Realizability Interpretation And Normalization Of Typed Call-by-Need λ-calculus With Control

Étienne Miquey^{1,2} and Hugo Herbelin^{2}

1 Équipe Gallinette Inria, LS2N (CNRS) Université de Nantes 2 Équipe πr^{2} Inria, IRIF (CNRS) Université Paris-Diderot

                     etienne.miquey,herbelin@inria.fr

Abstract. We define a variant of Krivine realizability where realizers are pairs of a term and a substitution. This variant allows us to prove the normalization of a simply-typed call-by-need λ-calculus with control due to Ariola et al. Indeed, in such call-by-need calculus, substitutions have to be delayed until knowing if an argument is really needed. We then extend the proof to a call-by-need λ-calculus equipped with a type system equivalent to classical second-order predicate logic, representing one step towards proving the normalization of the call-by-need classical second-order arithmetic introduced by the second author to provide a proof-as-program interpretation of the axiom of dependent choice.

Introduction

Realizability-based normalization

Normalization by realizability is a standard technique to prove the normalization of typed λ-calculi. Originally introduced by Tait [?] to prove the normalization of System T, it was extended by Girard to prove the normalization of System F [?]. This kind of techniques, also called normalization by reducibility or normalization by logical relations, works by interpreting each type by a set of typed or untyped terms seen as realizers of the type, then showing that the way these sets of realizers are built preserve properties such as normalization. Over the years, multiple uses and generalization of this method have been done, for a more detailed account of which we refer the reader to the work of Gallier [?].

Realizability techniques were adapted to the normalization of various calculi for classical logic (see e.g. [?,?]). A specific framework tailored to the study of realizability for classical logic has been designed by Krivine [?] on top of a λcalculus with control whose reduction is defined in terms of an abstract machine. In such a machinery, terms are evaluated in front of stacks; and control (thus classical logic) is made available through the possibility of saving and restoring stacks. During the last twenty years, Krivine’s classical realizability turned out to be fruitful both from the point of view of logic, leading to the construction of new models of set theory, and generalizing in particular the technique of Cohen’s forcing [?,?,?]; and on its computational facet, providing alternative tools to the analysis of the computational content of classical programs^{3}.

Noteworthily, Krivine realizability is one of the approaches contributing to advocating the motto that through the Curry-Howard correspondence, with new programming instructions come new reasoning principles^{4}. Our original motivation for the present work is actually in line with this idea, in the sense that our long-term purpose is to give a realizability interpretation to dPA^{ω}, a call-by-need calculus defined by the second author [?]. In this calculus, the lazy evaluation is indeed a fundamental ingredient in order to obtain an executable proof term for the axiom of dependent choice.

Contributions of the paper

In order to address the normalization of typed call-by-need λ-calculus, we design a variant of Krivine’s classical realizability, where the realizers are closures (a term with a substitution for its free variables). The call-by-need λ-calculus with control that we consider is the \overline{λ}_{[lvτ⋆]}-calculus. This calculus, that was defined by Ariola et al. [?], is syntactically described in an extension with explicit substitutions of the λμμ̃-calculus [?,?,?]. The syntax of the λμμ̃-calculus itself refines the syntax of the λ-calculus by syntactically distinguishing between terms and evaluation contexts. It also contains commands which combine terms and evaluation contexts so that they can interact together. Thinking of evaluation contexts as stacks and commands as states, the λμμ̃-calculus can also be seen as a syntax for abstract machines. As for a proof-as-program point of view, the λμμ̃-calculus and its variants can be seen as a term syntax for proofs of Gentzen’s sequent calculus. In particular, the λμμ̃-calculus contains control operators which give a computational interpretation to classical logic.

We give a proof of normalization first for the simply-typed \overline{λ}_{[lvτ⋆]}-calculus^{5}, then for a type system with first-order and second-order quantification. While we only apply our technique to the normalization of the \overline{λ}_{[lvτ⋆]}-calculus, our interpretation incidentally suggests a way to adapt Krivine realizability to other call-by-need settings. This paves the way to the computational interpretation of classical proofs using lazy evaluation or shared memory cells, including the case of the call-by-need second order arithmetic dPA^{ω} [?].

3 See for instance [?] about witness extraction or [?,?] about specification problems. 4 For instance, one way to realize the axiom of dependent choice in classical realizabil-

ity is by means of an extra instruction quote [?]. 5 Even though it has not been done formally, the normalization of the \overline{λ}_{lv}-calculus pre-

sented in [?] should also be derivable from Polonowski’s proof of strong normalization of the non-deterministic λμμ̃-calculus [?]. The \overline{λ}_{lv}-calculus (a big-step variant of the \overline{λ}_{[lvτ⋆]}-calculus introduced in Ariola et al.) is indeed a particular evaluation strategy for the λμμ̃-calculus, so that the strong normalization of the non-deterministic variant of the latter should imply the normalization of the former as a particular case.

1 The \overline{λ}_{[lvτ ⋆]}-calculus

1.1 The call-by-need evaluation strategy

The call-by-need evaluation strategy of the λ-calculus evaluates arguments of functions only when needed, and, when needed, shares their evaluations across all places where the argument is required. The call-by-need evaluation is at the heart of a functional programming language such as Haskell. It has in common with the call-by-value evaluation strategy that all places where a same argument is used share the same value. Nevertheless, it observationally behaves like the callby-name evaluation strategy (for the pure λ-calculus), in the sense that a given computation eventually evaluates to a value if and only if it evaluates to the same value (up to inner reduction) along the call-by-name evaluation. In particular, in a setting with non-terminating computations, it is not observationally equivalent to the call-by-value evaluation. Indeed, if the evaluation of a useless argument loops in the call-by-value evaluation, the whole computation loops, which is not the case of call-by-name and call-by-need evaluations.

These three evaluation strategies can be turned into equational theories. For call-by-name and call-by-value, this was done by Plotkin through continuationpassing-style (CPS) semantics characterizing these theories [?]. For the call-by-need evaluation strategy, a specific equational theory reflecting the intensional behavior of the strategy into a semantics was proposed independently by Ariola and Felleisen [?], and by Maraist, Odersky and Wadler [?]. A continuationpassing-style semantics was proposed in the 90s by Okasaki, Lee and Tarditi [?]. However, this semantics does not ensure normalization of simply-typed call-by-need evaluation, as shown in [?], thus failing to ensure a property which holds in the simply-typed call-by-name and call-by-value cases.

Continuation-passing-style semantics de facto gives a semantics to the extension of λ-calculus with control operators^{6}. In particular, even though call-by-name and call-by-need are observationally equivalent on pure λ-calculus, their different intentional behaviors induce different CPS semantics, leading to different observational behaviors when control operators are considered. On the other hand, the semantics of calculi with control can also be reconstructed from an analysis of the duality between programs and their evaluation contexts, and the duality between the let construct (which binds programs) and a control operator such as Parigot’s μ (which binds evaluation contexts). Such an analysis can be done in the context of the λμμ̃-calculus [?,?].

In the call-by-name and call-by-value cases, the approach based on λμμ̃- calculus leads to continuation-passing style semantics similar to the ones given by Plotkin or, in the call-by-name case, also to the one by Lafont, Reus and Streicher [?]. As for call-by-need, in [?] is defined the \overline{λ}_{lv}-calculus, a call-by-need version of the λμμ̃-calculus. A continuation-passing style semantics is then defined via a calculus called \overline{λ}_{[lvτ⋆]} [?]. This semantics, which is different from Okasaki, Lee and Tarditi’s one [?], is the object of study in this paper.

6 That is to say with operators such as Scheme’s callcc, Felleisen’s C, K, or A operators [?], Parigot’s μ and [ ] operators [?], Crolard’s catch and throw operators [?].

1.2 Explicit environments

While the results presented in this paper could be directly expressed using the \overline{λ}_{lv}-calculus, the realizability interpretation naturally arises from the decomposition of this calculus into a different calculus with an explicit environment, the \overline{λ}_{[lvτ⋆]}-calculus [?]. Indeed, as we shall see in the sequel, the decomposition highlights different syntactic categories that are deeply involved in the type system and in the definition of the realizability interpretation.

The \overline{λ}_{[lvτ⋆]}-calculus is a reformulation of the \overline{λ}_{lv}-calculus with explicit environments, called stores and denoted by τ. Stores consists of a list of bindings of the form [x := t], where x is a term variable and t a term, and of bindings of the form [α := e] where α is a context variable and e a context. For instance, in the closure cτ[x := t]τ′, the variable x is bound to t in c and τ′. Besides, the term t might be an unevaluated term (i.e. lazily stored), so that if x is eagerly demanded at some point during the execution of this closure, t will be reduced in order to obtain a value. In the case where t indeed produces a value V, the store will be updated with the binding [x := V]. However, a binding of this form (with a value) is fixed for the rest of the execution. As such, our so-called stores somewhat behave like lazy explicit substitutions or mutable environments.

To draw the comparison between our structures and the usual notions of stores and environments, two things should be observed. First, the usual notion of store refers to a structure of list that is fully mutable, in the sense that the cells can be updated at any time and thus values might be replaced. Second, the usual notion of environment designates a structure in which variables are bounded to closures made of a term and an environment. In particular, terms and environments are duplicated, i.e. sharing is not allowed. Such a structure resemble to a tree whose nodes are decorated by terms, as opposed to a machinery allowing sharing (like ours) whose underlying structure is broadly a directed acyclic graph. See for instance [?] for a Krivine abstract machine with sharing.

1.3 Syntax & reduction rules

The lazy evaluation of terms allows for the following reduction rule: us to reduce a command ⟨μα.c||μ̃x.c′⟩ to the command c′ together with the binding [x := μα.c].

⟨μα.c||μ̃x.c′⟩ → c′[x := μα.c]

In this case, the term μα.c is left unevaluated (“frozen”) in the store, until possibly reaching a command in which the variable x is needed. When evaluation reaches a command of the form ⟨x||F ⟩τ[x := μα.c]τ′, the binding is opened and the term is evaluated in front of the context μ̃[x].⟨x||F ⟩τ′:

⟨x||F ⟩τ[x := μα.c]τ′ → ⟨μα.c||μ̃[x].⟨x||F ⟩τ′⟩τ

The reader can think of the previous rule as the “defrosting” operation of the frozen term μα.c: this term is evaluated in the prefix of the store τ which predates it, in front of the context μ̃[x].⟨x||F ⟩τ′ where the μ̃[x] binder is waiting for a value.

Strong values  v ::= λx.t | k
Weak values  V ::= v | x
Terms  t, u ::= V | μα.c
Forcing contexts  F ::= t · E | κ
Catchable contexts  E ::= F | α | μ̃[x].⟨x||F ⟩τ
Evaluation contexts  e ::= E | μ̃x.c
Stores  τ ::= ε | τ[x := t] | τ[α := E]
Commands  c ::= ⟨t||e⟩
Closures  l ::= cτ

(Beta) (Let) (Catch) (Lookup_{α}) (Lookup_{x}) (Restore)

\begin{matrix}⟨λx.t||u · E⟩τ  → & ⟨u||μ̃x.⟨t||E⟩⟩τ \\ ⟨t||μ̃x.c⟩τ  → & cτ[x := t] \\ ⟨μα.c||E⟩τ  → & cτ[α := E] \\ ⟨V ||α⟩τ[α := E]τ′  → & ⟨V ||E⟩τ[α := E]τ′ \\ ⟨x||F ⟩τ[x := t]τ′  → & ⟨t||μ̃[x].⟨x||F ⟩τ′⟩τ \\ ⟨V ||μ̃[x].⟨x||F ⟩τ′⟩τ  → & ⟨V ||F ⟩τ[x := V]τ′ \end{matrix}

Fig. 1. Syntax and reduction rules of the \overline{λ}_{[lvτ⋆]}-calculus

This context keeps trace of the part of the store τ′ that was originally located after the binding [x := ...]. This way, if a value V is indeed furnished for the binder μ̃[x], the original command ⟨x||F ⟩ is evaluated in the updated full store:

⟨V ||μ̃[x].⟨x||F ⟩τ′⟩τ → ⟨V ||F ⟩τ[x := V]τ′

The brackets in μ̃[x].c are used to express the fact that the variable x is forced at top-level (unlike contexts of the shape μ̃x.C[⟨x||F ⟩] in the \overline{λ}_{lv}-calculus). The reduction system resembles the one of an abstract machine. Especially, it allows us to keep the standard redex at the top of a command and avoids searching through the meta-context for work to be done.

Note that our approach slightly differ from [?] since we split values into two categories: strong values (v) and weak values (V). The strong values correspond to values strictly speaking. The weak values include the variables which force the evaluation of terms to which they refer into shared strong value. Their evaluation may require capturing a continuation. The syntax of the language, which includes constants k and co-constants κ, is given in Figure 1. As for the reduction →, we define it as the compatible reflexive transitive closure of the rules given in Figure 1.

The different syntactic categories can be understood as the different levels of alternation in a context-free abstract machine (see [?]): the priority is first given to contexts at level e (lazy storage of terms), then to terms at level t (evaluation of μα into values), then back to contexts at level E and so on until level v. These different categories are directly reflected in the definition of the abstract machine defined in [?], and will thus be involved in the definition of our realizability interpretation. We chose to highlight this by distinguishing different types of sequents already in the typing rules that we shall now present.

\begin{matrix}{(k : X) ∈ S \atop Γ ⊢_{v} k : X} ^{(k)} & {Γ, x : A ⊢_{t} t : B \atop Γ ⊢_{v} λx.t : A → B} ^{(→_{r})} & {(x : A) ∈ Γ \atop Γ ⊢_{V} x : A} ^{(x)} & {Γ ⊢_{v} v : A \atop Γ ⊢_{V} v : A}^{(↑^{V} )} \\ {(κ : A) ∈ S \atop Γ ⊢_{F} κ : A^{⊥ ⊥}} ^{(κ)} & \begin{matrix}Γ ⊢_{t} t : A & Γ ⊢_{E} E : B^{⊥ ⊥} \\ Γ ⊢_{F} t · E : (A → B)^{⊥ ⊥} \end{matrix} ^{(→_{l})} & {(α : A) ∈ Γ \atop Γ ⊢_{E} α : A^{⊥ ⊥}} ^{(α)} \\ {Γ ⊢_{F} F : A^{⊥ ⊥} \atop Γ ⊢_{E} F : A^{⊥ ⊥}} ^{(↑^{E})} & {Γ ⊢_{V} V : A \atop Γ ⊢_{t} V : A}^{(↑^{t})} & {Γ, α : A^{⊥ ⊥} ⊢_{c} c \atop Γ ⊢_{t} μα.c : A}^{(μ)} & {Γ ⊢_{E} E : A^{⊥ ⊥} \atop Γ ⊢_{e} E : A^{⊥ ⊥}} ^{(↑^{e})} \\ {Γ, x : A ⊢_{c} c \atop Γ ⊢_{e} μ̃x.c : A^{⊥ ⊥}} ^{(μ̃)} & \begin{matrix}Γ, x : A, Γ′ ⊢_{F} F : A^{⊥ ⊥} & Γ ⊢_{τ} τ : Γ′ \\ Γ ⊢_{E} μ̃[x].⟨x||F ⟩τ : A^{⊥ ⊥} \end{matrix} ^{(μ̃^{[]})} \\ \begin{matrix}Γ ⊢_{t} t : A & Γ ⊢_{e} e : A^{⊥ ⊥} \\ Γ ⊢_{c} ⟨t||e⟩ \end{matrix}^{(c)} & \begin{matrix}Γ, Γ′ ⊢_{c} c & Γ ⊢_{τ} τ : Γ′ \\ Γ ⊢_{l} cτ \end{matrix} ^{(l)} & Γ ⊢_{τ} ε : ε^{(ε)} \\ \begin{matrix}Γ ⊢_{τ} τ : Γ′ & Γ, Γ′ ⊢_{t} t : A \\ Γ ⊢_{τ} τ[x := t] : Γ′, x : A \end{matrix}^{(τ_{t})} & \begin{matrix}Γ ⊢_{τ} τ : Γ′ & Γ, Γ′ ⊢_{E} E : A^{⊥ ⊥} \\ Γ ⊢_{τ} τ[α := E] : Γ′, α : A^{⊥ ⊥} \end{matrix} ^{(τ_{E})} \end{matrix}

Fig. 2. Typing rules of the \overline{λ}_{[lvτ⋆]}-calculus

1.4 A type system for the \overline{λ}_{[lvτ ⋆]}-calculus.

We have nine kinds of (one-sided) sequents, one for typing each of the nine syntactic categories. We write them with an annotation on the ⊢ sign, using one of the letters v, V, t, F, E, e, l, c, τ. Sequents typing values and terms are asserting a type, with the type written on the right; sequents typing contexts are expecting a type A with the type written A^{⊥ ⊥}; sequents typing commands and closures are black boxes neither asserting nor expecting a type; sequents typing substitutions are instantiating a typing context. In other words, we have the following nine kinds of sequents:

\begin{matrix}Γ ⊢_{l} l \\ Γ ⊢_{c} c \\ Γ ⊢_{τ} τ : Γ′ \end{matrix}  \begin{matrix}Γ ⊢_{t} t : A \\ Γ ⊢_{V} V : A \\ Γ ⊢_{v} v : A \end{matrix}  \begin{matrix}Γ ⊢_{e} e : A^{⊥ ⊥} \\ Γ ⊢_{E} E : A^{⊥ ⊥} \\ Γ ⊢_{F} F : A^{⊥ ⊥} \end{matrix}

where types and typing contexts are defined by:

A, B ::= X | A → B Γ ::= ε | Γ, x : A | Γ, α : A^{⊥ ⊥}

The typing rules are given on Figure 2 where we assume that a variable x (resp. co-variable α) only occurs once in a context Γ (we implicitly assume the possibility of renaming variables by α-conversion). We also adopt the convention that constants k and co-constants κ come with a signature S which assigns them a type. This type system enjoys the property of subject reduction.

Theorem 1 (Subject reduction). If Γ ⊢_{l} cτ and cτ → c′τ′ then Γ ⊢_{l} c′τ′.

Proof. By induction on typing derivations, see Appendix A. ⊓ ⊔

2 Normalization of the \overline{λ}_{[lvτ ⋆]}-calculus

2.1 Normalization by realizability

The proof of normalization for the \overline{λ}_{[lvτ⋆]}-calculus that we present in this section is inspired from techniques of Krivine’s classical realizability [?], whose notations we borrow. Actually, it is also very close to a proof by reducibility^{7}. In a nutshell, to each type A is associated a set |A|_{t} of terms whose execution is guided by the structure of A. These terms are the ones usually called realizers in Krivine’s classical realizability. Their definition is in fact indirect, and is done by orthogonality to a set of “correct” computations, called a pole. The choice of this set is central when studying models induced by classical realizability for secondorder-logic, but in the present case we only pay attention to the particular pole of terminating computations. This is where lies one of the difference with usual proofs by reducibility, where everything is done with respect to SN, while our definition are parametric in the pole (which is chosen to be SN in the end). The adequacy lemma, which is the central piece, consists in proving that typed terms belong to the corresponding sets of realizers, and are thus normalizing.

More in details, our proof can be sketched as follows. First, we generalize the usual notion of closed term to the notion of closed term-in-store. Intuitively, this is due to the fact that we are no longer interested in closed terms and substitutions to close opened terms, but rather in terms that are closed when considered in the current store. This is based on the simple observation that a store is nothing more than a shared substitution whose content might evolve along the execution. Second, we define the notion of pole ⊥⊥, which are sets of closures closed by anti-evaluation and store extension. In particular, the set of normalizing closures is a valid pole. This allows to relate terms and contexts thanks to a notion of orthogonality with respect to the pole. We then define for each formula A and typing level o (of e, t, E, V, F, v) a set |A|_{o} (resp. ∥A∥_{o}) of terms (resp. contexts) in the corresponding syntactic category. These sets correspond to reducibility candidates, or to what is usually called truth values and falsity values in Krivine realizability. Finally, the core of the proof consists in the adequacy lemma, which shows that any closed term of type A at level o is in the corresponding set |A|_{o}. This guarantees that any typed closure is in any pole, and in particular in the pole of normalizing closures. Technically, the proof of adequacy evaluates in each case a state of an abstract machine (in our case a closure), so that the proof also proceeds by evaluation. A more detailed explanation of this observation as well as a more introductory presentation of normalization proofs by classical realizability are given in an article by Dagand and Scherer [?].

2.2 Realizability interpretation for the \overline{λ}_{[lvτ ⋆]}-calculus

We begin by defining some key notions for stores that we shall need further in the proof.

7 See for instance the proof of normalization for system D presented in [?, 3.2].

Definition 2 (Closed store). We extend the notion of free variable to stores:

\begin{matrix}F V (ε) ≜ & ∅ \\ F V (τ[x := t]) ≜ & F V (τ) ∪ \{y ∈ F V (t) : y ∉ dom(τ)\} \\ F V (τ[α := E]) ≜ & F V (τ) ∪ \{β ∈ F V (E) : β ∉ dom(τ)\} \end{matrix}

so that we can define a closed store to be a store τ such that F V (τ) = ∅. Definition 3 (Compatible stores). We say that two stores τ and τ′ are independent and write τ # τ′ when dom(τ) ∩ dom(τ′) = ∅. We say that they are compatible and write τ ⋄ τ′ whenever for all variables x (resp. co-variables α) present in both stores: x ∈ dom(τ) ∩ dom(τ′); the corresponding terms (resp. contexts) in τ and τ′ coincide. Finally, we say that τ′ is an extension of τ and write τ ◁ τ′ whenever dom(τ) ⊆ dom(τ′) and τ ⋄ τ′.

We denote by \overline{ττ′} the compatible union join(τ, τ′) of closed stores τ and τ′, defined by:

join(τ_{0}[x := t]τ_{1}, τ′_{0}[x := t]τ′_{1}) ≜ τ_{0}τ′_{0}[x := t]join(τ_{1}, τ′_{1})
join(τ, τ′) ≜ ττ′
join(ε, τ) ≜ τ
join(τ, ε) ≜ τ

\begin{matrix}(if τ_{0} # τ′_{0}) \\ (if τ # τ′) \end{matrix}

The following lemma (which follows easily from the previous definition) states the main property we will use about union of compatible stores.

Lemma 4. If τ and τ′ are two compatible stores, then τ ◁ \overline{ττ′} and τ′ ◁ \overline{ττ′}. Besides, if τ is of the form τ_{0}[x := t]τ_{1}, then \overline{ττ′} is of the form τ_{2}[x := t]τ_{3} with τ_{0} ◁ τ_{2} and τ_{1} ◁ τ_{3}.

Proof. This follows easily from the previous definition. ⊓ ⊔

As we explained in the introduction of this section, we will not consider closed terms in the usual sense. Indeed, while it is frequent in the proofs of normalization (e.g. by realizability or reducibility) of a calculus to consider only closed terms and to perform substitutions to maintain the closure of terms, this only makes sense if it corresponds to the computational behavior of the calculus. For instance, to prove the normalization of λx.t in typed call-by-name λμμ̃-calculus, one would consider a substitution ρ that is suitable for with respect to the typing context Γ, then a context u · e of type A → B, and evaluates :

⟨λx.t_{ρ}||u · e⟩ → ⟨t_{ρ}[u/x]||e⟩

Then we would observe that t_{ρ}[u/x] = t_{ρ[x:=u]} and deduce that ρ[x := u] is suitable for Γ, x : A, which would allow us to conclude by induction.

However, in the \overline{λ}_{[lvτ⋆]}-calculus we do not perform global substitution when reducing a command, but rather add a new binding [x := u] in the store:

⟨λx.t||u · E⟩τ → ⟨t||E⟩τ[x := u]

Therefore, the natural notion of closed term invokes the closure under a store, which might evolve during the rest of the execution (this is to contrast with a substitution).

Definition 5 (Term-in-store). We call closed term-in-store (resp. closed contextin-store, closed closures) the combination of a term t (resp. context e, command c) with a closed store τ such that F V (t) ⊆ dom(τ). We use the notation (t|τ) (resp. (e|τ), (c|τ)) to denote such a pair.

We should note that in particular, if t is a closed term, then (t|τ) is a term-in-store for any closed store τ. The notion of closed term-in-store is thus a generalization of the notion of closed terms, and we will (ab)use of this terminology in the sequel. We denote the sets of closed closures by C_{0}, and will identify (c|τ) and the closure cτ when c is closed in τ. Observe that if cτ is a closure in C_{0} and τ′ is a store extending τ, then cτ′ is also in C_{0}. We are now equipped to define the notion of pole, and verify that the set of normalizing closures is indeed a valid pole.

Definition 6 (Pole). A subset ⊥⊥ ⊆ C_{0} is said to be saturated or closed by anti-reduction whenever for all (c|τ), (c′|τ′) ∈ C_{0}, if c′τ′ ∈ ⊥⊥ and cτ → c′τ′ then cτ ∈ ⊥⊥. It is said to be closed by store extension if whenever cτ ∈ ⊥⊥, for any store τ′ extending τ: τ ◁ τ′, cτ′ ∈ ⊥⊥. A pole is defined as any subset of C_{0} that is closed by anti-reduction and store extension.

The following proposition is the one supporting the claim that our realizability proof is almost a reducibility proof whose definitions have been generalized with respect to a pole instead of the fixed set SN.

Proposition 7. The set ⊥⊥_{⇓} = {cτ ∈ C_{0} : cτ normalizes } is a pole.

Proof. As we only considered closures in C_{0}, both conditions (closure by antireduction and store extension) are clearly satisfied:

– if cτ → c′τ′ and c′τ′ normalizes, then cτ normalizes too;

– if c is closed in τ and cτ normalizes, if τ ◁ τ′ then cτ′ will reduce as cτ does (since c is closed under τ, it can only use terms in τ′ that already were in τ) and thus will normalize. ⊓ ⊔

Definition 8 (Orthogonality). Given a pole ⊥⊥, we say that a term-in-store (t|τ) is orthogonal to a context-in-store (e|τ′) and write (t|τ)⊥⊥(e|τ′) if τ and τ′ are compatible and ⟨t||e⟩\overline{ττ′} ∈ ⊥⊥.

Remark 9. The reader familiar with Krivine’s forcing machine [?] might recognize his definition of orthogonality between terms of the shape (t, p) and stacks of the shape (π, q), where p and q are forcing conditions^{8}:

(t, p)⊥⊥(π, q) ⇔ (t ⋆ π, p ∧ q) ∈ ⊥⊥

8 The meet of forcing conditions is indeed a refinement containing somewhat the “union” of information contained in each, just like the union of two compatible stores.

We can now relate closed terms and contexts by orthogonality with respect to a given pole. This allows us to define for any formula A the sets |A|_{v}, |A|_{V} , |A|_{t} (resp. ∥A∥_{F},∥A∥_{E}, ∥A∥_{e}) of realizers (or reducibility candidates) at level v, V, t (resp. F, E, e) for the formula A. It is to be observed that realizers are here closed terms-in-store.

Definition 10 (Realizers). Given a fixed pole ⊥⊥, we set:

\begin{aligned}|X|_{v} & = & \{(k|τ) : ⊢ k : X\} \\ |A → B|_{v} & = & \{(λx.t|τ) : ∀uτ′, τ ⋄ τ′ ∧ (u|τ′) ∈ |A|_{t} ⇒ (t|\overline{ττ′}[x := u]) ∈ |B|_{t}\} \\ ∥A∥_{F} & = & \{(F |τ) : ∀vτ′, τ ⋄ τ′ ∧ (v|τ′) ∈ |A|_{v} ⇒ (v|τ′)⊥⊥(F |τ)\} \\ |A|_{V} & = & \{(V |τ) : ∀F τ′, τ ⋄ τ′ ∧ (F |τ′) ∈ ∥A∥_{F} ⇒ (V |τ)⊥⊥(F |τ′)\} \\ ∥A∥_{E} & = & \{(E|τ) : ∀V τ′, τ ⋄ τ′ ∧ (V |τ′) ∈ |A|_{V} ⇒ (V |τ′)⊥⊥(E|τ)\} \\ |A|_{t} & = & \{(t|τ) : ∀Eτ′, τ ⋄ τ′ ∧ (E|τ′) ∈ ∥A∥_{E} ⇒ (t|τ)⊥⊥(E|τ′)\} \\ ∥A∥_{e} & = & \{(e|τ) : ∀tτ′, τ ⋄ τ′ ∧ (t|τ′) ∈ |A|_{t} ⇒ (t|τ′)⊥⊥(e|τ)\} \end{aligned}

Remark 11. We draw the reader attention to the fact that we should actually write |A|_{v}^{⊥ ⊥}, ∥A∥_{F}^{⊥ ⊥}, etc... and τ ⊩_{⊥ ⊥} Γ, because the corresponding definitions are parameterized by a pole ⊥⊥. As it is common in Krivine’s classical realizability, we ease the notations by removing the annotation ⊥⊥ whenever there is no ambiguity on the pole. Besides, it is worth noting that if co-constants do not occur directly in the definitions, they may still appear in the realizers by mean of the pole.

If the definition of the different sets might seem complex at first sight, we claim that they are quite natural in regards of the methodology of Danvy’s semantics artifacts presented in [?]. Indeed, having an abstract machine in contextfree form (the last step in this methodology before deriving the CPS) allows us to have both the term and the context (in a command) that behave independently of each other. Intuitively, a realizer at a given level is precisely a term which is going to behave well (be in the pole) in front of any opponent chosen in the previous level (in the hierarchy v, F, V,etc...). For instance, in a call-by-value setting, there are only three levels of definition (values, contexts and terms) in the interpretation, because the abstract machine in context-free form also has three. Here the ground level corresponds to strong values, and the other levels are somewhat defined as terms (or context) which are well-behaved in front of any opponent in the previous one. The definition of the different sets |A|_{v}, ∥A∥_{F} , |A|_{V}, etc... directly stems from this intuition.

In comparison with the usual definition of Krivine’s classical realizability, we only considered orthogonal sets restricted to some syntactical subcategories. However, the definition still satisfies the usual monotonicity properties of biorthogonal sets:

Proposition 12. For any type A and any given pole ⊥⊥, we have:

1. |A|_{v} ⊆ |A|_{V} ⊆ |A|_{t};  2. ∥A∥_{F} ⊆ ∥A∥_{E} ⊆ ∥A∥_{e}.

Proof. All the inclusions are proved in a similar way. We only give the proof for |A|_{v} ⊆ |A|_{V}. Let ⊥⊥ be a pole and (v|τ) be in |A|_{v}. We want to show that (v|τ) is in |A|_{V}, that is to say that v is in the syntactic category V (which is true), and that for any (F |τ′) ∈ ∥A∥_{F} such that τ ⋄ τ′, (v|τ)⊥⊥(F |τ′). The latter holds by definition of (F |τ′) ∈ ∥A∥_{F}, since (v|τ) ∈ |A|_{v}. ⊓ ⊔

We now extend the notion of realizers to stores, by stating that a store τ realizes a context Γ if it binds all the variables x and α in Γ to a realizer of the corresponding formula.

Definition 13. Given a closed store τ and a fixed pole ⊥⊥, we say that τ realizes Γ, which we write^{9} τ ⊩ Γ, if:

1. for any (x : A) ∈ Γ, τ ≡ τ_{0}[x := t]τ_{1} and (t|τ_{0}) ∈ |A|_{t}

2. for any (α : A^{⊥ ⊥}) ∈ Γ, τ ≡ τ_{0}[α := E]τ_{1} and (E|τ_{0}) ∈ ∥A∥_{E}

In the same way than weakening rules (for the typing context) are admissible for each level of the typing system :

\begin{matrix}Γ ⊢_{t} t : A & Γ ⊆ Γ′ \\ Γ′ ⊢_{t} t : A \end{matrix}  \begin{matrix}Γ ⊢_{e} e : A^{⊥ ⊥} & Γ ⊆ Γ′ \\ Γ′ ⊢_{e} e : A^{⊥ ⊥} \end{matrix} … \begin{matrix}Γ ⊢_{τ} τ : Γ′′ & Γ ⊆ Γ′ \\ Γ′ ⊢_{τ} τ : Γ′′ \end{matrix}

the definition of realizers is compatible with a weakening of the store.

Lemma 14 (Store weakening). Let τ and τ′ be two stores such that τ ◁ τ′, let Γ be a typing context and let ⊥⊥ be a pole. The following statements hold:

1. \overline{ττ′} = τ′

2. If (t|τ) ∈ |A|_{t} for some closed term (t|τ) and type A, then (t|τ′) ∈ |A|_{t}. The same holds for each level e, E, V, F, v of the typing rules.

3. If τ ⊩ Γ then τ′ ⊩ Γ.

Proof. 1. Straightforward from the definition of τ̄τ′.

2. This essentially amounts to the following observations. First, one remarks that if (t|τ) is a closed term, so then so is (t|\overline{ττ′}) for any closed store τ′ compatible with τ. Second, we observe that if we consider for instance a closed context (E|τ′′) ∈ ∥A∥_{E}, then \overline{ττ′} ⋄ τ′′ implies τ ⋄ τ′′, thus (t|τ)⊥⊥(E|τ′′) and finally (t|\overline{ττ′})⊥⊥(E|τ′′) by closure of the pole under store extension. We conclude that (t|τ′)⊥⊥(E|τ′′) using the first statement.

3. By definition, for all (x : A) ∈ Γ, τ is of the form τ_{0}[x := t]τ_{1} such that (t|τ_{0}) ∈ |A|_{t}. As τ and τ′ are compatible, we know by Lemma 4 that \overline{ττ′} is of the form τ′_{0}[x := t]τ′_{1} with τ′_{0} an extension of τ_{0}, and using the first point we get that (t|τ′_{0}) ∈ |A|_{t}. ⊓ ⊔

Definition 15 (Adequacy). Given a fixed pole ⊥⊥, we say that:

– A typing judgment Γ ⊢_{t} t : A is adequate (w.r.t. the pole ⊥⊥) if for all stores τ ⊩ Γ, we have (t|τ) ∈ |A|_{t}.

9 Once again, we should formally write τ ⊩_{⊥ ⊥} Γ but we will omit the annotation by ⊥ ⊥ as often as possible.

– More generally, we say that an inference rule

\begin{aligned}J_{1} & ⋯ & J_{n} \\ & J_{0} \end{aligned}

is adequate (w.r.t. the pole ⊥⊥) if the adequacy of all typing judgments J_{1}, …, J_{n} implies the adequacy of the typing judgment J_{0}.

Remark 16. From the latter definition, it is clear that a typing judgment that is derivable from a set of adequate inference rules is adequate too.

We will now show the main result of this section, namely that the typing rules of Figure 2 for the \overline{λ}_{[lvτ⋆]}-calculus without co-constants are adequate with any pole. Observe that this result requires to consider the \overline{λ}_{[lvτ⋆]}-calculus without co-constants. Indeed, we consider co-constants as coming with their typing rules, potentially giving them any type (whereas constants can only be given an atomic type). Thus, there is a priori no reason^{10} why their types should be adequate with any pole.

However, as observed in the previous remark, given a fixed pole it suffices to check whether the typing rules for a given co-constant are adequate with this pole. If they are, any judgment that is derivable using these rules will be adequate.

Theorem 17 (Adequacy). If Γ is a typing context, ⊥⊥ is a pole and τ is a store such that τ ⊩ Γ, then the following holds in the \overline{λ}_{[lvτ⋆]}-calculus without co-constants:

1. If v is a strong value such that Γ ⊢_{v} v : A, then (v|τ) ∈ |A|_{v}.

2. If F is a forcing context such that Γ ⊢_{F} F : A^{⊥ ⊥}, then (F |τ) ∈ ∥A∥_{F}.

3. If V is a weak value such that Γ ⊢_{V} V : A, then (V |τ) ∈ |A|_{V}.

4. If E is a catchable context such that Γ ⊢_{E} E : A^{⊥ ⊥}, then (E|τ) ∈ ∥A∥_{F}.

5. If t is a term such that Γ ⊢_{t} t : A, then (t|τ) ∈ |A|_{t}.

6. If e is a context such that Γ ⊢_{e} e : A^{⊥ ⊥}, then (e|τ) ∈ ∥A∥_{e}.

7. If c is a command such that Γ ⊢_{c} c, then cτ ∈ ⊥⊥.

8. If τ′ is a store such that Γ ⊢_{τ} τ′ : Γ′, then ττ′ ⊩ Γ, Γ′.

Proof. The different statements are proved by mutual induction over typing derivations. We only give the most important cases here, the exhaustive induction is given in Appendix B.

Rule (→_{l}). Assume that

\begin{matrix}Γ ⊢_{t} u : A & Γ ⊢_{E} E : B^{⊥ ⊥} \\ Γ ⊢_{F} u · E : (A → B)^{⊥ ⊥} \end{matrix} ^{(→_{l})}

10 Think for instance of a co-constant of type (A → B)^{⊥ ⊥}, there is no reason why it

should be orthogonal to any function in |A → B|_{v}.

and let ⊥⊥ be a pole and τ a store such that τ ⊩ Γ. Let (λx.t|τ′) be a closed term in the set |A → B|_{v} such that τ ⋄ τ′, then we have:

⟨λx.t||u · E⟩\overline{ττ′} → ⟨u||μ̃x.⟨t||E⟩⟩\overline{ττ′} → ⟨t||E⟩\overline{ττ′}[x := u]

By definition of |A → B|_{v}, this closure is in the pole, and we can conclude by anti-reduction.

Rule (x). Assume that

{(x : A) ∈ Γ \atop Γ ⊢_{V} x : A} ^{(x)}

and let ⊥⊥ be a pole and τ a store such that τ ⊩ Γ. As (x : A) ∈ Γ, we know that τ is of the form τ_{0}[x := t]τ_{1} with (t|τ_{0}) ∈ |A|_{t}. Let (F |τ′) be in ∥A∥_{F}, with τ ⋄ τ′. By Lemma 4, we know that \overline{ττ′} is of the form \overline{τ_{0}}[x := t]\overline{τ_{1}}. Hence we have:

⟨x||F ⟩\overline{τ_{0}}[x := t]\overline{τ_{1}} → ⟨t||μ̃[x].⟨x||F ⟩\overline{τ_{1}}⟩\overline{τ_{0}}

and it suffices by anti-reduction to show that the last closure is in the pole ⊥⊥. By induction hypothesis, we know that (t|τ_{0}) ∈ |A|_{t} thus we only need to show that it is in front of a catchable context in ∥A∥_{E}. This corresponds exactly to the next case that we shall prove now.

Rule (μ̃^{[]}). Assume that

\begin{matrix}Γ, x : A, Γ′ ⊢_{F} F : A & Γ, x : A ⊢ τ′ : Γ′ \\ Γ ⊢_{E} μ̃[x].⟨x||F ⟩τ′ : A \end{matrix} ^{(μ̃^{[]})}

and let ⊥⊥ be a pole and τ a store such that τ ⊩ Γ. Let (V |τ_{0}) be a closed term in |A|_{V} such that τ_{0} ⋄ τ. We have that :

⟨V ||μ̃[x].⟨x||F ⟩\overline{τ′}⟩\overline{τ_{0}τ} → ⟨V ||F ⟩\overline{τ_{0}τ}[x := V]τ′

By induction hypothesis, we obtain τ[x := V]τ′ ⊩ Γ, x : A, Γ′. Up to αconversion in F and τ′, so that the variables in τ′ are disjoint from those in τ_{0}, we have that \overline{τ_{0}τ} ⊩ Γ (by Lemma 14) and then τ′′ ≜ \overline{τ_{0}τ}[x := V]τ′ ⊩ Γ, x : A, Γ′. By induction hypothesis again, we obtain that (F |τ′′) ∈ ∥A∥_{F} (this was an assumption in the previous case) and as (V |τ_{0}) ∈ |A|_{V}, we finally get that (V |τ_{0})⊥⊥(F |τ′′) and conclude again by anti-reduction. ⊓ ⊔

Corollary 18. If cτ is a closure such that ⊢_{l} cτ is derivable, then for any pole ⊥⊥ such that the typing rules for co-constants used in the derivation are adequate with ⊥⊥, cτ ∈ ⊥⊥.

We can now put our focus back on the normalization of typed closures. As we already saw in Proposition 7, the set ⊥⊥_{⇓} of normalizing closure is a valid pole, so that it only remains to prove that any typing rule for co-constants is adequate with ⊥⊥_{⇓}.

Lemma 19. Any typing rule for co-constants is adequate with the pole ⊥⊥_{⇓}, i.e. if Γ is a typing context, and τ is a store such that τ ⊩ Γ, if κ is a co-constant such that Γ ⊢_{F} κ : A^{⊥ ⊥}, then (κ|τ) ∈ ∥A∥_{F}.

Proof. This lemma directly stems from the observation that for any store τ and any closed strong value (v|τ′) ∈ |A|_{v}, ⟨v||κ⟩\overline{ττ′} does not reduce and thus belongs to the pole ⊥⊥_{⇓}.

As a consequence, we obtain the normalization of typed closures of the full calculus.

Theorem 20. If cτ is a closure of the \overline{λ}_{[lvτ⋆]}-calculus such that ⊢_{l} cτ is derivable, then cτ normalizes.

This is to be contrasted with Okasaki, Lee and Tarditi’s semantics for the call-by-need λ-calculus, which is not normalizing in the simply-typed case, as shown in Ariola et al. [?].

2.3 Extension to 2^{nd}-order type systems

We focused in this article on simply-typed versions of the \overline{λ}_{lv} and \overline{λ}_{[lvτ⋆]} calculi. But as it is common in Krivine classical realizability, first and second-order quantifications (in Curry style) come for free through the interpretation. This means that we can for instance extend the language of types to first and secondorder predicate logic:

\begin{aligned}e_{1}, e_{2} & ::= & x | f(e_{1}, …, e_{k}) \\ A, B & ::= & X(e_{1}, …, e_{k}) | A → B | ∀x.A | ∀X.A \end{aligned}

We can then define the following introduction rules for universal quantifications:

\begin{matrix}Γ ⊢_{v} v : A & x ∉ F V (Γ) \\ Γ ⊢_{v} v : ∀x.A \end{matrix} ^{(∀_{r}^{1})}  \begin{matrix}Γ ⊢_{v} v : A & X ∉ F V (Γ) \\ Γ ⊢_{v} v : ∀X.A \end{matrix} ^{(∀_{r}^{2})}

Observe that these rules need to be restricted at the level of strong values, just as they are restricted to values in the case of call-by-value^{11}. As for the left rules, they can be defined at any levels, let say the more general e:

{Γ ⊢_{e} e : (A[n/x])^{⊥ ⊥} \atop Γ ⊢_{e} e : (∀x.A)^{⊥ ⊥}} ^{(∀_{l}^{1})}  {Γ ⊢_{e} e : (A[B/X])^{⊥ ⊥} \atop Γ ⊢_{e} e : (∀X.A)^{⊥ ⊥}} ^{(∀_{l}^{2})}

where n is any natural number and B any formula. The usual (call-by-value) interpretation of the quantification is defined as an intersection over all the possible instantiations of the variables within the model. We do not wish to

11 For further explanation on the need for a value restriction in Krivine realizability, we refer the reader to [?] or [?].

enter into too many details^{12} on this topic here, but first-order variable are to be instantiated by integers, while second order are to be instantiated by subset of terms at the lower level, i.e. closed strong-values in store (which we write V_{0}):

|∀x.A|_{v} = ⋂_{n∈ℕ} |A[n/x]|_{v}  |∀X.A|_{v} = ⋂_{S∈ℕ^{k}→P(V_{0})} |A[S/X]|_{v}

where the variable X is of arity k. It is then routine to check that the typing rules are adequate with the realizability interpretation.

3 Conclusion and further work

In this paper, we presented a system of simple types for a call-by-need calculus with control, which we proved to be safe in that it satisfies subject reduction (Theorem 1) and that typed terms are normalizing (Theorem 20). We proved the normalization by means of realizability-inspired interpretation of the \overline{λ}_{[lvτ⋆]}- calculus. Incidentally, this opens the doors to the computational analysis (in the spirit of Krivine realizability) of classical proofs using control, laziness and shared memory.

In further work, we intend to present two extensions of the present paper. First, following the definition of the realizability interpretation, we managed to type the continuation-and-store passing style translation for the \overline{λ}_{[lvτ⋆]}-calculus (see [?]). Interestingly, typing the translation emphasizes its computational content, and in particular, the store-passing part is reflected in a Kripke forcing-like manner of typing the extensibility of the store [?, Chapter 6].

Second, on a different aspect, the realizability interpretation we introduced could be a first step towards new ways of realizing axioms. In particular, the first author used in his Ph.D. thesis [?, Chapter 8] the techniques presented in this paper to give a normalization proof for dPA^{ω}, a proof system developed by the second author [?]. Indeed, this proof system allows to define a proof for the axiom of dependent choice thanks to the use of streams that are lazily evaluated, and was lacking a proper normalization proof.

Finally, to determine the range of our technique, it would be natural to investigate the relation between our framework and the many different presentations of call-by-need calculi (with or without control). Amongst other calculi, we could cite Chang-Felleisen presentation of call-by-need [?], Garcia et al. lazy calculus with delimited control [?] or Kesner’s recent paper on normalizing by-need terms characterized by an intersection type system [?]. To this end, we might rely on Pédrot and Saurin’s classical by-need [?]. They indeed relate (classical) call-by-need with linear head-reduction from a computational point of view, and draw the connections with the presentations of Ariola et al. [?] and Chang-Felleisen [?]. Ariola et al. \overline{λ}_{lv}-calculus being close to the \overline{λ}_{[lvτ⋆]}-calculus (see [?] for further details), our technique is likely to be adaptable to their framework, and thus to Pédrot and Saurin’s system.

12 Once again, we advise the interested reader to refer to [?] or [?] for further details.

References

1. Zena Ariola and Matthias Felleisen. The call-by-need lambda calculus. J. Funct. Program., 7(3):265–301, 1993.

2. Zena M. Ariola, Paul Downen, Hugo Herbelin, Keiko Nakata, and Alexis Saurin. Classical call-by-need sequent calculi: The unity of semantic artifacts. In Tom Schrijvers and Peter Thiemann, editors, Proceedings of FLOPS’12, Kobe, Japan, May 23-25, 2012. Proceedings, LNCS, pages 32–46. Springer, 2012.

3. Franco Barbanera and Stefano Berardi. A symmetric λ-calculus for classical program extraction. Information and Computation, 125(2):103–117, 1996.

4. Stephen Chang and Matthias Felleisen. The call-by-need lambda calculus, revisited. In Programming Languages and Systems - 21st European Symposium on Programming, ESOP 2012, Held as Part of the European Joint Conferences on Theory and Practice of Software, ETAPS 2012, Tallinn, Estonia, March 24 - April 1, 2012. Proceedings, pages 128–147, 2012.

5. Tristan Crolard. A confluent lambda-calculus with a catch/throw mechanism. J. Funct. Program., 9(6):625–647, 1999.

6. Pierre-Louis Curien and Hugo Herbelin. The duality of computation. In Proceedings of ICFP 2000, SIGPLAN Notices 35(9), pages 233–243. ACM, 2000.

7. Pierre-Évariste Dagand and Gabriel Scherer. Normalization by realizability also evaluates. In David Baelde and Jade Alglave, editors, Proceedings of JFLA’15, Le Val d’Ajol, France, January 2015.

8. Matthias Felleisen, Daniel P. Friedman, Eugene E. Kohlbecker, and Bruce F. Duba. Reasoning with continuations. In Proceedings of LICS’86, Cambridge, Massachusetts, USA, June 16-18, 1986, pages 131–141. IEEE Computer Society, 1986.

9. Jean Gallier. On girard’s ’candidats de reductibilité.’. In Odifreddi, editor, Logic and Computer Science, pages 123–203. Academic Press, 1900.

10. Ronald Garcia, Andrew Lumsdaine, and Amr Sabry. Lazy evaluation and delimited control. Logical Methods in Computer Science, Volume 6, Issue 3, July 2010.

11. Jean-Yves Girard. Une extension de Ľinterpretation de gödel a Ľanalyse, et son application a Ľelimination des coupures dans Ľanalyse et la theorie des types. In J.E. Fenstad, editor, Proceedings of the Second Scandinavian Logic Symposium, volume 63 of Studies in Logic and the Foundations of Mathematics, pages 63 – 92. Elsevier, 1971.

12. Mauricio Guillermo and Alexandre Miquel. Specifying peirce’s law in classical realizability. Mathematical Structures in Computer Science, 26(7):1269–1303, 2016.

13. Mauricio Guillermo and Étienne Miquey. Classical realizability and arithmetical formulæ. Mathematical Structures in Computer Science, page 1–40, 2016.

14. Hugo Herbelin. C’est maintenant qu’on calcule: au cœur de la dualité. Habilitation thesis, University Paris 11, December 2005.

15. Hugo Herbelin. A constructive proof of dependent choice, compatible with classical logic. In Proceedings of the 27th Annual IEEE Symposium on Logic in Computer Science, LICS 2012, Dubrovnik, Croatia, June 25-28, 2012, pages 365–374. IEEE Computer Society, 2012.

16. Delia Kesner. Reasoning About Call-by-need by Means of Types, pages 424–441. Springer Berlin Heidelberg, Berlin, Heidelberg, 2016.

17. Jean-Louis Krivine. Lambda-calculus, types and models. Ellis Horwood series in computers and their applications. Masson, 1993.

18. Jean-Louis Krivine. Dependent choice, ‘quote’ and the clock. Th. Comp. Sc., 308:259–276, 2003.

19. Jean-Louis Krivine. Realizability in classical logic. In interactive models of computation and program behaviour. Panoramas et synthèses, 27, 2009.

20. Jean-Louis Krivine. Realizability algebras: a program to well order r. Logical Methods in Computer Science, 7(3), 2011.

21. Jean-Louis Krivine. Realizability algebras II : new models of ZF + DC. Logical Methods in Computer Science, 8(1):10, February 2012. 28 p.

22. Jean-Louis Krivine. On the structure of classical realizability models of ZF, 2014.

23. Yves Lafont, Bernhard Reus, and Thomas Streicher. Continuations semantics or expressing implication by negation. Technical Report 9321, Ludwig-Maximilians-Universität, München, 1993.

24. Frédéric Lang. Explaining the lazy krivine machine using explicit substitution and addresses. Higher-Order and Symbolic Computation, 20(3):257–270, Sep 2007.

25. Rodolphe Lepigre. A classical realizability model for a semantical value restriction. In Peter Thiemann, editor, Programming Languages and Systems - 25th European Symposium on Programming, ESOP 2016, Held as Part of the European Joint Conferences on Theory and Practice of Software, ETAPS 2016, Eindhoven, The Netherlands, April 2-8, 2016, Proceedings, volume 9632 of Lecture Notes in Computer Science, pages 476–502. Springer, 2016.

26. John Maraist, Martin Odersky, and Philip Wadler. The call-by-need lambda calculus. J. Funct. Program., 8(3):275–317, 1998.

27. Alexandre Miquel. Existential witness extraction in classical realizability and via a negative translation. Logical Methods in Computer Science, 7(2):188–202, 2011.

28. Étienne Miquey. Classical realizability and side-effects. PhD thesis, Université Paris-Diderot, Universidad de la República (Uruguay), 2017.

29. Guillaume Munch-Maccagnoni. Focalisation and Classical Realisability. In Erich Grädel and Reinhard Kahle, editors, Computer Science Logic ’09, volume 5771 of Lecture Notes in Computer Science, pages 409–423. Springer, Heidelberg, 2009.

30. Chris Okasaki, Peter Lee, and David Tarditi. Call-by-need and continuationpassing style. Lisp and Symbolic Computation, 7(1):57–82, 1994.

31. Michel Parigot. Free deduction: An analysis of ”computations” in classical logic. In Andrei Voronkov, editor, Proceedings of LPAR, volume 592 of LNCS, pages 361–380. Springer, 1991.

32. Michel Parigot. Strong normalization of second order symmetric lambda-calculus. In Sanjiv Kapoor and Sanjiva Prasad, editors, Foundations of Software Technology and Theoretical Computer Science, 20th Conference, FST TCS 2000 New Delhi, India, December 13-15, 2000, Proceedings, volume 1974 of LNCS, pages 442–453. Springer, 2000.

33. Pierre-Marie Pédrot and Alexis Saurin. Classical by-need. In Peter Thiemann, editor, Programming Languages and Systems: 25th European Symposium on Programming, ESOP 2016, Proceedings, pages 616–643. Springer Berlin Heidelberg, 2016.

34. Gordon D. Plotkin. Call-by-name, call-by-value and the lambda-calculus. Theor. Comput. Sci., 1(2):125–159, 1975.

35. Emmanuel Polonowski. Strong normalization of lambda-mu-mu/tilde-calculus with explicit substitutions. In Igor Walukiewicz, editor, Foundations of Software Science and Computation Structures, 7th International Conference, FOSSACS 2004, Held as Part of the Joint European Conferences on Theory and Practice of Software, ETAPS 2004, Barcelona, Spain, March 29 - April 2, 2004, Proceedings, volume 2987 of Lecture Notes in Computer Science, pages 423–437. Springer, 2004.

36. William. W. Tait. Intensional interpretations of functionals of finite type i. Journal of Symbolic Logic, 32(2):198–212, 1967.

A Subject reduction of the \overline{λ}_{[lvτ ⋆]}-calculus

We present in this section the proof of subject reduction for the \overline{λ}_{[lvτ⋆]}-calculus (Section 1). The proof is done by reasoning by induction over the typing derivation, and relies on the fact that the type system admits a weakening rule.

Lemma 21. The following rule is admissible for any level o of the hierarchy e, t, E, V, F, v, c, l, τ:

\begin{matrix}Γ ⊢_{o} o : A & Γ ⊆ Γ′ \\ Γ′ ⊢_{o} o : A \end{matrix}

Proof. Easy induction on typing derivations using the typing rules given in Figure 2.

Theorem 1. If Γ ⊢_{l} cτ and cτ → c′τ′ then Γ ⊢_{l} c′τ′.

Proof. By induction over the reduction rules of the \overline{λ}_{[lvτ⋆]}-calculus (see Figure 1). Case ⟨t||μ̃x.c⟩τ → cτ[x := t]. A typing derivation of the closure on the left-hand side is of the form:

\begin{aligned}{Π_{t} \atop Γ, Γ′ ⊢_{t} t : A} & {Π_{c} \atop Γ, Γ′, x : A ⊢_{c} c} ; Γ, Γ′ ⊢_{e} μ̃x.c : A & {Π_{τ} \atop Γ ⊢_{τ} τ : Γ′} \\ & Γ, Γ′ ⊢_{c} ⟨t||μ̃x.c⟩ \end{aligned} ; Γ ⊢_{l} ⟨t||μ̃x.c⟩τ

hence we can derive:

\begin{matrix}{Π_{c} \atop Γ, Γ′, x : A ⊢_{c} c} & \begin{matrix}{Π_{τ} \atop Γ ⊢_{τ} τ : Γ′} & {Π_{t} \atop Γ, Γ′ ⊢_{t} t : A} \\ Γ ⊢_{τ} τ[x := t] : (Γ′, x : A) \end{matrix} \\ Γ ⊢_{l} cτ[x := t] \end{matrix}

Case ⟨μα.c||E⟩τ → cτ[α := E]. A typing derivation of the closure on the lefthand side is of the form:

\begin{matrix}\begin{matrix}{Π_{c} \atop Γ, Γ′, α : A^{⊥ ⊥} ⊢_{c} c} ; Γ, Γ′ ⊢_{t} μα.c : A & {Π_{E} \atop Γ, Γ′ ⊢_{E} E : A^{⊥ ⊥}} ; Γ, Γ′ ⊢_{e} E : A^{⊥ ⊥} \\ Γ, Γ′ ⊢_{c} ⟨μα.c||E⟩ \end{matrix} & {Π_{τ} \atop Γ ⊢_{τ} τ : Γ′} \\ Γ ⊢_{l} ⟨t||μ̃x.c⟩τ \end{matrix}

hence we can derive:

\begin{matrix}{Π_{c} \atop Γ, Γ′, α : A^{⊥ ⊥} ⊢_{c} c} & \begin{matrix}{Π_{τ} \atop Γ ⊢_{τ} τ : Γ′} & {Π_{E} \atop Γ, Γ′ ⊢_{E} E : A} \\ Γ ⊢_{τ} τ[α := E] : (Γ′, α : A^{⊥ ⊥}) \end{matrix} \\ Γ ⊢_{l} cτ[α := E] \end{matrix}

Case ⟨V ||α⟩τ[α := E]τ′ → ⟨V ||E⟩τ[α := E]τ′. A typing derivation of the closure on the left-hand side is of the form:

\begin{matrix}\begin{matrix}{Π_{V} \atop Γ, Γ_{0}, α : A^{⊥ ⊥}, Γ_{1} ⊢_{t} V : A} & {Γ, Γ_{0}, α : A^{⊥ ⊥}, Γ_{1} ⊢_{F} α : A^{⊥ ⊥} \atop Γ, Γ_{0}, α : A^{⊥ ⊥}, Γ_{1} ⊢_{E} α : A^{⊥ ⊥}} ; Γ, Γ_{0}, α : A^{⊥ ⊥}, Γ_{1} ⊢_{e} α : A^{⊥ ⊥} \\ Γ, Γ_{0}, α : A^{⊥ ⊥}, Γ_{1} ⊢_{c} ⟨V ||α⟩ \end{matrix} & \begin{matrix}\begin{matrix}{Π_{τ} \atop Γ ⊢ τ : Γ_{0}} & {Π_{E} \atop Γ, Γ_{0} ⊢_{E} E : A^{⊥ ⊥}} \\ Γ ⊢_{τ} τ[α := E] : Γ_{0}, α : A^{⊥ ⊥} \end{matrix} & Π_{τ′} \\ Γ ⊢_{τ} τ[α := E]τ′ : Γ_{0}, α : A^{⊥ ⊥}, Γ_{1} \end{matrix} \\ Γ ⊢_{l} ⟨V ||α⟩τ[α := E]τ′ \end{matrix}

where we cheated to compact each typing judgment for τ′ (corresponding to types in Γ_{1}) in Π_{τ′}. Therefore, we can derive:

\begin{matrix}\begin{matrix}{Π_{V} \atop Γ, Γ_{0}, α : A^{⊥ ⊥}, Γ_{1} ⊢_{t} V : A} & {Π_{E} \atop Γ, Γ_{0}, α : A^{⊥ ⊥}, Γ_{1} ⊢_{E} E : A^{⊥ ⊥}} ; Γ, Γ_{0}, α : A^{⊥ ⊥}, Γ_{1} ⊢_{e} E : A^{⊥ ⊥} \\ Γ, Γ_{0}, α : A^{⊥ ⊥}, Γ_{1} ⊢_{c} ⟨V ||E⟩ \end{matrix} & \begin{matrix}\begin{matrix}{Π_{τ} \atop Γ ⊢ τ : Γ_{0}} & {Π_{E} \atop Γ, Γ_{0} ⊢_{E} E : A^{⊥ ⊥}} \\ Γ ⊢_{τ} τ[α := E] : Γ_{0}, α : A^{⊥ ⊥} \end{matrix} & Π_{τ′} \\ Γ ⊢_{τ} τ[α := E]τ′ : Γ_{0}, α : A^{⊥ ⊥}, Γ_{1} \end{matrix} \\ Γ ⊢_{l} ⟨V ||α⟩τ[α := E]τ′ \end{matrix}

Case ⟨x||F ⟩τ[x := t]τ′ → ⟨t||μ̃[x].⟨x||F ⟩τ′⟩τ. A typing derivation of the closure on the left-hand side is of the form:

\begin{matrix}\begin{matrix}{Γ, Γ_{0}, x : A, Γ_{1} ⊢_{V} x : A \atop Γ, Γ_{0}, x : A, Γ_{1} ⊢_{t} x : A} & {Π_{F} \atop Γ, Γ_{0}, x : A, Γ_{1} ⊢_{e} F : A^{⊥ ⊥}} \\ Γ, Γ_{0}, x : A, Γ_{1} ⊢_{c} ⟨x||F ⟩ \end{matrix} & \begin{matrix}\begin{matrix}{Π_{τ} \atop Γ ⊢ τ : Γ_{0}} & {Π_{t} \atop Γ, Γ_{0} ⊢_{t} t : A} \\ Γ ⊢_{τ} τ[x := t] : Γ_{0}, x : A \end{matrix} & Π_{τ′} \\ Γ ⊢_{τ} τ[x := t]τ′ : Γ_{0}, x : A, Γ_{1} \end{matrix} \\ Γ ⊢_{l} ⟨V ||F ⟩τ[x := t]τ′ \end{matrix}

hence we can derive:

\begin{matrix}{Π_{t} \atop Γ, Γ_{0}, Γ_{1} ⊢_{t} t : A} & \begin{matrix}\begin{matrix}{Γ, Γ_{0}, x : A, Γ_{1} ⊢_{V} x : A \atop Γ, Γ_{0}, x : A, Γ_{1} ⊢_{t} x : A} & {Π_{F} \atop Γ, Γ_{0}, x : A, Γ_{1} ⊢_{e} F : A^{⊥ ⊥}} \\ Γ, Γ_{0}, x : A, Γ_{1} ⊢_{c} ⟨x||F ⟩ \end{matrix} & {Π_{τ′} \atop Γ, Γ_{0}, x : A ⊢_{τ} τ′ : Γ_{1}} \\ Γ, Γ_{0}, x : A ⊢_{l} ⟨x||F ⟩τ′ \end{matrix} ; Γ, Γ_{0} ⊢_{E} μ̃[x].⟨x||F ⟩τ′ : A^{⊥ ⊥} ; Γ, Γ_{0} ⊢_{e} μ̃[x].⟨x||F ⟩τ′ : A^{⊥ ⊥} \\ Γ, Γ_{0} ⊢_{c} ⟨t||μ̃[x].⟨x||F ⟩τ′⟩ \end{matrix} ; {Π_{τ} \atop Γ ⊢ τ : Γ_{0}} ; Γ ⊢_{l} ⟨t||μ̃[x].⟨x||F ⟩τ′⟩τ

Case ⟨V ||μ̃[x].⟨x||F ⟩τ′⟩τ → ⟨V ||F ⟩τ[x := V]τ′. A typing derivation of the closure on the left-hand side is of the form:

\begin{matrix}{Π_{V} \atop Γ, Γ_{0}, Γ_{1} ⊢_{t} V : A} & \begin{matrix}\begin{matrix}{Γ, Γ_{0}, x : A, Γ_{1} ⊢_{V} x : A \atop Γ, Γ_{0}, x : A, Γ_{1} ⊢_{t} x : A} & {Π_{F} \atop Γ, Γ_{0}, x : A, Γ_{1} ⊢_{e} F : A^{⊥ ⊥}} \\ Γ, Γ_{0}, x : A, Γ_{1} ⊢_{c} ⟨x||F ⟩ \end{matrix} & {Π_{τ′} \atop Γ, Γ_{0}, x : A ⊢_{τ} τ′ : Γ_{1}} \\ Γ, Γ_{0}, x : A ⊢_{l} ⟨x||F ⟩τ′ \end{matrix} ; Γ, Γ_{0} ⊢_{E} μ̃[x].⟨x||F ⟩τ′ : A^{⊥ ⊥} ; Γ, Γ_{0} ⊢_{e} μ̃[x].⟨x||F ⟩τ′ : A^{⊥ ⊥} \\ Γ, Γ_{0} ⊢_{c} ⟨V ||μ̃[x].⟨x||F ⟩τ′⟩ \end{matrix} ; {Π_{τ} \atop Γ ⊢ τ : Γ_{0}} ; Γ ⊢_{l} ⟨V ||μ̃[x].⟨x||F ⟩τ′⟩τ

Therefore we can derive:

\begin{matrix}\begin{matrix}{Π_{V} \atop Γ, Γ_{0}, x : A, Γ_{1} ⊢_{t} V : A} & {Π_{F} \atop Γ, Γ_{0}, x : A, Γ_{1} ⊢_{e} F : A^{⊥ ⊥}} \\ Γ, Γ_{0}, x : A, Γ_{1} ⊢_{c} ⟨V ||F ⟩ \end{matrix} & \begin{matrix}\begin{matrix}{Π_{τ} \atop Γ ⊢ τ : Γ_{0}} & {Π_{V} \atop Γ, Γ_{0} ⊢_{t} V : A} \\ Γ ⊢_{τ} τ[x := V] : Γ_{0}, x : A \end{matrix} & Π_{τ′} \\ Γ ⊢_{τ} τ[x := V]τ′ : Γ_{0}, x : A, Γ_{1} \end{matrix} \\ Γ ⊢_{l} ⟨V ||F ⟩τ[x := V]τ′ \end{matrix}

where we implicitly used Lemma 21 to weaken Π_{V}:

\begin{matrix}{Π_{V} \atop Γ, Γ_{0} ⊢_{t} V : A} & Γ, Γ_{0} ⊆ Γ, Γ_{0}, x : A, Γ_{1} \\ Γ, Γ_{0}, x : A, Γ_{1} ⊢_{t} V : A \end{matrix}

Case ⟨λx.t||u · E⟩τ → ⟨u||μ̃x.⟨t||E⟩⟩τ. A typing proof for the closure on the left-hand side is of the form:

\begin{matrix}\begin{matrix}{Π_{t} \atop Γ, Γ′, x : A ⊢_{t} t : B} ; Γ, Γ′ ⊢_{v} λx.t : A → B ; Γ, Γ′ ⊢_{V} λx.t : A → B ; Γ, Γ′ ⊢_{t} λx.t : A → B & \begin{matrix}{Π_{u} \atop Γ, Γ′ ⊢_{t} u : A} & {Π_{E} \atop Γ, Γ′ ⊢_{E} E : B^{⊥ ⊥}} \\ Γ, Γ′ ⊢_{E} u · e : (A → B)^{⊥ ⊥} \end{matrix} ; Γ, Γ′ ⊢_{e} u · e : (A → B)^{⊥ ⊥} \\ Γ, Γ′ ⊢_{c} ⟨λx.t||u · E⟩ \end{matrix} & {Π_{τ} \atop Γ ⊢_{τ} τ : Γ′} \\ Γ ⊢_{l} ⟨λx.t||u · E⟩τ \end{matrix}

We can thus build the following derivation:

\begin{matrix}\begin{aligned}{Π_{u} \atop Γ, Γ′ ⊢_{t} u : A} & \begin{matrix}{Π_{t} \atop Γ, Γ′, x : A ⊢_{t} t : B} & {Π_{E} \atop Γ, Γ′, x : A ⊢_{E} E : B^{⊥ ⊥}} ; Γ, Γ′, x : A ⊢_{e} E : B^{⊥ ⊥} \\ Γ, Γ′, x : A ⊢_{c} ⟨t||E⟩ \end{matrix} ; Γ, Γ′ ⊢_{e} μ̃x.⟨t||E⟩ : A^{⊥ ⊥} \\ & Γ, Γ′ ⊢_{c} ⟨u||μ̃x.⟨t||E⟩⟩ \end{aligned} & {Π_{τ} \atop Γ ⊢_{τ} τ : Γ′} \\ Γ ⊢_{l} ⟨u||μ̃x.⟨t||E⟩⟩τ \end{matrix}

where we implicitly used Lemma 21 to weaken Π_{E}:

\begin{matrix}{Π_{E} \atop Γ, Γ ⊢_{E} E : B^{⊥ ⊥}} & Γ, Γ′ ⊆ Γ, Γ′, x : A \\ Γ, Γ′, x : A ⊢_{E} E : B^{⊥ ⊥} \end{matrix}

B Adequacy lemma

We give here the full proof of the adequacy lemma for the realizability interpretation of the \overline{λ}_{[lvτ⋆]}-calculus.

Theorem 17 (Adequacy). The typing rules of Figure 2 for the \overline{λ}_{[lvτ⋆]}-calculus without co-constants are adequate with any pole. Namely, if Γ is a typing context, ⊥⊥ is a pole and τ is a store such that τ ⊩ Γ, then the following holds in the \overline{λ}_{[lvτ⋆]}-calculus without co-constants:

1. If v is a strong value such that Γ ⊢_{v} v : A, then (v|τ) ∈ |A|_{v}.

2. If F is a forcing context such that Γ ⊢_{F} F : A^{⊥ ⊥}, then (F |τ) ∈ ∥A∥_{F}.

3. If V is a weak value such that Γ ⊢_{V} V : A, then (V |τ) ∈ |A|_{V}.

4. If E is a catchable context such that Γ ⊢_{E} E : A^{⊥ ⊥}, then (E|τ) ∈ ∥A∥_{F}.

5. If t is a term such that Γ ⊢_{t} t : A, then (t|τ) ∈ |A|_{t}.

6. If e is a context such that Γ ⊢_{e} e : A^{⊥ ⊥}, then (e|τ) ∈ ∥A∥_{e}.

7. If c is a command such that Γ ⊢_{c} c, then cτ ∈ ⊥⊥.

8. If τ′ is a store such that Γ ⊢_{τ} τ′ : Γ′, then ττ′ ⊩ Γ, Γ′.

Proof. We proceed by induction over the typing rules.

Rule (k). This case stems directly from the definition of |X|_{v} for X atomic.

Rule (→_{r}). This case exactly matches the definition of |A → B|_{v}. Assume that

{Γ, x : A ⊢_{t} t : B \atop Γ ⊢_{v} λx.t : A → B} ^{(→_{r})}

and let ⊥⊥ be a pole and τ a store such that τ ⊩ Γ. If (u|τ′) is a closed term in the set |A|_{t}, then, up to α-conversion for the variable x, \overline{ττ′} ⊩ Γ by Lemma 14 and \overline{ττ′}[x := u] ⊩ Γ, x : A. Using the induction hypothesis, (t|\overline{ττ′}[x := u]) is indeed in |B|_{t}.

Rule (→_{l}). Assume that

\begin{matrix}Γ ⊢_{t} u : A & Γ ⊢_{E} E : B^{⊥ ⊥} \\ Γ ⊢_{F} u · E : (A → B)^{⊥ ⊥} \end{matrix} ^{(→_{l})}

and let ⊥⊥ be a pole and τ a store such that τ ⊩ Γ. Let (λx.t|τ′) be a closed term in the set |A → B|_{v} such that τ ⋄ τ′, then we have:

⟨λx.t||u · E⟩\overline{ττ′} → ⟨u||μ̃x.⟨t||E⟩⟩\overline{ττ′} → ⟨t||E⟩\overline{ττ′}[x := u]

By definition of |A → B|_{v}, this closure is in the pole, and we can conclude by anti-reduction.

Rule (↑^{V}). This case, as well as every other case where typing a term (resp. context) at a higher level of the hierarchy (rules (↑^{E}), (↑^{t}), (↑^{e})), is a simple consequence of Proposition 12. Indeed, assume for instance that

{Γ ⊢_{v} v : A \atop Γ ⊢_{V} v : A} ^{(↑^{V} )}

and let ⊥⊥ be a pole and τ a store such that τ ⊩ Γ. By induction hypothesis, we get that (v|τ) ∈ |A|_{v}. Thus if (F |τ′) is in ∥A∥_{F}, by definition (v|τ)⊥⊥(F |τ′).

Rule (x). Assume that

{(x : A) ∈ Γ \atop Γ ⊢_{V} x : A} ^{(x)}

and let ⊥⊥ be a pole and τ a store such that τ ⊩ Γ. As (x : A) ∈ Γ, we know that τ is of the form τ_{0}[x := t]τ_{1} with (t|τ_{0}) ∈ |A|_{t}. Let (F |τ′) be in ∥A∥_{F}, with τ ⋄ τ′. By Lemma 4, we know that \overline{ττ′} is of the form \overline{τ_{0}}[x := t]\overline{τ_{1}}. Hence we have:

⟨x||F ⟩\overline{τ_{0}}[x := t]\overline{τ_{1}} → ⟨t||μ̃[x].⟨x||F ⟩\overline{τ_{1}}⟩\overline{τ_{0}}

and it suffices by anti-reduction to show that the last closure is in the pole ⊥⊥. By induction hypothesis, we know that (t|τ_{0}) ∈ |A|_{t} thus we only need to show that it is in front of a catchable context in ∥A∥_{E}. This corresponds exactly to the next case that we shall prove now.

Rule (μ̃^{[]}). Assume that

\begin{matrix}Γ, x : A, Γ′ ⊢_{F} F : A & Γ, x : A ⊢ τ′ : Γ′ \\ Γ ⊢_{E} μ̃[x].⟨x||F ⟩τ′ : A \end{matrix} ^{(μ̃^{[]})}

and let ⊥⊥ be a pole and τ a store such that τ ⊩ Γ. Let (V |τ_{0}) be a closed term in |A|_{V} such that τ_{0} ⋄ τ. We have that :

⟨V ||μ̃[x].⟨x||F ⟩\overline{τ′}⟩\overline{τ_{0}τ} → ⟨V ||F ⟩\overline{τ_{0}τ}[x := V]τ′

By induction hypothesis, we obtain τ[x := V]τ′ ⊩ Γ, x : A, Γ′. Up to αconversion in F and τ′, so that the variables in τ′ are disjoint from those in τ_{0}, we have that \overline{τ_{0}τ} ⊩ Γ (by Lemma 14) and then τ′′ ≜ \overline{τ_{0}τ}[x := V]τ′ ⊩ Γ, x : A, Γ′. By induction hypothesis again, we obtain that (F |τ′′) ∈ ∥A∥_{F} (this was an assumption in the previous case) and as (V |τ_{0}) ∈ |A|_{V}, we finally get that (V |τ_{0})⊥⊥(F |τ′′) and conclude again by anti-reduction.

Rules (α). This case is obvious from the definition of τ ⊩ Γ.

Rule (μ). Assume that

{Γ, α : A^{⊥ ⊥} ⊢_{c} c \atop Γ ⊢_{t} μα.c : A} ^{(μ)}

and let ⊥⊥ be a pole and τ a store such that τ ⊩ Γ. Let (E|τ′) be a closed context in ∥A∥_{E} such that τ ⋄ τ′. We have that :

⟨μα.c||E⟩\overline{ττ′} → c\overline{ττ′}[α := E]

Using the induction hypothesis, we only need to show that \overline{ττ′}[α := E] ⊩ Γ, α : A^{⊥ ⊥}, Γ′ and conclude by anti-reduction. This obviously holds, since (E|τ′) ∈ ∥A∥_{E} and \overline{ττ′} ⊩ Γ byLemma 4.

Rule (μ̃). This case is identical to the previous one.

Rule (c). Assume that

\begin{matrix}Γ ⊢_{t} t : A & Γ ⊢_{e} e : A^{⊥ ⊥} \\ Γ ⊢_{c} ⟨t||e⟩ \end{matrix} ^{(c)}

and let ⊥⊥ be a pole and τ a store such that τ ⊩ Γ. Then by induction hypothesis (t|τ) ∈ |A|_{t} and (e|τ) ∈ ∥A∥_{e}, so that ⟨t||e⟩τ ∈ ⊥⊥.

Rule (τ_{t}). This case directly stems from the induction hypothesis which exactly matches the definition of ττ′[x := t] ⊩ Γ, Γ′, x : A. The case for the rule (τ_{E}) is identical, and the case for the rule (ε) is trivial.