Dependent subtyping, object paths, and classical control
appendix sectionrules
Dependent subtyping, object paths, and classical control
Dependent subtyping and refinement entailment
Dependent products compare their codomains under the client domain:
Γ⊢𝐴2<:𝐴1Γ,𝑥:𝐴2⊢𝐵1<:𝐵2
Γ⊢Π𝑥:𝐴1𝐵1<:Π𝑥:𝐴2𝐵2
Π-Sub
The refinement ledger uses a distinct relation. Its annotated A-normal term syntax and evaluation contexts are 𝑒::=𝑣∣𝑒𝑣,𝑣::=𝑥∣𝑚∣⟨𝑚1,…,𝑚𝑘⟩∣𝜆𝑥:𝑅.𝑒,𝐸::=[]∣𝐸𝑣. It reduces only by (𝜆𝑥:𝑅.𝑒)𝑣⟶𝑒[𝑣/𝑥] and the compatible rule 𝑒⟶𝑒′⇒𝐸[𝑒]⟶𝐸[𝑒′]. Its base and function subtyping clauses are
Entails(Φ(Γ)∧𝜙1,𝜙2)
Γ⊢𝖣𝖱𝖾𝖿{𝜈:𝐵∣𝜙1}<:{𝜈:𝐵∣𝜙2}
R-Base-Sub
Γ⊢𝖣𝖱𝖾𝖿𝑅2<:𝑅1Γ,𝑥:𝑅2⊢𝖣𝖱𝖾𝖿𝑆1<:𝑆2
Γ⊢𝖣𝖱𝖾𝖿Π𝑥:𝑅1𝑆1<:Π𝑥:𝑅2𝑆2
R-Π-Sub
Base introduction, variables, and array introduction are
Γ(𝑥)=𝑅
Γ⊢𝖣𝖱𝖾𝖿𝑥:𝑅
R-Var
Γ⊢𝖣𝖱𝖾𝖿{𝜈:𝖨𝗇𝗍∣𝜙}𝗍𝗒𝗉𝖾Entails(Φ(Γ),𝜙[𝑚/𝜈])
Γ⊢𝖣𝖱𝖾𝖿𝑚:{𝜈:𝖨𝗇𝗍∣𝜙}
R-Int
Γ⊢𝖣𝖱𝖾𝖿{𝜈:𝖠𝗋𝗋∣𝜙}𝗍𝗒𝗉𝖾Entails(Φ(Γ),𝜙[⟨𝑚1,…,𝑚𝑘⟩/𝜈])
Γ⊢𝖣𝖱𝖾𝖿⟨𝑚1,…,𝑚𝑘⟩:{𝜈:𝖠𝗋𝗋∣𝜙}
R-Arr
Refinement abstraction, application, and subsumption are
Γ,𝑥:𝑅⊢𝖣𝖱𝖾𝖿𝑒:𝑆
Γ⊢𝖣𝖱𝖾𝖿𝜆𝑥:𝑅.𝑒:Π𝑥:𝑅𝑆
R-Lam
Γ⊢𝖣𝖱𝖾𝖿𝑓:Π𝑥:𝑅𝑆Γ⊢𝖣𝖱𝖾𝖿𝑣:𝑅
Γ⊢𝖣𝖱𝖾𝖿𝑓𝑣:𝑆[𝑣/𝑥]
R-App
Γ⊢𝖣𝖱𝖾𝖿𝑒:𝑅Γ⊢𝖣𝖱𝖾𝖿𝑅<:𝑆
Γ⊢𝖣𝖱𝖾𝖿𝑒:𝑆
R-Sub
For a requested difference constraint, Entails accepts either a replayed path of weight at most the requested bound or a replayed closed cycle whose recomputed weight is negative. A claimed weight without the corresponding contiguous edge sequence is not a certificate. A GCIC cast is a run-time term 𝖼𝖺𝗌𝗍[𝐵⇐𝐴](𝑡), not either subtyping judgment. A failed constructor or index test reduces to 𝖾𝗋𝗋𝐵.
Variable-path DOT
Type selection, recursive self, and object members use
Γ⊢𝑥:{𝐴:𝑆..𝑈}
Γ⊢𝑆<:𝑥.𝐴
DOT-Sel-L
Γ⊢𝑥:{𝐴:𝑆..𝑈}
Γ⊢𝑥.𝐴<:𝑈
DOT-Sel-U
Γ⊢𝑆2<:𝑆1Γ⊢𝑈1<:𝑈2
Γ⊢{𝐴:𝑆1..𝑈1}<:{𝐴:𝑆2..𝑈2}
DOT-Type-Mem-Sub
Γ⊢𝑥:𝑇
Γ⊢𝑥:𝜇(𝑥:𝑇)
DOT-Rec-I
Γ⊢𝑥:𝜇(𝑧:𝑇)
Γ⊢𝑥:𝑇[𝑥/𝑧]
DOT-Rec-E
Γ⊢𝑥:{𝑎:𝑇}
Γ⊢𝑥.𝑎:𝑇
DOT-Fld-E
An inert recursive object type has pairwise distinct fields and only tight members {𝐴:𝑇..𝑇}. Tight selection replaces the two general rules by
Γ⊢!𝑥:{𝐴:𝑇..𝑇}
Γ⊢#𝑇<:𝑥.𝐴
DOT-T-Sel-L
Γ⊢!𝑥:{𝐴:𝑇..𝑇}
Γ⊢#𝑥.𝐴<:𝑇
DOT-T-Sel-U
Concrete type definitions are tight by construction:
Γ⊢𝑇𝗍𝗒𝗉𝖾
Γ⊢{𝐴=𝑇}:{𝐴:𝑇..𝑇}
DOT-Def-Type
Stable paths and pDOT
Stable paths are variables and immutable field paths:
𝑥:𝑇∈Γ
Γ⊢𝑥𝗉𝖺𝗍𝗁
P-Var
Γ⊢𝑝:{𝑎:𝑇}
Γ⊢𝑝.𝑎𝗉𝖺𝗍𝗁
P-Fld
Singletons propagate only toward a typeable target prefix:
Γ⊢𝑝:𝑞.𝗍𝗒𝗉𝖾Γ⊢𝑞:𝑇
Γ⊢𝑝:𝑇
Sngl-Trans
Γ⊢𝑝:𝑞.𝗍𝗒𝗉𝖾Γ⊢𝑞.𝑎𝗉𝖺𝗍𝗁
Γ⊢𝑝.𝑎:𝑞.𝑎.𝗍𝗒𝗉𝖾
Sngl-E
One-occurrence replacement is formation-indexed. The path-prefix relation checks every complete changed prefix:
Γ⊢𝑞𝗉𝖺𝗍𝗁
Γ⊢RPath(𝑝,𝑝,𝑞,𝑞)
RP-Here
Γ⊢RPath(𝑟,𝑝,𝑞,𝑟′)Γ⊢𝑟′.𝑎𝗉𝖺𝗍𝗁
Γ⊢RPath(𝑟.𝑎,𝑝,𝑞,𝑟′.𝑎)
RP-Fld
The selected leaf is also formed after replacement:
Γ⊢RPath(𝑟,𝑝,𝑞,𝑟′)Γ⊢𝑟′.𝐴𝗍𝗒𝗉𝖾
Γ⊢Replace(𝑟.𝐴,𝑝,𝑞,𝑟′.𝐴)
R-Sel
Γ⊢RPath(𝑟,𝑝,𝑞,𝑟′)Γ⊢𝑟′.𝗍𝗒𝗉𝖾𝗍𝗒𝗉𝖾
Γ⊢Replace(𝑟.𝗍𝗒𝗉𝖾,𝑝,𝑞,𝑟′.𝗍𝗒𝗉𝖾)
R-Sngl
Structural replacement descends through exactly one field, member bound, or intersection component. For function domains it checks the unchanged codomain under the replaced domain; for function codomains and recursive self types it alpha-renames the binder away from the two paths and checks the target codomain or recursive type. One-occurrence replacement is then bidirectional at subtyping:
Γ⊢𝑝:𝑞.𝗍𝗒𝗉𝖾Γ⊢𝑞𝗉𝖺𝗍𝗁Γ⊢Replace(𝑇,𝑝,𝑞,𝑈)
Γ⊢𝑇<:𝑈
Repl-pq
Γ⊢𝑝:𝑞.𝗍𝗒𝗉𝖾Γ⊢𝑝𝗉𝖺𝗍𝗁Γ⊢Replace(𝑇,𝑞,𝑝,𝑈)
Γ⊢𝑇<:𝑈
Repl-qp
Nested initialization substitutes the installed path for inner self and requires a tight record:
𝑝.𝑎;Γ⊢𝑑[𝑝.𝑎/𝑦]:𝑇[𝑝.𝑎/𝑦]TightRecord(𝑇)
𝑝;Γ⊢{𝑎=𝜈(𝑦:𝑇)𝑑}:{𝑎:𝜇(𝑦:𝑇)}
Def-New
The body premise can be derived only after every path in 𝑑[𝑝.𝑎/𝑦] and 𝑇[𝑝.𝑎/𝑦] passes the path-formation rules. The source rule has no third path premise. Path lookup follows immutable stored fields; it is separate from term reduction.
Proof-dependent classical control
Proofs, left contexts, and commands have the three regular judgments Γ⊢𝑝:𝐴∣Δ, Γ∣𝑒:𝐴⊢Δ, and 𝑐:(Γ⊢Δ). Regular judgments carry no dependency list. Their control core is
Γ⊢𝑝:𝐴∣ΔΓ∣𝑒:𝐴⊢Δ
⟨𝑝∥𝑒⟩:(Γ⊢Δ)
Cut
𝑐:(Γ⊢𝛼:𝐴,Δ)
Γ⊢𝜇𝛼.𝑐:𝐴∣Δ
μ-R
𝑐:(Γ,𝑎:𝐴⊢Δ)
Γ∣̃𝜇𝑎.𝑐:𝐴⊢Δ
μ-L
Dependent products use
Γ,𝑎:𝐴⊢𝑝:𝐵∣Δ
Γ⊢𝜆𝑎.𝑝:Π𝑎:𝐴.𝐵∣Δ
Π-R
Γ⊢𝑞:𝐴∣ΔΓ∣𝑒:𝐵[𝑞/𝑎]⊢Δ𝑞∉NEF⟹𝑎∉𝖥𝖵(𝐵)
Γ∣𝑞⋅𝑒:Π𝑎:𝐴.𝐵⊢Δ
Π-L
Thus a proof outside NEF is permitted only when the codomain is independent of the proof variable. The complete mutually generated fragment used here is 𝑝𝑁::=𝑉𝑝∣(𝑡,𝑝𝑁)∣𝜇⋆.𝑐𝑁∣prf𝑝𝑁∣subst𝑝𝑁𝑞𝑁,𝑐𝑁::=⟨𝑝𝑁∥𝑒𝑁⟩,𝑒𝑁::=⋆∣̃𝜇𝑎.𝑐𝑁. Here ⋆ is the single continuation local to the fragment; it is not the calculus continuation ̂𝗍𝗉. Thus 𝜇⋆.𝑐𝑁 is admitted only with a command and context generated by the two displayed clauses. An ordinary 𝜇𝛼.𝑐 proof and an application spine are rejected, while variables, lambdas, positive pairs, reflexivity, and the displayed delimited 𝜇⋆ form are admitted. The principal roots are ⟨𝑉∥̃𝜇𝑎.𝑐⟩⟶𝑐[𝑉/𝑎],⟨𝜇𝛼.𝑐∥𝑒⟩⟶𝑐[𝑒/𝛼]. The dependent mode alone carries a list 𝜎::=𝜖∣𝜎{𝑟∣𝑞}. Formula compatibility is 𝐴𝜖={𝐴},𝐴𝜎{𝑟∣𝑞}={𝐴𝜎∪(𝐴[𝑞/𝑟])𝜎,𝑞∈NEF,𝐴𝜎,𝑞∉NEF. Its judgments are Γ∣𝑒:𝐴⊢𝑑Δ,̂𝗍𝗉:𝐵;𝜎 and 𝑐:(Γ⊢𝑑Δ,̂𝗍𝗉:𝐵;𝜎). The bridge rules include
𝑐:(Γ⊢𝑑Δ,̂𝗍𝗉:𝐴;𝜖)
Γ⊢𝜇̂𝗍𝗉.𝑐:𝐴∣Δ
μtp
Γ⊢𝑝:𝐴∣ΔΓ∣𝑒:𝐴⊢𝑑Δ,̂𝗍𝗉:𝐵;𝜎{⋅∣𝑝}
⟨𝑝∥𝑒⟩:(Γ⊢𝑑Δ,̂𝗍𝗉:𝐵;𝜎)
Cut-d
The proof premise of Cut-𝑑 is regular. The dependent context uses the open list entry to reconcile its formula with the regular proof’s formula. The distinguished continuation ̂𝗍𝗉 freezes the enclosing context while that dependency is open.
Graded erasure: additional formation, equality, usage, and dynamics
Together with the graded-erasure card immediately above, the rules below record the noninherited part of the signature in definition 101.2, definition 101.3, definition 101.4, definition 101.5, definition 101.9. Appendix A does not repeat the binder, congruence, and constructor schemas displayed in those definitions; those point-of-use displays are the complete signature.
The quantifier and functional-passing rules are printed in the dependent session card above. The propositions-as-sessions rules are inherited from subappendix A.61; the seven rules below are the additional base rules used by definition 102.1. Thus every omitted rule has one named earlier card rather than an implicit premise.
Ψ;Γ;⋅⟹𝟎::𝑧:𝟏
Ψ;Γ;Δ⟹𝑃::𝑧:𝐶
Ψ;Γ;Δ,𝑥:𝟏⟹𝑃::𝑧:𝐶
Ψ;Γ;Δ,𝑥:𝐴⟹𝑃::𝑧:𝐵
Ψ;Γ;Δ⟹𝑧(𝑥).𝑃::𝑧:𝐴⊸𝐵
Ψ;Γ;Δ1⟹𝑃::𝑦:𝐴Ψ;Γ;Δ2,𝑥:𝐵⟹𝑄::𝑧:𝐶
Ψ;Γ;Δ1,Δ2,𝑥:𝐴⊸𝐵⟹(𝜈𝑦)𝑥⟨𝑦⟩.(𝑃∣𝑄)::𝑧:𝐶
Ψ;Γ;⋅⟹𝑃::𝑦:𝐴
Ψ;Γ;⋅⟹!𝑧(𝑦).𝑃::𝑧:!𝐴
!R
Ψ;Γ,𝑢:𝐴;Δ⟹𝑃::𝑧:𝐶
Ψ;Γ;Δ,𝑥:!𝐴⟹𝑃[𝑥/𝑢]::𝑧:𝐶
!L
Ψ;Γ;⋅⟹𝑃::𝑥:𝐴Ψ;Γ,𝑢:𝐴;Δ⟹𝑄::𝑧:𝐶
Ψ;Γ;Δ⟹(𝜈𝑢)((!𝑢(𝑥).𝑃)∣𝑄)::𝑧:𝐶
Cut^!
Dependent effects: additional operation and inclusion delta
The value/computation boundary and both bind rules are printed in the card above. The following rules supplement the point-of-use operation, stack, and machine signatures in definition 103.4, definition 103.8. Those definitions display the complete transition relation; this card does not duplicate every constructor-preserving machine frame.
Γ,𝑥:𝖡⊢𝐴:𝖴Γ⊢⋆:𝐴[𝗍𝗋𝗎𝖾/𝑥]Γ⊢⋆:𝐴[𝖿𝖺𝗅𝗌𝖾/𝑥]
Γ,𝑥:𝖡⊢⋆:𝐴
Dep- B-E
Γ⊢𝖼𝖽𝗂𝗏𝖾𝗋𝗀𝖾𝐵――:𝐵――
Diverge
Γ,𝑧:𝑈𝐵――⊢𝖼𝑀:𝐵――
Γ⊢𝖼𝜇𝐵――𝑧𝑀:𝐵――
Rec
Γ⊢𝖼𝖾𝗋𝗋𝗈𝗋𝐵――𝑒:𝐵――
Error
Γ⊢𝖼𝑀:𝐵――
Γ⊢𝖼𝗉𝗋𝗂𝗇𝗍𝑚.𝑀:𝐵――
Print
{Γ⊢𝖼𝑀𝑖:𝐵――}1≤𝑖≤𝑛
Γ⊢𝖼𝖼𝗁𝗈𝗈𝗌𝖾𝑖(𝑀𝑖):𝐵――
Choose
Γ;𝐶――⊢𝗄𝗇𝗂𝗅:𝐶――
Nil
Γ⊢𝗏𝑉:𝐴Γ;𝐵――[𝑉/𝑥]⊢𝗄𝐾:𝐶――
Γ;Π𝑥:𝐴𝐵――⊢𝗄𝑉::𝐾:𝐶――
Arg
Γ⊢𝖼𝑁:𝐵――[𝗍𝗁𝗎𝗇𝗄𝑀/𝑧]
Γ⊢𝖼𝑁:𝐵――[𝗍𝗁𝗎𝗇𝗄(𝗐𝗋𝗂𝗍𝖾𝑠.𝑀)/𝑧]
Incl-Write
Γ⊢𝖼𝑁:𝐵――[𝗍𝗁𝗎𝗇𝗄𝑀𝑠′/𝑧]
Γ⊢𝖼𝑁:𝐵――[𝗍𝗁𝗎𝗇𝗄(𝗋𝖾𝖺𝖽𝗍𝗈𝑠(𝑀𝑠))/𝑧]
Incl-Read
Γ⊢𝖼𝑁:𝐵――[𝗍𝗁𝗎𝗇𝗄𝑀/𝑧]
Γ⊢𝖼𝑁:𝐵――[𝗍𝗁𝗎𝗇𝗄(𝗉𝗋𝗂𝗇𝗍𝑚.𝑀)/𝑧]
Incl-Print
Γ⊢𝖼𝑁:𝐵――[𝗍𝗁𝗎𝗇𝗄𝑀𝑖′/𝑧]
Γ⊢𝖼𝑁:𝐵――[𝗍𝗁𝗎𝗇𝗄(𝖼𝗁𝗈𝗈𝗌𝖾𝑖(𝑀𝑖))/𝑧]
Incl-Choose
Weakest preconditions: execution rules
The transformer equations and WP-Return, WP-Bind, and WP-Sub are printed in the preceding card. These are the two additional execution rules of definition 104.6.
The declarative product, refinement, and cast rules are printed in the card above. The following formation and bidirectional rules form the algorithmic delta of definition 106.1, definition 106.4; the complete rule families remain displayed at those definitions.
The selection, recursive-self, field, and tight-member rules are printed in the object-type card above. The following structural and definition rules supplement the complete point-of-use family in definition 107.2; this card does not duplicate its application, let, and evaluation-context schemas.
Γ⊢𝑇<:⊤
DOT-Top
Γ⊢⊥<:𝑇
DOT-Bot
Γ⊢𝑇<:𝑇
DOT-Refl
Γ⊢𝑆<:𝑇Γ⊢𝑇<:𝑈
Γ⊢𝑆<:𝑈
DOT-Trans
Γ⊢𝑇∧𝑈<:𝑇
DOT-And_1-
Γ⊢𝑇∧𝑈<:𝑈
DOT-And_2-
Γ⊢𝑆<:𝑇Γ⊢𝑆<:𝑈
Γ⊢𝑆<:𝑇∧𝑈
DOT–And
Γ⊢𝑇<:𝑈
Γ⊢{𝑎:𝑇}<:{𝑎:𝑈}
DOT-Fld–Fld
Γ,𝑥:𝑇⊢𝑑:𝑇
Γ⊢𝜈(𝑥:𝑇)𝑑:𝜇(𝑥:𝑇)
DOT-Obj-I
Γ⊢𝑡:𝑇
Γ⊢{𝑎=𝑡}:{𝑎:𝑇}
DOT-Def-Val
Γ⊢𝑑1:𝑇1Γ⊢𝑑2:𝑇2dom(𝑑1)∩dom(𝑑2)=∅
Γ⊢𝑑1∧𝑑2:𝑇1∧𝑇2
DOT-Def-And
Fully path-dependent types: additional replacement and lookup delta
The stable-path, singleton, replacement-leaf, and nested-initialization rules are printed in the pDOT card above. The following rules complete the named replacement descent and lookup deltas; all unchanged DOT rules are inherited from definition 107.2.
The cut, control, dependent-product, NEF, and dependency-list rules are printed in the classical-control card above. The following rules form the distinctive delta of definition 109.1, definition 109.4; the ordinary positive and equality schemas remain at those point-of-use definitions.