Proof of the algorithm. The proof considers the system model BAMPn,t[t < n/(m + 1), LRC], the algorithmic safety and liveness constraints on W , namely, W (k + 1) > n and n − t ≥ (W − 1)k + 1, and the non-triviality condition (k < m) ∧ (k ≤ t). Preliminary remark 1 The proof considers the semantic of the messages DECIDE() described pre- viously. This is equivalent to consider that, after it has decided, a correct process continues executing while skipping line 8. Notation Given a round r, let EST [r] be the set of estimate values of the correct processes when they start round r, and AUX [r] be the set including the values of the auxi variables of the correct processes at the end of the first phase of round r (i.e., just after line 5). let us notice that AUX [r] can contain ⊥. Preliminary remark 2 The proof of the MV-Obligation property requires that at most m different val- ues are MV-broadcast. Hence, this requirement extends to the invocations SMV broadcastPHASE[r, x](), where x ∈ {1, 2}. By assumption, this requirement is initially satisfied, namely, |EST [1]| ≤ m. We will see in the proof that (i) AUX [r] contains at most k values proposed by correct processes plus pos- sibly ⊥, (ii) viewi[r, 2] is a subset of AUX [r], and (iii) mv validi[1, 1] contains only values proposed by correct processes. From the previous observations we conclude that at most m different values are SMV-broadcast at line 4 and line 6 of Algorithm 4.
Lemma 1. If a correct process decides a value, this value was proposed by a correct process.
Proof of the algorithm. Lemma 1 (Set agreement and Termination under Obstruction-freedom). Any par- ticipating process that runs alone for a sufficiently long time, eventually decides. More- over, the processes that decide, decide on at most n — 1 different values.
Proof of the algorithm. 7 The proof considers the system model BAMPn,t[t < n/(m + 1), LRC], the algorithmic safety and 8 liveness constraints on W , namely, W (k + 1) > n and n − t ≥ (W − 1)k + 1, and the non-triviality 9 condition (k < m) ∧ (k ≤ t). 12 Preliminary remark 1 The proof considers the semantic of the messages DECIDE() described pre-
Proof of the algorithm. The proof considers that (1) k = t, i.e., the size of the new name space of the underlying adaptive renaming is M = p + t— 1 when p processes participate, and (2) at least (n — t) correct processes participate in the k-set agreement problem.
Lemma 1. The number of values that are decided is at most t, and a decided value is a proposed value. operation kset propose(vi): (1) (2)
Proof of the algorithm. Let p be the number of processes that participate in the renaming. The size of the new name space is M = min(2p — 1,p + k — 1). Proof. Let us consider a run in which p processes participate. Let pi be a process that returns a new name (line 15). The new name obtained by pi is the last name it has proposed (at line 10 during the previous iteration). When pi defined its last name proposal, at most p 1 other processes have previously defined a name proposal, i.e., j : (j = i) (statei[j].prop = ) p 1 (O1). Moreover, due to the definition of Ωk, when it defines its last name proposal, the rank of pi in leadersi is at most m∗in(p, k) (O2). It follows from (O1) and (O2) that the last name proposal computed by pi is upper bounded by (p — 1) + min(p, k), i.e., M = min(2p — 1,p — 1+ k). Lemma 3
