Related: finding the same bug with TLA+ https://news.ycombinator.com/item?id=48730953