anchor.diff:  %% Initialize the state
   initial_state() ->
       #state{vclock=vclock:fresh(),
  -           model=orddict:from_list([{ID, 0} || ID <- ?ACTOR_IDS])
  +           model=new_model()
             }.
   
   %% Command generator, S is the state
  
positive.code:     oneof([
             {call, vclock, increment, [gen_actor_id(), S#state.vclock]},
             {call, vclock, get_counter, [gen_actor_id(), S#state.vclock]},
             {call, vclock, merge, [[gen_vclock(), S#state.vclock]]}
            ]).
  
  %% Next state transformation, S is the current state
  
negative.code: postcondition(#state{model=M}, {call,vclock,get_counter,[ActorId, _]}, Res) ->
      %% The counter for a given actor is the same as the model
      Res == orddict:fetch(ActorId, M);
  postcondition(#state{model=M}, {call,_,merge,[{OM,Other},VClock]}, Res) ->
      Merged = model_merge(M, OM),
      %% The merged state has all the same actor counts
      lists:all(fun(A) -> orddict:fetch(A,Merged) == vclock:get_counter(A,Res) end, 
                ?ACTOR_IDS) andalso
          %% The merged vector clock descends from both inputs
          vclock:descends(Res, Other) andalso vclock:descends(Res, VClock);
  postcondition(_S, _C, _Res) ->
      true.
  