Fix a type 𝐴 :U𝑖, a function 𝑞 :𝐴 →𝐴, and a starting value 𝑎 :𝐴. Consider a stream record whose state is visible in its fields: 𝗇𝖾𝗑𝗍:𝖮𝗋𝖻𝗂𝗍(𝑞,𝑎)→𝐴,𝗌𝗍𝖾𝗉:(𝑧:𝖮𝗋𝖻𝗂𝗍(𝑞,𝑎))→𝖨𝖽𝐴(𝗇𝖾𝗑𝗍(𝑧),𝑞(𝑎)),𝗍𝖺𝗂𝗅:𝖮𝗋𝖻𝗂𝗍(𝑞,𝑎)→𝖮𝗋𝖻𝗂𝗍(𝑞,𝑞(𝑎)). The three copattern equations for 𝗂𝗍𝖾𝗋𝖺𝗍𝖾(𝑞,𝑎) return, in field order, 𝑞(𝑎),𝗋𝖾𝖿𝗅𝑞(𝑎),𝗂𝗍𝖾𝗋𝖺𝗍𝖾(𝑞,𝑞(𝑎)). If a compiler translates 𝗌𝗍𝖾𝗉 before recording 𝗇𝖾𝗑𝗍, it checks reflexivity against an unknown endpoint. A productive clause list is therefore not yet a typed primitive corecursor. Both intermediate translations must preserve the field dependencies.
Three frozen representations
The source Tcop-clause inherits Timpl-clauses patterns and the Timpl-co stream evaluation discipline. It adds finite coinductive records whose fields form a telescope Φ=(𝜋1:𝐴1,…,𝜋𝑚:𝐴𝑚), where 𝐴𝑗 may mention the record parameters, indices, the self object, and earlier projections 𝜋1,…,𝜋𝑗−1. A clause left side is an ordered sequence of input patterns followed by one coprojection path. The path follows the declared field telescope and binds no variable. One finite definition group is written in indexed-fiber form 𝑑:(⃗ı:Δ𝑖)(Δ𝑑(⃗ı))→𝑅⃗𝑝⃗ı(𝑑∈G). This fibered header makes the state tag of a recursive call well typed; a surface declaration whose result index is computed from unconstrained inputs must first be elaborated to this form with its index-equality witness. That reindexing elaboration is outside Tcop-clause. For a nonrecursive field, a right side contains no call to the copattern definition group. For a recursive field, the entire right side is one saturated call 𝑑′@Δ′⃗𝑏 to that group, and every argument 𝑏𝑙 is group-free Timpl. Nested group calls and group calls in computational fields are outside Tcop-clause.
The intermediate Tcop-tree has leaves, indexed input-split nodes, and coprojection nodes. A coprojection node for 𝜋𝑗 carries the earlier field terms needed to instantiate 𝐴𝑗. The target Tcop-core is Timpl-rec-core plus the primitive record corecursor Rec-Corec of definition 125.9 for exactly these finite telescopes, and nothing else. An elaborated mutual group may generate one nonrecursive indexed state family through Timpl-data; the generated family, constructors, and eliminator are signature declarations rather than a new Tcop-core rule. Clause priority is first match. Coverage is required at every reachable constructor and coprojection node. Higher-order patterns, projection overloading, hidden eta laws, effects, and arbitrary coinductive families are outside the card.
Referenced from 5 locations
The rule delta enables a dependent result field and its tail. It changes the case-tree typing invariant: a branch context must carry not only refined input indices but also the values of all earlier projections on the same path.
For an accepted record declaration 𝑅 :(Δ𝑝)(Δ𝑖) →Uℓ with field telescope Φ =(𝜋1 :𝐴1,…,𝜋𝑚 :𝐴𝑚), the declarations are checked from left to right under 𝑧 :𝑅 ⃗𝑝 ⃗ı. The generated projection rule is Γ⊢𝑟:𝑅⃗𝑝⃗ıΓ⊢𝜋𝑗(𝑟):𝐴𝑗[𝑟/𝑧]Coproj−Ty. Occurrences of 𝜋𝑙(𝑟) for 𝑙 <𝑗 in the conclusion are typed by the earlier generated rules; a mention of 𝜋𝑙 with 𝑙 ≥𝑗 makes the field telescope ill formed.
A source definition has one checked fibered header from the finite group G and finite ordered rows M𝑟=(⃗𝑝𝑟;𝜋𝑗𝑟;𝑒𝑟). The pattern telescope ⃗𝑝𝑟 covers (⃗ı :Δ𝑖)(Δ𝑑(⃗ı)) and is checked by the matrix rules of definition 121.1. Static pattern elaboration produces the symbolic, dependency-preserving row map ̂𝜌𝑟 :Θ𝑟 →((⃗ı :Δ𝑖)(Δ𝑑(⃗ı))). If 𝑢𝑟,𝑙 is the stored symbolic term for the earlier field 𝜋𝑙 on the same path, the right side must satisfy the single finite judgment Θ𝑟⊢𝑒𝑟:𝐴𝑗𝑟[𝑑@(⃗ı,Δ𝑑)̂𝜌𝑟/𝑧][⃗𝑢𝑟,<𝑗𝑟/⃗𝜋<𝑗𝑟], where Θ𝑟 is the refined branch context. This is a static row check; it neither chooses closed inputs nor runs the matcher. Acceptance also checks the right-side shape fixed in definition 125.1: a field outside 𝑁 is group-free, while a field in 𝑁 is exactly one saturated group call with group-free arguments.
Write 𝑡 ⇓𝖳𝑣 for the closed group-free Timpl evaluation recalled in definition 124.2. A closed copattern right side has one of two weak-head results 𝑤 ::=𝑣 ∣𝑑′ ⃗𝑎. The auxiliary judgment 𝑒 ⇓𝖢𝑤 is generated by 𝑒 contains no call to the copattern group𝑒⇓𝖳𝑣𝑒⇓𝖢𝑣Copat−Result−Val. The recursive-result rule is 𝑑′:(Δ′)→𝑅⃗𝑝⃗ı′(𝑏𝑙⇓𝖳𝑎𝑙)𝑙∈Δ′𝑑′@Δ′⃗𝑏⇓𝖢𝑑′@Δ′⃗𝑎Copat−Result−Rec. Thus a recursive-field call is a weak-head record result, but its arguments must first be closed typed Timpl normal forms. No rule unfolds that record call. Source field observation is defined only for a closed tuple ⃗𝑎 that is ready for the indexed declaration telescope in the sense of definition 121.5. It reuses the relational matcher of definition 121.6; in particular, no new partial function named “match” is assumed. The root rule is ⃗𝑎 is closed, well typed, and ready𝗆𝖺𝗍𝖼𝗁𝖾𝗌(⃗𝑝𝑟,⃗𝑎,𝜃𝑟)(∄𝜃𝑞.𝗆𝖺𝗍𝖼𝗁𝖾𝗌(⃗𝑝𝑞,⃗𝑎,𝜃𝑞))𝑞<𝑟,𝑗𝑞=𝑗𝑟𝑒𝑟𝜃𝑟⇓𝖢𝑤𝑑⃗𝑎⇓𝜋𝑗𝑟𝑤Copat−Row. Thus priority is least matching row for the demanded field, not least row in a different field. Finite paths have grammar 𝑜 ::=𝜋𝑗 ∣𝜋𝑗 ⋅𝑜. A one-field path uses Copat-Row; path extension uses 𝑗∈𝑁𝑠⇓𝜋𝑗𝑠′𝑠′⇓𝑜𝑣𝑠⇓𝜋𝑗⋅𝑜𝑣Copat−Path−Step. The first premise restricts extension to the declared recursive set 𝑁. A nonrecursive field may itself have an unrelated record type, but such a field ends a path in this card; admitting observations through that record would require a second record signature and translation case.
Referenced from 3 locations
The intermediate syntax is 𝑄::=𝗅𝖾𝖺𝖿(𝑟,𝜎,𝑒)∣𝗌𝗉𝗅𝗂𝗍(𝑥;{𝑐𝑘(⃗𝑦𝑘)⇒𝑄𝑘}𝑘)∣𝖿𝗂𝖾𝗅𝖽𝗌{𝜋𝑗(⃗𝑢<𝑗)⇒𝑄𝑗}1≤𝑗≤𝑚. A leaf stores its source row, typed branch substitution, checked right side, and its group-free or saturated-recursive shape certificate. A split node stores the indexed motive and branch substitutions generated by definition 121.1. A fields node stores the complete ordered frontier; its 𝑗-th child is checked at 𝐴𝑗[⃗𝑢<𝑗/⃗𝜋<𝑗]. These requirements define the judgment Θ ⊢𝑄 :Φ.
Execution is defined only for closed ready input tuples. It first selects the demanded field, then follows input splits, and finally evaluates the leaf: 𝑄𝑗[⃗𝑎/Δ]⇓𝑤𝖿𝗂𝖾𝗅𝖽𝗌{𝜋𝑙(⃗𝑢<𝑙)⇒𝑄𝑙}𝑙(⃗𝑎)⇓𝜋𝑗𝑤Tree−Field. Input splitting uses 𝑎𝑥⇓𝖳𝑐𝑘(⃗𝑣)𝑄𝑘[⃗𝑣/⃗𝑦𝑘]⇓𝑤𝗌𝗉𝗅𝗂𝗍(𝑥;{𝑐𝑙(⃗𝑦𝑙)⇒𝑄𝑙}𝑙)[⃗𝑎]⇓𝑤Tree−Split. Finally, leaf execution is 𝑒𝜎⇓𝖢𝑤𝗅𝖾𝖺𝖿(𝑟,𝜎,𝑒)⇓𝑤Tree−Leaf. For an accepted mutual group, write 𝑄𝑑 for the covered tree generated for declaration 𝑑. Longer paths pass from a recursive leaf to the tree of the declaration named by that leaf: 𝑗∈𝑁𝑄𝑑(⃗𝑎)⇓𝜋𝑗𝑑′⃗𝑏𝑄𝑑′(⃗𝑏)⇓𝑜𝑣𝑄𝑑(⃗𝑎)⇓𝜋𝑗⋅𝑜𝑣Tree−Path−Step. There is no rule for a missing constructor or field branch; coverage excludes those states for an accepted tree.
Referenced from 2 locations
A typed copattern frontier is a telescope Θ∣𝑧:𝑅⃗𝑝⃗𝑖∣𝜋1(𝑧)=𝑢1,…,𝜋𝑗−1(𝑧)=𝑢𝑗−1 ⊢ 𝜋𝑗(𝑧):𝐴𝑗[⃗𝑢/⃗𝜋]. The equations on the left are typed substitution data, not kernel equality reflection. The compiler realizes them by extending the branch substitution with the earlier field terms. A leaf at field 𝜋𝑗 must synthesize a right side at exactly 𝐴𝑗[⃗𝑢/⃗𝜋].
Referenced from 3 locations
For 𝗂𝗍𝖾𝗋𝖺𝗍𝖾, the frontier at 𝗌𝗍𝖾𝗉 contains 𝗇𝖾𝗑𝗍(𝑧) =𝑞(𝑎). Its expected type is therefore 𝖨𝖽𝐴(𝑞(𝑎),𝑞(𝑎)), so 𝗋𝖾𝖿𝗅𝑞(𝑎) checks. Deleting that one frontier equation recreates the opening failure.
Clauses become typed case trees
The clauses-to-tree judgment Θ∣M ⟹𝖼𝗍𝑄:(Φ,𝑗) uses the first blocking item of the first surviving row.
An input constructor pattern creates the indexed split and transports the whole frontier by the restricted substitution of definition 78.9.
A coprojection 𝜋𝑗 creates a field node only when every earlier field on that record path has already produced a term. It extends the frontier by 𝜋𝑗(𝑧) =𝑢𝑗 before compiling later fields.
A variable pattern extends the row map. An inaccessible pattern checks against the accumulated substitution and introduces no run-time branch.
A leaf checks the right side against the instantiated field type and retains the first surviving source row number.
Failure reports the blocking row, input or field path, expected type, and unresolved index or missing earlier projection.
Referenced from 2 locations
Input splitting and coprojection splitting do not commute without a proof. If an input constructor refines an index occurring in a later field type, the coprojection node must receive the refined substitution. The algorithm fixes the first blocker, so its certificate records one deterministic order.
Let 𝜎 :Θ′ →Θ be a dependency-preserving substitution returned by indexed splitting. If a frontier in Θ types field 𝜋𝑗 at 𝐴𝑗[⃗𝑢/⃗𝜋], then its pointwise image in Θ′ types 𝜋𝑗 at 𝐴𝑗[⃗𝑢𝜎/⃗𝜋]𝜎.
Referenced from 3 locations
Proof of Lemma 125.6 — Frontier substitution
Proof. Induct on the field position 𝑗. The first field has no earlier projection equation, so ordinary Timpl substitution gives its type. At position 𝑗 +1, apply the induction hypothesis to each earlier field term. The dependency-preserving property keeps every declaration before its uses, so the substituted frontier is a telescope. Timpl substitution in 𝐴𝑗+1, followed by the pointwise substitutions for the earlier projections, gives the displayed type. ◻
If Tcop-clause accepts a definition 𝑑 and produces 𝑄, then 𝑄 is a well-typed, covered Tcop-tree at the declaration type of 𝑑. Every leaf retains the least reachable source row and checks at the field type determined by its typed frontier.
Referenced from 5 locations
Proof of Theorem 125.7 — Clause-to-case-tree typing
Proof. Induct on the compiler derivation. At an input split, clause specialization preserves the least row by lemma 121.4; dependent frontiers remain typed by lemma 125.6. At a coprojection node, field-order checking supplies all earlier field terms, so the frontier extension is well typed by telescope formation. Variable and inaccessible items use the stored row map and equality check. At a leaf, acceptance supplies both the right-side typing judgment at the instantiated field type and the group-free or saturated-recursive shape certificate. Coverage acceptance supplies every reachable constructor and field branch. These are all compiler rules. ◻
Let an accepted Tcop-clause group produce covered trees (𝑄𝑑)𝑑, and let ⃗𝑎 be a closed well-typed ready tuple for declaration 𝑑.
For every declared field 𝜋𝑗 and closed weak-head result 𝑤 ::=𝑣 ∣𝑑′ ⃗𝑏, 𝑑⃗𝑎⇓𝜋𝑗𝑤⟺𝑄𝑑(⃗𝑎)⇓𝜋𝑗𝑤. Both derivations select the same least matching row among the rows for 𝜋𝑗.
For every finite coprojection path 𝑜 ending in a computational field and every closed value 𝑣, 𝑑⃗𝑎⇓𝑜𝑣⟺𝑄𝑑(⃗𝑎)⇓𝑜𝑣.
Referenced from 4 locations
Proof of Lemma 125.8 — Source and case-tree observations agree
Proof. For item 1, select the child for 𝜋𝑗 by Tree-Field and induct on that finite field tree. At a split, readiness gives a closed constructor value at the split-family position. Group-free normalization therefore returns that constructor with the same children. The specialization and default-matrix clauses of lemma 121.4 say that a source row matches the original tuple exactly when its residual row matches the selected branch, and they preserve row order. Apply the induction hypothesis in that branch. At a leaf, the stored branch substitution is the unique substitution 𝜃𝑟 collected by 𝗆𝖺𝗍𝖼𝗁𝖾𝗌(⃗𝑝𝑟,⃗𝑎,𝜃𝑟). The leaf certificate says that every earlier row for 𝜋𝑗 fails. Hence Copat-Row and Tree-Leaf have the identical final premise 𝑒𝑟𝜃𝑟 ⇓𝖢𝑤. In the converse direction, inversion of the same split nodes reconstructs the constructor branches; inversion of the leaf certificate reconstructs the matching substitution and the failure of every earlier field-specific row. These are all tree-node forms.
For item 2, induct on the length of 𝑜. A one-field path is item 1. If 𝑜 =𝜋𝑗 ⋅𝑜′, inversion of either path rule gives 𝑗 ∈𝑁, a recursive result 𝑑′ ⃗𝑏, and the remaining observation. Item 1 transports the first premise between source and tree. The recursive-result rule prepares every component of ⃗𝑏 as a closed value or erased normal form, so ⃗𝑏 is ready for 𝑑′; apply the induction hypothesis to 𝑜′, then rebuild the corresponding path rule. ◻
★☆☆ Write the three successive frontiers for 𝗂𝗍𝖾𝗋𝖺𝗍𝖾(𝑞,𝑎). Give the expected type at each leaf and the substitution that changes the tail state from 𝑎 to 𝑞(𝑎).
Referenced from 3 locations
Case trees become primitive eliminators
The second translation must not re-run source matching. It consumes only a typed case tree and therefore has a smaller proof surface. Its target rule is the following one, which Tcop-core adds and which definition 125.1 named but did not display.
Let 𝑅 :(Δ𝑝)(Δ𝑖) →Uℓ be a card record with field telescope Φ =(𝜋1 :𝐴1,…,𝜋𝑚 :𝐴𝑚). Let 𝑁 ⊆{1,…,𝑚} collect the fields whose type is a recursive occurrence 𝑅 ⃗𝑝 ⃗ı𝑗 with ⃗ı𝑗 a term over Δ𝑝,Δ𝑖; no other occurrence of 𝑅 is permitted in Φ. Fix a state family 𝑆 :(Δ𝑖) →U𝑘. In a provisional signature, declare the method-independent constant 𝖼𝗈𝗋𝖾𝖼𝑅:(⃗ı:Δ𝑖)(𝑠:𝑆⃗ı)→𝑅⃗𝑝⃗ı. The provisional signature is local to the rule check and is committed only after every method below has checked. Earlier results are not represented by arbitrary binders. Instead, after methods ℎ1,…,ℎ𝑗−1 have checked, define their actual outputs and decoded fields in the context (⃗ı :Δ𝑖)(𝑠 :𝑆 ⃗ı) by 𝑣𝑙(⃗ı,𝑠):=ℎ𝑙⃗ı𝑠,¯𝑣𝑙(⃗ı,𝑠):={𝖼𝗈𝗋𝖾𝖼𝑅⃗ı𝑙𝑣𝑙(⃗ı,𝑠),𝑙∈𝑁,𝑣𝑙(⃗ı,𝑠),𝑙∉𝑁. Abbreviate 𝑧𝑠:=𝖼𝗈𝗋𝖾𝖼𝑅 ⃗ı 𝑠. The output type of the next method uses the substitution 𝜎𝑗[⃗ℎ<𝑗]:=[¯𝑣1(⃗ı,𝑠),…,¯𝑣𝑗−1(⃗ı,𝑠)/𝜋1(𝑧𝑠),…,𝜋𝑗−1(𝑧𝑠)]. Its output type is 𝐴∗𝑗[⃗ℎ<𝑗]:=⎧{
{⎨{
{⎩𝑆⃗ı𝑗,𝑗∈𝑁,𝐴𝑗[𝑧𝑠/𝑧]𝜎𝑗[⃗ℎ<𝑗],𝑗∉𝑁. Thus a later field sees the actual output of each earlier method. A recursive output is decoded to the record generated from its state before substitution.
The sequential method judgment is generated by 𝑋Σ+⊢𝗆𝖾𝗍𝗁𝗈𝖽𝗌𝑆():Φ≤0Corec−Meth−Nil. The extension rule is Σ+⊢𝗆𝖾𝗍𝗁𝗈𝖽𝗌𝑆(⃗ℎ<𝑗):Φ<𝑗Σ+⊢ℎ𝑗:(⃗ı:Δ𝑖)(𝑠:𝑆⃗ı)→𝐴∗𝑗[⃗ℎ<𝑗]Σ+⊢𝗆𝖾𝗍𝗁𝗈𝖽𝗌𝑆(⃗ℎ≤𝑗):Φ≤𝑗Corec−Meth−Snoc. The second premise is checked with the previously checked method terms substituted literally into its codomain. Their ordinary beta and definition rules are available; no coprojection equation is available during this check. The Rec-Corec transaction first declares the displayed corecursor provisionally, then checks this finite judgment, and only then commits the constant and the following 𝑚 computation rules together: 𝜋𝑗(𝖼𝗈𝗋𝖾𝖼𝑅⃗ı𝑠)⇝0ℎ𝑗⃗ı𝑠(𝑗∉𝑁),𝜋𝑗(𝖼𝗈𝗋𝖾𝖼𝑅⃗ı𝑠)⇝0𝖼𝗈𝗋𝖾𝖼𝑅⃗ı𝑗(ℎ𝑗⃗ı𝑠)(𝑗∈𝑁). Only a state, never a record, is returned by a recursive method: that is what makes the rule primitive. The decoded actual output ¯𝑣𝑙, rather than a state or an unconstrained variable, is substituted into later field types. Tcop-core adds Rec-Corec for the finite record telescopes of definition 125.1 and nothing else.
Writing Σ+ for the provisional signature and 𝐸𝑗(⃗ı,𝑠) for the corresponding displayed coprojection equation, the transaction is the signature rule Σ⊢𝑅 𝖼𝖺𝗋𝖽 𝗋𝖾𝖼𝗈𝗋𝖽:ΦΣ⊢𝑆:(Δ𝑖)→U𝑘Σ+=Σ,𝖼𝗈𝗋𝖾𝖼𝑅:(⃗ı:Δ𝑖)(𝑠:𝑆⃗ı)→𝑅⃗𝑝⃗ıΣ+⊢𝗆𝖾𝗍𝗁𝗈𝖽𝗌𝑆(ℎ1,…,ℎ𝑚):ΦΣ,𝖼𝗈𝗋𝖾𝖼𝑅,(𝐸𝑗(⃗ı,𝑠))1≤𝑗≤𝑚 𝗌𝗂𝗀𝗇𝖺𝗍𝗎𝗋𝖾Rec−Corec. All premises are checked before the conclusion extends Σ; failure of one method therefore commits neither the constant nor any equation.
The occurrences of 𝖼𝗈𝗋𝖾𝖼𝑅 in ¯𝑣𝑙 refer to the provisional constant introduced at stage one. Its type is method-independent, which makes the later stages well founded. Each such occurrence only reconstructs an earlier recursive projection from a state; no method returns an arbitrary 𝑅-value. A target that forbade the generated constant from method types would have to impose the stricter boundary that no later field depends on an earlier recursive projection. Tcop-core chooses the displayed simultaneous dependent-corecursor rule instead.
Referenced from 7 locations
For a legal dependency after recursion, take the unindexed record fields 𝗅𝖺𝖻𝖾𝗅:𝟐,𝗍𝖺𝗂𝗅:𝑅,𝖿𝗅𝖺𝗀:𝖨𝖽𝟐(𝗅𝖺𝖻𝖾𝗅(𝗍𝖺𝗂𝗅(𝑧)),𝗍𝗍). The projection 𝗅𝖺𝖻𝖾𝗅 :𝑅 →𝟐 is introduced by the earlier field of the same record before the flag type is checked; it is not an ambient constant that mentions a record still being declared. The flag type contains no syntactic occurrence of 𝑅, so it satisfies the card. The tail method has actual output 𝑣2 =ℎ2 𝑠 :𝑆, and the flag method has type 𝐴∗3[ℎ1,ℎ2]=𝖨𝖽𝟐(𝗅𝖺𝖻𝖾𝗅(𝖼𝗈𝗋𝖾𝖼𝑅(ℎ2𝑠)),𝗍𝗍),¯𝑣2=𝖼𝗈𝗋𝖾𝖼𝑅(ℎ2𝑠). Putting the state ℎ2 𝑠 itself in that identity type would require 𝗅𝖺𝖻𝖾𝗅 to accept a state of type 𝑆 although its domain is 𝑅. This example forces the decoded-field substitution without weakening the occurrence restriction.
★☆☆ For the label–tail–flag record, derive 𝐴∗3[ℎ1,ℎ2] and ¯𝑣2 from definition 125.9. Then replace ¯𝑣2 by the state ℎ2 𝑠 and state the exact failed typing judgment.
Referenced from 3 locations
For a finite accepted group G, set 𝑘G:=max(𝗅𝖾𝗏(Δ𝑖),max𝑑∈G𝗅𝖾𝗏(Δ𝑑(⃗ı))), using the telescope-level function of definition 122.13. The generated block is 𝖲𝗍𝖺𝗍𝖾G:(⃗ı:Δ𝑖)→U𝑘G,𝗂𝗇𝑑:(⃗ı:Δ𝑖)(⃗𝑎:Δ𝑑(⃗ı))→𝖲𝗍𝖺𝗍𝖾G(⃗ı). The maximum is formed after the Timpl level solver has accepted every input telescope; a stuck or inconsistent maximum rejects the translation.
Referenced from 4 locations
Proof of Lemma 125.11 — Generated state-block formation
Proof. Every index-binder type and every constructor-field type inhabits a universe at most 𝑘G by the two components of its defining maximum. The family does not occur in an index or constructor telescope, so every constructor scan uses a block-free argument and passes the occurrence judgment of definition 122.4. The dependency graph has one vertex and no edge. The universe-output procedure of definition 122.13 therefore emits only inequalities bounded by the displayed maximum, all of which the chosen level satisfies. Timpl-data formation supplies the family, constructors, and indexed eliminator. ◻
Write ‖𝑄‖ for the following translation.
A nonrecursive leaf becomes its checked group-free Timpl term. A recursive leaf is handled by item 4; no other leaf contains a group call.
An input-split node becomes the corresponding generated inductive eliminator. Its motive is the result field type transported by the node’s frontier substitution.
A complete sequence of coprojection nodes becomes the sequential method tuple (ℎ𝑗)𝑗 of one Rec-Corec instance, using the generated state block of definition 125.10. Its formation is lemma 125.11, and its constructor 𝗂𝗇𝑑(⃗ı,⃗𝑎) records both the declaration tag and its fiber input. The method for 𝜋𝑗 is checked after the methods 𝜋1,…,𝜋𝑗−1, and its type and body substitute their actual decoded outputs ¯𝑣1,…,¯𝑣𝑗−1, and substitute 𝖼𝗈𝗋𝖾𝖼𝑅 ⃗ı 𝑠 for the source self object 𝑧. Thus a source occurrence of an earlier recursive projection becomes the guarded term 𝖼𝗈𝗋𝖾𝖼𝑅 ⃗ı𝑙 (ℎ𝑙 ⃗ı 𝑠), not the state ℎ𝑙 ⃗ı 𝑠. The compiled declaration itself is ‖𝑄𝑑‖:=𝜆⃗ı.𝜆⃗𝑎.𝖼𝗈𝗋𝖾𝖼𝑅⃗ı(𝗂𝗇𝑑(⃗ı,⃗𝑎)). Field selection therefore precedes every translated input split: the 𝑗-th method contains the input-split tree compiled from the 𝑗-th child of the fields node.
A recursive leaf for the checked call 𝑑′@Δ𝑑′(⃗ı𝑗)⃗𝑏, whose field lies in 𝑁, becomes the tagged state 𝗂𝗇𝑑′(⃗ı𝑗,‖⃗𝑏‖):𝖲𝗍𝖺𝗍𝖾G(⃗ı𝑗). Its group-free arguments are translated componentwise. The leaf does not call the method ℎ𝑗 being defined and never returns a record of 𝑅.
Referenced from 5 locations
For the orbit example, the declaration has an empty fiber telescope, so the generated family has the constructor 𝗂𝗇𝗂𝗍𝖾𝗋𝖺𝗍𝖾 :(𝑏 :𝐴) →𝖲𝗍𝖺𝗍𝖾G(𝑏). The three sequential methods are ℎ1:=𝜆𝑎.𝜆𝑠.𝑞(𝑎),ℎ2:=𝜆𝑎.𝜆𝑠.𝗋𝖾𝖿𝗅𝑞(𝑎),ℎ3:=𝜆𝑎.𝜆𝑠.𝗂𝗇𝗂𝗍𝖾𝗋𝖺𝗍𝖾(𝑞(𝑎)). After ℎ1 has checked, the second method’s codomain is 𝖨𝖽𝐴(ℎ1𝑎𝑠,𝑞(𝑎))≡𝖨𝖽𝐴(𝑞(𝑎),𝑞(𝑎)) by ordinary beta-reduction of ℎ1; hence ℎ2 checks before any corecursor equation is committed. The third codomain is 𝖲𝗍𝖺𝗍𝖾G(𝑞(𝑎)). The recursive field carries no record, only the state at the moved index 𝑞(𝑎), which is where 𝗂𝗍𝖾𝗋𝖺𝗍𝖾(𝑞,𝑞(𝑎)) is recovered. Writing 𝖮𝗋𝖻𝗂𝗍(𝑞,𝑞(𝑎)) in the third position instead would make the third method accept an arbitrary record and turn the corecursor back into the unrestricted fixed point that definition 125.9 excludes.
If a complete Tcop-tree coprojection spine is typed at frontier Φ, then the methods generated by definition 125.12 satisfy the sequential method judgment of definition 125.9.
Referenced from 3 locations
Proof of Lemma 125.13 — Coprojection method typing
Proof. Induct on the field position. At position one, suppose first that 1 ∉𝑁. Case-tree typing gives a term of 𝐴1 under 𝑧 :𝑅 ⃗𝑝 ⃗ı. The staged corecursor rule types 𝖼𝗈𝗋𝖾𝖼𝑅 ⃗ı 𝑠 at that record type, so source substitution gives the first method at 𝐴1[𝖼𝗈𝗋𝖾𝖼𝑅 ⃗ı 𝑠/𝑧]. If 1 ∈𝑁, the stored call certificate and lemma 125.11 instead give the translated leaf type 𝑆 ⃗ı1. In either case, Corec-Meth-Nil followed by Corec-Meth-Snoc establishes the sequential judgment at position one. Assume that judgment holds through position 𝑗. For each 𝑙 ≤𝑗, method typing gives the actual output 𝑣𝑙 =ℎ𝑙 ⃗ı 𝑠; decode it as itself when 𝑙 ∉𝑁 and as 𝖼𝗈𝗋𝖾𝖼𝑅 ⃗ı𝑙 𝑣𝑙 when 𝑙 ∈𝑁. The corecursor typing rule gives every decoded term its declared field type. The frontier at field 𝑗 +1 records precisely these terms. Substitute the generated self object and the decoded actual outputs into that frontier. If field 𝑗 +1 is nonrecursive, theorem 125.7 and the stored group-free certificate type its translated leaf at 𝐴∗𝑗+1[⃗ℎ≤𝑗]. If it is recursive, the stored call certificate has some tag 𝑑′, moved index ⃗ı𝑗+1, and translated arguments ‖⃗𝑏‖ :Δ𝑑′(⃗ı𝑗+1). The generated constructor rule therefore gives 𝗂𝗇𝑑′(⃗ı𝑗+1,‖⃗𝑏‖) :𝖲𝗍𝖺𝗍𝖾G(⃗ı𝑗+1), again exactly 𝐴∗𝑗+1[⃗ℎ≤𝑗]. Rule Corec-Meth-Snoc adds the method in either case. Finite induction establishes the complete sequential method judgment. ◻
If 𝑄 is a well-typed covered Tcop-tree for declaration 𝑑, then ‖𝑄‖ is a Tcop-core term at the declared type of 𝑑.
Referenced from 4 locations
Proof of Theorem 125.14 — Case-tree-to-core typing
Proof. Induct on 𝑄. A nonrecursive leaf is typed by its group-free certificate. An input split uses the generated inductive eliminator, and the induction hypotheses type every branch at its transported motive. For a coprojection spine, lemma 125.13 gives the complete sequential method judgment required by Rec-Corec. A recursive leaf certificate types ⃗𝑏 :Δ𝑑′(⃗ı𝑗), so the generated constructor rule types 𝗂𝗇𝑑′(⃗ı𝑗,‖⃗𝑏‖) at 𝖲𝗍𝖺𝗍𝖾G(⃗ı𝑗), which is the type 𝐴∗𝑗[⃗ℎ<𝑗] demanded for 𝑗 ∈𝑁. Hence every translated node is typed, including the root. ◻
A compiled declaration applied to closed inputs may still have outer lambda redexes before its primitive corecursor is visible. Write 𝑞⟹𝗂𝗇𝑐 when a nonempty deterministic sequence contracts exactly the outer beta-redexes of ‖𝑄𝑑‖ ⃗ı ⃗𝑎, from left to right, and stops at 𝑐=𝖼𝗈𝗋𝖾𝖼𝑅⃗ı(𝗂𝗇𝑑(⃗ı,⃗𝑎)). The sequence does not contract a Rec-Corec projection, enter a method body, evaluate a state field, or use a generated Block-comp equation. Translated input splits occur inside the demanded field method and are therefore not preparation steps.
Referenced from 2 locations
Let 𝑄𝑑 be a well-typed covered Tcop-tree, let ⃗𝑎 be a closed well-typed ready fiber-argument tuple at a closed ready index tuple ⃗ı, and put 𝑞 =‖𝑄𝑑‖ ⃗ı ⃗𝑎. Either 𝑞 is already a primitive corecursor object, or there is a unique object 𝑐 =𝖼𝗈𝗋𝖾𝖼𝑅 ⃗ı 𝑠 with 𝑞 ⟹𝗂𝗇𝑐. In both cases, 𝑠 =𝗂𝗇𝑑(⃗ı,⃗𝑎); preparation has not selected a field, an input branch, or a source row.
Referenced from 4 locations
Proof of Lemma 125.16 — Compiled application preparation is total and functional
Proof. Unfold the displayed clause for ‖𝑄𝑑‖ in definition 125.12. Successive beta-contractions substitute the closed index tuple and then the closed fiber tuple. Lambda arity fixes their order and their number. The resulting term is exactly 𝖼𝗈𝗋𝖾𝖼𝑅 ⃗ı(𝗂𝗇𝑑(⃗ı,⃗𝑎)). If both telescopes are empty, that object was present before any contraction; otherwise the stated nonempty sequence is unique. Since no method is projected during this sequence, no field-specific split tree and hence no row can be selected. ◻
The target observation relation is distinct from source ⇓𝑜. Its root-bridge rule is 𝑞⟹𝗂𝗇𝑐𝑐⇓𝖢𝖢𝑜𝑣𝑞⇓𝖢𝖢𝑜𝑣Core−Prepare. For a closed generated object 𝑐 =𝖼𝗈𝗋𝖾𝖼𝑅 ⃗ı 𝑠, a nonrecursive field uses 𝑗∉𝑁𝜋𝑗(𝑐)⇝0𝑒𝑒⇓𝖳𝑣𝑐⇓𝖢𝖢𝜋𝑗𝑣Core−Field−Val, where the root contraction is the 𝑗-th committed Rec-Corec equation. A recursive field exposes the decoded next object: 𝑗∈𝑁𝜋𝑗(𝑐)⇝0𝖼𝗈𝗋𝖾𝖼𝑅⃗ı𝑗(ℎ𝑗⃗ı𝑠)ℎ𝑗⃗ı𝑠⇓𝖳𝑠′𝑐⇓𝖢𝖢𝜋𝑗𝖼𝗈𝗋𝖾𝖼𝑅⃗ı𝑗𝑠′Core−Field−Rec. Longer observations are generated only through recursive fields: 𝑗∈𝑁𝑐⇓𝖢𝖢𝜋𝑗𝑐′𝑐′⇓𝖢𝖢𝑜𝑣𝑐⇓𝖢𝖢𝜋𝑗⋅𝑜𝑣Core−Path−Step. There is no target path rule through an unrelated record-valued field, matching the source restriction in definition 125.2.
Referenced from 3 locations
Let 𝑄𝑑 be a well-typed covered tree in an accepted Tcop-clause group, and let ⃗𝑐 =(⃗ı,⃗𝑎) be a closed well-typed ready argument tuple for 𝑑. For every finite coprojection path 𝑜 ending in a computational field and every closed value 𝑣, 𝑄𝑑(⃗𝑐)⇓𝑜𝑣⟺‖𝑄𝑑‖⃗𝑐⇓𝖢𝖢𝑜𝑣.
Referenced from 4 locations
Proof of Lemma 125.18 — Case-tree and core observations agree
Proof. Induct on the length of 𝑜. First suppose 𝑜 =𝜋𝑗 with 𝑗 ∉𝑁. By lemma 125.16, outer beta-contraction exposes the unique object with state 𝗂𝗇𝑑(⃗ı,⃗𝑎) and selects no field or row. The committed Rec-Corec equation for 𝜋𝑗 exposes exactly the translated 𝑗-th child of the fields node. Induct on that finite child. A translated split is the generated datatype eliminator. Because the input tuple is ready, its scrutinee is a closed constructor value, and the corresponding Block-comp equation selects the same branch as Tree-Split. A translated leaf is the same closed group-free Timpl term with the same frontier substitution. Soundness, completeness, and functionality of group-free normalization from lemma 124.3 therefore equate its ⇓𝖳 result with the Tree-Leaf result. These arguments work in both directions by inversion of Core-Prepare, the committed field equation, and each generated Block-comp equation. They exhaust the split and leaf forms, so Core-Field-Val gives the claimed equivalence for a one-field computational path.
Now let 𝑜 =𝜋𝑗 ⋅𝑜′. Inversion of Tree-Path-Step gives 𝑗 ∈𝑁 and a recursive leaf result 𝑑′ ⃗𝑏. The same structural induction on the 𝑗-th child shows that its translated method normalizes to the state 𝗂𝗇𝑑′(⃗ı𝑗,‖⃗𝑏‖): at a recursive leaf, this is item 4 of definition 125.12, and the group-free normalizer evaluates the stored arguments in the same telescope order as Copat-Result-Rec. Rule Core-Field-Rec therefore returns 𝖼𝗈𝗋𝖾𝖼𝑅⃗ı𝑗(𝗂𝗇𝑑′(⃗ı𝑗,‖⃗𝑏‖)), the compiled object for the recursive result. The argument tuple ⃗𝑏 is ready by the premises of Copat-Result-Rec. Apply the induction hypothesis to 𝑄𝑑′(⃗𝑏) and 𝑜′, then rebuild Tree-Path-Step and Core-Path-Step. Conversely, inversion of Core-Field-Rec and the method’s generated block equations recovers the same declaration tag, prepared arguments, and recursive tree leaf; the induction hypothesis recovers the remaining tree observation. Thus both directions hold for every finite path. ◻
If Tcop-clause accepts 𝑑, then the composed output ‖𝑄𝑑‖ is well typed in Tcop-core. For every closed well-typed ready argument tuple ⃗𝑐 =(⃗ı,⃗𝑎), finite coprojection path 𝑜 ending in a computational field, and closed value 𝑣, the two exact implications are 𝑑⃗𝑐⇓𝑜𝑣⟹‖𝑄𝑑‖⃗𝑐⇓𝖢𝖢𝑜𝑣,‖𝑄𝑑‖⃗𝑐⇓𝖢𝖢𝑜𝑣⟹𝑑⃗𝑐⇓𝑜𝑣. At each projection in the path, both derivations select the same least matching source row among the rows for that demanded field.
Referenced from 4 locations
Proof of Theorem 125.19 — Composed elaboration and observation preservation
Proof. Typing is the composition of theorem 125.7 followed by theorem 125.14. Apply lemma 125.8 to identify source observation with the covered-tree observation, including the least selected row at each field. Apply lemma 125.18 to identify that tree observation with target observation. Composition gives each displayed implication. The first lemma supplies the row statement; the second translation consumes the selected leaves and does not run matching again. ◻
Cockx and Abel formalize elaboration from dependent pattern and copattern clauses to well-typed case trees. They prove that a signature all of whose functions are given by well-typed case trees is respectful, hence type-preserving, in Definitions 13–14, Lemmas 15–16, and Theorem 17 [CA20]. The second translation and the Tcop-core signature are fixed and proved locally here; the source theorem does not by itself justify a translation to unnamed primitive eliminators.
Suggested first pass.
None of these problems is a prerequisite for a later chapter. Begin with exercise 125.3, then complete exercise 125.5.
★★☆ Draw the complete Tcop-tree for 𝗂𝗍𝖾𝗋𝖺𝗍𝖾(𝑞,𝑎), including each frontier. Translate it to the sequential primitive method tuple and calculate the first two tail observations followed by next.
Referenced from 4 locations
★★☆ Swap the 𝗇𝖾𝗑𝗍 and 𝗌𝗍𝖾𝗉 declarations in the orbit record without changing their types. Locate the first ill-scoped occurrence, and prove that no field permutation preserving dependencies can put step first.
Referenced from 3 locations
★★★ Practical project.dependent-copattern-case-tree Implement in Kappa the single-definition, finite-input-pattern, three-field orbit fragment. The general indexed helper-state datatype for a mutual group is outside this runner. Compile an ordered clause list to a coprojection spine in which every field node stores the frontier accumulated before it, then read back the case tree, the field frontiers, and the observation trace from that spine; none of the three may be printed as a literal. Preserve the invariant that field 𝑗 stores terms for all fields below 𝑗. Accept iterate and print observations 1,2,3 from successor at zero; reject step-before-next, naming the earlier field that is missing, and uncovered-input, naming the field and constructor with no branch. Additional rejections must name a wholly missing field, a field whose own rows omit a constructor, and a field whose right side has the wrong finite type. Five mutations must fail the acceptance oracle: dropping 𝗇𝖾𝗑𝗍 from the declared predecessors of 𝗌𝗍𝖾𝗉, letting one constructor pattern count as covering, failing to advance the frontier stored by the compiled spine, using global rather than per-field coverage, and bypassing the finite right-side type checker. The interpreter checks this finite compiler; it does not prove the general Cockx–Abel theorem.
Referenced from 5 locations