{"title": "Scope Lifetime & Finalization", "producer": ["GENERATED by tools/Drivers/Semantics.lean (make gen-semantics); do not edit", "format: effect4-semantics-report v8", "command: make gen-semantics", "inputs: tools/ProofGraph/Registry.lean, tools/Tools/Semantics.lean, tools/Drivers/Semantics.lean, tools/Tools/SemanticsDisplay.lean, tools/Tools/SemanticsDocument.lean, tools/Tools/Document.lean, tools/Tools/Document/Json.lean, src/Effect4/Laws/Auto/Semantics.lean, Test/Counterexamples/REGISTER.md, docs/core/decisions.md, lean-toolchain"], "format": "effect4-document/1", "body": [{"line": [{"text": "Lifetimes, finalizer registration, and LIFO unwinding. "}, {"text": "16 claims: "}, {"text": "15 "}, {"status": "proved"}, {"text": ", "}, {"text": "1 "}, {"status": "goal"}, {"text": "."}], "kind": "para"}, {"title": "Scope lifetime and finalization", "kind": "part", "key": "about:concept:scope-lifetime-finalization", "body": [{"line": [{"text": "This page explains scope lifetime and finalization in Effect4. It covers how resources are registered, how scopes close idempotently in reverse order, and how uninterruptible masks protect cleanup execution."}], "kind": "para"}, {"title": "The runtime concept", "kind": "part", "key": "about:concept:scope-lifetime-finalization:runtime-concept", "body": [{"line": [{"text": "Effect programs allocate managed resources such as database connections, worker threads, and file descriptors within scopes. In Effect rc.112, a scope guarantees cleanup upon normal exit or failure."}], "kind": "para"}, {"line": [{"text": "Effect4 models scopes as explicit containers in "}, {"code": "Scope"}, {"text": " ("}, {"code": "src/Effect4/Machine/Scope.lean"}, {"text": "). Each scope maintains an insertion-ordered table of registered finalizers."}], "kind": "para"}, {"line": [{"text": "Closing a scope executes registered cleanup routines to ensure that allocated resources do not leak."}], "kind": "para"}]}, {"title": "Literature foundations", "kind": "part", "key": "about:concept:scope-lifetime-finalization:literature", "body": [{"line": [{"text": "The metatheory adapts region-based resource management from ATTAPL ch. 3 (Henglein, Makholm, Niss). In that framework, resource lifecycles align with structured computational regions."}], "kind": "para"}, {"line": [{"text": "Stack unwinding and abnormal exit handling adapt Harper (PFPL ch. 28). Control stacks manage cleanup frames during evaluation and failure unwinding."}], "kind": "para"}]}, {"title": "What Effect4 keeps and what it cuts", "kind": "part", "key": "about:concept:scope-lifetime-finalization:adaptations-and-cuts", "body": [{"line": [{"text": "Effect4 keeps dynamic scope allocation and insertion-ordered finalization tables. It models scope presence in the world using "}, {"code": "ScopeLive"}, {"text": " ("}, {"code": "src/Effect4/Laws/Program/Typed/World.lean"}, {"text": ")."}], "kind": "para"}, {"line": [{"text": "Under decisions row 156 ("}, {"code": "E4-RUN-CE-001"}, {"text": "), Effect4 enforces state-first unwinding:"}], "kind": "para"}, {"lines": [[{"text": "The scope transitions to closed before running any finalizer."}], [{"text": "Re-entrant registrations on a closing scope execute immediately."}], [{"text": "Finalizers run in strict reverse registration order ("}, {"code": "closeOrder_eq"}, {"text": ", "}, {"code": "E4-RUN-CE-002"}, {"text": ")."}], [{"text": "Closing an already closed scope is idempotent and returns without re-executing cleanup ("}, {"code": "close_twice"}, {"text": ", "}, {"code": "E4-RUN-CE-003"}, {"text": ")."}]], "kind": "items"}, {"line": [{"text": "Effect4 cuts operations on absent scopes ("}, {"code": "E4-SCHED-CE-020"}, {"text": "). Operating on a missing scope handle halts the machine because dangling handles are invalid. Defect transmission is restricted by "}, {"code": "ShapeFree"}, {"text": " (decisions row 152)."}], "kind": "para"}, {"line": [{"text": "Uninterruptible masks protect cleanup execution by saving the fiber's interruptibility flag and restoring it on region exit (decisions rows 227 and 244)."}], "kind": "para"}]}, {"title": "How to read the claims", "kind": "part", "key": "about:concept:scope-lifetime-finalization:reading-claims", "body": [{"line": [{"text": "The claims under this concept state that resource cleanup executes in predictable order without double execution or leaks."}], "kind": "para"}, {"line": [{"text": "Key properties to inspect:"}], "kind": "para"}, {"lines": [[{"ref": "claim:close-order-eq", "label": "`close-order-eq`"}, {"text": ": Finalizers execute in strict reverse registration order."}], [{"ref": "claim:close-twice", "label": "`close-twice`"}, {"text": ": Applying close repeatedly is idempotent."}], [{"ref": "claim:saved-mask-restoration", "label": "`saved-mask-restoration`"}, {"text": ": An uninterruptible mask restores the previous interruptibility flag on exit."}]], "kind": "items"}, {"line": [{"text": "These claims show that scopes release resources deterministically across all exit paths."}], "kind": "para"}]}]}, {"rows": [[[{"ref": "claim:finalizer-starts-bounded", "label": "finalizer-starts-bounded"}], [{"text": "preservation"}], [{"status": "proved"}], [{"code": "Effect4.Program.FinalizerRun.starts_le_pushes"}]], [[{"ref": "claim:once-placed-finalizer", "label": "once-placed-finalizer"}], [{"text": "preservation"}], [{"status": "goal"}], [{"code": "Effect4.Program.FinalizerRun.once_placed_pushes_once"}]], [[{"ref": "claim:close-idempotent", "label": "close-idempotent"}], [{"text": "preservation"}], [{"status": "proved"}], [{"code": "Effect4.Scope.close_idempotent"}]], [[{"ref": "claim:close-twice", "label": "close-twice"}], [{"text": "preservation"}], [{"status": "proved"}], [{"code": "Effect4.Scope.close_twice"}]], [[{"ref": "claim:close-order-eq", "label": "close-order-eq"}], [{"text": "inversion"}], [{"status": "proved"}], [{"code": "Effect4.Scope.closeOrder_eq"}]], [[{"ref": "claim:close-reentrant-add", "label": "close-reentrant-add"}], [{"text": "preservation"}], [{"status": "proved"}], [{"code": "Effect4.Scope.close_reentrant_add"}]], [[{"ref": "claim:close-seq-protocol", "label": "close-seq-protocol"}], [{"text": "fundamentalProperty"}], [{"status": "proved"}], [{"code": "Effect4.Program.Typed.closeSeqProtocol"}]], [[{"ref": "claim:saved-mask-restoration", "label": "saved-mask-restoration"}], [{"text": "preservation"}], [{"status": "proved"}], [{"code": "Effect4.Program.Typed.saved_mask_restoration"}]], [[{"ref": "claim:saved-mask-pop-discipline", "label": "saved-mask-pop-discipline"}], [{"text": "preservation"}], [{"status": "proved"}], [{"code": "Effect4.Machine.saved_mask_pop_discipline"}]], [[{"ref": "claim:saved-mask-chain-runs", "label": "saved-mask-chain-runs"}], [{"text": "preservation"}], [{"status": "proved"}], [{"code": "Effect4.Program.compiled_mask_chain_runs"}]], [[{"ref": "claim:saved-mask-region-bracket", "label": "saved-mask-region-bracket"}], [{"text": "preservation"}], [{"status": "proved"}], [{"code": "Effect4.Program.compiled_region_bracket"}]], [[{"ref": "claim:stepped-fiber-live", "label": "stepped-fiber-live"}], [{"text": "inversion"}], [{"status": "proved"}], [{"code": "Effect4.Program.stepped_live"}]], [[{"ref": "claim:pool-return-front", "label": "pool-return-front"}], [{"text": "inversion"}], [{"status": "proved"}], [{"code": "Effect4.Pool.Model.giveBack_front"}]], [[{"ref": "claim:pool-return-once", "label": "pool-return-once"}], [{"text": "inversion"}], [{"status": "proved"}], [{"code": "Effect4.Pool.Model.giveBack_once"}]], [[{"ref": "claim:pool-close-refuses", "label": "pool-close-refuses"}], [{"text": "inversion"}], [{"status": "proved"}], [{"code": "Effect4.Pool.Model.close_refuses"}]], [[{"ref": "claim:pool-drain-waits", "label": "pool-drain-waits"}], [{"text": "inversion"}], [{"status": "proved"}], [{"code": "Effect4.Pool.Model.drain_waits"}]]], "kind": "table", "headers": ["Claim", "Role", "Status", "Evidence"]}, {"title": "finalizer-starts-bounded", "kind": "part", "key": "claim:finalizer-starts-bounded", "body": [{"line": [{"text": "Every native decision prefix starts an onExit finalizer no more often than it pushes that source's finalizer frame; arbitrary program, table and budget; no progress, source uniqueness or cleanup-log claim"}], "kind": "para"}, {"line": [{"text": "Finalizer starts spend recorded pushes, retaining any unspent stack credits. Every native decision prefix satisfies the bound."}], "kind": "para"}, {"rows": [{"line": [{"code": "Effect4.Laws.Program.FinalizerRun"}], "label": "Module"}], "kind": "fields"}, {"language": "lean", "kind": "code", "body": "∀ (p : Effect4.Program.NativeEff) (table : Effect4.Program.RowTable) (cf : Nat)\n (m : Effect4.Program.NativeMachine) (q : List Nat),\n Effect4.Program.Guard.Reachable p table cf m →\n instLENat.le\n (List.countP (Effect4.Program.FinalizerRun.startedAt q)\n (m.trace\n (Effect4.Prim Effect4.Program.EffName Effect4.Program.EffThunk Effect4.Machine.Val\n Effect4.Machine.Err Effect4.Machine.Defect Effect4.FiberId Effect4.Machine.Ann)\n (Effect4.FrameFiber Effect4.Program.EffName Effect4.Program.EffThunk Effect4.Machine.Val\n Effect4.Machine.Err Effect4.Machine.Defect Effect4.FiberId Effect4.Machine.Ann)\n (Effect4.FrameEvent Effect4.Program.EffName Effect4.Program.EffThunk Effect4.Machine.Val\n Effect4.Machine.Err Effect4.Machine.Defect Effect4.FiberId Effect4.Machine.Ann)))\n (List.countP (Effect4.Program.FinalizerRun.registeredAt q)\n (m.trace\n (Effect4.Prim Effect4.Program.EffName Effect4.Program.EffThunk Effect4.Machine.Val\n Effect4.Machine.Err Effect4.Machine.Defect Effect4.FiberId Effect4.Machine.Ann)\n (Effect4.FrameFiber Effect4.Program.EffName Effect4.Program.EffThunk Effect4.Machine.Val\n Effect4.Machine.Err Effect4.Machine.Defect Effect4.FiberId Effect4.Machine.Ann)\n (Effect4.FrameEvent Effect4.Program.EffName Effect4.Program.EffThunk Effect4.Machine.Val\n Effect4.Machine.Err Effect4.Machine.Defect Effect4.FiberId Effect4.Machine.Ann)))"}]}, {"title": "once-placed-finalizer", "kind": "part", "key": "claim:once-placed-finalizer", "body": [{"line": [{"text": "A once-placed source pushes its finalizer frame at most once across every fiber of a native decision prefix; no progress or log-writer claim"}], "kind": "para"}, {"line": [{"text": "Control-source uniqueness obligation of the at-most-once claim. A once-placed source pushes its finalizer frame at most once across all fibers. Consumer: the atomic cleanup-log claim. It supplies no finalizer progress."}], "kind": "para"}, {"rows": [{"line": [{"code": "Effect4.Laws.Program.FinalizerRun"}], "label": "Module"}], "kind": "fields"}, {"language": "lean", "kind": "code", "body": "∀ (p : Effect4.Program.NativeEff) (table : Effect4.Program.RowTable) (cf : Nat)\n (m : Effect4.Program.NativeMachine) (q : List Nat),\n Eq (Effect4.Program.OncePlaced (Effect4.Program.Node.eff p) q) Bool.true →\n Effect4.Program.Guard.Reachable p table cf m →\n instLENat.le\n (List.countP (Effect4.Program.FinalizerRun.registeredAt q)\n (m.trace\n (Effect4.Prim Effect4.Program.EffName Effect4.Program.EffThunk Effect4.Machine.Val\n Effect4.Machine.Err Effect4.Machine.Defect Effect4.FiberId Effect4.Machine.Ann)\n (Effect4.FrameFiber Effect4.Program.EffName Effect4.Program.EffThunk Effect4.Machine.Val\n Effect4.Machine.Err Effect4.Machine.Defect Effect4.FiberId Effect4.Machine.Ann)\n (Effect4.FrameEvent Effect4.Program.EffName Effect4.Program.EffThunk Effect4.Machine.Val\n Effect4.Machine.Err Effect4.Machine.Defect Effect4.FiberId Effect4.Machine.Ann)))\n 1"}]}, {"title": "close-idempotent", "kind": "part", "key": "claim:close-idempotent", "body": [{"line": [{"text": "Closing an already-closed scope returns void without re-running finalizers"}], "kind": "para"}, {"line": [{"text": "Closing an already-closed scope returns it without running a finalizer. census: scope.close-state-first"}], "kind": "para"}, {"rows": [{"line": [{"code": "Effect4.Machine.Scope"}], "label": "Module"}, {"line": [{"text": "PFPL"}, {"text": ", "}, {"text": "ch. 28, §28.1, p. 261"}, {"text": " (adaptedResult)"}], "label": "Literature"}], "kind": "fields"}, {"language": "lean", "kind": "code", "body": "∀ {κ φ : Type u} {β : Type v} {ε δ ι α : Type u}\n (run : φ → Effect4.Exit β ε δ ι α → Effect4.Exit Unit ε δ ι α)\n (self : Effect4.Scope κ φ β ε δ ι α) (exit : Effect4.Exit β ε δ ι α),\n Eq self.isClosed Bool.true →\n Eq (Effect4.Scope.close run self exit) { fst := self, snd := Effect4.Exit.void }"}]}, {"title": "close-twice", "kind": "part", "key": "claim:close-twice", "body": [{"line": [{"text": "A second close runs nothing"}], "kind": "para"}, {"line": [{"text": "A second close runs nothing. census: scope.close-state-first"}], "kind": "para"}, {"rows": [{"line": [{"code": "Effect4.Machine.Scope"}], "label": "Module"}], "kind": "fields"}, {"language": "lean", "kind": "code", "body": "∀ {κ φ : Type u} {β : Type v} {ε δ ι α : Type u}\n (run : φ → Effect4.Exit β ε δ ι α → Effect4.Exit Unit ε δ ι α)\n (self : Effect4.Scope κ φ β ε δ ι α) (first second : Effect4.Exit β ε δ ι α),\n Eq (Effect4.Scope.close run (Effect4.Scope.close run self first).fst second)\n { fst := (Effect4.Scope.close run self first).fst, snd := Effect4.Exit.void }"}]}, {"title": "close-order-eq", "kind": "part", "key": "claim:close-order-eq", "body": [{"line": [{"text": "Scope finalizers run in reverse registration order (LIFO)"}], "kind": "para"}, {"line": [{"text": "Finalizers are materialised in insertion order and iterated backwards. census: scope.close-lifo"}], "kind": "para"}, {"rows": [{"line": [{"code": "Effect4.Machine.Scope"}], "label": "Module"}, {"line": [{"text": "ATTAPL"}, {"text": ", "}, {"text": "ch. 3, pp. 87–136"}, {"text": " (analogy)"}], "label": "Literature"}], "kind": "fields"}, {"language": "lean", "kind": "code", "body": "∀ {κ φ : Type u} {β : Type v} {ε δ ι α : Type u} (self : Effect4.Scope κ φ β ε δ ι α),\n Eq self.closeOrder (List.map Prod.snd self.finalizers).reverse"}]}, {"title": "close-reentrant-add", "kind": "part", "key": "claim:close-reentrant-add", "body": [{"line": [{"text": "Re-entrant finalizer addition observes closed state immediately"}], "kind": "para"}, {"line": [{"text": "The sharp form of \"state before finalizers\": a finalizer that re-enters the scope while it closes sees a "}, {"code": "Closed"}, {"text": " scope, so its own registration runs immediately with the closing exit rather than being recorded. census: rule.scope-close-lifo-state-first"}], "kind": "para"}, {"rows": [{"line": [{"code": "Effect4.Machine.Scope"}], "label": "Module"}], "kind": "fields"}, {"language": "lean", "kind": "code", "body": "∀ {κ φ : Type u} {β : Type v} {ε δ ι α : Type u} [inst : DecidableEq κ]\n (run : φ → Effect4.Exit β ε δ ι α → Effect4.Exit Unit ε δ ι α)\n (self : Effect4.Scope κ φ β ε δ ι α) (exit : Effect4.Exit β ε δ ι α) (key : κ) (finalizer : φ),\n Eq self.isClosed Bool.false →\n Eq (Effect4.Scope.addExit run (self.closeState exit) key finalizer)\n { fst := self.closeState exit, snd := run finalizer exit }"}]}, {"title": "close-seq-protocol", "kind": "part", "key": "claim:close-seq-protocol", "body": [{"line": [{"text": "The sequential close walk meets the ambient iterator protocol at one row for admitted finalizers"}], "kind": "para"}, {"line": [{"text": "A typed walk frame has its protocol: coinduction from the invariant."}], "kind": "para"}, {"rows": [{"line": [{"code": "Effect4.Laws.Program.Typed.Commands.Clauses.Close"}], "label": "Module"}, {"line": [{"text": "deVilhenaPottier2021"}, {"text": ", "}, {"text": "audit P8"}, {"text": " (adaptedResult)"}], "label": "Literature"}], "kind": "fields"}, {"language": "lean", "kind": "code", "body": "∀ {root : Effect4.Program.Typed.ProgramSource} {w : Effect4.Program.Typed.World}\n {row : Effect4.Machine.Env.Requirement} {tin tout : Effect4.Program.EffTy}\n {name : Effect4.Program.EffName},\n Effect4.Program.Typed.CloseSeqTyped root\n { fst := w,\n snd :=\n { fst := row,\n snd := { fst := row, snd := { fst := tin, snd := { fst := tout, snd := name } } } } } →\n Effect4.Program.Typed.AmbientIteratorProtocol root w row row tin tout name"}]}, {"title": "saved-mask-restoration", "kind": "part", "key": "claim:saved-mask-restoration", "body": [{"line": [{"text": "The mask's law at the boundaries of regions, on the frame machine: the getter masks and answers the image of the entry flag; a restore site at a true bit is the interruptible region over its body, and at a false bit it is its body's own code; a region's entry sets its own flag at every fiber and saves the earlier flag exactly when it changes it; the saved frame's pass returns that flag on every exit, and with a cause pending an exit that leaves the fiber interruptible fails there with it (decisions rows 227, 244 to 246; no progress, nothing about a module, and no statement for a region that changes no flag)"}], "kind": "para"}, {"line": [{"text": "The mask's law at the boundaries of regions (the claim "}, {"code": "saved-mask-restoration"}, {"text": "; concept "}, {"code": "scope-lifetime-finalization"}, {"text": ", requirement R11; decisions rows 227 and 244 to 246)."}], "kind": "para"}, {"line": [{"text": "Reach: the frame machine at the program's interpreter, any completed view, any fiber and any machine; the compile at a positive budget; both saved bits; any exit. It does not establish progress, and it names no module that uses the mask. It does not state that a region which changes no flag ends with its entry flag: such a region pushes no frame, and its exit flag is what its body left (the module's head; the receipt's open part). The reference machine's clause is related to the frame's by the simulation ("}, {"code": "evaluate_rel"}, {"text": "'s cases "}, {"code": "actMask"}, {"text": " and "}, {"code": "actGetInterruptible"}, {"text": ", "}, {"code": "Laws/Program/Simulation/Evaluate.lean"}, {"text": "), and it keeps the typed state ("}, {"code": "clause_mask"}, {"text": ", "}, {"code": "clause_getInterruptible"}, {"text": "). Its consumers are the Queue's waiting wrapper and the Semaphore's protected permit."}], "kind": "para"}, {"rows": [{"line": [{"code": "Effect4.Laws.Program.Typed.Mask"}], "label": "Module"}], "kind": "fields"}, {"language": "lean", "kind": "code", "body": "Effect4.Program.Typed.MaskRestoration"}]}, {"title": "saved-mask-pop-discipline", "kind": "part", "key": "claim:saved-mask-pop-discipline", "body": [{"line": [{"text": "At one fixed base bit, the frame machine keeps the chain of restoring frames on a fiber's stack: FrameFiber.popFrom from an empty scratch stack, getCont, Machine.frameExitState and the entry of each region keep it, and two fibers with one base and one stack have one flag (a local law at every demand, skip flag and carried cause; no statement of a run, of a completed exit, of cleanup or of delivery)"}], "kind": "para"}, {"line": [{"text": "The saved mask's chain through a pop of the stack (the proposed registry claim "}, {"code": "saved-mask-pop-discipline"}, {"text": "; concept "}, {"code": "scope-lifetime-finalization"}, {"text": ", requirement R11). It is a step of the open run-level half of "}, {"code": "saved-mask-restoration"}, {"text": ". Each field cites one theorem of this module, so its status is derived from theirs ("}, {"code": "#plan_status"}, {"text": ")."}], "kind": "para"}, {"line": [{"text": "Reach: the polymorphic "}, {"code": "FrameFiber"}, {"text": ", at every stack, demand, skip flag and carried cause, with one fixed base. The pop asks for an empty scratch stack, as "}, {"code": "getCont"}, {"text": " calls it."}], "kind": "para"}, {"line": [{"text": "It does not establish a law of a run, a completed exit, a cleanup's multiplicity, a delivery, a budget or liveness. It says nothing of a host or of a printed form. The bracket of a whole region and each fiber's base in a run are not stated."}], "kind": "para"}, {"line": [{"text": "Its consumers are the later lift through "}, {"code": "Machine.Lift"}, {"text": ", then the waiting wrapper under a masked caller and Semaphore's protected permit."}], "kind": "para"}, {"rows": [{"line": [{"code": "Effect4.Laws.Machine.MaskDiscipline"}], "label": "Module"}], "kind": "fields"}, {"language": "lean", "kind": "code", "body": "∀ (ν σ : Type u) (β : Type v) (ε δ ι α : Type u) [inst : DecidableEq ε] [inst_1 : DecidableEq δ]\n [inst_2 : DecidableEq ι] [inst_3 : DecidableEq α], Effect4.Machine.MaskPopDiscipline ν σ β ε δ ι α"}]}, {"title": "saved-mask-chain-runs", "kind": "part", "key": "claim:saved-mask-chain-runs", "body": [{"line": [{"text": "Each live fiber of a run of a compiled program holds the saved mask's chain at its start flag: the invariant MaskRuns, at a table of start flags, is kept by every decision tape and fuel at the compiled program's interpreter, from each machine that holds it; each command keeps it under the condition just before a clearing, which the command loop discharges, so each entry outside the machine that returns a machine keeps it, with no premise for the condition (the lift of saved-mask-pop-discipline to runs; no typing, no admission and no premise on the table; no bracket of a region, no flag or stack of an exited fiber, no cleanup's multiplicity, no delivery, no budget, no liveness)"}], "kind": "para"}, {"line": [{"text": "Each live fiber of a run of a compiled program holds the saved mask's chain at its start flag (the proposed registry claim "}, {"code": "saved-mask-chain-runs"}, {"text": "; concept "}, {"code": "scope-lifetime-finalization"}, {"text": ", requirement R11). It is the placed statement of the claim: the lift of "}, {"code": "saved_mask_pop_discipline"}, {"text": " to runs, at the compiled program's interpreter "}, {"code": "interpOf root table"}, {"text": " and under the native evaluator "}, {"code": "evaluatorFor root table"}, {"text": ". A printed form of the statement hides that instance."}], "kind": "para"}, {"line": [{"text": "Its general form is "}, {"code": "Machine.saved_mask_chain_runs"}, {"text": ", at the frame evaluator. This statement is "}, {"code": "Machine.replayEval_maskRuns"}, {"text": " at the native evaluator's premise "}, {"code": "evaluateNative_keepsMask"}, {"text": "."}], "kind": "para"}, {"line": [{"text": "Reach: every program, row table, decision tape and fuel, from each machine that holds the invariant. It asks for no typing, no admission and no premise on the table."}], "kind": "para"}, {"line": [{"text": "It does not establish the bracket of a region, a flag or a stack of an exited fiber as a state invariant, a cleanup's multiplicity, a delivery, a budget or liveness. An invariant is not progress."}], "kind": "para"}, {"line": [{"text": "Its consumers are the bracket's law, then the waiting wrapper under a masked caller, Semaphore's protected permit and Pool's "}, {"code": "use"}, {"text": "."}], "kind": "para"}, {"rows": [{"line": [{"code": "Effect4.Laws.Program.MaskRuns"}], "label": "Module"}], "kind": "fields"}, {"language": "lean", "kind": "code", "body": "∀ (root : Effect4.Program.NativeEff) (table : Effect4.Program.RowTable) (fuel : Nat)\n (tape :\n List\n (Effect4.Machine.RunDecision Effect4.Program.EffName Effect4.Program.EffThunk\n Effect4.Machine.Val Effect4.Machine.Err Effect4.Machine.Defect Effect4.FiberId\n Effect4.Machine.Ann))\n (bases : List Bool)\n (m :\n Effect4.Machine.RunMachine Effect4.Program.EffName Effect4.Program.EffThunk Effect4.Machine.Val\n Effect4.Machine.Err Effect4.Machine.Defect Effect4.FiberId Effect4.Machine.Ann\n Effect4.Machine.Ctx Effect4.Machine.Stores),\n Effect4.Machine.MaskRuns bases m →\n Exists fun bases' =>\n And (bases.IsPrefix bases')\n (Effect4.Machine.MaskRuns bases'\n (Effect4.Machine.replayEval (Effect4.Program.interpOf root table) fuel tape m).machine)"}]}, {"title": "saved-mask-region-bracket", "kind": "part", "key": "claim:saved-mask-region-bracket", "body": [{"line": [{"text": "A region of a compiled program ends at its entry's stack and at its entry flag, for an arbitrary body: at two cuts of one command loop's run where a pending command steps the fiber, the later cut's stack shape above ++ below is a premise, and it is the region's only mark on the machine; the theorem then gives the entry's stack and the entry flag at the region's end, which is the fiber that the pop of the own frames leaves where no own frame answers, and the pop goes on from it; it does not give that a body's run keeps that shape (the run-level half of saved-mask-restoration; no premise on an exit, by stepped-fiber-live; no cleanup, no release count, no delivery, no budget, no liveness; nothing of a region whose fiber exits inside it; the client premise of the mask's derived form stays: nothing acquired or registered before the body begins, decisions rows 227, 244 to 246)"}], "kind": "para"}, {"line": [{"text": "A region of a compiled program ends at its entry's stack and at its entry flag, for an arbitrary body (the proposed registry claim "}, {"code": "saved-mask-region-bracket"}, {"text": "; concept "}, {"code": "scope-lifetime-finalization"}, {"text": ", requirement R11). It is the run-level half of "}, {"code": "saved-mask-restoration"}, {"text": ", at the compiled program's interpreter "}, {"code": "interpOf p table"}, {"text": " and under the native evaluator."}], "kind": "para"}, {"line": [{"text": "The two cuts are cuts of one command loop's run ("}, {"code": "LoopCut"}, {"text": ", at tables in the prefix order), and at each a pending command steps the fiber. The first is the region's entry: its stack is the entry's stack, and its flag is the entry flag. At the second the fiber is inside the region: its stack is the own frames "}, {"code": "above"}, {"text": " over the entry's stack. Where the pop of the own frames answers nothing, the body's exit has passed each own frame. Then the region's end has the entry's stack and the entry flag, and the pop of the fiber goes on as the pop of the region's end ("}, {"code": "RegionEnds"}, {"text": ")."}], "kind": "para"}, {"line": [{"text": "Its two facts are its steps. The stack at the region's end is the entry's stack ("}, {"code": "FrameFiber.regionEnd_stack"}, {"text": "). The fiber is live at both cuts ("}, {"code": "stepped_live"}, {"text": "), so the statement takes no premise on an exit. Its general form is "}, {"code": "Machine.saved_mask_region_bracket"}, {"text": ", which takes that premise."}], "kind": "para"}, {"line": [{"text": "Reach: every program, row table, demand, skip flag and carried cause. It asks for no typing and no admission. A region that changes its flag and a region that changes no flag are one case: the statement reads the entry's stack and the entry flag alone."}], "kind": "para"}, {"line": [{"text": "The later cut's stack shape "}, {"code": "above ++ below"}, {"text": " is a premise, and it is the region's only mark on the machine. The theorem then gives the entry's stack and the entry flag at the region's end. It does not give that a body's run keeps that shape."}], "kind": "para"}, {"line": [{"text": "It gives no cleanup, no release count, no delivery, no budget and no liveness, and nothing of a region whose fiber exits inside it. The client premise of the mask's derived form stays with the client: nothing is acquired or registered before the body begins (decisions rows 227 and 244 to 246)."}], "kind": "para"}, {"line": [{"text": "Its consumers are the waiting wrapper under a masked caller, then Semaphore's protected permit and Pool's "}, {"code": "use"}, {"text": "."}], "kind": "para"}, {"rows": [{"line": [{"code": "Effect4.Laws.Program.MaskBracket"}], "label": "Module"}], "kind": "fields"}, {"language": "lean", "kind": "code", "body": "∀ (p : Effect4.Program.NativeEff) (table : Effect4.Program.RowTable) {bases bases' : List Bool}\n {m m' : Effect4.Program.NativeMachine} {cmds cmds' : List Effect4.Program.Guard.NCmd},\n Effect4.Program.LoopCut p table bases m cmds →\n Effect4.Program.LoopCut p table bases' m' cmds' →\n bases.IsPrefix bases' →\n ∀ {c c' : Effect4.Program.Guard.NCmd},\n List.instMembership.mem cmds c →\n List.instMembership.mem cmds' c' →\n ∀ {id : Effect4.FiberId},\n Effect4.Machine.Steps id c →\n Effect4.Machine.Steps id c' →\n ∀ {f g : Effect4.Program.Guard.NFiber},\n Eq (Effect4.Machine.RunMachine.fiber? m id) (Option.some f) →\n Eq (Effect4.Machine.RunMachine.fiber? m' id) (Option.some g) →\n ∀ {above : List Effect4.Program.NCode},\n Eq\n (g.frame\n (Effect4.Prim Effect4.Program.EffName Effect4.Program.EffThunk\n Effect4.Machine.Val Effect4.Machine.Err Effect4.Machine.Defect\n Effect4.FiberId Effect4.Machine.Ann)\n (Effect4.FrameFiber Effect4.Program.EffName\n Effect4.Program.EffThunk Effect4.Machine.Val\n Effect4.Machine.Err Effect4.Machine.Defect Effect4.FiberId\n Effect4.Machine.Ann)).stack\n (instHAppendOfAppend.hAppend above\n (f.frame\n (Effect4.Prim Effect4.Program.EffName Effect4.Program.EffThunk\n Effect4.Machine.Val Effect4.Machine.Err\n Effect4.Machine.Defect Effect4.FiberId Effect4.Machine.Ann)\n (Effect4.FrameFiber Effect4.Program.EffName\n Effect4.Program.EffThunk Effect4.Machine.Val\n Effect4.Machine.Err Effect4.Machine.Defect Effect4.FiberId\n Effect4.Machine.Ann)).stack) →\n ∀ (demand : Effect4.Arm) (skip : Bool)\n (cause : Option Effect4.Machine.CauseV),\n Eq\n (((g.frame\n (Effect4.Prim Effect4.Program.EffName\n Effect4.Program.EffThunk Effect4.Machine.Val\n Effect4.Machine.Err Effect4.Machine.Defect\n Effect4.FiberId Effect4.Machine.Ann)\n (Effect4.FrameFiber Effect4.Program.EffName\n Effect4.Program.EffThunk Effect4.Machine.Val\n Effect4.Machine.Err Effect4.Machine.Defect\n Effect4.FiberId Effect4.Machine.Ann)).own\n above).getCont\n demand skip cause).answer\n Effect4.ContAnswer.empty →\n (f.frame\n (Effect4.Prim Effect4.Program.EffName\n Effect4.Program.EffThunk Effect4.Machine.Val\n Effect4.Machine.Err Effect4.Machine.Defect Effect4.FiberId\n Effect4.Machine.Ann)\n (Effect4.FrameFiber Effect4.Program.EffName\n Effect4.Program.EffThunk Effect4.Machine.Val\n Effect4.Machine.Err Effect4.Machine.Defect Effect4.FiberId\n Effect4.Machine.Ann)).RegionEnds\n (g.frame\n (Effect4.Prim Effect4.Program.EffName Effect4.Program.EffThunk\n Effect4.Machine.Val Effect4.Machine.Err\n Effect4.Machine.Defect Effect4.FiberId Effect4.Machine.Ann)\n (Effect4.FrameFiber Effect4.Program.EffName\n Effect4.Program.EffThunk Effect4.Machine.Val\n Effect4.Machine.Err Effect4.Machine.Defect Effect4.FiberId\n Effect4.Machine.Ann))\n above demand skip cause"}]}, {"title": "stepped-fiber-live", "kind": "part", "key": "claim:stepped-fiber-live", "body": [{"line": [{"text": "At each cut of a compiled command loop, a fiber that a pending command steps has not exited: the guard's queue gives the fiber of each pending Cmd.loop and Cmd.deliver as running, and the guard's state gives each exited fiber as not running (every program and row table, each machine and pending commands that hold GuardState and GuardQueue; false at a hand-written interpreter; no statement that a fiber is stepped, and nothing of a fiber that no pending command steps)"}], "kind": "para"}, {"line": [{"text": "At each cut of a compiled command loop, a fiber that a pending command steps has not exited (the proposed registry claim "}, {"code": "stepped-fiber-live"}, {"text": "; concept "}, {"code": "scope-lifetime-finalization"}, {"text": ", requirement R11). The guard's queue gives the fiber of each pending "}, {"code": "Cmd.loop"}, {"text": " and "}, {"code": "Cmd.deliver"}, {"text": " as running and not parked, and the guard's state gives each exited fiber as not running. It is the second fact of the bracket, and its own source."}], "kind": "para"}, {"line": [{"text": "So no compiled program reaches a machine where the command loop steps an exited fiber. The invariant "}, {"code": "MaskRuns"}, {"text": " ranges over the live fibers for that machine's sake ("}, {"code": "Laws/Machine/MaskRuns.lean"}, {"text": ")."}], "kind": "para"}, {"line": [{"text": "Reach: every program and row table, and each machine and pending commands that hold the guard's state and the guard's queue. "}, {"code": "Guard.driveStep_invariants"}, {"text": " keeps both along a command loop, and "}, {"code": "Guard.guardState_reachable"}, {"text": " gives the state at each reachable machine."}], "kind": "para"}, {"line": [{"text": "It does not establish that a fiber is stepped, and it gives nothing of a fiber that no pending command steps. The statement is false at a hand-written interpreter: there the command loop steps an exited fiber, and "}, {"code": "Test/Machine/MaskBracket.lean"}, {"text": " holds two such cuts."}], "kind": "para"}, {"line": [{"text": "Its consumers are "}, {"code": "compiled_region_bracket"}, {"text": ", and each law that reads a fiber at its own step."}], "kind": "para"}, {"rows": [{"line": [{"code": "Effect4.Laws.Program.MaskBracket"}], "label": "Module"}], "kind": "fields"}, {"language": "lean", "kind": "code", "body": "∀ (p : Effect4.Program.NativeEff) (table : Effect4.Program.RowTable)\n {m : Effect4.Program.NativeMachine} {cmds : List Effect4.Program.Guard.NCmd},\n Effect4.Program.Guard.GuardState m →\n Effect4.Program.Guard.GuardQueue p table m cmds →\n ∀ {c : Effect4.Program.Guard.NCmd},\n List.instMembership.mem cmds c →\n ∀ {id : Effect4.FiberId},\n Effect4.Machine.Steps id c →\n ∀ {f : Effect4.Program.Guard.NFiber},\n Eq (Effect4.Machine.RunMachine.fiber? m id) (Option.some f) →\n Eq\n (f.exit\n (Effect4.Prim Effect4.Program.EffName Effect4.Program.EffThunk\n Effect4.Machine.Val Effect4.Machine.Err Effect4.Machine.Defect\n Effect4.FiberId Effect4.Machine.Ann)\n (Effect4.FrameFiber Effect4.Program.EffName Effect4.Program.EffThunk\n Effect4.Machine.Val Effect4.Machine.Err Effect4.Machine.Defect\n Effect4.FiberId Effect4.Machine.Ann))\n Option.none"}]}, {"title": "pool-return-front", "kind": "part", "key": "claim:pool-return-front", "body": [{"line": [{"text": "A return of a lease that holds its item puts the item at the front of the idle items, keeps every item, and leaves the lease holding nothing (a helper of pool-lease-return; no finalizer's run)"}], "kind": "para"}, {"line": [{"text": "A return puts its item at the front, and it keeps every item. Where the lease holds the item, the item's stamp joins the front of the idle stamps, the lease returned, and a wake is owed exactly when a waiter is enrolled. Every item stays, with its resource: a return finalizes nothing. After it the lease holds no item. Consumer: the proposed claim "}, {"code": "pool-lease-return"}, {"text": ". It states one transition, and nothing about a finalizer's run."}], "kind": "para"}, {"rows": [{"line": [{"code": "Effect4.Laws.Library.Pool.Profile"}], "label": "Module"}], "kind": "fields"}, {"language": "lean", "kind": "code", "body": "∀ {s : Effect4.Pool.Model.State} {i l : Nat},\n Eq (s.items.any fun x => x.heldBy i l) Bool.true →\n And (Eq (Effect4.Pool.Model.giveBack s i l).fst.available (List.cons i s.available))\n (And\n (Eq (Effect4.Pool.Model.giveBack s i l).snd\n { fst := Bool.true, snd := s.waiters.isEmpty.not })\n (And\n (Eq\n (List.map (fun it => { fst := it.stamp, snd := it.resource })\n (Effect4.Pool.Model.giveBack s i l).fst.items)\n (List.map (fun it => { fst := it.stamp, snd := it.resource }) s.items))\n (Eq ((Effect4.Pool.Model.giveBack s i l).fst.items.any fun x => x.heldBy i l)\n Bool.false)))"}]}, {"title": "pool-return-once", "kind": "part", "key": "claim:pool-return-once", "body": [{"line": [{"text": "A second return of one lease changes nothing in Pool's model, and it owes no wake (a helper of pool-lease-return, from pool-return-front; the model's step only: no program and no finalizer's run)"}], "kind": "para"}, {"line": [{"text": "A lease returns at most once. After a return of a lease, a second return of the same lease changes nothing and owes no wake, whatever the first one did. Consumer: the proposed claim "}, {"code": "pool-lease-return"}, {"text": "."}], "kind": "para"}, {"rows": [{"line": [{"code": "Effect4.Laws.Library.Pool.Profile"}], "label": "Module"}], "kind": "fields"}, {"language": "lean", "kind": "code", "body": "∀ (s : Effect4.Pool.Model.State) (i l : Nat),\n Eq (Effect4.Pool.Model.giveBack (Effect4.Pool.Model.giveBack s i l).fst i l)\n { fst := (Effect4.Pool.Model.giveBack s i l).fst,\n snd := { fst := Bool.false, snd := Bool.false } }"}]}, {"title": "pool-close-refuses", "kind": "part", "key": "claim:pool-close-refuses", "body": [{"line": [{"text": "After the close's first step of Pool's model every lease is refused, and a refused lease changes no item (a helper of pool-close-waits; no wait for a lease and no finalizer's run; decisions row 268)"}], "kind": "para"}, {"line": [{"text": "After the close's first step no lease begins. The step leaves a closing pool, it tells whether it began the close, and its count is the count of the waiters. At a closing pool every lease is refused, and a refused lease changes no item, no idle stamp and no stamp of a lease. No transition opens the pool again ("}, {"code": "step_closing"}, {"text": "). Consumer: the proposed claim "}, {"code": "pool-close-waits"}, {"text": ". It states no wait for a lease, no finalizer's run and no completed close."}], "kind": "para"}, {"rows": [{"line": [{"code": "Effect4.Laws.Library.Pool.Profile"}], "label": "Module"}], "kind": "fields"}, {"language": "lean", "kind": "code", "body": "∀ (s : Effect4.Pool.Model.State),\n And (Eq (Effect4.Pool.Model.close s).fst.closing Bool.true)\n (And (Eq (Effect4.Pool.Model.close s).snd { fst := s.closing.not, snd := s.waiters.length })\n (∀ (id : Nat),\n Eq (Effect4.Pool.Model.lease (Effect4.Pool.Model.close s).fst id)\n { fst := Effect4.Pool.Model.withdraw (Effect4.Pool.Model.close s).fst id,\n snd := { fst := Bool.true, snd := Option.none } }))"}]}, {"title": "pool-drain-waits", "kind": "part", "key": "claim:pool-drain-waits", "body": [{"line": [{"text": "The closer's step of Pool's model answers that the pool is drained exactly when no lease is outstanding, it enrols the closer exactly otherwise, and it changes the waiters alone (a helper of pool-close-waits; one transition: no wait along a run, no progress of the closer and no finalizer's run; decisions rows 268 and 276)"}], "kind": "para"}, {"line": [{"text": "The closer's step answers true exactly where no lease is outstanding (decisions rows 268 and 276, point 2). It enrols the closer exactly otherwise: the closer's own entry leaves first, so an entry after the step is this step's enrolment. The check and the enrolment are one transition, so each later return finds a waiter. The step changes the waiters alone: it frees no item, and it finalizes none. Consumer: the proposed claim "}, {"code": "pool-close-waits"}, {"text": ". It states one transition. It states no wait along a run, no progress of the closer and no finalizer's run."}], "kind": "para"}, {"rows": [{"line": [{"code": "Effect4.Laws.Library.Pool.Profile"}], "label": "Module"}], "kind": "fields"}, {"language": "lean", "kind": "code", "body": "∀ (s : Effect4.Pool.Model.State) (id : Nat),\n And\n (Iff (Eq (Effect4.Pool.Model.drain s id).snd Bool.true)\n (Eq (Effect4.Pool.Model.leases s) List.nil))\n (And\n (Iff (List.instMembership.mem (Effect4.Pool.Model.drain s id).fst.waiters id)\n (Ne (Effect4.Pool.Model.leases s) List.nil))\n (Eq (Effect4.Pool.Model.drain s id).fst\n { items := s.items, available := s.available,\n waiters := (Effect4.Pool.Model.drain s id).fst.waiters, closing := s.closing,\n next := s.next }))"}]}]}