{
  "schema_version": 1,
  "kind": "formal-package-inputs",
  "package_id": "reference-profile",
  "revision": "2",
  "tool_sha256": "5bd7b64db99ae4c6c35f290de5e809c0ee41af43f8699cf696099ffb6452b1e2",
  "license_id": "CC0-1.0",
  "description": "Complete selected asymmetric reference profile. Definitions and supplied fixtures are distinct from the three teaching specializations; review and qualification are stated in the bound evidence and release.",
  "transformation": "Typed neutral source, field and constructor mappings with exact retained source counterparts. Correspondence is limited to the selected finite contexts and documented provider/renderer assumptions; arbitrary character-string equivalence is not claimed.",
  "files": [
    {
      "path": "AbilityChecksMC.cfg",
      "sha256": "6e9454775c40569fa46829ab767ed562cdbf2e1cdf68ceb03c307c66b7d4bb42",
      "bytes": 47
    },
    {
      "path": "AbilityChecksMC.tla",
      "sha256": "82dc8b02fab1885c14c1621e1216651c29e18d53c92ebad885d8d77414e4d732",
      "bytes": 1709869
    },
    {
      "path": "AbilityContracts.tla",
      "sha256": "59e41e680fef411cbbca20e8e6ab96b7ddeaa23f5976b5f027056711508ea37d",
      "bytes": 582718
    },
    {
      "path": "AbilityProceduresMC.cfg",
      "sha256": "a8844a8d69dc0ffcf0391eaa1eb5106b3365a739f3a8eff7930bacf1edf7a6cc",
      "bytes": 110
    },
    {
      "path": "AbilityProceduresMC.tla",
      "sha256": "74d7e1733ae34828060ebd6a26c387263d61b9b3ec56820f41a3fdc396000a09",
      "bytes": 23093
    },
    {
      "path": "AbilityRegistry.tla",
      "sha256": "1a195ef151269ceca4d1711b21bf7e0bbcbd38f42733895002891669b42b86a5",
      "bytes": 13228
    },
    {
      "path": "ActionAdapters.tla",
      "sha256": "ccce32620cce3064d2e89e6ddb44181610d530fa31f469df4da19a6c88390771",
      "bytes": 10833
    },
    {
      "path": "ActionCompositionMC.cfg",
      "sha256": "9aabdf3f75442d5bf6879e01f6fb6126b3041e35b567ac960a2bb2304caa78bd",
      "bytes": 342
    },
    {
      "path": "ActionCompositionMC.tla",
      "sha256": "cd2ec2e6cbf10462b7f511dcbecff091b633ccb47bbdde2570f452c1245131cc",
      "bytes": 58517
    },
    {
      "path": "ActivityChecksMC.cfg",
      "sha256": "deff5bd9c79fab1cccb506237e1b2054749eeb463308f07d2e68fb41adbf2651",
      "bytes": 423
    },
    {
      "path": "ActivityChecksMC.tla",
      "sha256": "63b8cf583b0653d265267e85f2837226d2842e932dd145518b8971e94c0af69c",
      "bytes": 9121
    },
    {
      "path": "ActivityPublication.tla",
      "sha256": "f01f9581f182de4c72c2e8eddfbbd23459aa64721d1a3644a48cd8b21a375fa9",
      "bytes": 5024
    },
    {
      "path": "AdditionalChecksMC.cfg",
      "sha256": "5c2ecb7d4b74d41c8c63816db1b86e1104bf7ed0f4bbb8d0b48b2218cc75e782",
      "bytes": 49
    },
    {
      "path": "AdditionalChecksMC.tla",
      "sha256": "b4f84836f648321ef3421eb0a9407a01b04920ba5e9bd3d3d9b4a3817943809c",
      "bytes": 354264
    },
    {
      "path": "AdditionalContracts.tla",
      "sha256": "9f829795cf97ae2657eae5256235073f0b71b46c951ed2e2d35c1743b4f5d859",
      "bytes": 192058
    },
    {
      "path": "AdditionalProceduresMC.cfg",
      "sha256": "9a7a63687551220e44e586c54958b620b291554be2879b5b4974a4a1c7c14e77",
      "bytes": 94
    },
    {
      "path": "AdditionalProceduresMC.tla",
      "sha256": "2d2df837e93471471d147121423d85a61031e713e09bf32cb2ca6d5e23988406",
      "bytes": 9777
    },
    {
      "path": "BasicContracts.tla",
      "sha256": "2f2aac3e854727d3088ec82d6714dd9a042a796156c7c2ad30556f23dbffcaf2",
      "bytes": 10643
    },
    {
      "path": "CommitmentProbesMC.cfg",
      "sha256": "d67e6dcd76745ba39e470fd3586cc7fbb6da7a0cc7e55c6e74a805b3a43e5e56",
      "bytes": 60
    },
    {
      "path": "CommitmentProbesMC.tla",
      "sha256": "88165118d96f9e4590b3808fe98e5197657e1794320dd4d552920942a5498277",
      "bytes": 14982
    },
    {
      "path": "CommitmentPublicationMC.cfg",
      "sha256": "3c8abc70ab2c7beb8b06bdffea243b2a5eb689f157a578a65f43318e9fdc28d1",
      "bytes": 109
    },
    {
      "path": "CommitmentPublicationMC.tla",
      "sha256": "71899c0f71aff0d91b5dc528dc41f53d2d8f41e4e4307b7e0a9a63215c31a074",
      "bytes": 803
    },
    {
      "path": "CommittedCompositionMC.cfg",
      "sha256": "0a1666d0efeb1f81fa413fe914a8a86e43faee9d975861e02506eecc02481445",
      "bytes": 181
    },
    {
      "path": "CommittedCompositionMC.tla",
      "sha256": "d0b43166d487604f41c8baebd69b2f67b494d0a15b38b3bcb354d0008d5fcac2",
      "bytes": 37099
    },
    {
      "path": "CompletionOrderChecksMC.cfg",
      "sha256": "8e81319543388b700a94761e264b5491cd4e82a96c11174cf3bf90246a0d519a",
      "bytes": 338
    },
    {
      "path": "CompletionOrderChecksMC.tla",
      "sha256": "e234bc2966db32dc7f21631006b91ba331362eed4ce884296b2444d81bacb642",
      "bytes": 5362
    },
    {
      "path": "CompletionPublicationVariantMC-defective.cfg",
      "sha256": "996c0c825c57fdd7af258b6f2cc53f75a97e7d4edb66f8b369305c2e97fcde64",
      "bytes": 369
    },
    {
      "path": "CompletionPublicationVariantMC-ordinary.cfg",
      "sha256": "9aabdf3f75442d5bf6879e01f6fb6126b3041e35b567ac960a2bb2304caa78bd",
      "bytes": 342
    },
    {
      "path": "CompletionPublicationVariantMC.tla",
      "sha256": "403a1d3cccdf377772203c80d0f20a678b1b87055e256be68be5528b114768cb",
      "bytes": 81
    },
    {
      "path": "CompositionOracle.tla",
      "sha256": "cffaccef75f97bfc4dc38dba4e6e3ab54c08d0dcd70e36ff0f8e270f31ffbd7b",
      "bytes": 2661
    },
    {
      "path": "ConnectedTimingMC.cfg",
      "sha256": "f372611225dbfe8bb628211c03894bb9064cbb753e51a1c6ef7b2e2b3cc8ac43",
      "bytes": 98
    },
    {
      "path": "ConnectedTimingMC.tla",
      "sha256": "76301535287a9eba9fc4816c8c0307bc5a40ce6a157450b416da8854f18659ca",
      "bytes": 37330
    },
    {
      "path": "ConnectionFacts.tla",
      "sha256": "09e7fd4998a0c1f51b0dd47ca205ce24afe3c3c80391deb3da4e078a787eb916",
      "bytes": 1542
    },
    {
      "path": "ControlChecksMC.cfg",
      "sha256": "2648a783b24f28b4cc0f5262e5166569542674e69900dbab6a8dd53334fadae4",
      "bytes": 302
    },
    {
      "path": "ControlChecksMC.tla",
      "sha256": "6f585c50d223c66746c50218775a2720dd3987526f27e99af29eeb265163622b",
      "bytes": 3787
    },
    {
      "path": "CostClampVariantMC-defective.cfg",
      "sha256": "33077fa910f597f9f7ac818c2852b554eb46f92f8da1e0235369005545e6c3a5",
      "bytes": 96
    },
    {
      "path": "CostClampVariantMC-ordinary.cfg",
      "sha256": "d46f696843f2891c75fb66d94d79cac514fb05c87e51c8962fe614c2375afaf1",
      "bytes": 43
    },
    {
      "path": "CostClampVariantMC.tla",
      "sha256": "addd7159d168cb4cbbdaa10675a97861592d33cf0c39619cf1378e8d5d538850",
      "bytes": 177
    },
    {
      "path": "DefinitionChecksMC.cfg",
      "sha256": "d46f696843f2891c75fb66d94d79cac514fb05c87e51c8962fe614c2375afaf1",
      "bytes": 43
    },
    {
      "path": "DefinitionChecksMC.tla",
      "sha256": "ae3d8d50f518f766c7e6556712ed4f1d5cbeabefb5c34c59e3093e2025c282a5",
      "bytes": 13055
    },
    {
      "path": "DetachedChecksMC.cfg",
      "sha256": "7c20c25229102a9c286816fd3afc3b7b3cf0f4fb075f3439715429c0f84deedf",
      "bytes": 303
    },
    {
      "path": "DetachedChecksMC.tla",
      "sha256": "d61e29f12edfd1db007de35bb6ce64571cc2ca37f5c5eb789c1d489759a8e031",
      "bytes": 6325
    },
    {
      "path": "HostingChecksMC.cfg",
      "sha256": "aaf7d55b612c5ffdbb957e00fc34651d00809bb2f139bf6bdf4c93c6411b72a7",
      "bytes": 302
    },
    {
      "path": "HostingChecksMC.tla",
      "sha256": "86ac889f39bc28462782d7a767263360d204676c590c5755a9710fbb96f5de76",
      "bytes": 1985
    },
    {
      "path": "IdentityRenewalVariantMC-defective.cfg",
      "sha256": "81ee7f6040909e9ebbe551451504460d81efe05385999a27937eaa4ababf732b",
      "bytes": 403
    },
    {
      "path": "IdentityRenewalVariantMC-ordinary.cfg",
      "sha256": "db944b834eac0bfcf340733d27306ce476103e92051aec0de6d698236379ae5e",
      "bytes": 348
    },
    {
      "path": "IdentityRenewalVariantMC.tla",
      "sha256": "b7ba44c13cfcdbccd4fac82f33c4654489552343de1f28132f34a75cd6d87f94",
      "bytes": 2849
    },
    {
      "path": "InspectionChecksMC.cfg",
      "sha256": "7d7a4e8163cbfeef467c3f26765eb2f1eb8c26c22829d1ee459e5e57bba5e3ed",
      "bytes": 47
    },
    {
      "path": "InspectionChecksMC.tla",
      "sha256": "c53d75b501a2f211edd4c2e79c296db8d2da5e25a03f91656909e27cebb6af26",
      "bytes": 41516
    },
    {
      "path": "InspectionContracts.tla",
      "sha256": "0a75a472db592cf3a38880d44533ec24955652ff69f77bf3049e831f974c3cfc",
      "bytes": 34222
    },
    {
      "path": "InspectionProceduresMC.cfg",
      "sha256": "21dba6d4586cf38774c45e9124a8e6d831c58f5ba8b050a6d94a4d95a9cf29c1",
      "bytes": 93
    },
    {
      "path": "InspectionProceduresMC.tla",
      "sha256": "96e563d3f944ca6088c959631a9610a8c2b2653bba8a1f182fbb48b3e645bf8e",
      "bytes": 11874
    },
    {
      "path": "InspectionTimingAssertions.cfg",
      "sha256": "c5fa9cac06dacebd9deb6570f9e952c8419985ce71d16236173e54eede115a1b",
      "bytes": 80
    },
    {
      "path": "InspectionTimingMC.cfg",
      "sha256": "dcd5068261c59e3cb41575bab702b6cb6969b011031207e6a8be6cdbe4362a4a",
      "bytes": 120
    },
    {
      "path": "InspectionTimingMC.tla",
      "sha256": "3f08d2dfada7581d18e33a654fc0f24987071d816c3d7e282f4c7c962e86c112",
      "bytes": 27959
    },
    {
      "path": "InterruptConditionVariantMC-defective.cfg",
      "sha256": "ed576f075eac29b73a901cccec2e9a8ea2b8f731aa8631abf755f5b9d86fb790",
      "bytes": 116
    },
    {
      "path": "InterruptConditionVariantMC-ordinary.cfg",
      "sha256": "6e9454775c40569fa46829ab767ed562cdbf2e1cdf68ceb03c307c66b7d4bb42",
      "bytes": 47
    },
    {
      "path": "InterruptConditionVariantMC.tla",
      "sha256": "c324eba1c8467ba4cf549d6d5fa1aee64c37170780b3675f01cb9b0525576612",
      "bytes": 220
    },
    {
      "path": "ItemTimingAssertions.cfg",
      "sha256": "717dbac158555da7b415628033d0b909644504fe1baa4fbe74bd16aedb2c06e0",
      "bytes": 88
    },
    {
      "path": "ItemTimingMC.cfg",
      "sha256": "e95873fccda01c4de0fe7529e5ddb61c05de498de432e2b3873cc8c2338372d9",
      "bytes": 224
    },
    {
      "path": "ItemTimingMC.tla",
      "sha256": "4b22c7380b671bf7166f2c4d31bba77fb05271ef298be204a28303ca12e51f3f",
      "bytes": 52817
    },
    {
      "path": "LocationChecksMC.cfg",
      "sha256": "4ec7de9556bef94337026ece2c87b4e469b3f36f38c8ec4cb42ba6a2c6ff8340",
      "bytes": 47
    },
    {
      "path": "LocationChecksMC.tla",
      "sha256": "ee4092275f8ae657bc6c746477cfe93004f0becc8e2f6cf7f89b85384a120e0b",
      "bytes": 32936
    },
    {
      "path": "LocationContracts.tla",
      "sha256": "943c271c683e41188f22bbd5908d01730ad785a356817243105ca86c86431727",
      "bytes": 30779
    },
    {
      "path": "ObjectRuntime.tla",
      "sha256": "db1125c89f6a025226216f1a09f7ba5fc2989039dc09975cbddea0c69e5c0d75",
      "bytes": 34579
    },
    {
      "path": "ObjectiveChecksMC.cfg",
      "sha256": "3bbcd5bb20647c80ac850813f9ee1761f529499e66e48a7171eff7f8c6c9ddf1",
      "bytes": 310
    },
    {
      "path": "ObjectiveChecksMC.tla",
      "sha256": "41296000a751f83472ac54c04d87e4bac63a5c42480bc67e24db94a5ccd8d6e8",
      "bytes": 2943
    },
    {
      "path": "OperationAdmissionVariantMC-defective.cfg",
      "sha256": "541588227d7fce81cb63bddb2d20b779e56f6210d2e0d6a906763be1224e750c",
      "bytes": 111
    },
    {
      "path": "OperationAdmissionVariantMC-ordinary.cfg",
      "sha256": "9ffbd41ddef7d5d024670b0c641f0d65f2211fe9d2475e8bec83deb20fa37fc1",
      "bytes": 47
    },
    {
      "path": "OperationAdmissionVariantMC.tla",
      "sha256": "cf746959796686382a7ac6d21474e830d7cb87323d21d2b19da8931a024396c4",
      "bytes": 504
    },
    {
      "path": "OperationChecksMC.cfg",
      "sha256": "9ffbd41ddef7d5d024670b0c641f0d65f2211fe9d2475e8bec83deb20fa37fc1",
      "bytes": 47
    },
    {
      "path": "OperationChecksMC.tla",
      "sha256": "9214b5868e4c2472ece3fdc53c86f94e901ef6eed5bc3403e960d03b40ed4c8e",
      "bytes": 67846
    },
    {
      "path": "OperationContracts.tla",
      "sha256": "a8db694bea6c3a78a597ed0175f1c31f4d51898546301074502c36f0a1a7f85e",
      "bytes": 67416
    },
    {
      "path": "OperationProceduresMC.cfg",
      "sha256": "c4b0c1b88a5e30b3be4e7ce3fad51fafaf6234a0c931b810834518e530a92016",
      "bytes": 89
    },
    {
      "path": "OperationProceduresMC.tla",
      "sha256": "ecd7aebafacf15ca04bce38b14edb53cc260525ce89733b3435ca6ec289ea7fe",
      "bytes": 11207
    },
    {
      "path": "PendingChecksMC.cfg",
      "sha256": "0422fdaf81e5d4fbab46de926d3c51f06ff3e91c3d884509bc5b181bc731eadc",
      "bytes": 334
    },
    {
      "path": "PendingChecksMC.tla",
      "sha256": "6478e7af94695eed86272b7f5a2e0179f576d3cfae7c93cf756690e6112009bd",
      "bytes": 31245
    },
    {
      "path": "PersistentChecksMC.cfg",
      "sha256": "e9c590da2e7170890b7453d4305fb57c2a15dfb8842f8cb2eb75e31a11d93836",
      "bytes": 106
    },
    {
      "path": "PersistentChecksMC.tla",
      "sha256": "5387c45ed9df211075b3e3d5f715aaa486c96f318cb3080f424db94b99cceecc",
      "bytes": 39628
    },
    {
      "path": "Reactive-completion-reaction.cfg",
      "sha256": "8ff466544acdb3d1a64636c8fbb6cc73bc6dfb4661f24bd4cfc4f0dde65ca3d2",
      "bytes": 356
    },
    {
      "path": "Reactive-cost-reaction.cfg",
      "sha256": "fa592b20ef94aaea049f850d0e3464dc3fb50d5055fa907db80c8430f38184f7",
      "bytes": 350
    },
    {
      "path": "RegistryAvailabilityMC.cfg",
      "sha256": "d99248d3e9eddfca312a71e851ee995a94660ef47afc7982549a87f2ec53bd70",
      "bytes": 418
    },
    {
      "path": "RegistryAvailabilityMC.tla",
      "sha256": "b5bcc299b40bfdaf13fd4aa2cb6f5deb881167bfa0054fc036f13c49f2dc91ab",
      "bytes": 56468
    },
    {
      "path": "RegistryChecksMC.cfg",
      "sha256": "2f9d4f85a8b56a43ea9d50c77adacdbc66063f287cfaeed166f8b0fc506b2fec",
      "bytes": 130
    },
    {
      "path": "RegistryChecksMC.tla",
      "sha256": "e36816f68d5791a232d9ac87f752966da847a56340c8ced0f4f58c0514da947e",
      "bytes": 13615
    },
    {
      "path": "RegistryCompositionMC.cfg",
      "sha256": "ab10c0aff2730452b875d6c155c82a89e175593f51559b3732d2d008736a1876",
      "bytes": 181
    },
    {
      "path": "RegistryCompositionMC.tla",
      "sha256": "3a2f9bd5da4148216515de693ab9cd82ac415d091344ac61dc9c30a3c48b9e47",
      "bytes": 38454
    },
    {
      "path": "RegistryUniquenessVariantMC-defective.cfg",
      "sha256": "26ed3eacefcbbfe1c3ffc22e923cf35aab2dc4aac38ef4ce5a5a63b4caed04bc",
      "bytes": 194
    },
    {
      "path": "RegistryUniquenessVariantMC-ordinary.cfg",
      "sha256": "2f9d4f85a8b56a43ea9d50c77adacdbc66063f287cfaeed166f8b0fc506b2fec",
      "bytes": 130
    },
    {
      "path": "RegistryUniquenessVariantMC.tla",
      "sha256": "6306906d4d145dfcf83b13bdb96b3c61a14525804310bb2116adc1d60ef743c6",
      "bytes": 464
    },
    {
      "path": "RetirementChecksMC.cfg",
      "sha256": "296c61bc8f04a05c373d5aa9876231aceff10b5244f0c07e805d09e2ab31ca66",
      "bytes": 298
    },
    {
      "path": "RetirementChecksMC.tla",
      "sha256": "290a89fe0e05d4a0f3bbad2e04a7a8eccfa5bd60843d0cc2515dc5a06e6b6f92",
      "bytes": 2573
    },
    {
      "path": "RuntimeChecksMC.cfg",
      "sha256": "361161cbc5064316d45899aedafbaf22b10991c99087fe99b3c0b56e8d2f9fb5",
      "bytes": 306
    },
    {
      "path": "RuntimeChecksMC.tla",
      "sha256": "aaf1b0fd2946d2ea1a3abde9d4f7feb313ba55d3cd6f0bf1b0b71435cc18b001",
      "bytes": 14692
    },
    {
      "path": "SchedulerChecksMC.cfg",
      "sha256": "1688a6f5253ef0fa7b2f3f5f5f044aa81db591bfa8c599def2f4fc6a106033bd",
      "bytes": 60
    },
    {
      "path": "SchedulerChecksMC.tla",
      "sha256": "083261ec58b1474c18dce6c87dbf2e939d90a909975fd66947a95ca557c91217",
      "bytes": 44369
    },
    {
      "path": "SchedulerOracle.tla",
      "sha256": "01bfbe67a462872e94b83ea45e0aadde384911ce703a94df5758add15ce80c2e",
      "bytes": 34406
    },
    {
      "path": "SchemaChecksMC.cfg",
      "sha256": "e9e669f1c73b08a22e0ccad65a8973beb7d95f7c35af015a484c840550c5690e",
      "bytes": 47
    },
    {
      "path": "SchemaChecksMC.tla",
      "sha256": "af8639139ffe226dae51dcc18f5f6b028f088b16e6a17d14fea72253a137236b",
      "bytes": 31574
    },
    {
      "path": "SchemaContracts.tla",
      "sha256": "2f26f6a745bd228e6ee2a0df520174e8700be8d9e05837d63352d08a53d80896",
      "bytes": 23273
    },
    {
      "path": "SettlementFacts.tla",
      "sha256": "84e6c6ceb1bdee5c882e49a3aea85ea7efad91be3354bda6ba810ddc6c41b5f5",
      "bytes": 963
    },
    {
      "path": "SetupChecksMC.cfg",
      "sha256": "d11b4651ffeba017970654202a6067a638d8fbae758fedd9371470dd4d05b26c",
      "bytes": 212
    },
    {
      "path": "SetupChecksMC.tla",
      "sha256": "bf3738bf4592a6c7bb5004300f408744d0a49a62ad6e5a07d9029878a22cca71",
      "bytes": 4572
    },
    {
      "path": "SetupContracts.tla",
      "sha256": "95d88e09ed60aaad65de312fcab2e3cabc019b4f7cf3749cfc694865d2c3d440",
      "bytes": 15414
    },
    {
      "path": "SideATurnTiming.cfg",
      "sha256": "7455e9b05c321d8cbfca17bec1f05ad772c038d94d145604b0e8f663b0ffe601",
      "bytes": 105
    },
    {
      "path": "SideBTurnTiming.cfg",
      "sha256": "b6b527701137a4035f332073e93c9b847570ec802b0682352583e16ae3a09905",
      "bytes": 105
    },
    {
      "path": "SpecimenFactsA.tla",
      "sha256": "330ff5ce458018b321cb65045d67e2b38498bfbefd1c635784331b8573b07a42",
      "bytes": 30060
    },
    {
      "path": "SpecimenFactsB.tla",
      "sha256": "3535d0d4ceef69b9818a7fad48f1cc054735ae09a067f67b03e80c3112d055fc",
      "bytes": 23877
    },
    {
      "path": "TargetChecksMC.cfg",
      "sha256": "dfd8e4ee0a751d36517a70fb5262fcb3cde283b557704d5569ff89099108f627",
      "bytes": 298
    },
    {
      "path": "TargetChecksMC.tla",
      "sha256": "d1e213594dccd899ce0697a1f0c3b682698eda43b28050ffe1c15e7c8cbf21b3",
      "bytes": 4636
    },
    {
      "path": "TraversalChecksMC.cfg",
      "sha256": "98fdc8ecf21ac4f8cbe54b9a336ddff10c13b78ec5ba227c438da215a17fed24",
      "bytes": 47
    },
    {
      "path": "TraversalChecksMC.tla",
      "sha256": "f584f0f3ad852ed860f54b2813acd5b8c9c1e7546e72bcd7a553a5081747ab67",
      "bytes": 45396
    },
    {
      "path": "TraversalContracts.tla",
      "sha256": "0787b29b22641c0a26c9e7e918190787a788a6046448eb0f5bdb35298a759ebf",
      "bytes": 60813
    },
    {
      "path": "TraversalIdentityVariantMC-defective.cfg",
      "sha256": "868a2048f6cbd856d68fb2b757950f3fd6b70e7f9dbe37cdf0cd9c3a192d77e9",
      "bytes": 116
    },
    {
      "path": "TraversalIdentityVariantMC-ordinary.cfg",
      "sha256": "98fdc8ecf21ac4f8cbe54b9a336ddff10c13b78ec5ba227c438da215a17fed24",
      "bytes": 47
    },
    {
      "path": "TraversalIdentityVariantMC.tla",
      "sha256": "2c34344f9054fa6e1c91506fd113a3e7c17904356f518acf6e790f5f918b535f",
      "bytes": 205
    },
    {
      "path": "TraversalProceduresMC.cfg",
      "sha256": "daac1cd5a6739608ac52b8b34cc41e66d3c191112f9473236c13f3d51b379c41",
      "bytes": 89
    },
    {
      "path": "TraversalProceduresMC.tla",
      "sha256": "dc886b8f28f6d388e89c25d3392141dde93f342945e2446eaeed8c01ea52ed95",
      "bytes": 18026
    },
    {
      "path": "TraversalTimingAssertions.cfg",
      "sha256": "8bb8b5bcba3ecb76b79624fb4779cbe4d390890fb1ecb27bd2c21269ec5f5b2a",
      "bytes": 78
    },
    {
      "path": "TraversalTimingMC.cfg",
      "sha256": "d0a08aef1a4c9a16b7eda5444f9005d60678af44eebd1fdd80ebfe9721c11bd7",
      "bytes": 117
    },
    {
      "path": "TraversalTimingMC.tla",
      "sha256": "d9fffa0f1e2fdb7befc2e1cfc03fe7ce6d119209bf78eb00672ce756614636bd",
      "bytes": 47529
    },
    {
      "path": "TurnChecksMC.cfg",
      "sha256": "88a15af436c0cd7041311cabbc0d7da34b1304e1bb94942bbef4b8fcccfae0e1",
      "bytes": 47
    },
    {
      "path": "TurnChecksMC.tla",
      "sha256": "8859da36f7412877fbe01364c08d08626224da10955103945595d23cd62c41ed",
      "bytes": 19565
    },
    {
      "path": "TurnContracts.tla",
      "sha256": "0e74f4d2765fa94aa8949a93458b11f6edaf79aa9eb153aca400ead6363e677b",
      "bytes": 26396
    },
    {
      "path": "TurnHandoffVariantMC-defective.cfg",
      "sha256": "a52ee1e124b8ef31d30d80a9edd0f7e1a8701a92ef095c34e5b5389dff2dd9f0",
      "bytes": 106
    },
    {
      "path": "TurnHandoffVariantMC-ordinary.cfg",
      "sha256": "88a15af436c0cd7041311cabbc0d7da34b1304e1bb94942bbef4b8fcccfae0e1",
      "bytes": 47
    },
    {
      "path": "TurnHandoffVariantMC.tla",
      "sha256": "3b31f4f82c5f8c6e71e997237faab1537eefd5a1a5aac09346eb95fd0180adf8",
      "bytes": 111
    },
    {
      "path": "TurnProceduresMC.cfg",
      "sha256": "40258761da0d2907d2d9e84c46f94534adcdadaa9c8675ccd5d3f7e492745290",
      "bytes": 79
    },
    {
      "path": "TurnProceduresMC.tla",
      "sha256": "5d84c21df7f344310a7e8c5cdf81fdf23df1f5a769fed141b2e15ae3b2ff2a95",
      "bytes": 8627
    },
    {
      "path": "TypeChecksMC.cfg",
      "sha256": "6bdfd510cdff9509d5912b321f258e30b7e70126e085089f408757480de8ca4e",
      "bytes": 47
    },
    {
      "path": "TypeChecksMC.tla",
      "sha256": "90546d6158d3b8a52ff708bbb21e9ecb3b9bf5d8910687d0c46273e9e7821c62",
      "bytes": 38906
    },
    {
      "path": "TypeContracts.tla",
      "sha256": "f79dbc7032119426400f52106b3f68a966a1f985cdde8cd409f21e45f58ae113",
      "bytes": 23772
    },
    {
      "path": "TypeOwnershipVariantMC-defective.cfg",
      "sha256": "ff570aa4abe228216761efe85e0ab1cd59fb5c2c93f7cc1d321cded043ba983b",
      "bytes": 124
    },
    {
      "path": "TypeOwnershipVariantMC-ordinary.cfg",
      "sha256": "6bdfd510cdff9509d5912b321f258e30b7e70126e085089f408757480de8ca4e",
      "bytes": 47
    },
    {
      "path": "TypeOwnershipVariantMC.tla",
      "sha256": "caa394227577195a56733989dd3dc5827c77156be4d8dfc7396e7b972759ad9c",
      "bytes": 156
    },
    {
      "path": "UnitChecksMC.cfg",
      "sha256": "e4495f2cbd4aa39923ea2742a0f5341282e5dd348e469a098abbee5d10dd3836",
      "bytes": 302
    },
    {
      "path": "UnitChecksMC.tla",
      "sha256": "bb1eeb37de8ddd0768b24d0473bcf32b44fa002aaaf2352ab8f17d857e095f2e",
      "bytes": 4183
    },
    {
      "path": "VisibilityChecksMC.cfg",
      "sha256": "7d84dd9dbb9dc774c0bbd74603c7c4e2685fbbc3d716f0414dc6b9172779c07e",
      "bytes": 314
    },
    {
      "path": "VisibilityChecksMC.tla",
      "sha256": "3e4b944779ee16376e77a41fe7c07cfee3cdce3165bb5e9b0c95bc925c824939",
      "bytes": 2742
    }
  ],
  "models": [
    {
      "id": "ref-action-composition",
      "module": "ActionCompositionMC",
      "config": "ActionCompositionMC.cfg",
      "expected_exit": 0,
      "outcome": "success",
      "properties": [
        "ASourceSafety",
        "AActionPaymentSafety",
        "ACheckpointSafety",
        "AStepSafety",
        "ACompletionSafety",
        "AHistorySafety",
        "AOuterSafety",
        "AEventuallyReturns"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "ActionCompositionMC.cfg",
        "constants": [
          [
            "AScenario",
            "\"empty\""
          ],
          [
            "AMutation",
            "\"none\""
          ],
          [
            "PaidAmounts",
            "{ 0 }"
          ],
          [
            "PaidMoves",
            "{ FALSE }"
          ]
        ],
        "definition_overrides": {},
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 512,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "Applicable costs, permissions, allocation and valid candidate/payment witnesses are the exact supplied finite fixtures; no general payment interpreter is supplied.",
        "Outer schedules, procedure adapters, provider facts, metadata and exact caller/transaction/receipt identities are the selected finite composition fixtures."
      ],
      "fairness": [
        "ASpec == AInit /\\ [][ANext]_<<guideCaseT11,qT11>> /\\ WF_<<guideCaseT11,qT11>>(ANext)"
      ],
      "warnings": [],
      "max_seconds": 90,
      "evidence_class": "finite-state-exploration",
      "check_deadlock": true,
      "description": "ordinary finite model. Underlying ordinary program: finite transition exploration with state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model."
    },
    {
      "id": "ref-activity-checks",
      "module": "ActivityChecksMC",
      "config": "ActivityChecksMC.cfg",
      "expected_exit": 0,
      "outcome": "success",
      "properties": [
        "APublicationSafety",
        "AHistoricalSafety",
        "AEpochSafety",
        "ANativeActivitySafety",
        "ANativeCatalogSafety",
        "ARejectionSafety",
        "AEventuallyPublished"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "ActivityChecksMC.cfg",
        "constants": [
          [
            "ActivityProfiles",
            "{ \"permission\" , \"conditional-entry\" , \"paid-entry\" , \"alternating\" , \"decoy-permission\" , \"overlap\" }"
          ],
          [
            "PaidAmounts",
            "{ 0 , 1 }"
          ],
          [
            "PaidMoves",
            "{ TRUE , FALSE }"
          ]
        ],
        "definition_overrides": {},
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 512,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "Registered role/zone/event constructors, normalized source/provenance identities, provider facts and pinned renderer behavior are restricted to the selected finite contexts."
      ],
      "fairness": [
        "ASpec == AInit /\\ [][ANext]_<<qT11,registryCaseSA,guideCaseT11>> /\\ WF_<<qT11,registryCaseSA,guideCaseT11>>(ANext)"
      ],
      "warnings": [],
      "max_seconds": 90,
      "evidence_class": "finite-state-exploration",
      "check_deadlock": false,
      "description": "ordinary finite model. Underlying ordinary program: finite transition exploration with state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model."
    },
    {
      "id": "ref-detached-checks",
      "module": "DetachedChecksMC",
      "config": "DetachedChecksMC.cfg",
      "expected_exit": 0,
      "outcome": "success",
      "properties": [
        "DSafety",
        "DEventuallyDone"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "DetachedChecksMC.cfg",
        "constants": [
          [
            "DetachedProfiles",
            "{ \"none\" , \"imminent-permission\" , \"imminent-entry\" , \"resolving-permission\" , \"resolving-entry\" }"
          ],
          [
            "PendingProfiles",
            "{ \"no-loss\" }"
          ],
          [
            "PaidAmounts",
            "{ 0 , 1 }"
          ],
          [
            "PaidMoves",
            "{ TRUE , FALSE }"
          ]
        ],
        "definition_overrides": {},
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 512,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "Registered role/zone/event constructors, normalized source/provenance identities, provider facts and pinned renderer behavior are restricted to the selected finite contexts."
      ],
      "fairness": [
        "DSpec == DInit /\\ [][DNext]_<<qT11,registryCaseSA,guideCaseT11>> /\\ WF_<<qT11,registryCaseSA,guideCaseT11>>(DNext)"
      ],
      "warnings": [],
      "max_seconds": 90,
      "evidence_class": "finite-state-exploration",
      "check_deadlock": false,
      "description": "ordinary finite model. Underlying ordinary program: finite transition exploration with state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model."
    },
    {
      "id": "ref-pending-checks",
      "module": "PendingChecksMC",
      "config": "PendingChecksMC.cfg",
      "expected_exit": 0,
      "outcome": "success",
      "properties": [
        "U4Safety",
        "U4PendingSafety",
        "U4CaptureSafety",
        "U4DoneSafety",
        "U4EventuallyDone"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "PendingChecksMC.cfg",
        "constants": [
          [
            "PendingProfiles",
            "{ \"no-loss\" , \"permission-restore\" , \"entry-restore\" , \"permission-drain\" , \"entry-drain\" }"
          ],
          [
            "PaidAmounts",
            "{ 0 , 1 }"
          ],
          [
            "PaidMoves",
            "{ TRUE , FALSE }"
          ]
        ],
        "definition_overrides": {},
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 512,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "Registered role/zone/event constructors, normalized source/provenance identities, provider facts and pinned renderer behavior are restricted to the selected finite contexts."
      ],
      "fairness": [
        "U4Spec == U4Init /\\ [][U4Next]_<<qT11,registryCaseSA,guideCaseT11>> /\\ WF_<<qT11,registryCaseSA,guideCaseT11>>(U4Next)"
      ],
      "warnings": [],
      "max_seconds": 90,
      "evidence_class": "finite-state-exploration",
      "check_deadlock": false,
      "description": "ordinary finite model. Underlying ordinary program: finite transition exploration with state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model."
    },
    {
      "id": "ref-additional-checks",
      "module": "AdditionalChecksMC",
      "config": "AdditionalChecksMC.cfg",
      "expected_exit": 0,
      "outcome": "success",
      "properties": [
        "Block10Assertions"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "AdditionalChecksMC.cfg",
        "constants": [],
        "definition_overrides": {},
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 512,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "Activity, legality, current-effect, payment and exact caller/child completion witnesses are supplied in the selected model; external ability interpretation is outside scope.",
        "Outer schedules, procedure adapters, provider facts, metadata and exact caller/transaction/receipt identities are the selected finite composition fixtures."
      ],
      "fairness": [],
      "warnings": [],
      "max_seconds": 90,
      "evidence_class": "prepared-assertions",
      "check_deadlock": true,
      "description": "ordinary finite model. Underlying ordinary program: prepared/pointwise assertion fixture; no reached state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model."
    },
    {
      "id": "ref-persistent-checks",
      "module": "PersistentChecksMC",
      "config": "PersistentChecksMC.cfg",
      "expected_exit": 0,
      "outcome": "success",
      "properties": [
        "PersistentFrontierAssertions103",
        "DeliveredPersistent103"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "PersistentChecksMC.cfg",
        "constants": [],
        "definition_overrides": {},
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 512,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "Activity, legality, current-effect, payment and exact caller/child completion witnesses are supplied in the selected model; external ability interpretation is outside scope."
      ],
      "fairness": [
        "SpecPersistent103 == InitPersistent103 /\\ [][NextPersistent103]_p103 /\\ WF_p103(WorkPersistent103)"
      ],
      "warnings": [],
      "max_seconds": 90,
      "evidence_class": "finite-state-exploration",
      "check_deadlock": true,
      "description": "ordinary finite model. Underlying ordinary program: finite transition exploration with state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model."
    },
    {
      "id": "ref-additional-procedures",
      "module": "AdditionalProceduresMC",
      "config": "AdditionalProceduresMC.cfg",
      "expected_exit": 0,
      "outcome": "success",
      "properties": [
        "Safety10p",
        "EventuallyReturned10p"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "AdditionalProceduresMC.cfg",
        "constants": [],
        "definition_overrides": {},
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 512,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "Activity, legality, current-effect, payment and exact caller/child completion witnesses are supplied in the selected model; external ability interpretation is outside scope."
      ],
      "fairness": [
        "Spec10p == Init10p /\\ [][Next10p]_vars10p /\\ WF_vars10p(ActiveWork10p)"
      ],
      "warnings": [],
      "max_seconds": 90,
      "evidence_class": "finite-state-exploration",
      "check_deadlock": false,
      "description": "ordinary finite model. Underlying ordinary program: finite transition exploration with state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model."
    },
    {
      "id": "ref-objective-checks",
      "module": "ObjectiveChecksMC",
      "config": "ObjectiveChecksMC.cfg",
      "expected_exit": 0,
      "outcome": "success",
      "properties": [
        "TypeOK",
        "PhysicalUniqueness",
        "HostIntegrity",
        "ObjectiveAssertions",
        "ObjectiveCompleted"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "ObjectiveChecksMC.cfg",
        "constants": [
          [
            "CardData <- Data"
          ],
          [
            "InitialState <- DummyInitial"
          ],
          [
            "Commands <- ObjectiveCommands"
          ],
          [
            "CardOverride <- NoOverride"
          ],
          [
            "CheckpointOverrideAllowed <- NoCheckpointOverride"
          ]
        ],
        "definition_overrides": {
          "CardData": "Data",
          "CardOverride": "NoOverride",
          "CheckpointOverrideAllowed": "NoCheckpointOverride",
          "Commands": "ObjectiveCommands",
          "InitialState": "DummyInitial"
        },
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 512,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "The selected phase schedule, objective values and completion/checkpoint providers are supplied exactly; no complete-game or arbitrary-scheduler progress claim is made."
      ],
      "fairness": [
        "ObjectiveSpec == ObjectiveInit /\\ [][ObjectiveNext]_mcvars /\\ WF_pc(pc = 0 /\\ pc' = 1)"
      ],
      "warnings": [],
      "max_seconds": 90,
      "evidence_class": "finite-state-exploration",
      "check_deadlock": true,
      "description": "ordinary finite model. Underlying ordinary program: finite transition exploration with state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model."
    },
    {
      "id": "ref-completion-order-checks",
      "module": "CompletionOrderChecksMC",
      "config": "CompletionOrderChecksMC.cfg",
      "expected_exit": 0,
      "outcome": "success",
      "properties": [
        "TypeOK",
        "PhysicalUniqueness",
        "HostIntegrity",
        "CheckpointAssertions",
        "CheckpointCompleted"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "CompletionOrderChecksMC.cfg",
        "constants": [
          [
            "CardData <- Data"
          ],
          [
            "InitialState <- DummyInitial"
          ],
          [
            "Commands <- CheckpointTestCommands"
          ],
          [
            "CardOverride <- CheckpointTestOverride"
          ],
          [
            "CheckpointOverrideAllowed <- SpecificCheckpointPermission"
          ]
        ],
        "definition_overrides": {
          "CardData": "Data",
          "CardOverride": "CheckpointTestOverride",
          "CheckpointOverrideAllowed": "SpecificCheckpointPermission",
          "Commands": "CheckpointTestCommands",
          "InitialState": "DummyInitial"
        },
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 512,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "Outer schedules, procedure adapters, provider facts, metadata and exact caller/transaction/receipt identities are the selected finite composition fixtures."
      ],
      "fairness": [
        "CheckpointSpec ==\n    CheckpointInit /\\ [][CheckpointNext]_mcvars /\\ WF_mcvars(CheckpointProgress)"
      ],
      "warnings": [],
      "max_seconds": 90,
      "evidence_class": "finite-state-exploration",
      "check_deadlock": true,
      "description": "ordinary finite model. Underlying ordinary program: finite transition exploration with state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model."
    },
    {
      "id": "ref-control-checks",
      "module": "ControlChecksMC",
      "config": "ControlChecksMC.cfg",
      "expected_exit": 0,
      "outcome": "success",
      "properties": [
        "TypeOK",
        "PhysicalUniqueness",
        "HostIntegrity",
        "ControlAssertions",
        "ControlCompleted"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "ControlChecksMC.cfg",
        "constants": [
          [
            "CardData <- Data"
          ],
          [
            "InitialState <- DummyInitial"
          ],
          [
            "Commands <- ControlCommands"
          ],
          [
            "CardOverride <- NoOverride"
          ],
          [
            "CheckpointOverrideAllowed <- NoCheckpointOverride"
          ]
        ],
        "definition_overrides": {
          "CardData": "Data",
          "CardOverride": "NoOverride",
          "CheckpointOverrideAllowed": "NoCheckpointOverride",
          "Commands": "ControlCommands",
          "InitialState": "DummyInitial"
        },
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 512,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "Object identifiers, ownership/control, relocation and visibility inputs are well-shaped finite records in this profile; general information noninterference is outside scope."
      ],
      "fairness": [
        "ControlSpec == ControlInit /\\ [][ControlNext]_mcvars /\\ WF_pc(pc = 0 /\\ pc' = 1)"
      ],
      "warnings": [],
      "max_seconds": 90,
      "evidence_class": "finite-state-exploration",
      "check_deadlock": true,
      "description": "ordinary finite model. Underlying ordinary program: finite transition exploration with state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model."
    },
    {
      "id": "ref-unit-checks",
      "module": "UnitChecksMC",
      "config": "UnitChecksMC.cfg",
      "expected_exit": 0,
      "outcome": "success",
      "properties": [
        "TypeOK",
        "PhysicalUniqueness",
        "HostIntegrity",
        "CounterAssertions",
        "CounterCompleted"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "UnitChecksMC.cfg",
        "constants": [
          [
            "CardData <- Data"
          ],
          [
            "InitialState <- DummyInitial"
          ],
          [
            "Commands <- CounterCommands"
          ],
          [
            "CardOverride <- NoOverride"
          ],
          [
            "CheckpointOverrideAllowed <- NoCheckpointOverride"
          ]
        ],
        "definition_overrides": {
          "CardData": "Data",
          "CardOverride": "NoOverride",
          "CheckpointOverrideAllowed": "NoCheckpointOverride",
          "Commands": "CounterCommands",
          "InitialState": "DummyInitial"
        },
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 512,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "Applicable costs, permissions, allocation and valid candidate/payment witnesses are the exact supplied finite fixtures; no general payment interpreter is supplied."
      ],
      "fairness": [
        "CounterSpec == CounterInit /\\ [][CounterNext]_mcvars /\\ WF_mcvars(CounterProgress)"
      ],
      "warnings": [],
      "max_seconds": 90,
      "evidence_class": "finite-state-exploration",
      "check_deadlock": true,
      "description": "ordinary finite model. Underlying ordinary program: finite transition exploration with state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model."
    },
    {
      "id": "ref-definition-checks",
      "module": "DefinitionChecksMC",
      "config": "DefinitionChecksMC.cfg",
      "expected_exit": 0,
      "outcome": "success",
      "properties": [
        "AllAssertions"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "DefinitionChecksMC.cfg",
        "constants": [],
        "definition_overrides": {},
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 512,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "Applicable costs, permissions, allocation and valid candidate/payment witnesses are the exact supplied finite fixtures; no general payment interpreter is supplied.",
        "The selected finite metadata, role, zone, face and setup constructors are supplied exactly; arbitrary strings or metadata tables are outside this checking scope."
      ],
      "fairness": [],
      "warnings": [],
      "max_seconds": 90,
      "evidence_class": "prepared-assertions",
      "check_deadlock": true,
      "description": "ordinary finite model. Underlying ordinary program: prepared/pointwise assertion fixture; no reached state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model."
    },
    {
      "id": "ref-hosting-checks",
      "module": "HostingChecksMC",
      "config": "HostingChecksMC.cfg",
      "expected_exit": 0,
      "outcome": "success",
      "properties": [
        "TypeOK",
        "PhysicalUniqueness",
        "HostIntegrity",
        "HostingAssertions",
        "HostingCompleted"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "HostingChecksMC.cfg",
        "constants": [
          [
            "CardData <- Data"
          ],
          [
            "InitialState <- DummyInitial"
          ],
          [
            "Commands <- HostingCommands"
          ],
          [
            "CardOverride <- NoOverride"
          ],
          [
            "CheckpointOverrideAllowed <- NoCheckpointOverride"
          ]
        ],
        "definition_overrides": {
          "CardData": "Data",
          "CardOverride": "NoOverride",
          "CheckpointOverrideAllowed": "NoCheckpointOverride",
          "Commands": "HostingCommands",
          "InitialState": "DummyInitial"
        },
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 512,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "Object identifiers, ownership/control, relocation and visibility inputs are well-shaped finite records in this profile; general information noninterference is outside scope."
      ],
      "fairness": [
        "HostingSpec == HostingInit /\\ [][HostingNext]_mcvars /\\ WF_mcvars(HostingProgress)"
      ],
      "warnings": [],
      "max_seconds": 90,
      "evidence_class": "finite-state-exploration",
      "check_deadlock": true,
      "description": "ordinary finite model. Underlying ordinary program: finite transition exploration with state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model."
    },
    {
      "id": "ref-runtime-checks",
      "module": "RuntimeChecksMC",
      "config": "RuntimeChecksMC.cfg",
      "expected_exit": 0,
      "outcome": "success",
      "properties": [
        "TypeOK",
        "PhysicalUniqueness",
        "HostIntegrity",
        "RuntimeAssertions",
        "PureRuntimeContracts",
        "Completed"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "RuntimeChecksMC.cfg",
        "constants": [
          [
            "CardData <- Data"
          ],
          [
            "InitialState <- DummyInitial"
          ],
          [
            "Commands <- NoCommands"
          ],
          [
            "CardOverride <- NoOverride"
          ],
          [
            "CheckpointOverrideAllowed <- NoCheckpointOverride"
          ]
        ],
        "definition_overrides": {
          "CardData": "Data",
          "CardOverride": "NoOverride",
          "CheckpointOverrideAllowed": "NoCheckpointOverride",
          "Commands": "NoCommands",
          "InitialState": "DummyInitial"
        },
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 512,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "Object identifiers, ownership/control, relocation and visibility inputs are well-shaped finite records in this profile; general information noninterference is outside scope."
      ],
      "fairness": [
        "SpecMC == InitMC /\\ [][NextMC]_mcvars /\\ WF_mcvars(AdvanceMC)"
      ],
      "warnings": [
        "Warning: The invariant PureRuntimeContracts is a constant-level formula (i.e., it contains no variables, primes, or temporal operators) and evaluates to TRUE. To assert constant-level formulas in your spec, use ASSUME ConstInv. If you optionally want to give the assumption a name, write ASSUME YourAssumption == ConstInv instead. See https://explain.tlapl.us/assumptions-and-invariants for additional details."
      ],
      "max_seconds": 90,
      "evidence_class": "finite-state-exploration",
      "check_deadlock": true,
      "description": "ordinary finite model. Underlying ordinary program: finite transition exploration with state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model."
    },
    {
      "id": "ref-setup-checks",
      "module": "SetupChecksMC",
      "config": "SetupChecksMC.cfg",
      "expected_exit": 0,
      "outcome": "success",
      "properties": [
        "SetupMCType",
        "SetupMCConservation",
        "SetupMCDecisionOrder",
        "SetupMCBothHandsBeforeRedraw",
        "SetupMCGameStartsLast",
        "SetupMCFinished",
        "SetupMCEventuallyDone"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "SetupChecksMC.cfg",
        "constants": [],
        "definition_overrides": {},
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 512,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "Object identifiers, ownership/control, relocation and visibility inputs are well-shaped finite records in this profile; general information noninterference is outside scope.",
        "The selected finite metadata, role, zone, face and setup constructors are supplied exactly; arbitrary strings or metadata tables are outside this checking scope."
      ],
      "fairness": [
        "SetupMCSpec ==\n    /\\ SetupMCInit\n    /\\ [][SetupMCNext]_setupVars\n    /\\ WF_setupVars(SetupMCProgress)"
      ],
      "warnings": [],
      "max_seconds": 90,
      "evidence_class": "finite-state-exploration",
      "check_deadlock": true,
      "description": "ordinary finite model. Underlying ordinary program: finite transition exploration with state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model."
    },
    {
      "id": "ref-target-checks",
      "module": "TargetChecksMC",
      "config": "TargetChecksMC.cfg",
      "expected_exit": 0,
      "outcome": "success",
      "properties": [
        "TypeOK",
        "PhysicalUniqueness",
        "HostIntegrity",
        "TargetAssertions",
        "TargetCompleted"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "TargetChecksMC.cfg",
        "constants": [
          [
            "CardData <- Data"
          ],
          [
            "InitialState <- DummyInitial"
          ],
          [
            "Commands <- TargetCommands"
          ],
          [
            "CardOverride <- NoOverride"
          ],
          [
            "CheckpointOverrideAllowed <- NoCheckpointOverride"
          ]
        ],
        "definition_overrides": {
          "CardData": "Data",
          "CardOverride": "NoOverride",
          "CheckpointOverrideAllowed": "NoCheckpointOverride",
          "Commands": "TargetCommands",
          "InitialState": "DummyInitial"
        },
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 512,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "Permission, destination, effect, candidate-state and completion witnesses are supplied at their documented boundaries; an operation source listing is not a general interpreter."
      ],
      "fairness": [
        "TargetSpec == TargetInit /\\ [][TargetNext]_mcvars /\\\n              WF_pc(pc < TargetLimit(caseNo) /\\ pc' = pc + 1)"
      ],
      "warnings": [],
      "max_seconds": 90,
      "evidence_class": "finite-state-exploration",
      "check_deadlock": true,
      "description": "ordinary finite model. Underlying ordinary program: finite transition exploration with state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model."
    },
    {
      "id": "ref-retirement-checks",
      "module": "RetirementChecksMC",
      "config": "RetirementChecksMC.cfg",
      "expected_exit": 0,
      "outcome": "success",
      "properties": [
        "TypeOK",
        "PhysicalUniqueness",
        "HostIntegrity",
        "RetireAssertions",
        "RetireCompleted"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "RetirementChecksMC.cfg",
        "constants": [
          [
            "CardData <- Data"
          ],
          [
            "InitialState <- DummyInitial"
          ],
          [
            "Commands <- RetireCommands"
          ],
          [
            "CardOverride <- NoOverride"
          ],
          [
            "CheckpointOverrideAllowed <- NoCheckpointOverride"
          ]
        ],
        "definition_overrides": {
          "CardData": "Data",
          "CardOverride": "NoOverride",
          "CheckpointOverrideAllowed": "NoCheckpointOverride",
          "Commands": "RetireCommands",
          "InitialState": "DummyInitial"
        },
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 512,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "Permission, destination, effect, candidate-state and completion witnesses are supplied at their documented boundaries; an operation source listing is not a general interpreter."
      ],
      "fairness": [
        "RetireSpec == RetireInit /\\ [][RetireNext]_mcvars /\\\n             WF_pc(pc < RetireLimit(caseNo) /\\ pc' = pc + 1)"
      ],
      "warnings": [],
      "max_seconds": 90,
      "evidence_class": "finite-state-exploration",
      "check_deadlock": true,
      "description": "ordinary finite model. Underlying ordinary program: finite transition exploration with state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model."
    },
    {
      "id": "ref-visibility-checks",
      "module": "VisibilityChecksMC",
      "config": "VisibilityChecksMC.cfg",
      "expected_exit": 0,
      "outcome": "success",
      "properties": [
        "TypeOK",
        "PhysicalUniqueness",
        "HostIntegrity",
        "ExposureAssertions",
        "ExposureCompleted"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "VisibilityChecksMC.cfg",
        "constants": [
          [
            "CardData <- ExposureData"
          ],
          [
            "InitialState <- DummyInitial"
          ],
          [
            "Commands <- ExposureCommands"
          ],
          [
            "CardOverride <- NoOverride"
          ],
          [
            "CheckpointOverrideAllowed <- NoCheckpointOverride"
          ]
        ],
        "definition_overrides": {
          "CardData": "ExposureData",
          "CardOverride": "NoOverride",
          "CheckpointOverrideAllowed": "NoCheckpointOverride",
          "Commands": "ExposureCommands",
          "InitialState": "DummyInitial"
        },
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 512,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "Object identifiers, ownership/control, relocation and visibility inputs are well-shaped finite records in this profile; general information noninterference is outside scope."
      ],
      "fairness": [
        "ExposureSpec == ExposureInit /\\ [][ExposureNext]_mcvars /\\\n                WF_pc(pc < ExposureLimit(caseNo) /\\ pc' = pc + 1)"
      ],
      "warnings": [],
      "max_seconds": 90,
      "evidence_class": "finite-state-exploration",
      "check_deadlock": true,
      "description": "ordinary finite model. Underlying ordinary program: finite transition exploration with state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model."
    },
    {
      "id": "ref-schema-checks",
      "module": "SchemaChecksMC",
      "config": "SchemaChecksMC.cfg",
      "expected_exit": 0,
      "outcome": "success",
      "properties": [
        "Block2Assertions"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "SchemaChecksMC.cfg",
        "constants": [],
        "definition_overrides": {},
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 512,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "The selected finite metadata, role, zone, face and setup constructors are supplied exactly; arbitrary strings or metadata tables are outside this checking scope."
      ],
      "fairness": [],
      "warnings": [],
      "max_seconds": 90,
      "evidence_class": "prepared-assertions",
      "check_deadlock": true,
      "description": "ordinary finite model. Underlying ordinary program: prepared/pointwise assertion fixture; no reached state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model."
    },
    {
      "id": "ref-type-checks",
      "module": "TypeChecksMC",
      "config": "TypeChecksMC.cfg",
      "expected_exit": 0,
      "outcome": "success",
      "properties": [
        "Block3Assertions"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "TypeChecksMC.cfg",
        "constants": [],
        "definition_overrides": {},
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 512,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "The selected finite metadata, role, zone, face and setup constructors are supplied exactly; arbitrary strings or metadata tables are outside this checking scope."
      ],
      "fairness": [],
      "warnings": [],
      "max_seconds": 90,
      "evidence_class": "prepared-assertions",
      "check_deadlock": true,
      "description": "ordinary finite model. Underlying ordinary program: prepared/pointwise assertion fixture; no reached state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model."
    },
    {
      "id": "ref-location-checks",
      "module": "LocationChecksMC",
      "config": "LocationChecksMC.cfg",
      "expected_exit": 0,
      "outcome": "success",
      "properties": [
        "Block4Assertions"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "LocationChecksMC.cfg",
        "constants": [],
        "definition_overrides": {},
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 512,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "The selected finite metadata, role, zone, face and setup constructors are supplied exactly; arbitrary strings or metadata tables are outside this checking scope."
      ],
      "fairness": [],
      "warnings": [],
      "max_seconds": 90,
      "evidence_class": "prepared-assertions",
      "check_deadlock": true,
      "description": "ordinary finite model. Underlying ordinary program: prepared/pointwise assertion fixture; no reached state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model."
    },
    {
      "id": "ref-turn-checks",
      "module": "TurnChecksMC",
      "config": "TurnChecksMC.cfg",
      "expected_exit": 0,
      "outcome": "success",
      "properties": [
        "Block5Assertions"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "TurnChecksMC.cfg",
        "constants": [],
        "definition_overrides": {},
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 512,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "The selected phase schedule, objective values and completion/checkpoint providers are supplied exactly; no complete-game or arbitrary-scheduler progress claim is made."
      ],
      "fairness": [],
      "warnings": [],
      "max_seconds": 90,
      "evidence_class": "prepared-assertions",
      "check_deadlock": true,
      "description": "ordinary finite model. Underlying ordinary program: prepared/pointwise assertion fixture; no reached state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model."
    },
    {
      "id": "ref-turn-procedures",
      "module": "TurnProceduresMC",
      "config": "TurnProceduresMC.cfg",
      "expected_exit": 0,
      "outcome": "success",
      "properties": [
        "TurnsInvariant5",
        "EventuallyHandoff5"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "TurnProceduresMC.cfg",
        "constants": [],
        "definition_overrides": {},
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 512,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "The selected phase schedule, objective values and completion/checkpoint providers are supplied exactly; no complete-game or arbitrary-scheduler progress claim is made."
      ],
      "fairness": [
        "SpecTurns5 == InitTurns5 /\\ [][NextTurns5]_q5 /\\ WF_q5(NextTurns5)"
      ],
      "warnings": [],
      "max_seconds": 90,
      "evidence_class": "finite-state-exploration",
      "check_deadlock": true,
      "description": "ordinary finite model. Underlying ordinary program: finite transition exploration with state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model."
    },
    {
      "id": "ref-traversal-checks",
      "module": "TraversalChecksMC",
      "config": "TraversalChecksMC.cfg",
      "expected_exit": 0,
      "outcome": "success",
      "properties": [
        "Block6Assertions"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "TraversalChecksMC.cfg",
        "constants": [],
        "definition_overrides": {},
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 512,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "Layouts, orders, current object references, lawful views and selection/effect providers are the exact finite fixtures; these do not grant broader observation rights."
      ],
      "fairness": [],
      "warnings": [],
      "max_seconds": 90,
      "evidence_class": "prepared-assertions",
      "check_deadlock": true,
      "description": "ordinary finite model. Underlying ordinary program: prepared/pointwise assertion fixture; no reached state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model."
    },
    {
      "id": "ref-traversal-procedures",
      "module": "TraversalProceduresMC",
      "config": "TraversalProceduresMC.cfg",
      "expected_exit": 0,
      "outcome": "success",
      "properties": [
        "TraversalsInvariant6",
        "EventuallyReturns6"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "TraversalProceduresMC.cfg",
        "constants": [],
        "definition_overrides": {},
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 512,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "Layouts, orders, current object references, lawful views and selection/effect providers are the exact finite fixtures; these do not grant broader observation rights."
      ],
      "fairness": [
        "SpecTraversals6 == InitTraversals6 /\\ [][NextTraversals6]_q6 /\\ WF_q6(NextTraversals6)"
      ],
      "warnings": [],
      "max_seconds": 90,
      "evidence_class": "finite-state-exploration",
      "check_deadlock": true,
      "description": "ordinary finite model. Underlying ordinary program: finite transition exploration with state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model."
    },
    {
      "id": "ref-inspection-procedures",
      "module": "InspectionProceduresMC",
      "config": "InspectionProceduresMC.cfg",
      "expected_exit": 0,
      "outcome": "success",
      "properties": [
        "InspectionesInvariant7",
        "EventuallyReturns7"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "InspectionProceduresMC.cfg",
        "constants": [],
        "definition_overrides": {},
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 512,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "Layouts, orders, current object references, lawful views and selection/effect providers are the exact finite fixtures; these do not grant broader observation rights."
      ],
      "fairness": [
        "SpecInspectiones7 == InitInspectiones7 /\\ [][NextInspectiones7]_q7 /\\ WF_q7(NextInspectiones7)"
      ],
      "warnings": [],
      "max_seconds": 90,
      "evidence_class": "finite-state-exploration",
      "check_deadlock": true,
      "description": "ordinary finite model. Underlying ordinary program: finite transition exploration with state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model."
    },
    {
      "id": "ref-inspection-checks",
      "module": "InspectionChecksMC",
      "config": "InspectionChecksMC.cfg",
      "expected_exit": 0,
      "outcome": "success",
      "properties": [
        "Block7Assertions"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "InspectionChecksMC.cfg",
        "constants": [],
        "definition_overrides": {},
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 512,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "Layouts, orders, current object references, lawful views and selection/effect providers are the exact finite fixtures; these do not grant broader observation rights."
      ],
      "fairness": [],
      "warnings": [],
      "max_seconds": 90,
      "evidence_class": "prepared-assertions",
      "check_deadlock": true,
      "description": "ordinary finite model. Underlying ordinary program: prepared/pointwise assertion fixture; no reached state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model."
    },
    {
      "id": "ref-operation-checks",
      "module": "OperationChecksMC",
      "config": "OperationChecksMC.cfg",
      "expected_exit": 0,
      "outcome": "success",
      "properties": [
        "Block8Assertions"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "OperationChecksMC.cfg",
        "constants": [],
        "definition_overrides": {},
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 512,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "Permission, destination, effect, candidate-state and completion witnesses are supplied at their documented boundaries; an operation source listing is not a general interpreter."
      ],
      "fairness": [],
      "warnings": [
        "Warning: The EXCEPT was applied to non-existing fields of the value at"
      ],
      "max_seconds": 90,
      "evidence_class": "prepared-assertions",
      "check_deadlock": true,
      "description": "ordinary finite model. Underlying ordinary program: prepared/pointwise assertion fixture; no reached state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model."
    },
    {
      "id": "ref-operation-procedures",
      "module": "OperationProceduresMC",
      "config": "OperationProceduresMC.cfg",
      "expected_exit": 0,
      "outcome": "success",
      "properties": [
        "ProceduresInvariant8",
        "EventuallyReturns8"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "OperationProceduresMC.cfg",
        "constants": [],
        "definition_overrides": {},
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 512,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "Permission, destination, effect, candidate-state and completion witnesses are supplied at their documented boundaries; an operation source listing is not a general interpreter."
      ],
      "fairness": [
        "SpecProcedures8 == InitProcedures8 /\\ [][NextProcedures8]_q8 /\\ WF_q8(NextProcedures8)"
      ],
      "warnings": [],
      "max_seconds": 90,
      "evidence_class": "finite-state-exploration",
      "check_deadlock": true,
      "description": "ordinary finite model. Underlying ordinary program: finite transition exploration with state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model."
    },
    {
      "id": "ref-ability-checks",
      "module": "AbilityChecksMC",
      "config": "AbilityChecksMC.cfg",
      "expected_exit": 0,
      "outcome": "success",
      "properties": [
        "Block9Assertions"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "AbilityChecksMC.cfg",
        "constants": [],
        "definition_overrides": {},
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 1536,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "Activity, legality, current-effect, payment and exact caller/child completion witnesses are supplied in the selected model; external ability interpretation is outside scope."
      ],
      "fairness": [],
      "warnings": [],
      "max_seconds": 90,
      "evidence_class": "prepared-assertions",
      "check_deadlock": true,
      "description": "ordinary finite model. Underlying ordinary program: prepared/pointwise assertion fixture; no reached state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model."
    },
    {
      "id": "ref-ability-procedures",
      "module": "AbilityProceduresMC",
      "config": "AbilityProceduresMC.cfg",
      "expected_exit": 0,
      "outcome": "success",
      "properties": [
        "ProceduresInvariant9",
        "EventuallyReturns9"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "AbilityProceduresMC.cfg",
        "constants": [],
        "definition_overrides": {},
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 512,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "Activity, legality, current-effect, payment and exact caller/child completion witnesses are supplied in the selected model; external ability interpretation is outside scope."
      ],
      "fairness": [
        "SpecProcedures9 == InitProcedures9 /\\ [][NextProcedures9]_q9p /\\ WF_q9p(WorkProcedures9)"
      ],
      "warnings": [],
      "max_seconds": 90,
      "evidence_class": "finite-state-exploration",
      "check_deadlock": false,
      "description": "ordinary finite model. Underlying ordinary program: finite transition exploration with state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model."
    },
    {
      "id": "ref-registry-checks",
      "module": "RegistryChecksMC",
      "config": "RegistryChecksMC.cfg",
      "expected_exit": 0,
      "outcome": "success",
      "properties": [
        "SAssertionsSA"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "RegistryChecksMC.cfg",
        "constants": [
          [
            "PaidAmounts",
            "{ 0 , 1 }"
          ],
          [
            "PaidMoves",
            "{ TRUE , FALSE }"
          ]
        ],
        "definition_overrides": {},
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 512,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "Registered role/zone/event constructors, normalized source/provenance identities, provider facts and pinned renderer behavior are restricted to the selected finite contexts."
      ],
      "fairness": [],
      "warnings": [],
      "max_seconds": 90,
      "evidence_class": "prepared-assertions",
      "check_deadlock": false,
      "description": "ordinary finite model. Underlying ordinary program: prepared/pointwise assertion fixture; no reached state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model."
    },
    {
      "id": "ref-item-timing-assertions",
      "module": "ItemTimingMC",
      "config": "ItemTimingAssertions.cfg",
      "expected_exit": 0,
      "outcome": "success",
      "properties": [
        "ItemInspectionPointwiseChecksT11"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "ItemTimingAssertions.cfg",
        "constants": [],
        "definition_overrides": {},
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 512,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "Layouts, orders, current object references, lawful views and selection/effect providers are the exact finite fixtures; these do not grant broader observation rights."
      ],
      "fairness": [],
      "warnings": [],
      "max_seconds": 90,
      "evidence_class": "prepared-assertions",
      "check_deadlock": true,
      "description": "ordinary finite model. Underlying ordinary program: prepared/pointwise assertion fixture; no reached state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model."
    },
    {
      "id": "ref-item-timing",
      "module": "ItemTimingMC",
      "config": "ItemTimingMC.cfg",
      "expected_exit": 0,
      "outcome": "success",
      "properties": [
        "ItemInspectionTemporalSafetyT11",
        "ItemInspectionPaidLifecycleSafetyT11",
        "ItemInspectionNativeLedgerSafetyT11",
        "ItemInspectionTemporalTerminatesT11"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "ItemTimingMC.cfg",
        "constants": [],
        "definition_overrides": {},
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 512,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "Layouts, orders, current object references, lawful views and selection/effect providers are the exact finite fixtures; these do not grant broader observation rights."
      ],
      "fairness": [
        "ItemInspectionTemporalSpecT11 == ItemInspectionTemporalInitT11 /\\ [][ItemInspectionTemporalNextT11]_<<guideCaseT11,qT11>> /\\ WF_<<guideCaseT11,qT11>>(ItemInspectionTemporalNextT11)"
      ],
      "warnings": [],
      "max_seconds": 90,
      "evidence_class": "finite-state-exploration",
      "check_deadlock": true,
      "description": "ordinary finite model. Underlying ordinary program: finite transition exploration with state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model."
    },
    {
      "id": "ref-inspection-timing-assertions",
      "module": "InspectionTimingMC",
      "config": "InspectionTimingAssertions.cfg",
      "expected_exit": 0,
      "outcome": "success",
      "properties": [
        "InspectionPointwiseChecksT11"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "InspectionTimingAssertions.cfg",
        "constants": [],
        "definition_overrides": {},
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 512,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "Layouts, orders, current object references, lawful views and selection/effect providers are the exact finite fixtures; these do not grant broader observation rights."
      ],
      "fairness": [],
      "warnings": [],
      "max_seconds": 90,
      "evidence_class": "prepared-assertions",
      "check_deadlock": true,
      "description": "ordinary finite model. Underlying ordinary program: prepared/pointwise assertion fixture; no reached state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model."
    },
    {
      "id": "ref-inspection-timing",
      "module": "InspectionTimingMC",
      "config": "InspectionTimingMC.cfg",
      "expected_exit": 0,
      "outcome": "success",
      "properties": [
        "InspectionAuditInvariantT11",
        "InspectionAuditEventuallyReturnsT11"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "InspectionTimingMC.cfg",
        "constants": [],
        "definition_overrides": {},
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 512,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "Layouts, orders, current object references, lawful views and selection/effect providers are the exact finite fixtures; these do not grant broader observation rights."
      ],
      "fairness": [
        "InspectionAuditSpecT11 == InspectionAuditInitT11 /\\ [][InspectionAuditNextT11]_<<guideCaseT11,qT11>> /\\ WF_<<guideCaseT11,qT11>>(InspectionAuditNextT11)"
      ],
      "warnings": [],
      "max_seconds": 90,
      "evidence_class": "finite-state-exploration",
      "check_deadlock": true,
      "description": "ordinary finite model. Underlying ordinary program: finite transition exploration with state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model."
    },
    {
      "id": "ref-side-a-turn-timing",
      "module": "SchedulerChecksMC",
      "config": "SideATurnTiming.cfg",
      "expected_exit": 0,
      "outcome": "success",
      "properties": [
        "SideAAuditInvariantT11",
        "SideAAuditEventuallyHandoffT11"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "SideATurnTiming.cfg",
        "constants": [],
        "definition_overrides": {},
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 512,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "The selected phase schedule, objective values and completion/checkpoint providers are supplied exactly; no complete-game or arbitrary-scheduler progress claim is made."
      ],
      "fairness": [
        "SideAAuditSpecT11 == SideAAuditInitT11 /\\ [][SideAAuditNextT11]_<<guideCaseT11,qT11>> /\\ WF_<<guideCaseT11,qT11>>(SideAAuditNextT11)"
      ],
      "warnings": [],
      "max_seconds": 90,
      "evidence_class": "finite-state-exploration",
      "check_deadlock": true,
      "description": "ordinary finite model. Underlying ordinary program: finite transition exploration with state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model."
    },
    {
      "id": "ref-scheduler-checks",
      "module": "SchedulerChecksMC",
      "config": "SchedulerChecksMC.cfg",
      "expected_exit": 0,
      "outcome": "success",
      "properties": [
        "PointwiseChecksT11"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "SchedulerChecksMC.cfg",
        "constants": [],
        "definition_overrides": {},
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 512,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "The selected phase schedule, objective values and completion/checkpoint providers are supplied exactly; no complete-game or arbitrary-scheduler progress claim is made."
      ],
      "fairness": [],
      "warnings": [],
      "max_seconds": 90,
      "evidence_class": "prepared-assertions",
      "check_deadlock": true,
      "description": "ordinary finite model. Underlying ordinary program: prepared/pointwise assertion fixture; no reached state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model."
    },
    {
      "id": "ref-connected-timing",
      "module": "ConnectedTimingMC",
      "config": "ConnectedTimingMC.cfg",
      "expected_exit": 0,
      "outcome": "success",
      "properties": [
        "IntegrationSafetyT11",
        "IntegrationTerminatesT11"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "ConnectedTimingMC.cfg",
        "constants": [],
        "definition_overrides": {},
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 512,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "Outer schedules, procedure adapters, provider facts, metadata and exact caller/transaction/receipt identities are the selected finite composition fixtures."
      ],
      "fairness": [
        "IntegrationSpecT11 == IntegrationInitT11 /\\ [][IConnectedStepT11]_<<guideCaseT11,qT11>> /\\ WF_<<guideCaseT11,qT11>>(IConnectedStepT11)"
      ],
      "warnings": [],
      "max_seconds": 90,
      "evidence_class": "finite-state-exploration",
      "check_deadlock": true,
      "description": "ordinary finite model. Underlying ordinary program: finite transition exploration with state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model."
    },
    {
      "id": "ref-commitment-probes",
      "module": "CommitmentProbesMC",
      "config": "CommitmentProbesMC.cfg",
      "expected_exit": 0,
      "outcome": "success",
      "properties": [
        "PaidProbeChecksT11"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "CommitmentProbesMC.cfg",
        "constants": [],
        "definition_overrides": {},
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 512,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "Activity, legality, current-effect, payment and exact caller/child completion witnesses are supplied in the selected model; external ability interpretation is outside scope."
      ],
      "fairness": [],
      "warnings": [],
      "max_seconds": 90,
      "evidence_class": "prepared-assertions",
      "check_deadlock": true,
      "description": "ordinary finite model. Underlying ordinary program: prepared/pointwise assertion fixture; no reached state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model."
    },
    {
      "id": "ref-committed-composition",
      "module": "CommittedCompositionMC",
      "config": "CommittedCompositionMC.cfg",
      "expected_exit": 0,
      "outcome": "success",
      "properties": [
        "PConnectedSafety",
        "PPaidSafety",
        "PEventuallyReturns"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "CommittedCompositionMC.cfg",
        "constants": [
          [
            "PaidAmounts",
            "{ 0 , 1 }"
          ],
          [
            "PaidMoves",
            "{ TRUE , FALSE }"
          ]
        ],
        "definition_overrides": {},
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 512,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "Applicable costs, permissions, allocation and valid candidate/payment witnesses are the exact supplied finite fixtures; no general payment interpreter is supplied.",
        "Outer schedules, procedure adapters, provider facts, metadata and exact caller/transaction/receipt identities are the selected finite composition fixtures."
      ],
      "fairness": [
        "PSpec == PInit /\\ [][PWork]_<<guideCaseT11,qT11>> /\\ WF_<<guideCaseT11,qT11>>(PWork)"
      ],
      "warnings": [],
      "max_seconds": 90,
      "evidence_class": "finite-state-exploration",
      "check_deadlock": false,
      "description": "ordinary finite model. Underlying ordinary program: finite transition exploration with state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model."
    },
    {
      "id": "ref-commitment-publication",
      "module": "CommitmentPublicationMC",
      "config": "CommitmentPublicationMC.cfg",
      "expected_exit": 0,
      "outcome": "success",
      "properties": [
        "PublicationSafetyT11",
        "ItemInspectionTemporalTerminatesT11"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "CommitmentPublicationMC.cfg",
        "constants": [],
        "definition_overrides": {},
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 512,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "Applicable costs, permissions, allocation and valid candidate/payment witnesses are the exact supplied finite fixtures; no general payment interpreter is supplied.",
        "Activity, legality, current-effect, payment and exact caller/child completion witnesses are supplied in the selected model; external ability interpretation is outside scope."
      ],
      "fairness": [
        "PublicationSpecT11 == PublicationInitT11 /\\ [][ItemInspectionTemporalNextT11]_<<guideCaseT11,qT11>> /\\ WF_<<guideCaseT11,qT11>>(ItemInspectionTemporalNextT11)"
      ],
      "warnings": [],
      "max_seconds": 90,
      "evidence_class": "finite-state-exploration",
      "check_deadlock": true,
      "description": "ordinary finite model. Underlying ordinary program: finite transition exploration with state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model."
    },
    {
      "id": "ref-registry-availability",
      "module": "RegistryAvailabilityMC",
      "config": "RegistryAvailabilityMC.cfg",
      "expected_exit": 0,
      "outcome": "success",
      "properties": [
        "VConnectedSafety",
        "VPaidSafety",
        "VPaidCompletion",
        "VDeclineCompletion",
        "VNoChildCompletion"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "RegistryAvailabilityMC.cfg",
        "constants": [
          [
            "AvailabilityProfiles",
            "{ \"baseline\" , \"paid-permission\" , \"paid-entry\" , \"initial-paid-permission\" , \"initial-paid-entry\" , \"initial-conditional-permission\" , \"initial-conditional-entry\" }"
          ],
          [
            "PaidAmounts",
            "{ 0 , 1 }"
          ],
          [
            "PaidMoves",
            "{ TRUE , FALSE }"
          ]
        ],
        "definition_overrides": {},
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 512,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 300
      },
      "assumptions": [
        "Registered role/zone/event constructors, normalized source/provenance identities, provider facts and pinned renderer behavior are restricted to the selected finite contexts."
      ],
      "fairness": [
        "VSpec == VInit /\\ [][VWork]_<<guideCaseT11,qT11>> /\\ WF_<<guideCaseT11,qT11>>(VWork)"
      ],
      "warnings": [],
      "max_seconds": 300,
      "evidence_class": "finite-state-exploration",
      "check_deadlock": false,
      "description": "ordinary finite model. Underlying ordinary program: finite transition exploration with state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model."
    },
    {
      "id": "ref-registry-composition",
      "module": "RegistryCompositionMC",
      "config": "RegistryCompositionMC.cfg",
      "expected_exit": 0,
      "outcome": "success",
      "properties": [
        "RConnectedSafety",
        "RPaidSafety",
        "REventuallyReturns"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "RegistryCompositionMC.cfg",
        "constants": [
          [
            "PaidAmounts",
            "{ 0 , 1 }"
          ],
          [
            "PaidMoves",
            "{ TRUE , FALSE }"
          ]
        ],
        "definition_overrides": {},
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 512,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "Registered role/zone/event constructors, normalized source/provenance identities, provider facts and pinned renderer behavior are restricted to the selected finite contexts."
      ],
      "fairness": [
        "RSpec == RInit /\\ [][RWork]_<<guideCaseT11,qT11>> /\\ WF_<<guideCaseT11,qT11>>(RWork)"
      ],
      "warnings": [],
      "max_seconds": 90,
      "evidence_class": "finite-state-exploration",
      "check_deadlock": false,
      "description": "ordinary finite model. Underlying ordinary program: finite transition exploration with state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model."
    },
    {
      "id": "ref-traversal-timing-assertions",
      "module": "TraversalTimingMC",
      "config": "TraversalTimingAssertions.cfg",
      "expected_exit": 0,
      "outcome": "success",
      "properties": [
        "TraversalPointwiseChecksT11"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "TraversalTimingAssertions.cfg",
        "constants": [],
        "definition_overrides": {},
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 512,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "Layouts, orders, current object references, lawful views and selection/effect providers are the exact finite fixtures; these do not grant broader observation rights."
      ],
      "fairness": [],
      "warnings": [],
      "max_seconds": 90,
      "evidence_class": "prepared-assertions",
      "check_deadlock": true,
      "description": "ordinary finite model. Underlying ordinary program: prepared/pointwise assertion fixture; no reached state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model."
    },
    {
      "id": "ref-side-b-turn-timing",
      "module": "SchedulerChecksMC",
      "config": "SideBTurnTiming.cfg",
      "expected_exit": 0,
      "outcome": "success",
      "properties": [
        "SideBAuditInvariantT11",
        "SideBAuditEventuallyHandoffT11"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "SideBTurnTiming.cfg",
        "constants": [],
        "definition_overrides": {},
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 512,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "The selected phase schedule, objective values and completion/checkpoint providers are supplied exactly; no complete-game or arbitrary-scheduler progress claim is made."
      ],
      "fairness": [
        "SideBAuditSpecT11 == SideBAuditInitT11 /\\ [][SideBAuditNextT11]_<<guideCaseT11,qT11>> /\\ WF_<<guideCaseT11,qT11>>(SideBAuditNextT11)"
      ],
      "warnings": [],
      "max_seconds": 90,
      "evidence_class": "finite-state-exploration",
      "check_deadlock": true,
      "description": "ordinary finite model. Underlying ordinary program: finite transition exploration with state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model."
    },
    {
      "id": "ref-traversal-timing",
      "module": "TraversalTimingMC",
      "config": "TraversalTimingMC.cfg",
      "expected_exit": 0,
      "outcome": "success",
      "properties": [
        "TraversalAuditInvariantT11",
        "TraversalAuditEventuallyReturnsT11"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "TraversalTimingMC.cfg",
        "constants": [],
        "definition_overrides": {},
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 512,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "Layouts, orders, current object references, lawful views and selection/effect providers are the exact finite fixtures; these do not grant broader observation rights."
      ],
      "fairness": [
        "TraversalAuditSpecT11 == TraversalAuditInitT11 /\\ [][TraversalAuditNextT11]_<<guideCaseT11,qT11>> /\\ WF_<<guideCaseT11,qT11>>(TraversalAuditNextT11)"
      ],
      "warnings": [],
      "max_seconds": 90,
      "evidence_class": "finite-state-exploration",
      "check_deadlock": true,
      "description": "ordinary finite model. Underlying ordinary program: finite transition exploration with state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model."
    },
    {
      "id": "ref-cost-clamp-ordinary",
      "module": "CostClampVariantMC",
      "config": "CostClampVariantMC-ordinary.cfg",
      "expected_exit": 0,
      "outcome": "success",
      "properties": [
        "AllAssertions"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "CostClampVariantMC-ordinary.cfg",
        "constants": [],
        "definition_overrides": {},
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 512,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "Applicable costs, permissions, allocation and valid candidate/payment witnesses are the exact supplied finite fixtures; no general payment interpreter is supplied."
      ],
      "fairness": [],
      "warnings": [],
      "max_seconds": 90,
      "evidence_class": "prepared-assertions",
      "check_deadlock": true,
      "description": "ordinary finite model. Underlying ordinary program: prepared/pointwise assertion fixture; no reached state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model."
    },
    {
      "id": "ref-cost-clamp-defective",
      "module": "CostClampVariantMC",
      "config": "CostClampVariantMC-defective.cfg",
      "expected_exit": 12,
      "outcome": "safety-counterexample",
      "properties": [
        "AllAssertions"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "CostClampVariantMC-defective.cfg",
        "constants": [
          [
            "ModifiedCost <- DefectBodyCostClampVariant"
          ]
        ],
        "definition_overrides": {
          "ModifiedCost": "DefectBodyCostClampVariant"
        },
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 512,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "Applicable costs, permissions, allocation and valid candidate/payment witnesses are the exact supplied finite fixtures; no general payment interpreter is supplied."
      ],
      "fairness": [],
      "warnings": [],
      "max_seconds": 90,
      "evidence_class": "prepared-assertions",
      "check_deadlock": true,
      "description": "intentional named invariant counterexample. Underlying ordinary program: prepared/pointwise assertion fixture; no reached state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model.",
      "expected_property": "AllAssertions",
      "negative_of": "ref-cost-clamp-ordinary"
    },
    {
      "id": "ref-identity-renewal-ordinary",
      "module": "IdentityRenewalVariantMC",
      "config": "IdentityRenewalVariantMC-ordinary.cfg",
      "expected_exit": 0,
      "outcome": "success",
      "properties": [
        "TypeOK",
        "PhysicalUniqueness",
        "HostIntegrity",
        "RuntimeAssertions",
        "PureRuntimeContracts",
        "Completed"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "IdentityRenewalVariantMC-ordinary.cfg",
        "constants": [
          [
            "CardData <- Data"
          ],
          [
            "InitialState <- DummyInitial"
          ],
          [
            "Commands <- NoCommands"
          ],
          [
            "CardOverride <- NoOverride"
          ],
          [
            "CheckpointOverrideAllowed <- NoCheckpointOverride"
          ],
          [
            "mcvars <- ControlFirstVariables"
          ]
        ],
        "definition_overrides": {
          "CardData": "Data",
          "CardOverride": "NoOverride",
          "CheckpointOverrideAllowed": "NoCheckpointOverride",
          "Commands": "NoCommands",
          "InitialState": "DummyInitial",
          "mcvars": "ControlFirstVariables"
        },
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 512,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "Object identifiers, ownership/control, relocation and visibility inputs are well-shaped finite records in this profile; general information noninterference is outside scope."
      ],
      "fairness": [
        "SpecMC == InitMC /\\ [][NextMC]_mcvars /\\ WF_mcvars(AdvanceMC)"
      ],
      "warnings": [
        "Warning: The invariant PureRuntimeContracts is a constant-level formula (i.e., it contains no variables, primes, or temporal operators) and evaluates to TRUE. To assert constant-level formulas in your spec, use ASSUME ConstInv. If you optionally want to give the assumption a name, write ASSUME YourAssumption == ConstInv instead. See https://explain.tlapl.us/assumptions-and-invariants for additional details."
      ],
      "max_seconds": 90,
      "evidence_class": "finite-state-exploration",
      "check_deadlock": true,
      "description": "ordinary finite model. Underlying ordinary program: finite transition exploration with state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model."
    },
    {
      "id": "ref-identity-renewal-defective",
      "module": "IdentityRenewalVariantMC",
      "config": "IdentityRenewalVariantMC-defective.cfg",
      "expected_exit": 12,
      "outcome": "safety-counterexample",
      "properties": [
        "TypeOK",
        "PhysicalUniqueness",
        "HostIntegrity",
        "RuntimeAssertions",
        "PureRuntimeContracts",
        "Completed"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "IdentityRenewalVariantMC-defective.cfg",
        "constants": [
          [
            "CardData <- Data"
          ],
          [
            "InitialState <- DummyInitial"
          ],
          [
            "Commands <- NoCommands"
          ],
          [
            "CardOverride <- NoOverride"
          ],
          [
            "CheckpointOverrideAllowed <- NoCheckpointOverride"
          ],
          [
            "Relocate <- DefectBodyIdentityRenewalVariant"
          ],
          [
            "mcvars <- ControlFirstVariables"
          ]
        ],
        "definition_overrides": {
          "CardData": "Data",
          "CardOverride": "NoOverride",
          "CheckpointOverrideAllowed": "NoCheckpointOverride",
          "Commands": "NoCommands",
          "InitialState": "DummyInitial",
          "Relocate": "DefectBodyIdentityRenewalVariant",
          "mcvars": "ControlFirstVariables"
        },
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 512,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "Object identifiers, ownership/control, relocation and visibility inputs are well-shaped finite records in this profile; general information noninterference is outside scope."
      ],
      "fairness": [
        "SpecMC == InitMC /\\ [][NextMC]_mcvars /\\ WF_mcvars(AdvanceMC)"
      ],
      "warnings": [
        "Warning: The invariant PureRuntimeContracts is a constant-level formula (i.e., it contains no variables, primes, or temporal operators) and evaluates to TRUE. To assert constant-level formulas in your spec, use ASSUME ConstInv. If you optionally want to give the assumption a name, write ASSUME YourAssumption == ConstInv instead. See https://explain.tlapl.us/assumptions-and-invariants for additional details."
      ],
      "max_seconds": 90,
      "evidence_class": "finite-state-exploration",
      "check_deadlock": true,
      "description": "intentional named invariant counterexample. Underlying ordinary program: finite transition exploration with state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model.",
      "expected_property": "RuntimeAssertions",
      "negative_of": "ref-identity-renewal-ordinary"
    },
    {
      "id": "ref-type-ownership-ordinary",
      "module": "TypeOwnershipVariantMC",
      "config": "TypeOwnershipVariantMC-ordinary.cfg",
      "expected_exit": 0,
      "outcome": "success",
      "properties": [
        "Block3Assertions"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "TypeOwnershipVariantMC-ordinary.cfg",
        "constants": [],
        "definition_overrides": {},
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 512,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "The selected finite metadata, role, zone, face and setup constructors are supplied exactly; arbitrary strings or metadata tables are outside this checking scope."
      ],
      "fairness": [],
      "warnings": [],
      "max_seconds": 90,
      "evidence_class": "prepared-assertions",
      "check_deadlock": true,
      "description": "ordinary finite model. Underlying ordinary program: prepared/pointwise assertion fixture; no reached state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model."
    },
    {
      "id": "ref-type-ownership-defective",
      "module": "TypeOwnershipVariantMC",
      "config": "TypeOwnershipVariantMC-defective.cfg",
      "expected_exit": 12,
      "outcome": "safety-counterexample",
      "properties": [
        "Block3Assertions"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "TypeOwnershipVariantMC-defective.cfg",
        "constants": [
          [
            "BarrierInstructionOwnerKindValid <- DefectBodyTypeOwnershipVariant"
          ]
        ],
        "definition_overrides": {
          "BarrierInstructionOwnerKindValid": "DefectBodyTypeOwnershipVariant"
        },
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 512,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "The selected finite metadata, role, zone, face and setup constructors are supplied exactly; arbitrary strings or metadata tables are outside this checking scope."
      ],
      "fairness": [],
      "warnings": [],
      "max_seconds": 90,
      "evidence_class": "prepared-assertions",
      "check_deadlock": true,
      "description": "intentional named invariant counterexample. Underlying ordinary program: prepared/pointwise assertion fixture; no reached state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model.",
      "expected_property": "Block3Assertions",
      "negative_of": "ref-type-ownership-ordinary"
    },
    {
      "id": "ref-turn-handoff-ordinary",
      "module": "TurnHandoffVariantMC",
      "config": "TurnHandoffVariantMC-ordinary.cfg",
      "expected_exit": 0,
      "outcome": "success",
      "properties": [
        "Block5Assertions"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "TurnHandoffVariantMC-ordinary.cfg",
        "constants": [],
        "definition_overrides": {},
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 512,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "The selected phase schedule, objective values and completion/checkpoint providers are supplied exactly; no complete-game or arbitrary-scheduler progress claim is made."
      ],
      "fairness": [],
      "warnings": [],
      "max_seconds": 90,
      "evidence_class": "prepared-assertions",
      "check_deadlock": true,
      "description": "ordinary finite model. Underlying ordinary program: prepared/pointwise assertion fixture; no reached state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model."
    },
    {
      "id": "ref-turn-handoff-defective",
      "module": "TurnHandoffVariantMC",
      "config": "TurnHandoffVariantMC-defective.cfg",
      "expected_exit": 12,
      "outcome": "safety-counterexample",
      "properties": [
        "Block5Assertions"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "TurnHandoffVariantMC-defective.cfg",
        "constants": [
          [
            "TurnOtherPlayer5 <- DefectBodyTurnHandoffVariant"
          ]
        ],
        "definition_overrides": {
          "TurnOtherPlayer5": "DefectBodyTurnHandoffVariant"
        },
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 512,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "The selected phase schedule, objective values and completion/checkpoint providers are supplied exactly; no complete-game or arbitrary-scheduler progress claim is made."
      ],
      "fairness": [],
      "warnings": [],
      "max_seconds": 90,
      "evidence_class": "prepared-assertions",
      "check_deadlock": true,
      "description": "intentional named invariant counterexample. Underlying ordinary program: prepared/pointwise assertion fixture; no reached state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model.",
      "expected_property": "Block5Assertions",
      "negative_of": "ref-turn-handoff-ordinary"
    },
    {
      "id": "ref-traversal-identity-ordinary",
      "module": "TraversalIdentityVariantMC",
      "config": "TraversalIdentityVariantMC-ordinary.cfg",
      "expected_exit": 0,
      "outcome": "success",
      "properties": [
        "Block6Assertions"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "TraversalIdentityVariantMC-ordinary.cfg",
        "constants": [],
        "definition_overrides": {},
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 512,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "Layouts, orders, current object references, lawful views and selection/effect providers are the exact finite fixtures; these do not grant broader observation rights."
      ],
      "fairness": [],
      "warnings": [],
      "max_seconds": 90,
      "evidence_class": "prepared-assertions",
      "check_deadlock": true,
      "description": "ordinary finite model. Underlying ordinary program: prepared/pointwise assertion fixture; no reached state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model."
    },
    {
      "id": "ref-traversal-identity-defective",
      "module": "TraversalIdentityVariantMC",
      "config": "TraversalIdentityVariantMC-defective.cfg",
      "expected_exit": 12,
      "outcome": "safety-counterexample",
      "properties": [
        "Block6Assertions"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "TraversalIdentityVariantMC-defective.cfg",
        "constants": [
          [
            "TraversalDirectEdge6 <- DefectBodyTraversalIdentityVariant"
          ]
        ],
        "definition_overrides": {
          "TraversalDirectEdge6": "DefectBodyTraversalIdentityVariant"
        },
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 512,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "Layouts, orders, current object references, lawful views and selection/effect providers are the exact finite fixtures; these do not grant broader observation rights."
      ],
      "fairness": [],
      "warnings": [],
      "max_seconds": 90,
      "evidence_class": "prepared-assertions",
      "check_deadlock": true,
      "description": "intentional named invariant counterexample. Underlying ordinary program: prepared/pointwise assertion fixture; no reached state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model.",
      "expected_property": "Block6Assertions",
      "negative_of": "ref-traversal-identity-ordinary"
    },
    {
      "id": "ref-operation-admission-ordinary",
      "module": "OperationAdmissionVariantMC",
      "config": "OperationAdmissionVariantMC-ordinary.cfg",
      "expected_exit": 0,
      "outcome": "success",
      "properties": [
        "Block8Assertions"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "OperationAdmissionVariantMC-ordinary.cfg",
        "constants": [],
        "definition_overrides": {},
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 512,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "Permission, destination, effect, candidate-state and completion witnesses are supplied at their documented boundaries; an operation source listing is not a general interpreter."
      ],
      "fairness": [],
      "warnings": [
        "Warning: The EXCEPT was applied to non-existing fields of the value at"
      ],
      "max_seconds": 90,
      "evidence_class": "prepared-assertions",
      "check_deadlock": true,
      "description": "ordinary finite model. Underlying ordinary program: prepared/pointwise assertion fixture; no reached state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model."
    },
    {
      "id": "ref-operation-admission-defective",
      "module": "OperationAdmissionVariantMC",
      "config": "OperationAdmissionVariantMC-defective.cfg",
      "expected_exit": 12,
      "outcome": "safety-counterexample",
      "properties": [
        "Block8Assertions"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "OperationAdmissionVariantMC-defective.cfg",
        "constants": [
          [
            "PayActivation8 <- DefectBodyOperationAdmissionVariant"
          ]
        ],
        "definition_overrides": {
          "PayActivation8": "DefectBodyOperationAdmissionVariant"
        },
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 512,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "Permission, destination, effect, candidate-state and completion witnesses are supplied at their documented boundaries; an operation source listing is not a general interpreter."
      ],
      "fairness": [],
      "warnings": [
        "Warning: The EXCEPT was applied to non-existing fields of the value at"
      ],
      "max_seconds": 90,
      "evidence_class": "prepared-assertions",
      "check_deadlock": true,
      "description": "intentional named invariant counterexample. Underlying ordinary program: prepared/pointwise assertion fixture; no reached state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model.",
      "expected_property": "Block8Assertions",
      "negative_of": "ref-operation-admission-ordinary"
    },
    {
      "id": "ref-interrupt-condition-ordinary",
      "module": "InterruptConditionVariantMC",
      "config": "InterruptConditionVariantMC-ordinary.cfg",
      "expected_exit": 0,
      "outcome": "success",
      "properties": [
        "Block9Assertions"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "InterruptConditionVariantMC-ordinary.cfg",
        "constants": [],
        "definition_overrides": {},
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 1536,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "Activity, legality, current-effect, payment and exact caller/child completion witnesses are supplied in the selected model; external ability interpretation is outside scope."
      ],
      "fairness": [],
      "warnings": [],
      "max_seconds": 90,
      "evidence_class": "prepared-assertions",
      "check_deadlock": true,
      "description": "ordinary finite model. Underlying ordinary program: prepared/pointwise assertion fixture; no reached state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model."
    },
    {
      "id": "ref-interrupt-condition-defective",
      "module": "InterruptConditionVariantMC",
      "config": "InterruptConditionVariantMC-defective.cfg",
      "expected_exit": 12,
      "outcome": "safety-counterexample",
      "properties": [
        "Block9Assertions"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "InterruptConditionVariantMC-defective.cfg",
        "constants": [
          [
            "AbilityIsInterrupt9 <- DefectBodyInterruptConditionVariant"
          ]
        ],
        "definition_overrides": {
          "AbilityIsInterrupt9": "DefectBodyInterruptConditionVariant"
        },
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 1536,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "Activity, legality, current-effect, payment and exact caller/child completion witnesses are supplied in the selected model; external ability interpretation is outside scope."
      ],
      "fairness": [],
      "warnings": [],
      "max_seconds": 90,
      "evidence_class": "prepared-assertions",
      "check_deadlock": true,
      "description": "intentional named invariant counterexample. Underlying ordinary program: prepared/pointwise assertion fixture; no reached state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model.",
      "expected_property": "Block9Assertions",
      "negative_of": "ref-interrupt-condition-ordinary"
    },
    {
      "id": "ref-registry-uniqueness-ordinary",
      "module": "RegistryUniquenessVariantMC",
      "config": "RegistryUniquenessVariantMC-ordinary.cfg",
      "expected_exit": 0,
      "outcome": "success",
      "properties": [
        "SAssertionsSA"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "RegistryUniquenessVariantMC-ordinary.cfg",
        "constants": [
          [
            "PaidAmounts",
            "{ 0 , 1 }"
          ],
          [
            "PaidMoves",
            "{ TRUE , FALSE }"
          ]
        ],
        "definition_overrides": {},
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 512,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "Registered role/zone/event constructors, normalized source/provenance identities, provider facts and pinned renderer behavior are restricted to the selected finite contexts."
      ],
      "fairness": [],
      "warnings": [],
      "max_seconds": 90,
      "evidence_class": "prepared-assertions",
      "check_deadlock": false,
      "description": "ordinary finite model. Underlying ordinary program: prepared/pointwise assertion fixture; no reached state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model."
    },
    {
      "id": "ref-registry-uniqueness-defective",
      "module": "RegistryUniquenessVariantMC",
      "config": "RegistryUniquenessVariantMC-defective.cfg",
      "expected_exit": 12,
      "outcome": "safety-counterexample",
      "properties": [
        "SAssertionsSA"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "RegistryUniquenessVariantMC-defective.cfg",
        "constants": [
          [
            "PaidAmounts",
            "{ 0 , 1 }"
          ],
          [
            "PaidMoves",
            "{ TRUE , FALSE }"
          ],
          [
            "CatalogValidSA <- DefectBodyRegistryUniquenessVariant"
          ]
        ],
        "definition_overrides": {
          "CatalogValidSA": "DefectBodyRegistryUniquenessVariant"
        },
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 512,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "Registered role/zone/event constructors, normalized source/provenance identities, provider facts and pinned renderer behavior are restricted to the selected finite contexts."
      ],
      "fairness": [],
      "warnings": [],
      "max_seconds": 90,
      "evidence_class": "prepared-assertions",
      "check_deadlock": false,
      "description": "intentional named invariant counterexample. Underlying ordinary program: prepared/pointwise assertion fixture; no reached state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model.",
      "expected_property": "SAssertionsSA",
      "negative_of": "ref-registry-uniqueness-ordinary"
    },
    {
      "id": "ref-completion-publication-ordinary",
      "module": "CompletionPublicationVariantMC",
      "config": "CompletionPublicationVariantMC-ordinary.cfg",
      "expected_exit": 0,
      "outcome": "success",
      "properties": [
        "ASourceSafety",
        "AActionPaymentSafety",
        "ACheckpointSafety",
        "AStepSafety",
        "ACompletionSafety",
        "AHistorySafety",
        "AOuterSafety",
        "AEventuallyReturns"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "CompletionPublicationVariantMC-ordinary.cfg",
        "constants": [
          [
            "AScenario",
            "\"empty\""
          ],
          [
            "AMutation",
            "\"none\""
          ],
          [
            "PaidAmounts",
            "{ 0 }"
          ],
          [
            "PaidMoves",
            "{ FALSE }"
          ]
        ],
        "definition_overrides": {},
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 512,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "Outer schedules, procedure adapters, provider facts, metadata and exact caller/transaction/receipt identities are the selected finite composition fixtures."
      ],
      "fairness": [
        "ASpec == AInit /\\ [][ANext]_<<guideCaseT11,qT11>> /\\ WF_<<guideCaseT11,qT11>>(ANext)"
      ],
      "warnings": [],
      "max_seconds": 90,
      "evidence_class": "finite-state-exploration",
      "check_deadlock": true,
      "description": "ordinary finite model. Underlying ordinary program: finite transition exploration with state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model."
    },
    {
      "id": "ref-completion-publication-defective",
      "module": "CompletionPublicationVariantMC",
      "config": "CompletionPublicationVariantMC-defective.cfg",
      "expected_exit": 12,
      "outcome": "safety-counterexample",
      "properties": [
        "ASourceSafety",
        "AActionPaymentSafety",
        "ACheckpointSafety",
        "AStepSafety",
        "ACompletionSafety",
        "AHistorySafety",
        "AOuterSafety",
        "AEventuallyReturns"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "CompletionPublicationVariantMC-defective.cfg",
        "constants": [
          [
            "AScenario",
            "\"empty\""
          ],
          [
            "AMutation",
            "\"repeated-completion-publication\""
          ],
          [
            "PaidAmounts",
            "{ 0 }"
          ],
          [
            "PaidMoves",
            "{ FALSE }"
          ]
        ],
        "definition_overrides": {},
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 512,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "Outer schedules, procedure adapters, provider facts, metadata and exact caller/transaction/receipt identities are the selected finite composition fixtures."
      ],
      "fairness": [
        "ASpec == AInit /\\ [][ANext]_<<guideCaseT11,qT11>> /\\ WF_<<guideCaseT11,qT11>>(ANext)"
      ],
      "warnings": [],
      "max_seconds": 90,
      "evidence_class": "finite-state-exploration",
      "check_deadlock": true,
      "description": "intentional named invariant counterexample. Underlying ordinary program: finite transition exploration with state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model.",
      "expected_property": "ACompletionSafety",
      "negative_of": "ref-completion-publication-ordinary"
    },
    {
      "id": "ref-action-cost-reaction",
      "module": "ActionCompositionMC",
      "config": "Reactive-cost-reaction.cfg",
      "expected_exit": 0,
      "outcome": "success",
      "properties": [
        "ASourceSafety",
        "AActionPaymentSafety",
        "ACheckpointSafety",
        "AStepSafety",
        "ACompletionSafety",
        "AHistorySafety",
        "AOuterSafety",
        "AEventuallyReturns"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "Reactive-cost-reaction.cfg",
        "constants": [
          [
            "AScenario",
            "\"cost-reaction\""
          ],
          [
            "AMutation",
            "\"none\""
          ],
          [
            "PaidAmounts",
            "{ 0 }"
          ],
          [
            "PaidMoves",
            "{ FALSE }"
          ]
        ],
        "definition_overrides": {},
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 512,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "Outer schedules, procedure adapters, provider facts, metadata and exact caller/transaction/receipt identities are the selected finite composition fixtures.",
        "Applicable costs, permissions, allocation and valid candidate/payment witnesses are the exact supplied finite fixtures; no general payment interpreter is supplied.",
        "Registered role/zone/event constructors, normalized source/provenance identities, provider facts and pinned renderer behavior are restricted to the selected finite contexts.",
        "Activity, legality, current-effect, payment and exact caller/child completion witnesses are supplied in the selected model; external ability interpretation is outside scope."
      ],
      "fairness": [
        "ASpec == AInit /\\ [][ANext]_<<guideCaseT11,qT11>> /\\ WF_<<guideCaseT11,qT11>>(ANext)"
      ],
      "warnings": [],
      "max_seconds": 90,
      "evidence_class": "finite-state-exploration",
      "check_deadlock": true,
      "description": "ordinary finite model. Underlying ordinary program: finite transition exploration with state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model."
    },
    {
      "id": "ref-action-completion-reaction",
      "module": "ActionCompositionMC",
      "config": "Reactive-completion-reaction.cfg",
      "expected_exit": 0,
      "outcome": "success",
      "properties": [
        "ASourceSafety",
        "AActionPaymentSafety",
        "ACheckpointSafety",
        "AStepSafety",
        "ACompletionSafety",
        "AHistorySafety",
        "AOuterSafety",
        "AEventuallyReturns"
      ],
      "constraints": [],
      "bounds": {
        "configuration": "Reactive-completion-reaction.cfg",
        "constants": [
          [
            "AScenario",
            "\"completion-reaction\""
          ],
          [
            "AMutation",
            "\"none\""
          ],
          [
            "PaidAmounts",
            "{ 0 }"
          ],
          [
            "PaidMoves",
            "{ FALSE }"
          ]
        ],
        "definition_overrides": {},
        "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.",
        "heap_mib": 512,
        "workers": 1,
        "seed": 1,
        "fingerprint_polynomial": 0,
        "max_seconds": 90
      },
      "assumptions": [
        "Outer schedules, procedure adapters, provider facts, metadata and exact caller/transaction/receipt identities are the selected finite composition fixtures.",
        "Applicable costs, permissions, allocation and valid candidate/payment witnesses are the exact supplied finite fixtures; no general payment interpreter is supplied.",
        "Registered role/zone/event constructors, normalized source/provenance identities, provider facts and pinned renderer behavior are restricted to the selected finite contexts.",
        "Activity, legality, current-effect, payment and exact caller/child completion witnesses are supplied in the selected model; external ability interpretation is outside scope."
      ],
      "fairness": [
        "ASpec == AInit /\\ [][ANext]_<<guideCaseT11,qT11>> /\\ WF_<<guideCaseT11,qT11>>(ANext)"
      ],
      "warnings": [],
      "max_seconds": 90,
      "evidence_class": "finite-state-exploration",
      "check_deadlock": true,
      "description": "ordinary finite model. Underlying ordinary program: finite transition exploration with state-changing edges. A negative result supports only its actual captured prefix. Evidence applies only to the exact configured finite model."
    }
  ]
}