anchor.diff:  postcondition(#state{model=M}, {call,vclock,get_counter,[ActorId, _]}, Res) ->
       %% The counter for a given actor is the same as the model
       Res == orddict:fetch(ActorId, M);
  -postcondition(#state{model=M}, {call,vclock,merge,[[Other,VClock]]}, Res) ->
  -    %% The counter for a given actor is the same as the model
  -    Merged = model_merge(M,Other),
  +postcondition(#state{model=M}, {call,_,merge,[{OM,Other},VClock]}, Res) ->
  +    Merged = model_merge(M, OM),
  +    %% The merged state has all the same actor counts
       lists:all(fun(A) -> orddict:fetch(A,Merged) == vclock:get_counter(A,Res) end, 
                 ?ACTOR_IDS) andalso
  +        %% The merged vector clock descends from both inputs
           vclock:descends(Res, Other) andalso vclock:descends(Res, VClock);
   postcondition(_S, _C, _Res) ->
       true.
  
positive.code: %% Initialize the state
  initial_state() ->
      #state{vclock=vclock:fresh(),
             model=orddict:from_list([{ID, 0} || ID <- ?ACTOR_IDS])
            }.
  
  %% Command generator, S is the state
  
negative.code:     oneof([
             {call, vclock, increment, [gen_actor_id(), S#state.vclock]},
             {call, vclock, get_counter, [gen_actor_id(), S#state.vclock]},
             {call, ?MODULE, merge, [gen_vclock(), S#state.vclock]}
            ]).
  
  %% Next state transformation, S is the current state
  