Some TLA+ suggestions about ghostferry

[shuhaowu]

Thanks for the tips! This is the first real TLA+ spec I wrote so I appreciate any tips. I'll take a look at running this at some point in the near future.

I'm not sure if I can discount holes in the database, I suspect I can but I don't know how to prove it.

About the labels, I found it more clear this way as then all the code is lined up and indented similar to how actual code would be. I can then trace each label back to the code, although I'm still not quite sure what style I should adopt.

[hwayne]

Happy to help!

I'm not sure if I can discount holes in the database, I suspect I can but I don't know how to prove it.

One thing you can do is create separate models, one where you have holes and one where you don't. Since the latter would have one fewer "record", you can check it over a larger set of inputs in the same amount of time. You'd check the former with a smaller model and the latter with a larger one.

If you go this route, you could make a CONSTANT TableGenerator(_) operator and choose in the model whether it generates all length-n tuples of PossibleRecords or all possible tuples up to length-n.

Please let me know if you have any questions!