Prerequisites. Direct starred prerequisites: Chapter 37. No later core chapter depends on this route.
Dependent intersection can add a view 𝐵(𝑡) to a subject 𝑡 whose left-hand type is already known. It cannot define one type 𝑇 whose membership condition says, for every 𝑡:𝑇, that a predicate holds of 𝑡 itself. The Church encoding of naturals exposes the missing dependency. Its iterator provides 𝑛:∀𝐶:U0.(𝐶→𝐶)→𝐶→𝐶, but induction needs a motive 𝐶:𝖭𝖺𝗍→U0 and the conclusion 𝐶(𝑛), where the subject 𝑛 occurs in its own assigned type.
System S is Fu and Stump’s Curry-style extension of the Calculus of Constructions. Its terms are untyped lambda terms with globally defined closed constants. Its types add implicit products ∀𝑥:𝐴.𝐵, type-level term abstraction and application, and the subject-dependent self type 𝜄𝑥.𝑇. A global closure may contain a singly recursive type definition 𝑋↦𝑇, but every occurrence of 𝑋 in 𝑇 is positive or lies in an erased position. Term definitions are nonrecursive and closed. The metatheorems below apply to this exact signature, not to an unrestricted recursive type equation.
The type 𝜄𝑥.𝑇 binds the term variable 𝑥 in 𝑇. Formation, generation, instantiation, and their erasure equation are
Γ,𝑥:𝜄𝑥.𝑇⊢𝑇𝗍𝗒𝗉𝖾
Γ⊢𝜄𝑥.𝑇𝗍𝗒𝗉𝖾
S-Self-F
Γ⊢𝑡:𝑇[𝑡/𝑥]Γ⊢𝜄𝑥.𝑇𝗍𝗒𝗉𝖾
Γ⊢𝑡:𝜄𝑥.𝑇
S-Self-Gen
Γ⊢𝑡:𝜄𝑥.𝑇
Γ⊢𝑡:𝑇[𝑡/𝑥]
S-Self-Inst
Γ⊢𝑡:𝜄𝑥.𝑇
erase(𝗌𝖾𝗅𝖿𝖦𝖾𝗇(𝑡))=erase(𝑡)=erase(𝗌𝖾𝗅𝖿𝖨𝗇𝗌𝗍(𝑡))
S-Self-Erase
The terms in the source conclusions are all the same Curry term 𝑡; 𝗌𝖾𝗅𝖿𝖦𝖾𝗇 and 𝗌𝖾𝗅𝖿𝖨𝗇𝗌𝗍 above name typing steps, not runtime constructors. The rules are inverse changes of type annotation, not a judgmental equation 𝜄𝑥.𝑇≡𝑇[𝑡/𝑥] valid for arbitrary 𝑡.
Let 𝑧:𝜄𝑥.𝑇 be neutral. Rule S-Self-Inst changes its type to 𝑇[𝑧/𝑥], but no reduction occurs. This is the stuck case: the self rule reveals a dependent view of 𝑧 without revealing the head constructor of 𝑧.
★☆☆ Starting from 𝑡:𝑇[𝑡/𝑥], apply S-Self-Gen and then S-Self-Inst. Write the type after each step and compute the erasure. Explain why the calculation does not prove 𝜄𝑥.𝑇≡𝑇[𝑢/𝑥] for an unrelated 𝑢.
The tempting recursive equation 𝖡𝖺𝖽:=𝖡𝖺𝖽→𝖭 places 𝖡𝖺𝖽 to the left of an arrow. If it were admitted equi-recursively, the untyped self-application 𝛿:=𝜆𝑥.𝑥𝑥 could receive type 𝖡𝖺𝖽→𝖭 and 𝛿𝛿 would reproduce itself. This would contradict strong normalization.
For the strong-normalization theorem, a closure entry 𝑋↦𝑇 satisfies 𝖯𝗈𝗌(𝑋,𝑇) when every non-erased occurrence of 𝑋 is positive. The polarity calculation is 𝗉𝗈𝗅𝑝(𝐴→𝐵)=𝗉𝗈𝗅¬𝑝(𝐴)∧𝗉𝗈𝗅𝑝(𝐵), and products preserve polarity in their bodies. Occurrences in kinds and in the domain annotation of an implicit product are erased by the target translation and impose no recursive target equation. Mutual recursive type definitions and open recursive right-hand sides are excluded from the frozen closure.
For 𝖡𝖺𝖽↦𝖡𝖺𝖽→𝖭, the occurrence is negative and the closure is rejected. For the Church natural closure below, the recursive occurrences in motive annotations and implicit domains are erased, while the remaining target equation is positive.
Induction from self instantiation
Define a closed recursive type closure 𝜇𝖭 by 𝖭𝖺𝗍↦𝜄𝑥.∀𝐶:𝖭𝖺𝗍→U0.(∀𝑛:𝖭𝖺𝗍.𝐶(𝑛)→𝐶(𝖲(𝑛)))→𝐶(𝟢)→𝐶(𝑥),𝟢↦𝜆𝑠.𝜆𝑧.𝑧,𝖲↦𝜆𝑛.𝜆𝑠.𝜆𝑧.𝑠(𝑛𝑠𝑧). The binders over 𝐶 and 𝑛 are implicit. Their erasure gives the ordinary Church type (𝐶→𝐶)→𝐶→𝐶.
Proof. For zero, fix 𝐶, a step 𝑠, and a base 𝑧:𝐶(𝟢). The term 𝜆𝑠.𝜆𝑧.𝑧 has the instantiated body type ending in 𝐶(𝜆𝑠.𝜆𝑧.𝑧) because this term is definitionally the Church zero. Rule S-Self-Gen gives the self type 𝖭𝖺𝗍.
For successor, assume 𝑛:𝖭𝖺𝗍. By S-Self-Inst, 𝑛:∀𝐶:𝖭𝖺𝗍→U0.(∀𝑘:𝖭𝖺𝗍.𝐶(𝑘)→𝐶(𝖲(𝑘)))→𝐶(𝟢)→𝐶(𝑛). Thus 𝑛𝑠𝑧:𝐶(𝑛) and 𝑠𝑛(𝑛𝑠𝑧):𝐶(𝖲(𝑛)). Abstraction gives the body required for 𝖲(𝑛), and S-Self-Gen gives 𝖲(𝑛):𝖭𝖺𝗍. ◻
Proof of Theorem 94.5 — Derived natural-number induction
Proof. Fix 𝐶, 𝑠, 𝑧, and 𝑛:𝖭𝖺𝗍. Rule S-Self-Inst gives exactly the implicit product displayed in the first paragraph of lemma 94.4. Three eliminations yield 𝑛𝑠𝑧:𝐶(𝑛). Abstraction over 𝑛, 𝑧, and 𝑠, followed by the implicit introduction for 𝐶, gives the stated type. The type of the final result mentions the function argument 𝑛 because self instantiation substituted that same subject for 𝑥. ◻
The constructor computations occur after erasure: 𝗂𝗇𝖽𝑠𝑧𝟢𝛽⟶𝑧,𝗂𝗇𝖽𝑠𝑧(𝖲𝑛)𝛽⟶∗𝑠𝑛(𝑛𝑠𝑧). For a neutral 𝑛, 𝑛𝑠𝑧 remains stuck even though its type is 𝐶(𝑛).
★★☆ Fix 𝐴:U0. Work in context 𝑛:𝖭𝖺𝗍 with the indexed closure 𝖵𝖾𝖼(𝐴,𝑛)↦𝜄𝑣.∀𝐶:(∏𝑘:𝖭𝖺𝗍𝖵𝖾𝖼(𝐴,𝑘)→U0).𝐶(𝟢,𝗏𝗇𝗂𝗅)→(∀𝑘:𝖭𝖺𝗍.∀𝑎:𝐴.∀𝑥𝑠:𝖵𝖾𝖼(𝐴,𝑘).𝐶(𝑘,𝑥𝑠)→𝐶(𝖲(𝑘),𝗏𝖼𝗈𝗇𝗌(𝑘,𝑎,𝑥𝑠)))→𝐶(𝑛,𝑣). Give fully typed Church terms for 𝗏𝗇𝗂𝗅 and 𝗏𝖼𝗈𝗇𝗌 under this closure. Then derive the exact result type ∏𝑛:𝖭𝖺𝗍∏𝑣:𝖵𝖾𝖼(𝐴,𝑛)𝐶(𝑛,𝑣) of the induction term, including the nil and cons premises displayed above and the final self-instantiation step.
Proof. Induct on the typing derivation. The implicit-product cases choose their bound variable outside FV(𝑢)∪FV(Γ)∪FV(Δ) and apply the induction hypothesis under that binder. In the S-Self-Gen case, the induction hypothesis gives 𝑡[𝑢/𝑥]:𝑇[𝑡/𝑦][𝑢/𝑥]. Choose the self binder 𝑦 outside FV(𝑢). Capture avoidance gives 𝑇[𝑡/𝑦][𝑢/𝑥]=𝑇[𝑢/𝑥][𝑡[𝑢/𝑥]/𝑦], which is the premise of S-Self-Gen for 𝜄𝑦.𝑇[𝑢/𝑥]. The S-Self-Inst case uses the same equation in the opposite direction. Closure entries are closed, so substitution does not alter their right-hand sides. ◻
Proof of Theorem 94.7 — Confluence and preservation
Proof. This is an exact import for the signature of convention 94.1. Fu and Stump prove confluence of beta reduction as Lemma 1 on page 12. Their self-conversion relation and 𝜄-elimination theorem are Definition 15 and Theorem 6 on pages 11–12. Definitions 17–20 and Lemmas 3–7 on page 13 define the term- and type-morphing substitutions and prove product compatibility as Theorem 7. Theorem 8 on that page then has the signature Γ⊢𝑡:𝑇,Γ⊢𝑡⟶𝛽𝑡′,Γ𝗐𝖿⟹Γ⊢𝑡′:𝑇. These imported results give the two clauses of the theorem; no theorem is transferred to mutual, open, or nonpositive closure entries [FS14]. ◻
Proof of Theorem 94.8 — Strong normalization of System S
Proof. Import the exact erasure and reducibility development of Fu and Stump. On page 10, Definitions 8–11 give the target 𝐹𝜔 signature with positive definitions and the kind, type, and context erasures; Theorem 4 proves that a well-formed System S derivation maps to that target. On page 11, Definitions 12–14 give the reducibility candidates, the least-fixed-point environment for positive recursive definitions, and the logical relation. Theorem 5 states that if Γ⊢𝑡:𝑇 and Γ𝗐𝖿, then the unchanged Curry term belongs to the candidate interpreting the erased 𝑇. The sentence immediately following Theorem 5 combines it with Theorem 4 to conclude strong normalization. Those results have exactly the closure and positivity hypotheses frozen here, so they establish the displayed statement [FS14]. ◻
If the positivity hypothesis is removed, 𝖡𝖺𝖽 above and 𝛿𝛿 invalidate the fixed-point interpretation and the conclusion. If mutual recursion or open closure right-hand sides are added, the displayed translation no longer proves the theorem; a separate target metatheory would be required.
Four distinct self binders
System
self binder occurs in
enabling rule
erasure
dependent intersection
second view 𝐵(𝑥)
same-subject introduction
one existing term
System S
the assigned type 𝑇(𝑥)
self generation/instantiation
unchanged term
OO 𝖲𝖾𝗅𝖿
method result types
class/matching rules
object value
DOT
recursive object type
recursive introduction/path selection
allocated object
An identity self-loop instead has a path variable 𝑝:𝑥=𝐴𝑥 and an identity eliminator. System S has neither endpoints nor path elimination. Its normalization proof depends on the positive recursive closure and on erasure, not on a groupoid law.
★★☆ Write the complete typing derivation of 𝗂𝗇𝖽𝑠𝑧𝑛:𝐶(𝑛). Circle the occurrence of 𝑛 introduced by S-Self-Inst. Replace 𝐶(𝑛) by a constant motive and identify the ordinary Church iterator obtained after erasure.
★★☆ Compute the polarity of the recursive variable in 1+𝑋×𝑋, 𝑋→𝖭, and (𝑋→𝖭)→𝖭. For each result, state whether the frozen closure admits it. For the rejected case, show the failed reducibility-candidate monotonicity inclusion.
★★★Practical project.system-s-self-positivity-checker Implement in Kappa a finite polarity checker for products and arrows, together with a finite same-subject check for self generation and instantiation. Maintain two invariants: both self rules preserve the subject’s erased tag, and every accepted recursive occurrence is positive. Accept 𝑋×𝑋 and (𝑋→1)→1, reject 𝑋→1, and reject a self-instantiation whose displayed subject differs from the substituted subject. Removing the arrow-domain polarity flip must make the test fail.
Sources. The System S syntax and rules are on pages 5–7 of Fu and Stump’s extended version; the Church-natural derivation is on pages 7–8. The erasure to 𝐹𝜔 with positive definitions begins on pages 9–11, the confluence and morph analyses on pages 11–13, and preservation and consistency on pages 13–14. The source proves strong normalization only for its restricted closure discipline. No public System S checker or mechanized metatheory was available, so the Kappa project tests the printed side conditions rather than claiming to mechanize the theorem [FS14].