All-Path Reachability Proofs

• All-path reachability proofs are techniques that guarantee every execution path from a designated source reaches a target state, ensuring universal partial correctness.
• They employ coinductive calculi and cyclic proof strategies to symbolically cover all successors, handling both terminating and infinite execution paths.
• These methods bridge operational semantics with modular verification, integrating compositional proof systems and separation-logic techniques for local reasoning.

All-path reachability proofs establish universal-style reachability properties: from a designated source description, every relevant execution path reaches a designated target description. In the literature on logically constrained term rewriting systems (LCTRSs), this is formulated as demonic validity: from any initial state satisfying the left-hand constrained term, every terminating execution path must eventually reach the right-hand constrained term, while infinite paths count as vacuously satisfying the property (Ciobâcă et al., 2018). In language-independent reachability logic, the corresponding judgment states that for every complete execution path starting from a state satisfying a precondition, some state on that path satisfies the postcondition (Stefanescu et al., 2018). The subject is therefore centered on universal path quantification, coinductive semantics, proof systems that symbolically cover all successors, and finite cyclic proof devices that represent infinite reasoning.

1. Semantic core of all-path reachability

The semantic hallmark of all-path reachability is the shift from existential to universal path quantification. In the LCTRS account, a reachability property is a pair of state predicates $\langle P,Q\rangle$, and it is valid iff every execution path starting in $P$ eventually reaches $Q$, or the path is infinite. The induced coinductive characterization of valid reachability predicates is given by the rules

$${\sf Subsumption}\quad \frac{}{ \langle P,Q\rangle}\qquad P\subseteq Q$$

and

$${\sf Step}\quad \frac{\langle \partial(P\setminus Q),Q\rangle}{\langle P,Q\rangle} \qquad P\setminus Q\ \text{runnable}.$$

For constrained terms $\varphi=\{t\mid \phi\}$ and $\varphi'=\{t'\mid \phi'\}$, demonically satisfying $\varphi \Rightarrow \varphi'$ means that for every valuation of the shared variables, every terminating execution from the left instance reaches the right instance (Ciobâcă et al., 2018).

Language-independent all-path reachability logic draws the same distinction at the level of operational semantics. It treats the semantics as a set of unconditional reduction rules and explicitly separates one-path / existential reachability from all-path reachability. The all-path reading is: for every complete execution path starting from a state satisfying $\varphi$, some state on that path satisfies $\varphi'$. The paper presents this as an all-path, partial-correctness interpretation and motivates it by nondeterministic and concurrent languages, where one successful execution is insufficient (Stefanescu et al., 2018).

A central conceptual distinction follows immediately. All-path reachability is not the same as existential reachability, and it is not, in general, a termination claim. In the LCTRS framework, infinite paths satisfy the property vacuously; in the operational-semantics framework, the logic is explicitly presented as partial correctness for nondeterministic and concurrent programs. This places all-path reachability alongside universal partial correctness rather than total correctness.

2. Coinductive calculi over rewriting systems and operational semantics

Two canonical calculi make the universal semantics proof-theoretic. For LCTRSs, the symbolic system $P$0 uses three rules: [axiom], [subs], and $P$1. The [axiom] rule applies when the left constraint is unsatisfiable. The [subs] rule removes the part of the current left-hand side that is already covered by the right-hand side. The $P$2 rule computes all symbolic successors

$P$3

and requires all of them to satisfy the same target. The meta-theoretic result is exact: $P$4 The same framework proves the commutation theorem

$P$5

so symbolic derivatives correspond exactly to semantic successors (Ciobâcă et al., 2018).

The language-independent system of all-path reachability logic is organized around sequents of the form $P$6, where $P$7 is a set of already accepted axioms and $P$8 is a set of tentative circularities. Its rules are Step, Axiom, Reflexivity, Transitivity, Case analysis, Consequence, Abstraction, Logic framing, and Circularity. Step is the rule that handles branching: it requires that every state satisfying the current precondition can take a semantics step and that every successor generated by each matching semantics rule satisfies the target. The system is sound and relatively complete; its soundness has been mechanized in Coq; and the approach is implemented in the K framework, where verification uses symbolic execution via narrowing and pure constraints are discharged by Z3 (Stefanescu et al., 2018).

These two developments share a common proof-theoretic pattern. A goal is discharged either because it is already covered by the target, or because all immediate successor obligations are discharged. In the rewriting setting this is expressed through symbolic derivatives; in the operational-semantics setting it is expressed through unification against the left-hand sides of semantics rules. In both cases, universal branching is the essential feature.

3. Circularity, guarded cyclic proofs, and compositionality

Because universal symbolic execution can unfold indefinitely, finite proof objects require a disciplined form of cyclic reasoning. In the LCTRS framework, the system $P$9 extends $Q$0 with a [circ] rule. If the current goal matches a previously stated goal in the finite set $Q$1, the proof may “close the loop” and continue from the circularity’s right-hand side, while a complementary $Q$2 branch handles the non-matching case. This compression is sound only under a guardedness condition: a $Q$3 node is guarded iff it has an ancestor that is a $Q$4 node, and a proof tree is guarded iff all $Q$5 nodes are guarded. The resulting Circularity Principle,

$Q$6

is proved by constructing an increasing chain of proof trees

$Q$7

whose limit contains no $Q$8-nodes and is therefore a valid $Q$9 proof (Ciobâcă et al., 2018).

Reachability Logic over transition systems generalizes the same issue into a theory of proof-system design. It presents three sound and complete systems: a one-rule purely coinductive system $${\sf Subsumption}\quad \frac{}{ \langle P,Q\rangle}\qquad P\subseteq Q$$0, an asymmetrically compositional mixed inductive/coinductive system $${\sf Subsumption}\quad \frac{}{ \langle P,Q\rangle}\qquad P\subseteq Q$$1, and a symmetrically compositional system $${\sf Subsumption}\quad \frac{}{ \langle P,Q\rangle}\qquad P\subseteq Q$$2, essentially inductive, with coinduction encoded in hypotheses. The paper’s main tradeoff statement is exact: the more induction a proof system uses, and the more specialised is its use of coinduction, the more compositional the proof system is, but the more difficult its soundness proof becomes. The same work also proves compositionality with respect to transition systems: if $${\sf Subsumption}\quad \frac{}{ \langle P,Q\rangle}\qquad P\subseteq Q$$3 and $${\sf Subsumption}\quad \frac{}{ \langle P,Q\rangle}\qquad P\subseteq Q$$4, then $${\sf Subsumption}\quad \frac{}{ \langle P,Q\rangle}\qquad P\subseteq Q$$5 (Rusu et al., 2019).

Two consequences are especially important. First, cyclic proofs are not automatically sound; they must encode genuine progress. Second, all-path reachability proofs admit several proof-theoretic factorizations: one can emphasize direct coinduction, explicit induction principles, or compositional reuse of already proved formulas. The choice affects proof modularity and meta-theoretic complexity, not the underlying universal property being established.

4. Partial validity, total validity, safety, and liveness

The abstract APR framework isolates the source–target structure of all-path reachability. An APR predicate is a pair of a source set and a target set, written in the paper as $${\sf Subsumption}\quad \frac{}{ \langle P,Q\rangle}\qquad P\subseteq Q$$6, with $${\sf Subsumption}\quad \frac{}{ \langle P,Q\rangle}\qquad P\subseteq Q$$7. For abstract reduction systems, partial validity is defined coinductively via the greatest fixed point of an inference system, and the classical rules are Subsumption and Step. A central reformulation replaces these by Axiom, Subs, and Der, yielding a system $${\sf Subsumption}\quad \frac{}{ \langle P,Q\rangle}\qquad P\subseteq Q$$8 that is semantics-preserving and has a one-to-one correspondence with the LCTRS proof rules. The paper proves

$${\sf Subsumption}\quad \frac{}{ \langle P,Q\rangle}\qquad P\subseteq Q$$9

and establishes that for any APR predicate, at most one rule in $${\sf Step}\quad \frac{\langle \partial(P\setminus Q),Q\rangle}{\langle P,Q\rangle} \qquad P\setminus Q\ \text{runnable}.$$0 is applicable; with the disproof rule, exactly one of Axiom, Subs, Der, or Dis applies (Kojima et al., 4 Feb 2026).

This framework then separates safety from liveness. For safety, the target $${\sf Step}\quad \frac{\langle \partial(P\setminus Q),Q\rangle}{\langle P,Q\rangle} \qquad P\setminus Q\ \text{runnable}.$$1 is chosen as a set of non-error normal forms satisfying

$${\sf Step}\quad \frac{\langle \partial(P\setminus Q),Q\rangle}{\langle P,Q\rangle} \qquad P\setminus Q\ \text{runnable}.$$2

Under this condition, partial validity of the APR predicate is equivalent to the statement that there is no finite execution path from $${\sf Step}\quad \frac{\langle \partial(P\setminus Q),Q\rangle}{\langle P,Q\rangle} \qquad P\setminus Q\ \text{runnable}.$$3 that includes a state in the error set $${\sf Step}\quad \frac{\langle \partial(P\setminus Q),Q\rangle}{\langle P,Q\rangle} \qquad P\setminus Q\ \text{runnable}.$$4. The framework also introduces the “any” trick: add a fresh irreducible state $${\sf Step}\quad \frac{\langle \partial(P\setminus Q),Q\rangle}{\langle P,Q\rangle} \qquad P\setminus Q\ \text{runnable}.$$5 and transitions $${\sf Step}\quad \frac{\langle \partial(P\setminus Q),Q\rangle}{\langle P,Q\rangle} \qquad P\setminus Q\ \text{runnable}.$$6 for all $${\sf Step}\quad \frac{\langle \partial(P\setminus Q),Q\rangle}{\langle P,Q\rangle} \qquad P\setminus Q\ \text{runnable}.$$7; then safety reduces to partial validity of a transformed APR predicate with target $${\sf Step}\quad \frac{\langle \partial(P\setminus Q),Q\rangle}{\langle P,Q\rangle} \qquad P\setminus Q\ \text{runnable}.$$8.

For liveness, the same framework introduces total validity, which requires not only finite but also infinite execution paths to reach target sets. This is strictly stronger than partial validity. Its decisive theorem concerns cyclic proof graphs: if a partially valid APR proof of a predicate has proof graph $${\sf Step}\quad \frac{\langle \partial(P\setminus Q),Q\rangle}{\langle P,Q\rangle} \qquad P\setminus Q\ \text{runnable}.$$9, then

$\varphi=\{t\mid \phi\}$0

The result supplies a necessary and sufficient condition under which a cyclic-proof tree for partial validity also proves liveness. In this way, the abstract APR framework makes precise a distinction that is often blurred in informal discussions: universal safety over terminating executions and universal eventuality over all executions are different proof obligations.

5. Modular heap verification and local proofs of global reachability

Heap reasoning introduces a different difficulty: reachability is global, but modular verification requires footprint-local specifications. A separation-logic technique addresses this by defining reachability relative to a heap fragment $\varphi=\{t\mid \phi\}$1 and a set of reference fields $\varphi=\{t\mid \phi\}$2. The local edge predicate is extracted by snapshot^F(\GRAPH), and the local path predicate is axiomatized as a reflexive transitive closure schema rather than defined directly in SMT. The key contribution is a reachability-framing principle for relatively convex subheaps: if $\varphi=\{t\mid \phi\}$3 and no path inside $\varphi=\{t\mid \phi\}$4 leaves $\varphi=\{t\mid \phi\}$5 and later re-enters it, then caller reachability can be partitioned exactly into cases that are wholly in the callee footprint, wholly in the frame, or cross the boundary once. The method supports acyclic graphs with a bounded outdegree and 0--1-path graphs (ZOPGs), integrates reachability with other separation-logic assertions, supports concurrent programs, and is automated in Viper using Boogie and Z3 (Ter-Gabrielyan et al., 2019).

The same work is equally explicit about its limitations. It does not provide a framework for arbitrary reachability in arbitrary graphs, and it does not prove unrestricted universal properties over all paths in arbitrary heap graphs. Its modular framing rules depend on relative convexity, and its automation depends on staying within first-order formulas that SMT solvers can manage. The resulting proofs are therefore strong but structurally restricted: they establish path-preservation and path-creation summaries inside supported heap classes, not a general all-path calculus for unrestricted heaps.

A more algebraic variant of local reasoning represents global graph properties as fixpoints of equations over graphs. In the flow-based framework, a flow domain is $\varphi=\{t\mid \phi\}$6, and a flow is any solution of

$\varphi=\{t\mid \phi\}$7

For reachability, the central instance is the path-counting flow domain

$\varphi=\{t\mid \phi\}$8

where the flow at node $\varphi=\{t\mid \phi\}$9 is the number of paths from a distinguished source $\varphi'=\{t'\mid \phi'\}$0 to $\varphi'=\{t'\mid \phi'\}$1. In this encoding, $\varphi'=\{t'\mid \phi'\}$2 means $\varphi'=\{t'\mid \phi'\}$3 is reachable from $\varphi'=\{t'\mid \phi'\}$4, and $\varphi'=\{t'\mid \phi'\}$5 means unique path / tree-like reachability. The framework introduces a flow interface algebra $\varphi'=\{t'\mid \phi'\}$6, proves that $\varphi'=\{t'\mid \phi'\}$7 is a separation algebra, and supplies a replacement theorem showing that a subgraph can be replaced by another with the same interface while preserving the global property (Krishna et al., 2019).

These heap-oriented developments do not redefine all-path reachability semantics, but they do show how global path facts can be recovered from local proof obligations. In that sense, they complement the coinductive calculi: instead of symbolically exploring all successors, they encode enough boundary information to avoid reopening the entire graph.

6. Adjacent meanings of universal reachability

The surrounding literature uses related but non-equivalent notions of universal reachability. In graph algorithms, the join-reachability graph $\varphi'=\{t'\mid \phi'\}$8 of a collection of directed graphs is defined so that

$\varphi'=\{t'\mid \phi'\}$9

where $\varphi \Rightarrow \varphi'$0 means that $\varphi \Rightarrow \varphi'$1 is reachable from $\varphi \Rightarrow \varphi'$2 in all graphs of the collection. For two digraphs, the restricted version of the smallest join-reachability graph is polynomial-time computable, while the unrestricted version, where Steiner vertices are allowed, is NP-hard (Georgiadis et al., 2010). This is a universal intersection of reachability relations across several graphs, not a proof system for executions of one transition system.

In directed-graph homology, reachability homology collapses a digraph to its reachability preorder

$\varphi \Rightarrow \varphi'$3

takes the nerve of that preorder, and studies the resulting chain complex and homology groups. The normalized chain complex $\varphi \Rightarrow \varphi'$4 is generated by tuples whose consecutive terms are related by reachability, and the theory satisfies homotopy invariance, Künneth, excision, and Mayer–Vietoris theorems. The paper characterizes the nerve as an “all-path” object because a simplex records not one path, but the existence of reachability between successive vertices (Hepworth et al., 2023).

Topological modal logic provides a different contrast. Its binary modality $\varphi \Rightarrow \varphi'$5 is interpreted existentially: $\varphi \Rightarrow \varphi'$6 The logic combining $\varphi \Rightarrow \varphi'$7 with the Cantor derivative modality has an axiomatic system $\varphi \Rightarrow \varphi'$8 that is sound and complete both for the class of $\varphi \Rightarrow \varphi'$9 topologies and for the class of all metric spaces, and it is decidable (Gagarin et al., 30 Jun 2026). Here path-reachability is an Until-like topological modality over continuous paths, not the demonic all-path partial-correctness notion used in operational semantics and rewriting.

Across these traditions, the unifying concern is global path behavior. The main difference is the semantic role played by universality: in program logics and APR frameworks it quantifies over executions of one system; in join-reachability it intersects reachability across several graphs; in reachability homology it passes from paths to a preorder of path existence; and in topological logic it is replaced by an existential continuous-path modality.