eyeprolog 1.5.50 → 1.5.52

package/conformance-report.md

@@ -32,7 +32,7 @@ spelling therefore changes this report even when no corpus file is added or remo
 | context | 11 | 0 | 0 | 0 | 11 |
 | control | 15 | 0 | 0 | 0 | 15 |
 | explicit-tabling | 6 | 0 | 0 | 0 | 6 |
-| iso | 173 | 218 | 0 | 0 | 391 |
+| iso | 174 | 219 | 0 | 0 | 393 |
 | lists | 52 | 3 | 0 | 0 | 55 |
 | modules | 2 | 0 | 0 | 0 | 2 |
 | negation | 8 | 0 | 19 | 0 | 27 |
@@ -45,7 +45,7 @@ spelling therefore changes this report even when no corpus file is added or remo
 | terms | 26 | 3 | 0 | 0 | 29 |
 | unification | 18 | 0 | 0 | 0 | 18 |
 | variables | 16 | 7 | 0 | 0 | 23 |
-| **Total** | **495** | **273** | **19** | **21** | **808** |
+| **Total** | **496** | **274** | **19** | **21** | **810** |
 
 ## DCG conformance clarification
 

package/examples/book/README.md

@@ -61,15 +61,13 @@ npm run generate
 
 ## Chapter 8: Collecting and choosing answers
 
-- [01-findall.pl](chapter-08/01-findall.pl)
-- [02-outgoing_costs.pl](chapter-08/02-outgoing_costs.pl)
-- [03-best_route.pl](chapter-08/03-best_route.pl)
+- [01-outgoing_costs.pl](chapter-08/01-outgoing_costs.pl)
+- [02-best_route.pl](chapter-08/02-best_route.pl)
 
 ## Chapter 9: Structured data, text, and contexts
 
-- [01-functor.pl](chapter-09/01-functor.pl)
-- [02-normalized.pl](chapter-09/02-normalized.pl)
-- [03-message.pl](chapter-09/03-message.pl)
+- [01-normalized.pl](chapter-09/01-normalized.pl)
+- [02-message.pl](chapter-09/02-message.pl)
 
 ## Chapter 10: From puzzles to models
 
@@ -148,8 +146,7 @@ npm run generate
 
 - [01-worker.pl](chapter-24/01-worker.pl) — Generate, constrain, describe
 - [02-simple_path.pl](chapter-24/02-simple_path.pl) — Search over states
-- [03-reachable.pl](chapter-24/03-reachable.pl) — Existence, one witness, and all witnesses
-- [04-best_plan.pl](chapter-24/04-best_plan.pl) — Optimization is search plus an order
+- [03-best_plan.pl](chapter-24/03-best_plan.pl) — Optimization is search plus an order
 
 ## Chapter 25: Case study: an auditable decision service
 
@@ -174,11 +171,10 @@ npm run generate
 
 ## Chapter 28: Algebra, symmetry, and representation
 
-- [01-program.pl](chapter-28/01-program.pl) — Unification is structural equation solving
-- [02-triangle.pl](chapter-28/02-triangle.pl) — Symmetry reduces search
-- [03-rectangle.pl](chapter-28/03-rectangle.pl) — Relations reveal inverse problems
-- [04-integer_rectangle.pl](chapter-28/04-integer_rectangle.pl)
-- [05-preserves_combine.pl](chapter-28/05-preserves_combine.pl) — Composition, homomorphism, and reusable laws
+- [01-triangle.pl](chapter-28/01-triangle.pl) — Symmetry reduces search
+- [02-rectangle.pl](chapter-28/02-rectangle.pl) — Relations reveal inverse problems
+- [03-integer_rectangle.pl](chapter-28/03-integer_rectangle.pl)
+- [04-preserves_combine.pl](chapter-28/04-preserves_combine.pl) — Composition, homomorphism, and reusable laws
 
 ## Chapter 29: Search as experimental mathematics
 
@@ -238,13 +234,15 @@ npm run generate
 
 ## Chapter 39: Predicate reference
 
-- [01-answer.pl](chapter-39/01-answer.pl) — Library relations by programming role
-- [02-answer-2.pl](chapter-39/02-answer-2.pl)
-- [03-answer-3.pl](chapter-39/03-answer-3.pl)
-- [04-cost.pl](chapter-39/04-cost.pl)
-- [05-message.pl](chapter-39/05-message.pl)
-- [06-task.pl](chapter-39/06-task.pl)
-- [07-program.pl](chapter-39/07-program.pl) — Specialized library implementation notes
+- [01-elk.pl](chapter-39/01-elk.pl) — Reading static procedures
+- [02-solve.pl](chapter-39/02-solve.pl)
+- [03-answer.pl](chapter-39/03-answer.pl) — Library relations by programming role
+- [04-answer-2.pl](chapter-39/04-answer-2.pl)
+- [05-answer-3.pl](chapter-39/05-answer-3.pl)
+- [06-cost.pl](chapter-39/06-cost.pl)
+- [07-message.pl](chapter-39/07-message.pl)
+- [08-task.pl](chapter-39/08-task.pl)
+- [09-program.pl](chapter-39/09-program.pl) — Specialized library implementation notes
 
 ## Chapter 40: Running EyeProlog: command line and corpus
 

package/examples/book/chapter-03/09-program.pl

@@ -1,2 +1,2 @@
 % From The Art of EyeProlog, Chapter 3 — Equality, unification, and the occurs check.
-(X = wrapper(X)).
+cyclic_unification :- X = wrapper(X).

package/examples/book/chapter-39/01-elk.pl

@@ -0,0 +1,6 @@
+% From The Art of EyeProlog, Chapter 39 — Reading static procedures.
+:- public(elk/1).
+
+elk(X) :- moose(X).
+
+moose(bertha).

package/examples/book/chapter-39/02-solve.pl

@@ -0,0 +1,10 @@
+% From The Art of EyeProlog, Chapter 39.
+:- set_prolog_flag(default_procedure_access, public).
+
+solve(true) :- !.
+solve((A, B)) :- !, solve(A), solve(B).
+solve(H) :- clause(H, Body), solve(Body).
+
+elk(X) :- moose(X).
+moose(bertha).
+grazes(X) :- elk(X).

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "1.5.50",
+  "version": "1.5.52",
   "description": "EyeProlog turns facts and rules into answers and proofs.",
   "type": "module",
   "main": "./index.js",

package/src/iso.js

@@ -740,7 +740,13 @@ function* clauseSolutions({ solver, goal, env }, state) {
   // the default in every mode, not only under --iso-strict: assert/1,
   // retract/1, and abolish/1 already reject static procedures unconditionally,
   // and clause/2 now agrees with them.
-  if (isProcessorStaticProcedure(solver, head) || (group && !group.dynamic)) {
+  //
+  // 7.5.3 notes that a public/1 directive would be an extension, so a static
+  // procedure declared public, or any user-defined procedure when the
+  // default_procedure_access flag is public, stays readable here. Either way
+  // the procedure remains static and cannot be modified.
+  if (isProcessorStaticProcedure(solver, head) ||
+      (group && !group.dynamic && !isPublicProcedure(solver, group))) {
     throw new PrologError('permission_error(access, private_procedure)', indicator);
   }
   callableOrVariable(goal.args[1], env);
@@ -798,6 +804,13 @@ function isGrammarRuleProcedure(solver, head) {
   return !solver.isoStrict && head.name === '-->' && head.arity === 2;
 }
 
+// A user-defined procedure is readable by clause/2 when it was declared public
+// or when the processor grants access to every user-defined procedure.
+function isPublicProcedure(solver, group) {
+  if (group.public) return true;
+  return solver.prologFlags?.get('default_procedure_access')?.value?.name === 'public';
+}
+
 function isProcessorStaticProcedure(solver, head) {
   // Conjunction is an ISO control construct (7.5/Table 9) but is executed
   // directly by the solver rather than through the builtin registry.  The

package/src/parser.js

@@ -1130,7 +1130,7 @@ class Parser {
           (['char_conversion', 'set_prolog_flag'].includes(directive.name) && directive.arity === 2)
         );
         const extensionDirective = directive.type === 'compound' && (
-          (['use_module', 'meta_predicate', 'attribute', 'table'].includes(directive.name) && directive.arity === 1) ||
+          (['use_module', 'meta_predicate', 'attribute', 'table', 'public'].includes(directive.name) && directive.arity === 1) ||
           (['module', 'use_module'].includes(directive.name) && directive.arity === 2)
         );
         if (this.strictIso && extensionDirective) {

package/src/program.js

@@ -154,6 +154,10 @@ export class Program {
     this.libraryImports = [];
     this.interopPortabilityWarnings = [];
     this.dynamicPredicates = new Set();
+    // ISO 7.5.3 notes that a public/1 directive declaring user-defined
+    // procedures to be public would be an extension. Such a procedure stays
+    // static -- it cannot be modified -- but clause/2 may inspect it.
+    this.publicPredicates = new Set();
     this.multifilePredicates = new Set();
     this.discontiguousPredicates = new Set();
     this.strictIso = options.isoStrict === true;
@@ -221,6 +225,7 @@ export class Program {
       wfsDatalog: false,
       scalarFactsOnly: true,
       dynamic: this.dynamicPredicates.has(modulePredicateKey(module, name, arity)),
+      public: this.publicPredicates.has(modulePredicateKey(module, name, arity)),
       negationStratum: null,
       hasCut: false,
       cutReachable: null,
@@ -636,6 +641,7 @@ class ProgramBuilder {
     this.options = options;
     this.program = program ?? new Program([], { ...options, [DEFER_PROGRAM_BUILD]: true });
     this.declaredDynamicIndicators = new Map();
+    this.declaredPublicIndicators = new Map();
     this.declaredMultifileIndicators = new Map();
     this.declaredDiscontiguousIndicators = new Map();
     this.declaredTableIndicators = new Map();
@@ -651,7 +657,7 @@ class ProgramBuilder {
     const unit = textUnit ?? '<input>';
     let declarations = this.directiveDeclarationsByText.get(unit);
     if (!declarations) {
-      declarations = { dynamic: new Set(), multifile: new Set(), discontiguous: new Set(), table: new Set() };
+      declarations = { dynamic: new Set(), public: new Set(), multifile: new Set(), discontiguous: new Set(), table: new Set() };
       this.directiveDeclarationsByText.set(unit, declarations);
     }
     return declarations[kind];
@@ -717,6 +723,13 @@ class ProgramBuilder {
       local.add(key);
       targetSet.add(key);
       declaredMap.set(`${textUnit}\u0000${key}`, { ...indicator, key, module, textUnit });
+      if (kind === 'public') {
+        // Unlike dynamic/1, a public declaration says nothing about existence:
+        // it only grants clause/2 access. Groups created later pick the flag up
+        // from program.publicPredicates in makeGroup.
+        const existing = program.groups.get(key);
+        if (existing) existing.public = true;
+      }
       if (kind === 'dynamic') {
         // A dynamic declaration creates the procedure immediately, not only
         // when ProgramBuilder.finish() runs. Compile-time source-expansion
@@ -830,6 +843,10 @@ class ProgramBuilder {
     const module = clause.module ?? 'user';
     const textUnit = clause.textUnit ?? '<input>';
     this.addProcedureDirective(clause, 'dynamic', program.dynamicPredicates, this.declaredDynamicIndicators);
+    // public/1 is an extension, so the strict Part 1 profile does not offer it.
+    if (!program.strictIso) {
+      this.addProcedureDirective(clause, 'public', program.publicPredicates, this.declaredPublicIndicators);
+    }
     this.addProcedureDirective(clause, 'multifile', program.multifilePredicates, this.declaredMultifileIndicators);
     this.addProcedureDirective(clause, 'discontiguous', program.discontiguousPredicates, this.declaredDiscontiguousIndicators);
     this.addProcedureDirective(clause, 'table', program.tabledPredicates, this.declaredTableIndicators);
@@ -1879,16 +1896,28 @@ function assertDynamicIndicatorIsDefinable(indicator, strictIso = false) {
 
 function assertPredicateIsDefinable(name, arity, strictIso = false) {
   // false/0 is standardized as a static built-in by Corrigendum 2 and cannot
-  // be redefined in either profile.  Strict core mode extends the same ISO
-  // rule to every Part-1 built-in/control construct; the normal EyeProlog
-  // profile keeps its historical source-compatibility behavior.
-  const strictSyntaxProcedure = strictIso && (
-    (name === ',' && arity === 2) ||
-    (name === ':-' && (arity === 1 || arity === 2))
-  );
+  // be redefined in either profile.
+  //
+  // ISO 7.4.3 requires that the predicate indicator of the head of a clause in
+  // a Prolog text is not that of a built-in predicate or a control construct.
+  // That subclause otherwise defers to assertz/1 and waives only the static
+  // procedure error, so the built-in restriction is a separate requirement and
+  // is not profile-dependent. The strict ISO registry holds exactly the Part 1
+  // built-ins and control constructs, so it is consulted in every mode.
+  //
+  // EyeProlog's library and extension predicates are deliberately absent from
+  // that registry and stay redefinable, which preserves the source
+  // compatibility that user programs rely on.
+  //
+  // (,)/2 is a control construct (table 9) but is recognized by the parser
+  // rather than the registry, so it is named here. (:-)/1-2 come from the STC
+  // #56 working draft rather than published text and stay strict-only.
+  const controlConstruct = name === ',' && arity === 2;
+  const draftSyntaxProcedure = strictIso && name === ':-' && (arity === 1 || arity === 2);
   if ((name === 'false' && arity === 0) ||
-      (strictIso && getStrictIsoRegistry().get(name, arity)) ||
-      strictSyntaxProcedure) {
+      getStrictIsoRegistry().get(name, arity) ||
+      controlConstruct ||
+      draftSyntaxProcedure) {
     throw staticProcedureModificationError(name, arity);
   }
 }

package/src/solver.js

@@ -1263,8 +1263,17 @@ function defaultPrologFlags(unknown = 'error', strictIso = false) {
     ['unknown', { value: compound(unknown, []), allowed: ['error', 'fail', 'warning'], changeable: true }],
     ['double_quotes', { value: compound('chars', []), allowed: ['chars', 'codes', 'atom'], changeable: true }],
     ['occurs_check', { value: compound('true', []), allowed: ['true', 'error'], changeable: true }],
+    // ISO 7.5.2 makes every user-defined procedure static, and therefore
+    // private, unless declared otherwise. Setting this flag to public grants
+    // clause/2 access to all of them at once, which meta-interpreters need
+    // without having to enumerate every predicate in a public/1 directive.
+    // The procedures stay static: assert/1 and retract/1 still refuse them.
+    ['default_procedure_access', { value: compound('private', []), allowed: ['private', 'public'], changeable: true }],
   ]);
-  if (strictIso) flags.delete('occurs_check');
+  if (strictIso) {
+    flags.delete('occurs_check');
+    flags.delete('default_procedure_access');
+  }
   return flags;
 }
 

package/test/conformance/ISO-IMPLEMENTATION-DEFINED.md

@@ -69,7 +69,7 @@ Status values are:
 | 7.11.2.5 | Default `double_quotes` | `chars`. | **defined** — `src/solver.js`, parser flag state. |
 | 7.12.1 | Second argument of `error/2` | The default context term is the atom `eyeprolog`. A few implementation-specific diagnostics may deliberately supply a more specific context term. | **defined** — `formalErrorTerm()` in `src/iso.js`. |
 | 7.12.2(f) | Implementation-defined representation limits | Character and character-code operations are limited to Unicode scalar values; surrogates and values above U+10FFFF are representation errors. Arity/integer values are modeled as unbounded but may hit host/resource limits. Float input overflow uses the implementation-specific `max_float`/`min_float` representation names documented by the STC-oriented tests. | **defined** — parser/ISO numeric and character guards. |
-| 8.17.1 | Implementation-defined flag value ranges | Strict mode exposes only Part 1 core flags and their standard value sets. Normal mode additionally exposes EyeProlog's `occurs_check` flag. With `bounded=false`, `max_integer` and `min_integer` have no current or selectable value and their `current_prolog_flag/2` queries fail. Valid alternative values of fixed standard flags are distinguished from invalid values so `set_prolog_flag/2` reports permission versus domain errors as prescribed. | **defined** — strict registry/flag filtering in `src/solver.js`; strict flag tests. |
+| 8.17.1 | Implementation-defined flag value ranges | Strict mode exposes only Part 1 core flags and their standard value sets. Normal mode additionally exposes EyeProlog's `occurs_check` and `default_procedure_access` flags. With `bounded=false`, `max_integer` and `min_integer` have no current or selectable value and their `current_prolog_flag/2` queries fail. Valid alternative values of fixed standard flags are distinguished from invalid values so `set_prolog_flag/2` reports permission versus domain errors as prescribed. | **defined** — strict registry/flag filtering in `src/solver.js`; strict flag tests. |
 | 8.17.3 | Other effects of `halt/0` | Terminates EyeProlog execution and returns host/process status `0`; it produces no Prolog solution. | **defined** — `HaltSignal`, `haltBuiltin()`, CLI/runner handling. |
 | 8.17.4 | Meaning/effects of `halt(Status)` | Integer `Status` is converted to the host process/runner halt code; it produces no Prolog solution. | **defined** — `haltBuiltin()`, `src/execute.js`, `src/cli.js`. |
 | 9.1.4.1 | Floating-point rounding function `rndF` | Floating values and operations use ECMAScript `Number` (IEEE-754 binary64) and the host's specified binary64 arithmetic/conversions. | **defined** — `src/iso-arithmetic.js`, `src/number-value.js`. |
@@ -121,6 +121,7 @@ families; `--iso-strict` is intended to remove their Part 1 interpretation.
 | 5.5.6 Side effects | Normal mode adds `statistics/0-2`, cleanup/library state, and optional proof/statistics host instrumentation. | The strict registry excludes Prolog-visible statistics/cleanup/library adapters; ordinary Part 1 I/O/database/flag/operator side effects remain. Host proof/statistics collection observes execution through the embedding API rather than adding a strict Prolog goal effect. **covered** — strict registry/execution regression. |
 | 5.5.7 Control constructs | `tnot/1`, `wfs_truth/2`, and normal-profile execution optimizations | `tnot/1`, `wfs_truth/2`, and the normal-profile explicit `table` declaration are absent. |
 | 5.5.8 Flags | `occurs_check` | Absent in strict mode. |
+| 5.5.8 Flags, 7.5.3 NOTE | `public/1` directive, `default_procedure_access` flag | Absent in strict mode. The 7.5.3 NOTE anticipates a `public/1` extension declaring user-defined procedures public; the flag generalizes it to all of them at once, which meta-interpreters need without annotating the interpreted program. Read access only: a public procedure stays static, so `assert`/`retract` still report `permission_error(modify, static_procedure)`, and built-ins stay private. |
 | 5.5.9 Built-in predicates | EyeProlog libraries, CLP(Z), statistics, Part 3 `phrase/2-3`, and bundled-library autoloaded predicates | Strict registry contains only the Part 1 + Corrigenda core registry. |
 | 5.5.10 Evaluable functors | Normal mode additionally accepts the EyeProlog evaluable atom `e`; the remaining arithmetic functors accepted by strict mode are the Part 1 + Corrigenda set. | Strict mode rejects `e/0` as non-evaluable and retains the Corrigendum arithmetic additions. **covered** — strict extension-boundary regression plus `src/iso-arithmetic.js`. |
 | 5.5.11 Reserved atoms | None | None. |

package/test/conformance/ISO-PROLOG-TEXT-EXECUTION-MATRIX.md

@@ -23,7 +23,7 @@ chosen behavior is also indexed by `ISO-IMPLEMENTATION-DEFINED.md`.
 | 7.4.2.7 `include/1` | covered | The included text is prepared at the directive position and shares operator/character/flag preparation state with its parent. |
 | 7.4.2.8 `ensure_loaded/1` | covered | A source is prepared at most once in the current load graph, including repeated references and self/top-level references. |
 | 7.4.2.9 `set_prolog_flag/2` | covered | Preparation-time flag changes affect subsequent text and are replayed into execution state; strict flag names/values/changeability remain governed by the closed 7.11 audit. |
-| 7.4.3 source clauses | covered | Source heads/bodies are validated like program clauses, standardized static/control procedures are protected, declarations can create empty procedures, and body conversion follows 7.6.2 while preserving head/body variable identity. |
+| 7.4.3 source clauses | covered | Source heads/bodies are validated like program clauses, standardized static/control procedures are protected, declarations can create empty procedures, and body conversion follows 7.6.2 while preserving head/body variable identity. The built-in restriction applies in every execution mode, so consulting a clause for a built-in predicate or control construct reports the same `permission_error(modify, static_procedure)` as `assert`ing one; EyeProlog's own library and extension predicates are not standard built-ins and stay redefinable. Corpus: `error/iso/consult_redefines_builtin`. |
 
 The strict release test `closes ISO 7.4 Prolog-text preparation and directive
 rows` exercises the cross-text operator/character/flag state, include and
@@ -37,7 +37,7 @@ and preparation error cases.
 | --- | --- | --- |
 | 7.5.1 initial database and clause order | covered | Prepared clauses retain textual preparation order. The implementation-defined initial database/standard-procedure choices are documented separately. |
 | 7.5.2 static and dynamic procedures | covered | Source procedures are static unless declared dynamic; asserting a previously absent predicate creates a dynamic procedure; modification of protected/static procedures is rejected. |
-| 7.5.3 private and public procedures | covered | User static procedures are private to `clause/2` in every execution mode, not only under `--iso-strict`; dynamic procedures are public; standardized built-ins/control forms remain static/private. Corpus: `iso/clause_static_and_dynamic_access`, `error/iso/clause_static_user_procedure`. |
+| 7.5.3 private and public procedures | covered | User static procedures are private to `clause/2` in every execution mode, not only under `--iso-strict`; dynamic procedures are public; standardized built-ins/control forms remain static/private. The NOTE's suggested `public/1` directive is provided as an extension in normal mode, together with a `default_procedure_access` flag that declares every user-defined procedure public; both grant read access only and leave the procedures static. Corpus: `iso/clause_static_and_dynamic_access`, `iso/public_procedure_access`, `error/iso/clause_static_user_procedure`. |
 | 7.5.4 database update visibility | covered | Dynamic calls use the logical-update view: an activation continues over the clause set visible when it began, while later activations see successful assertions/retractions. `retractall/1` retains an empty dynamic procedure and `abolish/1` removes it. |
 
 The strict test `closes ISO 7.5-7.7 database, conversion, and execution rows`

package/test/conformance/README.md

@@ -140,7 +140,7 @@ Selected cases are adapted from the ISO and standard-core suites of Logtalk,
 Scryer Prolog, Trealla Prolog, and SWI-Prolog. Their upstream identifiers and licenses
 are recorded in [THIRD_PARTY.md](THIRD_PARTY.md).
 
-The corpus has 391 cases in `iso/` and 808 file-based conformance cases in total. Of those, 11 cases in `stc/` are explicitly labelled working-draft review evidence rather than normative ISO claims. The separate vendored strict-reader WG17 matrix is a deterministic regression snapshot; the live Neumerkel gate discovers the current upstream inventory at run time; release/report checks separately verify the tracked `NEUMERKEL-LATEST.md`. The generated `conformance-report.md` records local corpus totals and links to that live evidence. Together with regression, documentation-sync, API, example, and book-example checks, `npm test` is the release gate.
+The corpus has 393 cases in `iso/` and 810 file-based conformance cases in total. Of those, 11 cases in `stc/` are explicitly labelled working-draft review evidence rather than normative ISO claims. The separate vendored strict-reader WG17 matrix is a deterministic regression snapshot; the live Neumerkel gate discovers the current upstream inventory at run time; release/report checks separately verify the tracked `NEUMERKEL-LATEST.md`. The generated `conformance-report.md` records local corpus totals and links to that live evidence. Together with regression, documentation-sync, API, example, and book-example checks, `npm test` is the release gate.
 
 ## Updating expected output
 

package/test/conformance/cases/iso/public_procedure_access.pl

@@ -0,0 +1,52 @@
+% ISO 7.5.3 notes that "an additional directive public/1 that specifies some
+% user-defined procedures to be public would be an extension". EyeProlog
+% provides that directive, plus a default_procedure_access flag that grants
+% clause/2 access to every user-defined procedure at once, which a
+% meta-interpreter needs without annotating the program it interprets.
+%
+% Both are read access only. A public procedure is still static, so assert/1
+% and retract/1 continue to report permission_error(modify, static_procedure),
+% and built-in procedures stay private either way.
+% https://github.com/eyereasoner/eyeprolog/issues/96
+
+:- public(elk/1).
+elk(X) :- moose(X).
+
+moose(bertha).
+
+%% goal: declared_public(X0)
+
+declared_public(Body) :-
+    clause(elk(bertha), Body).
+
+%% goal: undeclared_sibling(X0)
+
+% moose/1 carries no declaration, so it stays private.
+undeclared_sibling(Culprit) :-
+    catch(clause(moose(_), _), error(Formal, _), true),
+    Formal = permission_error(access, private_procedure, Culprit).
+
+%% goal: public_is_not_dynamic(X0)
+
+public_is_not_dynamic(Formal) :-
+    catch(assertz(elk(clara)), error(Formal, _), true).
+
+%% goal: flag_default(X0)
+
+flag_default(Access) :-
+    current_prolog_flag(default_procedure_access, Access).
+
+%% goal: flag_opens_every_procedure(X0)
+
+flag_opens_every_procedure(Body) :-
+    set_prolog_flag(default_procedure_access, public),
+    clause(moose(bertha), Body),
+    set_prolog_flag(default_procedure_access, private).
+
+%% goal: builtins_stay_private(X0)
+
+builtins_stay_private(Culprit) :-
+    set_prolog_flag(default_procedure_access, public),
+    catch(clause(atom(_), _), error(Formal, _), true),
+    set_prolog_flag(default_procedure_access, private),
+    Formal = permission_error(access, private_procedure, Culprit).

package/test/conformance/errors/iso/consult_redefines_builtin.pl

@@ -0,0 +1,11 @@
+% ISO 7.4.3: a clause of a clause-term in a Prolog text must satisfy the same
+% constraints as a successful assertz/1, waiving only the static-procedure
+% error, and the predicate indicator of its head must not be that of a built-in
+% predicate or a control construct. Consulting a definition of clause/2 is
+% therefore a permission error, exactly as asserta/1 already reported.
+% https://github.com/eyereasoner/eyeprolog/issues/97
+%% goal: answer
+
+clause(elk(1), 2).
+
+answer.

package/test/conformance/expected/iso/exceptions_and_flags.pl

@@ -1,3 +1,3 @@
 answer(7, red, caught(eyeprolog), first, caught(eyeprolog)).
 answer(7, red, caught(eyeprolog), second, caught(eyeprolog)).
-flags(off, on, [pair(bounded, false), pair(integer_rounding_function, toward_zero), pair(char_conversion, on), pair(debug, off), pair(max_arity, unbounded), pair(unknown, fail), pair(double_quotes, chars), pair(occurs_check, true)]).
+flags(off, on, [pair(bounded, false), pair(integer_rounding_function, toward_zero), pair(char_conversion, on), pair(debug, off), pair(max_arity, unbounded), pair(unknown, fail), pair(double_quotes, chars), pair(occurs_check, true), pair(default_procedure_access, private)]).

package/test/conformance/expected/iso/public_procedure_access.pl

@@ -0,0 +1,6 @@
+declared_public(moose(bertha)).
+undeclared_sibling(moose / 1).
+public_is_not_dynamic(permission_error(modify, static_procedure, elk / 1)).
+flag_default(private).
+flag_opens_every_procedure(true).
+builtins_stay_private(atom / 1).

package/test/conformance/expected-errors/iso/consult_redefines_builtin.txt

@@ -0,0 +1 @@
+error(permission_error(modify, static_procedure), /(clause, 2))

package/test/run-regression.mjs

@@ -4907,6 +4907,192 @@ answer(Result) :- countdown(2048, Result), Result = 2048.
         assertEqual(answers.length, 2, 'cut did not prune the second clause');
       },
     },
+    {
+      // https://github.com/eyereasoner/eyeprolog/issues/97
+      name: 'a Prolog text cannot supply clauses for a built-in predicate',
+      run: () => {
+        let caught = null;
+        try {
+          Program.parse('clause(elk(1), 2).\n');
+        } catch (error) {
+          caught = error;
+        }
+        if (!caught) throw new Error('a clause for clause/2 was accepted from a Prolog text');
+        assertEqual(caught.formal, 'permission_error(modify, static_procedure)', 'formal error');
+        assertEqual(termToString(caught.culprit), '/(clause, 2)', 'culprit predicate indicator');
+      },
+    },
+    {
+      name: 'consult and asserta/1 agree on redefining a built-in',
+      run: () => {
+        let textFormal = null;
+        try {
+          Program.parse('clause(elk(1), 2).\n');
+        } catch (error) {
+          textFormal = error.formal;
+        }
+        const solver = new Solver(Program.parse('run :- asserta(clause(elk(1), 2)).\n'), {});
+        let assertFormal = null;
+        try {
+          [...solver.solve([parseGoalText('run')], new Env(), 0)];
+        } catch (error) {
+          assertFormal = error.formal;
+        }
+        assertEqual(textFormal, 'permission_error(modify, static_procedure)', 'consult path');
+        assertEqual(assertFormal, textFormal, 'assert path agrees with consult');
+      },
+    },
+    {
+      // Control constructs are covered as well as built-in predicates.
+      name: 'a Prolog text cannot supply clauses for a control construct',
+      run: () => {
+        for (const [source, indicator] of [
+          ["';'(a, b).\n", "/(';', 2)"],
+          ["','(a, b).\n", "/(',', 2)"],
+          ['!.\n', '/(!, 0)'],
+        ]) {
+          let caught = null;
+          try {
+            Program.parse(source);
+          } catch (error) {
+            caught = error;
+          }
+          assertEqual(caught?.formal, 'permission_error(modify, static_procedure)', `formal error for ${indicator}`);
+          assertEqual(termToString(caught.culprit), indicator, `culprit for ${indicator}`);
+        }
+      },
+    },
+    {
+      // EyeProlog's library and extension predicates are not standard
+      // built-ins, so user programs may still define their own versions.
+      name: 'a Prolog text may still redefine library predicates',
+      run: () => {
+        const program = Program.parse('member(X, [X]).\nappend([], L, L).\n');
+        assertEqual(program.findGroup('member', 2) != null, true, 'member/2 defined by the text');
+        assertEqual(program.findGroup('append', 3) != null, true, 'append/3 defined by the text');
+      },
+    },
+    {
+      // A dynamic/1 directive names a procedure the text is about to define,
+      // so it is subject to the same restriction.
+      name: 'a dynamic/1 directive cannot name a built-in predicate',
+      run: () => {
+        let caught = null;
+        try {
+          Program.parse(':- dynamic(atom_length/2).\n');
+        } catch (error) {
+          caught = error;
+        }
+        assertEqual(caught?.formal, 'permission_error(modify, static_procedure)', 'formal error');
+        assertEqual(termToString(caught.culprit), '/(atom_length, 2)', 'culprit predicate indicator');
+      },
+    },
+    {
+      // ISO 7.5.3 NOTE: public/1 as an extension.
+      name: 'a public/1 directive grants clause/2 access to a static procedure',
+      run: () => {
+        const program = Program.parse(':- public(elk/1).\nelk(X) :- moose(X).\nmoose(bertha).\n');
+        const solver = new Solver(program, {});
+        const answers = [...solver.solve([parseGoalText('clause(elk(_), _)')], new Env(), 0)];
+        assertEqual(answers.length, 1, 'declared public procedure is readable');
+        assertEqual(program.findGroup('elk', 1).dynamic, false, 'public does not imply dynamic');
+      },
+    },
+    {
+      name: 'a public/1 declaration still refuses database modification',
+      run: () => {
+        const solver = new Solver(Program.parse(':- public(elk/1).\nelk(bertha).\n'), {});
+        for (const goal of ['assertz(elk(clara))', 'retract(elk(bertha))']) {
+          let caught = null;
+          try {
+            [...solver.solve([parseGoalText(goal)], new Env(), 0)];
+          } catch (error) {
+            caught = error;
+          }
+          assertEqual(caught?.formal, 'permission_error(modify, static_procedure)', `${goal} is refused`);
+        }
+      },
+    },
+    {
+      name: 'public/1 applies to clauses that precede the directive',
+      run: () => {
+        const program = Program.parse('elk(bertha).\n:- public(elk/1).\n');
+        const solver = new Solver(program, {});
+        const answers = [...solver.solve([parseGoalText('clause(elk(_), _)')], new Env(), 0)];
+        assertEqual(answers.length, 1, 'earlier clauses become readable');
+      },
+    },
+    {
+      name: 'public/1 leaves undeclared procedures private',
+      run: () => {
+        const solver = new Solver(Program.parse(':- public(elk/1).\nelk(X) :- moose(X).\nmoose(bertha).\n'), {});
+        let caught = null;
+        try {
+          [...solver.solve([parseGoalText('clause(moose(_), _)')], new Env(), 0)];
+        } catch (error) {
+          caught = error;
+        }
+        assertEqual(caught?.formal, 'permission_error(access, private_procedure)', 'sibling stays private');
+      },
+    },
+    {
+      // The meta-interpreter case: no annotation on the interpreted program.
+      name: 'default_procedure_access public opens every user-defined procedure',
+      run: () => {
+        const source = ':- set_prolog_flag(default_procedure_access, public).\n' +
+          'solve(true) :- !.\n' +
+          'solve((A, B)) :- !, solve(A), solve(B).\n' +
+          'solve(H) :- clause(H, Body), solve(Body).\n' +
+          'elk(X) :- moose(X).\nmoose(bertha).\ngrazes(X) :- elk(X).\n';
+        const solver = new Solver(Program.parse(source), {});
+        const goal = parseGoalText('solve(grazes(W))');
+        const answers = [...solver.solve([goal], new Env(), 0)];
+        assertEqual(answers.length, 1, 'meta-interpreter answer count');
+        assertEqual(termToString(copyResolved(goal.args[0], answers[0])), 'grazes(bertha)', 'meta-interpreter answer');
+      },
+    },
+    {
+      name: 'default_procedure_access public keeps procedures static and built-ins private',
+      run: () => {
+        const source = ':- set_prolog_flag(default_procedure_access, public).\nmoose(bertha).\n';
+        const solver = new Solver(Program.parse(source), {});
+        for (const [goal, formal] of [
+          ['retract(moose(bertha))', 'permission_error(modify, static_procedure)'],
+          ['clause(atom(_), _)', 'permission_error(access, private_procedure)'],
+        ]) {
+          let caught = null;
+          try {
+            [...solver.solve([parseGoalText(goal)], new Env(), 0)];
+          } catch (error) {
+            caught = error;
+          }
+          assertEqual(caught?.formal, formal, `${goal} is refused`);
+        }
+      },
+    },
+    {
+      // public/1 and the flag are extensions, so the strict profile omits both.
+      name: 'strict ISO core mode offers neither public/1 nor the access flag',
+      run: () => {
+        let caught = null;
+        try {
+          Program.parse(':- public(elk/1).\nelk(bertha).\n', { isoStrict: true });
+        } catch (error) {
+          caught = error;
+        }
+        if (!caught) throw new Error('public/1 was accepted in strict ISO core mode');
+        // 8.17.4.3: an unknown flag name is a domain error, so the flag being
+        // absent from the strict profile is observable that way.
+        const solver = new Solver(Program.parse('elk(bertha).\n', { isoStrict: true }), { isoStrict: true });
+        let flagError = null;
+        try {
+          [...solver.solve([parseGoalText('current_prolog_flag(default_procedure_access, _)', { isoStrict: true })], new Env(), 0)];
+        } catch (error) {
+          flagError = error;
+        }
+        assertEqual(flagError?.formal, 'domain_error(prolog_flag)', 'flag is absent in strict ISO core mode');
+      },
+    },
     {
       // https://github.com/eyereasoner/eyeprolog/issues/96
       name: 'clause/2 keeps static procedures private in the default mode',
@@ -8170,14 +8356,16 @@ function whiteBoxCases() {
         assertEqual(termToString(candidates.primary[0].head, new Env(), true), 'row(a0, b0, c0, first)', 'first head');
         assertEqual(termToString(candidates.primary[1].head, new Env(), true), 'row(a0, X, c0, wildcard)', 'wildcard head');
 
+        // A user-defined name: ISO 7.4.3 forbids a Prolog text from defining
+        // clauses for a built-in predicate such as open/3.
         const variableHeavy = Program.parse(Array.from(
           { length: 12 },
-          (_, index) => `open(X${index}, Y${index}, value${index}).`,
+          (_, index) => `gate(X${index}, Y${index}, value${index}).`,
         ).join('\n'));
-        const openGroup = variableHeavy.findGroup('open', 3);
-        selectClauseCandidates(openGroup, parseGoalText('open(a, b, Result)'), new Env());
-        assertEqual(openGroup.demandIndexes.size, 0, 'poor wide index discarded');
-        assertEqual(openGroup.rejectedDemandIndexes.has('0,1'), true, 'poor call mode remembered');
+        const gateGroup = variableHeavy.findGroup('gate', 3);
+        selectClauseCandidates(gateGroup, parseGoalText('gate(a, b, Result)'), new Env());
+        assertEqual(gateGroup.demandIndexes.size, 0, 'poor wide index discarded');
+        assertEqual(gateGroup.rejectedDemandIndexes.has('0,1'), true, 'poor call mode remembered');
       },
     },
     {

package/the-art-of-eyeprolog.md

@@ -770,13 +770,18 @@ Equality in the pure Herbrand reading is syntactic identity after substitution.
 Operationally, unification discovers a substitution that makes terms
 identical. EyeProlog performs an occurs check whenever unification would bind a
 variable. It therefore uses finite-tree unification and rejects a binding when
-the variable occurs anywhere in the proposed value. For example, this call
-fails rather than constructing a cyclic term:
+the variable occurs anywhere in the proposed value. For example, the body of this
+clause fails rather than constructing a cyclic term:
 
 ```eyeprolog
-(X = wrapper(X)).
+cyclic_unification :- X = wrapper(X).
 ```
 
+The goal has to be written inside a clause of its own: ISO 7.4.3 forbids a
+Prolog text from supplying clauses for a built-in predicate, so a bare
+`(X = wrapper(X)).` in a program file is a clause for `(=)/2` and is rejected
+with *permission_error(modify, static_procedure, (=)/2)*.
+
 ISO classifies unifications whose outcome depends on an occurs check as
 subject-to-occurs-check (STO). EyeProlog's default remains the sound finite-tree
 behavior above. For diagnosis, EyeProlog additionally provides the
@@ -6146,7 +6151,7 @@ partial list.
 
 #### Dynamic database and procedure information
 
-- **`clause(+Head,?Body)`** — Enumerates fresh copies of source clauses matching the callable `Head`; facts have body `true`. Only *public* procedures can be inspected: a procedure defined by a Prolog text is static unless a *dynamic/1* directive declares it, and a procedure first created by *assertz/1* or *asserta/1* is dynamic. Access to a static user procedure, or to a built-in, raises *permission_error(access,private_procedure)*. This applies in every execution mode, not only under `--iso-strict`, and matches the *permission_error(modify,static_procedure)* that *assertz/1* and *retract/1* already raise for the same procedures.
+- **`clause(+Head,?Body)`** — Enumerates fresh copies of source clauses matching the callable `Head`; facts have body `true`. Only *public* procedures can be inspected: a procedure defined by a Prolog text is static unless a *dynamic/1* directive declares it, and a procedure first created by *assertz/1* or *asserta/1* is dynamic. Access to a static user procedure, or to a built-in, raises *permission_error(access,private_procedure)*. This applies in every execution mode, not only under `--iso-strict`, and matches the *permission_error(modify,static_procedure)* that *assertz/1* and *retract/1* already raise for the same procedures. Normal mode additionally accepts a *public/1* directive and a `default_procedure_access` flag that open static procedures to inspection; see below.
 - **`asserta(+Clause)`, `assertz(+Clause)`** — Insert a copied fact or rule at the beginning or end of a predicate declared *dynamic/1*. Static and built-in procedures cannot be modified.
 - **`retract(+Clause)`** — Removes matching dynamic clauses one at a time on backtracking. A call sees the logical update view captured when it began. A fact pattern matches facts only.
 - **`retractall(+Head)`** — Removes every matching clause from a dynamic procedure, succeeds when none match, and keeps the empty dynamic procedure known.
@@ -6200,6 +6205,58 @@ consults another file or imports a module instead of being reset by the host
 rebuild of the program. Programs that intentionally treat an undefined
 predicate as failure must opt in with `set_prolog_flag(unknown, fail)`; bundled
 examples and non-ISO corpus cases that depend on that policy do so explicitly.
+### Reading static procedures
+
+A procedure defined by a Prolog text is static, so `clause/2` refuses it
+(ISO 7.5.2, 7.5.3, 8.8.1.3). Declaring the procedure `dynamic` lifts the
+restriction, but it also makes the procedure modifiable, and for a
+meta-interpreter it means annotating a program you may not want to edit and
+enumerating every predicate you intend to read.
+
+ISO 7.5.3 has a NOTE observing that a `public/1` directive declaring
+user-defined procedures to be public would be an extension. Normal EyeProlog
+provides it:
+
+```eyeprolog
+:- public(elk/1).
+
+elk(X) :- moose(X).
+
+moose(bertha).
+```
+
+`clause(elk(bertha), Body)` now succeeds with `Body = moose(bertha)`, while
+`moose/1` carries no declaration and stays private. A public procedure is still
+*static*: `assertz(elk(clara))` continues to raise
+*permission_error(modify,static_procedure)*. The directive grants read access
+only.
+
+To open every user-defined procedure at once, set the
+`default_procedure_access` flag to `public`:
+
+```eyeprolog
+:- set_prolog_flag(default_procedure_access, public).
+
+solve(true) :- !.
+solve((A, B)) :- !, solve(A), solve(B).
+solve(H) :- clause(H, Body), solve(Body).
+
+elk(X) :- moose(X).
+moose(bertha).
+grazes(X) :- elk(X).
+```
+
+`solve(grazes(W))` yields `W = bertha` without a single declaration on the
+interpreted program. The flag changes access, not mutability or existence:
+procedures remain static, and built-in procedures remain private, so
+`clause(atom(_), _)` still raises *permission_error(access,private_procedure)*.
+The supported values are `private` (the default, matching ISO) and `public`.
+
+Both the directive and the flag are extensions, so strict ISO core mode offers
+neither: `public/1` is rejected as an implementation-specific directive, and
+`current_prolog_flag(default_procedure_access, _)` raises
+*domain_error(prolog_flag)*.
+
 The `occurs_check` flag is an EyeProlog diagnostic
 extension rather than an ISO-defined core flag: it is absent in strict mode,
 while normal mode keeps its `true` default and optional `error` diagnostic for
@@ -10365,7 +10422,7 @@ must preserve the same observable outcome. Additional normal-mode syntax may
 accept texts outside the strict grammar, but it may not reinterpret an accepted
 standard case.
 
-The file-based conformance corpus contains 808 cases, including 391 focused ISO cases derived from the success, failure, mode, and error behavior in ISO/IEC 13211-1 clauses 7 and 8, Part 2 modules, and Part 3 grammar rules.
+The file-based conformance corpus contains 810 cases, including 393 focused ISO cases derived from the success, failure, mode, and error behavior in ISO/IEC 13211-1 clauses 7 and 8, Part 2 modules, and Part 3 grammar rules.
 Separate exact-output suites check 210 normal examples and 61 proof examples; all executable chapter programs are parsed and their declared goals are executed. The eight-case
 playground contract suite imports the production worker, sends real reasoning
 requests through its message protocol, and crawls the served module graph for

package/tools/extract-book-examples.mjs

@@ -4,6 +4,8 @@ import path from 'node:path';
 import process from 'node:process';
 import { fileURLToPath } from 'node:url';
 
+import { Program, getStrictIsoRegistry } from '../src/index.js';
+
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const bookPath = path.join(root, 'the-art-of-eyeprolog.md');
 const outputRoot = path.join(root, 'examples', 'book');
@@ -36,6 +38,11 @@ for (const match of book.matchAll(/^(## \d+\. ([^\n]+)|# ([^\n]+)|```eyeprolog\n
   if (!chapter) continue;
   const source = match[4].trim();
   if (!source.endsWith('.')) continue;
+  // The book also uses eyeprolog blocks for template listings and single
+  // illustrative goals. Those read as clauses for a built-in predicate, which
+  // ISO 7.4.3 forbids a Prolog text from defining, so they are not programs
+  // and are not extracted as such.
+  if (definesBuiltIn(source)) continue;
 
   const firstClause = source
     .split('\n')
@@ -46,6 +53,27 @@ for (const match of book.matchAll(/^(## \d+\. ([^\n]+)|# ([^\n]+)|```eyeprolog\n
   chapter.examples.push({ predicate, section, source });
 }
 
+// True when a code block supplies clauses for a standard built-in predicate or
+// control construct, which marks it as a signature listing or goal fragment
+// rather than an extractable program.
+function definesBuiltIn(source) {
+  try {
+    const program = Program.parse(source);
+    const registry = getStrictIsoRegistry();
+    for (const group of program.groups.values()) {
+      if (group.name === ',' && group.arity === 2) return true;
+      if (registry.get(group.name, group.arity)) return true;
+    }
+    return false;
+  } catch (error) {
+    // Preparation itself rejects a clause head that is a built-in, so that
+    // error is the signal we are looking for. Any other parse failure is left
+    // to the book-example test, which reports it instead of silently dropping
+    // the block here.
+    return error?.formal === 'permission_error(modify, static_procedure)';
+  }
+}
+
 const files = new Map();
 const readme = [
   '# The Art of EyeProlog — inline examples',

package/examples/book/chapter-08/01-findall.pl

@@ -1,8 +0,0 @@
-% From The Art of EyeProlog, Chapter 8.
-:- use_module(library(aggregate)).
-:- use_module(library(lists)).
-:- use_module(library(iso_ext)).
-
-findall(Template, Goal, List).
-countall(Goal, Count).
-sumall(Value, Goal, Sum).

package/examples/book/chapter-09/01-functor.pl

@@ -1,4 +0,0 @@
-% From The Art of EyeProlog, Chapter 9.
-functor(Term, Name, Arity).
-arg(Index, Term, Value).
-(Term =.. [Name | Arguments]).

package/examples/book/chapter-24/03-reachable.pl

@@ -1,6 +0,0 @@
-% From The Art of EyeProlog, Chapter 24 — Existence, one witness, and all witnesses.
-:- use_module(library(lists)).
-
-reachable(From, To).
-once(simple_path(From, To, Path)).
-findall(Path, simple_path(From, To, Path), Paths).

package/examples/book/chapter-28/01-program.pl

@@ -1,2 +0,0 @@
-% From The Art of EyeProlog, Chapter 28 — Unification is structural equation solving.
-(pair(X, f(Y)) = pair(g(a), f(b))).