{"title": "Open work", "producer": ["GENERATED by tools/Drivers/Semantics.lean (make gen-semantics); do not edit", "format: effect4-semantics-report v8", "command: make gen-semantics", "inputs: tools/ProofGraph/Registry.lean, tools/Tools/Semantics.lean, tools/Drivers/Semantics.lean, tools/Tools/SemanticsDisplay.lean, tools/Tools/SemanticsDocument.lean, tools/Tools/Document.lean, tools/Tools/Document/Json.lean, src/Effect4/Laws/Auto/Semantics.lean, Test/Counterexamples/REGISTER.md, docs/core/decisions.md, lean-toolchain"], "format": "effect4-document/1", "body": [{"line": [{"text": "The open part of the plan: 11 planned goals, and 26 theorems proved modulo them. "}, {"text": "A goal's docstring, written with its statement, says why its proof waits. A chain shows how a theorem "}, {"text": "reaches a goal. Each step is an edge of the plan, from a node to a node its proof reaches first."}], "kind": "para"}, {"title": "once_placed_pushes_once", "kind": "part", "key": "open:Effect4.Program.FinalizerRun.once_placed_pushes_once", "body": [{"line": [{"text": "Control-source uniqueness obligation of the at-most-once claim. A once-placed source pushes its finalizer frame at most once across all fibers. Consumer: the atomic cleanup-log claim. It supplies no finalizer progress."}], "kind": "para"}, {"rows": [{"line": [{"code": "Effect4.Laws.Program.FinalizerRun"}], "label": "Module"}, {"line": [{"ref": "claim:once-placed-finalizer", "label": "once-placed-finalizer"}], "label": "Claims"}, {"line": [{"ref": "req:R11", "label": "R11"}], "label": "Requirements"}], "kind": "fields"}, {"language": "lean", "kind": "code", "body": "∀ (p : Effect4.Program.NativeEff) (table : Effect4.Program.RowTable) (cf : Nat)\n (m : Effect4.Program.NativeMachine) (q : List Nat),\n Eq (Effect4.Program.OncePlaced (Effect4.Program.Node.eff p) q) Bool.true →\n Effect4.Program.Guard.Reachable p table cf m →\n instLENat.le\n (List.countP (Effect4.Program.FinalizerRun.registeredAt q)\n (m.trace\n (Effect4.Prim Effect4.Program.EffName Effect4.Program.EffThunk Effect4.Machine.Val\n Effect4.Machine.Err Effect4.Machine.Defect Effect4.FiberId Effect4.Machine.Ann)\n (Effect4.FrameFiber Effect4.Program.EffName Effect4.Program.EffThunk Effect4.Machine.Val\n Effect4.Machine.Err Effect4.Machine.Defect Effect4.FiberId Effect4.Machine.Ann)\n (Effect4.FrameEvent Effect4.Program.EffName Effect4.Program.EffThunk Effect4.Machine.Val\n Effect4.Machine.Err Effect4.Machine.Defect Effect4.FiberId Effect4.Machine.Ann)))\n 1"}]}, {"title": "countdown_parks_positional", "kind": "part", "key": "open:Effect4.Program.Typed.Evaluating.countdown_parks_positional", "body": [{"line": [{"text": "A positional countdown's park ("}, {"code": "fiberPre"}, {"text": "'s positional arm of "}, {"code": "awaitAll"}, {"text": " and "}, {"code": "awaitAllFailFast"}, {"text": ": a tuple certificate of per-target exit columns, which "}, {"code": "Layer.merge"}, {"text": "'s siblings use): as "}, {"code": "Evaluating.countdown_parks"}, {"text": ", the record resuming with the exits at the tuple of the targets' columns. Planned: "}, {"code": "J"}, {"text": "'s countdown payload holds one pair of columns for every target, so it cannot type this record; a positional payload must carry the columns in the targets' order. "}, {"code": "J"}, {"text": " then admits a stale or a duplicate countdown firing that would append past them (seat B's finding, 2026-10-12). Neither rc.112 nor 4.0.1 fires a target's observer twice ("}, {"code": "fiberAwaitAll"}, {"text": ", "}, {"code": "internal/effect.ts:779-813"}, {"text": ", the same text in 4.0.1), so the proof needs "}, {"code": "J"}, {"text": " to say that each countdown key has at most one firing to come. Consumer: "}, {"code": "awaitAllParks"}, {"text": ", "}, {"code": "awaitAllFailFastParks"}, {"text": "."}], "kind": "para"}, {"rows": [{"line": [{"code": "Effect4.Laws.Program.Typed.Commands.Clauses.Park"}], "label": "Module"}, {"line": [{"ref": "claim:step-loop-preserves", "label": "step-loop-preserves"}, {"text": ", "}, {"ref": "claim:step-deliver-preserves", "label": "step-deliver-preserves"}, {"text": ", "}, {"ref": "claim:typed-state-admitted", "label": "typed-state-admitted"}, {"text": ", "}, {"ref": "claim:decision-keeps-typed", "label": "decision-keeps-typed"}, {"text": ", "}, {"ref": "claim:m7-exits-typed", "label": "m7-exits-typed"}, {"text": ", "}, {"ref": "claim:m7-stores-typed", "label": "m7-stores-typed"}, {"text": ", "}, {"ref": "claim:m7-never-halts", "label": "m7-never-halts"}, {"text": ", "}, {"ref": "claim:m7-admitted", "label": "m7-admitted"}, {"text": ", "}, {"ref": "claim:m7-exit-handles-valid", "label": "m7-exit-handles-valid"}, {"text": ", "}, {"ref": "claim:obs-typed-admitted", "label": "obs-typed-admitted"}, {"text": ", "}, {"ref": "claim:m7-results-exit-hasty", "label": "m7-results-exit-hasty"}], "label": "Claims"}, {"line": [{"ref": "req:R1", "label": "R1"}, {"text": ", "}, {"ref": "req:R6", "label": "R6"}, {"text": ", "}, {"ref": "req:R9", "label": "R9"}], "label": "Requirements"}], "kind": "fields"}, {"language": "lean", "kind": "code", "body": "∀ {root : Effect4.Program.Typed.ProgramSource} {rootTy : Effect4.Program.EffTy}\n {w : Effect4.Program.Typed.World} {m : Effect4.Program.Sched.RState}\n {rest : List Effect4.Program.Sched.RCmd} {f : Effect4.Program.Sched.RFiber} {y : Bool},\n Effect4.Program.Typed.Evaluating root rootTy w m rest f y →\n Eq (Effect4.Program.Typed.raceRegistrationR f.frame.current) Option.none →\n Eq (Effect4.Program.Sched.externalRequestR f.frame.current) Option.none →\n ∀ {targets : List Effect4.FiberId} (failFast : Bool) {exits : List Effect4.Machine.ExitV}\n {target : Effect4.FiberId} {remaining : List Effect4.FiberId},\n Eq\n (Effect4.Machine.countdownWalk\n { fibers := m.fibers, races := m.races, nextId := m.nextId,\n nextToken := instHAdd.hAdd m.nextToken 1, nextRace := m.nextRace,\n middlewareInstalled := m.middlewareInstalled, armed := m.armed, state := m.state,\n trace := m.trace, stuck := m.stuck, forks := m.forks }\n targets List.nil)\n { fst := exits, snd := Option.some { fst := target, snd := remaining } } →\n (∀ (id : Effect4.FiberId),\n List.instMembership.mem targets id → instLTNat.lt id.value m.nextId) →\n ∀ (cols : Effect4.FiberId → Prod Effect4.Program.Ty Effect4.Program.Ty),\n (∀ (id : Effect4.FiberId),\n List.instMembership.mem targets id →\n Effect4.Program.Typed.FiberColumnsBelow w id (cols id).fst (cols id).snd) →\n ∀ (next' : Effect4.Machine.ExitV → Effect4.Program.Sched.RProgram)\n (row : Effect4.Machine.Env.Requirement) (flag : Bool),\n Effect4.Machine.Env.Context.Satisfies f.context.services row →\n (∀ (ty : Effect4.Program.EffTy),\n Eq (w.Γ f.id) (Option.some ty) →\n Effect4.Program.Typed.MHostStack root w\n (Effect4.Machine.RunMachine.update m f) f.id\n {\n fst :=\n Effect4.Program.Typed.AmbientPosition.result\n {\n fst :=\n Effect4.Program.EffTy.pure\n (Effect4.Program.Ty.tuple\n (List.map (fun t => (cols t).fst.exitOf (cols t).snd)\n targets)),\n snd := { fst := row, snd := row } }.fst\n {\n fst :=\n Effect4.Program.EffTy.pure\n (Effect4.Program.Ty.tuple\n (List.map\n (fun t => (cols t).fst.exitOf (cols t).snd)\n targets)),\n snd := { fst := row, snd := row } }.snd.fst\n {\n fst :=\n Effect4.Program.EffTy.pure\n (Effect4.Program.Ty.tuple\n (List.map\n (fun t => (cols t).fst.exitOf (cols t).snd)\n targets)),\n snd := { fst := row, snd := row } }.snd.snd,\n snd := f.frame.interruptible }\n (Effect4.Program.Typed.finalPos ty flag)\n (List.cons (Effect4.Program.Sched.ScopeFrame.answer next')\n f.frame.stack)) →\n (∀ (M : Effect4.Program.Sched.RState) (g : Effect4.Program.Sched.RFiber)\n (edits :\n List\n (Effect4.Machine.FiberEdit Effect4.Machine.Err\n Effect4.Machine.Defect Effect4.FiberId Effect4.Machine.Ann)),\n Eq g.frame.current f.frame.current →\n Eq\n (Effect4.Program.Sched.prepareIterR\n { machine := M, fiber := g, yielding := y,\n outcome := Effect4.Machine.Outcome.parked, nested := List.nil,\n edits := edits })\n { machine := M, fiber := g, yielding := y,\n outcome := Effect4.Machine.Outcome.parked, nested := List.nil,\n edits := edits }) →\n Effect4.Program.Typed.SettlesTyped root rootTy w f.id rest\n (Effect4.Program.Sched.prepareIterR\n { machine := Effect4.Program.Typed.countdownMachine m target f.id,\n fiber :=\n Effect4.Program.Typed.countdownFiber root f next'\n { token := m.nextToken, remaining := remaining,\n collected := exits,\n resumeWith := Effect4.Machine.Resume.exitsValue,\n failFast := failFast },\n yielding := y,\n outcome :=\n Effect4.Machine.FiberAction.outcomeOf\n (Effect4.Program.Typed.countdownMachine m target f.id)\n Bool.true,\n nested := List.nil,\n edits :=\n List.cons\n (Effect4.Machine.FiberEdit.observe target\n (Effect4.Machine.Observer.countdown f.id m.nextToken))\n List.nil })"}, {"line": [{"text": "Proved modulo this goal (10), each by its shortest chain of nearest nodes:"}], "kind": "para"}, {"lines": [[{"code": "reachable_typed_admitted"}, {"text": " → "}, {"code": "reachable_typed"}, {"text": " → "}, {"code": "decision_preserves"}, {"text": " → "}, {"code": "deliver_preserves"}, {"text": " → "}, {"code": "countdown_parks_positional"}], [{"code": "reachable_typed"}, {"text": " → "}, {"code": "decision_preserves"}, {"text": " → "}, {"code": "deliver_preserves"}, {"text": " → "}, {"code": "countdown_parks_positional"}], [{"code": "m7_proved"}, {"text": " → "}, {"code": "decision_preserves"}, {"text": " → "}, {"code": "deliver_preserves"}, {"text": " → "}, {"code": "countdown_parks_positional"}], [{"code": "m7_admitted"}, {"text": " → "}, {"code": "m7_proved"}, {"text": " → "}, {"code": "decision_preserves"}, {"text": " → "}, {"code": "deliver_preserves"}, {"text": " → "}, {"code": "countdown_parks_positional"}], [{"code": "loop_preserves"}, {"text": " → "}, {"code": "countdown_parks_positional"}], [{"code": "deliver_preserves"}, {"text": " → "}, {"code": "countdown_parks_positional"}], [{"code": "decision_preserves"}, {"text": " → "}, {"code": "deliver_preserves"}, {"text": " → "}, {"code": "countdown_parks_positional"}], [{"code": "exitHandles_valid"}, {"text": " → "}, {"code": "reachable_typed"}, {"text": " → "}, {"code": "decision_preserves"}, {"text": " → "}, {"code": "deliver_preserves"}, {"text": " → "}, {"code": "countdown_parks_positional"}], [{"code": "obs_typed"}, {"text": " → "}, {"code": "decision_preserves"}, {"text": " → "}, {"code": "deliver_preserves"}, {"text": " → "}, {"code": "countdown_parks_positional"}], [{"code": "exits_hasTy"}, {"text": " → "}, {"code": "obs_typed"}, {"text": " → "}, {"code": "decision_preserves"}, {"text": " → "}, {"code": "deliver_preserves"}, {"text": " → "}, {"code": "countdown_parks_positional"}]], "kind": "items"}]}, {"title": "request_leads", "kind": "part", "key": "open:Effect4.Run.CallTree.request_leads", "body": [{"line": [{"text": "A live native request retains a local call position reached under submitted exits. Consumer: "}, {"code": "request_in_tree"}, {"text": ", then the original routing clause. The unresolved obligation includes arbitrary budget cuts and every permitted control decision. The existing local agreement theorem supplies the subsequent call-tree observation."}], "kind": "para"}, {"rows": [{"line": [{"code": "Effect4.Laws.Run.CallTree"}], "label": "Module"}, {"line": [{"ref": "claim:recorded-call-tree-prefix", "label": "recorded-call-tree-prefix"}], "label": "Claims"}, {"line": [{"ref": "req:R5", "label": "R5"}, {"text": ", "}, {"ref": "req:R6", "label": "R6"}, {"text": ", "}, {"ref": "req:R10", "label": "R10"}], "label": "Requirements"}], "kind": "fields"}, {"language": "lean", "kind": "code", "body": "∀ (s : Effect4.Run),\n s.Reached →\n Eq (Effect4.Program.Denote.StraightRows s.built.table s.built.program) Bool.true →\n Eq (Effect4.Run.CallTree.NoCauseHandler s.built.program) Bool.true →\n Effect4.Program.SourceScope.ExternalOnly s.built.program →\n Effect4.Program.SourceScope.ConcreteReplies s.built.table →\n ∀ (call : Effect4.Api.HostSession.Call) (token : Nat),\n Eq (Effect4.Program.requestOf s.machine call.fiber token)\n (Option.some { fst := call.op, snd := call.request }) →\n Exists fun i =>\n Exists fun row =>\n Exists fun tape =>\n Exists fun frame =>\n Exists fun stores =>\n And (Eq call.op (Effect4.Program.NativeOp.external i))\n (And\n (Eq (Effect4.Program.externalRow s.built.table i) (Option.some row))\n (And\n (∀ (ex : Effect4.Machine.ExitV),\n List.instMembership.mem tape ex →\n Exists fun reply =>\n And\n (List.instMembership.mem s.journal\n (Effect4.Api.Runner.Command.submit reply))\n (Eq reply.completion\n (Effect4.Machine.Completion.ofExit ex)))\n (And\n (Effect4.Program.Agreement.Leads\n (Effect4.Run.CallTree.admittedTapeHost s.built.table)\n s.built.program\n (Effect4.Program.Agreement.Pos.live\n (Effect4.Program.Agreement.fiberOf\n (Effect4.Program.compile s.built.program\n s.budget.compileFuel)\n List.nil)\n Effect4.Machine.Stores.empty)\n tape (Effect4.Program.Agreement.Pos.live frame stores) List.nil)\n (And\n (Eq (Effect4.Program.Agreement.IsCall frame.current) Bool.true)\n (Eq (Effect4.Program.Agreement.callOf frame.current)\n (Option.some { fst := i, snd := call.request }))))))"}, {"line": [{"text": "Proved modulo this goal (3), each by its shortest chain of nearest nodes:"}], "kind": "para"}, {"lines": [[{"code": "bound_in_tree"}, {"text": " → "}, {"code": "request_leads"}], [{"code": "routing"}, {"text": " → "}, {"code": "unauthorized_calls_nothing"}, {"text": " → "}, {"code": "bound_in_tree"}, {"text": " → "}, {"code": "request_leads"}], [{"code": "unauthorized_calls_nothing"}, {"text": " → "}, {"code": "bound_in_tree"}, {"text": " → "}, {"code": "request_leads"}]], "kind": "items"}]}, {"title": "log_debits", "kind": "part", "key": "open:Test.Dogfood.Scenario.Atomic.Cleanup.log_debits", "body": [{"line": [{"text": "Cleanup-log provenance obligation of the original claim. Every logged identity comes from its request's finalizer, with at most one write per start. Reach: actual admitted histories, including interruption and incomplete commands. Consumer: "}, {"code": "cleaned"}, {"text": "; the static placement proof alone does not establish this property."}], "kind": "para"}, {"rows": [{"line": [{"code": "Test.Dogfood.Scenario.Atomic.Cleanup"}], "label": "Module"}, {"line": [{"text": "—"}], "label": "Claims"}, {"line": [{"ref": "req:R4", "label": "R4"}, {"text": ", "}, {"ref": "req:R11", "label": "R11"}], "label": "Requirements"}], "kind": "fields"}, {"language": "lean", "kind": "code", "body": "∀ (b : Effect4.Api.Built) (m : Effect4.Program.NativeMachine),\n Eq\n (Effect4.Api.Author.build\n (Test.Dogfood.Scenario.Atomic.shop Test.Dogfood.Scenario.Atomic.Fault.none))\n (Except.ok b) →\n Effect4.Run.HistoryOf b Test.Dogfood.Scenario.Atomic.budget.compileFuel m →\n And\n (∀ (i : Nat),\n List.instMembership.mem (Test.Dogfood.Scenario.Atomic.Store.observeM m).cleaned i →\n List.instMembership.mem Test.Dogfood.Scenario.Atomic.requests i)\n (∀ (i : Nat),\n List.instMembership.mem Test.Dogfood.Scenario.Atomic.requests i →\n instLENat.le (List.count i (Test.Dogfood.Scenario.Atomic.Store.observeM m).cleaned)\n (List.countP\n (Effect4.Program.FinalizerRun.startedAt\n (Test.Dogfood.Scenario.Atomic.Cleanup.requestPath i))\n (m.trace\n (Effect4.Prim Effect4.Program.EffName Effect4.Program.EffThunk Effect4.Machine.Val\n Effect4.Machine.Err Effect4.Machine.Defect Effect4.FiberId Effect4.Machine.Ann)\n (Effect4.FrameFiber Effect4.Program.EffName Effect4.Program.EffThunk\n Effect4.Machine.Val Effect4.Machine.Err Effect4.Machine.Defect Effect4.FiberId\n Effect4.Machine.Ann)\n (Effect4.FrameEvent Effect4.Program.EffName Effect4.Program.EffThunk\n Effect4.Machine.Val Effect4.Machine.Err Effect4.Machine.Defect Effect4.FiberId\n Effect4.Machine.Ann))))"}, {"line": [{"text": "Proved modulo this goal (2), each by its shortest chain of nearest nodes:"}], "kind": "para"}, {"lines": [[{"code": "atomic"}, {"text": " → "}, {"code": "cleans_once"}, {"text": " → "}, {"code": "log_debits"}], [{"code": "cleans_once"}, {"text": " → "}, {"code": "log_debits"}]], "kind": "items"}]}, {"title": "shop_stages", "kind": "part", "key": "open:Test.Dogfood.Scenario.Atomic.Store.shop_stages", "body": [{"line": [{"text": "The stages exist (program-specific; new). Every machine of every history of the shop admits a stage assignment that fits its observation."}], "kind": "para"}, {"line": [{"text": "Placement. Concept "}, {"code": "store-typing"}, {"text": ", requirement R4. Question: the scenario clauses "}, {"code": "counted"}, {"text": " and "}, {"code": "committed"}, {"text": ", whose step this is. Consumers: "}, {"code": "Atomic.counted"}, {"text": ", "}, {"code": "Atomic.committed"}, {"text": "; with a "}, {"code": "cleaned"}, {"text": " stage per request it also serves "}, {"code": "cleans_once"}, {"text": " (R11, another seat's). Reach: the built shop, every compile budget, every control history. Not established: that a request decides (progress), anything of a lowered run. Route ("}, {"code": "README.md"}, {"text": ", section S2): the shop's per-fiber positions, by the fiber-local residual law (G2), and one check per write site and per interruption."}], "kind": "para"}, {"rows": [{"line": [{"code": "Test.Dogfood.Scenario.Atomic.Store"}], "label": "Module"}, {"line": [{"text": "—"}], "label": "Claims"}, {"line": [{"ref": "req:R4", "label": "R4"}], "label": "Requirements"}], "kind": "fields"}, {"language": "lean", "kind": "code", "body": "∀ (b : Effect4.Api.Built),\n Eq\n (Effect4.Api.Author.build\n (Test.Dogfood.Scenario.Atomic.shop Test.Dogfood.Scenario.Atomic.Fault.none))\n (Except.ok b) →\n ∀ (compileFuel : Nat) (m : Effect4.Program.NativeMachine),\n Effect4.Run.ControlHistory b compileFuel m →\n Exists fun g =>\n Test.Dogfood.Scenario.Atomic.Store.StagesFit g\n (Test.Dogfood.Scenario.Atomic.Store.observeM m)"}, {"line": [{"text": "Proved modulo this goal (3), each by its shortest chain of nearest nodes:"}], "kind": "para"}, {"lines": [[{"code": "atomic"}, {"text": " → "}, {"code": "committed"}, {"text": " → "}, {"code": "shop_stages"}], [{"code": "committed"}, {"text": " → "}, {"code": "shop_stages"}], [{"code": "counted"}, {"text": " → "}, {"code": "shop_stages"}]], "kind": "items"}]}, {"title": "jobs_step", "kind": "part", "key": "open:Test.Dogfood.Scenario.QueueWorkers.Assertions.jobs_step", "body": [{"line": [{"text": "Machine-to-model preservation for "}, {"code": "held_within_fed"}, {"text": " at an actual funded command boundary. It needs the queue-cell writer census, admitted take replies and once-entered continuations. Consumer: "}, {"code": "jobs_boundary"}, {"text": ", then the first clause. It establishes no rest or progress claim."}], "kind": "para"}, {"rows": [{"line": [{"code": "Test.Dogfood.Scenario.QueueWorkers.Assertions"}], "label": "Module"}, {"line": [{"text": "—"}], "label": "Claims"}, {"line": [{"ref": "req:R10", "label": "R10"}, {"text": ", "}, {"ref": "req:R12", "label": "R12"}], "label": "Requirements"}], "kind": "fields"}, {"language": "lean", "kind": "code", "body": "∀ (total : Nat) (b : Effect4.Api.Built) (s : Effect4.Run) (c : Effect4.Api.Runner.Command),\n Eq (Effect4.Api.Author.build (Test.Dogfood.Scenario.QueueWorkers.crew total)) (Except.ok b) →\n Test.Dogfood.Scenario.QueueWorkers.Assertions.Basis b s →\n Test.Dogfood.Scenario.QueueWorkers.Assertions.Jobs s →\n Eq (s.rowReads c) Bool.true → Test.Dogfood.Scenario.QueueWorkers.Assertions.Jobs (s.step c)"}, {"line": [{"text": "Proved modulo this goal (4), each by its shortest chain of nearest nodes:"}], "kind": "para"}, {"lines": [[{"code": "fed_accounted"}, {"text": " → "}, {"code": "jobs_step"}], [{"code": "held_within_fed"}, {"text": " → "}, {"code": "jobs_step"}], [{"code": "queueWorkers"}, {"text": " → "}, {"code": "queue_settled"}, {"text": " → "}, {"code": "jobs_step"}], [{"code": "queue_settled"}, {"text": " → "}, {"code": "jobs_step"}]], "kind": "items"}]}, {"title": "logs_history", "kind": "part", "key": "open:Test.Dogfood.Scenario.QueueWorkers.Assertions.logs_history", "body": [{"line": [{"text": "The remaining cleanup writer obligation on the original actual history. Each observed identity spends a release start at its own source acquisition. Consumer: "}, {"code": "cleanup_step"}, {"text": ", then the unchanged "}, {"code": "releases_once"}, {"text": "; no progress or release order follows."}], "kind": "para"}, {"rows": [{"line": [{"code": "Test.Dogfood.Scenario.QueueWorkers.Assertions"}], "label": "Module"}, {"line": [{"text": "—"}], "label": "Claims"}, {"line": [{"ref": "req:R10", "label": "R10"}, {"text": ", "}, {"ref": "req:R11", "label": "R11"}], "label": "Requirements"}], "kind": "fields"}, {"language": "lean", "kind": "code", "body": "∀ (total compileFuel : Nat) (b : Effect4.Api.Built) (machine : Effect4.Program.NativeMachine),\n Eq (Effect4.Api.Author.build (Test.Dogfood.Scenario.QueueWorkers.crew total)) (Except.ok b) →\n Effect4.Run.HistoryOf b compileFuel machine →\n And\n (∀ (value : Effect4.Machine.Val),\n List.instMembership.mem (Test.Dogfood.Scenario.QueueWorkers.Assertions.log machine)\n value →\n Exists fun i =>\n And (List.instMembership.mem (List.cons 1 (List.cons 2 (List.cons 3 List.nil))) i)\n (Eq value (Effect4.Store.Val.nat i)))\n (∀ (i : Nat),\n List.instMembership.mem (List.cons 1 (List.cons 2 (List.cons 3 List.nil))) i →\n instLENat.le\n (List.count (Effect4.Store.Val.nat i)\n (Test.Dogfood.Scenario.QueueWorkers.Assertions.log machine))\n (List.countP\n (Effect4.Program.ReleaseTrace.releaseAt\n (Test.Dogfood.Scenario.QueueWorkers.Assertions.acquirePath i))\n (machine.trace\n (Effect4.Prim Effect4.Program.EffName Effect4.Program.EffThunk Effect4.Machine.Val\n Effect4.Machine.Err Effect4.Machine.Defect Effect4.FiberId Effect4.Machine.Ann)\n (Effect4.FrameFiber Effect4.Program.EffName Effect4.Program.EffThunk\n Effect4.Machine.Val Effect4.Machine.Err Effect4.Machine.Defect Effect4.FiberId\n Effect4.Machine.Ann)\n (Effect4.FrameEvent Effect4.Program.EffName Effect4.Program.EffThunk\n Effect4.Machine.Val Effect4.Machine.Err Effect4.Machine.Defect Effect4.FiberId\n Effect4.Machine.Ann))))"}, {"line": [{"text": "Proved modulo this goal (3), each by its shortest chain of nearest nodes:"}], "kind": "para"}, {"lines": [[{"code": "cleanup_step"}, {"text": " → "}, {"code": "logs_history"}], [{"code": "queueWorkers"}, {"text": " → "}, {"code": "QueueWorkers.releases_once"}, {"text": " → "}, {"code": "cleanup_step"}, {"text": " → "}, {"code": "logs_history"}], [{"code": "QueueWorkers.releases_once"}, {"text": " → "}, {"code": "cleanup_step"}, {"text": " → "}, {"code": "logs_history"}]], "kind": "items"}]}, {"title": "rest_step", "kind": "part", "key": "open:Test.Dogfood.Scenario.QueueWorkers.Assertions.rest_step", "body": [{"line": [{"text": "Rest preservation for "}, {"code": "fed_accounted"}, {"text": " and "}, {"code": "queue_settled"}, {"text": " at an actual command boundary. It needs committed delivery custody, interrupted withdrawal and queue wake-to-wait correspondence. Consumer: "}, {"code": "rest_script"}, {"text": ", then the two rest clauses. It establishes no fairness or liveness claim."}], "kind": "para"}, {"rows": [{"line": [{"code": "Test.Dogfood.Scenario.QueueWorkers.Assertions"}], "label": "Module"}, {"line": [{"text": "—"}], "label": "Claims"}, {"line": [{"ref": "req:R10", "label": "R10"}, {"text": ", "}, {"ref": "req:R12", "label": "R12"}], "label": "Requirements"}], "kind": "fields"}, {"language": "lean", "kind": "code", "body": "∀ (total : Nat) (b : Effect4.Api.Built) (s : Effect4.Run) (c : Effect4.Api.Runner.Command),\n Eq (Effect4.Api.Author.build (Test.Dogfood.Scenario.QueueWorkers.crew total)) (Except.ok b) →\n Test.Dogfood.Scenario.QueueWorkers.Assertions.Basis b s →\n Test.Dogfood.Scenario.QueueWorkers.Assertions.Jobs s →\n Test.Dogfood.Scenario.QueueWorkers.Assertions.Rest s →\n Eq (s.rowReads c) Bool.true →\n Test.Dogfood.Scenario.QueueWorkers.Assertions.Rest (s.step c)"}, {"line": [{"text": "Proved modulo this goal (3), each by its shortest chain of nearest nodes:"}], "kind": "para"}, {"lines": [[{"code": "fed_accounted"}, {"text": " → "}, {"code": "rest_step"}], [{"code": "queueWorkers"}, {"text": " → "}, {"code": "queue_settled"}, {"text": " → "}, {"code": "rest_step"}], [{"code": "queue_settled"}, {"text": " → "}, {"code": "rest_step"}]], "kind": "items"}]}, {"title": "cleanup_keeps", "kind": "part", "key": "open:Test.Dogfood.Scenario.Timeout.cleanup_keeps", "body": [{"line": [{"text": "Cleanup keeps the committed count. Under every script the observation satisfies "}, {"code": "Observation.cleanupKeeps"}, {"text": ". Each attempt that ended stands once in the cleanup log, with the count its finalizer saw: its own number. So an interruption by the timer takes no committed count back. Reach: the program "}, {"code": "fetch"}, {"text": ", every script of the driver's alphabet, the battery's budgets. It is a statement about the log and the count cell: it counts writes by identity. It does not count a finalizer's invocations, and it does not establish that a finalizer runs. It states no cut inside a masked region: the attempt has none. Concept "}, {"code": "scope-lifetime-finalization"}, {"text": ", R11. Consumer: the timeout scenario. Its controls are finite runs, and the seat's receipt records a bounded search."}], "kind": "para"}, {"rows": [{"line": [{"code": "Test.Dogfood.Scenario.Timeout"}], "label": "Module"}, {"line": [{"text": "—"}], "label": "Claims"}, {"line": [{"ref": "req:R6", "label": "R6"}, {"text": ", "}, {"ref": "req:R11", "label": "R11"}], "label": "Requirements"}], "kind": "fields"}, {"language": "lean", "kind": "code", "body": "Test.Dogfood.Scenario.Timeout.CleanupKeeps"}, {"line": [{"text": "Proved modulo this goal (1), each by its shortest chain of nearest nodes:"}], "kind": "para"}, {"lines": [[{"code": "timeout"}, {"text": " → "}, {"code": "cleanup_keeps"}]], "kind": "items"}]}, {"title": "retries_declared", "kind": "part", "key": "open:Test.Dogfood.Scenario.Timeout.retries_declared", "body": [{"line": [{"text": "Only returned declared failures retry. Each later attempt follows a completed timeout form that returns a declared typed failure. The client starts at most four attempts. Reach: "}, {"code": "fetch"}, {"text": ", the battery's budgets, and every plain script. The observation keeps host reply application separate from the form's complete returned exit. The selected entrant identifies its attempt or timer role at the actual exit observer. The statement establishes no fairness, physical deadline, or general law of either form. Concept: translation-simulation, R10. Consumer: the timeout scenario."}], "kind": "para"}, {"rows": [{"line": [{"code": "Test.Dogfood.Scenario.Timeout"}], "label": "Module"}, {"line": [{"text": "—"}], "label": "Claims"}, {"line": [{"ref": "req:R6", "label": "R6"}, {"text": ", "}, {"ref": "req:R10", "label": "R10"}], "label": "Requirements"}], "kind": "fields"}, {"language": "lean", "kind": "code", "body": "Test.Dogfood.Scenario.Timeout.RetriesDeclared"}, {"line": [{"text": "Proved modulo this goal (1), each by its shortest chain of nearest nodes:"}], "kind": "para"}, {"lines": [[{"code": "timeout"}, {"text": " → "}, {"code": "retries_declared"}]], "kind": "items"}]}, {"title": "logs_step", "kind": "part", "key": "open:Test.Dogfood.Scenario.Workers.Assertions.logs_step", "body": [{"line": [{"text": "Store preservation obligation of "}, {"code": "releases_once"}, {"text": ". Reach: the second allocated reference in actual crew histories at every command boundary. It needs the cell's writer census and the value captured at each acquisition source. It proves no host behavior; consumer: "}, {"code": "step"}, {"text": " and then "}, {"code": "history"}, {"text": "."}], "kind": "para"}, {"rows": [{"line": [{"code": "Test.Dogfood.Scenario.Workers.Assertions"}], "label": "Module"}, {"line": [{"text": "—"}], "label": "Claims"}, {"line": [{"ref": "req:R6", "label": "R6"}, {"text": ", "}, {"ref": "req:R11", "label": "R11"}], "label": "Requirements"}], "kind": "fields"}, {"language": "lean", "kind": "code", "body": "∀ (total cf : Nat) (b : Effect4.Api.Built) (m : Effect4.Program.NativeMachine)\n (x : Prod Nat Effect4.Program.NativeDecision),\n Eq (Effect4.Api.Author.build (Test.Dogfood.Scenario.Workers.crew total)) (Except.ok b) →\n Test.Dogfood.Scenario.Workers.Assertions.Holds b cf m →\n Effect4.Run.Accepted b.table (Effect4.Api.HostSession.callTable b.program b.table) m x.snd →\n Test.Dogfood.Scenario.Workers.Assertions.LogDebits (Effect4.Run.stepBy b m x)"}, {"line": [{"text": "Proved modulo this goal (2), each by its shortest chain of nearest nodes:"}], "kind": "para"}, {"lines": [[{"code": "Workers.releases_once"}, {"text": " → "}, {"code": "logs_step"}], [{"code": "workers"}, {"text": " → "}, {"code": "Workers.releases_once"}, {"text": " → "}, {"code": "logs_step"}]], "kind": "items"}]}]}