Prerequisites. Direct starred prerequisites: none. Chapter 54 supplies the CwF interface, chapter 55, chapter 152 the first models, and chapter 56 the strictification used to build them. No later core chapter depends on this route.
Suppose a value is available only later, and that a proof about it must be carried out now. Write 𝐴 for the type of the value and let ◻𝐴 be the type of a value available later. Two operations are wanted: from a proof of 𝐴 carried out in the later world, a proof of ◻𝐴 now; and from ◻𝐴 now, access to 𝐴 in the later world. The difficulty is that “the later world” is not a type, and not a stage of a computation either. It is a change in the mode of the judgment: the context under which one reasons is different, and the variables usable there are not the variables usable here.
It is tempting to reach for the staged calculi of chapter 129, where ⟨𝐴⟩ is the type of code and quotation crosses a boundary. That is a different mechanism, and the difference is visible in one rule. Cross-stage persistence lets a present value be used inside a quotation; the value is transported and later executed. A judgment-mode change makes no such promise: there is no execution and nothing is transported. A modality may admit no persistence at all, and a mode may have no code to run. What is shared is only the shape of the syntax, and a shared glyph is not a translation.
The construction below therefore starts from the context, not from the type.
Types are 𝐴,𝐵::=𝑏∣𝐴→𝐵∣◻𝐴. Contexts are generated by Γ::=⋅∣Γ,𝑥:𝐴∣Γ.𝖫, where Γ.𝖫 is Γlocked. Typing is given by the ordinary rules for variables, abstraction and application — with the variable rule requiring that no lock occur to the right of the declaration — together with
Γ.𝖫⊢𝑡:𝐴
Γ⊢𝖻𝗈𝗑𝑡:◻𝐴
Box-I
Γ⊢𝑡:◻𝐴
Γ.𝖫⊢𝗎𝗇𝖻𝗈𝗑𝑡:𝐴
Box-E
and the equations 𝗎𝗇𝖻𝗈𝗑(𝖻𝗈𝗑𝑡)=𝑡 and 𝖻𝗈𝗑(𝗎𝗇𝖻𝗈𝗑𝑡)=𝑡.
The variable rule is the whole discipline: a lock is a barrier, and a variable declared before a lock is not usable after it. The type ◻𝐴 is what the barrier leaves behind.
Define Γ≤Δ when Δ is obtained from Γ by inserting declarations, at positions not separated from the end by a lock that Γ does not have. Then Γ⊢𝑡:𝐴 and Γ≤Δ imply Δ⊢𝑡:𝐴; and if Γ,𝑥:𝐴,Γ′⊢𝑡:𝐵 and Γ⊢𝑢:𝐴 with Γ′ lock-free, then Γ,Γ′⊢𝑡[𝑢/𝑥]:𝐵.
Proof. Both by induction on the typing derivation. For weakening the only interesting case is Box-E: the conclusion is at Δ.𝖫 and the premise at Δ, and Γ≤Δ gives the premise by the induction hypothesis. For substitution the hypothesis that Γ′ is lock-free is used exactly once, in the variable case: if Γ′ contained a lock, 𝑥 would not be usable at the leaf and the substitution would be vacuous, but the statement of the lemma would then be about a different context. In the Box-I case the premise is at (Γ,𝑥:𝐴,Γ′).𝖫, where 𝑥 is unusable, so nothing is substituted and the induction hypothesis is applied trivially. ◻
Interpret a context by a semantic environment indexed by the number of trailing locks, a type ◻𝐴 by the semantics of 𝐴 one lock deeper, and reify at ◻𝐴 by 𝖻𝗈𝗑. Then every term has a normal form, and for 𝑡:=𝜆𝑥.𝖻𝗈𝗑(𝗎𝗇𝖻𝗈𝗑𝑥) at type ◻𝑏→◻𝑏 the algorithm returns 𝜆𝑥.𝑥.
Proof of Proposition 160.3 — Normalization by evaluation, one calculation
Proof. Evaluation sends 𝑥 to the semantic value in the environment; the clause for 𝗎𝗇𝖻𝗈𝗑 moves one lock inward and the clause for 𝖻𝗈𝗑 moves one lock outward, so the composite is the identity on semantic values. Reification at ◻𝑏 emits 𝖻𝗈𝗑 and recurses; at the base type it emits the accumulated neutral, which for the displayed term is the variable. Hence the normal form is 𝜆𝑥.𝑥, which is the 𝜂-equation of definition 160.1 read as a computation. Existence of normal forms in general is the usual logical-relations argument for normalization by evaluation, carried out over contexts indexed by lock depth. ◻
Proposition 160.3 is a theorem about a simply typed calculus with one modality. It introduces the lock mechanism and nothing else: it supplies no dependent judgment, no substitution calculus for dependent contexts, and no normalization statement for any of the systems below. The mechanized development that accompanies the source checks exactly this simply typed statement.
Extend the substitution calculus of definition 54.2 by a context former Γ.𝖫, by the rules
Γ.𝖫⊢𝐴𝗍𝗒𝗉𝖾
Γ⊢◻𝐴𝗍𝗒𝗉𝖾
DBox-F
Γ.𝖫⊢𝑡:𝐴
Γ⊢𝖻𝗈𝗑𝑡:◻𝐴
DBox-I
Γ⊢𝑡:◻𝐴
Γ.𝖫⊢𝗎𝗇𝖻𝗈𝗑𝑡:𝐴
DBox-E
and the equations 𝗎𝗇𝖻𝗈𝗑(𝖻𝗈𝗑𝑡)=𝑡, 𝖻𝗈𝗑(𝗎𝗇𝖻𝗈𝗑𝑡)=𝑡, together with the substitution laws ◻(𝐴)[𝛾]=◻(𝐴[𝛾.𝖫]) and (𝖻𝗈𝗑𝑡)[𝛾]=𝖻𝗈𝗑(𝑡[𝛾.𝖫]), where 𝛾.𝖫 is the action of the lock on substitutions.
Every CwDRA interprets definition 160.5: contexts, types, terms and substitutions as in theorem 54.28, with [[Γ.𝖫]]:=𝖫[[Γ]], [[◻𝐴]]:=𝑅([[𝐴]]), [[𝖻𝗈𝗑𝑡]] the image of [[𝑡]] under the bijection and [[𝗎𝗇𝖻𝗈𝗑𝑡]] its inverse. Conversely the syntax of definition 160.5, quotiented by judgmental equality, is a CwDRA, and it is initial among them.
Proof of Theorem 160.7 — Soundness at the exact signature
Proof.Soundness.DBox-F is clause (2), DBox-I and DBox-E are the two directions of clause (3), and their two equations are that the bijection is a bijection. The substitution laws of definition 160.5 are exactly the naturality requirements of definition 160.6: without them the interpretation of a substituted modal type would depend on the order of the two operations. The remaining rules are theorem 54.28.
Term model and initiality. The syntactic CwF of theorem 54.27 acquires 𝖫 from the context former, which is functorial because 𝛾.𝖫 is defined by recursion and preserves identities and composites; 𝑅 from ◻; and the bijection from 𝖻𝗈𝗑 and 𝗎𝗇𝖻𝗈𝗑, which are mutually inverse by the two equations. Naturality is the two substitution laws. Initiality is the argument of theorem 54.27 with two further clauses in the induction, one for each new former, each forced by the requirement that the interpretation be a morphism of CwDRAs. ◻
Let Γ.𝖫⊢𝐴𝗍𝗒𝗉𝖾 and Γ.𝖫.𝐴⊢𝐵𝗍𝗒𝗉𝖾. The derivable dependent distribution law is Γ⊢𝖽𝗂𝗌𝗍:◻(∏𝑎:𝐴𝐵)→∏𝑢:◻𝐴◻(𝐵[⟨𝗂𝖽,𝗎𝗇𝖻𝗈𝗑𝑢⟩]),𝖽𝗂𝗌𝗍:=𝜆𝑓.𝜆𝑢.𝖻𝗈𝗑((𝗎𝗇𝖻𝗈𝗑𝑓)(𝗎𝗇𝖻𝗈𝗑𝑢)). It is well typed because both occurrences of 𝗎𝗇𝖻𝗈𝗑 sit under the single lock introduced by the outer 𝖻𝗈𝗑, where DBox-E makes them available; and the codomain must substitute 𝗎𝗇𝖻𝗈𝗑𝑢 into 𝐵 because 𝐵 depends on a variable of 𝐴, which exists only under that lock.
The naive variant with codomain ∏𝑢:◻𝐴◻𝐵 is not even well formed: 𝐵 is a type over Γ.𝖫.𝐴, so ◻𝐵 requires a term of 𝐴 in the context, and 𝑢:◻𝐴 is not one. The substitution is not a convenience; it is what makes the statement a statement.
★☆☆ Show that 𝑥:𝐴⊢𝖻𝗈𝗑𝑥:◻𝐴 is not derivable in definition 160.1, and identify the side condition of the variable rule that blocks it. Then exhibit a context in which the analogous judgment is derivable.
★★☆ Show that dropping the naturality requirement from definition 160.6 invalidates theorem 160.7: exhibit two derivations of the same judgment whose interpretations differ.
Let mode 𝗌 be the mode of static data — values that exist now and may be inspected — and mode 𝖽 the mode of dynamic data. There is an inclusion of static into dynamic, and a modality that records that a dynamic object was produced statically. A type at 𝗌 is not a type at 𝖽; a context at one mode cannot be used at the other. With one modality on one mode this is inexpressible: the calculus of definition 160.5 has a single judgment form, so ◻ maps its types to its types and there is no second collection to map into.
A mode theoryM is a strict 2-category. Its objects 𝑚,𝑛,… are modes; its 1-cells 𝜇:𝑛→𝑚 are modalities, composed by 𝜇∘𝜈 with identities 𝟏𝑚; its 2-cells 𝛼:𝜇⇒𝜈 are the transformations between modalities, with vertical and horizontal composition satisfying the interchange law strictly.
For each mode 𝑚 there are judgments Γ𝖼𝗍𝗑𝑚, Γ⊢𝑚𝐴𝗍𝗒𝗉𝖾, Γ⊢𝑚𝑡:𝐴 and the four equalities, all at mode 𝑚. Contexts are generated by the empty context, by Γ.𝐴, and, for each modality 𝜇:𝑛→𝑚, by the lockΓ𝖼𝗍𝗑𝑚Γ.𝖫𝜇𝖼𝗍𝗑𝑛, subject to Γ.𝖫𝟏=Γ and Γ.𝖫𝜇∘𝜈=(Γ.𝖫𝜇).𝖫𝜈. A 2-cell 𝛼:𝜇⇒𝜈 induces a substitution Γ.𝖫𝜈→Γ.𝖫𝜇, functorially in 𝛼. Variables are annotated: a declaration is 𝑥:𝜇𝐴, and the variable rule is
𝛼:𝜇⇒locks(Γ′)
Γ.(𝑥:𝜇𝐴),Γ′⊢𝑥𝛼:𝐴[…]
MTT-Var
where locks(Γ′) is the composite of the modalities of the locks occurring in Γ′ and the elided substitution is the induced one. The modal type former is, for 𝜇:𝑛→𝑚,
Γ.𝖫𝜇⊢𝑛𝐴𝗍𝗒𝗉𝖾
Γ⊢𝑚⟨𝜇∣𝐴⟩𝗍𝗒𝗉𝖾
MTT-F
Γ.𝖫𝜇⊢𝑛𝑡:𝐴
Γ⊢𝑚𝗆𝗈𝖽𝜇(𝑡):⟨𝜇∣𝐴⟩
MTT-I
with elimination by a modal 𝗅𝖾𝗍: from Γ.𝖫𝜈⊢𝑠:⟨𝜇∣𝐴⟩ and Γ.(𝑥:𝜈∘𝜇𝐴)⊢𝑢:𝐶 conclude Γ⊢𝗅𝖾𝗍𝗆𝗈𝖽𝜇(𝑥)=𝑠𝗂𝗇𝑢:𝐶[…], with the 𝛽-rule substituting 𝑡 for 𝑥.
Proof of Lemma 160.12 — Weakening and substitution, multimodally
Proof. Induction on the derivation of 𝑡. The only case that consults the annotation is MTT-Var: there the premise supplies 𝛼:𝜇⇒locks(Γ′), and the proviso is exactly that such an 𝛼 exists, so the substituted term is 𝑢 transported along the substitution induced by 𝛼. In the lock case the context grows by 𝖫𝜈 and locks grows by 𝜈, so the proviso is preserved by whiskering 𝛼. In MTT-I the premise is one lock deeper and the induction hypothesis applies with the whiskered 2-cell. Functoriality of the induced substitutions in 𝛼 is what makes the two possible orders of transport agree. ◻
Fix a mode theory M with a decidable equality on 2-cells, and freeze the signature of definition 160.11 together with Π-, Σ- and 𝟐-types at each mode. Then every closed term of 𝟐 at any mode is judgmentally equal to 𝗍𝗍 or to 𝖿𝖿.
Proof of Theorem 160.13 — Canonicity for the frozen mode theory
Proof. Glue along the global-sections functor, as in construction 151.30, but with the displayed model indexed by modes: a displayed context over Γ at mode 𝑚 is a predicate on the closing substitutions of Γ, and the clause for a lock is 𝑅Γ.𝖫𝜇(𝜌)iff𝑅Γ(𝜌′)fortheclosingsubstitution𝜌′determinedby𝜌, which is well defined because 𝖫 is functorial in Γ and the lock equations of definition 160.11 are strict. The clause for ⟨𝜇∣𝐴⟩ is: 𝑆⟨𝜇∣𝐴⟩(𝜌,𝑡) holds iff 𝑡 is judgmentally equal to 𝗆𝗈𝖽𝜇(𝑡′) for some 𝑡′ with 𝑆𝐴 holding at the locked context. Closure under MTT-I is immediate; closure under the modal 𝗅𝖾𝗍 uses the 𝛽-rule together with the induction hypothesis at the locked context; and closure under MTT-Var uses the 2-cell 𝛼, whose induced substitution acts on the witnesses — here decidable equality of 2-cells is what makes the predicate a well-defined function of the annotation rather than of a chosen representative. The rest of the displayed model is lemma 151.31. Initiality supplies a section as in theorem 151.32, and instantiating it at a closed term of 𝟐 gives the disjunction. ◻
Theorem 160.13 is canonicity, not normalization. The normalization theorem for multimodal type theory — and with it decidability of conversion — is a separate result of the matching source, proved at its own frozen mode theory and conversion rules by a synthetic-Tait argument; it is not implied by anything above and is not restated here. In particular proposition 160.3 is a normalization statement for a simply typed calculus with one modality, and it donates nothing to the dependent or multimodal systems, exactly as remark 160.4 records; and theorem 160.7 is a soundness and initiality statement for a single dependent modality, which donates no multimodal theorem.
Let M𝗀 have one mode 𝗀, one generating modality ▹:𝗀→𝗀, no relations on 1-cells, and one generating 2-cell 𝗇𝖾𝗑𝗍:𝟏⇒▹, subject to no equations beyond those of a strict 2-category.
Proof of Proposition 160.16 — Guarded recursion is typable
Proof. (1) Under the lock 𝖫▹ the declaration 𝑎:𝟏𝐴 is usable exactly when a 2-cell 𝟏⇒▹ exists, which is 𝗇𝖾𝗑𝗍; MTT-Var then applies.
(2) Take 𝜆𝑓.𝜆𝑢.𝗅𝖾𝗍𝗆𝗈𝖽▹(𝑔)=𝑓𝗂𝗇𝗅𝖾𝗍𝗆𝗈𝖽▹(𝑎)=𝑢𝗂𝗇𝗆𝗈𝖽▹(𝑔𝑎). Both eliminations introduce a declaration at modality ▹, and inside the final 𝗆𝗈𝖽▹ the composite of locks is ▹, so both variables are usable by MTT-Var at the identity 2-cell.
(3) The isomorphism is the pair of the two projections and the pairing; it is an isomorphism because × is the product and ▹ is applied only to the second component, so no lock separates the two directions.
(4) A term of that type would, by MTT-Var applied under no lock, require a 2-cell ▹⇒𝟏 in M𝗀. By definition 160.15 the 2-cells are generated by 𝗇𝖾𝗑𝗍 in the direction 𝟏⇒▹ and closed under the two compositions, so every 2-cell out of ▹ has target a composite containing ▹; none has target 𝟏. Hence no such term exists. ◻
Proposition 160.16 is a statement about M𝗀 and its 2-cells. It resembles the staging discipline of chapter 129 in shape — a boundary, an introduction that crosses it, and a variable rule that does not — and differs from it in content. There is no code, no splice and no run: clause (4) is proved by inspecting 2-cells, and the corresponding staging fact is proved by inspecting an operational semantics. Neither proof transfers, and neither system’s theorem may be cited for the other.
A reflective subuniverse modality is an operation ◯ on the types of a single judgment, with a unit 𝐴→◯𝐴 and an induction principle making ◯𝐴 the reflection of 𝐴; its rules quantify over types at one mode and mention no context former. The modalities of definition 160.11 have the opposite signature: they act on judgments, they introduce a context former, and their introduction rule has a premise in a different context. A subuniverse modality therefore has a unit at every type, while ⟨𝜇∣−⟩ has one only when a 2-cell 𝟏⇒𝜇 exists, as proposition 160.16(1) shows. Nothing here assumes a reflective subuniverse, and no rule above may be read as providing one.
Cohesive and synthetic-differential programs instantiate definition 160.10 with mode theories whose modalities form an adjoint string, and they are developed in the literature with substantial further structure. They are named here and not developed: each requires a complete public proof at its own frozen mode theory, and a later mathematical use to justify the machinery. Nothing in this chapter’s statements depends on them.
★★☆ Add to M𝗀 a generating 2-cell ▹⇒𝟏 and show that proposition 160.16(4) then fails by exhibiting the term. What does the resulting calculus lose, and which clause of lemma 160.12 still holds?
★★☆ Show that the annotation 𝜇 on a declaration 𝑥:𝜇𝐴 cannot be omitted: give two derivations that differ only in the annotation and whose conclusions are different judgments, and locate the step of lemma 160.12 that consults it.
★★☆ Show that the single-modality calculus of definition 160.5 is the instance of definition 160.11 over the mode theory with one mode, one generating modality and no 2-cells, by matching the rules one by one. Which rule of definition 160.11 has no counterpart, and why does its absence not matter here?
The results are lemma 160.2 and proposition 160.3 for the simply typed lock calculus; theorem 160.7 for the single dependent modality and its CwDRA models; lemma 160.12 and theorem 160.13 for the multimodal calculus over a frozen mode theory; and proposition 160.16 for one application. Their separation is not editorial, and remark 160.14 states it: the simply typed normalization result donates no dependent theorem, the dependent right-adjoint calculus donates no multimodal theorem, and the multimodal normalization and decidability result is not proved here and is not implied by canonicity.
Three further boundaries. Theorem 160.13 requires decidable equality of 2-cells and the frozen signature named in its statement; a mode theory without that property is outside it. Proposition 160.16(4) is a statement about M𝗀 and, by remark 160.17, is neither implied by nor an implication of the operational results of chapter 129. And by remark 160.18 nothing above provides a reflective subuniverse; the two kinds of modality are distinguished by their rule signatures and are not interchangeable.
The consistency of the systems above rests on the model sequence built earlier: the CwF interface and initiality of chapter 54, the set and groupoid models of chapter 55, chapter 152 as sources of CwDRAs, and the strictification of chapter 56 for turning a categorical model with weakly stable structure into one satisfying the substitution equations of definition 160.6 on the nose. The optional model chapters are comparisons and are not premises of any statement above.
The proof base divides exactly. The simply typed Fitch calculus, its substitution lemma and its normalization by evaluation are [Clo18, VRC22a], with the accompanying mechanization [VRC22b] checking that simply typed statement only. The dependent lock calculus, the CwDRA interface of definition 160.6 and the term-model soundness of theorem 160.7 are [BCM^+20]. The mode theories, locks, annotated variables and modal types of definition 160.11, together with the multimodal metatheory, are treated at monograph length in [Gra23]; the judgmental and semantic prerequisites are [AG26].
★★★ Construct a CwDRA on the set model of definition 151.3: take 𝖫Γ:=Γ×𝑋 for a fixed set 𝑋 and find the corresponding 𝑅 and bijection. Verify all the naturality conditions of definition 160.6, and determine which modal axioms the resulting ◻ validates.
★★★ In the calculus of proposition 160.16, define the guarded stream of alternating booleans using ⊛ and a fixed point, state precisely which additional rule the fixed point requires, and prove that the definition is well typed once that rule is added. Then show that removing the rule leaves the stream undefinable.
★★★ Write out the lock clause in the proof of theorem 160.13 in full, including the verification that the displayed predicate is preserved by the substitution induced by a 2-cell. Identify exactly where decidable equality of 2-cells is used.
★★★Practical project.multimodal-lock-checker Implement a bidirectional type checker for the fragment of definition 160.11 with Π-types, 𝟐 and modal types, parameterized by a finite mode theory given as a table of modes, generating modalities and generating 2-cells with their composites. The invariant the checker must maintain is that a variable is accepted only when the recorded 2-cell witnesses 𝜇⇒locks(Γ′) in the given mode theory, and that every lock operation respects the two strict equations of definition 160.11. The program must print, for each named input, the computed lock composite at each variable occurrence, the accepted or rejected verdict with the missing 2-cell named on failure, and the normal form of a closed 𝟐 term. The acceptance test is: over M𝗀 of definition 160.15 the term 𝗇𝖾𝗑𝗍𝐴 of proposition 160.16(1) is accepted and ⊛ of clause (2) is accepted; the term of type ▹𝐴→𝐴 is rejected with the missing 2-cell ▹⇒𝟏 named, matching clause (4); adding that generating 2-cell to the table makes the same term accepted, matching exercise 160.3; and every closed 𝟐 term in the test suite normalizes to 𝗍𝗍 or 𝖿𝖿, illustrating theorem 160.13 on those inputs. A checker over a finite mode theory is evidence on named inputs: it proves neither theorem 160.13 nor any normalization statement, and by remark 160.14 it must not be described as deciding conversion in general.