System F quantifies over types but cannot abstract over a type constructor.
A container operation that cannot be typed
For the examples in this chapter we extend System F by a primitive base ℕ and primitive binary products: 𝐴,𝐵::=𝑢∣ℕ∣𝐴→𝐵∣𝐴×𝐵∣∀𝑢.𝐴. Consider the mapping operation of a container: for the “diagonal” container that stores two elements of the same type, it is the function that applies 𝑓:𝑎→𝑏 to both components of a pair. For lists it is the usual map, for trees the relabeling of every node. We would like one type that all of these mapping operations share, quantified over the container itself: ∀𝑐.∀𝑎.∀𝑏.(𝑎→𝑏)→𝑐𝑎→𝑐𝑏. The attempt fails already at formation. In System F the judgment Δ⊢𝐴𝗍𝗒𝗉𝖾 is derived by one rule per production of the grammar above, and the subexpression 𝑐𝑎 matches none of them: there is no production applying one type expression to another. The stuck attempt is
noapplicableformationrule
Δ,𝑐,𝑎,𝑏⊢𝑐𝑎𝗍𝗒𝗉𝖾
?
and no rule has a conclusion of the form 𝑐𝑎𝗍𝗒𝗉𝖾. The variable 𝑐 is being used as a function on types, while System F’s type variables stand only for types. The repair is the same one that distinguishes numbers from functions on numbers: classify type expressions, and let the classification include function classifications. The classifications of type expressions are called kinds.
Kinds are generated by the grammar 𝜅::=𝖳𝗒∣𝜅1→𝜅2. The kind 𝖳𝗒 classifies types, the type expressions that classify terms. The kind 𝜅1→𝜅2 classifies operators taking an argument of kind 𝜅1 to a result of kind 𝜅2. Kinds contain no variables, binders, or reduction. The kind arrow classifies constructor functions, whereas 𝐴→𝐵 is itself a constructor of kind 𝖳𝗒.
The container variable 𝑐 of (7.1) will receive kind 𝖳𝗒→𝖳𝗒. Since type expressions of higher kind are no longer types, we rename the syntactic class: its elements are constructors, and the constructors of kind 𝖳𝗒 are the types.
The judgment Δ⊢𝐴::𝜅 is read “constructor 𝐴 has kind 𝜅.” Accordingly, the binder 𝑢::𝜅 declares that 𝑢 has kind 𝜅; this double colon is not the grammar symbol ::=. Constructors are generated by the grammar 𝐴,𝐵,𝐶::=𝑢∣ℕ∣𝐴→𝐵∣𝐴×𝐵∣∀𝑢::𝜅.𝐴∣∃𝑢::𝜅.𝐴∣𝜆𝑢::𝜅.𝐴∣𝐴𝐵, where 𝑢 ranges over constructor variables. We identify generated trees up to alpha-renaming, following chapter 1. A concrete checker must therefore compare normal forms modulo renaming of bound variables. Constructor application binds more tightly than →, and a quantifier body extends maximally to the right; arrows associate to the right.
A kind contextΔ=𝑢1::𝜅1,…,𝑢𝑛::𝜅𝑛 declares finitely many distinct constructor variables with their kinds. Formation is an explicit judgment:
⋅𝗄𝖼𝗍𝗑
KCtx-Empty
Δ𝗄𝖼𝗍𝗑𝑢∉dom(Δ)
Δ,𝑢::𝜅𝗄𝖼𝗍𝗑
KCtx-Ext
The kinding judgment is defined only over a formed kind context and is inductively generated by:
Δ𝗄𝖼𝗍𝗑(𝑢::𝜅)∈Δ
Δ⊢𝑢::𝜅
K-Var
Δ𝗄𝖼𝗍𝗑
Δ⊢ℕ::𝖳𝗒
K-Nat
Δ⊢𝐴::𝖳𝗒Δ⊢𝐵::𝖳𝗒
Δ⊢𝐴→𝐵::𝖳𝗒
K-Arr
Δ⊢𝐴::𝖳𝗒Δ⊢𝐵::𝖳𝗒
Δ⊢𝐴×𝐵::𝖳𝗒
K-Prod
Δ,𝑢::𝜅𝗄𝖼𝗍𝗑Δ,𝑢::𝜅⊢𝐴::𝖳𝗒
Δ⊢∀𝑢::𝜅.𝐴::𝖳𝗒
K-All
Δ,𝑢::𝜅𝗄𝖼𝗍𝗑Δ,𝑢::𝜅⊢𝐴::𝖳𝗒
Δ⊢∃𝑢::𝜅.𝐴::𝖳𝗒
K-Some
Δ,𝑢::𝜅1𝗄𝖼𝗍𝗑Δ,𝑢::𝜅1⊢𝐴::𝜅2
Δ⊢𝜆𝑢::𝜅1.𝐴::𝜅1→𝜅2
K-Abs
Δ⊢𝐴::𝜅1→𝜅2Δ⊢𝐵::𝜅1
Δ⊢𝐴𝐵::𝜅2
K-App
The existential former ∃𝑢::𝜅.𝐴 participates in constructor formation, conversion, and normalization. The term grammar studied here has no package introduction or elimination form. It is present so that the next chapter can add package terms while reusing this constructor language and its kinding, substitution, normalization, and conversion metatheory without redefining them.
For example, K-Some is used in the derivation 𝑢::𝖳𝗒𝗄𝖼𝗍𝗑𝑢::𝖳𝗒⊢𝑢×𝑢::𝖳𝗒⋅⊢∃𝑢::𝖳𝗒.𝑢×𝑢::𝖳𝗒K−Some.
The variable, abstraction, and application fragment of kinding is precisely the simply typed 𝜆-calculus of chapter 2, moved up one level: kinds play the role of simple types, 𝖳𝗒 is the base kind, and K-Var, K-Abs, K-App correspond to Var, Lam, App. The nullary and binary former rules add constants at the base kind. The binding formers ∀ and ∃ are separate syntax and are not silently encoded as constants. Constructor binders and term binders therefore use the same freshness and renaming discipline while inhabiting different judgments.
Define the mapping-type operator and the diagonal container: 𝖬𝖺𝗉:=𝜆𝑐::𝖳𝗒→𝖳𝗒.∀𝑎::𝖳𝗒.∀𝑏::𝖳𝗒.(𝑎→𝑏)→𝑐𝑎→𝑐𝑏,𝖯:=𝜆𝑢::𝖳𝗒.𝑢×𝑢.
Put Δ𝑐:=𝑐::𝖳𝗒→𝖳𝗒 and Δ0:=Δ𝑐,𝑎::𝖳𝗒,𝑏::𝖳𝗒. The complete bottom-up derivation of the body of 𝖬𝖺𝗉 is the following list; each line uses only earlier lines on the list. Δ0⊢𝑐::𝖳𝗒→𝖳𝗒𝐾−𝑉𝑎𝑟,Δ0⊢𝑎::𝖳𝗒,𝑏::𝖳𝗒𝐾−𝑉𝑎𝑟,Δ0⊢𝑐𝑎::𝖳𝗒,𝑐𝑏::𝖳𝗒𝐾−𝐴𝑝𝑝,Δ0⊢𝑎→𝑏::𝖳𝗒𝐾−𝐴𝑟𝑟,Δ0⊢𝑐𝑎→𝑐𝑏::𝖳𝗒𝐾−𝐴𝑟𝑟,Δ0⊢(𝑎→𝑏)→𝑐𝑎→𝑐𝑏::𝖳𝗒𝐾−𝐴𝑟𝑟,Δ𝑐,𝑎::𝖳𝗒⊢∀𝑏::𝖳𝗒.(𝑎→𝑏)→𝑐𝑎→𝑐𝑏::𝖳𝗒𝐾−𝐴𝑙𝑙,Δ𝑐⊢∀𝑎::𝖳𝗒.∀𝑏::𝖳𝗒.(𝑎→𝑏)→𝑐𝑎→𝑐𝑏::𝖳𝗒𝐾−𝐴𝑙𝑙. Rule K-Abs now gives ⊢𝖬𝖺𝗉::(𝖳𝗒→𝖳𝗒)→𝖳𝗒. Likewise K-Var, K-Prod, and K-Abs give ⊢𝖯::𝖳𝗒→𝖳𝗒, after which K-App gives ⊢𝖬𝖺𝗉𝖯::𝖳𝗒. The row labelled K-App is exactly the use of a type variable that System F could not form.
A type such as 𝖬𝖺𝗉𝖯 classifies terms, but no typing rule stated so far connects it with its unfolding. A term of type 𝖬𝖺𝗉𝖯 ought to be exactly a term of type ∀𝑎.∀𝑏.(𝑎→𝑏)→(𝑎×𝑎)→(𝑏×𝑏): the two types differ only by performing the substitution that K-Abs and K-App promise. We therefore equip the constructor level with computation, and the term level with a rule transporting typing across it.
Type-level reduction is the one-step relation 𝐴⟶𝛽𝐴′ on constructors, inductively defined by the axiom
(𝜆𝑢::𝜅.𝐴)𝐵⟶𝛽𝐴[𝐵/𝑢]
TR-Beta
together with the complete congruence family
𝐴⟶𝛽𝐴′
𝐴𝐵⟶𝛽𝐴′𝐵
TR-App_1
𝐵⟶𝛽𝐵′
𝐴𝐵⟶𝛽𝐴𝐵′
TR-App_2
𝐴⟶𝛽𝐴′
(𝐴→𝐵)⟶𝛽(𝐴′→𝐵)
TR-Arr_1
𝐵⟶𝛽𝐵′
(𝐴→𝐵)⟶𝛽(𝐴→𝐵′)
TR-Arr_2
𝐴⟶𝛽𝐴′
𝐴×𝐵⟶𝛽𝐴′×𝐵
TR-Prod_1
𝐵⟶𝛽𝐵′
𝐴×𝐵⟶𝛽𝐴×𝐵′
TR-Prod_2
𝐴⟶𝛽𝐴′
𝜆𝑢::𝜅.𝐴⟶𝛽𝜆𝑢::𝜅.𝐴′
TR-Abs
𝐴⟶𝛽𝐴′
∀𝑢::𝜅.𝐴⟶𝛽∀𝑢::𝜅.𝐴′
TR-All
𝐴⟶𝛽𝐴′
∃𝑢::𝜅.𝐴⟶𝛽∃𝑢::𝜅.𝐴′
TR-Some
There are no other one-step reductions. We write ⟶∗𝛽 for the reflexive–transitive closure. A normal constructor admits no ⟶𝛽 step; a neutral constructor is not a 𝜆-abstraction. This arrow reduces constructors. It is distinct from the term-level beta reduction of chapter 5, despite the shared historical subscript.
This is the constructor-level specialization of “not an introduction form.” For constructor beta reduction the only introduction that can create a root redex under application is a constructor lambda. Thus arrows, products, and quantifiers count as neutral here even though they are type formers. In particular a beta redex is neutral: its outer constructor is application. This is the use of (CR3) in lemma 7.18.
For example, 𝖬𝖺𝗉𝖯⟶𝛽∀𝑎::𝖳𝗒.∀𝑏::𝖳𝗒.(𝑎→𝑏)→𝖯𝑎→𝖯𝑏⟶∗𝛽∀𝑎::𝖳𝗒.∀𝑏::𝖳𝗒.(𝑎→𝑏)→(𝑎×𝑎)→(𝑏×𝑏), and the last constructor is normal. By contrast 𝑐𝑎, with 𝑐 a variable, is neutral and normal: computation is stuck on it. The decision procedure of section 7.5 must therefore retain, rather than unfold, this application.
Constructor equality is the congruence generated by this computation. We record it as a judgment so that derivations can cite it.
This chapter freezes constructor conversion at 𝛽-conversion. It does not add the constructor 𝜂-law 𝜆𝑢::𝜅.𝐴𝑢≡𝐴 when 𝑢∉𝖿𝗏(𝐴). Adding that law would require 𝛽𝜂-normal forms and a corresponding extension of the common-reduct characterization below; the present theorem 7.25 is stated only for ⟶∗𝛽.
Terms are generated by 𝑒::=𝑥∣𝜆𝑥:𝐴.𝑒∣𝑒1𝑒2∣Λ𝑢::𝜅.𝑒∣𝑒[𝐶]∣(𝑒1,𝑒2)∣𝗉𝗋1𝑒∣𝗉𝗋2𝑒∣𝟢∣𝗌𝗎𝖼(𝑒), This is the term grammar of 𝐹𝜔 used here; in particular, it has no package form. A term context Γ=𝑥1:𝐴1,…,𝑥𝑘:𝐴𝑘 declares distinct term variables at types; the judgment Δ;Γ⊢𝑒:𝐴 presupposes Δ⊢𝐴𝑖::𝖳𝗒 for each declaration and Δ⊢𝐴::𝖳𝗒. Write Δ⊢Γ𝖼𝗍𝗑 for that presupposition, generated by
Δ𝗄𝖼𝗍𝗑
Δ⊢⋅𝖼𝗍𝗑
Ctx-Empty
Δ⊢Γ𝖼𝗍𝗑Δ⊢𝐴::𝖳𝗒𝑥∉dom(Γ)
Δ⊢Γ,𝑥:𝐴𝖼𝗍𝗑
Ctx-Ext
The term typing rules are:
(𝑥:𝐴)∈Γ
Δ;Γ⊢𝑥:𝐴
T-Var
Δ⊢𝐴::𝖳𝗒Δ;Γ,𝑥:𝐴⊢𝑒:𝐵
Δ;Γ⊢𝜆𝑥:𝐴.𝑒:𝐴→𝐵
T-Lam
Δ;Γ⊢𝑒1:𝐴→𝐵Δ;Γ⊢𝑒2:𝐴
Δ;Γ⊢𝑒1𝑒2:𝐵
T-App
𝑢∉dom(Δ)∪fv(Γ)Δ,𝑢::𝜅;Γ⊢𝑒:𝐴
Δ;Γ⊢Λ𝑢::𝜅.𝑒:∀𝑢::𝜅.𝐴
T-TLam
Δ;Γ⊢𝑒:∀𝑢::𝜅.𝐴Δ⊢𝐶::𝜅
Δ;Γ⊢𝑒[𝐶]:𝐴[𝐶/𝑢]
T-TApp
Δ;Γ⊢𝑒1:𝐴1Δ;Γ⊢𝑒2:𝐴2
Δ;Γ⊢(𝑒1,𝑒2):𝐴1×𝐴2
T-Pair
Δ;Γ⊢𝑒:𝐴1×𝐴2
Δ;Γ⊢𝗉𝗋𝑖𝑒:𝐴𝑖
T-Prj
Δ;Γ⊢𝟢:ℕ
T-Zero
Δ;Γ⊢𝑒:ℕ
Δ;Γ⊢𝗌𝗎𝖼(𝑒):ℕ
T-Suc
Δ;Γ⊢𝑒:𝐴Δ⊢𝐴≡𝐵::𝖳𝗒
Δ;Γ⊢𝑒:𝐵
T-Conv
The function rules correspond to F-Var, F-Arr-I, and F-Arr-E of chapter 5; T-TLam and T-TApp correspond to F-All-I and F-All-E. Their local names expose the term forms. In T-TLam freshness is printed as a premise rather than left to the formation presupposition. Rule T-Conv is the sole point at which constructor equality enters term typing; everything proved about ≡ in section 7.4, section 7.5 exists to keep this one rule checkable.
The values of the package-free term grammar are 𝑣::=𝜆𝑥:𝐴.𝑒∣Λ𝑢::𝜅.𝑒∣(𝑣1,𝑣2)∣𝟢∣𝗌𝗎𝖼(𝑣). The one-step relation 𝑒⟶𝑒′ is generated by the three root contractions
(𝜆𝑥:𝐴.𝑒)𝑣⟶𝑒[𝑣/𝑥]
E-Beta
(Λ𝑢::𝜅.𝑒)[𝐶]⟶𝑒[𝐶/𝑢]
E-TBeta
𝑖∈{1,2}
𝗉𝗋𝑖(𝑣1,𝑣2)⟶𝑣𝑖
E-PrjPair
and the complete congruence family
𝑒1⟶𝑒′1
𝑒1𝑒2⟶𝑒′1𝑒2
E-App_1
𝑒2⟶𝑒′2
𝑣1𝑒2⟶𝑣1𝑒′2
E-App_2
𝑒⟶𝑒′
𝑒[𝐶]⟶𝑒′[𝐶]
E-TApp
𝑒1⟶𝑒′1
(𝑒1,𝑒2)⟶(𝑒′1,𝑒2)
E-Pair_1
𝑒2⟶𝑒′2
(𝑣1,𝑒2)⟶(𝑣1,𝑒′2)
E-Pair_2
𝑒⟶𝑒′
𝗉𝗋𝑖𝑒⟶𝗉𝗋𝑖𝑒′
E-Prj
𝑒⟶𝑒′
𝗌𝗎𝖼(𝑒)⟶𝗌𝗎𝖼(𝑒′)
E-Suc
There is no reduction under 𝜆 or Λ. In particular, E-App2 and E-Pair2 become available only after the left subterm is a value. Write ⟶∗ for the reflexive–transitive closure of ⟶.
The type-beta root substitutes a constructor into every annotation and type argument in the body. It is term evaluation, not a ⟶𝛽 step between constructors.
Let 𝗂𝖽𝜔:=Λ𝑎::𝖳𝗒.𝜆𝑥:𝑎.𝑥. Then 𝗂𝖽𝜔[ℕ](𝗌𝗎𝖼(𝟢))⟶(𝜆𝑥:ℕ.𝑥)(𝗌𝗎𝖼(𝟢))⟶𝗌𝗎𝖼(𝟢). The first step is E-TBeta; the second is E-Beta. By contrast, 𝟢𝟢 is closed and stuck, but T-App cannot type it because ℕ does not convert to an arrow. Safety will exclude stuck nonvalues from the well-typed closed fragment.
Define 𝖽𝗆𝖺𝗉:=Λ𝑎::𝖳𝗒.Λ𝑏::𝖳𝗒.𝜆𝑓:𝑎→𝑏.𝜆𝑝:𝑎×𝑎.(𝑓(𝗉𝗋1𝑝),𝑓(𝗉𝗋2𝑝)). Writing Δ1:=𝑎::𝖳𝗒,𝑏::𝖳𝗒 and Γ1:=𝑓:𝑎→𝑏,𝑝:𝑎×𝑎, rules T-Var and T-Prj give Δ1;Γ1⊢𝗉𝗋𝑖𝑝:𝑎 for 𝑖=1,2, rule T-App then Δ1;Γ1⊢𝑓(𝗉𝗋𝑖𝑝):𝑏, and rule T-PairΔ1;Γ1⊢(𝑓(𝗉𝗋1𝑝),𝑓(𝗉𝗋2𝑝)):𝑏×𝑏, and two uses of T-Lam and two of T-TLam give ⋅;⋅⊢𝖽𝗆𝖺𝗉:∀𝑎::𝖳𝗒.∀𝑏::𝖳𝗒.(𝑎→𝑏)→(𝑎×𝑎)→(𝑏×𝑏). This is not yet the type 𝖬𝖺𝗉𝖯. The bridge is a constructor-equality derivation: Q-Beta gives 𝖯𝑎≡𝑎×𝑎 and 𝖯𝑏≡𝑏×𝑏; Q-Arr, Q-All, and one more Q-Beta for the outer redex 𝖬𝖺𝗉𝖯, chained by Q-Sym and Q-Trans, yield ⋅⊢∀𝑎::𝖳𝗒.∀𝑏::𝖳𝗒.(𝑎→𝑏)→(𝑎×𝑎)→(𝑏×𝑏)≡𝖬𝖺𝗉𝖯::𝖳𝗒, and T-Conv concludes ⋅;⋅⊢𝖽𝗆𝖺𝗉:𝖬𝖺𝗉𝖯. The conversion step is not bureaucracy: without it, this outer T-TLam derivation stops at the unfolded universal type. It cannot assign 𝖽𝗆𝖺𝗉 the syntactically application-headed type 𝖬𝖺𝗉𝖯.
The metatheory of kinding repeats, one level up, the metatheory of simple typing developed in chapter 2. We nevertheless copy the short inductions here, because their binder decompositions determine the substitutions used throughout the chapter.
Constructor substitution is determined by 𝑢[𝐶/𝑢]=𝐶,𝑣[𝐶/𝑢]=𝑣(𝑣≠𝑢),ℕ[𝐶/𝑢]=ℕ,(𝐴𝐵)[𝐶/𝑢]=𝐴[𝐶/𝑢]𝐵[𝐶/𝑢],(𝐴⋆𝐵)[𝐶/𝑢]=𝐴[𝐶/𝑢]⋆𝐵[𝐶/𝑢],(⋄𝑣::𝜅.𝐴)[𝐶/𝑢]=⋄𝑣::𝜅.𝐴[𝐶/𝑢](𝑣≠𝑢,𝑣∉fv(𝐶)), where ⋆∈{→,×} and ⋄∈{𝜆,∀,∃}; first rename the binder when the freshness condition fails. Substitution through a term acts on every type annotation and type argument. Its binding clauses include (𝜆𝑥:𝐴.𝑒)[𝐶/𝑢]=𝜆𝑥:𝐴[𝐶/𝑢].𝑒[𝐶/𝑢],(𝑒[𝐴])[𝐶/𝑢]=(𝑒[𝐶/𝑢])[𝐴[𝐶/𝑢]]. The binder of Λ𝑣::𝜅.𝑒 is renamed away from fv(𝐶)∪{𝑢} before substitution continues into 𝑒; if 𝑣=𝑢, the substitution stops at the binder. On the remaining new term forms it is componentwise: (𝑒1,𝑒2)[𝐶/𝑢]=(𝑒1[𝐶/𝑢],𝑒2[𝐶/𝑢]),(𝗉𝗋𝑖𝑒)[𝐶/𝑢]=𝗉𝗋𝑖(𝑒[𝐶/𝑢]),𝟢[𝐶/𝑢]=𝟢,𝗌𝗎𝖼(𝑒)[𝐶/𝑢]=𝗌𝗎𝖼(𝑒[𝐶/𝑢]). Together with the term-substitution clauses of chapter 5, these equations define capture-avoiding substitution for the entire term grammar.
A finite simultaneous constructor substitution 𝜃 maps constructor variables to constructors and acts in one pass: 𝑢[𝜃]={𝜃(𝑢)𝑢∈dom(𝜃),𝑢𝑢∉dom(𝜃). It has homomorphic clauses for application and every former. Before entering ⋄𝑢::𝜅.𝐴, alpha-rename 𝑢 away from the free variables of every image of 𝜃, then remove 𝑢 from the domain. The same operation on terms changes every type annotation and type argument. Extension 𝜃,𝑢↦𝐵 agrees with 𝜃 away from 𝑢 and sends 𝑢 to 𝐵. Thus simultaneous substitution is one operation, not an unspecified sequence of single substitutions. We reserve 𝜃 for constructor substitution; 𝜎 continues to denote simultaneous term substitution as in definition 5.33.
Proof of Lemma 7.8 — Weakening and substitution for kinding
Proof. For weakening, induct on the displayed kinding derivation. In K-Var, the declaration used by the premise is still present after insertion. For K-App, K-Arr, and K-Prod, weaken every premise and reapply the same rule; K-Nat has no premises. In a binder rule, say K-Abs, first choose its bound variable 𝑣 fresh for the inserted declaration. Its premise has context Δ1,Δ2,𝑣::𝜅0; apply the induction hypothesis at this longer suffix and reapply K-Abs. The K-All and K-Some cases are identical.
For substitution, again induct on the final rule. If K-Var selects 𝑢, replace that leaf by the given derivation of 𝐵 and weaken it through Δ2; if it selects another variable, keep the leaf. For K-App, K-Arr, and K-Prod, apply the induction hypothesis to every premise and rebuild the same rule; K-Nat is unchanged. In a binder rule, choose the displayed binder 𝑣 distinct from 𝑢 and fresh for 𝐵. For example, the K-All premise is Δ1,𝑢::𝜅′,Δ2,𝑣::𝜅0⊢𝐴0::𝖳𝗒. The induction hypothesis, with suffix Δ2,𝑣::𝜅0, gives Δ1,Δ2,𝑣::𝜅0⊢𝐴0[𝐵/𝑢]::𝖳𝗒. Rule K-All concludes with subject ∀𝑣::𝜅0.𝐴0[𝐵/𝑢]. The binder clause of constructor substitution gives ∀𝑣::𝜅0.𝐴0[𝐵/𝑢]=(∀𝑣::𝜅0.𝐴0)[𝐵/𝑢]. Replacing K-All by K-Abs or K-Some gives the other two binder cases. ◻
★☆☆ Instantiate the substitution part of lemma 7.8 at the constructor ∀𝑣::𝖳𝗒.𝑢→𝑣. Use 𝐵=ℕ×ℕ, state the freshness choice for 𝑣, and display the complete kinding derivation of the substituted constructor.
The outer form of a constructor selects exactly one kinding rule. Consequently, if Δ⊢𝐴::𝜅 and Δ⊢𝐴::𝜅′, then 𝜅=𝜅′, and the two derivations are identical.
Proof of Lemma 7.9 — Kinding inversion and uniqueness
Proof. Rule selection is read off the table: the eight rules have subjects of eight distinct outer forms. This does not yet assert that an application’s intermediate domain kind is unique. Uniqueness of the conclusion kind is a structural induction on 𝐴. For 𝑢 the context determines 𝜅, declarations being distinct by KCtx-Ext. For ℕ, arrows, products, and both quantifiers the kind is 𝖳𝗒 in every derivation. For 𝜆𝑢::𝜅1.𝐴0, inversion gives 𝜅=𝜅1→𝜅2 and 𝜅′=𝜅1→𝜅′2 with both 𝜅2,𝜅′2 kinds of 𝐴0 in Δ,𝑢::𝜅1; the induction hypothesis gives 𝜅2=𝜅′2. Note that the domain kind is read off the annotation—this is where Church-style annotation is used, exactly as in lemma 2.19. For 𝐴1𝐴2, the inductive hypothesis for 𝐴1 equates the two arrow kinds, and injectivity of the kind grammar equates their codomains. For derivation uniqueness, the outer constructor first selects its kinding rule. In the application case it selects K-App; kind uniqueness just proved fixes the intermediate domain kind, and the induction hypotheses uniquely determine the derivations of Δ⊢𝐴1::𝜅1→𝜅2 and Δ⊢𝐴2::𝜅1, so the reconstructed K-App node is unique. For a variable, the unique context declaration fixes the leaf; K-Nat is the unique premise-free leaf. Arrow and product nodes have two premise derivations, each fixed by its induction hypothesis. Universal, existential, and abstraction nodes have one body premise under the binder, again fixed by the induction hypothesis. These cases exhaust the rule table. ◻
Proof. Induct on the typing derivation. At T-Var, context formation gives the declared type’s kind. The lambda, pair, and natural cases rebuild K-Arr, K-Prod, or K-Nat from the induction hypotheses. In an application or projection, lemma 7.9 inverts the kinding of the premise’s arrow or product type to obtain the required component. The T-TLam case uses K-All. The T-TApp case uses constructor substitution, lemma 7.8, on the body formation obtained by inverting K-All. Finally, the equality premise of T-Conv already forms its right endpoint at 𝖳𝗒. ◻
Proof of Lemma 7.10 — Subject reduction for kinding
Proof. Induction on the derivation of the step. For TR-Beta, the subject is (𝜆𝑢::𝜅1.𝐴0)𝐵. Inversion (lemma 7.9) gives Δ⊢𝜆𝑢::𝜅1.𝐴0::𝜅1→𝜅 and Δ⊢𝐵::𝜅1, and inverting again, Δ,𝑢::𝜅1⊢𝐴0::𝜅. Substitution (lemma 7.8) yields Δ⊢𝐴0[𝐵/𝑢]::𝜅. Each congruence case applies the inductive hypothesis to the stepped premise of the inverted rule and reapplies the rule. ◻
Proof. Rule induction. Q-Refl and the congruence rules are immediate from their premises and the corresponding kinding rules; Q-Sym and Q-Trans rearrange inductive hypotheses; Q-Beta kinds its left side by K-Abs and K-App and its right side by lemma 7.8. ◻
Proof of Lemma 7.12 — Reduction is included in equality
Proof. Induction on the step. At a redex, inversion gives Δ,𝑢::𝜅1⊢𝐴0::𝜅2 and Δ⊢𝐵::𝜅1, exactly the premises of Q-Beta. A congruence step in an argument position uses the inductive hypothesis there, Q-Refl at the unchanged positions, and the matching congruence rule Q-Arr, …, Q-App. The starred form follows by Q-Refl and Q-Trans, using lemma 7.10 to keep each intermediate constructor kinded. ◻
Normalization at the type level
Rule T-Conv obliges a type checker to decide Δ⊢𝐴≡𝐵::𝜅. Every kinded constructor is strongly normalizing, and local confluence gives it a unique beta-normal form; therefore equality holds exactly when the two normal forms agree. The normalization proof lifts the reducibility construction of chapter 2 to constructors: at 𝖳𝗒 reducibility is strong normalization, while at 𝜅1→𝜅2 it means mapping every member of Red𝜅1 into Red𝜅2. The three required closure properties are normalization, reduction closure, and neutral expansion, the clauses (CR1)–(CR3) of definition 5.25. The clause names are reused by analogy only: here they classify constructors, and SN below means constructor strong normalization rather than either System F term set.
Every constructor has finitely many one-step reducts. Hence for 𝐴∈SN the length of a longest reduction sequence from 𝐴 is a finite number 𝜈(𝐴), and 𝐴⟶𝛽𝐴′ implies 𝜈(𝐴′)<𝜈(𝐴).
Proof of Lemma 7.14 — Finite branching and reduction height
Proof. Finite branching is a structural induction: a step is either TR-Beta at the root, possible in at most one way, or a step in one of finitely many argument positions, each finitely branching by the inductive hypothesis. For the second claim, consider the tree whose root is 𝐴 and whose children of any node are its one-step reducts; it is finitely branching, and every branch is finite because 𝐴∈SN. If the branch lengths were unbounded, we could choose at the root a child whose subtree has unbounded branch lengths (some child must, as there are finitely many), and repeat, producing an infinite branch—a contradiction. So branch lengths are bounded, and 𝜈(𝐴) is their maximum; a reduct’s subtree is a subtree of 𝐴’s, giving the strict decrease. ◻
The number 𝜈(𝐴) is a classical proof device extracted from finite branching and the strong-normalization hypothesis; it is not a computable function on raw constructors supplied to the checker. A direct formalization of this argument recurses on accessibility for ⟶𝛽, so its normalizer receives strong-normalization evidence. An executable development may instead prove termination for a separately defined normalizer, for example normalization by evaluation. Later uses of 𝜈 in this section are proof inductions, not pseudocode.
At arrow kind, the required invariant is explicit: a reducible constructor of kind 𝜅1→𝜅2 maps every reducible argument of kind 𝜅1 to a reducible result of kind 𝜅2.
The bare invariant 𝐴∈SN fails at K-App: from 𝐴,𝐵∈SN one cannot conclude 𝐴𝐵∈SN, because beta substitution can expose redexes not present in either reduction tree. The untyped shape (𝜆𝑢.𝑢𝑢)(𝜆𝑢.𝑢𝑢) makes the missing applicative hypothesis visible. The repair is to require an arrow-kind constructor to send every reducible argument to a reducible result.
For each kind 𝜅, the set Red𝜅 of constructors is defined by induction on 𝜅: Red𝖳𝗒:=SN;Red𝜅1→𝜅2:={𝐴∣𝐴𝐵∈Red𝜅2forevery𝐵∈Red𝜅1}. This recursion is well founded on the syntax of the kind: in the arrow clause both 𝜅1 and 𝜅2 are proper subkinds of 𝜅1→𝜅2. This is an untyped proof predicate on unkinded constructors. Membership in Red𝜅 does not itself assert kindability at 𝜅; lemma 7.20 assumes a kinding derivation before proving membership in the corresponding predicate. This distinction is why the same raw variable may serve as a neutral test at several kinds without contradicting kind uniqueness. The distinction is used immediately in the arrow-kind proof of (CR1), where a fresh raw variable is tested at 𝜅1 without consulting any declared kind.
Proof. The outer simultaneous induction is on 𝜅 and proves (CR1)–(CR3) together. In the arrow-kind (CR3) case a second induction on the natural number 𝜈(𝐵) controls reductions in the argument. No third induction is implicit.
Base kind. (CR1) is the definition. (CR2): a suffix of an infinite reduction from 𝐴′ would extend to one from 𝐴. (CR3): any infinite sequence from 𝐴 has a first step, landing in some reduct, which is in SN by hypothesis; contradiction. (Neutrality is not needed at the base kind.)
Arrow kind 𝜅1→𝜅2. (CR1): let 𝐴∈Red𝜅1→𝜅2 and pick a variable 𝑢; by the inductive (CR3) at 𝜅1, 𝑢∈Red𝜅1, so 𝐴𝑢∈Red𝜅2⊆SN by the inductive (CR1). An infinite reduction from 𝐴 would, under the application congruence, give one from 𝐴𝑢; so 𝐴∈SN. (CR2): for 𝐵∈Red𝜅1 we have 𝐴𝐵∈Red𝜅2 and 𝐴𝐵⟶𝛽𝐴′𝐵, so 𝐴′𝐵∈Red𝜅2 by the inductive (CR2). (CR3): let 𝐴 be neutral with all reducts in Red𝜅1→𝜅2, and let 𝐵∈Red𝜅1; then 𝐵∈SN by the inductive (CR1), and we show 𝐴𝐵∈Red𝜅2 by a side induction on 𝜈(𝐵). The constructor 𝐴𝐵 is neutral, so by the inductive (CR3) at 𝜅2 it suffices that all its one-step reducts are in Red𝜅2. A reduct is either 𝐴′𝐵 with 𝐴⟶𝛽𝐴′—then 𝐴′∈Red𝜅1→𝜅2 by hypothesis, so 𝐴′𝐵∈Red𝜅2—or 𝐴𝐵′ with 𝐵⟶𝛽𝐵′—then 𝐵′∈Red𝜅1 by the inductive (CR2) and 𝜈(𝐵′)<𝜈(𝐵), so the side induction applies—or a root 𝛽-step, impossible since 𝐴 is neutral, hence not an abstraction. ◻
★★☆ Fill the arrow-kind (CR3) argument for one neutral application 𝐴𝐵. Classify every possible one-step reduct, identify the induction hypothesis used in each case, and explain why a root 𝛽-step is impossible.
Proof. (1) Structural induction on 𝐴 over representatives whose binders avoid 𝑢,𝑣 and the free variables of 𝐵,𝐶. For 𝐴=𝑣: both sides are 𝐵[𝐶/𝑢]. For 𝐴=𝑢: the left side is 𝐶, the right side is 𝐶[𝐵[𝐶/𝑢]/𝑣]=𝐶 since 𝑣 is not free in 𝐶. Other variables give themselves on both sides, and every composite form distributes both substitutions to its arguments, where the inductive hypothesis applies.
(2) Induction on the step. For TR-Beta: ((𝜆𝑣::𝜅.𝐴0)𝐵)[𝐶/𝑢]𝑠𝑢𝑏𝑠𝑡𝑖𝑡𝑢𝑡𝑖𝑜𝑛𝑐𝑙𝑎𝑢𝑠𝑒𝑠=(𝜆𝑣::𝜅.𝐴0[𝐶/𝑢])(𝐵[𝐶/𝑢])𝑇𝑅−𝐵𝑒𝑡𝑎⟶𝛽𝐴0[𝐶/𝑢][𝐵[𝐶/𝑢]/𝑣]𝑐𝑙𝑎𝑖𝑚(1)=(𝐴0[𝐵/𝑣])[𝐶/𝑢]. Congruence steps substitute in an argument position and use the inductive hypothesis under the same congruence rule.
(3) Structural induction on 𝐴. At 𝐴=𝑢 use the single step 𝐶⟶𝛽𝐶′; another variable takes no steps. Application, arrow, and product concatenate the induction-hypothesis sequences in their argument positions through the corresponding congruence rules. At ⋄𝑣::𝜅.𝐴0, for ⋄∈{𝜆,∀,∃}, first freshen 𝑣 away from 𝑢,𝐶,𝐶′, apply the induction hypothesis to 𝐴0, and lift its sequence under the binder congruence.
(4) Structural induction on 𝐴, choosing every binder fresh for 𝜃,𝐵,𝑢. At 𝐴=𝑢, both sides are 𝐵. At another variable 𝑣, freshness ensures that substituting 𝑢 into 𝜃(𝑣) leaves it unchanged. For an arrow 𝐴1→𝐴2, apply the two induction hypotheses and rebuild the arrow. For ∀𝑣::𝜅.𝐴0, choose 𝑣 fresh for 𝜃,𝐵,𝑢, apply the body hypothesis, and reattach the binder. Product and existential formers are the corresponding binary and binder cases. ◻
Proof. Fix 𝐵∈Red𝜅1; we must show (𝜆𝑢::𝜅1.𝐴)𝐵∈Red𝜅2. Variables are reducible by lemma 7.16; taking the variable 𝑢 itself for 𝐵 in the hypothesis gives 𝐴=𝐴[𝑢/𝑢]∈Red𝜅2, so 𝐴∈SN by (CR1), and 𝐵∈SN likewise. We argue by complete induction on 𝜈(𝐴)+𝜈(𝐵), generalized over both 𝐴 and 𝐵 and over the hypothesis that 𝐴[𝐵0/𝑢]∈Red𝜅2 for every 𝐵0∈Red𝜅1. Thus the induction hypothesis remains available after replacing 𝐴 by a reduct 𝐴′ or 𝐵 by a reduct 𝐵′. The application is neutral, so by (CR3) it suffices that each one-step reduct lies in Red𝜅2. The reducts are:
𝐴[𝐵/𝑢], in Red𝜅2 by hypothesis;
(𝜆𝑢::𝜅1.𝐴′)𝐵 with 𝐴⟶𝛽𝐴′: for every 𝐵0∈Red𝜅1, 𝐴[𝐵0/𝑢]⟶𝛽𝐴′[𝐵0/𝑢] by lemma 7.17(2), so 𝐴′[𝐵0/𝑢]∈Red𝜅2 by (CR2); since 𝜈(𝐴′)<𝜈(𝐴), the inductive hypothesis applies;
(𝜆𝑢::𝜅1.𝐴)𝐵′ with 𝐵⟶𝛽𝐵′: then 𝐵′∈Red𝜅1 by (CR2) and 𝜈(𝐵′)<𝜈(𝐵), so the inductive hypothesis applies.
By (CR3), (𝜆𝑢::𝜅1.𝐴)𝐵∈Red𝜅2, and as 𝐵 was arbitrary, 𝜆𝑢::𝜅1.𝐴∈Red𝜅1→𝜅2. ◻
Proof of Lemma 7.19 — Formers preserve normalization
Proof. No reduction rule has an arrow at the root of its redex, so every reduct of 𝐴1→𝐴2 is 𝐴′1→𝐴2 or 𝐴1→𝐴′2 with the indicated component stepped. An infinite sequence from 𝐴→𝐵 therefore steps one of the two components infinitely often, and selecting those steps yields an infinite reduction of 𝐴 or of 𝐵. The product case is identical with the other binary former. A quantifier has one unary position: every reduct of ∀𝑢::𝜅.𝐴 is ∀𝑢::𝜅.𝐴′ with 𝐴⟶𝛽𝐴′. ◻
Proof of Lemma 7.20 — Fundamental lemma for kinding
Proof. Rule induction on the kinding derivation.
Case K-Var:𝐴=𝑢𝑖 and 𝐴[𝜃]=𝜃(𝑢𝑖)∈Red𝜅𝑖 by assumption.
Case K-Nat:ℕ has no reducts, so ℕ∈SN=Red𝖳𝗒.
Cases K-Arr, K-Prod: the inductive hypotheses put both substituted components in Red𝖳𝗒=SN, and lemma 7.19 concludes, since (𝐴1→𝐴2)[𝜃]=𝐴1[𝜃]→𝐴2[𝜃].
Cases K-All, K-Some: choose the bound variable 𝑢 fresh for 𝜃, so (∀𝑢::𝜅0.𝐴0)[𝜃]=∀𝑢::𝜅0.(𝐴0[𝜃,𝑢↦𝑢]). The extended substitution sends 𝑢 to a variable, which is reducible by lemma 7.16, so the inductive hypothesis gives 𝐴0[𝜃,𝑢↦𝑢]∈Red𝖳𝗒=SN, and lemma 7.19 concludes.
Case K-Abs:𝐴=𝜆𝑢::𝜅′1.𝐴0 with Δ,𝑢::𝜅′1⊢𝐴0::𝜅′2, and with 𝑢 fresh for 𝜃, 𝐴[𝜃]=𝜆𝑢::𝜅′1.𝐴0[𝜃]. For any 𝐵∈Red𝜅′1, freshness gives (𝐴0[𝜃])[𝐵/𝑢]=𝐴0[𝜃,𝑢↦𝐵] by lemma 7.17(4), which is in Red𝜅′2 by the inductive hypothesis at the extended substitution. Lemma 7.18 concludes 𝐴[𝜃]∈Red𝜅′1→𝜅′2.
Case K-App: the inductive hypotheses give 𝐴1[𝜃]∈Red𝜅1→𝜅 and 𝐴2[𝜃]∈Red𝜅1, and the definition of Red𝜅1→𝜅 applies to the application. ◻
Proof of Theorem 7.21 — Type-level strong normalization
Proof. Apply lemma 7.20 with the identity substitution, which is reducible because variables are (lemma 7.16); then 𝐴=𝐴[id]∈Red𝜅⊆SN by (CR1). A normal form is reached by reducing anywhere until no step applies, which must happen within 𝜈(𝐴) steps (lemma 7.14). ◻
Confluence and the decision of conversion
Normalization alone does not yet let a checker compare normal forms: perhaps a constructor reaches two different normal forms along different reduction orders, and perhaps ≡ relates constructors whose normal forms differ. The obstruction sits in rule Q-Trans: knowing that 𝐴 and 𝐵 reduce to a common constructor, and that 𝐵 and 𝐶 do, one must merge two reduction diagrams that share only 𝐵. Confluence is exactly the merging principle, and with strong normalization already proved, it follows from a local check.
Proof. Induction on 𝐴, with cases on how the two steps are derived.
If both steps are TR-Beta at the root, then 𝐴1=𝐴2.
If both are congruence steps in the same argument position, the inductive hypothesis for that argument yields a common reduct, and the congruence rules transport it. If they are congruence steps in different argument positions, the two steps act on disjoint subterms and commute: performing the other step on each side reaches the same constructor in one step each.
The remaining case is a root TR-Beta on 𝐴=(𝜆𝑢::𝜅.𝐴0)𝐵0, with the other step inside. If the other step is in the body, 𝐴2=(𝜆𝑢::𝜅.𝐴′0)𝐵0 with 𝐴0⟶𝛽𝐴′0; then 𝐴1=𝐴0[𝐵0/𝑢]⟶𝛽𝐴′0[𝐵0/𝑢] by lemma 7.17(2), and 𝐴2⟶𝛽𝐴′0[𝐵0/𝑢] by TR-Beta. If the other step is in the argument, 𝐴2=(𝜆𝑢::𝜅.𝐴0)𝐵′0 with 𝐵0⟶𝛽𝐵′0; then 𝐴1=𝐴0[𝐵0/𝑢]⟶∗𝛽𝐴0[𝐵′0/𝑢] by lemma 7.17(3), and 𝐴2⟶𝛽𝐴0[𝐵′0/𝑢]. ◻
★★☆ Close the local-confluence peak in which (𝜆𝑢::𝜅.𝐴0)𝐵0 contracts at the root on one side and reduces 𝐵0⟶𝛽𝐵′0 on the other. Give the common reduct and name the substitution–reduction clause that reaches it from the root reduct.
Proof of Theorem 7.23 — Confluence on normalizing constructors
Proof. This is the standard well-founded proof of Newman’s lemma: local confluence plus termination implies confluence. Complete induction on 𝜈(𝐴) (lemma 7.14). If either given reduction is empty, its endpoint is 𝐴 and the other endpoint closes the diagram. Otherwise 𝐴⟶𝛽𝐴′1⟶∗𝛽𝐴1 and 𝐴⟶𝛽𝐴′2⟶∗𝛽𝐴2. By lemma 7.22 there is 𝐶 with 𝐴′1⟶∗𝛽𝐶 and 𝐴′2⟶∗𝛽𝐶. Since 𝜈(𝐴′1)<𝜈(𝐴), the inductive hypothesis for 𝐴′1 applied to the reductions to 𝐴1 and to 𝐶 gives 𝐷 with 𝐴1⟶∗𝛽𝐷 and 𝐶⟶∗𝛽𝐷. Since 𝜈(𝐴′2)<𝜈(𝐴), the inductive hypothesis for 𝐴′2 applies to the two displayed reductions 𝐴′2⟶∗𝛽𝐴2,𝐴′2⟶∗𝛽𝐶⟶∗𝛽𝐷, and gives 𝐵 with 𝐴2⟶∗𝛽𝐵 and 𝐷⟶∗𝛽𝐵; then also 𝐴1⟶∗𝛽𝐷⟶∗𝛽𝐵. ◻
Proof. Existence is theorem 7.21. If 𝐴 reduces to normal forms 𝑁1 and 𝑁2, confluence joins them; normality forces both joining reductions to be empty, so 𝑁1=𝑁2. ◻
Proof of Theorem 7.25 — Conversion is common reduction
Proof.(2)⇒(3): the common reduct 𝐶 reduces to its normal form, which both 𝐴 and 𝐵 then reach; uniqueness of normal forms (corollary 7.24) gives nf(𝐴)=nf(𝐶)=nf(𝐵). (3)⇒(2): take 𝐶=nf(𝐴)=nf(𝐵). (2)⇒(1): by lemma 7.12, Δ⊢𝐴≡𝐶 and Δ⊢𝐵≡𝐶 at kind 𝜅; Q-Sym and Q-Trans conclude.
(1)⇒(2) is a rule induction on the equality derivation. Q-Refl: take 𝐶=𝐴. Q-Beta: the left side steps to the right side. Q-Sym: symmetric hypothesis. Congruence rules: the inductive hypotheses join each argument, and the congruence rules applied step by step join the composites; for instance if 𝐴𝑖⟶∗𝛽𝐶𝑖 and 𝐵𝑖⟶∗𝛽𝐶𝑖, then (𝐴1→𝐴2)⟶∗𝛽(𝐶1→𝐶2)and(𝐵1→𝐵2)⟶∗𝛽(𝐶1→𝐶2). The decisive case is Q-Trans: the hypotheses give 𝐶1 joining 𝐴,𝐵 and 𝐶2 joining 𝐵,𝐶. Both 𝐶1 and 𝐶2 are reducts of 𝐵, which is kinded by lemma 7.11 and hence in SN by theorem 7.21; confluence (theorem 7.23) joins 𝐶1 and 𝐶2 at some 𝐶3, which then joins 𝐴 and 𝐶. ◻
Enumerate redex occurrences by a preorder traversal of the constructor tree. Visit the root first. Then visit application, arrow, and product children from left to right; visit the body of each 𝜆, ∀, and ∃ binder; variables and ℕ have no children. An occurrence is a redex exactly when it is an application whose left child is a constructor abstraction. If the list is nonempty, contract its first occurrence, renaming its binder before capture-avoiding substitution when necessary, and repeat. Here outermost means the shortest earliest preorder path, and traversal descends under every binder.
★☆☆ Run definition 11.30 on ((𝜆𝑐::𝖳𝗒→𝖳𝗒.𝜆𝑎::𝖳𝗒.𝑐𝑎)𝖯)ℕandℕ×ℕ. Record the preorder path chosen at each step and decide their constructor equality using corollary 7.26.
Conversion is decidable: first infer the unique kinds of 𝐴 and 𝐵; then normalize by definition 11.30; finally compare the two normal forms up to renaming of bound variables.
Head constructors are injective: if Δ⊢𝐴1→𝐴2≡𝐵1→𝐵2::𝖳𝗒, then Δ⊢𝐴𝑖≡𝐵𝑖::𝖳𝗒 for 𝑖=1,2; likewise for ×. If Δ⊢∀𝑢::𝜅.𝐴0≡∀𝑢::𝜅′.𝐵0::𝖳𝗒, then 𝜅=𝜅′ and, after opening both binders with one fresh 𝑢, Δ,𝑢::𝜅⊢𝐴0≡𝐵0::𝖳𝗒; likewise for ∃.
Distinct heads never convert: no two of ℕ, 𝐴1→𝐴2, 𝐴1×𝐴2, ∀𝑢::𝜅.𝐴0, ∃𝑢::𝜅.𝐴0, and a variable 𝑢 are related by a formed judgment Δ⊢𝐴≡𝐵::𝖳𝗒.
Proof of Corollary 7.26 — The conversion facts required by term checking
Proof. For claim 1, kind inference follows the unique rule determined by the outer constructor: it recursively infers premise kinds, rejects a mismatched application or former, and returns the forced conclusion kind. To decide conversion, repeatedly reduce the first constructor redex in the preorder of definition 11.30 until none remains. Strong normalization proves termination, and confluence proves the normal form strategy independent. The redex scan is a finite syntax traversal. Each contraction strictly lowers 𝜈, so the loop terminates; its endpoint is normal, and alpha-comparison is decidable by simultaneously opening corresponding binders with one fresh variable. Correctness is theorem 7.25(3). For claims 2 and 3, observe as in lemma 7.19 that reduction preserves the outermost former of an arrow, product, quantifier, variable, or ℕ, reducing only the arguments; hence nf(𝐴1→𝐴2)=nf(𝐴1)→nf(𝐴2), and correspondingly for the other formers, while nf(𝑢)=𝑢 and nf(ℕ)=ℕ. Equality of the normal forms (theorem 7.25) then forces equality of the components’ normal forms in claim 2—in the quantifier case after opening both bodies with one common fresh variable, as in corollary 2.11—and is impossible in claim 3 because the outermost formers differ. ◻
Claim 1 gives the equality test used by T-Conv; claims 2 and 3 give the head injectivity and disjointness used by lemma 7.29, theorem 11.42.
The normalize-both procedure is a decision proof, not a production cost model. Materializing two normal forms may duplicate subterms whose heads already decide the comparison. A practical checker should weak-head normalize only until each head is visible, compare matching heads, and recurse on their components while caching repeated reductions. This changes the amount of work performed on many inputs without changing the decision procedure proved correct above.
Proof of Lemma 7.27 — Constructor equality respects substitution
Proof. By theorem 7.25, choose 𝐷 with 𝐴⟶∗𝛽𝐷 and 𝐵⟶∗𝛽𝐷. Repeated use of lemma 7.17(2) gives reductions of 𝐴[𝐶/𝑢] and 𝐵[𝐶/𝑢] to 𝐷[𝐶/𝑢]. Kinding substitution (lemma 7.8) forms all three constructors in the target context, so the common-reduct direction of theorem 7.25 concludes. ◻
Proof of Lemma 11.33 — Constructor equality weakening
Proof. By theorem 7.25, choose a common reduct 𝐶 of 𝐴 and 𝐵. Inserting an unused declaration changes neither reduction; kinding weakening from lemma 7.8(1) forms the three constructors in the larger context. The common-reduct direction of theorem 7.25 concludes. ◻
Proof of Lemma 11.34 — Structural properties of F_ω term typing
Proof. Each claim is an induction on the displayed typing derivation, after freshening term and constructor binders away from the inserted declaration or substituend. Variable leaves use context membership; every composite term rule applies the induction hypotheses to its premises and then reapplies the same rule. Term substitution replaces the selected T-Var leaf by the given derivation and leaves every other leaf intact.
For the constructor-substitution interface, the T-TLam case moves both constructor and term contexts. Write its binder as 𝑣 and freshen it away from 𝑢,𝐶,Δ0,Δ1,Γ. Its premise is Δ0,𝑢::𝜅,Δ1,𝑣::𝜅𝑣;Γ⊢𝑒:𝐴. The induction hypothesis, taking Δ1,𝑣::𝜅𝑣 as the suffix, gives Δ0,Δ1,𝑣::𝜅𝑣;Γ[𝐶/𝑢]⊢𝑒[𝐶/𝑢]:𝐴[𝐶/𝑢]. The original freshness premise and the choice of 𝑣 imply 𝑣∉fv(Γ[𝐶/𝑢]), so T-TLam reconstructs Δ0,Δ1;Γ[𝐶/𝑢]⊢Λ𝑣::𝜅𝑣.𝑒[𝐶/𝑢]:∀𝑣::𝜅𝑣.𝐴[𝐶/𝑢]. These term and type expressions are exactly the constructor substitutions of the original conclusion, by the binder clauses.
The only cases absent from the System F structural lemmas lemma 5.5, lemma 5.6, lemma 5.7 are products, naturals, and T-Conv. Products and naturals are componentwise or nullary. For constructor-context weakening at T-Conv, weaken its equality premise with lemma 11.33; for constructor substitution, substitute in that premise with lemma 7.27. The corresponding kinding premises use lemma 7.8. Term substitution does not alter the equality premise. These observations also preserve every formation presupposition in Ctx-Ext, so all four reconstructed derivations are well formed. ◻
Final T-Conv rules can hide the syntax-directed last rule. The next lemma removes that conversion suffix before lemma 7.29 uses the exposed rule.
Proof. Induct on the derivation. If the final rule is not T-Conv, take 𝐴0=𝐴 and Q-Refl. If it is T-Conv, apply the induction hypothesis to its typing premise and compose the resulting equality with the conversion premise by Q-Trans. ◻
The value grammar and constructor conversion meet in the canonical-forms lemma. The component equalities in its statement are needed because a final T-Conv may change the spelling of a value’s type without changing the value.
Proof of Lemma 11.36 — Canonical forms for pure F_ω
Proof. Apply lemma 7.28. The exposed derivation ends in the unique introduction rule permitted by the syntax of 𝑣: T-Lam, T-TLam, T-Pair, T-Zero, or T-Suc. Its result type has, respectively, head →, ∀, ×, or ℕ. Distinct-head disjointness in corollary 7.26(3) excludes every value form whose result head differs from the requested head.
For an arrow, the exposed T-Lam derivation supplies Δ;𝑥:𝐶⊢𝑒:𝐷, and arrow injectivity in corollary 7.26(2) gives the two component equalities. The universal case uses quantifier-head injectivity, which also equates the binder kinds and permits one common fresh binder name. The product case uses product injectivity on the two premise types. At ℕ, the two remaining value rules are T-Zero and T-Suc; the latter’s premise has type ℕ before the stripped conversion. These cases exhaust the value grammar. ◻
Proof. Induct on the derivation of 𝑒⟶𝑒′. At each case, first use lemma 7.28 on the typing of the whole source. Its exposed last rule is forced by the source term’s outer syntax. Rebuild that rule after the step and restore the stripped result conversion with T-Conv.
For E-Beta, the exposed outer rule is T-App. Suppose its operator premise has type 𝐴0→𝐵0 and its argument premise types 𝑣 at 𝐴0. Strip conversions from the typing of the displayed abstraction. Its T-Lam premise has the form Δ;Γ,𝑥:𝐶⊢𝑒0:𝐷,Δ⊢𝐶→𝐷≡𝐴0→𝐵0::𝖳𝗒. Arrow injectivity gives 𝐶≡𝐴0 and 𝐷≡𝐵0. Symmetry and T-Conv type 𝑣 at 𝐶; term substitution from lemma 11.34(3) types 𝑒0[𝑣/𝑥] at 𝐷; a final conversion gives 𝐵0.
For E-TBeta, the exposed outer rule is T-TApp. Stripping the typing of the type abstraction and applying universal-head injectivity gives, after one alpha-renaming, Δ,𝑢::𝜅;Γ⊢𝑒0:𝐵,Δ,𝑢::𝜅⊢𝐵≡𝐴0::𝖳𝗒. Constructor substitution from lemma 11.34(4) gives Δ;Γ[𝐶/𝑢]⊢𝑒0[𝐶/𝑢]:𝐵[𝐶/𝑢]. The freshness premise of T-TLam gives 𝑢∉fv(Γ), so Γ[𝐶/𝑢]=Γ. Equality substitution from lemma 7.27 converts the result type to 𝐴0[𝐶/𝑢], as required by T-TApp.
For E-PrjPair, strip the pair’s typing. Product-head injectivity converts the selected component premise to the component type demanded by the exposed T-Prj rule.
Each congruence rule has one stepping premise. Apply the induction hypothesis to the matching typing premise and rebuild T-App, T-TApp, T-Pair, T-Prj, or T-Suc. In the right-hand application and pair cases, the value side condition changes no typing premise. The three root cases and these seven congruence cases are the complete relation of definition 11.7. ◻
Proof. Induct on the typing derivation. The variable case is impossible because the term context is empty. A final T-Conv uses the induction hypothesis for its typing premise. Term abstractions, type abstractions, and 𝟢 are values.
For T-App, apply the operator induction hypothesis. An operator step gives E-App1. If the operator is a value, apply the argument induction hypothesis. An argument step gives E-App2. If both are values, lemma 11.36(1) makes the operator a term abstraction, so E-Beta applies. The T-TApp case first steps its operator by E-TApp; otherwise lemma 11.36(2) makes that value a type abstraction, so E-TBeta applies.
For T-Pair, step the first nonvalue component by E-Pair1 or E-Pair2; if both components are values, the pair is a value. For T-Prj, step the operand by E-Prj; if it is a value, lemma 11.36(3) makes it a pair and E-PrjPair applies. Finally, T-Suc either uses E-Suc on the premise step or forms the value 𝗌𝗎𝖼(𝑣). These cases cover every term typing rule. ◻
If Δ;⋅⊢𝑒:𝐴 and 𝑒⟶∗𝑒′, then 𝑒′ is a value or takes another step. Thus a term closed in term variables cannot evaluate to a stuck nonvalue; the constructor context Δ may remain open.
Proof. Induct on the step sequence and apply theorem 11.37 at each step. The endpoint remains typed at 𝐴, so theorem 11.38 gives the stated alternative. ◻
Proof of Lemma 7.29 — Unicity of typing up to conversion
Proof. Strip both final conversion chains with lemma 7.28. We compare the two non-conversion conclusions by induction on the common term subject, then compose with the two stripped equalities.
For 𝑥, both rules read the same unique declaration from Γ. For 𝟢 and 𝗌𝗎𝖼(𝑒), both conclusions are ℕ; the latter also invokes the induction hypothesis on the premise. For 𝜆𝑥:𝐶.𝑒, the annotation 𝐶 is literally the same in both derivations; the induction hypothesis in Γ,𝑥:𝐶 equates the two body types, and Q-Arr equates the result types. For 𝑒1𝑒2, the two operator premises have types 𝐶→𝐷 and 𝐶′→𝐷′. Their induction hypothesis and arrow injectivity give 𝐷≡𝐷′. For a pair, apply the two component induction hypotheses and Q-Prod; for 𝗉𝗋𝑖𝑒, apply the premise induction hypothesis and product injectivity to the selected component.
For Λ𝑢::𝜅.𝑒, the kind annotation is literally shared; apply the induction hypothesis under 𝑢::𝜅 and then Q-All. Finally consider 𝑒[𝐶]. Its two operator premises have types ∀𝑢::𝜅.𝐷 and ∀𝑣::𝜅′.𝐷′. The type argument 𝐶 has a unique kind, so 𝜅=𝜅′; alpha-open both quantifiers with one fresh 𝑢. The operator induction hypothesis and universal injectivity give 𝐷≡𝐷′ in the extended context, and lemma 7.27 gives 𝐷[𝐶/𝑢]≡𝐷′[𝐶/𝑢], the two syntax-directed result types. ◻
This result and lemma 7.30 concern the package-free grammar of definition 7.6. They assert neither unicity nor a failure of unicity for an extension with packages.
For formed Δ;Γ, define the partial function 𝗂𝗇𝖿𝖾𝗋Δ;Γ(𝑒) by structural recursion on 𝑒.
A variable returns its unique declared type. Zero returns ℕ.
𝜆(𝑥:𝐴).𝑒 first checks Δ⊢𝐴::𝖳𝗒, infers 𝐵 for the body under Γ,𝑥:𝐴, and returns 𝐴→𝐵.
For 𝑒1𝑒2, infer 𝐶 and 𝐴. Normalize 𝐶; it must have form 𝐷→𝐵, and conversion must accept 𝐴 against 𝐷. Return 𝐵.
A type abstraction checks the printed freshness premise, infers its body type 𝐴 under Δ,𝑢::𝜅;Γ, and returns ∀𝑢::𝜅.𝐴.
For 𝑒[𝐶], infer and normalize the operator type. It must have form ∀𝑢::𝜅.𝐴; infer the unique kind of 𝐶, require 𝜅, and return 𝐴[𝐶/𝑢].
A pair infers both components and returns their product. A projection infers and normalizes its argument type, requires a product head, and returns the selected component.
For 𝗌𝗎𝖼(𝑒), infer the argument type, require conversion with ℕ, and return ℕ.
Every requirement invokes the kind and conversion decisions proved in corollary 7.26. A failed requirement rejects the term. The cases cover variables, abstractions, applications, type abstractions, type applications, pairs, projections, and successors: exactly the term grammar. Thus the definition specifies every possible conversion test.
Proof of Theorem 11.42 — Correctness of syntax-directed term inference
Proof. For soundness, induct over the recursive call. At application, type application, and projection, the computed normal head is convertible to the inferred premise type by theorem 7.25; insert T-Conv at that premise and apply the matching syntax rule. The argument checks insert one further T-Conv. Every other case applies its displayed typing rule directly.
For completeness, induct on the term after stripping the final conversion with lemma 7.28. The exposed syntax rule determines the recursive premises. The induction hypothesis for each premise Δ′;Γ′⊢𝑒′:𝐴′ is the conjunction 𝗂𝗇𝖿𝖾𝗋Δ′;Γ′(𝑒′)=𝐵′forsome𝐵′,andΔ′⊢𝐵′≡𝐴′::𝖳𝗒.
For application, the stripped derivation has premises 𝑒1:𝐶→𝐷 and 𝑒2:𝐶. The first induction hypothesis returns some 𝐸≡𝐶→𝐷. By the conversion characterization, the normal form of 𝐸 has shape 𝐶′→𝐷′; head injectivity gives 𝐶′≡𝐶 and 𝐷′≡𝐷. The second induction hypothesis returns 𝐸2≡𝐶, so transitivity gives 𝐸2≡𝐶′ and the argument guard succeeds. Inference returns 𝐷′, which is convertible to the stripped conclusion 𝐷 and hence, after composing with the stripped final conversion, to the original requested type.
For type application 𝑒[𝐶], the exposed operator premise has type ∀𝑢::𝜅.𝐴. Its induction hypothesis returns an 𝐸 convertible to that universal, so normalization exposes ∀𝑢::𝜅.𝐴′ with 𝐴′≡𝐴 after opening the binders; kind uniqueness validates the printed argument 𝐶, and equality substitution gives 𝐴′[𝐶/𝑢]≡𝐴[𝐶/𝑢] for the returned type. For 𝗉𝗋𝑖𝑒, the exposed premise types 𝑒 at 𝐶1×𝐶2. Its induction hypothesis returns an 𝐸 whose normal form is 𝐶′1×𝐶′2; product injectivity gives 𝐶′𝑖≡𝐶𝑖, so the selected returned component is convertible to the declarative result.
At a lambda, the printed domain is formed by the typing premise, the body induction hypothesis succeeds, and Q-Arr relates the returned arrow to the declarative one. At a type abstraction, the printed freshness premise is the one in the exposed T-TLam rule; the body induction hypothesis and Q-All relate the returned universal type. A pair uses its two induction hypotheses and Q-Prod. Zero returns ℕ. For a successor, the induction hypothesis returns a type convertible to ℕ, so its guard succeeds and it returns ℕ. These cases exhaust the term grammar. The final statement is the two directions followed by one conversion comparison. ◻
Proof. Invert the kinding derivation while following the left spine of a putative normal application. Its head cannot be a constructor abstraction, for then the application would be a TR-Beta redex. Nor can the head be ℕ, an arrow, a product, or either quantifier: each has kind 𝖳𝗒, whereas every applied head must have an arrow kind. By kind uniqueness, the only remaining possible head is a variable. Closedness excludes that case. Thus a closed normal constructor of kind 𝖳𝗒 is not an application or abstraction. Inverting its outer kinding rule leaves exactly the five listed forms, and normality of the whole constructor implies normality of every component. ◻
The kind and constructor discipline is the Church-style 𝐹𝜔 presentation of [Har16], extended here by the primitive data used in the examples and by the existential former in the displayed constructor grammar. The normalization, confluence, conversion decision, and pure call-by-value safety proofs are reproduced locally rather than imported from that presentation. Package values and package reduction are not part of this chapter’s safety theorem; the package chapter adds them as a conservative term-language extension. Cardelli and Wegner’s parametric type operators supply the historical higher-kinded boundary [CW85]. Equirecursive 𝐹𝜔𝜇 has a different equality and safety signature, with decidable type checking stated only for its first-order-recursive fragment [CGO16]; none of that recursive extension is inherited here. Finite-rank reconstruction is likewise a separate problem. Kfoury and Tiuryn’s Theorem 20 decides whether a pure term, under a supplied environment of closed rank-one types, has an extending environment and a rank-two result type in their second-order system [KT92]. It does not supply inference for the Church-style calculus developed in this chapter.
Constructor reduction is normalizing and confluent. Hence constructor conversion is decidable, and T-Conv has an effective equality test. The separate term relation preserves typing, and every closed well-typed pure term is a value or takes a call-by-value step.
★☆☆ Delete the annotation, so that abstraction is written 𝜆𝑢.𝐴 with the rule premise Δ,𝑢::𝜅1⊢𝐴::𝜅2 for an arbitrary 𝜅1. Give two kinding derivations assigning the single constructor 𝜆𝑢.𝑢 the distinct kinds 𝖳𝗒→𝖳𝗒 and (𝖳𝗒→𝖳𝗒)→(𝖳𝗒→𝖳𝗒), showing that lemma 7.9 fails in Curry style.
★★★Practical project.fomega-checker Implement kind inference, constructor normalization, and explicit term checking for definition 7.2, definition 7.6, definition 11.41. Preserve the invariant that every normalized constructor retains its inferred kind, and handle T-Conv by comparing alpha-equivalent normal forms. The acceptance test must infer the kind of 𝖬𝖺𝗉, normalize 𝖢𝗈𝗆𝗉𝖯𝖯ℕ, accept 𝖽𝗆𝖺𝗉 at its application-headed type, reject the failed 𝑐𝑎 formation attempt without a higher kind for 𝑐, and reject two distinct normal head constructors as nonconvertible.
★★☆ Suppose the base reducibility set Red𝖳𝗒 were changed from strongly normalizing constructors to constructors having at least one terminating reduction sequence. Show first that (CR1) already fails, and then identify the subsidiary (CR3) induction that consequently loses its reduction-height measure. Use the unkinded constructor shape (𝜆𝑥::𝖳𝗒.ℕ)((𝜆𝑢::𝖳𝗒.𝑢𝑢)(𝜆𝑢::𝖳𝗒.𝑢𝑢)) to explain why one terminating path does not bound all congruence-closed paths. State why reducibility is defined on unkinded constructors before kinding selects the well-formed ones.