Handle indeterminate-order multiple operation calls

Develop a method for generating proof obligations for expressions containing multiple operation calls whose evaluation order cannot be determined statically.

Background

The proof-obligation generator extracts operation calls from expressions and processes them in tool evaluation order. This works when the number and order of calls can be determined statically, but expressions such as set comprehensions may generate an unknown number of calls. The paper states that these cases are not yet handled and that the resulting proof obligations are marked as “UNCHECKED.”

References

In addition, as noted in Section~\ref{sec:returns}, we cannot yet deal with multiple operation calls in an expression where the order of those calls cannot be statically determined.

— Further Progress Towards Operation Proof Obligation Generation for VDM  (2608.19848 - Battle et al., 20 Aug 2026) in Section 6, Future Work; see also Section 4.2, “Return Values”

Furthermore, Section \ref{sec:opcalls} noted that inter-module calls cannot yet determine how local state is updated, leading to under-qualified POs.

— Further Progress Towards Operation Proof Obligation Generation for VDM  (2608.19848 - Battle et al., 20 Aug 2026) in Section 6, Future Work; see also Section 4.1, “Simple Calls”

This family answers a different question from the one CompProv poses. Its tools ask whether a result is numerically trustworthy; CompProv asks whether a result's derivation is recorded and auditable at all, a question that remains open even when every operation executes with full precision and no rounding error occurs.

— CompProv Produces Machine Readable Graphs Encoding Microscopic Algebraic Provenance for Reproducible Computation  (2610.01203 - Abramyan et al., 1 Oct 2026) in Section 2.3, Numerical Accuracy and Rounding-Error Diagnostics