-\section{Traversal phase --- proofs}
-
-For each operation called for by the traversal algorithms, we prove
-that the commit generation preconditions are met.
-
-\subsection{Reachability and coverage}
-
-We ensure Tip Covers Reachable as follows:
-
-\begin{itemize}
-\item We do not generate any commits $\in \py$ other than
- during $\alg{Merge-Tip}(\py)$;
-\item So at the start of $\alg{Merge-Tip}(\py)$,
- $ \pendsof{\allreach}{\py} = \pendsof{\allsrcs}{\py} $
-\item $\alg{Merge-tip}$ arranges that when it is done
- $\tippy \ge \pendsof{\allreach}{\py}$ --- see below.
-\end{itemize}
-
-A corrolary is as follows:
-\statement{Tip Covers Superior Reachable} {
- \bigforall_{\pd \isdep \pc}
- \tipdy \ge \pendsof{\allreachof{\pcy}}{\pdy}
-}
-\proof{
- No commits $\in \pdy$ are created other than during
- $\alg{Merge-Tip}(\pd)$, which runs (and has thus completed)
- before $\alg{Merge-Tip}(\pcy)$
- So $\pendsof{\allreachof{\pcy}}{\pdy} =
- \pendsof{\allreachof{\pdy}}{\pdy}$.
-}
-
-\subsection{Traversal Lemmas}
-
-\statement{Tip Correct Contents}{
- \tipcy \haspatch \pa E
- \equiv
- \pa E = \pc \lor \pa E \isdep \pc
-}
-\proof{
- For $\pc = \pa E$, Tip Own Contents suffices.
- For $\pc \neq \pa E$, Exclusive Tip Contents
- gives $D \isin \tipcy \equiv D \isin \baseof{\tipcy}$
- which by Correct Base $\equiv D \isin \tipcn$.
-}
-
-\subsection{Base Dependency Merge, Base Sibling Merge}
-
-We do not prove that the preconditions are met. Instead, we check
-them at runtime. If they turn out not to be met, we abandon
-\alg{Merge-Base} and resort to \alg{Recreate-Base}.
-
-TODO COMPLETE MERGE-BASE STUFF
-
-WIP WHAT ABOUT PROVING ALL THE TRAVERSAL RESULTS
-
-\subsection{Recreate Base Beginning}
-
-To recap we are executing Create Base with
-$L = \tipdy$ and $\pq = \pc$.
-
-\subsubsection{Create Acyclic}
-
-By Tip Correct Contents of $L$,
-$L \haspatch \pa E \equiv \pa E = \pd \lor \pa E \isdep \pd$.
-Now $\pd \isdirdep \pc$,
-so by Coherence, and setting $\pa E = \pc$,
-$L \nothaspatch \pc$. I.e. $L \nothaspatch \pq$. OK.
-
-That's everything for Create Base. $\qed$
-
-\subsection{Recreate Base Final Declaration}
-
-\subsubsection{Base Only} $\patchof{W} = \patchof{L} = \pn$. OK.
-
-\subsubsection{Unique Tips}
-
-Want to prove that for any $\p \isin C$, $\tipdy$ is a suitable $T$.
-
-WIP
-
-\subsection{Tip Base Merge}
-
-$L = W$, $R = \tipcn$.
-
-TODO TBD
-
-Afterwards, $\baseof{W} = \tipcn$.
-
-\subsection{Tip Source Merge}
-
-In fact, we do this backwards: $L = S$, $R = W$. Since $S \in \pcy$,
-the resulting $C \in \pcy$ and the remaining properties of the Merge
-commit construction are symmetrical in $L$ and $R$ so this is fine.
-
-By the results of Tip Base Merge, $\baseof{W} = \tipcn$.
-
-By Base Ends Supreme, $\tipcn \ge \baseof{S}$ i.e.
-$\baseof{R} \ge \baseof{L}$.
-
-Either $\baseof{L} = \baseof{M}$, or we must choose a different $M$ in
-which case $M = \baseof{S}$ will suffice.
-