@hansjm10/volt-coding-agent 0.0.0-bootstrap.0 → 0.1.0

package/docs/tla/ClientAuth.tla

@@ -0,0 +1,205 @@
+-------------------------------- MODULE ClientAuth --------------------------------
+\* In plain terms
+\*
+\* This is the door: deciding whether a phone is allowed to connect. A phone is
+\* identified by its Iroh node id (never by anything it claims in the hello). The
+\* security questions that matter:
+\*   - Can a REVOKED phone get back in? (Only after the operator explicitly
+\*     approves a re-pair AND a fresh, unexpired pairing secret is used.)
+\*   - Can a one-time pairing secret be replayed by a DIFFERENT phone? (No: once
+\*     consumed it is a tombstone that rejects any other node.)
+\*   - Can an EXPIRED secret still pair? (No.)
+\*   - Can a stale approval, or a host clock that jumped backwards, silently keep
+\*     a revoked phone's re-pair window open forever? (No -- the approval window
+\*     fails CLOSED on a negative time delta.)
+\*
+\* This module models the host state (paired / revoked / approval / secret / clock)
+\* evolving through operator and phone actions, and checks that no sequence of
+\* interleavings ever admits a phone that should be blocked.
+\*
+\* Source of truth:
+\*   src/core/remote/iroh/authorization.ts  (authorizeIrohRemoteClient)
+\*   src/core/remote/iroh/state.ts          (tombstones, revoked clients)
+\*   docs/iroh-remote-protocol.md           (handshake failure outcomes)
+\*
+\* The decision function `Decide` mirrors authorizeIrohRemoteClient's ORDERED
+\* checks; `LegitPaired` states independently what must be true for a pairing to
+\* be safe. Keeping them separate is what makes the invariants non-vacuous: if a
+\* future edit reorders or weakens the decision, the two diverge and TLC reports it.
+
+EXTENDS Naturals
+
+CONSTANTS
+    Nodes,        \* client node ids (symmetric); small, e.g. {n1, n2}
+    NONE          \* sentinel
+
+ASSUME NONE \notin Nodes
+
+MaxClock     == 2   \* small logical clock; can move forwards AND backwards
+ApprovalTTL  == 1   \* re-pair approval window (clock units)
+
+SecretStates == {"none", "pending", "expired", "consumed"}
+Outcomes     == {"idle", "client_revoked", "pairing_secret_expired", "workspace_denied",
+                 "pairing_secret_consumed", "client_unknown", "ok_paired", "ok_existing"}
+
+VARIABLES
+    paired,          \* [Nodes -> BOOLEAN]  a known paired client
+    revoked,         \* [Nodes -> BOOLEAN]  has a revocation tombstone
+    approved,        \* [Nodes -> BOOLEAN]  re-pair approval granted
+    approvedAt,      \* [Nodes -> 0..MaxClock]  when approval was granted
+    secretState,     \* the single current pairing secret slot
+    secretConsumer,  \* Nodes \cup {NONE}  who consumed the secret
+    wsAvailable,     \* requested workspace currently usable
+    clock,           \* logical clock
+    lastOutcome,     \* result of the most recent Attempt
+    illegitPair,     \* the last Attempt paired a phone that should have been blocked
+    wsBypass         \* the last Attempt returned ok while the workspace was unavailable
+
+vars == << paired, revoked, approved, approvedAt, secretState, secretConsumer,
+           wsAvailable, clock, lastOutcome, illegitPair, wsBypass >>
+
+-----------------------------------------------------------------------------
+CATypeOK ==
+    /\ paired \in [Nodes -> BOOLEAN]
+    /\ revoked \in [Nodes -> BOOLEAN]
+    /\ approved \in [Nodes -> BOOLEAN]
+    /\ approvedAt \in [Nodes -> 0..MaxClock]
+    /\ secretState \in SecretStates
+    /\ secretConsumer \in Nodes \cup {NONE}
+    /\ wsAvailable \in BOOLEAN
+    /\ clock \in 0..MaxClock
+    /\ lastOutcome \in Outcomes
+    /\ illegitPair \in BOOLEAN
+    /\ wsBypass \in BOOLEAN
+
+Init ==
+    /\ paired = [n \in Nodes |-> FALSE]
+    /\ revoked = [n \in Nodes |-> FALSE]
+    /\ approved = [n \in Nodes |-> FALSE]
+    /\ approvedAt = [n \in Nodes |-> 0]
+    /\ secretState = "none"
+    /\ secretConsumer = NONE
+    /\ wsAvailable = TRUE
+    /\ clock = 0
+    /\ lastOutcome = "idle"
+    /\ illegitPair = FALSE
+    /\ wsBypass = FALSE
+
+-----------------------------------------------------------------------------
+\* Re-pair approval window, with the FAIL-CLOSED lower bound (clock >= approvedAt)
+\* from authorization.ts L120: without it a backwards clock leaves a negative delta
+\* that trivially satisfies the TTL and keeps a revoked client admissible forever.
+ApprovalActive(n) ==
+    /\ revoked[n]
+    /\ approved[n]
+    /\ clock >= approvedAt[n]
+    /\ clock - approvedAt[n] <= ApprovalTTL
+
+HasPendingSecret(presents) == presents /\ secretState = "pending"
+ExpiredSecret(presents)    == presents /\ secretState = "expired"
+ConsumedSecret(presents)   == presents /\ secretState = "consumed"
+
+\* authorizeIrohRemoteClient's ordered decision (L129-301), workspace collapsed to
+\* one availability bit.
+Decide(n, presents) ==
+    IF revoked[n] /\ ~ (ApprovalActive(n) /\ HasPendingSecret(presents))
+        THEN "client_revoked"
+    ELSE IF ~ paired[n] /\ ExpiredSecret(presents)
+        THEN "pairing_secret_expired"
+    ELSE IF ~ wsAvailable
+        THEN "workspace_denied"
+    ELSE IF ~ paired[n] /\ ConsumedSecret(presents)
+        THEN "pairing_secret_consumed"
+    ELSE IF ~ paired[n] /\ ~ HasPendingSecret(presents)
+        THEN "client_unknown"
+    ELSE IF ~ paired[n]
+        THEN "ok_paired"
+    ELSE "ok_existing"
+
+\* The security SPEC for a legitimate pairing, written independently of Decide.
+LegitPaired(n, presents) ==
+    /\ ~ paired[n]
+    /\ presents
+    /\ secretState = "pending"
+    /\ wsAvailable
+    /\ (revoked[n] => ApprovalActive(n))
+
+-----------------------------------------------------------------------------
+\* A phone connects and presents (or omits) the current pairing secret.
+Attempt(n, presents) ==
+    LET oc == Decide(n, presents) IN
+    /\ lastOutcome' = oc
+    /\ illegitPair' = (oc = "ok_paired" /\ ~ LegitPaired(n, presents))
+    /\ wsBypass'    = (oc \in {"ok_paired", "ok_existing"} /\ ~ wsAvailable)
+    /\ IF oc = "ok_paired"
+       THEN \* pair: add client, consume secret, clear any revocation for this node
+            /\ paired'         = [paired         EXCEPT ![n] = TRUE]
+            /\ revoked'        = [revoked        EXCEPT ![n] = FALSE]
+            /\ approved'       = [approved       EXCEPT ![n] = FALSE]
+            /\ secretState'    = "consumed"
+            /\ secretConsumer' = n
+            /\ UNCHANGED << approvedAt, wsAvailable, clock >>
+       ELSE UNCHANGED << paired, revoked, approved, secretState, secretConsumer,
+                         approvedAt, wsAvailable, clock >>
+
+\* Operator mints a fresh pairing ticket (new secret in the slot).
+MintTicket ==
+    /\ secretState' = "pending"
+    /\ secretConsumer' = NONE
+    /\ UNCHANGED << paired, revoked, approved, approvedAt, wsAvailable, clock, lastOutcome, illegitPair, wsBypass >>
+
+\* The pending secret's TTL elapses.
+ExpireSecret ==
+    /\ secretState = "pending"
+    /\ secretState' = "expired"
+    /\ UNCHANGED << paired, revoked, approved, approvedAt, secretConsumer, wsAvailable, clock, lastOutcome, illegitPair, wsBypass >>
+
+\* Operator revokes a paired client.
+Revoke(n) ==
+    /\ paired[n] = TRUE
+    /\ paired'   = [paired   EXCEPT ![n] = FALSE]
+    /\ revoked'  = [revoked  EXCEPT ![n] = TRUE]
+    /\ approved' = [approved EXCEPT ![n] = FALSE]
+    /\ UNCHANGED << approvedAt, secretState, secretConsumer, wsAvailable, clock, lastOutcome, illegitPair, wsBypass >>
+
+\* Operator approves a re-pair for a revoked node (records approval time = now).
+ApproveRePair(n) ==
+    /\ revoked[n] = TRUE
+    /\ approved'   = [approved   EXCEPT ![n] = TRUE]
+    /\ approvedAt' = [approvedAt EXCEPT ![n] = clock]
+    /\ UNCHANGED << paired, revoked, secretState, secretConsumer, wsAvailable, clock, lastOutcome, illegitPair, wsBypass >>
+
+\* The requested workspace becomes (un)available.
+SetWorkspace(b) ==
+    /\ b # wsAvailable
+    /\ wsAvailable' = b
+    /\ UNCHANGED << paired, revoked, approved, approvedAt, secretState, secretConsumer, clock, lastOutcome, illegitPair, wsBypass >>
+
+\* The host clock moves -- forwards OR backwards (adversarial).
+SetClock(t) ==
+    /\ t # clock
+    /\ clock' = t
+    /\ UNCHANGED << paired, revoked, approved, approvedAt, secretState, secretConsumer, wsAvailable, lastOutcome, illegitPair, wsBypass >>
+
+Next ==
+    \/ MintTicket
+    \/ ExpireSecret
+    \/ \E n \in Nodes : \/ Revoke(n)
+                        \/ ApproveRePair(n)
+                        \/ \E p \in BOOLEAN : Attempt(n, p)
+    \/ \E b \in BOOLEAN : SetWorkspace(b)
+    \/ \E t \in 0..MaxClock : SetClock(t)
+
+Spec == Init /\ [][Next]_vars
+
+-----------------------------------------------------------------------------
+\* No phone is ever paired when the security spec says it should be blocked --
+\* covers revoked-re-entry (needs approval), one-time-secret replay by another node
+\* (needs a pending, not consumed/expired, secret), and the fail-closed clock check.
+NoIllegitimatePairing == illegitPair = FALSE
+
+\* Workspace authorization is re-checked on EVERY handshake: no ok outcome slips
+\* through while the workspace is unavailable (not cached at pairing).
+WorkspacePerRequest == wsBypass = FALSE
+
+=============================================================================

package/docs/tla/ClientConn.cfg

@@ -0,0 +1,16 @@
+\* TLC configuration for ClientConn.tla
+\*   ./check.sh ClientConn
+\* Checks the phone's reconnect behavior: at most one concurrent dial, no auto-
+\* reconnect while the user disconnected, terminal is absorbing, abort keeps the
+\* stream live.
+
+SPECIFICATION Spec
+
+INVARIANT
+    CCTypeOK
+    SingleReconnectDial
+    UserDiscSuppresses
+    NoIllegalReconnect
+    TerminalAbsorbing
+    AbortKeepsLive
+    DialImpliesLoop

package/docs/tla/ClientConn.tla

@@ -0,0 +1,265 @@
+-------------------------------- MODULE ClientConn --------------------------------
+\* In plain terms
+\*
+\* The phone's own connection behavior for the conversation it's showing. The
+\* things that must never go wrong:
+\*   - If the user pressed Disconnect, the phone must NOT quietly reconnect on its
+\*     own; only an explicit user reconnect resumes.
+\*   - Only ONE reconnect attempt runs at a time. A network blip while a dial is
+\*     already in flight must not spawn a second, concurrent dial.
+\*   - "Abort" (stop the current turn) is not "detach": aborting keeps the stream
+\*     live.
+\*   - A terminal failure (revoked / workspace removed) is absorbing: nothing auto-
+\*     recovers out of it; only an explicit user action does.
+\*   - An expected closure (a lease hand-off) leads to a clean reconnect; a
+\*     terminal closure leads to the absorbing failure -- neither is a surprise
+\*     disconnect.
+\*
+\* Source of truth:
+\*   volt-app .../VoltSession+Reconnect.swift  (the reconnect loop + network path)
+\*   volt-app .../ConversationClosureLedger.swift  (expected-closure markers)
+\*   volt-app README "Mobile Background Behavior"
+\*
+\* Modeling note: `loopActive` is the guard variable (reconnectTask != nil) and
+\* `dials` counts connect attempts actually in flight. The bug the code guards
+\* against (networkPathStatusDidChange clobbering a live `.connecting` dial) would
+\* clear `loopActive` while `dials > 0`, letting a second dial start -> `dials = 2`.
+\* The correct rule (NetLoss leaves an in-flight dial alone) keeps `dials <= 1`.
+
+EXTENDS Naturals
+
+Statuses    == {"live", "down", "waiting", "terminal"}
+LedgerKinds == {"none", "handoff", "terminal"}
+
+VARIABLES
+    status,             \* connection status of the shown conversation
+    dials,              \* reconnect connect attempts actually in flight (0..2)
+    loopActive,         \* a reconnect loop owns the retry (reconnectTask != nil)
+    userDisc,           \* user pressed Disconnect (suppresses auto-reconnect)
+    background,         \* app is backgrounded
+    netOK,              \* network path is satisfied
+    ledger,             \* armed expected-closure marker for this conversation
+    turnAborted,        \* the current turn was aborted (stream stays live)
+    wIllegalReconnect,  \* an auto-reconnect began while suppressed (sticky witness)
+    wTerminalEscape,    \* an auto action left the terminal state (sticky witness)
+    wAbortDropped       \* an abort dropped the stream / triggered reconnect (sticky witness)
+
+vars == << status, dials, loopActive, userDisc, background, netOK, ledger,
+           turnAborted, wIllegalReconnect, wTerminalEscape, wAbortDropped >>
+
+-----------------------------------------------------------------------------
+CCTypeOK ==
+    /\ status \in Statuses
+    /\ dials \in 0..2
+    /\ loopActive \in BOOLEAN
+    /\ userDisc \in BOOLEAN
+    /\ background \in BOOLEAN
+    /\ netOK \in BOOLEAN
+    /\ ledger \in LedgerKinds
+    /\ turnAborted \in BOOLEAN
+    /\ wIllegalReconnect \in BOOLEAN
+    /\ wTerminalEscape \in BOOLEAN
+    /\ wAbortDropped \in BOOLEAN
+
+Init ==
+    /\ status = "live"
+    /\ dials = 0
+    /\ loopActive = FALSE
+    /\ userDisc = FALSE
+    /\ background = FALSE
+    /\ netOK = TRUE
+    /\ ledger = "none"
+    /\ turnAborted = FALSE
+    /\ wIllegalReconnect = FALSE
+    /\ wTerminalEscape = FALSE
+    /\ wAbortDropped = FALSE
+
+-----------------------------------------------------------------------------
+\* canContinueAutomaticReconnect (VoltSession+Reconnect.swift L154-163), collapsed.
+CanAuto ==
+    /\ ~ userDisc
+    /\ ~ background
+    /\ netOK
+    /\ status \in {"down", "waiting"}
+
+-----------------------------------------------------------------------------
+\* beginForegroundReconnect: start the single reconnect loop and its first dial.
+\* Guards on ~loopActive (no second loop) and status not connected/connecting.
+BeginAutoDial ==
+    /\ CanAuto
+    /\ ~ loopActive
+    /\ dials = 0
+    /\ loopActive' = TRUE
+    /\ dials' = 1
+    /\ wIllegalReconnect' = wIllegalReconnect \/ userDisc            \* FALSE by CanAuto
+    /\ wTerminalEscape'   = wTerminalEscape \/ (status = "terminal") \* FALSE by CanAuto
+    /\ UNCHANGED << status, userDisc, background, netOK, ledger, turnAborted, wAbortDropped >>
+
+\* The one loop retries after a failed dial (sequential, still one loop).
+RetryDial ==
+    /\ loopActive
+    /\ dials = 0
+    /\ CanAuto
+    /\ dials' = 1
+    /\ UNCHANGED << status, loopActive, userDisc, background, netOK, ledger, turnAborted,
+                    wIllegalReconnect, wTerminalEscape, wAbortDropped >>
+
+\* A reconnect dial connects.
+DialSucceed ==
+    /\ dials >= 1
+    /\ status' = "live"
+    /\ dials' = dials - 1
+    /\ loopActive' = FALSE
+    /\ wTerminalEscape' = wTerminalEscape \/ (status = "terminal")   \* status is down/waiting here
+    /\ UNCHANGED << userDisc, background, netOK, ledger, turnAborted, wIllegalReconnect, wAbortDropped >>
+
+\* A reconnect dial fails; the loop keeps retrying only while it still can.
+DialFail ==
+    /\ dials >= 1
+    /\ dials' = dials - 1
+    /\ loopActive' = IF (~ userDisc /\ ~ background /\ netOK /\ status # "terminal") THEN loopActive ELSE FALSE
+    /\ UNCHANGED << status, userDisc, background, netOK, ledger, turnAborted,
+                    wIllegalReconnect, wTerminalEscape, wAbortDropped >>
+
+\* Unexpected stream loss (network / host): report a disconnect, become recoverable.
+LoseStreamUnexpected ==
+    /\ status = "live"
+    /\ ledger = "none"
+    /\ status' = "down"
+    /\ UNCHANGED << dials, loopActive, userDisc, background, netOK, ledger, turnAborted,
+                    wIllegalReconnect, wTerminalEscape, wAbortDropped >>
+
+\* Arm an expected-closure marker before the host closes the stream.
+MarkHandoff ==
+    /\ status = "live" /\ ledger = "none"
+    /\ ledger' = "handoff"
+    /\ UNCHANGED << status, dials, loopActive, userDisc, background, netOK, turnAborted,
+                    wIllegalReconnect, wTerminalEscape, wAbortDropped >>
+
+MarkTerminal ==
+    /\ status = "live" /\ ledger = "none"
+    /\ ledger' = "terminal"
+    /\ UNCHANGED << status, dials, loopActive, userDisc, background, netOK, turnAborted,
+                    wIllegalReconnect, wTerminalEscape, wAbortDropped >>
+
+\* Expected hand-off closure (lease_transferred / session_rekeyed_reconnect):
+\* consume the marker and reconnect cleanly -- no surprise disconnect.
+LoseStreamHandoff ==
+    /\ status = "live"
+    /\ ledger = "handoff"
+    /\ ledger' = "none"
+    /\ status' = "down"
+    /\ UNCHANGED << dials, loopActive, userDisc, background, netOK, turnAborted,
+                    wIllegalReconnect, wTerminalEscape, wAbortDropped >>
+
+\* Expected terminal closure (revocation / workspace removal): absorbing failure.
+LoseStreamTerminal ==
+    /\ status = "live"
+    /\ ledger = "terminal"
+    /\ ledger' = "none"
+    /\ status' = "terminal"
+    /\ dials' = 0
+    /\ loopActive' = FALSE
+    /\ UNCHANGED << userDisc, background, netOK, turnAborted,
+                    wIllegalReconnect, wTerminalEscape, wAbortDropped >>
+
+\* Abort the current turn: the stream stays LIVE (abort is not detach).
+Abort ==
+    /\ status = "live"
+    /\ ~ turnAborted
+    /\ turnAborted' = TRUE
+    /\ wAbortDropped' = wAbortDropped \/ (status # "live") \/ loopActive   \* FALSE: status stays live, loop untouched
+    /\ UNCHANGED << status, dials, loopActive, userDisc, background, netOK, ledger,
+                    wIllegalReconnect, wTerminalEscape >>
+
+ClearTurn ==
+    /\ turnAborted
+    /\ turnAborted' = FALSE
+    /\ UNCHANGED << status, dials, loopActive, userDisc, background, netOK, ledger,
+                    wIllegalReconnect, wTerminalEscape, wAbortDropped >>
+
+\* The user explicitly disconnects: suppress auto-reconnect, cancel any loop.
+UserDisconnect ==
+    /\ ~ userDisc
+    /\ userDisc' = TRUE
+    /\ status' = "down"
+    /\ dials' = 0
+    /\ loopActive' = FALSE
+    /\ UNCHANGED << background, netOK, ledger, turnAborted,
+                    wIllegalReconnect, wTerminalEscape, wAbortDropped >>
+
+\* The user explicitly reconnects: clears suppression, starts a dial (also the only
+\* escape from the terminal state).
+UserReconnect ==
+    /\ userDisc \/ status \in {"down", "waiting", "terminal"}
+    /\ userDisc' = FALSE
+    /\ status' = "down"
+    /\ loopActive' = TRUE
+    /\ dials' = 1
+    /\ UNCHANGED << background, netOK, ledger, turnAborted,
+                    wIllegalReconnect, wTerminalEscape, wAbortDropped >>
+
+\* Network path drops. If a dial is IN FLIGHT it owns "connecting" -- do NOT cancel
+\* it (that is the anti-double-loop rule). Otherwise cancel an idle loop.
+NetLoss ==
+    /\ netOK
+    /\ netOK' = FALSE
+    /\ IF dials > 0
+       THEN /\ UNCHANGED << status, loopActive >>
+       ELSE /\ loopActive' = FALSE
+            /\ status' = IF status = "down" THEN "waiting" ELSE status
+    /\ UNCHANGED << dials, userDisc, background, ledger, turnAborted,
+                    wIllegalReconnect, wTerminalEscape, wAbortDropped >>
+
+NetSatisfied ==
+    /\ ~ netOK
+    /\ netOK' = TRUE
+    /\ UNCHANGED << status, dials, loopActive, userDisc, background, ledger, turnAborted,
+                    wIllegalReconnect, wTerminalEscape, wAbortDropped >>
+
+\* Backgrounding detaches and cancels reconnect; foreground re-enables it.
+Background ==
+    /\ ~ background
+    /\ background' = TRUE
+    /\ loopActive' = FALSE
+    /\ dials' = 0
+    /\ status' = IF status = "live" THEN "down" ELSE status
+    /\ UNCHANGED << userDisc, netOK, ledger, turnAborted,
+                    wIllegalReconnect, wTerminalEscape, wAbortDropped >>
+
+Foreground ==
+    /\ background
+    /\ background' = FALSE
+    /\ UNCHANGED << status, dials, loopActive, userDisc, netOK, ledger, turnAborted,
+                    wIllegalReconnect, wTerminalEscape, wAbortDropped >>
+
+Next ==
+    \/ BeginAutoDial \/ RetryDial \/ DialSucceed \/ DialFail
+    \/ LoseStreamUnexpected \/ MarkHandoff \/ MarkTerminal
+    \/ LoseStreamHandoff \/ LoseStreamTerminal
+    \/ Abort \/ ClearTurn
+    \/ UserDisconnect \/ UserReconnect
+    \/ NetLoss \/ NetSatisfied \/ Background \/ Foreground
+
+Spec == Init /\ [][Next]_vars
+
+-----------------------------------------------------------------------------
+\* At most one reconnect dial is ever in flight -- a network blip during a dial
+\* never spawns a second concurrent dial.
+SingleReconnectDial == dials <= 1
+
+\* While the user has disconnected, no reconnect loop or dial is running.
+UserDiscSuppresses == userDisc => (~ loopActive /\ dials = 0)
+
+\* No AUTOMATIC action ever began a reconnect while suppressed.
+NoIllegalReconnect == wIllegalReconnect = FALSE
+
+\* No AUTOMATIC action escaped the absorbing terminal state.
+TerminalAbsorbing == wTerminalEscape = FALSE
+
+\* An abort never drops the stream or triggers a reconnect.
+AbortKeepsLive == wAbortDropped = FALSE
+
+\* A live in-flight dial implies the loop owns it (coherence of the two counters).
+DialImpliesLoop == (dials >= 1) => loopActive
+=============================================================================

package/docs/tla/LeaseBroker.cfg

@@ -0,0 +1,43 @@
+\* TLC configuration for LeaseBroker.tla
+\*
+\* Run (once a JDK 17+ and tla2tools.jar are installed):
+\*   java -XX:+UseParallelGC -jar tla2tools.jar -workers auto \
+\*        -config LeaseBroker.cfg LeaseBroker.tla
+\*
+\* This is the GREEN BASELINE. It proves the ownership + hand-off invariants, the
+\* stream-count-leak guard (NoStreamLeak, now that lease-broker.ts is fixed), and
+\* the two liveness properties.
+\*
+\* One predicate stays OFF -- it documents INTENDED behavior (decided), not a bug:
+\*   IdleAcquireOnlyWhenIdle -- a detached runtime's in-flight turn is abandoned on
+\*   TUI acquire (RFC §4.2). Add it under INVARIANT to see the trace of that path.
+
+SPECIFICATION Spec
+
+CONSTANTS
+    Keys = {k1, k2}
+    TUIs = {t1, t2}
+    MaxStreams = 2
+    NoTUI = NoTUI
+
+\* Keys and TUIs are interchangeable, but SYMMETRY is unsound with liveness
+\* (PROPERTY) checks in TLC, so it is left off here.  For an INVARIANT-only,
+\* faster run, delete the PROPERTY block below and uncomment:
+\* SYMMETRY Symmetry
+
+INVARIANT
+    TypeOK
+    OwnershipUnique
+    RuntimeIffDaemon
+    TuiOwnerWellFormed
+    DisposePendingOnlyTui
+    RelaysOnlyWhenTui
+    DrainHasAcquirer
+    StreamingCoherent
+    DrainNoNewTurn
+    NoStreamLeak
+\*  IdleAcquireOnlyWhenIdle  \* <-- documents intended detached-turn abandonment (RFC §4.2); not a bug
+
+PROPERTY
+    DrainConverges
+    EventualSettle