Canonicity, Normalization, and Decidable Conversion
A closed Boolean may be hidden beneath binders, applications, and eliminators; for example 𝑏0:=(𝜆𝑓.𝑓𝖿𝖿)(𝜆𝑥.𝗂𝗇𝖽𝟐(𝑦.𝟐;𝖿𝖿,𝗍𝗍,𝑥)):𝟐 reduces to 𝗍𝗍. Two different questions are hidden in that calculation. Is every closed Boolean judgmentally one of the two constructors? And do open terms—the terms a kernel actually compares—have computable canonical representatives?
A predicate tested only at closed instantiations can classify 𝑏0, but it contains no datum for an open variable of function type. A kernel comparison therefore needs a context-indexed predicate stable under substitution into a larger context. Stability under weakening alone is insufficient: a dependent function must accept arguments containing variables introduced in the larger context. The normalization proof below is forced by that obstruction. Its logical relation records an action by finite semantic substitutions, and readback turns the resulting semantic evidence into the canonical representatives needed by conversion.
The canonicity theorem
Canonicity asserts that closed terms compute; the proved instance here says that every closed boolean of 𝑇Π𝟐 is judgmentally a constructor.
The canonical forms of closed Boolean type are the constructor terms 𝗍𝗍 and 𝖿𝖿. Recall from definition 1.36 that the numerals are the closed terms 𝗌𝗎𝖼𝑚(𝟢) for 𝑚 a meta-level natural number, where 𝗌𝗎𝖼0(𝟢):=𝟢 and 𝗌𝗎𝖼𝑚+1(𝟢):=𝗌𝗎𝖼(𝗌𝗎𝖼𝑚(𝟢)).
The set-valued computability proof in this section is carried out in ZFC. Its syntax, derivations, and every indexed family below are sets; Replacement and Power Set form the required products. Because 𝑇Π𝟐 has no object-language universes, no Grothendieck universe or inaccessible cardinal is used. The open normalization theorem for 𝑇𝗂𝗆𝗉𝗅 is proved locally later in this chapter, in ZFC; no published normalization theorem is used in that proof. The separate source-signature construction is comparative and remains confined to its cumulative signature 𝑇𝖢𝗈𝗊.
A logical-relations proof needs an ambient theory able to form the relation and justify its recursion. When a recursively axiomatized object theory is strong enough for Gödel’s second incompleteness theorem, a normalization proof yielding its consistency cannot in general be internalized in that same theory. This structural warning does not impose a large cardinal on the weak fragment here; it explains why the ambient theory must nevertheless be named.
Proof. Use the two-point set model of exactly the named calculus 𝑇Π𝟐. Interpret a context as the set of its environments, Π as dependent function space, and 𝟐 as {0,1}, with its eliminator defined by the two cases. Induction on a derivation shows that every structural, Π-, and Boolean rule preserves this interpretation: the two computation cases are the defining equations of application and case analysis, and congruence and conversion use equality of functions and elements. Thus a derivation of ⋅⊢𝗍𝗍≡𝖿𝖿:𝟐 would imply 0=1, which is false. ◻
A syntactically shorter proof, though not a model-free one, is available in the larger base signature: if ⋅⊢𝗍𝗍≡𝖿𝖿:𝟐, then by congruence ⋅⊢𝖨𝖽𝟐(𝗍𝗍,𝗍𝗍)≡𝖨𝖽𝟐(𝗍𝗍,𝖿𝖿)𝗍𝗒𝗉𝖾, so the conversion rule turns 𝗋𝖾𝖿𝗅 into a closed term of 𝖨𝖽𝟐(𝗍𝗍,𝖿𝖿); applying the map of example 30.12 yields a closed term of 𝟎. Under the set-theoretic assumptions of convention 48.28, this contradicts corollary 90.7. That theorem is itself proved by a set model; the alternative is shorter in object-language syntax, not independent of semantics.
Target B (Boolean canonicity). Let ⋅⊢𝑏:𝟐 in the fragment with the structural rules, Π, and 𝟐, denoted 𝑇Π𝟐. Then at least one of ⋅⊢𝑏≡𝗍𝗍:𝟐 and ⋅⊢𝑏≡𝖿𝖿:𝟐 holds; with proposition 49.3 that makes it exactly one. The numbered form and its proof are theorem 49.2.
Canonicity is stated per type. For a fragment containing ℕ, its natural-number instance is the assertion ⋅⊢𝑛:ℕ⟹⋅⊢𝑛≡𝗌𝗎𝖼𝑚(𝟢):ℕforaunique𝑚. The Boolean theorem of this section does not establish that assertion: the computability predicate and fundamental lemma must first be extended with the ℕ rules. Likewise, canonicity at 𝟎 would imply consistency, while identity-type canonicity would identify every closed 𝑝:𝖨𝖽𝐴(𝑎,𝑏) with reflexivity and hence give 𝑎≡𝑏:𝐴. None of these larger-signature consequences is used in this chapter.
Canonicity concerns the empty context only. In context 𝑥:𝟐, the variable 𝑥 is judgmentally equal to neither constructor. If 𝑥≡𝗍𝗍, substitution of 𝖿𝖿 for 𝑥 would give 𝖿𝖿≡𝗍𝗍, contradicting proposition 49.3; substitution of 𝗍𝗍 refutes 𝑥≡𝖿𝖿 in the same way. Variables manufacture non-canonical terms at every type. Closed 𝑇Π𝟐 terms reduce to canonical form; open terms may remain neutral.
★☆☆ Work in the base signature through chapter 30, and assume identity-type canonicity and Boolean separation for that signature. From ⋅⊢𝑣:𝟎 use 𝟎-elimination to construct a closed term of 𝖨𝖽𝟐(𝗍𝗍,𝖿𝖿) and derive a contradiction. State why this proves consistency of the named base, and why Boolean canonicity alone does not supply the identity-type conclusion.
We now prove Target B by a proof-relevant computability construction. Its evidence-carrying predicates are the elementary form of the gluing model used later for universes.
In this section 𝑇Π𝟐 denotes the fragment of the base theory with: the structural rules (definition 26.22); ∏𝑥:𝐴𝐵 with 𝛽 and 𝜂 (definition 27.2); and 𝟐 with its dependent eliminator 𝗂𝗇𝖽𝟐(𝑥.𝐶;𝑐0,𝑐1,𝑏) and its two computation rules (definition 28.7). There are no universes; the extension to the full base theory is discussed in remark 49.13, remark 49.10. Premises of rules are compressed per convention 26.14.
The normal forms used below are 𝜂-long: a neutral function is reified as a lambda that applies the neutral to a fresh reflected variable. Kernel implementations may use weak-head reduction internally, but no oriented reduction relation is needed in the Tait proof or in the normalization theorem stated here. In particular, Π-𝜂 is used as expansion during readback, not as a proposed left-to-right rewriting step.
We write 𝖶𝖳𝗆(⋅,𝐴) for the set of well-typed raw terms 𝑎 with ⋅⊢𝑎:𝐴; the symbol Tm is reserved for a term-family component when working with categories with families. For a meta-level statement 𝑃, the subsingleton {𝑘∣𝑃} denotes {𝑥∈{𝑘}∣𝑃}: it contains 𝑘 if 𝑃 holds and is empty otherwise.
A direct induction on Γ⊢𝑡:𝐴 that asks only whether the closed instance 𝑡[𝛾] computes fails at application. The induction hypothesis for 𝑓:∏𝑥:𝐴𝐵 must be usable at every closed 𝑎:𝐴[𝛾], and its result must land in the changing fiber 𝐵[𝛾,𝑎/𝑥]; a Boolean-valued predicate on 𝑓 contains neither the argument evidence nor that fiber. This failed attempt forces the proof-relevant, type-indexed assignment below.
Work under convention 111.2. Fix a default set ⊥∙ returned by a term clause whose stated domain condition fails; a malformed type clause returns the constantly empty family. The fundamental lemma proves that neither fallback is reached on well-typed inputs. A computability assignment attaches to each raw expression both its closed instance and evidence indexed by its type. To every raw expression 𝑡 of 𝑇Π𝟐 with free variables among Γ=(𝑥1:𝐴1,…,𝑥𝑛:𝐴𝑛) assign, by structural recursion on 𝑡, an operation 𝑡∙ on a computable closing instantiation(𝛾,𝛾∙). Here 𝛾=(𝑎1,…,𝑎𝑛) is a list of closed terms and 𝛾∙=(𝑎∙1,…,𝑎∙𝑛) is its evidence list. We write 𝑡[𝛾] for simultaneous substitution.
For a raw domain annotation 𝐴, put D𝐴(𝛾,𝛾∙):=∑𝑎∈𝖶𝖳𝗆(⋅,𝐴[𝛾])𝐴∙(𝛾,𝛾∙)(𝑎). This is a set. For the clauses below, abbreviate 𝖺𝖻𝗌:=𝜆(𝑥:𝐴).𝑏,𝐸:=𝗂𝗇𝖽𝟐(𝑥.𝐶;𝑐0,𝑐1,𝑏),𝗍𝖾𝗌𝗍:=𝑏∙(𝛾,𝛾∙). The term clauses are: 𝑥∙𝑖(𝛾,𝛾∙):=𝑎∙𝑖𝗍𝗍∙(𝛾,𝛾∙):=1,𝖿𝖿∙(𝛾,𝛾∙):=0,𝖺𝖻𝗌∙(𝛾,𝛾∙):=[(𝑎,𝑎∙)∈D𝐴(𝛾,𝛾∙)↦𝑏∙((𝛾,𝑎),(𝛾∙,𝑎∙))](𝑓𝑎)∙(𝛾,𝛾∙):=𝑓∙(𝛾,𝛾∙)(𝑎[𝛾],𝑎∙(𝛾,𝛾∙))𝐸∙(𝛾,𝛾∙):={𝑐∙0(𝛾,𝛾∙)if𝗍𝖾𝗌𝗍=1,𝑐∙1(𝛾,𝛾∙)if𝗍𝖾𝗌𝗍=0. The application clause is used only when the displayed pair lies in the domain of 𝑓∙(𝛾,𝛾∙); application returns ⊥∙ otherwise. The clauses for type expressions produce families of sets, indexed by closed terms: 𝟐∙(𝛾,𝛾∙):=𝑏↦{1∣⋅⊢𝑏≡𝗍𝗍:𝟐}∪{0∣⋅⊢𝑏≡𝖿𝖿:𝟐}(∏𝑥:𝐴𝐵)∙(𝛾,𝛾∙):=𝑓↦∏𝑎∈𝖶𝖳𝗆(⋅,𝐴[𝛾])∏𝑎∙∈𝐴∙(𝛾,𝛾∙)(𝑎)𝐵∙((𝛾,𝑎),(𝛾∙,𝑎∙))(𝑓𝑎) Finally, the sets of computable closing instantiations for contexts: ⋅∙:={((),())}(Γ,𝑥:𝐴)∙:={((𝛾,𝑎),(𝛾∙,𝑎∙))∣(𝛾,𝛾∙)∈Γ∙,𝑎∈𝖶𝖳𝗆(⋅,𝐴[𝛾]),𝑎∙∈𝐴∙(𝛾,𝛾∙)(𝑎)} The membership test in the context clause is total even before the fundamental lemma: when 𝐴∙(𝛾,𝛾∙) is not a family, the fallback convention makes the test false. The abstraction clause is a set function on the displayed set D𝐴, rather than an unrestricted proper-class operation. The fundamental lemma subsequently proves that this fallback is never reached by a computable closing instantiation.
For 𝑒:=(𝜆𝑥.𝑥)𝗍𝗍 in the empty context, the semantic calculation is 𝑒∙((),())𝑎𝑝𝑝𝑙𝑖𝑐𝑎𝑡𝑖𝑜𝑛=(𝜆𝑥.𝑥)∙((),())(𝗍𝗍,1)𝑎𝑏𝑠𝑡𝑟𝑎𝑐𝑡𝑖𝑜𝑛=𝑥∙((𝗍𝗍),(1))𝑣𝑎𝑟𝑖𝑎𝑏𝑙𝑒=1. The resulting witness lies in 𝟐∙((),())(𝑒) because 𝑒≡𝗍𝗍. Thus application consumes both the closed argument and its computability evidence, exactly as required by the failed direct induction.
Evidence is a structure, not a property: 𝟐∙(𝑏) is a set that could a priori contain both 0 and 1. Nothing in definition 49.9 presumes that the two disjuncts exclude each other — that is proposition 49.3, proved by a model, not by the recursion. Proof-relevance is idle in 𝑇Π𝟐 but indispensable for universes: a computability predicate for ⋅⊢𝑐:U0 must be defined by recursion on evidence that 𝑐 is convertible to a type constructor, and if 𝑐 were convertible both to 𝟐 and to some ∏𝑥:𝐴𝐵 the recursion would be ambiguous. Taking evidence as data — the evidence for 𝑐contains the computability family for 𝖤𝗅𝗍(𝑐) — dissolves the ambiguity.
Proof of Lemma 49.11 — Weakening and substitution for (-)^
Proof. Proceed simultaneously by structural induction on 𝑡. For a variable 𝑦, clause (1) is lookup in the unchanged part of the instantiation. For clause (2), the case 𝑦=𝑥 reads 𝑎∙(𝛾,𝛾∙)=𝑎∙(𝛾,𝛾∙); the case 𝑦≠𝑥 is again unchanged lookup. For either Boolean constant, both clauses reduce to reflexivity.
For application, the induction hypotheses give 𝑓∙1=𝑓∙2 and 𝑎∙1=𝑎∙2; congruence of meta-level application gives 𝑓∙1(𝑎∙1)=𝑓∙2(𝑎∙2). For 𝜆𝑦.𝑏, alpha-rename 𝑦 away from 𝑥, 𝑎, and 𝛾. The induction hypothesis for the stored domain annotation identifies the two sets D𝐴; apply the body induction hypothesis after extending both instantiations by an arbitrary pair (𝑐,𝑐∙); extensionality of meta-level functions gives the displayed equality of semantic abstractions. For the Π-type clause, apply the body induction hypothesis after adjoining an arbitrary pair (𝑐,𝑐∙), then use extensionality at every factor of the dependent product.
For Boolean elimination, the scrutinee induction hypothesis gives equal values 𝑟∙1=𝑟∙2∈{0,1}, so both eliminators select the same branch. If that value is 1, the true-branch induction hypothesis equates the returned evidence; if it is 0, the false-branch induction hypothesis does. The motive induction hypothesis equates the selected fibers. ◻
Proof of Lemma 49.12 — Fundamental lemma of computability
Proof. Induct simultaneously on the four judgment forms in clauses (a)–(d): type formation yields an equality-invariant computability family, type equality equates such families, typing yields evidence, and term equality equates evidence. Begin with dependent-product formation.
(a), Π-formation. By induction hypothesis (a) for 𝐴 and, for each (𝑎,𝑎∙), for 𝐵 at the extended instantiation, each displayed product is a set by Replacement and Power Set in convention 111.2. For invariance, suppose ⋅⊢𝑓≡𝑔:∏𝑥:𝐴[𝛾]𝐵[𝛾]. For each admissible (𝑎,𝑎∙), congruence of application gives ⋅⊢𝑓𝑎≡𝑔𝑎:𝐵[𝛾][𝑎/𝑥], so the factors agree by induction hypothesis (a) for 𝐵; hence the products agree. (The 𝟐 case is transitivity.)
(c), variable rule. By definition of Γ∙, 𝑥∙𝑖(𝛾,𝛾∙)=𝑎∙𝑖, which lies in 𝐴∙𝑖(…)(𝑎𝑖); and 𝑥𝑖[𝛾]=𝑎𝑖.
(c), Π-introduction. Let Γ,𝑥:𝐴⊢𝑏:𝐵. We must show that the evidence (𝜆𝑥.𝑏)∙(𝛾,𝛾∙) lies in the product over (𝑎,𝑎∙) of 𝐵∙((𝛾,𝑎),(𝛾∙,𝑎∙))((𝜆𝑥.𝑏[𝛾])𝑎). Fix (𝑎,𝑎∙). By induction hypothesis (c) for 𝑏, 𝑏∙((𝛾,𝑎),(𝛾∙,𝑎∙))∈𝐵∙((𝛾,𝑎),(𝛾∙,𝑎∙))(𝑏[𝛾][𝑎/𝑥]). The 𝛽-rule gives ⋅⊢(𝜆𝑥.𝑏[𝛾])𝑎≡𝑏[𝛾][𝑎/𝑥]:𝐵[𝛾][𝑎/𝑥], so by invariance (a) for 𝐵 the two fibers coincide, and the clause for (𝜆𝑥.𝑏)∙ produces exactly the required dependent function.
(c), Π-elimination. Let Γ⊢𝑓:∏𝑥:𝐴𝐵 and Γ⊢𝑎:𝐴. By induction hypotheses (c), 𝑓∙(𝛾,𝛾∙) is a dependent function as above and 𝑎∙(𝛾,𝛾∙)∈𝐴∙(𝛾,𝛾∙)(𝑎[𝛾]); instantiating at (𝑎[𝛾],𝑎∙(𝛾,𝛾∙)) gives an element of 𝐵∙((𝛾,𝑎[𝛾]),(𝛾∙,𝑎∙(𝛾,𝛾∙)))(𝑓[𝛾]𝑎[𝛾]), which by lemma 49.11(2) is the required set (𝐵[𝑎/𝑥])∙(𝛾,𝛾∙)((𝑓𝑎)[𝛾]).
(c), Boolean elimination. Let 𝑒:=𝗂𝗇𝖽𝟐(𝑥.𝐶;𝑐0,𝑐1,𝑏). The scrutinee induction hypothesis gives 𝑏∙(𝛾,𝛾∙)∈{1∣𝑏[𝛾]≡𝗍𝗍}∪{0∣𝑏[𝛾]≡𝖿𝖿}. Hence its value is either 1 or 0. In the first case, membership and 0≠1 give a derivation 𝑞:⋅⊢𝑏[𝛾]≡𝗍𝗍:𝟐. The branch induction hypothesis gives evidence for 𝑐0[𝛾] in the fiber of (𝐶[𝗍𝗍/𝑥])∙. Substitution congruence along 𝑞, followed by the 𝟐 computation rule, gives ⋅⊢𝐶[𝑏/𝑥][𝛾]≡𝐶[𝗍𝗍/𝑥][𝛾]𝗍𝗒𝗉𝖾,⋅⊢𝑒[𝛾]≡𝑐0[𝛾]:𝐶[𝑏/𝑥][𝛾]. Clauses (a)–(b) and lemma 49.11(2) therefore move the branch evidence to the required fiber (𝐶[𝑏/𝑥])∙(𝛾,𝛾∙)(𝑒[𝛾]); the semantic eliminator clause returns exactly that evidence because the scrutinee value is 1. If the value is 0, use 𝑏[𝛾]≡𝖿𝖿, the 𝑐1 induction hypothesis, and the false computation rule. This proves the dependent eliminator typing case rather than only its two computation equalities.
(d), 𝛽. With notation as in the introduction case, ((𝜆𝑥.𝑏)𝑎)∙(𝛾,𝛾∙)𝑎𝑝𝑝𝑙𝑖𝑐𝑎𝑡𝑖𝑜𝑛𝑎𝑛𝑑𝑎𝑏𝑠𝑡𝑟𝑎𝑐𝑡𝑖𝑜𝑛=𝑏∙((𝛾,𝑎[𝛾]),(𝛾∙,𝑎∙(𝛾,𝛾∙)))𝑙𝑒𝑚𝑚𝑎49.11(2)=(𝑏[𝑎/𝑥])∙(𝛾,𝛾∙).
(d), 𝟐-computation.𝗍𝗍∙(𝛾,𝛾∙)=1, so the eliminator clause selects 𝑐∙0(𝛾,𝛾∙), which is 𝗂𝗇𝖽𝟐(𝑥.𝐶;𝑐0,𝑐1,𝗍𝗍)∙(𝛾,𝛾∙) by definition; membership in the correct fiber uses invariance (a) for 𝐶 as in the introduction case. For 𝖿𝖿, the evidence value is 0, so the eliminator clause selects 𝑐∙1(𝛾,𝛾∙). Invariance (a) for 𝐶 identifies its fiber with the one selected by substituting 𝖿𝖿 for 𝑥, which gives the required membership for 𝟐-comp2.
(d), 𝜂. Let Γ⊢𝑓:∏𝑥:𝐴𝐵 with 𝑥 not free in 𝑓. For each (𝑎,𝑎∙), (𝜆𝑥.𝑓𝑥)∙(𝛾,𝛾∙)(𝑎,𝑎∙)𝑎𝑏𝑠𝑡𝑟𝑎𝑐𝑡𝑖𝑜𝑛,𝑎𝑝𝑝𝑙𝑖𝑐𝑎𝑡𝑖𝑜𝑛,𝑣𝑎𝑟𝑖𝑎𝑏𝑙𝑒=(𝑓𝑥)∙((𝛾,𝑎),(𝛾∙,𝑎∙))𝑙𝑒𝑚𝑚𝑎49.11(1)=𝑓∙(𝛾,𝛾∙)(𝑎,𝑎∙). The two dependent functions agree pointwise, hence are equal.
(d), congruences and equivalence rules; (c), conversion rule. Congruences combine induction hypotheses (d) pointwise; symmetry and transitivity are those of meta-level equality; the conversion rule combines (c) with (b). More explicitly, 𝜆-congruence applies the induction hypothesis for the bodies at every computable (𝑎,𝑎∙); Boolean-eliminator congruence uses the induction hypotheses for the motive, both branches, and the scrutinee, after which both semantic eliminators choose the same branch. For Π-congruence in (b), the domain induction hypothesis gives 𝐴∙(𝛾,𝛾∙)=𝐴′∙(𝛾,𝛾∙), and, for every (𝑎,𝑎∙) in this common index set, the codomain induction hypothesis gives 𝐵∙((𝛾,𝑎),(𝛾∙,𝑎∙))=𝐵′∙((𝛾,𝑎),(𝛾∙,𝑎∙)). Thus the two dependent products are equal. In the structural cases, lemma 49.11(1) is the weakening equation and clause (2) is the substitution equation; exchange permutes the instantiation list and contraction replaces its final two equal coordinates by the diagonal. Together with the explicit Π and 𝟐 cases above, these equations establish clauses (a)–(d) for every last rule of 𝑇Π𝟐. ◻
Proof of Theorem 49.2 — Boolean canonicity for the elementary fragment
Proof. Let ⋅⊢𝑏:𝟐. Instantiate lemma 49.12(c) at the empty instantiation ((),())∈⋅∙: 𝑏∙((),())∈𝟐∙((),())(𝑏)={1∣⋅⊢𝑏≡𝗍𝗍:𝟐}∪{0∣⋅⊢𝑏≡𝖿𝖿:𝟐}. This set is inhabited, so at least one disjunct holds. At most one holds by proposition 49.3 and transitivity. ◻
The elementary assignment illustrates the closed-term half of the general construction. For the non-universe formers of the base theory its first clauses are: 𝟏∙(𝛾,𝛾∙)(𝑢):={0}𝟎∙(𝛾,𝛾∙)(𝑣):=∅ℕ∙(𝛾,𝛾∙)(𝑛):={𝑚∈ℕ∣⋅⊢𝑛≡𝗌𝗎𝖼𝑚(𝟢):ℕ}(∑𝑥:𝐴𝐵)∙(𝛾,𝛾∙)(𝑝) is the set of pairs of evidence for 𝗉𝗋1𝑝 and for 𝗉𝗋2𝑝 at the correspondingly instantiated 𝐵; and 𝖨𝖽𝐴(𝑎,𝑏)∙(𝛾,𝛾∙)(𝑝) is the set of pairs (𝑞,𝑟) in which 𝑞 is a derivation of ⋅⊢𝑎[𝛾]≡𝑏[𝛾]:𝐴[𝛾] and 𝑟 is a derivation of ⋅⊢𝑝≡𝗋𝖾𝖿𝗅𝑎[𝛾]:𝖨𝖽𝐴[𝛾](𝑎[𝛾],𝑏[𝛾]). The endpoint derivation 𝑞 makes the displayed reflexivity proof well typed; the proof derivation 𝑟 then validates the computation rule of 𝖩 (definition 30.1): congruence replaces 𝑝 by 𝗋𝖾𝖿𝗅𝑎[𝛾], after which the 𝖩 computation rule selects the reflexivity branch. Universes require the proof-relevant clause sketched in remark 49.10: evidence for ⋅⊢𝑐:U𝑖 is a pair of a constructor form for 𝑐 and a computability family for its elements. W-evidence must additionally be inductive in the semantic subtrees.
Listing these clauses does not prove their substitution stability, and that is the exact reason the rest of the chapter does not proceed by enlarging (−)∙. Each clause above evaluates a term at a closing instantiation; a term under a binder has none, and the two exercises below are the only consequences that closed instantiations alone can carry. The open construction that replaces (−)∙, and the theorem it proves for the kernel signature, are definition 111.65 and theorem 111.76.
★★☆ Prove lemma 49.11. (Structural induction on 𝑡; the variable clauses are the base cases, and the binder cases use 𝛼-renaming as fixed by definition 26.1.)
★★☆ Reconstruct from lemma 49.12 the 𝜉-rule for 𝜆, congruence for 𝗂𝗇𝖽𝟐, and part (b) for the Π-congruence rule. For each reconstruction, display the exact extended instantiation and the induction hypothesis that identifies the two semantic outputs.
★★☆ Using the ℕ clause of remark 49.13 and clauses for 𝟢, 𝗌𝗎𝖼, 𝗂𝗇𝖽ℕ, prove canonicity at ℕ (remark 49.5). Where does the induction need the evidence 𝑚 rather than mere inhabitation?
★★☆ Assume that the identity-type clause of remark 49.13 satisfies the four conclusions of lemma 49.12. Prove that if ⋅⊢𝑝:𝖨𝖽𝐴(𝑎,𝑏), then ⋅⊢𝑝≡𝗋𝖾𝖿𝗅𝑎:𝖨𝖽𝐴(𝑎,𝑏) and ⋅⊢𝑎≡𝑏:𝐴. Identify the two components of the stored identity evidence; no constructor-injectivity hypothesis is needed. Explain why neither the Tait argument of section 49.2 nor theorem 49.17 supplies the assumed identity clause.
The kernel signature, its reduction, and its normal forms
Canonicity governs closed terms. The kernel of chapter 48 compares open ones: its four inversion operations and its two conversion queries are applied in an arbitrary context, and proposition 110.17 records that nothing there constructs them. Everything below is therefore carried out at the full signature named in convention 110.16, and the first task is to write that signature’s raw syntax, its computation steps, and the shape a canonical representative can have.
Write 𝑇𝗂𝗆𝗉𝗅 for the signature of convention 110.16: the structural rules of definition 26.22; Π with 𝛽 and 𝜂 (definition 27.2) carrying the explicitness bit 𝜖∈{𝖾𝗑𝗉,𝗂𝗆𝗉} and the relevance bit 𝜚∈{𝗋𝗎𝗇𝗍𝗂𝗆𝖾,𝖾𝗋𝖺𝗌𝖾𝖽}; Σ with both projections, both 𝛽-rules and 𝜂 (definition 27.9); 𝟏 with 𝜂 (definition 27.14); 𝟐 (definition 28.7); ℕ (definition 28.21); intensional identity with 𝖩 (definition 30.1); the strict Russell universes of definition 29.1 together with the explicit strict lifts of definition 29.10 and Lift-Id; and the vector family with the eliminator 𝗏𝗂𝗇𝖽 of definition 78.1. Its raw expressions are one sort, because U-El uses a universe element directly as a type: ℓ::=0∣𝑢∣ℓ+1∣max(ℓ,ℓ)𝑎,𝐴::=𝑥∣Uℓ∣𝖫𝗂𝖿𝗍ℓ(𝑎)∣∏𝜖,𝜚𝑥:𝐴𝐵∣𝜆𝜖,𝜚(𝑥:𝐴).𝑏∣𝑎𝜖,𝜚𝑏∣∑𝑥:𝐴𝐵∣(𝑎,𝑏)∣𝗉𝗋1(𝑎)∣𝗉𝗋2(𝑎)∣𝟏∣⋆∣𝟐∣𝗍𝗍∣𝖿𝖿∣𝗂𝗇𝖽𝟐(𝑥.𝐶;𝑎,𝑏,𝑐)∣ℕ∣𝟢∣𝗌𝗎𝖼(𝑎)∣𝗂𝗇𝖽ℕ(𝑥.𝐶;𝑎,𝑏,𝑐)∣𝖨𝖽𝐴(𝑎,𝑏)∣𝗋𝖾𝖿𝗅𝑎∣𝖩𝐴;𝑎;𝑏(𝑥.𝑦.𝑝.𝐶;𝑧.𝑐;𝑞)∣𝖵𝖾𝖼(𝐴,𝑎)∣𝗏𝗇𝗂𝗅∣𝗏𝖼𝗈𝗇𝗌(𝑎,𝑏,𝑐)∣𝗏𝗂𝗇𝖽(M;𝑝0;S;𝑎,𝑏),M:=𝑛.𝑣.𝑃,S:=𝑛.𝑎.𝑥𝑠.𝑞.𝑝𝑠 Here 𝑢 ranges over external level parameters (convention 29.3), so a level expression ℓ denotes a natural number once its parameters are given values, and a judgment is a schema in those parameters. Lemma 111.19 shows that the schema may be decided symbolically. Every binder displayed before a dot is part of the raw constructor: 𝗏𝗂𝗇𝖽 binds two variables in its motive and four in its successor branch, exactly as Vec-elim does.
Two omissions from convention 111.16 are deliberate and are not repaired anywhere below: 𝑇𝗂𝗆𝗉𝗅 has no 𝖶-type and no coinductive former, so the theorems of this chapter say nothing about the signature 𝑇𝗂𝗆𝗉𝗅-co obtained by adding one.
The pair (𝜖,𝜚) is checked kernel syntax (convention 110.16): a formation, introduction, elimination, computation or uniqueness rule applies only when the three occurrences belonging to one binder carry the same pair. Consequently ∏𝜖,𝜚𝑥:𝐴𝐵 and ∏𝜖′,𝜚′𝑥:𝐴𝐵 with (𝜖,𝜚)≠(𝜖′,𝜚′) are distinct types with no rule relating them, and (𝜆𝜖,𝜚(𝑥:𝐴).𝑏)𝜖′,𝜚′𝑎 with mismatched pairs is not a redex. Erasing both bits from every occurrence maps each rule of 𝑇𝗂𝗆𝗉𝗅 to the corresponding rule of definition 27.2; nothing below uses more about them than this equality test.
An atom is a level expression 𝑢+𝑛 with 𝑢 a parameter and 𝑛∈ℕ. A level expression is in level normal form when it is written max(𝑛0,𝑢1+𝑛1,…,𝑢𝑘+𝑛𝑘), with 𝑢1,…,𝑢𝑘 pairwise distinct parameters listed in a fixed order of parameters, and with the constant 𝑛0 present exactly when either 𝑘=0 or 𝑛0>max1≤𝑗≤𝑘𝑛𝑗. Write ⌈ℓ⌉ for the expression obtained by
distributing (−)+1 over max and flattening nested maxima;
replacing two atoms 𝑢+𝑛, 𝑢+𝑚 on the same parameter by 𝑢+max(𝑛,𝑚), and merging all constants into one 𝑛0;
deleting 𝑛0 when 𝑘≥1 and 𝑛0≤max𝑗𝑛𝑗.
Step (3) is not cosmetic: max(1,𝑢+1) and 𝑢+1 denote the same function, because 𝑢+1≥1 for every value of 𝑢, so a normal form that retained the constant 1 would not be unique.
Let ℓ,ℓ′ be level expressions over parameters 𝑢1,…,𝑢𝑚, and call two expressions equivalent when they denote the same natural number under every assignment of naturals to those parameters.
⌈ℓ⌉ is in level normal form and is equivalent to ℓ.
ℓ and ℓ′ are equivalent if and only if ⌈ℓ⌉ and ⌈ℓ′⌉ are the same expression.
Whether ℓ<ℓ′ holds under every assignment is decidable.
Proof of Lemma 111.19 — Deciding level equality and level order
Proof. (1) Each step preserves the denoted number under every assignment: max(ℓ1,ℓ2)+1=max(ℓ1+1,ℓ2+1) and max is associative, commutative and idempotent, giving step (1); max(𝑢+𝑛,𝑢+𝑚)=𝑢+max(𝑛,𝑚) gives step (2); and if 𝑛0≤𝑛𝑗 for some 𝑗, then 𝑢𝑗+𝑛𝑗≥𝑛𝑗≥𝑛0 under every assignment, so deleting 𝑛0 changes nothing, giving step (3). Steps (2) and (3) leave the shape required by definition 111.18.
(2) One direction is (1). For the other, let ⌈ℓ⌉ and ⌈ℓ′⌉ be equivalent normal forms. Fix a parameter 𝑢𝑗 and evaluate both at 𝑢𝑗:=𝑁 with every other parameter 0. For 𝑁 larger than every offset occurring in either expression, the value is 𝑁+𝑛𝑗 if 𝑢𝑗 occurs with offset 𝑛𝑗, and is a constant independent of 𝑁 otherwise. Comparing the values at two such 𝑁 shows that 𝑢𝑗 occurs in both normal forms or in neither, and that its offsets agree when it occurs. So the atom sets coincide; write 𝑀:=max𝑗𝑛𝑗 for their common maximal offset when 𝑘≥1. Now evaluate both at the all-zero assignment. If 𝑘=0 both expressions are their constants, which are therefore equal. If 𝑘≥1, the value is 𝑛0 when the constant is present—since then 𝑛0>𝑀—and 𝑀 when it is absent. Hence the common value determines whether the constant is present and, if so, its size. The two normal forms are therefore the same expression.
(3) ℓ<ℓ′ holds under every assignment exactly when ⌈ℓ+1⌉≤⌈ℓ′⌉ does. A maximum is at most 𝑅 exactly when each of its entries is, so test the entries of ⌈ℓ+1⌉=max(𝑚0,𝑢1+𝑚1,…) separately against 𝑅:=⌈ℓ′⌉. An atom 𝑢+𝑚 satisfies 𝑢+𝑚≤𝑅 under every assignment if and only if 𝑢 occurs in 𝑅 with an offset 𝑛≥𝑚: the condition is sufficient because 𝑢+𝑚≤𝑢+𝑛, and necessary because otherwise 𝑅 is bounded in 𝑢 or grows with a smaller offset, and taking 𝑢 large refutes the inequality. The constant 𝑚0 satisfies 𝑚0≤𝑅 under every assignment if and only if 𝑚0≤𝑅(0,…,0), because 𝑅 is monotone in each parameter, so its minimum is at the all-zero assignment. Each test compares finitely many natural numbers. ◻
Reduction now records what the computation rules do when read from left to right. The uniqueness rules Π-𝜂, Σ-𝜂 and 𝟏-𝜂 are deliberately absent from it; they are not left-to-right steps, and definition 49.14 builds them into the shape of a normal form instead.
Root contraction⇝0 is the least relation on raw expressions containing the following instances, in which every displayed Π-triple carries one and the same pair (𝜖,𝜚). (𝜆𝜖,𝜚(𝑥:𝐴).𝑏)𝜖,𝜚𝑎Π−𝛽⇝0𝑏[𝑎/𝑥],𝗉𝗋1((𝑎,𝑏))Σ−𝛽1⇝0𝑎,𝗉𝗋2((𝑎,𝑏))Σ−𝛽2⇝0𝑏,𝗂𝗇𝖽𝟐(𝑥.𝐶;𝑐𝑡,𝑐𝑓,𝗍𝗍)𝟐−𝑐𝑜𝑚𝑝1⇝0𝑐𝑡,𝗂𝗇𝖽𝟐(𝑥.𝐶;𝑐𝑡,𝑐𝑓,𝖿𝖿)𝟐−𝑐𝑜𝑚𝑝2⇝0𝑐𝑓,𝗂𝗇𝖽ℕ(𝑥.𝐶;𝑐0,𝑐𝑠,𝟢)ℕ−𝑐𝑜𝑚𝑝1⇝0𝑐0,𝗂𝗇𝖽ℕ(𝑥.𝐶;𝑐0,𝑐𝑠,𝗌𝗎𝖼(𝑚))ℕ−𝑐𝑜𝑚𝑝2⇝0𝑐𝑠𝑚(𝗂𝗇𝖽ℕ(𝑥.𝐶;𝑐0,𝑐𝑠,𝑚)),𝖩𝐴;𝑎;𝑎(𝑥.𝑦.𝑝.𝐶;𝑧.𝑐;𝗋𝖾𝖿𝗅𝑎)𝐼𝑑−𝑐𝑜𝑚𝑝⇝0𝑐[𝑎/𝑧],𝗏𝗂𝗇𝖽(M;𝑝0;S;𝟢,𝗏𝗇𝗂𝗅)𝑉𝑒𝑐−𝑐𝑜𝑚𝑝1⇝0𝑝0,𝗏𝗂𝗇𝖽(M;𝑝0;S;𝗌𝗎𝖼(𝑚),𝗏𝖼𝗈𝗇𝗌(𝑚,𝑐,𝑦𝑠))𝑉𝑒𝑐−𝑐𝑜𝑚𝑝2⇝0𝑝𝑠[𝑚/𝑛,𝑐/𝑎,𝑦𝑠/𝑥𝑠,𝑟/𝑞], with M,S the two binder groups of convention 111.16 and 𝑟:=𝗏𝗂𝗇𝖽(M;𝑝0;S;𝑚,𝑦𝑠), together with the strict-lift instances 𝖫𝗂𝖿𝗍ℓ(∏𝜖,𝜚𝑥:𝐴𝐵)𝐿𝑖𝑓𝑡−𝑃𝑖⇝0∏𝜖,𝜚𝑥:𝖫𝗂𝖿𝗍ℓ𝐴𝖫𝗂𝖿𝗍ℓ𝐵,𝖫𝗂𝖿𝗍ℓ(∑𝑥:𝐴𝐵)𝐿𝑖𝑓𝑡−𝑆𝑖𝑔⇝0∑𝑥:𝖫𝗂𝖿𝗍ℓ𝐴𝖫𝗂𝖿𝗍ℓ𝐵,𝖫𝗂𝖿𝗍ℓ(𝖨𝖽𝐴(𝑎,𝑏))𝐿𝑖𝑓𝑡−𝐼𝑑⇝0𝖨𝖽𝖫𝗂𝖿𝗍ℓ𝐴(𝑎,𝑏),𝖫𝗂𝖿𝗍ℓ(𝐾)𝐿𝑖𝑓𝑡−𝐾⇝0𝐾,𝖫𝗂𝖿𝗍ℓ(U𝑘)𝐿𝑖𝑓𝑡−𝐻𝑖𝑒𝑟⇝0U𝑘 for 𝐾∈{𝟏,𝟐,ℕ}, where Lift-𝐾 abbreviates the three rules Lift-Unit, Lift-Bool, Lift-Nat of definition 29.10, and Vec-comp1, Vec-comp2 are the two equations that definition 78.1 names Vec-comp.
Definition 29.10 supplies a commuting equation for every former it lists, and Lift-Id was added with the identity type. The vector family was introduced later (definition 78.1) and no Lift-Vec equation accompanies it, so 𝖫𝗂𝖿𝗍ℓ(𝖵𝖾𝖼(𝐴,𝑛))and𝖵𝖾𝖼(𝖫𝗂𝖿𝗍ℓ𝐴,𝑛) are two elements of Uℓ+1 with no derivable equation between them, although Lift-El makes the first of them equal, as a type, to 𝖵𝖾𝖼(𝐴,𝑛). Neither is 𝖵𝖾𝖼-formation a congruence across a lift: its element premise is a term of a fixed universe, and 𝖫𝗂𝖿𝗍ℓ𝐴 and 𝐴 never inhabit the same one. The same holds for an iterated lift 𝖫𝗂𝖿𝗍ℓ+1(𝖫𝗂𝖿𝗍ℓ(𝐴)), which has no equation collapsing it. Nothing below repairs the signature: the normal codes of definition 49.14 keep both stuck lifts, the conversion procedure of theorem 111.81 therefore rejects 𝖫𝗂𝖿𝗍ℓ(𝖵𝖾𝖼(𝐴,𝑛))≡𝖵𝖾𝖼(𝖫𝗂𝖿𝗍ℓ𝐴,𝑛) at Uℓ+1, and it accepts Γ⊢𝖫𝗂𝖿𝗍ℓ(𝖵𝖾𝖼(𝐴,𝑛))≡𝖵𝖾𝖼(𝐴,𝑛)𝗍𝗒𝗉𝖾. A signature that wanted the two codes identified would have to add the equation and re-check lemma 111.74 for it.
One-step reduction⟶ is the compatible closure of ⇝0: it contracts one redex in an arbitrary subexpression, including under a binder. Its reflexive-transitive closure is ⟶∗.
Weak-head reduction contracts only in a head position, and the head positions are fixed by the following grammar of head contexts. Its last two productions are ordered, so that exactly one hole is available in a 𝗏𝗂𝗇𝖽 node. 𝐻::=◻∣𝐻𝜖,𝜚𝑎∣𝗉𝗋1(𝐻)∣𝗉𝗋2(𝐻)∣𝖫𝗂𝖿𝗍ℓ(𝐻)∣𝗂𝗇𝖽𝟐(𝑥.𝐶;𝑐𝑡,𝑐𝑓,𝐻)∣𝗂𝗇𝖽ℕ(𝑥.𝐶;𝑐0,𝑐𝑠,𝐻)∣𝖩𝐴;𝑎;𝑏(𝑥.𝑦.𝑝.𝐶;𝑧.𝑐;𝐻)∣𝗏𝗂𝗇𝖽(M;𝑝0;S;𝑚,𝐻)∣𝗏𝗂𝗇𝖽(M;𝑝0;S;𝐻,𝑤) The last production carries the side condition that 𝑤 admit no weak-head step; the two before it are unrestricted. A weak-head step carries 𝐻⟨𝑎⟩ to 𝐻⟨𝑏⟩ whenever 𝑎⇝0𝑏; the expression 𝐻⟨𝑏⟩ is then the weak-head reduct of 𝐻⟨𝑎⟩. Weak-head reduction is the reflexive-transitive closure of that step, and a raw expression is a weak-head normal form when no weak-head step applies to it. No arrow is introduced for the relation: every statement below about it names the head context and the root instance, which is what the algorithm of remark 111.86 inspects. The side condition makes the vector argument of 𝗏𝗂𝗇𝖽 the principal one and its index the secondary one; without it, an expression whose index and vector are both redexes would have two weak-head reducts.
Proof of Lemma 111.23 — Substitution, weakening, and conversion for reduction
Proof. (1) Inspect the ten computation instances and the five lift instances of definition 111.20. Choose the representative of each binder to avoid dom(𝛾) and the free variables of its images, which is possible by lemma 26.9. For Π-𝛽 the two sides become (𝜆𝜖,𝜚(𝑥:𝐴[𝛾]).𝑏[𝛾+])𝜖,𝜚𝑎[𝛾]and𝑏[𝛾+][𝑎[𝛾]/𝑥]=𝑏[𝑎/𝑥][𝛾], the last equation being composition of capture-avoiding substitutions, where 𝛾+ extends 𝛾 by 𝑥↦𝑥. The bit pair is carried unchanged, so the instantiated pair still matches and the right-hand side is again an instance. Σ-𝛽1,2, 𝟐-comp1,2 and ℕ-comp1 substitute into a subexpression only. ℕ-comp2 and Vec-comp2 rebuild the same expression from substituted components, again by substitution composition, and Vec-comp2 additionally uses that its recursive call 𝑟 is built from the very components being substituted. Id-comp needs its two endpoint annotations and its 𝗋𝖾𝖿𝗅 argument to remain the same expression after substitution, which they do because 𝛾 is applied to all four occurrences of 𝑎 at once. The five lift instances are first-order rewrites of a head symbol and its arguments, and the level subscript is unaffected because levels are external.
(2) Induction on the one-step derivation, using (1) at the root and capture avoidance at each binder; then induction on the length of the reduction sequence. Weakening is the case where 𝛾 is an inclusion of contexts.
(3) Induction on 𝑎⟶𝑏. At the root, each instance of definition 111.20 is exactly the left-to-right reading of a computation rule of the signature, whose premises are recovered from Γ⊢𝑎:𝐴 by inversion: for instance, if Γ⊢𝗂𝗇𝖽ℕ(𝑥.𝐶;𝑐0,𝑐𝑠,𝗌𝗎𝖼(𝑚)):𝐴, then ℕ-elim gives Γ,𝑥:ℕ⊢𝐶𝗍𝗒𝗉𝖾, Γ⊢𝑐0:𝐶[𝟢/𝑥], Γ⊢𝑐𝑠:𝖲𝗍𝖾𝗉ℕ(𝐶) and Γ⊢𝗌𝗎𝖼(𝑚):ℕ, and ℕ-comp2 is the required equation at 𝐶[𝗌𝗎𝖼(𝑚)/𝑥]; Conv moves it to 𝐴. The five lift instances are the equations of definition 29.10 and Lift-Id, which are equations in Uℓ+1 and hence type equations by U-El-Eq. In a compatible position the induction hypothesis supplies an equation for the redex and the congruence rule of the surrounding former—app-eq, pair-eq, 𝗉𝗋1-eq, 𝗉𝗋2-eq, the two eliminator congruences of definition 28.7, definition 28.21, Id-elim-eq, the Vec-elim congruence, Π-form-eq, the Σ-formation congruence of remark 27.10, Id-form-eq, or Lift-Cong—propagates it. Transitivity of judgmental equality closes ⟶∗.
(4) Let 𝑏 be a weak-head reduct of 𝑎, so 𝑎=𝐻⟨𝑎0⟩ with 𝑎0 a root redex and 𝑏=𝐻⟨𝑎′0⟩ for 𝑎0⇝0𝑎′0. We show that 𝐻 and 𝑎0 are determined by 𝑎. The outermost symbol of 𝑎 admits at most one production of the grammar of definition 111.22: application, the two projections, the two eliminators, 𝖩, 𝖫𝗂𝖿𝗍 and 𝗏𝗂𝗇𝖽 each occur in exactly one production, except 𝗏𝗂𝗇𝖽, which occurs in two. For a 𝗏𝗂𝗇𝖽 node the side condition decides between them: if the vector argument admits a weak-head step the first production applies and the second does not, and if it does not, only the second is available. So the decomposition proceeds deterministically down to the hole. Finally, at most one root instance applies to 𝑎0, because the left-hand sides of definition 111.20 have pairwise distinct head symbols, and where one head symbol carries several instances—𝗂𝗇𝖽𝟐, 𝗂𝗇𝖽ℕ, 𝗏𝗂𝗇𝖽, 𝖫𝗂𝖿𝗍—the instances are distinguished by the constructor in the eliminated position. ◻
Four judgments are defined by mutual induction: Γ⊢𝑢𝗇𝖾𝐴 (𝑢 is neutral of type 𝐴), Γ⊢𝑣𝗇𝖿𝐴 (𝑣 is normal of type 𝐴), Γ⊢𝐴𝗇𝖿𝗍𝗒𝗉𝖾 (𝐴 is a normal type), and Γ⊢𝑐𝗇𝖿Uℓ (𝑐 is a normal code at level ℓ), the last being a special case of the second. A neutral term is an elimination chain blocked on a variable; a normal term is 𝛽-normal and 𝜂-long. Premises recoverable from the rule data are compressed per convention 26.14. Every field that a raw constructor stores—a 𝜆-domain, the three annotations of 𝖩, an eliminator motive, a 𝗋𝖾𝖿𝗅 argument, a 𝗏𝖼𝗈𝗇𝗌 index—carries its own normality premise below; without that, two judgmentally equal terms could carry 𝛼-distinct annotations and no normal form would be canonical.
Here 𝑃0 and 𝑃𝑠 are the two branch types of Vec-elim.
Normal terms, one group per former. A type 𝐴 is positive when it is 𝟐, ℕ, an identity type, a vector type, a universe, or a neutral type; that is, when it is neither a Π-type, nor a Σ-type, nor 𝟏.
Γ⊢𝐴𝗇𝖿𝗍𝗒𝗉𝖾Γ,𝑥:𝐴⊢𝑣𝗇𝖿𝐵
Γ⊢𝜆𝜖,𝜚(𝑥:𝐴).𝑣𝗇𝖿∏𝜖,𝜚𝑥:𝐴𝐵
nf-lam
Γ⊢𝑣𝗇𝖿𝐴Γ⊢𝑤𝗇𝖿𝐵[𝑣/𝑥]
Γ⊢(𝑣,𝑤)𝗇𝖿∑𝑥:𝐴𝐵
nf-pair
Γ⊢⋆𝗇𝖿𝟏
nf-star
Γ⊢𝗍𝗍𝗇𝖿𝟐
nf-true
Γ⊢𝖿𝖿𝗇𝖿𝟐
nf-false
Γ⊢𝟢𝗇𝖿ℕ
nf-zero
Γ⊢𝑣𝗇𝖿ℕ
Γ⊢𝗌𝗎𝖼(𝑣)𝗇𝖿ℕ
nf-suc
Γ⊢𝑣𝗇𝖿𝐴Γ⊢𝑎≡𝑣:𝐴Γ⊢𝑏≡𝑣:𝐴
Γ⊢𝗋𝖾𝖿𝗅𝑣𝗇𝖿𝖨𝖽𝐴(𝑎,𝑏)
nf-refl
Γ⊢𝑛≡𝟢:ℕ
Γ⊢𝗏𝗇𝗂𝗅𝗇𝖿𝖵𝖾𝖼(𝑐,𝑛)
nf-vnil
Γ⊢𝑣𝑛𝗇𝖿ℕΓ⊢𝑣𝑎𝗇𝖿𝑐Γ⊢𝑣𝑥𝑠𝗇𝖿𝖵𝖾𝖼(𝑐,𝑣𝑛)Γ⊢𝑛≡𝗌𝗎𝖼(𝑣𝑛):ℕ
Γ⊢𝗏𝖼𝗈𝗇𝗌(𝑣𝑛,𝑣𝑎,𝑣𝑥𝑠)𝗇𝖿𝖵𝖾𝖼(𝑐,𝑛)
nf-vcons
Γ⊢𝑢𝗇𝖾𝐴𝐴𝗉𝗈𝗌𝗂𝗍𝗂𝗏𝖾
Γ⊢𝑢𝗇𝖿𝐴
nf-ne
Rule nf-ne is restricted to positive types because Π-𝜂, Σ-𝜂, and 𝟏-𝜂 equate a neutral of the excluded types with an expanded form (remark 49.15).
Normal codes are the normal terms whose type is a universe. They have their own rule family, one clause for each universe-closure rule of definition 29.1, definition 29.10, definition 30.1, definition 78.1, because a normal code is a normal term, not a normal type:
Γ⊢𝐾𝗇𝖿Uℓ
nf-cd-K
𝑘<ℓ
Γ⊢U𝑘𝗇𝖿Uℓ
nf-cd-univ
Γ⊢𝑐𝗇𝖿UℓΓ,𝑥:𝑐⊢𝑑𝗇𝖿Uℓ
Γ⊢∏𝜖,𝜚𝑥:𝑐𝑑𝗇𝖿Uℓ
nf-cd-pi
Γ⊢𝑐𝗇𝖿UℓΓ,𝑥:𝑐⊢𝑑𝗇𝖿Uℓ
Γ⊢∑𝑥:𝑐𝑑𝗇𝖿Uℓ
nf-cd-sg
Γ⊢𝑐𝗇𝖿UℓΓ⊢𝑣𝗇𝖿𝑐Γ⊢𝑤𝗇𝖿𝑐
Γ⊢𝖨𝖽𝑐(𝑣,𝑤)𝗇𝖿Uℓ
nf-cd-id
Γ⊢𝑐𝗇𝖿UℓΓ⊢𝑣𝗇𝖿ℕ
Γ⊢𝖵𝖾𝖼(𝑐,𝑣)𝗇𝖿Uℓ
nf-cd-vec
Γ⊢𝑐𝗇𝖿Uℓ𝑐𝗌𝗍𝗎𝖼𝗄
Γ⊢𝖫𝗂𝖿𝗍ℓ(𝑐)𝗇𝖿Uℓ+1
nf-cd-lift
with 𝐾∈{𝟏,𝟐,ℕ}. A normal code is stuck when it is neutral, or of the form 𝖵𝖾𝖼(−,−), or of the form 𝖫𝗂𝖿𝗍𝑘(−); these are the three shapes across which the signature moves no lift (remark 111.21). A neutral code is normal by nf-ne, universes being positive.
Normal types:
Γ⊢Uℓ𝗇𝖿𝗍𝗒𝗉𝖾
nf-ty-univ
Γ⊢𝐴𝗇𝖿𝗍𝗒𝗉𝖾Γ,𝑥:𝐴⊢𝐵𝗇𝖿𝗍𝗒𝗉𝖾
Γ⊢∏𝜖,𝜚𝑥:𝐴𝐵𝗇𝖿𝗍𝗒𝗉𝖾
nf-ty-pi
Γ⊢𝐴𝗇𝖿𝗍𝗒𝗉𝖾Γ,𝑥:𝐴⊢𝐵𝗇𝖿𝗍𝗒𝗉𝖾
Γ⊢∑𝑥:𝐴𝐵𝗇𝖿𝗍𝗒𝗉𝖾
nf-ty-sg
Γ⊢𝐾𝗇𝖿𝗍𝗒𝗉𝖾
nf-ty-K
Γ⊢𝐴𝗇𝖿𝗍𝗒𝗉𝖾Γ⊢𝑣𝗇𝖿𝐴Γ⊢𝑤𝗇𝖿𝐴
Γ⊢𝖨𝖽𝐴(𝑣,𝑤)𝗇𝖿𝗍𝗒𝗉𝖾
nf-ty-id
Γ⊢𝑐𝗇𝖿UℓΓ⊢𝑣𝗇𝖿ℕ
Γ⊢𝖵𝖾𝖼(𝑐,𝑣)𝗇𝖿𝗍𝗒𝗉𝖾
nf-ty-vec
Γ⊢𝑢𝗇𝖾Uℓ
Γ⊢𝑢𝗇𝖿𝗍𝗒𝗉𝖾
nf-ty-ne
𝖫𝗂𝖿𝗍 heads a normal code but never a normal type: by Lift-El a lift is judgmentally the type it lifts, so a normal type never mentions one except inside the code argument of nf-ty-vec, which is the single place where a normal type stores a code rather than a type. The classifier 𝐴 printed in a neutral or normal judgment need not itself be normal; conversion identifies it with the classifier reconstructed from the stored fields.
The type-directedness of definition 49.14 is forced by the three uniqueness rules. A neutral 𝑢 whose type is a product is not normal; its normal form is the expansion 𝜆𝜖,𝜚(𝑥:𝐴).𝑢𝜖,𝜚𝑥, recursively expanded. A neutral at ∑𝑥:𝐴𝐵 expands to the pair of its two projections. A term at 𝟏 has normal form ⋆ whatever it is. The last case is the sharpest: the same raw variable 𝑥 normalizes to ⋆ in the context 𝑥:𝟏 and to 𝑥 in the context 𝑥:𝟐. A function of the raw term alone cannot choose between those two answers, so normalization must be indexed by the classifier as well.
Proof of Lemma 111.26 — Stability of the four judgments
Proof. (1) Simultaneous induction on the four derivations. ne-var uses (𝑥:𝐴)∈Γ⊆Δ; every other rule rebuilds its conclusion from induction hypotheses, and the rules with a judgmental-equality premise (nf-refl, nf-vnil, nf-vcons) use weakening for judgmental equality from definition 26.22. For a binder rule the context extension is applied to a context already extended by the bound variable, which is again a context extension.
(2) Simultaneous induction, replacing each neutral, normal, code, or type rule by the typing rule bearing the same head symbol: ne-app by Π-elim, ne-fst and ne-snd by Σ-elim1,2, ne-ind-bool by 𝟐-elim, ne-ind-nat by ℕ-elim, ne-J by Id-elim, ne-vind by Vec-elim, nf-lam by Π-intro, nf-pair by Σ-intro, nf-refl by Id-intro followed by Conv along the two displayed endpoint equations, nf-vnil and nf-vcons by the two constructor rules of definition 78.1 followed by Conv along the displayed index equation, each nf-cd-− rule by the universe-closure rule of the same name in definition 29.1, nf-cd-lift by Lift-U, each nf-ty-− rule by the corresponding formation rule, and nf-ty-vec, nf-ty-ne by U-El.
(3) Induction on the neutral derivation. The only axiom is ne-var, whose premise (𝑥:𝐴)∈⋅ is false; every other rule has a neutral premise in the same context.
(4) A weak-head step decomposes its subject as 𝐻⟨𝑎0⟩ with 𝑎0 a root redex. Induction on the neutral derivation shows that peeling head contexts off a neutral term always exposes a variable, and a variable is not the left-hand side of any instance of definition 111.20: every instance has a constructor, a 𝜆, a pair, or a nullary type former in the eliminated position. The one production that could stop early is the secondary 𝗏𝗂𝗇𝖽 production, whose side condition is met here because ne-vind has a neutral vector argument, which by the induction hypothesis admits no weak-head step. A normal term with a constructor head admits no head context above it other than ◻, and a constructor is not a redex. A normal code headed by 𝖫𝗂𝖿𝗍ℓ admits the production 𝖫𝗂𝖿𝗍ℓ(𝐻), but its argument is stuck by the side condition of nf-cd-lift, and none of Lift-Pi, Lift-Sig, Lift-Id, Lift-𝐾, Lift-Hier applies to a neutral, a 𝖵𝖾𝖼 code, or another lift. ◻
★☆☆ Compute the 𝜂-long normal forms of: (i) ⋅⊢𝜆𝑓.𝑓:∏𝑓:𝟐→𝟐𝟐→𝟐; (ii) the variable 𝑔 in context 𝑔:∏𝑥:𝟐∏𝑦:𝟐𝟐; and (iii) the variable ℎ in context ℎ:∏𝑓:𝟐→𝟐𝟐. Use only the Π and 𝟐 rules of definition 49.14, and write the answers with the domain annotations and the two binder bits suppressed.
★☆☆ Show that in the base theory Γ⊢𝑡≡⋆:𝟏 for every Γ⊢𝑡:𝟏, and exhibit a raw term that has type 𝟏 in one context and type 𝟐 in another with different normal forms. Conclude that no function of the raw term alone can be a sound and complete normalization function: readback must consult the type (remark 49.15).
Three different assertions are in play, and a development that runs them together cannot say what its construction has bought. Canonicity is about closed data; normalization produces a canonical representative for open terms; decidable conversion is what the kernel calls. This section fixes the exact statement of each as a target. They are proved, as numbered theorems with their proofs beside them, in section 111.10, once the construction of section 49.5–section 111.9 is available.
A normalization structure for a type theory consists of computable functions from derivations of types and terms into a set of abstract syntax trees with decidable equality, such that two outputs are equal exactly when the represented inputs are judgmentally equal. Thus the functions are invariant on judgmental-equality classes and injective on the resulting quotients. This is the syntax-tree form of definition 48.8.
Write (∗) for the following package at a signature 𝑇: a computable nf assigning to each derivation of Γ⊢𝑎:𝐴 a term, and to each derivation of Γ⊢𝐴𝗍𝗒𝗉𝖾 a type, such that
Γ⊢nf(𝑎)𝗇𝖿𝐴 and Γ⊢nf(𝐴)𝗇𝖿𝗍𝗒𝗉𝖾;
Γ⊢𝑎≡nf(𝑎):𝐴 and Γ⊢𝐴≡nf(𝐴)𝗍𝗒𝗉𝖾(soundness);
Γ⊢𝑎≡𝑏:𝐴 if and only if nf(𝑎) and nf(𝑏) are 𝛼-equal, and Γ⊢𝐴≡𝐵𝗍𝗒𝗉𝖾 if and only if nf(𝐴) and nf(𝐵) are 𝛼-equal (completeness).
A theory satisfying (∗) has a normalization structure (definition 49.16): encode the normal syntax tree.
The three targets, at the signature 𝑇𝗂𝗆𝗉𝗅 of convention 111.16, are the following.
Target C (canonicity). Every closed ⋅⊢𝑏:𝟐 is judgmentally equal to exactly one of 𝗍𝗍,𝖿𝖿; every closed ⋅⊢𝑛:ℕ to 𝗌𝗎𝖼𝑚(𝟢) for exactly one 𝑚∈ℕ; every closed ⋅⊢𝑝:𝖨𝖽𝐴(𝑎,𝑏) forces ⋅⊢𝑎≡𝑏:𝐴 and ⋅⊢𝑝≡𝗋𝖾𝖿𝗅𝑎:𝖨𝖽𝐴(𝑎,𝑏); and every closed vector of numeral length 𝑚 is a 𝗏𝖼𝗈𝗇𝗌 chain of length 𝑚 ending in 𝗏𝗇𝗂𝗅.
Target N (normalization).𝑇𝗂𝗆𝗉𝗅 satisfies (∗), and nf is idempotent.
Target D (decidable conversion). Given derivations of the inputs as in remark 48.7, the judgments Γ⊢𝐴≡𝐵𝗍𝗒𝗉𝖾 and Γ⊢𝑎≡𝑏:𝐴 are decidable in 𝑇𝗂𝗆𝗉𝗅; equivalently, 𝑇𝗂𝗆𝗉𝗅 has an effective conversion invariant in the sense of definition 48.8.
Target C is silent about Π, Σ and 𝟏, and deliberately so: at those three formers the corresponding statement is the uniqueness rule itself, holds in every context rather than only in the empty one, and is already available. The interesting canonical-form statements are the ones listed, all at positive types.
Proof structure.
The obstruction is stated in section 111.6: neither an induction on raw syntax nor the closed-instantiation assignment of definition 49.9 survives a binder, because the induction hypothesis for a function must be usable at arguments that do not yet exist. The construction that overcomes it occupies four steps. Section 49.5 builds a domain of semantic values, an evaluator into it, and a type-directed readback; that supplies the candidate function nf but proves nothing about it. Section 111.8 carves out of the domain the values that are semantic types, equips each with a partial equivalence relation on its elements and with a Kripke relation to syntax, and proves the two lemmas—escape and reflection—that connect the two sides. Section 111.9 proves the fundamental lemma: every derivable judgment of 𝑇𝗂𝗆𝗉𝗅 is valid, treated rule family by rule family. Section 111.10 then states and proves Targets N, C and D in that order, and reads the kernel’s four inversion operations off the normal types.
★☆☆ Prove the claim of remark 49.6 directly, without invoking the normalization package (∗). If 𝑥:𝟐⊢𝑥≡𝗍𝗍:𝟐 were derivable, substitute 𝑥↦𝖿𝖿 and use Boolean separation. Give the dual substitution that rules out 𝑥:𝟐⊢𝑥≡𝖿𝖿:𝟐.
★☆☆ Show that judgmental equality of the base theory is semidecidable without any normalization theorem: enumerate derivations. Why is this useless as an implementation?
★★☆ Suppose a type theory has a recursive signature, effectively checkable rule instances, and decidable judgmental equality. Construct a normalization structure (definition 49.16) for it. Enumerate derivations and map each typed input to the first represented term judged equal to it. Explain why the given input derivation itself guarantees termination; no classical search principle is needed.
Normalization by evaluation for the simply-typed calculus
Normalization by evaluation computes normal forms without ever rewriting syntax: it evaluates the term into a semantic domain in which stuck computations are first-class, then reads back the value as a normal form. We fix the architecture as a definition, then instantiate it in full for 𝜆→.
The STLC construction below is carried out in a constructive type-theoretic metatheory with inductive syntax, dependent function types, and function extensionality for semantic equality proofs. Its functions are programs and its structural recursions terminate by the displayed inductive data; no excluded middle or choice is used. This is what turns evaluation and readback into an algorithm rather than merely a classical set function.
A normalization-by-evaluation structure for a theory with designated normal and neutral forms (definition 49.14) consists of:
a semantic domain: for each context Γ and type 𝐴 a set [[𝐴]](Γ) of values;
evaluation: an assignment 𝑡↦[[𝑡]], by structural recursion on terms, from terms in context Γ and environments 𝜌∈[[Γ]](Δ) to values, such that judgmentally equal terms evaluate to equal values;
reflection↑ from neutral forms to values and reification↓ from values to normal forms, together with a distinguished environment 𝜌Γ of reflected variables;
such that the composite nf(𝑡):=↓([[𝑡]]𝜌Γ),RawTm[[−]]𝜌Γ←←←←←←←←←←←←←→[[𝐴]]↓⟶Nf↪RawTm, lands in normal forms of the correct type and satisfies Γ⊢𝑡≡nf(𝑡):𝐴. If 𝑡≡𝑢:𝐴, evaluation gives equal semantic values and reification gives nf(𝑡)=nf(𝑢); call this equality preservation. Conversely, 𝑡≡nf(𝑡):𝐴 and 𝑢≡nf(𝑢):𝐴, so equal readbacks imply 𝑡≡𝑢:𝐴; call this equality reflection. Together they make comparison of normal forms a sound and complete decision procedure, without assigning the two words to opposite directions in isolation.
We build such a structure for the simply-typed 𝜆-calculus 𝜆→ of chapter 2 over a single base type 𝜄 with no constants; types are 𝑇::=𝜄∣𝑆→𝑇, with 𝛽𝜂-equality Γ⊢𝑡≡𝑠:𝑇. Normal and neutral forms specialize definition 49.14: neutrals are variables applied to normal arguments, and nf-ne is available only at 𝜄. We write Δ⊵Γ when Δ extends Γ on the right, i.e. Δ=Γ,Γ′; neutral and normal forms weaken along such extensions by lemma 2.14.
Three failures determine the semantic domain. If the ground type has no constants, the closed-only choice [[𝜄]](⋅)=∅ cannot interpret the open judgment 𝑥:𝜄⊢𝑥:𝜄. If semantic functions are only closures, then for 𝑓:𝑆→𝑇 the application 𝑓𝑎 is stuck rather than a semantic value; it must be reflected as 𝑎⟶↑𝑇(𝑓↓𝑆(𝑎)). Finally, reifying a semantic 𝑔:𝑆→𝑇 requires a fresh variable: ↓𝑆→𝑇Γ(𝑔)=𝜆(𝑥:𝑆).↓𝑇Γ,𝑥:𝑆(𝑔Γ,𝑥:𝑆(↑𝑆Γ,𝑥:𝑆(𝑥))). The right side lives in the extended context Γ,𝑥:𝑆; hence a value at Γ must act uniformly at every extension Δ⊵Γ. Neutrals, reflection, and the Kripke index below are forced by these three failures.
By recursion on the type: [[𝜄]](Γ):={𝑢∣Γ⊢𝑢𝗇𝖾𝜄}[[𝑆→𝑇]](Γ):=∏Δ⊵Γ([[𝑆]](Δ)→[[𝑇]](Δ)) For Δ⊵Γ, the restriction 𝑎↾Δ∈[[𝑇]](Δ) of 𝑎∈[[𝑇]](Γ) is weakening of the neutral term at 𝜄, and restriction of the indexing family at 𝑆→𝑇: (𝑓↾Δ)Θ:=𝑓Θ. Environments: [[Γ]](Δ):=∏(𝑥:𝑇)∈Γ[[𝑇]](Δ), with pointwise restriction.
By recursion on the type, define ↑𝑇Γ:{𝑢∣Γ⊢𝑢𝗇𝖾𝑇}→[[𝑇]](Γ) and ↓𝑇Γ:[[𝑇]](Γ)→{𝑣∣Γ⊢𝑣𝗇𝖿𝑇}: ↑𝜄Γ(𝑢):=𝑢↑𝑆→𝑇Γ(𝑢)Δ(𝑎):=↑𝑇Δ(𝑢↓𝑆Δ(𝑎))↓𝜄Γ(𝑢):=𝑢↓𝑆→𝑇Γ(𝑓):=𝜆(𝑥:𝑆).↓𝑇Γ,𝑥:𝑆(𝑓Γ,𝑥:𝑆(↑𝑆Γ,𝑥:𝑆(𝑥)))(𝑥fresh) (in the reflection clause 𝑢 is silently weakened to Δ). Evaluation [[𝑡]]𝜌∈[[𝑇]](Δ) for Γ⊢𝑡:𝑇 and 𝜌∈[[Γ]](Δ), by structural recursion: [[𝑥]]𝜌:=𝜌(𝑥),[[𝑟𝑠]]𝜌:=([[𝑟]]𝜌)Δ([[𝑠]]𝜌),([[𝜆𝑥.𝑡]]𝜌)Θ(𝑎):=[[𝑡]](𝜌↾Θ,𝑥↦𝑎). The identity environment𝜌Γ∈[[Γ]](Γ) is 𝜌Γ(𝑥):=↑𝑇Γ(𝑥) for (𝑥:𝑇)∈Γ, and nf𝑇Γ(𝑡):=↓𝑇Γ([[𝑡]]𝜌Γ).
Let Γ=(𝑓:𝜄→𝜄). Then [[𝑓]]𝜌Γ=↑𝜄→𝜄Γ(𝑓), the family 𝑎↦𝑓↓𝜄(𝑎)=𝑓𝑎 of neutral applications, so nf(𝑓)=𝜆(𝑥:𝜄).↓𝜄(𝑓𝑥)=𝜆(𝑥:𝜄).𝑓𝑥, the 𝜂-expansion — which no rewriting procedure oriented left-to-right would produce. Likewise [[(𝜆𝑦.𝑦)𝑓]]𝜌Γ=[[𝑓]]𝜌Γ already in the domain, so nf((𝜆𝑦.𝑦)𝑓)=𝜆(𝑥:𝜄).𝑓𝑥: the 𝛽-redex vanishes during evaluation, not by rewriting.
Let Γ and Δ be 𝜆→ contexts, let Γ⊢𝑡:𝑇, and let 𝜌∈[[Γ]](Δ). For every context Θ⊵Δ, [[𝑡]](𝜌↾Θ)=([[𝑡]]𝜌)↾Θin[[𝑇]](Θ). For Ξ⊵Θ⊵Δ, restriction satisfies (𝑎|Θ)|Ξ=𝑎|Ξ and 𝑎|Δ=𝑎 for every 𝑎∈[[𝑇]](Δ).
Proof. Induct on 𝑡, simultaneously with its type. A variable is the corresponding environment projection, so the equation is the definition of restricted environment. Application follows by the two induction hypotheses and the Kripke action of a semantic function. For abstraction, extensionality reduces the claim at every further extension Ξ⊵Θ and semantic argument 𝑎 to the induction hypothesis for the body in the extended environment (𝜌|Ξ,𝑎). Identities and composites of restrictions are componentwise identities and composites on environments; induction on the semantic type proves the same equations for semantic values. ◻
Proof of Lemma 49.28 — Evaluation and substitution
Proof. Induct on 𝑡. At 𝑥 both sides are [[𝑠]]𝜌; at another variable both are the same component of 𝜌. Application is immediate from the two induction hypotheses. Under 𝜆𝑦, choose 𝑦 fresh for 𝑠; semantic extensionality reduces the equality to the induction hypothesis for the body in (𝜌,𝑦↦𝑎). Capture avoidance gives (𝑡0[𝑠/𝑥])[𝑎/𝑦]=𝑡0[𝑎/𝑦][𝑠/𝑥], so the two extended environments coincide. These cases exhaust the term grammar. ◻
Proof. Induction on the derivation of the equality judgment.
𝛽:[[(𝜆𝑥.𝑡)𝑠]]𝜌𝑒𝑣𝑎𝑙𝑢𝑎𝑡𝑖𝑜𝑛=[[𝑡]](𝜌↾Δ,𝑥↦[[𝑠]]𝜌)𝑙𝑒𝑚𝑚𝑎49.28=[[𝑡[𝑠/𝑥]]]𝜌, where restriction along Δ⊵Δ is the identity.
𝜂: for Θ⊵Δ and 𝑎, ([[𝜆𝑥.𝑡𝑥]]𝜌)Θ(𝑎)𝑒𝑣𝑎𝑙𝑢𝑎𝑡𝑖𝑜𝑛=([[𝑡]](𝜌↾Θ))Θ(𝑎)𝑙𝑒𝑚𝑚𝑎49.27=(([[𝑡]]𝜌)↾Θ)Θ(𝑎)𝑟𝑒𝑠𝑡𝑟𝑖𝑐𝑡𝑖𝑜𝑛𝑎𝑡𝑓𝑢𝑛𝑐𝑡𝑖𝑜𝑛𝑡𝑦𝑝𝑒=([[𝑡]]𝜌)Θ(𝑎). Thus the semantic families are equal.
Congruences, equivalence rules: pointwise from the induction hypotheses, and by reflexivity, symmetry, transitivity of meta-level equality. ◻
Soundness requires relating values back to terms. The relation is a Kripke logical relation: a family of relations indexed by types and stable under context extension.
For Γ⊢𝑡:𝑇 and 𝑎∈[[𝑇]](Γ) define Γ⊩𝑡∼𝑎:𝑇 by recursion on 𝑇:
Γ⊩𝑡∼𝑢:𝜄 iff Γ⊢𝑡≡𝑢:𝜄 (recall 𝑢 is a neutral term);
Γ⊩𝑡∼𝑓:𝑆→𝑇 iff for all Δ⊵Γ and all 𝑠,𝑎 with Δ⊩𝑠∼𝑎:𝑆, we have Δ⊩𝑡𝑠∼𝑓Δ(𝑎):𝑇.
The relation is closed under judgmental equality on the left and under restriction on the right: if Γ⊢𝑡≡𝑡′:𝑇 and Γ⊩𝑡∼𝑎:𝑇 then Γ⊩𝑡′∼𝑎:𝑇; if Δ⊵Γ then Δ⊩𝑡∼𝑎↾Δ:𝑇. For the base type the first claim is transitivity of judgmental equality and the second is weakening. At 𝑆→𝑇, apply the induction hypotheses at 𝑇 after quantifying over a further extension and an argument related at 𝑆; the restriction claim uses functoriality of the Kripke family. This induction on 𝑇 proves both closure properties simultaneously.
Proof. At 𝜄 both parts are the definitions, since reflection and reification are identities there.
At 𝑆→𝑇, (a): let Γ⊩𝑡∼𝑓, and let 𝑥 be fresh. By (b) at 𝑆 (a smaller type), Γ,𝑥:𝑆⊩𝑥∼↑𝑆(𝑥):𝑆; hence by the definition of the relation, Γ,𝑥:𝑆⊩𝑡𝑥∼𝑓Γ,𝑥:𝑆(↑𝑆(𝑥)). By (a) at 𝑇, Γ,𝑥:𝑆⊢𝑡𝑥≡↓𝑇(𝑓Γ,𝑥:𝑆(↑𝑆(𝑥))):𝑇. The 𝜉-congruence and 𝜂 then give Γ⊢𝑡≡𝜆𝑥.⋯:𝑆→𝑇, and the right-hand side is precisely ↓𝑆→𝑇Γ(𝑓).
(b): let Γ⊢𝑡≡𝑢:𝑆→𝑇 with 𝑢 neutral, and let Δ⊵Γ, Δ⊩𝑠∼𝑎:𝑆. By (a) at 𝑆, Δ⊢𝑠≡↓𝑆Δ(𝑎):𝑆, so by congruence Δ⊢𝑡𝑠≡𝑢↓𝑆Δ(𝑎):𝑇, the right side a neutral (ne-app, 𝑢 weakened). By (b) at 𝑇, Δ⊩𝑡𝑠∼↑𝑇Δ(𝑢↓𝑆Δ(𝑎))=↑𝑆→𝑇Γ(𝑢)Δ(𝑎), as required. ◻
Proof. Induction on the typing derivation. Variables are the hypothesis. Application combines the induction hypotheses with the definition of the relation at 𝑆→𝑇 (taking Δ⊵Δ). For abstraction: given Θ⊵Δ and Θ⊩𝑠∼𝑎:𝑆, the induction hypothesis for the body at the extended substitution and environment (restricted along Θ, using closure under restriction) gives Θ⊩𝑡[𝛾,𝑠/𝑥]∼[[𝑡]](𝜌↾Θ,𝑥↦𝑎); since Θ⊢(𝜆𝑥.𝑡[𝛾])𝑠≡𝑡[𝛾,𝑠/𝑥]:𝑇 by 𝛽, closure of the relation under judgmental equality concludes. ◻
Proof. By lemma 49.31(b) with 𝑡=𝑢=𝑥, the identity substitution and the identity environment are related: Γ⊩𝑥∼𝜌Γ(𝑥):𝑆 for each (𝑥:𝑆)∈Γ. By lemma 49.32, Γ⊩𝑡∼[[𝑡]]𝜌Γ:𝑇; by lemma 49.31(a), Γ⊢𝑡≡↓𝑇Γ([[𝑡]]𝜌Γ):𝑇, which is the claim. ◻
The function type [[𝑆→𝑇]] lives in the constructive metatheory of convention 111.29. Evaluation represents its definable elements by finite closures containing a term body and an environment, and application runs a closure. Reification recurses on the finite object-language type, so normalization terminates on every typed input. A first-order implementation may defunctionalize those closures or use an untyped value domain with de Bruijn levels as in section 49.5; this changes the representation, not the effectivity claim. The algebraic formulation likewise uses only constructive metatheory.
★★★ Show that nf𝑇Γ(𝑣)=𝑣 for every Γ⊢𝑣𝗇𝖿𝑇, by mutual induction with the statement [[𝑢]]𝜌Γ=↑𝑇Γ(𝑢) for Γ⊢𝑢𝗇𝖾𝑇. Conclude that normal forms are canonical representatives: each judgmental equality class contains exactly one normal form.
★★★ Extend definition 49.24, definition 49.25 to 𝜆→ with 𝟐 and its non-dependent recursor: take [[𝟐]](Γ):={𝗍𝗍,𝖿𝖿}∪{𝑢∣Γ⊢𝑢𝗇𝖾𝟐}, define the semantic recursor by cases, and verify the two computation-rule cases in the proof of theorem 49.29.
The simply-typed construction of section 49.4 is complete, and the temptation is to replay it one step at a time. Two plausible first attempts are written out here, because each failure fixes a feature of the construction that follows.
First attempt: rewrite, then expand.
The first strategy a reader is likely to try is the one that works for untyped 𝛽-reduction: contract redexes until none remains, then 𝜂-expand the result. Write rw for that two-phase procedure. Three separate things go wrong, and only the first is the expected one.
The termination of the rewriting phase is the theorem being proved, so rw cannot be used to prove it. That objection is familiar and by itself would leave the design intact.
The second failure is fatal to the phase separation. Expanding after rewriting requires knowing, for each subterm, whether its type is a Π-type, and the type is itself a term that must be computed first. In the context Γ0:=(𝑋:U0,𝑛:ℕ),𝑇:=𝗂𝗇𝖽ℕ(𝑥.U0;𝟐,𝜆𝑘.𝜆𝑟.𝟐⟶𝑟,𝑛), the type 𝑇 is a Π-type when 𝑛 is a positive numeral and 𝟐 when 𝑛 is 𝟢; at 𝗌𝗎𝖼(𝗌𝗎𝖼(𝟢)) it is a Π-type of arity two. A variable 𝑓:𝑇 must be expanded to 𝜆(𝑦1:𝟐).𝜆(𝑦2:𝟐).𝑓𝑦1𝑦2 in the third case and left alone in the first, and rw can learn which only by running the same computation on the type. So the expansion phase is not after the rewriting phase; it is interleaved with it.
The third failure kills the expansion phase outright. At 𝟏, rule 𝟏-𝜂 is not an expansion: it replaces every term by ⋆. In Γ0,𝑢:𝟏 the raw variable 𝑢 must normalize to ⋆, while in Γ0,𝑢:𝟐 the same raw variable must normalize to 𝑢. No function of the raw term alone returns both answers, so rw cannot even be given the right type. What survives is: computation and 𝜂 must be performed by one operation, and that operation must receive the type.
Second attempt: induction on the typing derivation.
Repair the interface, then, and define a normal form N(D) by structural induction on a derivation D of Γ⊢𝑎:𝐴, in the hope of proving Γ⊢N(D)𝗇𝖿𝐴 and Γ⊢𝑎≡N(D):𝐴 at the same time. The constructor cases go through. The application case does not. Its premises give Γ⊢N(D𝑓)𝗇𝖿∏𝜖,𝜚𝑥:𝐴𝐵,Γ⊢N(D𝑎)𝗇𝖿𝐴, and by nf-lam the first is 𝜆𝜖,𝜚(𝑥:𝐴).𝑣 for some normal 𝑣. The normal form of 𝑓𝜖,𝜚𝑎 should then be the normal form of 𝑣[N(D𝑎)/𝑥]—but that expression is not a subderivation of D, and it is not smaller in any measure the induction has. Substituting a normal term into a normal term creates new redexes, which is precisely the phenomenon the theorem is about.
The repair is the one already used twice in this book, in section 49.2 and in definition 49.30: do not induct on the derivation for the conclusion you want; induct on the type for a stronger, hereditary statement, and derive the conclusion. The statement must, however, be strong enough in two directions that the elementary assignment of definition 49.9 is not.
First, it must be indexed by a context and stable under extending it. The assignment (−)∙ evaluates a term at a closing instantiation, and Γ∙ contains only closed terms. Under nf-lam the body must be normalized in Γ,𝑥:𝐴, where no closing instantiation for 𝑥 exists and none can be manufactured: in 𝑇𝗂𝗆𝗉𝗅 the type 𝐴 may be a variable of U0, which has no closed inhabitant at all. Hence the predicate is indexed by Δ⊵Γ and its evidence restricts along extensions, exactly as [[𝑆⟶𝑇]] was in definition 49.24.
The type index cannot be a syntactic type. In the failed first attempt the classifier 𝑇 had to be computed before its shape was visible; so the recursion must be on the value of the type, computed by the same evaluator that computes values of terms. Together with stability under context extension and the strict universes, this forces a semantic type to carry three pieces of data at once: a value that classifies computation, a ranked element relation, and restriction maps along context embeddings. A plain value, a plain predicate, or a family without restriction maps loses one of these three requirements.
Values, evaluation, and readback for the kernel signature
Both failures of section 111.6 asked for the same thing: one operation that computes and 𝜂-expands together, directed by the value of the classifier. This section builds the operation. It is an algorithm and nothing more; not one of its clauses is justified until section 111.9.
Use finite closures rather than a mixed-variance domain equation. Values, neutral values, environments, and closures are the least mutually inductive sets generated below. An environment is a finite list of values. A closure of arity 𝑟 is either ⟨𝜌;𝑥1,…,𝑥𝑟.𝑏⟩or𝗅𝗂𝖿𝗍𝖼𝗅𝜆(𝜒)or𝗌𝗍𝖾𝗉𝖼𝗅1(𝐹)or𝗌𝗍𝖾𝗉𝖼𝗅2(𝐹,𝑑), where 𝑏 is raw syntax, 𝜌 is an environment, and 𝜒 has arity 𝑟. The second form is used only for the codomain of a lifted type former; the last two are the finite closure tags for the derived natural-step type. Thus closures contain syntax and finite data; they do not contain set-theoretic functions. 𝐷∋𝑑,𝑒,A,C::=𝗅𝖺𝗆𝜖,𝜚(𝜒)∣𝖾𝗍𝖺𝜖,𝜚(𝑘;A;𝜒)::=∣𝗉𝖺𝗂𝗋(𝑑,𝑒)∣̂⋆∣̂𝗍𝗍∣̂𝖿𝖿::=∣̂𝟢∣̂𝗌𝗎𝖼(𝑑)∣̂𝗋𝖾𝖿𝗅(𝑑)::=∣̂𝗏𝗇𝗂𝗅∣̂𝗏𝖼𝗈𝗇𝗌(𝑑,𝑒,𝑑′)::=∣̂Π𝜖,𝜚(A,𝐹)∣̂Σ(A,𝐹)∣̂𝟏∣̂𝟐∣̂ℕ::=∣̂𝖨𝖽(A,𝑑,𝑒)∣̂𝖵𝖾𝖼(C,𝑑)::=∣̂U𝜆∣̂𝖫𝗂𝖿𝗍𝜆(C)∣𝗎𝗉A(𝑘),𝐷ne∋𝑘::=𝗑𝑚∣𝖺𝗉𝗉𝜖,𝜚(𝑘;A;𝑑)::=∣𝖿𝗌𝗍(𝑘)∣𝗌𝗇𝖽(𝑘)::=∣̂𝗂𝗇𝖽𝟐(𝐹;𝑑𝑡;𝑑𝑓;𝑘)∣̂𝗂𝗇𝖽ℕ(𝐹;𝑑0;𝑑𝑠;𝑘)::=∣̂𝖩(𝜗;𝑘)::=∣̂𝗏𝗂𝗇𝖽(V;𝜍;𝑑𝑚;𝑘). In ̂Π, ̂Σ and in the two inductive eliminator nodes, 𝐹 is an arity-one closure; in ̂𝖩, 𝐹 has arity three and 𝑔 arity one; in ̂𝗏𝗂𝗇𝖽, 𝐹 has arity two and 𝐺 arity four, matching the binders in convention 111.16. Closure execution is the least relation 𝜒@(𝑑1,…,𝑑𝑟)⇓𝑒 with rules
𝜌,𝑑1,…,𝑑𝑟⊢𝑏⇓𝑒
⟨𝜌;𝑥1,…,𝑥𝑟.𝑏⟩@(𝑑1,…,𝑑𝑟)⇓𝑒
Clos-Raw
𝜒@⃗𝑑⇓𝑒̂𝗅𝗂𝖿𝗍𝜆(𝑒)=𝑒′
𝗅𝗂𝖿𝗍𝖼𝗅𝜆(𝜒)@⃗𝑑⇓𝑒′
Clos-Lift
𝐹@𝑑⇓C
𝗌𝗍𝖾𝗉𝖼𝗅1(𝐹)@𝑑⇓̂Π𝖾𝗑𝗉,𝗋𝗎𝗇𝗍𝗂𝗆𝖾(C,𝗌𝗍𝖾𝗉𝖼𝗅2(𝐹,𝑑))
Clos-Step-1
𝐹@̂𝗌𝗎𝖼(𝑑)⇓C
𝗌𝗍𝖾𝗉𝖼𝗅2(𝐹,𝑑)@𝑒⇓C
Clos-Step-2
The evaluation, semantic-operation, and reflection judgments used in these premises are printed in definition 111.44, definition 111.45, definition 49.37. The four definitions are one simultaneous least graph; the forward presentation only keeps the clause tables readable. It is positive: every recursive occurrence is a premise of a rule, never the domain of a stored function. When the graph has the unique output 𝑒, write 𝜒(⃗𝑑)=𝑒.
The grammar just displayed is the raw representation. Mathematically, identify two raw values when no finite execution context built from these graph rules and ending in a constructor or neutral readback distinguishes them. This contextual equivalence is, by its definition, an equivalence and a congruence for every displayed constructor and graph rule; its quotient is a set because the raw grammar is a set. In particular, ⟨𝜌;𝑥.𝑏[𝛾]⟩ and ⟨[[𝛾]]𝜌;𝑥.𝑏⟩ have the same execution behavior, by rule induction. Below 𝐷 denotes this quotient. An implementation keeps the finite representatives; the quotient is used only to state substitution and weakening without choosing a closure representation.
To keep the displays below readable, abbreviate the two parameter blocks that never change during an elimination: 𝜗:=(A;𝐹;𝑔;𝑑𝑎;𝑑𝑏),𝜍:=(𝐹;𝑑0;𝐺), A stuck identity node is then written ̂𝖩(𝜗;𝑘) and a stuck vector node ̂𝗏𝗂𝗇𝖽(V;𝜍;𝑑𝑚;𝑘).
The field V is the semantic vector type stored in the 𝗎𝗉 node of the neutral principal argument. It is the only place from which readback can recover the element code, and definition 111.44 is arranged so that it is always available there.
The subscript 𝑚 of 𝗑𝑚 is a de Bruijn level. The subscripts 𝜆 on ̂U𝜆 and ̂𝖫𝗂𝖿𝗍𝜆 are canonical symbolic level normal forms from definition 111.18; no assignment to an external level parameter is stored in a value.
Application, projection, the four eliminators, and lifting act on values as follows. The equations present the clauses of least evaluation graphs; a case not listed has no derivation. In particular, they do not assert total set functions on arbitrary values. 𝗅𝖺𝗆𝜖,𝜚(𝜒)⋅𝜖,𝜚𝑑:=𝑒(𝜒@𝑑⇓𝑒),𝖾𝗍𝖺𝜖,𝜚(𝑘;A;𝐹)⋅𝜖,𝜚𝑑:=↑𝐹(𝑑)(𝖺𝗉𝗉𝜖,𝜚(𝑘;A;𝑑)),𝗎𝗉̂Π𝜖,𝜚(A,𝐹)(𝑘)⋅𝜖,𝜚𝑑:=𝗎𝗉𝐹(𝑑)(𝖺𝗉𝗉𝜖,𝜚(𝑘;A;𝑑)),𝖿𝗌𝗍𝗏(𝗉𝖺𝗂𝗋(𝑑,𝑒)):=𝑑,𝖿𝗌𝗍𝗏(𝗎𝗉̂Σ(A,𝐹)(𝑘)):=𝗎𝗉A(𝖿𝗌𝗍(𝑘)),𝗌𝗇𝖽𝗏(𝗉𝖺𝗂𝗋(𝑑,𝑒)):=𝑒,𝗌𝗇𝖽𝗏(𝗎𝗉̂Σ(A,𝐹)(𝑘)):=𝗎𝗉𝐹(𝑑1)(𝗌𝗇𝖽(𝑘)),:=𝑑1:=𝗎𝗉A(𝖿𝗌𝗍(𝑘)).𝗂𝖿𝗏(𝐹;𝑑𝑡;𝑑𝑓;̂𝗍𝗍):=𝑑𝑡,𝗂𝖿𝗏(𝐹;𝑑𝑡;𝑑𝑓;̂𝖿𝖿):=𝑑𝑓,𝗂𝖿𝗏(𝐹;𝑑𝑡;𝑑𝑓;𝗎𝗉̂𝟐(𝑘)):=𝗎𝗉𝐹(𝗎𝗉̂𝟐(𝑘))(̂𝗂𝗇𝖽𝟐(𝐹;𝑑𝑡;𝑑𝑓;𝑘)),𝗋𝖾𝖼𝗏(𝐹;𝑑0;𝑑𝑠;̂𝟢):=𝑑0,𝗋𝖾𝖼𝗏(𝐹;𝑑0;𝑑𝑠;̂𝗌𝗎𝖼(𝑑)):=𝑑𝑠⋅𝑑⋅𝗋𝖾𝖼𝗏(𝐹;𝑑0;𝑑𝑠;𝑑),𝗋𝖾𝖼𝗏(𝐹;𝑑0;𝑑𝑠;𝗎𝗉̂ℕ(𝑘)):=𝗎𝗉𝐹(𝗎𝗉̂ℕ(𝑘))(̂𝗂𝗇𝖽ℕ(𝐹;𝑑0;𝑑𝑠;𝑘)),𝗃𝗏(𝜗;̂𝗋𝖾𝖿𝗅(𝑑)):=𝑔(𝑑),𝗃𝗏(𝜗;𝗎𝗉I(𝑘)):=𝗎𝗉𝐹(𝑑𝑎,𝑑𝑏,𝗎𝗉I(𝑘))(̂𝖩(𝜗;𝑘)). The two applications in the ̂𝗌𝗎𝖼 clause are ⋅𝖾𝗑𝗉,𝗋𝗎𝗇𝗍𝗂𝗆𝖾, because 𝖲𝗍𝖾𝗉ℕ(𝐶) of definition 28.21 is the explicit, runtime-relevant product in 𝑇𝗂𝗆𝗉𝗅. The vector eliminator takes its motive 𝐹 of two arguments and its successor branch 𝐺 of four, and inspects its vector argument first: 𝗏𝗋𝗏(𝜍;𝑑𝑚;𝗎𝗉V(𝑘)):=𝗎𝗉𝐹(𝑑𝑚,𝗎𝗉V(𝑘))(̂𝗏𝗂𝗇𝖽(V;𝜍;𝑑𝑚;𝑘)),𝗏𝗋𝗏(𝜍;̂𝟢;̂𝗏𝗇𝗂𝗅):=𝑑0,𝗏𝗋𝗏(𝜍;̂𝗌𝗎𝖼(𝑚);̂𝗏𝖼𝗈𝗇𝗌(𝑚,𝑎,𝑥𝑠)):=𝐺(𝑚,𝑎,𝑥𝑠,𝗏𝗋𝗏(𝜍;𝑚;𝑥𝑠)). Only the first clause builds a stuck node, and it is reached only when the vector value is neutral, in which case that value carries its own semantic type V; no external argument is needed. A stuck node whose index is neutral while its vector is a constructor never arises on a well-typed input, because the element relation at a vector type of neutral length contains only neutral values (definition 111.58); on any other input no rule applies. Lifting is ̂𝗅𝗂𝖿𝗍𝜆(𝐾):=𝐾(𝐾∈{̂𝟏,̂𝟐,̂ℕ}),̂𝗅𝗂𝖿𝗍𝜆(̂U𝜇):=̂U𝜇,̂𝗅𝗂𝖿𝗍𝜆(̂Π𝜖,𝜚(A,𝐹)):=̂Π𝜖,𝜚(̂𝗅𝗂𝖿𝗍𝜆A,𝗅𝗂𝖿𝗍𝖼𝗅𝜆(𝐹)),̂𝗅𝗂𝖿𝗍𝜆(̂Σ(A,𝐹)):=̂Σ(̂𝗅𝗂𝖿𝗍𝜆A,𝗅𝗂𝖿𝗍𝖼𝗅𝜆(𝐹)),̂𝗅𝗂𝖿𝗍𝜆(̂𝖨𝖽(A,𝑑,𝑒)):=̂𝖨𝖽(̂𝗅𝗂𝖿𝗍𝜆A,𝑑,𝑒),̂𝗅𝗂𝖿𝗍𝜆(C):=̂𝖫𝗂𝖿𝗍𝜆(C), in the three remaining cases C=̂𝖵𝖾𝖼(−,−), C=̂𝖫𝗂𝖿𝗍𝑗(−), and C=𝗎𝗉̂U𝑗(−). These are exactly the five contraction instances of definition 111.20 together with the two stuck shapes of remark 111.21.
An environment is a finite list 𝜌 of values. The judgment 𝜌⊢𝑎⇓𝑑 is the least evaluation relation generated by the following clauses together with the closure-execution and semantic- operation clauses of definition 49.36, definition 111.44. We write [[𝑎]]𝜌=𝑑 only when a derivation of that judgment has been fixed. No clause consults a typing derivation. [[𝑥𝑗]]𝜌:=𝜌(𝑗),[[Uℓ]]𝜌:=̂U⌈ℓ⌉,[[𝖫𝗂𝖿𝗍ℓ(𝑎)]]𝜌:=̂𝗅𝗂𝖿𝗍⌈ℓ⌉([[𝑎]]𝜌),[[𝟏]]𝜌:=̂𝟏,[[𝟐]]𝜌:=̂𝟐,[[ℕ]]𝜌:=̂ℕ,[[⋆]]𝜌:=̂⋆,[[𝗍𝗍]]𝜌:=̂𝗍𝗍,[[𝖿𝖿]]𝜌:=̂𝖿𝖿,[[𝟢]]𝜌:=̂𝟢,[[𝗌𝗎𝖼(𝑎)]]𝜌:=̂𝗌𝗎𝖼([[𝑎]]𝜌),[[𝗋𝖾𝖿𝗅𝑎]]𝜌:=̂𝗋𝖾𝖿𝗅([[𝑎]]𝜌),[[∏𝜖,𝜚𝑥:𝐴𝐵]]𝜌:=̂Π𝜖,𝜚([[𝐴]]𝜌,⟨𝜌;𝑥.𝐵⟩),[[∑𝑥:𝐴𝐵]]𝜌:=̂Σ([[𝐴]]𝜌,⟨𝜌;𝑥.𝐵⟩),[[𝜆𝜖,𝜚(𝑥:𝐴).𝑏]]𝜌:=𝗅𝖺𝗆𝜖,𝜚(⟨𝜌;𝑥.𝑏⟩),[[𝑎𝜖,𝜚𝑏]]𝜌:=[[𝑎]]𝜌⋅𝜖,𝜚[[𝑏]]𝜌,[[(𝑎,𝑏)]]𝜌:=𝗉𝖺𝗂𝗋([[𝑎]]𝜌,[[𝑏]]𝜌),[[𝗉𝗋1(𝑎)]]𝜌:=𝖿𝗌𝗍𝗏([[𝑎]]𝜌),[[𝗉𝗋2(𝑎)]]𝜌:=𝗌𝗇𝖽𝗏([[𝑎]]𝜌),[[𝖨𝖽𝐴(𝑎,𝑏)]]𝜌:=̂𝖨𝖽([[𝐴]]𝜌,[[𝑎]]𝜌,[[𝑏]]𝜌),[[𝖵𝖾𝖼(𝐴,𝑛)]]𝜌:=̂𝖵𝖾𝖼([[𝐴]]𝜌,[[𝑛]]𝜌),[[𝗏𝗇𝗂𝗅]]𝜌:=̂𝗏𝗇𝗂𝗅,[[𝗏𝖼𝗈𝗇𝗌(𝑛,𝑎,𝑥𝑠)]]𝜌:=̂𝗏𝖼𝗈𝗇𝗌([[𝑛]]𝜌,[[𝑎]]𝜌,[[𝑥𝑠]]𝜌). The four eliminators evaluate to the corresponding semantic operation. Each motive and each multiple binder becomes a finite closure of the displayed arity: [[𝗂𝗇𝖽𝟐(𝑥.𝐶;𝑐𝑡,𝑐𝑓,𝑏)]]𝜌:=𝗂𝖿𝗏(⟨𝜌;𝑥.𝐶⟩;[[𝑐𝑡]]𝜌;[[𝑐𝑓]]𝜌;[[𝑏]]𝜌),[[𝗂𝗇𝖽ℕ(𝑥.𝐶;𝑐0,𝑐𝑠,𝑚)]]𝜌:=𝗋𝖾𝖼𝗏(⟨𝜌;𝑥.𝐶⟩;[[𝑐0]]𝜌;[[𝑐𝑠]]𝜌;[[𝑚]]𝜌),[[𝖩𝐴;𝑎;𝑏(𝑥.𝑦.𝑝.𝐶;𝑧.𝑐;𝑞)]]𝜌:=𝗃𝗏(𝜗𝜌;[[𝑞]]𝜌),[[𝗏𝗂𝗇𝖽(M;𝑝0;S;𝑚,𝑦𝑠)]]𝜌:=𝗏𝗋𝗏(𝜍𝜌;[[𝑚]]𝜌;[[𝑦𝑠]]𝜌), where the two parameter blocks are 𝜗𝜌:=([[𝐴]]𝜌;𝐹𝐶;𝑔𝑐;[[𝑎]]𝜌;[[𝑏]]𝜌),𝜍𝜌:=(𝐹𝑃;[[𝑝0]]𝜌;𝐺𝑝𝑠),𝐹𝐶:=⟨𝜌;𝑥,𝑦,𝑝.𝐶⟩,𝑔𝑐:=⟨𝜌;𝑧.𝑐⟩,𝐹𝑃:=⟨𝜌;𝑚,𝑦𝑠.𝑃⟩,𝐺𝑝𝑠:=⟨𝜌;𝑚,𝑎,𝑥𝑠,𝑖ℎ.𝑝𝑠⟩.
The graphs are deterministic. Simultaneous rule induction on evaluation, closure execution, and the semantic-operation graphs proves that two derivations with the same inputs have the same final constructor and then the same output by their induction hypotheses. They are intentionally partial on raw input. Their definedness on every well-typed input is proved by lemma 111.74, not assumed in this definition. Readback runs in the other direction and is indexed by a de Bruijn level 𝑛, the number of variables already introduced.
Fix a context Δ=(𝑥0:𝐴0,…,𝑥𝑛−1:𝐴𝑛−1) and read the level 𝗑𝑚 as the variable 𝑥𝑚. Reflection, reification, type quotation, code quotation, and neutral readback are the least mutually inductive graphs generated by the following clauses. Recursive calls in an equation are premises of its graph rule; the display does not assert a total recursive function on arbitrary values. Write 𝗏A𝑛:=↑A(𝗑𝑛) for the unique output when that graph is defined. Definedness and uniqueness on related inputs are proved in lemma 111.63.
Reflection 𝜂-expands at the three uniqueness formers and stops elsewhere: ↑̂Π𝜖,𝜚(A,𝐹)(𝑘):=𝖾𝗍𝖺𝜖,𝜚(𝑘;A;𝐹),↑̂Σ(A,𝐹)(𝑘):=𝗉𝖺𝗂𝗋(𝑑1,↑𝐹(𝑑1)(𝗌𝗇𝖽(𝑘))),𝑑1:=↑A(𝖿𝗌𝗍(𝑘)),↑̂𝟏(𝑘):=̂⋆,↑A(𝑘):=𝗎𝗉A(𝑘)foreveryotherheadA. Reification is the mirror image: ↓𝑛̂Π𝜖,𝜚(A,𝐹)(𝑑):=𝜆𝜖,𝜚(𝑥𝑛:𝖰𝑛(A)).↓𝑛+1𝐹(𝗏A𝑛)(𝑑⋅𝜖,𝜚𝗏A𝑛),↓𝑛̂Σ(A,𝐹)(𝑑):=(↓𝑛A(𝑑1),↓𝑛𝐹(𝑑1)(𝗌𝗇𝖽𝗏(𝑑))),𝑑1:=𝖿𝗌𝗍𝗏(𝑑),↓𝑛̂𝟏(𝑑):=⋆,↓𝑛̂𝟐(̂𝗍𝗍):=𝗍𝗍,↓𝑛̂𝟐(̂𝖿𝖿):=𝖿𝖿,↓𝑛̂ℕ(̂𝟢):=𝟢,↓𝑛̂ℕ(̂𝗌𝗎𝖼(𝑑)):=𝗌𝗎𝖼(↓𝑛̂ℕ(𝑑)),↓𝑛̂𝖨𝖽(A,𝑑𝑎,𝑑𝑏)(̂𝗋𝖾𝖿𝗅(𝑑)):=𝗋𝖾𝖿𝗅↓𝑛A(𝑑),↓𝑛̂𝖵𝖾𝖼(C,𝑑𝑚)(̂𝗏𝗇𝗂𝗅):=𝗏𝗇𝗂𝗅,↓𝑛̂𝖵𝖾𝖼(C,𝑑𝑚)(̂𝗏𝖼𝗈𝗇𝗌(𝑚,𝑎,𝑥𝑠)):=𝗏𝖼𝗈𝗇𝗌(↓𝑛̂ℕ(𝑚),↓𝑛C(𝑎),↓𝑛̂𝖵𝖾𝖼(C,𝑚)(𝑥𝑠)),↓𝑛̂U𝑖(C):=𝖰𝖼𝑛(C),↓𝑛A(𝗎𝗉B(𝑘)):=𝖱𝑛(𝑘)forApositive. Every annotation the output stores—the 𝜆-domain, the 𝗋𝖾𝖿𝗅 argument, the 𝗏𝖼𝗈𝗇𝗌 index—is itself produced by 𝖰𝑛 or ↓𝑛, never copied from the input. That is what makes an 𝛼-comparison of outputs meaningful: two judgmentally equal inputs whose annotations differ, such as 𝜆(𝑥:𝖫𝗂𝖿𝗍0ℕ).𝑥 and 𝜆(𝑥:ℕ).𝑥, receive the same normal form because both domains are requoted from the same semantic value.
Type quotation deletes lifts, because Lift-El makes 𝖫𝗂𝖿𝗍ℓ𝐴 the type 𝐴; code quotation keeps them: 𝖰𝑛(̂𝖫𝗂𝖿𝗍𝜆(C)):=𝖰𝑛(C),𝖰𝖼𝑛(̂𝖫𝗂𝖿𝗍𝜆(C)):=𝖫𝗂𝖿𝗍𝜆(𝖰𝖼𝑛(C)),𝖰𝑛(̂U𝜆):=U𝜆,𝖰𝖼𝑛(̂U𝜆):=U𝜆,𝖰𝑛(𝐾):=𝐾,𝖰𝖼𝑛(𝐾):=𝐾(𝐾∈{𝟏,𝟐,ℕ}),𝖰𝑛(𝗎𝗉̂U𝑖(𝑘)):=𝖱𝑛(𝑘),𝖰𝖼𝑛(𝗎𝗉̂U𝑖(𝑘)):=𝖱𝑛(𝑘), and on the four structured heads both operations descend, writing 𝖰♯ uniformly for either of them: 𝖰♯𝑛(̂Π𝜖,𝜚(A,𝐹)):=∏𝜖,𝜚𝑥𝑛:𝖰♯𝑛(A)𝖰♯𝑛+1(𝐹(𝗏A𝑛)),𝖰♯𝑛(̂Σ(A,𝐹)):=∑𝑥𝑛:𝖰♯𝑛(A)𝖰♯𝑛+1(𝐹(𝗏A𝑛)),𝖰♯𝑛(̂𝖨𝖽(A,𝑑,𝑒)):=𝖨𝖽𝖰♯𝑛(A)(↓𝑛A(𝑑),↓𝑛A(𝑒)),𝖰♯𝑛(̂𝖵𝖾𝖼(C,𝑑)):=𝖵𝖾𝖼(𝖰𝖼𝑛(C),↓𝑛̂ℕ(𝑑)). The vector clause uses 𝖰𝖼 in both readings, which is what remark 111.21 forces: the element of a vector type is a code, and no equation moves a lift across 𝖵𝖾𝖼.
Neutral readback rebuilds the syntactic elimination, reading back the principal argument and reifying every stored argument at the semantic type under which it was stored: 𝖱𝑛(𝗑𝑚):=𝑥𝑚,𝖱𝑛(𝖺𝗉𝗉𝜖,𝜚(𝑘;A;𝑑)):=𝖱𝑛(𝑘)𝜖,𝜚↓𝑛A(𝑑),𝖱𝑛(𝖿𝗌𝗍(𝑘)):=𝗉𝗋1(𝖱𝑛(𝑘)),𝖱𝑛(𝗌𝗇𝖽(𝑘)):=𝗉𝗋2(𝖱𝑛(𝑘)),𝖱𝑛(̂𝗂𝗇𝖽𝟐(𝐹;𝑑𝑡;𝑑𝑓;𝑘)):=𝗂𝗇𝖽𝟐(𝑥𝑛.𝖰𝑛+1(𝐹(𝗏̂𝟐𝑛));:=↓𝑛𝐹(̂𝗍𝗍)(𝑑𝑡),↓𝑛𝐹(̂𝖿𝖿)(𝑑𝑓),𝖱𝑛(𝑘)),𝖱𝑛(̂𝗂𝗇𝖽ℕ(𝐹;𝑑0;𝑑𝑠;𝑘)):=𝗂𝗇𝖽ℕ(𝑥𝑛.𝖰𝑛+1(𝐹(𝗏̂ℕ𝑛));:=↓𝑛𝐹(̂𝟢)(𝑑0),↓𝑛S(𝐹)(𝑑𝑠),𝖱𝑛(𝑘)),𝖱𝑛(̂𝖩(𝜗;𝑘)):=𝖩𝖰𝑛(A);𝑣𝑎;𝑣𝑏(M𝖩;S𝖩;𝖱𝑛(𝑘)),𝑣𝑎:=↓𝑛A(𝑑𝑎),𝑣𝑏:=↓𝑛A(𝑑𝑏),M𝖩:=𝑥𝑛.𝑥𝑛+1.𝑥𝑛+2.𝖰𝑛+3(𝐹(𝑤0,𝑤1,𝑤2)),S𝖩:=𝑥𝑛.↓𝑛+1𝐹(𝑤,𝑤,̂𝗋𝖾𝖿𝗅(𝑤))(𝑔(𝑤)), with 𝑤:=𝗏A𝑛, with 𝑤0,𝑤1 the reflected variables of A at levels 𝑛,𝑛+1 and 𝑤2:=𝗏̂𝖨𝖽(A,𝑤0,𝑤1)𝑛+2, and with the semantic value of 𝖲𝗍𝖾𝗉ℕ given by S(𝐹):=̂Π𝖾𝗑𝗉,𝗋𝗎𝗇𝗍𝗂𝗆𝖾(̂ℕ,𝗌𝗍𝖾𝗉𝖼𝗅1(𝐹)). Finally, for V=̂𝖵𝖾𝖼(C,𝑑′), 𝖱𝑛(̂𝗏𝗂𝗇𝖽(V;𝜍;𝑑𝑚;𝑘)):=𝗏𝗂𝗇𝖽(M𝗏;𝑣0;S𝗏;↓𝑛̂ℕ(𝑑𝑚),𝖱𝑛(𝑘)),M𝗏:=𝑥𝑛.𝑥𝑛+1.𝖰𝑛+2(𝐹(𝑎1,𝑎2)),𝑣0:=↓𝑛𝐹(̂𝟢,̂𝗏𝗇𝗂𝗅)(𝑑0),S𝗏:=𝑥𝑛.𝑥𝑛+1.𝑥𝑛+2.𝑥𝑛+3.↓𝑛+4F𝑠(𝐺(𝑏1,𝑏2,𝑏3,𝑏4)),F𝑠:=𝐹(̂𝗌𝗎𝖼(𝑏1),̂𝗏𝖼𝗈𝗇𝗌(𝑏1,𝑏2,𝑏3)), where 𝑎1:=𝗏̂ℕ𝑛, 𝑎2:=𝗏̂𝖵𝖾𝖼(C,𝑎1)𝑛+1, 𝑏1:=𝗏̂ℕ𝑛, 𝑏2:=𝗏C𝑛+1, 𝑏3:=𝗏̂𝖵𝖾𝖼(C,𝑏1)𝑛+2 and 𝑏4:=𝗏𝐹(𝑏1,𝑏3)𝑛+3. The element code C is read off the stored V; it is the only field of the node that does not also occur as an argument of 𝗏𝗋𝗏.
The identity environment of Δ is 𝜌Δ:=(↑[[𝐴0]]𝜌0(𝗑0),…), formed left to right so that 𝜌𝑗 is the prefix already built, and nf𝐴Δ(𝑎):=↓|Δ|[[𝐴]]𝜌Δ([[𝑎]]𝜌Δ),nfΔ(𝐴):=𝖰|Δ|([[𝐴]]𝜌Δ).
The level parameter of readback is not inert. Extending a context changes the fresh levels chosen under every binder, so the required weakening lemma must transport the readback graphs as well as the typing judgment.
A semantic telescope is built by Ψ::=⋅∣Ψ.A, where A may depend on the values assigned to the declarations of Ψ. Its length is |Ψ|. A semantic value, closure, environment, or ranked witness is Ψ-admissible when every free neutral level belongs to the initial segment 𝑗<|Ψ|, every such occurrence carries the classifier supplied by the 𝑗th declaration of Ψ, and every stored raw closure is closed by its displayed environment. Admissibility is formation data: every ranked construction below is defined relative to a displayed initial telescope Ψ. We do not first form an object with sparse levels and then compress those levels. Passage to a larger initial segment is an explicit typed target weakening, and passage through a binder is one of the typed extensions below. Thus no unclassified intermediate level is formed.
Write 𝐷Ψ⊆𝐷 for the set of Ψ-admissible values. When the ranked relations are introduced in definition 111.58, their membership judgment will have the support-explicit form 𝜂:(𝑑,𝑒)∈𝖤𝗅𝗍Ψ(𝛼). It is formable only when 𝛼 is formed at Ψ, when 𝑑,𝑒∈𝐷Ψ, and when the membership derivation 𝜂 is itself Ψ-admissible. Consequently membership at Ψ can never certify a value containing the fresh level |Ψ|; that value first belongs to the explicitly extended target world.
A semantic substitution𝜎:Ψ⇒Φ assigns a semantic value in 𝐷Φ to every declaration of the source telescope Ψ. Its typing witnesses, once the ranked relations have been constructed, require the 𝑗th assigned value to belong to the support-Φ element relation of the 𝑗th classifier after the preceding assignments. The untyped action graph on 𝐷 is determined by replacing level 𝑗 by that value and then executing every semantic operation. Thus a substituted neutral may compute. Closures are acted on through their stored environments.
One special action must remain distinct. If 𝜔:Ψ⇒Φ is an iterated typed target weakening and 𝑘∈𝐷ne is neutral syntax, then 𝜔∗𝑘 denotes the induced structural neutral weakening: it fixes each old level 𝑗<|Ψ| and recursively transports the stored semantic fields. It is not the action of an arbitrary semantic substitution on a bare neutral. The equivariance equations below relate structural neutral weakening to the semantic action on reflected values. In particular 𝜔∗𝑘 remains in 𝐷ne, so neutral readback at the target length is well formed.
The four operations below have different types and will not be denoted by one operation.
If 𝜎:Ψ⇒Φ, 𝑒∈𝐷Φ, and 𝑒 has the transported classifier 𝜎∗A at Φ, then (𝜎,𝑒):Ψ.A⇒Φ is arbitrary source extension.
If Φ.B is well formed, the weakening substitution 𝗐𝗄Φ,B:Φ⇒Φ.B sends each old declaration to its weakened semantic value. Hence 𝗐𝗄∘𝜎:Ψ⇒Φ.B is target weakening.
Put B:=𝜎∗A and 𝗏Φ,A:=↑(𝗐𝗄∘𝜎)∗A(𝗑|Φ|). The canonical lift is 𝜎↑:=(𝗐𝗄∘𝜎,𝗏Φ,A):Ψ.A⇒Φ.B. Here 𝗐𝗄Φ,B:Φ⇒Φ.B, whereas (𝗐𝗄∘𝜎)∗A is a classifier over Φ.B. It classifies the displayed fresh reflection, not the target declaration and not the bare neutral 𝗑|Φ|.
If 𝜏:Φ⇒Ξ, composition acts componentwise and arbitrary extension satisfies the typed equation 𝜏∘(𝜎,𝑒)=(𝜏∘𝜎,𝜏∗𝑒):Ψ.A⇒Ξ. Target weakening satisfies (𝗐𝗄∘𝜏)∘𝜎=𝗐𝗄∘(𝜏∘𝜎), and canonical lifts satisfy 𝜏↑∘𝜎↑=(𝜏∘𝜎)↑:Ψ.A⇒Ξ.((𝜏∘𝜎)∗A), where 𝜏↑:Φ.(𝜎∗A)⇒Ξ.(𝜏∗𝜎∗A).
The identity is defined recursively: 𝗂𝖽⋅:=(),𝗂𝖽Ψ.A:=(𝗐𝗄∘𝗂𝖽Ψ,↑𝗐𝗄∗A(𝗑|Ψ|)). For a syntactic weakening 𝜔:Δ↪Δ′, the corresponding semantic substitution is the iterated target weakening; write 𝜔∗𝑎 and 𝜔∗𝐽 for raw weakening and its action on a judgment. General semantic substitution has a raw action only when paired with a realizing raw substitution in definition 111.68. Action on ranked relation evidence requires the typed relational witness of definition 111.57.
Let 𝜎:Ψ⇒Φ and let all displayed inputs be Ψ-admissible. The following maps are defined and satisfy the displayed equations.
Evaluation, closure execution, application, projections, the four eliminators, and semantic lifting commute with 𝜎∗; for example,
𝜎∗(𝜒@⃗𝑑⇓𝑒):(𝜎∗𝜒)@(𝜎∗⃗𝑑)⇓𝜎∗𝑒. Moreover 𝗂𝖽∗=𝗂𝖽, (𝜏∘𝜎)∗=𝜏∗𝜎∗. Closure execution under an instantiated source binder uses (𝜎,𝑒) and equation 111.2; readback under a fresh target binder uses 𝜎↑ and equation 111.1.
Let 𝜔:Ψ⇒Φ be an iterated typed target weakening and put 𝑛=|Ψ|, 𝑛′=|Φ|. Reflection, reification, type quotation, code quotation, and neutral readback are equivariant: 𝜔∗↑A(𝑘)=↑𝜔∗A(𝜔∗𝑘),𝜔∗↓𝑛A(𝑑)=𝛼↓𝑛′𝜔∗A(𝜔∗𝑑),𝜔∗𝖰𝑛(A)=𝛼𝖰𝑛′(𝜔∗A),𝜔∗𝖰𝖼𝑛(C)=𝛼𝖰𝖼𝑛′(𝜔∗C),𝜔∗𝖱𝑛(𝑘)=𝛼𝖱𝑛′(𝜔∗𝑘).
If the same 𝜔 is induced by a syntactic weakening Δ↪Δ′ and 𝐽 is any typing, type-equality, term-equality, neutral, normal-term, normal-type, or normal-code judgment, then 𝜔∗𝐽 is derivable in the target world. Its type is the right-hand quotation in (2), not the untransported quotation at depth 𝑛.
Proof of Lemma 111.48 — Substitution and renaming equivariance
Proof. Prove (1) by simultaneous induction on the displayed graph. The variable case is the defining equation for 𝜎∗. A closure uses the induction hypothesis for its environment. An instantiated source binder uses equation 111.2; a fresh target binder uses the canonical lift of equation 111.1. The composition equations follow by a second induction on the same graph. In particular, target gap variables may occur in the substituted value 𝑒 and are retained on both sides.
For (2)–(3), specialize to iterated target weakening 𝜔. A raw closure uses the induction hypothesis for its environment and uses 𝜔↑ across each binder; Clos-Lift, Clos-Step-1, and Clos-Step-2 then commute with the corresponding semantic operation. Application and both projections use their immediate induction hypotheses. Boolean and natural elimination use the motive and branch hypotheses and preserve the constructor or stuck choice. Identity elimination transports the carrier, motive, branch, two endpoints, and principal neutral. Vector elimination transports its stored vector type, motive, base, successor method, index, and principal neutral. These are all semantic-operation rule families.
For (2), induction on the readback graph treats a binder by 𝜔↑; hence its freshly reflected value at the source classifier is sent to the freshly reflected value at the target classifier. The Π and Σ clauses therefore give alpha-equal binders and the induction hypothesis gives their dependent bodies. Identity and vector clauses use the reification and code- quotation hypotheses for every stored component. Each neutral eliminator uses the corresponding complete list from the preceding paragraph. The remaining clauses have no binder and follow structurally.
Finally weakening, alpha-conversion, and the equations of (2) prove (3), rule by rule for the seven named judgment forms. ◻
Every object in definition 49.36 is finite first-order data. Raw closures store a body and an environment; the other three closure tags perform the displayed lift and natural-step operations. Execution, evaluation, semantic operations, and readback are inductive graphs. Determinism is a simultaneous induction on their derivations. The finitely many multi-arity and derived tags are required by the 𝑇𝗂𝗆𝗉𝗅 binders.
That finite representation does not by itself prove definedness. Applying a raw closure runs an arbitrary body, and readback at ̂Π(A,𝐹) calls 𝐹 on a freshly reflected variable, so neither the value nor the level 𝑛 decreases. What does decrease is the ranked derivation of semantic typehood: every recursive call of ↓, ↑, 𝖰𝑛 and 𝖰𝖼𝑛 is at a semantic type named by a premise of the generator just used, and those premises are ordered by a well-founded multiset of symbolic-level heights followed by the Hessenberg sum of derivation ranks. The semantic-type construction below verifies strict descent for every clause. Neutral readback is the exception: it recurses on the structure of its neutral argument and reifies stored components at stored types that are not controlled by any ambient type. Definedness of 𝖱𝑛 on the neutral values that actually occur is therefore not assumed but proved, at the point where each such value is built, in lemma 111.74; it is exactly membership in the readback-defined field 𝐾Ψ, equivalently self-relatedness under ≈neΨ, of definition 111.52. Totality of nf on well-typed input is thus a theorem (theorem 111.76), not a property of the program text.
Let Δ0:=(𝑋:U0,𝑓:𝑋⟶𝑋,𝑢:𝟏), so |Δ0|=3 and, writing X:=𝗎𝗉̂U0(𝗑0), 𝜌Δ0=(X,↑̂Π(X,⟨(X);𝑥.𝑋⟩)(𝗑1),̂⋆). Then nf𝑋⟶𝑋Δ0(𝑓)=𝜆𝜖,𝜚(𝑥3:𝑋).𝑓𝜖,𝜚𝑥3,nf𝟏Δ0(𝑢)=⋆,nfΔ0(𝖫𝗂𝖿𝗍0(𝑋))=𝑋. The first is 𝜂-expansion produced by reflection, not by a rewriting step; the second is the collapse that defeated rw in section 111.6, and it happens because ↑̂𝟏 returns ̂⋆ before the variable is ever stored; the third deletes a lift because 𝖰𝑛 does, while nfU1Δ0(𝖫𝗂𝖿𝗍0(𝑋))=𝖫𝗂𝖿𝗍0(𝑋) keeps it, since the same value is read back there by 𝖰𝖼𝑛.
★★★ Reconstruct the Σ clauses of definition 49.36, definition 111.44, definition 111.45, definition 49.37 from the single requirement that readback be 𝜂-long: the values 𝗉𝖺𝗂𝗋(𝑑,𝑑′) and ̂Σ(𝐴,𝐹), the two semantic projections on a 𝗉𝖺𝗂𝗋 and on a neutral, the evaluation clauses, the reflection clause, and the reification clause ↓̂Σ(𝐴,𝐹)(𝑑)=(↓𝐴(𝑑1),↓𝐹(𝑑1)(𝑑2)), where 𝑑1,𝑑2 are the semantic projections of 𝑑. Then check both 𝛽-rules on a constructor pair and Σ-𝜂 on a reflected neutral.
Not every value is a type, and the values that are types must carry the data that readback consumes. Remark 49.10 already named the danger: if “A is a semantic type” were a mere property, a value could be a type in two ways and the recursion assigning it a set of elements would be ambiguous. The definition below therefore makes semantic typehood a proof-relevant relation and defines the elements by recursion on its derivations; lemma 111.62 then proves that the recursion is unambiguous after all.
Because the universes are strict, a level cannot be forgotten, and the construction is stratified twice: first the level-𝑖codes, whose level matters because U-Hier places U𝑗 in U𝑖 only for 𝑗≺𝑖; then the semantic types, in which a lift is invisible because Lift-El makes it so.
Section 111.8–Section 111.10 are carried out in ZFC. External level parameters remain formal. A subscript 𝑖,𝑗,𝜆 or 𝜇 below ranges over the canonical symbolic level forms of definition 111.18; 𝑖+1 means normalization after successor. Write 𝑖≺𝑗 when 𝑖<𝑗 under every assignment of the external parameters. Both equality and ≺ are decided on the symbolic forms by lemma 111.19. In particular, evaluation never chooses an ambient assignment and never replaces a symbolic level by a numeral.
The domain 𝐷 of definition 49.36 is a set. The proof-relevant code relations below are constructed as ranked well-founded trees, not postulated as an inductive–recursive type. Replacement therefore makes the relations and their element relations sets; no inaccessible cardinal is used.
Let 𝑘,𝑘′∈𝐷ne be Ψ-admissible. Write 𝑘≈neΨ𝑘′ when, for every iterated typed target weakening 𝜔:Ψ⇒Φ, there is a raw expression 𝑎 such that 𝖱|Φ|(𝜔∗𝑘)=𝑎and𝖱|Φ|(𝜔∗𝑘′)=𝑎. Graph determinism makes 𝑎 unique. Thus future readback depths occur only as the lengths of explicit future worlds.
The readback-defined field at Ψ is 𝐾Ψ:={𝑘∈𝐷ne∣𝑘isΨ-admissible,andforeveryiteratedtypedtargetweakening𝜔:Ψ⇒Φ,thereisan𝑎with𝖱|Φ|(𝜔∗𝑘)=𝑎}. Admissibility alone does not imply membership in 𝐾Ψ. The relation ≈neΨ is therefore treated as a partial equivalence relation on all Ψ-admissible neutrals, with field 𝐾Ψ, rather than as a reflexive relation on that entire set. When a ranked generator is displayed at support Ψ, an omitted subscript on ≈ne means Ψ.
Fix 𝜖=𝖾𝗑𝗉 and 𝜚=𝗋𝗎𝗇𝗍𝗂𝗆𝖾, and form the raw terms 𝐿:=𝜆𝜖,𝜚(𝑧:𝟏).𝑧𝜖,𝜚𝑧,Ω:=𝐿𝜖,𝜚𝐿. Put 𝐹𝟏:=⟨∅;𝑢.𝟏⟩,B:=̂Π𝜖,𝜚(̂𝟏,𝐹𝟏),𝑑:=𝗅𝖺𝗆𝜖,𝜚(⟨∅;𝑦.Ω⟩). Let Ψ:=⋅.̂Π𝜖,𝜚(B,𝐹𝟏),𝑘:=𝖺𝗉𝗉𝜖,𝜚(𝗑0;B;𝑑). The only free neutral of 𝑘 is 𝗑0, the stored domain is the domain of its classifier in Ψ, and both displayed raw closures are closed by their environments. Hence 𝑘 is Ψ-admissible.
At the identity weakening, 𝖱1(𝑘) requires ↓1B(𝑑). Product reification applies 𝑑 to the fresh reflected 𝟏 argument, so closure execution must evaluate Ω. No finite derivation does so: a derivation for 𝐿𝐿 would contain, below its two lambda evaluations, a strictly shorter derivation of the same closure application produced by the body 𝑧𝑧. Induction on derivation height rules out such a derivation. Therefore 𝑘∉𝐾Ψand𝑘≉neΨ𝑘. The example uses ill-typed raw syntax inside a closed closure. It does not challenge totality on well-typed inputs; it explains why every later neutral formation argument proves self-relatedness instead of appealing only to admissibility.
Proof of Lemma 111.54 — Neutral relatedness is a partial equivalence relation
Proof. For symmetry, fix 𝜔:Ψ⇒Φ and reverse the two equalities with their common readback output. For transitivity, suppose 𝑘0≈neΨ𝑘1 and 𝑘1≈neΨ𝑘2. At 𝜔, let 𝑎 be the common output for the first premise and 𝑏 the common output for the second. Determinism of the readback graph on 𝜔∗𝑘1 gives 𝑎=𝑏, so all three readbacks have one common output. Quantifying this construction over 𝜔 proves transitivity.
The definition of 𝑘≈neΨ𝑘 asks for exactly one defined readback after every typed target weakening; by graph determinism this is exactly 𝑘∈𝐾Ψ. Hence the restriction to 𝐾Ψ is reflexive, and the first part supplies symmetry and transitivity there. ◻
If 𝑗<|Ψ|, then 𝗑𝑗≈neΨ𝗑𝑗. If Ψ.A is well formed, then in particular 𝗑|Ψ|≈neΨ.A𝗑|Ψ|. More generally, take one of the seven nonvariable neutral constructors 𝖺𝗉𝗉,𝖿𝗌𝗍,𝗌𝗇𝖽,̂𝗂𝗇𝖽𝟐,̂𝗂𝗇𝖽ℕ,̂𝖩,̂𝗏𝗂𝗇𝖽. Two Ψ-admissible instances are related whenever their principal neutral fields are related at Ψ and, after every typed target weakening 𝜔:Ψ⇒Φ, each pair of transported semantic fields used by readback has defined, unique, equal quotation or reification output at depth |Φ| and at its displayed typed binder extensions.
Proof of Lemma 111.55 — World-indexed neutral formation
Proof. Fix 𝜔:Ψ⇒Φ. The variable equation is 𝖱|Φ|(𝜔∗𝗑𝑗)=𝜔∗𝑥𝑗. For application and the two projections, unfold their neutral-readback equations: the principal outputs agree by the neutral premise, and the application argument outputs agree by the transported stored-field premise. Boolean and natural elimination additionally use, in order, the motive, base branches, step branch, and principal hypotheses. Identity elimination uses the carrier, endpoints, three-variable motive, reflexivity branch, and principal hypotheses. Vector elimination uses the stored vector type, two-variable motive, base, four-variable successor method, index, and principal hypotheses. Thus both readback graphs have one common output at the exact target depth |Φ|; graph determinism makes it unique. Quantifying over typed future worlds Φ is exactly definition 111.52. ◻
Proof of Lemma 111.56 — World equivariance of neutral relatedness
Proof. Given a further typed weakening 𝜏:Φ⇒Ξ, apply the defining condition at 𝜏∘𝜔:Ψ⇒Ξ. Functoriality identifies its two inputs with 𝜏∗(𝜔∗𝑘) and 𝜏∗(𝜔∗𝑘′). Their readbacks at the exact depth |Ξ| have the same unique output, which is the defining condition at Φ. ◻
Every ranked code or semantic-type derivation is formed at a finite support telescopeΨ. Its declarations classify the endpoints, closure fields, and ranked premises as they are introduced, and its levels are the initial segment 0,…,|Ψ|−1. Support is not reconstructed from an erased derivation. Write 𝛼@Ψ to retain this formation index. Given 𝛼:A≈𝑖A′@Ψ,𝐹,𝐹′:𝐷→𝐷, a relational support telescope𝚿 consists of two endpoint telescopes with the same finite variable positions and ranked relatedness evidence for corresponding classifiers. Its extension 𝚿.𝛼 has endpoint telescopes Ψ.A and Ψ.A′ and uses 𝛼 as its final classifier relation. A relational world substitution for this data is a pair 𝝈=(𝜎0,𝜎1;𝑞):𝚿⇒𝚽 of telescope-indexed semantic substitutions together with ranked witnesses 𝑞 showing, declaration by declaration, that the two assigned values lie in the transported element relation of that declaration. Its action on 𝛼 is written 𝝈∗𝛼 and has endpoints 𝜎0∗A and 𝜎1∗A′. Its operations are: The identity 𝗂𝖽𝚿:𝚿⇒𝚿 has the recursively reflected components of definition 111.47. Put 𝜷:=𝝈∗𝛼. Target weakening is 𝗐𝗄∘𝝈:𝚿⇒𝚽.𝜷. The canonical fresh lift has type 𝝈↑:𝚿.𝛼⇒𝚽.𝜷. Its final pair is classified by (𝗐𝗄∘𝝈)∗𝛼 over the already-extended target 𝚽.𝜷. Thus the relation classifying the fresh pair is not the declaration used to extend 𝚽. If 𝜁:(𝑑,𝑒)∈𝖤𝗅𝗍Φ(𝝈∗𝛼), binder extension is the distinct operation (𝝈,𝑑,𝑒;𝜁):𝚿.𝛼⇒𝚽. It adjoins (𝑑,𝑒;𝜁) to 𝑞 without weakening the target. Formation of 𝜁 gives 𝑑,𝑒∈𝐷Φ, so arbitrary variables of Φ may occur in 𝑑,𝑒, but no level outside Φ may occur. Composition is typed by 𝝉∘(𝝈,𝑑,𝑒;𝜁)=(𝝉∘𝝈,𝜏0∗𝑑,𝜏1∗𝑒;𝝉∗𝜁), which is the relational instance of equation 111.2. Canonical lift is used only when a fresh target declaration is introduced.
A natural dependent-family premise𝛽 assigns, to every relational world substitution 𝝈:𝚿⇒𝚽 and every ranked witness 𝜁:(𝑑,𝑒)∈𝖤𝗅𝗍Φ(𝝈∗𝛼), a ranked derivation 𝛽𝝈,𝜁:(𝜎0∗𝐹)(𝑑)≈𝑖(𝜎1∗𝐹′)(𝑒)@Φ.(111.2) It also carries the naturality equation 𝝉∗(𝛽𝝈,𝜁)=𝛽𝝉∘𝝈,𝝉∗𝜁(𝝉:𝚽⇒𝚵), after the definitional closure-execution and substitution-composition equations of lemma 111.48. Semantic-type family premises are defined by replacing ≈𝑖 with ≈.
Reindexing along a relational 𝝂:𝚿⇒𝚿′ is precomposition: (𝝂∗𝛽)𝝈,𝜁:=𝛽𝝈∘𝝂,𝜁(𝝈:𝚿′⇒𝚽).Equation 111.1, Equation 111.3 prove that reindexing through a binder lift retains target gap variables. No inverse or restriction to the image of 𝝂 is used. For a self- derivation and a diagonal relational substitution, boldface and the two identical assignment subscripts are omitted: in particular, Ψ may denote the diagonal relational telescope 𝚿, and 𝗂𝖽Ψ then denotes its paired reflected identity.
For every initial support telescope Ψ and canonical symbolic level 𝑖, define a relation ≈𝑖@Ψ on 𝐷Ψ, related codes at level 𝑖, and for each derivation 𝛼:A≈𝑖B@Ψ a proof-relevant relation 𝖤𝗅𝗍Ψ(𝛼)⊆𝐷Ψ×𝐷Ψ, by the ranked construction below. A judgment 𝜂:(𝑑,𝑒)∈𝖤𝗅𝗍Ψ(𝛼) therefore contains three formation facts: 𝑑∈𝐷Ψ, 𝑒∈𝐷Ψ, and 𝜂 is Ψ-admissible. These facts are premises of membership, not consequences reconstructed from an erased pair. Write A∈C𝑖@Ψ for A≈𝑖A@Ψ; omit @Ψ only when the enclosing evidence fixes it. Each generator is displayed with the data it needs, followed by the element relation it defines. A support index is omitted inside a generator whose premises already display it. Derivations and membership evidence carry the initial telescope of definition 111.57; their action by typed semantic substitutions is constructed with their ranks. Write 𝗎𝑖 and 𝗇𝑖 for the displayed Unit and natural self-generator derivations at level 𝑖; these names refer to evidence, not yet to a derivation-independent relation.
Here is the promised construction. The symbolic order ≺ is well founded: if 𝑖≺𝑗, then evaluating every parameter at zero gives 𝑖(⃗0)<𝑗(⃗0), so an infinite ≺-descending chain would give an infinite descending chain of natural numbers. Proceed by well-founded recursion on 𝑖 under ≺. At a fixed 𝑖, build proof trees in ordinal stages. A generator enters stage 𝜉+1 only when every same-level code premise has already entered some stage below 𝜉+1; a universe premise may instead use the completed construction at 𝑗≺𝑖. For a dependent family of premises, Replacement supplies their set of ranks and the generator is assigned one plus its supremum. The element relation of a new proof tree is then the displayed set expression in the already-defined premise relations. At support Ψ, the Boolean, natural, and vector clauses use their displayed least positive subrelations of 𝐷Ψ×𝐷Ψ. Membership in every such relation is also proof relevant: a membership derivation records its outer constructor and has rank one greater than the supremum of its recursive membership premises. In particular, predecessor evidence for naturals and tail evidence for vectors have smaller rank. A vector-type generator is ranked above both its element-code premise and its length evidence; the semantic embedding of that code premise is recorded below the vector generator. Limit stages take unions of proof trees, not unions of the relations attached to one tree. Put ℎ(𝑖):=𝑖(⃗0). Thus every occurrence of 𝖤𝗅𝗍 is at a smaller triple (ℎ(𝑖),𝜉,𝜇) in lexicographic order, where 𝜉 is the construction rank and 𝜇 is the membership rank; a nonrecursive membership premise has 𝜇=0. A smaller symbolic level has smaller ℎ, a same-level generator premise has smaller 𝜉, and a natural or vector predecessor has smaller 𝜇. This constructs both the proof-relevant codes and their element relations; it also records the rank used by the later readback induction.
Unit.
̂𝟏≈𝑖̂𝟏, with element relation 𝐷Ψ×𝐷Ψ at support Ψ. Its nullary membership constructor takes the two displayed Ψ-admissibility derivations as premises.
Booleans.
̂𝟐≈𝑖̂𝟐, with element relation the least one containing (̂𝗍𝗍,̂𝗍𝗍), (̂𝖿𝖿,̂𝖿𝖿), and (𝗎𝗉̂𝟐(𝑘),𝗎𝗉̂𝟐(𝑘′)) for every 𝑘≈ne𝑘′.
Naturals.
̂ℕ≈𝑖̂ℕ, with element relation the least one containing (̂𝟢,̂𝟢), containing (̂𝗌𝗎𝖼(𝑑),̂𝗌𝗎𝖼(𝑒)) whenever it contains (𝑑,𝑒), and containing the related neutrals as in the Boolean clause.
Universes.
̂U𝑗≈𝑖̂U𝑗 for 𝑗≺𝑖, with element relation ≈𝑗.
Products.
From 𝛼:A≈𝑖A′@Ψ and a natural dependent-family premise 𝛽 as in definition 111.57, infer ̂Π𝜖,𝜚(A,𝐹)≈𝑖̂Π𝜖,𝜚(A′,𝐹′), with element evidence at support Ψ consisting of pairs (𝑔,ℎ) equipped with, for every relational 𝝈=(𝜎0,𝜎1;𝑞):Ψ⇒Φ and 𝜁:(𝑑,𝑒)∈𝖤𝗅𝗍Φ(𝝈∗𝛼), unique application outputs 𝑔𝜎0𝑑,ℎ𝜎1𝑒 and evidence 𝜂𝝈,𝜁:(𝑔𝜎0𝑑,ℎ𝜎1𝑒)∈𝖤𝗅𝗍Φ(𝛽𝝈,𝜁). These outputs and witnesses obey the analogue of equation 111.3 under every 𝝉:Φ⇒Ξ.
Sums.
From the same data, infer ̂Σ(A,𝐹)≈𝑖̂Σ(A′,𝐹′), with element relation {(𝑝,𝑞)∣allfourprojectionshaveuniqueoutputs,(𝑝1,𝑞1)∈𝖤𝗅𝗍Ψ(𝛼),(𝗌𝗇𝖽𝗏𝑝,𝗌𝗇𝖽𝗏𝑞)∈𝖤𝗅𝗍Ψ(𝛽𝗂𝖽Ψ,𝜂1)}, where 𝑝1=𝖿𝗌𝗍𝗏𝑝 and 𝑞1=𝖿𝗌𝗍𝗏𝑞, and 𝜂1:(𝑝1,𝑞1)∈𝖤𝗅𝗍Ψ(𝛼) is the recorded first-component witness. Substitution acts on this evidence using equation 111.3.
Identity.
From 𝛼:A≈𝑖A′ together with (𝑑𝑎,𝑑′𝑎) and (𝑑𝑏,𝑑′𝑏) in 𝖤𝗅𝗍(𝛼), infer ̂𝖨𝖽(A,𝑑𝑎,𝑑𝑏)≈𝑖̂𝖨𝖽(A′,𝑑′𝑎,𝑑′𝑏). For a relation 𝑅 and a finite set 𝑆, write 𝖢𝗅𝗂𝗊𝗎𝖾𝑅(𝑆) when 𝑆×𝑆⊆𝑅. The element relation is the least one containing the related neutrals and containing (̂𝗋𝖾𝖿𝗅(𝑑),̂𝗋𝖾𝖿𝗅(𝑒)) precisely when 𝖢𝗅𝗂𝗊𝗎𝖾𝖤𝗅𝗍(𝛼)({𝑑𝑎,𝑑𝑏,𝑑,𝑑′𝑎,𝑑′𝑏,𝑒}). Thus the evidence on both sides inhabits the single endpoint equivalence class; no unprimed endpoint is privileged.
Vectors.
From 𝛾:C≈𝑖C′ and 𝜈:(𝑑𝑛,𝑑′𝑛)∈𝖤𝗅𝗍(𝗇𝑖), infer ̂𝖵𝖾𝖼(C,𝑑𝑛)≈𝑖̂𝖵𝖾𝖼(C′,𝑑′𝑛). Its element relation is defined by recursion on 𝜈: at (̂𝟢,̂𝟢) it contains (̂𝗏𝗇𝗂𝗅,̂𝗏𝗇𝗂𝗅) and the related neutrals; at (̂𝗌𝗎𝖼𝑚,̂𝗌𝗎𝖼𝑚′) over a shorter derivation 𝜈′ it contains in addition every pair (̂𝗏𝖼𝗈𝗇𝗌(𝑚,𝑎,𝑥𝑠),̂𝗏𝖼𝗈𝗇𝗌(𝑚′,𝑎′,𝑥𝑠′)) with (𝑎,𝑎′)∈𝖤𝗅𝗍(𝛾) and (𝑥𝑠,𝑥𝑠′) in the relation given by 𝜈′; at related neutral lengths it contains the related neutrals only.
Lifts.
From 𝛾:C≈𝑗C′ with both sides stuck, infer ̂𝖫𝗂𝖿𝗍𝑗(C)≈𝑗+1̂𝖫𝗂𝖿𝗍𝑗(C′), with element relation 𝖤𝗅𝗍(𝛾).
Neutral codes.
From 𝑘≈ne𝑘′ put N:=𝗎𝗉̂U𝑖(𝑘) and N′:=𝗎𝗉̂U𝑖(𝑘′), and infer N≈𝑖N′. Its element relation is {(𝗎𝗉N(𝑘1),𝗎𝗉N′(𝑘′1))∣𝑘1≈ne𝑘′1}. Thus the formerly implicit annotations are exactly the two endpoint codes; no arbitrary A,B∈𝐷 are quantified here.
A value is stuck when it is 𝗎𝗉̂U𝑗(−), or ̂𝖵𝖾𝖼(−,−), or ̂𝖫𝗂𝖿𝗍𝑗(−); these are exactly the three values on which ̂𝗅𝗂𝖿𝗍 of definition 111.44 does not compute.
For every initial telescope Ψ, define a relation A≈B@Ψ on 𝐷Ψ, related semantic types, and 𝖤𝗅𝗍Ψ on its derivations, by the inductive definition with the generators of definition 111.58 at every level 𝑖 read with ≈ in place of ≈𝑖 throughout, except that
̂U𝑖≈̂U𝑖 has element relation ≈𝑖, for every 𝑖;
̂𝖵𝖾𝖼(C,𝑑𝑛)≈̂𝖵𝖾𝖼(C′,𝑑′𝑛) requires C≈𝑖C′ at a common level 𝑖, not merely C≈C′; its generator records both the code premise 𝛾 and its structural semantic embedding ¯𝛾. The two ranked relations and this embedding are constructed simultaneously: each code generator maps to the corresponding semantic generator, while a lift maps to two peels. Thus ¯𝛾 is formed below the vector generator and carries the same displayed element relation and membership ranks;
the generator for ̂𝖫𝗂𝖿𝗍 is replaced by the two peeling generators: from 𝛿:C≈B infer ̂𝖫𝗂𝖿𝗍𝑗(C)≈B and B≈̂𝖫𝗂𝖿𝗍𝑗(C), both with element relation 𝖤𝗅𝗍(𝛿);
𝗎𝗉̂U𝑖(𝑘)≈𝗎𝗉̂U𝑗(𝑘′) is generated from 𝑘≈ne𝑘′ for arbitrary 𝑖,𝑗.
This is again a ranked least relation. At stage 𝜉+1 a generator may use only semantic-type premises of rank at most 𝜉 and the already constructed code relations. Peeling therefore decreases construction rank even when it leaves the symbolic universe level unchanged. The same Replacement-and-supremum argument as in definition 111.58 handles the premise family of ̂Π and ̂Σ. Consequently 𝖤𝗅𝗍 is defined from strictly earlier evidence in every clause. Write A∈T@Ψ for A≈A@Ψ; omit @Ψ only when the enclosing evidence fixes it.
The two preceding definitions attach a support to every ranked derivation. A statement in which every ranked premise and conclusion remains at one support universally quantifies over that initial telescope Ψ and may omit the repeated world annotation. In particular, 𝜂:(𝑑,𝑒)∈𝖤𝗅𝗍(𝛼) with 𝛼@Ψ is only an abbreviation for the formed judgment 𝜂:(𝑑,𝑒)∈𝖤𝗅𝗍Ψ(𝛼); it never denotes membership in an unindexed raw relation on 𝐷. If 𝜎:Ψ⇒Φ, then membership in 𝖤𝗅𝗍(𝜎∗𝛼) is at Φ and therefore contains proofs that both endpoints lie in 𝐷Φ. Whenever a substitution changes the world, both source and target indices are displayed. This convention never permits quotation at a number unrelated to the length of its displayed support.
At a support Ψ, the clause for ̂𝟏 relates every pair in 𝐷Ψ×𝐷Ψ. That is deliberate and it is what 𝟏-𝜂 demands: two terms of type 𝟏 are judgmentally equal whenever they are formed at the same support, so no finer support-indexed relation could be complete. Three consequences have to be checked rather than assumed.
Reification stays defined, because ↓𝑛̂𝟏 ignores its argument and returns ⋆; no clause of definition 49.37 inspects a value at ̂𝟏. Reflection likewise returns ̂⋆ without consulting the neutral.
A family over ̂𝟏 must therefore be related to itself after every semantic substitution and at every target-admissible pair: the ̂Π generator quantifies 𝛽𝜎,𝜁 over all 𝜁:(𝑑,𝑒)∈𝖤𝗅𝗍Φ(𝜎∗𝛼) when 𝜎:Ψ⇒Φ. For a family arising from a type 𝐵 over 𝑥:𝟏 this natural premise is supplied by lemma 111.74 itself: the semantic half of lemma 111.74 quantifies over 𝖤𝗅𝗍Φ(𝜎∗𝗎𝑖)=𝐷Φ×𝐷Φ. Formation of the membership evidence supplies 𝑑,𝑒∈𝐷Φ, exactly the hypotheses needed by semantic extension. So the induction hypothesis for 𝐵 applies at (𝜎0∗𝜌,𝑑)≈Φ(𝜎1∗𝜌′,𝑒) and gives [[𝐵]](𝜎0∗𝜌,𝑑)≈[[𝐵]](𝜎1∗𝜌′,𝑒) for all 𝑑,𝑒∈𝐷Φ. On the syntactic side the Kripke clause at ̂𝟏 imposes only Δ⊢⋆:𝟏 beyond the standing element requirement, which is again vacuous here.
Finally, no other former indiscriminately relates all of 𝐷Ψ at a fixed support: every other element clause requires a constructor head or a related neutral. Unit totality never crosses a support boundary; only an explicit typed substitution transports its membership evidence.
The two exceptions are the whole content of the strict-lift package. Peeling says that a lifted code is the very type it lifts, which is Lift-El; keeping the code inside ̂𝖵𝖾𝖼 says that 𝖵𝖾𝖼 was formed from a code and that no equation moves a lift across it, which is remark 111.21.
Fix a support telescope Ψ; every unannotated derivation and membership judgment in clauses (1)–(6) is formed at Ψ in the sense of convention 111.60.
≈𝑖 and ≈ are symmetric and transitive, and each 𝖤𝗅𝗍Ψ(𝛼) is symmetric and transitive on 𝐷Ψ.
If 𝛼,𝛼′ both derive A≈𝑖B, then 𝖤𝗅𝗍Ψ(𝛼)=𝖤𝗅𝗍Ψ(𝛼′); likewise for ≈. Hence 𝖤𝗅𝗍Ψ(A≈B) is well defined, and we write 𝖤𝗅𝗍Ψ(A) for 𝖤𝗅𝗍Ψ(A≈A).
If 𝛼𝑖:A≈𝑖B and 𝛼𝑗:A≈𝑗B, then 𝖤𝗅𝗍(𝛼𝑖)=𝖤𝗅𝗍(𝛼𝑗). The equality carries a canonical outer-constructor-preserving transport between membership derivations, with the rank bound stated in (6).
If A≈𝑖B then A≈B and the two element relations agree.
If A≈B and A≈B′ then B≈B′; and ̂𝗅𝗂𝖿𝗍𝑖 preserves ≈ up to peeling: ̂𝗅𝗂𝖿𝗍𝑖(C)≈C whenever C∈C𝑖.
The equalities of element relations in (2)–(4) are realized by explicit evidence maps. For derivations 𝛿,𝛿′ with the same semantic endpoints and 𝜂:(𝑑,𝑒)∈𝖤𝗅𝗍(𝛿), there is evidence 𝗍𝗋𝛿,𝛿′(𝜂):(𝑑,𝑒)∈𝖤𝗅𝗍(𝛿′),𝗍𝗋𝛿′,𝛿(𝗍𝗋𝛿,𝛿′(𝜂))=𝜂. For code derivations 𝛼𝑖:C≈𝑖C′ and 𝛼𝑗:C≈𝑗C′ with the same endpoints, 𝗍𝗋𝑖,𝑗𝛼𝑖,𝛼𝑗(𝜁):(𝑑,𝑒)∈𝖤𝗅𝗍(𝛼𝑗)forevery𝜁:(𝑑,𝑒)∈𝖤𝗅𝗍(𝛼𝑖), and the reverse composite is the identity. A bridge 𝜃:A≈B determines 𝛿𝐴:=𝜃;𝜃𝗈𝗉 and 𝛿𝐵:=𝜃𝗈𝗉;𝜃; it supplies inverse evidence 𝖻𝗋𝜃(𝜂):(𝑑,𝑒)∈𝖤𝗅𝗍(𝛿𝐵) for every 𝜂:(𝑑,𝑒)∈𝖤𝗅𝗍(𝛿𝐴). Finally, if 𝛿∘ is the non-peeling core of 𝛿, then 𝗉𝖾𝖾𝗅𝛿(𝜂):(𝑑,𝑒)∈𝖤𝗅𝗍(𝛿∘). The reverse peeling map restores evidence at 𝛿. Every map preserves admissibility and the outer membership constructor and is natural in the support world: 𝜎∗𝗍𝗋𝛿,𝛿′(𝜂)=𝗍𝗋𝜎∗𝛿,𝜎∗𝛿′(𝜎∗𝜂), and, with every displayed expression well typed, 𝜎∗𝗍𝗋𝑖,𝑗𝛼𝑖,𝛼𝑗(𝜁)=𝗍𝗋𝑖,𝑗𝜎∗𝛼𝑖,𝜎∗𝛼𝑗(𝜎∗𝜁),𝜎∗𝖻𝗋𝜃(𝜂)=𝖻𝗋𝜎∗𝜃(𝜎∗𝜂),𝜎∗𝗉𝖾𝖾𝗅𝛿(𝜂)=𝗉𝖾𝖾𝗅𝜎∗𝛿(𝜎∗𝜂),𝜎∗𝗎𝗇𝗉𝖾𝖾𝗅𝛿(𝜂∘)=𝗎𝗇𝗉𝖾𝖾𝗅𝜎∗𝛿(𝜎∗𝜂∘). Its output rank is bounded by the Hessenberg sum of the ranks of its input evidence and the derivations defining the map.
Two derivations with the same code endpoints, or the same semantic-type endpoints, assign the same element relation.
Code derivations with the same endpoints at two possibly distinct symbolic levels assign the same element relation. Equality is witnessed by a transport of ranked membership derivations that preserves their outer constructor.
The code and semantic-type relations are symmetric and transitive, and every assigned element relation is symmetric and transitive.
If 𝛼:A≈B, then its element relation equals the relations assigned to the self-derivations obtained by composing 𝛼 with its converse. Thus all three may be denoted 𝖤𝗅𝗍(A)=𝖤𝗅𝗍(𝛼)=𝖤𝗅𝗍(B).
Peeling any finite spine of ̂𝖫𝗂𝖿𝗍 preserves the assigned element relation.
The simultaneous induction uses a measure that remains valid when two code levels differ. For code evidence at levels 𝑖1,…,𝑖𝑟, its first component is the finite multiset [ℎ(𝑖1),…,ℎ(𝑖𝑟)], ordered by the multiset extension of < on ℕ. Its second component is the Hessenberg, or natural, sum rk(𝛿1)#⋯#rk(𝛿𝑠)#rk(𝜂1)#⋯#rk(𝜂𝑡). Order the pair lexicographically. The multiset component decreases when a universe premise replaces an ambient level by a strictly smaller one. At a fixed multiset, the natural sum decreases when any construction, peeling, or membership premise is selected, because natural sum is strictly monotone in every argument. In particular, the transitivity induction uses rk(𝛿)#rk(𝛿′), not ordinal addition in a chosen order. This measure covers same-level, cross-level, transitivity, vector, and peeling calls.
For (F) and (C) at codes, distinct non-lift heads are disjoint constructors of 𝐷, so two derivations use the same generator. Apply (F) to the domain premise when the ambient levels agree, and (C) when they do not. Apply the same assertion to the smaller natural family premises. For a product, the evidence map is forced by its universal premise. Fix an arbitrary target relational substitution 𝝈:Ψ⇒Φ and arbitrary target-domain witness 𝜁′:(𝑑,𝑒)∈𝖤𝗅𝗍(𝝈∗𝛼′). First transport it backward across the inverse domain comparison: 𝜁:=𝗍𝗋𝝈∗𝛼′,𝝈∗𝛼(𝜁′). Apply the source universal function evidence to 𝜁, obtaining result evidence at 𝛽𝝈,𝜁. Then transport that result forward across the family comparison to obtain evidence at 𝛽′𝝈,𝜁′. The reverse comparison gives the inverse map. Under a further 𝝉:Φ⇒Ξ, both constructions become the same construction at 𝝉∘𝝈: this is equation 111.3 together with the displayed naturality equation in (6). Hence the map is compatible both with the selected dependent fiber and with all future worlds. Sums use the same backward domain transport on their recorded first-component witness before the forward fiber transport on the second component. The displayed element relations then agree. Naturals use induction on their positive element derivations. Vectors add an inner induction on the length evidence and use (C) for their element-code premise. The constructor, successor, and neutral cases are disjoint, so the transport preserves the outer constructor and recursively transports the stored evidence.
For a universe endpoint ̂U𝑘, both ambient levels must place 𝑘 strictly below them; both element relations are the already completed ≈𝑘. A lift endpoint determines its ambient level as the normalized successor of its stored lift index, so two such derivations have the same ambient level. A neutral-code endpoint 𝗎𝗉̂U𝑘(𝑞) likewise determines the ambient level 𝑘. These observations close the universe, lift, and neutral cases of (C).
For semantic types, (F) at a vector head may compare derivations whose element-code premises were chosen at different levels. Assertion (C) gives the required equality and membership-evidence transport before the vector clause is compared. Only peeling creates another critical pair. Define 𝗌𝗍𝗋𝗂𝗉(̂𝖫𝗂𝖿𝗍𝑗C)=𝗌𝗍𝗋𝗂𝗉(C) and let 𝑠(A,B) be the total number of leading lifts. Induction on 𝑠 factors every semantic-type derivation into left peels, a unique non-peeling core generator, and right peels. Two left peels, or two right peels, commute by the induction hypothesis on the shorter spine. The mixed critical pair ̂𝖫𝗂𝖿𝗍𝑖C≈̂𝖫𝗂𝖿𝗍𝑗D can peel left then right or right then left; both paths reach C≈D and both inherit exactly its element relation. Nested lifts repeat this diamond with smaller 𝑠. This proves (L) and closes the only overlap in (F).
For (P), symmetry reverses every premise. At a product or sum, (S) makes the domain element relation independent of its orientation, so the family premise is available at the reversed pair. For transitivity, first use (S) to regard all three domain relations as one PER. If (𝑑,𝑓) belongs to it, symmetry and transitivity give (𝑑,𝑑); use 𝑑 as the middle argument in the first family premise and then compose with the second premise at (𝑑,𝑓). The function case is pointwise. For the dependent-sum case, write 𝛼01:A0≈A1,𝛼12:A1≈A2 and let 𝛼02 be their composite. To construct transitive membership, start with sum values 𝑃0,𝑃1,𝑃2. Put 𝑑𝑟:=𝖿𝗌𝗍𝗏(𝑃𝑟) and 𝑒𝑟:=𝗌𝗇𝖽𝗏(𝑃𝑟) for 𝑟∈{0,1,2}. The two input derivations contain (𝑑0,𝑑1)∈𝖤𝗅𝗍(𝛼01),(𝑒0,𝑒1)∈𝖤𝗅𝗍(𝛽01𝑑0,𝑑1),(𝑑1,𝑑2)∈𝖤𝗅𝗍(𝛼12),(𝑒1,𝑒2)∈𝖤𝗅𝗍(𝛽12𝑑1,𝑑2). The common first component 𝑑1 selects the composite family premise 𝛽02𝑑0,𝑑2:=𝛽01𝑑0,𝑑1;𝛽12𝑑1,𝑑2:𝐹0(𝑑0)≈𝐹2(𝑑2). The last two second-component premises compose to (𝑒0,𝑒2)∈𝖤𝗅𝗍(𝛽02𝑑0,𝑑2). A different relational factorization through a first component 𝑑′1 gives the same fiber relation and membership transport by (F) and (S); hence the output does not depend on the chosen transitivity witness.
Boolean and natural constructor cases are immediate, and a neutral middle value forces both sides into the neutral case because constructor and neutral generators are disjoint. For vectors the evidence map from premises (𝛾𝑖,𝜈𝑖) to (𝛾𝑗,𝜈𝑗) is defined by the complete recursion below. Write 𝜈+𝑟:=𝗌𝗎𝖼(𝜈𝑟). 𝖵𝑖,𝑗(𝗓𝖾𝗋𝗈,𝗓𝖾𝗋𝗈;𝗏𝗇𝗂𝗅)=𝗏𝗇𝗂𝗅,𝖵𝑖,𝑗(𝜈+𝑖,𝜈+𝑗;𝗏𝖼𝗈𝗇𝗌(𝜁,𝜂))=𝗏𝖼𝗈𝗇𝗌(𝗍𝗋𝑖,𝑗𝛾𝑖,𝛾𝑗(𝜁),𝖵𝑖,𝑗(𝜈𝑖,𝜈𝑗;𝜂)),𝖵𝑖,𝑗(𝑞,𝑞′;𝗇𝖾𝗎𝗍𝗋𝖺𝗅(𝑘))=𝗇𝖾𝗎𝗍𝗋𝖺𝗅(𝑘). In the last line 𝑞,𝑞′ are the two related-neutral length witnesses. Here 𝛾𝑖 and 𝛾𝑗 are the two element-code premises, possibly at different ambient levels; the second line decreases both length and tail membership rank. The three constructors are disjoint, so these clauses are total on vector membership evidence and no mixed zero/successor/neutral case exists. For identity, two reflexivity pairs give two 𝖤𝗅𝗍(𝛼)-cliques with their middle witness in common; the PER laws for 𝖤𝗅𝗍(𝛼) make their union a clique, so the outer reflexivity pair composes. Neutral identity evidence composes only with neutral evidence. Universe elements use (P) at the smaller symbolic level. Peeling uses the diamond above. These cases prove (P), and composing a derivation with its converse and applying (F) proves (S).
The recursive constructions just displayed define the maps in (6). Reversing the comparison defines their inverses. Their outer constructors are unchanged, and the bound on their output ranks follows by the same multiset/natural-sum induction. This simultaneous proof establishes functionality before the first use below that omits derivation evidence. Proof relevance supplies the ranks for the comparison and the peeling diamond.
(4) now follows by induction on A≈𝑖B. Each generator of ≈𝑖 other than the lift generator is a generator of ≈, with the same 𝖤𝗅𝗍. For ̂U𝑗 with 𝑗≺𝑖, the element relation is ≈𝑗 on both sides. The lift generator maps to two applications of peeling, whose 𝖤𝗅𝗍 is again 𝖤𝗅𝗍(𝛾).
(5) The first claim is symmetry followed by transitivity. For the second, induct on C∈C𝑖: on the seven heads where ̂𝗅𝗂𝖿𝗍𝑖 computes, the result is related to C by the induction hypothesis applied to its components, since peeling is not needed for ̂𝟏,̂𝟐,̂ℕ and ̂U𝑘 and the ̂Π, ̂Σ, ̂𝖨𝖽 clauses lift their components; on the three stuck heads the result is ̂𝖫𝗂𝖿𝗍𝑖(C), related to C by one peeling step. ◻
Proof of Lemma 111.63 — Reification is determined by relatedness
Proof. Use the multiset/natural-sum measure of lemma 111.62, including both code-premise levels when a semantic vector derivation is inspected, with an inner induction on 𝜈 in the vector case and on the readback-graph derivation in the three inductively generated element relations. The induction proves existence and uniqueness together: existence follows by constructing the displayed graph clause; uniqueness follows because its premises have unique outputs and distinct outer constructors select distinct clauses. All four operations peel ̂𝖫𝗂𝖿𝗍 first, and the peeling generators change neither side of any claim, so those cases are immediate from the induction hypothesis; clause (2) is the exception, and there both sides carry the same lift, so the clause 𝖰𝖼𝑛(̂𝖫𝗂𝖿𝗍𝑗(C))=𝖫𝗂𝖿𝗍𝑗(𝖰𝖼𝑛(C)) reduces it to the induction hypothesis.
̂Π. For (1), 𝖰𝑛 emits the same (𝜖,𝜚) on both sides because the generator requires them equal; the domains agree by the induction hypothesis; the codomains are 𝐹(𝗏A𝑛) and 𝐹′(𝗏B𝑛). Let 𝚿 be the relational support carried by the product generator, and put 𝝎=𝗐𝗄𝚿,𝛿0, where 𝛿0 is its domain premise. Its endpoint targets are Ψ.A and Ψ.B, both of length 𝑛+1. The fresh variables are related neutrals at those exact target worlds by lemma 111.55. Clause (4) at the transported domain gives 𝜁𝑣:(𝗏𝜔0∗A𝑛,𝗏𝜔1∗B𝑛)∈𝖤𝗅𝗍(𝝎∗𝛿0), so the natural premise 𝛽𝝎,𝜁𝑣 relates the two codomains and the induction hypothesis applies at level 𝑛+1. For (3), ↓ emits a 𝜆 on both sides; its bodies are ↓𝑛+1(𝑔⋅𝗏A𝑛) and ↓𝑛+1(ℎ⋅𝗏B𝑛), related by the product membership evidence at (𝝎,𝜁𝑣), so the induction hypothesis applies. For (4), reflection produces two 𝖾𝗍𝖺 values. For an arbitrary relational substitution 𝝈=(𝜎0,𝜎1;𝑞):𝚿⇒𝚽 and 𝜁:(𝑑,𝑒)∈𝖤𝗅𝗍(𝝈∗𝛿0), applying them gives the two outputs of the simultaneous substitution-and-application graph. Inspect its last rules. If the transported heads remain stuck, the outputs are ↑𝛽𝝈,𝜁(𝖺𝗉𝗉(𝜎0∗𝑘;𝜎0∗A;𝑑)) and ↑𝛽𝝈,𝜁(𝖺𝗉𝗉(𝜎1∗𝑘′;𝜎1∗B;𝑒)). The latter is the primed counterpart. The application neutrals are related at the target support: after any further typed weakening, their heads agree by world stability of neutral relatedness and their reified arguments agree by (3) at that exact future world. If substitution exposes a closure or constructor head, the matching semantic-operation rule fires on both sides; its domain and strict family premises are smaller simultaneous-induction premises and give membership directly in 𝖤𝗅𝗍(𝛽𝝈,𝜁). These are all last rules of semantic application. Naturality under a further substitution is equation 111.3.
̂Σ. For (1), the domain quotations agree by the induction hypothesis at Ψ. Reify the related first projections at depth 𝑛; their common output selects the two codomain values through 𝛽𝗂𝖽𝚿,𝜂1. The induction hypothesis at that strict family premise gives equal codomain quotations at the same exact depth. For (3), the sum membership evidence first supplies 𝜂1 for the semantic first projections. Its stored second witness has type 𝜂2:(𝗌𝗇𝖽𝗏𝑑,𝗌𝗇𝖽𝗏𝑒)∈𝖤𝗅𝗍(𝛽𝗂𝖽𝚿,𝜂1), so the two induction hypotheses give equal first components and then equal second components in the fiber selected by those first components. For (4), lemma 111.55 at Ψ gives 𝖿𝗌𝗍(𝑘)≈neΨ𝖿𝗌𝗍(𝑘′). Reflection at the domain turns that pair into the witness selecting the second fiber; the same lemma then gives related second projections at that fiber. After a typed future weakening, equation 111.3 identifies the transported selected fiber with the fiber selected in the target world.
̂𝟏. Both reifications are ⋆ and both reflections are ̂⋆, which is related to itself because ̂⋆∈𝐷Ψ and 𝖤𝗅𝗍Ψ=𝐷Ψ×𝐷Ψ. This clause is the one that makes 𝖤𝗅𝗍 not a subsingleton and is exactly 𝟏-𝜂.
̂𝟐, ̂ℕ. Induct on the element derivation: a constructor pair reifies to the same constructor, with the ̂𝗌𝗎𝖼 case using the inner induction hypothesis; a related neutral pair reifies to 𝖱𝑛(𝑘)=𝖱𝑛(𝑘′), equal by definition 111.52. For (4), ↑ is 𝗎𝗉 and the pair is related by the neutral generator.
̂𝖨𝖽. A related pair is (̂𝗋𝖾𝖿𝗅(𝑑),̂𝗋𝖾𝖿𝗅(𝑒)) whose clique premise includes (𝑑,𝑒)∈𝖤𝗅𝗍(A), reified to 𝗋𝖾𝖿𝗅↓A(𝑑) and 𝗋𝖾𝖿𝗅↓B(𝑒), equal by (3) at the smaller type; or a related neutral pair, handled as above. In (1) the two endpoints are reified at A and B and are equal by (3).
̂𝖵𝖾𝖼. Clause (1) reads back the two element codes with 𝖰𝖼𝑛 and uses (2); this is where the absence of Lift-Vec is respected, since (2) keeps a lift that (1) would have deleted. For (3), induct on 𝜈: at ̂𝟢 both sides reify to 𝗏𝗇𝗂𝗅; at ̂𝗌𝗎𝖼 the three components are reified at ̂ℕ, at the element code, and at the shorter vector type, each equal by an induction hypothesis; at a neutral length only neutral pairs occur.
̂U𝑖. A related pair of elements is a pair of related level-𝑖 codes, and reification at ̂U𝑖 is 𝖰𝖼𝑛, so (3) at ̂U𝑖 is exactly (2). For (4), reflection at a universe is 𝗎𝗉, and two related neutrals generate a related pair of neutral codes.
Neutral type. All four claims reduce to 𝖱𝑛(𝑘)=𝖱𝑛(𝑘′). ◻
Let 𝝈=(𝜎0,𝜎1;𝑞):Ψ⇒Φ be relational for the displayed Ψ-admissible endpoints, closure fields, and evidence. The action of definition 111.47 extends to maps 𝝈∗𝛿:𝜎0∗A≈𝜎1∗B@Φfor𝛿:A≈B,𝝈∗𝛼:𝜎0∗C≈𝑖𝜎1∗C′@Φfor𝛼:C≈𝑖C′,𝝈∗𝜂:(𝜎0∗𝑑,𝜎1∗𝑒)∈𝖤𝗅𝗍Φ(𝝈∗𝛿)for𝜂:(𝑑,𝑒)∈𝖤𝗅𝗍Ψ(𝛿). Each map preserves a constructor outer generator. A neutral may compute after substitution; in that case its output rank is bounded by the Hessenberg sum of the input rank and the ranks in 𝑞. It preserves Ψ-admissibility as Φ-admissibility. In particular, the membership map transports both endpoint-admissibility premises and sends 𝐷Ψ×𝐷Ψ into 𝐷Φ×𝐷Φ. It is strictly functorial: 𝗂𝖽∗𝜉=𝜉,(𝝉∘𝝈)∗𝜉=𝝉∗(𝝈∗𝜉) for every displayed kind of evidence 𝜉. It commutes with the same-endpoint, cross-level, bridge, and peeling maps of lemma 111.62(6), with arbitrary source extension by equation 111.2, and with fresh canonical lift by equation 111.1.
Proof of Lemma 111.64 — Substitution action on ranked semantic evidence
Proof. Induct on the ranked derivation and its membership evidence simultaneously. The nullary code and type generators are fixed. Unit membership transports its two endpoint-admissibility derivations along 𝜎∗, yielding endpoints in 𝐷Φ; the remaining nullary membership constructors are transported componentwise. For a product or sum generator supported at Ψ, act on the domain premise and reindex its natural family by equation 111.4: (𝝈∗𝛽)𝝉,𝜁:=𝛽𝝉∘𝝈,𝜁(𝝉:Φ⇒Ξ). The endpoints agree because semantic evaluation and closure execution commute with composition. Naturality of 𝜎∗𝛽 is the calculation 𝝊∗(𝝈∗𝛽)𝝉,𝜁=𝑒𝑞𝑢𝑎𝑡𝑖𝑜𝑛111.3𝛽𝝊∘𝝉∘𝝈,𝝊∗𝜁=(𝝈∗𝛽)𝝊∘𝝉,𝝊∗𝜁. For product membership, define (𝝈∗𝜂)𝝉,𝜁 to be 𝜂𝝉∘𝝈,𝜁. Thus an arbitrary target witness 𝜁, including one containing variables of Ξ, is passed to the source universal premise at the composite substitution; it is never pulled back through a nonexistent inverse. Sum membership transports its first-component witness and then selects (𝝈∗𝛽)𝗂𝖽Φ,𝝈∗𝜂1=𝛽𝝈,𝝈∗𝜂1 for its second component.
Identity evidence transports the carrier premise, all six members of its clique, and the reflexivity or neutral outer constructor. Vector evidence uses the zero, successor, and neutral recursion: successor acts on the code-head witness and on the shorter tail witness. Universe evidence acts on its smaller-level code derivation. Lift evidence acts on its premise and retains the symbolic level. Neutral-code evidence acts on both endpoint annotations fixed in definition 111.58; at a variable it uses the corresponding component of 𝑞, and at a compound neutral it executes the semantic operation and applies the induction hypotheses to every stored field. Thus the result need not remain neutral, but it remains in the required element relation. Constructor cases preserve the proof-tree shape; the relational-neutral case is bounded by the ranks recorded in 𝑞. Identity and composition follow by the same induction; the product case reduces to associativity of substitution composition. An arbitrary binder instantiation uses equation 111.2; a fresh readback binder uses equation 111.1. Applying the induction to the definitions of 𝗍𝗋 and 𝗉𝖾𝖾𝗅 proves commutation with the four evidence maps. ◻
For a context Δ, with 𝑛:=|Δ|, let ΨΔ be its semantic classifier telescope. Let 𝛿:A≈A@ΨΔ be a ranked self-derivation and let 𝜂:(𝑑,𝑑)∈𝖤𝗅𝗍ΨΔ(𝛿) be ranked membership evidence formed at that same telescope. Its formation supplies 𝑑∈𝐷ΨΔ. Define Δ⊩𝛿,𝜂𝑎∼𝑑 by well-founded recursion on two nested orders. The outer generator order is 𝐠(𝛿):=([ℎ(𝑖1),…,ℎ(𝑖𝑟)],rk(𝛿)), where the multiset lists the ambient levels of the active code premises and rk(𝛿) is the construction rank. Order this pair lexicographically by the multiset extension and the ordinal order fixed in lemma 111.62. At a fixed 𝛿, use an inner recursion on rk(𝜂).
This nesting is essential. Before defining any clause at 𝛿, define the entire membership-indexed family of relations for every strict generator premise 𝛿0 with 𝐠(𝛿0)<𝐠(𝛿). The product clause may therefore invoke the domain relation at an argument witness 𝜁 of arbitrary rank: its generator 𝛼 is strict, so no comparison with rk(𝜂) or rk(𝜁) is needed. Its result relation is likewise at the strict family premise 𝛽𝜎,𝜁. Same-generator recursion occurs only for a natural predecessor and decreases rk(𝜂). A vector successor calls the strict element-code embedding and the vector generator built from the shorter length premise; identity calls its strict carrier premise, a universe calls the smaller-level code premise, and peeling calls its strict core. These are all outer decreases. Thus this definition does not use the invalid measure rk(𝛿)#rk(𝜂), which would fail for an arbitrary product argument. Every clause requires Δ⊢𝑎:𝖰𝑛(A) and uses the supplied 𝜂 rather than re-deriving membership. The membership index is what lets a syntactically witnessed argument extend a related environment; without it the two halves of lemma 111.74 could not be run at the same Π-introduction. Before selecting a clause, normalize a peeling self-derivation to paired left–right peels around its unique non-peeling core 𝛿∘:C≈C. The lift diamond in lemma 111.62 transports 𝜂 to 𝜂∘:(𝑑,𝑑)∈𝖤𝗅𝗍(𝛿∘), and Δ⊩𝛿,𝜂𝑎∼𝑑⟺Δ⊩𝛿∘,𝜂∘𝑎∼𝑑. The core premise has smaller derivation rank. In the remaining clauses, named evidence is always an immediate premise of 𝛿 or 𝜂.
If 𝛿 is the ̂𝟏 generator, there is no further condition.
If 𝛿 is the ̂𝟐 generator, 𝜂 is one of the three disjoint evidence forms. Respectively, either 𝑑=̂𝗍𝗍 and Δ⊢𝑎≡𝗍𝗍:𝟐; or 𝑑=̂𝖿𝖿 and Δ⊢𝑎≡𝖿𝖿:𝟐; or 𝑑=𝗎𝗉B(𝑘) with Δ⊢𝖱𝑛(𝑘)𝗇𝖾𝟐 and Δ⊢𝑎≡𝖱𝑛(𝑘):𝟐.
If 𝛿 is the ̂ℕ generator, 𝜂 is zero, successor evidence 𝜂′, or neutral evidence. In the first case 𝑑=̂𝟢 and Δ⊢𝑎≡𝟢:ℕ; or 𝑑=̂𝗌𝗎𝖼(𝑑′) and there is 𝑏 with Δ⊩𝛿,𝜂′𝑏∼𝑑′ and Δ⊢𝑎≡𝗌𝗎𝖼(𝑏):ℕ; or the neutral case as for ̂𝟐. The recursive call decreases rk(𝜂).
If 𝛿@ΨΔ is a product generator with domain premise 𝛼:B≈B@ΨΔ and natural family premise 𝛽, then for every inclusion 𝜔:Δ↪Δ′ and every 𝑏,𝑒 with self-membership evidence 𝜁:(𝑒,𝑒)∈𝖤𝗅𝗍ΨΔ′(𝜔∗𝛼) and Δ′⊩𝜔∗𝛼,𝜁𝑏∼𝑒, the transported product generator, with 𝐹𝜔:=𝜔∗𝐹, has the target-world premise 𝛽𝜔,𝜁:𝐹𝜔(𝑒)≈𝐹𝜔(𝑒). The transported function evidence 𝜔∗𝜂, evaluated at the identity substitution of the target world and at 𝜁, supplies a unique output (𝜔∗𝑑)⋅𝜖,𝜚𝑒 and a smaller membership premise (𝜔∗𝜂)𝗂𝖽,𝜁=𝜂𝜔,𝜁 at 𝛽𝜔,𝜁, and Δ′⊩𝛽𝜔,𝜁,𝜂𝜔,𝜁𝜔∗𝑎𝜖,𝜚𝑏∼(𝜔∗𝑑)⋅𝜖,𝜚𝑒.
If 𝛿 is a sum generator with domain premise 𝛼 and family premise 𝛽, then 𝜂 has component premises 𝜂1 and 𝜂2, and Δ⊩𝛼,𝜂1𝗉𝗋1(𝑎)∼𝖿𝗌𝗍𝗏(𝑑),Δ⊩𝛽𝗂𝖽ΨΔ,𝜂1,𝜂2𝗉𝗋2(𝑎)∼𝗌𝗇𝖽𝗏(𝑑),
If 𝛿 is an identity generator with carrier premise 𝛼, then 𝜂 is reflexivity evidence or neutral evidence. In the first case 𝑑=̂𝗋𝖾𝖿𝗅(𝑑′); the clique stored by 𝜂 supplies 𝜂′:(𝑑′,𝑑′)∈𝖤𝗅𝗍(𝛼), and there is 𝑏 with Δ⊩𝛼,𝜂′𝑏∼𝑑′, Δ⊢𝑎≡𝗋𝖾𝖿𝗅𝑏:𝖰𝑛(A) and, in addition, the two endpoint equationsΔ⊢↓𝑛B(𝑑𝑎)≡𝑏:𝖰𝑛(B),Δ⊢↓𝑛B(𝑑𝑏)≡𝑏:𝖰𝑛(B); or the neutral case. The endpoint equations are stored because typing 𝑎 at 𝖨𝖽𝖰𝑛(B)(↓(𝑑𝑎),↓(𝑑𝑏)) does not by itself equate the two endpoints with 𝑏: the judgment Δ⊢𝗋𝖾𝖿𝗅𝑏:𝖨𝖽𝐴(𝑎0,𝑏0) is derivable whenever Conv applies, and nothing in it forces 𝑎0≡𝑏≡𝑏0. Id-comp is stated at annotations equal to the 𝗋𝖾𝖿𝗅 argument, so without these two equations the identity computation case of lemma 111.74 could not fire.
If 𝛿 is a vector generator, it records a code self-premise 𝛾:C≈𝑖C, its smaller semantic embedding ¯𝛾:C≈C, and length evidence 𝜈. At zero, 𝜂 is nil or neutral evidence; in the nil case 𝑑=̂𝗏𝗇𝗂𝗅 and Δ⊢𝑎≡𝗏𝗇𝗂𝗅:𝖰𝑛(A), or the neutral case. At successor evidence 𝜈′ the cons evidence 𝜂 supplies 𝜁:(𝑑1,𝑑1)∈𝖤𝗅𝗍(𝛾) and tail evidence 𝜂2; let 𝛿′ be the vector self-generator built from 𝛾,𝜈′. Then 𝑑=̂𝗏𝖼𝗈𝗇𝗌(𝑚,𝑑1,𝑑2) and there are 𝑏1,𝑏2 with Δ⊩¯𝛾,¯𝜁𝑏1∼𝑑1,Δ⊩𝛿′,𝜂2𝑏2∼𝑑2, Here ¯𝜁 is obtained from 𝜁 by the transport of lemma 111.62(4),(6). That transport preserves the outer constructor. Moreover, Δ⊢𝑎≡𝗏𝖼𝗈𝗇𝗌(↓𝑛̂ℕ(𝑚),𝑏1,𝑏2):𝖰𝑛(A). At a neutral length, the neutral case only. The head call descends to the recorded code premise; the tail call descends in both 𝜈 and 𝜂.
If 𝛿 is the universe generator at 𝑖, then 𝜂 is a ranked self-derivation of 𝑑≈𝑖𝑑, Δ⊢𝑎≡𝖰𝖼𝑛(𝑑):U𝑖, and Δ⊢𝑎≡𝖰𝑛(𝑑)𝗍𝗒𝗉𝖾.
If 𝛿 is a neutral-type generator, so A=𝗎𝗉̂U𝑖(𝑘0), then 𝑑=𝗎𝗉B(𝑘) with Δ⊢𝖱𝑛(𝑘)𝗇𝖾𝖱𝑛(𝑘0) and Δ⊢𝑎≡𝖱𝑛(𝑘):𝖱𝑛(𝑘0).
The neutral case at A means: 𝑑=𝗎𝗉B(𝑘) with Δ⊢𝖱𝑛(𝑘)𝗇𝖾𝖰𝑛(A) and Δ⊢𝑎≡𝖱𝑛(𝑘):𝖰𝑛(A). It is available only at the positive types of definition 49.14.
If 𝛿,𝛿′:A≈A and 𝜂:(𝑑,𝑑)∈𝖤𝗅𝗍(𝛿), put 𝜂′:=𝗍𝗋𝛿,𝛿′(𝜂). Then Δ⊩𝛿,𝜂𝑎∼𝑑⟺Δ⊩𝛿′,𝜂′𝑎∼𝑑.
If 𝜃:A≈B, put 𝛿𝐴:=𝜃;𝜃𝗈𝗉 and 𝛿𝐵:=𝜃𝗈𝗉;𝜃. For 𝜂𝐴:(𝑑,𝑑)∈𝖤𝗅𝗍(𝛿𝐴) let 𝜂𝐵 be its bridge transport from lemma 111.62(6). Then Δ⊩𝛿𝐴,𝜂𝐴𝑎∼𝑑⟺Δ⊩𝛿𝐵,𝜂𝐵𝑎∼𝑑.
Let 𝛿𝑖,𝛿𝑗 be vector self-generators for the same endpoint ̂𝖵𝖾𝖼(C,𝑑𝑚), built respectively from (𝛾𝑖,𝜈𝑖) and (𝛾𝑗,𝜈𝑗), and let 𝜂𝑖:(𝑑,𝑑)∈𝖤𝗅𝗍(𝛿𝑖). Put 𝜂𝑗:=𝖵𝑖,𝑗(𝜈𝑖,𝜈𝑗;𝜂𝑖):(𝑑,𝑑)∈𝖤𝗅𝗍(𝛿𝑗), using 𝗍𝗋𝑖,𝑗𝛾𝑖,𝛾𝑗 on every successor head and the recursive map on its tail. Then Δ⊩𝛿𝑖,𝜂𝑖𝑎∼𝑑⟺Δ⊩𝛿𝑗,𝜂𝑗𝑎∼𝑑.
If 𝛿 has paired peeling core 𝛿∘ and 𝜂∘:=𝗉𝖾𝖾𝗅𝛿(𝜂), then Δ⊩𝛿,𝜂𝑎∼𝑑⟺Δ⊩𝛿∘,𝜂∘𝑎∼𝑑.
Proof of Lemma 111.66 — Kripke evidence independence
Proof. Prove all four claims simultaneously, before erasing evidence, by the same nested recursion as definition 111.65. The outer component is the multiset of the two ambient code heights followed by the Hessenberg sum of the compared generator ranks. After that generator pair is fixed, the inner component is the Hessenberg sum of the membership ranks being compared. An arbitrary product argument may have any membership rank, but every call made with it is at a strict domain or family generator and therefore decreases the outer component. Normalize both self-derivations to paired peeling spines. The peeling maps of lemma 111.62(6) give the same core and transport membership evidence without changing its outer constructor; each core derivation has smaller construction rank, so the natural-sum component decreases. A universe premise decreases the level multiset instead.
At Unit there is nothing to compare. At Boolean and natural types, functionality preserves the disjoint true, false, zero, successor, and neutral evidence forms. The successor case invokes the induction hypothesis on the predecessor membership evidence. At a product, let the compared self-generators have domain premises 𝛼,𝛼′ and natural families 𝛽,𝛽′. Fix an arbitrary future embedding 𝜔:Δ↪Δ′ and an arbitrary target witness 𝜁′:(𝑒,𝑒)∈𝖤𝗅𝗍(𝜔∗𝛼′). Transport it backward, 𝜁:=𝗍𝗋𝜔∗𝛼′,𝜔∗𝛼(𝜁′), and use the induction hypothesis at the strict generator 𝜔∗𝛼 to replace the target argument judgment indexed by 𝜁′ with the source one indexed by 𝜁. Apply the source universal premise to obtain 𝜂𝜔,𝜁 at 𝛽𝜔,𝜁. The family comparison and lemma 111.62(6) transport that result forward to the witness at 𝛽′𝜔,𝜁′; the induction hypothesis at this strict family generator transports the indexed result judgment. Under a further world map 𝜏, both paths are the construction at 𝜏∘𝜔, by equation 111.3 and the naturality of 𝗍𝗋. Thus the comparison preserves the universal product clause, including its world and dependent-family indices. Reversing the maps proves the converse. At a sum, let 𝑑1=𝖿𝗌𝗍𝗏(𝑑). The map 𝗍𝗋𝛿,𝛿′ sends the stored first-component witness 𝜂1 to 𝜂′1 and hence sends the selected family premise 𝛽𝗂𝖽,𝜂1 to 𝛽′𝗂𝖽,𝜂′1. Apply the induction hypothesis to Δ⊩𝛼,𝜂1𝗉𝗋1(𝑎)∼𝑑1andΔ⊩𝛽𝗂𝖽,𝜂1,𝜂2𝗉𝗋2(𝑎)∼𝗌𝗇𝖽𝗏(𝑑) using precisely those two transported witnesses. This proves the dependent second projection at its transported fiber, rather than at an unidentified codomain. At an identity type, the transported clique contains the same reflexivity value and endpoints; recurse at the smaller carrier premise. Neutral identity evidence is literal after neutral-readback functionality.
For vectors, apply the three-clause map 𝖵𝑖,𝑗 displayed in the proof of lemma 111.62. Zero sends nil evidence to nil evidence. Successor sends 𝗏𝖼𝗈𝗇𝗌(𝜁,𝜂2) to 𝗏𝖼𝗈𝗇𝗌(𝗍𝗋𝑖,𝑗𝛾𝑖,𝛾𝑗(𝜁),𝖵𝑖,𝑗(𝜈′𝑖,𝜈′𝑗;𝜂2)), and the induction hypotheses apply separately to the head at the semantic embedding of 𝛾𝑗 and to the tail at the shorter vector generator. Neutral evidence is fixed. Zero, successor, and neutral lengths are disjoint, so no fourth case exists. The successor call decreases both the length and membership contribution to the natural sum; changing 𝑖 to 𝑗 uses the level-pair transport rather than comparing either level in an arbitrary order. At a universe, the membership evidence is itself a code self-derivation; lemma 111.62(2),(3) identifies its element relation without evaluating a level parameter. At a neutral type both sides are the same neutral-readback equations. These cases exhaust the generators and establish each displayed equivalence before any notation below forgets 𝛿 or 𝜂. Reversing every evidence map proves the reverse implications. ◻
For A∈T, write Δ⊩𝑎∼𝑑:A when there exist ranked witnesses 𝛿:A≈A and 𝜂:(𝑑,𝑑)∈𝖤𝗅𝗍(𝛿) such that Δ⊩𝛿,𝜂𝑎∼𝑑. Lemma 111.66 makes the choice immaterial and transports this erased notation along A≈B.
Let 𝜉@Ψ be a finite tuple of Ψ-admissible semantic derivations and membership witnesses. Its support is the initial semantic telescope Ψ fixed by definition 111.47; there are no unused or unclassified levels.
A realizing substitution(̂𝜎,𝜎):Ψ⟹Γ consists of a typed semantic substitution 𝜎:Ψ⇒ΨΓ, its diagonal relational witness 𝑞 for 𝜉 in the sense of definition 111.57, and a simultaneous raw substitution ̂𝜎=(𝑏0,…,𝑏|Ψ|−1) into Γ. Reading the support telescope from left to right, its 𝑗th obligation is the indexed judgment Γ⊩𝜎∗𝛿𝑗,𝜎∗𝜂𝑗𝑏𝑗∼𝜎∗(𝗑𝑗), at the substituted 𝑗th classifier.
The three extensions are distinct. If (̂𝜎,𝜎):Ψ⟹Γ and Γ⊩𝜎∗𝛼,𝜁𝑏∼𝑒, then arbitrary source extension is (̂𝜎,𝑏;𝜎,𝑒):Ψ.A⟹Γ.(111.3) If 𝜔:Γ↪Γ′ introduces target declarations, target weakening is (𝜔∗̂𝜎;𝗐𝗄∘𝜎):Ψ⟹Γ′. If Γ′=Γ,𝑥𝑚:𝐴 introduces the fresh target declaration used by readback, require Γ⊢𝐴≡𝖰𝑚(𝜎∗A)𝗍𝗒𝗉𝖾. Its semantic classifier telescope is ΨΓ′=ΨΓ.(𝜎∗A), and canonical lift is (̂𝜎,𝜎)↑:=(𝜔∗̂𝜎,𝑥𝑚;𝜎↑):Ψ.A⟹Γ′. Its final semantic component is ↑(𝗐𝗄∘𝜎)∗A(𝗑𝑚). The classifier (𝗐𝗄∘𝜎)∗A lives over ΨΓ.(𝜎∗A) and classifies that component; it is not the declaration extending ΨΓ. Reflection supplies the indexed obligation, so a bare neutral is never entered as a semantic value.
For composable realizing substitutions (̂𝜎,𝑏;𝜎,𝑒):Ψ.A⟹Γ and (̂𝜏,𝜏):ΨΓ⟹Θ, composition is componentwise raw substitution paired with semantic composition. Substitution and weakening for typing, together with lemma 111.48, lemma 111.64, prove (̂𝜏,𝜏)∘(̂𝜎,𝑏;𝜎,𝑒)=((̂𝜏,𝜏)∘(̂𝜎,𝜎),𝑏[̂𝜏];𝜏∗𝑒):Ψ.A⟹Θ. Writing out the semantic targets, canonical lifts satisfy (̂𝜏,𝜏)↑∘(̂𝜎,𝜎)↑=((̂𝜏,𝜏)∘(̂𝜎,𝜎))↑ as realizing substitutions from Ψ.A into the target context whose last semantic declaration is (𝜏∘𝜎)∗A. The first equation is arbitrary instantiation; the second is fresh lifting. Neither is inferred from the other.
The two directions of the following lemma are the proof-relevant operations 𝗋𝖾𝗂𝖿𝗒 and 𝗋𝖾𝖿𝗅𝖾𝖼𝗍: clause (a) is 𝗋𝖾𝗂𝖿𝗒, which turns evidence that a term is related to a value into a normal form together with the conversion certifying it, and clause (b) is 𝗋𝖾𝖿𝗅𝖾𝖼𝗍, which turns a neutral judgment into that evidence.
Let A∈T, Δ a context, 𝑛=|Δ|. The witnesses used by an erased hypothesis are formed at the semantic classifier telescope ΨΔ, whose length is 𝑛.
(Escape.) If Δ⊩𝑎∼𝑑:A then Δ⊢↓𝑛A(𝑑)𝗇𝖿𝖰𝑛(A) and Δ⊢𝑎≡↓𝑛A(𝑑):𝖰𝑛(A).
(Reflection.) If 𝑘 is a neutral value with 𝑘≈neΨΔ𝑘 (equivalently, 𝑘∈𝐾ΨΔ), Δ⊢𝖱𝑛(𝑘)𝗇𝖾𝖰𝑛(A) and Δ⊢𝑎≡𝖱𝑛(𝑘):𝖰𝑛(A), then Δ⊩𝑎∼↑A(𝑘):A.
(World stability.) If Δ⊩𝑎∼𝑑:A, 𝜔:Δ↪Δ′, let 𝜔Ψ:ΨΔ⇒ΨΔ′ be its typed classifier-telescope weakening and, with 𝑛′=|Δ′|, Δ′⊢𝑎′≡𝜔∗𝑎:𝖰𝑛′(𝜔Ψ∗A), then Δ′⊩𝑎′∼𝜔Ψ∗𝑑:𝜔Ψ∗A.
(Transport.) If 𝛿:A≈B@ΨΔ then Δ⊩𝑎∼𝑑:A holds if and only if Δ⊩𝑎∼𝑑:B does.
(Type quotation.) If Δ⊢𝐴≡𝖰𝑛(A)𝗍𝗒𝗉𝖾 for some Δ⊢𝐴𝗍𝗒𝗉𝖾, then Δ⊢𝖰𝑛(A)𝗇𝖿𝗍𝗒𝗉𝖾.
(Code quotation.) If moreover A∈C𝑖 and Δ⊢𝑐≡𝖰𝖼𝑛(A):U𝑖 for some Δ⊢𝑐:U𝑖, then Δ⊢𝖰𝖼𝑛(A)𝗇𝖿U𝑖.
(Element quotation.) Under the type-formation premise of (e), if 𝛿:A≈A and 𝜂:(𝑑,𝑑)∈𝖤𝗅𝗍(𝛿) are formed at ΨΔ, then Δ⊩𝛿,𝜂↓𝑛A(𝑑)∼𝑑 and the reified term is normal at 𝖰𝑛(A).
(Quotation under realizing substitution.) Let 𝛿:A≈A@Ψ, put 𝑛=|Ψ|, and 𝜂:(𝑑,𝑑)∈𝖤𝗅𝗍(𝛿), and let (̂𝜎,𝜎):Ψ⟹Γ be a realizing substitution, with 𝑚=|Γ|. Then Γ⊢𝖰𝑛(A)[̂𝜎]≡𝖰𝑚(𝜎∗A)𝗍𝗒𝗉𝖾,Γ⊢𝖰𝑚(𝜎∗A)𝗇𝖿𝗍𝗒𝗉𝖾,Γ⊩𝜎∗𝛿,𝜎∗𝜂↓𝑛A(𝑑)[̂𝜎]∼𝜎∗𝑑. If 𝛼:C≈𝑖C@Ψ is among the evidence, the corresponding code equation and normality judgment are Γ⊢𝖰𝖼𝑛(C)[̂𝜎]≡𝖰𝖼𝑚(𝜎∗C):U𝑖,Γ⊢𝖰𝖼𝑚(𝜎∗C)𝗇𝖿U𝑖.
Proof of Lemma 111.69 — Escape, reflection, world stability, and quotation normality
Proof. Choose witnesses 𝛿:A≈A and 𝜂:(𝑑,𝑑)∈𝖤𝗅𝗍(𝛿) whenever an erased hypothesis is used. Prove (a)–(c) and (e)–(h) simultaneously by the nested recursion of definition 111.65. The outer induction is on the finite multiset of active code heights and the Hessenberg sum of the generator ranks used by the displayed claims. Once those generators are fixed, the inner induction is on the Hessenberg sum of their membership ranks. A product argument may have unbounded membership rank; every claim made about it is at the strict domain generator, and every claim about its result is at the strict natural family generator. Natural and vector predecessor calls decrease the inner rank or the recorded shorter generator. Include the strict code generator used by (f) in the outer component. Prove (b) with the canonical self-membership evidence produced by reflection in lemma 111.63(4), whose hypothesis 𝑘≈neΨΔ𝑘 is now an explicit premise. Normalize paired peeling spines first. Their core premise has smaller derivation rank and peeling changes neither ↓ nor 𝖰𝑛, so the lift cases follow from the induction hypothesis. Claim (d) is exactly lemma 111.66 after evidence erasure.
The three standing requirements of definition 111.65 are discharged once and not repeated in the cases below. In (b), take 𝜂𝑘:(↑A(𝑘),↑A(𝑘))∈𝖤𝗅𝗍(𝛿). This is lemma 111.63(4) at the displayed 𝑘≈neΨΔ𝑘 premise. The typing requirement follows from lemma 111.26(2) and Conv. In (c), lemma 111.64 transports the semantic type, value, self-derivation, and membership evidence; lemma 111.48(3) transports every stored judgment to its quotation at depth 𝑛′. Transitivity with the displayed equation for 𝑎′ supplies the left-hand conversion. This is the only valid passage from 𝖰𝑛(A) to 𝖰𝑛′(𝜔∗A): weakening without world equivariance would retain the wrong fresh binder levels.
̂𝟏. (a): ↓ returns ⋆, which is normal by nf-star, and 𝟏-𝜂 gives Δ⊢𝑎≡⋆:𝟏. (b): the relation has no further condition. (c): the Unit generator and its stored typing equation are carried by lemma 111.48.
̂𝟐, ̂ℕ. (a): in a constructor case ↓ returns that constructor, normal by nf-true, nf-false, nf-zero or, using the induction hypothesis on the smaller predecessor evidence 𝜂′, nf-suc, and the stored equation is the required conversion. In the neutral case ↓ returns 𝖱𝑛(𝑘), normal by nf-ne because 𝟐 and ℕ are positive. (b): the neutral case of the definition is the hypothesis. In (c), the constructor evidence is fixed and neutral evidence is acted on by 𝜔∗; the stored equations are transported by lemma 111.48(3), and normality by lemma 111.26(1).
̂Π𝜖,𝜚(B,𝐹). (a): put Δ′:=Δ,𝑥𝑛:𝖰𝑛(B) and 𝗏:=↑B(𝗑𝑛). Then Δ′⊢𝑥𝑛𝗇𝖾𝖰𝑛(B) by ne-var and 𝖱𝑛+1(𝗑𝑛)=𝑥𝑛. Moreover 𝗑𝑛≈neΨΔ′𝗑𝑛 by lemma 111.55, because 𝗑𝑛 is the final declaration of the explicit target world ΨΔ′. Thus (b) at 𝜔∗B, where 𝜔=𝜔𝑛,𝑛+1, gives Δ′⊩𝑥𝑛∼𝗏:𝜔∗B. Let 𝜁𝑣 be its indexed membership witness. The definition of the relation at ̂Π gives Δ′⊩𝑎𝜖,𝜚𝑥𝑛∼(𝜔∗𝑑)⋅𝜖,𝜚𝗏:(𝜔∗𝐹)(𝗏), and (a) at the strict family premise 𝛽𝜔,𝜁𝑣 gives a normal 𝑤:=↓𝑛+1(𝜔∗𝐹)(𝗏)((𝜔∗𝑑)⋅𝜖,𝜚𝗏) with Δ′⊢𝑎𝜖,𝜚𝑥𝑛≡𝑤:−. Rule nf-lam makes 𝜆𝜖,𝜚(𝑥𝑛:𝖰𝑛(B)).𝑤 normal, and it is exactly ↓𝑛A(𝑑). Finally 𝜆-eq and Π-𝜂 give 𝑎≡𝜆𝜖,𝜚(𝑥𝑛:𝖰𝑛(B)).𝑎𝜖,𝜚𝑥𝑛≡𝜆𝜖,𝜚(𝑥𝑛:𝖰𝑛(B)).𝑤. (b): let 𝜔:Δ↪Δ′, put 𝑛′:=|Δ′|, and Δ′⊩𝑏∼𝑒:𝜔∗B. By (a) at 𝜔∗B, Δ′⊢𝑏≡↓𝑛′𝜔∗B(𝑒):−, with the right side normal. Moreover, 𝖱𝑛′(𝖺𝗉𝗉𝜖,𝜚(𝜔∗𝑘;𝜔∗B;𝑒))=𝖱𝑛′(𝜔∗𝑘)𝜖,𝜚↓𝑛′𝜔∗B(𝑒) is neutral by ne-app. After every typed future weakening from ΨΔ′, its head agrees with itself by lemma 111.56, and its argument agrees with itself by lemma 111.63(3) at that future support. Hence the new application neutral is self-related at ΨΔ′. Rule app-eq gives 𝜔∗𝑎𝜖,𝜚𝑏≡ that neutral. Now (b) at the strict target-world family premise 𝛽𝜔,𝜁 concludes. (c): the quantifier over Δ′⊵Δ is transitive in the extension because world embeddings compose, and lemma 111.48 identifies the composite action; app-eq transports the left-hand conversion.
̂Σ(B,𝐹). (a): the two induction hypotheses give normal ↓B(𝖿𝗌𝗍𝗏𝑑) and ↓𝐹(𝖿𝗌𝗍𝗏𝑑)(𝗌𝗇𝖽𝗏𝑑) with 𝗉𝗋1(𝑎)≡ the first and 𝗉𝗋2(𝑎)≡ the second; nf-pair makes the pair normal, and Σ-𝜂 followed by pair-eq gives 𝑎≡(−,−). (b): from 𝖿𝗌𝗍(𝑘) and 𝗌𝗇𝖽(𝑘), neutral by ne-fst and ne-snd. Reflection at the first component gives Δ⊩𝛼,𝜂1𝗉𝗋1(𝑎)∼↑B(𝖿𝗌𝗍(𝑘)). Let this value be 𝑑1. Only after fixing 𝑑1 does the second component have the fiber 𝐹(𝑑1); reflection there, followed by 𝗉𝗋2-eq, gives the second indexed premise. Thus both clauses use the same selected fiber. In (c), 𝜔∗𝜂1 selects 𝜔∗𝑑1, the family derivation is the target premise 𝛽𝜔,𝜔∗𝜂1, and 𝜔∗𝜂2 has exactly that membership type by lemma 111.64. The two projection equations then transport by lemma 111.48(3).
̂𝖨𝖽(B,𝑑𝑎,𝑑𝑏). (a): in the ̂𝗋𝖾𝖿𝗅 case, (a) at B applied to Δ⊩𝑏∼𝑑′:B gives a normal 𝑣:=↓𝑛B(𝑑′) with Δ⊢𝑏≡𝑣:𝖰𝑛(B). Rule nf-refl requires in addition Δ⊢↓𝑛B(𝑑𝑎)≡𝑣:𝖰𝑛(B) and the same for 𝑑𝑏; these are the two stored endpoint equations of definition 111.65 composed with 𝑏≡𝑣, and they are not obtainable from the typing of 𝑎 alone. Hence 𝗋𝖾𝖿𝗅𝑣=↓𝑛A(̂𝗋𝖾𝖿𝗅(𝑑′)) is normal at 𝖰𝑛(A), and Δ⊢𝑎≡𝗋𝖾𝖿𝗅𝑣:− follows from the stored equation 𝑎≡𝗋𝖾𝖿𝗅𝑏 and the Id-intro congruence along 𝑏≡𝑣. The neutral case uses nf-ne, identity types being positive. (b): the neutral case is the hypothesis. In (c), the carrier witness and both endpoint equations are acted on by 𝜔∗; the two equivariance equations for reification identify their target endpoints, and transitivity transports the left-hand equation.
̂𝖵𝖾𝖼(C,𝑑𝑚). (a): inspect the recorded length and vector-membership derivations. At ̂𝟢 the constructor case reifies to 𝗏𝗇𝗂𝗅, normal by nf-vnil because the stored equation is 𝑛≡𝟢; at ̂𝗌𝗎𝖼(𝑚) the three induction hypotheses give normal components and nf-vcons applies, its index premise being the stored equation; the neutral case uses nf-ne. For (b), related neutral evidence reflects directly. For (c), zero evidence is fixed. Successor evidence 𝗏𝖼𝗈𝗇𝗌(𝜁,𝜂2) is sent to 𝗏𝖼𝗈𝗇𝗌(𝗍𝗋𝑖,𝑗𝛾𝑖,𝛾𝑗(𝜔∗𝜁),𝜔∗𝜂2), where 𝑗 is the ambient level recorded by the transported vector generator; apply the induction hypothesis to the head at the semantic embedding of 𝛾𝑗 and to the tail at the transported shorter-length generator. Neutral evidence is transported by neutral equivariance. These are the zero, successor, and neutral clauses; no mixed clause belongs to the element relation.
Universe head. For ̂U𝑖, claim (a) starts from ↓̂U𝑖(𝑑)=𝖰𝖼𝑛(𝑑). The second stored equation is combined with induction hypothesis (f) at the smaller code-membership derivation. The result is a normal code at U𝑖; the first stored equation is the conversion. (b): a neutral 𝑘 with 𝖱𝑛(𝑘) neutral at U𝑖 has 𝖰𝖼𝑛(𝗎𝗉̂U𝑖(𝑘))=𝖱𝑛(𝑘),𝖰𝑛(𝗎𝗉̂U𝑖(𝑘))=𝖱𝑛(𝑘). Thus both stored equations are the hypothesis. Claim (c) follows from lemma 111.48.
Neutral type. Claims (a), (b), (e), and (f) are the stored judgments. Claim (c) applies 𝜔∗ to their neutral and equality derivations and then uses transitivity of judgmental equality.
Claims (e)–(h), simultaneously. The induction proves the two quotation-substitution equations in (h), not just their embedding instances. For Unit, Boolean, and natural heads, substitution fixes the nullary quotations. Element evidence is Unit, a Boolean constructor or neutral, or a finite chain of natural successors ending in zero or a neutral. The zero and constructor calculations use the corresponding computation rule. A successor invokes (h) on its smaller predecessor evidence. For neutral evidence, induct on the neutral-readback graph. A variable is exactly one of the obligations of the realizing substitution. Application, the two projections, and the four eliminators apply the induction hypotheses to the stored fields and then use the matching semantic-operation clause. The world-indexed invariant of lemma 111.55 supplies normality after the operation remains stuck. This proves (h), and the identity realizing substitution gives (g); nf-star, nf-true, nf-false, nf-zero, nf-suc, and nf-ne give the displayed normal judgments.
For a product generator supported by Ψ, with 𝑛=|Ψ|, first apply the quotation- substitution induction hypothesis to its strict domain premise. To quote the codomain in a target context Γ with semantic classifier telescope Φ and length 𝑚, first form the source fresh reflection 𝑣𝑛:=↑(𝗐𝗄Ψ,B)∗B(𝗑𝑛),𝜁𝑛:(𝑣𝑛,𝑣𝑛)∈𝖤𝗅𝗍((𝗐𝗄Ψ,B)∗𝛼). Its strict source family premise is 𝛽𝗐𝗄Ψ,𝜁𝑛@Ψ.B. Now let 𝗐𝗄Φ,𝜎∗B:Φ⇒Φ.(𝜎∗B) be target weakening and reflect the fresh target variable at its transported classifier: 𝑣𝑚:=↑(𝗐𝗄∘𝜎)∗B(𝗑𝑚),𝜁𝑚:(𝑣𝑚,𝑣𝑚)∈𝖤𝗅𝗍((𝗐𝗄∘𝜎)∗𝛼). The canonical lifted realizing substitution is exactly (̂𝜎,𝜎)↑. Its defining equation contains no arbitrary-extension notation. Its target is Φ.(𝜎∗B), its last component is classified there by (𝗐𝗄∘𝜎)∗B, and its semantic action sends 𝑣𝑛 to 𝑣𝑚. The naturality equation for 𝛽 gives the exact indexed identity (𝝈↑)∗𝛽𝗐𝗄Ψ,𝜁𝑛=𝛽𝗐𝗄∘𝝈,𝜁𝑚:((𝗐𝗄∘𝜎)∗𝐹)(𝑣𝑚)≈((𝗐𝗄∘𝜎)∗𝐹)(𝑣𝑚). Apply (h) to the strict source premise 𝛽𝗐𝗄Ψ,𝜁𝑛 under the canonical lifted realizing substitution. The displayed identity is its target index, so the induction hypothesis gives the substituted codomain equation and its normality. Rule nf-ty-pi proves the type parts of (e) and (h). Rule nf-cd-pi proves the code parts of (f) and (h).
It remains to prove the product element clause of (h). Let 𝐿:=↓𝑛̂Π𝜖,𝜚(B,𝐹)(𝑑)[̂𝜎]. The outer readback rule makes 𝐿 a lambda whose body is the source body quotation under the raw part (𝗐𝗄∗̂𝜎,𝑥𝑚) of the canonical lift (̂𝜎,𝜎)↑. The target product relation asks about an arbitrary future embedding 𝜏:Γ↪Γ′ and arbitrary indexed argument Γ′⊩𝜏∗𝜎∗𝛼,𝜁𝑏∼𝑒. Let Φ′ be the semantic classifier telescope of Γ′ and let 𝗐𝗄𝜏:Φ⇒Φ′ be the iterated typed target weakening induced by 𝜏; its action is the 𝜏∗ in the indexed premise. First weaken the target of the realizing substitution along 𝜏, obtaining (𝜏∗̂𝜎;𝗐𝗄𝜏∘𝜎). Then instantiate the source binder by the arbitrary argument 𝑏∼𝑒: (𝜏∗̂𝜎,𝑏;𝗐𝗄𝜏∘𝜎,𝑒).(111.5) This is realizing by arbitrary source extension in definition 111.68; its semantic component may contain every gap variable of Γ′. Apply (h) at the strict family premise 𝛽𝗐𝗄𝜏∘𝜎,𝜁. It yields Γ′⊩𝛽𝗐𝗄𝜏∘𝜎,𝜁,𝜂𝗐𝗄𝜏∘𝜎,𝜁(↓𝑛+1𝐹(𝑣𝑛)(𝑑⋅𝑣𝑛))[𝜏∗̂𝜎,𝑏]∼((𝗐𝗄𝜏∘𝜎)∗𝑑)⋅𝑒. By Π-𝛽, the raw term on the left is judgmentally equal to 𝜏∗𝐿𝜖,𝜚𝑏; by equation 111.3, equation 111.6, its semantic index is exactly the result witness selected by 𝜏∗(𝜎∗𝜂). This proves the universal product clause at every future world and every related argument. No inference from the single fresh variable to arbitrary arguments occurs. Rule nf-lam gives normality. Taking (̂𝜎,𝜎) to be the identity realizing substitution, whose component obligations follow by (b) at the strict support classifiers, proves (g).
For a sum generator, put 𝑑1=𝖿𝗌𝗍𝗏(𝑑), 𝑑2=𝗌𝗇𝖽𝗏(𝑑), and let 𝜂1,𝜂2 be the recorded component evidence. Under a realizing substitution (̂𝜎,𝜎), first apply (h) to 𝜂1 at 𝛼. This gives 𝑏1:=↓𝑛B(𝑑1)[̂𝜎]withΓ⊩𝜎∗𝛼,𝜎∗𝜂1𝑏1∼𝜎∗𝑑1. Only now is the target fiber selected. Family naturality identifies 𝜎∗(𝛽𝗂𝖽Ψ,𝜂1)=𝛽𝜎,𝜎∗𝜂1, and the type part of (h) gives the explicit fiber conversion Γ⊢𝖰𝑛(𝐹(𝑑1))[̂𝜎]≡𝖰𝑚((𝜎∗𝐹)(𝜎∗𝑑1))𝗍𝗒𝗉𝖾. Transport 𝜎∗𝜂2 across that equality and apply (h) to obtain 𝑏2∼𝜎∗𝑑2 in precisely this fiber. Rule nf-pair applies after equation 111.7; Σ-𝜂 and the two projection equations give the indexed judgment. The same domain-then-fiber calculation proves nf-ty-sg and nf-cd-sg. This is the required dependent transport: the second component is never quoted at an unidentified or unconverted fiber.
For identity, the carrier induction hypothesis gives its substituted quotation. The clique in reflexivity evidence supplies carrier membership for both endpoints and the reflexivity witness. Apply (h) to all three strict carrier witnesses; substitution of the two stored endpoint equations puts their target quotations in the one required identity type. nf-ty-id, nf-cd-id, and nf-refl apply. Neutral identity evidence uses the neutral-graph induction above.
For a vector generator, apply the code part of (h) to its strict code premise and the element part to its length evidence at ̂ℕ. These are the two substituted premises of nf-ty-vec and nf-cd-vec. At zero, substitution fixes 𝗏𝗇𝗂𝗅. At successor evidence 𝜁:(𝑎,𝑎)∈𝖤𝗅𝗍(𝛾𝑖),𝜂2:(𝑥𝑠,𝑥𝑠)∈𝖤𝗅𝗍(𝛿𝜈′), transport 𝜎∗𝜁 through lemma 111.62(4),(6), apply (h) to the head at the strict semantic embedding of 𝛾𝑖, and apply (h) to 𝜂2 at the shorter vector generator. Together with the predecessor quotation, nf-vcons gives the substituted result and its index equation. At a neutral length, use the neutral-graph induction. Zero, successor, and neutral are all cases; the successor calls decrease the recorded shorter generator and membership evidence.
For a universe, (e) uses nf-ty-univ; the element part of (h) is the simultaneous code part at the smaller-level code derivation stored as universe membership. Code generators use, in order, nf-cd-𝐾, nf-cd-univ, nf-cd-pi, nf-cd-sg, nf-cd-id, and nf-cd-vec, with their raw substitution equations supplied by the strict premise instances of (h). A code lift invokes (h) at its smaller premise and then nf-cd-lift. A neutral code has endpoint N=𝗎𝗉̂U𝑖(𝑘) fixed in definition 111.58; its element annotations are N itself, and the neutral-graph induction supplies its substitution equation. Peeling invokes the strict semantic-type premise and changes neither quotation nor element evidence. These cases prove (e)–(h) for every generator and close the simultaneous induction.
Claim (d), uniformly. Choose witnesses for either erased judgment and transport them along A≈B using lemma 111.66; its converse supplies the reverse implication. The quoted types agree by lemma 111.63(1), so the standing typing premise is preserved by Conv. ◻
Let Δ be a context and 𝑛=|Δ|. If A∈T and Δ⊢𝐴≡𝖰𝑛(A)𝗍𝗒𝗉𝖾 for some Δ⊢𝐴𝗍𝗒𝗉𝖾, then Δ⊢𝖰𝑛(A)𝗇𝖿𝗍𝗒𝗉𝖾; if moreover A∈C𝑖 and Δ⊢𝑐≡𝖰𝖼𝑛(A):U𝑖 for some Δ⊢𝑐:U𝑖, then Δ⊢𝖰𝖼𝑛(A)𝗇𝖿U𝑖.
Proof of Lemma 111.70 — Quotation lands in normal syntax
Proof. Apply lemma 111.69(e) for the type claim and lemma 111.69(f) for the code claim. They were proved in the same well-founded induction as escape and element quotation, so this corollary introduces no reverse dependency. ◻
★★★ Following definition 111.58, define the partial equivalence relation interpreting U0 for the fragment with ̂𝟐 and ̂Π alone, as an inductive definition of related pairs of codes carrying, by recursion on that definition, the relation on their elements. Where does the ambiguity of remark 49.10 threaten, and what rules it out in your definition?
Everything so far is a definition. The single theorem that turns the definitions into a normalizer is the statement that every derivable judgment of 𝑇𝗂𝗆𝗉𝗅 is valid: its type has a semantic type, its term has an element, judgmentally equal inputs have related outputs, and the syntax stays tied to the semantics by the Kripke relation of definition 111.65. The invariant on environments has to carry all four of those, and it does so in two separate notions, for a reason the definition states.
Let Γ be the context 𝑥1:𝐴1,…,𝑥𝑚:𝐴𝑚, and write 𝜌<𝑗 for the length-(𝑗−1) prefix of an environment 𝜌.
Fix a semantic support telescope Ψ, independently of any syntactic target context. Two Ψ-admissible environments of length 𝑚 are related over Γ at Ψ, written 𝜌≈Ψ𝜌′:Γ, when they carry, for every 𝑗≤𝑚, ranked witnesses 𝛼𝑗:[[𝐴𝑗]]𝜌<𝑗≈[[𝐴𝑗]]𝜌′<𝑗@Ψ,𝜁𝑗:(𝜌(𝑗),𝜌′(𝑗))∈𝖤𝗅𝗍Ψ(𝛼𝑗). Formation of the displayed membership judgment supplies the admissibility of both endpoints and of 𝜁𝑗; 𝛼𝑗 is Ψ-admissible by its own formation. Thus the notation records a common finite initial telescope and not merely an erased binary relation. No theorem reconstructs this index from an erased pair of environments. Instead, the semantic half of the fundamental lemma quantifies over Ψ and over the displayed ranked witnesses at Ψ; each environment extension preserves that same formation index, and only an explicit typed substitution changes it. For a typed relational substitution 𝝈:Ψ⇒Φ, componentwise action gives 𝝈∗𝜌≈Φ𝝈∗𝜌′:Γ; the witnesses are 𝝈∗𝛼𝑗 and 𝝈∗𝜁𝑗.
Let Δ be a context with 𝑛=|Δ|. A pair (𝛾,𝜌) is valid over Γ in Δ, written Δ⊩(𝛾,𝜌):Γ, when 𝛾 assigns to each 𝑥𝑗 a term with Δ⊢𝛾(𝑥𝑗):𝐴𝑗[𝛾], when 𝜌≈ΨΔ𝜌:Γ for the semantic classifier telescope ΨΔ of Δ, and when for every 𝑗≤𝑚Δ⊩𝛼𝑗,𝜁𝑗𝛾(𝑥𝑗)∼𝜌(𝑗):[[𝐴𝑗]]𝜌<𝑗.
The two notions must be kept apart, and the reason is worth stating, because collapsing them is the natural mistake. An element of 𝖤𝗅𝗍(A) need not be the value of any term: nothing in definition 111.58 restricts the relation to definable values. A single invariant carrying both a value and a syntactic witness for it could therefore not be extended by an arbitrary related pair (𝑑,𝑒), and that extension is exactly what the formation and introduction rules of Π and Σ require, since their semantic clauses quantify over all related arguments. Conversely, the syntactic half quantifies over every future argument that comes with a Kripke witness. Fresh reflection supplies the identity environment, while lemma 111.69(h) extends quotation by an arbitrary such argument. The fundamental lemma below therefore has two halves with two different environment notions, and each rule is checked against both.
Let 𝑡 be a raw expression with free variables among Γ=(𝑥1,…,𝑥𝑚) and let 𝜌 be an environment.
If 𝑥𝑚 is not free in 𝑡, then [[𝑡]](𝜌,𝑑)=[[𝑡]]𝜌 for every 𝑑.
For a substitution 𝛾=(𝑎1,…,𝑎𝑚), [[𝑡[𝛾]]]𝜌=[[𝑡]]([[𝑎1]]𝜌,…,[[𝑎𝑚]]𝜌). In particular [[𝑡[𝑎/𝑥]]]𝜌=[[𝑡]](𝜌,[[𝑎]]𝜌).
If 𝜎:Ψ⇒Φ and 𝜌 is Ψ-admissible, then [[𝑡]](𝜎∗𝜌)=𝜎∗([[𝑡]]𝜌). Beneath 𝑟 instantiated source binders, the equation uses the iterated arbitrary extension (𝜎,𝑒1,…,𝑒𝑟) of equation 111.2; beneath a fresh target binder it uses the canonical lift 𝜎↑ of equation 111.1. It is natural in every further typed substitution 𝜏:Φ⇒Ξ.
Proof of Lemma 111.72 — Evaluation, weakening, and substitution
Proof. Structural induction on 𝑡, simultaneously for all three clauses. A variable is lookup: for (1) in the unchanged prefix, for (2) the 𝑗-th component [[𝑎𝑗]]𝜌 by definition. Every non-binding constructor of convention 111.16 evaluates to a value built from the values of its immediate subexpressions by an operation of definition 111.44; the induction hypotheses equate those values, and graph determinism equates the outputs. Every binding constructor evaluates to a finite raw closure. Choosing the bound variable outside dom(𝛾) and the free variables of its images, the induction hypothesis for 𝑏 at the extended environment shows that the two closure execution graphs agree on every tuple of arguments. Hence the closures are equal in the contextual quotient of definition 49.36; multi-binder instantiation uses (𝜎,𝑒1,…,𝑒𝑟) and repeated equation 111.2; only a new target declaration uses equation 111.1. Naturality is associativity of composition and lemma 111.48(1). The 𝖫𝗂𝖿𝗍 clause is the unary operation ̂𝗅𝗂𝖿𝗍⌈ℓ⌉, and the symbolic level is unaffected by substitution because levels are external (convention 29.3). ◻
Proof. Induction on the derivation of C≈𝑖C′. On ̂𝟏,̂𝟐,̂ℕ the operation is the identity and the same generator applies at level 𝑖+1, whose element clause does not mention the level. On ̂U𝑗 with 𝑗≺𝑖 the operation is the identity and 𝑗≺𝑖+1, so the generator applies and the element relation is ≈𝑗 either way. On ̂Π and ̂Σ the operation lifts the domain and every codomain, and the induction hypothesis gives the corresponding derivations at level 𝑖+1 with the same element relations, whence the displayed element clauses agree. On ̂𝖨𝖽 the operation lifts the carrier only, and the endpoints stay related by the induction hypothesis. On the three stuck heads the operation returns ̂𝖫𝗂𝖿𝗍𝑖(−), and the lift generator of definition 111.58 applies with 𝖤𝗅𝗍 unchanged by definition. ◻
Each clause has two independently quantified halves. Its semantic half is quantified over every finite semantic support telescope Ψ and every 𝜌≈Ψ𝜌′:Γ; its output includes the displayed ranked Ψ-admissible witness. Its syntactic half is quantified over every Δ⊩(𝛾,𝜌):Γ, with 𝑛=|Δ| and support ΨΔ.
If Γ⊢𝐴𝗍𝗒𝗉𝖾, then there is 𝛼𝐴:[[𝐴]]𝜌≈[[𝐴]]𝜌′@Ψ, and Δ⊢𝐴[𝛾]≡𝖰𝑛([[𝐴]]𝜌)𝗍𝗒𝗉𝖾.
If Γ⊢𝐴≡𝐵𝗍𝗒𝗉𝖾, then there is 𝛼𝐴,𝐵:[[𝐴]]𝜌≈[[𝐵]]𝜌′@Ψ, and Δ⊢𝐴[𝛾]≡𝐵[𝛾]𝗍𝗒𝗉𝖾.
If Γ⊢𝑎:𝐴, then there is 𝜁𝑎:([[𝑎]]𝜌,[[𝑎]]𝜌′)∈𝖤𝗅𝗍Ψ(𝛼𝐴), where 𝛼𝐴 is the witness from (a), and Δ⊩𝑎[𝛾]∼[[𝑎]]𝜌:[[𝐴]]𝜌.
If Γ⊢𝑎≡𝑏:𝐴, then there is 𝜁𝑎,𝑏:([[𝑎]]𝜌,[[𝑏]]𝜌′)∈𝖤𝗅𝗍Ψ(𝛼𝐴), and both Δ⊩𝑎[𝛾]∼[[𝑎]]𝜌:[[𝐴]]𝜌 and Δ⊩𝑏[𝛾]∼[[𝑏]]𝜌:[[𝐴]]𝜌.
Proof of Lemma 111.74 — Fundamental lemma for T_ impl
Proof. Simultaneous rule induction on the four judgment forms (remark 26.23); each case discharges both halves. A subsidiary induction on the element derivation is used in the ℕ and 𝖵𝖾𝖼 elimination cases. In a semantic call, fix the support Ψ carried by 𝜌≈Ψ𝜌′; in a syntactic call, independently put 𝑛=|Δ| and use ΨΔ. No semantic premise is indexed by 𝑛 merely because the other half happens to mention Δ. All constructor and closure clauses preserve Ψ-admissibility by lemma 111.48; every output membership judgment contains the two endpoint-admissibility premises of definition 111.58, and all output derivations and membership witnesses carry the assigned ranks. Thus every induction hypothesis used below has a common support and ranked witnesses. Furthermore, lemma 111.62(2) is used silently to speak of the element relation of a pair of related types. Lemma 111.69(d) transports the Kripke relation along ≈ and is likewise used silently.
Two extension principles are used repeatedly and are recorded once. Semantic extension: if 𝜌≈Ψ𝜌′:Γ, 𝛼:[[𝐴]]𝜌≈[[𝐴]]𝜌′@Ψ and 𝜁:(𝑑,𝑒)∈𝖤𝗅𝗍Ψ(𝛼), then (𝜌,𝑑)≈Ψ(𝜌′,𝑒):Γ,𝑥:𝐴. The final declaration uses 𝛼 and 𝜁; the formation premises of 𝜁 give 𝑑,𝑒∈𝐷Ψ, so the two extended environments satisfy the admissibility clause of definition 111.71. Nothing syntactic is required, and 𝑑,𝑒 are arbitrary among values admissible at Ψ. Syntactic extension: if Δ⊩(𝛾,𝜌):Γ and Δ⊢𝐴[𝛾]≡𝖰𝑛([[𝐴]]𝜌)𝗍𝗒𝗉𝖾, then, writing Δ′:=Δ,𝑥𝑛:𝐴[𝛾] and 𝜔:Δ↪Δ′, and 𝗏:=↑𝜔∗[[𝐴]]𝜌(𝗑𝑛), Δ′⊩(𝜔∗𝛾,𝑥𝑛),(𝜔∗𝜌,𝗏):Γ,𝑥:𝐴. Here Δ′⊢𝑥𝑛𝗇𝖾𝐴[𝛾] by ne-var, and lemma 111.55 gives 𝗑𝑛≈neΨΔ′𝗑𝑛 at the explicit extended classifier telescope. World equivariance turns the weakened type equation into 𝐴[𝛾]≡𝖰𝑛+1(𝜔∗[[𝐴]]𝜌), so lemma 111.69(b) supplies the Kripke component, while lemma 111.63(4) supplies (𝗏,𝗏) in the element relation.
One half is uniform and is disposed of once: the syntactic half of clause (b), namely Δ⊢𝐴[𝛾]≡𝐵[𝛾]𝗍𝗒𝗉𝖾, is Subst-Eq-Ty applied to the premise Γ⊢𝐴≡𝐵𝗍𝗒𝗉𝖾 and the substitution 𝛾, in every case. The cases below therefore treat only the semantic half of (b).
Structural rules.Var and Assum. Both halves are the corresponding clauses of definition 111.71 at the selected declaration, together with 𝑥𝑗[𝛾]=𝛾(𝑥𝑗) and [[𝑥𝑗]]𝜌=𝜌(𝑗).
Wk, Exch, Rename. These change the ambient context without changing the expression. A related environment, respectively a valid pair, for the larger context restricts to one for the smaller by deleting, permuting, or renaming the corresponding components; every clause of definition 111.71 is preserved componentwise, and lemma 111.72(1) identifies the two evaluations.
Subst and Subst-Eq-Ty, Subst-Eq-Tm. Given Γ⊢𝑎:𝐴 and a judgment in Γ,𝑥:𝐴,Θ, the semantic half of induction hypothesis (c) for 𝑎 extends 𝜌≈Ψ𝜌′ by ([[𝑎]]𝜌,[[𝑎]]𝜌′), and its syntactic half extends (𝛾,𝜌) by (𝑎[𝛾],[[𝑎]]𝜌). Applying the induction hypothesis at the longer context and rewriting with lemma 111.72(2) gives the claim for the substituted judgment.
Ctx-Conv. A related environment or valid pair for Γ,𝑥:𝐴′,Θ is one for Γ,𝑥:𝐴,Θ when Γ⊢𝐴≡𝐴′𝗍𝗒𝗉𝖾: the type component transports by induction hypothesis (b), the element component by lemma 111.62(2), and the Kripke component by lemma 111.69(d).
Conv and Conv-Eq. Induction hypothesis (b) gives [[𝐴]]𝜌≈[[𝐵]]𝜌′@Ψ; the element relations coincide by lemma 111.62(2), and the Kripke relation transports by lemma 111.69(d).
The equality rules. Six rules are treated together: Ty-Refl, Ty-Sym, Ty-Trans, Tm-Refl, Tm-Sym and Tm-Trans. The relation 𝜌≈Ψ𝜌′:Γ is symmetric and transitive, because ≈ and every element relation are (lemma 111.62(1)); so induction hypothesis (d) at the exchanged environments gives symmetry, and composing two instances with the middle term evaluated at a common 𝜌 gives transitivity. On the syntactic side both are symmetry and transitivity of judgmental equality. Reflexivity is (a) and (c), and the presupposition rules follow from (a) and (c) directly.
Π.Π-form and Π-form-eq. Semantic half: induction hypothesis (a) for 𝐴 gives 𝛼:[[𝐴]]𝜌≈[[𝐴]]𝜌′@Ψ. For every relational substitution 𝝈=(𝜎0,𝜎1;𝑞):Ψ⇒Φ and every 𝜁:(𝑑,𝑒)∈𝖤𝗅𝗍Φ(𝝈∗𝛼),lemma 111.72(3) identifies 𝜎0∗[[𝐴]]𝜌 with [[𝐴]](𝜎0∗𝜌) and likewise on the right. Hence (𝜎0∗𝜌,𝑑)≈Φ(𝜎1∗𝜌′,𝑒) is a related environment over Γ,𝑥:𝐴, and induction hypothesis (a) for 𝐵 gives 𝛽𝝈,𝜁:[[𝐵]](𝜎0∗𝜌,𝑑)≈[[𝐵]](𝜎1∗𝜌′,𝑒)@Φ. Under a further relational 𝝉, evaluation-substitution and the induction hypothesis identify this derivation with 𝛽𝝉∘𝝈,𝝉∗𝜁, proving equation 111.3. This is the step for which the semantic half must not carry a syntactic witness: 𝑑 and 𝑒 range over the whole target-world element relation. The ̂Π generator then applies with the pair (𝜖,𝜚) copied unchanged from the syntax; the metadata premise of remark 111.17 is exactly what makes the generator applicable, and a mismatched pair produces no generator at all. Syntactic half: induction hypothesis (a) for 𝐴 gives Δ⊢𝐴[𝛾]≡𝖰𝑛([[𝐴]]𝜌)𝗍𝗒𝗉𝖾; syntactic extension and induction hypothesis (a) for 𝐵 give Δ′⊢𝐵[𝛾+]≡𝖰𝑛+1([[𝐵]](𝜌,𝗏))𝗍𝗒𝗉𝖾, and Π-form-eq assembles the two into the required equation, whose right-hand side is 𝖰𝑛 of the semantic product.
Π-intro and 𝜆-eq. Let Γ,𝑥:𝐴⊢𝑏:𝐵. For the semantic half, fix an arbitrary relational 𝝈=(𝜎0,𝜎1;𝑞):Ψ⇒Φ and 𝜁:(𝑑,𝑒)∈𝖤𝗅𝗍Φ(𝝈∗[[𝐴]]𝜌). Its formation gives 𝑑,𝑒∈𝐷Φ. Apply induction hypothesis (c) at the related environment (𝜎0∗𝜌,𝑑)≈Φ(𝜎1∗𝜌′,𝑒). Since (𝜎0∗[[𝜆𝜖,𝜚(𝑥:𝐴).𝑏]]𝜌)⋅𝜖,𝜚𝑑=[[𝑏]](𝜎0∗𝜌,𝑑) by definition 111.44, lemma 111.48, the required left output is [[𝑏]](𝜎0∗𝜌,𝑑); the identical calculation with 𝜎1,𝜌′,𝑒 gives the right output. The required product membership witness is therefore that induction hypothesis. Its naturality in a further substitution is the evaluation-substitution equation, so the universal product evidence is fully supplied. For the Kripke half, let 𝜔:Δ↪Δ′ and Δ′⊩𝑐∼𝑒:𝜔∗[[𝐴]]𝜌. Extend the transported pair (𝜔∗𝛾,𝜔∗𝜌) by (𝑐,𝑒). It is a valid pair over Γ,𝑥:𝐴: its Kripke component is the hypothesis, and its element component (𝑒,𝑒)∈𝖤𝗅𝗍ΨΔ′(𝜔∗[[𝐴]]𝜌) is the transported domain membership supplied by lemma 111.64. Induction hypothesis (c) then gives Δ′⊩𝑏[𝜔∗𝛾,𝑐/𝑥]∼[[𝑏]](𝜔∗𝜌,𝑒); rule Π-𝛽 gives Δ′⊢𝜔∗(𝜆𝜖,𝜚(𝑥:𝐴[𝛾]).𝑏[𝛾+]))𝜖,𝜚𝑐≡𝑏[𝜔∗𝛾,𝑐/𝑥]:−, and lemma 111.69(c) transports the relation along it.
Π-elim and app-eq. Induction hypothesis (c) for 𝑓 and for 𝑎, the element clause at ̂Π, and the Kripke clause at ̂Π taken at Δ′=Δ give both halves at the semantic type [[𝐵]](𝜌,[[𝑎]]𝜌), which is [[𝐵[𝑎/𝑥]]]𝜌 by lemma 111.72(2). This is the case that defeated the induction on derivations in section 111.6; it goes through here because the induction hypothesis for 𝑓 is a statement about all related arguments, not about one syntactic subterm.
Π-𝛽. The left side evaluates to [[𝑏]](𝜌,[[𝑎]]𝜌) and the right side to [[𝑏[𝑎/𝑥]]]𝜌′, which is [[𝑏]](𝜌′,[[𝑎]]𝜌′); the two are related by induction hypothesis (c) at the extended pair. The two Kripke statements are the ones just proved for the two sides.
Π-𝜂. Here the two values are not equal: [[𝑓]]𝜌 may be 𝗎𝗉(𝑘) while [[𝜆𝜖,𝜚(𝑥:𝐴).𝑓𝜖,𝜚𝑥]]𝜌 is a 𝗅𝖺𝗆 value. They are nevertheless related, and this is the clause for which the element relation at ̂Π was made extensional. Fix arbitrary 𝝈=(𝜎0,𝜎1;𝑞):Ψ⇒Φ and 𝜁:(𝑑,𝑒)∈𝖤𝗅𝗍Φ(𝝈∗[[𝐴]]𝜌). Then 𝜎0∗([[𝑓]]𝜌)⋅𝜖,𝜚𝑑and𝜎1∗([[𝜆𝜖,𝜚(𝑥:𝐴).𝑓𝜖,𝜚𝑥]]𝜌′)⋅𝜖,𝜚𝑒=𝜎1∗([[𝑓]]𝜌′)⋅𝜖,𝜚𝑒, the equality by definition 111.44 and lemma 111.72(1), and the two are related by induction hypothesis (c) for 𝑓 at the substituted related environments. This construction is natural in a further target substitution by lemma 111.48; hence it is product evidence, not merely base-world pointwise evidence. On the Kripke side, Π-𝛽 and lemma 111.69(c) again transport.
Σ.Σ-form. Let 𝛼:[[𝐴]]𝜌≈[[𝐴]]𝜌′@Ψ. For every relational 𝝈=(𝜎0,𝜎1;𝑞):Ψ⇒Φ and 𝜁:(𝑑,𝑒)∈𝖤𝗅𝗍Φ(𝝈∗𝛼), semantic extension and the induction hypothesis for 𝐵 give 𝛽𝝈,𝜁:[[𝐵]](𝜎0∗𝜌,𝑑)≈[[𝐵]](𝜎1∗𝜌′,𝑒)@Φ. Evaluation-substitution proves 𝝉∗𝛽𝝈,𝜁=𝛽𝝉∘𝝈,𝝉∗𝜁, so these are exactly the domain and natural dependent-family premises of the ̂Σ generator. Syntactic formation uses the same construction at the self-related environment and the type-quotation clause of lemma 111.69(e).
Σ-intro and pair-eq. Put 𝑎0=[[𝑎]]𝜌, 𝑎1=[[𝑎]]𝜌′. The induction hypothesis for 𝑎 supplies 𝜂1:(𝑎0,𝑎1)∈𝖤𝗅𝗍Ψ(𝛼). Only after this first-component witness is fixed do we extend the environments and apply the induction hypothesis for 𝑏, obtaining 𝜂2:([[𝑏]](𝜌,𝑎0),[[𝑏]](𝜌′,𝑎1))∈𝖤𝗅𝗍Ψ(𝛽𝗂𝖽Ψ,𝜂1). The pair (𝜂1,𝜂2) is precisely the dependent-sum element evidence. At a valid syntactic environment the two self-witnesses give Δ⊩𝛼,𝜂1𝗉𝗋1((𝑎[𝛾],𝑏[𝛾]))∼𝑎0,Δ⊩𝛽𝗂𝖽ΨΔ,𝜂1,𝜂2𝗉𝗋2((𝑎[𝛾],𝑏[𝛾]))∼[[𝑏]](𝜌,𝑎0). The first uses Σ-𝛽1; that equation selects the fiber 𝛽𝗂𝖽ΨΔ,𝜂1 in which the second judgment lives, and then Σ-𝛽2 supplies the second equation. Thus the dependent transport is determined before the second component is checked.
Σ-elim1, Σ-elim2, and projection congruence. If the induction hypothesis for 𝑝 supplies sum evidence (𝜂1,𝜂2), the first projection uses 𝜂1 at 𝛼. Put 𝑝1=𝖿𝗌𝗍𝗏([[𝑝]]𝜌). The second projection uses 𝜂2 at 𝛽𝗂𝖽Ψ,𝜂1, and lemma 111.72(2) identifies that semantic fiber with [[𝐵[𝗉𝗋1𝑝/𝑥]]]𝜌. The two Kripke premises in definition 111.65 have exactly these indices. Projection congruence transports 𝜂1 first and then the selected 𝜂2. The two 𝛽-rules are literal equalities of values together with the two indexed judgments displayed above.
Σ-𝜂. As for Π: the two values [[𝑝]]𝜌 and 𝗉𝖺𝗂𝗋(𝖿𝗌𝗍𝗏[[𝑝]]𝜌′,𝗌𝗇𝖽𝗏[[𝑝]]𝜌′) need not be equal, but their semantic projections are, so they are related by the element clause at ̂Σ. More explicitly, the first projection uses the stored 𝜂1 and thereby fixes 𝑝1; the second uses the stored judgment 𝜂2:(𝗌𝗇𝖽𝗏[[𝑝]]𝜌,𝗌𝗇𝖽𝗏[[𝑝]]𝜌′)∈𝖤𝗅𝗍Ψ(𝛽𝗂𝖽Ψ,𝜂1). On the syntactic side the Kripke clause at ̂Σ uses these two indexed witnesses, and Σ-𝛽1,2 identify the projections of the reconstructed pair with the projections of 𝑝[𝛾], so lemma 111.69(c) transports the relation from one to the other.
𝟏.𝟏-form, 𝟏-intro, 𝟏-𝜂. The generator ̂𝟏 has 𝖤𝗅𝗍Ψ=𝐷Ψ×𝐷Ψ. Evaluation at related Ψ-admissible environments produces Ψ-admissible values by lemma 111.48, so the two endpoint formation premises construct the Unit membership evidence. The Kripke clause at ̂𝟏 imposes only the typing that the judgment supplies. 𝟏-𝜂 is therefore valid without inspecting either value. This is the only former whose element relation deliberately relates every pair admissible at the displayed support; that coarseness is the semantic content of 𝟏-𝜂 and is the reason section 111.6 showed why it cannot be implemented by rewriting.
𝟐.Formation, 𝟐-intro1,2. The generator ̂𝟐 applies, and ̂𝗍𝗍, ̂𝖿𝖿 are related to themselves; the Kripke clauses are reflexivity of judgmental equality.
𝟐-elim and its congruence. Induction hypothesis (c) for the scrutinee 𝑏 puts ([[𝑏]]𝜌,[[𝑏]]𝜌′) in 𝖤𝗅𝗍(̂𝟐), so exactly one of three cases holds. If both are ̂𝗍𝗍, then 𝗂𝖿𝗏 selects [[𝑐𝑡]]𝜌 and [[𝑐𝑡]]𝜌′, related by induction hypothesis (c) at [[𝐶]](𝜌,̂𝗍𝗍)=[[𝐶[𝗍𝗍/𝑥]]]𝜌, which is [[𝐶[𝑏/𝑥]]]𝜌 because [[𝑏]]𝜌=̂𝗍𝗍. On the syntactic side the Kripke clause for 𝑏 gives Δ⊢𝑏[𝛾]≡𝗍𝗍:𝟐, so the eliminator congruence and 𝟐-comp1 give 𝗂𝗇𝖽𝟐(𝑥.𝐶[𝛾+];𝑐𝑡[𝛾],𝑐𝑓[𝛾],𝑏[𝛾])≡𝑐𝑡[𝛾], and lemma 111.69(c) transports. If both values are ̂𝖿𝖿, then 𝗂𝖿𝗏 selects the two interpretations of 𝑐𝑓. Induction hypothesis (c) relates them in the fiber [[𝐶]](𝜌,̂𝖿𝖿)=[[𝐶[𝖿𝖿/𝑥]]]𝜌=[[𝐶[𝑏/𝑥]]]𝜌. The Kripke clause for 𝑏 gives Δ⊢𝑏[𝛾]≡𝖿𝖿:𝟐; eliminator congruence and 𝟐-comp2 therefore give 𝗂𝗇𝖽𝟐(𝑥.𝐶[𝛾+];𝑐𝑡[𝛾],𝑐𝑓[𝛾],𝑏[𝛾])≡𝑐𝑓[𝛾], after which lemma 111.69(c) transports. If both values are related neutrals 𝗎𝗉(𝑘), 𝗎𝗉(𝑘′), then 𝗂𝖿𝗏 returns two ̂𝗂𝗇𝖽𝟐 nodes; they are ≈neΨ because their readbacks agree after every typed future weakening from Ψ, by lemma 111.63(1) on the quoted motive and (3) on the two reified branches, and by hypothesis on the principal argument. The Kripke half uses ne-ind-bool: its motive and branch premises are normal by lemma 111.70 and lemma 111.69(a), and the eliminator congruence identifies 𝗂𝗇𝖽𝟐(𝑥.𝐶[𝛾+];…,𝑏[𝛾]) with the readback of the neutral node.
𝟐-comp1,2. Literal equality of values, as computed above, together with the two Kripke statements.
ℕ.Formation, ℕ-intro1,2. As for 𝟐, with ̂𝗌𝗎𝖼 applied to the induction hypothesis for the predecessor.
ℕ-elim and its congruence. Induction hypothesis (c) puts ([[𝑚]]𝜌,[[𝑚]]𝜌′) in 𝖤𝗅𝗍(̂ℕ), an inductively generated relation; induct on that derivation. At (̂𝟢,̂𝟢), 𝗋𝖾𝖼𝗏 selects the base branch and ℕ-comp1 matches it syntactically. At (̂𝗌𝗎𝖼(𝑑),̂𝗌𝗎𝖼(𝑒)) over a smaller derivation, 𝗋𝖾𝖼𝗏 returns [[𝑐𝑠]]𝜌⋅𝑑⋅𝗋𝖾𝖼𝗏(…;𝑑); induction hypothesis (c) for 𝑐𝑠 at the Π-type 𝖲𝗍𝖾𝗉ℕ(𝐶) of definition 28.21—which in 𝑇𝗂𝗆𝗉𝗅 carries the pair (𝖾𝗑𝗉,𝗋𝗎𝗇𝗍𝗂𝗆𝖾), as 𝗋𝖾𝖼𝗏 does—applied twice, once at the related predecessors, once at the pair supplied by the subsidiary induction hypothesis—gives the element claim, and ℕ-comp2 together with the Kripke clause at ̂Π gives the syntactic one. At related neutrals, the argument is the neutral case of 𝟐 with ne-ind-nat in place of ne-ind-bool and with the step branch reified at the semantic value of 𝖲𝗍𝖾𝗉ℕ.
Intensional identity.Id-form, Id-form-eq. The ̂𝖨𝖽 generator, from induction hypothesis (a) for 𝐴 and (c) for the two endpoints.
Id-intro. Evaluation gives [[𝗋𝖾𝖿𝗅𝑎]]𝜌=̂𝗋𝖾𝖿𝗅([[𝑎]]𝜌), and the element clause requires the six values contributed by the two equal endpoints and the two witnesses to form one 𝖤𝗅𝗍([[𝐴]]𝜌)-clique. They are just copies of [[𝑎]]𝜌 and [[𝑎]]𝜌′. Induction hypothesis (c) supplies the cross pair; symmetry and transitivity from lemma 111.62 supply all ordered pairs in the clique. On the Kripke side, 𝗋𝖾𝖿𝗅𝑎[𝛾] is the required witness, and the two endpoint equations demanded by definition 111.65 hold because ↓[[𝐴]]𝜌([[𝑎]]𝜌) is judgmentally 𝑎[𝛾] by lemma 111.69(a).
Id-elim, Id-elim-eq, Id-comp. Induction hypothesis (c) for the eliminated proof 𝑞 gives two cases. If both values are ̂𝗋𝖾𝖿𝗅(𝑑), ̂𝗋𝖾𝖿𝗅(𝑒) with (𝑑,𝑒) related, then 𝗃𝗏 returns [[𝑐]](𝜌,𝑑) and [[𝑐]](𝜌′,𝑒), related by induction hypothesis (c) for 𝑐 at the extended pair. Syntactically, the Kripke clause supplies 𝑏 with Δ⊢𝑞[𝛾]≡𝗋𝖾𝖿𝗅𝑏:− and, by its two endpoint equations, Δ⊢𝑎[𝛾]≡𝑏:𝐴[𝛾] and Δ⊢𝑏′[𝛾]≡𝑏:𝐴[𝛾] for the two annotations; so Id-elim-eq replaces 𝑞[𝛾] by 𝗋𝖾𝖿𝗅𝑏 and both annotations by 𝑏, and Id-comp then contracts the result to 𝑐[𝛾,𝑏/𝑧]. Those two endpoint equations are exactly why definition 111.65 stores them: without them Id-comp is not applicable, since its conclusion is stated at annotations equal to the 𝗋𝖾𝖿𝗅 argument. If both values are related neutrals, the two ̂𝖩 nodes are ≈neΨ by lemma 111.63 on the quoted motive, the quoted carrier, the two reified endpoints and the reified branch, and ne-J makes the syntactic eliminator neutral.
Universes and lifts.U-Form.[[Uℓ]]𝜌=̂U𝑖 with 𝑖=⌈ℓ⌉, related to itself. Quotation returns U⌈ℓ⌉, which is schema-equal to Uℓ by the symbolic normalization theorem lemma 111.19; no parameter assignment is chosen.
U-Hier. For 𝑗≺𝑖, ̂U𝑗≈𝑖̂U𝑗 is a generator, so ̂U𝑗∈𝖤𝗅𝗍(̂U𝑖); both quotations return U𝑗. The strictness of the hierarchy is exactly the side condition 𝑗≺𝑖 on that generator: no generator places 𝗎𝗉̂U𝑗(𝑘) in C𝑖 for 𝑖≠𝑗.
U-El, U-El-Eq. Induction hypothesis (c) at U𝑖 gives [[𝐴]]𝜌∈C𝑖 and, by the Kripke clause at ̂U𝑖, the type equation Δ⊢𝐴[𝛾]≡𝖰𝑛([[𝐴]]𝜌)𝗍𝗒𝗉𝖾. Lemma 111.62(4) turns the code relation into a type relation with the same elements, which is claim (a); U-El-Eq is the same step from (d) to (b).
U-Pi, U-Sig, U-Unit, U-Bool, U-Nat, Id-form-U, Vec-form, and their congruences. Each is the corresponding generator of definition 111.58 at the level named in the rule, applied to the induction hypotheses for the components at that same level. On the Kripke side, the clause at ̂U𝑖 has two equations; the first is proved by the code congruence of the rule together with the induction hypotheses at U𝑖, the second by the type congruence together with claim (a). Vec-form is the case where the two equations genuinely differ, because 𝖰𝖼𝑛 retains a lift in the element code that 𝖰𝑛 would delete (remark 111.21).
Lift-U, Lift-Cong.Lemma 111.73 gives ̂𝗅𝗂𝖿𝗍𝑖([[𝐴]]𝜌)∈C𝑖+1 with the same elements, and the Kripke code equation is 𝖰𝖼𝑛(̂𝗅𝗂𝖿𝗍𝑖([[𝐴]]𝜌)), which the five clauses of ̂𝗅𝗂𝖿𝗍 match against the five contraction instances by lemma 111.23(3).
Lift-El. Claim (b) at Γ⊢𝖫𝗂𝖿𝗍ℓ𝐴≡𝐴𝗍𝗒𝗉𝖾 is ̂𝗅𝗂𝖿𝗍𝑖([[𝐴]]𝜌)≈[[𝐴]]𝜌′, which is lemma 111.62(5) followed by transitivity. The peeling generators of definition 111.59 exist for exactly this rule.
Lift-Pi, Lift-Sig, Lift-Id, Lift-Unit, Lift-Bool, Lift-Nat, Lift-Hier. Each is a literal equality of values: ̂𝗅𝗂𝖿𝗍𝑖 is defined by exactly those seven clauses, and lemma 111.72 shows that the right-hand side evaluates to the same value. For example, writing P:=∏𝜖,𝜚𝑥:𝐴𝐵 and P↑:=∏𝜖,𝜚𝑥:𝖫𝗂𝖿𝗍ℓ𝐴𝖫𝗂𝖿𝗍ℓ𝐵, [[P↑]]𝜌=̂Π𝜖,𝜚(̂𝗅𝗂𝖿𝗍𝑖[[𝐴]]𝜌,⟨𝜌;𝑥.𝖫𝗂𝖿𝗍ℓ𝐵⟩)=̂Π𝜖,𝜚(̂𝗅𝗂𝖿𝗍𝑖[[𝐴]]𝜌,𝗅𝗂𝖿𝗍𝖼𝗅𝑖(⟨𝜌;𝑥.𝐵⟩))=̂𝗅𝗂𝖿𝗍𝑖([[P]]𝜌). The middle equality is equality of closure-execution graphs, hence equality in the contextual quotient of definition 49.36. There is no clause for 𝖵𝖾𝖼, and none is needed, because the signature has no equation there.
Vectors.Vec-form. The universe induction hypothesis for the element code gives 𝛾𝑖:C≈𝑖C′; the induction hypothesis for the length gives 𝜈:(𝑑𝑚,𝑑′𝑚)∈𝖤𝗅𝗍(𝗇𝑖). These two witnesses generate ̂𝖵𝖾𝖼(C,𝑑𝑚)≈𝑖̂𝖵𝖾𝖼(C′,𝑑′𝑚). Its semantic embedding is obtained by lemma 111.62(4), with the head membership map of part (6). The syntactic code equation retains the element code through 𝖰𝖼 and quotes the index through element quotation; these are exactly the two premises of Vec-form.
The two constructor rules. At zero length, the vector generator contains (̂𝗏𝗇𝗂𝗅,̂𝗏𝗇𝗂𝗅) and the Kripke clause stores both 𝑚≡𝟢 and 𝗏𝗇𝗂𝗅≡𝗏𝗇𝗂𝗅. At successor length, induction gives 𝜁:(𝑎0,𝑎1)∈𝖤𝗅𝗍(𝛾𝑖),𝜂𝑥𝑠:(𝑥𝑠0,𝑥𝑠1)∈𝖤𝗅𝗍(𝛿𝜈′), where 𝜈′ is predecessor evidence and 𝛿𝜈′ is the shorter vector generator. If the right element-code premise is recorded at level 𝑗, transport 𝜁 by 𝗍𝗋𝑖,𝑗𝛾𝑖,𝛾𝑗 before forming the right constructor. The vector-successor membership constructor then yields (̂𝗏𝖼𝗈𝗇𝗌(𝑑𝑚,𝑎0,𝑥𝑠0),̂𝗏𝖼𝗈𝗇𝗌(𝑑′𝑚,𝑎1,𝑥𝑠1))∈𝖤𝗅𝗍(𝛿𝗌𝗎𝖼(𝜈′)). The syntactic clause stores the reified predecessor, head, and tail equations; Vec-intro𝑠 identifies its result index with 𝗌𝗎𝖼(𝑚).
Vec-elim and its congruence. Induction hypothesis (c) for the index 𝑚 and for the vector 𝑦𝑠 gives related values; induct on the derivation of the length relation, a derivation in the inductively generated relation 𝖤𝗅𝗍(̂ℕ).
If the vector values are related neutrals 𝗎𝗉V(𝑘), 𝗎𝗉V′(𝑘′), the first clause of 𝗏𝗋𝗏 applies on both sides and returns two ̂𝗏𝗂𝗇𝖽 nodes. Their stored fields are related: the motives and the two branches by the induction hypotheses, the stored vector types V,V′ by induction hypothesis (a) for the type of 𝑦𝑠, the index values by induction hypothesis (c) for 𝑚. Hence, after every typed future weakening, their readbacks agree at the exact target-support depth by lemma 111.63(1)–(3), which gives the required self-related and cross-related neutral evidence, not merely equality at the ambient depth. Syntactically, ne-vind makes the eliminator neutral: its element-code premise is lemma 111.70, its motive and branch premises are lemma 111.69(a) and lemma 111.70, its index premise is lemma 111.69(a) at ̂ℕ, and its principal premise is the Kripke clause for 𝑦𝑠.
Otherwise the vector values are constructors, and the length derivation decides which. At (̂𝟢,̂𝟢) they are ̂𝗏𝗇𝗂𝗅, the second clause returns the base branch, and the Vec-elim congruence followed by Vec-comp1 performs the same replacement syntactically, using the Kripke equations Δ⊢𝑚[𝛾]≡𝟢:ℕ and Δ⊢𝑦𝑠[𝛾]≡𝗏𝗇𝗂𝗅:−. At (̂𝗌𝗎𝖼(𝑑),̂𝗌𝗎𝖼(𝑒)) they are ̂𝗏𝖼𝗈𝗇𝗌 nodes, the third clause applies the four-argument map 𝐺 to the predecessor pair (𝑑,𝑒), the transported head pair 𝗍𝗋𝑖,𝑗𝛾𝑖,𝛾𝑗(𝜁), the tail pair 𝜂𝑥𝑠, and the recursive pair supplied by the subsidiary induction hypothesis at 𝛿𝜈′. Applying the semantic induction hypothesis for the successor method in that order selects the dependent result fiber 𝐹(̂𝗌𝗎𝖼(𝑑),̂𝗏𝖼𝗈𝗇𝗌(𝑑,𝑎,𝑥𝑠)) on the left and its related fiber on the right. Syntactically, Vec-comp2 performs exactly those four substitutions [𝑚/𝑛,𝑐/𝑎,𝑦𝑠/𝑥𝑠,𝑟/𝑞], its recursive occurrence 𝑟 matching the recursive semantic call. The remaining combination—a neutral index with a constructor vector—cannot occur, because the element relation of definition 111.58 at a vector type of related neutral length contains only related neutrals; that is why 𝗏𝗋𝗏 needs no clause for it and why definition 49.14 has no neutral rule for it.
Vec-comp1,2. The two computations displayed above are literal equalities of values.
Every rule of 𝑇𝗂𝗆𝗉𝗅 named in convention 111.16 has now been treated. No case was deferred, and the three cases that are not literal equalities of values—Π-𝜂, Σ-𝜂, 𝟏-𝜂—are precisely the three for which the element relations were made extensional. ◻
For every derivable context Γ𝖼𝗍𝗑, the identity environment 𝜌Γ of definition 49.37 satisfies 𝜌Γ≈ΨΓ𝜌Γ:Γ, and Γ⊩(𝜄,𝜌Γ):Γ where 𝜄 is the substitution fixing every variable.
Proof of Lemma 111.75 — The identity environment is valid
Proof. Induction on the length of Γ. The empty case is the empty pair. Suppose the claim for Γ and let Γ⊢𝐴𝗍𝗒𝗉𝖾, so that Γ,𝑥:𝐴 is derivable. By lemma 111.74(a) at the induction hypothesis, A:=[[𝐴]]𝜌Γ is a semantic type and Γ⊢𝐴≡𝖰𝑛(A)𝗍𝗒𝗉𝖾 with 𝑛=|Γ|. Let 𝜔:Γ↪Γ,𝑥:𝐴. World equivariance moves the equation to Γ,𝑥:𝐴, where ne-var gives Γ,𝑥:𝐴⊢𝑥𝗇𝖾𝐴 and hence, after conversion, Γ,𝑥:𝐴⊢𝑥𝗇𝖾𝖰𝑛+1(𝜔∗A). The fresh level is the final declaration of ΨΓ,𝑥:𝐴. Hence 𝗑𝑛≈neΨΓ,𝑥:𝐴𝗑𝑛 by lemma 111.55, and lemma 111.69(b) gives Γ,𝑥:𝐴⊩𝑥∼↑𝜔∗A(𝗑𝑛):𝜔∗A. Moreover, lemma 111.63(4) gives (↑𝜔∗A(𝗑𝑛),↑𝜔∗A(𝗑𝑛))∈𝖤𝗅𝗍ΨΓ,𝑥:𝐴(𝜔∗A). This pair is both the element component of 𝜌Γ,𝑥:𝐴 and the standing requirement of definition 111.65. The earlier components are inherited from the induction hypothesis by lemma 111.69(c) at 𝜔, using reflexivity for the target conversion. ◻
Normalization, canonicity, and the kernel’s conversion interface
The three targets of section 111.4 are now assembled from the fundamental lemma, in the order Target N, Target C, Target D, each followed immediately by its proof.
𝑇𝗂𝗆𝗉𝗅 satisfies the package (∗) of convention 111.28. More precisely, for every derivable context Γ𝖼𝗍𝗑, every Γ⊢𝐴𝗍𝗒𝗉𝖾, and every Γ⊢𝑎:𝐴, the indexed normalizers of definition 49.37 are idempotent: nf𝐴Γ(nf𝐴Γ(𝑎))=nf𝐴Γ(𝑎),nfΓ(nfΓ(𝐴))=nfΓ(𝐴).
Proof of Theorem 111.76 — Normalization for T_ impl
Proof. Let Γ⊢𝑎:𝐴 with 𝑛=|Γ|. By lemma 111.75 the pair (𝜄,𝜌Γ) is valid, where 𝜄 fixes every variable, so the syntactic half of lemma 111.74(c) gives Γ⊩𝑎∼[[𝑎]]𝜌Γ:A,A:=[[𝐴]]𝜌Γ, using 𝑎[𝜄]=𝑎. Lemma 111.69(a) makes nf𝐴Γ(𝑎)=↓𝑛A([[𝑎]]𝜌Γ) a normal form of type 𝖰𝑛(A) with Γ⊢𝑎≡nf𝐴Γ(𝑎):𝖰𝑛(A), and lemma 111.74(a) gives Γ⊢𝐴≡𝖰𝑛(A)𝗍𝗒𝗉𝖾, so Conv moves the equation to 𝐴 and lemma 111.70 makes nfΓ(𝐴)=𝖰𝑛(A) a normal type. That is clause (1) and clause (2) of (∗).
For clause (3), let Γ⊢𝑎≡𝑏:𝐴. The semantic half of lemma 111.74(d) at the related environments 𝜌Γ≈𝜌Γ gives ([[𝑎]]𝜌Γ,[[𝑏]]𝜌Γ)∈𝖤𝗅𝗍(A), and lemma 111.63(3) turns that into nf𝐴Γ(𝑎)=nf𝐴Γ(𝑏) as raw expressions. Conversely, if the two normal forms are 𝛼-equal, then clause (2) and transitivity give Γ⊢𝑎≡𝑏:𝐴. For types, run the same three sentences with clause (d) replaced by lemma 111.74(b), 𝖤𝗅𝗍(A) by ≈, and lemma 111.63(3) by lemma 111.63(1). Computability of nf is remark 49.35, whose one open point—totality on well-typed input—has just been proved: along a valid pair every semantic operation invoked has a unique output, and every readback invoked is defined by lemma 111.63.
Idempotence follows from (2) and (3): Γ⊢𝑎≡nf𝐴Γ(𝑎):𝐴, so applying (3) to that equation gives nf𝐴Γ(nf𝐴Γ(𝑎))=nf𝐴Γ(𝑎), and likewise for types. ◻
Idempotence says only that renormalizing changes nothing. The sharper statement is that the normal forms are exactly the fixed points.
Proof. Simultaneous induction on the four derivations of definition 49.14. Each is well typed by lemma 111.26(2), so lemma 111.74 applies to it and every semantic type mentioned is a semantic type. Two facts are used throughout: 𝜌Δ,𝑥:𝐴=(𝜌Δ,𝗏[[𝐴]]𝑛) by definition 49.37, and [[𝐴𝑗]]𝜌<𝑗=[[𝐴𝑗]]𝜌Δ by lemma 111.72(1).
(d), ne-var: [[𝑥𝑗]]=𝜌Δ(𝑗)=↑[[𝐴𝑗]](𝗑𝑗) and 𝖱𝑛(𝗑𝑗)=𝑥𝑗.
(d), ne-app: by the induction hypothesis [[𝑢]]=↑̂Π𝜖,𝜚(A0,𝐹)(𝑘′), which definition 49.37 unfolds to 𝖾𝗍𝖺𝜖,𝜚(𝑘′;A0;𝐹). Applying it to [[𝑣]] gives ↑𝐹([[𝑣]])(𝖺𝗉𝗉(𝑘′;A0;[[𝑣]])), and 𝐹([[𝑣]])=[[𝐵[𝑣/𝑥]]] by lemma 111.72(2). Its readback is 𝖱𝑛(𝑘′)𝜖,𝜚↓𝑛A0([[𝑣]]), which the induction hypotheses (d) and (c) turn into 𝑢𝜖,𝜚𝑣.
(d), ne-fst, ne-snd: reflection at ̂Σ is a 𝗉𝖺𝗂𝗋 of two reflections, so the semantic projections return them, and 𝖱𝑛 prefixes 𝗉𝗋1 or 𝗉𝗋2.
(d), ne-ind-bool, ne-ind-nat, ne-J, ne-vind: the induction hypothesis makes the principal argument 𝗎𝗉B(𝑘′), so the corresponding clause of definition 111.44 builds a stuck node whose readback rebuilds the syntactic eliminator. Its motive is quoted at the extended level and equals the stored motive by induction hypothesis (a); its minor arguments are reified at the semantic types of their declared classifiers—for 𝟐 these are 𝐹(̂𝗍𝗍) and 𝐹(̂𝖿𝖿), equal to [[𝐶[𝗍𝗍/𝑥]]] and [[𝐶[𝖿𝖿/𝑥]]] by lemma 111.72(2)—and equal the stored arguments by induction hypothesis (c). For ne-vind the element code is recovered from the semantic vector type stored in 𝗎𝗉B(𝑘′), which is [[𝖵𝖾𝖼(𝑐,𝑤)]]=̂𝖵𝖾𝖼([[𝑐]],[[𝑤]]), and induction hypothesis (b) returns 𝑐.
(c), nf-lam: [[𝜆𝜖,𝜚(𝑥:𝐴).𝑣]]=𝗅𝖺𝗆𝜖,𝜚(⟨𝜌Δ;𝑥.𝑣⟩), and reification emits 𝜆𝜖,𝜚(𝑥𝑛:𝖰𝑛([[𝐴]])).↓𝑛+1𝐹(𝗏)([[𝑣]](𝜌Δ,𝗏)) with 𝗏=𝗏[[𝐴]]𝑛. The domain is 𝐴 by induction hypothesis (a)—which is available exactly because nf-lam carries the premise Δ⊢𝐴𝗇𝖿𝗍𝗒𝗉𝖾—and the body is 𝑣 by induction hypothesis (c) in Δ,𝑥:𝐴, whose identity environment is (𝜌Δ,𝗏).
(c), nf-pair: the semantic projections of a 𝗉𝖺𝗂𝗋 are its components, and the two induction hypotheses return 𝑣 and 𝑤.
(c), nf-star, nf-true, nf-false, nf-zero, nf-suc, nf-refl, nf-vnil, nf-vcons: reification emits the same constructor and reifies each stored field at the semantic type of its declared classifier, so the induction hypotheses return the stored fields.
(c), nf-ne: by (d), [[𝑢]]=↑[[𝐴]](𝑘), and at a positive head reflection is 𝗎𝗉[[𝐴]](𝑘), whose reification is 𝖱𝑛(𝑘)=𝑢.
(a) and (b): each rule of the two normal families is matched by the clause of definition 49.37 for the corresponding value head. For nf-ty-vec the code is requoted by 𝖰𝖼𝑛 and the length reified at ̂ℕ, returning 𝑐 and 𝑣 by (b) and (c); for nf-ty-ne the value is 𝗎𝗉̂Uℓ(𝑘) by (d) and 𝖰𝑛 returns 𝖱𝑛(𝑘)=𝑢. For nf-cd-lift, induction hypothesis (b) shows that [[𝑐]] has one of the three stuck heads—a neutral code, a ̂𝖵𝖾𝖼, or a ̂𝖫𝗂𝖿𝗍—so ̂𝗅𝗂𝖿𝗍ℓ wraps rather than computes, and 𝖰𝖼𝑛 emits 𝖫𝗂𝖿𝗍ℓ(𝑐).
The final claim combines (a) and (c) with the definition of nf; uniqueness of the normal form in an equality class then follows from theorem 111.76(3). ◻
It is worth separating the three properties, because they are proved by three different mechanisms and only the first two are usually named. Soundness, Γ⊢𝑎≡nf(𝑎):𝐴, comes from the Kripke relation between syntax and values and its escape lemma (lemma 111.69(a)); nothing about partial equivalence relations enters it. Completeness, 𝑎≡𝑏⇒nf(𝑎)=nf(𝑏), comes from the partial equivalence relations on values and the reification lemma (lemma 111.63); nothing about syntax enters it, and it is the direction that fails for a naive value domain in which 𝜂 is not built into reification. Stability, nf(𝑣)=𝑣, comes from neither: it is the induction of lemma 111.77 over the normal and neutral rules. A development that proves only the first two has a normalizer; a development that proves all three has canonical representatives.
Proof of Theorem 49.18 — Canonicity and canonical forms
Proof. Item (5) is Π-𝜂, Σ-𝜂, and 𝟏-𝜂 read as they stand; it is recorded beside the others because it is the exact sense in which a negative former has canonical forms, and because it is the only one of the five that does not need the empty context.
For the other four, work in the empty context, where 𝜌⋅ is the empty environment and, by lemma 111.26(3), no expression is neutral. Consequently no clause of definition 111.65 that requires ⋅⊢𝖱0(𝑘)𝗇𝖾− can hold: its premise is a neutral judgment in the empty context.
(1) Let ⋅⊢𝑏:𝟐. The syntactic half of lemma 111.74(c), at the valid pair of lemma 111.75 for the empty context, gives ⋅⊩𝑏∼[[𝑏]]𝜌⋅:̂𝟐, and the neutral case is excluded, so ⋅⊢𝑏≡𝗍𝗍:𝟐 or ⋅⊢𝑏≡𝖿𝖿:𝟐. They are not both derivable: otherwise 𝗍𝗍≡𝖿𝖿, and theorem 111.76(3) would give nf(𝗍𝗍)=nf(𝖿𝖿), that is 𝗍𝗍=𝖿𝖿 as raw expressions. (Proposition 49.3 proves the same separation by a two-point model and without the present construction.)
(2) Run the argument of (1) with ̂𝟐 replaced by ̂ℕ and its two constructor cases by the two generators ̂𝟢 and ̂𝗌𝗎𝖼, adding an induction on the derivation that [[𝑛]]𝜌⋅ is related to itself: the neutral case is excluded, so the value is ̂𝗌𝗎𝖼𝑚(̂𝟢) for some 𝑚∈ℕ, and the Kripke clauses compose 𝑚 successor equations into ⋅⊢𝑛≡𝗌𝗎𝖼𝑚(𝟢):ℕ. Uniqueness of 𝑚 again follows from clause (3) of (∗), since distinct numerals are distinct raw expressions.
(3) Let ⋅⊢𝑝:𝖨𝖽𝐴(𝑎,𝑏). The neutral case at ̂𝖨𝖽 is excluded, so [[𝑝]]𝜌⋅=̂𝗋𝖾𝖿𝗅(𝑑) and there is 𝑐 with ⋅⊢𝑝≡𝗋𝖾𝖿𝗅𝑐:𝖨𝖽𝐴(𝑎,𝑏) together with the two stored endpoint equations of definition 111.65, which after lemma 111.74(a) and Conv read ⋅⊢𝑎≡𝑐:𝐴 and ⋅⊢𝑏≡𝑐:𝐴. Symmetry and transitivity give ⋅⊢𝑎≡𝑏:𝐴, and the Id-intro congruence along ⋅⊢𝑐≡𝑎:𝐴 then identifies 𝗋𝖾𝖿𝗅𝑐 with 𝗋𝖾𝖿𝗅𝑎 at 𝖨𝖽𝐴(𝑎,𝑏).
(4) Let ⋅⊢𝑥𝑠:𝖵𝖾𝖼(𝑐,𝑛) with ⋅⊢𝑛≡𝗌𝗎𝖼𝑚(𝟢):ℕ. By (2) the length value is ̂𝗌𝗎𝖼𝑚(̂𝟢); induct on 𝑚. At 𝑚=0 the neutral case is excluded and the clause gives ⋅⊢𝑥𝑠≡𝗏𝗇𝗂𝗅:−. At 𝑚+1 it gives ⋅⊢𝑥𝑠≡𝗏𝖼𝗈𝗇𝗌(𝗌𝗎𝖼𝑚(𝟢),𝑏1,𝑏2):− with 𝑏2 a closed vector of length 𝗌𝗎𝖼𝑚(𝟢), to which the induction hypothesis applies. ◻
Given derivations of the inputs as in remark 48.7, the judgments Γ⊢𝐴≡𝐵𝗍𝗒𝗉𝖾 and Γ⊢𝑎≡𝑏:𝐴 are decidable in 𝑇𝗂𝗆𝗉𝗅; equivalently, 𝑇𝗂𝗆𝗉𝗅 has an effective conversion invariant in the sense of definition 48.8.
Proof. Given derivations of Γ⊢𝑎:𝐴 and Γ⊢𝑏:𝐴, compute nf𝐴Γ(𝑎) and nf𝐴Γ(𝑏) and compare them for 𝛼-equality. Both computations terminate by theorem 111.76; the outputs are finite binding trees whose only non-syntactic data are external level expressions, and 𝛼-equality of such trees is decidable by convention 26.8 together with lemma 111.19(2) for the level indices. Soundness and completeness of the test are clauses (2) and (3) of (∗). Types are decided in the same way. Proposition 48.9 converts the decision procedure into an effective conversion invariant, and conversely the encoded normal form is one directly. ◻
The kernel of chapter 48 asked for six operations, not two, and asked for them at the full signature. All six are now definable.
At 𝑇𝗂𝗆𝗉𝗅 the six operations hypothesized in definition 48.16 exist and are total computable: Γ⊢𝐴⇔𝐵𝗍𝗒𝗉𝖾,Γ⊢𝑎⇔𝑏:𝐴,unPiMeta(Γ,𝐶),unSg(Γ,𝐶),unId(Γ,𝐶),unUniv(Γ,𝐶). The two conversion queries are sound and complete for judgmental equality. Each inversion operation returns the constructor arguments together with a judgmental equality to 𝐶, coherently with every other presentation of 𝐶 in the sense of definition 48.10, or correctly reports that no such presentation exists.
Proof of Theorem 111.81 — The Timpl conversion interface
Proof. The two conversion queries are the decision procedure of corollary 49.20.
For unPiMeta(Γ,𝐶), compute 𝑉:=nfΓ(𝐶). If 𝑉=∏𝜖,𝜚𝑥:𝐴0𝐵0, return (𝜖,𝜚,𝐴0,𝑥.𝐵0) together with Γ⊢𝐶≡∏𝜖,𝜚𝑥:𝐴0𝐵0𝗍𝗒𝗉𝖾, which is clause (2) of (∗). Otherwise report failure. Failure is correct: if Γ⊢𝐶≡∏𝜖,𝜚𝑥:𝐴′𝐵′𝗍𝗒𝗉𝖾 held, clause (3) would give 𝑉=nfΓ(∏𝜖,𝜚𝑥:𝐴′𝐵′), and that normal type has a Π head, because [[∏𝜖,𝜚𝑥:𝐴′𝐵′]]𝜌Γ=̂Π𝜖,𝜚(−,−) and 𝖰𝑛 of a ̂Π value is a Π-type carrying the same two bits.
Coherence is Π-injectivity, which the same two clauses supply. Suppose Γ⊢𝐶≡∏𝜖,𝜚𝑥:𝐴𝐵𝗍𝗒𝗉𝖾 and Γ⊢𝐶≡∏𝜖′,𝜚′𝑥:𝐴′𝐵′𝗍𝗒𝗉𝖾. Clause (3) makes the two normal types the same raw expression; in particular (𝜖,𝜚)=(𝜖′,𝜚′), and the two displayed domains have the same normal form, so clause (2) and transitivity give Γ⊢𝐴≡𝐴′𝗍𝗒𝗉𝖾. Context conversion along that equality puts 𝐵′ in Γ,𝑥:𝐴, where the two codomains again have the same normal form, whence Γ,𝑥:𝐴⊢𝐵≡𝐵′↓𝐴𝗍𝗒𝗉𝖾. This is exactly definition 48.10.
unSg and unId repeat the argument with the heads ̂Σ and ̂𝖨𝖽, whose quotations are Σ-types and identity types; for unId the two endpoints returned are the reified ones, and coherence follows because clause (3) identifies them as raw expressions. For unUniv(Γ,𝐶), compute 𝑉; if 𝑉=U𝑖 return 𝑖, else fail. Correctness of the returned level uses lemma 111.19(2): two level expressions name the same universe exactly when their normal forms agree, so the returned 𝑖 is unique. Failure is correct by the same head argument, and unUniv is an executable operation rather than an unbounded search for 𝑖. ◻
Every theorem of chapter 48 whose statement is conditional on totality of the six operations of definition 48.16 holds unconditionally at 𝑇𝗂𝗆𝗉𝗅; in particular the determinism, soundness, and completeness statements proposition 48.17, theorem 48.19, theorem 48.20, and the termination conclusion of proposition 110.17, hold with actual algorithms in place of every assumed oracle. Consequently bidirectional type-checking for 𝑇𝗂𝗆𝗉𝗅 is decidable, and demands (D1), (D2), and (D4) of remark 48.14 are met at that signature.
Proof of Corollary 111.82 — The kernel is unconditional
Proof.Theorem 111.81 constructs the six operations with exactly the modes, presuppositions, soundness, completeness, and universal-coherence properties assumed in definition 48.16. Discharging a hypothesis of a conditional theorem yields its conclusion. (D1) is corollary 49.20 through proposition 48.9; (D2) is the inversion half of theorem 111.81; (D4) is theorem 49.18. ◻
Π-head injectivity for 𝑇𝗂𝗆𝗉𝗅 is proved inside theorem 111.81 and is not assumed anywhere. Two boundaries remain visible in that proof. First, injectivity is a consequence of completeness of nf, not of any confluence or subject-reduction property: lemma 111.23 is never used for it. Second, the inversion operations invert normal-form heads, and for 𝖵𝖾𝖼 that head stores a code rather than a type. An operation unVec—which chapter 48 does not require—would therefore distinguish 𝖵𝖾𝖼(𝐴,𝑛) from 𝖵𝖾𝖼(𝖫𝗂𝖿𝗍ℓ𝐴,𝑛), and correctly so: by remark 111.21 those two are not judgmentally equal types. It is the deleted lift of 𝖫𝗂𝖿𝗍ℓ(𝖵𝖾𝖼(𝐴,𝑛)), not the one inside a 𝖵𝖾𝖼, that a type-level inversion may discard.
Let Γ:=(𝑋:U0,𝑛:ℕ), so |Γ|=2 and [[𝑋]]𝜌Γ=X:=𝗎𝗉̂U0(𝗑0), [[𝑛]]𝜌Γ=𝜈:=𝗎𝗉̂ℕ(𝗑1). Evaluating and quoting the two expressions of remark 111.21 as types gives nfΓ(𝖫𝗂𝖿𝗍0(𝖵𝖾𝖼(𝑋,𝑛)))=𝖰2(̂𝖫𝗂𝖿𝗍0(̂𝖵𝖾𝖼(X,𝜈)))=𝖵𝖾𝖼(𝑋,𝑛),nfΓ(𝖵𝖾𝖼(𝖫𝗂𝖿𝗍0𝑋,𝑛))=𝖰2(̂𝖵𝖾𝖼(̂𝖫𝗂𝖿𝗍0(X),𝜈))=𝖵𝖾𝖼(𝖫𝗂𝖿𝗍0𝑋,𝑛), because 𝖰2 deletes an outer lift and 𝖰𝖼2, which the vector clause uses on the element, keeps one. Quoting the same two expressions as codes at U1 gives 𝖫𝗂𝖿𝗍0(𝖵𝖾𝖼(𝑋,𝑛)) and 𝖵𝖾𝖼(𝖫𝗂𝖿𝗍0𝑋,𝑛). So the kernel accepts Γ⊢𝖫𝗂𝖿𝗍0(𝖵𝖾𝖼(𝑋,𝑛))≡𝖵𝖾𝖼(𝑋,𝑛)𝗍𝗒𝗉𝖾 and rejects both Γ⊢𝖵𝖾𝖼(𝖫𝗂𝖿𝗍0𝑋,𝑛)≡𝖵𝖾𝖼(𝑋,𝑛)𝗍𝗒𝗉𝖾 and Γ⊢𝖫𝗂𝖿𝗍0(𝖵𝖾𝖼(𝑋,𝑛))≡𝖵𝖾𝖼(𝖫𝗂𝖿𝗍0𝑋,𝑛):U1. All three answers are correct for the signature as definition 29.10 leaves it.
The theorem package (∗) is proved for 𝑇𝗂𝗆𝗉𝗅 and for nothing larger. Four boundaries are worth naming exactly, because later chapters inherit them.
Inside. All eight former families of convention 111.16 are covered by one simultaneous construction: Π with its two metadata bits, Σ, 𝟏, 𝟐, ℕ, intensional identity with 𝖩, the strict Russell universes with their lifts, and the vector family with 𝗏𝗂𝗇𝖽. They had to be treated simultaneously: the element relation of each former is defined in terms of the element relations of the others, and the recursion is founded on the paired-level multiset and Hessenberg rank sum of lemma 111.62, not on any one former. Discharging them one at a time would not have been possible.
Outside: 𝖶 and coinduction.𝑇𝗂𝗆𝗉𝗅 contains no 𝖶-type and no coinductive former. Adding 𝖶 would require an additional ordinal component in the induction measure—a rank on semantic subtrees—and a new element clause inductive in those subtrees; adding a coinductive former would require the dual and a productivity condition. Neither is carried out here, so no statement of this chapter applies to 𝑇𝗂𝗆𝗉𝗅-co.
Outside: extensional type theory, and conservativity. The construction uses Id-comp at 𝗋𝖾𝖿𝗅 and nothing stronger; adding equality reflection destroys the theorem at its root, by theorem 35.49, corollary 48.48. In the other direction, (∗) is what convention 110.16 named as the missing ingredient for conservativity of 𝑇𝗂𝗆𝗉𝗅 over the proof fragment 𝑇el, but it is not by itself that conservativity: one would still have to show that the normal form of a 𝑇el judgment mentions no 𝟐, no vector, and no metadata bit, a subformula argument that this chapter does not carry out.
Normalize-and-compare is the executable specification supplied by corollary 49.20, not the usual production strategy. Kernels weak-head normalize both sides in the sense of definition 111.22, compare the exposed heads, recurse only into the necessary components, and unfold stored definitions lazily. Theorem 111.76(3) proves that any such sound and complete head-directed comparison decides the same relation, and lemma 111.23(3)–(4) is what makes a head-directed strategy sound and deterministic in the first place. Avoiding the construction of full normal forms is essential for large terms with expensive computations.
By theorem 35.49, corollary 48.48, judgmental equality in extensional type theory is undecidable and ETT admits no effective conversion invariant. The latter corollary already discharges the recursive-signature hypotheses of proposition 48.9. The culprit is equality reflection (definition 35.1): a derivation of a judgmental equality may bury an arbitrary proof of an identity, so equality of terms inherits the full strength of provability (theorem 35.9, [Hof95]). This is the precise cost of ETT recorded in chapter 35, and it is the exact complement of corollary 49.20: the two signatures differ by one rule.
Work in the empty context and put 𝑓:=𝜆𝜖,𝜚(𝑥:𝟐).𝑥 and 𝑔:=𝜆𝜖,𝜚(𝑥:𝟐).𝗂𝗇𝖽𝟐(𝑦.𝟐;𝖿𝖿,𝗍𝗍,𝗂𝗇𝖽𝟐(𝑦.𝟐;𝖿𝖿,𝗍𝗍,𝑥)). Evaluating and reifying at 𝟐⟶𝟐 introduces one reflected variable, 𝗏:=𝗎𝗉̂𝟐(𝗑0). For 𝑓 the semantic function returns 𝗏, so nf𝟐⟶𝟐⋅(𝑓)=𝜆𝜖,𝜚(𝑥0:𝟐).𝑥0. For 𝑔 the inner 𝗂𝖿𝗏 is stuck on 𝗏 and returns 𝗎𝗉̂𝟐(𝑘1) with 𝑘1=̂𝗂𝗇𝖽𝟐(⟨⋅;𝑦.𝟐⟩;̂𝖿𝖿;̂𝗍𝗍;𝗑0); the outer one is stuck on that and returns 𝗎𝗉̂𝟐(𝑘2) with 𝑘2=̂𝗂𝗇𝖽𝟐(⟨⋅;𝑦.𝟐⟩;̂𝖿𝖿;̂𝗍𝗍;𝑘1). Hence nf𝟐⟶𝟐⋅(𝑔)=𝜆𝜖,𝜚(𝑥0:𝟐).𝗂𝗇𝖽𝟐(𝑥1.𝟐;𝖿𝖿,𝗍𝗍,𝗂𝗇𝖽𝟐(𝑥1.𝟐;𝖿𝖿,𝗍𝗍,𝑥0)), a different raw expression. By theorem 111.76(3), ⋅⊢𝑓≡𝑔:𝟐⟶𝟐 is therefore not derivable, although 𝑓𝗍𝗍≡𝑔𝗍𝗍 and 𝑓𝖿𝖿≡𝑔𝖿𝖿 by theorem 49.18(1) and two Boolean computations. The clause that separates them is the reflected variable of definition 49.37: it is the one argument at which the two functions cannot be compared by computation.
Example 111.88 exhibits two pointwise-equal Boolean functions that are not judgmentally equal, which is what makes a function extensionality axiom meaningful. It is not a proof that the axiom is independent. The expected independence statement says that there is no closed term of type ∏𝐴:U0∏𝐵:𝐴→U0𝖥𝗎𝗇𝖾𝗑𝗍𝐴,𝐵 in the intensional theory of chapter 26–chapter 30. That theory is not𝑇𝗂𝗆𝗉𝗅: it contains 𝟎, binary sums, and 𝖶-types, each of which would need its own generator in definition 111.58 and its own case in lemma 111.74. So theorem 111.76 does not apply to it, and neither does theorem 49.17, whose signature is 𝑇Coq. Streicher’s modified-realizability separation and Hofmann’s account establish closely related formulations [Str93][Hof95], but an exact signature translation to the book’s strict Russell hierarchy remains open.
A normalization theorem at a neighbouring signature
A cumulative Russell hierarchy also admits a normalization-model argument. The signature must remain explicit because its universe equations participate in the construction.
Write 𝑇Coq for the signature of [Coq19]: the structural operations of a category with families [Coq19], dependent products with 𝜂[Coq19], a cumulative universe hierarchy 𝑈𝑛 satisfying the Russell identification 𝖳𝗒𝗉𝖾𝑛(Γ)=𝖤𝗅𝖾𝗆(Γ,𝑈𝑛)[Coq19], and booleans 𝑁2 with the curried dependent recursor 𝖻𝗋𝖾𝖼(𝐶,𝑐0,𝑐1) in 𝖤𝗅𝖾𝗆(Γ,Π𝑁2𝐶)[Coq19].
𝑇Coq is not any calculus of this book, and four differences are load-bearing rather than cosmetic. Its universes are cumulative, whereas the hierarchy of definition 29.1 is strict and reaches higher levels only through the explicit lifts of definition 29.10; its Boolean recursor is ternary and returns a function, whereas 𝗂𝗇𝖽𝟐(𝑥.𝐶;𝑐𝑡,𝑐𝑓,𝑏) is quaternary and consumes its scrutinee; the displayed Russell identification makes a type be an element of 𝑈𝑛, whereas this book keeps Γ⊢𝐴𝗍𝗒𝗉𝖾 and Γ⊢𝑎:U𝑖 separate judgments related by U-El; and 𝑇Coq has no Σ, no 𝟏, no ℕ, no identity type and no indexed family. Its §7 records that the argument is expected to extend to dependent sums with surjective pairing and to 𝖶[Coq19]; that is an author’s remark about a future construction, not a theorem, and nothing here treats it as one.
It is tempting to read the Π and 𝑁2 clauses of the source as a self-contained sublist and to obtain a universe-free normalization theorem by striking the universe clauses. The construction does not have that shape.
In the reducibility model the type sort of the constructed model is its element sort at the universe: 𝖤𝗅𝖾𝗆∗((Γ,Γ′),𝑈∗𝑛)=𝖳𝗒𝗉𝖾∗𝑛(Γ,Γ′)[Coq19]. In the normalization model a type at level 𝑛 is a pair consisting of a type 𝐴 together with a component in 𝑈′𝑛(𝐴), and an element of 𝑈′𝑛(𝑇) is a quadruple one of whose components is a normal form of 𝑇 at 𝑈𝑛[Coq19]. So 𝑈′𝑛 is not one clause beside the others: it is the fibre in which every type datum lives, and the level 𝑛 indexing it is the stratification on which the whole assignment recurses.
Deleting the universe operations therefore removes two different things at once—the carrier of every type datum, and the measure that makes the definition well founded. Replacing the universe-code component by a normal-type judgment does not repair this: it changes what the fibre is, so the closure and stability verifications must be redone for the new fibre, and the recursion must be re-founded on a new measure. That is a different construction with its own fundamental lemma. The construction of section 49.5–section 111.9 is such a different construction, carried out from scratch for convention 111.16; it is not the neighbouring construction with its universe clause deleted.
Let ICoq be the initial model of 𝑇Coq. For every context Γ of ICoq, type 𝐴 over Γ, and elements 𝑎,𝑏:𝐴, it is decidable whether 𝑎=𝑏. The decision procedure normalizes 𝑎 and 𝑏 to typed normal forms and compares those forms syntactically.
The conclusion is confined to 𝑇Coq. It proves nothing about 𝑇Π𝟐, nothing about the checker fragment 𝑇el of definition 48.16, and nothing about 𝑇𝗂𝗆𝗉𝗅; in particular it supplies no normalization structure in the sense of definition 49.16 for any of the three, and the Π/𝟐 part of 𝑇Coq may not be split off to obtain one (remark 111.91). Nothing in section 49.5–section 111.10 cites it.
Proof. We construct a normalization model over ICoq and then use initiality to obtain the normalization function. The construction has four stages.
Stage 1: typed normal syntax. Let C be the category whose objects are telescopes and whose morphisms are renamings represented by lists of variables. For a telescope Δ and a type 𝑇 over Δ, write 𝖭𝗈𝗋𝗆Δ(𝑇)and𝖭𝖾𝗎𝗍Δ(𝑇) for the sets of typed normal and neutral expressions, and write 𝖾𝗏𝑇 for their evaluation into ICoq. Renaming acts on both sets by recursion on normal and neutral syntax. The variable, application, Boolean-recursion, lambda, and normal-product constructors commute with this action, so these sets and evaluation maps form presheaves on C. In particular, normal products are freely generated: 𝗉𝗂(𝑇0,𝐹0)=𝗉𝗂(𝑇1,𝐹1)⟹𝑇0=𝑇1and𝐹0=𝐹1. The second equality is equality of the renamed bodies in the extended telescope. This injectivity is the syntactic fact used by the final comparison procedure.
Stage 2: the universe fibre. For an element 𝑇:𝑈𝑛 in the presheaf model, define 𝑈′𝑛(𝑇) to consist of quadruples 𝑞𝑇=(𝑇′,𝑇0,𝛼𝑇,𝛽𝑇) with the following data, natural in renamings: 𝑇′(𝑢)asetofrealizersforevery𝑢:𝑇,𝑇0∈𝖭𝗈𝗋𝗆(𝑈𝑛)with𝖾𝗏𝑈𝑛(𝑇0)=𝑇,𝛼𝑇(𝑢,𝜈)∈𝖭𝗈𝗋𝗆(𝑇)with𝖾𝗏𝑇(𝛼𝑇(𝑢,𝜈))=𝑢,𝛽𝑇(𝑘)∈𝑇′(𝖾𝗏𝑇(𝑘))forevery𝑘∈𝖭𝖾𝗎𝗍(𝑇). Thus 𝛼𝑇 reifies a realized element and 𝛽𝑇 reflects a neutral element. The normal universe code is part of the datum rather than a consequence of it; this is the reason for remark 111.91.
Form the displayed normalization model whose contexts are pairs (Γ,Γ′), where Γ′ is a renaming-stable family over the environments of Γ. A type is a pair (𝐴,𝐴′) with 𝐴′(𝜌,𝜌′)∈𝑈′𝑛(𝐴𝜌), and an element is a pair (𝑎,𝑎′) with 𝑎′(𝜌,𝜌′)∈(𝐴′(𝜌,𝜌′))′(𝑎𝜌). Context extension and substitution use dependent sum and reindexing of these families. The projection that forgets all primed components therefore preserves the category-with-families operations.
Stage 3: closure under the signature. The universe 𝑈𝑛 is realized by 𝑈∗𝑛=(𝑈′𝑛,𝖴𝑛,𝛼𝑈𝑛,𝛽𝑈𝑛). Here 𝛼𝑈𝑛(𝑇,𝑞𝑇) returns the component 𝑇0 of equation 111.14 below, and reflection of a neutral 𝐾:𝑈𝑛 produces 𝛽𝑈𝑛(𝐾)=(𝐾′,𝐾,𝛼𝐾,𝛽𝐾), where 𝐾′(𝑢) is the set of neutral normal witnesses over 𝑢, 𝛼𝐾 includes such a witness into normal syntax, and 𝛽𝐾 regards a neutral as such a witness. In the notation of equation 111.14, the relevant component is 𝛼𝑈𝑛(𝑇,(𝑇′,𝑇0,𝛼𝑇,𝛽𝑇))=𝑇0. These definitions satisfy equation 111.10 by the evaluation rule for a neutral universe code.
For booleans, let 𝑁′2(𝑡) contain a normal Boolean over 𝑡: it is either 0, 1, or a neutral Boolean. Reification is the inclusion into normal syntax, and reflection sends a neutral to its neutral alternative. To check the recursor, let 𝑞𝐶(𝑡,𝜈) be the normalization datum for its motive and let 𝜉0,𝜉1 realize its two branches 𝑐0,𝑐1. The result realizer is 𝜉0 when 𝜈=0 and 𝜉1 when 𝜈=1. When 𝜈 is a neutral 𝑘, put 𝑔(𝑥):=(𝑞𝐶(𝖾𝗏(𝑥),𝛽𝑁2(𝑥)))0,𝑘𝗋𝖾𝖼:=𝖻𝗋𝖾𝖼(𝗅𝖺𝗆𝑁2(𝑥↦𝑔(𝑥)),𝛼𝐶(0,0)(𝑐0,𝜉0),𝛼𝐶(1,1)(𝑐1,𝜉1))(𝑘). Reflect 𝑘𝗋𝖾𝖼 with the 𝛽-component of 𝑞𝐶(𝑡,𝑘). Evaluation of the three clauses gives the two Boolean computations and the stuck recursor, respectively.
It remains to give the product clause. Suppose 𝑞𝐴=(𝐴′,𝐴0,𝛼𝐴,𝛽𝐴)∈𝑈′𝑛(𝐴) and, for every 𝑎:𝐴 and 𝜈∈𝐴′(𝑎), 𝑞𝐵(𝑎,𝜈)=(𝐵′(𝑎,𝜈),𝐵0(𝑎,𝜈),𝛼𝐵(𝑎,𝜈),𝛽𝐵(𝑎,𝜈))∈𝑈′𝑛(𝐵(𝑎)). For 𝑤:Π(𝑎:𝐴).𝐵(𝑎) and a variable 𝑥, abbreviate 𝑎𝑥:=𝖾𝗏(𝑥) and 𝜈𝑥:=𝛽𝐴(𝑥). Set 𝐶′(𝑤):=∏𝑎:𝐴∏𝜈∈𝐴′(𝑎)𝐵′(𝑎,𝜈)(𝖺𝗉𝗉(𝑤,𝑎)),𝛽𝐶(𝑘)(𝑎,𝜈):=𝛽𝐵(𝑎,𝜈)(𝖺𝗉𝗉(𝑘,𝛼𝐴(𝑎,𝜈))),ℎ𝑤,𝜉(𝑥):=𝛼𝐵(𝑎𝑥,𝜈𝑥)(𝖺𝗉𝗉(𝑤,𝑎𝑥),𝜉(𝑎𝑥,𝜈𝑥)),𝛼𝐶(𝑤,𝜉):=𝗅𝖺𝗆𝐴0(𝑥↦ℎ𝑤,𝜉(𝑥)),𝐶0:=𝗉𝗂(𝐴0,𝑥↦𝐵0(𝑎𝑥,𝜈𝑥)). In the last three lines 𝑥 is the newest variable of the extended telescope, and every operation is renamed along that extension. Evaluation of the last line gives Π(𝑎:𝐴).𝐵(𝑎). Evaluation of 𝛽𝐶 gives the application of 𝑘 because reflection preserves evaluation. Evaluation of 𝛼𝐶 gives 𝑤 because the body evaluates pointwise to 𝖺𝗉𝗉(𝑤,𝑎) and product 𝜂 identifies the resulting lambda with 𝑤. Hence (𝐶′,𝐶0,𝛼𝐶,𝛽𝐶) belongs to 𝑈′𝑛(Π(𝑎:𝐴).𝐵(𝑎)). Equation 111.12, Equation 111.13, Equation 111.15, together with the pointwise structural clauses, equip the displayed model with every operation of 𝑇Coq and preserve all of its equations.
Stage 4: normalization and decision. Initiality gives a unique morphism 𝑠:ICoq→I∗Coq into the displayed model. Its composite with the forgetful projection is the identity morphism by initiality. Consequently, for every 𝑎:𝐴, the second component 𝑎′ of 𝑠(𝑎) has the type required in equation 111.11. Define 𝗇𝖿𝐴(𝑎):=𝛼𝐴(𝑎,𝑎′). By equation 111.10, 𝖾𝗏𝐴(𝗇𝖿𝐴(𝑎))=𝑎. If 𝑎=𝑏, functoriality of 𝑠 and of reification gives 𝗇𝖿𝐴(𝑎)=𝗇𝖿𝐴(𝑏). Conversely, equality of the normal forms implies 𝑎=𝖾𝗏𝐴(𝗇𝖿𝐴(𝑎))=𝖾𝗏𝐴(𝗇𝖿𝐴(𝑏))=𝑏. Typed normal syntax has decidable equality by structural recursion; the product case uses equation 111.8. Comparing 𝗇𝖿𝐴(𝑎) and 𝗇𝖿𝐴(𝑏) therefore decides whether 𝑎=𝑏, as required. ◻
The untyped value domain of definition 49.36, the type-directed reflection and reification of definition 49.37, and the division of labour between a partial equivalence relation for completeness and a Kripke relation for soundness are Abel’s: the untyped domain is [Abe13], type-directed reflection and reification are [Abe13], the partial equivalence relations are [Abe13], and the Kripke relation to syntax is [Abe13]. The theorems there are proved for the language PTT of [Abe13]: untyped de Bruijn expressions with explicit substitutions over six constants—natural numbers, zero, successor, primitive recursion, the dependent function type, and the universes 𝖲𝖾𝗍𝑘—presented as a type-assignment system with a subsumption rule and cumulative universes 𝖲𝖾𝗍𝑘≤𝖲𝖾𝗍𝑙 for 𝑘≤𝑙. PTT therefore has Π, ℕ and universes and nothing else: no Σ, no 𝟏, no 𝟐, no identity type, no indexed family, no strict lifts and no binder metadata; and its subsumption rule is a rule that convention 111.16 does not have. What is borrowed above is the architecture, clause by clause; what is proved above is proved here. The same source’s [Abe13] records injectivity of the dependent function type for PTT, which is the analogue of the Π clause of theorem 111.81 at that smaller signature.
Definition 111.65 pairs a term with a value and requires them to agree after readback; definition 111.71 does the same for substitutions and environments. Angiuli and Gratzer present exactly this pairing as a gluing construction and package its conclusion as a normalization structure [AG26], which is the form used in definition 49.16. Their development is for extensional type theory and supplies no theorem used above; the normalization-structure packaging is only a definition.
Altenkirch and Kaposi prove normalization, completeness, stability, and decidability of definitional equality by an internal, proof-relevant logical predicate [AK17]. Their object theory is the intrinsically typed quotient inductive–inductive syntax of [AK17]: explicit substitutions, dependent functions with 𝜂, one uninterpreted type 𝑈, and a family sending a term of that type to a type, 𝖤𝗅:𝖳𝗆Γ𝑈→𝖳𝗒Γ. It has no Σ, 𝟏, 𝟐, ℕ, identity type, vector family, strict lift, or binder metadata. The construction is internal to a metatheory supporting the quotient inductive–inductive presentation and extensional principles. It does not normalize types: normal terms remain indexed by types that need not be normal [AK17]. Thus it does not supply the normal-type component of convention 111.28. Its separate injectivity development [AK17] is the analogue of the Π-head argument in theorem 111.81, but only for its own signature. Consequently it supplies architectural evidence for definition 111.71, lemma 111.74. The proofs above are independent of its result; transferring that result to 𝑇𝗂𝗆𝗉𝗅 would still require exactly the missing former and metatheory translations just listed.
Computability predicates originate with Tait’s normalization proof for Gödel’s System T; Girard’s candidates extend the method to impredicative polymorphism [GLT89]. Martin-Löf’s semantic normalization and decidability arguments [ML98, ML75] anticipate normalization by evaluation. Section 49.4 uses the Kripke presentation descending from Catarina Coquand’s formalization; Abel supplies the architecture for section 49.5–section 111.9 at the smaller signature recorded in remark 111.93[Abe13]. Altenkirch and Kaposi’s intrinsic presheaf construction supplies the source-bounded comparison in remark 111.95, including its explicit substitution signature and its limits relative to Timpl [AK17]. The proof-relevant algebraic construction in section 49.2, convention 111.90 follows Coquand [Coq19]; Angiuli and Gratzer package the corresponding Artin gluing as the normalization structure of definition 49.16[AG26]. Streicher gives an early semantic analysis of intensionality [Str93], while Hofmann proves the extensional-equality boundary used in remark 49.21[Hof95]. Synthetic Tait computability and its cubical and modal applications are developed in [Ste21, SA21, Gra23]; an operational cubical canonicity proof is [Ang19]. The rule-induction discipline is that of [Har16].
★★☆ In the respective contexts, normalize 𝑓:𝟐→𝟐⊢𝑓:𝟐→𝟐,𝑥:𝟐⊢𝗂𝗇𝖽𝟐(𝑦.𝟐;𝗍𝗍,𝖿𝖿,𝑥):𝟐, and 𝑝:(𝟐→𝟐)→𝟐⊢𝑝:(𝟐→𝟐)→𝟐. In the middle term the motive is the constant family 𝑦.𝟐, the true branch is 𝗍𝗍, the false branch is 𝖿𝖿, and the principal argument is the neutral variable 𝑥; hence no computation rule fires. For each result, trace reflection and reification and identify the type index that prevents an untyped readback clause.
★★★Practical project.nbe-pi-bool Before implementing the evaluator, carry out on paper the following exact case table and record every evaluation, reflection, and reification call: Π—a lambda and application of a neutral function; Σ—a pair and both projections of a neutral pair; 𝟏—⋆ and 𝜂-readback (there is no Unit eliminator in the signature); 𝟐—both constructors and elimination of a neutral Boolean; ℕ—zero, successor, and elimination of a neutral natural; identity—reflexivity and 𝖩 on a neutral proof; vectors—nil, cons, and 𝗏𝗂𝗇𝖽 on a neutral vector; universes and strict lift—quotation of a universe code, a neutral code, and a lifted code (these are quotation cases, not term eliminators). Also write one ill-typed readback request and the invariant that rejects it.
Implement in Agda or Kappa a fuel-bounded executable slice of the normalizer of definition 111.45, definition 49.37 and a partial normal-form shape rechecker, covering every entry of the preceding case table; for Π preserve its two binder bits, for identity include 𝖩, for vectors include 𝗏𝗂𝗇𝖽, and for strict universes include 𝖫𝗂𝖿𝗍. Each test supplies the semantic readback type as trusted input: the slice neither infers that type nor checks universe formation. Its invariant is only that reification is called at the supplied semantic type, that every stored annotation in the output is requoted rather than copied, and that the separate rechecker accepts the outer grammar of the resulting normal form. It is not the independent bidirectional rechecker of chapter 48. The program must produce: the 𝜂-long normal form of a variable at each negative former; the stuck normal form of each eliminator on a neutral principal argument; a normal Π-type whose two bits are preserved; the accepted type equation and the rejected code equation of example 111.84; the 𝖩 and 𝗏𝗂𝗇𝖽 computations on 𝗋𝖾𝖿𝗅 and on 𝗏𝖼𝗈𝗇𝗌; and one accepted and one rejected conversion. Mutation test: replace one semantic clause by another that still type-checks—for instance, let reification at a Σ value return its first projection twice—and exhibit the named oracle that then fails. State explicitly that the executable slice is finite and that running it proves none of theorem 111.76, theorem 49.18, corollary 49.20.