anchor.diff:  %%% Command sequences
   %%%===================================================================
   
  -modified_commands(Module) ->
  +finite_fault_commands(Module) ->
       ?LET(Commands, commands(Module), 
           begin 
               debug("~p: original command sequence...~n", [?MODULE]),
  
positive.code: %% Given the state `State' *prior* to the call `{call, Mod, Fun, Args}',
  %% determine whether the result `Res' (coming from the actual system)
  %% makes sense.
  postcondition(_State, {call, ?MODULE, sync_join_cluster, [_Node, _JoinNode]}, {ok, _Members}) ->
      postcondition_debug("postcondition sync_join_cluster fired", []),
      true;
  
negative.code:     State#property_state{joined_nodes=JoinedNodes ++ [Node], counter=Counter+1};
  next_state(#property_state{counter=Counter, joined_nodes=JoinedNodes}=State, _Res, {call, ?MODULE, sync_leave_cluster, [Node]}) -> 
      State#property_state{joined_nodes=JoinedNodes -- [Node], counter=Counter+1};
  next_state(#property_state{}=State, _Res, {call, ?MODULE, forced_failure, []}) -> 
      State;
  next_state(#property_state{counter=Counter, fault_model_state=FaultModelState0, node_state=NodeState0, joined_nodes=JoinedNodes}=State, Res, {call, _Mod, Fun, _Args}=Call) -> 
      case lists:member(Fun, node_functions()) of
          true ->
  