anchor.diff:  %% What should the initial node state be.
   node_initial_state() ->
       node_debug("initializing", []),
  -    #node_state{sent=[]}.
  +    #node_state{sent=[], failed_to_send=[]}.
   
   %% Names of the node functions so we kow when we can dispatch to the node
   %% pre- and postconditions.
  
positive.code:     true;
  node_postcondition(_NodeState, {call, ?MODULE, broadcast, [_Node, _Message]}, ok) ->
      true;
  node_postcondition(#node_state{sent=Sent}, {call, ?MODULE, check_mailbox, []}, Results) ->
      lists:foldl(fun({Message, Recipients}, MessageAcc) ->
          node_debug("verifying that message ~p was received by ~p", [Message, Recipients]),
  
          All = lists:foldl(fun(Recipient, NodeAcc) ->
  
negative.code:     Sent = Sent0 ++ [{Message, Recipients}],
      NodeState#node_state{sent=Sent};
  
  node_next_state(#property_state{joined_nodes=JoinedNodes}, 
                  #node_state{failed_to_send=FailedToSend0}=NodeState, 
                  error, 
                  {call, ?MODULE, broadcast, [Node, {Id, Value}]}) ->
      Recipients = JoinedNodes,
      Message = {Id, Node, Value},
      FailedToSend = FailedToSend0 ++ [{Message, Recipients}],
      NodeState#node_state{failed_to_send=FailedToSend};
  
  %% If the broadcast returned 'error', we have to assume it was aborted (synchronous.)
  node_next_state(_State, NodeState, _Response, _Command) ->
      NodeState.
  