all the appropriate commits (and the appropriate other patches),
as generated by the Traversal phase of the update algorithm.
+\item[ $\allreach$ ]
+The set of all reachable commits.
+
+A reachable commit is one we might refer to explicitly in any of these
+algorithms, and any ancestor of such a commit. We explicitly
+enumerate all of the input commits ($\allsrcs$), so the reachable
+commits are originally the input commits and their ancestors.
+
+$\allreach$ varies over time as we generate more commits. Each
+commit we generate will have only reachable commits as ancestors, so
+generating a new commit (only) adds that new commit to $\allreach$.
+
+\item[ $\allreachof{\py}$ ]
+The set of reachable commits at the point where we have just generated
+$\tippy$, i.e. just after $\alg{Merge-Tip}(\p)$.
+
\end{basedescript}
+\stdsection{ WIP tip satisfaction, reachable commits }
+
+We preserve/ensure
+$$ \tippy >= \pendsof{\allreach_{\py}}{\py} $$
+($\tippy$ is computed during traversal for the patch $\p$)
+
+We ensure this property by:
+ - we do not generate any commits for py other than
+ during Merge-Tip
+ - so at the start of Merge-Tip pendsof (O, py) = pendsof (U, py)
+ - Merge-Tip itself wip wip wip
+
+