anchor.diff:  %% Initialize the state
   initial_state() ->
       #state{vclock=vclock:fresh(),
  -           model=orddict:from_list([{ID, 0} || ID <- ?ACTOR_IDS])
  +           model=new_model()
             }.
   
   %% Command generator, S is the state
  
positive.code:             model=orddict:update_counter(ActorId, 1, S#state.model)};
  next_state(S,_V,{call,vclock,get_counter,[_, _]}) ->
      S;
  next_state(S,V,{call,vclock,merge,[[Other,_VClock]]}) ->
      S#state{vclock=V, model=model_merge(S#state.model, Other)};
  next_state(S,_V,{call,_,_,_}) ->
      S.
  
  
negative.code: postcondition(#state{model=M}, {call,vclock,get_counter,[ActorId, _]}, Res) ->
      %% The counter for a given actor is the same as the model
      Res == orddict:fetch(ActorId, M);
  postcondition(#state{model=M}, {call,_,merge,[{OM,Other},VClock]}, Res) ->
      Merged = model_merge(M, OM),
      %% The merged state has all the same actor counts
      lists:all(fun(A) -> orddict:fetch(A,Merged) == vclock:get_counter(A,Res) end, 
                ?ACTOR_IDS) andalso
          %% The merged vector clock descends from both inputs
          vclock:descends(Res, Other) andalso vclock:descends(Res, VClock);
  postcondition(_S, _C, _Res) ->
      true.
  