anchor.diff:      S2#state { service_pids = Pids };
   
   next_state(S, Res, {call, M, unhealthy_service, [Service]}) ->
  -    ?debugFmt("Next state:\n"
  -    "   in state:  ~p\n"
  -    "   last res:  ~p\n"
  -    "   service:  ~p",
  -    [S,Res,Service]),
       S;
  -    %S2 = service_up(node(), Service, S),
  -    %Pids = orddict:store(Service, Res, S2#state.service_pids),
  -    %S2#state { service_pids = Pids };
   
   next_state(S, Res, {call, M, recovering_service, [Service]}) ->
       meck:sequence(mod_health, callback, 2, [false, true]),
  
positive.code:     deep_validate(S2);
  
  postcondition(S, {call, _, unhealthy_service, [Service]}, Res) ->
      ?debugFmt("postcondition:\n"
      "   in state:  ~p\n"
      "   service:  ~p\n"
      "   in res:  ~p",
      [S, Service, Res]),
      S2 = service_up(node(), Service, S),
      S3 = service_down(node(), Service, S2),
      validate_broadcasts([S,S2,S3], Service),
      ?assert(meck:validate(mod_health)),
      deep_validate(S3);
  
  
negative.code:     after 1000 ->
          erlang:error(timeout)
      end,
      % give the broadcast for service down to be handled.
      timer:sleep(50),
      Pid.
  
  recovering_service(Service) ->
  