Builds on #498 (named state sets) and #435.

Motivation

A state is written as a predicate on the object, open(this). That predicate is shorthand for "the state set of this holds the value open", which Z3 encodes as phase(this) == k. The set only shows up in messages, and there it looks unrelated to the state:

found closed(d@26) && locked(d) && doorState(d) == doorState(d@26) but expected closed(d) && unlocked(d)

To see that d is closed, the reader has to know that closed belongs to doorState. If the state is written as a value of its set, the message chains on its own:

found doorState(d@26) == closed && lockState(d) == locked && doorState(d) == doorState(d@26) but expected doorState(d) == closed && lockState(d) == unlocked

This form also says which set a spec constrains: to = "phase(this) == end", undo(this) == undo(old(this)). That is what the state machine, the frame equalities and the hints already work with.

Design

1. Syntax: set(e) == state in any refinement

For a state set g (named, or stateN) and a state s of g:

e is any expression accepted as a state argument today (this, a parameter, _, old(this)). The grammar does not change, because s already parses as a variable. Both forms stay valid and can be mixed. The new form is preferred in docs and examples. Comparisons other than == and != (g(e) < s) are not given a meaning: s is an unknown variable there, as today.

Resolution. In g(e) == s, s is resolved as a state when all of these hold:

• g is a state set function;
• s is the name of one of g's states;
• s is not a variable in the spec's scope: the parameters, the context's variables where the spec is read, and _, this and return. Those three are always variables, even if a state has that name.

A variable keeps its meaning, so a spec that is valid today means the same: to = "phase(this) == closed" in void choose(int closed) still compares with the parameter. The state is resolved by the set it is compared with, so two sets, or two classes, may have states with the same name.

A state name is unique within its class. Two sets of one class may not share a state name. @StateSet(name = "phase", value = {"closed", "open"}) together with @StateSet(name = "latch", value = {"open", "locked"}) is an error: State 'open' is in two state sets of Door: phase and latch. Today that is accepted, but open(this) silently picks one of the two sets. The new form would say which set, but it is read as the shorthand, which cannot. Two classes may still share state names (ambiguous_state_names_correct). Likewise, a state may not have the name of a set of its class, generated names included: a state state1 next to the unnamed first set state1 is an error. Before, only named sets were checked.

Errors, all Error like the other state set errors:

• g(e) == s where s is not a variable in scope but is a state of another set of the same class: State 'locked' is not a state of 'doorState' (its states are closed, opened).
• the existing "not found" error for a name that is neither a state nor a variable.

2. Implementation: translate to the existing shorthand, once, in one helper

set(e) == state is rewritten to state(e), and != to !state(e), by one helper (StateValues in rj_language). The helper is given the states and a test for "is a variable".

All state sets are registered first. A new first pass of RefinementProcessor registers every @StateSet (classes, interfaces and @ExternalRefinementsFor specs) before any spec is read. Today MethodsFirstChecker and ExternalRefinementTypeChecker register a class's sets while they visit it. A spec that mentions a class visited later then sees no sets, which is #452 for external specs. That pass is its own PR (#508), and it fixes #452. It runs after FieldGhostsGeneration and also registers @RefinementPredicate ghosts, which are only allowed on types, so the name checks for named sets still see every ghost.

Translated once, where the spec is written, in the spec's own scope. This happens when the spec string is parsed into the stored predicate, so every syntactic reader sees the shorthand. The readers are the frame equalities, the state machine (isQuery on return refinements), the hints, DecidingArgument, StateErrorCategories and #495's relevance pass. The parse sites are:

• TypeChecker.getRefinementFromAnnotation, for @Refinement on parameters, returns, fields and locals;
• AuxStateHandler.createStatePredicate, for method from/to;
• AuxStateHandler.setConstructorStates, for constructor to, which does not go through createStatePredicate;
• alias bodies, when the alias is registered, with only the alias's parameters as variables. With IsClosed(Door d) { phase(d) == closed } used in void test(int closed), closed is still the state, as in closed(d).

There is no late resolution in the caller's context. A caller's variable can therefore never capture a state name from a spec written elsewhere. If a parse site were missed, the name would stay an unknown variable and give the existing "not found" error, never a different meaning.

Parity with the shorthand. Wherever the new form is translated, it behaves exactly as the shorthand it becomes, including the shorthand's existing limitations. Those are fixed separately for both forms:

• Soundness: a to that sets another object's state drops the receiver's frame (x.observe(y) forgets x's state) #504: a state of another object counts as a mention of the receiver's set (unsound).
• False error: state sets declared two levels up the hierarchy are not kept across a call #505: sets declared two levels up the hierarchy are not in scope.

No change to the Z3 encoding, the state machine or the error categories.

3. Frame equalities need no change

phase(this) == open becomes open(this) before the frame logic runs, so it counts as a mention of phase, exactly like open(this). A to that uses a set's function directly, as in phase(this) == phase(other), is a separate question from #498, now in #506.

4. Messages show named sets in the new form

In messages, hints and the derivation steps, a state of a named set is printed as set(x) == state, and !state(x) as set(x) != state. This holds whichever form the spec used. States of unnamed sets keep state(x), because state2(x) == closed reads worse than closed(x). Only the rendering changes: the predicates, simplification steps and #495's relevance pass work on the same expressions.

PRs

0. False error: a state inside a @RefinementAlias body is not translated (Closed(_) rejects a closed object) #503 (PR Expand aliases before translating states #507): expand aliases before translating states, an existing bug.
   0b. Register all ghosts and state sets in a first pass (PR Register every ghost and state set before any spec is read #508), which fixes External specs: a @StateSet declared later in the file is not found by an interface earlier in it #452.
1. Language (sections 1–2): the helper, its parse sites, and the wrong-set error. Tests:
   • one correct fixture written only in the new form: two named sets, a constructor to, from/to, !=, old, a branch keeping a set, and a boolean query whose return refinement uses the new form (state machine parity);
   • one error fixture for the wrong-set error and for a state name shared by two sets of one class;
   • one fixture where a parameter named like a state keeps its meaning, and an alias whose body uses that state name inside the same method still means the state;
   • a set with a state named _, where phase(this) == _ on a parameter still compares with the parameter's value.
2. Messages (section 4): rendering of named-set states. Test: the ErrorStateHintMultipleSets message.
3. Docs and examples: README and the examples use the new form. The study exercises are updated in the study repository.