Handle indeterminate-order multiple operation calls

Develop a method for generating proof obligations for expressions containing multiple operation calls whose evaluation order cannot be determined statically.

Background

The proof-obligation generator extracts operation calls from expressions and processes them in tool evaluation order. This works when the number and order of calls can be determined statically, but expressions such as set comprehensions may generate an unknown number of calls. The paper states that these cases are not yet handled and that the resulting proof obligations are marked as “UNCHECKED.”

References

In addition, as noted in Section~\ref{sec:returns}, we cannot yet deal with multiple operation calls in an expression where the order of those calls cannot be statically determined.

— Further Progress Towards Operation Proof Obligation Generation for VDM  (2608.19848 - Battle et al., 20 Aug 2026) in Section 6, Future Work; see also Section 4.2, “Return Values”

Furthermore, Section \ref{sec:opcalls} noted that inter-module calls cannot yet determine how local state is updated, leading to under-qualified POs.

— Further Progress Towards Operation Proof Obligation Generation for VDM  (2608.19848 - Battle et al., 20 Aug 2026) in Section 6, Future Work; see also Section 4.1, “Simple Calls”