Merge cleanup branch

This branch separated ModelChecker into two separate classes/modules. It was a
big disruptive change, and it was not compile-able at some points (the BROKEN
commit and some of its successors). Hence the non-fast-forward merge here, to
record the divergent portion of history as special.