{
 "interpretation": "The 'approximately 7.3 million model-checked states' claim corresponds to the SUM OF DISTINCT STATES across 13 runs of two bounded TLA+ models = 7642008 (rounded). It is NOT a single model and NOT a proof about the Python engine.",
 "models": [
  "CAINMCPGateAuthorization",
  "CAINPBFTCommitSafety"
 ],
 "not_proved": "bounded model checking of abstract specs; no refinement/correspondence proof to the deployed code",
 "run_count": 13,
 "runs": [
  {
   "as_expected": true,
   "checked_at": "2026-09-27T03:03:58.677604+00:00",
   "depth": 17,
   "distinct_states": 553996,
   "expected": "no error",
   "model": "CAINMCPGateAuthorization",
   "no_error": true,
   "run": "gate_byzantine_member_n4",
   "spec_sha256": "6a53f85d2ce4d0ac749d556cf0932dee99dbf429b27797285c0e69feb7415fbb",
   "states_generated": 4048953
  },
  {
   "as_expected": true,
   "checked_at": "2026-09-27T03:03:58.677604+00:00",
   "depth": 19,
   "distinct_states": 1591308,
   "expected": "no error",
   "model": "CAINMCPGateAuthorization",
   "no_error": true,
   "run": "gate_no_byzantine",
   "spec_sha256": "6a53f85d2ce4d0ac749d556cf0932dee99dbf429b27797285c0e69feb7415fbb",
   "states_generated": 12916185
  },
  {
   "as_expected": true,
   "checked_at": "2026-09-27T03:03:58.677604+00:00",
   "depth": 4,
   "distinct_states": 638,
   "expected": "NoExecWithoutQuorum VIOLATED",
   "model": "CAINMCPGateAuthorization",
   "no_error": false,
   "run": "mutant_weak_quorum_threshold_2",
   "spec_sha256": "6a53f85d2ce4d0ac749d556cf0932dee99dbf429b27797285c0e69feb7415fbb",
   "states_generated": 1117
  },
  {
   "as_expected": true,
   "checked_at": "2026-09-27T03:03:58.677604+00:00",
   "depth": 6,
   "distinct_states": 15180,
   "expected": "NotExpired VIOLATED",
   "model": "CAINMCPGateAuthorization",
   "no_error": false,
   "run": "mutant_no_expiry_check",
   "spec_sha256": "6a53f85d2ce4d0ac749d556cf0932dee99dbf429b27797285c0e69feb7415fbb",
   "states_generated": 50099
  },
  {
   "as_expected": true,
   "checked_at": "2026-09-27T03:03:58.677604+00:00",
   "depth": 5,
   "distinct_states": 3905,
   "expected": "ActionBinding VIOLATED",
   "model": "CAINMCPGateAuthorization",
   "no_error": false,
   "run": "mutant_no_action_binding",
   "spec_sha256": "6a53f85d2ce4d0ac749d556cf0932dee99dbf429b27797285c0e69feb7415fbb",
   "states_generated": 9905
  },
  {
   "as_expected": true,
   "checked_at": "2026-09-27T03:03:58.677604+00:00",
   "depth": 5,
   "distinct_states": 3905,
   "expected": "IdentityBinding VIOLATED",
   "model": "CAINMCPGateAuthorization",
   "no_error": false,
   "run": "mutant_no_identity_binding",
   "spec_sha256": "6a53f85d2ce4d0ac749d556cf0932dee99dbf429b27797285c0e69feb7415fbb",
   "states_generated": 9905
  },
  {
   "as_expected": true,
   "checked_at": "2026-09-27T03:03:58.677604+00:00",
   "depth": 5,
   "distinct_states": 5144,
   "expected": "ContextBinding VIOLATED",
   "model": "CAINMCPGateAuthorization",
   "no_error": false,
   "run": "mutant_no_context_continuity",
   "spec_sha256": "6a53f85d2ce4d0ac749d556cf0932dee99dbf429b27797285c0e69feb7415fbb",
   "states_generated": 13627
  },
  {
   "as_expected": true,
   "checked_at": "2026-09-27T03:03:58.677604+00:00",
   "depth": 7,
   "distinct_states": 44990,
   "expected": "SingleUse VIOLATED",
   "model": "CAINMCPGateAuthorization",
   "no_error": false,
   "run": "mutant_no_single_use",
   "spec_sha256": "6a53f85d2ce4d0ac749d556cf0932dee99dbf429b27797285c0e69feb7415fbb",
   "states_generated": 187269
  },
  {
   "as_expected": true,
   "checked_at": "2026-09-27T02:45:32.994302+00:00",
   "depth": 32,
   "distinct_states": 290806,
   "expected": "no error",
   "model": "CAINPBFTCommitSafety",
   "no_error": true,
   "run": "fixed_byzantine_replica_n4",
   "spec_sha256": "4b5dbbeda5bd6db9be9707a6e5f9dda1f0ea89656b9040e4ad018e1b134ce238",
   "states_generated": 1099897
  },
  {
   "as_expected": true,
   "checked_at": "2026-09-27T02:45:32.994302+00:00",
   "depth": 32,
   "distinct_states": 670340,
   "expected": "no error",
   "model": "CAINPBFTCommitSafety",
   "no_error": true,
   "run": "fixed_byzantine_leader_n1",
   "spec_sha256": "4b5dbbeda5bd6db9be9707a6e5f9dda1f0ea89656b9040e4ad018e1b134ce238",
   "states_generated": 2512355
  },
  {
   "as_expected": true,
   "checked_at": "2026-09-27T02:45:32.994302+00:00",
   "depth": 42,
   "distinct_states": 4198642,
   "expected": "no error",
   "model": "CAINPBFTCommitSafety",
   "no_error": true,
   "run": "fixed_no_byzantine",
   "spec_sha256": "4b5dbbeda5bd6db9be9707a6e5f9dda1f0ea89656b9040e4ad018e1b134ce238",
   "states_generated": 18600059
  },
  {
   "as_expected": true,
   "checked_at": "2026-09-27T02:45:32.994302+00:00",
   "depth": 14,
   "distinct_states": 48651,
   "expected": "Agreement VIOLATED",
   "model": "CAINPBFTCommitSafety",
   "no_error": false,
   "run": "mutant_old_rule_execute_on_prepared_cert",
   "spec_sha256": "4b5dbbeda5bd6db9be9707a6e5f9dda1f0ea89656b9040e4ad018e1b134ce238",
   "states_generated": 202713
  },
  {
   "as_expected": true,
   "checked_at": "2026-09-27T02:45:32.994302+00:00",
   "depth": 22,
   "distinct_states": 214503,
   "expected": "Agreement VIOLATED",
   "model": "CAINPBFTCommitSafety",
   "no_error": false,
   "run": "mutant_new_primary_ignores_reports",
   "spec_sha256": "4b5dbbeda5bd6db9be9707a6e5f9dda1f0ea89656b9040e4ad018e1b134ce238",
   "states_generated": 708068
  }
 ],
 "schema": "cain42.review.formal_reconciliation.v1",
 "source_dir": "clawx-site/evidence/formal-2026-09-27",
 "tool": "TLC (tla2tools.jar)",
 "total_distinct_states": 7642008,
 "total_generated_states": 40360152
}