Année : 2004 N^{o} attribué par la bibliothèque

THÈSE

présentée à

l’ÉCOLE POLYTECHNIQUE

pour obtenir le titre de DOCTEUR EN SCIENCES Spécialité Informatique

soutenue par

Didier Le Botlan

le 06/05/2004

Titre

MLF : Une extension de ML avec polymorphisme de second ordre

et instanciation implicite.

Directeur de thèse : Didier Rémy INRIA Rocquencourt

Jury

Directeur  Didier Rémy
Rapporteurs  Benjamin Pierce

Jacques Garrigue

Président  Roberto Di Cosmo
Examinateurs  Claude Kirchner

Dale Miller 2 2

Abstract

We propose a type system MLF that generalizes ML with first-class polymorphism as in System F. Expressions may contain second-order type annotations. Every typable expression admits a principal type, which however depends on type annotations. Principal types capture all other types that can be obtained by implicit type instantiation and they can be inferred.

All expressions of ML are well-typed without any annotations. All expressions of System F can be mechanically encoded into MLF by dropping all type abstractions and type applications, and injecting type annotations of lambda-abstractions into MLF types. Moreover, only parameters of lambda-abstractions that are used polymorphically need to remain annotated.

Keywords:

Type Inference, First-Class Polymorphism, Second-Order Polymorphism, System F, ML, Type Annotations.

Résumé

Nous nous intéressons à une extension de ML avec polymorphisme de première classe, à la manière du Système F. Cette extension, nommée MLF, utilise les annotations de types d’ordre supérieur données explicitement dans le programme pour inférer de manière principale le type le plus général. Toute expression admet ainsi un type principal, qui dépend des annotations présentes initialement dans le programme.

Toute expression de ML est typable dans MLF sans annotation supplémentaire. Les expressions du Système F sont encodées de manière systématique dans MLF en supprimant les abstractions et les applications de types, et en traduisant les annotations de types dans le langage de types de MLF. De plus, les paramètres de lambda-abstractions qui ne sont pas utilisés de manière polymorphe n’ont pas besoin d’être annotés.

Mots Clefs

Inférence de types, Polymorphisme de première classe, Polymorphisme d’ordre deux, Système F, ML, Annotations de type 4 4

Contents

Abstract / Résumé  3

Introduction  11
Conventions  33

I Types  35
1 Types, prefixes, and relations under prefixes  37
1.1 Syntax of types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
1.2 Prefixes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
1.3 Occurrences . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
1.3.1 Skeletons . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
1.3.2 Projections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
1.3.3 Free type variables and unbound type variables . . . . . . . . . . 41
1.3.4 Renamings and substitutions . . . . . . . . . . . . . . . . . . . . 42
1.4 Relations under prefix . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
1.5 Type equivalence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
1.5.1 Rearrangements . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
1.5.2 Occurrences and equivalence . . . . . . . . . . . . . . . . . . . . . 50
1.5.3 Canonical forms for types . . . . . . . . . . . . . . . . . . . . . . 51
1.6 The abstraction relation . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
1.7 The instance relation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
1.8 Examples . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
2 Properties of relations under prefixes  63
2.1 Projections and instantiation . . . . . . . . . . . . . . . . . . . . . . . . 65
2.2 Canonical representatives and bounds in a prefix . . . . . . . . . . . . . 69

2.3 Restricted and thrifty derivations . . . . . . . . . . . . . . . . . . . . . . 69
2.4 Contexts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
2.5 Local abstraction and instance rules . . . . . . . . . . . . . . . . . . . . 77
2.5.1 Context-based rules . . . . . . . . . . . . . . . . . . . . . . . . . 78
2.5.2 Alternative abstraction and alternative instance . . . . . . . . . . 80
2.6 Atomic instances . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83
2.6.1 Definitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84
2.6.2 Equivalence between relations . . . . . . . . . . . . . . . . . . . . 85
2.7 Equivalence vs instantiation . . . . . . . . . . . . . . . . . . . . . . . . . 86
2.7.1 Polynomials . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86
2.7.2 Weight . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88
2.7.3 Abstraction is well-founded . . . . . . . . . . . . . . . . . . . . . 97
2.8 Confluence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98
3 Relations between prefixes  101
3.1 Substitutions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101
3.2 Prefix instance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103
3.3 Domains of prefixes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104
3.4 Rules for prefix equivalence, abstraction, and instance . . . . . . . . . . 104
3.5 Splitting prefixes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111
3.6 Prefixes and Instantiation . . . . . . . . . . . . . . . . . . . . . . . . . . 113
4 Unification  119
4.1 Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120
4.2 Auxiliary algorithms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121
4.3 Unification algorithm . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124
4.4 Soundness of the algorithm . . . . . . . . . . . . . . . . . . . . . . . . . 126
4.5 Termination of the algorithm . . . . . . . . . . . . . . . . . . . . . . . . 128
4.6 Completeness of the algorithm . . . . . . . . . . . . . . . . . . . . . . . . 131

II The programming language  139
5 Syntax and semantics  143
5.1 Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143
5.2 Static semantics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144
5.2.1 ML as a subset of MLF . . . . . . . . . . . . . . . . . . . . . . . 146
5.2.2 Examples of typings . . . . . . . . . . . . . . . . . . . . . . . . . 146
5.3 Syntax-directed presentation . . . . . . . . . . . . . . . . . . . . . . . . . 149
5.4 Dynamic semantics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149

6 Type Safety  151
6.1 Standard Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151
6.1.1 Renaming and substitutions . . . . . . . . . . . . . . . . . . . . . 151
6.1.2 Strengthening and weakening typing judgments . . . . . . . . . . 152
6.1.3 Substitutivity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154
6.2 Equivalence between the syntax-directed system and the original system 155
6.3 Type safety . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157
7 Type inference  163
7.1 Type inference algorithm . . . . . . . . . . . . . . . . . . . . . . . . . . . 163
7.2 Soundness of the algorithm . . . . . . . . . . . . . . . . . . . . . . . . . 164
7.3 Completeness of the algorithm . . . . . . . . . . . . . . . . . . . . . . . . 165
7.4 Decidability of type inference . . . . . . . . . . . . . . . . . . . . . . . . 168
8 Type annotations  171
8.1 MLF without type annotations . . . . . . . . . . . . . . . . . . . . . . . 171
8.2 Introduction to type annotations . . . . . . . . . . . . . . . . . . . . . . 174
8.3 Annotation primitives . . . . . . . . . . . . . . . . . . . . . . . . . . . . 174

III Expressiveness of MLF  177
9 Encoding System F into MLF  181
9.1 Definition of System F . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181
9.2 Encoding types and typing environments . . . . . . . . . . . . . . . . . . 182
9.3 Encoding expressions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183
10 Shallow MLF  187
10.1 Definition and characterization . . . . . . . . . . . . . . . . . . . . . . . 187
10.2 Expressiveness of Shallow MLF . . . . . . . . . . . . . . . . . . . . . . . 190
10.3 Comparison with System F . . . . . . . . . . . . . . . . . . . . . . . . . 191
10.3.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 191
10.3.2 Preliminary results about System F . . . . . . . . . . . . . . . . 192
10.3.3 Encoding shallow types into System F . . . . . . . . . . . . . . . 194
10.3.4 Encoding Shallow F into System F . . . . . . . . . . . . . . . . . 197
10.4 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 200
11 Language extensions  203
11.1 Tuples, Records . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203
11.2 References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 204
11.3 Propagating type annotations . . . . . . . . . . . . . . . . . . . . . . . . 206

12 MLF in practice  209
12.1 Some standard encodings . . . . . . . . . . . . . . . . . . . . . . . . . . 209
12.2 Existential Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 210
12.3 When are annotations needed ? . . . . . . . . . . . . . . . . . . . . . . . 211
12.4 A detailed example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 212
12.5 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 216

Conclusion  217

Bibliography  223

IV Appendix  229
A Proofs (Technical details)  231

Indexes  319
Index of rules  319
Index of notations  322

Acknowledgments

Ma propre expérience, quoique limitée, m’incite à croire que mener à bien une thèse reste moins difficile qu’élever un bébé. Cependant, ceci ne révèle rien de la difficulté à diriger une thèse. Je tiens à remercier chaleureusement Didier Rémy pour avoir accepté le rôle de directeur de thèse qu’il a exercé avec une attention et une patience exemplaires. Parmi une multitude d’autres enseignements, il m’a montré l’importance de prendre du recul en recadrant le travail en cours, même inachevé, dans un contexte plus large. J’ai pu bénéficier avec joie de sa connaissance pointue de TEX , incarnée notamment dans le très utile WhizzyTEX .

Je remercie tout particulièrement Benjamin Pierce et Jacques Garrigue, rapporteurs, pour l’attention particulière qu’ils ont portée à mon travail, ainsi que les nombreuses heures de décalage horaire qu’ils ont dû subir pour participer à la soutenance. Leurs suggestions furent particulièrement bienvenues et me seront profitables à l’avenir. Merci également aux autres membres du jury pour l’intérêt qu’ils ont manifesté envers ma thèse : Roberto Di Cosmo, Claude Kirchner, et Dale Miller. Je remercie au passage Roberto pour son intervention salvatrice sur mon ordinateur portable, réalisée grâce à Demolinux.

Merci à tous les membres de ma famille pour leur soutien inépuisable : mes parents, mes beaux-parents, mon épouse, et à sa manière, mais tout aussi inépuisable, Pierre-Gilles.

Merci à Vincent Simonet pour ses multiples compétences, notamment sa relecture minutieuse et sa maîtrise de TeX. J’ai aussi apprécié l’aide linguistique apportée par James Leifer.

Tous les membres du projet Cristal, passés et présents, se caractérisent par une disponibilité exceptionnelle. Merci en particulier à Xavier Leroy qui prend toujours le temps de partager ses vastes connaissances alors même que sa nouvelle fonction de directeur de projet ne lui laisse que peu de temps.

Je remercie Jean-Jacques Lévy pour avoir su présenter la recherche en informatique de manière motivante, ainsi que pour les sorties piscine. Maxence Guesdon étant complice, je le remercie également.

10

Introduction

In 1965, Gordon Moore made an observation which has since become famous: the number of transistors per integrated circuit grows exponentially. This singular phenomenon has been maintained for forty years. As a consequence, computers are more and more powerful and fast, allowing more and more programmers to write ever larger and more complex programs. A less pleasant consequence is that the number of ill-written programs follows the same curve. Fortunately, research on programming languages brings solutions to help the programmer in keeping his mental health. One of the most efficient technique is static typechecking. Static typechecking can be viewed as a validation done by the compiler that guarantees that the program will not perform illegal operations, that is, will not crash. For instance, it ensures that every data structure will be manipulated only by suitable functions. We usually say that “well-typed programs do not go wrong”. Moreover, in practice, a large proportion of errors is automatically detected by typechecking, and this considerably accelerates program development.

In order to typecheck a program, a compiler may require explicit type information in the source program itself, as is the case in C or Java, where each variable and function declaration needs to be annotated with types. This is acceptable when the types are simple. However, in order to get more expressiveness power and to be able to typecheck more complex programs, it is necessary to introduce a richer syntax for types. This is the case for example with higher-order functional languages, such as ML [DM82]. Then smart compilers perform type inference (also called type reconstruction) in order to find by themselves the type annotations. In the case of ML, the type inference algorithm is complete, which means that no type annotation is needed in the program, and all the information may be inferred by the typechecker (i.e. by the compiler). It is still possible, though, to write explicit type annotations for documentation purposes.

Types provide an approximation of programs and the typechecker may reject wellbehaved programs it cannot type. Such a limitation can be encountered in monomorphically typed systems, where each function can only be used with one single type. In that case, a given function cannot be applied to two data structures with incompatible types. For example, the function List.length, which returns the number of elements of the list it is applied to, could only be used with lists of integers, and another function should be defined to operate on lists of strings. However, both functions have the same code, but only their types are different. This useless duplication of code can be avoided thanks to more expressive type systems. Indeed, many solutions have been proposed in order to typecheck functions applied to arguments of incompatible types. They include type systems based on subtyping, intersection types, and parametric polymorphism. We immediately discard the solution used in C or Java which consists in casting the type of expressions to void* or Object in order to put them in a general-purpose structure. When taking an element out of the structure, some unsafe operation, such as a cast from Object to a given class or from void* to a given pointer type, is needed. In the worst case it breaks type safety and well-typed programs do not necessarily behave well; in the best case dynamic typechecks are performed at run-time. In both cases, some type errors are only detected at run-time, which is not satisfying in our opinion. We describe quickly the other solutions mentioned above.

Subtyping allows some information in types [Car88, Mit83, Pot98b] to be forgotten. For example, integers and floating point numbers are usually of incomparable types, but both can be viewed as members of the more general type “number”. A list of integers can then be viewed as a list of numbers, or even as an unspecified list, forgetting the type information about the content of the list. To pursue the example given above, the function List.length can then be applied to any unspecified list, including, by subtyping, lists of integers and lists of strings. Extensions of ML with subtyping that allow for type inference have been designed [OSW99, Pot98a]. They remain to be tested on large-scale developments. One step towards integration within a large-scale framework is Flow Caml [Sim03], an information flow analyzer for the Caml language based on subtyping.

Intersection types enumerate precisely the different types a given value can have, and may be viewed as a refinement of subtyping [CDC78, CDCS79, Sal82, Pot80, Pie91]. For instance, List.length can be given an intersection type that states that it is both a function accepting lists of integers and a function accepting lists of strings. Intersection types are in some way as expressive as programs themselves [CC90]. In particular, a program is typable with intersection types if and only if it terminates [Pot80]. Some restrictions based on ranks have been proposed to integrate intersection types within a programming language with type inference [KW99, Jim00]. However, such restrictions interfere with modularity: a value cannot always be passed as an argument if the rank of its type is too high. Indeed, the type of the function being applied needs to be of a higher rank, which might be forbidden. Hence, although intersection types enjoy useful properties, they are too expressive and must be limited in practice.

Parametric polymorphism, which we simply call polymorphism, allows quantification over some type variables in types. Then any polymorphic expression may have an infinite number of types. For example, List.length is a function accepting lists of α, whatever α is. We develop our presentation of parametric polymorphism hereafter.

These solutions provide a way to use a single function with different types, that is, to apply a single function to data structures with incompatible types. They all help to avoid unnecessary duplication of code, and therefore contribute to keeping the program concise. In the ML language, the third solution, parametric polymorphism, is used. More precisely, the ML typechecker is able to infer polymorphic types for named functions. In particular all functions defined at top-level are assigned a polymorphic type if possible. This feature greatly contributes to ML’s conciseness and expressiveness. Moreover, even though the cost for type inference is exponential in theory, it appears to be very efficient in practice. The success of ML suggests that parametric polymorphism is an expressive feature that applies well to large scale programs.

Second class polymorphism

Polymorphism in ML is second-class only: as mentioned above, only named values may have a polymorphic type, that is, only values bound with a let construct. As a consequence, it is not possible for the argument of a function to be used with a polymorphic type. For instance, let id be the identity function, that is, λ(x) x. Its type in ML is polymorphic and equal to ∀ (α) α → α, which we write σ_{id}. Then (λ(x) x x) id (\underline{1}) is not typable in ML, whereas let x = id in x x (\underline{2}) is. Indeed, typing the body of the function λ(x) x x would require x to have a polymorphic type, e.g. σ_{id}. However, x is not bound by a let but by a λ. Hence, its type is monomorphic in ML, and the typing of (1) fails. On the contrary, x is first bound by a let construct in (2), and then the body x x is typed. In ML, this allows us to infer a polymorphic type for x, namely σ_{id}, which suffices to typecheck (2). This example illustrates why polymorphism in ML is second-class only; that is, because it is not allowed in λabstractions. It also shows that the let construct may, in some situations, circumvent this limitation. However, there are some situations where let-polymorphism a la ML is not enough.

Motivation

We detail our motivation for this thesis whose contribution is a programming language named MLF. Our starting point is ML.

Actually, ML is surprisingly powerful in defining, handling, and iterating over complex data structures. Indeed, data structures are usually typed using parametric type constructors such as built-in types or user-defined datatypes. The type parameter represents the type of values to be found in the structure. As an example, a list of elements with type α is given the parametric type α list in OCaml [LDG^{+}02]. Then the associated constructors such as the empty list, the cons operator, or userdefined constructors are automatically given a polymorphic type with outer quantification. For example, the empty list is given the type ∀ (α) α list. Most functions defined on these data structures, such as iterators, are also given polymorphic types with outer quantification. For instance, List.fold is given the polymorphic type ∀ (α, β) β list → (α → β → α) → α → α.

As long as the data structure is known to the programmer, ML is perfectly suitable, and outer-polymorphism makes it possible to take many instances of the data structure and fill them with values of different types. Indeed, one can use the constructors for lists to build lists of integers, lists of arrays, or more generally, lists of α, whatever α is. No coercion of explicit type information is needed in the program. This is not true in some programming languages such as C or Java. Noticeably, the introduction of type parameters has been studied in the case of Java [BOSW98].

However, as soon as more abstraction is needed, ML is no longer sufficient. Indeed, assume the data structure is not known to the programmer: he wishes to write a function taking an unknown data structure as an argument, as well as an iterator over this data structure. Then the ML type system requires the data structure and the iterator to be monomorphic. It is no longer possible to explore the data structure using incompatible instances of the iterator.

As an example, consider a program that takes a list as an input data structure and only manipulates that list through the function List.fold ls. Such a program can always take the following form:

         λ(ls)
           let fold = List.fold ls in
           a_{2}

where ls does not occur free in a_{2}. In order to offer more flexibility, the programmer may leave the underlying implementation of the data structure abstract. Then this piece of code would become a function expecting only an iterator: λ(fold)a_{2}. Consequently, it would be possible to use this function with different data structures such as lists, balanced trees, hashtables, etc. Unfortunately, such a function is not typable in ML as soon as its argument is used polymorphically. Observe that this requires only traversing the data structure using two incompatible instances of fold. In Chapter 12, we develop a similar example using a prototype implementation of MLF. Another related example is given Section 11.1 (page 203); it shows that the encoding of pairs in System F is not correct in ML.

First-class polymorphism (also called second-order polymorphism) makes it possible to typecheck such examples; we describe it more precisely in the next section. Then the argument fold can be given the polymorphic type ∀ (α) (α → β → α) → α → α), where β stands for the type of elements of the data structure.

As a summary, abstraction over data structures is not possible in core-ML (although some implementations allows it at the module level). More generally, ML is usually not suitable to handle values with hidden type information:

As a first example, consider existential types, which can be used to encapsulate a value and hide part of the type information; that is, part of the structure of the value is hidden to the outside world. For instance, consider a server that receives tasks to be done asynchronously, queues them in a list, and may then execute them sequentially. The list contains tasks waiting to be executed: its type is task list. Now, how is the type task defined? In ML a task is usually only a computation waiting to be triggered, that is, a function of type unit → unit. However, it is often more convenient to describe a task as a pair of a function and an argument to be passed to the function. Then a task is a pair (f, a) whose type is an existential type: ∃α.(α → unit) × α. Using this form of encapsulation, it is possible to put pairs of incompatible types into the task list. Existentials are not available in core-ML, but in some extension to the language [LO94a]. However, some explicit type information is needed both for encapsulation and opening, which will be improved with MLF. Existential types can also be encoded quite elegantly using first-class polymorphism.

As a second example, objects are also a form of encapsulation. Since objects may contain any data structure, possibly hidden to the outside world, its interface (methods) must provide tools to copy, transform, or iterate over itself. Hence, polymorphic functions are usually needed in the interface. Take for example a class dlist implementing double-linked lists. Since the type of the list elements, say α, is only a type parameter of the class, the methods^{1} rev, car, cdr are monomorphic. Their types are, respectively, α dlist, α, and α dlist. However, a method such as fold must be polymorphic: its type is ∀ (β) (β → α → β) → β → β. Such a type cannot be expressed in ML because first-class polymorphism is missing. In OCaml, a special extension to the language is required to provide polymorphic methods in objects [GR99].

Encoding monads, as done by Peyton Jones and Shields [JS04] also needs first-class polymorphism. Indeed, a monad type, which we write α m, is usually parametric over some type variable α, and the functions of the monad interface must be polymorphic. For instance, return and bind are given the polymorphic types ∀ (α) α → (α m) and ∀ (α, β) α m → (α → β m) → β m. Then functions taking a monad as an argument usually require second-order polymorphism.

1Following the tradition, rev, car and cdr are, respectively, the functions which reverses a list, returns the first element, and returns the list without the first element.

As another example, non-uniform recursive types [Oka98] are also known to make use of polymorphic recursion. Two cases can be identified.

• The first one corresponds to finite types: take for instance the datatype definition type α T = None | Some of α × (int T). A function defined over this datatype certainly needs to be defined for the types α T and int T. If polymorphic recursion is not available, it is still possible to define twice the same function: the first one is defined over the type int T, and the second one over α T. This example shows how duplication of code may circumvent the limitations of the type system.

• The second case corresponds to infinite types: take for instance the following definition type α T = None | Some of α list T. A recursive function defined over such a datatype needs to be polymorphic. In this case, it is not possible to duplicate the code to circumvent the limitations of the type system.

All the examples above only require rank-2 polymorphism. However Peyton Jones and Shields [JS04] give an example that illustrates how a rank-3 polymorphic type may be needed by defining a recursive map function over a nested datatype: the recursive map function is decomposed into a recursive fixpoint operator and a non-recursive map function. Although this separation is quite artificial, it shows that rank-3 types are likely to appear in programs using polymorphic functions as soon as more abstraction is introduced. Indeed, adding an extra level of abstraction, such as the explicit separation mentioned here, immediately increases the rank of the types being involved.

As a conclusion of this section, we have seen that although outer polymorphism a la ML is usually enough to create and handle parametric data structures, some extension to the type system is needed as soon as one wishes to express more abstraction over data structures, encapsulation of values, or non-uniform datatypes. Indeed, in all these cases the lack of first-class polymorphism in ML prevents the typing of the corresponding programs.

First-class polymorphism

In a type system with first-class polymorphism, any variable may have a polymorphic type, including λ-bound variables. In the 1970’s, Girard [Gir72] and Reynolds [Rey74] independently designed such a type system, called System F. Since full type inference is undecidable for System F [Wel94], some explicit type information is needed in order to typecheck expressions. As a consequence, System F is usually defined in Church style, where expressions have sufficient type information so that the typing derivation can be constructed. Three kinds of type information are found in System F expressions: type abstractions, type annotations, and type applications. Type abstractions are abstractions over type variables, and written Λ(α) a. They indicate that the expression a is polymorphic in α. The type variable being abstracted (α in our example) is meant to appear in type annotations or type applications. Type annotations are types used to annotate λ-bound variables. For example, the identity is written Λ(α) λ(x: α) x (\underline{3}) in System F. A type abstraction is used to indicate that this function is polymorphic. The type annotation on x links the abstract type variable α to the type of x. In System F, the expression (3) has type ∀ α · α → α.^{2} Intuitively, a polymorphic value represents an infinite number of types. Choosing one of these types (or a subset of these types) is called instantiation. In System F, instantiation is explicit via a type application. To pursue the example, instantiating the identity so that it can be applied to integers is done by writing id [int]. Type applications explicitly indicate how a polymorphic value is instantiated. The type argument (here int) is meant to replace the abstracted type variable (here α) in the body of the type abstraction, leading to the type int → int.

There is a great difference between programming in ML and programming in System F: while the former benefits from full type inference, so that no type is needed in the source program, the latter needs all the type information described above. However, System F is more expressive than ML since polymorphism is first class. In order to merge the two systems, a first approach may consist in performing a sufficient amount of type inference in System F, so that usual programs would need very little type annotations. Taking F_{<:} as a basis, Cardelli has experimented such a solution [Car93]. It has lead to local type inference [PT98], recently improved to colored local type inference [OZZ01]. Both of these type systems succeed in merging subtyping with fist-class polymorphism, while providing a reasonable amount of type inference. However, both fail to type all unannotated ML programs. Besides, although local type inference seems satisfactory enough in practice, it suffers from intrinsic limitations that are believed hard to fix [HP99]. We compare this approach with ours at the end of the introduction.

A second approach consists of extending ML with higher-order types, so that all ML programs are typable without any annotations and System F can be encoded into the extended language [LO94b, Rém94, OL96, GR99]. However, the existing solutions are still limited in expressiveness and the amount of necessary type declarations keeps first-class polymorphism uneasy to use. More precisely, these solutions embed firstclass polymorphism into ML monotypes using type constructors. This is called boxed polymorphism. Here, a polymorphic value may have either a polymorphic type, as in ML, or a boxed polymorphic type. Explicit coercions are needed to transform a polymorphic type into a boxed one. Conversely, whereas a polymorphic type is implicitly instantiated in ML, an explicit coercion is needed as well to transform a boxed type into a polymorphic type. The amount of explicit type information differ from one system to another. For example, in Poly-ML [GR99] the coercion from boxed types to polymorphic types is a simple mark that does not depend on the types being coerced (the construct ⟨·⟩). However, an explicit type annotation is required for coercing a polymorphic type to a boxed type. Although Poly-ML has been used to add polymorphic methods to OCaml, it is probably not suitable yet for providing user-friendly first-class polymorphism. In summary, existing solutions are in general uneasy to use due to the required amount of type information in programs. Indeed, explicit type information is needed both when a polymorphic value is boxed and when it is unboxed. Below, we compare these proposals with MLF.

2Note that we use two notations: a first one is ∀ (α) σ for polymorphic types of ML, which we also use for types of MLF; the second one is ∀ α · t for polymorphic types of System F.

In this document, we follow the second approach: our goal is to type all ML programs without any type annotation, and to type all expressions of System F using type annotations if necessary. We build on the work done in Poly-ML, and we aim at the elimination of all coercions between unboxed polymorphic types and boxed polymorphic types. However, we do not expect to guess polymorphism, so that explicit type annotations are still required in some cases in order to typecheck expressions of System F. In summary, MLF programs contain some type annotations, but no coercion, no type abstraction, and no type application.

Type inference

The ML language benefits from full type inference, while System F does not. Let us study more precisely what this means. In core-ML, programs consist of untyped lambda-expressions and a let construct. Notice that, by construction, they do not contain any type annotation. Not all the writable programs are valid ML programs: only some of them are typable, according to a set of typing rules. Fortunately, there exists a type inference algorithm, which finds whether a given program is typable or not. Moreover, this algorithm is complete, that is, it always terminates by telling if the given program is typable or not. In summary, the type inference problem in ML consists of finding whether a given program is typable according to the ML typing rules. It is remarkable that, by definition, the given programs do not contain any type information.

A similar approach for System F is called Curry style System F: programs are unannotated lambda-terms, that is, pure-lambda terms without any type information. Then typing rules are defined on pure lambda-terms, and a type inference problem consists of finding whether there exists a typing derivation using Curry style System F typing rules. Unfortunately, type inference in Curry style System F is undecidable in general [Wel94]. This means that it is impossible to design a complete algorithm which finds whether a given program is typable or not. This is probably why programs are usually defined in a Church style, that is, with a lot of type information. Additionally, typing rules are defined on fully annotated programs. Hence, defining type inference as we did for ML would be meaningless: since all the necessary type information is already present in programs, it is straightforward to write a type inference algorithm that simply checks if the given program is typable. In that sense, we have a complete type inference algorithm for Church style System F. It should be noticed that whereas a Church style System F program has the same structure as its typing derivation, a Curry style System F program may have many typing derivations.

Since full type inference is undecidable in Curry style System F, it is impossible to reconstruct all type abstractions, type applications and type annotations. Besides, reconstructing type annotations when only type abstractions and the location of type applications are indicated is undecidable as well [Pfe93]. In MLF, we aim at the elimination of type abstractions and type applications, but not all annotated lambdas. Hence, an MLF program is an ML program that might still contain some type annotations. As seen above, an annotated System F program corresponds exactly to its expected typing derivation, thus type inference is straightforward in Church style System F. On the contrary, an annotated MLF program still requires some type inference: first, type annotations are not required on all λ-bound variables, thus it remains to infer the types of unannotated λ-bound variables, as it is the case in ML; second, type abstractions and type applications are not explicit, thus it remains to infer both the places where polymorphism is introduced and the places where polymorphism is instantiated. We see that the type inference problem over annotated MLF programs is a priori not straightforward, and certainly more difficult than type inference problems over fully annotated System F programs. In this document, we consider only such type inference problems. In particular, we do not study type inference problems over MLF without type annotations (that is, pure lambda-terms considered as MLF programs). Nevertheless, a short discussion about the decidability of such problems is addressed while comparing MLF and System F.

In summary, our ambition is to infer types for all ML programs and to infer type abstractions and type applications for all System F programs. However, our goal is not to guess type annotations, thus programs that need but lack type annotations must be immediately rejected. This is why, unlike ML, the static semantics of an MLF program take type annotations into account.

Principal types

In ML, type inference relies on the following property: all the possible types of a program are instances of a single type, called its principal type. It is worth comparing what principal types are in the different flavors of System F. As seen above, a Church style System F program admits at most one type, which can be considered as a (trivial) principal type. Conversely, a Curry style System F program may admit many incomparable types. To see this, consider the expression λ(x) x x. Then taking σ_{id} for the type of x (and adding the necessary type application) makes the expression typable with type σ_{id} → σ_{id}. However, taking ∀ α · α for the type of x leads to the type (∀ α · α) → (∀ α · α). These two types are incomparable. Furthermore, there is no type that is both a valid type for λ(x) x x and more general than these two types. Indeed, Curry style System F does not have principal types.

In MLF, any typable expression admits a principal type: all the possible types of a program are instances of a single type. Note that this holds for annotated programs. Like type inference, the problem of principal types is a priori not straightforward in annotated MLF, while it is trivial in fully annotated System F. In this document, we consider only the problem of principal types for annotated MLF programs, and we do not consider the problem of principal types for MLF without type annotations. As a consequence, the principal type of every typable expression depends on the explicit type annotations. It should be clear from the above discussion that this is not a limitation due to the design of MLF, but it is only a consequence of our ambitions.

To sum up, we consider the questions of type inference and principal types for annotated MLF programs. Whereas these problems are trivial in fully annotated System F, they are not in MLF since we aim at the inference of type abstractions and type applications. More precisely, the principal type of an expression must capture all possible type abstractions and type applications through an appropriate instance relation, as well as an appropriate syntax for types. Let us consider an example. We assume choose is an expression of type ∀ α · α → α → α (it can be defined as λ(x) λ(y) if true then x else y). Let us apply choose to the identity id: adding the omitted type abstractions and type applications, we get (at least) two typings for chooseid in Church style System F:

choose [∀ β · β → β] id  : (∀ β · β → β) → (∀ β · β → β)
Λ(β) choose [β → β]  (id [β]) : ∀ β · (β → β) → (β → β)

The first typing is obtained by keeping the identity fully polymorphic. Then chooseid is a function expecting an argument that must be as polymorphic as the identity. The second typing is obtained by first instantiating the identity to β → β. Then chooseid is a function expecting a monomorphic argument of type β → β.

In MLF, we have to give a principal type to chooseid that can capture both types by instantiation. We note that both types have the same structure t → t. Actually, it is straightforward to check that all the types of chooseid in System F have the form ∀ ᾱ · t → t for some type variables ᾱ and some type t instance of ∀ α · α → α (including ∀ α · α → α itself). In MLF, we capture this by writing ∀ (α ≥ σ_{id}) α → α for the type of chooseid. The notation (α ≥ σ_{id}) binds α to any instance of the identity σ_{id}. Such a binding is called a flexible binding. By analogy, we write ∀ (α = σ_{id}) α → α for the type σ_{id} → σ_{id}. The binding (α=σ_{id}) is a rigid binding. As suggested by the notation, the instance relation of MLF allows the bound of α in ∀ (α ≥ σ_{id}) to be updated by any instance of σ_{id} , but does not allow the bound of α in ∀ (α = σ_{id}) to be instantiated. This new syntax for types, along with an appropriate instance relation, actually suffices to capture all implicit type abstractions and type applications; that is, we get principal types in MLF by just following the intuition behind the notation ∀ (α ≥ σ) σ′, which means “the type σ′ where α is any instance of σ”. In short, MLF provides richer types with constraints on the bounds of variables that allow the instantiation of these variables to be delayed until we have the necessary information to instantiate them.

Compositional type inference

A principal typing [Jim96] is a typing judgment that somehow represents all possible typing judgments of the expression. In particular, it must represent all possible typing environments that allow the typing of the expression. We parenthetically observe that MLF does not have principal typings, nor do System F or ML [Wel02]. As a counter example, in System F, ML, and MLF, there is no way to provide a typing of x x (under a typing environment binding x) that represents all its typings.

Let us have a closer look at λ(x) x x. This expression is not typable in ML. Besides, it is not typable in MLF as such because it would require guessing the polymorphic type of x. Actually, a type annotation, e.g. (x : σ_{id}) is necessary to typecheck the expression, and the expression λ(x: σ_{id}) x x, which we call auto, is typable in MLF. Now, we consider a variant: instead of returning only x x, we return a pair composed of x x and x; that is, we consider the expression λ(x) (x x, x). It is not typable in MLF either, for the reason given above, and a type annotation is needed. In MLF, we allow any subexpression to be annotated, thus the expressions λ(x) ((x : σ_{id}) x, x) (\underline{1}) and λ(x) (x x, (x : σ_{id})) (\underline{2}) are well-formed. Furthermore, annotations on λ-bound variables, which are the only kind of type annotations in System F, are syntactic sugar in MLF: λ(x: σ_{id}) (x x, x) is expanded into λ(x) let x = (x : σ_{id}) in (x x, x) (\underline{3}). In those three examples (1), (2), and (3), a type annotation (x : σ_{id}) is given, thus there is no need to guess the polymorphic type of x. However, although (1) and (3) are typable in MLF, we reject (2) in order to keep type inference compositional. Let us explain why. The typing of (2) requires the typing of (x x) (\underline{4}) and the typing of (x : σ_{id}) (\underline{5}). Additionally, the initial typing environment does not provide any information about the type of x. Hence, if the type inference algorithm first tries to type expression (5), it “learns” that the type of x is σ_{id}. Then using this information, we expect it to succeed in typing (4). However, if the algorithm first tries to type expression (4), it can only fail because it cannot guess the polymorphic type of x. A solution to this problem would be to use backtracking in the type inference algorithm. Note, however, that the type information (x : σ_{id}) may be located in an arbitrarily “deep” subexpression.

In such a situation, type inference is not only expansive but also counter-intuitive to the programmer. To avoid this in MLF, we have designed the type system so that the expression (2) is not typable. In other words, the specification is kept compositional. Let us explain how the typing rules of MLF allow for the typing of (1) but reject the typing of (2).

Considering the ML typing rules, the typing rule for λ-abstractions is restricted so that type inference is possible. Indeed, the typing of λ(x) a only allows a monotype (that is, a non-polymorphic type) to be assigned to x. We use the same technique in MLF: λ-abstractions can only introduce monotypes in the typing environment. However, the typing of (1) obviously requires x to have a polymorphic type. The trick is to assign a type variable to x, say α, and to bind α to a polymorphic type in a prefix. Thus, a λ-bound variable such as x is given a monotype α that represents a polymorphic type via the prefix. A fundamental property of the prefix is that its bindings are “abstracted”, that is, hidden from the typing rules. To pursue the example, we say that the type variable α is an abstraction of the polymorphic type σ_{id}. In order to use x as a polymorphic expression, it is first necessary to reveal its polymorphism, which can only be done with an explicit type annotation. Of course, the type annotation on x must correspond to the binding of α in the prefix.

All typing rules of MLF are stated under a prefix. Then type variables can represent polytypes by putting the corresponding binding into the prefix. However, the information stored in the prefix cannot be used for typing the expression: an explicit type annotation is necessary to reveal the polymorphic type associated to a type variable. Note, however, that there is no need to reveal the type of an expression that is not used polymorphically. A related key feature of MLF is that type variables can always be implicitly instantiated by polymorphic types. This can be illustrated by the application (λ(x) x id) auto (λ(x: σ_{id}) x x). This expression is typable in MLF as such, that is without any type application nor any type annotation—except, of course, in the definition of auto itself. The type of x is polymorphic (it is the type of auto), but x itself is not used polymorphically. Thus, the type of x can be kept abstract so that no revelation (no type annotation) is needed. In fact, a generalization of this example is the app function λ(f) λ(x) f x, whose MLF principal type is ∀ (α, β) (α → β) → α → β. It is remarkable that whenever a_{1} a_{2} is typable in MLF, so is app a_{1} a_{2}, without any type annotation nor any type application. This includes, of course, cases where a_{1} expects a polymorphic value as argument, such as in appautoid. We find such examples quite important in practice, since they model iterators (e.g. app) applied to polymorphic functions (e.g. auto) over structures holding polymorphic values (e.g. id).

To conclude, the typing rules of MLF define a compositional specification. The technique is to enrich typing judgments with a prefix that binds type variables to polytypes, and to allow only explicit type annotations to reveal the polytype associated to a type variable. Conversely, it is possible to implicitly abstract a polytype by a type variable. This is formalized in MLF by a relation under prefix called abstraction. Thus, MLF enjoys three relations on types: the equivalence, abstraction, and instance relations. Actually the instance relation includes the abstraction relation, which includes the equivalence relation. The inverse of the abstraction relation is the revelation relation, which is used by type annotations to reveal the polytype abstracted by a type variable. The abstraction and revelation relations play a key role in type inference by setting a clear distinction between explicit and inferred type information, which is the essence of MLF.

Variants of MLF

All ML programs are typable in MLF as such. Besides, all System F programs can be encoded into MLF by dropping type abstractions and type applications. Thus, MLF seems to be expressive enough. However, subject reduction does not hold in MLF for a simple notion of reduction (non local computation of annotations would be required during reduction). Thus, we introduce an intermediate variant MLF_{⋆} where type annotations are replaced by a place holder for revelation, called an oracle. For example, using the symbol ⋆ in place of polytypes, λ(x: ⋆) x x belongs to MLF_{⋆} since λ(x: σ_{id}) x x belongs to MLF. Since type annotations are replaced by oracles, the reduction rules can be expressed in a simple way that does not need heavy computation on type annotations. Subject reduction and progress are proved for MLF_{⋆}. Then type soundness follows for MLF_{⋆} and, indirectly, for MLF.

In fact, we abstract the presentation of MLF_{⋆} over a collection of primitives so that MLF can then be embedded into MLF_{⋆} by treating type-annotations as an appropriate choice of primitives and disallowing annotation place holders in source terms. Thus, although our practical interest is the system MLF, most of the technical developments are pursued in MLF_{⋆}.

Related works

Our work is related to all other works that aim at some form of type inference in the presence of first-class polymorphism. The closest of them is unquestionably Poly-ML [GR99], which is itself related to several other works:

Encapsulated polymorphism

Some previous proposals [Rém94, OL96] encapsulate first-class polymorphic values within datatypes. In these frameworks, a program must contain preliminary type definitions for all polymorphic types that are embedded in the program. For instance, the following program defines two flavors of auto and applies them to id:

         type sid = Sid of ∀α. α → α
         let id = Sid (λ(x)x)
         let auto_{1} x = match x with Sid x' → x' x'
         let auto_{2} x = match x with Sid x' → x' x
         (auto_{1} id, auto_{2} id)

Notice the difference between auto_{1} and auto_{2}: the former returns the unboxed identity; the latter returns the boxed identity.

We see that the type sid is used both as a constructor in the creation of the polymorphic value id (second line) and as a destructor in the lambda-abstraction (third and fourth lines). In practice, some syntactic sugar allows auto_{1} to be defined as follows:

         let auto_{1} (Sid x) = x x

Poly-ML is an improvement over these proposals that let the coercion from monotypes to polytypes be a simple mark, independent of the type being coerced. Then polymorphic types do not need to be defined (bound to a constructor) before they are used, although it is still possible to do so. Noticeably, Poly-ML subsumes first-class polymorphism by datatype encapsulation.

The above example can now be written as follows:

         let id = [λ(x) → x : ∀α. α → α]
         let auto_{1} (x:∀α. α → α) = ⟨x⟩ ⟨x⟩
         let auto_{2} (x:∀α. α → α) = ⟨x⟩ x
         (auto_{1} id, auto_{2} id)

The explicit creation of a polymorphic value is still required at the first line. However, using a known polymorphic value (second and third lines) is easier since the coercion from the embedded value x to a polymorphic value is simply written ⟨x⟩. Notice how abstracting over a polymorphic value requires explicit type information but using it only requires the mark.

Still, Poly-ML is not yet fully satisfying since the explicit type information necessary to build a polymorphic value (at the first line) is utterly redundant: can a programmer accept to write down a type that is already inferred by the typechecker?

Odersky and Läufer’s proposal [OL96] is two-folded: the first mechanism is described above; a second mechanism simultaneously allows a form of predicative quantification. This implies that the above example can also be written as follows:

         let id = λ(x)x
         let auto (x:∀α. α → α) = x x
         auto id

This is also the way this program is written in MLF. However, this form of quantification is predicative in Odersky and Läufer’s proposal [OL96], whereas it is impredicative in MLF. This makes a huge difference between the two systems: although both of them typecheck the expression λ(x: σ) a for any type scheme σ, encapsulation is required to pass this function as a value in their proposal, and for example store it in a list. In MLF, this function can be passed as any other value, without any form of explicit encapsulation. As another example, in Odersky and Läufer’s system, if f a typechecks, then it is not always the case that app f a does. Hence, this restricted form of predicative polymorphism breaks compositionality. Noticeably, the encoding of System F given by Odersky and Läufer does not use annotated λ-abstractions at all, but only polymorphic datatypes. Actually, predicative quantification and polymorphic datatypes are two independent features that can only lead to a non-uniform programming style, as far as first-class polymorphism is concerned.

MLF subsumes all of these proposals: type annotations are only required on some lambda-abstractions, and no form of explicit coercion between polymorphic types and embedded polytypes is ever needed. Additionally, MLF is an unpredicative type system and the encoding of System F into MLF is a straightforward local mapping of expressions which removes type abstractions and type applications. On the contrary, encodings based on polymorphic datatypes analyze the whole program, that is, the whole typing derivation; the transformation is not local and the inserted type definitions can be quite involved (cf. lifting of types in Odersky and Läufer’s proposal [OL96]).

The encoding of System F into Poly-ML does not need these type definitions; however each polymorphic value is embedded and thus requires an explicit type annotation, like in let id = [fun x →x : ∀α. α→α]. As a consequence, the encoding of a given System F expression can be larger than the original expression. In MLF, polymorphic values are implicitly created; that is, no explicit type annotation is required. Besides, the encoding of System F always produces smaller expressions.

A further extension of Odersky and Läufer’s work is Peyton Jones and Shields’type inference for arbitrary-rank types [JS04], which we discuss below.

Fragments of System F

Other approaches consider some fragments of System F and try to perform type reconstruction. Rank-2 polymorphism allows for full type inference [KW94]. Interestingly, this system, which Jim calls Λ_{2}, types the same programs than I_{2}, the rank-2 intersection types system [Jim95]. As already mentioned, these approaches are not compositional because of the rank limitation. Since first-class polymorphism is precisely needed to introduce a higher level of abstraction, we think this fundamental limitation is not acceptable in our opinion: only the abstractions over ML values are possible, which is then just not enough. Besides, the inference algorithm in Λ_{2} requires rewriting programs according to some non-intuitive reduction rules. Worse, this algorithm can only be applied to full programs: it is not possible to typecheck library modules independently. Noticeably, the algorithm given by Trevor Jim for I_{2} has better properties, including principal typings. However, the equivalence between I_{2} and Λ_{2} is also shown by mean of rewriting techniques; thus, although a typing in I_{2} can be inferred in a modular way, it does not give a modular typing in Λ_{2}.

Our treatment of annotations as type-revealing primitives also resembles retyping functions (functions whose type-erasure η-reduces to the identity) [Mit88]. However, our annotations are explicit and cover only certain forms of retyping functions, and conversely can do more. Type inference for System F modulo η-expansion is known to be undecidable as well [Wel96].

Several people have considered partial type inference for System F [JWOG89, Boe85, Pfe93, Sch98] and stated undecidability results for some particular variants. For instance Boehm [Boe85] and Pfenning [Pfe93] consider programs of System F where λ-abstractions can be unannotated, and only the locations of type applications are given, not the actual type argument. They both show that type reconstruction in this system is undecidable by encoding second-order unification. Both encodings manage to introduce an unannotated λ-abstraction whose argument is used polymorphically. This is precisely what we avoid in MLF: all polymorphic λ-abstraction must be annotated, whereas type abstractions and type applications are inferred.

As another example, Schubert [Sch98] considers sequent decision problems in both Curry style System F and Church style System F. Sequent decision problems in Curry style System F mostly correspond to type inference in System F, as already studied by Wells [Wel94], and are known to be undecidable. An interesting problem in Church style System F consists in finding the typing environment Γ which makes a given program M typable (the term M is fully annotated). Schubert proves that this problem is undecidable in general by encoding a restricted form of second-order unification, which is shown equivalent to the problem of termination for two-counters automata. We see that although the program is fully annotated, the knowledge of the typing environment is necessary to typecheck it in a decidable way. Fortunately, this is the approach we have in MLF, just like in ML. On the contrary, systems with intersection types, and more generally systems aiming at principal typings, have to infer both the type and the typing environment.

Second-order unification

Second-order unification, although known to be undecidable, has been used to explore the practical effectiveness of type inference for System F by Pfenning [Pfe88]. Despite our opposite choice, that is not to support second-order unification, there are at least two comparisons to be made. Firstly, Pfenning’s work does not cover the language ML per se, but only the λ-calculus, since let-bindings are expanded prior to type inference. Indeed, ML is not the simply-typed λ-calculus and type inference in ML cannot, in practice, be reduced to type inference in the simply-typed λ-calculus after expansion of let-bindings. Secondly, one proposal seems to require annotations exactly where the other can skip them: in Pfenning’s system [Pfe88], markers (but no type) annotations must replace type-abstraction and type-application nodes; conversely, this information is omitted in MLF, but instead, explicit type information must remain for some arguments of λ-abstractions.

Our proposal is implicitly parameterized by the type instance relation and its corresponding unification algorithm. Thus, most of the technical details can be encapsulated within the instance relation. We would like to understand our notion of unification as a particular case of second-order unification. One step in this direction would be to consider a modular constraint-based presentation of second-order unification [DHKP96]. Flexible bounds might partly capture, within principal types, what constraint-based algorithms capture as partially unresolved multi-sets of unification constraints. Another example of restricted unification within second-order terms is unification under a mixed prefix [Mil92]. However, our notion of prefix and its role in abstracting polytypes is quite different. In particular, mixed prefixes mention universal and existential quantification, whereas MLF prefixes are universally quantified. Besides, MLF prefixes associate a bound to each variable, whereas mixed prefixes are always unconstrained.

Actually, none of the above works did consider subtyping at all. This is a significant difference with proposals based on local type inference [Car93, PT98, OZZ01] where subtyping is a prerequisite. The addition of subtyping to our framework remains to be explored.

Local type inference

The main difference between local type inference [PT98] and the approach we followed in MLF is that the former avoids global unification and only matches types at application nodes in the program: type information can only be propagated between adjacent nodes. As a result, it provides a convenient way to handle subtyping and some form of type inference in System F. The motivation for local type inference is mainly practical. As a consequence of this approach, there is no standard translation of System F (except the identity), which could have illustrated how much annotation is required in an automatic translation. Rather, the authors give some measurement of necessary type annotations on real existing ML programs. Still, the local-inference programming style always requires “top-level” definitions to be annotated and polymorphism must be explicitly introduced. Not all ML programs are typable in these systems, even after decorating top-level definitions with type abstractions and type annotations: inner type annotations may also be needed. One difficulty arises from anonymous functions as well as so-called hard-to-synthesize arguments [HP99]. As an example, the application app f x may be untypable when f is polymorphic^{3}. Principal types are ensured by finding a “best argument” each time a polymorphic type is instantiated. If no best argument can be found, the typechecker signals an error. Such errors do not exist in ML nor MLF, where any typable expression has a principal type. It should be noticed that finding a “best argument”, and thus inferring principal types in local type systems, is made more difficult because of the presence of subtyping.

Colored local type inference [OZZ01] is presented as an improvement over local type inference, although some terms typable in the latter are not typable in the former. It enriches type inference by allowing partial type information to be propagated.

Beyond its treatment of subtyping, local type inference also brings the idea that explicit type annotations can be propagated up and down the source tree according to fixed well-defined rules, which, at least intuitively, could be understood as a preprocessing of the source term. Such a mechanism is being used in the Glasgow Haskell Compiler, and can also be added on top of MLF as well, as explained in Chapter 11.

Meanwhile, in Cambridge

Adapting ideas both from Odersky and Läufer’s work and local type inference, Peyton Jones and Shields designed a type inference algorithm for arbitrary-rank types [JS04]. Their type system uses a restriction of Mitchell type containment relation [Mit88], which is contravariant in the domain of arrow types and covariant in their codomain. This is a first difference with MLF, in which the instance relation is always covariant (including in the domain and codomain of arrow types). Let us look at an example taken from Peyton Jones and Shields’paper [JS04].

We assume we are given some functions g, k_{1} and k_{2}, with the following signature:

val g : ((∀β. β list → β list) → int) → int
val k_{1} : (∀α. α → α) → int
val k_{2} : (int list → int list) → int

By subsumption,

(∀α. α → α) → int

is less polymorphic than

(∀β. β list → β list) → int

3The problem disappears in the uncurrified form, but uncurrifying is not always possible, or it may amount to introducing anonymous functions with an explicit type annotation.

As a consequence, (g k_{1}) is ill-typed in Peyton Jones and Shields’type system, whereas (g k_{2}) is well typed. In MLF, the type associated to g is ∀ (γ = ∀ (β) β list → β list ) (γ → int) → int (\underline{1}). Hence, both (g k_{1}) and (g k_{2}) would be ill-typed, because MLF supports no form of contravariance.

However, the type system of MLF contains flexible bounds, which can help in this very example. More precisely, the type of g shows that it is a function expecting an argument x with type (∀β.β list → β list) → int. Hence, x must be a function expecting an argument with type ∀β.β list → β list. Let h be a function with this type. Then, g could be defined as follows:

let g (x:(∀β. β list → β list) → int) = x h

Actually, x is not used polymorphically, thus the following definition is also typable in MLF:

let g_{2} x = x h

Besides, the principal type inferred for g_{2} is ∀ (γ ≥ ∀β.β list → β list) ∀ (δ) (α → δ) → δ (\underline{2}). Comparing (1) and (2), we see that the rigid binding for γ is replaced by a flexible binding. Then, the type variable γ stands for ∀β.β list → β list or any instance of it, including int list → int list. As a consequence, (g_{2} k_{2}) typechecks in MLF (and (g_{2} k_{1}) is still not typable because the bound of γ cannot be instantiated to ∀α.α → α).

We see that although MLF does not enjoy any form of contravariance, it may still typecheck some examples that, at first glance, seem to require contravariant subsumption.

Another difference between Peyton Jones and Shields’type system and MLF is that the former is predicative. Thus, as already mentioned above, compositionality is restricted; data structures cannot hold polymorphic values; generic functions cannot be applied to polymorphic values. We think this is a considerable limitation. As a simple example, consider the expression [auto] (that is, auto in a singleton list).

Furthermore, this system borrows an idea from local type inference, namely inwards propagation of type information, which is formalized in the type-system specification. In MLF, propagation of type annotations may be performed beforehand, as a simple purely-syntactic mechanism independently from the typing process. This leads to comparable features, such as the propagation of type information from interface files to implementation files. However, this remains a side mechanism, which only plays a minor role in MLF.

Still, Peyton Jones and Shields’s metatheory is much simpler than the one of MLF. At the programmer’s level, though, it is not clear which one is simpler to use.

Organization of the document

The expressiveness of MLF is based essentially on its type system, while its typing rules are almost identical to those of ML. Such a combination of more expressive types and ML semantics leads to an expressive second-order type system. Types are defined and studied in Part I. Typing rules and dynamic semantics are defined and studied in Part II. The expressiveness of MLF is considered in Part III.

Part I: Types Types are described in Chapter 1 as monotypes and polytypes. Monotypes are monomorphic types, without quantifiers. Polytypes are polymorphic types, and consist in a sequence of bindings, called a prefix, in front of a monotype. The equivalence relation (≡) and instance relation (⊑) are then defined, as well as an intermediate relation, the abstraction relation (⊏ −). The two former relations can be viewed as extensions of the ML corresponding relations. The abstraction relation, however, has no counterpart in ML. It is a reversible relation, as equivalence, but only explicitly, that is, thanks to type annotations in the source code. It is used to distinguish between inferred information on types and explicitly given information. Chapter 2 gathers useful properties about types and relations between types. Some of these results are direct extensions of ML properties to the more general framework of MLF. Some other results have no counterpart in ML^{4}, notably properties concerning the abstraction relation. The three relations on types induce immediately the same relations on prefixes. Prefixes extend the notion of substitution by allowing, intuitively, the substitution of type variables by polytypes. Types and substitutions are at the heart of the ML type system. Similarly, types and prefixes contain the expressive power of MLF. Chapter 3 focuses on prefixes. Like properties on types, properties on prefixes usually extend known results about substitutions in ML, in a more general framework. The work done on types and prefixes is then used in Chapter 4, where the unification algorithm is stated, then shown correct and complete. As expected, the unification algorithm is an extension of the ML unification algorithm that deals with polytypes, and returns a prefix instead of a substitution.

Part II: The programming language As explained above, we define the language MLF_{⋆}, which consists of the expressions of ML enriched with a construction called an oracle. The difference between ML and MLF_{⋆} lies mainly in their respective type system, not only in the oracle. The oracle is a simple mark on the expression that explicitly allows the reversal of the abstraction relation. Oracles do not contribute to the reduction of expressions, but they are silently propagated. The expressions and dynamic semantics of MLF_{⋆} are given in Chapter 5, as well as the typing rules. The typing rules of MLF_{⋆} are similar to those of ML: they are only enriched with an explicit prefix, and make use of the richer type instance relation. In ML, all bounds of the prefix are unconstrained, therefore the prefix is kept implicit. An additional typing rule is necessary for the oracle; it allows only to reverse the abstraction relation. Then exactly as in ML, a syntax-directed presentation of the typing rules is given. The goal of a type system is to ensure safety, that is, well-typed programs do not go wrong. Chapter 6 shows type safety for MLF_{⋆}. Type safety for MLF, which is defined as MLF_{⋆} without oracles, follows. As suggested by their name, oracles cannot be guessed. More precisely, oracles reverse the abstraction relation, which is safe (type safety is preserved), but breaks type inference. Indeed, Chapter 7 gives a type inference algorithm which is shown sound and complete for MLF, but not for MLF_{⋆}, where it is probably undecidable. In summary, a richer language is introduced, namely MLF_{⋆} in order to show type safety of MLF. However, MLF is the programming language that we wish to use, and which provides type inference. Although the syntax of MLF and ML are the same, the type system of the former is much richer than the type system of the latter. However, we show in Chapter 8 that core-MLF and ML are equivalent, that is, the power available in the type system of MLF is not used. Then we introduce explicit type annotations as a set of primitives, which make use of the richer type system. We prove that type safety still holds. A few examples show how type-annotations primitives can be used to introduce first-class polymorphism. The type inference mechanism simply takes advantage of the information given by type annotations present in the source code. The expressiveness of MLF with type annotations is addressed in the third part.

4Actually, such results are trivial when stated in the framework of ML.

Part III: Expressiveness of MLF As claimed so far, MLF is a language with firstclass polymorphism. We back up this statement by proposing an encoding of System F into MLF. In Chapter 9, we prove that this encoding is sound, that is, every encoding of an expression typable in System F is typable in MLF. Noticeably, the encoding simply removes type abstractions and type applications, thus a given program is always smaller in MLF than in System F. In Chapter 10, we address the converse question: Can MLF be encoded in System F? We first consider a restriction of MLF, Shallow MLF, where type annotations can only be types of System F. Then we show that System F can be encoded in Shallow MLF. Conversely, we propose an interpretation of types of Shallow MLF, and show that each typing in Shallow MLF corresponds to one or many typings in System F. As a consequence, Shallow MLF and System F have the same set of typable terms, up to type information. We use this equivalence between Shallow MLF and System F to discuss the differences between MLF and System F. Next, considering MLF as a basis for a real programming language, we look at some useful extensions in Chapter 11. As a first example, references can be included in MLF. However, as in ML, generalization has to be restricted, and we consider the well-known value-only polymorphism restriction. A more usable proposal by Jacques Garrigue [Gar02] is also presented and discussed. As a second example, we show how type annotations can be propagated from interface files to implementation files thanks to a straightforward mechanism. Finally, Chapter 12 addresses MLF in practice. We show some examples written in MLF and tested with our prototype.

Conventions

In this document, we distinguish four kinds of formal results: lemmas, corollaries, properties, and theorems. A lemma states a single result, which is usually used to show other results. We sometimes gather several minor results in a single statement. Each result is called a property, then. Properties are small results, usually used to show lemmas. A corollary is always found directly after a result of which it is a direct consequence. A theorem is a fundamental result of the thesis.

Proofs of formal results are given inline or they are moved to Appendix A. We give proofs inline by default, and move them to appendix when they are basically similar to already seen proofs, or when they are too long and of little interest. Additionally, a very small number of straightforward results are not proven in this document; the reader should be able to find the proof alone without any difficulty.

Statements with a short scope, such as intermediate results in proofs or constructions introduced locally, are sometimes labelled with an underlined number like this (\underline{1}). Then they can be referred at like this (1). Here is a complete example:

Epimenides is a Cretan (\underline{2}). Epimenides says: “All Cretans are liars.” (\underline{3}). From (2) and (3), we conclude that Epimenides cannot tell the truth (\underline{4}), that is, there is at least one Cretan that is not a liar. Then we know from (4) that Epimenides is not this Cretan (\underline{5}). As a consequence of (2) and (5), there exist at least two Cretans.

We highly recommend to use Active-DVI ^{5} to read proofs since it provides eye candy features that really eases the reading of such materials.

Inference rules are written in small capitals, such as, for example R-Trans. Some derivable rules are also introduced. Their names always finish by a star, such as for example Eq-Mono^{⋆}. All the inference rules of the document are gathered in the index of rules, page 319. Such rules are meant to build derivations, in the usual way. Unless specified otherwise, the size of a derivation is the number of rules it uses.

5http://pauillac.inria.fr/advi/

We bind an element to a name by using the symbol =^{△}. For instance, we write τ =^{△} τ_{1} → τ_{2} to mean that, from now on, τ is τ_{1} → τ_{2}. This is different from τ = τ_{1} → τ_{2}, which means that the already-defined object τ happens to be equal to τ_{1} → τ_{2}.

Notation A sequence or a set is usually written x̄. For instance, ᾱ is a set of type variables. We also use the letters I or J for unordered sets of type variables. An index of all notations can be found page 322. We sometimes abbreviate “if and only if” into “iff”.

Following the usual notations, applications of λ-terms associates to the left, and the scope of the binding λ(x) extends as far to the right as possible. As for types, the arrow → associates to the right, and the bindings ∀ (α) extends as far to the right as possible.

Part I Types

Chapter 1

Types, prefixes, and relations under prefixes

As explained in the introduction, MLF uses a new syntax for types, which embeds first-class quantification. In ML, monotypes are simple types without quantifiers and polytypes (also called type schemes) consist of a list of quantified variables ∀ (ᾱ) followed by a monotype, e.g. ∀ (α, β) α → β. In MLF too, we make the difference between monotypes and polytypes. Monotypes are similar to monotypes of ML. Polytypes are more elaborate than in ML: the list of quantified variables provides a bound for each variable. For example, ∀ (α_{1} ≥ σ_{1}, α_{2} = σ_{2}) are valid bindings in MLF. A list of variables with their bound is called a prefix. To pursue the example, (α_{1} ≥ σ_{1}, α_{2} = σ_{2}) is a valid prefix in MLF. The first quantification, binding α_{1}, is flexible: its bound can be instantiated. The second quantification, binding α_{2}, is rigid: its bound cannot be instantiated. Intuitively, rigid bounds correspond to the type of arguments which are required to be polymorphic, whereas flexible bounds correspond to the type of expressions that happen to be polymorphic, but that are not constrained to be.

Types and prefixes are introduced in Sections 1.1 and 1.2, respectively. Then Section 1.3 defines occurrences in a type, free variables, and substitutions.

The expressiveness of a type system lies in its relations between types. In MLF, we have a hierarchy made of three relations on types: equivalence (≡), abstraction (⊏ −), and instance (⊑). All these relations are defined under prefix, which means that we write (Q) σ_{1} ⊑ σ_{2} instead of simply σ_{1} ⊑ σ_{2}. The given prefix Q provides a bound to all free variables of σ_{1} and σ_{2}. The equivalence, abstraction, and instance relations are described in Sections 1.5, 1.6, and 1.7, respectively. Additionally, we show in Section 1.5, that types have a unique canonical form, up to commutation of independent binders. This means that we capture the equivalence relation in a notion of canonical form.

This first chapter establishes many results (properties, lemmas or corollaries), most of which are used throughout the document. Only a very few of these are “local” in the sense they are not referenced at in other chapters.

One of the most important result is Corollary 1.5.10 (page 54), which characterizes the equivalence under prefix. Property 1.5.6.i (page 51) states the equivalence between a given type and its normal form; it is widely used throughout the thesis. A related result is 1.5.6.iii (page 51), which shows that a substitution and the normal form operator commute. Property 1.5.4.i (page 50) is also widely used; it states that equivalent types have the same structure. A standard result is Property 1.7.2.iii (page 59), which corresponds to the addition of unused hypotheses in the prefix of instance derivations. Another standard result is Property 1.7.2.i (page 59); it shows that a renaming can be applied to a whole instance derivation.

1.1 Syntax of types

The syntax of types is the following:

τ ::= α | g^{n} τ_{1} .. τ_{n}  Monotypes
σ ::= τ | ⊥ | ∀ (α ≥ σ) σ | ∀ (α = σ) σ  Polytypes

We distinguish between monotypes and polytypes. By default, “types” refers to the more general form, i.e. to polytypes. The syntax of monotypes is parameterized by an enumerable set of type variables α ∈ ϑ and a family of type symbols g ∈ G given with their arity |g|. To avoid degenerate cases, we assume that G contains at least a symbol of arity two (the infix arrow →) and a symbol of arity zero (e.g. unit). We write g^{n} if g is of arity n. As shown by the definition, a monotype is either a type variable in ϑ, or a constructed type g^{n} τ_{1} .. τ_{n}. An example of constructed type is (→) τ τ′, which we write τ → τ′. As in ML, monotypes do not contain quantifiers.

Polytypes generalize ML type schemes. They are either a monotype τ, bottom (written ⊥), or a binding quantified in front of a polytype, that is, ∀ (α≥σ) σ′ or ∀ (α=σ) σ′. Inner quantifiers as in System F cannot be written directly inside monotypes. However, they can be simulated with types of the form ∀ (α = σ) σ′, which stands, intuitively, for the polytype σ′ where all occurrences of α would have been replaced by the polytype σ. Noticeably, our notation contains additional meaningful sharing information. Finally, the general form ∀ (α ≥ σ) σ′ intuitively stands for the collection of all polytypes σ′ where α is an instance of σ. We say that α has a rigid bound in (α = σ) and a flexible bound in (α ≥ σ). Intuitively, the polytype ⊥ corresponds to the ML scheme ∀α.α. More precisely, it is made equivalent to ∀ (α ≥ ⊥) α. Actually, ML type schemes can be seen as polytypes of the form ∀ (α_{1} ≥ ⊥) … ∀ (α_{n} ≥ ⊥) τ with outer quantifiers. Indeed, a particular case of flexible bound is the unconstrained bound (α ≥ ⊥), which we abbreviate as (α).

Notations Given a sequence α_{1}, … α_{n} of variables, we define the type ∇_{α_{1},...α_{n}} as an abbreviation for α_{1} → … → α_{n} → unit. We write τ̄ for tuples of types, and ᾱ # β̄ means that the sets ᾱ and β̄ are disjoint. For convenience, we write (α ⋄ σ) for either (α = σ) or (α ≥ σ). The symbol ⋄ acts as a meta-variable and two occurrences or more of ⋄ in the same context mean that they stand for = or all stand for ≥. To allow independent choices we use indices like in ⋄_{1} and ⋄_{2} for unrelated occurrences.

1.2 Prefixes

A polytype is a sequence of bindings, called a prefix, in front of a monotype. As remarked in the introduction, the expressiveness of types essentially comes from the expressiveness of prefixes. Indeed, the only difference between ML polytypes and MLF polytypes lie in their bindings, that is, in their prefixes.

A prefix Q is a sequence of bindings (α_{1} ⋄_{1} σ_{1}) … (α_{n} ⋄_{n} σ_{n}) where variables α_{1}, … α_{n} are pairwise distinct and form the domain of Q, which we write dom(Q). The order of bindings in a prefix is significant: bindings are meant to be read from left to right; furthermore, we require the variables α_{j} not to occur in σ_{i} whenever i ≤ j (up to α-conversion of bound variables). As an example, (α ≥ ⊥, β = α → α) is well formed, but (α = β → β, β ≥ ⊥) is not. A prefix is called unconstrained when it is of the form (α_{1} ≥ ⊥, … α_{n} ≥ ⊥). One can consider that in ML, the prefix is implicit and unconstrained.

Notations Since α_{1}, … α_{n} are pairwise distinct, we can unambiguously write (α⋄σ) ∈ Q to mean that Q is of the form (Q_{1}, α ⋄ σ, Q_{2}).

We write ∇_{Q} for ∇_{dom(Q)}, Q # Q′ for dom(Q) # dom(Q′), and ∀ (Q) σ for the type ∀ (α_{1} ⋄_{1} σ_{1}) … ∀ (α_{n} ⋄_{n} σ_{n}) σ.

1.3 Occurrences

In this section, we define a projection function which maps occurrences in the domain of a given type to a type symbol such as ⊥, a type constructor, or a type variable. We first introduce skeletons which are trees representing the projection function.

1.3.1 Skeletons

Definition 1.3.1 Skeletons are defined by the following grammar:

t ::= α | ⊥ | g^{n} t_{1} .. t_{n}

Substitutions are defined on skeletons in the obvious way. Since skeletons do not bind any variables, substitutions on skeletons are always capture-avoiding. The substitution of α by t′ is written [t′/α]. We write t[t′/α] for the skeleton t where α is substituted by t′. Substitutions on skeletons are written Θ.

1.3.2 Projections

An occurrence is a sequence of natural numbers. We write ϵ for the empty sequence, and k^{n} for the sequence k, …, k of length n (and, in particular, k^{0} is ϵ). The projection function maps pairs t/u composed of a skeleton t and an occurrence u to a type symbol, that is, to an element of the set {⊥} ∪ ϑ ∪ G. It is defined inductively by the following rules:

⊥/ϵ = ⊥  α/ϵ = α  g^{n} t_{1} .. t_{n}/ϵ = g  \frac{i ∈ 1..n}{g^{n} t_{1} .. t_{n}/iu = t_{i}/u}

We write t/ for the projection function u ↦ t/u. We note that the projection t/ is isomorphic to t.

Definition 1.3.2 The projection of an MLF-type σ to a skeleton, written proj(σ), is defined inductively as follows:

proj(τ) = τ  proj(⊥) = ⊥  proj(∀ (α ⋄ σ) σ′) = proj(σ′)[proj(σ)/α]

Given a prefix Q equal to (α_{1} ⋄_{1} σ_{1}, … α_{n} ⋄_{n} σ_{n}), we define Θ_{Q} as the idempotent substitution on skeletons [proj(σ_{1})/α_{1}] ∘ … ∘ [proj(σ_{n})/α_{n}] (it is the composition of n elementary substitutions).

We write σ/ for the function proj(σ)/. We call occurrences of a polytype σ the domain of the function σ/, which we abbreviate as dom(σ). Notice that dom(σ) is a set of occurrences, while dom(Q) is a set of variables. We write σ · u/ to denote the function u′ ↦ σ/uu′. Note that σ · ϵ/ is equal to the projection σ/.

Example 1.3.1 Occurrences ignore quantifiers and only retain the structure of types. For instance, the polytypes σ_{1} =^{△} ∀ (α ≥ ⊥) α → α and σ_{2} =^{△} ∀ (β = ⊥) ∀ (γ ≥ ⊥) β → γ have the same occurrences, that is, σ_{1}/ = σ_{2}/. Equivalently, proj(σ_{1}) and proj(σ_{2}) are both equal to ⊥ → ⊥. More precisely, the domains of both σ_{1} and σ_{2} are equal to {ϵ, 1, 2} and both σ_{1}/ϵ and σ_{2}/ϵ are equal to →. Additionally, σ_{1}/1, σ_{1}/2, σ_{2}/1 and σ_{2}/2 are all equal to ⊥.

Properties 1.3.3 The following properties hold, for any prefix Q and types σ, σ_{1}, σ_{2}: i) proj(∀ (Q) σ) is Θ_{Q}(proj(σ)). ii) If σ_{1}/ = σ_{2}/, then (∀ (Q) σ_{1})/ = (∀ (Q) σ_{2})/.

\underline{Proof}: \underline{Property i} : It is shown by induction on the size of Q. If Q is ∅, then Θ_{Q} is the identity, and the result follows. Otherwise, Q is (α ⋄ σ′, Q′) and proj(∀ (Q) σ) is proj(∀ (α ⋄ σ′) ∀ (Q′) σ) by notation, that is, proj(∀ (Q′) σ)[proj(σ′)/α] (\underline{6}) by definition. By induction hypothesis on Q′, proj(∀ (Q′) σ) is Θ_{Q′}(proj(σ)). Hence by (6), proj(∀ (Q) σ) is (Θ_{Q′}(proj(σ′)))[proj(σ′)/α], that is, ([proj(σ′)/α] ∘ Θ_{Q′})(proj(σ′)). We get the expected result by observing that [proj(σ′)/α] ∘ Θ_{Q′} is Θ_{Q} by definition. \underline{Property ii} : We have by hypothesis σ_{1}/ = σ_{2}/, that is, proj(σ_{1}) = proj(σ_{2}). Hence, Θ_{Q}(proj(σ_{1})) = Θ_{Q}(proj(σ_{2})) holds, which gives proj(∀ (Q) σ_{1}) = proj(∀ (Q) σ_{2}) by Property i. By definition, this means that ∀ (Q) σ_{1}/ = ∀ (Q) σ_{2}/ holds.

1.3.3 Free type variables and unbound type variables

In ML, type variables that appear in a type are either bound or free. In MLF, the set of free variables is only a subset of unbound variables. For example, consider the type σ equal to ∀ (α = β → β) γ → γ. Since α is bound but not used, σ is considered equivalent to γ → γ. Hence, γ is free in σ, while β is only unbound. We give the two definitions for unbound variables and free variables. To ease the presentation, free variables are defined using skeletons.

Definition 1.3.4 A type variable α is free in σ if there exists an occurrence u such that σ/u is α. We write ftv(σ) the set of free type variables of σ. The set of unbound type variables of σ, written utv(σ), is defined inductively as follows:

utv(α) =^{△} {α}  utv(g^{n} τ_{1} .. τ_{n}) =^{△} ⋃_{i∈1..n} utv(τ_{i})  utv(⊥) =^{△} ∅

utv(∀ (α ⋄ σ) σ′) =^{△} (utv(σ′) − {α}) ∪ utv(σ)

The definition of free variables is equivalent to the usual inductive definition. In particular, we have the usual properties ftv(α) = {α} (since α/ϵ = α), and ftv(τ_{1} → τ_{2}) = ftv(τ_{1})∪ftv(τ_{2}) (since (τ_{1} → τ_{2})/u = α holds if and only if u is of the form iv (a number i followed by a path v) such that τ_{i}/v = α). Moreover, the given definition amounts to considering that α is bound in σ′, but not in σ in the polytype ∀ (α ⋄ σ) σ′. That is, ftv(∀ (α ⋄ σ) σ′) is (ftv(σ′) − {α}) ∪ ftv(σ) if α is free in σ′, and ftv(σ′) otherwise. Indeed, by definition, β is free in ∀ (α ⋄ σ) σ′ if and only if there exists u such that (proj(σ′)[proj(σ)/α])/u = β. We see that β is free in ∀ (α ⋄ σ) σ′ if and only if β is free in σ′ and is not α, or α is free in σ′ and β is free in σ. Additionally, we note that utv(τ) = ftv(τ) for any monotype τ. Moreover, it is straightforward to check by structural induction that ftv(σ) ⊆ utv(σ) holds for any σ.

By extension, the free variables of a set of types {σ_{1}, … σ_{n}} is defined as the union ⋃_{i=1..n} ftv(σ_{i}). Similarly, we write utv(σ_{1}, …, σ_{n}) for the union ⋃_{i=1..n} utv(σ_{i}). A polytype is closed if it has no unbound type variable. When utv(σ) ⊆ dom(Q), we also say that σ is closed under prefix Q. We define utv(Q) as utv(∀ (Q) ⊥). When utv(Q) is empty, that is, ∀ (Q) ⊥ is closed, we say that Q is a closed prefix.

α-conversion Polytypes are considered equal modulo α-conversion where ∀ (α⋄σ) σ′ binds α in σ′, but not in σ. Let Q be (α_{1} ⋄_{1} σ_{1}, … α_{n} ⋄_{n} σ_{n}). Note that the α_{i}’s can be renamed in the type ∀ (Q) σ, but not in the stand-alone prefix Q. For instance, ∀ (α ≥ ⊥) α → α is considered equal to ∀ (β ≥ ⊥) β → β, but (α ≥ ⊥) and (β ≥ ⊥) are distinct prefixes. We easily check that free variables and unbound variables are stable under α-conversion.

1.3.4 Renamings and substitutions

Given a function f from type variables to monotypes (typically a renaming or a substitution, as defined next), we define the domain of f, written dom(f), as the set of type variables α such that f(α) ≠ α. The codomain of f, written codom(f), is the set ftv(f(dom(f))), that is, ⋃_{α∈dom(f)} ftv(f(α)). Such functions are extended to types and type schemes in the obvious way, by avoiding capture of bound variables. An idempotent function f is such that f ∘ f = f, this amounts to having dom(f) # codom(f). The composition f_{1} ∘ f_{2} is well-formed if we have codom(f_{1}) # dom(f_{2}). A function is said invariant on ᾱ whenever dom(f) # ᾱ.

A renaming ϕ is an idempotent function mapping type variables to type variables that is injective on the finite set dom(ϕ). Renamings are bijective from their domain to their codomain, but are never bijective on ϑ (except the identity). A renaming ϕ is said disjoint from ᾱ whenever ᾱ # dom(ϕ) ∪ codom(ϕ) holds. If ϕ is a renaming, we write ϕ^{¬} for the inverse renaming, whose domain is codom(ϕ) and codomain is dom(ϕ). More precisely, for every β in codom(ϕ), we define ϕ^{¬}(β) as α such that ϕ(α) = β. We say that ϕ is a renaming of a set ᾱ if ϕ is a renaming and if dom(ϕ) ⊆ ᾱ and codom(ϕ) # ᾱ hold. For example, the swapping α ↦ β, β ↦ α is bijective on ϑ but is not a renaming. The mapping α ↦ β is a renaming, though, and its inverse β ↦ α is a renaming too. Note that ϕ^{¬} ∘ ϕ is not the identity, but is ϕ^{¬} (which is invariant on dom(ϕ), though). Conversely, ϕ ∘ ϕ^{¬} is ϕ.

A substitution θ is an idempotent function mapping type variables to monotypes such that dom(θ) is finite. Any renaming is also a substitution. We write id for the identity on type variables, considered as a substitution.

Notation The capture-avoiding substitution of α by τ in σ is written σ[τ/α]. Given a prefix Q equal to (α_{i} ⋄_{i} σ_{i})^{i∈I}, and a substitution θ, we define θ(Q) as (θ(α_{i}) ⋄_{i} θ(σ_{i})) provided that θ restricted to dom(Q) is a renaming of dom(Q). In particular, if ϕ is a renaming of dom(Q), then ϕ(Q) is a well-formed prefix. Note also that ∀ (ϕ(Q)) ϕ(τ) is alpha-convertible to ∀ (Q) τ. Additionally, if θ is a substitution such that dom(Q) # dom(θ) ∪ codom(θ) holds, then θ(Q) is the prefix (α_{i} ⋄_{i} θ(σ_{i}))^{i∈I}.

Example 1.3.2 As already mentioned, types only allows quantifiers to be outermost, or in the bound of other bindings. Therefore, the type ∀ α · (∀ β · (τ[β] → α)) → α of System F cannot be written directly. (Here, τ[β] means a type τ in which the variable β occurs.) However, it can be represented in MLF by the type ∀ (α) ∀ (β′ = ∀ (β) τ[β] → α) β′ → α. In fact, all types of System F can easily be represented as polytypes by recursively binding all occurrences of inner polymorphic types to fresh variables beforehand (an encoding from System F into MLF is given in Section 9.2). In this translation, auxiliary variables are used in a linear way. For instance, (∀ α · τ) → (∀ α · τ) is translated into ∀ (α_{1} = ∀ (α) τ) ∀ (α_{2} = ∀ (α) τ) α_{1} → α_{2}. Intuitively, ∀ (α′ = ∀ (α) τ) α′ → α′ could also represent the same System F type, more concisely. However, this type is not equivalent to the previous one, but only an abstraction of it, as explained further.

Graphs For illustration purposes, we represent types as graphs throughout this document. More precisely, a type can be represented by two DAGs (Directed Acyclic Graphs) sharing the same set of nodes. The nodes are labelled with either a type symbol g, ⊥, or a type variable. The first DAG corresponds to the symbolic structure of a type. The second DAG corresponds to its binding structure. For example, we consider the type of the identity, σ_{id}, equal to ∀ (α ≥ ⊥) α → α. Its skeleton is ⊥ → ⊥. Such a representation ignores that the left-hand side and the right-side of the arrow correspond to the same variable α. In graphs, we make this information explicit by sharing the two nodes, as shown below:

\overrightarrow{⊥}

In this graph, we show explicitly that the left-hand child and the right-hand child of the arrow are both the type variable α. The bottom node represents α, and is therefore labelled by the bound of α, that is ⊥.

It remains to represent the binding structure of the type. We use dotted arrows and dashed arrows to represent, respectively, flexible bindings and rigid bindings. To pursue the above example, the node labelled by ⊥, which corresponds to the type variable α, is bound at top-level. This binding is flexible, thus it is represented by a dotted arrow:

\overrightarrow{⊥}

For the sake of comparison, the type ∀ (α ≥ ⊥, β = ⊥) α → β is represented by the following graph, where α is represented by the left-hand node, and β by the right-hand node.

⊥ → ⊥

As another example, the representation of ∀ (α ≥ ⊥) ∀ (β = ∀ (γ ≥ ⊥) γ → α) β → α is given below. The middle node represents β, it is rigid and bound at top-level, hence the dashed arrow. The leftmost node is γ, it is bound at the level of β (that is, γ is introduced syntactically in the bound of β) and it is flexible, hence the dotted arrow from this node to the middle node representing β. The rightmost node is α, it is flexible and bound at top-level.

⊥ → → ⊥

Although graphs are only a convenient representation of types, they may be used as a basis for an implementation.

Types are meant to be instantiated implicitly as in ML along an instance relation ⊑. As explained in the introduction, we also consider an abstraction relation ⊏ − and its inverse relation ⊐ − that is used by annotations to reveal a polymorphic type. In Section 1.5, we first define an equivalence relation between types, which is the kernel of both ⊏ − and ⊑. In Section 1.6, we define the relation ⊏ −. The instance relation ⊑, which contains ⊏ −, is defined in Section 1.7. All these relations have common properties captured by the notion of relations under prefix, as defined in the following section.

1.4 Relations under prefix

The equivalence, abstraction, and instance relation of MLF, as well as auxiliary relations introduced later in the thesis, are all relations under prefix. The prefix is meant to bind all unbound variables of considered types. In the following definition, ♢ is meant to be replaced by either ≡, ⊏ −, or ⊑.

Definition 1.4.1 A relation under prefix ♢ is a relation on triples composed of a wellformed prefix Q and two types σ_{1} and σ_{2} such that utv(σ_{1}, σ_{2}) ⊆ dom(Q). It is written (Q) σ_{1} ♢ σ_{2}.

By notation σ_{1} ♢ σ_{2} means (Q) σ_{1} ♢ σ_{2} for some unconstrained prefix Q such that utv(σ_{1}, σ_{2}) ⊆ dom(Q).

The relations under prefix we consider in this document are all meant to be used transitively. While some of these relations are transitive by definition (such as the equivalence, abstraction, and instance relations), some other relations are first defined non-transitively, and then extended with transitivity. Hence the following definition:

Definition 1.4.2 A relation under prefix ♢ is said transitive if and only if it satisfies the following rule:

R-Trans ; \frac{(Q) σ_{1} ♢ σ_{2} (Q) σ_{2} ♢ σ_{3}}{(Q) σ_{1} ♢ σ_{3}}

Given a relation ♢, we write ♢^{∗} for its transitive closure, that is, ♢^{∗} is the smallest relation containing ♢ and satisfying Rule R-Trans.

Relations under prefix are also meant to operate under the leading prefix of a type. For example, if σ_{1} ♢ σ_{2} holds, we expect ∀ (Q) σ_{1} ♢ ∀ (Q) σ_{2} to hold too. This can be captured by a single rule:

R-Context-R

\frac{(Q, α ⋄ σ) σ_{1} ♢ σ_{2} α ∉ dom(Q)}{(Q) ∀ (α ⋄ σ) σ_{1} ♢ ∀ (α ⋄ σ) σ_{2}}

Some rules can also operate on the bounds of the leading prefix. For example, if σ_{1} ♢ σ_{2} holds, we may have ∀ (α ≥ σ_{1}) σ ♢ ∀ (α ≥ σ_{2}) σ. A similar example could be given with a rigid bound instead of a flexible bound. This is captured by the two following rules

R-Context-Flexible

\frac{(Q) σ_{1} ♢ σ_{2}}{(Q) ∀ (α ≥ σ_{1}) σ ♢ ∀ (α ≥ σ_{2}) σ}

R-Context-Rigid

\frac{(Q) σ_{1} ♢ σ_{2}}{(Q) ∀ (α = σ_{1}) σ ♢ ∀ (α = σ_{2}) σ}

Figure 1.1: Type equivalence under prefix

Eq-Refl (Q) σ ≡ σ

Eq-Free

\frac{α ∉ ftv(σ_{1})}{(Q) ∀ (α ⋄ σ) σ_{1} ≡ σ_{1}}

Eq-Comm

\frac{α_{1} ∉ ftv(σ_{2}) α_{2} ∉ ftv(σ_{1}) α_{1} ≠ α_{2}}{(Q) ∀ (α_{1} ⋄_{1} σ_{1}) ∀ (α_{2} ⋄_{2} σ_{2}) σ ≡ ∀ (α_{2} ⋄_{2} σ_{2}) ∀ (α_{1} ⋄_{1} σ_{1}) σ}

Eq-Var (Q) ∀ (α ⋄ σ) α ≡ σ

Eq-Mono ; \frac{(α ⋄ σ_{0}) ∈ Q (Q) σ_{0} ≡ τ_{0}}{(Q) τ ≡ τ[τ_{0}/α]}

Definition 1.4.3 A relation under prefix ♢ is said flexible-compliant iff it satisfies rules R-Context-Flexible and R-Context-R. It is said rigid-compliant iff it satisfies rules R-Context-Rigid and R-Context-R. It is said congruent iff it satisfies these three rules.

When a relation is congruent, it satisfies the following rule, which stands for both R-Context-Flexible and R-Context-Rigid, thanks to the meta-variable ⋄.

R-Context-L

\frac{(Q) σ_{1} ♢ σ_{2}}{(Q) ∀ (α ⋄ σ_{1}) σ ♢ ∀ (α ⋄ σ_{2}) σ}

The three following sections define the equivalence, abstraction, and instance relations, respectively. As expected, the equivalence is a congruent relation. The abstraction relation happens to be a rigid-compliant relation, and the instance relation is a flexible-compliant relation.

1.5 Type equivalence

The order of quantifiers and some other syntactical notations are not always meaningful. Such syntactic artifacts are captured by a notion of type equivalence. As expected, the equivalence relation is symmetric, that is, if (Q) σ_{1} ≡ σ_{2} holds, then (Q) σ_{2} ≡ σ_{1} holds too. Additionally, it is usually not possible to read information from the prefix, except for monotypes. Thus, for instance (α = τ) α ≡ τ holds (read: under the prefix (α = τ), the types α and τ are equivalent). This is not true when τ is replaced by a type scheme σ.

Definition 1.5.1 (Equivalence) The equivalence under prefix ≡ is the smallest symmetric, transitive, and congruent relation under prefix that satisfies the rules of Figure 1.1.

Rule Eq-Comm allows the reordering of independent binders; Rule Eq-Free eliminates unused bound variables. Rule Eq-Mono allows the reading of the bound of a variable from the prefix when it is (equivalent to) a monotype. An example of use of Eq-Mono is (Q, α = τ_{0}, Q′) α → α ≡ τ_{0} → τ_{0}. Rule Eq-Mono makes no difference between ≥ and = whenever the bound is equivalent to a monotype. The restriction of Rule Eq-Mono to the case where σ_{0} is equivalent to a monotype is required for the well-formedness of the conclusion. Moreover, it also disallows (Q, α = σ_{0}, Q′) α ≡ σ_{0}: variables with polymorphic bounds must be treated abstractly and cannot be silently expanded. In particular, we do not wish (Q) ∀ (α=σ_{0}, α′=σ_{0}) α → α′ ≡ ∀ (α=σ_{0}) α → α to hold.

Rule Eq-Var expands into both ∀ (α = σ) α ≡ σ and ∀ (α ≥ σ) α ≡ σ. The former captures the intuition that ∀ (α=σ) σ′ stands for σ′[σ/α], which however, is not always well-formed. The latter may be surprising: it states that σ is an instance of ∀ (α≥σ) α, and conversely. On the one hand, the interpretation of ∀ (α ≥ σ) α as the set of all α where α is an instance of σ implies (intuitively) that σ itself is an instance of ∀ (α≥σ) α. On the other hand, however, it is not immediate to consider ∀ (α ≥ σ) α, that is, the set of all instance of σ, as an instance of σ. Actually, we could remove this second part of the equivalence without changing the set of typable terms. However, it is harmless and allows for a more uniform presentation.

Reasoning under prefixes makes it possible to break a polytype ∀ (Q) σ and “look inside under prefix Q”. For instance, it follows from iterations of Rule R-Context-R that (Q) σ ≡ σ′ suffices to show (∅) ∀ (Q) σ ≡ ∀ (Q) σ′.

Definition 1.5.1 mentions that ≡ is a symmetric relation. Therefore, in the proofs, we implicitly assume that each rule defining equivalence is symmetric. Actually, it suffices to consider only the symmetric variants of rules Eq-Var, Eq-Mono, and Eq-Free. Indeed, the other rules are already symmetric by construction.

It is not necessary to bind explicitly a monotype, as in ∀ (α = τ) α → α. Indeed, this type is equivalent to τ → τ. More generally, the following rule is derivable with rules R-Context-R, R-Context-L, Eq-Mono, R-Trans, and Eq-Free:

Eq-Mono^{⋆} ; \frac{(Q) σ′ ≡ τ}{(Q) ∀ (α ⋄ σ′) σ ≡ σ[τ/α]}

Conversely, replacing Eq-Mono by Eq-Mono^{⋆} would restrict the set of judgments. Indeed, whereas Eq-Mono is derivable by Eq-Mono^{⋆} under an empty prefix, it is not the case under an arbitrary prefix. For a counter-example, (β, α = β → β) α ≡ β → β holds by Eq-Mono, but it is not derivable if only Eq-Mono^{⋆} is allowed and not Eq-Mono.

In graphs, monotypes are nodes not binding any other node. Rules Eq-Mono and Eq-Mono^{⋆} state that such nodes can be equivalently duplicated. For example, the following equivalence holds by Eq-Mono^{⋆}:

∀ (α ≥ ⊥) ∀ (β = α → α) β → β ≡ ∀ (α ≥ ⊥) (α → α) → (α → α)

This means that the two following graphs are considered equivalent:

→ → → ⊥ ; \begin{matrix}→ \\ → \\ ⊥ \end{matrix}

All other equivalence rules, namely Eq-Refl, Eq-Free, Eq-Var, and Eq-Comm are already captured by graphs.

The following rule is derivable with rules Eq-Free and Eq-Var:

Eq-Var^{⋆} ; \frac{(α ⋄ σ) ∈ Q}{(Q_{0}) ∀ (Q) α ≡ ∀ (Q) σ}

1.5.1 Rearrangements

Normal forms will be unique, up to commutation of independent binders, that is, up to Rule Eq-Comm. We define an equivalence relation that captures only such a reordering of binders.

Definition 1.5.2 The relation ≈ is the smallest equivalence relation satisfying the following rules:

\frac{σ_{1} ≈ σ_{2}}{∀ (α ⋄ σ) σ_{1} ≈ ∀ (α ⋄ σ) σ_{2}} \frac{σ_{1} ≈ σ_{2}}{∀ (α ⋄ σ_{1}) σ ≈ ∀ (α ⋄ σ_{2}) σ} ; \frac{α_{1} ∉ ftv(σ_{2}) α_{2} ∉ ftv(σ_{1}) α_{1} ≠ α_{2}}{∀ (α_{1} ⋄_{1} σ_{1}) ∀ (α_{2} ⋄_{2} σ_{2}) σ ≈ ∀ (α_{2} ⋄_{2} σ_{2}) ∀ (α_{1} ⋄_{1} σ_{1}) σ}

1.5 Type equivalence  49

When σ_{1} ≈ σ_{2} holds, we say that σ_{1} is a rearrangement of σ_{2}. When ∀ (Q_{1}) ⊥ ≈ ∀ (Q_{2}) ⊥ holds, we say that Q_{1} is a rearrangement of Q_{2}.

Note that the relation ∀ (Q_{1}) ∇_{Q_{1}} ≈ ∀ (Q_{2}) ∇_{Q_{1}} mentions ∇_{Q_{1}} (that is, a type mentioning all type variables of dom(Q_{1})) on both sides. Thus, it prevents implicit α-conversion of the domain of Q_{1} between ∀ (Q_{1}) ∇_{Q_{1}} and ∀ (Q_{2}) ∇_{Q_{1}}.

Properties 1.5.3 i) If σ ≈ τ, then σ = τ. ii) If σ_{1} ≈ σ_{2} holds and θ is a substitution, then θ(σ_{1}) ≈ θ(σ_{2}) holds. iii) If σ_{1} ≈ σ_{2}, then (Q) σ_{1} ≡ σ_{2} holds for any well-formed prefix Q such that we have

utv(σ_{1}, σ_{2}) ⊆ dom(Q) iv) If Q′ ≈ Q and (Q) σ_{1} ≡ σ_{2} hold, then (Q′) σ_{1} ≡ σ_{2}.

v) If QQ′ is well-formed and (Q) σ_{1} ≡ σ_{2} holds, then (QQ′) σ_{1} ≡ σ_{2} holds.

\underline{Proof}: \underline{Property i}: It only states that any rearrangement of a monotype τ is τ itself.

\underline{Property ii}: It is shown by induction on the derivation of σ_{1} ≈ σ_{2}.

\underline{Property iii}: By definition ≈ is a binary relation. Let ˙≈ be the relation on triples defined as (Q) σ_{1} ˙≈σ_{2} if and only if σ_{1} ≈ σ_{2} holds and Q is well-formed. Then ˙≈ is the smallest relation satisfying rules Eq-Refl, R-Trans, R-Context-R, R-Context-L, and Eq-Comm (where ≡ is replaced by ˙≈). Consequently, ˙≈ is included in ≡. Therefore, if σ_{1} ≈ σ_{2} holds, then (Q) σ_{1} ≡ σ_{2} holds for any well-formed Q binding the variables of utv(σ_{1}, σ_{2}).

\underline{Property iv} : It is shown by induction on the derivation of (Q) σ_{1} ≡ σ_{2}. Cases Eq-Refl, Eq-Free, Eq-Comm, and Eq-Var are immediate. Cases R-Trans and R-Context-L are by induction hypothesis. Case R-Context-R is by induction hypothesis, observing that (Q, α ⋄ σ_{0}) is a rearrangement of (Q′, α ⋄ σ_{0}). As for Eq-Mono, σ_{1} is τ, σ_{2} is τ[τ_{0}/α], and the premises are (α ⋄ σ_{0}) ∈ Q and (Q) σ_{0} ≡ τ_{0}. By induction hypothesis, we have (Q′) σ_{0} ≡ τ_{0} (\underline{1}). Since Q′ is a rearrangement of Q, we have (α ⋄ σ′_{0}) ∈ Q′, where σ′_{0} is a rearrangement of σ_{0}. Hence, (Q′) σ_{0} ≡ σ′_{0} (\underline{2}) holds by property iii. Consequently, (Q′) σ′_{0} ≡ τ_{0} holds by R-Trans, (1), and (2). Then (Q′) σ_{1} ≡ σ_{2} holds by Rule Eq-Mono.

\underline{Property v} : It is a subcase of the following, more general property:

If Q_{1}Q_{2}Q_{3} is well-formed, and if (Q_{1}Q_{3}) σ_{1} ≡ σ_{2} holds, then (Q_{1}Q_{2}Q_{3}) σ_{1} ≡
σ_{2} holds.

It is shown by induction on the derivation of (Q_{1}Q_{3}) σ_{1} ≡ σ_{2}.

50  Types, prefixes, and relations under prefixes

1.5.2 Occurrences and equivalence

Occurrences—and therefore free type variables—are stable under type equivalence:

Properties 1.5.4 i) If (QQ′) σ_{1} ≡ σ_{2} holds and Q is unconstrained, then ∀ (Q′) σ_{1}/ = ∀ (Q′) σ_{2}/. ii) We have τ_{1} ≡ τ_{2} iff τ_{1} is τ_{2}. iii) If σ_{1} ≡ σ_{2} holds, then ftv(σ_{1}) = ftv(σ_{2}).

\underline{Proof}: \underline{Property i}: By definition of occurrences, it suffices to show that whenever (QQ′) σ_{1} ≡ σ_{2} (\underline{1}) holds, then proj(∀ (Q′) σ_{1}) and proj(∀ (Q′) σ_{2}) are equal. The proof is by induction on the derivation of (1). Case R-Trans is by induction hypothesis. In Cases Eq-Refl, Eq-Free, Eq-Comm, and Eq-Var, we have proj(σ_{1}) = proj(σ_{2}), thus we get the expected result by Property 1.3.3.ii (page 40). Remaining cases are:

∘ Case R-Context-L: We have σ_{1} = ∀ (α ⋄ σ′_{1}) σ (\underline{2}), σ_{2} = ∀ (α ⋄ σ′_{2}) σ (\underline{3}), and the premise is (QQ′) σ′_{1} ≡ σ′_{2}. By α-conversion, we can freely assume that α is not in dom(QQ′). We have proj(∀ (Q′) σ′_{1}) = proj(∀ (Q′) σ′_{2}) by induction hypothesis, that is, Θ_{Q′}(proj(σ′_{1})) = Θ_{Q′}(proj(σ′_{2})) (\underline{4}). Hence, we have the following, where i can be 1 or 2:

proj(∀ (Q′) σ_{i}) = proj(∀ (Q′) ∀ (α ⋄ σ′_{i}) σ)  by (2) or (3)
= Θ_{Q′}(proj(∀ (α ⋄ σ′_{i}) σ))  by Property 1.3.3.i (page 40)
= Θ_{Q′}(proj(σ)[proj(σ′_{i})/α])  by Definition 1.3.2
= Θ_{Q′}(proj(σ))[Θ_{Q′}(proj(σ′_{i}))/α] (\underline{5})

Additionally, by (4), we get

Θ_{Q′}(proj(σ))[Θ_{Q′}(proj(σ′_{1}))/α] = Θ_{Q′}(proj(σ))[Θ_{Q′}(proj(σ′_{2}))/α] (\underline{6})

Hence, proj(∀ (Q′) σ_{1}) = proj(∀ (Q′) σ_{2}) holds by (5) and (6).

∘ Case R-Context-R: We have σ_{1} = ∀ (α ⋄ σ) σ′_{1}, σ_{2} = ∀ (α ⋄ σ) σ′_{2}, and the premise is (QQ′, α ⋄ σ) σ′_{1} ≡ σ′_{2}. By induction hypothesis, we get proj(∀ (Q′, α ⋄ σ) σ′_{1}) = proj(∀ (Q′, α ⋄ σ) σ′_{2}), which is the expected result.

∘ Case Eq-Mono: We have σ_{1} = τ and σ_{2} = τ[τ_{0}/α]. The premises are (QQ′) σ_{0} ≡ τ_{0} (\underline{7}) and (α ⋄ σ_{0}) ∈ QQ′. Necessarily, (α ⋄ σ_{0}) is in Q′ (\underline{8}) because Q is unconstrained by hypothesis. By induction hypothesis and (7), we get proj(∀ (Q′) σ_{0}) = proj(∀ (Q′) τ_{0}), which gives Θ_{Q′}(proj(σ_{0})) = Θ_{Q′}(proj(τ_{0})) (\underline{9}) by Property 1.3.3.i (page 40). We have

proj(∀ (Q′) τ) = Θ_{Q′}(τ)  by Property 1.3.3.i (page 40)
= Θ_{Q′}(τ[Θ_{Q′}(proj(σ_{0}))/α]) by (8) and Definition 1.3.2
= Θ_{Q′}(τ[Θ_{Q′}(proj(τ_{0}))/α]) by (9)
= Θ_{Q′}(τ[τ_{0}/α])  by Definition 1.3.2
= proj(∀ (Q′) τ[τ_{0}/α])  by Property 1.3.3.i (page 40)

This is the expected result \underline{Property ii}: Assume τ ≡ τ′. By definition, this means that we have (∅) τ ≡ τ′. Hence, by Property i, we have τ/ = τ′/, that is proj(τ)/ = proj(τ′)/. Hence, the skeletons proj(τ) and proj(τ′) are equal. Since by definition proj(τ) is τ and proj(τ′) is τ′, we have the expected result, that is, τ = τ′.

\underline{Property iii}: It is a direct consequence of property i.

1.5.3 Canonical forms for types

In this section, we define a function nf that maps all equivalent types to the same normal form, up to rearrangement.

Definition 1.5.5 We define the function nf(σ) inductively as follows:

nf(⊥) =^{△} ⊥  nf(τ) =^{△} τ  nf(∀ (α ⋄ σ) σ′) =^{△} \begin{cases}nf(σ) & if nf(σ′) is α \\ nf(σ′)[τ/α] & if nf(σ) is τ \\ nf(σ′) & if α ∉ ftv(σ′) \\ ∀ (α ⋄ nf(σ)) nf(σ′) & otherwise \end{cases}

If nf(σ) = σ, we say that σ is in normal form.

We state here some useful properties about normal forms.

Properties 1.5.6 The following hold for any type σ and any substitution θ: i) nf(σ) ≡ σ. ii) ftv(σ) = ftv(nf(σ)). iii) nf(θ(σ)) = θ(nf(σ)). iv) nf(σ) is in normal form.

These properties are shown by induction on the number of universal quantifiers appearing in σ. The full proof can be found in Appendix (page 231).

In MLF, we distinguish monotypes τ and polytypes σ. Actually, we also need to spot monotypes up to equivalence, that is, polytypes that are equivalent to monotypes. Similarly, we spot type variables up to equivalence, that is, polytypes that are equivalent to type variables.

Definition 1.5.7 The set of polytypes σ such that nf(σ) = τ for some monotype τ is written T . The set of polytypes σ such that nf(σ) = α for some type variable α is written V.

By Rule Eq-Mono^{⋆}, R-Trans, and Property 1.5.6.i, if σ is in T , we have ∀ (α=σ) σ′ ≡ ∀ (α ≥ σ) σ′. This is the reason why, in the following, any binding (α ⋄ σ) where σ is in T is considered both flexible and rigid. In other words, flexibility is not meaningful for a bound in T . This is not surprising since monotypes cannot be instantiated anyway.

Definition 1.5.8 The substitution extracted from a prefix Q, written Q̂, is defined by:

ˆ∅ =^{△} id { \atop (α ⋄ σ, Q′)} =^{△} \begin{cases}[nf(σ)/α] ∘ Q̂′ & if σ ∈ T \\ Q̂′ & otherwise \end{cases}

Notice that { \atop Q_{1}Q_{2}} = Q̂_{1} ∘ Q̂_{2} holds for any well-formed prefix Q_{1}Q_{2}. Besides, for any σ and Q, we have (Q) σ ≡ Q̂(σ) by using Eq-Mono repeatedly. Note also that the domain of Q̂ is the set of variables of dom(Q) whose bound is in T . Therefore, dom(Q̂) ⊆ dom(Q) holds. This can be compared with the domain of Θ_{Q}, which is always dom(Q).

As expected, normal forms capture the equivalence relation, up to commutation and alpha-conversion of binders. Since the equivalence relation is defined under a prefix, it has to be taken into account when comparing normal forms. This is stated precisely by the following lemma:

Lemma 1.5.9 If (Q) σ_{1} ≡ σ_{2} holds, then so does Q̂(nf(σ_{1})) ≈ Q̂(nf(σ_{2})).

\underline{Proof}: by induction on the derivation of (Q) σ_{1} ≡ σ_{2}.

∘ Case Eq-Refl: Immediate.

∘ Case R-Trans: By induction hypothesis and transitivity of the relation ≈.

∘ Case Eq-Free: We have σ_{2} = ∀ (α ⋄ σ) σ_{1} and α ∉ ftv(σ_{1}). By definition, nf(σ_{2}) is nf(σ_{1}), thus Q̂(nf(σ_{1})) is Q̂(nf(σ_{2})), and Q̂(nf(σ_{1})) ≈ Q̂(nf(σ_{2})) holds.

∘ Case Eq-Comm: We have σ_{1} ≈ σ_{2} by hypothesis, thus Q̂(nf(σ_{1})) ≈ Q̂(nf(σ_{2})) holds by Property 1.5.3.ii.

∘ Case Eq-Var: We have σ_{2} = ∀ (α ⋄ σ_{1}) α. By definition, nf(σ_{2}) is nf(σ_{1}), thus we have Q̂(nf(σ_{1})) = Q̂(nf(σ_{2})), which implies Q̂(nf(σ_{1})) ≈ Q̂(nf(σ_{2})).

∘ Case R-Context-R: We have σ_{1} = ∀ (α ⋄ σ) σ′_{1} and σ_{2} = ∀ (α ⋄ σ) σ′_{2}. The premise is (Q, α ⋄ σ) σ′_{1} ≡ σ′_{2} (\underline{1}). By induction hypothesis and (1), we have the rearrangement { \atop (Q, α ⋄ σ)}(nf(σ′_{1})) ≈ { \atop (Q, α ⋄ σ)}(nf(σ′_{2})) (\underline{2}). Note that (Q, α ⋄ σ) is well-formed only if α ∉ dom(Q), thus, α ∉ dom(Q̂) ∪ codom(Q̂) (\underline{3}). We proceed by case analysis.

Subcase nf(σ) is τ: Let θ be [τ/α]. We have { \atop Q, α ⋄ σ} = Q̂ ∘ θ, thus, by (2), Q̂ ∘ θ(nf(σ′_{1})) ≈ Q̂ ∘ θ(nf(σ′_{2})). Since nf(∀ (α ⋄ σ) σ′_{1}) is by definition θ(nf(σ′_{1})) and nf(∀ (α ⋄ σ)

1.5 Type equivalence  53

σ′_{2}) is θ(nf(σ′_{2})), we have shown that Q̂(nf(σ_{1})) ≈ Q̂(nf(σ_{2})). In the following subcases, we assume that nf(σ) is not a monotype τ, which implies { \atop Q, α ⋄ σ} = Q̂ (\underline{4}). Note also that Q̂(α) = α (\underline{5}) holds from (3). We have Q̂(nf(σ′_{1})) ≈ Q̂(nf(σ′_{2})) (\underline{6}) from (4) and (2).

Subcase nf(σ′_{1}) is α: From (6) and (5), we have α ≈ Q̂(nf(σ′_{2})). By Property 1.5.3.i, this gives Q̂(nf(σ′_{2})) = α. Hence, nf(σ′_{2}) is α by (3). By definition, nf(σ_{1}) and nf(σ_{2}) are nf(σ), thus Q̂(nf(σ_{1})) ≈ Q̂(nf(σ_{2})) holds by reflexivity.

Subcase nf(σ′_{2}) is α is similar.

Subcase α ∉ ftv(nf(σ′_{1})): By (3), we get α ∉ ftv(Q̂(nf(σ′_{1}))). By (6) and Property 1.5.4.iii, we get α ∉ ftv(Q̂(nf(σ′_{2}))). By (3), we get α ∉ ftv(nf(σ′_{2})). Hence, nf(σ_{1}) is nf(σ′_{1}) and nf(σ_{2}) is nf(σ′_{2}), thus we get the result by (6).

Subcase α ∉ ftv(nf(σ′_{2})) is similar.

Otherwise, nf(σ) is not equal to a monotype τ, α ∈ ftv(nf(σ′_{1})), α ∈ ftv(nf(σ′_{2})), nf(σ′_{1}) is not α, and nf(σ′_{2}) is not α. By definition nf(σ_{1}) is ∀ (α⋄nf(σ)) nf(σ′_{1}) and nf(σ_{2}) is ∀ (α ⋄ nf(σ)) nf(σ′_{2}). From (6), we get ∀ (α ⋄ Q̂(σ)) Q̂(nf(σ′_{1})) ≈ ∀ (α ⋄ Q̂(σ)) Q̂(nf(σ′_{2})), that is Q̂(nf(σ_{1})) ≈ Q̂(nf(σ_{2})).

∘ Case R-Context-L: We have σ_{1} = ∀ (α⋄σ′_{1}) σ and σ_{2} = ∀ (α⋄σ′_{2}) σ. The premise is (Q) σ′_{1} ≡ σ′_{2}. By induction hypothesis, we have Q̂(nf(σ′_{1})) ≈ Q̂(nf(σ′_{2})) (\underline{7}). We proceed by case analysis:

Subcase nf(σ) is α: Then nf(σ_{1}) is nf(σ′_{1}) and nf(σ_{2}) is nf(σ′_{2}), thus (7) is the expected result.

Subcase α ∉ nf(σ): nf(σ_{1}) is nf(σ) and nf(σ_{2}) is nf(σ). Hence, Q̂(nf(σ_{1})) = Q̂(nf(σ_{2})), which implies the expected result.

Subcase nf(σ′_{1}) is τ_{1}: By induction hypothesis (7), nf(σ′_{2}) is a monotype τ_{2} such that Q̂(τ_{1}) = Q̂(τ_{2}) (\underline{8}) holds. By definition 1.5.5, nf(σ_{1}) is nf(σ)[τ_{1}/α] (\underline{9}) and nf(σ_{2}) is nf(σ)[τ_{2}/α] (\underline{10}). Hence, we have:

Q̂(nf(σ_{1})) = Q̂(nf(σ)[τ_{1}/α])  by (9)
= Q̂(nf(σ)[Q̂(τ_{1})/α])
= Q̂(nf(σ)[Q̂(τ_{2})/α]) by (8)
= Q̂(nf(σ)[τ_{2}/α])
= Q̂(nf(σ_{2}))  by (10)

This is the expected result.

Subcase nf(σ′_{2}) is τ_{2} is similar.

Otherwise, nf(σ_{1}) is ∀ (α ⋄ nf(σ′_{1})) nf(σ) and nf(σ_{2}) is ∀ (α ⋄ nf(σ′_{2})) nf(σ). Hence, we have Q̂(nf(σ_{1})) ≈ Q̂(nf(σ_{2})) by (7).

∘ Case Eq-Mono: We have σ_{1} = τ, σ_{2} = τ[τ_{0}/α], (α⋄σ_{0}) ∈ Q (\underline{11}), and (Q) σ_{0} ≡ τ_{0}. By induction hypothesis, we have Q̂(nf(σ_{0})) ≈ Q̂(τ_{0}), which implies Q̂(nf(σ_{0})) = Q̂(τ_{0}) by Property 1.5.3.i. Hence, nf(σ_{0}) = τ′ (\underline{12}) such that Q̂(τ′) = Q̂(τ_{0}) (\underline{13}). We have Q̂(σ_{1}) = Q̂(τ) = Q̂(τ[τ′/α]) (\underline{14}) by (11), by definition of Q̂, and by (12). We also have Q̂(σ_{2}) = Q̂(τ[τ_{0}/α]) = Q̂(τ[τ′/α]) (\underline{15}) by (13). Hence, Q̂(σ_{1}) = Q̂(σ_{2}) holds from (14) and (15), that is, Q̂(nf(σ_{1})) = Q̂(nf(σ_{2})) since nf(σ_{1}) = nf(τ) = τ = σ_{1} and nf(σ_{2}) = σ_{2}.

The next corollary characterizes equivalence under prefix. It shows that the only information that is used from the prefix Q is its associated substitution Q̂.

Corollary 1.5.10 We have (Q) σ_{1} ≡ σ_{2} iff Q̂(σ_{1}) ≡ Q̂(σ_{2}).

See proof in the Appendix (page 232).

As a consequence, we have the following characterization of normal forms:

nf(σ) is a rearrangement of nf(σ′) iff (Q) σ ≡ σ′ holds for any well-formed prefix Q such that utv(σ, σ′) ⊆ dom(Q).

Next is a set of properties used throughout the thesis. For instance, Property i states that equivalent types have equal normal form, up to rearrangement. Property v shows that equivalence is preserved under substitution. Property vii shows that equivalent monotypes are actually equal, up to the substitution extracted from the prefix. Property viii will be used directly for showing the soundness of the unification algorithm. It states that two types are equivalent (under a given prefix) if and only if their subparts are equivalent.

Properties 1.5.11 For any polytypes σ, σ_{1}, σ_{2}, any well-formed prefix Q, and any substitution θ, we have:

i) If σ_{1} ≡ σ_{2}, then nf(σ_{1}) ≈ nf(σ_{2}). ii) σ is in T iff σ ≡ τ for some monotype τ iii) σ is in V iff σ ≡ α for some type variable α iv) θ(σ) is in T iff σ is in T .

v) If σ_{1} ≡ σ_{2}, then θ(σ_{1}) ≡ θ(σ_{2}). vi) If (Q) σ_{1} ≡ σ_{2}, then Q̂(σ_{1})/ = Q̂(σ_{2})/. vii) (Q) τ_{1} ≡ τ_{2} iff Q̂(τ_{1}) = Q̂(τ_{2}). viii) (Q) g τ_{1} … τ_{n} ≡ g′ τ′_{1} … τ′_{m} holds if and only if g = g′, n = m and (Q) τ_{i} ≡ τ′_{i}

holds for all i in 1..n. ix) If (Q) σ_{1} ≡ σ_{2} and α ∉ dom(Q̂) hold, then α ∈ ftv(σ_{1}) iff α ∈ ftv(σ_{2}).

x) If σ_{1} ∈ T and (Q) σ_{1} ≡ σ_{2} hold, then σ_{2} ∈ T .

These properties are shown using Lemma 1.5.9 or Corollary 1.5.10.

Constructed forms

Types of the form ∀ (α ⋄σ) α are equivalent to σ by Rule Eq-Var. However such types hide their structure in the bound of α. We sometimes need to force the structure of a type to be apparent. Hence, the following definition:

Definition 1.5.12 A type σ is in constructed form if and only if σ is ⊥, or σ is of the form ∀ (Q) τ and τ ∉ dom(Q).

We note that every type τ is in constructed form. Moreover, every type admits a constructed form: the function cf, defined below, maps every type to a constructed form.

cf(⊥) =^{△} ⊥  cf(τ) =^{△} τ  cf(∀ (α ⋄ σ) σ′) =^{△} \begin{cases}cf(σ) & if nf(σ′) is α \\ ∀ (α ⋄ σ) cf(σ′) & otherwise \end{cases}

Properties 1.5.13 i) For any type σ, we have cf(σ) ≡ σ. ii) If σ is in constructed form, then cf(σ) is σ.

The equivalence under (a given) prefix is a symmetric operation. In other words, it captures reversible transformations. Irreversible transformations are captured by an instance relation ⊑. Moreover, as explained in the introduction, we distinguish a subrelation ⊏ − of ⊑ called abstraction. The inverse of abstraction is used by type annotations to reveal the polymorphic type bound to a type variable in the prefix. In contrast, inverse of instance relations would, in general, be unsound. Indeed, reversing the instance relation is not sound in ML either.

1.6 The abstraction relation

Definition 1.6.1 (Abstraction) The abstraction relation ⊏ − is the smallest transitive and rigid-compliant relation under prefix that satisfies the rules of Figure 1.2.

We write (Q) σ_{1} ⊏ − σ_{2}, which is read “σ_{2} is an abstraction of σ_{1}” or “σ_{1} is a revelation of σ_{2}” under prefix Q. The abstraction relation is a rigid-compliant relation under prefix, which means that abstraction under flexible bounds is not allowed. Equivalence is included in abstraction by Rule A-Equiv. Rule A-Hyp replaces a polytype σ_{1} by a variable α_{1}, provided α_{1} is rigidly bound to σ_{1} in Q. Note that Rule A-Hyp is not reversible. In particular, (α_{1} = σ_{1}) ∈ Q does not imply (Q) α_{1} ⊏ − σ_{1}, unless σ_{1} is in T . This asymmetry is essential, since uses of ⊏ − will be inferred, but uses of ⊐ − will

Figure 1.2: The abstraction relation

A-Equiv ; \frac{(Q) σ_{1} ≡ σ_{2}}{(Q) σ_{1} ⊏ − σ_{2}}  A-Hyp ; \frac{(α_{1} = σ_{1}) ∈ Q}{(Q) σ_{1} ⊏ − α_{1}}

not. When (Q) σ_{1} ⊏ − α_{1} holds, we say that the polytype σ_{1} is abstracted with α_{1}. This operation can also be seen as hiding the polymorphic type σ_{1} under the abstract name α_{1}. Conversely, (Q) α_{1} ⊐ − σ_{1} consists of revealing the polytype abstracted by the name α_{1}. An abstract polytype, i.e. a variable bound to a polytype in Q, can only be manipulated by its name, i.e. abstractly. The polytype must be revealed explicitly (by using the relation ⊐ −) before it can be further instantiated (along the relations ⊏ − or ⊑). (See also Examples 6.2.12 and 6.2.13 below.)

Example 1.6.3 The abstraction (α = σ) ∀ (α = σ) σ′ ⊏ − σ′ is derivable: on the one hand, (α = σ) σ ⊏ − α holds by A-Hyp, leading to (α = σ) ∀ (α = σ) σ′ ⊏ − ∀ (α = α) σ′ by R-Context-Rigid; on the other hand, (α=σ) ∀ (α=α) σ′ ≡ σ′ holds by Eq-Mono^{⋆}. Hence, we conclude by A-Equiv and R-Trans.

The following rule is derivable by A-Hyp, R-Context-Rigid and Eq-Mono^{⋆}:

A-Up^{⋆} ; \frac{α′ ∉ ftv(σ_{0})}{∀ (α = ∀ (α′ = σ′) σ) σ_{0} ⊏ − ∀ (α′ = σ′) ∀ (α = σ) σ_{0}}

This rule can be represented with graphs as follows:

\begin{aligned}& g \\ g_{α} \\ g_{α′} \end{aligned}  ⊏ −  \begin{aligned}& g \\ g_{α} \\ g_{α′} \end{aligned}

The top level node is labelled with g, which is defined as σ_{0}/ϵ. The two other nodes are labelled with g_{α} and g_{α′}, which are defined respectively as σ/ϵ and σ′/ϵ. The symbolic structure of the type is not known in detail. However, we expect α to be free in σ_{0} and α′ to be free in σ. This is represented by the doubled dashed lines.

Intuitively, only rigid bindings in Q are read (abstracted) in the derivation of (Q) σ_{1} ⊏ − σ_{2}, flexible bindings are simply ignored. Hence, if Q is unconstrained, it can be replaced by any other well-formed prefix, as stated by the following property:

Lemma 1.6.2 If we have σ_{1} ⊏ − σ_{2}, then (Q) σ_{1} ⊏ − σ_{2} holds whenever it is well-formed.

\underline{Proof}: This lemma is a consequence of the following, more general statement, taking Q′ = ∅.

If Q is unconstrained and (QQ′) σ_{1} ⊏ − σ_{2} holds, if dom(Q) ⊆ dom(Q′′) holds
and Q′′Q′ is well-formed, then (Q′′Q′) σ_{1} ⊏ − σ_{2} holds too.

It is shown by induction on the derivation of (QQ′) σ_{1} ⊏ − σ_{2}. Cases R-Trans, R-Context-R, and R-Context-Rigid are by induction hypothesis. Note that the reinforcement of the statement is necessary for the case R-Context-R.

∘ Case A-Equiv: By hypothesis (QQ′) σ_{1} ≡ σ_{2} holds. Let θ be Q̂ ∘ Q̂′. By Corollary 1.5.10, we have θ(σ_{1}) ≡ θ(σ_{2}) (\underline{1}) Since Q is unconstrained, Q̂ is the identity. Hence, θ is Q̂′. As a consequence, { \atop Q′′Q′} is Q̂′′ ∘ θ (\underline{2}). By Property 1.5.11.v and (1), we have Q̂′′ ∘ θ(σ_{1}) ≡ Q̂′′ ∘ θ(σ_{2}). By Corollary 1.5.10 and (2), we get (Q′′Q′) σ_{1} ≡ σ_{2}. Hence, (Q′′Q′) σ_{1} ⊏ − σ_{2} holds by A-Equiv.

∘ Case A-Hyp: We have σ_{2} = α and (α = σ_{1}) ∈ QQ′. Since Q is unconstrained, we must have (α = σ_{1}) ∈ Q′. Hence, (α = σ_{1}) ∈ Q′′Q′, thus (Q′′Q′) σ_{1} ⊏ − α holds by A-Hyp. This is the expected result.

The abstraction relation can only hide a polytype under its abstract name, but cannot modify the structure of the polytype. This is why this relation is (explicitly) reversible. In order to instantiate polytypes, as we do in ML, we need an irreversible instance relation.

1.7 The instance relation

Definition 1.7.1 (Instance) The instance relation ⊑ is the smallest transitive and flexible-compliant relation under prefix that satisfies the rules of Figure 1.3.

We write (Q) σ_{1} ⊑ σ_{2}, which is read “σ_{2} is an instance of σ_{1}” or “σ_{1} is more general than σ_{2}” under prefix Q.

It is a flexible-compliant relation under prefix, thus only flexible bindings may be instantiated. Conversely, instantiation cannot occur under rigid bounds, except when it is an abstraction, and we have to use I-Abstract then. Rule I-Bot means that ⊥ behaves as a least element for the instance relation. Rule I-Rigid mean that flexible bounds can be changed into rigid bounds. An interesting rule is I-Hyp—the counterpart of rule A-Hyp, which replaces a polytype σ_{1} by a variable α_{1}, provided σ_{1} is a flexible bound of α_{1} in Q.

Example 1.7.4 The instance relation (α ≥ σ) ∀ (α ≥ σ) σ′ ⊑ σ′ holds. The derivation follows the one of Example 1.6.3 but uses I-Hyp and R-Context-Flexible instead of A-Hyp and R-Context-Rigid. More generally, the following rule is derivable:

I-Drop^{⋆} ; \overline{(QQ′Q′′) ∀ (Q′) σ ⊑ σ}

Example 1.7.5 The relation^{1} (Q) ∀ (α ≥ σ) ∀ (β ≥ σ ) α → β ⊑ ∀ (α ≥ σ) ∀ (β ≥ α ) α → β follows by rules R-Context-R, R-Context-Flexible, and I-Hyp. The right hand side is equivalent to ∀ (α ≥ σ) α → α by Eq-Mono^{⋆}.

The following rules are derivable as well:

I-Equiv^{⋆} ; \frac{(Q) σ_{1} ≡ σ_{2}}{(Q) σ_{1} ⊑ σ_{2}}  I-Up^{⋆} ; \frac{α_{2} ∉ ftv(σ)}{(Q) ∀ (α_{1} ≥ ∀ (α_{2} ⋄ σ_{2}) σ_{1}) σ ⊑ ∀ (α_{2} ⋄ σ_{2}) ∀ (α_{1} ≥ σ_{1}) σ}

We represent I-Up^{⋆} with graphs as follows:

\begin{aligned}& g \\ g_{α} \\ g_{α′} \end{aligned}  ⊑  \begin{aligned}& g \\ g_{α} \\ g_{α′} \end{aligned}

We now state a few simple properties about abstraction and instantiation, using the meta-symbol ♢.

1The single difference between the two types is highlighted.

Figure 1.3: Type instance

I-Abstract \frac{(Q) σ_{1} ⊏ − σ_{2}}{(Q) σ_{1} ⊑ σ_{2}} I-Hyp \frac{(α_{1} ≥ σ_{1}) ∈ Q}{(Q) σ_{1} ⊑ α_{1}} I-Bot (Q) ⊥ ⊑ σ I-Rigid \overline{(Q) ∀ (α ≥ σ_{1}) σ ⊑ ∀ (α = σ_{1}) σ}

Properties 1.7.2

i) Given a renaming ϕ of dom(Q), if (Q) σ_{1} ♢ σ_{2} holds, then we have a derivation with the same size of (ϕ(Q)) ϕ(σ_{1}) ♢ ϕ(σ_{2}).

ii) If Q′ ≈ Q and (Q) σ_{1} ♢ σ_{2} hold, then we have (Q′) σ_{1} ♢ σ_{2}. iii) If QQ′ is well-formed and (Q) σ_{1} ♢ σ_{2} holds, then we have (QQ′) σ_{1} ♢ σ_{2}.

The proofs are by induction on the input derivation.

1.8 Examples

In this section, we consider two examples. The first one illustrates how the usual ML instance relation is subsumed by the instance relation of MLF. The second example considers a well-known isomorphism in System F, which is partially captured by our instance relation.

Example 1.8.6 The relation ⊑ generalizes the instance relation of ML. For example, the type ∀ (α) τ[α] is more general than ∀ (α, α′) τ[α → α′], as shown by the following derivation (valid under any prefix):

∀ (α) τ[α]
= ∀ (α ≥ ⊥) τ[α]  (\underline{1})
≡ ∀ (α′, α′′) ∀ (α ≥ ⊥) τ[α]  (\underline{2})
⊑ ∀ (α′, α′′) ∀ (α ≥ α′ → α′′) τ[α]  (\underline{3})
≡ ∀ (α′, α′′) τ[α′ → α′′]  (\underline{4})
= ∀ (α, α′) τ[α → α′]  (\underline{5})

(1) by notation; (2) by Eq-Free; (3) by R-Context-Flexible, since (α′, α′′) ⊥ ⊑ α′ → α′′; (4) by Eq-Mono^{⋆}; and (5) by renaming.

We represent this instance relation by the graphs below. The symbol g is the top symbol of τ, that is, τ/ϵ. The node labelled with ⊥ in the left-hand graph represents α. The two nodes labelled with ⊥ in the right-hand graph represent α and α′, respectively.

\begin{aligned}& g \\ ⊥ \end{aligned}  ⊑  ^{⊥ → g ⊥}

Note that another derivation is possible:

∀ (α) τ[α]
= ∀ (α ≥ ⊥) τ[α]  (\underline{6})
⊑ ∀ (α ≥ ∀ (α′, α′′) α′ → α′′) τ[α] (\underline{7})
⊑ ∀ (α′, α′′) ∀ (α ≥ α′ → α′′) τ[α] (\underline{8})
≡ ∀ (α′, α′′) τ[α′ → α′′]  (\underline{9})
≡ ∀ (α, α′) τ[α → α′]  (\underline{10})

(6) by notation; (7) by R-Context-Flexible and I-Bot; (8) by I-Up^{⋆}; (9) by Eq-Mono^{⋆}; and (10) by renaming.

Two instantiations are used (namely (7) and (8)). We represent them with the following graphs:

\begin{aligned}& g \\ ⊥ \end{aligned}  ⊑  ^{⊥ → g ⊥}  ⊑  ^{⊥ → g ⊥}

Example 1.8.7 The instance relation of MLF covers an interesting case of type isomorphism [Cos95]. In System F, type ∀ α · τ′ → τ is isomorphic^{2} to τ′ → ∀ α · τ whenever α is not free in τ′. In MLF, the two corresponding polytypes are not equivalent but in an instance relation. Precisely, ∀ (α′ ≥ ∀ (α) τ) τ′ → α′ is more general than ∀ (α) τ′ → τ, as shown by the following derivation:

∀ (α′ ≥ ∀ (α) τ) τ′ → α′
⊑ ∀ (α) ∀ (α′ ≥ τ) τ′ → α′  by I-Up^{⋆}
≡ ∀ (α) τ′ → τ  by Eq-Mono^{⋆}

2That is, there exists a function ηβ-reducible to the identity that transforms one into the other, and conversely.

As a particular case, let σ_{id} =^{△} ∀ (β) β → β; then ∀ (α, α′ ≥ σ_{id}) α → α′ is more general than ∀ (α, β) α → β → β (the derivation closely follows the one of example 1.8.6). It should be noticed that we encoded the System F type τ′ → ∀ α · τ by ∀ (α′ ≥ ∀ (α) τ) τ′ → α′. Another valid encoding would be ∀ (α′ = ∀ (α′ = ∀ (α) τ)) τ′ → α. Then the bound of α′ is rigid, and the derivation given above is not possible. In that case, the types are not in an instance relation. However, as in System F, it is possible to write a retyping function from one type to the other.

This example shows that MLF types and instance relation can capture part of this isomorphism. This is actually a standard approach when addressing the problem of type inference with first class polymorphism. For example, the intermediate language Λ_{2}^{−} [KW94] forbids quantifiers at the right of arrows. This language is shown equivalent to System F, thanks to the aforementioned isomorphism. As another example, taken from Odersky and Läufer’s article [OL96] ∀ α · int → α list is made a subtype of int → ∀ α · α list using an appropriate instance relation.

In summary, MLF partially captures the type isomorphism given above. It should also be noted that, as opposed to type containment [Mit88], the instance relation cannot express any form of contravariance.

62

Chapter 2

Properties of relations under prefixes

Instantiation in ML consists of applying a substitution: given a type scheme σ =^{△} ∀ (ᾱ) τ, its instances are of the form θ(τ) for a substitution θ whose domain is included in ᾱ. This definition of ML instantiation implies some useful properties, which we expect to hold in MLF too.

In Section 2.1, we establish a few properties based on the observation of the skeletons. In ML, a type σ and its instances have comparable structures, that is, comparable skeletons. More precisely, the skeleton of the instance θ(τ) corresponds to the skeleton of σ where quantified variables ᾱ are substituted by θ. Hence, the skeleton of θ(τ) is the skeleton of σ, except on occurrences corresponding to quantified variables. In MLF, we define a partial order ⩽_{/} on occurrences (or, equivalently, on skeletons) that captures the idea that only quantified variables can be instantiated. This result is stated as Property 2.1.3.ii, which concerns the instance relation. Conversely, the abstraction relation is, intuitively, a reversible relation. Hence, we expect it to keep skeletons unchanged; this is stated by Property 2.1.3.i. Another property of the ML instance relation concerns free variables: if α is free in σ, then α is free in all instances of σ (and more precisely, α appears at least at the same occurrences). Such a result also holds in MLF, as stated by Lemma 2.1.4, which can be first read by taking Q_{1} = ∅. A straightforward result in ML states that monotypes have no instances (except themselves). This is also true in MLF, up to equivalence, as stated by Lemma 2.1.6.

In some implementations of ML, such as OCaml, some type variables become aliases during unification. For example, the unification of α → α and β → β might create an alias from α to β, which we write (α = β) (\underline{1}). Then each time a type variable is encountered, the implementation calls a function repr which finds its representative. To pursue the example, the representative of α is β and the representative of β is β.

Such a mechanism plays quite an important role in the efficiency of unification in ML. However, it is seldom formalized. In MLF, the alias from α to β appears directly in the prefix, in the form (1). In Section 2.2, we define the representative of a variable, according to a given prefix, and establish a few properties. The representative of α in Q is written Q[α], and the bound of the representative (which, intuitively, is the bound meant for α), is written Q(α).

Section 2.3 provides different ways to transform derivations of equivalence, abstraction, or instance judgments, the goal being to force some invariants. A first set of straightforward restrictions defines restricted derivations; another independent restriction, which concerns only the context rule R-Context-R, defines thrifty derivations. Property 2.3.3 shows that derivations that are restricted and thrifty are as expressive as normal derivations. Such restrictions are useful to discard pathological cases, which would shamelessly obfuscate some proofs.

In Section 2.4 we study contexts, which represent types with a hole [ ]. We use them in Section 2.5 to define a set of rules that replaces context rules by explicit contexts. More precisely, context rules such as R-Context-R, R-Context-Flexible or R-Context-Rigid are removed, and all other rules mention explicitly a context C. As expected, these new relations are as expressive as the original relations. Another independent set of rules is introduced, that defines the relations ⊏ −ᾱ and ⊑ᾱ. These relations are similar to ⊏ − and ⊑, but seriously restrict rules A-Hyp and I-Hyp. In order to preserve the expressiveness, we introduce new rules, namely A-Up’, A-Alias’, I-Up’, and I-Alias’. The derivations with ⊏ −ᾱ and ⊑ᾱ make the transformations on binders more explicit than with ⊏ − and ⊑. More precisely, whereas the latter only consider unification of binders (rules A-Hyp and I-Hyp), the former distinguish local unification of binders (rules A-Alias’ and I-Alias’), extrusion of binders (rules A-Up’ and I-Up’), and unification of binders with the prefix (rules A-Hyp’ and I-Hyp’).

In Section 2.6, we define atomic relations. Atomic relations can decompose an abstraction derivation or an instance derivation into a sequence of atomic and effective transformations. We use atomic decomposition to show some confluence results; indeed, once a derivation is decomposed into a sequence of transformations, confluence can be proved by considering all possible pairs of transformations.

The main result of Section 2.7 is Property 2.7.7.i, which shows that the equivalence relation is the symmetric kernel of the instance relation. This result is proved by associating a three-variable polynomial to each type, and by showing that the instance relation strictly decreases the polynomials if and only if it is irreversible (that is, when it is not an equivalence). Polynomials are also used to show that the relation ⊏ − considered as an order on types (under a given prefix) is well-founded. Such a result is used in the following section to show confluence between ⊏ − and ⊑. Indeed, the main result of Section 2.8 is the Diamond Lemma (Lemma 2.8.4), which states the confluence of ⊏ − and ⊑ under an unconstrained prefix.

2.1 Projections and instantiation

Skeletons, projections and occurrences were defined formally in section 1.3. We have seen that a skeleton is a tree composed of type variables, type constructors g^{n} (such as the arrow →), and ⊥. Intuitively, only the leaves labeled with ⊥ can be instantiated. This is captured by the following definition, which introduces the notation ⩽_{/}. Then, we immediately show that this relation is actually a partial order on skeletons.

Definition 2.1.1 We define a relation on skeletons, written ⩽_{/}, as follows: t_{1} ⩽_{/} t_{2} holds if and only if dom(t_{1}) ⊆ dom(t_{2}) and for all u ∈ dom(t_{1}), we have t_{1}/u ≠ t_{2}/u implies t_{1}/u = ⊥.

The definition immediately applies to projections since they are isomorphic to skeletons (see Section 1.3.2). By extension, we write σ_{1} ⩽_{/} σ_{2} to mean σ_{1}/ ⩽_{/} σ_{2}/.

Properties 2.1.2 i) The relation ⩽_{/} is a partial order. ii) If t_{1} ⩽_{/} t_{2} holds, then for any substitution θ, we have θ(t_{1}) ⩽_{/} θ(t_{2}). iii) If t_{1} ⩽_{/} t_{2} holds, then for any skeleton t, we have t[t_{1}/α] ⩽_{/} t[t_{2}/α].

These properties are direct consequences of Definition 2.1.1. See details in the Appendix (page 233).

As a consequence of Property 2.1.2.i, if we have σ_{1} ⩽_{/} σ_{2} and σ_{2} ⩽_{/} σ_{1}, then σ_{1}/ = σ_{2}/ (that is, proj(σ_{1}) = proj(σ_{2})). However, this does not imply σ_{1} = σ_{2} in general, as shown by example 1.3.1. Actually, it does not imply σ_{1} ≡ σ_{2} either, since types contain more information than skeletons.

Projections, instantiation and free variables

Projections are stable under abstraction, but not (in general) under instantiation. This is stated more precisely by the following lemma:

Properties 2.1.3 i) If (Q) σ_{1} ⊏ − σ_{2}, then (∀ (Q) σ_{1})/ = (∀ (Q) σ_{2})/. ii) If (Q) σ_{1} ⊑ σ_{2}, then ∀ (Q) σ_{1} ⩽_{/} ∀ (Q) σ_{2}.

\underline{Proof}: \underline{Property i} : It is shown by induction on the derivation of (Q) σ_{1} ⊏ − σ_{2}.

∘ Case A-Equiv: By Property 1.5.4.i (page 50).

∘ Case R-Trans: By induction hypothesis.

66  Properties of relations under prefixes

∘ Case A-Hyp: By hypothesis, we have (α=σ_{1}) ∈ Q and σ_{2} is α. We have ∀ (Q) σ_{2} = ∀ (Q) α ≡ ∀ (Q) σ_{1} by Eq-Var^{⋆}. Consequently, ∀ (Q) σ_{1} ≡ ∀ (Q) σ_{2} holds. We get the expected result by Property 1.5.4.i (page 50).

∘ Case R-Context-R: We have σ_{1} = ∀ (α ⋄ σ) σ′_{1} and σ_{2} = ∀ (α ⋄ σ) σ′_{2}. Besides, the premise is (Q, α ⋄ σ) σ′_{1} ⊏ − σ′_{2}. Hence, by induction hypothesis, we have (∀ (Q, α ⋄ σ) σ′_{1})/ = (∀ (Q, α ⋄ σ) σ′_{2})/, which is the expected result.

∘ Case R-Context-Rigid: Like for the case R-Context-L in the proof of Property 1.5.4.i (page 50).

\underline{Property ii} : It is shown by induction on the derivation of (Q) σ_{1} ⊑ σ_{2}.

∘ Case I-Abstract: By Property i.

∘ Case R-Trans: By induction hypothesis and transitivity of ⩽_{/} (Property 2.1.2.i).

∘ Case I-Bot: We have σ = ⊥, thus (∀ (Q) σ_{1})/ = ⊥/. We get the expected result by observing that ⊥ ⩽_{/} (∀ (Q) σ_{2}) always holds.

∘ Case R-Context-Flexible: We have σ_{1} = ∀ (α ≥ σ′_{1}) σ (\underline{1}) and σ_{2} = ∀ (α ≥ σ′_{2}) σ (\underline{2}). The premise is (Q) σ′_{1} ⊑ σ′_{2}. By induction hypothesis, we know that (∀ (Q) σ′_{1})/ ⩽ (∀ (Q) σ′_{2})/, that is Θ_{Q}(proj(σ′_{1}))/ ⩽ Θ_{Q}(proj(σ′_{2}))/ (\underline{3}) by Property 1.3.3.i (page 40). We have

(∀ (Q) σ_{1})/ = (∀ (Q) ∀ (α ≥ σ′_{1}) σ)/  from (1)
= Θ_{Q}(proj(σ)[  proj(σ′_{1})/α])/ by Property 1.3.3.i (page 40)

and Definition 1.3.2

= Θ_{Q}(proj(σ))[Θ_{Q}(proj(σ′_{1}))/α]/
⩽_{/} Θ_{Q}(proj(σ))[Θ_{Q}(proj(σ′_{2}))/α]/ by Property 2.1.2.iii and (3).
= Θ_{Q}(proj(σ)[  proj(σ′_{2})/α])/
= (∀ (Q) ∀ (α ≥ σ′_{2}) σ)/  by Property 1.3.3.i (page 40)

and Definition 1.3.2

= (∀ (Q) σ_{2})/  from (2)

Finally, we have shown ∀ (Q) σ_{1}/ ⩽_{/} ∀ (Q) σ_{2}/, which is the expected result.

∘ Case I-Hyp is similar to case A-Hyp above.

∘ Case I-Rigid: ∀ (α ≥ σ) σ′ and ∀ (α = σ) σ′ have the same projection.

Considering an instance (Q) σ_{1} ⊑ σ_{2}, we need to track occurrences of variables bound in Q but free in σ_{1}. The following lemma states that, in general, such variables also occur in σ_{2}, at the same occurrence. We require (α ⋄ σ) to be in the prefix, because the instance relation is only defined under a prefix that binds all free variables of the judgment. Additionally, we require σ not to be equivalent to a monotype, otherwise it could be equivalently substituted by Rule Eq-Mono, and the result would not hold. As a counterexample, take (Q, α = τ) α ⊑ τ (where α cannot be free in τ).

Lemma 2.1.4 Assume σ is not in T . If (Q, α ⋄ σ, Q_{1}) σ_{1} ♢ σ_{2} and (∀ (Q_{1}) σ_{1})/u = α hold, then (∀ (Q_{1}) σ_{2})/u = α. As a consequence, if α ∈ ftv(∀ (Q_{1}) σ_{1}), then α ∈ ftv(∀ (Q_{1}) σ_{2}).

The proof is by induction on the derivation. See the details in Appendix (page 234).

Monotypes

By Definition 1.5.7, a type σ is in T if its normal form has no quantifiers. Like in ML, this means that monotypes cannot be instantiated. Monotypes play an important role in MLF, since they can be inferred (like in ML), whereas polymorphic types can only be propagated. Throughout the proofs, we need to characterize monotypes, variables, or ⊥. Definition 1.5.7 uses normal forms. The following properties use projection.

Properties 2.1.5 i) σ ∈ T iff for all u ∈ dom(σ) we have σ/u ≠ ⊥. ii) We have σ/ϵ = α iff σ ≡ α. iii) We have σ/ϵ = ⊥ iff σ ≡ ⊥.

See proof in the Appendix (page 235).

The following lemma is essential: it shows that any instance of a monotype τ is only equivalent to τ, even under a prefix. In particular, assume σ is some polymorphic type scheme. If we have (α = σ) α ⊑ σ′, then σ′ must be α (when put in normal form). In other words, even if α is rigidly bound to a polytype σ in the prefix, there is no way to take an instance of it other than α itself. This is also why we say that the information (α = σ) is hidden in the prefix: we can propagate the variable α, bound to σ, but we cannot use its polymorphism. Decidability of type inference relies on this result.

Lemma 2.1.6 If σ_{1} ∈ T and (Q) σ_{1} ♢ σ_{2} hold, then we have (Q) σ_{1} ≡ σ_{2}.

\underline{Proof}: By induction on the derivation of (Q) σ_{1} ♢ σ_{2}.

∘ Case A-Equiv: By hypothesis, (Q) σ_{1} ≡ σ_{2} holds, which is the expected result.

∘ Case R-Trans By induction hypothesis, Property 1.5.11.x (page 54) and R-Trans.

∘ Case A-Hyp and I-Hyp: We have (Q) σ_{1} ⊑ α_{1} (that is, σ_{2} is α_{1}), and the premise is (α_{1} ⋄ σ_{1}) ∈ Q (\underline{1}). By hypothesis, σ_{1} ∈ T , thus σ_{1} ≡ τ (\underline{2}) for some monotype τ by Property 1.5.11.ii (page 54). By Property 1.5.3.v (page 49) and (2), we get (Q) σ_{1} ≡ τ (\underline{3}). By (2), Eq-Mono, and (1), we get (Q) τ ≡ α_{1} (\underline{4}). Hence, (Q) σ_{1} ≡ α_{1} holds by R-Trans, (3), and (4). This is the expected result.

∘ Case R-Context-R We have σ_{1} = ∀ (α ⋄ σ) σ′_{1} and σ_{2} = ∀ (α ⋄ σ) σ′_{2}. The premise is (Q, α ⋄ σ) σ′_{1} ♢ σ′_{2} (\underline{5}). By hypothesis we have ∀ (α ⋄ σ) σ′_{1} ∈ T . By Property 2.1.5.i, we must have σ′_{1} ∈ T . Hence (Q, α ⋄ σ) σ′_{1} ≡ σ′_{2} holds by induction hypothesis on (5). Consequently, (Q) ∀ (α ⋄ σ) σ′_{1} ≡ ∀ (α ⋄ σ) σ′_{2} holds by R-Context-R and this is the expected result.

∘ Case R-Context-Rigid and R-Context-Flexible: We have σ_{1} = ∀ (α ⋄ σ) σ_{0} and σ_{2} = ∀ (α ⋄ σ′) σ_{0}. The premise is (Q) σ ♢ σ′ (\underline{6}). If α ∉ ftv(σ_{0}), then σ_{1} ≡ σ_{2} by Eq-Free, which is the expected result. Otherwise, we necessarily have σ and σ_{0} in T by Property 2.1.5.i. Hence, (Q) σ ≡ σ′ holds by induction hypothesis on (6). Consequently, (Q) σ_{1} ≡ σ_{2} holds by R-Context-L.

∘ Case I-Bot implies σ_{1} = ⊥, which is a contradiction with the hypothesis σ_{1} ∈ T , by Property 2.1.5.i.

∘ Case I-Rigid: we have σ_{1} = ∀ (α ≥ σ) σ′ and σ_{2} = ∀ (α = σ) σ′. If α ∉ ftv(σ′), then σ_{1} ≡ σ_{2}. Otherwise, we necessarily have σ and σ′ in T by Property 2.1.5.i. Consequently, σ ≡ τ for some monotype τ. Hence σ_{1} ≡ σ′[τ/α] (\underline{7}) holds by Eq-Mono^{⋆} as well as σ′[τ/α] ≡ σ_{2} (\underline{8}). We get the expected result by R-Trans, (7), (8), and by Property 1.5.3.v (page 49).

Cycles

Types in MLF are not recursive, thus a type cannot be strictly included in itself. As a consequence, an instance of a given polytype cannot be a strict subterm.

Properties 2.1.7 i) If σ · ϵ/ ⩽_{/} σ · u/, then u is ϵ. ii) If we have either (Q) σ ⊑ α or (Q) α ⊑ σ and if α ∈ ftv(σ), then σ ≡ α.

\underline{Proof}: \underline{Property i}: We have σ · ϵ/ ⩽_{/} σ · u/. By definition, this implies σ/u ⩽_{/} σ/uu. Hence uu, that is u^{2}, is in dom(σ). By immediate induction, we show that u^{i} is in dom(σ) for all natural number i. By definition, dom(σ) is dom(proj(σ)), where proj(σ) is a skeleton (that is, a tree). By construction, dom(proj(σ)) is a finite set of occurrences. Hence, we necessarily have u = ϵ.

\underline{Property ii}: By hypothesis, we have (Q) σ ⊑ α (\underline{1}), or (Q) α ⊑ σ (\underline{2}), and α ∈ ftv(σ), that is, there exists u such that σ/u = α. If u is ϵ, then we get the expected result by Property 2.1.5.ii. Otherwise, we have u ≠ ϵ (\underline{3}) and (∀ (Q) σ) · u/ = (∀ (Q) α) · ϵ/ (\underline{4}) by definition of occurrences. If (1) holds, we get ∀ (Q) σ/ ⩽_{/} ∀ (Q) α/ by Property 2.1.3.ii. Hence, we get (∀ (Q) σ) · ϵ/ ⩽_{/} (∀ (Q) σ) · u/ by (4), and we conclude by Property i that u is ϵ. Otherwise, (2) holds, and we get (Q) α ≡ σ by Lemma 2.1.6. Hence, ∀ (Q) α/ = ∀ (Q) σ/ (\underline{5}) holds by Property 1.5.4.i (page 50). By (5) and (4), we get (∀ (Q) σ) · u/ = (∀ (Q) σ) · ϵ/. This leads to u = ϵ by Property i. In both cases, we have u = ϵ, which is a contradiction with (3).

2.2 Canonical representatives and bounds in a prefix

In the prefix (α ≥ ⊥, β = α), we can see β as an alias for α. The following definition captures the intuition that α and β have the same representative:

Definition 2.2.1 Given a prefix Q and a type variable α in dom(Q), we define the representative of α in Q, which we write Q[α], by the following induction:

(Q, α ⋄ σ, Q′)[α] =^{△} \begin{cases}Q[β] & if nf(σ) = β \\ α & otherwise \end{cases}

The bound of Q[α] in Q is written Q(α). Note that if Q(α) is defined, it is not in V.

Intuitively, Q(α) is the “real” bound of α in Q, and Q[α] is a type variable equivalent to α under Q whose bound is the “real” bound of α. As an example, taking Q =^{△} (α ≥ ⊥, β = α), we have Q[α] = α, Q[β] = α, Q(α) = Q(β) = ⊥.

Properties 2.2.2 We have the following properties for any closed well-formed prefix Q, and α, β in dom(Q):

i) (Q) α ≡ Q[α]. ii) If Q̂(α) = β, then we have Q[α] = β and Q(α) = Q(β) follows. iii) If Q̂(α) ∉ V, then (Q) α ≡ Q(α) holds. iv) We have Q(α) ∉ T iff Q̂(α) ∈ ϑ

v) If (Q) α ≡ β, then (Q) Q(α) ≡ Q(β). vi) If (Q) α ♢ σ and Q(α) ∉ T hold, then nf(σ) ∈ ϑ and Q(nf(σ)) ∉ T .

See proof in the Appendix (page 235).

2.3 Restricted and thrifty derivations

We wish to put equivalence, abstraction, and instance derivations in canonical forms. In this section, we introduce some syntactic restrictions on the derivations. We prove that these restrictions do not actually reduce the expressiveness of relations.

Restricted derivations Some rules can be restricted by adding some side-conditions that do not reduce the set of derivable judgments. Reasoning on restricted derivations often simplifies proofs.

Lemma 2.3.1 Given a derivation of (Q) σ ♢ σ′, there exists a derivation of the same judgment such that the following hold:

• In Rule I-Bot, nf(σ) is not ⊥ and σ ∉ V.

• In Rules R-Context-L, R-Context-Rigid, R-Context-Flexible, α is in ftv(σ) and nf(σ) is not α.

• In Rule I-Rigid, α ∈ ftv(σ), σ_{1} is not in T , and nf(σ) is not α.

• In rules I-Hyp and A-Hyp, σ_{1} is not in T .

A derivation which follows those restrictions is called a restricted derivation.

The proof is by induction on the initial derivation. It should be simply remarked that whenever a rule is not restricted, as described above, it can be freely replaced by an equivalence. See proof in the Appendix (page 236).

Thrifty derivations Consider the following occurrence of the right-context rule. The symbol ♢ stands for either ≡, ⊏ −, or ⊑:

R-Context-R

\frac{(Q, α ⋄ σ) σ_{1} ♢ σ_{2}}{(Q) ∀ (α ⋄ σ) σ_{1} ♢ ∀ (α ⋄ σ) σ_{2}}

This occurrence is said to be squandering when either nf(σ_{1}) or nf(σ_{2}) is α, but not both simultaneously. We will show in Lemma 2.3.3 that squandering occurrences of R-Context-R can always be removed.

Definition 2.3.2 (Thrifty Derivations) A derivation with no squandering rules is a thrifty derivation.

This means that, in a thrifty derivation each occurrence of Rule R-Context-R (such as the one given above) nf(σ_{1}) is α if and only if nf(σ_{2}) is α.

Lemma 2.3.3 Any derivation can be rewritten into a thrifty restricted derivation.

The proof proceeds by rewriting derivations into thrifty derivations, and then by observing that restricted derivations are kept restricted. See the details of the proof in the Appendix (page 238).

The following corollary characterizes abstraction. It states that if a type σ_{1} that is not a variable can be instantiated to a variable α, then it means that σ_{1} has been abstracted by α. This must be done in two steps: first, σ_{1} is instantiated to the bound of α, then it is abstracted by A-Hyp or I-Hyp. As a consequence, we know that the bound of α is an instance of σ_{1}.

Corollary 2.3.4 Assume (α ⋄ σ) ∈ Q and σ_{1} ∉ V. If (Q) σ_{1} ♢ α holds, then so does (Q) σ_{1} ♢ σ. Besides, if ♢ is ⊏ −, then ⋄ is rigid.

See proof in the Appendix (page 242).

2.4 Contexts

An occurrence points to a location in the skeleton of a type: the projection function cannot provide more information than skeletons do. However MLF types are richer than skeletons, thus occurrences are not accurate enough. In order to point to a location in a type more accurately, we define contexts, which have the same structure as types.

We first define generic contexts, which are the most general form of contexts with a single hole. We also define special forms of generic contexts that are narrow contexts, flexible contexts and rigid contexts. Finally, we define contexts with multiple holes.

Generic contexts Generic one-hole contexts are defined by the following grammar:

C ::= [ ] | ∀ (α ⋄ σ) C | ∀ (α ⋄ C) σ

A well-formed context does not bind the same variable twice. The prefix of a wellformed context C, written \overline{C}, is defined recursively by

\overline{[ ]} =^{△} ∅  \overline{∀ (α ⋄ σ) C} =^{△} (α ⋄ σ)\overline{C}  \overline{∀ (α ⋄ C) σ} =^{△} \overline{C}

We write dom(C) for dom(\overline{C}), and Ĉ for ˆ \overline{C}. If C is well-formed, then \overline{C} is well-formed. For example, let C be the context

∀ (α ≥ ⊥, β = ∀ (γ = α → α) ∀ (δ ≥ [ ]) γ → δ) β → β

Then \overline{C} is (α ≥ ⊥, γ = α → α), and Ĉ is [α → α/γ]. We can informally represent this context by the graph below. The node labelled ⊥ corresponds to α, the node labelled [ ] corresponds to δ. The former is flexible and bound at top-level; and the latter is flexible and bound at β. The middle node labelled → represents β; it is rigid and bound at top-level. The bottom node labelled → represents γ. It is a monotype, thus it is not bound.

→ → →  [ ] ⊥

The next definition introduces the notion of a useful context and of equivalence between contexts.

Definition 2.4.1

• A context C is said useless if, for all σ_{1} and σ_{2}, C(σ_{1}) ≡ C(σ_{2}) holds. Otherwise, it is said useful.

• Two contexts C_{1} and C_{2} are said ᾱ-equivalent if and only if C_{1}(σ) ≡ C_{2}(σ) holds for any σ such that ftv(σ) ∩ (dom(C_{1}) ∪ dom(C_{2})) ⊆ ᾱ.

• Two contexts C_{1} and C_{2} are said equivalent if and only if C_{1}(σ) ≡ C_{2}(σ) holds for any σ.

For example, ∀ (α=[ ]) β → β is useless, whereas ∀ (α=[ ]) α → β is useful. Additionally, the contexts ∀ (α ≥ ⊥, β ≥ ⊥) [ ] and ∀ (α ≥ ⊥, γ ≥ ⊥) [ ] are α-equivalent, but are not β- or γ-equivalent. Note that C_{1} equivalent to C_{2} means that C_{1} is ϑ-equivalent to C_{2}.

We define next the level of a context C. It is intuitively the depth of the hole in C. More precisely, it will be shown that a useless context has level 0 (and conversely), and a context of the form ∀ (Q) [ ] has level 1 (and conversely). For example, a context such as ∀ (α ≥ [ ]) α → α has level 2, and a context such as ∀ (α ≥ ∀ (β ≥ [ ]) β → β) α → α has level 3.

Then we define the level-1 domain of a context C. It corresponds intuitively to the type variables bound directly in front of the hole. For example, the level-1 domain of ∀ (α ≥ ⊥, β ≥ ∀ (γ = α → α, δ ≥ ⊥) [ ]) α → β is the set {γ, δ}. Indeed, the bindings (γ = α → α, δ ≥ ⊥) are in front of the hole [ ]. They are, intuitively, at the same level as the hole. Other bindings, such as (α ≥ ⊥) are not at the same level, thus α do not appear in the level-1 domain.

Definition 2.4.2

• The level of a context C, written level(C), is defined inductively as follows:

level([ ]) =^{△} 1 level(∀ (α ⋄ C) σ) =^{△} \begin{cases}level(C) & if σ ≡ α \\ 0 & if α ∉ ftv(σ) \\ 0 & if level(C) = 0 \\ level(C) + 1 & otherwise \end{cases}

level(∀ (α ⋄ σ) C) =^{△} level(C)

• The level-1 domain of a context C, written dom_{1}(C), is defined inductively as follows:

dom_{1}(C) =^{△} ∅ if level(C) = 0 dom_{1}(C) =^{△} dom(C) if level(C) = 1

dom_{1}(C) =^{△} dom_{1}(C′) if level(C) > 1 and \begin{cases}C = ∀ (α ⋄ σ) C′ \\ or \\ C = ∀ (α ⋄ C′) σ \end{cases}

Properties 2.4.3

i) If C is a useful context, then there exists u such that for any σ and u′ in dom(σ), we have C(σ)/uu′ = σ/u′.

ii) If C is a useful context, and σ ∉ T , then C(σ) ∉ T . iii) A context C is useful iff level(C) > 0.

See proof in the Appendix (page 242).

We introduce three restrictions of generic contexts, namely narrow, flexible, and rigid contexts. Narrow contexts are intuitively contexts of the form ∀ (Q) [ ]. However, thanks to rule Eq-Var, a context C_{n} such as ∀ (α ≥ ⊥, β ≥ ∀ (Q′) [ ]) β is equivalent to ∀ (α ≥ ⊥, Q′) [ ]. Hence, a context such as C_{n} is also considered narrow. This is captured by the following definition.

Narrow contexts Narrow contexts are a restriction of generic contexts defined by the following grammar:

C_{n} ::= [ ] | ∀ (α ⋄ σ) C_{n} | ∀ (α ⋄ C_{n}) σ where nf(σ) = α

The following properties explain what a narrow context is.

Properties 2.4.4 i) A prefix C is narrow iff level(C) = 1. ii) If level(C) = 1, then C is equivalent to ∀ (\overline{C}) [ ]. iii) If level(C) > 1, then there exists C′ such that C is equivalent to C′(∀ (α ⋄ ∀ (Q_{1})

[ ]) σ) and level(C′) = level(C) − 1. iv) If level(C) ⩾ 1, then there exists C′ and C_{n} such that C is equivalent to C′(C_{n}),

and level(C_{n}) = 1, dom_{1}(C′) = ∅, and dom_{1}(C) = dom(C_{n}).

v) If C(σ) ∈ V, then level(C) ⩽ 1.

These properties are shown by structural induction on the context C. See details in Appendix (page 243).

Intuitively, instantiation occurs only at flexible occurrences, that is, only in flexible bounds. It can also occur in the bound of α in ∀ (α = σ) α, because it is equivalent to σ by Eq-Var. Flexible contexts, defined next, are contexts suitable for instantiation.

Flexible contexts Flexible contexts are a restriction of generic contexts defined by the following grammar:

C_{f} ::= [ ] | ∀ (α ⋄ σ) C_{f} | ∀ (α ≥ C_{f}) σ | ∀ (α = C_{f}) σ where nf(σ) = α

Similarly, abstraction occurs only at rigid occurrences, that is, only in rigid bounds. Rigid contexts are contexts suitable for abstraction.

Rigid contexts Rigid contexts are a restriction of generic contexts defined by the following grammar:

C_{r} ::= [ ] | ∀ (α ⋄ σ) C_{r} | ∀ (α = C_{r}) σ | ∀ (α ≥ C_{r}) σ where nf(σ) = α

The following lemma shows that the normal form of a type C(σ_{1}) is of the form C′(nf(Ĉ(σ_{1}))) for some context C′. Intuitively, C′ is some sort of normal form of C, which is partially captured by the statement that C′ is ᾱ-equivalent to C (where the interface ᾱ is the set of free variables of Ĉ(σ_{1})). For instance, take the following:

{C =^{△} ∀ (α ≥ ⊥, β = α → α, γ ≥ [ ]) β → γ σ_{1} =^{△} ∀ (δ ≥ ⊥) δ → β \atop σ =^{△} C(σ_{1}) = ∀ (α ≥ ⊥, β = α → α, γ ≥ ∀ (δ ≥ ⊥) δ → β) β → γ}

We have Ĉ = [α → α/β]. Then the normal form of σ is ∀ (α ≥ ⊥, γ ≥ ∀ (δ ≥ ⊥) δ → (α → α)) (α → α) → γ. Taking C′ = ∀ (α ≥ ⊥, γ ≥ [ ]) (α → α) → γ, we have nf(σ) = C′(∀ (δ ≥ ⊥) δ → (α → α)), that is, nf(σ) = C′(Ĉ(σ_{1})). Additionally, C′ and C are α-equivalent.

2.4 Contexts  75

Lemma 2.4.5 If C is a useful well-formed context, σ = C(σ_{1}) and σ_{1} ∉ T , then there exists C′ such that

• C′ is ftv(Ĉ(σ_{1}))-equivalent to C

• dom(C′) ⊆ dom(C)

• nf(σ) = C′(nf(Ĉ(σ_{1})))

\underline{Proof}: This is proved by induction on the number of quantifiers of the context C. By hypothesis, σ_{1} ∉ T (\underline{1}). Let ᾱ be ftv(Ĉ(σ_{1})) (\underline{2}). We proceed by case analysis on the structure of C.

∘ Case C is [ ]: Then σ is σ_{1} and taking C′ = [ ] is appropriate.

∘ Case C is ∀ (α_{0} ⋄ σ_{0}) C_{0} (\underline{3}): Then σ is ∀ (α_{0} ⋄ σ_{0}) C_{0}(σ_{1}) (\underline{4}). Necessarily, C_{0} is useful. By well-formedness of C, we must have α_{0} ∉ dom(C_{0}) (\underline{5}). We have α_{0} ∉ ᾱ by (2) and well-formedness of (3).

Subcase C_{0}(σ_{1}) ≡ α_{0}: By Property 1.5.11.ii (page 54), we have C_{0}(σ_{1}) ∈ T . By Property 2.4.3.ii and (1), we have C_{0}(σ_{1}) ∉ T . This is a contradiction, which means that this subcase cannot occur.

Subcase σ_{0} ∈ T : By Property 1.5.11.ii (page 54), we have σ_{0} ≡ τ_{0} for some monotype τ_{0}. Let θ be [τ_{0}/α_{0}]. The normal form of σ is by definition θ(nf(C_{0}(σ_{1}))), from (4). By Property 1.5.6.iii (page 51), we get nf(σ) = nf(θ(C_{0}(σ_{1}))), that is, nf(σ) = nf(θ(C_{0})(θ(σ_{1}))) (\underline{6}) thanks to (5). Observing that the substitution Ĉ is θ ∘ Ĉ_{0} (\underline{7}), we get ftv({ \atop θ(C_{0})}(θ(σ_{1}))) = ftv(Ĉ(σ_{1})) = ᾱ. By induction hypothesis on θ(C_{0}), there exists a context C_{1} that is ᾱ-equivalent to θ(C_{0}) (\underline{8}) and such that nf(θ(C_{0})(θ(σ_{1}))) = C_{1}(nf({ \atop θ(C_{0})}(θ(σ_{1})))) (\underline{9}) and dom(C_{1}) ⊆ dom(θ(C_{0})), that is, dom(C_{1}) ⊆ dom(C_{0}) (\underline{10}). By (9), (6), and (7), nf(σ) is C_{1}(nf(Ĉ(σ_{1}))). Hence, θ(C_{0}) is ᾱ-equivalent to ∀ (α_{0}⋄σ_{0}) C_{0}, that is, to C (\underline{11}). By (8) and (11), C_{1} is ᾱ-equivalent to C. Finally, dom(C_{1}) ⊆ dom(C) by (10) and (3). This is the expected result.

Subcase α_{0} ∉ ftv(C_{0}(σ_{1})) (\underline{12}): Then nf(σ) is nf(C_{0}(σ_{1})), thus we conclude directly by induction hypothesis. Indeed, C is ∀ (α_{0} ⋄ σ_{0}) C_{0} and is ᾱ-equivalent to C_{0} by (12). Besides, dom(C_{0}) ⊆ dom(C), and Ĉ_{0} = Ĉ.

Otherwise nf(σ) is ∀ (α_{0} ⋄ nf(σ_{0})) nf(C_{0}(σ_{1})), and Ĉ = Ĉ_{0} (\underline{13}). By induction hypothesis, there exists C_{1}, ᾱ-equivalent to C_{0}, such that nf(C_{0}(σ_{1})) = C_{1}(nf(Ĉ_{0}(σ_{1}))). By (13), we get nf(C_{0}(σ_{1})) = C_{1}(nf(Ĉ(σ_{1}))). We get the expected result by taking C′ = ∀ (α_{0} ⋄ nf(σ_{0})) C_{1}. Besides, C′ is equivalent to ∀ (α_{0} ⋄ σ_{0}) C_{1}, which is ᾱ-equivalent to ∀ (α_{0} ⋄σ_{0}) C_{0}, that is C. Finally, dom(C′) = {α_{0}}∪dom(C_{1}) and dom(C_{1}) ⊆ dom(C_{0}) by induction hypothesis, thus dom(C′) ⊆ {α_{0}} ∪ dom(C_{0}) = dom(C).

∘ Case C is ∀ (α_{0} ⋄ C_{0}) σ_{0}: then, σ is ∀ (α_{0} = C_{0}(σ_{1})) σ_{0}. We must have α_{0} ∈ ftv(σ_{0}) and C_{0} is useful (otherwise C would be useless). Moreover, Ĉ = Ĉ_{0} (\underline{14}) by definition.

Subcase nf(σ_{0}) is α_{0}: then, nf(σ) is nf(C_{0}(σ_{1})) and we conclude directly by induction hypothesis. Indeed, C is equivalent to C_{0}, dom(C_{0}) = dom(C), and Ĉ = Ĉ_{0} from (14).

Subcase C_{0}(σ_{1}) ∈ T is not possible by Property 2.4.3.ii.

Otherwise nf(σ) is ∀ (α_{0} ⋄nf(C_{0}(σ_{1}))) nf(σ_{0}). By induction hypothesis, there exists C_{1}, ᾱ-equivalent to C_{0} such that nf(C_{0}(σ_{1})) = C_{1}(nf(Ĉ_{0}(σ_{1}))) (\underline{15}) and dom(C_{1}) ⊆ dom(C_{0}) (\underline{16}). Hence, by (15) and (14), we have nf(C_{0}(σ_{1})) = C_{1}(nf(Ĉ(σ_{1}))). We get the expected result by taking C′ = ∀ (α_{0} ⋄ C_{1}) nf(σ_{0}). Besides, C′ is equivalent to ∀ (α_{0} ⋄ C_{1}) σ_{0}, which is ᾱ-equivalent to ∀ (α_{0} ⋄ C_{0}) σ_{0}, that is, C. From (16), we get dom(C_{1}) ⊆ dom(C). Finally, dom(C′) = dom(C_{1}) ⊆ dom(C) holds. This is the expected result.

Contexts with multiple holes Generic contexts with n holes C^{n} are defined by the following grammar:

C^{0} ::= σ  no hole
C^{1} ::= C
C^{m+p} ::= ∀ (α ⋄ C^{m}) C^{p}  for m + p > 1.

The notation C^{2}(σ_{1}, σ_{2}) means that the first hole is filled with σ_{1} and the second hole filled with σ_{2}.^{1} Note that the notion of useful context is more delicate: the “usefulness” of the first hole might depend on what is put in the second hole. For instance, take ∀ (α = [ ]) [ ].

Matching contexts We say that two generic contexts C_{1} and C_{2} match on σ if there exist σ_{1} and σ_{2} such that σ = C_{1}(σ_{1}) = C_{2}(σ_{2}). Two matching contexts C_{1} and C_{2} are nested when there exists C_{3} such that C_{1} = C_{2}(C_{3}) or C_{2} = C_{1}(C_{3}). Otherwise, they are said disjoint.

Lemma 2.4.6 Assume σ is in normal form. If C_{1} and C_{2} are disjoint and match on σ, then there exist a two-hole context C^{2} such that C_{1} = C^{2}([ ], σ_{2}) and C_{2} = C^{2}(σ_{1}, [ ]). Besides, if C_{1} is flexible (resp. rigid), then C^{2}([ ], σ′_{2}) is flexible (resp. rigid), for any σ′_{2}. A similar result holds for C_{2}.

\underline{Proof}: By induction on the structures of C_{1} and C_{2}. By hypothesis, we have σ = C_{1}(σ_{1}) = C_{2}(σ_{2}) (\underline{1}), and C_{1} and C_{2} are not nested.

1We should explain formally how to assign a number to each hole. However, this would only obfuscate the notations. Hence, we leave some harmless “artistic blur”, and assume that we have a way to assign a different number to each hole in a context.

2.5 Local abstraction and instance rules  77

∘ Case C_{1} = [ ] is not possible, since otherwise C_{1} and C_{2} are nested.

∘ Case C_{2} = [ ] is not possible either.

∘ Case C_{1} = ∀ (α⋄σ) C′_{1}, C_{2} = ∀ (α′ ⋄′ σ′) C′_{2}: Then (1) implies (α⋄σ) = (α′ ⋄′ σ′) and C′_{1}(σ_{1}) = C′_{2}(σ_{2}). By induction hypothesis, there exists C_{a}^{2} such that C′_{1} = C_{a}^{2}([ ], σ_{2}) and C′_{2} = C_{a}^{2}(σ_{1}, [ ]). Hence taking C_{2} = ∀ (α ⋄ σ) C_{a}^{2}([ ], [ ]) gives the expected result. Besides, if C_{1} is flexible (resp. rigid), then C′_{1} is flexible (resp. rigid). By induction hypothesis, C_{a}^{2}([ ], σ′_{2}) is flexible (resp. rigid) for any σ′_{2}. Hence, C_{2}([ ], σ′_{2}) is flexible (resp. rigid). Similarly for C_{2}(σ′_{1}, [ ]).

∘ Case C_{1} = ∀ (α⋄σ) C′_{1}, C_{2} = ∀ (α′ ⋄′ C′_{2}) σ′: Then (1) implies (α⋄σ) = (α′ ⋄′ C′_{2}(σ_{2})) and σ′ = C′_{1}(σ_{1}). Let C^{2} be ∀ (α ⋄ C′_{2}) C′_{1}, where the first hole is in C′_{1}, the second hole in C′_{2}. We have C_{1} = C^{2}([ ], σ_{2}) and C_{2} = C^{2}(σ_{1}, [ ]), which is the expected result. Besides, if C_{1} is flexible (resp. rigid), then C′_{1} is flexible (resp. rigid). Hence, C_{2}([ ], σ′_{2}) is flexible (resp. rigid). If C_{2} is flexible (resp. rigid), then C′_{2} is flexible (resp. rigid) and ⋄′ is ≥ (resp =). The case where nf(σ′) is α′ and ⋄′ is = (resp ≥) is not possible here, because σ is in normal form by hypothesis. Hence, C^{2}(σ′_{1}, [ ]) is flexible (resp. rigid).

∘ Case C_{1} = ∀ (α ⋄ C′_{1}) σ, C_{2} = ∀ (α′ ⋄′ σ′) C′_{2} is similar.

∘ Case C_{1} = ∀ (α ⋄ C′_{1}) σ, C_{2} = ∀ (α′ ⋄′ C′_{2}) σ′: Then (1) implies α = α′, ⋄ = ⋄′, σ = σ′, and C′_{1}(σ_{1}) = C′_{2}(σ_{2}). Thus, by induction hypothesis there exists C_{a}^{2} such that C′_{1} = C_{a}^{2}([ ], σ_{2}) and C′_{2} = C_{a}^{2}(σ_{1}, [ ]). Hence, taking C_{2} = ∀ (α⋄C_{a}^{2}) σ gives the expected result. Besides, if C_{1} is flexible (resp. rigid), then ⋄ is ≥ (resp. =) and C′_{1} is flexible (resp. rigid). By induction hypothesis, C_{a}^{2}([ ], σ′_{2}) is flexible (resp. rigid), for any σ′_{2}. Hence, C_{2}([ ], σ′_{2}) is flexible (resp. rigid) for any σ′_{2}. Similarly for C_{2}(σ′_{1}, [ ]).

Derivable context rules The following rules are derivable by induction on the context. They can represent any sequence of context rules.

Eq-Context^{⋆}

\frac{(Q\overline{C}) σ_{1} ≡ σ_{2}}{(Q) C(σ_{1}) ≡ C(σ_{2})}

A-Context^{⋆}

\frac{(Q\overline{C_{r}}) σ_{1} ⊏ − σ_{2}}{(Q) C_{r}(σ_{1}) ⊏ − C_{r}(σ_{2})}

I-Context^{⋆}

\frac{(Q\overline{C_{f}}) σ_{1} ⊑ σ_{2}}{(Q) C_{f}(σ_{1}) ⊑ C_{f}(σ_{2})}

2.5 Local abstraction and instance rules

The rules defining abstraction and instance were given in Figure 1.2 and 1.3, in Sections 1.6 and 1.7. In order to show confluence results on abstraction and instantiation, we need to put derivations in canonical forms. This amounts to lifting transitivity to top-level, and to replacing some rules, such as A-Hyp by local rules. Besides, we wish to get rid of context rules such as R-Context-R and R-Context-Rigid by using contexts defined in the previous section.

We recall that R^{∗} is the transitive closure of R.

2.5.1 Context-based rules

The following lemma states that transitivity can always be lifted to top-level.

Lemma 2.5.1 If we have a derivation of (Q) σ ♢ σ′, then, there exists a tuple σ_{1} … σ_{n} such that σ_{1} = σ, σ_{n} = σ′ and for all i < n we have a derivation of (Q) σ_{i} ♢ σ_{i+1} which does not use Rule R-Trans.

\underline{Proof}: By induction on the derivation of (Q) σ ♢ σ′. All cases are easy.

Abstraction

We wish to define a relation that has the same expressiveness as ⊏ − and that uses contexts instead of context rules. We consider the relation ⊏ −_{C} defined by the single following rule:

Ac-Hyp ; \frac{(α = σ_{1}) ∈ Q\overline{C_{r}}}{(Q) C_{r}(σ_{1}) ⊏ −_{C} C_{r}(α)}

Intuitively, ⊏ −_{C} captures abstraction, but not equivalence. Hence, we define (≡|⊏ −_{C}) as (≡) ∪ (⊏ −_{C}), that is:

(Q) σ_{1} (≡|⊏ −_{C}) σ_{2} if and only if (Q) σ_{1} ≡ σ_{2} or (Q) σ_{1} ⊏ −_{C} σ_{2} holds.

As expected, the transitive closure of (≡|⊏ −_{C}) is equivalent to abstraction.

Lemma 2.5.2 The relations ⊏ − and (≡|⊏ −_{C})^{∗} are equal.

\underline{Proof}: We need to show that (≡|⊏ −_{C})^{∗} is included in ⊏ −, and conversely.

\underline{Directly:} Rule Ac-Hyp is derivable with A-Hyp and A-Context^{⋆}. Hence, ⊏ −_{C} is included in ⊏ −. Moreover, ≡ is included in ⊏ − and ⊏ − is transitive, thus (≡|⊏ −_{C})^{∗} is included in ⊏ −.

\underline{Conversely}, we show that ⊏ − is included in (≡|⊏ −_{C})^{∗}. Thanks to Lemma 2.5.1, it suffices to show that if we have a derivation of (Q) σ_{1} ⊏ − σ_{2} not using R-Trans, then (Q) σ_{1} ≡ σ_{2} or (Q) σ_{1} ⊏ −_{C} σ_{2} is derivable. We assume we have a derivation of (Q) σ_{1} ⊏ − σ_{2} that does not use R-Trans. All abstractions rules of this derivation have at most one premise. Namely, the rules with one premise are context rules R-Context-R and R-Context-Rigid. The topmost abstraction rule is either A-Equiv or A-Hyp. If it is A-Equiv,

2.5 Local abstraction and instance rules  79

then (Q) σ_{1} ≡ σ_{2} is derivable, and this case is solved. Otherwise, we have a derivation of the form

A-Hyp \frac{(α = σ_{0}) ∈ QQ′}{(QQ′) σ_{0} ⊏ − α}
⋮
(Q) σ_{1} ⊏ − σ_{2}

By structural induction on this derivation, we can show that there exists a rigid context C_{r} such that σ_{1} = C_{r}(σ_{0}), σ_{2} = C_{r}(α), and Q′ = \overline{C_{r}}. Hence, we have (α=σ_{0}) ∈ Q\overline{C_{r}} and the derivation ends with (Q) C_{r}(σ_{0}) ⊏ − C_{r}(α). Consequently, we have (Q) C_{r}(σ_{0}) ⊏ −_{C} C_{r}(α) by Rule Ac-Hyp, that is, (Q) σ_{1} ⊏ −_{C} σ_{2}. This is the expected result.

Instance

As we have done for ⊏ −_{c}, we define the relation ⊑_{C} in order to capture type instantiation through context-based rules.

Ic-Bot \overline{(Q) C_{f}(⊥) ⊑_{C} C_{f}(σ)} Ic-Hyp \frac{(α ≥ σ) ∈ Q\overline{C_{f}}}{(Q) C_{f}(σ) ⊑_{C} C_{f}(α)} Ic-Abstract

\frac{(Q\overline{C_{f}}) σ ⊏ −_{C} σ′}{(Q) C_{f}(σ) ⊑_{C} C_{f}(σ′)}

Ic-Rigid ; \overline{(Q) C_{f}(∀ (α ≥ σ) σ′ ⊑_{C} C_{f}(∀ (α = σ) σ′)}

The relation (≡|⊑_{C}) is defined as (≡) ∪ (⊑_{C}).

Lemma 2.5.3 The relations ⊑ and (≡|⊑_{C})^{∗} are equal.

\underline{Proof}: We need to show that (≡|⊑_{C})^{∗} is included in ⊑, and conversely.

\underline{Directly:} rules Ic-Bot, Ic-Hyp, Ic-Rigid, and Ic-Abstract are derivable with I-Context^{⋆} and I-Bot, I-Hyp, I-Rigid, and I-Abstract, respectively. Hence, ⊑_{C} is included in ⊑. Moreover, ≡ is included in ⊑ and ⊑ is transitive, thus (≡|⊑_{C})^{∗} is included in ⊑.

\underline{Conversely,} we show that ⊑ is included in (≡|⊑_{C})^{∗}. We assume that (Q) σ_{1} ⊑ σ_{2} (\underline{1}) holds. We have to show that (Q) σ_{1} (≡|⊑_{C})^{∗} σ_{2} is derivable. Like in the proof of Lemma 2.5.2, we assume that the derivation of (1) does not use transitivity (thanks to Lemma 2.5.1). Hence, the derivation of (1) is actually a sequence of context-rules starting with a one-premise rule I-X, which can be either I-Abstract, I-Hyp, I-Bot or I-Rigid. Hence, the derivation of (1) is of the form:

I-X \overline{(QQ′) σ′_{1} ⊑ σ′_{2}}
⋮
(Q) σ_{1} ⊑ σ_{2}

In the first case (I-Abstract), following the proof of Lemma 2.5.2, we have a sequence of context rules (namely R-Context-Rigid or R-Context-R) starting with A-Hyp or A-Equiv. If it starts with A-Equiv, then (Q) σ_{1} ≡ σ_{2} holds, and the result is shown. Otherwise, and for other choices of I-X also, there exists a flexible context C_{f} such that \overline{C_{f}} = Q′, σ_{1} = C_{f}(σ′_{1}) and σ_{2} = C_{f}(σ′_{2}). Then we get the expected result by using rules (respectively) Ic-Abstract, Ic-Hyp, Ic-Bot and Ic-Rigid, and using Lemma 2.5.2 for I-Abstract.

2.5.2 Alternative abstraction and alternative instance

Rules A-Hyp and Ac-Hyp are not local. Indeed, both rules replace a type σ by a variable α, provided the binding (α=σ) is in the prefix. For example, ∀ (α=σ) ∀ (β=σ) α → β ⊏ − ∀ (α = σ) ∀ (β = α) α → β is derivable, taking C_{r} = ∀ (α = σ) ∀ (β = [ ]) α → β in Ac-Hyp. In that case, the binding (α = σ) is next to the hole. However, the context C_{r} can be of any level, which means that the information (α = σ) is propagated from one subterm of the type to another arbitrarily distant subterm. We wish to force rigid contexts to be of level 1 or 2 only. This gives more granularity to derivations, and makes it possible to show some “local” invariants that would possibly be broken by non-local rules.

In order to help the understanding of the following, we introduce the informal notion of frozen binding: Given a derivation D ending with (Q) σ_{1} ♢ σ_{2}, we call Q the frozen prefix. Inside the derivation D we may find a sequent such as (QQ′) σ′_{1} ♢ σ′_{2}. Whereas the bindings of Q are frozen, the bindings of Q′, which were introduced by context rules, are not.

Pursuing the analysis, we see that Rule A-Hyp can be used with three different flavors:

1. Abstraction between types at the same level; e.g. the following is derivable (as seen above): (Q) ∀ (α = σ) ∀ (β = σ) α → β ⊏ − ∀ (α = σ) ∀ (β = α) α → β.

2. Extrusion of a quantifier, as in A-Up^{⋆}: (Q) ∀ (α = ∀ (β = σ) σ′) τ ⊏ − ∀ (β = σ) ∀ (α = σ′) τ, provided β ∉ ftv(τ).

3. Abstraction of a type found in the frozen prefix: (α = σ) ∀ (β = σ) β → β ⊏ − ∀ (β = α) β → β.

We have already illustrated the extrusion of a quantifier by graphs page 58. The abstraction between a type and the prefix can also be represented by the same graphs, considering the top-level node in the prefix. The abstraction between types at the same level can be captured by graphs as follows:

σ → σ  ⊑  \overrightarrow{σ}

The same flavors, illustrated by similar examples, exist for I-Hyp. We now define two relations ⊏ −ᾱ and ⊑ᾱ (frozen abstraction and frozen instance relations) that explicitly separate these different flavors. In order to keep track of frozen bindings, we annotate the relation with a set of variables ᾱ that corresponds to variables introduced in the prefix by context rules (that is, non-frozen variables). Hence, we consider the following rule, which is meant to replace R-Context-R:

R-Context-R’

\frac{(Q, α ⋄ σ) σ_{1} ♢^{ᾱ∪\{α\}} σ_{2}}{(Q) ∀ (α ⋄ σ) σ_{1} ♢ᾱ ∀ (α ⋄ σ) σ_{2}}

Definition 2.5.4 (Frozen abstraction and frozen instance) We define the relation ⊏ −ᾱ as the smallest transitive relation under prefix that satisfies the rules of figure 2.1 as well as rules R-Context-Rigid and R-Context-R’.

The relation ⊑ᾱ is the smallest transitive relation under prefix that satisfies the rules of figure 2.2 as well as rules R-Context-Flexible and R-Context-R’.

Note that ⊏ −ᾱ is almost a rigid-compliant relation; the only difference lies in Rule R-Context-R’, which is used instead of R-Context-R. Similarly, ⊑ᾱ is almost a flexible-compliant relation, the difference being in Rule R-Context-R’.

The rules for ⊏ −ᾱ and ⊑ᾱ are similar to the rules defining ⊏ − and ⊑, except A-Hyp’ and I-Hyp’, which require the binding read in the prefix not to be in ᾱ (that is, the binding must be frozen). In order to make local unification or extrusion of binders possible, rules A-Alias’ and A-Up’ are added to the definition of ⊏ −ᾱ, and rules I-Alias’ and I-Up’ are added to the definition of ⊑ᾱ. They are meant to be used instead of A-Hyp or I-Hyp, when the binding read in the prefix is in ᾱ (that is, not frozen). A judgment (Q) σ_{1} ♢ᾱ σ_{2} is well formed if and only if Q is well-formed, and σ_{1} and σ_{2} are closed under Q. All derivations are implicitly well-formed. We note that ⊏ −ᾱ is included in ⊏ −^{ᾱ∪β̄} for any sets of variables ᾱ and β̄. As expected, these new relations are equivalent to the original ones:

Figure 2.1: Frozen abstraction relation

A-Equiv’ ; \frac{(Q) σ_{1} ≡ σ_{2}}{(Q) σ_{1} ⊏ −ᾱ σ_{2}}  A-Hyp’ ; \frac{(α = σ) ∈ Q α ∉ ᾱ}{(Q) σ ⊏ −ᾱ α}

A-Up’ ; \frac{α_{1} ∉ ftv(σ′)}{(Q) ∀ (α = ∀ (α_{1} = σ_{1}) σ) σ′ ⊏ −ᾱ ∀ (α_{1} = σ_{1}) ∀ (α = σ) σ′}

A-Alias’ ; \overline{(Q) ∀ (α_{1} = σ_{1}) ∀ (α_{2} = σ_{1}) σ ⊏ −ᾱ ∀ (α_{1} = σ_{1}) ∀ (α_{2} = α_{1}) σ}

Lemma 2.5.5 The relations ⊏ − and ⊏ −^{∅} are equal. The relations ⊑ and ⊑^{∅} are equal.

See proof in the Appendix (page 244).

The following rule is derivable:

I-Equiv^{⋆}’ ; \frac{(Q) σ_{1} ≡ σ_{2}}{(Q) σ_{1} ⊑ᾱ σ_{2}}

Some proofs are made easier by considering restricted derivations for ⊏ −ᾱ and ⊑ᾱ. The following lemma introduces new restrictions for the new rules A-Up, A-Alias, …

Lemma 2.5.6 The restrictions stated in Lemma 2.3.1 are still applicable with ⊑ᾱ and ⊏ −ᾱ, together with a few more restrictions:

• In rules A-Hyp’ and I-Hyp’, σ is not in T .

• In rules A-Up’ and I-Up’, α ∈ ftv(σ′), nf(σ′) is not α, α_{1} ∈ ftv(σ), nf(σ) is not α_{1}, and σ_{1} is not in T

• In rules A-Alias’ and I-Alias’, σ_{1} is not in T , and α_{1} and α_{2} are in ftv(σ)

\underline{Proof}: Similar to the proof of Lemma 2.3.1, and we only need to consider the new rules A-Hyp’, I-Hyp’, A-Up’, I-Up’, A-Alias’, and I-Alias’. We assume given a judgment (Q) σ_{1} ♢ᾱ σ_{2} derived with such a rule. If the restrictions above do not hold, then it is

Figure 2.2: Frozen instance relation

I-Abstract’

\frac{(Q) σ_{1} ⊏ −ᾱ σ_{2}}{(Q) σ_{1} ⊑ᾱ σ_{2}}

I-Bot’ (Q) ⊥ ⊑ᾱ σ I-Rigid’ \overline{(Q) ∀ (α ≥ σ_{1}) σ ⊑ᾱ ∀ (α = σ_{1}) σ}

I-Hyp’ ; \frac{(α ≥ σ) ∈ Q α ∉ ᾱ}{(Q) σ ⊑ᾱ α}  I-Up’ ; \frac{α_{1} ∉ ftv(σ′)}{(Q) ∀ (α ≥ ∀ (α_{1} ⋄ σ_{1}) σ) σ′ ⊑ᾱ ∀ (α_{1} ⋄ σ_{1}) ∀ (α ≥ σ) σ′}

I-Alias’ ; \overline{(Q) ∀ (α_{1} ≥ σ_{1}) ∀ (α_{2} ≥ σ_{1}) σ ⊑ᾱ ∀ (α_{1} ≥ σ_{1}) ∀ (α_{2} = α_{1}) σ}

easy to check that (Q) σ_{1} ≡ σ_{2} holds, and we conclude by Lemma 2.3.1, A-Equiv’ or I-Equiv^{⋆}’.

A derivation with ⊑ᾱ or ⊏ −ᾱ that keeps skeletons unchanged cannot instantiate ⊥, but only replaces types by an alias (like A-Alias’), or extrudes binders (like A-Up’). Since A-Up’ and A-Alias’ do not modify the set of free variables, only A-Hyp can introduce new variables, which are necessarily frozen, that is, not in ᾱ. This is expressed by the following lemma:

Lemma 2.5.7 If we have

(Q) σ_{1} ♢ᾱ σ_{2}  ∀ (Q) σ_{1}/ = ∀ (Q) σ_{2}/  α ∈ ᾱ  α ∈ ftv(Q̂(σ_{2}))

Then we have α ∈ ftv(Q̂(σ_{1})).

The proof is by induction on the derivation of (Q) σ_{1} ♢ᾱ σ_{2}. See details in the Appendix (page 246).

2.6 Atomic instances

In this section, we define new relations, namely, ˙⊑ and ˙⊏ −ᾱ, that have the same expressiveness as ⊑ and ⊏ − but ensure canonical derivations. Besides, these relations are not transitive, so that all the steps of the instantiation are clearly separated. Furthermore, each step is always irreversible, in the sense that it is not an equivalence. In other words, all steps are useful.

Figure 2.3: Strict instance

In all rules, C_{f} is a well-formed useful context.

S-Hyp ; \frac{\begin{aligned}& σ′ ∉ T \\ (α ≥ σ_{1}) ∈ Q & α ∉ dom(C_{f}) & (Q) σ_{1} ≡ Ĉ_{f}(σ′) \end{aligned}}{(Q) C_{f}(σ′) ˙⊏ C_{f}(α)}

S-Up

\frac{β ∈ ftv(σ′′) α ∈ ftv(σ′) σ′, σ′′ ∉ V σ ∉ T α ∉ dom(Q\overline{C_{f}}Q′) ftv(σ) # dom(Q′)}{(Q) C_{f}(∀ (β ≥ ∀ (Q′, α ⋄ σ) σ′) σ′′) ˙⊏ C_{f}(∀ (α ⋄ σ) ∀ (β ≥ ∀ (Q′) σ′) σ′′)}

S-Alias

\frac{α_{1} ∈ ftv(σ′) α_{2} ∈ ftv(σ′) dom(Q′) # ftv(σ_{1}, σ_{2}) σ_{1} ∉ T σ_{1} ≡ σ_{2} σ = ∀ (α_{1} ≥ σ_{1}, Q′, α_{2} ≥ σ_{2}) σ′}{(Q) C_{f}(σ) ˙⊏ C_{f}(∀ (α_{1} ≥ σ_{1}, Q′, α_{2} = α_{1}) σ′)}

S-Nil \frac{ftv(σ) = ∅}{(Q) C_{f}(⊥) ˙⊏ C_{f}(σ)} S-Rigid

\frac{σ′ ∉ T α ∈ ftv(σ) σ ∉ V}{(Q) C_{f}(∀ (α ≥ σ′) σ) ˙⊏ C_{f}(∀ (α = σ′) σ)}

2.6.1 Definitions

The one-step strict instance relation ˙⊏ is defined in Figure 2.3. The one-step abstraction relation ˙⊏ −ᾱ is defined in Figure 2.4. These rules mention flexible and rigid contexts, defined formally in section 2.4. The one-step instance relation ˙⊑, which combines ˙⊏ and ˙⊏ − is defined in Figure 2.5. The symbol R stands either for ˙⊑ or ˙⊏ −^{∅}. As usual, we write σ_{1} R σ_{2} for (Q) σ_{1} R σ_{2}, where Q is unconstrained and σ_{1} and σ_{2} are closed under Q.

Definition 2.6.1 We define the relations (≡ ˙⊏ −^{∅}) and (≡ ˙⊑): (Q) σ_{1} (≡R) σ_{2} holds if and only if (Q) σ_{1} ≡ σ_{2} or there exists σ′_{1} and σ′_{2} such that (Q) σ_{1} ≡ σ′_{1}, (Q) σ′_{1} R σ′_{2} and (Q) σ′_{2} ≡ σ_{2}.

As already mentioned, R^{∗} is the transitive closure of the relation R. Note that StSh-Hyp is restricted to variables α not in ᾱ. The only rule introducing variables in ᾱ is C-Abstract-F, which adds \overline{C_{f}}.

Figure 2.4: Strict Abstraction Relation

In all rules, C_{r} is a well-formed useful context.

StSh-Hyp

\frac{\begin{aligned}& σ′ ∉ T \\ (α = σ_{1}) ∈ Q & α ∉ dom(C_{r}) & α ∉ ᾱ & (Q) σ_{1} ≡ Ĉ_{r}(σ′) \end{aligned}}{(Q) C_{r}(σ′) ˙⊏ −ᾱ C_{r}(α)}

StSh-Up

\frac{β ∈ ftv(σ′′) α ∈ ftv(σ′) σ′, σ′′ ∉ V σ ∉ T α ∉ dom(Q\overline{C_{R}}Q′) ftv(σ) # dom(Q′)}{(Q) C_{r}(∀ (β = ∀ (Q′, α = σ) σ′) σ′′) ˙⊏ −ᾱ C_{r}(∀ (α = σ) ∀ (β = ∀ (Q′) σ′) σ′′)}

StSh-Alias

\frac{α_{1} ∈ ftv(σ′) α_{2} ∈ ftv(σ′) dom(Q′) # ftv(σ_{1}, σ_{2}) σ_{1} ∉ T σ = ∀ (α_{1} = σ_{1}, Q′, α_{2} = σ_{2}) σ′ σ_{1} ≡ σ_{2}}{(Q) C_{r}(σ) ˙⊏ −ᾱ C_{r}(∀ (α_{1} = σ_{1}, Q′, α_{2} = α_{1}) σ′)}

Figure 2.5: Combined instance

C-Strict \frac{(Q) σ_{1} ˙⊏ σ_{2}}{(Q) σ_{1} ˙⊑ σ_{2}}

C-Abstract-F

\frac{(Q\overline{C_{f}}) σ_{1} ˙⊏ −\overline{C_{f}} σ_{2} level(C_{f}) > 1}{(Q) C_{f}(σ_{1}) ˙⊑ C_{f}(σ_{2})}

C-Abstract-R

\frac{(Q) σ_{1} ⊏ − σ_{2}}{(Q) σ_{1} ˙⊑ σ_{2}}

2.6.2 Equivalence between relations

These new relations have the same expressiveness as the original relations, as stated by the following lemma.

Properties 2.6.2 i) The relations (⊏ −) and (≡ ˙⊏ −^{∅})^{∗} are equal. ii) The relations (⊑) and (≡ ˙⊑)^{∗} are equal.

See proof in the Appendix (page 247).

The relations ˙⊏ and ˙⊏ −ᾱ can be seen as rewriting relations, under a given prefix. Then (Q) σ_{1} ˙⊏ σ_{2} corresponds to reducing the argument σ_{1} by ˙⊏, and getting σ_{2} as a result. Similarly, the relation ˙⊏ −ᾱ is viewed as a rewriting relation. These (rewriting) relations have a remarkable property: if they can reduce an argument σ, then they can also reduce its normal form nf(σ). Besides, the results are equivalent. This is stated below:

Properties 2.6.3 The following properties hold for R being ˙⊏ −ᾱ and ˙⊏.

i) If (Q) σ_{1} R σ_{2} holds, then there exists σ′_{2} such that (Q) nf(σ_{1}) R σ′_{2} and (Q) σ_{2} ≡ σ′_{2} hold.

ii) If (Q) σ_{1} R σ_{2} holds, σ_{1} is in normal form, and σ′_{1} ≈ σ_{1}, then there exists σ′_{2} such that (Q) σ′_{1} R σ′_{2} and (Q) σ_{2} ≡ σ′_{2} hold.

This is shown by considering each rule individually. In all cases, the projection of the redex to its normal form leads to a similar redex, thanks to Lemma 2.4.5 (page 75). See proof in the Appendix (page 250).

This result will be used in the proof of the main confluence result, namely the Diamond Lemma (Lemma 2.8.4).

2.7 Equivalence vs instantiation

The key result of this section is Property 2.7.7.i, which shows that the equivalence relation is the kernel of the instance relation. The second main result of this section is Corollary 2.7.10, which shows that both the abstraction relation and its inverse the revelation relation are stationary.

While occurrences describe only the symbolic structure of types, i.e. their skeleton, we here use polynomials to describe their binding structure. The polynomial associated to the binding structure of a type is called its weight. As expected, a type with no binding structure, i.e. a monotype, weighs zero, as stated by Lemma 2.7.4. The converse is also true.

We start by stating a few properties about polynomials, then we define weights, and show some useful properties. Then we prove the main results, which are Property 2.7.7.i and Corollary 2.7.10.

2.7.1 Polynomials

The set of three-variable polynomials in X, Y, Z, which we simply call “polynomials”, is defined as ℤ[X][Y][Z]. The addition + and multiplication × are, as expected, commutative, thus, for instance X ×Y equals Y ×X. It is well known [Bou59] that ℤ[X][Y][Z] is isomorphic to (ℤ[Y][Z])[X]. In other words, any polynomial can be seen as a polynomial in variable X, with coefficients in the ring ℤ[Y][Z]. Similarly, ℤ[Y][Z] can be seen as polynomials in variable Y, with coefficients in the ring ℤ[Z].

Given a total ordering ⩽ on a ring 𝔸 , we define a total ordering on 𝔸 [X] as the lexicographic order on the sequence of coefficients, higher degrees coming first. Formally, if P and Q are in 𝔸 [X], we can always write them in the form p_{n}X^{n} + … + p_{1}X + p_{0} and q_{n}X^{n} + … + q_{1}X + q_{0}. (we can have p_{n} = 0 if, for instance, the degree of P is smaller than the degree of Q). Then P ⩽ Q if and only if (p_{n}, …, p_{1}, p_{0}) ⩽ (q_{n}, …, q_{1}, q_{0}), taking the lexicographic order over 𝔸 ^{n+1}.

Using the usual total ordering on ℤ, we get a total ordering on ℤ[Z]. We use again this ordering to build a total ordering on (ℤ[Z])[Y]. This new ordering is used too to build a total ordering on (ℤ[Z][Y])[X].

Because of the above hierarchy, polynomial variables do not play equivalent roles, with respect to the orderings. More precisely, X is prevailing over Y which is in turn prevailing over Z.

Example The following sequence is an increasing sequence: Z, Z^{2}, Y, X, X + Y^{3}, X^{2}, Y^{2}X^{2}, X^{3} + Z, X^{4}.

Intuitively, each binder of a type will be associated a polynomial variable (X, Y, or Z). Whereas the abstraction relation only modifies Y and Z binders, irreversible instantiations modify X binders. The following definition make it easier to talk about the X variables of a given polynomial.

Definition 2.7.1 The X-degree of a polynomial P is its degree in the variable X, where the coefficients are considered in the ring (ℤ[Z][Y]). We write X ∈ P if the X-degree of P is not 0. As a matter of fact, we have X ∈ P if and only if X appears in the reduced form of P.

This definition is used in the first and fourth properties of the following. The other results are straightfoward. We omit the proof.

Properties 2.7.2 We have the following properties for any P, Q and R in ℤ[X][Y][Z]: i) If X ∉ P and X ∉ P′, then X ∉ P + P′. ii) If P ⩾ Q, then P + R ⩾ Q + R. iii) If P > 0 and R > 0, then P × R > 0. iv) If we have P ⩽ Q ⩽ R and X ∉ R − P, then X ∉ R − Q and X ∉ Q − P.

The latter property can be intuitively interpreted as follows: consider three types σ_{p}, σ_{q} and σ_{r} such that σ_{p} ⊑ σ_{q} (\underline{1}) and σ_{q} ⊑ σ_{r} (\underline{2}) hold (under some unspecified prefix). We write P, Q and R for the polynomials associated to σ_{p}, σ_{q} and σ_{r}, respectively. If some X binder is modified during the first instantiation (1) or during the second one (2), which implies X ∈ Q − P or X ∈ R − Q, then X is to appear in R − P. In other words, each transformation on some X binder during instantiation will remain visible forever.

2.7.2 Weight

If (Q) σ_{1} ≡ σ_{2} holds, then we have (Q) σ_{1} ⊑ σ_{2} and (Q) σ_{2} ⊑ σ_{1} by I-Equiv^{⋆} and symmetry of ≡. Conversely, we want to show that if both (Q) σ_{1} ⊑ σ_{2} and (Q) σ_{2} ⊑ σ_{1} hold, then (Q) σ_{1} ≡ σ_{2} is derivable. As mentioned above, each type is given a weight which reflects its binding structure. While weights are stable under equivalence, they strictly decrease by irreversible instantiation and irreversible abstraction. In the following paragraph, we give an illustrating example that should give the intuition behind weights. The definitions or terms that we introduce there are not meant to be formal and are not used further in the document.

Introduction to weights Weights are meant to give some information about the binding structure of types. For example, take the following type, written σ (the type being too large, we display it on several lines)

∀ (α ≥ ⊥ )
∀ (β ≥ ∀ (β_{1} ≥ ⊥ ) ∀ (β_{2} = ⊥ ) β_{1} → β_{2})
∀ (γ = ∀ (γ_{1} ≥ ⊥ ) ∀ (γ_{2} = ⊥ ) γ_{1} → γ_{2})
α → β → γ

Its binding structure depends only on the locations of ⊥. In the above example, ⊥ occurs five times. For illustration purposes, we give a number to each occurrence of ⊥:

∀ (α ≥ ⊥_{1} )
∀ (β ≥ ∀ (β_{1} ≥ ⊥_{2} ) ∀ (β_{2} = ⊥_{3} ) β_{1} → β_{2})
∀ (γ = ∀ (γ_{1} ≥ ⊥_{4} ) ∀ (γ_{2} = ⊥_{5} ) γ_{1} → γ_{2})
α → β → γ

We represent this type with the following graph:

→ ⊥_{1}  → →  → ⊥_{2}  ⊥_{3}  ⊥_{4}  ⊥_{5}

We consider all occurrences of ⊥ and (informally) associate a path to each occurrence. In this context, a path is a word in the set {=, ≥}, such as ≥ ≥ = ≥ ≥.

• ⊥_{1} appears inside a flexible context (see page 74) that is directly in the bound of α, which is flexible. Hence, the path associated to ⊥_{1} is ≥.

• ⊥_{2} appears directly in the bound of β_{1}, and β_{1} is in the bound of β. Both β and β_{1} are flexible, thus the path associated to ⊥_{2} is written ≥≥.

• ⊥_{3} appears in the bound of β_{2}, which is rigid, and β_{2} is in the bound of β, which is flexible. Hence, the path associated to ⊥_{3} is ≥=.

• Similarly, the path associated to ⊥_{4} is =≥, and the path associated to ⊥_{5} is ==.

On graphs, we simply label flexible bindings with ≥ and rigid bindings with =.

→

⊥_{1} →

→ →

⊥_{2}  ⊥_{3}  ⊥_{4}  ⊥_{5} ≥ ≥ = ≥ = ≥ =

We now show in detail how we compute the polynomial associated to this type. The first step consists in associating a polynomial variable to each binding arrow. Then, each path can be easily mapped to a monomial. The second step simply adds all the monomials associated to the paths of occurrences of ⊥.

• Both ⊥_{1} and ⊥_{2} appear in flexible contexts (see page 74), that is, their path is of the form ≥^{∗} (a sequence of ≥). Instantiation (⊑) is allowed in such contexts. We will weight such contexts using the polynomial variable X. More precisely, the weight associated to ≥ (that is, to the path of ⊥_{1}) is X, and the weight associated to ≥≥ (that is, to the path of ⊥_{2}) is XX, that is X^{2}.

• Both ⊥_{3} and ⊥_{5} appear in rigid contexts (see page 74), that is, their path is of the form ≥^{∗}=^{+} (a sequence of ≥ followed by a non-empty sequence of =). Abstraction (⊏ −) is allowed in such contexts, but not instantiation. We will weight the rigid part of such contexts using the polynomial variable Y. More precisely, the weight associated to ≥= (that is, the path of ⊥_{3}) is XY, and the weight associated to == (that is, the weight of ⊥_{5}) is Y Y, that is Y^{2}.

• Finally, the path associated to ⊥_{4} is =≥. The context of ⊥_{4} is of the form C_{r}(C_{f}), and neither abstraction nor instantiation is possible in such a context. We will weight the non-flexible and non-rigid part of such contexts using the polynomial variable Z. More precisely, the weight associated to =≥ (that is, the path of ⊥_{4}) is Y Z.

The total weight of σ is obtained by adding all the monomials computed for each occurrence of ⊥. Thus, we get the polynomial X + X^{2} + XY + Y^{2} + Y Z.

We can also label each binder of the graph above with its corresponding weight.

→

⊥_{1} →

→ →

⊥_{2}  ⊥_{3}  ⊥_{4}  ⊥_{5} X X Y X Y Z Y

In summary, we use polynomial variables to weigh the contexts in which ⊥ occurs. The polynomial variable X is used for flexible contexts whose path is of the form ≥^{i}, the polynomial variable Y is used for rigid contexts whose path is of the form ≥^{i}=^{j+1} and the polynomial variable Z is used for contexts whose path if of the form ≥^{i} =^{j+1} ≥⋄^{k}. This is summarized in Figure 2.6. We wish to define weight incrementally. Hence, we assume given a “current” path that we incrementally extend. Assume the current path is ≥^{i}. It weighs X^{i}, and its associated variable is X. If we add ≥ to this path, we see that the weight is multiplied by X, which gives X^{i+1}. If we add =, the weight is multiplied by Y, which gives X^{i}Y. This is why we define the auxiliary operator ⋆ below, such that X ⋆ ≥ is X and X ⋆ = is Y. To continue, assume the current path is ≥^{i}=^{j+1}. It weighs X^{i}Y^{j+1}, and its associated variable is Y. If we add ≥ to this path, the weight is multiplied by Z, which gives X^{i}Y^{j+1}Z. If we add =, the weight is multiplied by Y. Hence, we define Y ⋆ ≥ as Z and Y ⋆ = as Y. Similarly, if the

Figure 2.6: Paths and weights

Path  Associated polynomial variable

\underbrace{\overbrace{≥ … ≥}^{i times}}_{X^{i}}  X

\underbrace{\overbrace{≥ … ≥}^{i times}}_{X^{i}}  \underbrace{\overbrace{= … =}^{j + 1 times}}_{Y^{j+1}}  Y

\underbrace{\overbrace{≥ … ≥}^{i times}}_{X^{i}}  \underbrace{\overbrace{= … =}^{j + 1 times}}_{Y^{j+1}}  \underbrace{\overbrace{≥ ⋄_{1} … ⋄_{k}}^{k times}}_{Z^{k+1}} Z

current path is ≥^{i} =^{j+1} ≥⋄^{k}, the associated variable is Z. Adding X or Y to such a path multiplies the weight by Z. Hence, Z ⋆ ≥ and Z ⋆ = are both equal to Z. This should explain the following definition:

Definition 2.7.3 We define the auxiliary binary operator ⋆ on the set {X, Y, Z} × {≥, =} as follows:

X ⋆ ≥ is X  X ⋆ = is Y  Y ⋆ ≥ is Z  Y ⋆ = is Y  Z ⋆ ⋄ is Z

As seen above, the weight associated to each occurrence of ⊥ depends on the its path, that is, on its context. The polynomial variables X, Y, and Z represent three kinds of paths. This is why we define three functions w_{A} for A in {X, Y, Z}, where A represents intuitively the current path. Each w_{A} maps types to polynomials in ℤ[X][Y][Z]. Here is the structural definition of w_{A}:

w_{A}(⊥) =^{△} 1 w_{A}(τ) =^{△} 0

w_{A}(∀ (α ⋄ σ) σ′) =^{△} \begin{cases}w_{A}(σ′) & if α ∉ ftv(σ′) \\ w_{A}(σ) & if nf(σ′) = α \\ w_{A⋆⋄}(σ) × (A ⋆ ⋄) + w_{A}(σ′) & otherwise \end{cases}

By default, the notation w(σ) means w_{X}(σ). Note that w_{A}(σ) ⩾ 0 for any A and σ, that is, w_{A}(σ) is in IN[X][Y][Z].

Examples One can check that σ, given above, does weigh X + X^{2} + XY + Y^{2} + Y Z. As another example, the weight of ∀ (β = ∀ (α ≥ ⊥) α → α) β → β is Z^{2} and the weight of the type of the identity ∀ (α ≥ ⊥) α → α is X. Note that ∀ (α ≥ ⊥) α → α and ∀ (α≥⊥) (α → α) → (α → α) have the same weight, whereas their structure (skeleton) are different.

We have characterized monotypes by their normal form, or by their projection (as in Property 2.1.5.i (page 67)). Another way is to use weights:

Lemma 2.7.4 We have w_{A}(σ) = 0 iff σ ∈ T .

\underline{Proof}: By Property 2.1.5.i (page 67), we only have to show that w_{A}(σ) = 0 if and only if there is no u such that σ/u = ⊥. The proof by structural induction on σ is straightforward.

Understanding weight

Let’s have a look at the rules defining abstraction ⊏ − and instantiation ⊑. We can consider these rules as rewriting rules taking a type and returning an instantiated type. Rules such as R-Context-R, R-Context-Flexible, … define the contexts in which the rewriting can be applied. Some rules are not symmetric, and possibly not reversible, namely the rules A-Hyp, I-Hyp, I-Rigid and I-Bot. Each time I-Bot is used (with restrictions of Lemma 2.3.1), the domain of the projection of its argument grows: if (Q) σ ⊑ σ′ holds by I-Bot and context rules, then the domain of σ is included in the domain σ′. For example, consider ⊥ ⊑ α → α: the domain grows from {ϵ} to {ϵ, 1, 2}. However, rules A-Hyp, I-Hyp and I-Rigid keep the same projection (relative to a given prefix). This is immediate for I-Rigid since projections ignore the kind of bounds. As for A-Hyp (or, similarly, I-Hyp), consider this typical example:

(α = σ) ∀ (β = σ) β → α ⊑ ∀ (β = α) β → α

It can be derived by R-Context-Rigid and A-Hyp. The skeleton associated to both sides (and under the prefix (α = σ)) is proj(σ) → proj(σ). Hence, in such an example, the projection is kept unchanged. Binders, however, have been modified, and weights are modified too. Indeed, the weight of ∀ (β = σ) β → α is Y × w_{Y} (σ), while the weight of ∀ (β = α) β → α is 0. We see that weights and projections are complementary: although projections are stable under A-Hyp, I-Hyp and I-Rigid, these rules decrease weights. However, we do not have (Q) σ_{1} ≡ σ_{2} if and only if w(σ_{1}) = w(σ_{2}) and ∀ (Q) σ_{1}/ = ∀ (Q) σ_{2}/. This result is true only if σ_{2} is known to be an instance of σ_{1} under Q, as stated in Property 2.7.6.ii. As a counterexample, take

σ_{1} =^{△} ∀ (α ≥ ⊥) ∀ (β ≥ σ_{id}) (α → α) → β and σ_{2} =^{△} ∀ (α ≥ ⊥) ∀ (β ≥ σ_{id}) β → (α → α),

2.7 Equivalence vs instantiation  93

to be taken under an empty prefix. We do have σ_{1}/ = σ_{2}/, more precisely both σ_{1} and σ_{2} have the skeleton (⊥ → ⊥) → (⊥ → ⊥). Besides, w(σ_{1}) and w(σ_{2}) are both equal to X + X^{2}. However, σ_{1} and σ_{2} are not equivalent since they do not have the same normal form up to rearrangement.

Like projections, weights are stable under equivalence:

Lemma 2.7.5 If (Q) σ_{1} ≡ σ_{2} holds, then w_{A}(σ_{1}) = w_{A}(σ_{2}).

\underline{Proof}: By induction on the derivation of (Q) σ_{1} ≡ σ_{2}. Case Eq-Refl is obvious. Cases Eq-Comm, Eq-Var, and Eq-Free are immediate by definition of w_{A}. In the case Eq-Mono, both sides weigh 0. Cases R-Trans and R-Context-L are by induction hypothesis. As for R-Context-R, we have σ_{1} = ∀ (α ⋄ σ) σ′_{1}, σ_{2} = ∀ (α ⋄ σ) σ′_{2}, and the premise is (Q, ∀ (α ⋄ σ)) σ′_{1} ≡ σ′_{2} (\underline{1}) We have to show that w_{A}(∀ (α ⋄ σ) σ′_{1}) = w_{A}(∀ (α ⋄ σ) σ′_{2}). By induction hypothesis and (1), we have w_{A′}(σ′_{1}) = w_{A′}(σ′_{2}) (\underline{2}), for any A′ in {X, Y, Z}. We proceed by case analysis:

Subcase σ ∈ T : Then by Lemma 2.7.4 we have w_{A}(σ) = 0, thus we have w_{A}(∀ (α⋄σ) σ′_{1}) = w_{A}(σ′_{1}) and w_{A}(∀ (α ⋄ σ) σ′_{2}) = w_{A}(σ′_{2}), and the result follows from (2). We can now consider σ not in T , that is α ∉ dom({ \atop Q, α ⋄ σ}). Writing θ for { \atop Q, α ⋄ σ}, we have α ∉ dom(θ) (\underline{3}).

Subcase α ∉ ftv(σ′_{1}): Then by Property 1.5.11.ix (page 54), (1), and (3), we have α ∉ ftv(σ′_{2}). Hence, we have w_{A}(∀ (α ⋄ σ) σ′_{1}) = w_{A}(σ′_{1}), w_{A}(∀ (α ⋄ σ) σ′_{2}) = w_{A}(σ′_{2}), and we conclude by (2).

Subcase α ∉ ftv(σ′_{2}): similar. We consider now that α ∈ ftv(σ′_{1}) and α ∈ ftv(σ′_{2}).

Subcase nf(σ′_{1}) = α: Then θ(α) = θ(nf(σ′_{2})) holds from Lemma 1.5.9 and (1). Hence, we get α = θ(nf(σ′_{2})) (\underline{4}) from (3). By well-formedness of (Q, α ⋄ σ), we have α ∉ ftv({ \atop Q, α ⋄ σ}), thus we have α ∉ codom(θ). Hence (4) gives nf(σ′_{2}) = α. Thus w_{A}(∀ (α ⋄ σ) σ′_{1}) = w_{A}(σ) = w_{A}(∀ (α ⋄ σ) σ′_{2}), which is the expected result.

Subcase nf(σ′_{2}) = α: similar.

Otherwise we have nf(σ′_{1}) ≠ α, nf(σ′_{2}) ≠ α, α ∈ ftv(σ′_{1}), and α ∈ ftv(σ′_{2}), hence by definition we get w_{A}(∀ (α ⋄ σ) σ′_{1}) = w_{A⋆⋄}(σ) × (A ⋆ ⋄) + w_{A}(σ′_{1}) and w_{A}(∀ (α ⋄ σ) σ′_{2}) = w_{A⋆⋄}(σ) × (A ⋆ ⋄) + w_{A}(σ′_{2}). They are equal by (2).

How to lose weight

Although weights are stable under equivalence, instantiation decreases weight and increases the domain of projections.

Properties 2.7.6 If (Q) σ_{1} ⊏ − σ_{2} holds, then the two following properties are true for A = Y and A = X. If (Q) σ_{1} ⊑ σ_{2} holds, then the two following properties are true for A = X.

i) If ∀ (Q) σ_{1}/ = ∀ (Q) σ_{2}/, then w_{A}(σ_{1}) ⩾ w_{A}(σ_{2}). ii) If ∀ (Q) σ_{1}/ = ∀ (Q) σ_{2}/ and w_{A}(σ_{1}) = w_{A}(σ_{2}), then (Q) σ_{1} ≡ σ_{2} holds.

\underline{Proof}: We prove both properties simultaneously. By Lemma 2.5.5, we have a derivation of (Q) σ_{1} ♢ᾱ σ_{2} (\underline{1}). By Lemma 2.5.6, the derivation is assumed restricted. We prove both properties by induction on the derivation of (1).

∘ Case A-Equiv’: We have (Q) σ_{1} ≡ σ_{2}. By Lemma 2.7.5, we have w_{A}(σ_{1}) = w_{A}(σ_{2}). Hence, Properties i and ii hold.

∘ Case R-Trans The premises are (Q) σ_{1} ♢ᾱ σ′_{1} (\underline{2}) and (Q) σ′_{1} ♢ᾱ σ_{2} (\underline{3}). By induction hypothesis on (2), if ∀ (Q) σ_{1}/ = ∀ (Q) σ′_{1}/, then w_{A}(σ_{1}) ⩾ w_{A}(σ′_{1}) (\underline{4}). By induction hypothesis on (3), if ∀ (Q) σ′_{1}/ = ∀ (Q) σ_{2}/, then w_{A}(σ′_{1}) ⩾ w_{A}(σ_{2}) (\underline{5}). By Property 2.1.3.ii (page 65), (2), and (3), we have ∀ (Q) σ_{1} ⩽_{/} ∀ (Q) σ′_{1} (\underline{6}), and ∀ (Q) σ′_{1} ⩽_{/} ∀ (Q) σ_{2} (\underline{7}). We prove Property i: Assume ∀ (Q) σ_{1}/ = ∀ (Q) σ_{2}/ holds. Then we have ∀ (Q) σ_{2} ⩽_{/} ∀ (Q) σ′_{1} from (6) thus ∀ (Q) σ′_{1}/ = ∀ (Q) σ_{2}/ = ∀ (Q) σ_{1}/ holds by antisymmetry (Property 2.1.2.i (page 65)) and (7). As a consequence, we have w_{A}(σ_{1}) ⩾ w_{A}(σ′_{1}) (\underline{8}) from (4) and w_{A}(σ′_{1}) ⩾ w_{A}(σ_{2}) (\underline{9}) from (5). Thus, we have w_{A}(σ_{1}) ⩾ w_{A}(σ_{2}) by transitivity of ⩾ on polynomials. This proves Property i.

By induction hypothesis on (2), if ∀ (Q) σ_{1}/ = ∀ (Q) σ′_{1}/, and w_{A}(σ_{1}) = w_{A}(σ′_{1}), then there exists a derivation of (Q) σ_{1} ≡ σ′_{1} (\underline{10}). By induction hypothesis on (3), if ∀ (Q) σ′_{1}/ = ∀ (Q) σ_{2}/, and w_{A}(σ′_{1}) = w_{A}(σ_{2}), then there exists a derivation of (Q) σ′_{1} ≡ σ_{2} (\underline{11}). We prove Property ii: As seen above, if ∀ (Q) σ_{1}/ = ∀ (Q) σ_{2}/, then ∀ (Q) σ_{1}/ = ∀ (Q) σ_{2}/ = ∀ (Q) σ′_{1}/. Additionally, if w_{A}(σ_{1}) = w_{A}(σ_{2}), then (8) and (9) imply w_{A}(σ_{1}) = w_{A}(σ′_{1}) = w_{A}(σ_{2}), by antisymmetry of ⩾ on polynomials. Consequently, we have a derivation of (Q) σ_{1} ≡ σ′_{1} by (10) and a derivation of (Q) σ′_{1} ≡ σ_{2} by (11). Hence, we get a derivation of (Q) σ_{1} ≡ σ_{2} by R-Trans. This proves Property ii.

∘ Case A-Hyp’ and I-Hyp’: We have either (Q) σ_{1} ⊑ α_{1} (that is, σ_{2} is α_{1}), with (α_{1} ≥ σ_{1}) ∈ Q, or (Q) σ_{1} ⊏ − α_{1} with (α_{1} = σ_{1}) ∈ Q. By Lemma 2.3.1, σ_{1} is not in T , thus w_{A}(σ_{1}) ≠ 0 by Lemma 2.7.4. Additionally, w_{A}(σ_{2}) = w_{A}(α_{1}) = 0 by definition. Hence, w_{A}(σ_{1}) > w_{A}(σ_{2}), which proves Properties i and ii.

∘ Case A-Alias’ and I-Alias’: We have σ_{1} = ∀ (α_{1}⋄σ) ∀ (α_{2}⋄σ) σ′ and σ_{2} = ∀ (α_{1}⋄σ) ∀ (α_{2} = α_{1}) σ′. By restrictions of Lemma 2.5.6, we have α_{1} ∈ ftv(σ′) and α_{2} ∈ ftv(σ′). Besides, σ ∉ T (\underline{1}). By definition we have w_{A}(σ_{1}) = w_{A}(σ′)+2×B ×w_{B}(σ), where B is A⋆⋄, and we have w_{A}(σ_{2}) = w_{A}(σ′)+B ×w_{B}(σ). Hence, w_{A}(σ_{1})−w_{A}(σ_{2}) = B ×w_{B}(σ), which is strictly greater than 0 by Lemma 2.7.4 and (1). This implies w_{A}(σ_{1}) > w_{A}(σ_{2}) by Property 2.7.2.ii (page 87), thus Properties i and ii hold.

∘ Case A-Up’ and I-Up’: We have σ_{1} = ∀ (α ⋄ ∀ (α′ ⋄′ σ′) σ) σ′′ and σ_{2} = ∀ (α′ ⋄′ σ′) ∀ (α ⋄ σ) σ′′. We have w_{A}(σ_{1}) = w_{A}(σ′′) + B × (w_{B}(σ) + C × w_{C}(σ′)) (\underline{1}), where B is A⋆⋄ and C is B ⋆⋄′. Similarly, we have w_{A}(σ_{2}) = w_{A}(σ′′)+D ×w_{D}(σ′)+B ×w_{B}(σ) (\underline{2})

2.7 Equivalence vs instantiation  95

where D is A ⋆ ⋄′. If we are in the case A-Up’, then ⋄ and ⋄′ are rigid, thus B is A⋆ =, that is Y (A is X or Y), C is Y, and D is Y. If we are in the case I-Up’, then ⋄ is >, A is X, thus B is X, C is X ⋆ ⋄′, and D is X ⋆ ⋄′. In both cases, C = D. Hence, we have w_{A}(σ_{2}) = w_{A}(σ′′) + C × w_{C}(σ′) + B × w_{B}(σ) (\underline{3}) from (2). From (1) and (3), we get w_{A}(σ_{1}) − w_{A}(σ_{2}) = C × w_{C}(σ′) × (B − 1) (\underline{4}). Since B is X or Y, we have B > 1, that is, B − 1 > 0 (\underline{5}). Since σ′ is not in T , we have w_{C}(σ′) > 0 (\underline{6}) by Lemma 2.7.4. Hence w_{A}(σ_{1}) − w_{A}(σ_{2}) > 0 by Property 2.7.2.iii (page 87), (5), (6), and (4), that is, w_{A}(σ_{1}) > w_{A}(σ_{2}). This proves Properties i and ii.

∘ Case R-Context-R We have (Q) σ_{1} ♢ᾱ σ_{2}, with σ_{1} = ∀ (α ⋄ σ_{0}) σ′_{1}, σ_{2} = ∀ (α ⋄ σ_{0}) σ′_{2}, and the premise is (Q, α ⋄ σ_{0}) σ′_{1} ♢^{ᾱ∪\{α\}} σ′_{2} (\underline{1}). If ∀ (Q) σ_{1}/ = ∀ (Q) σ_{2}/, then by notation ∀ (Q, α ⋄ σ_{0}) σ′_{1}/ = ∀ (Q, α ⋄ σ_{0}) σ′_{2}/, thus, by induction hypothesis, Property i, and (1), we have w_{A}(σ′_{1}) ⩾ w_{A}(σ′_{2}) (\underline{2}). We proceed by case analysis.

Subcase σ_{0} ∈ T : Then by definition we have w_{A}(σ_{1}) = w_{A}(σ′_{1}) and w_{A}(σ_{2}) = w_{A}(σ′_{2}), thus (2) proves Property i. Additionally, if we have w_{A}(σ_{1}) = w_{A}(σ_{2}), then we have w_{A}(σ′_{1}) = w_{A}(σ′_{2}), thus (Q, α ⋄ σ_{0}) σ′_{1} ≡ σ′_{2} holds by induction hypothesis and (1). We get (Q) σ_{1} ≡ σ_{2} by R-Context-R, which proves Property ii. In the following, we assume σ_{0} ∉ T (\underline{3}).

Subcase nf(σ′_{1}) = α: Then we have (Q, α⋄σ_{0}) σ′_{1} ≡ σ′_{2} by Lemma 2.1.6 and (1). Thus (Q) σ_{1} ≡ σ_{2} holds by R-Context-R, and we get the expected result by Lemma 2.7.5. In the following, we assume that nf(σ′_{1}) is not α.

Subcase nf(σ′_{2}) = α and α ∈ ftv(σ′_{1}) (\underline{4}): Then σ′_{1} ≡ α by Property 2.1.7.ii (page 68) and (1), and this is the previous subcase.

Subcase α ∈ ftv(σ′_{1}) and α ∉ ftv(σ′_{2}): This is not possible by Lemma 2.1.4 (page 67) and (3).

Subcase α ∈ ftv(σ′_{2}) and α ∉ ftv(σ′_{1}) (\underline{5}): This is not possible by Lemma 2.5.7 (page 83) and (3) (α is in ᾱ ∪ {α}). In the following, we assume that nf(σ′_{2}) is not α (because such a case corresponds necessarily to subcases (4) or (5)).

Subcase α ∈ ftv(σ′_{2}) and α ∈ ftv(σ′_{1}): We assumed that nf(σ′_{1}) ≠ α and nf(σ′_{2}) ≠ α, thus by definition, we have w_{A}(σ_{1}) = w_{B}(σ_{0}) × B + w_{A}(σ′_{1}), where B is A ⋆ ⋄. Similarly, we have w_{A}(σ_{2}) = w_{B}(σ_{0})×B+w_{A}(σ′_{2}). Hence w_{A}(σ_{1})−w_{A}(σ_{2}) = w_{A}(σ′_{1})−w_{A}(σ′_{2}) (\underline{6}) which is greater or equal to 0 by (2). This proves Property i. If w_{A}(σ_{1}) = w_{A}(σ_{2}), then (6) implies w_{A}(σ′_{1}) = w_{A}(σ′_{2}). Hence, by induction hypothesis and (1), there exists a derivation of (Q, α ⋄ σ_{0}) σ′_{1} ≡ σ′_{2}. We get (Q) σ_{1} ≡ σ_{2} by R-Context-R. This proves Property ii.

∘ Case A-Context-L’ and I-Context-L’: We have (Q) σ_{1} ♢ σ_{2}, with σ_{1} = ∀ (α⋄σ′_{1}) σ_{0} and σ_{2} = ∀ (α ⋄ σ′_{2}) σ_{0}. The premise is (Q) σ′_{1} ♢ᾱ σ′_{2} (\underline{1}). Moreover, if ♢ᾱ is ⊑ᾱ, then ⋄ is flexible; if ♢ᾱ is ⊏ −ᾱ, then ⋄ is rigid. By Lemma 2.5.6, we have nf(σ_{0}) ≠ α and α ∈ ftv(σ_{0}), that is, there exists u such that σ_{0}/u = α (\underline{2}). We prove Property i. Assume ∀ (Q) σ_{1}/ = ∀ (Q) σ_{2}/ holds. Then by Property 1.3.3.i (page 40), we get Θ_{Q}(σ_{1}) = Θ_{Q}(σ_{2}). Hence, we have Θ_{Q}(σ_{1})·u/ = Θ_{Q}(σ_{2})·u/, that is, Θ_{Q}(σ′_{1}) = Θ_{Q}(σ′_{2}) by (2). By Property 1.3.3.i (page 40), this implies ∀ (Q) σ′_{1}/ = ∀ (Q) σ′_{2}/. Let B be A ⋆ ⋄. By induction hypothesis and (1), we get w_{B}(σ′_{1}) ⩾ w_{B}(σ′_{2}) (\underline{3}). We have w_{A}(σ_{1}) = w_{A}(σ_{0}) + w_{B}(σ′_{1}) × B. Similarly, w_{A}(σ_{2}) = w_{A}(σ_{0}) + w_{B}(σ′_{2}) × B. Hence we have w_{A}(σ_{1})−w_{A}(σ_{2}) = B ×(w_{B}(σ′_{1})−w_{B}(σ′_{2})) (\underline{4}), thus we get w_{A}(σ_{1}) ⩾ w_{A}(σ_{2}) from (3). This proves Property i. If w_{A}(σ_{1}) = w_{A}(σ_{2}), then (4) implies w_{B}(σ′_{1}) = w_{B}(σ′_{2}), thus (Q) σ′_{1} ≡ σ′_{2} is derivable by induction hypothesis and (1). Hence (Q) σ_{1} ≡ σ_{2} is derivable by R-Context-L. This proves Property ii.

∘ Case I-Abstract’: By induction hypothesis.

∘ Case I-Bot’: We have σ_{1} = ⊥. Hence, (∀ (Q) σ_{1})/ϵ = ⊥. By Lemma 2.5.6, we have σ_{2} ∉ V, and σ_{2} is not ⊥. Hence, σ_{2}/ϵ is a type constructor g. By definition, we have ∀ (Q) σ_{1} <_{/} ∀ (Q) σ_{2}, which proves Properties i and ii.

∘ Case I-Rigid’: In this case, ♢ᾱ is ⊑ᾱ, and A is X. We have ∀ (Q) σ_{1}/ = ∀ (Q) σ_{2}/ and σ_{1} is of the form ∀ (α ≥ σ) σ′, while σ_{2} is of the form ∀ (α = σ) σ′. By Lemma 2.5.6, we have α ∈ ftv(σ′), nf(σ′) ≠ α, and σ ∉ T (\underline{1}). By definition, w_{X}(σ_{1}) is w_{X}(σ′)+X ×w_{X}(σ), while w_{X}(σ_{2}) equals w_{X}(σ′)+Y ×w_{Y} (σ). We get w(σ_{1})−w(σ_{2}) = Xw_{X}(σ) − Y w_{Y} (σ). By (1) and Lemma 2.7.4, we get w_{X}(σ) ≠ 0. The X-degree of Xw_{X}(σ) is at least 1, but the X-degree of Y w_{Y} (σ) is 0. Hence, Xw_{X}(σ) − Y w_{Y} (σ) > 0, that is, w(σ_{1}) > w(σ_{2}). This proves Properties i and ii.

Then we can show that the equivalence relation is the symmetric kernel of the instance relation.

Properties 2.7.7 i) If we have (Q) σ_{1} ⊑ σ_{2} and (Q) σ_{2} ⊑ σ_{1}, then (Q) σ_{1} ≡ σ_{2} holds. ii) If (Q) σ ⊑ ⊥ holds, then nf(σ) is ⊥.

\underline{Proof}: \underline{Property i}: By Property 2.1.3.ii (page 65), we get ∀ (Q) σ_{1}/ ⩽_{/} ∀ (Q) σ_{2}/ and ∀ (Q) σ_{2}/ ⩽_{/} ∀ (Q) σ_{1}/. Hence, by antisymmetry (Property 2.1.2.i (page 65)), we get ∀ (Q) σ_{1}/ = ∀ (Q) σ_{2}/. By Property 2.7.6.i, we get w(σ_{1}) ⩾ w(σ_{2}) and w(σ_{2}) ⩾ w(σ_{1}). Hence, w(σ_{1}) = w(σ_{2}), thus, by Property 2.7.6.ii, there exists a derivation of (Q) σ_{1} ≡ σ_{2}.

\underline{Property ii}: By I-Bot, we have (Q) ⊥ ⊑ σ. By Property i, we get (Q) σ ≡ ⊥. By Lemma 1.5.9, we get nf(Q̂(σ)) = ⊥. By Property 1.5.6.iii (page 51), this gives Q̂(nf(σ)) = ⊥. Hence, we must have nf(σ) = ⊥.

Weight watchers

As mentioned above, X corresponds intuitively to flexible contexts. Besides, the abstraction relation only occurs in rigid contexts. Thus, we expect “X-binders” to be kept unchanged by abstraction. Conversely, if an instantiation does not modify “X-binders”, we expect it to be a true abstraction. This last point is stated exactly in the following lemma:

Lemma 2.7.8 Assume Q̂(nf(σ_{2})) ∉ ϑ. Then we have (Q) σ_{1} ⊑ σ_{2}, ∀ (Q) σ_{1}/ = ∀ (Q) σ_{2}/, and X ∉ w(σ_{1}) − w(σ_{2}) if and only if (Q) σ_{1} ⊏ − σ_{2}.

It is shown by induction on the derivation of (Q) σ_{1} ⊑ σ_{2} for the first implication and by induction on the derivation of (Q) σ_{1} ⊏ − σ_{2} for the second. See details in the Appendix (page 253).

Note that “X-binders are kept unchanged” is expressed formally by X ∉ w(σ_{1}) − w(σ_{2}).

2.7.3 Abstraction is well-founded

In this section we show that abstraction is well-founded, as stated formally by Corollary 2.7.10. First, we show that the weight associated to a type σ is bounded by a polynomial that depends only on the size of σ.

Preliminary definitions We associate to any type σ a one-variable polynomial P (σ) defined as w(σ)(X, X, X). The depth of σ, written d(σ), is by definition the degree of P (σ). The size of σ is written #σ and is by definition the size of the finite set dom(σ). The cardinal of the set ftv(σ) is written n_{σ}.

Properties 2.7.9 We have the following properties:

i) For any polytype σ, each coefficient in P (σ) is bounded by #σ − n_{σ}. ii) For any polytype σ, we have d(σ) ⩽ #σ.

The proof is by structural induction on σ. See details in the Appendix (page 256).

A weak ascending sequence of polytypes (σ_{i})_{i∈IN} is a sequence such that (Q) σ_{i} ⊏ − σ_{i+1} holds for all i ⩾ 0. A weak descending sequence is such that (Q) σ_{i+1} ⊏ − σ_{i} (or, equivalently, (Q) σ_{i} ⊐ − σ_{i+1}).

Corollary 2.7.10 Any weak ascending or weak descending sequence (σ_{i})_{i∈IN} is stationary, that is, there exists n such that (Q) σ_{i} ≡ σ_{n} holds for any i ⩾ n

\underline{Proof}: By Property 2.1.3.i (page 65), we have σ_{i}/ = σ_{i+1}/ for any i. Hence, for any i, we have σ_{i}/ = σ_{0}/ and #σ_{i} = #σ_{0}. Let w_{i} be w(σ_{i}). If the sequence is ascending, we have (Q) σ_{i} ⊏ − σ_{i+1}, thus w_{i} ⩾ w_{i+1} holds by Property 2.7.6.i. If the sequence is descending, we have w_{i} ⩽ w_{i+1} for all i. Let P_{i} be the polynomial w_{i}(X, X, X).

• We say that P is bounded by n, when each coefficient in P is bounded by n, and the degree of P is bounded by n too. By Property 2.7.9.i, each coefficient in P_{i} is bounded by #σ_{i}, that is, by #σ_{0}. The degree of P_{i} is also bounded by #σ_{0} by Property 2.7.9.ii. Hence, P_{i} is bounded by a constant #σ_{0}. We note that P_{i} is in IN[X] (the coefficients of P cannot be negative).

• The subset S of IN[X] of polynomials P bounded by n is finite, for any n. Hence, the increasing (or decreasing) sequence (P_{i})_{i∈IN}, which is included in S, is stationary. Consequently, there exists a polynomial P and k such that for any i ⩾ k, we have P_{i} = P.

• The set of polynomials w in IN[X][Y][Z] such that w(X, X, X) is P is finite too (indeed, the equation n_{x} + n_{y} + n_{z} = n, where n is given, admits a finite number of solutions in IN^{3}.) Hence, the increasing (or decreasing) sequence (w_{i}) is stationary. Consequently, there exists n such that, by Property 2.7.6.i, (Q) σ_{i} ≡ σ_{n} holds for i ⩾ n. This is the expected result.

In summary, any weak ascending sequence is finite, which also means that the abstraction relation can be considered as a well-founded order (up to equivalence) on the set of types. Such a result will be useful to show confluence of the abstraction relation in Lemma 2.8.2.

2.8 Confluence

We wish to show two important confluence results. The first one is the confluence of the abstraction relation (see Lemma 2.8.2). The second one is the commutation of the abstraction relation and the instance relation, as stated in the Diamond Lemma (Lemma 2.8.4). To begin with, we show some auxiliary confluence results on the atomic relations defined in Section 2.6. The properties below are used only in Lemma 2.8.2 and (indirectly) in Lemma 2.8.4. These lemmas state the confluence of ⊏ − on the one hand, and of ⊏ − and ⊑ on the other hand.

Properties 2.8.1

i) Assume σ_{1} is in normal form and Q is unconstrained. If we have (Q) σ_{1} ˙⊏ −ᾱ σ_{2} and (Q) σ_{1} ˙⊏ −ᾱ σ_{3}, then there exists σ_{4} such that (Q) σ_{2} ⊏ − σ_{4} and (Q) σ_{3} ⊏ − σ_{4}.

ii) The relation (≡ ˙⊏ −^{∅}) is weakly confluent under an unconstrained prefix. iii) Assume σ_{1} is in normal form and Q is unconstrained. If we have (Q) σ_{1} ˙⊏ σ_{2}

and (Q) σ_{1} ˙⊏ − σ_{3}, then there exist σ_{4} such that (Q) σ_{2} ˙⊏ − σ_{4} and (Q) σ_{3} ˙⊏ σ_{4} holds.

iv) Assume C_{f}(σ_{1}) is in normal form, level(C_{f}) > 1, and Q is unconstrained. If we have (Q\overline{C_{f}}) σ_{1} ˙⊏ −^{dom(C_{f})} σ_{2}, and (Q) C_{f}(σ_{1}) ˙⊏ −ᾱ σ_{3}, then there exists σ_{4} such that (Q) C_{f}(σ_{2}) ˙⊏ −ᾱ σ_{4} and (Q) σ_{3} ˙⊑ σ_{4} hold.

These results are shown by considering the critical pairs. See the full proof in the Appendix (page 257).

The following diagram illustrates the confluence of the abstraction relation (under an unconstrained prefix).

\begin{matrix}σ_{1} & σ_{2} \\ σ_{3} & σ_{4} \end{matrix} ⊏ − ⊏ − ⊏ − ⊏ −

This result is stated formally by the following lemma.

Lemma 2.8.2 (Confluence of the abstraction relation) If σ_{1} ⊏ − σ_{2} and σ_{1} ⊏ − σ_{3} hold, then there exists σ_{4} such that σ_{2} ⊏ − σ_{4} and σ_{3} ⊏ − σ_{4} hold.

\underline{Proof}: By Property 2.6.2.i (page 85), the relations (≡ ˙⊏ −^{∅})^{∗} and ⊏ − are equivalent. Hence, by hypothesis, we can derive both σ_{1} (≡ ˙⊏ −^{∅})^{∗} σ_{2} and σ_{1} (≡ ˙⊏ −^{∅})^{∗} σ_{3}. By Property 2.8.1.ii, (≡ ˙⊏ −^{∅}) is weakly confluent. Besides, by Corollary 2.7.10, (≡ ˙⊏ −^{∅}) is well-founded (up to equivalence). Note that (≡ ˙⊏ −^{∅}) is defined up to equivalence. Hence, (≡ ˙⊏ −^{∅})^{∗} is confluent, that is, there exists σ_{4} such that σ_{2} (≡ ˙⊏ −^{∅})^{∗} σ_{4} and σ_{3} (≡ ˙⊏ −^{∅})^{∗} σ_{4}. We can equivalently write σ_{2} ⊏ − σ_{4} and σ_{3} ⊏ − σ_{4}. This is the expected result.

The instance relation ⊑ is not confluent. This is not surprising since the ML instance relation, which is a subcase, is not: two incompatible instantiations of the same type variable cannot be merged. However, abstraction and instance commute, as described by the following diagram, to be taken under an unconstrained prefix.

\begin{matrix}σ_{1} & σ_{2} \\ σ_{3} & σ_{4} \end{matrix} ⊏ − ⊑ ⊏ − ⊑

Lemma 2.8.3 Assume Q is unconstrained. If we have (Q) σ_{1} (≡ ˙⊑) σ_{2} and (Q) σ_{1} (≡ ˙⊏ −^{∅}) σ_{3}, then there exists σ_{4} such that (Q) σ_{2} (≡ ˙⊏ −^{∅}) σ_{4} and (Q) σ_{3} (≡ ˙⊑) σ_{4} hold.

\underline{Proof}: If (Q) σ_{1} ≡ σ_{2} or (Q) σ_{1} ≡ σ_{3} hold, we get the expected result by taking (respectively) σ_{4} = σ_{3} or σ_{4} = σ_{2}. Otherwise, we have by definition

{(Q) σ_{1} ≡ σ_{1}^{a} (\underline{1})  (Q) σ_{1}^{a} ˙⊑ σ′_{2}  (Q) σ′_{2} ≡ σ_{2}  (Q) σ_{1} ≡ σ_{1}^{b}  (Q) σ_{1}^{b} ˙⊏ −ᾱ σ′_{3} \atop (Q) σ′_{3} ≡ σ_{3}}

Let σ′_{1} be nf(σ_{1}). By Property 1.5.6.iv (page 51), σ′_{1} is in normal form and by Property 1.5.6.i (page 51), (Q) σ′_{1} ≡ σ_{1} holds. Besides, by Property 1.5.11.i (page 54) and (1), σ′_{1} ≈ nf(σ_{1}^{a}) holds. By Property 2.6.3.i (page 86), there exists σ′′_{2} such that (Q) σ′′_{2} ≡ σ′_{2} and (Q) σ′_{1} ˙⊑ σ′′_{2}. Similarly, there exists σ′′_{3} such that (Q) σ′′_{3} ≡ σ′_{3} and (Q) σ′_{1} ˙⊏ −ᾱ σ′′_{3}. Hence, we have

(Q) σ_{1} ≡ σ′_{1}  (Q) σ′_{1} ˙⊑ σ′′_{2} (\underline{2})  (Q) σ′_{1} ˙⊏ −ᾱ σ′′_{3}  (Q) σ′′_{2} ≡ σ_{2}  (Q) σ′′_{3} ≡ σ_{3}

We have three rules to derive (2):

∘ Case C-Strict: Then (Q) σ′_{1} ˙⊏ σ′′_{2} holds. By Property 2.8.1.iii, there exists σ_{4} such that (Q) σ′′_{3} ˙⊏ σ_{4} and (Q) σ′′_{2} ˙⊏ −ᾱ σ_{4}. Hence, (Q) σ_{3} (≡ ˙⊑) σ_{4} and (Q) σ_{2} (≡ ˙⊏ −^{∅}) σ_{4} hold, which is the expected result.

∘ Case C-Abstract-F: Then by Property 2.8.1.iv, there exists σ_{4} such that (Q) σ′′_{2} ˙⊏ −ᾱ σ_{4} and (Q) σ′′_{3} ˙⊑ σ_{4}. Hence, we get (Q) σ_{2} (≡ ˙⊏ −^{∅}) σ_{4} and (Q) σ_{3} (≡ ˙⊑) σ_{4}, which is the expected result.

∘ Case C-Abstract-R: then, (Q) σ_{1} ⊏ − σ_{2} and (Q) σ_{1} ⊏ − σ_{3}, thus we conclude directly by Lemma 2.8.2.

Lemma 2.8.4 (Diamond Lemma) If Q is unconstrained, (Q) σ_{1} ⊑ σ_{2} and (Q) σ_{1} ⊏ − σ_{3} hold, then there exist σ_{4} such that (Q) σ_{2} ⊏ − σ_{4} and (Q) σ_{3} ⊑ σ_{4} hold.

\underline{Proof}: By Property 2.6.2.i (page 85), the relation ⊏ − is equivalent to (≡ ˙⊏ −^{∅})^{∗} and the relation ⊑ is equivalent to (≡ ˙⊑)^{∗}. Lemma 2.8.3 states the strong confluence of (≡ ˙⊏ −^{∅}) and (≡ ˙⊑), hence, there exist σ_{4} such that (Q) σ_{2} (≡ ˙⊏ −^{∅})^{∗} σ_{4} and (Q) σ_{3} (≡ ˙⊑) σ_{4}. By Properties 2.6.2.i (page 85) and 2.6.2.ii (page 85), this amounts to writing (Q) σ_{2} ⊏ − σ_{4} and (Q) σ_{3} ⊑ σ_{4}.

The diamond lemma is stated under an unconstrained prefix. This restriction is mandatory, as shown by the following counter-example. Take

σ_{1} =^{△} ∀ (α) α → α  Q =^{△} (β = σ_{1})  σ_{2} =^{△} int → int  σ_{3} =^{△} α

Graphically, this gives

\begin{matrix}∀ (α) α → α & int → int \\ α & ? \end{matrix}  ⊏ − ⊑ ⊏ − ⊑

It is impossible to find any suitable σ_{4} which closes the diagram. Indeed, the only instance of α are types equivalent to α, which cannot be abstractions of int → int.

Chapter 3

Relations between prefixes

Prefixes play a crucial role in MLF. Whereas the solutions to a unification problem are substitutions in ML, that is, mappings from type variables to monotypes, in MLF the solutions to a unification problem are prefixes, that is, mappings from type variables to types (possibly polytypes). Hence, prefixes can be seen as a generalization of the notion of substitutions to polytypes.

In Section 3.1, we show how a prefix can express a monotype substitution, just as in ML. A substitution θ_{1} is said more general than a substitution θ_{2} when there exists θ such that θ_{2} = θ ∘ θ_{1}. Conversely, we can say that θ_{2} is an instance of θ_{1}. We expect a similar instance relation on prefixes in MLF. More precisely, rules R-Context-Rigid and R-Context-Flexible show that two types ∀ (Q) σ and ∀ (Q′) σ with the same suffix can be in an instance relation, for any suffix σ. This suggests a notion of inequality between prefixes alone. However, because prefixes are “open” this relation must be defined relative to a set of variables that lists (a superset of) the free type variables of σ, called an interface and written with letter I. Prefix relations are defined in Section 3.2. Then we state a few results about prefixes and prefix instance. The main result of this chapter is Lemma 3.6.4, which implies that if (Q) σ_{1} ⊑ σ_{2} (\underline{1}) holds and Q′ is an instance of Q, then (Q′) σ_{1} ⊑ σ_{2} (\underline{2}) also holds. Such a result is used for showing the soundness of the unification algorithm. Indeed, it shows that if an instance relation (1) holds under a prefix Q, then it also holds (2) under the instantiation of its prefix.

3.1 Substitutions

A monotype prefix is a prefix whose bounds are all in T . For example (α_{1} = τ_{1}, … α_{n} = τ_{n}) is a monotype prefix, which embeds the substitution [τ_{1}/α_{1}] ∘ … ∘ [τ_{n}/α_{n}] within type expressions^{1}. Conversely, given an idempotent substitution θ, we write \underline{θ} for the corresponding monotype prefix. More precisely, \underline{θ} is the prefix (α=θ(α))_{α∈dom(θ)}. Note that since θ is idempotent, \underline{θ} is automatically a well-formed prefix. As expected, we have (Q) ∀ (\underline{θ}) σ ≡ θ(σ) and (Q\underline{θ}) σ ≡ θ(σ) (the former by Rule Eq-Mono^{⋆} and the latter by iteration of Rule Eq-Mono). The following rule is derivable using R-Context-R and Eq-Mono^{⋆}:

Pr-Subst^{⋆} ; \frac{(Q\underline{θ}) σ_{1} ♢ σ_{2}}{(Q) θ(σ_{1}) ♢ θ(σ_{2})}

Note also that the substitution extracted from \underline{θ}, that is ˆ \underline{θ}, is equal to θ.

In Section 1.3.4 we defined the application of a substitution θ to a prefix Q. In the particular case where Q is itself a substitution \underline{θ′}, we may wonder what is θ(Q). The answer is expressed in Property 3.1.1.i below. The case where θ is a renaming ϕ corresponds to Property 3.1.1.ii. Finally, Property 3.1.1.iii gives the substitution extracted from θ(Q).

Properties 3.1.1 If we have dom(θ′) # dom(θ) ∪ codom(θ), then the following properties hold:

i) The prefix θ(\underline{θ′}) is a monotype prefix corresponding to the substitution θ ∘ θ′ restricted to dom(θ′).

ii) The prefix ϕ(\underline{θ′}) is a monotype prefix corresponding to the substitution ϕ ∘ θ′ ∘ ϕ^{¬}. iii) For any prefix Q and renaming ϕ on dom(Q), we have { \atop ϕ(Q)} = ϕ ∘ Q̂ ∘ ϕ^{¬}.

\underline{Proof}: \underline{Property i}: By construction, θ(\underline{θ′}) is a monotype prefix. The domain of θ(\underline{θ′}) is by definition dom(\underline{θ′}), that is, dom(θ′). Let α be in dom(θ′). By definition, θ(\underline{θ′})(α) is θ(θ′(α)), that is, θ ∘ θ′(α). Hence, θ(\underline{θ′}) and θ ∘ θ′ are equal on dom(θ′).

\underline{Property ii}: By definition, ϕ(\underline{θ′}) is a monotype prefix whose associated substitution θ′′ is defined as follows: α ∈ dom(θ′′) if and only if there exists β ∈ dom(θ′) such that ϕ(β) = α; then θ′′(α) is ϕ(θ′(β)) (\underline{1}). Given any α, we have ϕ ∘ θ′ ∘ ϕ^{¬}(α) = ϕ ∘ θ′(β), where α is ϕ(β). If α ∈ dom(θ′′), then ϕ ∘ θ′(β) = θ′′(α) by (1). Otherwise, θ′′(α) is α and β ∉ dom(θ′). Hence, θ′(β) = β, thus ϕ ∘ θ′(β) = ϕ(β) = α. In both cases, we have ϕ ∘ θ′ ∘ ϕ^{¬}(α) = θ′′(α). This holds for all α, therefore θ′′ is ϕ ∘ θ′ ∘ ϕ^{¬}.

\underline{Property iii}: By definition, { \atop ϕ(Q)} is ϕ(Q̂). We get the expected result by Property ii.

1Actually, prefixes are slightly more precise than substitutions because they are kept as a sequence of elementary substitutions rather than just their composition.

3.2 Prefix instance

As explained above, we define an instance relation on prefixes, relative to a set of type variables I, called an interface. For example, we expect the prefixes (β ≥ ⊥, α = β → β) and (γ ≥ ⊥, α = γ → γ) to be equivalent under the interface {α}, but not under the interface {α, β} or {α, γ}. To ease the presentation, we introduce a new notation: We write Σ_{I} for the set of types whose unbound variables are in I.

Definition 3.2.1 (Prefix instance) Let Q and Q′ be closed well-formed prefixes, and I be a set of variables such that I ⊆ dom(Q) ∩ dom(Q′) holds. A prefix Q′ is an instance of a prefix Q under the interface I, and we write Q ⊑^{I} Q′, if and only if ∀ (Q) σ ⊑ ∀ (Q′) σ holds for all types σ in Σ_{I}. We omit I in the notation when it is equal to dom(Q). We define Q ≡^{I} Q′ and Q ⊏ −^{I} Q′ similarly.

Let Q be a well-formed closed prefix. Then ∅ ≡ Q holds, which means by notation ∅ ≡^{∅} Q. Conversely, Q ≡^{I} ∅ holds if and only if I is empty. In particular, Q ≡ ∅ does not hold if Q is not empty. Although the relation ≡^{I} is symmetric, we see that the relation ≡ (where the interface is left implicit) is not.

Example 3.2.8 For any σ, we can derive (∅) ∀ (α ≥ ⊥) σ ⊑ ∀ (β) ∀ (α ≥ β → β) σ by Eq-Free, I-Nil, and context rules. More generally, if we have Q and Q′ unconstrained, dom(θ) ⊆ dom(Q), and codom(θ) ⊆ dom(Q′), then we have Q ⊑ Q′\underline{θ}. This covers the instantiation of substitutions in ML, where free variables have the implicit bound ⊥, just as in Q (which is unconstrained), and where free variables can be substituted by any monotype.

Properties 3.2.2 i) We have Q_{1} ≡^{I} Q_{2} iff Q_{1} ⊑^{I} Q_{2} and Q_{2} ⊑^{I} Q_{1}. ii) If Q_{1} ≈ Q_{2}, then Q_{1} ≡ Q_{2}.

It is a direct consequence of Property 2.7.7.i (page 96). See Appendix (page 265).

Assume we have (Q) σ ⊑ α and σ is not a type variable. Then σ is instantiated to a type variable bound in the prefix. The only way to do so is by either Rule A-Hyp or Rule I-Hyp. This means that σ can be instantiated into the bound of α. This is expressed formally by the following properties.

Properties 3.2.3 i) If we have (Q) σ ⊏ − α and σ ∉ V, then (Q) σ ⊏ − Q(α) holds. ii) If we have (Q) σ ⊑ α and σ ∉ V, then (Q) σ ⊑ Q(α) holds. iii) For all Q and α, (Q) Q(α) ⊑ α holds.

See proof in the Appendix (page 266).

3.3 Domains of prefixes

As seen in Section 1.2, if Q is the prefix (α_{1} ⋄_{1} σ_{1}, … α_{n} ⋄_{n} σ_{n}), then its domain dom(Q) is the set {α_{1}, … α_{n}}. We need to capture the notion of useful domain of a prefix Q.

Definition 3.3.1 If I is a set of type variables, the domain of Q useful for I, written dom(Q/I), is defined as follows:

α ∈ dom(Q/I) if and only if Q = (Q_{1}, α ⋄ σ, Q_{2}) and α ∈ ftv(∀ (Q_{2}) ∇_{I})

We also write dom(Q/σ) instead of dom(Q/ ftv(σ)) and similarly dom(Q/σ_{1}, σ_{2}) instead of dom(Q/ ftv(σ_{1}) ∪ ftv(σ_{2})).

Intuitively, dom(Q/σ) is the domain of Q which is useful for σ. For example, if Q′ corresponds to Q, where all bindings not in dom(Q/σ) have been removed, then we have ∀ (Q) σ ≡ ∀ (Q′) σ by Eq-Free.

Properties 3.3.2 i) We have dom(Q/I ∪ J) = dom(Q/I) ∪ dom(Q/J). ii) If Q ≈ Q′ holds, and ᾱ ⊆ dom(Q), then dom(Q/ᾱ) = dom(Q′/ᾱ).

See proof in the Appendix (page 268).

The notion of useful domain of a prefix can be viewed as an extension of the notion of free variables. Indeed, in ML, all free variables have the bound ⊥, which means that the implicit prefix Q is unconstrained. Then the domain of Q useful for a polytype σ, i.e. dom(Q/σ), is exactly the set of free variables of σ. In MLF, however, a variable β can be in dom(Q/σ) directly or indirectly. For a direct example, take ∀ (α ≥ ⊥) α → β for σ, and (β ≥ ⊥) for Q. For an indirect example, take ∀ (α ≥ ⊥) α → γ for σ, and (β ≥ ⊥, γ ≥ ∀ (δ) δ → β) for Q. In the indirect example, β is not free in σ, but γ is free in σ and β is free in the bound of γ. We see that β is “indirectly” free in σ via the prefix Q. This is captured by the notion of useful domain of the prefix, which is therefore an extension of the notion of free variables.

3.4 Rules for prefix equivalence, abstraction, and instance

Prefix instance was defined in Definition 3.2.1. Below, we give a syntactic characterization. Inference rules defining prefix equivalence, prefix abstraction, and prefix instance are given in figures 3.1, 3.2, and 3.3. As in Section 1.7, we use the symbol ♢_{ℓ} as a meta-variable standing for ≡_{ℓ}, ⊏ −_{ℓ}, or ⊑_{ℓ}. The notation Q ♢_{ℓ}^{I} Q′ implicitly requires Q and Q′ to be closed well-formed prefixes such that I ⊆ dom(Q) ∩ dom(Q′).

Figure 3.1: Prefix equivalence

\begin{matrix}PE-Refl \\ Q ≡_{ℓ}^{I} Q \end{matrix} PE-Trans ; \frac{Q_{1} ≡_{ℓ}^{I} Q_{2}  Q_{2} ≡_{ℓ}^{I} Q_{3}}{Q_{1} ≡_{ℓ}^{I} Q_{3}}

PE-Free

\frac{α ∉ dom(Q) α ∉ I}{Q ≡_{ℓ}^{I} (Q, α ⋄ σ)}

PE-Mono \overline{(Q, α ≥ τ, Q_{0}) ≡_{ℓ}^{I} (Q, α = τ, Q_{0})} PE-Context-L

\frac{(Q) σ_{1} ≡ σ_{2}}{(Q, α ⋄ σ_{1}, Q_{0}) ≡_{ℓ}^{I} (Q, α ⋄ σ_{2}, Q_{0})}

PE-Swap ; \frac{σ ∉ T}{(Q, α_{1} ⋄ σ, α_{2} = α_{1}, Q_{0}) ≡_{ℓ}^{I} (Q, α_{2} ⋄ σ, α_{1} = α_{2}, Q_{0})}

PE-Comm

\frac{α_{1} ∉ ftv(σ_{2}) α_{2} ∉ ftv(σ_{1})}{(Q, α_{1} ⋄_{1} σ_{1}, α_{2} ⋄_{2} σ_{2}, Q_{0}) ≡_{ℓ}^{I} (Q, α_{2} ⋄_{2} σ_{2}, α_{1} ⋄_{1} σ_{1}, Q_{0})}

Figure 3.2: Prefix Abstraction

PA-Equiv ; \frac{Q_{1} ≡_{ℓ}^{I} Q_{2}}{Q_{1} ⊏ −_{ℓ}^{I} Q_{2}}  PA-Trans ; \frac{\begin{matrix}Q_{1} ⊏ −_{ℓ}^{I} Q_{2} \\ Q_{2} ⊏ −_{ℓ}^{I} Q_{3} \end{matrix}}{Q_{1} ⊏ −_{ℓ}^{I} Q_{3}}

PA-Context-L

\frac{(Q) σ_{1} ⊏ − σ_{2}}{(Q, α = σ_{1}, Q_{0}) ⊏ −_{ℓ}^{I} (Q, α = σ_{2}, Q_{0})}

Unsurprisingly, these rules are similar to the rules defining equivalence, abstraction, and instantiation of types, except for Rule PE-Swap, which corresponds to (implicit) α-conversion between types.

We wish to show the equivalence between the relation ⊑_{ℓ}^{I} and the relation ⊑^{I}. To begin with, we check that ⊑_{ℓ}^{I} is included in ⊑^{I}. Lemma 3.4.1 If Q ♢_{ℓ}^{I} Q′ holds, then Q ♢^{I} Q′.

\underline{Proof}: We show by induction on the derivation of Q ♢_{ℓ}^{I} Q′ that for any σ such that ftv(σ) ⊆ I, we have ∀ (Q) σ ♢ ∀ (Q′) σ. All cases are easy.

Figure 3.3: Prefix instance

PI-Abstract \frac{Q_{1} ⊏ −_{ℓ}^{I} Q_{2}}{Q_{1} ⊑_{ℓ}^{I} Q_{2}}  PI-Trans ; \frac{\begin{matrix}Q_{1} ⊑_{ℓ}^{I} Q_{2} \\ Q_{2} ⊑_{ℓ}^{I} Q_{3} \end{matrix}}{Q_{1} ⊑_{ℓ}^{I} Q_{3}}  PI-Rigid ; \overline{(Q, α ≥ σ_{1}, Q_{0}) ⊑_{ℓ}^{I} (Q, α = σ_{1}, Q_{0})}

PI-Context-L

\frac{(Q) σ_{1} ⊑ σ_{2}}{(Q, α ≥ σ_{1}, Q_{0}) ⊑_{ℓ}^{I} (Q, α ≥ σ_{2}, Q_{0})}

The following rule is derivable by PE-Context-L and Eq-Mono:

PE-Mono^{⋆} ; \frac{(Q) σ ≡ τ}{(Q, α = σ, Q′) ≡_{ℓ} (Q, α = σ, Q′[τ/α])}

We now prove some useful properties about prefix relations. For instance, Property i below shows that the interface of a relation can always be shrinked. Notice also that Q_{1} ♢_{ℓ}^{∅} Q_{2} always holds, for any prefixes Q_{1} and Q_{2}. Property ii simply states that derivations are stable under renaming. Property iii shows that it is always possible to append a non-interfering prefix Q to both sides of a derivation of Q_{1} ♢_{ℓ}^{I} Q_{2}. Property iv shows that the equivalence between a prefix a renaming of this prefix can be derived. Property v states if a sequence of binders is duplicated in a prefix (up to renaming), both sequences can be merged by instantiation.

Properties 3.4.2 i) If Q_{1} ♢_{ℓ}^{I} Q_{2} and J ⊆ I hold, then we have Q_{1} ♢_{ℓ}^{J} Q_{2}. ii) If ϕ is a renaming of dom(Q) ∪ dom(Q′), and if there is a derivation of Q ♢_{ℓ}^{I} Q′

of size n, then we have a derivation of ϕ(Q) ♢_{ℓ}^{ϕ(I)} ϕ(Q′) of size n. iii) If Q_{1} ♢_{ℓ}^{I} Q_{2}, Q # Q_{1}, Q # Q_{2}, and utv(Q) ⊆ I, then Q_{1}Q ♢_{ℓ}^{I∪dom(Q)} Q_{2}Q. iv) If ϕ is a renaming of dom(Q) and Q a closed well-formed prefix, then we have

Q ≡_{ℓ} ϕ(Q)\underline{ϕ}.

v) If ϕ is a renaming of domain dom(Q) such that Q_{1}Qϕ(Q)Q_{2} is a well-formed closed prefix, then we can derive Q_{1}Qϕ(Q)Q_{2} ⊑_{ℓ} Q_{1}Q\underline{ϕ^{¬}}Q_{2}.

See proof in the Appendix (page 268).

As explained in the introduction of this chapter, the main result is Lemma 3.6.4 (page 114). A less general case is stated by the next lemma. Namely, if two types σ

3.4 Rules for prefix equivalence, abstraction, and instance  107

and σ′ are equivalent under a prefix Q, and if Q′ is an instance of Q, then we expect σ and σ′ to be equivalent under Q′ too. This statement is refined by providing the interface I of the instance relation, as well as the set of free variables of σ and σ′. We recall that Σ_{I} is the set of types whose unbound variables are in I.

Lemma 3.4.3 If we have Q_{1} ♢_{ℓ}^{I} Q_{2}, then for all σ and σ′ in Σ_{I} such that (Q_{1}) σ ≡ σ′ holds, we have (Q_{2}) σ ≡ σ′.

\underline{Proof}: By hypothesis, we have Q_{1} ♢_{ℓ}^{I} Q_{2} (\underline{1}), (Q_{1}) σ ≡ σ′ (\underline{2}), and ftv(σ) ∪ ftv(σ′) ⊆ I (\underline{3}). We have to show that (Q_{2}) σ ≡ σ′ (\underline{4}) holds. We note that it suffices to show that Q̂_{1} and Q̂_{2} are equal on I (\underline{5}). Indeed, Corollary 1.5.10 and (2) imply Q̂_{1}(σ) ≡ Q̂_{1}(σ′) (\underline{6}). Additionally, (5), and (3) give Q̂_{1}(σ) = Q̂_{2}(σ) (\underline{7}) and Q̂_{1}(σ′) = Q̂_{2}(σ′) (\underline{8}). By (6), (7), and (8), we get Q̂_{2}(σ) ≡ Q̂_{2}(σ′), which implies (4) thanks to Corollary 1.5.10. We prove either (4) or (5) according to which one is easier. The proof is by induction on the derivation of (1).

∘ Case PE-Refl: Immediate.

∘ Case PE-Trans, PA-Trans, PI-Trans, PA-Equiv, and PI-Abstract: By induction hypothesis.

∘ Case PE-Comm and PI-Rigid: Q̂_{1} is Q̂_{2}, thus (5) holds.

∘ Case PE-Free: We have Q_{2} = (Q_{1}, α⋄σ). Hence, Q̂_{2} = Q̂_{1}∘θ, where dom(θ) ⊆ {α}. By hypothesis, α ∉ I. Hence, Q̂_{2} and Q̂_{1} are equal on I, and we have shown (5).

∘ Case PE-Mono: By definition, Q̂_{1} and Q̂_{2} are equal, thus we have (5).

∘ Case PE-Context-L, PA-Context-L and PI-Context-L: By hypothesis, we have Q_{1} = (Q_{a}, α ⋄ σ_{1}, Q_{b}) and Q_{2} = (Q_{a}, α ⋄ σ_{2}, Q_{b}). Besides, (Q_{a}) σ_{1} ♢ σ_{2} (\underline{9}) holds. Let θ_{a} be Q̂_{a} and θ_{b} be Q̂_{b}. If α ∉ dom(Q̂_{1}), then, Q̂_{1} is θ_{a} ∘θ_{b}, and Q̂_{2} is θ_{a} ∘θ∘θ_{b}, where dom(θ) ⊆ \{α\}. Hence, Q̂_{2} is θ_{a} ∘ θ ∘ θ_{a} ∘ θ_{b}, that is, θ_{a} ∘ θ ∘ Q̂_{1} (\underline{10}). By (6), (10), and Property 1.5.11.v, we get θ_{a} ∘θ ∘Q̂_{1}(σ) ≡ θ_{a} ∘θ ∘Q̂_{1}(σ′), that is, Q̂_{2}(σ) ≡ Q̂_{2}(σ′) by (10). This implies (4) by Corollary 1.5.10. Otherwise, α ∈ dom(Q̂_{1}), which means that σ_{1} ∈ T . By Lemma 2.1.6 and (9), we get σ_{2} ∈ T and (Q_{a}) σ_{1} ≡ σ_{2}. By Lemmas 1.5.9 and 1.5.6.iii (page 51), we get θ_{a} ∘ { \atop (α ⋄ σ_{1})} = θ_{a} ∘ { \atop (α ⋄ σ_{2})}, thus Q̂_{1} = Q̂_{2} holds, that is (5).

∘ Case PE-Swap: We have Q_{1} = (Q_{a}, α_{1} ⋄ σ, α_{2} = α_{1}, Q_{b}) (\underline{11}) and Q_{2} = (Q_{a}, α_{2} ⋄

σ, α_{1} = α_{2}, Q_{b}). Let θ_{a} be Q̂_{a} and θ_{b} be Q̂_{b}. Let θ_{1} be { \atop (α_{1} ⋄ σ)} and θ_{2} be { \atop (α_{2} ⋄ σ)}. Note

that the substitution [α_{2}/α_{1}] ∘ θ_{1} ∘ [α_{1}/α_{2}] is equal to the substitution θ_{2} ∘ [α_{2}/α_{1}] (\underline{12}) (consider the images of α_{1} and α_{2} for the two cases σ ∈ T and σ ∉ T ). Then using these notations, Q̂_{1} is θ_{a} ∘ θ_{1} ∘ [α_{1}/α_{2}] ∘ θ_{b} (\underline{13}) and Q̂_{2} is θ_{a} ∘ θ_{2} ∘ [α_{2}/α_{1}] ∘ θ_{b} (\underline{14}). By (6) and (13), we have θ_{a} ∘ θ_{1} ∘ [α_{1}/α_{2}] ∘ θ_{b}(σ) ≡ θ_{a} ∘ θ_{1} ∘ [α_{1}/α_{2}] ∘ θ_{b}(σ′). Composing by [α_{2}/α_{1}] (Property 1.5.11.v (page 54)), we get [α_{2}/α_{1}] ∘ θ_{a} ∘ θ_{1} ∘ [α_{1}/α_{2}] ∘ θ_{b}(σ) ≡ [α_{2}/α_{1}] ∘ θ_{a} ∘ θ_{1} ∘ [α_{1}/α_{2}] ∘ θ_{b}(σ′) (\underline{15}). By well-formedness of (11), we have α_{1} ∉ dom(θ_{a}) and α_{2} ∉ codom(θ_{a}). Hence, θ_{a} and [α_{2}/α_{1}] commute: from (15), we get θ_{a} ∘ [α_{2}/α_{1}] ∘ θ_{1} ∘ [α_{1}/α_{2}] ∘ θ_{b}(σ) ≡ θ_{a} ∘ [α_{2}/α_{1}] ∘ θ_{1} ∘ [α_{1}/α_{2}] ∘ θ_{b}(σ′). By (12), we get θ_{a} ∘ θ_{2} ∘ [α_{2}/α_{1}] ∘ θ_{b}(σ) ≡ θ_{a} ∘ θ_{2} ∘ [α_{2}/α_{1}] ∘ θ_{b}(σ′). By (14), this is Q̂_{2}(σ) ≡ Q̂_{2}(σ′). This implies (4) by Corollary 1.5.10.

The instance relation on types ⊑ and the instance relation on prefixes are closely related. In particular, if Q_{1} ⊑^{I} Q_{2} holds, and τ ∈ Σ_{I}, we have by definition ∀ (Q_{1}) τ ⊑ ∀ (Q_{2}) τ (\underline{1}). Conversely, if (1) holds, we expect the prefix Q_{2} to be an instance of the prefix Q_{1}, under the interface ftv(τ), that is Q_{1} ⊑^{ftv(τ)} Q_{2}. Actually, we show in the next lemma that Q_{1} ⊑_{ℓ}^{ftv(τ)} Q_{2} (\underline{2}) holds, which implies Q_{1} ⊑^{ftv(τ)} Q_{2} (\underline{3}) by Lemma 3.4.1. Showing (2) instead of (3) is more general, and is a key result used to show the equality between ⊑_{ℓ}^{I} and ⊑^{I}. In summary, we show in Lemma 3.4.4 that (1) implies (2). The statement of the lemma is, however, a bit more involved.

First, the main hypothesis (Q) σ_{1} ♢ σ_{2} is more general than (1). Additionally, the constructed form of σ_{1} is ∀ (Q_{1}) τ_{1}, which discards the case where nf(σ_{1}) is ⊥. Similarly, the constructed form of σ_{2} is ∀ (Q_{2}) τ_{2}.

The main conclusion is QQ_{1} ♢_{ℓ}^{dom(Q)∪I} QQ_{2}\underline{θ} (\underline{4}), which corresponds to (2) after adding the prefix Q and a substitution θ. The role of the substitution θ is to map variables of Q_{1} to variables of Q_{2}. Indeed, by renaming, ∀ (Q_{1}) τ_{1} and ∀ (Q_{2}) τ_{2} might use different variable names; we use the substitution θ to map names from ∀ (Q_{1}) τ_{1} to names of ∀ (Q_{2}) τ_{2}. The correctness of this mapping could be intuitively expressed by the equality θ(τ_{1}) = τ_{2} (\underline{5}). Actually, (5) does not always hold, because the prefixes Q and Q_{2} must be taken into account. Lemma 3.4.4 is more precise and provides the correct result, that is, (QQ_{2}) θ(τ_{1}) ≡ τ_{2} (\underline{6}). Note, though, that (5) implies (6). What is more, θ is a substitution, but is not necessarily a renaming. For example, we have (α) ∀ (β = α → α) β → β ≡ (α → α) → (α → α) by Eq-Mono. In such a case, the left-hand prefix is (β = α → α), and the right-hand prefix is empty. Then θ is the substitution [α → α/β]; it is not a renaming.

The lemma considers the constructed forms of σ_{1} and σ_{2} (see page 55), in order to avoid degenerate cases. A type such as σ_{1} =^{△} ∀ (α = ∀ (Q′_{1}) τ_{1}) α hides its structure in the bound of α. By Eq-Var, we have σ_{1} ≡ ∀ (Q′_{1}) τ_{1} (\underline{7}). As mentioned above, the substitution θ is used to link variables of dom(Q_{2}) to variables of dom(Q_{1}). If we do not take the constructed form of σ_{1}, Q_{1} would be a single binding (α = ∀ (Q′_{1}) τ_{1}) (\underline{8}). However, because of the equivalence (7), the meaningful bindings are those of Q′_{1}, but not only (8). In other words, it is not possible to map variables of dom(Q_{2}) to α only, but it is possible to map them to dom(Q′_{1}). Taking the constructed form ensures that the considered prefix is always the “meaningful” prefix.

Moreover, Lemma 3.4.4 assumes that we have nf(σ_{2}) ∉ ϑ or Q(nf(σ_{2})) ∈ T . This assumption is also necessary to discard degenerate cases. For instance, let σ be ∀ (Q) τ. We have (α ≥ σ) σ ⊑ α by I-Hyp. Without the assumption above, it could be given as input to the lemma. However, we cannot find a meaningful relation between the prefix (α ≥ σ, Q) and the prefix (α ≥ σ), as required by (4). In such a case, we cannot express (6) either.

Lemma 3.4.4 We assume we have nf(σ_{2}) ∉ ϑ or Q(nf(σ_{2})) ∈ T . We assume cf(σ_{1}) and cf(σ_{2}) have well-formed prefixes. If we have (Q) σ_{1} ♢ σ_{2} and nf(σ_{1}) ≠ ⊥, cf(σ_{1}) is ∀ (Q_{1}) τ_{1}, and Q_{1} # Q, then there exist an α-conversion ∀ (Q_{2}) τ_{2} of cf(σ_{2}) and a substitution θ such that the following facts hold, writing I for dom(Q_{1}/τ_{1}).

(QQ_{2}) θ(τ_{1}) ≡ τ_{2}  dom(θ) ⊆ I  θ(I) ⊆ dom(Q) ∪ dom(Q_{2}/τ_{2})
QQ_{1} ♢_{ℓ}^{dom(Q)∪I} QQ_{2}\underline{θ}

The proof is by induction on the derivation of (Q) σ_{1} ♢ σ_{2}. See details in the Appendix (page 270).

As explained above, Lemma 3.4.4 is a main result for proving the equivalence between the relations ⊑^{I} and ⊑_{ℓ}^{I}. Actually, a first corollary of Lemma 3.4.4 is Property 3.4.5.i below. Then the expected equivalence (Property 3.4.5.ii) is a direct consequence.

Properties 3.4.5 We have the following properties:

i) If (∅) ∀ (Q_{1}) ∇_{I} ♢ ∀ (Q_{2}) ∇_{I}, then Q_{1} ♢_{ℓ}^{I} Q_{2}. ii) We have Q_{1} ♢^{I} Q_{2} iff Q_{1} ♢_{ℓ}^{I} Q_{2}.

\underline{Proof}: \underline{Property i}: Assume that we have ∀ (Q_{1}) ∇_{I} ♢ ∀ (Q_{2}) ∇_{I}. By Lemma 3.4.4, there exists a renaming ϕ and a substitution θ such that the following hold:

(ϕ(Q_{2})) θ(∇_{I}) ≡ ϕ(∇_{I}) (\underline{1})  J =^{△} dom(Q_{1}/I) (\underline{2})  dom(θ) ⊆ J
θ(J) ⊆ dom(ϕ(Q_{2})/ϕ(I)) Q_{1} ♢_{ℓ}^{J} ϕ(Q_{2})\underline{θ} (\underline{3})

We have I ⊆ J (\underline{4}) from (2). Hence, we have Q_{1} ♢_{ℓ}^{I} ϕ(Q_{2})\underline{θ} (\underline{5}) by Property 3.4.2.i, (4) and (3). By Property 1.5.11.vii (page 54) and (1), we have { \atop ϕ(Q_{2})}∘θ(∇_{I}) = { \atop ϕ(Q_{2})}∘ϕ(∇_{I}). This implies that { \atop ϕ(Q_{2})} ∘ θ and { \atop ϕ(Q_{2})} ∘ ϕ are the same substitution on I. Hence,

ϕ(Q_{2})\underline{({ \atop ϕ(Q_{2})} ∘ θ)} ≡_{ℓ}^{I} ϕ(Q_{2})\underline{({ \atop ϕ(Q_{2})} ∘ ϕ)} (\underline{6}) holds by PE-Free. Moreover, ϕ(Q_{2}){ \atop ϕ(Q_{2})} ∘

ϕ ≡_{ℓ}^{I} ϕ(Q_{2})\underline{ϕ} (\underline{7}) holds by PE-Mono^{⋆}. Besides, Q_{2} ≡_{ℓ} ϕ(Q_{2})\underline{ϕ} (\underline{8}) holds by Property 3.4.2.iv. Additionally, we have ϕ(Q_{2})\underline{θ} ≡_{ℓ}^{I} ϕ(Q_{2})\underline{{ \atop ϕ(Q_{2})} ∘ θ} (\underline{9}) by PE-Mono^{⋆}. By (5), (9), (6), (7), (8), and PE-Trans, we get Q_{1} ♢_{ℓ}^{I} Q_{2}. This is the expected result. \underline{Property ii}: \underline{Directly,} we have Q_{1} ♢^{I} Q_{2}. Hence, ∀ (Q_{1}) ∇_{I} ♢ ∀ (Q_{2}) ∇_{I} holds by definition. Hence by Property i, Q_{1} ♢_{ℓ}^{I} Q_{2} holds. The \underline{converse} is from Lemma 3.4.1.

We have shown that ♢^{I} and ♢_{ℓ}^{I} are the same relation. In the rest of the document, we will use only the symbols ≡^{I}, ⊏ −^{I}, and ⊑^{I} to make the presentation lighter.

ML types as a particular case

The next lemma shows that under an unconstrained prefix the instance relation corresponds to the instance relation of ML (in ML free variables are implicitly unconstrained in the prefix). As explained in Section 1.1, ML types can be injected in MLF in the form ∀ (α_{1} ≥ ⊥) … ∀ (α_{n} ≥ ⊥) τ. Hence, in the framework of MLF, we call such types ML types:

Definition 3.4.6 Polytypes of the form ∀ (Q) τ where Q is unconstrained are called ML types.

Lemma 3.4.7 We assume Q unconstrained and that σ_{1} and σ_{2} are ML types, closed under Q. Then (Q) σ_{1} ⊑ σ_{2} holds iff σ_{2} is an instance of σ_{1} in ML.

See proof in the Appendix (page 274).

Graphs representing ML types may only have binding arrows from nodes labelled ⊥ to the top-level node. Besides, these arrows must be flexible. Here is an example of an ML type:

→ → ⊥  ⊥

This graph represents the type ∀ (α, β) (α → β) → α → β, that is, the type of λ(f) λ(x) f x, which we also call app. More precisely, we have represented ∀ (α, β) ∀ (γ = α → β) γ → γ, which is equivalent. The middle node represents γ, the left-hand node is α and the right-hand node is β. The only bindings are from α and β to the top-level node.

Here is the type of a common function in ML:

→  → →  →  → ⊥  ⊥ ⊥

We have represented the type ∀ (α, β, γ) (α → β) → (β → γ) → α → γ, which is the type of the (reversed) composition function λ(f) λ(g) λ(x) g (f x). (The type of the normal composition function gives a more intricate graph.)

3.5 Splitting prefixes

In this section we present the split algorithm, which takes a prefix Q and a set of variables ᾱ, and splits Q into two parts Q_{1} and Q_{2} such that the domain of Q_{1} is the domain of Q useful for ᾱ (see Definition 3.3.1). In order to show how the split algorithm is used, the following short story talks about generalization, which will be defined only in Chapter 5. This means that the following explanation is better understood by readers familiar with ML generalization, but should not frighten the others.

A short story of type generalization In ML, polymorphism is introduced by generalization. More precisely, if an expression a has type σ and if α is not free in the typing environment Γ, then the expression a can be given the type scheme ∀ (α) σ. This is possible for any type variable α not free in Γ, that is, if α and β are not free in Γ, a can be given the type ∀ (α) σ as well as ∀ (β) σ. As already mentioned in Section 1.2, the prefix in ML is implicit and unconstrained. Hence, generalizing a variable α consists mostly of taking α from the prefix and quantifying it in σ. The prefix before generalization is (Q, α), and the prefix after generalization is simply Q.

As for the type of a, it is σ before generalization, and ∀ (α) σ after. Note that in ML, bindings in the prefix are mutually independent, which implies that the prefixes (α, β) and (β, α) are equivalent.

In MLF, we follow the same idea for generalization: a binding is taken from the prefix and quantified in front of the type of the expression. Whereas bindings are unconstrained in ML, they are of the general form (α ⋄ σ) in MLF. Moreover, whereas bindings are mutually independent in ML, they can depend on each other in MLF. For instance, in the prefix Q = (α ≥ ⊥, β = ∀ (γ) γ → α), the binding for β depends on α because α is free in the bound of β. In ML, we could only have (α ≥ ⊥, β ≥ ⊥), which is equivalent to (β ≥ ⊥, α ≥ ⊥), as remarked above. In ML, if α is not free in Γ, we can generalize it. Similarly, if β is not free in Γ, we can generalize it. In MLF, however, things are not so direct. Under prefix Q, we can generalize β (if β is not free in Γ), but we cannot generalize α directly because α is needed in the prefix, namely in the bound of β. As a consequence, the only way to generalize α is first to generalize β (if possible), then to generalize α. As a conclusion, generalization in MLF must follow the dependencies of bindings. Therefore, when we wish to generalize as many variables as possible (according to a given typing environment Γ), we have to split the prefix Q in two parts. The first part contains all bindings of variables free in Γ, as well as bindings they depend on. The second part contains all remaining bindings, that is, type variables that do not appear in Γ, directly or indirectly. In this section, we describe this operation, the split algorithm. Note that, as mentioned above, splitting is trivial in ML since bindings do not depend on each other.

In the following definition, we write q ⟶^{1} (Q_{1}, Q_{2}) for the pair (Q_{1}q, Q_{2}) and q ⟶^{2} (Q_{1}, Q_{2}) for the pair (Q_{1}, Q_{2}q).

Definition 3.5.1 The split algorithm takes a closed prefix Q and a set ᾱ included in dom(Q) and returns a pair of prefixes, which we write Q↑ᾱ. It is defined inductively as follows:

∅↑ᾱ = (∅, ∅) (Q, α ⋄ σ)↑ᾱ = \{ \begin{matrix}(α ⋄ σ) ⟶^{1} Q↑(ᾱ − α) ∪ ftv(σ) & if α ∈ ᾱ \\ (α ⋄ σ) ⟶^{2} Q↑ᾱ & if α ∉ ᾱ \end{matrix}

It is obvious to check that this algorithm always terminates and never fails. The next lemma shows its correctness.

Lemma 3.5.2 If Q↑ᾱ is the pair (Q_{1}, Q_{2}), then we have (i) Q_{1}Q_{2} ≈ Q, (ii) ᾱ ⊆ dom(Q_{1}), and (iii) dom(Q_{1}/ᾱ) = dom(Q_{1}).

See proof in the Appendix (page 275).

3.6 Prefixes and Instantiation

This section gathers technical results that will be used mostly for unification. A main result is Lemma 3.6.4: it states that a judgment under a prefix Q still holds under all instances of Q. In ML, a substitution θ can be applied to a whole typing derivation. This can be viewed as instantiating all free type variables of the derivation. In particular, if σ_{2} is an instance of σ_{1} in ML, then θ(σ_{2}) is an instance of θ(σ_{1}). In MLF, we state a more general result: typing derivations are stated under a given prefix, and instantiating the whole derivation amounts to instantiating the prefix. Thus, if σ_{2} is an instance of σ_{1} under prefix Q, then σ_{2} must be an instance of σ_{1} under any instance of Q (including monotypes instances, which represent substitutions). Hence, Lemma 3.6.4 entails that typing judgments are stable under substitution.

The next property extends the interface of an instantiation. For example, it takes a derivation of Q ⊑^{I} Q′ as an input, and provides a derivation of Q ⊑^{J} Q′\underline{θ} as an output, with I ⊆ J. This result is used for showing the completeness of the unification algorithm (to be found in Chapter 4).

Lemma 3.6.1 Assume we have Q ♢^{I} Q′. Let J be dom(Q/I) and ϕ be a renaming of dom(Q′), disjoint from I. Then there exists a substitution θ such that Q ♢^{J} ϕ(Q′)\underline{θ} and dom(θ) ⊆ J − I hold.

\underline{Proof}: By Definition 3.2.1, we have ∀ (Q) ∇_{I} ♢ ∀ (Q′) ∇_{I}. Alpha-converting the righthand side with the renaming ϕ, and observing that ϕ is disjoint from I, we get ∀ (Q) ∇_{I} ♢ ∀ (ϕ(Q′)) ∇_{I}. Let J be dom(Q/I). By Lemma 3.4.4, there exists an alpha-conversion ∀ (Q′′) τ of ∀ (ϕ(Q′)) ∇_{I} (\underline{1}) and a substitution θ′ such that we have

(Q′′) θ′(∇_{I}) ≡ τ (\underline{2})  dom(θ′) ⊆ J  θ′(J) ⊆ dom(Q′′/τ)  Q ♢^{J} Q′′\underline{θ′} (\underline{3})

From (1), there exists a renaming ϕ′ such that Q′′ = ϕ′(ϕ(Q′)), that is, Q′′ = ϕ′ ∘ ϕ(Q′), and τ = ϕ′(∇_{I}) (\underline{4}). Let θ′′ be the substitution defined as ϕ′ on I and as θ′ elsewhere (\underline{5}). From (2) and (4), we get (Q′′) θ′(∇_{I}) ≡ ϕ′(∇_{I}), hence by Property 1.5.11.vii (page 54), we have Q̂′′ ∘ θ′(∇_{I}) = Q̂′′ ∘ ϕ′(∇_{I}), that is, Q̂′′ ∘ θ′ and Q̂′′ ∘ ϕ′ are equal on I (\underline{6}). Therefore, we have Q̂′′ ∘θ′ = Q̂′′ ∘θ′′ from (5) and (6). Then from (3), we get Q ♢^{J} Q′′\underline{θ′′} by PE-Mono^{⋆}. Hence, ∀ (Q) ∇_{J} ♢ ∀ (Q′′) θ′′(∇_{J}) (\underline{7}) holds by Definition 3.2.1 and Eq-Mono^{⋆}. Let θ be ϕ^{′¬} ∘ θ′′ restricted to J. We note that ∀ (ϕ(Q′)) θ(∇_{J}) is an alpha-conversion of ∀ (Q′′) θ′′(∇_{J}). Hence, ∀ (Q) ∇_{J} ♢ ∀ (ϕ(Q′)\underline{θ}) ∇_{J} holds from (7). By Property 3.4.5.i, we get Q ♢^{J} ϕ(Q′)\underline{θ}. Besides, dom(θ) ⊆ J and θ is invariant on I, thus dom(θ) ⊆ J − I. This is the expected result.

The next property is a variant: we also extend the interface of an instantiation Q ♢^{I} Q′, but the extended interface is the entire domain dom(Q) instead of dom(Q/I).

Lemma 3.6.2 If we have Q ♢^{I} Q′, then there exists a renaming ϕ on dom(Q′) disjoint from I, a prefix Q_{0}, a substitution θ and a prefix Q′_{0} such that we have

Q ♢ ϕ(Q′)Q_{0}  dom(Q_{0}) # I  ϕ(Q′)Q_{0} ≡^{I} Q′  Q_{0} = \underline{θ}Q′_{0}
dom(Q′_{0}) # dom(Q/I)

See proof in the Appendix (page 275).

As claimed in the introduction of this chapter, one main result is Lemma 3.6.4, to be found next page. The following properties are used directly in the proof of the lemma.

Properties 3.6.3 Let ♢ be ⊑ or ⊏ −. We have the following properties:

i) If (Q, α ⋄ σ) σ_{1} ♢ σ_{2} holds and α ∉ ftv(σ_{1}) ∪ ftv(σ_{2}), then (Q) σ_{1} ♢ σ_{2} holds. ii) If (Q, α ≥ τ, Q_{0}) σ_{1} ♢ σ_{2}, then (Q, α = τ, Q_{0}) σ_{1} ♢ σ_{2}, and conversely. iii) If (Q, α ⋄ σ, α′ = α, Q_{0}) σ_{1} ♢ σ_{2}, then (Q, α′ ⋄ σ, α = α′, Q_{0}) σ_{1} ♢ σ_{2}. iv) Assume (Q) σ ≡ σ′. If (Q, α ⋄ σ, Q_{0}) σ_{1} ♢ σ_{2}, then (Q, α ⋄ σ′, Q_{0}) σ_{1} ♢ σ_{2}.

v) Assume (Q) σ ⊏ − σ′. If (Q, α = σ, Q_{0}) σ_{1} ♢ σ_{2}, then (Q, α = σ′, Q_{0}) σ_{1} ♢ σ_{2}. vi) Assume (Q) σ ⊑ σ′. If (Q, α ≥ σ, Q_{0}) σ_{1} ♢ σ_{2}, then (Q, α ≥ σ′, Q_{0}) σ_{1} ♢ σ_{2}. vii) If (Q, α ≥ σ, Q_{0}) σ_{1} ♢ σ_{2}, then (Q, α = σ, Q_{0}) σ_{1} ♢ σ_{2}.

See proof in the Appendix (page 276).

Lemma 3.6.4 Assume σ_{1} and σ_{2} are in Σ_{I}. If Q_{1} ♢^{I} Q_{2} and (Q_{1}) σ_{1} ♢ σ_{2} hold, then we have (Q_{2}) σ_{1} ♢ σ_{2}.

See proof in the Appendix (page 278).

The following properties are used to show the correctness of unification.

Properties 3.6.5 If we have

Q_{1} ♢^{I} Q_{2}  γ ∈ I  dom(Q_{1}/γ) ⊆ I  σ_{1} ∉ V

then we have the following:

i) If (γ ≥ σ_{1}) ∈ Q_{1} and (γ ⋄ σ_{2}) ∈ Q_{2}, then (Q_{2}) σ_{1} ⊑ σ_{2}. ii) If (γ = σ_{1}) ∈ Q_{1} and (γ ⋄ σ_{2}) ∈ Q_{2}, then (Q_{2}) σ_{1} ⊏ − σ_{2}. iii) If (γ ≥ σ_{1}) ∈ Q_{1}, then (Q_{2}) σ_{1} ⊑ Q_{2}(γ) iv) If (γ = σ_{1}) ∈ Q_{1}, then (Q_{2}) σ_{1} ⊏ − Q_{2}(γ)

\underline{Proof}: \underline{Property i}: By hypothesis, (γ ≥ σ_{1}) ∈ Q_{1}. Hence, (Q_{1}) σ_{1} ⊑ γ (\underline{1}) holds by I-Hyp, and we have ftv(σ_{1}) ⊆ dom(Q_{1}/γ). Since we have dom(Q_{1}/γ) ⊆ I by hypothesis, this gives ftv(σ_{1}) ⊆ I. Lemma 3.6.4 and (1) gives (Q_{2}) σ_{1} ⊑ γ. By Corollary 2.3.4, there exists a derivation of (Q_{2}) σ_{1} ⊑ σ_{2}.

\underline{Property ii}: It is similar, using A-Hyp instead of I-Hyp.

\underline{Properties iii and iv}: Let (γ ⋄ σ_{2}) be the binding of γ in Q_{2}. By Property i or ii, we have (Q_{2}) σ_{1} ♢ σ_{2} (\underline{2}). If σ_{2} ∉ ϑ, then Q_{2}(γ) = σ_{2} by definition, thus (Q_{2}) σ_{1} ♢ Q_{2}(γ) holds. Otherwise, σ_{2} ∈ ϑ, thus σ_{2} ≡ α and Q_{2}[γ] = Q_{2}[α] (\underline{3}) by definition. Hence, we have Q_{2}(γ) = Q_{2}(α) by definition and (3). Besides, (2) becomes (Q_{2}) σ_{1} ♢ α. By Property 3.2.3.i (page 103) or Property 3.2.3.ii (page 103), we get (Q_{2}) σ_{1} ♢ Q_{2}(α). This is the expected result.

The following lemma is used to prove the completeness of unification.

Lemma 3.6.6 If we have (Q) σ_{1} ⊑ σ_{2} and (Q) σ_{2} ⊑ σ_{3} and (Q) σ_{1} ⊏ − σ_{3}, then we have both (Q) σ_{1} ⊏ − σ_{2} and (Q) σ_{2} ⊏ − σ_{3}.

See proof in the Appendix (page 278).

The following lemma is used in the proof of Theorem 5, which states that System F can be encoded into MLF.

Lemma 3.6.7 If ∀ (α) σ ⊏ − σ′ holds, then σ′ ≡ ∀ (α) σ′′ and σ ⊏ − σ′′.

See proof in the Appendix (page 279).

The following property is used only in the proof of Lemma 3.6.9.

Lemma 3.6.8 If ∀ (Q) α/u = ⊥ holds, then there exist Q_{1}, Q_{2}, β, σ, u_{1}, and u_{2} such that Q is (Q_{1}, β ⋄ σ, Q_{2}), u = u_{1}u_{2}, ∀ (Q_{2}) α/u_{1} = β, and σ/u_{2} = ⊥.

See proof in the Appendix (page 280).

The following lemma is a key result for the soundness of the abstraction-check algorithm (Def. 4.2.1), which is used by the unification algorithm.

Lemma 3.6.9 If we have the following:

σ_{2} ∈ Σ_{I}  σ_{2} ∉ V  (Q) σ_{1} ⊑ σ_{2}  Q ⊑^{I} Q′  (Q′) σ_{1} ⊏ − σ_{2}

then, we also have (Q) σ_{1} ⊏ − σ_{2}.

See proof in the Appendix (page 280).

The following property is only used in Lemma 4.6.4, which shows that unification in MLF implements usual first-order unification as a special case. Indeed, as said in the introduction this Chapter, page 101, prefixes can be viewed as extended substitutions. Then prefix instance corresponds to composing substitutions. More precisely, we say that θ_{1} is more general than θ_{2}, which we can write θ_{1} ⊑ θ_{2}, whenever there exists θ such that θ_{2} = θ ∘ θ_{1}. The following property extends such a result to prefixes.

Lemma 3.6.10 If Q_{1} ⊑^{I} Q_{2} holds, then there exists a substitution θ such that Q̂_{2} and θ ∘ Q̂_{1} are equal on I.

See proof in the Appendix (page 281).

The following lemma is used in showing subject reduction in MLF_{⋆}.

Lemma 3.6.11 If we have (∅) ∀ (Q_{1}) τ_{11} → τ_{12} ♢ ∀ (Q_{2}) τ_{21} → τ_{22} then, (∅) ∀ (Q_{1}) τ_{11} ♢ ∀ (Q_{2}) τ_{21} and (∅) ∀ (Q_{1}) τ_{12} ♢ ∀ (Q_{2}) τ_{22} hold.

See proof in the Appendix (page 281).

Note that the above lemma is stated under an empty prefix (∅), and with any relation ♢ in {≡, ⊏ −, ⊑}. One could wonder whether the result still holds under a well-formed prefix Q. Actually, such a result is easy to prove for the relations ≡ and ⊑. We do not know if it holds for ⊏ −. Fortunately, we only use it with ⊏ − and under an empty prefix.

The following property is used only in the proof of the Recomposition Lemma (Lemma 3.6.13).

Lemma 3.6.12 If we have Q ⊑ Q_{1}Q_{2} and dom(Q) = dom(Q/I) and I ⊆ dom(Q_{1}), then dom(Q_{2}/ dom(Q)) ⊆ dom(Q̂_{2}) and Q̂_{2}(dom(Q)) ⊆ dom(Q_{1}).

See proof in the Appendix (page 281).

The recomposition lemma, to be found next, is a key result used to show the completeness of unification and, independently, of type inference. It states, basically, that generalization can commute with the instantiation of the prefix. In ML, we would have the following diagram, where Γ ⊢ a : σ means that the expression a has type σ under the typing environment Γ. We assume that α, β, and γ are not free in the typing environment Γ.

\begin{matrix}Γ ⊢ a : α → α & Γ ⊢ a : (β → γ) → (β → γ) \\ Γ ⊢ a : ∀ (α) α → α & Γ ⊢ a : ∀ (β, γ) (β → γ) → (β → γ) \end{matrix} Gen(α) ⊑ (\underline{1}) Gen(β, γ) ⊑ (\underline{2})

The arrow Gen(α) means that we generalize type variable α. Similarly, Gen(β, γ) means that we generalize β and γ. The instantiation (1) consists, in ML, in applying the substitution [β → γ/α] to the whole judgment. In MLF, it consists of instantiating the implicit prefix (α) into (β, γ, α = β → γ) (by PE-Free, PI-Context-L, and I-Nil). The instantiation (2) simply instantiates ∀ (α) α → α into ∀ (β, γ) (β → γ) → (β → γ); this is valid in ML and in MLF. Using the same notations as in the recomposition lemma, we have the following diagram:

\begin{matrix}(Q_{1}) Γ ⊢ a : τ & (Q_{2}Q_{3}) Γ ⊢ a : τ \\ (Q_{a}) Γ ⊢ a : ∀ (Q_{b}) τ (\underline{3}) & (Q_{2}) Γ ⊢ a : ∀ (Q_{3}) τ (\underline{4}) \end{matrix} {Q_{1} ≈ Q_{a}Q_{b} \atop Gen(Q_{b})} ⊑ Gen(Q_{3}) ⊑

Actually, the recomposition lemma does not mention typing judgments, but only prefixes. This is due to the expressiveness of prefixes, which can capture most of the type information of typing judgments. Indeed, a typing judgment such as (3) can be equivalently written (Q_{a}, γ ≥ ∀ (Q_{b}) τ) Γ ⊢ a : γ (\underline{5}). Similarly, (4) can be written (Q_{2}, γ ≥ ∀ (Q_{3}) τ) Γ ⊢ a : γ (\underline{6}). We see that all the interesting information is put in the prefix. We now understand why the recomposition lemma does not mention typing judgments but uses prefixes such as in (5) and (6) instead.

Lemma 3.6.13 (Recomposition lemma) If we have

Q_{1} ⊑^{I∪J} Q_{2}Q_{3}  (Q_{a}, Q_{b}) = Q_{1}↑I  I ⊆ dom(Q_{2})  ftv(τ) ⊆ I ∪ J

then, for γ fresh (that is, γ not in dom(Q_{1}) ∪ dom(Q_{2}) ∪ dom(Q_{3})), we can derive (Q_{a}, γ ≥ ∀ (Q_{b}) τ) ⊑^{I∪{γ}} (Q_{2}, γ ≥ ∀ (Q_{3}) τ).

See proof in the Appendix (page 283).

118

Chapter 4

Unification

The power of ML lies on its first-order unification algorithm, which enables type inference with outer-polymorphism (or, polymorphism a la ML). In ML, every solvable unification problem has a principal solution, which is a substitution. Such a solution is always found by the algorithm if it exists: the ML unification algorithm is complete. Conversely, unification of second-order polymorphic types is undecidable in general, therefore any second-order unification algorithm cannot be sound and complete. In MLF, types are second order, but unification remains first-order. Indeed, while secondorder unification usually requires “guessing” polymorphic types, the MLF abstraction relation is designed to prevent implicit introduction of polymorphism. Hence, only explicit type annotations can create new second-order polymorphic types, so that the MLF unification algorithm does not have to guess second-order polymorphism. In this chapter, we define unification of types, and give a sound and complete unification algorithm.

The solution to a unification problem is not a substitution, as in ML, but a prefix. As explained earlier, prefixes can be viewed as extended substitutions. In ML, we usually consider that a unification problem consists in two types τ_{1} and τ_{2}, and that the solution is a single substitution θ that unifies τ_{1} and τ_{2}. In a slightly different presentation, we can consider that the unification problem consists in two types τ_{1} and τ_{2}, and a substitution θ (intuitively, the “current” substitution). Then a solution is a substitution θ′, instance of θ, which unifies τ_{1} and τ_{2}. This means that there exists θ′′ such that θ′ is θ′′ ∘ θ. Note that θ′′ is actually the unifier of θ(τ_{1}) and θ(τ_{2}). We have a similar presentation in MLF: a unification problem consists in two types τ_{1} and τ_{2}, and a prefix Q. Then a solution is a prefix Q′, instance of Q, which unifies τ_{1} and τ_{2}, that is, such that (Q′) τ_{1} ≡ τ_{2} holds. This definition is given in Section 4.1, and we also prove that it is an extension of ML unification.

As remarked in Section 3.1, monotype prefixes contain more information than substitutions. In particular, they contain the history of unification. More precisely, a monotype prefix corresponds to a composition of elementary substitutions. Take for example the prefix, say Q, equal to (β≥⊥, γ=β, α=γ), which is a unifier for α → γ and γ → β. Its extracted substitution Q̂, which unifies the given types, is α ↦ β, γ ↦ β. Whereas the substitution, alone, does not give much information, the prefix Q shows the history: α has first been unified to γ, hence the binding (α=γ), then γ has been unified to β, hence the binding (γ =β). In the usual implementation of ML unification, we find a similar case: α would be an alias for γ, and γ would be an alias for β. An important optimization consists of updating the links, in order to have α and γ aliases for β. Similarly, in MLF, the prefix (β ≥⊥, γ =β, α=β) is equivalent to Q by PE-Context-L and Eq-Mono. We see that the optimization is not transparent in MLF and corresponds to an equivalence between prefixes. This example illustrates that monotype prefixes capture more information than substitutions, and are closer to the implementation. Actually, monotype prefixes are very similar to multi-equations [Rém92], since they provide the same information. However, MLF prefixes are richer than multi-equations because a type variable can be bound to a polytype. This is also why an auxiliary algorithm is needed, namely update, that updates the polytype bound of a variable with another bound. This algorithm may rearrange elements of the prefix to satisfy dependencies.

The auxiliary algorithms abstraction-check, merge and update are defined in Section 4.2. Then the unification algorithm, called unify, is given in Section 4.3. As unification remain first-order, the algorithm is very similar to the ML unification algorithm, with only a few extra cases to handle polytype bounds. Soundness, termination, and completeness of the unification algorithm are shown respectively in Sections 4.4, 4.5, and 4.6.

4.1 Definition

We first give a simple specification of the unifier of two types under a given initial prefix. As explained above, the unifier is not a substitution, but rather a prefix.

Definition 4.1.1 (Unification) A prefix Q′ unifies τ_{1} and τ_{2} under Q if and only if Q ⊑ Q′ and (Q′) τ_{1} ≡ τ_{2} hold.

Such a definition is an extension of ML unification, as shown by the following lemma.

Lemma 4.1.2 Let θ be a substitution and Q an unconstrained prefix that binds variables of codom(θ). If Q′ unifies τ_{1} and τ_{2} under the prefix Q\underline{θ}, then Q̂′ is a unifier of τ_{1} and τ_{2} in ML.

Figure 4.1: Abstraction-check algorithm

We assume that (Q) σ_{1} ⊑ σ_{2} holds. We define (Q) σ_{1} ⊏ −^{?} σ_{2} as follows : 1. If proj(∀ (Q) σ_{1}) and proj(∀ (Q) σ_{2}) are not equal, then return false.

2. If Q̂(nf(σ_{1})) is a monotype, then return true.

3. If Q̂(nf(σ_{2})) is not in ϑ, then return true if and only if X ∉ w(σ_{1}) − w(σ_{2}).

4. If Q̂(nf(σ_{2})) is α, find (α = σ) in Q (if such a binding cannot be found, return false), and return (Q) σ_{1} ⊏ −^{?} σ.

\underline{Proof}: Direct consequence of Property 1.5.11.vii (page 54).

4.2 Auxiliary algorithms

The unification algorithm uses three auxiliary algorithms: the abstraction-check algorithm, the update algorithm, and the merge algorithm.

The abstraction-check algorithm checks that the operations performed on binders are all safe. For example, it prevents the instantiation of σ_{id} in the type ∀ (α = σ_{id}) α → α, which may occur for example when unifying this type with (int → int) → (int → int). Indeed, the former type represents a function that expects a polymorphic argument and must not be instantiated. Interestingly, the check can be done a posteriori, and need not be done each time a binder is moved.

Definition 4.2.1 The abstraction-check algorithm (Q) σ ⊏ −^{?} σ′ is defined in Figure 4.1. It takes a prefix Q and two polytypes σ and σ′ such that (Q) σ ⊑ σ′ holds and tells if (Q) σ ⊏ − σ′ holds.

Lemma 4.2.2 Assume we have (Q) σ_{1} ⊑ σ_{2}. Then (Q) σ_{1} ⊏ − σ_{2} iff (Q) σ_{1} ⊏ −^{?} σ_{2} returns true.

\underline{Proof}: The termination, completeness and soundness of the abstraction-check algorithm are shown independently.

Termination There is only one place where the algorithm calls itself recursively. All other steps immediately terminate. In that case, Q̂(nf(σ_{2})) is α and (α = σ) ∈ Q. By definition of Q̂, we must have σ ∉ T . Hence, Q̂(nf(σ)) ∉ ϑ, and in this case the call to (Q) σ_{1} ⊏ −^{?} σ terminates immediately.

122  Unification

Completeness Completeness is shown by induction on the recursive calls to the abstraction-check algorithm. We assume (Q) σ_{1} ⊏ − σ_{2} holds. We show that (Q) σ_{1} ⊏ −^{?} σ_{2} returns true. By Lemmas 2.1.3.i (page 65) and 2.7.8, we have ∀ (Q) σ_{1}/ = ∀ (Q) σ_{2}/ (\underline{1}) and X ∉ w(σ_{1}) − w(σ_{2}) (\underline{2}) provided Q̂(nf(σ_{2})) ∉ V. From (1), we have proj(∀ (Q) σ_{1}) = proj(∀ (Q) σ_{2}) (\underline{3}).

• The first step does not return false thanks to (3).

• If (Q) σ_{1} ≡ τ holds, then Q̂(nf(σ_{1})) is a monotype Q̂(τ) by Lemma 1.5.9. Hence, the second step returns true. We can now assume that (Q) σ_{1} ≡ τ does not hold for any monotype τ. In particular, we can assume that σ_{1} ∉ V (\underline{4}).

• If Q̂(nf(σ_{2})) is not in ϑ, then the algorithm returns true thanks to (2).

• Otherwise, Q̂(nf(σ_{2})) is α, thus (Q) σ_{1} ⊏ − α (\underline{5}) holds by Property 1.5.6.i (page 51) and Eq-Mono. Let (α⋄σ) be the binding of α in Q. By (4), (5) and Corollary 2.3.4, we have a derivation of (Q) σ_{1} ⊏ − σ (\underline{6}) and ⋄ is rigid. Hence, the algorithm finds (α=σ) in Q and calls (Q) σ_{1} ⊏ −^{?} σ. By induction hypothesis and (6), the algorithm returns true. This is the expected result.

Soundness Soundness is shown by induction on the recursive calls to the algorithm. We assume (Q) σ_{1} ⊏ −^{?} σ_{2} returns true, and we must show that (Q) σ_{1} ⊏ − σ_{2} holds. By hypothesis, (Q) σ_{1} ⊑ σ_{2} (\underline{7}) holds.

• Since the first step does not return false, we must have proj(∀ (Q) σ_{1}) = proj(∀ (Q) σ_{2}), that is, ∀ (Q) σ_{1}/ = ∀ (Q) σ_{2}/ (\underline{8}).

• If the algorithm returns true at the second step, we must have Q̂(nf(σ_{1})) = τ for some type τ. Hence, we have nf(σ_{1}) = τ′, which means σ_{1} ∈ T . By Lemma 2.1.6 and (7), we get (Q) σ_{1} ≡ σ_{2}, which implies (Q) σ_{1} ⊏ − σ_{2} by A-Equiv.

• If the algorithm returns true at the third step, we must have Q̂(nf(σ_{2})) ∉ ϑ (\underline{9}) and X ∉ w(σ_{1}) − w(σ_{2}) (\underline{10}). By (7), (8), (10) and (9) and by Lemma 2.7.8, we have (Q) σ_{1} ⊏ − σ_{2}. This is the expected result.

• Otherwise, the algorithm necessarily returns true at the recursive call of the fourth step and Q̂(nf(σ_{2})) is α (\underline{11}). Hence, (α = σ) ∈ Q and (Q) σ_{1} ⊏ −^{?} σ returns true. By induction hypothesis, we have (Q) σ_{1} ⊏ − σ. By A-Hyp, we have (Q) σ ⊏ − α, thus (Q) σ_{1} ⊏ − α holds by R-Trans. Finally, (Q) σ ⊏ − σ_{2} holds by Lemmas 1.5.10, 1.5.6.i (page 51), and (11).

The update algorithm replaces the bound of a prefix binding by a new one. It reorders the bindings in the prefix if necessary to make the resulting prefix well-formed. The condition α ∉ dom(Q/σ) ensures that there is no circular dependency, just like the

Figure 4.2: Update algorithm

We assume α ∈ dom(Q), ftv(σ) ⊆ dom(Q) and α ∉ dom(Q/σ). We define Q ⇐ (α ⋄ σ) as follows :

1. let (Q_{1}, Q_{2}) be Q↑ ftv(σ) in

2. let (Q_{2}^{a}, α ⋄′ σ′, Q_{2}^{b}) be Q_{2} in

3. If ⋄′ is = and (Q) σ′ ⊏ −^{?} σ is false, then fail.

4. return (Q_{1}Q_{2}^{a}, α ⋄ σ, Q_{2}^{b}).

occur-check in ML. The algorithm fails if a rigid bound is updated by a strict instance, using the abstraction-check algorithm. This algorithm is defined in Figure 4.2.

For example, if Q is (α ≥ σ_{id}, β ≥ ⊥), then the update Q ⇐ (α = β → β) returns the prefix (β ≥ ⊥, α = β → β). Notice that the binders α and β have been reordered, so that the resulting prefix is well-formed. As another example, if Q is (α = σ_{id}, β ≥ ⊥), then the update Q ⇐ (α = β → β) fails because it tries to instantiate the rigid bound σ_{id} to a strict instance β → β.

The following lemma will be used to show the equivalence between the unification algorithm and a variant that reorders the bindings of the input prefix and removes unused bindings.

Lemma 4.2.3 If Q_{1} ⇐ (α ⋄ σ) is well defined, and if Q_{2} is a rearrangement of Q_{1}, then Q_{2} ⇐ (α ⋄ σ) is a rearrangement of Q_{1} ⇐ (α ⋄ σ).

The following lemma states the completeness of the update algorithm.

Lemma 4.2.4 If we have

Q_{1} ⊑^{I} Q_{2}  (α ⋄ σ) ∈ Q_{1}  (Q_{1}) σ ⊑ σ′ (Q_{1}) σ ⊏ − σ′ if ⋄ is rigid
α ∉ dom(Q_{1}/σ′) ftv(σ′) ∪ {α} ⊆ I (Q_{2}) σ′ ⊑ α (Q_{2}) σ′ ⊏ − α if ⋄′ is rigid

then, we have (Q_{1} ⇐ (α ⋄′ σ′)) ⊑^{I} Q_{2}, and the update is well-defined.

See proof in the Appendix (page 284).

This lemma states the soundness of the update algorithm.

Lemma 4.2.5 If we have (α ⋄ σ) ∈ Q, (Q) σ ⊑ σ′ and (Q ⇐ (α ⋄ σ′)) returns Q′, then Q ⊑ Q′.

See proof in the Appendix (page 285).

The merge algorithm unifies two type variables, which must have the same bound. The resulting binding is flexible if and only if the two variables are flexible. Otherwise, the new binding is rigid. This algorithm cannot fail.

Definition 4.2.6 The merge algorithm Q ⇐ α ∧ α′ takes two variables α and α′ and a prefix Q such that Q is (Q_{0}, α ⋄ σ, Q_{1}, α′ ⋄′ σ, Q_{2}) or Q is (Q_{0}, α′ ⋄′ σ, Q_{1}, α ⋄ σ, Q_{2}) and returns the prefix (Q_{0}, α ⋄′′ σ, α′ = α, Q_{1}Q_{2}) where ⋄′′ is flexible if both ⋄ and ⋄′ are flexible, and rigid otherwise.

The two following lemmas state the soundness and completeness of the merge algorithm, respectively.

Lemma 4.2.7 If Q ⇐ α ∧ α′ returns Q′, then Q ⊑ Q′ and (Q′) α ≡ α′.

See proof in the Appendix (page 285).

Lemma 4.2.8 If we have

Q_{1} ⊑^{I} Q_{2}  α, α′ ∈ I  (α ⋄ σ) ∈ Q_{1}  (α′ ⋄′ σ) ∈ Q_{1}  (Q_{2}) α ≡ α′

then (Q_{1} ⇐ α ∧ α′) ⊑^{I} Q_{2}.

See proof in the Appendix (page 285).

4.3 Unification algorithm

The algorithm unify takes a prefix Q and two types τ and τ′ and returns a prefix that unifies τ and τ′ under Q, as described in Theorem 1 (page 137), or fails. In fact, the algorithm unify is recursively defined with an auxiliary unification algorithm polyunify for polytypes: polyunify takes a prefix Q and two type schemes σ_{1} and σ_{2} not in V and returns a pair (Q′, σ′) such that Q ⊑ Q′ and (Q′) σ_{1} ⊑ σ′ and (Q′) σ_{2} ⊑ σ′ hold.

The algorithms unify and polyunify are described in Figures 4.3 and 4.4, respectively. For the sake of comparison with ML, think of the input prefix Q as a substitution given to unify and of the result prefix Q′ as an instance of Q (i.e. a substitution of the form Q′′ ∘ Q) that unifies τ and τ′. Unification of polytypes essentially follows the general structure of first-order unification of monotypes. The main differences are that (i) the computation of the unifying substitution is replaced by the computation of a unifying prefix, (ii) additional work must be performed when a variable bound to a strict polytype (i.e. other than ⊥ and not equivalent to a monotype) is being unified:

Figure 4.3: Unification algorithm (monotypes)

unify (Q, τ_{1}, τ_{2})

— Proceeds by case analysis on (τ_{1}, τ_{2}) :

Case (α, α): return Q. Case (g τ_{1}^{1} .. τ_{1}^{n}, g τ_{2}^{1} .. τ_{2}^{n}):

• let Q^{0} be Q in

• let Q^{i} be unify (Q^{i−1}, τ_{1}^{i−1}, τ_{2}^{i−1}) for i ∈ 1..n in
• return Q^{n}.

Case (g_{1} τ_{1}^{1} .. τ_{1}^{p}, g_{2} τ_{2}^{1} .. τ_{2}^{q}) with g_{1} ≠ g_{2}: fail. Case (α, τ) or (τ, α) with (α ⋄ σ) ∈ Q and σ ∈ V: return unify (Q, τ, nf(σ)). Case (α, τ) or (τ, α) with (α ⋄ σ) ∈ Q, τ ∉ ϑ, and σ ∉ V:

• fail if α ∈ dom(Q/τ).

• let (Q′, _) be polyunify (Q, σ, τ) in
• return (Q′) ⇐ (α = τ)

Case (α_{1}, α_{2}) with (α_{1} ⋄_{1} σ_{1}) ∈ Q, (α_{2} ⋄_{2} σ_{2}) ∈ Q, α_{1} ≠ α_{2}, and σ_{1}, σ_{2} not in V: • fail if α_{1} ∈ dom(Q/σ_{2}) or α_{2} ∈ dom(Q/σ_{1}).

• let (Q′, σ_{3}) be polyunify (Q, σ_{1}, σ_{2}) in
• return (Q′) ⇐ (α_{1} ⋄_{1} σ_{3}) ⇐ (α_{2} ⋄_{2} σ_{3}) ⇐ α_{1} ∧ α_{2}.

its bound must be further unified (last case of polyunify) and the prefix must then be updated accordingly.

The following is a stability property: it shows that if a binding (α ⋄ σ) ∈ Q is useless, regarding two types τ_{1} and τ_{2}, (that is, α ∉ dom(Q/τ_{1}, τ_{2})), then the unify algorithm does not remove the binding, and does not use it either (it is still useless after unification). Like all results about the unification algorithm, it is two-folded: one statement concerns the unification of monotypes (unify); the other concerns the unification of polytypes (polyunify). We recall that the notation dom(Q/τ_{1}, τ_{2}) means dom(Q/τ_{1}) ∪ dom(Q/τ_{2}).

Properties 4.3.1 Assume (α ⋄ σ) ∈ Q.

i) If unify (Q, τ_{1}, τ_{2}) returns a prefix Q′, and if α ∉ dom(Q/τ_{1}, τ_{2}), then (α⋄σ) ∈ Q′ and α ∉ dom(Q′/τ_{1}, τ_{2}).

ii) If polyunify (Q, σ_{1}, σ_{2}) returns (Q′, σ_{3}), and if α ∉ dom(Q/σ_{1}, σ_{2}), then (α⋄σ) ∈ Q′ and α ∉ dom(Q′/σ_{1}, σ_{2}, σ_{3}).

See proof in the Appendix (page 286).

Figure 4.4: Unification algorithm (polytypes)

 polyunify (Q, σ_{1}, σ_{2})

— Rewrite σ_{1} and σ_{2} in constructed form, and then:

Case (⊥, σ) or (σ, ⊥): return (Q, σ) Case (∀ (Q_{1}) τ_{1}, ∀ (Q_{2}) τ_{2}) with Q_{1}, Q_{2}, and Q having disjoint domains (which

usually requires renaming σ_{1} and σ_{2})

• let Q_{0} be unify (QQ_{1}Q_{2}, τ_{1}, τ_{2}) in

• let (Q_{3}, Q_{4}) be Q_{0}↑ dom(Q) in

• return (Q_{3}, ∀ (Q_{4}) τ_{1})

The following property shows that the unify algorithm is stable under rearrangement of the prefix, and under addition of new (unused) bindings.

Properties 4.3.2 Assume Q ≈ Q_{1}Q_{2}.

i) If ftv(τ, τ′) ⊆ dom(Q_{1}), then unify (Q_{1}, τ, τ′) returns Q′_{1} if and only if unify (Q, τ, τ′) returns a rearrangement of Q′_{1}Q_{2}.

ii) If ftv(σ, σ′) ⊆ dom(Q_{1}), then polyunify (Q_{1}, σ, σ′) returns Q′_{1} and σ′′ if and only if polyunify (Q, σ, σ′) returns a rearrangement of Q′_{1}Q_{2} and a rearrangement of σ′′.

See proof in the Appendix (page 286).

4.4 Soundness of the algorithm

In this section, we show the soundness of the unify and polyunify algorithms. More precisely, we show that if unify returns a prefix, it is an instance of the initial prefix and it does unify the types given in input. As for polyunify, it also returns two elements : an instance of the initial prefix and a common instance of σ_{1} and σ_{2} under this prefix. This means that polyunify returns the least upper bound of σ_{1} and σ_{2}.

Lemma 4.4.1 (Soundness of the unification algorithm) These two results hold: (i) If unify (Q, τ_{1}, τ_{2}) succeeds with Q′, then Q ⊑ Q′ and (Q′) τ_{1} ≡ τ_{2}. (ii) Assume σ_{1} ∉ V and σ_{2} ∉ V. If polyunify (Q, σ_{1}, σ_{2}) succeeds with (Q′, σ),

then Q ⊑ Q′, (Q′) σ_{1} ⊑ σ and (Q′) σ_{2} ⊑ σ hold.

\underline{Proof}: By induction on the recursive calls to both algorithms. We show the result for unify by case analysis on (τ_{1}, τ_{2}):

4.4 Soundness of the algorithm  127

∘ Case (α, α) is immediate.

∘ Case (g τ_{1}^{1} .. τ_{1}^{n}, g τ_{2}^{1} .. τ_{2}^{n}): Let Q^{0} be Q, and Q^{i} be unify (Q^{i−1}, τ_{1}^{i−1}, τ_{2}^{i−1}) for i ∈ 1..n. By definition, Q′ is Q^{n}. By induction hypothesis, we have Q^{0} ⊑ Q^{1} … ⊑ Q^{n−1} ⊑ Q′. Besides, (Q^{i}) τ_{1}^{i−1} ≡ τ_{2}^{i−1} holds for i ∈ 1..n. Hence, by Lemma 3.4.3, we get (Q′) τ_{1}^{i−1} ≡ τ_{2}^{i−1}. By Property 1.5.11.viii (page 54), this implies (Q′) τ_{1} ≡ τ_{2}.

∘ Case (g_{1} …, g_{2} …) is not possible since the algorithm succeeds by hypothesis.

∘ Case (α, τ) or (τ, α) with (α ⋄ σ) ∈ Q and σ ∈ V: By induction hypothesis, unify (Q, τ, nf(σ)) returns Q′ such that (Q′) τ ≡ nf(σ) (\underline{1}) and Q ⊑ Q′. Moreover, we have (Q) α ≡ nf(σ) by Eq-Mono, thus (Q′) α ≡ nf(σ) (\underline{2}) holds by Lemma 3.6.4. Then (Q′) τ ≡ α holds by R-Trans, (1), and (2). This is the expected result.

∘ Case (α, τ) or (τ, α): We have (α ⋄ σ) ∈ Q (\underline{3}), τ ∉ V, and σ ∉ V. Let (Q_{0}, σ′) be polyunify (Q, σ, τ). By induction hypothesis, we have Q ⊑ Q_{0} (\underline{4}), (Q_{0}) σ ⊑ σ′ (\underline{5}) and (Q_{0}) τ ⊑ σ′. By Lemma 2.1.6, this gives (Q_{0}) τ ≡ σ′ (\underline{6}). Hence, (Q_{0}) σ ⊑ τ (\underline{7}) holds by R-Trans, (5), and (6). We have α ∉ dom(Q/σ) by well-formedness of Q and (3). Besides, α ∉ dom(Q/τ), otherwise the algorithm would fail on the first step. Hence, by Property 4.3.1.i, (α⋄σ) ∈ Q_{0} (\underline{8}) and α ∉ dom(Q_{0}/τ) (\underline{9}). Let Q′ be Q_{0} ⇐ (α=τ) (\underline{10}). This update is well-defined by (9) and succeeds by hypothesis (the algorithm succeeds). By Lemma 4.2.5, (7) and (8), we get Q_{0} ⊑ Q′ (\underline{11}). By PI-Trans, (4), and (11), we get Q ⊑ Q′. As a consequence of (10), we have (α = τ) ∈ Q′. Hence, (Q′) α ≡ τ holds by Eq-Mono.

∘ Case (α_{1}, α_{2}): We have (α_{1} ⋄_{1} σ_{1}) ∈ Q and (α_{2} ⋄_{2} σ_{2}) ∈ Q. Moreover, σ_{1} and σ_{2} are not in V and α_{1} ≠ α_{2}. Let (Q_{0}, σ_{3}) be polyunify (Q, σ_{1}, σ_{2}). By induction hypothesis, we have Q ⊑ Q_{0} (\underline{12}) and (Q_{0}) σ_{1} ⊑ σ_{3} (\underline{13}) as well as (Q_{0}) σ_{2} ⊑ σ_{3} (\underline{14}). We have α_{1} ∉ dom(Q/σ_{1}) and α_{1} ∉ dom(Q/σ_{2}), otherwise the algorithm would fail on the first step. Hence, by Property 4.3.1.i, (α_{1} ⋄_{1} σ_{1}) ∈ Q_{0} (\underline{15}), α_{1} ∉ dom(Q_{0}/σ_{3}) (\underline{16}) and α_{2} ∉ dom(Q_{0}/σ_{3}) (\underline{17}). Let Q_{1} be Q_{0} ⇐ (α_{1} ⋄_{1} σ_{3}), Q_{2} be Q_{1} ⇐ (α_{2} ⋄_{2} σ_{3}), and Q′ be Q_{2} ⇐ α_{1} ∧ α_{2}. The updates are well-defined by (16) and (17). By Lemma 4.2.5, (13) and (15), we get Q_{0} ⊑ Q_{1} (\underline{18}). By Lemma 3.6.4, (18), and (14), we get (Q_{1}) σ_{2} ⊑ σ_{3} (\underline{19}). We show that (α_{2} ⋄_{2} σ_{2}) ∈ Q_{0} as we showed (15). thus (α_{2} ⋄_{2} σ_{2}) ∈ Q_{1} (\underline{20}) (the update does not modify the binding of α_{2}). Hence, by Lemma 4.2.5, (19) and (20), we get Q_{1} ⊑ Q_{2} (\underline{21}). Finally, we have Q_{2} ⊑ Q′ (\underline{22}) and (Q′) α_{1} ≡ α_{2} by Lemma 4.2.7. By PI-Trans, (12), (18), (21), and (22), we get Q ⊑ Q′.

We show the result for polyunify by case analysis on the constructed forms of (σ_{1}, σ_{2}):

∘ Case (⊥, σ) or (σ, ⊥): We return (Q, σ), thus the expected result holds by Property 1.5.13.i (page 55), and by rules PE-Refl, Eq-Refl and I-Bot.

∘ Case ∀ (Q_{1}) τ_{1}, ∀ (Q_{2}) τ_{2}: Let Q_{0} = unify (QQ_{1}Q_{2}, τ_{1}, τ_{2}). By induction hypothesis, Q_{0} is such that QQ_{1}Q_{2} ⊑ Q_{0} (\underline{1}) and (Q_{0}) τ_{1} ≡ τ_{2} (\underline{2}). Let (Q_{3}, Q_{4}) be Q_{0}↑ dom(Q) (\underline{3}). The returned prefix is Q′ = Q_{3}. By Lemma 3.5.2 and (3), Q_{0} is a rearrangement of Q_{3}Q_{4} (\underline{4}). Hence (1) gives QQ_{1}Q_{2} ⊑^{dom(Q)} Q_{3}Q_{4} (\underline{5}) by Property 3.2.2.ii (page 103) and Property 3.4.2.i (page 106). Since dom(Q_{1}Q_{2}) # dom(Q) by hypothesis and dom(Q_{4}) # dom(Q) (\underline{6}) by Lemma 3.5.2 and (3), we get Q ⊑ Q_{3} (\underline{7}) by PE-Free and (5). Additionally, ftv(σ_{1}) ⊆ dom(Q), thus dom(Q_{4}) # ftv(σ_{1}) (\underline{8}) holds by (6). We have

σ_{1} ≡ ∀ (Q_{1}) τ_{1} by Property 1.5.13.i (page 55)
(QQ_{1}Q_{2})  σ_{1} ⊑ τ_{1}  by I-Drop^{⋆}
(Q_{3}Q_{4})  σ_{1} ⊑ τ_{1}  by Lemma 3.6.4 and (5)
(Q_{3})  ∀ (Q_{4}) σ_{1} ⊑ ∀ (Q_{4}) τ_{1} by R-Context-R
(Q_{3})  σ_{1} ⊑ ∀ (Q_{4}) τ_{1} by (8) and Eq-Free.

Similarly, we can show that (Q_{3}) σ_{2} ⊑ ∀ (Q_{4}) τ_{2} holds. Moreover, by (2) and (4), we have (Q_{3}Q_{4}) τ_{1} ≡ τ_{2}, and we get (Q_{3}) ∀ (Q_{4}) τ_{1} ≡ ∀ (Q_{4}) τ_{2} by R-Context-R. To sum up, we have (7) as well as (Q_{3}) σ_{1} ⊑ ∀ (Q_{4}) τ_{1} and (Q_{3}) σ_{2} ⊑ ∀ (Q_{4}) τ_{1}. This is the expected result.

4.5 Termination of the algorithm

In order to make the proof of termination easier, we consider a variant of the unification algorithm, composed of two sub-algorithms unify′ and polyunify′. The body of polyunify′ is the body of polyunify, where the occurrence of unify is replaced by unify′. The algorithm unify′ is given in Figure 4.5.

The differences between unify and unify′ are in the cases (α, τ) and (α_{1}, α_{2}): The recursive call to polyunify is given a prefix Q_{1} in unify′, instead of Q in unify. The prefix Q_{1} contains all the bindings of Q which do not depend on α (in the first case), or on α_{1} or α_{2} (in the second case). Intuitively all the bindings that depends on α or on α_{1} or α_{2} are useless during the unification of α and τ or of α_{1} and α_{2} (respectively). In unify′, we explicitly remove such bindings, thus the recursive call to polyunify is made with a “smaller” prefix. This helps to show termination. First, we show that unify and unify′ are equivalent. Then we define sizes and weights associated to a unification problem. Finally, we show that the algorithm unify′ calls itself recursively with a strictly smaller weight, thus it terminates.

Lemma 4.5.1 The algorithms unify and unify′ are equivalent. More precisely, the algorithm unify (Q, τ_{1}, τ_{2}) returns Q′ if and only if the algorithm unify′ (Q, τ_{1}, τ_{2}) returns a rearrangement of Q′.

See proof in the Appendix (page 286).

Definition 4.5.2 We define ⌈σ⌉ as the number of universal quantifiers appearing syntactically in σ (considering ∀ (α_{1} ⋄_{1} σ_{1}, Q) σ as syntactic sugar for ∀ (α_{1} ⋄_{1} σ_{1}) ∀ (Q) σ. Similarly, ⌈(α_{1} ⋄_{1} σ_{1}, … α_{n} ⋄_{n} σ_{n})⌉ is n + ⌈σ_{1}⌉ + … ⌈σ_{n}⌉. We also define #τ as the size of the set dom(τ).

Figure 4.5: Unification algorithm (variant)

unify′ (Q, τ_{1}, τ_{2})

— Proceeds by case analysis on (τ_{1}, τ_{2}) :

Case (α, α) : return Q. Case (g τ_{1}^{1} .. τ_{1}^{n}, g τ_{2}^{1} .. τ_{2}^{n}) :

• let Q^{0} be Q in

• let Q^{i} be unify′ (Q^{i−1}, τ_{1}^{i−1}, τ_{2}^{i−1}) for i ∈ 1..n in

• return Q^{n}. Case (g_{1} τ_{1}^{1} .. τ_{1}^{p}, g_{2} τ_{2}^{1} .. τ_{2}^{q}) with g_{1} ≠ g_{2} : fail Case (α, τ) or (τ, α) with (α ⋄ σ) ∈ Q and σ ∈ V :

• return unify′ (Q, τ, nf(σ)). Case (α, τ) or (τ, α) with (α ⋄ σ) ∈ Q, τ ∉ ϑ, and σ ∉ V :

• fail if α ∈ dom(Q/τ).

• let I be {β ∈ dom(Q) | β ≠ α and α ∉ dom(Q/β)}

• let (Q_{1}, Q_{2}) be Q↑I

• let (Q′_{1}, _) be polyunify′ (Q_{1}, σ, τ).

• return Q′_{1}Q_{2} ⇐ (α = τ). Case (α_{1}, α_{2}) with (α_{1} ⋄_{1} σ_{1}) ∈ Q, (α_{2} ⋄_{2} σ_{2}) ∈ Q, α_{1} ≠ α_{2}, and σ_{1}, σ_{2} not in V :

• fail if α_{1} ∈ dom(Q/σ_{2}) or α_{2} ∈ dom(Q/σ_{1}).

• let I be {β ∈ dom(Q) | β ∉ {α_{1}, α_{2}} and {α_{1}, α_{2}} # dom(Q/β)}

• let (Q_{1}, Q_{2}) be Q↑I

• let (Q′_{1}, σ_{3}) be polyunify′ (Q_{1}, σ_{1}, σ_{2})

• return Q′_{1}Q_{2} ⇐ (α_{1} ⋄_{1} σ_{3}) ⇐ (α_{2} ⋄_{2} σ_{3}) ⇐ α_{1} ∧ α_{2}

Note that we have #τ > 0 for any τ, while ⌈τ⌉ = 0.

Properties 4.5.3 i) For any Q and τ, we have ⌈∀ (Q) τ⌉ = ⌈Q⌉. ii) For any prefix Q_{1}Q_{2}, we have ⌈Q_{1}Q_{2}⌉ = ⌈Q_{1}⌉ + ⌈Q_{2}⌉. iii) If Q ≈ Q′, then ⌈Q⌉ = ⌈Q′⌉. iv) If unify′ (Q, τ_{1}, τ_{2}) returns Q′, then ⌈Q′⌉ ⩽ ⌈Q⌉.

v) If polyunify′ (Q, σ_{1}, σ_{2}) returns (Q′, σ_{3}), then ⌈Q′⌉ + ⌈σ_{3}⌉ ⩽ ⌈Q⌉ + ⌈σ_{1}⌉ + ⌈σ_{2}⌉.

See proof in the Appendix (page 288).

Properties 4.5.3.iv and 4.5.3.v tell us an interesting story. Indeed, by definition, ⌈Q⌉ and ⌈σ⌉ are the number of quantifiers appearing in Q and σ. Hence, the two aforementioned properties show that the number of quantifiers only decreases during unification. This corroborates the intuition that we perform only first-order unification, and that we never guess polymorphism, that is, we never introduce new quantifiers.

Weights

We associate a weight to each call to unify′ (Q, τ_{1}, τ_{2}) and polyunify′ (Q, σ_{1}, σ_{2}). A weight is a triple in IN^{3}, with its natural lexicographic ordering.

Definition 4.5.4 The weight associated to unify′ (Q, τ_{1}, τ_{2}) is

(2 × ⌈Q⌉ , #τ_{1} + #τ_{2} , card(dom(Q/τ_{1})) + card(dom(Q/τ_{2})))

The weight associated to polyunify′ (Q, σ_{1}, σ_{2}) is

(1 + 2 × (⌈Q⌉ + ⌈σ_{1}⌉ + ⌈σ_{2}⌉) , 0 , 0)

Lemma 4.5.5 (Termination of unification) The unify algorithm always terminates, either by failing or by returning a prefix.

\underline{Proof}: By Lemma 4.5.1, unify (Q, τ_{1}, τ_{2}) terminates if and only if unify′ (Q, τ_{1}, τ_{2}) (\underline{1}) terminates. Hence, we show termination for unify′ and polyunify′. Actually, we show that in the body of (1), all recursive calls to unify′ and polyunify′ have strictly smaller weights than the weight of (1). Similarly, we show that in the body of polyunify′ (Q, σ_{1}, σ_{2}) (\underline{2}), recursive calls to unify′ and polyunify′ have strictly smaller weights than the weight of (2). Termination follows. We proceed by case analysis.

∘ Case (α, α) has no recursive call.

∘ Case (g τ_{1}^{1} .. τ_{1}^{n}, g τ_{2}^{1} .. τ_{2}^{n}): By Property 4.5.3.iv, ⌈Q^{i}⌉ ⩽ ⌈Q⌉. Besides, #τ_{1}^{i} < #τ_{1} and #τ_{2}^{i} < #τ_{2}. Hence, the weight of unify (Q^{i}, τ_{1}^{i}, τ_{2}^{i}) is strictly smaller than the weight of (1).

∘ Case (g_{1} τ_{1}^{1} .. τ_{1}^{n}, g_{2} τ_{2}^{1} .. τ_{2}^{n}): both calls fail.

∘ Case (α, τ) with (α = σ) ∈ Q and σ ∈ V: We call unify (Q, τ, nf(σ)) (\underline{3}). By hypothesis, we have σ ∈ V, which means that nf(σ) is a type variable β such that dom(Q/α) = dom(Q/β) ∪ \{α\}. Hence, card(dom(Q/α)) = card(dom(Q/β)) + 1 (\underline{4}). The weight of (1) is the triple

(2 × ⌈Q⌉, #α + #τ, card(dom(Q/α)) + card(dom(Q/τ)))

The weight of (3) is

(2 × ⌈Q⌉, #β + #τ, card(dom(Q/β)) + card(dom(Q/τ)))

4.6 Completeness of the algorithm  131

By (4), and observing that #β = #α, this weight is equal to

(2 × ⌈Q⌉, #α + #τ, card(dom(Q/α)) − 1 + card(dom(Q/τ)))

Hence, the weight of (3) is strictly smaller than the weight of (2).

∘ Case (α, τ): Let I be {β ∈ dom(Q) | β ≠ α and α ∉ dom(Q/β)}. Let (Q_{1}, Q_{2}) be Q↑I. There is a recursive call to polyunify′ (Q_{1}, σ, τ) (\underline{5}). By Lemmas 3.5.2 and 4.5.3.ii, we have ⌈Q⌉ = ⌈Q_{1}⌉ + ⌈Q_{2}⌉ (\underline{6}) Besides, α ∈ dom(Q_{2}), thus we have ⌈Q_{2}⌉ ⩾ 1 + ⌈σ⌉. This implies ⌈Q_{1}⌉ + 1 + ⌈σ⌉ ⩽ ⌈Q_{1}⌉ + ⌈Q_{2}⌉, that is, ⌈Q_{1}⌉ + 1 + ⌈σ⌉ ⩽ ⌈Q⌉ (\underline{7}) by (6). The first element of the weight of (1) is 2 × ⌈Q⌉. The first element of the weight of (5) is w = 1 + 2 × (⌈Q_{1}⌉ + ⌈σ⌉ + ⌈τ⌉), that is, w = 1 + 2 × (⌈Q_{1}⌉ + ⌈σ⌉). Hence, we have w < 2 × (⌈Q_{1}⌉ + 1 + ⌈σ⌉). By (7), we get w < 2 × ⌈Q⌉. This implies that the weight of (5) is strictly smaller than the weight of (1).

∘ Case (α_{1}, α_{2}): Let I be {β ∈ dom(Q) | β ∉ {α_{1}, α_{2}} and {α_{1}, α_{2}} # dom(Q/β)} and (Q_{1}, Q_{2}) be Q↑I. There is a recursive call to polyunify (Q_{1}, σ_{1}, σ_{2}) (\underline{8}). By Lemmas 3.5.2 and 4.5.3.ii, we have ⌈Q⌉ = ⌈Q_{1}⌉ + ⌈Q_{2}⌉ (\underline{9}). Besides, α_{1}, α_{2} ∈ dom(Q_{2}), thus ⌈Q_{2}⌉ ⩾ 2+⌈σ_{1}⌉+⌈σ_{2}⌉ (\underline{10}). Hence, ⌈Q_{1}⌉+2+⌈σ_{1}⌉+⌈σ_{2}⌉ ⩽ ⌈Q⌉ (\underline{11}) holds from (9) and (10). The first element of the weight of (1) is 2×⌈Q⌉. The first element of the weight of (8) is w = 1 + 2 × (⌈Q_{1}⌉ + ⌈σ_{1}⌉ + ⌈σ_{2}⌉). We have w < 2 × (⌈Q_{1}⌉ + 2 + ⌈σ_{1}⌉ + ⌈σ_{2}⌉). Hence, by (11), we get w < 2 × ⌈Q⌉. As a consequence, the weight of (8) is strictly smaller than the weight of (1).

In polyunify′ (Q, σ_{1}, σ_{2}) (\underline{12}), we call unify′ (QQ_{1}Q_{2}, τ_{1}, τ_{2}) (\underline{13}). The first element of the weight of (12) is 1 + 2 × (⌈Q⌉ + ⌈σ_{1}⌉ + ⌈σ_{2}⌉), that is, by Property 4.5.3.i, 1 + 2 × (⌈Q⌉ + ⌈Q_{1}⌉ + ⌈Q_{2}⌉). By Property 4.5.3.ii, the first element of the weight of (13) is 2 × (⌈Q⌉ + ⌈Q_{1}⌉ + ⌈Q_{2}⌉). Hence, the weight of (13) is strictly smaller than the weight of (12).

4.6 Completeness of the algorithm

In this section, we show that the unification algorithm is also complete: if the unification problem admits a solution, then the algorithm finds a solution, which is equivalent or better (that is, more general).

The following property is used in the proof of completeness.

Lemma 4.6.1 If σ_{1} and σ_{2} are not in V, and if polyunify (Q, σ_{1}, σ_{2}) returns (Q′, σ_{3}), then, σ_{3} is not in V.

See proof in the Appendix (page 288).

The intuitive specification of completeness is the following: if there is a solution to a given unification problem (e.g. (Q_{2}) τ_{1} ≡ τ_{2} below), then unification succeeds and returns a better result (e.g. Q′_{1} ⊑^{I} Q_{2} below).

Lemma 4.6.2 (Completeness of unification) Let I be dom(Q_{1}). We assume that τ_{1}, τ_{2}, σ_{1}, and σ_{2} are in Σ_{I}. Furthermore, we assume that Q_{1} ⊑^{I} Q_{2} holds.

(i) If (Q_{2}) τ_{1} ≡ τ_{2} holds, then unify (Q_{1}, τ_{1}, τ_{2}) succeeds with Q′_{1} and we have Q′_{1} ⊑^{I} Q_{2}.

(ii) If σ_{1}, σ_{2}, and σ_{3} are not in V, and if we have (Q_{2}) σ_{1} ⊑ σ_{3} and (Q_{2}) σ_{2} ⊑ σ_{3}, then polyunify (Q_{1}, σ_{1}, σ_{2}) succeeds with Q′_{1} and σ′_{3} such that (Q′_{1}, γ ≥ σ′_{3}) ⊑^{I∪{γ}} (Q_{2}, γ ≥ σ_{3})

\underline{Proof}: We prove both properties simultaneously by induction on the recursive calls to the algorithm.

\underline{The unify algorithm}:

Let I be dom(Q_{1}) (\underline{1}). We have to show that the algorithm cannot fail, thanks to the hypotheses (Q_{2}) τ_{1} ≡ τ_{2} (\underline{2}) and Q_{1} ⊑ Q_{2} (\underline{3}), and that the returned prefix, Q′_{1} is such that Q′_{1} ⊑^{I} Q_{2}. We proceed by case analysis on (τ_{1}, τ_{2}).

∘ Case (α, α) is immediate.

∘ Case (g τ_{1}^{1} .. τ_{1}^{n}, g τ_{2}^{1} .. τ_{2}^{n}): We will shown this case by iteration (from 1 to n). By Property 1.5.11.viii (page 54) applied to (2), we have (Q_{2}) τ_{1}^{i} ≡ τ_{2}^{i} for all i ∈ 1..n. Let Q^{0} be Q_{1} and Q^{i} be unify (Q^{i−1}, τ_{1}^{i−1}, τ_{2}^{i−1}). We have Q^{0} ⊑ Q_{2} by hypothesis. We prove by (local) induction on i, that there exists a renaming ϕ^{i} on dom(Q_{2}) disjoint from I, and a prefix Q_{0}^{i} such that Q^{i} ⊑ ϕ^{i}(Q_{2})Q_{0}^{i} holds and dom(Q_{0}^{i}) # I. This is obviously true for i = 0, taking ϕ^{0} = id and Q_{0}^{i} = ∅. By (local) induction hypothesis, we have Q^{i−1} ⊑ ϕ^{i−1}(Q_{2})Q_{0}^{i−1} (\underline{4}). By Property 3.4.2.iv (page 106), we have Q_{2} ≡ ϕ^{i−1}(Q_{2})\underline{ϕ^{i−1}}, thus Q_{2} ≡^{I} ϕ^{i−1}(Q_{2}) holds by Property 3.4.2.i (page 106) and PE-Free. Then Q_{2} ≡^{I} ϕ^{i−1}(Q_{2})Q_{0}^{i−1} (\underline{5}) holds by PE-Free. We have (Q_{2}) τ_{1}^{i} ≡ τ_{2}^{i} (\underline{6}), thus (ϕ^{i−1}(Q_{2})Q_{0}^{i−1}) τ_{1}^{i} ≡ τ_{2}^{i} (\underline{7}) holds by Lemma 3.6.4 applied to (5) and (6). Hence, by induction hypothesis, (4), and (7), Q^{i} is defined (that is, the algorithm succeeds) and we have Q^{i} ⊑^{I} ϕ^{i−1}(Q_{2})Q_{0}^{i−1}. By Lemma 3.6.2 (page 114), there exists a renaming ϕ disjoint from I and a prefix Q_{0} such that we have Q^{i} ⊑ ϕ(ϕ^{i−1}(Q_{2})Q_{0}^{i−1})Q_{0}. Taking ϕ^{i} = ϕ ∘ ϕ^{i−1} and Q_{0}^{i} = ϕ(Q_{0}^{i−1})Q_{0} gives the expected result.

By (local) induction, the result holds for n, hence, we have

Q′_{1} = Q^{n} ⊑ ϕ^{n}(Q_{2})Q_{0}^{n} ≡^{I} Q_{2}

Finally, we have Q′_{1} ⊑^{I} Q_{2}. This is the expected result.

∘ Case (g_{1} …, g_{2} …) with g_{1} ≠ g_{2}: The algorithm fails. Indeed, according to Property 1.5.11.viii, it is not possible to find Q_{2} such that (Q_{2}) g_{1} … ≡ g_{2} …, thus this case does not happen.

∘ Case (α, τ) or (τ, α) with (α ⋄ σ) ∈ Q_{1} and σ ∈ V: By hypothesis, (Q_{2}) τ ≡ α (\underline{8}) holds. We have (Q_{1}) α ≡ nf(σ) (\underline{9}) by Eq-Mono. Moreover, ftv(nf(σ)) ⊆ dom(Q_{1}) holds, thus we have ftv(nf(σ)) ⊆ I from (1). Hence, by Lemma 3.6.4, (3), and (9), we get (Q_{2}) α ≡ nf(σ) (\underline{10}). Consequently, (Q_{2}) τ ≡ nf(σ) holds by R-Trans, (10), and (8). Hence, we get the result by induction hypothesis applied to unify (Q_{1}, τ, nf(σ)).

∘ Case (α, τ) or (τ, α): We have (α ⋄ σ) ∈ Q_{1} (\underline{11}), as well as τ ∉ ϑ (\underline{12}) and σ ∉ V (\underline{13}). By hypothesis, (Q_{2}) τ ≡ α (\underline{14}) holds. In the first point, below, we show that the algorithm cannot fail in the first step of the case (α, τ). In the second point, we use the induction hypothesis and the completeness of the update algorithm (Lemma 4.2.4) to show the result. The case where the binding is rigid might fail because of the abstraction-check algorithm. It is not the case thanks to Lemma 3.6.9, as shown below.

• If α ∈ dom(Q_{1}/τ), then Q_{1} is of the form (Q_{a}, α⋄σ, Q_{b}) and α ∈ ftv(∀ (Q_{b}) τ) (\underline{15}). Since τ ∉ ϑ, we have ∀ (Q_{b}) τ ∉ V (\underline{16}). We can derive (Q_{1}) ∀ (Q_{b}) τ ⊑ τ (\underline{17}) by I-Drop^{⋆}. Hence, (Q_{2}) ∀ (Q_{b}) τ ⊑ τ holds by Lemma 3.6.4, (17), and (3). By (14), we get (Q_{2}) ∀ (Q_{b}) τ ⊑ α (\underline{18}). By Property 2.1.7.ii (page 68), (15), and (18), we have ∀ (Q_{b}) τ ≡ α, which is not possible by (16). Hence, α ∉ dom(Q_{1}/τ) (\underline{19}), and the algorithm does not fail on the first step.

• From (14) and Corollary 1.5.10, we must have α ∈ dom(Q̂_{2}). Hence, there exists τ′ and σ′ such that (α = σ′) ∈ Q_{2} (\underline{20}) and nf(σ′) = τ′. Then (Q_{2}) α ≡ σ′ (\underline{21}) holds by Eq-Mono and Property 1.5.6.i. Note that (11) gives α ∈ I (\underline{22}) and dom(Q_{1}/α) ⊆ I (\underline{23}) by (1). By Property 3.6.5.i (page 114), (2), (22), (23), (13), (11), and (20), we have (Q_{2}) σ ⊑ σ′ (\underline{24}), thus (Q_{2}) σ ⊑ τ (\underline{25}) holds by R-Trans, (24), (21), and (14). We have (Q_{2}) τ ⊑ τ (\underline{26}) by Eq-Refl. By induction hypothesis, (3), (13), (12), (25), and (26), polyunify (Q_{1}, σ, τ) succeeds with (Q′, σ_{3}) (\underline{27}) such that (Q′, γ ≥ σ_{3}) ⊑^{I∪\{γ\}} (Q_{2}, γ ≥ τ). By Property 3.4.2.i (page 106) and PE-Free, we get Q′ ⊑^{I} Q_{2} (\underline{28}). By Property 4.3.1.i (page 125) and (19), we have (α ⋄ σ) ∈ Q′ (\underline{29}) and α ∉ dom(Q′/τ) (\underline{30}). By (14), A-Equiv, and I-Abstract, we get (Q_{2}) τ ⊏ − α (\underline{31}) and (Q_{2}) τ ⊑ α (\underline{32}). The Soundness Lemma (Lemma 4.4.1) applied to (27) give (Q′) τ ⊑ σ_{3} (\underline{33}), (Q′) σ ⊑ σ_{3} (\underline{34}), and Q_{1} ⊑ Q′. By Lemma 2.1.6 and (33), we have (Q′) σ_{3} ≡ τ (\underline{35}), thus (Q′) σ ⊑ τ (\underline{36}) holds by R-Trans, (35), and (34). If ⋄ is rigid, we can derive (Q_{2}) σ ⊏ − τ by Property 3.6.5.ii (page 114), thus (Q′) σ ⊏ − τ (\underline{37}) holds by Lemma 3.6.9, (28), (36), and (12). Let Q′_{1} be Q′ ⇐ (α = τ). By Lemma 4.2.4 (page 123), (28), (29), (37), (36), (30), (32) and (31), Q′_{1} is well defined and Q′_{1} ⊑^{I} Q_{2} holds. This is the expected result.

∘ Case (α_{1}, α_{2}): We have (α_{1} ⋄_{1} σ_{1}) ∈ Q_{1} (\underline{38}), and (α_{2} ⋄_{2} σ_{2}) ∈ Q_{1} (\underline{39}). By hypothesis, (Q_{2}) α_{1} ≡ α_{2} (\underline{40}) holds, σ_{1}, σ_{2} ∉ V (\underline{41}). By well-formedness of (3), Q_{1} is closed. Hence, (38) and (39) imply utv(σ_{1})∪utv(σ_{2}) ⊆ dom(Q_{1}), that is, σ_{1}, σ_{2} ∈ Σ_{I} (\underline{42}) by (1).

We show, in a first time, that the algorithm does not fail on its first step. Assume, by a way of contradiction, that α_{2} ∈ dom(Q_{1}/σ_{1}) holds. Then Q_{1} is of the form (Q_{a}, α_{2} ⋄_{2} σ_{2}, Q_{b}) and α_{2} ∈ ftv(∀ (Q_{b}) σ_{1}) (\underline{43}). From (41), we have ∀ (Q_{b}) σ_{1} ∉ V (\underline{44}). We can derive (Q_{1}) ∀ (Q_{b}) σ_{1} ⊑ α_{1} by I-Drop^{⋆}, and I-Hyp or A-Hyp. Hence, (Q_{2}) ∀ (Q_{b}) σ_{1} ⊑ α_{1} holds by Lemma 3.6.4 and (3). With (40) and R-Trans, we get (Q_{2}) ∀ (Q_{b}) σ_{1} ⊑ α_{2} (\underline{45}). By Property 2.1.7.ii (page 68), (43), and (45), we have ∀ (Q_{b}) σ_{1} ≡ α_{2}, which is not possible by (44). Hence, the hypothesis α_{2} ∈ dom(Q_{1}/σ_{1}) is not true. Similarly, we can show α_{1} ∉ dom(Q_{1}/σ_{2}) (\underline{46}). As a consequence, the algorithm does not fail on the first step.

We now gather the necessary intermediate results to use the completeness of the update algorithm (Lemma 4.2.4). This proof is quite similar to the case (α, τ) above. It is a little more intricate, though, because both bounds are type schemes (not monotypes), and so is their unifier. If ⋄_{1} is rigid, we have (Q_{1}) σ_{1} ⊏ − α_{1} (\underline{47}) by A-Hyp, and (Q_{1}) σ_{1} ⊑ α_{1} (\underline{48}) by I-Abstract. If ⋄_{1} is flexible, we have (48) directly by I-Hyp. By Lemma 3.6.4, (47), (48), and (3), we get (Q_{2}) σ_{1} ⊏ − α_{1} (\underline{49}) (when ⋄_{1} is rigid), and (Q_{2}) σ_{1} ⊑ α_{1} (\underline{50}). By Property 3.2.3.i, (49), and (41), we get (Q_{2}) σ_{1} ⊏ − Q_{2}(α_{1}) (\underline{51}) (when ⋄_{1} is rigid). By Property 3.2.3.ii, (50), and (41), we get (Q_{2}) σ_{1} ⊑ Q_{2}(α_{1}) (\underline{52}). Similarly, we have (Q_{2}) σ_{2} ⊑ Q_{2}(α_{2}) (\underline{53}), and (Q_{2}) σ_{2} ⊏ − Q_{2}(α_{2}) when ⋄_{2} is rigid. By Property 2.2.2.v (page 69) and (40), we have (Q_{2}) Q_{2}(α_{1}) ≡ Q_{2}(α_{2}) (\underline{54}). Let σ_{3} be Q_{2}(α_{1}) (\underline{55}). Note that by Definition 2.2.1, we have σ_{3} ∉ V (\underline{56}). By (52) and (55), we have (Q_{2}) σ_{1} ⊑ σ_{3} (\underline{57}). By (53), (55), and (54), we get (Q_{2}) σ_{2} ⊑ σ_{3} (\underline{58}). By induction hypothesis, (3), (41), (56), (57), and (58), polyunify (Q_{1}, σ_{1}, σ_{2}) succeeds with (Q′, σ′_{3}) such that (Q′, γ≥σ′_{3}) ⊑^{I∪{γ}} (Q_{2}, γ≥σ_{3}) holds. By Lemma 3.6.1 (page 113), there exists a renaming ϕ disjoint from I ∪ {γ} and a substitution θ such that (Q′, γ ≥ σ′_{3}) ⊑^{J∪\{γ\}} (ϕ(Q_{2}), γ ≥ ϕ(σ_{3}), \underline{θ}) (\underline{59}) holds, J is the domain dom(Q′/I ∪ ftv(σ′_{3})) (\underline{60}), and dom(θ) ⊆ J − I (\underline{61}). From (59), PE-Comm, and (61), we get (Q′, γ ≥ σ′_{3}) ⊑^{J∪\{γ\}} (ϕ(Q_{2})\underline{θ}, γ ≥ ϕ(σ_{3})) (\underline{62}). Let σ′′_{3} be ϕ(σ_{3}) (\underline{63}) and Q′_{2} be ϕ(Q_{2})\underline{θ} (\underline{64}) Then (62) becomes (Q′, γ≥σ′_{3}) ⊑^{J∪\{γ\}} (Q′_{2}, γ≥σ′′_{3}) (\underline{65}). We get Q′ ⊑^{J} Q′_{2} (\underline{66}) by Property 3.4.2.i (page 106) and PE-Free. By Lemma 4.6.1, we have σ′_{3} ∉ V (\underline{67}). By (60), we have dom(Q′, γ ≥ σ′_{3}/γ) ⊆ J ∪ \{γ\} (\underline{68}). We have (Q′_{2}) σ′_{3} ⊑ σ′′_{3} (\underline{69}) by Property 3.6.5.i (page 114), (65), (68), (67). Additionally, Q_{2} ≡ ϕ(Q_{2})\underline{ϕ} (\underline{70}) holds by Property 3.4.2.iv (page 106), which leads to Q_{2} ≡^{I} ϕ(Q_{2})\underline{θ} (\underline{71}) by Property 3.4.2.i (page 106) and PE-Free. From (71) and (64), we get Q_{2} ≡^{I} Q′_{2} (\underline{72}). By soundness (Lemma 4.4.1), we have (Q′) σ_{1} ⊑ σ′_{3} (\underline{73}). Hence, (Q′_{2}) σ_{1} ⊑ σ′_{3} (\underline{74}) holds by Lemma 3.6.4 and (66). By (46) and Property 4.3.1.i (page 125), we have (α_{1} ⋄_{1} σ_{1})∈ Q′ (\underline{75}) as well as α_{1} ∉ dom(Q′/σ′_{3}) (\underline{76}). By Property 3.2.3.iii (page 103) and (55), we get (Q′_{2}) σ′′_{3} ⊑ α_{1} (\underline{77}). By (77), (69), and R-Trans, we get (Q′_{2}) σ′_{3} ⊑ α_{1} (\underline{78}).

We temporarily consider, in this paragraph, that ⋄_{1} is rigid. Then (51) holds, that is, (Q_{2}) σ_{1} ⊏ − σ_{3}. Then by (70) and Lemma 3.6.4, we get (Q′_{2}\underline{ϕ}) σ_{1} ⊏ − σ_{3}, thus we get (Q′_{2}) ϕ(σ_{1}) ⊏ − ϕ(σ_{3}) by R-Context-R. Since ϕ is a renaming disjoint from I, and by (63) and (42), this gives (Q′_{2}) σ_{1} ⊏ − σ′′_{3} (\underline{79}) . By Lemma 3.6.6, (74), (69) and (79), we get (Q′_{2}) σ_{1} ⊏ − σ′_{3} (\underline{80}) and (Q′_{2}) σ′_{3} ⊏ − σ′′_{3} (\underline{81}). By Lemma 3.6.9, (60), (67), (73), (66), (80), we get (Q′) σ_{1} ⊏ − σ′_{3} (\underline{82}). (Q′) σ_{1} ⊏ − α_{1} holds by A-Hyp and (75). Hence, (Q′_{2}) σ_{1} ⊏ − α_{1} (\underline{83}) holds by Lemma 3.6.4 and (66). By Property 2.2.2.i (page 69), we have (Q′_{2}) α_{1} ≡ Q′_{2}[α_{1}] (\underline{84}). Thus, we get (Q′_{2}) σ_{1} ⊏ − Q′_{2}[α_{1}] (\underline{85}) by R-Trans, (83), and (84). By Corollary 2.3.4, (85) and (41), the bound of Q′_{2}[α_{1}] is rigid. Hence, (Q′_{2}) Q′_{2}(α_{1}) ⊏ − Q′_{2}[α_{1}] holds by A-Hyp. That is, (Q′_{2}) σ′′_{3} ⊏ − α_{1} (\underline{86}) by (63), (84), and R-Trans. Then (Q′_{2}) σ′_{3} ⊏ − α_{1} (\underline{87}) holds by (81), (86), and R-Trans.

We get back to the general case. We have ftv(σ′_{3}) ⊆ J (\underline{88}) from (60). By hypothesis, we have α_{1} ∈ I, thus α_{1} ∈ J (\underline{89}). Let Q_{a} be Q′ ⇐ (α_{1} ⋄_{1} σ′_{3}), let Q_{b} be Q_{a} ⇐ (α_{2} ⋄_{2} σ′_{3}), and Q′_{1} be Q_{b} ⇐ α_{1} ∧ α_{2}. By Lemma 4.2.4 (page 123), (66), (75), (73), (82), (76), (88), (89), (78) and (87), Q_{a} is well-defined and we have Q_{a} ⊑^{J} Q′_{2}. Similarly, Q_{b} is well-defined and we have Q_{b} ⊑^{J} Q′_{2}. By Property 3.4.2.i (page 106), we get Q_{b} ⊑^{I} Q′_{2}, and by (72), we have Q_{b} ⊑^{I} Q_{2}. Then by Lemma 4.2.8 (page 124), we have Q′_{1} ⊑^{I} Q_{2}. This is the expected result.

\underline{The polyunify algorithm}:

By hypothesis, σ_{1}, σ_{2}, and σ_{3} are not in V, and we have (Q_{2}) σ_{1} ⊑ σ_{3} (\underline{1}) and (Q_{2}) σ_{2} ⊑ σ_{3} (\underline{2}). Besides, Q_{1} ⊑^{I} Q_{2} (\underline{3}) holds with I = dom(Q_{1}). Hence, I ⊆ dom(Q_{2}) (\underline{4}). We show that the algorithm does not fail and returns (Q′_{1}, σ′_{3}) such that (Q′_{1}, γ ≥ σ′_{3}) ⊑^{I∪{γ}} (Q_{2}, γ ≥ σ_{3}) holds. We proceed by case on (σ_{1}, σ_{2}).

∘ Case (⊥, σ) or (σ, ⊥): Then we return (Q_{1}, σ). We have (Q_{2}) σ ⊑ σ_{3} (\underline{5}) by (1) or (2). By hypothesis, we have utv(σ) ⊆ dom(Q_{1}), that is utv(σ) ⊆ I. Thus, we have (Q_{1}, γ ≥ σ) ⊑^{I∪{γ}} (Q_{2}, γ ≥ σ) by Property 3.4.2.iii (page 106). Then (Q_{1}, γ ≥ σ) ⊑^{I∪{γ}} (Q_{2}, γ ≥ σ_{3}) holds by PI-Context-L, (5) and PI-Trans.

∘ Case (∀ (P_{1}) τ_{1}, ∀ (P_{2}) τ_{2}): By hypothesis, we have dom(Q_{1}), dom(P_{1}) and dom(P_{2}) disjoint. We have to gather the intermediate results necessary to use the Recomposition Lemma (Lemma 3.6.13), which immediately gives the expected result, as shown below.

By Lemma 3.4.4, (1) and (2), there exist two substitutions θ_{1} and θ_{2} and two alphaconversions of σ_{3}, which we write ∀ (P_{3}) τ_{3} and ∀ (P_{4}) τ_{4} , such that we have

Q_{2}P_{1} ⊑^{dom(Q_{2})∪I_{1}} Q_{2}P_{3}\underline{θ_{1}} (\underline{6}) Q_{2}P_{2} ⊑^{dom(Q_{2})∪I_{2}} Q_{2}P_{4}\underline{θ_{2}}
I_{1} =^{△} dom(P_{1}/ ftv(τ_{1})) I_{2} =^{△} dom(P_{2}/ ftv(τ_{2}))
(Q_{2}P_{3}) θ_{1}(τ_{1}) ≡ τ_{3} (\underline{7}) (Q_{2}P_{4}) θ_{2}(τ_{2}) ≡ τ_{4}

By Lemma 3.6.2 (page 114) and (6), there exists a renaming ϕ_{1} on dom(Q_{2}P_{3}\underline{θ_{1}}), disjoint from dom(Q_{2}) ∪ I_{1}, and a prefix Q_{0} such that we have Q_{2}P_{1} ⊑ ϕ_{1}(Q_{2}P_{3}\underline{θ_{1}})Q_{0}. Note that ϕ_{1}(τ_{1}) is τ_{1}. Since ϕ_{1} is disjoint from dom(Q_{2}), we have Q_{2}P_{1} ⊑ Q_{2}ϕ_{1}(P_{3}\underline{θ_{1}})Q_{0}. We define P′_{3} as ϕ_{1}(P_{3}), τ′_{3} as ϕ_{1}(τ_{3}), and θ′_{1} as the substitution extracted from ϕ_{1}(\underline{θ_{1}}). The last judgment can now be written Q_{2}P_{1} ⊑ Q_{2}P′_{3}\underline{θ′_{1}}Q_{0} (\underline{8}). By Property 1.7.2.i (page 59) and (7), we get (Q_{2}P′_{3}) θ′_{1}(τ_{1}) ≡ τ′_{3} (\underline{9}). Similarly, there exists ϕ_{2} disjoint from dom(Q_{2}) ∪ I_{2} and Q′_{0}, and we define P′_{4} as ϕ_{2}(P_{4}), τ′_{4} as ϕ_{2}(τ_{4}) and θ′_{2} as the substitution extracted from ϕ_{2}(\underline{θ_{2}}), so that we have Q_{2}P_{2} ⊑ Q_{2}P′_{4}\underline{θ′_{2}}Q′_{0} (\underline{10}) and (Q_{2}P′_{4}) θ′_{2}(τ_{2}) ≡ τ′_{4} (\underline{11}). By definition, ∀ (P_{4}) τ_{4} is an alpha-conversion of ∀ (P_{3}) τ_{3}, thus there exists a renaming ψ of dom(P_{3}) such that P_{4} = ψ(P_{3}) and τ_{4} = ψ(τ_{3}) hold. Let ψ′ be a renaming mapping dom(P′_{4}) to fresh variables, (that is, outside dom(Q_{1}) ∪ dom(Q_{2}) ∪ dom(P′_{3}) ∪ dom(P_{1}) ∪ dom(P_{2}) ∪ dom(\underline{θ′_{2}}Q′_{0})). Let ϕ be ψ′ ∘ ϕ_{2} ∘ ψ ∘ ϕ_{1}^{¬}, let P_{5} be ψ′(P′_{4}) and τ_{5} be ψ′(τ′_{4}). We have P_{5} = ϕ(P′_{3}) as well as τ_{5} = ϕ(τ′_{3}) (\underline{12}) Hence, ∀ (P_{5}) τ_{5} is an alpha-renaming of ∀ (P′_{3}) τ′_{3}. By Property 3.4.2.iv (page 106), we have Q_{2}P′_{4} ≡ Q_{2}P_{5}ψ′. By Property 3.4.2.iii (page 106), it leads to Q_{2}P′_{4}\underline{θ′_{2}}Q′_{0} ≡ Q_{2}P_{5}ψ′\underline{θ′_{2}}Q′_{0} (\underline{13}). Let θ′′_{2} be ψ′ ∘ θ′_{2} (\underline{14}). By PI-Trans, (13), (10), and (14), we get Q_{2}P_{2} ⊑ Q_{2}P_{5}\underline{θ′′_{2}}Q′_{0} (\underline{15}). By Property 1.7.2.i (page 59) and (11), we get (Q_{2}P_{5}) θ′′_{2}(τ_{2}) ≡ τ_{5} (\underline{16}). By construction, we have P′_{3} # P_{5}.

By Property 3.4.2.iii (page 106) and (8), we get Q_{2}P_{1}P_{2} ⊑ Q_{2}P′_{3}\underline{θ′_{1}}Q_{0}P_{2}, which gives by PE-Comm Q_{2}P_{1}P_{2} ⊑ Q_{2}P_{2}P′_{3}\underline{θ′_{1}}Q_{0} (\underline{17}). By Property 3.4.2.iii (page 106), (15), we get

Q_{2}P_{2}P′_{3}\underline{θ′_{1}}Q_{0} ⊑ Q_{2}P_{5}\underline{θ′′_{2}}Q′_{0}P′_{3}\underline{θ′_{1}}Q_{0}

which gives by PE-Comm

Q_{2}P_{2}P′_{3}\underline{θ′_{1}}Q_{0} ⊑ Q_{2}P′_{3}P_{5}\underline{θ′_{1}}\underline{θ′′_{2}}Q_{0}Q′_{0} (\underline{18})

By PI-Trans, (17) and (18), we have

Q_{2}P_{1}P_{2} ⊑ Q_{2}P′_{3}P_{5}\underline{θ′_{1}}\underline{θ′′_{2}}Q_{0}Q′_{0} (\underline{19})

By Property 3.4.2.v (page 106), we get

Q_{2}P′_{3}P_{5}\underline{θ′_{1}}\underline{θ′′_{2}}Q_{0}Q′_{0} ⊑ Q_{2}P′_{3}\underline{ϕ^{¬}}\underline{θ′_{1}}\underline{θ′′_{2}}Q_{0}Q′_{0} (\underline{20})

Hence, by PI-Trans, (19), and (20), we have

Q_{2}P_{1}P_{2} ⊑ Q_{2}P′_{3}\underline{ϕ^{¬}}\underline{θ′_{1}}\underline{θ′′_{2}}Q_{0}Q′_{0} (\underline{21})

By Lemma 3.6.4, (16), and (20), we have (Q_{2}P′_{3}\underline{ϕ^{¬}}\underline{θ′_{1}}\underline{θ′′_{2}}Q_{0}Q′_{0}) θ′′_{2}(τ_{2}) ≡ τ_{5} (\underline{22}). Moreover, we have

(Q_{2}P′_{3}\underline{ϕ^{¬}}\underline{θ′_{1}}\underline{θ′′_{2}}Q_{0}Q′_{0}) τ_{1} ≡  θ′_{1}(τ_{1}) by Eq-Mono
≡^{(\underline{23})} τ′_{3}  by (9)
=  ϕ^{¬}(τ_{5}) by (12)
≡ τ_{5} by Eq-Mono
≡  θ′′_{2}(τ_{2}) by (22)
≡  τ_{2}  by Eq-Mono

In summary, we have shown that we have (Q_{2}P′_{3}\underline{ϕ^{¬}}\underline{θ′_{1}}\underline{θ′′_{2}}Q_{0}Q′_{0}) τ_{1} ≡ τ_{2} (\underline{24}). Additionally, (Q_{2}) ∀ (P′_{3}\underline{ϕ^{¬}}\underline{θ′_{1}}\underline{θ′′_{2}}Q_{0}Q′_{0}) τ_{1} ≡ ∀ (P′_{3}\underline{ϕ^{¬}}\underline{θ′_{1}}\underline{θ′′_{2}}Q_{0}Q′_{0}) τ′_{3} holds by (23) and R-Context-R, that is, (Q_{2}) ∀ (P′_{3}\underline{ϕ^{¬}}\underline{θ′_{1}}\underline{θ′′_{2}}Q_{0}Q′_{0}) τ_{1} ≡ σ_{3} (\underline{25}). Similarly, we have (Q_{2}) ∀ (P′_{3}\underline{ϕ^{¬}}\underline{θ′_{1}}\underline{θ′′_{2}}Q_{0}Q′_{0}) τ_{2} ≡ σ_{3}. By Property 3.4.2.iii (page 106) and (3), we get Q_{1}P_{1}P_{2} ⊑ Q_{2}P_{1}P_{2}. Hence, we have Q_{1}P_{1}P_{2} ⊑ Q_{2}P′_{3}\underline{ϕ^{¬}}\underline{θ′_{1}}\underline{θ′′_{2}}Q_{0}Q′_{0} (\underline{26}) from (21). Hence, by (26), (24), and induction hypothesis, the call to unify (Q_{1}P_{1}P_{2}, τ_{1}, τ_{2}) succeeds with Q_{0} such that Q_{0} ⊑^{dom(Q_{1}P_{1}P_{2})} Q_{2}P′_{3}\underline{ϕ^{¬}}\underline{θ′_{1}}\underline{θ′′_{2}}Q_{0}Q′_{0} (\underline{27}).

Let (Q_{3}, Q_{4}) be Q_{0}↑ dom(Q_{1}), that is, Q_{0}↑I. By Lemma 3.6.13, (27), and (4), ftv(τ_{1}) ⊆ I ∪ dom(P_{1}), taking J = dom(P_{1}P_{2}), and by (25), we get (Q_{3}, γ ≥ ∀ (Q_{4}) τ_{1}) ⊑^{I∪{γ}} (Q_{2}, γ ≥ σ_{3}). The algorithm returns (Q_{3}, ∀ (Q_{4}) τ_{1}), thus Q′_{1} is Q_{3} and σ′_{3} is ∀ (Q_{4}) τ_{1}. Hence, we have shown that (Q′_{1}, γ ≥ σ′_{3}) ⊑^{I∪{γ}} (Q_{2}, γ ≥ σ_{3}) holds. This is the expected result.

Corollary 4.6.3 Assume Q_{1} ⊑^{I} Q_{2} and τ_{1}, τ_{2} are in Σ_{I}. If (Q_{2}) τ_{1} ≡ τ_{2} holds, then unify (Q_{1}, τ_{1}, τ_{2}) succeeds with Q′_{1} such that Q′_{1} ⊑^{I} Q_{2}.

See proof in the Appendix (page 289).

Theorem 1 For any prefix Q and monotypes τ_{1} and τ_{2}, unify (Q, τ_{1}, τ_{2}) returns the smallest prefix (for the relation ⊑^{dom(Q)}) that unifies τ_{1} and τ_{2} under Q, or fails if there exists no prefix Q′ that unifies τ_{1} and τ_{2} under Q.

This theorem is a direct consequence of the soundness of the unification algorithm (Lemma 4.4.1), of its completeness (Lemma 4.6.2), and of its proof of termination (Lemma 4.5.5). Indeed, given a unification problem, the unification algorithm either fails or returns a prefix Q (termination). It it fails, the unification problem has no solution (completeness). Otherwise, Q is a solution to the unification problem (soundness) and all other solutions are instances of Q (completeness).

First-order unification The next lemma shows that the unification algorithm for MLF returns the same result as the unification algorithm for ML when the given unification problem is actually an ML unification problem.

Lemma 4.6.4 Given two monotypes τ_{1} and τ_{2}, and an unconstrained prefix Q such that τ_{1} and τ_{2} are closed under Q, unify (Q, τ_{1}, τ_{2}) returns Q′ such that Q̂′ is the principal unifier of τ_{1} and τ_{2}, or fails if τ_{1} and τ_{2} cannot be unified.

\underline{Proof}: \underline{Termination}: By Lemma 4.5.5, we know that unify (Q, τ_{1}, τ_{2}) always terminates. \underline{Soundness}: If unify (Q, τ_{1}, τ_{2}) returns a prefix Q′, then by Lemma 4.4.1, we have Q ⊑ Q′ and (Q′) τ_{1} ≡ τ_{2} (\underline{1}). Let θ be Q̂′. By Property 1.5.11.vii (page 54) and (1), we have θ(τ_{1}) = θ(τ_{2}). Hence, θ is a unifier of τ_{1} and τ_{2}. \underline{Completeness}: Assume there exists a substitution θ such that θ(τ_{1}) = θ(τ_{2}). Then (θ)

τ_{1} ≡ τ_{2} (\underline{2}) holds by Eq-Mono. Let I be ftv(σ_{1}) ∪ ftv(σ_{2}). Let Q′′ be an unconstrained

prefix such that ftv(θ(I)) ⊆ dom(Q′′). Then Q ⊑^{I} Q′′\underline{θ} (\underline{3}) holds by PE-Free, PI-

Context-L, and I-Bot. By Corollary 4.6.3, (2), and (3), unify (Q, τ_{1}, τ_{2}) succeeds

and returns Q′ such that Q′ ⊑^{I} Q′′\underline{θ}. By Lemma 3.6.10 (page 116), there exists θ′ such

that we have θ = θ′ ∘ Q̂′. This is the expected result.

138

Part II

The programming language

The expressiveness of types, which we studied in Part I, is richer than in ML: types contain first-class polymorphism. In this part, we explain how to use such an expressiveness of types in the framework of a programming language, MLF, and we show that this language is safe, that is, well-typed programs do not go wrong. Type safety in MLF is shown by the usual combination of progress, which states that a well-typed expression is either a value or can be further reduced, and subject reduction, which states that reduction preserves typings. Since MLF aims at being an extension of ML, the syntax of MLF contains the syntax of ML, along with the same reduction rules. Actually, MLF expressions are exactly ML expressions. Moreover, it will be shown in Corollary 8.1.7 that MLF without type annotations has the same set of typable terms as ML.

Fortunately, the power available in MLF polymorphic types can be introduced thanks to type annotations, which are a set of primitives. Those primitives have no dynamic cost: they behave just like the identity, but their given types make it possible to introduce first-class polymorphism in programs. Of course, such primitives have types that, in general, could not be expressed in ML. Their types need the expressiveness available in MLF. Since we are interested in showing subject reduction, we have to associate a reduction rule to each type annotation. However, the reduction rules associated to some type annotations would need a language of types even richer than MLF types. In other words, it is not possible to associate a reduction rule to every type annotation using the MLF types. Hence, we use a trick, called oracles. Oracles are a simple mark put on an expression, which intuitively stands for a suitable type annotation. Then reduction rules associated to type annotations are easily written using oracles. The language made of MLF and oracles is called MLF_{⋆}. Although we wish to prove type-safety in MLF, we have to show subject-reduction and progress in MLF_{⋆} because type annotations create oracles by reduction. Note that, like type annotations, oracles have no dynamic cost: they just behave like the identity. Their role is only static. Indeed, they are used in replacement of type annotations to allow the introduction of first-class polymorphism. A key difference between oracles and type annotations, or equivalently between MLF_{⋆} and MLF, is that type annotations contain all the type information needed for type inference, whereas oracles do not contain type information, but only indicate places where an annotation should be inserted. As a consequence, type inference is possible in MLF. On the contrary, it is probably undecidable in MLF_{⋆} , just as in System F, even though the undecidability of the latter does not imply the undecidability of the former. See Part III and in particular Chapter 10 for a more detailed discussion about this issue.

This part is organized as follows: we define MLF and MLF_{⋆} in Chapter 5, and we give their static and dynamic semantics. Type safety is shown for MLF_{⋆} in Chapter 6, and type safety for MLF is a direct consequence. A type inference algorithm for MLF is shown sound and complete in Chapter 7. Finally, type annotations are introduced as a set of primitives in Chapter 8. Type annotations can be viewed as a bridge between MLF, which has type inference, and MLF_{⋆}, which has oracles needed for subject reduction.

Chapter 5

Syntax and semantics

This chapter introduces the syntax of MLF_{⋆}, which is the syntax of ML with oracles (Section 5.1). Then its static semantics, that is, the typing rules of MLF_{⋆} are given in Section 5.2. They are similar to ML typing rules, with the additional rule for oracles that allows the reversal of the abstraction relation. This is called revelation. Since implicit revelation would break type inference, oracles are not allowed in MLF, for which we wish to build a type-inference algorithm. They will replaced by explicit type annotations, as described in Chapter 8. Like in ML, we provide a syntax-directed set of typing rules in Section 5.3. Whereas the syntax-directed presentation of ML tries to keep judgments as instantiated as possible, we try to keep MLF_{⋆} judgments as generalized as possible. Indeed, polymorphism has to be kept deeply in type structures, in order to ensure principal types. Binders can always be extruded to outer levels afterwards. Finally, Section 5.4 gives the dynamic semantics of MLF_{⋆}, which is identical to that of ML. Oracles do not contribute to reduction. They are simply propagated to indicate the locations that need to be annotated in reduced expressions .

We also consider a variant of MLF_{⋆}, called UMLF (unannotated MLF), where oracles are all implicit. As expected MLF, MLF_{⋆}, and UMLF have the same set of typable terms, but full type inference is possible only in MLF.

5.1 Syntax

We assume given a countable set of variables, written with letter x, and a countable set of constants c ∈ C. Every constant c has an arity |c|. A constant is either a primitive f or a constructor C. The distinction between constructors and primitives lies in their dynamic semantics: primitives (such as +) are reduced when fully applied, while constructors (such as cons) represent data structures, and are only reduced by

Figure 5.1: Expressions of MLF_{⋆}

a ::= x | c | λ(x) a | a a | let x = a in a  Terms
| (a : ⋆)  Oracles
c ::= f | C  Constants
z ::= x | c  Identifiers

other primitives (or pattern matching in a suitable extension of the language). We use letter z to refer to identifiers, i.e. either variables x or constants c.

Expressions of MLF_{⋆}, written with letter a, are described in Figure 5.1. Expressions are those of ML extended with oracles. An oracle, written (a : ⋆) is a place holder for an implicit type annotation around the expression a. Equivalently, the oracles can be replaced by explicit type annotations before type inference. Explicit annotations (a : σ), which are described in Chapter 8, are actually syntactic sugar for applications (σ) a where (σ) are constants. Some examples given in the introduction use the notation λ(x: σ) a, which is not defined in Figure 5.1 because it is syntactic sugar for λ(x) let x = (x : σ) in a. Similarly, λ(x: ⋆) a means λ(x) let x = (x : ⋆) in a.

The language MLF is the restriction of MLF_{⋆} to expressions that do not contain oracles. Programmers are expected to write their programs in MLF, so that type inference is possible. Reductions rules, however, may introduce oracles. More precisely, oracles are only introduced by type annotation primitives. Hence, the language MLF_{⋆} is only needed to show subject reduction for programs that contain type annotations.

5.2 Static semantics

Typing environments (or typing contexts), written with letter Γ, are lists of assertions of the form z : σ that bind each identifier at most once. We write z : σ ∈ Γ to mean that z is bound in Γ. We note that the order of assertions is not significant in Γ since identifiers are bound at most once. We assume given an initial typing context Γ_{0} mapping constants to closed polytypes. A typing environment Γ extends Γ_{0} whenever for all z : σ in Γ_{0}, we have z : σ in Γ.

Typing judgments are of the form (Q) Γ ⊢ a : σ. A tiny difference with ML is the presence of the prefix Q that assigns bounds to type variables appearing free in Γ or σ. By comparison, this prefix is left implicit in ML because all free type variables have the same (implicit) bound ⊥. In MLF and MLF_{⋆}, we require σ and all polytypes of Γ to be closed with respect to Q, that is, utv(Γ) ∪ utv(σ) ⊆ dom(Q).

Figure 5.2: Typing rules for MLF and MLF_{⋆}

Var ; \frac{z : σ ∈ Γ}{(Q) Γ ⊢ z : σ} App ; \frac{(Q) Γ ⊢ a_{1} : τ_{2} → τ_{1}  (Q) Γ ⊢ a_{2} : τ_{2}}{(Q) Γ ⊢ a_{1} a_{2} : τ_{1}}  Fun ; \frac{(Q) Γ, x : τ_{0} ⊢ a : τ}{(Q) Γ ⊢ λ(x) a : τ_{0} → τ}

Let

\frac{\begin{matrix}(Q) Γ ⊢ a_{1} : σ \\ (Q) Γ, x : σ ⊢ a_{2} : τ \end{matrix}}{(Q) Γ ⊢ let x = a_{1} in a_{2} : τ}

Gen

\frac{(Q, α ⋄ σ) Γ ⊢ a : σ′ α ∉ ftv(Γ)}{(Q) Γ ⊢ a : ∀ (α ⋄ σ) σ′}

Inst \frac{(Q) Γ ⊢ a : σ (Q) σ ⊑ σ′}{(Q) Γ ⊢ a : σ′} Oracle

\frac{(Q) Γ ⊢ a : σ (Q) σ ⊐ − σ′}{(Q) Γ ⊢ (a : ⋆) : σ′}

Typing rules The typing rules of MLF_{⋆} and MLF are described in Figure 5.2. They correspond to the typing rules of ML modulo the richer types, the richer instance relation, and the explicit binding of free type variables in judgments (in the prefix). In addition, Rule Oracle allows for the revelation of polytypes, that is, the transformation of types along the inverse of the abstraction relation. (This rule would have no effect in ML where abstraction is the same as equivalence.) As explained in the introduction, we also consider UMLF, a variant of MLF_{⋆} where oracles are left implicit. This amounts to replacing Rule Oracle by U-Oracle given below or, equivalently, combine Oracle with Inst into U-Inst.

U-Oracle

\frac{(Q) Γ ⊢ a : σ (Q) σ ⊐ − σ′}{(Q) Γ ⊢ a : σ′}

U-Inst \frac{(Q) Γ ⊢ a : σ (Q) σ ⊐ −⊑⊐ − σ′}{(Q) Γ ⊢ a : σ′}

In Rule U-Inst, we have to allow revelation before and after instantiation because ⊑ and ⊐ − do not commute in general, under an arbitrary prefix. However, ⊐ −⊑⊐ −⊑ happens to be equal^{1} to ⊐ −⊑⊐ −. Thus, Rule U-Inst never needs to be used twice on the same expression.

As in ML, there is an important difference between rules Fun and Let: while typechecking their bodies, a let-bound variable can be assigned a polytype, but a λbound variable can only be assigned a monotype in Γ. Indeed, the latter must be guessed while the former can be inferred from the type of the bound expression. This restriction is essential to enable type inference. Notice that a λ-bound variable can refer to a polytype abstractly via a type variable α bound to a polytype σ in Q. However, this will not make it possible to take different instances of σ while typing the body of the abstraction, unless the polytype bound σ of α is first revealed by an oracle. Indeed, the only possible instances of α under a prefix Q that contains the binding (α = σ) are types equivalent to α under Q, as shown by Lemma 2.1.6. However, (Q) α ≡ σ does not hold (see Property 1.5.11.x (page 54)). Thus, if x : α is in the typing context Γ, the only way of typing x (modulo equivalence) is (Q) Γ ⊢ x : α, whereas (Q) Γ ⊢ x : σ is not derivable. Conversely, (Q) Γ ⊢ (x : ⋆) : σ is derivable, since (Q) α ⊐ − σ holds. This prevents, for example, λ(x) x x from being typable in MLF—see Example 6.2.12.

1This statement is not shown in this document. It is proved under an unconstrained prefix using the Diamond Lemma (Lemma 2.8.4).

5.2.1 ML as a subset of MLF

ML can be embedded into MLF by restricting all bounds in the prefix Q to be unconstrained. Rules Gen and Inst are then exactly those of ML, by Lemma 3.4.7. Hence, any closed program typable in ML is also typable in MLF.

The converse will be shown in Section 8.1; that is, terms typable in MLF without primitives are also typable in ML.

5.2.2 Examples of typings

In this section, we consider three examples of typings:

• The first one illustrates that the canonical typing in MLF (or principal typing) of a term can be quite different from its typing in ML.

• The second example focuses on the role of rigid bindings in types: we introduce two constants whose type differ only by one rigid binding. In the type of the first constant, a single rigid binding is used. In the type of the second constant, the same rigid binding is duplicated. We compare the typing of expressions using either one of these constants.

• The third example considers the “app” property, which illustrates the compositionality of MLF.

Example 5.2.9 This first example of typing illustrates the use of polytypes in typing derivations: we consider the simple expression K′ defined by λ(x) λ(y) y. Following ML, one possible typing derivation is (recall that (α, β) stands for (α ≥ ⊥, β ≥ ⊥)):

Gen \frac{Fun \frac{(α, β) x : α, y : β ⊢ y : β}{Fun \frac{(α, β) x : α ⊢ λ(y) y : β → β}{(α, β) ⊢ K′ : α → (β → β)}}}{⊢ K′ : ∀ (α, β) α → (β → β)}

There is, however, another typing derivation that infers a more general type for K′ in MLF (for conciseness we write Q for (α, β ≥σ_{id}), and we recall that σ_{id} is ∀ (α) α → α):

Inst Gen \frac{Fun \frac{(Q, γ) x : α, y : γ ⊢ y : γ}{(Q, γ) x : α ⊢ λ(y) y : γ → γ}}{(Q) x : α ⊢ λ(y) y : σ_{id}} \overline{(Q) σ_{id} ⊑ β} I-Hyp

Fun \frac{(Q) x : α ⊢ λ(y) y : β}{Gen \frac{(Q) ⊢ K′ : α → β}{⊢ K′ : ∀ (Q) α → β}}

Notice that the polytype ∀ (Q) α → β is more general than ∀ (α, β) α → (β → β), which follows from Example 1.8.7. Actually, this derivation gives the principal type of K′. Satisfyingly, this is also the type inferred by the type inference algorithm (given in Chapter 7), and implemented in a prototype of MLF:

    # let k' = fun x y -> y ;;
    val k' : ['a] ['b > ['c] 'c -> 'c] 'a -> 'b

Here are graphs representing the type of K′. The left-hand graph represents its principal type in MLF, given above. The right-hand graph represents the type of K′ in ML, that is, ∀ (α, β) α → β → β.

→ ⊥  → ⊥  ^{→ ⊥  → ⊥}

Example 5.2.10 This example emphasizes the role of the relation ⊐ − during typing. Let f_{1} and f_{2} be two functions of respective types:

\begin{matrix}σ_{1} & =^{△} & ∀ (α = σ_{id}) ∀ (α′ = σ_{id}) & α → α′ \\ σ_{2} & =^{△} & ∀ (α = σ_{id}) & α → α \end{matrix}

The graphs representing these types are the following:

→ → ⊥  → ⊥  \begin{matrix}→ \\ → \\ ⊥ \end{matrix}

Intuitively, f_{1} and f_{2} behave like the identity (they just return their argument). Let us check that the expression a_{1} defined as λ(x) (f_{1} x) x, is typable but a_{2}, defined as λ(x) (f_{2} x) x, is not. In the former case, we can easily derive the following judgment, where Q stands for (α = σ_{id}, α′ = σ_{id}) and Γ is x : α:

App \frac{(Q) Γ ⊢ f_{1} : α → α′  (Q) Γ ⊢ x : α}{(Q) Γ ⊢ f_{1} x : α′ (\underline{1})}

Hence (α = σ_{id}) Γ ⊢ f_{1} x : ∀ (α′ = σ_{id}) α′ holds by Rule Gen since α′ is not free in the context. By Rule Eq-Var, we get ∀ (α′ = σ_{id}) α′ ≡ σ_{id} (under any prefix). Besides, we also have σ_{id} ⊑ α → α under any prefix that binds α. Consequently, we get (α = σ_{id}) Γ ⊢ f_{1} x : α → α by Rule Inst. Hence, ⊢ λ(x) (f_{1} x) x : σ_{2} follows by App and Gen. However, when f_{1} is replaced by f_{2}, we can only derive (Q) Γ ⊢ f_{2} x : α instead of the judgment (1) and we cannot apply Rule Gen with α. Additionally, it happens that σ_{1} ⊏ − σ_{2} is derivable (see for example Rule A-Alias’), thus (f_{2} : ⋆) can be given the type σ_{1} so that λ(x) (f_{2} : ⋆) x x is typable.

We see that the expression a_{2} is not typable as such, but becomes typable with an oracle. In this very example, the role of the oracle is to “transform” the function f_{2} into f_{1}. The function f_{2} can be viewed as the identity, that is, a silent function, whereas f_{1} can be viewed as a type annotation. Hence, the oracle transforms a silent binding let x = x in x x into an annotated binding let x = (x : σ_{id}) in x x.

Example 5.2.11 We recall that app is defined as λ(x) λ(y) x y. An interesting property of MLF is that whenever an application a_{1} a_{2} is typable, then app a_{1} a_{2} is also typable, without any need for extra type annotations. Indeed, app has type ∀ (α, β) (α → β) → α → β (the typing derivation is similar to the one in ML). Besides, since a_{1} a_{2} is typable, we must have a_{1} of type τ_{2} → τ_{1} and a_{2} of type τ_{2}. Then by instantiation, app can be given the type (τ_{2} → τ_{1}) → τ_{2} → τ_{1}, and app a_{1} a_{2} is easily typed, then. It should be noted that, whereas only monotypes seem to be used, τ_{1} and τ_{2} can actually be type variables bound to polytypes in the current prefix. We see that although τ_{1} and τ_{2} can be aliases to polytypes, they are transparently propagated to the type of app by implicit instantiation.

Figure 5.3: Syntax-directed typing rules

Var^{▽} \frac{z : σ ∈ Γ}{(Q) Γ ⊢^{▽} z : σ}

Fun^{▽}

\frac{α ∉ ftv(τ_{0}) (QQ′) Γ, x : τ_{0} ⊢^{▽} a : σ dom(Q′) # ftv(Γ)}{(Q) Γ ⊢^{▽} λ(x) a : ∀ (Q′, α ≥ σ) τ_{0} → α}

App^{▽} \frac{\begin{matrix}(Q) Γ ⊢^{▽} a_{1} : σ_{1} & (Q) Γ ⊢^{▽} a_{2} : σ_{2} \\ (Q) σ_{1} ⊑ ∀ (Q′) τ_{2} → τ_{1} & (Q) σ_{2} ⊑ ∀ (Q′) τ_{2} \end{matrix}}{(Q) Γ ⊢^{▽} a_{1} a_{2} : ∀ (Q′) τ_{1}} Let^{▽}

\frac{\begin{matrix}(Q) Γ ⊢^{▽} a_{1} : σ_{1} \\ (Q) Γ, x : σ_{1} ⊢^{▽} a_{2} : σ_{2} \end{matrix}}{(Q) Γ ⊢^{▽} let x = a_{1} in a_{2} : σ_{2}}

Oracle^{▽}

\frac{\begin{matrix}(Q) Γ ⊢^{▽} a : σ \\ (Q) σ ⊑ σ′′ & (Q) σ′′ ⊐ − σ′ \end{matrix}}{(Q) Γ ⊢^{▽} (a : ⋆) : σ′}

5.3 Syntax-directed presentation

As in ML, we can replace the typing rules of MLF_{⋆} by a set of equivalent syntax-directed typing rules, which are given in Figure 5.3. Naively, a sequence of non-syntax-directed typing rules Gen and Inst should be placed around any other rule. However, many of these occurrences can be proved unnecessary by following an appropriate strategy. For instance, in ML, judgments are maintained instantiated as much as possible and are only generalized on the left-hand side of Rule Let. In MLF_{⋆}, this strategy would require more occurrences of generalization. Instead, we prefer to maintain typing judgments generalized as much as possible. Then it suffices to allow Rule Gen right after Rule Fun and to allow Rule Inst right before Rule App (see rules Fun^{▽} and App^{▽}). Syntaxdirected rules are slightly less intuitive. However, they are much more convenient for proving formal properties. In particular, induction on derivations can be replaced by structural induction on terms. The equivalence between the syntax-directed and original presentations of the typing rules is stated in section 6.2.

5.4 Dynamic semantics

The semantics of MLF_{⋆} is the standard call-by-value semantics of ML. Another choice, such as e.g. call-by-name would satisfy the same essential properties, including type safety. However, the discussion about imperative features such as references, to be found in Part III, assumes a call-by-value semantics. We present it as a small-step reduction semantics. Values and call-by-value evaluation contexts are described below.

v ::= w | (w : ⋆)
w ::= λ(x) a
| f v_{1} … v_{n}  n < |f|
| C v_{1} … v_{n}  n ≤ |C|
E ::= [ ] | E a | v E | (E : ⋆) | let x = E in a

A value is either a function (λ(x) a), a partially applied primitive (f v_{1} … v_{n}), or a constructed value C v_{1} … v_{n}. Additionally, it can be an annotated value, that is (w : ⋆), where w is a non-annotated value. We distinguish two classes, v and w, in order to forbid ((v : ⋆) : ⋆), which is not a value. Indeed, it can be reduced to (v : ⋆) by Rule ⋆⋆, to be found next. The reduction relation ⟶ is parameterized by a set of δ-rules of the form (δ):

f v_{1} … v_{n} ⟶ a when |f| = n  (δ)
(λ(x) a) v ⟶ a[v/x]  (β_{v})
let x = v in a ⟶ a[v/x]  (β_{let})
(v_{1} : ⋆) v_{2} ⟶ (v_{1} v_{2} : ⋆)  (⋆)
((v : ⋆) : ⋆) ⟶ (v : ⋆)  (⋆⋆)

The main reduction is the β-reduction that takes two forms Rule (β_{v}) and Rule (β_{let}). Oracles are maintained during reduction, to which they do not contribute: they are simply pushed out of applications by Rule (⋆). Moreover, two oracles do not have more power than one single oracle, as stated by Rule (⋆⋆). Finally, the reduction is the smallest relation containing (δ), (β_{v}), (β_{let}), (⋆), and (⋆⋆) rules that is closed under E-congruence:

E[a] ⟶ E[a′] if a ⟶ a′  (Context)

Note that the semantics of MLF is untyped. See Remark 9.3.1 on page 184 for more discussion of this issue.

Chapter 6

Type Safety

Type soundness of MLF_{⋆} is shown as usual by a combination of subject reduction, which ensures that typings are preserved by reduction, and progress, which ensures that welltyped programs that are not values can be further reduced. A few standard results are shown first in Section 6.1. We show subject reduction and progress in the syntaxdirected system; hence, we need to prove the equivalence between the syntax-directed system and the original one; this is done in Section 6.2. Type safety is shown for MLF_{⋆} parameterized by a set of primitives and constructors. Of course, some assumptions about the behavior and the types of primitives are required. These assumptions, as well as subject reduction and progress, are addressed in Section 6.3.

6.1 Standard Properties

In this section, we give a few standard properties, which are similar to well known properties in ML. A first one states that typing judgments can be renamed. Then we show that the hypotheses gathered in the prefix can be instantiated (Rule Weaken) and that the hypotheses of the typing environment can be replaced by more general assumptions (Rule Strengthen). Finally, the Substitutivity Lemma is a key result for showing subject-reduction.

6.1.1 Renaming and substitutions

Lemma 6.1.1 (Renaming of judgment) Given a derivation of the judgment (Q) Γ ⊢ a : σ and a renaming ϕ on type variables, the judgment (ϕ(Q)) ϕ(Γ) ⊢ a : ϕ(σ) admits a derivation of the same size.

\underline{Proof}: By induction on the derivation of (Q) Γ ⊢ a : σ. All cases are easy.

6.1.2 Strengthening and weakening typing judgments

The instance relation between typing contexts (Q) Γ′ ⊑ Γ is an abbreviation for

∀z ∈ dom(Γ), we have z ∈ dom(Γ′) and (Q) Γ′(z) ⊑ Γ(z)

The next lemma states two standard properties of typing judgments, presented in the form of rules Strengthen and Weaken, along with a variant Weaken^{⋆}. In a judgment (Q) Γ ⊢ a : σ, the polytype σ can be weakened as described by Rule Inst. Conversely, the context Γ can be strengthened, as described by Rule Strengthen. In addition to weakening the type or strengthening the context, the whole judgment can be instantiated. In ML, this is expressed by stability of typing judgments under substitutions. In MLF, this is modeled by instantiating the prefix of the typing judgment, as described by Rule Weaken. To see this, consider prefixes as a generalization of substitutions. An ML derivation Γ ⊢ a : σ would be represented in MLF by (Q) Γ ⊢ a : σ where Q assigns unconstrained bounds to the type variables of ftv(Γ) ∪ ftv(σ). The substitution lemma says that for any substitution θ, the derivation θ(Γ) ⊢ a : θ(σ) (\underline{1}) is also valid. In MLF, applying Rule Weaken to (Q) Γ ⊢ a : σ, we can first deduce that the derivation (Q′, (α ≥ θ(α))^{α∈Q}) Γ ⊢ a : σ holds where Q′ assigns unconstrained bounds to ftv(θ(Q)). By notation, this is (Q′, \underline{θ}) Γ ⊢ a : σ. Then we can derive (Q′) θ(Γ) ⊢ a : θ(σ) (which represents the ML judgment (1)) using rules Strengthen, Gen and Inst and the equivalences (Q′\underline{θ}) Γ ≡ θ(Γ) and (Q′\underline{θ}) σ ≡ θ(σ). In summary, the stability of typing judgments under substitution in ML is here expressed as Rule Weaken, which allows the instantiation of the current prefix. Indeed, prefixes are a generalization of substitutions, and prefix instance corresponds to substitution composition. While Rule Weaken requires Q′ to be an instance of Q under interface dom(Q), Rule Weaken^{⋆} specifies an interface I which must only contain free variables of Γ and σ; this version is not used further.

Lemma 6.1.2 The following rules are admissible:

Strengthen

\frac{(Q) Γ ⊢ a : σ (Q) Γ′ ⊑ Γ}{(Q) Γ′ ⊢ a : σ}

Weaken

\frac{(Q) Γ ⊢ a : σ Q ⊑ Q′}{(Q′) Γ ⊢ a : σ}

\frac{(Q) Γ ⊢ a : σ  ftv(Γ, σ) ⊆ I  Q ⊑^{I} Q′}{(Q′) Γ ⊢ a : σ}

Weaken^{⋆}

6.1 Standard Properties  153

\underline{Proof}: We prove Strengthen by induction on the derivation of (Q) Γ ⊢ a : σ. Cases App, Fun, Let, Inst and Oracle are by induction hypothesis.

∘ Case Var: We have (Q) Γ ⊢ z : σ and z : σ is in Γ. By definition, z : σ′ is in Γ′, with (Q) σ′ ⊑ σ. Hence, we have (Rule Var) (Q) Γ′ ⊢ z : σ′ and we get the expected result (Q) Γ′ ⊢ z : σ by Rule Inst.

∘ Case Gen: The premises are (Q, α⋄σ_{a}) Γ ⊢ a : σ′ (\underline{1}) and α ∉ ftv(Γ). The conclusion is (Q) Γ ⊢ a : ∀ (α ⋄ σ_{a}) σ′. We have (Q) Γ′ ⊑ Γ by hypothesis. By well-formedness all free type variables of Γ and Γ′ must be bound in Q, and α ∉ dom(Q) holds by hypothesis, hence we have α ∉ ftv(Γ′). The result is by induction hypothesis on (1) and Rule Gen, then.

We prove Weaken by induction on the derivation of (Q) Γ ⊢ a : σ. Case Var is immediate. Cases Fun, App, and Let are by induction hypothesis. Case Gen: The premise is (Q, α⋄σ_{1}) Γ ⊢ a : σ_{2} (\underline{2}) and α ∉ ftv(Γ). The conclusion is (Q) Γ ⊢ a : ∀ (α⋄σ_{1}) σ_{2}. By alpha-conversion, we can freely assume that α ∉ dom(Q′). By Property 3.4.2.iii (page 106) and the hypothesis Q ⊑ Q′, we get (Q, α ⋄ σ_{1}) ⊑ (Q′, α ⋄ σ_{1}). By induction hypothesis and (2), we get a derivation of (Q′, α ⋄ σ_{1}) Γ ⊢ a : σ_{2}. By Rule Gen, we get (Q′) Γ ⊢ a : ∀ (α ⋄ σ_{1}) σ_{2}, which is the expected result. Cases Inst and Oracle are direct consequences of Lemma 3.6.4.

Proof of Weaken^{⋆}: The hypotheses are (Q) Γ ⊢ a : σ (\underline{1}), ftv(Γ) ⊆ I (\underline{2}), ftv(σ) ⊆ I (\underline{3}), and Q ⊑^{I} Q′ (\underline{4}). By Lemma 3.6.2 (page 114) and (4), there exists a renaming ϕ disjoint from I and a prefix Q_{0} such that Q ⊑ ϕ(Q′)Q_{0} (\underline{5}) and dom(Q_{0}) # I (\underline{6}) hold. Hence, by Weaken, (5) and (1), we have (ϕ(Q′)Q_{0}) Γ ⊢ a : σ. By Rule Gen, (6) and (2), we get (ϕ(Q′)) Γ ⊢ a : ∀ (Q_{0}) σ (\underline{7}). By Eq-Free, (6) and (3), we get ∀ (Q_{0}) σ ≡ σ (\underline{8}). Hence, (ϕ(Q′)) Γ ⊢ a : σ (\underline{9}) holds by Rule Inst, (7), and (8). The renaming ϕ is disjoint from I, thus ϕ^{¬}(Γ) = Γ and ϕ^{¬}(σ) = σ hold by (2) and (3). By (9) and Lemma 6.1.1 applied with the renaming ϕ^{¬}, we get (Q′) Γ ⊢ a : σ, which is the expected result.

Corollary 6.1.3 If QQ′ is well-formed and if (Q) Γ ⊢ a : σ holds, then so does (QQ′) Γ ⊢ a : σ.

As a consequence, the following rule is admissible:

App^{⋆} ; \frac{(Q) Γ ⊢ a_{1} : ∀ (Q′) τ_{2} → τ_{1} (Q) Γ ⊢ a_{2} : ∀ (Q′) τ_{2}}{(Q) Γ ⊢ a_{1} a_{2} : ∀ (Q′) τ_{1}}

\underline{Proof}: \underline{Corollary 6.1.3} is a direct consequence of Rule Weaken, observing that Q ≡ QQ′ holds by PE-Free.

154  Type Safety

\underline{App^{⋆}} is derivable: By alpha-conversion, we can assume that Q′ # Q and dom(Q′) # ftv(Γ). By Corollary 6.1.3, we have (QQ′) Γ ⊢ a_{1} : ∀ (Q′) τ_{2} → τ_{1} (\underline{1}) as well as (QQ′) Γ ⊢ a_{2} : ∀ (Q′) τ_{2} (\underline{2}). By Rule I-Drop^{⋆}, we have (QQ′) ∀ (Q′) τ_{2} → τ_{1} ⊑ τ_{2} → τ_{1} (\underline{3}) as well as (QQ′) ∀ (Q′) τ_{2} ⊑ τ_{2} (\underline{4}). Hence, (QQ′) Γ ⊢ a_{1} : τ_{2} → τ_{1} and (QQ′) Γ ⊢ a_{2} : τ_{2} hold by Rule Inst, (1) and (3), as well as (2) and (4) respectively. Then (QQ′) Γ ⊢ a_{1} a_{2} : τ_{1} holds by App. Finally, (Q) Γ ⊢ a_{1} a_{2} : ∀ (Q′) τ_{1} holds by Rule Gen.

6.1.3 Substitutivity

Lemma 6.1.4, next, is a usual result in ML, which states that unused hypotheses can be added to the typing environment.

Lemma 6.1.4 If Γ and Γ′ have disjoint domains, and if (Q) Γ ⊢ a : σ holds, then so does (Q) Γ, Γ′ ⊢ a : σ.

See proof in the Appendix (page 289).

The substitutivity lemma is a key result for showing subject reduction.

Lemma 6.1.5 (Substitutivity) If we have (Q) Γ, x : σ ⊢ a_{0} : σ_{0} and (Q) Γ ⊢ a : σ, then (Q) Γ ⊢ a_{0}[a/x] : σ_{0} holds.

\underline{Proof}: We write θ for the substitution [a/x]. By hypothesis, (Q) Γ ⊢ a : σ (\underline{1}) holds. The proof is by induction on the derivation of (Q) Γ, x : σ ⊢ a_{0} : σ_{0}. Cases App, Inst, Gen and Oracle are by induction hypothesis.

∘ Case Fun: The premise is (Q) Γ, x : σ, y : τ_{0} ⊢ a_{1} : τ (\underline{2}) and the conclusion is (Q) Γ, x : σ ⊢ λ(y) a_{1} : τ_{0} → τ. The judgment (2) can as well be written (Q) Γ, y : τ_{0}, x : σ ⊢ a_{1} : τ (\underline{3}). By Lemma 6.1.4 and (1), we have (Q) Γ, y : τ_{0} ⊢ a : σ (\underline{4}). By induction hypothesis, (3), and (4) we have (Q) Γ, y : τ_{0} ⊢ θ(a_{1}) : τ. Hence, by Rule Fun, we get (Q) Γ ⊢ θ(λ(y) a_{1}) : τ_{0} → τ, which is the expected result.

∘ Case Var: we have (Q) Γ, x : σ ⊢ z : σ_{0}. If z is not x, then θ(z) is z, and we have (Q) Γ ⊢ θ(z) : σ_{0}. Otherwise, we have z = x and σ_{0} = σ. By hypothesis, (Q) Γ ⊢ x : σ holds, that is, (Q) Γ ⊢ a : σ.

∘ Case Let: we have (Q) Γ, x : σ ⊢ let y = a_{1} in a_{2} : σ_{0}, and the premises are (Q) Γ, x : σ ⊢ a_{1} : σ_{y} (\underline{5}) and (Q) Γ, x : σ, y : σ_{y} ⊢ a_{2} : σ_{0}, which can also be written (Q) Γ, y : σ_{y}, x : σ ⊢ a_{2} : σ_{0} (\underline{6}). Thanks to Lemma 6.1.4 and (1), we have (Q) Γ, y : σ_{y} ⊢ a : σ. By induction hypothesis applied once to (5) and once to (6), we get (Q) Γ ⊢ θ(a_{1}) : σ_{y} and (Q) Γ, y : σ_{y} ⊢ θ(a_{2}) : σ_{0}. Thus (Q) Γ ⊢ let y = θ(a_{1}) in θ(a_{2}) : σ_{0} holds by Rule Let. This is equivalent to (Q) Γ ⊢ θ(let y = a_{1} in a_{2}) : σ_{0}, which is the expected result.

6.2 Equivalence between the syntax-directed system and the original system

The equivalence between the syntax-directed (⊢^{▽}) and original presentations (⊢) of the typing rules is proved by showing the inclusion of ⊢^{▽} in ⊢ first. The inverse inclusion is not so direct, and we start by proving the equivalence between ⊢ and an intermediate type system (⊢′), described below.

Lemma 6.2.1 The system ⊢^{▽} is included in ⊢, that is, if (Q) Γ ⊢^{▽} a : σ is derivable, then (Q) Γ ⊢ a : σ is derivable.

See proof in the Appendix (page 289).

We introduce an auxiliary system ⊢′ composed of the rules of ⊢^{▽} plus rules Gen and Inst.

Lemma 6.2.2 The system ⊢ is included in ⊢′.

\underline{Proof}: Indeed, rules Var, Fun, App, Let, and Oracle can be derived using (respectively) Var^{▽}, Fun^{▽} and Inst, App^{▽}, Let^{▽}, and Oracle^{▽}. Hence, any derivation in the system ⊢ can be rewritten into a derivation into the system ⊢′.

Lemma 6.2.3 The following rule is admissible:

Strengthen’

\frac{(Q) Γ ⊢′ a : σ (Q) Γ′ ⊑ Γ}{(Q) Γ′ ⊢′ a : σ}

The proof is similar to the proof of Rule Strengthen. The details can be found in the Appendix (page 290).

It remains to be shown that ⊢′ is included in ⊢^{▽}. Intuitively, occurrences of Rule Gen can be moved up (and absorbed on the way up), whereas occurrences of Rule Inst can be moved down (and partially absorbed by Rule App).

Definition 6.2.4 The size of a typing derivation in the system ⊢′ is the number of rules it uses, ignoring the right premise in Rule Let^{▽}.

In the following properties, we show that the system ⊢′ keeps judgments as generalized as possible: Rule Gen can always be merged with other rules.

Properties 6.2.5

i) If we have a derivation of (Q) Γ ⊢′ a : σ_{a} ending with Rule Gen, then there exists σ′_{a} and a strictly smaller derivation of (Q) Γ ⊢′ a : σ′_{a} such that σ_{a} ≡ σ′_{a} holds.

ii) If we have a derivation of (Q) Γ ⊢′ a : σ_{a}, then there exists σ′_{a} such that we have

a derivation of (Q) Γ ⊢′ a : σ′_{a} not using Gen, and such that σ_{a} ≡ σ′_{a} hold. iii) If we have a derivation of (Q) Γ ⊢′ a : σ_{a} not using Gen, then there exists σ′_{a}

such that (Q) Γ ⊢^{▽} a : σ′_{a} and (Q) σ′_{a} ⊑ σ_{a} holds.

See proof in the Appendix (page 290).

Thanks to these properties, it is now possible to state the equivalence between the syntax-directed system and the original system:

Lemma 6.2.6 (Syntax-Directed Typings) We have (Q) Γ ⊢ a : σ iff there exists σ′ such that (Q) Γ ⊢^{▽} a : σ′ and (Q) σ′ ⊑ σ.

\underline{Proof}: If there exists σ′ such that (Q) Γ ⊢^{▽} a : σ′ and (Q) σ′ ⊑ σ (\underline{1}) hold, then (Q) Γ ⊢ a : σ′ is derivable by Lemma 6.2.1, thus (Q) Γ ⊢ a : σ is derivable by Rule Inst and (1). Conversely, if (Q) Γ ⊢ a : σ holds, then there exists a derivation of (Q) Γ ⊢′ a : σ by Lemma 6.2.2. We get the expected result by Lemmas 6.2.5.ii and 6.2.5.iii, then.

Example 6.2.12 As we claimed in the introduction, a λ-bound variable that is used polymorphically must be annotated. Let us check that λ(x) x x is not typable in MLF by means of contradiction. A syntax-directed type derivation of this expression would be of the form:

Fun^{▽} App^{▽} \frac{\begin{matrix}Var^{▽} (Q) x : τ_{0} ⊢^{▽} x : τ_{0} & (Q) x : τ_{0} ⊢^{▽} x : τ_{0} Var^{▽} \\ (Q) τ_{0} ⊑ ∀ (Q′) τ_{2} → τ_{1} (\underline{2}) & (Q) τ_{0} ⊑ ∀ (Q′) τ_{2} (\underline{1}) \end{matrix}}{(Q) x : τ_{0} ⊢^{▽} x x : ∀ (Q′) τ_{1}} (Q) ∅ ⊢^{▽} λ(x) x x : ∀ (α ≥ ∀ (Q′) τ_{1}) τ_{0} → α

By rules I-Drop^{⋆}, (2), and (1), we get respectively (QQ′) τ_{0} ⊑ τ_{2} → τ_{1} and (QQ′) τ_{0} ⊑ τ_{2}. Then (QQ′) τ_{2} → τ_{1} ≡ τ_{2} follows by Lemma 2.1.6 and R-Trans. Thus, by Property 1.5.11.vii, there exists a substitution θ such that θ(τ_{2}) = θ(τ_{2} → τ_{1}), that is, θ(τ_{2}) = θ(τ_{2}) → θ(τ_{1}), which is impossible.

This example shows the limit of type inference, which is actually the strength of our system! We maintain principal types by rejecting examples where type inference would need to guess second-order types.

Example 6.2.13 Let us recover typability by introducing an oracle and building a derivation for λ(x) (x : ⋆) x. Taking (α = σ_{id}) for Q and α for τ_{0}, we obtain:

App^{▽}

Oracle^{▽} \frac{\begin{aligned}Var^{▽} & (Q) x : α ⊢^{▽} x : α \\ & (Q) α ⊐ − σ_{id} (\underline{3}) \end{aligned}}{(Q) x : α ⊢^{▽} (x : ⋆) : σ_{id}}  (Q) x : α ⊢^{▽} x : α Var^{▽}
(Q) σ_{id} ⊑ α → α
Fun^{▽} \frac{(Q) x : α ⊢^{▽} (x : ⋆) x : α}{⊢^{▽} λ(x) (x : ⋆) x : ∀ (α = σ_{id}) α → α}

The oracle plays a crucial role in (3)—the revelation of the type scheme σ_{id} that is the bound of the type variable α used in the type of x. We have (Q) σ_{id} ⊑ α, indeed, but the converse relation does not hold, so Rule Inst cannot be used here to replace α by its bound σ_{id}. Chapter 8 shows how an explicit annotation (x : σ_{id}) can replace the oracle (x : ⋆).

6.3 Type safety

Of course, type soundness cannot hold without some assumptions relating the static semantics of constants described by the initial typing context Γ_{0} and their dynamic semantics. To ease the presentation, we introduce a relation ⊆^{Γ} between programs for any typing environment Γ extending Γ_{0}: we write a ⊆^{Γ} a′ if and only if every typing of a under Γ, i.e. every pair (Q, σ) such that (Q) Γ ⊢ a : σ holds, is also a typing of a′. A relation R on programs preserves typings under Γ whenever it is a sub-relation of ⊆^{Γ}. Then showing subject-reduction for a given reduction relation R under a typing environment Γ amounts to showing that R preserve typings under Γ.

We now introduce the three hypotheses that the constants are required to validate.

Definition 6.3.1 (Hypotheses) We assume that the following properties hold for constants.

(H0) (Arity) Each constant c ∈ dom(Γ_{0}) has a closed type Γ_{0}(c) of the form ∀ (Q) τ_{1} → … τ_{|c|} → τ and such that (∀ (Q) τ)/ϵ is not in {→, ⊥} whenever c is a constructor.

(H1) (Subject-Reduction) All δ-rules preserve typings. That is (δ) is a sub-relation of ⊆^{Γ}, for any Γ extending Γ_{0}.

(H2) (Progress) Any expression a of the form f v_{1} … v_{|f|}, such that (Q) Γ ⊢ a : σ is in the domain of (δ).

The first hypothesis (H0) links the dynamic arity |c| of a constant c to its type. Intuitively, a constant of arity n must have a type with exactly n arrows, no more. The second hypothesis (H1) simply states subject-reduction for each constant. The third hypothesis (H2) is progress for primitives, that is, when a primitive f is applied to |f| arguments, it must reduce to a value.

The language MLF_{⋆} is parameterized by a set of primitives and constants that satisfy the hypotheses above. These hypotheses are sufficient to ensure type safety, which we prove by a combination of subject-reduction, next, and progress. In MLF and MLF_{⋆}, subject reduction holds only under Γ_{0} (actually, under any closed typing environment extending Γ_{0}). This means that reduction is only allowed at top-level, and not under a λ-abstraction. As a counterexample, consider the expression λ(x) (x : ⋆) x. It is typable in MLF_{⋆}. However, if we allowed reduction under λ-abstractions, we could use Rule (⋆) to reduce the above expression to λ(x) (x x : ⋆), which is not typable in MLF_{⋆}. It is typable in UMLF, though, adding an implicit oracle on the first occurrence of x. We see that subject reduction does not hold under any context in MLF_{⋆}. This is why subject reduction is stated only under under the initial typing environment Γ_{0} (which may contain any closed bindings, though). Conversely, subject reduction does hold under any typing environment in UMLF. This means that partial reduction is not possible in MLF because it would lose type information needed for type inference. However, it is possible in UMLF where oracles are implicit. We formalize this by giving two statements for subject reduction.

Theorem 2 (Subject reduction) Reduction preserves typings in UMLF, and preserve typings under Γ_{0} in MLF_{⋆}.

\underline{Proof}: We must show that (⟶) is a subrelation of (⊆^{Γ}) in UMLF and a subrelation of (⊆^{Γ_{0}}) in MLF_{⋆}. We proceed by case analysis on the different reduction rules. In each case, by hypothesis, we have an expression a_{1} that reduces to a_{2} and a derivation of (Q) Γ ⊢ a_{1} : σ (\underline{1}). We must show that (Q) Γ ⊢ a_{2} : σ holds (\underline{2}). By Lemma 6.2.6 and (1), we have a derivation in the syntax-directed system, that is, we have (Q) Γ ⊢^{▽} a_{1} : σ′ (\underline{3}) with (Q) σ′ ⊑ σ (\underline{4}). It suffices to show that (Q) Γ ⊢ a_{2} : σ′ (\underline{5}) holds. Indeed, (2) then holds by Inst and (4). We show either (2) or (5), depending which one is easier. We note that the rules (⋆) and (⋆⋆) make no sense in UMLF (indeed, since oracles can be implicitly inserted, these reduction rules have no effect). Hence, we consider the cases (⋆) and (⋆⋆) only in MLF_{⋆}, which imply that the typing environment is Γ_{0}. ∘ Case δ: The judgment (2) holds by hypothesis (H1). ∘ Case β_{let}: The reduction is let x = v in a ⟶ a[v/x], and we know by (3) that the judgment (Q) Γ ⊢^{▽} let x = v in a : σ′ holds. The derivation must end as follows:

\frac{(Q) Γ ⊢^{▽} v : σ_{1}  (Q) Γ, x : σ_{1} ⊢^{▽} a : σ′}{(Q) Γ ⊢^{▽} let x = v in a : σ′} Let^{▽}

6.3 Type safety  159

Applying the Substitutivity Lemma (Lemma 6.1.5), we get (Q) Γ ⊢^{▽} a[v/x] : σ′, which is the expected result (5).

∘ Case β_{v}: The reduction is (λ(x) a) v ⟶ a[v/x], and we know that the judgment (Q) Γ ⊢^{▽} (λ(x) a) v : σ′ holds. By definition of ⊢^{▽}, there must exist Q_{1}, Q_{2}, τ, τ_{1}, τ_{2}, σ_{1}, σ_{2}, and α such that this derivation is of the form:

Fun^{▽} \frac{(QQ_{1}) Γ, x : τ ⊢^{▽} a : σ_{1} (\underline{9}) dom(Q_{1}) ∩ Γ = ∅}{(Q) Γ ⊢^{▽} λ(x) a : ∀ (Q_{1}, α ≥ σ_{1}) τ → α}  (Q) Γ ⊢^{▽} v : σ_{2} (\underline{8})
(Q) ∀ (Q_{1}, α ≥ σ_{1}) τ → α ⊑ ∀ (Q_{2}) τ_{2} → τ_{1} (\underline{7}) (Q) σ_{2} ⊑ ∀ (Q_{2}) τ_{2} (\underline{6}).

(Q) Γ ⊢^{▽} (λ(x) a) v : ∀ (Q_{2}) τ_{1} App^{▽}

Here σ′ is ∀ (Q_{2}) τ_{1}. Let Q′_{1} be the prefix (Q_{1}, α ≥ σ_{1}). Without lost of generality, we can assume α ∉ dom(Q) (otherwise, we rename α). This implies Q′_{1} # Q; besides dom(Q′_{1}) # ftv(Γ) (\underline{10}) since Γ must be closed under Q by well-formedness of (8). We can also assume dom(Q′_{1}) = dom(Q′_{1}/τ → α) (\underline{11}) (otherwise Q′_{1} contains useless binders that can be freely removed). We get a derivation of (QQ′_{1}) Γ, x : τ ⊢ a : α (\underline{12}) by Corollary 6.1.3, Inst and I-Hyp applied to (9). From (7), we get (Q) ∀ (Q′_{1}) τ → α ⊑ ∀ (Q_{2}) τ_{2} → τ_{1} (\underline{13}). Applying Lemma 3.4.4 to (13), there exists a substitution θ and an alpha-conversion of ∀ (Q_{2}) τ_{2} → τ_{1}, written ∀ (Q′_{2}) τ′_{2} → τ′_{1} such that (QQ′_{2}) θ(τ → α) ≡ τ′_{2} → τ′_{1} (\underline{14}) and QQ′_{1} ⊑^{I} QQ′_{2}\underline{θ} (\underline{15}), where I = dom(Q) ∪ dom(Q′_{1}/τ → α) and dom(θ) ⊆ dom(Q′_{1}/τ → α) (\underline{16}). Note that ftv(Γ) ⊆ dom(Q) (\underline{17}) hold by wellformedness of (8). From (15) and (11), we get QQ′_{1} ⊑ QQ′_{2}\underline{θ} (\underline{18}). Hence, by Rule Weaken, (12), and (18), we get (QQ′_{2}\underline{θ}) Γ, x : τ ⊢ a : α. By Strengthen, and observing that (QQ′_{2}\underline{θ}) σ_{0} ≡ θ(σ_{0}) holds by Eq-Mono for any σ_{0}, we get the judgment (QQ′_{2}\underline{θ}) θ(Γ), x : θ(τ) ⊢ a : α. By Gen, we get (QQ′_{2}) θ(Γ), x : θ(τ) ⊢ a : ∀ (\underline{θ}) α. By Inst and (QQ′_{2}) ∀ (\underline{θ}) α ≡ θ(α), it leads to (QQ′_{2}) θ(Γ), x : θ(τ) ⊢ a : θ(α) (\underline{19}). From (14) and Property 1.5.11.viii (page 54), we get (QQ′_{2}) θ(τ) ≡ τ′_{2} and (QQ′_{2}) θ(α) ≡ τ′_{1}. Hence, by Strengthen and Inst on (19), we get (QQ′_{2}) θ(Γ), x : τ′_{2} ⊢ a : τ′_{1} (\underline{20}). By (16) and (10), we get dom(θ) # dom(Q). Hence, by (17), we get θ(Γ) = Γ. Then, from (20) we have the judgment (QQ′_{2}) Γ, x : τ′_{2} ⊢ a : τ′_{1} (\underline{21}). From (6), we get (Q) σ_{2} ⊑ ∀ (Q′_{2}) τ′_{2} by alpha-conversion. Hence, (QQ′_{2}) σ_{2} ⊑ τ′_{2} (\underline{22}) holds by Property 1.7.2.iii (page 59) and I-Drop^{⋆}. From (8) and Corollary 6.1.3 (page 153), we get (QQ′_{2}) Γ ⊢ v : σ_{2}. By Inst and (22), we get (QQ′_{2}) Γ ⊢ v : τ′_{2} (\underline{23}). Hence, applying the Substitutivity Lemma (Lemma 6.1.5) to (21) and (23), we get (QQ′_{2}) Γ ⊢ a[v/x] : τ′_{1} (\underline{24}). Moreover, we have dom(Q′_{2}) # ftv(Γ) from (17), so that applying Rule Gen to (24) leads to (Q) Γ ⊢ a[v/x] : ∀ (Q′_{2}) τ′_{1}, that is, by alpha-conversion (Q) Γ ⊢ a[v/x] : ∀ (Q_{2}) τ_{1}. This is the expected result.

∘ Case (⋆): The reduction is (v_{1} : ⋆) v_{2} ⟶ (v_{1} v_{2} : ⋆) and a is (v_{1} : ⋆) v_{2}. As explained above, this case concerns only MLF_{⋆}; it cannot occur in UMLF. As a consequence, the typing environment we consider is the initial typing environment Γ_{0}. By hypothesis (H0), Γ_{0} is closed, that is, ftv(Γ_{0}) = ∅. Applying repeatedly Rule Gen to (1), we get (∅) Γ_{0} ⊢ (v_{1} : ⋆) v_{2} : ∀ (Q) σ. By Lemma 6.2.6, we have a derivation of (∅) Γ_{0} ⊢^{▽} (v_{1} : ⋆) v_{2} : ∀ (Q′) τ_{1} such that ∀ (Q′) τ_{1} ⊑ ∀ (Q) σ (\underline{25}). This derivation necessarily ends with the following rules:

App^{▽}

Oracle^{▽} \frac{\begin{matrix}(∅) Γ_{0} ⊢^{▽} v_{1} : σ_{1} (\underline{31}) \\ σ_{1} ⊑ σ′′_{1} (\underline{30}) & σ′_{1} ⊏ − σ′′_{1} (\underline{29}) \end{matrix}}{(∅) Γ_{0} ⊢^{▽} (v_{1} : ⋆) : σ′_{1}}  (∅) Γ_{0} ⊢^{▽} v_{2} : σ_{2} (\underline{28})
σ′_{1} ⊑ ∀ (Q′) τ_{2} → τ_{1} (\underline{27}) σ_{2} ⊑ ∀ (Q′) τ_{2} (\underline{26})
(∅) Γ_{0} ⊢^{▽} (v_{1} : ⋆) v_{2} : ∀ (Q′) τ_{1}

The relations between types, above, can be represented by the following diagram:

\begin{aligned}& σ′_{1} & ∀ (Q′) τ_{2} → τ_{1} \\ σ_{1} & σ′′_{1} \end{aligned} ⊑^{(30)} ⊏ −_{(29)} ⊑^{(27)}

Applying the Diamond Lemma (Lemma 2.8.4) to the above diagram, we know that there exists σ_{3} such that the following holds:

\begin{aligned}& σ′_{1} & ∀ (Q′) τ_{2} → τ_{1} \\ σ_{1} & σ′′_{1} & σ_{3} \end{aligned} ⊑^{(30)} ⊏ − ⊑^{(27)} ⊏ −_{(\underline{32})} ⊑^{(\underline{33})}

We can freely assume that σ_{3} is in normal form. By Property 2.1.3.ii (page 65) and (32), we conclude that σ_{3} is of the form ∀ (Q_{3}) τ′_{2} → τ′_{1}. By Lemma 3.6.11 and (32), ∀ (Q′) τ_{2} ⊏ − ∀ (Q_{3}) τ′_{2} (\underline{34}) and ∀ (Q′) τ_{1} ⊏ − ∀ (Q_{3}) τ′_{1} (\underline{35}) hold. By Rule Inst, (31), (30), and (33) we get (∅) Γ_{0} ⊢ v_{1} : ∀ (Q_{3}) τ′_{2} → τ′_{1} (\underline{36}). By Rule Inst, (28), (26), and (34), we can derive (∅) Γ_{0} ⊢ v_{2} : ∀ (Q_{3}) τ′_{2} (\underline{37}). Consequently, by Rule App^{⋆}, (36) and (37), (∅) Γ_{0} ⊢ v_{1} v_{2} : ∀ (Q_{3}) τ′_{1} holds. Finally, by Oracle and (35), we get (∅) Γ_{0} ⊢ (v_{1} v_{2} : ⋆) : ∀ (Q′) τ_{1}. By (25) and Inst, we get (∅) Γ_{0} ⊢ (v_{1} v_{2} : ⋆) : ∀ (Q) σ, that is, (∅) Γ_{0} ⊢ a′ : ∀ (Q) σ. By Corollary 6.1.3 (page 153), we get (Q) Γ_{0} ⊢ a′ : ∀ (Q) σ. Besides, (Q) ∀ (Q) σ ⊑ σ holds by I-Drop^{⋆}. Hence, (Q) Γ_{0} ⊢ a′ : σ holds by Inst. This is the expected result (2).

∘ Case (⋆⋆): This case concerns only MLF_{⋆}, thus the typing environment is Γ_{0}. We have a derivation of (Q) Γ_{0} ⊢ ((a_{0} : ⋆) : ⋆) : σ. As in the previous case (⋆), we have (∅) Γ_{0} ⊢ ((a_{0} : ⋆) : ⋆) : ∀ (Q) σ by Gen. By Lemma 6.2.6, we have a derivation of (∅) Γ_{0} ⊢^{▽} ((a_{0} : ⋆) : ⋆) : σ_{0} (\underline{38}), with σ_{0} ⊑ ∀ (Q) σ (\underline{39}). The derivation of (38) is necessarily of the form

Oracle^{▽} Oracle^{▽} \begin{matrix}(∅) Γ_{0} ⊢^{▽} a_{0} : σ_{3} (\underline{40}) & (∅) σ_{3} ⊑ σ_{4} & (∅) σ_{1} ⊏ − σ_{4} \\ (∅) Γ_{0} ⊢^{▽} (a_{0} : ⋆) : σ_{1} & (∅) σ_{1} ⊑ σ_{2} & (∅) σ_{0} ⊏ − σ_{2} \end{matrix} (∅) Γ_{0} ⊢^{▽} ((a_{0} : ⋆) : ⋆) : σ_{0}

6.3 Type safety  161

We can represent the relation between these polytypes by the solid arrows in the following diagram:

\begin{aligned}& & σ_{0} \\ & σ_{1} & σ_{2} \\ σ_{3} & σ_{4} & σ_{5} \end{aligned} ⊑^{(\underline{41})} ⊏ − ⊑ ⊏ −_{(\underline{42})} ⊑^{(\underline{43})} ⊏ −_{(\underline{44})}

By the Diamond Lemma 2.8.4, there exists σ_{5} such that the relations represented by the dotted arrows hold. By R-Trans, (41), and (43), we get σ_{3} ⊑ σ_{5} (\underline{45}). By R-Trans, (42), and (44), we get σ_{0} ⊏ − σ_{5} (\underline{46}). Hence, by (40), Oracle^{▽}, (45), and (46), we get (∅) Γ_{0} ⊢^{▽} (a_{0} : ⋆) : σ_{0}. By Inst and (39), we get (∅) Γ_{0} ⊢ (a_{0} : ⋆) : ∀ (Q) σ. By Corollary 6.1.3 (page 153), Inst and I-Drop^{⋆}, we can derive (Q) Γ_{0} ⊢ (a_{0} : ⋆) : σ. This is the expected result (2).

∘ Case Context: The hypothesis is a ⟶ a′. We know that (∅) Γ ⊢ E[a] : σ′ holds. We must show that (Q) Γ ⊢ E[a′] : σ (2) also holds. The proof is immediate by structural induction on E:

The second step in showing type safety consists of showing progress.

Theorem 3 (Progress) Any expression a such that we have (Q) Γ_{0} ⊢ a : σ is a value or can be further reduced.

\underline{Proof}: We reason by induction on the structure of a.

∘ Case x: This is not possible, since Γ_{0} does not bind any variable.

∘ Case c: Then a is a value.

∘ Case λ(x) a: Then a is a value.

∘ Case let x = a_{1} in a_{2}: Necessarily, a_{1} is typable in the typing environment Γ_{0}. By induction hypothesis, either a_{1} is a value or it can be further reduced. In either case, a can be further reduced (by Rule β_{let} or by Rule Context).

∘ Case a_{1} a_{2} Necessarily, a_{1} and a_{2} are also well-typed in (Q), Γ_{0}. Thus, by induction hypothesis, either a_{1} can be further reduced (and so can a) or a_{1} is a value. We continue with the second case. In turn, either a_{2} can be further reduced and so can a or it is also a value. We continue with the second case and reason on the structure of a_{1}:

Subcase (w : ⋆): then a can be reduced by (⋆).

Subcase λ(x) a′: then a can be reduced by β_{v}.

Subcase f v_{1} … v_{n} with n < |f|: then either n + 1 < |f| and a is a value, or n + 1 = |f| and a can be reduced by hypothesis (H2) for constants.

Subcase C v_{1} … v_{n} with n ≤ |C|: By Lemma 6.2.6, we have a typing derivation of (Q) Γ_{0} ⊢^{▽} a_{1} : σ. This derivation starts with Var^{▽} and uses App^{▽} repeatedly, once for each v_{i}. Let σ_{i} be the type given to C v_{1} … v_{i} in the i^{th} Rule App^{▽}. Let σ_{0} be Γ(C). We show by induction on the number of rules App^{▽}, that (∀ (Q) σ_{i})/2^{|C|−i} is neither →, nor ⊥.

• This result holds for i = 0 by hypothesis (H0).

• Assuming the result holds for i, we show it also holds for i + 1: By Rule App^{▽}, we have (Q) σ_{i} ⊑ ∀ (Q′) τ_{2} → τ_{1} and σ_{i+1} is ∀ (Q′) τ_{1}. By Property 2.1.3.ii (page 65), (∀ (QQ′) τ_{2} → τ_{1})/2^{|C|−i} is neither →, nor ⊥. Hence, (∀ (QQ′) τ_{1})/2^{|C|−(i+1)} is neither →, nor ⊥, which is the expected result.

By induction, the result holds for all i ∈ 0..|C|. If n is |C|, then (∀ (Q) σ_{n})/ϵ is neither → nor ⊥ (\underline{1}). Besides, Rule App^{▽} is used to type a_{1} a_{2}, which implies that (Q) σ_{n} ⊑ ∀ (Q′) τ_{2} → τ_{1} (\underline{2}) holds for some Q′, τ_{2} and τ_{1}. We have a contradiction between (1), (2), and Property 2.1.3.ii. Hence n cannot be |C|. Thus, a is a value.

∘ Case (a′ : ⋆): Necessarily, a′ is well-typed. By induction hypothesis, either a′ is a value or it can be further reduced. In the latter case, a can be reduced by Rule Context. In the former case, a′ is either a value of the form w, and a is a value, or it is a value v of the form (w : ⋆). Then a can be reduced by (⋆⋆).

Combining theorems 2 and 3 ensures that the reduction of well-typed programs either proceeds forever or ends up with a value. This holds for programs in MLF_{⋆} but also for programs in MLF, since MLF is a subset of MLF_{⋆}. Hence MLF is also sound. However, MLF does not enjoy subject reduction, since reduction may create oracles. Notice, however, that oracles can only be introduced by δ-rules.

Chapter 7

Type inference

Type inference in MLF_{⋆} is probably as difficult as full type inference in System F, because oracles do not provide any type information. Indeed, oracles only indicate place-holders for type annotations. Fortunately, a program in MLF mentions type annotations, which are primitives, instead of oracles. In this chapter, we give a typeinference algorithm for MLF, which we show sound and complete. Interestingly, type annotations are not considered here, because type annotations are primitives, and the type of primitives is always known (from the initial typing environment Γ_{0}). Hence, the type inference algorithm does not guess any polymorphism, but simply propagates known type information. This is why the algorithm is quite simple, and also why it is complete.

7.1 Type inference algorithm

Figure 7.1 defines the type-inference algorithm WF for MLF. The algorithm follows the algorithm W for ML [Mil78], with only two differences: first, the algorithm builds a prefix Q instead of a substitution; second, all free type variables not in Γ are quantified at each abstraction or application. Since free variables of Γ are in dom(Q), finding quantified variables consists of splitting the current prefix according to dom(Q), as described by Definition 3.5.1.

Definition 7.1.1 A pair (Q′, σ′) is an instance of a pair (Q, σ) under interface I if we have (Q, α ≥ σ) ⊑^{I∪{α}} (Q′, α ≥ σ′) for any α not in dom(Q) ∪ dom(Q′).

A type inference problem is a triple (Q, Γ, a), where all free type variables in Γ are bound in Q. A pair (Q′, σ) is a solution to this problem if Q ⊑ Q′ and (Q′) Γ ⊢ a : σ holds. A solution of a type inference problem (Q, Γ, a) is principal if all other solutions are instances of the given one, under interface dom(Q).

164  Type inference

Figure 7.1: Algorithm WF

The algorithm infer (Q, Γ, a) is defined by cases on expression a :

Case x : return Q, Γ(x)

Case λ(x) a :

• let Q_{1} = (Q, α ≥ ⊥) with α ∉ dom(Q)

• let (Q_{2}, σ) = infer (Q_{1}, (Γ, x : α), a)

• let β ∉ dom(Q_{2}) and (Q_{3}, Q_{4}) = Q_{2}↑ dom(Q)

• return Q_{3}, ∀ (Q_{4}, β ≥ σ) α → β

Case a b :

• let (Q_{1}, σ_{a}) = infer (Q, Γ, a)

• let (Q_{2}, σ_{b}) = infer (Q_{1}, Γ, b)

• let α_{a}, α_{b}, β ∉ dom(Q_{2})

• let Q_{3} = unify ((Q_{2}, α_{a} ≥ σ_{a}, α_{b} ≥ σ_{b}, β ≥ ⊥), α_{a}, α_{b} → β)

• let (Q_{4}, Q_{5}) = Q_{3}↑ dom(Q)

• return (Q_{4}, ∀ (Q_{5}) β)

Case let x = a_{1} in a_{2} :

• let (Q_{1}, σ_{1}) = infer (Q, Γ, a_{1})

• return infer (Q_{1}, (Γ, x : σ_{1}), a_{2})

7.2 Soundness of the algorithm

Lemma 7.2.1 (Soundness of type inference) The algorithm WFis sound; that is, for any Q, Γ, and a, if infer (Q, Γ, a) returns a pair (Q′, σ), then we have:

Q ⊑ Q′ (Q′) Γ ⊢ a : σ

\underline{Proof}: By structural induction on a.

∘ Case x: We have Q′ = Q and σ = Γ(x), thus the result is immediate by Rule Var.

∘ Case λ(x) a: Let Q_{1} be (Q, α ≥ ⊥) and (Q_{2}, σ) be infer (Q_{1}, Γ, x : α, a). By induction hypothesis, we have Q_{1} ⊑ Q_{2} and (Q_{2}) Γ, x : α ⊢ a : σ (\underline{1}). Let (Q_{3}, Q_{4}) be Q_{2}↑ dom(Q). We have Q_{2} ≡ Q_{3}Q_{4} (\underline{2}) by Lemma 3.5.2. Hence, by Weaken, (2), and (1), we have (Q_{3}Q_{4}) Γ, x : α ⊢ a : σ. By Rule Fun^{▽}, we get (Q_{3}) Γ ⊢ λ(x) a : ∀ (Q_{4}, β ≥ σ) α → β, which is the expected result. Moreover, we have Q ≡ Q_{1} ⊑ Q_{2} ≡ Q_{3}Q_{4} ≡^{dom(Q_{1})} Q_{3}. Hence Q ⊑ Q_{3} holds.

∘ Case a b: Let (Q_{1}, σ_{a}) be infer (Q, Γ, a) and (Q_{2}, σ_{b}) be infer (Q_{1}, Γ, b). By induction hypothesis, we have Q ⊑ Q_{1} ⊑ Q_{2} (\underline{1}) and (Q_{1}) Γ ⊢ a : σ_{a} (\underline{2}) as well as (Q_{2}) Γ ⊢ a : σ_{b} (\underline{3}). Hence, by Weaken on (2) and (1), we have (Q_{2}) Γ ⊢ a : σ_{a} (\underline{4}).

Let Q_{0} be (Q_{2}, α_{a} ≥ σ_{a}, α_{b} ≥ σ_{b}, β ≥ ⊥). By rules Weaken, Inst and I-Hyp applied once to (3) and once to (4), we get (Q_{0}) Γ ⊢ a : α_{a} (\underline{5}) and (Q_{0}) Γ ⊢ b : α_{b} (\underline{6}). Let Q_{3} be unify (Q_{0}, α_{a}, α_{b} → β). By Lemma 4.4.1, we have Q_{0} ⊑ Q_{3} (\underline{7}) and (Q_{3}) α_{a} ≡ α_{b} → β (\underline{8}). Let (Q_{4}, Q_{5}) be Q_{3}↑ dom(Q). We have Q_{3} ≡ Q_{4}Q_{5} (\underline{9}) by Lemma 3.5.2. By Weaken, (7), once on (5) and once on (6), we have (Q_{3}) Γ ⊢ a : α_{a} (\underline{10}) and (Q_{3}) Γ ⊢ b : α_{b}. By Inst applied to (8) and (10), we get (Q_{3}) Γ ⊢ a : α_{b} → β (\underline{11}). By Rule App, we get (Q_{3}) Γ ⊢ a b : β. By Weaken applied to (9), we get (Q_{4}Q_{5}) Γ ⊢ a b : β. Since ftv(Γ) ⊆ dom(Q) ⊆ dom(Q_{4}), we get by Rule Gen (Q_{4}) Γ ⊢ a b : ∀ (Q_{5}) β, which is the expected result. Moreover, we have Q ⊑ Q_{1} ⊑ Q_{2} ≡ Q_{0} ⊑ Q_{3} ≡ Q_{4}Q_{5} ≡^{dom(Q)} Q_{4}. Hence, Q ⊑ Q_{4} holds.

∘ Case let x = a_{1} in a_{2}: Let (Q_{1}, σ_{1}) be infer (Q, Γ, a_{1}). By induction hypothesis, we have Q ⊑ Q_{1} (\underline{1}) and (Q_{1}) Γ ⊢ a_{1} : σ_{1} (\underline{2}). Let (Q_{2}, σ_{2}) be infer (Q_{1}, Γ, x : σ_{1}, a_{2}). By induction hypothesis, we have Q_{1} ⊑ Q_{2} (\underline{3}) and (Q_{2}) Γ, x : σ_{1} ⊢ a_{2} : σ_{2} (\underline{4}). By Rule Weaken, (2), and (3), we have (Q_{2}) Γ ⊢ a_{1} : σ_{1} (\underline{5}). Rule Let applies on (5) and (4) and gives (Q_{2}) Γ ⊢ let x = a_{1} in a_{2} : σ_{2}. Moreover, by PI-Trans on (1) and (3), we have Q ⊑ Q_{2}. This is the expected result.

7.3 Completeness of the algorithm

Lemma 7.3.1 (Completeness of type inference) The algorithm WF is complete, that is, if there exists a solution to a type inference problem (Q, Γ, a), then the algorithm infer (Q, Γ, a) succeeds and returns a principal solution.

\underline{Proof}: Let I be dom(Q). By hypothesis and Lemma 6.2.6, we have a solution (Q_{2}, σ_{2}), that is (Q_{2}) Γ ⊢^{▽} a : σ_{2}and Q ⊑ Q_{2} (\underline{1}) hold. Note that dom(Q) ⊆ dom(Q_{2}) (\underline{2}) holds. We have to show that infer (Q, Γ, a) succeeds and returns (Q_{1}, σ_{1}) such that (Q_{1}, γ > σ_{1}) ⊑^{I∪\{γ\}} (Q_{2}, γ > σ_{2}) (\underline{3}). The proof is by induction on the structure of a. We proceed by case analysis on the last rule of the derivation of (Q_{2}) Γ ⊢^{▽} a : σ_{2}.

∘ Case Var: Then a is a variable x, σ_{2} is Γ(x) and infer (Q, Γ, a) succeeds and returns (Q, Γ(x)). Hence, σ_{1} = σ_{2} and Q_{1} = Q. Then (3) holds by Property 3.4.2.iii (page 106) and (1).

∘ Case Fun: Then a is λ(x) a′. By hypothesis, (Q_{2}Q′_{2}) Γ, x : τ_{0} ⊢^{▽} a′ : σ′_{2} (\underline{4}) and dom(Q′_{2}) ∩ ftv(Γ) = ∅ hold, and σ_{2} is ∀ (Q′_{2}, β ≥ σ′_{2}) τ_{0} → β (\underline{5}). Let α be a fresh type variable outside dom(Q_{2}Q′_{2}). We have (Q_{2}Q′_{2}, α = τ_{0}) Γ, x : α ⊢^{▽} a′ : σ′_{2} (\underline{6}) by Corollary 6.1.3 (page 153), Strengthen, and (4). We can derive (Q, α ≥ ⊥) ⊑ (Q_{2}Q′_{2}, α = τ_{0}) (\underline{7}) from (1) by Property 3.4.2.iii (page 106) and rules PE-Free, PI-Context-L, and I-Nil. By induction hypothesis on (6) and (7), infer (Q, α > ⊥, Γ, x : α, a′) succeeds with (Q′_{1}, σ′_{1}) such that (Q′_{1}, γ ≥ σ′_{1}) ⊑^{I∪\{α,γ\}} (Q_{2}Q′_{2}, α = τ_{0}, γ ≥ σ′_{2}) (\underline{8}) holds. Let (Q_{3}, Q_{4}) be Q′_{1}↑ dom(Q). We note that the prefixes (Q_{3}, (Q_{4}, γ ≥ σ′_{1})) and (Q′_{1}, γ ≥ σ′_{1})↑ dom(Q) are equal (\underline{9}) by Definition 3.5.1 and since γ ∉ dom(Q). Remember that I is a shorthand for dom(Q). By Lemma 3.6.13 applied to (8), (9), and (2), and taking τ = α → γ, we get

(Q_{3}, γ′ ≥ ∀ (Q_{4}, γ ≥ σ′_{1}) α → γ) ⊑^{I∪\{γ′\}} (Q_{2}, γ′ ≥ ∀ (Q′_{2}, α = τ_{0}, γ ≥ σ′_{2}) α → γ) (\underline{10})

The algorithm returns (Q_{3}, ∀ (Q_{4}, γ ≥ σ′_{1}) α → γ), that is, Q_{1} is Q_{3} and σ_{1} is ∀ (Q_{4}, γ ≥ σ′_{1}) α → γ). Additionally, from (5), Eq-Mono^{⋆} and α-conversion, σ_{2} is equivalent to ∀ (Q′_{2}, α = τ_{0}, γ ≥ σ′_{2}) α → γ. Then (10) is equivalent to

(Q_{1}, γ′ ≥ σ_{1}) ⊑^{I∪{γ′}} (Q_{2}, γ′ ≥ σ_{2})

This is the expected result.

∘ Case Let: We have a of the form let x = a_{1} in a_{2}. By hypothesis, we have (Q_{2}) Γ ⊢^{▽} a_{1} : σ_{0} and (Q_{2}) Γ, x : σ_{0} ⊢^{▽} a_{2} : σ_{2} (\underline{11}). By induction hypothesis, infer (Q, Γ, a) succeeds and returns (Q_{3}, σ_{3}) such that (Q_{3}, γ≥σ_{3}) ⊑^{I∪{γ}} (Q_{2}, γ≥σ_{0}). By Lemma 3.6.2 (page 114), there exists a renaming ϕ and a substitution θ both invariant on I ∪ {γ}, as well as a prefix Q′_{0} such that we have (Q_{3}, γ ≥ σ_{3}) ⊑ (ϕ(Q_{2}, γ ≥ σ_{0})\underline{θ}Q′_{0}) (\underline{12}). Besides, we have dom(Q′_{0}) # dom((Q_{3}, γ ≥ σ_{3})/I ∪ {γ}), that is, dom(Q′_{0}) # γ ∪ dom(Q_{3}/I ∪ ftv(σ_{3})) (\underline{13}). By Property 3.4.2.i (page 106), (12), and PE-Free, Q_{3} ⊑ (ϕ(Q_{2}, γ ≥ σ_{0})\underline{θ}Q′_{0}) (\underline{14}) holds. From (11), we get (Q_{2}, γ ≥σ_{0}) Γ, x : σ_{0} ⊢ a_{2} : σ_{2} by Corollary 6.1.3 (page 153). Hence, by Lemma 6.1.1, we get (ϕ(Q_{2}, γ ≥ σ_{0})) ϕ(Γ, x : σ_{0}) ⊢ a_{2} : ϕ(σ_{2}). Since ϕ is disjoint from I, ϕ is invariant on Γ, thus this rewrites to (ϕ(Q_{2}, γ ≥ σ_{0})) Γ, x : ϕ(σ_{0}) ⊢ a_{2} : ϕ(σ_{2}). By Corollary 6.1.3 (page 153), we have (ϕ(Q_{2}, γ ≥ σ_{0})\underline{θ}Q′_{0}) Γ, x : ϕ(σ_{0}) ⊢ a_{2} : ϕ(σ_{2}) (\underline{15}). We can derive (Q_{3}, γ ≥ σ_{3}) σ_{3} ⊑ γ (\underline{16}) by I-Hyp. From (12), (16), and Lemma 3.6.4, we get (ϕ(Q_{2}), γ ≥ ϕ(σ_{0}), \underline{θ}Q′_{0}) σ_{3} ⊑ γ. By (13), we have γ ∉ dom(Q′_{0}) and dom(Q′_{0}) # ftv(σ_{3}). Hence, by R-Context-R and Eq-Free, we get (ϕ(Q_{2}), γ ≥ϕ(σ_{0})), θ(σ_{3}) ⊑ θ(γ). Observing that θ(γ) is γ and that γ ∉ ftv(θ(σ_{3})) (by well-formedness of (12)), we get (ϕ(Q_{2})) θ(σ_{3}) ⊑ ϕ(σ_{0}) by R-Context-R, Eq-Free, and Eq-Var. By Property 1.7.2.iii (page 59), we get (ϕ(Q_{2}, γ ≥ σ_{0})\underline{θ}Q′_{0}) θ(σ_{3}) ⊑ ϕ(σ_{0}). By Eq-Mono, we get (ϕ(Q_{2}, γ ≥ σ_{0})\underline{θ}Q′_{0}) σ_{3} ⊑ ϕ(σ_{0}). By Strengthen on (15), we get (ϕ(Q_{2}, γ ≥ σ_{0})\underline{θ}Q′_{0}) Γ, x : σ_{3} ⊢ a_{2} : ϕ(σ_{2}) (\underline{17}). By induction hypothesis applied to (17) and (14), infer (Q_{3}, Γ, x : σ_{3}, a_{2}) succeeds with (Q′_{1}, σ_{1}) such that (Q′_{1}, γ′ ≥ σ_{1}) ⊑^{I∪{γ′}} (ϕ(Q_{2}, γ ≥σ_{0})\underline{θ}Q′_{0}, γ′ ≥ϕ(σ_{2})) (\underline{18}). We note that ftv(σ_{2}) ∈ dom(Q_{2}) by well-formedness of (11). Hence, ftv(ϕ(σ_{2})) ∈ dom(ϕ(Q_{2})) (\underline{19}). We have

(ϕ(Q_{2}, γ ≥ σ_{0})\underline{θ}Q′_{0}, γ′ ≥ ϕ(σ_{2}))
≡ (ϕ(Q_{2}, γ′ ≥ σ_{2}, γ ≥ σ_{0})\underline{θ}Q′_{0}) by (19) and Eq-Comm
≡^{I∪{γ′}} (ϕ(Q_{2}, γ′ ≥ σ_{2}))  by Eq-Free
≡^{I∪\{γ′\}} (ϕ(Q_{2}, γ′ ≥ σ_{2}))\underline{ϕ}  by Eq-Free
≡^{I∪{γ′}} (Q_{2}, γ′ ≥ σ_{2})  by Property 3.4.2.iv (page 106)

Hence, (ϕ(Q_{2}, γ≥σ_{0})\underline{θ}Q′_{0}, γ′≥ϕ(σ_{2})) ≡^{I∪\{γ′\}} (Q_{2}, γ′≥σ_{2}) holds, and we get the expected result from (18), that is,

(Q′_{1}, γ′ ≥ σ_{1}) ⊑^{I∪{γ′}} (Q_{2}, γ′ ≥ σ_{2})

∘ Case App: By hypothesis, we have

{(Q_{2}) Γ ⊢^{▽} a_{1} : σ_{a} (\underline{20})  (Q_{2}) Γ ⊢^{▽} a_{2} : σ_{b} (\underline{21})  (Q_{2}) σ_{a} ⊑ ∀ (Q_{3}) τ_{2} → τ_{1} (\underline{22}) \atop (Q_{2}) σ_{b} ⊑ ∀ (Q_{3}) τ_{2} (\underline{23})  σ_{2} = ∀ (Q_{3}) τ_{1}}

Let α_{a}, α_{b}, β be fresh variables. Let I_{a} be I ∪ {α_{a}}, and I_{b} be I ∪ {α_{b}}. By induction hypothesis, (20), and (1), infer (Q_{,}Γ, a_{1}) succeeds and returns (Q_{a}, σ′_{a}) such that (Q_{a}, α_{a} ≥ σ′_{a}) ⊑^{I_{a}} (Q_{2}, α_{a} ≥ σ_{a}) holds. By Lemma 3.6.2 (page 114), there exists a renaming ϕ_{a} and a substitution θ_{a}, both invariant on I_{a}, as well as Q′_{0} such that we have (Q_{a}, α_{a} ≥ σ′_{a}) ⊑ (ϕ_{a}(Q_{2}, α_{a} ≥ σ_{a})\underline{θ_{a}}Q′_{0}) (\underline{24}) holds. Moreover, we have dom(Q′_{0}) # dom(Q_{a}/I ∪ ftv(σ′_{a})) (\underline{25}). We have Q_{a} ⊑ (ϕ_{a}(Q_{2}, α_{a} ≥ σ_{a})\underline{θ_{a}}Q′_{0}) (\underline{26}) from (24) and PE-Free. Let I′ be dom(Q_{a}) (\underline{27}). By Lemmas 6.1.1 and 6.1.3, and by (21), we get (ϕ_{a}(Q_{2}, α_{a} ≥ σ_{a})\underline{θ_{a}}Q′_{0}) Γ ⊢ a_{2} : ϕ_{a}(σ_{b}) (\underline{28}). Hence, by induction hypothesis, (26) and (28), infer (Q_{a}, Γ, a_{2}) succeeds and returns (Q_{b}, σ′_{b}) such that (Q_{b}, α_{b} ≥ σ′_{b}) ⊑^{I′∪\{α_{b}\}} (ϕ_{a}(Q_{2}, α_{a} ≥ σ_{a})\underline{θ_{a}}Q′_{0}, α_{b} ≥ ϕ_{a}(σ_{b})) (\underline{29}) holds. Let ϕ′ be a renaming of α_{a} to a fresh variable α′_{a} (that is, not in the domain or in the free variables of Q_{1}, Q_{2}, ϕ_{a}, θ_{a}, Q′_{0}). Let θ′_{a} be the substitution extracted from ϕ′(\underline{θ_{a}}) and Q′′_{0} be ϕ′(Q′′_{0}). We remark from (21) that ftv(σ_{b}) ⊆ dom(Q_{2}). Hence, ftv(ϕ_{a}(σ_{b})) ⊆ dom(ϕ_{a}(Q_{2})) (\underline{30}), thus α_{a} ∉ ftv(ϕ_{a}(σ_{b})). As a consequence, ϕ ∘ ϕ_{a}(σ_{b}) = ϕ_{a}(σ_{b}) (\underline{31}). By Property 3.4.2.iv (page 106) (using the renaming ϕ), and (31), we get (ϕ_{a}(Q_{2}, α_{a} ≥ σ_{a})\underline{θ_{a}}Q′_{0}, α_{b} ≥ ϕ_{a}(σ_{b})) ≡^{I′∪\{α_{b}\}} (ϕ_{a}(Q_{2}, α′_{a} ≥ σ_{a})\underline{θ′_{a}}Q′′_{0}, α_{b} ≥ ϕ_{a}(σ_{b}))\underline{ϕ} (\underline{32}). Additionally, α_{a} was chosen such that α_{a} ∉ I′ ∪ \{α_{b}\} (\underline{33}). Hence, by PE-Free, (32), and (33), we get

(ϕ_{a}(Q_{2}, α_{a} ≥ σ_{a})\underline{θ_{a}}Q′_{0}, α_{b} ≥ ϕ_{a}(σ_{b})) ≡^{I′∪\{α_{b}\}} (ϕ_{a}(Q_{2}, α′_{a} ≥ σ_{a})\underline{θ′_{a}}Q′′_{0}, α_{b} ≥ ϕ_{a}(σ_{b}))

With (29) and PI-Trans, we get

(Q_{b}, α_{b} ≥ σ′_{b}) ⊑^{I′∪\{α_{b}\}} (ϕ_{a}(Q_{2}, α′_{a} ≥ σ_{a})\underline{θ′_{a}}Q′′_{0}, α_{b} ≥ ϕ_{a}(σ_{b}))

Observing that we have utv(σ′_{a}) ⊆ I′ from (24) and (27), we get by Property 3.4.2.iii (page 106)

(Q_{b}, α_{b}≥σ′_{b}, α_{a}≥σ′_{a}, β≥⊥) ⊑^{I′∪\{α_{b},α_{a},β\}} (ϕ_{a}(Q_{2}, α′_{a}≥σ_{a})\underline{θ′_{a}}Q′′_{0}, α_{b}≥ϕ_{a}(σ_{b}), α_{a}≥σ′_{a}, β≥⊥)

By Property 3.4.2.i (page 106), we get

(Q_{b}, α_{b} ≥σ′_{b}, α_{a} ≥σ′_{a}, β ≥⊥) ⊑^{I∪\{α_{b},α_{a}\}} (ϕ_{a}(Q_{2}, α′_{a} ≥σ_{a})\underline{θ′_{a}}Q′′_{0}, α_{b} ≥ϕ_{a}(σ_{b}), α_{a} ≥σ′_{a}, β ≥⊥)

Let Q_{4} be (Q_{b}, α_{a} ≥ σ′_{a}, α_{b} ≥ σ′_{b}, β ≥ ⊥), J be I ∪ {α_{b}, α_{a}, β}, and P_{4} be (ϕ_{a}(Q_{2}, α′_{a} ≥ σ_{a})\underline{θ′_{a}}Q′′_{0}, α_{b} ≥ ϕ_{a}(σ_{b}), α_{a} ≥ σ′_{a}, β ≥ ⊥). The above relation can be written

Q_{4} ⊑^{J} P_{4} (\underline{34})

We have (Q_{a}, α_{a} ≥ σ′_{a}) σ′_{a} ⊑ α_{a}, thus by Lemma 3.6.4 applied to (24), we can derive (ϕ_{a}(Q_{2}, α_{a} ≥ σ_{a})\underline{θ_{a}}Q′_{0}) σ′_{a} ⊑ α_{a}. Observing that α_{a} ∉ ftv(σ′_{a}), we get (ϕ_{a}(Q_{2}, α′_{a} ≥ σ_{a})\underline{θ′_{a}}Q′′_{0}) σ′_{a} ⊑ α′_{a} by Property 1.7.2.i (page 59). Hence, we have

P_{4} ⊑ (ϕ_{a}(Q_{2}, α′_{a} ≥ σ_{a})\underline{θ′_{a}}Q′′_{0}, α_{b} ≥ ϕ_{a}(σ_{b}), α_{a} = α′_{a}, β ≥ ⊥) (\underline{35})

and we write P_{5} for the right-hand side. By PE-Swap and PE-Commut, using (30), we get

P_{5} ≡ (ϕ_{a}(Q_{2}), α_{a} ≥ ϕ_{a}(σ_{a}), α_{b} ≥ ϕ_{a}(σ_{b}), β ≥ ⊥, α′_{a} = α_{a}, \underline{θ′_{a}}Q′′_{0}) (\underline{36})

and we write P_{6} for the right-hand side. By Property 1.7.2.i (page 59) applied to (22) and (23), we get (ϕ_{a}(Q_{2})) ϕ_{a}(σ_{a}) ⊑ ϕ_{a}(∀ (Q_{3}) τ_{2} → τ_{1}) and (ϕ_{a}(Q_{2})) ϕ_{a}(σ_{b}) ⊑ ϕ_{a}(∀ (Q_{3}) τ_{2}). Hence, we can derive

P_{6} ⊑ (ϕ_{a}(Q_{2}), α_{a} ≥ ϕ_{a}(∀ (Q_{3}) τ_{2} → τ_{1}), α_{b} ≥ ϕ_{a}(∀ (Q_{3}) τ_{2}), β ≥ ⊥, α′_{a} = α_{a}, \underline{θ′_{a}}Q′′_{0}) (\underline{37})

and we write P_{7} for the right-hand side. By PE-Free and I-Drop^{⋆} (twice on ϕ_{a}(Q_{3})), we can derive

P_{7} ⊑ (ϕ_{a}(Q_{2}Q_{3}), α_{a} = ϕ_{a}(τ_{2} → τ_{1}), α_{b} = ϕ_{a}(τ_{2}), β ≥ ⊥, α′_{a} = α_{a}, \underline{θ′_{a}}) (\underline{38})

and we write P_{8} for the right-hand side. Finally, by Property 3.4.2.iv (page 106) and I-Bot, we get

P_{8} ⊑^{J} (Q_{2}Q_{3}, α_{a} = τ_{2} → τ_{1}, α_{b} = τ_{2}, β = τ_{1}) (\underline{39})

Let Q_{6} be (Q_{2}Q_{3}, α_{a} = τ_{2} → τ_{1}, α_{b} = τ_{2}, β = τ_{1}). By (34), (35), (36), (37), (38), and (39), we get Q_{4} ⊑^{J} Q_{6}. Moreover, we have (Q_{6}) α_{a} ≡ α_{b} → β by lemma 1.5.10.

By completeness of unification, (Lemma 4.6.2), unify (Q_{4}) α_{a} ≐ α_{b} → β succeeds and returns Q_{5} such that we have Q_{5} ⊑^{J} Q_{6}. Let (Q_{7}, Q_{8}) be Q_{5}↑ dom(Q). By hypothesis, I = dom(Q), and I ⊆ dom(Q_{2}). By Lemma 3.6.13, we have a derivation of

(Q_{7}, γ ≥ ∀ (Q_{8}) β) ⊑^{I∪{γ}} (Q_{2}, γ ≥ ∀ (Q_{3}) τ_{1})

This is the expected result.

∘ Case Oracle cannot appear since type inference is only performed in MLF, not in MLF_{⋆}.

7.4 Decidability of type inference

Lemma 7.4.1 The type inference algorithm always terminates, either by failing or by returning a prefix and a type scheme.

\underline{Proof}: By induction on the size of the expression being typed. All cases are straightforward, using Lemma 4.5.5 for the termination of unify.

Thanks to Lemmas 7.2.1 and 7.3.1, the type inference algorithm is proved sound and complete. Additionally, the algorithm always terminates by Lemma 7.4.1. Hence, the following theorem:

Theorem 4 (Type inference) The set of solutions of a solvable type inference problem admits a principal solution. Given any type inference problem, the algorithm WF either returns a principal solution or fails if no solution exists.

170

Chapter 8

Type annotations

In this chapter, we restrict our attention to MLF, i.e. to expressions that do not contain oracles. Since expressions of MLF are exactly those of ML, the only difference lies in the richer types and typing rules. However, this is not sufficient to provide usable first-class polymorphism, since MLF without type annotations and ML are equivalent, as shown by the next section. The following sections introduce type annotations as primitives and show how to use them to introduce polymorphism in MLF.

8.1 MLF without type annotations

In the following, we write ⊑_{ML} for the ML generalized instance relation. It allows instantiation of quantified variables with any monotype and immediate generalization of freshly introduced variables. We define it as follows:

∀ (ᾱ) σ ⊑_{ML} ∀ (β̄) σ[τ̄/ᾱ] holds if and only if β̄ is disjoint from ftv(σ).

The following property is standard in ML:

Lemma 8.1.1 If we have ∀ (ᾱ) τ_{1} ⊑_{ML} ∀ (β̄) τ_{2}, then for any τ such that ftv(τ) # ᾱ and ftv(τ) # β̄, we have ∀ (ᾱ) τ[τ_{1}/γ] ⊑_{ML} ∀ (β̄) τ[τ_{2}/γ]

\underline{Proof}: By definition, we have β̄ # ftv(τ_{1}), and τ_{2} = τ_{1}[τ̄/ᾱ] (\underline{1}). By hypothesis, we have β̄ # ftv(τ), thus β̄ # ftv(τ[τ_{1}/γ]). As a consequence, we have ∀ (ᾱ) τ[τ_{1}/γ] ⊑_{ML} ∀ (β̄) τ[τ_{1}/γ][τ̄/ᾱ]. By hypothesis, we have ᾱ # ftv(τ) (\underline{2}). We get the expected result by observing that ∀ (β̄) τ[τ_{1}/γ][τ̄/ᾱ] is equal to ∀ (β̄) τ[τ_{2}/γ] by (1) and (2).

Polytypes that do not contain rigid bindings are said to be flexible. Let flex be the function defined on polytypes and prefixes that transforms every rigid binding into a flexible binding. For instance, flex (∀ (α = σ_{1}, β ≥ σ_{2}) σ) is ∀ (α ≥ flex (σ_{1}), β ≥ flex (σ_{2})) flex (σ). We say that a derivation is flexible if it does not contain any rigid bindings in types or in the prefix. A judgment is flexible if it has a flexible derivation.

Properties 8.1.2 i) If (Q) σ_{1} ≡ σ_{2}, then (flex (Q)) flex (σ_{1}) ≡ flex (σ_{2}) is flexible. ii) If (Q) σ_{1} ⊏ − σ_{2}, then (flex (Q)) flex (σ_{1}) ⊑ flex (σ_{2}) is flexible. iii) If (Q) σ_{1} ⊑ σ_{2}, then (flex (Q)) flex (σ_{1}) ⊑ flex (σ_{2}) is flexible.

\underline{Proof}: For each property, by induction on the derivation. Equivalence and Instance cases are easy. As for the abstraction relation, the cases A-Hyp and R-Context-Rigid are replaced by (respectively) I-Hyp and R-Context-Flexible. Finally, I-Rigid is replaced by Eq-Refl and I-Equiv^{⋆}.

We lift the function flex to typing environments and typing judgments in the natural way. This operation is correct in the following sense:

Lemma 8.1.3 If (Q) Γ ⊢ a : σ holds in MLF, then so does flex ((Q) Γ ⊢ a : σ).

\underline{Proof}: By induction on the derivation of (Q) Γ ⊢ a : σ. Case Var is immediate. Cases App, Fun and Let are by induction hypothesis. Case Inst is by Property 8.1.2.iii. Case Gen: We have (Q) Γ ⊢ a : ∀ (α ⋄ σ_{1}) σ_{2}, and the premise is (Q, α ⋄ σ_{1})⊢ a : σ_{2}, with α ∉ ftv(Γ). Note that α ∉ ftv(flex (Γ)). By induction hypothesis, (flex (Q), α ≥ flex (σ_{1})) flex (Γ) ⊢ a : flex (σ_{2}) holds. Hence, (flex (Q)) flex (Γ) ⊢ a : ∀ (α ≥ flex (σ_{1})) flex (σ_{2}) holds by Gen. By definition, this means (flex (Q)) flex (Γ) ⊢ a : flex ∀ (α ⋄ σ_{1}) σ_{2}. This is the expected result.

Definition 8.1.4 We define the ML approximation ⟨⟨σ⟩⟩ of an MLF flexible type σ as follows:

⟨⟨⊥⟩⟩ = ∀ (α) α  ⟨⟨τ⟩⟩ = τ  \frac{⟨⟨σ⟩⟩ = ∀ (Q) τ}{⟨⟨∀ (α ≥ σ) σ′⟩⟩ = ∀ (Q) ⟨⟨σ′⟩⟩[τ/α]}

We extend ⟨⟨·⟩⟩ to prefixes by returning a pair of an unconstrained prefix and a substitution:

⟨⟨∅⟩⟩ = ∅, id \frac{⟨⟨σ⟩⟩ = ∀ (Q_{1}) τ_{1} ⟨⟨Q′⟩⟩ = Q_{2}, θ_{2}}{⟨⟨(α ⋄ σ, Q′)⟩⟩ = Q_{1}Q_{2}, [τ_{1}/α] ∘ θ_{2}}

Note that ML types are invariant by ⟨⟨·⟩⟩. Indeed, we have ⟨⟨∀ (ᾱ) τ⟩⟩ = ∀ (ᾱ) τ. Note also that if ⟨⟨σ⟩⟩ is ∀ (Q) τ, then Q is unconstrained.

Properties 8.1.5 i) For any σ and any substitution θ, we have ⟨⟨θ(σ)⟩⟩ = θ(⟨⟨σ⟩⟩). ii) The following implications hold:

\frac{⟨⟨Q⟩⟩ = Q′, θ}{⟨⟨∀ (Q) σ⟩⟩ = ∀ (Q′) θ(⟨⟨σ⟩⟩)}  \frac{⟨⟨Q_{1}⟩⟩ = Q′_{1}, θ_{1}  ⟨⟨Q_{2}⟩⟩ = Q′_{2}, θ_{2}}{⟨⟨Q_{1}Q_{2}⟩⟩ = Q′_{1}Q′_{2}, θ_{1} ∘ θ_{2}}

iii) We have ⟨⟨σ⟩⟩/ = σ/ for any σ. iv) If σ ≡ τ holds, then ⟨⟨σ⟩⟩ = ∀ (Q) τ with dom(Q) # ftv(τ).

v) If ⟨⟨Q⟩⟩ is (Q′, θ), then there exists θ′ such that θ is θ′ ∘ Q̂. vi) If (Q) σ_{1} ⊑ σ_{2} is flexible, and ⟨⟨Q⟩⟩ = (Q′, θ), then θ(⟨⟨σ_{1}⟩⟩) ⊑_{ML} θ(⟨⟨σ_{2}⟩⟩) holds.

See proof in the Appendix (page 293).

We lift ⟨⟨·⟩⟩ to typing environments in the obvious way.

Lemma 8.1.6 If we have a flexible derivation of (Q) Γ ⊢ a : σ, then we have a derivation of θ(⟨⟨Γ⟩⟩) ⊢ a : θ(⟨⟨σ⟩⟩) in ML, where ⟨⟨Q⟩⟩ is Q′, θ.

\underline{Proof}: By induction on the derivation. Case Var is immediate. Cases Fun, App, and Let are by induction hypothesis. Case Inst is a direct consequence of Property 8.1.5.vi. Case Gen: The premise is (Q, α ⋄ σ_{1}) Γ ⊢ a : σ_{2}. Let ∀ (Q_{1}) τ_{1} be ⟨⟨σ_{1}⟩⟩, and θ_{1} be [τ_{1}/α]. We chose Q_{1} such that dom(Q_{1}) # ftv(Γ) (\underline{1}). By Property 8.1.5.ii, we have ⟨⟨(Q, α ⋄ σ_{1})⟩⟩ = Q′Q_{1}, θ ∘ θ_{1}. By induction hypothesis, we have θ ∘ θ_{1}(⟨⟨Γ⟩⟩) ⊢_{ML} a : θ ∘ θ_{1}(⟨⟨σ_{2}⟩⟩). Since α ∉ ftv(Γ), we have θ_{1}(⟨⟨Γ⟩⟩) = ⟨⟨Γ⟩⟩. Hence, θ(⟨⟨Γ⟩⟩) ⊢_{ML} a : θ ∘θ_{1}(⟨⟨σ_{2}⟩⟩ holds. From (1), we get by Rule Gen of ML, θ(⟨⟨Γ⟩⟩) ⊢_{ML} a : ∀ (Q_{1}) θ ∘ θ_{1}(⟨⟨σ_{2}⟩⟩). This is θ(⟨⟨Γ⟩⟩) ⊢_{ML} a : θ(∀ (Q_{1}) θ_{1}(⟨⟨σ_{2}⟩⟩)). This is the expected result, by observing that ⟨⟨∀ (α ⋄ σ_{1}) σ_{2}⟩⟩ is ∀ (Q_{1}) θ_{1}(⟨⟨σ_{2}⟩⟩).

Corollary 8.1.7 If an expression a is typable under a flexible typing environment Γ in MLF, then a is typable under ⟨⟨Γ⟩⟩ in ML.

\underline{Proof}: Direct consequence of Lemmas 8.1.6 and 8.1.3.

The inverse inclusion has already been stated in Section 5.2.1. In the particular case where the initial typing context Γ_{0} contains only ML types, a closed expression can be typed in MLF under Γ_{0} if and only if it can be typed in ML under Γ_{0}. This is not true for MLF_{⋆} in which the expression λ(x) (x : ⋆) x is typable. Indeed, as shown in Chapter 9, all terms of System F can be typed in MLF_{⋆}.

8.2 Introduction to type annotations

The following example, which describes a single annotation, should provide intuition for the general case.

Example 8.2.14 Let f be a constant of type σ = ∀ (α=σ_{id}, α′ ≥σ_{id}) α → α′ with the δ-reduction f v ⟶ (v : ⋆). Then the expression a defined as λ(x) (f x) x behaves like λ(x) x x and is well-typed, of type ∀ (α=σ_{id}) α → α. To see this, let Q and Γ stand for (α=σ_{id}, α′≥σ_{id}) and x : α. By rules Inst, Var, and App (Q) Γ ⊢ f x : α′ holds; hence by Rule Gen, we get (α = σ_{id}) Γ ⊢ f x : ∀ (α′ ≥ σ_{id}) α′ since α′ is not free in Γ. By Rule Eq-Var, we have ∀ (α′ ≥ σ_{id}) α′ ≡ σ_{id} (under any prefix); besides, σ_{id} ⊑ α → α holds under any prefix that binds α. Thus, we get (α = σ_{id}) Γ ⊢ f x : α → α by Rule Inst. The result follows by rules App, Fun, and Gen.

Observe that the static effect of f in f x is (i) to force the type of x to be abstracted by a type variable α bound to σ_{id} in Q and (ii) to allow f x, that is x, to have the type σ_{id}, exactly as the oracle (x : ⋆) would. Notice that the bound of α in σ is rigid: the function f expects a value v that must have type σ_{id}, and not an instance of σ_{id}. Conversely, the bound of α′ is flexible: the type of f v is σ_{id} but may also be any instance of σ_{id}.

Note that a behaves as the auto-application function λ(x) x x (when applied to the same value, reduction steps of the latter can be put in correspondence with major reduction steps of the former), which is not typable (see Example 6.2.12).

8.3 Annotation primitives

Definition 8.3.1 We call annotations the denumerable collection of unary primitives (∃ (Q) σ), defined for all prefixes Q and polytypes σ closed under Q. The initial typing environment Γ_{0} contains these primitives with their associated type:

(∃ (Q) σ) : ∀ (Q) ∀ (α = σ) ∀ (β ≥ σ) α → β  ∈ Γ_{0}

We may identify annotation primitives up to the equivalence of their types.

Besides, we write (a : ∃ (Q) σ) for the application (∃ (Q) σ) a. We also abbreviate (∃ (Q) σ) as (σ) when all bounds in Q are unconstrained. Actually, replacing an annotation (∃ (Q) σ) by (σ) preserves typability and, more precisely, preserves typings.

Note the difference between (∃ (Q) σ) and (∀ (Q) σ). The latter would require the argument to have type ∀ (Q) σ while the former only requires the argument to have type σ under some prefix Q′ to be determined from the context.

Example 8.3.15 As seen in Example 6.2.12, λ(x) x x is not typable in MLF. We also claimed that it would be typable with annotations. We give a typing derivation for λ(x) let y = (x : σ_{id}) in y y. We write a for this expression and σ_{a} for ∀ (α = σ_{id}) ∀ (α′ ≥ σ_{id}) α → α′.

Let

(α = σ_{id}) Γ, x : α ⊢ (x : σ_{id}) : σ_{id} (\underline{2})
(α = σ_{id}) Γ, x : α, y : σ_{id} ⊢ y y : σ_{id} (\underline{1})

Fun \frac{(α = σ_{id}) Γ, x : α ⊢ let y = (x : σ_{id}) in y y : σ_{id}}{Gen \frac{(α = σ_{id}) Γ ⊢ a : ∀ (α′ ≥ σ_{id}) α → α′}{(∅) Γ ⊢ a : σ_{a}}}

The judgment (1) can be easily derived, since y is known to have the polymorphic type σ_{id}. The key point of this derivation is how we get the judgment (2). That is, having x : α in the typing environment, and (α = σ_{id}) in the prefix, how can we derive (Q) Γ ⊢ (x : σ_{id}) : σ_{id}? Here is the derivation, writing Q for (α = σ_{id}):

App Inst \frac{(Q) Γ ⊢ (σ_{id}) : ∀ (α_{1} = σ_{id}) ∀ (α_{2} = σ_{id}) α_{1} → α_{2}}{(Q) Γ ⊢ (σ_{id}) : ∀ (α_{2} = σ_{id}) α → α_{2}}  (Q) Γ ⊢ x : α (Q) Γ ⊢ (x : σ_{id}) : σ_{id}

The instantiation simply shares α_{1} with α in the prefix (rules A-Hyp and R-Context-Rigid).

While annotations have been introduced as primitives for simplicity of presentation, they are obviously meant to be applied. Notice that the type of an annotation may be instantiated before the annotation is applied. However, the annotation keeps exactly the same “revealing power” after instantiation. This is described by the following technical lemma (the reader may take ∅ for Q_{0} at first).

Lemma 8.3.2 We have (Q_{0}) Γ ⊢ (a : ∃ (Q) σ) : σ_{0} iff there exists a type ∀ (Q′) σ′_{1} such that (Q_{0}) Γ ⊢ a : ∀ (Q′) σ′_{1} holds together with the following relations:

Q_{0}Q ⊑ Q_{0}Q′  (Q_{0}Q′) σ′_{1} ⊐ − σ  (Q_{0}) ∀ (Q′) σ ⊑ σ_{0}

The prefix Q of the annotation ∃ (Q) σ may be instantiated into Q′. However, Q′ guards σ′_{1} ⊐ − σ in (Q_{0}Q′) σ′_{1} ⊐ − σ. In particular, the lemma would not hold with (Q_{0}) ∀ (Q′) σ′_{1} ⊐ − ∀ (Q′′) σ and (Q_{0}) ∀ (Q′′) σ′_{1} ⊑ σ_{0}. Lemma 8.3.2 has similarities with Rule Annot of Poly-ML [GR99]. See proof in the Appendix (page 295).

Corollary 8.3.3 The judgment (Q) Γ ⊢ (a : ⋆) : σ_{0} holds iff there exists an annotation (σ) such that (Q) Γ ⊢ (a : σ) : σ_{0} holds.

See proof in the Appendix (page 296).

Hence, all expressions typable in MLF_{⋆} are typable in MLF as long as all annotation primitives are in the initial typing context Γ_{0}. Conversely, the annotation (∃ (Q) σ) can be simulated by λ(x) (x : ⋆) in MLF_{⋆}, both statically and dynamically. Hence annotation primitives are unnecessary in MLF_{⋆}.

Reduction of annotations The δ-reduction for annotations just replaces explicit type information by oracles.

(v : ∃ (Q) σ) ⟶ (v : ⋆)

Lemma 8.3.4 (Soundness of type annotations) Type annotation primitives validate the required hypotheses H0 (arity), H1 (subject-reduction), and H2 (progress).

See proof in the Appendix (page 296).

Syntactic sugar As mentioned earlier, λ(x: σ) a is syntactic sugar for λ(x) let x = (x : σ) in a. The derived typing rule is:

Fun^{⋆} ; \frac{(Q) Γ, x : σ ⊢ a : σ′ Q′ ⊑ Q}{(Q) Γ ⊢ λ(x: ∃ (Q′) σ) a : ∀ (α = σ) ∀ (α′ ≥ σ′) α → α′}

This rule is actually simpler than the derived annotation rule suggested by Lemma 8.3.2, because instantiation is here left to each occurrence of the annotated program variable x in a.

The derived reduction rule is (λ(x: ∃ (Q) σ) a) v ⟶^{β_{⋆}} let x = (v : ∃ (Q) σ) in a. Indeed, values must then be extended with expressions of the form λ(x: ∃ (Q) σ) a.

Part III

Expressiveness of MLF

We have already seen that all ML programs can be written in MLF without annotations. In Chapter 9, we provide a straightforward compositional translation of terms of System F into MLF. In Chapter 10, we then identify a subsystem of MLF, called Shallow MLF, whose let-binding-free version is exactly the target of the encoding of System F. We give an interpretation of types of Shallow MLF that allows every typing in Shallow MLF to be transformed into one or many typings in System F. In Chapter 11 we consider some extensions of MLF, including references and propagation of type annotations. Finally, Chapter 12 takes a closer look at the MLF programming language by giving some examples of programs that make use of first-class polymorphism.

180 180

Chapter 9

Encoding System F into MLF

In this chapter, we prove that System F can be mechanically encoded into MLF with type annotations primitives (which we simply call MLF). We show that the translation is correct, that is, if a term typable is in System F, then its translation is typable in MLF. This result illustrates the expressiveness of MLF: it shows that all System F expressions are indeed available in MLF. Moreover, thanks to the results of Chapter 7, we know that the translated terms contain all the needed type information to make type inference possible. The last question concerns the conciseness of the translation, and the usefulness of MLF: how many type annotations are needed? Actually, the translation removes type abstraction and type application, hence only type annotations on lambda-abstractions remain. Additionally, annotating with a monotype is useless in MLF, hence some of these annotations are unnecessary. In summary, we see that MLF requires strictly less type information than System F. Moreover, all ML programs are typable without type annotations. Hence, we expect MLF to be really usable in practice: it combines the conciseness of ML, and the second-order power of System F.

We first recall the definition of System F, then we give the translation of System F environments, as well as the translation of System F expressions. Finally, we prove the correctness of the translation.

9.1 Definition of System F

The types, terms, and typing contexts of system F are given below:

t ::= α | t → t | ∀ α · t  Types
M ::= x | M M′ | λ(x: t) M | Λ(α) M | M [t]  Terms
A ::= ∅ | A, x : t | A, α  Typing Contexts

Types are not divided into monotypes and polytypes, as in MLF, and are simply polymorphic types: the ∀ quantifier can appear at any occurrence. Expressions are either variables such as x, applications M M′, annotated abstractions λ(x: t) M, type abstractions Λ(α) M, which explicitly bind the type variable α in the expression M, or type applications M [t], which explicitly instantiate the polymorphic type of M, say ∀ (α) t′, by using t, leading to t′[t/α]. Typing environments bind variables to types, and bind free type variables. In System F, all type variables must be explicitly introduced.

The typing rules of System F are the following:

F-Var ; \frac{x : t ∈ A}{A ⊢ x : t}  F-App ; \frac{A ⊢ a_{1} : t_{2} → t_{1}  A ⊢ a_{2} : t_{2}}{A ⊢ a_{1} a_{2} : t_{1}}  F-Tapp ; \frac{A ⊢ a : ∀ α · t}{A ⊢ a [t′] : t[t′/α]}

F-Fun ; \frac{A, x : t ⊢ a : t′}{A ⊢ λ(x: t) a : t → t′}  F-Tfun ; \frac{A, α ⊢ a : t α ∉ A}{A ⊢ Λ(α) a : ∀ α · t}

We see that polymorphism is explicitly introduced by type abstraction in Rule F-Tfun, and that it is explicitly instantiated by type application in Rule F-Tapp.

9.2 Encoding types and typing environments

The translation of types of System F into MLF types uses auxiliary rigid bindings for arrow types. This ensures that there are no inner polytypes left in the result of the translation, which would otherwise be ill-formed. Quantifiers that are present in the original types are translated to unconstrained bounds.

[[α]] = α  [[∀ α · t]] = ∀ (α) [[t]]  [[t_{1} → t_{2}]] = ∀ (α_{1} = [[t_{1}]]) ∀ (α_{2} = [[t_{2}]]) α_{1} → α_{2}

In order to state the correspondence between typing judgments, we must also translate typing contexts. The translation of A, written [[A]], returns a pair (Q) Γ of a prefix and a typing context and is defined inductively as follows:

[[∅]] = () ∅  \frac{[[A]] = (Q) Γ}{[[A, x : t]] = (Q) Γ, x : [[t]]}  \frac{[[A]] = (Q) Γ α ∉ dom(Q)}{[[A, α]] = (Q, α) Γ}

The translation of types enjoys the following property:

Lemma 9.2.1 For any t and t′, we have [[t′[t/α]]] ⊏ − ∀ (α = [[t]]) [[t′]].

\underline{Proof}: Let σ be [[t]]. We reason by structural induction on t′.

∘ Case t′ is α: The left-hand side is [[t]], that is σ, the right-hand side is ∀ (α = σ) α. They are equivalent by Eq-Var. We conclude by A-Equiv.

9.3 Encoding expressions  183

∘ Case t′ is β and β ≠ α: The left-hand side is β, the right-hand side is ∀ (α = σ) β. They are equivalent by Eq-Free, and we conclude by A-Equiv.

∘ Case t′ is ∀ β · t′′: By induction hypothesis, we have [[t′′[t/α]]] ⊏ − ∀ (α = σ) [[t′′]]. By notation, this means (Q) [[t′′[t/α]]] ⊏ − ∀ (α = σ) [[t′′]], where Q is unconstrained and binds free variables of the judgment. We can freely assume that Q is of the form (Q′, β ≥ ⊥) (using Lemma 1.6.2 (page 57) if necessary). Hence, by R-Context-R, we get ∀ (β) [[t′′[t/α]]] ⊏ − ∀ (β) ∀ (α = σ) [[t′′]] (\underline{1}). By definition, the left-hand side is [[∀ β · t′′[t/α]]], i.e. [[t′[t/α]]]. The right-hand side is equivalent to ∀ (α = σ) ∀ (β) [[t′′]] by Eq-Comm, i.e. ∀ (α = σ) [[t′]] by definition of [[·]] and of t′. Hence, (1) gives [[t′[t/α]]] ⊏ − ∀ (α = σ) [[t′]], which is the expected result.

∘ Case t′ is t_{1} → t_{2}: By induction hypothesis, we have [[t_{1}[t/α]]] ⊏ − ∀ (α = [[t]]) [[t_{1}]] and [[t_{2}[t/α]]] ⊏ − ∀ (α=[[t]]) [[t_{2}]]. which we write σ′_{1} ⊏ − ∀ (α=σ) σ_{1} (\underline{2}) and σ′_{2} ⊏ − ∀ (α=σ) σ_{2} (\underline{3}). We only have to show that ∀ (α_{1} = σ′_{1}) ∀ (α_{2} = σ′_{2}) α_{1} → α_{2} ⊏ − ∀ (α = σ) ∀ (α_{1} = σ_{1}) ∀ (α_{2} = σ_{2}) α_{1} → α_{2} holds. This is shown by R-Context-Rigid, (2) and (3), and by A-Up^{⋆}.

9.3 Encoding expressions

The translation of System F terms into MLF terms forgets type abstractions and applications, and translates types inside term abstractions.

{[[Λ(α) M]] = [[M]]  [[M t]] = [[M]]  [[x]] = x  [[M M′]] = [[M]] [[M′]] \atop [[λ(x: t) M]] = λ(x: [[t]]) [[M]]}

The soundness of this translation is stated by the following theorem:

Theorem 5 For any closed typing context A (that does not bind the same type variable twice), term M, and type t of System F such that A ⊢ M : t, there exists a derivation (Q) Γ ⊢ [[M]] : σ such that (Q) Γ = [[A]] and [[t]] ⊏ − σ hold.

\underline{Proof}: We reason by induction on the derivation of A ⊢ M : t. Let (Q) Γ be [[A]].

∘ Case F-Var: By hypothesis, we have x : t ∈ A. By definition of [[A]], we have x : [[t]] ∈ Γ, and Γ is closed under Q. Hence, (Q) Γ ⊢ x : [[t]] holds by Var. This is the expected result.

∘ Case F-App: We have M = M_{1} M_{2} and the premises are A ⊢ M_{1} : t_{2} → t_{1} and A ⊢ M_{2} : t_{2}. By induction hypothesis, we have both (Q) Γ ⊢ [[M_{1}]] : σ (\underline{1}) and (Q) Γ ⊢ [[M_{2}]] : σ_{2} (\underline{2}) with [[t_{2} → t_{1}]] ⊏ − σ (\underline{3}) and [[t_{2}]] ⊏ − σ_{2} (\underline{4}). By definition of [[t_{2} → t_{1}]], we have ∀ (α_{2} = [[t_{2}]], α_{1} = [[t_{1}]]) α_{2} → α_{1} ⊏ − σ (\underline{5}) from (3). By (4) and R-Context-Rigid, we have ∀ (α_{2} = [[t_{2}]], α_{1} = [[t_{1}]]) α_{2} → α_{1} ⊏ − ∀ (α_{2} = σ_{2}, α_{1} = [[t_{1}]]) α_{2} → α_{1} (\underline{6}). Thus by Lemma 2.8.2, (5), and (6), there exists a type σ′ such that we have σ ⊏ − σ′ (\underline{7}) and

184  Encoding System F into MLF

∀ (α_{2} = σ_{2}, α_{1} = [[t_{1}]]) α_{2} → α_{1} ⊏ − σ′ (\underline{8}). We can freely assume that σ′ is in normal form. By Property 2.1.3.ii (page 65), σ′ is of the form ∀ (Q′) τ_{2} → τ_{1} (\underline{9}). By Inst, (1), (7), and (9), we get (Q) Γ ⊢ [[M_{1}]] : ∀ (Q′) τ_{2} → τ_{1} (\underline{10}). By Lemma 3.6.11, (8), and (9) we have σ_{2} ⊏ − ∀ (Q′) τ_{2} (\underline{11}) as well as [[t_{1}]] ⊏ − ∀ (Q′) τ_{1} (\underline{12}). Consequently, we can derive (Q) Γ ⊢ [[M_{2}]] : ∀ (Q′) τ_{2} (\underline{13}) by (11), (2), and Inst. Thus, (Q) Γ ⊢ [[M_{1}]] [[M_{2}]] : ∀ (Q′) τ_{1} holds by App^{⋆}, (10), and (13). This and (12) are the expected result.

∘ Case F-Tapp: The premise is A ⊢ M : ∀ α · t′. By induction hypothesis, we have (Q) Γ ⊢ [[M]] : σ (\underline{14}) where [[∀ α · t′]] ⊏ − σ (\underline{15}). By definition, [[∀ α · t′]] is ∀ (α) [[t′]], thus (15) is ∀ (α) [[t′]] ⊏ − σ. By Lemma 3.6.7, this implies that σ is equivalent to ∀ (α) σ_{0} (\underline{16}) with [[t′]] ⊏ − σ_{0} (\underline{17}). Let σ′ be ∀ (α = [[t]]) σ_{0}. We have σ ⊑ σ′ (\underline{18}) by (16), R-Context-Flexible, and I-Bot. By Rule Inst, (14), and (18) gives (Q) Γ ⊢ [[M]] : σ′. Furthermore, we have ∀ (α = [[t]]) [[t′]] ⊏ − σ′ (\underline{19}) by (17) and R-Context-R. We note that [[t′[t/α]]] ⊏ − ∀ (α = [[t]]) [[t′]] (\underline{20}) holds by Lemma 9.2.1. Hence, by R-Trans, (20), and (19), we get [[t′[t/α]]] ⊏ − σ′. This is the expected result.

∘ Case F-Fun: The premise is A, x : t ⊢ a : t′. By induction, we have (Q) Γ, x : [[t]] ⊢ a : σ′, where [[t′]] ⊏ − σ′ (\underline{21}). By Rule Fun^{⋆}, we have (Q) Γ ⊢ λ(x: [[t]]) a : ∀ (α = [[t]], α′ ≥ σ′) α → α′. Let σ′′ be ∀ (α = [[t]], α′ = σ′) α → α′. By Rule Inst, we have (Q) Γ ⊢ a : σ′′. By (21), we have: ∀ (α = [[t]], α′ = [[t′]]) α → α′ ⊏ − σ′′, i.e. [[t → t′]] ⊏ − σ′′.

∘ Case F-Tfun: The premise is A, α ⊢ a : t By induction, we have (Q, α) Γ ⊢ a : σ with [[t]] ⊏ − σ (\underline{22}). We have α ∉ Γ, since α ∉ A. By Rule Gen, we have (Q) Γ ⊢ a : ∀ (α) σ. From (22), we have ∀ (α) [[t]] ⊏ − ∀ (α) σ. That is [[∀ α · t]] ⊏ − ∀ (α) σ.

Noticeably, translated terms contain strictly fewer annotations than original terms; this property that was not true in Poly-ML. In particular, all type Λ-abstractions and type applications are dropped and only annotations of λ-bound variables remain. Moreover, some of these annotations are still superfluous, since, for instance, removing monotype annotations preserves typings in MLF.

Remark 9.3.1 System F can be viewed in Curry style, where terms are unannotated, or in Church style, where terms come with sufficient type information so that full type information can be uniquely reconstructed. In Church style, terms can be given a typed semantics. For instance, type abstraction may stop the evaluation just like value abstractions.

UMLF is somehow the Curry’s view. However, there is no exact Church style for MLF: type abstractions, i.e. places where polymorphism is introduced, are left implicit, and type applications, i.e. places where polymorphism is used, are inferred. Even terms with fully annotated λ-abstractions can place type-abstraction and type application at different occurrences.

There is thus no obvious typed semantics for MLF: if the semantics were given on type derivations, one should then show some coherence property that the semantics is independent of the translation, and in particular on places where type-abstractions or type-applications would be inserted.

Encoding Poly-ML

Although not stated formally, terms of Poly-ML [GR99] can be translated to terms of System F. As a corollary of Theorem 5, terms typable in Poly-ML can also be typed in MLF. note that all polymorphism-elimination annotations ⟨·⟩ that were mandatory in Poly-ML are indeed removed in the translation.

186

Chapter 10

Shallow MLF

We have seen in Chapter 9 that System F can be encoded in MLF by just erasing type applications and type abstractions. Hence, the set of unannotated lambda-terms typable in System F is included in the set of lambda-terms typable in MLF. Conversely, we may wonder whether MLF is strictly more powerful than System F, that is, whether there exists a term typable in MLF whose type erasure is a lambda-term that is not typable in System F. As a first step, we identify a strict subset of MLF which is sufficient to encode System F. In this chapter, we describe this subsystem, called Shallow MLF.

10.1 Definition and characterization

In the following, a type of System F is called a System F type. We also introduce a subset of MLF types, called F-types, which are, intuitively, the translation of System F types into MLF.

Definition 10.1.1 A type in normal form is an F-type if and only if all its flexible bounds are unconstrained (that is, of the form (α ≥ ⊥)). A type is an F-type if and only if its normal form is an F-type.

Types that are not F-types, e.g. ∀ (α ≥ σ) τ (\underline{1}), where σ is equivalent neither to a monotype nor to ⊥, have been introduced to factor out choices during type inference. Such types are indeed used in a derivation of let f = chooseidin (f auto) (f succ). However, they are never used in the encoding of System F. We wish to show that restricting MLF derivations to use only F-types preserves the encoding of System F. We do not show this result directly, but first consider a less restrictive subset of types, called shallow types. Shallow types are a superset of F-types that also allow types such as (1), except in rigid bounds. Indeed, a rigid bound corresponds intuitively to an explicit type annotation in the source code. Then restricting rigid bounds to F-types amounts to restricting type annotations to F-types only. From a practical point of view, this means that the type annotation primitives available to the programmer are F-types only. Shallow types are still needed, however, because they are introduced by the type inference algorithm e.g. in the typing of chooseid).

Definition 10.1.2 Let a type in normal form be shallow if and only if all its rigid bounds are F-types. A type is shallow if and only if its normal form is shallow. A prefix Q is shallow if and only if ∀ (Q) ∇_{dom(Q)} is shallow.

Since shallowness depends on the binding structure of types, it can be captured by polynomials, as defined in Section 2.7.2. Actually, polynomial variables X, Y, and Z correspond respectively to top-level flexible bindings, rigid bindings, and flexible bindings under rigid bindings. Hence, we expect Z to correspond exactly to the bounds that are unconstrained in shallow types. which leads to the following definition:

Definition 10.1.3 Let P and P′ be polynomials in IN[X, Y, Z]. We write P ⩽_{Z} P′ if and only if the maximal degree of variable Z in P is less than or equal to the maximal degree of variable Z in P′.

For example, we have X^{2}Y Z ⩽_{Z} Z^{2}, XY ⩽_{Z} Y, as well as 1 ⩽_{Z} 0. Note that ⩽_{Z} is defined with the maximal degree, hence we have some unusual properties. For instance we have P_{1} + P_{2} ⩽_{Z} P′ if and only if P_{1} ⩽_{Z} P′ and P_{2} ⩽_{Z} P′. Moreover, we have P ⩽_{Z} P_{1} + P_{2} if and only if P ⩽_{Z} P_{1} or P ⩽_{Z} P_{2}.

The shallowness of a type σ can be tested by looking only at the degree of its weight in variable Z (weights w_{A} were defined page 91), as formalized by Property 10.1.4.ii below. For example, the type ∀ (α ≥ σ_{id}, β = σ_{id}) α → β is shallow, and its polynomial is X^{2} + Y Z. Conversely, the type ∀ (β = ∀ (α ≥ σ_{id}) α → α) β → β is not shallow, and its polynomial is Y Z^{2}.

Properties 10.1.4 i) A type σ is an F-type iff w_{Y} (σ) ⩽_{Z} Z. ii) A type σ is shallow iff w_{X}(σ) ⩽_{Z} Z. iii) For any σ, we have w_{X}(σ) ⩽_{Z} w_{Y} (σ).

\underline{Proof}: \underline{Property i}: By Property 1.5.6.i and Lemma 2.7.5, we have w_{Y} (σ) = w_{Y} (nf(σ)). Moreover, by definition, a type is shallow if and only if its normal form is shallow. As a consequence, it suffices to show that nf(σ) is an F-type if and only if w_{Y} (nf(σ)) ⩽_{Z} Z. To ease the presentation, we simply assume that σ is in normal form. We proceed by case analysis on the form of σ.

∘ Case τ or ⊥: Then w_{Y} (σ) is 0 or 1, and w_{Y} (σ) ⩽_{Z} Z holds.

∘ Case ∀ (α≥σ_{1}) σ_{2}: Then w_{Y} (σ) is w_{Z}(σ_{1})×Z +w_{Y} (σ_{2}) (\underline{1}). If σ is an F-type, then, by definition, σ_{1} is ⊥, and σ_{2} is an F-type. Hence, we have w_{Z}(σ_{1}) = 1 by definition and w_{Y} (σ_{2}) ⩽_{Z} Z (\underline{2}) by induction hypothesis. This gives w_{Z}(σ_{1}) × Z ⩽_{Z} Z, which implies w_{Y} (σ) ⩽_{Z} Z by (1) and (2). Conversely, if w_{Y} (σ) ⩽_{Z} Z holds, then from (1), we have w_{Z}(σ_{1}) ⩽_{Z} 1 and w_{Y} (σ_{2}) ⩽_{Z} Z. The former implies that w_{Z}(σ_{1}) is 0 or 1. Hence, σ_{1} is ⊥ (it cannot be a monotype τ because σ is in normal form). The latter implies, by induction hypothesis, that σ_{2} is an F-type. Hence, σ, that is ∀ (α ≥ ⊥) σ_{2}, is an F-type. ∘ Case ∀ (α = σ_{1}) σ_{2}: Then w_{Y} (σ) is w_{Y} (σ_{1}) × Y + w_{Y} (σ_{2}). Hence, on the one hand, we have w_{Y} (σ) ⩽_{Z} Z if and only if w_{Y} (σ_{1}) ⩽_{Z} Z and w_{Y} (σ_{2}) ⩽_{Z} Z. On the other hand, σ is an F-type if and only if σ_{1} and σ_{2} are F-types. We conclude by induction hypothesis.

\underline{Property ii}: By structural induction on σ. As in Property i, we assume that σ is in normal form. ∘ Case τ or ⊥: Then w_{X}(σ) is 0 or 1, and w_{X}(σ) ⩽_{Z} Z holds. ∘ Case ∀ (α ≥ σ_{1}) σ_{2}: Then w_{X}(σ) is w_{X}(σ_{1}) × X + w_{X}(σ_{2}). Hence, on the one hand, we have w_{X}(σ) ⩽_{Z} Z if and only if w_{X}(σ_{1}) ⩽_{Z} Z and w_{X}(σ_{2}) ⩽_{Z} Z. On the other hand, σ is shallow if and only if σ_{1} and σ_{2} are shallow. We conclude by induction hypothesis. ∘ Case ∀ (α=σ_{1}) σ_{2}: Then w_{X}(σ) is w_{Y} (σ_{1})×Y +w_{X}(σ_{2}). Hence, we have w_{X}(σ) ⩽_{Z} Z if and only if w_{Y} (σ_{1}) ⩽_{Z} Z and w_{X}(σ_{2}) ⩽_{Z} Z. We conclude by induction hypothesis and Property i.

\underline{Property iii}: By structural induction on σ.

These properties provide a convenient way to characterize F-types and shallow types. It remains to define Shallow MLF as a subset of MLF: Recall that MLF (with type annotations) is a type system that allows all MLF-types as annotations and in derivations. Additionally, MLF_{⋆} allows the guessing of type annotations thanks to Rule Oracle.

Definition 10.1.5 (Shallow MLF) We define Shallow MLF as the subset of MLF where type annotations are restricted to F-types and derivations can only mention shallow types. Similarly, Shallow MLF_{⋆} is the subset of MLF_{⋆} where derivations can only mention shallow types and Rule Oracle can only be used with F-types.

As mentioned earlier, restricting type annotations to F-types amounts to restricting the type of the annotation primitive to a shallow type. Indeed, the type annotation primitive (σ) (we assume σ is closed) has type ∀ (α_{1} = σ) ∀ (α_{2} = σ) α_{1} → α_{2}. This type is shallow if and only if σ is an F-type.

We have given an encoding of System F into MLF in Chapter 9. In the next section, we show that this encoding is actually an encoding into Shallow MLF. That is, not only the type annotations are F-types (which is obvious), but the typing derivations themselves are actually shallow. This means that Shallow MLF, though it is a subset of MLF, is sufficient to provide all the expressiveness of System F.

10.2 Expressiveness of Shallow MLF

It is immediate to check that the translation of System F types are F-types. Hence, the encoding of a term of System F gives a term whose type annotations are F types. Besides, the encoding of a typing environment is a pair composed of a shallow typing environment and an unconstrained prefix. As a consequence, we expect the typing derivation of the encoding to be shallow. The main result of this section gives a stronger result (it is not restricted to translations of System F terms): Lemma 10.2.3 states that if a term is typable in MLF under a shallow typing environment and a shallow prefix, then it is typable in Shallow MLF. The next lemma is a preliminary result which implies that an abstraction of an F-type is also an F-type.

Lemma 10.2.1 If (Q) σ_{1} ⊏ − σ_{2} holds, then so does w_{Y} (σ_{2}) ⩽_{Z} w_{Y} (σ_{1}).

See proof in the Appendix (page 296).

Our goal is to show that a shallow typable term admits a shallow derivation. Actually, the inference and unification algorithms are “shallow-stable”, that is, when given shallow terms (resp. types), they return shallow derivations (resp. types). This implies that the principal type of a shallow term is a shallow type. We formalize the above result for the unification algorithm, after having stated two useful properties.

Properties 10.2.2 i) If Q is shallow, then ∀ (Q) τ is shallow. ii) If Q is shallow and (Q_{1}, Q_{2}) = Q↑ᾱ, then Q_{1} and Q_{2} are shallow. iii) If Q is shallow and Q′ = unify (Q, τ_{1}, τ_{2}), then Q′ is shallow. iv) If Q, σ_{1}, and σ_{2} are shallow, and (Q′, σ_{3}) = polyunify (Q, σ_{1}, σ_{2}), then Q′ and

σ_{3} are shallow.

\underline{Proof}: Properties i and ii are easily shown by structural induction on Q. We prove properties iii and iv simultaneously by induction on the recursive calls to the algorithms. All cases are easy, except the case unify (Q, α_{1}, α_{2}), where (α_{1} ⋄_{1} σ_{1}) and (α_{2} ⋄_{2} σ_{2}) are in Q. In this case, we call polyunify as follows: (Q′, σ_{3}) = polyunify (Q, σ_{1}, σ_{2}). By induction hypothesis Q′ and σ_{3} are shallow. Besides, without loss of generality, Q′ is of the form (Q_{1}, α_{1} ⋄_{1} σ_{1}, Q_{2}, α_{2} ⋄_{2} σ_{2}, Q_{3}). We note that Q_{1}, Q_{2}, and Q_{3} are shallow. We return Q′′ defined as (Q_{1}, α_{1} ⋄ σ_{3}, Q_{2}, α_{2} = α_{1}, Q_{3}), where ⋄ is rigid if and only if ⋄_{1} or ⋄_{2} is rigid. If ⋄ is flexible, then Q′′ is shallow by construction, and the case is solved. Otherwise, ⋄ is rigid, which means that ⋄_{1} or ⋄_{2} is rigid. We show the result for ⋄_{1} rigid, the other case being similar. The update algorithm calls the abstraction-check algorithm, which ensures that (Q′) σ_{1} ⊏ − σ_{3} holds. By hypothesis, (α_{1} = σ_{1}) is in Q and Q is shallow, thus σ_{1} must be an F-type. By Lemma 10.2.1 and Property 10.1.4.i, σ_{3} is an F-type too. Hence, Q′′ is shallow.

We can now state the main result of the section: a shallow term typable in MLF is typable in Shallow MLF.

Lemma 10.2.3 If Q, Γ, and a are shallow, and (Q) Γ ⊢ a : σ holds in MLF for some σ, then there exists a shallow derivation of (Q) Γ ⊢ a : σ′ for some shallow type σ′.

\underline{Proof}: By completeness of the type inference algorithm, we know that infer (Q, Γ, a) succeeds. We show by induction on the recursive calls to infer that if Q, Γ, and a are shallow, and Q′, σ is infer (Q, Γ, a), then Q′ and σ are shallow. All cases are easy, using Property 10.2.2.iii for the application case.

As a conclusion, if a shallow term a is typable in MLF, under a shallow prefix and a shallow typing environment, then it admits a derivation in Shallow MLF. In that case, it is noticeable that the inference algorithm returns a shallow principal type. As a first corollary, subject reduction holds in Shallow MLF since it holds in MLF. As a second corollary, the encoding given for System F also holds in Shallow MLF. Hence we have shown the inclusion System F ⊆ Shallow MLF (considering only type erasure of terms). The next section covers the converse inclusion: is Shallow MLF included in System F?

10.3 Comparison with System F

10.3.1 Introduction

An immediate issue prevents Shallow MLF from being compared to System F: Letbindings. Usually, a let-binding let x = a_{1} in a_{2} in encoded as (λ(x) a_{2}) a_{1}. We note that let-bindings do not increase expressiveness in MLF or MLF_{⋆}, since the above encoding can always be used, inserting explicit type annotations or oracles if necessary. For example, let σ be the type ∀ (α ≥ σ_{id}) α → α. Then the expression let x = choose id in a can be encoded as (λ(x: σ) a) (choose id) in MLF, or as (λ(x: ⋆)

a) (chooseid) in MLF_{⋆}. The same property is not true for Shallow MLF, since shallowtypes that are not F-types cannot be used as annotations. Indeed, the principal type given to choose id, namely σ, is a shallow type but not a F-type. Hence, whereas let x = choose id in a is in Shallow MLF, its natural encoding as a λ-abstraction is not in Shallow MLF.^{1} Therefore, we also have to consider the restriction Shallow F of Shallow MLF to programs without let-bindings. The encoding of System F into MLF given in Section 9.1 is actually an encoding into Shallow F, by considering λ(x: σ) a as syntactic sugar for λ(x) a[(x : σ)/x] instead of λ(x) let x = (x : σ) in a.

1This does not imply that the type erasure of the encoding is not in Shallow MLF. See the comparison between MLF and System F in Section 10.4 for more details about this issue.

Similarly, λ(x: ⋆) a is syntactic sugar for λ(x) a[(x : ⋆)/x]. Hence, we have the inclusion System F ⊆ Shallow F, considering only the type erasure of terms. We wish to show the converse inclusion: the type erasure of terms typable in Shallow F, that is in Shallow MLF without Let-binding, is included in the type erasure of terms typable in System F.

10.3.2 Preliminary results about System F

Types of System F are written with letter t. We recall that types of Shallow MLF are written σ in general, and τ when they are monotypes. We implicitly consider that a monotype τ is in Shallow MLF as well as in System F. We define below the projection of an F-type (which is a type in MLF) into a System F type: Given an F-type σ in normal form, we define \underline{σ} as its projection into an F-type:

\underline{⊥} =^{△} ∀ α · α  \underline{τ} =^{△} τ  \underline{∀ (α = σ) σ′} =^{△} \underline{σ′}[\underline{σ}/α]  \underline{∀ (α ≥ ⊥) σ} =^{△} ∀ α · \underline{σ}

As for the general case, \underline{σ} is \underline{nf(σ)}. As mentioned above, we consider that τ is in System F, thus we have \underline{τ} = τ.

Next, we formalize the instance relation of System F, which we write ⊑_{F}. We use it to define the function fsub (t) as the set of all instances of t. The relation ⊑_{F} is defined as follows:

∀ ᾱ · t ⊑_{F} ∀ β̄ · t[t̄/ᾱ] holds if and only if β̄ is disjoint from ftv(t).

We define fsub (t) as {t′ | t ⊑_{F} t′}.

We also extend the function proj() (defined page 40) to System F types. This function takes a System F type and returns a skeleton.

proj(α) =^{△} α  proj(t_{1} → t_{2}) =^{△} proj(t_{1}) → proj(t_{2})  proj(∀ α · t) =^{△} proj(t)[⊥/α]

We write σ ⩽_{/} t for σ/ ⩽_{/} t/.

We can now state a few properties. In the following, we write S for a set of types of System F. We define ∀ α · S as the set {∀ α · t | t ∈ S}, and fsub (S) is the set ⋃_{t∈S} fsub (t). We use the letter θ for substitutions in System F. It should be clear from the context if a given substitution θ is a substitution in System F or in Shallow MLF. Substitutions are implicitly capture-avoiding. We note that [(∀ β · β → β)/α] is a valid substitution in System F. It is not the case in Shallow MLF or in MLF, where only monotype substitutions are allowed. We write θ(S) for the set {θ(t) | t ∈ S}.

10.3 Comparison with System F  193

Properties 10.3.1 i) We have ftv(\underline{σ}) = ftv(σ). ii) We have θ(fsub (S)) ⊆ fsub (θ(S)). iii) We have ∀ α · fsub (S) ⊆ fsub (∀ α · S). iv) If fsub (S_{1}) = fsub (S_{2}), then fsub (∀ ᾱ · S_{1}) = fsub (∀ ᾱ · S_{2}).

v) We have fsub (θ(t)) = fsub (θ(fsub (t))).

\underline{Proof}: \underline{Property i}: Straightforward structural induction on σ.

\underline{Property ii}: Let t be in θ(fsub (S)). By definition, there exists t_{1} ∈ S and t_{2} such that t_{1} ⊑_{F} t_{2} (\underline{1}) and t = θ(t_{2}). Then we get θ(t_{1}) ⊑_{F} θ(t_{2}) from (1), that is, θ(t_{1}) ⊑_{F} t. Hence, t ∈ fsub (θ(S)).

\underline{Property iii}: Let t be in ∀ α · fsub (S). By definition, t is of the form ∀ α · t′ for some System F type t′ and there exists t′′ in S such that t′′ ⊑_{F} t′ (\underline{1}). Then ∀ α · t′′ ⊑_{F} ∀ α · t′ holds from (1), that is ∀ α · t′′ ⊑_{F} t. Hence, t ∈ fsub (∀ α · S).

\underline{Property iv}: We have fsub (S_{1}) ⊆ fsub (S_{2}). Prefixing both sets with ∀α, we get the inclusion ∀ α · fsub (S_{1}) ⊆ ∀ α · fsub (S_{2}). Applying fsub (), we get fsub (∀ α · fsub (S_{1})) ⊆ fsub (∀ α · fsub (S_{2})) (\underline{1}). By Property iii, we have ∀ α · fsub (S_{2}) ⊆ fsub (∀ α · S_{2}). Hence, we get fsub (∀ α · fsub (S_{1})) ⊆ fsub (fsub (∀ α · S_{2})) from (1). This happens to be equivalent to fsub (∀ α · fsub (S_{1})) ⊆ fsub (∀ α · S_{2}) (\underline{2}). Additionally, we have S_{1} ⊆ fsub (S_{1}), thus fsub (∀ α · S_{1}) ⊆ fsub (∀ α · fsub (S_{1})) holds. Then, fsub (∀ α · S_{1}) ⊆ fsub (∀ α · S_{2}) holds from (2). By symmetry, we get fsub (∀ α · S_{1}) = fsub (∀ α · S_{2}).

\underline{Property v}: We have t ∈ fsub (t). Hence, θ(t) is in the set θ(fsub (t)), which implies that fsub (θ(t)) ⊆ fsub (θ(fsub (t))) (\underline{1}) holds. Conversely, we show that fsub (θ(fsub (t))) ⊆ fsub (θ(t)) holds. Let t_{1} be in fsub (θ(fsub (t))). By definition, there exists t_{2} such that t ⊑_{F} t_{2} (\underline{2}) and θ(t_{2}) ⊑_{F} t_{1} (\underline{3}). Then θ(t) ⊑_{F} θ(t_{2}) (\underline{4}) holds from (2). Thus θ(t) ⊑_{F} t_{1} holds by (4) and (3). This means that t_{1} is in fsub (θ(t)). As a conclusion, we have fsub (θ(fsub (t))) ⊆ fsub (θ(t)) (\underline{5}). By (1) and (5), we get fsub (θ(t)) = fsub (θ(fsub (t))).

The next definition captures the idea that a set S depends only on a given set of type variables. For example, given a type t, consider the set S defined as fsub (t). Since S is generated only from t, it can depend only on the free variables of t. As a consequence, if the type β → β is in S, and β is not free in t, this means that γ → γ is also in S for any γ. Actually, we can even expect t′ → t′ to be in S, for any type t′. This is captured by the following definition (think of ᾱ as the set of type variables used to generate the set S):

Definition 10.3.2 We say that a set of types S is ᾱ-stable if and only if for any substitution θ invariant on ᾱ, we have θ(S) ⊆ S.

We note that if S is ᾱ-stable, then it is also (ᾱ ∪ β̄)-stable. We defined Σᾱ page 103 as the set of MLF-types whose unbound variables are included in ᾱ. We now define Σ¬ ; ᾱ as the set of System F types whose free variables are disjoint from ᾱ. The notation S_{1} =ᾱ S_{2}, defined next, intuitively means that the sets S_{1} and S_{2} are equal, except for some “uninteresting” types that mentions variables in ᾱ. Formally, we write S_{1} =ᾱ S_{2} if S_{1} ∩ Σ¬ ; ᾱ = S_{2} ∩ Σ¬ ; ᾱ holds. We write S_{1} ⊆ᾱ S_{2} if S_{1} ∩ Σ¬ ; ᾱ ⊆ S_{2} ∩ Σ¬ ; ᾱ holds. We note that S_{1} =ᾱ S_{2} holds if and only if S_{1} ⊆ᾱ S_{2} and S_{1} ⊆ᾱ S_{2} hold. Additionally, S_{1} =_{∅} S_{2} means S_{1} = S_{2}.

Properties 10.3.3 i) If S is ᾱ-stable, then fsub (S) is ᾱ-stable. ii) The set fsub (t) is ftv(t)-stable. iii) If S is ᾱ-stable and β̄-stable, then it is (ᾱ ∩ β̄)-stable. iv) If S_{1} and S_{2} are ᾱ-stable, ᾱ # β̄, and S_{1} ⊆β̄ S_{2}, then S_{1} ⊆ S_{2}.

v) If S_{1} and S_{2} are ᾱ-stable, ᾱ # β̄, and S_{1} =β̄ S_{2}, then S_{1} = S_{2}. vi) If we have S_{1} ⊆_{ᾱ∪{α}} S_{2} for all α in an infinite set I, then S_{1} ⊆ᾱ S_{2} holds. vii) If we have S_{1} =_{ᾱ∪{α}} S_{2} for all α in an infinite set I, then S_{1} =ᾱ S_{2} holds. viii) If we have S_{1} ⊆ᾱ S_{2}, then fsub (S_{1}) ⊆ᾱ fsub (S_{2}) holds. ix) If we have S_{1} =ᾱ S_{2}, then fsub (S_{1}) =ᾱ fsub (S_{2}) holds.

x) If we have ᾱ # codom(θ) and S_{1} =ᾱ S_{2}, then θ(S_{1}) =ᾱ θ(S_{2}).

See proof in the Appendix (page 297).

Thanks to these properties about sets of System F types, we are ready to introduce the interpretation of Shallow MLF types as sets of System F types.

10.3.3 Encoding shallow types into System F

Shallow types are more expressive than types of System F. As an example, the principal type given to the expression choose id, that is, ∀ (α ≥ σ_{id}) α → α has no direct counterpart in System F. More precisely, the above expression can be annotated in multiple ways, leading to multiple typings in System F. In particular, it can be typed with σ_{id} → σ_{id} and also with (t → t) → (t → t) for any type t. This is the reason why the encoding of a shallow type is not a single System F type, but rather a set of types. Intuitively, the encoding of a type σ is the set of all instances of σ that are F-types. Hence, the following definition:

Definition 10.3.4 The interpretation of a shallow type σ, written ((σ)), is a set of System F types defined inductively as follows:

((τ)) =^{△} fsub (τ)  ((⊥)) =^{△} fsub (∀ α · α)  ((∀ (α = σ) σ′)) =^{△} fsub (((σ′))[\underline{σ}/α]) (\underline{1})

((∀ (α ≥ σ) σ′)) =^{△} fsub ( ⋃_{t∈((σ))}^{ᾱ#ftv(σ,σ′)} ∀ ᾱ · ((σ′))[t/α])

We note that ((τ)) is fsub (τ), which is different from {τ} since it contains all types equivalent to τ is System F. For instance, the type ∀ α · τ is in fsub (τ) if α ∉ ftv(τ). In (1), note that σ is an F-type since ∀ (α = σ) σ′ is shallow. Hence, we substitute α by \underline{σ} in the set ((σ′)).

Example The interpretation of the polymorphic type σ_{id} is (after simplification)

fsub ( ⋃_{t}^{ᾱ#{α}} ∀ ᾱ · t → t), which is exactly the set fsub (∀ α · α → α). Actually, we show

in Property 10.3.6.viii, below, that the interpretation of any F-type σ is the set of all instances of \underline{σ} in System F. Note also that we consider the union over all ᾱ disjoint from {α}. This restriction is unnecessary, and we could as well consider variables ᾱ containing α. However, since both definitions are equivalent, we chose the first one, which makes some proofs easier. It will be shown in Property 10.3.6.ix that more restrictions can be put on ᾱ without changing the definition.

Given two sets of substitutions S_{1} and S_{2}, we write S_{1} ⊚ S_{2} for the set {θ_{1} ∘ θ_{2} | θ_{1} ∈ S_{1}, θ_{2} ∈ S_{2}}. We also write S_{1} ∘ θ for S_{1} ⊚ {θ}.

Definition 10.3.5 The interpretation of a shallow prefix Q, written ((Q)), is a set of substitutions of System F, defined inductively as follows:

{((∅)) =^{△} \{id\} ((Q′, α = σ)) =^{△} ((Q′)) ∘ [\underline{σ}/α] \atop ((Q′, α ≥ σ)) =^{△} ((Q′)) ⊚ ⋃_{t∈((σ))}[nf(t)/α] (\underline{2})}

In (2), we write nf(t) to mean the normal form of t in System F. We could equivalently keep t unchanged, but taking the normal form eases some proofs. We note that ((Q_{1}Q_{2})) is ((Q_{1})) ⊚ ((Q_{2})).

We now establish a number of properties that will be used to show the soundness of the interpretation of shallow types, in Lemma 10.3.10. For instance, Property i shows that the interpretation of a type scheme is closed with respect to the instance relation of System F.

Some results below require the argument σ to be in normal form. This requirement is introduced in order to simplify the corresponding proof. Actually, all of these properties are extended to type schemes not in normal forms, once the necessary results have been shown.

Properties 10.3.6 i) We have fsub (((σ))) = ((σ)). ii) If σ is in normal form and α ∉ ftv(σ), then ∀ α · ((σ)) ⊆ ((σ)). iii) If σ is in normal form, ((σ)) is ftv(σ)-stable. iv) If t is not equivalent to α, then fsub (t[t′/α]) =_{α} (fsub (t))[t′/α].

v) If θ is a substitution and the normal form of t is not in dom(θ), then we have θ(fsub (t)) =_{dom(θ)} fsub (θ(t)).

vi) For all t in ((σ)), we have σ ⩽_{/} t. vii) If nf(σ) ≠ α and nf(σ) ≠ ⊥, we have fsub (((σ))[t/α]) =_{α} ((σ))[t/α]. viii) If σ is an F-type in normal form, then ((σ)) = fsub (\underline{σ}).

ix) If the sets S and S′ are β̄-stable, then we have ⋃_{t∈S}^{ᾱ#β̄} ∀ ᾱ·S′[t/α] = ⋃_{t∈S}^{ᾱ#β̄∪γ̄} ∀ ᾱ·S′[t/α]

x) If θ is a monotype substitution, then we have θ(fsub (S)) =_{dom(θ)} fsub (θ(S)). xi) If θ is a monotype substitution and σ is in normal form, then θ(((σ))) =_{dom(θ)}

((θ(σ))) holds. xii) If σ_{1} ≡ σ_{2} holds, then we have ((σ_{1})) = ((σ_{2})). xiii) If θ is in ((Q)), there exists a System F substitution θ′ such that θ = θ′ ∘ Q̂(t).

See proof in the Appendix (page 299).

Some of the properties above require their argument to be in normal form. Thanks to Property xii, this requirement can be discarded:

Properties 10.3.7 i) If α ∉ ftv(σ), then ∀ α · ((σ)) ⊆ ((σ)). ii) The set ((σ)) is ftv(σ)-stable. iii) If σ is an F-type, then ((σ)) = fsub (\underline{σ}). iv) If θ is a monotype substitution, we have θ(((σ))) =_{dom(θ)} ((θ(σ))).

Abstraction is a relation that hides information in the prefix. Its converse relation is revelation, which exposes a type scheme bound to a variable in the prefix, and is possible only by explicit type annotations. These two relations are at the heart of type inference. However, the interpretation of shallow types is not designed for preserving type inference, but only for comparing expressiveness of Shallow MLF and System F.

Thus abstraction and revelation are ignored by the interpretation, as stated by the following lemma:

Lemma 10.3.8 If we have a shallow derivation of (Q) σ_{1} ⊏ − σ_{2}, then for all θ in ((Q)), the sets fsub (θ(((σ_{1})))) and fsub (θ(((σ_{2})))) are equal.

See proof in the Appendix (page 310).

Note, however, that a corollary of this lemma is that the interpretation of shallow types captures the equivalence relation (as well as the abstraction relation).

The next lemma shows that the interpretation of shallow types is consistent with the instance relation: if σ_{2} is an instance of σ_{1} in Shallow MLF, then each type in ((σ_{2})) must be an instance (in System F) of a type in ((σ_{1})). Actually it amounts to having ((σ_{2})) ⊆ ((σ_{1})). This holds for the instance relation under an empty prefix. The following lemma takes the prefix into account thanks to a substitution θ.

Lemma 10.3.9 If we have a shallow derivation of (Q) σ_{1} ♢ σ_{2}, then for all θ in ((Q)), we have θ(((σ_{2}))) ⊆ θ(((σ_{1}))).

See proof in the Appendix (page 313).

10.3.4 Encoding Shallow F into System F

We consider the Curry-style version of System F, which we call implicit System F. Expressions are expressions of the pure lambda-calculus, so that type applications, type abstractions, and type annotations are all implicit. The typing rules of implicit System F are the following:

IF-Var ; \frac{x : t ∈ A}{A ⊢^{F} x : t}  IF-Fun ; \frac{A, x : t ⊢^{F} a : t′}{A ⊢^{F} λ(x) a : t → t′}  IF-App ; \frac{A ⊢^{F} a_{1} : t_{2} → t_{1}  A ⊢^{F} a_{2} : t_{2}}{A ⊢^{F} a_{1} a_{2} : t_{1}}

IF-Inst \frac{A ⊢^{F} a : t t ⊑_{F} t′}{A ⊢^{F} a : t′} IF-Gen

\frac{A ⊢^{F} a : t α ∉ ftv(A)}{A ⊢^{F} a : ∀ α · t}

As expected, these rules correspond to the rules of System F, where type annotations are removed on lambda-bound variables, type abstractions are type applications are made implicit in rules IF-Gen and IF-Inst, respectively.

In order to prove that Shallow F and System F have the same expressiveness, we introduce Shallow UMLF as Shallow F with implicit oracles and without type annotations. The type erasure of an expression typable in Shallow F is typable in Shallow UMLF.

198  Shallow MLF

Conversely, if an expression is typable in Shallow UMLF, it can be annotated in order to be typable in Shallow F. We simply say that Shallow F and Shallow UMLF have the same set of typable terms. We show in the following lemma that a term typable in Shallow UMLF is also typable in implicit System F.

Lemma 10.3.10 Assume Γ is a type environment with monotypes only. If we have a derivation of (Q) Γ ⊢ a : σ in Shallow UMLF, then θ(Γ) ⊢^{F} a : θ(t) holds for all System F substitutions θ, and System F type t such that θ ∈ ((Q)), and t ∈ ((σ)).

\underline{Proof}: By induction on the shallow derivation of (Q) Γ ⊢ a : σ. Let θ be in ((Q)) and t be in ((σ)) (\underline{1}).

∘ Case Var: By hypothesis, we have Γ(x) = τ. Hence, θ(Γ)(x) is θ(τ). Thus, we can derive θ(Γ) ⊢^{F} a : θ(τ) (\underline{2}) by IF-Var. Additionally, t is in ((τ)). Hence, t is in fsub (τ), which means that t is equivalent to τ. Then θ(t) is equivalent to θ(τ). Thus, θ(Γ) ⊢^{F} a : θ(t) holds from (2) by IF-Inst.

∘ Case App: The premises are (Q) Γ ⊢ a_{1} : τ_{2} → τ_{1}, (Q) Γ ⊢ a_{2} : τ_{2}, a is a_{1} a_{2}, and σ is τ_{1}. By induction hypothesis, we have θ(Γ) ⊢^{F} a_{1} : θ(τ_{2} → τ_{1}), as well as θ(Γ) ⊢^{F} a_{2} : θ(τ_{2}). By IF-App, we get θ(Γ) ⊢^{F} a : θ(τ_{1}) (\underline{3}). We note that ((τ_{1})) = fsub (τ_{1}), hence, t is equivalent to τ_{1} (from (1)). This implies θ(t) equivalent to θ(τ_{1}). Then by IF-Inst and (3), we get θ(Γ) ⊢^{F} a : θ(t).

∘ Case Fun: The premise is (Q) Γ, x : τ_{0} ⊢ a′ : τ, a is λ(x) a′, and σ is τ_{0} → τ. We note that ((τ_{0} → τ)) = fsub (τ_{0} → τ), hence, t is equivalent to τ_{0} → τ (from (1)). Then θ(t) is equivalent to θ(τ_{0} → τ). By induction hypothesis, we have θ(Γ, x : τ_{0}) ⊢^{F} a′ : θ(τ). By IF-Fun, we get θ(Γ) ⊢^{F} λ(x) a′ : θ(τ_{0}) → θ(τ). By IF-Inst, we get θ(Γ) ⊢^{F} a : θ(t).

∘ Case Gen: The premise is (Q, α⋄σ_{1}) Γ ⊢ a : σ_{2} with α ∉ ftv(Γ), and σ is ∀ (α⋄σ_{1}) σ_{2}. We consider two subcases:

Subcase σ is ∀ (α = σ_{1}) σ_{2}: By definition, we have ((σ)) = fsub (((σ_{2}))[\underline{σ_{1}}/α]). From (1), there exists t_{2} in ((σ_{2})) such that t_{2}[\underline{σ_{1}}/α] ⊑_{F} t holds. This implies the inclusion θ(t_{2}[\underline{σ_{1}}/α]) ⊑_{F} θ(t) (\underline{4}). Let θ′ be θ ∘ [\underline{σ_{1}}/α]. We note that θ′ ∈ ((Q, α = σ_{1})). By induction hypothesis, we have θ′(Γ) ⊢^{F} a : θ′(t_{2}), that is, θ(Γ) ⊢^{F} a : θ(t_{2}[\underline{σ_{1}}/α]). By (4) and IF-Inst, we get θ(Γ) ⊢^{F} a : θ(t).

Subcase σ is ∀ (α ≥ σ_{1}) σ_{2}: By definition, we have

((σ)) = fsub ( ⋃_{t_{1}∈((σ_{1}))}^{ᾱ#ftv(σ_{1},σ_{2})} ∀ ᾱ · ((σ_{2}))[t_{1}/α])

Let J be ftv(σ_{1}, σ_{2}) ∪ ftv(θ(Γ)) ∪ dom(θ) ∪ codom(θ) (\underline{5}). By Properties 10.3.7.ii and 10.3.6.ix, we get

((σ)) = fsub ( ⋃_{t_{1}∈((σ_{1}))}^{ᾱ#J} ∀ ᾱ · ((σ_{2}))[t_{1}/α])

10.3 Comparison with System F  199

From (1), there exist t_{2} ∈ ((σ_{2})), t_{1} ∈ ((σ_{1})), and ᾱ disjoint from J such that ∀ ᾱ · t_{2}[t_{1}/α] ⊑_{F} t (\underline{6}) holds. Let θ′ be θ ∘ [nf(t_{1})/α]. We note that θ′ ∈ ((Q, α ≥ σ_{1})). By induction hypothesis, we have θ′(Γ) ⊢^{F} a : θ′(t_{2}), that is, θ(Γ) ⊢^{F} a : θ(t_{2}[nf(t_{1})/α]). By (5) and IF-Gen, we get θ(Γ) ⊢^{F} a : ∀ ᾱ · θ(t_{2}[nf(t_{1})/α]). By (5), this is equal to θ(Γ) ⊢^{F} a : θ(∀ ᾱ · t_{2}[nf(t_{1})/α]). By (6) and F-Inst, we get θ(Γ) ⊢^{F} a : θ(t).

∘ Case Inst: The premise is (Q) Γ ⊢ a : σ′ and (Q) σ′ ⊑ σ holds. By Lemma 10.3.9, we have θ(((σ))) ⊆ θ(((σ′))). Hence, we have θ(t) ∈ θ(((σ′))), that is, there exists t′ in ((σ′)) such that θ(t) = θ(t′). By induction hypothesis, we have a derivation of θ(Γ) ⊢^{F} a : θ(t′), that is, θ(Γ) ⊢^{F} a : θ(t).

∘ Case Oracle: The premises are (Q) Γ ⊢ a : σ′ and (Q) σ ⊏ − σ′. By Lemma 10.3.8, we have fsub (θ(((σ)))) = fsub (θ(((σ′)))). We note that θ(t) is in fsub (θ(((σ)))). Hence, θ(t) is in fsub (θ(((σ′)))), that is, there exists t′ in ((σ′)) such that θ(t′) ⊑_{F} θ(t) (\underline{7}). By induction hypothesis we have θ(Γ) ⊢^{F} a : θ(t′). By (7) and IF-Inst, we get θ(Γ) ⊢^{F} a : θ(t).

Note that the above lemma makes sense since ((Q)) and ((σ)) are not empty by construction.

In order to illustrate this result, we consider the expression a equal to chooseid. In MLF, a has the principal type ∀ (α ≥ σ_{id}) α → α, which we write σ. The corresponding derivation is the following: (for the sake of readability we only show a meaningful excerpt of the derivation)

Gen

App Inst \frac{(α ≥ σ_{id}) ∅ ⊢ choose : ∀ (β) β → β → β (α ≥ σ_{id}) ∀ (β) β → β → β ⊑ α → α → α}{(α ≥ σ_{id}) ∅ ⊢ choose : α → α → α}  \frac{(α ≥ σ_{id}) ∅ ⊢ id : σ_{id} (α ≥ σ_{id}) σ_{id} ⊑ α}{(α ≥ σ_{id}) ∅ ⊢ id : α} Inst (α ≥ σ_{id}) ∅ ⊢ a : α → α

(∅) ∅ ⊢ a : ∀ (α ≥ σ_{id}) α → α

The above lemma states that for any System F type t in ((σ)), ⊢^{F} a : t holds (the prefix is empty). We write id_{α} for α → α, and t_{id} for ∀ α·id_{α}. We give two derivations corresponding to two choices of t, namely t_{id} → t_{id} and ∀ α · id_{α} → id_{α}.

IF-App

IF-Inst \frac{⊢^{F} choose : ∀ β · β → β → β ∀ β · β → β → β ⊑_{F} t_{id} → t_{id} → t_{id}}{⊢^{F} choose : t_{id} → t_{id} → t_{id}}  ⊢^{F} id : t_{id}
⊢^{F} a : t_{id} → t_{id}

IF-Inst \frac{⊢^{F} choose : ∀ β · β → β → β ∀ β · β → β → β ⊑_{F} id_{α} → id_{α} → id_{α}}{⊢^{F} choose : id_{α} → id_{α} → id_{α} (\underline{8})}

IF-Inst

\frac{⊢^{F} id : t_{id} t_{id} ⊑_{F} id_{α}}{⊢^{F} id : id_{α} (\underline{9})}

IF-Gen IF-App \frac{(8) (9)}{⊢^{F} a : id_{α} → id_{α}} ⊢^{F} a : ∀ α · id_{α} → id_{α}

In the first derivation, the substitution taken from ((α ≥ σ_{id})) is [t_{id}/α], while it is [id_{α}/α] in the second derivation.

As a conclusion, each term typable in Shallow UMLF is also typable in System F, thus System F and Shallow F have the same set of typable terms. As a corollary, type inference in Shallow UMLF is undecidable, and so is type inference in Shallow MLF_{⋆}. However, this does not imply undecidability of type inference in MLF_{⋆}, even though the converse would be surprising.

Since Shallow F and System-F have the same expressiveness, for every term a of Shallow F there exists a term M of explicitly typed system F that has the same erasure as a. However, there is no unicity of a.

The interpretation of shallow types in System F suggests a semantics for types. However, the encoding ((σ)) of shallow types is disappointing: On the one hand, as stated by Lemma 10.3.8, abstraction and revelation are not covered by the interpretation. On the other hand, the strength of MLF lies in the way it propagates type information via abstraction and revelation, which makes type inference possible. Thus, the given encoding does not provide a semantics meaningful for type inference. Fixing this amounts to finding an interpretation that makes the difference between e.g. ∀ (α = σ_{id}) α → α and ∀ (α = σ_{id}, β = σ_{id}) α → β. We are not aware of any such semantics.

10.4 Discussion

Let us summarize the results shown above. This document studies MLF (with type annotations) and MLF_{⋆} (with oracles), which have the same set of typable terms. We wish to compare MLF and System F. We have already shown in Chapter 9 that System F can be encoded in MLF. Hence, the set of typable terms of System F is included in the set of typable terms of MLF. We simply say that System F is included in MLF. We do not show the converse inclusion, but rather consider a restriction of MLF, called Shallow MLF. In Section 10.2, we have shown that a term is typable in Shallow MLF if and only if it is shallow and typable in MLF. Thus, Shallow MLF can as well be defined as MLF where type annotations are required to be types of System F only. As a consequence, System F is included in Shallow MLF. More precisely, terms of System F do not have the let construct, thus System F is included in Shallow F, which is Shallow MLF without let. Conversely, we have shown in Section 10.3, that Shallow F is included in System F. Hence, Shallow F and System F have the same set of typable terms. This can be pictured by the following sequence of relations:

MLF = MLF_{⋆} ⊇ Shallow MLF ⊇ Shallow F = System F

A remaining question is whether Shallow F is a strict subset of Shallow MLF (encoding let constructs as λ-abstractions). We conjecture that this is true.

More precisely, our candidate for discrimination is the term a_{0} given below. We first introduce some notations that make the term a_{0} more readable. Given a number n, we write n̄ for the church numeral n, that is, λ(f) λ(x) (f … (f x)) with f repeated n times. We write S the successor function, that is, λ(n) λ(f) λ(x) f (n f x). We recall that auto is λ(x) x x. Additionally, given two terms a and a′, the sequence a; a′ is syntactic sugar for ¯0 a a′. Then the term a_{0} is defined as let x = a_{1} in a_{2} where a_{1} is the function λ(f) f id and a_{2} is the sequence x auto ; (λ(y) x y ; y S) (λ(z) λ(z′) z ¯2).

The term a_{0} is in Shallow MLF. However, we conjecture that a_{0} is not typable in System F. The intuition is that the two occurrences of x have “incompatible types” ((∀ α·(α → α)) → t) → t for some type t and (ℕ^{2} → ℕ^{2}) → ℕ^{2} in System F where ℕ is the type ∀ α·(α → α) → α → α of church numerals and ℕ^{2} is ℕ → ℕ. In Shallow MLF, x can be assigned the type (∀ (β, α ≥ σ_{id}) α → β) → β.

Furthermore, assuming that a is not in System F, we can build the term a′ equal to ¯1 (λ(x) a_{2}) a_{1}, which is in MLF but not in Shallow MLF. Indeed, (λ(x) a_{2}) a_{1} is typable in MLF (annotating x with the type given above), thus a′ is typable, as shown in Example 5.2.11. However, a′ is not typable in Shallow MLF. Indeed, it would otherwise be typable in Shallow F (it does not use let), and therefore it would be typable in System F. This has been conjectured not to hold.

Still, MLF remains a second-order system and in that sense should not be significantly more expressive than System F. In particular, we conjecture that the term (λ(y) y I ; y K) (λ(x) x x) that is typable in F^{ω} but not in F [GR88] is not typable in MLF either. Conversely, we do not know whether there exists a term of MLF that is not typable in F^{ω}.

Notice however that the term a_{0} given above is typable in F^{ω}. The hint is to encode the type ∀ (β) ∀ (α′≥∀ (α) α → α) (α′ → β) → β as ∀ A·∀ β·((∀ α·A α → A α) → β) → β and use Λ(γ) γ or Λ(γ) ℕ for A to recover the types of the two occurrences of x. Then a can be typed as follows in F^{ω}: (λ(x: ∀ A · ∀ β · ((∀ α · A α → A α) → β) → β) a′_{2}) a′_{1}, where, a′_{1} is Λ(A) Λ(β) λ(f : (∀ α · A α → A α) → β) f (Λ(α) id[A α]) and a′_{2} is

Λ(α)
x [Λ(β) β] [id_{α}] (λ(x: σ_{id}) x [id_{α}] x[α]) ;
(λ(y : ℕ^{2} → ℕ^{2}) x [Λ(α) ℕ^{2}] [ℕ] y ; y S)
(λ(z : ℕ^{2}) λ(z′ : ℕ) z ¯2)

This suggests that there may exist an encoding of MLF into F^{ω}.

We can now enrich the above diagram with these conjectures:

F^{ω}

( \begin{matrix}MLF \\ MLF_{⋆} \end{matrix} ) ⊃^{(\underline{10})} ( \begin{matrix}Shallow MLF \\ Shallow MLF_{⋆} \end{matrix} ) ⊃^{(\underline{11})} Shallow F = System F

⊂^{(\underline{12})} ⊃^{(\underline{13})}

The inclusion (11) corresponds to the encoding of System F, which is shallow (proved). It is conjectured to be a strict inclusion. The inclusion (10) is by construction. It is strict whenever (11) is strict. The inclusion (13) is by construction of F^{ω}. It is known to be a strict inclusion [GR88]. We expect the inclusion (12) to hold, as suggested by the example above, however we are not able to give a systematic encoding of MLF into F^{ω}. This inclusion is also conjectured to be strict.

Reducing all let-bindings in a term of Shallow MLF produces a term in Shallow F. Hence, terms of Shallow MLF are strongly normalizable. We conjecture that so are all terms of MLF.

Chapter 11

Language extensions

We have defined MLF as a core language made of the expressions of ML and type annotations. We have shown that all programs in ML are still typable in MLF, without any annotation. However, real ML programs often mention useful language extensions. We show in this chapter how such extensions could be added to MLF.

Some constructs, such as tuples or records, are looked at in Section 11.1 and are easily added to MLF. Interestingly, first-class polymorphism allows for a direct encoding of some constructs (such as pairs), which is not always possible in ML. Imperative features are considered in Section 11.2: References are known to misbehave in the presence of ML-style polymorphism, thus this extension is more delicate and requires some restrictions. More precisely, we consider the well known value restriction and a more subtle variant, the relaxed value restriction. In Section 11.3, we consider a useful feature that is not meaningful in ML because type annotations are not required for type inference. This feature consists of mechanically propagating type annotations from toplevel to subexpressions. As an immediate application, it can be used to automatically propagate type annotations from interface files to implementation files. For instance, the type information given in the signature of a module can be automatically propagated to each element and each subexpression of the module.

11.1 Tuples, Records

Because the language is parameterized by constants, which can be used either as constructors or primitive operations, the language can import foreign functions defined via appropriate δ-rules. These could include primitive types (such as integers, strings, etc.) and operations over them. Sums and products, as well as predefined datatypes, can also be treated in this manner, but some (easy) extension is required to declare new data-types within the language itself.

As an example, the primitives that handle pairs have the same types as in ML:

\begin{aligned}(_, _) & : & ∀ (α, β) α → β → α × β \\ fst & : & ∀ (α, β) α × β → α \\ snd & : & ∀ (α, β) α × β → β \end{aligned}

The corresponding δ-rules are

\begin{matrix}fst (v_{1}, v_{2}) & ⟶ & v_{1} \\ snd (v_{1}, v_{2}) & ⟶ & v_{2} \end{matrix}

We could also introduce pairs using the usual encoding of pairs in System F:

\begin{aligned}(_, _) & = & λ(x) λ(y) λ(f) f x y \\ fst & = & λ(p) p (λ(x) λ(y) x) \\ snd & = & λ(p) p (λ(x) λ(y) y) \end{aligned}

However, as remarked by Fritz Henglein [Hen93], this encoding is not correct in ML. Indeed, the type given to λ(p) (fst p, snd p) is then ∀ α · α × α → α × α, whereas it is ∀ αβ · α × β → α × β when using the primitive pairs. This cannot be fixed in ML, but it can in MLF, adding a type annotation to the argument of fst and snd:

\begin{aligned}fst & = & λ(p: ∃ (α, β) ∀ (γ) (α → β → γ) → γ) p (λ(x) λ(y) x) \\ snd & = & λ(p: ∃ (α, β) ∀ (γ) (α → β → γ) → γ) p (λ(x) λ(y) y) \end{aligned}

Then the pairs encoded as functions and the primitive pairs have the same typing behavior.

11.2 References

To give an account of references, the simplest modification of the dynamic semantics is to use a global store (mapping store locations to values) and a small-step reduction relation over store-expression pairs. This carries over to MLF without any difficulty.

Adapting the static semantics to ensure that store locations are always used at the same type is more difficult. In ML, this can be done by restricting implicit letpolymorphism to syntactic values [Wri95]. Hence, the type of a location, which must be the type of the non-value expression creating the location, cannot be polymorphic. This solution can be adapted to MLF as well.

Value restriction The value restriction consists of restricting Rule Gen to values (non-expansive expressions) only:

Gen-vr

\frac{(Q, α ⋄ σ) Γ ⊢ a : σ′ α ∉ ftv(Γ) a non-expansive}{(Q) Γ ⊢ a : ∀ (α ⋄ σ) σ′}

Then the type inference algorithm (page 164) is modified as follows:

Case a b :

• let (Q_{1}, σ_{a}) = infer (Q, Γ, a)

• let (Q_{2}, σ_{b}) = infer (Q_{1}, Γ, b)

• let α_{a}, α_{b}, β ∉ dom(Q_{2})

• let Q_{3} = unify ((Q_{2}, α_{a} ≥ σ_{a}, α_{b} ≥ σ_{b}, β ≥ ⊥), α_{a}, α_{b} → β) return (Q_{3}, β)

We return Q_{3} whereas, in the previous version of the algorithm, Q_{3} is split in two parts Q_{4} and Q_{5}. Then Q_{4} is returned as the new prefix, and Q_{5} is generalized in front of β.

However, this solution is likely to be very disappointing when applied to MLF, whose machinery relies on type generalization and the use of polymorphic non-functional expressions (which cannot be η-expanded). As a first example, type annotations are primitives that reveal polymorphism upon application. If the value-restriction holds, a type annotation primitive does no longer reveal polymorphism, because generalization is forbidden. Hence, the introduction of the value-restriction requires a dedicated typing rule for type annotations. Fortunately, there is a simple relaxation of valueonly polymorphism that allows type variables to remain polymorphic in the type of non-values, as long as they only occur covariantly [Gar02]. Since this extension was designed for Poly-ML in the first place (even though it is more general), we expect this solution to work well for MLF as well and to be sufficient in practice.

Relaxed value restriction Given a flat type t, we define ftv^{−}(t) inductively as follows:

ftv^{−}(α) = ∅  ftv^{−}(⊥) = ∅  ftv^{−}(t_{1} → t_{2}) = ftv(t_{1}) ∪ ftv^{−}(t_{2})

Given a type scheme σ, ftv^{−}(σ) is by definition ftv^{−}(proj(t)). We note that all free variables of σ occurring at the left of an arrow are in ftv^{−}(σ). This definition of negative occurrences is not usual, since α is considered negative in (α → β) → β, while it is often considered positive in other type systems.

The relaxed value restriction consists of restricting Rule Gen as follows:

Gen-rvr

\frac{(Q, α ⋄ σ) Γ ⊢ a : σ′ α ∉ ftv(Γ) a non-expansive or α ∉ ftv^{−}(σ′)}{(Q) Γ ⊢ a : ∀ (α ⋄ σ) σ′}

In order to implement this rule in the type inference algorithm, we need to modify the split algorithm (defined page 112) according to the occurrence of variables. Hence the following definition:

Definition 11.2.1 The positive splitting of a closed prefix Q according to the set ᾱ and the type scheme σ is written Q↑^{σ}ᾱ and defined inductively as follows (we require ᾱ ⊆ dom(Q)).:

∅↑^{σ}ᾱ = (∅, ∅)

(Q, α ⋄ σ)↑^{τ} ᾱ = \{ \begin{matrix}(α ⋄ σ) ⟶^{1} Q↑^{σ′}(ᾱ − α) ∪ ftv(σ) & when α ∈ ᾱ or α ∈ ftv^{−}(σ′) \\ (α ⋄ σ) ⟶^{2} Q↑^{∀ (α⋄σ)σ′} ᾱ & otherwise \end{matrix}

Then the type-inference algorithm is modified as follows:

Case a b :

• let (Q_{1}, σ_{a}) = infer (Q, Γ, a)

• let (Q_{2}, σ_{b}) = infer (Q_{1}, Γ, b)

• let α_{a}, α_{b}, β ∉ dom(Q_{2})

• let Q_{3} = unify ((Q_{2}, α_{a} ≥ σ_{a}, α_{b} ≥ σ_{b}, β ≥ ⊥), α_{a}, α_{b} → β)

• let (Q_{4}, Q_{5}) = Q↑^{β} dom(Q)

• return (Q_{4}, ∀ (Q_{5}) β)

The only difference is that variables that are generalized (namely Q_{5}) are those obtained from the positive splitting of Q, which takes the occurrence of the variables into account.

This restriction has been implemented and seems to work well on a few significant examples. It remains to find if it is usable in practice for larger programs.

11.3 Propagating type annotations

In MLF, type annotations are only needed on arguments of λ-abstractions that are used polymorphically. However, for documentation purposes or for readability, it can be useful to put extra type annotations. For instance, consider the following top-level definition: let delta = λ(x: σ_{id}) x x. One could wish to give explicitly the type of delta (the annotation σ_{id} → σ_{id} is syntactic sugar for ∀ (α = σ_{id}) ∀ (β = σ_{id}) α → β): let (delta : σ_{id} → σ_{id}) = λ(x: σ_{id}) x x (\underline{14}). In this case, the two annotations are obviously redundant. We would like to get rid of the second one (x : σ_{id}), which is subsumed by the first one.

In a first time, we define some syntactic sugar to give meaning to the notation let (x : σ) = a. Then we show how type annotations can be automatically propagated in order to avoid useless redundancy.

let-bound variables and λ-bound variables can be annotated, using the following syntactic sugar (the first rule was already defined in Section 8.3):

λ(x: ∃ (Q) σ) a ⟶ λ(x) let x = (x : ∃ (Q) σ) in a
let (x : ∃ (Q) σ) = a in a′ ⟶ let x = (a : ∃ (Q) σ) in a′
let rec (x : ∃ (Q) σ) = a in a′ ⟶ let rec x =
let x = (x : ∃ (Q) σ) in
(a : ∃ (Q) σ) in a′

Next, we show how the outer type annotation in (14) can be propagated to the inner λ-abstraction. More generally, we show how type annotations are propagated to inner terms. Since flexible bindings and rigid bindings are quite different in nature, they are propagated differently. The flexible domain and rigid domain of a prefix, defined next, clearly separate those two kinds of bindings.

Definition 11.3.1 The flexible domain and the rigid domain of a prefix Q , written dom_{>}(Q) and dom_{=}(Q) respectively, are defined as follows:

• α ∈ dom_{>}(Q) if and only if (α ≥ σ) ∈ Q or (α = σ′) ∈ Q and σ′ ∈ T .

• α ∈ dom_{=}(Q) if and only if (α = σ) ∈ Q or (α ≥ σ′) ∈ Q and σ′ ∈ T .

We note that dom(Q) is the union of dom_{>}(Q) and dom_{=}(Q), and that dom(Q̂) is their intersection. Indeed, as explained in Definition 1.5.7, bindings (α ⋄ σ) where σ ∈ T are considered both flexible and rigid.

The rules given below syntactically propagate type annotations. To ease readability, we do not keep the original type annotation in place but only show the propagation mechanism. Actually, the outer type annotation is meant to be kept in place and propagated.

(a_{1} a_{2} : ∃ (Q) σ) ⟶ (a_{1} : ∃ (α, Q) ∀ (α′ = σ) α → α′) a_{2}
(let x = a_{1} in a_{2} : ∃ (Q) σ) ⟶ let x = a_{1} in (a_{2} : ∃ (Q) σ)
(a_{1}, a_{2} : ∃ (Q) ∀ (Q′) τ_{1} × τ_{2}) ⟶ ((a_{1} : ∃ (Q) ∀ (Q′) τ_{1}),
(a_{2} : ∃ (Q) ∀ (Q′) τ_{2}))
(λ(x) a : ∃ (Q) ∀ (Q′) τ_{1} → τ_{2}) ⟶ λ(x: ∃ (QQ_{1}) ∀ (Q′_{1}) τ_{1})
(a : ∃ (QQ_{2}) ∀ (Q′_{2}) τ_{2})

where

(Q_{1}, Q′_{1}) =^{△} Q′↑ ftv(τ_{2}) ∪ dom_{>}(Q′)

(Q_{2}, Q′_{2}) =^{△} Q′↑ ftv(τ_{1})

Hence, if the expression let (delta : σ_{id} → σ_{id}) = λ(x) x x is given in input, it is first replaced by let delta = (λ(x) x x : ∀ (α = σ_{id}, β = σ_{id}) α → β). Then the type annotation is propagated as follows (writing type annotations in normal form): letdelta = (λ(x: σ_{id}) ((x : ∃ (α) α → σ_{id}) x : σ_{id}) : ∀ (α = σ_{id}, β = σ_{id}) α → β). The type annotation (_: σ_{id}) has been automatically propagated to the λ-bound variable x. Note that the expression let (delta : ∃ (α) σ_{id} → α) = λ(x) x x is also typable by syntactic propagation of type annotations.

Chapter 12

MLF in practice

One of the main motivations for designing MLF was that the amount of explicit type information required in some previous proposals was too big. Satisfyingly, the encoding of System F is light, and we know that arguments of λ-abstractions that are not used polymorphically need not be annotated.

12.1 Some standard encodings

Using the prototype, we were able to test a few simple examples such as the usual encodings of Church integers, booleans, and tuples in System F. As expected, very few type annotations are needed, and always at predictable places. Indeed, for arguments that are known to have a polymorphic type (for example the polymorphic type encoding integers), it is usually good practice to annotate them using an abbreviation: on the one hand, such arguments are most of the time more “significant” than monomorphic arguments; on the other hand, the inferred types will be much easier to read, thanks to the abbreviation. Besides, although some functions abstract over polymorphic types, they do not necessarily use their argument in a polymorphic way. As a result, a substantial number of function definitions does not actually need the type annotation that the programmer already provided for his own convenience.

In the following example, we define Church integers and some operations over them.^{1}

         # type Int = ∀α. (α → α) → (α → α)
         type Int defined.
         # let succ (n:Int) = fun f x → n f (f x)
         val succ : ∀(β ≥ ∀α. (α → α) → α → α) Int → β

1The output is taken from the prototype, but slightly modified to make it more readable.

         # let add (n:Int) (m:Int) = n succ m
         val add : ∀(β ≥ Int → Int) Int → β

Actually, both of these functions can be written without type annotations (indeed, they are typable in ML). But then the inferred type, which is equivalent, is harder to read:

         # let add n m = n succ m
         val add : ∀(α ≥ ∀(γ ≥ ∀ x.(x → x) → x → x) Int → γ)

∀(δ) ∀(ϵ) (α → δ → ϵ) → δ → ϵ

Moreover, it sometimes happens that, although a function is typable without any type annotation, the type annotation is mandatory in order to get the “correct” type (see the example with pairs in Section 11.1). Indeed, the principal type of an expression depends on the polymorphic type annotations.

Notice that in all of these cases, the annotation could be propagated from the signature file to the implementation, using the technique described in Section 11.3.

We admit that these examples are only simple encodings that do not make strong use of first-class polymorphism. Thus, it is not surprising that so few annotations are actually needed. However, it would be possible to build more involved examples by using these encodings with complex data structures. For example, it is possible to store Church integers (which are polymorphic) in a hashtable without any need for type annotations. The following piece of code typechecks in MLF with the value restriction.

         let table = Hashtbl.create 10
         Hashtbl.add table "one" (λ(f) λ(x)f x)
         Hashtbl.add table "two"  (λ(f) λ(x)f (f x))
         add (Hashtbl.find table "one") (Hashtbl.find table "two")

The last line applies add, which requires its two arguments to be polymorphic of type Int (Church integers). The type of table is monomorphic, namely α hashtable, where α is a weak type variable. Still, α is bound to Int in the prefix. We see that the type parameter of the type constructor hashtable is implicitly instantiated by (a type variable standing for) a polymorphic type. This makes hashtables, or any data structure, compositionnally usable, including with polymorphic values.

12.2 Existential Types

Another interesting example is the encoding of existentials. In System F, the existential type ∃α.t is isomorphic to the polymorphic type ∀ β · (∀ α · t → β) → β. Then, an existential value v with type ∃α.t is encoded as a function expecting a polymorphic argument: let v′ = Λ(β) λ(x: ∀ α · t → β) x v.

In order to open an existential v′, one must apply it to a polymorphic function, that is, a function parametric over the type being abstracted: (we omit the type application) v′ [..] (Λ(α) λ(x: α) (x, x)).

In MLF, the encoding of existentials gets a real benefit from type inference. Indeed, while the creation of the existential itself requires a type annotation, the opening does not require any type annotation. This is the best we can expect since the abstract type given to the encapsulated value can only be defined by the programmer himself.

Let us consider a concrete example: we build an encapsulation for tasks, that is, a pair of a function and its argument. Tasks can be put in a list and evaluated by a server. The server opens each encapsulation and applies the function (second element of the pair) to its argument (first element of the pair).

         let encapsulate v = λ(f : ∀α. α × (α → unit) → β) f v
         let create f arg = encapsulate (arg, f)
         let serve box = box (λp (snd p) (fst p))

New tasks are easily created using create, put in any data structure such as a list, and served using serve:

         let taskList = (create f1 arg1) :: (create f2 arg2) :: ...
         let server () = List.iter serve taskList

Notice that only a single type annotation is needed for the whole example.

12.3 When are annotations needed?

MLF motto is “annotate arguments that are used polymorphically”. This does not mean that the argument is used twice. Indeed, in some examples, an annotation is required on an argument which is only used once.

Consider the following example:

         let auto (x : ∀α. α → α) = x x
         let t z = auto z
         t id

auto is defined as usual: it requires a polymorphic argument. Then, we define t that expects a polymorphic argument z and applies auto to it. The argument z is not annotated because it is not used polymorphically, but only passed through.

We consider a variant auto_{2} defined as follows:

         let auto_{2} (z:∀α. unit → α → α) = (z ()) (z ())

: ∀(β = ∀α. unit → α → α) ∀(γ ≥ ∀α. α → α) β → γ

Finally, we build t_{2} that, intuitively, takes the identity as an argument, builds a λ-abstraction, and applies auto_{2} to the result.

         let t_{2} y = auto_{2} (λ() y)

This expression is not typable in MLF. It is an example of a function which uses its argument only once, but which requires an annotation. Indeed, annotating y with ∀ (α) α → α suffices to make the expression typable. In this example, the argument y is used polymorphically in the sense that it is used to build a function which is required to be polymorphic. On the contrary, in λz.auto z, the argument z is not used but only passed through.

12.4 A detailed example

In the following example, we aim at writing some generic functions that can be used with different kinds of data structures. For instance, we define the functions size, sum and max that return, respectively, the number of elements of the given data structure, the sum of all (integers) elements of the data structure, and the maximal element of the structure. These functions are written only once, but are applied on two different incompatible implementations. The first one is a list of integers, the second one is a balanced binary tree. Both of these data structures are viewed abstractly, using their associated iterator.

The following type definition corresponds to the type of iterators over type structures holding integers. Since such data structures are typically special instances of graphs, we simply call this type graph.

 type graph = ∀α. (int → α → α) → α → α

The first data structure we use is a list. The iterator over lists is easily defined as follows^{2}:

 let rec list_iter list f accu =
   if list = [] then accu
   else list_iter (cdr list) f (f (car list) accu)

: ∀α. ∀β. α list → (α → β → β) → β → β

The second data structure is a balanced binary tree. We define a datatype for such trees and the corresponding iterator.

2This full example is written as such in our prototype implementation of MLF; only the output is slightly modified to make it easier to read.

type tree = Empty | Node of tree * tree | Leaf of int
(* left-to-right traversal of the tree. *)
let rec (tree_iter: tree → graph) tree f accu  =
  begin match tree with

| Empty → accu

  | Node (left, right) → tree_iter right f (tree_iter left f accu)
  | Leaf x → f x accu
  end
 : tree → graph

The annotation on tree_iter could be omitted here. It makes the inferred type more readable.

Next, we define a few generic functions that can be applied on any data structure, using the iterator.

let size  gr = gr (fun x n → n+1) 0    (* Number of elements. *)
let nodes gr = gr (fun x l → x::l) []  (* List of elements. *)
let sum   gr = gr (fun x s → s+x) 0    (* Sum of all elements. *)
let last  gr = gr (fun x a → x) 0      (* Last element, 0 if none. *)
let max   gr = gr (fun x m → if x > m then x else m) 0
let min   gr = gr (fun x m → if x < m then x else m) (last gr)

Since no type annotation is given, the inferred types may be quite large; for example:

val last : ∀(α ≥ ∀β. ∀(γ ≥ ∀δ. δ → β) β → γ) ∀ϵ. (α → int → ϵ) → ϵ

val max: ∀α. ((int → int → int) → int → α) → α

The following function converts a given graph (whose actual representation is unknown) to a list, provided the given graph is quite small. The list is exported as another graph.

let convert (gr:graph) =
  if size gr < 10 then list_iter (nodes gr)
  else gr
 : graph → graph

An annotation is required because the argument gr is used twice with incompatible types; that is, gr is used polymorphically. The inferred type is also much easier to read than the above types.

The next function (inefficiently) inserts an element in a balanced tree (usual ML code).

let rec insert tree x =
  begin match tree with

| Empty → Leaf x

| Leaf y → Node (Leaf x, Leaf y)

  | Node (left, right) →
      if size (tree_iter left) <= size (tree_iter right)
      then Node (insert left x, right)
      else Node (left, insert right x)
  end
 : tree → int → tree

Next, we build a balanced tree with the values 1, .., 6.

let tree = insert Empty 1
let tree = insert tree 2
let tree = insert tree 3
let tree = insert tree 4
let tree = insert tree 5
let tree = insert tree 6

We define three different graphs. The first one is implemented by a balanced tree; the second one is a conversion of it (and will actually be converted to a list); the third one is implemented by a list.

let graph_{1} = tree_iter tree
let graph_{2} = convert graph_{1}
let graph_{3} = list_iter [1; 2; 3; 4; 5; 6]

The function print_info below prints all kinds of information about a given graph, including its size and all its nodes. It is a generic function: it does not depend on the underlying implementation.

(* Tool function *)
let rec print_list l =
  if l = [] then print "[]"
  else (print_int (car l) ; print "; " ; print_list (cdr l))

let print_info (gr:graph) =
  begin
    print "Size  : " ; print_int (size gr) ; print "\n" ;
    print "Sum   : " ; print_int (sum  gr) ; print "\n" ;
    print "Last  : " ; print_int (last gr) ; print "\n" ;
    print "Max   : " ; print_int (max gr) ; print "\n" ;
    print "Min   : " ; print_int (min gr) ; print "\n" ;
    print "Nodes : " ; print_list (nodes gr) ; print "\n" ;
  end
 : graph → unit

This function is annotated because its argument gr is used polymorphically.

Finally, we call the generic function print_info with the three different graphs we have defined. Two of them are actually implemented by lists and one of them by a balanced tree.

  print "Graph_{1} \n" ; print_info graph_{1} ;
  print "Graph_{2} \n" ; print_info graph_{2} ;
  print "Graph_{3} \n" ; print_info graph_{3} ;

The output we get is the following:

\underline{Graph_{1}}
Size  : 6
Sum   : 21
Last  : 1
Max   : 6
Min   : 1
Nodes : 1; 4; 6; 2; 3; 5; []
\underline{Graph_{2}}
Size  : 6
Sum   : 21
Last  : 5
Max   : 6
Min   : 1
Nodes : 5; 3; 2; 6; 4; 1; []

 \underline{Graph_{3}}
 Size  : 6
 Sum   : 21
 Last  : 6
 Max   : 6
 Min   : 1
 Nodes : 6; 5; 4; 3; 2; 1; []

12.5 Discussion

In the above example, only two type annotations are mandatory, namely in convert and print_info. Another one was provided for convenience in tree_iter. Writing this sample code, it was always very clear when to put an annotation.

A different style would be to annotate generic functions such as size, nodes, etc., although they do not require any annotation. As a result, the inferred types would be nicer, and the function print_info would not need an annotation.

More generally, the “generic functions” above can be viewed as library functions. Then, their type would be provided in a signature file. As a consequence, user-defined functions using this library would, in most cases, not need type annotations.

Conclusion

We have presented MLF, which is an extension of ML with more expressive types that embed first-class polymorphism. A sound and complete unification algorithm for these types is provided; although they are second-order, unification is kept first-order. Indeed, polymorphism is never guessed, but only silently propagated. It can be introduced, as in ML, by the let construct, or by explicit type annotations. Then it is implicitly instantiated, just as in ML.

The typing rules of MLF are the typing rules of ML, up to the richer types and the richer instance relation. As a consequence, the type inference algorithm of MLF is similar to the type inference of ML and basically relies on unification. As in ML, any typable MLF program admits a principal type, that however depends on the explicit type annotations. The similarity between MLF and ML imply that all ML programs are typable in MLF as such. Furthermore, the richer types allow the introduction of type annotations as primitives, for which we prove type safety. Using these primitives, we show how to encode all System F programs by simply erasing type abstractions and type applications.

Interestingly, all type annotations of a System F program are not necessary in MLF: monotype annotations as well as annotations on variables that are not used polymorphically can be inferred. For example, the app function, defined as λ(f) λ(x) f x can be applied to any pair of arguments a_{1} and a_{2} such that a_{1} a_{2} is typable. This is not true in System F where type applications are needed to specialize the type of app. Similarly, the function λ(x) x id can be applied both to a function expecting a monomorphic argument, such as List.map, and to a function expecting a polymorphic argument, such as auto (defined as λ(x: σ_{id}) x x). No type application or coercion is needed to choose between a monomorphic instance of the identity and the “polymorphic” identity. This is not true in other type systems trying to merge ML and first-class polymorphism, including Poly-ML.

In summary, MLF is an integration of ML and System F that combines the convenience of type inference as present in ML and the expressiveness of second-order polymorphism. Type information is only required for arguments of functions that are used polymorphically in their bodies. We think that this specification should be intuitive to the user. Besides, it is modular, since annotations depend more on the behavior of the code than on the context in which the code is placed; in particular, functions that only carry polymorphism without using it can be left unannotated.

The obvious potential application of our work is to extend ML-like languages with second-order polymorphism while keeping full type inference for a large subset of the language, containing at least all ML programs.

Exploring the difference between MLF and System F, we have considered a restriction of MLF called Shallow MLF. It is shown that Shallow MLF can be equivalently viewed as MLF where type annotations are restricted to types of System F. All programs of ML and of System F are typable in Shallow MLF as well. This means that the programmer does not need to understand MLF types to write Shallow MLF programs. However, shallow types are still introduced by the type inference algorithm, e.g. the typing of choose id introduces the type ∀ (α ≥ σ_{id}) α → α. Hence, the knowledge of shallow types seems necessary to understand inferred types, in particular those appearing in error messages. Still, we have shown that Shallow MLF (without the let construct) types the same set of terms than System F. More precisely, a typing of an expression in Shallow MLF corresponds to one or more typings in System F. Thus, we expect that it is possible to design a typechecker based on MLF that totally hides MLF types: the programmer only sees System F types. However, although such a typechecker is able to infer principal types for expressions, it cannot always display them. This can also be problematic when writing interface files. Hence, whereas MLF types are a priori not needed in source programs, they may still appear in interface files as well as in messages of the typechecker.

Future work

MLF and F^{ω} Since System F can be encoded into MLF, we may consider an extension of MLF with higher-order types, that is, with types of F^{ω}. By keeping type abstractions and type applications fully explicit for higher-order kinds, it should be possible to perform type inference. As a consequence, we expect to be able to infer type abstractions and type applications for the kind type in F^{ω}. This remains to be formalized.

An efficient implementation of unification The unification algorithm we give is defined on “syntactic” types. Viewing the types as graphs, as described page 43, it should be possible to design a more efficient unification algorithm. More precisely, graphs and unification problems can be encoded as multi-equations, so that solving a unification problems amounts to finding the solved form of a set of multi-equations. Then the unification algorithm can be described as rewriting rules that keep the same set of solutions. From an implementation point of view, a unification algorithm on graphs would proceed in two steps: a first step performs first-order unification, ignoring binders; a second-step moves and merges binders. The second step fails if a rigid binder is illegally moved. For instance, rewriting the type ∀ (α = σ_{id}) α → τ into ∀ (β) ∀ (α = β → β) α → τ amounts to moving the binder of β, which is not allowed under rigid bindings. Indeed, the former type requires a polymorphic argument, with type σ_{id}, whereas the latter can be applied to any monomorphic type. Therefore, such an instantiation is not correct because it would allow us to apply auto, which expects a polymorphic argument, to a monomorphic value such as succ (the successor function). On graphs, it means that the following is not allowed:

→ →  τ ⊥  ⊑  ^{→ →  τ ⊥}

Additionally, some well-formedness conditions imply that each node must appear only under the node where it is bound. In “syntactic types”, it corresponds to the fact that a type variable cannot be used outside its lexical scope. Thus, special care must be taken while merging binders: in order to keep well-formedness, it may be necessary to move binders not directly involved in the operation. Detecting which binders to move may be a costly operation; this needs further investigation. To illustrate this, we provide an example. The left-hand graph represents the type ∀ (α ≥ ∀ (β) ∀ (γ ≥ ∀ (δ) β → δ) β → γ) ∀ (γ′) α → γ′. The right-hand graph is similar, but nodes are labelled with their corresponding variable name. The root node does not correspond to a type variable, thus we call it ϵ.

⊥ → →→ ⊥ ⊥  ^{β α ϵ γ δ γ′}

We wish to unify γ and γ′. The first step of the unification algorithm on graphs just performs first-order unification on structures and leads to the following:

β α ϵ γ δ

This graph does not correspond to a syntactic type because γ is bound at two places. Fortunately, the binding of γ and the binding of α are flexible, thus it is allowed to move the binder of γ to the top-level node, which gives the following:

β α ϵ γ δ

Unfortunately, this graph is not well-formed either: it is not possible to write it as a type. The reason is that β appears in the bound of γ but is bound at α. However, γ is bound at ϵ, thus β is not in the scope of γ. As a consequence, the binder of β needs to be moved to ϵ as follows:

β α ϵ γ δ

This graph represents the type ∀ (β) ∀ (γ ≥ ∀ (δ) β → δ) (β → γ) → γ, which is the solution to the unification problem described above.

This example illustrates that solving the unification of two nodes such as γ and γ′ may have consequences on binders not directly related to γ or γ′: in this example, it is necessary to move the binder of β to build a well-formed graph. Whereas algorithms for first-order unification are well-known and algorithms for merging binders seem straightforward, it remains to find an efficient algorithm to detect ill-formed graphs and to find which binders to move. This is probably the most costly operation since moving a single binder may transform arbitrarily many binders into illegal binders.

A semantics for MLFtypes The interpretation of shallow types as sets of System F types sketched a semantics for MLF types. However, as mentioned then, the given interpretation is not sound for the abstraction relation. Thus, it remains to find a suitable semantics that captures the meaning of MLF types, including the meaning of abstraction and revelation. Indeed, the relations ⊏ − and ⊐ − are fundamental for type inference, and a semantics for types must be able to distinguish for example ∀ (α=σ_{id}) α → α and ∀ (α=σ_{id}, β =σ_{id}) α → β. A starting point for such a semantics might be graph representations.

222

Bibliography

[Boe85] H.-J. Boehm. Partial polymorphic type inference is undecidable. In 26th Annual Symposium on Foundations of Computer Science, pages 339–345. IEEE Computer Society Press, October 1985.

[BOSW98] Gilad Bracha, Martin Odersky, David Stoutamire, and Philip Wadler. Making the future safe for the past: Adding genericity to the java programming language. In Proc. OPPSLA’98, October 1998.

[Bou59] Nicolas Bourbaki. Livre XI, Eléments de Mathématique, Algèbre, Chap 4: Polynomes et Fractions Rationnelles. Hermann, 1959.

[Car88] Luca Cardelli. A semantics of multiple inheritance. Information and Computation, 76(2–4):138–164, 1988.

[Car93] Luca Cardelli. An implementation of FSub. Research Report 97, Digital Equipment Corporation Systems Research Center, 1993.

[CC90] Felice Cardone and Mario Coppo. Two extensions of Curry’s type inference system. In Logic and Computer Science, pages 19–76. Academic Press, 1990.

[CDC78] Mario Coppo and Mariangiola Dezani-Ciancaglini. A new type-assignment for λ-terms. Archiv Math. Logik, 19:139–156, 1978.

[CDCS79] Mario Coppo, Mariangiola Dezani-Ciancaglini, and Patrick Sallé. Functional characterization of some semantic equalities inside λ-calculus. In Hermann A. Maurer, editor, Proceedings of the 6th Colloquium on Automata, Languages and Programming, volume 71 of LNCS, pages 133–146, Graz, Austria, July 1979. Springer.

[Cos95] Roberto Di Cosmo. Isomorphisms of Types: from lambda-calculus to information retrieval and language design. Birkhauser, 1995.

[DHKP96] Gilles Dowek, Thérèse Hardin, Claude Kirchner, and Frank Pfenning. Higher-order unification via explicit substitutions: the case of higher-order patterns. In M. Maher, editor, Joint international conference and symposium on logic programming, pages 259–273, 1996.

[DM82] Luis Damas and Robin Milner. Principal type-schemes for functional programs. In Proceedings of the Ninth ACM Conference on Principles of Programming Langages, pages 207–212, 1982.

[Gar02] Jacques Garrigue. Relaxing the value-restriction. Presented at the third Asian workshop on Programmaming Languages and Systems (APLAS), 2002.

[Gir72] Jean-Yves Girard. Interprétation fonctionnelle et élimination des coupures de l’arithmétique d’ordre supérieur. Thèse d’état, University of Paris VII, 1972.

[GR88] P. Giannini and S. Ronchi Della Rocca. Characterization of typings in polymorphic type discipline. In Third annual Symposium on Logic in Computer Science, pages 61–70. IEEE, 1988.

[GR99] Jacques Garrigue and Didier Rémy. Extending ML with Semi-Explicit higher-order polymorphism. Journal of Functional Programming, vol 155, pages pages 134–169, 1999. A preliminary version appeared in TACS’97.

[Hen93] Fritz Henglein. Type inference with polymorphic recursion. ACM Transactions on Programming Languages and Systems, 15(2):253–289, 1993.

[HP99] Haruo Hosoya and Benjamin C. Pierce. How good is local type inference? Technical Report MS-CIS-99-17, University of Pennsylvania, June 1999.

[Jim95] Trevor Jim. Rank-2 type systems and recursive definitions. Technical Report MIT/LCS/TM-531, Massachusetts Institute of Technology, Laboratory for Computer Science, November 1995.

[Jim96] Trevor Jim. What are principal typings and what are they good for? In ACM, editor, ACM Symposium on Principles of Programming Languages (POPL), St. Petersburg Beach, Florida, pages 42–53, 1996.

[Jim00] Trevor Jim. A polar type system. In Electronic Notes in Theoretical Computer Science, 2000.

[JS04] S. Peyton Jones and M. Shields. Practical type inference for arbitrary-rank types, 2004.

[JWOG89] Jr. James William O’Toole and David K. Gifford. Type reconstruction with first-class polymorphic values. In SIGPLAN ’89 Conference on Programming Language Design and Implementation, Portland, Oregon, June 1989. ACM. also in ACM SIGPLAN Notices 24(7), July 1989.

[KW94] Assaf J. Kfoury and Joe B. Wells. A direct algorithm for type inference in the rank-2 fragment of the second-order lambda -calculus. In ACM Conference on LISP and Functional Programming, 1994.

[KW99] Assaf J. Kfoury and Joe B. Wells. Principality and decidable type inference for finite-rank intersection types. In ACM Symposium on Principles of Programming Languages (POPL), pages 161–174. ACM, January 1999.

[LDG^{+}02] Xavier Leroy, Damien Doligez, Jacques Garrigue, Didier Rémy, and Jérôme Vouillon. The Objective Caml system, documentation and user’s manual - release 3.05. Technical report, INRIA, July 2002. Documentation distributed with the Objective Caml system.

[LO94a] Konstantin Läufer and Martin Odersky. Polymorphic type inference and abstract data types. ACM Transactions on Programming Languages and Systems (TOPLAS), 16(5):1411–1430, September 1994. An earlier version appeared in the Proceedings of the ACM SIGPLAN Workshop on ML and its Applications, 1992, under the title “An Extension of ML with First-Class Abstract Types”.

[LO94b] Konstantin Läufer and Martin Odersky. Polymorphic type inference and abstract data types. ACM Transactions on Programming Languages and Systems, 16(5):1411–1430, September 1994.

[Mil78] R. Milner. A theory of type polymorphism in programming. Journal of Computer and System Sciences, 17:348–375, December 1978.

[Mil92] Dale Miller. Unification under a mixed prefix. Journal of Symbolic Computation, 14:321–358, 1992.

[Mit83] John C. Mitchel. Coercion and type inference. In ACM Symp. on Priciples of Programming Languages, pages 175–185. ACM, 1983.

[Mit88] John C. Mitchell. Polymorphic type inference and containment. Information and Computation, 2/3(76):211–249, 1988.

[Oka98] Chris Okasaki. Purely Functional Data Structures. Cambridge University Press, Cambridge, England, 1998.

[OL96] Martin Odersky and Konstantin Läufer. Putting type annotations to work. In Proceedings of the 23rd ACM Conference on Principles of Programming Languages, pages 54–67, January 1996.

[OSW99] Martin Odersky, Martin Sulzmann, and Martin Wehr. Type inference with constrained types. Theory and Practice of Object Systems, 5(1):35–55, 1999.

[OZZ01] Martin Odersky, Christoph Zenger, and Matthias Zenger. Colored local type inference. ACM SIGPLAN Notices, 36(3):41–53, March 2001.

[Pfe88] Frank Pfenning. Partial polymorphic type inference and higher-order unification. In Proceedings of the ACM Conference on Lisp and Functional Programming, pages 153–163. ACM Press, July 1988.

[Pfe93] Frank Pfenning. On the undecidability of partial polymorphic type reconstruction. Fundamenta Informaticae, 19(1,2):185–199, 1993. Preliminary version available as Technical Report CMU-CS-92-105, School of Computer Science, Carnegie Mellon University, January 1992.

[Pie91] Benjamin C. Pierce. Programming with Intersection Types and Bounded Polymorphism. PhD thesis, Carnegie Mellon University, December 1991. Available as School of Computer Science technical report CMU-CS-91-205.

[Pot80] Garrell Pottinger. A type assignment for the strongly normalizable λ-terms. In To H. B. Curry: Essays on Combinatory Logic, Lambda Calculus, and Formalism, pages 561–577. Academic Press, New York, 1980.

[Pot98a] François Pottier. A framework for type inference with subtyping. In Proceedings of the third ACM SIGPLAN International Conference on Functional Programming (ICFP’98), pages 228–238, September 1998.

[Pot98b] François Pottier. Synthèse de types en présence de sous-typage: de la théorie à la pratique. PhD thesis, Université Paris 7, July 1998.

[PT98] Benjamin C. Pierce and David N. Turner. Local type inference. In Proceedings of the 25th ACM Conference on Principles of Programming Languages, 1998. Full version in ACM Transactions on Programming Languages and Systems (TOPLAS), 22(1), January 2000, pp. 1–44.

[Rém92] Didier Rémy. Extending ML type system with a sorted equational theory. Research Report 1766, Institut National de Recherche en Informatique et Automatisme, Rocquencourt, BP 105, 78 153 Le Chesnay Cedex, France, 1992.

[Rém94] Didier Rémy. Programming objects with ML-ART: An extension to ML with abstract and record types. In Masami Hagiya and John C. Mitchell, editors, Theoretical Aspects of Computer Software, volume 789 of Lecture Notes in Computer Science, pages 321–346. Springer-Verlag, April 1994.

[Rey74] John C. Reynolds. Towards a theory of type structure. In Proc. Colloque sur la Programmation, pages 408–425, New York, 1974. Springer-Verlag LNCS 19.

[Sal82] P. Sallé. Une extension de la theorie des types en λ-calcul. In Lecture Notes in Computer Science No. 62, pages 398–410. Springer-Verlag, 1982.

[Sch98] Aleksy Schubert. Second-order unification and type inference for Churchstyle polymorphism. In Conference Record of POPL 98: The 25TH ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages, San Diego, California, pages 279–288, New York, NY, 1998.

[Sim03] Vincent Simonet. The Flow Caml System: documentation and user’s manual. Technical Report 0282, Institut National de Recherche en Informatique et en Automatique (INRIA), July 2003. \begin{matrix}c \\ ◯ \end{matrix}INRIA.

[Wel94] J. B. Wells. Typability and type checking in the second order λ-calculus are equivalent and undecidable. In Ninth annual IEEE Symposium on Logic in Computer Science, pages 176–185, July 1994.

[Wel96] Joe B. Wells. Type Inference for System F with and without the Eta Rule. PhD thesis, Boston University, 1996.

[Wel02] J. B. Wells. The essence of principal typings. In Proc. 29th Int’l Coll. Automata, Languages, and Programming, volume 2380 of LNCS, pages 913– 925. Springer-Verlag, 2002.

[Wri95] Andrew K. Wright. Simple imperative polymorphism. Lisp and Symbolic Computation, 8(4):343–355, 1995.

228

Part IV Appendix

Appendix A

Proofs (Technical details)

Felix qui potuit rerum cognescere causas — Virgile Géorgiques II, 489

Proof of Property 1.5.6

\underline{Property i}: It is by induction on the number of universal quantifiers appearing in σ. If σ has no universal quantifiers, then σ is ⊥ or τ, and we get the result by Rule Eq-Refl since nf(σ) is σ itself. Otherwise, σ is ∀ (α ⋄ σ_{1}) σ_{2}, where σ_{1} and σ_{2} have strictly less universal quantifiers than σ. We proceed by case analysis: ∘ Case nf(σ_{2}) is α: Then nf(σ) is nf(σ_{1}) (\underline{1}), and σ_{2} ≡ α by induction hypothesis. By Property 1.5.3.v (page 49), (α⋄σ_{1}) σ_{2} ≡ α also holds. Hence, σ ≡ σ_{1} (\underline{2}) holds by rules R-Context-R and Eq-Var. By induction hypothesis on σ_{1}, we have σ_{1} ≡ nf(σ_{1}) (\underline{3}), therefore σ ≡ nf(σ_{1}) holds by R-Trans, (2), and (3). By (1), we get σ ≡ nf(σ). ∘ Case α ∉ ftv(σ_{2}): then, nf(σ) is nf(σ_{2}) (\underline{4}). We have σ ≡ σ_{2} by Eq-Free, thus σ ≡ nf(σ_{2}) holds by induction hypothesis and R-Trans. By (4), this means σ ≡ nf(σ). ∘ Case nf(σ_{1}) is τ_{1}: We have σ_{2} ≡ nf(σ_{2}) by induction hypothesis on σ_{2}, thus σ ≡ ∀ (α⋄σ_{1}) nf(σ_{2}) (\underline{5}) holds by R-Context-R and Property 1.5.3.v (page 49). Moreover, we have σ_{1} ≡ τ_{1} by induction hypothesis on σ_{1}, hence we have σ ≡ nf(σ_{2})[τ_{1}/α] by Rule Eq-Mono^{⋆} on (5) and R-Trans. We conclude by observing that nf(σ) is nf(σ_{2})[τ_{1}/α]. ∘ Otherwise, nf(σ) is ∀ (α ⋄ nf(σ_{1})) nf(σ_{2}). By induction hypothesis, σ_{1} ≡ nf(σ_{1}) and σ_{2} ≡ nf(σ_{2}). Hence, (α ⋄ σ_{1}) σ_{2} ≡ nf(σ_{2}) holds by Property 1.5.3.v (page 49). We conclude by rules R-Context-R, R-Context-R and R-Trans. \underline{Property ii}: It is a consequence of Properties i and 1.5.4.iii (page 50). \underline{Property iii}: It is shown by induction on the number of universal quantifiers appearing in σ. If σ has no universal quantifiers, then σ is ⊥ or τ, and we get the expected result since nf(σ) is σ itself and nf(θ(σ)) is θ(σ). Otherwise, σ is ∀ (α ⋄ σ_{1}) σ_{2}, where σ_{1} and σ_{2} have strictly less universal quantifiers than σ. By alpha-conversion, we can assume α ∉ dom(θ) ∪ codom(θ), thus θ(σ) = ∀ (α ⋄ θ(σ_{1})) θ(σ_{2}). We proceed by case analysis:

∘ Case nf(σ_{2}) is α: By induction hypothesis, nf(θ(σ_{2})) is θ(nf(σ_{2})), that is α. Hence, nf(θ(σ)), that is, nf(∀ (α ⋄ θ(σ_{1})) θ(σ_{2})), is by definition nf(θ(σ_{1})). By induction hypothesis, nf(θ(σ_{1})) is θ(nf(σ_{1})), thus nf(θ(σ)) is θ(nf(σ_{1})), that is, θ(nf(σ)). ∘ Case nf(σ_{1}) is τ_{1}: Let θ′ be [τ_{1}/α] and θ′′ be [θ(τ_{1})/α]; since α ∉ dom(θ)∪codom(θ), we have θ ∘ θ′ = θ′′ ∘ θ (\underline{6}). By induction hypothesis nf(θ(σ_{1})) is θ(τ_{1}), thus nf(θ(σ)) is by definition θ′′(nf(θ(σ_{2}))). By induction hypothesis, it is also θ′′(θ(nf(σ_{2}))), that is θ ∘ θ′(nf(σ_{2})) by (6). We conclude by observing that θ′(nf(σ_{2})) is nf(σ). ∘ Case α ∉ ftv(σ_{2}): Since α ∉ codom(θ), we have α ∉ ftv(θ(σ_{2})). Hence, nf(θ(σ)) is by definition nf(θ(σ_{2})) and we conclude directly by induction hypothesis. ∘ Otherwise, we know that nf(σ_{2}) is not α, thus, by induction hypothesis, nf(θ(σ_{2})) is not α. Moreover, nf(σ_{1}) is not a monotype τ_{1}, thus, by induction hypothesis, nf(θ(σ_{1})) is not a monotype. Additionally, α ∈ ftv(σ_{2}), thus α ∈ ftv(θ(σ_{2})). Consequently, nf(θ(σ)) is by definition ∀ (α⋄nf(θ(σ_{1}))) nf(θ(σ_{2})). By induction hypothesis, it is equal to ∀ (α ⋄ θ(nf(σ_{1}))) θ(nf(σ_{2})), that is, θ(nf(σ)). \underline{Property iv}: It is shown by induction on the number of universal quantifiers appearing in σ. If σ has no universal quantifiers, then σ is ⊥ or τ, and we get the expected result since nf(σ) is σ itself. Otherwise, σ is ∀ (α ⋄ σ_{1}) σ_{2}, where σ_{1} and σ_{2} have strictly less universal quantifiers than σ. We proceed by case analysis: ∘ Case nf(σ_{2}) is α: then, nf(σ) is nf(σ_{1}), which is in normal form by induction hypothesis. ∘ Case nf(σ_{1}) is τ_{1}: let θ be [τ_{1}/α]; by definition, nf(σ) is θ(nf(σ_{2})), that is, nf(θ(σ_{2})) by Property iii. Since nf(θ(σ_{2})) is in normal form by induction hypothesis, we conclude that nf(σ) is normal form. ∘ Case α ∉ ftv(σ_{2}): then, nf(σ) is nf(σ_{2}), which is in normal form by induction hypothesis. ∘ Otherwise, nf(σ) is ∀ (α ⋄ nf(σ_{1})) nf(σ_{2}). We know that nf(σ_{2}) is not α, that nf(σ_{1}) is not a monotype τ_{1}, and that α ∈ ftv(σ_{2}). By Property i, we have nf(σ_{2}) ≡ σ_{2}. Hence, by Property 1.5.4.iii (page 50), we have α ∈ ftv(nf(σ_{2})). Additionally, by induction hypothesis, nf(nf(σ_{1})) is nf(σ_{1}) and nf(nf(σ_{2})) is nf(σ_{2}). Hence, nf(nf(σ)) is nf(∀ (α⋄nf(σ_{1})) nf(σ_{2})), that is by definition ∀ (α⋄nf(σ_{1})) nf(σ_{2}), that is nf(σ). Hence, nf(σ) is in normal form.

Proof of Corollary 1.5.10

\underline{Directly,} if (∅) Q̂(σ_{1}) ≡ Q̂(σ_{2}) holds, then, by Property 1.5.3.v (page 49), we have (Q) Q̂(σ_{1}) ≡ Q̂(σ_{2}). Since we have (Q) σ_{1} ≡ Q̂(σ_{1}) and (Q) σ_{2} ≡ Q̂(σ_{2}) by Eq-Mono, we conclude directly using R-Trans twice. \underline{Conversely,} if we have (Q) σ_{1} ≡ σ_{2}, then by Lemma 1.5.9 we know that nf(Q̂(σ_{1})) ≈ nf(Q̂(σ_{2})) holds. Hence, nf(Q̂(σ_{1})) ≡ nf(Q̂(σ_{2})) holds by Property 1.5.3.iii (page 49). We conclude by observing that Q̂(σ_{1}) ≡ nf(Q̂(σ_{1})) and nf(Q̂(σ_{2})) ≡ Q̂(σ_{2}) hold by Property 1.5.6.i (page 51).

Proof of Property 2.1.2

\underline{Property i}: Reflexivity: immediate Transitivity: Assume we have t_{1} ⩽_{/} t_{2} (\underline{1}) and t_{2} ⩽_{/} t_{3} (\underline{2}). We have dom(t_{1}) ⊆ dom(t_{2}) ⊆ dom(t_{3}), thus dom(t_{1}) ⊆ dom(t_{3}). Besides, for all u ∈ dom(t_{1}), if t_{1}/u ≠ t_{3}/u, then either t_{1}/u = t_{2}/u, or t_{1}/u ≠ t_{2}/u. In the second case, we have t_{1}/u = ⊥ by definition of (1), which is the expected result. In the first case, we must have t_{2}/u ≠ t_{3}/u, thus t_{2}/u = ⊥ by definition of (2), and t_{1}/u = t_{2}/u = ⊥ holds. Antisymmetry: Assume t_{1} ⩽_{/} t_{2} (\underline{3}) and t_{2} ⩽_{/} t_{1} (\underline{4}). We have dom(t_{1}) ⊆ dom(t_{2}) and dom(t_{2}) ⊆ dom(t_{1}), thus dom(t_{1}) = dom(t_{2}) holds. Besides, for any u in dom(t_{1}), if we have t_{1}/u ≠ t_{2}/u, then t_{1}/u = ⊥ by definition of (3). However, we then also have t_{2}/u ≠ t_{1}/u, which implies t_{2}/u = ⊥ by definition of (4). Consequently, t_{1}/u = ⊥ = t_{2}/u, which is a contradiction. As a consequence, t_{1}/ = t_{2}/, that is, t_{1} = t_{2}.

\underline{Property ii}: Assume we have t_{1} ⩽_{/} t_{2} (\underline{1}) By definition, we have dom(t_{1}) ⊆ dom(t_{2}) (\underline{2}). Let θ be a substitution. Note that dom(t) ⊆ dom(θ(t)) (\underline{3}) holds for any t. Let u be in dom(θ(t_{1})). Either u is in dom(t_{1}), or u is of the form u_{1}u_{2}, with t_{1}/u_{1} = α (\underline{4}) and θ(α)/u_{2} = t_{1}/u. In the first case, we know that u is in dom(t_{2}) from (2). Hence, u is in dom(θ(t_{2})) by (3). In the second case, we know that u_{1} is in dom(t_{2}) from (2), and that t_{2}/u_{1} is α by definition of (1) and by (4). Hence, u_{1}u_{2} is in dom(θ(t_{2})). Consequently, we have shown that dom(θ(t_{1})) ⊆ dom(θ(t_{2})) holds (\underline{5}). Let u be such that θ(t_{1})/u ≠ θ(t_{2})/u (\underline{6}). Either u is in dom(t_{1}), or u is of the form u_{1}u_{2}, with t_{1}/u_{1} = α and θ(α)/u_{2} = t_{1}/u. In the first case, u is in dom(t_{2}) by (2), and t_{1}/u ≠ t_{2}/u, which implies t_{1}/u = ⊥ by definition of (1). Hence, θ(t_{1})/u = ⊥, since ⊥ is not substituted by θ. In the second case, t_{1}/u_{1} = α, thus t_{2}/u_{2} = α by definition of (1). Hence, we have θ(t_{1})/u_{1}u_{2} = θ(α)/u_{2} = θ(t_{2})/u_{1}u_{2}, that is θ(t_{1})/u = θ(t_{2})/u. This is a contradiction with (6). Hence, this second case cannot occur. In summary, we have shown that whenever θ(t_{1})/u ≠ θ(t_{2})/u, then θ(t_{1})/u = ⊥. With (5), this implies that we have θ(t_{1}) ⩽_{/} θ(t_{2}).

\underline{Property iii}: We assume we have t_{1} ⩽_{/} t_{2} (\underline{1}) and a skeleton t. By definition, dom(t_{1}) ⊆ dom(t_{2}) (\underline{2}) holds. Let t′_{1} be t[t_{1}/α] and t′_{2} be t[t_{2}/α]. Note that we have dom(τ) ⊆ dom(t_{1}) and dom(t) ⊆ dom(t_{2}) (\underline{3}). We have to show that t′_{1} ⩽_{/} t′_{2} holds. Let u be in dom(t′_{1}). Either u is in dom(t), or u is of the form u_{1}u_{2} with t/u_{1} = α (\underline{4}) and t_{1}/u_{2} = t′_{1}/u. In the first case, u is in dom(t′_{2}) by (3). In the second case, we have u_{2} ∈ dom(t_{1}), hence u_{2} ∈ dom(t_{2}) (\underline{5}) by (2). Then u_{1}u_{2} is in dom(t[t_{2}/α]) by (4) and (5). We have shown that dom(t′_{1}) ⊆ dom(t′_{2}) (\underline{6}). Let u be such that t′_{1}/u ≠ t′_{2}/u (\underline{7}). Either u is in dom(t), or u is of the form u_{1}u_{2} with t/u_{1} = α and t_{1}/u_{2} = t′_{1}/u. In the first case, we necessarily have t/u = α (otherwise, t′_{1}/u = t/u = t′_{2}/u). Hence, t′_{1}/u = t_{1}/ϵ and t′_{2}/u = t_{2}/ϵ, thus we have t_{1}/ϵ ≠ t_{2}/ϵ from (7), which implies t_{1}/ϵ = ⊥ by definition of (1). This leads to t′_{1}/u = ⊥. In the second case, we have t′_{1}/u = t_{1}/u_{2} and t′_{2}/u = t_{2}/u_{2}. Hence, t_{1}/u_{2} ≠ t_{2}/u_{2} holds from (7), which implies t_{1}/u_{2} = ⊥ by definition of (1). This leads to t′_{1}/u = ⊥. In both cases, t′_{1}/u = ⊥. With (6), this implies that we have t′_{1} ⩽_{/} t′_{2}.

Proof of Lemma 2.1.4

By induction on the derivation of (Q, α ⋄ σ, Q_{1}) σ_{1} ♢ σ_{2}. By hypothesis, we have (∀ (Q_{1}) σ_{1})/u = α (\underline{1}). ∘ Case A-Equiv: we have (Q, α ⋄ σ, Q_{1}) σ_{1} ≡ σ_{2}, thus (Q, α ⋄ σ) ∀ (Q_{1}) σ_{1} ≡ ∀ (Q_{1}) σ_{2} (\underline{2}) holds by Rule R-Context-R. Let θ be { \atop (Q, α ⋄ σ)}. Since σ ∉ T , we have α ∉ dom(θ). By well-formedness of (Q, α ⋄ σ), we have Q closed and α ∉ dom(Q), thus α ∉ codom(θ) (\underline{3}). By Corollary 1.5.10 applied to (2), we have θ(∀ (Q_{1}) σ_{1}) ≡ θ(∀ (Q_{1}) σ_{2}). By Property 1.5.11.vi (page 54), we have θ(∀ (Q_{1}) σ_{1})/ = θ(∀ (Q_{1}) σ_{2})/ (\underline{4}). By (1), we have θ(∀ (Q_{1}) σ_{1})/u = θ(α)/ϵ = α and θ(∀ (Q_{1}) σ_{2})/u = α by (4), which implies (∀ (Q_{1}) σ_{2})/u = α, by (3). ∘ Case R-Trans: By induction hypothesis. ∘ Case R-Trans: By induction hypothesis. ∘ Case I-Hyp: we have (Q, α ⋄ σ, Q_{1}) σ_{1} ⊑ β with (β ⋄′ σ_{1}) ∈ (Q, α ⋄ σ, Q_{1}). If (β ⋄′ σ_{1}) ∈ (Q, α ⋄ σ), necessarily ftv(σ_{1}) # {α} ∪ dom(Q_{1}) by well-formedness of (Q, α ⋄ σ, Q_{1}), thus ∀ (Q_{1}) σ_{1} ≡ σ_{1} (by Eq-Free) and α ∉ ftv(∀ (Q_{1}) σ_{1}), which is a contradiction with (1). Hence, β ∈ dom(Q_{1}). Therefore, ∀ (Q_{1}) σ_{1} ≡ ∀ (Q_{1}) β by Eq-Var^{⋆}. Consequently, (∀ (Q_{1}) β)/u = (∀ (Q_{1}) σ_{1})/u = α by Property 1.5.4.i (page 50) and (1). ∘ Case A-Hyp: similar to I-Hyp. ∘ Case R-Context-R: By induction hypothesis. ∘ Case R-Context-R: By induction hypothesis. ∘ Case R-Context-Flexible: We have (Q, α ⋄ σ, Q_{1}) ∀ (β ⋄ σ_{1}) σ_{0} ♢ ∀ (β ⋄ σ_{2}) σ_{0} and the premise is (Q, α ⋄ σ, Q_{1}) σ_{1} ♢ σ_{2} (\underline{5}). Besides, (∀ (Q_{1}) ∀ (β ⋄ σ_{1}) σ_{0})/u = α by hypothesis (1). By Property 1.3.3.i (page 40), we have Θ_{Q_{1}}(proj(σ_{0})[proj(σ_{1})/α])/u = α. If u is of the form u_{1}u_{2} with σ_{0}/u_{1} = β, then Θ_{Q_{1}}(proj(σ_{1}))/u_{2} = α, thus ∀ (Q_{1}) σ_{1}/u_{2} = α by Property 1.3.3.i (page 40). Hence, by induction hypothesis on (5), we get (∀ (Q_{1}) σ_{2})/u_{2} = α, which implies (∀ (Q_{1}) ∀ (β ⋄ σ_{2}) σ_{0})/u_{1}u_{2} = α by Property 1.3.3.i (page 40). Otherwise, we have (∀ (Q_{1}) ∀ (β ⋄ σ_{1}) σ_{0})/u = (∀ (Q_{1}) σ_{0})/u = (∀ (Q_{1}) ∀ (β ⋄ σ_{2}) σ_{0})/u, which is the expected result. ∘ Case R-Context-Rigid is similar to R-Context-Flexible. ∘ Case I-Abstract: By induction hypothesis. ∘ Case I-Bot cannot occur since (∀ (Q_{1}) ⊥)/u = α is not possible. ∘ Case I-Rigid is immediate.

Proof of Property 2.1.5

\underline{Property i}: If there exists u ∈ dom(σ) such that σ/u = ⊥, then by Property 1.5.4.i (page 50), σ is not equivalent to a type (no type τ is such that τ/u = ⊥). Hence, by Property 1.5.11.ii (page 54), σ is not in T . Conversely, assume that σ is not equivalent to a type. We have to show that there exists u such that σ/u = ⊥. The proof is by induction on the structure of σ. If σ is ⊥, we get the result by taking u = ϵ. Otherwise, σ is of the form ∀ (α ⋄ σ_{1}) σ_{2}. If both σ_{1} and σ_{2} are equivalent to types τ_{1} and τ_{2}, then by Rule Eq-Mono, σ would be equivalent to a monotype τ_{2}[τ/α], which is not possible by hypothesis. Hence, σ_{1} or σ_{2} is not equivalent to a type. If σ_{2} is not equivalent to a type, then by induction hypothesis, there exists u such that σ_{2}/u = ⊥, thus σ/u = ⊥. If σ_{2} is equivalent to a type, then necessarily σ_{1} is not and α ∈ dom(σ_{2}) (otherwise σ would be equivalent to σ_{2} by Rule Eq-Free). Hence, there exists u_{2} such that σ_{2}/u_{2} = α. Furthermore, by induction hypothesis, there exists u_{1} such that σ_{1}/u_{1} = ⊥. Consequently, σ/u_{2}u_{1} = ⊥.

\underline{Property ii}: Directly, by Property 1.5.4.i (page 50). Conversely, we assume σ/ϵ is α. Since α is of arity 0, we must have dom(σ) = {ϵ}. Hence, there is no u ∈ dom(σ) such that σ/u = ⊥. By Property i, this implies σ ∈ T . Consequently, nf(σ) = τ such that τ/ = σ/ = α/, by Properties 1.5.6.i (page 51) and 1.5.4.i (page 50). This implies τ = α (τ and α are viewed as skeletons). Hence, nf(σ) = α, that is, σ ≡ α by Property 1.5.6.i (page 51).

\underline{Property iii}: It is shown by induction on the structure of σ. By hypothesis, we have σ/ϵ = ⊥ (\underline{1}). If σ is ⊥, the result is immediate. Otherwise, by Property i and (1), we know that σ is not a type τ. If σ is ∀ (α ⋄ σ_{1}) σ_{2}, either σ_{2}/ϵ = ⊥ and we conclude by induction hypothesis and Eq-Free, either σ_{2}/ϵ = α and σ_{1}/ϵ = ⊥ (\underline{2}). In the latter case, we get σ_{1} ≡ ⊥ (\underline{3}) by induction hypothesis on (2) and σ_{2} ≡ α (\underline{4}) by Property ii, thus we conclude that ∀ (α⋄σ_{1}) σ_{2} ≡ ⊥ by R-Trans, R-Context-L, R-Context-R, Eq-Var, (3), and (4). This is the expected result.

Proof of Property 2.2.2

\underline{Property i} : It is shown by induction on the size of Q.

\underline{Property ii}: We show by induction on the size of Q that Q[α] = β.

\underline{Property iii} : It is shown by structural induction on Q. By hypothesis, we have Q̂(α) ∉ V (\underline{1}). If Q is (Q′, β ⋄ σ), with β ≠ α, then we have α ∈ dom(Q′), Q̂′(α) = Q̂(α), and Q(α) = Q′(α), thus we get the result by induction hypothesis. If Q is (Q′, α ⋄ σ) and nf(σ) = β, then we have β ∈ dom(Q′) by well-formedness and (Q) α ≡ β (\underline{2}) by Property 1.5.6.i (page 51) and Eq-Mono. Additionally, we have Q[α] = Q′[β], thus Q(α) = Q′(β) (\underline{3}) holds. Moreover, we have Q̂(α) = Q̂′(β), hence Q̂′(β) ∉ V holds by (1). By induction hypothesis, (Q′) β ≡ Q′(β) holds. Hence, we have (Q) β ≡ Q′(β) (\underline{4}) by Property 1.5.3.v (page 49). Finally, (Q) α ≡ Q(α) holds by (2), (4), and (3). This is the expected result. In the last case, Q is (Q′, α ⋄ σ), and σ ∉ ϑ. Then Q[α] is α, thus Q(α) is σ. Moreover, if σ ∉ T , then Q̂(α) is α, which is a contradiction. Consequently, σ ∈ T , and Q̂(α) ≡ σ (\underline{5}) by Definition 1.5.8 and Property 1.5.6.i (page 51). Hence, by Eq-Mono and (5), we get (Q) α ≡ σ, that is, (Q) α ≡ Q(α).

\underline{Property iv}: It is shown by induction on the size of Q. Necessarily, Q is of the form (Q_{1}, α ⋄ σ, Q_{2}). By definition, Q[α] is Q_{1}[β] if nf(σ) is β and α otherwise (\underline{1}). In the first case, Q(α) is Q_{1}(β) by definition and Q̂(α) is Q̂_{1}(β), hence we get the expected result by induction hypothesis on Q_{1}. In the second case, Q(α) is σ (\underline{2}). \underline{Directly,} we have by hypothesis Q(α) ∉ T , thus (2) implies α ∉ dom(Q̂), that is, Q̂(α) = α, which is the expected result. \underline{Conversely,} we have by hypothesis Q(α) ∈ T , that is σ ∈ T . Then Q̂(α) is Q̂_{1}(nf(σ)) (\underline{3}). By hypothesis (1), nf(σ) is not in ϑ, hence, neither is Q̂_{1}(nf(σ)). By (3), this implies Q̂(α) ∉ ϑ. This is the expected result.

\underline{Property v}: By Property i, we have (Q) Q[α] ≡ Q[β] (\underline{1}). If Q[α] is Q[β], then Q(α) = Q(β) by definition, which gives the expected result by Eq-Refl. Otherwise, by Corollary 1.5.10 and (1), we have Q̂(Q[α]) = Q̂(Q[β]). If Q̂(Q[α]) is a type variable γ, then Q(Q[α]) = Q(γ) by Property ii, that is, Q(α) = Q(γ). Similarly, Q(β) = Q(γ), thus Q(α) = Q(β) and the result holds by Eq-Refl. Otherwise, Q̂(Q[α]) ∉ ϑ and by Property iii, we have (Q) Q[α] ≡ Q(Q[α]), that is, (Q) Q[α] ≡ Q(α) (\underline{2}). Similarly, (Q) Q[β] ≡ Q(β) (\underline{3}). By (1), (2), and (3), we get (Q) Q(α) ≡ Q(β). This is the expected result.

\underline{Property vi}: By hypothesis, (Q) α ♢ σ (\underline{1}) holds. By Lemma 2.1.6 on (1), we must have (Q) σ ≡ α. By Lemma 1.5.9 and Property 1.5.6.iii (page 51), we have Q̂(nf(σ)) ≈ Q̂(α), that is Q̂(nf(σ)) = Q̂(α) (\underline{2}) since Q̂(α) is a monotype (does not have any quantifier). By hypothesis, Q(α) ∉ T . Hence, by Property iv, we have Q̂(α) ∈ ϑ, that is, Q̂(α) ∈ dom(Q) since Q is closed by well-formedness of (1). Hence, Q̂(nf(σ)) ∈ dom(Q) holds from (2). Necessarily, nf(σ) is a type variable β such that Q̂(β) ∈ dom(Q). By Property iv, we get Q(β) ∉ T .

Proof of Lemma 2.3.1

We first prove the two following results, namely (\underline{1}) and (\underline{2}):

For any σ, there exists a restricted derivation of σ ≡ nf(σ).

If σ_{a} and σ_{b} are in normal forms, and if σ_{a} ≈ σ_{b} holds, then there exists a restricted derivation of σ_{a} ≡ σ_{b}.

\underline{Proof sketch of (1):} Property 1.5.6.i states that σ ≡ nf(σ) holds. We have to show that this derivation is, moreover, restricted. Actually, the proof of Property 1.5.6.i (page 51) is still appropriate. Indeed, the proof of Property 1.5.6.i (page 51) does not use R-Context-L, and builds only restricted derivations. □ \underline{Proof sketch of (2):} The proof of σ_{a} ≡ σ_{b} only uses rules R-Context-R, R-Context-L, and Eq-Comm. Every occurrence of Rule R-Context-L is necessarily restricted since σ_{a} and σ_{b} are in normal form: for instance, if σ_{a} is ∀ (α ⋄ σ_{1}) σ, we must have α ∈ ftv(σ), nf(σ) ≠ α, and nf(σ) ≠ ⊥. □

We first prove the result for a derivation of (Q) σ_{1} ≡ σ_{2}: By Lemma 1.5.9, we have Q̂(nf(σ_{1})) ≈ Q̂(nf(σ_{2})). Hence, Q̂(nf(σ_{1})) ≡ Q̂(nf(σ_{2})) (\underline{3}) holds and is restricted by Result (2). By Property 1.5.6.iii (page 51), (3) can also be written nf(Q̂(σ_{1})) ≡ nf(Q̂(σ_{2})) (\underline{4}). By Result (1), we have restricted derivations of Q̂(σ_{1}) ≡ nf(Q̂(σ_{1})) (\underline{5}) and nf(Q̂(σ_{2})) ≡ Q̂(σ_{2}) (\underline{6}). Besides, (Q) σ_{1} ≡ Q̂(σ_{1}) (\underline{7}) holds by Eq-Mono and is restricted. Similarly, (Q) Q̂(σ_{2}) ≡ σ_{2} (\underline{8}) is restricted. By Property 1.5.3.v (page 49), R-Trans, (7), (5), (4), (6), and (8), we have a restricted derivation of (Q) σ_{1} ≡ σ_{2}. This is the expected result.

In summary, the following rule is admissible:

Equiv-R

\frac{(Q) σ_{1} ≡ σ_{2}}{(Q) σ_{1} ♢ σ_{2} (restricted)}

Then we prove the result for an abstraction or instantiation derivation. The proof is by induction on the derivation. ∘ Case I-Bot: We proceed by case analysis.

Subcase nf(σ) is ⊥: Then (Q) ⊥ ≡ σ holds by Property 1.5.6.i (page 51). We conclude by Rule Equiv-R.

Subcase σ ∈ V: Then nf(σ) = α by definition. By Property 1.5.6.ii (page 51), we have α ∈ ftv(σ). By well-formedness, we must have α ∈ dom(Q). Let α′ be Q[α]. We have (α′ ⋄′ σ′) ∈ Q, σ′ ∉ V (\underline{9}), and (Q) α ≡ α′ (\underline{10}) by Property 2.2.2.i (page 69). By Rule Equiv-R and (10), we have a restricted derivation of (Q) α ♢ α′ (\underline{11}). Moreover, if nf(σ′) is not ⊥, we have a restricted derivation of (Q) ⊥ ⊑ σ′ (\underline{12}) by I-Nil and (9). If nf(σ′) is ⊥, (Q) ⊥ ≡ σ′ by Property 1.5.6.i (page 51), and (12) holds by Equiv-R. In both cases, we have a restricted derivation of (12). If σ′ is in T , then (Q) σ′ ⊑ α′ (\underline{13}) holds by Eq-Mono and I-Equiv^{⋆}. Otherwise, (13) holds by I-Hyp. In both cases, (13) is restricted. From (12), (13), (11) and R-Trans, we get a restricted derivation of (Q) ⊥ ⊑ α This is the expected result.

Otherwise, the judgment is already restricted. ∘ Case R-Context-Rigid and R-Context-Flexible: The premise is the judgment (Q) σ_{1} ♢ σ_{2} (\underline{14}) and the conclusion is (Q) ∀ (α ⋄ σ_{1}) σ ♢ ∀ (α ⋄ σ_{2}) σ. By induction hypothesis, we have a restricted derivation of (14). If α ∉ ftv(σ), then (Q) ∀ (α⋄σ_{1}) σ ≡ ∀ (α⋄σ_{2}) σ is derivable by Eq-Free and R-Trans, and we conclude by Equiv-R. If nf(σ) is α, then (Q) ∀ (α ⋄ σ_{1}) σ ≡ σ_{1} (\underline{15}) holds by Property 1.5.6.i (page 51), R-Context-R, and Eq-Var. Similarly, (Q) ∀ (α ⋄ σ_{2}) σ ≡ σ_{2} (\underline{16}) holds. By Equiv-R, (15), (16), and (14), we have a restricted derivation of (Q) ∀ (α ⋄ σ_{1}) σ ♢ ∀ (α ⋄ σ_{2}) σ. This is the expected result. If nf(σ) is ⊥, then (Q) ∀ (α ⋄ σ_{1}) σ ≡ ⊥ and (Q) ∀ (α ⋄ σ_{2}) σ ≡ ⊥ hold. By R-Trans and Equiv-R, we have a restricted derivation of (Q) ∀ (α ⋄ σ_{1}) σ ♢ ∀ (α ⋄ σ_{2}) σ. Otherwise, the judgment is restricted, and there exists a restricted derivation of the premise (14). This is the expected result. ∘ Case R-Context-R: If (Q, α⋄σ) σ_{1} ≡ σ_{2} holds, then (Q) ∀ (α⋄σ) σ_{1} ≡ ∀ (α⋄σ) σ_{2} holds by R-Context-R, and we get the expected result by A-Equiv or I-Equiv^{⋆}. ∘ Case I-Rigid: If α ∉ ftv(σ), then we can derive (Q) ∀ (α ≥ σ_{1}) σ ≡ σ by Eq-Free, as well as (Q) σ ≡ ∀ (α = σ_{1}) σ. We conclude by Equiv-R. If σ_{1} is in T , then nf(σ_{1}) is τ_{1} by definition and we have (Q) ∀ (α ≥ σ_{1}) σ ≡ σ[τ_{1}/α] by Eq-Mono, as well as (Q) σ[τ_{1}/α] ≡ ∀ (α = σ_{1}) σ. We conclude by Equiv-R. If nf(σ) is α, then (Q) ∀ (α ≥ σ_{1}) σ ≡ σ_{1} by Property 1.5.6.i (page 51) and Eq-Var, as well as (Q) σ_{1} ≡ ∀ (α = σ_{1}) σ. We conclude by Equiv-R. Otherwise, the judgment is already restricted. ∘ Case A-Hyp: We have (α_{1} = σ_{1}) ∈ Q. If σ_{1} ∈ T , then (Q) σ_{1} ≡ τ_{1} (\underline{17}) holds for some monotype τ_{1} by Properties 1.5.11.ii (page 54) and 1.5.3.v (page 49). Hence, (Q) α_{1} ≡ τ_{1} (\underline{18}) holds by Eq-Mono. Finally, (Q) α_{1} ≡ σ_{1} by (18), (17), and R-Trans. By Rule Equiv-R, we get the expected result (Q) σ_{1} ⊏ − α_{1}. ∘ Case I-Hyp: similar. ∘ All other cases are by induction hypothesis.

Proof of Lemma 2.3.3

We first show the three following properties, then we show the lemma.

1. For any type σ, there exists a thrifty derivation of σ ≡ nf(σ).

2. Any equivalence derivation can be rewritten into a thrifty derivation.

3. Any derivation can be rewritten into a thrifty derivation.

\underline{Property 1} : It is by induction on the number of universal quantifiers appearing in σ. If σ has no universal quantifiers, then σ is ⊥ or τ, and we get the result by Rule Eq-Refl since nf(σ) is σ itself. Otherwise, σ is ∀ (α ⋄ σ_{1}) σ_{2} (\underline{1}), where σ_{1} and σ_{2} have strictly less universal quantifiers than σ. We proceed by case analysis: ∘ Case nf(σ_{2}) is α: Then nf(σ) is nf(σ_{1}), and σ_{2} ≡ α holds and is thrifty by induction hypothesis. By Property 1.5.3.v (page 49), (α ⋄ σ_{1}) σ_{2} ≡ α also holds, and is thrifty. Hence, ∀ (α ⋄ σ_{1}) σ_{2} ≡ ∀ (α ⋄ σ_{1}) α (\underline{2}) holds by R-Context-R. This equivalence is thrifty since nf(σ_{2}) and nf(α) are both α. We have ∀ (α ⋄ σ_{1}) α ≡ σ_{1} by Eq-Var (\underline{3}). Since σ is ∀ (α⋄σ_{1}) σ_{2} (from (1)), we get σ ≡ σ_{1} by R-Trans, (2) and (3). By induction hypothesis we also have a thrifty derivation of σ_{1} ≡ nf(σ_{1}), therefore σ ≡ nf(σ_{1}) holds by R-Trans and is thrifty. In the following, we assume nf(σ_{2}) is not α. ∘ Case nf(σ_{1}) is τ_{1} (\underline{4}): We have a thrifty derivation of σ_{2} ≡ nf(σ_{2}) by induction hypothesis, thus we get a thrifty derivation of σ ≡ ∀ (α ⋄ σ_{1}) nf(σ_{2}) by R-Context-R. Moreover, we have σ_{1} ≡ τ_{1} by induction hypothesis on (4), hence we have σ ≡ nf(σ_{2})[τ_{1}/α] by Rule Eq-Mono^{⋆} and R-Trans. This derivation is thrifty. We conclude by observing that nf(σ) is nf(σ_{2})[τ_{1}/α]. ∘ Case α ∉ ftv(σ_{2}): Then nf(σ) is nf(σ_{2}), and σ ≡ σ_{2} by Eq-Free, thus we get a thrifty derivation of σ ≡ nf(σ_{2}) by induction hypothesis and R-Trans. ∘ Otherwise, nf(σ) is ∀ (α ⋄ nf(σ_{1})) nf(σ_{2}). By induction hypothesis, σ_{1} ≡ nf(σ_{1}) and σ_{2} ≡ nf(σ_{2}). Hence, (α ⋄ σ_{1}) σ_{2} ≡ nf(σ_{2}) holds by Property 1.5.3.v (page 49). By rules R-Context-L, R-Context-R and R-Trans, we get a thrifty derivation of σ ≡ nf(σ).

\underline{Property 2}: By hypothesis, we have (Q) σ_{1} ≡ σ_{2}. By Corollary 1.5.10, we have a derivation of Q̂(σ_{1}) ≡ Q̂(σ_{2}) (\underline{1}). Note that (Q) σ_{1} ≡ Q̂(σ_{1}) (\underline{2}) is thrifty since it only uses Eq-Mono. Similarly, (Q) Q̂(σ_{2}) ≡ σ_{2} (\underline{3}) is thrifty. By Property 1.5.11.i (page 54) applied to (1), we have nf(Q̂(σ_{1})) ≈ nf(Q̂(σ_{2})) (\underline{4}). The derivation of (4) provides a derivation of nf(Q̂(σ_{1})) ≡ nf(Q̂(σ_{2})) (\underline{5}) by Property 1.5.3.iii (page 49). Besides, the derivation of (5) is thrifty: indeed, each occurrence or Rule R-Context-R operates on normal forms. By Property 1, we have a thrifty derivation of Q̂(σ_{1}) ≡ nf(Q̂(σ_{1})) (\underline{6}) and nf(Q̂(σ_{2})) ≡ Q̂(σ_{2}) (\underline{7}). By R-Trans, (2), (6), (5), (7), and (3), we get a thrifty derivation of (Q) σ_{1} ≡ σ_{2}.

Before going on proving the remaining properties, we prove the following result, which we refer to as Thrifty-Var.

Assume (α ⋄ σ) ∈ Q. If (Q) σ_{1} ♢ σ_{2} is thrifty, and (Q) σ_{2} ≡ α holds but (Q) σ_{1} ≡ α does not hold, then there exists a thrifty derivation of (Q) σ_{1} ♢ σ. Besides, if ♢ is ⊏ −, then ⋄ is rigid.

Proof: By induction on the derivation. None of the equivalence cases occur since σ_{1} is not equivalent to α under Q, while σ_{2} is.

∘ Case R-Trans The premises are (Q) σ_{1} ♢ σ′_{1} (\underline{1}) and (Q) σ′_{1} ♢ σ_{2} (\underline{2}). Besides, both derivations are thrifty. If (Q) σ′_{1} ≡ α, we conclude directly by induction hypothesis on (1). Otherwise, we know by induction hypothesis on (2) that we have a thrifty derivation of (Q) σ′_{1} ♢ σ (\underline{3}). Hence, by R-Trans, (1), and (3), we have a thrifty derivation of (Q) σ_{1} ♢ σ. Additionally, if ♢ is ⊏ −, then ⋄ is rigid.

∘ Case R-Context-R We have σ_{1} = ∀ (β ⋄′ σ′) σ′_{1} (\underline{4}) and σ_{2} = ∀ (β ⋄′ σ′) σ′_{2}. The premise is (Q, β ⋄′ σ′) σ′_{1} ♢ σ′_{2} (\underline{5}) and is thrifty. By hypothesis, we have (Q) ∀ (β ⋄′ σ′) σ′_{2} ≡ α (\underline{6}).

Subcase nf(σ′_{2}) is β: By Eq-Var, R-Trans, and (6), we get (Q) σ′ ≡ α (\underline{7}). Moreover, nf(σ′_{1}) is not β (otherwise, we would have (Q) σ_{1} ≡ α by Property 1.5.6.i (page 51), (7), (4), and Eq-Var). Hence, this occurrence of R-Context-R is squandering, which is not possible by hypothesis.

Subcase β ∉ ftv(σ′_{2}): We have nf(σ) ≠ β (\underline{8}) by Property 1.5.6.ii (page 51). Since by hypothesis this occurrence of R-Context-R or R-Context-R is thrifty, we must have nf(σ′_{1}) ≠ β (\underline{9}). By Eq-Free, we have (Q) σ′_{2} ≡ α. By induction hypothesis on (5), we have a thrifty derivation of (Q, β ⋄′ σ′) σ′_{1} ♢ σ (\underline{10}). Besides, if ♢ is ⊏ −, then ⋄ is rigid. By (10), R-Context-R, we get (Q) ∀ (β ⋄′ σ′) σ′_{1} ♢ ∀ (β ⋄′ σ′) σ (\underline{11}). This derivation is thrifty since nf(σ′_{1}) ≠ β (from (9)) and nf(σ) ≠ β (from (8)). By Eq-Free, we have (Q) ∀ (α ⋄′ σ′) σ ≡ σ. Hence, (Q) ∀ (α ⋄′ σ′) σ ♢ σ (\underline{12}) holds by A-Equiv and I-Abstract, and is thrifty. By R-Trans, (11), and (12), we have a thrifty derivation of (Q) ∀ (β ⋄′ σ′) σ′_{1} ♢ σ. This is the expected result.

Otherwise β ∈ ftv(σ′_{2}) (\underline{13}) and nf(σ′_{2}) is not β (\underline{14}). We show that σ ∈ T . Let θ be Q̂. note that β ∉ dom(θ) ∪ codom(θ) by well-formedness of (5). By Corollary 1.5.10 applied to (6), we have θ(∀ (β ⋄′ σ′) σ′_{2}) ≡ θ(α) (\underline{15}). By (13), there exists an occurrence u such that σ′_{2}/u = β (\underline{16}). We cannot have σ′_{2} ≡ β, because of (14) and Property 1.5.11.i (page 54). By Property 2.1.5.ii (page 67), this implies σ′_{2}/ϵ ≠ β. Hence, u is not ϵ in (16). As a consequence, σ′_{2}/ϵ must be a type constructor g. By Property 1.5.4.i (page 50) applied to (15), we have θ(α)/ϵ = g. Hence, α must be in dom(θ), which means that σ ∈ T (\underline{17}). By Property 1.5.11.ii (page 54), there exists τ such that σ ≡ τ. In summary, (α ⋄ σ) ∈ Q, and σ ≡ τ (\underline{18}) holds. We have (Q) α ≡ τ (\underline{19}) by Eq-Mono, thus (Q) α ≡ σ (\underline{20}) holds by R-Trans (18), and (19). By (6), (20), and R-Trans, we get (Q) σ_{2} ≡ σ. By Property 2, we have a thrifty derivation of (Q) σ_{2} ≡ σ (\underline{21}). By hypothesis, (Q) σ_{1} ♢ σ_{2} (\underline{22}) is thrifty, hence (Q) σ_{1} ♢ σ is thrifty by (22), (21), and R-Trans. Besides since σ ∈ T (from (17)), the binding (α ⋄ σ) is considered flexible and rigid. This is the expected result.

∘ Case A-Hyp: We have (α_{1} = σ_{1}) ∈ Q, and σ_{2} is α_{1}. By hypothesis, (Q) α_{1} ≡ α (\underline{23}).

Subcase α is α_{1}: We have σ_{1} = σ and (Q) σ_{1} ⊏ − σ holds by Eq-Refl, and is thrifty. Besides, ♢ is ⊏ − and ⋄ is rigid.

Otherwise, σ_{1} cannot be in T (otherwise we would have (Q) σ_{1} ≡ α by (23) and Eq-Mono). By Property 1.5.11.vii (page 54) and (23), we have Q̂(α_{1}) = Q̂(α), that is, α_{1} = Q̂(α). As a consequence, we must have α ∈ dom(Q̂), that is, σ ∈ T . Then (Q) α ≡ σ (\underline{24}) holds, thus (Q) α_{1} ≡ σ (\underline{25}) holds by R-Trans, (23), and (24). By Property 2, (25) is made thrifty. Hence, we get a thrifty derivation of (Q) α_{1} ⊏ − σ (\underline{26}) by A-Equiv. Additionally, (Q) σ_{1} ⊏ − α_{1} (\underline{27}) holds by A-Hyp and is thrifty by definition. Therefore, we get a thrifty derivation of (Q) σ_{1} ⊏ − σ by R-Trans, (27), and (26). ∘ Case I-Hyp is similar. ∘ Case I-Bot: Since σ_{1} is ⊥, we can derive (Q) σ_{1} ⊑ σ by I-Bot, and it is thrifty. ∘ Case I-Abstract: By induction hypothesis. ∘ Case I-Rigid: We have σ_{1} = ∀ (α ≥ σ′_{1}) σ′_{2} and σ_{2} = ∀ (α = σ′_{1}) σ′_{2}. If α ∉ ftv(σ′_{2}), then σ_{1} ≡ σ_{2}, which is a contradiction. Since (Q) σ_{2} ≡ α holds by hypothesis, we must have σ_{2} ∈ T by Property 1.5.11.x (page 54). Hence, σ′_{2} ∈ T and σ′_{1} ∈ T by Property 2.1.5.i (page 67). Then σ_{1} ≡ σ_{2} by Eq-Mono and R-Trans, which is a contradiction. Hence, this case cannot occur. ∘ Case R-Context-Rigid and R-Context-Flexible: We have σ_{1} = ∀ (β ⋄ σ′_{1}) σ_{0} and σ_{2} = ∀ (β ⋄ σ′_{2}) σ_{0}. The premise is (Q) σ′_{1} ♢ σ′_{2} (\underline{28}), and the conclusion is (Q) σ_{1} ♢ σ_{2} (\underline{29}). Moreover, by hypothesis, we have (Q) σ_{2} ≡ α (\underline{30}), that is, (Q) ∀ (β ⋄ σ′_{2}) σ_{0} ≡ α (\underline{31}) holds.

Subcase nf(σ_{0}) is β: Then (Q) σ′_{2} ≡ α (\underline{32}) holds by Eq-Var and (31). Besides, (Q) σ′_{1} ≡ α does not hold (\underline{33}) otherwise, we would have (Q) σ_{1} ≡ α. By induction hypothesis on (28), (32), and (33), we have a thrifty derivation of (Q) σ′_{1} ♢ σ, which gives (Q) ∀ (β ⋄ σ′_{1}) σ_{0} ♢ ∀ (β ⋄ σ) σ_{0} by R-Context-Rigid or R-Context-Flexible. Then by Eq-Var, we get (Q) ∀ (β ⋄ σ′_{1}) σ_{0} ♢ σ. Additionally, by induction hypothesis on (28), if ♢ is ⊏ −, then ⋄ is rigid.

Subcase β ∉ ftv(σ_{0}): Then (Q) σ_{1} ≡ σ_{2} holds by Eq-Free, which is a contradiction.

Otherwise, β ∈ ftv(σ_{0}) and nf(σ_{0}) is not β. Then σ_{0}/ϵ must be a type constructor g. By Property 1.5.11.vi (page 54) and (31), we must have Q̂(α)/ϵ = g, which implies α ∈ dom(Q̂), that is σ ∈ T (\underline{34}). As a consequence, (Q) α ≡ σ (\underline{35}) holds, thus (Q) σ_{2} ≡ σ (\underline{36}) holds by R-Trans, (30), and (35). By Property 2 and (36), there exists a thrifty derivation of (Q) σ_{2} ≡ σ. By A-Equiv or I-Equiv^{⋆}, (Q) σ_{2} ♢ σ (\underline{37}) holds and is thrifty. Then (Q) σ_{1} ♢ σ holds by R-Trans or R-Trans, (29) and (37), and is thrifty. Since σ ∈ T (from (34)), the binding (α ⋄ σ) is flexible and rigid. □

Thanks to Thrifty-Var, we can prove remaining properties: \underline{Property 3}: We show that any derivation with exactly one squandering rule, used last, can be made thrifty and keep the same conclusion. The result for any given derivation is immediate by induction on the number of squandering rule of the derivation. By definition, there are two ways of being a squandering rule: ∘ First case: The conclusion is (Q) ∀ (α⋄σ) σ_{1} ♢ ∀ (α⋄σ) σ_{2}, where nf(σ_{2}) is α and nf(σ_{1}) is not α. The last rule used is X-Context-R, thus the premise is a derivation of (Q, α ⋄ σ) σ_{1} ♢ σ_{2} (\underline{1}), which is thrifty by hypothesis. By Property 1.5.6.i (page 51), σ_{2} ≡ α (\underline{2}) holds.

Subcase σ_{1} is not equivalent to α under (Q, α ⋄ σ): By thrifty-var and (1), there exists a thrifty derivation of (Q, α ⋄ σ) σ_{1} ♢ σ. Hence, by X-Context-R, we get a thrifty derivation of (Q) ∀ (α ⋄ σ) σ_{1} ♢ ∀ (α ⋄ σ) σ (\underline{3}). Additionally, (Q) ∀ (α ⋄ σ) σ ≡ σ (\underline{4}) holds by Eq-Free, and (Q) σ ≡ ∀ (α ⋄ σ) α (\underline{5}) by Eq-Var. Finally, by R-Trans, (4), and (5), and (2), we get (Q) ∀ (α ⋄ σ) σ ≡ ∀ (α ⋄ σ) σ_{2} (\underline{6}). By Property 2, this equivalence can be made thrifty. Hence, by R-Trans, (3), and (6), we have a thrifty derivation of (Q) ∀ (α ⋄ σ) σ_{1} ♢ ∀ (α ⋄ σ) σ_{2}. This is the expected result.

Subcase σ_{1} is equivalent to α under (Q, α ⋄ σ): By Lemma 2.1.6 and (1), we get (Q, α ⋄ σ) σ_{2} ≡ α. Hence, (Q) ∀ (α ⋄ σ) σ_{1} ≡ ∀ (α ⋄ σ) σ_{2} holds by R-Context-R. By Property 2, we have a thrifty derivation of (Q) ∀ (α ⋄ σ) σ_{1} ♢ ∀ (α ⋄ σ) σ_{2}. ∘ Second case: The conclusion is (Q) ∀ (α ⋄ σ) σ_{1} ♢ ∀ (α ⋄ σ) σ_{2}, where nf(σ_{2}) is not α and nf(σ_{1}) is α. By Property 1.5.6.i (page 51), we have σ_{1} ≡ α. The premise is a thrifty derivation of (Q, α ⋄ σ) σ_{1} ♢ σ_{2}. By Lemma 2.1.6, we have (Q, α ⋄ σ) σ_{1} ≡ σ_{2}. Hence, (Q) ∀ (α ⋄ σ) σ_{1} ≡ ∀ (α ⋄ σ) σ_{2} holds by R-Context-R, and we conclude directly by Property 2.

\underline{Lemma 2.3.3} (proof sketch): We use Property 3 and we prove that any thrifty derivation is kept thrifty when using the rewriting rules suggested in the proof of Lemma 2.3.1. As a matter of fact, none of them uses a right-context rule, thus no squandering rule can be introduced. This means that the derivation is kept thrifty.

Proof of Corollary 2.3.4

By Property 3, we have a thrifty derivation of (Q) σ_{1} ♢ α (\underline{1}). If (Q) σ_{1} ≡ α does not hold, then we get the expected result by thrifty-var (to be found in the preceding proof) and (1). Otherwise, we have (Q) σ_{1} ≡ α (\underline{2}) and σ_{1} ∉ V. This implies α ∈ dom(Q̂) by Corollary 1.5.10 and 1.5.4.i (page 50). Hence, σ ∈ T (\underline{3}). Thus, (Q) α ≡ σ (\underline{4}) holds and (Q) σ_{1} ≡ σ follows by R-Trans, (2), and (4). Since σ ∈ T (from (3)), the binding (α ⋄ σ) is flexible and rigid. This is the expected result.

Proof of Property 2.4.3

\underline{Property i} : It is proved by structural induction on the context.

\underline{Property ii}: It is a consequence of Properties i and 2.1.5.i.

\underline{Property iii} : It is by structural induction on C. The cases [ ], and ∀ (α ⋄ C) σ when α ∉ ftv(σ) are immediate. The cases level(C) = 0, ∀ (α ⋄ σ) C′, and ∀ (α ⋄ C′) σ_{a} with σ_{a} ≡ α are by induction hypothesis. The last case is C = ∀ (α ⋄ C′) σ, when α ∈ ftv(σ) (\underline{1}), σ ∉ V and level(C′) ≠ 0 (\underline{2}). By definition of (1), there exists an occurrence u such that σ/u = α. By induction hypothesis and (2), C′ is useful. Let β and γ be two fresh variables. By Property i, there exists u′ such that C′(β)/u′ = β and C′(γ)/u′ = γ. Hence, we have C(β)/uu′ = β and C(γ)/uu′ = γ. By corollary 1.5.11.vi (page 54), we cannot have C(β) ≡ C(γ). Hence, C is useful.

Proof of Property 2.4.4

\underline{Property i}: We prove by structural induction that for any narrow context C_{n}, we have level(C_{n}) = 1 (straightforward). Conversely, we assume that level(C) = 1 (\underline{1}) We prove by structural induction on C that C is narrow. If C is [ ], then C is narrow. If C is ∀ (α ⋄ σ) C′ (\underline{2}), then level(C′) = level(C) by definition of levels, thus level(C′) = 1 by (1). Hence, C′ is narrow by induction hypothesis, which implies that C is narrow by (2). If C is ∀ (α⋄C′) σ_{α}, where σ_{α} ≡ α, then we have level(C′) = level(C) by definition, thus level(C′) = 1 by (1). Hence, C′ is narrow by induction hypothesis, which implies that C is narrow too. If C is ∀ (α⋄C′) σ and σ ≢ α, then, either level(C′) = 0, which implies level(C) = 0 and this is a contradiction, or level(C′) > 0 and level(C) = level(C′) + 1, thus level(C) > 1, which is a contradiction too. This case is not possible.

\underline{Property ii}: If level(C) = 1, we know that C is narrow. We prove by structural induction on C that C is equivalent to ∀ (\overline{C}) [ ]. ∘ Case [ ]: immediate. ∘ Case ∀ (α ⋄ σ) C′: By induction hypothesis C′ is equivalent to ∀ (\overline{C′}) [ ]. Hence, C is equivalent to ∀ (α ⋄ σ) ∀ (\overline{C′}) [ ], which is the expected result since \overline{∀ (α ⋄ σ) C′} is (α ⋄ σ)\overline{C′}. ∘ Case ∀ (α ⋄ C′) σ_{α}: We have C equivalent to C′, and we get the expected result by induction hypothesis and by observing that \overline{C} is \overline{C′}.

\underline{Property iii}: It is shown by induction on C: ∘ Case [ ] cannot occur since level(C) > 1. ∘ Case ∀ (α ⋄ C_{1}) σ_{α} and σ_{α} ≡ α: Then level(C_{1}) > 1 and C is equivalent to C_{1}, thus the result is by induction hypothesis. ∘ Case ∀ (α ⋄ C_{1}) σ and σ ≢ α: Then level(C_{1}) = level(C) − 1. If level(C_{1}) = 1, then we get the expected result by Property ii, taking Q_{1} = \overline{C_{1}}. Otherwise, by induction hypothesis, C_{1} is equivalent to C′_{1}(∀ (β ⋄ ∀ (Q_{1}) [ ]) σ′), and we get the expected result by taking C′ = ∀ (α ⋄ C′_{1}) σ. ∘ Case ∀ (α⋄σ) C_{1}: We have level(C) = level(C_{1}) > 1. We get the result by induction hypothesis.

\underline{Property iv}: If level(C) = 1, then we get the result by taking C′ = [ ] and C_{n} = C. Hence, we assume level(C) > 1, and we prove the result by structural induction on C: ∘ Case [ ]: Not possible since level(C) > 1. ∘ Case ∀ (α ⋄ σ) C′: By induction hypothesis. ∘ Case ∀ (α⋄C′) σ_{α} and σ_{α} ≡ α: We have level(C′) = level(C), dom_{1}(C′) = dom_{1}(C), and C′ is equivalent to C. Hence, we get the result by induction hypothesis. ∘ Case ∀ (α ⋄ C′) σ and σ ≢ α: We have level(C′) = level(C) − 1. If level(C′) = 1, we get the expected result. Otherwise, we get the result by induction hypothesis.

\underline{Property v}: It is shown by structural induction on C: ∘ Case [ ]: immediate. ∘ Case ∀ (α ⋄ σ′) C′: Since C(σ) ∈ V, we must have C′(σ) ∈ V, and we get the result by induction hypothesis. ∘ Case ∀ (α⋄C′) σ_{α} and σ_{α} ≡ α: Since C(σ) ≡ C′(σ) by Eq-Var, we have C′(σ) ∈ V, and we get the result by induction hypothesis, observing that level(C) = level(C′). ∘ Case ∀ (α ⋄ C′) σ′ and σ′ ≢ α: If level(C′) = 0, or α ∉ ftv(σ′), then level(C) = 0, which is the expected result. Otherwise, α ∈ ftv(σ′) and level(C′) > 0. Hence, level(C) = level(C′) + 1 by definition. Thus we have level(C) > 1. We must show that this case is not possible, that is, C(σ) cannot be in V. Indeed, we have α ∈ ftv(σ′) and σ′ ≢ α, thus σ′/ϵ ∉ ϑ. Hence, ∀ (α ⋄ C′(σ)) σ′/ϵ ∉ ϑ, which implies that C(σ) ∉ V by Property 1.5.4.i (page 50).

Proof of Lemma 2.5.5

The relations ⊏ −ᾱ and ⊑ᾱ are included (respectively) in ⊏ − and ⊑ for any set ᾱ. Indeed, the new set of rules defining (respectively) ⊏ −ᾱ and ⊑ᾱ is derivable from the old set of rules defining (respectively) ⊏ − and ⊑.

Conversely, we have to show that ⊏ − is included in ⊏ −^{∅}. By Lemma 2.5.2 (page 78), this amounts to showing that (≡|⊏ −_{C})^{∗} is included in ⊏ −^{∅}. Since ⊏ −^{∅} is transitive, it suffices to show that (≡|⊏ −_{C}) is included in ⊏ −^{∅}. Additionally, ≡ is included in ⊏ −^{∅} by RuleA-Equiv’, thus we only need to prove the following property:

If (Q) σ_{1} ⊏ −_{C} σ_{2} (\underline{1}) holds, then (Q) σ_{1} ⊏ −^{∅} σ_{2} holds too.

Necessarily, Ac-Hyp is used to derive (1). Hence, we have σ_{1} = C_{r}(σ_{0}), σ_{2} = C_{r}(α), and (α = σ_{0}) ∈ Q\overline{C_{r}}. If α ∈ dom(Q), then α is frozen in the derivation of (Q) σ_{1} ⊏ − σ_{2}, that is, α is not introduced in ᾱ by context rules. Hence, (Q) σ_{1} ⊏ −ᾱ σ_{2} holds, by A-Hyp’ and context rules. Otherwise, α ∈ dom(\overline{C_{r}}), which implies that the context C_{r} is of the form C_{a}(∀ (α = σ_{0}) C_{b}). In summary, we have:

σ_{1} = C_{a}(∀ (α = σ_{0}) C_{b}(σ_{0})) (\underline{2})  σ_{2} = C_{a}(∀ (α = σ_{0}) C_{b}(α))  (Q) σ_{1} ⊏ −_{C} σ_{2} (\underline{3})

We have to show that (Q) σ_{1} ⊏ −^{∅} σ_{2} holds too. In fact, it suffices to show that (Q\overline{C_{a}}) ∀ (α = σ_{0}) C_{b}(σ_{0}) ⊏ −ᾱ (dom(C_{a}))∀ (α = σ_{0}) C_{b}(α) (\underline{4}) holds. Then context rules A-Context-L’ and R-Context-R give the expected result. We show (4) by case on the level of C_{b}. ∘ Case level(C_{b}) = 1: Then C_{b} is equivalent to ∀ (\overline{C_{b}}) [ ] by Property 2.4.4.ii (page 74). Hence, C_{b}(σ_{0}) ≡ ∀ (\overline{C_{b}}) σ_{0} (\underline{5}) holds. Since (2) and (3) are well-formed, we must have ftv(σ_{0}) ⊆ dom(Q\overline{C_{a}}), and ftv(σ_{0}) # dom(\overline{C_{b}}). Hence, ∀ (\overline{C_{b}}) σ_{0} is equivalent to σ_{0} (\underline{6}) by Eq-Free. Similarly, we have ∀ (α = σ_{0}) C_{b}(α) ≡ ∀ (α = σ_{0}) α (\underline{7}) by Eq-Free, and ∀ (α = σ_{0}) α ≡ σ_{0} (\underline{8}) by Eq-var. Hence, R-Trans, (7), and (8) give ∀ (α = σ_{0}) C_{b}(α) ≡ σ_{0} (\underline{9}). Consequently, by (5), (6), and (9), we have (Q\overline{C_{a}}) ∀ (α = σ_{0}) C_{b}(σ_{0}) ≡ ∀ (α = σ_{0}) C_{b}(α), which implies the expected result (4) by A-Equiv’. ∘ Case level(C_{b}) = 2: Then by Property 2.4.4.iii (page 74), C_{b} is equivalent to ∀ (Q_{1}) ∀ (α′ = ∀ (Q_{2}) [ ]) σ′, for some prefixes Q_{1}, Q_{2}. As above, we note that ftv(σ_{0}) # dom(Q_{1}Q_{2}), thus ∀ (α = σ_{0}) C_{b}(σ_{0}) ≡ ∀ (α = σ_{0}) ∀ (α′ = σ_{0}) ∀ (Q_{1}) σ′ (\underline{10}) holds by Eq-Free and Eq-Comm, and ∀ (α = σ_{0}) C_{b}(α) ≡ ∀ (α = σ_{0}) ∀ (α′ = α) ∀ (Q_{1}) σ′ (\underline{11}). Hence, by rules A-Alias’, A-Equiv’, (10), and (11), we derive (Q\overline{C_{a}}) ∀ (α = σ_{0}) C_{b}(σ_{0}) ⊏ −^{dom(C_{a})} ∀ (α = σ_{0}) C_{b}(α). This is the expected result (4). ∘ Case level(C_{b}) > 1 (\underline{12}): We prove the following result:

Given n > 0, for any rigid context C_{r} such that level(C_{r}) = n + 1, and σ_{0} such that ftv(σ_{0}) ∪ \{α\} # dom(\overline{C_{r}}), there exists a rigid context C′_{r} such that level(C′_{r}) = n, C_{r}(σ_{0}) ⊏ −^{∅} C′_{r}(σ_{0}) and C_{r}(α) ≡ C′_{r}(α).

Proof: This is proved by structural induction on C_{r}.

Subcase [ ] is not possible since level(C_{r}) > 1. Subcase ∀ (β ⋄ σ) C_{1}: By induction hypothesis. Subcase ∀ (β ⋄ C_{1}) σ and σ ≡ β: Then C_{r} is equivalent to C_{1}, and we get the

result by induction hypothesis.

Subcase ∀ (β = C_{1}) σ and σ ≢ β: If level(C_{1}) > 1, then we get the result by induction hypothesis. Otherwise, level(C_{1}) = 2, thus, by Properties 2.4.4.iii (page 74) and 2.4.4.ii (page 74), C_{1} is equivalent to ∀ (Q′_{1}) ∀ (β′=∀ (Q′_{2}) [ ]) σ_{1} for some prefixes Q′_{1} and Q′_{2}. Besides, we have ftv(σ_{0}) # dom(Q′_{1}Q′_{2}) by hypothesis. This implies C_{1}(σ_{0}) ≡ ∀ (β′ = σ_{0}) ∀ (Q_{1}) σ_{1} by Eq-Free and Eq-Comm. Hence, C(σ_{0}) ≡ ∀ (β = ∀ (β′ = σ_{0}) ∀ (Q_{1}) σ_{1}) σ. By A-Up’, we get C(σ_{0}) ⊏ − [∅]∀ (β′ = σ_{0}) ∀ (β = ∀ (Q_{1}) σ_{1}) σ. Similarly, C(α) ≡ ∀ (β′ = α) ∀ (β = ∀ (Q_{1}) σ_{1}) σ. Hence, the context C′_{r} = ∀ (β′ = [ ]) ∀ (β = σ_{1}) σ is of level n = 1 and is appropriate. □

Back to the main proof. By well-formedness of (2), we have ftv(σ)∪{α} # dom(C_{b}). By (12), level(C_{b}) = n > 1, hence there exists a rigid context C′_{b} of level n−1 such that C_{b}(σ_{0}) ⊏ −^{∅} C′_{b}(σ_{0}) and C_{b}(α) ≡ C′_{b}(α). By immediate iteration, we build a sequence C_{b}^{i} of rigid contexts, such that C_{b}(σ_{0}) ⊏ −^{∅} C_{b}^{n}[σ_{0}] (\underline{13}) holds by R-Trans, C_{b}(α) ≡ C_{b}^{n}[α] (\underline{14}) hold, and C_{b}^{n} is of level 1. Moreover, ∀ (α = σ_{0}) C_{b}^{n}[σ_{0}] ⊏ −ᾱ ∀ (α = σ_{0}) C_{b}^{n}[α] (\underline{15}) holds by Eq-Comm and A-Alias’. Hence, by R-Trans, (13), (15), and (14), we get ∀ (α = σ_{0}) C_{b}(σ_{0}) ⊏ −^{∅} ∀ (α = σ_{0}) C_{b}(α), which is the expected result (4).

The proof of the equivalence between ⊑ and ⊑ᾱ is similar. A new proof for the case I-Abstract is needed, though, since the induction hypothesis cannot be used (indeed, ⊏ − is equal to ⊏ −^{∅}, but not in general to ⊏ −ᾱ).

Proof of Lemma 2.5.7

By induction on the derivation of (Q) σ_{1} ♢ᾱ σ_{2}. ∘ Case A-Equiv’: by Corollary 1.5.10 and Property 1.5.11.ix (page 54). ∘ Case R-Trans The premises are (Q) σ_{1} ♢ᾱ σ′_{1} (\underline{1}) and (Q) σ′_{1} ♢ᾱ σ_{2} (\underline{2}). We have ∀ (Q) σ_{1}/ ⩽_{/} ∀ (Q) σ′_{1}/ (\underline{3}) by Property 2.1.3.ii (page 65), and ∀ (Q) σ′_{1}/ ⩽_{/} ∀ (Q) σ_{2}/ (\underline{4}) Since ∀ (Q) σ_{1}/ = ∀ (Q) σ_{2}/ (by hypothesis), (3) become ∀ (Q) σ_{2}/ ⩽_{/} ∀ (Q) σ′_{1}/ (\underline{5}). By (4), (5) and antisymmetry of ⩽ (Property 2.1.2.i (page 65)), we get ∀ (Q) σ_{2}/ = ∀ (Q) σ′_{1}/. Similarly, ∀ (Q) σ_{1}/ = ∀ (Q) σ′_{1}/ (\underline{6}) holds. If α ∈ ftv(Q̂(σ_{2})) and α ∈ ᾱ, then α ∈ ftv(Q̂(σ′_{1})) by induction hypothesis on (2), thus α ∈ ftv(Q̂(σ_{1})) by induction hypothesis on (1). ∘ Case R-Context-R’: We have σ_{1} = ∀ (β⋄σ) σ′_{1} and σ_{2} = ∀ (β⋄σ) σ′_{2}. We choose β fresh, that is, β ∉ dom(Q̂) ∪ codom(Q̂). The premise is (Q, β ⋄ σ) σ′_{1} ♢^{ᾱ∪\{β\}} σ′_{2} (\underline{1}). By hypothesis, we have ∀ (Q) σ_{1}/ = ∀ (Q) σ_{2}/, that is, ∀ (Q, β ⋄ σ) σ′_{1}/ = ∀ (Q, β ⋄ σ) σ′_{2}/. Let α be in ᾱ and in ftv(Q̂(σ_{2})) (\underline{2}). If α is in ftv(Q̂(σ′_{2})), then by induction hypothesis on (1), α is in ftv(Q̂(σ′_{1})), thus α ∈ ftv(Q̂(σ_{1})). Otherwise, we have α ∉ ftv(Q̂(σ′_{2})) and (2), thus we necessarily have β ∈ ftv(σ′_{2}) (\underline{3}). and α ∈ ftv(Q̂(σ)) (\underline{4}). Let θ′ be { \atop Q, β ⋄ σ}. We proceed by case analysis.

Subcase σ ∉ T : Then θ′ is Q̂ (\underline{5}), thus we have β ∈ ftv(θ′(σ′_{2})) from (3), and β is obviously in ᾱ ∪ {β}. By induction hypothesis and (1), we get β ∈ ftv(θ′(σ′_{1})). Consequently, β ∈ ftv(Q̂(σ′_{1})) (\underline{6}) by (5), thus α ∈ ftv(Q̂(σ_{1})) by (6) and (4). This is the expected result.

Subcase σ ∈ T : Then σ ≡ τ (\underline{7}) by Property 1.5.11.ii (page 54) and θ′ is Q̂ ∘ [β = τ] (\underline{8}). We have α ∈ ftv(Q̂(τ)) from (4) and (7), thus α ∈ ftv(θ′(σ′_{2})) by (8) and (3). Hence, by induction hypothesis and (1), we have α ∈ ftv(θ′(σ′_{1})). Consequently, α ∈ ftv(Q̂(∀ (β ⋄ σ) σ′_{1})) by (8) and (7). This is the expected result.

∘ Case A-Context-L’ and I-Context-L’: We have σ_{1} = ∀ (β ⋄ σ′_{1}) σ and σ_{2} = ∀ (β ⋄ σ′_{2}) σ. The premise is (Q) σ′_{1} ♢ᾱ σ′_{2} (\underline{1}). We have α ∈ ftv(Q̂(σ_{2})) by hypothesis. If α ∈ ftv(Q̂(σ)), then α ∈ ftv(Q̂(σ_{1})), which is the expected result. Otherwise, we must have α ∈ ftv(Q̂(σ′_{2})) (\underline{2}) and β ∈ ftv(σ) (\underline{3}). By definition, there exists u such that σ/u = β. By hypothesis, ∀ (Q) σ_{1}/ = ∀ (Q) σ_{2}/. Hence, ∀ (Q) σ_{1} · u/ = ∀ (Q) σ_{2} · u/. By Property 1.3.3.i (page 40), this means Θ_{Q}(σ_{1}) · u/ = Θ_{Q}(σ_{2}) · u/, that is, Θ_{Q}(σ′_{1}) · ϵ/ = Θ_{Q}(σ′_{2}) · ϵ/. By Property 1.3.3.i (page 40), we get ∀ (Q) σ′_{1}/ = ∀ (Q) σ′_{2}/. By induction hypothesis,(1), and (2), we get α ∈ ftv(Q̂(σ′_{1})), thus α ∈ ftv(Q̂(σ_{1})) by (3).

∘ Case I-Rigid’: Both sides have the same set of free variables.

∘ Case A-Hyp’ and I-Hyp’: Here σ_{2} is β, and β is not in ᾱ, hence there is no α ∈ ftv(σ_{2}) such that α is in ᾱ.

∘ Case A-Alias’ and I-Alias’: Both sides have the same set of free variables.

∘ Case A-Up’ and I-Up’: Both sides have the same set of free variables.

∘ Case I-Nil’: We have (Q) ⊥ ⊑ σ_{2} and ∀ (Q) ⊥/ = ∀ (Q) σ_{2}/. Hence, σ_{2} is either ⊥, or a type variable. This is a contradiction with restrictions of Lemma 2.5.6. Hence, this case does not happen.

Proof of Property 2.6.2

We are glad to prove each point. \underline{Property i}: it is easy to check that ˙⊏ −ᾱ is included in ⊏ − (indeed, rules StSh-Hyp, StSh-Up and StSh-Alias are derivable with ⊏ −). Additionally, ≡ is included in ⊏ −, and ⊏ − is transitive, thus (≡ ˙⊏ −^{∅})^{∗} is included in ⊏ −. Conversely, we show that ⊏ − is included in (≡ ˙⊏ −^{∅})^{∗}.

As seen in Lemma 2.5.5, the relations ⊏ − and ⊏ −ᾱ are equivalent. Hence, it suffices to show that ⊏ −ᾱ is included in (≡ ˙⊏ −^{∅})^{∗}. By Lemma 2.5.6, we can assume that the given derivation is restricted. As we did in Lemma 2.5.1 (page 78), transitivity can be lifted to top-level for ⊏ −ᾱ too, thus it suffices to show that ⊏ −ᾱ without transitivity is included in (≡ ˙⊏ −^{∅}). More precisely, we prove that if we have a restricted derivation of (Q) σ_{1} ⊏ −ᾱ σ_{2} without transitivity, then (Q) σ_{1} (≡ ˙⊏ −^{∅}) σ_{2} is derivable. As we did in the proof of Lemma 2.5.2 (page 78), we can write the derivation of (Q) σ_{1} ⊏ −ᾱ σ_{2} in the form

A-X \frac{…}{(QQ′) σ′_{1} ⊏ −ᾱ σ′_{2}}
⋮
(Q) σ_{1} ⊏ −ᾱ σ_{2}

Where, A-X is either A-Equiv, A-Up’, A-Hyp’ or A-Alias’, and the symbol ⋮ represents a sequence of context rules. If A-X is A-Equiv, then (Q) σ_{1} ≡ σ_{2} holds, thus (Q) σ_{1} (≡ ˙⊏ −^{∅}) σ_{2} holds by definition. Otherwise, as we did in the proof of Lemma 2.5.2 (page 78), we can associate a rigid context C_{r} to the sequence of context

rules (⋮), such that Q′ = \overline{C_{r}}, σ_{1} = C_{r}(σ′_{1}) and σ_{2} = C_{r}(σ′_{2}). In summary, we have (Q) C_{r}(σ′_{1}) ⊏ −ᾱ C_{r}(σ′_{2}), and we must show that (Q) C_{r}(σ′_{1}) (≡ ˙⊏ −^{∅}) C_{r}(σ′_{2}) holds. ∘ Case Rule A-X is A-Hyp’: Then we have (α = σ′_{1}) ∈ Q (since α ∉ ᾱ) and σ′_{2} = α. Hence, (Q) C_{r}(σ′_{1}) ˙⊏ −ᾱ C_{r}(σ′_{2}) holds by Rule StSh-Hyp whenever σ′_{1} ∉ T . If σ′_{1} ∈ T , then (Q) C_{r}(σ′_{1}) ≡ C_{r}(α) is easily derivable by Eq-Mono, thus (Q) C_{r}(σ′_{1}) (≡ ˙⊏ −^{∅}) C_{r}(σ′_{2}) holds. ∘ Case Rule A-X is A-Up’: Then we have σ′_{1} = ∀ (α = ∀ (α_{1} = σ_{1}) σ) σ′ and σ′_{2} = ∀ (α_{1} = σ_{1}) ∀ (α = σ) σ′. Hence, (Q) σ_{1} ˙⊏ −ᾱ σ_{2} holds by Rule StSh-Up (all side conditions obviously hold since Q′ is ∅ and the rule is restricted). ∘ Case Rule A-X is A-Alias’: Then we have σ′_{1} = ∀ (α_{1} = σ_{0}) ∀ (α_{2} = σ_{0}) σ and σ′_{2} = ∀ (α_{1} = σ_{0}) ∀ (α_{2} = α_{1}) σ. Hence, (Q) C_{r}(σ′_{1}) ˙⊏ −ᾱ C_{r}(σ′_{2}) holds by StSh-Alias (because the judgment is restricted, the side conditions hold).

We have shown that (Q) σ_{1} (≡ ˙⊏ −^{∅}) σ_{2} holds, thus ⊏ − is included in (≡ ˙⊏ −^{∅})^{∗}. Consequently, ⊏ − and (≡ ˙⊏ −^{∅})^{∗} are equivalent. □

\underline{Property ii}: We have ⊏ − included in ˙⊑ by C-Abstract-R. Hence, ⊏ − is included in (≡ ˙⊑)^{∗} (\underline{1}).

We introduce a derivable rule:

The following rule is derivable:

C-Abstract \frac{(QQ′) σ_{1} ⊏ −^{dom(Q′)} σ_{2}  Q′ = \overline{C_{f}}}{(Q) C_{f}(σ_{1}) (≡ ˙⊑)^{∗} C_{f}(σ_{2})}

Proof: We assume (QQ′) σ_{1} ⊏ −ᾱ σ_{2} (\underline{2}) holds. If level(C_{f}) = 0, then C_{f} is useless by Property 2.4.3.iii (page 73), thus C_{f}(σ_{1}) ≡ C_{f}(σ_{2}) by definition, and (Q) C_{f}(σ_{1}) (≡ ˙⊑) C_{f}(σ_{2}) holds. If level(C_{f}) is 1, then C_{f} is narrow by Property 2.4.4.i (page 74) thus C_{f} is also a rigid context. Hence, (Q) C_{f}(σ_{1}) ⊏ −ᾱ C_{f}(σ_{2}) holds by context rules. Thus (Q) C_{f}(σ_{1}) (≡ ˙⊑)^{∗} C_{f}(σ_{2}) holds by Lemma 2.5.5 and (1). Otherwise, level(C_{f}) > 1. By Lemma 2.5.5, Property i, and (2), we have (QQ′) σ_{1} (≡ ˙⊏ −^{∅})^{∗} σ_{2}. Since (≡ ˙⊑)^{∗} is transitive, it suffices to show that if (QQ′) σ_{a} (≡ ˙⊏ −^{∅}) σ_{b} holds, then (Q) C_{f}(σ_{a}) (≡ ˙⊑)^{∗} C_{f}(σ_{b}) holds too. Additionally, since ≡ is included in (≡ ˙⊑), it suffices to show that if (QQ′) σ_{a} ˙⊏ −ᾱ σ_{b} holds, then (Q) C_{f}(σ_{a}) (≡ ˙⊑)^{∗} C_{f}(σ_{b}) holds too. We get such a result by C-Abstract-F. □

The relation ˙⊏ is included in ⊑, as well as ≡ and ˙⊏ −ᾱ. Besides, ⊑ is a congruence under flexible prefixes C_{f}. Hence, ˙⊑ is included in ⊑. Since ⊑ is transitive, ˙⊑^{∗} is also included in ⊑. Additionally, ≡ is included in ⊑ by I-Equiv^{⋆}, thus (≡ ˙⊑)^{∗} is included in ⊑.

Conversely, we show that ⊑ is included in (≡ ˙⊑)^{∗}. By Lemma 2.5.5, it suffices to show that ⊑ᾱ is included in (≡ ˙⊑)^{∗}. As shown in Lemma 2.5.1 (page 78), transitivity can be lifted at top-level, and the derivation is made restricted by Lemma 2.5.6; thus, we only have to show that if we have a restricted derivation of (Q) σ_{1} ⊑ᾱ σ_{2}, without using transitivity, then (Q) σ_{1} (≡ ˙⊑)^{∗} σ_{2} holds too. The derivation of (Q) σ_{1} ⊑ᾱ σ_{2} is of the form

I-Context-X’ \frac{I-X \frac{\overline{(QQ′) σ′_{1} ⊑ᾱ σ′_{2}}}{⋮}}{(Q) σ_{1} ⊑ᾱ σ_{2}}

The context rules (represented by ⋮) are associated to a flexible context C_{f} such that \overline{C_{f}} = Q′, σ_{1} = C_{f}(σ′_{1}) and σ_{2} = C_{f}(σ′_{2}). The top Rule I-X is I-Abstract’, I-Bot’, I-Hyp’, I-Rigid’, I-Up’, or I-Alias’.

∘ Case I-Abstract’: By hypothesis (QQ′) σ′_{1} ⊏ −^{dom(Q′)} σ′_{2} holds. We have (Q) σ_{1} (≡ ˙⊑)^{∗} σ_{2} by C-Abstract. This is the expected result.

∘ Case I-Hyp’: By rules S-Hyp and C-Strict.

∘ Case I-Rigid’: By rules S-Rigid and C-Strict.

∘ Case I-Bot’: We have σ′_{1} = ⊥. If σ′_{2} is closed, we conclude directly by S-Nil and C-Strict. Otherwise, we consider ∀ (QQ′) σ′_{2}, which is necessarily closed. We can derive (Q) σ_{1} ˙⊑ C_{f}(∀ (QQ′) σ′_{2}) by S-Nil and C-Strict. By iteration of S-Hyp and C-Strict, or A-Hyp and C-Abstract, we derive (Q) C_{f}(∀ (QQ′) σ′_{2}) ˙⊑^{∗} C_{f}(σ′_{2}). Hence, (Q) σ_{1} ˙⊑^{∗} C_{f}(σ′_{2}) holds by transitivity, that is (Q) σ_{1} ˙⊑^{∗} σ_{2}.

∘ Case I-Up’: By S-Up and C-Strict.

∘ Case I-Alias’: By S-Alias and C-Strict.

Proof of Property 2.6.3

Each point deserves its own proof.

\underline{Property i for R being ˙⊏ −ᾱ}: By case on the rule used to derive (Q) σ_{1} ˙⊏ −ᾱ σ_{2}. ∘ Case StSh-Hyp: By hypothesis, we have σ_{1} = C_{r}(σ′_{1}), (α = σ′′_{1}) ∈ Q (\underline{1}), σ_{2} = C_{r}(α) and (Q) Ĉ_{r}(σ′_{1}) ≡ σ′′_{1} (\underline{2}). Besides, σ′_{1} ∉ T and C_{r} is a useful well-formed context by hypothesis. By Lemma 2.4.5 (page 75), there exists a context C′_{r}, which is ftv(Ĉ_{r}(σ′_{1}))-equivalent to C_{r}, such that nf(σ_{1}) = C′_{r}(σ_{f}) (\underline{3}), where σ_{f} is nf(Ĉ_{r}(σ′_{1})). Hence, σ_{f} ≡ Ĉ_{r}(σ′_{1}) (\underline{4}) by Property 1.5.6.i (page 51). Consequently, (2) and (4) lead to (Q) σ_{f} ≡ σ′′_{1} (\underline{5}). We have (Q) nf(σ_{1}) ˙⊏ −ᾱ C′_{r}(α) (\underline{6}) by StSh-Hyp, (3), (1), and (5). Besides, (Q) C′_{r}(α) ≡ C_{r}(α) (\underline{7}) holds since C′_{r} and C_{r} are ftv(Ĉ_{r}(σ′_{1}))-equivalent and α ∉ dom(C_{r}) ∪ dom(C′_{r}). We have the expected result, namely (6) and (7), taking σ′_{2} = C′_{r}(α). ∘ Case StSh-Up: By hypothesis, we have σ_{1} = C_{r}(∀ (β = ∀ (Q′, α_{0} = σ_{0}) σ′) σ′′), and σ_{2} = C_{r}(∀ (α_{0} = σ_{0}) ∀ (β = ∀ (Q′) σ′) σ′′) (\underline{8}). along with a bunch of sideconditions. Let σ_{a} be ∀ (β = ∀ (Q′, α_{0} = σ_{0}) σ′) σ′′. By hypothesis we have σ_{0} ∉ T , α_{0} ∈ ftv(σ′) and β ∈ ftv(σ′′), thus σ_{a} ∉ T by Property 2.1.5.i (page 67). Let θ be Ĉ_{r} and ᾱ be ftv(θ(σ_{a})). By hypothesis, C_{r} is a useful well-formed context, thus, by Lemma 2.4.5 (page 75), there exists a context C′_{r}, that is ᾱ-equivalent to C_{r}, such that nf(σ_{1}) = C′_{r}(σ′_{1}) (\underline{9}), with σ′_{1} = nf(θ(σ_{a}))). Hence, by Property 1.5.6.iii (page 51), we have σ′_{1} = θ(∀ (β = σ′′_{1}) nf(σ′′)) (\underline{10}), where σ′′_{1} is nf(∀ (Q′) ∀ (α_{0} = σ_{0}) σ′). We write θ′ for Q̂′. By definition of normal form σ′′_{1} is ∀ (Q′′) ∀ (α_{0} = nf(σ_{0})) θ′(nf(σ′)) (\underline{11}), with ∀ (Q′′) θ′(nf(σ′)) = nf(∀ (Q′) σ′) (\underline{12}). Combining (9), (10), and (11), nf(σ_{1}) is (you may take a deep breath) C′_{r}(∀ (β = ∀ (θ(Q′′)) ∀ (α_{0} = θ(nf(σ_{0}))) θθ′(nf(σ′))) θ(nf(σ′′))). In addition, all side conditions of StSh-Up are satisfied. Hence, StSh-Up can be applied: (Q) nf(σ_{1}) ˙⊏ −ᾱ C′_{r}(∀ (α_{0} = θ(nf(σ_{0}))) ∀ (β = ∀ (θ(Q′′)) θθ′(nf(σ′))) θ(nf(σ′′))).

Now, watchful readers expect a proof that C′_{r}(∀ (α_{0} = θ(nf(σ_{0}))) ∀ (β = ∀ (θ(Q′′)) θθ′(nf(σ′))) θ(nf(σ′′))) is equivalent to σ_{2}. Let σ′_{2} be the former. We get σ′_{2} ≡ C′_{r}(∀ (α_{0}= θ(σ_{0})) ∀ (β=θ(∀ (Q′) σ′)) θ(σ′′)) from (12) and Property 1.5.6.i (page 51). As for σ_{2}, we use Eq-Mono and derive σ_{2} ≡ C_{r}(∀ (α_{0} = θ(σ_{0})) ∀ (β = θ(∀ (Q′) σ′)) θ(σ′′)) from (8). Hence, σ_{2} ≡ C_{r}(σ_{3}) and σ′_{2} ≡ C′_{r}(σ_{3}), where σ_{3} is ∀ (α_{0} = θ(σ_{0})) ∀ (β = θ(∀ (Q′) σ′)) θ(σ′′). We know that C_{r} and C′_{r} are ᾱ-equivalent. Moreover, ftv(σ_{3}) = ftv(θ(ftv(σ_{a}))) = ᾱ, thus by definition of ᾱ-equivalence, we have C_{r}(σ_{3}) ≡ C′_{r}(σ_{3}), which gives σ_{2} ≡ σ′_{2}. This is the expected result.

∘ Case StSh-Alias: We have σ_{1} = C_{r}(∀ (α_{a} = σ_{a}) ∀ (Q′) ∀ (α_{b} = σ_{b}) σ′) with σ_{a} ≡ σ_{b}, and σ_{2} is C_{r}(∀ (α_{a} = σ_{a}) ∀ (Q′) ∀ (α_{b} = α_{a}) σ′). Let σ_{0} be ∀ (α_{a} = σ_{a}) ∀ (Q′) ∀ (α_{b} = σ_{b}) σ′ (\underline{13}). Let θ be Ĉ_{r} and ᾱ be ftv(θ(σ_{0})). By hypothesis, σ_{a} ∉ T and α_{a} ∈ ftv(σ′), thus σ_{0} ∉ T by Property 2.1.5.i (page 67). Besides, C_{r} is a useful wellformed context, thus by Lemma 2.4.5 (page 75), there exists a context C′_{r} which is ᾱ-equivalent to C_{r} such that nf(σ_{1}) = C′_{r}(nf(θ(σ_{0}))). By Property 1.5.6.iii (page 51), we have nf(σ_{1}) = C′_{r}(θ(nf(σ_{0}))) (\underline{14}).

Let θ′ be Q̂′. From (13), nf(σ_{0}) is of the form ∀ (α_{a} = nf(σ_{a})) ∀ (Q′′) ∀ (α_{b} = nf(σ_{b})) θ′(nf(σ′)) (\underline{15}). Consequently, from (14) and (15), nf(σ_{1}) is C′_{r}(∀ (α_{a} = θ(nf(σ_{a}))) ∀ (θ(Q′′)) ∀ (α_{b} = θ(nf(σ_{b}))) θθ′(nf(σ′))) (\underline{16}), besides, α_{a}, α_{b} ∈ ftv(θθ′(nf(σ′))) (\underline{17}) by Property 1.5.6.ii (page 51). By hypothesis σ_{a} ∉ T , hence θ(nf(σ_{a})) ∉ T (\underline{18}) by property 1.5.11.iv (page 54). Moreover σ_{a} ≡ σ_{b}, thus nf(σ_{a}) ≡ nf(σ_{b}) by Property 1.5.6.i (page 51) and R-Trans. This gives θ(nf(σ_{a})) ≡ θ(nf(σ_{b})) (\underline{19}) by Property 1.5.11.v (page 54). Consequently, from (16), (17), (18), (19), and StSh-Alias, we can derive (Q) nf(σ_{1}) ˙⊏ −ᾱ σ′_{2}, where σ′_{2} is C′_{r}(∀ (α_{a} = θ(nf(σ_{a}))) ∀ (θ(Q′′)) ∀ (α_{b} = α_{a}) θθ′(nf(σ′))).

It remains to be shown that σ_{2} ≡ σ′_{2} holds. We have σ_{2} ≡ C_{r}(∀ (α_{a} = θ(nf(σ_{a}))) ∀ (θ(Q′′)) ∀ (α_{b} = α_{a}) θθ′(nf(σ′))) using Eq-Mono* on Ĉ_{r} and Q̂′. Hence, σ_{2} ≡ C_{r}(σ_{z}) and σ′_{2} is C′_{r}(σ_{z}), where σ_{z} is ∀ (α_{a} = θ(nf(σ_{a}))) ∀ (θ(Q′′)) ∀ (α_{b} = α_{a}) θθ′(nf(σ′)). By Property 1.5.4.i (page 50), we have ftv(σ_{z}) = θ(ftv(σ_{0})), thus we get ftv(σ_{z}) = ᾱ. Hence, by definition of ᾱ-equivalence, we get C_{r}(σ_{z}) ≡ C′_{r}(σ_{z}), which leads to σ_{2} ≡ σ′_{2}. This is the expected result.

\underline{Property ii for R being ˙⊏ −ᾱ}: By hypothesis, σ_{1} ≈ σ′_{1} (\underline{1}) and (Q) σ_{1} ˙⊏ −ᾱ σ_{2} (\underline{2}) hold. We prove the result for a single commutation only, then we get the expected result by immediate induction. We assume that (1) holds by a single commutation. More precisely, let σ_{r}, σ′_{r} and C be such that

{σ_{r} = ∀ (γ = σ_{a}, β = σ_{b}) σ_{c}  σ′_{r} = ∀ (β = σ_{b}, γ = σ_{a}) σ_{c}  σ_{1} = C(σ_{r}) (\underline{3}) \atop σ′_{1} = C(σ′_{r})  β ∉ ftv(σ_{a})  γ ∉ ftv(σ_{b}) (\underline{4}).}

Since σ_{1} is in normal form, we also know that γ, β ∈ ftv(σ_{c}). We prove the result by case on the rule used to derive (2). ∘ Case StSh-Hyp: σ_{1} is of the form C_{r}(σ′) and (α = σ_{0}) ∈ Q with (Q) σ_{0} ≡ Ĉ_{r}(σ′). Since σ_{1} is in normal form, we have Ĉ_{r} = id. By (3), we have C(∀ (γ = σ_{a}, β = σ_{b}) σ_{c}) = C_{r}(σ′). By alpha-conversion, we can freely assume that γ ∉ ftv(σ_{0}). We proceed by case analysis on C and C_{r}.

Subcase C and C_{r} are disjoint: By Lemma 2.4.6 (page 76), there exists a two-hole context C^{2} such that C_{r} = C^{2}([ ], ∀ (γ = σ_{a}, β = σ_{b}) σ_{c}) and C = C^{2}(σ′, [ ]). Besides, C′_{r} = C^{2}([ ], ∀ (β = σ_{b}, γ = σ_{a}) σ_{c}) (\underline{5}) is rigid. We have σ′_{1} = C′_{r}(σ′). Let σ′_{2} be C′_{r}(α) (\underline{6}). Note also that σ_{2} is C^{2}(α, ∀ (γ = σ_{a}, β = σ_{b}) σ_{c}) (\underline{7}). By StSh-Hyp, we get (Q) σ′_{1} ˙⊏ −ᾱ σ′_{2}, and σ′_{2} ≈ σ_{2} by (6), (5), and (7). This is the expected result.

Subcase C is of the form C_{r}(C′): We have σ′ = C′(σ_{r}), (Q) σ_{0} ≡ C′(σ′_{r}), and (Q) α ≡ α. We get the expected result by StSh-Hyp.

Subcase C_{r} is of the form C(∀ (γ = C′, β = σ_{b}) σ_{c}): immediate
Subcase C_{r} is of the form C(∀ (γ = σ_{a}, β = C′) σ_{c}): immediate
Subcase C_{r} is of the form C(∀ (γ = σ_{a}, β = σ_{b}) C′): immediate

Subcase C_{r} is of the form C(∀ (γ =σ_{a}) [ ]): We must have σ_{1} = C(∀ (γ =σ_{a}, β = σ_{b}) σ_{c}) and (Q) σ_{0} ≡ ∀ (β = σ_{b}) σ_{c}. However, γ ∈ ftv(σ_{c}), thus γ ∈ ftv(∀ (β = σ_{b}) σ_{c}). Hence, by Property 1.5.4.i (page 50), we must have γ ∈ ftv(σ_{0}), which is a contradiction. Hence this case cannot occur. ∘ Case StSh-Up: σ_{1} is of the form C_{r}(∀ (α_{b}=∀ (Q′, α_{a}=σ) σ′) σ′′), with σ ∉ T , α_{a} ∈ ftv(σ′), σ′, σ′′ ∉ V (\underline{8}), α_{a} ∉ dom(Q\overline{C_{r}}Q′) (\underline{9}), ftv(σ) # dom(Q′), α_{b} ∈ ftv(σ′′) (\underline{10}), and σ_{2} is C_{r}(∀ (α_{a} = σ) ∀ (α_{b} = ∀ (Q′) σ′) σ′′). We have C(∀ (γ = σ_{a}, β = σ_{b}) σ_{c}) = C_{r}(∀ (α_{b} = ∀ (Q′, α_{a} = σ) σ′) σ′′). We proceed by case on the form of C and C_{r}:

Subcase C and C_{r} are disjoint: immediate

Subcase C is C_{r}: We have γ = α_{b} (\underline{11}), σ_{a} = ∀ (Q′, α_{a} = σ) σ′ and σ′′ = ∀ (β=σ_{b}) σ_{c} (\underline{12}) Then σ′_{1} is C_{r}(∀ (β=σ_{b}, γ=∀ (Q′, α_{a}=σ) σ′) σ_{c}). We have γ ∈ ftv(σ_{c}) by (10), (11), (12) and (4). Besides, σ_{c} ∉ V by (12) and (8) and α_{a} ∉ ftv(σ_{c}) by (12) and (9). Hence, StSh-Up applies and gives (Q) σ′_{1} ˙⊏ −ᾱ C_{r}(∀ (β=σ_{b}, α_{a}=σ, γ=∀ (Q′) σ′) σ_{c}). We get the expected result by observing that C_{r}(∀ (β =σ_{b}, α_{a} =σ, γ =∀ (Q′) σ′) σ_{c}) is equivalent to σ_{2}.

Subcase C is of the form C_{r}(C′): immediate. Subcase C_{r} is of the form C(C′): immediate.

∘ Case StSh-Alias: all subcases are easy.

\underline{Property i for R being ˙⊏}: By case on the rule used to derive (Q) σ_{1} ˙⊏ σ_{2}. Cases S-Hyp, S-Up and S-Alias are similar to cases StSh-Hyp, StSh-Up, and StSh-Alias of Property i. ∘ Case S-Nil: We have σ_{1} = C_{f}(⊥), σ_{2} = C_{f}(σ) and σ is closed by hypothesis. By Lemma 2.4.5 (page 75), there exists C′_{r}, ∅-equivalent to C_{r}, such that nf(σ_{1}) = C′_{r}(⊥). Consequently, nf(σ_{1}) ˙⊏ C′_{r}(σ) holds by S-Nil. Additionally, we have C_{r}(σ) ≡ C′_{r}(σ) by definition of ∅-equivalence. ∘ Case S-Rigid: We have σ_{1} = C_{f}(∀ (α ≥ σ′) σ) and σ_{2} = C_{f}(∀ (α = σ′) σ). By hypothesis, σ ∉ V, σ′ ∉ T (\underline{13}) and α ∈ ftv(σ) (\underline{14}). Let σ_{0} be ∀ (α ≥ σ′) σ, ᾱ be ftv(θ(σ_{0})) and θ be Ĉ_{r}. By Property 2.1.5.i (page 67) applied to (13) and (14), we have σ_{0} ∉ T . By Lemma 2.4.5 (page 75), there exists C′_{r}, ᾱ-equivalent to C_{r}, such that nf(σ_{1}) = C′_{r}(nf(θ(σ_{0}))). Hence, by Property 1.5.6.iii (page 51), nf(σ_{1}) is C′_{r}(θ(∀ (α ≥ nf(σ′)) nf(σ))), that is, C′_{r}(∀ (α ≥ θ(nf(σ′))) θ(nf(σ))). By Rule S-Rigid, we can derive (Q) nf(σ_{1}) ˙⊏ C′_{r}(σ′_{0}), where σ′_{0} is ∀ (α = θ(nf(σ′))) θ(nf(σ)). We note that σ′_{0} is θ(nf(∀ (α = σ′) σ)). Consequently, σ_{2} ≡ C_{r}(σ′_{0}) holds by by Property 1.5.6.i (page 51) and by Rule Eq-Mono. We have ftv(σ′_{0}) = θ(ftv(σ_{0})) by Property 1.5.6.ii (page 51), thus ftv(σ′_{0}) = ᾱ. Hence, by definition of ᾱ-equivalence, C_{r}(σ′_{0}) ≡ C′_{r}(σ′_{0}).

\underline{Property ii for R being ˙⊏}: By case on the rule used to derive (Q) σ_{1} ˙⊏ σ_{2}. Cases S-Hyp, S-Up and S-Alias are similar to cases StSh-Hyp, StSh-Up, and StSh-Alias of Property ii. ∘ Case S-Nil: immediate. ∘ Case S-Rigid: immediate.

Proof of Lemma 2.7.8

\underline{Directly,} we assume that we have

{Q̂(nf(σ_{2})) ∉ ϑ (\underline{1})  (Q) σ_{1} ⊑ σ_{2} (\underline{2})  ∀ (Q) σ_{1}/ = ∀ (Q) σ_{2}/ (\underline{3}) \atop X ∉ w(σ_{1}) − w(σ_{2}) (\underline{4})}

By Lemma 2.5.5 and (2), we have a derivation of (Q) σ_{1} ⊑ᾱ σ_{2} (\underline{5}). By Lemma 2.5.6, this derivation is restricted. The proof is by induction on the derivation of (5). ∘ Case I-Abstract’: The premise is (Q) σ_{1} ⊏ −ᾱ σ_{2} and we conclude by Lemma 2.5.5. ∘ Case R-Trans: The premises are (Q) σ_{1} ⊑ᾱ σ′_{1} (\underline{6}) and (Q) σ′_{1} ⊑ᾱ σ_{2} (\underline{7}). By hypothesis (3), ∀ (Q) σ_{1}/ = ∀ (Q) σ_{2}/ holds. Hence, ∀ (Q) σ_{1}/ = ∀ (Q) σ′_{1}/ = ∀ (Q) σ_{2}/ (\underline{8}) holds (see case R-Trans in the proof of Property 2.7.6.i (page 94) for details). Besides, by Property 2.7.6.i (page 94), (6), and (7), we have w(σ_{1}) ⩾ w(σ′_{1}) ⩾ w(σ_{2}) (\underline{9}). By Property 2.7.2.iv (page 87), (4), and (9), we get X ∉ w(σ_{1})−w(σ′_{1}) (\underline{10}) and X ∉ w(σ′_{1}) − w(σ_{2}) (\underline{11}). Now, by hypothesis (1), we have Q̂(nf(σ_{2})) ∉ ϑ. Assume Q̂(nf(σ′_{1})) ∈ ϑ holds. By definition, this means that we have Q̂(nf(σ′_{1})) = α (\underline{12}) for some type variable α. If, by a way of contradiction, α ∈ dom(Q̂) holds, then, by wellformedness of Q, we must have α ∉ codom(Q̂), which implies α ∉ Q̂(nf(σ′_{1})), and this is a contradiction with (12). Consequently, we have α ∉ dom(Q̂) (\underline{13}), that is, Q̂(α) = α. Then (12) gives Q̂(nf(σ′_{1})) ≡ Q̂(α) (\underline{14}) by Eq-Refl. By Corollary 1.5.10 and (14), we get (Q) nf(σ′_{1}) ≡ α. By Property 1.5.6.i and R-Trans, this gives (Q) σ′_{1} ≡ α (\underline{15}). Hence, by Lemma 2.1.6, (7), and (15), we have (Q) σ′_{1} ≡ σ_{2} (\underline{16}). By R-Trans, (16), and (15), we get (Q) σ_{2} ≡ α. Consequently, Q̂(nf(σ_{2})) ∈ ϑ holds by Corollary 1.5.10 and (13), which is a contradiction with (1). Hence, we have Q̂(nf(σ′_{1})) ∉ V (\underline{17}). By induction hypothesis, (6), (8), (10), and (17), we have (Q) σ_{1} ⊏ − σ′_{1} (\underline{18}). By induction hypothesis, (7), (8), (11), and (1), we have (Q) σ′_{1} ⊏ − σ_{2} (\underline{19}). By R-Trans, (18), and (19), we get (Q) σ_{1} ⊏ − σ_{2}. This is the expected result. ∘ Case R-Context-R: We have σ_{1} = ∀ (α ⋄ σ) σ′_{1} and σ_{2} = ∀ (α ⋄ σ) σ′_{2}. The premise is (Q, α ⋄ σ) σ′_{1} ⊑^{ᾱ∪\{α\}} σ′_{2} (\underline{20}). By hypothesis (3), we have ∀ (Q, α ⋄ σ) σ′_{1}/ = ∀ (Q, α ⋄ σ) σ′_{2}/ (\underline{21}). Let θ′ be { \atop Q, α ⋄ σ} and θ be Q̂. We proceed by case analysis.

Subcase σ ∈ T : We have σ ≡ τ by Property 1.5.11.ii (page 54). By definition, we have w(σ_{1}) = w(σ′_{1}) and w(σ_{2}) = w(σ′_{2}). Hence, we get X ∉ w(σ′_{1}) − w(σ′_{2}) (\underline{22}) from (4). From (1), we have θ(nf(σ′_{2})[α = τ]) ∉ V, which can also be written θ′(nf(σ′_{2})) ∉ V (\underline{23}). By induction hypothesis, (20), (21), (22), and (23), we get (Q, α ⋄ σ) σ′_{1} ⊏ − σ′_{2}. We conclude by R-Context-R.

In the following, we assume σ ∉ T , which implies θ′ = θ. Besides, if α ∈ ftv(σ′_{2}), then α ∈ ftv(σ′_{1}) by Lemma 2.5.7 (page 83), (20), and (21), and α ∉ codom(Q̂)). Conversely, if α ∈ ftv(σ′_{1}), then α ∈ ftv(σ′_{2}) by Lemma 2.1.4 (page 67). Hence, we know that α ∈ ftv(σ′_{2}) if and only if α ∈ ftv(σ′_{1}) (\underline{24}).

Subcase nf(σ′_{1}) = α: Then σ′_{2} ≡ α by Property 2.1.7.ii (page 68), (24), and (20). Hence, σ_{1} ≡ σ ≡ σ_{2} holds by Eq-Var, and we have (Q) σ_{1} ⊏ − σ_{2} by A-Equiv.

Subcase nf(σ′_{2}) = α: Then σ′_{1} ≡ α by Property 2.1.7.ii (page 68), and we also have (Q) σ_{1} ≡ σ_{2}. In the following, we assume that nf(σ′_{1}) ≠ α and nf(σ′_{2}) ≠ α (\underline{25}) hold.

Otherwise, let x be 1 if α ∈ ftv(σ′_{1}) and 0 otherwise. Let A be X ⋆ ⋄. We have w(σ_{1}) = x × A × w_{A}(σ) + w(σ′_{1}) and w(σ_{2}) = x × A × w_{A}(σ) + w(σ′_{2}). Hence, w(σ_{1}) − w(σ_{2}) = w(σ′_{1}) − w(σ′_{2}), thus X ∉ w(σ′_{1}) − w(σ′_{2}) (\underline{26}) by (4). We have θ(nf(σ_{2})) ∉ V from (1), and nf(σ′_{2}) is not α from (25). Thus we have θ(nf(σ′_{2})) ∉ V (\underline{27}) (otherwise, σ′_{2} would be equivalent to a type variable β, and ∀ (α ⋄ σ) σ′_{2} ≡ β would also hold, which is a contradiction with (1)). By induction hypothesis, (20), (21), (26), and (27), we get (Q, α ⋄ σ) σ′_{1} ⊏ − σ′_{2}. Then (Q) σ_{1} ⊏ − σ_{2} holds by R-Context-R. This is the expected result. ∘ Case I-Context-L’: We have σ_{1} = ∀ (α ≥ σ′_{1}) σ and σ_{2} = ∀ (α ≥ σ′_{2}) σ. The premise is (Q) σ′_{1} ⊑ᾱ σ′_{2}. We have ∀ (Q) σ_{1}/ = ∀ (Q) σ_{2}/ (\underline{1}) by hypothesis, and nf(σ) ≠ α, and α ∈ ftv(σ) (\underline{2}) by Lemma 2.5.6. By Property 1.3.3.i (page 40), (1), and (2), we get ∀ (Q) σ′_{1}/ = ∀ (Q) σ′_{2}/ (\underline{3}). We have w(σ_{1}) = X × w(σ′_{1}) + w(σ) and w(σ_{2}) = X×w(σ′_{2})+w(σ). Hence, w(σ_{1})−w(σ_{2}) = X×(w(σ′_{1})−w(σ′_{2})). By hypothesis, we have X ∉ w(σ_{1}) − w(σ_{2}). Consequently, we must have w(σ′_{1}) − w(σ′_{2}) = 0, that is, w(σ′_{1}) = w(σ′_{2}) (\underline{4}). By Property 2.7.6.ii (page 94), (3), and (4), we get (Q) σ′_{1} ≡ σ′_{2}. Hence, (Q) σ_{1} ≡ σ_{2} holds by R-Context-L, and (Q) σ_{1} ⊏ − σ_{2} holds by A-Equiv. ∘ Case I-Bot’: We have σ_{1} = ⊥. Hence, (∀ (Q) σ_{1})/ϵ = ⊥. By Lemma 2.5.6, we have σ_{2} ∉ V, and σ_{2} is not ⊥. Hence, σ_{2}/ϵ is a type constructor g. This is a contradiction with the hypothesis ∀ (Q) σ_{1}/ = ∀ (Q) σ_{2}/. Hence, this case cannot occur. ∘ Case I-Hyp’: We have (α_{1} ≥ σ_{1}) ∈ Q, and σ_{2} is α_{1}. By Lemma 2.5.6, we have σ_{1} ∉ T , thus we have Q̂(nf(σ_{2})) = α_{1} ∈ V, which is a contradiction (by hypothesis). Hence, this case cannot occur. ∘ Case I-Up’: We have σ_{1} = ∀ (α_{1}≥∀ (α_{2}⋄σ′′) σ′) σ and σ_{2} = ∀ (α_{2}⋄σ′′) ∀ (α_{1}≥σ′) σ. By hypothesis, we have X ∉ w(σ_{1}) − w(σ_{2}). By restrictions of Lemma 2.5.6, we have α_{1} ∈ ftv(σ), nf(σ) ≠ α_{1}, α_{2} ∈ ftv(σ′), σ′′ ∉ T (\underline{5}), and nf(σ′) ≠ α_{2}. Let A be X ⋆ ⋄. We have w(σ_{1}) = w(σ) + X × (w(σ′) + A × w_{A}(σ′′)). We have w(σ_{2}) = w(σ) + X × w(σ′) + A × w_{A}(σ′′). Hence, w(σ_{1}) − w(σ_{2}) = A × w_{A}(σ′′) × (X − 1). By Lemma 2.7.4 (page 92) and (5), w_{A}(σ′′) ≠ 0, thus X ∈ w(σ_{1}) − w(σ_{2}), which is a contradiction (by hypothesis). Hence, this case cannot occur. ∘ Case I-Alias’: We have σ_{1} = ∀ (α_{1} ≥ σ′) ∀ (α_{2} ≥ σ′) σ and σ_{2} = ∀ (α_{1} ≥ σ′) ∀ (α_{2} = α_{1}) σ. By restrictions of Lemma 2.5.6, we have α_{1} and α_{2} in ftv(σ), and σ′ ∉ T (\underline{6}). By definition, we have w(σ_{1}) = w(σ) + 2 × X × w(σ′) and w(σ_{2}) = w(σ) + X × w(σ′). Hence w(σ_{1}) − w(σ_{2}) = X × w(σ′). By Lemma 2.7.4 (page 92) and (6), this implies X ∈ w(σ_{1}) − w(σ_{2}), which is a contradiction. Hence, this case cannot occur. ∘ Case I-Rigid’: We have σ_{1} = ∀ (α ≥ σ′) σ and σ_{2} = ∀ (α = σ′) σ. By restrictions of Lemma 2.3.1, we have σ′ not in T (\underline{7}), α ∈ ftv(σ), and nf(σ) ≠ α. Hence, w(σ_{1}) = w(σ) + X × w(σ′) and w(σ_{2}) = w(σ) + Y × w_{Y} (σ′). We get w(σ_{1}) − w(σ_{2}) = Xw(σ′) − Y w_{Y} (σ′) (\underline{8}). Since X ∉ Y w_{Y} (σ′), the X-degree of Y w_{Y} (σ′) is 0. Since w(σ′) is not 0 by Lemma 2.7.4 (page 92) and (7), the X-degree of Xw(σ′) is not zero. Hence, X ∈ Xw(σ′) − Y w_{Y} (σ′), that is, X ∈ w(σ_{1}) − w(σ_{2}) by (8). This is a contradiction. Hence, this case cannot occur.

\underline{Conversely,} we assume that (Q) σ_{1} ⊏ − σ_{2} holds. By Property 2.1.3.i, we have ∀ (Q) σ_{1}/ = ∀ (Q) σ_{2}/. By I-Abstract, we have (Q) σ_{1} ⊑ σ_{2}. It remains only to be shown that X ∉ w(σ_{1}) − w(σ_{2}) (\underline{1}) holds. By Lemma 2.5.5 we have a derivation of (Q) σ_{1} ⊏ −ᾱ σ_{2} (\underline{2}). By Lemma 2.5.6, this derivation is restricted. We prove (1) by induction on the derivation of (2). ∘ Case A-Equiv’: By Lemma 2.7.5 (page 93), we have w_{X}(σ_{1}) − w_{X}(σ_{2}) = 0. ∘ Case R-Trans: The premises are (Q) σ_{1} ⊏ −ᾱ σ′_{1} (\underline{3}) and (Q) σ′_{1} ⊏ −ᾱ σ_{2} (\underline{4}). If Q̂(nf(σ′_{1})) is in V, then (Q) σ_{2} ≡ σ′_{1} holds by Lemma 2.1.6, thus Q̂(nf(σ_{2})) is in V by Lemma 1.5.9, which is a contradiction. Hence, Q̂(nf(σ′_{1})) ∉ V, and we get X ∉ w_{X}(σ_{1})−w_{X}(σ′_{1}) by induction hypothesis on (3), as well as X ∉ w_{X}(σ′_{1})−w_{X}(σ_{2}) by induction hypothesis on (4). This gives X ∉ w_{X}(σ_{1}) − w_{X}(σ_{2}) by addition. ∘ Case A-Hyp’: We have (α = σ_{1}) ∈ Q, and σ_{2} is α. By Lemma 2.5.6, σ_{1} ∉ T , that is, α ∉ dom(Q̂). Hence, Q̂(σ_{2}) = Q̂(α) = α. This is a contradiction. This case is not possible. ∘ Case R-Context-R: We have σ_{1} = ∀ (α⋄σ) σ′_{1} and σ_{2} = ∀ (α⋄σ) σ′_{2}. The premise is (Q, α ⋄ σ) σ′_{1} ⊏ −^{ᾱ∪\{α\}} σ′_{2} (\underline{5}). We proceed by case analysis.

Subcase σ ∈ T : Then w(σ_{1}) = w(σ′_{1}) and w(σ_{2}) = w(σ′_{2}). By induction hypothesis on (5), we get X ∉ w(σ′_{1}) − w(σ′_{2}), that is X ∉ w(σ_{1}) − w(σ_{2}).

In the following, we assume that σ ∉ T . By Lemmas 2.5.7 (page 83) and 2.1.4 (page 67), we have α ∈ ftv(σ′_{1}) if and only if α ∈ ftv(σ′_{2}) (\underline{6}).

Subcase σ′_{2} ∈ V and α ∈ ftv(σ′_{2}): Necessarily nf(σ′_{2}) = α. Besides, we have α ∈ ftv(σ′_{1}) from (6). Hence, σ′_{1} ≡ α holds by Property 2.1.7.ii (page 68). Consequently, σ_{1} ≡ σ_{2} and w(σ_{1}) − w(σ_{2}) = 0.

Subcase σ′_{2} ∈ V and α ∉ ftv(σ′_{2}): Then α ∉ ftv(σ′_{1}) by (6). Hence, w(σ_{1}) = w(σ′_{1}) (\underline{7}) and w(σ_{2}) = w(σ′_{2}) (\underline{8}). Besides, we have σ_{2} ≡ σ′_{2} by Eq-Free. Hence, Q̂(nf(σ′_{2})) ≈ Q̂(nf(σ_{2})) holds by Lemma 1.5.9. This implies Q̂(nf(σ′_{2})) ∉ ϑ. We conclude by induction hypothesis on (5), (7), and (8).

In the following, we assume that σ′_{2} ∉ V.

Subcase σ′_{1} ≡ α: By Lemma 2.1.6 and (5), we get (Q, α ⋄ σ) σ′_{1} ≡ σ′_{2}, thus (Q) σ_{1} ≡ σ_{2} holds by R-Context-R, and w(σ_{1})−w(σ_{2}) = 0 by Lemma 2.7.5 (page 93).

Otherwise let x be 1 if α ∈ ftv(σ′_{1}) and 0 otherwise. Let A be X ⋆ ⋄. We have w(σ_{1}) = w(σ′_{1}) + x × A × w_{A}(σ) and w(σ_{2}) = w(σ′_{2}) + x × A × w_{A}(σ). Hence, w(σ_{1}) − w(σ_{2}) = w(σ′_{1}) − w(σ′_{2}) and we conclude directly by induction hypothesis on (5). ∘ Case A-Context-L’: We have σ_{1} = ∀ (α = σ′_{1}) σ and σ_{2} = ∀ (α = σ′_{2}) σ. By Lemma 2.5.6, we have α ∈ ftv(σ). By definition, we have w(σ_{1}) = w_{Y} (σ′_{1}) × Y + w(σ) and w(σ_{2}) = w_{Y} (σ′_{2}) × Y + w(σ). Hence, w(σ_{1}) − w(σ_{2}) = (w_{Y} (σ′_{1}) − w_{Y} (σ′_{2})) × Y, thus X ∉ w(σ_{1}) − w(σ_{2}). ∘ Case A-Alias’: We have σ_{1} = ∀ (α_{1} = σ) ∀ (α_{2} = σ) σ′, and α_{1} and α_{2} are in ftv(σ′). Moreover, σ is not in T . We have w(σ_{1}) = w(σ′) + 2 × Y × w_{Y} (σ) and w(σ_{2}) = w(σ′) + Y × w_{Y} (σ). Hence, w(σ_{1}) − w(σ_{2}) = Y × w_{Y} (σ), thus X ∉ w(σ_{1}) − w(σ_{2}). ∘ Case A-Up’: We have σ_{1} = ∀ (α_{1} = ∀ (α_{2} = σ′′) σ′) σ and σ_{2} = ∀ (α_{2} = σ′′) ∀ (α_{1} = σ′) σ. Moreover, α_{1} ∈ ftv(σ), α_{2} ∈ ftv(σ′), nf(σ) is not α_{1}, nf(σ′) is not α_{2}, and σ′′ is not in T . We have w(σ_{1}) = w(σ) + Y × (w_{Y} (σ′) + Y × w_{Y} (σ′′)) and w(σ_{2}) = w(σ)+Y ×w_{Y} (σ′)+Y ×w_{Y} (σ′′). Hence, w(σ_{1})−w(σ_{2}) = Y w_{Y} (σ′′)×(Y −1). We see that X ∉ w(σ_{1}) − w(σ_{2}).

Proof of Property 2.7.9

\underline{Property i}: It is shown by structural induction on σ. ∘ Case τ: We have P (σ) = 0 and #σ ⩾ n_{α}, thus the result holds. ∘ Case ⊥: We have P (σ) = 1, #σ = 1, and σ is closed, thus the result holds. ∘ Case ∀ (α⋄σ_{1}) σ_{2}, with nf(σ_{2}) = α: By definition we have P (σ) = P (σ_{1}), n_{σ} = n_{σ_{1}}, and #σ = #σ_{1}, thus we get the result by induction hypothesis on σ_{1}. ∘ Case ∀ (α⋄σ_{1}) σ_{2}, with α ∉ ftv(σ_{2}): By definition we have P (σ) = P (σ_{2}), n_{σ} = n_{σ_{2}}, and #σ = #σ_{2}, thus we get the result by induction hypothesis on σ_{2}. ∘ Case ∀ (α ⋄ σ_{1}) σ_{2} (other cases): By definition, P (σ) is P (σ_{2}) + X × P (σ_{1}). By induction hypothesis, the coefficients of P (σ_{1}) are bounded by #σ_{1} − n_{σ_{1}}, and the coefficients of P (σ_{2}) are bounded by #σ_{2} − n_{σ_{2}}. Hence, the coefficients of P (σ) are bounded by #σ_{1} + #σ_{2} − n_{σ_{1}} − n_{σ_{2}}. Since ftv(σ) = ftv(σ_{1}) ∪ ftv(σ_{2}) − {α}, and α ∈ ftv(σ_{2}), we have n_{σ} ⩽ n_{σ_{1}} + n_{σ_{2}} − 1. Consequently, −n_{σ_{1}} − n_{σ_{2}} ⩽ −n_{σ} − 1 holds. Hence, we have #σ_{1} + #σ_{2} − n_{σ_{1}} − n_{σ_{2}} ⩽ #σ_{1} + #σ_{2} − n_{σ} − 1, thus the coefficients of P (σ) are bounded by #σ_{1} + #σ_{2} − n_{σ} − 1. Let k_{α} be the number of occurrences of α in σ_{2} (that is, the cardinal of the set of all u such that σ_{2}/u = α). We have #σ = #σ_{2} − k_{α} + k_{α} × #σ_{1}. Hence, #σ = #σ_{2} + k_{α} × (#σ_{1} − 1). Since α ∈ ftv(σ_{2}), we have k_{α} ⩾ 1, thus #σ ⩾ #σ_{2} + #σ_{1} − 1 (\underline{1}), that is #σ_{1} + #σ_{2} ⩽ #σ + 1. Since all the coefficients of P (σ) are bounded by #σ_{1} + #σ_{2} − n_{σ} − 1, they are also bounded by #σ − n_{σ}, which is the expected result.

\underline{Property ii}: It is shown by structural induction on σ. All cases are straightforward, except the last one: ∘ Case ∀ (α ⋄ σ_{1}) σ_{2}, when σ_{2} ≢ α and α ∈ ftv(σ_{2}). By definition, P (σ) = P (σ_{2}) + X × P (σ_{1}), thus d(σ) = max(d(σ_{2}), d(σ_{1}) + 1). We have d(σ_{2}) ⩽ #σ_{2} by induction hypothesis as well as d(σ_{1}) ⩽ #σ_{1}. Hence, d(σ) ⩽ max(#σ_{2}, #σ_{1} + 1) (\underline{2}). Moreover, as shown above (1), we have #σ ⩾ #σ_{2} + #σ_{1} − 1 (\underline{3}). Additionally, we have #σ_{2} ⩽ #σ_{2} + #σ_{1} − 1 (\underline{4}). Since σ_{2} ≢ α, and α ∈ ftv(σ_{2}), we must have #σ_{2} ⩾ 2 by Property 2.1.5.ii (page 67). Hence, #σ_{1} + 1 ⩽ #σ_{1} + #σ_{2} − 1 (\underline{5}). As a consequence of (4) and (5), we have max(#σ_{2}, #σ_{1}+1) ⩽ #σ_{2}+#σ_{1}−1, thus max(#σ_{2}, #σ_{1}+1) ⩽ #σ holds by (3). Finally, we get d(σ) ⩽ #σ by (2).

Proof of Property 2.8.1

\underline{Property i}: Intuitively, this proof is quite long because we have to consider many critical pairs. Two rules can be used to derive (Q) σ_{1} ˙⊏ −ᾱ σ_{2}, namely StSh-Up and StSh-Alias (note that the prefix is unconstrained). Similarly, two rules can be used to derive (Q) σ_{1} ˙⊏ −ᾱ σ_{3}. By symmetry, this makes three cases to consider:

∘ Case StSh-Up and StSh-Up: We have

σ_{1} = C_{r}(∀ (β =∀ (Q_{1}) ∀ (α=σ_{a}) σ_{b}) σ_{c}) (\underline{1}) σ_{2} = C_{r}(∀ (α=σ_{a}) ∀ (β =∀ (Q_{1}) σ_{b}) σ_{c})

σ_{1} = C′_{r}(∀ (β′ = ∀ (Q_{2}) ∀ (α′ = σ′_{a}) σ′_{b}) σ′_{c}) (\underline{2})
σ_{3} = C′_{r}(∀ (α′ = σ′_{a}) ∀ (β′ = ∀ (Q_{2}) σ′_{b}) σ′_{c})

Besides, the premises give the following hypotheses (\underline{3}):

β ∈ ftv(σ_{c})  β′ ∈ ftv(σ′_{c})  α ∈ ftv(σ_{b})  α′ ∈ ftv(σ′_{b})  σ_{b}, σ′_{b}, σ_{c}, σ′_{c} ∉ V
σ_{a}, σ′_{a} ∉ T  α ∉ dom(Q\overline{C_{r}}Q_{1})  α′ ∉ dom(Q\overline{C_{r}}Q_{2})

We proceed by case analysis on C_{r} and C′_{r}.

Subcase C_{r} = C′_{r}: Then from (1) and (2), we get ∀ (Q_{2}) ∀ (α′ =σ′_{a}) σ′_{b} = ∀ (Q_{1}) ∀ (α = σ_{a}) σ_{b}. If α is α′, we have σ_{3} = σ_{2}, thus we get the result by taking σ_{4} = σ_{2}. Otherwise, with no loss of generality, we can freely assume that α ∈ dom(Q_{2}). Hence, we have σ_{1} of the form C_{r}(∀ (β = ∀ (Q_{a}, α = σ_{a}, Q_{b}, α′ = σ′_{a}) σ′_{b}) σ_{c}), σ_{2} of the form C_{r}(∀ (α = σ_{a}) ∀ (β = ∀ (Q_{a}Q_{b}, α′ = σ′_{a}) σ′_{b}) σ_{c}, and σ_{3} of the form C_{r}(∀ (α′ = σ′_{a}) ∀ (β = ∀ (Q_{a}, α=σ_{a}, Q_{b}) σ′_{b}) σ_{c}. Then taking σ_{4} = C_{r}(∀ (α=σ_{a}, α′=σ′_{a}) ∀ (β=∀ (Q_{a}Q_{b}) σ′_{b}) σ_{c}), we can derive (Q) σ_{2} ˙⊏ −ᾱ σ_{4} (\underline{4}) and (Q) σ_{3} ˙⊏ −ᾱ σ_{4} (\underline{5}) by StSh-Up. The premises of (4) and (5) are ensured by (3).

Subcase C_{r} and C′_{r} disjoint: By Lemma 2.4.6 (page 76), there exists a twohole context C^{2} such that C_{r} = C^{2}([ ], ∀ (β′ = ∀ (Q_{2}) ∀ (α′ = σ′_{a}) σ′_{b}) σ′_{c}) and C′_{r} = C^{2}(∀ (β = ∀ (Q_{1}) ∀ (α = σ_{a}) σ_{b}) σ_{c}, [ ]). Then taking σ_{4} = C^{2}(∀ (α = σ_{a}) ∀ (β = ∀ (Q_{1}) σ_{b}) σ_{c}, ∀ (α′ = σ′_{a}) ∀ (β′ = ∀ (Q_{2}) σ′_{b}) σ′_{c}) gives the expected result.

Subcase C_{r} and C′_{r} nested: without loss of generality, we can freely assume that C′_{r} is of the form C_{r}(C). Hence, we have

σ_{1} = C_{r}(∀ (β =∀ (Q_{1}) ∀ (α=σ_{a}) σ_{b}) σ_{c}) (\underline{6}) σ_{2} = C_{r}(∀ (α=σ_{a}) ∀ (β =∀ (Q_{1}) σ_{b}) σ_{c})

σ_{1} = C_{r}(C(∀ (β′ = ∀ (Q_{2}) ∀ (α′ = σ′_{a}) σ′_{b}) σ′_{c})) (\underline{7})
σ_{3} = C_{r}(C(∀ (α′ = σ′_{a}) ∀ (β′ = ∀ (Q_{2}) σ′_{b}) σ′_{c}))

From (6) and (7), we get C(∀ (β′ = ∀ (Q_{2}) ∀ (α′ = σ′_{a}) σ′_{b}) σ′_{c}) = ∀ (β = ∀ (Q_{1}) ∀ (α = σ_{a}) σ_{b}) σ_{c}. We have six choices for C:

• C is of the form ∀ (β = ∀ (Q_{1}) ∀ (α = σ_{a}) σ_{b}) C′. We get the expected solution by taking σ_{4} = C_{r}(∀ (α = σ_{a}) ∀ (β = ∀ (Q_{1}) σ_{b}) C′(∀ (α′ = σ′_{a}) ∀ (β′ = ∀ (Q_{2}) σ′_{b}) σ′_{c}))

• C is of the form ∀ (β = ∀ (Q′) [ ]) σ_{c} and dom(Q′) ⊂ dom(Q_{1}): Then σ′_{c} is ∀ (Q′′) ∀ (α = σ_{a}) σ_{b}. We get the expected result by taking σ_{4} = C_{r}(∀ (α = σ_{a}) ∀ (β = ∀ (Q′) ∀ (α′ = σ′_{a}) ∀ (β′ = ∀ (Q_{2}) σ′_{b}) ∀ (Q′′) σ_{b}) σ_{c}).

• C is of the form ∀ (β = ∀ (Q_{1}) [ ]) σ_{c}: Then β′ is α. We get the expected result by taking σ_{4} = C_{r}(∀ (α′ = σ′_{a}) ∀ (α = ∀ (Q_{2}) σ′_{b}) ∀ (β = ∀ (Q_{1}) σ′_{c}) σ_{c}).

• C is of the form ∀ (β = ∀ (Q_{a}) ∀ (γ = C′) ∀ (Q_{b}) ∀ (α = σ_{a}) σ_{b}) σ_{c}: We get the expected solution by taking σ_{4} = C_{r}(∀ (α = σ_{a}) ∀ (β = ∀ (Q_{a}) ∀ (γ = C′(∀ (α′ = σ′_{a}) ∀ (β′ = ∀ (Q_{2}) σ′_{b}) σ′_{c})) ∀ (Q_{b}) σ_{b}) σ_{c})

• C is of the form ∀ (β = ∀ (Q_{1}) ∀ (α = C′) σ_{b}) σ_{c}: We get the expected solution by taking σ_{4} = C_{r}(∀ (α = C′(∀ (α′ = σ′_{a}) ∀ (β′ = ∀ (Q_{2}) σ′_{b}) σ′_{c})) ∀ (β = ∀ (Q_{1}) σ_{b}) σ_{c})

• C is of the form ∀ (β = ∀ (Q_{1}) ∀ (α = σ_{a}) C′) σ_{c}: We get the expected solution by taking σ_{4} = C_{r}(∀ (α = σ_{a}) ∀ (β = ∀ (Q_{1}) C′(∀ (α′ = σ′_{a}) ∀ (β′ = ∀ (Q_{2}) σ′_{b}) σ′_{c})) σ_{c})

∘ Case StSh-Up and StSh-Alias: We have

{σ_{1} = C_{r}(∀ (β = ∀ (Q_{1}) ∀ (α = σ_{a}) σ_{b}) σ_{c}) σ_{1} = C′_{r}(∀ (α_{1} = σ′_{1}) ∀ (Q′) ∀ (α_{2} = σ′_{2}) σ′′_{1}) \atop σ_{2} = C_{r}(∀ (α = σ_{a}) ∀ (β = ∀ (Q_{1}) σ_{b}) σ_{c}) σ_{3} = C′_{r}(∀ (α_{1} = σ′_{1}) ∀ (Q′) ∀ (α_{2} = α_{1}) σ′′_{1})}

and by hypothesis, σ′_{1} ≡ σ′_{2}. We proceed by case analysis on C_{r} and C′_{r}.

Subcase C_{r} = C′_{r}: then, β = α_{1}, thus we have σ_{1} = C_{r}(∀ (β = ∀ (Q_{1}) ∀ (α = σ_{a}) σ_{b}) σ_{c}) σ_{1} = C_{r}(∀ (β = σ′_{1}) ∀ (Q′) ∀ (α_{2} = σ′_{2}) σ′′_{1}) σ_{2} = C_{r}(∀ (α = σ_{a}) ∀ (β = ∀ (Q_{1}) σ_{b}) σ_{c}) σ_{3} = C_{r}(∀ (β = σ′_{1}) ∀ (Q′) ∀ (α_{2} = β) σ′′_{1})

σ′_{1} = ∀ (Q_{1}) ∀ (α = σ_{a}) σ_{b} σ_{c} = ∀ (Q′) ∀ (α_{2} = σ′_{2}) σ′′_{1}

Taking σ_{4} = C_{r}(∀ (α = σ_{a}) ∀ (β = ∀ (Q_{1}) σ_{b}) ∀ (Q′) ∀ (α_{2} = β) σ′′_{1}) is appropriate.

Subcase C_{r} and C′_{r} are disjoint: by Lemma 2.4.6 (page 76), there exists a two-hole context C^{2} such that C_{r} = C^{2}([ ], ∀ (α_{1} = σ′_{1}) ∀ (Q′) ∀ (α_{2} = σ′_{2}) σ′′_{1}) and C′_{r} = C^{2}(∀ (β = ∀ (Q_{1}) ∀ (α = σ_{a}) σ_{b}) σ_{c}, [ ]). Then taking σ_{4} = C^{2}(∀ (α = σ_{a}) ∀ (β = ∀ (Q_{1}) σ_{b}) σ_{c}, ∀ (α_{1} = σ′_{1}) ∀ (Q′) ∀ (α_{2} = α_{1}) σ′′_{1}) is appropriate.

Subcase C_{r} is of the form C′_{r}(C): we have σ_{1} = C′_{r}(C(∀ (β = ∀ (Q_{1}) ∀ (α = σ_{a}) σ_{b}) σ_{c}))

σ_{1} = C′_{r}(∀ (α_{1} = σ′_{1}) ∀ (Q′) ∀ (α_{2} = σ′_{2}) σ′′_{1})
σ_{2} = C′_{r}(C(∀ (α = σ_{a}) ∀ (β = ∀ (Q_{1}) σ_{b}) σ_{c}))
σ_{3} = C′_{r}(∀ (α_{1} = σ′_{1}) ∀ (Q′) ∀ (α_{2} = α_{1}) σ′′_{1})

We have five choices for C:

• C = ∀ (α_{1} = C′) ∀ (Q′) ∀ (α_{2} = σ′_{2}) σ′′_{1}: we get the expected solution by taking σ_{4} = C′_{r}(∀ (α_{1} = C′(∀ (α = σ_{a}) ∀ (β = ∀ (Q_{1}) σ_{b}) σ_{c})) ∀ (Q′) ∀ (α_{2} = α_{1}) σ′′_{1})

• C = ∀ (α_{1} = σ′_{1}) ∀ (Q_{a}) [ ] with α_{2} ∉ dom(Q_{a}). We have ∀ (Q_{a}) ∀ (β = ∀ (Q_{1}) ∀ (α = σ_{a}) σ_{b}) σ_{c} = ∀ (Q′) ∀ (α_{2} = σ′_{2}) σ′′_{1}.

If β = α_{2}, then taking σ_{4} = C′_{r}(∀ (α=σ_{a}) ∀ (α_{1} =∀ (Q_{1}) σ_{b}) ∀ (Q′) ∀ (α_{2} =α_{1}) σ_{c}) is appropriate.

Otherwise, β ∈ dom(Q′) and σ_{c} is of the form ∀ (Q_{2}) ∀ (α_{2} = σ′_{2}) σ′′_{1}. Then taking σ_{4} = C′_{r}(∀ (α_{1} = σ′_{1}) ∀ (Q_{a}) ∀ (α = σ_{a}) ∀ (β = ∀ (Q_{1}) σ_{b}) ∀ (Q_{2}) ∀ (α_{2} = α_{1}) σ′′_{1}) is appropriate.

• C = ∀ (α_{1} = σ′_{1}) ∀ (Q_{a}) ∀ (γ = C′) ∀ (Q_{b}) ∀ (α_{2} = σ′_{2}) σ′′_{1}: we get the expected solution by taking σ_{4} = C′_{r}(∀ (α_{1} = σ′_{1}) ∀ (Q_{a}) ∀ (γ = C′(∀ (α = σ_{a}) ∀ (β = ∀ (Q_{1}) σ_{b}) σ_{c})) ∀ (Q_{b}) ∀ (α_{2} = α_{1}) σ′′_{1})

• C = ∀ (α_{1} = σ′_{1}) ∀ (Q′) ∀ (α_{2} = C′) σ′′_{1}: we get the expected solution by taking σ_{4} = C′_{r}(∀ (α_{1} = C′(∀ (α = σ_{a}) ∀ (β = ∀ (Q_{1}) σ_{b}) σ_{c})) ∀ (Q′) ∀ (α_{2} = α_{1}) σ′′_{1})

• C = ∀ (α_{1} = σ′_{1}) ∀ (Q′) ∀ (α_{2} = σ′_{2}) C′: we get the expected solution by taking σ_{4} = C′_{r}(∀ (α_{1} = σ′_{1}) ∀ (Q′) ∀ (α_{2} = α_{1}) C′(∀ (α = σ_{a}) ∀ (β = ∀ (Q_{1}) σ_{b}) σ_{c}))

Subcase C′_{r} is of the form C_{r}(C): we have

σ_{1} = C_{r}(∀ (β = ∀ (Q_{1}) ∀ (α = σ_{a}) σ_{b}) σ_{c}) (\underline{8})
σ_{1} = C_{r}(C(∀ (α_{1} = σ′_{1}) ∀ (Q′) ∀ (α_{2} = σ′_{2}) σ′′_{1})) (\underline{9})
σ_{2} = C_{r}(∀ (α = σ_{a}) ∀ (β = ∀ (Q_{1}) σ_{b}) σ_{c})
σ_{3} = C_{r}(C(∀ (α_{1} = σ′_{1}) ∀ (Q′) ∀ (α_{2} = α_{1}) σ′′_{1}))

From (8) and (9), we get

C(∀ (α_{1} = σ′_{1}) ∀ (Q′) ∀ (α_{2} = σ′_{1}) σ′′_{1})) = ∀ (β = ∀ (Q_{1}) ∀ (α = σ_{a}) σ_{b}) σ_{c}

We have eight choices for C:

• C is of the form ∀ (β = ∀ (Q_{1}) ∀ (α = σ_{a}) σ_{b}) C′: we get the expected result by taking σ_{4} = C_{r}(∀ (α =σ_{a}) ∀ (β =∀ (Q_{1}) σ_{b}) C′(∀ (α_{1} =σ′_{1}) ∀ (Q′) ∀ (α_{2} =α_{1}) σ′′_{1})).

• C is of the form ∀ (β = ∀ (Q_{a}) [ ]) σ_{c} with dom(Q_{a}) ⊂ dom(Q_{1}) and α = α_{2}: then, Q_{1} = (Q_{a}, α_{1} = σ′_{1}, Q′). We get the expected result by taking σ_{4} = C_{r}(∀ (α_{1} = σ′_{1}, α = α_{1}) ∀ (β = ∀ (Q_{a}, Q′) σ_{b}) σ_{c}).

• C is of the form ∀ (β = ∀ (Q_{a}) [ ]) σ_{c} with dom(Q_{a}) ⊂ dom(Q_{1}) and α ∈ dom(Q′): then, Q′ = (Q_{b}, α = σ_{a}, Q_{c}) We get the expected result by taking σ_{4} = C_{r}(∀ (α = σ_{a}) ∀ (β = ∀ (Q_{a}, α_{1} = σ′_{1}, Q_{b}, Q_{c}, α_{2} = α_{1}) σ′′_{1}))).

• C is of the form ∀ (β=∀ (Q_{a}) [ ]) σ_{c} with dom(Q_{a}) ⊂ dom(Q_{1}) and α_{2} ∈ dom(Q_{1}): then, Q_{1} = (Q_{a}, α_{1} = σ′_{1}, Q′, α_{2} = σ′_{2}, Q_{b}) We get the expected result by taking σ_{4} = C_{r}(∀ (α = σ_{a}) ∀ (β = ∀ (Q_{a}, α_{1} = σ′_{1}, Q′, α_{2} = α_{1}, Q_{b}) σ_{b}) σ_{c}).

• C is of the form ∀ (β = ∀ (Q_{1}) [ ]) σ_{c} (that is, α_{1} = α): we get the expected result by taking σ_{4} = C_{r}(∀ (α_{1} = σ′_{1}, α_{2} = α_{1}) ∀ (β = ∀ (Q_{1}, Q′) σ′′_{1}) σ_{c}).

• C is of the form ∀ (β = ∀ (Q_{a}) ∀ (γ = C′) ∀ (Q_{b}) ∀ (α = σ_{a}) σ_{b}) σ_{c}: we get the expected result by taking σ_{4} = C_{r}(∀ (α=σ_{a}) ∀ (β=∀ (Q_{a}, γ=C′(∀ (α_{1}=σ′_{1}, Q′, α_{2}= α_{1}) σ′′_{1}), Q_{b}) σ_{b}) σ_{c}).

• C is of the form ∀ (β = ∀ (Q_{1}) ∀ (α = C′) σ_{b}) σ_{c}: we get the expected result by taking σ_{4} = C_{r}(∀ (α = C′(∀ (α_{1} = σ′_{1}, Q′, α_{2} = α_{1}) σ′′_{1})) ∀ (β = ∀ (Q_{1}) σ_{b}) σ_{c}).

• C is of the form ∀ (β = ∀ (Q_{1}) ∀ (α = σ_{a}) C′) σ_{c}: we get the expected result by taking σ_{4} = C_{r}(∀ (α = σ_{a}) ∀ (β = ∀ (Q_{1}) C′(∀ (α_{1} = σ′_{1}, Q′, α_{2} = α_{1}) σ′′_{1})) σ_{c}).

∘ Case StSh-Alias and StSh-Alias: we have

{σ_{1} = C_{r}(∀ (α_{1} = σ_{a}, Q, α_{2} = σ_{b}) σ)  σ_{2} = C_{r}(∀ (α_{1} = σ_{a}, Q, α_{2} = α_{1}) σ) \atop σ_{1} = C′_{r}(∀ (α′_{1} = σ′_{a}, Q′, α′_{2} = σ′_{b}) σ′)  σ_{3} = C′_{r}(∀ (α′_{1} = σ′_{a}, Q′, α′_{2} = α′_{1}) σ′)}

By hypothesis, we have σ_{a} ≡ σ_{b} and σ′_{a} ≡ σ′_{b}.

We proceed by case analysis on C_{r} and C′_{r}.

Subcase C_{r} = C′_{r}: then, α_{1} = α′_{1}. If α_{2} is α′_{2}, then σ_{2} = σ_{3} and we get the result by taking σ_{4} = σ_{3}. Otherwise, without loss of generality, we can assume that σ_{1} is of the form C_{r}(∀ (α_{1} = σ_{a}, Q, α_{2} = σ_{b}, Q_{1}, α′_{2} = σ_{1}) σ′) We get the expected result by taking σ_{4} = C_{r}(∀ (α_{1} = σ_{a}, Q, α_{2} = α_{1}, Q_{1}, α′_{2} = α_{1}) σ′)

Subcase C_{r} and C′_{r} are disjoint: by Lemma 2.4.6 (page 76), there exists a two-hole context C^{2} such that C_{r} = C^{2}([ ], ∀ (α′_{1} = σ′_{a}, Q, α′_{2} = σ′_{b}) σ′) and C′_{r} = C^{2}(∀ (α_{1} = σ_{a}, Q, α_{2} = σ_{b}) σ, [ ]). Then we get the expected result by taking σ_{4} = C^{2}(∀ (α_{1} = σ_{a}, Q, α_{2} = α_{1}) σ, ∀ (α′_{1} = σ′_{a}, Q, α′_{2} = α′_{1}) σ′).

Subcase C_{r} and C′_{r} are nested: without loss of generality, we can freely assume that C′_{r} is of the form C_{r}(C). Hence, we have

{σ_{1} = C_{r}(∀ (α_{1} = σ_{a}, Q, α_{2} = σ_{b}) σ) (\underline{10}) σ_{2} = C_{r}(∀ (α_{1} = σ_{a}, Q, α_{2} = α_{1}) σ) \atop σ_{1} = C_{r}(C(∀ (α′_{1} = σ′_{a}, Q′, α′_{2} = σ′_{b}) σ′)) (\underline{11}) σ_{3} = C_{r}(C(∀ (α′_{1} = σ′_{a}, Q′, α′_{2} = α′_{1}) σ′))}

From (10) and (11), we get

∀ (α_{1} = σ_{a}, Q, α_{2} = σ_{b}) σ = C(∀ (α′_{1} = σ′_{a}, Q′, α′_{2} = σ′_{b}) σ′)

We have eight choices for C:

• C = ∀ (α_{1} = C′, Q, α_{2} = σ_{b}) σ: Then we get the expected result by taking σ_{4} = C_{r}(∀ (α_{1} = C′(∀ (α′_{1} = σ′_{a}, Q′, α′_{2} = α′_{1}) σ′), Q, α_{2} = α_{1}) σ).

• C = ∀ (α_{1} = σ_{a}, Q_{1}, ∀ (γ = C′), Q_{2}, α_{2} = σ_{b}) σ: Then we get the expected result by taking σ_{4} = C_{r}(∀ (α_{1}=σ_{a}, Q_{1}, ∀ (γ=C′(∀ (α′_{1}=σ′_{a}, Q′, α′_{2}=α′_{1}) σ′)), Q_{2}, α_{2}=α_{1}) σ.

• C = ∀ (α_{1} = σ_{a}, Q, α_{2} = C′) σ: Then we get the expected result by taking σ_{4} = C_{r}(∀ (α_{1} = C′(∀ (α′_{1} = σ′_{a}, Q′, α′_{2} = α′_{1}) σ′)Q, α_{2} = α_{1}) σ.

• C = ∀ (α_{1} = σ_{a}, Q, α_{2} = σ_{b}) C′: Then we get the expected result by taking σ_{4} = C_{r}(∀ (α_{1} = σ_{a}, Q, α_{2} = α_{1}) C′(∀ (α′_{1} = σ′_{a}, Q′, α′_{2} = α′_{1}) σ′)).

• C = ∀ (α_{1} = σ_{a}, Q_{1}) [ ] with dom(Q_{1}) ⊂ dom(Q) and α′_{2} ∈ dom(Q): We have Q = (Q_{1}, α′_{1} = σ′_{a}, Q′, α′_{2} = σ′_{b}, Q_{2}). Then we get the expected result by taking σ_{4} = C_{r}(∀ (α_{1} = σ_{a}, Q_{1}, α′_{1} = σ′_{a}, Q′, α′_{2} = α′_{1}, Q_{2}, α_{2} = α_{1}) σ).

• C = ∀ (α_{1} = σ_{a}, Q_{1}) [ ] with dom(Q_{1}) ⊂ dom(Q) and α_{2} = α′_{2}: we have σ_{1} = σ′_{1} and Q = (Q_{1}, α′_{1} = σ′_{a}, Q′). Then we get the expected result by taking σ_{4} = C_{r}(∀ (α_{1} = σ_{a}, Q_{1}, α′_{1} = α_{1}, Q′, α_{2} = α_{1}) σ).

• C = ∀ (α_{1} = σ_{a}, Q_{1}) [ ] with dom(Q_{1}) ⊂ dom(Q) and α_{2} ∈ dom(Q′): we have Q′ = (Q_{a}, α_{2}=σ_{b}, Q_{b}). Then we get the expected result by taking σ_{4} = C_{r}(∀ (α_{1}= σ_{a}, Q_{1}, α′_{1} = σ′_{a}, Q_{a}, α_{2} = α_{1}, Q_{b}, α′_{2} = α′_{1}) σ′).

• C = ∀ (α_{1} = σ_{a}, Q) [ ] (that is, α_{2} = α′_{1}): we have σ_{1} = σ′_{1}. Then we get the expected result by taking σ_{4} = C_{r}(∀ (α_{1} = σ_{a}, Q, α′_{1} = α_{1}, Q′, α′_{2} = α_{1}) σ′).

\underline{Property ii}: By hypothesis, we have σ_{1}, σ_{2} and σ_{3} such that (Q) σ_{1} (≡ ˙⊏ −^{∅}) σ_{2} and

(Q) σ_{2} (≡ ˙⊏ −^{∅}) σ_{3} hold. We have to show that there exists σ_{4} such that (Q) σ_{2} (≡ ˙⊏ −^{∅})^{∗} σ_{4} and (Q) σ_{3} (≡ ˙⊏ −^{∅})^{∗} σ_{4}. By Property 2.6.2.i (page 85), the relations (≡ ˙⊏ −^{∅})^{∗} and ⊏ − are equivalent, thus it suffices to show that there exists σ_{4} such that (Q) σ_{2} ⊏ − σ_{4} and (Q) σ_{3} ⊏ − σ_{4}. If (Q) σ_{1} ≡ σ_{2} or (Q) σ_{1} ≡ σ_{3} hold, then taking (respectively) σ_{4} = σ_{3} or σ_{4} = σ_{2} gives the expected result. Otherwise, by definition, there exist σ_{1}^{a}, σ′_{2}, σ_{1}^{b} and σ′_{3} such that we have

{(Q) σ_{1} ≡ σ_{1}^{a} (\underline{1})  (Q) σ_{1}^{a} ˙⊏ −^{∅} σ′_{2} (\underline{2})  (Q) σ′_{2} ≡ σ_{2}  (Q) σ_{1} ≡ σ_{1}^{b} \atop (Q) σ_{1}^{b} ˙⊏ −^{∅} σ′_{3}  (Q) σ′_{3} ≡ σ_{3}}

Figure A.1: Commutation

\begin{matrix}σ_{1} & σ_{1}^{a} & σ′_{2} & σ_{2} \\ σ_{1}^{b} & σ′_{1} & σ′′_{2} \\ σ′_{3} & σ′′_{3} & σ_{4} \\ σ_{3} \end{matrix} ≡ ≡ ≡ ≡ ≡ ≡ ˙⊏ −^{∅} ˙⊏ −^{∅} ≡ ≡ ˙⊏ −^{∅} ˙⊏ −^{∅} ⊏ − ⊏ −

Let σ′_{1} be nf(σ_{1}). By Property 1.5.6.iv (page 51), σ′_{1} is in normal form, and by Property 1.5.6.i (page 51), σ′_{1} ≡ σ_{1} holds.

We represent these relations by the solid arrows of figure A.1, to be read under prefix Q. The dotted arrows correspond to relations shown below.

By Property 1.5.11.i (page 54) and (1), nf(σ_{1}^{a}) ≈ σ′_{1} holds. By (2), Properties 2.6.3.i (page 86) and 2.6.3.ii (page 86), there exists σ′′_{2} such that (Q) σ′_{2} ≡ σ′′_{2} and (Q) σ′_{1} ˙⊏ −^{∅} σ′′_{2}. Similarly, there exists σ′′_{3} such that (Q) σ′_{3} ≡ σ′′_{3} and (Q) σ′_{1} ˙⊏ −^{∅} σ′′_{3}. Hence, we have

(Q) σ_{1} ≡ σ′_{1}  (Q) σ′_{1} ˙⊏ −^{∅} σ′′_{2}  (Q) σ′′_{2} ≡ σ_{2}  (Q) σ′_{1} ˙⊏ −^{∅} σ′′_{3}  (Q) σ′′_{3} ≡ σ_{3}

By Property i, there exists σ_{4} such that (Q) σ′′_{2} ⊏ − σ_{4} and (Q) σ′′_{3} ⊏ − σ_{4}. Consequently, (Q) σ_{2} ⊏ − σ_{4} holds by A-Equiv and R-Trans. Similarly, (Q) σ_{3} ⊏ − σ_{4} holds. This is the expected result.

\underline{Property iii}: Intuitively, there are no critical pair in this configuration. By hypothesis, we have (Q) σ_{1} ˙⊏ σ_{2} (\underline{1}) and (Q) σ_{1} ˙⊏ −ᾱ σ_{3} (\underline{2}). All rules available to derive (1) are of the form (Q) C_{f}(σ′_{1}) ˙⊏ C_{f}(σ′_{2}), thus there exist a flexible context C_{f} and types σ′_{1} and σ′_{2} such that we have σ_{1} = C_{f}(σ′_{1}) (\underline{3}) and σ_{2} = C_{f}(σ′_{2}). Similarly, there exist a rigid context C_{r} and types σ′′_{1} and σ′_{3} such that we have σ_{1} = C_{r}(σ′′_{1}) (\underline{4}) and σ_{3} = C_{r}(σ′_{3}). We proceed by case analysis on the pair (C_{f}, C_{r}). Since σ_{1} is in normal form, C_{f} cannot be of the form ∀ (Q_{1}, α = C′_{f}) σ_{α} and C_{r} cannot be of the form ∀ (Q_{1}, α ≥ C′_{r}) σ_{α}, with nf(σ_{α}) = α. By (3) and (4), we must always have σ_{1} = C_{f}(σ′_{1}) = C_{r}(σ′′_{1}) (\underline{5}). Additionally, Rule StSh-Hyp cannot be used to derive (2) because the prefix is unconstrained. ∘ Case ∀ (Q_{1}) [ ], ∀ (Q_{1}) [ ]: The rule used to derive (2) is either StSh-Up, or StSh-Alias. In both cases σ_{1} is of the form C_{r}(∀ (α = σ_{a}) σ_{b}) (\underline{6}). Hence, σ_{1} must be of the form ∀ (Q_{1}) (∀ (α = σ_{a}) σ_{b}). If Rule S-Hyp is used to derive (1), then σ_{1} must be of the form C_{f}(σ′), where (Q) ⊥ ≡ Ĉ_{f}(σ′) (because Q is unconstrained). By Property 1.5.11.vi (page 54), we must have σ′/ϵ = ⊥. Hence, σ′ ≡ ⊥ by Property 2.1.5.iii (page 67). Moreover, σ′ is in normal form since σ_{1} is in normal form. Hence, σ′ must be ⊥. In summary, σ_{1} is ∀ (Q_{1}) ⊥, which is a contradiction with (6). Hence, Rule S-Hyp cannot be used. All other rules available to derive (1) imply that σ_{1} is of the form C_{f}(∀ (α≥σ_{a}) σ_{b}). Consequently, we should have ∀ (Q_{1}) ∀ (α ≥ σ_{a}) σ_{b} = ∀ (Q_{1}) ∀ (α = σ_{a}) σ_{b}, which is a contradiction. Thus this case cannot occur. ∘ Case (∀ (Q_{1}, α ≥ C′_{f}) σ_{0}, ∀ (Q_{1}, α ≥ σ_{a}) C′_{r}): By (5), we must have σ_{a} = C′_{f}(σ′_{1}) and σ_{0} = C′_{r}(σ′′_{1}). Hence, σ_{1} is ∀ (Q_{1}, α ≥ C′_{f}(σ′_{1})) C′_{r}(σ′′_{1}). We get the expected result by taking σ_{4} = ∀ (Q_{1}, α ≥ C′_{f}(σ′_{2})) C′_{r}(σ′_{3}). ∘ Case (∀ (Q_{1}, α = σ_{a}) C′_{f}, ∀ (Q_{1}, α = C′_{r}) σ_{0}): By (5), we must have σ_{a} = C′_{r}(σ′′_{1}) and σ_{0} = C′_{f}(σ′_{1}). Hence, σ_{1} is ∀ (Q_{1}, α = C′_{r}(σ′′_{1})) C′_{f}(σ′_{1}). We get the expected result by taking σ_{4} = ∀ (Q_{1}, α = C′_{r}(σ′_{3})) C′_{f}(σ′_{2}). ∘ Case ∀ (Q_{1}) [ ], ∀ (Q_{1}) C′_{r} (the case where C′_{r} is [ ] has already been discarded): By (5), we must have σ′_{1} = C′_{r}(σ′′_{1}) (\underline{7}). We consider the rule used to derive (1):

Subcase S-Hyp: Necessarily, σ_{1} is of the form ∀ (Q_{1}) ⊥. This is a contradiction with σ_{1} = ∀ (Q_{1}) C′_{r}(σ′′_{1}) and C′_{r} different from [ ].

Subcase S-Up: we have σ′_{1} = ∀ (β ≥ ∀ (Q′, α ⋄ σ) σ′) σ′′. By (7), we must have C′_{r} = ∀ (β ≥∀ (Q′, α⋄σ) σ′) C′′_{r} and C′′_{r}(σ′′_{1}) = σ′′. We get the expected result by taking σ_{4} = ∀ (Q_{1}) ∀ (α ⋄ σ) ∀ (β ≥ ∀ (Q′) σ′) C′′_{r}(σ′_{3}).

Subcase S-Alias: We have σ′_{1} = ∀ (α_{1} ≥σ_{a}, Q′, α_{2} ≥σ_{b}) σ′. If C′_{r} is of the form ∀ (Q_{1}, α = C′′_{r}) σ_{0} with α ∈ dom(Q′) or α_{2} ∈ dom(Q_{1}), we get the expected result by taking σ_{4} = ∀ (Q′_{1}, α = C′′_{r}(σ′_{3})) σ′_{0}, and Q′_{1} and σ′_{0} are, respectively, Q_{1} and σ_{0}, where the binding (α_{2} ≥ σ_{b}) is replaced by (α_{2} = α_{1}). Otherwise, C′_{r} is of the form ∀ (Q_{2}) [ ]. We proceed by case on the rule used to derive (2).

• Rule StSh-Up: we have σ′′_{1} = ∀ (β = ∀ (Q_{a}, α ⋄ σ) σ′) σ′′. Hence, by (7), we get ∀ (α_{1} ≥ σ_{a}, Q′, α_{2} ≥ σ_{b}) σ′ = ∀ (Q_{2}, β = ∀ (Q_{a}, α ⋄ σ) σ′) σ′′. Necessarily, β is in dom(Q′) or α_{2} is in dom(Q_{2}). In both cases, we get the expected result by taking σ_{4} = ∀ (Q′_{2}, α ⋄ σ, β = ∀ (Q_{a}) σ′) σ′′_{2} and Q′_{2} and σ′′_{2} are, respectively, Q_{2} and σ′′, where the binding (α_{2} ≥ σ_{b}) is replaced by (α_{2} = α_{1}).

• Rule StSh-Alias: We have σ′′_{1} = ∀ (α′_{1} = σ′_{a}, Q′′, α′_{2} = σ′_{b}) σ′′. By (7), we get ∀ (α_{1} ≥ σ_{a}, Q′, α_{2} ≥ σ_{b}) σ′ = ∀ (Q_{2}, α′_{1} = σ′_{a}, Q′′, α′_{2} = σ′_{b}) σ′′. Necessarily, α_{2} is in dom(Q_{2}) ∪ dom(Q′′) or α′_{1} and α′_{2} are in dom(Q′). In all cases, we get the expected result by taking ∀ (Q′_{2}, α′_{1} = σ′_{a}, Q′′_{2}, α′_{2} = α′_{1}) σ′′_{2} and Q′_{2}, Q′′_{2} and σ′′_{2} are, respectively, Q_{2}, Q′′ and σ′′, where the binding (α_{2} ≥σ_{b}) is replaced by (α_{2} =α_{1}).

Subcase S-Nil: We have σ′_{1} = ⊥. By (7), we must have ⊥ = C′_{r}(σ′′_{1}), which is a contradiction, since C′_{r} is not [ ].

Subcase S-Rigid: We have σ′_{1} = ∀ (α≥σ′) σ. By (7), we must have C′_{r} = ∀ (α≥ σ′) C′′_{r} and C′′_{r}(σ′′_{1}) = σ. We get the expected result by taking σ_{4} = ∀ (α = σ′) C′′_{r}(σ′_{3}). ∘ Case ∀ (Q_{1}) C′_{f}, ∀ (Q_{1}) [ ] (the case where C′_{f} is [ ] has already been discarded): By (5), we must have σ′′_{1} = C′_{f}(σ′_{1}). We consider the rule used to derive (2):

Subcase StSh-Up: similar to S-Up above.

Subcase StSh-Alias: similar to S-Alias above.

\underline{Property iv}: Intuitively, there are no critical pair in this configuration. By hypothesis, we have (Q) C_{f}(σ_{1}) ˙⊏ −ᾱ σ_{3} (\underline{1}) and (Q\overline{C_{f}}) σ_{1} ˙⊏ −ᾱ σ_{2}. From (1), we have C_{f}(σ_{1}) = C_{r}(σ′_{1}) (\underline{2}) for some C_{r} and σ′_{1}, and σ_{3} is C_{r}(σ′_{3}). We proceed by case analysis on the pair (C_{f}, C_{r}): ∘ Case C_{f} and C_{r} are disjoint: By Lemma 2.4.6 (page 76) and (2), there exists a twohole context C^{2} such that C_{f} = C^{2}([ ], σ′_{1}) and C_{r} = C^{2}(σ_{1}, [ ]). Taking σ_{4} = C^{2}(σ_{2}, σ′_{3}) gives the expected result. ∘ Case C_{r} is of the form C_{f}(C′) is not possible since level(C_{f}) > 1. ∘ Case C_{f} is of the form C_{r}(C′_{f}): necessarily, level(C_{r}) = 1, that is, by Property 2.4.4.i (page 74), C_{r} is of the form ∀ (Q_{1}) [ ]. Besides, level(C′_{f}) > 1. The hypothesis (1) can be written this way: (Q) ∀ (Q_{1}) C′_{f}(σ_{1}) ˙⊏ −ᾱ ∀ (Q_{1}) σ′_{3} (\underline{3}). Two rules can be used to derive (3):

Subcase StSh-Up: Then C′_{f}(σ_{1}) = ∀ (β = ∀ (Q′, α = σ) σ′) σ′′. Necessarily, C′_{f} is of the form ∀ (β = ∀ (Q′, α = σ) σ′) C′′_{f}. Then we get the expected result by taking σ_{4} = ∀ (Q_{1}, α = σ, β = ∀ (Q′) σ′) C′′_{f}(σ_{2})

Subcase StSh-Alias: Then C′_{f}(σ_{1}) = ∀ (α_{1} = σ, Q′, α_{2} = σ′) σ′′ with σ ≡ σ′, and σ_{3} is ∀ (α_{1} = σ, Q′, α_{2} = α_{1}) σ′′. Necessarily, C′_{f} is of the form ∀ (α_{1} = σ) ∀ (Q_{0}) ∀ (α≥C′′_{f}) σ_{0}, where α ∈ dom(Q′) or α_{2} ∈ dom(Q_{0}). In both cases, we get the expected result by taking σ_{4} = ∀ (Q) ∀ (α_{1}=σ, Q′_{0}, α≥C′′_{f}(σ_{2})) σ′_{0} and Q′_{0} and σ′_{0} are, respectively, Q_{0} and σ_{0} where the binding (α_{2} = σ′) is replaced by (α_{2} = α_{1}).

Proof of Property 3.2.2

\underline{Property i}: Directly, if we have Q_{1} ≡^{I} Q_{2}, then, for any σ such that ftv(σ) ⊆ I, we have ∀ (Q_{1}) σ ≡ ∀ (Q_{2}) σ, which implies ∀ (Q_{1}) σ ⊑ ∀ (Q_{2}) σ (\underline{1}) by I-Equiv^{⋆}, as well as ∀ (Q_{2}) σ ⊑ ∀ (Q_{1}) σ (\underline{2}). By definition, (1) implies Q_{1} ⊑^{I} Q_{2}, and (2) implies Q_{2} ⊑^{I} Q_{1}. Conversely, let σ be such that ftv(σ) ⊆ I. By hypothesis, Q_{1} ⊑^{I} Q_{2} and Q_{2} ⊑^{I} Q_{1} hold, thus we have by definition ∀ (Q_{1}) σ ⊑ ∀ (Q_{2}) σ and ∀ (Q_{2}) σ ⊑ ∀ (Q_{1}) σ. By Property 2.7.7.i (page 96), we have ∀ (Q_{1}) σ ≡ ∀ (Q_{2}) σ. Hence, by definition, Q_{1} ≡^{I} Q_{2} holds.

\underline{Property ii}: By hypothesis, we have a derivation of ∀ (Q_{1}) ⊥ ≈ ∀ (Q_{2}) ⊥ (\underline{3}). We show by induction on the derivation of (3) that there exists a derivation of ∀ (Q_{1}) σ ≈ ∀ (Q_{2}) σ (\underline{4}) for any σ. Actually, we get a derivation of (4) by replacing ⊥ by σ in the derivation of (3). Then by Property 1.5.3.iii (page 49), we have ∀ (Q_{1}) σ ≡ ∀ (Q_{2}) σ. Hence, by definition, Q_{1} ≡ Q_{2} holds.

Proof of Property 3.2.3

\underline{Property i}: If (Q) α ≡ Q(α) holds, then we conclude by I-Equiv^{⋆} and R-Trans. From now on, we assume (Q) α ≡ Q(α) does not hold. This implies Q̂(α) ∈ V (\underline{1}) by Property 2.2.2.iii (page 69). By hypothesis, (Q) σ ⊏ − α holds. By Property 2.6.2.i (page 85), we have a derivation of (Q) σ (≡ ˙⊏ −^{∅})^{∗} α. Assume we proved the following property:

If we have (Q) σ_{1} (≡ ˙⊏ −^{∅}) σ_{2} and (Q) σ_{2} ≡ α, then we have either (Q) σ_{1} ≡
α, or (Q) σ_{1} ⊏ − Q(α).

Then we may conclude by induction on the size of (Q) σ (≡ ˙⊏ −^{∅})^{∗} α, Property 2.6.2.i (page 85) and R-Trans. Therefore, it only remains to prove the property above. We reason by case analysis. By hypothesis, we have (Q) σ_{2} ≡ α (\underline{2}) and (Q) σ_{1} (≡ ˙⊏ −^{∅}) σ_{2}. If (Q) σ_{1} ≡ σ_{2} (\underline{3}), then (Q) σ_{1} ≡ α holds by R-Trans, (3) and (2), and the result is shown. Otherwise, by definition of (≡ ˙⊏ −^{∅}), there exist σ′_{1} and σ′_{2} such that (Q) σ_{1} ≡ σ′_{1} (\underline{4}), (Q) σ′_{1} ˙⊏ −ᾱ σ′_{2} (\underline{5}) and (Q) σ′_{2} ≡ σ_{2} (\underline{6}) hold. We have (Q) σ′_{2} ≡ α by R-Trans, (6), and (2). Hence, we have Q̂(σ′_{2}) ≡ Q̂(α) by Corollary 1.5.10. By (1), this means Q̂(σ′_{2}) ≡ β, where β = Q̂(α) (\underline{7}). Hence, nf(Q̂(σ′_{2})) is β by Property 1.5.11.i (page 54). We get Q̂(nf(σ′_{2})) = β by Property 1.5.6.iii (page 51), which implies nf(σ′_{2}) = γ (\underline{8}) for some variable γ such that Q̂(γ) = β (\underline{9}). Three rules are available to derive (5): However, rules StSh-Up and StSh-Alias cannot be used to derive (5), because the side-conditions of these rules prevent σ′_{2} from being in V. Thus, Rule StSh-Hyp must be used. Then σ′_{1} is C_{r}(σ′) (\underline{10}), σ′_{2} is C_{r}(α′) (\underline{11}), with (α′ = σ_{0}) ∈ Q (\underline{12}) and (Q) σ_{0} ≡ Ĉ_{r}(σ′) (\underline{13}). Additionally, α′ ∉ dom(C_{r}) (\underline{14}) and C_{r} is necessarily useful (otherwise, we would have (Q) σ′_{1} ≡ σ′_{2}). We have (Q) C_{r}(σ′) ≡ C_{r}(Ĉ_{r}(σ′)) (\underline{15}) by Eq-Mono, R-Context-L, and R-Context-R. From (13), we get (Q) C_{r}(Ĉ_{r}(σ′)) ≡ C_{r}(σ_{0}) (\underline{16}). By R-Trans, (10), (15), and (16), we get (Q) σ′_{1} ≡ C_{r}(σ_{0}) (\underline{17}). By (14), we get α′ ∈ ftv(C_{r}(α′)), that is α′ ∈ ftv(σ′_{2}), which implies α′ ∈ ftv(nf(σ′_{2})) by Property 1.5.6.ii (page 51). By (8), this means that α′ is γ. Consequently, σ_{0} = Q(γ) (\underline{18}) holds from (12). By Property 2.4.4.v (page 74), (8), and (11), we must have level(C_{r}) ⩽ 1, that is level(C_{r}) = 1 (\underline{19}) since C_{r} is useful (Property 2.4.3.iii (page 73)). We have dom(C_{r}) # ftv(σ_{0}) (\underline{20}) by well-formedness of (12). By (19) and (20), we get (Q) C_{r}(σ_{0}) ≡ σ_{0} (\underline{21}) by Property 2.4.4.ii (page 74) and Eq-Free. Finally, this gives (Q) σ_{1} ≡ Q(γ) by (4), (17), (21), (18), and R-Trans. We get (Q) σ_{1} ⊏ − Q(γ) (\underline{22}) by A-Equiv. By Property 2.2.2.ii (page 69) applied to (7) and (9), we have Q(α) = Q(β) and Q(β) = Q(γ). Therefore, (22) gives (Q) σ_{1} ⊏ − Q(α), which is the expected result.

\underline{Property ii}: If (Q) σ ⊏ − α holds, then Property i and I-Abstract give the expected result. Hence, we assume (Q) σ ⊏ − α does not hold. This implies σ ∉ T by Lemma 2.1.6. Furthermore, we also assume that (Q) α ≡ Q(α) does not hold (if it holds, we get the result by I-Equiv^{⋆} and R-Trans). This implies Q̂(α) ∈ V (\underline{1}) by Property 2.2.2.iii (page 69). By Property 2.6.2.ii (page 85), we have a derivation of (Q) σ (≡ ˙⊑)^{∗} α. Assume we proved the following property:

If we have (Q) σ_{1} (≡ ˙⊑) σ_{2} and (Q) σ_{2} ≡ α, then we have either (Q) σ_{1} ≡ α,
or (Q) σ_{1} ⊑ Q(α).

Then we conclude by induction on the size of (Q) σ (≡ ˙⊑)^{∗} α, Property 2.6.2.ii (page 85) and R-Trans. Therefore, it remains only to show the property above. We reason by case analysis. By hypothesis, we have (Q) σ_{2} ≡ α (\underline{2}) and (Q) σ_{1} (≡ ˙⊑) σ_{2}. If (Q) σ_{1} ≡ σ_{2} (\underline{3}), then (Q) σ_{1} ≡ α holds by R-Trans, (3) and (2), and the result is shown. Otherwise (\underline{4}) there exist σ′_{1} and σ′_{2} such that (Q) σ_{1} ≡ σ′_{1} (\underline{5}), (Q) σ′_{1} ˙⊑ σ′_{2} (\underline{6}) and (Q) σ′_{2} ≡ σ_{2} (\underline{7}). We have (Q) σ′_{2} ≡ α (\underline{8}) by R-Trans, (7), and (2). Hence, we have Q̂(σ′_{2}) ≡ Q̂(α) by Corollary 1.5.10. By (1), this means Q̂(σ′_{2}) ≡ β, where β = Q̂(α) (\underline{9}). Hence, nf(Q̂(σ′_{2})) is β by Property 1.5.11.i (page 54). We get Q̂(nf(σ′_{2})) = β by Property 1.5.6.iii (page 51), which implies nf(σ′_{2}) = γ (\underline{10}) for some variable γ such that Q̂(γ) = β (\underline{11}) holds. Three rules are available to derive (6): ∘ Case C-Strict: Then we have (Q) σ′_{1} ˙⊏ σ′_{2} (\underline{12}) and σ′_{2} ∈ V (\underline{13}) (by (10)). Rules S-Up, S-Alias, S-Rigid cannot be used to derive (12), because the side-conditions of these rules prevent σ′_{2} from being in V. If Rule S-Nil is used, then there exists a useful context C_{f} and a closed type σ such that σ′_{2} is C_{f}(σ). Since σ′_{2} ∈ V, this implies σ ∈ V, which is a contradiction with ftv(σ) = ∅. Hence this rule cannot be used. Last, Rule S-Hyp is used to derive (12), and σ′_{1} is C_{f}(σ′) (\underline{14}), σ′_{2} is C_{f}(α′) (\underline{15}), with (α′ ≥ σ_{0}) ∈ Q (\underline{16}) and (Q) σ_{0} ≡ Ĉ_{f}(σ′) (\underline{17}). Additionally, α′ ∉ dom(C_{f}) (\underline{18}), and C_{f} is necessarily useful (otherwise, we would have (Q) σ′_{1} ≡ σ′_{2}). We have (Q) C_{f}(σ′) ≡ C_{f}(Ĉ_{f}(σ′)) (\underline{19}) by Eq-Mono, R-Context-L, and R-Context-R. By (17), we have (Q) C_{f}(Ĉ_{f}(σ′)) ≡ C_{f}(σ_{0}) (\underline{20}). By R-Trans, (14), (19), and (20), we get (Q) σ′_{1} ≡ C_{f}(σ_{0}) (\underline{21}). By (18), we get α′ ∈ ftv(C_{f}(α′)), that is α′ ∈ ftv(σ′_{2}), which implies α′ ∈ ftv(nf(σ′_{2})) by Property 1.5.6.ii (page 51). By (10), this means that α′ is γ. Consequently, σ_{0} = Q(γ) (\underline{22}). By Property 2.4.4.v (page 74), (13), and (15), we must have level(C_{f}) ⩽ 1, that is level(C_{f}) = 1 (\underline{23}) since C_{f} is useful (Property 2.4.3.iii (page 73)). We have dom(C_{f}) # ftv(σ_{0}) (\underline{24}) by well-formedness of (16). By (23) and (24), we get (Q) C_{f}(σ_{0}) ≡ σ_{0} (\underline{25}) by Property 2.4.4.ii (page 74) and Eq-Free. Finally, this gives (Q) σ_{1} ≡ Q(γ) by (5), (21), (25), (22), and R-Trans. We get (Q) σ_{1} ⊑ Q(γ) (\underline{26}) by I-Equiv^{⋆}. By Property 2.2.2.ii (page 69) applied to (9) and (11), we have Q(α) = Q(β) and Q(β) = Q(γ). Therefore, (26) gives (Q) σ_{1} ⊑ Q(α), which is the expected result. ∘ Case C-Abstract-F: We must have σ′_{2} of the form C_{f}(σ_{0}) with level(C_{f}) > 1. By (10), σ′_{2} ∈ V. By Property 2.4.4.v (page 74), this implies level(C_{f}) ⩽ 1, which is a contradiction. Therefore, this case cannot occur. ∘ Case C-Abstract-R: Then by hypothesis, (Q) σ′_{1} ⊏ − σ′_{2} (\underline{27}) holds, thus (Q) σ_{1} ⊏ − α holds by R-Trans, A-Equiv and (5), (27) and (8). We assumed (in (4)), that (Q) σ_{1} ≡ σ_{2} does not hold. This implies σ_{1} ∉ T by Lemma 2.1.6. Hence, (Q) σ_{1} ⊏ − Q(α) by Property i, which gives (Q) σ_{1} ⊑ Q(α) by I-Abstract. This is the expected result.

\underline{Property iii}: We have (Q) Q(α) ⊑ Q[α] by I-Hyp or A-Hyp and I-Abstract. We conclude by Property 2.2.2.i (page 69).

Proof of Property 3.3.2

\underline{Property i} : It is shown by observing that α ∈ ftv(∀ (Q_{2}) ∇_{I∪J}) is equivalent to α ∈ ftv(∀ (Q_{2}) ∇_{I}) ∪ ftv(∀ (Q_{2}) ∇_{J}). \underline{Property ii} : It suffices to show the result for a single commutation. Then the result follows by immediate induction on the number of commutations. Hence, it suffices to show that dom(Q_{1}, α ⋄ σ, α′ ⋄′ σ′, Q_{0}/ᾱ) and dom(Q_{1}, α′ ⋄′ σ′, α ⋄ σ, Q_{0}/ᾱ) are equal when α ∉ ftv(σ′) and α′ ∉ ftv(σ). We get the expected result by observing that α is in ftv(∀ (α′ ⋄′ σ′, Q_{0}) ∇_{I}) if and only if α is in ftv(∀ (Q_{0}) ∇_{I}), and similarly, α′ is in ftv(∀ (α ⋄ σ, Q_{0}) ∇_{I}) if and only if α′ is in ftv(∀ (Q_{0}) ∇_{I}).

Proof of Property 3.4.2

\underline{Property i} : It is shown by induction on the derivation of Q_{1} ♢_{ℓ}^{I} Q_{2}. All cases are easy.

\underline{Property ii}: We say that α appears in a judgment Q_{1} ♢_{ℓ}^{I} Q_{2} if α is in dom(Q_{1}) ∪ dom(Q_{2}). We say that α appears in a derivation when it appears in one of its judgments. By hypothesis, we have a derivation of Q ♢_{ℓ}^{I} Q′ (\underline{1}). We show that ϕ(Q) ♢_{ℓ}^{ϕ(I)} ϕ(Q′) holds for a renaming ϕ such that codom(ϕ) is fresh, that is, disjoint from the set of type variables appearing in the derivation of (1). All cases are easy. Then any renaming ϕ can be decomposed into ϕ_{1} ∘ ϕ_{2} such that ϕ_{2} is fresh, relatively to the derivation of Q ⊑_{ℓ}^{I} Q′, and ϕ_{1} is fresh, relatively to the derivation of ϕ_{2}(Q) ⊑_{ℓ}^{ϕ_{2}(I)} ϕ_{2}(Q′).

\underline{Property iii}: By hypothesis, we have a derivation of Q_{1} ♢_{ℓ}^{I} Q_{2} (\underline{1}). Let ϕ be a renaming mapping the domain dom(Q) − I to fresh variables (that is, outside dom(QQ_{1}Q_{2})). By Property ii, we have a derivation of ϕ(Q_{1}) ♢_{ℓ}^{ϕ(I)} ϕ(Q_{2}) (\underline{2}). Since dom(ϕ) # I, we have ϕ(Q_{1}) ♢_{ℓ}^{I} ϕ(Q_{2}) (\underline{3}) from (2). Besides, by hypothesis, we have dom(Q) # dom(Q_{1}) ∪ dom(Q_{2}) (\underline{4}), hence ϕ is invariant on Q_{1} and Q_{2}. Then (3) is written Q_{1} ♢_{ℓ}^{I} Q_{2} (\underline{5}). The difference between (1) and (5) lies in the fact that intermediate variables (variables introduced by PE-Free) are renamed by ϕ in (5), and therefore such variables are outside dom(Q). By hypothesis utv(Q) ⊆ I, thus utv(Q) ⊆ dom(Q_{1}) ∩ dom(Q_{2}) (\underline{6}) by well-formedness of (5). Hence, by (4) and (6), Q_{1}Q and Q_{2}Q are well-formed and closed. The proof is by induction on the derivation of (5). Case PE-Refl is immediate. We show directly cases PE-Mono, PE-Swap, PE-Comm, PE-Context-L, PA-Context-L, PI-Context-L and PI-Rigid by replacing Q_{0} by Q_{0}Q. Cases PA-Equiv and PI-Abstract are by induction hypothesis. ∘ Case PE-Free: We have Q_{2} = (Q_{1}, α ⋄ σ), with α ∉ dom(Q_{1}) and α ∉ I (\underline{7}). Thanks to the renaming ϕ, we know that α ∉ dom(Q). Besides, (7) and the hypothesis utv(Q) ⊆ I imply that α ∉ utv(Q). Hence Q_{1}Q ≡_{ℓ} (Q_{1}, α ⋄ σ, Q) holds by PE-Free and PE-Comm. This is the expected result. ∘ Case PE-Trans, PA-Trans and PI-Trans: We have Q_{1} ♢_{ℓ}^{I} Q′_{1} and Q′_{1} ♢_{ℓ}^{I} Q_{2}. By induction hypothesis, we get Q_{1}Q ♢_{ℓ}^{I∪dom(Q)} Q′_{1}Q and Q′_{1}Q ♢_{ℓ}^{I∪dom(Q)} Q_{2}Q. By PE-Trans, PA-Trans, or PI-Trans, we get Q_{1}Q ♢_{ℓ}^{I∪dom(Q)} Q_{2}Q.

\underline{Property iv}: By hypothesis, Q is closed (\underline{1}) and well-formed, and ϕ is a renaming of dom(Q). This implies that ϕ is injective on dom(Q). Hence, ϕ(Q) is closed and well-formed. Additionally, dom(ϕ) ⊆ dom(Q) holds by hypothesis, thus codom(ϕ) ⊆ dom(ϕ(Q)). As a consequence, ϕ(Q)\underline{ϕ} is closed and well-formed. Let I be dom(Q) (\underline{2}). The proof is by induction on the size of the finite set dom(ϕ). If this set is empty, then Q = ϕ(Q) and we get the result by PE-Refl. Otherwise, let (α ⋄ σ) be the leftmost binding of Q such that α ∈ dom(ϕ). We can write Q in the form (Q_{1}, α ⋄ σ, Q_{2}), and dom(Q_{1}) # dom(ϕ) (\underline{3}). Since Q is closed by (1), we have ftv(σ) ⊆ dom(Q_{1}), hence ftv(σ) # dom(ϕ) by (3). As a consequence, we have ϕ(σ) = σ (\underline{4}). We write α′ for ϕ(α) (\underline{5}). Since ϕ is a renaming of dom(Q), we have dom(Q) # codom(ϕ), which implies α′ ∉ dom(Q) (\underline{6}). We have the following:

Q = (Q_{1}, α ⋄ σ, Q_{2})  by notation
≡^{I} (Q_{1}, α ⋄ σ, α′ = α, Q_{2})  by PE-Free and (6)
≡^{I} (Q_{1}, α′ ⋄ σ, α = α′, Q_{2})  by PE-Swap
≡^{I} (Q_{1}, α′ ⋄ σ, α = α′, Q_{2}[α′/α]) by PE-Mono^{⋆}
≡^{I} (Q_{1}, α′ ⋄ σ, Q_{2}[α′/α], α = α′) by PE-Comm

Let Q′_{1} be (Q_{1}, α′ ⋄ σ, Q_{2}[α′/α], α = α′). We have shown that Q ≡^{I} Q′_{1} (\underline{7}) holds. Applying the induction hypothesis to Q′_{1} and on the renaming ϕ′ = ϕ_{| dom(ϕ)−α}, we get Q′_{1} ≡ ϕ′(Q′_{1})\underline{ϕ′}. This gives Q′_{1} ≡ (Q_{1}, α′ ⋄ σ, ϕ′(Q_{2}[α′/α]), α = α′, \underline{ϕ′}), that is, Q′_{1} ≡ (Q_{1}, α′ ⋄ σ, ϕ(Q_{2}), α = α′, \underline{ϕ′}). Since (α = α′, \underline{ϕ′}) is \underline{ϕ}, we get Q′_{1} ≡ (Q_{1}, α′ ⋄ σ, ϕ(Q_{2}), \underline{ϕ}). Hence, Q′_{1} ≡ ϕ((Q_{1}, α ⋄ σ, Q_{2}))\underline{ϕ} holds by (4) and (5), that is, Q′_{1} ≡ ϕ(Q)\underline{ϕ}. By Property i, we get Q′_{1} ≡^{I} ϕ(Q)\underline{ϕ} (\underline{8}). By PE-Trans, (7), and (8), we get Q ≡^{I} ϕ(Q)\underline{ϕ}, that is, Q ≡ ϕ(Q)\underline{ϕ} by notation and (2).

\underline{Property v}: By induction on the size of dom(Q). If Q is empty, the result is by Eq-Refl. Otherwise, Q is (α⋄σ, Q′) and ϕ is ϕ_{1}∘ϕ′ = ϕ′∘ϕ_{1} (\underline{1}), where dom(ϕ′) = dom(Q′), dom(ϕ_{1}) = {α} and ϕ_{1}(α) = α′. We have

Q_{1}Qϕ(Q)Q_{2}
= (Q_{1}, α ⋄ σ, Q′, α′ ⋄ σ, ϕ(Q′)Q_{2}) by definition
⊑ (Q_{1}, α ⋄ σ, Q′, α′ = α, ϕ(Q′)Q_{2}) by PI-Context-L and I-Hyp or

by PA-Context-L and A-Hyp

= (Q_{1}, α ⋄ σ, Q′\underline{ϕ_{1}^{¬}}ϕ(Q′)Q_{2})  by definition of ϕ_{1}
≡ (Q_{1}, α ⋄ σ, Q′\underline{ϕ_{1}^{¬}}ϕ_{1}^{¬}(ϕ(Q′)Q_{2})) by PE-Mono^{⋆}
= (Q_{1}, α ⋄ σ, Q′\underline{ϕ_{1}^{¬}}ϕ′(Q′)Q_{2})  since ϕ is ϕ_{1} ∘ ϕ′ (from (1))
≡ (Q_{1}, α ⋄ σ, \underline{ϕ_{1}^{¬}}Q′ϕ′(Q′)Q_{2})  by PE-Comm
⊑ (Q_{1}, α ⋄ σ, \underline{ϕ_{1}^{¬}}Q′\underline{ϕ^{′¬}}Q_{2})  by induction hypothesis
≡ (Q_{1}, α ⋄ σ, Q′\underline{ϕ_{1}^{¬}}\underline{ϕ^{′¬}}Q_{2})  by PE-Comm
= (Q_{1}, α ⋄ σ, Q′\underline{ϕ^{¬}}Q_{2})  since ϕ^{¬} is ϕ_{1}^{¬} ∘ ϕ^{′¬} (from (1))
= Q_{1}Q\underline{ϕ^{¬}}Q_{2}

This is the expected result.

Proof of Lemma 3.4.4

By Lemma 2.3.3 (page 70) and (Q) σ_{1} ♢ σ_{2}, we have a derivation of (Q) σ_{1} ♢ σ_{2} (\underline{1}) which is thrifty and follows the restrictions of Lemma 2.3.1. The proof is by induction on the derivation of (1). ∘ Case Eq-Refl: Taking θ = id gives the expected result. ∘ Case Eq-Free: We have two subcases:

Subcase σ_{1} is ∀ (α ⋄ σ) σ_{2}: Then Q_{1} is (α ⋄ σ, Q_{2}) and τ_{2} is τ_{1}. We take θ = id. Then (QQ_{2}) θ(τ_{1}) ≡ τ_{2} holds. Let I be dom(Q_{1}/τ_{1}), that is, dom(Q_{2}/τ_{1}) since α ∉ ftv(∀ (Q_{2}) τ_{1}). This gives I = dom(Q_{2}/τ_{2}), and θ(I) ⊆ dom(Q_{2}/τ_{2}). Moreover, QQ_{1} ≡_{ℓ}^{dom(Q)∪I} QQ_{2}\underline{θ} holds by PE-Comm and PE-Free since α ∉ I and α is not free in any bound of Q_{2}.

Subcase σ_{2} is ∀ (α ⋄ σ) σ_{1}: similar.

∘ Case Eq-Comm: By taking θ = id and by PE-Comm.

∘ Case Eq-Var: We get the expected result by taking θ = id, and by observing that cf(σ_{1}) = cf(σ_{2}).

∘ Case Eq-Mono: By hypothesis, (α ⋄ σ) ∈ Q and (Q) σ ≡ τ holds. Besides, σ_{2} and σ_{1} are τ_{2} and τ_{1} respectively. Consequently, Q_{2} and Q_{1} are ∅. Taking θ = id gives the expected result.

∘ Case R-Context-L, R-Context-Rigid, and R-Context-Flexible: We have σ_{1} = ∀ (α ⋄ σ′_{1}) σ and σ_{2} = ∀ (α ⋄ σ′_{2}) σ. The premise is (Q) σ′_{1} ♢ σ′_{2} (\underline{2}). By hypothesis (Lemma 2.3.1), α ∈ ftv(σ) and nf(σ) is not α. Hence, cf(σ_{1}) is ∀ (α ⋄ σ′_{1}) cf(σ) and cf(σ_{2}) is ∀ (α ⋄ σ′_{2}) cf(σ), thus Q_{1} is (α ⋄ σ′_{1}, Q′) and Q_{2} is (α ⋄ σ′_{2}, Q′). Then we get the expected result by taking θ = id and by rules PE-Context-L, PA-Context-L or PI-Context-L, and (2).

∘ Case A-Equiv: By induction hypothesis and PA-Equiv.

∘ Case I-Hyp and A-Hyp: Then σ_{2} is α, with (α ⋄ σ) ∈ dom(Q). By restrictions of Lemma 2.3.1, we must have σ ∉ T . Hence, Q(α) ∉ T , which is a contradiction since, by hypothesis, nf(σ_{2}) ∈ ϑ implies Q(nf(σ_{2})) ∈ T . Hence, these cases cannot occur.

∘ Case I-Abstract: By induction hypothesis, and by PI-Abstract.

∘ Case R-Trans: By hypothesis, we have (Q) σ_{1} ♢ σ′_{1} (\underline{3}) and (Q) σ′_{1} ♢ σ_{2} (\underline{4}). Additionally, nf(σ_{2}) ∈ ϑ implies Q(nf(σ_{2})) ∈ T (\underline{5}). Besides, nf(σ_{1}) ≠ ⊥ (\underline{6}) by hypothesis. By Property 2.7.7.ii (page 96) and Property 1.5.6.i (page 51) applied to (3) and (6), we get nf(σ′_{1}) ≠ ⊥. By Properties 2.2.2.vi (page 69) and 1.5.6.i (page 51) applied to (4) and (5), nf(σ′_{1}) ∈ ϑ implies Q(nf(σ′_{1})) ∈ T . Let ∀ (Q_{1}) τ_{1} be cf(σ_{1}). By induction hypothesis on (3), there exists an alpha-conversion of cf(σ′_{1}), written ∀ (Q′_{1}) τ′_{1} and a substitution θ_{1} such that we have

(QQ′_{1}) θ_{1}(τ_{1}) ≡ τ′_{1} (\underline{7})  I_{1} =^{△} dom(Q_{1}/τ_{1}) (\underline{8})  dom(θ_{1}) ⊆ I_{1} (\underline{9})
θ_{1}(I_{1}) ⊆ dom(Q) ∪ dom(Q′_{1}/τ′_{1}) (\underline{10}) QQ_{1} ♢_{ℓ}^{dom(Q)∪I_{1}} QQ′_{1}\underline{θ_{1}} (\underline{11})

From (9) and (8), we get dom(θ_{1}) ⊆ dom(Q_{1}) (\underline{12}). By induction hypothesis and (4), there exists an alpha-conversion of cf(σ_{2}), written ∀ (Q_{2}) τ_{2} and a substitution θ_{2} such that we have

(QQ_{2}) θ_{2}(τ′_{1}) ≡ τ_{2} (\underline{13})  I_{2} =^{△} dom(Q′_{1}/τ′_{1}) (\underline{14})  dom(θ_{2}) ⊆ I_{2} (\underline{15})
θ_{2}(I_{2}) ⊆ dom(Q) ∪ dom(Q_{2}/τ_{2}) (\underline{16}) QQ′_{1} ♢_{ℓ}^{dom(Q)∪I_{2}} QQ_{2}\underline{θ_{2}} (\underline{17})

Let ϕ (\underline{18}) be a renaming mapping dom(Q_{2}) to fresh variables (that is, outside the domain dom(QQ_{1}) ∪ dom(Q′_{1})). We have dom(ϕ) ⊆ dom(Q_{2}) (\underline{19}) and ϕ is a renaming of dom(QQ_{2}) (\underline{20}). Let Q′_{2} be ϕ(Q_{2}) and τ′_{2} be ϕ(τ_{2}). We note that ∀ (Q′_{2}) τ′_{2} is an alpha-conversion of ∀ (Q_{2}) τ_{2}, that is, an alpha-conversion of cf(σ_{2}). Let θ′_{2} be ϕ ∘ θ_{2} restricted to I_{2}. By definition, we have dom(θ′_{2}) ⊆ I_{2} (\underline{21}). By Property 1.7.2.i (page 59) applied to (13), we get (Qϕ(Q_{2})) ϕ(θ_{2}(τ′_{1})) ≡ ϕ(τ_{2}), that is, (QQ′_{2}) θ′_{2}(τ′_{1}) ≡ τ′_{2} (\underline{22}). The prefix QQ_{2} is a closed well-formed prefix (\underline{23}). By Property 3.4.2.iv (page 106), (20) and (23), we get QQ_{2} ≡ ϕ(QQ_{2})\underline{ϕ}, that is, QQ_{2} ≡ Qϕ(Q_{2})\underline{ϕ} (\underline{24}). By well-formedness of (17), QQ_{2}\underline{θ_{2}} is well-formed. Hence, dom(θ_{2}) # dom(QQ_{2}) holds (we simply write θ_{2} # QQ_{2} (\underline{25})). From (19) and (25), we get θ_{2} # ϕ (\underline{26}). From (15) and (14), we get dom(θ_{2}) ⊆ dom(Q′_{1}). By definition of ϕ (18), this implies dom(θ_{2}) # codom(ϕ), thus θ_{2} # ϕ(Q_{2}) (\underline{27}) holds. Hence, from (25), (26), and (27), we have θ_{2} # Qϕ(Q_{2})\underline{ϕ} (\underline{28}). Additionally, codom(θ_{2}) ⊆ dom(Q) ∪ dom(Q_{2}) (\underline{29}) holds from (16). By Property 3.4.2.iii (page 106), (28), (25), (29), and (24), we get QQ_{2}\underline{θ_{2}} ≡ Qϕ(Q_{2})\underline{ϕ}\underline{θ_{2}} (\underline{30}). By PE-Free and (30), we get QQ_{2}\underline{θ_{2}} ≡^{dom(Q)∪I_{2}} QQ′_{2}\underline{θ′_{2}} (\underline{31}). By PE-Trans, (17), and (31), we have QQ′_{1} ♢_{ℓ}^{dom(Q)∪I_{2}} QQ′_{2}\underline{θ′_{2}} (\underline{32}). Applying ϕ to (16), we get θ′_{2}(I_{2}) ⊆ dom(Q) ∪ dom(Q′_{2}/τ′_{2}) (\underline{33}). By (21) and (14), we get dom(θ′_{2}) ⊆ dom(Q′_{1}). In summary, we have shown

(QQ′_{2}) θ′_{2}(τ′_{1}) ≡ τ′_{2} (22)  I_{2} =^{△} dom(Q′_{1}/τ′_{1}) (14)  dom(θ′_{2}) ⊆ I_{2} (21)
θ′_{2}(I_{2}) ⊆ dom(Q) ∪ dom(Q′_{2}/τ′_{2}) (33) QQ′_{1} ♢_{ℓ}^{dom(Q)∪I_{2}} QQ′_{2}\underline{θ′_{2}} (32)

Since (11) is well-formed, we have θ_{1} # QQ′_{1} (\underline{34}). By (14), we get I_{2} ⊆ dom(Q′_{1}). Hence, dom(θ_{1}) # dom(Q) ∪ I_{2} (\underline{35}) holds by (34). Thus, by (21), is also gives dom(θ_{1}) # dom(θ′_{2}) (\underline{36}). By (12) and by definition of ϕ (18), we have dom(θ_{1}) # dom(Q′_{2}) (\underline{37}). Hence, we have θ_{1} # QQ′_{2}θ′_{2} (\underline{38}) from (34), (37), and (36). Additionally, codom(θ_{1}) ⊆ dom(Q) ∪ dom(Q′_{1}/τ′_{1}) holds by (10). Hence, by (14), we get codom(θ_{1}) ⊆ dom(Q) ∪ I_{2} (\underline{39}). In summary, we have shown

θ_{1} # QQ′_{1} (34)  θ_{1} # QQ′_{2}\underline{θ′_{2}} (38)  codom(θ_{1}) ⊆ dom(Q) ∪ I_{2} (39)

By Property 3.4.2.iii (page 106) and (32), we get the relation

QQ′_{1}\underline{θ_{1}} ♢_{ℓ}^{dom(Q)∪I_{2}∪dom(θ_{1})} QQ′_{2}\underline{θ′_{2}}\underline{θ_{1}}

(\underline{40}). Additionally, from (10), we have I_{1} ⊆ dom(Q′_{1}/τ′_{1}) ∪ dom(θ_{1}), that is, I_{1} ⊆ I_{2} ∪ dom(θ_{1}). Hence, by Property 3.4.2.i (page 106) applied to (40), we get the relation QQ′_{1}\underline{θ_{1}} ♢_{ℓ}^{dom(Q)∪I_{1}} QQ′_{2}\underline{θ′_{2}}\underline{θ_{1}} (\underline{41}). Then, by transitivity, (11), and (41), we get

QQ_{1} ♢_{ℓ}^{dom(Q)∪I_{1}} QQ′_{2}\underline{θ′_{2}}\underline{θ_{1}} (\underline{42}). Let θ be θ′_{2}∘θ_{1} restricted to I_{1}, so that dom(θ) ⊆ I_{1} (\underline{43}) holds. By Eq-Free and (42), we get QQ_{1} ♢_{ℓ}^{dom(Q)∪I_{1}} QQ′_{2}\underline{θ} (\underline{44}). We have

θ(I_{1}) = θ′_{2} ∘ θ_{1}(I_{1})  by definition
⊆ θ′_{2}(dom(Q) ∪ dom(Q′_{1}/τ′_{1})) by (10).
= dom(Q) ∪ θ′_{2}(dom(Q′_{1}/τ′_{1})) since dom(θ′_{2}) # dom(Q) by (21).
= dom(Q) ∪ θ′_{2}(I_{2})  by (14).
⊆ dom(Q) ∪ dom(Q′_{2}/τ′_{2})  by (33).

Consequently, we have θ(I_{1}) ⊆ dom(Q) ∪ dom(Q′_{2}/τ′_{2}) (\underline{45}).

We have ftv(τ_{1}) ⊆ dom(Q)∪dom(Q_{1}/τ_{1}). Hence, ftv(θ_{1}(τ_{1})) ⊆ dom(Q)∪θ_{1}(I_{1}), that is, by (10), ftv(θ_{1}(τ_{1})) ⊆ dom(Q) ∪ I_{2}. Additionally, ftv(τ′_{1}) ⊆ dom(Q) ∪ dom(Q′_{1}/τ′_{1}), that is, ftv(τ′_{1}) ⊆ dom(Q) ∪ I_{2} by (14). Hence, from (7), (32) and Lemma 3.4.3, we get (QQ′_{2}\underline{θ′_{2}}) θ_{1}(τ_{1}) ≡ τ′_{1}. By R-Context-R, we get (QQ′_{2}) θ′_{2}(θ_{1}(τ_{1})) ≡ θ′_{2}(τ′_{1}), that is, (QQ′_{2}) θ(τ_{1}) ≡ θ′_{2}(τ′_{1}). By R-Trans and (22), we get (QQ′_{2}) θ(τ_{1}) ≡ τ′_{2} (\underline{46}).

We have the expected result, that is, (46), (8), (43), (45) and (44).

∘ Case I-Bot: We have σ_{1} = ⊥, thus nf(σ_{1}) is ⊥ and this case is not possible by hypothesis.

∘ Case I-Rigid: By taking θ = id and by PI-Rigid.

∘ Case R-Context-R: We have σ_{1} = ∀ (α⋄σ) σ′_{1} and σ_{2} = ∀ (α⋄σ) σ′_{2}. The premise is (Q, α ⋄ σ) σ′_{1} ♢ σ′_{2} (\underline{47}). We proceed by case analysis:

Subcase nf(σ′_{1}) = α and nf(σ′_{2}) = α: Hence, cf(σ_{1}) is cf(σ) and cf(σ_{2}) is cf(σ), thus we get the expected result by taking θ = id.

Subcase nf(σ′_{1}) ≠ α and nf(σ′_{2}) = α is not possible since the derivation is thrifty.

Subcase nf(σ′_{1}) = α and nf(σ′_{2}) ≠ α is not possible since the derivation is thrifty.

Otherwise nf(σ′_{1}) ≠ α and nf(σ′_{2}) ≠ α (\underline{48}): By definition, cf(σ_{1}) is ∀ (α ⋄ σ) cf(σ′_{1}) and cf(σ_{2}) is ∀ (α ⋄ σ) cf(σ′_{2}). If we have nf(σ′_{1}) = ⊥, then nf(σ_{1}) is ⊥, which is not possible by hypothesis. Hence, nf(σ′_{1}) ≠ ⊥. If we have nf(σ′_{2}) ∈ dom(Q, α ⋄ σ), and (Q, α ⋄ σ)(nf(σ′_{2})) ∉ T , then, either nf(σ′_{2}) ∈ dom(Q) (\underline{49}) and Q(nf(σ′_{2})) ∉ T (\underline{50}), or nf(σ′_{2}) is α. The latter is not possible by (48). In the former case, we have nf(σ_{2}) = nf(σ′_{2}), thus (49) and (50) give nf(σ_{2}) ∈ dom(Q) and Q(nf(σ_{2})) ∉ T , which is not possible by hypothesis. Hence, nf(σ′_{2}) ∉ dom((Q, α ⋄ σ)), or (Q, α ⋄ σ)(nf(σ′_{2})) ∈ T . We have cf(σ_{1}) = ∀ (α ⋄ σ) ∀ (Q′_{1}) τ_{1}. By induction hypothesis on (47), there exists an alpha-conversion of cf(σ′_{2}) written ∀ (Q′_{2}) τ_{2} and a substitution θ such that

(Q, α ⋄ σ, Q′_{2}) θ(τ_{1}) ≡ τ_{2}  I =^{△} dom(Q′_{1}/τ_{1})  dom(θ) ⊆ I

θ(I) ⊆ dom(Q) ∪ \{α\} ∪ dom(Q′_{2}/τ_{2}) (Q, α ⋄ σ, Q′_{1}) ♢_{ℓ}^{dom(Q)∪\{α\}∪I}(Q, α ⋄ σ, Q′_{2})\underline{θ} (\underline{51})

Let Q_{1} be (α ⋄ σ, Q′_{1}) and Q_{2} be (α ⋄ σ, Q′_{2}). The constructed form of σ_{1} is ∀ (Q_{1}) τ_{1} and ∀ (Q_{2}) τ_{2} is an alpha-conversion of cf(σ_{2}). By defining I′ =^{△} dom(Q_{1}/τ_{1}), we have I ⊆ I′ ⊆ I ∪ \{α\} (\underline{52}). We immediately have

(QQ_{2}) θ(τ_{1}) ≡ τ_{2}  I′ =^{△} dom(Q_{1}/τ_{1})  dom(θ) ⊆ I′
θ(I′) ⊆ dom(Q) ∪ dom(Q_{2}/τ_{2}) (QQ_{1}) ♢_{ℓ}^{dom(Q)∪I′}(QQ_{2})\underline{θ} (\underline{53})

We get (53) from (51) by using Property 3.4.2.i (page 106) and (52).

Proof of Lemma 3.4.7

\underline{Directly}, (Q) σ_{1} ⊑ σ_{2} holds by hypothesis, and Q is unconstrained. Besides, σ_{1} and σ_{2} are ML types. We proceed by case analysis: ∘ Case nf(σ_{1}) is ⊥: Then σ_{1} is necessarily of the form ∀ (Q_{1}) α_{1}, with α_{1} ∈ dom(Q_{1}) and Q_{1} is an unconstrained prefix. In ML, σ_{1} is written ∀ (ᾱ) ∀ (α) α, and we have σ_{1} ⊑_{ML} σ_{2}, provided σ_{2} is an ML type. ∘ Case σ_{1} is in V: We have nf(σ_{1}) = α. Necessarily, σ_{1} is of the form ∀ (ᾱ) α with α ∉ ᾱ. By Lemma 2.1.6, (Q) σ_{2} ≡ α holds. Thus Q̂(α) is a rearrangement of Q̂(nf(σ_{2})) by Lemma 1.5.9. Observing that Q̂ = id, we get nf(σ_{2}) = α. Hence, σ_{2} is of the form ∀ (β̄) α with α ∉ β̄. Consequently, σ_{1} and σ_{2} are equivalent in ML. ∘ Case σ_{2} is in V: We assume nf(σ_{1}) is not ⊥ and σ_{1} is not in V. By Properties 2.1.5.ii and 2.1.5.iii (page 67), σ_{1}/ϵ is a type constructor g. Hence, (∀ (Q) σ_{1})/ϵ is g. Since Q is unconstrained and σ_{2} ∈ V, we have (∀ (Q) σ_{2})/ϵ = ⊥. This is a contradiction by Property 2.1.3.ii (page 65). Hence, this case cannot occur. ∘ Case σ_{2} is not in constructed form: Necessarily, σ_{2} is of the form ∀ (ᾱ) α, with α ∈ ᾱ. Hence, σ_{2}/ϵ is ⊥. By Property 2.1.3.ii (page 65), we must have σ_{1}/ϵ = ⊥ or σ_{1}/ϵ = α with α ∈ dom(Q). In the first case, nf(σ_{1}) is ⊥ by Property 2.1.5.iii (page 67) and Property 1.5.11.i (page 54), thus this case has already been solved above. In the second case, σ_{1} ≡ α by Property 2.1.5.ii (page 67), thus σ_{1} ∈ T by Property 1.5.11.x (page 54) and (Q) σ_{1} ≡ σ_{2} holds by Lemma 2.1.6. Thus, Q̂(σ_{1}) ≡ Q̂(σ_{2}) holds by Corollary 1.5.10. Observing that Q̂ is id, we get σ_{1} ≡ σ_{2}, which is a contradiction with Property 1.5.4.i (page 50). ∘ Otherwise: σ_{1} is of the (constructed) form ∀ (Q_{1}) τ_{1}, where Q_{1} is unconstrained. Besides, σ_{2} is in constructed form too. By Lemma 3.4.4, there exists an alphaconversion of σ_{2}, written ∀ (Q_{2}) τ_{2}, and a substitution θ such that (QQ_{2}) θ(τ_{1}) ≡ τ_{2} holds, with dom(θ) ⊆ dom(Q_{1}). Observing that QQ_{2} is unconstrained, we get θ(τ_{1}) = τ_{2} by Property 1.5.11.vii (page 54). Let ᾱ be dom(Q_{1}) and β̄ be dom(Q_{2}). We can write θ in the form [τ̄/ᾱ]. Hence, σ_{2} is ∀ (β̄) τ_{1}[τ̄/ᾱ] (up to renaming) As a consequence, σ_{2} is an instance of σ_{1} in ML.

\underline{Conversely}, σ_{2} is by hypothesis an instance of σ_{1}. This means that σ_{1} is ∀ (ᾱ) τ and σ_{2} is ∀ (β̄) τ[τ̄′/ᾱ]. We can derive (Q) σ_{1} ⊑ σ_{2} by rules R-Context-Flexible, I-Bot and Eq-Mono^{⋆}.

Proof of Lemma 3.5.2

By induction on the size of Q. If Q is ∅, then necessarily ᾱ = ∅, and the algorithm returns the pair (∅, ∅), which is correct. Otherwise, Q is of the form Q′q (\underline{1}), where q is (α ⋄ σ). We consider two cases: ∘ Case α ∉ ᾱ: Let (Q′_{1}, Q′_{2}) be Q′↑ᾱ. By definition, we have Q_{1} = Q′_{1} (\underline{2}) and Q_{2} = (Q′_{2}q) (\underline{3}). By induction hypothesis, we have Q′_{1}Q′_{2} ≈ Q′ (\underline{4}), ᾱ ⊆ dom(Q′_{1}) (\underline{5}), as well as dom(Q′_{1}/ᾱ) = dom(Q′_{1}) (\underline{6}). Then Q′_{1}Q′_{2}q ≈ Q′q holds from (4), (1), (2), and (3), that is, Q_{1}Q_{2} ≈ Q (i). By (2), (5) and (6), we have ᾱ ⊆ dom(Q_{1}) and dom(Q_{1}/ᾱ) = dom(Q_{1}), which is the expected result (ii) and (iii).

∘ Case α ∈ ᾱ: Let β̄ be (ᾱ − α) ∪ ftv(σ). By definition 3.3.1 and (1), we have dom(Q/ᾱ) = α ∪ dom(Q′/β̄) (\underline{7}). Let (Q′_{1}, Q′_{2}) be Q′↑β̄. By definition, we have Q_{1} = Q′_{1}q (\underline{8}) and Q_{2} = Q′_{2} (\underline{9}). By induction hypothesis, Q′_{1}Q′_{2} ≈ Q′ (\underline{10}), β̄ ⊆ dom(Q′_{1}) (\underline{11}) and dom(Q′_{1}/β̄) = dom(Q′_{1}) (\underline{12}). We have ftv(σ) ⊆ β̄. Hence, by (11), ftv(σ) ⊆ dom(Q′_{1}), which implies ftv(σ) # dom(Q′_{2}). Hence, we have Q′_{1}qQ′_{2} ≈ Q′_{1}Q′_{2}q, thus Q′_{1}qQ′_{2} ≈ Q′q holds from (10), that is, Q_{1}Q_{2} ≈ Q (i) from (8) and (9). From (11), we have ᾱ ⊆ dom(Q′_{1}) ∪ {α}, that is, ᾱ ⊆ dom(Q_{1}) (ii). Finally, dom(Q/ᾱ) is dom(Q′_{1}qQ′_{2}/ᾱ) (\underline{13}) by Property 3.3.2.ii (page 104) and (i). Besides, dom(Q′_{1}qQ′_{2}/ᾱ) is dom(Q′_{1}q/ᾱ) (\underline{14}) since ᾱ # dom(Q′_{2}). Similarly, dom(Q′/β̄) is dom(Q′_{1}/β̄) (\underline{15}).

Thus, we can prove the following sequence of equalities:

dom(Q_{1}/ᾱ) = dom(Q′_{1}q/ᾱ)  by (8)
= dom(Q′_{1}qQ′_{2}/ᾱ) by (14)
= dom(Q/ᾱ)  by (13)
= α ∪ dom(Q′/β̄) by (7)
= α ∪ dom(Q′_{1}/β̄) by (15)
= α ∪ dom(Q′_{1})  by (12)
= dom(Q_{1})  by (8)

This is the expected result (iii).

Proof of Lemma 3.6.2

By hypothesis, we have Q ♢^{I} Q′ (\underline{1}). Let (Q_{1}, Q′_{0}) be Q↑I. By Lemma 3.5.2, Q_{1}Q′_{0} (\underline{2}) is a rearrangement of Q, I ⊆ dom(Q_{1}) (\underline{3}) and dom(Q_{1}/I) = dom(Q_{1}) (\underline{4}). We get dom(Q/I) = dom(Q_{1}) (\underline{5}) from (4) and (2). From (2), we get dom(Q′_{0}) # dom(Q_{1}), which implies dom(Q′_{0}) # dom(Q/I) (\underline{6}) by (5) as well as dom(Q′_{0}) # I (\underline{7}) by (3). We have Q ≡^{I} Q_{1} by (2), Property 3.2.2.ii (page 103), PE-Free, and (7). Thus Q_{1} ♢^{I} Q′ (\underline{8}) holds from (1) and R-Trans. Moreover, dom(Q/I) # dom(Q′_{0}) holds from (2) and (5). Let ϕ be a renaming of dom(Q′) disjoint from I such that dom(ϕ(Q′))∩ dom(Q_{1}) = I and ϕ(Q′) # Q′_{0} (\underline{9}). By Lemma 3.6.1 (page 113) and (8), there exists a substitution θ such that Q_{1} ♢^{J} ϕ(Q′)\underline{θ} (\underline{10}) holds, where J is dom(Q_{1}/I), that is dom(Q_{1}) (\underline{11}) by (4). Additionally, we have dom(θ) ⊆ J − I, which implies dom(θ) # I (\underline{12}) and dom(θ) # dom(Q′_{0}) (\underline{13}) by (11) and (2). We have Q_{1} ♢ ϕ(Q′)\underline{θ} (\underline{14}) from (10) and (11). By Property 3.4.2.iii (page 106), (9), (13), and (14) we get Q_{1}Q′_{0} ♢ ϕ(Q′)\underline{θ}Q′_{0} (\underline{15}). We define Q_{0} as \underline{θ}Q′_{0} (\underline{16}). Note that dom(Q_{0}) # I (\underline{17}) by (7) and (12). From (15), (2), and (16), we get Q ♢ ϕ(Q′)Q_{0} (\underline{18}). Finally, we have Q′ ≡ ϕ(Q′)\underline{ϕ} by Property 3.4.2.iv (page 106). Since ϕ is disjoint from I, we get Q′ ≡^{I} ϕ(Q′) (\underline{19}) by PE-Free. Besides we have ϕ(Q′)Q_{0} ≡^{I} ϕ(Q′) (\underline{20}) by PE-Free and (17). Hence, by PE-Trans, (19), and (20), we get Q′ ≡^{I} ϕ(Q′)Q_{0} (\underline{21}). We have shown the expected results, namely, (18), (17), (21), (16), and (6).

Proof of Property 3.6.3

We prove each property independently.

\underline{Property i}: By hypothesis, (Q, α ⋄ σ) σ_{1} ♢ σ_{2} holds. Hence, (Q) ∀ (α ⋄ σ) σ_{1} ♢ ∀ (α ⋄ σ) σ_{2} holds by R-Context-R. We conclude by R-Trans and observing that (Q) ∀ (α ⋄ σ) σ_{1} ≡ σ_{1} and (Q) ∀ (α ⋄ σ) σ_{2} ≡ σ_{2} hold by Eq-Free.

\underline{Property ii}: We prove by induction that for any Q, Q_{0}, σ_{1} and σ_{2}, if (Q, α ≥ τ, Q_{0}) σ_{1} ♢ σ_{2} holds, then (Q, α = τ, Q_{0}) σ_{1} ♢ σ_{2} holds too. Equivalence cases are discarded since ♢ is ⊏ − or ⊑. Cases R-Trans, R-Context-Rigid, R-Context-Flexible and I-Abstract are by induction hypothesis. Cases I-Bot and I-Rigid do not read the prefix, thus (Q, α = τ, Q_{0}) σ_{1} ⊑ σ_{2} still holds. ∘ Case R-Context-R we have σ_{1} = ∀ (β⋄σ) σ′_{1} and σ_{2} = ∀ (β⋄σ) σ′_{2}. By hypothesis, (Q, α≥τ, Q_{0}, β⋄σ) σ′_{1} ♢ σ′_{2} holds. By induction hypothesis, (Q, α=τ, Q_{0}, β⋄σ) σ′_{1} ♢ σ′_{2} holds too. Hence, (Q, α = τ, Q_{0}) σ_{1} ♢ σ_{2} holds by R-Context-R. ∘ Case A-Hyp: Then σ_{2} = β. If β is not α, the result is immediate. Otherwise, (Q, α ⋄ τ, Q_{0}) τ ⊏ − α holds by Eq-Mono. ∘ Case I-Hyp: similar.

\underline{Remark} that we do not read the prefix, except in the last two cases. As a consequence, we use the same proof structure for the next properties, and we only need to show the result for cases A-Hyp and I-Hyp.

\underline{Property iii}: We have (Q, α ⋄ σ, α′ = α, Q_{0}) σ_{1} ♢ σ_{2}.

∘ Case A-Hyp: We have σ_{2} = β. If β is neither α nor α′, we get the result by A-Hyp. If β is α, we have σ_{1} = σ, and (Q, α′ ⋄ σ, α = α′, Q_{0}) σ_{1} ⊏ − α′ holds by A-Hyp, thus (Q, α′ ⋄ σ, α = α′, Q_{0}) σ_{1} ⊏ − α holds by R-Trans, Eq-Mono and A-Equiv. If β is α′, we have σ_{1} = α, and (Q, α′ ⋄ σ, α = α′, Q_{0}) σ_{1} ⊏ − α′ holds by Eq-Mono.

∘ Case I-Hyp: similar.

\underline{Property iv}: We have (Q) σ ≡ σ′ (\underline{1}) and (Q, α ⋄ σ, Q_{0}) σ_{1} ♢ σ_{2}. As explained above, we only need to consider cases A-Hyp and I-Hyp. In both cases, σ_{2} is a variable β.

∘ Case A-Hyp: If β is not α, the result is by A-Hyp. Otherwise, we have σ_{1} = σ and ⋄ is =. We have (Q, α ⋄ σ′, Q_{0}) σ ≡ σ′ (\underline{2}) from (1) and Property 1.5.3.v (page 49). Additionally, (Q, α ⋄ σ′, Q_{0}) σ′ ⊏ − α (\underline{3}) holds by A-Hyp. Hence, (Q, α ⋄ σ′, Q_{0}) σ ⊏ − α holds by A-Equiv, R-Trans, (2), and (3).

∘ Case I-Hyp: similar.

\underline{Property v}: We have (Q) σ ⊏ − σ′ (\underline{1}) and (Q, α = σ, Q_{0}) σ_{1} ♢ σ_{2}.

∘ Case A-Hyp: We have σ_{2} = β. If β is not α, we get the result by A-Hyp. Otherwise, σ_{1} is σ. By Property 1.7.2.iii (page 59), (Q, α = σ′, Q_{0}) σ ⊏ − σ′ (\underline{2}) holds from (1). Hence, (Q, α = σ′, Q_{0}) σ ⊏ − α holds by R-Trans, (2), and A-Hyp.

∘ Case I-Hyp: We have σ_{2} = β. We cannot have β = α, since the binding of α is rigid. Thus, we get the result by I-Hyp.

\underline{Property vi}: We have (Q) σ ⊑ σ′ (\underline{1}) and (Q, α ≥ σ, Q_{0}) σ_{1} ♢ σ_{2}.

∘ Case A-Hyp: We have σ_{2} = β. We cannot have β = α, since the binding of α is flexible. Thus, we get the result by A-Hyp.

∘ Case I-Hyp: We have σ_{2} = β. If β is not α, we get the result by I-Hyp. Otherwise, σ_{1} is σ. By Property 1.7.2.iii (page 59) and (1), (Q, α≥σ′, Q_{0}) σ ⊑ σ′ (\underline{2}) holds. Hence, (Q, α ≥ σ′, Q_{0}) σ ⊑ α holds by R-Trans, (2), and I-Hyp.

\underline{Property vii}: We have (Q, α ≥ σ, Q_{0}) σ_{1} ♢ σ_{2}.

∘ Case A-Hyp: We have σ_{2} = β. We cannot have β = α, since the binding of α is flexible. Thus, we get the result by A-Hyp.

∘ Case I-Hyp: We have σ_{2} = β. If β is not α, we get the result by I-Hyp. Otherwise, σ_{1} is σ. By A-Hyp, we can derive (Q, α = σ, Q_{0}) σ_{1} ⊏ − α. Then by I-Abstract, we get (Q, α = σ, Q_{0}) σ_{1} ⊑ α. This is the expected result.

Proof of Lemma 3.6.4

If ♢ is ≡, then we get the result by Lemma 3.4.3. Otherwise, ♢ is ⊏ − or ⊑. The proof is by induction on the derivation of Q_{1} ♢^{I} Q_{2}. Cases PE-Trans, PA-Trans, PI-Trans, PA-Equiv, PI-Abstract are by induction hypothesis. Case PE-Refl is immediate. Other cases are: ∘ Case PE-Free: If Q_{1} is (Q_{2}, α⋄σ), we get the result by Property 3.6.3.i (page 114). If Q_{2} is (Q_{1}, α ⋄ σ), we get the result by Property 1.7.2.iii (page 59). ∘ Case PE-Mono: Direct consequence of Property 3.6.3.ii (page 114). ∘ Case PE-Context-L: Direct consequence of Property 3.6.3.iv (page 114). ∘ Case PE-Swap: Direct consequence of Property 3.6.3.iii (page 114). ∘ Case PE-Comm: Direct consequence of Property 1.7.2.ii (page 59). ∘ Case PA-Context-L: Direct consequence of Property 3.6.3.v (page 114). ∘ Case PI-Context-L: Direct consequence of Property 3.6.3.vi (page 114). ∘ Case PI-Rigid: Direct consequence of Property 3.6.3.vii (page 114).

Proof of Lemma 3.6.6

We have the hypotheses

(Q) σ_{1} ⊑ σ_{2} (\underline{1})  (Q) σ_{2} ⊑ σ_{3} (\underline{2})  (Q) σ_{1} ⊏ − σ_{3} (\underline{3})

We consider two cases: ∘ Case Q̂(nf(σ_{3})) ∉ V: Then we have Q̂(nf(σ_{2})) ∉ V by Lemmas 2.1.6, (2), and 1.5.9. We have ∀ (Q) σ_{1}/ ⩽_{/} ∀ (Q) σ_{2}/ ⩽_{/} ∀ (Q) σ_{3}/ by Property 2.1.3.ii (page 65), (1), and (2). We have ∀ (Q) σ_{1}/ = ∀ (Q) σ_{3}/ by Property 2.1.3.i (page 65) and (3). Hence, by antisymmetry (Property 2.1.2.i (page 65)), we get ∀ (Q) σ_{1}/ = ∀ (Q) σ_{2}/ = ∀ (Q) σ_{3}/. We have w(σ_{1}) ⩾ w(σ_{2}) ⩾ w(σ_{3}) by Property 2.7.6.i (page 94), (1), and (2). We have X ∉ w(σ_{1}) − w(σ_{3}) by Lemma 2.7.8 and (3), thus we get X ∉ w(σ_{1}) − w(σ_{2}) and X ∉ w(σ_{2}) − w(σ_{3}) by Property 2.7.2.iv (page 87). Hence, by Lemma 2.7.8 and (1), we get (Q) σ_{1} ⊏ − σ_{2}. Similarly, by Lemma 2.7.8 and (2), we get (Q) σ_{2} ⊏ − σ_{3}. ∘ Case Q̂(nf(σ_{3})) = α (\underline{4}): Note that necessarily Q̂(α) = α (\underline{5}) holds, because Q̂ is idempotent. We consider two subcases.

Subcase σ_{2} ∈ V: Then (Q) σ_{2} ≡ σ_{3} (\underline{6}) holds by Lemma 2.1.6, thus (Q) σ_{1} ⊏ − σ_{2} holds by A-Equiv, R-Trans, (6) and (3). Besides, (Q) σ_{2} ⊏ − σ_{3} holds by A-Equiv and (6).

Subcase nf(σ_{2}) ∉ ϑ: Then we have σ_{2} ∉ V (\underline{7}). If we have σ_{1} ∈ V, then by (1), (2), and Lemma 2.1.6, we get (Q) σ_{1} ≡ σ_{2} and (Q) σ_{2} ≡ σ_{3}, which leads to the expected result by A-Equiv. Now, we assume σ_{1} ∉ V (\underline{8}). From (2), we get (Q) σ_{2} ⊑ Q̂(nf(σ_{3})) by Eq-Mono, Property 1.5.6.i (page 51), and I-Equiv^{⋆}.

Hence, we have (Q) σ_{2} ⊑ α (\underline{9}) from (4). Let (α ⋄ σ) be the binding of α in Q (\underline{10}). We get by Corollary 2.3.4, (10), (7), and (9) (Q) σ_{2} ⊑ σ (\underline{11}). From (4), we have (Q) σ_{3} ≡ α (\underline{12}) by Eq-Mono and Property 1.5.6.i. Hence, by (3) and R-Trans, we get (Q) σ_{1} ⊏ − α (\underline{13}). By Corollary 2.3.4, (10), (8), and (13), we get (Q) σ_{1} ⊏ − σ (\underline{14}) and ⋄ is rigid, that is, (α=σ) ∈ Q (\underline{15}). We have Q̂(nf(σ)) ∉ V (\underline{16}) by (15) and (5). In summary, we have shown (Q) σ_{1} ⊑ σ_{2} from (1), (Q) σ_{2} ⊑ σ from (11), and (Q) σ_{1} ⊏ − σ from (14). Hence, thanks to (16), we fall back in the first case. As a consequence, we have (Q) σ_{1} ⊏ − σ_{2} (\underline{17}) and (Q) σ_{2} ⊏ − σ (\underline{18}).

By A-Hyp and (15), we get (Q) σ ⊏ − α (\underline{19}). By R-Trans, (18), and (19), we get (Q) σ_{2} ⊏ − α (\underline{20}). By R-Trans, (20) and (12), we get (Q) σ_{2} ⊏ − σ_{3}. With (17), this is the expected result.

Proof of Lemma 3.6.7

By hypothesis, we have (Q) ∀ (α) σ ⊏ − σ′, where Q is unconstrained and binds the free variables of ∀ (α) σ and σ′. By Property 2.6.2.i (page 85), there exists a derivation of (Q) ∀ (α) σ (≡ ˙⊏ −^{∅})^{∗} σ′. More precisely, there exist σ_{1}, … σ_{n}, such that σ_{1} = ∀ (α) σ, σ_{n} = σ′, and (Q) σ_{i} (≡ ˙⊏ −^{∅}) σ_{i+1} for i ∈ [1..n[. We prove the following property (where Q is unconstrained):

If we have σ_{a} ≡ ∀ (α) σ′_{a} and (Q) σ_{a} (≡ ˙⊏ −^{∅}) σ_{b}, then there exists σ′_{b} such
that σ_{b} ≡ ∀ (α) σ′_{b} and (Q, α) σ′_{a} ⊏ − σ′_{b}.

Proof: By hypothesis, we have σ_{a} ≡ ∀ (α) σ′_{a} (\underline{1}) and (Q) σ_{a} (≡ ˙⊏ −^{∅}) σ_{b}. By definition, either σ_{a} ≡ σ_{b} (the result is immediate, then), or there exist σ_{c} and σ_{d} such that we have

σ_{a} ≡ σ_{c} (\underline{2})  (Q) σ_{c} ˙⊏ −ᾱ σ_{d} (\underline{3})  σ_{d} ≡ σ_{b} (\underline{4}).

Hence, we have σ_{c} ≡ ∀ (α) σ′_{a} (\underline{5}) by R-Trans, (1) and (2). We can choose α such that α ∉ ftv(σ_{b}). If α ∉ ftv(σ′_{a}), then σ_{c} ≡ σ′_{a}, thus taking σ′_{b} = σ_{b} is appropriate. Hence, we assume that α ∈ ftv(σ′_{a}) (\underline{6}). By Property 2.6.3.i (page 86) on (3), there exists σ′_{d} such that (Q) nf(σ_{c}) ˙⊏ −ᾱ σ′_{d} (\underline{7}) and σ′_{d} ≡ σ_{d} (\underline{8}). By Property 1.5.11.i (page 54) on (5), nf(σ_{c}) is a rearrangement of nf(∀ (α) σ′_{a}). By Property 2.6.3.ii (page 86) applied to (7), there exists σ′′_{d} such that we have (Q) nf(∀ (α) σ′_{a}) ˙⊏ −ᾱ σ′′_{d} (\underline{9}) and σ′′_{d} ≡ σ′_{d} (\underline{10}). By R-Trans, (10), (8), and (4), we get σ′′_{d} ≡ σ_{b} (\underline{11}). If σ′_{a} ≡ α, then nf(∀ (α) σ′_{a}) is ⊥. This is a contradiction with (9) since no rule can be used to derive (Q) ⊥ ˙⊏ −ᾱ σ′′_{d} (note that the prefix is unconstrained). Hence, σ′_{a} is not equivalent to α. From (6), we get nf(∀ (α) σ′_{a}) = ∀ (α) nf(σ′_{a}). Hence, (Q) ∀ (α) nf(σ′_{a}) ˙⊏ −ᾱ σ′′_{d} (\underline{12}) holds from (9). Moreover, (12) is derived by StSh-Up or StSh-Alias (indeed, the prefix is unconstrained). Hence, ∀ (α) nf(σ′_{a}) is of the form C_{r}(σ_{0}) and σ′′_{d} is of the form C_{r}(σ′_{0}).

Necessarily, C_{r} is ∀ (α) C′_{r} and C′_{r}(σ_{0}) = nf(σ′_{a}) (\underline{13}). The premises of StSh-Up or StSh-Alias are independent of C_{r} and Q. Hence, (Q, α) C′_{r}(σ_{0}) ˙⊏ −ᾱ C′_{r}(σ′_{0}) (\underline{14}) holds too. Let σ′_{b} be C′_{r}(σ′_{0}). Then σ′′_{d} is ∀ (α) σ′_{b} (\underline{15}) and (14) gives (Q, α) C′_{r}(σ_{0}) ˙⊏ −ᾱ σ′_{b}. By Property 2.6.2.i (page 85), we get (Q, α) C′_{r}(σ_{0}) ⊏ − σ′_{b} (\underline{16}). From (16), (13), and Property 1.5.6.i (page 51), we get (Q, α) σ′_{a} ⊏ − σ′_{b}. From (11) and (15), we get σ_{b} ≡ ∀ (α) σ′_{b}. This is the expected result. □

The lemma is then proved by induction on i.

Proof of Lemma 3.6.8

By induction on the size of Q. By hypothesis, Q is of the form (Q_{1}, α ⋄ σ_{a}, Q_{2}). If σ_{a}/u is defined and is ⊥, then we get the expected result by taking β = α, u_{1} = ϵ, and u_{2} = u. Otherwise, there exist v_{1} and v_{2} such that u = v_{1}v_{2} and σ_{a}/v_{1} = β (\underline{1}) with β ∈ dom(Q_{1}). Then ∀ (Q_{1}) β/v_{2} = ⊥. By induction hypothesis, Q_{1} is of the form (Q_{11}, γ ⋄ σ_{c}, Q_{12}), v_{2} is of the form w_{1}w_{2} such that ∀ (Q_{12}) β/w_{1} = γ (\underline{2}) and σ_{c}/w_{2} = ⊥ (\underline{3}). Then Q is of the form (Q_{11}, γ ⋄ σ_{c}, Q_{12}, α ⋄ σ_{a}, Q_{2}), u is of the form v_{1}w_{1}w_{2} such that

∀ (Q_{12}, α ⋄ σ_{a}, Q_{2}) α/v_{1}w_{1} = ∀ (Q_{12}) σ_{a}/v_{1}w_{1}
= ∀ (Q_{12}) β/w_{1}  from (1)
= γ  from (2)

Additionally, σ_{c}/w_{2} = ⊥ holds from (3). This is the expected result.

Proof of Lemma 3.6.9

By hypothesis, we have

σ_{2} ∈ Σ_{I} (\underline{1})  σ_{2} ∉ V (\underline{2})  (Q) σ_{1} ⊑ σ_{2} (\underline{3})  Q ⊑^{I} Q′ (\underline{4})  (Q′) σ_{1} ⊏ − σ_{2} (\underline{5})

We first show that ∀ (Q) σ_{1}/ = ∀ (Q) σ_{2}/ holds. By Property 2.1.3.ii (page 65) applied to (3), we have ∀ (Q) σ_{1} ⩽_{/} ∀ (Q) σ_{2} (\underline{6}). By Definition 3.2.1 (page 103), (4), and (1), we get ∀ (Q) σ_{2} ⊑ ∀ (Q′) σ_{2} (\underline{7}). By Property 2.1.3.ii (page 65) applied to (7), we get ∀ (Q) σ_{2} ⩽_{/} ∀ (Q′) σ_{2} (\underline{8}). By Property 2.1.3.i (page 65) applied to (5), we get ∀ (Q′) σ_{1}/ = ∀ (Q′) σ_{2}/(\underline{9}). Let u be an occurrence in dom(∀ (Q) σ_{1}) such that (∀ (Q) σ_{1})/u ≠ (∀ (Q) σ_{2})/u. By definition of ⩽_{/} and (6), we have (∀ (Q) σ_{1})/u = ⊥ and (∀ (Q) σ_{2})/u = g (\underline{10}), where g is not ⊥. Can u be in dom(σ_{1})? We would have σ_{1}/u = ⊥, thus ∀ (Q′) σ_{1}/u = ⊥ (\underline{11}). However, we have ∀ (Q′) σ_{2}/u = g by (10) and (8). This is a contradiction with (11) and (9). Consequently, u is not in dom(σ_{1}), which means that it is of the form u_{1}u_{2} (\underline{12}) with σ_{1}/u_{1} = α (\underline{13}) and ∀ (Q) α/u_{2} = ⊥. By Lemma 3.6.8 (page 115), Q is of the form (Q_{1}, β ⋄σ_{b}, Q_{2}) (\underline{14}) and u_{2} is of the form v_{1}v_{2} (\underline{15}) such that ∀ (Q_{2}) α/v_{1} = β (\underline{16}) and σ_{b}/v_{2} = ⊥ (\underline{17}). Note that σ_{b} is not in T by Property 2.1.5.i (page 67). We have (∀ (Q_{2}) σ_{1}/u_{1}v_{1}) = β by (13) and (16). Thus, by Lemma 2.1.4 applied to (3), we get (∀ (Q_{2}) σ_{2})/u_{1}v_{1} = β (\underline{18}). Hence, (∀ (Q) σ_{2})/u = ⊥ holds from (12), (15), (18), (14), and (17). This is a contradiction with (10). In summary, we have shown by way of contradiction that ∀ (Q) σ_{1}/ = ∀ (Q) σ_{2}/ (\underline{19}) holds. By Lemma 2.7.8, (2), and (5), we get X ∉ w(σ_{1}) − w(σ_{2}) (\underline{20}). By Lemma 2.7.8, (2), (3), (19), and (20), we get (Q) σ_{1} ⊏ − σ_{2}.

Proof of Lemma 3.6.10

By hypothesis, Q_{1} ⊑^{I} Q_{2} holds. By Lemma 3.6.1 (page 113), there exists a renaming ϕ on dom(Q_{2}) and a substitution θ′ invariant on I such that J = dom(Q_{1}/I) and Q_{1} ⊑^{J} ϕ(Q_{2})\underline{θ′} (\underline{1}) hold. We have (Q_{1}) ∇_{I} ≡ Q̂_{1}(∇_{I}) by Eq-Mono. By Lemma 3.6.4 and (1), we get (ϕ(Q_{2})\underline{θ′}) ∇_{I} ≡ Q̂_{1}(∇_{I}). By Property 1.5.11.vii (page 54), we have

{ \atop ϕ(Q_{2})} ∘ θ′(∇_{I}) = { \atop ϕ(Q_{2})} ∘ θ′ ∘ Q̂_{1}(∇_{I}) (\underline{2}). Let θ_{0} be { \atop ϕ(Q_{2})} ∘ θ′. Since θ′ is invariant

on I, (2) gives { \atop ϕ(Q_{2})}(∇_{I}) = θ_{0} ∘ Q̂_{1}(I) (\underline{3}). By Property 3.1.1.iii (page 102), we have { \atop ϕ(Q_{2})} = ϕ ∘ Q̂_{2} ∘ ϕ^{¬}. Hence, (3) becomes ϕ ∘ Q̂_{2} ∘ ϕ^{¬}(∇_{I}) = θ_{0} ∘ Q̂_{1}(I) (\underline{4}). Since ϕ is a renaming disjoint from I, we have ϕ^{¬}(∇_{I}) = ∇_{I}. Hence (4) gives ϕ ∘ Q̂_{2}(∇_{I}) = θ_{0} ∘ Q̂_{1}(I). Applying ϕ^{¬}, we get Q̂_{2}(∇_{I}) = ϕ^{¬} ∘ θ_{0} ∘ Q̂_{1}(∇_{I}). Let θ be ϕ^{¬} ∘ θ_{0}. We get Q̂_{2}(∇_{I}) = θ ∘ Q̂_{1}(∇_{I}), which implies that Q̂_{2} and θ ∘ Q̂_{1} are equal on I.

Proof of Lemma 3.6.11

First, notice that we can show the lemma for any alpha-conversion of ∀ (Q_{2}) τ_{21} → τ_{22} (indeed, ∀ (Q_{2}) τ_{21} and ∀ (Q_{2}) τ_{22} can always be alpha-converted accordingly). Hence, we can freely assume ∀ (Q_{2}) τ_{21} → τ_{22} to be suitable for Lemma 3.4.4, thus we get a substitution θ such that

(Q_{2}) θ(τ_{11} → τ_{12}) ≡ τ_{21} → τ_{22} (\underline{1})  I = dom(Q_{1}/τ_{11} → τ_{12})  dom(θ) ⊆ I
Q_{1} ♢^{dom(Q)∪I} Q_{2}\underline{θ} (\underline{2})

By Property 1.5.11.viii applied to (1), we get (Q_{2}) θ(τ_{11}) ≡ τ_{21} (\underline{3}) and (Q_{2}) θ(τ_{12}) ≡ τ_{22}. By (2) and Definition 3.2.1, we have ∀ (Q_{1}) τ_{11} ♢ ∀ (Q_{2}\underline{θ}) τ_{11}. By (3), this gives ∀ (Q_{1}) τ_{11} ♢ ∀ (Q_{2}) τ_{21}. We show similarly that ∀ (Q_{1}) τ_{12} ♢ ∀ (Q_{2}) τ_{22} holds. This is the expected result.

Proof of Lemma 3.6.12

\underline{We prove the first statement.} By hypothesis Q ⊑ Q_{1}Q_{2} (\underline{1}), dom(Q) = dom(Q/I) (\underline{2}), I ⊆ dom(Q_{1}) (\underline{3}), and dom(Q_{1}) # dom(Q_{2}) (\underline{4}) by well-formedness of Q_{1}Q_{2}. Thus I # dom(Q_{2}) (\underline{5}) holds from (3) and (4). Let α′ be in dom(Q_{2}/ dom(Q)) (\underline{6}). By Property 3.3.2.i (page 104), we have dom(Q_{2}/ dom(Q)) = ⋃_{α∈dom(Q)} dom(Q_{2}/α). Hence, from (6), there exists α ∈ dom(Q) (\underline{7}) such that we have α′ ∈ dom(Q_{2}/α) (\underline{8}). Hence, α is in dom(Q) ∩ dom(Q_{2}). Therefore, Q is of the form (Q_{a}, α ⋄_{1} σ_{1}, Q_{b}) (\underline{9}) and Q_{2} of the form (Q_{2}^{a}, α ⋄_{2} σ_{2}, Q_{2}^{b}) (\underline{10}). Additionally, from (8), Q_{2}^{a} is of the form (Q_{2}^{c}, α′ ⋄_{3} σ_{3}, Q_{2}^{d}) (\underline{11}) and α′ ∈ ftv(∀ (Q_{2}^{d}) σ_{2}) (\underline{12}). By we have α ∈ dom(Q/I) from (2) and (7). By (9), this means that α ∈ ftv(∀ (Q_{b}) ∇_{I}) (\underline{13}). We have the following:

(Q)  ∀ (Q_{b}) ∇_{I}  ⊑ ∇_{I}  by I-Drop^{⋆} and (9)
(Q_{1}Q_{2})  ∀ (Q_{b}) ∇_{I}  ⊑ ∇_{I}  by Lemma 3.6.4 and (1)
(Q_{1}Q_{2}^{a}, α ⋄_{2} σ_{2}, Q_{2}^{b}) ∀ (Q_{b}) ∇_{I}  ⊑ ∇_{I}  by (10)
(Q_{1}Q_{2}^{a}, α ⋄_{2} σ_{2})  ∀ (Q_{2}^{b}Q_{b}) ∇_{I} ⊑ ∀ (Q_{2}^{b}) ∇_{I} by R-Context-R
(Q_{1}Q_{2}^{a}, α ⋄_{2} σ_{2})  ∀ (Q_{2}^{b}Q_{b}) ∇_{I} ⊑ ∇_{I}  by (5) and Eq-Free

Since we have α ∈ dom(Q_{2}) and (5), we have α ∉ I, that is, α ∉ ftv(∇_{I}). Hence, by R-Context-R and Eq-Free, we get

\begin{matrix}(Q_{1}Q_{2}^{a}) & ∀ (α ⋄_{2} σ_{2}) ∀ (Q_{2}^{b}Q_{b}) ∇_{I} & ⊑ & ∇_{I} \\ (Q_{1}Q_{2}^{c}, α′ ⋄_{3} σ_{3}, Q_{2}^{d}) & ∀ (α ⋄_{2} σ_{2}) ∀ (Q_{2}^{b}Q_{b}) ∇_{I} & ⊑ & ∇_{I} & by (11) \end{matrix}

We get (Q_{1}Q_{2}^{c}, α′ ⋄_{3} σ_{3}) ∀ (Q_{2}^{d}) ∀ (α ⋄_{2} σ_{2}) ∀ (Q_{2}^{b}Q_{b}) ∇_{I} ⊑ ∀ (Q_{2}^{d}) ∇_{I} by R-Context-R. By (5) and Eq-Free, we get (Q_{1}Q_{2}^{c}, α′ ⋄_{3} σ_{3}) ∀ (Q_{2}^{d}) ∀ (α ⋄_{2} σ_{2}) ∀ (Q_{2}^{b}Q_{b}) ∇_{I} ⊑ ∇_{I} (\underline{14}). By (13), we have α ∈ ftv(∀ (Q_{2}^{b}Q_{b}) ∇_{I}). Hence, by (12), α′ ∈ ftv(∀ (Q_{2}^{d}) ∀ (α⋄_{2} σ_{2}) ∀ (Q_{2}^{b}Q_{b}) ∇_{I}) (\underline{15}). Moreover, α′ ∉ I by (6) and (5). Hence, α′ ∉ ftv(∇_{I}) (\underline{16}). By Lemma 2.1.4 (page 67) on (14), (15), and (16), we get σ_{3} ∈ T , which implies α′ ∈ dom(Q̂_{2}). This result holds for any α′ in dom(Q_{2}/ dom(Q)), hence we have dom(Q_{2}/ dom(Q)) ⊆ dom(Q̂_{2}).

\underline{We prove the second statement.} Let α be in dom(Q) (\underline{1}). We have to show that ftv(Q̂_{2}(α)) ⊆ dom(Q_{1}). It suffices to show that ftv(Q̂_{2}(α)) # dom(Q_{2}) holds. By a way of contradiction, assume that β ∈ ftv(Q̂_{2}(α)) (\underline{2}) and β ∈ dom(Q_{2}). Then Q_{2} is of the form (Q_{a}, β ⋄ σ, Q_{b}). By definition of Q̂_{2} (which is idempotent) and (2), we must have β ∉ dom(Q̂_{2}) (\underline{3}). From (2), we have β ∈ ftv(Q̂_{b}(α)). Hence, β ∈ ftv(∀ (Q_{b}) Q̂_{b}(α)) (since β ∉ dom(Q_{b})). This gives β ∈ ftv(∀ (Q_{b}) α) (\underline{4}) by Property 1.5.11.vi (page 54) and by observing that ∀ (Q_{b}) α ≡ ∀ (Q_{b}) Q̂_{b}(α) holds by Eq-Mono. Therefore, from (4), we have β ∈ dom(Q_{2}/α), which implies β ∈ dom(Q_{2}/ dom(Q)) from (1). The first property ensures that β ∈ dom(Q̂_{2}), which is a contradiction with (3). We have shown a contradiction, thus the hypothesis β ∈ ftv(Q̂_{2}(α)) and β ∈ dom(Q_{2}) was wrong. As a consequence, we have Q̂_{2}(dom(Q)) ⊆ dom(Q_{1}).

Proof of Lemma 3.6.13

By hypothesis, Q_{1} ⊑^{I∪J} Q_{2}Q_{3} holds. By Lemma 3.6.1 (page 113), there exists a renaming ϕ on dom(Q_{2}Q_{3}) and a substitution θ both invariant on I ∪ J such that Q_{1} ⊑^{K} ϕ(Q_{2}Q_{3})\underline{θ} holds, and K = dom(Q_{1}/I ∪ J) (\underline{1}). Since ftv(τ) ⊆ I ∪ J, we have θ(τ) = τ (\underline{2}). Let Q′_{2} be ϕ(Q_{2}) and Q′_{3} be ϕ(Q_{3}). We have Q_{1} ⊑^{K} Q′_{2}Q′_{3}\underline{θ} (\underline{3}). Additionally, (Q_{a}, Q_{b}) is Q_{1}↑I, thus by Lemma 3.5.2, we have I ⊆ dom(Q_{a}) (\underline{4}), dom(Q_{a}/I) = dom(Q_{a}) (\underline{5}), and Q_{a}Q_{b} ≈ Q_{1} (\underline{6}). Hence, (3) becomes Q_{a}Q_{b} ⊑^{K} Q′_{2}Q′_{3}\underline{θ} (\underline{7}). From (1) and Property 3.3.2.i (page 104), we have dom(Q_{1}/I) ⊆ K (\underline{8}). From (5), (4), and (6), we get dom(Q_{1}/I) = dom(Q_{a}/I) = dom(Q_{a}) (\underline{9}). By (9) and (8), we have dom(Q_{a}) ⊆ K (\underline{10}). By Property 3.4.2.i (page 106), PE-Free, (7) and (10) we get Q_{a} ⊑ Q′_{2}Q′_{3}\underline{θ} (\underline{11}). Hence, we get (Q_{a}, γ ≥ ∀ (Q_{b}) τ) ⊑ (Q′_{2}Q′_{3}\underline{θ}, γ ≥ ∀ (Q_{b}) τ) by Property 3.4.2.iii (page 106). Let θ′ be Q̂′_{3} ∘ θ. By Eq-Mono^{⋆}, we get (Q_{a}, γ ≥ ∀ (Q_{b}) τ) ⊑ (Q′_{2}Q′_{3}\underline{θ}, γ ≥ θ′(∀ (Q_{b}) τ)) (\underline{12}). We also have

(Q_{a}Q_{b}) ∀ (Q_{b}) τ  ⊑ τ  by I-Drop^{⋆}
(Q′_{2}Q′_{3}\underline{θ}) ∀ (Q_{b}) τ  ⊑ τ  by Lemma 3.6.4 and (7)
(Q′_{2})  ∀ (Q′_{3}) θ(∀ (Q_{b}) τ) ⊑ ∀ (Q′_{3}) θ(τ) by R-Context-R
(Q′_{2})  ∀ (Q′_{3}) θ′(∀ (Q_{b}) τ) ⊑ ∀ (Q′_{3}) θ′(τ) by Eq-Mono^{⋆}

Hence, (Q′_{2}) ∀ (Q′_{3}) θ′(∀ (Q_{b}) τ) ⊑ ∀ (Q′_{3}) θ′(τ) (\underline{13}) holds. We have I ⊆ dom(Q_{2}) by hypothesis, and ϕ disjoint from I, thus I ⊆ dom(Q′_{2}) (\underline{14}). By Lemma 3.6.12 (page 116) applied to (11), (14) and (5), we get dom(Q′_{3}\underline{θ}/ dom(Q_{a})) ⊆ dom(θ′) and θ′(dom(Q_{a})) ⊆ dom(Q′_{2}) (\underline{15}). Consider the instantiation (13). The free variables of ∀ (Q_{b}) τ are in dom(Q_{a}) (since Q_{a}Q_{b} ≈ Q_{1}). Hence, the free variables of θ′(∀ (Q_{b}) τ) are in θ′(dom(Q_{a})). By (15), they are in dom(Q′_{2}). In particular, they are not in dom(Q′_{3}) (since Q′_{2} # Q′_{3} holds by well-formedness of (3)). Hence, ∀ (Q′_{3}) θ′(∀ (Q_{b}) τ) ≡ θ′(∀ (Q_{b}) τ) holds by Eq-Free. Consequently, (13) gives

(Q′_{2}) θ′(∀ (Q_{b}) τ) ⊑ ∀ (Q′_{3}) θ′(τ) (\underline{16})

Additionally, we have

(Q_{a}, γ ≥ ∀ (Q_{b}) τ) ⊑ (Q′_{2}, γ ≥ θ′(∀ (Q_{b}) τ), Q′_{3}\underline{θ})  by PE-Comm on (12).
(Q_{a}, γ ≥ ∀ (Q_{b}) τ) ⊑ (Q′_{2}, γ ≥ ∀ (Q′_{3}) θ′(τ), Q′_{3}\underline{θ})  by PI-Context-L

and (16).

(Q_{a}, γ ≥ ∀ (Q_{b}) τ) ⊑ (Q′_{2}, γ ≥ ∀ (Q′_{3}) θ(τ), Q′_{3}\underline{θ})  by Eq-Mono^{⋆}.
(Q_{a}, γ ≥ ∀ (Q_{b}) τ) ⊑ (Q′_{2}, γ ≥ ∀ (Q′_{3}) τ, Q′_{3}\underline{θ})  by (2).
(Q_{a}, γ ≥ ∀ (Q_{b}) τ) ⊑ (ϕ(Q_{2}), γ ≥ ∀ (ϕ(Q_{3})) τ, Q′_{3}\underline{θ}) by definition.
(Q_{a}, γ ≥ ∀ (Q_{b}) τ) ⊑ (ϕ(Q_{2}), γ ≥ ϕ(∀ (Q_{3}) τ), Q′_{3}\underline{θ}) by alpha-renaming.
(Q_{a}, γ ≥ ∀ (Q_{b}) τ) ⊑ (ϕ(Q_{2}, γ ≥ ∀ (Q_{3}) τ), Q′_{3}\underline{θ})

Then (Q_{a}, γ≥∀ (Q_{b}) τ) ⊑^{I∪\{γ\}} (ϕ(Q_{2}, γ≥∀ (Q_{3}) τ)) (\underline{17}) holds by PE-Free and Property 3.4.2.i (page 106). By Property 3.4.2.iv (page 106), we have (Q_{2}, γ ≥ ∀ (Q_{3}) τ) ≡ (ϕ(Q_{2}, γ ≥ ∀ (Q_{3}) τ)\underline{ϕ}), thus (Q_{2}, γ ≥ ∀ (Q_{3}) τ) ≡^{I∪\{γ\}} (ϕ(Q_{2}, γ ≥ ∀ (Q_{3}) τ)) holds by PE-Free and Property 3.4.2.i (page 106). With (17), we get (Q_{a}, γ ≥ ∀ (Q_{b}) τ) ⊑^{I∪{γ}} (Q_{2}, γ ≥ ∀ (Q_{3}) τ). This is the expected result.

Proof of Lemma 4.2.4

By Lemma 3.6.1 (page 113), there exists a renaming ϕ on dom(Q_{2}) and a substitution θ invariant on I such that Q_{1} ⊑^{J} ϕ(Q_{2})\underline{θ} (\underline{1}) holds, and J is dom(Q_{1}/I). Let (Q_{3}, Q_{4}) be Q_{1}↑ ftv(σ′). By Lemma 3.5.2, we have Q_{3}Q_{4} ≈ Q_{1} (\underline{2}) and ftv(σ′) # dom(Q_{4}) (\underline{3}). Then Q_{4} is (Q_{5}, α ⋄ σ, Q_{6}) and Q_{1} is a rearrangement of (Q_{3}Q_{5}, α ⋄ σ, Q_{6}) by (2). From (3), we have ftv(σ′) # dom(Q_{6}) (\underline{4}). Let Q_{a} be Q_{3}Q_{5} and Q_{b} be Q_{6} (\underline{5}). Then Q_{1} is a rearrangement of (Q_{a}, α ⋄ σ, Q_{b}) (\underline{6}). By hypothesis, if ⋄ is =, then (Q_{1}) σ ⊏ − σ′ holds. This implies that (Q_{1}) σ ⊏ −^{?} σ′ returns true, by Lemma 4.2.2. Hence, Q_{1} ⇐ (α ⋄′ σ′) is well-defined (that is, it does not fail on the fourth step). We write it Q′_{1}.

By definition, Q′_{1} is (Q_{a}, α ⋄′ σ′, Q_{b}) (\underline{7}) and dom(Q_{b}) # ftv(σ′) holds from (4) and (5).

We have the following:

(Q_{a}, α ⋄ σ, Q_{b})  ∀ (Q_{b}) ∇_{I} ⊑  ∇_{I} by I-Drop^{⋆}.
(Q_{1})  ∀ (Q_{b}) ∇_{I} ⊑  ∇_{I} by (6)

and Property 1.7.2.ii

(ϕ(Q_{2})\underline{θ}) ∀ (Q_{b}) ∇_{I} ⊑ ∇_{I} by Lemma 3.6.4 on (1).
∀ (ϕ(Q_{2})\underline{θ}Q_{b}) ∇_{I} ⊑ ∀ (ϕ(Q_{2})\underline{θ}) ∇_{I} by R-Context-R
∀ (ϕ(Q_{2})\underline{θ}Q_{b}) ∇_{I} ⊑ ∀ (ϕ(Q_{2})) ∇_{I} since dom(θ) # I.
∀ (ϕ(Q_{2})\underline{θ}Q_{b}) ∇_{I} ⊑  ∀ (Q_{2}) ∇_{I} by alpha-conversion

Hence, ∀ (ϕ(Q_{2})\underline{θ}Q_{b}) ∇_{I} ⊑ ∀ (Q_{2}) ∇_{I} (\underline{8}) holds. By hypothesis, we have (Q_{2}) σ′ ⊑ α (\underline{9}) and (Q_{2}) σ′ ⊏ − α (\underline{10}) when ⋄′ is rigid. We have Q_{2} ≡^{I} ϕ(Q_{2})\underline{ϕ} by Property 3.4.2.iv (page 106). We get Q_{2} ≡^{I} ϕ(Q_{2})\underline{θ} (\underline{11}) by PE-Free (twice). Hence, we have (ϕ(Q_{2})\underline{θ}) σ′ ⊑ α (\underline{12}) (and possibly (ϕ(Q_{2})\underline{θ}) σ′ ⊏ − α (\underline{13})) by Lemma 3.6.4, (9), possibly (10), and (11). Then we have the following (we abbreviated R-Context-Flexible and R-Context-Rigid into RC-Flexible and RC-Rigid, respectively):

(Q_{a}, α ⋄ σ, Q_{b}) ∀ (Q′_{1}) ∇_{I} ⊑ ∀ (α ⋄′ σ′, Q_{b}) ∇_{I} by I-Drop^{⋆} and (7)
(Q_{1}) ∀ (Q′_{1}) ∇_{I} ⊑ ∀ (α ⋄′ σ′, Q_{b}) ∇_{I} by (6)
(ϕ(Q_{2})\underline{θ}) ∀ (Q′_{1}) ∇_{I} ⊑ ∀ (α ⋄′ σ′, Q_{b}) ∇_{I} by Lemma 3.6.4 and (1)
(ϕ(Q_{2})\underline{θ}) ∀ (Q′_{1}) ∇_{I} ⊑ ∀ (α ⋄′ α, Q_{b}) ∇_{I} by RC-Flexible and (12)

or RC-Rigid and (13)

(ϕ(Q_{2})\underline{θ}) ∀ (Q′_{1}) ∇_{I} ⊑  ∀ (Q_{b}) ∇_{I} by Eq-Mono^{⋆}
∀ (Q′_{1}) ∇_{I} ⊑ ∀ (ϕ(Q_{2})\underline{θ}Q_{b}) ∇_{I} by R-Context-R

The left-hand side ∀ (Q′_{1}) ∇_{I} is closed, thus ∀ (ϕ(Q_{2})\underline{θ}) ∀ (Q′_{1}) ∇_{I} and ∀ (Q′_{1}) ∇_{I} are equivalent by Eq-Free. This is why we get the last line by Eq-Free. Finally, combining with (8), we get ∀ (Q′_{1}) ∇_{I} ⊑ ∀ (Q_{2}) ∇_{I}, thus Property 3.4.5.i (page 109) gives the expected result.

Proof of Lemma 4.2.5

By hypothesis, we have (Q) σ ⊑ σ′ (\underline{1}). Let (Q_{1}, Q_{2}) be Q↑ ftv(σ′). By Lemma 3.5.2, we have Q_{1}Q_{2} ≈ Q. By hypothesis, we have Q_{2} of the form (Q_{2}^{a}, α ⋄ σ, Q_{2}^{b}). If ⋄ is =, then (Q) σ ⊏ −^{?} σ′ returns true, thus we have (Q) σ ⊏ − σ′ (\underline{2}) by Lemma 4.2.2 and (1). Finally, the algorithm returns Q′ = (Q_{1}Q_{2}^{a}, α ⋄ σ′, Q_{2}^{b}). The prefix (Q_{1}Q_{2}^{a}, α ⋄ σ, Q_{2}^{b}) is a rearrangement of Q. Besides, (Q_{1}Q_{2}^{a}, α ⋄ σ, Q_{2}^{b}) ⊑ Q′ holds by PA-Context-L and (2) or PI-Context-L and (1). Hence, Q ⊑ Q′ holds, which is the expected result.

Proof of Lemma 4.2.7

By hypothesis, Q is of the form (Q_{0}, α ⋄ σ, Q_{1}, α′ ⋄′ σ, Q_{2}), or (Q_{0}, α′ ⋄′ σ, Q_{1}, α ⋄ σ, Q_{2}). By well-formedness of Q, we must have ftv(σ) # dom(Q_{1}). Hence, by Eq-Comm, we get Q ≡ (Q_{0}, α ⋄ σ, α′ ⋄′ σ, Q_{1}Q_{2}) (\underline{1}). If ⋄ and ⋄′ are flexible, then ⋄′′ is ≥ and Q ⊑ (Q_{0}, α ⋄′′ σ, α′ ⋄′′ σ, Q_{1}Q_{2}) (\underline{2}) holds from (1) by PE-Refl. Otherwise, ⋄′′ is = and (2) holds from (1) and by Rule PI-Rigid (if necessary). Finally, Q ⊑ (Q_{0}, α ⋄′′ σ, α′ = α, Q_{1}Q_{2}) (\underline{3}) holds from (2), by PI-Trans, PI-Context-L on the binding (α′ ≥ σ), and I-Hyp when ⋄′′ is flexible, or PA-Context-L on the binding (α′ = σ) and A-Hyp when ⋄′′ is rigid. Hence, Q ⊑ Q′ holds from (3). Additionally, (Q′) α ≡ α′ holds by Eq-Mono.

Proof of Lemma 4.2.8

Merging is only a particular case of Updating. More precisely, let ⋄′′ be ≥ if both ⋄ and ⋄′ are ≥, and = otherwise. Let Q_{a} be Q_{1} ⇐ (α ⋄′′ σ), let Q_{b} be Q_{a} ⇐ (α ⋄′′ σ), and Q_{c} be Q_{b} ⇐ (α′ = α). We show that Q_{a}, Q_{b}, and Q_{c} are well-defined (that is, the updates do not fail) and that Q_{c} is a rearrangement of Q ⇐ α ∧ α′. By hypothesis and without loss of generality Q_{1} is of the form (Q_{4}, α ⋄ σ, Q_{5}, α′ ⋄′ σ, Q_{6}) (\underline{1}). By well-formedness, we have α′ ∉ dom(Q_{1}/σ), thus α′ ∉ dom(Q_{b}/α). This implies that Q_{b} ⇐ (α′ = α) can be applied. Let (P_{1}, P_{2}) be Q_{1}↑ ftv(σ). By Lemma 3.5.2, we have P_{1}P_{2} ≈ Q_{1} and dom(P_{1}) = dom(Q_{1}/σ) (\underline{2}). Besides, by well-formedness of (1), we must have ftv(σ) ⊆ dom(Q_{4}) (\underline{3}). More precisely, we must have dom(Q_{1}/σ) ⊆ dom(Q_{4}) (\underline{4}). Hence dom(P_{1}) ⊆ dom(Q_{4}) (\underline{5}) holds from (4) and (2). By Lemma 4.2.2, (Q) σ ⊏ −^{?} σ holds. Hence, the algorithm does not fail on its fourth step. Finally, it returns Q_{a}, which is a rearrangement of (Q_{4}, α⋄′′ σ, Q_{5}, α′ ⋄′ σ, Q_{6}). Similarly, Q_{b} is a rearrangement of (Q_{4}, α ⋄′′ σ, Q_{5}, α′ ⋄′′ σ, Q_{6}) (\underline{6}). Since ftv(σ) ⊆ dom(Q_{4}) (from (3)), Q_{b} is also a rearrangement of (Q_{4}, α⋄′′σ, α′⋄′′σ, Q_{5}Q_{6}). Then observing that (Q_{b}) σ ⊏ − α holds when ⋄′′ is rigid, we see that Q_{b} ⇐ (α′ =α) is well-defined, that is, Q_{c} is well-defined, and is a rearrangement of (Q_{4}, α⋄′′ σ, α′ =α, Q_{4}Q_{6}), that is, a rearrangement of Q ⇐ α∧α′ (\underline{7}). By Lemma 3.6.1 (page 113), there exists a renaming ϕ on dom(Q_{2}) and a substitution θ invariant on I such that Q_{1} ⊑^{J} ϕ(Q_{2})\underline{θ} (\underline{8}) holds, and J is dom(Q_{1}/I). Hence, ftv(σ) ∪ \{α\} ⊆ J (\underline{9}) holds from the hypothesis α, α′ ∈ I. We have (Q_{1}) σ ⊑ α by I-Hyp, thus (ϕ(Q_{2})\underline{θ}) σ ⊑ α holds by Lemma 3.6.4 and (8). We have (Q_{2}) α ≡ α′ by hypothesis, and Q_{2} ≡^{I} ϕ(Q_{2})\underline{θ} (\underline{10}) is derivable by Property 3.4.2.iv (page 106) and PE-Free (observing that ϕ and θ are invariant on I), thus (ϕ(Q_{2})\underline{θ}) α ≡ α′ (\underline{11}) holds. Besides, if ⋄′′ is =, then either ⋄ or ⋄′ is =. In the first case, we have (Q_{1}) σ ⊏ − α by A-Hyp. In the second case, we have (Q_{1}) σ ⊏ − α′ by A-Hyp. Then (ϕ(Q_{2})\underline{θ}) σ ⊏ − α or (ϕ(Q_{2})\underline{θ}) σ ⊏ − α′ (\underline{12}) holds by Lemma 3.6.4 and (8). By (12) and (11), we get (ϕ(Q_{2})\underline{θ}) σ ⊏ − α (\underline{13}). Note that (Q_{1}) σ ⊏ − σ (\underline{14}) and (Q_{1}) σ ⊑ σ (\underline{15}) hold by Eq-Refl, A-Equiv, and I-Equiv^{⋆}. By Lemma 4.2.4 (page 123), (8), (1), (14), (15), (9), and (13) we have Q_{a} ⊑^{J} ϕ(Q_{2})\underline{θ}. Similarly, Q_{b} ⊑^{J} ϕ(Q_{2})\underline{θ} is derivable. By Property 3.4.2.i (page 106) and (10), we get Q_{b} ⊑^{I} Q_{2} (\underline{16}). From (6), (Q_{b}) σ ⊑ α′ (\underline{17}) holds by I-Hyp when ⋄′′ is flexible, and (Q_{b}) σ ⊏ − α′ (\underline{18}) holds by A-Hyp when ⋄′′ is rigid. By well-formedness of Q_{b}, we have α′ ∉ dom(Q_{b}/α) (\underline{19}). We have by hypothesis α, α′ ∈ I (\underline{20}) and (Q_{2}) α ≡ α′ (\underline{21}). By Lemma 4.2.4 (page 123), (16), (6), (17), (18), (19), (20), (21), we get Q_{c} ⊑^{I} Q_{2}. Hence, (Q_{1} ⇐ α ∧ α′) ⊑^{I} Q_{2} holds from (7).

Proof of Property 4.3.1

We prove both properties simultaneously, by induction on the recursive calls to unify

and polyunify.

Proof of Property 4.3.2

By induction on the recursive calls to unify. All cases are easy.

Proof of Lemma 4.5.1

We prove the result for unify′ and polyunify′ simultaneously, by induction on the recursive calls. We get the result for polyunify′ by induction hypothesis and Property 4.3.2.i (page 126). As for unify′, we proceed by case analysis on (τ_{1}, τ_{2}). Cases (α, α) and (g_{1} …, g_{2} …) with g_{1} ≠ g_{2} are immediate (unify and unify′ return the same result). Cases (g τ_{1}^{1} …, g τ_{2}^{1} …) and (α, τ) or (τ, α) with (α ⋄ σ) ∈ Q and σ ∈ V are by induction hypothesis (unify and unify′ are identical).

∘ Case (α, τ) or (τ, α) with (α ⋄ τ′) ∈ Q: In this case, unify simply returns unify (Q, τ, τ′), while unify′ is more elaborate. We have to consider the two following subcases:

Subcase α ∈ dom(Q/τ) (\underline{1}): By Property 1.5.11.vii (page 54), we have Q̂(τ) = Q̂(α) (\underline{2}) if and only if (Q) τ ≡ α holds. If (2) does not hold, then unify′ fails. We have to show that unify fails too. By a way of contradiction, assume unify succeeds with a prefix Q′. Then by soundness (Lemma 4.4.1), we would have Q ⊑ Q′ (\underline{3}) and (Q′) α ≡ τ (\underline{4}). From (1), Q is of the form (Q_{a}, α ⋄ σ, Q_{b}) and α ∈ ftv(∀ (Q_{b}) τ) (\underline{5}). Hence, we can derive (Q) ∀ (Q_{b}) τ ⊑ τ (\underline{6}) by I-Drop^{⋆}. By Lemma 3.6.4, (6), and (3), we get (Q′) ∀ (Q_{b}) τ ⊑ τ. From (4), we get (Q′) ∀ (Q_{b}) τ ⊑ α (\underline{7}) By Property 2.1.7.ii (page 68), (7), and (5), we get ∀ (Q_{b}) τ ≡ α. Hence, (6) gives (Q) α ⊑ τ. By Lemma 2.1.6, it leads to (Q) α ≡ τ. This is a contradiction with the hypothesis that (2) does not hold. Hence, unify cannot succeed, and this is the expected result.

Otherwise, (2) holds, and unify′ returns Q. From (2), we have (Q) α ≡ τ (\underline{8}). We have to show that unify returns a rearrangement of Q. From (1), Q is of the form (Q_{a}, α ⋄ σ, Q_{b}) and α ∈ ftv(∀ (Q_{b}) τ) (\underline{9}). Hence, we can derive (Q) ∀ (Q_{b}) τ ⊑ τ by I-Drop^{⋆}. From (8), we get (Q) ∀ (Q_{b}) τ ⊑ α (\underline{10}) By Property 2.1.7.ii (page 68), (10), and (9), we get ∀ (Q_{b}) τ ≡ α (\underline{11}). This implies that either τ is α, or it is a variable β such that β ∈ dom(Q_{b}). In the first case, unify (Q, τ, α) returns Q, which is the expected result. In the second case, Q_{b} is of the form (Q_{b}^{1}, β ⋄_{b} σ_{b}, Q_{b}^{2}). From (11) and Eq-Var, we get ∀ (Q_{b}^{1}) σ_{b} ≡ α. This implies σ_{b} ∈ V, that is, σ_{b} ≡ γ such that γ ∈ dom(Q_{b}^{1}).

Subcase α ∉ dom(Q/τ): ∘ Case (α, τ) or (τ, α) with (α ⋄ σ) ∈ Q (\underline{12}): Both algorithms fail in the first step, or both continue. Let I be {β ∈ dom(Q) | β ≠ α and α ∉ dom(Q/β)} and (Q_{1}, Q_{2}) be Q↑I. The algorithm unify′ calls polyunify′ (Q_{1}, σ, τ) while unify calls polyunify (Q, σ, τ). By Lemma 3.5.2, Q_{1}Q_{2} is a rearrangement of Q, I ⊆ dom(Q_{1}) and dom(Q_{1}/I) = dom(Q_{1}). We have α ∉ dom(Q/σ) by well-formedness of Q and (12), hence ftv(σ) ⊆ I. We have α ∉ dom(Q/τ) (otherwise both algorithms fail in the first step), hence ftv(τ) ⊆ I. Thus, we have ftv(τ) ∪ ftv(σ) ⊆ dom(Q_{1}). By Property 4.3.2.ii (page 126) and induction hypothesis, polyunify′ (Q_{1}, σ, τ) returns Q′_{1} if and only if polyunify (Q, σ, τ) returns Q′, a rearrangement of Q′_{1}Q_{2}. Then Q′_{1}Q_{2} ⇐ (α = τ) is a rearrangement of Q′ ⇐ (α=τ) by Lemma 4.2.3 (page 123). This is the expected result. ∘ Case (α_{1}, α_{2}): Both algorithms fail if α_{1} ∈ dom(Q/σ_{2}) or α_{2} ∈ dom(Q/σ_{1}). Let I be {β ∈ dom(Q) | β ∉ {α_{1}, α_{2}} and {α_{1}, α_{2}} # dom(Q/β)}. Let (Q_{1}, Q_{2}) be Q↑I. The algorithm unify′ calls polyunify′ (Q_{1}, σ_{1}, σ_{2}), while unify calls polyunify (Q, σ_{1}, σ_{2}). By Lemma 3.5.2 and by definition of I, Q_{1}Q_{2} is a rearrangement of Q, and we have ftv(σ_{1}) ∪ ftv(σ_{2}) ⊆ dom(Q_{1}). Hence, by Property 4.3.2.i (page 126) and induction hypothesis, polyunify′ (Q_{1}, σ_{1}, σ_{2}) returns (Q′_{1}, σ′_{3}) if and only if polyunify (Q, σ_{1}, σ_{2}) returns (Q′, σ_{3}) such that Q′ is a rearrangement of Q′_{1}Q_{2} and σ_{3} is a rearrangement of σ′_{3}. Hence, Q′_{1}Q_{2} ⇐ (α_{1} ⋄_{1} σ′_{3}) ⇐ (α_{2} ⋄_{2} σ′_{3}) ⇐ α_{1} ∧ α_{2} is a rearrangement of Q′ ⇐ (α_{1} ⋄_{1} σ_{3}) ⇐ (α_{2} ⋄_{2} σ_{3}) ⇐ α_{1} ∧ α_{2}. This is the expected result.

Proof of Property 4.5.3

Properties i, ii, and iii are immediate.

We show \underline{Properties iv and v} simultaneously, by induction on the recursive calls to unify′ and polyunify′. For unify′, we proceed by case on (τ_{1}, τ_{2}):

∘ Case (α, α): We return Q and we have ⌈Q⌉ ⩽ ⌈Q⌉.

∘ Case (g τ_{1}^{1} .. τ_{1}^{n}, g τ_{2}^{1} .. τ_{2}^{n}): by induction hypothesis.

∘ Case (g_{1} τ_{1}^{1} .. τ_{1}^{p}, g_{2} τ_{2}^{1} .. τ_{2}^{q}) with g_{1} ≠ g_{2}: is not possible since, by hypothesis, we succeed.

∘ Case (α, τ) or (τ, α) with (α ⋄ σ) ∈ Q and σ ∈ V: By induction hypothesis.

∘ Case (α, τ) or (τ, α): We have (Q_{1}, Q_{2}) = Q↑I. By Lemmas 3.5.2 and ii, we get ⌈Q⌉ = ⌈Q_{1}⌉ + ⌈Q_{2}⌉ (\underline{1}). Note that (α ⋄ σ) ∈ Q_{2}. We have (Q′_{1}, σ′) = polyunify′ (Q_{1}, σ, τ). By induction hypothesis, ⌈Q′_{1}⌉ + ⌈σ′⌉ ⩽ ⌈Q_{1}⌉ + ⌈σ⌉ + ⌈τ⌉, that is, ⌈Q′_{1}⌉ + ⌈σ′⌉ ⩽ ⌈Q_{1}⌉ + ⌈σ⌉. Hence, we have ⌈Q′_{1}⌉ ⩽ ⌈Q_{1}⌉ + ⌈σ⌉ (\underline{2}). Let Q′ be Q′_{1}Q_{2} ⇐ (α = τ). We note that ⌈Q′⌉ = ⌈Q′_{1}⌉ + ⌈Q_{2}⌉ − ⌈σ⌉ + ⌈τ⌉. Hence, by (2), we get ⌈Q′⌉ ⩽ ⌈Q_{1}⌉ + ⌈σ⌉ + ⌈Q_{2}⌉ − ⌈σ⌉, that is, ⌈Q′⌉ ⩽ ⌈Q_{1}⌉ + ⌈Q_{2}⌉. By (1), this gives ⌈Q′⌉ ⩽ ⌈Q⌉.

∘ Case (α_{1}, α_{2}): Similarly, ⌈Q⌉ = ⌈Q_{1}⌉ + ⌈Q_{2}⌉ and by induction hypothesis, ⌈Q′_{1}⌉ + ⌈σ_{3}⌉ ⩽ ⌈Q_{1}⌉ + ⌈σ_{1}⌉ + ⌈σ_{2}⌉ (\underline{3}). Let Q′ be Q′_{1}Q_{2} ⇐ (α_{1} ⋄_{1} σ_{3}) ⇐ (α_{2} ⋄_{2} σ_{3}) ⇐ α_{1} ∧ α_{2}. We note that ⌈Q′⌉ = ⌈Q′_{1}⌉ + ⌈Q_{2}⌉ − ⌈σ_{1}⌉ − ⌈σ_{2}⌉ + ⌈σ_{3}⌉. Hence, ⌈Q′⌉ ⩽ ⌈Q_{1}⌉ + ⌈Q_{2}⌉ holds from (3), that is, ⌈Q′⌉ ⩽ ⌈Q⌉. This is the expected result.

For polyunify, we have σ_{1} = ∀ (Q_{1}) τ_{1} and σ_{2} = ∀ (Q_{2}) τ_{2}. We compute Q_{0} = unify (QQ_{1}Q_{2}, τ_{1}, τ_{2}) and (Q_{3}, Q′) = Q_{0}↑ dom(Q). By Lemma 3.5.2, Q_{3}Q′ ≈ Q_{0}. Hence, by Property ii, we get ⌈Q_{0}⌉ = ⌈Q_{3}⌉ + ⌈Q′⌉ (\underline{1}). We have σ_{3} = ∀ (Q′) τ_{1}, thus ⌈σ_{3}⌉ = ⌈Q′⌉ (\underline{2}) by Property i. By induction hypothesis, we have ⌈Q_{0}⌉ ⩽ ⌈QQ_{1}Q_{2}⌉ (\underline{3}). By (3), (1), (2), we get ⌈Q_{3}⌉ + ⌈σ_{3}⌉ ⩽ ⌈QQ_{1}Q_{2}⌉. By Properties ii and i, we get ⌈Q_{3}⌉ + ⌈σ_{3}⌉ ⩽ ⌈Q⌉ + ⌈σ_{1}⌉ + ⌈σ_{2}⌉. This is the expected result.

Proof of Lemma 4.6.1

In the cases (⊥, σ), or (σ, ⊥), polyunify returns σ, which is σ_{1} or σ_{2}, thus it is not in V by hypothesis. In the last case, it returns ∀ (Q_{4}) τ_{1}, where the constructed form of σ_{1} is ∀ (Q_{1}) τ_{1}. Since σ_{1} is not in V, we must have τ_{1} ∉ ϑ, thus ∀ (Q_{4}) τ_{1} ∉ V.

Proof of Corollary 4.6.3

By hypothesis, Q_{1} ⊑^{I} Q_{2} (\underline{1}) holds. By Lemma 3.6.2 (page 114) on (1), there exists a renaming ϕ disjoint from I and a prefix Q_{0} such that we have Q_{1} ⊑ ϕ(Q_{2})Q_{0} and ϕ(Q_{2})Q_{0} ≡^{I} Q_{2} (\underline{2}). By Lemma 4.6.2, unify (Q_{1}, τ_{1}, τ_{2}) succeeds with Q′_{1} and we have Q′_{1} ⊑^{dom(Q_{1})} ϕ(Q_{2})Q_{0}. By Property 3.4.2.i (page 106) and (2), we get Q′_{1} ⊑^{I} Q_{2}. This is the expected result.

Proof of Lemma 6.1.4

This property is shown by induction on the the derivation of (Q) Γ ⊢ a : σ. Case Var is immediate. Cases App, Inst and Oracle are by induction hypothesis. ∘ Case Fun: The premise is (Q) Γ, x : τ_{0} ⊢ a_{0} : τ and σ is τ_{0} → τ. By alphaconversion of the lambda-bound variable x, we can freely assume that x is not bound in Γ′. Hence, by induction hypothesis, we have (Q) Γ, x : τ_{0}, Γ′ ⊢ a_{0} : τ, which is identified with (Q) Γ, Γ′, x : τ_{0} ⊢ a_{0} : τ. Hence, by Rule Fun, we get (Q) Γ, Γ′ ⊢ λ(x) a_{0} : τ_{0} → τ, which is the expected result. ∘ Case Let: We have (Q) Γ ⊢ a_{1} : σ_{1} and (Q) Γ, x : σ_{1} ⊢ a_{2} : σ. By induction hypothesis, we have (Q) Γ, Γ′ ⊢ a_{1} : σ_{1} and (Q) Γ, x : σ_{1}, Γ′ ⊢ a_{2} : σ, which can be written (Q) Γ, Γ′, x : σ_{1} ⊢ a_{2} : σ. Hence, by Rule Let, we get the expected result. ∘ Case Gen: The premise is (Q, α⋄σ_{a}) Γ ⊢ a : σ′ (\underline{1}), and σ is ∀ (α⋄σ_{a}) σ′. Besides, α ∉ ftv(Γ). Let α′ be a fresh variable (that is, not in ftv(Γ, Γ′)). By Lemma 6.1.1 applied to (1) with the renaming [α′/α], we get (Q, α′ ⋄ σ_{a}) Γ ⊢ a : σ′[α′/α], and this derivation has the same size as (1). Hence, by induction hypothesis, we have a derivation of (Q, α′⋄σ_{a}) Γ, Γ′ ⊢ a : σ′[α′/α]. Applying Gen, we get (Q) Γ, Γ′ ⊢ a : ∀ (α′⋄σ_{a}) σ′[α′/α], that is (by alpha-conversion) (Q) Γ, Γ′ ⊢ a : σ, which is the expected result.

Proof of Lemma 6.2.1

It suffices to show that each rule defining ⊢^{▽} is derivable in ⊢. ∘ Case Var^{▽}: This rule is identical to Rule Var. ∘ Case Fun^{▽}: We choose α fresh, that is α ∉ dom(QQ′)∪ftv(Γ, τ_{0}, σ). By hypothesis, (QQ′) Γ, x : τ_{0} ⊢ a : σ holds, and dom(Q′) # ftv(Γ). By Corollary 6.1.3 (page 153), we get (QQ′, α ≥ σ) Γ, x : τ_{0} ⊢ a : σ. Hence, the following derivation:

\frac{(QQ′, α ≥ σ) Γ, x : τ_{0} ⊢ a : σ  \overline{(QQ′, α ≥ σ) σ ⊑ α} I-Hyp}{\frac{(QQ′, α ≥ σ) Γ, x : τ_{0} ⊢ a : α}{\frac{(QQ′, α ≥ σ) Γ ⊢ λ(x) a : τ_{0} → α}{(Q) Γ ⊢ λ(x) a : ∀ (Q′, α ≥ σ) τ_{0} → α} Gen} Fun} Inst

∘ Case App^{▽}: We have already shown that App^{⋆} is derivable. Then App^{▽} can be derived with Inst and App^{⋆}. ∘ Case Let^{▽} We choose α fresh, and Q_{2} is an abbreviation for (Q, α ≥ σ_{2}). By hypothesis, we have (Q) Γ ⊢ a_{1} : σ_{1} and (Q) Γ, x : σ_{1} ⊢ a_{2} : σ_{2}. By Corollary 6.1.3 (page 153), we get (Q_{2}) Γ ⊢ a_{1} : σ_{1} and (Q_{2}) Γ, x : σ_{1} ⊢ a_{2} : σ_{2}. Then we have the following derivation:

(Q_{2}) Γ ⊢ a_{1} : σ_{1}  \frac{\begin{matrix}(Q_{2}) Γ, x : σ_{1} ⊢ a_{2} : σ_{2} \\ (Q_{2}) σ_{2} ⊑ α \end{matrix}}{(Q_{2}) Γ, x : σ_{1} ⊢ a_{2} : α} Inst
\frac{(Q_{2}) Γ ⊢ let x = a_{1} in a_{2} : α}{(Q) Γ ⊢ let x = a_{1} in a_{2} : σ_{2}} Gen+Inst

Let

∘ Case Oracle^{▽} is a combination of Oracle and Inst.

Proof of Lemma 6.2.3

By induction on the derivation of (Q) Γ ⊢′ a : σ. Cases App^{▽}, Fun^{▽}, Let^{▽}, Inst and Oracle^{▽} are by induction hypothesis. ∘ Case Var^{▽}: We have (Q) Γ ⊢′ z : σ and z : σ is in Γ. By definition, z : σ′ is in Γ′, with (Q) σ′ ⊑ σ. Hence, we have (Rule Var^{▽}) (Q) Γ′ ⊢′ z : σ′ and we get the expected result (Q) Γ′ ⊢′ z : σ by Rule Inst. ∘ Case Gen: The premises are (Q, α ⋄ σ_{a}) Γ ⊢′ a : σ′ (\underline{1}) and α ∉ ftv(Γ). The conclusion is (Q) Γ ⊢′ a : ∀ (α ⋄ σ_{a}) σ′. We have (Q) Γ′ ⊑ Γ. By well-formedness, all free type variables of Γ′ must be bound in Q. Since α ∉ dom(Q), we have α ∉ ftv(Γ′). The result is by induction hypothesis on (1) and Rule Gen, then.

Proof of Property 6.2.5

\underline{Property i}: By hypothesis, we have a derivation ending with Gen. Its premise is (Q, α ⋄ σ) Γ ⊢′ a : σ′ (\underline{1}) and its conclusion is (Q) Γ ⊢′ a : ∀ (α ⋄ σ) σ′ (\underline{2}). Besides, α ∉ ftv(Γ) (\underline{3}). We have to show that there exists a derivation of (Q) Γ ⊢′ a : σ′′ (\underline{4}), with σ′′ ≡ ∀ (α ⋄ σ) σ′ (\underline{5}), and the size of (4) must be strictly smaller than the size of (2), or, equivalently, the size of (4) is smaller than or equal to the size of (1). The proof is by induction on the size of the term, then on the size of the derivation, and then by case on the penultimate rule (the last rule being, by hypothesis, Rule Gen). ∘ Case Var^{▽}: The premise of this penultimate rule is x : σ′ ∈ Γ (\underline{6}), and its conclusion is (1), with a being x. We have α ∉ ftv(σ′) by (3) and (6). Thus ∀ (α ⋄ σ) σ′ ≡ σ′ (\underline{7}) holds by Eq-Free. We have (Q) Γ ⊢′ x : σ′ (\underline{8}) by Var^{▽}, that is (4), taking σ′′ = σ′. As expected (5) holds by (7). Besides, the size of (8) is one, which is equal to the size of (1). ∘ Case Fun^{▽}: The premise is (Q, α ⋄ σ, Q′) Γ, x : τ_{0} ⊢′ a_{0} : σ_{0} (\underline{9}) and dom(Q′) # ftv(Γ) (\underline{10}). Besides, σ′ is ∀ (Q′, β ≥ σ_{0}) τ_{0} → β (\underline{11}). Hence, (1) is written (Q, α ⋄ σ) Γ ⊢′ λ(x) a_{0} : ∀ (Q′, β ≥ σ_{0}) τ_{0} → β. By (3) and (10), we have dom(α ⋄ σ, Q′) # ftv(Γ). Hence, by Rule Fun^{▽} applied to (9), we get (Q) Γ ⊢′ λ(x) a_{0} : ∀ (α ⋄ σ, Q′, β ≥ σ_{0}) τ_{0} → β (\underline{12}). Taking σ′′ = ∀ (α ⋄ σ, Q′, β ≥ σ_{0}) τ_{0} → β, we have shown (4) and (5), using (11). Additionally, the size of (12) is the size of (1). ∘ Case App^{▽}: The premises are (Q, α ⋄ σ) Γ ⊢′ a_{1} : σ_{1} (\underline{13}) and (Q, α ⋄ σ) Γ ⊢′ a_{2} : σ_{2} (\underline{14}). Moreover, we have (Q, α ⋄ σ) σ_{1} ⊑ ∀ (Q′) τ_{2} → τ_{1} (\underline{15}) and (Q, α ⋄ σ) σ_{2} ⊑ ∀ (Q′) τ_{2} (\underline{16}). Besides, σ′ is ∀ (Q′) τ_{1}. By (3), (13) and Rule Gen, we get (Q) Γ ⊢′ a_{1} : ∀ (α ⋄ σ) σ_{1} (\underline{17}). Besides, the size of (17) is the size of (13) plus one. By induction hypothesis, (Q) Γ ⊢′ a_{1} : σ′_{1} (\underline{18}) is derivable with σ′_{1} ≡ ∀ (α ⋄ σ) σ_{1} (\underline{19}). Moreover, the size of (18) is strictly smaller than the size of (17), that is, smaller than or equal to the size of (13). Similarly, (Q) Γ ⊢′ a_{2} : σ′_{2} (\underline{20}) is derivable with σ′_{2} ≡ ∀ (α ⋄ σ) σ_{2} (\underline{21}), and the size of (20) is smaller than or equal to the size of (14). By (19), (15) and R-Context-R we get (Q) σ′_{1} ⊑ ∀ (α ⋄ σ, Q′) τ_{2} → τ_{1} (\underline{22}). Similarly, (21) and (16) give (Q) σ′_{2} ⊑ ∀ (α⋄σ, Q′) τ_{2} (\underline{23}). By (18), (20), (22), and (23), and Rule App^{▽}, we get (Q) Γ ⊢′ a_{1} a_{2} : ∀ (α ⋄ σ, Q′) τ_{1} (\underline{24}). This corresponds to (4). Additionally, the size of (24) is one plus the size of (18) and the size of (20). Hence, it is smaller than or equal to one plus the size of (13) plus the size of (14), that is, the size of (1). ∘ Case Inst: The premises are (Q, α⋄σ) Γ ⊢′ a : σ_{0} (\underline{25}). and (Q, α⋄σ) σ_{0} ⊑ σ′ (\underline{26}). By Rule Gen, (Q) Γ ⊢′ a : ∀ (α ⋄ σ) σ_{0} holds. By induction hypothesis, (Q) Γ ⊢′ a : σ′_{0} (\underline{27}) holds, with σ′_{0} ≡ ∀ (α ⋄ σ) σ_{0} (\underline{28}), and the size of (27) is smaller than or equal to the size of (25). From (26), R-Context-R, and (28), we get (Q) σ′_{0} ⊑ ∀ (α ⋄ σ) σ′. Hence, with (27) and Inst, this gives (Q) Γ ⊢′ a : ∀ (α ⋄ σ) σ′ (\underline{29}). Besides, the size of (29) is smaller than or equal to one plus the size of (25). Hence, it is smaller than or equal to the size of (1). ∘ Case Oracle^{▽} is similar. ∘ Case Gen: The premise is (Q, α⋄σ, α_{1} ⋄_{1} σ_{1}) Γ ⊢′ a : σ_{0} (\underline{30}), and σ′ is ∀ (α_{1} ⋄_{1} σ_{1}) σ_{0}. By induction hypothesis, we have a derivation of (Q, α ⋄ σ) Γ ⊢′ a : σ′_{0} (\underline{31}) which is smaller than or equal to the size of (30) and with σ′_{0} ≡ σ′ (\underline{32}). By Rule Gen, we get (Q) Γ ⊢′ a : ∀ (α ⋄ σ) σ′_{0}. By induction hypothesis, we have a derivation of (Q) Γ ⊢′ a : σ′′ (\underline{33}), where σ′′ ≡ ∀ (α ⋄ σ) σ′_{0} (\underline{34}), and the size of (33) is smaller than or equal to the size of (31). We note that σ′′ ≡ ∀ (α ⋄ σ) σ′ by (32) and (34). Besides, the size of (33) is smaller than or equal to the size of (30). Thus, it is strictly smaller than the size of (1). ∘ Case Let^{▽}: The premises are (Q, α ⋄ σ) Γ ⊢′ a_{1} : σ_{1} (\underline{35}) as well as (Q, α ⋄ σ) Γ, x : σ_{1} ⊢′ a_{2} : σ′ (\underline{36}). By Gen and (35), we get (Q) Γ ⊢′ a_{1} : ∀ (α ⋄ σ) σ_{1}. By induction hypothesis, we have a derivation of (Q) Γ ⊢′ a_{1} : σ′_{1} (\underline{37}), with σ′_{1} ≡ ∀ (α ⋄ σ) σ_{1} (\underline{38}). Besides, the size of (37) is smaller than or equal to the size of (35). We note that (Q, α ⋄ σ) ∀ (α ⋄ σ) σ_{1} ⊑ σ_{1} (\underline{39}) is derivable by I-Drop^{⋆}. From (39) and (38), we get (Q, α⋄σ) σ′_{1} ⊑ σ_{1} (\underline{40}). By Strengthen’, (36), and (40), we get (Q, α⋄σ) Γ, x : σ′_{1} ⊢′ a_{2} : σ′ (\underline{41}). Note that we have α ∉ ftv(σ) by well formedness of the prefix of (35). Hence, we have α ∉ ftv(∀ (α⋄σ) σ_{1}), which implies α ∉ ftv(σ′_{1}) (\underline{42}) by Property 1.5.4.iii (page 50) and (38). By Rule Gen, (42) and (41), we get (Q) Γ, x : σ′_{1} ⊢′ a_{2} : ∀ (α ⋄ σ) σ′ (\underline{43}). By Rule Let^{▽}, (37) and (43), we get (Q) Γ ⊢′ a : ∀ (α ⋄ σ) σ′ (\underline{44}). The size of (44) is one plus the size of (37) (remember that the right premise of Let^{▽} is not counted). Hence, the size of (44) is smaller than or equal to one plus the size of (35). Consequently, the size of (44) is smaller than or equal to the size of (1).

\underline{Property ii}: By induction on the size of the term, then on the size of the derivation. Case Var^{▽} is immediate. Cases Fun^{▽}, App^{▽}, Inst, and Oracle^{▽} are by induction hypothesis. ∘ Case Let^{▽}: The premises are (Q) Γ ⊢′ a_{1} : σ_{1} and (Q) Γ, x : σ_{1} ⊢′ a_{2} : σ_{2} (\underline{1}). By induction hypothesis, (Q) Γ ⊢′ a_{1} : σ′_{1} (\underline{2}) is derivable not using Gen, with σ′_{1} ≡ σ_{1}. By Strengthen’ and (1), we get (Q) Γ, x : σ′_{1} ⊢′ a_{2} : σ_{2}. By induction hypothesis (a_{2} is a subexpression of a), we have a derivation of (Q) Γ, x : σ′_{1} ⊢′ a_{2} : σ′_{2} (\underline{3}) not using Gen and σ′_{2} ≡ σ_{2}. By Let^{▽}, (2), and (3), we have a derivation of (Q) Γ ⊢′ a : σ′_{2} not using Gen, and σ′_{2} ≡ σ_{2}. This is the expected result. ∘ Case Gen: By Property i, there exists a strictly smaller derivation not ending with Gen of (Q) Γ ⊢′ a : σ′′_{a} with σ′′_{a} ≡ σ_{a} (\underline{4}). Hence, by induction hypothesis, we have a derivation not using Gen of (Q) Γ ⊢′ a : σ′_{a} with σ′_{a} ≡ σ′′_{a} (\underline{5}). By R-Trans, (5), and (4), we have σ′_{a} ≡ σ_{a}, which is the expected result.

\underline{Property iii}: By induction on the size of the term and on the derivation. ∘ Case Var^{▽} is immediate. ∘ Case Inst: The premises are (Q) Γ ⊢′ a : σ (\underline{1}) and (Q) σ ⊑ σ_{a} (\underline{2}). We get the expected result by induction hypothesis on (1) and (2). ∘ Case Gen: By hypothesis, this case cannot occur. ∘ Case Fun^{▽}: The premise is (QQ′) Γ, x : τ_{0} ⊢^{▽} a : σ and dom(Q′) ∩ ftv(Γ) = ∅. By induction hypothesis, we have a derivation of (QQ′) Γ, x : τ_{0} ⊢^{▽} a : σ′ (not using Inst) such that (QQ′) σ′ ⊑ σ (\underline{3}). By Rule Fun^{▽}, we have (Q) Γ ⊢^{▽} λ(x) a : ∀ (Q′, α ≥ σ′) τ_{0} → α, and we easily check that (Q) ∀ (Q′, α ≥ σ′) τ_{0} → α ⊑ ∀ (Q′, α ≥ σ) τ_{0} → α holds by rules R-Context-R, R-Context-Flexible, and (3). ∘ Case Oracle^{▽} and App^{▽}: These rules already contains an occurrence of Inst by construction. Thus, the we get the result by induction hypothesis. ∘ Case Let^{▽} The premises are (Q) Γ ⊢′ a_{1} : σ_{1} and (Q) Γ, x : σ_{1} ⊢′ a_{2} : σ_{2}. By induction hypothesis, we have a derivation of (Q) Γ ⊢^{▽} a_{1} : σ′_{1} (\underline{4}) such that (Q) σ′_{1} ⊑ σ_{1} holds. Hence, by Rule Strengthen, we have (Q) Γ, x : σ′_{1} ⊢′ a_{2} : σ_{2} (\underline{5}). Note that a_{2} is a subterm of a, thus the induction hypothesis can be applied to (5). Hence, by induction hypothesis, we have a derivation of (Q) Γ, x : σ′_{1} ⊢^{▽} a_{2} : σ′_{2} with (Q) σ′_{2} ⊑ σ_{2} (\underline{6}). We conclude with Rule Let^{▽}, (4), and (6).

Proof of Property 8.1.5

\underline{Property i}: It is shown by structural induction on σ.

\underline{Property ii}: We prove the first rule by induction on the size of Q. If Q is ∅, ⟨⟨∅⟩⟩ is ∅, id, and ⟨⟨σ⟩⟩ = ∀ (∅) id(⟨⟨σ⟩⟩) holds. Otherwise, Q is (α ⋄ σ_{0}, Q′). Let ∀ (Q_{1}) τ_{1} be ⟨⟨σ_{0}⟩⟩ and Q′_{1}, θ_{1} be ⟨⟨Q′⟩⟩. By induction hypothesis, ⟨⟨∀ (Q′) σ⟩⟩ = ∀ (Q′_{1}) θ_{1}(⟨⟨σ⟩⟩). Hence, by Definition 8.1.4, ⟨⟨∀ (Q) σ⟩⟩ is ∀ (Q_{1}Q′_{1}) θ_{1}(⟨⟨σ⟩⟩)[τ_{1}/α] (\underline{1}). By definition, ⟨⟨Q⟩⟩ is Q_{1}Q′_{1}, [τ_{1}/α] ∘ θ_{1}. Hence, (1) is the expected result.

The second rule is proved by induction on the size of Q_{1}. If Q_{1} is ∅, the result is immediate. Otherwise, Q_{1} is (α⋄σ, Q′_{1}). Let Q′′_{1}, θ′_{1} be ⟨⟨Q′_{1}⟩⟩. By induction hypothesis, ⟨⟨Q′_{1}Q_{2}⟩⟩ is Q′′_{1}Q′_{2}, θ′_{1} ∘θ_{2}. Let ∀ (Q) τ be ⟨⟨σ⟩⟩. By definition, ⟨⟨Q_{1}Q_{2}⟩⟩ is QQ′′_{1}Q′_{2}, [τ/α]∘ θ′_{1} ∘ θ_{2}. We get the expected result by observing that ⟨⟨Q_{1}⟩⟩ is QQ′′_{1}, [τ/α] ∘ θ′_{1}.

\underline{Property iii}: It is shown by structural induction on σ.

\underline{Property iv}: By hypothesis, we have σ ≡ τ. By Property 1.5.4.i (page 50), we have σ/ = τ/. By Property iii, we have σ/ = ⟨⟨σ⟩⟩/. Hence, ⟨⟨σ⟩⟩/ = τ/. Moreover, ⟨⟨σ⟩⟩ is necessarily of the form ∀ (ᾱ) τ′. For any u in dom(⟨⟨σ⟩⟩), we have ⟨⟨σ⟩⟩/u = τ/u, hence ⟨⟨σ⟩⟩/u ≠ ⊥, that is, ∀ (ᾱ) τ′/u ≠ ⊥ for any u in dom(∀ (ᾱ) τ′). Hence, we must have ᾱ # ftv(τ′). Consequently, ∀ (ᾱ) τ′/ = τ′/, thus τ′/ = τ/. This implies τ = τ′. We have shown that ⟨⟨σ⟩⟩ is ∀ (ᾱ) τ with ᾱ # ftv(τ).

\underline{Property v}: It is shown by induction on the size of Q. If Q is ∅, the result is immediate. Otherwise, Q is (Q′, α ⋄ σ). Let ∀ (Q_{1}) τ_{1} be ⟨⟨σ⟩⟩, and Q′_{1}, θ_{1} be ⟨⟨Q′⟩⟩. By induction hypothesis, θ_{1} is of the form θ′_{1} ∘Q̂′. By definition, θ is [τ_{1}/α]∘θ_{1}, that is [τ_{1}/α]∘θ′_{1} ∘Q̂′. If σ ∉ T , then Q̂ = Q̂′, and θ is [τ_{1}/α] ∘ θ′_{1} ∘ Q̂. This is the expected result. Otherwise, σ ≡ τ, and τ_{1} is τ by Property iv. Moreover, Q̂ is [τ/α] ∘ Q̂′. Then θ is [τ/α] ∘ θ′_{1} ∘ Q̂′. Consequently, θ is equivalent to [τ/α] ∘ θ′_{1} ∘ [τ/α] ∘ Q̂′, that is, [τ/α] ∘ θ′_{1} ∘ Q̂. This is the expected result.

\underline{Property vi}: It is by induction on the derivation of (Q) σ_{1} ⊑ σ_{2}. Cases R-Trans, A-Hyp, … and I-Rigid are not possible since the derivation is flexible. ∘ Case Eq-Refl: immediate. ∘ Case R-Trans: By induction.

∘ Case R-Trans: By induction.

∘ Case Eq-Free: This case corresponds to adding or removing useless binders in an ML type scheme.

∘ Case Eq-Comm: This case corresponds to commuting binders in an ML type scheme.

∘ Case Eq-Var: ⟨⟨∀ (α ≥ σ) α⟩⟩ and ⟨⟨σ⟩⟩ are identical.

∘ Case R-Context-R: Let Q_{a} be (Q, α ≥ σ_{0}). Let ∀ (Q_{0}) τ_{0} be ⟨⟨σ_{0}⟩⟩. Let Q′, θ be ⟨⟨Q⟩⟩, and let θ′ be [τ_{0}/α]. The premise is (Q_{a}) σ′_{1} ⊑ σ′_{2}, and we have σ_{1} = ∀ (α≥σ_{0}) σ′_{1}, as well as σ_{2} = ∀ (α≥σ_{0}) σ′_{2}. We have ⟨⟨Q_{a}⟩⟩ = Q′Q_{0}, θ∘θ′ by Property ii. By induction hypothesis, we have θ ∘ θ′(⟨⟨σ′_{1}⟩⟩) ⊑_{ML} θ ∘ θ′(⟨⟨σ′_{2}⟩⟩) (\underline{1}). Hence, we have

θ(⟨⟨∀ (α ≥ σ_{0}) σ_{1}⟩⟩) =  θ(∀ (Q_{0}) θ′(⟨⟨σ_{1}⟩⟩) by definition
=  ∀ (Q_{0}) θ ∘ θ′(⟨⟨σ_{1}⟩⟩)
⊑_{ML} ∀ (Q_{0}) θ ∘ θ′(⟨⟨σ_{2}⟩⟩) by (1)
=  θ(∀ (Q_{0}) θ′(⟨⟨σ_{2}⟩⟩))
=  θ(⟨⟨∀ (α ≥ σ_{0}) σ_{2}⟩⟩) by definition

This is the expected result.

∘ Case R-Context-L: See R-Context-Flexible

∘ Case R-Context-Flexible: The premise is ∀ (Q) σ′_{1} ⊑ σ′_{2}, and the conclusion is ∀ (Q) ∀ (α≥σ′_{1}) σ ⊑ ∀ (α≥σ′_{2}) σ. Let Q′θ be ⟨⟨Q⟩⟩. Let ∀ (Q_{1}) τ_{1} be ⟨⟨σ′_{1}⟩⟩ and ∀ (Q_{2}) τ_{2} be ⟨⟨σ′_{2}⟩⟩. Let θ_{1} be [τ_{1}/α] and θ_{2} be [τ_{2}/α]. We have ⟨⟨∀ (α ≥ σ′_{1}) σ⟩⟩ = ∀ (Q_{1}) θ_{1}(⟨⟨σ⟩⟩) and ⟨⟨∀ (α ≥ σ′_{2}) σ⟩⟩ = ∀ (Q_{2}) θ_{2}(⟨⟨σ⟩⟩). By induction hypothesis, we have θ(⟨⟨σ′_{1}⟩⟩) ⊑_{ML} θ(⟨⟨σ′_{2}⟩⟩), that is, ∀ (Q_{1}) θ(τ_{1}) ⊑_{ML} ∀ (Q_{2}) θ(τ_{2}). By Lemma 8.1.1 (page 171), we get ∀ (Q_{1}) θ ∘ θ_{1}(⟨⟨σ⟩⟩) ⊑_{ML} ∀ (Q_{2}) θ ∘ θ_{2}(⟨⟨σ⟩⟩), which is the expected result.

∘ Case Eq-Mono: The premises are (α ⋄ σ_{0}) ∈ Q and (Q) σ_{0} ≡ τ_{0}. The conclusion is (Q) τ ≡ τ[τ_{0}/α]. We have Q̂(α) = Q̂(τ_{0}) by definition. Let Q′, θ be ⟨⟨Q⟩⟩. We have θ(α) = θ(τ_{0}) by Property v. Hence, we have θ(τ) = θ(τ[τ_{0}/α]). This is the expected result.

∘ Case I-Hyp: We have (α_{1} ≥ σ_{1}) ∈ Q and the conclusion is (Q) σ_{1} ⊑ α_{1}. Let ∀ (Q_{1}) τ_{1} be ⟨⟨σ_{1}⟩⟩ and Q′, θ be ⟨⟨Q⟩⟩. By definition, θ(α_{1}) = θ(τ_{1}). Besides, θ(∀ (Q_{1}) τ_{1}) is ∀ (Q_{1}) θ(τ_{1}) since Q_{1} is unconstrained, and ∀ (Q_{1}) θ(τ_{1}) ⊑_{ML} θ(τ_{1}) holds, that is, ∀ (Q_{1}) θ(τ_{1}) ⊑_{ML} θ(α_{1}). Thus we have the expected result θ(∀ (Q_{1}) τ_{1}) ⊑_{ML} θ(α_{1}).

∘ Case I-Bot: ∀ (α) α ⊑_{ML} σ holds for any ML type σ.

This proves the property.

Proof of Lemma 8.3.2

Let us name the conclusions (1) through (4) in order of appearance:

{(Q_{0}) Γ ⊢ a : ∀ (Q′) σ′_{1} (\underline{1})  Q_{0}Q ⊑ Q_{0}Q′ (\underline{2})  (Q_{0}Q′) σ′_{1} ⊐ − σ (\underline{3}) \atop (Q_{0}) ∀ (Q′) σ ⊑ σ_{0} (\underline{4})}

We write Q′′ for (Q, α_{1} = σ, α_{0} = σ). By Lemma 6.2.6, it suffices to show the result for (Q_{0}) Γ ⊢^{▽} (a : ∃ (Q) σ) : ∀ (Q_{1}) τ_{0} (\underline{5}) with (Q_{0}) ∀ (Q_{1}) τ_{0} ⊑ σ_{0} (\underline{6}). The premises of (5) are necessarily

{(Q_{0}) Γ ⊢^{▽} a : σ_{1} (\underline{7}) (Q_{0}) σ_{1} ⊑ ∀ (Q_{1}) τ_{1} (\underline{8}) \atop (Q_{0}) ∀ (Q′′) α_{1} → α_{0} ⊑ ∀ (Q_{1}) τ_{1} → τ_{0} (\underline{9})}

∘ Soundness Assume (1), (2), (3), and (4). Take (Q′, α_{1} = σ′_{1}, α_{0} = σ) for Q_{1}, α_{1} for τ_{1}, and α_{0} for τ_{0}. By Lemma 6.2.6 and (1), there exists σ_{1} such that (7) holds and (Q_{0}) σ_{1} ⊑ ∀ (Q′) σ′_{1} (\underline{10}) holds. By Eq-Var^{⋆}, we have (Q_{0}) ∀ (Q_{1}) τ_{1} ≡ ∀ (Q′) σ′_{1}. Hence, (10) gives (Q_{0}) σ_{1} ⊑ ∀ (Q_{1}) τ_{1} (8). We have (Q_{0}Q) ∀ (Q′′) α_{1} → α_{0} ⊑ ∀ (α_{1} =σ) ∀ (α_{0} = σ) α_{1} → α_{0} (\underline{11}) by I-Drop^{⋆}. By (2) and Lemma 3.6.4 applied to (11), we get (Q_{0}Q′) ∀ (Q′′) α_{1} → α_{0} ⊑ ∀ (α_{1} = σ) ∀ (α_{0} = σ) α_{1} → α_{0}. Using I-Abstract with (3), we get (Q_{0}Q′) ∀ (Q′′) α_{1} → α_{0} ⊑ ∀ (α_{1} = σ′_{1}) ∀ (α_{0} = σ) α_{1} → α_{0}. Hence, by R-Context-R and Eq-Free, we get (Q_{0}) ∀ (Q′′) α_{1} → α_{0} ⊑ ∀ (Q′) ∀ (α_{1}=σ′_{1}) ∀ (α_{0}=σ) α_{1} → α_{0}, that is (Q_{0}) ∀ (Q′′) α_{1} → α_{0} ⊑ ∀ (Q_{1}) α_{1} → α_{0} (9). The premises (7), (8), (9) are checked, thus Rule App applies and gives (Q_{0}) Γ ⊢^{▽} (a : ∃ (Q) σ) : ∀ (Q_{1}) τ_{0} (5). Finally, (Q_{0}) ∀ (Q_{1}) τ_{0} ≡ ∀ (Q′) σ holds by Eq-Var^{⋆}, thus (Q_{0}) ∀ (Q_{1}) τ_{0} ⊑ σ_{0} (6) holds by (4). ∘ Completeness For simplicity, we assume that dom(Q/ ftv(σ)) = dom(Q) (\underline{12}), that is, Q contains only useful bindings. By hypothesis, (5) and (6) hold, thus we have the premises (7), (8), and (9). By Rule Inst, (7) and (8), we have (Q_{0}) Γ ⊢ a : ∀ (Q_{1}) τ_{1} (\underline{13}). By Lemma 3.4.4 applied to (9), there exists a prefix P_{1} such that ∀ (P_{1}) τ′_{1} → τ′_{0} is an alpha-conversion of ∀ (Q_{1}) τ_{1} → τ_{0}, and a substitution θ such that

(Q_{0}P_{1}) θ(α_{1} → α_{0}) ≡ τ′_{1} → τ′_{0} (\underline{14})  J = dom(Q′′/α_{1} → α_{0}) (\underline{15})  dom(θ) ⊆ J
Q_{0}Q′′ ⊑^{dom(Q_{0})∪J} Q_{0}P_{1}\underline{θ} (\underline{16})

From (12) and (15), we get J = dom(Q′′). Hence, (16) becomes Q_{0}Q′′ ⊑ Q_{0}P_{1}\underline{θ} (\underline{17}). By Property 3.4.2.i (page 106) and PE-Free, we get Q_{0}Q ⊑ Q_{0}P_{1}\underline{θ}, that is (2) by taking Q′ = P_{1}\underline{θ}. By Property 1.5.11.viii (page 54) on (14), we get (Q_{0}P_{1}) θ(α_{1}) ≡ τ′_{1} (\underline{18}) and (Q_{0}P_{1}) θ(α_{0}) ≡ τ′_{0} (\underline{19}). By alpha-conversion, (13) becomes (Q_{0}) Γ ⊢ a : ∀ (P_{1}) τ′_{1}. From (18), and Inst, we get (Q_{0}) Γ ⊢ a : ∀ (P_{1}) θ(α_{1}), that is, (Q_{0})

Γ ⊢ a : ∀ (Q′) α_{1} (1) by taking σ′_{1} = α_{1}. We have (Q_{0}Q′′) σ ⊏ − α_{1} by A-Hyp. Hence, by Lemma 3.6.4 on (17), we get (Q_{0}Q′) σ ⊏ − α_{1}, that is, (3). Similarly, we can derive (Q_{0}Q′) σ ⊏ − α_{0}. Hence, (Q_{0}) ∀ (Q′) σ ⊑ ∀ (Q′) α_{0} (\underline{20}) holds by R-Context-R. We have (Q_{0}) ∀ (Q′) α_{0} ≡ ∀ (P_{1}) τ′_{0} from (19). By alpha-conversion, we have (Q_{0}) ∀ (Q′) α_{0} ≡ ∀ (Q_{1}) τ_{0} (\underline{21}). By R-Trans on (20), (21), and (6) we get (Q_{0}) ∀ (Q′) σ ⊑ σ_{0}, that is, (4).

Proof of Corollary 8.3.3

Directly, we assume (Q_{0}) Γ ⊢ (a : ⋆) : σ_{0} holds. By Lemma 6.2.6, (Q_{0}) Γ ⊢^{▽} (a : ⋆) : σ′_{0} (\underline{1}) holds with (Q_{0}) σ′_{0} ⊑ σ_{0} (\underline{2}). The judgment (1) must be derived by Rule Oracle. Thus there must exists σ_{1} and σ_{2} such that we have

(Q_{0}) Γ ⊢^{▽} a : σ_{1} (\underline{3})  (Q_{0}) σ_{1} ⊑ σ_{2} (\underline{4})  (Q_{0}) σ_{2} ⊐ − σ′_{0} (\underline{5})

Let ϕ be a renaming of domain dom(Q_{0}). Let Q be ϕ(Q_{0}) and σ be ϕ(σ_{0}). Let Q′ be \underline{ϕ^{¬}}. Let σ′_{1} be ϕ(σ_{2}) and σ be ϕ(σ′_{0}). By Rule Inst, (3) and (4), we get (Q_{0}) Γ ⊢ a : σ_{2}, which gives by Eq-Mono^{⋆} (Q_{0}) Γ ⊢ a : ∀ (Q′) σ′_{1} (\underline{6}). We have Q_{0}Q ⊑ Q_{0}Q′ (\underline{7}) by Property 3.4.2.v (page 106). From (5), we get (Q_{0}Q′) ϕ(σ′_{0}) ⊏ − ϕ(σ_{2}), that is, (Q_{0}Q′) σ ⊏ − σ′_{1} (\underline{8}). By (2), we have (Q_{0}) ∀ (Q′) σ ⊑ σ_{0} (\underline{9}). Hence, by (6), (7), (8), (9), and by Lemma 8.3.2 we have (Q_{0}) Γ ⊢ (a : ∃ (Q) σ) : σ_{0}. This is the expected result.

Conversely, by Lemma 8.3.2, there exists Q′ and σ′_{1} such that (Q_{0}) Γ ⊢ a : ∀ (Q′) σ′_{1} (\underline{10}) holds as well as (Q_{0}Q′) σ′_{1} ⊐ − σ (\underline{11}) and (Q_{0}) ∀ (Q′) σ ⊑ σ_{0} (\underline{12}). By Rule R-Context-R on (11), we get (Q_{0}) ∀ (Q′) σ′_{1} ⊐ − ∀ (Q′) σ (\underline{13}). Hence, by (10), (13) and Rule Oracle, we get (Q_{0}) Γ ⊢ (a : ⋆) : ∀ (Q′) σ. We get the expected result by Rule Inst and (12).

Proof of Lemma 8.3.4

Hypothesis H0 is easily checked. Hypothesis H1 is a direct consequence of Corollary 8.3.3. Hypothesis H2: (v : ∃ (Q) σ) always reduces.

Proof of Lemma 10.2.1

By Lemmas 2.5.5 and 2.5.6, we have a restricted derivation of (Q) σ_{1} ⊏ −ᾱ σ_{2} (\underline{1}). We show w_{Y} (σ_{2}) ⩽_{Z} w_{Y} (σ_{1}) by induction on the derivation of (1). Case A-Equiv’ is a direct consequence of Lemma 2.7.5. Case R-Trans is by induction hypothesis. ∘ Case A-Context-L’: We have σ_{1} = ∀ (α = σ′_{1}) σ, σ_{2} = ∀ (α = σ′_{2}) σ, and the premise is (Q) σ′_{1} ⊏ − σ′_{2}. By induction hypothesis, we have w_{Y} (σ′_{2}) ⩽_{Z} w_{Y} (σ′_{1}) (\underline{2}). By Lemma 2.5.6, we have nf(σ) ≠ α, and α ∈ ftv(σ). Hence, by definition we have w_{Y} (σ_{1}) = Y × w_{Y} (σ′_{1}) + w_{Y} (σ) and w_{Y} (σ_{2}) = Y × w_{Y} (σ′_{2}) + w_{Y} (σ). We conclude by (2), then.

∘ Case R-Context-R: We have σ_{1} = ∀ (α ⋄ σ) σ′_{1}, σ_{2} = ∀ (α ⋄ σ) σ′_{2}, and the premise is (Q, α ⋄ σ) σ′_{1} ⊏ −^{ᾱ∪\{α\}} σ′_{2} (\underline{3}). By induction hypothesis, we have w_{Y} (σ′_{2}) ⩽_{Z} w_{Y} (σ′_{1}) (\underline{4}). We consider a four subcases:

Subcase σ ∈ T : Then w_{Y} (σ_{1}) = w_{Y} (σ′_{1}) and w_{Y} (σ_{2}) = w_{Y} (σ′_{2}). We conclude by (4). In the following, we assume σ ∉ T . By (3), and Lemmas 2.5.7 (page 83) and 2.1.4 (page 67), we have α ∈ ftv(σ′_{1}) if and only if α ∈ ftv(σ′_{2}) (\underline{5}).

Subcase nf(σ′_{1}) = α: Then we have (Q, α ⋄ σ) σ′_{1} ≡ σ′_{2} by Lemma 2.1.6, which implies (Q) σ_{1} ≡ σ_{2}. We conclude by Lemma 2.7.5.

Subcase α ∉ ftv(σ′_{1}): Then α ∉ ftv(σ′_{2}) by (5). Hence, we have w_{Y} (σ_{1}) = w_{Y} (σ′_{1}) and w_{Y} (σ_{2}) = w_{Y} (σ′_{2}). We conclude by (4).

Subcase α ∈ ftv(σ′_{1}): Then α ∈ ftv(σ′_{2}) by (5). Either w_{Y} (σ_{2}) is Y × w_{Y} (σ) + w_{Y} (σ′_{2}) or it is w_{Y} (σ) if nf(σ′_{2}) = α. In both cases, we see that w_{Y} (σ_{2}) =_{Z} w_{Y} (σ) + w_{Y} (σ′_{2}). By (4), we have w_{Y} (σ_{2}) ⩽_{Z} w_{Y} (σ) + w_{Y} (σ′_{1}), that is, w_{Y} (σ_{2}) ⩽_{Z} w_{Y} (σ_{1}). ∘ Case A-Hyp’: We have σ_{2} = α, with (α = σ_{1}) ∈ Q. We simply note that w_{Y} (σ_{2}) is w_{Y} (α), that is, 0. ∘ Case A-Alias’: We check that w_{Y} (σ_{1}) =_{Z} w_{Y} (σ_{2}). ∘ Case A-Up’: We check that w_{Y} (σ_{1}) =_{Z} w_{Y} (σ_{2}).

Proof of Property 10.3.3

\underline{Property i}: Let S be an ᾱ-stable set. Let θ be a substitution invariant on ᾱ. By definition, we have θ(S) ⊆ S. This implies fsub (θ(S)) ⊆ fsub (S) (\underline{1}). By Property 10.3.1.ii, we have θ(fsub (S)) ⊆ fsub (θ(S)) (\underline{2}). By (2) and (1), we get θ(fsub (S)) ⊆ fsub (S). This means that fsub (S) is ᾱ-stable.

\underline{Property ii}: This is a direct consequence of Property i, by observing that \{t\} is ftv(t)- stable.

\underline{Property iii}: By hypothesis, S is ᾱ-stable (\underline{1}) and β̄-stable (\underline{2}). Let θ be a substitution invariant on ᾱ ∩ β̄ (\underline{3}). We show by induction on the size of dom(θ) that θ(S) ⊆ S holds. If dom(θ) = ∅, then result is immediate. Otherwise, θ can be decomposed into [t/α] ∘ θ′, such that the size of dom(θ′) is the size of dom(θ) minus one. We have to show [t/α] ∘ θ′(S) ⊆ S. By induction hypothesis, we have θ′(S) ⊆ S. Hence, it suffices to show that S[t/α] ⊆ S (\underline{4}). If α ∉ ᾱ, the substitution [t/α] is invariant on ᾱ, thus (4) holds by (1). Otherwise, α ∈ ᾱ. By hypothesis (3), we must have α ∉ ᾱ ∩ β̄. Hence, we have α ∉ β̄. Then the substitution [t/α] is invariant on β̄. Thus (4) holds by (2). In both cases, we have shown (4). Hence, by induction, we have θ(S) ⊆ S. This holds for any θ invariant on ᾱ ∩ β̄, thus S is (ᾱ ∩ β̄)-stable.

\underline{Property iv}: By hypothesis, S_{1} is ᾱ-stable (\underline{1}) and S_{2} is ᾱ-stable (\underline{2}). Let t_{1} be in S_{1}. If t_{1} ∈ Σ¬ ; β̄, then t_{1} ∈ S_{1}∩Σ¬ ; β̄, thus t_{1} ∈ S_{2}∩Σ¬ ; β̄ by hypothesis. Hence, t_{1} ∈ S_{2}. Otherwise, t_{1} ∉ Σ¬ ; β̄, which means that some free variables of t_{1} are in β̄. Let ϕ be a renaming of domain β̄ mapping β̄ to fresh variables, that is, variables outside ᾱ ∪ β̄ ∪ ftv(t_{1}). Since we have β̄ # ᾱ by hypothesis, ϕ is invariant on ᾱ. Hence, ϕ(S_{1}) ⊆ S_{1} holds by (1). This implies ϕ(t_{1}) ∈ S_{1}. Besides, ϕ(t_{1}) ∈ Σ¬ ; β̄. Hence, as shown above, ϕ(t_{1}) ∈ S_{2}. We note that ϕ^{¬} is a renaming invariant on ᾱ ∪ β̄ ∪ ftv(t_{1}). Hence, ϕ^{¬}(S_{2}) ⊆ S_{2} holds by (2). This implies ϕ^{¬} ∘ ϕ(t_{1}) ∈ S_{2}, that is, t_{1} ∈ S_{2}. As a conclusion, we have shown S_{1} ⊆ S_{2}.

\underline{Property v}: It is a direct consequence of Property iv.

\underline{Property vi}: As a preliminary result, we show ⋃_{α∈I} Σ_{ᾱ∪\{α\}}^{¬} = Σ¬ ; ᾱ (\underline{1}). Indeed, we have

Σ_{ᾱ∪{α}}^{¬} ⊆ Σ¬ ; ᾱ for any α. Hence, ⋃_{α∈I} Σ_{ᾱ∪{α}}^{¬} ⊆ Σ¬ ; ᾱ holds. Conversely, let t be in Σ¬ ; ᾱ. The set ftv(t) is finite and the set I is infinite. Hence, there exists α ∈ I such that α ∉ ftv(t). Then we have t ∈ Σ_{ᾱ∪{α}}^{¬}, that is, t ∈ ⋃_{α∈I} Σ_{ᾱ∪{α}}^{¬}. As a conclusion, we have shown (1).

We get back to the proof of the property. We have S_{1} ∩ Σ_{ᾱ∪{α}}^{¬} ⊆ S_{2} ∩ Σ_{ᾱ∪{α}}^{¬} for

all α in I. Hence, taking the union we get ⋃_{α∈I} S_{1} ∩ Σ_{ᾱ∪{α}}^{¬} ⊆ ⋃_{α∈I} S_{2} ∩ Σ_{ᾱ∪{α}}^{¬}, that is,

S_{1} ∩ ( ⋃_{α∈I} Σ_{ᾱ∪{α}}^{¬}) ⊆ S_{2} ∩ ( ⋃_{α∈I} Σ_{ᾱ∪{α}}^{¬}). By (1), we get S_{1} ∩ Σ¬ ; ᾱ ⊆ S_{2} ∩ Σ¬ ; ᾱ, which

means S_{1} ⊆ᾱ S_{2}.

\underline{Property vii}: Direct consequence of Property vi.

\underline{Property viii}: By hypothesis, we have S_{1} ⊆ᾱ S_{2} (\underline{1}). We have to show fsub (S_{1}) ⊆ᾱ fsub (S_{2}). Let t be in fsub (S_{1}) ∩ Σ¬ ; ᾱ. By definition, we have ftv(t) # ᾱ, and there exists t_{1} in S_{1} such that t_{1} ⊑_{F} t (\underline{2}). Observing that ftv(t_{1}) ⊆ ftv(t), we have ftv(t_{1}) # ᾱ. Hence, t_{1} ∈ S_{1} ∩ Σ¬ ; ᾱ. From (1), we get t_{1} ∈ S_{2}. Hence, from (2), we have t ∈ fsub (S_{2}). This is the expected result.

\underline{Property ix}: Direct consequence of Property viii.

\underline{Property x}: If we have ᾱ # codom(θ) and S_{1} =ᾱ S_{2}, then θ(S_{1}) =ᾱ θ(S_{2}). Let t be in θ(S_{1}) ∩ Σ¬ ; ᾱ. There exists t_{1} in S_{1} such that t = θ(t_{1}). Since ᾱ # ftv(t), we must have ᾱ # ftv(t_{1}). Hence, t_{1} is in S_{1}∩Σ¬ ; ᾱ, which implies t_{1} ∈ S_{2}. Then θ(t_{1}) ∈ θ(S_{2}). We have shown θ(S_{1}) ⊆ᾱ θ(S_{2}). By symmetry, we have θ(S_{2}) ⊆ᾱ θ(S_{1}), thus θ(S_{1}) =ᾱ θ(S_{2}) holds.

Proof of Property 10.3.6

\underline{Property i}: In all cases ((σ)) is of the form fsub (S) for some set of types S, and we simply note that fsub (fsub (S)) = fsub (S).

\underline{Property ii}: By structural induction on σ. ∘ Case σ is τ: Then ((σ)) is fsub (τ). Let t be in ((σ)). We have τ ⊑_{F} t, which implies that t is equivalent to τ. Hence, ftv(t) = ftv(τ), and ∀ α · t is equivalent to t. As a consequence, we have ∀ α · t ∈ ((σ)), which is the expected result. ∘ Case σ is ⊥: Then ((σ)) is fsub (∀ (α) α). We immediately have ∀ α · t ∈ ((σ)) for any t. Hence, ∀ α · ((σ)) ⊆ ((σ)). ∘ Case σ is ∀ (β = σ_{1}) σ_{2}: We can freely assume β ≠ α. By definition, ((σ)) is fsub (((σ_{2}))[\underline{σ_{1}}/β]). Hence, ∀ α · ((σ)) is ∀ α · fsub (((σ_{2}))[\underline{σ_{1}}/β]). Thus, by Property 10.3.1.iii, we have ∀ α · ((σ)) ⊆ fsub (∀ α · (((σ_{2}))[\underline{σ_{1}}/β])). By hypothesis, α ∉ ftv(σ) and σ is in normal form, hence α ∉ ftv(σ_{1}). By Property 10.3.1.i, we get α ∉ ftv(\underline{σ_{1}}), thus ∀ α· and the substitution [\underline{σ_{1}}/β] commute, leading to ∀ α · ((σ)) ⊆ fsub ((∀ α · ((σ_{2})))[\underline{σ_{1}}/β]). By induction hypothesis, we have ∀ α · ((σ_{2})) ⊆ ((σ_{2})). Hence, ∀ α · ((σ)) ⊆ fsub (((σ_{2}))[\underline{σ_{1}}/β]) holds, that is, ∀ α · ((σ)) ⊆ ((σ)). ∘ Case σ is ∀ (β ≥ σ_{1}) σ_{2}: We can freely assume β ≠ α. By definition, ((σ)) is

fsub ( ⋃_{t_{1}∈((σ_{1}))}^{ᾱ#ftv(σ_{1},σ_{2})} ∀ ᾱ · ((σ_{2}))[t_{1}/β])

Hence, we have

∀ α · ((σ)) = ∀ α · fsub (⋃_{t_{1}∈((σ_{1}))}^{ᾱ#ftv(σ_{1},σ_{2})} ∀ ᾱ · ((σ_{2}))[t_{1}/β])
⊆ fsub (⋃_{t_{1}∈((σ_{1}))}^{ᾱ#ftv(σ_{1},σ_{2})} ∀ α · ∀ ᾱ · ((σ_{2}))[t_{1}/β]) by Prop. 10.3.1.iii

By hypothesis, α ∉ ftv(σ) and σ is in normal form. We simply note that α ∪ ᾱ # ftv(σ_{1}, σ_{2}) holds for all ᾱ disjoint from ftv(σ_{1}, σ_{2}). Hence, we have

∀ α · ((σ)) ⊆ fsub ( ⋃_{t_{1}∈((σ_{1}))}^{ᾱ#ftv(σ_{1},σ_{2})} ∀ ᾱ · ((σ_{2}))[t_{1}/β])

That is, ∀ α · ((σ)) ⊆ ((σ)).

\underline{Property iii}: Let θ be a substitution invariant on ftv(σ). Let ᾱ be its domain. By Property ii, we have ∀ ᾱ · ((σ)) ⊆ ((σ)). Hence, applying fsub (), we get fsub (∀ ᾱ · ((σ))) ⊆ fsub (((σ))). By Property i, this is fsub (∀ ᾱ · ((σ))) ⊆ ((σ)). We simply note that θ(((σ))) ⊆ fsub (∀ ᾱ · ((σ))). Hence, we have θ(((σ))) ⊆ ((σ)). This holds for all θ invariant on ftv(σ), thus ((σ)) is ftv(σ)-stable.

\underline{Property iv}: Let t_{1} be in (fsub (t))[t′/α]. By definition, there exists t′_{1} such that t ⊑_{F} t′_{1} (\underline{1}) and t_{1} is t′_{1}[t′/α]. We note that t[t′/α] ⊑_{F} t′_{1}[t′/α] holds from (1), that is, t[t′/α] ⊑_{F} t_{1}. Hence, t_{1} is in fsub (t[t′/α]). We have shown (fsub (t))[t′/α] ⊆ fsub (t[t′/α]) (\underline{2}).

Conversely, let t_{1} be in fsub (t[t′/α]) ∩ Σ_{α}^{¬}. This means that t[t′/α] ⊑_{F} t_{1} (\underline{3}) holds and α ∉ ftv(t_{1}) (\underline{4}). If α ∉ ftv(t), we have t_{1} ∈ fsub (t), thus we have t_{1}[t′/α] ∈ (fsub (t))[t′/α], that is, by (4), t_{1} ∈ (fsub (t))[t′/α] (\underline{5}). From now on, we assume that α ∈ ftv(t) (\underline{6}). By hypothesis and alpha-conversion, t is of the form ∀ ᾱ · t_{0}, with \{α\} ∪ ftv(t′) # ᾱ (\underline{7}), t_{0} ≠ α, and t_{0} is not a quantified type. Hence, t[t′/α] is equal to ∀ ᾱ · (t_{0}[t′/α]), and t_{0}[t′/α] is not a quantified type. From (3), t_{1} is of the form ∀ β̄ · (t_{0}[t′/α])[t̄/ᾱ] (\underline{8}), for some types t̄ and β̄ disjoint from ftv(t_{0}[t′/α]) (\underline{9}). From (9) and (6), we get β̄ # ftv(t′) (\underline{10}). By alpha-conversion, we can freely assume that α ∉ β̄ (\underline{11}). Hence, we have β̄ # ftv(t_{0}) from (9) and (11). Therefore, ∀ ᾱ · t_{0} ⊑_{F} ∀ β̄ · t_{0}[t̄/ᾱ] holds (by definition of ⊑_{F}). Let t_{2} be ∀ β̄ · t_{0}[t̄/ᾱ]. We have shown t ⊑_{F} t_{2}. Additionally, α ∉ ftv(t̄) (\underline{12}) holds from (4) and (8). We note that t_{1} = t_{2}[t′/α] holds from (8), (11), (7), (12), and (10). Hence, we have shown that t_{1} is in (fsub (t))[t′/α]. In both cases, we have shown (5). This implies fsub (t[t′/α]) ∩ Σ_{α}^{¬} ⊆ (fsub (t))[t′/α]. Thus, fsub (t[t′/α]) ⊆_{α} (fsub (t))[t′/α] (\underline{13}) holds.

From (2) and (13), we have fsub (t[t′/α]) =_{α} (fsub (t))[t′/α].

\underline{Property v}: By Property 10.3.1.ii, we have θ(fsub (t)) ⊆ fsub (θ(t)) (\underline{1}). Conversely, we show by induction on the size of dom(θ) that fsub (θ(t)) ⊆_{dom(θ)} θ(fsub (t)). If dom(θ) is empty, the result is immediate. Otherwise, we can write θ in the form θ′ ∘ [t′/α], with α ∉ dom(θ′) and the size of dom(θ′) is strictly smaller than the size of dom(θ). By hypothesis, the normal form of t is not in dom(θ). Hence, the normal form of t is not α. By Property iv, we get fsub (t[t′/α]) =_{α} (fsub (t))[t′/α] (\underline{2}). Let t_{1} be in fsub (θ(t)) ∩ Σ_{dom(θ)}^{¬} (\underline{3}). We have t_{1} ∈ fsub (θ_{1}(t[t′/α])), and t_{1} ∈ Σ_{dom(θ_{1})}^{¬}. By induction hypothesis, we get t_{1} ∈ θ_{1}(fsub (t[t′/α])). Hence, there exists t′_{1} in fsub (t[t′/α]) such that t_{1} = θ_{1}(t′_{1}). We note that α ∉ ftv(t_{1}) holds from (3). It implies α ∉ ftv(t′_{1}). Hence, t′_{1} is in fsub (t[t′/α]) ∩ Σ_{α}^{¬}. By (2), we get t′_{1} ∈ (fsub (t))[t′/α]. Hence, t_{1} is in θ_{1}(fsub (t))[t′/α], that is, t_{1} ∈ θ(fsub (t)). In summary, we have shown fsub (θ(t)) ⊆_{dom(θ)} θ(fsub (t)). With (1), we get fsub (θ(t)) =_{dom(θ)} θ(fsub (t)).

\underline{Property vi}: First, we note that if t_{1} ⊑_{F} t_{2} holds, then we have t_{1} ⩽_{/} t_{2} (\underline{1}). Then we proceed by structural induction on σ. ∘ Case σ is τ: Then ((σ)) is fsub (τ), thus t is equivalent to τ, and τ/ = t/ holds. Hence, we have τ ⩽_{/} t.

∘ Case σ is ⊥: Then σ ⩽_{/} t always holds. ∘ Case σ is ∀ (α_{1} = σ_{1}) σ_{2}: Then ((σ)) is fsub (((σ_{2}))[\underline{σ_{1}}/α]). Thanks to Remark (1) above, it suffices to show the result for t in ((σ_{2}))[\underline{σ_{1}}/α]. Hence, we assume t of the form t_{2}[\underline{σ_{1}}/α] for t_{2} ∈ ((σ_{2})). By induction hypothesis, we have σ_{2} ⩽_{/} t_{2}. Hence, we have proj(σ_{2})[proj(σ_{1})/α] ⩽_{/} t_{2}[proj(σ_{1})/α] by Property 2.1.2.ii. We note that proj(σ_{2})[proj(σ_{1})/α] is proj(σ), and that proj(σ_{1}) = proj(\underline{σ_{1}}). Hence, we get proj(σ) ⩽_{/} t_{2}[proj(\underline{σ_{1}})/α], that is, σ ⩽_{/} t, which is the expected result. ∘ Case σ is ∀ (α_{1} ≥ σ_{1}) σ_{2}: As above, it suffices to show the result for t in ∀ ᾱ · ((σ_{2}))[t_{1}/α], with t_{1} ∈ ((σ_{1})), and ᾱ # ftv(σ_{1}, σ_{2}). Hence, t is of the form ∀ ᾱ · t_{2}[t_{1}/α], for t_{2} ∈ ((σ_{2})). By induction hypothesis, we have proj(σ_{2}) ⩽_{/} proj(t_{2}). By Property 2.1.2.ii, we get proj(σ_{2})[proj(σ_{1})/α] ⩽_{/} proj(t_{2})[proj(σ_{1})/α] (\underline{2}). By induction hypothesis, we have proj(σ_{1}) ⩽_{/} proj(t_{1}). Hence, by Property 2.1.2.iii, we get proj(t_{2})[proj(σ_{1})/α] ⩽_{/} proj(t_{2})[proj(t_{1})/α] (\underline{3}). By transitivity of ⩽_{/}, (2), and (3), we get proj(σ) ⩽_{/} proj(t_{2}[t_{1}/α]), that is, σ ⩽_{/} t_{2}[t_{1}/α]. It implies ∀ (ᾱ) σ ⩽_{/} ∀ ᾱ · t_{2}[t_{1}/α], that is ∀ (ᾱ) σ ⩽_{/} t. Observing that ∀ (ᾱ) σ ≡ σ by Eq-Free, we get σ ⩽_{/} t by Property 1.5.4.i.

\underline{Property vii}: By hypothesis, nf(σ) is not ⊥. By Property 2.1.5.iii, it implies σ/ϵ ≠ ⊥. Hence, for all t′ in ((σ)), we have t′/ϵ = σ/ϵ (\underline{1}) by Property vi. By hypothesis, nf(σ) is not α, that is, σ/ϵ ≠ α by Property 2.1.5.ii. Hence, t′/ϵ ≠ α holds from (1), which implies that t′ is not equivalent to α. As a consequence, fsub (t′[t/α]) =_{α} fsub (t′) [t/α] holds by Property iv. This holds for all t′ in ((σ)), thus fsub (((σ))[t/α]) =_{α} fsub (((σ))) [t/α]. We conclude by Property i, then.

\underline{Property viii}: We show by structural induction on σ that ((σ)) = fsub (\underline{σ}). ∘ Case σ is τ: Then we have ((σ)) = fsub (τ) and \underline{σ} = τ, which gives ((σ)) = fsub (\underline{σ}). ∘ Case σ is ⊥: Then we have ((σ)) = fsub (∀ α · α) and \underline{σ} = ∀ α · α. Hence, ((σ)) = fsub (\underline{σ}). ∘ Case σ is ∀ (α = σ_{1}) σ_{2}: Then we have both ((σ)) = fsub (((σ_{2}))[\underline{σ_{1}}/α]) (\underline{1}) and \underline{σ} = \underline{σ_{2}}[\underline{σ_{1}}/α]. We note that \underline{σ_{2}} is not α because σ is in normal form. Hence, we have fsub (\underline{σ}) =_{α} fsub (\underline{σ_{2}}) [\underline{σ_{1}}/α] by Property iv. By induction hypothesis, we get fsub (\underline{σ}) =_{α} ((σ_{2}))[\underline{σ_{1}}/α] (\underline{2}). Since σ is in normal form, nf(σ_{2}) is neither α nor ⊥, hence the relation fsub (((σ_{2}))[\underline{σ_{1}}/α]) =_{α} ((σ_{2}))[\underline{σ_{1}}/α] (\underline{3}) holds by Property vii. From (1), (2) and (3), we get fsub (\underline{σ}) =_{α} ((σ)). This holds for any suitable choice of α, thus we get fsub (\underline{σ}) =_{∅} ((σ)) by Property 10.3.3.vii. That is fsub (\underline{σ}) = ((σ)).

∘ Case σ is ∀ (α ≥ ⊥) σ_{2}: Then we have ((σ)) = fsub (⋃_{t∈((⊥))}^{ᾱ#ftv(σ_{2})} ∀ ᾱ · ((σ_{2}))[t/α]) (\underline{4}) and \underline{σ} = ∀ α · \underline{σ_{2}} (\underline{5}). We note that ((⊥)) is fsub (∀ α · α) by definition. Hence, t ∈ ((⊥)) holds for any t. Additionally, fsub (\underline{σ}) is by definition the set of instances of \underline{σ}. From (5), it is the set ⋃_{t}^{ᾱ#ftv(σ_{2})} ∀ ᾱ · fsub (\underline{σ_{2}}) [t/α]. By induction hypothesis, we get fsub (\underline{σ}) = ⋃_{t}^{ᾱ#ftv(σ_{2})} ∀ ᾱ · ((σ_{2}))[t/α]. We see that fsub (fsub (\underline{σ})) = ((σ)) holds from (4), that is, fsub (\underline{σ}) = ((σ)).

\underline{Property ix}: We obviously have ⋃_{t∈S}^{ᾱ#β̄∪γ̄} ∀ ᾱ · S′[t/α] ⊆ ⋃_{t∈S}^{ᾱ#β̄} ∀ ᾱ · S′[t/α]. Hence, we only

have to show ⋃_{t∈S}^{ᾱ#β̄} ∀ ᾱ · S′[t/α] ⊆ ⋃_{t∈S}^{ᾱ#β̄∪γ̄} ∀ ᾱ · S′[t/α]. Let t_{1} be in the left-hand term.

There exist ᾱ disjoint from β̄, t in S and t′ in S′ such that t_{1} = ∀ ᾱ · t′[t/α]. Let ϕ be a renaming of domain ᾱ mapping its domain to fresh variables, that is, outside ᾱ ∪ β̄ ∪ γ̄ ∪ ftv(t) ∪ ftv(t′) ∪ {α}. Let ϕ′ be ϕ restricted to ᾱ − {α}. We note that ϕ and ϕ′ are invariant on β̄. Hence, ϕ(S) ⊆ S and ϕ′(S′) ⊆ S′ hold. We note that ∀ ϕ(ᾱ)·ϕ′(t′)[ϕ(t)/α] is an alpha-conversion of t_{1}. Additionally, ϕ(ᾱ) # β̄∪γ̄, ϕ′(t′) ∈ S′

and ϕ(t) ∈ S. Hence, we have t_{1} ∈ ⋃_{t∈S}^{ᾱ#β̄∪γ̄} ∀ ᾱ · S′[t/α], which is the expected result.

\underline{Property x}: Thanks to Property 10.3.1.ii (page 193), it suffices to show the relation fsub (θ(S)) ⊆_{dom(θ)} θ(fsub (S)) (\underline{1}). Let t be in fsub (θ(S)) ∩ Σ_{dom(θ)}^{¬} (\underline{2}). By definition, there exists t′ in S such that θ(t′) ⊑_{F} t (\underline{3}). We can freely assume that t′ is in normal form. We consider two cases.

∘ Case t′ ∈ dom(θ): Then θ(t′) is a monotype (by hypothesis), thus t and θ(t′) are equivalent from (3). This implies that there exists t′′ equivalent to t′ such that t = θ(t′′). Thus, we have t ∈ θ(fsub (S)). ∘ Otherwise we have t′ ∉ dom(θ), and t ∉ dom(θ) holds from (2). From (3) we have t ∈ fsub (θ(t′)). By Property iv, we get t ∈ θ(fsub (t′)), which implies t ∈ θ(fsub (S)).

In both cases, we have t ∈ θ(fsub (S)). Hence, (1) is shown and fsub (θ(S)) =_{dom(θ)} θ(fsub (S)) holds.

\underline{Property xi}: This is shown by structural induction on σ. Before all, we note that θ(((σ))) ⊆ Σ_{dom(θ)}^{¬} holds since θ is idempotent by convention. Hence, θ(((σ))) =_{dom(θ)} ((θ(σ))) implies θ(((σ))) ⊆ ((θ(σ))). We will implicitly apply this result to the induction hypothesis in some of the following cases.

∘ Case σ is τ: Then ((σ)) is fsub (τ), thus θ(((σ))) is fsub (θ(τ)), that is, ((θ(τ))).

∘ Case σ is ⊥: Then ((θ(σ))) is fsub (∀ α · α), that is, ((⊥)). Hence, it remains to show ((⊥)) =_{dom(θ)} θ(((⊥))) (\underline{1}). We clearly have θ(((⊥))) ⊆ ((⊥)) (\underline{2}). Conversely, let t be in ((⊥)) ∩ Σ_{dom(θ)}^{¬}. We have ftv(t) # dom(θ). Hence, θ(t) = t. Thus, t is in θ(((⊥))). We have shown ((⊥)) ⊆_{dom(θ)} θ(((⊥))) (\underline{3}). From (2) and (3), we get (1).

∘ Case σ is ∀ (α = σ_{1}) σ_{2}: We can freely consider α ∉ dom(θ) ∪ codom(θ). We have ((σ)) = fsub (((σ_{2}))[\underline{σ_{1}}/α]) (\underline{4}). Besides, θ(σ) is ∀ (α = θ(σ_{1})) θ(σ_{2}), thus ((θ(σ))) is by definition the set fsub (((θ(σ_{2})))[\underline{θ(σ_{1})}/α]) (\underline{5}). We have

θ(((σ))) = θ(fsub (((σ_{2}))[\underline{σ_{1}}/α]))  from (4)
⊆ fsub (θ(((σ_{2}))[\underline{σ_{1}}/α]))  by Property 10.3.1.ii
= fsub (θ(((σ_{2})))[θ(\underline{σ_{1}})/α])
= fsub (θ(((σ_{2})))[\underline{θ(σ_{1})}/α]) since θ(\underline{σ_{1}}) = \underline{θ(σ_{1})} (easy)
(\underline{6}) θ(((σ))) ⊆ fsub (θ(((σ_{2})))[\underline{θ(σ_{1})}/α]) as a summary

Additionally, we have

(\underline{7}) θ(((σ_{2})))  ⊆ ((θ(σ_{2})))
(\underline{8}) θ(((σ_{2})))[\underline{θ(σ_{1})}/α]  ⊆ ((θ(σ_{2})))[\underline{θ(σ_{1})}/α]
(\underline{9}) fsub (θ(((σ_{2})))[\underline{θ(σ_{1})}/α]) ⊆ fsub (((θ(σ_{2})))[\underline{θ(σ_{1})}/α])

We have (7) by induction hypothesis, (8) by applying [\underline{θ(σ_{1})}/α] to (7), and (9) by applying fsub () to (8). Combining (6), (9), and (5), we get θ(((σ))) ⊆ ((θ(σ))) (\underline{10}).

Conversely, we show ((θ(σ))) ⊆_{dom(θ)∪{α}} θ(((σ))). Since σ is in normal form, nf(σ_{2}) is neither α nor ⊥. Hence, nf(θ(σ_{2})) is neither α nor ⊥. Then by Property vii and (5), we get ((θ(σ))) =_{α} ((θ(σ_{2})))[\underline{θ(σ_{1})}/α] (\underline{11}). Let t be in ((θ(σ))) ∩ Σ_{dom(θ)∪\{α\}}^{¬} (\underline{12}). From (11), we have t ∈ ((θ(σ_{2})))[\underline{θ(σ_{1})}/α]. Hence, there exists t_{2} ∈ ((θ(σ_{2}))) (\underline{13}) such that t = t_{2}[\underline{θ(σ_{1})}/α] (\underline{14}). By induction hypothesis, we have ((θ(σ_{2}))) =_{dom(θ)} θ(((σ_{2}))) (\underline{15}). Since we have ftv(t) # dom(θ) from (12), we get ftv(t_{2}) # dom(θ) (\underline{16}) by (14). From (13), (16), and (15), we have t_{2} ∈ θ(((σ_{2}))). Hence, t is in θ(((σ_{2})))[\underline{θ(σ_{1})}/α], that is, in θ(((σ_{2}))[\underline{σ_{1}}/α]). This implies t ∈ θ(fsub (((σ_{2}))[\underline{σ_{1}}/α])). Hence, we have t ∈ θ(((σ))). This holds for all t in ((θ(σ))) ∩ Σ_{dom(θ)∪\{α\}}^{¬}, hence we have ((θ(σ))) ⊆_{dom(θ)∪\{α\}} θ(((σ))) (\underline{17}). By (10) and (17), we have ((θ(σ))) =_{dom(θ)∪{α}} θ(((σ))). This holds for any choice of α. Hence, by Property 10.3.3.vii, we get ((θ(σ))) =_{dom(θ)} θ(((σ))).

∘ Case σ is ∀ (α≥σ_{1}) σ_{2}: We can freely assume α # dom(θ)∪codom(θ). By definition,

we have ((σ)) = fsub ( ⋃_{t_{1}∈((σ_{1}))}^{ᾱ#ftv(σ_{1},σ_{2})} ∀ ᾱ · ((σ_{2}))[t_{1}/α]). Hence, the set θ(((σ))) is equal to

⋃_{t_{1}∈((σ_{1}))}^{ᾱ#ftv(σ_{1},σ_{2})} θ(fsub (∀ ᾱ · ((σ_{2}))[t_{1}/α])). Let J be ftv(σ_{1})∪ftv(σ_{2})∪{α}∪dom(θ)∪codom(θ).

By Property iii, ((σ_{1})) and ((σ_{2})) are J-stable. By Property ix, we have θ(((σ))) = ⋃_{t_{1}∈((σ_{1}))}^{ᾱ#J} θ(fsub (∀ ᾱ · ((σ_{2}))[t_{1}/α])) (\underline{18}). Additionally, θ(σ) is ∀ (α = θ(σ_{1})) θ(σ_{2}), thus

((θ(σ))) is ⋃_{t_{1}∈((θ(σ_{1}))))}^{ᾱ#ftv(σ_{1},σ_{2})} fsub (∀ ᾱ · ((θ(σ_{2})))[t_{1}/α]). By Property iii, ((θ(σ_{1}))) and ((θ(σ_{2})))

are J-stable. By Property ix, ((θ(σ))) = ⋃_{t_{1}∈((θ(σ_{1}))))}^{ᾱ#J} fsub (∀ ᾱ · ((θ(σ_{2})))[t_{1}/α]) (\underline{19}) holds.

Let t_{1} be in ((σ_{1})) and ᾱ disjoint from J. We have the following:

(\underline{20}) θ(fsub (∀ ᾱ · ((σ_{2}))[t_{1}/α])) ⊆ fsub (θ(∀ ᾱ · ((σ_{2}))[t_{1}/α]))
(\underline{21})  ⊆ fsub (∀ ᾱ · θ(((σ_{2}))[t_{1}/α]))
(\underline{22})  = fsub (∀ ᾱ · θ(((σ_{2})))[θ(t_{1})/α])
(\underline{23}) θ(fsub (∀ ᾱ · ((σ_{2}))[t_{1}/α])) ⊆ fsub (∀ ᾱ · ((θ(σ_{2})))[θ(t_{1})/α]))

We have (20) by Property 10.3.1.ii, (21) by commutation of θ and ∀ ᾱ· since ᾱ # J, (22) by propagating θ, and (23) since θ(((σ_{2}))) ⊆ ((θ(σ_{2}))) holds by induction hypothesis. We have (23) for all t_{1} in ((σ_{1})) and ᾱ disjoint from J. Hence, taking the union, we get by (18)

θ(((σ))) ⊆ ⋃_{t_{1}∈((σ_{1}))}^{ᾱ#J} fsub (∀ ᾱ · ((θ(σ_{2})))[θ(t_{1})/α]))

Observing that the sets {θ(t_{1}) | t_{1} ∈ ((σ_{1}))} and {t_{1} | t_{1} ∈ θ(((σ_{1})))} are equal, we get

θ(((σ))) ⊆ ⋃_{t_{1}∈θ(((σ_{1})))}^{ᾱ#J} fsub (∀ ᾱ · ((θ(σ_{2})))[t_{1}/α])) (\underline{24})

By induction hypothesis, we have θ(((σ_{1}))) ⊆ ((θ(σ_{1}))). Hence, by (24) and (19), we get θ(((σ))) ⊆ ((θ(σ))) (\underline{25}). Conversely, we show that ((θ(σ))) ⊆_{dom(θ)∪\{α\}} θ(((σ))) holds. Let t be in ((θ(σ)))∩Σ_{dom(θ)∪\{α\}}^{¬} (\underline{26}). From (19), there exists t_{1} ∈ ((θ(σ_{1}))) (\underline{27}), ᾱ # J, and t_{2} ∈ ((θ(σ_{2}))) such that ∀ ᾱ · t_{2}[t_{1}/α] ⊑_{F} t (\underline{28}). We have ftv(t) # dom(θ) (\underline{29}) from (26). Thus, ftv(t_{2}) # dom(θ) holds from (28). Hence, by induction hypothesis, we have t_{2} ∈ θ(((σ_{2}))). Hence, there exists t′_{2} ∈ ((σ_{2})) such that t_{2} = θ(t′_{2}). From (28), we get t ∈ fsub (∀ ᾱ · θ(t′_{2})[t_{1}/α]). If α ∉ ftv(t_{2}), then (28) can as well be written ∀ ᾱ · t_{2}[t′_{1}/α] ⊑_{F} t for some t′_{1} in θ(((σ_{1}))), and we have t ∈ fsub (∀ ᾱ · θ(t′_{2})[t′_{1}/α]) (\underline{30}). Otherwise, we have α ∈ ftv(t_{2}), thus (28) and (29) imply ftv(t_{1}) # dom(θ). Hence, by induction hypothesis and (27), we get t_{1} ∈ θ(((σ_{1}))), that is, there exists t′_{1} ∈ θ(((σ_{1}))) (namely t′_{1} = t_{1}), such that t ∈ fsub (∀ ᾱ · θ(t′_{2})[t′_{1}/α]). We see that (30) holds in both cases for some t′_{1} ∈ θ(((σ_{1}))). Hence, there exists t′′_{1} in ((σ_{1})) such that t′_{1} = θ(t′′_{1}) and t ∈ fsub (∀ ᾱ · θ(t′_{2})[θ(t′′_{1})/α]), that is, t ∈ fsub (θ(∀ ᾱ · t′_{2}[t′′_{1}/α])). From (26) and Property x, we get t ∈ θ(fsub (∀ ᾱ · t′_{2}[t′′_{1}/α])). As a consequence, we have t ∈

⋃_{t′′_{1}∈((σ_{1}))}^{ᾱ#J} θ(fsub (∀ ᾱ · ((σ_{2}))[t′′_{1}/α]), that is, t ∈ θ(((σ))). This holds for all t in ((θ(σ))) ∩

Σ_{dom(θ)∪\{α\}}^{¬}, thus we have ((θ(σ))) ⊆_{dom(θ)∪\{α\}} θ(((σ))) (\underline{31}). From (25) and (31), we get ((θ(σ))) =_{dom(θ)∪{α}} θ(((σ))). This holds for any choice of α, thus Property 10.3.3.vii gives ((θ(σ))) =_{dom(θ)} θ(((σ))).

\underline{Property xii}: First, we show that ((σ)) = ((nf(σ))). Then we show that if σ ≈ σ′ holds for σ and σ′ in normal form, then ((σ)) = ((σ′)) holds. We conclude by Property 1.5.11.i, then.

First, we show by induction on the number of universal quantifiers of σ that ((σ)) = ((nf(σ))). We proceed by case analysis on the shape of σ. ∘ Case τ: We have nf(τ) = τ. ∘ Case ⊥: We have nf(⊥) = ⊥. ∘ Case ∀ (α = σ_{1}) σ_{2}: We consider five subcases:

Subcase nf(σ_{2}) = α: We have nf(σ) = nf(σ_{1}) and by definition ((σ)) is fsub (((σ_{2}))[\underline{σ_{1}}/α]). By induction hypothesis, ((σ_{2})) = fsub (α). Hence, ((σ)) equals fsub (\underline{σ_{1}}), that is, fsub (\underline{nf(σ_{1})}) (by definition). By Property viii, we get ((σ)) = ((nf(σ_{1}))).

Subcase nf(σ_{2}) = ⊥: Then, nf(σ) is ⊥ and by definition the interpretation ((σ)) is fsub (((σ_{2}))[\underline{σ_{1}}/α]). By induction hypothesis, ((σ_{2})) = fsub (∀ β · β). Hence, ((σ)) = fsub ((fsub (∀ β · β))[\underline{σ_{1}}/α]). By Property 10.3.1.v, we get ((σ)) = fsub ((∀ β · β)[\underline{σ_{1}}/α]), that is, ((σ)) = fsub (∀ β · β). Hence, ((σ)) = ((⊥)).

From now on, we assume that nf(σ_{2}) is neither ⊥ nor α, so that ((σ)) is by definition fsub (((σ_{2}))[\underline{σ_{1}}/α]). Then by Property vii, we have ((σ)) =_{α} ((σ_{2}))[\underline{σ_{1}}/α] (\underline{1}).

Subcase α ∉ ftv(σ_{2}): Then nf(σ) is nf(σ_{2}). From (1), we have ((σ)) =_{α} ((σ_{2}))[\underline{σ_{1}}/α] (\underline{2}). By Property iii, ((σ_{2})) is ftv(σ_{2})-stable. As a consequence, the inclusion ((σ_{2}))[\underline{σ_{1}}/α] ⊆ ((σ_{2})) (\underline{3}) holds. Conversely, if t is in ((σ_{2})) ∩ Σ_{α}^{¬}, we have α ∉ ftv(t), thus t[\underline{σ_{1}}/α] = t, which implies t ∈ ((σ_{2}))[\underline{σ_{1}}/α]. As a consequence, ((σ_{2})) ∩ Σ_{α}^{¬} ⊆ ((σ_{2}))[\underline{σ_{1}}/α]. This is by definition ((σ_{2})) ⊆_{α} ((σ_{2}))[\underline{σ_{1}}/α] (\underline{4}). By (3) and (4), we get ((σ_{2})) =_{α} ((σ_{2}))[\underline{σ_{1}}/α] (\underline{5}). By (2) and (5), we get ((σ)) =_{α} ((σ_{2})) (\underline{6}). By Property iii, ((σ)) is ftv(σ)-stable, that is, ftv(σ_{2})-stable. Additionally, we recall that α ∉ ftv(σ_{2}). Hence, by Property 10.3.3.v and (6), we get ((σ)) = ((σ_{2})). By induction hypothesis, we have ((σ)) = ((nf(σ_{2}))), that is, ((σ)) = ((nf(σ))).

Subcase σ_{1} ∈ T : Let τ be nf(σ_{1}). We have nf(σ) = nf(σ_{2})[τ/α] (\underline{7}). From (1), we have ((σ)) =_{α} ((σ_{2}))[\underline{σ_{1}}/α]. By induction hypothesis, we get the relation ((σ)) =_{α} ((nf(σ_{2})))[τ/α] (\underline{8}). By Property xi, we have ((nf(σ_{2})))[τ/α] =_{α} ((nf(σ_{2})[τ/α])) (\underline{9}). By (7), (8), and (9), we get ((σ)) =_{α} ((nf(σ))). This holds for any choice of α, thus we get ((σ)) = ((nf(σ))) by Property 10.3.3.vii.

Otherwise, nf(σ) is ∀ (α = nf(σ_{1})) nf(σ_{2}), and ((σ)) is fsub (((σ_{2}))[\underline{σ_{1}}/α]), that is, fsub (((σ_{2}))[\underline{nf(σ_{1})}/α]). By definition, ((nf(σ))) is fsub (((nf(σ_{2})))[\underline{nf(σ_{1})}/α]). By

induction hypothesis, it is equal to fsub (((σ_{2}))[\underline{nf(σ_{1})}/α]), that is, ((σ)).

∘ Case ∀ (α ≥ σ_{1}) σ_{2}: By definition, ((σ)) is fsub ( ⋃_{t∈((σ_{1}))}^{ᾱ#ftv(σ_{1},σ_{2})} ∀ ᾱ · ((σ_{2}))[t/α]) (\underline{10}).

We consider five subcases:

Subcase nf(σ_{2}) = α: From (10) and induction hypothesis, the set ((σ)) is equal

to fsub ( ⋃_{t∈((nf(σ_{1})))}^{ᾱ#ftv(σ_{1},σ_{2})} ∀ ᾱ · t). This can also be written

((σ)) = ⋃_{ᾱ#ftv(σ_{1},σ_{2})} fsub (∀ ᾱ · ((nf(σ_{1})))) (\underline{11}).

We immediately have ((nf(σ_{1}))) ⊆ ((σ)) (\underline{12}), taking ᾱ = ∅. Conversely, we have ∀ ᾱ · ((σ_{1})) ⊆ ((nf(σ_{1}))) by Property ii. Hence, fsub (∀ ᾱ · ((σ_{1}))) ⊆ fsub (((nf(σ_{1})))) by applying fsub (), that is, fsub (∀ ᾱ · ((σ_{1}))) ⊆ ((nf(σ_{1}))) by Property i. Taking the union over ᾱ, and by (11), we get ((σ)) ⊆ ((nf(σ_{1}))) (\underline{13}). By (12) and (13), we get ((σ)) = ((nf(σ_{1}))), which is the expected result.

Subcase nf(σ_{2}) = ⊥: From (10) and induction hypothesis, we have ((σ)) equal

to fsub ( ⋃_{t∈((nf(σ_{1})))}^{ᾱ#ftv(σ_{1},σ_{2})} ∀ ᾱ · ((⊥))[t/α]). Observing that ((⊥)) is fsub (∀ (β) β), and taking

ᾱ = ∅, we have fsub (fsub (∀ β · β) [t/α]) ⊆ ((σ)) Hence, by Property 10.3.1.v, we have fsub ((∀ β · β)[t/α]) ⊆ ((σ)), that is, fsub (∀ β · β) ⊆ ((σ)), that is, ((⊥)) ⊆ ((σ)). Conversely, ((σ)) ⊆ ((⊥)) obviously holds, thus we have ((σ)) = ((⊥)), which is the expected result.

Subcase α ∉ ftv(nf(σ_{2})): From (10) and induction hypothesis, we have ((σ))

equal to fsub ( ⋃_{t∈((σ_{1}))}^{ᾱ#ftv(σ_{1},σ_{2})} ∀ ᾱ · ((nf(σ_{2})))[t/α]) (\underline{14}). We have ∀ α·((nf(σ_{2}))) ⊆ ((nf(σ_{2})))

by Property ii. Hence, (∀ α · ((nf(σ_{2}))))[t/α] ⊆ ((nf(σ_{2})))[t/α] holds, that is, ∀ α · ((nf(σ_{2}))) ⊆ ((nf(σ_{2})))[t/α]. Applying fsub, we get the inclusion fsub (∀ α · ((nf(σ_{2})))) ⊆ fsub (((nf(σ_{2})))[t/α]). Observing that ((nf(σ_{2}))) ⊆ fsub (∀ α · ((nf(σ_{2})))) holds, we get ((nf(σ_{2}))) ⊆ fsub (((nf(σ_{2})))[t/α]). Hence, we have ((nf(σ_{2}))) ⊆ ((σ)), taking ᾱ = ∅ in (14). Conversely, ((nf(σ_{2}))) is ftv(σ_{2})-stable by Property iii. Note that [t/α] is invariant on ftv(σ_{2}). Hence, ((nf(σ_{2})))[t/α] ⊆ ((nf(σ_{2}))). This gives ∀ ᾱ · ((nf(σ_{2})))[t/α] ⊆ ((nf(σ_{2}))) by Property ii. Hence, ((σ)) ⊆ ((nf(σ_{2}))) holds by (14), taking the union over t and ᾱ. We have shown ((σ)) = ((nf(σ_{2}))), which is the expected result.

Subcase σ_{1} ∈ T : Let τ be nf(σ_{1}). From (10) and induction hypothesis, ((σ))

is equal to fsub ( ⋃_{t∈((τ))}^{ᾱ#ftv(σ_{1},σ_{2})} ∀ ᾱ · ((nf(σ_{2})))[t/α]) (\underline{15}). We note that t ∈ ((τ)) implies

t equivalent to τ. Hence, ((σ)) is also equal to fsub ( ⋃^{ᾱ#ftv(σ_{1},σ_{2})} ∀ ᾱ · ((nf(σ_{2})))[τ/α]).

Taking ᾱ = ∅, we have ((nf(σ_{2})))[τ/α] ⊆ ((σ)). By Property xi, we get ((nf(σ_{2})[τ/α])) ⊆_{α} ((σ)), that is ((nf(σ))) ⊆_{α} ((σ)) (\underline{16}). Conversely, by Property xi we have ((nf(σ_{2})))[t/α] ⊆ ((nf(σ_{2})[t/α])), that is, ((nf(σ_{2})))[t/α] ⊆ ((nf(σ))). Hence, ∀ ᾱ · ((nf(σ_{2})))[t/α] ⊆ ∀ ᾱ · ((nf(σ))). By Property ii, we get ∀ ᾱ · ((nf(σ_{2})))[t/α] ⊆ ((nf(σ))). Hence, the inclusion fsub (∀ ᾱ · ((nf(σ_{2})))[t/α] ⊆ ((nf(σ)))). This holds for all ᾱ disjoint from ftv(σ_{1}, σ_{2}) and all t in ((τ)), hence we get ((σ)) ⊆ ((nf(σ))) (\underline{17}) from (15). From (16) and (17), we get ((σ)) =_{α} ((nf(σ))). This holds for any choice of α, hence we have ((σ)) = ((nf(σ))) by Property 10.3.3.vii.

Otherwise: By induction hypothesis applied to σ_{1} and σ_{2}, and (10), the set

((σ)) is equal to fsub ( ⋃_{t∈((nf(σ_{1})))}^{ᾱ#ftv(σ_{1},σ_{2})} ∀ ᾱ · ((nf(σ_{2})))[t/α]). Hence ((σ)) = ((∀ (α ≥ nf(σ_{1}))

nf(σ_{2}))), that is ((σ)) = ((nf(σ))).

Then we have to show that if we have σ ≈ σ′ for σ and σ′ in normal form, then ((σ)) = ((σ′)) holds. The proof is by induction on the derivation of σ ≈ σ′. Three rules define the relation ≈. Two of them are context rules. These cases are shown directly by induction hypothesis. The third case is the commutation rule: by hypothesis we have α_{1} ∉ ftv(σ_{2}) and α_{2} ∉ ftv(σ_{1}), and

∀ (α_{1} ⋄_{1} σ_{1}, α_{2} ⋄_{2} σ_{2}) σ ≈ ∀ (α_{2} ⋄_{2} σ_{2}, α_{1} ⋄_{1} σ_{1}) σ

Let σ_{a} be the left-hand type, and σ_{b} be the right-hand type. The definitions to compute the sets ((σ_{a})) and ((σ_{b})) depend on the symbols ⋄_{1} and ⋄_{2}. In order to factorize the four possible cases, we consider the following remark: Let σ′ be a type and σ′′ be an F-type. Let S be \{\underline{σ′}\}. Then we note that fsub (((σ))[\underline{σ′}/α]) can be writ-

ten fsub ( ⋃_{t∈S}^{ᾱ#ftv(σ,σ′)} ∀ ᾱ · ((σ))[t/α]). Hence, taking S_{1} =^{△} ((σ_{1})) if ⋄_{1} is flexible and

S_{1} =^{△} \{\underline{σ_{1}}\} is ⋄_{1} is rigid, ((σ_{a})) is equal to

fsub (  ⋃_{t_{1}∈S_{1}}^{ᾱ#ftv(σ_{a})∪{α_{1}}} ∀ ᾱ · ((∀ (α_{2} ⋄_{2} σ_{2}) σ))[t_{1}/α_{1}])

Taking S_{2} =^{△} ((σ_{2})) if ⋄_{2} is flexible and S_{2} =^{△} \{\underline{σ_{2}}\} if ⋄_{2} is rigid, ((σ_{a})) is then equal to

fsub (  ⋃_{t_{1}∈S_{1}}^{ᾱ#ftv(σ_{a})∪{α_{1}}} ∀ ᾱ · fsub ( ⋃_{t_{2}∈S_{2}}^{β̄#ftv(σ_{2},σ)} ∀ β̄ · ((σ))[t_{2}/α_{2}]) [t_{1}/α_{1}])

Let J be ftv(σ_{1}) ∪ ftv(σ_{2}) ∪ ftv(σ). By Properties iii and ix, we get

fsub ( ⋃_{t_{1}∈S_{1}}^{ᾱ#J} ∀ ᾱ · fsub ( ⋃_{t_{2}∈S_{2}}^{β̄#J} ∀ β̄ · ((σ))[t_{2}/α_{2}]) [t_{1}/α_{1}])

By notation, it is equal to

fsub ( ⋃_{t_{1}∈S_{1}}^{ᾱ#J} ⋃_{t_{2}∈S_{2}}^{β̄#J} ∀ ᾱ · fsub (∀ β̄ · ((σ))[t_{2}/α_{2}]) [t_{1}/α_{1}])

By Property 10.3.1.iii, we get

((σ_{a})) ⊆ fsub ( ⋃_{t_{1}∈S_{1}}^{ᾱ#J} ⋃_{t_{2}∈S_{2}}^{β̄#J} fsub (∀ ᾱ · ∀ β̄ · ((σ))[t_{2}/α_{2}]) [t_{1}/α_{1}])

By notation, and observing that fsub (fsub (S)) = fsub (S), we get

((σ_{a})) ⊆ fsub ( ⋃_{t_{1}∈S_{1}}^{ᾱ#J} ⋃_{t_{2}∈S_{2}}^{β̄#J} ∀ ᾱ · ∀ β̄ · ((σ))[t_{2}/α_{2}][t_{1}/α_{1}]) (\underline{18})

Let ᾱ and β̄ be disjoint from J. Let t_{1} and t_{2} be in S_{1} and S_{2}, respectively. Let γ_{1} and γ_{2} be fresh variables, that is, not in J ∪ ftv(t_{1}) ∪ ftv(t_{2}) ∪ ᾱ ∪ β̄ ∪ {α_{1}} ∪ {α_{2}}. Let t′_{1} be t_{1}[γ_{2}/α_{2}] and t′_{2} be t_{2}[γ_{1}/α_{1}]. We recall that S_{1} is either ((σ_{1})) or \{\underline{σ_{1}}\}. In the first case, S_{1} is ftv(σ_{1})-stable by Property iii. By hypothesis, we have α_{2} ∉ ftv(σ_{1}). Hence, S_{1}[γ_{2}/α_{2}] ⊆ S_{1}, thus t′_{1} ∈ S_{1} (\underline{19}). In the second case, t_{1} is \underline{σ_{1}} and ftv(t_{1}) = ftv(σ_{1}) by Property 10.3.1.i, hence t′_{1} = t_{1}. In both cases, (19) holds. Similarly, t′_{2} ∈ S_{2} holds. Additionally, we have {γ_{1}, γ_{2}} # J. Hence, we have {γ_{1}, γ_{2}}∪ᾱ # J. As a consequence, we have

∀ γ_{1}γ_{2}ᾱβ̄ · ((σ))[t′_{1}/α_{1}][t′_{2}/α_{2}] ∈ ⋃_{t_{1}∈S_{1}}^{ᾱ#J} ⋃_{t_{2}∈S_{2}}^{β̄#J} ∀ ᾱ · ∀ β̄ · ((σ))[t_{1}/α_{1}][t_{2}/α_{2}]

Applying fsub (), we get

fsub (∀ γ_{1}γ_{2}ᾱβ̄ · ((σ))[t′_{1}/α_{1}][t′_{2}/α_{2}]) ⊆ fsub ( ⋃_{t_{1}∈S_{1}}^{ᾱ#J} ⋃_{t_{2}∈S_{2}}^{β̄#J} ∀ ᾱ · ∀ β̄ · ((σ))[t_{1}/α_{1}][t_{2}/α_{2}])

Observing that we have ((σ))[t′_{1}/α_{1}][t′_{2}/α_{2}] = ((σ))[t′_{2}/α_{2}][t′_{1}/α_{1}], we get

fsub (∀ γ_{1}γ_{2}ᾱβ̄ · ((σ))[t′_{2}/α_{2}][t′_{1}/α_{1}]) ⊆ fsub ( ⋃_{t_{1}∈S_{1}}^{ᾱ#J} ⋃_{t_{2}∈S_{2}}^{β̄#J} ∀ ᾱ · ∀ β̄ · ((σ))[t_{1}/α_{1}][t_{2}/α_{2}])

Additionally, we note that the type ∀ ᾱβ̄ · ((σ))[t_{2}/α_{2}][t_{1}/α_{1}] belongs to the set

fsub (∀ γ_{1}γ_{2}ᾱβ̄ · ((σ))[t′_{2}/α_{2}][t′_{1}/α_{1}])

Thus, we get

∀ ᾱβ̄ · ((σ))[t_{2}/α_{2}][t_{1}/α_{1}] ∈ fsub ( ⋃_{t_{1}∈S_{1}}^{ᾱ#J} ⋃_{t_{2}∈S_{2}}^{β̄#J} ∀ ᾱ · ∀ β̄ · ((σ))[t_{1}/α_{1}][t_{2}/α_{2}])

This holds for all t_{1} and t_{2} in S_{1} and S_{2}, respectively, and for all ᾱ and β̄ disjoint from J. Hence, taking the union over t_{1}, t_{2}, ᾱ and β̄, we get

fsub ( ⋃_{t_{1}∈S_{1}}^{ᾱ#J} ⋃_{t_{2}∈S_{2}}^{β̄#J} ∀ ᾱβ̄ · ((σ))[t_{2}/α_{2}][t_{1}/α_{1}])
⊆ fsub ( ⋃_{t_{1}∈S_{1}}^{ᾱ#J} ⋃_{t_{2}∈S_{2}}^{β̄#J} ∀ ᾱ · ∀ β̄ · ((σ))[t_{1}/α_{1}][t_{2}/α_{2}])

Applying fsub (), and by (18), we get

((σ_{a})) ⊆ fsub ( ⋃_{t_{1}∈S_{1}}^{ᾱ#J} ⋃_{t_{2}∈S_{2}}^{β̄#J} ∀ ᾱ · ∀ β̄ · ((σ))[t_{1}/α_{1}][t_{2}/α_{2}])

By commutation of the union symbols, we get

((σ_{a})) ⊆ fsub ( ⋃_{t_{2}∈S_{2}}^{β̄#J} ⋃_{t_{1}∈S_{1}}^{ᾱ#J} ∀ β̄ · ∀ ᾱ · ((σ))[t_{1}/α_{1}][t_{2}/α_{2}])

This can also be written

((σ_{a})) ⊆ fsub ( ⋃_{t_{2}∈S_{2}}^{β̄#J} ∀ β̄ · ⋃_{t_{1}∈S_{1}}((σ))[t_{1}/α_{1}][t_{2}/α_{2}])

Observing that we have ⋃_{t_{1}∈S_{1}}((σ))[t_{1}/α_{1}] ⊆ ((∀ (α_{1} ⋄_{1} σ_{1}) σ)), we get

((σ_{a})) ⊆ fsub ( ⋃_{t_{2}∈S_{2}}^{β̄#J} ∀ β̄ · ((∀ (α_{1} ⋄_{1} σ_{1}) σ))[t_{2}/α_{2}])

That is,

((σ_{a})) ⊆ ((∀ (α_{2} ⋄_{2} σ_{2}) ∀ (α_{1} ⋄_{1} σ_{1}) σ))

Hence, we have shown ((σ_{a})) ⊆ ((σ_{b})). By symmetry, we immediately get ((σ_{b})) ⊆ ((σ_{a})). Hence, ((σ_{a})) = ((σ_{b})), which is the expected result. Finally, we have shown that σ ≈ σ′ implies ((σ)) = ((σ′)).

\underline{Property xiii}: We prove the property by structural induction on Q. Let θ be in ((Q)). We proceed by case analysis on the shape of Q. ∘ Case ∅: Immediate. ∘ Case (Q′, α ⋄ σ) with σ ∉ T : Then θ is equal to θ′ ∘ [t/α] for t being \underline{σ} if ⋄ is rigid, or t being in ((σ)) otherwise. By induction hypothesis, there exists θ′′ such that θ′ = θ′′ ∘ Q̂′. We get the expected result by observing that Q̂ = Q̂′. ∘ Case (Q′, α = σ) with σ ∈ T : Then θ is equal to θ′ ∘ [\underline{σ}/α] for some θ′ in ((Q′)). Let τ be nf(σ). By induction hypothesis, there exists θ′′ such that θ′ = θ′′ ∘ Q̂′. Hence θ = θ′′ ∘ Q̂′ ∘ [\underline{σ}/α]. By definition, \underline{σ} is \underline{τ}, that is, τ. Hence, θ = θ′′ ∘ Q̂′ ∘ [τ/α]. We conclude by observing that Q̂ is Q̂′ ∘ [τ/α]. ∘ Case (Q′, α ≥ σ) with σ ∈ T : Then θ is equal to θ′ ∘ [t/α] for some t in ((σ)), and θ′ in ((Q′)). Let τ be nf(σ). By Property xii, we have t ∈ ((τ)), that is, t ∈ fsub (τ). As a consequence, t is equivalent to τ. Thus, nf(t) is τ. By induction hypothesis, there exists θ′′ such that θ′ = θ′′ ∘ Q̂′. Hence we have θ = θ′′ ∘ Q̂′ ∘ [τ/α]. We conclude by observing that Q̂ is Q̂′ ∘ [τ/α].

Proof of Lemma 10.3.8

By induction on the derivation of (Q) σ_{1} ⊏ − σ_{2} (\underline{1}). Let θ be in ((Q)). We proceed by case analysis on the last rule in the derivation of (1). ∘ Case A-Equiv: By hypothesis, (Q) σ_{1} ≡ σ_{2} holds. By Corollary 1.5.10, we have Q̂(σ_{1}) ≡ Q̂(σ_{2}). Hence, by Property 10.3.6.xii, we have ((Q̂(σ_{1}))) = ((Q̂(σ_{2}))). By Property iv, we get Q̂(((σ_{1}))) =_{dom(Q̂)} Q̂(((σ_{2}))) (\underline{2}). Since Q̂ is idempotent, we have

Q̂(((σ_{1}))) ∩ Σ_{dom(Q̂)}^{¬} = Q̂(((σ_{1}))) as well as Q̂(((σ_{2}))) ∩ Σ_{dom(Q̂)}^{¬} = Q̂(((σ_{2}))). Hence,

from (2), we get Q̂(((σ_{1}))) = Q̂(((σ_{2}))) (\underline{3}). By Property 10.3.6.xiii, we have θ = θ′ ∘ Q̂.

Composing (3) by θ′, we get θ(((σ_{1}))) = θ(((σ_{2}))). This leads to fsub (θ(((σ_{1})))) = fsub (θ(((σ_{2})))).

∘ Case R-Trans: By induction hypothesis.

∘ Case R-Context-Rigid: The premise is (Q) σ′_{1} ⊏ − σ′_{2} (\underline{4}), σ_{1} is ∀ (α = σ′_{1}) σ, and σ_{2} is ∀ (α = σ′_{2}) σ. Since σ_{1} and σ_{2} are shallow, σ′_{1} and σ′_{2} are F-types. Hence, we have ((σ′_{1})) = fsub (\underline{σ′_{1}}) and ((σ′_{2})) = fsub (\underline{σ′_{2}}) by Property iii. By induction hypoth-

esis and (4), it gives fsub (θ(((σ′_{1})))) = fsub (θ(((σ′_{2})))), that is, fsub (θ(fsub (\underline{σ′_{1}}))) =

fsub (θ(fsub (\underline{σ′_{2}}))). By Property 10.3.1.v, we get fsub (θ(\underline{σ′_{1}})) = fsub (θ(\underline{σ′_{2}})) (\underline{5}). In

particular, we have θ(\underline{σ′_{1}}) ∈ fsub (θ(\underline{σ′_{1}})). Hence, by (5), we have θ(\underline{σ′_{1}}) ∈ fsub (θ(\underline{σ′_{2}})), which means that θ(\underline{σ′_{2}}) ⊑_{F} θ(\underline{σ′_{1}}) (\underline{6}) holds. Similarly, we show that θ(\underline{σ′_{1}}) ⊑_{F} θ(\underline{σ′_{2}}) (\underline{7}) holds. As a consequence of (6) and (7), θ(\underline{σ′_{1}}) and θ(\underline{σ′_{2}}) are equivalent (\underline{8}) in System F. Now, by definition, ((σ_{1})) is ((σ))[\underline{σ′_{1}}/α]. Hence, θ(((σ_{1}))) is θ(((σ)))[θ(\underline{σ′_{1}})/α]. By (8), this implies θ(((σ)))[θ(\underline{σ′_{2}})/α] ⊂ fsub (θ(((σ_{1})))), that is, θ(((σ_{2}))) ⊂ fsub (θ(((σ_{1})))). Similarly, we have θ(((σ_{1}))) ⊂ fsub (θ(((σ_{2})))). As a result, θ(((σ_{1}))) and θ(((σ_{2}))) are equivalent in System F. This implies fsub (θ(((σ_{1})))) = fsub (θ(((σ_{2})))).

∘ Case R-Context-R: The premise is (Q, α ⋄ σ) σ′_{1} ⊏ − σ′_{2}, σ_{1} is ∀ (α ⋄ σ) σ′_{1}, and σ_{2} is ∀ (α ⋄ σ) σ′_{2}.

Subcase ⋄ is rigid: Then ((σ_{1})) is fsub (((σ′_{1}))[\underline{σ}/α]) and ((σ_{2})) is fsub (((σ′_{2}))[\underline{σ}/α]). Let θ′ be θ ∘ [\underline{σ}/α]. We note that θ′ is in ((Q, α = σ)). By induction hypothesis, we have

fsub (θ′(((σ′_{1})))) = fsub (θ′(((σ′_{2}))))

Thus, by Property 10.3.1.v, we get the equality

fsub (θ(fsub (((σ′_{1}))[\underline{σ}/α]))) = fsub (θ(fsub (((σ′_{2}))[\underline{σ}/α])))

This is exactly fsub (θ(((σ_{1})))) = fsub (θ(((σ_{2})))).

Subcase ⋄ is flexible: By definition, we have

((σ_{1})) = fsub ( ⋃_{t∈((σ))}^{ᾱ#ftv(σ,σ′_{1})} ∀ ᾱ · ((σ′_{1}))[t/α])

((σ_{2})) = fsub ( ⋃_{t∈((σ))}^{ᾱ#ftv(σ,σ′_{2})} ∀ ᾱ · ((σ′_{2}))[t/α])

This leads to the following:

fsub (θ(((σ_{1})))) = fsub (θ (fsub ( ⋃_{t∈((σ))}^{ᾱ#ftv(σ,σ′_{1})} ∀ ᾱ · ((σ′_{1}))[t/α])))

fsub (θ(((σ_{2})))) = fsub (θ (fsub ( ⋃_{t∈((σ))}^{ᾱ#ftv(σ,σ′_{2})} ∀ ᾱ · ((σ′_{2}))[t/α])))

By Property 10.3.1.v, we get

fsub (θ(((σ_{1})))) = fsub (θ ( ⋃_{t∈((σ))}^{ᾱ#ftv(σ,σ′_{1})} ∀ ᾱ · ((σ′_{1}))[t/α]))

and

fsub (θ(((σ_{2})))) = fsub (θ ( ⋃_{t∈((σ))}^{ᾱ#ftv(σ,σ′_{2})} ∀ ᾱ · ((σ′_{2}))[t/α]))

This can also be written

fsub (θ(((σ_{1})))) = ⋃_{t∈((σ))}^{ᾱ#ftv(σ,σ′_{1})} fsub (θ (∀ ᾱ · ((σ′_{1}))[t/α]))

fsub (θ(((σ_{2})))) = ⋃_{t∈((σ))}^{ᾱ#ftv(σ,σ′_{2})} fsub (θ (∀ ᾱ · ((σ′_{2}))[t/α]))

Let J be ftv(σ, σ′_{1}, σ′_{2})∪dom(θ)∪codom(θ) (\underline{9}). By Property ii, ((σ)) is ftv(σ, σ′_{2})-stable, ((σ′_{1})) is ftv(σ, σ′_{1})-stable, and ((σ′_{2})) is ftv(σ, σ′_{2})-stable. Hence, by Property 10.3.6.ix, we get

fsub (θ(((σ_{1})))) = ⋃_{t∈((σ))}^{ᾱ#J} fsub (θ (∀ ᾱ · ((σ′_{1}))[t/α])) (\underline{10})

fsub (θ(((σ_{2})))) = ⋃_{t∈((σ))}^{ᾱ#J} fsub (θ (∀ ᾱ · ((σ′_{2}))[t/α])) (\underline{11})

We have to show that these two sets are equal. Let t ∈ ((σ)) and ᾱ disjoint from J (\underline{12}). Let θ′ be θ ∘ [nf(t)/α] (\underline{13}). We note that θ′ is in ((Q, α ≥ σ)). We have

(\underline{14}) fsub (θ′(((σ′_{1}))))  = fsub (θ′(((σ′_{2}))))
(\underline{15}) fsub (θ(((σ′_{1}))[nf(t)/α])) = fsub (θ(((σ′_{2}))[nf(t)/α]))
(\underline{16}) fsub (θ(((σ′_{1}))[t/α]))  = fsub (θ(((σ′_{2}))[t/α]))
(\underline{17}) fsub (∀ ᾱ · θ(((σ′_{1}))[t/α])) = fsub (∀ ᾱ · θ(((σ′_{2}))[t/α]))
(\underline{18}) fsub (θ(∀ ᾱ · ((σ′_{1}))[t/α])) = fsub (θ(∀ ᾱ · ((σ′_{2}))[t/α]))

Equality (14) holds by induction hypothesis. Equality (15) holds by (13) and (14). Equality (16) holds by (15) by observing that t and nf(t) are equivalent, thus the set fsub (θ(((σ′))[nf(t)/α])) is equal to fsub (θ(((σ′))[t/α])) for σ′ being σ′_{1} or σ′_{2}. Equality (17) holds by Property 10.3.1.iv and (16). Equality (18) holds by commutation of θ and ∀ ᾱ·, thanks to (12) and (9). In summary, (18) holds for all t in ((σ)) and ᾱ disjoint from J, hence we have fsub (θ(((σ_{1})))) = fsub (θ(((σ_{2})))) from (10) and (11). ∘ Case A-Hyp: We have (α = σ_{1}) ∈ Q and σ_{2} is α. By definition, ((σ_{2})) is fsub (α). Necessarily, Q is of the form (Q_{1}, α =σ_{1}, Q_{2}). Hence, ((Q)) is ((Q_{1}))⊚((α =σ_{1}))⊚((Q_{2})). This implies that θ is of the form θ_{1} ∘ θ′ ∘ θ_{2} (\underline{19}), with θ_{1} ∈ ((Q_{1})), θ_{2} ∈ ((Q_{2})), and θ′ is [\underline{σ_{1}}/α]. Hence, we have fsub (θ(((σ_{2})))) = fsub (θ(fsub (α))), that is, fsub (θ(((σ_{2})))) = fsub (θ(α)) by Property 10.3.1.v. By (19), we get fsub (θ(((σ_{2})))) = fsub (θ_{1}(\underline{σ_{1}})) (\underline{20}). By Property iii, we have ((σ_{1})) = fsub (\underline{σ_{1}}). Hence, fsub (θ(((σ_{1})))) = fsub (θ(fsub (\underline{σ_{1}}))). By Property 10.3.1.v, fsub (θ(((σ_{1})))) is fsub (θ(\underline{σ_{1}})), that is, fsub (θ_{1}(\underline{σ_{1}})). Then, we get fsub (θ(((σ_{1})))) = fsub (θ(((σ_{2})))) by (20).

Proof of Lemma 10.3.9

By Lemma 2.3.3, we have a restricted thrifty derivation of (Q) σ_{1} ♢ σ_{2} (\underline{1}). Let θ be in ((Q)). We consider a first case that corresponds to equivalence, then we proceed by case analysis on the last rule in the derivation of (1). ∘ Case (Q) σ_{1} ≡ σ_{2} holds: As in the proof of Lemma 10.3.8, we have θ(((σ_{1}))) = θ(((σ_{2}))). This case being solved, we can freely consider that, in the following, (Q) σ_{1} ≡ σ_{2} does not hold. ∘ Case A-Equiv: See the above remark. ∘ Case I-Abstract: By induction hypothesis. ∘ Case R-Trans: By induction hypothesis. ∘ Case R-Context-R: The premise is (Q, α ⋄ σ) σ′_{1} ♢ σ′_{2} (\underline{2}), σ_{1} is ∀ (α ⋄ σ) σ′_{1}, and σ_{2} is ∀ (α ⋄ σ) σ′_{2}. We can freely consider α ∉ codom(θ). If nf(σ′_{1}) is ⊥, then nf(σ_{1}) is ⊥, thus ((σ_{1})) is ((⊥)) by Property 10.3.6.xii. In this case, θ(((σ_{2}))) ⊆ θ(((σ_{1}))) obviously holds. If nf(σ′_{2}) is ⊥, then nf(σ_{2}) is ⊥, which implies nf(σ_{1}) = ⊥ by Property 2.7.7.ii. We solve this case as above. In the following, we consider nf(σ_{1}) and nf(σ_{2}) different from ⊥ (\underline{3}). Since the derivation is thrifty, we have nf(σ′_{1}) = α if and only if nf(σ′_{2}) = α. We note that if nf(σ′_{1}) = α, then ((σ′_{1})) is fsub (α) by Properties 1.5.6.i and 10.3.6.xii. Hence, in this case, ((σ_{1})) and ((σ_{2})) are equal, which solves this case. In the following, we consider nf(σ_{1}) and nf(σ_{2}) different from α (\underline{4}). Additionally, if nf(σ′_{1}) is a type variable β, then (Q, α ⋄ σ) σ′_{1} ≡ σ′_{2} holds by Property 2.1.6, thus (Q) σ_{1} ≡ σ_{2} holds. We have already proved such a case. In the following, we consider that nf(σ_{1}) is not a type variable (\underline{5}). We consider two subcases.

Subcase ⋄ is rigid: By definition, ((σ_{1})) is the set fsub (((σ′_{1}))[\underline{σ}/α]) (\underline{6}) and ((σ_{2})) is the set fsub (((σ′_{2}))[\underline{σ}/α]). Let θ′ be θ ∘ [\underline{σ}/α]. We note that θ′ is in ((Q, α = σ)). By induction hypothesis and (2), we have θ′(((σ′_{2}))) ⊆ θ′(((σ′_{1}))) (\underline{7}). By Property 10.3.6.vii, (3), (4), and (6), we get ((σ_{1})) =_{α} ((σ′_{1}))[\underline{σ}/α]. By Property 10.3.3.x, we get θ(((σ_{1}))) =_{α} θ′(((σ′_{1}))). Similarly, θ(((σ_{2}))) =_{α} θ′(((σ′_{2}))). From (7), we get θ(((σ_{2}))) ⊆_{α} θ(((σ_{1}))). This holds for any choice of α not in codom(θ), thus, by Property 10.3.3.vi, we get θ(((σ_{2}))) ⊆ θ(((σ_{1}))).

Subcase ⋄ is flexible: By definition, we have

((σ_{1})) = fsub ( ⋃_{t∈((σ))}^{ᾱ#ftv(σ,σ′_{1})} ∀ ᾱ · ((σ′_{1}))[t/α])

((σ_{2})) = fsub ( ⋃_{t∈((σ))}^{ᾱ#ftv(σ,σ′_{2})} ∀ ᾱ · ((σ′_{2}))[t/α])

Let J be ftv(σ) ∪ ftv(σ′_{1}) ∪ ftv(σ′_{2}) ∪ dom(θ) ∪ codom(θ). By Properties 10.3.7.ii and 10.3.6.ix, we get

((σ_{1})) = fsub ( ⋃_{t∈((σ))}^{ᾱ#J} ∀ ᾱ · ((σ′_{1}))[t/α]) (\underline{8})

((σ_{2})) = fsub ( ⋃_{t∈((σ))}^{ᾱ#J} ∀ ᾱ · ((σ′_{2}))[t/α]) (\underline{9})

Let t_{2} be in θ(((σ_{2}))). We note that ftv(t_{2}) # dom(θ) (\underline{10}) holds. By (9), there exist t in ((σ)) and ᾱ disjoint from J such that t_{2} is in θ(fsub (∀ ᾱ · ((σ′_{2}))[t/α])). By Property 10.3.1.ii, we have t_{2} in the set fsub (θ(∀ ᾱ · ((σ′_{2}))[t/α])). Since ᾱ is disjoint from J, this set is equal to fsub (∀ ᾱ · θ ∘ [t/α](((σ′_{2})))). This set is closed by equivalence in System F (it is of the form fsub (S)), hence it is equal to fsub (∀ ᾱ · θ ∘ [nf(t)/α](((σ′_{2})))). Let θ′ be θ∘[nf(t)/α]. We note that θ′ is in ((Q, α≥σ)). Hence, by induction hypothesis, we have θ′(((s′_{2}))) ⊆ θ′(((σ′_{1}))). As a consequence, t_{2} is in fsub (∀ ᾱ · θ ∘ [nf(t)/α](((σ′_{1})))), that is, t in fsub (θ(∀ ᾱ · ((σ′_{1}))[nf(t)/α])). For any t_{1} in ∀ ᾱ · ((σ′_{1}))[nf(t)/α], we have t_{1}/ϵ = σ′_{1}/e by Property 10.3.6.vi, (3), and (4). In particular, (5) implies that the normal form of t_{1} is not in the set dom(θ). By Property 10.3.6.v and (10), the type t_{2} is in the set θ(fsub (∀ ᾱ · ((σ′_{1}))[nf(t)/α])). Since t and nf(t) are equivalent, we also have t_{2} in θ(fsub (∀ ᾱ · ((σ′_{1}))[t/α])). Hence, t_{2} is in

θ(fsub ( ⋃_{t∈((σ))}^{ᾱ#J} ∀ ᾱ · ((σ′_{1}))[t/α]))

By (8), that is t_{2} ∈ θ(((σ_{1}))) In summary, we have shown θ(((σ_{2}))) ⊆ θ(((σ_{1}))). ∘ Case R-Context-Rigid: The premise is (Q) σ′_{1} ⊏ − σ′_{2} (\underline{11}), σ_{1} is ∀ (α = σ′_{1}) σ, and σ_{2} is ∀ (α = σ′_{2}) σ. We can freely assume α ∉ codom(θ). By definition, ((σ_{1})) is fsub (((σ))[\underline{σ′_{1}}/α]) and ((σ_{2})) is fsub (((σ))[\underline{σ′_{2}}/α]). By restrictions of Lemma 2.3.1, we have nf(σ) ≠ α and nf(σ) ≠ ⊥, which imply ((σ_{1})) =_{α} ((σ))[\underline{σ′_{1}}/α] and ((σ_{2})) =_{α} ((σ))[\underline{σ′_{2}}/α] by Property 10.3.6.vii (page 196). By Property 10.3.3.x (page 194), we get θ(((σ_{1}))) =_{α} θ(((σ))[\underline{σ′_{1}}/α]) and θ(((σ_{2}))) =_{α} θ(((σ))[\underline{σ′_{2}}/α]). This is equivalent to θ(((σ_{1}))) =_{α} θ(((σ))[θ(\underline{σ′_{1}})/α]) (\underline{12}) and θ(((σ_{2}))) =_{α} θ(((σ))[θ(\underline{σ′_{2}})/α]) (\underline{13}). By Lemma 10.3.8 (page 197) and (11), we have fsub (θ(((σ′_{1})))) = fsub (θ(((σ′_{2})))). By Property 10.3.7.iii (page 196), it gives

fsub (θ(fsub (\underline{σ′_{1}}))) = fsub (θ(fsub (\underline{σ′_{2}})))

By Property 10.3.1.v, we get fsub (θ(\underline{σ′_{1}})) = fsub (θ(\underline{σ′_{2}})) (\underline{14}). In particular, we have

θ(\underline{σ′_{1}}) ∈ fsub (θ(\underline{σ′_{1}})). Hence, by (14), we have θ(\underline{σ′_{1}}) ∈ fsub (θ(\underline{σ′_{2}})), which means that θ(\underline{σ′_{2}}) ⊑_{F} θ(\underline{σ′_{1}}) (\underline{15}) holds. Similarly, we show that θ(\underline{σ′_{1}}) ⊑_{F} θ(\underline{σ′_{2}}) (\underline{16}) holds. As a consequence of (15) and (16), θ(\underline{σ′_{1}}) and θ(\underline{σ′_{2}}) are equivalent in System F. Observing that \underline{σ′_{1}} and \underline{σ′_{2}} are in normal form by definition, we get θ(\underline{σ′_{1}}) = θ(\underline{σ′_{2}}). By (12) and (13), it leads to θ(((σ_{1}))) =_{α} θ(((σ_{1}))). This holds for any choice of α such that α ∉ codom(θ). Hence, by Property 10.3.3.vii, we get θ(((σ_{1}))) = θ(((σ_{2}))). ∘ Case R-Context-Flexible: The premise is (Q) σ′_{1} ⊑ σ′_{2} (\underline{17}), σ_{1} is ∀ (α ≥ σ′_{1}) σ, and σ_{2} is ∀ (α ≥ σ′_{2}) σ. By induction hypothesis and (17), we get θ(((σ′_{2}))) ⊆ θ(((σ′_{1}))) (\underline{18}). By definition, we have

((σ_{1})) = fsub ( ⋃_{t′_{1}∈((σ′_{1}))}^{ᾱ#ftv(σ′_{1},σ)} ∀ ᾱ · ((σ))[t′_{1}/α])

((σ_{2})) = fsub ( ⋃_{t′_{2}∈((σ′_{2}))}^{ᾱ#ftv(σ′_{2},σ)} ∀ ᾱ · ((σ))[t′_{2}/α])

Let J be ftv(σ, σ′_{1}, σ′_{2}) ∪ dom(θ) ∪ codom(θ). By Properties 10.3.7.ii and 10.3.6.ix, we get

((σ_{1})) = fsub ( ⋃_{t′_{1}∈((σ′_{1}))}^{ᾱ#J} ∀ ᾱ · ((σ))[t′_{1}/α])

((σ_{2})) = fsub ( ⋃_{t′_{2}∈((σ′_{2}))}^{ᾱ#J} ∀ ᾱ · ((σ))[t′_{2}/α])

Applying θ, we get

θ(((σ_{1}))) = θ (fsub ( ⋃_{t′_{1}∈((σ′_{1}))}^{ᾱ#J} ∀ ᾱ · ((σ))[t′_{1}/α]))

θ(((σ_{2}))) = θ (fsub ( ⋃_{t′_{2}∈((σ′_{2}))}^{ᾱ#J} ∀ ᾱ · ((σ))[t′_{2}/α]))

By restrictions of Lemma 2.3.1, we have α ∈ ftv(σ), and nf(σ) ≠ α. As a consequence, σ/ϵ is a type constructor g. Hence, for all t in ((σ)), for all ᾱ and all t′_{1} ∈ ((σ′_{1})), ∀ ᾱ · t[t′_{1}/α]/ϵ = g. In particular, t ∉ dom(θ). By Property 10.3.6.v, we get

θ(((σ_{1}))) =_{dom(θ)} fsub ( ⋃_{t′_{1}∈((σ′_{1}))}^{ᾱ#J} θ(∀ ᾱ · ((σ))[t′_{1}/α]))

θ(((σ_{2}))) =_{dom(θ)} fsub ( ⋃_{t′_{2}∈((σ′_{2}))}^{ᾱ#J} θ(∀ ᾱ · ((σ))[t′_{2}/α]))

Hence, we have

θ(((σ_{1}))) =_{dom(θ)} fsub ( ⋃_{t′_{1}∈((σ′_{1}))}^{ᾱ#J} ∀ ᾱ · θ(((σ)))[θ(t′_{1})/α])

θ(((σ_{2}))) =_{dom(θ)} fsub ( ⋃_{t′_{2}∈((σ′_{2}))}^{ᾱ#J} ∀ ᾱ · θ(((σ)))[θ(t′_{2})/α])

We note that the sets {θ(t′_{1}) | t′_{1} ∈ ((σ′_{1}))} and {t′_{1} | t′_{1} ∈ θ(((σ′_{1})))} are equal. Hence, we have

θ(((σ_{1}))) =_{dom(θ)} fsub ( ⋃_{t′_{1}∈θ(((σ′_{1})))}^{ᾱ#J} ∀ ᾱ · θ(((σ)))[t′_{1}/α])

θ(((σ_{2}))) =_{dom(θ)} fsub ( ⋃_{t′_{2}∈θ(((σ′_{2})))}^{ᾱ#J} ∀ ᾱ · θ(((σ)))[t′_{2}/α])

By (18), we get θ(((σ_{2}))) ⊆_{dom(θ)} θ(((σ_{1}))). We note that θ is idempotent, thus θ(((σ_{i})))∩ Σ_{dom(θ)}^{¬} = θ(((σ_{i}))) for σ_{i} being σ_{1} or σ_{2}. Hence, θ(((σ_{2}))) ⊆ θ(((σ_{1}))) holds. ∘ Case A-Hyp: We have (α = σ_{1}) ∈ Q and σ_{2} is α. By definition, ((σ_{2})) is fsub (α). Necessarily, Q is of the form (Q_{1}, α =σ_{1}, Q_{2}). Hence, ((Q)) is ((Q_{1}))⊚((α =σ_{1}))⊚((Q_{2})). This implies that θ is of the form θ_{1}∘[\underline{σ_{1}}/α]∘θ_{2}, with θ_{1} ∈ ((Q_{1})) and θ_{2} ∈ ((Q_{2})). Hence, all types in θ(((σ_{2}))) are equivalent to θ_{1}(\underline{σ_{1}}), that is, θ(\underline{σ_{1}}). This implies θ(((σ_{2}))) ⊆ fsub (θ(\underline{σ_{1}})). By Property 10.3.1.v, we get θ(((σ_{2}))) ⊆ fsub (θ(fsub (\underline{σ_{1}}))). By Property 10.3.7.iii, we have θ(((σ_{2}))) ⊆ fsub (θ(((σ_{1})))). The restrictions of Lemma 2.3.1 ensure that σ_{1} is not in T . Hence, nf(σ_{1}) is not in dom(θ). As a consequence, we have θ(((σ_{2}))) ⊆_{dom(θ)} θ(fsub (((σ_{1})))). By Property 10.3.6.i, we get θ(((σ_{2}))) ⊆_{dom(θ)} θ(((σ_{1}))). Observing that θ is idempotent, we get θ(((σ_{2}))) ∩ Σ_{dom(θ)}^{¬} = θ(((σ_{2}))), thus θ(((σ_{2}))) ⊆_{dom(θ)} θ(((σ_{1}))). ∘ Case I-Hyp: We have (α ≥ σ_{1}) ∈ Q and σ_{2} is α. By definition, ((σ_{2})) is fsub (α). Necessarily, Q is of the form (Q_{1}, α ≥σ_{1}, Q_{2}). Hence, ((Q)) is ((Q_{1}))⊚((α ≥σ_{1}))⊚((Q_{2})). This implies that θ is of the form θ_{1} ∘ [t/α] ∘ θ_{2}, with θ_{1} ∈ ((Q_{1})), θ_{2} ∈ ((Q_{2})), and t ∈ ((σ_{1})). Hence, all types in θ(((σ_{2}))) are equivalent to θ_{1}(t), that is, θ(t). We conclude as in the case A-Hyp. ∘ Case I-Bot: We have σ_{1} = ⊥, and observing that ((⊥)) is fsub (∀ α · α), we have θ(((σ_{2}))) ⊆ θ((⊥)). ∘ Case I-Rigid: We have σ_{1} = ∀ (α ≥ σ) σ′, and σ_{2} = ∀ (α = σ) σ′. By definition,

((σ_{2})) is fsub (((σ′))[\underline{σ}/α]), and ((σ_{1})) is fsub ( ⋃_{t∈((σ))}^{ᾱ#ftv(σ,σ′)} ∀ ᾱ · ((σ′))[t/α]) (\underline{19}) By Prop-

erty 10.3.7.iii, we have \underline{σ} ∈ ((σ)). Let t be \underline{σ}. Taking ᾱ = ∅ in (19), we immediately have fsub (((σ′))[t/α]) ⊆ ((σ_{1})), that is, ((σ_{2})) ⊆ ((σ_{1})). This implies θ(((σ_{2}))) ⊆ θ(((σ_{1}))).

318

Indexes

Defined rules

Many inference rules are introduced in the document. They are listed in the following table. Names of derived rules are followed by a star ^{⋆} and can be found page 321.

Rule name Relation Page [fig]  Rule name  Relation Page [fig]
A-Alias’  ⊏ −ᾱ p.82 [2.1]  A-Context-L’  ⊏ −ᾱ p.82 [2.1]
A-Context^{⋆}  ⊏ − p.77  A-Equiv’  ⊏ −ᾱ p.82 [2.1]
A-Equiv  ⊏ − p.56 [1.2]  A-Hyp’  ⊏ −ᾱ p.82 [2.1]
A-Hyp  ⊏ − p.56 [1.2]  A-Up’  ⊏ −ᾱ p.82 [2.1]
A-Up^{⋆}  ⊏ − p.56  Ac-Hyp  ⊏ −_{C} p.78
App^{▽}  ⊢^{▽} p.149 [5.3]  App  ⊢  p.145 [5.2]
C-Abstract-F ˙⊑ p.85 [2.5]  C-Abstract-R  ˙⊑ p.85 [2.5]
C-Strict  ˙⊑ p.85 [2.5]  Eq-Comm  ≡ p.46 [1.1]
Eq-Context^{⋆}  ≡ p.77  Eq-Free  ≡ p.46 [1.1]
Eq-Mono^{⋆}  ≡ p.47  Eq-Mono  ≡ p.46 [1.1]
Eq-Refl  ≡ p.46 [1.1]  Eq-Var^{⋆}  ≡ p.48
Eq-Var  ≡ p.46 [1.1]  Fun^{▽}  ⊢^{▽} p.149 [5.3]
Fun^{⋆}  ⊢  p.176  Fun  ⊢  p.145 [5.2]
Gen  ⊢  p.145 [5.2]  I-Abstract’  ⊑ᾱ p.83 [2.2]
I-Abstract  ⊑ p.59 [1.3]  I-Alias’  ⊑ᾱ p.83 [2.2]
I-Bot’  ⊑ᾱ p.83 [2.2]  I-Bot  ⊑ p.59 [1.3]
I-Context-L’  ⊑ᾱ p.83 [2.2]  I-Context^{⋆}  ⊑ p.77
continued…  continued…

Rule name Relation Page [fig]  Rule name  Relation Page [fig]
I-Drop^{⋆}  ⊑ p.58  I-Equiv^{⋆}  ⊑ p.58
I-Hyp’  ⊑ᾱ p.83 [2.2]  I-Hyp  ⊑ p.59 [1.3]
I-Rigid’  ⊑ᾱ p.83 [2.2]  I-Rigid  ⊑ p.59 [1.3]
I-Up’  ⊑ᾱ p.83 [2.2]  I-Up^{⋆}  ⊑ p.58
Ic-Abstract  ⊑_{C} p.79  Ic-Bot  ⊑_{C} p.79
Ic-Hyp  ⊑_{C} p.79  Ic-Rigid  ⊑_{C} p.79
Inst  ⊢  p.145 [5.2]  Let^{▽}  ⊢^{▽} p.149 [5.3]
Let  ⊢  p.145 [5.2]  Oracle^{▽}  ⊢^{▽} p.149 [5.3]
Oracle  ⊢  p.145 [5.2]  PA-Context-L  ⊏ −_{ℓ}^{I} p.105 [3.2]
PA-Equiv  ⊏ −_{ℓ}^{I} p.105 [3.2]  PA-Trans  ⊏ −_{ℓ}^{I} p.105 [3.2]
PE-Comm  ≡_{ℓ}^{I} p.105 [3.1]  PE-Context-L  ≡_{ℓ}^{I} p.105 [3.1]
PE-Free  ≡_{ℓ}^{I} p.105 [3.1]  PE-Mono^{⋆}  ≡_{ℓ}^{I} p.106
PE-Mono  ≡_{ℓ}^{I} p.105 [3.1]  PE-Refl  ≡_{ℓ}^{I} p.105 [3.1]
PE-Swap  ≡_{ℓ}^{I} p.105 [3.1]  PE-Trans  ≡_{ℓ}^{I} p.105 [3.1]
PI-Abstract  ⊑_{ℓ}^{I} p.106 [3.3]  PI-Context-L  ⊑_{ℓ}^{I} p.106 [3.3]
PI-Rigid  ⊑_{ℓ}^{I} p.106 [3.3]  PI-Trans  ⊑_{ℓ}^{I} p.106 [3.3]
Pr-Subst^{⋆}  ♢ p.102  R-Context-Flexible ♢ p.46
R-Context-Rigid ♢ p.46  R-Context-L  ♢ p.46
R-Context-R ♢ p.45  R-Trans  ♢ p.45
S-Alias  ˙⊏ p.84 [2.3]  S-Hyp  ˙⊏ p.84 [2.3]
S-Nil  ˙⊏ p.84 [2.3]  S-Rigid  ˙⊏ p.84 [2.3]
S-Up  ˙⊏ p.84 [2.3]  StSh-Alias  ˙⊏ −ᾱ p.85 [2.4]
StSh-Hyp  ˙⊏ −ᾱ p.85 [2.4]  StSh-Up  ˙⊏ −ᾱ p.85 [2.4]
Strengthen’  ⊢′ p.155 –6.2.3  Strengthen  ⊢  p.152 –6.1.2
Var^{▽}  ⊢^{▽} p.149 –5.3  Var  ⊢  p.145 [5.2]
Weaken^{⋆}  ⊢  p.152 –6.1.2  Weaken  ⊢  p.152 6.1.2

Derivable rules

Some of the rules in the previous table are actually derivable rules. We explicitly give such rules here.

Name  Rule  Page
Eq-Mono^{⋆}  \frac{(Q) σ′ ≡ τ}{(Q) ∀ (α ⋄ σ′) σ ≡ σ[τ/α]}  P.47
Eq-Var^{⋆}  \frac{(α ⋄ σ) ∈ Q}{(Q_{0}) ∀ (Q) α ≡ ∀ (Q) σ}  P.48
A-Up^{⋆}  \frac{α′ ∉ ftv(σ_{0})}{∀ (α = ∀ (α′ = σ′) σ) σ_{0} ⊏ − ∀ (α′ = σ′) ∀ (α = σ) σ_{0}}  P.56
I-Drop^{⋆}  \overline{(QQ′Q′′) ∀ (Q′) σ ⊑ σ}  P.58
I-Equiv^{⋆}  \frac{(Q) σ_{1} ≡ σ_{2}}{(Q) σ_{1} ⊑ σ_{2}}  P.58
I-Up^{⋆} \frac{α_{2} ∉ ftv(σ)}{(Q) ∀ (α_{1} ≥ ∀ (α_{2} ⋄ σ_{2}) σ_{1}) σ ⊑ ∀ (α_{2} ⋄ σ_{2}) ∀ (α_{1} ≥ σ_{1}) σ} P.58

Eq-Context^{⋆} \frac{(Q\overline{C}) σ_{1} ≡ σ_{2}}{(Q) C(σ_{1}) ≡ C(σ_{2})} P.77

A-Context^{⋆}  \frac{(Q\overline{C_{r}}) σ_{1} ⊏ − σ_{2}}{(Q) C_{r}(σ_{1}) ⊏ − C_{r}(σ_{2})}  P.77

continued…

Name  Rule  Page

I-Context^{⋆}  \frac{(Q\overline{C_{f}}) σ_{1} ⊑ σ_{2}}{(Q) C_{f}(σ_{1}) ⊑ C_{f}(σ_{2})}  P.77

Pr-Subst^{⋆}  \frac{(Q\underline{θ}) σ_{1} ♢ σ_{2}}{(Q) θ(σ_{1}) ♢ θ(σ_{2})}  P.102

PE-Mono^{⋆}  \frac{(Q) σ ≡ τ}{(Q, α = σ, Q′) ≡_{ℓ} (Q, α = σ, Q′[τ/α])}  P.106

Notations

The following table lists the symbols and notations used in this document. The left column contains a symbol or a word. Then comes the page where it is defined. In most cases, the third column provides the corresponding definition, or it simply reads the symbol.

In a few cases, the prefix Q is supposed equal to (α_{1} ⋄_{1} σ_{1}, … α_{n} ⋄_{n} σ_{n}) (\underline{1}). We explicitly refer to this definition, then.

Symbol Page Meaning
α, τ, σ

38

A type variable, a monotype, a polytype

ᾱ, τ̄ 39 A tuple of type variables, a tuple of monotypes

Q_{1} # Q_{2}  39 dom(Q_{1}) # dom(Q_{2})
ᾱ # β̄ 39 ᾱ ∩ β̄ = ∅

ϕ disjoint from ᾱ 42

ᾱ # dom(ϕ) ∪ codom(ϕ)

#(σ)

97

The cardinal of dom(σ)

⋆ 91

Binary operator on {X, Y, Z}

∀ (Q) σ 39 ∀ (α_{1} ⋄_{1} σ_{1}) … ∀ (α_{n} ⋄_{n} σ_{n}) σ when Q is (1)

continued…

Symbol Page Meaning
∀ α · S 192 {∀ α · t | t ∈ S}

⊑ 57

The instance relation, figure 1.3

˙⊑ 85 See figure 2.5
˙⊏ 84 See figure 2.3

⊑^{I} 103

Prefix instance relation

⊑_{ℓ}^{I}  106 See figure 3.3
⊑_{C}  79

⊑_{F} 192

The instance relation of System F.

⊑ᾱ  83 See figure 2.2

⊏ − 55

The abstraction relation, figure 1.2

˙⊏ −ᾱ  85 See figure 2.4

(Q) σ_{1} ⊏ −^{?} σ_{2} 121

The abstraction-check algorithm

⊏ −^{I}

103

Prefix abstraction relation

⊏ −_{ℓ}^{I}  105 See figure 3.2
⊏ −_{C}  78
⊏ −ᾱ  82 See figure 2.1

ϵ 40

The empty sequence

≈ 48

The rearrangement relation, Definition 1.5.2

S_{1} =ᾱ S_{2} 194 S_{1} ∩ Σ¬ ; ᾱ = S_{2} ∩ Σ¬ ; ᾱ

≡ 47

The equivalence relation, figure 1.1

(≡ ˙⊏ −^{∅}), (≡ ˙⊑)

84

See Definition 2.6.1

(≡|⊑_{C}) 79
(≡|⊏ −_{C}) 78

≡^{I} 103

Prefix equivalence relation

≡_{ℓ}^{I}  105 See figure 3.1

⋄, ⋄′, ⋄_{1} 39 Meta-variables standing for = or ≥, as in e.g. (α_{1} ⋄_{1} σ_{1}, α_{2} ⋄_{2} σ_{2})

T 51 The set {σ | ∃τ.nf(σ) = τ}

continued…

Symbol Page Meaning

⊥ 38

“bottom”, equivalent to ∀ (α) α

ϕ 42

An idempotent renaming

ϕ^{¬} 42

The inverse renaming of ϕ

ϕ(Q) 42 {(ϕ(α_{1}) ⋄_{1} ϕ(σ_{1}) … ϕ(α_{n}) ⋄_{n} ϕ(σ_{n})) when Q \atop is (1)}

♢ 45 Meta-variable standing for ≡, ⊏ −, or ⊑, as in e.g. (Q) σ_{1} ♢ σ_{2}

Q ♢ Q′ 103 Q ♢^{dom(Q)} Q′

σ · u/ 40

The function u′ ↦ σ/uu′

⌈σ⌉ 128

See Definition 4.5.2

σ′[σ/α] 42

The substitution [σ/α] applied to the type σ′

σ/ 40 The function mapping occurrences in σ to type symbols

σ/u 40

The type symbol at occurrence u in σ

\underline{σ} 192 The projection of an F-type σ to a type of System F.

[σ/α] 42

The capture-avoiding substitution of α by σ

Σ_{I} 103

The set {σ | utv(σ) ⊆ I}

Σ¬ ; ᾱ 194

The set of System F types {t | ftv(σ) # ᾱ}

P ⩽ P′ (polynomials) 86

⩽_{/} 65

A partial order on skeletons

S_{1} ⊆ᾱ S_{2} 194 S_{1} ∩ Σ¬ ; ᾱ ⊆ S_{2} ∩ Σ¬ ; ᾱ

⊢ 145

Typing judgments, see figure 5.2

⊢^{▽} 149 Syntax-directed typing judgments, see figure 5.3

Θ 40

A substitution on skeletons

θ 42

An idempotent substitution

θ(S) 192 {θ(t) | t ∈ S}
θ(Q) 42

continued…

Symbol Page Meaning

\underline{θ} 102

The monotype prefix corresponding to θ

Θ_{Q} 40 Assuming Q is (1), this is the substitution [proj(σ_{1})/α_{1}] ∘ .. ∘ [proj(σ_{n})/α_{n}]

[ ] 71

A hole (in contexts)

∇_{Q}  39 ∇_{dom(Q)}
∇_{α_{1},...α_{n}}  39 α_{1} → … → α_{n} → unit

C 71

Generic contexts

\overline{C} 71

The prefix corresponding to C

Ĉ 71

The extracted substitution ˆ \overline{C}

C^{n} 76

Contexts with n holes

C_{f} 74

Flexible contexts

C_{n} 73

Narrow contexts

C_{r} 74

Rigid contexts

cf(σ)

55

The constructed form of σ

codom(f)

42

The set ⋃_{α∈dom(f)} ftv(f(α))

d(σ)

97

The degree of P (σ)

dom(Q) 39 The set {α_{1}, … α_{n}}

dom(σ)

40

The domain of σ/

dom(f) 42 The set {α | f(α) ≠ α}

dom_{=}(Q), dom_{>}(Q)

207

Rigid domain of Q, flexible domain of Q

dom_{1}(C)

73

The 1-level of context C

dom(C)

71

The domain dom(\overline{C})

dom(Q/I)

104

See Definition 3.3.1

dom(Q/σ_{1}, … σ_{i})

104

The domain dom(Q/ ftv(σ_{1}) ∪ … ftv(σ_{i}))

dom(Q/σ)

104

The domain dom(Q/ ftv(σ))

fsub (S) 192 ⋃_{t∈S} fsub (t)
fsub (t) 192 {t′ | t ⊑_{F} t′}

ftv(σ)

41 The set of free type variables of σ

continued…

Symbol Page Meaning

ftv(σ_{1}, σ_{2})

41

The set ftv(σ_{1}) ∪ ftv(σ_{2})

g or g^{n} 38

A type constructor, of arity n

I 101

An interface, that is, a set of type variables ᾱ

level(C)

73

The level of context C

nf(σ)

51

The normal form of σ

P (σ) 97 w_{X}(σ)(X, X, X)

proj(σ)

40

The function mapping types to skeletons

Q 39

A prefix, e.g.(1)

Q↑ᾱ 112

The splitting of Q according to ᾱ

Q[α] 69

The representative of α in Q

Q(α)

69

The bound of Q[α] in Q

Q ⇐ (α ⋄ σ)

123

Update algorithm, see figure 4.2

Q ⇐ α_{1} ∧ α_{2} 124

Merge algorithm, see Definition 4.2.6

Q̂ 52

The substitution extracted from Q

R^{∗} 34

The transitive closure of R

R 34 A meta-variable standing for a relation (depending on the context)

S 192

A set of System F types.

t 39 A skeleton

utv(σ)

41

The set of unbound type variables of σ

ϑ 38

The set of type variables.

V 51

The set {σ | ∃α.nf(σ) = α}

w_{X}(σ), w_{Y} (σ), w_{Z}(σ)

91

Weights of σ (polynomials)

constructed form 55

See Definition 1.5.12

flexible binding 38 (α ≥ σ)
f invariant on ᾱ 42 ᾱ # dom(f)
rigid binding 38 (α = σ)

unconstrained binding 38 (α ≥ ⊥) also written (α)