eyeprolog 1.5.49 → 1.5.51

package/conformance-report.md

@@ -32,7 +32,7 @@ spelling therefore changes this report even when no corpus file is added or remo
 | context | 11 | 0 | 0 | 0 | 11 |
 | control | 15 | 0 | 0 | 0 | 15 |
 | explicit-tabling | 6 | 0 | 0 | 0 | 6 |
-| iso | 171 | 217 | 0 | 0 | 388 |
+| iso | 173 | 219 | 0 | 0 | 392 |
 | lists | 52 | 3 | 0 | 0 | 55 |
 | modules | 2 | 0 | 0 | 0 | 2 |
 | negation | 8 | 0 | 19 | 0 | 27 |
@@ -45,7 +45,7 @@ spelling therefore changes this report even when no corpus file is added or remo
 | terms | 26 | 3 | 0 | 0 | 29 |
 | unification | 18 | 0 | 0 | 0 | 18 |
 | variables | 16 | 7 | 0 | 0 | 23 |
-| **Total** | **493** | **272** | **19** | **21** | **805** |
+| **Total** | **495** | **274** | **19** | **21** | **809** |
 
 ## DCG conformance clarification
 

package/examples/book/README.md

@@ -61,15 +61,13 @@ npm run generate
 
 ## Chapter 8: Collecting and choosing answers
 
-- [01-findall.pl](chapter-08/01-findall.pl)
-- [02-outgoing_costs.pl](chapter-08/02-outgoing_costs.pl)
-- [03-best_route.pl](chapter-08/03-best_route.pl)
+- [01-outgoing_costs.pl](chapter-08/01-outgoing_costs.pl)
+- [02-best_route.pl](chapter-08/02-best_route.pl)
 
 ## Chapter 9: Structured data, text, and contexts
 
-- [01-functor.pl](chapter-09/01-functor.pl)
-- [02-normalized.pl](chapter-09/02-normalized.pl)
-- [03-message.pl](chapter-09/03-message.pl)
+- [01-normalized.pl](chapter-09/01-normalized.pl)
+- [02-message.pl](chapter-09/02-message.pl)
 
 ## Chapter 10: From puzzles to models
 
@@ -148,8 +146,7 @@ npm run generate
 
 - [01-worker.pl](chapter-24/01-worker.pl) — Generate, constrain, describe
 - [02-simple_path.pl](chapter-24/02-simple_path.pl) — Search over states
-- [03-reachable.pl](chapter-24/03-reachable.pl) — Existence, one witness, and all witnesses
-- [04-best_plan.pl](chapter-24/04-best_plan.pl) — Optimization is search plus an order
+- [03-best_plan.pl](chapter-24/03-best_plan.pl) — Optimization is search plus an order
 
 ## Chapter 25: Case study: an auditable decision service
 
@@ -174,11 +171,10 @@ npm run generate
 
 ## Chapter 28: Algebra, symmetry, and representation
 
-- [01-program.pl](chapter-28/01-program.pl) — Unification is structural equation solving
-- [02-triangle.pl](chapter-28/02-triangle.pl) — Symmetry reduces search
-- [03-rectangle.pl](chapter-28/03-rectangle.pl) — Relations reveal inverse problems
-- [04-integer_rectangle.pl](chapter-28/04-integer_rectangle.pl)
-- [05-preserves_combine.pl](chapter-28/05-preserves_combine.pl) — Composition, homomorphism, and reusable laws
+- [01-triangle.pl](chapter-28/01-triangle.pl) — Symmetry reduces search
+- [02-rectangle.pl](chapter-28/02-rectangle.pl) — Relations reveal inverse problems
+- [03-integer_rectangle.pl](chapter-28/03-integer_rectangle.pl)
+- [04-preserves_combine.pl](chapter-28/04-preserves_combine.pl) — Composition, homomorphism, and reusable laws
 
 ## Chapter 29: Search as experimental mathematics
 

package/examples/book/chapter-03/09-program.pl

@@ -1,2 +1,2 @@
 % From The Art of EyeProlog, Chapter 3 — Equality, unification, and the occurs check.
-(X = wrapper(X)).
+cyclic_unification :- X = wrapper(X).

package/examples/iso-grouped-solutions.pl

@@ -5,6 +5,9 @@
 %% goal: report(X0, X1)
 
 
+% clause/2 may only inspect a public procedure, so sale/3 is declared dynamic.
+:- dynamic(sale/3).
+
 sale(north, ada, 7).
 sale(north, ada, 7).
 sale(north, ben, 5).

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "1.5.49",
+  "version": "1.5.51",
   "description": "EyeProlog turns facts and rules into answers and proofs.",
   "type": "module",
   "main": "./index.js",

package/src/iso.js

@@ -733,8 +733,14 @@ function* clauseSolutions({ solver, goal, env }, state) {
   // EyeProlog selects private-procedure access before Body callability when both
   // conditions hold. ISO 7.12 permits an implementation-dependent choice when
   // more than one error condition is simultaneously satisfied.
-  if (isProcessorStaticProcedure(solver, head) ||
-      (solver.isoStrict && group && !group.dynamic)) {
+  //
+  // A procedure defined by a Prolog text is static unless a dynamic/1
+  // directive says otherwise (ISO 7.5.2 and 8.9), and clause/2 may only
+  // inspect a public (dynamic) procedure (ISO 8.8.1.3). Static is therefore
+  // the default in every mode, not only under --iso-strict: assert/1,
+  // retract/1, and abolish/1 already reject static procedures unconditionally,
+  // and clause/2 now agrees with them.
+  if (isProcessorStaticProcedure(solver, head) || (group && !group.dynamic)) {
     throw new PrologError('permission_error(access, private_procedure)', indicator);
   }
   callableOrVariable(goal.args[1], env);

package/src/program.js

@@ -778,12 +778,19 @@ class ProgramBuilder {
       }
 
       if (!isDirectiveClause(clause)) {
-        if (program.strictIso && Array.isArray(clause.body) && clause.body.length > 0) {
+        if (Array.isArray(clause.body) && clause.body.length > 0) {
           // ISO 7.6.2 applies when source text is prepared as well as when a
           // clause term is asserted dynamically. Keep the original variable
           // objects while wrapping variable goals in call/1 so sharing with
           // the head (and recursively through ;/2 and ->/2) is preserved for
           // later clause/2 and retract/1 conversion back to terms.
+          //
+          // 7.5.1 prepares the read-terms of a Prolog text into database
+          // clauses by this same conversion, so it is not conditional on the
+          // strict profile. Skipping it left a bare variable goal where the
+          // standard requires call/1, which both reports the wrong body term
+          // through clause/2 (8.8.1.4, legs/2) and makes a cut in that goal
+          // transparent instead of local to the call (7.8.3).
           clause.body = clause.body.map((goal) => convertClauseBodyTerm(goal));
         }
         assertHeadIsDefinable(clause.head, program.strictIso);
@@ -1872,16 +1879,28 @@ function assertDynamicIndicatorIsDefinable(indicator, strictIso = false) {
 
 function assertPredicateIsDefinable(name, arity, strictIso = false) {
   // false/0 is standardized as a static built-in by Corrigendum 2 and cannot
-  // be redefined in either profile.  Strict core mode extends the same ISO
-  // rule to every Part-1 built-in/control construct; the normal EyeProlog
-  // profile keeps its historical source-compatibility behavior.
-  const strictSyntaxProcedure = strictIso && (
-    (name === ',' && arity === 2) ||
-    (name === ':-' && (arity === 1 || arity === 2))
-  );
+  // be redefined in either profile.
+  //
+  // ISO 7.4.3 requires that the predicate indicator of the head of a clause in
+  // a Prolog text is not that of a built-in predicate or a control construct.
+  // That subclause otherwise defers to assertz/1 and waives only the static
+  // procedure error, so the built-in restriction is a separate requirement and
+  // is not profile-dependent. The strict ISO registry holds exactly the Part 1
+  // built-ins and control constructs, so it is consulted in every mode.
+  //
+  // EyeProlog's library and extension predicates are deliberately absent from
+  // that registry and stay redefinable, which preserves the source
+  // compatibility that user programs rely on.
+  //
+  // (,)/2 is a control construct (table 9) but is recognized by the parser
+  // rather than the registry, so it is named here. (:-)/1-2 come from the STC
+  // #56 working draft rather than published text and stay strict-only.
+  const controlConstruct = name === ',' && arity === 2;
+  const draftSyntaxProcedure = strictIso && name === ':-' && (arity === 1 || arity === 2);
   if ((name === 'false' && arity === 0) ||
-      (strictIso && getStrictIsoRegistry().get(name, arity)) ||
-      strictSyntaxProcedure) {
+      getStrictIsoRegistry().get(name, arity) ||
+      controlConstruct ||
+      draftSyntaxProcedure) {
     throw staticProcedureModificationError(name, arity);
   }
 }

package/test/conformance/ISO-BUILTIN-MODE-ERROR-MATRIX.md

@@ -141,7 +141,7 @@ The Corrigendum 2 additions have the same shape.
 
 | Clause / predicate | Prescribed row | Status | Executable evidence |
 | --- | --- | --- | --- |
-| 8.8.1 `clause/2` | enumerate clauses of a public user-defined procedure | covered | dynamic-clause tests and grouped-solutions/clause corpus |
+| 8.8.1 `clause/2` | enumerate clauses of a public user-defined procedure | covered | dynamic-clause tests and grouped-solutions/clause corpus; `iso/clause_static_and_dynamic_access` and `error/iso/clause_static_user_procedure` pin the static/private default in all modes |
 | 8.8.1 error (a) | variable head -> instantiation error | covered | strict `clause(X,_)` |
 | 8.8.1 error (b) | non-callable head -> callable type error | covered | strict `clause(4,_)` |
 | 8.8.1 error (c) | private procedure -> access/private-procedure permission error | covered | strict static/private tests |

package/test/conformance/ISO-PROLOG-TEXT-EXECUTION-MATRIX.md

@@ -23,7 +23,7 @@ chosen behavior is also indexed by `ISO-IMPLEMENTATION-DEFINED.md`.
 | 7.4.2.7 `include/1` | covered | The included text is prepared at the directive position and shares operator/character/flag preparation state with its parent. |
 | 7.4.2.8 `ensure_loaded/1` | covered | A source is prepared at most once in the current load graph, including repeated references and self/top-level references. |
 | 7.4.2.9 `set_prolog_flag/2` | covered | Preparation-time flag changes affect subsequent text and are replayed into execution state; strict flag names/values/changeability remain governed by the closed 7.11 audit. |
-| 7.4.3 source clauses | covered | Source heads/bodies are validated like program clauses, standardized static/control procedures are protected, declarations can create empty procedures, and body conversion follows 7.6.2 while preserving head/body variable identity. |
+| 7.4.3 source clauses | covered | Source heads/bodies are validated like program clauses, standardized static/control procedures are protected, declarations can create empty procedures, and body conversion follows 7.6.2 while preserving head/body variable identity. The built-in restriction applies in every execution mode, so consulting a clause for a built-in predicate or control construct reports the same `permission_error(modify, static_procedure)` as `assert`ing one; EyeProlog's own library and extension predicates are not standard built-ins and stay redefinable. Corpus: `error/iso/consult_redefines_builtin`. |
 
 The strict release test `closes ISO 7.4 Prolog-text preparation and directive
 rows` exercises the cross-text operator/character/flag state, include and
@@ -37,7 +37,7 @@ and preparation error cases.
 | --- | --- | --- |
 | 7.5.1 initial database and clause order | covered | Prepared clauses retain textual preparation order. The implementation-defined initial database/standard-procedure choices are documented separately. |
 | 7.5.2 static and dynamic procedures | covered | Source procedures are static unless declared dynamic; asserting a previously absent predicate creates a dynamic procedure; modification of protected/static procedures is rejected. |
-| 7.5.3 private and public procedures | covered | User static procedures are private to `clause/2`; dynamic procedures are public; standardized built-ins/control forms remain static/private. |
+| 7.5.3 private and public procedures | covered | User static procedures are private to `clause/2` in every execution mode, not only under `--iso-strict`; dynamic procedures are public; standardized built-ins/control forms remain static/private. Corpus: `iso/clause_static_and_dynamic_access`, `error/iso/clause_static_user_procedure`. |
 | 7.5.4 database update visibility | covered | Dynamic calls use the logical-update view: an activation continues over the clause set visible when it began, while later activations see successful assertions/retractions. `retractall/1` retains an empty dynamic procedure and `abolish/1` removes it. |
 
 The strict test `closes ISO 7.5-7.7 database, conversion, and execution rows`
@@ -51,7 +51,7 @@ The complete 8.8-8.9 database built-in modes/errors remain covered by
 | Row | Status | EyeProlog disposition / executable evidence |
 | --- | --- | --- |
 | 7.6.1 term-to-goal/body boundary | covered | Callable terms enter execution as goals; variables are deferred through `call/1`; non-callable numeric/body terms are rejected rather than silently coerced. |
-| 7.6.2 term-to-body conversion | covered | Variables become `call/1`; conjunction, disjunction, and if-then bodies are converted recursively; non-control callable terms retain their predication; variable identity is preserved across the converted clause. |
+| 7.6.2 term-to-body conversion | covered | Variables become `call/1`; conjunction, disjunction, and if-then bodies are converted recursively; non-control callable terms retain their predication; variable identity is preserved across the converted clause. The conversion runs in every execution mode, for clauses prepared from a Prolog text as well as for `assert`ed clauses, so both paths yield the same body term. Corpus: `iso/clause_body_conversion`. |
 | 7.6.3 clause-to-term observation | covered | `clause/2` returns fresh renamed clause observations with the required sharing between head and body. |
 | 7.6.4 update conversion | covered | `asserta/1`, `assertz/1`, `retract/1`, and prepared source clauses use the same strict body-conversion rules and reject malformed bodies before database mutation. |
 

package/test/conformance/README.md

@@ -140,7 +140,7 @@ Selected cases are adapted from the ISO and standard-core suites of Logtalk,
 Scryer Prolog, Trealla Prolog, and SWI-Prolog. Their upstream identifiers and licenses
 are recorded in [THIRD_PARTY.md](THIRD_PARTY.md).
 
-The corpus has 388 cases in `iso/` and 805 file-based conformance cases in total. Of those, 11 cases in `stc/` are explicitly labelled working-draft review evidence rather than normative ISO claims. The separate vendored strict-reader WG17 matrix is a deterministic regression snapshot; the live Neumerkel gate discovers the current upstream inventory at run time; release/report checks separately verify the tracked `NEUMERKEL-LATEST.md`. The generated `conformance-report.md` records local corpus totals and links to that live evidence. Together with regression, documentation-sync, API, example, and book-example checks, `npm test` is the release gate.
+The corpus has 392 cases in `iso/` and 809 file-based conformance cases in total. Of those, 11 cases in `stc/` are explicitly labelled working-draft review evidence rather than normative ISO claims. The separate vendored strict-reader WG17 matrix is a deterministic regression snapshot; the live Neumerkel gate discovers the current upstream inventory at run time; release/report checks separately verify the tracked `NEUMERKEL-LATEST.md`. The generated `conformance-report.md` records local corpus totals and links to that live evidence. Together with regression, documentation-sync, API, example, and book-example checks, `npm test` is the release gate.
 
 ## Updating expected output
 

package/test/conformance/cases/iso/clause_body_conversion.pl

@@ -0,0 +1,41 @@
+% ISO 7.6.2 a: when a term is converted to the body of a clause, a variable
+% goal becomes call/1. ISO 7.6.2 b applies the conversion recursively through
+% (,)/2, (;)/2 and (->)/2. ISO 7.5.1 prepares the read-terms of a Prolog text
+% into database clauses by that same conversion, so a clause loaded from a
+% Prolog text and the identical clause added by assertz/1 must agree.
+
+:- dynamic(from_text/1).
+from_text(Goal) :- Goal.
+
+:- dynamic(nested/3).
+nested(A, B, C) :- (A ; B), (C -> true ; true).
+
+:- dynamic(cut_scope/1).
+cut_scope(Goal) :- Goal.
+cut_scope(_) :- true.
+
+%% goal: text_body(X0)
+
+text_body(Body) :-
+    clause(from_text(true), Body).
+
+%% goal: nested_body(X0)
+
+nested_body(Body) :-
+    clause(nested(a, b, c), Body).
+
+%% goal: assert_agrees_with_text(X0)
+
+% The same clause added at run time must convert to the same body term.
+assert_agrees_with_text(Agree) :-
+    assertz((asserted(Goal) :- Goal)),
+    clause(from_text(true), TextBody),
+    clause(asserted(true), AssertedBody),
+    ( TextBody == AssertedBody -> Agree = agree ; Agree = differ ).
+
+%% goal: cut_is_local(X0)
+
+% 7.8.3: a cut in the argument of call/1 is local to that call, so it must not
+% prune the remaining clauses of cut_scope/1.
+cut_is_local(Solutions) :-
+    findall(taken, cut_scope(!), Solutions).

package/test/conformance/cases/iso/clause_static_and_dynamic_access.pl

@@ -0,0 +1,26 @@
+% Procedures defined by a Prolog text are static unless a dynamic/1 directive
+% makes them public. clause/2 inspects public procedures and raises a
+% permission error for static ones, in every execution mode.
+% https://github.com/eyereasoner/eyeprolog/issues/96
+
+:- dynamic(elk/1).
+elk(X) :- moose(X).
+
+moose(bertha).
+
+%% goal: public_clause(X0)
+
+public_clause(Body) :-
+    clause(elk(bertha), Body).
+
+%% goal: private_clause(X0)
+
+private_clause(Culprit) :-
+    catch(clause(moose(_), _), error(Formal, _), true),
+    Formal = permission_error(access, private_procedure, Culprit).
+
+%% goal: asserted_clause(X0)
+
+asserted_clause(Body) :-
+    assertz(caribou(rudolf)),
+    clause(caribou(_), Body).

package/test/conformance/cases/iso/grouped_solutions_and_clauses.pl

@@ -1,3 +1,8 @@
+% clause/2 may only inspect public (dynamic) procedures. Predicates that are
+% read back with clause/2 below are declared dynamic; the rest stay static.
+:- dynamic(parent/2).
+:- dynamic(same/1).
+
 b(2, two).
 b(1, one).
 b(1, one).

package/test/conformance/cases/stc/clause_variable_identity.pl

@@ -2,6 +2,8 @@
 % https://www.complang.tuwien.ac.at/ulrich/iso-prolog/stc#37
 %% goal: clause_variable_identity
 
+% clause/2 may only inspect a public procedure, so a/1 is declared dynamic.
+:- dynamic(a/1).
 a(X) :- b(X).
 
 clause_variable_identity :-

package/test/conformance/errors/iso/clause_static_user_procedure.pl

@@ -0,0 +1,13 @@
+% A procedure defined by a Prolog text is static, and therefore private, unless
+% a dynamic/1 directive makes it public (ISO 7.5.2, 8.9). clause/2 may only
+% inspect a public procedure (ISO 8.8.1.3), so reading a static user procedure
+% is a permission error rather than a source of solutions.
+% https://github.com/eyereasoner/eyeprolog/issues/96
+%% goal: answer
+
+elk(X) :- moose(X).
+
+moose(bertha).
+
+answer :-
+    clause(elk(N), Body).

package/test/conformance/errors/iso/consult_redefines_builtin.pl

@@ -0,0 +1,11 @@
+% ISO 7.4.3: a clause of a clause-term in a Prolog text must satisfy the same
+% constraints as a successful assertz/1, waiving only the static-procedure
+% error, and the predicate indicator of its head must not be that of a built-in
+% predicate or a control construct. Consulting a definition of clause/2 is
+% therefore a permission error, exactly as asserta/1 already reported.
+% https://github.com/eyereasoner/eyeprolog/issues/97
+%% goal: answer
+
+clause(elk(1), 2).
+
+answer.

package/test/conformance/expected/iso/clause_body_conversion.pl

@@ -0,0 +1,4 @@
+text_body(call(true)).
+nested_body(((call(a) ; call(b)), (call(c) -> true ; true))).
+assert_agrees_with_text(agree).
+cut_is_local([taken, taken]).

package/test/conformance/expected/iso/clause_static_and_dynamic_access.pl

@@ -0,0 +1,3 @@
+public_clause(moose(bertha)).
+private_clause(moose / 1).
+asserted_clause(true).

package/test/conformance/expected-errors/iso/clause_static_user_procedure.txt

@@ -0,0 +1 @@
+error(permission_error(access, private_procedure), /(elk, 1))

package/test/conformance/expected-errors/iso/consult_redefines_builtin.txt

@@ -0,0 +1 @@
+error(permission_error(modify, static_procedure), /(clause, 2))

package/test/run-regression.mjs

@@ -4851,6 +4851,212 @@ answer(Result) :- countdown(2048, Result), Result = 2048.
         assertEqual(answers.length, 1, 'dynamic clause answer count');
       },
     },
+    {
+      // ISO 7.6.2 a/b, checked against the 8.8.1.4 worked example for legs/2.
+      name: 'preparing a Prolog text converts variable body goals to call/1',
+      run: () => {
+        const program = Program.parse(':- dynamic(legs/2).\nlegs(A, 7) :- A, call(A).\n');
+        const solver = new Solver(program, {});
+        const goal = parseGoalText('clause(legs(c, 7), Body)');
+        const answers = [...solver.solve([goal], new Env(), 0)];
+        assertEqual(answers.length, 1, 'clause answer count');
+        assertEqual(termToString(copyResolved(goal.args[1], answers[0])), '(call(c), call(c))', 'converted body');
+      },
+    },
+    {
+      name: 'preparation and assertz/1 agree on clause body conversion',
+      run: () => {
+        const fromText = Program.parse(':- dynamic(p/1).\np(G) :- G.\n');
+        const textGoal = parseGoalText('clause(p(true), B)');
+        const textAnswers = [...new Solver(fromText, {}).solve([textGoal], new Env(), 0)];
+        const asserted = Program.parse('run(B) :- assertz((q(G) :- G)), clause(q(true), B).\n');
+        const assertGoal = parseGoalText('run(B)');
+        const assertAnswers = [...new Solver(asserted, {}).solve([assertGoal], new Env(), 0)];
+        assertEqual(textAnswers.length, 1, 'text clause answer count');
+        assertEqual(assertAnswers.length, 1, 'asserted clause answer count');
+        assertEqual(
+          termToString(copyResolved(textGoal.args[1], textAnswers[0])),
+          termToString(copyResolved(assertGoal.args[0], assertAnswers[0])),
+          'converted bodies agree',
+        );
+      },
+    },
+    {
+      // 7.6.2 b converts the arguments of ;/2 and ->/2 recursively.
+      name: 'body conversion recurses through disjunction and if-then',
+      run: () => {
+        const program = Program.parse(':- dynamic(r/3).\nr(A, B, C) :- (A ; B), (C -> true ; true).\n');
+        const solver = new Solver(program, {});
+        const goal = parseGoalText('clause(r(a, b, c), Body)');
+        const answers = [...solver.solve([goal], new Env(), 0)];
+        assertEqual(answers.length, 1, 'clause answer count');
+        assertEqual(
+          termToString(copyResolved(goal.args[1], answers[0])),
+          "(';'(call(a), call(b)), ';'(->(call(c), true), true))",
+          'recursively converted body',
+        );
+      },
+    },
+    {
+      // 7.8.3: a cut inside call/1 is local, so the remaining clauses survive.
+      name: 'a variable body goal from a Prolog text keeps cut local',
+      run: () => {
+        const program = Program.parse('s(G) :- G.\ns(_) :- true.\n');
+        const solver = new Solver(program, {});
+        const answers = [...solver.solve([parseGoalText('s(!)')], new Env(), 0)];
+        assertEqual(answers.length, 2, 'cut did not prune the second clause');
+      },
+    },
+    {
+      // https://github.com/eyereasoner/eyeprolog/issues/97
+      name: 'a Prolog text cannot supply clauses for a built-in predicate',
+      run: () => {
+        let caught = null;
+        try {
+          Program.parse('clause(elk(1), 2).\n');
+        } catch (error) {
+          caught = error;
+        }
+        if (!caught) throw new Error('a clause for clause/2 was accepted from a Prolog text');
+        assertEqual(caught.formal, 'permission_error(modify, static_procedure)', 'formal error');
+        assertEqual(termToString(caught.culprit), '/(clause, 2)', 'culprit predicate indicator');
+      },
+    },
+    {
+      name: 'consult and asserta/1 agree on redefining a built-in',
+      run: () => {
+        let textFormal = null;
+        try {
+          Program.parse('clause(elk(1), 2).\n');
+        } catch (error) {
+          textFormal = error.formal;
+        }
+        const solver = new Solver(Program.parse('run :- asserta(clause(elk(1), 2)).\n'), {});
+        let assertFormal = null;
+        try {
+          [...solver.solve([parseGoalText('run')], new Env(), 0)];
+        } catch (error) {
+          assertFormal = error.formal;
+        }
+        assertEqual(textFormal, 'permission_error(modify, static_procedure)', 'consult path');
+        assertEqual(assertFormal, textFormal, 'assert path agrees with consult');
+      },
+    },
+    {
+      // Control constructs are covered as well as built-in predicates.
+      name: 'a Prolog text cannot supply clauses for a control construct',
+      run: () => {
+        for (const [source, indicator] of [
+          ["';'(a, b).\n", "/(';', 2)"],
+          ["','(a, b).\n", "/(',', 2)"],
+          ['!.\n', '/(!, 0)'],
+        ]) {
+          let caught = null;
+          try {
+            Program.parse(source);
+          } catch (error) {
+            caught = error;
+          }
+          assertEqual(caught?.formal, 'permission_error(modify, static_procedure)', `formal error for ${indicator}`);
+          assertEqual(termToString(caught.culprit), indicator, `culprit for ${indicator}`);
+        }
+      },
+    },
+    {
+      // EyeProlog's library and extension predicates are not standard
+      // built-ins, so user programs may still define their own versions.
+      name: 'a Prolog text may still redefine library predicates',
+      run: () => {
+        const program = Program.parse('member(X, [X]).\nappend([], L, L).\n');
+        assertEqual(program.findGroup('member', 2) != null, true, 'member/2 defined by the text');
+        assertEqual(program.findGroup('append', 3) != null, true, 'append/3 defined by the text');
+      },
+    },
+    {
+      // A dynamic/1 directive names a procedure the text is about to define,
+      // so it is subject to the same restriction.
+      name: 'a dynamic/1 directive cannot name a built-in predicate',
+      run: () => {
+        let caught = null;
+        try {
+          Program.parse(':- dynamic(atom_length/2).\n');
+        } catch (error) {
+          caught = error;
+        }
+        assertEqual(caught?.formal, 'permission_error(modify, static_procedure)', 'formal error');
+        assertEqual(termToString(caught.culprit), '/(atom_length, 2)', 'culprit predicate indicator');
+      },
+    },
+    {
+      // https://github.com/eyereasoner/eyeprolog/issues/96
+      name: 'clause/2 keeps static procedures private in the default mode',
+      run: () => {
+        const program = Program.parse('elk(X) :- moose(X).\nmoose(bertha).\n');
+        const solver = new Solver(program, {});
+        let caught = null;
+        try {
+          [...solver.solve([parseGoalText('clause(elk(N), Body)')], new Env(), 0)];
+        } catch (error) {
+          caught = error;
+        }
+        if (!caught) throw new Error('clause/2 unexpectedly inspected a static procedure');
+        assertEqual(caught.formal, 'permission_error(access, private_procedure)', 'formal error');
+        assertEqual(termToString(caught.culprit), '/(elk, 1)', 'culprit predicate indicator');
+      },
+    },
+    {
+      name: 'clause/2 inspects a procedure declared dynamic in the default mode',
+      run: () => {
+        const program = Program.parse(':- dynamic(elk/1).\nelk(X) :- moose(X).\nmoose(bertha).\n');
+        const solver = new Solver(program, {});
+        const answers = [...solver.solve([parseGoalText('clause(elk(N), Body)')], new Env(), 0)];
+        assertEqual(answers.length, 1, 'dynamic clause answer count');
+      },
+    },
+    {
+      name: 'clause/2 inspects procedures created by assertz/1 in the default mode',
+      run: () => {
+        const program = Program.parse('run(Body) :- assertz(elk(bertha)), clause(elk(_), Body).\n');
+        const solver = new Solver(program, {});
+        const answers = [...solver.solve([parseGoalText('run(Body)')], new Env(), 0)];
+        assertEqual(answers.length, 1, 'asserted clause answer count');
+      },
+    },
+    {
+      name: 'clause/2 and assertz/1 agree on which procedures are static',
+      run: () => {
+        const program = Program.parse('elk(bertha).\n');
+        const solver = new Solver(program, {});
+        const formals = [];
+        for (const goal of ['clause(elk(_), Body)', 'assertz(elk(clara))', 'retract(elk(bertha))']) {
+          try {
+            [...solver.solve([parseGoalText(goal)], new Env(), 0)];
+            formals.push(null);
+          } catch (error) {
+            formals.push(error.formal);
+          }
+        }
+        assertEqual(formals[0], 'permission_error(access, private_procedure)', 'clause/2 access');
+        assertEqual(formals[1], 'permission_error(modify, static_procedure)', 'assertz/1 modification');
+        assertEqual(formals[2], 'permission_error(modify, static_procedure)', 'retract/1 modification');
+      },
+    },
+    {
+      // A static procedure stays private even when clause/2 is also given a
+      // non-callable body, matching the existing strict-mode error ordering.
+      name: 'clause/2 reports private access before body callability',
+      run: () => {
+        const program = Program.parse('elk(bertha).\n');
+        const solver = new Solver(program, {});
+        let caught = null;
+        try {
+          [...solver.solve([parseGoalText('clause(elk(_), 4)')], new Env(), 0)];
+        } catch (error) {
+          caught = error;
+        }
+        assertEqual(caught?.formal, 'permission_error(access, private_procedure)', 'formal error');
+      },
+    },
     {
       name: 'strict ISO core mode disables normal-profile recursion planning',
       run: () => {
@@ -8044,14 +8250,16 @@ function whiteBoxCases() {
         assertEqual(termToString(candidates.primary[0].head, new Env(), true), 'row(a0, b0, c0, first)', 'first head');
         assertEqual(termToString(candidates.primary[1].head, new Env(), true), 'row(a0, X, c0, wildcard)', 'wildcard head');
 
+        // A user-defined name: ISO 7.4.3 forbids a Prolog text from defining
+        // clauses for a built-in predicate such as open/3.
         const variableHeavy = Program.parse(Array.from(
           { length: 12 },
-          (_, index) => `open(X${index}, Y${index}, value${index}).`,
+          (_, index) => `gate(X${index}, Y${index}, value${index}).`,
         ).join('\n'));
-        const openGroup = variableHeavy.findGroup('open', 3);
-        selectClauseCandidates(openGroup, parseGoalText('open(a, b, Result)'), new Env());
-        assertEqual(openGroup.demandIndexes.size, 0, 'poor wide index discarded');
-        assertEqual(openGroup.rejectedDemandIndexes.has('0,1'), true, 'poor call mode remembered');
+        const gateGroup = variableHeavy.findGroup('gate', 3);
+        selectClauseCandidates(gateGroup, parseGoalText('gate(a, b, Result)'), new Env());
+        assertEqual(gateGroup.demandIndexes.size, 0, 'poor wide index discarded');
+        assertEqual(gateGroup.rejectedDemandIndexes.has('0,1'), true, 'poor call mode remembered');
       },
     },
     {

package/the-art-of-eyeprolog.md

@@ -770,13 +770,18 @@ Equality in the pure Herbrand reading is syntactic identity after substitution.
 Operationally, unification discovers a substitution that makes terms
 identical. EyeProlog performs an occurs check whenever unification would bind a
 variable. It therefore uses finite-tree unification and rejects a binding when
-the variable occurs anywhere in the proposed value. For example, this call
-fails rather than constructing a cyclic term:
+the variable occurs anywhere in the proposed value. For example, the body of this
+clause fails rather than constructing a cyclic term:
 
 ```eyeprolog
-(X = wrapper(X)).
+cyclic_unification :- X = wrapper(X).
 ```
 
+The goal has to be written inside a clause of its own: ISO 7.4.3 forbids a
+Prolog text from supplying clauses for a built-in predicate, so a bare
+`(X = wrapper(X)).` in a program file is a clause for `(=)/2` and is rejected
+with *permission_error(modify, static_procedure, (=)/2)*.
+
 ISO classifies unifications whose outcome depends on an occurs check as
 subject-to-occurs-check (STO). EyeProlog's default remains the sound finite-tree
 behavior above. For diagnosis, EyeProlog additionally provides the
@@ -6146,7 +6151,7 @@ partial list.
 
 #### Dynamic database and procedure information
 
-- **`clause(+Head,?Body)`** — Enumerates fresh copies of source clauses matching the callable `Head`; facts have body `true`. Access to built-ins raises *permission_error(access,private_procedure)*.
+- **`clause(+Head,?Body)`** — Enumerates fresh copies of source clauses matching the callable `Head`; facts have body `true`. Only *public* procedures can be inspected: a procedure defined by a Prolog text is static unless a *dynamic/1* directive declares it, and a procedure first created by *assertz/1* or *asserta/1* is dynamic. Access to a static user procedure, or to a built-in, raises *permission_error(access,private_procedure)*. This applies in every execution mode, not only under `--iso-strict`, and matches the *permission_error(modify,static_procedure)* that *assertz/1* and *retract/1* already raise for the same procedures.
 - **`asserta(+Clause)`, `assertz(+Clause)`** — Insert a copied fact or rule at the beginning or end of a predicate declared *dynamic/1*. Static and built-in procedures cannot be modified.
 - **`retract(+Clause)`** — Removes matching dynamic clauses one at a time on backtracking. A call sees the logical update view captured when it began. A fact pattern matches facts only.
 - **`retractall(+Head)`** — Removes every matching clause from a dynamic procedure, succeeds when none match, and keeps the empty dynamic procedure known.
@@ -10365,7 +10370,7 @@ must preserve the same observable outcome. Additional normal-mode syntax may
 accept texts outside the strict grammar, but it may not reinterpret an accepted
 standard case.
 
-The file-based conformance corpus contains 805 cases, including 388 focused ISO cases derived from the success, failure, mode, and error behavior in ISO/IEC 13211-1 clauses 7 and 8, Part 2 modules, and Part 3 grammar rules.
+The file-based conformance corpus contains 809 cases, including 392 focused ISO cases derived from the success, failure, mode, and error behavior in ISO/IEC 13211-1 clauses 7 and 8, Part 2 modules, and Part 3 grammar rules.
 Separate exact-output suites check 210 normal examples and 61 proof examples; all executable chapter programs are parsed and their declared goals are executed. The eight-case
 playground contract suite imports the production worker, sends real reasoning
 requests through its message protocol, and crawls the served module graph for

package/tools/extract-book-examples.mjs

@@ -4,6 +4,8 @@ import path from 'node:path';
 import process from 'node:process';
 import { fileURLToPath } from 'node:url';
 
+import { Program, getStrictIsoRegistry } from '../src/index.js';
+
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const bookPath = path.join(root, 'the-art-of-eyeprolog.md');
 const outputRoot = path.join(root, 'examples', 'book');
@@ -36,6 +38,11 @@ for (const match of book.matchAll(/^(## \d+\. ([^\n]+)|# ([^\n]+)|```eyeprolog\n
   if (!chapter) continue;
   const source = match[4].trim();
   if (!source.endsWith('.')) continue;
+  // The book also uses eyeprolog blocks for template listings and single
+  // illustrative goals. Those read as clauses for a built-in predicate, which
+  // ISO 7.4.3 forbids a Prolog text from defining, so they are not programs
+  // and are not extracted as such.
+  if (definesBuiltIn(source)) continue;
 
   const firstClause = source
     .split('\n')
@@ -46,6 +53,27 @@ for (const match of book.matchAll(/^(## \d+\. ([^\n]+)|# ([^\n]+)|```eyeprolog\n
   chapter.examples.push({ predicate, section, source });
 }
 
+// True when a code block supplies clauses for a standard built-in predicate or
+// control construct, which marks it as a signature listing or goal fragment
+// rather than an extractable program.
+function definesBuiltIn(source) {
+  try {
+    const program = Program.parse(source);
+    const registry = getStrictIsoRegistry();
+    for (const group of program.groups.values()) {
+      if (group.name === ',' && group.arity === 2) return true;
+      if (registry.get(group.name, group.arity)) return true;
+    }
+    return false;
+  } catch (error) {
+    // Preparation itself rejects a clause head that is a built-in, so that
+    // error is the signal we are looking for. Any other parse failure is left
+    // to the book-example test, which reports it instead of silently dropping
+    // the block here.
+    return error?.formal === 'permission_error(modify, static_procedure)';
+  }
+}
+
 const files = new Map();
 const readme = [
   '# The Art of EyeProlog — inline examples',

package/examples/book/chapter-08/01-findall.pl

@@ -1,8 +0,0 @@
-% From The Art of EyeProlog, Chapter 8.
-:- use_module(library(aggregate)).
-:- use_module(library(lists)).
-:- use_module(library(iso_ext)).
-
-findall(Template, Goal, List).
-countall(Goal, Count).
-sumall(Value, Goal, Sum).

package/examples/book/chapter-09/01-functor.pl

@@ -1,4 +0,0 @@
-% From The Art of EyeProlog, Chapter 9.
-functor(Term, Name, Arity).
-arg(Index, Term, Value).
-(Term =.. [Name | Arguments]).

package/examples/book/chapter-24/03-reachable.pl

@@ -1,6 +0,0 @@
-% From The Art of EyeProlog, Chapter 24 — Existence, one witness, and all witnesses.
-:- use_module(library(lists)).
-
-reachable(From, To).
-once(simple_path(From, To, Path)).
-findall(Path, simple_path(From, To, Path), Paths).

package/examples/book/chapter-28/01-program.pl

@@ -1,2 +0,0 @@
-% From The Art of EyeProlog, Chapter 28 — Unification is structural equation solving.
-(pair(X, f(Y)) = pair(g(a), f(b))).