{"title": "Reactive Scheduling",
 "producer":
 ["GENERATED by tools/Drivers/Semantics.lean (make gen-semantics); do not edit",
  "format: effect4-semantics-report v8",
  "command: make gen-semantics",
  "inputs: tools/ProofGraph/Registry.lean, tools/Tools/Semantics.lean, tools/Drivers/Semantics.lean, tools/Tools/SemanticsDisplay.lean, tools/Tools/SemanticsDocument.lean, tools/Tools/Document.lean, tools/Tools/Document/Json.lean, src/Effect4/Laws/Auto/Semantics.lean, Test/Counterexamples/REGISTER.md, docs/core/decisions.md, lean-toolchain"],
 "format": "effect4-document/1",
 "body":
 [{"line":
   [{"text":
     "Multi-fiber execution, decision steps, and configuration invariants. "},
    {"text": "25 claims: "},
    {"text": "19 "},
    {"status": "proved"},
    {"text": ", "},
    {"text": "4 "},
    {"status": "modulo"},
    {"text": ", "},
    {"text": "2 "},
    {"status": "absent"},
    {"text": "."}],
   "kind": "para"},
  {"title": "Reactive scheduling and machine invariants",
   "kind": "part",
   "key": "about:concept:reactive-scheduling",
   "body":
   [{"line":
     [{"text":
       "This page explains reactive scheduling and machine invariants in Effect4. It covers how concurrent fibers step cooperatively, how configuration invariants exclude stuck states, and why invariant safety is distinct from progress."}],
     "kind": "para"},
    {"title": "The runtime concept",
     "kind": "part",
     "key": "about:concept:reactive-scheduling:runtime-concept",
     "body":
     [{"line":
       [{"text":
         "Effect programs schedule concurrent fibers using cooperative yields, callback dispatchers, and queue processing. In Effect rc.112, the runtime manages fiber queues and interleaves execution."}],
       "kind": "para"},
      {"line":
       [{"text":
         "Effect4 reifies this behavior as an operational small-step transition system in "},
        {"code": "RunMachine"},
        {"text": " ("},
        {"code": "src/Effect4/Machine/Fibers.lean"},
        {"text":
         "). Commands and scheduling choices execute from explicit decision queues."}],
       "kind": "para"},
      {"line":
       [{"text":
         "Scheduling coordinates multiple fibers, dispatches armed listeners, and handles asynchronous completions cleanly."}],
       "kind": "para"}]},
    {"title": "Literature foundations",
     "kind": "part",
     "key": "about:concept:reactive-scheduling:literature",
     "body":
     [{"line":
       [{"text":
         "Machine type safety builds on the syntactic approach of Wright and Felleisen (1994). Small-step concurrent transition systems adapt the models in Harper (PFPL chs. 39–41)."}],
       "kind": "para"},
      {"line":
       [{"text":
         "Invariants and execution trace properties adapt Owicki and Gries (1976) and Manna and Pnueli (1991). Safety methods establish trace inclusions following Lynch and Vaandrager (1995)."}],
       "kind": "para"}]},
    {"title": "What Effect4 keeps and what it cuts",
     "kind": "part",
     "key": "about:concept:reactive-scheduling:adaptations-and-cuts",
     "body":
     [{"line":
       [{"text":
         "Effect4 keeps small-step execution driven by explicit data decisions ("},
        {"code": "RunDecision"},
        {"text": "). Configuration typing is governed by the invariant "},
        {"code": "ConfigTyped"},
        {"text": " ("},
        {"code": "src/Effect4/Laws/Program/Typed/Assembly.lean"},
        {"text": ")."}],
       "kind": "para"},
      {"line":
       [{"text":
         "Under decisions row 139, Effect4 strictly separates invariant consequences from progress:"}],
       "kind": "para"},
      {"lines":
       [[{"text": "The theorem "},
         {"code": "machineTyped_not_halted"},
         {"text": " states that a typed machine is not halted."}],
        [{"text":
          "That fact is an invariant consequence, not operational progress."}],
        [{"text":
          "Operational progress additionally requires classifying states as finished, stepping, or waiting at a live frontier."}]],
       "kind": "items"},
      {"line":
       [{"text": "Effect4 cuts unbounded tokens by enforcing "},
        {"code": "keysBelow"},
        {"text": " in "},
        {"code": "QueueOk"},
        {"text":
         " (decisions row 106). Queued observer and enrollment identifiers are bounded below "},
        {"code": "nextId"},
        {"text": " (decisions rows 134 (e) and 189)."}],
       "kind": "para"},
      {"line":
       [{"text":
         "Administrative markers such as raw scope exit callbacks are excluded from general program typing (decisions row 188). Finite queue fairness ("},
        {"code": "flush_fair"},
        {"text":
         ") states that, with enough command fuel, each owner armed at the start is entered. It takes at most as many rounds as there are owners."}],
       "kind": "para"}]},
    {"title": "How to read the claims",
     "kind": "part",
     "key": "about:concept:reactive-scheduling:reading-claims",
     "body":
     [{"line":
       [{"text":
         "The claims under this concept state that machine transitions maintain configuration validity and that scheduling queues behave fairly."}],
       "kind": "para"},
      {"line": [{"text": "Key properties to inspect:"}], "kind": "para"},
      {"lines":
       [[{"ref": "claim:machine-typed-not-halted",
          "label": "`machine-typed-not-halted`"},
         {"text":
          ": A typed machine state never halts at an invalid stuck configuration."}],
        [{"ref": "claim:flush-fair", "label": "`flush-fair`"},
         {"text":
          ": Armed callback owners fire within a bounded number of execution rounds."}],
        [{"ref": "claim:frontier-names-work", "label": "`frontier-names-work`"},
         {"text":
          ": An unfinished machine whose tape runs out waits at a frontier, which is empty exactly at deadlock."}]],
       "kind": "items"},
      {"line":
       [{"text":
         "The table of claims on this page gives each claim's status and its statement."}],
       "kind": "para"}]}]},
  {"rows":
   [[[{"ref": "claim:machine-typed-not-halted",
       "label": "machine-typed-not-halted"}],
     [{"text": "inversion"}],
     [{"status": "proved"}],
     [{"code": "Effect4.Program.Typed.machineTyped_not_halted"}],
     [{"text": "—"}]],
    [[{"ref": "claim:flush-fair", "label": "flush-fair"}],
     [{"text": "fundamentalProperty"}],
     [{"status": "proved"}],
     [{"code": "Effect4.Machine.Scheduling.flush_fair"}],
     [{"text": "—"}]],
    [[{"ref": "claim:random-descent", "label": "random-descent"}],
     [{"text": "fundamentalProperty"}],
     [{"status": "proved"}],
     [{"code": "Effect4.Machine.Descent.complete_unique"}],
     [{"text": "—"}]],
    [[{"ref": "claim:step-loop-preserves", "label": "step-loop-preserves"}],
     [{"text": "preservation"}],
     [{"status": "modulo"}],
     [{"code": "Effect4.Program.Typed.loop_preserves"},
      {"text": ", modulo "},
      {"code": "countdown_parks_positional"}],
     [{"code": "E4-TYPED-CE-025"}]],
    [[{"ref": "claim:step-deliver-preserves",
       "label": "step-deliver-preserves"}],
     [{"text": "preservation"}],
     [{"status": "modulo"}],
     [{"code": "Effect4.Program.Typed.deliver_preserves"},
      {"text": ", modulo "},
      {"code": "countdown_parks_positional"}],
     [{"code": "E4-TYPED-CE-025"}]],
    [[{"ref": "claim:store-frame-typing", "label": "store-frame-typing"}],
     [{"text": "preservation"}],
     [{"status": "proved"}],
     [{"code": "Effect4.Program.Typed.configTyped_frame"}],
     [{"text": "—"}]],
    [[{"ref": "claim:waiter-completion-typing",
       "label": "waiter-completion-typing"}],
     [{"text": "preservation"}],
     [{"status": "proved"}],
     [{"code": "Effect4.Program.Typed.completionStrong_await"}],
     [{"text": "—"}]],
    [[{"ref": "claim:step-wake-preserves", "label": "step-wake-preserves"}],
     [{"text": "preservation"}],
     [{"status": "proved"}],
     [{"code": "Effect4.Program.Typed.wake_preserves"}],
     [{"text": "—"}]],
    [[{"ref": "claim:step-launch-preserves", "label": "step-launch-preserves"}],
     [{"text": "preservation"}],
     [{"status": "proved"}],
     [{"code": "Effect4.Program.Typed.launch_preserves"}],
     [{"code": "E4-TYPED-CE-029"}]],
    [[{"ref": "claim:step-registration-done-preserves",
       "label": "step-registration-done-preserves"}],
     [{"text": "preservation"}],
     [{"status": "proved"}],
     [{"code": "Effect4.Program.Typed.registrationDone_preserves"}],
     [{"text": "—"}]],
    [[{"ref": "claim:drivestate-lift", "label": "drivestate-lift"}],
     [{"text": "simulation"}],
     [{"status": "proved"}],
     [{"code": "Effect4.Machine.Lift.driveState_lift"}],
     [{"text": "—"}]],
    [[{"ref": "claim:typed-state-admitted", "label": "typed-state-admitted"}],
     [{"text": "preservation"}],
     [{"status": "modulo"}],
     [{"code": "Effect4.Program.Typed.reachable_typed"},
      {"text": ", modulo "},
      {"code": "countdown_parks_positional"}],
     [{"text": "—"}]],
    [[{"ref": "claim:run-work-selection", "label": "run-work-selection"}],
     [{"text": "compatibility"}],
     [{"status": "proved"}],
     [{"code": "Effect4.Run.nextControl_spec"}],
     [{"text": "—"}]],
    [[{"ref": "claim:scheduler-progress", "label": "scheduler-progress"}],
     [{"text": "progress"}],
     [{"status": "absent"}],
     [{"text":
       "Operational progress is an open obligation; machineTyped_not_halted provides an invariant consequence (stuck = none) without successor existence"}],
     [{"text": "—"}]],
    [[{"ref": "claim:fair-tape-drains-armed",
       "label": "fair-tape-drains-armed"}],
     [{"text": "adequacy"}],
     [{"status": "proved"}],
     [{"code": "Effect4.Machine.Scheduling.fairTape_unarmed"}],
     [{"text": "—"}]],
    [[{"ref": "claim:frontier-names-work", "label": "frontier-names-work"}],
     [{"text": "inversion"}],
     [{"status": "proved"}],
     [{"code": "Effect4.Api.frontier_empty_iff_deadlocked"}],
     [{"text": "—"}]],
    [[{"ref": "claim:decision-keeps-typed", "label": "decision-keeps-typed"}],
     [{"text": "preservation"}],
     [{"status": "modulo"}],
     [{"code": "Effect4.Program.Typed.decision_preserves"},
      {"text": ", modulo "},
      {"code": "countdown_parks_positional"}],
     [{"text": "—"}]],
    [[{"ref": "claim:fair-scheduling", "label": "fair-scheduling"}],
     [{"text": "adequacy"}],
     [{"status": "absent"}],
     [{"text": "Weak fairness progress is open (R12; decisions row 86)"}],
     [{"text": "—"}]],
    [[{"ref": "claim:queue-step-capacity", "label": "queue-step-capacity"}],
     [{"text": "preservation"}],
     [{"status": "proved"}],
     [{"code": "Effect4.Queue.Model.positive_suspend_step_capacity"}],
     [{"text": "—"}]],
    [[{"ref": "claim:queue-first-profile-closed",
       "label": "queue-first-profile-closed"}],
     [{"text": "preservation"}],
     [{"status": "proved"}],
     [{"code": "Effect4.Queue.Model.first_profile_closed"}],
     [{"text": "—"}]],
    [[{"ref": "claim:semaphore-visit-selects-earliest",
       "label": "semaphore-visit-selects-earliest"}],
     [{"text": "inversion"}],
     [{"status": "proved"}],
     [{"code": "Effect4.Semaphore.Model.visit_selects_earliest"}],
     [{"text": "—"}]],
    [[{"ref": "claim:semaphore-visit-stops", "label": "semaphore-visit-stops"}],
     [{"text": "inversion"}],
     [{"status": "proved"}],
     [{"code": "Effect4.Semaphore.Model.visit_stops_iff"}],
     [{"text": "—"}]],
    [[{"ref": "claim:queue-first-step-invariant",
       "label": "queue-first-step-invariant"}],
     [{"text": "preservation"}],
     [{"status": "proved"}],
     [{"code": "Effect4.Queue.Model.first_step_inv"}],
     [{"text": "—"}]],
    [[{"ref": "claim:queue-first-run-flags", "label": "queue-first-run-flags"}],
     [{"text": "preservation"}],
     [{"status": "proved"}],
     [{"code": "Effect4.Queue.Model.first_run_flags"}],
     [{"text": "—"}]],
    [[{"ref": "claim:pool-select-takes-first",
       "label": "pool-select-takes-first"}],
     [{"text": "inversion"}],
     [{"status": "proved"}],
     [{"code": "Effect4.Pool.Model.select_takes_first"}],
     [{"text": "—"}]]],
   "kind": "table",
   "headers": ["Claim", "Role", "Status", "Evidence", "Contested by"]},
  {"title": "machine-typed-not-halted",
   "kind": "part",
   "key": "claim:machine-typed-not-halted",
   "body":
   [{"line":
     [{"text": "Halted machine configuration outside MachineTyped invariant"}],
     "kind": "para"},
    {"line":
     [{"text": "A halted machine is outside "},
      {"code": "J"},
      {"text": " (row 139; probe C's "},
      {"code": "typedState_halt"},
      {"text": ", read at "},
      {"code": "J"},
      {"text": ")."}],
     "kind": "para"},
    {"rows":
     [{"line": [{"code": "Effect4.Laws.Program.Typed.Assembly"}],
       "label": "Module"},
      {"line":
       [{"text": "PFPL"},
        {"text": ", "},
        {"text": "ch. 28, §28.2, p. 263"},
        {"text": " (adaptedResult)"}],
       "label": "Literature"}],
     "kind": "fields"},
    {"language": "lean",
     "kind": "code",
     "body":
     "∀ (root : Effect4.Program.Typed.ProgramSource) (rootTy : Effect4.Program.EffTy)\n  (w : Effect4.Program.Typed.World) (m : Effect4.Program.Sched.RState)\n  (why : Effect4.Machine.Stuck),\n  Not (Effect4.Program.Typed.MachineTyped root rootTy w (Effect4.Machine.RunMachine.halt m why))"}]},
  {"title": "flush-fair",
   "kind": "part",
   "key": "claim:flush-fair",
   "body":
   [{"line":
     [{"text":
       "Every initially armed owner in a duplicate-free queue is entered within its length in rounds"}],
     "kind": "para"},
    {"line":
     [{"text":
       "LIVE/fair: under enough command fuel for the initial queue, every initially armed owner is entered within its length in rounds, even if callbacks rearm."}],
     "kind": "para"},
    {"rows":
     [{"line": [{"code": "Effect4.Laws.Machine.Scheduling"}],
       "label": "Module"},
      {"line":
       [{"text": "LynchVaandrager1995"},
        {"text": ", "},
        {"text": "audit C4"},
        {"text": " (proofTechnique)"}],
       "label": "Literature"}],
     "kind": "fields"},
    {"language": "lean",
     "kind": "code",
     "body":
     "∀ {ν σ : Type u} {β : Type v} {ε δ ι α χ : Type u} {St : Type (max u v)} [inst : DecidableEq ε]\n  [inst_1 : DecidableEq δ] [inst_2 : DecidableEq ι] [inst_3 : DecidableEq α]\n  (interp : Effect4.Machine.RunInterp ν σ β ε δ ι α χ St) (fuel rounds : Nat)\n  (m : Effect4.Machine.RunMachine ν σ β ε δ ι α χ St),\n  (m.armed (Effect4.Prim ν σ β ε δ ι α) (Effect4.FrameFiber ν σ β ε δ ι α)\n        (Effect4.FrameEvent ν σ β ε δ ι α)).Nodup →\n    Eq\n        (Effect4.Machine.Scheduling.FlushReady interp fuel\n          (m.armed (Effect4.Prim ν σ β ε δ ι α) (Effect4.FrameFiber ν σ β ε δ ι α)\n              (Effect4.FrameEvent ν σ β ε δ ι α)).length\n          m)\n        Bool.true →\n      instLENat.le\n          (m.armed (Effect4.Prim ν σ β ε δ ι α) (Effect4.FrameFiber ν σ β ε δ ι α)\n              (Effect4.FrameEvent ν σ β ε δ ι α)).length\n          rounds →\n        ∀ (owner : Effect4.FiberId),\n          List.instMembership.mem\n              (m.armed (Effect4.Prim ν σ β ε δ ι α) (Effect4.FrameFiber ν σ β ε δ ι α)\n                (Effect4.FrameEvent ν σ β ε δ ι α))\n              owner →\n            Eq (Effect4.Machine.Scheduling.FiredWithin interp fuel rounds m owner) Bool.true"}]},
  {"title": "random-descent",
   "kind": "part",
   "key": "claim:random-descent",
   "body":
   [{"line":
     [{"text":
       "Under a bisimulation that is an equivalence, and the local diamond up to it, every complete tape of a step labelled by decisions has one length and an equal end; one complete tape bounds every tape. Nothing of the machine: the checked fragment of decisions row 361 is its use"}],
     "kind": "para"},
    {"line":
     [{"text": "Every complete tape has the same length and an "},
      {"code": "R"},
      {"text": "-equal end. The pointer of the claim "},
      {"code": "random-descent"},
      {"text": "."}],
     "kind": "para"},
    {"rows":
     [{"line": [{"code": "Effect4.Laws.Machine.Descent"}], "label": "Module"}],
     "kind": "fields"},
    {"language": "lean",
     "kind": "code",
     "body":
     "∀ {S : Type u} {D : Type v} {step : S → D → Option S} {R : S → S → Prop},\n  Equivalence R →\n    Effect4.Machine.Descent.Bisim step R →\n      Effect4.Machine.Descent.Diamond step R →\n        ∀ {s t1 t2 : S} {c1 c2 : List D},\n          Eq (Effect4.Machine.Descent.run step s c1) (Option.some t1) →\n            Effect4.Machine.Descent.Terminal step t1 →\n              Eq (Effect4.Machine.Descent.run step s c2) (Option.some t2) →\n                Effect4.Machine.Descent.Terminal step t2 → And (R t1 t2) (Eq c1.length c2.length)"}]},
  {"title": "step-loop-preserves",
   "kind": "part",
   "key": "claim:step-loop-preserves",
   "body":
   [{"line": [{"text": "The loop decision preserves configuration typing"}],
     "kind": "para"},
    {"line":
     [{"code": "loop"},
      {"text": " keeps "},
      {"code": "I"},
      {"text": " ("},
      {"code": "loop_preserves"},
      {"text": "): every clause, the walk."}],
     "kind": "para"},
    {"rows":
     [{"line": [{"code": "Effect4.Laws.Program.Typed.Commands.Clauses.All"}],
       "label": "Module"},
      {"line":
       [{"text": "WrightFelleisen1994"},
        {"text": ", "},
        {"text": "audit P36"},
        {"text": " (adaptedResult)"}],
       "label": "Literature"}],
     "kind": "fields"},
    {"language": "lean",
     "kind": "code",
     "body":
     "∀ (root : Effect4.Program.Typed.ProgramSource) (rootTy : Effect4.Program.EffTy)\n  (id : Effect4.FiberId) (y : Bool),\n  Effect4.Program.Typed.StepPreserves root rootTy (Effect4.Machine.Cmd.loop id y)"},
    {"line":
     [{"text": "Register record "},
      {"code": "E4-TYPED-CE-025"},
      {"text": " (REPAIRED)"}],
     "kind": "para"},
    {"language": "text",
     "kind": "code",
     "body":
     "| `E4-TYPED-CE-025` | REPAIRED 2026-10-03 (row 134 (b), the waiter column `MachineWide.waiters`; the refuted goals `M6Ledger.step_loop` and `step_deliver` are proved over it: `loop_preserves`, `deliver_preserves`, `Typed/Commands/Clauses/All.lean`, `053aa3d9`, `[propext, Quot.sound]`); SEEDED 2026-10-01 (seat D3, `5789df56`, merged `7d50cfe6`; kernel-checked at `[propext, Quot.sound]`) | `StepPreserves` for `loop` and `deliver` is false: completing a Deferred owes its waiters the completion at tokens no clause relates to the cell | `docs/research/2026-10-01-landing/seat-D3/probes/LoopDeliver.lean`: `loop_false`, `deliver_false` | row 134 (b): a waiter column in `J` (ruled; seat D5) |"}]},
  {"title": "step-deliver-preserves",
   "kind": "part",
   "key": "claim:step-deliver-preserves",
   "body":
   [{"line": [{"text": "The deliver decision preserves configuration typing"}],
     "kind": "para"},
    {"line":
     [{"code": "deliver"},
      {"text": " keeps "},
      {"code": "I"},
      {"text": " ("},
      {"code": "deliver_preserves"},
      {"text": "): every clause, the walk."}],
     "kind": "para"},
    {"rows":
     [{"line": [{"code": "Effect4.Laws.Program.Typed.Commands.Clauses.All"}],
       "label": "Module"}],
     "kind": "fields"},
    {"language": "lean",
     "kind": "code",
     "body":
     "∀ (root : Effect4.Program.Typed.ProgramSource) (rootTy : Effect4.Program.EffTy)\n  (id : Effect4.FiberId) (y : Bool),\n  Effect4.Program.Typed.StepPreserves root rootTy (Effect4.Machine.Cmd.deliver id y)"},
    {"line":
     [{"text": "Register record "},
      {"code": "E4-TYPED-CE-025"},
      {"text": " (REPAIRED)"}],
     "kind": "para"},
    {"language": "text",
     "kind": "code",
     "body":
     "| `E4-TYPED-CE-025` | REPAIRED 2026-10-03 (row 134 (b), the waiter column `MachineWide.waiters`; the refuted goals `M6Ledger.step_loop` and `step_deliver` are proved over it: `loop_preserves`, `deliver_preserves`, `Typed/Commands/Clauses/All.lean`, `053aa3d9`, `[propext, Quot.sound]`); SEEDED 2026-10-01 (seat D3, `5789df56`, merged `7d50cfe6`; kernel-checked at `[propext, Quot.sound]`) | `StepPreserves` for `loop` and `deliver` is false: completing a Deferred owes its waiters the completion at tokens no clause relates to the cell | `docs/research/2026-10-01-landing/seat-D3/probes/LoopDeliver.lean`: `loop_false`, `deliver_false` | row 134 (b): a waiter column in `J` (ruled; seat D5) |"}]},
  {"title": "store-frame-typing",
   "kind": "part",
   "key": "claim:store-frame-typing",
   "body":
   [{"line":
     [{"text":
       "A store edit satisfying the stated frame, store typing, key and due-owner premises keeps configuration typing"}],
     "kind": "para"},
    {"line":
     [{"text": "A store edit keeps "},
      {"code": "I"},
      {"text": " at the world over the edited store ("},
      {"code": "note.md"},
      {"text": " §4): the views "},
      {"code": "J"},
      {"text":
       " reads move as the frame says, and the new store states its own clauses (well-formedness, the generated store typing, no new internal key, owners for its scheduled due entries)."}],
     "kind": "para"},
    {"rows":
     [{"line": [{"code": "Effect4.Laws.Program.Typed.Commands.Bookkeeping"}],
       "label": "Module"},
      {"line":
       [{"text": "deVilhenaPottier2021"},
        {"text": ", "},
        {"text": "§4.2.4 (frame rule); audit P8"},
        {"text": " (analogy)"}],
       "label": "Literature"}],
     "kind": "fields"},
    {"language": "lean",
     "kind": "code",
     "body":
     "∀ {root : Effect4.Program.Typed.ProgramSource} {rootTy : Effect4.Program.EffTy}\n  {w : Effect4.Program.Typed.World} {m : Effect4.Program.Sched.RState}\n  {q : List Effect4.Program.Sched.RCmd},\n  Effect4.Program.Typed.ConfigTyped root rootTy w m q →\n    ∀ {s : Effect4.Machine.Stores},\n      Effect4.Program.Typed.StoreFrame m.state s →\n        s.WF →\n          Effect4.Program.Typed.StoresOk (Effect4.Program.Typed.preds root)\n              { ids := w.ids, state := s, Γ := w.Γ, «Π» := w.«Π», Ρ := w.Ρ, Θ := w.Θ,\n                serviceTy := w.serviceTy }\n              Effect4.Program.Typed.Expect.root s →\n            List.instHasSubset.Subset\n                (Effect4.Program.Guard.internalKeys\n                  { fibers := m.fibers, races := m.races, nextId := m.nextId,\n                    nextToken := m.nextToken, nextRace := m.nextRace,\n                    middlewareInstalled := m.middlewareInstalled, armed := m.armed, state := s,\n                    trace := m.trace, stuck := m.stuck, forks := m.forks })\n                (Effect4.Program.Guard.internalKeys m) →\n              (∀\n                  (o :\n                    Effect4.Machine.Owed\n                      (Effect4.Machine.Completion Effect4.Machine.Val Effect4.Machine.Err\n                        Effect4.Machine.Defect Effect4.FiberId Effect4.Machine.Ann)),\n                  List.instMembership.mem\n                      (s.deferreds.due\n                        (Effect4.Machine.Completion Effect4.Machine.Val Effect4.Machine.Err\n                          Effect4.Machine.Defect Effect4.FiberId Effect4.Machine.Ann))\n                      o →\n                    ∀ (owner : Effect4.FiberId) (priority : Nat),\n                      Eq o.mode (Effect4.Machine.WakeMode.scheduled owner priority) →\n                        Eq (Effect4.Machine.RunMachine.fiber? m owner).isSome Bool.true) →\n                And\n                  (w.leHost\n                    { ids := w.ids, state := s, Γ := w.Γ, «Π» := w.«Π», Ρ := w.Ρ, Θ := w.Θ,\n                      serviceTy := w.serviceTy })\n                  (Effect4.Program.Typed.ConfigTyped root rootTy\n                    { ids := w.ids, state := s, Γ := w.Γ, «Π» := w.«Π», Ρ := w.Ρ, Θ := w.Θ,\n                      serviceTy := w.serviceTy }\n                    { fibers := m.fibers, races := m.races, nextId := m.nextId,\n                      nextToken := m.nextToken, nextRace := m.nextRace,\n                      middlewareInstalled := m.middlewareInstalled, armed := m.armed, state := s,\n                      trace := m.trace, stuck := m.stuck, forks := m.forks }\n                    q)"}]},
  {"title": "waiter-completion-typing",
   "kind": "part",
   "key": "claim:waiter-completion-typing",
   "body":
   [{"line":
     [{"text":
       "A completion fitting its cell's columns meets a waiter's declared answer and error demand"}],
     "kind": "para"},
    {"line":
     [{"text": "The waiter → due transfer ("},
      {"code": "note.md"},
      {"text":
       " §3): a waiter declared at a type that accepts its cell's columns accepts any completion the cell holds, the cell's completion moving along both columns ("},
      {"code": "fitsExit_sub"},
      {"text": "; a delayed read along the checker's order, "},
      {"code": "Ty.sub_le_subN"},
      {"text": ")."}],
     "kind": "para"},
    {"rows":
     [{"line": [{"code": "Effect4.Laws.Program.Typed.Commands.Bookkeeping"}],
       "label": "Module"},
      {"line":
       [{"text": "deVilhenaPottier2021"},
        {"text": ", "},
        {"text": "§3.3 (protocol subsumption); audit P8"},
        {"text": " (proofTechnique)"}],
       "label": "Literature"}],
     "kind": "fields"},
    {"language": "lean",
     "kind": "code",
     "body":
     "∀ {w : Effect4.Program.Typed.World} {a e : Effect4.Program.Ty} {ty : Effect4.Program.EffTy}\n  {c :\n    Effect4.Machine.Completion Effect4.Machine.Val Effect4.Machine.Err Effect4.Machine.Defect\n      Effect4.FiberId Effect4.Machine.Ann},\n  Effect4.Program.Typed.AwaitDemand a e ty →\n    Effect4.Program.Typed.CompletionStrong w\n        { answer := a, error := e, requires := Effect4.Machine.Env.Requirement.empty } c →\n      Effect4.Program.Typed.CompletionStrong w ty c"}]},
  {"title": "step-wake-preserves",
   "kind": "part",
   "key": "claim:step-wake-preserves",
   "body":
   [{"line":
     [{"text":
       "The wake command keeps configuration typing through its waiter-to-due transfer"}],
     "kind": "para"},
    {"line":
     [{"code": "wake"},
      {"text": " keeps "},
      {"code": "I"},
      {"text": " at the world over the woken store."}],
     "kind": "para"},
    {"rows":
     [{"line": [{"code": "Effect4.Laws.Program.Typed.Commands.Bookkeeping"}],
       "label": "Module"},
      {"line":
       [{"text": "LynchVaandrager1995"},
        {"text": ", "},
        {"text": "§6 (invariants); audit C4"},
        {"text": " (proofTechnique)"}],
       "label": "Literature"}],
     "kind": "fields"},
    {"language": "lean",
     "kind": "code",
     "body":
     "∀ (root : Effect4.Program.Typed.ProgramSource) (rootTy : Effect4.Program.EffTy)\n  (list : Effect4.Machine.WakeKey) (phase : Effect4.Machine.WakePhase),\n  Effect4.Program.Typed.StepPreserves root rootTy (Effect4.Machine.Cmd.wake list phase)"}]},
  {"title": "step-launch-preserves",
   "kind": "part",
   "key": "claim:step-launch-preserves",
   "body":
   [{"line":
     [{"text":
       "The launch command keeps configuration typing when adding a fresh race entrant"}],
     "kind": "para"},
    {"line":
     [{"code": "launch"},
      {"text": " keeps "},
      {"code": "I"},
      {"text": " ("},
      {"code": "Machine/Fibers.lean:1879-1896"},
      {"text": ", rc.112 "},
      {"code": ":1520-1528"},
      {"text": "): the entrant is allocated at the old "},
      {"code": "nextId"},
      {"text":
       " and declared at the race's result type (its program, typed at a type whose columns are below it, widened there; closed because the race token's declaration is), the race loses that program, and the entrant's evaluation and enrollment are queued ahead of the next launch. Every other arm leaves the machine and drops the head."}],
     "kind": "para"},
    {"rows":
     [{"line": [{"code": "Effect4.Laws.Program.Typed.Commands.Launch"}],
       "label": "Module"}],
     "kind": "fields"},
    {"language": "lean",
     "kind": "code",
     "body":
     "∀ (root : Effect4.Program.Typed.ProgramSource) (rootTy : Effect4.Program.EffTy) (raceId : Nat),\n  Effect4.Program.Typed.StepPreserves root rootTy (Effect4.Machine.Cmd.launch raceId)"},
    {"line":
     [{"text": "Register record "},
      {"code": "E4-TYPED-CE-029"},
      {"text": " (REPAIRED)"}],
     "kind": "para"},
    {"language": "text",
     "kind": "code",
     "body":
     "| `E4-TYPED-CE-029` | REPAIRED 2026-10-03 (row 134 (e), fresh-bounded fiber ids; the refuted goal `M6Ledger.step_launch` is proved over it: `launch_preserves`, `Typed/Commands/Launch.lean`); SEEDED 2026-10-01 (seat D3, `5789df56`, merged `7d50cfe6`; kernel-checked at `[propext, Quot.sound]`) | `StepPreserves` for `launch` is false: a race's live set may name the next fiber id | `docs/research/2026-10-01-landing/seat-D3/probes/Races.lean`: `Launch.launch_false` | row 134 (e): fresh-bounded fiber ids (ruled; seat D5) |"}]},
  {"title": "step-registration-done-preserves",
   "kind": "part",
   "key": "claim:step-registration-done-preserves",
   "body":
   [{"line":
     [{"text":
       "Completing race registration keeps configuration typing through immediate settlement or parking"}],
     "kind": "para"},
    {"line":
     [{"code": "registrationDone"},
      {"text": " keeps "},
      {"code": "I"},
      {"text": " at the same world (Concept 4, scheduler step preservation; "},
      {"code": "Machine/Fibers.lean:1912-1931"},
      {"text":
       "). The head's authority names the race and its running, unparked host on the race's marker; "},
      {"code": "RegistrationState"},
      {"text": " gives the race token's declared type "},
      {"code": "resultTy"},
      {"text": " and a host stack accepting it ("},
      {"code": "StackReply"},
      {"text": "); "},
      {"code": "RaceOk"},
      {"text": " gives the race column at that type ("},
      {"code": "RacePayload"},
      {"text": "), which does not read "},
      {"code": "registering"},
      {"text": ". An accepted exit is typed by the column and installed as "},
      {"code": "raceSettle"},
      {"text": " ("},
      {"code": "raceSettle_typed"},
      {"text": ") under the queued "},
      {"code": "loop"},
      {"text": ". With no answer the cancel frame is pushed ("},
      {"code": "stackAccepts_raceFinalizer"},
      {"text": "): a deferred interrupt clears the park and the queued "},
      {"code": "loop"},
      {"text": " reads the marker, which "},
      {"code": "ReadCode"},
      {"text": " leaves to "},
      {"code": "RegistrationState"},
      {"text": "; otherwise the host parks idle at the race key with a "},
      {"code": "void"},
      {"text": " record, which no observer reads (decisions row 134 (d); "},
      {"code": "configTyped_rupdate_park"},
      {"text": "), and the race retains its declared token."}],
     "kind": "para"},
    {"rows":
     [{"line": [{"code": "Effect4.Laws.Program.Typed.Commands.Registration"}],
       "label": "Module"}],
     "kind": "fields"},
    {"language": "lean",
     "kind": "code",
     "body":
     "∀ (root : Effect4.Program.Typed.ProgramSource) (rootTy : Effect4.Program.EffTy) (raceId : Nat)\n  (yielding : Bool),\n  Effect4.Program.Typed.StepPreserves root rootTy\n    (Effect4.Machine.Cmd.registrationDone raceId yielding)"}]},
  {"title": "drivestate-lift",
   "kind": "part",
   "key": "claim:drivestate-lift",
   "body":
   [{"line": [{"text": "Command loop invariant lifting for driveState"}],
     "kind": "para"},
    {"line":
     [{"text":
       "Lift 1, the command loop. One fact per command gives the fact for "},
      {"code": "driveState"},
      {"text":
       " at every fuel, machine and pending list, at some later world."}],
     "kind": "para"},
    {"rows":
     [{"line": [{"code": "Effect4.Laws.Machine.Lift"}], "label": "Module"},
      {"line":
       [{"text": "PFPL"},
        {"text": ", "},
        {"text": "ch. 28, pp. 261–268"},
        {"text": " (proofTechnique)"}],
       "label": "Literature"}],
     "kind": "fields"},
    {"language": "lean",
     "kind": "code",
     "body":
     "∀ {ν σ : Type u} {β : Type v} {ε δ ι α χ : Type u} {St : Type (max u v)} [inst : DecidableEq ε]\n  [inst_1 : DecidableEq δ] [inst_2 : DecidableEq ι] [inst_3 : DecidableEq α]\n  {κ φ η : Type (max u v)} [inst_4 : Effect4.Machine.FiberCore ν β ε δ ι α κ φ]\n  [inst_5 : Effect4.Machine.FiberEvaluator ν σ β ε δ ι α χ St κ φ η] {W : Type w}\n  (o : Effect4.Laws.Effects.WorldOrder W) (interp : Effect4.Machine.RunInterp ν σ β ε δ ι α χ St κ)\n  (I :\n    W →\n      Effect4.Machine.RunMachine ν σ β ε δ ι α χ St κ φ η →\n        List (Effect4.Machine.Cmd ν σ β ε δ ι α κ) → Prop),\n  Effect4.Machine.Lift.StepKeeps o interp I →\n    ∀ (fuel : Nat) (w : W) (m : Effect4.Machine.RunMachine ν σ β ε δ ι α χ St κ φ η)\n      (cmds : List (Effect4.Machine.Cmd ν σ β ε δ ι α κ)),\n      I w m cmds →\n        Exists fun w' =>\n          And (o.le w w')\n            (I w' (Effect4.Machine.driveState interp fuel m cmds).fst\n              (Effect4.Machine.driveState interp fuel m cmds).snd)"}]},
  {"title": "typed-state-admitted",
   "kind": "part",
   "key": "claim:typed-state-admitted",
   "body":
   [{"line":
     [{"text":
       "Every admitted replay of a checked program ends in J: host answers admitted at the ghost token table keep the typed state"}],
     "kind": "para"},
    {"line":
     [{"text":
       "Every admitted replay of a checked program is typed: the reference replay of a tape whose host answers are admitted ("},
      {"code": "AdmittedTape"},
      {"text": ", the ghost admission at "},
      {"code": "Θ"},
      {"text": ") ends in "},
      {"code": "J"},
      {"text":
       ", for every checked closed program, with row 117's empty requirement row at the load. M5 ("},
      {"code": "load_typed"},
      {"text": ") and M6 ("},
      {"code": "decision_preserves"},
      {"text": ") through "},
      {"code": "admitted_typed"},
      {"text": ". Concept 4 ("},
      {"code": "typed-state-reachable"},
      {"text":
       "); it reduces the host lane's typing half (T4) to executable admission ("},
      {"code": "admit_sound"},
      {"text": ", decisions rows 97–99)."}],
     "kind": "para"},
    {"rows":
     [{"line": [{"code": "Effect4.Laws.Program.Typed.Commands.Clauses.All"}],
       "label": "Module"}],
     "kind": "fields"},
    {"language": "lean",
     "kind": "code",
     "body":
     "∀ (root : Effect4.Program.Typed.ProgramSource) (rootTy : Effect4.Program.EffTy) (fuel : Nat),\n  Eq (Effect4.Program.typeOfProgram root.sig.signature root.program) (Option.some rootTy) →\n    Eq rootTy.requires Effect4.Machine.Env.Requirement.empty →\n      ∀ (tape : List Effect4.Api.Decision),\n        Effect4.Program.Typed.AdmittedTape root rootTy fuel tape →\n          Exists fun w =>\n            Effect4.Program.Typed.MachineTyped root rootTy w\n              (Effect4.Machine.ReplayResult.machine\n                (Effect4.Program.Sched.replayR root.program fuel tape))"}]},
  {"title": "run-work-selection",
   "kind": "part",
   "key": "claim:run-work-selection",
   "body":
   [{"line":
     [{"text":
       "The opt-in control planner selects exactly a queued flush or the first runnable evaluation on a non-stuck machine"}],
     "kind": "para"},
    {"line":
     [{"text":
       "The selected control belongs to the declared two-choice policy."}],
     "kind": "para"},
    {"rows": [{"line": [{"code": "Effect4.Laws.Run"}], "label": "Module"}],
     "kind": "fields"},
    {"language": "lean",
     "kind": "code",
     "body":
     "∀ (s : Effect4.Run) (decision : Effect4.Api.Decision),\n  Iff (Eq s.nextControl (Option.some decision))\n    (And\n      (Eq\n        (s.machine.stuck\n          (Effect4.Prim Effect4.Program.EffName Effect4.Program.EffThunk Effect4.Machine.Val\n            Effect4.Machine.Err Effect4.Machine.Defect Effect4.FiberId Effect4.Machine.Ann)\n          (Effect4.FrameFiber Effect4.Program.EffName Effect4.Program.EffThunk Effect4.Machine.Val\n            Effect4.Machine.Err Effect4.Machine.Defect Effect4.FiberId Effect4.Machine.Ann)\n          (Effect4.FrameEvent Effect4.Program.EffName Effect4.Program.EffThunk Effect4.Machine.Val\n            Effect4.Machine.Err Effect4.Machine.Defect Effect4.FiberId Effect4.Machine.Ann))\n        Option.none)\n      (Or (And (Eq decision Effect4.Api.flush) (Ne s.work.queued List.nil))\n        (Exists fun fiber =>\n          And (Eq decision (Effect4.Machine.RunDecision.evaluate fiber))\n            (And (Eq s.work.queued List.nil) (Eq s.work.runnable.head? (Option.some fiber))))))"}]},
  {"title": "scheduler-progress",
   "kind": "part",
   "key": "claim:scheduler-progress",
   "body":
   [{"line":
     [{"text":
       "Operational progress with successor transitions or live frontier classification"}],
     "kind": "para"}]},
  {"title": "fair-tape-drains-armed",
   "kind": "part",
   "key": "claim:fair-tape-drains-armed",
   "body":
   [{"line":
     [{"text":
       "A fair finite tape that suffices leaves no armed owner at its live end (R12-a: the finite endpoint consequence of FairTape's final prefix; not general fairness, not infinite tapes)"}],
     "kind": "para"},
    {"line":
     [{"text":
       "A fair finite tape leaves nothing armed at its live end (R12-a, the finite endpoint consequence): when the whole tape suffices and its replay is not stuck, "},
      {"code": "FairTape"},
      {"text": " at the split "},
      {"code": "tape ++ []"},
      {"text":
       " asks each armed owner for a later servicing decision inside the empty suffix, so no owner is armed. Concept "},
      {"code": "reactive-scheduling"},
      {"text": ", claim "},
      {"code": "fair-tape-drains-armed"},
      {"text":
       ". Reach: one finite tape, at any interpreter and fuel. It does not establish liveness on infinite tapes, termination, host progress, general scheduler fairness ("},
      {"code": "flush_fair"},
      {"text":
       " permits rearming), or that the frontier names the remaining waits (R12-b). It serves R12 as the finite half of \"liveness under "},
      {"code": "FairTape"},
      {"text": "\"."}],
     "kind": "para"},
    {"rows":
     [{"line": [{"code": "Effect4.Laws.Machine.Scheduling"}],
       "label": "Module"}],
     "kind": "fields"},
    {"language": "lean",
     "kind": "code",
     "body":
     "∀ {ν σ : Type u} {β : Type v} {ε δ ι α χ : Type u} {St : Type (max u v)} [inst : DecidableEq ε]\n  [inst_1 : DecidableEq δ] [inst_2 : DecidableEq ι] [inst_3 : DecidableEq α]\n  (interp : Effect4.Machine.RunInterp ν σ β ε δ ι α χ St) (fuel : Nat)\n  (m : Effect4.Machine.RunMachine ν σ β ε δ ι α χ St)\n  (tape : List (Effect4.Machine.RunDecision ν σ β ε δ ι α)),\n  Effect4.Machine.Scheduling.FairTape interp fuel m tape →\n    Eq (Effect4.Machine.Suffices interp fuel tape m) Bool.true →\n      Eq\n          ((Effect4.Machine.replayEval interp fuel tape m).machine.stuck\n            (Effect4.Prim ν σ β ε δ ι α) (Effect4.FrameFiber ν σ β ε δ ι α)\n            (Effect4.FrameEvent ν σ β ε δ ι α))\n          Option.none →\n        Eq\n          ((Effect4.Machine.replayEval interp fuel tape m).machine.armed\n            (Effect4.Prim ν σ β ε δ ι α) (Effect4.FrameFiber ν σ β ε δ ι α)\n            (Effect4.FrameEvent ν σ β ε δ ι α))\n          List.nil"}]},
  {"title": "frontier-names-work",
   "kind": "part",
   "key": "claim:frontier-names-work",
   "body":
   [{"line":
     [{"text":
       "R12-b: at a live, unfinished machine whose tape ran out, the frontier is empty exactly at a deadlock: nothing runnable, nothing armed, no host request, no timer, no compile budget (not progress, not liveness)"}],
     "kind": "para"},
    {"line":
     [{"text":
       "R12-b: at a live, unfinished machine, the tape frontier is empty exactly at a deadlock. So the frontier names a reason whenever work is armed ("},
      {"code": "E4-SCHED-CE-021"},
      {"text": ", repaired by decisions row 201 (b))."}],
     "kind": "para"},
    {"line":
     [{"text": "Concept "},
      {"code": "reactive-scheduling"},
      {"text": ", claim "},
      {"code": "frontier-names-work"},
      {"text": ": the frontier half of the classification that "},
      {"code": "scheduler-progress"},
      {"text": " asks for. Reach: every frame machine ("},
      {"code": "NativeMachine"},
      {"text":
       "), with no reachability or typing premise, at the tape exhaustion site; a fuel frontier always names "},
      {"code": ".commandFuel"},
      {"text": " ("},
      {"code": "commandFuel_iff"},
      {"text":
       "). It does not establish that the named decision steps the machine, what any decision does at a deadlocked machine, or liveness (R12-c). It serves R12: "},
      {"code": "Deadlocked"},
      {"text": " requires nothing armed."}],
     "kind": "para"},
    {"rows":
     [{"line": [{"code": "Effect4.Laws.Api.Frontier"}], "label": "Module"}],
     "kind": "fields"},
    {"language": "lean",
     "kind": "code",
     "body":
     "∀ (m : Effect4.Program.NativeMachine),\n  Eq\n      (m.stuck\n        (Effect4.Prim Effect4.Program.EffName Effect4.Program.EffThunk Effect4.Machine.Val\n          Effect4.Machine.Err Effect4.Machine.Defect Effect4.FiberId Effect4.Machine.Ann)\n        (Effect4.FrameFiber Effect4.Program.EffName Effect4.Program.EffThunk Effect4.Machine.Val\n          Effect4.Machine.Err Effect4.Machine.Defect Effect4.FiberId Effect4.Machine.Ann)\n        (Effect4.FrameEvent Effect4.Program.EffName Effect4.Program.EffThunk Effect4.Machine.Val\n          Effect4.Machine.Err Effect4.Machine.Defect Effect4.FiberId Effect4.Machine.Ann))\n      Option.none →\n    Eq (Effect4.Machine.RunMachine.finished m) Bool.false →\n      Iff (Eq (Effect4.Api.frontierReasons Effect4.Machine.Exhaustion.tape m) List.nil)\n        (Effect4.Api.Deadlocked m)"}]},
  {"title": "decision-keeps-typed",
   "kind": "part",
   "key": "claim:decision-keeps-typed",
   "body":
   [{"line":
     [{"text":
       "M6b: one tape decision keeps J when its host answer, if any, is admitted"}],
     "kind": "para"},
    {"line":
     [{"text": "A tape decision keeps "},
      {"code": "J"},
      {"text": " ("},
      {"code": "decision_preserves"},
      {"text":
       "): the command facts and the six edits through the decision lift ("},
      {"code": "decisionKeeps_of_ledger"},
      {"text": ")."}],
     "kind": "para"},
    {"rows":
     [{"line": [{"code": "Effect4.Laws.Program.Typed.Commands.Clauses.All"}],
       "label": "Module"}],
     "kind": "fields"},
    {"language": "lean",
     "kind": "code",
     "body":
     "∀ (root : Effect4.Program.Typed.ProgramSource) (rootTy : Effect4.Program.EffTy) (fuel : Nat)\n  (d : Effect4.Api.Decision), Effect4.Program.Typed.DecisionKeeps root rootTy fuel d"}]},
  {"title": "fair-scheduling",
   "kind": "part",
   "key": "claim:fair-scheduling",
   "body":
   [{"line": [{"text": "Progress under weak fairness"}], "kind": "para"},
    {"rows":
     [{"line":
       [{"text": "PFPL"},
        {"text": ", "},
        {"text": "chs. 39–41, pp. 371–406"},
        {"text": " (excludedFeature)"}],
       "label": "Literature"}],
     "kind": "fields"}]},
  {"title": "queue-step-capacity",
   "kind": "part",
   "key": "claim:queue-step-capacity",
   "body":
   [{"line":
     [{"text":
       "One step of the Queue's abstract model under suspend keeps the capacity, the strategy and the buffer's bound (a helper of queue-expansion-agrees on its abstract client's side; lengths in the natural-number model, no delivery and no target; decisions rows 219, 233 and 255)"}],
     "kind": "para"},
    {"line":
     [{"text":
       "Abstract positive-capacity suspend steps keep the configuration and buffer bound. Consumer: the later Queue term-to-model refinement. No wrapper or host claim. The proof does not use "},
      {"code": "_hpos"},
      {"text": "."}],
     "kind": "para"},
    {"rows":
     [{"line": [{"code": "Effect4.Laws.Library.Queue.Capacity"}],
       "label": "Module"}],
     "kind": "fields"},
    {"language": "lean",
     "kind": "code",
     "body":
     "∀ (c : Nat) (s : Effect4.Queue.Model.State) (op : Effect4.Queue.Model.Op),\n  instLTNat.lt 0 c →\n    Eq s.capacity (Option.some c) →\n      Eq s.strategy Effect4.Queue.Model.Strategy.suspend →\n        instLENat.le s.messages.length c →\n          have next := (Effect4.Queue.Model.step Effect4.Queue.Model.Fault.none { s := s } op).s;\n          And (Eq next.capacity (Option.some c))\n            (And (Eq next.strategy Effect4.Queue.Model.Strategy.suspend)\n              (instLENat.le next.messages.length c))"}]},
  {"title": "queue-first-profile-closed",
   "kind": "part",
   "key": "claim:queue-first-profile-closed",
   "body":
   [{"line":
     [{"text":
       "Each first operation of the Queue's abstract model keeps the first profile, when its request keeps the step's premise (a helper of queue-expansion-agrees: the domain of the step goals; no agreement of a term with the model; decisions rows 219, 233 and 255)"}],
     "kind": "para"},
    {"line":
     [{"text":
       "The first profile is closed. Each first operation of the model leaves a state of the profile, when its request keeps the premise. Consumer: each step goal of the Queue's term-to-model refinement, along a run. No wrapper or host claim."}],
     "kind": "para"},
    {"rows":
     [{"line": [{"code": "Effect4.Laws.Library.Queue.Profile"}],
       "label": "Module"}],
     "kind": "fields"},
    {"language": "lean",
     "kind": "code",
     "body":
     "∀ (s : Effect4.Queue.Model.State) (op : Effect4.Queue.Model.Op),\n  Effect4.Queue.Model.FirstProfile s →\n    Eq (Effect4.Queue.Model.firstOp op) Bool.true →\n      Effect4.Queue.Model.Requested s op →\n        Effect4.Queue.Model.FirstProfile\n          (Effect4.Queue.Model.step Effect4.Queue.Model.Fault.none { s := s } op).s"}]},
  {"title": "semaphore-visit-selects-earliest",
   "kind": "part",
   "key": "claim:semaphore-visit-selects-earliest",
   "body":
   [{"line":
     [{"text":
       "One visit of Semaphore's model selects the earliest fitting waiter at or after its cursor, and that waiter leaves (a helper of semaphore-expansion-agrees' waiting clauses; one visit, no walk and no liveness; decisions row 259)"}],
     "kind": "para"},
    {"line":
     [{"text":
       "A visit resumes the earliest fitting waiter at or after its cursor. On a profile state, the selected waiter is enrolled, its stamp is at or after the cursor, and its count fits the free count. Its stamp is the least among the waiters that are at or after the cursor and fit. The selected waiter leaves the list, and nothing else changes. Consumer: the waiting clauses of the proposed claim "},
      {"code": "semaphore-expansion-agrees"},
      {"text": ". It states one visit, and nothing about a whole walk."}],
     "kind": "para"},
    {"rows":
     [{"line": [{"code": "Effect4.Laws.Library.Semaphore.Profile"}],
       "label": "Module"}],
     "kind": "fields"},
    {"language": "lean",
     "kind": "code",
     "body":
     "∀ {s : Effect4.Semaphore.Model.State},\n  Effect4.Semaphore.Model.Profile s →\n    ∀ {cursor : Nat} {w : Effect4.Semaphore.Model.Waiter},\n      Eq (Effect4.Semaphore.Model.visit s cursor).snd (Option.some w) →\n        And (List.instMembership.mem s.waiters w)\n          (And (instLENat.le cursor w.stamp)\n            (And (instLENat.le w.need (Effect4.Semaphore.Model.free s))\n              (And\n                (∀ (u : Effect4.Semaphore.Model.Waiter),\n                  List.instMembership.mem s.waiters u →\n                    instLENat.le cursor u.stamp →\n                      instLENat.le u.need (Effect4.Semaphore.Model.free s) →\n                        instLENat.le w.stamp u.stamp)\n                (Eq (Effect4.Semaphore.Model.visit s cursor).fst\n                  { permits := s.permits, taken := s.taken, waiters := s.waiters.erase w,\n                    next := s.next }))))"}]},
  {"title": "semaphore-visit-stops",
   "kind": "part",
   "key": "claim:semaphore-visit-stops",
   "body":
   [{"line":
     [{"text":
       "One visit of Semaphore's model selects nobody exactly when no permit is free or no waiter at or after the cursor fits, and then it changes nothing (a helper of semaphore-expansion-agrees' waiting clauses; one visit, no walk and no liveness; decisions row 259)"}],
     "kind": "para"},
    {"line":
     [{"text":
       "A visit stops only when no permit is free or no such waiter fits. A visit selects nobody exactly when the free count is zero, or each waiter at or after the cursor needs more than the free count. It then changes nothing. Consumer: the waiting clauses of the proposed claim "},
      {"code": "semaphore-expansion-agrees"},
      {"text": ". It states one visit, and no liveness."}],
     "kind": "para"},
    {"rows":
     [{"line": [{"code": "Effect4.Laws.Library.Semaphore.Profile"}],
       "label": "Module"}],
     "kind": "fields"},
    {"language": "lean",
     "kind": "code",
     "body":
     "∀ (s : Effect4.Semaphore.Model.State) (cursor : Nat),\n  And\n    (Iff (Eq (Effect4.Semaphore.Model.visit s cursor).snd Option.none)\n      (Or (Eq (Effect4.Semaphore.Model.free s) 0)\n        (∀ (u : Effect4.Semaphore.Model.Waiter),\n          List.instMembership.mem s.waiters u →\n            instLENat.le cursor u.stamp → instLTNat.lt (Effect4.Semaphore.Model.free s) u.need)))\n    (Eq (Effect4.Semaphore.Model.visit s cursor).snd Option.none →\n      Eq (Effect4.Semaphore.Model.visit s cursor).fst s)"}]},
  {"title": "queue-first-step-invariant",
   "kind": "part",
   "key": "claim:queue-first-step-invariant",
   "body":
   [{"line":
     [{"text":
       "One step of a first operation of the Queue's abstract model keeps the run invariant of the first profile: the profile, the buffer's bound, tidy, quiet at the run's signalled, and the two flags (the model's half of wait-registration-no-gap and of waiting-request-obligation-preserved; no program, no delivery of a signal and no liveness; decisions rows 219, 233, 255 and 275)"}],
     "kind": "para"},
    {"line":
     [{"text":
       "One step of a first operation keeps the run invariant. From every run of the invariant, the model's step by a first operation whose request keeps "},
      {"code": "Requested"},
      {"text":
       " leaves a run of the invariant. So the step keeps both flags. After it no taker stands ready without a signal. Each request that waited still waits, is the step's own, or is named by a signal."}],
     "kind": "para"},
    {"line":
     [{"text": "It is the model's half of "},
      {"code": "wait-registration-no-gap"},
      {"text": " and of "},
      {"code": "waiting-request-obligation-preserved"},
      {"text": ". Consumer: "},
      {"code": "first_run_inv"},
      {"text":
       ", and then the run-level law of the Queue's wrapper. The statement is of the model alone: no program, no delivery of a signal, no liveness and no fairness."}],
     "kind": "para"},
    {"rows":
     [{"line": [{"code": "Effect4.Laws.Library.Queue.Invariant"}],
       "label": "Module"}],
     "kind": "fields"},
    {"language": "lean",
     "kind": "code",
     "body":
     "∀ (r : Effect4.Queue.Model.Run) (op : Effect4.Queue.Model.Op),\n  Effect4.Queue.Model.FirstRunInv r →\n    Eq (Effect4.Queue.Model.firstOp op) Bool.true →\n      Effect4.Queue.Model.Requested r.s op →\n        Effect4.Queue.Model.FirstRunInv\n          (Effect4.Queue.Model.step Effect4.Queue.Model.Fault.none r op)"}]},
  {"title": "queue-first-run-flags",
   "kind": "part",
   "key": "claim:queue-first-run-flags",
   "body":
   [{"line":
     [{"text":
       "From the empty queue of a positive capacity both flags of the Queue's abstract model hold after every list of first operations whose requests keep their premises at each prefix (the bounded exploration's two flags at every length, on the first profile; decisions rows 219, 233, 255 and 275)"}],
     "kind": "para"},
    {"line":
     [{"text":
       "From the empty queue both flags hold after every list of first operations. The model's bounded exploration holds both flags to a fixed depth, over more operations. This statement holds them at every length, on the first profile. Consumer: the run-level law of the Queue's wrapper. It says nothing of "},
      {"code": "close"},
      {"text": " or "},
      {"code": "shutdown"},
      {"text": ", and nothing of a delivery."}],
     "kind": "para"},
    {"rows":
     [{"line": [{"code": "Effect4.Laws.Library.Queue.Invariant"}],
       "label": "Module"}],
     "kind": "fields"},
    {"language": "lean",
     "kind": "code",
     "body":
     "∀ (c : Nat) (ops : List Effect4.Queue.Model.Op),\n  Effect4.Queue.Model.FirstOps { s := { capacity := Option.some (instHAdd.hAdd c 1) } } ops →\n    And\n      (Eq\n        (List.foldl (Effect4.Queue.Model.step Effect4.Queue.Model.Fault.none)\n            { s := { capacity := Option.some (instHAdd.hAdd c 1) } } ops).ok\n        Bool.true)\n      (Eq\n        (List.foldl (Effect4.Queue.Model.step Effect4.Queue.Model.Fault.none)\n            { s := { capacity := Option.some (instHAdd.hAdd c 1) } } ops).named\n        Bool.true)"}]},
  {"title": "pool-select-takes-first",
   "kind": "part",
   "key": "claim:pool-select-takes-first",
   "body":
   [{"line":
     [{"text":
       "One selection of Pool's model takes the first waiters of the state that it finds, at most its count, and it changes the waiters alone (a helper of pool-wake-selection; one selection, no run and no liveness)"}],
     "kind": "para"},
    {"line":
     [{"text":
       "A selection takes the first waiters of the state that it finds, at most its count, and exactly those. The selected identities are a prefix of the waiters, in the order of enrolment. They are as many as the count, or every waiter where fewer wait. They leave the list, and nothing else changes: a wake reserves nothing. Consumer: the proposed claim "},
      {"code": "pool-wake-selection"},
      {"text": ". It states one selection, and nothing about a run."}],
     "kind": "para"},
    {"rows":
     [{"line": [{"code": "Effect4.Laws.Library.Pool.Profile"}],
       "label": "Module"}],
     "kind": "fields"},
    {"language": "lean",
     "kind": "code",
     "body":
     "∀ (s : Effect4.Pool.Model.State) (count : Nat),\n  And\n    (Eq\n      (instHAppendOfAppend.hAppend (Effect4.Pool.Model.select s count).snd\n        (Effect4.Pool.Model.select s count).fst.waiters)\n      s.waiters)\n    (And (Eq (Effect4.Pool.Model.select s count).snd.length (instMinNat.min count s.waiters.length))\n      (Eq (Effect4.Pool.Model.select s count).fst\n        { items := s.items, available := s.available, waiters := List.drop count s.waiters,\n          closing := s.closing, next := s.next }))"}]}]}