Lean-yjs: formally proving the Yjs conflict resolution algorithms

@iasakura Iasakura
Sat, 13 Sep 2025 17:55:55 +0000

Hello,

I’m working on iasakura/lean-yjs, a Lean4 project to formally model and prove the correctness of Yjs algorithms.
My goal is to contribute to the theoretical reliability of Yjs by providing formal proofs, and hopefully to share observations from the verification process, in case they might be useful for those interested in the correctness of the Yjs algorithm.

So far I’ve proved the commutativity of the Yjs conflict resolution algorithm, which is modeled as the integrate function from the reference implementation by Joseph Gentle.
Currently, my work is still at the algorithmic level of verification, but my plan is to gradually move towards proofs that are closer to the actual implementation.

Along the way, I also noticed that the original YATA insert algorithm described in “Near Real-Time Peer-to-Peer Shared Editing on Extensible Data Types” admits a potential non-convergent case.
This issue does not affect Yjs at all, because the Yjs algorithm already addresses this problem. In fact, my verification shows that my formal model of Yjs does not exhibit such non-convergent cases.
I’m sharing this because I believe it might be useful for those interested in understanding the correctness of the YATA algorithm.
Non-convergent example (click for more details)
If I’m misunderstanding something here, I’d be happy to be corrected.
I would greatly appreciate any feedback or comments.