anchor.diff:      State#property_state{joined_nodes=JoinedNodes ++ [Node], counter=Counter+1};
   next_state(#property_state{counter=Counter, joined_nodes=JoinedNodes}=State, _Res, {call, ?MODULE, sync_leave_cluster, [Node]}) -> 
       State#property_state{joined_nodes=JoinedNodes -- [Node], counter=Counter+1};
  +next_state(#property_state{}=State, _Res, {call, ?MODULE, forced_failure, []}) -> 
  +    State;
   next_state(#property_state{counter=Counter, fault_model_state=FaultModelState0, node_state=NodeState0, joined_nodes=JoinedNodes}=State, Res, {call, _Mod, Fun, _Args}=Call) -> 
       case lists:member(Fun, node_functions()) of
           true ->
  
positive.code: %% Given the state `State' *prior* to the call `{call, Mod, Fun, Args}',
  %% determine whether the result `Res' (coming from the actual system)
  %% makes sense.
  postcondition(_State, {call, ?MODULE, sync_join_cluster, [_Node, _JoinNode]}, {ok, _Members}) ->
      postcondition_debug("postcondition sync_join_cluster fired", []),
      true;
  
negative.code: %%%===================================================================
  %%% Commands
  %%%===================================================================
  
  forced_failure() ->
      RunnerNode = node(),
  
      command_preamble(RunnerNode, [forced_failure]),
  
      %% Do nothing.
  
      command_conclusion(RunnerNode, [forced_failure]),
  
      ok.
  
  sync_join_cluster(Node, JoinNode) ->
      command_preamble(Node, [sync_join_cluster, JoinNode]),
  