\section{Traversal phase --- proofs}

For each operation called for by the traversal algorithms, we prove
that the commit generation preconditions are met.

\subsection{Reachability and coverage}

We ensure Tip Covers Reachable as follows:

\begin{itemize}
\item  We do not generate any commits $\in \py$ other than
       during $\alg{Merge-Tip}(\py)$;
\item  So at the start of $\alg{Merge-Tip}(\py)$,
       $ \pendsof{\allreach}{\py} = \pendsof{\allsrcs}{\py} $
\item  $\alg{Merge-tip}$ arranges that when it is done
       $\tippy \ge \pendsof{\allreach}{\py}$ --- see below.
\end{itemize}

A corrolary is as follows:
\statement{Tip Covers Superior Reachable} {
  \bigforall_{\pd \isdep \pc}
    \tipdy \ge \pendsof{\allreachof{\pcy}}{\pdy}
}
\proof{
  No commits $\in \pdy$ are created other than during
  $\alg{Merge-Tip}(\pd)$, which runs (and has thus completed)
  before $\alg{Merge-Tip}(\pcy)$
  So $\pendsof{\allreachof{\pcy}}{\pdy} =
      \pendsof{\allreachof{\pdy}}{\pdy}$.
}

\subsection{Traversal Lemmas}

\statement{Tip Correct Contents}{
  \tipcy \haspatch \pa E
    \equiv
  \pa E = \pc \lor \pa E \isdep \pc
}
\proof{
  For $\pc = \pa E$, Tip Own Contents suffices.
  For $\pc \neq \pa E$, Exclusive Tip Contents
  gives $D \isin \tipcy \equiv D \isin \baseof{\tipcy}$
  which by Correct Base $\equiv D \isin \tipcn$.
}

\subsection{Base Dependency Merge, Base Sibling Merge}

We do not prove that the preconditions are met.  Instead, we check
them at runtime.  If they turn out not to be met, we abandon
\alg{Merge-Base} and resort to \alg{Recreate-Base}.

TODO COMPLETE MERGE-BASE STUFF

WIP WHAT ABOUT PROVING ALL THE TRAVERSAL RESULTS

\subsection{Recreate Base Beginning}

To recap we are executing Create Base with
$L = \tipdy$ and $\pq = \pc$.

\subsubsection{Create Acyclic}

By Tip Correct Contents of $L$,
$L \haspatch \pa E \equiv \pa E = \pd \lor \pa E \isdep \pd$.
Now $\pd \isdirdep \pc$,
so by Coherence, and setting $\pa E = \pc$,
$L \nothaspatch \pc$. I.e. $L \nothaspatch \pq$. OK.

That's everything for Create Base.  $\qed$

\subsection{Recreate Base Final Declaration}

\subsubsection{Base Only} $\patchof{W} = \patchof{L} = \pn$.  OK.

\subsubsection{Unique Tips}

Want to prove that for any $\p \isin C$, $\tipdy$ is a suitable $T$.

WIP

\subsection{Tip Base Merge}

$L = W$, $R = \tipcn$.

TODO TBD

Afterwards, $\baseof{W} = \tipcn$.

\subsection{Tip Source Merge}

In fact, we do this backwards: $L = S$, $R = W$.  Since $S \in \pcy$,
the resulting $C \in \pcy$ and the remaining properties of the Merge
commit construction are symmetrical in $L$ and $R$ so this is fine.

By the results of Tip Base Merge, $\baseof{W} = \tipcn$.

By Base Ends Supreme, $\tipcn \ge \baseof{S}$ i.e.
$\baseof{R} \ge \baseof{L}$.

Either $\baseof{L} = \baseof{M}$, or we must choose a different $M$ in
which case $M = \baseof{S}$ will suffice.

