eyeprolog 1.5.20 → 1.5.22

package/index.d.ts

@@ -12,6 +12,8 @@ export interface EyePrologRunOptions {
   /** Host-supplied goals, executed in order. */
   goals?: Array<string | EyePrologTerm>;
   proof?: boolean;
+  /** Proof detail: abstract keeps library predicates as trusted leaves; expanded opens bundled Prolog library clauses. */
+  proofDetail?: 'abstract' | 'expanded';
   why?: boolean;
   explain?: boolean;
   maxDepth?: number;
@@ -310,9 +312,54 @@ export function hasForwardRules(program: Program): boolean;
 /** Execute EyeProlog `:+/2` rules to closure using an existing solver. */
 export function executeForwardRules(program: Program, solver: Solver, options?: EyePrologForwardRunOptions): EyePrologForwardRunResult;
 export function runQuads(source: string | Program, options?: EyePrologQuadRunOptions): EyePrologQuadRunResult;
-export function whyProof(program: Program, goal: EyePrologTerm, options?: EyePrologRunOptions): { ok: boolean; text: string };
+export interface EyePrologProofMethod {
+  type: 'source' | 'builtin' | 'library' | 'conjunction';
+  kind?: 'fact' | 'rule';
+  filename?: string;
+  clause?: number;
+  name?: string;
+  arity?: number;
+}
+
+export interface EyePrologProofNode {
+  goal: string;
+  method: EyePrologProofMethod;
+  bindings: Array<{ name: string; value: string }>;
+  children: EyePrologProofNode[];
+}
+
+export interface EyePrologProofCertificate {
+  version: 1;
+  detail: 'abstract' | 'expanded';
+  answer: string;
+  proof: EyePrologProofNode;
+}
+
+export interface EyePrologProofResult {
+  ok: boolean;
+  certificate: EyePrologProofCertificate | null;
+  text: string;
+}
+
+export interface EyePrologProofTrustBoundary {
+  type: 'builtin' | 'library';
+  name: string;
+  arity: number;
+  goal: string;
+}
+
+export interface EyePrologProofVerification {
+  ok: boolean;
+  error: string | null;
+  trusted: EyePrologProofTrustBoundary[];
+}
+
+export function proofCertificate(program: Program, goal: EyePrologTerm, options?: EyePrologRunOptions): EyePrologProofResult;
+export function proofCertificatesFromText(text: string, program: Program): EyePrologProofCertificate[];
+export function verifyProof(program: Program, certificate: EyePrologProofCertificate | EyePrologProofResult, options?: EyePrologRunOptions): EyePrologProofVerification;
+export function whyProof(program: Program, goal: EyePrologTerm, options?: EyePrologRunOptions): EyePrologProofResult;
 export function whyNoProof(goal: EyePrologTerm): string;
-export function explainProof(program: Program, goal: EyePrologTerm, options?: EyePrologRunOptions): { ok: boolean; text: string };
+export function explainProof(program: Program, goal: EyePrologTerm, options?: EyePrologRunOptions): EyePrologProofResult;
 
 declare const eyeprolog: {
   VAR: typeof VAR;
@@ -386,6 +433,9 @@ declare const eyeprolog: {
   hasForwardRules: typeof hasForwardRules;
   executeForwardRules: typeof executeForwardRules;
   runQuads: typeof runQuads;
+  proofCertificate: typeof proofCertificate;
+  proofCertificatesFromText: typeof proofCertificatesFromText;
+  verifyProof: typeof verifyProof;
   whyProof: typeof whyProof;
   whyNoProof: typeof whyNoProof;
   explainProof: typeof explainProof;

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "1.5.20",
+  "version": "1.5.22",
   "description": "EyeProlog turns facts and rules into answers and proofs.",
   "type": "module",
   "main": "./index.js",

package/src/ARCHITECTURE.md

@@ -21,6 +21,12 @@ higher-level frontends.
 5. **Frontends/tools** — `execute.js`, `repl.js`, `cli.js`, `quads.js`,
    `explain.js`, and the playground worker.
 
+`explain.js` owns both proof construction and proof-certificate verification.
+Verification walks the supplied certificate and checks source-clause steps against
+the parsed `Program`; it does not call the solver to rediscover the proof.
+Built-in and abstract library nodes are explicit trust boundaries, while expanded
+proofs expose bundled Prolog-library clauses as ordinary source steps.
+
 `iso.js` and `program.js` remain facade modules for their existing exports, so
 this refactor does not change the public JavaScript API.
 

package/src/cli.js

@@ -25,6 +25,8 @@ export async function main(argv) {
   const options = {
     files: [],
     proof: false,
+    proofDetail: 'abstract',
+    verifyProof: null,
     quads: false,
     stats: false,
     isoStrict: false,
@@ -47,6 +49,15 @@ export async function main(argv) {
       return;
     } else if (!endOptions && (arg === '--proof' || arg === '-p')) {
       options.proof = true;
+    } else if (!endOptions && arg === '--proof-detail') {
+      const detail = argv[++i];
+      if (detail !== 'abstract' && detail !== 'expanded') throw new Error('--proof-detail requires abstract or expanded');
+      options.proof = true;
+      options.proofDetail = detail;
+    } else if (!endOptions && arg === '--verify-proof') {
+      const file = argv[++i];
+      if (file == null) throw new Error('--verify-proof requires a file');
+      options.verifyProof = file;
     } else if (!endOptions && (arg === '--quads' || arg === '-q')) {
       options.quads = true;
     } else if (!endOptions && (arg === '--stats' || arg === '-s')) {
@@ -94,9 +105,18 @@ export async function main(argv) {
   if (options.isoStrict && options.quads) {
     throw new Error('--iso-strict cannot be combined with --quads');
   }
+  if (options.verifyProof != null && options.quads) {
+    throw new Error('--verify-proof cannot be combined with --quads');
+  }
+  if (options.verifyProof != null && options.proof) {
+    throw new Error('--verify-proof cannot be combined with --proof or --proof-detail');
+  }
+  if (options.verifyProof != null && options.goals.length > 0) {
+    throw new Error('--verify-proof cannot be combined with --goal');
+  }
 
   if (options.isoStrict && options.files.length === 0 && options.goals.length === 0 &&
-      !options.proof && !options.stats && !options.warnings) {
+      options.verifyProof == null && !options.proof && !options.stats && !options.warnings) {
     const engine = await loadEngine();
     const { runRepl } = await import('./repl.js');
     const exitCode = await runRepl(engine, {
@@ -134,7 +154,7 @@ export async function main(argv) {
     }
   }
 
-  if (options.goals.length === 0 && !options.quads) {
+  if (options.goals.length === 0 && !options.quads && options.verifyProof == null) {
     for (const source of sourceParts) options.goals.push(...goalsFromSource(source.text));
   }
 
@@ -150,7 +170,7 @@ export async function main(argv) {
 
   const engine = await loadEngine();
   let program = engine.Program.parseSources(sourceParts, {
-    sourceMetadata: options.proof || options.isoStrict,
+    sourceMetadata: options.proof || options.verifyProof != null || options.isoStrict,
     isoStrict: options.isoStrict,
     autoload: options.autoload,
     autoloadGoals: options.goals,
@@ -164,6 +184,20 @@ export async function main(argv) {
     return;
   }
 
+  if (options.verifyProof != null) {
+    const explanation = await loadExplanation();
+    const proofText = await fs.readFile(options.verifyProof, 'utf8');
+    const certificates = explanation.proofCertificatesFromText(proofText, program);
+    if (certificates.length === 0) throw new Error(`no why/2 proof certificate found in ${options.verifyProof}`);
+    const registry = options.isoStrict ? engine.getStrictIsoRegistry() : engine.getEyePrologRegistry();
+    for (let i = 0; i < certificates.length; i++) {
+      const checked = explanation.verifyProof(program, certificates[i], { registry });
+      if (!checked.ok) throw new Error(`proof certificate ${i + 1} failed verification: ${checked.error}`);
+    }
+    process.stdout.write(`verified ${certificates.length} proof certificate${certificates.length === 1 ? '' : 's'}.\n`);
+    return;
+  }
+
   if (!options.quads || options.goals.length > 0) {
     if (options.goals.length === 0 && !options.isoStrict && engine.hasForwardRules(program)) {
       await runForwardDefault(engine, program, options);
@@ -244,7 +278,7 @@ async function runDefault(engine, program, options) {
     const { haltCode } = engine.executeGoals(program, solver, goals, {
       onAnswer: (line, resolved) => {
         process.stdout.write(line);
-        if (options.proof) writeExplanation(explanation, program, resolved, registry);
+        if (options.proof) writeExplanation(explanation, program, resolved, registry, options);
       },
     });
     if (haltCode != null) process.exitCode = haltCode;
@@ -253,8 +287,8 @@ async function runDefault(engine, program, options) {
   }
 }
 
-function writeExplanation(explanation, program, resolved, registry) {
-  const proof = explanation.whyProof(program, resolved, { registry });
+function writeExplanation(explanation, program, resolved, registry, options = {}) {
+  const proof = explanation.whyProof(program, resolved, { registry, proofDetail: options?.proofDetail ?? 'abstract' });
   process.stdout.write(proof.text);
   if (!proof.ok) process.stdout.write(explanation.whyNoProof(resolved));
 }
@@ -276,6 +310,8 @@ Input:
 Options:
   -h, --help            Show this help text and exit.
   -p, --proof           Enable proof explanations.
+  --proof-detail mode   Use abstract or expanded proof detail (implies --proof).
+  --verify-proof file   Verify why/2 proof certificates against the input program.
   -q, --quads           Run embedded quad tests and fail if any do not hold.
   -s, --stats           Print solver and memory statistics to stderr after execution.
   --iso-strict          Use ISO/IEC 13211-1 core + Corrigenda 1-3 only;

package/src/explain.js

@@ -2,19 +2,34 @@
 // The explanation printer replays a successful goal against the program and emits
 // ordinary EyeProlog facts with nested proof terms.  Explanations are therefore both
 // human-readable and machine-readable.
-import { ATOM, COMPOUND, Env, Term, VAR, deref, flattenConjunction, freshTerm, termToString, unify, variantTerms } from './term.js';
+import { ATOM, COMPOUND, Env, Term, VAR, deref, flattenConjunction, freshTerm, properListItems, termToString, unify, variantTerms } from './term.js';
 import { selectClauseCandidates } from './program.js';
+import { parseGoalText, parseProgramText } from './parser.js';
 import { getEyePrologRegistry } from './standard-library.js';
 import { Solver, nextFreshId } from './solver.js';
 
-export function whyProof(program, goal, options = {}) {
+let verifyFreshCounter = 0;
+
+export function proofCertificate(program, goal, options = {}) {
   const maxDepth = options.maxDepth ?? 256;
   const registry = options.registry ?? getEyePrologRegistry();
   const env = options.env ?? new Env();
-  for (const proof of proveGoalAll(program, goal, env, 0, maxDepth, registry, [])) {
-    return { ok: true, text: renderWhyFacts(goal, proof.node, proof.env) };
+  const detail = normalizeProofDetail(options.proofDetail ?? 'abstract');
+  for (const proof of proveGoalAll(program, goal, env, 0, maxDepth, registry, [], detail)) {
+    const answer = resolveForProof(goal, proof.env);
+    const certificate = {
+      version: 1,
+      detail,
+      answer: termToString(answer, new Env(), true),
+      proof: certificateNode(proof.node),
+    };
+    return { ok: true, certificate, text: renderWhyFacts(goal, proof.node, proof.env) };
   }
-  return { ok: false, text: '' };
+  return { ok: false, certificate: null, text: '' };
+}
+
+export function whyProof(program, goal, options = {}) {
+  return proofCertificate(program, goal, options);
 }
 
 export function whyNoProof(goal) {
@@ -26,11 +41,11 @@ export function explainProof(program, goal, options = {}) {
   return whyProof(program, goal, options);
 }
 
-function* proveGoalAll(program, goal, env, depth, maxDepth, registry, active) {
+function* proveGoalAll(program, goal, env, depth, maxDepth, registry, active, detail) {
   if (depth > maxDepth) return;
 
   if (goal.type === COMPOUND && goal.name === ',' && goal.arity === 2) {
-    for (const proved of proveGoalsAll(program, flattenConjunction(goal), env, depth + 1, maxDepth, registry, active)) {
+    for (const proved of proveGoalsAll(program, flattenConjunction(goal), env, depth + 1, maxDepth, registry, active, detail)) {
       yield {
         env: proved.env,
         node: {
@@ -58,7 +73,7 @@ function* proveGoalAll(program, goal, env, depth, maxDepth, registry, active) {
           sourceHead: resolveForProof(goal, proofEnv),
           sourceBody: [],
           bindings: [],
-          children: builtinChildren(program, goal, proofEnv, depth + 1, maxDepth, registry, active),
+          children: builtinChildren(program, goal, proofEnv, depth + 1, maxDepth, registry, active, detail),
         },
       };
     }
@@ -74,7 +89,7 @@ function* proveGoalAll(program, goal, env, depth, maxDepth, registry, active) {
   // a standard Prolog module. The implementation remains
   // ordinary clauses, but explanations collapse its private helper expansion
   // behind an explicit library(Name, Arity) boundary.
-  if (group.module !== 'user' && program.modules.get(group.module)?.filename?.startsWith('src/lib/')) {
+  if (detail !== 'expanded' && group.module !== 'user' && program.modules.get(group.module)?.filename?.startsWith('src/lib/')) {
     const solver = new Solver(program, { registry });
     for (const next of solver.solve([goal], env.clone(), 0)) {
       const proofEnv = next.clone ? next.clone() : next;
@@ -128,7 +143,7 @@ function* proveGoalAll(program, goal, env, depth, maxDepth, registry, active) {
       let activePushed = true;
       active.push({ goal, env });
       try {
-        for (const proved of proveGoalsAll(program, freshBody, next, depth + 1, maxDepth, registry, active)) {
+        for (const proved of proveGoalsAll(program, freshBody, next, depth + 1, maxDepth, registry, active, detail)) {
           active.pop();
           activePushed = false;
           yield {
@@ -160,7 +175,7 @@ function clauseCandidateAt(candidate, index) {
   return Array.isArray(candidate) ? candidate[index] : index === 0 ? candidate : undefined;
 }
 
-function* proveGoalsAll(program, goals, env, depth, maxDepth, registry, active) {
+function* proveGoalsAll(program, goals, env, depth, maxDepth, registry, active, detail) {
   if (goals.length === 0) {
     yield { env: env.clone(), children: [] };
     return;
@@ -170,8 +185,8 @@ function* proveGoalsAll(program, goals, env, depth, maxDepth, registry, active)
   const goal = goals[selectedIndex];
   const rest = selectedIndex === 0 ? goals.slice(1) : [...goals.slice(0, selectedIndex), ...goals.slice(selectedIndex + 1)];
 
-  for (const proved of proveGoalAll(program, goal, env, depth, maxDepth, registry, active)) {
-    for (const tail of proveGoalsAll(program, rest, proved.env, depth, maxDepth, registry, active)) {
+  for (const proved of proveGoalAll(program, goal, env, depth, maxDepth, registry, active, detail)) {
+    for (const tail of proveGoalsAll(program, rest, proved.env, depth, maxDepth, registry, active, detail)) {
       const children = tail.children.slice();
       children.splice(selectedIndex, 0, proved.node);
       yield { env: tail.env, children };
@@ -212,10 +227,10 @@ function selectReadyDeterministicBuiltin(goals, env, registry) {
   return 0;
 }
 
-function builtinChildren(program, goal, env, depth, maxDepth, registry, active) {
+function builtinChildren(program, goal, env, depth, maxDepth, registry, active, detail) {
   if (goal.type !== COMPOUND) return [];
   if (goal.name === 'once' && goal.arity === 1) {
-    for (const proved of proveGoalAll(program, goal.args[0], env.clone(), depth, maxDepth, registry, active)) return [proved.node];
+    for (const proved of proveGoalAll(program, goal.args[0], env.clone(), depth, maxDepth, registry, active, detail)) return [proved.node];
   }
   return [];
 }
@@ -250,6 +265,291 @@ function libraryMethod(goal) {
   };
 }
 
+function normalizeProofDetail(value) {
+  if (value === 'abstract' || value === 'expanded') return value;
+  throw new Error(`unknown proof detail: ${value}`);
+}
+
+function certificateNode(node) {
+  return {
+    goal: termToString(node.goal, new Env(), true),
+    method: certificateMethod(node.method),
+    bindings: node.bindings.map((binding) => ({
+      name: String(binding.name),
+      value: termToString(binding.value, new Env(), true),
+    })),
+    children: node.children.map(certificateNode),
+  };
+}
+
+function certificateMethod(method) {
+  if (typeof method === 'string') return { type: method };
+  if (!method || typeof method !== 'object') return { type: String(method) };
+  return { ...method };
+}
+
+export function proofCertificatesFromText(text, program) {
+  const clauses = parseProgramText(String(text), {
+    doubleQuotes: program.doubleQuotes ?? 'chars',
+    sourceMetadata: false,
+  });
+  const certificates = [];
+  for (const clause of clauses) {
+    if (!clause?.head || clause.body?.length !== 0 || clause.head.type !== COMPOUND ||
+        clause.head.name !== 'why' || clause.head.arity !== 2) continue;
+    const proof = certificateNodeFromTerm(clause.head.args[1]);
+    if (!proof) continue;
+    certificates.push({
+      version: 1,
+      detail: containsExpandedLibrarySource(proof) ? 'expanded' : 'abstract',
+      answer: termToString(clause.head.args[0], new Env(), true),
+      proof,
+    });
+  }
+  return certificates;
+}
+
+function certificateNodeFromTerm(term) {
+  if (term.type !== COMPOUND || term.name !== 'proof') return null;
+  const fields = term.args;
+  if (fields.length < 2) return null;
+  const goalField = fields[0];
+  const byField = fields[1];
+  if (goalField.type !== COMPOUND || goalField.name !== 'goal' || goalField.arity !== 1) return null;
+  if (byField.type !== COMPOUND || byField.name !== 'by' || byField.arity !== 1) return null;
+  const node = {
+    goal: termToString(goalField.args[0], new Env(), true),
+    method: certificateMethodFromTerm(byField.args[0]),
+    bindings: [],
+    children: [],
+  };
+  if (!node.method) return null;
+  for (let i = 2; i < fields.length; i++) {
+    const field = fields[i];
+    if (field.type !== COMPOUND) return null;
+    if (field.name === 'bindings' && field.arity === 1) {
+      const items = properListItems(field.args[0], new Env());
+      if (items == null) return null;
+      node.bindings = items.map((item) => {
+        if (item.type !== COMPOUND || item.name !== 'binding' || item.arity !== 2) throw new Error('malformed certificate binding');
+        return { name: certificateText(item.args[0]), value: termToString(item.args[1], new Env(), true) };
+      });
+    } else if (field.name === 'uses' && field.arity === 1) {
+      const items = properListItems(field.args[0], new Env());
+      if (items == null) return null;
+      node.children = items.map(certificateNodeFromTerm);
+      if (node.children.some((child) => child == null)) return null;
+    } else {
+      return null;
+    }
+  }
+  return node;
+}
+
+function certificateMethodFromTerm(term) {
+  if (term.type === ATOM && term.name === 'conjunction') return { type: 'conjunction' };
+  if (term.type !== COMPOUND) return null;
+  if ((term.name === 'fact' || term.name === 'rule') && term.arity === 2) {
+    const clause = term.args[1];
+    if (clause.type !== COMPOUND || clause.name !== 'clause' || clause.arity !== 1) return null;
+    return { type: 'source', kind: term.name, filename: certificateText(term.args[0]), clause: Number(clause.args[0].name) };
+  }
+  if ((term.name === 'builtin' || term.name === 'library') && term.arity === 2) {
+    return { type: term.name, name: String(term.args[0].name), arity: Number(term.args[1].name) };
+  }
+  return null;
+}
+
+function certificateText(term) {
+  if (term.type === ATOM || term.type === 'string') return String(term.name);
+  const items = properListItems(term, new Env());
+  if (items != null && items.every((item) => item.type === ATOM && String(item.name).length === 1)) {
+    return items.map((item) => String(item.name)).join('');
+  }
+  if (items != null && items.every((item) => item.type === 'number' && /^\d+$/.test(String(item.name)))) {
+    const codes = items.map((item) => Number(item.name));
+    if (codes.every((code) => Number.isInteger(code) && code >= 0 && code <= 0x10ffff && !(code >= 0xd800 && code <= 0xdfff))) {
+      return String.fromCodePoint(...codes);
+    }
+  }
+  throw new Error('expected certificate text');
+}
+
+function containsLibraryBoundary(node) {
+  if (node.method?.type === 'library') return true;
+  return node.children.some(containsLibraryBoundary);
+}
+
+function containsExpandedLibrarySource(node) {
+  if (node.method?.type === 'source' && String(node.method.filename ?? '').startsWith('src/lib/')) return true;
+  return node.children.some(containsExpandedLibrarySource);
+}
+
+export function verifyProof(program, input, options = {}) {
+  const certificate = input?.certificate ?? input;
+  try {
+    if (!certificate || certificate.version !== 1 || typeof certificate.answer !== 'string' || !certificate.proof ||
+        (certificate.detail !== 'abstract' && certificate.detail !== 'expanded')) {
+      throw new Error('invalid proof certificate');
+    }
+    if (certificate.detail === 'abstract' && containsExpandedLibrarySource(certificate.proof)) {
+      throw new Error('abstract proof certificate contains expanded library source');
+    }
+    if (certificate.detail === 'expanded' && containsLibraryBoundary(certificate.proof)) {
+      throw new Error('expanded proof certificate contains an abstract library boundary');
+    }
+    const registry = options.registry ?? getEyePrologRegistry();
+    const answer = parseCertificateTerm(certificate.answer, program);
+    const rootGoal = parseCertificateTerm(certificate.proof.goal, program);
+    const answerEnv = new Env();
+    if (!unify(answer, rootGoal, answerEnv)) throw new Error('certificate answer does not match root goal');
+    verifyCertificateNode(program, certificate.proof, rootGoal, registry, options, new Env());
+    return { ok: true, error: null, trusted: collectTrustedBoundaries(certificate.proof) };
+  } catch (error) {
+    return { ok: false, error: error instanceof Error ? error.message : String(error), trusted: [] };
+  }
+}
+
+function collectTrustedBoundaries(node, out = []) {
+  if (node.method?.type === 'builtin' || node.method?.type === 'library') {
+    out.push({
+      type: node.method.type,
+      name: String(node.method.name),
+      arity: Number(node.method.arity),
+      goal: String(node.goal),
+    });
+  }
+  for (const child of node.children) collectTrustedBoundaries(child, out);
+  return out;
+}
+
+function parseCertificateTerm(text, program) {
+  return parseGoalText(String(text), { doubleQuotes: program.doubleQuotes ?? 'chars' });
+}
+
+function verifyCertificateNode(program, node, expectedGoal, registry, options, inheritedEnv) {
+  if (!node || typeof node.goal !== 'string' || !node.method || !Array.isArray(node.children) || !Array.isArray(node.bindings)) {
+    throw new Error('malformed proof node');
+  }
+  const nodeGoal = parseCertificateTerm(node.goal, program);
+  if (!unify(expectedGoal, nodeGoal, inheritedEnv)) throw new Error(`proof goal mismatch: ${node.goal}`);
+  const method = node.method;
+
+  if (method.type === 'conjunction') {
+    if (nodeGoal.type !== COMPOUND || nodeGoal.name !== ',' || nodeGoal.arity !== 2) throw new Error('invalid conjunction proof');
+    const goals = flattenConjunction(nodeGoal);
+    if (goals.length !== node.children.length) throw new Error('conjunction child count mismatch');
+    for (let i = 0; i < goals.length; i++) {
+      const childGoal = parseCertificateTerm(node.children[i].goal, program);
+      if (!unify(goals[i], childGoal, inheritedEnv)) throw new Error(`conjunction child ${i + 1} does not match`);
+      verifyCertificateNode(program, node.children[i], childGoal, registry, options, new Env());
+    }
+    if (node.bindings.length !== 0) throw new Error('conjunction proof must not carry clause bindings');
+    return;
+  }
+
+  if (method.type === 'builtin') {
+    const name = nodeGoal.type === COMPOUND || nodeGoal.type === ATOM ? nodeGoal.name : null;
+    const arity = nodeGoal.type === COMPOUND ? nodeGoal.arity : 0;
+    if (method.name !== name || method.arity !== arity || registry.get(name, arity) == null) {
+      throw new Error(`untrusted builtin boundary: ${method.name}/${method.arity}`);
+    }
+    if (node.bindings.length !== 0) throw new Error('builtin proof must not carry clause bindings');
+    if (name === 'once' && arity === 1) {
+      if (node.children.length !== 1) throw new Error('once/1 proof requires exactly one child');
+      const childGoal = parseCertificateTerm(node.children[0].goal, program);
+      const innerEnv = new Env();
+      if (!unify(nodeGoal.args[0], childGoal, innerEnv)) throw new Error('once/1 child does not match called goal');
+      verifyCertificateNode(program, node.children[0], childGoal, registry, options, new Env());
+    } else if (node.children.length !== 0) {
+      throw new Error(`unexpected children for builtin ${name}/${arity}`);
+    }
+    return;
+  }
+
+  if (method.type === 'library') {
+    const name = nodeGoal.type === COMPOUND || nodeGoal.type === ATOM ? nodeGoal.name : null;
+    const arity = nodeGoal.type === COMPOUND ? nodeGoal.arity : 0;
+    if (method.name !== name || method.arity !== arity) throw new Error('library boundary does not match goal');
+    const group = findLibraryGroup(program, name, arity);
+    if (!group) throw new Error(`untrusted library boundary: ${name}/${arity}`);
+    if (node.children.length !== 0 || node.bindings.length !== 0) throw new Error('abstract library proof must be a leaf');
+    return;
+  }
+
+  if (method.type === 'source') {
+    verifySourceNode(program, node, nodeGoal, registry, options);
+    return;
+  }
+
+  throw new Error(`unknown proof method: ${method.type}`);
+}
+
+function findLibraryGroup(program, name, arity) {
+  for (const group of program.groups.values()) {
+    if (group.name !== name || group.arity !== arity || group.module === 'user') continue;
+    if (program.modules.get(group.module)?.filename?.startsWith('src/lib/')) return group;
+  }
+  return null;
+}
+
+function verifySourceNode(program, node, nodeGoal, registry, options) {
+  const method = node.method;
+  const candidates = program.clauses.filter((clause) => {
+    const source = clause.source ?? {};
+    const filename = source.filename ?? '<input>';
+    const clauseNumber = source.clause ?? ((clause.index ?? 0) + 1);
+    return filename === method.filename && clauseNumber === method.clause;
+  });
+  if (candidates.length === 0) throw new Error(`source clause not found: ${method.filename}:${method.clause}`);
+
+  for (const clause of candidates) {
+    const kind = clause.body.length === 0 ? 'fact' : 'rule';
+    if (method.kind !== kind) continue;
+    const id = `verify${++verifyFreshCounter}`;
+    const variables = new Map();
+    const head = freshTerm(clause.head, id, variables);
+    const body = clause.body.map((term) => freshTerm(term, id, variables));
+    const env = new Env();
+    if (!unify(head, nodeGoal, env)) continue;
+    if (body.length !== node.children.length) continue;
+
+    let valid = true;
+    for (let i = 0; i < body.length; i++) {
+      try {
+        const childGoal = parseCertificateTerm(node.children[i].goal, program);
+        if (!unify(body[i], childGoal, env)) { valid = false; break; }
+        verifyCertificateNode(program, node.children[i], childGoal, registry, options, new Env());
+      } catch {
+        valid = false;
+        break;
+      }
+    }
+    if (!valid) continue;
+    if (!verifyBindings(node.bindings, variables, env, program)) continue;
+    return;
+  }
+  throw new Error(`source proof does not validate: ${node.goal}`);
+}
+
+function verifyBindings(bindings, variables, env, program) {
+  const expected = new Map();
+  for (const [name, fresh] of variables.entries()) {
+    const resolved = deref(fresh, env);
+    if (resolved.type !== VAR) expected.set(name, resolved);
+  }
+  if (bindings.length !== expected.size) return false;
+  for (const binding of bindings) {
+    if (!binding || typeof binding.name !== 'string' || typeof binding.value !== 'string') return false;
+    const resolved = expected.get(binding.name);
+    if (!resolved) return false;
+    const value = parseCertificateTerm(binding.value, program);
+    const check = new Env();
+    if (!unify(resolveForProof(resolved, env), value, check)) return false;
+  }
+  return true;
+}
+
 function renderMethodTerm(method) {
   if (method && method.type === 'source') return `${method.kind}(${quoteString(method.filename)}, clause(${method.clause}))`;
   if (method && method.type === 'builtin') return `builtin(${quoteAtomText(method.name)}, ${method.arity})`;

package/src/index.js

@@ -79,7 +79,7 @@ export function run(source, options = {}) {
     ({ haltCode } = executeForwardRules(program, solver, {
       onAnswer: (line, resolved) => {
         output.push(line);
-        if (includeWhy) appendExplanation(output, program, resolved, runOptions.registry);
+        if (includeWhy) appendExplanation(output, program, resolved, runOptions.registry, options.proofDetail);
       },
       onFuse: (line) => output.push(line),
       onDiagnostic: (line) => {
@@ -91,15 +91,15 @@ export function run(source, options = {}) {
     ({ haltCode } = executeGoals(program, solver, goals, {
       onAnswer: (line, resolved) => {
         output.push(line);
-        if (includeWhy) appendExplanation(output, program, resolved, runOptions.registry);
+        if (includeWhy) appendExplanation(output, program, resolved, runOptions.registry, options.proofDetail);
       },
     }));
   }
   return { stdout: output.join(''), stats: solver.stats, haltCode };
 }
 
-function appendExplanation(output, program, resolved, registry) {
-  const proof = whyProof(program, resolved, { registry });
+function appendExplanation(output, program, resolved, registry, proofDetail = 'abstract') {
+  const proof = whyProof(program, resolved, { registry, proofDetail });
   output.push(proof.text);
   if (!proof.ok) output.push(whyNoProof(resolved));
 }

package/src/write.js

@@ -152,6 +152,20 @@ function writeString(value) {
   return out + '"';
 }
 
+function quotedListCharacter(item, doubleQuotes) {
+  if (doubleQuotes === 'chars') {
+    if (item.type !== ATOM || Array.from(item.name).length !== 1) return null;
+    return item.name;
+  }
+  if (doubleQuotes === 'codes') {
+    if (item.type !== NUMBER || !/^\d+$/.test(item.name)) return null;
+    const code = BigInt(item.name);
+    if (code < 0n || code > 0x10ffffn || (code >= 0xd800n && code <= 0xdfffn)) return null;
+    return String.fromCodePoint(Number(code));
+  }
+  return null;
+}
+
 function quotedListSplice(term, env, doubleQuotes) {
   if (doubleQuotes !== 'chars' && doubleQuotes !== 'codes') return null;
   const characters = [];
@@ -164,16 +178,9 @@ function quotedListSplice(term, env, doubleQuotes) {
     if (!isCons(cursor)) {
       return characters.length === 0 ? null : { text: characters.join(''), tail: cursor };
     }
-    const item = deref(cursor.args[0], env);
-    if (doubleQuotes === 'chars') {
-      if (item.type !== ATOM || Array.from(item.name).length !== 1) return null;
-      characters.push(item.name);
-    } else {
-      if (item.type !== NUMBER || !/^\d+$/.test(item.name)) return null;
-      const code = BigInt(item.name);
-      if (code < 0n || code > 0x10ffffn || (code >= 0xd800n && code <= 0xdfffn)) return null;
-      characters.push(String.fromCodePoint(Number(code)));
-    }
+    const character = quotedListCharacter(deref(cursor.args[0], env), doubleQuotes);
+    if (character == null) return null;
+    characters.push(character);
     cursor = cursor.args[1];
   }
 }
@@ -351,15 +358,26 @@ function format(term, env, options, table, maxPriority = 1200, context = 'term')
 
     if (!options.ignoreOps) {
       const parts = [];
+      let quotedSuffix = [];
       let cursor = resolved;
       while (true) {
         cursor = deref(cursor, env);
         const separator = options.compact ? ',' : ', ';
-        if (isEmptyList(cursor)) return `[${parts.join(separator)}]`;
+        if (isEmptyList(cursor)) {
+          if (quotedSuffix.length > 1 && quotedSuffix.length < parts.length) {
+            const prefix = parts.slice(0, parts.length - quotedSuffix.length);
+            return `[${prefix.join(separator)}|${writeString(quotedSuffix.join(''))}]`;
+          }
+          return `[${parts.join(separator)}]`;
+        }
         if (!isCons(cursor)) {
           const tailSeparator = options.compact ? '|' : ' | ';
           return `[${parts.join(separator)}${tailSeparator}${format(cursor, env, options, table, 999, 'argument')}]`;
         }
+        const item = deref(cursor.args[0], env);
+        const character = quotedListCharacter(item, options.doubleQuotes);
+        if (character == null) quotedSuffix = [];
+        else quotedSuffix.push(character);
         parts.push(format(cursor.args[0], env, options, table, 999, 'argument'));
         cursor = cursor.args[1];
       }

package/test/conformance/ISO-IMPLEMENTATION-DEFINED.md

@@ -124,7 +124,7 @@ families; `--iso-strict` is intended to remove their Part 1 interpretation.
 | 5.5.9 Built-in predicates | EyeProlog libraries, CLP(Z), statistics, Part 3 `phrase/2-3`, and bundled-library autoloaded predicates | Strict registry contains only the Part 1 + Corrigenda core registry. |
 | 5.5.10 Evaluable functors | Normal mode additionally accepts the EyeProlog evaluable atom `e`; the remaining arithmetic functors accepted by strict mode are the Part 1 + Corrigenda set. | Strict mode rejects `e/0` as non-evaluable and retains the Corrigendum arithmetic additions. **covered** — strict extension-boundary regression plus `src/iso-arithmetic.js`. |
 | 5.5.11 Reserved atoms | None | None. |
-| Cor.3 5.5.12 Options | Extra library/host options may exist outside core option lists | Normal mode additionally accepts the EyeProlog `write_term/2-3` options `double_quotes(true|false)` and `spacing(true|false)`. `double_quotes(true)` is orthogonal to `ignore_ops(true)`: eligible character/code lists retain double-quoted notation while operator terms use functional notation, and the order of those distinct options does not affect the result. `spacing(false)` emits only lexically required separators; `spacing(true)` adds conventional layout around operators. Strict core excludes these implementation-specific extensions and accepts only the Part 1 plus Corrigendum 3 write-option surface; unknown extension options raise `domain_error(write_option,...)`. |
+| Cor.3 5.5.12 Options | Extra library/host options may exist outside core option lists | Normal mode additionally accepts the EyeProlog `write_term/2-3` options `double_quotes(true|false)` and `spacing(true|false)`. `double_quotes(true)` is orthogonal to `ignore_ops(true)`: eligible character/code lists, including a proper list's maximal character/code suffix of at least two elements, retain double-quoted notation while operator terms use functional notation, and the order of those distinct options does not affect the result. `spacing(false)` emits only lexically required separators; `spacing(true)` adds conventional layout around operators. Strict core excludes these implementation-specific extensions and accepts only the Part 1 plus Corrigendum 3 write-option surface; unknown extension options raise `domain_error(write_option,...)`. |
 
 Normal mode provides documented module and DCG compatibility profiles whose
 features overlap standardized Part 2 and Part 3 facilities. They are extensions

package/test/conformance/expected/iso/logtalk_univ.pl

@@ -1 +1 @@
-univ_results(foo(a, b), [foo, a, b], "a", ['.', 1, []], [1.0]).
+univ_results(foo(a, b), [foo|"ab"], "a", ['.', 1, []], [1.0]).

package/test/run-regression.mjs

@@ -47,6 +47,9 @@ import {
   unify,
   variantTerms,
   parseProgramText,
+  proofCertificate,
+  proofCertificatesFromText,
+  verifyProof,
 } from '../src/index.js';
 import { ISO_OPERATOR_DEFINITIONS, parseGoalText, parseNumberTokenText, tryParseClausesFastInto } from '../src/parser.js';
 import { PrologError, formalErrorTerm } from '../src/iso.js';
@@ -73,6 +76,10 @@ const testRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)));
 const packageRoot = path.resolve(testRoot, '..');
 const bin = path.join(packageRoot, 'bin', 'eyeprolog.js');
 const pkg = JSON.parse(fs.readFileSync(path.join(packageRoot, 'package.json'), 'utf8'));
+// The issue #49 hand-off checks assert demand-driven completion and bounded memory,
+// not a machine-speed threshold. Leave enough wall-clock headroom for slower or
+// contended CI hosts while still terminating a genuinely stuck child process.
+const DCG_HANDOFF_TEST_TIMEOUT_MS = 20_000;
 let tmp = null;
 let tmpCounter = 0;
 
@@ -2863,7 +2870,7 @@ c4 ?- call((!;1)).
         const result = spawnSync(process.execPath, ['--input-type=module', '--eval', script], {
           cwd: packageRoot,
           encoding: 'utf8',
-          timeout: 5000,
+          timeout: DCG_HANDOFF_TEST_TIMEOUT_MS,
         });
         if (result.error) throw result.error;
         assertEqual(result.status, 0, `65536-cell hand-off status; stderr=${result.stderr}`);
@@ -2906,7 +2913,7 @@ c4 ?- call((!;1)).
             'length(_,E),E>12,N is 2^E,\\+ \\+ (length(L,N),time(phrase(a,L))).\n' +
             ';\n;\n;\n\n' +
             'halt.\n',
-          timeout: 5000,
+          timeout: DCG_HANDOFF_TEST_TIMEOUT_MS,
         });
         if (result.error) throw result.error;
         assertEqual(result.status, 0, `deep REPL hand-off status; stderr=${result.stderr}`);
@@ -3842,6 +3849,39 @@ child.stdin.write(\`consult(${consultedAtom}).\\n\`);
         assertEqual(result.stderr, '', 'stderr');
       },
     },
+
+    {
+      name: '--proof-detail expanded exposes bundled Prolog library clauses',
+      run: () => {
+        const input = '%% goal: q(a)\n:- use_module(library(lists)).\nq(X) :- member(X, [a,b]).\n';
+        const result = runCli(['--proof-detail', 'expanded', '-'], { input });
+        assertEqual(result.status, 0, 'exit status');
+        assertIncludes(result.stdout, 'by(fact("src/lib/lists.pl"', 'expanded library source');
+        assertNotIncludes(result.stdout, 'by(library(member, 2))', 'abstract library boundary');
+      },
+    },
+    {
+      name: '--verify-proof accepts saved why/2 proof output and rejects tampering',
+      run: () => {
+        const programFile = path.join(tmp, `proof-program-${++tmpCounter}.pl`);
+        const proofFile = path.join(tmp, `proof-certificate-${++tmpCounter}.pl`);
+        fs.writeFileSync(programFile, '%% goal: q(a)\np(a).\nq(X) :- p(X).\n');
+        const generated = runCli(['--proof', programFile]);
+        assertEqual(generated.status, 0, 'proof generation status');
+        fs.writeFileSync(proofFile, generated.stdout);
+        const verified = runCli(['--verify-proof', proofFile, programFile]);
+        assertEqual(verified.status, 0, 'verification status');
+        assertEqual(verified.stdout, 'verified 1 proof certificate.\n', 'verification stdout');
+        const strictVerified = runCli(['--iso-strict', '--verify-proof', proofFile, programFile]);
+        assertEqual(strictVerified.status, 0, 'strict verification status');
+        assertEqual(strictVerified.stdout, 'verified 1 proof certificate.\n', 'strict verification stdout');
+        const tamperedFile = path.join(tmp, `proof-certificate-bad-${++tmpCounter}.pl`);
+        fs.writeFileSync(tamperedFile, generated.stdout.replace('goal(p(a))', 'goal(p(b))'));
+        const rejected = runCli(['--verify-proof', tamperedFile, programFile]);
+        assertEqual(rejected.status, 1, 'tampered verification status');
+        assertIncludes(rejected.stderr, 'proof certificate 1 failed verification', 'tampered verification stderr');
+      },
+    },
     {
       name: '-pw combines proof and warning flags',
       run: () => {
@@ -5624,6 +5664,74 @@ true :+ ready.
       },
     },
 
+    {
+      name: 'proof certificates verify source derivations without proof search',
+      run: () => {
+        const program = Program.parse('p(a, b).\nq(X, Y) :- p(X, Y).\n', { sourceMetadata: true });
+        const result = proofCertificate(program, parseGoalText('q(a, b)'));
+        assertEqual(result.ok, true, 'certificate generated');
+        assertEqual(result.certificate.version, 1, 'certificate version');
+        assertEqual(result.certificate.answer, 'q(a, b)', 'certificate answer');
+        const checked = verifyProof(program, result);
+        assertEqual(checked.ok, true, 'certificate verifies');
+        assertEqual(checked.trusted.length, 0, 'source-only certificate has no trusted boundaries');
+      },
+    },
+    {
+      name: 'proof verification rejects a tampered child goal',
+      run: () => {
+        const program = Program.parse('p(a, b).\nq(X, Y) :- p(X, Y).\n', { sourceMetadata: true });
+        const result = proofCertificate(program, parseGoalText('q(a, b)'));
+        const tampered = structuredClone(result.certificate);
+        tampered.proof.children[0].goal = 'p(a, c)';
+        assertEqual(verifyProof(program, tampered).ok, false, 'tampered child is rejected');
+        const bindingTamper = structuredClone(result.certificate);
+        bindingTamper.proof.bindings[1].value = 'c';
+        assertEqual(verifyProof(program, bindingTamper).ok, false, 'tampered binding is rejected');
+        const changedProgram = Program.parse('p(a, c).\nq(X, Y) :- p(X, Y).\n', { sourceMetadata: true });
+        assertEqual(verifyProof(changedProgram, result).ok, false, 'changed source program is rejected');
+      },
+    },
+    {
+      name: 'why/2 text round-trips into a verifiable proof certificate',
+      run: () => {
+        const program = Program.parse('p(a).\nq(X) :- p(X).\n', { sourceMetadata: true });
+        const result = proofCertificate(program, parseGoalText('q(a)'));
+        const parsed = proofCertificatesFromText(result.text, program);
+        assertEqual(parsed.length, 1, 'certificate count');
+        assertEqual(verifyProof(program, parsed[0]).ok, true, 'round-tripped certificate verifies');
+      },
+    },
+    {
+      name: 'proof certificate text round-trips under every double_quotes mode',
+      run: () => {
+        for (const doubleQuotes of ['chars', 'codes', 'atom']) {
+          const program = Program.parse('p(a).\nq(X) :- p(X).\n', { sourceMetadata: true, doubleQuotes });
+          const result = proofCertificate(program, parseGoalText('q(a)', { doubleQuotes }));
+          const parsed = proofCertificatesFromText(result.text, program);
+          assertEqual(parsed.length, 1, `${doubleQuotes} certificate count`);
+          assertEqual(verifyProof(program, parsed[0]).ok, true, `${doubleQuotes} certificate verifies`);
+        }
+      },
+    },
+    {
+      name: 'expanded proof detail opens bundled Prolog library clauses',
+      run: () => {
+        const program = Program.parse(':- use_module(library(lists)).\nq(X) :- member(X, [a,b]).\n', { sourceMetadata: true });
+        const abstract = proofCertificate(program, parseGoalText('q(a)'));
+        const expanded = proofCertificate(program, parseGoalText('q(a)'), { proofDetail: 'expanded' });
+        assertEqual(abstract.certificate.proof.children[0].method.type, 'library', 'abstract library boundary');
+        assertEqual(expanded.certificate.proof.children[0].method.type, 'source', 'expanded library source');
+        const abstractChecked = verifyProof(program, abstract);
+        const expandedChecked = verifyProof(program, expanded);
+        assertEqual(abstractChecked.ok, true, 'abstract certificate verifies');
+        assertEqual(abstractChecked.trusted.length, 1, 'abstract certificate reports library trust');
+        assertEqual(abstractChecked.trusted[0].type, 'library', 'reported trust boundary type');
+        assertEqual(expandedChecked.ok, true, 'expanded certificate verifies');
+        assertEqual(expandedChecked.trusted.length, 0, 'pure-Prolog expanded certificate removes library trust');
+      },
+    },
+
     {
       name: 'run accepts Program instances',
       run: () => {
@@ -7171,6 +7279,92 @@ function whiteBoxCases() {
           'double_quotes(codes) representation');
       },
     },
+    {
+      name: 'double-quoted character and code suffixes are recognized inside proper lists (issue #88 suffix follow-up)',
+      run: () => {
+        const repl = runCli([], {
+          input: 'T = [A,b,c,d,e,f].\nhalt.\n',
+        });
+        assertEqual(repl.status, 0, 'REPL exit status');
+        assertIncludes(repl.stdout, 'T = [A|"bcdef"].', 'Scryer-compatible character suffix');
+        assertNotIncludes(repl.stdout, 'T = [A, b, c, d, e, f].', 'expanded suffix suppressed');
+
+        const chars = parseGoalText('p([foo,b,c])').args[0];
+        assertEqual(
+          formatTermForWrite(chars, new Env(), {
+            quoted: true,
+            doubleQuotes: 'chars',
+            doubleBar: true,
+            compact: true,
+            operators: ISO_OPERATOR_DEFINITIONS,
+          }),
+          '[foo|"bc"]',
+          'ordinary list notation uses a quoted suffix',
+        );
+        assertEqual(
+          formatTermForWrite(chars, new Env(), {
+            quoted: true,
+            ignoreOps: true,
+            doubleQuotes: 'chars',
+            doubleBar: true,
+            compact: true,
+            operators: ISO_OPERATOR_DEFINITIONS,
+          }),
+          `'.'(foo,"bc")`,
+          'ignore_ops remains orthogonal to suffix quoting',
+        );
+        assertEqual(
+          formatTermForWrite(chars, new Env(), {
+            quoted: true,
+            doubleQuotes: null,
+            doubleBar: true,
+            compact: true,
+            operators: ISO_OPERATOR_DEFINITIONS,
+          }),
+          '[foo,b,c]',
+          'disabled double_quotes keeps expanded list notation',
+        );
+        const improper = parseGoalText('p([foo,b,c|tail])').args[0];
+        assertEqual(
+          formatTermForWrite(improper, new Env(), {
+            quoted: true,
+            doubleQuotes: 'chars',
+            doubleBar: true,
+            compact: true,
+            operators: ISO_OPERATOR_DEFINITIONS,
+          }),
+          '[foo,b,c|tail]',
+          'improper suffix is not mistaken for a proper string suffix',
+        );
+
+        const astral = parseGoalText("p([foo,'😀',x])").args[0];
+        assertEqual(
+          formatTermForWrite(astral, new Env(), {
+            quoted: true,
+            doubleQuotes: 'chars',
+            doubleBar: true,
+            compact: true,
+            operators: ISO_OPERATOR_DEFINITIONS,
+          }),
+          '[foo|"😀x"]',
+          'Unicode scalar suffix',
+        );
+
+        const codes = parseGoalText('p([foo,98,128512])', { doubleQuotes: 'codes' }).args[0];
+        assertEqual(
+          formatTermForWrite(codes, new Env(), {
+            quoted: true,
+            doubleQuotes: 'codes',
+            doubleBar: true,
+            compact: true,
+            operators: ISO_OPERATOR_DEFINITIONS,
+          }),
+          '[foo|"b😀"]',
+          'code-list suffix',
+        );
+      },
+    },
+
     {
       name: 'charsio write_term_to_chars composes double_quotes with ignore_ops',
       run: () => {

package/the-art-of-eyeprolog.md

@@ -1467,25 +1467,42 @@ why(
 ).
 ```
 
-Proof output is valid EyeProlog input:
+Proof output is valid EyeProlog input and can be kept as a proof certificate:
 
 ```sh
 eyeprolog --proof examples/socrates.pl > socrates.why.pl
+eyeprolog --verify-proof socrates.why.pl examples/socrates.pl
 ```
 
+The second command checks the supplied `why/2` derivation against the program;
+it does not search again for a proof. A changed source clause, child goal, source
+location, or recorded substitution makes the certificate fail verification.
+Certificate input is parsed as Prolog data rather than loaded as a program, so
+its terms cannot trigger directives while being checked.
+
 A normal answer is one resolved ground term followed by a period. Strings,
 quoted atoms, lists, and compounds are rendered in supported source syntax so
 the output can be read back. Enabling `--proof`, `--warnings`, or `--stats`
 must not change which answers are found.
 
-The second argument of `why/2` is an abstract proof term of the general shape
+The second argument of `why/2` is a proof term of the general shape
 `proof(goal(G), by(Method), bindings(Bindings), uses(Proofs))`. User clauses
 are identified as `fact(Filename, clause(N))` or
 `rule(Filename, clause(N))`, with one-based source clause numbers. Built-ins
-are identified as `builtin(Name, Arity)`. Explanation data is outside the
+are identified as `builtin(Name, Arity)`. By default, bundled Prolog-library
+predicates appear as `library(Name, Arity)` trusted boundaries. Use
+`--proof-detail expanded` to replace those boundaries with the library source
+clauses and any trusted built-ins they call. Explanation data is outside the
 logical semantics of the input program: it describes the derivation but does
 not participate in finding it.
 
+Verification checks source steps structurally: the named clause must exist, its
+head must unify with the certified goal, its body must correspond to the child
+proofs, and recorded clause-variable bindings must agree with that derivation.
+Built-ins and abstract library nodes are deliberately trusted boundaries. This
+separates proof discovery from proof checking without pretending that host
+operations can be justified by Prolog source that does not exist.
+
 A second program can query `why/2`. Read a proof as an argument. If it contains
 irrelevant detours, improve the helpers. If a key premise is hidden inside an
 opaque value, model it as a fact. Designing for a good explanation often
@@ -1862,10 +1879,42 @@ prints numeric work counters; those counters describe this run rather than an
 additional logical answer.
 
 `run/2` accepts source text or an already parsed `Program`. Its options include
-`proof` (with `why` and `explain` as aliases), `maxDepth`, `maxInferences`,
-`maxMemoryBytes`, `solutionLimit`, a custom `registry`, and `strictNegation` or
-`analyzeNegation`. It returns `stdout`, the solver's numeric `stats`, and a
-nullable `haltCode`; it does not write to the process streams.
+`proof` (with `why` and `explain` as aliases), `proofDetail` (`abstract` or
+`expanded`), `maxDepth`, `maxInferences`, `maxMemoryBytes`, `solutionLimit`, a
+custom `registry`, and `strictNegation` or `analyzeNegation`. It returns
+`stdout`, the solver's numeric `stats`, and a nullable `haltCode`; it does not
+write to the process streams.
+
+For applications that exchange proofs independently of answer output, the same
+module exposes `proofCertificate(program, goal, options)`,
+`proofCertificatesFromText(text, program)`, and
+`verifyProof(program, certificate, options)`:
+
+```js
+import {
+  Program, parseGoalText,
+  proofCertificate, proofCertificatesFromText, verifyProof
+} from 'eyeprolog';
+
+const program = Program.parse(`
+p(a).
+q(X) :- p(X).
+`, { sourceMetadata: true });
+
+const made = proofCertificate(program, parseGoalText('q(a)'));
+console.log(verifyProof(program, made).ok); // true
+
+const received = proofCertificatesFromText(made.text, program)[0];
+console.log(verifyProof(program, received).ok); // true
+```
+
+`proofCertificate` returns both the ordinary `why/2` text and a JSON-serializable
+certificate object. `verifyProof` walks the supplied certificate rather than
+asking the solver to find another proof; its `trusted` array lists every builtin
+or abstract-library boundary that was assumed while checking it. Passing
+`proofDetail: 'expanded'` exposes bundled Prolog-library clauses in the
+certificate and therefore reduces library-level trust boundaries to the
+built-ins those clauses ultimately use.
 
 When `run` receives an already parsed `Program`, bundled-library imports
 needed only by its host-supplied goals are added to that Program before solving,
@@ -5480,9 +5529,11 @@ still retained where adjacent graphic tokens would otherwise merge, as in
 `write_term/2-3` supports `quoted/1`, `ignore_ops/1`, `numbervars/1`, and
 `variable_names/1`. Normal mode additionally accepts the EyeProlog extension
 `double_quotes(true|false)`: `true` lets eligible character/code lists use the
-current `double_quotes` representation. Proper lists can therefore be written
-as `"text"`, while a partial list such as `[a,b|Tail]` is written as
-`"ab"||Tail`. This representation choice is independent of `ignore_ops/1`: with
+current `double_quotes` representation. Proper character/code lists can therefore be written
+as `"text"`. A proper list whose final segment contains at least two characters/codes
+uses that representation for the suffix, so `[A,b,c,d,e,f]` is written as
+`[A|"bcdef"]`. A partial list such as `[a,b|Tail]` is written as `"ab"||Tail`.
+This representation choice is independent of `ignore_ops/1`: with
 `ignore_ops(true)`, operator terms use functional notation while an explicitly
 requested character/code list remains double quoted. Thus
 `write_term(f("ab",a+b),[quoted(true),ignore_ops(true),double_quotes(true)])`
@@ -5547,6 +5598,21 @@ and document the command line; the conformance corpus fixes success, failure,
 mode, and error behavior. Use this part for working practice and those chapters
 for exact reference.
 
+### Historical note: the practical language becomes portable
+
+By the late 1970s and 1980s, Prolog had spread from its Marseille origins into
+several implementation traditions. The Edinburgh and DECsystem-10 lineage in
+particular helped establish a practical programming vocabulary around ordered
+control, term inspection, dynamic clauses, operators, and streams. These
+facilities made Prolog useful far beyond theorem-proving examples, but
+differences between systems also made portability a recurring concern.
+
+ISO/IEC 13211-1:1995 gave that accumulated practice a common core. It did not
+freeze the language: constraints, modules, tabling, coroutining, and other
+facilities continued to develop in implementations and later standardization
+work. What the standard supplied was a stable shared account of ordinary Prolog
+terms, control, state, errors, and I/O against which extensions could be named.
+
 # Part IX — Reference as practice
 
 Reference is useful only when the route into it is clear. Begin with the task
@@ -9319,6 +9385,8 @@ make the observed question explicit.
 | --- | --- |
 | `-h`, `--help` | Show usage |
 | `-p`, `--proof` | Print `why/2` explanations |
+| `--proof-detail abstract|expanded` | Select library abstraction for proof output; implies `--proof` |
+| `--verify-proof File` | Verify saved `why/2` proof certificates against the input program without proof search |
 | `-q`, `--quads` | Run embedded quad tests and fail if any do not hold |
 | `--iso-strict` | Restrict parsing and execution to ISO/IEC 13211-1:1995 + Corrigenda 1–3; reject EyeProlog language extensions (including `table` and `:+`) and disable bundled-library autoloading |
 | `--portable` | Enforce the conservative EyeProlog/Trealla/Scryer interoperability profile |
@@ -9363,7 +9431,9 @@ Work in a fixed sequence:
 
 1. predict the ground answers before running the program;
 2. run without observation flags and compare stdout with that prediction;
-3. add `--proof` when the support for an answer is the question;
+3. add `--proof` when the support for an answer is the question; save the
+   output and use `--verify-proof` when the derivation itself must cross a
+   process or review boundary;
 4. add `--warnings` when portability or negative dependencies are the
    question; use `--portable` when non-profile dependencies must fail CI;
 5. add `--stats` only when comparing two executions of the same semantic case.
@@ -9373,6 +9443,8 @@ For example:
 ```sh
 eyeprolog --goal 'ancestor(X, Y)' examples/ancestor.pl
 eyeprolog --proof --goal 'type(X, Y)' examples/socrates.pl
+eyeprolog --proof examples/socrates.pl > socrates.why.pl
+eyeprolog --verify-proof socrates.why.pl examples/socrates.pl
 eyeprolog --warnings --goal 'answer(X)' test/conformance/warnings/negation/unstratified_mutual.pl
 eyeprolog --portable --goal 'sudoku9_solution(S)' examples/clpz-sudoku-9x9.pl
 eyeprolog --stats --goal 'path(a, X)' examples/path-discovery.pl > answers.pl 2> run.stats
@@ -10594,6 +10666,22 @@ variables. Variant recognition is important for tabling and cycle analysis.
 **Witness.** A constructed ground term demonstrating an existential result,
 such as a path, assignment, factorization, schedule, or proof-relevant object.
 
+### Historical note: manuals become specifications
+
+Early Prolog programmers learned from implementation manuals, examples, and
+books whose descriptions were often inseparable from one particular system. As
+the language spread, reference writing acquired a second task: distinguish the
+portable language from implementation convention. Predicate indexes, precise
+mode and error descriptions, and standards documents became tools for comparing
+systems rather than merely operating one of them.
+
+ISO standardization made that distinction explicit, while conformance tests and
+cross-processor corpora made many disagreements executable. A mature reference
+therefore joins several forms of evidence: normative prose, named predicates
+and flags, examples, implementation boundaries, and reproducible tests. The
+result is not a substitute for programming practice; it is a map from a
+concrete question to the exact contract that governs it.
+
 # Part X — Laboratories
 
 ## 44. Twelve laboratories
@@ -10858,6 +10946,21 @@ A beautiful program is not merely short. It makes the reason for its
 correctness, the shape of its search, and the boundary of its trust available
 to the next reader.
 
+### Historical note: logic programming grows through exercises
+
+Logic programming has long been taught by construction. Lists, family
+relations, puzzles, grammars, interpreters, search problems, and small expert
+systems became recurring exercises because each exposes both a logical relation
+and the control needed to compute with it. Texts such as *The Art of Prolog*
+made this dual reading central: an exercise was not finished when a clause
+parsed, but when its meaning, modes, and behavior could be explained.
+
+Laboratory practice later absorbed regression testing, property-oriented
+checking, benchmark corpora, and reproducible command-line runs. These tools
+fit logic programming unusually well because a small change can be examined at
+several levels at once: answers, failures, witnesses, proofs, and search. The
+laboratory is where a declarative claim becomes an executable experiment.
+
 # Part XI — Review
 
 ## 45. Checkpoint notes and selected answers
@@ -10982,3 +11085,17 @@ unbounded theorem.
 
 For laboratory checkpoints, leave an artifact. A useful completion is not merely a paragraph: it is a small source file, predicted output, actual output, and one sentence explaining any difference.
 
+### Historical note: review becomes explanation
+
+The declarative reading of logic programs encouraged debugging methods that ask
+what a relation was intended to mean, not only which machine step came next. In
+the early 1980s, Ehud Shapiro's work on algorithmic debugging used computation
+trees together with a programmer's judgments about intended results to narrow a
+fault to the clause responsible for it. Declarative debugging developed this
+idea alongside, rather than instead of, ordinary tracing.
+
+That tradition gives review a distinctive role in logic programming. A worked
+answer is useful when it can be reconstructed from the relation, the calling
+mode, and the evidence, and when a disagreement can be turned into a smaller
+question about meaning or control. Review then becomes another pass through the
+same discipline as programming: predict, execute, explain, and revise.

package/why-eyeprolog.md

@@ -203,9 +203,20 @@ make decisions, combine data from several sources, or need to be reviewed by
 someone who did not write them.
 
 Proofs make successful reasoning easier to inspect, test, teach, and discuss.
-They do not authenticate source data or replace application security. Embedders
-remain responsible for validating inputs and imposing suitable time, memory,
-depth, and solution limits.
+EyeProlog also treats a successful `why/2` term as a portable proof certificate.
+A certificate can be saved, transmitted as ordinary Prolog data, and checked later
+against the program without repeating the search that found the answer. Source
+steps are checked against the named clauses and their substitutions. Built-ins
+and abstract library steps remain explicit trusted boundaries; expanded proof
+detail opens bundled Prolog-library clauses so that more of the derivation can
+be checked from source. The verification result enumerates the remaining trusted
+boundaries rather than folding them into an undifferentiated success result.
+
+Verification and discovery therefore have different jobs: solving searches for
+a derivation, while certificate verification checks a supplied derivation. The
+certificate does not authenticate source data or replace application security.
+Embedders remain responsible for validating inputs and imposing suitable time,
+memory, depth, and solution limits.
 
 ## One engine across JavaScript environments