Prerequisites. Direct starred prerequisites: Chapter 100. No later core chapter depends on this route.
The normalization theorem of chapter 100 concerns beta reduction after boxes have been forgotten by a reducibility interpretation. It gives no compiler. In particular, the judgment that an argument has grade zero does not by itself show that deleting the argument preserves the numeral computed by a program. The missing object is a translation into an operational target, together with a relation that follows both evaluations.
Fix a grade structure (𝑀,+,0,⋅,1,∧,≤). Addition and multiplication form a semiring, ∧ is a greatest-lower-bound operation, and ≤ is the usage order. Addition and multiplication distribute over meet, and equality of grades is decidable. For every 𝑝,𝑟∈𝑀, natural-number recursion uses a function 𝗇𝗋𝑝,𝑟:𝑀3→𝑀. For grades 𝑞𝑧,𝑞𝑠,𝑞𝑛,𝑞′𝑧,𝑞′𝑠,𝑞′𝑛,𝑞∈𝑀, the five scalar laws are 𝑞𝑛≤0⟹𝗇𝗋𝑝,𝑟(𝑞𝑧,𝑞𝑠,𝑞𝑛)≤𝑞𝑧NR-Base.𝗇𝗋𝑝,𝑟(𝑞𝑧,𝑞𝑠,𝑞𝑛)≤𝑞𝑠+𝑝𝑞𝑛+𝑟𝗇𝗋𝑝,𝑟(𝑞𝑧,𝑞𝑠,𝑞𝑛)NR-Step.𝑞𝑧≤𝑞′𝑧,𝑞𝑠≤𝑞′𝑠,𝑞𝑛≤𝑞′𝑛⟹𝗇𝗋𝑝,𝑟(𝑞𝑧,𝑞𝑠,𝑞𝑛)≤𝗇𝗋𝑝,𝑟(𝑞′𝑧,𝑞′𝑠,𝑞′𝑛)NR-Mono.𝗇𝗋𝑝,𝑟(𝑞𝑧,𝑞𝑠,𝑞𝑛)𝑞≤𝗇𝗋𝑝,𝑟(𝑞𝑧𝑞,𝑞𝑠𝑞,𝑞𝑛𝑞)NR-Right.𝗇𝗋𝑝,𝑟(𝑞𝑧,𝑞𝑠,𝑞𝑛)+𝗇𝗋𝑝,𝑟(𝑞′𝑧,𝑞′𝑠,𝑞′𝑛)≤𝗇𝗋𝑝,𝑟(𝑞𝑧+𝑞′𝑧,𝑞𝑠+𝑞′𝑠,𝑞𝑛+𝑞′𝑛)NR-Interchange. The scalar operations lift pointwise to usage contexts of one domain: (𝛾+𝛿)(𝑖):=𝛾(𝑖)+𝛿(𝑖),(𝑝𝛾)(𝑖):=𝑝𝛾(𝑖),(𝛾∧𝛿)(𝑖):=𝛾(𝑖)∧𝛿(𝑖),𝗇𝗋𝑝,𝑟(𝛾,𝛿,𝜂)(𝑖):=𝗇𝗋𝑝,𝑟(𝛾(𝑖),𝛿(𝑖),𝜂(𝑖)). Only the last three arguments of 𝗇𝗋𝑝,𝑟 are lifted. Hence equation 101.1–equation 101.5 hold for usage contexts by evaluation at each component.
The expressions are 𝐴,𝐵,𝑡,𝑢::=𝖴∣Π𝑞𝑝𝐴𝐵∣Σ𝑞&𝐴𝐵∣Σ𝑞⊗𝐴𝐵∣𝖭∣⊥∣𝑥𝑖∣𝜆𝑝𝑡∣𝑡𝑝𝑢∣(𝑡,𝑢)&∣𝖿𝗌𝗍𝑡∣𝗌𝗇𝖽𝑡∣(𝑡,𝑢)⊗∣𝗉𝗋𝗈𝖽𝗋𝖾𝖼𝑞𝑟(𝐴;𝑡;𝑢)∣𝗓𝖾𝗋𝗈∣𝗌𝗎𝖼𝑡∣𝗇𝖺𝗍𝗋𝖾𝖼𝑞𝑝,𝑟(𝐴;𝑧;𝑠;𝑛)∣𝖾𝗆𝗉𝗍𝗒𝗋𝖾𝖼𝑝(𝐴;𝑡). The universe is one Russell classifier 𝖴; it is not a hierarchy of first-class levels, and the calculus has no rule Γ⊢𝖴:𝖴. Strong sums have projections and eta equality. Weak sums have 𝗉𝗋𝗈𝖽𝗋𝖾𝖼. The two configurable predicates 𝖯𝗋𝗈𝖽𝗋𝖾𝖼(𝑟) and 𝖤𝗆𝗉𝗍𝗒𝗋𝖾𝖼(𝑝) determine which grades their eliminators admit. The calculus contains no identity type, opacity, weak unit type, or first-class level syntax. Every theorem below is restricted to this displayed sublanguage.
Write 𝐵[𝑡] for the de Bruijn substitution 𝐵[𝗂𝖽,𝑡], write ↑ for shift, and write Γ.𝐴 for context extension. Typing and usage are separate judgments: Γ⊢𝑡:𝐴 checks the classifier, whereas 𝛾▸𝑡 checks annotations and has one grade for each variable of Γ.
The context, variable-membership, and type judgments are generated by
⊢𝜖
Ctx-ε
Γ⊢𝐴
⊢Γ.𝐴
Ctx-Ext
𝑥0:𝐴[↑]∈Γ.𝐴
V-Zero
𝑥𝑖:𝐴∈Γ
𝑥𝑖+1:𝐴[↑]∈Γ.𝐵
V-Suc
Γ⊢𝐴:𝖴
Γ⊢𝐴
Ty-U
Γ.𝐴⊢𝐵
Γ⊢Π𝑞𝑝𝐴𝐵
Ty-Π
Γ.𝐴⊢𝐵
Γ⊢Σ𝑞𝑘𝐴𝐵
Ty-Σ
where 𝑘∈{&,⊗}. The complete universe-code fragment is
⊢Γ
Γ⊢𝖭:𝖴
Code-N
⊢Γ
Γ⊢⊥:𝖴
Code-Empty
Γ⊢𝐴:𝖴Γ.𝐴⊢𝐵:𝖴
Γ⊢Π𝑞𝑝𝐴𝐵:𝖴
Code-Π
Γ⊢𝐴:𝖴Γ.𝐴⊢𝐵:𝖴
Γ⊢Σ𝑞𝑘𝐴𝐵:𝖴
Code-Σ
Thus 𝖭, ⊥, Π, and Σ are terms classified by 𝖴, and Ty-U turns such a code into a type; there is no code for 𝖴 itself.
The function and pair rules are
Γ⊢𝑡:𝐴Γ⊢𝐴=𝐵
Γ⊢𝑡:𝐵
T-Conv
⊢Γ𝑥𝑖:𝐴∈Γ
Γ⊢𝑥𝑖:𝐴
T-Var
Γ.𝐴⊢𝐵Γ.𝐴⊢𝑡:𝐵
Γ⊢𝜆𝑝𝑡:Π𝑞𝑝𝐴𝐵
T-Lam
Γ⊢𝑡:Π𝑞𝑝𝐴𝐵Γ⊢𝑢:𝐴
Γ⊢𝑡𝑝𝑢:𝐵[𝑢]
T-App
Γ.𝐴⊢𝐵Γ⊢𝑡:𝐴Γ⊢𝑢:𝐵[𝑡]
Γ⊢(𝑡,𝑢)𝑘:Σ𝑞𝑘𝐴𝐵
T-Pair
Γ.𝐴⊢𝐵Γ⊢𝑡:Σ𝑞&𝐴𝐵
Γ⊢𝖿𝗌𝗍𝑡:𝐴
T-Fst
Γ.𝐴⊢𝐵Γ⊢𝑡:Σ𝑞&𝐴𝐵
Γ⊢𝗌𝗇𝖽𝑡:𝐵[𝖿𝗌𝗍𝑡]
T-Snd
The primitive weak-sum eliminator binds the two components in its branch. Its type rule, including the distinction between the dependency grade 𝑞′ of the scrutinee and the usage annotation 𝑞 on the eliminator, is
Γ.Σ𝑞′⊗𝐴𝐵⊢𝐶Γ⊢𝑡:Σ𝑞′⊗𝐴𝐵Γ.𝐴.𝐵⊢𝑢:𝐶[↑2,(𝑥1,𝑥0)⊗]
Γ⊢𝗉𝗋𝗈𝖽𝗋𝖾𝖼𝑞𝑟(𝐶;𝑡;𝑢):𝐶[𝑡]
T-Prodrec
There is no primitive 𝗉𝗋𝗈𝖽𝗋𝖾𝖼 rule for Σ&, and there are no primitive projections for Σ⊗.
Finally, the natural-number and empty-type rules are
⊢Γ
Γ⊢𝗓𝖾𝗋𝗈:𝖭
T-Zero
Γ⊢𝑡:𝖭
Γ⊢𝗌𝗎𝖼𝑡:𝖭
T-Suc
Γ⊢𝐴Γ⊢𝑡:⊥
Γ⊢𝖾𝗆𝗉𝗍𝗒𝗋𝖾𝖼𝑝(𝐴;𝑡):𝐴
T-Emptyrec
and
Γ⊢𝑧:𝐴[𝗓𝖾𝗋𝗈]Γ.𝖭.𝐴⊢𝑠:𝐴[↑2,𝗌𝗎𝖼𝑥1]Γ⊢𝑛:𝖭
Γ⊢𝗇𝖺𝗍𝗋𝖾𝖼𝑞𝑝,𝑟(𝐴;𝑧;𝑠;𝑛):𝐴[𝑛]
T-Natrec
The displayed formation premises are exact: the well-formedness of the motives that can be recovered from other premises is not inserted as a new premise.
The two equality judgments are generated by the following complete card. Type equality is obtained from equality in the universe, is an equivalence relation, and is closed under the two dependent type constructors:
Γ⊢𝐴=𝐵:𝖴
Γ⊢𝐴=𝐵
Eq-Ty
Γ⊢𝐴
Γ⊢𝐴=𝐴
Eq-Ty-Refl
Γ⊢𝐴=𝐵
Γ⊢𝐵=𝐴
Eq-Ty-Sym
Γ⊢𝐴=𝐵Γ⊢𝐵=𝐶
Γ⊢𝐴=𝐶
Eq-Ty-Trans
Γ⊢𝐴=𝐴′Γ.𝐴⊢𝐵=𝐵′
Γ⊢Π𝑞𝑝𝐴𝐵=Π𝑞𝑝𝐴′𝐵′
Eq-Π
Γ⊢𝐴=𝐴′Γ.𝐴⊢𝐵=𝐵′
Γ⊢Σ𝑞𝑘𝐴𝐵=Σ𝑞𝑘𝐴′𝐵′
Eq-Σ
Here and below 𝑘∈{&,⊗}. Term equality is a typed equivalence relation with conversion:
Γ⊢𝑡:𝐴
Γ⊢𝑡=𝑡:𝐴
Eq-Refl
Γ⊢𝐴Γ⊢𝑡=𝑢:𝐴
Γ⊢𝑢=𝑡:𝐴
Eq-Sym
Γ⊢𝑡=𝑢:𝐴Γ⊢𝑢=𝑣:𝐴
Γ⊢𝑡=𝑣:𝐴
Eq-Trans
Γ⊢𝑡=𝑢:𝐴Γ⊢𝐴=𝐵
Γ⊢𝑡=𝑢:𝐵
Eq-Conv
The universe-level congruences and application congruence are
Γ⊢𝐴=𝐴′:𝖴Γ.𝐴⊢𝐵=𝐵′:𝖴
Γ⊢Π𝑞𝑝𝐴𝐵=Π𝑞𝑝𝐴′𝐵′:𝖴
Eq-Π-U
Γ⊢𝐴=𝐴′:𝖴Γ.𝐴⊢𝐵=𝐵′:𝖴
Γ⊢Σ𝑞𝑘𝐴𝐵=Σ𝑞𝑘𝐴′𝐵′:𝖴
Eq-Σ-U
Γ⊢𝑡=𝑡′:Π𝑞𝑝𝐴𝐵Γ⊢𝑢=𝑢′:𝐴
Γ⊢𝑡𝑝𝑢=𝑡′𝑝𝑢′:𝐵[𝑢]
Eq-App
Functions have beta and eta:
Γ.𝐴⊢𝐵Γ.𝐴⊢𝑡:𝐵Γ⊢𝑢:𝐴
Γ⊢(𝜆𝑝𝑡)𝑝𝑢=𝑡[𝑢]:𝐵[𝑢]
Eq-β
Γ.𝐴⊢𝐵Γ⊢𝑡:Π𝑞𝑝𝐴𝐵Γ⊢𝑢:Π𝑞𝑝𝐴𝐵Γ.𝐴⊢𝑡[↑]𝑝𝑥0=𝑢[↑]𝑝𝑥0:𝐵
Γ⊢𝑡=𝑢:Π𝑞𝑝𝐴𝐵
Eq-η
For strong sums, projections compute and are congruent, and the two projections jointly determine an inhabitant:
The term judgment Γ⊢𝑡⟶𝑢:𝐴 is the least typed relation containing the following conversion, head-context, and computation rules. Conversion is itself a displayed rule, not an untyped closure convention:
Γ⊢𝑡⟶𝑢:𝐴Γ⊢𝐴=𝐵
Γ⊢𝑡⟶𝑢:𝐵
R-Conv
For applications,
Γ⊢𝑡⟶𝑡′:Π𝑞𝑝𝐴𝐵Γ⊢𝑢:𝐴
Γ⊢𝑡𝑝𝑢⟶𝑡′𝑝𝑢:𝐵[𝑢]
R-App
Γ.𝐴⊢𝐵Γ.𝐴⊢𝑡:𝐵Γ⊢𝑢:𝐴
Γ⊢(𝜆𝑝𝑡)𝑝𝑢⟶𝑡[𝑢]:𝐵[𝑢]
R-β
For strong sums,
Γ.𝐴⊢𝐵Γ⊢𝑡⟶𝑡′:Σ𝑞&𝐴𝐵
Γ⊢𝖿𝗌𝗍𝑡⟶𝖿𝗌𝗍𝑡′:𝐴
R-Fst
Γ.𝐴⊢𝐵Γ⊢𝑡:𝐴Γ⊢𝑢:𝐵[𝑡]
Γ⊢𝖿𝗌𝗍(𝑡,𝑢)&⟶𝑡:𝐴
R-Fst-β
and
Γ.𝐴⊢𝐵Γ⊢𝑡⟶𝑡′:Σ𝑞&𝐴𝐵
Γ⊢𝗌𝗇𝖽𝑡⟶𝗌𝗇𝖽𝑡′:𝐵[𝖿𝗌𝗍𝑡]
R-Snd
Γ.𝐴⊢𝐵Γ⊢𝑡:𝐴Γ⊢𝑢:𝐵[𝑡]
Γ⊢𝗌𝗇𝖽(𝑡,𝑢)&⟶𝑢:𝐵[𝖿𝗌𝗍(𝑡,𝑢)&]
R-Snd-β
For the weak-sum eliminator,
Γ⊢𝑡⟶𝑡′:Σ𝑞′⊗𝐴𝐵Γ.Σ𝑞′⊗𝐴𝐵⊢𝐶Γ.𝐴.𝐵⊢𝑢:𝐶[↑2,(𝑥1,𝑥0)⊗]
Γ⊢𝗉𝗋𝗈𝖽𝗋𝖾𝖼𝑞𝑟(𝐶;𝑡;𝑢)⟶𝗉𝗋𝗈𝖽𝗋𝖾𝖼𝑞𝑟(𝐶;𝑡′;𝑢):𝐶[𝑡]
R-Prodrec
and
Γ.Σ𝑞′⊗𝐴𝐵⊢𝐶Γ⊢𝑡1:𝐴Γ⊢𝑡2:𝐵[𝑡1]Γ.𝐴.𝐵⊢𝑢:𝐶[↑2,(𝑥1,𝑥0)⊗]
Γ⊢𝗉𝗋𝗈𝖽𝗋𝖾𝖼𝑞𝑟(𝐶;(𝑡1,𝑡2)⊗;𝑢)⟶𝑢[𝑡1,𝑡2]:𝐶[(𝑡1,𝑡2)⊗]
R-Prodrec-β
Natural-number recursion reduces only its scrutinee:
Type reduction is term reduction at 𝖴, and ⟶∗ is the reflexive, transitive closure. These clauses are the entire call-by-name weak-head relation: there is no reduction under a lambda, pair component, or recursion branch.
For beta reduction, U-App gives the required substitution arithmetic: if 𝛾,𝑝▸𝑡 and 𝛿▸𝑢, then 𝛾+𝑝𝛿▸𝑡[𝑢/𝑥]. A rule that used 𝛾+𝛿 would be unsound at 𝑝=2, since two occurrences of the bound variable become two copies of every free occurrence of 𝑢.
Let Ψ be a matrix of grades and 𝜎 a simultaneous substitution. If every row 𝑒𝑖Ψ resources 𝜎(𝑖), then 𝛾▸𝑡⟹𝛾Ψ▸𝑡[𝜎]. Consequently, if 𝛾▸𝑡 and Γ⊢𝑡⟶𝑢:𝐴, then 𝛾▸𝑢.
Proof of Theorem 101.6 — Usage substitution and preservation
Proof. Matrix multiplication satisfies 0Ψ=0,𝑒𝑖Ψ=𝗋𝗈𝗐𝑖(Ψ),(𝛾+𝛿)Ψ=𝛾Ψ+𝛿Ψ,(𝑝𝛾)Ψ=𝑝(𝛾Ψ). Here the middle identity says that the 𝑖-th unit row selects row 𝑖 of Ψ. If Ψ+ is the matrix of the lifted substitution, then (𝛾,𝑝)Ψ+=(𝛾Ψ,𝑝),(𝛾,𝑝,𝑟)Ψ++=(𝛾Ψ,𝑝,𝑟).(101.1) Induct on the displayed usage derivation.
Leaves and subsumption. For U-Universe, U-N, U-Empty, and U-Zero, use 0Ψ=0. The U-Var goal is exactly the row premise 𝑒𝑖Ψ▸𝜎(𝑖). In U-Sub, monotonicity of matrix multiplication sends 𝛿≤𝛾 to 𝛿Ψ≤𝛾Ψ, after which U-Sub applies to the induction hypothesis.
Formation and binders. For U-Π, the induction hypotheses, with the lifted substitution in the codomain, give 𝛾Ψ▸𝐴[𝜎] and 𝛿Ψ,𝑞▸𝐵[𝜎+]. Rule U-Π gives 𝑝(𝛾Ψ)+𝛿Ψ=(𝑝𝛾+𝛿)Ψ▸Π𝑞𝑝𝐴[𝜎]𝐵[𝜎+]. For U-Σ, replace the left side by 𝛾Ψ+𝛿Ψ=(𝛾+𝛿)Ψ. For U-Lam, equation 101.1 turns the body induction hypothesis into 𝛾Ψ,𝑝▸𝑡[𝜎+], and U-Lam removes the last component.
Binary constructors. The application hypotheses rebuild U-App at 𝛾Ψ+𝑝(𝛿Ψ)=(𝛾+𝑝𝛿)Ψ. The weak-pair calculation is 𝛾Ψ+𝛿Ψ=(𝛾+𝛿)Ψ. For a strong pair, U-StrongPair first gives 𝛾Ψ∧𝛿Ψ. Monotonicity gives (𝛾∧𝛿)Ψ≤𝛾Ψ,(𝛾∧𝛿)Ψ≤𝛿Ψ, so the defining property of meet and U-Sub give the required context (𝛾∧𝛿)Ψ. The U-Fst, U-Snd, and U-Suc cases apply their displayed unary rule to the induction hypothesis.
Eliminators. For U-Prodrec, the three induction hypotheses and equation 101.1 have contexts 𝛾Ψ, 𝛿Ψ,𝑟,𝑟, and 𝜂Ψ,𝑞. Rebuilding the rule gives 𝑟(𝛾Ψ)+𝛿Ψ=(𝑟𝛾+𝛿)Ψ. The predicate 𝖯𝗋𝗈𝖽𝗋𝖾𝖼(𝑟) is unchanged by substitution. For U-Emptyrec, the term and motive hypotheses rebuild the rule at 𝑝(𝛾Ψ)=(𝑝𝛾)Ψ; the predicate 𝖤𝗆𝗉𝗍𝗒𝗋𝖾𝖼(𝑝) is unchanged.
For U-Natrec, fix a target component 𝑗. Expanding matrix multiplication gives a finite sum over source rows. Apply NR-Right, equation 101.4, to move each matrix entry into the three branch demands, apply NR-Interchange, equation 101.5, to combine the rows, and apply NR-Mono, equation 101.3, to the induction-hypothesis bounds. Componentwise this proves 𝗇𝗋𝑝,𝑟(𝛾𝑧,𝛾𝑠,𝛾𝑛)Ψ≤𝗇𝗋𝑝,𝑟(𝛾𝑧Ψ,𝛾𝑠Ψ,𝛾𝑛Ψ). Rule U-Natrec resources the substituted term at the right side, and U-Sub changes it to the left side. This exhausts the usage card and proves substitution.
For preservation, induct on the rules of definition 101.5; if the last usage rule is U-Sub, first apply the induction argument above it and then reapply its inequality.
Application and strong sums. For R-App, the reduction induction hypothesis replaces the function premise of U-App; the argument premise and the context 𝛾+𝑝𝛿 do not change. Rule R-𝛽 is the single-substitution instance 𝛾,𝑝▸𝑡,𝛿▸𝑢⟹𝛾+𝑝𝛿▸𝑡[𝑢]. For R-Fst and R-Snd, apply the reduction induction hypothesis to the scrutinee and rebuild U-Fst or U-Snd. In the two projection beta cases, inversion of U-StrongPair gives 𝛾▸𝑡 and 𝛿▸𝑢, while the redex has context 𝛾∧𝛿. The inequalities 𝛾∧𝛿≤𝛾 and 𝛾∧𝛿≤𝛿, followed by U-Sub, resource the selected component.
Weak sums. Rule R-Prodrec applies the reduction induction hypothesis to its scrutinee and rebuilds U-Prodrec. For R-Prodrec-𝛽, invert the weak-pair premise to obtain 𝛾1▸𝑡1 and 𝛾2▸𝑡2, and invert the branch premise to obtain 𝛿,𝑟,𝑟▸𝑢. Two applications of usage substitution give 𝛿+𝑟𝛾1+𝑟𝛾2▸𝑢[𝑡1,𝑡2]. Distributivity and commutativity identify this context with 𝑟(𝛾1+𝛾2)+𝛿, the demand of the redex.
Naturals and emptiness. For R-Natrec, the reduction induction hypothesis changes 𝛾𝑛▸𝑛 to 𝛾𝑛▸𝑛′; rebuilding U-Natrec leaves its computed demand unchanged. In R-Nat-Zero, inversion of the zero usage gives 𝛾𝑛≤0. Hence NR-Base gives 𝗇𝗋𝑝,𝑟(𝛾𝑧,𝛾𝑠,𝛾𝑛)≤𝛾𝑧, and U-Sub changes the base-premise derivation 𝛾𝑧▸𝑧 to the redex context. In R-Nat-Suc, inversion gives 𝛾𝑛▸𝑛. Substituting the scrutinee and the recursive call into 𝛾𝑠,𝑝,𝑟▸𝑠 resources the reduct at 𝛾𝑠+𝑝𝛾𝑛+𝑟𝗇𝗋𝑝,𝑟(𝛾𝑧,𝛾𝑠,𝛾𝑛). Rule NR-Step, equation 101.2, places the redex demand below this context, and U-Sub finishes the case. Finally, R-Emptyrec applies the reduction induction hypothesis to the absurd scrutinee and rebuilds U-Emptyrec. For R-Conv, inversion exposes a premise Γ⊢𝑡⟶𝑢:𝐴 and an equality Γ⊢𝐴=𝐵. The reduction induction hypothesis applied to that premise gives 𝛾▸𝑢; usage has no type index, so this is exactly the required conclusion at 𝐵. These are all rules of definition 101.5, and preservation follows. ◻
★★☆ Let 𝑡=𝑥2𝑦, let 𝛾=(1,2), and substitute a term with demand 𝛿=(3,1) for 𝑦. Write the substitution matrix and compute 𝛾Ψ. Repeat with scalar one and identify the component that would under-count the grade-two substitution.
The weak-head reduction of definition 101.5 is typed and call-by-name. A reducibility relation for that exact syntax proves normalization independently of usage. The proof chain is fundamental reducibility, weak-head uniqueness, conversion soundness, conversion completeness, equality decision, and typing decision. Every result below is stated at the signature of definition 101.2, definition 101.3, definition 101.5; later extensions of the calculus supply no premise.
Proof of Theorem 101.7 — Normalization and conversion
Proof. Clause 1 imports the fundamental reducibility results identified in the source’s Section 4.4, printed p. 15. At the displayed signature their type and term consequences are Γ⊢𝐴⟹∃𝑙.Γ⊩𝑙𝐴 and, for every derivation Γ⊢𝑡:𝐴, reducibility of 𝑡 at the same candidate. The term component of reducibility supplies a weak-head reduct. Clause 2 is source Theorems 4.1 and 4.2, printed p. 15. The first says that a weak-head normal form admits no nonidentity typed weak-head reduction; the second identifies the endpoints of two typed weak-head reductions from one term.
For clause 3, the source proves soundness of algorithmic conversion by induction on the algorithmic derivation and completeness by mutual induction on declarative type and term equality. Decidability follows by running that conversion procedure on typed inputs; the checking result is restricted to the checkable expressions stated in Section 4.4. All three clauses therefore have exactly the syntax of definition 101.1; no consequence is claimed for identity types, first-class levels, top-level definitions, opacity, or weak units [ADE26]. ◻
Usage preservation is absent from the proof of normalization. Conversely, theorem 101.6 does not exclude an infinite sequence: it says that every reduct still satisfies one grade judgment. The two theorems answer different questions.
Erasure into an untyped target
Fix a grade zero satisfying positivity of addition and meet, and 0≰1. Let 𝜔 range over grades distinct from zero. The target grammar is 𝑣,𝑤::=𝑥𝑖∣𝜆𝑣∣𝑣𝑤∣(𝑣,𝑤)∣𝖿𝗌𝗍𝑣∣𝗌𝗇𝖽𝑣∣𝗉𝗋𝗈𝖽𝗋𝖾𝖼(𝑣;𝑤)∣𝗓𝖾𝗋𝗈∣𝗌𝗎𝖼𝑣∣𝗇𝖺𝗍𝗋𝖾𝖼(𝑣;𝑤;𝑣′). It is an untyped call-by-name calculus. The closed term ↺:=(𝜆(𝑥0𝑥0))(𝜆(𝑥0𝑥0)) loops and represents erased source syntax that cannot be observed by a sound extracted program.
Write 𝑡∙ for the non-strict extraction. The following clauses cover every constructor of definition 101.1: 𝖴∙=↺,𝖭∙=↺,⊥∙=↺,(Π𝑞𝑝𝐴𝐵)∙=↺,(Σ𝑞𝑘𝐴𝐵)∙=↺,𝑥∙𝑖=𝑥𝑖,(𝜆𝜔𝑡)∙=𝜆𝑡∙,(𝑡𝜔𝑢)∙=𝑡∙𝑢∙,(𝜆0𝑡)∙=𝑡∙[↺/𝑥],(𝑡0𝑢)∙=𝑡∙,((𝑡,𝑢)𝑘)∙=(𝑡∙,𝑢∙),(𝖿𝗌𝗍𝑡)∙=𝖿𝗌𝗍𝑡∙,(𝗌𝗇𝖽𝑡)∙=𝗌𝗇𝖽𝑡∙,(𝗉𝗋𝗈𝖽𝗋𝖾𝖼𝑞𝜔(𝐴;𝑡;𝑢))∙=𝗉𝗋𝗈𝖽𝗋𝖾𝖼(𝑡∙;𝑢∙),(𝗉𝗋𝗈𝖽𝗋𝖾𝖼𝑞0(𝐴;𝑡;𝑢))∙=𝑢∙[↺,↺],𝗓𝖾𝗋𝗈∙=𝗓𝖾𝗋𝗈,(𝗌𝗎𝖼𝑡)∙=𝗌𝗎𝖼(𝑡∙),(𝗇𝖺𝗍𝗋𝖾𝖼𝑞𝑝,𝑟(𝐴;𝑧;𝑠;𝑛))∙=𝗇𝖺𝗍𝗋𝖾𝖼(𝑧∙;𝑠∙;𝑛∙),(𝖾𝗆𝗉𝗍𝗒𝗋𝖾𝖼𝑝(𝐴;𝑡))∙=↺. Here 𝑘∈{&,⊗}, and the two-term substitution in erased 𝗉𝗋𝗈𝖽𝗋𝖾𝖼 replaces its component binders in de Bruijn order. The side condition 𝖯𝗋𝗈𝖽𝗋𝖾𝖼(0) belongs to usage validation; it does not make extraction partial.
The one-step target relation is generated by the following complete non-strict rule family:
𝑣⟶𝑣′
𝑣𝑤⟶𝑣′𝑤
E-App
(𝜆𝑣)𝑤⟶𝑣[𝑤]
E-β
𝑣⟶𝑣′
𝖿𝗌𝗍𝑣⟶𝖿𝗌𝗍𝑣′
E-Fst
𝖿𝗌𝗍(𝑣,𝑤)⟶𝑣
E-Fst-β
𝑣⟶𝑣′
𝗌𝗇𝖽𝑣⟶𝗌𝗇𝖽𝑣′
E-Snd
𝗌𝗇𝖽(𝑣,𝑤)⟶𝑤
E-Snd-β
𝑣⟶𝑣′
𝗉𝗋𝗈𝖽𝗋𝖾𝖼(𝑣;𝑤)⟶𝗉𝗋𝗈𝖽𝗋𝖾𝖼(𝑣′;𝑤)
E-Prodrec
𝗉𝗋𝗈𝖽𝗋𝖾𝖼((𝑣,𝑣′);𝑤)⟶𝑤[𝑣,𝑣′]
E-Prodrec-β
𝑣⟶𝑣′
𝗇𝖺𝗍𝗋𝖾𝖼(𝑧;𝑠;𝑣)⟶𝗇𝖺𝗍𝗋𝖾𝖼(𝑧;𝑠;𝑣′)
E-Natrec
𝗇𝖺𝗍𝗋𝖾𝖼(𝑧;𝑠;𝗓𝖾𝗋𝗈)⟶𝑧
E-Nat-Zero
𝗇𝖺𝗍𝗋𝖾𝖼(𝑧;𝑠;𝗌𝗎𝖼𝑣)⟶𝑠[𝑣,𝗇𝖺𝗍𝗋𝖾𝖼(𝑧;𝑠;𝑣)]
E-Nat-Suc
Its reflexive, transitive closure is ⟶∗. For observations at 𝖭, close both source and target reduction under successors: 𝑣⟶𝑣′𝗌𝗎𝖼𝑣⟶𝑠𝗌𝗎𝖼𝑣′andΓ⊢𝑡⟶𝑡′:𝖭Γ⊢𝗌𝗎𝖼𝑡⟶𝑠𝗌𝗎𝖼𝑡′:𝖭, and then take reflexive, transitive closure. The reductions in theorem 101.11 are these successor-closed relations.
Consider 𝑒=(𝜆0𝑥.𝗌𝗎𝖼𝗓𝖾𝗋𝗈)0𝗇𝖺𝗍𝗋𝖾𝖼(𝐴;𝑧;𝑠;𝑛). The source evaluates to 𝗌𝗎𝖼𝗓𝖾𝗋𝗈 without inspecting the argument. Extraction gives 𝑒∙=𝗌𝗎𝖼𝗓𝖾𝗋𝗈. Changing the binder and application annotations to 𝜔 retains the argument and yields (𝜆𝑥.𝗌𝗎𝖼𝗓𝖾𝗋𝗈)𝗇𝖺𝗍𝗋𝖾𝖼(𝑧∙;𝑠∙;𝑛∙). Grade zero controls translation only after the usage judgment has validated the annotations.
Proof. Induct on 𝛾▸𝑡. The variable case would imply 0≤1, contradicting the well-behaved-zero assumption. Positivity of addition handles applications and weak pairs; positivity of meet handles strong pairs. The abstraction case removes the bound component. For a grade-zero application, the argument is absent from the target, while for a nonzero application the induction hypothesis applies to both subterms. The recursion case uses positivity of the 𝗇𝗋 result. These cases cover every extraction clause. ◻
Let Δ be a context. Assume either 𝖯𝗋𝗈𝖽𝗋𝖾𝖼(0) is false or Δ is empty. If 𝖤𝗆𝗉𝗍𝗒𝗋𝖾𝖼(0) is true, also assume that Δ is consistent. If Δ⊢𝑡:𝖭and0▸𝑡, then there is a numeral ――𝑛 such that both the source and target evaluate under successor closure to that numeral: Δ⊢𝑡⟶∗――𝑛:𝖭,𝑡∙⟶∗――𝑛.
Proof of Theorem 101.11 — Operational erasure soundness
Proof. We use two compatibility claims. First, for every simultaneous substitution 𝜎, extraction commutes with substitution on retained variables: (𝑎[𝜎])∙=𝑎∙[𝜎∙].(1) For an erased binder, the corresponding component of 𝜎∙ is ↺. Prove (1) by induction on 𝑎. The variable, binder, application, pair, projection, successor, and recursor clauses follow by the induction hypotheses. In a grade-zero application the argument disappears on both sides. In a grade-zero weak-sum eliminator, lemma 101.10 removes both component variables from the extracted branch, so replacing them by 𝑡∙1,𝑡∙2 or by two copies of ↺ gives the same target term. Empty elimination extracts to ↺ on both sides. These are all clauses of definition 101.8.
Second, suppose Δ⊢𝑎⟶𝑏:𝐴 and the usage derivation for 𝑎 has total grade zero. Under the two hypotheses of the theorem, 𝑎∙⟶∗𝑏∙.(2) Prove (2) by induction on the displayed source-reduction derivation. The R-App, R-Fst, R-Snd, R-Prodrec, and R-Natrec cases apply the induction hypothesis under the matching E-App, E-Fst, E-Snd, E-Prodrec, and E-Natrec context. Rule R-𝛽 becomes E-𝛽 when the application grade is nonzero; at grade zero both endpoints are equal by (1). The two strong-pair projection roots become E-Fst-𝛽 and E-Snd-𝛽. A weak-pair beta root becomes E-Prodrec-𝛽 when its scrutinee is retained, and becomes equality by (1) and lemma 101.10 when its grade is zero. The two natural-number roots become E-Nat-Zero and E-Nat-Suc; equation (1) identifies the substituted step branch in the successor case. R-Conv uses the induction hypothesis unchanged because extraction does not inspect the classifier. An empty eliminator at total grade zero would contain a zero-use proof of ⊥. If 𝖤𝗆𝗉𝗍𝗒𝗋𝖾𝖼(0) is available, consistency of Δ excludes that derivation; if it is not available, the term is not admitted. Thus no empty-elimination root remains. This exhausts definition 101.5 and proves (2).
By clause 1 of theorem 101.7, the well-typed natural-number term 𝑡 has a weak-head normal form. Canonicity for the natural-number rules in definition 101.2 identifies that form as a numeral ――𝑛: a variable head is excluded by the zero-use derivation, a neutral eliminator would contradict normalization together with the closed-match and consistency hypotheses, and the remaining canonical forms are 𝗓𝖾𝗋𝗈 and successors. Hence Δ⊢𝑡⟶∗――𝑛:𝖭. Repeated application of (2), using theorem 101.6 at each source step, gives 𝑡∙⟶∗――𝑛∙. Extraction fixes numerals, so ――𝑛∙=――𝑛, which proves both conclusions. ◻
If erased weak-pair matches are admitted in an open context, the term 𝗉𝗋𝗈𝖽𝗋𝖾𝖼00(𝖭;𝑥0;𝗓𝖾𝗋𝗈) is closed under extraction but stuck in the source. It is the boundary counterexample to dropping the first hypothesis. Consistency is needed when an empty eliminator may erase an open contradiction. Neither condition is ornamental.
★★☆ Type the open weak-pair match just displayed and calculate its extraction. Show that the source has no weak-head step while the target is 𝗓𝖾𝗋𝗈. Identify the exact hypothesis of theorem 101.11 that rejects the example.
A distinct recursion calculus replaces the use of 𝗇𝗋𝑝,𝑟 by a greatest lower bound of the finite unfolding demands 𝗇𝗋0(𝑟;𝑞𝑧,𝑞𝑠)=𝑞𝑧,𝗇𝗋𝑘+1(𝑟;𝑞𝑧,𝑞𝑠)=𝑞𝑠+𝑟𝗇𝗋𝑘(𝑟;𝑞𝑧,𝑞𝑠). Its recursion rule requires ⋀𝑘𝗇𝗋𝑘(𝑟;𝑞𝑧,𝑞𝑠) and the corresponding bound for scrutinee use. The grade structure must have well-behaved greatest lower bounds. This is a rule replacement, not a lemma about definition 101.1.
The machine has to be written down, because the theorem below quantifies over its states and its stuck configurations.
𝐻 is a heap, a finite list of entries 𝑦↦𝑝(𝑢,𝜌′) pairing a closure with the grade 𝑝 of available copies of it;
𝑡 is the term in head position and 𝜌 its environment, a finite map from the free variables of 𝑡 to heap pointers;
𝑆 is a stack of continuations.
Every continuation 𝑒 has a multiplicity|𝑒|, and a stack’s multiplicity is the product of its entries: |𝜖|:=1,|𝑒.𝑆|:=|𝑒|⋅|𝑆|. Application, projection, and successor continuations have multiplicity 1; the two pattern-matching continuations 𝗉𝗋𝗈𝖽𝗋𝖾𝖼𝑝𝑟 and 𝖾𝗆𝗉𝗍𝗒𝗋𝖾𝖼𝑝𝑟 have multiplicity 𝑟, the grade at which they consume their scrutinee.
Two transitions matter here. Looking up a variable consumes |𝑆| copies of its entry, ⟨𝐻;𝑥;𝜌;𝑆⟩⟶⟨𝐻′;𝑢;𝜌′;𝑆⟩when𝐻⊢𝜌(𝑥)↦|𝑆|(𝑢,𝜌′);𝐻′, where 𝐻′ is 𝐻 with |𝑆| copies subtracted from that entry, and the transition does not apply when fewer than |𝑆| copies remain. Applying a graded abstraction allocates, ⟨𝐻;𝜆𝑝𝑥.𝑡;𝜌;∙𝑝𝑢[𝜌′].𝑆⟩⟶⟨𝐻.𝑦↦|𝑆|𝑝(𝑢,𝜌′);𝑡;𝜌[𝑥↦𝑦];𝑆⟩, so the new entry is created with exactly the number of copies the stack can demand.
A state is well-resourced when the grades available in 𝐻 dominate, pointwise, the demand of the head term together with the demand of the stack.
Three things can stop weak head evaluation: a variable lookup finds too few copies, a value meets a continuation that does not match it, or a value meets the empty stack. The theorem rules out the first for well-resourced states and the second by typing, leaving the third as the intended terminal case.
Write 𝛾▸𝑝𝑡 for the usage judgment of definition 101.4 taken at grade 𝑝, so that 𝜖▸1𝑡 says that the closed term 𝑡 is resourced for exactly one use. In the recursion calculus, if 𝜖▸1𝑡 and 𝜖⊢𝑡:𝖭, then machine evaluation of ⟨𝑡⟩ reaches a state ⟨𝐻;――𝑛;𝜌;𝜖⟩ for some numeral ――𝑛, heap 𝐻, and environment 𝜌, and the grade associated with every entry of 𝐻 is bounded by zero. For the linearity semiring, every linear entry allocated during evaluation was looked up exactly once.
Proof of Theorem 101.13 — Resource-correct numeral evaluation
Proof. Write 𝐷(𝐻;𝑡;𝜌;𝑆) for the pointwise demand of the head closure and stack, after 𝜌 replaces the head’s free variables by heap pointers. Thus well-resourcedness is the inequality 𝐷(𝐻;𝑡;𝜌;𝑆)≤grade(𝐻). We prove four claims.
Resource preservation. If a well-resourced state takes one machine step, then its successor is well-resourced. Check the transition forms. A variable lookup consumes |𝑆| copies from both 𝐷 and the selected heap grade; the lookup premise provides the subtraction and hence preserves the inequality. Application, the two projections, weak-sum elimination, empty elimination, and successor move one eliminator from the head to the stack. The definition |𝑒.𝑆|=|𝑒||𝑆| makes the demand before and after each push equal. Applying 𝜆𝑝𝑥.𝑡 removes an application continuation and allocates |𝑆|𝑝 copies of its argument. The body usage premise has bound-variable component 𝑝, so replacing that component by the new pointer changes both sides of the demand inequality by exactly |𝑆|𝑝.
A strong-pair projection pops a multiplicity-one continuation and selects one component. Its demand is bounded by the pair demand because 𝛾∧𝛿≤𝛾 for the first projection and 𝛾∧𝛿≤𝛿 for the second. A weak-pair match pops a multiplicity-𝑟 continuation and extends the environment by two pointers; the branch premise of the usage rule bounds their demand by the two scaled component demands. Empty elimination has no value-pop case. A successor pushes a multiplicity-one continuation until its argument is a numeral and then pops it. Finally, the natural-number recursor uses 𝗇𝗋0(𝑟;𝑞𝑧,𝑞𝑠)=𝑞𝑧 at zero and 𝗇𝗋𝑘+1(𝑟;𝑞𝑧,𝑞𝑠)=𝑞𝑠+𝑟𝗇𝗋𝑘(𝑟;𝑞𝑧,𝑞𝑠) at a successor; these are exactly the resource equations for the base and step transitions. The listed cases are the variable, eliminator-push, value-pop, and successor families of the machine, so resource preservation is proved.
Typing and progress. Machine typing assigns the head its closure type and assigns each stack continuation an input and output type. Induction on a transition preserves that typing. The variable case uses the type stored with the heap closure; lambda application uses value substitution; projection and weak-match pops use inversion of their pair typing rules; the two natural-number pops use the recursor computation types. These are the same transition families as in the resource proof. Consequently, a well-typed state whose stack is nonempty has a matching transition whenever its head is a value. A well-resourced variable head has a lookup transition by the first claim’s inequality. An eliminator head has a push transition. Hence a well-typed, well-resourced state can stop only with a value in head position and the empty stack.
Termination and numeral form. Expand a machine state to the call-by-name term obtained by replacing every heap pointer by its stored closure and plugging the head into its stack. A variable lookup and an eliminator push leave this expansion unchanged. Every value-pop transition is one call-by-name contraction, and the successor transition is one successor-closed natural-number step. Conversely, the outermost contraction of an expanded state is realized by finitely many lookup/push steps followed by its matching pop. The administrative prefix is finite. Order heap entries by allocation time; the environment stored in a fresh entry contains only older pointers. A lookup therefore decreases pointer age along every consecutive lookup chain, including a chain whose stack demand is zero. Between two lookups, each push removes the outer head eliminator. For positive stack demand, the resource invariant gives the additional bound that the number of lookups cannot exceed the allocated grade. Clause 1 of theorem 101.7, applied to the typed expanded initial state, rules out an infinite sequence of pop transitions. Thus full machine evaluation terminates. Its terminal head has type 𝖭; inversion of the typing rules leaves only a numeral ――𝑛.
Final heap. Strengthen the resource invariant used in the first stage by retaining a residual usage context 𝜁 for heap entries. The variable rule replaces the selected component 𝑞+|𝑆| by 𝑞; lambda application appends the component |𝑆|𝑝; push and pop cases only redistribute components. Rule induction on the same transition families therefore preserves the equation “allocated demand = consumed demand plus 𝜁”. Initially the closed usage derivation 𝜖▸1𝑡 has no free component. At ⟨𝐻;――𝑛;𝜌;𝜖⟩, the numeral and empty stack also contribute no free component, so the preserved equation yields 𝜁≤0. The heap-compatibility part of the invariant says that every entry grade is bounded by its component of 𝜁; hence every final heap grade is bounded by zero. In the linearity semiring a freshly allocated linear entry starts with grade one, every successful lookup subtracts one, and zero is the only grade bounded by zero. Each such entry was consequently looked up exactly once. ◻
Suggested first pass.
None of these problems is a prerequisite for a later chapter. Begin with exercise 101.3, then complete exercise 101.5.
★★☆ Reconstruct the application and natural-number successor cases of theorem 101.6. State the matrix equation and the characteristic 𝗇𝗋 inequality on the relation symbols where they are used.
★★★ Compare grade preservation, erasure soundness, and machine resource correctness on the retained-argument example. For each theorem, state its signature, hypotheses, and observable conclusion. Give one pair of theorems for which neither conclusion implies the other.
★★★Practical project.graded-erasure-trace-checker Implement in Kappa a finite grade-zero extraction checker for variables, lambdas, application, naturals, and a guarded weak-pair match. Maintain the invariant that every deleted variable has inferred grade zero. On named inputs and expected outputs 𝚎𝚛𝚊𝚜𝚎𝚍-𝚒𝚗𝚍𝚎𝚡↦𝚜𝚞𝚌𝚣𝚎𝚛𝚘,𝚛𝚎𝚝𝚊𝚒𝚗𝚎𝚍-𝚊𝚛𝚐𝚞𝚖𝚎𝚗𝚝↦𝚊𝚛𝚐𝚞𝚖𝚎𝚗𝚝𝚛𝚎𝚝𝚊𝚒𝚗𝚎𝚍,𝚘𝚙𝚎𝚗-𝚎𝚛𝚊𝚜𝚎𝚍-𝚖𝚊𝚝𝚌𝚑↦𝚛𝚎𝚓𝚎𝚌𝚝𝚎𝚍:𝚎𝚛𝚊𝚜𝚎𝚍𝚖𝚊𝚝𝚌𝚑𝚒𝚗𝚘𝚙𝚎𝚗𝚌𝚘𝚗𝚝𝚎𝚡𝚝. Require also the three boundary observations 𝚍𝚒𝚜𝚑𝚘𝚗𝚎𝚜𝚝-𝚣𝚎𝚛𝚘-𝚐𝚛𝚊𝚍𝚎↦𝚛𝚎𝚓𝚎𝚌𝚝𝚎𝚍𝚋𝚢𝚒𝚗𝚏𝚎𝚛𝚛𝚎𝚍𝚞𝚜𝚎,𝚌𝚕𝚘𝚜𝚎𝚍-𝚎𝚛𝚊𝚜𝚎𝚍-𝚖𝚊𝚝𝚌𝚑↦𝚊𝚌𝚌𝚎𝚙𝚝𝚎𝚍,𝚜𝚑𝚊𝚍𝚘𝚠𝚎𝚍-𝚘𝚞𝚝𝚎𝚛-𝚞𝚜𝚎↦𝚞𝚗𝚞𝚜𝚎𝚍. A mutation that deletes a grade-one argument must fail the retained-argument oracle. Two further well-typed mutations must be rejected: inferring zero use for every variable fails the dishonest-grade oracle, and descending beneath a same-name binder fails the shadowing oracle. Explain why the first mutation violates grade inference while the second violates binder identity. The program checks a finite translation; it does not prove logical-relation soundness or exact heap access counts.
Sources. The syntax, usage theorems, and erasure result are reconstructed from Abel, Danielsson, and Eriksson, especially pp. 12–21, with Theorems 4.1 and 4.2 on printed p. 15 and Theorem 6.9 on printed p. 29 [ADE26]. The normalization and conversion bundle imports Sections 4–5, a ten-page source development; the shorter usage, erasure, and operational arguments are proved locally. The machine of definition 101.12 is Figures 6 and 7 of the separate recursion calculus on its printed p. 279:12, its resource-correctness theorem is that paper’s Theorem 4.9 on printed p. 279:17, and its noninterference instance is Theorem 6.1 [EAD26]. The two calculi have distinct signatures; the recursion results do not strengthen the erasure theorem.