FPRD LabShare an approach

← Claims

Conditional staging theorem under the complete sequence contract

FPRD-T127

Opaque catenable-sequence updates can be staged before feedback

Exact statement

Assume a persistent sequence implementation satisfies the direct Draft 5 Section 11.1 contract: list semantics, persistence, opaque elements, a finite source-record signature and inspected nonpointer data, uniformly bounded strict evaluation and field selection, explicit old/fresh pointer origins, and no escaping temporary control values. Its bounded old-dependent structural allocation plan can stage a new receipt as an opaque atom and tie that atom to its fresh owner in one D36 simultaneous batch, preserving sequence semantics. This conditional staging theorem does not certify the concrete OCaml implementation or recover a withdrawn numerical radius from Kaplan--Tarjan's abstract worst-case operation bound.

StatusConditional theorem proved; numerical radius certificate withdrawn
External reviewNo documented external or specialist review of this FPRD result is recorded.

Context

The fresh occurrence owner must be inserted as the terminal element of a sequence that the owner itself points to. Structural sequence work can be evaluated first only because the element is opaque to that work.

Hypotheses and scope

  • The persistent sequence implementation satisfies every Draft 5 Section 11.1 clause: list semantics, persistence, opaque elements, finite source-record and constructor signatures, uniformly bounded strict evaluation and field selection, finite inspected nonpointer data, complete old/fresh pointer origins, and no escaping temporary control values.
  • The palindrome client uses empty, single, uncons, and catenation; inject is derived as catenation with a singleton. Both catenation operands may be unbounded.

Proof or evidence

Under the complete sequence contract, symbolic evaluation stages an opaque fresh receipt and ties it to its fresh owner in one simultaneous batch. Kaplan-Tarjan supplies imported abstract operation evidence. The later OCaml variant, typed-call analyses, and finite checks are implementation evidence with uncovered obligations; Appendix D remains informal and Needs work.

Opaque-atom staging →

Verification notes

The governing proposition is conditional on the complete Draft 5 Section 11.1 contract; the concrete implementation is not certified. The following dated source-audit trail is retained as implementation evidence. A 10 September 2026 source audit read Kaplan–Tarjan 1999 through Theorem 5.1 and the catenable-steque construction. Later audits made the exact client adapter explicit, inspected Viennot et al. arXiv:2505.07681v3 and paper-pinned commit 444358e, and implemented the length-free transformation. The Buffer counter-review reached a real assertion in unused Buffer.two: eq2 is only a lower bound. The helper was removed. Three same-model reviews then addressed the unchanged Deque_core by constructor proof, bounded exhaustive interpretation, and abstraction-bypass counterattack. Allocation ceilings remain 7 for single, 450 for cat, and 2,490 for uncons. The typed call certificate checks the corrected 14/20/118 endpoint ceilings. A later adversarial mutation replaced every selector witness in the radius proof object with one repeated vocabulary member; the old checker still passed and reproduced 55/874. The OCaml 4.14.1 interprocedural IR now records all 3,912 expressions, 3,764 child edges, qualified formals, 646 cases, 2,342 pattern nodes, 454 ordered calls, 437 returns, 928 builds, and 1,397 bound locals. Its callback-specialized cat closure contains 42 named Cadeque/Buffer helpers, the concat entry and two finite folds, plus 36 Deque-core bodies, for 81 bodies total. A separate pre-specialization gate reported 78; reconciliation identified exactly the omitted push, inject, and is_empty_chain bodies. The strengthened admission gate binds the exact archived source and CMT bytes, checks every build slot against its expression edge, and gives the exact 952-slot source-declaration partition: 405 fixed structural, 73 fixed control, and 474 context-sensitive source sites across 42 bindings. Eighteen admission mutations reject. A further contract audit establishes that these are not 474 monomorphic semantic instances: the Packet carrier permits symbolic Pair^k(alpha) depth, so binding-only memoization or a flat finite label table is unsound. The contract rejects 21 such weakenings. No old/fresh interpretation or contiguous witness exists yet because the symbolic type schemes, 42 callback substitutions, and two assertion obligations remain. The former 55/874 operation radii and 1,750/989/876 client radii therefore remain withdrawn, while A*=8,838 and q=7 remain. The whole-client normalization theorem still converts the sequential client to one Definition 10.1 plan with some finite source-model radius. The reviews share source and model dependencies; no fresh compiler-libs extraction in this runtime, Rocq rerun, external review, checked OCaml–Rocq refinement, or mechanized runtime cost semantics is claimed.

Limitations

  • Appendix D and the handwritten source arguments remain informal implementation evidence and Needs work. Finite exhaustive and differential checks do not certify the complete Section 11.1 contract.
  • The 7/450/2,490 allocation ceilings remain supported in the explicit abstract record model. The proposed 55/874 source-graph radii are withdrawn because their checker did not validate selector coverage or provenance.
  • The complete client retains A*=8,838 and q=7. The callback-specialized cat closure has complete control/dataflow topology and an exact 952-source-site admission table: source declarations fix 405 structural and 73 control sites, while 474 across 42 bindings need symbolic context-sensitive type schemes. They cannot be flattened into 474 monomorphic instances because Packet permits arbitrary Pair^k(alpha) depth. Those schemes, 42 callback substitutions, and two assertions remain before old/fresh interpretation.
  • The whole-client normalization theorem concerns the retained abstract record graph. It does not claim equality of OCaml allocation traces, garbage, tuple layout, or runtime failures.
  • The former external/internal/reset radii 1,750/989/876 are withdrawn with their unverified selector-envelope premise.
  • The direct theorem is conditional on the complete Section 11.1 contract and uses symbolic finite resource constants; no numerical radius or distance corollary is currently certified.
  • The Rocq correctness proof and the handwritten OCaml resource argument concern different programs. Combining them without a refinement proof would be invalid.
  • The facade theorem concerns values reachable through the documented abstract interface; generated internal module names can bypass wrapper abstraction in a source-tree build.
  • Narrowing the API does not remove the hard catenation case; ordinary lists and unbalanced concatenation DAGs do not meet the stated worst-case persistent interface.
  • Opacity is essential: inspecting the fresh payload during the same step would invalidate the staging argument.

Open work

Extract canonical symbolic type schemes for the 474 context-sensitive cat source sites, preserving arbitrary Pair^k(alpha) depth, then run branch-correlated callback substitution while failing closed on both assertions.

Notes

Status proof applies to the conditional staging proposition only. Kaplan--Tarjan is imported abstract operation evidence, not a complete source-record or old/fresh provenance certificate for the later OCaml variant. Appendix D remains informal implementation evidence and Needs work. The typed-call, callback and constructor analyses are finite/source checks with explicit uncovered obligations. Numerical cat 55/56, uncons 874/875, client radius 1750 and scaffold distance 1751 remain withdrawn. Archived allocation counts are not promoted to a new numerical theorem. See docs/integration/reconciliation/T125-T128.md and its reopen gates.