Why Does Propositional Quantification Make Modal and Temporal Logics on Trees Robustly Hard?

Adding propositional quantification to the modal logics K, T or S4 is known to lead to undecidability but CTL with propositional quantification under the tree semantics (tQCTL) admits a non-elementary Tower-complete satisfiability problem. We investigate the complexity of strict fragments of tQCTL as well as of the modal logic K with propositional quantification under the tree semantics. More specifically, we show that tQCTL restricted to the temporal operator EX is already Tower-hard, which is unexpected as EX can only enforce local properties. When tQCTL restricted to EX is interpreted on N-bounded trees for some N>= 2, we prove that the satisfiability problem is AExpPol-complete; AExpPol-hardness is established by reduction from a recently introduced tiling problem, instrumental for studying the model-checking problem for interval temporal logics. As consequences of our proof method, we prove Tower-hardness of tQCTL restricted to EF or to EXEF and of the well-known modal logics such as K, KD, GL, K4 and S4 with propositional quantification under a semantics based on classes of trees.


Introduction
Propositional quantification in modal and temporal logics. A natural way to design logics that dynamically update their models, consists in adding propositional quantification as done for example to define QBF from SAT. Propositional quantification is a very powerful feature to update models but this may have consequences in terms of computability. In the realm of modal logics [BdRV01], the paper [Bul69] remains a quite early work adding propositional quantification. The undecidability of the propositional modal logic K (resp. T, K4 and S4) augmented with propositional quantification is first established in [Fin70], and this is done thanks to a reduction from the second-order arithmetic. By contrast, the decidability of second-order versions of the modal logic S5 is first proved in [Fin69,Chapter 3] (see also [Fin70,Kap70]) but two S5 modalities and propositional quantification already lead to undecidability [AT02,KT96].
of QCTL t and we aim at characterising its complexity. Furthermore, the model-checking problem for QCTL t is Tower-hard even with input Kripke structures having at most two successor worlds per world and Tower-hardness of QLTL holds with linear structures of length ω, see e.g. [SVW87]. Thus, it is worth understanding what happens with the satisfiability problem for QCTL t X when the tree models are N -bounded (i.e. each node has at most N children) for some fixed N ≥ 2.
Our contributions. Given QCTL t , the extension of CTL with propositional quantification under the tree semantics (i.e. the models are finite-branching trees where all the maximal branches are infinite), let QCTL t ≤N be its variant in which the models are N -bounded, for some N ≥ 2. We write QCTL t X and QCTL t X,≤N , to denote respectively the restriction to the operator EX, and QCTL t F to denote the restriction of QCTL t to EF. • We first present to the reader the toolkit of local nominals and explain the basic ideas behind the hardness results of this paper by proving, for all N ≥ 2, that the satisfiability problem for QCTL t X,≤N is AExp pol -complete (Section 3). AExp pol is the class of problems solvable by exponential-time alternating Turing machines with a polynomial number of alternations. By using a small model property and the complexity of model-checking (with upper bound AExp pol ), AExp pol -easiness is established. As far as AExp pol -hardness is concerned, the alternating multi-tiling problem introduced in [BMMP17] is instrumental to establish that the model-checking problem for the interval temporal logic BĒ with regular expressions is AExp pol -hard. As a corollary, we get that the modal logic K with propositional quantification interpreted on finite trees of branching degree bounded by some fixed N ≥ 2 is also AExp pol -complete.
• More generally and despite the modest scope of EX, the satisfiability problem for QCTL t X is shown to be Tower-hard (Theorem 4.8), by a uniform reduction from k-NExpTimecomplete tiling problems (uniformity is with respect to k). The corresponding upper bound is known from [LM14] and it is worth noting that all the Tower upper bound results presented in this paper are based on translations into the satisfiability problem for QCTL t , sometimes via intermediate decision problems, which eventually uses Rabin's Theorem [Rab69] in some essential way. The hardness proof is one of the main results of the paper and amounts first to showing that one can enforce that a node has a number of children equal to some tower of exponentials of height k with a formula of size exponential in k. By contrast, checking the satisfiability status of CTL * formulae, requires only to consider tree models with branching degree bounded by the size of the formula, see e.g. [ES84,DGL16]. Once this complex construction enforcing a very high number of children is performed, the reduction from the tiling problems can be done with the help of other properties on the number of children. Hence, even though QCTL X under the structure semantics is undecidable [Fin70] and the variant of QCTL t X under the tree semantics (QCTL t ) is decidable by [LM14], the problem admits a high complexity despite the local range of EX. The Tower lower bound for QCTL t crucially depends on the availability of very wide trees, which contrasts with the AExp pol upper bound for QCTL t X,≤N for which trees are N -bounded. • By adapting our proof method, we show that QCTL t F and QCTL t XF (a variant of QCTL t F propositional variable x can be expressed by the formula EX x∧¬(∃ p EX(x∧p)∧EX(x∧¬p)), where p is distinct from x. The satisfiability problem for the logic QCTL s (under the structure semantics) takes as input a formula φ in QCTL and asks whether there is a finite and total Kripke structure K and a world w such that K, w |= φ.
The tree semantics introduced in [LM14] is obtained by considering as only admissible models the computation trees of finite and total Kripke structures. As noted in [LM14,Remark 5.7], an equivalent formulation can be provided: the satisfiability problem for the logic QCTL t (under the tree semantics) takes as input a formula in QCTL and asks whether there is a finite-branching tree model T in which all the maximal branches are infinite such that T, ε |= φ and ε is the root of T. This is the definition we adopt along the paper.
We write SAT(L) to denote the satisfiability problem for the logic L. The distinction between the tree semantics and the structure semantics is crucial and affects the computational properties of the satisfiability problems. All our forthcoming Tower upper bound results are based on translations into the satisfiability problem for QCTL t , sometimes via intermediate decision problems, which eventually invokes Rabin's Theorem [Rab69] in some essential way. This is not surprising, as considering tree-like models and propositional quantification naturally leads to invoking the decidability of SωS [Rab69] or its linear version, the second-order logic of one successor S1S [Büc60].
Let us recapitulate the different versions of quantified CTL we have seen so far. • QCTL s is interpreted over finite and total Kripke structures and SAT(QCTL s ) is undecidable, see e.g. [LM14]. • QCTL t is interpreted over finite-branching trees in which all the maximal branches are infinite and SAT(QCTL t ) is Tower-complete, see e.g. [LM14]. Let us introduce two additional versions that are closely related to modal logics with propositional quantification on tree-like models introduced in the forthcoming Section 5.
• QCTL f t is interpreted over finite trees, SAT(QCTL f t ) can be shown to be in Tower by a logspace reduction into SAT(QCTL t ) and its restriction to EX will be shown to admit a Tower-hard satisfiability problem (see Section 5). • QCTL gt is interpreted over finite-branching trees (maximal branches may be finite), SAT(QCTL gt ) can be shown to be in Tower by logspace reduction into SAT(QCTL t ) and its restriction to EXEF will be shown to admit a Tower-hard satisfiability problem (see Section 5).
As a side remark, the equivalence between the two formulations of QCTL t , is mainly due to the fact that QCTL t can be translated into Monadic Second-Order Logic (MSO) over tree models with arbitrary finite branching (getting decidability by Rabin's Theorem [Rab69]). Indeed, as MSO over tree models with arbitrary finite branching is decidable by Rabin's Theorem [Rab69], the satisfiability problem for QCTL t is decidable too, by a standard translation internalising the tree semantics for QCTL t . As explained in [Tho97,Section 6.3], the existence of a tree model implies also the existence of a regular tree model, that can be precisely originated by a finite Kripke structure. Hence, QCTL t has the finite model property. So, not only can every finite and total Kripke structure be unfolded as a finite-branching tree in which all the maximal branches are infinite (a direct consequence of the definition for computation trees) but the existence of a tree model with the above-mentioned properties and satisfying φ implies the existence of the computation tree of a finite and total Kripke structure satisfying φ. Hence, satisfiability in the computation tree of a finite Kripke structure is equivalent to satisfiability in a finite-branching tree in which all the maximal branches are infinite, and in the sequel, we shall operate with the latter definition. Apart from CTL-like logics (see e.g. [LM14] for a wealth of bibliographical references), other logics with propositional quantification have been shown to be decidable by translation into SωS, see e.g. [AB93,BCZ00,Zac04]. Besides, in [AB93] a fragment of GL with propositional quantification is shown to be decidable by translation into the weak monadic second-order logic of one successor WS1S [Büc60], and a version of Gödel logic LC with propositional quantification is shown to be decidable by translation into S1S [Büc60,BCZ00], see also [Zac04] solving partially an open problem from [Kre97a,§9].
2.3. Complexity classes and tiling problems. In this section, we introduce tiling problems that are mainly used in Sections 3.3 and 4.4.
Let t : N × N → N be a tetration function defined for integers n, k ≥ 0, inductively as t(0, n)=n and t(k+1, n)=2 t(k,n) . Intuitively the function t defines the tower of exponentials of height k, e.g. we have t(1, n) = 2 n , t(2, n) = 2 2 n , and so on. By k-NExpTime we denote the class of all problems decidable with a nondeterministic Turing machines of working time in O(t(k, p(n))) for some polynomial p(·), on each input of length n. We define Tower as the class of all problems of time complexity bounded by a tower of exponentials, whose height is an elementary function [Sch16]. Thus, to show Tower-hardness (using elementary reductions [Sch16]), it is sufficient to prove k-NExpTime-hardness for all k using uniform reductions [Sch16, Section 3.1]. It is worth recalling that Tower-hardness is defined with the class of elementary reductions (i.e. those with time-complexity bounded by a tower of exponentials of fixed height) [Sch16]. Building a reduction from instances of k-NExpTime-hard problems with time-complexity f(n, k) where the size n of the input leads to an elementary reduction when f(n, k) itself is elementary in n and k. This is what we mean by a uniform reduction in k to establish Tower-hardness.
For proving hardness results, we make extensive use of tiling problems, see e.g. [vEB97].
Definition 2.2. The tiling problem Tiling k takes as inputs a triple T , H, V and c ∈ T n for some n ≥ 1 such that T is a finite set of tile types, H ⊆ T × T (resp. V ⊆ T × T ) represents the horizontal (resp. vertical) matching relation, and c = t 0 , t 1 , . . . , t n−1 ∈ T n is the initial condition. A solution for the instance T , H, V , c is a mapping τ : A mapping τ satisfying (hori) and (verti) is called a tiling.
The problem of checking if an instance of Tiling k has a solution (note that k does not appear in the instance and it governs the size of the grid) is k-NExpTime-complete [vEB97]. Given N ≥ 2, let us consider the satisfiability problem for QCTL t X,≤N in which the structures are tree models where all the maximal branches are infinite but each node has at 5:8

B. Bednarczyk and S. Demri
Vol. 18:3 most N children (and at least one child). To characterise the complexity of SAT(QCTL t X,≤N ), we consider the complexity class AExp pol that consists of all problems decidable by an alternating Turing machine (ATM) [CKS81] working in exponential-time and using only polynomially many alternations [BMMP17,Mol19]. We stress here that allowing an unbounded number of alternations would give us the class ExpSpace, and classes similar to AExp pol have been considered in [Ber80], typically STA(f(n),g(n),h(n)), where f(n) refers to the restriction on the Space, g(n) refers to the restriction on the Time, and h(n) refers to the restriction on the number of Alternations. Consequently, AExp pol is the union of classes STA(·,2 g(n) ,h(n)) with polynomials g(n), h(n). The complexity of several logical problems has been captured by the class AExp pol , see e.g. [FR75,BvDP15,BMMP17].
For proving AExp pol -hardness, we use an elegant modification of Tiling 1 , introduced in [BMMP17, Mol19]. The extension amounts to considering a stack of n tilings, with a matching relation between two consecutive tile types on the same position of the grid, and quantifications over the tile types on the first row (initial conditions). Details follow below.
The alternating multi-tiling problem is shown to be AExp pol -complete in [BMMP17,Mol19].

What happens when trees are bounded?
In this section, we study the satisfiability problem for QCTL t X,≤N with N ≥ 1, i.e. QCTL t X over trees, where the degree of each node is bounded by a fixed natural number N ≥ 1.
As we have already mentioned in the introduction, the goal of this section is two-fold. First, we would like to make the reader familiar with our proof techniques applied to a simplified scenario. Second, our results show that to get Tower-hardness of QCTL t X we must focus on trees of arbitrarily large branching.
3.1. A toolkit for introducing local nominals. Below, we introduce formulae to simulate partially the use of nominals from hybrid modal logics [ABM01]. A nominal x is usually understood as a propositional variable true at exactly one world of the model (a global property). In QCTL t X , such a property cannot be enforced but it can be done with respect to nodes at a bounded depth from the evaluation node, whence the adjective 'local' for the nominals. The use of local nominals is essential in all our hardness proofs, as it allows us to simulate first-order quantification on a given set of nodes of bounded depth. Proofs of all lemmas from this section are rather straightforward and are shown by careful inspection of the semantics. Hence, we delegate them to Appendix A.1-A.3.
Definition 3.1. Given a tree model T and a node v, we say that the propositional variable states that x is a nominal for the depth k (EX k denotes k copies of EX).
Let us next define @ k x φ as the formula EX k (x ∧ φ) (usually assuming that nom(x, k) holds).
Lemma 3.5. Given a tree model T and a node v, Let us illustrate the use of local nominals and diff-nom(x 1 , . . . , x α , k) to specify that a node has at most 2 n children, with a formula of polynomial size in n. This is exactly the type of properties that can be expressed in graded modal logics [Fin72,FBDC85,Tob01]. Given a finite set X of propositional variables, we design a formula stating that no pair of distinct children agree on all propositional variables from X, as done in [DLM16]. It is given below: Thus, the formula 3 ≤2 n from graded modal logics can be expressed in QCTL t X with 3 ≤2 n def = ∃ p 0 , . . . , p n−1 Uni({p 0 , . . . , p n−1 }). In Section 4, we show how to succinctly express hyperexponential bounds.
3.2. Beyond the ExpSpace upper bound: AExp pol . In order to solve SAT(QCTL t X,≤N ), little is needed if the ExpSpace upper bound is aimed. Indeed, given a formula φ in QCTL t X,≤N , it is clear that for an N -bounded tree model T satisfying φ at its root node ε, it is irrelevant what happens at nodes of depth strictly more than md (φ). Hence, the formula φ is satisfiable iff there is a finite N -bounded tree structure T with all the branches of length exactly md (φ) satisfying φ at its root ε (as the branches of tree models are infinite, we need to consider branches of length exactly md (φ)). Thus, T has at most |φ|N |φ| nodes. To get an algorithm working in NExpSpace, guess such an exponential-size finite tree structure, and perform model-checking on it with an algorithm inherently in PSpace (as model-checking finite structures with MSO is PSpace-complete [Sto74,Var82] and φ can be translated to MSO in the standard way), which leads to NExpSpace. By Savitch's Theorem [Sav70], we get the ExpSpace upper bound.
This bound is not completely satisfactory as it does not use much of QCTL t X,≤N and more importantly, Section 3.3 proves AExp pol -hardness of SAT(QCTL t X,≤N ) as long as N ≥ 2. Hence, the goal of this section is to establish an AExp pol upper bound. The tight upper bound for SAT(QCTL t X,≤N ) relies on the following ingredients. (i) Every formula φ of QCTL t X is logically equivalent to a QCTL t X formula φ in prenex normal form (PNF) such that φ can be computed in polynomial-time in |φ|. Formulae in PNF are of the form Q 1 p 1 · · · Q β p β ψ where {Q 1 , . . . , Q β } ⊆ {∃, ∀} and ψ is quantifier-free. (ii) Existence of an N -bounded tree model for φ is equivalent to the existence of an Nbounded finite tree structure such that all branches are of length md (φ). Then, we simply guess a finite tree of a small (exponential) size with the help of the shallow model property -such a tree will be later unravelled to become an infinite tree model. (iii) Checking whether T, ε |= Q 1 p 1 · · · Q β p β ψ (involving an N -bounded finite tree with branches of length md (ψ) and the input formula in PNF) can be done with an alternating Turing machine in time O((|ψ| + β)|T|) and with at most β alternations. To establish (i), we cannot rely directly on PNF for QCTL from [LM14,Prop. 3.1] as the translation in [LM14,Prop. 3.1] involves temporal operators beyond the language of QCTL t X.
Proof. On tree models, the following formulae are tautologies, assuming that p does not occur in ψ (where Q is either ∃ or ∀): Hence, by employing the above formulae and rewriting the input, we conclude the lemma. For a more detailed explanation consult Apppendix A.4 Now we proceed with the second property. Let us be a bit more precise. Given a tree model T, we write T n to denote its subtree obtained by taking only nodes on the depth at most n from the root. A completion of a finite tree T of maximal depth n is an infinite tree T (finite-branching and all the maximal branches are infinite) such that T = T n . By the naive completion of T of maximal depth n, we refer to the unique completion achieved by replacing each node v at depth n from T by an infinite chain of copies of itself.
A shallow model property states that what matters for a QCTL t X formula φ in its infinite tree model is a relatively small finite part, with paths bounded by the modal depth of φ.
Lemma 3.7 (Shallow Model Property). Let T, ε be a model for the QCTL t X -formula φ. Then, any completion of T md(φ) , ε is also a model for φ.
Proof. The construction is standard and goes in exactly the same way as in the literature, e.g. [BdRV01, Theorem 2.3].
Since we are interested in the satisfiability problem over N -bounded trees, the overall size of a structure T md(φ) can be easily bounded. A simple estimation can be obtained by counting the number of nodes with a certain distance from the root, namely: As a direct consequence of the above estimation and Lemma 3.7, we obtain: Lemma 3.8. For any formula φ, φ is satisfiable for QCTL t X,≤N iff φ is satisfiable in a finite N -bounded tree structure of size bounded by |φ|N |φ| and each branch is of length md (φ).
In order to establish (iii), the details are omitted but we apply the naive model-checking algorithm for MSO with an ATM: existential (resp. universal) quantification ∃p (resp. ∀p) requires time O(|T|) and the machine enters a sequence of existential (resp. universal) states. The quantifier-free formula ψ is evaluated as a first-order formula by the standard translation for modal logic. Note also that checking T , v |= ψ can be done in polynomial time in |ψ|+|T | (see [CE81,Sch03]). By combining (i)-(iii) we establish an improved upper bound.
Theorem 3.9. For any N ≥ 1, the satisfiability problem for QCTL t X,≤N is in AExp pol . When N = 1, the upper bound can be improved as the number of alternations is linear and the size of the finite witness "tree" is polynomial in |φ|, and therefore the whole procedure can be implemented with a polynomial-time alternating Turing machine (thus in PSpace [CKS81]). The matching lower bound is inherited from quantified propositional logic QBF, see e.g. [MS73].

3.3.
A reduction from AMTP (with fixed N ≥ 2). Let N ≥ 2 and let us consider the satisfiability problem for QCTL t X,≤N in which the structures are tree models where all the maximal branches are infinite and each node has at most N children (and at least one child). In order to show that the problem is AExp pol -hard, we define below a reduction from the alternating multi-line tiling problem AMTP presented in Section 2 and introduced in [BMMP17].
To define a grid [0, 2 n − 1] × [0, 2 n − 1], a major part in the solution of an instance of AMTP, we specify a tree such that every node at a distance less than 2n from the root ε has exactly two children, implying that there are exactly 2 2n nodes at a distance 2n from ε. Moreover, each node at a distance 2n encodes a position (H, V) in [0, 2 n − 1] × [0, 2 n − 1], by making the propositional variables h n−1 , . . . , h 0 and v n−1 , . . . , v 0 to be responsible, respectively, for the horizontal and vertical axes. The i-th bit of H (resp. V) is taken care of by the truth value of h i (resp. v i ) and by convention the least significant bit is encoded by h 0 (resp. v 0 ).

B. Bednarczyk and S. Demri
Vol. 18:3 The forthcoming formula grid(2n) is dedicated to encoding such a grid.
states that there are exactly two children. Moreover, AX 0 ψ def = ψ and AX i+1 ψ def = AXAX i ψ. Note that the upper part of grid(2n) enforces that there are exactly 2 2n descendants at a distance 2n from the root, while the lower part imposes that any two such descendants differ by at least one propositional variable from h n−1 , . . . , h 0 , v n−1 , . . . , v 0 . Hence, the full grid [0, 2 n − 1] × [0, 2 n − 1] is encoded with grid(2n). The correctness of grid(2n) follows from Lemma 3.3 and Lemma 3.5.
Corollary 3.11. T, v |= grid(2n) iff T 2n is a binary tree in which there are exactly 2 2n nodes v satisfying E 2n (v, v ) and each of such distinct nodes v , v is labelled by a different subset of atomic propositions from {v 0 , v 1 , . . . , v n−1 , h 0 , h 1 , . . . , h n−1 }.
Let T , H, V be a triple from an instance of AMTP and let j ∈ N. Each tile type t ∈ T will be represented by a fresh propositional variable t j . Hence, {t j : t ∈ T } (written below T j ) is a set of propositional variables used to provide a tile type for each position of the grid [0, 2 n − 1] × [0, 2 n − 1], while the superscript 'j' is handy to remember that this concerns the j-th tiling (as several tilings are involved in AMTP instances).
We first define the formulae φ j cov , φ j H and φ j V whose conjunction states that every position of the grid has a unique tile type in T j , and the horizontal and vertical matching conditions are satisfied. Hence, we have a valid tiling of the grid made from T j .
The formula φ j cov expresses that every position of the grid has a unique tile type: For the horizontal matching constraints, we need to express when two nodes at a distance 2n interpreted respectively by x and y and representing respectively the position (H, V) and (H , V ), satisfy V = V and H = H + 1. The formula HN(x, y) ('HN' for 'horizontal neighbours') does the job using a standard arithmetical reasoning on binary numbers. The intuition is that we treat h i propositions as bits and to verify that the number encoded on y is equal to the number encoded on x plus 1, we need to (i) find an index i on which the i-th bit is switched on for y but switched off for x, (ii) check that all bits on more significant positions after i for x and y are equal and (iii) ensure that all less significant bits are switched on for x while switched off for y. This idea is formalised as follows: Employing HN(x, y) we can provide a formula φ j H that encodes horizontal matching constraints: Let VN(x, y) (where 'VN' stands for 'vertical neighbours') be the formula obtained from HN(x, y) by replacing each occurrence of h α (resp. v α ) by v α (resp. h α ).
The following formula φ j V encodes the vertical matching constraints: To state that a root satisfying grid(2n) encodes a tiling with respect to T j , we consider the formula φ j Lemma 3.12. Assume that T, v |= grid(2n) holds. Then: is a tiling, then there exists a tree T , v satisfying φ j tiling ∧ grid(2n) and being a T j -variant of T. Proof. By careful inspection of the semantics and of presented formulae, cf. Appendix A.5.
In order to encode an instance of AMTP, there are still properties that need to be expressed. Let us assume that the root node ε satisfies grid(2n).
• Given the set of initial tile types T 0 ⊆ T , let us express that for each position of the first row of the grid, exactly one tile type in T j 0 holds.
• Assuming that ε satisfies φ j tiling ∧ φ j init , we express that for each position of the first row of the grid, the tile type in T j 0 coincides with the tile type in T j 0 (corresponding to (m-init)): B. Bednarczyk and S. Demri Vol. 18:3 • Given the set of accepting tile types T acc ⊆ T and assuming that ε satisfies φ j tiling , we state that there is a position on the last row with a tile type in T acc (satisfying (m-accept)): • Given the multi-matching tiling relation T multi ⊆ T × T , and assuming ε satisfies φ j tiling ∧ φ j+1 tiling , on every position, the tile type in T j and the tile type in T j+1 are in the relation T multi (fulfilling the requirements of (m-multi)): It is time to wrap up. Given a finite set of propositional variables X = {r 1 , . . . , r β }, we write ∃X ψ to denote the formula ∃r 1 ∃r 2 · · · ∃r β ψ. ∀X ψ is defined similarly. Given an instance I of AMTP made of n, T , H, V , T 0 , T acc , T multi , let us define the formula φ I below: Now, we can state the correctness of the reduction.
Proof. The proof is a bit tedious but has no serious difficulties, as all the conditions for being a solution of I can be easily expressed, as soon as the grid [0, 2 n − 1] × [0, 2 n − 1] is encoded. Moreover, the quantifications involved in AMTP are straightforwardly taken care of in QCTL t X,≤N thanks to the presence of propositional quantification. Consult Appendix A.6.
The above lemma leads us to one of the main results of the paper.
Theorem 3.14. For all N ≥ 2, the satisfiability problem for QCTL t X,≤N is AExp pol -hard.

4.
Tower-hardness of the satisfiability problem QCTL t

X
We are back to the (general) satisfiability problem for QCTL t X , i.e. with no further restrictions on the number of children per node. 4.1. Overview of the method. In order to show Tower-hardness, we shall reduce the k-NExpTime-complete tiling problem Tiling k introduced in Section 2.3 to SAT(QCTL t X ) and this should be done in a uniform way so that Tower-hardness can be concluded (see the discussion in [Sch16, Section 3.1.2] and in Section 2.3). Hence, we need to encode concisely a grid t(k, n) × t(k, n) and to do so, the main task consists in enforcing that a node has t(k, n) children, using a formula of elementary size in k + n (bounded by a tower of exponentials of fixed height). Actually, our method produces a formula of exponential size in k + n. Of course, this is not the end of the story as we need to encode the grid t(k, n) × t(k, n) and to express on it constraints about the tiling τ . First, let us explain how to enforce that a node has exactly t(k, n) children, by partly taking advantage of the proof technique of local nominals (see Section 3.1).
We recall that t(1, n)=2 n and t(k + 1, n)=2 t(k,n) for k > 0. For the forthcoming subsections, we assume that n is fixed. Below, we classify the nodes of a tree model by their type (a value in N) such that any node is of type 0, and if a node is of type k > 0, then it has exactly t(k, n) children and all the children are of type k − 1. To be more precise, a node may have two types (as one of them is always zero). So, a node of type 1 has exactly 2 n children, a node of type 2 has exactly 2 2 n children, etc. Therefore if a node is of type k > 0, then the value k is unique. Additional conditions apply for being of type k > 0 but we can already notice that a node v of type k implicitly defines a balanced subtree of depth k with root v.
In order to enforce that a node is of type k ≥ 1 (this is a trivial property for k = 0), and therefore has exactly t(k, n) children, with each node v of type k ≥ 0 is associated a number in [0, t(k +1, n)−1]. Such a number is written nb T (v). The subscript 'T' may be omitted when the context is clear.
by a slight abuse of notation, we may refer to a node by its local nominal when it exists).
When the type of the node v is zero, its number is defined as the unique m such that the number represented by the truth values of p n−1 , p n−2 , . . . p 0 is equal to m. As usual, the propositional variable p i is responsible for the ith bit of the number m and by convention, the least significant bit is encoded by the truth value of p 0 . We illustrate the encoding below:  Otherwise, when the type of v is equal to some k > 0, its number is represented by the binary encoding of the propositional variable val on its children assuming that there are t(k, n) children whose respective (bit) numbers span all over [0, t(k, n) − 1] and therefore all the children are implicitly ordered. This principle makes sense conceptually but it remains to express it in QCTL t X , similarly to the Tower-hardness proof in [PHST19] for the fluted fragment in which counters with high values have to be enforced within a restricted language (see also [Sto74]). That is why, in Table 1, we present a list of formulae to be defined. All of them are interpreted on a node v 0 of type k ≥ 0, 1 ≤ d ≤ k.

Formulae to be defined
Intuitive meaning In the last 3 lines of the table, the subscript 'k' below '=' and '<' allows us to remember that the formula is evaluated at a node of type k; asx andȳ are of length d, the number comparison is done on nodes of type k − d and the numbers can take values in [0, t(k − d + 1, n) − 1]. Though most of the intuitive meanings are straightforward, let us notice that uniq(k) is intended to express that two distinct children of v 0 have distinct numbers. Similarly, compl(k) is intended to express that if a child of v 0 has a number n strictly less than t(k, n) − 1, then v 0 has also another child with number equal to n + 1 ('compl' in compl(k) stands for 'complete').
In what follows we will also employ x,ȳ to denote the formula . . , v d can be understood as two branches rooted at v 0 ending at the node v d and at the node v d respectively. The formula x,ȳ uses subformulae introduced in Section 3.1 and the wide hat symbol in x,ȳ abovex and y is a graphical reminder of these two branches. By contrast, the specific formula x,x states the existence of a single branch with nodes v 0 , . . . , v d . In order to define type(k) (k ≥ 1), we specify that every child is of type k − 1, there is a child with number equal to zero, and if a child has number m < t(k, n) − 1, then there is a child with number equal to m + 1. Moreover, two distinct children have distinct numbers in [0, t(k, n) − 1]. Satisfying these conditions guarantees that the number for the children span all over [0, t(k, n) − 1]. The formula type(k) (for k ≥ 1) is defined as Note that the above formula is intended to be built over the propositional variables p 0 , . . . , p n−1 , val (only). Let us first explain how we proceed to define all the mentioned formulae. For successive values N ∈ N, we define inductively the formulae: • type(N ), first(N ) and last(N ), For N = 0, only the formulae type(0), first(0) and last(0) make sense. The case N = 1 is not yet an instance of the general case. We first treat the cases for N ∈ {0, 1} and then we proceed with the general case N ≥ 2. 4.2. Formulae for types zero and one. When k = 0 (thus k = N = 0), only the intended properties for the formulae type(0), first(0) and last(0) are meaningful. Let us define them, in the simplest way.
We next focus on the case when N = 1 and we define the formulae type(k), first(k) and last(k) with k=1 (i.e. when k=N =1) as well as nb(x 1 , . . . , x d ) < k nb(y 1 , . . . , y d ) and nb(y 1 , . . . , y d ) = k nb(x 1 , . . . , We stress that k and d can be arbitrarily large as long as k = d. To start with the formula nb(x 1 , . . . , x d ) = k nb(y 1 , . . . , y d ), it can be easily defined in terms of nb(x 1 , . . . , x d ) < k nb(y 1 , . . . , y d ) as: Second, we turn our attention to the formula type(1). It states that there is a child with number equal to zero, if a child has number m < 2 n − 1, then there is a child with number equal to m + 1, all the children are of type 0, and two distinct children have distinct numbers in [0, 2 n − 1]. Remember that the number of each child (of type 0) is computed from the propositional variables in {p n−1 , . . . , p 0 }. The arithmetical reasoning between children, leading to the fact that there are exactly 2 n children whose numbers span all over [0, 2 n − 1] takes advantage of standard arithmetical properties on numbers encoded by n bits. Here is the formula type(1): It remains to specify what exactly the formulae uniq(1) and compl(1) are. In order to define uniq(1), responsible for enforcing the uniqueness among the children's numbering, we simply state that there are no two distinct children (of type 0) having the same number: ∀x, y diff-nom(x, y, 1) → ¬(nb(x) = 1 nb(y)).
Note that the formula diff-nom(x, y, 1) guarantees that we pick two distinct children and the nominals x and y allow us to access them (and check the values of the propositional variables in {p n−1 , . . . , p 0 }). Consult Lemma 3.5 for the correctness. The formula compl(1) below states that for each child v (of type 0) that is not the last one (i.e. does not have the highest possible number among all other nodes), there is also a child v (also of type 0) such that nb T (v ) = nb T (v) + 1. Here is the formula compl(1): x (¬last(0))) → ∃y nom(y, 1) ∧ nb(y) = 1 nb(x) + 1. Finally, it remains to define the formulae nb(x) = 1 nb(y) and nb(y) = 1 nb(x) + 1 used respectively in uniq(1) and in compl(1). Below, we treat the more general situation with k = d (k is not necessarily equal to 1), and nb(x) = 1 nb(y) and nb(y) = 1 nb(x) + 1 are specific instances with k = d = 1. Let assume thatx = x 1 , . . . , x k andȳ = y 1 , . . . , y k (thus d = k). The forthcoming definitions are standard and rely on elementary operations on binary encoding of natural numbers with n bits (again, the least significant bit is represented by the truth value of p 0 ): For the sake of completeness, we define first(1) def = AX(¬val ) and last(1) def = AX(val ). The lemma below states that we have properly proceeded for the binary encoding of numbers with the variables in p n−1 , . . . , p 0 (and Lemmas 3.4-3.5 need to be used).
Lemma 4.1. Let T be a tree model and v be one of its nodes such that v satisfies x,ȳ (x andȳ are both of length k) and, v k and v k are understood as nodes of type 0.
Proof. By careful inspection of the presented formulae, cf. Appendix B.1.
We conclude by presenting the main lemma that gathers all established formulae.
Lemma 4.2. Let T be a tree model and let v be any of its nodes. The following hold: Proof. The properties (II)-(III) follow immediately from the way we encode numbers. Check Appendix B.2 for a more detailed explanation. 4.3. Formulae with arbitrary N ≥ 2. Let us consider the arbitrary case N ≥ 2. Below, we define the formulae type(N ), first(N ) and last(N ) as well as nb(x 1 , . . . , x d ) < k nb(y 1 , . . . , y d ), and nb(y 1 , . . . , We also consider the formula nb(x 1 , . . . , x d ) = k nb(y 1 , . . . , y d ), that is defined as follows: We assume that for all k < N , the formulae type(k), last(k) and first(k) are already defined and for k − d ≤ N − 2, the formulae nb(x) < k nb(ȳ), nb(x) = k nb(ȳ) and nb(ȳ) = k nb(x) + 1 are already defined too (x andȳ are of length d). This can be understood as an implicit induction hypothesis when proving the correctness of the formulae built for N . As for the case N = 1, the formula type(N ) follows the general schema: it states that there is a child with number equal to zero, if a child has number m < t(N, n) − 1, then there is a child with number equal to m + 1, and two distinct children have distinct numbers in [0, t(N, n) − 1]. Of course, all the children are enforced to be of type N − 1. We present the claimed formula type(N ) below.
Again, it remains to specify what uniq(N ) and compl(N ) are. In order to define uniq(N ), we simply state that there are no two distinct children (of type N − 1) with the same number: Again, the formula diff-nom(x, y, 1) allows us to select two distinct children (of type N − 1). The formula compl(N ) below states that for each child v (of type N − 1) that is not the last one, there is also a child v (of type N − 1 too) such that nb T (v ) = nb T (v) + 1. Here it is: x (¬last(N − 1))) → ∃y nom(y, 1) ∧ nb(y) = N nb(x) + 1. It remains to define nb(x) = N nb(y) and nb(y) = N nb(x) + 1 used respectively in uniq(N ) and in compl(N ). This time, this requires much lengthier developments, apart from using the properties of the formulae constructed for N − 1 and for smaller values (implicit induction hypothesis). Below, we treat the more general situation with k − d = N − 1, and nb(x) = N nb(y) and nb(y) = N nb(x) + 1 are just particular instances with k = N and d = 1. Thus, letx = x 1 , . . . , x d andȳ = y 1 , . . . , y d .
For defining nb(y 1 , . . . , y k ) = k nb(x 1 , . . . , x k ) + 1 (see Section 4.2), we have compared the respective truth values of the propositional variables p n−1 , . . . , p 0 for the node v k (the interpretation of x k ) and for the node v k (the interpretation of y k ). The same principle applied for defining nb(x 1 , . . . , x k ) = k nb(y 1 , . . . , y k ). Typically, nb(y 1 , . . . , Additional arithmetical constraints are needed to relate the partition ofx with the partition ofȳ (see below the details) but in a way, it is independent of the partition itself. For instance, the unique child of v d satisfying s and the unique child of v d satisfying s should have the same (bit) number. Nevertheless, it is clear that we need, at least, to be able to state in QCTL t X the existence of a partition satisfying the conditions (a), (b) and (c). In the sequel, such partitions are called lsr-partitions. The forthcoming formula LSRx(k) does the job for v d (then use LSRȳ(k) for v d ).
Takex = x 1 , . . . , x d . In the context of the definition of LSRx(k), we allow the limit case d = 0, with empty sequence ε, assuming that @ ε ψ def = ψ and ε, ε def = . Below 0 ≤ d < k and the formula LSRx(k) is defined as the conjunction LSR 1 x (k) ∧ LSR 2 x (k) ∧ LSR 3 x (k) and is interpreted on a node v 0 of type k satisfying x,x, and therefore this satisfaction is witnessed by the branch v 0 , . . . , v d (notations for developments below). First, LSR 2 x (k) def = @x(EX =1 (s)), with EX =1 (ψ) defined as EXψ ∧ ¬∃ p (EX(ψ ∧ p) ∧ EX(ψ ∧ ¬p)) for a fresh p. Note that the formula LSR 2 x (k) simply states that there is a unique child of v d satisfying s. Next, let LSR 1 x (k) be defined below, stating that for every child of v d , exactly one propositional variable among {l, s, r} holds true:  Proof. By careful inspection of the presented formulae, cf. Appendix B.3.
We come back to the question of defining formulae expressing number comparisons. The formula nb(ȳ) = k nb(x) + 1 (remember k − d = N − 1) is defined as the expression The conjunction φ left (k) ∧ φ select (k) ∧ φ right (k) takes care of the arithmetical constraints. The formula φ select (k) states that the v d 's unique child satisfying s (whose number is the pivot bit i) does not satisfy val , and the v d 's unique child satisfying s (whose number is also the pivot bit i) satisfies val : The formula φ right (k) states that for all the children of v d satisfying r (and therefore with bit number strictly smaller than i), the bit value is 1, and for all the children of v d satisfying r (and therefore with bit number strictly smaller than i), the bit value is 0. φx ,ȳ left (k) def = ∀w @x(nom(w, 1) ∧ @ 1 w (l)) → ∃w @ȳ(nom(w , 1) ∧ @ 1 w (l)) ∧ nb(x, w) = k nb(ȳ, w ) ∧ (@x ,w val ↔ @ȳ ,w val ) . Note that nb(x, w) = k nb(ȳ, w ) is well-defined as k − (d + 1) ≤ N − 2. Below, we define the formula nb(x) < k nb(ȳ) with k − d = N − 1,x = x 1 , . . . , x d andȳ = y 1 , . . . , y d . Based on previous developments and on standard arithmetical properties of numbers encoded in binary with k − d bits, we define the formula nb(x) < k nb(ȳ) as the expression As previously, the formula nb(x) = k nb(ȳ) is defined as follows: Lemma 4.4. Let T be a tree model, v be a node satisfying x,ȳ and, v d , v d are of type k − d.
Proof. By careful inspection of the presented formulae, cf. Appendix B.4.
Mainly, this allows us to prove Lemma 4.5(I).
Lemma 4.5. Let N ≥ 2, T be a tree model and v be one of its nodes.
Proof. Similar to the proof of Lemma 4.2, see Appendix B.5 for more details.
Consequently, for all k ≥ 0, type(k), first(k) and last(k) characterise exactly the discussed properties, and similarly for the formulae of form nb(ȳ) = k nb(x) + 1, nb(x) < k nb(ȳ), nb(x) = k nb(ȳ) wherex andȳ are of length d in [1, k] and k ≥ 1. It is natural to wonder what is the size of type(k), using a reasonably succinct encoding for formulae. As the definition of type(k) requires the subformulae type(k − 1), nb(x) = k nb(ȳ) and nb(ȳ) = k nb(x) + 1 (the other subformulae are of constant size), and the formula type(1) is quadratic in n, one can show that type(k) is of size 2 O(k+n) . This is sufficient for our purposes. 4.4. Uniform reduction leading to Tower-hardness. Let (P, c), where P = (T , H, V) and c = t 0 , t 1 , . . . , t n−1 be an instance of Tiling k known to be k-NExpTime-complete (see also [DGL16,Chapter 11]). We reduce the existence of a tiling τ : [0, t(k, n) − 1] × [0, t(k, n) − 1] → T , respecting the initial condition and the horizontal and vertical matching conditions, to the satisfiability of a formula φ in QCTL t X . To encode the grid [0, t(k, n) − 1] × [0, t(k, n) − 1], we consider a root node ε of type k + 1, and we distinguish t(k, n) children among all of its t(k + 1, n) children. Each child of ε has itself exactly t(k, n) children as it is a node of type k. In order to identify the t(k, n) first children of ε, we use an lsr-partition so that the unique child satisfying s has precisely the number t(k, n). This guarantees that exactly the children of ε whose numbers are in [0, t(k, n) − 1] satisfy r. So, the lsr-partition is used in a new context.
Below, we define the new formula nb = k t(k, n) that expresses that a node of type k has number t(k, n) (k ≥ 1). We recall that a node of type k takes its values in [0, t(k + 1, n) − 1]. Let us provide an inductive definition for nb = k t(k, n) with the base case k = 1.
Proof. By careful inspection of the semantics, cf. Appendix B.6. Let φ P be the formula built from the instance (P = (T , H, V), c) as follows: Definitions and explanations for φ cov , φ init , φ H and φ V follow but observe that an lsr-partition is performed for a node of type k + 1 and exactly t(k, n) children satisfy r thanks to the satisfaction of the subformula EX(s ∧ (nb = k t(k, n))). The formula φ cov states that every position in [0, t(k, n) − 1] × [0, t(k, n) − 1] has a unique tile: The tile types in T are understood as propositional variables. In order to access the root node ε to a node encoding a position of the grid, one needs first to access a child v of ε satisfying r (and this is done with the help of the local nominal x) and then to access any child v of v (done with the local nominal y). Then, to reason propositionally on v , it is sufficient to consider subformulae of the form @ x,y ψ. This principle is applied to all the formulae below. The formula φ H defined below encodes the horizontal matching constraints.
It remains to express the initial conditions. It is sufficient to identify the n first children of the first child of ε (identified by the satisfaction of first(k)). For example, to express that the jth child of the first child of ε (say v is this first child of ε) satisfies t j , perform an lsr-partition on v, enforce that the unique child satisfying s also satisfies t j and express that there are exactly j − 1 children of v satisfying r. This is a condition from graded modal logic that is easy to express. Let EX =i ψ be the formula below stating that exactly i ≥ 1 children satisfy ψ: ∃ q 1 , . . . , q i diff-nom(q 1 , . . . , q i , 1) ∧ AX((q 1 ∨ · · · ∨ q i ) ↔ ψ), where q 1 , . . . , q i are fresh propositional variables. By convention EX =0 ψ is defined as AX¬ψ.
The formula φ init is defined as ∃ l, s, r LSR ε (k) ∧ EX =i r ∧ EX(s ∧ t i )).
The correctness of the reduction is stated below. Lemma 4.7. P = (T , H, V), c = t 0 , t 1 , . . . , t n−1 is a positive instance of Tiling k iff φ P is satisfiable in QCTL t X . Proof. Given an instance P = (T , H, V), c = t 0 , t 1 , . . . , t n−1 of the tiling problem Tiling k , let τ : [0, t(k, n) − 1] × [0, t(k, n) − 1] → T be a tiling respecting all the constraints (init), (hori) and (verti). Below, we build a tree model T = V, E, l such that T, ε |= φ P where ε is the root node of T. Let V be the following subset of N * (set of finite sequences over N): • ε is the empty string and it belongs to V , The binary relation E is simply defined as: vEv def ⇔ v is a prefix of v , and v · α = v for some α ∈ N. So, (V, E) is a finite-branching tree such that all the maximal branches are infinite. The labelling map l is defined in a way so that T, ε |= type(k + 1). For instance, any node m k+1 , . . . , m 2 ∈ V ∩ N k−1 has 2 n children, and their numbers should span over [0, 2 n − 1]. This is easy to realise by setting properly the truth values for p n−1 , . . . , p 0 . Similarly, any node m k+1 , . . . , m 3 ∈ V ∩ N k−2 has t(2, n) children, and their numbers should span over [0, t(2, n) − 1]. Again, this is easy to realise by setting properly the truth values of val on the nodes in [0, t(k + 1, n) − 1] × · · · × [0, t(1, n) − 1]. So, it remains to take care of the propositional variables dedicated to the tile types.
In particular, this means that for all , there is exactly one tile type (understood as a propositional variable) satisfied by (i, j). • For all v ∈ V \ [0, t(k, n) − 1] × [0, t(k, n) − 1], the value of the set l(v) ∩ T is irrelevant.
It remains to check that which is routine and done in Appendix B.7.
We are ready to conclude the main theorem of this paper.
Theorem 4.8. SAT(QCTL t X ) is Tower-complete. Theorem 4.8 significantly improves the Tower lower bound from [LM14, Cor. 5.6] by considering as only temporal operator, the (local) modality EX. Tower-hardness can be also obtained with arbitrary countable trees. In Section 5 below, we show that this entails more Tower-hardness results for other fragments of QCTL t X and for modal logics with propositional quantification under appropriate tree semantics.

A harvest of Tower-complete modal and temporal logics
We capitalise on the Tower-hardness of the satisfiability problem for QCTL t X , by showing Tower-hardness of other fragments of QCTL t that involve only EF or its strict variant EXEF (Section 5.1). Tower-hardness is obtained by reduction from SAT(QCTL t X ) by introducing propositional variables that enforce layers from the root in the tree model and therefore this allows us to simulate EX. In Section 5.2, we consider well-known modal logics that are complete for classes of tree-like Kripke structures, and we show that their extension with propositional quantification for such classes of tree-like Kripke structures is decidable in Tower, but more importantly Tower-hard. Some of such classes involve finite trees and therefore, we also take the opportunity to study QCTL f t X and QCTL f t XF that happen, for instance, to be closely related to the modal logics QK t and QGL t , respectively. 5.1. The satisfiability problems for QCTL t F and QCTL t XF are Tower-hard! The fragment QCTL t F of QCTL t is defined according to the following grammar φ :: We recall the standard semantics for EF-formulae: T, v |= EFφ def ⇔ there is j ≥ 0 such that vE j v and T, v |= φ, and as usual, AGφ def = ¬EF¬φ. In order to show that SAT(QCTL t F ) is Tower-hard, we design a logarithmic-space many-one reduction from SAT(QCTL t X ). A more sophisticated analysis is also possible to establish Tower-hardness for even smaller fragments, see the recent work [Man20a].
Let φ be a formula in QCTL t X with modal depth md (φ) = k. Without loss of generality, we assume that φ may contain occurrences of EX and no occurrences of AX. Let us define the formula φ = trans(k, φ) ∧ shape(k) in QCTL t F , where the formula shape(k) enforces a discipline for layers (explained below) and trans(k, φ) admits a recursive definition, by relativising the occurrences of EX. We consider the set of propositional variables Y k = {layer −1 , layer 0 , . . . , layer k } with the intended meaning that a node satisfying layer i is of "layer i", the root node being of layer k. Indeed, there is a need for such propositional variables, as unlike with the formulae in QCTL t X , we have to enforce that moving with EF leads to a lower layer.
The formula shape(k) is defined as the conjunction of the following formulae. • Every node satisfies exactly one propositional variable from Y k (layer unicity): • When a node satisfies layer i with −1 ≤ i ≤ k, none of its descendants satisfies layer j with j > i (monotonicity of layer numbers): −1≤i≤k AG(layer i → AG(layer −1 ∨ layer 0 ∨ · · · ∨ layer i )) • When a node satisfies layer i with 0 ≤ i ≤ k, there is a descendant satisfying layer i−1 (weak progress): • When a node satisfies layer i with 0 ≤ i ≤ k, it has no (strict) descendant satisfying layer i (no stuttering). This type of constraints does not apply to layer −1 .
0≤i≤k AG(layer i → ¬∃p (p ∧ EF(layer i ∧ ¬p))) • The root node is at layer k: layer k . A tree model T = V, E, l for QCTL t with root ε is k-layered iff the conditions below hold: (a) For every node v ∈ V , card(l(v) ∩ Y k ) = 1.
(b) For all v ∈ V such that layer j ∈ l(v) for some j ∈ [−1, k], • if j ≥ 0, then there is v such that vEv and layer j−1 ∈ l(v ) and, • for all v such that vE + v and layer j ∈ l(v ), we have j ≤ j. (c) For all j ∈ [0, k], there are no distinct nodes v and v such that vE + v and layer j ∈ l(v) ∩ l(v ). (d) layer k ∈ l(ε), where ε is the root of the tree model. This means that the only propositional variable from Y k satisfied by a node reachable in j ∈ [1, k] steps from ε is layer m for some m ≤ k − j, and the only propositional variable from Y k satisfied by a node reachable in strictly more than k steps from ε is layer −1 . Moreover, once layer −1 holds true, it holds for all its descendants. Actually, the formula shape(k) characterises k-layered structures.
Lemma 5.1. Let T = V, E, l be a tree model for QCTL t with the root node ε. We have T, ε |= shape(k) holds if and only if T is k-layered.
Proof. By careful inspection of the semantics, cf. Appendix C.1.
• trans(i, p) def = p for all propositional variables p, • trans is homomorphic for Boolean connectives and trans(i, ∃ p ψ) Note that trans(k, φ) has no occurrence of layer −1 since md (φ) = k and that translating an EX-formula decreases the index of the layer by exactly one. The correctness of the reduction can be now stated as follows.
Hence we conclude yet another important result.
Theorem 5.3. The satisfiability problem for QCTL t F is Tower-complete. The Tower upper bound is established for the full logic QCTL t in [LM14] and in particular for QCTL t F . Theorem 5.3 also admits a variant in which we only allow to move to proper descendants. It amounts to replacing EF by EXEF (treated here as a single modality) in QCTL t F , leading to the variant QCTL t XF , with formulae obtained from φ :: As usual, we write AXAG ψ as an abbreviation of ¬EXEF¬φ.
Theorem 5.4. The satisfiability problem for QCTL t XF is Tower-complete. As above, the Tower upper bound for SAT(QCTL t XF ) is inherited from SAT(QCTL t ) [LM14]. Note that in QCTL t , the formula EFp is logically equivalent to p ∨ EXEFp. Thus, we get a (possibly exponential, which is sufficient for us) reduction from SAT(QCTL t F ) to SAT(QCTL t XF ), whence the Tower-hardness of SAT(QCTL t XF ). Recall that Towerhardness is defined with respect to elementary reductions and therefore an exponential-time reduction is fine to establish Tower-hardness, see e.g. [Sch16] and Section 2.3. 5.2. Modal logics with propositional quantification on trees. Numerous well-known modal logics are complete (a.k.a. determined) for classes of tree-like structures. A modal logic L (defined from the Hilbert-style system HL) is complete for a class of Kripke structures C iff the theoremhood of φ in HL is equivalent to the validity of φ in C (i.e. for all K ∈ C, for all w, we have K, w |= φ). For instance, the (propositional) modal logic K is complete for the class of finite trees [Seg71,BdRV01]. It is worth noting that a given modal logic can be complete for different classes of Kripke models (e.g. K is complete for the class of all the Kripke models, but also complete for the class of finite Kripke models) and their extension to propositional quantification may lead to distinct logics. Typically, K with propositional quantification under the structure semantics is undecidable [Fin70] whereas it is shown below to be Tower-complete under the finite tree semantics. Below, for the propositional modal logics L in K, KD, GL, K4 and S4 we define an extension QL t with propositional quantification under a class of tree-like models that is complete for the logic L.
In order to avoid too many notations, the modalities for each logic QL t are EX and AX (instead of the more standard modal operators 3 and 2) and therefore QL t formulae are built from the grammar below: φ :: • The propositional modal logic K is complete for the class of finite trees and we define QK t as the modal logic with propositional quantification over the class of finite trees. • The propositional modal logic KD (K with seriality, a.k.a. totality) is known to be complete for the class of finite-branching trees for which all the maximal branches are infinite. Indeed, KD is complete for the class of finite total Kripke models. Therefore by using the unfolding construction, completeness applies also for the class of finite-branching trees for which all the maximal branches are infinite, i.e. the models for QCTL t . Let QKD t be the modal logic with propositional quantification over the class of finite-branching trees for which all the maximal branches are infinite. The satisfiability problem for QKD t is exactly the problem for QCTL t X . • The modal logic GL is known to be complete for the class of finite transitive trees (GL is complete with respect to finite irreflexive transitive Kripke models [Smo85]), i.e. the class of Kripke structures V, E + , l such that V, E, l is a finite tree model, see e.g. [BdRV01]. Let QGL t be the modal logic with propositional quantification over the class of finite transitive trees, which is precisely QCTL f t XF . It is worth noting that adding propositional quantification to GL is studied in [AB93], where a fragment is shown to be decidable by translation into the weak monadic second-order logic of one successor WS1S [Büc60].
• The modal logic K4 is complete for the class of Kripke structures V, E + , l such that V, E, l is a finite-branching tree model (some branches may be infinite, some others not). Let QK4 t be the modal logic with propositional quantification over the class of finite-branching trees. • The modal logic S4 is complete for the class of finite Kripke structures such that the accessibility relation is reflexive and transitive, and therefore complete for the class of structures V, E * , l such that V, E, l is a finite-branching tree model in which all the branches are infinite (by unfolding). Let QS4 t be the modal logic with propositional quantification over the class of finite-branching trees in which all the branches are infinite (precisely the class of models for QCTL t ). The satisfiability problem for QS4 t happens to be exactly the problem for QCTL t F , modulo the fact that EX in QS4 t corresponds to EF in QCTL t F .
In this section, we show that the satisfiability problem for the logics QK t , QKD t , QGL t , QK4 t and QS4 t and whose models are tree-like Kripke structures is Tower-complete. For instance, QK t corresponds to the modal logic K interpreted on finite trees with propositional quantification, which is precisely QCTL f t X , i.e. QCTL f t restricted to the EX operator. Theorem 5.5. SAT(QK t ) is Tower-complete.
Proof. The satisfiability problem in Theorem 5.5 is exactly SAT(QCTL f t X ). An easy translation can be found in Appendix C.3.
As a corollary of Theorem 3.14, for all N ≥ 2, the satisfiability problem for QK t ≤N is AExp pol -complete too where QK t ≤N is interpreted on finite trees whose branching degree is at most N . The AExp pol lower bound can be obtained using the same reduction as for QCTL t X,≤N whereas the AExp pol upper bound uses also the same arguments as for QCTL t X,≤N . We have seen that QKD t is actually defined as QCTL t X (KD is characterised by total and finite Kripke structures whose unfoldings generate finite-branching trees in which all the branches are infinite). Consequently: Recall that the modal logic GL is known to be complete for the class of finite transitive trees. The logic QGL t extends it with propositional quantification. We obtain the following: Proof. The logic can be shown to be precisely QCTL f t XF when EX is translated into EXEF, whence we get a Tower upper bound. For the Tower-hardness proof, it is very similar to the one for QCTL t F (actually, it is a bit simpler). Consult Appendix C.4. QK4 t is defined as the modal logic with propositional quantification over the class of finite-branching trees. Our next theorem is as follows.
Proof. Full proof is in Appendix C.5. We first show SAT(QK4 t ) and SAT(QCTL gt XF ) are identical modulo the rewriting of EX into EXEF. This yields the Tower upper bound. As far as Tower-hardness is concerned, for any formula φ in QCTL t XF , one can show that φ is satisfiable for QCTL t XF iff φ ∧ EX EF ∧ AXAG EXEF is satisfiable in QCTL gt XF . Finally, by noting that QS4 t is equal to QCTL t F modulo that EX is rewritten into EF, using Theorem 5.3, we get the following complexity characterisation.

Conclusion
In the paper, we have developed a relatively simple proof method to show that the satisfiability problems for QCTL t X , QCTL t F and QCTL t XF are Tower-complete, see also similar methods in [Sto74,PHST19]. Our contribution is to establish Tower-hardness, which could be also shown for several modal logics with propositional quantification whose respective classes of models are tree-like structures. Moreover, in the case of fixed degree, we have shown that for all N ≥ 2, the satisfiability problem for the variant QCTL t X,≤N is AExp pol -complete. Whereas AExp pol -hardness is established by reducing the alternating multi-tiling problem recently introduced in [BMMP17], the Tower-hardness of SAT(QCTL t X ) is essentially based on the fact that one can enforce concisely that a node has a number of children equal to some tower of exponentials.
Section 5 deals with the Tower-completeness of SAT(QCTL f t X ) and SAT(QCTL f t XF ), as well as Tower-completeness for the well-known modal logics K, KD, GL, K4 and S4 extended with propositional quantification but with adequate classes of tree-like structures. Though the Tower upper bound for decision problems on trees should not come as a real surprise, all our Tower-hardness results significantly improve the current state-of-the-art regarding the fragments of QCTL t and for the above-mentioned modal logics. In particular, our proof technique for Tower-hardness of SAT(QCTL t X ) (and therefore for QK t on finite trees) is simple enough so that it could be further reused or adapted, see e.g. a recent refinement of the proof in [BDFM20].
This work can be continued in several directions. For instance, Tower-hardness of SAT(QCTL t F ) is recently refined in [Man20b,Man20a] by establishing that already QCTL t F restricted to formulae of modal/temporal depth two is also Tower-hard. Among the several directions, one of them would be to characterise the expressiveness of QCTL t X or QCTL t F along the lines of [DLM16] or [Kuu15], see also [AvBG18]. More generally, we believe that standard modal logics with propositional quantification, but under the tree semantics, deserve to be much better understood. Proof. First, suppose that x is a nominal for the depth k ≥ 0 from v. By definition, this Because of the constraint on the satisfaction of the propositional variable p, the nodes v and v are distinct, which leads to a contradiction. Conversely, suppose that T, v |= nom(x, k). As T, v |= EX k x, there exists v such that vE k v and T, v |= x. The uniqueness of v can be concluded from the satisfaction ¬∃p (EX k (x ∧ p) ∧ EX k (x ∧ ¬p)) (as above), since that formula characterises exactly the property that there are no two distinct nodes reachable in k steps from v satisfying x.

A.2. Proof of Lemma 3.3.
Proof. By assumption, there is a node v ∈ V satisfying vE k v such that T, v |= x, and for all v = v satisfying vE k v , we have T, v |= x. First, suppose that T, v |= @ k x φ, i.e. T, v |= EX k (x ∧ φ). Hence, there exists v such that vE k v and T, v |= x ∧ φ. As T, v |= x, the node v is necessarily equal to v and therefore T, v |= φ. For the opposite direction, suppose that T, v |= φ. As vE k v and T, v |= x, by the definition of the satisfaction relation |=, we conclude that T, v |= EX k (x ∧ φ) and EX k (x ∧ φ) is equal to @ k x φ.
Proof. The proof is by induction on d. For the base case, suppose that d = 1. Thus, we have that T, v 0 |= nom(x 1 , 1), and that v 1 is the unique child of v 0 such that v 0 Ev 1 and T, v 1 |= x 1 . By Lemma 3.3, we have T, v 0 |= @ 1 x 1 φ iff T, v 1 |= φ and @ x 1 φ is equal to @ 1 x 1 φ, so we are done. For the induction step with d ≥ 2, let us assume that and v 1 , . . . , v d is associated to x 1 , . . . x d . The propositions below are equivalent 3.3).
Hence, T, v 0 |= @xφ holds iff T, v d |= φ holds, finishing the proof. Proof. By way of example, we prove that EX ∀ p ψ ↔ ∀ p EXψ is valid. (Other formulae, e.g. EX ∃ p ψ ↔ ∃ p EXψ can be proved to be valid in an even simpler way). Before doing so, note that then the valid equivalences below provide a rewriting system (by reading the equivalences from left to right) that pushes the propositional quantification outside (in the usual way), leading to formulae in PNF in polynomial-time (Q ∈ {∃, ∀}).
assuming that p does not occur in ψ (otherwise, rename the quantified variable). First, assume that T, v |= EX ∀ p ψ with T = V, E, l . Thus, there exists v such that vEv and T, v |= ∀ p ψ. Hence, for all T ≈ AP \{p} T, we have T , v |= ψ. As v remains a child of v for all such variants T , we have that for all T ≈ AP \{p} T, vE v and T , v |= ψ. Thus, for all T ≈ AP \{p} T we have T , v |= EXψ. We conclude T, v |= ∀ p EXψ.
Conversely (and this is the place where the tree structure is essential), assume T, v |= ∀ p EXψ. It means that for all T ≈ AP \{p} T, we have T , v |= EXψ. Ad absurdum, where denotes the disjoint sum. One can show that T ≈ AP \{p} T and for all v such that vEv , T , v |= ψ, which leads to a contradiction.
Proof. We start with the first item of the lemma. The definition of τ is correct, since: • for each position (x, y) ∈ [0, 2 n − 1] × [0, 2 n − 1] there is a unique node v in the distance 2n from v encoding the position (x, y) (follows from Corollary 3.11), • for each v , as defined above, there is a unique tile proposition t j such that T, v |= t j holds (it is a direct consequence of the satisfaction of φ j cov at v). The satisfaction of the conditions (hori) and (verti) follows from the satisfaction of φ j H ∧ φ j V . Indeed, let us discuss the condition (hori) only, since (verti) is analogous. Take any two consecutive positions (a, b) and (a, b + 1) such that τ (a, b) = t and τ (a, b + 1) = t . Then, let v t , v t be nodes at the distance 2n from v, representing the positions (a, b) and (a, b + 1). Set the local nominals x and y at v t and v t . Then, note that the formula HN(x, y) is satisfied at v by elementary operations on binary encodings of numbers. Hence, by the right-hand side of the implication in φ j H we conclude that (t, t ) ∈ H. To show the second item, we take T = V, E, l obtained from T = V, E, l by setting l (v (a,b) ) = (l (v (a,b) ) \ T j ) ∪ {τ (a, b)} for the unique node v (a,b) at the distance 2n from v corresponding to (a, b) in the grid. Otherwise l and l coincide. Since the formula grid(2n) does not employ propositions from T j we conclude T , v |= grid(2n). By the definition of τ we know that each node at the distance 2n from v is labelled with exactly one tile proposition from T j and hence, T , v |= φ j cov . Checking that T , v satisfies φ j H ∧ φ j V is routine and follows from the fact that τ is a tiling (so it satisfies (hori) and (verti)).
Proof. Let I be the instance n, T , H, V , T 0 , T acc , T multi of AMTP. Before showing that the reduction is correct, we need to state preliminary properties. Moreover, in the proof below, we repeat several formula definitions to follow more smoothly the technical developments.
(GRID) We recall that grid(2n) is defined as the formula below Given a tree model T and a root node ε, one can show that T, ε |= grid(2n) iff the properties below hold: (a) For all j ∈ [0, 2n − 1], we have that εE j v implies that v has exactly two children.
(b) For all distinct nodes v, v such that εE 2n v and εE 2n v , there is some propositional variable r in {h n−1 , . . . , h 0 , v n−1 , . . . , v 0 }, such that v satisfies r iff v does not satisfy r. Satisfaction of (a) is essentially due to the fact that EX =2 is defined as and one can check that it holds true on nodes having exactly two children. For the satisfaction of (b), we need to invoke Lemma 3.2, Lemma 3.3 and Lemma 3.5. Assuming that diff-nom(x, y, 2n) holds, (b) is equivalent to have two distinct nodes that are the respective interpretations of the nominals x and y for the depth 2n. More generally, Lemma 3.12 states the main properties that are used about grid(2n).
(TILING) Let us state a few properties about the conjunction φ j cov ∧ φ j H ∧ φ j V assuming that T, ε |= grid(2n) (and therefore the set of nodes of distance 2n from the root encodes the grid [0, 2 n − 1] × [0, 2 n − 1]). The formula φ j cov defined as states that all the nodes at distance 2n from the root satisfy exactly one tile type from T j . This is again a consequence of Lemma 3.2 and Lemma 3.3. The formula φ j H is defined as: where HN(x, y) is the formula below: The formula HN(x, y) expresses that, assuming that x and y for the depth 2n, the two nodes at distance 2n interpreted respectively by constraints for the set of tile types T j . Indeed, in VN(x, y) we swap the variable h α with the variable v α (with respect to the definition for HN(x, y)), which amount to stating that assuming that x and y are nominals for the depth 2n from ε, the two nodes at distance 2n interpreted respectively by x and y and representing respectively the positions (H, V) and (H , V ) of the grid, satisfies V = V + 1 and H = H. So, assuming that T, ε |= grid(2n), the formula φ j cov ∧ φ j H ∧ φ j V expresses that the way the tile types from T j holds on the nodes at distance 2n from the root defines a proper tiling.
(INIT) Let φ j init be the formula below: Note that ( α∈[0,n−1] ¬h α ) states on a node v at distance 2n from the root, that all the propositional variables h α are false and therefore this is a node on the row zero of the grid. φ j init therefore states (using again Lemma 3.2 and Lemma 3.3) that all the nodes of the row zero have a unique tile type from T 0 .
(COINCI) Let φ j,j coinci be the formula below (with j, j ∈ N): Assuming that T, ε |= φ j tiling ∧ φ j init , the formula φ j,j coinci states that for every node of the row zero, the tile type from T j is the same as the tile type from T j 0 . The reasoning is exactly the same as for (INIT).
(ACCEPT) Let φ j acc be the formula below Note that ( α∈[0,n−1] h α ) states on a node v at distance 2n from the root, that all the propositional variables h α are true and therefore this is a node on the (last) row 2 n − 1 of the grid. Assuming that T, ε |= φ j tiling , the formula φ j acc therefore states that there is a node encoding a position of the grid on the last row such that the tile type is in T j acc . (MULTI) Finally, let φ j multi be the formula below: As done in (INIT), φ j multi (assuming that T, ε |= φ j tiling ∧ φ j+1 tiling ) states that for all nodes at distance 2n from the root, the tile type from T j and the tile type from T j+1 are in the relation T multi . Consequently, if and only if the initial condition induced from the satisfaction of ( j∈[1,n] φ j init ) (see the definition of AMTP in Section 2.3) of the form (w 1 , . . . , w n ) ∈ (T 2 n 0 ) n , and the multitiling (τ 1 , . . . , τ n ) induced by the satisfaction of ( j∈[n+1,2n] φ j tiling ), entails that (τ 1 , . . . , τ n ) is a solution and satisfies the condition (m-init), (m-tiling), (m-multi) and (m-accept). Indeed, satisfying T, ε |= grid(2n) ∧ ( j∈[n+1,2n] φ j tiling ) defines a multi-tiling (τ 1 , . . . , τ n ) (and reciprocally). Similarly, satisfying T, ε |= grid(2n) ∧ ( j∈[1,n] φ j init ) defines an initial condition (w 1 , . . . , w n ) ∈ (T 2 n 0 ) n (and reciprocally). The details are omitted but it does not pose any difficulty. So given an initial condition c = (w 1 , . . . , w n ) ∈ (T 2 n 0 ) n , we write T c to denote a tree model such that T c , ε |= grid(2n) ∧ ( j∈[1,n] φ j init ) and on the grid induced by T c , we have precisely the initial condition c. Similarly, given a multi-tiling M = (τ 1 , . . . , τ n ), we write T M to denote a tree model such that T M , ε |= grid(2n) ∧ ( j∈[n+1,2n] φ j tiling ) and on the grid induced by T M , we have precisely the multi-tiling (τ 1 , . . . , τ n ). More generally, given c and M , we write T c,M to denote a tree model such that T c,M , ε |= grid(2n) ∧ ( j∈[1,n] φ j init ) ∧ ( j∈[n+1,2n] φ j tiling ) and on the grid induced by T c,M , we have precisely the initial condition c and the multi-tiling M . Reciprocally, assuming a tree model T such that T, ε |= grid(2n) ∧ ( j∈[1,n] φ j init ), we write c T = (w 1 , . . . , w n ) to denote the initial condition from the grid defined by T. Similarly, assuming a tree model T such that T, ε |= grid(2n) ∧ ( j∈[n+1,2n] φ j tiling ), we write M T = (τ 1 , . . . , τ n ) to denote the multi-tiling from the grid defined by T.
Proof. The property (III) is a direct consequence of (II). Since the proof of (II) is similar to (I), we focus on showing (I) only. In order to define nb(y 1 , . . . , y k ) = k nb(x 1 , . . . , x k ) + 1, and therefore to express that nb T (v k ) = nb T (v k ) + 1 with numbers computed with the propositional variables p n−1 , . . . , p 0 , we perform a standard comparison of the respective truth values of p n−1 , . . . , p 0 for the node v k (the interpretation of x k ) and for the node v k (the interpretation of y k ). Typically, , v k and v k agree on p j (nb T (v k ) and nb T (v k ) agree on their jth bit), • v k does not satisfy p i and v k satisfies p i (nb T (v k ) and nb T (v k ) disagree on their ith bit and the ith bit of nb T (v k ) is equal to zero), • for every j ∈ [0, i − 1], v k satisfies p j and v k does not satisfy p j . The formula nb(y 1 , . . . , y k ) = k nb(x 1 , . . . , x k ) + 1 indeed quantifies existentially on i via a generalised disjunction and the three conditions are checked by three conjuncts in the standard manner.

B.2. Proof of Lemma 4.2.
Proof. We focus on proving (I), the other properties can be shown analogously.
A node v is of type 1 iff it has exactly 2 n children, say v 0 , . . . , v 2 n −1 , and for all j ∈ [0, 2 n − 1], the number associated to v j is precisely j when encoded with the truth values of the propositional variables p n−1 , . . . , p 0 . The latter proposition amounts to having the following conditions: (a) The node v has a child whose number is zero. (b) If v is a child of v with number m < 2 n − 1, then v has also a child with number m + 1. (c) Two distinct children of v have distinct numbers. Let us recall that type(1) = AX(type(0)) ∧ EX(first(0)) ∧ uniq(1) ∧ compl(1). Obviously, AX(type(0)) always holds and EX(first(0)) expresses exactly the condition (a). It remains to show that uniq(1) (resp. compl(1)) characterises the conditions (c) (resp. the condition (b)). The formula uniq(1) is equal to ∀x, y diff-nom(x, y, 1) → ¬(nb(x) = 1 nb(y)). By Lemma 4.1(III), and by Lemma 3.5, when interpreted on a node of type 1, uniq(1) states that for any two distinct children, their respective numbers are different, which is precisely the condition (c). Finally, let us recall the definition of the formula compl(1): ∀x (nom(x, 1) ∧ @ 1 x (¬last(0))) → ∃y nom(y, 1) ∧ nb(y) = 1 nb(x) + 1. By Lemma 4.1(I), by the fact that last(0) already characterises the nodes of type 0 whose number is 2 n − 1. By Lemma 3.2 and Lemma 3.3, the formula compl(1), states that for all children whose number m is different from 2 n − 1, there is a child with number m + 1, which is precisely the condition (b). This ends the proof as all the formulae AX(type(0)), EX(first(0)), uniq(1), compl(1) capture exactly the properties specified above.
Proof. Assume that v 0 is of type k, T, v 0 |= x,x and the witness branch is v 0 , . . . , v d . First, suppose that T, v |= LSRx(k). As T, v 0 |= @x(EX =1 (s)), by Lemma 3.4, T, v d |= EX =1 (s). It is easy to show that EX =1 ψ holds whenever there is a unique child satisfying ψ. Consequently, there is a unique child of v d satisfying s, which corresponds to the satisfaction of (b). As T, v 0 |= @x (AX((s ∨ l ∨ r) ∧ ¬(s ∧ l) ∧ ¬(s ∧ r) ∧ ¬(l ∧ r))), by Lemma 3.4, we have T, v d |= AX((s∨l∨r)∧¬(s∧l)∧¬(s∧r)∧¬(l∧r)) and therefore for all children v of v d , we have T, v |= (s∨l∨r)∧¬(s∧l)∧¬(s∧r)∧¬(l∧r). As the formula (s∨l∨r)∧¬(s∧l)∧¬(s∧r)∧¬(l∧r) precisely states that exactly one propositional variable among {l, s, r} holds true, we can conclude that (a) is satisfied. Moreover, T, v 0 |= LSR 3 x (k) and by Lemma 3.4, we have that T, v d |= ∀w∀w diff-nom(w, w , 1)∧((@ 1 w (s)∧@ 1 w (r))∨(@ 1 w (l)∧@ 1 w (s))) → nb(w ) < k−d nb(w). As k − d − 1 ≤ N − 2 by assumption, the satisfaction of the formula above on v d straightforwardly states that for all children v and v of v d such that (v satisfies s and v satisfies r) or (v satisfies l and v satisfies s), we have nb T (v) < nb T (v ) (here we use the induction hypothesis), which corresponds precisely to the satisfaction of (c). The proof in the other direction is quite similar as there are equivalences between the formulae LSR 1 x (k), LSR 2 x (k), and LSR 3 Proof. Let T be a tree model and v be such that v satisfies x,ȳ, k − d = N − 1 and v d and v d are of type k − d. We will focus on the proof of (I) only. The proof of (II) is similar to the proof of (I) and (III) is a direct consequence of (II). Hence, we omit the details.
As v d and v d are of type k − d, both have t(k − d, n) children. Those children are ordered, let u 0 , . . . , u t(k−d,n)−1 be the children of v k such that nb(u j ) = j for all j. Similarly, let u 0 , . . . , u t(k−d,n)−1 be the children of v k such that nb(u j ) = j for all j. By arithmetical reasoning, we have nb and nb T (v d ) agree on the jth bit, which is equivalent to u j and u j agree on val , (B) the ith bit of nb T (v d ) is equal to 0 and the ith bit of nb T (v d ) is equal to 1, which is equivalent to u i does not satisfy val and u i satisfies val , (C) for every j ∈ [0, i − 1], the jth bit of nb T (v d ) is equal to 1 and the jth bit of nb T (v d ) is equal to 0, which is equivalent to u j satisfies val and u j does not satisfy val . By using Lemma 3.4, it is easy to check that the condition (A) (resp. (B), (C)) is taken care by φ left (k) (resp. φ select (k), φ right (k)). This is quite immediate for φ select (k) and φ right (k), as no induction hypothesis is used, in particular no comparison between numbers is performed. Concerning the satisfaction of φ left (k), we have to be more careful. Let us recall the definition of the formula φx ,ȳ left (k) below: ∀w @x(nom(w, 1) ∧ @ 1 w (l)) → ∃w @ȳ(nom(w , 1) ∧ @ 1 w (l)) ∧ nb(x, w) = k nb(ȳ, w ) ∧ (@x ,w val ⇔ @ȳ ,w val ) . We have defined φ left (k) as φx ,ȳ left (k) ∧ φȳ ,x left (k). By Lemma 3.4, and by the induction hypothesis (as (k − (d + 1)) ≤ N − 2), φx ,ȳ left (k) enforces that for all children v of v d satisfying l, there is a child v of v d satisfying l, such that v and v agree on val . Moreover, φȳ ,x left (k) enforces that for all children v of v d satisfying l, there is a child v of v d satisfying l, such that v and v agree on val . So, the set of numbers of the children of v d satisfying l is equal to the set of numbers of the children of v d satisfying l. This implies also that this property applies for the children satisfying r, and the number of the unique child of v d satisfying s is equal to the number of the unique child of v d . This is a direct consequence of the properties of lsr-partitions (see Lemma 4.3). Consequently, nb T (v d ) = nb T (v d ) + 1 implies nb(ȳ) = k nb(x) + 1. The proof for the other direction is similar, as φ left (k) is equivalent to (A), φ select (k) is equivalent to (B) and φ right (k) is equivalent to (C). Moreover, the existential quantification over i corresponds to the existential quantification leading to an lsr-partition. Obviously, the formula AX(type(N − 1)) expresses exactly the condition (b), assuming that type(N − 1) already characterised the nodes of type N − 1. Similarly, the formula EX(first(N − 1)) expresses exactly the condition (a ), assuming that first(N − 1) already characterises the nodes of type N − 1 whose number is zero. It remains to show that uniq(N ) (resp. compl(N )) characterises the conditions (c ) (resp. the condition (b )).
By Lemma 4.4(III), and by the fact that diff-nom(x, y, 1) enforces that x and y are interpreted by two distinct children (see Lemma 3.5), when interpreted on a node of type N , the formula uniq(N ) states that for any two distinct children, their respective numbers are different, which is precisely the condition (c ). Finally, let us recall the formula compl(N ): ∀x (nom(x, 1) ∧ @ 1 x (¬last(N − 1))) → ∃y nom(y, 1) ∧ nb(y) = N nb(x) + 1. By Lemma 4.4(I), by the fact that last(N − 1) already characterises the nodes of type N − 1 whose number is t(N, n) − 1 and by the properties of the subformulae nom(x, 1) and nom(y, 1) enforcing local nominals x and y, the formula compl(N ), when interpreted on a node of type N , states that for all children whose number m is different from t(N, n) − 1, there is a child with number m + 1, which is precisely the condition (b ). This ends the proof as the formulae AX(type(N − 1)), EX(first(N − 1)), uniq(N ), compl(N ) capture (a )+(b )+(c ). Proof. The case of k = 0 is trival, so take for the case case k = 1. Assuming that T, v |= type(1), the node v is of type 1, and therefore v has exactly t(1, n) = 2 n children. The number nb T (v) is determined by the truth values of val on its children, and the children have themselves (bit) numbers spanning all over [0, 2 n − 1] and the numbers are encoded by the truth values of p n−1 , . . . , p 0 . Consequently, nb T (v) = t(1, n) = 2 n iff the unique child v of v such that nb T (v ) = n satisfies val and all the other children do not satisfy val . If the value n encoded with n bits is represented by the sequence of bits b n−1 b n−2 · · · b 0 , then X n = n is a shortcut for i∈[0, For the induction step, we reason in a similar way. Assume that for all 1 ≤ k < k, if T , v |= type(k ), we have nb T (v ) = t(k , n) iff T, v |= nb = k t(k , n). Now, assume that T, v |= type(k), the node v is of type k, and therefore v has exactly t(k, n) children. The number nb T (v) is determined by the truth values of val on its children, and the children have themselves (bit) numbers spanning all over [0, t(k, n) − 1]. Consequently, nb T (v) = t(k, n) iff the unique child v of v such that nb T (v ) = t(k − 1, n) satisfies val and all the other children does not satisfy val . Indeed, if only the t(k − 1, n)th bit is equal to 1, nb T (v) is equal to 2 t(k−1,n) , which is precisely t(k, n). Now, checking whether a node of type k − 1, has value t(k−1, n) can be expressed by nb = k−1 t(k−1, n) invoking the induction hypothesis. Putting all together, we get nb T (v) = t(k, n) iff T, v |= AX(val ↔ (nb = k−1 t(k − 1, n))). B.7. More details on the proof of Lemma 4.7.
Proof. We have seen that the satisfaction of type(k+1) is guaranteed by the way propositional variables hold on the nodes. Observe that for the nodes in [0, t(k + 1, n) − 1] × · · · × [0, t(1, n) − 1] × 0 + , the truth values of the propositional variables is irrelevant. Moreover, for all j ∈ [1, k + 1], for all m k+1 , . . . , m j ∈ [0, t(k + 1, n) − 1] × · · · × [0, t(j, n) − 1], we have nb T (m k+1 , . . . , m j ) = m j . In order to check the satisfaction of the existentially quantified subformula, we consider the labelling l variant of l only for the propositional variables l, s, and r such that l holds on [t(k, n) + 1, t(k + 1, n) − 1], s holds on t(k, n), and r holds on [0, t(k, n) − 1]. By Lemma 4.3, V, E, l , ε |= LSR ε (k + 1) and by Lemma 4.6, we have V, E, l , ε |= EX(s ∧ nb = k t(k, n)). The satisfaction of the formulae φ cov , φ H and φ V is inherited from the fact that for all (i, j) ∈ [0, t(k, n) − 1] × [0, t(k, n) − 1], there is exactly one tile type satisfied by (i, j) and the mapping τ satisfies horizontal and vertical matching conditions. Here, we use the properties of the formulae of the form nom(x, 1), @ 1 x ψ, nb(x) = k+1 nb(x ) and nb(x, y ) = k+1 nb(x, y) + 1 (see e.g. Lemma 4.4), apart from the fact that r holds exactly on the nodes in [0, t(k, n) − 1]. Concerning the satisfaction of φ init , first observe that EX =j ψ holds true exactly when there are j children of the node satisfying the formula ψ. Hence, the formula below ∀ x (nom(x, 1) ∧ @ 1 x (first(k))) → @ 1 x ( j∈[0,n−1] ∃ l, s, r LSR ε (k) ∧ EX =j r ∧ EX(s ∧ t j )) states for all (i, j) ∈ {0} × [0, n − 1], t j holds on it. In order to access the jth child of {0}, an lsr-partition on the children of {0} is performed and s holds true exactly on (i, j) by counting how many children satisfies r. The proof for the other direction uses similar principles and is omitted herein. The main idea is to build τ so that assuming that T, ε |= φ P , for all v, v such that ε E v E v , and (nb(v), nb(v )) ∈ [0, t(k, n) − 1] × [0, t(k, n) − 1], τ (nb(v), nb(v )) takes the value of the unique t in T satisfied on the node v .
Appendix C. Proofs from Section 5 C.1. Proof of Lemma 5.1.
Proof. First, let us suppose that T is k-layered and we show that T, ε |= shape(k).
• By the first point of the condition (b), for all i ∈ [0, k], we have T, ε |= AG(layer i → EF layer i−1 ). Actually, when T, v |= layer i the witness descendant satisfying layer i−1 is a child of v by (b). • By the condition (d), we have T, ε |= layer k .
• By the condition (c), for every node v satisfying layer j for some j ∈ [0, k], there is no proper descendant of v satisfying layer j . Observe that the formula ¬∃p (p ∧ EF(layer j ∧ ¬p)) holds exactly on the nodes such that there is no proper descendant satisfying layer j . Hence T, ε |= 0≤i≤k AG (layer i → ¬∃p (p ∧ EF(layer i ∧ ¬p))) .
Conversely, suppose that T, ε |= shape(k) holds. The satisfaction of (a), (c) and (d) holds thanks to the corresponding formulae in shape(k) (see above). Let us check that (c) holds true. As T, ε |= 0≤i≤k AG(layer i → ¬∃p (p ∧ EF(layer i ∧ ¬p))) holds and for all i ∈ [0, k], we have T, ε |= AG(layer i → EF layer i−1 ), on the same branch two distinct nodes cannot satisfy layer i for some i ∈ [0, k]. Moreover, the satisfaction of layer i implies that some (proper) descendant satisfies layer i−1 . Due to the monotonicity of the layer numbers and no stuttering, layer i implies that a child satisfies layer i−1 , which corresponds to the first point of (b). The second point of (b) is a consequence of the monotonicity of the layer numbers. Proof. First, let us assume that φ (md (φ) = k ≥ 0) is satisfiable for QCTL t X , i.e. T, ε |= φ holds with the tree model T = V, E, l . Let T = V, E, l be the tree model obtained from T by providing truth values for the propositional variables in Y k . More precisely, for all v ∈ V with εE j v, we have that l (v) def = (l(v) \ Y k ) ∪ {layer max(−1,k−j) }. As T is a tree model, εE j v implies that j is the unique number of steps to reach v from ε. Obviously, T is k-layered and hence, by Lemma 5.1, T , ε |= shape(k) holds. Moreover, by structural induction, one can show that for all j ∈ [0, k], for all v ∈ V with εE (k−j) v, and for all subformulae ψ of φ of modal depth less than j, T, v |= ψ if and only if T , v |= trans(j, ψ). This leads to the satisfaction of T , ε |= trans(k, φ).
• For the base case j = 0, for all formulae ψ of modal degree 0, we have T, v |= ψ iff T , v |= trans(0, ψ) due to the fact that trans(0, ψ) = ψ and, that T and T agree on the propositional variables occurring in φ. • For the induction step, the proof for the cases with Boolean connectives is immediate.
• We now consider the case with propositional quantification. Suppose that T, v |= ∃ p ψ.
Hence, there is T = V, E, l such that T ≈ AP \{p} T and T , v |= ψ. Let T = V, E, l be the variant obtained from T such that for all v ∈ V with εE j v , we have l (v ) def = (l (v ) \ Y k ) ∪ {layer max(−1,k−j) }. By the induction hypothesis, T , v |= trans(j, ψ). It is easy to check that T ≈ AP \{p} T and therefore T , v |= ∃ p trans(j, ψ). The proof for the other direction is analogous.
• Finally, we consider the case with EX. First, let us suppose that T, v |= EXψ with εE (k−j) v and the modal depth of ψ is less than j. Hence, there is v such that vEv and T, v |= ψ. Thus, εE (k−(j−1)) v and therefore v satisfies layer j−1 in T . By the induction hypothesis (ψ is also of modal depth less than j −1), we conclude T , v |= layer j−1 ∧trans(j −1, ψ). As v is also a child of v in T (and therefore a descendant), we obtain T , v |= EF(layer j−1 ∧ trans(j−1, ψ)). Conversely, suppose that T , v |= EF(layer j−1 ∧trans(j−1, ψ)). Thus, there is a descendant v such that vE * v and T , v |= layer j−1 ∧ trans(j − 1, ψ). By definition of l , we have εE k−j+1 v and therefore vEv . By the induction hypothesis, we obtain T, v |= ψ (again, ψ is also of modal depth less than j − 1), which implies T, v |= EXψ.
For the other implication, we assume that trans(k, φ) ∧ shape(k) is satisfiable for QCTL t F , that is T, ε |= trans(k, φ) ∧ shape(k) holds with the tree model T = V, E, l and md (φ) = k ≥ 0. By Lemma 5.1, the tree model T is k-layered and therefore satisfying layer i and jumping to a node with the help of EF(layer i−1 ∧ . . .) leads to a child node (assuming that i ∈ [0, k]). Let T = V , E , l be the tree model defined as follows: • V is the least subset of V satisfying the conditions below: ε ∈ V , if v ∈ V and layer j ∈ l(v) for some j ∈ [0, k], then for all v ∈ V such that layer j−1 ∈ l(v ) and vEv , then v ∈ V . The children of v that do not satisfy layer j−1 are ignored in T . • l is the restriction of l to V .
• For all v, v ∈ V , vE v def ⇔ one the conditions below holds: layer −1 ∈ l(v) ∩ l(v ) and vEv .
-For some j ∈ [0, k], vEv , layer j ∈ l(v) and layer j−1 ∈ l(v ). It is not difficult to check that T is a tree model (finite-branching tree and all the maximal branches are infinite), as T satisfies the formula below (due to the satisfaction of shape(k)): Similarly to what we did above, by structural induction, one can show that for all j ∈ [0, k], for all v ∈ V such that layer j ∈ l(v), and for all subformulae ψ of φ of modal depth less than j, we have T, v |= trans(j, ψ) iff T , v |= ψ. This leads to the satisfaction of T , ε |= φ as T, ε |= layer k holds by the satisfaction of shape(k).
• For the base case j = 0, for all formulae ψ of modal degree 0, we have T, v |= trans(0, ψ) iff T , v |= ψ due to the fact that trans(0, ψ) = ψ and, T and T agree on the propositional variables occurring in φ. • For the induction step, the proof for the cases with Boolean connectives and propositional quantification is by easy verification (cf. the proof in the other direction). • Let us treat in depth the case with EXψ, with layer j ∈ l(v) and EXψ is of modal depth less than j. Suppose that T, v |= trans(j, EXψ). So, this means that T, v |= EF(layer j−1 ∧ trans(j − 1, ψ)). There is v ∈ V such that vE * v and T, v |= layer j−1 ∧ trans(j − 1, ψ). As T is a k-layered tree model, necessarily vEv (otherwise there are two distinct nodes on the branch from v such that either both satisfy layer j or both satisfy layer j−1 , which leads to a contradiction). By definition of E , we get vE v and by the induction hypothesis (ψ is also of modal depth less than j − 1), we get T , v |= ψ. Hence, we obtain T , v |= EXψ. Conversely, assume that T , v |= EXψ. Thus, there exists v ∈ V such that vE v and T , v |= ψ. By definition of E , T, v |= layer j−1 and hence, by the induction hypothesis, we get T, v |= layer j−1 ∧ trans(j − 1, ψ). As one can check that E ⊆ E and hence, we conclude that T, v |= EF(layer j−1 ∧ trans(j − 1, ψ)).
Proof. As far as Tower-hardness is concerned, in order to enforce finite tree models, it is sufficient to consider the reduction defined for QCTL t X in Section 4 but to modify the definition of the formula type(0) so that type(0) is now equal to ¬EX . In that way, the finite grids of the form [0, t(k, n) − 1] × [0, t(k, n) − 1] can still be encoded but with finite tree models.
In order to get the Tower upper bound, let us define a reduction to the satisfiability problem for QCTL t by simply identifying finite trees within tree models for QCTL t (known to be in Tower by [LM14]). Let φ be a formula in QK t . Without loss of generality, we assume that φ may contain occurrences of EX and no occurrences of AX. We introduce the formula trans(φ) ∧ φ fin in QCTL t , where φ fin enforces that the fresh propositional variable in holds true only finitely on each branch and trans(φ) admits a recursive definition, by relativising the occurrences of EX with respect to in. Let φ fin be the formula in ∧ AF ¬in ∧ AG(¬in → AG ¬in). The satisfiability of φ fin at the root node ε implies that in holds exactly on a subtree from ε where all the branches are finite. It remains to define trans(φ): • trans(p) def = p for all propositional variables p, and trans is homomorphic for Boolean connectives and propositional quantification, • trans(EXψ) def = EX(in ∧ trans(ψ)).