eyeprolog 1.5.48 → 1.5.50

package/conformance-report.md

@@ -32,7 +32,7 @@ spelling therefore changes this report even when no corpus file is added or remo
 | context | 11 | 0 | 0 | 0 | 11 |
 | control | 15 | 0 | 0 | 0 | 15 |
 | explicit-tabling | 6 | 0 | 0 | 0 | 6 |
-| iso | 171 | 217 | 0 | 0 | 388 |
+| iso | 173 | 218 | 0 | 0 | 391 |
 | lists | 52 | 3 | 0 | 0 | 55 |
 | modules | 2 | 0 | 0 | 0 | 2 |
 | negation | 8 | 0 | 19 | 0 | 27 |
@@ -45,7 +45,7 @@ spelling therefore changes this report even when no corpus file is added or remo
 | terms | 26 | 3 | 0 | 0 | 29 |
 | unification | 18 | 0 | 0 | 0 | 18 |
 | variables | 16 | 7 | 0 | 0 | 23 |
-| **Total** | **493** | **272** | **19** | **21** | **805** |
+| **Total** | **495** | **273** | **19** | **21** | **808** |
 
 ## DCG conformance clarification
 
@@ -53,6 +53,11 @@ EyeProlog checks the input and remainder of `phrase/2-3` and reports
 `type_error(list, S)` when an argument is neither a list nor a partial list.
 These implementation-defined checks follow ISO/IEC TS 13211-3:2025,
 8.18.1.3 g and h; this behavior is not a known deviation.
+The checks are optional. EyeProlog elects to perform both consistently.
+Dedicated regressions require the exact error for atomic non-lists and
+improper lists across both arities and both sequence positions, while
+accepting variables, proper lists, and partial lists. The upstream quads
+allow checking and non-checking outcomes and do not prove this policy.
 
 The Part 3 implementation target is
 [ISO/IEC TS 13211-3:2025](https://www.iso.org/standard/83635.html).

package/examples/iso-grouped-solutions.pl

@@ -5,6 +5,9 @@
 %% goal: report(X0, X1)
 
 
+% clause/2 may only inspect a public procedure, so sale/3 is declared dynamic.
+:- dynamic(sale/3).
+
 sale(north, ada, 7).
 sale(north, ada, 7).
 sale(north, ben, 5).

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "1.5.48",
+  "version": "1.5.50",
   "description": "EyeProlog turns facts and rules into answers and proofs.",
   "type": "module",
   "main": "./index.js",

package/src/iso.js

@@ -733,8 +733,14 @@ function* clauseSolutions({ solver, goal, env }, state) {
   // EyeProlog selects private-procedure access before Body callability when both
   // conditions hold. ISO 7.12 permits an implementation-dependent choice when
   // more than one error condition is simultaneously satisfied.
-  if (isProcessorStaticProcedure(solver, head) ||
-      (solver.isoStrict && group && !group.dynamic)) {
+  //
+  // A procedure defined by a Prolog text is static unless a dynamic/1
+  // directive says otherwise (ISO 7.5.2 and 8.9), and clause/2 may only
+  // inspect a public (dynamic) procedure (ISO 8.8.1.3). Static is therefore
+  // the default in every mode, not only under --iso-strict: assert/1,
+  // retract/1, and abolish/1 already reject static procedures unconditionally,
+  // and clause/2 now agrees with them.
+  if (isProcessorStaticProcedure(solver, head) || (group && !group.dynamic)) {
     throw new PrologError('permission_error(access, private_procedure)', indicator);
   }
   callableOrVariable(goal.args[1], env);
@@ -3024,7 +3030,9 @@ function* phraseSolutions({ solver, goal, env }, state) {
   validateDcgEmbeddedGoals(grammarBody, input, requestedOutput);
   // ISO/IEC TS 13211-3:2025, 8.18.1.3 g and h permit these checks
   // and specify type_error(list, S) for invalid terminal-sequence arguments.
-  // Keep both diagnostics and the unmodified upstream phrase quad gate.
+  // EyeProlog elects to perform both optional checks consistently, including
+  // improper lists. The upstream quads allow non-checking outcomes too; the
+  // dedicated regression matrix requires our exact diagnostics.
   // See conformance-report.md and issue #94.
   if (!isListOrPartialList(input, env)) {
     throw new PrologError('type_error(list)', deref(input, env));

package/src/program.js

@@ -778,12 +778,19 @@ class ProgramBuilder {
       }
 
       if (!isDirectiveClause(clause)) {
-        if (program.strictIso && Array.isArray(clause.body) && clause.body.length > 0) {
+        if (Array.isArray(clause.body) && clause.body.length > 0) {
           // ISO 7.6.2 applies when source text is prepared as well as when a
           // clause term is asserted dynamically. Keep the original variable
           // objects while wrapping variable goals in call/1 so sharing with
           // the head (and recursively through ;/2 and ->/2) is preserved for
           // later clause/2 and retract/1 conversion back to terms.
+          //
+          // 7.5.1 prepares the read-terms of a Prolog text into database
+          // clauses by this same conversion, so it is not conditional on the
+          // strict profile. Skipping it left a bare variable goal where the
+          // standard requires call/1, which both reports the wrong body term
+          // through clause/2 (8.8.1.4, legs/2) and makes a cut in that goal
+          // transparent instead of local to the call (7.8.3).
           clause.body = clause.body.map((goal) => convertClauseBodyTerm(goal));
         }
         assertHeadIsDefinable(clause.head, program.strictIso);

package/test/conformance/ISO-BUILTIN-MODE-ERROR-MATRIX.md

@@ -141,7 +141,7 @@ The Corrigendum 2 additions have the same shape.
 
 | Clause / predicate | Prescribed row | Status | Executable evidence |
 | --- | --- | --- | --- |
-| 8.8.1 `clause/2` | enumerate clauses of a public user-defined procedure | covered | dynamic-clause tests and grouped-solutions/clause corpus |
+| 8.8.1 `clause/2` | enumerate clauses of a public user-defined procedure | covered | dynamic-clause tests and grouped-solutions/clause corpus; `iso/clause_static_and_dynamic_access` and `error/iso/clause_static_user_procedure` pin the static/private default in all modes |
 | 8.8.1 error (a) | variable head -> instantiation error | covered | strict `clause(X,_)` |
 | 8.8.1 error (b) | non-callable head -> callable type error | covered | strict `clause(4,_)` |
 | 8.8.1 error (c) | private procedure -> access/private-procedure permission error | covered | strict static/private tests |

package/test/conformance/ISO-PART2-PART3-SCOPE.md

@@ -37,12 +37,23 @@ implementation-dependent negation/if-then choices documented in the reference.
 `--iso-strict` leaves `-->/2` as ordinary Part 1 operator syntax and excludes
 Part 3 grammar expansion and `phrase/2-3` from the strict registry.
 
-One compatibility difference is explicit: EyeProlog currently reports
-`type_error(list)` when its `phrase/2-3` terminal-sequence validation rejects a
-non-list. The Part 3 terminal-sequence specification uses its own terminal
-sequence error category. EyeProlog retains the list-shaped error for its normal
-interoperability profile, so this behavior must not be presented as evidence of
-complete Part 3 conformance.
+EyeProlog elects to perform both implementation-defined terminal-sequence
+checks in ISO/IEC TS 13211-3:2025, 8.18.1.3 g and h. The checks are optional;
+when performed, their specified error type is `list`. EyeProlog consistently
+raises `type_error(list, Culprit)` for a non-list input to `phrase/2` or
+`phrase/3`, and for a non-list remainder to `phrase/3`. The culprit is the
+whole invalid argument, including an improper list, not just its tail.
+Variables, proper lists, and partial lists are accepted by these checks.
+For otherwise valid grammar bodies, validation precedes execution, even when
+the grammar would fail or produce a side effect.
+
+The upstream phrase quads permit both checking and non-checking outcomes and
+therefore do not establish this consistency. A dedicated regression matrix in
+`test/run-regression.mjs` requires the exact diagnostic across both arities,
+both sequence positions, atomic and compound non-lists, improper lists at
+several depths, and several grammar bodies. Positive cases protect variables,
+proper lists, and partial lists. These are policy checks, not a relaxation of
+the unmodified upstream corpus.
 
 The Part 3 implementation otherwise keeps sequence validation, grammar-body
 callability, variable-body instantiation errors, `phrase/3` steadfastness, and

package/test/conformance/ISO-PROLOG-TEXT-EXECUTION-MATRIX.md

@@ -37,7 +37,7 @@ and preparation error cases.
 | --- | --- | --- |
 | 7.5.1 initial database and clause order | covered | Prepared clauses retain textual preparation order. The implementation-defined initial database/standard-procedure choices are documented separately. |
 | 7.5.2 static and dynamic procedures | covered | Source procedures are static unless declared dynamic; asserting a previously absent predicate creates a dynamic procedure; modification of protected/static procedures is rejected. |
-| 7.5.3 private and public procedures | covered | User static procedures are private to `clause/2`; dynamic procedures are public; standardized built-ins/control forms remain static/private. |
+| 7.5.3 private and public procedures | covered | User static procedures are private to `clause/2` in every execution mode, not only under `--iso-strict`; dynamic procedures are public; standardized built-ins/control forms remain static/private. Corpus: `iso/clause_static_and_dynamic_access`, `error/iso/clause_static_user_procedure`. |
 | 7.5.4 database update visibility | covered | Dynamic calls use the logical-update view: an activation continues over the clause set visible when it began, while later activations see successful assertions/retractions. `retractall/1` retains an empty dynamic procedure and `abolish/1` removes it. |
 
 The strict test `closes ISO 7.5-7.7 database, conversion, and execution rows`
@@ -51,7 +51,7 @@ The complete 8.8-8.9 database built-in modes/errors remain covered by
 | Row | Status | EyeProlog disposition / executable evidence |
 | --- | --- | --- |
 | 7.6.1 term-to-goal/body boundary | covered | Callable terms enter execution as goals; variables are deferred through `call/1`; non-callable numeric/body terms are rejected rather than silently coerced. |
-| 7.6.2 term-to-body conversion | covered | Variables become `call/1`; conjunction, disjunction, and if-then bodies are converted recursively; non-control callable terms retain their predication; variable identity is preserved across the converted clause. |
+| 7.6.2 term-to-body conversion | covered | Variables become `call/1`; conjunction, disjunction, and if-then bodies are converted recursively; non-control callable terms retain their predication; variable identity is preserved across the converted clause. The conversion runs in every execution mode, for clauses prepared from a Prolog text as well as for `assert`ed clauses, so both paths yield the same body term. Corpus: `iso/clause_body_conversion`. |
 | 7.6.3 clause-to-term observation | covered | `clause/2` returns fresh renamed clause observations with the required sharing between head and body. |
 | 7.6.4 update conversion | covered | `asserta/1`, `assertz/1`, `retract/1`, and prepared source clauses use the same strict body-conversion rules and reject malformed bodies before database mutation. |
 

package/test/conformance/README.md

@@ -140,7 +140,7 @@ Selected cases are adapted from the ISO and standard-core suites of Logtalk,
 Scryer Prolog, Trealla Prolog, and SWI-Prolog. Their upstream identifiers and licenses
 are recorded in [THIRD_PARTY.md](THIRD_PARTY.md).
 
-The corpus has 388 cases in `iso/` and 805 file-based conformance cases in total. Of those, 11 cases in `stc/` are explicitly labelled working-draft review evidence rather than normative ISO claims. The separate vendored strict-reader WG17 matrix is a deterministic regression snapshot; the live Neumerkel gate discovers the current upstream inventory at run time; release/report checks separately verify the tracked `NEUMERKEL-LATEST.md`. The generated `conformance-report.md` records local corpus totals and links to that live evidence. Together with regression, documentation-sync, API, example, and book-example checks, `npm test` is the release gate.
+The corpus has 391 cases in `iso/` and 808 file-based conformance cases in total. Of those, 11 cases in `stc/` are explicitly labelled working-draft review evidence rather than normative ISO claims. The separate vendored strict-reader WG17 matrix is a deterministic regression snapshot; the live Neumerkel gate discovers the current upstream inventory at run time; release/report checks separately verify the tracked `NEUMERKEL-LATEST.md`. The generated `conformance-report.md` records local corpus totals and links to that live evidence. Together with regression, documentation-sync, API, example, and book-example checks, `npm test` is the release gate.
 
 ## Updating expected output
 

package/test/conformance/cases/iso/clause_body_conversion.pl

@@ -0,0 +1,41 @@
+% ISO 7.6.2 a: when a term is converted to the body of a clause, a variable
+% goal becomes call/1. ISO 7.6.2 b applies the conversion recursively through
+% (,)/2, (;)/2 and (->)/2. ISO 7.5.1 prepares the read-terms of a Prolog text
+% into database clauses by that same conversion, so a clause loaded from a
+% Prolog text and the identical clause added by assertz/1 must agree.
+
+:- dynamic(from_text/1).
+from_text(Goal) :- Goal.
+
+:- dynamic(nested/3).
+nested(A, B, C) :- (A ; B), (C -> true ; true).
+
+:- dynamic(cut_scope/1).
+cut_scope(Goal) :- Goal.
+cut_scope(_) :- true.
+
+%% goal: text_body(X0)
+
+text_body(Body) :-
+    clause(from_text(true), Body).
+
+%% goal: nested_body(X0)
+
+nested_body(Body) :-
+    clause(nested(a, b, c), Body).
+
+%% goal: assert_agrees_with_text(X0)
+
+% The same clause added at run time must convert to the same body term.
+assert_agrees_with_text(Agree) :-
+    assertz((asserted(Goal) :- Goal)),
+    clause(from_text(true), TextBody),
+    clause(asserted(true), AssertedBody),
+    ( TextBody == AssertedBody -> Agree = agree ; Agree = differ ).
+
+%% goal: cut_is_local(X0)
+
+% 7.8.3: a cut in the argument of call/1 is local to that call, so it must not
+% prune the remaining clauses of cut_scope/1.
+cut_is_local(Solutions) :-
+    findall(taken, cut_scope(!), Solutions).

package/test/conformance/cases/iso/clause_static_and_dynamic_access.pl

@@ -0,0 +1,26 @@
+% Procedures defined by a Prolog text are static unless a dynamic/1 directive
+% makes them public. clause/2 inspects public procedures and raises a
+% permission error for static ones, in every execution mode.
+% https://github.com/eyereasoner/eyeprolog/issues/96
+
+:- dynamic(elk/1).
+elk(X) :- moose(X).
+
+moose(bertha).
+
+%% goal: public_clause(X0)
+
+public_clause(Body) :-
+    clause(elk(bertha), Body).
+
+%% goal: private_clause(X0)
+
+private_clause(Culprit) :-
+    catch(clause(moose(_), _), error(Formal, _), true),
+    Formal = permission_error(access, private_procedure, Culprit).
+
+%% goal: asserted_clause(X0)
+
+asserted_clause(Body) :-
+    assertz(caribou(rudolf)),
+    clause(caribou(_), Body).

package/test/conformance/cases/iso/grouped_solutions_and_clauses.pl

@@ -1,3 +1,8 @@
+% clause/2 may only inspect public (dynamic) procedures. Predicates that are
+% read back with clause/2 below are declared dynamic; the rest stay static.
+:- dynamic(parent/2).
+:- dynamic(same/1).
+
 b(2, two).
 b(1, one).
 b(1, one).

package/test/conformance/cases/stc/clause_variable_identity.pl

@@ -2,6 +2,8 @@
 % https://www.complang.tuwien.ac.at/ulrich/iso-prolog/stc#37
 %% goal: clause_variable_identity
 
+% clause/2 may only inspect a public procedure, so a/1 is declared dynamic.
+:- dynamic(a/1).
 a(X) :- b(X).
 
 clause_variable_identity :-

package/test/conformance/errors/iso/clause_static_user_procedure.pl

@@ -0,0 +1,13 @@
+% A procedure defined by a Prolog text is static, and therefore private, unless
+% a dynamic/1 directive makes it public (ISO 7.5.2, 8.9). clause/2 may only
+% inspect a public procedure (ISO 8.8.1.3), so reading a static user procedure
+% is a permission error rather than a source of solutions.
+% https://github.com/eyereasoner/eyeprolog/issues/96
+%% goal: answer
+
+elk(X) :- moose(X).
+
+moose(bertha).
+
+answer :-
+    clause(elk(N), Body).

package/test/conformance/expected/iso/clause_body_conversion.pl

@@ -0,0 +1,4 @@
+text_body(call(true)).
+nested_body(((call(a) ; call(b)), (call(c) -> true ; true))).
+assert_agrees_with_text(agree).
+cut_is_local([taken, taken]).

package/test/conformance/expected/iso/clause_static_and_dynamic_access.pl

@@ -0,0 +1,3 @@
+public_clause(moose(bertha)).
+private_clause(moose / 1).
+asserted_clause(true).

package/test/conformance/expected-errors/iso/clause_static_user_procedure.txt

@@ -0,0 +1 @@
+error(permission_error(access, private_procedure), /(elk, 1))

package/test/run-conformance-report.mjs

@@ -143,6 +143,11 @@ function dcgConformanceSection() {
     '`type_error(list, S)` when an argument is neither a list nor a partial list.',
     'These implementation-defined checks follow ISO/IEC TS 13211-3:2025,',
     '8.18.1.3 g and h; this behavior is not a known deviation.',
+    'The checks are optional. EyeProlog elects to perform both consistently.',
+    'Dedicated regressions require the exact error for atomic non-lists and',
+    'improper lists across both arities and both sequence positions, while',
+    'accepting variables, proper lists, and partial lists. The upstream quads',
+    'allow checking and non-checking outcomes and do not prove this policy.',
     '',
     'The Part 3 implementation target is',
     '[ISO/IEC TS 13211-3:2025](https://www.iso.org/standard/83635.html).',

package/test/run-regression.mjs

@@ -1230,6 +1230,44 @@ why(
         assertEqual(forbiddenFresh.failed, 1, 'fresh thrown variable is detected');
       },
     },
+    {
+      name: 'phrase terminal-sequence checks are consistent across arities and list shapes (issue #94)',
+      run: () => {
+        // The upstream quads allow both checking and non-checking processors.
+        // Require EyeProlog's chosen diagnostic, not either portable outcome.
+        const bodies = ['[]', '[a]', '{true}', '{fail}', '{write(reached)}', '!', 'p'];
+        const invalid = ['non_list', '0', 'f(a)', '[a|non_list]', '[a,b|0]', '[a,b,c|f(t)]'];
+        for (const body of bodies) {
+          for (const bad of invalid) {
+            for (const call of [`phrase(${body}, Bad)`, `phrase(${body}, Bad, [])`,
+              `phrase(${body}, [], Bad)`]) {
+              let output = '';
+              runEyeProlog('p --> [a].', {
+                ioOptions: { write: (text) => { output += text; } },
+                goal: `Bad=${bad}, catch((${call}, write(missed)), error(type_error(list, Bad), _), write(ok))`,
+              });
+              assertEqual(output, 'ok', `${call} with ${bad}`);
+            }
+          }
+        }
+        for (const goal of [
+          'phrase([], [])',
+          'phrase([a], [a])',
+          'phrase([a], L), L == [a]',
+          'phrase([a], [a|T]), T == []',
+          'phrase([], S, S), var(S)',
+          'phrase([], [a|T], [a|T]), var(T)',
+          'phrase([], L, [a|T]), L == [a|T], var(T)',
+          'phrase([a], [a|T], T), var(T)',
+          'phrase([f(a),1], [f(a),1])',
+        ]) {
+          let output = '';
+          runEyeProlog('', { goal: `(${goal}), write(ok)`,
+            ioOptions: { write: (text) => { output += text; } } });
+          assertEqual(output, 'ok', goal);
+        }
+      },
+    },
     {
       name: 'runQuads matches the corrected ISO phrase quad boundaries',
       run: () => {
@@ -4813,6 +4851,132 @@ answer(Result) :- countdown(2048, Result), Result = 2048.
         assertEqual(answers.length, 1, 'dynamic clause answer count');
       },
     },
+    {
+      // ISO 7.6.2 a/b, checked against the 8.8.1.4 worked example for legs/2.
+      name: 'preparing a Prolog text converts variable body goals to call/1',
+      run: () => {
+        const program = Program.parse(':- dynamic(legs/2).\nlegs(A, 7) :- A, call(A).\n');
+        const solver = new Solver(program, {});
+        const goal = parseGoalText('clause(legs(c, 7), Body)');
+        const answers = [...solver.solve([goal], new Env(), 0)];
+        assertEqual(answers.length, 1, 'clause answer count');
+        assertEqual(termToString(copyResolved(goal.args[1], answers[0])), '(call(c), call(c))', 'converted body');
+      },
+    },
+    {
+      name: 'preparation and assertz/1 agree on clause body conversion',
+      run: () => {
+        const fromText = Program.parse(':- dynamic(p/1).\np(G) :- G.\n');
+        const textGoal = parseGoalText('clause(p(true), B)');
+        const textAnswers = [...new Solver(fromText, {}).solve([textGoal], new Env(), 0)];
+        const asserted = Program.parse('run(B) :- assertz((q(G) :- G)), clause(q(true), B).\n');
+        const assertGoal = parseGoalText('run(B)');
+        const assertAnswers = [...new Solver(asserted, {}).solve([assertGoal], new Env(), 0)];
+        assertEqual(textAnswers.length, 1, 'text clause answer count');
+        assertEqual(assertAnswers.length, 1, 'asserted clause answer count');
+        assertEqual(
+          termToString(copyResolved(textGoal.args[1], textAnswers[0])),
+          termToString(copyResolved(assertGoal.args[0], assertAnswers[0])),
+          'converted bodies agree',
+        );
+      },
+    },
+    {
+      // 7.6.2 b converts the arguments of ;/2 and ->/2 recursively.
+      name: 'body conversion recurses through disjunction and if-then',
+      run: () => {
+        const program = Program.parse(':- dynamic(r/3).\nr(A, B, C) :- (A ; B), (C -> true ; true).\n');
+        const solver = new Solver(program, {});
+        const goal = parseGoalText('clause(r(a, b, c), Body)');
+        const answers = [...solver.solve([goal], new Env(), 0)];
+        assertEqual(answers.length, 1, 'clause answer count');
+        assertEqual(
+          termToString(copyResolved(goal.args[1], answers[0])),
+          "(';'(call(a), call(b)), ';'(->(call(c), true), true))",
+          'recursively converted body',
+        );
+      },
+    },
+    {
+      // 7.8.3: a cut inside call/1 is local, so the remaining clauses survive.
+      name: 'a variable body goal from a Prolog text keeps cut local',
+      run: () => {
+        const program = Program.parse('s(G) :- G.\ns(_) :- true.\n');
+        const solver = new Solver(program, {});
+        const answers = [...solver.solve([parseGoalText('s(!)')], new Env(), 0)];
+        assertEqual(answers.length, 2, 'cut did not prune the second clause');
+      },
+    },
+    {
+      // https://github.com/eyereasoner/eyeprolog/issues/96
+      name: 'clause/2 keeps static procedures private in the default mode',
+      run: () => {
+        const program = Program.parse('elk(X) :- moose(X).\nmoose(bertha).\n');
+        const solver = new Solver(program, {});
+        let caught = null;
+        try {
+          [...solver.solve([parseGoalText('clause(elk(N), Body)')], new Env(), 0)];
+        } catch (error) {
+          caught = error;
+        }
+        if (!caught) throw new Error('clause/2 unexpectedly inspected a static procedure');
+        assertEqual(caught.formal, 'permission_error(access, private_procedure)', 'formal error');
+        assertEqual(termToString(caught.culprit), '/(elk, 1)', 'culprit predicate indicator');
+      },
+    },
+    {
+      name: 'clause/2 inspects a procedure declared dynamic in the default mode',
+      run: () => {
+        const program = Program.parse(':- dynamic(elk/1).\nelk(X) :- moose(X).\nmoose(bertha).\n');
+        const solver = new Solver(program, {});
+        const answers = [...solver.solve([parseGoalText('clause(elk(N), Body)')], new Env(), 0)];
+        assertEqual(answers.length, 1, 'dynamic clause answer count');
+      },
+    },
+    {
+      name: 'clause/2 inspects procedures created by assertz/1 in the default mode',
+      run: () => {
+        const program = Program.parse('run(Body) :- assertz(elk(bertha)), clause(elk(_), Body).\n');
+        const solver = new Solver(program, {});
+        const answers = [...solver.solve([parseGoalText('run(Body)')], new Env(), 0)];
+        assertEqual(answers.length, 1, 'asserted clause answer count');
+      },
+    },
+    {
+      name: 'clause/2 and assertz/1 agree on which procedures are static',
+      run: () => {
+        const program = Program.parse('elk(bertha).\n');
+        const solver = new Solver(program, {});
+        const formals = [];
+        for (const goal of ['clause(elk(_), Body)', 'assertz(elk(clara))', 'retract(elk(bertha))']) {
+          try {
+            [...solver.solve([parseGoalText(goal)], new Env(), 0)];
+            formals.push(null);
+          } catch (error) {
+            formals.push(error.formal);
+          }
+        }
+        assertEqual(formals[0], 'permission_error(access, private_procedure)', 'clause/2 access');
+        assertEqual(formals[1], 'permission_error(modify, static_procedure)', 'assertz/1 modification');
+        assertEqual(formals[2], 'permission_error(modify, static_procedure)', 'retract/1 modification');
+      },
+    },
+    {
+      // A static procedure stays private even when clause/2 is also given a
+      // non-callable body, matching the existing strict-mode error ordering.
+      name: 'clause/2 reports private access before body callability',
+      run: () => {
+        const program = Program.parse('elk(bertha).\n');
+        const solver = new Solver(program, {});
+        let caught = null;
+        try {
+          [...solver.solve([parseGoalText('clause(elk(_), 4)')], new Env(), 0)];
+        } catch (error) {
+          caught = error;
+        }
+        assertEqual(caught?.formal, 'permission_error(access, private_procedure)', 'formal error');
+      },
+    },
     {
       name: 'strict ISO core mode disables normal-profile recursion planning',
       run: () => {

package/the-art-of-eyeprolog.md

@@ -5870,10 +5870,14 @@ look_ahead(X), [X] --> [X].
 `phrase(+Body,?Sequence)` accepts or generates a complete sequence.
 `phrase(+Body,?Sequence,?Rest)` leaves `Rest` unconsumed and is steadfast in
 that argument. A variable body raises `instantiation_error`; a non-callable
-body raises `type_error(callable)`. EyeProlog performs terminal-sequence checks and currently reports
-`type_error(list)` for a rejected non-list. This is a normal-profile
-interoperability choice, not a Part 3 conformance claim; Part 3 defines a
-dedicated terminal-sequence error category. See
+body raises `type_error(callable)`. EyeProlog elects to perform the optional
+terminal-sequence checks of ISO/IEC TS 13211-3:2025, 8.18.1.3 g and h.
+It consistently reports `type_error(list, Culprit)` for invalid input in both
+arities and invalid remainder in `phrase/3`, including improper lists.
+Variables, proper lists, and partial lists pass these checks. Validation
+precedes grammar execution; an otherwise valid failing grammar does not
+suppress the diagnostic. Dedicated regressions enforce this policy separately
+from the portable quads, which accept both checking and non-checking outcomes. See
 [`ISO-PART2-PART3-SCOPE.md`](test/conformance/ISO-PART2-PART3-SCOPE.md).
 
 #### A bidirectional expression grammar
@@ -6142,7 +6146,7 @@ partial list.
 
 #### Dynamic database and procedure information
 
-- **`clause(+Head,?Body)`** — Enumerates fresh copies of source clauses matching the callable `Head`; facts have body `true`. Access to built-ins raises *permission_error(access,private_procedure)*.
+- **`clause(+Head,?Body)`** — Enumerates fresh copies of source clauses matching the callable `Head`; facts have body `true`. Only *public* procedures can be inspected: a procedure defined by a Prolog text is static unless a *dynamic/1* directive declares it, and a procedure first created by *assertz/1* or *asserta/1* is dynamic. Access to a static user procedure, or to a built-in, raises *permission_error(access,private_procedure)*. This applies in every execution mode, not only under `--iso-strict`, and matches the *permission_error(modify,static_procedure)* that *assertz/1* and *retract/1* already raise for the same procedures.
 - **`asserta(+Clause)`, `assertz(+Clause)`** — Insert a copied fact or rule at the beginning or end of a predicate declared *dynamic/1*. Static and built-in procedures cannot be modified.
 - **`retract(+Clause)`** — Removes matching dynamic clauses one at a time on backtracking. A call sees the logical update view captured when it began. A fact pattern matches facts only.
 - **`retractall(+Head)`** — Removes every matching clause from a dynamic procedure, succeeds when none match, and keeps the empty dynamic procedure known.
@@ -10361,7 +10365,7 @@ must preserve the same observable outcome. Additional normal-mode syntax may
 accept texts outside the strict grammar, but it may not reinterpret an accepted
 standard case.
 
-The file-based conformance corpus contains 805 cases, including 388 focused ISO cases derived from the success, failure, mode, and error behavior in ISO/IEC 13211-1 clauses 7 and 8, Part 2 modules, and Part 3 grammar rules.
+The file-based conformance corpus contains 808 cases, including 391 focused ISO cases derived from the success, failure, mode, and error behavior in ISO/IEC 13211-1 clauses 7 and 8, Part 2 modules, and Part 3 grammar rules.
 Separate exact-output suites check 210 normal examples and 61 proof examples; all executable chapter programs are parsed and their declared goals are executed. The eight-case
 playground contract suite imports the production worker, sends real reasoning
 requests through its message protocol, and crawls the served module graph for