Can we have reachability properties in TLA⁺?
What happened
I was reading Hillel Wayne’s new post TLA+ Won’t Solve Everything and became fixated on one of the things he says cannot be expressed in TLA⁺: Possibility and reachability properties: that it’s always possible to make P true, even if you don’t actually decide to. Things like “I can always shut down the computer” or “A user can always change their password”. These can&r…
Summary assembled by rule from the sources below