just one dedicated execution per document version -- NB: non-monotonicity of cancel always requires fresh update;
explicit terminate_execution;
tuned source structure;
\index{model checking example|(}%
\index{lfp@{\texttt{lfp}}!applications of|see{CTL}}
\input{CTL/document/Base.tex}
\input{CTL/document/PDL.tex}
\input{CTL/document/CTL.tex}
\index{model checking example|)}