Realizability Problem for Constraint LTL

Constraint linear-time temporal logic (CLTL) is an extension of LTL that is interpreted on sequences of valuations of variables over an infinite domain. The atomic formulas are interpreted as constraints on the valuations. The atomic formulas can constrain valuations over a range of positions along a sequence, with the range being bounded by a parameter depending on the formula. The satisfiability and model checking problems for CLTL have been studied by Demri and D'Souza. We consider the realizability problem for CLTL. The set of variables is partitioned into two parts, with each part controlled by a player. Players take turns to choose valuations for their variables, generating a sequence of valuations. The winning condition is specified by a CLTL formula -- the first player wins if the sequence of valuations satisfies the specified formula. We study the decidability of checking whether the first player has a winning strategy in the realizability game for a given CLTL formula. We prove that it is decidable in the case where the domain satisfies the completion property, a property introduced by Balbiani and Condotta in the context of satisfiability. We prove that it is undecidable over $(\mathbb{Z},<,=)$, the domain of integers with order and equality. We prove that over $(\mathbb{Z},<,=)$, it is decidable if the atomic constraints in the formula can only constrain the current valuations of variables belonging to the second player, but there are no such restrictions for the variables belonging to the first player. We call this single-sided games.


Introduction
Propositional linear temporal logic (LTL) and related automata theoretic models have been extended in various ways to make it more expressive. Prompt-LTL [18], Constraint LTL [13], LTL with freeze operators [12], temporal logic of repeating values [11,24], finite memory automata [16], data automata [8] are all examples of this. Prompt-LTL is concerned with bounding wait times for formulas that are intended to become true eventually, while other extensions are concerned with using variables that range over infinite domains in place of Boolean propositions used in propositional LTL. Variables ranging over infinite domains are a natural choice for writing specifications for systems that deal with infinite domains. For example, constraint LTL has been used for specifications of cloud based elastic systems [6], where the domain of natural numbers is used to reason about the number of resources that are being used by cloud based systems.
An orthogonal development in formal verification is synthesis, that is concerned with automatically synthesizing programs from logical specifications. The problem was identified by Church [10] and one way to solve it is by viewing it as the solution of a two person game. For specifications written in propositional LTL, the worst case complexity of the realizability problem is doubly exponential [23]. However, efficient algorithms exist for fragments of LTL. The algorithms are efficient enough and the fragments are expressive enough to be used in practice, for example to synthesize robot controllers [17], data buffers and data buses [22]. This paper is in an area that combines both developments mentioned in the above paragraphs. We consider constraint LTL (CLTL) and partition the set of variables into two parts, each being owned by a player in a two player game. The players take turns to choose a valuation for their variables over an infinite domain. The game is played forever and results in a sequence of valuations. The first player tries to ensure that the resulting sequence satisfies a specified CLTL formula (which is the winning condition) and the second player tries to foil this. We study the decidability of checking whether the first player has a winning strategy, called the realizability problem in the sequel. CLTL is parameterized by a constraint system, that can have various relations over the infinite domain. The atomic formulas of CLTL can compare values of variables in different positions along a range of positions, using the relations present in the constraint system. The range of positions is bounded and depends on the formula. E.g., an atomic formula can say that the value of x at a position is less than the value of y in the next position, in the domain of integers or real numbers with linear order. Decidability of the CLTL realizability problem depends on the constraint system. It also depends on whether the atomic formulas can compare values at different positions of the input, as opposed to comparing values of different variables at the same position of the input. If the former is allowed only for variables belonging to one of the players, they are called single-sided games. This is illustrated next.
For instance in cloud based elastic systems [6], the number of resources allocated and the number of virtual machines running are tracked. One desirable property is that if the number of virtual machines increases, the number of resources allocated also increase. Typically the number of resources allocated is controlled by the system and the number of virtual machines is controlled by the environment. Let x be a variable that keeps track of the number of resources allocated and let y denote the number of virtual machines. Specifying this property will require comparing the value of x at the current position with the value of x at the next position. We may also compare the current value of y with its value at the next position, but this will need both the system and the environment to be able to compare the values of their variables at different positions. Instead, if we restrict the environment to only decide whether a new virtual machine request is raised at the current position, the environment need not compare the value of y with its value at the next position. Hence only system compares the values of its variables across different positions and thus, the game will be single-sided.

Contributions.
We prove that the realizability problem for CLTL is 1. 2EXPTIME-complete for constraint systems that satisfy a so-called completion property, 2. undecidable for integers with linear order and equality and 3. 2EXPTIME-complete for single-sided games on integers with linear order and equality.
The third result above is the main one and is inspired by concepts used in satisfiability [13]. In satisfiability, this technique is based on patterns that repeat in ultimately periodic words. It requires new insights to make it work in trees that we use to represent strategies here.

Preliminaries
Let Z be the set of integers and N be the set of non-negative integers. We denote by ⌈i⌉ k the number i ceiled at k: ⌈i⌉ k = i if i ≤ k and ⌈i⌉ k = k otherwise. If m is any mapping and S is a subset of the domain of m, we denote by m ↾ S the mapping m restricted to the domain S. For a sequence of mappings m 1 · m 2 · · · , we write m 1 · m 2 · · · ↾ S for m 1 ↾ S · m 2 ↾ S · · · . For integers n 1 , n 2 , we denote by [n 1 , n 2 ] the set {n ∈ Z | n 1 ≤ n ≤ n 2 }. We recall the definitions of constraint systems and constraint LTL (CLTL) from [13]. A constraint system D is of the form (D, R 1 , . . . , R n , I), where D is a non-empty set called the domain. Each R i is a predicate symbol of arity a i , with I(R i ) ⊆ D ai being its interpretation.
Let V be a set of variables, partitioned into the sets V a , V b of look-ahead and future-blind variables. A look-ahead term is of the form X i y, where y is a look-ahead variable, i ≥ 0 and X is a symbol intended to denote "next". For k ≥ 0, we denote by T a [k] the set of all look-ahead terms of the form X i y, where i ∈ [0, k] and y is a look-ahead variable. A constraint c is of the form R(t 1 , . . . , t n ), where R is a predicate symbol of arity n and t 1 , . . . , t n are all future-blind variables or they are all look-ahead terms. The syntax of CLTL is given by the following grammar, where c is a constraint as defined above.
The semantics of CLTL is defined over sequences σ (also called concrete models in the following); for every i ≥ 0, σ(i) : V → D is a mapping of the variables. Given, x 1 , . . . , x n ∈ V a and i 1 , . . . , i n ∈ N, the i th position of a concrete model σ satisfies the constraint This can be proved by a reduction from the repeated control state reachability problem for 2-counter machines, which is known to be undecidable [3]. The main idea of the reduction is that one of the players simulates the counter machine and the other player catches mistakes, like other similar reductions for games [1]. For a detailed proof of this result, please refer to the arXiv version of this paper [7].
Some proofs and technical details in the subsequent sections are moved to the appendix due to space constraints.

Symbolic Models
The models of CLTL are infinite sequences over infinite alphabets. Frames, introduced in [13], abstract them to finite alphabets. We adapt frames to constraint systems of the form (D, <, =). Conceptually, frames and symbolic models as we will define here are almost the same as introduced in [13], where the authors used these notions to solve the satisfiability problem for CLTL. For the purpose of CLTL games, we use slightly different definitions and notations, as this makes it easier to present game-theoretic arguments. For the rest of the paper, we shall assume that the set of variables V is finite. Also, unless mentioned otherwise, we shall assume that D is Z, N or a domain that satisfies a so-called completion property. Suppose that the first player owns the variables x, z. The second player owns y and wants to ensure that x < y ∧ y < z over the domain of integers. It depends on whether the gap between the values assigned by the first player to x and to z, is large enough for the second player to push y in between.
▶ Definition 2 (gap functions). Given a mapping m : V b → D, we associate with it a gap function gp : Define the function gp such that gp(x 0 ) = 0 and gp( The left hand side of the above equation denotes the gap between x l and x l+1 according to the gp function. The right hand side denotes the gap between the same variables according to the mapping m, ceiled at |V b | − 1. Since V b is finite, the set of gap functions is also finite. We use gap functions only for future-blind variables V b , only for the domains Z or N. Hence, the minus sign '−' in the definition of gap functions is interpreted as the usual subtraction over Z or N.
The following definition formalizes how a frame captures information about orders and gaps for s successive positions.
▶ Definition 3 (Frames). Given a number s ≥ 1, an s-frame f is a pair (≤ f , gp f ), where ≤ f is a total pre-order 2 on the set of look-ahead terms T a [s − 1] and gp f : 3 is a gap function.
In the notation s-frame, s is intended to denote the size of the frame -the number of successive positions about which information is captured. The current position and the following (s − 1) positions are considered, for which the look-ahead terms in T a [s − 1] are needed. We denote by < f and ≡ f the strict order and equivalence relation induced by ≤ f : x < f y iff x ≤ f y and y ̸ ≤ f x and x ≡ f y iff x ≤ f y and y ≤ f x.

8:6
Realizability Problem for Constraint LTL We will deal with symbolic models that constitute sequences of frames. An s-frame will capture information about the first s positions of a model. If this is followed by a (s + 1)-frame, it will capture information about the first (s + 1) positions of the model. Both frames capture information about the first s positions, so they must be consistent about the information they have about the shared positions. Similarly, an s-frame meant for positions i to i + s − 1 may be followed by another s-frame meant for positions i + 1 to i + s. The two frames must be consistent about the positions i + 1 to i + s − 1 that they share. The following definition formalizes these requirements.
▶ Definition 4 (One-step compatibility). For s ≥ 1, an s-frame f and an (s + 1)-frame g, the pair (f, g) is one-step compatible if the following conditions are true.
For all j ∈ [0, s − 1] and all variables For s ≥ 2 and s-frames f, g, the pair (f, g) is one-step compatible if: Fix a number k ≥ 0 and consider formulas of X-length k. A symbolic model is a sequence ρ of frames such that for all i ≥ 0, ρ(i) is an ⌈i + 1⌉ k+1 -frame and (ρ(i), ρ(i + 1)) is one-step compatible. CLTL formulas can be interpreted on symbolic models, using symbolic semantics |= s as explained next. To check if the i th position of ρ symbolically satisfies the atomic constraint t 1 < t 2 (where t 1 , t 2 are look-ahead terms), we check whether t 1 < t 2 according to the i th frame ρ(i). In formal notation, this is written as For future-blind variables x, y, ρ, i |= s x < y if gp ρ(i) (x, 0) < gp ρ(i) (y, 0). The symbolic satisfaction relation |= s is extended to all CLTL formulas of X-length k by induction on the structure of the formula, as done for propositional LTL. To check whether ρ, i |= s t 1 < t 2 in this symbolic semantics, we only need to check ρ(i), the i th frame in ρ, unlike the CLTL semantics, where we may need to check other positions also. In this sense, the symbolic semantics lets us treat CLTL formulas as if they were formulas in propositional LTL and employ techniques that have been developed for propositional LTL. But to complete that task, we need a way to go back and forth between symbolic and concrete models. Given a concrete model σ, we associate with it a symbolic model µ(σ) as follows. Imagine we are looking at the concrete model through a narrow aperture that only allows us to view k + 1 positions of the concrete model, and we can slide the aperture to view different portions. The i th frame of µ(σ) will capture information about the portion of the concrete model visible when the right tip of the aperture is at position i of the concrete model (so the left tip will be at i − ⌈i⌉ k ). Formally, the total pre-order of the i th frame is the one induced by the valuations along the positions i − ⌈i⌉ k to i of the concrete model. For every j ∈ [0, ⌈i⌉ k ], the function λx.gp f (x, j) of the i th frame is the gap function associated with the mapping For every concrete model, there is an associated symbolic model, but the converse is not true. E.g., if every frame in a symbolic model requires Xx < x, the corresponding concrete model needs to have an infinite descending chain, which is not possible in the constraint system (N, <, =). We say that a symbolic model ρ admits a concrete model if there exists a concrete model σ such that ρ = µ(σ).

Decidability Over Domains Satisfying the Completion Property
In this section, we prove that the CLTL realizability problem is decidable if the domain satisfies a so called completion property. Let C be a set of constraints over a constraint system D. We call C satisfiable if there is a valuation satisfying all the constraints in C. For a subset U ⊆ V of variables, C ↾ U is the subset of C consisting of those constraints that only use terms built with variables in U . A partial valuation v ′ is a valuation for the terms occurring in C ↾ U . We say D has the completion property if for every satisfiable set of constraints C and every subset U ⊆ V , every partial valuation v ′ satisfying C ↾ U can be extended to a valuation v satisfying C. An example of a constraint system which does not satisfy the completion property is (Z, <, =), since for the set of constraints C = {x < y, x < z, z < y} over the set of variables V = {x, y, z}, the partial valuation v : x → 0, y → 1 satisfies the constraints in C involving x and y, but cannot be extended to a valuation which satisfies the constraints x < z and z < y in C. The constraint systems (Q, <, =) and (R, <, =) satisfy the completion property. Also, one can easily see that for every infinite domain D, the constraint system (D, =) always satisfies the completion property. It is known that CLTL satisfiability is decidable for constraint systems that satisfy the completion property [13,4]. The completion property of a constraint system is closely related to the denseness of the underlying domain. Consider an example of a controller system that controls the temperature of water in a water tank. Let x be a variable that denotes the temperature of the water. The controller may be required to guarantee, for instance, that 20 ≤ x ≤ 100. In principle, the temperature of water can be any real number. Hence x comes from a dense domain. So the domain over which properties of such a system are specified satisfies the completion property (refer to [27] for a detailed explanation of such a controller). In contrast, consider cloud-based elastic systems [6], which we briefly described in the introduction. It is clear that both-the number of resources allocated and the number of virtual machines running are natural numbers. As the domain of natural numbers is not dense, we can conclude that constraint systems used to model these cloud-based elastic systems do not satisfy the completion property. Now we prove that for constraint systems of the form (D, <, =) that satisfy the completion property, the CLTL realizability problem is decidable. This holds even when both players have look-ahead variables, so we don't need to treat future-blind variables separately. Hence, we set V b to be empty and ignore gap functions in frames.
We reduce CLTL games to parity games on finite graphs, which are known to be decidable (see, e.g., [19]). In a CLTL game, environment chooses a valuation for EV , which we track in our finite graph by storing the positions of the new values relative to the values chosen in the previous rounds. We do this with partial frames, which we define next.
In the set of terms T a [s − 2] ∪ {X s−1 y | y ∈ EV } used in partial frames, the terms in the first set represent values chosen in the previous rounds and the terms in the second set represent values chosen by environment for EV in the current round.

Realizability Problem for Constraint LTL
Note that a partial s-frame is a total pre-order on the set of terms T a [s − 2] ∪ {X s−1 y | y ∈ EV } and an s-frame is a total pre-order on the set of terms T a [s − 1]. Let pf be an s-partial frame and let f be an s-frame such that (pf, f ) is one-step compatible.
Clearly, C 2 is a subset of C 1 skipping all those constraints that contain system variables corresponding to the s th position. If a finite sequence of mappings (em 1 ⊕ sm 1 )...(em s−1 ⊕ sm s−1 )em s satisfies the pre-order ≤ pf then it satisfies the constraints in C 2 . Since the constraint system satisfies the completion property, there must exist a system mapping sm s for the system variables at position s such that the sequence of mappings (em 1 ⊕ sm 1 )...(em s ⊕ sm s ) satisfies the constraints in C 1 and hence, also satisfies the pre-order ≤ f . Thus, we have the following proposition: pf is the s-partial frame induced by em and the previous (s − 1) mappings in the sequence, and f is an s-frame such that (pf, f ) is one-step compatible (where i ≥ s). If the constraint system satisfies the completion property, then em can be extended to a mapping em ⊕ sm such that f is the s-frame associated with em ⊕ sm and the previous (s − 1) mappings in the sequence.
We know that any LTL formula ϕ can be converted to an equivalent non-deterministic Büchi automaton with an exponential number of states in the size of ϕ in EXPTIME [30]. Now, every non-deterministic Büchi automaton B with n states can be converted to a deterministic parity automaton [15,Chapter 1] with number of states exponential in n and number of colours polynomial in n [21, Theorem 3.10]. Using these results, it is easy to see that given a CLTL formula ϕ, we can construct a deterministic parity automaton A ϕ with set of states Q and with number of colours d, accepting the set of all sequences of frames that symbolically satisfy ϕ, such that |Q| is double exponential in the size of ϕ and d is exponential in the size of ϕ. Now we design parity games to simulate CLTL games.
▶ Definition 8. Let ϕ be the CLTL formula defining the winning condition for a CLTL game and k be its X-length. Let F denote the set of all s-frames for s ∈ [0, k]. Let A ϕ be a deterministic parity automaton accepting the set of all sequences of frames that symbolically satisfy ϕ, with Q being the set of states, q I ∈ Q being the initial state and d being the number of colours. We define a parity game with environment vertices f is an s-frame for some s and pf is a partial ⌈s + 1⌉ (k+1)frame. There is an edge from (f, q I , pf ) to (g, q I ) if (pf , g) is one step compatible and g is an s-frame for s ∈ [1, k]. There is an edge from (f, q, pf ) to (g, q ′ ) if (pf , g) is one-step compatible, g is a (k + 1)-frame and A ϕ goes from q to q ′ on reading g. Vertices (f, q) and (f, q, pf ) get the same colour as q in the parity automaton A ϕ . The initial vertex is (⊥, q I ), where ⊥ is the trivial 0-frame.
The edges of the parity game above are from V s to V e or vice-versa. They are designed such that q I is the only state used for the first k rounds, where the frames will be of size at most k (this is because for the system to win in a play of the parity game generating a frame sequence ρ, we only require that the sequence ρ[k, ∞) symbolically satisfy ϕ, according to Lemma 5). For the first (k + 1) frame, an edge from a system vertex of the form (f, q I , pf ) to an environment vertex of the form (g, q ′ ) is taken and from then on, we track the state of the parity automaton as it reads the sequence of frames contained in the sequence of vertices that are chosen by the players in the game.
▶ Lemma 9. For a CLTL game over a constraint system satisfying the completion property with winning condition given by a formula ϕ, system has a winning strategy iff she has a positional winning strategy in the parity game given in Definition 8.
Proof idea. For every play in the CLTL game, there is a corresponding play in the parity game, but the converse is not true in general, since only the order of terms are tracked in the parity game and not the actual values. For constraint systems satisfying the completion property, Proposition 7 implies that there exist valuations corresponding to all possible orderings of terms, so the converse is also true. ◀ ▶ Theorem 10. The CLTL realizability problem over constraint systems that satisfy the completion property is 2EXPTIME-complete.
Proof. From Lemma 9, this is effectively equivalent to checking the existence of a winning strategy for system in a game. Now, checking if system has a winning strategy in the parity game (constructed using A ϕ ) can be achieved in O(n log d ) time where n is the number of states in the game graph [9]. Now, by our construction, n = |Q| × |F |. We know, |F| is the number of total pre-orders on V , for which 2 (k.|V |) 2 is a crude upper bound. This means that |F| is exponential in the size of ϕ and hence, overall we get a 2EXPTIME upper bound for our realizability problem. We also know that the realizability problem for LTL is complete for 2EXPTIME [23]. Thus, the CLTL realizability problem over constraint systems satisfying the completion property is also 2EXPTIME-complete. ◀ We know that a positional winning strategy in the parity game for a player, if it exists, can be implemented by a deterministic finite state transducer. Since D satisfies the completion property, consider a resource-bounded Turing machine M , which can, given an environment mapping em as described in Proposition 7, extend it to a mapping em ⊕ sm such that the order f imposed by the em ⊕ sm and the previous s − 1 mappings over the set of all terms extends the order pf imposed by em and the previous s − 1 mappings. Now, for implementing the winning strategy for a player in a CLTL game, we use the deterministic finite state transducer corresponding to the parity game given in Definition 8. For every input of a partial frame pf by environment in a round, the transducer returns a frame f for system that extends pf . The transducer along with the machine M implements the winning strategy for system in a given CLTL game, if it exists. Note that as we saw above, the constraint systems (N, =) and (Z, =) (with just equality and no linear order) also satisfy the completion property. So, it follows that the CLTL realizability problem over these constraint systems is also decidable.

Decidability of single-sided CLTL games over (Z, <, =)
We consider games where environment has only future-blind variables, while the system has both future-blind and look-ahead variables. We call this single-sided CLTL games. So, in a single-sided game, EV = EV b and SV = SV b ∪ SV a . Given a CLTL formula ϕ, the single-sided realizability problem is to check whether system has a winning strategy in the single-sided CLTL game whose winning condition is ϕ. We only consider the constraint system (Z, <, =) and show that the single-sided realizability problem is decidable over (Z, <, =). We do this in two stages. In the first stage, we reduce it to the problem of checking the non-emptiness of a set of trees satisfying certain properties. These trees represent system strategies. In the second stage, we show that non-emptiness can be checked using tree automata techniques. Let G be the set of gap functions associated with mappings of the form EV b → Z. For s ≥ 1, an s-frame g and a function gp ∈ G, the pair (gp, g) is gap compatible if for all x, y ∈ EV b , gp(x) − gp(y) = gp g (x, s − 1) − gp g (y, s − 1). Intuitively, the gaps that frame g imposes between EV b variables in its last position are the same as the gaps imposed by gp. We now have the following proposition (refer to the arXiv version of the paper for the proof).
▶ Proposition 11 (gap compatibility). For s ≥ 1, an s-frame g and a function gp ∈ G, suppose the pair (gp, g) is gap compatible. If gp is the gap function associated with a mapping em : EV b → Z, it can be extended to a mapping em ⊕ sm : is the gap function associated with em ⊕ sm.
Let ϕ be the CLTL formula defining the winning condition of a single-sided CLTL game and let k be its X-length. Let F be the set of all s-frames for s ∈ [0, k]. For technical convenience, we let F include the trivial 0-frame ⊥ = (≤ ⊥ , gp ⊥ ), where ≤ ⊥ is the trivial total pre-order on the empty set and gp ⊥ is the trivial function on the empty domain.
▶ Definition 12 (Winning strategy trees). A strategy tree is a function T : G * → F such that for every node η ∈ G * , T (η) is a ⌈|η|⌉ k+1 -frame and for every gp ∈ G, (T (η), T (η · gp)) is one-step compatible and (gp, T (η · gp)) is gap compatible. A function L is said to be a labeling function if for every node η ∈ G * , L(η) : V → Z is a mapping of the variables in V . For an infinite path π in T , let T (π) (resp. L(π)) denote the infinite sequence of frames (resp. mappings) labeling the nodes in π, except the root node ϵ. A winning strategy tree is a pair (T, L) such that T is a strategy tree and L is a labelling function satisfying the condition that for every infinite path π, T (π) = µ(L(π)) and T (π), k |= s ϕ.
The last condition above means that T (π) is the symbolic model associated with the concrete model L(π) and that it symbolically satisfies the formula ϕ.
Two concrete models may have the same symbolic model associated with them, if they differ only slightly, as explained next. Two concrete models σ 1 , σ 2 are said to coincide on V a if σ 1 (i) ↾ V a = σ 2 (i) ↾ V a for all i ≥ 0. They are said to coincide on V b up to gap functions if for every i ≥ 0, the same gap function is associated with σ 1 (i) ↾ V b and σ 2 (i) ↾ V b . The following result follows directly from definitions.
▶ Proposition 13 (similar concrete models have the same symbolic model). If two concrete models coincide on V a and they coincide on V b up to gap functions, then they have the same symbolic model associated with them.
The following result accomplishes the first stage of the decidability proof, reducing the existence of winning strategies to non-emptiness of a set of trees. A detailed proof of this result can be found on the arXiv version of the paper with the same title.
▶ Lemma 14 (strategy to tree). System has a winning strategy in the single-sided CLTL game with wining condition ϕ iff there exists a winning strategy tree.
Proof idea. If environment chooses a mapping em : EV b → Z in the CLTL game, the corresponding choice in the tree T is to go to the child gp, the gap function associated with em. System responds with the mapping L(gp) ↾ SV a for the look-ahead variables. For the future-blind variables SV b , system chooses a mapping that ensures compatibility with the frame T (gp). This will ensure that system's response and L coincide on V a and coincide on V b up to gap functions, so Proposition 13 ensures that both have the same symbolic model. The symbolic model symbolically satisfies ϕ by definition of wining strategy trees and Lemma 5 implies that the concrete model satisfies ϕ. ◀ Given a tree G * → F, a tree automaton over finite alphabets can check whether it is a strategy tree or not, by allowing transitions only between one-step and gap compatible frames. However, to check whether it is a winning strategy tree, we need to check whether there exists a labeling function L, which is harder. One way to check the existence of such a labeling function is to start labeling at the root and inductively extend to children. Suppose there are two variables x, y at some node and we have to label them with integers. There may be many variables in other nodes whose labels should be strictly between those of x, y in the current node. So our labels for x, y in the current node should leave a gap large enough to accommodate others that are supposed to be in between. Next we introduce some orderings we use to formalize this.
A node variable in a strategy tree T is a pair (η, x) where η is a node and x ∈ V a is a look-ahead variable. The tree induces an order on node variables as follows. Suppose η is a node, T (η) is an s-frame for some s and η a is an ancestor of η such that the difference in height h = |η| − |η a | between the descendant and ancestor is at most s − 1. For look-ahead variables x, y ∈ V a , recall that the term X s−1 x represents the variable x in the last position of the frame T (η), and X s−1−h y represents the variable y at h positions before the last one. We In other words, for the variables and positions captured in the frame T (η), ⊑ T is same as the total pre-order ≤ T (η) . We define (η, η a , y)). We define ⊏ * T to be the reflexive transitive closure of ⊏ T and ⊏ + T to be the transitive closure of ⊏ T . Note that ⊏ * T and ⊏ + T can compare node variables that are in different branches of the tree also, though they are not total orders. We write (η 1 , x) ⊏ * T (η 2 , y) (resp, (η 1 , x) ⊏ + T (η 2 , y)) equivalently as (η 2 , y) ⊐ * T (η 1 , x) (resp. (η 1 , x) ⊐ + T (η 2 , y)). By definition, (η 1 , x) ⊏ + T (η 2 , y) (resp.(η 2 , y) ⊏ + T (η 1 , x)) if (η 1 , x) ⊏ * T (η 2 , y) and (η 2 , y) ̸ ⊏ * T (η 1 , x) (resp. (η 2 , y) ⊏ * T (η 1 , x) and (η 1 , x) ̸ ⊏ * T (η 2 , y)). ⊏ + is irreflexive and transitive.
▶ Definition 15 (Bounded chain strategy trees). Suppose T is a strategy tree, η, η ′ are two nodes and x, y ∈ V a are look-ahead variables such that (η, x) ⊏ + T (η ′ , y). A chain between (η, x) and (η ′ , y) is a sequence (η 1 , x 1 )(η 2 , x 2 ) · · · (η r , x r ) such that (η, y). We say r is the length of the chain. The strategy tree T is said to have bounded chains if for any two node variables (η, x) and (η ′ , y), there is a bound N such that any chain between (η, x) and (η ′ , y) is of length at most N .

▶ Lemma 16. A strategy tree T has a labeling function L such that (T, L) is a winning strategy tree iff T has bounded chains.
The above lemma characterizes those strategy trees that are winning strategy trees. This is the main technical difference between CLTL games and games with register automata specifications [28,14]. Since register automata can compare values that are arbitrarily far apart, the corresponding characterization of symbolic structures that have associated concrete structures is more involved compared to Lemma 16 above.
Detecting unbounded chains is still difficult for tree automata -to find longer chains, we may have to examine longer paths. This difficulty can be overcome if we can show that longer chains can be obtained by repeatedly joining shorter ones. We now introduce some T I M E 2 0 2 2

8:12
Realizability Problem for Constraint LTL notation and results to formalize this. For a node η and an ancestor η a ,T (η a , η) is the sequence of frames T (η a ) · · · T (η) labeling the path from η a to η. A node η 1 is said to occur within the influence of (η a , η) if η 1 occurs between η a and η or η 1 is an ancestor of η a and |η a | − |η 1 | ≤ s − 1, where s is the size of the frame T (η a ). The following result follows directly from definitions.

▶ Lemma 18 (Pumping chains in regular trees). Suppose T is a regular tree. Then T has unbounded chains iff there exists an infinite path containing two infinite sequences
i ) for all i ≥ 1 and satisfy one of the following conditions.
We can choose a chain that is long enough to contain two isomorphic nodes. The path between them can be repeated infinitely. Proposition 17 will imply that this infinite path contains an infinite chain as required.
◀ Lemma 18 says that if a regular tree has unbounded chains, it will have an infinite path containing an infinite chain. The infinite sequence of the first (resp. second) kind given in Lemma 18 is called an infinite forward (resp. backward) chain. Now we design a tree automaton A ϕ whose language L(A ϕ ) is an approximation of the set T = {T | ∃L, (T, L) is a winning strategy tree} such that L(A ϕ ) is non-empty iff T is. Hence, the single-sided CLTL realizability problem is equivalent to checking the non-emptiness of L(A ϕ ). The tree automaton A ϕ is the intersection of three automata A str ϕ , A symb ϕ and A chain ϕ , all of which read |G|-ary trees labeled with letters from F. The automaton A str ϕ accepts the set of all strategy trees, A symb ϕ accepts the set of all trees each of whose paths symbolically satisfies the formula ϕ and A chain ϕ accepts the set of all trees that do not have any infinite forward or backward chains. Construction of these automata are explained in detail in Appendix B.
▶ Lemma 19. The system player has a winning strategy in the single-sided CLTL(Z, <, =) game with winning condition ϕ iff L(A ϕ ) is non-empty.
Proof. Suppose there is a winning strategy for the system player in single-sided CLTL(Z, < , =) game with winning condition ϕ. By Lemma 14, there exists a winning strategy tree, say (T, L). Since, T is a strategy tree, T ∈ L(A str ). We know that every branch of T must symbolically satisfy ϕ and hence, T ∈ L(A symb ϕ ). Further, since T has the labelling function L, Lemma 16 implies that T has bounded chains and thus, it cannot have any infinite forward or backward chains. So T ∈ L(A chain ). Thus, T ∈ L(A ϕ ).
Conversely, suppose A ϕ accepts a tree T . It is known that if the language of a tree automaton is non-empty, it contains a regular tree [20,Corollary 8.20]. Although this result holds for tree automata that read infinite binary trees as inputs, the proofs can be suitably modified to work for tree automata that read |G|-ary trees. Hence we can conclude that A ϕ must accept a regular tree T ′ . Since, T ′ ∈ L(A ϕ ), every branch of T ′ must symbolically satisfy ϕ, T ′ must be a strategy tree and it cannot have any infinite forward or backward chains. Thus, by Lemma 18, T ′ must have bounded chains and hence by Lemma 16, T ′ must have a labelling function L ′ such that (T ′ , L ′ ) is a winning strategy tree. Hence, by Lemma 14 the system player has a winning strategy in the single-sided CLTL(Z, <, =) game. ◀ Note that L(A ϕ ) is not equal to the set T = {T | ∃L, (T, L) is a winning strategy tree} in general. As seen in the above proof, we can only guarantee that the regular trees in L(A ϕ ) are in T . The non-regular trees in L(A ϕ ) need not be in T .
Using the previous lemma, we get the following decidability result.
Proof. Given a formula ϕ, Lemma 19 implies that it is enough to construct the tree automaton A ϕ and check it for non-emptiness. From the description of the construction in Appendix B, we can see that A str ϕ , A symb ϕ and A chain ϕ can be constructed in 2EXPTIME in the size of ϕ. Thus, the automaton A ϕ can be constructed in 2EXPTIME. Now, checking non-emptiness of a parity tree automaton is decidable and the upper bound stated in [20,Corollary 8.22 (1)] implies that the single-sided realizability problem for CLTL over (Z, <, =) is in 2EXPTIME. Now, the realizability problem for LTL is 2EXPTIME-complete [23] and hence, the singlesided realizability problem for CLTL over (Z, <, =) must also be 2EXPTIME-complete. ◀

Discussion and Future Work
We have seen in this paper that the CLTL realizability problem is decidable over domains satisfying completion property and that the single-sided CLTL realizability problem is decidable over integers with linear order and equality. But both these problems have a high complexity (both are 2EXPTIME-complete). It would be interesting to see if there are expressive fragments of CLTL with lower complexity, like the fragments of LTL studied in [22], which work on practical examples. We believe that single-sided CLTL games over the domain of natural numbers (N, <, =) are also decidable. In [13], the authors extend the automata-characterization for the satisfiability problem for CLTL over the integer domain to the domain of natural numbers. A similar extension of the tree-automata characterization for the single-sided games over integers to one for single-sided games over the naturals seems possible, although the details need to be worked out.
Despite the decidability result that we have for the single-sided CLTL games over integers, the language of the tree automaton that we construct in this paper is an approximation of the set of all winning strategy trees. We do not have a machine-theoretic representation for winning strategies yet, and this is an interesting direction for future exploration.

8:18
Realizability Problem for Constraint LTL Next we will show that there are chains that go arbitrarily deep in a single branch. Suppose there are chains of unbounded lengths between (η 1 , x 1 ) and (η 2 , x 2 ). All such chains must pass through the least common ancestor (say η a ) of η 1 , η 2 . For some variable x a , there must be chains of unbounded lengths between either (η 1 , x 1 ) and (η a , x a ) or between (η a , x a ) and (η 2 , x 2 ). Say there are unbounded chains between (η 1 , x 1 ) and (η a , x a ); the other case is similar. There is only one path between η 1 and η a , so there must be chains of unbounded lengths that go beyond this path and come back. There must be node variables (η 1 , y 1 ), (η 1 , y 2 ) or (η a , y 1 ), (η a , y 2 ) such that there are chains of unbounded lengths between them. We will consider (η 1 , y 1 ), (η 1 , y 2 ); the other case is similar. For the chains of unbounded lengths starting from (η 1 , y 1 ) and ending at (η 2 , y 2 ), let η be the highest node (nearest to the root) visited. There must be (η, z 1 ), (η, z 2 ) such that there are chains of unbounded lengths between them that only visit descendants of η. If there is a bound (say B) on how deep the chains go below η and come back, the number of nodes that can be visited is bounded by the number of node variables that occur in the subtree of height B rooted at η (a node can occur at most once in a chain; otherwise, it will contradict the fact that ⊏ + T is irreflexive). Hence, for any bound B, there are chains that go deeper than B and come back.
Next we prove that there is no bound on the number of node variables in a single path that belong to a chain. For this, first suppose that there is a node η and a chain goes down one child of η starting from (η, x), comes back to η via (η, y) and goes down another child. Then we have (η, y) in the branch, we have (η, x) ⊏ + T (η, y) in the main path by transitivity). Hence, every such node contributes a node variable in a chain.
So if there is no bound on the number of such branching nodes along a path, then there is no bound on the number of node variables in a single path that belong to a chain, as required. Suppose for the sake of contradiction that the number of such branching nodes along any path is bounded (by say B 1 ) and the number of node variables in a chain along any one path is also bounded (say by B 2 ). Then any chain is in a subtree with at most |G| B1 leaves (and hence at most as many paths) and at most B 2 node variables along any path, so the length of such chains is bounded. Hence, either the number of branching nodes along a path is unbounded or the number of node variables in a chain along a path is unbounded. Both of these imply that the number of node variables in a chain along a path is unbounded, as required.
A chain that goes deep down a path may make u-turns (first descend through descendants and then go to an ascendant or vice-versa) multiple times within the branch. We would like to prove that there is no bound on the length of chain segments that don't have u-turns (these are the straight segments that we need). Suppose for the sake of contradiction that there is a bound on the length of straight segments. Then there is no bound on the number of straight segments in a path, since we have already shown that the number of node variables in a chain along a path is unbounded. There can be only boundedly many distinct straight segments in a path of bounded depth, so the straight segments go deeper without any bound.
If there is a straight segment and another one occurs below the first one, the first straight segment can be extended by appending node variables of the second one, as can be seen in the illustration below. root first straight segment second straight segment first segment extended This contradicts the hypothesis that length of straight segments is bounded. This shows that there are unboundedly long straight segments, completing the proof. ◀

B.1 Construction of A ϕ
The automaton A str ϕ has set of states F. In state f , it can read the input label f and go to states f 1 , . . . , f |G| in its children, provided (f, f i ) is one-step compatible and (gp i , f i ) is gap-compatible for all i ∈ [1, |G|]. All states are accepting in this Büchi automaton. This automaton just checks that every pair of consecutive frames along every branch of the tree is one-step compatible and gap-compatible and hence verifies that the tree accepted is a strategy tree. Now, the size of the set of states of A str ϕ is |F|, and the size of the transition set is |F| × |Σ| × |F | |G| where the input alphabet Σ = F. Since, G is the set of all gap functions associated with mappings of the form EV b → Z, by definition of G its range must be {0, . . . , . Also, from the definition of F, we get |F| ≤ 2 (k.|V a |) 2 × (|V b | |V b | 2 ) k where k is the X-length of ϕ. Thus, the size of A str ϕ is double exponential in the size of ϕ.
The automaton A symb ϕ checks that every path in the input tree is accepted by a Büchi automaton B symb ϕ , which ensures that the input sequence symbolically satisfies the formula ϕ.
Given the Büchi automaton B symb ϕ , we first convert it to some deterministic parity automaton Thus, the parity tree automaton A symb ϕ can be constructed in 2EXPTIME in the size of ϕ. Next, we describe the construction of the parity tree automaton A chain ϕ . It needs to check that there are no infinite forward or backward chains in any of the paths. For this we will first construct a Büchi word automaton that accepts all words not having an infinite forward or backward chain, convert it into a deterministic parity automaton C chain ϕ and then as before, construct A chain ϕ with the same size as C chain ϕ . This Büchi word automaton can be constructed by complementing the Büchi automaton B chain which accepts all words that contain an infinite forward chain or an infinite backward chain in EXPTIME in the size of B chain [29]. The construction of such a Büchi automaton B chain is already described in [13]. The size of B chain (as described in [13]) is polynomial in the size of the CLTL formula ϕ and hence, the size of A chain ϕ is double exponential in the size of ϕ.