Tla Plus, Resilience, Software Development, DevOps.
more than having no garbage collection at all was. It is tempting to force the model to always do garbage collection just to get the model to pass, which is also not useful. What we could do instead is reconsider ifServersHealthy should be an invariant the way it is. When we define an invariant,