fix(phl): check the bound of the upper-bound while rule on all memories

Summary: the pHL `while` tactic (invariant only, `<=`) accepted
`phoare[M.p : true ==> false] <= (-1%r)` for `while (true) {}` (upstream
#1102), and likewise with the invariant `false` and a diverging prefix.

Root cause (src/phl/ecPhlWhile.ml, `t_bdhoare_while_rev_r`): the rule is a
fixpoint induction whose base case (the loop diverges: probability 0) and
exit case need `0%r <= bd`, and whose exit case needs
`inv /\ !e /\ post => bd = 1%r`. The exit condition was emitted inside the
post-condition of the hoare judgment on the prefix, which only has to hold
on its terminating runs, and `0%r <= bd` was not required at all, so a
diverging loop -- or a diverging prefix with the invariant `false` -- proved
any bound.

Fix: the prefix goal becomes `hoare[s : pre ==> inv]`; the exit condition
`forall &hr, inv /\ !e /\ post => bd = 1%r` and the non-negativity
`forall &hr, 0%r <= bd` are emitted by the rule as separate goals quantified
over all memories (always, in this order, after the body and prefix goals).
Based on #1105: under its semantics the bound must be non-negative in every
memory, so the goal is unconditional (restricting it to `pre \/ inv` would
still let the rule prove a judgment whose bound is negative outside them).
The `while` tactic (`process_while`) tries `t_trivial` on the two of them
so trivial cases stay effort-free. examples/PRG.ec closes the two relocated
goals.

Test: tests/phoare-while-neg-bound.ec (invariants `true` and `false`). The
remaining goal `forall &hr, 0%r <= -1%r` is introduced with `move=> &hr`
(which fails when the goal is not emitted) and asserted unprovable with
`fail (by smt())`.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Author: Yiping106283

examples/PRG.ec

@@ -551,7 +551,11 @@ section.
     rewrite
       (@BIA.big_cat_int (qF + size P.logP{hr} + 1) (_ + List.size _))
       ?BIA.big_int1 /#.
-  by skip; progress=> /#.
+  + by skip; progress=> /#.
+  + by move=> &hr [#] _ _ _ ->.
+  move=> &hr; case: (Bad P.logP{hr} F.m{hr})=> //=.
+  apply/divr_ge0; 2:smt(Support.card_gt0).
+  by apply/le_fromint/Bigint.sumr_ge0_seq=> a /mem_range; smt(ge0_qF size_ge0).
   qed.
 
   lemma conclusion &m:

src/phl/ecPhlWhile.ml

@@ -185,19 +185,39 @@ let t_bdhoare_while_rev_r inv tc =
       f_imp while_jgmt unfolded_while_jgmt
   in
 
-  (* 2. Sub-goal *)
-  let rem_concl =
-    let modi = s_write env lp_body in
+  (* 2. Sub-goal: the prefix establishes the invariant *)
+  let rem_concl = f_hoareS mt b_pre rem_s (POE.lift inv) in
+
+  (* 3. Sub-goal: on exit with the post-condition, the bound is 1.
+     4. Sub-goal: the bound is non-negative.
+
+     Both are conditions on the bound that justify the transformation, not
+     conditions on the behaviour of [rem_s]: they are needed for every memory
+     the loop may start from (3, 4) and, since a non-terminating run of
+     [rem_s] contributes probability 0 to the conclusion, for every memory
+     satisfying the pre-condition (4). They are therefore emitted quantified
+     over all memories and NOT inside the (partial-correctness) post-condition
+     of sub-goal 2, which only has to hold on terminating runs of [rem_s].
+     Moreover a pHL judgment is false as soon as its bound is negative in
+     some memory (whether or not that memory satisfies the pre-condition),
+     so (4) is required unconditionally. *)
+  let exit_concl =
     let term_post = map_ss_inv2 f_imp
       (map_ss_inv2 f_and inv (map_ss_inv2 f_and (map_ss_inv1 f_not lp_guard) b_post))
       (map_ss_inv2 f_eq bound {m;inv=f_r1}) in
-    let term_post = generalize_mod_ss_inv env modi term_post in
-    let term_post = map_ss_inv2 f_and inv term_post in
-    let post = { hsi_m = term_post.m; hsi_inv = POE.empty term_post.inv; } in
-    f_hoareS mt b_pre rem_s post
+    EcSubst.f_forall_mems_ss_inv mem term_post
+  in
+
+  let nonneg_concl =
+    EcSubst.f_forall_mems_ss_inv mem
+      (map_ss_inv2 f_real_le {m;inv=f_r0} bound)
   in
 
-  FApi.xmutate1_hyps tc `While [(hyps', body_concl); (hyps, rem_concl)]
+  FApi.xmutate1_hyps tc `While
+    [(hyps', body_concl  );
+     (hyps , rem_concl   );
+     (hyps , exit_concl  );
+     (hyps , nonneg_concl)]
 
 (* -------------------------------------------------------------------- *)
 (* Rule for = or >= *)
@@ -580,7 +600,12 @@ let process_while side winfos tc =
         t_bdhoare_while_rev_geq phi vrnt k eps tc
       | None, None ->
           let _, phi = TTC.tc1_process_Xhl_formula tc phi in
-          t_bdhoare_while_rev phi tc
+          (* [t_bdhoare_while_rev] emits the bound side-conditions (exit
+             bound, non-negativity) as the last two goals; try to close them
+             automatically so trivial cases stay effort-free. *)
+          FApi.t_onalli
+            (function 2 | 3 -> FApi.t_try t_trivial | _ -> t_id)
+            (t_bdhoare_while_rev phi tc)
 
       | None, Some _ ->
         tc_error !!tc "invalid arguments"

tests/phoare-while-neg-bound.ec

@@ -0,0 +1,39 @@
+(* pHL `while` with an invariant only, upper bound (upstream #1102): the
+   conditions on the bound (`inv /\ !e /\ post => bd = 1%r`, `0%r <= bd`)
+   must be goals quantified over all memories, not part of the
+   post-condition of the hoare judgment on the statements preceding the
+   loop, which a diverging prefix or a never-established invariant
+   discharges vacuously. Under #1105 a pHL judgment with a bound that is
+   negative in some memory is false, so the non-negativity goal is
+   unconditional. Here `0%r <= -1%r` must remain, unprovable. *)
+require import AllCore Real.
+
+module M = { proc p() = { while (true) {} } }.
+
+lemma bad : phoare[M.p : true ==> false] <= (-1%r).
+proof.
+proc.
+while (true).
++ auto.
++ done.
+(* remaining goal: forall &hr, 0%r <= -1%r *)
+move=> &hr.
+fail (by smt()).
+abort.
+
+(* Invariant `false`, "established" by a diverging prefix: only the
+   non-negativity of the bound rejects it. *)
+module N = { proc p() = { while (true) {} while (true) {} } }.
+
+lemma bad' : phoare[N.p : true ==> false] <= (-1%r).
+proof.
+proc.
+while false.
++ auto.
++ while true.
+  + done.
+  done.
+(* remaining goal: forall &hr, 0%r <= -1%r *)
+move=> &hr.
+fail (by smt()).
+abort.