I've added a marked for the Athena problem case, and now no more false 'complete proof' results are produced.
However, the tool reports, 'no attack within bounds', which is slightly inaccurate
depending on the interpretatio of 'bounds'.
the (monstrously large) system structure, there is now a global
'switchdata' structure originating in switches.c. This makes it much
easier to see what's happening.
* Note: although this code has been tested, there might be some
hiccups, because doing multiple search&replace actions over all
files is bound to cause some problems.