{"title": "Host Session Protocol",
 "producer":
 ["GENERATED by tools/Drivers/Semantics.lean (make gen-semantics); do not edit",
  "format: effect4-semantics-report v8",
  "command: make gen-semantics",
  "inputs: tools/ProofGraph/Registry.lean, tools/Tools/Semantics.lean, tools/Drivers/Semantics.lean, tools/Tools/SemanticsDisplay.lean, tools/Tools/SemanticsDocument.lean, tools/Tools/Document.lean, tools/Tools/Document/Json.lean, src/Effect4/Laws/Auto/Semantics.lean, Test/Counterexamples/REGISTER.md, docs/core/decisions.md, lean-toolchain"],
 "format": "effect4-document/1",
 "body":
 [{"line":
   [{"text":
     "Session automaton, external reply ingestion, and boundary capabilities. "},
    {"text": "12 claims: "},
    {"text": "11 "},
    {"status": "proved"},
    {"text": ", "},
    {"text": "1 "},
    {"status": "assumed"},
    {"text": "."}],
   "kind": "para"},
  {"title": "Host session protocol and boundary",
   "kind": "part",
   "key": "about:concept:host-session-protocol",
   "body":
   [{"line":
     [{"text":
       "This page explains the host session protocol and boundary in Effect4. It covers the four-state protocol automaton, keyed call correlation, at-most-once reply application, and external host assumptions."}],
     "kind": "para"},
    {"title": "The runtime concept",
     "kind": "part",
     "key": "about:concept:host-session-protocol:runtime-concept",
     "body":
     [{"line":
       [{"text":
         "Effect programs perform external operations by dispatching asynchronous requests to the host platform and awaiting responses. In Effect rc.112, fibers pause until external listeners resolve or reject promises."}],
       "kind": "para"},
      {"line":
       [{"text":
         "Effect4 formalizes this boundary through a keyed host session ("},
        {"code": "Session"},
        {"text": ", "},
        {"code": "src/Effect4/Api/HostSession.lean"},
        {"text":
         "). External completions enter as host answers submitted and applied through strict protocol steps."}],
       "kind": "para"},
      {"line":
       [{"text":
         "This architecture isolates external side effects from internal deterministic machine steps."}],
       "kind": "para"}]},
    {"title": "Literature foundations",
     "kind": "part",
     "key": "about:concept:host-session-protocol:literature",
     "body":
     [{"line":
       [{"text":
         "The metatheory adapts session types from Wadler (2012) and Honda, Vasconcelos, and Kubo (1998). Structured session protocols track communication states and dual message exchanges."}],
       "kind": "para"},
      {"line":
       [{"text":
         "Labeled transition systems and protocol automata adapt Lynch and Vaandrager (1995)."}],
       "kind": "para"},
      {"line":
       [{"text":
         "Mathematical models of external hosts adapt comodels from Plotkin and Power (2008), Uustalu (2015), and Ahman and Bauer (2020)."}],
       "kind": "para"}]},
    {"title": "What Effect4 keeps and what it cuts",
     "kind": "part",
     "key": "about:concept:host-session-protocol:adaptations-and-cuts",
     "body":
     [{"line":
       [{"text":
         "Effect4 governs host interaction using a four-state protocol automaton ("},
        {"code": "idle"},
        {"text": ", "},
        {"code": "awaitingAsync"},
        {"text": ", "},
        {"code": "parked"},
        {"text": ", "},
        {"code": "terminated"},
        {"text": ") in "},
        {"code": "Protocol"},
        {"text": " ("},
        {"code": "src/Effect4/Api/HostProtocol.lean"},
        {"text": ")."}],
       "kind": "para"},
      {"line":
       [{"text":
         "Host replies enter through explicit call correlation. Envelope fields (session, call identifier, key, and row) match responses to waiting operations."}],
       "kind": "para"},
      {"line":
       [{"text": "Effect4 enforces at-most-once reply application ("},
        {"code": "applyReply"},
        {"text": "):"}],
       "kind": "para"},
      {"lines":
       [[{"text":
          "Each correlation key is bound, submitted, and applied at most once."}],
        [{"text":
          "Applying a reply prepares the answer and resumes the waiting fiber once."}],
        [{"text": "A retired key cannot be applied again ("},
         {"code": "session_keys_once"},
         {"text": ")."}]],
       "kind": "items"},
      {"line":
       [{"text":
         "Effect4 cuts internal handle transmission (decisions row 97, "},
        {"code": "E4-HOST-CE-007"},
        {"text":
         "). Host rows carrying internal handles like cells or scopes are rejected at table admission."}],
       "kind": "para"},
      {"line":
       [{"text":
         "Host progress is an external driver assumption, not an internal proof obligation ("},
        {"code": "docs/core/host-boundary.md"},
        {"text": ")."}],
       "kind": "para"}]},
    {"title": "How to read the claims",
     "kind": "part",
     "key": "about:concept:host-session-protocol:reading-claims",
     "body":
     [{"line":
       [{"text":
         "The claims under this concept state that host communication adheres to protocol transitions and that admitted replies fit expected continuation types."}],
       "kind": "para"},
      {"line": [{"text": "Key properties to inspect:"}], "kind": "para"},
      {"lines":
       [[{"ref": "claim:keys-once", "label": "`keys-once`"},
         {"text":
          ": A reached run binds, submits, and applies each correlation key at most once."}],
        [{"ref": "claim:allows-answer", "label": "`allows-answer`"},
         {"text":
          ": Asynchronous response delivery is an allowed protocol transition from the awaiting state."}],
        [{"ref": "claim:host-progress", "label": "`host-progress`"},
         {"text":
          ": Eventual response arrival is recorded as an external assumption."}]],
       "kind": "items"},
      {"line":
       [{"text":
         "The table of claims on this page gives each claim's status and its statement."}],
       "kind": "para"}]}]},
  {"rows":
   [[[{"ref": "claim:run-admitted-history", "label": "run-admitted-history"}],
     [{"text": "compatibility"}],
     [{"status": "proved"}],
     [{"code": "Effect4.Run.reached_history"}],
     [{"text": "—"}]],
    [[{"ref": "claim:keys-once", "label": "keys-once"}],
     [{"text": "preservation"}],
     [{"status": "proved"}],
     [{"code": "Effect4.Run.session_keys_once"}],
     [{"text": "—"}]],
    [[{"ref": "claim:allows-answer", "label": "allows-answer"}],
     [{"text": "preservation"}],
     [{"status": "proved"}],
     [{"code": "Effect4.Run.allows_answer"}],
     [{"text": "—"}]],
    [[{"ref": "claim:reply-commute", "label": "reply-commute"}],
     [{"text": "compatibility"}],
     [{"status": "proved"}],
     [{"code": "Effect4.Api.HostSession.reply_commute"}],
     [{"text": "—"}]],
    [[{"ref": "claim:session-success-prepared-membership",
       "label": "session-success-prepared-membership"}],
     [{"text": "preservation"}],
     [{"status": "proved"}],
     [{"code": "Effect4.Api.HostSession.preflight_success_prepared_fits"}],
     [{"text": "—"}]],
    [[{"ref": "claim:reply-at-call-instance",
       "label": "reply-at-call-instance"}],
     [{"text": "preservation"}],
     [{"status": "proved"}],
     [{"code": "Effect4.Program.instance_prepared_success"}],
     [{"text": "—"}]],
    [[{"ref": "claim:block-call-instance", "label": "block-call-instance"}],
     [{"text": "preservation"}],
     [{"status": "proved"}],
     [{"code": "Effect4.Program.checkModule_programCallAt"}],
     [{"text": "—"}]],
    [[{"ref": "claim:session-failure-shape-free",
       "label": "session-failure-shape-free"}],
     [{"text": "preservation"}],
     [{"status": "proved"}],
     [{"code": "Effect4.Api.HostSession.preflight_failure_noShapeDefect"}],
     [{"code": "E4-HOST-CE-008"}]],
    [[{"ref": "claim:frontier-awaithost", "label": "frontier-awaithost"}],
     [{"text": "inversion"}],
     [{"status": "proved"}],
     [{"code": "Effect4.Api.observe_awaitingAsync_iff"}],
     [{"text": "—"}]],
    [[{"ref": "claim:host-progress", "label": "host-progress"}],
     [{"text": "progress"}],
     [{"status": "assumed"}],
     [{"text": "assumed: "}, {"text": "docs/core/host-boundary.md"}],
     [{"text": "—"}]],
    [[{"ref": "claim:rows-loop-frontier", "label": "rows-loop-frontier"}],
     [{"text": "simulation"}],
     [{"status": "proved"}],
     [{"code": "Effect4.Run.rows_loop_frontier"}],
     [{"text": "—"}]],
    [[{"ref": "claim:rows-loop-frontier-host",
       "label": "rows-loop-frontier-host"}],
     [{"text": "simulation"}],
     [{"status": "proved"}],
     [{"code": "Effect4.Run.rows_loop_frontier_host"}],
     [{"text": "—"}]]],
   "kind": "table",
   "headers": ["Claim", "Role", "Status", "Evidence", "Contested by"]},
  {"title": "run-admitted-history",
   "kind": "part",
   "key": "claim:run-admitted-history",
   "body":
   [{"line":
     [{"text":
       "Every reached recorded run has its built program's call table and a history of session-admitted native decisions, at its compile budget; no progress or outside-host claim"}],
     "kind": "para"},
    {"line":
     [{"text":
       "Every reached run's machine is a history of its program. Reach: every built program, name, budget and profile, every row."}],
     "kind": "para"},
    {"rows":
     [{"line": [{"code": "Effect4.Laws.Run.Frame"}], "label": "Module"}],
     "kind": "fields"},
    {"language": "lean",
     "kind": "code",
     "body":
     "∀ (s : Effect4.Run),\n  s.Reached →\n    And (Eq s.session.calls (Effect4.Api.HostSession.callTable s.built.program s.built.table))\n      (Effect4.Run.HistoryOf s.built s.budget.compileFuel s.machine)"}]},
  {"title": "keys-once",
   "kind": "part",
   "key": "claim:keys-once",
   "body":
   [{"line":
     [{"text":
       "A reached run binds, submits and applies each key at most once, and applies no retired key"}],
     "kind": "para"},
    {"line":
     [{"text":
       "Each key is bound once, received once and applied once, and a retired call is never applied. In every recorded run of every program: the session binds a key at most once, accepts at most one reply receipt and applies at most one reply at a key, and no key that a control or an application retired is ever applied. Concept "},
      {"code": "host-session-protocol"},
      {"text": ", R6; the proposed claim "},
      {"code": "keys-once"},
      {"text":
       " (role preservation). The machine's part is that a guard the machine dropped never holds a request again ("},
      {"code": "reservedKeys_steppedBy"},
      {"text": "): a later park takes a fresh token. Consumer: "},
      {"code": "stale_never_applies"},
      {"text":
       ", clauses one to three. Reach: every program, table, budget and journal of the four row kinds, with its raw rows. It does not establish reply admission at the application, the retirement edge of the host protocol, the order of two applications, or which reply a host sends: a host may answer a call with any body it chooses."}],
     "kind": "para"},
    {"rows":
     [{"line": [{"code": "Effect4.Laws.Run.Journal"}], "label": "Module"}],
     "kind": "fields"},
    {"language": "lean",
     "kind": "code",
     "body":
     "∀ (s : Effect4.Run),\n  s.Reached →\n    And s.boundKeys.Nodup\n      (And s.submittedKeys.Nodup\n        (And s.appliedKeys.Nodup\n          (∀ (k : Effect4.Api.HostSession.Key),\n            List.instMembership.mem s.retiredKeys k →\n              Not (List.instMembership.mem s.appliedKeys k))))"}]},
  {"title": "allows-answer",
   "kind": "part",
   "key": "claim:allows-answer",
   "body":
   [{"line":
     [{"text":
       "Answering an async request is an allowed transition from awaitingAsync"}],
     "kind": "para"},
    {"line":
     [{"text": "An answer is an edge from "},
      {"code": "awaitingAsync"},
      {"text":
       " to every state, so the machine it leaves is never a protocol refusal."}],
     "kind": "para"},
    {"rows":
     [{"line": [{"code": "Effect4.Laws.Run"}], "label": "Module"},
      {"line":
       [{"text": "Wadler2012"},
        {"text": ", "},
        {"text": "audit P35"},
        {"text": " (adaptedResult)"}],
       "label": "Literature"}],
     "kind": "fields"},
    {"language": "lean",
     "kind": "code",
     "body":
     "∀ (key : Effect4.Api.HostSession.Key) (target : Effect4.Api.HostProtocol.State),\n  Eq\n    (Effect4.Api.HostProtocol.allows Effect4.Api.HostProtocol.State.awaitingAsync\n      (Effect4.Api.HostProtocol.Label.answer key) target)\n    Bool.true"}]},
  {"title": "reply-commute",
   "kind": "part",
   "key": "claim:reply-commute",
   "body":
   [{"line":
     [{"text": "Independent host replies commute in session submission"}],
     "kind": "para"},
    {"line":
     [{"text":
       "Two accepted receipts for distinct keys commute as whole sessions. The machine, active calls, call IDs, consumed ledger, and retired ownership are unchanged in either order. This is receipt/storage only, not "},
      {"code": "answerAsync"},
      {"text": " continuation execution."}],
     "kind": "para"},
    {"rows":
     [{"line": [{"code": "Effect4.Laws.Api.HostSession"}], "label": "Module"},
      {"line":
       [{"text": "LynchVaandrager1995"},
        {"text": ", "},
        {"text": "audit C4"},
        {"text": " (analogy)"}],
       "label": "Literature"}],
     "kind": "fields"},
    {"language": "lean",
     "kind": "code",
     "body":
     "∀ {program : Effect4.Api.Program} {table : Effect4.Program.RowTable}\n  (s : Effect4.Api.HostSession.Session program table) (a b : Effect4.Api.HostSession.Reply),\n  Ne a.key b.key →\n    Eq (Effect4.Api.HostSession.submit s a).phase Effect4.Api.HostSession.Phase.preflight →\n      Eq (Effect4.Api.HostSession.submit s b).phase Effect4.Api.HostSession.Phase.preflight →\n        Eq (Effect4.Api.HostSession.submit (Effect4.Api.HostSession.submit s a).session b).session\n          (Effect4.Api.HostSession.submit (Effect4.Api.HostSession.submit s b).session a).session"}]},
  {"title": "session-success-prepared-membership",
   "kind": "part",
   "key": "claim:session-success-prepared-membership",
   "body":
   [{"line":
     [{"text":
       "A session-accepted successful reply prepares a member of its selected shape-decided row, or, where the row's own columns refuse it, it is admitted at its call's checked instance (InstanceSuccess; decisions row 323)"}],
     "kind": "para"},
    {"line":
     [{"text":
       "A session-accepted successful completion prepares the actual row-typed value, or it is admitted at the call's checked instance and reaches the program unchanged. On the row's path membership requires the selected row's shape-decided answer column. Failures, world-reading columns and token-world correlation remain outside this theorem. The session is not executed here."}],
     "kind": "para"},
    {"rows":
     [{"line": [{"code": "Effect4.Laws.Api.HostSession"}], "label": "Module"}],
     "kind": "fields"},
    {"language": "lean",
     "kind": "code",
     "body":
     "∀ {program : Effect4.Api.Program} {table : Effect4.Program.RowTable}\n  (s : Effect4.Api.HostSession.Session program table) (reply : Effect4.Api.HostSession.Reply)\n  (decision : Effect4.Program.NativeDecision) (value : Effect4.Machine.Val),\n  Eq\n      (s.machine.stuck\n        (Effect4.Prim Effect4.Program.EffName Effect4.Program.EffThunk Effect4.Machine.Val\n          Effect4.Machine.Err Effect4.Machine.Defect Effect4.FiberId Effect4.Machine.Ann)\n        (Effect4.FrameFiber Effect4.Program.EffName Effect4.Program.EffThunk Effect4.Machine.Val\n          Effect4.Machine.Err Effect4.Machine.Defect Effect4.FiberId Effect4.Machine.Ann)\n        (Effect4.FrameEvent Effect4.Program.EffName Effect4.Program.EffThunk Effect4.Machine.Val\n          Effect4.Machine.Err Effect4.Machine.Defect Effect4.FiberId Effect4.Machine.Ann))\n      Option.none →\n    Eq reply.completion (Effect4.Machine.Completion.ofExit (Effect4.Exit.success value)) →\n      Eq (Effect4.Api.HostSession.preflight s reply) (Except.ok decision) →\n        Or (Effect4.Api.HostSession.PreparedSuccess s reply decision)\n          (Effect4.Api.HostSession.InstanceSuccess s reply decision)"}]},
  {"title": "reply-at-call-instance",
   "kind": "part",
   "key": "claim:reply-at-call-instance",
   "body":
   [{"line":
     [{"text":
       "A reply admitted at its call's checked instance is a handle-free member of the instance's answer column, and the machine prepares it unchanged, at a row whose answer column allocates nothing; a failure admitted there holds no reserved defect; the registration keeps its call's address and the session reads programCallAt there, from a table made once at open (reached_callInstance); in a recorded, funded run that address holds a call of the operation in the program (origin_addresses_call); the expansion of layer references keeping it there is open (decisions rows 183, 323)"}],
     "kind": "para"},
    {"line":
     [{"text":
       "A success admitted at its call's instance is a member of the instance's answer column, holds no handle, and reaches the program unchanged: the machine's preparation leaves the stores as they are and answers the value itself."}],
     "kind": "para"},
    {"rows":
     [{"line": [{"code": "Effect4.Laws.Program.Admit"}], "label": "Module"}],
     "kind": "fields"},
    {"language": "lean",
     "kind": "code",
     "body":
     "∀ (program : Effect4.Program.NativeEff) (table : Effect4.Program.RowTable)\n  (instanceAt : List Nat → Option (Effect4.Program.CallInstance Effect4.Program.NativeOp))\n  (m : Effect4.Program.NativeMachine) (r : Effect4.Program.RecordedReply)\n  (value : Effect4.Machine.Val),\n  Eq\n      (m.stuck\n        (Effect4.Prim Effect4.Program.EffName Effect4.Program.EffThunk Effect4.Machine.Val\n          Effect4.Machine.Err Effect4.Machine.Defect Effect4.FiberId Effect4.Machine.Ann)\n        (Effect4.FrameFiber Effect4.Program.EffName Effect4.Program.EffThunk Effect4.Machine.Val\n          Effect4.Machine.Err Effect4.Machine.Defect Effect4.FiberId Effect4.Machine.Ann)\n        (Effect4.FrameEvent Effect4.Program.EffName Effect4.Program.EffThunk Effect4.Machine.Val\n          Effect4.Machine.Err Effect4.Machine.Defect Effect4.FiberId Effect4.Machine.Ann))\n      Option.none →\n    Eq r.completion (Effect4.Machine.Completion.ofExit (Effect4.Exit.success value)) →\n      Effect4.Program.InstanceEnvelope table instanceAt m r →\n        Exists fun origin =>\n          Exists fun c =>\n            And (Eq (Effect4.Program.originOf m r.fiber r.token) (Option.some origin))\n              (And (Eq (instanceAt origin) (Option.some c))\n                (And (Eq c.op r.op)\n                  (And\n                    (Eq\n                      (Effect4.Program.Val.hasTy value c.answer\n                        (m.state\n                              (Effect4.Prim Effect4.Program.EffName Effect4.Program.EffThunk\n                                Effect4.Machine.Val Effect4.Machine.Err Effect4.Machine.Defect\n                                Effect4.FiberId Effect4.Machine.Ann)\n                              (Effect4.FrameFiber Effect4.Program.EffName Effect4.Program.EffThunk\n                                Effect4.Machine.Val Effect4.Machine.Err Effect4.Machine.Defect\n                                Effect4.FiberId Effect4.Machine.Ann)\n                              (Effect4.FrameEvent Effect4.Program.EffName Effect4.Program.EffThunk\n                                Effect4.Machine.Val Effect4.Machine.Err Effect4.Machine.Defect\n                                Effect4.FiberId Effect4.Machine.Ann)).externals.allocated)\n                      Bool.true)\n                    (And (Eq (Effect4.Store.Val.handles value) List.nil)\n                      (Eq\n                        (Effect4.Machine.prepareAsyncAnswer (Effect4.Program.interpOf program table)\n                          m r.fiber r.token r.completion)\n                        {\n                          fst :=\n                            m.state\n                              (Effect4.Prim Effect4.Program.EffName Effect4.Program.EffThunk\n                                Effect4.Machine.Val Effect4.Machine.Err Effect4.Machine.Defect\n                                Effect4.FiberId Effect4.Machine.Ann)\n                              (Effect4.FrameFiber Effect4.Program.EffName Effect4.Program.EffThunk\n                                Effect4.Machine.Val Effect4.Machine.Err Effect4.Machine.Defect\n                                Effect4.FiberId Effect4.Machine.Ann)\n                              (Effect4.FrameEvent Effect4.Program.EffName Effect4.Program.EffThunk\n                                Effect4.Machine.Val Effect4.Machine.Err Effect4.Machine.Defect\n                                Effect4.FiberId Effect4.Machine.Ann),\n                          snd := Effect4.Prim.success value })))))"}]},
  {"title": "block-call-instance",
   "kind": "part",
   "key": "claim:block-call-instance",
   "body":
   [{"line":
     [{"text":
       "On a program that the module check admits, the call instance answers at every call, with the call's operation: in a definition's body at the block's signature and its declared request, in a block's main program at the block's signature, and in a program with no block (programCallAt over Eff.partAt); the session's call table is its lookup, so a session that start made has an instance at every call of its admitted program (start_callInstance_complete); it does not say that the expansion of layer references keeps a call at its address, nor anything of a run (decisions rows 323, 328, 333)"}],
     "kind": "para"},
    {"line":
     [{"text": "The claim "},
      {"code": "block-call-instance"},
      {"text":
       ". On a program that the module check admits, the call instance answers at every call, with the call's operation: inside a definition's body, in the main program of a block, and in a program with no block. Before this law the session's call table missed every call of a program with a block (seat HOST's probe, part B)."}],
     "kind": "para"},
    {"rows":
     [{"line": [{"code": "Effect4.Laws.Program.Typing.Parts"}],
       "label": "Module"}],
     "kind": "fields"},
    {"language": "lean",
     "kind": "code",
     "body":
     "∀ {Op : Type} {s : Effect4.Program.Signature Op} {p : Effect4.Program.Eff Op}\n  {T : Effect4.Program.EffTy} {path : List Nat} {op : Op} {request : Effect4.Program.Term},\n  Eq (Effect4.Program.Checker.checkModule s p) (Except.ok T) →\n    Eq ((Effect4.Program.Node.eff p).at_ path)\n        (Option.some (Effect4.Program.Node.eff (Effect4.Program.Eff.perform op request))) →\n      Exists fun c =>\n        And (Eq (Effect4.Program.programCallAt s List.nil p path) (Option.some c)) (Eq c.op op)"}]},
  {"title": "session-failure-shape-free",
   "kind": "part",
   "key": "claim:session-failure-shape-free",
   "body":
   [{"line":
     [{"text":
       "A session-accepted failing reply carries no reserved defect: the failure half of admit_sound (decisions row 191, E4-HOST-CE-008)"}],
     "kind": "para"},
    {"line":
     [{"text":
       "An accepted failing reply has no shape defect (decisions row 191, "},
      {"code": "E4-HOST-CE-008"},
      {"text": "): executable admission refuses the reserved defects ("},
      {"code": "admit_failure_reservedFree"},
      {"text": "), so a session-accepted failure satisfies "},
      {"code": "NoShapeDefect"},
      {"text": " at every type. This is the failure half of "},
      {"code": "admit_sound"},
      {"text": ", executable admission implying the ghost "},
      {"code": "AnswerOk"},
      {"text":
       "; the value half waits on row 97's handle declarations, and the cause's membership in the error column is "},
      {"code": "external_error_typed"},
      {"text": "."}],
     "kind": "para"},
    {"rows":
     [{"line": [{"code": "Effect4.Laws.Api.HostSession"}], "label": "Module"}],
     "kind": "fields"},
    {"language": "lean",
     "kind": "code",
     "body":
     "∀ {program : Effect4.Api.Program} {table : Effect4.Program.RowTable}\n  (s : Effect4.Api.HostSession.Session program table) (reply : Effect4.Api.HostSession.Reply)\n  (decision : Effect4.Program.NativeDecision) (c : Effect4.Machine.CauseV),\n  Eq reply.completion (Effect4.Machine.Completion.ofExit (Effect4.Exit.failure c)) →\n    Eq (Effect4.Api.HostSession.preflight s reply) (Except.ok decision) →\n      ∀ (ty : Effect4.Program.EffTy),\n        Effect4.Program.Typed.NoShapeDefect ty (Effect4.Exit.failure c)"},
    {"line":
     [{"text": "Register record "},
      {"code": "E4-HOST-CE-008"},
      {"text": " (REPAIRED)"}],
     "kind": "para"},
    {"language": "text",
     "kind": "code",
     "body":
     "| `E4-HOST-CE-008` | REPAIRED 2026-10-03 (decisions row 191: `admit` and `externalAdmits` refuse a host failure carrying `badName` or `notImplemented`, `Refusal.reservedDefect`; `preflight_failure_noShapeDefect`, `Laws/Api/HostSession.lean`, `[propext, Quot.sound]`); SEEDED 2026-10-03 (Codex, `docs/research/2026-10-03-session-work/t4-audit.lean`; registered by Claude) | Executable admission is at least as strict as the typed exit judgment on failures: `admit = none` on a failing reply gives `CompletionStrong`, the failure half of `admit_sound` (T4) | `Test/Counterexamples/Machine/Runtime/HostReservedDefect.lean`: the session accepted `die badName` (`preflight` returned the answer decision, `admit` no refusal, `externalAdmits` true) while `ExitOk` refuses it at every world (`NoShapeDefect`, row 152) | Admission refuses the two reserved defects before reading the error column, on the decision path and the oracle path; ordinary defects and interrupts stay admitted at every error column. The value half of admission (row 97) is unchanged. |"}]},
  {"title": "frontier-awaithost",
   "kind": "part",
   "key": "claim:frontier-awaithost",
   "body":
   [{"line":
     [{"text":
       "Machine awaitingAsync state matches frontier awaitHost reasons"}],
     "kind": "para"},
    {"rows":
     [{"line": [{"code": "Effect4.Laws.Api.Frontier"}], "label": "Module"}],
     "kind": "fields"},
    {"language": "lean",
     "kind": "code",
     "body":
     "∀ (why : Effect4.Machine.Exhaustion) (m : Effect4.Program.NativeMachine),\n  Iff (Eq (Effect4.Api.HostProtocol.observe m) Effect4.Api.HostProtocol.State.awaitingAsync)\n    (Exists fun key =>\n      List.instMembership.mem (Effect4.Api.frontierReasons why m)\n        (Effect4.Api.FrontierReason.awaitHost key))"}]},
  {"title": "host-progress",
   "kind": "part",
   "key": "claim:host-progress",
   "body":
   [{"line": [{"text": "Host session progress under external answers"}],
     "kind": "para"},
    {"rows":
     [{"line":
       [{"text":
         "Host session progress is subject to external driver execution; outside closed runtime"}],
       "label": "Reason"}],
     "kind": "fields"}]},
  {"title": "rows-loop-frontier",
   "kind": "part",
   "key": "claim:rows-loop-frontier",
   "body":
   [{"line":
     [{"text":
       "H8's detailed frontier on loops: for a recorded run of a LoopedRows program the row fragment with loops admits, funded, at rest and driven by a host, every call the machine waits on is a host row, and past a budget bound the detailed observation of the budgeted meaning under the run's reply tape waits at that row and request, with the machine's stores and the tape read to its end (no progress claim: a wait is a frontier, never a failure; nothing of a fork, a scope or an interruption; the host-meaning widening, slice L4)"}],
     "kind": "para"},
    {"line":
     [{"text":
       "H8's detailed frontier on loops (Q4): for a recorded run of a program of the row fragment with loops that is funded, at rest and driven by a host, every call the machine waits on is a host row, and past a budget bound the detailed observation of the budgeted meaning under the run's reply tape waits at that row and request, with the machine's stores and the tape read to its end. The session prefix ("},
      {"code": "session_settled"},
      {"text":
       ") leaves a root parked on that call, and the local wait is the meaning's ("},
      {"code": "localWaitC_to_rowsB"},
      {"text": "). Concept "},
      {"code": "host-session-protocol"},
      {"text": ", claim "},
      {"code": "rows-loop-frontier"},
      {"text":
       ", role simulation; requirement R12 (and R6). Consumers: the waiting driver and the resource prefix (slices S1 and S2). It establishes no progress: a wait is a frontier, never a failure, and nothing says the host answers; nothing of a fork, a scope or an interruption."}],
     "kind": "para"},
    {"rows":
     [{"line": [{"code": "Effect4.Laws.Api.SessionMeaningLoop"}],
       "label": "Module"}],
     "kind": "fields"},
    {"language": "lean",
     "kind": "code",
     "body": "Effect4.Run.H8FrontierLoopedRows"}]},
  {"title": "rows-loop-frontier-host",
   "kind": "part",
   "key": "claim:rows-loop-frontier-host",
   "body":
   [{"line":
     [{"text":
       "H9's detailed frontier on loops: the same under any host whose answers are the run's and which leaves the waited call unanswered: past a budget bound the meaning under the host waits at that call, with the machine's stores and the host where the answers left it (the host's silence is a premise; the host-meaning widening, slice L4)"}],
     "kind": "para"},
    {"line":
     [{"text": "H9's detailed frontier on loops (Q4 under a host): as "},
      {"code": "rows_loop_frontier"},
      {"text": ", under any host whose answers are the run's ("},
      {"code": "HostAnswered"},
      {"text":
       ") and which does not answer the call the machine waits on: past a budget bound the meaning under the host waits at that call, with the machine's stores and the host where the answers left it. Concept "},
      {"code": "host-session-protocol"},
      {"text": ", claim "},
      {"code": "rows-loop-frontier-host"},
      {"text":
       ", role simulation; requirement R12 (and R6). It does not establish that the host leaves the call unanswered: that is the premise."}],
     "kind": "para"},
    {"rows":
     [{"line": [{"code": "Effect4.Laws.Api.SessionMeaningLoop"}],
       "label": "Module"}],
     "kind": "fields"},
    {"language": "lean",
     "kind": "code",
     "body": "Effect4.Run.H9FrontierLoopedRows"}]}]}