Prerequisites. Direct starred prerequisites: none. No later core chapter depends on this route.
The relational translation of chapter 59 sends a derivation to a term. It is a function on derivations, and a derivation is not a value of any type, so a program of the theory cannot apply it. The statement we would like to have available inside the theory is forevery𝑓:∏𝑥:∑𝑦:U𝖤𝗅(𝑦)𝖤𝗅(𝗉𝗋1𝑥)andevery𝐴and𝑎:𝐴,𝑓(𝐴,𝑎)=𝑎. Adding (167.1) as an axiom breaks canonicity, by the argument of proposition 164.21. What is needed instead is a type former whose elements are the relational data, with binders that place them in the context and computation rules that let them reduce.
Cubical type theories supply such a former by adding an interval and paths along it. The calculus of this chapter does not: it adds one operator ∀ sending a type to the type of its logical spans, together with the operations that project a span to its legs, degenerate an element into a span, and exchange two span dimensions. Nothing in the syntax mentions a dimension variable, and nothing above dimension three appears.
The core theory is extensional Martin-Löf type theory with
a unit type 𝟏 with ⋆ and its uniqueness rule 𝑡=⋆;
dependent sums ∑𝑥:𝐴𝐵 with (𝑢,𝑣), 𝗉𝗋1, 𝗉𝗋2, the two computation rules and the uniqueness rule 𝑡=(𝗉𝗋1𝑡,𝗉𝗋2𝑡);
extensional identity types 𝖤𝗊𝐴(𝑢,𝑣) with 𝗋𝖾𝖿𝗅, equality reflection, and uniqueness of identity proofs;
dependent products ∏𝑥:𝐴𝐵 with 𝛽 and 𝜂;
a Coquand universe U with decoder 𝖤𝗅(−);
𝟐 with 𝗍𝗍, 𝖿𝖿 and the dependent eliminator 𝗂𝗍𝖾𝑦.𝐵𝑡𝑢𝑣.
We present it as a second-order theory: judgments are 𝐴 for types and 𝑡:𝐴 for terms, binders are written with a turnstile inside the operation, and no rule about contexts or substitutions is displayed, since substitution is that of the ambient second-order framework.
Equality reflection and uniqueness of identity proofs are used at two places below and nowhere else: they make 𝖤𝗊(,) strictly preserved by the span operator, and they make the preservation of 𝗋𝖾𝖿𝗅 automatic.
Read ∀𝐴 as the type of spans over 𝐴: an element has one leg 𝑘𝐴𝑎2 in 𝐴 for each 𝑘, and an apex which the type does not name. The operation 𝖺𝗉 says that a map preserves spans, and ∀𝖽 and 𝖺𝗉𝖽 are the dependent versions, over a given span in the base. The operation 𝖺𝗉𝖽 is the one that does the work in every application below.
The five equations grouped under Legs after the first line are the content of the two-dimensional structure, and each says one thing. The legs of a degenerate span are the element it came from. The two ways of taking a leg of a double span are related by 𝖲. The two ways of degenerating a span into a double span are related by 𝖲. Double symmetry is the identity. And on a triple span, swapping dimensions 0 and 1, then 1 and 2, then 0 and 1, agrees with swapping 1 and 2, then 0 and 1, then 1 and 2; with naturality this makes the induced symmetries of an 𝑛-fold span the full symmetric group.
Two formers are not preserved strictly, and each needs one further operation.
with the three equations 𝑘𝖽𝑥.∏𝑦:𝐵𝐶𝑎2(𝗆𝗄∀Π𝑎2𝑡𝑘𝑡)=𝑡𝑘,𝜆𝑦2.𝖺𝗉𝖽((𝑥,𝑓,𝑦).𝑓𝑦)(𝑎2,(𝗆𝗄∀Π𝑎2𝑡𝑘𝑡,𝑦2))=𝑡,𝗆𝗄∀Π𝑎2(𝑘𝖽𝑥.∏𝑦:𝐵𝐶𝑎2𝑡2)(𝜆𝑦2.𝖺𝗉𝖽((𝑥,𝑓,𝑦).𝑓𝑦)(𝑎2,(𝑡2,𝑦2)))=𝑡2. The operation 𝗎𝗇𝗌𝗉𝖺𝗇 of definition 167.2 plays the same role for U: the canonical map from 𝑎2:∀U to the span with apex ∀𝖽(𝑥.𝖤𝗅(𝑥))𝑎2, legs 𝖤𝗅(𝑘U𝑎2) and projections 𝑘𝖽𝑥.𝖤𝗅(𝑥)𝑎2 has 𝗎𝗇𝗌𝗉𝖺𝗇 as a section, and the three Universe equations of definition 167.3 say exactly that.
One might expect ∀(∏𝑦:𝐵𝐶)≅∏𝑦2:∀𝐵∀𝖽(𝑦.𝐶)𝑦2, matching the Σ equation. It fails from right to left. From an element of the left-hand side, 𝑘∏𝑦:𝐵𝐶 produces a function ∏𝑦:𝐵𝐶 at the legs. From an element of the right-hand side there is no way to produce one, because the right-hand side speaks only about spans and a leg of a span of functions is a function that the data does not mention. The premise of MkPi adds exactly that missing datum: functions 𝑡𝑘 at the legs, together with the square saying they are compatible with the function 𝑡 at the apex.
Proof of Proposition 167.6 — Spans of the four base formers
Proof. Items 1–3 and the isomorphism of item 4 are the corresponding equations of definition 167.3, definition 167.4; only the claim about projections needs an argument, and it is a calculation: 𝖺𝗉𝖽(𝑥.𝗉𝗋𝑘𝑡)𝑎2Σ−𝜂=𝗉𝗋𝑘(𝖺𝗉𝖽(𝑥.𝗉𝗋1𝑡)𝑎2,𝖺𝗉𝖽(𝑥.𝗉𝗋2𝑡)𝑎2)𝖺𝗉𝖽−𝑝𝑎𝑖𝑟=𝗉𝗋𝑘(𝖺𝗉𝖽(𝑥.(𝗉𝗋1𝑡,𝗉𝗋2𝑡))𝑎2)Σ−𝜂=𝗉𝗋𝑘(𝖺𝗉𝖽(𝑥.𝑡)𝑎2). ◻
Proof. For 1, 𝑎=𝑎[⋆/_], so 𝖱𝐴𝑎=𝖱𝐴(𝑎[⋆/_])=𝖺𝗉(_.𝑎)(𝖱𝟏⋆) by the second Legs equation, and 𝖱𝟏⋆=⋆ because ∀𝟏=𝟏 is a unit type.
For 2, both sides equal 𝖺𝗉(_.𝑏)⋆: 𝖺𝗉(_.𝑏)𝑎2𝑏=𝑏[⋆/_]=𝖺𝗉(_.𝑏)(𝖺𝗉(_.⋆)𝑎2)∀𝟏=𝟏=𝖺𝗉(_.𝑏)⋆, the second step because 𝖺𝗉(_.⋆)𝑎2 is an element of ∀𝟏=𝟏 and so is ⋆.
For 3, apply the Σ-uniqueness rule to 𝑘∑𝑥:𝐴𝐵(𝑎2,𝑏2) and compute the first projection by the first Legs equation applied to 𝖺𝗉(𝑤.𝗉𝗋1𝑤), using the Σ equation of definition 167.3; the second projection is 𝑘𝖽 by its definition in definition 167.2.
For 4, apply 3 to (𝑎2,𝖺𝗉𝖽(𝑥.𝑡)𝑎2)=𝖺𝗉𝖽(𝑥.(𝑥,𝑡))𝑎2 and use the first Legs equation on the right-hand side. ◻
★☆☆ Using ∀𝟐=𝟐 and lemma 167.7, compute 𝑘𝟐𝑏2 for 𝑏2:∀𝟐, and 𝖺𝗉(𝑥.𝗂𝗍𝖾_.𝟐𝑥𝖿𝖿𝗍𝗍)𝑏2. Then state what ∀𝟐=𝟐 says about a binary span over 𝟐, and why that does not make the two legs equal in a calculus with more than one leg.
Definition 167.2 presents the span operations as operations on types and terms. A second presentation makes them operations on contexts, and it is the one that the model of section 167.4 interprets directly.
The initial models of the local and the global theory are isomorphic, by mutually inverse maps 𝛼 from the global to the local syntax and 𝛽 back, both of which act as the identity on the core theory.
What is imported is the construction of 𝛼 and 𝛽 and the verification that they are mutually inverse, due to Altenkirch, Chamoun, Kaposi and Shulman, Internal Parametricity, without an Interval, §4. What it supplies here is the transfer of theorem 167.15, proved for the global syntax, back to the local one; because 𝛼 and 𝛽 fix the core theory, a closed Boolean term is fixed by both, and the transfer is the two-line argument displayed in that theorem’s proof.
The category ◻ has the natural numbers as objects. Its morphisms are generated by a category structure together with 𝗌𝗎𝖼:◻(𝐽,𝐼)→◻(1+𝐽,1+𝐼),𝑘𝐼:◻(𝐼,1+𝐼),𝖱𝐼:◻(1+𝐼,𝐼),𝖲𝐼:◻(2+𝐼,2+𝐼), subject to 𝗌𝗎𝖼(𝑓∘𝑔)=𝗌𝗎𝖼𝑓∘𝗌𝗎𝖼𝑔,𝗌𝗎𝖼id=id,𝑘𝐼∘𝑓=𝗌𝗎𝖼𝑓∘𝑘𝐽,𝖱𝐼∘𝗌𝗎𝖼𝑓=𝑓∘𝖱𝐽,𝖲𝐼∘𝗌𝗎𝖼(𝗌𝗎𝖼𝑓)=𝗌𝗎𝖼(𝗌𝗎𝖼𝑓)∘𝖲𝐽,𝖱𝐼∘𝑘𝐼=id𝐼,𝖲𝐼∘𝑘1+𝐼=𝗌𝗎𝖼𝑘𝐼,𝖱1+𝐼∘𝖲𝐼=𝗌𝗎𝖼𝖱𝐼,𝖲𝐼∘𝖲𝐼=id2+𝐼,𝖲1+𝐼∘𝗌𝗎𝖼𝖲𝐼∘𝖲1+𝐼=𝗌𝗎𝖼𝖲𝐼∘𝖲1+𝐼∘𝗌𝗎𝖼𝖲𝐼. Equivalently, ◻ is the free symmetric semicartesian strict monoidal category on a cylinder; the last equation is the braid relation, so the automorphisms of the object 𝐼 are the permutations of an 𝐼-element set.
Define, by induction on 𝐼0, (sym0,1∣id𝐼1):=id1+𝐼1,(sym1+𝐼0,1∣id𝐼1):=𝖲𝐼0+𝐼1∘𝗌𝗎𝖼(sym𝐼0,1∣id𝐼1),(sym1,0∣id𝐼1):=id1+𝐼1,(sym1,1+𝐼0∣id𝐼1):=𝗌𝗎𝖼(sym1,𝐼0∣id𝐼1)∘𝖲𝐼0+𝐼1. Then the two composites are the identities on 1+𝐼0+𝐼1 and on 𝐼0+1+𝐼1 respectively.
Proof. By induction on 𝐼0. At 𝐼0=0 both are identities by definition. At 1+𝐼0, (sym1+𝐼0,1∣id)∘(sym1,1+𝐼0∣id)𝑑𝑒𝑓.=𝖲∘𝗌𝗎𝖼(sym𝐼0,1∣id)∘𝗌𝗎𝖼(sym1,𝐼0∣id)∘𝖲𝐼𝐻=𝖲∘𝖲𝖲𝖲=id=id, using functoriality of 𝗌𝗎𝖼 at the middle step. The other composite is the same calculation with the two definitions exchanged. ◻
The presheaf category [◻op,𝐒𝐞𝐭] carries a model of the global theory, in which ∀ is precomposition by 𝗌𝗎𝖼, and 𝑘, 𝖱, 𝖲 are precomposition by the generators of the same names.
Proof.Proof structure. The core theory is interpreted by the standard presheaf model of chapter 52: contexts are presheaves, types over Γ are presheaves on the category of elements, and the formers of definition 167.1 are the pointwise ones, with U a Hofmann–Streicher universe. What must be added is the interpretation of the span structure, and each item of definition 167.8 is one line.
The endofunctor. Set (∀Γ)𝐼:=Γ1+𝐼, with the action of 𝑓:◻(𝐽,𝐼) given by 𝗌𝗎𝖼𝑓. Functoriality is the first two equations of definition 167.10, and preservation of the terminal presheaf is immediate since 𝟏 is the constant one-point presheaf. The action on types and terms is the same reindexing, so it commutes with substitution.
The three transformations. Set 𝑘Γ, 𝖱Γ and 𝖲Γ to be precomposition by 𝑘𝐼, 𝖱𝐼 and 𝖲𝐼. Naturality is the third, fourth and fifth equations of definition 167.10, contravariantly; the remaining four equations of definition 167.10 become, again contravariantly, the four equations required in definition 167.8, with the braid equation last.
Strict preservation.𝟏, Σ, 𝖤𝗊(,) and 𝟐 are interpreted pointwise, and reindexing along 𝗌𝗎𝖼 commutes with a pointwise former; hence each is preserved on the nose.
Π and U. Neither is pointwise. For Π, an element of ∀(Π𝐵𝐶) at 𝐼 is an element of (Π𝐵𝐶) at 1+𝐼, which is a family of functions indexed by morphisms out of 1+𝐼; splitting those morphisms according to whether they factor through 𝑘 gives exactly the triple (𝑡𝑘,𝑡,𝑒) of MkPi, and the splitting is a bijection by the case analysis on ◻-morphisms that lemma 167.11 makes available. For U, the canonical map to the span of its decodings has a section by the same case analysis; the reverse round trip is not the identity in this model, which is why definition 167.4 asks only for a section and definition 167.3 lists only the three Universe equations. ◻
Let Syn be the initial model of the global theory and let 𝐺:Syn→[◻op,𝐒𝐞𝐭] be the global-sections functor, 𝐺Γ𝐼:=Sub(◻-shapedcontext,Γ) at dimension 𝐼, extended to types and terms in the standard way. The gluing model is the displayed model over Syn whose displayed types over 𝐴 are predicates on the global sections of 𝐴, closed under the formers, and whose displayed terms are proofs.
Proof of Lemma 167.14 — G preserves the span structure
Proof. For ∀, unfolding the two definitions at dimension 𝐼, 𝐺(∀Γ)𝛾1+𝐼𝑑𝑒𝑓.𝑜𝑓𝐺=∀𝐼(∀Γ)[𝛾1+𝐼]𝑑𝑒𝑓.𝑜𝑓∀=∀1+𝐼Γ[𝛾1+𝐼]𝑑𝑒𝑓.𝑜𝑓𝐺=(𝐺Γ)𝛾1+𝐼𝑑𝑒𝑓.𝑖𝑛[◻op,𝐒𝐞𝐭]=∀(𝐺Γ)𝛾1+𝐼. For 𝑘, 𝐺𝑘Γ𝛾1+𝐼𝑑𝑒𝑓.𝑜𝑓𝐺=∀𝐼𝑘Γ∘𝛾1+𝐼𝑑𝑒𝑓𝑖𝑛𝑖𝑡𝑖𝑜𝑛167.10=𝛾1+𝐼[𝑘𝐼]𝑑𝑒𝑓.=𝑘𝐺Γ𝛾1+𝐼, and the arguments for 𝖱 and 𝖲 are the same computation with 𝖱𝐼 and 𝖲𝐼 in place of 𝑘𝐼, using the corresponding generator of definition 167.10. ◻
Proof.Global syntax. Glue along 𝐺, using lemma 167.14 to know that the displayed model of definition 167.13 is a model of the global theory. Induction on Syn interprets a closed 𝑡:𝟐 as a term of Tm[◻op,𝐒𝐞𝐭](𝐺⋅𝟏.)(∑:𝟐𝖤𝗊(𝗂𝗍𝖾𝐪(𝐺𝗍𝗍[𝐩])(𝐺𝖿𝖿[𝐩]),𝐺𝑡[𝐩])). Supplying id⋅ and the element of the metatheoretic unit set yields a pair consisting of a metatheoretic Boolean 𝑏 together with a proof that 𝗂𝗍𝖾𝑏𝗍𝗍𝖿𝖿=𝑡; case analysis on 𝑏 gives the two alternatives.
Local syntax. Let 𝑡 be closed of type 𝟐 in the local syntax. By theorem 167.9, 𝛼𝑡 is a closed term of type 𝟐 in the global syntax, since 𝛼 acts as the identity on the core theory and 𝟐, ⋅ belong to it. The previous paragraph gives, say, 𝛼𝑡=𝗍𝗍. Applying 𝛽 and using that 𝛽 also fixes the core theory, 𝑡𝛽𝛼=id=𝛽(𝛼𝑡)ℎ𝑦𝑝𝑜𝑡ℎ𝑒𝑠𝑖𝑠=𝛽𝗍𝗍𝛽𝑓𝑖𝑥𝑒𝑠𝑡ℎ𝑒𝑐𝑜𝑟𝑒=𝗍𝗍. ◻
Proof of Theorem 167.16 — Uniqueness of the polymorphic identity
Proof. The unary calculus suffices, so 𝑘 has one value.
The span. Let 𝑥:𝐴⊢𝑃 be any predicate and let 𝑝:𝑃[𝑎/𝑥]. Form 𝑠:=𝗎𝗇𝗌𝗉𝖺𝗇𝐴(∑𝑥:𝐴𝑃)(𝑥.𝗉𝗋1𝑥):∀U, whose leg is 𝐴, whose apex is ∑𝑥:𝐴𝑃, and whose projection is the first projection. Then (𝑠,(𝑎,𝑝)) is an element of ∀(∑𝑦:U𝖤𝗅(𝑦)), by the Σ equation of definition 167.3 together with the second Universe equation.
The term. Apply 𝖺𝗉𝖽 to 𝑓: 𝑢:=𝖺𝗉𝖽(𝑥.𝑓𝑥)(𝑠,(𝑎,𝑝)). Its type computes as ∀𝖽(𝑥.𝖤𝗅(𝗉𝗋1𝑥))(𝑠,(𝑎,𝑝))𝑓𝑢𝑛𝑐𝑡𝑜𝑟𝑖𝑎𝑙𝑖𝑡𝑦=∀𝖽(𝑥.𝖤𝗅(𝑥))(𝖺𝗉(𝑥.𝗉𝗋1𝑥)(𝑠,(𝑎,𝑝)))𝑙𝑒𝑔𝑠𝑜𝑓𝑎𝑝𝑎𝑖𝑟=∀𝖽(𝑥.𝖤𝗅(𝑥))𝑠𝐔𝐧𝐢𝐯𝐞𝐫𝐬𝐞=∑𝑥:𝐴𝑃.
The first component. Compute 𝗉𝗋1𝑢: 𝗉𝗋1𝑢𝑡ℎ𝑖𝑟𝑑𝐔𝐧𝐢𝐯𝐞𝐫𝐬𝐞𝑒𝑞.=𝑘𝖽𝑥.𝖤𝗅(𝑥)𝑠𝑢𝑙𝑒𝑚𝑚𝑎167.7(3)=𝑘𝖽𝑥.𝖤𝗅(𝗉𝗋1𝑥)(𝑠,(𝑎,𝑝))𝑢𝑙𝑒𝑚𝑚𝑎167.7(4)=(𝑓𝑥)[𝑘∑𝑦:U𝖤𝗅(𝑦)(𝑠,(𝑎,𝑝))/𝑥]𝑙𝑒𝑚𝑚𝑎167.7(3)=𝑓(𝑐𝐴,𝑎), using in the last step that the leg of 𝑠 is 𝐴, whose code is 𝑐𝐴, and that the projection sends (𝑎,𝑝) to 𝑎.
Conclusion. Hence 𝗉𝗋2𝑢:𝑃[𝑓(𝑐𝐴,𝑎)/𝑥]. Choose 𝑃:=𝖤𝗊𝐴(𝑎,𝑥) and 𝑝:=𝗋𝖾𝖿𝗅; then 𝗉𝗋2𝑢:𝖤𝗊𝐴(𝑎,𝑓(𝑐𝐴,𝑎)), and symmetry of the extensional identity type gives the stated inhabitant. ◻
Theorem 167.16 is (167.1), proved by a term of the calculus rather than by a metatheoretic translation, and by theorem 167.15 the calculus containing that term still has canonical Booleans. The predicate 𝑃 was arbitrary: the same term proves that 𝑓 preserves every predicate, which is the internal form of the free theorem of example 164.15.
Redo the construction in the binary calculus, with 𝑠 replaced by an 𝗎𝗇𝗌𝗉𝖺𝗇 over two types 𝐴0,𝐴1 and two maps out of a relation, and state the conclusion it yields about 𝑓(𝑐𝐴0,𝑎0) and 𝑓(𝑐𝐴1,𝑎1).
State which of the two conclusions is stronger and why the unary one does not follow from the binary one by taking 𝐴0=𝐴1.
★★★ Let 𝑁:=∏𝑥:∑𝑦:∑𝑧:U𝖤𝗅(𝑧)(𝖤𝗅(𝗉𝗋1𝑦)→𝖤𝗅(𝗉𝗋1𝑦))𝖤𝗅(𝗉𝗋1(𝗉𝗋1𝑥)) be the type of Church numerals, with 𝗓𝖾𝗋𝗈:=𝜆𝑥.𝗉𝗋2(𝗉𝗋1𝑥), 𝗌𝗎𝖼:=𝜆𝑛.𝜆𝑥.𝗉𝗋2𝑥(𝑛𝑥) and 𝗂𝗍𝖾(𝐴,𝑧𝐴,𝑠𝐴):=𝜆𝑛.𝑛(𝐴,𝑧𝐴,𝑠𝐴).
Using the binary calculus and 𝗆𝗄∀Π, show that 𝗂𝗍𝖾 respects algebra morphisms: for 𝑓 with 𝑓𝑧𝐴=𝑧𝐵 and 𝑓(𝑠𝐴𝑛)=𝑠𝐵(𝑓𝑛), 𝑓(𝗂𝗍𝖾𝐴𝑛)=𝗂𝗍𝖾𝐵𝑛.
Using the unary calculus, show that (𝑁,𝗓𝖾𝗋𝗈,𝗌𝗎𝖼) is initial among algebras, and state which premise of MkPi carries the compatibility square in each part.
Say why the same argument cannot be carried out by the external translation of chapter 59 without adding an axiom.
Indexed heterogeneous bridges. The operator ∀ takes a type to the spans over it. A relation between two different types indexed by a further parameter is a different former with different rules, and no clause of definition 167.3 is a rule for one.
Fibrancy and transport. A span is not a path: nothing above provides a transport operation along a span, and none is derivable, since ∀ has no elimination rule beyond the legs.
Normalization.Definition 167.1 has equality reflection, so conversion is undecidable. A normalization theorem would concern a variant of the theory without reflection, and no such variant is constructed here.
Higher dimensions. The syntax mentions no cube above dimension three: 𝖲 is two-dimensional and its braid equation is three-dimensional. The model of theorem 167.12 has cubes of every dimension, and a statement about them is a statement about the model, not about the theory.
Show that the objects 0,1,2 have respectively one, 1+|𝑘| and a computable number of morphisms into 1, by listing them.
Prove that the automorphism group of the object 𝐼 is the symmetric group on 𝐼 letters, using lemma 167.11 and the braid equation.
Show that ◻ is semicartesian but not cartesian, by exhibiting a morphism that no diagonal could provide, and say which equation of definition 167.10 a diagonal would have to satisfy.
★★★Practical project.span-calculus-checker Implement, in Kappa, a checker for the local span calculus and run it on the terms of this chapter.
Calculus to implement. The core theory of definition 167.1 restricted to 𝟏, Σ, extensional 𝖤𝗊(,), Π, 𝟐 and a single universe U with 𝖤𝗅(−); and the span operations of definition 167.2–definition 167.4. Represent terms with de Bruijn indices, and implement the equations of definition 167.3 as a left-to-right rewriting relation with a fuel bound, so that conversion is decided by rewriting both sides to a normal form of that relation and comparing — which is a decision procedure for the displayed equations, not for the conversion of definition 167.1, whose equality reflection the checker does not implement.
Invariant. Every rewrite must be an instance of exactly one equation of definition 167.3 or definition 167.4, and the checker must record which one; the recorded sequence for each accepted judgment is the certificate. The checker must also verify the compatibility square of MkPi whenever 𝗆𝗄∀Π is applied, and reject when it fails.
Concrete result. For each named input, an accept or reject verdict together with the rewrite certificate, or the offending premise.
Acceptance test. The following must be accepted with the printed certificate matching the chapter: the four computations of proposition 167.6; the four derived equations of lemma 167.7, each as a rewrite from left to right; the type computation of 𝑢 in theorem 167.16, whose certificate must be exactly the three steps displayed there; and the computation of 𝗉𝗋1𝑢, whose certificate must be the four steps displayed there, ending at 𝑓(𝑐𝐴,𝑎). The following must be rejected: an application of 𝗆𝗄∀Π whose square premise is omitted; a use of 𝗎𝗇𝗌𝗉𝖺𝗇 whose apex and legs do not match the supplied maps; and a term asserting the reverse round trip for U, which definition 167.4 does not provide. Produce three mutations that still run — make ∀ preserve Π strictly, drop 𝖲∘𝖲=id, and let 𝗎𝗇𝗌𝗉𝖺𝗇 be a full inverse — and confirm that each accepts a judgment the unchanged checker rejects. State explicitly that the program checks the displayed equations on finitely many terms and proves neither theorem 167.15 nor theorem 167.12.