Stresses MULTIPLE defers enqueued in a SINGLE component RTC: Worker2.go defers two
blocks (d1 then d2) in one handler.

dzn golden (System2_golden.aut): strictly p.d1 then p.d2.

KEY RESULT: ours is weak-trace EQUAL to dzn here (ours ⊑ dzn, included).
A single leaf has ONE sim.deferred FIFO, so INTRA-leaf multi-defer order is ALREADY
correct in the leaf LTS. The global-defer over-approximation (misc_global_defer /
_nested) is purely CROSS-LEAF: independent leaf defer queues interleaving in the
composition. So the synchronization monitor only needs to enforce CROSS-leaf order;
each leaf already discharges its own blocks in FIFO order.

DESIGN COROLLARY (id namespace):
- <defer> DISCHARGE needs only the OWNER tag (leaf): the monitor pops the global
  head iff its owner == the discharging leaf; the leaf's own LTS picks WHICH of its
  blocks (its internal FIFO already matches the order its entries sit in the global
  queue, by RTC atomicity). No per-block id on discharge.
- <defer-qin>/<defer-cancel> need a per-block id = (owner, slot) where slot is a
  small per-leaf index (bounded by queue-size-defer). cancel(owner,slot) is then
  position-independent -> no recompute across discharges/layers. Owner is a
  projection of the id, so discharge (owner) and qin/cancel (owner,slot) share one
  namespace, with discharge using the coarser projection.

GOLDEN NOTE: *_golden.aut is generated via scripts/lbs-system-golden.sh (inspect-ports + dzn graph + lbs_system_transform.py), which strips dzn's known provides-port .inevitable BUG (+ tau self-loops, fork-at-reply). Validate with: NUC_DEFER_SYNC=1 NUC_RTCPROD=1 nucleos lts -m <C> | wf-check.py aut - <golden> --system.
