A COINDUCTIVE REFORMULATION OF MILNER’S PROOF SYSTEM FOR REGULAR EXPRESSIONS MODULO BISIMILARITY

. Milner deﬁned an operational semantics for regular expressions as ﬁnite-state processes. In order to axiomatize bisimilarity of regular expressions under this process semantics, he adapted Salomaa’s complete proof system for equality of regular expressions under the language semantics. Apart from most equational axioms, Milner’s system Mil inherits from Salomaa’s system a non-algebraic rule for solving ﬁxed-point equations. Recognizing distinctive properties of the process semantics that render Salomaa’s proof strategy inapplicable, Milner posed completeness of the system Mil as an open question. As a proof-theoretic approach to this problem we characterize the derivational power that the ﬁxed-point rule adds to the purely equational part Mil ´ of Mil . We do so by means of a coinductive rule that permits cyclic derivations that consist of a ﬁnite process graph with empty steps that satisﬁes the layered loop existence and elimination property LLEE, and two of its Mil ´ -provable solutions. By adding this rule instead of the ﬁxed-point rule in Mil , we deﬁne the coinductive reformulation cMil as an extension of Mil ´ . For showing that cMil and Mil are theorem equivalent we develop eﬀective proof transformations from Mil to cMil , and vice versa. Since it is located half-way in between bisimulations and proofs in Milner’s system Mil , cMil may become a beachhead for a completeness proof of Mil . This article extends our contribution to the CALCO 2022 proceedings. Here we reﬁne the proof transformations by framing them as eliminations of derivable and admissible rules, and we link coinductive proofs to a coalgebraic formulation of solutions of process


Introduction
Milner introduced in [Mil84] a process semantics ¨ P for regular expressions e as finite-state process graphs e P . Informally the process interpretation is defined as follows, for regular expressions built from the constants 0 and 1 by using the regular operators`,¨, and p¨q˚: Milner called regular expressions 'star expressions' when they are interpreted as processes. He formulated this semantics after developing a complete equational proof system for equality of 'a class of regular behaviors'. By that he understood the bisimilarity equivalence classes of finite-state processes that are represented by µ-terms. Then he defined the process semantics by interpreting regular expressions as µ-term representations of finite-state processes. In doing so, he defined 'star behaviors', the bisimilarity equivalence classes of the interpretations of star expressions as a subclass of 'regular behaviors'. As an afterthought to the complete proof system for regular behaviors, he was interested in an axiomatization of equality of 'star behavior' directly on star expressions (instead of on µ-term representations). For this purpose he appropriately adapted Salomaa's complete proof system [Sal66] for language equivalence on regular expressions to a system Mil that is sound for equality of denoted star behaviors. But Milner noticed that completeness of Mil cannot be shown in analogy to Salomaa's completeness proof. He formulated completeness of Mil as an open problem, because he realized a significant difficulty due to a peculiarity by which the process semantics contrasts starkly with the language semantics of regular expressions.
The process semantics of regular expressions is incomplete in the following sense. While for every finite-state automaton M there is a regular expression e whose language interpretation e L coincides with the language accepted by M (formally LpMq " e L ), it is not the case that every finite-state process is the process interpretation of some star expression, not even modulo bisimilarity. Giving a counterexample that demonstrates this, Milner proved in [Mil84] that the process graph G 1 below with linear recursive equational specification SpG 1 q does not define a star behavior, and hence is not bisimilar to the process interpretation of a star expression. He conjectured that the same is true for the process graph G 2 below with specification SpG 2 q. That was confirmed later by Bosscher [Bos97].
X 2 a 1 a 3 X 3 a 1 a 2 SpG 1 q " $ ' & ' % X 1 " a 2¨X2`a3¨X3 X 2 " a 1¨X1`a3¨X3 X 3 " a 1¨X1`a2¨X2 (Here and later we highlight the start vertex of a process graph by a brown arrow , and emphasize a vertex v with immediate termination in brown as including a boldface ring.) It follows that the systems of SpG 1 q and SpG 2 q of guarded equations with star expressions cannot be solved by star expressions modulo bisimilarity. Due to soundness of Mil, also the specifications SpG 1 q and SpG 2 q are unsolvable by star expressions when equality is interpreted as provability in Mil. However, if all actions in the process graphs G 1 and G 2 are replaced by a single action a, obtaining graphs G paq 1 and G paq 2 , then the arising specifications SpG paq 1 q and SpG paq 2 q are solvable, modulo bisimilarity, and also with respect to provability in Mil. Indeed it is easy to verify that solutions are obtained by letting X 1 :" X 2 :" X 3 :" a˚¨0 in SpG paq 1 q, and by letting Y 1 :" Y 2 :" a˚in SpG paq 2 q. The extraction procedure of solutions of specifications in Salomaa's proof completeness is able to solve every linear system of recursion equations, independently of the actions occurring. It follows that an analogous procedure is not possible for solving systems of linear recursion equations in the process semantics. The extraction procedure for linear specifications with respect to the language semantics is possible because both laws for distributing¨over`are available, and indeed are part of Salomaa's proof system. But Mil does not contain the left-distributivity law x¨py`zq " x¨y`x¨z, because it famously is not sound under bisimilarity. In the presence of only right-distributivity px`yq¨z " x¨z`y¨z in Mil the extraction procedure from Salomaa's proof does not work, because failure of left-distributivity oftentimes prevents expressions to be rewritten in such a way that the fixed-point rule RSP˚in Mil can be applied successfully. But if RSP˚is replaced in Mil by a general unique-solvability rule scheme for guarded systems of equations (see Definition 2.11), then a complete system arises (noted in [Gra06]). Therefore completeness of Mil hinges on whether the fixed-point rule RSP˚enables to prove equal any two star-expression solutions of a given guarded system of equations, on the basis of the purely equational part Mil´of Mil.
As a stepping stone for tackling this difficult question, we characterize the derivational power that the fixed-point rule RSP˚adds to the subsystem Mil´of Mil. We do so by means of 'coinductive proofs' whose shapes have the 'loop existence and elimination property' LEE from [GF20a]. This property stems from the interpretation of (1-free) star expressions, which is defined by induction on syntax trees, creating a hierarchy of 'loop subgraphs'. Crucially for our purpose, linear guarded systems of equations that correspond to finite process graphs with LEE are uniquely solvable modulo provability in Mil´. The reason is that process graphs with LEE, which need not be in the image of the process semantics, are amenable to applying right-distributivity and the rule RSP˚for an extraction procedure like in Salomaa's proof (see Section 6). These process graphs can be expressed modulo bisimilarity by some star expression, which can be used to show that any two solutions modulo Mil´of a specification of LEE-shape are Mil-provably equal. This is a crucial step in the completeness proof by Fokkink and myself in [GF20a] for the tailored restriction BBP of Milner's system Mil to '1-free' star expressions.
Thus motivated, we define a 'LLEE-witnessed coinductive proof' as a process graph G with 'layered' LEE (LLEE) whose vertices are labeled by equations between star expressions. The left-and the right-hand sides of the equations in the vertices of G have to form a solution vector of a specification corresponding to the process graph G. That specification, however, needs to be satisfied only up to provability in Mil´from sound assumptions. Such coinductive derivations are typically circular, like the one depicted in Figure 1 of the semantically valid equation pa`bq˚¨0 " pa¨pa`bq`bq˚¨0 . That example is intended to give a first impression of the concepts involved, despite of the fact that some details can only be appreciated later, when this example will be revisited in Example 5.3. We describe these concepts below.
The process graph G in Figure 1, which is given together with a labelingĜ that is a 'LLEE-witness' of G. The colored transitions with marking labels rns, for n P N`, indicate the LLEE-structure of G, see Section 4. The graph G underlies the coinductive proof on the left (see Example 5.3 for a justification). G is a '1-chart' that is, a process graph with hkkkikkkj pa`bq˚¨0 " f hkkkkkkkkikkkkkkkkj pa¨pa`bq`bq¨p e0 hkkkikkkj pa`bq˚¨0q`0 ι, RSPp a`bq˚¨0 " pa¨pa`bq`bq˚¨0 e0¨0 " f¨pe0¨0q`0 e0¨0 " f˚¨0 p1¨pa`bqq¨pe0¨0q " pp1¨pa`bqq¨f˚q¨0 a, b 1¨pe0¨0q " p1¨f˚q¨0 1 e0¨0 lo omo on (by the premise of ι) pa¨pa`bq`bq¨pe0¨0q`0 " f¨pe0¨0q`0 " " pa¨pa`bq`bql ooooooooomooooooooon 1-transitions that represent empty steps. Here and later we depict 1-transitions as dotted arrows. For 1-charts, '1-bisimulation' is the adequate concept of bisimulation (Definition 2.4). We showed in [Gra21c,Gra20] that the process (chart) interpretation Cpeq of a star expression e is the image of a 1-chart Cpeq with LLEE under a functional 1-bisimulation. In this example, G " Cph˚¨0q maps by a functional 1-bisimulation to interpretations of both expressions in the conclusion. The correctness conditions for such coinductive proofs are formed by the requirement that the left-, and respectively, the right-hand sides of formal equations form 'Mil´-provable solutions' of the underlying process graph: an expression at a vertex v can be reconstructed, provably in Mil´, from the transitions to, and the expressions at, immediate successor vertices of v. Crucially we establish in Section 6, by a generalization of arguments in [GF20a,GF20b] using RSP˚, that every LLEE-witnessed coinductive proof over Mil´can be transformed into a derivation in Mil with the same conclusion.
This raises the question of whether the fixed-point rule RSP˚of Mil adds any derivational power to Mil´that goes beyond those of LLEE-witnessed coinductive proofs over Mil´, and if so, how far precisely. In Section 7 we show that every instance of the fixed-point rule RSP˚can be mimicked by a LLEE-witnessed coinductive proof over Mil´in which also the premise of the rule may be used. It follows that the derivational power that RSPå dds to Mil´within Mil consists of iterating such LLEE-witnessed coinductive proofs along finite (meta-)prooftrees. The example in Figure 2 is intended to give a first idea of the construction that we will use (in the proof of Lemma 7.2) to mimic instances of RSP˚. Here this construction results in a coinductive proof that only differs slightly from the one with the same underlying LLEE-1-chart we saw earlier. We will revisit this example in Example 7.6.
Based on the two transformations from coinductive proofs to derivations in Mil, and of applications of the fixed-point rule to coinductive proofs, we reformulate Milner's system Mil as a theorem-equivalent proof system cMil. For this, we replace the fixed-point rule RSPi n Mil with a rule that permits to infer an equation e " f from a finite set Γ of equations if there is a LLEE-witnessed coinductive proof over Mil´plus the equations in Γ that has conclusion e " f . We also define a theorem-equivalent system CLC ('combining LLEE-witnessed coinductive provability') with the equational coinductive proof rule alone. In the formalization of these systems we depart from the the exposition in [Gra21a,Gra21b]. There, we used a hybrid concept of formulas that included entire coinductive proofs, which then Relation with the completeness proof of Milner's system in [Gra22a]. The completeness proof of Milner's system Mil summarized in [Gra22a] with report [Gra22b] was finished and written only after the article [Gra21b] for CALCO 2021. Indeed, we found the results in Section 6 of [Gra21b] and here in Section 7 (that instances of the fixed-point rule RSP˚can be mimicked by LLEE-witnessed coinductive proofs) in an effort to prepare for that completeness proof. In particular, we wanted to be able to argue for the expedience of the use of LLEE-1-charts (see Definition 4.9) despite of the fact that reasoning with LLEE-1-charts towards a completeness proof of Mil encounters a crucial obstacle 1 . Without any argumentation that links derivations in Milner's system closely to LLEE-1-charts, it could be conceivable that this obstacle does not have any wider significance. Namely, it could be entirely specific to the use of LLEE-1-charts, while a completeness proof might possibly be based on quite different concepts. The situation changed, however, after we realized that instances of the fixed-point rule can always be modeled (see Lemma 7.4) by cyclic proofs of the shape of guarded LLEE-1-charts (see Definition 5.1), and proofs in Milner's system can be transformed (see Theorem 7.8) into meta-prooftrees of such cyclic proofs (derivations in the system CLC, see Definition 5.8). On the basis of these results we could argue that in principle every completeness proof of Milner's system Mil can be routed through (see Section 8) arguments in which LLEE-1-charts appear front and central.
The completeness proof of Mil in [Gra22a,Gra22b] uses additional observations and concepts (above all, a 'crystallization procedure' of LLEE-1-charts for minimization under 1-bisimilarity), and is not formulated in terms of the cyclic proof systems that we introduce here. However, the results of Section 6, the transformation of LLEE-witnessed coinductive proofs into derivations in Mil (see Proposition 6.8) are of central importance for formulating the completeness proof in [Gra22a,Gra22b]. Indeed, they prove the lemmas (E) (extraction of provable solutions from guarded LLEE-1-charts) and (SE) (provable solution equality in guarded LLEE-1-charts) of the completeness proof as listed in Section 5 of [Gra22a,Gra22b]. Overview. We start in Section 2 with introducing basic definitions concerning the process semantics of regular expressions, and concepts that we will need. We define star expressions, finite process graphs with 1-transitions, (1-)bisimulations and 1-bisimilarity, and the process semantics of star expressions. Then we introduce equational-logic based, and equation-based proof systems, with Milner's system Mil and two variants as first examples. Also, we define when inference rules are derivable or admissible in such a proof system, and establish easy interconnections. Finally we define the concept of solution for 1-charts with respect to an equational proof system. In Section 3 we link to an insightful coalgebraic characterization of provable solutions of 1-charts that is due to Schmid, Rot, and Silva in [SRS21]. We reformulate it in our terminology, but do not prove it in detail, as our development does not depend on it. In Section 4 we explain concepts and definitions concerning the (layered) loop existence and elimination property (L)LEE from [GF20b,GF20a], and recall the '1-chart interpretation' of star expressions from [Gra20,Gra21c], which guarantees LLEE. In Section 5 we introduce 'coinductive proofs' over equational proof systems. We formulate proof systems CC and CLC with appropriate rule schemes that permit to use and combine coinductive proofs, and respectively, LLEE-witnessed coinductive proofs. Then we introduce the coinductive reformulation cMil of Mil as an extension of the equational part Mil´of Mil. We also establish basic proof-theoretic connections between these new systems.
In Section 6 we show that coinductive proofs over proof systems with derivational power not greater than Milner's system Mil can be transformed into derivations in Mil. We use this fact to obtain a proof transformation from cMil to Mil.
In Section 7 we demonstrate that every instance ι of the fixed-point rule RSP˚of Mil can be mimicked by a coinductive proof of the conclusion of ι where (correctness conditions of) that proof may use the equational part Mil´of Mil plus the premise equation of ι. We apply this central observation for defining a proof transformation from Mil to cMil. With this transformation and the one constructed in Section 6 we prove that the proof systems CLC and cMil are theorem-equivalent with Milner's system Mil.
In the final section, Section 8, we recapitulate our motivation for introducing coinductive circular proofs, and summarize our results. We argue that the coinductive proof systems CLC and cMil can be viewed as being located roughly half-way in between derivations in Mil and bisimulations between process interpretations of star expressions. We conclude with initial ideas about a proof strategy for a completeness proof of CLC and cMil, which would yield a completeness of Mil.

Process semantics for star expressions, and Milner's proof system
Here we fix terminology concerning star expressions, 1-charts, 1-bisimulations; we exhibit Milner's system (and a few variants), and recall the chart interpretation of star expressions.
Definition 2.1 (star expressions). Let A be a set of actions. The set StExppAq of star expressions over actions in A are strings that are defined by the following grammar: e, e 1 , e 2 ::" 0 | 1 | a | pe 1`e2 q | pe 1¨e2 q | e˚(where a P A) We will drop outermost brackets, and those that are expendable according to the precedence of star˚over composition¨and choice`, and of composition¨over choice`. We use e, f, g, h, possibly indexed and/or decorated, as identifiers (for reasoning on the meta-level like with 'syntactical variables' [Sho67]) for star expressions. We write " for syntactic equality between star expressions denoted by such identifiers, and values of star expression functions, in a given context, but we permit " in formal equations between star expressions. We denote by EqpAq the set of formal equations e " f between two star expressions e, f P StExppAq.
Definition 2.2 (1-charts, and charts). A 1-chart is a 6-tuple xV, A, 1, v s , Ñ, Óy where V is a finite set of vertices, A is a set of (proper) action labels, 1 R A is the specified empty step label, v s P V is the start vertex (hence V ‰ ∅), Ñ Ď VˆAˆV is the labeled transition relation, where A :" A Y t1u is the set of action labels including 1, and Ó Ď V is a set of vertices with immediate termination. In such a 1-chart, we call a transition in Ñ X pVˆAˆV q (labeled by a proper action in A) a proper transition, and a transition in Ñ X pVˆt1uˆV q (labeled by the empty-step symbol 1) a 1-transition. Reserving non-underlined action labels like a, b, . . . for proper actions, we use underlined action label symbols like a for actions labels in the set A; in doing so we highlight also in firebrick transition labels that may involve 1.
We say that a 1-chart is weakly guarded if it does not contain cycles of 1-transitions. By a chart we mean a 1-chart C that is 1-transition free in the sense that all of its transitions are proper. We will use the symbols C and C (also with subscripts) as identifiers for 1-charts, and charts, respectively. We use the notations V pCq, and V pCq for quick reference to the set of vertices of a 1-chart C, and of a chart C. Below we define the process semantics of star (regular) expressions as (1-free) charts, and hence as finite, rooted labeled transition systems, which will be compared with (1-)bisimilarity. The charts that will be obtained in this way correspond to non-deterministic finite-state automata that are defined by iterating partial derivatives [Ant96] (1996) of Antimirov (who did not aim at a process semantics). Indeed, Antimirov's result that every regular expression only has finitely many iterated partial derivatives (Corollary 3.5 in [Ant96]) guarantees finiteness of chart interpretations as defined below. We will use the notation Cpeq with as meaning 'the chart induced by (the process interpretation of) the star expression e'.
Definition 2.3. The chart interpretation of a star expression e P StExppAq is the 1-transition free chart Cpeq " xV peq, A, 1, e, Ñ X pV peqˆAˆV peqq, Ó X V peqy, where V peq consists of all star expressions that are reachable from e via the labeled transition relation Ñ Ď StExppAqˆAˆStExppAq that is defined, together with the immediate-termination relation Ó Ď StExppAq, via derivability in the transition system specification (TSS) T pAq, for a P A, e, e 1 , e 2 , e 1 , e 1 1 , e 1 2 P StExppAq: f e a Ý Ñ e 1 is derivable in T pAq, for e, e 1 P StExppAq, a P A, then we say that e 1 is a derivative of e. If eÓ is derivable in T pAq, then we say that e permits immediate termination.
In Section 4 we define a refinement of this interpretation from [Gra21c] into a 1-chart interpretation. In both versions, (1-)charts obtained will be compared with respect to 1-bisimilarity that relates the behavior of 'induced transitions' of 1-charts. By an induced a-transition v p p pas s s ÝÑ w, for a proper action a P A, in a 1-chart C we mean a path v 1 Ý Ñ¨¨¨1 Ý Ñ¨a Ý Ñ w in C that consists of a finite number of 1-transitions that ends with a proper a-transition. By induced termination vÓ p1q , for v P V we mean that there is a path v 1 Ý Ñ¨¨¨1 Ý Ñṽ withṽÓ in C.
Definition 2.4 ((1-)bisimulation). Let C i " xV i , A, 1, v s,i , Ñ i , Ó i y be 1-charts, for i P t1, 2u. By a 1-bisimulation between C 1 and C 2 we mean a binary relation B Ď V 1ˆV2 such that xv s,1 , v s,2 y P B holds (that is, B relates the start vertices of C 1 and C 2 ), and for every xv 1 , v 2 y P B the following three conditions hold: is a 1-bisimulation between C 1 and C 2 . We denote by C 1 Ø C 2 and say that C 1 and C 2 are 1-bisimilar, if there is a 1-bisimulation between C 1 and C 2 .
By a functional 1-bisimulation from C 1 to C 2 we mean a 1-bisimulation B between C 1 and C 2 that is defined by a function ϕ : V 1 Ñ V 2 as its graph, that is, by B " graphpϕq " txv, ϕpvqy | v P V u; in this case we write C 1 Ñ ϕ C 2 . We write C 1 Ñ C 2 if there is a functional 1-bisimulation from C 1 to C 2 .
We note that for 1-transition-free 1-charts the bisimulation conditions specialize to their usual form: the induced transitions p p p¨s s s Ý Ñ in (forth) and (back) specialize to proper transitions Ý Ñ, and induced termination Ó p1q in (termination) specializes to immediate termination Ó. Let C 1 and C 2 be charts (1-transition-free 1-charts). We write C 1 Ø B C 2 , and say that B 17:10

C. Grabmayer
Vol. 19:2 is a bisimulation between C 1 and C 2 if B is a 1-bisimulation between C 1 and C 2 . We write C 1 Ø C 2 , and say that C 1 and C 2 are bisimilar if there is a bisimulation between C 1 and C 2 . We write C 1 Ñ C 2 if there is 1-bisimulation from chart C 1 to chart C 2 ). Let C be a 1-chart, and B Ď V pCqˆV pCq. We say that B is a 1-bisimulation on C if B is a 1-bisimulation between C and C. Let C be a chart, and B Ď V pCqˆV pCq. We say that B is a bisimulation on C if B is a bisimulation between C and C.
We now define 'process semantics equality' of two star expressions as bisimilarity of their chart interpretations. We do not introduce the process semantics of star expressions as 'star behaviors' (bisimilarity equivalence classes of their chart interpretations) as Milner in [Mil84], but only the relation that two star expressions denote the same star behavior.
Definition 2.5 (process semantics equality). We define process semantics equality as the binary relation " ¨ P Ď StExppAqˆStExppAq by stipulating it, for all e, f P StExppAq, as bisimilarity of the (1-free) chart interpretations of e and f : Definition 2.6 (proof system EL, Eqp¨q-based/EL-based proof systems). Let A be a set.
By an EqpAq-based proof system we will mean a Hilbert-style proof system whose formulas are the equations in EqpAq between star expressions over A. For an EqpAq-based proof system S and a set Γ Ď EqpAq we denote by S`Γ the EqpAq-based proof system whose rules are those of S, and whose axioms are those of S plus the equations in Γ.
The basic proof system ELpAq of equational logic for star expressions over A is an EqpAq-based proof system that has the following rules: Cxt Cres " Crf s that is, the rules Refl (for reflexivity), and the rules Symm (for symmetry), Trans (for transitivity), and Cxt (for filling a context), where Crs is a 1-hole star expression context.
By an ELpAq-based system we mean an EqpAq-based proof system whose rules include the rules of the basic system ELpAq of equational logic (additionally, it may specify an arbitrary set of axioms). We will use the letter S as identifier for EL-based proof systems.
Definition 2.7. Let S be an EqpAq-based proof system. Let e, f P StExppAq. We say that e " f is derivable in S, which we denote here by e 1 " S e 2 (instead of the more commonly used notation $ S e 1 " e 2 ), if there is a derivation without assumptions in S that has conclusion e " f . If e " f is derivable in S, we also say that e " f is a theorem of S.
Definition 2.8 (sub-system, theorem equivalence/subsumption of Eqp¨q-based proof systems). Let S 1 and S 2 be EqpAq-based proof systems.
We say that S 1 is a sub-system of S 2 , denoted by S 1 Ď S 2 , if every axiom of S 1 is an axiom of S 2 , and every rule of S 1 is also a rule of S 2 . We say that S 1 is theorem-subsumed by S 2 , denoted by S 1 À S 2 , if every theorem of S 1 is also a theorem of S 2 , that is, if e " S 1 f implies e " S 2 f , for all e, f P StExppAq. We say that S 1 and S 2 are theorem-equivalent, denoted by S 1 " S 2 , if S 1 and S 2 have the same theorems (that is, if S 1 À S 2 , and S 2 À S 1 ).
For the definitions of the concept of 'derivable', 'correct', and 'admissible' rule in Definition 2.9 below for an EqpAq-based proof system we introduce an informal concept of derivation rule that will suffice for our purpose. For abstract formulations of rules, and for the concepts of derivability, correctness, and admissibility of rules we refer: (i) to [Gra05a], where these concepts have been gathered and formally treated for Hilbertstyle proof systems (as well as for natural-deduction style proof systems), (ii) and to [Gra04], where for 'abstract Hilbert systems', systematic connections between these concepts of rules have been studied, also with respect to how rules can be eliminated from derivations. Let S be an EqpAq-based proof system for star expressions over A. Let n P N. By a(n) (n-premise) rule R for S we mean an inference scheme all of whose instances are of the form: with star expressions e, f, e 1 , . . . , e n , f 1 , . . . , f n P StExppAq. For such a rule R for S we denote by S`R the EqpAq-based proof system that extends S by adding R as an additional rule.
Definition 2.9 (derivable, correct, and admissible rules). Let S be an EqpAq-based proof system. Let R be a rule for S. We say that R is derivable in S if every instance ι of R can be mimicked by a derivation D ι in S by which we mean that the set of assumptions of D ι is contained in the set of premises of ι, and the conclusion of D ι is the conclusion of ι.
We say that R is correct for S if instances of R can be eliminated from derivations in S`R in the following limited sense: for every derivation D in S`R without assumptions that terminates with an instance of R but all of whose immediate subderivations are derivations in S there is a derivation D 1 in S without assumptions, and with the same conclusion as D.
We say that R is admissible in S if S`R " S holds, that is, the addition of R to S does not extend the derivable formulas (the theorems) of S.
The definition of 'R is admissible in S' is easily understood to be equivalent with the statement that instances of R can be eliminated from derivations in S`R without assumptions in the unlimited sense: for every derivation D in S`R without assumptions there is a derivation D 1 in S without assumptions, and with the same conclusion as D. Therefore rule admissibility implies rule correctness. This justifies the implication "ñ" in item (i) of the lemma below that gathers basic relationships between the three properties of rules with respect to a proof system as defined above.
Lemma 2.10. Let R be a rule for an EL-based proof system S for star expressions over A. Then the following statements link derivability, correctness, and admissibility of R in/for S : then R is also correct for S, and due to (i) also admissible in S. However, rule admissibility and correctness does not imply derivability in general.
Proof. Concerning statement (i) of the lemma we have already argued for the direction "ñ" just above. The direction "ð" can be established by showing that, if R is correct for S, then every given derivation D in S`R can be transformed into a derivation D 1 in S with the same conclusion by eliminating instances of R in top-down direction, using derivation replacements as guaranteed by the defining statement of 'R is correct for S'.
For showing the main part of statement (ii), we consider an n-premise rule R for S that is a derivable rule of S. In order to show that R is correct for S, we have to show that every derivation D in S`R that terminates with an instance ι of R but has immediate subderivations in S can be transformed into a derivation D 1 in S with the same conclusion. Let D be such a derivation in S`R with instance ι of R at the bottom, as illustrated on the 17:12

C. Grabmayer
Vol. 19:2 right below. Since R is derivable in S there is a derivation D ι in S that derives the conclusion of ι from its n premises. Then D can be transformed according to the following step: where re 1 " f 1 s, . . . re n " f n s denote the assumption classes of e 1 " f n , . . . , e 1 " f n in leafs at the top of the prooftree D ι ). The result of this step is a derivation D 1 in S with the same conclusion as D. Since D was chosen arbitrary in this statement but with a bottommost instance of R and immediate subderivations in S, we have shown the desired transformation statement, which guarantees that R is correct for S.
If a rule R is correct and admissible in an EL-based proof system S, then R does not need to be derivable. This is because correctness of R in S cannot be used to mimic such instances of R that do not have theorems of S as conclusion by derivations in S. As a trivial example we take S " ELpAq. In S only reflexivity axioms are theorems. A 1-premise rule that leaves its premise unchanged is clearly admissible in S, but not derivable, because instances with formulas e " f where e ı f cannot be mimicked by derivations in S. Now we introduce Milner's proof system Mil, and two of its variants Mil 1 and Mil 1 . Afterwards we gather basic connections between these systems.
Definition 2.11 (Milner's system Mil, variants and subsystems). Let A be a set of actions. By the proof system Mil´pAq we mean the ELpAq-based proof system for star expressions over A with the following axiom schemes: passocp`qq pe`f q`g " e`pf`gq pid l p¨qq 1¨e " e pneutrp`qq e`0 " e pid r p¨qq e¨1 " e pcommp`qq e`f " f`e pdeadlockq 0¨e " 0 pidempotp`qq e`e " e precp˚qq e˚" 1`e¨ep assocp¨qq pe¨f q¨g " e¨pf¨gq ptrm-bodyp˚qq e˚" p1`eqp r-distrp`,¨qq pe`f q¨g " e¨g`f¨g where e, f, g P StExppAq, and with the rules of the system ELpAq of equational logic. The recursive specification principle for star iteration RSP˚, the unique solvability principle for star iteration USP 1 , and the general unique solvability principle USP are the schematically defined rules with side-conditions of the following forms: Milner's proof system MilpAq is the extension of Mil´pAq by adding the rule RSP˚. Its variant systems Mil 1 pAq, and Mil 1 pAq, arise from Mil´pAq by adding (instead of RSP˚) the rule USP 1 , and respectively, the rule USP. ACIpAq is the system with the axioms for associativity, commutativity, and idempotency for`. We will keep the action set A implicit in the notation. Lemma 2.12. Milner's system Mil and its variants Mil 1 and Mil 1 are related as follows: Proof. Statement (i) of the lemma is due to the fact that instances the rule USP 1 are also instances of USP, and therefore Mil 1 " Mil´`USP 1 À Mil´`USP " Mil 1 follows. For establishing statement (ii) we show that USP 1 is a derivable rule in Mil, and that RSP˚is a derivable rule in Mil 1 . Then, by Lemma 2.10, (ii), USP 1 is an admissible rule of Mil, thus Mil`USP 1 " Mil, and RSP˚is an admissible rule of Mil 1 , hence Mil 1`U SP 1 " Mil 1 . With this we can argue as follows: Mil " Mil`USP 1 " pMil´`RSP˚q`USP 1 " pMil´`USP 1 q`RSP˚" Mil 1`R SP˚" Mil 1 Then we obtain Mil " Mil 1 by transitivity of theorem equivalence ".
For showing that RSP˚is derivable in Mil 1 , we consider an instance of RSP˚as in Definition 2.11, for fixed star expressions e, f with f Ú , and g. From its premise e " f¨e`g we have to show that the conclusion e " f˚¨g of the RSP˚instance can be derived by inferences in Mil 1 " Mil´`USP 1 . By stepwise use of axioms of Mil´we obtain: Hence there is a derivation of f˚¨g " f¨pf˚¨gq`g in Mil 1 . This derivation can be extended, due to f Ú , by an instance of USP 1 that is applied to e " f¨e`g and f˚¨g " f¨pf˚¨gq`g. We obtain a derivation of e " f˚¨g in Mil 1 from the assumption e " f¨e`g.
For showing that USP 1 is derivable in Mil, we consider an instance of USP 1 as in Definition 2.11, with premises e 1 " f¨e 1`g , and e 2 " f¨e 2`g , for fixed star expressions e 1 , e 2 , f with f Ú , and g. By two instances of RSP˚we get e 1 " f˚¨g, and e 2 " f˚¨g. By applying Symm below e 2 " f˚¨g, we obtain f˚¨g " e 2 . Then by applying Trans to e 1 " f˚¨g and f˚¨g " e 2 we obtain the conclusion e 1 " e 2 of the USP 1 instance. Now we define soundness and completeness of equation-based proof systems for star expressions with respect to equivalence relations on star expressions. Then we formulate soundness of Milner's system from [Mil84], and recall Milner's completeness question.
Definition 2.13. Let S be an EqpAq-based proof system and let » be an equivalence relation on StExppAq. We say that S is sound for » if, for all e, f P StExppAq, e " S f implies e » f . We say that S is complete for » if, for all e, f P StExppAq, e » f implies e " S f .
Proposition 2.14 [Mil84]. Mil is sound for process semantics equality " ¨ P on regular expressions. That is, for all e, f P StExppAq it holds: p e " Mil f ùñ e " ¨ P f q , and hence p e " Mil f ùñ e " ¨ P f q .
Question 2.15 [Mil84]. Is Mil complete for bisimilarity of process interpretations? That is, does for all e, f P StExppAq the implication p e " Mil f ðù Cpeq Ø Cpfq q hold?
Finally we define the crucial concept of provable solution of a 1-chart with respect to an EL-based proof system. Intuitively, a 'provable solution' of a 1-chart C is a provable solution of some recursive specification SpCq that is associated with C in a natural way (see for example the two examples on page 2). Since associating specifications SpCq to 1-charts C presupposes the use of some list representation for the set T C pvq of transitions from vertex v, for every vertex v of C, any such association map cannot be unique. The definition of provable solutions of 1-charts below uses such list representations implicitly, and assumes that associativity, commutativity, and reflexivity axioms are present in the underlying proof system. In this way the concept of provable solution permits us to avoid defining associated specifications for 1-charts in some canonical (but still necessarily arbitrary) way. In the next section we explain an alternative characterization of provable solutions.
Definition 2.16 (provable solutions). Let S be an EL-based proof system for star expressions over A that extends ACI. Let C " xV, A, 1, v s , Ñ, Óy be a 1-chart.
By a star expression function on C we mean a function s : V Ñ StExppAq on the vertices of C. Let v P V . We say that such a star expression function s on C is an S-provable solution of C at v if it holds that: given the (possibly redundant) list representation , and as 1 if vÓ. This definition does not depend on the specifically chosen list representation of T C pvq, because S extends ACI, and therefore it contains the associativity, commutativity, and idempotency axioms for`.
By an S-provable solution of C (with principal value spv s q at the start vertex v s ) we mean a star expression function s on C that is an S-provable solution of C at every vertex of C.

Characterization of provable solutions of 1-charts
This section is an intermezzo in which we link to an elegant coalgebraic formulation of the concept of provable solution by Schmid, Rot, and Silva in [SRS21]. Their observation is a crucial first part of a detailed and beautiful coalgebraic analysis of the completeness proof in [GF20b,GF20a] by Fokkink and myself for a tailored restriction of Milner's system Mil to '1-free star expressions'. Here we reformulate their characterization of provable solution by means of the terminology that we are using here, and explain the connection, but do not prove the statements in detail. This is because we will only use this characterization later as an additional motivation for our concept of 'coinductive proof', but not for developing the proof transformations to and from the coinductive reformulation cMil of Milner's system Mil.
Schmid, Rot, and Silva construe the operational process semantics that a transition system like that in Definition 2.3 induces on the set StExp of all star expressions as a coalgebra (also denoted by) StExp. Charts can also be represented as (finite) coalgebras due to their structure as transition graphs. On this basis, they obtain the following characterization of provable solutions for proof systems S like Mil and Mil´.
Lemma 3.1 (" Lemma 2.2 in [SRS21]). For every chart C, for every star-expression function s : V pCq Ñ StExp, and for S P ␣ Mil, Mil´(, the following two statements are equivalent: (i) s is an S-provable solution of a chart C.
By analyzing the proof of this statement on the basis of terminology we use here, we find the following. Schmid, Rot, and Silva noticed that statements (a) and (b) below hold, and used them in conjunction with (c) (which is analogous to Proposition 2.9 in [GF20b,GF20a]) to obtain the characterization for charts above. We extend it to 1-charts here in (d): (a) Provability in a system S like Milner's defines a bisimulation relation on the the set of star expressions when that is endowed with the process semantics. (See Lemma 3.3). (b) Due to (a) a factor chart Cpeq{ " S can be defined such that Cpeq Ñ Cpeq{ " S holds, that is, there is a functional bisimulation from Cpeq to Cpeq{ " S . (See Lemma 3.5). We formulate these statements more precisely here below. We start with a general definition of factor charts. But the property (b) of factor charts of the chart interpretation with respect to provability will then only be shown in Lemma 3.4 below, after the formulation of the property (a) in Lemma 3.3.
Definition 3.2 (factor chart). Let C " xV, A, 1, v s , Ñ, Óy be a chart (that is, a 1-transition free 1-chart). Let » be an equivalence relation on V . Then we define the factor chart C{ » of C with respect to » by: , and for all v, v 1 , v 2 P V and a P A: By the projection function from C to C{ » we mean the function π » : . Then provability " S with respect to S is a bisimulation on the chart interpretation Cpeq of e, for every e P StExppAq.
Proof (Idea). By verifying the bisimulation conditions (forth), (back), (termination) for conclusions of derivations in S, proceeding by induction on the depth of derivations in S. In the base case, this is settled for the axioms of Mil´. In the induction step, it is settled for the conclusions of the reflexivity, symmetry, and transitivity rules of EL, and of the fixed-point rule RSP˚in Mil. (The arguments are similar to the proof of Theorem 2.1 in [SRS21].) Lemma 3.4. Let C " xV, A, 1, v s , Ñ, Óy be a (1-free) chart. Let » be an equivalence relation on V that is a bisimulation on C.
Then C Ñ π» C{ » holds, that is, π » defines a functional bisimulation from C to C{ » .
Proof (hint). The (forth) and (termination) conditions for the graph graphpπ » q of π » to be a bisimulation are easy to verify. For demonstrating also the (back) condition for graphpπ » q to be a bisimulation it is crucial to use the assumption that » is a bisimulation on C.

C. Grabmayer
Vol. 19:2 The following lemma states that every star expression e can be reconstructed, provably in Mil´, from the transitions that it facilitates in the process semantics, and the targets of these transitions. Statements like this are frequently viewed as being analogous to the fundamental theorem of calculus, which states that every differentiable function can be reconstructed from its derivative function via integration. Proof (hint). The proof proceeds by induction on the structure of the star expression e. All axioms of Mil´(and hence all axioms of Mil) are necessary in the arguments. An analogous statement that can be viewed as the restriction of the statement of Lemma 3.6 for '1-free star expressions' was proved as Lemma A.2 in [GF20b] , and as Theorem 2.2 in [SRS21].
Here we will prove an analogous statement, Lemma 4.20, in the next section.
Lemma 3.7. For every star expression e P StExppAq with chart interpretation Cpeq " xV peq, A, 1, e, Ñ, Óy the identical star-expression function id V peq : V peq Ñ StExppAq, e Þ Ñ e is a Mil´-provable solution of Cpeq with principal value e.
Proof. The correctness conditions for the star-expression function id V peq to be a Mil´-provable solution of the chart interpretation Cpeq of e are guaranteed by Lemma 3.6.
On the basis of these preparations we now reformulate the characterization of provable solutions of charts by Schmid, Rot, and Silva as a characterization of provable solutions of 1-charts via functional 1-bisimulations to factor charts of appropriate chart interpretations.
Proof (sketch). A technical part of the proof consists in showing that for every star-expression function s : V Ñ StExppAq on a 1-chart C " xV, A, 1, v s , Ñ, Óy the following two statements are equivalent: (i) s is an S-provable solution of C, (ii) s is an S-provable solution of the 'induced chart' C p¨s p¨s p¨s " xV, A, 1, p p p¨s s s Ý Ñ, Ó p1q y of C that results by using induced transitions as transitions, and induced termination as termination, that is, with: For the implication 'ñ' in (3.1) we assume that s is a S-provable solution of C. By the auxiliary statement above, s is then also a S-provable solution of the induced chart C p¨s p¨s p¨s of C. Then it is not difficult to verify the 1-bisimulation conditions (forth), (back), and (termination) for rss " S to define a 1-bisimulation from C to Cpspv s qq{ " S .
For the converse implication 'ð' in (3.1), we assume s : V Ñ StExppAq as a star expression function with C Ñ rss " S Cpspv s qq{ " S . Here Lemma 3.6, the possibility to S-provably reconstruct a star expression e from the transitions to its derivatives, can be employed in order to recognize s as a S-provable solution of the induced chart C p¨s p¨s p¨s of C. Then by applying the auxiliary statement, we obtain that s is also a S-provable solution of C.  Figure 3: Four 1-charts (action labels ignored) that violate at least one loop 1-chart condition (L1), (L2), or (L3), and a loop 1-chart C with one of its loop sub-1-charts L.

Layered loop existence and elimination, and LLEE-witnesses
In this subsection we recall definitions from [GF20a,Gra21c] of the loop existence and elimination condition LEE, its 'layered' version LLEE, and of chart labelings that witness these conditions. Specifically we will use the adaptation of these concepts to 1-charts that has been introduced in [Gra21c], because the use of 1-charts with 1-transitions will be crucial for the concept of 'LLEE-witnessed coinductive proof' in Section 5. For this purpose we also recall the '1-chart interpretation' of star expressions as introduced in [Gra21c] for which the property LLEE is guaranteed in contrast to the chart interpretation from Definition 2.3. We will keep formalities to a minimum as these are necessary for our purpose here, and have to refer to [GF20a,Gra21c] and the appertaining reports [GF20b, Gra20] for more details.
We start with the definitions of loop 1-charts, and of loop sub(-1)charts, and examples for these concepts.   A loop sub-1-chart of a 1-chart C is a loop 1-chart L that is a sub-1-chart of C with some vertex v P V of C as start vertex such that L is formed, for a nonempty set U of transitions of C from v, by all vertices and transitions on paths that start with a transition in U and continue onward until v is reached again; in this case the transitions in U are the loop-entry transitions of L, and we say that the transitions in U induce L. Example 4.4. In the 1-chart C in Figure 3 we have illustrated (in the right copy of C) a loop sub-1-chart L of C with start vertex v 2 that is induced by the set U :" txv 2 , a, v 0 yu that consists of the single loop-entry transition from v 2 to v 0 , assuming that its action label is a.
Then L consists of all colored transitions. -We note that also the generated sub-1-chart CÓ v 2 of C that is rooted at v 2 is a loop sub-1-chart of C, because it is a loop 1-chart, and it that is generated by the set of both of the two transitions from v 2 .
The 1-chart C 1 that results by the elimination of (the loop sub-1-chart) L from C arises by removing all loop-entry transitions in U of L from C, and then also removing all vertices and transitions that become unreachable; in this case we write C ñ elim C 1 , and also say that C 1 results by a single-step loop elimination from C.
Suppose that the loop sub-1-charts L 1 , . . . , L n satisfy the following two conditions: (ms-1) their sets U 1 , . . . , U n of loop-entry transitions are disjoint (that is, U i X U j ‰ ∅ for all i, j P t1, . . . , nu with i ‰ j), (ms-2) no start vertex of a loop sub-1-chart L i is in the body of another one L j , for all i, j P t1, . . . , nu with i ‰ j. Then we say that a 1-chart C 1 results by the multi-step loop elimination of L 1 , . . . , L n from C if C 1 arises from C by removing all loop-entry transitions in U 1 , . . . , U n of L 1 , . . . , L n from C, and then also removing all vertices and transitions that become unreachable; in this case we write C ùñ elim C 1 , and say that C 1 results by a multi-step loop elimination from C.
Proof. First, ñ elim Ď ùñ elim holds because every single-step loop elimination is also a multi-step loop elimination. Crucially, ùñ elim Ď ñè lim holds, because every multi-step loop elimination of loop sub-1-charts L 1 , . . . , L n in a 1-chart C with loop-entry transitions U 1 , . . . , U n can be implemented as a sequence of single-step loop eliminations of L 1 , . . . , L n irrespective of the chosen order: hereby (ms-1) guarantees that every loop-entry transition belongs uniquely to one of L 1 , . . . , L n and thus is removed in precisely one step; and (ms-2) ensures that, after the elimination of a loop sub-1-chart L i , another one L j with j ‰ i that has not yet been eliminated is still a loop sub-1-chart. Finally these statements imply that the many-step versions of single-step and multi-step loop elimination coincide.
We say that C has the loop existence and elimination property (LEE) if repeated loop elimination started on C leads to a 1-chart without an infinite path, that is, if there is multi-step loop elimination reduction sequence C ùñe lim C 1 (or by Lemma 4.6 equivalently, a single-step loop elimination reduction sequence C ñe lim C 1 ) that leads to a 1-chart C 1 without an infinite path.
If, in a successful elimination sequence from a 1-chart C, loop-entry transitions are never removed that depart from a vertex in the body of a previously eliminated loop sub-1-chart, then we say that C satisfies layered LEE (LLEE), and that C is a LLEE-1-chart.
Example 4.8. In Figure 4 we have illustrated a successful run of the loop elimination procedure for the 1-chart C there. The loop-entry transitions of loop sub-1-charts that are eliminated in the next step, respectively, are marked in bold. We have neglected action  Figure 4: Example of a loop elimination process that witnesses LEE/LLEE for the 1-chart C.
Three single-step loop eliminations from C reach the same result C 3 as two multistep loop eliminations (where the second multi-step is also a single step).
labels there, except for indicating 1-transitions by dotted arrows. Since the graph C 3 that is reached by three loop-subgraph elimination steps C ñè lim C 3 from the 1-chart C does not have an infinite path, and since no loop-entry transitions have been removed from a previously eliminated loop sub-1-chart, we conclude that C satisfies LEE and LLEE. In Figure 5 we illustrate two runs of the loop elimination procedure from a 1-chart E: The one from E to the left only witnesses LEE but not LLEE, since in the second elimination step a loop-entry transition (drawn red) is removed from the body of the loop sub-1-chart that is eliminated in the first step (drawn in green). The one from E to the right witnesses LLEE, because transitions are only removed sequentially at the same vertex, and hence no loop-entry transition is removed from the body of a loop 1-chart that was eliminated before.
The two process graphs G 1 and G 2 on page 2, which are not expressible by star expressions modulo bisimilarity, do not satisfy LLEE nor LEE: neither of them has a loop subchart (as argued in Example 4.2), yet both of them facilitate infinite paths. 17:20   Figure 7: A LEE-witness that is not layered (in the middle), and a LLEE-witness (right) for a variation E 1 of the LLEE-1-chart E in Figure 5.
Definition 4.9 (LLEE-witness). Let C " xV, A, 1, v s , Ñ, Óy be a 1-chart. By an entry/body-labeling of C we mean a 1-chartĈ " xV, AˆN, 1, v s ,Ñ, Óy with actions in AˆN that results from C by attaching to every transition of C an additional marking label in N (the transitions inÑ are marking-labeled versions of the transitions in Ñ).
A LLEE-witnessĈ of a 1-chart C is an entry/body-labeling of C that is the recording of a LLEE-guaranteeing, successful run C ùñe lim C 1 of the multi-step loop elimination procedure on C that results by attaching to a transition τ of C the marking label n for n P N`(in pictures indicated as rns, in steps as Ñ rns ) forming a loop-entry transition if τ is eliminated in the n-th multi-step, and by attaching marking label 0 to all other transitions of C (in pictures neglected, in steps indicated as Ñ bo ) forming a body transition.
We say that a LLEE-witnessĈ of a 1-chart C is guarded if the action labels of the loop-entry transitions ofĈ are proper (different from 1). We say that a LLEE-1-chart C is guarded if C has a guarded LLEE-witness.
The definition above of guardedness for LLEE-witnesses is justified in view of the fact that loop-entry transitions divide infinite paths in LLEE-witnesses into finite segments that consist only of body transitions with perhaps a leading loop-entry transition. This is a consequence of the fact that LLEE-witnesses do not permit infinite paths of body transitions (see Lemma 4.13, (ii)). Therefore guarded LLEE-witnesses, in which loop-entry transitions must be proper, do not permit infinite paths of 1-transitions. It also follows that the underlying (LLEE-)1-chart of a guarded LLEE-witness is weakly guarded. Example 4.10. The entry/body-labelingsĈ 1 andĈ 3 in Figure 6 of the 1-chart C from Figure 4 are LLEE-witnesses that arise from the successful runs of the loop elimination procedure in Example 4.9:Ĉ 1 is the recording on C of the three single-step loop eliminations (viewed as trivial multi-steps in order to apply the clause for a LLEE-witness in Definition 4.9) that lead to C 3 , andĈ 3 is the recording on C of the two multi-step loop eliminations from C toĈ 3 . The entry/body-labelingĈ 2 in Figure 6 is another LLEE-witness of C that records the successful process of four elimination steps of four loop sub-1-charts each of which is induced by only a single loop-entry transition. The 1-chart C in Figure 4 has a property that does not hold in general: C only admits layered LEE -witnesses. Indeed, this does not hold for the 1-chart E in Figure 5: the entry/body-labeling p E p1q is not a layered LLEE-witness, because it arises from a run of the loop elimination process in which in the second step a loop-entry transition is eliminated from the body of a loop sub-1-chart that was eliminated in the first step. But the entry/body-labeling p E 1 to the LLEE-witness p E p2q 1 in the example in Figure 7, which transfers the loop-entry transition marking label r3s from the transition from w 1 to w 2 over to the transition from v to u, hints at the proof of this statement. However, we do not need this result, because we will be able to use the guaranteed existence of LLEE-witnesses (see Theorem 4.18) for the 1-chart interpretation below (see Definition 4.15).
For the proofs in Section 6 we will need the 'descends-in-loop-to' relation ñ as defined below, and the fact that it constitutes a 'descent' in a LLEE-witness. The latter is expressed by the subsequent lemma together with termination of the body-step relation Ñ bo . Both of these properties can be established by arguing with the successful runs of the loop sub-1-chart elimination procedure that underlies a LLEE-witness.
Let v, w P V . We denote by v ñ w, and by w ð v, and say that v descends in a loop to w, if w is in the body of the loop sub-1-chart at v, which means that there is a path v Ñ rns v 1 Ñb o w from v via a loop-entry transition and subsequent body transitions without encountering v again.
Lemma 4.13. The relations ñ and Ñ bo defined by a LLEE-witnessĈ of a 1-chart C satisfy: (i) ð`is a well-founded, strict partial order on V .
(ii) Ðb o is a well-founded strict partial order on V .
Proof. Well-foundedness and irreflexivity of each of ð`and Ðb o follows from termination of ñ and Ñ bo , respectively. These termination properties can be established in the same way as for LLEE-charts without 1-transitions, for which they follow immediately from Lemma 5.2 in [GF20a,GF20b]. Since ð`and Ðb o are transitive by definition, it follows that both relations are well-founded strict partial orders.
While chart interpretations of '1-free' star expressions always satisfy LEE, see [GF20b]), we observed in [Gra21c] that this is not true for the chart interpretations of star expressions 17:22

C. Grabmayer
Vol. 19:2 in general. As a remedy for this failure of LEE for chart interpretations, we introduced '1-chart interpretations' of star expressions [Gra21c]. For such 1-chart interpretations we showed that LEE is guaranteed, and that they refine chart interpretations in the sense that there always is a functional 1-bisimulation from the 1-chart interpretation of a star expression to its chart interpretation (see Theorem 4.18 below). For the definition of 1-chart interpretations we extended the syntax of star expressions to obtain 'stacked star expressions', see the definition below. The intuition behind the use of the 'stack product' symbol › is to keep track of when a transition has descended into the body of an iteration expression such that the iteration can be interpreted as a loop sub-1-chart or a tower of nested (and possibly partially overlapping) loop sub-1-charts. This feature of › makes a transition system specification possible (see Definition 4.15) which introduces 1-transitions only as 'backlinks' that lead from the body (the internal vertices) of some loop sub-1-chart L of a 1-chart interpretation back to the start vertex of L.
Definition 4.14 (stacked star expressions). Let A be a set whose members we call actions.
The set StExp p›q pAq of stacked star expressions over (actions in) A is defined by the grammar: . Note that the set StExppAq of star expressions would arise if the clause E › e˚were dropped.
The star height |E|˚of stacked star expressions E is defined by adding the two clauses |E¨e|˚:" max t|E|˚, |e|˚u, and |E › e˚|˚:" max t|E|˚, |e˚|˚u to the definition of the star height of star expressions.
The projection function π : StExp p›q pAq Ñ StExppAq is defined by interpreting › as¨by the clauses: πpE¨eq :" πpEq¨e, πpE › e˚q :" πpEq¨e˚, and πpeq :" e, for all stacked star expressions E P StExp p›q pAq, and star expressions e P StExppAq.
In line with [Gra21c] we introduce the 1-chart interpretation of a star expression e with notation Cpeq as 'the 1-chart induced by (the process interpretation of) e'. For understanding the TSS in its definition below it is key to note that, by the rules for iterations, the stacked product operation › helps to record that an expression has descended from the iteration expression on the right-hand side of ›. This feature is used by the rule for stacked product to introduce 1-transitions only as backlinks to expressions from which they have descended. The rules for iteration expressions define loop-entry transitions and body transitions, respectively, dependent on whether e is 'strongly normed' (symbolically denoted by nd`peq) in the sense of facilitating a process trace to termination, and hence dependent on whether an iteration induces a loop sub-1-chart (outside of inner loop sub-1-charts).
Definition 4.15 (1-chart interpretation of star expressions). By the 1-chart interpretation Cpeq of a star expression e we mean the 1-chart that arises together with the entry/body-la-belingĈpeq as the e-rooted labeled transition system with 1-transitions (1-LTS) generated by teu according to the following TSS on the set StExp p›q of stacked star expressions, where l P tbou Y trns | n P N`u are marking labels: The condition nd`peq means a strengthening of normedness, namely, that e permits a positive length path to an expression f with f Ó ; it is definable by induction. Immediate termination for expressions of Cpeq is defined by the same rules as in Definition 2.3 (for star expressions only, preventing immediate termination for expressions with stacked product ›). We note that finiteness of Cpeq as a 1-chart is guaranteed by Theorem 4.18, (ii), below.
We also extend the 1-chart interpretation of star expressions in the obvious way to all stacked star expressions E P StExp p›q : by CpEq we mean the E-rooted sub-1-LTS generated by tEu in the 1-LTS generated by the TSS above.
Definition 4.16. For every stacked star expression E P StExp p›q pAq, we define the set ABpEq of action (partial) 1-derivatives of E, and the set BpEq of (partial) 1-derivatives of E by: where the transitions are defined by the TSS in Definition 4.15.
Lemma 4.17. The action 1-derivatives ABpEq of a stacked star expression E over actions in A satisfy the following recursive equations, for all a P A, e, e 1 , e 2 P StExppAq, and stacked star expressions E 1 over actions in A: ABp0q :" ABp1q :" ∅ , Proof. By case-wise inspection of the definition of the TSS in Def. 4.15.
Theorem 4.18 [Gra20,Gra21c]. For every e P StExppAq, the following statements hold for the concepts as introduced in Definition 4.15: (i) The entry/body-labelingĈpeq of Cpeq is a guarded LLEE-witness of Cpeq.
(ii) The projection function π defines a 1-bisimulation from the 1-chart interpretation Cpeq of e to the chart interpretation Cpeq of e, that is symbolically, Cpeq Ñ π Cpeq, and hence also Cpeq Ñ Cpeq. Since the set of stacked star expressions that form the pre-image of a star expression under the projection function is always finite, it follows that 1-chart interpretations of star expressions are always finite as well.
For the proof of Lemma 4.21 below we will need the second of the two subsequent lemmas, Lemma 4.20. Its proof uses the first lemma, which crucially states that every star expression e with immediate termination can Mil´-provably be written as a star expression 1`f where f does not permit immediate termination.
Lemma 4.19. If eÓ for a star expression e P StExppAq, then there is a star expression f P StExppAq with f Ú , e " Mil´1`f , |f |˚" |e|˚, and ppidˆπq˝ABqpfq " ppidˆπq˝ABqpeq.
Proof. By a proof by induction on structure of e, in which all axioms of Mil´are used. Lemma 4.20. πpEq " Mil´τCpEq pEq`ř n i"1 a i¨π pE 1 i q, given a list representation T CpEq pwq " Proof. We establish the lemma by induction on the star height |E|˚of E with a subinduction on the syntactical structure of E. All cases of stacked star expressions can be dealt with in a quite straightforward manner, except for the case of star expressions with an outermost iteration. There, an appeal to Lemma 4.19 is crucial. We treat this case in detail below.
Suppose that E " e˚for some star expression e P StExppAq (without occurrences of stacked product ›). For showing the representation of πpEq as stated by the lemma, we assume that the transitions from e in Cpeq as defined in Definition 4.15 are as follows: for some stacked star expression E 1 1 , . . . , E 1 n , which are 1-derivatives of e. Note that according to the TSS in Definition 4.15 only proper transitions (those with proper action labels in A) can depart from the star expression e (which does not contain stacked products ›). Then it follows, again from the TSS in Definition 4.15 that: We assume now that eÓ holds. (We will see that if e Ú holds, the argumentation below becomes easier). Then by Lemma 4.19 there is a star expression f P StExppAq with f Ú , and such that 1`f " Mil´e , |f |˚" |e|˚, and ppidˆπq˝ABqpfq " ppidˆπq˝ABqpeq hold. From the latter it follows with (4.1):  In view of (4.2), this chain of Mil´-provable equalities verifies the statement in the lemma in this case E " e˚with eÓ. If e Ú holds, then the detour via f is not necessary, and the argument is much simpler. The statement of the lemma holds true then as well. Proof. The statement of the lemma is an immediate consequence of Lemma 4.20.

Coinductive version of Milner's proof system
In this section we motivate and define 'coinductive proofs', introduce coinductive versions of Milner's system Mil, and establish first interconnections between these proof systems.
As the central concept we now introduce 'coinductive proofs' over EL-based proof systems S. We have seen examples for such circular deductions earlier in Figure 1 and Figure 2. We define a coinductive proof over S as a weakly guarded 1-chart C whose vertices are labeled by equations between star expressions such that the left-, and the right-hand sides of the equations form S-provable solutions of C. The conclusion of such a proof is the equation that labels the start vertex of C. If S is theorem-subsumed by Mil (formally, S À Mil holds), then a coinductive proof with 1-chart C, conclusion e 1 " e 2 , and left-and right-hand side labeling functions L 1 and L 2 can be viewed, due to Proposition 3.8, as a pair of 1-bisimulations defined by rL 1 s " Mil and by rL 2 s " Mil from C to Cpe 1 q{ " Mil , and to Cpe 2 q{ " Mil (see Figure 8). In this case we can show that the conclusion e 1 " e 2 of the coinductive proof is semantically sound (see Proposition 5.6). Indeed a stronger statement holds, and its proof will form the central part of Section 6: if S À Mil holds, and the underlying chart of the coinductive proof of e 1 " e 2 over S is a LLEE-1-chart, then that proof can be transformed into a proof of e 1 " e 2 in Milner's system Mil (see Proposition 6.8 in the next section).
In order to guarantee that coinductive proofs over a proof system S can only derive semantically valid equations, it is necessary to demand that S is sound for process-semantics equality " ¨ P (for example if S À Mil, using Proposition 2.14). This notwithstanding, we do not include this requirement in the definition below, but add it later to statements when it is needed. The reason is that in Section 7 we want to be able to show (see Lemma 7.3) that even instances of the fixed-point rule RSP˚with premises that are not semantically valid can be mimicked by coinductive proofs over appropriate proof systems that are unsound. Definition 5.1 ((LLEE-witnessed) coinductive proofs). Let A be a set of actions. Let S be an ELpAq-based proof system with ACI Ď S. Let e 1 , e 2 P StExppAq be star expressions.
By a coinductive proof over S of e 1 " e 2 we mean a pair CP " xC, Ly that consists of a weakly guarded 1-chart C " xV, A, 1, v s , Ñ, Óy, and a labeling function L : V Ñ EqpAq of vertices of C by formal equations over A such that for the functions L 1 , L 2 : V Ñ StExppAq that denote the star expressions L 1 pvq, and L 2 pvq, on the left-, and on the right-hand side of the equation Lpvq, respectively, the following conditions hold: (cp1) L 1 and L 2 are S-provable solutions of C, (cp2) e 1 " L 1 pv s q and e 2 " L 2 pv s q (e 1 and e 2 are principal values of L 1 and L 2 , respectively).
We denote by e 1 coind """ S e 2 that there is a coinductive proof over S of e 1 " e 2 .
By a LLEE-witnessed coinductive proof over S we mean a coinductive proof CP " xC, Ly where C is a guarded LLEE-1-chart. We denote by e 1 LLEE """ S e 2 that there is a LLEE-witnessed coinductive proof over S of e 1 " e 2 .
While the restriction to guardedness of the LLEE-1-chart underlying LLEE-witnessed coinductive proofs could be relaxed to weak guardedness, we have required guardedness in this definition in order to (somewhat) reduce technicalities in the proofs in Section 6.
We provide two examples of LLEE-witnessed coinductive proofs. First we develop a new one, and then we revisit and justify the example in Figure 1 from the introduction.
Example 5.2. In Figure 9 we have illustrated a LLEE-witnessed coinductive proof over Miló f the statement pa˚¨b˚q˚L LEE """ Mil´p a`bq˚. Formally this proof is of the form CP " xC, Ly where C " Cppa˚¨b˚q˚q has the guarded LLEE-witnessĈppa˚¨b˚q˚q (see Theorem 4.18) as indicated in Figure 9 where framed boxes contain vertex names.
In this illustration we have drawn the 1-chart C that carries the equations with its start vertex below in order to adhere to the prooftree intuition for the represented derivation, namely with the conclusion at the bottom. We will do so repeatedly also below. Solution correctness for the left-hand sides L 1 of the equations L on C in Figure 9 follow from Lemma 4.21, because C " Cppa˚¨b˚q˚q where pa˚¨b˚q˚is the left-hand side of the conclusion. This notwithstanding, below we verify the correctness conditions in C for the left-hand side L 1 and the right-hand side L 2 of the equation labeling function L for the (most involved) case of vertex v 1 as follows (we neglect some associative brackets, and combine some applications of axioms in Mil´): Mil´p 1`a¨a˚`a¨a˚¨b¨b˚`b¨b˚q¨pa˚¨b˚q" Mil´p 1`a¨a˚¨p1`b¨b˚q`b¨b˚q¨pa˚¨b˚q" Mil´p 1`a¨a˚¨b˚`b¨b˚q¨pa˚¨b˚q" Mil´1¨p a˚¨b˚q˚`a¨ppp1¨a˚q¨b˚q¨pa˚¨b˚q˚q`b¨pp1¨b˚q¨pa˚¨b˚q˚q " 1¨L 1 pv s q`a¨L 1 pv 11 q`b¨L 1 pv 21 q L 2 pv 1 q " pa`bq" Mil´p a`bq˚`pa`bq˚" Mil´1`p a`bq¨pa`bq˚`1`pa`bq¨pa`bq" Mil´1`1`p a`bq¨pa`bq˚`a¨pa`bq˚`b¨pa`bq" Mil´1`p a`bq¨pa`bq˚`a¨p1¨pa`bq˚q`b¨p1¨pa`bq˚q " Mil´1¨p a`bq˚`a¨p1¨pa`bq˚q`b¨p1¨pa`bq˚q " 1¨L 2 pv s q`a¨L 2 pv 11 q`b¨L 2 pv 21 q Note that the form of these two correctness conditions at v 1 arise from the outgoing transitions from v 1 in C in Figure 9: the 1-transition from v 1 to v s , the a-transition from v 1 to v 11 , and the b-transition from v 1 to v 21 . The solution conditions for L " xL 1 , L 2 y at the vertices v and v 2 can be verified analogously. At v 11 and at v 21 the solution conditions follow by using the axiom id l p¨q of Mil´.
Example 5.3. For the statement g˚¨0 " pa`bq˚¨0 LLEE """ Mil´p a¨pa`bq`bq˚¨0 " h˚¨0, we illustrated in Figure 2 the coinductive proof CP " xCph˚¨0q, Ly over Mil´with underlying guarded LLEE-witnessĈph˚¨0q, where Cph˚¨0q andĈph˚¨0q is the 1-chart interpretation as defined according to Definition 4.15, and the equation-labeling function L on Cph˚¨0q is defined as in the figure.
The correctness conditions at the start vertex (at the bottom) can be verified as follows: h˚¨0 " pa¨pa`bq`bq˚¨0 " Mil´p 1`pa¨pa`bq`bq¨pa¨pa`bq`bq˚q¨0 " Mil´1¨0`p pa¨pa`bq`bq¨h˚q¨0 " Mil´0`p pa¨pa`bqq¨h˚`b¨h˚q¨0 " Mil´p a¨ppa`bq¨h˚q`b¨h˚q¨0 " Mil´p pa¨ppa`bq¨h˚qq¨0`pb¨h˚q¨0 " Mil´a¨p pa`bq¨h˚q¨0q`b¨ph˚¨0q " Mil´a¨p p1¨pa`bqq¨h˚q¨0q`b¨pp1¨h˚q¨0q . condition for pp1¨pa`bqq¨h˚q¨0 at the left upper vertex of Cph˚¨0q can be verified as follows: Finally, the correctness conditions at the right upper vertex of Cph˚¨0q can be obtained by applications of the axiom (id l p¨q) only.
As a direct consequence of Definition 5.1, the following lemma states that LLEE-witnessed coinductive provability of an equation implies its coinductive provability. The subsequent lemma states easy observations about the composition of coinductive provability over a proof system S with provability " S in S.
Lemma 5.4. e 1 LLEE """ S e 2 implies e 1 coind """ S e 2 , for all e 1 , e 2 P StExppAq, where S is an EL-based proof system over StExppAq with ACI Ď S that is sound with respect to " ¨ P .
Lemma 5.5. Let R P ␣ coind """ S , LLEE """ S ( for some EL-based proof system S with ACI Ď S. Then R is reflexive, symmetric, and satisfies " S˝R Ď R, R˝" S Ď R, and " S Ď R.
The proposition below, and the subsequent remark are evidence for the fact, mentioned at the start of this section, that coinductive proofs over proof systems that are sound with respect to " ¨ P derive semantically valid conclusions themselves. Rather than formulating their statements for all semantically sound proof systems, we restrict our attention to systems that are theorem-subsumed by Mil.
Proposition 5.6. Let S be an EL-based proof system over StExppAq with ACI Ď S À Mil. Then for all e 1 , e 2 P StExppAq it holds: e 1 coind """ S e 2 ùñ Cpe 1 q Ø Cpe 2 q , (5.1) That is, if there is a coinductive proof over S of e 1 " e 2 , then the chart interpretations of e 1 and e 2 are bisimilar.
Proof. We have illustrated the proof of this proposition in Figure 10: In every coinductive proof xC, Ly over S with S À Mil of an equation e 1 " e 2 , the star-expression functions L 1 and L 2 are Mil-provable solutions of C. Then by using Proposition 3.8 and Lemma 3.5 we get the link of functional (1-)bisimulations between Cpe 1 q and Cpe 2 q as drawn in that picture. Since (functional) bisimulations compose with (functional) 1-bisimulations to 1-bisimulations, and 1-bisimulations between charts are bisimulations, we obtain that Cpe 1 q Ø Cpe 2 q holds, and consequently, that e 1 " ¨ P e 2 holds. Remark 5.7. For every coinductive proof CP " xC, Ly, whether CP is LLEE-witnessed or not, over an EL-based proof system S with ACI Ď S À Mil the finite relation defined by: is a 1-bisimulation up to " S with respect to the labeled transition system on all star expressions that is defined by the TSS in Definition 2.3. This can be shown by using that the left-hand sides L 1 pvq, and respectively the right-hand sides L 2 pvq, of the equations Lpvq in CP, for v P V pCq, form S-provable solutions of the 1-chart C that underlies CP.
We now define two proof systems CLC and CC for combining LLEE-witnessed coinductive provability. Each of these systems consists of a single rule scheme, a more specific one for CLC, and a more liberal one for CC. Instances of rules of these two schemes formalize LLEE-witnessed coinductive provability in CLC, and respectively coinductive provability in CC, of equations between star expressions from assumed equations. Different from the exposition in [Gra21a,Gra21b], where we permitted entire coinductive proofs as formulas and as premises of rules, we here keep the proof systems EqpAq-based by externalizing coinductive proofs from the rules by 'hiding' them in side-conditions. 2 The more restricted proof system CLC will form the core of our coinductive reformulation of Milner's system.
Definition 5.8 (proof systems CLC, CC for combining (LLEE-witn.) coinductive provability). Let A be a set of actions. We define EqpAq-based proof systems CLCpAq and CCpAq.
The proof system CLCpAq for combining LLEE-witnessed coinductive provability (over extensions of Mil´pAq) of equations between star expressions over A is an EqpAq-based proof system without axioms, but with the rules of the scheme: g 1 " h 1 . . . g n " h n LCoProof n (if (5.3) holds) e " f (5.2) e LLEE """ Mil´`Γ f for Γ " tg 1 " h 1 , . . . , g n " h n u with n P N (including n " 0). (5. 3) The proof system CCpAq for combining coinductive provability (over extensions of Mil´pAq) is an EqpAq-based proof system without axioms, but with the rules of the scheme: g 1 " h 1 . . . g n " h n CoProof n (if (5.4) holds) e " f e coind """ Mil´`Γ f for Γ " tg 1 " h 1 , . . . , g n " h n u with n P N (including n " 0). (5.4) We will keep the set A implicit, and write CLC and CC for CLCpAq and CCpAq, respectively.
Note that the systems CLC and CC do not contain the rules of EL nor any axioms. Instead, derivations in these systems have to start with 0-premise instances of LCoProof 0 or CoProof 0 . Due to Lemma 5.4 every instance of the rule LCoProof n of CLC for some n P N is also an instance of the rule CoProof n of CC. It follows that derivability of an equation e " f in CLC implies derivability of e " f in CC, that is, CLC À CC holds, see Lemma 5.11, (i), below.
Based on CLC, we now define the system that we call the coinductive variant cMil of Milner's proof system Mil. For this, we replace the fixed-point rule in Mil by the rule scheme Definition 5.9 (proof systems cMil, cMil 1 , and cMil). Let A be a set of actions.
The proof system cMilpAq, the coinductive variant of MilpAq, is an EL-based proof system whose axioms are those of Mil´pAq, and whose rules are those of ELpAq, plus the rule scheme tLCoProof n u nPN from CLCpAq. By cMil 1 pAq we mean the simple coinductive variant of MilpAq, an EL-based proof system that arises by only adding the rule LCoProof 1 of CLCpAq to the rules and axioms of Mil´pAq.
By cMilpAq we mean the variant of cMilpAq in which the more general rule scheme tCoProof n u nPN from CCpAq is used (instead of tLCoProof n u nPN from CLCpAq).
We now prove a lemma (Lemma 5.11 below) that gathers elementary theorem equivalence and theorem subsumption statements between the coinductive variants of Milner's system defined above. For its proof we argue with subsystem relationships as gathered by Lemma 5.10 below, and we explain basic proof transformations between these systems.
Proof. We have argued for statement (i) above, below Definition 5.8: every instance of the rule LCoProof n of CLC, for n P N, is also an instance of the rule CoProof n of CC. This also implies the part cMil À cMil of statement (ii), because it shows in every derivation D of an equation e " f in cMil every instance of LCoProof n , for n P N, can be replaced by an instance of CoProof n with as result a derivation D 1 of e " f in cMil. The part cMil 1 À cMil of statement (ii) follows from the fact that cMil 1 is a subsystem of cMil by Lemma 5.10, (ii). For statement (iii), the theorem-subsumption part CLC À cMil follows from CLC Ď cMil, see Lemma 5.10, (i). For showing the converse implication, CLC Á cMil, we will demonstrate the proof-transformation statement (5.5) below by first showing its special case (5.6): Every derivation D in cMil can be transformed into a derivation D 1 in CLC with the same conclusion.

)
(5.5) The transformation statement (5.5) holds for every derivation D in cMil with an instance of LCoProof n , for some n P N, at the bottom.

* (5.6)
The idea for both of these proof transformation statements is to 'hide' derivation parts that consist of axioms and rules in Mil´into the correctness statements of coinductive proofs that appear as side-conditions in instances of the coinductive rule in CLC. More precisely, the idea is to replace derivation parts D 0 in Mil´of a derivation D in cMil, where D 0 consists of the inference in Mil´of an equation g " h from a set Γ of m assumption equations, by an instance of the coinductive rule LCoProof m that has the m assumptions of D 0 in Γ as its premises. Then whenever g " h is needed to justify a correctness conditions it can be reconstructed from the premises, provably in Mil´, on the basis of the derivation D 0 in Mil´. We start by showing (5.6), and proceed for this purpose by induction on the depth |D| of D. Suppose that D is a derivation in cMil with an occurrence of an instance ι of LCoProof n at the bottom. To perform the induction step for D, we need to transform D into a derivation D 1 in CLC with the same conclusion. We may assume that the immediate subderivations D 1 , . . . , D n of D (just above the instance ι) contain axioms and/or rules of Mil´, because otherwise D is already a derivation in CLC. To keep the illustration of the transformation step simple, we assume that only the i-th subderivation D i contains axioms and/or rules of Mil; the general case will become clear through this example. We assume that D is of the form: with side-condition e LLEE """ Mil´`Γ f for Γ " tg 1 " h 1 , . . . g n " h n u , (5.8) where D 1 , . . . , D i´1 , D i`1 , . . . D n are already derivations in CLC (with bottommost instances of LCoProof n i that are suggested by dashed lines), but D i contains axioms and/or rule instances of Mil´, and can be construed with a bottom part D i0 in Mil´below m conclusions g i1 " h i1 , . . . , g im " h im of instances of coinductive rules from tLCoProof j u jPN . Then we apply the induction hypothesis to the subderivations D i1 , . . . , D im of D 0 , which is possible due to |D i1 | , . . . , |D im | ă |D i | ă |D|, to obtain derivations D 1 i1 , . . . , D 1 im in CLC with the same conclusions g i1 " h i1 , . . . , g im " h im , respectively. Then we transform D by replacing the instance of LCoProof n at the bottom by an instance of LCoProof n`m´1 , keeping the first i´1 and the last n`1´i premises and their subderivations, but replacing the i-th premise and its immediate subderivation D i by m additional premises with immediate subderivations D 1 i1 , . . . , D 1 im , thereby obtaining: However, we need to show the side-condition for the displayed instance of LCoProof n`m´1 : the set of conclusions of D 1 i1 , . . . , D 1 im .
(5.10) Now due to (5.8) there is a LLEE-witnessed coinductive proof LCP of e " f over Mil´`Γ. But now LCP is also a LLEE-witnessed coinductive proof of e " f over Mil´`Γ 1 , and thus over a different set of premises, which we recognize as follows. The equations in ∆, which have been added to Γ in order to get Γ 1 after removing g i " h i , are derivable in Mil´`Γ by means for the derivation D 0 . Therefore the correctness conditions for LCP as a LLEE-witnessed coinductive proof over Mil´`Γ imply the correctness conditions for LCP as a LLEE-witnessed coinductive proof over Mil´`Γ 1 . This shows (5.10). Therefore the resulting derivation D 1 in (5.9) is a derivation in CLC with the same conclusion as D. (This transformation step can obviously be generalized to the situation in which not just D i , but also others among the immediate subderivations D 1 , . . . , D n of D contain axioms and/or rules of Mil´.) In this way we have performed the induction step. Finally we establish (5.5) in full generality. For this we consider the remaining situation in which the derivation D in cMil does not terminate with an instance of a coinductive rule. Then D can be construed with a part derivation D 0 in Mil´above its conclusion, and below m P N subderivations D 1 , . . . , D m , each of which terminates with a coinductive rule (see below on the left). Note that m " 0 is possible if D is a derivation in Mil´. By applying (5.6) to D 1 , . . . , D m we obtain derivations D 1 1 , . . . , D 1 m in CLC with the same conclusions, respectively. By combining these derivations in CLC with an instance of LCoProof m we can perform the following transformation step in order to obtain a derivation D 1 in CLC :  Here we need to establish the following side-condition for the instance of LCoProof m at the bottom of D 1 : e LLEE """ Mil´`Γ f where Γ :" te 1 " f 1 , . . . , e m " f m u .
(5.12) We can establish this coinductive-provability statement by recognizing that xCpeq, Ly with Cpeq the 1-chart interpretation of e, and with equation labeling function: is a LLEE-witnessed coinductive proof over Mil´`Γ of e " f . To verify this statement, we use that Cpeq is a guarded LLEE-1-chart by Theorem 4.18, (i), and we have to check the correctness conditions for L 1 and L 2 with L " xL 1 , L 2 y to be Mil´`Γ-provable solutions of Cpeq. We first note that e " f is provable in Mil´`Γ (i.e. e " Mil´`Γ f ) since D 0 is a derivation of e " f in Mil´from the assumptions in Γ. Then we argue as follows: ‚ The correctness conditions for L 1 to be a pMil´`Γq-provable solution of Cpeq follow from the fact that L 1 is a Mil´-provable solution of Cpeq due to Lemma 4.21. ‚ L 2 differs from L 1 only in the value for the start vertex e, where L 2 peq " f , but L 1 peq " e.
From this it follows, in view of e " Mil´`Γ f , that the correctness conditions for L 1 imply the correctness conditions for L 2 , because they differ only up to expressions that are provably equal in Mil´`Γ and also need to hold up to pMil´`Γq-provability. This argument shows (5.12), which justifies the side-condition of the instance of LCoProof m at the bottom of the derivation D 1 on the right in (5.11). Therefore we have indeed obtained from D a derivation in CLC with the same conclusion as D. In this way we have completed the proof of cMil À CLC, the remaining part of (iii). Statement (iv) can be shown entirely analogously as statement (iii). It follows that e " f is provable in CC, and in cMil. Now since the correctness conditions for the Mil´-provable solutions L 1 and L 2 of C at each of the vertices of C together form a guarded system of linear equations to which the rule USP can be applied (as C is 1-free), we obtain that e " f is also provable in Mil 1 .

From LLEE-witnessed coinductive proofs to Milner's system
In this Section we develop a proof-theoretic interpretation of the coinductive variant system cMil of Mil in Milner's original system Mil. Since cMil and Mil differ only by the coinductive rule scheme tLCoProof n u nPN (which is part of cMil, but not of Mil), and by the fixed-point rule RSP˚(which is part of Mil, but not of cMil), the crucial step for this proof transformation is to show that instances of LCoProof n , for n P N, can be mimicked in Mil if their premise equations are derivable in Mil. We will do so by showing that the rules LCoProof n , for n P N, are correct for Mil. This implies that these rules are admissible in Mil (by Lemma 2.10), and also, that they can be eliminated from derivations in Mil`tLCoProof n u nPN , which is an extension of cMil. In this way we obtain the proof-theoretic interpretation of cMil in Mil.
For proving correctness of LCoProof n for Mil, where n P N, we will show that every LLEE-witnessed coinductive proof xC, Ly over a proof system S that is theorem-subsumed by Mil of an equation e 1 " e 2 can also be established by a proof of e 1 " e 2 in Milner's system Mil. Informally, this statement is illustrated in Figure 11 by informally employing the characterization in Proposition 3.8 of the provable solutions in such LLEE-witnessed coinductive proofs. We establish the indicated informal second step in this section, where it will be guaranteed by Proposition 6.8. In particular, our proof of this step will use the following two statements: (SE) (solution extraction) from a LLEE-witnessĈ of C a Mil-provable solution s C of C can be extracted (Lemma 6.4), and (SU) (solution uniqueness) every Mil-provable solution of the LLEE-1-chart C (such as L 1 and L 2 ) is Mil-provably equal to the solution s C extracted fromĈ (Lemma 6.7). By these statements we will obtain for every LLEE-witnessed coinductive proof xC, Ly of e 1 " e 2 , assuming that v s is the star vertex of C and hence L 1 pv s q " e 1 as well as L 2 pv s q " e 2 hold, that e 1 " L 1 pv s q " Mil sĈpv s q " Mil L 2 pv s q " e 2 holds, and therefore e 1 " Mil e 2 .
The proofs of the statements (SE) and (SU) below are adaptations to LLEE-1-charts of proofs of analogous statements for LLEE-charts in Section 5 of [GF20a,GF20b]. We have to, at places substantially, refine the extraction technique of star expressions from 17:34

C. Grabmayer
Vol. 19:2 process graphs with LLEE that was first described in [GF20a,GF20b]. However, we will use the simplification to only reason about guarded LLEE-witnesses, in which loop-entry transition are proper transitions. We can do so because the 1-chart interpretation Cpeq of a star expression e is guaranteed to have a guarded LLEE-witnessĈpeq by Theorem 4.18. For developing and proving the extraction statement (SE) we use that the hierarchical loop structure of a 1-chart C with LLEE-witnessĈ facilitates the extraction of a Mil´-provable solution of C (see Lemma 6.4). The reason is as follows. The process behavior at every vertex w in C can be split into an iteration part that is induced via the loop-entry transitions from w inĈ (which induce loop sub-1-charts with inner loop sub-1-charts whose behavior can be synthesized recursively), and an exit part that is induced via the body transitions from w in C. This intuition leads us to the definition below. We define the 'extraction function' sĈ ofĈ from a 'relative extraction function' tĈ ofĈ, whose values tĈpw, vq capture the behavior at w in a loop sub-1-chart at v until v is reached.
The extraction function sĈ : V Ñ StExppAq ofĈ is defined from the relative extraction function tĈ : txw, vy | w, v P V pCq, w ð " vu Ñ StExppAq ofĈ for w, v P V : where ă lex is a well-founded strict partial order due to Lemma 4.13. The choice of the list representations of action-target sets ofĈ changes the definitions of these functions only up to provability in ACI.
We exemplify the extraction process defined above by a concrete example.
Example 6.2. We consider the 1-chart C, and the LLEE-witnessĈ of C, in the LLEE-witnessed coinductive proof CP " xC, Ly of pa˚¨b˚q˚" pa`bq˚in Example 5.2. We detail in Figure 12 the process of computing the principal value sĈpv s q of the extraction function sĈ ofĈ. The statement of Lemma 6.4 below will guarantee that sĈ is a Mil´-provable solution of C.
In order to show that the extraction function of a guarded LLEE-witness of a 1-chart C defines a Mil´-provable solution of C, see Lemma 6.4 and its proof later, we first have to establish a Mil´-provable connection between the relative extraction function and the extraction function of a guarded LLEE-witness. For this we prove the following lemma. Lemma 6.3. Let C be a (guarded) LLEE-1-chart with guarded LLEE-witnessĈ. Then sĈpwq " Mil´tĈ pw, vq¨sĈpvq holds for all vertices w, v P V pCq such that w ð " v.
0˚¨p1¨tĈpv 1 , v s qq " Mil´a˚¨bsĈ pv s q :" pa¨tĈpv 11 , v s q`b¨tĈpv 21 , v s qq˚¨1 " Mil´p a¨pa˚¨b˚q`b¨b˚qF igure 12: Extraction of the principal value of a Mil´-provable solution sĈ from the LLEE-wit-nessĈ in the coinductive proof in Example 5.2, with Mil´-provable simplifications.
We have to show that spwq " Mil´tĈ pw, vq¨spvq holds for all w, v P V with w ð " v. We first notice that this statement holds obviously for w " v, due tĈpw, vq " tĈpv, vq " 1, and the presence of the axiom pid l p¨qq in Mil´. Therefore it suffices to show, by also using this fact, that spwq " Mil´tĈ pw, vq¨spvq holds for all w, v P V with w ð v. We will show this by using the same induction as for the definition of the relative extraction function tĈ in Definition 6.1, that is, by complete induction on the (converse) lexicographic partial order ă lex of ð`and Ðb o on VˆV defined by: xw 1 , v 1 y ă lex xw 2 , v 2 y : ðñ v 1 ð`v 2 _ p v 1 " v 2^w1 Ðb o w 2 q, which is well-founded by Lemma 4.13. For our argument we assume to have given, underlying the definition of the relative extraction function tĈ and the extraction function sĈ, list representations TĈpwq of the transitions from w inĈ as in Definition 6.1, for all w P V .
In order to carry out the induction step, we let w, v P V be arbitrary, but such that w ð v. On the basis of the form of TĈpwq as in Definition 6.1 we argue as follows, starting with a step in which we use the definition of sĈ, and followed by a second step in which we use that τ C pwq " 0 holds, because w cannot have immediate termination as due to w ð v it is in the body of the loop at v (cf. condition (L3) for loop 1-charts in Section 4): we can apply the induction hypothesis to sĈpu i q, as w Ñ bo u i (see TĈpwq as in Def. 6.1) and u i ‰ v imply u i ð v, and u i Ð bo w entails xu i , vy ă lex xw, vy) We note that this reasoning also applies for the special cases n " 0, and with a slight change also for m " 0, where ř m i"1 b i¨tĈ pu i , vq " 0, and then an axiom (deadlock) has to be used. In this way we have shown, due to ACI Ď Mil´, the desired Mil´-provable equality spwq " Mil´tĈ pw, vq¨spvq for the vertices v and w that we picked with the property w ð v.
Since w, v P V with w ð v were arbitrary above, we have successfully carried out the proof by induction that sĈpwq " Mil´tĈ pw, vq¨s C pvq holds for all w, v P V with w ð v. As we have argued that the statement also holds for w " v, we have proved the lemma.
Lemma 6.4 (extracted function is provable solution). Let C be a LLEE-1-chart with guarded LLEE-witnessĈ. Then the extraction function sĈ ofĈ is a Mil´-provable solution of C.
We show that the extraction function sĈ ofĈ is a Mil´-provable solution of C by verifying the Mil´-provable correctness conditions for sĈ at every vertex w P V . For the argument we assume to have given, underlying the definition of the relative extraction function tĈ and the extraction function sĈ, list representations TĈpwq of the transitions from w inĈ as written in Definition 6.1, for all vertices w P V .
We let w P V be arbitrary. Starting from the definition of sĈ in Definition 6.1 on the basis of the form of TĈpwq, we argue by the following steps: by axioms pr-distrp`,¨qq, pid l p¨qq, and passocp¨qq) "´´m (by definition of sĈpwq in Def. 6.1) by axioms pcommp`qq, pr-distrp`,¨qq, and passocp¨qq) (by Lemma 6.3, due to w i ð " w, which follows from w Ñ rl i s w i (see TĈpwq as in Def. 6.1), and by axioms passocp`qq ).
Since ACI Ď Mil´, this chain of equalities yields a Mil´-provable equality that establishes, in view of TĈpwq as in Definition 6.1, the correctness condition for sĈ to be a Mil´-provable solution at the vertex w that we picked. Since w P V was arbitrary, we have established that the extraction function sĈ ofĈ is a Mil´-provable solution of C.
For showing the solution uniqueness statement (SU) we can also use the hierarchical loop structure of a 1-chart C with LLEE-witnessĈ for carrying out proofs by induction. We repurpose the two-step approach of the proof of Lemma 6.4 that used the Mil-provable relationship between the extraction function sĈ ofĈ and the relative extraction function tĈ ofĈ in Lemma 6.3. In doing so we first establish, for every Mil-provable solution s of C, a connection with the relative extraction function t C ofĈ, see Lemma 6.5 below. The proof of this lemma proceeds by an induction that starts at innermost loop sub-1-charts of the given LLEE-witness, and then progresses to outer loop sub-1-charts. Different from Lemma 6.3, it will be crucial here to employ the fixed-point rule RSP˚of Mil in the proof.
Lemma 6.5. Let C be a LLEE-1-chart with guarded LLEE-witnessĈ. Furthermore, let S be an ELpAq-based proof system such that ACI Ď S À Mil.
Let s : V pCq Ñ StExppAq be an S-provable solution of C. Then spwq " Mil tĈpw, vq¨spvq holds for all vertices w, v P V pCq with w ð " v.
We have to show that spwq " Mil tĈpw, vq¨spvq holds for all w, v P V with w ð " v. We first notice that this statement holds obviously for w " v, due tĈpw, vq " tĈpv, vq " 1. Therefore it suffices to show, by also using this fact, that spwq " Mil tĈpw, vq¨spvq holds for all w, v P V with w ð v. We will show this by using the same induction as for the definition of the relative extraction function in Definition 6.1, that is, by complete induction on the (converse) lexicographic partial order ă lex of ð`and Ðb o on VˆV defined by: Ðb o w 2 q, which is well-founded due to Lemma 4.13. For our argument we suppose to have given, underlying the definition of the relative extraction function tĈ and the extraction function sĈ, list representations TĈpwq of the transitions from w inĈ as written in Definition 6.1, for all w P V .
In order to carry out the induction step, we let w, v P V be arbitrary such that w ð v. On the basis of the form of TĈpwq as in Definition 6.1 we argue as follows, starting with a step in which we use that s is an S-provable solution of C, and followed by a second step in which we use that τ C pwq " 0 holds, because w cannot have immediate termination as due to w ð v it is in the body of the loop at v (see condition (L3) for loop 1-charts in Section 4): f w i " w, then spw i q " Mil tĈpw i , wq¨spwqq due to tĈpw, wq " 1; if w i ‰ w, we can apply the induction hypothesis to spw i q, because then w Ñ rl i s w i (see TĈpwq as in Def. 6.1) implies w i ð w, and due to w ð v we get xw i , wy ă lex xw, vy) f u i " v, then spu i q " Mil tĈpu i , vq¨spvqq due to tĈpv, vq " 1; if u i ‰ v, we can apply the induction hypothesis to spu i q, as w Ñ bo u i (see TĈpwq as in Def. 6.1) and u i ‰ v imply u i ð v, and u i Ð bo w entails xu i , vy ă lex xw, vy) (by axioms passocp¨qq, and pr-distrp`,¨qq).
We note that these equalities also hold for the special cases in which n " 0 or/and m " 0, where in the case m " 0 an axiom (deadlock) needs to be used in the last step. Since ACI Ď S À Mil, and Mil´Ď Mil, we have obtained the following provable equality: Since`ř n i"1 a i¨tĈ pw i , wq˘Ú holds, we can apply RSP˚in order to obtain, and reason further: (by w ð v, and the definition of tĈpw, vq in Def. 6.1) In this way we have shown, due to Mil´Ď Mil, the desired Mil-provable equality spwq " Mil tĈpw, vq¨spvq for the vertices v and w that we picked with the property w ð v.
Since w, v P V with w ð v were arbitrary for this argument, we have successfully carried out the proof by induction spwq " Mil tĈpw, vq¨spvq holds for all w, v P V with w ð v. As we have argued that the statement also holds for w " v, we have proved the lemma.
Definition 6.6. For an EqpAq-based proof system S we say that two star expression functions s 1 , s 2 : V Ñ StExppAq are S-provably equal if s 1 pvq " S s 2 pvq holds for all v P V . Now we use the relationship of arbitrary Mil-provable solutions of a guarded LLEE-wit-nessĈ with the relative extraction function sĈ ofĈ as stated by Lemma 4.13 in order to demonstrate the solution uniqueness statement (SU). The proof can be viewed as proceeding on the maximal length of body transition paths from vertices v, where for descents from v via a loop-entry transition into an inner loop the statement of Lemma 6.5 is used. Again the use of the fixed-point rule RSP˚of Mil´is crucial, because any two Mil´-provable solutions of a guarded LLEE-1-chart cannot be expected to be Mil´-provably equal in general. 3 Lemma 6.7 (provable equality of solutions of LLEE-1-charts). Let C be a guarded LLEE-1-chart, and let S be an EL-based proof system over StExppAq such that ACI Ď S À Mil.
Then any two S-provable solutions of C are Mil-provably equal.
Proof. Let C " xV, A, 1, v s , Ñ, Óy be a LLEE-1-chart with guarded LLEE-witnessĈ, and let S an EL-based proof system as assumed in the lemma. In order to show that any two S-provable solutions of C are Mil-provably equal, it suffices to show that every S-provable solution of C is Mil-provably equal to the extraction function sĈ ofĈ. For demonstrating this, let s : V Ñ StExppAq be an S-provable solution of C. We have to show that spwq " Mil sĈpwq holds for all w P V . We proceed by complete induction on the well-founded relation Ðb o (see Lemma 4.13, (ii)), which does not require us to treat base cases separately. For our argument we assume to have given, underlying the definition of the relative extraction function tĈ and the extraction function s C , list representations TĈpwq of the transitions from w inĈ as written in Definition 6.1, for all w P V .
Let w P V be arbitrary. On the basis of TĈpwq as in Definition 6.1 we argue as follows, starting with a step in which we use that s is an S-provable solution of C in view of the 3 As a simple example, the use of RSP˚is necessary for proving equal in Mil the two Mil´-provable solutions of the guarded LLEE -1-chart Cppa¨aq˚¨0q with the principal values a˚¨0 and pa¨aq˚¨0, respectively. spwq " S τ C pwq`´´n w Ñ rl i s w i (due to TĈpwq as in Definition 6.1) implies w i ð " w, from which Lemma 6.5 yields spw i q " Mil tĈpw i , wq¨spwq ) by axioms passocp¨qq and pr-distrp`,¨qq) due to w Ñ bo u i (see TĈpwq as in Definition 6.1), and hence u i Ð bo w, spu i q " Mil sĈpu i q follows from the induction hypothesis).
Since ACI Ď S À Mil, and Mil´Ď Mil, we have obtained the following provable equality: ow since`ř n i"1 a i¨tĈ pw i , wq˘Ú holds, we can apply the rule RSP˚to this in order to obtain: sĈpwq (by the definition of sĈ in Definition 6.1) Thus we have verified the proof obligation spwq " Mil sĈpwq for the induction step, for the vertex w as picked. By having performed the induction step, we have successfully carried out the proof by complete induction on Ð bo that spwq " Mil sĈpwq holds for all w P V , and for an arbitrary S-provable solution s of C. This implies the statement of the lemma, that any two S-provable solutions of C are Mil-provably equal.
Proposition 6.8. For every EL-based proof system S over StExppAq with ACI Ď S À Mil, provability by LLEE-witnessed coinductive proofs over S implies derivability in Mil: Proof. For showing (6.1), let e, f P StExppAq be such that e LLEE """ S f . Then there is a LLEE-witnessed coinductive proof LCP " xC, Ly of e 1 " e 2 over S, which consists of a guarded LLEE-1-chart C and S-provable solutions L 1 , L 2 : V pCq Ñ StExppAq of C with e 1 " L 1 pv s q and e 2 " L 2 pv s q. By applying Lemma 6.7 to LCP we find that L 1 and L 2 are Mil-provably equal. This entails e 1 " L 1 pv s q " Mil L 2 pv s q " e 2 , and thus e 1 " Mil e 2 .
Mil´m eans use of 'is Mil´-provable solution') L i pv 2 q " (sol) Mil´b¨L i pv 21 q`1¨L i pv s q " Mil´b¨L i pv 2 q`L i pv s q ó applying RSPL i pv 2 q " Mil b˚¨L i pv s q L i pv 11 q " (sol) Mil´1¨L i pv 1 q " Mil´L i pv 1 q L i pv 1 q " Mil´a¨L i pv 11 q`b¨L i pv 21 q`1¨L i pv s q " Mil a¨L i pv 1 q`pb¨b˚`1q¨L i pv s q " Mil´a¨L i pv 1 q`b˚¨L i pv s q ó applying RSPL i pv 1 q " Mil a˚¨pb˚¨L i pv s qq " Mil´p a˚¨b˚q¨L i pv s q L i pv s q " Mil´1`a¨L i pv 11 q`b¨L i pv 21 q " Mil´1`a¨L i pv 1 q`b¨L i pv 2 q " Mil pa¨pa˚¨b˚q`b¨b˚q¨L i pv s q`1 ó applying RSPL i pv s q " Mil pa¨pa˚¨b˚q`b¨b˚q˚¨1 " Mil´p a¨pa˚¨b˚q`b¨b˚q˚" Mil´sĈ pv s q Figure 13: Showing for the coinductive proof xC, Ly in Example 5.2 that the principal value L i pv s q of the Mil´-provable solution L i for i P t1, 2u is Mil-provably equal to the principal value sĈpv s q of the solution sĈ extracted the underlying LLEE-witnessĈ.
Example 6.9. We consider again the LLEE-witnessed coinductive proof CP " xC, Ly of pa˚¨b˚q˚" pa`bq˚in Example 5.2. In Figure 13 we exhibit the extraction process of derivations in Mil of L 1 pv s q " s C pvq and L 2 pv s q " s C pvq from the guarded LLEE-witnessĈ of C. These two derivations in Mil can be combined by using EL rules in order to obtain a derivation in Mil of pa˚¨b˚q˚" L 1 pv s q " L 2 pv s q " pa`bq˚.
Lemma 6.10. The rules LCoProof n are correct for Mil, for all n P N. This statement also holds effectively: Every derivation D in Mil`LCoProof n that consists of a bottommost instance of LCoProof n , where n P N, whose immediate subderivations are derivations in Mil can be transformed effectively into a derivation D 1 in Mil that has the same conclusion as D.
Proof. We let n P N. In order to show correctness of the rule LCoProof n for Mil, we consider a derivation D in Mil`LCoProof n that has immediate subderivations D 1 , . . . , D n in Mil, and that terminates with an instance ι of LCoProof n , where Γ :" tg 1 " h 1 , . . . , g 1 " h 1 u : LCoProof n e " f and e LLEE """ Mil´`Γ f holds as side-condition on the instance ι of LCoProof n . Then there is a LLEE-witnessed coinductive proof LCP " xC, Ly of e " f over Mil´`Γ. We have to show that there is a derivation D 1 in Mil with the same conclusion e " f .
Since D 1 , . . . , D n are derivations in Mil, their conclusions in Γ are derivable in Mil. This implies Mil`Γ À Mil. It follows that LCP is also a LLEE-witnessed coinductive proof of 17:42

C. Grabmayer
Vol. 19:2 e " f over Mil, that is, it holds: e LLEE """ Mil f . From this we obtain e " Mil f by applying Proposition 6.8, which guarantees a derivation D 1 in Mil with conclusion e " f as desired. The proof of Proposition 6.8 furthermore guarantees that such a derivation D 1 in Mil can be constructed effectively from the coinductive proof of e " f over Mil´`Γ (and hence over Mil) and the derivations D 1 , . . . , D n in Mil.
Theorem 6.11. cMil À Mil. Moreover, every derivation in cMil with conclusion e " f can be transformed effectively into a derivation in Mil that has the same conclusion.
Proof. Due to Lemma 6.10, every rule LCoProof n , for n P N, is correct for Mil. Then by using Lemma 2.10, (i), we find that each of these rules are admissible in Mil. This means that Mil`LCoProof n " Mil holds for all n P N, which implies, with an argument by induction on the prooftree size of derivations in Mil`tLCoProof n u nPN , that Mil`tLCoProof n u nPN " Mil holds as well. With this statement we can now argue as follows: cMil " Mil´`tLCoProof n u nPN (by Definition 5.9) Ď pMil´`tLCoProof n u nPN q`RSP˚(by extension via adding the rule RSP˚) " pMil´`RSP˚q`tLCoProof n u nPN (by construing the same system differently) " Mil`tLCoProof n u nPN (by Definition 2.11) " Mil (as argued above) .
From this we obtain cMil À Mil in view of pĎ¨"q Ď pÀ¨"q Ď À. For demonstrating the effective transformation statement of the theorem we use the transformation from the proof of the implication "ð" in Lemma 2.10, (i), which states that correct rules are also admissible. We have to show that every derivation D in cMil can be transformed effectively into a derivation D 1 in Mil with the same conclusion. In order to establish this statement by induction we prove it for all derivations D in the extension cMil`RSP˚" Mil´`tLCoProof n u nPN`R SP˚" Mil`tLCoProof n u nPN of cMil.
We proceed by induction on the number of instances of rules LCoProof n , for n P N, in D. Let D be a derivation Mil´`tLCoProof n u nPN`R SP˚. If D does not contain an instance of LCoProof n with n P N, then D is already a derivation in Mil " Mil´`RSP˚, and no further transformation is necessary. Otherwise D contains at least one instance of LCoProof n with n P N. We pick an instance ι in D of a rule LCoProof n 0 with n 0 P N that is topmost among the instances of the coinductive rule in D, that is, none of the immediate subderivations of the instance ι in D contains any instance of a rule LCoProof n for n P N. Let D 0 be the subderivation of D that ends in ι. Since ι is topmost, all of the immediate subderivations of ι and D 0 in D are derivations in Mil " Mil´`RSP˚, and D 0 is a derivation in Mil´`LCoProof n 0`R SP˚" Mil`LCoProof n 0 . Therefore we can apply the effective part of Lemma 6.10 to the subderivation D 0 . We obtain a derivation D 1 0 in Mil with the same conclusion as ι and D 0 . Then by replacing D 0 in D with D 1 0 we obtain a derivationD in Mil´`tLCoProof n u nPN`R SP˚that has the same conclusion as D, but that has one instance of a coinductive rule less than D. Now we can apply the induction hypothesis toD in order to effectively transform it in a derivation D 1 in Mil that has the same conclusion as D. In this way we have performed the induction step.
We conclude this section with an illustrative application of the results obtained here that provides in-roads for a completeness proof for Milner ' Cpe 1 q Cpe 2 q e 1 " Mil e 2 Cor. 6.14, (i) Cor. 6.14, (ii) Cpe 1 q Cpe 2 q C LLEE, guarded Figure 14: Illustration of the statements (for arbitrary given e 1 , e 2 P StExp) of Corollary 6.14: Milner's system Mil is complete for 1-bisimilarity of chart interpretations via guarded LLEE-1-charts as joint expansion or as joint minimization.
apply Proposition 6.8, the transformation of LLEE-witnessed coinductive proofs over Mil into derivations in Mil. We show (see Corollary 6.14 below) that Milner's system is complete for bisimilarity of chart interpretations of star expressions when bisimilarity is witnessed by joint expansion or joint minimization to a guarded LLEE-1-chart via functional 1-bisimulations (see Definition 6.12). For showing this statement we must, however, use here without proof a technical result from [Gra22a]: Mil-provable solutions of 1-charts can be transferred backwards over functional 1-bisimulations (see Lemma 6.13). This statement is a generalization to 1-charts of Proposition 5.1 in [GF20a], which states that S-provable solutions of charts, for ACI Ě S, can be transferred backwards over functional bisimulations.
Definition 6.12. Let C, C 1 , and C 2 be 1-charts. We say that C 1 and C 2 are 1-bisimilar via C as (their) joint expansion (C 1 and C 2 are 1-bisimilar via C as (their) joint minimization) if C 1 Ð C Ñ C 2 holds (respectively, if C 1 Ñ C Ð C 2 holds).
Corollary 6.14. The following two statements hold (see Figure 14 for their illustrations): (i) Mil is complete for 1-bisimilarity of chart interpretations of two star expressions via a guarded LLEE-1-chart as joint expansion. (ii) Mil is complete for 1-bisimilarity of chart interpretations of two star expressions via a guarded LLEE-1-chart as joint minimization.
Proof. For showing statement (i), let e 1 , e 2 P StExppAq be such that there is a guarded LLEE-1-chart C with Cpe 1 q Ð C Ñ Cpe 2 q. We have to show e 1 " Mil e 2 . Due to Lemma 3.7, there are Mil´-provable (and thus Mil-provable) solutions of Cpe 1 q and Cpe 2 q with principal values e 1 , and e 2 , respectively. Then we obtain by applying Lemma 6.13, in view of the converse functional 1-bisimulations from Cpe 1 q and Cpe 2 q to C, that there are two Mil-provable solutions L 1 and L 2 of C with the principal values e 1 and e 2 , respectively. These two Mil-provable solutions of the guarded LLEE-1-chart C can be combined to obtain a LLEE-witnessed coinductive proof xC, Ly of e 1 " e 2 over Mil. Thus we obtain: From this we arrive at e 1 " Mil e 2 by Proposition 6.8.
For showing statement (ii), let e 1 , e 2 P StExppAq be such that there is a guarded LLEE-1-chart C with Cpe 1 q Ñ C Ð Cpe 2 q. We have to show e 1 " Mil e 2 . We first note that due to Lemma 6.3 the extraction function sĈ of a (guarded) LLEE-wit-nessĈ of the guarded LLEE-1-chart C yields a Mil´-provable (and hence also a Mil-provable) solution s of C whose principal value we denote by e. Next we apply Theorem 4.18, (ii), to extend the assumed functional 1-bisimulations to C above the chart interpretations Cpe 1 q and Cpe 2 q to start from the 1-chart interpretations Cpe 1 q and Cpe 2 q: we obtain Cpe 1 q Ñ Cpe 1 q Ñ C Ð Cpe 2 q Ð Cpe 2 q. By Theorem 4.18, (i), we find that Cpe 1 q and Cpe 2 q are guarded LLEE-1-charts. By transitivity of Ñ we obtain Cpe 1 q Ñ C Ð Cpe 2 q. Now we can apply Lemma 6.13 to obtain, from the Mil-provable solution s of C, a Mil-provable solution L e 1 ,2 of Cpe 1 q with principal value e, and L e 2 ,2 of Cpe 2 q also with principal value e. By Lemma 4.21 we furthermore obtain Mil´-provable (and hence Mil-provable) solutions L e 1 ,1 of Cpe 1 q with principal value e 1 , and L e 2 ,1 of Cpe 2 q with principal value e 2 . The two Mil-provable solutions L e 1 ,1 and L e 1 ,2 of the guarded LLEE-1-chart Cpe 1 q can be combined to a LLEE-witnessed coinductive proof xCpe 1 q, L e 1 y of e 1 " e over Mil. Analogously, the two Mil-provable solutions L e 2 ,1 and L e 2 ,2 of the guarded LLEE-1-chart Cpe 2 q can be combined to a LLEE-witnessed coinductive proof xCpe 2 q, L e 2 y of e 2 " e over Mil. Together we obtain: Now by an appeal to Proposition 6.8 we obtain e 1 " Mil e and e 2 " Mil e. Finally, by applying of symmetry and transitivity rules in Mil we obtain e 1 " Mil e 2 .
Remark 6.15. While both of the statements (i) and (ii) of Corollary 6.14 were important pieces of the puzzle for constructing the completeness proof for Mil as sketched in [Gra22a], neither of them yields such a proof directly. This is because of the following two facts: First, two bisimilar chart interpretations do not always have a guarded LLEE-1-chart as their joint expansion along Ð. This can be demonstrated with the counterexample of the charts in Example 4.1 of [GF20a]. As a consequence, (i) is sometimes not applicable. Second, two bisimilar chart interpretations do not in general have a guarded LLEE-1-chart as their joint minimization along Ñ. This is an easy consequence of the counterexample that is described in [Gra22a,Sect. 6]. Therefore direct application of (ii) is also excluded in some situations.
Yet more sophisticated applications of (i) and (ii) can still turn out to be expedient. Indeed, a strengthening of (ii) has helped us settle a subcase, and a refinement of (ii) has led to completeness proof for Mil as sketched in [Gra22a]. In [GF20a], Fokkink and I have employed the stronger and more specific version of the joint minimization idea in Corollary 6.14, (ii), for a completeness proof of an adaptation BBP by Bergstra, Bethke, and Ponse of Mil to '1-free star expressions' (without 1, and with binary iteration instead of unary iteration). Concretely, we used that bisimilar chart interpretations of 1-free star expressions have LLEE-charts as their bisimulation collapses (and thus have guarded LLEE-1-charts as joint minimizations). The completeness proof for Mil as summarized in [Gra22a] has been built around a more involved argument that employs 'crystallized' LLEE-1-chart approximations of the joint bisimulation collapse of bisimilar chart interpretations.

From Milner's system to LLEE-witnessed coinductive proofs
In this section we develop a proof-theoretic interpretation of Mil in the subsystem cMil 1 of cMil, and hence also a proof-theoretic interpretation of Mil in cMil. Since Mil and cMil 1 differ only by the fixed-point rule RSP˚(which is part of Mil, but not of cMil) and the  Figure 15: The 1-chart interpretation Cpf˚q for f˚as in (7.1) in Example 7.1.
rule LCoProof 1 (which is part of cMil 1 , but not of Mil), the crucial step for this proof transformation is to show that instances of RSP˚can be mimicked in cMil 1 . We will do so by showing that instances of RSP˚are derivable in cMil 1 , and in particular, can be mimicked by instances of LCoProof 1 . More precisely, we will show that every instance ι of the fixed-point rule RSP˚of Mil can be mimicked by an instance of LCoProof 1 that has the same premise and conclusion, and that uses as its side-condition a LLEE-witnessed coinductive proof over Mil´in which the premise of ι may be used. Still more explicitly, we show that every RSP˚-instance with premise e " f¨e`g such that f Ó and with conclusion e " f˚¨g gives rise to a coinductive proof of e " f˚¨g over Mil´`te " f¨e`gu with underlying 1-chart Cpf˚¨gq and guarded LLEE-witnessĈpf˚¨gq.
We first illustrate this mimicking step by a concrete example (see Example 7.1), in order to motivate and convey the idea of this proof transformation. It will be built on three auxiliary statements (see after Example 7.1) two of which we have shown already in Section 4. Subsequently we prove the remaining crucial auxiliary statement (Lemma 7.2), and then establish the transformation by showing that RSP˚is a derivable rule in cMil 1 (Lemma 7.4, using Lemma 7.3). Finally we use derivability of RSP˚in cMil 1 in order to obtain the proof transformation from Mil to cMil 1 (see Theorem 7.5).
Example 7.1. We consider an instance of RSP˚that corresponds, up to an application of r-distrp`,¨q, to the instance of RSP˚at the bottom in Figure 13: pa`bql ooomooon e " ppa¨a˚`bq¨b˚ql oooooooooomoooooooooon f˚¨1 lo omo on g (7.1) We want to mimic this instance of RSP˚by an instance of LCoProof 1 that uses a LLEE-witnessed coinductive proof of e " f˚¨g over Mil´plus the premise of the RSP˚instance (7.1). We first obtain the 1-chart interpretation Cpf˚q of f˚according to Definition 4.15, see Figure 15, together with its LLEE-witnessĈpf˚q that is guaranteed by Theorem 4.18. Due to Lemma 4.21 the iterated partial 1-derivatives as depicted define a Mil´-provable solution of Cpf˚q when stacked products › are replaced by products¨. From this LLEE-witness that carries a Mil-provable solution we now obtain a LLEE-witnessed coinductive proof of f¨e`g " f˚¨g under the assumption of e " f¨e`g, as follows. By replacing parts p. . .q › f˚by πpp. . .qq¨e in the Mil-provable solution of Cpf˚q, and respectively, by replacing p. . .q › f˚by pπpp. . .qq¨f˚q¨g we obtain the left-and the right-hand sides of the r2s Figure 16: LLEE-witnessed coinductive proof of f¨e`g " f˚¨g over Mil´`te " f¨e`gu .
formal equations in the cyclic derivation in Figure 16. That derivation is a LLEE-witnessed coinductive proof LCP of f¨e`g " f˚¨g over Mil´`te " f¨e`gu : The right-hand sides form a Mil-provable solution of Cpf˚¨gq due to Lemma 4.21 (note that Cpf˚¨gq is isomorphic to Cpf˚q due to g " 1). The left-hand sides also form a solution of Cpf˚¨gq (see Lemma 7.2 below), noting that for the 1-transitions back to the conclusion the assumption e " f¨e`g must be used in addition to Mil´. By using this assumption again, the result LCP 1 of replacing f¨e`g in the conclusion of LCP by e is also a LLEE-witnessed coinductive proof over Mil´`te " f¨e`gu. Consequently: e " f¨e`g LCP Mil´`te"f¨e`gu pe " f˚¨gq LCoProof 1 e " f˚¨g (7.2) is a rule instance of cMil and CLC by which we have mimicked the RSP˚instance in (7.1).
By examining the steps that we used in the example above, we find that three main auxiliary statements were used for the construction of a LLEE-witnessed coinductive proof that mimics an instance of the fixed-point rule RSP˚by an instance of LCoProof 1 . In relation to an instance of RSP˚of the generic form as in Definition 2.11, these are the statements that, for all star expressions e, f , and g, it holds: (a) The 1-chart interpretation Cpeq of a star expressions e is a guarded LLEE-1-chart. (b) e is the principal value of a Mil´-provable solution of the 1-chart interpretation Cpeq of e. (c) e is the principal value of a pMil´`te " f¨e`guq-provable solution of the 1-chart interpretation Cpf˚¨gq of f˚¨g. While (a) is guaranteed by Theorem 4.18, and (b) by Lemma 4.21, we are now going to justify the central statement (c) by proving the following lemma.
Lemma 7.2. Let e, f, g P StExppAq with f Ú , and let Γ :" te " f¨e`gu. Then e is the principal value of a pMil´`Γq-provable solution of the 1-chart interpretation Cpf˚¨gq of f˚¨g.
Proof. First, it can be verified that the vertices of Cpf˚¨gq are of either of three forms: We will show that s is a pMil´`Γq-provable solution of Cpf˚¨gq. Instead of verifying the correctness conditions for s for list representations of transitions, we will argue more loosely with sums over action 1-derivatives sets ABpHq of stacked star expressions H where such sums are only well-defined up to ACI. Due to ACI Ď Mil´such an argumentation is possible. Specifically we will demonstrate, for all E P V pCpf˚¨gqq, that s is a pMil´`Γq-provable solution at E, that is, that it holds: where by the sum on the right-hand side we mean an arbitrary representative of the ACI equivalence class of star expressions that is described by the sum expression of this form.
For showing (7.4), we distinguish the three cases of vertices E P V pCpf˚¨gqq according to (7.3), that is, E " f˚¨g, E " pF › f˚q¨g for some F P B`pfq, and E " G for some G P B`pgq. We will see that the assumption Γ will only be needed for the treatment of the first case.
In the first case, we consider E " f˚¨g. We find by Lemma 4.17 (or by inspecting the TSS in Definition 4.15), and in view of (7.3): ABpf˚¨gq " txa, pF › f˚q¨gy | xa, F y P ABpfqu Y ABpgq , (7.5) (7.6) Then (7.6) guarantees that s is defined for all partial 1-derivatives of E " f˚¨g. With this knowledge we can argue as follows: " ACI τ CpEq pEq`ÿ xa,E 1 yPABpf˚¨gq"ABpEq a¨spE 1 q (by E " f˚¨g and (7.5)).
Due to ACI Ď Mil´Ď Mil´`Γ this chain of equalities is provable in Mil´`Γ, which verifies (7.4) for E as considered here, or in other words, s is a pMil´`Γq-provable solution of at E.
Due to ACI Ď Mil´Ď Mil´`Γ the chains of equalities in both subcases are provable in Mil´`Γ, and therefore we have now verified (7.4) also in the (entire) second case, that is, that s is a pMil´`Γq-provable solution of Cpf˚¨gq at E as in this case.
In the final case, E " G with G P B`pgq. Since then 1-derivatives of G are in B`pgq as well, and hence by (7.3) also in V pCpf˚¨gqq, it follows that s is defined for all 1-derivatives of G and E. With this knowledge we can argue as follows: " ACI τ CpGq pGq`ÿ xa,G 1 yPABpGq a¨spG 1 q (by the definition of s) Due to ACI Ď Mil´Ď Mil´`Γ this chain of equalities verifies (7.4) also in this case. By having established (7.4) for the, according to (7.3), three possible forms of stacked star expressions that are vertices of Cpf˚¨gq, we have shown that s is indeed a pMil´`Γq-provable solution of Cpf˚¨gq.
After having proved statement (c), we can combine the statements (a), (b), and (c) as above in order construct LLEE-witnessed coinductive proofs with which instances of RSPc an be mimicked by instances of LCoProof 1 . This leads us to Lemma 7.3 below, and, as it can show derivability of RSP˚in cMil 1 , to Lemma 7.4. Lemma 7.3. Let e, f, g P StExppAq with f Ú , and let Γ :" te " f¨e`gu. Then it holds that e LLEE """ pMil´`Γq f˚¨g. Proof. First, there is a Mil´`Γ-provable solution s 1 of Cpf˚¨gq with s 1 pf˚¨gq " e, due to Lemma 7.2. Second, there is a Mil´-provable solution s 2 of Cpf˚¨gq with s 2 pf˚¨gq " f˚¨g, due to Lemma 4.21. Then xCpf˚¨gq, Ly with Lpvq :" s 1 pvq " s 2 pvq for all v P V pCpf˚¨gqq is a LLEE-witnessed coinductive proof of e " f˚¨g over Mil´`Γ, because Cpf˚¨gq has the guarded LLEE-witnessĈpf˚¨gq by Theorem 4.18.
We note that the equation in the set Γ in the assumption of Lemma 7.3 does not need to be sound semantically. Therefore it was crucial for the formulation of this lemma that we did not require proof systems S to be sound with respect to " ¨ P for the definition of coinductive proofs in Definition 5.1. Indeed we have done so there in order to be able to formulate this lemma, which states that also instances of the fixed-point rule RSP˚with premises that are not semantically sound can be mimicked by appropriate coinductive proofs.
Lemma 7.4. RSP˚is a derivable rule in cMil.
Proof. Every instance ι of RSP˚can be replaced by a mimicking derivation D ι in cMil 1 according to the following step, where f Ú holds as the side-condition of the instance of RSP˚: e " f¨e`g ι RSPe " f˚¨g ú ùñ e " f¨e`g LCoProof 1 e " f˚¨g (7.11) Here the side-condition e LLEE """ pMil´`te"f¨e`guq f˚¨g of the instance of LCoProof 1 in the derivation D ι on the right is guaranteed by Lemma 7.3.
We now can show the main result of this section, the proof transformation from Mil to cMil 1 . We obtain this transformation by using derivability of RSP˚in cMil 1 as stated by this lemma, and by combining basic proof-theoretic transformations that eliminate derivable, and hence correct and admissible, rules from derivations as described in the proof of Lemma 2.10.
Theorem 7.5. Mil À cMil 1 . What is more, every derivation in Mil with conclusion e " f can be transformed effectively into a derivation with conclusion e " f in cMil 1 .
From this we can infer Mil À cMil 1 , because Ď implies À, and À¨" Ď ". That every derivation D in Mil can be transformed effectively into a derivation D 1 in cMil with the same conclusion follows from derivability of RSP˚in cMil: then in D every instance of RSP˚can be replaced by a corresponding instance of LCoProof 1 as described in (7.11) of the proof of Lemma 7.4 with as result a derivation D 1 in cMil 1 with the same conclusion as D. This argument instantiates the implication from rule derivability to rule admissibility, and the transformations explained in the proof of Lemma 2.10, (i) and (ii), specifically (2.1).
Example 7.6. In Figure 2 we provided a first illustration for translating an instance of the fixed-point rule into a coinductive proof in Figure 2 on page 4. Specifically, we mimicked the instance ι (see below) of the fixed-point rule RSP˚in Milner's system Mil " Mil´`RSPb y a coinductive proof over Mil´`tpremise of ιu with LLEE-witnessĈpf˚¨0q. The correctness conditions that have to be satisfied for the right-hand sides in order to recognize this prooftree as a LLEE-witnessed coinductive proof Mil´`tpremise of ιu are the same as those that we have verified for the right-hand sides of the coinductive proof over Mil´with the same LLEE-witness in Example 5.3. Note that the premise of ι is not used for the correctness conditions of the right-hand sides. The correctness condition for the left-hand side e0¨0 at the bottom vertex of Cpf˚¨0q can be verified as follows, now making use of the premise of the considered instance ι of RSP˚: Together this yields the provable equation: e0¨0 " Mil´`tpremise of ιu a¨pp1¨pa`bqq¨pe0¨0qq`b¨p1¨pe0¨0qq , which demonstrates the correctness condition for the left-hand side e0¨0 at the bottom vertex of Cpf˚¨0q. The correctness condition for the left-hand side a¨pp1¨pa`bqq at the top left vertex of Cpf˚¨0q can be verified without using the premise of ι as follows: Finally, the correctness condition of the left-hand side 1¨pe0¨0q at the right upper vertex of Cpf˚¨0q can be obtained by an application of the axiom (id l p¨q) only.
We close this section by giving an example that provides an additional sanity check for the proof transformation from Mil to cMil that we developed above. The example below shows that the construction of a LLEE-witnessed coinductive proof fails for an inference that is not an instance of the fixed-point rule RSP˚because the side-condition is violated. The premise is semantically valid by Proposition 2.14 because it is provable in Mil´: pa`cq˚" Mil´1`p a`cq¨pa`cq˚" Mil´1`a¨p a`cq˚`c¨pa`cq" Mil´1`a¨p a`cq˚`1`a¨pa`cq˚`c¨pa`cq" Mil´1`a¨p a`cq˚`pa`cq˚" Mil´1`a¨p a`cq˚`1¨pa`cq" Mil´1`p a`1q¨pa`cq˚" Mil´p a`1q¨pa`cq˚`1 . But the conclusion of the inference is obviously not valid semantically, because its left-hand side can iterate c-transitions, while its right-hand side does not permit c-transitions. Now by mechanically performing the same construction of a coinductive proof as we illustrated it in Example 7.1 and in Example 7.6, we obtain the LLEE-1-chart Cpf˚q and the star expression assignments to it as in Figure 17. There we recognize that, while f˚¨g is the principal value of a Mil´-provable solution of Cpf˚¨gq (see on the right), we have not obtained a Mil`te " f¨e`gu-provable solution of Cpf˚¨gq with principal value f¨e`g (see in the middle). This is because the correctness condition is violated at the bottom vertex, because pa`1q¨pa`cq˚`1 " Mil´1`a¨p 1¨pa`cq˚q does not hold: otherwise it would have to be semantically valid by Proposition 2.14, but it is not, because only the left-hand side permits an initial c-transition.
Therefore the construction does not give rise to a LLEE-witnessed coinductive proof of the (not semantically valid) formal equation pa`cq˚" pa`1q¨pa`cq˚`1.
Based on the proof transformations that we have developed in this section and earlier in Section 6, we now obtain our main result. It justifies that we called the proof system cMil a reformulation of Milner's system Mil.
Proof. By combining the statements of Theorem 7.5, Lemma 5.11, and Theorem 6.11 we obtain the theorem-subsumption statements Mil À cMil 1 À cMil p" CLCq À Mil, which together justify the theorem-equivalence of Mil with each of cMil 1 , cMil, and CLC.

Summary and Conclusion
We set out on a proof-theoretic investigation of the problem of whether Milner's system Mil is complete for process-semantics equality " ¨ P on regular expressions (which Milner calls 'star expressions' for disambiguation when interpreted according to the process semantics). Specifically we aimed at characterizing the derivational power that the fixed-point rule RSPi n Mil adds to its purely equational part Mil´.
In order to define a substitute for the rule RSP˚we based ours on two results that we have obtained earlier (the first in joint work with Fokkink): (S/U) Linear specifications of the shape 4 of transition graphs that satisfy the layered loop existence and elimination property LLEE are:  Now in order to obtain results for 1-charts that are analogous to (S) and (U), we have generalized these statements to guarded 1-charts in Section 6. In doing so, we obtained: (S/U) 1 Guarded linear specifications of the shape of 1-charts that satisfy the loop existence and elimination property LLEE are: (S) 1 solvable by star expressions modulo provability in Mil´(see (SE)), (U) 1 uniquely solvable by star expressions modulo provability in Mil (see (SU)). These statements correspond to the statements (SE) and (SU) in Section 6 which we have proved as Lemma 6.4, and Lemma 6.7, respectively.
These statements motivated us to define 'coinductive proofs' as pairs of solutions for guarded LLEE-1-charts, because every pair of Mil´-provable, or Mil-provable solutions can be proved equal in Mil. On the basis of this idea we developed the following concepts and results (we emphasize earlier introduced terminology again here below): 1 LLEE-witnessed coinductive proof over an equational proof system S (Definition 5.1): We defined a coinductive proof as a weakly guarded LLEE-1-chart C whose vertices are labeled by equations between the values of two S-provable solutions of C. 2 Coinductive reformulation cMil of Milner's system Mil (Definition 5.9): We defined cMil as the result of replacing the fixed-point rule RSP˚in Mil with rules of the scheme tLCoProof i u iPN that formalize provability by LLEE-witnessed coinductive proofs.
Ź As the 'kernel' of cMil we defined the system CLC (Definition 5.8) for combining LLEE-witnessed coinductive proofs with only the rules of the scheme tLCoProof i u iPN . 3 Proof transformations between cMil and Mil that show their theorem-equivalence.
Ź We showed that the rules of tLCoProof i u iPN are correct and admissible for Mil, and that this implies that every derivation in cMil can be transformed into one in Mil with the same conclusion by eliminating occurrences of these rules. (See Section 6.) Ź We showed that the fixed-point rule RSP˚of Mil is derivable in cMil, because every instance ι can be mimicked by an instance of LCoProof 1 that uses the premise of ι, and, as a side-condition, a LLEE-witnessed coinductive proof over Mil´. As a consequence we showed that every derivation in Mil can be transformed into one in cMil with the same conclusion by eliminating occurrences of RSP˚. (See Section 7.) 4 Coinductive reformulation cMil of the variant Mil 1 (with the powerful rule USP, see Definition 2.11) of Mil: We formulated systems cMil (Definition 5.9) and CC (Definition 5.8) based on coinductive proofs without LLEE-witnesses. The systems cMil and CC can be recognized as complete variants of cMil and CLC. We have, however, only argued that in Remark 5.12 (on the basis of earlier work [Gra06]), but not proved it in detail here. 5 Proof transformations between cMil and CLC, and cMil and CC that show their theoremequivalence. Here the idea of the non-trivial transformations from cMil to CLC was to 'hide' all derivation parts that consist of axioms or rules of the purely equational part Mil´of Mil into the correctness conditions of solutions in LLEE-witnessed coinductive proofs, which occur as side-conditions of instances of rules of tLCoProof i u iPN in CLC. The transformation from cMil to CC operates analogously. (See Lemma 5.11, (iii), and (iv).) In Figure 18 we have illustrated the web of proof transformations between, on the one hand, Milner's systems and its variants as defined in Definition 2.11, and, on the other hand, the coinductive reformulations cMil and cMil 1 of Mil, and cMil of Mil 1 in Definition 5.9, as well as the coinductive kernel systems CLC of cMil, and CC of cMil in Definition 5.8. The coinductive reformulation cMil of Mil, and its coinductive kernel CLC, can be looked upon as being situated roughly half-way in between Mil and bisimulations between chart interpretations of star expressions. We illustrate this in Figure 19. This picture arises from the highest level in Figure 18, when instantiated for specified conclusions e 1 " Mil e 2 , e 1 " cMil e 2 , and e 1 " CLC e 2 , and by extending it further to Cpe 1 q Ø Cpe 2 q, and hence to e 1 " ¨ P e 2 . For the last step we use soundness of CLC, which follows from soundness of Mil with respect to " ¨ P , see Proposition 2.14, in view of the proof transformations that link CLC via cMil to Mil. Now we note that derivations of CLC represent proof-trees of coinductive proofs each of which defines a bisimulation up to provability by Proposition 5.6, and Remark 5.7. Therefore we can argue that prooftrees in CLC, and by proof-theoretic association also prooftrees in cMil, are situated roughly half-way in between prooftrees in Mil and bisimulations between chart interpretation of star expressions. We think that Figure 19 provides a reasonable suggestion of the proof-theoretic closeness of these systems. The proof-theoretic connections of CLC with cMil and Mil guarantee that completeness of Mil (with respect to " ¨ P ) is equivalent to completeness of cMil, and also to completeness of CLC. Stronger still, the proof transformations between CLC, cMil, and Mil guarantee that every completeness proof of Mil can be 'routed through' CLC (and also through cMil). Such a 'rerouting' through CLC of a completeness proof of Mil does, however, not need to be equally natural as a 'direct' completeness proof of Mil. But since CLC is intuitively much closer to " ¨ P than Mil (as suggested by Figure 19), much hope was warranted to obtain a completeness proof for Mil by finding a completeness proof for CLC first, or to at least to use concepts that we have introduced here. (The latter hope turned out to be justified.) Indeed, since the proof systems cMil and CLC are tied to process graphs via the circular deductions they permit and to bisimulations up to provability, and since cMil and CLC are theorem-equivalent with Mil, they were conceived as (and still can be) natural beachheads for a completeness proof of Milner's system. In Figure 19 we have indicated the step to CLC that is missing here for a completeness proof of Mil with a question mark: a completeness proof of CLC, and that is, an argument that, for every bisimulation between Cpe 1 q and Cpe 2 q where e 1 and e 2 are given star expressions, yields a prooftree in CLC with conclusion e 1 " e 2 .
Due to their feature of permitting derivations that can be construed as combinations of 1-bisimulations (up to provability), we were confident that the proof system cMil and its coinductive kernel CLC substantially increase the space for graph-based approaches to finding a completeness proof of Mil. A concrete indication for this expectation was the following. By closely analyzing the completeness proof in [GF20b,GF20a] for the tailored restriction BBP of Mil to '1-free' star expressions we find: Valid equations between 1-free star expressions admit derivations in CLC of depth less than or equal to 2.

*
(8.1) This fact suggests the following research question: Can derivations in CLC (derivations in cMil) always be simplified to some kind of normal form that is of bounded depth (respectively, of bounded nesting depth of LLEE-witnessed coinductive proofs)?
, . - Despite of the fact that this question admits a trivial answer in view of the completeness proof of Mil in [Gra22a], see (C2) and (C3) below, it can be desirable to also find an answer that is based on a proof-theoretic analysis, and that leads to a workable concept of 'normal form' for derivations in CLC or in cMil. Intuitions for finding such a concept may be found in developing simplification steps of 1-charts with LLEE under 1-bisimilarity, as those are used in the completeness proofs for BBP with respect to '1-free' star expressions in [GF20b,GF20a], and for Mil with respect to all star expressions in [Gra22a,Gra22b]. We close by listing consequences of the latter (one is direct, the other two are a bit technical).
Consequences of the completeness proof of Mil in [Gra22a]. Below we list the most important consequences that the completeness proof of Mil as summarized in [Gra22a] has for the line of investigation on coinductive versions of Mil as reported here: (C1) The coinductive versions cMil and CLC of Milner's system Mil are (just like Mil) complete with respect to process semantics equality " ¨ P of star expressions. (This follows directly from Theorem 5.1 in [Gra22a] in view of Theorem 7.8 here.) (C2) Valid equations between star expressions admit derivations in CLC of depth less than or equal to 2. (This generalization of (8.1) can be shown by a close analysis of the structure of the completeness proof of Mil in Section 5 of [Gra22a]. The proof is similar to that of Corollary 6.14, (ii), and also similar to the argumentation for the analogous statement concerning '1-free' star expressions and the system BBP as reported above.) (C3) As a consequence of (C2) the research question (8.2) admits the trivial answer "yes", albeit one that avoids a close proof-theoretic analysis. (Yet we still think that an answer that is based on a fine-grained proof-theoretic analysis would be more desirable).
Acknowledgement. First I want to thank the editors Alexandra Silva and Fabio Gadducci very much: without their leniency with the deadline I would not have been able to finish this extended article version of my CALCO paper [Gra21b]. Second, I am greatly indebted to the reviewers of this article for reading it carefully, spotting distracting problems, asking spot-on questions, and suggesting changes and additions. To mention two important examples: an acute pointer to a shortcoming of the more informal definition of LLEE-witness in terms of recordings of loop elimination steps (now rectified by using multi-step loop elimination steps, see Definition 4.9) and a perceptive question of whether the proof system Mil is complete with respect to bisimulations that are witnessed by guarded LLEE-1-charts (it is indeed, and the question has led me to formulating and proving Corollary 6.14). I am very thankful to Luca Aceto for giving me the chance to continue my work on Milner's problems on the process interpretation of regular expressions in the PRIN project IT MATTERS -Methods and Tools for Trustworthy Smart Systems (ID: 2017FTXR7S 005).