{
  "schema_version": "ocme-derivation-reader-v1",
  "guide_id": "derivation-mko-algorithm-correctness-01",
  "mko_id": "mko-algorithm-correctness",
  "title": {
    "zh-Hant": "算法正確性：非確定性相鄰交換排序的部分正確、終止與總正確",
    "en": "Algorithm correctness: partial correctness, termination and total correctness of nondeterministic adjacent-swap sorting"
  },
  "contract": {
    "schema_version": "ocme-derivation-guide-v0.1",
    "guide_id": "derivation-mko-algorithm-correctness-01",
    "source": {
      "mko_id": "mko-algorithm-correctness",
      "commit": "b28a5edbd46279b1db2a3f3f48bb3f447e18899f",
      "sha256": "d9789607b7391a897a2a291245a0699d81ef6dbbdfac86b9b86c04cf7dc0ad27",
      "english_sha256": "33d91b7ce0b46158c3d90a3ec3dfc6506626564456beeabe3e4337d620f07e87"
    },
    "mode": "algorithm_trace",
    "audience_prerequisites": [
      "order_basics",
      "nat_induction",
      "finite_counting_basics",
      "numeric_evaluation"
    ],
    "goal": {
      "zh-Hant": "在有限狀態模型 M 中，狀態是 (1,2,3) 的六個排列，初始狀態 (3,2,1)，每步可非確定性地交換任一個相鄰逆序對，Halt={(1,2,3)}。以後置條件「遞增排列且為輸入的重排」證明 M 的部分正確性、終止性與總正確性：用排名函數 inv（逆序數）證明每條執行至多 3 步，且每條極大執行停在 Halt。再以變體 M′（允許交換任何相鄰對）說明一條成功路徑與部分正確都不足以得到總正確，以變體 M″（錯誤的停止條件）說明終止不足以得到正確。",
      "en": "In a finite-state model M whose states are the six permutations of (1,2,3), with initial state (3,2,1), each step may nondeterministically swap any adjacent inverted pair, and Halt={(1,2,3)}. With the postcondition 'increasing, and a rearrangement of the input', prove partial correctness, termination and total correctness of M, using the ranking function inv (the number of inversions) to show every execution takes at most 3 steps and every maximal execution stops in Halt. Then use the variant M′ (any adjacent pair may be swapped) to show that one successful path and partial correctness do not give total correctness, and the variant M″ (a wrong halting condition) to show that termination does not give correctness."
    },
    "givens": [
      {
        "id": "G1",
        "statement": {
          "zh-Hant": "模型 M=(S,Init,Step,Halt)：S 是 (1,2,3) 的六個排列 123、132、213、231、312、321；Init={321}；對 s=(x1,x2,x3)∉Halt，若 x1>x2 則有邊 s→(x2,x1,x3)，若 x2>x3 則有邊 s→(x1,x3,x2)；Halt={123}，停止狀態沒有外出邊（MKO 假設 a1）。",
          "en": "Model M=(S,Init,Step,Halt): S is the six permutations 123, 132, 213, 231, 312, 321 of (1,2,3); Init={321}; for s=(x1,x2,x3)∉Halt there is an edge s→(x2,x1,x3) if x1>x2 and an edge s→(x1,x3,x2) if x2>x3; Halt={123}, and halt states have no outgoing edges (MKO assumption a1)."
        }
      },
      {
        "id": "G2",
        "statement": {
          "zh-Hant": "後置條件 Q(s)：s 的三項遞增（x1<x2<x3），且其項目恰是輸入 321 的項目 {1,2,3} 的重排。前置條件：初始狀態屬於 Init。",
          "en": "Postcondition Q(s): the three entries of s are increasing (x1<x2<x3) and are a rearrangement of the entries {1,2,3} of the input 321. Precondition: the initial state lies in Init."
        }
      },
      {
        "id": "G3",
        "statement": {
          "zh-Hant": "變體 M′：S、Init、Halt 同 M，但對 s∉Halt，任一相鄰對都可交換，不論是否逆序。變體 M″：S、Init 與交換規則同 M（只交換相鄰逆序對），但 Halt″={s∈S ∣ x1<x2}，並截斷 Halt″ 的外出邊。",
          "en": "Variant M′: S, Init and Halt as in M, but for s∉Halt either adjacent pair may be swapped, inverted or not. Variant M″: S, Init and the swap rule as in M (only adjacent inverted pairs), but Halt″={s∈S ∣ x1<x2}, with edges out of Halt″ truncated."
        }
      },
      {
        "id": "G4",
        "statement": {
          "zh-Hant": "M 是非確定性的：所有責任都針對從 Init 出發的每一條可能執行，一條成功路徑不足以證明（MKO 假設 a2）。 這裡終止性量化於極大執行（無窮執行亦算極大）；有限但未極大的執行只是可繼續延伸的前綴，不要求前綴本身已到達 Halt。",
          "en": "M is nondeterministic: every obligation concerns every possible execution from Init, and one successful path is not a proof (MKO assumption a2). Here termination quantifies over maximal executions (including infinite executions). A finite nonmaximal execution is an extendible prefix and need not already have reached Halt."
        }
      }
    ],
    "steps": [
      {
        "id": "S01",
        "uses": [
          "G1"
        ],
        "before_tex": "S=\\{123,132,213,231,312,321\\},\\ \\mathrm{Init}=\\{321\\},\\ \\mathrm{Halt}=\\{123\\}",
        "after_tex": "\\mathrm{Init},\\mathrm{Halt}\\subseteq S,\\ \\mathrm{Step}\\subseteq S\\times S,\\ |S|=3!=6",
        "relation": "definition",
        "rule": "def_intro",
        "conditions": [],
        "explanation": {
          "zh-Hant": "確認 M 是 MKO 意義下的有限模型。321 與 123 都在 S 中。交換一個排列的兩項，所得仍是 1、2、3 的排列，所以每條邊的兩端都在 S 中，Step⊆S×S。S 恰有 3!=6 個元素。123 沒有相鄰逆序對，所以本來就沒有外出邊，與「Halt 為終點」一致。",
          "en": "Confirm that M is a finite model in the MKO's sense. 321 and 123 lie in S. Swapping two entries of a permutation gives another permutation of 1, 2, 3, so both ends of every edge lie in S, and Step⊆S×S. S has exactly 3!=6 elements. 123 has no adjacent inverted pair, so it has no outgoing edges anyway, consistent with Halt states being endpoints."
        },
        "reverse_audit": {
          "kind": "premise_audit",
          "required_ids": [
            "G1",
            "mko_computational_model_def",
            "finite_counting_basics"
          ],
          "explanation": {
            "zh-Hant": "此步只檢查資料構成模型；「交換保持排列」也就是後置條件中「為輸入的重排」那一半的來源（N1 重算 3!）。",
            "en": "This step only checks that the data form a model; 'swapping preserves being a permutation' is also the source of the 'rearrangement of the input' half of the postcondition (N1 recomputes 3!)."
          }
        },
        "leaf_basis": "def_intro + subset_def + cartesian_product_def + finite_counting_basics"
      },
      {
        "id": "S02",
        "uses": [
          "G2",
          "G4",
          "mko_algorithm_correctness_def"
        ],
        "before_tex": "M,\\ Q",
        "after_tex": "\\mathrm{PC}:\\ \\text{every halt reached satisfies}\\ Q;\\quad \\mathrm{T}:\\ \\text{every maximal execution is finite and ends in Halt};\\quad \\mathrm{TC}=\\mathrm{PC}\\wedge\\mathrm{T}",
        "relation": "definition",
        "rule": "def_unfold",
        "conditions": [],
        "explanation": {
          "zh-Hant": "依 MKO 的部分正確／總正確區分寫出責任，並把終止性精確量化於極大執行。PC：從 Init 出發、到達 Halt 的每條執行，其末狀態滿足 Q。T：從 Init 出發的每條極大執行都有限且末狀態屬於 Halt，等價於沒有無窮執行，也沒有停在非 Halt 狀態的有限極大執行。有限非極大前綴不要求已到 Halt。TC 是 PC 與 T 的合取，所有非確定選擇都必須涵蓋（G4）。",
          "en": "Write out the partial/total-correctness obligations, quantifying termination precisely over maximal executions. PC: every execution from Init that reaches Halt ends in a state satisfying Q. T: every maximal execution from Init is finite and ends in Halt, equivalently there is no infinite execution and no finite maximal execution ending outside Halt. A finite nonmaximal prefix need not have reached Halt already. TC is PC together with T, and all nondeterministic choices must be covered (G4)."
        },
        "reverse_audit": {
          "kind": "premise_audit",
          "required_ids": [
            "mko_algorithm_correctness_def",
            "G4"
          ],
          "explanation": {
            "zh-Hant": "此步只展開定義。PC 本身不要求任何執行停止，所以單獨的 PC 可能空真成立。",
            "en": "This step only unfolds the definitions. PC by itself does not require any execution to stop, so PC alone can hold vacuously."
          }
        },
        "leaf_basis": "def_unfold + mko_algorithm_correctness_def"
      },
      {
        "id": "S03",
        "uses": [
          "G1"
        ],
        "before_tex": "s\\in S\\setminus\\mathrm{Halt}",
        "after_tex": "x_1>x_2\\ \\vee\\ x_2>x_3,\\ \\text{so}\\ \\mathrm{Post}(s)\\ne\\varnothing",
        "relation": "theorem_application",
        "rule": "L_succ",
        "conditions": [],
        "explanation": {
          "zh-Hant": "套用引理 L_succ（在 S03.1、S03.2 證明）：不在 Halt 的狀態一定有相鄰逆序對，因此有後繼，不會卡住。這是終止性論證中排除「卡住」的部分。",
          "en": "Apply Lemma L_succ (proved in S03.1 and S03.2): a state outside Halt always has an adjacent inverted pair and hence a successor, so it cannot be stuck. This is the part of the termination argument that rules out getting stuck."
        },
        "reverse_audit": {
          "kind": "premise_audit",
          "required_ids": [
            "L_succ",
            "G1"
          ],
          "explanation": {
            "zh-Hant": "只對 M 的交換規則成立；在 M″ 中某些非 Halt 狀態的情況需另外檢查。",
            "en": "It holds for the swap rule of M; for M″ the states outside its halt set must be checked separately."
          }
        },
        "leaf_basis": "contrapositive + order_basics"
      },
      {
        "id": "S03.1",
        "uses": [
          "order_basics",
          "contrapositive"
        ],
        "before_tex": "\\neg(x_1>x_2)\\ \\wedge\\ \\neg(x_2>x_3)",
        "after_tex": "x_1<x_2<x_3",
        "relation": "implies",
        "rule": "order_basics",
        "conditions": [
          "x_1,x_2,x_3\\ \\text{distinct}"
        ],
        "explanation": {
          "zh-Hant": "改證逆否命題：若沒有相鄰逆序對，則 s∈Halt。排列的三項互不相同，依三分律「不是 x1>x2」且 x1≠x2 給出 x1<x2；同理 x2<x3。所以 x1<x2<x3。",
          "en": "Prove the contrapositive: if there is no adjacent inverted pair, then s∈Halt. The three entries of a permutation are distinct, so by trichotomy 'not x1>x2' with x1≠x2 gives x1<x2; likewise x2<x3. So x1<x2<x3."
        },
        "reverse_audit": {
          "kind": "premise_audit",
          "required_ids": [
            "order_basics",
            "contrapositive"
          ],
          "explanation": {
            "zh-Hant": "需要三項互異；若允許重複值，「不大於」只能得「小於或等於」。",
            "en": "It needs distinct entries; with repeated values, 'not greater' would give only 'less than or equal'."
          }
        },
        "leaf_basis": "order_basics + contrapositive"
      },
      {
        "id": "S03.2",
        "uses": [
          "S03.1",
          "order_basics"
        ],
        "before_tex": "x_1<x_2<x_3,\\ \\{x_1,x_2,x_3\\}=\\{1,2,3\\}",
        "after_tex": "(x_1,x_2,x_3)=(1,2,3)\\in\\mathrm{Halt}",
        "relation": "implies",
        "rule": "order_basics",
        "conditions": [],
        "explanation": {
          "zh-Hant": "x1 小於另外兩項（x1<x2，且依傳遞 x1<x3），所以 x1 是 {1,2,3} 的最小元 1；x3 大於另外兩項，所以 x3=3；剩下 x2=2。因此 s=123∈Halt。S03.1 與 S03.2 合起來，以逆否方式證得 L_succ。",
          "en": "x1 is smaller than the other two entries (x1<x2 and, by transitivity, x1<x3), so x1 is the least element 1 of {1,2,3}; x3 is larger than the other two, so x3=3; what remains is x2=2. Hence s=123∈Halt. S03.1 and S03.2 together prove L_succ by contraposition."
        },
        "reverse_audit": {
          "kind": "premise_audit",
          "required_ids": [
            "S03.1",
            "order_basics"
          ],
          "explanation": {
            "zh-Hant": "需要 s 是 1、2、3 的排列（S01）。",
            "en": "It needs s to be a permutation of 1, 2, 3 (S01)."
          }
        },
        "leaf_basis": "order_basics + contrapositive"
      },
      {
        "id": "S04",
        "uses": [
          "G1"
        ],
        "before_tex": "s=(x_1,x_2,x_3)",
        "after_tex": "\\mathrm{inv}(s)=[x_1>x_2]+[x_1>x_3]+[x_2>x_3]\\ge 0;\\ \\mathrm{inv}(321)=3,\\ \\mathrm{inv}(231)=\\mathrm{inv}(312)=2,\\ \\mathrm{inv}(213)=\\mathrm{inv}(132)=1,\\ \\mathrm{inv}(123)=0",
        "relation": "definition",
        "rule": "def_intro",
        "conditions": [],
        "explanation": {
          "zh-Hant": "定義排名函數 inv(s)：位置對 (i,j)、i<j 中 x_i>x_j 的個數。它是三個 0 或 1 的和，所以是 0 到 3 的自然數。逐一計算六個狀態的值（N2 到 N7 可重算）。",
          "en": "Define the ranking function inv(s): the number of position pairs (i,j) with i<j and x_i>x_j. It is a sum of three 0-or-1 terms, so it is a natural number between 0 and 3. Compute it for all six states (recomputable as N2 to N7)."
        },
        "reverse_audit": {
          "kind": "premise_audit",
          "required_ids": [
            "def_intro",
            "numeric_evaluation"
          ],
          "explanation": {
            "zh-Hant": "此步只定義與計算，不推出執行性質；inv≥0 由定義直接得到。",
            "en": "This step only defines and computes and derives no execution property; inv≥0 follows directly from the definition."
          }
        },
        "leaf_basis": "def_intro + numeric_evaluation"
      },
      {
        "id": "S05",
        "uses": [
          "S04",
          "G1"
        ],
        "before_tex": "(s,s')\\in\\mathrm{Step}",
        "after_tex": "\\mathrm{inv}(s')=\\mathrm{inv}(s)-1",
        "relation": "theorem_application",
        "rule": "L_rank",
        "conditions": [],
        "explanation": {
          "zh-Hant": "套用引理 L_rank（在 S05.1、S05.2 對兩種交換分別證明）：每一步都使逆序數恰好減 1。這是對每一種邊的證明，不是只在幾個樣本狀態上觀察。",
          "en": "Apply Lemma L_rank (proved separately for the two kinds of swap in S05.1 and S05.2): every step lowers the inversion count by exactly 1. This is a proof for every kind of edge, not an observation at a few sample states."
        },
        "reverse_audit": {
          "kind": "premise_audit",
          "required_ids": [
            "L_rank",
            "S04"
          ],
          "explanation": {
            "zh-Hant": "引理依賴「只交換逆序對」；在 M′ 中交換非逆序對會使 inv 增加，引理不適用。",
            "en": "The lemma depends on 'only inverted pairs are swapped'; in M′ swapping a non-inverted pair raises inv, and the lemma does not apply."
          }
        },
        "leaf_basis": "def_unfold + add_comm + numeric_evaluation"
      },
      {
        "id": "S05.1",
        "uses": [
          "S04",
          "G1"
        ],
        "before_tex": "x_1>x_2,\\ s'=(x_2,x_1,x_3)",
        "after_tex": "\\mathrm{inv}(s')=0+[x_2>x_3]+[x_1>x_3]=\\mathrm{inv}(s)-1",
        "relation": "implies",
        "rule": "def_unfold",
        "conditions": [
          "x_1>x_2"
        ],
        "explanation": {
          "zh-Hant": "交換前兩項：inv(s′)=[x2>x1]+[x2>x3]+[x1>x3]。因 x1>x2，[x2>x1]=0。而 inv(s)=[x1>x2]+[x1>x3]+[x2>x3]=1+[x1>x3]+[x2>x3]。其餘兩項只是交換了位置（加法交換律），所以 inv(s′)=inv(s)−1。",
          "en": "Swap the first two entries: inv(s′)=[x2>x1]+[x2>x3]+[x1>x3]. Since x1>x2, [x2>x1]=0. And inv(s)=[x1>x2]+[x1>x3]+[x2>x3]=1+[x1>x3]+[x2>x3]. The remaining two terms only change places (commutativity of addition), so inv(s′)=inv(s)−1."
        },
        "reverse_audit": {
          "kind": "premise_audit",
          "required_ids": [
            "S04",
            "def_unfold",
            "add_comm"
          ],
          "explanation": {
            "zh-Hant": "需要條件 x1>x2，這正是 M 允許此交換的條件。",
            "en": "It needs the condition x1>x2, which is exactly the condition under which M allows this swap."
          }
        },
        "leaf_basis": "def_unfold + add_comm + order_basics"
      },
      {
        "id": "S05.2",
        "uses": [
          "S04",
          "G1"
        ],
        "before_tex": "x_2>x_3,\\ s'=(x_1,x_3,x_2)",
        "after_tex": "\\mathrm{inv}(s')=[x_1>x_3]+[x_1>x_2]+0=\\mathrm{inv}(s)-1",
        "relation": "implies",
        "rule": "def_unfold",
        "conditions": [
          "x_2>x_3"
        ],
        "explanation": {
          "zh-Hant": "交換後兩項：inv(s′)=[x1>x3]+[x1>x2]+[x3>x2]。因 x2>x3，[x3>x2]=0，而 inv(s)=[x1>x2]+[x1>x3]+1。所以 inv(s′)=inv(s)−1。S05.1 與 S05.2 涵蓋 M 的兩種邊，證得 L_rank。",
          "en": "Swap the last two entries: inv(s′)=[x1>x3]+[x1>x2]+[x3>x2]. Since x2>x3, [x3>x2]=0, while inv(s)=[x1>x2]+[x1>x3]+1. So inv(s′)=inv(s)−1. S05.1 and S05.2 cover both kinds of edge in M, proving L_rank."
        },
        "reverse_audit": {
          "kind": "premise_audit",
          "required_ids": [
            "S04",
            "def_unfold",
            "add_comm",
            "case_analysis"
          ],
          "explanation": {
            "zh-Hant": "M 的邊只有這兩種，所以兩個情況窮盡。",
            "en": "M has only these two kinds of edge, so the two cases are exhaustive."
          }
        },
        "leaf_basis": "def_unfold + add_comm + order_basics + case_analysis"
      },
      {
        "id": "S06",
        "uses": [
          "S04",
          "G1"
        ],
        "before_tex": "(t_k)\\ \\text{an execution of}\\ M,\\ t_0\\in\\mathrm{Init}",
        "after_tex": "\\mathrm{inv}(t_0)=\\mathrm{inv}(321)=3",
        "relation": "induction_base",
        "rule": "nat_induction",
        "conditions": [],
        "explanation": {
          "zh-Hant": "考慮任意一條執行 (t_k)。t0∈Init={321}，所以 inv(t0)=3。這是不變量 inv(t_k)=3−k 的歸納基底（k=0）。",
          "en": "Consider any execution (t_k). t0∈Init={321}, so inv(t0)=3. This is the base case (k=0) of the invariant inv(t_k)=3−k."
        },
        "reverse_audit": {
          "kind": "premise_audit",
          "required_ids": [
            "S04",
            "G1",
            "nat_induction"
          ],
          "explanation": {
            "zh-Hant": "不變量在初始狀態成立；保持性在 S07。",
            "en": "The invariant holds at the initial state; preservation is S07."
          }
        },
        "leaf_basis": "nat_induction + numeric_evaluation"
      },
      {
        "id": "S07",
        "uses": [
          "S06",
          "S05"
        ],
        "before_tex": "\\mathrm{inv}(t_k)=3-k,\\ (t_k,t_{k+1})\\in\\mathrm{Step}",
        "after_tex": "\\mathrm{inv}(t_{k+1})=(3-k)-1=3-(k+1)",
        "relation": "induction_step",
        "rule": "nat_induction",
        "conditions": [],
        "explanation": {
          "zh-Hant": "設 inv(t_k)=3−k，且執行還有下一步 t_{k+1}。依 L_rank，inv(t_{k+1})=inv(t_k)−1=(3−k)−1=3−(k+1)。所以對執行中的每個索引 k，都有 inv(t_k)=3−k。不變量對每一步都證明了保持，不論在非確定的分岔中選了哪一條邊。",
          "en": "Assume inv(t_k)=3−k and that the execution has a next state t_{k+1}. By L_rank, inv(t_{k+1})=inv(t_k)−1=(3−k)−1=3−(k+1). So inv(t_k)=3−k for every index k of the execution. Preservation is proved for every step, whichever edge is chosen at a nondeterministic branch."
        },
        "reverse_audit": {
          "kind": "premise_audit",
          "required_ids": [
            "S06",
            "S05",
            "nat_induction"
          ],
          "explanation": {
            "zh-Hant": "歸納步用到 L_rank 對所有邊成立；算術恆等式由 N8 作一次多項式核對。",
            "en": "The induction step uses L_rank for every edge; the arithmetic identity is checked as a degree-one polynomial identity in N8."
          }
        },
        "leaf_basis": "nat_induction + eq_replace + add_assoc"
      },
      {
        "id": "S08",
        "uses": [
          "S07",
          "S04"
        ],
        "before_tex": "\\mathrm{inv}(t_k)=3-k\\ge 0",
        "after_tex": "k\\le 3:\\ \\text{every execution has at most 3 steps; no infinite execution}",
        "relation": "implies",
        "rule": "order_basics",
        "conditions": [],
        "explanation": {
          "zh-Hant": "inv 的值不小於 0，所以執行中任何索引 k 都滿足 3−k≥0，即 k≤3。因此每條執行至多有 4 個狀態、3 步，不存在無窮執行。這是排名函數論證：一個非負整數值每步嚴格下降，不能無限下降。",
          "en": "inv is never below 0, so every index k of an execution satisfies 3−k≥0, i.e. k≤3. Hence every execution has at most 4 states and 3 steps, and no infinite execution exists. This is the ranking-function argument: a nonnegative integer that strictly decreases at every step cannot decrease forever."
        },
        "reverse_audit": {
          "kind": "premise_audit",
          "required_ids": [
            "S07",
            "S04",
            "order_basics"
          ],
          "explanation": {
            "zh-Hant": "需要 inv≥0 與每步恰減 1。只排除無窮執行；是否停在 Halt 由 S09 處理。",
            "en": "It needs inv≥0 and a decrease of exactly 1 per step. It rules out infinite executions only; whether they stop in Halt is S09."
          }
        },
        "leaf_basis": "order_basics + nat_induction"
      },
      {
        "id": "S09",
        "uses": [
          "S08",
          "S03"
        ],
        "before_tex": "\\text{every execution is finite}",
        "after_tex": "\\text{every maximal execution ends in Halt:}\\ \\mathrm{T}",
        "relation": "implies",
        "rule": "contrapositive",
        "conditions": [],
        "explanation": {
          "zh-Hant": "由 S08，每條執行有限；只要末狀態還有後繼就可以延長，延長至多到 3 步，所以每條執行都可延伸成極大執行，其末狀態沒有後繼。依 L_succ 的逆否（S03），沒有後繼的狀態必在 Halt。所以每條從 Init 出發的極大執行都有限並以 Halt 結束；每條有限前綴亦可延伸到這樣的停止執行。依 S02，終止性 T 成立。",
          "en": "By S08 every execution is finite; it can be extended while its last state has a successor, at most up to 3 steps, so every execution extends to a maximal one whose last state has no successor. By the contrapositive of L_succ (S03), a state without successors lies in Halt. Thus every maximal execution from Init is finite and ends in Halt, and every finite prefix extends to such a halting execution. Termination T holds as defined in S02."
        },
        "reverse_audit": {
          "kind": "premise_audit",
          "required_ids": [
            "S08",
            "S03",
            "contrapositive"
          ],
          "explanation": {
            "zh-Hant": "T 需要兩件事：沒有無窮執行（S08）且沒有卡住（S03）；缺一不可。",
            "en": "T needs two facts: no infinite execution (S08) and no getting stuck (S03); neither can be dropped."
          }
        },
        "leaf_basis": "contrapositive + mko_computational_model_def"
      },
      {
        "id": "S10",
        "uses": [
          "S01",
          "G1",
          "G2"
        ],
        "before_tex": "t_{\\mathrm{last}}\\in\\mathrm{Halt}=\\{123\\}",
        "after_tex": "Q(123):\\ 1<2<3\\ \\wedge\\ \\{1,2,3\\}=\\{1,2,3\\}\\ \\Rightarrow\\ \\mathrm{PC}",
        "relation": "implies",
        "rule": "mko_algorithm_correctness_def",
        "conditions": [],
        "explanation": {
          "zh-Hant": "任何到達 Halt 的執行，末狀態都是 123。123 遞增，而且其項目是輸入 321 的項目的重排（S01：每個狀態都是 1、2、3 的排列，交換不改變項目）。所以 Q 在每個可到達的停止狀態成立，部分正確性 PC 成立。",
          "en": "Every execution reaching Halt ends at 123. 123 is increasing, and its entries are a rearrangement of the entries of the input 321 (S01: every state is a permutation of 1, 2, 3, and swaps do not change the entries). So Q holds at every reachable halt state, and partial correctness PC holds."
        },
        "reverse_audit": {
          "kind": "premise_audit",
          "required_ids": [
            "S01",
            "G2",
            "mko_algorithm_correctness_def"
          ],
          "explanation": {
            "zh-Hant": "PC 只談到達的停止狀態；它不推出 T，T 由 S09 另外證明。",
            "en": "PC speaks only about halt states that are reached; it does not imply T, which S09 proves separately."
          }
        },
        "leaf_basis": "mko_algorithm_correctness_def + order_basics"
      },
      {
        "id": "S11",
        "uses": [
          "S09",
          "S10",
          "S02"
        ],
        "before_tex": "\\mathrm{PC},\\ \\mathrm{T}",
        "after_tex": "\\mathrm{TC}=\\mathrm{PC}\\wedge\\mathrm{T}\\ \\text{holds for}\\ M",
        "relation": "implies",
        "rule": "and_intro_elim",
        "conditions": [],
        "explanation": {
          "zh-Hant": "合取 S10 的 PC 與 S09 的 T，依 S02 的定義得總正確性：從 321 出發的每條極大執行都終止，且終止時輸出遞增的重排 123。",
          "en": "Conjoin PC from S10 and T from S09; by the definition in S02 this is total correctness: every maximal execution from 321 terminates, and on termination outputs the increasing rearrangement 123."
        },
        "reverse_audit": {
          "kind": "sufficient_goal_reduction",
          "required_ids": [
            "S02",
            "S09",
            "S10",
            "and_intro_elim"
          ],
          "explanation": {
            "zh-Hant": "目標 TC；依定義足夠且必要的是 PC 與 T，兩者都由前面步驟正向證得，沒有把 TC 當前提。",
            "en": "Goal TC; by definition PC together with T is necessary and sufficient, and both were proved forwards above without assuming TC."
          }
        },
        "leaf_basis": "and_intro_elim + mko_algorithm_correctness_def"
      },
      {
        "id": "S12",
        "uses": [
          "G1",
          "S11"
        ],
        "before_tex": "\\text{reachable graph from}\\ 321",
        "after_tex": "321\\to 231\\to 213\\to 123,\\quad 321\\to 312\\to 132\\to 123",
        "relation": "implies",
        "rule": "mko_computational_model_def",
        "conditions": [],
        "explanation": {
          "zh-Hant": "有限模型可用完整可達圖交叉核對。321 有兩個後繼：交換前兩項得 231，交換後兩項得 312。231 只有後兩項逆序，得 213；312 只有前兩項逆序，得 132；213 得 123；132 得 123。所以恰有兩條極大執行，各 3 步，等於 inv(321)，都停在 123。這與 S07 到 S11 一致；但一般性證明來自 S05 到 S10，不依賴這張圖。",
          "en": "A finite model can be cross-checked with its complete reachable graph. 321 has two successors: swapping the first pair gives 231, swapping the last pair gives 312. 231 has only its last pair inverted, giving 213; 312 has only its first pair inverted, giving 132; 213 gives 123; 132 gives 123. So there are exactly two maximal executions, each of 3 steps, equal to inv(321), both ending at 123. This agrees with S07 to S11; the general proof, however, comes from S05 to S10 and does not depend on this graph."
        },
        "reverse_audit": {
          "kind": "premise_audit",
          "required_ids": [
            "G1",
            "mko_computational_model_def"
          ],
          "explanation": {
            "zh-Hant": "可達圖必須從每個可達狀態列出全部後繼才算完整；這裡六個狀態都已處理。",
            "en": "The reachable graph counts as complete only if all successors of every reachable state are listed; all six states are handled here."
          }
        },
        "leaf_basis": "mko_computational_model_def + case_analysis"
      },
      {
        "id": "S13",
        "uses": [
          "G3",
          "S02"
        ],
        "before_tex": "M':\\ 321\\to 231\\to 213\\to 123\\ \\text{exists}",
        "after_tex": "t_{2k}=321,\\ t_{2k+1}=231\\ \\text{is infinite}\\ \\Rightarrow\\ \\neg\\mathrm{T},\\ \\neg\\mathrm{TC}\\ \\text{for}\\ M'",
        "relation": "implies",
        "rule": "quantifier_negation",
        "conditions": [],
        "explanation": {
          "zh-Hant": "在 M′ 中，成功路徑 321→231→213→123 仍存在，而且 Halt 仍是 {123}，所以 PC 照樣成立。但 M′ 允許交換非逆序對：321 交換前兩項得 231，231 交換前兩項又回到 321，兩者都不在 Halt。序列 t_{2k}=321、t_{2k+1}=231 是合法的無窮執行，T 不成立，TC 不成立。一條成功路徑與 PC 都不足以得到總正確（MKO 誤解）。",
          "en": "In M′ the successful path 321→231→213→123 still exists, and Halt is still {123}, so PC still holds. But M′ allows swapping non-inverted pairs: swapping the first pair of 321 gives 231, and swapping the first pair of 231 returns to 321, neither in Halt. The sequence t_{2k}=321, t_{2k+1}=231 is a legal infinite execution, so T fails and TC fails. Neither one successful path nor PC yields total correctness (the misconception identified in the MKO)."
        },
        "reverse_audit": {
          "kind": "premise_audit",
          "required_ids": [
            "G3",
            "S02",
            "quantifier_negation"
          ],
          "explanation": {
            "zh-Hant": "一條無窮執行就否定全稱的 T。索引分偶數與奇數兩種，涵蓋所有 n≥0；交替的兩條邊 321→231 與 231→321 都是 M′ 的邊。",
            "en": "One infinite execution refutes the universal T. Indices split into even and odd, covering every n≥0; the two alternating edges 321→231 and 231→321 are both edges of M′."
          }
        },
        "leaf_basis": "quantifier_negation + case_analysis + mko_algorithm_correctness_def"
      },
      {
        "id": "S14",
        "uses": [
          "G3",
          "G2",
          "S02"
        ],
        "before_tex": "M'':\\ \\mathrm{Halt}''=\\{s\\mid x_1<x_2\\}=\\{123,132,231\\}",
        "after_tex": "321\\to 231\\in\\mathrm{Halt}'',\\ \\neg Q(231)\\ \\Rightarrow\\ \\neg\\mathrm{PC},\\ \\neg\\mathrm{TC}\\ \\text{for}\\ M''",
        "relation": "implies",
        "rule": "quantifier_negation",
        "conditions": [],
        "explanation": {
          "zh-Hant": "在 M″ 中，從 321 出發的極大執行只有兩條：321→231（231 的 2<3，屬於 Halt″，停止）與 321→312→132（132 屬於 Halt″，停止）。兩條都停止，所以 T 成立；但停止狀態 231 不遞增（3>1），Q(231) 為假，PC 不成立，TC 也不成立。終止本身不保證正確。",
          "en": "In M″ there are only two maximal executions from 321: 321→231 (231 has 2<3, so it is in Halt″ and stops) and 321→312→132 (132 is in Halt″ and stops). Both stop, so T holds; but the halt state 231 is not increasing (3>1), so Q(231) is false, PC fails, and TC fails too. Termination by itself does not guarantee correctness."
        },
        "reverse_audit": {
          "kind": "premise_audit",
          "required_ids": [
            "G3",
            "G2",
            "quantifier_negation"
          ],
          "explanation": {
            "zh-Hant": "否定 PC 只需一個到達的停止狀態不滿足 Q；T 的判定來自兩條極大執行的完整列舉。",
            "en": "Refuting PC needs one reached halt state violating Q; the verdict on T comes from the complete enumeration of the two maximal executions."
          }
        },
        "leaf_basis": "quantifier_negation + mko_algorithm_correctness_def"
      }
    ],
    "result": {
      "zh-Hant": "對 M：每步使逆序數恰減 1，所以每條執行至多 3 步；非 Halt 狀態都有後繼，所以每條極大執行停在 123；123 滿足後置條件。故 M 部分正確、終止、總正確；可達圖恰有兩條極大執行，各 3 步。M′ 部分正確且有成功路徑，但有無窮執行 321↔231，不是總正確；M″ 終止，但停在未排序的 231，不是部分正確。",
      "en": "For M: each step lowers the inversion count by exactly 1, so every execution takes at most 3 steps; every non-halt state has a successor, so every maximal execution stops at 123; 123 satisfies the postcondition. So M is partially correct, terminating and totally correct; its reachable graph has exactly two maximal executions, each of 3 steps. M′ is partially correct and has a successful path, but has the infinite execution alternating 321 and 231, so it is not totally correct; M″ terminates but can stop at the unsorted 231, so it is not partially correct."
    },
    "negative_controls": [
      {
        "claim": {
          "zh-Hant": "M′ 有成功路徑 321→231→213→123，所以 M′ 總正確",
          "en": "M′ has the successful path 321→231→213→123, so M′ is totally correct"
        },
        "expected": "reject",
        "reason": {
          "zh-Hant": "M′ 有無窮執行 321→231→321→231 不斷交替，T 不成立。",
          "en": "M′ has the infinite execution alternating 321→231→321→231 forever, so T fails."
        }
      },
      {
        "claim": {
          "zh-Hant": "M′ 部分正確，所以 M′ 終止",
          "en": "M′ is partially correct, so M′ terminates"
        },
        "expected": "reject",
        "reason": {
          "zh-Hant": "PC 不含終止；M′ 的 PC 成立而 T 不成立。",
          "en": "PC does not include termination; for M′, PC holds and T fails."
        }
      },
      {
        "claim": {
          "zh-Hant": "M″ 的每條執行都停止，所以 M″ 總正確",
          "en": "Every execution of M″ stops, so M″ is totally correct"
        },
        "expected": "reject",
        "reason": {
          "zh-Hant": "M″ 會停在 231，它不是遞增排列，PC 不成立。",
          "en": "M″ can stop at 231, which is not increasing, so PC fails."
        }
      },
      {
        "claim": {
          "zh-Hant": "永不停止的程式不是部分正確的",
          "en": "A program that never halts is not partially correct"
        },
        "expected": "reject",
        "reason": {
          "zh-Hant": "沒有到達任何停止狀態時，PC 空真成立；它不是總正確，但是部分正確。",
          "en": "When no halt state is ever reached, PC holds vacuously; such a program is not totally correct, but it is partially correct."
        }
      }
    ],
    "status": "candidate",
    "gaps": [],
    "verification": {
      "structure": "checked_local_script",
      "mathematics": "candidate_argument",
      "formalization": "not_formalized"
    },
    "rule_glossary": [
      {
        "id": "order_basics",
        "kind": "prerequisite",
        "statement": {
          "zh-Hant": "實數的序：任兩數恰有 u<v、u=v、u>v 之一；u<v 且 v<w 推出 u<w；u<v 推出 u+w<v+w；u<v 且 w>0 推出 uw<vw；u<v 且 w<0 推出 uw>vw。",
          "en": "Order of the reals: exactly one of u<v, u=v, u>v holds; u<v and v<w give u<w; u<v gives u+w<v+w; u<v and w>0 give uw<vw; u<v and w<0 give uw>vw."
        }
      },
      {
        "id": "nat_induction",
        "kind": "prerequisite",
        "statement": {
          "zh-Hant": "數學歸納原理：對從 n₀ 起的命題族 P(n)，若 P(n₀) 成立，且對每個 n≥n₀ 都有 P(n)⇒P(n+1)，則所有 n≥n₀ 都有 P(n)。",
          "en": "Principle of induction: for a family P(n) starting at n₀, if P(n₀) holds and P(n)⇒P(n+1) for every n≥n₀, then P(n) holds for every n≥n₀."
        }
      },
      {
        "id": "finite_counting_basics",
        "kind": "prerequisite",
        "statement": {
          "zh-Hant": "有限計數：互斥有限集合 A、B 有 |A∪B|=|A|+|B|；|A×B|=|A|·|B|；有限集之間存在雙射 ⇔ 元素個數相同。",
          "en": "Finite counting: for disjoint finite sets A, B, |A∪B|=|A|+|B|; |A×B|=|A|·|B|; there is a bijection between finite sets ⇔ they have the same number of elements."
        }
      },
      {
        "id": "numeric_evaluation",
        "kind": "prerequisite",
        "statement": {
          "zh-Hant": "明確整數或有理數算式的精確求值；可以獨立重算。",
          "en": "Exact evaluation of an explicit integer or rational expression; independently recomputable."
        }
      },
      {
        "id": "def_intro",
        "kind": "prerequisite",
        "statement": {
          "zh-Hant": "引入定義：可為一個命題、式子或物件取名；之後名稱與被定義者可互相替換。",
          "en": "Introducing a definition: a statement, expression or object may be given a name, after which the name and what it stands for are interchangeable."
        }
      },
      {
        "id": "subset_def",
        "kind": "prerequisite",
        "statement": {
          "zh-Hant": "子集：A⊆B 表示 A 的每個元素都是 B 的元素，即 ∀x (x∈A⇒x∈B)。",
          "en": "Subset: A⊆B means every element of A is an element of B, i.e. ∀x (x∈A⇒x∈B)."
        }
      },
      {
        "id": "cartesian_product_def",
        "kind": "prerequisite",
        "statement": {
          "zh-Hant": "笛卡兒積：A×B 是所有有序對 (a,b)（a∈A、b∈B）的集合；(a,b)=(c,d) ⇔ a=c 且 b=d。",
          "en": "Cartesian product: A×B is the set of ordered pairs (a,b) with a∈A and b∈B; (a,b)=(c,d) ⇔ a=c and b=d."
        }
      },
      {
        "id": "def_unfold",
        "kind": "prerequisite",
        "statement": {
          "zh-Hant": "展開定義：把一個已定義的詞換成它的定義內容（或反向收回），命題的真假不變。",
          "en": "Unfolding a definition: replacing a defined term by its definition (or folding it back) does not change whether a statement is true."
        }
      },
      {
        "id": "contrapositive",
        "kind": "prerequisite",
        "statement": {
          "zh-Hant": "逆否命題：P⇒Q 與 ¬Q⇒¬P 等價。逆命題 Q⇒P 一般不與 P⇒Q 等價。",
          "en": "Contrapositive: P⇒Q is equivalent to ¬Q⇒¬P. The converse Q⇒P is in general not equivalent to P⇒Q."
        }
      },
      {
        "id": "add_comm",
        "kind": "prerequisite",
        "statement": {
          "zh-Hant": "加法交換律：u+v=v+u。",
          "en": "Commutativity of addition: u+v=v+u."
        }
      },
      {
        "id": "case_analysis",
        "kind": "prerequisite",
        "statement": {
          "zh-Hant": "分情況論證：若 P∨Q 成立，且 P⇒R、Q⇒R 都已證，則 R 成立。所有情況必須涵蓋全部可能。",
          "en": "Proof by cases: if P∨Q holds and both P⇒R and Q⇒R are proved, then R holds. The cases must cover every possibility."
        }
      },
      {
        "id": "eq_replace",
        "kind": "prerequisite",
        "statement": {
          "zh-Hant": "等值代換：命題中的一個式子可換成與它相等的式子，命題的真假不變。",
          "en": "Replacement of equals: an expression inside a statement may be replaced by an equal expression without changing whether the statement is true."
        }
      },
      {
        "id": "add_assoc",
        "kind": "prerequisite",
        "statement": {
          "zh-Hant": "加法結合律：(u+v)+w=u+(v+w)。",
          "en": "Associativity of addition: (u+v)+w=u+(v+w)."
        }
      },
      {
        "id": "and_intro_elim",
        "kind": "prerequisite",
        "statement": {
          "zh-Hant": "合取：由 P 與 Q 得 P∧Q；由 P∧Q 可分別得 P 與 Q。",
          "en": "Conjunction: from P and Q infer P∧Q; from P∧Q infer P and infer Q."
        }
      },
      {
        "id": "quantifier_negation",
        "kind": "prerequisite",
        "statement": {
          "zh-Hant": "量詞否定：¬(∀x, P(x)) 等價於 ∃x, ¬P(x)；¬(∃x, P(x)) 等價於 ∀x, ¬P(x)。",
          "en": "Negating quantifiers: ¬(∀x, P(x)) is equivalent to ∃x, ¬P(x), and ¬(∃x, P(x)) is equivalent to ∀x, ¬P(x)."
        }
      },
      {
        "id": "mko_algorithm_correctness_def",
        "kind": "cited",
        "source": {
          "mko_id": "mko-algorithm-correctness",
          "sha256": "d9789607b7391a897a2a291245a0699d81ef6dbbdfac86b9b86c04cf7dc0ad27",
          "commit": "b28a5edbd46279b1db2a3f3f48bb3f447e18899f"
        },
        "statement": {
          "zh-Hant": "相對初始條件與後置條件，部分正確性表示每個從合法初始狀態到達的停止狀態都滿足後置條件；終止性表示每個合法執行最終到達停止狀態；總正確性是兩者的合取。",
          "en": "Relative to initial conditions and a postcondition, partial correctness says every halt reached from a legal initial state satisfies the postcondition. Termination says every legal execution eventually reaches a halt. Total correctness is their conjunction."
        }
      },
      {
        "id": "mko_computational_model_def",
        "kind": "cited",
        "source": {
          "mko_id": "mko-computational-model",
          "sha256": "ceedb5463ff015fc7cd0f74870bfb9033cfb9a8ff893490b0335fe4bf9112ace",
          "commit": "b28a5edbd46279b1db2a3f3f48bb3f447e18899f"
        },
        "statement": {
          "zh-Hant": "有限抽象模型 (S,Init,Step,Halt)，Init,Halt⊆S、Step⊆S×S；執行從 Init 開始沿 Step 前進，進入 Halt 即結束；無後繼的狀態不因而自動屬於 Halt。",
          "en": "A finite abstract model (S,Init,Step,Halt) with Init,Halt⊆S and Step⊆S×S; executions start in Init, follow Step and end on entering Halt; a state without successors is not automatically in Halt."
        }
      },
      {
        "id": "L_succ",
        "kind": "lemma",
        "proved_in": [
          "S03.1",
          "S03.2"
        ],
        "statement": {
          "zh-Hant": "在 M 中，每個 s∈S∖Halt 都至少有一個相鄰逆序對，因此至少有一個 Step 後繼。",
          "en": "In M, every s∈S∖Halt has at least one adjacent inverted pair and hence at least one Step-successor."
        }
      },
      {
        "id": "L_rank",
        "kind": "lemma",
        "proved_in": [
          "S05.1",
          "S05.2"
        ],
        "statement": {
          "zh-Hant": "在 M 中，若 (s,s′)∈Step，則 inv(s′)=inv(s)−1。",
          "en": "In M, if (s,s′)∈Step then inv(s′)=inv(s)−1."
        }
      }
    ],
    "revision_log": [],
    "numeric_checks": [
      {
        "id": "N1",
        "step": "S01",
        "lhs": "factorial(3)",
        "rhs": "6"
      },
      {
        "id": "N2",
        "step": "S04",
        "lhs": "max(min(3-2,1),0)+max(min(3-1,1),0)+max(min(2-1,1),0)",
        "rhs": "3"
      },
      {
        "id": "N3",
        "step": "S04",
        "lhs": "max(min(2-3,1),0)+max(min(2-1,1),0)+max(min(3-1,1),0)",
        "rhs": "2"
      },
      {
        "id": "N4",
        "step": "S04",
        "lhs": "max(min(3-1,1),0)+max(min(3-2,1),0)+max(min(1-2,1),0)",
        "rhs": "2"
      },
      {
        "id": "N5",
        "step": "S04",
        "lhs": "max(min(2-1,1),0)+max(min(2-3,1),0)+max(min(1-3,1),0)",
        "rhs": "1"
      },
      {
        "id": "N6",
        "step": "S04",
        "lhs": "max(min(1-3,1),0)+max(min(1-2,1),0)+max(min(3-2,1),0)",
        "rhs": "1"
      },
      {
        "id": "N7",
        "step": "S04",
        "lhs": "max(min(1-2,1),0)+max(min(1-3,1),0)+max(min(2-3,1),0)",
        "rhs": "0"
      },
      {
        "id": "N8",
        "step": "S07",
        "vars": [
          "k"
        ],
        "degree": 1,
        "lhs": "(3-k)-1",
        "rhs": "3-(k+1)"
      }
    ]
  },
  "presentation": {
    "md_scope": {
      "zh-Hant": "在 MKO 範圍內工作：使用前一條目的有限狀態模型，Halt 狀態為執行終點（假設 a1）；模型非確定性，責任針對所有可能執行（假設 a2）。不處理 Hoare 邏輯的一般規則、公平性或實際程式語言語義，不改動 canonical MKO 或英文 edition。",
      "en": "Works inside the MKO's scope: the finite-state model of the preceding entry, with Halt states as execution endpoints (assumption a1); the model is nondeterministic and the obligations concern every possible execution (assumption a2). General Hoare-logic rules, fairness and the semantics of real programming languages are not treated, and the canonical MKO and its English edition are not changed."
    },
    "md_symbols": [
      [
        "s=(x_1,x_2,x_3)",
        "狀態：1、2、3 的一個排列，簡寫為 x1x2x3，例如 321",
        "a state: a permutation of 1, 2, 3, abbreviated x1x2x3, e.g. 321"
      ],
      [
        "Q(s)",
        "後置條件：遞增且為輸入的重排",
        "the postcondition: increasing and a rearrangement of the input"
      ],
      [
        "\\mathrm{inv}(s)",
        "逆序數 [x1>x2]+[x1>x3]+[x2>x3]",
        "the inversion count [x1>x2]+[x1>x3]+[x2>x3]"
      ],
      [
        "[P]",
        "P 為真時取 1，否則取 0",
        "1 if P is true, 0 otherwise"
      ],
      [
        "\\mathrm{PC},\\ \\mathrm{T},\\ \\mathrm{TC}",
        "部分正確、終止、總正確",
        "partial correctness, termination, total correctness"
      ],
      [
        "M',\\ M''",
        "兩個對照變體",
        "the two contrast variants"
      ]
    ],
    "md_error_controls": [
      {
        "title": "一條成功路徑不是總正確 / One successful path is not total correctness",
        "zh": "MKO 指出的誤解是把一條成功 trace 或「輸出正確但可能不停」當成總正確。M′ 有成功路徑 321→231→213→123，PC 也成立，卻有無窮執行（S13）。非確定性模型的責任針對所有執行（MKO 假設 a2）。",
        "en": "The misconception identified in the MKO is taking one successful trace, or 'correct output but possibly non-terminating', as total correctness. M′ has the successful path 321→231→213→123 and satisfies PC, yet has an infinite execution (S13). In a nondeterministic model the obligations concern every execution (MKO assumption a2)."
      },
      {
        "title": "部分正確可以空真成立 / Partial correctness can hold vacuously",
        "zh": "PC 只要求「到達的停止狀態」滿足 Q。一個永不停止的模型（例如只有邊 321→321 而 Halt 不可達）沒有任何停止狀態可檢查，PC 空真成立，但 T 不成立。所以 PC 不能冒充 TC（MKO 第二段）。",
        "en": "PC only requires reached halt states to satisfy Q. A model that never stops (for example with the single edge 321→321 and Halt unreachable) has no halt state to check, so PC holds vacuously while T fails. So PC cannot stand in for TC (MKO paragraph 2)."
      },
      {
        "title": "不變量要對每一步證明 / An invariant must be proved for every step",
        "zh": "「inv 每步減 1」在 S05 對 M 的兩種邊都證明了。若只在樣本轉移上觀察，例如在 M′ 中看到 321→231 使 inv 由 3 變 2，就會漏掉 231→321 使 inv 由 2 變 3 的邊。初始成立加上逐步保持才是證明（MKO 第一段）。",
        "en": "'inv drops by 1 at each step' was proved in S05 for both kinds of edge in M. Observing it only on sample transitions, for example seeing 321→231 take inv from 3 to 2 in M′, would miss the edge 231→321 taking inv from 2 to 3. Establishment plus preservation at every step is what makes a proof (MKO paragraph 1)."
      }
    ],
    "md_open_items": [
      {
        "zh-Hant": "Hoare 式規格、一般的排名函數方法、非確定性公平性與實際程式語義的橋接（MKO formal next）未在此建立；本稿只處理一個明示的有限模型。",
        "en": "Hoare-style specifications, the general ranking-function method, nondeterministic fairness and the bridge to real program semantics (MKO formal next) are not built here; this guide handles one explicit finite model only."
      }
    ]
  },
  "revision": {
    "id": "production-20261019-adopted-96",
    "source_commit": "b28a5edbd46279b1db2a3f3f48bb3f447e18899f",
    "adopted_source_sha256": "9ce0cffb4623aaaff23ae8c54c93395ecd56ec9621219ba8168ae49c7873d238",
    "original_source_sha256": "9ce0cffb4623aaaff23ae8c54c93395ecd56ec9621219ba8168ae49c7873d238",
    "owner_adopted": true,
    "bilingual_sync": "complete_source_bound",
    "formal_Lean": "NOT_RUN",
    "independent_AI_concurrence": "NOT_MEASURED",
    "issue_ids": [],
    "scope": "Owner-adopted natural-language teaching guide; not a formal proof, canonical MKO rewrite or evidence-status promotion."
  }
}