{"title": "Residual Program Typing",
 "producer":
 ["GENERATED by tools/Drivers/Semantics.lean (make gen-semantics); do not edit",
  "format: effect4-semantics-report v8",
  "command: make gen-semantics",
  "inputs: tools/ProofGraph/Registry.lean, tools/Tools/Semantics.lean, tools/Drivers/Semantics.lean, tools/Tools/SemanticsDisplay.lean, tools/Tools/SemanticsDocument.lean, tools/Tools/Document.lean, tools/Tools/Document/Json.lean, src/Effect4/Laws/Auto/Semantics.lean, Test/Counterexamples/REGISTER.md, docs/core/decisions.md, lean-toolchain"],
 "format": "effect4-document/1",
 "body":
 [{"line":
   [{"text": "TypedProg, the protocol-indexed judgment on residual programs. "},
    {"text": "20 claims: "},
    {"text": "19 "},
    {"status": "proved"},
    {"text": ", "},
    {"text": "1 "},
    {"status": "refuted"},
    {"text": "."}],
   "kind": "para"},
  {"title": "Residual program typing",
   "kind": "part",
   "key": "about:concept:residual-program-typing",
   "body":
   [{"line":
     [{"text":
       "This page explains residual program typing in Effect4. It covers how effectful programs denote typed interactions and why sequencing relies on explicit compatibility lemmas rather than unrestricted bind."}],
     "kind": "para"},
    {"title": "The runtime concept",
     "kind": "part",
     "key": "about:concept:residual-program-typing:runtime-concept",
     "body":
     [{"line":
       [{"text":
         "Effect programs structure asynchronous and stateful workflows by chaining operations, handling failures, and bracketing resource lifecycles. At runtime, these workflows yield control steps and await replies."}],
       "kind": "para"},
      {"line":
       [{"text":
         "Effect4 separates stored program IR from semantic execution. First-order stored syntax denotes residual programs that formalize operational continuations."}],
       "kind": "para"},
      {"line":
       [{"text":
         "Residual program typing certifies that every step of a residual program complies with protocol requirements and handles replies safely."}],
       "kind": "para"}]},
    {"title": "Literature foundations",
     "kind": "part",
     "key": "about:concept:residual-program-typing:literature",
     "body":
     [{"line":
       [{"text":
         "The concept connects to effect systems in ATTAPL ch. 3 (Henglein, Makholm, Niss), which statically track computational effects and regions."}],
       "kind": "para"},
      {"line":
       [{"text":
         "Protocol typing adapts the handler verification principles of de Vilhena and Pottier (2021). Continuations must accept all valid answers under extended worlds."}],
       "kind": "para"},
      {"line":
       [{"text":
         "The representation draws an analogy to Interaction Trees (Xia et al. 2020), where monadic programs interact through typed operation nodes."}],
       "kind": "para"}]},
    {"title": "What Effect4 keeps and what it cuts",
     "kind": "part",
     "key": "about:concept:residual-program-typing:adaptations-and-cuts",
     "body":
     [{"line":
       [{"text":
         "Effect4 keeps protocol-directed verification via the judgment "},
        {"code": "TypedProg"},
        {"text": " ("},
        {"code": "src/Effect4/Laws/Program/Typed/Residual.lean"},
        {"text":
         "). This inductive predicate types free-monad residual programs against worlds."}],
       "kind": "para"},
      {"line":
       [{"text":
         "Operation clauses enforce that continuations remain well-typed for every permitted answer at any future world accessible by "},
        {"code": "World.leHost"},
        {"text": "."}],
       "kind": "para"},
      {"line":
       [{"text":
         "Effect4 cuts stored closures from program syntax (decisions row 163). Function continuations exist solely in the semantic carrier "},
        {"code": "RProgram"},
        {"text": ", never in stored "},
        {"code": "Eff"},
        {"text": " trees."}],
       "kind": "para"},
      {"line":
       [{"text": "Importantly, "},
        {"code": "TypedProg"},
        {"text":
         " is not closed under unrestricted monadic bind (decisions row 148, "},
        {"code": "E4-TYPED-CE-030"},
        {"text": "). Control bracket markers like "},
        {"code": "unguard"},
        {"text": " carry exit values directly, breaking general bind typing."}],
       "kind": "para"},
      {"line":
       [{"text":
         "Effect4 replaces unrestricted bind with construct-specific compatibility lemmas such as "},
        {"code": "seq_typed"},
        {"text": " and "},
        {"code": "guardBind_typed"},
        {"text": " ("},
        {"code": "src/Effect4/Laws/Program/Typed/Seq.lean"},
        {"text": ")."}],
       "kind": "para"}]},
    {"title": "How to read the claims",
     "kind": "part",
     "key": "about:concept:residual-program-typing:reading-claims",
     "body":
     [{"line":
       [{"text":
         "The claims under this concept state that denotation produces well-typed residual programs and that control flow constructs compose without defect."}],
       "kind": "para"},
      {"line": [{"text": "Key properties to inspect:"}], "kind": "para"},
      {"lines":
       [[{"ref": "claim:denote-typed", "label": "`denote-typed`"},
         {"text":
          ": The denotation of an admitted program produces a well-typed residual program."}],
        [{"ref": "claim:seq-typed", "label": "`seq-typed`"},
         {"text":
          ": Sequential composition keeps residual typing when chaining valid success continuations."}],
        [{"ref": "claim:bind-closed", "label": "`bind-closed`"},
         {"text":
          ": Unrestricted bind closure is refuted by an explicit counterexample."}]],
       "kind": "items"},
      {"line":
       [{"text":
         "These claims show that certified program trees translate into valid operational models without assuming universal monadic composition."}],
       "kind": "para"}]}]},
  {"rows":
   [[[{"ref": "claim:instantiated-formation",
       "label": "instantiated-formation"}],
     [{"text": "compatibility"}],
     [{"status": "proved"}],
     [{"code": "Effect4.Program.rowTy_instantiated_formed"}],
     [{"text": "—"}]],
    [[{"ref": "claim:seq-typed", "label": "seq-typed"}],
     [{"text": "compatibility"}],
     [{"status": "proved"}],
     [{"code": "Effect4.Program.Typed.seq_typed"}],
     [{"text": "—"}]],
    [[{"ref": "claim:close-typed", "label": "close-typed"}],
     [{"text": "preservation"}],
     [{"status": "proved"}],
     [{"code": "Effect4.Program.Typed.close_typed"}],
     [{"text": "—"}]],
    [[{"ref": "claim:sound-at-app-signature",
       "label": "sound-at-app-signature"}],
     [{"text": "compatibility"}],
     [{"status": "proved"}],
     [{"code": "Effect4.Program.Denote.run_typed_app"}],
     [{"text": "—"}]],
    [[{"ref": "claim:straight-meaning-typed",
       "label": "straight-meaning-typed"}],
     [{"text": "fundamentalProperty"}],
     [{"status": "proved"}],
     [{"code": "Effect4.Program.Denote.meaning_typed"}],
     [{"text": "—"}]],
    [[{"ref": "claim:denote-typed", "label": "denote-typed"}],
     [{"text": "fundamentalProperty"}],
     [{"status": "proved"}],
     [{"code": "Effect4.Program.Typed.denotesTyped"}],
     [{"code": "E4-TYPED-CE-020"},
      {"text": ", "},
      {"code": "E4-TYPED-CE-021"},
      {"text": ", "},
      {"code": "E4-TYPED-CE-022"},
      {"text": ", "},
      {"code": "E4-TYPED-CE-023"},
      {"text": ", "},
      {"code": "E4-TYPED-CE-031"}]],
    [[{"ref": "claim:invocation-arm", "label": "invocation-arm"}],
     [{"text": "fundamentalProperty"}],
     [{"status": "proved"}],
     [{"code": "Effect4.Program.Typed.call_arm"}],
     [{"text": "—"}]],
    [[{"ref": "claim:rebuild-admission", "label": "rebuild-admission"}],
     [{"text": "compatibility"}],
     [{"status": "proved"}],
     [{"code": "Effect4.Program.Authoring.rebuild_spec"}],
     [{"text": "—"}]],
    [[{"ref": "claim:denote-typed-layer-free",
       "label": "denote-typed-layer-free"}],
     [{"text": "fundamentalProperty"}],
     [{"status": "proved"}],
     [{"code": "Effect4.Program.Typed.denotesTyped_of_layerFree"}],
     [{"text": "—"}]],
    [[{"ref": "claim:load-typed-layer-free", "label": "load-typed-layer-free"}],
     [{"text": "preservation"}],
     [{"status": "proved"}],
     [{"code": "Effect4.Program.Typed.loadsTyped_of_layerFree"}],
     [{"text": "—"}]],
    [[{"ref": "claim:provide-layer-arm", "label": "provide-layer-arm"}],
     [{"text": "compatibility"}],
     [{"status": "proved"}],
     [{"code": "Effect4.Program.Typed.provideLayerArm"}],
     [{"code": "E4-TYPED-CE-023"},
      {"text": ", "},
      {"code": "E4-TYPED-CE-031"}]],
    [[{"ref": "claim:load-typed", "label": "load-typed"}],
     [{"text": "preservation"}],
     [{"status": "proved"}],
     [{"code": "Effect4.Program.Typed.loadsTyped"}],
     [{"text": "—"}]],
    [[{"ref": "claim:load-typed-checked", "label": "load-typed-checked"}],
     [{"text": "preservation"}],
     [{"status": "proved"}],
     [{"code": "Effect4.Program.Typed.load_typed"}],
     [{"text": "—"}]],
    [[{"ref": "claim:bind-closed", "label": "bind-closed"}],
     [{"text": "compatibility"}],
     [{"status": "refuted"}],
     [{"code": "Test.Program.TypedProgBindRed.typedProg_not_bind_closed"}],
     [{"text": "—"}]],
    [[{"ref": "claim:guard-bind-typed", "label": "guard-bind-typed"}],
     [{"text": "compatibility"}],
     [{"status": "proved"}],
     [{"code": "Effect4.Program.Typed.guardBind_typed"}],
     [{"text": "—"}]],
    [[{"ref": "claim:on-failure-typed", "label": "on-failure-typed"}],
     [{"text": "compatibility"}],
     [{"status": "proved"}],
     [{"code": "Effect4.Program.Typed.catchGuard_typed"}],
     [{"text": "—"}]],
    [[{"ref": "claim:all-guard-typed", "label": "all-guard-typed"}],
     [{"text": "compatibility"}],
     [{"status": "proved"}],
     [{"code": "Effect4.Program.Typed.allGuard_typed"}],
     [{"text": "—"}]],
    [[{"ref": "claim:on-exit-typed", "label": "on-exit-typed"}],
     [{"text": "compatibility"}],
     [{"status": "proved"}],
     [{"code": "Effect4.Program.Typed.onExit_typed"}],
     [{"text": "—"}]],
    [[{"ref": "claim:scoped-body-substitution-boundary",
       "label": "scoped-body-substitution-boundary"}],
     [{"text": "compatibility"}],
     [{"status": "proved"}],
     [{"code": "Effect4.Program.Typed.scoped_body_substitution_boundary"}],
     [{"text": "—"}]],
    [[{"ref": "claim:admitted-source-lawful",
       "label": "admitted-source-lawful"}],
     [{"text": "compatibility"}],
     [{"status": "proved"}],
     [{"code": "Effect4.Program.Typed.lawfulSig_of_admitted"}],
     [{"code": "E4-TYPED-CE-041"}]]],
   "kind": "table",
   "headers": ["Claim", "Role", "Status", "Evidence", "Contested by"]},
  {"title": "instantiated-formation",
   "kind": "part",
   "key": "claim:instantiated-formation",
   "body":
   [{"line":
     [{"text":
       "Successful row template use checks instantiated map keys and deferred error columns"}],
     "kind": "para"},
    {"line":
     [{"code": "instantiated-formation"},
      {"text":
       ": a successful row use retains the actual bindings, the request's and then the binder term's ("},
      {"code": "bindTerm"},
      {"text":
       "), and strict formation of every substituted column. Typing consumes this through "},
      {"code": "rowTy"},
      {"text":
       ". This is a static property; it makes no host reply or execution claim."}],
     "kind": "para"},
    {"rows":
     [{"line": [{"code": "Effect4.Laws.Program.Template"}], "label": "Module"}],
     "kind": "fields"},
    {"language": "lean",
     "kind": "code",
     "body":
     "∀ {row : Effect4.Program.Row} {request : Effect4.Program.Ty} {use : Option Effect4.Program.TermUse}\n  {ty : Effect4.Program.EffTy},\n  Eq (Effect4.Program.rowTy row request use) (Option.some ty) →\n    Exists fun σ =>\n      Exists fun bindings =>\n        And\n          (Eq (Effect4.Program.Bounds.matchB List.nil row.request.normalize request.normalize)\n            (Option.some σ))\n          (And (Eq (Effect4.Program.bindTerm σ use) (Except.ok bindings))\n            (Effect4.Program.Formation.Formed\n              (Effect4.Program.Formation.instantiatedSites row bindings)))"}]},
  {"title": "seq-typed",
   "kind": "part",
   "key": "claim:seq-typed",
   "body":
   [{"line":
     [{"text":
       "The seqR compatibility lemma: denoteR sequences with typed continuations"}],
     "kind": "para"},
    {"line":
     [{"text": "The "},
      {"code": "seqR"},
      {"text": " compatibility lemma. A first program typed at "},
      {"code": "mid"},
      {"text": ", a value continuation typed at "},
      {"code": "ty"},
      {"text": " at every later world on every value that fits "},
      {"code": "mid"},
      {"text": "'s answer column, and equal error columns: the sequence "},
      {"code": "denoteR"},
      {"text": " builds is typed at "},
      {"code": "ty"},
      {"text":
       ". A failure of the first program skips the continuation and must fit "},
      {"code": "ty"},
      {"text":
       "'s error column, which the equal columns give. The instance of "},
      {"code": "seqGuard_typed"},
      {"text": " at "},
      {"code": "seqR"},
      {"text": "."}],
     "kind": "para"},
    {"rows":
     [{"line": [{"code": "Effect4.Laws.Program.Typed.Seq"}], "label": "Module"},
      {"line":
       [{"text": "ATTAPL"},
        {"text": ", "},
        {"text": "ch. 3, pp. 87–136"},
        {"text": " (adaptedResult)"}],
       "label": "Literature"}],
     "kind": "fields"},
    {"language": "lean",
     "kind": "code",
     "body":
     "∀ (root : Effect4.Program.Typed.ProgramSource) {w : Effect4.Program.Typed.World}\n  {mid ty : Effect4.Program.EffTy} {a : Effect4.Program.Sched.RProgram}\n  {k : Effect4.Machine.Val → Effect4.Program.Sched.RProgram},\n  Effect4.Program.Typed.TypedProg root w mid a →\n    (∀ (w' : Effect4.Program.Typed.World),\n        w.leHost w' →\n          ∀ (v : Effect4.Machine.Val),\n            Effect4.Program.Typed.Fits w' v mid.answer →\n              Effect4.Program.Typed.TypedProg root w' ty (k v)) →\n      Eq mid.error ty.error →\n        Effect4.Program.Typed.TypedProg root w ty\n          (Effects.Program.bind\n            (Effect4.Program.Sched.guardR Effect4.Program.Sched.GuardKind.onSuccess a)\n            (Effect4.Program.Sched.seqR k))"}]},
  {"title": "close-typed",
   "kind": "part",
   "key": "claim:close-typed",
   "body":
   [{"line":
     [{"text": "Closing a typed program with unguard preserves typing"}],
     "kind": "para"},
    {"line":
     [{"text": "Closing keeps the type. Closing a typed program with "},
      {"code": "unguard"},
      {"text":
       " is typed at the same type: every leaf becomes a closing marker carrying the leaf's exit."}],
     "kind": "para"},
    {"rows":
     [{"line": [{"code": "Effect4.Laws.Program.Typed.Seq"}], "label": "Module"},
      {"line":
       [{"text": "deVilhenaPottier2021"},
        {"text": ", "},
        {"text": "audit P8"},
        {"text": " (proofTechnique)"}],
       "label": "Literature"}],
     "kind": "fields"},
    {"language": "lean",
     "kind": "code",
     "body":
     "∀ (root : Effect4.Program.Typed.ProgramSource) {w : Effect4.Program.Typed.World}\n  {T : Effect4.Program.EffTy} {a : Effect4.Program.Sched.RProgram},\n  Effect4.Program.Typed.TypedProg root w T a →\n    ∀ (g : Effect4.Machine.ExitV → Effect4.Program.Sched.RProgram),\n      Effect4.Program.Typed.TypedProg root w T\n        (Effects.Program.bind a fun ex =>\n          Effects.Program.vis (Sum.inr (Effect4.Program.Sched.FiberOp.unguard ex)) g)"}]},
  {"title": "sound-at-app-signature",
   "kind": "part",
   "key": "claim:sound-at-app-signature",
   "body":
   [{"line":
     [{"text":
       "Meaning, loop and run soundness at an application's signature: any table, service declarations at fresh codes, by C3's reflection (R1)"}],
     "kind": "para"},
    {"line":
     [{"code": "run_typed"},
      {"text": " (the machine) at an application's signature (R1)."}],
     "kind": "para"},
    {"rows":
     [{"line": [{"code": "Effect4.Laws.Program.SoundAnySignature"}],
       "label": "Module"}],
     "kind": "fields"},
    {"language": "lean",
     "kind": "code",
     "body":
     "∀ (t : Effect4.Program.RowTable) (s : List (Prod Effect4.ServiceKey Effect4.Program.Ty)),\n  (∀ (entry : Prod Effect4.ServiceKey Effect4.Program.Ty),\n      List.instMembership.mem s entry → { rows := t }.FreshCode entry) →\n    ∀ (e : Effect4.Program.NativeEff) (ty : Effect4.Program.EffTy) (fuel : Nat),\n      Eq (Effect4.Program.Denote.Straight e) Bool.true →\n        Eq (Effect4.Program.effTy { rows := t, services := s }.signature List.nil e)\n            (Option.some ty) →\n          instLENat.le (Effect4.Program.Agreement.depth e) fuel →\n            instLENat.le (instHAdd.hAdd (instHMul.hMul 2 (Effect4.Program.Agreement.steps e)) 6)\n                fuel →\n              And (Eq (Effect4.Api.run e fuel).outcome Effect4.Api.Outcome.finished)\n                (Exists fun ex =>\n                  And (Eq (Effect4.Api.run e fuel).exit (Option.some ex))\n                    (Effect4.Program.Denote.ExitHasTy ty.answer ty.error\n                      (Effect4.Api.run e fuel).stores ex))"}]},
  {"title": "straight-meaning-typed",
   "kind": "part",
   "key": "claim:straight-meaning-typed",
   "body":
   [{"line":
     [{"text":
       "Typed straight programs return ExitHasTy from the empty environment and stores"}],
     "kind": "para"},
    {"line":
     [{"text":
       "A typed straight program's meaning has its type. From the empty stores, the exit is a valid value of the answer type or a cause inside the error type."}],
     "kind": "para"},
    {"rows":
     [{"line": [{"code": "Effect4.Laws.Program.MeaningSound"}],
       "label": "Module"}],
     "kind": "fields"},
    {"language": "lean",
     "kind": "code",
     "body":
     "∀ (e : Effect4.Program.NativeEff) (t : Effect4.Program.EffTy),\n  Eq (Effect4.Program.Denote.Straight e) Bool.true →\n    Eq (Effect4.Program.effTy Effect4.Program.nativeSignature List.nil e) (Option.some t) →\n      Effect4.Program.Denote.ExitHasTy t.answer t.error\n        (Effect4.Program.Denote.meaning e List.nil Effect4.Machine.Stores.empty).snd\n        (Effect4.Program.Denote.meaning e List.nil Effect4.Machine.Stores.empty).fst"}]},
  {"title": "denote-typed",
   "kind": "part",
   "key": "claim:denote-typed",
   "body":
   [{"line":
     [{"text":
       "The denotation of a checked program is TypedProg at its certificate (M5)"}],
     "kind": "para"},
    {"line":
     [{"text": "M5's fundamental property (decisions rows 148 and 349, "},
      {"code": "denotesTyped"},
      {"text":
       "): at every source whose layer references are well formed, a checked point denotes a program typed by the ambient judgment at every world whose service table is the source's and every row holding its requirement row. The arms by induction on fuel ("},
      {"code": "childDenotes_upto"},
      {"text": "), the layer family's by "},
      {"code": "provideLayerArm"},
      {"text": "."}],
     "kind": "para"},
    {"rows":
     [{"line": [{"code": "Effect4.Laws.Program.Typed.LayerArm"}],
       "label": "Module"},
      {"line":
       [{"text": "XiaEtAl2020"},
        {"text": ", "},
        {"text": "audit P37"},
        {"text": " (definitionUsed)"}],
       "label": "Literature"}],
     "kind": "fields"},
    {"language": "lean",
     "kind": "code",
     "body":
     "∀ (root : Effect4.Program.Typed.ProgramSource), Effect4.Program.Typed.DenotesTyped root"},
    {"line":
     [{"text": "Register record "},
      {"code": "E4-TYPED-CE-020"},
      {"text": " (REPAIRED)"}],
     "kind": "para"},
    {"language": "text",
     "kind": "code",
     "body":
     "| `E4-TYPED-CE-020` | REPAIRED 2026-10-01 (seat D2, merged `aabb1b5e`: `DenotesTyped` takes row 170's premise `layerRefsWF`, discharged at the load by `layerRefsWF_of_typeOf`); SEEDED 2026-10-01 (seat D2) | `DenotesTyped` is false at a root whose layer reference targets a reference | Codex's candidate (`docs/research/2026-10-01-landing/codex-second-eyes/2016-d1-review.md`): three `provideLayer`s of `Test.Program.TypedSplit.key` with unit bodies, the last `.ref [1,0,0]` to `.ref [0,0]`; the point `[1,1]` is `PointTyped` at `pure unit` through `Eff.expandIn`, the run's `.ref` arm answers `badShapeExit` (reading, not compiled) | decisions row 170: the premise `layerRefsWF` on `DenotesTyped`, discharged at the load from `typeOfProgram` |"},
    {"line":
     [{"text": "Register record "},
      {"code": "E4-TYPED-CE-021"},
      {"text": " (REPAIRED)"}],
     "kind": "para"},
    {"language": "text",
     "kind": "code",
     "body":
     "| `E4-TYPED-CE-021` | REPAIRED 2026-10-01 (seat D2, merged `aabb1b5e`: `PointTyped` carries the completed view, row 175 (a)); SEEDED 2026-10-01 (seat D2) | `DenotesTyped` is false at a point whose completed view holds an exit the world refuses, because `PointTyped` never reads `point.completed` | seat D2's witness: the corpus program `awaitFiber.value`, point `[1]`, env `[fiber 1]`, completed `[(1, success \"x\")]`, world `Γ 1 = pure nat`; `PointTyped` at `pure (exitOf nat never)`, the denotation `.pure (success (exitOk \"x\"))` refused | decisions row 175 (ruled): `PointTyped` carries the completed view |"},
    {"line":
     [{"text": "Register record "},
      {"code": "E4-TYPED-CE-022"},
      {"text": " (REPAIRED)"}],
     "kind": "para"},
    {"language": "text",
     "kind": "code",
     "body":
     "| `E4-TYPED-CE-022` | REPAIRED 2026-10-01 (seat D2, merged `aabb1b5e`: `DenotesTyped` ranges over worlds whose service table is the source's, row 175); SEEDED 2026-10-01 (seat D2) | `DenotesTyped` is false at a world whose service table differs from the checker's | seat D2's witness: `.service ⟨4,4⟩` (native carrier `nat`) at a world with `serviceTy := fun _ => none` and a context holding `str \"x\"` under the key | decisions row 175 (ruled): `DenotesTyped` ranges over worlds whose service table is the source's |"},
    {"line":
     [{"text": "Register record "},
      {"code": "E4-TYPED-CE-023"},
      {"text": " (REPAIRED)"}],
     "kind": "para"},
    {"language": "text",
     "kind": "code",
     "body":
     "| `E4-TYPED-CE-023` | REPAIRED 2026-10-02 (seat L: built layers answer the fiber-context image, decisions row 176 (b), `f8571cf0`, merged `9a2b7651`; the layer family's arm proved at every source, `provideLayerArm`, `8c9464b6`, merged `71b1c9c1`); SEEDED 2026-10-02 (seat L, `c1c05314`, merged `3f9c2a77`; D2's reserved id) | `DenotesTyped` holds at a typed `provideLayer` point whose memo lookup hits | `memoSrc`, `provideLayer (effect K (succeed 7)) false (succeed unit)` checked at `pure unit`: the hit answers a fiber-context image, which fits `Ty.context` and which the build's reader `Env.decode` refuses, so `addCurrentMemoMapR` answers `badShapeExit`; `old_memo_refuted : ¬ DenotesTyped memoSrc`, kernel-checked at `c1c05314` over the old helpers (`Test/Program/LayerDenotation.lean`; the history control `hit_image_refused_old` stays) | decisions row 176 (b) (ruled): a build answers `builtContext`, every reader is `Val.context?`; row 187 types the memo rows so a guard keeps the hit's type |"},
    {"line":
     [{"text": "Register record "},
      {"code": "E4-TYPED-CE-031"},
      {"text": " (REPAIRED)"}],
     "kind": "para"},
    {"language": "text",
     "kind": "code",
     "body":
     "| `E4-TYPED-CE-031` | REPAIRED 2026-10-02 (seat L, L1 `569d3d69`, merged `71b1c9c1`: `orDie` resolves its inner layer on both machines, `resolveLayerWith` and `denoteLayerWith`'s `orDie` arm; the controls `orDie_runs`, `chain_runs` and their reference twins); SEEDED 2026-10-02 (seat L, `c1c05314`, merged `3f9c2a77`) | `ProvideLayerArm` and `DenotesTyped` hold at a well-formed program with a layer reference under `orDie` | `orDieSrc`: `layerRefsWF` admits `orDie (ref t)` and the checker types the expansion, where the reference is its target's term, while the run compiled `orDie`'s inner term directly, the wrong shape at every fuel; `orDie_arm_refuted : ¬ ProvideLayerArm orDieSrc`, `orDie_denotes_refuted`, kernel-checked at `c1c05314` over the old arms | decisions row 185 (owner, 2026-10-02): `orDie` builds its inner layer as it resolves (`Layer.ts:3327-3328`, `self.build(memoMap, scope)`) |"}]},
  {"title": "invocation-arm",
   "kind": "part",
   "key": "claim:invocation-arm",
   "body":
   [{"line":
     [{"text":
       "An invocation of a checked definition block denotes TypedProg at the declared row: the body at its point, its type widened to the declaration (M5's arm, decisions row 328, G3)"}],
     "kind": "para"},
    {"line":
     [{"text": "An invocation (decisions row 328, goal G3; the arm of "},
      {"code": "denote-typed"},
      {"text":
       "): the counted step, then the definition's body at its path, its one variable the request's value. The checker types the invocation by the definition's declared row ("},
      {"code": "invoke_hasTy"},
      {"text":
       "), which the declaration's formation keeps closed: the request's value fits the declared request and the node's type is the declared columns ("},
      {"code": "rowTy_closed_some"},
      {"text": "). The body is typed at its point by the block's typing ("},
      {"code": "BodiesTyped"},
      {"text": "), one unit of fuel lighter ("},
      {"code": "Point.redirect"},
      {"text": "), and its type widens to the declared columns ("},
      {"code": "DefDecl.admits"},
      {"text": "). Its consumer is "},
      {"code": "perform_arm"},
      {"text": "."}],
     "kind": "para"},
    {"rows":
     [{"line": [{"code": "Effect4.Laws.Program.Typed.Denotation"}],
       "label": "Module"}],
     "kind": "fields"},
    {"language": "lean",
     "kind": "code",
     "body":
     "∀ {root : Effect4.Program.Typed.ProgramSource} {w : Effect4.Program.Typed.World}\n  {p : Effect4.Program.Point} {ty : Effect4.Program.EffTy}\n  {available : Effect4.Machine.Env.Requirement} {k : Nat} {r : Effect4.Program.Term} {f : Nat},\n  Eq p.fuel (instHAdd.hAdd f 1) →\n    Eq ((Effect4.Program.Node.eff root.program).at_ p.path)\n        (Option.some\n          (Effect4.Program.Node.eff\n            (Effect4.Program.Eff.perform (Effect4.Program.NativeOp.call k) r))) →\n      Effect4.Program.Typed.PointTyped root w p ty →\n        Eq w.serviceTy root.sig.serviceTy →\n          Effect4.Program.Typed.BodiesTyped root →\n            (∀ (c : Effect4.Program.NativeEff) (path : List Nat),\n                Eq ((Effect4.Program.Node.eff root.program).at_ path)\n                    (Option.some (Effect4.Program.Node.eff c)) →\n                  Effect4.Program.Typed.ChildDenotes root f c path) →\n              Effect4.Row.Subset ty.requires available →\n                Effect4.Program.Typed.AmbientProg root w available\n                  (Effect4.Program.Typed.AmbientPosition.result\n                    { fst := ty, snd := { fst := available, snd := available } }.fst\n                    { fst := ty, snd := { fst := available, snd := available } }.snd.fst\n                    { fst := ty, snd := { fst := available, snd := available } }.snd.snd)\n                  (Effect4.Program.Sched.denoteR root.program\n                    (Effect4.Program.Eff.perform (Effect4.Program.NativeOp.call k) r) p)"}]},
  {"title": "rebuild-admission",
   "kind": "part",
   "key": "claim:rebuild-admission",
   "body":
   [{"line":
     [{"text":
       "Successful rebuilding checks the exact candidate under the retained host table and row names (Built.rebuild)"}],
     "kind": "para"},
    {"line":
     [{"text":
       "Successful rebuilding retains the host setup and checks exactly the candidate. The returned "},
      {"code": "Built.admitted"},
      {"text": " certificate is indexed by those program and table fields."}],
     "kind": "para"},
    {"rows":
     [{"line": [{"code": "Effect4.Laws.Program.Author"}], "label": "Module"}],
     "kind": "fields"},
    {"language": "lean",
     "kind": "code",
     "body":
     "∀ {before after : Effect4.Api.Built} {candidate : Effect4.Api.Program},\n  Eq (before.rebuild candidate) (Except.ok after) →\n    And (Eq after.program candidate)\n      (And (Eq after.table before.table) (Eq after.rowNames before.rowNames))"}]},
  {"title": "denote-typed-layer-free",
   "kind": "part",
   "key": "claim:denote-typed-layer-free",
   "body":
   [{"line":
     [{"text":
       "M5 on the layer-free fragment: every arm but provideLayer's, assembled by induction on fuel"}],
     "kind": "para"},
    {"line":
     [{"text":
       "M5 on the layer-free fragment: a program none of whose nodes is a "},
      {"code": "provideLayer"},
      {"text":
       " satisfies the fundamental property; the layer family's arm cannot be reached there ("},
      {"code": "provideLayerArm_of_layerFree"},
      {"text": ")."}],
     "kind": "para"},
    {"rows":
     [{"line": [{"code": "Effect4.Laws.Program.Typed.Assembly"}],
       "label": "Module"},
      {"line":
       [{"text": "XiaEtAl2020"},
        {"text": ", "},
        {"text": "audit P37"},
        {"text": " (definitionUsed)"}],
       "label": "Literature"}],
     "kind": "fields"},
    {"language": "lean",
     "kind": "code",
     "body":
     "∀ (root : Effect4.Program.Typed.ProgramSource),\n  Effect4.Program.Typed.LayerFree root.program → Effect4.Program.Typed.DenotesTyped root"}]},
  {"title": "load-typed-layer-free",
   "kind": "part",
   "key": "claim:load-typed-layer-free",
   "body":
   [{"line":
     [{"text":
       "The typed load on the layer-free fragment: a checked program loads into J (M5's load connector, the marker premise discharged)"}],
     "kind": "para"},
    {"line":
     [{"text":
       "The typed load on the layer-free fragment: a checked program none of whose nodes is a "},
      {"code": "provideLayer"},
      {"text": " loads into "},
      {"code": "J"},
      {"text": " ("},
      {"code": "denotesTyped_of_layerFree"},
      {"text": ", then the load connector)."}],
     "kind": "para"},
    {"rows":
     [{"line": [{"code": "Effect4.Laws.Program.Typed.Commands.Finish"}],
       "label": "Module"}],
     "kind": "fields"},
    {"language": "lean",
     "kind": "code",
     "body":
     "∀ (root : Effect4.Program.Typed.ProgramSource) (rootTy : Effect4.Program.EffTy)\n  (fuel compileFuel : Nat),\n  Effect4.Program.Typed.LayerFree root.program →\n    Effect4.Program.Typed.LoadsTyped root rootTy fuel compileFuel"}]},
  {"title": "provide-layer-arm",
   "kind": "part",
   "key": "claim:provide-layer-arm",
   "body":
   [{"line":
     [{"text":
       "The layer family's arm: a layer build at an admitted layer point answers the built context at the layer's checked error type, and the provide protocol around it is typed (decisions rows 176 (b), 185-187)"}],
     "kind": "para"},
    {"line":
     [{"code": "ProvideLayerArm"},
      {"text":
       " holds at every source: the hypothesis the assembly was conditional on."}],
     "kind": "para"},
    {"rows":
     [{"line": [{"code": "Effect4.Laws.Program.Typed.LayerArm"}],
       "label": "Module"}],
     "kind": "fields"},
    {"language": "lean",
     "kind": "code",
     "body":
     "∀ (root : Effect4.Program.Typed.ProgramSource), Effect4.Program.Typed.ProvideLayerArm root"},
    {"line":
     [{"text": "Register record "},
      {"code": "E4-TYPED-CE-023"},
      {"text": " (REPAIRED)"}],
     "kind": "para"},
    {"language": "text",
     "kind": "code",
     "body":
     "| `E4-TYPED-CE-023` | REPAIRED 2026-10-02 (seat L: built layers answer the fiber-context image, decisions row 176 (b), `f8571cf0`, merged `9a2b7651`; the layer family's arm proved at every source, `provideLayerArm`, `8c9464b6`, merged `71b1c9c1`); SEEDED 2026-10-02 (seat L, `c1c05314`, merged `3f9c2a77`; D2's reserved id) | `DenotesTyped` holds at a typed `provideLayer` point whose memo lookup hits | `memoSrc`, `provideLayer (effect K (succeed 7)) false (succeed unit)` checked at `pure unit`: the hit answers a fiber-context image, which fits `Ty.context` and which the build's reader `Env.decode` refuses, so `addCurrentMemoMapR` answers `badShapeExit`; `old_memo_refuted : ¬ DenotesTyped memoSrc`, kernel-checked at `c1c05314` over the old helpers (`Test/Program/LayerDenotation.lean`; the history control `hit_image_refused_old` stays) | decisions row 176 (b) (ruled): a build answers `builtContext`, every reader is `Val.context?`; row 187 types the memo rows so a guard keeps the hit's type |"},
    {"line":
     [{"text": "Register record "},
      {"code": "E4-TYPED-CE-031"},
      {"text": " (REPAIRED)"}],
     "kind": "para"},
    {"language": "text",
     "kind": "code",
     "body":
     "| `E4-TYPED-CE-031` | REPAIRED 2026-10-02 (seat L, L1 `569d3d69`, merged `71b1c9c1`: `orDie` resolves its inner layer on both machines, `resolveLayerWith` and `denoteLayerWith`'s `orDie` arm; the controls `orDie_runs`, `chain_runs` and their reference twins); SEEDED 2026-10-02 (seat L, `c1c05314`, merged `3f9c2a77`) | `ProvideLayerArm` and `DenotesTyped` hold at a well-formed program with a layer reference under `orDie` | `orDieSrc`: `layerRefsWF` admits `orDie (ref t)` and the checker types the expansion, where the reference is its target's term, while the run compiled `orDie`'s inner term directly, the wrong shape at every fuel; `orDie_arm_refuted : ¬ ProvideLayerArm orDieSrc`, `orDie_denotes_refuted`, kernel-checked at `c1c05314` over the old arms | decisions row 185 (owner, 2026-10-02): `orDie` builds its inner layer as it resolves (`Layer.ts:3327-3328`, `self.build(memoMap, scope)`) |"}]},
  {"title": "load-typed",
   "kind": "part",
   "key": "claim:load-typed",
   "body":
   [{"line":
     [{"text":
       "M5: a lawful, checked, closed source with an empty requirement row loads into J"}],
     "kind": "para"},
    {"line":
     [{"text": "M5 ("},
      {"code": "loadsTyped"},
      {"text":
       "): a lawful, checked, closed source whose requirement row is empty loads into "},
      {"code": "J"},
      {"text": " at the initial world, at every fuel and compile budget."}],
     "kind": "para"},
    {"rows":
     [{"line": [{"code": "Effect4.Laws.Program.Typed.LayerArm"}],
       "label": "Module"}],
     "kind": "fields"},
    {"language": "lean",
     "kind": "code",
     "body":
     "∀ (root : Effect4.Program.Typed.ProgramSource) (rootTy : Effect4.Program.EffTy)\n  (fuel compileFuel : Nat), Effect4.Program.Typed.LoadsTyped root rootTy fuel compileFuel"}]},
  {"title": "load-typed-checked",
   "kind": "part",
   "key": "claim:load-typed-checked",
   "body":
   [{"line":
     [{"text":
       "The typed load for every checked program: M5 with no lawful-signature or closed-row premise"}],
     "kind": "para"},
    {"line":
     [{"text":
       "The typed load for a checked closed program: row 117's empty requirement row applies at the load. The source's lawful-signature premise is not read here."}],
     "kind": "para"},
    {"rows":
     [{"line": [{"code": "Effect4.Laws.Program.Typed.LayerArm"}],
       "label": "Module"}],
     "kind": "fields"},
    {"language": "lean",
     "kind": "code",
     "body":
     "∀ (root : Effect4.Program.Typed.ProgramSource) (rootTy : Effect4.Program.EffTy)\n  (fuel compileFuel : Nat),\n  Eq (Effect4.Program.typeOfProgram root.sig.signature root.program) (Option.some rootTy) →\n    Eq rootTy.requires Effect4.Machine.Env.Requirement.empty →\n      Exists fun w =>\n        Effect4.Program.Typed.MachineTyped root rootTy w\n          (Effect4.Program.Sched.loadR root.program fuel compileFuel)"}]},
  {"title": "bind-closed",
   "kind": "part",
   "key": "claim:bind-closed",
   "body":
   [{"line": [{"text": "TypedProg is closed under bind"}], "kind": "para"},
    {"line":
     [{"text": "Red control: "},
      {"code": "TypedProg"},
      {"text": " is not closed under bind. "},
      {"code": "closeAtNat"},
      {"text": " is typed at "},
      {"code": "nat"},
      {"text": ", "},
      {"code": "toUnit"},
      {"text": " is typed at "},
      {"code": "unit"},
      {"text":
       " on every exit at every later world, and their sequence is not typed at "},
      {"code": "unit"},
      {"text": ": the marker's exit must fit the current type."}],
     "kind": "para"},
    {"rows":
     [{"line": [{"code": "Test.Program.TypedProgBindRed"}], "label": "Module"},
      {"line":
       [{"text": "deVilhenaPottier2021"},
        {"text": ", "},
        {"text": "audit P8"},
        {"text": " (excludedFeature)"}],
       "label": "Literature"}],
     "kind": "fields"},
    {"language": "lean",
     "kind": "code",
     "body":
     "∀ (root : Effect4.Program.Typed.ProgramSource) (w : Effect4.Program.Typed.World),\n  Exists fun mid =>\n    Exists fun ty =>\n      Exists fun p =>\n        Exists fun k =>\n          And (Effect4.Program.Typed.TypedProg root w mid p)\n            (And\n              (∀ (w' : Effect4.Program.Typed.World),\n                w.leHost w' →\n                  ∀ (ex : Effect4.Machine.ExitV),\n                    Effect4.Program.Typed.ExitOk w' mid ex →\n                      Effect4.Program.Typed.TypedProg root w' ty (k ex))\n              (Not (Effect4.Program.Typed.TypedProg root w ty (Effects.Program.bind p k))))"},
    {"line":
     [{"text": "Register record "},
      {"code": "E4-TYPED-CE-030"},
      {"text": " (REPAIRED)"}],
     "kind": "para"},
    {"language": "text",
     "kind": "code",
     "body":
     "| `E4-TYPED-CE-030` | REPAIRED 2026-10-01 (seat D2, merged `aabb1b5e`: every guard shape has its compatibility lemma); SEEDED 2026-10-01 (coordinator; the red controls landed with decisions row 148, in the battery under the gate's ceiling) | `TypedProg` is closed under bind: a program typed at `mid` and a continuation typed at `ty` at every later world on every exit `ExitOk` admits at `mid` make a sequence typed at `ty` | `Test/Program/TypedProgBindRed.lean`: `typedProg_not_bind_closed` (`:32`; a closing marker's exit must fit the current type), `bind_not_typed` and `guard_bind_not_closed` (a first program whose only closing marker sits inside a guard body does not bind either); green control `seq_sample` | no bind rule: M5 sequences per construct (`seq_typed`, `src/Effect4/Laws/Program/Typed/Seq.lean:59`, with `close_typed`); the `onFailure`, `all` and `onExit` shapes beside it, landed by seat D2 (`catchGuard_typed`, `allGuard_typed`, `onExit_typed`, the general `guardBind_typed`; decisions row 148) |"}]},
  {"title": "guard-bind-typed",
   "kind": "part",
   "key": "claim:guard-bind-typed",
   "body":
   [{"line":
     [{"text":
       "The guard compatibility lemma: a guarded program bound into its arms is typed (the general form of seq_typed, row 148)"}],
     "kind": "para"},
    {"line":
     [{"text": "The guard compatibility lemma (the general form of "},
      {"code": "seq_typed"},
      {"text": ", decisions row 148): a first program typed at "},
      {"code": "mid"},
      {"text": ", a continuation typed at "},
      {"code": "ty"},
      {"text":
       " at every later world on every exit the guard's arm takes and "},
      {"code": "mid"},
      {"text": " admits, and every exit the arm does not take admitted at "},
      {"code": "ty"},
      {"text": ": the guarded sequence is typed at "},
      {"code": "ty"},
      {"text": ". Every guard "},
      {"code": "denoteR"},
      {"text": " builds has this shape ("},
      {"code": "guardR kind a"},
      {"text": ", bound to a continuation); the body closes by "},
      {"code": "close_typed"},
      {"text": "."}],
     "kind": "para"},
    {"rows":
     [{"line": [{"code": "Effect4.Laws.Program.Typed.Seq"}],
       "label": "Module"}],
     "kind": "fields"},
    {"language": "lean",
     "kind": "code",
     "body":
     "∀ (root : Effect4.Program.Typed.ProgramSource) {w : Effect4.Program.Typed.World}\n  {mid ty : Effect4.Program.EffTy} {kind : Effect4.Program.Sched.GuardKind}\n  {a : Effect4.Program.Sched.RProgram} {K : Effect4.Machine.ExitV → Effect4.Program.Sched.RProgram},\n  Effect4.Program.Typed.TypedProg root w mid a →\n    (∀ (w' : Effect4.Program.Typed.World),\n        w.leHost w' →\n          ∀ (ex : Effect4.Machine.ExitV),\n            Eq (kind.hasExitArm ex) Bool.true →\n              Effect4.Program.Typed.ExitOk w' mid ex →\n                Effect4.Program.Typed.TypedProg root w' ty (K ex)) →\n      (∀ (w' : Effect4.Program.Typed.World),\n          w.leHost w' →\n            ∀ (ex : Effect4.Machine.ExitV),\n              Effect4.Program.Typed.ExitOk w' mid ex →\n                Eq (kind.hasExitArm ex) Bool.false → Effect4.Program.Typed.ExitOk w' ty ex) →\n        Effect4.Program.Typed.TypedProg root w ty\n          (Effects.Program.bind (Effect4.Program.Sched.guardR kind a) K)"}]},
  {"title": "on-failure-typed",
   "kind": "part",
   "key": "claim:on-failure-typed",
   "body":
   [{"line":
     [{"text":
       "The onFailure shape (catchCause, catchIf, orDie, a finalizer's cleanup) is typed"}],
     "kind": "para"},
    {"line":
     [{"text": "The "},
      {"code": "onFailure"},
      {"text": " shape ("},
      {"code": "catchCause"},
      {"text": ", "},
      {"code": "catchIf"},
      {"text": ", "},
      {"code": "orDie"},
      {"text": ", a finalizer's cleanup): the continuation at every failure "},
      {"code": "mid"},
      {"text": " admits; a success skips it and must fit "},
      {"code": "ty"},
      {"text": "'s answer column, below which "},
      {"code": "mid"},
      {"text": "'s is."}],
     "kind": "para"},
    {"rows":
     [{"line": [{"code": "Effect4.Laws.Program.Typed.Seq"}],
       "label": "Module"}],
     "kind": "fields"},
    {"language": "lean",
     "kind": "code",
     "body":
     "∀ (root : Effect4.Program.Typed.ProgramSource) {w : Effect4.Program.Typed.World}\n  {mid ty : Effect4.Program.EffTy} {a : Effect4.Program.Sched.RProgram}\n  {K : Effect4.Machine.ExitV → Effect4.Program.Sched.RProgram},\n  Effect4.Program.Typed.TypedProg root w mid a →\n    Eq (mid.answer.subN ty.answer) Bool.true →\n      (∀ (w' : Effect4.Program.Typed.World),\n          w.leHost w' →\n            ∀\n              (c :\n                Effect4.Cause Effect4.Machine.Err Effect4.Machine.Defect Effect4.FiberId\n                  Effect4.Machine.Ann),\n              Effect4.Program.Typed.ExitOk w' mid (Effect4.Exit.failure c) →\n                Effect4.Program.Typed.TypedProg root w' ty (K (Effect4.Exit.failure c))) →\n        Effect4.Program.Typed.TypedProg root w ty\n          (Effects.Program.bind\n            (Effect4.Program.Sched.guardR Effect4.Program.Sched.GuardKind.onFailure a) K)"}]},
  {"title": "all-guard-typed",
   "kind": "part",
   "key": "claim:all-guard-typed",
   "body":
   [{"line":
     [{"text":
       "The all and onExit guard shapes (exit, matchCause, a finalizer's boundary) are typed"}],
     "kind": "para"},
    {"line":
     [{"text": "The "},
      {"code": "all"},
      {"text": " and "},
      {"code": "onExit"},
      {"text": " shapes ("},
      {"code": "exit"},
      {"text": ", "},
      {"code": "matchCause"},
      {"text":
       ", a finalizer's boundary): a guard whose arm takes every exit runs the continuation on every exit "},
      {"code": "mid"},
      {"text": " admits; nothing skips."}],
     "kind": "para"},
    {"rows":
     [{"line": [{"code": "Effect4.Laws.Program.Typed.Seq"}],
       "label": "Module"}],
     "kind": "fields"},
    {"language": "lean",
     "kind": "code",
     "body":
     "∀ (root : Effect4.Program.Typed.ProgramSource) {w : Effect4.Program.Typed.World}\n  {mid ty : Effect4.Program.EffTy} {kind : Effect4.Program.Sched.GuardKind},\n  (∀ (ex : Effect4.Machine.ExitV), Eq (kind.hasExitArm ex) Bool.true) →\n    ∀ {a : Effect4.Program.Sched.RProgram}\n      {K : Effect4.Machine.ExitV → Effect4.Program.Sched.RProgram},\n      Effect4.Program.Typed.TypedProg root w mid a →\n        (∀ (w' : Effect4.Program.Typed.World),\n            w.leHost w' →\n              ∀ (ex : Effect4.Machine.ExitV),\n                Effect4.Program.Typed.ExitOk w' mid ex →\n                  Effect4.Program.Typed.TypedProg root w' ty (K ex)) →\n          Effect4.Program.Typed.TypedProg root w ty\n            (Effects.Program.bind (Effect4.Program.Sched.guardR kind a) K)"}]},
  {"title": "on-exit-typed",
   "kind": "part",
   "key": "claim:on-exit-typed",
   "body":
   [{"line":
     [{"text":
       "The onExit shape onExitR builds: the body and the finalizer at their types"}],
     "kind": "para"},
    {"line":
     [{"text": "The "},
      {"code": "onExit"},
      {"text": " shape ("},
      {"code": "onExitR"},
      {"text": ", "},
      {"code": "DenoteR.lean"},
      {"text": "): the body typed at "},
      {"code": "b"},
      {"text":
       ", below the result in both columns, and the finalizer typed at "},
      {"code": "f"},
      {"text": " on every exit "},
      {"code": "b"},
      {"text":
       " admits, its error column below the result's: the region is typed at the result. The guard's arm takes every exit ("},
      {"code": "allGuard_typed"},
      {"text": "); each runs the finalizer's boundary ("},
      {"code": "finalizer_typed"},
      {"text": ")."}],
     "kind": "para"},
    {"rows":
     [{"line": [{"code": "Effect4.Laws.Program.Typed.Seq"}],
       "label": "Module"}],
     "kind": "fields"},
    {"language": "lean",
     "kind": "code",
     "body":
     "∀ (root : Effect4.Program.Typed.ProgramSource) {w : Effect4.Program.Typed.World}\n  {b f ty : Effect4.Program.EffTy} {body : Effect4.Program.Sched.RProgram}\n  {fin : Effect4.Machine.ExitV → Effect4.Program.Sched.RProgram} {flag : Bool},\n  Eq (b.answer.subN ty.answer) Bool.true →\n    Eq (b.error.subN ty.error) Bool.true →\n      Eq (f.error.subN ty.error) Bool.true →\n        Effect4.Program.Typed.TypedProg root w b body →\n          (∀ (w' : Effect4.Program.Typed.World),\n              w.leHost w' →\n                ∀ (ex : Effect4.Machine.ExitV),\n                  Effect4.Program.Typed.ExitOk w' b ex →\n                    Effect4.Program.Typed.TypedProg root w' f (fin ex)) →\n            Effect4.Program.Typed.TypedProg root w ty (Effect4.Program.Sched.onExitR body fin flag)"}]},
  {"title": "scoped-body-substitution-boundary",
   "kind": "part",
   "key": "claim:scoped-body-substitution-boundary",
   "body":
   [{"line":
     [{"text":
       "A restore site is one node that binds nothing, with its checked body at child 0: both saved choices run that one body in the node's environment; a typed point at the node denotes a typed program, its saved term evaluates to an image, and its body's point is typed at the node's type; a saved value passed as data keeps its choice and holds no handle; the mask's builder is the program's own expansion over bind (decisions rows 245, 246; the restore node's half of the claim; no agreement with a target)"}],
     "kind": "para"},
    {"line":
     [{"text": "The restore node's body (the claim "},
      {"code": "scoped-body-substitution-boundary"},
      {"text": ", for the mask; concept "},
      {"code": "residual-program-typing"},
      {"text": ", requirement R4; decisions rows 245 and 246)."}],
     "kind": "para"},
    {"line":
     [{"text":
       "Reach: the checker at any signature and path; the compile at a positive budget; the typed state at a source whose layer references are well formed and a world whose service table is the source's ("},
      {"code": "denotesTyped"},
      {"text":
       "). It does not establish agreement with a target. The claim's second half, a later constructor that binds a scope, has no statement: the mask adds none. Its consumers are the Queue's waiting wrapper and the Semaphore's protected permit, which descend into a restore site's body by "},
      {"code": "bodyTyped"},
      {"text": "."}],
     "kind": "para"},
    {"rows":
     [{"line": [{"code": "Effect4.Laws.Program.Typed.Mask"}],
       "label": "Module"}],
     "kind": "fields"},
    {"language": "lean",
     "kind": "code",
     "body": "Effect4.Program.Typed.RestoreBodyBoundary"}]},
  {"title": "admitted-source-lawful",
   "kind": "part",
   "key": "claim:admitted-source-lawful",
   "body":
   [{"line":
     [{"text":
       "An admitted program's signature, its row table and its service declarations, is lawful: program admission runs admitSig (the bridge from admission to the typed state)"}],
     "kind": "para"},
    {"line":
     [{"text": "The bridge (proved; claim "},
      {"code": "admitted-source-lawful"},
      {"text": "). An admitted program's signature is lawful: admission ran "},
      {"code": "admitSig"},
      {"text": " (decisions row 21), and "},
      {"code": "admitSig_ok_iff"},
      {"text": " reads its "},
      {"code": "ok"},
      {"text": " as "},
      {"code": "LawfulSig"},
      {"text": ". "},
      {"code": "E4-TYPED-CE-041"},
      {"text":
       "'s three witnesses, which the table-indexed admission admitted, are refused now ("},
      {"code": "Test/Counterexamples/Program/AdmissionUnserved.lean"},
      {"text": ")."}],
     "kind": "para"},
    {"rows":
     [{"line": [{"code": "Effect4.Laws.Program.Typed.AdmittedSource"}],
       "label": "Module"}],
     "kind": "fields"},
    {"language": "lean",
     "kind": "code",
     "body":
     "∀ {program : Effect4.Program.NativeEff} {app : Effect4.Program.SigApp}\n  (a : Effect4.Program.AdmittedProgram program app), Effect4.Program.LawfulSig app"},
    {"line":
     [{"text": "Register record "},
      {"code": "E4-TYPED-CE-041"},
      {"text": " (REPAIRED)"}],
     "kind": "para"},
    {"language": "text",
     "kind": "code",
     "body":
     "| `E4-TYPED-CE-041` | REPAIRED 2026-10-04 (seat S, branch `seat/sigapp`: decisions row 21's slice, step 2; `lawfulSig_of_admitted` has no premise, `[propext, Quot.sound]`); SEEDED 2026-10-04 (Claude, the Σ_app slice survey; kernel-checked by `decide +kernel`) | A program the API admits denotes a lawful source: `AdmittedProgram program table` implies `LawfulSig ⟨table, []⟩`, the premise of M5–M7 (`ProgramSource.lawful`) | `Test/Counterexamples/Program/AdmissionUnserved.lean`, one witness per clause the API did not check: a row requiring the key at service code 30, which no built-in carrier serves, performed by the program; a row whose answer mentions an unbound parameter; a parameter under a union head. Each was admitted by `admitProgram` and refused by `admitSig`. Repaired: `admitProgram` refuses each with the refusal `admitSig` gives (`refused`: `.signature (.unservedKey 0 appKey)`; `refused_unscoped`: `.signature (.row 0 .notWellScoped)`; `refused_union`: `.signature (.row 0 (.templateNotAdmissible \"request\"))`; `decide +kernel`), `not_lawful` stays, and each old acceptance is a red control under `#guard_msgs (error)`; the green controls admit clause 1's program once the application declares the key's carrier (`admitted_served`) and type a read of the declared service at its carrier (`admitted_reads_declared`, against `refused_reads_undeclared`) | decisions row 21's slice, step 2 (`docs/research/2026-10-04-claude-lead/sigapp-slice-plan.md`): program admission runs the signature's located refusal (`admitSig`, `src/Effect4/Program/SigApp.lean`) at `AdmittedProgram program app`, whose certificate holds `admitSig app = .ok ()`; the bridge `lawfulSig_of_admitted` is `admitSig_ok_iff` read off that field, and the premise `AdmissionGap` is deleted |"}]}]}