Variable orphans clean

The check is variable_orphans_clean. It is SPEC-stage plus audit. Default severity is error. The hop reads the component variable model against the formulas that consume it. It does not rewrite the YAML. It does not call Z3. It does not call Kind2.

It fires on both sides. declared-unused is a name in *.vars.yaml that no requirement uses. undeclared-used is a name a requirement uses that nothing declares. The rule it enforces: declare a domain fact when a requirement needs it, not before. A variable's justification is the formula that consumes it.

Every declared-unused finding has exactly three deliberate resolutions. Write the requirement whose FRETish consumes it. Mark it proof_auxiliary: true with a reason of at least 16 characters, for genuine solver bookkeeping only. Or delete it with proof var remove, which refuses while any requirement still names it. A bulk waiver hides the missing-requirement signal that makes the hop worth running.

A handful of orphans is drift: a rename, a moved requirement. A large orphan count is an ordering problem. The domain was enumerated before the shalls caught up. Adding a spare variable to silence non-boolean inputs constrained trades a warning there for an error here.

This is not list-versus-sentence on one requirement. That hop is variable drift. A parseable, satisfiable, fully traced shall can still leave requestCount sitting with no consumer. The help file teaches that first.

# component-a/variables.yaml
#   requestCount     OLD: nothing references this
#   request_count    NEW: live name
#
# the shall uses request_count
# Kind2 still prints valid
#
# proof audit --check variable_orphans_clean
# [SPEC] variable_orphans_clean
# requestCount declared but unused
# silent rename: last VALID still on the new name

The fix is on the model, not on another test. Run proof var diagnose on the component. Then pick one resolution per leftover, not in bulk. Write the missing shall if the name is real behavior. Mark it auxiliary if it is partition-complement bookkeeping. Delete it if the rename stranded it.

proof audit --check variable_orphans_clean --verbose
proof var diagnose component-a
proof gaps specs/system --check orphans

The teaching graph is still one component whose live shall sat on request_count while requestCount had no consumer. Close it by deleting the leftover, or by writing the shall that actually needs it, or by marking genuine solver bookkeeping auxiliary with a reason. Do not invent a shall purely to absorb the name. Do not waive the hop in bulk. With no consumer the hop still fires, and the old name did not go anywhere. It just sat in the YAML.

# component-a/variables.yaml now holds the live name
#   request_count    direction input
#
# proof audit --check variable_orphans_clean
# 0 variable model issues. this hop is quiet
#
# proof var diagnose component-a
# request_count consumed by the live shall

List-versus-sentence on one requirement stays on variable drift. A non-bool input with no domain stays on non-boolean inputs constrained. An unconstrained output while Kind2 still printed realisable stays on gaps clean. Jama still authors. Proof vs Jama.

Error, not warning, on the default. Auxiliary is silence with a reason, not a proof that the leftover was unused on purpose. A reason under 16 characters does not write. var remove refuses while any requirement still names the variable, so a delete cannot silently break a live formula. The hop does not rewrite the YAML. It does not add a shall. It does not prove the Go. It does not run Kind2. A quiet hop is not a proof that the model is the one you meant, only that every collected declaration has a consumer or an exemption, and every used name is declared. We have not scored this floor against a frozen Jama pack or a ReqIF export. The loss is named, not scored.

The list-versus-sentence hop stays on variable drift. The silent-domain hop stays on non-boolean inputs constrained. The unconstrained-output hop stays on gaps clean. The code-annotation hop stays on orphan code. The engagement stays on software correctness audit. Jama still authors.

What is variable orphans clean? Same question. Same URL.

Is this variables declared? No. That hop is the preflight that refuses a phantom before Kind2 runs, including wrong direction. This hop is leftover inventory. See variables declared.

Is this variable drift? No. That hop is list versus sentence on one requirement. This hop is declared-unused and undeclared-used on the component model. See variable drift.

Is this non-boolean inputs constrained? No. That hop is a declared non-bool input with no domain. Adding a spare name to silence it fails here. See non-boolean inputs constrained.

Is this gaps clean? No. That hop is an unconstrained output while Kind2 still printed realisable. See gaps clean.

Is this orphan code? No. That hop is a function with no requirement ID. This hop is a declared variable with no consuming formula. See orphan code.

Is this auxiliary variable? No. Ads 110 on that string is math glossary. Auxiliary here is solver bookkeeping with a written reason, not a textbook term.

Does an auxiliary flag prove the leftover is safe? No. It names why the encoder needs a name no behavioral shall consumes. The hop still counts it in the exemption inventory.

Does a quiet hop prove the code matches the shall? No. The hop observes declarations against consumers. It does not prove the Go.

Is Proof a Jama alternative for the shall? No. Jama still authors. Proof vs Jama.