Lectures onType Theory
Chapter 101
Chapter 101Optional

Graded Erasure and Extraction

Prerequisites. Direct starred prerequisites: Chapter 100. No later core chapter depends on this route.

The normalization theorem of chapter 100 concerns beta reduction after boxes have been forgotten by a reducibility interpretation. It gives no compiler. In particular, the judgment that an argument has grade zero does not by itself show that deleting the argument preserves the numeral computed by a program. The missing object is a translation into an operational target, together with a relation that follows both evaluations.

The graded-erasure calculus

Definition 101.1 — Graded-erasure signature

Fix a grade structure (M,+,0,,1,,). Addition and multiplication form a semiring, is a greatest-lower-bound operation, and is the usage order. Addition and multiplication distribute over meet, and equality of grades is decidable. For every p,rM, natural-number recursion uses a function nrp,r:M3M. For grades qz,qs,qn,qz,qs,qn,qM, the five scalar laws are qn0nrp,r(qz,qs,qn)qzNR-Base. nrp,r(qz,qs,qn)qs+pqn+rnrp,r(qz,qs,qn)NR-Step. qzqz,qsqs,qnqnnrp,r(qz,qs,qn)nrp,r(qz,qs,qn)NR-Mono. nrp,r(qz,qs,qn)qnrp,r(qzq,qsq,qnq)NR-Right. nrp,r(qz,qs,qn)+nrp,r(qz,qs,qn)nrp,r(qz+qz,qs+qs,qn+qn)NR-Interchange. The scalar operations lift pointwise to usage contexts of one domain: (γ+δ)(i):=γ(i)+δ(i),(pγ)(i):=pγ(i),(γδ)(i):=γ(i)δ(i),nrp,r(γ,δ,η)(i):=nrp,r(γ(i),δ(i),η(i)). Only the last three arguments of nrp,r are lifted. Hence equation 101.1equation 101.5 hold for usage contexts by evaluation at each component.

The expressions are A,B,t,u::=UΠpqABΣ&qABΣqABNxiλpttpu(t,u)&fsttsndt(t,u)prodrecrq(A;t;u)zerosuctnatrecp,rq(A;z;s;n)emptyrecp(A;t). The universe is one Russell classifier U; it is not a hierarchy of first-class levels, and the calculus has no rule ΓU:U. Strong sums have projections and eta equality. Weak sums have prodrec. The two configurable predicates Prodrec(r) and Emptyrec(p) determine which grades their eliminators admit. The calculus contains no identity type, opacity, weak unit type, or first-class level syntax. Every theorem below is restricted to this displayed sublanguage.

Write B[t] for the de Bruijn substitution B[id,t], write for shift, and write Γ.A for context extension. Typing and usage are separate judgments: Γt:A checks the classifier, whereas γt checks annotations and has one grade for each variable of Γ.

Definition 101.2 — Graded typing card

The context, variable-membership, and type judgments are generated by

ϵ
Ctx-ε
ΓA
Γ.A
Ctx-Ext
x0:A[]Γ.A
V-Zero
xi:AΓ
xi+1:A[]Γ.B
V-Suc
ΓA:U
ΓA
Ty-U
Γ.AB
ΓΠpqAB
Ty-Π
Γ.AB
ΓΣkqAB
Ty-Σ

where k{&,}. The complete universe-code fragment is

Γ
ΓN:U
Code-N
Γ
Γ:U
Code-Empty
ΓA:UΓ.AB:U
ΓΠpqAB:U
Code-Π
ΓA:UΓ.AB:U
ΓΣkqAB:U
Code-Σ

Thus N, , Π, and Σ are terms classified by U, and Ty-U turns such a code into a type; there is no code for U itself.

The function and pair rules are

Γt:AΓA=B
Γt:B
T-Conv
Γxi:AΓ
Γxi:A
T-Var
Γ.ABΓ.At:B
Γλpt:ΠpqAB
T-Lam
Γt:ΠpqABΓu:A
Γtpu:B[u]
T-App
Γ.ABΓt:AΓu:B[t]
Γ(t,u)k:ΣkqAB
T-Pair
Γ.ABΓt:Σ&qAB
Γfstt:A
T-Fst
Γ.ABΓt:Σ&qAB
Γsndt:B[fstt]
T-Snd

The primitive weak-sum eliminator binds the two components in its branch. Its type rule, including the distinction between the dependency grade q of the scrutinee and the usage annotation q on the eliminator, is

Γ.ΣqABCΓt:ΣqABΓ.A.Bu:C[2,(x1,x0)]
Γprodrecrq(C;t;u):C[t]
T-Prodrec

There is no primitive prodrec rule for Σ&, and there are no primitive projections for Σ.

Finally, the natural-number and empty-type rules are

Γ
Γzero:N
T-Zero
Γt:N
Γsuct:N
T-Suc
ΓAΓt:
Γemptyrecp(A;t):A
T-Emptyrec

and

Γz:A[zero]Γ.N.As:A[2,sucx1]Γn:N
Γnatrecp,rq(A;z;s;n):A[n]
T-Natrec

The displayed formation premises are exact: the well-formedness of the motives that can be recovered from other premises is not inserted as a new premise.

Definition 101.3 — Graded equality card

The two equality judgments are generated by the following complete card. Type equality is obtained from equality in the universe, is an equivalence relation, and is closed under the two dependent type constructors:

ΓA=B:U
ΓA=B
Eq-Ty
ΓA
ΓA=A
Eq-Ty-Refl
ΓA=B
ΓB=A
Eq-Ty-Sym
ΓA=BΓB=C
ΓA=C
Eq-Ty-Trans
ΓA=AΓ.AB=B
ΓΠpqAB=ΠpqAB
Eq-Π
ΓA=AΓ.AB=B
ΓΣkqAB=ΣkqAB
Eq-Σ

Here and below k{&,}. Term equality is a typed equivalence relation with conversion:

Γt:A
Γt=t:A
Eq-Refl
ΓAΓt=u:A
Γu=t:A
Eq-Sym
Γt=u:AΓu=v:A
Γt=v:A
Eq-Trans
Γt=u:AΓA=B
Γt=u:B
Eq-Conv

The universe-level congruences and application congruence are

ΓA=A:UΓ.AB=B:U
ΓΠpqAB=ΠpqAB:U
Eq-Π-U
ΓA=A:UΓ.AB=B:U
ΓΣkqAB=ΣkqAB:U
Eq-Σ-U
Γt=t:ΠpqABΓu=u:A
Γtpu=tpu:B[u]
Eq-App

Functions have beta and eta:

Γ.ABΓ.At:BΓu:A
Γ(λpt)pu=t[u]:B[u]
Eq-β
Γ.ABΓt:ΠpqABΓu:ΠpqABΓ.At[]px0=u[]px0:B
Γt=u:ΠpqAB
Eq-η

For strong sums, projections compute and are congruent, and the two projections jointly determine an inhabitant:

Γ.ABΓt:AΓu:B[t]
Γfst(t,u)&=t:A
Eq-Fst-β
Γ.ABΓt=u:Σ&qAB
Γfstt=fstu:A
Eq-Fst
Γ.ABΓt:AΓu:B[t]
Γsnd(t,u)&=u:B[fst(t,u)&]
Eq-Snd-β
Γ.ABΓt=u:Σ&qAB
Γsndt=sndu:B[fstt]
Eq-Snd
Γ.ABΓt:Σ&qABΓu:Σ&qABΓfstt=fstu:AΓsndt=sndu:B[fstt]
Γt=u:Σ&qAB
Eq-Σ_&-η

Both pair constructors are congruent, whereas only weak sums have the primitive pattern computation and congruence rules:

Γ.ABΓt=t:AΓu=u:B[t]
Γ(t,u)k=(t,u)k:ΣkqAB
Eq-Pair
Γ.ΣqABCΓt:AΓt:B[t]Γ.A.Bu:C[2,(x1,x0)]
Γprodrecrq(C;(t,t);u)=u[t,t]:C[(t,t)]
Eq-Prodrec-β
Γ.ΣqABC=CΓt=t:ΣqABΓ.A.Bu=u:C[2,(x1,x0)]
Γprodrecrq(C;t;u)=prodrecrq(C;t;u):C[t]
Eq-Prodrec

Natural recursion has its two computations and congruence rules:

Γz:A[zero]Γ.N.As:A[2,sucx1]
Γnatrecp,rq(A;z;s;zero)=z:A[zero]
Eq-Nat-Zero
Γz:A[zero]Γ.N.As:A[2,sucx1]Γn:N
Γnatrecp,rq(A;z;s;sucn)=s[n,natrecp,rq(A;z;s;n)]:A[sucn]
Eq-Nat-Suc
Γt=u:N
Γsuct=sucu:N
Eq-Suc
Γ.NA=AΓz=z:A[zero]Γ.N.As=s:A[2,sucx1]Γn=n:N
Γnatrecp,rq(A;z;s;n)=natrecp,rq(A;z;s;n):A[n]
Eq-Natrec

Finally, empty elimination is congruent in both its motive and absurd proof:

ΓA=BΓt=u:
Γemptyrecp(A;t)=emptyrecp(B;u):A
Eq-Emptyrec

There is no eta rule for weak sums. No rule for a constructor outside the signature of definition 101.1 is included.

Definition 101.4 — Graded usage card

The grade-assignment judgment is generated by the following complete list:

0U
U-Universe
0N
U-N
0
U-Empty
eixi
U-Var
0zero
U-Zero
γAδ,qB
pγ+δΠpqAB
U-Π
γAδ,qB
γ+δΣkqAB
U-Σ
γ,pt
γλpt
U-Lam
γtδu
γ+pδtpu
U-App
γtδu
γ+δ(t,u)
U-WeakPair
γtδu
γδ(t,u)&
U-StrongPair
γt
γfstt
U-Fst
γt
γsndt
U-Snd
γt
γsuct
U-Suc
γtδ,r,ruη,qCProdrec(r)
rγ+δprodrecrq(C;t;u)
U-Prodrec
γtδAEmptyrec(p)
pγemptyrecp(A;t)
U-Emptyrec
γzzγs,p,rsγnnδ,qA
nrp,r(γz,γs,γn)natrecp,rq(A;z;s;n)
U-Natrec
γtδγ
δt
U-Sub

The motive premises in U-Prodrec, U-Natrec, and U-Emptyrec validate annotations but do not contribute to the conclusion’s demand.

Definition 101.5 — Paper weak-head dynamics

The term judgment Γtu:A is the least typed relation containing the following conversion, head-context, and computation rules. Conversion is itself a displayed rule, not an untyped closure convention:

Γtu:AΓA=B
Γtu:B
R-Conv

For applications,

Γtt:ΠpqABΓu:A
Γtputpu:B[u]
R-App
Γ.ABΓ.At:BΓu:A
Γ(λpt)put[u]:B[u]
R-β

For strong sums,

Γ.ABΓtt:Σ&qAB
Γfsttfstt:A
R-Fst
Γ.ABΓt:AΓu:B[t]
Γfst(t,u)&t:A
R-Fst-β

and

Γ.ABΓtt:Σ&qAB
Γsndtsndt:B[fstt]
R-Snd
Γ.ABΓt:AΓu:B[t]
Γsnd(t,u)&u:B[fst(t,u)&]
R-Snd-β

For the weak-sum eliminator,

Γtt:ΣqABΓ.ΣqABCΓ.A.Bu:C[2,(x1,x0)]
Γprodrecrq(C;t;u)prodrecrq(C;t;u):C[t]
R-Prodrec

and

Γ.ΣqABCΓt1:AΓt2:B[t1]Γ.A.Bu:C[2,(x1,x0)]
Γprodrecrq(C;(t1,t2);u)u[t1,t2]:C[(t1,t2)]
R-Prodrec-β

Natural-number recursion reduces only its scrutinee:

Γnn:NΓz:A[zero]Γ.N.As:A[2,sucx1]
Γnatrecp,rq(A;z;s;n)natrecp,rq(A;z;s;n):A[n]
R-Natrec

with the two computation rules

Γz:A[zero]Γ.N.As:A[2,sucx1]
Γnatrecp,rq(A;z;s;zero)z:A[zero]
R-Nat-Zero

and

Γz:A[zero]Γ.N.As:A[2,sucx1]Γn:N
Γnatrecp,rq(A;z;s;sucn)s[n,natrecp,rq(A;z;s;n)]:A[sucn]
R-Nat-Suc

The last head context is

ΓAΓtt:
Γemptyrecp(A;t)emptyrecp(A;t):A
R-Emptyrec

Type reduction is term reduction at U, and is the reflexive, transitive closure. These clauses are the entire call-by-name weak-head relation: there is no reduction under a lambda, pair component, or recursion branch.

For beta reduction, U-App gives the required substitution arithmetic: if γ,pt and δu, then γ+pδt[u/x]. A rule that used γ+δ would be unsound at p=2, since two occurrences of the bound variable become two copies of every free occurrence of u.

Theorem 101.6 — Usage substitution and preservation

Let Ψ be a matrix of grades and σ a simultaneous substitution. If every row eiΨ resources σ(i), then γtγΨt[σ]. Consequently, if γt and Γtu:A, then γu.

Proof of Theorem 101.6 — Usage substitution and preservation

Proof. Matrix multiplication satisfies 0Ψ=0,eiΨ=rowi(Ψ),(γ+δ)Ψ=γΨ+δΨ,(pγ)Ψ=p(γΨ). Here the middle identity says that the i-th unit row selects row i of Ψ. If Ψ+ is the matrix of the lifted substitution, then (101.1)(γ,p)Ψ+=(γΨ,p),(γ,p,r)Ψ++=(γΨ,p,r). Induct on the displayed usage derivation.

Leaves and subsumption. For U-Universe, U-N, U-Empty, and U-Zero, use 0Ψ=0. The U-Var goal is exactly the row premise eiΨσ(i). In U-Sub, monotonicity of matrix multiplication sends δγ to δΨγΨ, after which U-Sub applies to the induction hypothesis.

Formation and binders. For U-Π, the induction hypotheses, with the lifted substitution in the codomain, give γΨA[σ] and δΨ,qB[σ+]. Rule U-Π gives p(γΨ)+δΨ=(pγ+δ)ΨΠpqA[σ]B[σ+]. For U-Σ, replace the left side by γΨ+δΨ=(γ+δ)Ψ. For U-Lam, equation 101.1 turns the body induction hypothesis into γΨ,pt[σ+], and U-Lam removes the last component.

Binary constructors. The application hypotheses rebuild U-App at γΨ+p(δΨ)=(γ+pδ)Ψ. The weak-pair calculation is γΨ+δΨ=(γ+δ)Ψ. For a strong pair, U-StrongPair first gives γΨδΨ. Monotonicity gives (γδ)ΨγΨ,(γδ)ΨδΨ, so the defining property of meet and U-Sub give the required context (γδ)Ψ. The U-Fst, U-Snd, and U-Suc cases apply their displayed unary rule to the induction hypothesis.

Eliminators. For U-Prodrec, the three induction hypotheses and equation 101.1 have contexts γΨ, δΨ,r,r, and ηΨ,q. Rebuilding the rule gives r(γΨ)+δΨ=(rγ+δ)Ψ. The predicate Prodrec(r) is unchanged by substitution. For U-Emptyrec, the term and motive hypotheses rebuild the rule at p(γΨ)=(pγ)Ψ; the predicate Emptyrec(p) is unchanged.

For U-Natrec, fix a target component j. Expanding matrix multiplication gives a finite sum over source rows. Apply NR-Right, equation 101.4, to move each matrix entry into the three branch demands, apply NR-Interchange, equation 101.5, to combine the rows, and apply NR-Mono, equation 101.3, to the induction-hypothesis bounds. Componentwise this proves nrp,r(γz,γs,γn)Ψnrp,r(γzΨ,γsΨ,γnΨ). Rule U-Natrec resources the substituted term at the right side, and U-Sub changes it to the left side. This exhausts the usage card and proves substitution.

For preservation, induct on the rules of definition 101.5; if the last usage rule is U-Sub, first apply the induction argument above it and then reapply its inequality.

Application and strong sums. For R-App, the reduction induction hypothesis replaces the function premise of U-App; the argument premise and the context γ+pδ do not change. Rule R-β is the single-substitution instance γ,pt,δuγ+pδt[u]. For R-Fst and R-Snd, apply the reduction induction hypothesis to the scrutinee and rebuild U-Fst or U-Snd. In the two projection beta cases, inversion of U-StrongPair gives γt and δu, while the redex has context γδ. The inequalities γδγ and γδδ, followed by U-Sub, resource the selected component.

Weak sums. Rule R-Prodrec applies the reduction induction hypothesis to its scrutinee and rebuilds U-Prodrec. For R-Prodrec-β, invert the weak-pair premise to obtain γ1t1 and γ2t2, and invert the branch premise to obtain δ,r,ru. Two applications of usage substitution give δ+rγ1+rγ2u[t1,t2]. Distributivity and commutativity identify this context with r(γ1+γ2)+δ, the demand of the redex.

Naturals and emptiness. For R-Natrec, the reduction induction hypothesis changes γnn to γnn; rebuilding U-Natrec leaves its computed demand unchanged. In R-Nat-Zero, inversion of the zero usage gives γn0. Hence NR-Base gives nrp,r(γz,γs,γn)γz, and U-Sub changes the base-premise derivation γzz to the redex context. In R-Nat-Suc, inversion gives γnn. Substituting the scrutinee and the recursive call into γs,p,rs resources the reduct at γs+pγn+rnrp,r(γz,γs,γn). Rule NR-Step, equation 101.2, places the redex demand below this context, and U-Sub finishes the case. Finally, R-Emptyrec applies the reduction induction hypothesis to the absurd scrutinee and rebuilds U-Emptyrec. For R-Conv, inversion exposes a premise Γtu:A and an equality ΓA=B. The reduction induction hypothesis applied to that premise gives γu; usage has no type index, so this is exactly the required conclusion at B. These are all rules of definition 101.5, and preservation follows. ◻

Exercise 101.1

★★☆ Let t=x2y, let γ=(1,2), and substitute a term with demand δ=(3,1) for y. Write the substitution matrix and compute γΨ. Repeat with scalar one and identify the component that would under-count the grade-two substitution.

Normalization and conversion

The weak-head reduction of definition 101.5 is typed and call-by-name. A reducibility relation for that exact syntax proves normalization independently of usage. The proof chain is fundamental reducibility, weak-head uniqueness, conversion soundness, conversion completeness, equality decision, and typing decision. Every result below is stated at the signature of definition 101.2, definition 101.3, definition 101.5; later extensions of the calculus supply no premise.

Theorem 101.7 — Normalization and conversion

For the signature of definition 101.1:

  1. every well-typed term and type reduces to a weak-head normal form;

  2. a weak-head normal form has no typed weak-head reduct, and two weak-head normal forms reached from one typed expression are equal;

  3. algorithmic conversion is sound and complete for declarative equality; hence conversion and type checking are decidable on the checkable expressions.

Proof of Theorem 101.7 — Normalization and conversion

Proof. Clause 1 imports the fundamental reducibility results identified in the source’s Section 4.4, printed p. 15. At the displayed signature their type and term consequences are ΓAl.ΓlA and, for every derivation Γt:A, reducibility of t at the same candidate. The term component of reducibility supplies a weak-head reduct. Clause 2 is source Theorems 4.1 and 4.2, printed p. 15. The first says that a weak-head normal form admits no nonidentity typed weak-head reduction; the second identifies the endpoints of two typed weak-head reductions from one term.

For clause 3, the source proves soundness of algorithmic conversion by induction on the algorithmic derivation and completeness by mutual induction on declarative type and term equality. Decidability follows by running that conversion procedure on typed inputs; the checking result is restricted to the checkable expressions stated in Section 4.4. All three clauses therefore have exactly the syntax of definition 101.1; no consequence is claimed for identity types, first-class levels, top-level definitions, opacity, or weak units [ADE26]. ◻

Usage preservation is absent from the proof of normalization. Conversely, theorem 101.6 does not exclude an infinite sequence: it says that every reduct still satisfies one grade judgment. The two theorems answer different questions.

Erasure into an untyped target

Fix a grade zero satisfying positivity of addition and meet, and 01. Let ω range over grades distinct from zero. The target grammar is v,w::=xiλvvw(v,w)fstvsndvprodrec(v;w)zerosucvnatrec(v;w;v). It is an untyped call-by-name calculus. The closed term :=(λ(x0x0))(λ(x0x0)) loops and represents erased source syntax that cannot be observed by a sound extracted program.

Definition 101.8 — Extraction

Write t for the non-strict extraction. The following clauses cover every constructor of definition 101.1: U=↺,N=↺,=↺,(ΠpqAB)=↺,(ΣkqAB)=↺,xi=xi,(λωt)=λt,(tωu)=tu,(λ0t)=t[/x],(t0u)=t,((t,u)k)=(t,u),(fstt)=fstt,(sndt)=sndt,(prodrecωq(A;t;u))=prodrec(t;u),(prodrec0q(A;t;u))=u[,],zero=zero,(suct)=suc(t),(natrecp,rq(A;z;s;n))=natrec(z;s;n),(emptyrecp(A;t))=↺. Here k{&,}, and the two-term substitution in erased prodrec replaces its component binders in de Bruijn order. The side condition Prodrec(0) belongs to usage validation; it does not make extraction partial.

Definition 101.9 — Non-strict target reduction

The one-step target relation is generated by the following complete non-strict rule family:

vv
vwvw
E-App
(λv)wv[w]
E-β
vv
fstvfstv
E-Fst
fst(v,w)v
E-Fst-β
vv
sndvsndv
E-Snd
snd(v,w)w
E-Snd-β
vv
prodrec(v;w)prodrec(v;w)
E-Prodrec
prodrec((v,v);w)w[v,v]
E-Prodrec-β
vv
natrec(z;s;v)natrec(z;s;v)
E-Natrec
natrec(z;s;zero)z
E-Nat-Zero
natrec(z;s;sucv)s[v,natrec(z;s;v)]
E-Nat-Suc

Its reflexive, transitive closure is . For observations at N, close both source and target reduction under successors: vvsucvssucvandΓtt:NΓsuctssuct:N, and then take reflexive, transitive closure. The reductions in theorem 101.11 are these successor-closed relations.

Consider e=(λ0x.suczero)0natrec(A;z;s;n). The source evaluates to suczero without inspecting the argument. Extraction gives e=suczero. Changing the binder and application annotations to ω retains the argument and yields (λx.suczero)natrec(z;s;n). Grade zero controls translation only after the usage judgment has validated the annotations.

Lemma 101.10 — No extracted occurrence

If γt and γ(i)=0, then xi does not occur free in t.

Proof of Lemma 101.10 — No extracted occurrence

Proof. Induct on γt. The variable case would imply 01, contradicting the well-behaved-zero assumption. Positivity of addition handles applications and weak pairs; positivity of meet handles strong pairs. The abstraction case removes the bound component. For a grade-zero application, the argument is absent from the target, while for a nonzero application the induction hypothesis applies to both subterms. The recursion case uses positivity of the nr result. These cases cover every extraction clause. ◻

Theorem 101.11 — Operational erasure soundness

Let Δ be a context. Assume either Prodrec(0) is false or Δ is empty. If Emptyrec(0) is true, also assume that Δ is consistent. If Δt:Nand0t, then there is a numeral n such that both the source and target evaluate under successor closure to that numeral: Δtn:N,tn.

Proof of Theorem 101.11 — Operational erasure soundness

Proof. We use two compatibility claims. First, for every simultaneous substitution σ, extraction commutes with substitution on retained variables: (1)(a[σ])=a[σ]. For an erased binder, the corresponding component of σ is . Prove (1) by induction on a. The variable, binder, application, pair, projection, successor, and recursor clauses follow by the induction hypotheses. In a grade-zero application the argument disappears on both sides. In a grade-zero weak-sum eliminator, lemma 101.10 removes both component variables from the extracted branch, so replacing them by t1,t2 or by two copies of gives the same target term. Empty elimination extracts to on both sides. These are all clauses of definition 101.8.

Second, suppose Δab:A and the usage derivation for a has total grade zero. Under the two hypotheses of the theorem, (2)ab. Prove (2) by induction on the displayed source-reduction derivation. The R-App, R-Fst, R-Snd, R-Prodrec, and R-Natrec cases apply the induction hypothesis under the matching E-App, E-Fst, E-Snd, E-Prodrec, and E-Natrec context. Rule R-β becomes E-β when the application grade is nonzero; at grade zero both endpoints are equal by (1). The two strong-pair projection roots become E-Fst-β and E-Snd-β. A weak-pair beta root becomes E-Prodrec-β when its scrutinee is retained, and becomes equality by (1) and lemma 101.10 when its grade is zero. The two natural-number roots become E-Nat-Zero and E-Nat-Suc; equation (1) identifies the substituted step branch in the successor case. R-Conv uses the induction hypothesis unchanged because extraction does not inspect the classifier. An empty eliminator at total grade zero would contain a zero-use proof of . If Emptyrec(0) is available, consistency of Δ excludes that derivation; if it is not available, the term is not admitted. Thus no empty-elimination root remains. This exhausts definition 101.5 and proves (2).

By clause 1 of theorem 101.7, the well-typed natural-number term t has a weak-head normal form. Canonicity for the natural-number rules in definition 101.2 identifies that form as a numeral n: a variable head is excluded by the zero-use derivation, a neutral eliminator would contradict normalization together with the closed-match and consistency hypotheses, and the remaining canonical forms are zero and successors. Hence Δtn:N. Repeated application of (2), using theorem 101.6 at each source step, gives tn. Extraction fixes numerals, so n=n, which proves both conclusions. ◻

If erased weak-pair matches are admitted in an open context, the term prodrec00(N;x0;zero) is closed under extraction but stuck in the source. It is the boundary counterexample to dropping the first hypothesis. Consistency is needed when an empty eliminator may erase an open contradiction. Neither condition is ornamental.

Exercise 101.2

★★☆ Type the open weak-pair match just displayed and calculate its extraction. Show that the source has no weak-head step while the target is zero. Identify the exact hypothesis of theorem 101.11 that rejects the example.

The recursion machine is a different theorem

A distinct recursion calculus replaces the use of nrp,r by a greatest lower bound of the finite unfolding demands nr0(r;qz,qs)=qz,nrk+1(r;qz,qs)=qs+rnrk(r;qz,qs). Its recursion rule requires knrk(r;qz,qs) and the corresponding bound for scrutinee use. The grade structure must have well-behaved greatest lower bounds. This is a rule replacement, not a lemma about definition 101.1.

The machine has to be written down, because the theorem below quantifies over its states and its stuck configurations.

Definition 101.12 — Resource machine

A state is a quadruple H;t;ρ;S:

  • H is a heap, a finite list of entries yp(u,ρ) pairing a closure with the grade p of available copies of it;

  • t is the term in head position and ρ its environment, a finite map from the free variables of t to heap pointers;

  • S is a stack of continuations.

Every continuation e has a multiplicity |e|, and a stack’s multiplicity is the product of its entries: |ϵ|:=1,|e.S|:=|e||S|. Application, projection, and successor continuations have multiplicity 1; the two pattern-matching continuations prodrecrp and emptyrecrp have multiplicity r, the grade at which they consume their scrutinee.

Two transitions matter here. Looking up a variable consumes |S| copies of its entry, H;x;ρ;SH;u;ρ;Swhen Hρ(x)|S|(u,ρ);H, where H is H with |S| copies subtracted from that entry, and the transition does not apply when fewer than |S| copies remain. Applying a graded abstraction allocates, H;λpx.t;ρ;pu[ρ].SH.y|S|p(u,ρ);t;ρ[xy];S, so the new entry is created with exactly the number of copies the stack can demand.

A state is well-resourced when the grades available in H dominate, pointwise, the demand of the head term together with the demand of the stack.

Three things can stop weak head evaluation: a variable lookup finds too few copies, a value meets a continuation that does not match it, or a value meets the empty stack. The theorem rules out the first for well-resourced states and the second by typing, leaving the third as the intended terminal case.

Theorem 101.13 — Resource-correct numeral evaluation

Write γpt for the usage judgment of definition 101.4 taken at grade p, so that ϵ1t says that the closed term t is resourced for exactly one use. In the recursion calculus, if ϵ1t and ϵt:N, then machine evaluation of t reaches a state H;n;ρ;ϵ for some numeral n, heap H, and environment ρ, and the grade associated with every entry of H is bounded by zero. For the linearity semiring, every linear entry allocated during evaluation was looked up exactly once.

Proof of Theorem 101.13 — Resource-correct numeral evaluation

Proof. Write D(H;t;ρ;S) for the pointwise demand of the head closure and stack, after ρ replaces the head’s free variables by heap pointers. Thus well-resourcedness is the inequality D(H;t;ρ;S)grade(H). We prove four claims.

Resource preservation. If a well-resourced state takes one machine step, then its successor is well-resourced. Check the transition forms. A variable lookup consumes |S| copies from both D and the selected heap grade; the lookup premise provides the subtraction and hence preserves the inequality. Application, the two projections, weak-sum elimination, empty elimination, and successor move one eliminator from the head to the stack. The definition |e.S|=|e||S| makes the demand before and after each push equal. Applying λpx.t removes an application continuation and allocates |S|p copies of its argument. The body usage premise has bound-variable component p, so replacing that component by the new pointer changes both sides of the demand inequality by exactly |S|p.

A strong-pair projection pops a multiplicity-one continuation and selects one component. Its demand is bounded by the pair demand because γδγ for the first projection and γδδ for the second. A weak-pair match pops a multiplicity-r continuation and extends the environment by two pointers; the branch premise of the usage rule bounds their demand by the two scaled component demands. Empty elimination has no value-pop case. A successor pushes a multiplicity-one continuation until its argument is a numeral and then pops it. Finally, the natural-number recursor uses nr0(r;qz,qs)=qz at zero and nrk+1(r;qz,qs)=qs+rnrk(r;qz,qs) at a successor; these are exactly the resource equations for the base and step transitions. The listed cases are the variable, eliminator-push, value-pop, and successor families of the machine, so resource preservation is proved.

Typing and progress. Machine typing assigns the head its closure type and assigns each stack continuation an input and output type. Induction on a transition preserves that typing. The variable case uses the type stored with the heap closure; lambda application uses value substitution; projection and weak-match pops use inversion of their pair typing rules; the two natural-number pops use the recursor computation types. These are the same transition families as in the resource proof. Consequently, a well-typed state whose stack is nonempty has a matching transition whenever its head is a value. A well-resourced variable head has a lookup transition by the first claim’s inequality. An eliminator head has a push transition. Hence a well-typed, well-resourced state can stop only with a value in head position and the empty stack.

Termination and numeral form. Expand a machine state to the call-by-name term obtained by replacing every heap pointer by its stored closure and plugging the head into its stack. A variable lookup and an eliminator push leave this expansion unchanged. Every value-pop transition is one call-by-name contraction, and the successor transition is one successor-closed natural-number step. Conversely, the outermost contraction of an expanded state is realized by finitely many lookup/push steps followed by its matching pop. The administrative prefix is finite. Order heap entries by allocation time; the environment stored in a fresh entry contains only older pointers. A lookup therefore decreases pointer age along every consecutive lookup chain, including a chain whose stack demand is zero. Between two lookups, each push removes the outer head eliminator. For positive stack demand, the resource invariant gives the additional bound that the number of lookups cannot exceed the allocated grade. Clause 1 of theorem 101.7, applied to the typed expanded initial state, rules out an infinite sequence of pop transitions. Thus full machine evaluation terminates. Its terminal head has type N; inversion of the typing rules leaves only a numeral n.

Final heap. Strengthen the resource invariant used in the first stage by retaining a residual usage context ζ for heap entries. The variable rule replaces the selected component q+|S| by q; lambda application appends the component |S|p; push and pop cases only redistribute components. Rule induction on the same transition families therefore preserves the equation “allocated demand = consumed demand plus ζ”. Initially the closed usage derivation ϵ1t has no free component. At H;n;ρ;ϵ, the numeral and empty stack also contribute no free component, so the preserved equation yields ζ0. The heap-compatibility part of the invariant says that every entry grade is bounded by its component of ζ; hence every final heap grade is bounded by zero. In the linearity semiring a freshly allocated linear entry starts with grade one, every successful lookup subtracts one, and zero is the only grade bounded by zero. Each such entry was consequently looked up exactly once. ◻

Suggested first pass.

None of these problems is a prerequisite for a later chapter. Begin with exercise 101.3, then complete exercise 101.5.

Exercise 101.3

★★☆ Reconstruct the application and natural-number successor cases of theorem 101.6. State the matrix equation and the characteristic nr inequality on the relation symbols where they are used.

Exercise 101.4

★★★ Compare grade preservation, erasure soundness, and machine resource correctness on the retained-argument example. For each theorem, state its signature, hypotheses, and observable conclusion. Give one pair of theorems for which neither conclusion implies the other.

Exercise 101.5

★★★ Practical project.graded-erasure-trace-checker Implement in Kappa a finite grade-zero extraction checker for variables, lambdas, application, naturals, and a guarded weak-pair match. Maintain the invariant that every deleted variable has inferred grade zero. On named inputs and expected outputs erased-index  suc zero,retained-argument  argument retained,open-erased-match  rejected: erased match in open context. Require also the three boundary observations dishonest-zero-grade  rejected by inferred use,closed-erased-match  accepted,shadowed-outer-use  unused. A mutation that deletes a grade-one argument must fail the retained-argument oracle. Two further well-typed mutations must be rejected: inferring zero use for every variable fails the dishonest-grade oracle, and descending beneath a same-name binder fails the shadowing oracle. Explain why the first mutation violates grade inference while the second violates binder identity. The program checks a finite translation; it does not prove logical-relation soundness or exact heap access counts.

Sources. The syntax, usage theorems, and erasure result are reconstructed from Abel, Danielsson, and Eriksson, especially pp. 12–21, with Theorems 4.1 and 4.2 on printed p. 15 and Theorem 6.9 on printed p. 29 [ADE26]. The normalization and conversion bundle imports Sections 4–5, a ten-page source development; the shorter usage, erasure, and operational arguments are proved locally. The machine of definition 101.12 is Figures 6 and 7 of the separate recursion calculus on its printed p. 279:12, its resource-correctness theorem is that paper’s Theorem 4.9 on printed p. 279:17, and its noninterference instance is Theorem 6.1 [EAD26]. The two calculi have distinct signatures; the recursion results do not strengthen the erasure theorem.

Search the book

Type to search the local edition.