Let Γ𝖺𝗉𝗉:=𝐴:U𝑢,𝑚:ℕ,𝑛:ℕ,𝑥𝑠:𝖵𝖾𝖼(𝐴,𝑚),𝑦𝑠:𝖵𝖾𝖼(𝐴,𝑛). The surface application 𝖺𝗉𝗉𝖾𝗇𝖽𝑥𝑠𝑦𝑠 does not belong to the kernel language. The kernel constant expects a level, an element type, and two length indices before the two vectors: 𝖺𝗉𝗉𝖾𝗇𝖽[𝑢]{𝐴}{𝑚}{𝑛}𝑥𝑠𝑦𝑠:𝖵𝖾𝖼(𝐴,𝑛+𝑚). The braces mark implicit term arguments and the square brackets mark an external level argument. Deleting those four arguments is harmless only if a terminating procedure reconstructs them, rejects incompatible choices, and returns the explicit term in (112.2) for the kernel to check. That reconstruction problem is elaboration.
The surface-to-core problem
The kernel checks one fixed calculus. Surface syntax changes how information reaches that calculus; it does not add a kernel rule.
This chapter inherits the predicative kernel signature 𝑇𝗂𝗆𝗉𝗅, pronounced “Timpl”, from convention 110.16. Surface elaboration additionally admits level metavariables; generated level expressions use zero, successor, and maximum, and a solved elaboration instantiates them by external Timpl levels. Every core Π-binder, abstraction, and application therefore carries the explicitness and relevance bits fixed by the inherited signature. Elaboration copies both bits and never guesses either independently of a binder. The core Σ-former, pairs, and projections have no such metadata.
The chapter assumes a conversion interface providing total normalization to beta-iota normal, eta-long form, constructor inversion, and conversion for this exact signature. Eta-long form is recursive at every Timpl former with a uniqueness rule: a 𝟏-typed term normalizes to ⋆, a Σ-typed neutral is exposed as a pair of projections whose components are normalized again, and a Π-typed neutral is exposed as an abstraction. Consequently variables of recursively contractible Unit/Sigma type disappear from canonical support rather than surviving as arbitrary neutral heads. The rules below use that interface rather than re-prove a conversion query. Theorem 111.81 constructs the six operations at the exact Timpl signature and corollary 111.82 discharges this oracle boundary. This does not make the whole elaborator total: general recursive definitions, 𝑊-types, coinduction, quotient computation, equality reflection, recursive pattern clauses, coercions, overloading, type-class search, and tactics are not in this card. In particular, the chapter reconstructs the arguments of an already elaborated vector eliminator; it does not compile the two clauses defining append.
The surface fragment 𝑇𝖾𝗅𝖺𝖻 has variables and declared constants; explicit and implicit Π-binders, abstractions, and applications; Σ-types, pairs, and projections; the nullary and constructor forms of 𝟏, 𝟐, ℕ, identity, and 𝖵𝖾𝖼; strict universe expressions Uℓ; their motive-annotated eliminators; annotations (𝑒:𝐴); and holes written _. A fully explicit core term may occur as an annotated atom. Thus every Timpl former is available, while the only information the elaborator reconstructs is:
implicit term arguments declared by an implicit Π-binder;
external universe levels;
the type and term demanded by a hole; and
annotations forced by an expected type.
A surface Π-binder and abstraction record explicitness and relevance. Written application syntax records explicitness; its relevance is copied from the exposed Π-head. The Σ-binder carries neither bit. Surface recursive clauses are absent from 𝑇𝖾𝗅𝖺𝖻.
Here is the grammar used below. A hatted level or argument may be omitted; 𝗁 ranges over the finite Timpl signature card, including its constructors and motive-annotated eliminators. 𝑒::=𝑥∣Uℓ∣𝗁[⃗̂ℓ]⟨⃗̂𝑒⟩∣_∣(𝑒:𝐴)∣𝜆𝜖,𝜚𝑥.𝑒∣𝑒𝜖𝑒∣(𝑒,𝑒)∣𝗉𝗋1(𝑒)∣𝗉𝗋2(𝑒),𝐴::=𝑥∣_∣Uℓ∣𝟏∣𝟐∣ℕ∣𝖨𝖽𝐴(𝑒,𝑒)∣𝖵𝖾𝖼[̂ℓ](𝐴,𝑒)∣∏𝜖,𝜚𝑥:𝐴𝐴∣∑𝑥:𝐴𝐴. The application marker 𝜖 is explicit or implicit. In a signature head, omission is permitted exactly at an external level or an implicit argument declared by that head; all motives remain written. A core preterm is the Timpl grammar from convention 112.1, extended only by level metavariables and occurrences ?𝛼[𝛿]. Thus the grammar does not hide a second class of untyped core nodes.
For the rules below, 𝗐𝗁𝗇𝖿(𝐴) is the unique weak-head form returned by the normalization interface of convention 112.1. A premise 𝗐𝗁𝗇𝖿(𝐴)=𝐻 is an algorithmic head test, not a new judgmental equality rule.
When metadata matters, write ∏𝜖,𝜚𝑥:𝐴𝐵, 𝜆𝜖,𝜚(𝑥:𝐴).𝑏, and 𝑓𝜖,𝜚𝑎 for the three core nodes. The ordinary ∏𝑥:𝐴𝐵, 𝜆(𝑥:𝐴).𝑏, and 𝑓𝑎 notations abbreviate the explicit-runtime case. No analogous superscripts are attached to Σ, pairs, or projections.
The distinction between explicit and implicit arguments is syntactic. Write ∏𝑥:𝐴𝐵 and 𝑓𝑎 for explicit binding and application, and write {𝑥:𝐴}→𝐵 and 𝑓{𝑎} for their implicit counterparts. In this abbreviation the implicit binder is erased, so these forms mean ∏𝗂𝗆𝗉,𝖾𝗋𝖺𝗌𝖾𝖽𝑥:𝐴𝐵 and 𝑓𝗂𝗆𝗉,𝖾𝗋𝖺𝗌𝖾𝖽𝑎. An implicit runtime argument is written with the full metadata notation. Thus every abbreviated form still fixes both bits required by the core checker.
An unannotated abstraction illustrates the first limit. There is no synthesis derivation for Γ⊢𝜆𝑥.𝑥⇒? because the domain cannot be recovered from the term. Against an expected type ℕ→ℕ, however, the product head determines the domain and codomain, and the body checks in Γ,𝑥:ℕ. A hole has the reverse behavior: _⇐ℕ has enough type information, but no term. The elaborator records the missing term as a scoped unknown rather than inventing a global placeholder.
A contextual metavariable declaration has the form ?𝛼:[Δ⊢𝐴], where Δ=𝑥1:𝐴1,…,𝑥𝑘:𝐴𝑘 is a well-formed telescope and Δ⊢𝐴𝗍𝗒𝗉𝖾. In a context Γ, an occurrence has the form ?𝛼[𝜃], where 𝜃:Γ→Δ is a well-typed simultaneous substitution. A definition ?𝛼:=[Δ]𝑎 is legal exactly when Δ⊢𝑎:𝐴, and replaces every occurrence by 𝑎[𝜃]. In worked constraint traces only, when Δ=Γ, the bare notation ?𝛼 abbreviates the identity occurrence ?𝛼[idΓ]; declarations and generation rules retain the substitution explicitly.
A metacontextM is a dependency-ordered list of declarations and definitions. The type and body of an entry may mention only entries to its left. A term metavariable never denotes an external universe level; a level metavariable ranges over level expressions and belongs to a separate finite context L.
The explicit telescope and substitution on a metavariable occurrence enforce the contextual modal discipline; the solver below uses only the finite renaming instances displayed in this definition.
Let M and N be dependency-ordered metacontexts. A typed meta-substitution 𝜃:M⇒N assigns to every entry ?𝛼:[Δ⊢𝐴] of M a term [Δ]𝑎 well typed at 𝐴 after the earlier assignments, with free metavariables drawn from N. Its action is postfix: ?𝛼[𝛿][𝜃] is 𝑎[𝛿][𝜃], and the action extends structurally to contexts, types, terms, and constraints.
If 𝜌:N⇒P, define postfix composition by 𝑋[𝜃;𝜌]≡𝑋[𝜃][𝜌],(𝜃;𝜌)(?𝛼):=𝜃(?𝛼)[𝜌]. For a finite problem 𝑃, write dom(𝑃) for the metavariables present before solving. Solutions 𝜃1 and 𝜃2 are compared only on that domain. Write 𝖬𝗈𝗋𝖾𝖦𝖾𝗇𝖾𝗋𝖺𝗅𝑃(𝜃1,𝜃2) when some well-typed 𝜌 satisfies ?𝛼[𝜃2]≡?𝛼[𝜃1][𝜌]forevery?𝛼∈dom(𝑃). Residual fresh metavariables are immaterial: two solutions are identified when a dependency-preserving bijective renaming of those fresh entries makes their actions judgmentally equal on dom(𝑃). A most general solution is one related by 𝖬𝗈𝗋𝖾𝖦𝖾𝗇𝖾𝗋𝖺𝗅𝑃 to every solution, modulo that equivalence.
For the hole _⇐ℕ in context 𝑥:ℕ, create ?𝛼:[𝑥:ℕ⊢ℕ] and return ?𝛼[𝑥]. If the hole is inside a second binder 𝑦:𝟐, its occurrence is ?𝛼[𝑥,𝑦] only when the declaration telescope includes both variables. The rejected definition ?𝛼:[𝑥:ℕ⊢ℕ]:=[𝑥:ℕ]𝑦(𝑦:ℕ∉𝑥:ℕ) fails the typing premise of definition 112.3. Recording only a global symbol ?𝛼 would lose precisely this check.
An object constraint is either a type equation Γ⊢𝐴≐𝐵𝗍𝗒𝗉𝖾 or a heterogeneous typed term equation Γ⊢(𝑠:𝑆)≐(𝑡:𝑇). A type equation requires judgmental equality of two already well-formed types; it does not require them to inhabit a common universe. A solution of a term equation must first make 𝑆 and 𝑇 judgmentally equal types and must then, after conversion to either type, make 𝑠 and 𝑡 judgmentally equal. We abbreviate the homogeneous case by Γ⊢𝑠≐𝑡:𝑆. Heterogeneous equations are necessary while dependent indices are still unknown: two constructor spines need not have a common type before their index constraint is solved.
A formation guard has the form Γ⊢𝐴˙∈Uℓ. It is a suspended, syntax-directed universe-membership task, not an equation, and is never sent to the unifier. After object substitution it is compiled into the exact level premises of the Timpl formation rules by definition 112.11. The component C stores an ordered equation list and an ordered formation-guard list; concatenation preserves both orders.
A level constraint is either a strict equality ℓ≐𝖫ℓ′ or a formation inequality ℓ+𝑘≤ℓ′, where 𝑘 is a meta-level natural number. A constraint state(L;M;C;U) consists of a level context, a metacontext, a finite constraint component C, and a finite list of level constraints.
A solution(𝜐;𝜃) assigns level expressions to the unknowns in L and well-typed contextual definitions to the unsolved entries of M. It solves the state when every equation in C becomes judgmental equality in Timpl, every formation guard compiles without a flexible-head obstruction, and every equality or inequality in U, including those emitted by guard compilation, is valid for all values of the external level parameters. The type-equality and term-equality obligations are both part of solving an object constraint. Once the unique equality-level substitution has been fixed and applied, object solutions are ordered by the problem-relative predicate 𝖬𝗈𝗋𝖾𝖦𝖾𝗇𝖾𝗋𝖺𝗅𝑃 of definition 112.4; equivalently, 𝜃2 agrees on the original problem domain with 𝜃1;𝜌 for a well-typed substitution 𝜌 on the remaining object metavariables in that equality-substituted state. Residual bound-level assignments are not ordered by instantiation. Their order is pointwise: 𝜈≤𝜈′ exactly when 𝜈(𝑞)≤𝜈′(𝑞) for every bound metavariable 𝑞 and every valuation of the external parameters.
The occurs check forbids a metavariable in its own definition; the scope check requires a proposed body to use only its declaration telescope. The two checks are different. The equation ?𝛼[𝑥]≐𝗌𝗎𝖼(?𝛼[𝑥]):ℕ passes the scope check but fails the occurs check: no finite acyclic definition for ?𝛼 results. The equation ?𝛼[𝑥]≐𝑦:ℕ with 𝑦∉Δ can be acyclic but fails the scope check. Both checks precede every assignment.
★☆☆ In context 𝑥:ℕ,𝑦:𝟐, let ?𝛼:[𝑥:ℕ⊢ℕ] and ?𝛽:[𝑥:ℕ,𝑦:𝟐⊢ℕ]. Decide which of ?𝛼[𝑥]≐𝑥,?𝛼[𝑥]≐𝗂𝗇𝖽𝟐(𝑧.ℕ;𝑥,𝗌𝗎𝖼(𝑥);𝑦),?𝛽[𝑥,𝑦]≐𝑥 may orient from left to right as a contextual definition. For each rejected orientation name the failed premise of definition 112.3.
Constraint generation traverses surface syntax to produce a typed core preterm and equations; it follows the bidirectional division of definition 48.16. It does not solve equations while traversing syntax; the separation makes the soundness invariant visible.
The judgments L;M;Γ⊢𝑒⇒𝑎:𝐴⊣L′;M′;C;U,L;M;Γ⊢𝑒⇐𝐴⇝𝑎⊣L′;M′;C;U,L;M;Γ⊢𝐴⇐𝗍𝗒𝗉𝖾⇝𝐴′⊣L′;M′;C;U. respectively synthesize a Timpl type and preterm, check against a supplied Timpl type, or elaborate a well-formed type without asserting that it inhabits one universe. The third mode is necessary because the strict hierarchy of definition 29.1 is not cumulative. The output contexts extend the input contexts, and the returned term, type, and constraints may mention only output declarations. Premises are read left to right: each premise receives the output contexts of its predecessor, and their constraint lists are concatenated in that order. The rules use one fixed fresh-name supply. We also use two auxiliary judgments: L;M;Γ⊢(𝑎:𝐴)@⃗𝑞⟹𝑏:𝐵⊣L′;M′;C;U,L;M;Γ⊢ℎ(⃗𝑎;Δℎ;𝑅)@⃗𝑞⟹𝑏:𝐵⊣L′;M′;C;U. The first consumes an ordinary written application spine. The second walks the dependency-ordered argument telescope of a fixed signature head ℎ; its input ⃗𝑎 is the already elaborated prefix. A written argument is 𝑞=𝑒𝜖. In a signature telescope, every binder additionally has a surface policy 𝜔∈{𝗂𝗇𝖿𝖾𝗋,𝗐𝗋𝗂𝗍𝖾}; all motive binders have policy 𝗐𝗋𝗂𝗍𝖾. List concatenation of independently generated constraints is written with commas and always follows premise order. In long rules only, the abbreviations Ξ𝑖:=L𝑖;M𝑖;Γ,Ω𝑖:=L𝑖;M𝑖;C𝑖;U𝑖 carry no hidden operation: the index on Ξ𝑖 names the level and metacontexts at stage 𝑖, while the index on Ω𝑖 names that stage’s output package; an unindexed input in a rule is Ξ0. The sequential package Ω1⋄Ω2:=L2;M2;(C1,C2);(U1,U2) is defined only when the second premise starts in Ξ1, and extends associatively to a finite sequence of threaded packages. Thus ⋄ merely prints the state threading and ordered concatenation already required by the judgments. If 𝑔 is a formation guard, write Ω⊕𝑔 for the same package with 𝑔 appended to the guard projection of its constraint component. This operation does not run a solver. The atomic, checked-hole, direction-changing, and lambda clauses are
𝑥:𝐴∈Γ
L;M;Γ⊢𝑥⇒𝑥:𝐴⊣L;M;∅;∅
E-Syn-Var
𝑐[⃗ℓ]:𝐴isafullylevel-instantiatedsignatureatom
L;M;Γ⊢𝑐[⃗ℓ]⇒𝑐[⃗ℓ]:𝐴⊣L;M;∅;∅
E-Syn-Atom
?𝛼freshM′=M,?𝛼:[Γ⊢𝐴]
L;M;Γ⊢_⇐𝐴⇝?𝛼[idΓ]⊣L;M′;∅;∅
E-Chk-Hole
L;M;Γ⊢𝑒⇒𝑎:𝐵⊣L′;M′;C;U
L;M;Γ⊢𝑒⇐𝐴⇝𝑎⊣L′;M′;(C,Γ⊢𝐴≐𝐵𝗍𝗒𝗉𝖾);U
E-Chk-Syn
𝗐𝗁𝗇𝖿(𝐴)=∏𝜖,𝜚𝑥:𝐵𝐶L;M;Γ,𝑥:𝐵⊢𝑒⇐𝐶⇝𝑏⊣L′;M′;C′;U′
L;M;Γ⊢𝜆𝜖,𝜚𝑥.𝑒⇐𝐴⇝𝜆𝜖,𝜚(𝑥:𝐵).𝑏⊣L′;M′;C′;U′
E-Chk-Lam
Universe membership has its own checking clause:
𝑝,𝑞well-formedlevelexpressions𝗐𝗁𝗇𝖿(𝐴)=U𝑞
L;M;Γ⊢U𝑝⇐𝐴⇝U𝑝⊣L;M;∅;(𝑝+1≤𝑞)
E-Chk-Univ
The displayed inequality is recorded, not solved during generation. It is the exact side condition of U-Hier.
Holes and annotations in synthesis mode, and holes in type mode, are governed by the following rules. These rules fix the declaration order of the fresh level and object metavariables.
Type formation is a separate inductive judgment, not an implicit appeal to a maximum universe. In E-Ty-Vec, 𝗅𝖾𝗏𝖾𝗅L(̂ℓ)=(ℓ,L0) means ℓ is the written well-formed level and L0=L, or ℓ=?𝑢 is fresh and L0=L,?𝑢.
Thus the legal input 𝖵𝖾𝖼[0]((𝑥:ℕ)→ℕ,𝟢) first elaborates its product element type by E-Ty-Pi; the resulting guard is then discharged by U-Pi. No term-synthesis rule for a product is required.
The binding type formers thread the domain output into the opened codomain.
Type-mode rule selection is deterministic. Inspect the outer constructor in this priority order: hole, universe literal, nullary base, identity, vector, product, and Sigma. Rule E-Ty-El is the fallback only for an atom outside those seven syntactic classes whose synthesis exposes a universe. It is therefore never tried after a recognized type-former rule has failed, and no surface type expression selects two type-mode clauses.
Pairs and projections have the following exact clauses. The weak-head premises are tests; failure gives no derivation.
Ordinary application is the least relation generated by E-Syn-App, E-Spine-Done, E-Spine-Insert, and E-Spine-Consume. Rule priority is part of the definition: insertion precedes the explicit case, a written implicit argument precedes insertion, and E-Spine-Done applies only when the written spine is empty and the exposed head is not an implicit product.
A flexible or rigid nonproduct head and an explicitness mismatch have no rule. Consequently this relation inserts one unique consecutive block of implicit arguments and never guesses a relevance bit.
Finally let a signature entry have level parameters ⃗𝑢, result 𝑅, and dependency-ordered argument telescope ((𝑥𝑖:𝐵𝑖)𝜖𝑖,𝜚𝑖,𝜔𝑖)𝑛𝑖=1. Written levels are copied; omitted levels are replaced from left to right by fresh level metavariables. This deterministic operation is written 𝗅𝖾𝗏𝖾𝗅𝗌ℎ(⃗̂ℓ;L)=(⃗ℓ;L0). The signature-head and telescope rules are:
There is no omission rule for a 𝗐𝗋𝗂𝗍𝖾 binder. This is the exact reason an eliminator motive cannot be invented by E-Syn-Head.
Rule E-Chk-Syn emits first-class type equality, so it remains applicable to well-formed mixed-level products that inhabit no common strict universe. When a type equation itself compares U𝑟 with U𝑠, rigid decomposition emits the strict level equality 𝑟≐𝖫𝑠. Separate membership premises emit lower-bound edges through E-Chk-Univ. The type rules never invent a maximum universe: the optional level on a surface vector is a formation witness, while the returned Timpl family is 𝖵𝖾𝖼(𝐴′,𝑛′). Every premise receives both output contexts of its predecessor. Lambda, pair, projection, ordinary-spine, and signature-head rules likewise copy their displayed dependency and metadata; a failed head test or marker match has no derivation. In particular a flexible application head is outside this direct generation fragment until an annotation exposes a product with both metadata bits, and no signature rule invents a written motive.
This repeated insertion of consecutive implicit binders is implicit saturation; it stops at the first explicit binder and does not choose among alternative spine shapes.
For a declared head, E-Syn-Head instantiates external levels before the head telescope is traversed. Thus an omitted level of 𝖺𝗉𝗉𝖾𝗇𝖽 or 𝗆𝖺𝗉 is fixed before ordinary implicit saturation, whereas E-Syn-Atom applies only after every external level has already been written.
The displayed rules cover all and only the forms of definition 112.2. In particular, both binding clauses elaborate their codomains in the opened context Γ,𝑥:𝐴′; this is part of the inductive definition rather than an extensibility convention.
Expected-type propagation is already doing mathematical work in E-Chk-Lam: it moves 𝐵 into the context before the body is visited. The same operation fixes both components of a pair. For example, checking (_,𝗋𝖾𝖿𝗅(_)) against ∑𝑛:ℕ𝖨𝖽ℕ(𝑛,𝑛) creates ?𝛼:[Γ⊢ℕ],?𝛽:[Γ⊢ℕ] and the second component generates ?𝛽≐?𝛼:ℕ. The expected Σ-type is what makes both holes scoped and typed.
Each line changes one feature. ?𝛼[]≐ℕassignaclosedtype;𝖵𝖾𝖼(?𝛼[],𝑚)≐𝖵𝖾𝖼(ℕ,𝑚)decomposeacommonrigidhead;?𝛼[𝑥]≐𝑥abstractthepermittedvariable;?𝛼[𝑥]≐𝖵𝖾𝖼(?𝛼[𝑥],𝑚)rejectthecyclicassignment. The first line needs ordinary assignment, the second rigid decomposition, the third contextual abstraction, and the fourth the occurs check. These four operations determine the readable solver below.
Suppose a generation judgment starts from well-formed L, M, and Γ. Its output contexts extend the inputs and remain well formed. Both sides of every emitted type equation are well-formed types. In every emitted Γ⊢(𝑠:𝑆)≐(𝑡:𝑇), both displayed typing judgments and both type-formation judgments hold under the output metacontext. Every emitted formation guard has a well-formed guarded type and level expression. Every emitted strict level equality and level inequality compares well-formed level expressions. Every returned preterm has the returned or expected type, conditional on the equation and formation-guard obligations in those constraints; every result of the third judgment is a well-formed type conditional on its formation guards.
Proof. Use simultaneous induction on synthesis, checking, application-spine, and type-formation derivations. The variable, constant, and annotation cases apply their Timpl typing rules and the context-extension lemma. In E-Chk-Lam, inversion gives the domain 𝐵 and codomain 𝐶; the induction hypothesis types 𝑏:𝐶 in Γ,𝑥:𝐵, hence the core abstraction has type 𝐴 after the recorded head equality. Inversion also recovers the product’s explicitness and relevance; the rule requires the surface abstraction to agree and copies the same pair to the core abstraction. Pair checking uses the first induction hypothesis before substituting its returned term into the second component type. The substitution lemma therefore gives a well-formed second query.
For application, each inserted metavariable is declared at the exposed domain before its occurrence. Substitution gives 𝐶[?𝛼/𝑥] as the type of the partially applied core term. The explicit argument case then applies Π-elimination with the exposed binder’s two metadata bits. A flexible head produces no ill-typed preterm: generation reports the run outside the direct fragment until an annotation exposes a product. A hole is well typed by its declaration. The signature-headed schema follows by induction over its dependency-ordered telescope: after each argument, substitution types every later domain and the result. Thus it covers the constructor and eliminator cases, and a motive is an input rather than an untyped invention. In the binding-former case, the two type-formation induction hypotheses form 𝐴′ and 𝐵′ in succession, with 𝐵′ formed in Γ,𝑥:𝐴′. The ordinary Π- or Σ-formation rule gives typehood without a universe-membership conclusion. The former copies the written explicitness and relevance, whereas the latter introduces no metadata. Rule E-Chk-Univ records a well-formed inequality, and rigid universe comparison records a well-formed strict equality. The induction hypotheses preserve both output contexts and type every constraint emitted by a surface type hole. ◻
★★☆ Trace checking (𝟢,𝗋𝖾𝖿𝗅(𝟢)) against ∑𝑛:ℕ𝖨𝖽ℕ(𝑛,𝟢). Display the expected type of the second component after substitution. Then replace the first component by 𝗌𝗎𝖼(𝟢) and display the rigid identity-endpoint constraint that causes rejection.
Term metavariables cannot solve a universe inequality. The elaborator uses the level-expression algebra of section 74.4 and solves a separate graph problem. The inequalities generated here are precisely those of U-Hier and the nullary closure rules; U-Cumul is absent from Timpl. Equality must first be decidable in that algebra.
Fix the declaration order of the external level parameters. A level atom is either a numeral 0+𝑘 or an expression 𝑝+𝑘, where 𝑝 is an external parameter and 𝑘∈ℕ. An atom dominates another atom under all natural-number valuations precisely in one of the following cases:
they have the same external parameter and the first offset is at least the second;
both are numerals and the first numeral is at least the second; or
the first is 𝑝+𝑘, the second is 0+𝑗, and 𝑘≥𝑗.
The canonical level normal form𝗅𝗇𝖿(𝑒) is the declaration-ordered maximum of atoms obtained by distributing successor over maximum, retaining only the largest offset for each external parameter and deleting every dominated numeral. If no external atom dominates the largest numeral, retain that numeral as the first atom. Repeated atoms and the empty maximum are identified with one copy and 0, respectively.
For example, 𝗅𝗇𝖿(max(max(𝑢,𝑣)+1,𝑢+3,2))=max(𝑢+3,𝑣+1). The numeral disappears because 𝑢+3 is at least 3 under every valuation. By contrast, the numeral in max(𝑢,𝑣,1) remains: the valuation 𝑢=𝑣=0 makes it decisive.
For all level expressions 𝑒 and 𝑒′, normalization preserves their value under every natural-number valuation of the external parameters. Moreover, 𝑒 and 𝑒′ have the same value under every such valuation if and only if 𝗅𝗇𝖿(𝑒) and 𝗅𝗇𝖿(𝑒′) are syntactically identical.
Proof. Induction on 𝑒 proves preservation. The zero case gives the atom 0+0. Successor adds one to every atom because max(𝑎,𝑏)+1=max(𝑎+1,𝑏+1). Maximum takes the union of the two atom lists. In each case, deleting a dominated atom preserves the maximum by the three clauses of definition 112.9.
It remains to prove uniqueness. In an irredundant list, the offset attached to an external parameter 𝑝 is recovered by setting every other parameter to zero and letting the value of 𝑝 exceed every displayed offset. Thus equal functions have the same external atoms and offsets. After those offsets are fixed, evaluating all parameters at zero recovers the retained numeral: when present it is strictly larger than every external offset, and when absent it was dominated by one of them. Declaration order then makes the two canonical lists syntactically identical. The reverse implication follows from the preservation calculation. ◻
After applying every object assignment stored in M, normalize the guarded type to weak-head form and compile Γ⊢𝐴˙∈Uℓ by the following exhaustive clauses for the Timpl card: 𝖿𝗈𝗋𝗆Γ(U𝑝,ℓ)={𝑝+1≤ℓ},𝖿𝗈𝗋𝗆Γ(𝐷,ℓ)={0≤ℓ}(𝐷∈{𝟏,𝟐,ℕ}),𝖿𝗈𝗋𝗆Γ(∏𝜖,𝜚𝑥:𝐵𝐶,ℓ)=𝖿𝗈𝗋𝗆Γ(𝐵,ℓ)++𝖿𝗈𝗋𝗆Γ,𝑥:𝐵(𝐶,ℓ),𝖿𝗈𝗋𝗆Γ(∑𝑥:𝐵𝐶,ℓ)=𝖿𝗈𝗋𝗆Γ(𝐵,ℓ)++𝖿𝗈𝗋𝗆Γ,𝑥:𝐵(𝐶,ℓ),𝖿𝗈𝗋𝗆Γ(𝖨𝖽𝐵(𝑎,𝑏),ℓ)=𝖿𝗈𝗋𝗆Γ(𝐵,ℓ),𝖿𝗈𝗋𝗆Γ(𝖵𝖾𝖼(𝐵,𝑛),ℓ)=𝖿𝗈𝗋𝗆Γ(𝐵,ℓ). If the weak-head form is a rigid neutral (N) and synthesis gives Γ⊢𝑁:U𝑞, emit the strict equality ℓ≐𝖫𝑞. A still-flexible head returns outside; the compiler never guesses its universe. The base clauses deliberately emit 0≤ℓ, although that inequality is extensionally automatic: when ℓ is a fresh omitted vector level, it classifies ℓ as a bound metavariable and gives the least choice (0). These clauses are precisely U-Hier, U-Pi, U-Sig, the identity and vector closure rules, and the three base closure rules. Guard compilation therefore emits no object equation and no universe maximum.
A stratified level problem partitions its level metavariables into equality metavariables and bound metavariables by the following deterministic collection policy. A fresh level metavariable starts unclassified. The first strict equality that orients it to an occurs-free expression classifies it as an equality metavariable; an equality between two unclassified metavariables orients the later declaration to the earlier one. After all strict equalities have been collected and substituted, an unclassified metavariable occurring as the right endpoint of a formation inequality becomes a bound metavariable. Any still-unclassified metavariable is ambiguous, and any strict equality still mentioning a bound metavariable is outside this stratified grammar. Thus classification is generated from constraint roles, not supplied as unexplained input data. Each equality metavariable 𝑞 has at most one direct assignment 𝑞≐𝖫𝑒, where 𝑒 is occurs-free and is built from zero, external parameters, and earlier equality metavariables by successor and maximum. Equality assignments are processed in declaration order and substituted through the rest of the problem. No equality metavariable may remain afterward. Normalize a residual rigid equality with 𝗅𝗇𝖿; such an equality contains only zero and external parameters. Delete it when the normal forms are identical and reject it otherwise. An equality that still mentions a bound metavariable is outside the stratified grammar.
Before constructing the residual bound graph, normalize every inequality whose right side contains no bound metavariable. Such an inequality is valid for all external-parameter valuations exactly when every atom of the left normal form is dominated, in the sense of definition 112.9, by some atom of the right normal form. Delete a valid rigid inequality and reject an invalid one. The residual bound part is then a finite set of inequalities 𝑝+𝑘≤𝑞, where 𝑝 is an external parameter, bound metavariable, or zero; 𝑞 is a bound metavariable; and 𝑘∈ℕ. The two metavariable classes are disjoint. Comparing strict universes U𝑟 and U𝑠 generates a level equality; if it orients toward a fresh equality metavariable, it must fit (112.5). Separately, E-Chk-Univ and formation-guard compilation generate 𝑝+1≤𝑞 when U𝑝 is checked against U𝑞. Replace max(𝑝1,…,𝑝𝑟)+𝑘≤𝑞 by its 𝑟 component inequalities. After the rigid discharge, the upper normal form must be one bound metavariable 𝑞. An upper maximum containing a bound metavariable is disjunctive rather than a difference-constraint edge and is reported outside this stratified fragment; an upper maximum containing no bound metavariable was already decided by the atomwise test.
Regard (112.6) as an edge 𝑝𝑘→𝑞. Adjoin a zero-weight edge 00→𝑞 for every bound metavariable 𝑞; this records the implicit natural-number lower bound and does not change the set of solutions. Compute strongly connected components of the full nonnegative-weight graph. Reject any component containing a positive-weight edge: within a strongly connected component that edge lies on a positive cycle. Every remaining component has only zero-weight edges; collapse those components. On the resulting acyclic graph, assign to each unknown 𝑞 the maximum of 𝑝+𝑘 over all paths from zero or an external parameter 𝑝 to 𝑞.
The constraints 𝑢+1≤𝑟 and 𝑣+1≤𝑟 give 𝑟=max(𝑢,𝑣)+1. The constraints 𝑟+1≤𝑠 and 𝑠+1≤𝑟 form a positive cycle and are rejected. Weak cycles merely identify levels.
The algorithm of definition 112.12 terminates. It rejects exactly the unsatisfiable stratified level problems, and otherwise returns the unique normalized equality assignments followed by the pointwise least solution of the residual bound problem.
Proof of Theorem 112.13 — Canonical stratified level solution
Proof. The dependency-ordered equality pass terminates, and its grammar makes each assignment unique after normalization. By lemma 112.10, two residual rigid normal forms are identical exactly when their equality is valid under every valuation; when they differ, the separating valuation from that lemma proves the rejection sound and complete. An occurs check or a second, incompatible direct assignment is outside the stratified grammar rather than a solver branch. Substitution leaves a finite collection of bounds. For a rigid upper bound, atomwise domination is equivalent to universal validity of one maximum below another: each left atom must be bounded by a right atom, and the three domination clauses prove sufficiency; a failing atom supplies a separating valuation. The discharge pass is therefore sound and complete. What remains is a finite nonnegative-weight bound graph.
Compute its full strongly connected components. Such a component contains a positive edge exactly when it contains a positive cycle; summing that cycle’s inequalities yields 𝑞+𝑘≤𝑞 for 𝑘>0, which has no natural-number solution. Conversely, if no component contains a positive edge, every internal edge has weight zero. After those components are collapsed, define the value at a vertex by the maximum weight of every path ending there, with zero or the path’s external parameter as base. The adjoined zero edge ensures that this set is nonempty for every bound vertex. A finite acyclic graph has finitely many paths. Appending an edge 𝑝𝑘→𝑞 shows that the assigned value of 𝑞 is at least the assigned value of 𝑝 plus 𝑘, so every constraint holds.
Let 𝜈 be any other solution. Induction along a path gives 𝑝+𝑘≤𝜈(𝑞) for the path’s accumulated weight 𝑘. Taking the maximum over all such paths shows that the constructed value is at most 𝜈(𝑞). Hence it is the pointwise least solution. ◻
Syntactic decomposition before computation is unsound. The two types (𝜆𝑥.𝖵𝖾𝖼(𝐴,𝑥))𝑚and𝖵𝖾𝖼(𝐴,𝑚) have different raw heads and the same weak-head form. Conversely, unfolding every subterm to full normal form spends work in components that a head comparison may never inspect.
Weak-head normalization reduces head 𝛽-redexes and the computation rule of an eliminator whose scrutinee has constructor head. A weak head is flexible when the head of its neutral spine is an unsolved metavariable, even when applications or stuck eliminators follow that head. It is rigid when the spine head is a bound variable, declared constant, type former, or constructor, or when an eliminator is stuck on such a rigid neutral. Thus ?𝛼[𝑥]𝑦 is flexible for classification, although it will be outside the direct fragment below.
Before classifying heads, delete any normalized heterogeneous constraint whose two types and whose two terms are respectively judgmentally identical. A remaining constraint is flex–rigid when exactly one term head is flexible, flex–flex when both are flexible, and rigid–rigid otherwise. The types are simplified before the terms; the terms are normalized only far enough to make this classification.
After weak-head normalization, simplify a heterogeneous rigid–rigid equation as follows.
First simplify the equation between its two types. Reject a rigid type clash. Once the types convert, regard the term equation as homogeneous.
Delete every normalized reflexive equation, irrespective of whether its common head is rigid or flexible.
Decompose two occurrences of the same type former or constructor into equations between corresponding arguments. Dependent spine arguments are processed from left to right, so each earlier equality converts the types of the later pair.
Compare two abstractions by extending the context with one variable and comparing their bodies. The normalization interface supplies eta-long forms, so a neutral function at product type is exposed as an abstraction before this clause is used. It also canonicalizes every Unit-typed term to ⋆ and exposes a Sigma-typed neutral as a pair before component comparison.
Comparing U𝑟 with U𝑠 emits the strict level equality 𝑟≐𝖫𝑠. Before any suspended term equation is exposed, run the equality stratum of definition 112.12: orient a permitted equality metavariable, substitute its normalized assignment through the entire combined state, and delete a reflexive rigid equality or reject a distinct one. Separately, E-Chk-Univ emits 𝑝+1≤𝑞 when checking U𝑝 against U𝑞.
Reject distinct rigid heads, including distinct constructors of 𝟐, ℕ, or 𝖵𝖾𝖼.
Leave an equation stuck only when at least one side has a flexible head.
The fresh variable in item 4 avoids the free variables of both sides and of the constraint context. For a first-class type equation, skip item 1 and apply items 2–7 directly to the two well-formed type expressions. For a heterogeneous term equation, item 1 is a separate type-equation task and must finish before term-head classification.
Each step of definition 112.15, including an update of the level state, preserves and reflects the combined solution pairs of its input state. A rigid type- or term-head rejection has no solution.
Proof of Lemma 112.16 — Rigid simplification preserves solutions
Proof. Weak-head normalization preserves judgmental equality. Solving the type obligation licenses context conversion to a homogeneous term equation. Congruence proves that solutions of the component equations solve the original equation. Constructor injectivity supplied by the Timpl conversion interface gives the converse; dependent spines use context conversion after each earlier component. Function extensionality is not used: eta-long normalization exposes both functions as abstractions, after which the abstraction clause compares their bodies under the same fresh variable. At 𝟏, both normal forms are ⋆, so the equation is reflexive. At a dependent Σ-type, eta-long normalization exposes both terms as pairs; injectivity first compares their projections and then compares the second components after the first-component conversion. Applying these three clauses recursively is why variables of contractible nested Unit/Sigma type do not create additional rigid solutions. Disjoint normal rigid heads cannot be judgmentally equal by constructor inversion.
For the universe clause, a combined solution of 𝑟≐𝖫𝑠 makes the two level expressions equal under every external-parameter valuation. Orienting an allowed equation 𝑞≐𝖫𝑒 and substituting 𝑒 for 𝑞 preserves and reflects combined solutions by the substitution property. If neither side is orientable, lemma 112.10 shows that identical normal forms are valid under every valuation and that distinct normal forms have a separating valuation. Thus deletion and rejection preserve exactly the old solution set. The formation inequality emitted by E-Chk-Univ is a generation constraint, so this simplification step merely retains it in the level state. ◻
★★☆ Let Γ0=𝐴:U𝑢,𝑚:ℕ,𝑎:𝐴,𝑦𝑠:𝖵𝖾𝖼(𝐴,𝑚),?𝑝:[Γ0⊢ℕ], and extend Γ0 by 𝑥𝑠:𝖵𝖾𝖼(𝐴,?𝑝[idΓ0]). Write 𝜋 for the weakening projection from that extended context to Γ0. Decompose the heterogeneous constraint (𝗏𝖼𝗈𝗇𝗌(?𝑝[𝜋],𝑎,𝑥𝑠):𝖵𝖾𝖼(𝐴,𝗌𝗎𝖼(?𝑝[𝜋])))≐(𝗏𝖼𝗈𝗇𝗌(𝑚,𝑎,𝑦𝑠):𝖵𝖾𝖼(𝐴,𝗌𝗎𝖼(𝑚))). Write the outer type and index equations first, solve ?𝑝, and state the context conversion needed before comparing the tails. Explain why comparing the tails before solving the index would not give a well-typed homogeneous equation.
A higher-order pattern occurrence is a metavariable applied to a list of pairwise distinct bound variables. The contextual occurrences below are this chapter’s telescope-typed form of that restriction.
The equation ?𝛼[𝑥]≐𝗌𝗎𝖼(𝑥) determines a function. A non-pattern observation need not even have a most general unifier. Fix the simply typed signature containing one base type 𝑜, one constant 𝑐:𝑜, and no eliminators, and let ?𝐹:[𝑥:𝑜⊢𝑜]. The equation ?𝐹[𝑐]≐𝑐:𝑜 has the two solutions ?𝐹:=[𝑥]𝑥 and ?𝐹:=[𝑥]𝑐. They are incomparable: an instance of the first still maps a fresh variable to that variable, while an instance of the second maps it to 𝑐. Moreover they have no common more-general unifier. Indeed, put the body of any proposed unifier into beta-normal, eta-long form. In the context 𝑥:𝑜, substitution of 𝑐 can produce the rigid canonical form 𝑐 without a residual equation only when that body is 𝑥 or 𝑐; a neutral headed by a residual metavariable stays neutral. Thus every unifier is one of the two displayed classes.
This proves non-unitarity of a typed non-pattern problem; the existence of several solutions alone would not. The stronger undecidability boundary for unrestricted higher-order unification and the unitary restricted result for exact CoC patterns do not transfer to the larger elaborator of this chapter. Our direct fragment therefore requires every flexible argument list to exhibit the variables on which the unknown may depend.
An occurrence is a contextual pattern occurrence when it has the form ?𝛼[𝑥1,…,𝑥𝑘], the 𝑥𝑖 are pairwise distinct, and the displayed substitution is a well-typed variable renaming from the declaration telescope of ?𝛼. A state is in the direct contextual-pattern fragment when weak-head simplification exposes only such occurrences as an entire flexible side and the following pruning-free conditions hold at every state reached by the fixed strategy. In particular, a metavariable occurrence followed by an application or stuck eliminator is outside this fragment even though its neutral head is flexible for classification. The conditions are:
in every flex–rigid constraint ?𝛼[⃗𝑥]≐𝑡, every occurrence of ?𝛼 and every occurrence of a free ordinary variable outside ⃗𝑥 is rigid in the sense defined below, while every other metavariable of 𝑡 can be moved before ?𝛼 by a dependency-preserving permutation;
every flex–flex restriction has a well-formed dependency-closed common telescope and result type;
substituting a candidate assignment and weak-head simplifying does not expose a non-pattern occurrence; and
after the equality-level substitution, every candidate object body checks at its declared result type without using a residual formation bound or instantiating a bound-level metavariable.
The test is performed before committing each transition. Its possible outcomes are therefore inside, outside the direct fragment, and unsatisfiable. Outside is not a proof of unsatisfiability. The solver does not postpone, prune, imitate, project, or search.
An occurrence inside a normal term is rigid when the path from the term root to that occurrence passes through no subterm with a flexible head; the occurrence’s own head is not counted. A forbidden variable or self-occurrence below another flexible head may be removed by pruning and is therefore outside this direct fragment. The same occurrence below only rigid constructors cannot be repaired by instantiating another metavariable and is eligible for a scope or occurs certificate.
For example, in 𝑥,𝑦:ℕ, ?𝛼[𝑥]≐𝗌𝗎𝖼(?𝛽[𝑦]) is a contextual-pattern equation but is outside the direct fragment. A pruning solver could introduce ?𝛾[], set ?𝛽:=[𝑦]?𝛾[], and then solve ?𝛼. The direct solver reports outside; it does not call the solvable state a scope error. This distinction is the price of the short completeness proof.
Consider Γ⊢?𝛼[𝑥1,…,𝑥𝑘]≐𝑡:𝐴. Orient the flexible side to the left. Assign ?𝛼:=[𝑧1:𝐴1,…,𝑧𝑘:𝐴𝑘]𝑡𝗇𝖿[𝑧1/𝑥1,…,𝑧𝑘/𝑥𝑘] exactly when:
?𝛼 does not occur in 𝑡𝗇𝖿;
every free ordinary variable of 𝑡𝗇𝖿 is among the 𝑥𝑖;
every metavariable in 𝑡𝗇𝖿 precedes ?𝛼, after a dependency-preserving permutation of independent declarations; and
after applying the equality-level substitution, the candidate body checks against the declared result type of ?𝛼 without appealing to a residual formation bound or assigning a bound-level metavariable.
Before applying items 1–3, compute the beta-iota normal, eta-long form 𝑡𝗇𝖿 supplied by convention 112.1, and use that normal form in both the tests and the displayed assignment. This canonical-form precondition is essential: a variable hidden in a discarded beta argument is not a scope occurrence, and a self-occurrence hidden there is not a cycle. Canonical forms therefore determine the scope and cycle tests rather than merely optimizing them. After assignment, substitute the definition through the remaining state. If item 2 fails only because an out-of-scope variable occurs below another flexible head, report outside the direct fragment; pruning could still produce a solution. A rigid out-of-scope occurrence is an actual scope failure. Failure of item 4 solely because universe membership awaits a residual bound is outside, not unsatisfiable. For example, ?𝐴:[Γ⊢U𝑞]≐U𝑝 is deferred by this finite policy when only 𝑝+1≤𝑞 could license the assignment; the chapter does not claim a principal object substitution before that bound is instantiated.
For example, ?𝛼[𝑥,𝑦]≐𝗏𝖼𝗈𝗇𝗌(𝟢,𝑥,?𝛽[𝑦]) orients only if 𝑥:𝐴, 𝑦:𝐵, ?𝛽 precedes ?𝛼, and the constructor has the declared result type. The assignment abstracts both variables even though the body ignores no declared dependency. In contrast, ?𝛼[𝑥]≐𝑦 fails item 2 and ?𝛼[𝑥]≐𝗌𝗎𝖼(?𝛼[𝑥]) fails item 1.
When the four premises of definition 112.18 hold in the direct fragment, the assignment in (112.9) is a most general solution of (112.8). If item 1 or item 2 fails by a rigid occurrence, the equation has no finite well-scoped contextual solution.
Proof of Lemma 112.19 — Flex–rigid most generality
Proof. Substitution into the abstraction yields 𝑡𝗇𝖿≡𝑡. The assignment is therefore a solution. Let 𝜃 be any other solution. Since the argument list is a bijective renaming of the declaration telescope, abstracting the equality 𝜃(?𝛼[𝑥1,…,𝑥𝑘])≡𝜃(𝑡) gives an equality of contextual definitions. Define 𝑏:=𝑡𝗇𝖿[𝑧1/𝑥1,…,𝑧𝑘/𝑥𝑘]. Then 𝜃(?𝛼)=[𝑧1:𝐴1,…,𝑧𝑘:𝐴𝑘]𝜃(𝑏). Thus 𝜃 factors through the displayed assignment on ?𝛼; it may still instantiate the metavariables of 𝑡𝗇𝖿, which is exactly the remaining freedom. A rigid self-occurrence survives every substitution and would make a finite term contain itself as a proper subterm. A rigid variable outside the telescope survives substitution but is not in scope in any legal definition of ?𝛼. ◻
For an equation ?𝛼[𝑥1,…,𝑥𝑘]≐?𝛼[𝑦1,…,𝑦𝑘], retain exactly those telescope positions 𝑖 for which 𝑥𝑖=𝑦𝑖, together with every earlier position on which the retained variables’ types and the result type depend. If dependency closure would retain a position with 𝑥𝑖≠𝑦𝑖, report the state outside the direct fragment. Otherwise create ?𝛽:[Δ′⊢𝐴′] and define both sides through ?𝛼:=[Δ]?𝛽[𝜋Δ′]. This rule is reached only after the heterogeneous type task has been solved. Consequently, if a result type itself mentions a mismatched actual parameter, its rigid type equation fails as unsatisfiable before flex–flex intersection. The outside outcome above concerns a dependency-closure failure that remains after the two occurrence types have converted. For distinct metavariables, retain the ordinary variables that occur in both argument lists, ordered as in the ambient context, and close that list under dependencies. Define each metavariable through one fresh ?𝛽 over the retained telescope, provided both declaration telescopes admit the required projections and the two result types are judgmentally equal after restriction. The fixed left-to-right order chooses the fresh name; it does not choose a value for it.
The metacontext operation is part of the rule. First take a dependency-preserving topological permutation that places all declarations needed by Δ′ and 𝐴′ before the target declaration or declarations. Insert ?𝛽 immediately before the earliest target, replace each target declaration by the displayed definition through ?𝛽, and substitute those definitions through every later declaration, definition, and constraint. Recheck the resulting suffix. If a target is a prerequisite of the fresh declaration, or if two targets cannot be brought to this position without reversing a dependency, the state is outside the direct fragment.
Thus ?𝛼[𝑥,𝑦]≐?𝛼[𝑧,𝑦], for pairwise distinct variables 𝑥,𝑦,𝑧, forces the result to ignore the first formal parameter and preserves dependence on the second. The equation ?𝛼[𝑥,𝑦]≐?𝛼[𝑥,𝑧] preserves the first formal parameter instead. A result type mentioning a discarded parameter prevents any restriction that would discard that parameter.
Proof. Induct on the normal form of 𝑏. The variable case is immediate when its type has no uniqueness rule. At Unit type the canonical form is ⋆, so the free-variable set is empty. At Sigma type eta-longness exposes a pair and the introduction argument below applies componentwise. An introduction applies the induction hypothesis to each normal component. A neutral has a rigid variable or constant head: rigid-head injectivity first identifies the heads and then identifies corresponding spine arguments, to which the induction hypotheses apply. Eta-longness covers function type without an extensionality principle. Recursive Unit normalization also removes a variable hidden in a contractible Sigma component. These cases exhaust normal Timpl terms under the conversion interface of convention 112.1. ◻
Let Δ𝛼⊢𝑏:𝐴𝛼 and Δ𝛽⊢𝑐:𝐴𝛽 be normal and eta-long. Suppose injective variable renamings from direct-pattern spines 𝜎:Γ→Δ𝛼 and 𝜏:Γ→Δ𝛽 satisfy 𝑏[𝜎]≡𝑐[𝜏]. If Δ′ is the dependency-closed telescope of ordinary variables occurring in both renaming images, and the result types agree after restriction, then there is a normal 𝑤 over Δ′ such that 𝑏≡𝑤[𝜋𝛼],𝑐≡𝑤[𝜋𝛽], where 𝜋𝛼,𝜋𝛽 are the dependency-preserving projections from the two declaration telescopes.
Proof of Lemma 112.22 — Common-support factorization
Proof. Normalize the common instance to 𝑛. Since substitution by a variable renaming preserves normality and free variables, FV(𝑛)=𝜎(FV(𝑏))=𝜏(FV(𝑐))⊆im(𝜎)∩im(𝜏). Replace those common images by the corresponding variables of Δ′; the resulting normal form is 𝑤. Injectivity of each pattern renaming and induction on normal forms give 𝑏≡𝑤[𝜋𝛼] and 𝑐≡𝑤[𝜋𝛽]. Dependency closure types every replacement, and the restricted result-type equality types the common residual body. This is the two-body form of lemma 112.21; it uses no choice of a value for the residual body. ◻
When the dependency-closure and metacontext-insertion tests succeed, (112.10) is a most general solution of the flex–flex equation. Every solution in the direct contextual-pattern fragment is independent of a mismatched position.
Proof. The two instantiated occurrences beta-reduce to the same application of ?𝛽, so the construction is a solution. For a self-equation, any solution supplies one normal body. Applying lemma 112.21 successively shows that body is independent of every mismatched position, so it factors through the projection to Δ′.
For distinct targets, let a solution assign normal bodies 𝑏𝛼 and 𝑏𝛽. Their instances have a common normal form because the solution satisfies the equation. By lemma 112.22, both bodies factor through one residual body 𝑤 over the dependency-closed intersection telescope. Instantiating the fresh ?𝛽 by 𝑤 therefore factors the arbitrary solution through the displayed pair of definitions. This proves most-generality for distinct as well as repeated metavariables. Dependency closure is necessary because removing a variable while retaining a type that mentions it would not form a telescope or a result type. The topological permutation preserves the earlier-than relation for every dependency edge. Weakening types ?𝛽 at its insertion point; replacing the targets and applying typed substitution to the suffix preserves the metacontext invariant. ◻
Let (L;M;C;U) be a finite, well-formed constraint state whose equation projection lies in the direct contextual-pattern fragment and whose initial and simplification-emitted level constraints form one stratified level problem. Formation guards are carried unchanged and are compiled after object substitution; their emitted level constraints join the same stratified problem. On the equation projection, the fixed object strategy weak-headsimplificationandreflexivedeletion,thenrigiddecomposition,immediatelevel-equalityorientationandsubstitutionwheneveremitted,thenflex--rigidassignment,thenflex--flexintersection. terminates. It returns an object-unsatisfiability certificate, the outcome outside, or the unique normalized equality-level substitution 𝜐=, a most general object substitution 𝜃 well typed in the 𝜐=-substituted state, and an accumulated residual bound problem B. Every successful step preserves solution pairs for the equation and level projection: if (𝜈,𝜎) solves that projection, then 𝜈 extends 𝜐=, satisfies B, and ?𝛼[𝜎]≡?𝛼[𝜃][𝜌] for every input metavariable, for some well-typed substitution 𝜌 on the remaining object metavariables; conversely every such 𝜈 and 𝜌 solves that projection. Each rejection from the object or equality-level pass certifies that its projection has no solution. The residual bound solver and final formation-guard compilation remain. Inputs or intermediate states that fail a direct-fragment test receive the distinct outcome outside, for which the theorem makes no completeness claim.
Proof of Theorem 112.24 — Terminating pattern simplification
Proof. Normalize only for the proof measure, and order states lexicographically by:
the number of unsolved equality-level metavariables;
the number of unsolved object metavariables;
the sum of the declaration-telescope lengths of unsolved object metavariables;
the total erased-subject size of the normalized equality tasks; and
the number of constraints.
Measure solver checkpoints immediately after weak-head simplification, but measure equality subjects by the size of their total normal forms. A heterogeneous constraint is counted as its active type-equality task together with its suspended term-equality task. Erase the ambient type annotation of each task and any declaration-signature material recovered by a head lookup. Thus comparing 𝑐𝑥 with 𝑐𝑦 counts the two applications, while the component comparison counts 𝑥 and 𝑦, not the possibly larger declared domain written beside them. This proof measure exists by the hypothesis in convention 112.1. The operational solver computes only weak-head forms for rigid classification, but computes a full canonical form immediately before a flex–rigid occurs, scope, or assignment test, as required by definition 112.18. Before head classification, normalized reflexive deletion removes constraints such as ?𝛼[𝑥]≐?𝛼[𝑥]. A flex–rigid assignment decreases the second component. A flex–flex intersection replaces one or two unknowns by one unknown over a proper smaller telescope, decreasing the second component or, for a self-equation, the third. Solving the type task of a heterogeneous constraint deletes that already-counted task and exposes its already-counted suspended term task. Every rigid decomposition replaces a normal constructor, type former, abstraction, or rigid neutral spine by proper normalized subject subexpressions and introduces only erased ambient annotations; it therefore decreases the fourth component. Deletion decreases the fourth or fifth component. An oriented universe equality decreases the first component before its substitution can enlarge a later task; a normalized rigid equality is deleted or rejected. Only after this pass does the suspended term task become active. The strategy forbids a step that leaves the state unchanged, so there is no infinite run.
Every step preserves the combined solution pairs and object most-generality by lemma 112.16, lemma 112.19, lemma 112.23. A terminal nonempty state cannot contain a rigid–rigid equation, because decomposition or rejection would apply. It cannot contain a flex–rigid or flex–flex pattern equation, because the corresponding assignment or a justified occurs or rigid scope failure would apply. Hence a nonfailed terminal state has no equations and its accumulated substitution is most general in the equality-substituted state. For example, U?ℓ≐U𝑢 first assigns ?ℓ:=𝑢 throughout the state, making a subsequent object assignment at U𝑢 genuinely well typed; U0≐U1 is rejected before any suspended term task is exposed. The bound phase of theorem 112.13 subsequently accepts or rejects B. Conversely each object rejection clause identifies a rigid-head clash, cyclic finite term, or rigid scope escape, none of which a direct contextual-pattern solution can repair. Every pruning, non-pattern, or metacontext-ordering failure was separated earlier as outside and is not used in this converse. ◻
★☆☆ Solve ?𝛼[𝑥,𝑦]≐(𝑥,𝗌𝗎𝖼(𝑥)):∑𝑛:ℕℕ, where ?𝛼:[𝑥:ℕ,𝑦:𝟐⊢∑𝑛:ℕℕ]. Write the contextual abstraction and verify its type. State why the unused argument 𝑦 does not violate the pattern condition.
★★☆ Let ?𝛼:[𝑥:ℕ,𝑦:ℕ⊢ℕ]. Compute the most general solutions of ?𝛼[𝑥,𝑦]≐?𝛼[𝑥,𝑧]and?𝛼[𝑥,𝑦]≐?𝛼[𝑧,𝑦]. Here 𝑥,𝑦,𝑧:ℕ are pairwise distinct. For each solution give the retained telescope. Then change the declared result type to 𝖵𝖾𝖼(ℕ,𝑦). Identify which equation the preliminary type task rejects, give the solver’s three-valued outcome, and say which intersection is still reached.
★★☆ For the one-base-type signature of (112.7), prove that [𝑥]𝑥 and [𝑥]𝑐 are incomparable unifiers and that no third unifier is more general than both. Then explain exactly why the flex–rigid proof of lemma 112.19 is unavailable.
Return to (112.1). The declaration is externally polymorphic in one level and implicitly polymorphic in its element type and indices: 𝖺𝗉𝗉𝖾𝗇𝖽:[𝑢]{𝐴:U𝑢}→{𝑚:ℕ}→{𝑛:ℕ}→𝖵𝖾𝖼(𝐴,𝑚)→𝖵𝖾𝖼(𝐴,𝑛)→𝖵𝖾𝖼(𝐴,𝑛+𝑚). The body is the vector eliminator term constructed in construction 78.5; the declaration contains no surface pattern clauses. The type-formation judgment establishes that the displayed product is a type; it does not assign that mixed-level product to an invented maximum universe.
Synthesis of 𝖺𝗉𝗉𝖾𝗇𝖽 returns (112.11). Before the written argument 𝑥𝑠, implicit saturation creates ?ℓ,?𝑋:[Γ𝖺𝗉𝗉⊢U?ℓ],?𝑝:[Γ𝖺𝗉𝗉⊢ℕ],?𝑞:[Γ𝖺𝗉𝗉⊢ℕ] and the core spine 𝖺𝗉𝗉𝖾𝗇𝖽[?ℓ]{?𝑋}{?𝑝}{?𝑞}. Checking 𝑥𝑠 against 𝖵𝖾𝖼(?𝑋,?𝑝) emits 𝖵𝖾𝖼(?𝑋,?𝑝)≐𝖵𝖾𝖼(𝐴,𝑚), whose rigid decomposition gives the heterogeneous element equation (?𝑋:U?ℓ)≐(𝐴:U𝑢)and?𝑝≐𝑚:ℕ. The type obligation of the element equation is U?ℓ≐U𝑢. Its universe-head comparison emits ?ℓ≐𝖫𝑢, whose normalized assignment is ?ℓ=𝑢. Checking 𝑦𝑠 then emits 𝖵𝖾𝖼(𝐴,?𝑞)≐𝖵𝖾𝖼(𝐴,𝑛), so ?𝑞≐𝑛. Substitution produces exactly 𝖺𝗉𝗉𝖾𝗇𝖽[𝑢]{𝐴}{𝑚}{𝑛}𝑥𝑠𝑦𝑠:𝖵𝖾𝖼(𝐴,𝑛+𝑚). Every unknown is fixed by a typed equation. No search branch and no constructor clause is involved.
An expected result can propagate information in the other direction. In the context 𝐴:U𝑢,𝑚:ℕ,𝑛:ℕ,𝑥𝑠:𝖵𝖾𝖼(𝐴,𝑚), checking 𝖺𝗉𝗉𝖾𝗇𝖽𝑥𝑠_ against 𝖵𝖾𝖼(𝐴,𝑛+𝑚) fixes the second hole at 𝖵𝖾𝖼(𝐴,𝑛). Without the expected result, the hole still has a contextual type after the first argument, but its index metavariable remains unsolved until another constraint mentions it.
Soundness and the exact completeness claim
A solver may stop with constraints or with unsolved metavariables. Neither state is a successful elaboration.
it starts in a metavariable-free object context, every generated object equation lies in the direct contextual-pattern fragment and the solver returns a well-typed substitution;
after object substitution, every formation guard compiles without a flexible-head obstruction, and every universe constraint generated initially, emitted while simplifying object constraints, or emitted by guard compilation belongs to one stratified level problem; its equality stratum is solved and substituted before the bound solver returns a solution of the accumulated residue; and
applying both solutions leaves no metavariable in the returned context, type, or term.
Before exposing a solved result, an implementation also submits the completed annotation certificate defined below to the independent rechecker. Kernel rejection is an implementation failure, not an additional constraint-solver condition.
Let a synthesis or checking generation judgment return the core preterm 𝑎 at synthesized or supplied type 𝐴, satisfy the hypotheses of lemma 112.8, and let (𝜐;𝜃) solve its generated constraints. Then Γ[𝜐][𝜃]⊢𝑎[𝜐][𝜃]:𝐴[𝜐][𝜃]. For the third generation judgment, the corresponding conclusion is Γ[𝜐][𝜃]⊢𝐴′[𝜐][𝜃]𝗍𝗒𝗉𝖾.
Proof of Theorem 112.26 — Constraint-generation soundness
Proof. Apply (𝜐;𝜃) to the simultaneous induction proving lemma 112.8. Each conditional equation becomes a Timpl judgmental equality, so conversion discharges it. The application case deserves inspection. An inserted argument has its exposed domain by the contextual declaration, and substitution gives the instantiated codomain; Π-elimination therefore types the extended spine. An explicit argument is typed by the checking induction hypothesis. Repeating these two steps types the whole application.
In the expected-lambda case, weak-head inversion gives 𝐴≡∏𝜖,𝜚𝑥:𝐵𝐶. The induction hypothesis types the body at 𝐶, Π-introduction types the abstraction at the product, and conversion gives type 𝐴. Pair, constructor, vector-eliminator, and identity-eliminator cases apply their displayed Timpl rules. Universe solutions instantiate only rule indices, and theorem 112.13 shows that every required strict equality and formation inequality holds. The type-formation cases apply the fixed Timpl formation rules directly after their generated constraints are solved. In E-Ty-Vec, the validated formation guard is exactly the element-universe premise of Vec-form; it may have been produced by recursively elaborating a binding type former. ◻
Use exactly the three ordered recursive functions 𝑅𝗍𝗒,𝑅𝗌𝗒𝗇,𝑅𝖼𝗁𝗄 and their exhaustive clause table in definition 110.22. No extension is implicit: that table contains every recognized full-Timpl head. A type with no direct 𝑅𝗍𝗒 head—in particular a strict-lift type—is emitted as an annotated universe element, then checked by Syn-Ann and decoded by Ty-El. A solved elaboration emits the table’s surface syntax with all holes replaced, every contextual metavariable instantiated, all external levels normalized, and every motive, parameter, index, explicitness bit, and relevance bit stored.
Certificate acceptance is therefore the exact algorithm of definition 110.22: recheck the stored surface certificate for the claimed type, run 𝑅𝖼𝗁𝗄 at that type, and compare the returned core term with the claim up to alpha-equivalence. Level equality is strict normalized equality; the only bounds checked inside this table are the strict premises printed in Chk-Code-Univ and Chk-Code-Lift. Every other elaboration-time formation guard must be discharged before the certificate is emitted. No clause inserts an argument, solves a metavariable, reconstructs a motive, or accepts by erasure.
From a metavariable-free derivation 𝐷:Γ⊢𝑎:𝐴, including its presupposed formation derivation 𝐷𝐴:Γ⊢𝐴𝗍𝗒𝗉𝖾, one can compute a fully annotated Timpl certificate. Namely, put 𝜏𝐷:=annTy(𝐷𝐴) and 𝑒𝐷:=ann(𝐷); then (Γ,𝜏𝐷,𝑒𝐷,𝐴,𝑎) is accepted by the independent annotation rechecker of definition 112.27.
Proof of Lemma 112.28 — Timpl certificate completion
Proof. Translate 𝐷𝐴 and 𝐷 to the economical structural presentation and induct simultaneously, defining annTy and ann in the same recursion. The following list is exhaustive and names the selected rechecker clause.
proper typing premise wrapped in its inferred-type annotation; claimed type
Syn-Ann, then Chk-Conv
For each row, the induction hypotheses reconstruct every premise printed in the named clause; applying that clause returns the same core node and result type. In the conversion row, if the proper typing premise returns 𝑎:𝐶, ann emits (𝑒𝐷:annTy(𝐷𝐶)). Rule Syn-Ann therefore synthesizes 𝐶 even when 𝑒𝐷 has an introduction head, after which Chk-Conv compares 𝐶 with the claimed type. The rechecker never falls through from a failed recognized introduction clause. The type-formation induction uses, respectively, Ty-Pi, Ty-Sg, Ty-Id, the three Ty base clauses, Ty-Vec, Ty-Univ, or Ty-El. Universe-code formation uses the corresponding one of the nine Chk-Code clauses. Strict normalized comparison checks all stored levels and formation bounds; unPiMeta checks both metadata bits. These cases exhaust the fixed Timpl rule card. Erasure of ann(𝐷) is 𝑎, so the final alpha-comparison succeeds and the certificate is accepted. ◻
If 𝑒 has a solved elaboration 𝑎:𝐴 in Γ, then Γ⊢𝑎:𝐴 is derivable in Timpl and its completed annotation certificate is accepted by the independent rechecker. Surface holes, implicit arguments, and level metavariables add nothing to the trusted core.
Proof. Apply theorem 112.26 to the well-typed solutions returned by the two solvers. Because the input context is metavariable free and the solved result contains no metavariables, Γ[𝜐][𝜃]=Γ. Apply lemma 112.28 to the resulting derivation. The independent acceptance is therefore a computed consequence, not an appeal to the elaborator’s internal derivation object. ◻
Completeness requires a search policy, not merely a surface grammar.
Let 𝐷 contain the metavariables reachable from a generated state’s returned term and type after equality-level substitution. Write 𝑑:𝐷→{0,…,|𝐷|−1} for a strict ranking. A ground-determination certificate is a strict ranking 𝑑 such that, for every ?𝛼∈𝐷, after substituting the assignments of lower rank the state contains a direct flex–rigid equation ?𝛼[𝑥1,…,𝑥𝑘]≐𝑡:𝐴 whose right side contains only rigid syntax and lower-ranked metavariables, passes the occurs, scope, typing, and static-pattern tests, and therefore has the unique assignment [𝑥1,…,𝑥𝑘]𝑡. The dependency slice used by the certificate contains no flex–flex equation and introduces no fresh metavariable; states that require intersection or pruning are outside this decidable policy. No member of 𝐷 may be discharged by generalization. This finite certificate is checked from equations and ranks; it does not presuppose that the elaboration algorithm has succeeded. Here reachable means membership in the least set containing the object metavariables free in the returned term and type and closed under object metavariables in their declared types and bodies, in both sides and the type of every generated object equation, and in the guarded type of every formation guard.
A generation run for a surface term is policy-aligned when:
every introduction in synthesis position has an annotation;
implicit saturation stops at the first explicit binder and never inserts an explicit argument;
every generated object equation remains in the direct contextual-pattern fragment after substitution and weak-head simplification;
every level constraint generated initially, emitted while simplifying object constraints, or emitted by formation-guard compilation belongs to definition 112.12, and each strict equality is oriented and substituted before dependent object simplification continues; and
the returned slice has a ground-determination certificate in the sense of definition 112.30.
A policy-respecting elaboration is a derivation of the mutually inductive term and type relations Γ⊢𝑒⇝𝖯𝑎:𝐴andΓ⊢𝐴⇝𝗍𝗒𝗉𝖾𝖯𝐴′, with the auxiliary spine relation Γ⊢(𝑎:𝐴)@⃗𝑞⇝𝖯𝑏:𝐵. The following displayed schemas are the complete definition.
𝑥:𝐴∈Γ
Γ⊢𝑥⇝𝖯𝑥:𝐴
P-Var
𝑐[⃗ℓ]:𝐴isafullyinstantiatedsignatureatom
Γ⊢𝑐[⃗ℓ]⇝𝖯𝑐[⃗ℓ]:𝐴
P-Atom
Γ⊢𝑎:𝐴𝑎,𝐴containnometavariables
Γ⊢_⇝𝖯𝑎:𝐴
P-Hole
Γ⊢𝐴⇝𝗍𝗒𝗉𝖾𝖯𝐴′Γ⊢𝑒⇝𝖯𝑎:𝐴′
Γ⊢(𝑒:𝐴)⇝𝖯𝑎:𝐴′
P-Ann
Γ⊢𝐵𝗍𝗒𝗉𝖾Γ,𝑥:𝐵⊢𝐶𝗍𝗒𝗉𝖾Γ,𝑥:𝐵⊢𝑒⇝𝖯𝑏:𝐶
Γ⊢𝜆𝜖,𝜚𝑥.𝑒⇝𝖯𝜆𝜖,𝜚(𝑥:𝐵).𝑏:∏𝜖,𝜚𝑥:𝐵𝐶
P-Lam
Γ⊢𝐵𝗍𝗒𝗉𝖾Γ,𝑥:𝐵⊢𝐶𝗍𝗒𝗉𝖾Γ⊢𝑒0⇝𝖯𝑎:𝐵Γ⊢𝑒1⇝𝖯𝑏:𝐶[𝑎/𝑥]
Γ⊢(𝑒0,𝑒1)⇝𝖯(𝑎,𝑏):∑𝑥:𝐵𝐶
P-Pair
Rules P-Lam and P-Pair are the two genuinely checking-directed introductions. They display the expected type that generation weak-head inverts, copy the product metadata, and substitute the first pair component into the second component’s type. Atoms and every declared constructor or eliminator instead use P-Atom or the exact signature-head relation below; there is no duplicate introduction route. Type formation belongs to the separate relation below; it is not a term introduction into a guessed common universe.
For a surface vector level, 𝗅𝖾𝗏𝖾𝗅𝖯(̂ℓ)=ℓ copies a written level and, when the level is omitted, selects the metavariable-free formation witness stored by the candidate elaboration. The type relation for this policy is exactly:
𝑒≢_Γ⊢𝑒⇝𝖯𝑎:𝑇𝗐𝗁𝗇𝖿(𝑇)=U𝑢
Γ⊢𝑒⇝𝗍𝗒𝗉𝖾𝖯𝑎
P-Ty-El
𝑝isawell-formedlevelexpression
Γ⊢U𝑝⇝𝗍𝗒𝗉𝖾𝖯U𝑝
P-Ty-Univ
𝐷∈{𝟏,𝟐,ℕ}
Γ⊢𝐷⇝𝗍𝗒𝗉𝖾𝖯𝐷
P-Ty-Base
Γ⊢𝐴⇝𝗍𝗒𝗉𝖾𝖯𝐴′Γ⊢𝑒0⇝𝖯𝑎0:𝐴′Γ⊢𝑒1⇝𝖯𝑎1:𝐴′
Γ⊢𝖨𝖽𝐴(𝑒0,𝑒1)⇝𝗍𝗒𝗉𝖾𝖯𝖨𝖽𝐴′(𝑎0,𝑎1)
P-Ty-Id
𝗅𝖾𝗏𝖾𝗅𝖯(̂ℓ)=ℓΓ⊢𝐴⇝𝗍𝗒𝗉𝖾𝖯𝐴′Γ⊢𝐴′:UℓΓ⊢𝑛⇝𝖯𝑛′:ℕ
Γ⊢𝖵𝖾𝖼[̂ℓ](𝐴,𝑛)⇝𝗍𝗒𝗉𝖾𝖯𝖵𝖾𝖼(𝐴′,𝑛′)
P-Ty-Vec
Γ⊢𝐴⇝𝗍𝗒𝗉𝖾𝖯𝐴′Γ,𝑥:𝐴′⊢𝐵⇝𝗍𝗒𝗉𝖾𝖯𝐵′
Γ⊢∏𝜖,𝜚𝑥:𝐴𝐵⇝𝗍𝗒𝗉𝖾𝖯∏𝜖,𝜚𝑥:𝐴′𝐵′
P-Ty-Pi
Γ⊢𝐴⇝𝗍𝗒𝗉𝖾𝖯𝐴′Γ,𝑥:𝐴′⊢𝐵⇝𝗍𝗒𝗉𝖾𝖯𝐵′
Γ⊢∑𝑥:𝐴𝐵⇝𝗍𝗒𝗉𝖾𝖯∑𝑥:𝐴′𝐵′
P-Ty-Sigma
There is deliberately no P-Ty-Hole. Rule E-Ty-Hole remains part of general constraint generation, but its fresh universe may remain ambiguous, and a mixed-level type need not inhabit any universe at all. The decidable completeness policy therefore requires written annotation types; it still admits explicit mixed-level Π- and Σ-types through P-Ty-Pi/P-Ty-Sigma. The syntactic side condition on P-Ty-El prevents the term-hole rule from reconstructing a whole omitted type by a second route. Rule P-Ty-Vec separately records the particular universe membership required by vector formation, including an omitted vector level determined by guard compilation.
Ordinary applications have no alternative insertion choice:
The remaining rule is indexed by the same finite signature telescope as E-Syn-Head. For the external-level telescope of ℎ, define 𝗅𝖾𝗏𝖾𝗅𝗌ℎ,𝖯(⃗̂ℓ)=⃗ℓ positionwise: copy a written level exactly, and at an omitted position select the metavariable-free level witness stored by the candidate elaboration.
The auxiliary head judgment has exactly the three telescope clauses E-Head-Done, E-Head-Infer, and E-Head-Write, replacing each generation premise by ⇝𝖯 and replacing each inferred metavariable by its stored metavariable-free core witness. In particular, there is still no omission clause for a written motive. This completes the inductive policy relation and fixes every implicit, external-level, binder, and motive choice used by the completeness proof.
Let the generation run for 𝑒 be policy-aligned in a well-formed Timpl context Γ. If a metavariable-free, policy-respecting elaboration 𝑎:𝐴 exists, the algorithm of this chapter succeeds. Its object substitution is at least as general as the object substitution induced by 𝑎, while its residual bound-level assignment is pointwise least among all valid assignments. If the external level arguments of 𝑎 use that least assignment, the returned core term instantiates in its remaining object metavariables to a term judgmentally equal to 𝑎:𝐴.
Proof of Theorem 112.32 — Completeness for the decidable policy
Proof. Induct on the policy-respecting elaboration. At variables, atoms, signature heads, and annotations, generation chooses the same unique rule. In P-Lam and P-Pair, item 1 gives the displayed expected type needed to select the checking rule. At an application, item 2 fixes the number of inserted binders; the kernel term 𝑎 supplies a solution of every emitted domain equation. Constructor and eliminator cases follow their fixed surface heads, and motives are written inputs.
The induction is simultaneous over the term, type, and spine relations. The type cases are E-Ty-El, E-Ty-Base, E-Ty-Hole, E-Ty-Univ, E-Ty-Pi, E-Ty-Sigma, E-Ty-Id, and E-Ty-Vec; in particular an annotation first generates and solves the constraints of its surface type, and vector formation uses the stored level witness. It constructs a solution of the generated combined constraint state from 𝑎. By item 3 and theorem 112.24, the object solver cannot reject a solvable direct-pattern state. Its equality-level pass supplies the unique normalized level substitution before its most general, genuinely typed object substitution, and leaves the accumulated formation bounds. The simultaneous type induction shows that every carried formation guard normalizes under that substitution and that its compiled level premises are satisfied by the candidate. By item 4 and theorem 112.13, the equality and bound phases therefore accept the enlarged residue and return the pointwise least bound assignment. This is an order statement about natural levels, not an instantiation statement: for example, level 0 does not instantiate to level 1. For item 5, induction on the certificate rank assigns each reachable metavariable: lower ranks have already been substituted, and the certified direct flex–rigid equation triggers definition 112.18. The policy excludes flex–flex creation on this slice, so the ranking is defined on every metavariable it mentions. Thus no returned metavariable remains. Object most-generality and level leastness therefore remain separate conclusions. When 𝑎 uses the least bound assignment, applying the object-factorization result to the returned preterm gives a core term judgmentally equal to 𝑎, and corollary 112.29 supplies the kernel judgment. ◻
The theorem does not claim completeness for Timpl surface programming as a whole. It excludes non-pattern higher-order equations, recursive clauses, coercion search, overloading, type classes, tactics, and any heuristic that postpones or backtracks over constraints. It also excludes a fully implicit declaration whose unsolved metavariables a production assistant might choose to generalize.
The surface term 𝗏𝗇𝗂𝗅 in synthesis position inserts an element-type metavariable and a level metavariable but generates no equation fixing either. Accepting it would require an unannounced choice of 𝐴 and 𝑢, so item 3 of definition 112.25 leaves it unsolved and therefore rejects it. Either repair is explicit: (𝗏𝗇𝗂𝗅:𝖵𝖾𝖼[0](ℕ,𝟢))or𝗏𝗇𝗂𝗅⇐𝖵𝖾𝖼(𝐴,𝟢). The first writes the external level and synthesizes a closed vector type; the second uses an already formed expected type with its level fixed by the surrounding judgment. Neither changes the kernel rule for 𝗏𝗇𝗂𝗅.
★☆☆ For each of 𝗏𝗇𝗂𝗅, 𝜆𝑥.𝑥, and (𝟢,_), state whether it synthesizes, checks only against an expected type, or remains ambiguous even while checking. Give one minimal annotation, expected type, or explicit filling of a remaining term hole that repairs every rejected case.
Dynamic higher-order patterns. A constraint that is not presently a pattern can become one after another metavariable is assigned. Treating this observation as unrestricted postponement is unsafe. The terminating simplifier needs a placeholder that records an argument known to be unavailable, and it treats pruning followed by assignment as one indivisible decrease.
For this development only, use Reed’s canonical LF-like language. Its terms are beta-normal and eta-long, hereditary substitution keeps them canonical, and all expressions are well typed after dependencies are erased and every Π is read as an arrow. The relevant grammar is 𝐾::=𝗍𝗒𝗉𝖾∣Π𝑥:𝐴.𝐾,𝐴,𝐵::=𝑎⋅𝑆∣Π𝑥:𝐴.𝐵,𝑀,𝑁::=𝜆𝑥.𝑀∣𝑅∣◻,𝑅::=𝐻⋅𝑆∣𝑢[𝜎],𝐻::=𝑐∣𝑥∣𝑚,𝑆::=()∣(𝑀;𝑆),𝜎::=⋅∣𝜎,(𝑦/𝑥)∣𝜎,(𝑀/𝑥). Here 𝑢::(Ψ⊢𝑎⋅𝑆) is a contextual metavariable lowered to base type, 𝑢[𝜎] suspends a substitution for its local context, and 𝑚 is a modal free head that is never instantiated. The placeholder ◻ marks an argument that every solution must project away; the book’s postfix substitution convention prints its propagation as ◻[𝑀/𝑥]=◻, while hereditary application gives [◻∣𝑆]=◻. The brackets in 𝑢[𝜎] remain an inert suspension, not that postfix action.
A problem state is failure ⊥, or a modal context Δ together with a finite conjunction 𝑃 of normal-term, atomic-term, or spine equations, tentative equations 𝑢≐𝑅, and solved assignments 𝑢←𝑅. A metavariable is active when no assignment 𝑢←𝑅 occurs in 𝑃. A ground modal substitution solves 𝑃 when it makes every equation syntactically equal, respects every solved assignment, and its images contain no placeholder.
A pattern substitution𝜌 sends local variables to distinct bound variables or to ◻; it is strong, written 𝜉, when it contains no placeholder. The inverse 𝜉−1 sends a local variable back to its unique preimage and sends a variable outside the range to ◻. The operation 𝜉∩𝗂𝖽 retains identity components and replaces every nonidentity component by ◻. If (◻/𝑥)∈𝜌, then 𝜌∖𝑥 is the identity substitution on dom(𝜌)∖{𝑥}, not merely 𝜌 with one component erased.
The placeholder is semantic information, not a hole to be solved. For example, inversion across a strong pattern may replace a variable outside its range by ◻; a ground solution is then permitted only if a later projection removes that occurrence.
Write ̂𝑋{𝑌} for an expression context with the displayed occurrence 𝑌, ̂𝑋𝗋𝗂𝗀{𝑌} when the occurrence is outside every metavariable suspension, and ̂𝑋𝗌𝗋𝗂𝗀{𝑌} when it is also outside arguments to a bound-variable head. Reed’s simplifier nondeterministically uses exactly the following categories; a transition that leaves the state unchanged is forbidden.
Decomposition. Strip equal lambdas, equal rigid heads, and one pair of spine arguments; delete empty-spine equations. Distinct rigid heads fail. A placeholder in a rigid expression context fails: 𝜆𝑥.𝑀≐𝜆𝑥.𝑁isreplacedby𝑀≐𝑁,𝐻⋅𝑆≐𝐻⋅𝑆′isreplacedby𝑆≐𝑆′,𝐻⋅𝑆≐𝐻′⋅𝑆′isreplacedby⊥(𝐻≠𝐻′),(𝑀;𝑆)≐(𝑁;𝑆′)isreplacedby(𝑀≐𝑁)∧(𝑆≐𝑆′),̂𝑄𝗋𝗂𝗀{◻}isreplacedby⊥.
Inversion. For strong 𝜉, 𝑢[𝜉]≐𝑅isreplacedby𝑢≐𝑅[𝜉−1].
Occurs check. A self-occurrence under a strong pattern is replaceable by a placeholder only where the eventual solution must project it away; a strongly rigid occurrence below a constant is impossible: 𝑢≐𝐻⋅̂𝑆{𝑢[𝜉]}isreplacedby𝑢≐𝐻⋅̂𝑆{◻},𝑢≐𝑐⋅̂𝑆𝗌𝗋𝗂𝗀{𝑢[𝜎]}isreplacedby⊥.
Intersection. Replace 𝑢≐𝑢[𝜉] by 𝑢≐𝑢[𝜉∩𝗂𝖽], or delete it when 𝜉∩𝗂𝖽=𝜉.
Pruning. Suppose 𝑢[𝜌] occurs rigidly in an equation, (◻/𝑥)∈𝜌, and removing 𝑥 leaves a defined declaration (Γ⊢𝐴)∖𝑥: 𝑥 is absent from 𝐴 and from the types of the retained context. Introduce fresh 𝑣::((Γ⊢𝐴)∖𝑥) by replacing Δ,𝑢::(Γ⊢𝐴)⊢̂𝑄𝗋𝗂𝗀{𝑢[𝜌]}∧𝑃byΔ,𝑢::(Γ⊢𝐴),𝑣::((Γ⊢𝐴)∖𝑥)⊢(𝑢≐𝑣[𝜌∖𝑥])∧̂𝑄𝗋𝗂𝗀{𝑢[𝜌]}∧𝑃. Retain the equation containing the rigid occurrence. Instantiation of this fresh equation must occur immediately; no other transition may intervene.
Instantiation. If 𝑢∉𝖥𝖵(𝑅), replace (Δ⊢(𝑢≐𝑅)∧𝑃)by(Δ[𝑅/𝑢]⊢(𝑢←𝑅)∧𝑃[𝑅/𝑢]), using hereditary modal substitution in the context and all constraints.
Success means that only placeholder-free assignments remain. A state to which no category applies is stuck; it is not identified with either success or failure.
Pruning and its forced instantiation are one macro-transition for purposes of termination. The new 𝑣 has a strictly smaller local context than 𝑢, and the old 𝑢 becomes assigned immediately. Merely introducing 𝑣 would not decrease the number of active metavariables.
For a finite, well-formed problem in the language of definition 112.34, every transition sequence satisfying the pruning discipline terminates in a solved state, a stuck state, or failure. Every step preserves the set of ground solutions on the metavariables present before that step, and preserves well-formedness modulo that state’s residual problem. Consequently a solved final state induces a well-typed most general unifier of the initial problem.
Proof of Theorem 112.36 — Reed simplification: exact boundary
Proof. A term-size-only argument is unavailable. Instantiation may enlarge the surviving equations, while pruning introduces a fresh metavariable and an equation; without the forced following instantiation, the older pruning rule can reproduce its input up to renaming. The decreasing quantity must therefore put active declarations before syntax size.
Order states lexicographically by ⎛⎜
⎜
⎜
⎜
⎜
⎜
⎜⎝numberofactivemetavariables,sumoftheirlocal-contextsizes,totalsizeofalltermsinallequations⎞⎟
⎟
⎟
⎟
⎟
⎟
⎟⎠, where ◻ is smaller than every ordinary term. Instantiation strictly decreases the first component. A pruning–instantiation macro-step keeps the first component fixed and strictly decreases the second. Decomposition, inversion, occurs-check replacement, and a changing intersection preserve the first two components and strictly decrease the third. The no-op prohibition excludes equality of measures. Lexicographic order on three natural numbers is well founded, so every sequence terminates.
For solution preservation, decomposition uses injectivity and congruence of canonical syntax. A strong pattern substitution is injective and its inverse is a left inverse on expressions using only variables in its range, which proves inversion in both directions. In the first occurs case, a retained self-occurrence would make a finite solution a proper subterm of itself, so every solution must project it away and may replace it by ◻; in the strongly rigid constant case projection is unavailable, so repeated unfolding would create arbitrarily many occurrences of the constant. Intersection removes exactly the variables not fixed by the renaming. In a rigid occurrence, a placeholder argument cannot survive, so any solution of a pruning premise is independent of 𝑥; it therefore factors through the fresh smaller-context 𝑣. Instantiation is ordinary hereditary substitution and its occurs side condition prevents a cyclic definition. These arguments give equality of solution sets on the old metavariables.
Dependent well-formedness is stated modulo all equations in the residual state: two types are equivalent when every ground solution makes them syntactically equal. When decomposition compares two spine arguments, the two spine tails may initially have types containing those different arguments; their enclosing equation makes the types equal modulo the residual problem, which transports both tail typings to one type before the new equation is formed. For terms containing ◻, a completion replaces each placeholder by a well-typed normal term. Inversion completes an out-of-range variable with a fresh contextual metavariable of the required type; the other rules transport typing by hereditary substitution. Hence every transition preserves this well-formedness invariant. In a solved state, solution preservation says that every original solution is an instance of the displayed assignments, which is the MGU factorization claim. ◻
The theorem applies to canonical LF in spine form with contextual modal substitutions, approximate simple typing, hereditary substitution, placeholders, and non-instantiable modal free heads. It does not assert that every solvable problem reaches a solved state: a run may terminate stuck. Reed also permits cyclic dependencies among modal declarations during simplification; an application that requires an acyclic final context must perform a separate cycle check after simplification.
Timpl does not have the signature of definition 112.34. Its metavariables may inhabit general dependent types rather than Reed’s lowered base types; its definitional equality includes the Timpl computation rules rather than canonical LF hereditary substitution; and its elaboration state also contains universe equalities and bounds. Identity eliminators, vector indices, and universe normalization may expose or generate constraints not belonging to any category of definition 112.35. Moreover, elaboration itself may create new metavariables and equations, whereas Reed’s termination measure starts from one fixed finite problem.
An extension theorem would therefore have to give a translation or new transition category for every Timpl constraint, prove preservation of scoped typing and problem-relative solutions, and extend the lexicographic measure so that Timpl reduction, level solving, and constraint generation decrease it. Without those proofs, Reed’s theorem justifies the displayed LF-like dynamic pattern subsolver and no termination, completeness, or principality claim for the full Timpl elaborator.
This card is separate from Timpl. Its surface language has ordinary and implicit dependent products, abstractions, and applications. Its extended Martin–Löf core adds a type 𝖳𝖾𝗅 of telescopes, the empty telescope 𝜀, extension (𝑥:𝐴)▹¯𝐵, and a record type 𝖱𝖾𝖼(¯𝐴) of simultaneous arguments. For ¯𝐴:𝖳𝖾𝗅 and 𝐵:𝖱𝖾𝖼(¯𝐴)→U, the strictly curried type, abstraction, and application are written {𝑥:¯𝐴}→𝐵,𝜆{𝑥:¯𝐴}.𝑡,𝑡{𝑢:¯𝐴}. They compute by the telescope equations {𝑥:𝜀}→𝐵≡𝐵[[]/𝑥],{𝑥:(𝑦:𝐴)▹¯𝐵}→𝐶≡{𝑦:𝐴}→{𝑏:¯𝐵}→𝐶[(𝑦::𝑏)/𝑥], with the corresponding abstraction and application equations. Thus a meta-headed telescope represents an unknown number of leading implicit domains without changing the surface syntax. The core of this card uses a Russell type-in-type universe; it is not Timpl’s stratified hierarchy.
The obstruction is already present in polymorphic lists. Fix 𝖫𝗂𝗌𝗍:U→U,𝗇𝗂𝗅:{𝐴:U}→𝖫𝗂𝗌𝗍(𝐴),𝖼𝗈𝗇𝗌:{𝐴:U}→𝐴→𝖫𝗂𝗌𝗍(𝐴)→𝖫𝗂𝗌𝗍(𝐴). Check 𝖼𝗈𝗇𝗌(𝜆𝑥.𝑥)𝗇𝗂𝗅 against 𝖫𝗂𝗌𝗍({𝐴:U}→𝐴→𝐴). The ordinary bidirectional pass first checks 𝜆𝑥.𝑥 against a meta-headed expected type. Committing there to the explicit type ?𝐴→?𝐴 makes 𝗇𝗂𝗅 instantiate at that same type, so the final constraint tries to identify {𝐴:U}→𝐴→𝐴 with an explicit arrow and fails. The failure is not missing ordinary implicit-application insertion: that insertion has already supplied fresh arguments to 𝖼𝗈𝗇𝗌 and 𝗇𝗂𝗅. It is the earlier, irreversible choice not to insert an implicit abstraction.
In the card of convention 112.38, retain the ordinary insertion rule: when inference exposes 𝑡:{𝑥:𝐴}→𝐵 and the surface spine has no written implicit argument, insert a fresh ?𝑢:𝐴 and continue from 𝑡{?𝑢}:𝐵[?𝑢/𝑥].
Add one checking clause for a meta-headed expected type ?𝛼[¯𝑢]. Create a fresh telescope metavariable ?Δ:𝖳𝖾𝗅, extend the local context by 𝑥:𝖱𝖾𝖼(?Δ), infer the source term there, and run the ordinary implicit-application insertion just described, obtaining 𝑡′:𝐵. Add the source algorithm’s constancy constraint that records whether 𝐵 depends on 𝑥, unify ?𝛼[¯𝑢]≐{𝑥:?Δ}→𝐵, and return 𝜆{𝑥:?Δ}.𝑡′. If the codomain is independent of 𝑥, the constancy constraint solves ?Δ with 𝜀, so the wrapper computes away. In the polymorphic-list trace, unification instead solves the telescope with the one-entry domain (𝐴:U)▹𝜀, and the inserted wrapper becomes the required implicit abstraction.
For the surface and core languages frozen in convention 112.38, Kovács’s checking and inference functions have the following proved consequences.
Every returned checking or inference result satisfies its specified core typing judgment.
Erasing a returned core term yields its input surface term with holes filled and only implicit abstractions and applications inserted; the delayed strictly curried wrapper is included among those inserted abstractions.
The source proves no elaboration completeness theorem. Its functions are partial and may fail or diverge because the chosen core has type-in-type. Curried-application insertion for inferring polymorphic arguments is only the future-work sketch of Section 7.3; it is not covered by the two consequences and is not part of either proved algorithm.
Proof of Proposition 112.40 — Soundness and erasure of the source elaborator
Proof. We prove both items simultaneously. For every successful recursive call keep two invariants. First, if the input metacontext is Θ0, the returned metasubstitution has type 𝜃:Θ′⇒Θ0 and the returned core term is typed after applying 𝜃 to the input context. Second, if |−| forgets core annotations and erases implicit applications and implicit or strictly curried abstractions, then |𝑡′| is the input surface term with each surface hole replaced by the erasure of its returned solution. We establish the invariants by mutual structural induction on the checking and inference calls, with an inner induction on insertion.
The auxiliary operations preserve the first invariant. Ordinary substitution preserves core typing. Functoriality of metasubstitution gives 𝑢[𝜃1][𝜃2]=𝑢[𝜃1∘𝜃2], so the substitution thread printed by a later recursive call has the required source and target. The specification of 𝖿𝗋𝖾𝗌𝗁𝖬𝖾𝗍𝖺Θ∣Γ(𝐴) extends Θ by ?𝛼:Γ⇒𝐴, returns weakening 𝑝:(Θ,?𝛼:Γ⇒𝐴)⇒Θ, and types ?𝛼𝗏𝖺𝗋𝗌Γ:𝐴[𝑝]. Successful unification returns 𝜃 with 𝐴[𝜃]≡𝐵[𝜃]; conversion therefore changes the inferred type to the expected type. These four facts prove every use of substitution, 𝖿𝗋𝖾𝗌𝗁𝖬𝖾𝗍𝖺, and 𝗎𝗇𝗂𝖿𝗒 below.
For insertion, suppose the input is 𝑡:{𝑥:𝐴}→𝐵. Freshness gives 𝑢:𝐴; implicit application gives 𝑡{𝑢}:𝐵[𝑢/𝑥], and the inner induction applies to the residual result. The non-product clause returns its typed input. The guarded clause for an implicit abstraction also returns its input. Hence insertion preserves typing. Its only syntactic change is an implicit application, so it preserves the erasure invariant.
We now inspect the surface constructors. A variable is typed by lookup, and the universe is typed by the source’s type-in-type rule; both erase to themselves. For an explicit or implicit product, the two checking induction hypotheses type the domain and codomain at the universe; product formation types the returned core product. For an explicit or implicit application, the inference hypothesis types the head, insertion preserves that typing, two fresh universe-valued metavariables supply a prospective domain and codomain, and unification converts the head type to the corresponding product. The checking hypothesis types the argument at the converted domain, so application has the substituted codomain. The erasure calculation is |𝑡′{¯𝑢}𝑢′|=|𝑡′||𝑢′|=𝑡𝑢; for a written implicit application the retained brace distinguishes the written application from applications created by insertion.
For an abstraction checked against a matching product, the checking induction hypothesis types its body in the extended context and product introduction types the wrapper. For an inferred abstraction, freshness types its domain, the inference hypothesis and insertion type its body, and product introduction gives the returned type. The inserted implicit-wrapper checking clause for a non-abstraction is the same argument without changing the surface syntax: erasure removes the fresh wrapper. A let-expression uses the three induction hypotheses for its annotation, definition, and body; metasubstitution composition aligns their successively transformed contexts, and the core let rule types the result. Erasure distributes through let. A checking hole is exactly the term returned by 𝖿𝗋𝖾𝗌𝗁𝖬𝖾𝗍𝖺; an inferred hole first creates its fresh type and then its fresh inhabitant. Thus both are typed and their erasures are permitted hole fillings. The fallback checking clause combines the inference invariant, insertion lemma, and unification conversion, and changes no surface constructor.
It remains to check the delayed clause of definition 112.39. Freshness types ?Δ:𝖳𝖾𝗅. By the inference and insertion invariants, 𝑡′:𝐵 in Γ,𝑥:𝖱𝖾𝖼(?Δ). The constancy declaration only restricts later metasubstitutions and leaves that judgment valid. Strictly curried introduction therefore gives 𝜆{𝑥:?Δ}.𝑡′:{𝑥:?Δ}→𝐵; successful unification converts this type to ?𝛼[¯𝑢]. Its erasure is |𝑡′|, because the wrapper was inserted rather than written. These cases exhaust the checking, inference, insertion, and delayed clauses, proving both items.
No induction just given supplies a successful run for a typable surface term: it starts from a successful call. Nor does it prove termination of normalization or unification in the type-in-type core. Curried-application insertion is absent from the inspected clauses. The three excluded claims therefore do not follow. ◻
A polymorphically recursive constraint.
Take the indexed nesting signature 𝗇𝗂𝗅:𝖭𝖾𝗌𝗍(𝐴),𝖼𝗈𝗇𝗌:𝐴→𝖭𝖾𝗌𝗍(𝐴×𝐴)→𝖭𝖾𝗌𝗍(𝐴). With the written scheme 𝗌𝗂𝗓𝖾:{𝐴:U𝑢}→𝖭𝖾𝗌𝗍(𝐴)→ℕ, the constructor branch receives 𝑥𝑠:𝖭𝖾𝗌𝗍(𝐴×𝐴), and its recursive call instantiates 𝗌𝗂𝗓𝖾 at 𝐴×𝐴. The call is then checked by ordinary equations. Remove the scheme and give the recursive occurrence one monomorphic provisional type 𝖭𝖾𝗌𝗍(?𝑋)→ℕ. Splitting its input by 𝖼𝗈𝗇𝗌 gives the tail type 𝖭𝖾𝗌𝗍(?𝑋×?𝑋). The recursive call therefore generates ?𝑋≐?𝑋×?𝑋, which fails the occurs check. The polymorphic program does not solve that equation; it avoids it by instantiating one quantified scheme twice.
Inferring the missing scheme would therefore ask the solver to introduce a quantifier inside an unknown and to compare its distinct instances. A first-order unifier assigns monotypes, while the contextual-pattern solver of this chapter assigns terms at one declared dependent type. Neither rule invents the required scheme. This is the concrete reason recursive clauses are absent from definition 112.2. This trace establishes only that boundary of the Timpl policy; it imports no semi-unification or undecidability result.
★★☆ For the displayed 𝖭𝖾𝗌𝗍 signature, trace the constructor branch of 𝗌𝗂𝗓𝖾. First use its written polymorphic scheme and state the instance selected at the recursive call. Then replace the recursive assumption by the monotype 𝖭𝖾𝗌𝗍(?𝑋)→ℕ, generate the recursive-call equation for ?𝑋, and identify the exact solver check that fails. Explain why higher-order pattern assignment does not repair the failure.
A source-firewalled CIC comparison. UniCoq is a different unifier: its source calculus is CIC with definitions, inductives, fixpoints, flexible and rigid universe instances, canonical structures, and controlled backtracking. The comparison uses the journal specification’s universe rules in Section 11, canonical-structure rules in Sections 8 and 12, and correctness discussion in Section 15 [ZS17]. None of its judgments is identified with the Timpl state of definition 112.5.
Three traces expose the boundary. First, a universe-polymorphic identity is freshened at its two occurrences in self-application. If their flexible levels are ℓ and 𝜅, checking the argument generates 𝜅<ℓ; reusing one monomorphic level instead would demand both 𝑖<𝑗 and 𝑗<𝑖. The incompatible and identical explicit-instance cases therefore receive different outcomes. Second, the canonical-structure membership example begins with 𝗅𝗎𝗇𝗍𝖺𝗀(𝗅𝗂𝗌𝗍_𝗈𝖿(?𝑓))≐[𝑦1]++[𝑦2]. The default key selects 𝗋𝗂𝗀𝗁𝗍𝖳𝖺𝗀; the projector key then selects 𝗋𝗂𝗀𝗁𝗍_𝗉𝗋𝗈𝗈𝖿 and generates its arguments. In the smaller projector case, the solver must find a canonical record before checking an argument at its projected type. This is overloading search, not principal pattern unification.
Third, the natural type-preservation conjecture for the UniCoq procedure is false in the presence of the fixpoint guard. In mathematical notation, its published term has the following three local bindings: ℎ:(ℕ→𝟎)→ℕ→𝟎:=?𝑋1,𝑇:=𝖿𝗂𝗑𝑓(𝑥:ℕ):𝟎:=ℎ𝑓𝑥,𝑝:ℎ=𝗂𝖽ℕ→𝟎:=𝗋𝖾𝖿𝗅(?𝑋4),followedby𝑇𝟢. The equality for 𝑝 solves ?𝑋1 with 𝗂𝖽ℕ→𝟎. Substitution changes the fixpoint body to 𝗂𝖽𝑓𝑥, which reduces to 𝑓𝑥: the recursive call receives the original argument, not a structural subterm. Unification has produced convertible endpoints, but the kernel therefore rejects the instantiated fixpoint. Ziliani and Sozeau state no correctness proof for the full procedure [ZS17]. These comparison traces prove neither soundness nor completeness and do not alter theorem 112.24, theorem 112.32.
★★★ Reconstruct the three UniCoq comparison traces from the source-firewalled card: the flexible-level inequality for polymorphic self-application, the two canonical-structure selections for list membership, and the delayed instantiation that violates the fixpoint guard. For each trace, name the feature absent from Timpl and state why the trace supplies no counterexample to this chapter’s soundness or policy-completeness theorem.
Bidirectional typing supplies the information-flow discipline used in definition 112.6; the surface/core distinction is implemented at small scale in pi-forall[DK19, Wei22]. Gundry’s contextual unification gives the dependency-ordered metacontext, flex–rigid abstraction, flex–flex intersection, and sharply bounded pattern completeness used here [Gun13]. The direct fragment in this chapter is deliberately smaller so that theorem 112.24 has a direct termination proof. The level graph solver instantiates the universe-expression calculation and correctness theorem of section 74.4, proposition 74.10; it is independent of term unification. Its inequality edges come from U-Hier and the nullary closure rules, not from U-Cumul.
Three supplemental sources have narrower jobs. Pfenning proves existence and uniqueness, up to his pattern renamings and permutations, for the exact restricted CoC pattern syntax in his paper [Pfe91]; this chapter does not identify that equivalence with its contextual metacontext or transfer the result to Timpl. Baader and Snyder supply the first-order notions of substitution, problem-relative comparison, complete sets of unifiers, and term-DAG output used in the starred seminar [BS01]; their theorems are not dependent elaboration theorems.
Suggested first pass.
None of these problems is a prerequisite for a later chapter. Begin with exercise 112.11, then complete exercise 112.14.
★★☆ Use the declaration and context 𝗆𝖺𝗉:[𝑢,𝑣]{𝐴:U𝑢}→{𝐵:U𝑣}→{𝑛:ℕ}→(𝐴→𝐵)→𝖵𝖾𝖼(𝐴,𝑛)→𝖵𝖾𝖼(𝐵,𝑛),Γ=𝐴:U𝑢,𝐵:U𝑣,𝑛:ℕ,𝑓:𝐴→𝐵,𝑥𝑠:𝖵𝖾𝖼(𝐴,𝑛). Repeat the trace of section 112.6 for 𝗆𝖺𝗉𝑓𝑥𝑠. List the level metavariables and contextual term metavariables separately, each in creation order. Give the rigid equations generated by the vector argument, the strict level equalities and their normalized assignments, and the final metavariable-free core spine.
★★☆ Construct one well-typed constraint for each of four failures: rigid-head clash, occurs check, scope escape, and non-pattern application. Prove that the first three have no solution of the declared kind. For the fourth use (112.7): prove that its two solutions are incomparable and form its complete set of unifiers, and distinguish that non-unitarity claim from unrestricted higher-order undecidability.
★★★ Specify a graph representation for the rigid first-order constraints of definition 112.15. State a relation between graph nodes and tree terms, and prove that one graph merge preserves exactly the tree solutions. Do not claim the Paterson–Wegman complexity bound unless the representation and machine operations satisfy its hypotheses.
★★★Practical project.timpl-elaborator Implement in Agda or Kappa the reusable solver fragment below. The resulting program is a finite acceptance slice of definition 112.6, definition 112.15, definition 112.18, definition 112.12, not a parser or a full Timpl elaborator. Represent first-order terms by bound variables, arbitrary-arity rigid heads, and contextual metavariables applied to variable spines. Represent declarations by metavariables with finite list-valued telescopes, and represent a problem by an equation worklist and an ordered substitution. Implement rigid decomposition and clash. Implement flex–rigid assignment for a distinct-variable spine of the declared arity: check occurrence and scope, abstract the right-hand side to the declaration telescope by parallel renaming, and instantiate the stored body when applying the substitution. Reject flex–flex equations and non-pattern spines as outside this fragment.
Represent a finite level problem by integer-weighted edges 𝑝+𝑐≤𝑞. Detect a positive-weight cycle of arbitrary length by graph relaxation, rather than by matching a fixed edge-list shape. Maintain the invariant that every stored assignment is scoped by its declaration telescope and that every processed worklist uses the accumulated substitution. Keep ambiguity, occurs, scope, rigid clash, non-pattern input, positive level cycles, and final kernel acceptance as distinct decisions.
The program must traverse the following machine-readable corpus and emit either a metavariable-free core term with its type or a rejection category. The named acceptance corpus is:
append-ok: the context and surface term of (112.1), with exact core result (112.12);
vnil-annotated-ok: the annotated surface term (𝗏𝗇𝗂𝗅:𝖵𝖾𝖼[0](ℕ,𝟢)), producing the explicit core 𝗏𝗇𝗂𝗅[0]{ℕ}:𝖵𝖾𝖼(ℕ,𝟢);
vnil-ambiguous: bare 𝗏𝗇𝗂𝗅, rejected as unsolved-meta;
occurs-bad: ?𝛼[𝑥]≐𝗌𝗎𝖼(?𝛼[𝑥]), rejected as occurs;
scope-bad: ?𝛼[𝑥]≐𝑦 for 𝑦∉dom(𝑥:ℕ), rejected as scope; and
level-cycle-bad: 𝑟+1≤𝑠,𝑠+1≤𝑟, rejected as level-cycle.
Check every successful output with the independent finite Timpl kernel model. As a mutation test, disable the scope guard in flex–rigid assignment: the scope-bad record must then reach that kernel model and be rejected there, demonstrating that an elaborator’s acceptance without rechecking is not the invariant. The observable result is the six outcome records and the exact core spine for append-ok. Add non-public checks for a telescope of length at least three and a positive cycle of length at least three.
This project implements first-order syntactic rigid/flex–rigid solving for distinct-variable spines and finite difference-constraint cycle detection. It does not implement binders in the term syntax, dependent typing, definitional equality, flex–flex intersection, postponement, search, or constraint generation from arbitrary surface programs. Its executions provide no proof of theorem 112.24, corollary 112.29, theorem 112.32.