Paper deep dive
Mixed Choice in Asynchronous Multiparty Session Types
Laura Bocchi, Raymond Hu, Adriana Laura Voinea, Simon Thompson
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 93%
Last extracted: 7/20/2026, 7:19:32 AM
Summary
This paper introduces mMST, a framework for asynchronous multiparty session types (MST) that supports mixed choice (MC). Unlike classical MST which prohibits race conditions, mMST allows transient inconsistencies where participants may diverge in protocol state, ensuring they eventually converge to a consistent state. The authors prove correctness via progress properties and operational correspondence, and implement a toolchain to generate Erlang/OTP gen_statem processes from validated mMST protocols. The framework is validated by reimplementing part of the RabbitMQ amqp_client.
Entities (10)
Relation Signals (8)
Raymond Hu → affiliatedwith → Queen Mary University of London
confidence 95% · Raymond Hu ... Queen Mary University of London
Simon Thompson → affiliatedwith → University of Kent
confidence 95% · Simon Thompson ... University of Kent
Adriana Laura Voinea → affiliatedwith → University of Glasgow
confidence 95% · Adriana Laura Voinea ... University of Glasgow
Laura Bocchi → affiliatedwith → University of Kent
confidence 95% · Laura Bocchi ... University ofKent
mMST → supports → Mixed Choice
confidence 95% · We present a multiparty session type (MST) framework with asynchronous mixed choice (MC).
mMST → implementedin → Erlang/OTP
confidence 90% · programming compliant gen_statem processes in Erlang/OTP.
gen_statem → partof → Erlang/OTP
confidence 90% · Erlang/OTP has built-in support for a set of core design patterns, known as behaviours... target the gen_statem behaviour
mMST → validatedby → RabbitMQ
confidence 85% · We test our framework by using our toolchain to specify and reimplement part of the amqp_client of the RabbitMQ broker for Erlang.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:We present a multiparty session type (MST) framework with asynchronous mixed choice (MC). We propose a core construct for MC that allows transient inconsistencies in protocol state between distributed participants, but ensures all participants can always eventually reach a mutually consistent state. We prove the correctness of our system by establishing a progress property and an operational correspondence between global types and distributed local type projections. Based on our theory, we implement a practical toolchain for specifying and validating asynchronous MST protocols featuring MC, and programming compliant gen_statem processes in Erlang/OTP. We test our framework by using our toolchain to specify and reimplement part of the amqp_client of the RabbitMQ broker for Erlang.
Tags
Links
- Source: https://arxiv.org/abs/2602.23927v1
- Canonical: https://arxiv.org/abs/2602.23927v1
Trouble viewing inline? Open PDF directly →
Full Text
522,967 characters extracted from source content.
Expand or collapse full text
Mixed Choice in Asynchronous Multiparty Session Types Laura Bocchi L.Bocchi@kent.ac.uk 0000-0002-7177-9395 University of KentCanterburyUK , Raymond Hu r.hu@qmul.ac.uk 0000-0003-4361-6772 Queen Mary University of LondonLondonUK , Adriana Laura Voinea laura.voinea@glasgow.ac.uk 0000-0003-4482-205X University of GlasgowGlasgowUK and Simon Thompson S.J.Thompson@kent.ac.uk 0000-0002-2350-301X University of KentCanterburyUK Abstract. We present a multiparty session type (MST) framework with asynchronous mixed choice (MC). We propose a core construct for MC that allows transient inconsistencies in protocol state between distributed participants, but ensures all participants can always eventually reach a mutually consistent state. We prove the correctness of our system by establishing a progress property and an operational correspondence between global types and distributed local type projections. Based on our theory, we implement a practical toolchain for specifying and validating asynchronous MST protocols featuring MC, and programming compliant gen_statem processes in Erlang/OTP. We test our framework by using our toolchain to specify and reimplement part of the amqp_client of the RabbitMQ broker for Erlang. †copyright: none 1. Introduction Multiparty session types (MST) (Honda et al., 2008) is a typing discipline for concurrent processes that interact via message passing in communication sessions. The main idea is that an MST communication protocol can be statically checked for communication safety, i.e., freedom from fundamental errors such as reception errors (receiving unexpected messages), deadlocks (wait-for cycles) and orphan messages (messages that the receiver will never attempt to consume). MST is an active area of research due to its potential to offer programmatic techniques for safe specification and lightweight verification of communication protocols in concurrent and distributed systems. The key challenges being tackled include expressiveness of the types, tractability of the metatheory, and practicality of session-based programming and verification methods. These challenges are accentuated in the setting of distributed systems (DS) where communications are inherently asynchronous and failure is the norm. This paper tackles a crucial problem that concerns all of the above challenges: the notion of mixed choice in asynchronous MST. In classical MST (Honda et al., 2008; Bettini et al., 2008; Coppo et al., 2015), the construct for choice in a protocol, called a directed choice, looks as follows. ⇾:ai.ii∈I p q:\a_i. G_i\_i ∈I It specifies that a participant p makes an internal choice to send one of the aia_i messages to q and continue in protocol GiG_i. Participant q receives the aia_i as an external choice and continues in GiG_i correspondingly. Some systems (e.g., (Lange and Yoshida, 2019; Li et al., 2023)) support generalised choice constructs that allow the aia_i to be sent to different i q_i. However, the key point remains that the choice is directed by p. By contrast, this paper develops the following construct for mixed choice. ⇾:a1.1⊳⇾:a2.2 q p:a_1. G_1 10000\ 10000\ 10000\ 10000\ p q:a_2. G_2 It specifies that p and q each independently face a choice between a mix of input and output actions: q faces a mixed choice between sending a1a_1 on the left and receiving a2a_2 on the right, and vice versa for p. In an asynchronous setting, this means that q may opt to send a1a_1 and continue in protocol G1G_1 concurrently with p opting to send a2a_2 and continue in G2G_2. In this way, asynchronous mixed choices inherently describe a form of race condition, which classical MST intentionally prohibits outright because directed choice syntactically partitions all choices as input or output only. Yet such race conditions are useful and important in many real applications. Indeed, much recent research on improving the expressiveness and practicality of MST has touched on aspects of mixed choice, including work on exceptions (Capecchi et al., 2016; Viering et al., 2018; Fowler et al., 2019), interrupts (Demangeon et al., 2015; Chen et al., 2016), timing (Iraci et al., 2023) and timeouts (Pears et al., 2023; Hou et al., 2024), failure handling (Adameit et al., 2017; Barwell et al., 2022, 2023; Brun and Dardha, 2024), and fault-tolerance (Viering et al., 2021; Peters et al., 2023). These works (implicitly) involve patterns where a participant has the option on one hand to asynchronously output a message, while on the other hand it is simultaneously prepared for some input event, say, catching a concurrent channel exception, or receiving a criss-crossing interrupt or timeout message, or handling the failure of some other participant. The fundamental problem in reasoning about mixed choice in MST is that it allows participants to diverge in their local views of the protocol during execution. The insight of this paper is that communication safety can be achieved despite transient inconsistencies in distributed protocol state depending on how participants react to race-y messages and interact to resolve conflicts. Contributions and roadmap This paper presents the following contributions. • We introduce mMST, the first theory of global and local MST with an explicit construct for asynchronous mixed choice. To date, mixed choices in asynchronous sessions have only been partially expressed through specific-purpose constructs for exceptions, failure handling and so forth. By contrast, we present a general-purpose core theory of mixed choices that captures and unifies the fundamental essence of such ad hoc constructs. We propose an asymmetric design for mixed choice that statically ensures participants can eventually resolve the inherent race conditions through explicit interactions and agree on how the protocol should proceed. • We establish the correctness of mMST by proving a progress property for our mixed choice types, and an operational correspondence between global types and the corresponding system of local types. Together these guarantee that every non-terminated participant in an mMST protocol can always progress and that its behaviour is always protocol-compliant. Our results lay general foundations for a more flexible and practical concept of multiparty sessions that allows participants to deal with discrepancies in their distributed views of the protocol and safely converge on a consistent outcome. • We apply our theory by implementing a prototype toolchain for specifying and programming mMST-based protocols as gen_statem programs in Erlang/OTP. We test the expressiveness and practicality of mMST by using our toolchain to implement coordination protocols in the Erlang client of the RabbitMQ message broker, as well as a selection of examples from MST literature augmented with mixed choices. Section˜2 gives a high-level overview of our mixed choice construct. Sections˜3 and 4 present our theory and its formal properties. Section˜5 describes our toolchain for Erlang, our RabbitMQ use case and other examples. Section˜6 discusses related work, limitations and future work. Full details and proofs are available in the appendix. 2. Overview Our overall framework comprises two main stages. • Specification and static validation of a source mMST protocol based on our formal theory. • Implementation of each role in the asynchronous protocol in Erlang using correct-by-construction modules generated from the source protocol. The following two subsections illustrate the key concepts in each stage using a practical example. ⬇ 1// Exception, Interrupt, etc. similar 2global protocol Timeout( 3 role A, role B, role C) 4 mixed // "Left-hand" side (LHS) 5 a1() from A to B; 6 a2() from A to C; 7 a3() from B to C; 8 a4() from B to A; 9 a5() from C to A; 10 or // "Right-hand" side (RHS) 11 TOa() from B to A; 12 TOc() from B to C; 13 ABC1,!a1,!a_ 12,!a2,!a_ 23,?a3,?a_ 44,?a4,?a_ 51,?a1,?a_ 12,!a2,!a_ 23,!a3,!a_ 41,?a1,?a_ 22,?a2,?a_ 33,!a3,!a_ 5∙ 1a_1a2a_2a3a_3a4a_4a5a_5 ABC1,!a1,!a_ 12,!a2,!a_ 23,?∗3,?^* TOa1,!∗1,!^* TOa5,5, gc5,!5,! TOc1,?∗1,?^* TOc4,4, gca1a_1a2a_2 TOa TOc Figure 1. A multiparty timeout pattern as a safe mMST protocol using asynchronous mixed choice. 2.1. Asymmetric Mixed Choice in Asynchronous MST Our toolchain takes mMST protocols written in our extension of the Scribble protocol language (Yoshida et al., 2013; Hu and Yoshida, 2016). Communications are asynchronous: interactions are non-blocking on the sender side, while the receiver side blocks until a message is available for reading. This means a sender moves ahead in the protocol immediately after dispatching a message without waiting for the message to be received. Messages are delivered in order of dispatch in each direction between each pair of roles; receivers read messages from the expected sender in a FIFO manner. This model reflects our target Erlang programs and wider domains such as TCP-based Internet applications and Web services. Figure˜1 (left) illustrates a small protocol called Timeout involving three participants, whose behaviour is abstracted in MST as roles. The syntax of our mixed choice (MC) construct is: mixed /* "Left-hand" side (LHS) */ or /* "Right-hand" side (RHS) */ The protocol features an MC between role A on the LHS and B on the RHS. It expresses a typical timeout pattern where A has the option to send message a1 to B (and proceed asynchronously) on the LHS, but it must also be prepared to handle the potentially concurrent timeout message TOa from B on the RHS. Conversely, B has the option to wait for the a1 message on the LHS, or give up waiting and asynchronously send TOa on the RHS. Depending on how A and B proceed, role C must be prepared to handle one or both of the a2 from A and the TOc from B. We summarise the key concepts in the design of our MC and how we ensure MST safety. • Our MC is an asymmetric construct. In each MC, we designate the sender on the RHS as a special role that we refer to as the observer of the MC. The LHS can be considered a default or speculative branch, which can be asynchronously superceded by the RHS on the instigation of the observer. • We identify a notion of commitment of roles to an MC branch (LHS or RHS). Commitment means that the inherent race condition of an MC has been resolved from the perspective of that role and it knows the protocol will henceforth proceed only in that branch. An MC starts with no roles committed to either branch. Regardless of (speculative) interactions between other roles in the LHS, the first action by the observer in an MC (input on the LHS or output on the RHS) commits the observer to that branch. Any subsequent action by another role r, where the action causally depends on the observer, commits r to the same branch. • Protocol validation due to our formal theory ensures that however a protocol (speculatively) proceeds, all eventual commitments are monotonic and always consistent with the observer. To illustrate, Figure˜1 (right) depicts two possible executions of the protocol. For now, the reader can focus on the arrows and the blue labels; the grey annotations will be explained in Sec. 2.2. • The upper chart is a run where observer B opts to receive a1 and follow A on the LHS, i.e., it does not raise the timeout. While A and C may proceed asynchronously on the LHS, the observer B is the first role to commit when it consumes the a1. In turn C commits to the LHS when it consumes the a3 from B, and A commits when it consumes the a4. Although the a5 can arrive on the LHS at A before the a4, A must consume the a4 (and commit to the LHS) first following the protocol. • The lower chart is a run where observer B opts to overrule A and raise the timeout by sending TOa, which commits B to the RHS. Although A and C may be concurrently engaged in interactions on the LHS, role A eventually receives the TOa, causing it to switch from the LHS and commit to the RHS. Similarly, C switches and commits to the RHS when it receives the TOc. Stale message purging. The latter of the above cases demonstrates that supporting mixed choices safely in asynchronous MST requires one further key concept. Due to asynchrony, actions performed by one role may concurrently render other messages that are buffered or being sent obsolete. For instance, in the lower chart, the a1 message ‘criss-crosses’ with TOa and arrives at B after B has already committed to the RHS. From B’s perspective, sending the TOa renders the (already in-transit) a1 obsolete; in such cases, we refer to messages like a1 as stale messages. Similarly, the receipt of TOc by C renders the a2 stale. Our theory formalises a runtime mechanism that allows stale messages to be automatically purged transparently to the user program; e.g., in the case mentioned above, the runtime at B (resp. at C) will transparently purge the a1 that arrives after sending TOa (resp. the a2 after receiving TOc). Crucially, stale message purging can be safely performed by the local runtime of each distributed participant using only knowledge available to that participant. The notion of stale messages and purging never arises in classical MST. Our transparent purging mechanism could be considered a message passing analogy to garbage collection of stale objects in programming languages with automated memory management (such as Erlang). MC protocol validation. For reference, the Timeout protocol written in our formal notation for global types (Section˜3) is as follows. The ⊳ separates the LHS and RHS of the MC. The additional blue colouring indicates the points at which the roles become committed. ⇾:a1.⇾:a2.⇾:a3.⇾:a4.⇾:a5.⊳⇾:.⇾:. A B:a_1\,.\, A C:a_2\,.\, [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1B [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1C:a_3\,.\, B [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1A:a_4\,.\, C A:a_5\,.\, end\;\; \;\; [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1B [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1A: TOa\,.\, B [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1C: TOc\,.\, end ✓ Our static protocol validation ensures that role commitments are always consistent with the observer and that role termination is safe (as illustrated in the earlier example runs). By contrast, the below (renaming TOc) is rejected because commitment is ambiguous for C. ⇾:a1.⇾:a2.⇾:a3.⇾:a4.⇾:a5.⊳⇾:.⇾:a3. A B:a_1\,.\, A C:a_2\,.\, [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1B [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1C: [rgb]1,0,0 [named]pgfstrokecolorrgb1,0,0a_3\,.\, B [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1A:a_4\,.\, C A:a_5\,.\, end\;\; \;\; [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1B [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1A: TOa\,.\, B [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1C: [rgb]1,0,0 [named]pgfstrokecolorrgb1,0,0a_3\,.\, end ✗ The below (dropping the a3a_3) is also rejected because C reaches end without committing on the LHS. ⇾:a1.⇾:a2.⇾:a4.⇾:a5.⊳⇾:.⇾:. A B:a_1\,.\, A C:a_2\,.\, [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1B [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1A:a_4\,.\, C A:a_5\,.\, end\;\; \;\; [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1B [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1A: TOa\,.\, B [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1C: TOc\,.\, end ✗ However, the below (dropping the a4a_4) is accepted; A can safely commit on the LHS because it has a transitive causal dependency with observer B via C. ⇾:a1.⇾:a2.⇾:a3.⇾:a5.⊳⇾:.⇾:. A B:a_1\,.\, A C:a_2\,.\, [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1B [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1C:a_3\,.\, C [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1A:a_5\,.\, end\;\; \;\; [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1B [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1A: TOa\,.\, B [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1C: TOc\,.\, end ✓ Altogether, the design of our asynchronous MC, the concepts of observer and commitment and the protocol validation guarantee that every role that has not safely terminated will continue progressing through the protocol as expected. As an advance pointer, the main conditions checked by the protocol validation (which we refer to as awareness) and the progress property for global types are formally defined and established in Section˜3.3. On the expressiveness of mMST, consider again the criss-crossing pattern between A and B in the lower chart of Figure˜1 (right). By contrast, the conservative syntactic structure of classical MST (Coppo et al., 2016; Honda et al., 2016) implicitly precludes all such patterns where asynchronous messages criss-cross between a pair of roles in opposing directions. The complications introduced by these patterns – such as the inherent race conditions, stale messages, and the mechanisms required to resolve these – are why reasoning about safety of mixed choices in asynchronous MST (and DS in general!) is a difficult challenge, and has remained an open problem for MST. We have used the small Timeout example to introduce our MC and the key concepts. Nevertheless, it demonstrates how mMST supports the fundamental communication pattern underlying various important DS constructs, including exceptions, interrupts and failure handling, as found in many real-world applications. Our MC provides a core building block for expressing these constructs in MST. Sections˜3 and 5.2 include and summarise a range of further such examples that involve combining MC with the standard directed choice of MST, recursion and nested MCs. 2.2. Mixed Choice MST protocols in Erlang Erlang is a concurrent, dynamically typed functional programming language designed for implementing applications out of message passing processes. It is used in major applications and platforms such as WhatsApp and RabbitMQ. Its emphasis on building fault-tolerant distributed systems makes it a good target for applying and testing mMST. Erlang/OTP has built-in support for a set of core design patterns, known as behaviours, for implementing processes. In this paper, we target the gen_statem behaviour that provides a generic framework for implementing state machines. A process is formed by combining the provided generic state machine behaviour module with a user-written module of callback functions for handling events and state transitions according to the required application-specific logic. Based on our theory, we have implemented a toolchain for specifying and implementing mMST protocols as gen_statem processes. Our toolchain involves these steps. • The user writes the source global protocol (e.g., Timeout in Figure˜1) using our mMST extension of Scribble and uses the tool to validate it based on our formal conditions. • The tool internally projects valid global protocols to a local protocol for each role. The tool represents a local protocol as an Event-Driven Finite State Machine (EFSM) that matches the programming abstractions of gen_statem (see below). • From each EFSM, the tool generates (i) a correct-by-construction protocol- and role-specific gen_statem behaviour module, and (i) a corresponding template callback module for the programmer to use and adapt as required to complete the process definition. Global-to-local projection A local protocol is the view of the protocol from a specific role. Projecting a global protocol to a set of local protocols, one for each role, yields a distributed model. In our formal notation, the projected local types for Timeout are: ↾=⊕a1.⊕a2.&a4.&a5.⊳&.↾=&a1.⊕a3.⊕a4.⊳⊕.⊕.↾=&a2.&a3.⊕a5.⊳&. array[]l Timeout A=& B a_1\,.\, C a_2\,.\, B\,\&\,a_3\,.\, B\,\&\,a_4\,.\, C\,\&\,a_5\,.\, end& & B\,\&\, TOa\,.\, B TOc\,.\, end\\ Timeout B=& A\,\&\,a_1\,.\, A\,\&\,a_2\,.\, C a_3\,.\, A a_4\,.\, C\,\&\,a_5\,.\, end& & A TOa\,.\, C TOc\,.\, end\\ Timeout C=& A\,\&\,a_1\,.\, A\,\&\,a_2\,.\, B\,\&\,a_3\,.\, B\,\&\,a_4\,.\, A \,a_5\,.\, end& & B TOa\,.\, B\,\&\, TOc\,.\, end\\ array The ⊳ separates the LHS and RHS of the projected mixed choices. The ⊕ denotes an output-only choice (internal select), and &\& denotes the dual input-only choice (external branch); in this simple example, the input/output-only choices are all unary. Section˜4.3 proves that the behaviour of a projected local system corresponds to that of the global protocol. Projection thus entails that a protocol is realisable as a distributed system. EFSM representation The core abstraction of gen_statem is an Event-Driven Finite State Machine (EFSM). Transitions are described by111https://w.erlang.org/doc/system/statem.html State (S) × Event (E) → Action (A) × State (S’) which can be read: if the current state is S and event E occurs, then perform action A and transition to successor state S’ – i.e., the transition is triggered by E and A is a consequent effect. Events may have external sources, such as the arrival of a message (??), or internal (τ), such as a local computation. Actions include sending (!!) messages and the empty action (ϵε). In our mMST setting, a transition can also have the effect of switching from the LHS of an MC to commit to the RHS. 11A22334455τ/!aτ/ B!a_ 1τ/!aτ/ C!a_ 2?a B?a_ 4?a C?a_ 5?∗ B?^*TOa?∗ B?^*TOa?∗ B?^*TOa11B223344?a A?a_ 1τ/!aτ/ C!a_ 3τ/!aτ/ A!a_ 455?a/!∗ A?a_ 1/ A!^*TOaτ/!∗ τ/A!^*TOaτ/!τ/ C!TOc11C223344?a B?a_ 2?a A?a_ 3τ/!aτ/ A!a_ 5?∗ B?^*TOc?∗ B?^*TOc44 Transition labels: Event ‘/’ Action Event: ‘τ’ internal ‘??’ external msg. arrival Action: ‘!!’ send |\;|\; ‘ϵε’ empty ??-only labels are short for ?? / ϵε ∗ means switch to RHS of MC Figure 2. Local mMST protocols for each role of Timeout as EFSMs in Erlang gen_statem. Figure˜2 depicts the EFSM generated by our tool for each role of Timeout. The notation e/αe/α on the transitions means event e triggers the transition and action α is performed; an e on its own is shorthand for e/ϵe/ε. For example, the τ/!aτ/ B!a_ 1 from state 11 of A means that A can internally decide to send a_ 1 to B (and transition to 22). In B, the two transitions from state 11 with event ?a A?a_ 1 mean that if message a_ 1 arrives as an external event, B can either do !∗ A!^* TOa and transition to 44, or transition to 22 (with the empty action). Note, the ∗ annotation (as also occurs in the text below) indicates the transitions that switch from the LHS to the RHS of the MC. Classical MST permits only three kinds of local states: input-only (branch), output-only (select), and terminal; e.g., state 44 in A is a branch, and 33 in C is a select (again, both unary in this simple example). By contrast, the more expressive local behaviours enabled by our asynchronous MC can also be seen in the above EFSMs. As mentioned, observer B faces an internal MC in state 11 indicated by the mix of τ/!∗τ/!^* and ?/ϵ?/ε transitions induced by its RHS and LHS, respectively, yielding the timeout behaviour described at the start of Section˜2.1. On the other hand, A faces an external MC in state 11 as indicated by its mix of ?∗/ϵ?^*/ε and τ/!τ/! transitions: A can either (wait to) receive the TOa (and switch to the RHS), or internally decide (by some internal event τ) to send a_ 1 and proceed to 22. Our formal semantics allows both options, but an implementation may (e.g.) give priority to the former case if TOa has already arrived. Note how A is forced to eventually commit to either the LHS or RHS (in accordance with B) by state 33 at the latest by receiving a_ 4 or TOa. We give a couple of further comments on the richer behaviours expressed by our MC. First, note that external MCs may take various forms: e.g., both states 11 in A and 11 in C are external MCs featuring ?∗?^*, but the former is mixed with a τ whereas the latter is mixed with an ??-event. Second, note that the top-level roles of the MC are A and B, but their localised (projected) behaviours in the MC are not direct duals; e.g., state 33 in A is an external MC between a4a_4 and TOa that has no direct counterpart in B (i.e., there is no internal MC featuring a4a_4 in B). Additionally, ?∗?^* TOa events are spread over states 11, 22 and 33 in A; whereas in B, the !∗!^* TOa occurs only in 11, although in two different transitions since B can choose to raise the timeout either before (τ) or after (??) the a_ 1 has arrived. These behaviours are considerably more exotic than those supported in classical MST and speak to the challenge of reasoning about asynchronous MC theoretically and practically. Programming mMST-based processes in Erlang. Our toolchain uses the EFSMs to generate two Erlang modules per role for the programmer(s) to work with. The role module (RM) provides a customised gen_statem behaviour that is specialised to the source protocol and role. The programmer can consider it as part of the runtime and does not need to use it directly. The other, called the callback module (CM), is a template module of callback functions that the RM delegates to for handling event occurrences and performing state transition actions. The CM is generated with minimal placeholder code that the programmer can modify and extend with the required application-specific logic. The RM and CM together form a protocol- and role-specific mMST process. A set of processes comprising one for each role forms a complete application. ⬇ 1% Extract from role A 2s1(internal, a1, Data) →\ 3 gen_a:send_s1_a1(BPid, Data), next_state, s2, 4 Data, [next_event, internal, a2]; 5s1(cast, BPid, ’TOa’, Data) →\ stop, normal, Data. 6 7s2(internal, a2, Data) →\ 8 gen_a:send_s2_a2(CPid, Data), next_state, s3, Data; 9s2(cast, BPid, ’TOa’, Data) →\ stop, normal, Data. 10 11s3(cast, BPid, a4, Data) →\ next_state, s4, Data; 12s3(cast, BPid, ’TOa’, Data) →\ stop, normal, Data. 13 14s4(cast, CPid, a5, Data) →\ stop, normal, Data. 15 16 17% Extract from role B 18s1(internal,’TOa’, Data) →\ 19case make_choice_TOa(Data) of 20 1 →\ keep_state, Data; 21 2 →\ gen_b:send_s1_TOa(APid, Data), next_state, s3, 22 Data, [next_event, internal,’TOc’] 23end; % Continued on the right ⬇ 24% Continued from the left 25s1(cast,APid, a1,Data) →\ 26 case make_choice_a1(Data) of 27 1 →\ next_state, s2, Data, 28 [next_event, internal, a3]; 29 2 →\ gen_b:send_s1_TOa(APid, Data), 30 next_state, s5, Data, 31 [next_event, internal,’TOc’] 32 end. 33 34s5(internal, ’TOc’, Data) →\ 35 gen_b:send_s5_TOc(CPid, Data), 36 stop, normal, Data. 37 38s2(internal, a3, Data) →\ 39 gen_b:send_s2_a3(CPid, Data), next_state, s3, 40 Data, [next_event, internal, a4]. 41 42s3(internal, a4, Data) →\ 43 gen_b:send_s3_a4(APid, Data), 44 stop, normal, Data. 45 46 Figure 3. Extracts from the user-facing callback modules generated for A and B in the Timeout protocol. Figure˜3 shows code from the CMs as generated for roles A and B. As per their respective EFSMs (Figure˜2), they feature callback state functions (e.g., s1, s2, etc.) for handling state transitions according to event occurrences. The callbacks are fired (from the RM) based on the current state and by pattern matching against the event, which may come from an internal (locally triggered transitions, such as timeout decisions) or external (incoming messages) source. For instance, in A, state function s1 represents an external MC corresponding to state 1 (for A in Figure˜2): A may either send a1 to B (the internal clause), or receive ‘TOa’ from B (the cast clause), corresponding to the τ/! τ/B!a_1 and ?∗ B?^*TOa transitions, respectively. In B, the function s1 represents an internal MC. In the first clause (internal), B handles the internal event from the generated template function make_choice_TOa by which it decides whether to remain in the current state (keep_state) and wait to receive a1, or transition to s2 by sending ‘TOa’ to A (cf. τ/!∗ τ/A!^*To). Generally, the programmer will modify/replace such template decision functions according to the required application logic. In the second clause (cast), B receives the message a1 from A, and based on template function make_choice_a1(Data), either transitions (cf. ?a/!∗ A?a_ 1 /A!^*TOa) to s3 and schedules an internal event a2, or sends ‘TOa’ to A and transitions (cf. ?a A?a_ 1) to s2. Section˜5 demonstrates the internals of the RM that fires the callbacks in the above CM. In short, our tool generates the RM by instantiating the default gen_statem behaviour with the required EFSM structure (states, events, actions, and transitions); this is correct-by-construction and the programmer should not modify the RM. Following our formal semantics, the RM is also generated to encapsulate the (again, correct-by-construction) runtime mechanisms for handling MC commitment, LHS-to-RHS switching, and stale message purging specifically for the source protocol and role. The programmer can assume these mechanisms are provided and correct when working on the CM. Recall the example executions in Figure˜1 (right). The grey annotations denote the current state and relevant event/action at each role according to their EFSMs in Figure˜2; e.g., 1,!a1,!a_ 1 means in state 11, send message a_ 1. Stale message purging, denoted by gc in Figure˜1, is handled internally by the RM; we exclude purge actions from our depictions of EFSMs as they are transparent to the programmer. User processes do not consume stale messages, so they must be purged from the input buffer to prevent interference with future receives (given the FIFO nature of inputs). 2.3. Properties of mMST We end this overview by summarising the properties of our framework with advance pointers (a roadmap) to the relevant parts of our formal theory. Section˜3 formalises the syntax and metatheoretical LTS semantics of our global types with mixed choice and the notion of committing messages in MCs. It defines the conditions checked by protocol validation on protocol structure (well-formedness of committing messages, balance of roles across choice branches) and on inter-role dependencies in MCs (awareness). Section˜3.3 proves that valid protocols enjoy a per-role progress property and that their roles are always consistent in their commitments (coherence). Section˜4 formalises the syntax and LTS semantics of distributed local types and asynchronous message queues, the projection from global to local types, and the runtime mechanism for stale message purging. Section˜4.3 proves an operational correspondence in both directions between valid projectable global types and local systems that preserves projection. The operational correspondence (i.e., preservation of projection) and progress properties together safely entail that local roles never get stuck in a deadlock nor (noting the FIFO nature of communications in the local type LTS) due to receiving an unexpected message. Section˜4.4 further proves orphan message freedom. As discussed, our practical toolchain is implemented to perform protocol validation (conservatively, see Section˜5.1) and projection following our formal theory. It is implemented to perform a correct-by-construction translation from local projections to EFSMs and generation of gen_statem modules to transfer the above correctness properties to Erlang processes. The usage contract is that the programmer should not modify the generated RM and must use the CM according to the generated structures. The RM is generated with some internal runtime checks against the programmer supplying an invalid CM. 3. Global Types The syntax of global types G is defined by the grammar below: ::=⇾:S∣ :kS∣μ.∣⇾:S1⊳c⇾:S2∣1▶ℒ,ℛc2S::=ai.ii∈I array[]l G&::=& p q: [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S p 0.56905pt to8.94pt to3.31pt -1.65598pt to0.0pt @beginscope @invoke pgfstrokecolorrgb0,0,0 @color@rgb@stroke000 @invoke @color@rgb@fill000 @invoke @setlinewidth @invoke to0.0pt @beginscope @invoke @beginscope @invoke @roundcap @invoke @beginscope @setdash @temp @x @miterjoin @moveto2.52187pt0.0pt @lineto0.2pt1.35599pt @lineto0.0pt0.0pt @lineto0.2pt-1.35599pt @closepath @fillstroke @endscope @moveto0.0pt0.0pt @lineto0.0pt0.0pt @lineto0.92499pt0.8pt @lineto2.775pt-0.8pt @lineto4.625pt0.8pt @lineto5.55002pt0.0pt @lineto5.55002pt0.0pt @lineto5.56764pt0.0pt @stroke @invoke @beginscope @invoke @transformcm1.00.00.01.05.66763pt0.0pt @invoke @invoke @invoke @endscope @invoke @endscope @invoke @endscope @discardpath @invoke @endscope q:k\, [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S μ t. G t end q p: [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S_1 [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100 1.0mu ^c 1.0mu p q: [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S_2 G_1 1.0mu 1.0mu^c_L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_2\\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S&::=&\a_i. G_i\_i∈ I array The first five terms are standard (Deniélou and Yoshida, 2013). We recall that ⇾:S p q: [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S is an interaction where p is the sender and q is the receiver. Term S [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S specifies a set of choices: p can send q one of the labels aia_i (for i∈Ii∈ I) and the protocol continues as i G_i. The message in-transit type :kS p 0.56905pt to8.94pt to3.31pt -1.65598pt to0.0pt @beginscope @invoke pgfstrokecolorrgb0,0,0 @color@rgb@stroke000 @invoke @color@rgb@fill000 @invoke @setlinewidth @invoke to0.0pt @beginscope @invoke @beginscope @invoke @roundcap @invoke @moveto0.0pt0.0pt @lineto0.0pt0.0pt @lineto0.92499pt0.8pt @lineto2.775pt-0.8pt @lineto4.625pt0.8pt @lineto5.55002pt0.0pt @lineto5.55002pt0.0pt @lineto5.56764pt0.0pt @stroke @invoke @beginscope @invoke @transformcm1.00.00.01.05.66763pt0.0pt @invoke @invoke @invoke @endscope @invoke @endscope @invoke @endscope @discardpath @invoke @endscope q:k\, [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S stands for a state where p has sent label aka_k but q has not yet received it (asynchronous communication). Term μ.μ t. G is a recursive definition222We adopt iso-recursive types for a lower level view of nested MC instantiation and straightforward implementation. and t a recursive variable. The last two terms are new and model mixed choices (MC). The term ⇾:S1⊳c⇾:S2 q p: [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S_1 [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100 1.0mu ^c 1.0mu p q: [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S_2 is an MC definition: we call ⇾:S1 q p: [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S_1 the left-hand side block (LHS) of the MC and ⇾:S2 p q: [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S_2 the right-hand side block (RHS). Role p is set to receive a message from q in the LHS, but may decide to execute the RHS by sending a message to q instead. We say that p is the observer of the MC. We annotate MC definitions with a unique name c, which we may omit when it is not important. The term 1▶ℒ,ℛc2 G_1 1.0mu 1.0mu^c_L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_2 is an active MC. To ensure that roles eventually agree on which block (LHS or RHS) to execute, we use a notion of commitment. Some actions are designated as committing (defined in Section˜3.1). When a role executes a committing action within a block, it commits to that block, meaning that it can no longer perform any action (send or receive) in the other block. The semantics of global types use sets ℒL to keep track of the roles that are committed to the LHS, and ℛR to keep track those committed to the RHS. For convenience we may use the notation 1⊳c:2 G_1 [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100 1.0mu ^c: p 1.0mu G_2 and 1▶ℒ,ℛc:2 G_1 1.0mu 1.0mu^c: p_L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_2 assuming that 1 G_1 and 2 G_2 are of the form given by the grammar and that p is the observer. For readability, we omit annotations c, ℒL or ℛR when not needed. A global type is initial if it has no messages in transit and no active MC. The set of roles of G, denoted () R( G), is defined as usual except for the two new cases for MC: (1⊳2)=(1)∪(2)(1▶ℒ,ℛ2)=(1)∖ℛ∪(2)∖ℒ R( G_1 [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100 1.0mu 1.0mu G_2)= R( G_1) 10000\ ∪ 10000\ R( G_2) R( G_1 1.0mu 1.0mu_L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_2)= R( G_1) 10000\ ∪ 10000\ R( G_2) The roles of a MC definition are the roles in either of its sides. The case of active MC excludes the roles that have committed to the opposite side. This will be critical when defining progress, to characterise the roles that should continue on each side. We define a context environment C: ::=[_]∣⇾:S∪a.∣ :kS∪ak.∣▶∣▶∣⊳∣⊳∣μ.C::=[\,\_\,] p q: [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S∪\a.C\ p 0.56905pt to8.94pt to3.31pt -1.65598pt to0.0pt @beginscope @invoke pgfstrokecolorrgb0,0,0 @color@rgb@stroke000 @invoke @color@rgb@fill000 @invoke @setlinewidth @invoke to0.0pt @beginscope @invoke @beginscope @invoke @roundcap @invoke @moveto0.0pt0.0pt @lineto0.0pt0.0pt @lineto0.92499pt0.8pt @lineto2.775pt-0.8pt @lineto4.625pt0.8pt @lineto5.55002pt0.0pt @lineto5.55002pt0.0pt @lineto5.56764pt0.0pt @stroke @invoke @beginscope @invoke @transformcm1.00.00.01.05.66763pt0.0pt @invoke @invoke @invoke @endscope @invoke @endscope @invoke @endscope @discardpath @invoke @endscope q:k\, [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S∪\a_k.C\ 1.0mu 1.0mu G G 1.0mu 1.0muC [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100 1.0mu 1.0mu G G [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100 1.0mu 1.0muC μ t.C We say that ′ G is a subterm of G (or is in G) if there exists C such that =[′] G=C[ G ]. We say that two subterms of 1 G_1 and 2 G_2 of G are distinguished if =1[1]=2[2] G=C_1[ G_1]=C_2[ G_2] implies 1≠2C_1 _2. We say that G has an active MC 1▶2 G_1 G_2 if 1▶2 G_1 G_2 is a subterm of G. Similarly for MC definitions. 3.1. Committing Set and Well-Formedness In this section we formally introduce the notion of commitment, by defining the committing set of a MC named c, that is the set of actions by which some role commits to either the LHS or to the RHS of c. The committing set is defined on initial global types. Intuitively, the committing actions of a MC are: (1) on the LHS, the first receive action by the observer, and all receive actions of a message from a committed sender, (2) on the RHS, all the first actions of a role on that side. For simplicity, we identify committing actions (e.g., ?a p q?a) using only their labels (e.g., a). The committing set is therefore, a set of communication labels. In the following we denote with () U( G) the standard unfold-all-once operation that unfolds once all recursive types in G. We say that 1⊳c2 G_1 [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100 1.0mu ^c 1.0mu G_2 is the outermost occurrence of c in (G) U(G) if it is not a subterm of other MC definitions c in (G) U(G). Given a global type ⇾:S q p: [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S with S=ai.ii∈I [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S=\a_i. G_i\_i∈ I, we use the notation (S)=aii∈I labels( [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S)=\a_i\_i∈ I and (S)=ii∈I types( [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S)=\ G_i\_i∈ I. Definition 3.1 (Committing set). Let G be an initial global type. Let c be an MC definition in G, and ⇾:S1⊳c⇾:S2 q p:\, [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S_1 [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100 1.0mu ^c 1.0mu\, p q:\, [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S_2 be the outermost occurrence of c in () U( G). The committing set of c in G, denoted ⇓c() ^c -2.84526pt( G), is defined as follows: ⇓c():-(S1∪S2)∪⋃G∈(S1)⇓c(G,)∪⋃G∈(S2)⇓c(G,,) array[]l ^c -2.84526pt( G) 10000\ 10000\ labels( [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S_1\,∪\, [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S_2) 10000\ 10000\ ∪ 10000\ 10000\ _G∈ types( [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S_1) ^c -2.84526pt(G, [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5\ p\) 10000\ 10000\ ∪ 10000\ 10000\ _G∈ types( [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S_2) ^c -2.84526pt(G, [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5\ p, q\) array where ⇓c(,C) ^c -2.84526pt( G, [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5C) is an auxiliary function parameterized by the set C of committed roles, used to track dependency with other committing actions. In brief, the case for interactions is: ⇓c(⇾:S,C)=(S)∪⋃∈(S)⇓c(,C∪)(∈C∧∉C)⋃∈(S)⇓c(,C)otherwise ^c -2.84526pt( p q: [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S, [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5C)= cases labels( [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S) 10000\ ∪ _ G∈ types( [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S) ^c -2.84526pt( G, [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5C∪\ q\)&( p∈ C 10000\ 10000\ q ∈ C)\\ _ G∈ types( [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S) ^c -2.84526pt( G, [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5C)&otherwise cases The case ⇓c(1⊳c′2,C) ^c -2.84526pt( G_1 [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100 1.0mu ^c 1.0mu G_2, [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5C) returns ⇓c(1,C)∪⇓c(2,C) ^c -2.84526pt( G_1, [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5C) 10000\ ∪ ^c -2.84526pt( G_2, [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5C) if c′≠c ≠ c, and the empty set otherwise. Finally, ⇓c(μ.,C)=⇓c(,C) ^c -2.84526pt(μ t. G, [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5C) = ^c -2.84526pt( G, [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5C) and ⇓c(,C)=⇓c(,C)=∅ ^c -2.84526pt( t, [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5C) = ^c -2.84526pt( end, [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5C) = . Intuitively, ⇓c() ^c -2.84526pt( G) identifies the labels of S1∪S2 [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S_1∪ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S_2 as the set of initial committing labels in c: the labels in S1 [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S_1 are committing for p and labels in S2 [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S_2 are committing for both q and p. To these labels, we add those that depend on actions by p on the RHS of c and ,\ p, q\ on the LHS, by using the auxiliary function. The function ⇓c(,C) ^c -2.84526pt( G, [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5C) traverses the syntactic structure of G until it reaches t, end, or a nested occurrence of the same c (introduced by unfolding). In case ⇓c(⇾:S,C) ^c -2.84526pt( p q: [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S, [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5C) all labels that are sent from a committed role ∈C p∈ C to a non-committed role ∉C q ∈ C are regarded as committing. Unfolding () U( G) is used to account for committing labels that are captured into a MC block only after recursive unfolding, as we illustrate in Example˜3.2. Example 3.2 (Label capture). Consider the recursive type c=μ.⇾:a.(⇾:b.⊳2) G_c=μ t.\, p r: [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100a.( q p:b.\, t [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100 1.0mu 1.0mu G_2) where label a∉2a ∈ G_2 and hence does not appear directly in the MC. If we apply the auxiliary function in Definition˜3.1 to c G_c itself (rather than its unfolding (c) U( G_c)) then a would not be included in the committing set of c G_c. However, after some steps that involve recursive unfolding, shown in (1), an occurrence of a is introduced on the LHS of the outer MC. This second occurrence of a is committing (it makes r commit to the LHS of the outer MC). By using unfolding, Definition˜3.1 correctly identifies a as committing. (1) c→∗⇾:a.(⇾:b.(μ.⇾:a.(⇾:b.⊳2))▶2) G_c 10000\ 10000\ 10000\ 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 -3.44444pt^* 10000\ 10000\ 10000\ 10000\ p r: [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100a.( q p:b. [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1(μ t.\, p r: [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100a.( q p:b.\, t [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100 1.0mu 1.0mu G_2)) 1.0mu 1.0mu G_2) Well-formedness Global types where a label occurs multiple times, and where some occurrences are committing and some others are not, are problematic. A simple example is (2), where b appears twice, and is non-committing on the LHS of c while it is committing on the RHS. (2) ✗=⇾:a.⇾:b.1⊳c⇾:c.⇾:b.2 G_ 55= q p:a.\, q r: [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100b.\, G_1 [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100 1.0mu ^c 1.0mu p q:c.\, q r: [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100b.\, G_2 It is critical that we avoid ambiguities such as those in (2), as they may lead to incorrect semantics for mixed choices. To address this, we introduce a well-formedness condition on initial global types, requiring that all occurrences of a label are exclusively either committing or non-committing. Well-formedness relies on the notion of committing set (Definition˜3.1) and on the dual notion of non-committing set (Definition˜3.3 below). Well-formedness is formally defined in Definition˜3.4 by requiring the committing and non-committing sets to be disjoint. Definition 3.3 (Non-committing set). Let G be an initial global type, and let c be a MC definition in G, and ⇾:S1⊳c⇾:S2 q p:\, [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S_1 [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100 1.0mu ^c 1.0mu p q:\, [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S_2 be the outermost occurrence of c in () U( G). The non-committing set of c in G, denoted ⇑c() ^c -2.84526pt( G), is defined as follows, relying on auxiliary function ⇑c(,C) ^c -2.84526pt( G, [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5C) : ⇑c():-⋃G∈(S1)⇑c(G,)∪⋃G∈(S2)⇑c(G,,) array[]l ^c -2.84526pt( G) 10000\ 10000\ _G∈ types( [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S_1) ^c -2.84526pt(G, [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5\ p\) 10000\ ∪ 10000\ _G∈ types( [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S_2) ^c -2.84526pt(G, [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5\ p, q\) array In contrast to ⇓c() ^c -2.84526pt( G) in Definition˜3.1, ⇑c() ^c -2.84526pt( G) does not include (S1)∪(S2) labels( [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S_1)∪ labels( [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S_2) in the non-committing set of c. Function ⇑c(G,C) ^c -2.84526pt(G, [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5C) is defined like ⇓c(G,C) ^c -2.84526pt(G, [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5C) from Definition˜3.1 except the case for interaction types that is dual: specifically, ⇑c(⇾:S,C) ^c -2.84526pt( p q: [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S, [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5C) returns ⇑c(,C∪) ^c -2.84526pt( G, [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5C∪\ q\) if (∈C∧∉C)( p∈ C 10000\ 10000\ q ∈ C), and returns (S)∪⋃∈(S)⇑c(,C) labels( [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S) 10000\ ∪ 10000\ _ G∈ types( [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S) ^c -2.84526pt( G, [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5C) otherwise. Definition 3.4 (Well-formedness). Initial G is well-formed if for all c in G, ⇑c()∩⇓c()=∅ ^c -2.84526pt( G)\,∩ ^c -2.84526pt( G)= . Since the syntactic structure of () U( G) is finite, well-formedness yields a decidable algorithm based on the definitions of committing and non-committing sets. Hereafter we assume all initial global types to be well-formed. Example 3.5 (Well-formedness). One can verify that the global type ✗ G_ 55 in (2) is not well-formed by observing that b∈⇑c(✗)b∈ 10000\ ^c -2.84526pt( G_ 55) and b∈⇓c(✗)b∈ 10000\ ^c -2.84526pt( G_ 55). One can verify that ✓ G_ 51 below is well-formed by observing that ⇓c(✓)=a,d,e ^c -2.84526pt( G_ 51)=\a,d,e\, ⇑c(✓)=b ^c -2.84526pt( G_ 51)=\b\, and a,d,e∩b=∅\a,d,e\∩\b\= . ✓=μ.(⇾:a.⇾:b.⊳c⇾:d.⇾:e.)(✓)=⇾:a.⇾:b.✓⊳c⇾:d.⇾:e.μ.(⇾:a.⇾:b.⊳c…) array[]l G_ 51&=&μ t.\,( q p: [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0a.\, q r: [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0b.\, t [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100 1.0mu ^c 1.0mu\, p q: [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0d. p r: [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0e.\, t)\\ U( G_ 51)&=& q p: [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0a.\,\, q r: [rgb]1,0,0 [named]pgfstrokecolorrgb1,0,0b.\, G_ 51 [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100 1.0mu ^c 1.0mu p q: [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0d.\, p r: [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0e.\, [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1μ t.\,( q p:a.\, q r: [rgb]1,0,0 [named]pgfstrokecolorrgb1,0,0b.\, t [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100 1.0mu ^c 1.0mu [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1…) array This example is noteworthy: label b occurs multiple times in (✓) U( G_ 51) but all occurrences are consistent as they are all non-committing. The occurrence of b on the RHS of the outer c is non-committing because the receiver r is already committed to that block, having previously received committing label e. 3.2. Semantics of Global Types The semantics of global types is defined as a Labelled Transition System over terms G with labels ℓ:=!a∣?a∣νc := p q!a p q?a ν c !a p q!a (resp. ?a p q?a) denotes the sending (resp. receiving) action of message a from p to q. Label νcν c is for MC instantiation. We define the subject of a label as the singleton set containing the role performing the action described by that label: (!a)=(?a)= sbj( p q!a)= sbj( q p?a)=\ p\. In what follows, we may write p as a shorthand for the singleton \ p\. The subject νcν c is defined to be the empty set. In the LTS we assume knowledge of the original initial (or base) global type from which a given state is reached. We denote it with ¯ G. This is akin to assuming knowledge of the original static protocol specification of an ongoing session. The rules for the LTS are given in Figure˜4. The first set of rules for interactions is given in Figure˜4 (top), and is a minor adaptation of the semantics in (Deniélou and Yoshida, 2013). The remaining rules are new for MC. [] [Inst] instantiates a MC. [] [Ctx1] and [] [Ctx2] handle nested instantiations. The conditions on the roles ensure that once a side is resolved (i.e., no role can act in it anymore), it cannot perform degenerate νcν c transitions that would artificially break our correspondence results (Section˜4.3). In [] [Ctx1], l G_l is resolved when all roles are committed to the right. In [] [Ctx2], r G_r is resolved when some roles commit to the left. The asymmetry in the conditions of [] [Ctx1] and [] [Ctx2] reflects the fact that commitment to the RHS does not immediately preclude actions on the LHS, until all participants have committed. Maintaining the MC contexts, including the resolved sides in the global types (which will be incorporated into the projected local types), is important for correctly characterising stale messages in the projected systems, and thus for ensuring our correspondence results. [] [LSnd] allows a send action by the LHS if the subject p is not committed to the RHS. [] [RSnd] is symmetric, except p is added to ℛR (any action on the RHS is committing). Rules [] [LRcv1] and [] [LRcv2] are for committing and non-committing receive actions on the LHS, respectively. In both cases, the subject q must not be committed on the RHS. [] [RRcv] is similar for receive actions in the RHS. ⇾:ai.ii∈I→!ak :kai.ii∈I(k∈I)[] :kai.ii∈I→?akk[] ∈∀iIℓ→GiG′ip,∉qsbj(ℓ) ⇾pq:ai.Gi∈iIℓ→p⇾q:ai.G′i∈iI [] ℓ→G[μt./Gt]G′ μt.ℓ→G′ [] ℓ→GkG′k∉qsbj(ℓ)∈∀i∖Ik.=GiGi′ pq:kai.Gi∈iIℓ→p q:kai.G′i∈iI []1⊳c2→νc1▶∅,∅c2[] Glνc→Gl′R(¯G)≠R G=Gl▶L,RGrνc→G′l▶L,RGr [] Grνc→Gr′L=∅ G=Gl▶L,RGrνc→Gl▶L,RGr′ [] Gl!pqa→Gl′p∉R Gl▶L,RGr!pqa→G′l▶L,RGr [] pq?a→GlGl′∉qR∈a⇓c(¯G) Gl▶cL,RGrpq?a→G′l▶c∪Lq,RGr [] pq?a→GlGl′∉qR∉a⇓c(¯G) Gl▶cL,RGrpq?a→G′l▶cL,RGr [] !pqa→GrGr′∉pL Gl▶L,RGr!pqa→Gl▶L,∪RpG′r [] pq?a→GrGr′∉qL Gl▶L,RGrpq?a→Gl▶L,∪RqG′r [] array[]c array[]c p q:\a_i. G_i\_i∈ I 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q!a_k 10000\ p 0.56905pt to8.94pt to3.31pt -1.65598pt to0.0pt @beginscope @invoke pgfstrokecolorrgb0,0,0 @color@rgb@stroke000 @invoke @color@rgb@fill000 @invoke @setlinewidth @invoke to0.0pt @beginscope @invoke @beginscope @invoke @roundcap @invoke @moveto0.0pt0.0pt @lineto0.0pt0.0pt @lineto0.92499pt0.8pt @lineto2.775pt-0.8pt @lineto4.625pt0.8pt @lineto5.55002pt0.0pt @lineto5.55002pt0.0pt @lineto5.56764pt0.0pt @stroke @invoke @beginscope @invoke @transformcm1.00.00.01.05.66763pt0.0pt @invoke @invoke @invoke @endscope @invoke @endscope @invoke @endscope @discardpath @invoke @endscope q:k\a_i. G_i\_i∈ I 10000\ 10000\ 10000\ (k∈ I) 10000\ 10000\ [Snd]\\[8.5359pt] p 0.56905pt to8.94pt to3.31pt -1.65598pt to0.0pt @beginscope @invoke pgfstrokecolorrgb0,0,0 @color@rgb@stroke000 @invoke @color@rgb@fill000 @invoke @setlinewidth @invoke to0.0pt @beginscope @invoke @beginscope @invoke @roundcap @invoke @moveto0.0pt0.0pt @lineto0.0pt0.0pt @lineto0.92499pt0.8pt @lineto2.775pt-0.8pt @lineto4.625pt0.8pt @lineto5.55002pt0.0pt @lineto5.55002pt0.0pt @lineto5.56764pt0.0pt @stroke @invoke @beginscope @invoke @transformcm1.00.00.01.05.66763pt0.0pt @invoke @invoke @invoke @endscope @invoke @endscope @invoke @endscope @discardpath @invoke @endscope q:k\a_i. G_i\_i∈ I 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q?a_k 10000\ G_k 10000\ 10000\ 10000\ [Rcv] 10000\ 10000\ 10000\ 18.49988pt $ 74.91872pt $ ∀ i∈ I 18.49988pt G_i 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ G _i 18.49988pt p, q ∈ sbj( )$ 70.21185pt $ p q:\a_i. G_i\_i∈ I 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ p q:\a_i. G _i\_i∈ I$$ 10000\ 10000\ [Cont1]\\[19.91684pt] $ 30.7383pt $ G[μ t. G/ t] 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ G $ 21.13144pt $ μ t. G 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ G $$ 10000\ 10000\ [Rec] 18.49988pt 10000\ 10000\ $ 93.12206pt $ G_k 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ G _k 18.49988pt q ∈ sbj( ) 18.49988pt∀ i∈ I k.\, G_i= G_i $ 80.5609pt $ p 0.56905pt to8.94pt to3.31pt -1.65598pt to0.0pt @beginscope @invoke pgfstrokecolorrgb0,0,0 @color@rgb@stroke000 @invoke @color@rgb@fill000 @invoke @setlinewidth @invoke to0.0pt @beginscope @invoke @beginscope @invoke @roundcap @invoke @moveto0.0pt0.0pt @lineto0.0pt0.0pt @lineto0.92499pt0.8pt @lineto2.775pt-0.8pt @lineto4.625pt0.8pt @lineto5.55002pt0.0pt @lineto5.55002pt0.0pt @lineto5.56764pt0.0pt @stroke @invoke @beginscope @invoke @transformcm1.00.00.01.05.66763pt0.0pt @invoke @invoke @invoke @endscope @invoke @endscope @invoke @endscope @discardpath @invoke @endscope q:k\a_i. G_i\_i∈ I 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ p 0.56905pt to8.94pt to3.31pt -1.65598pt to0.0pt @beginscope @invoke pgfstrokecolorrgb0,0,0 @color@rgb@stroke000 @invoke @color@rgb@fill000 @invoke @setlinewidth @invoke to0.0pt @beginscope @invoke @beginscope @invoke @roundcap @invoke @moveto0.0pt0.0pt @lineto0.0pt0.0pt @lineto0.92499pt0.8pt @lineto2.775pt-0.8pt @lineto4.625pt0.8pt @lineto5.55002pt0.0pt @lineto5.55002pt0.0pt @lineto5.56764pt0.0pt @stroke @invoke @beginscope @invoke @transformcm1.00.00.01.05.66763pt0.0pt @invoke @invoke @invoke @endscope @invoke @endscope @invoke @endscope @discardpath @invoke @endscope q:k\a_i. G _i\_i∈ I$$ 10000\ 10000\ [Cont2]\\[19.91684pt] \\ array\\ array[]r G_1 [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100 1.0mu ^c 1.0mu G_2 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 ν c 10000\ G_1 1.0mu 1.0mu^c_ , [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_2 10000\ 10000\ [Inst]& $ 39.56021pt $ G_l 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 ν c 10000\ G_l R( G) $ 57.16199pt $ G= G_l 1.0mu 1.0mu_L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_r 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 ν c 10000\ G _l 1.0mu 1.0mu_L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_r$$ 10000\ 10000\ [Ctx1]\\[19.91684pt] $ 34.44838pt $ G_r 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 ν c 10000\ G_r = $ 48.77017pt $ G= G_l 1.0mu 1.0mu 10000\ _L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_r 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 ν c 10000\ G_l 1.0mu 1.0mu 10000\ _L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_r $$ 10000\ 10000\ [Ctx2]& $ 39.36888pt $ G_l 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q!a 10000\ G_l [rgb]0.5,0.5,0 [named]pgfstrokecolorrgb0.5,0.5,0 @color@cmyk@stroke001.5 @color@cmyk@fill001.5 p $ 54.02489pt $ G_l 1.0mu 1.0mu_L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_r 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q!a 10000\ G _l 1.0mu 1.0mu_L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_r$$ 10000\ 10000\ [LSnd]\\[22.76228pt] $ 70.28879pt $ G_l 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q?a 10000\ G_l 18.49988pt [rgb]0.5,0.5,0 [named]pgfstrokecolorrgb0.5,0.5,0 @color@cmyk@stroke001.5 @color@cmyk@fill001.5 q 18.49988pta∈ ^c -2.84526pt( G)$ 45.73222pt $ G_l 1.0mu 1.0mu^c_L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_r 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q?a 10000\ G _l 1.0mu 1.0mu^c_L∪\ q\,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_r$$ 10000\ 10000\ [LRcv1]& $ 73.66379pt $ G_l 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q?a 10000\ G_l 18.49988pt [rgb]0.5,0.5,0 [named]pgfstrokecolorrgb0.5,0.5,0 @color@cmyk@stroke001.5 @color@cmyk@fill001.5 q 18.49988pta ∈ ^c -2.84526pt( G)$ 45.73222pt $ G_l 1.0mu 1.0mu^c_L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_r 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q?a 10000\ G _l 1.0mu 1.0mu^c_L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_r$$ 10000\ 10000\ [LRcv2]\\[25.6073pt] $ 44.80702pt $ G_r 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q!a 10000\ G_r 18.49988pt [rgb]0.5,0.5,0 [named]pgfstrokecolorrgb0.5,0.5,0 @color@cmyk@stroke001.5 @color@cmyk@fill001.5 p $ 61.66504pt $ G_l 1.0mu 1.0mu_L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_r 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q!a 10000\ G_l 1.0mu 1.0mu_L,R∪\ p\ [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G _r$$ 10000\ 10000\ [RSnd]& $ 45.52159pt $ G_r 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q?a 10000\ G_r 18.49988pt [rgb]0.5,0.5,0 [named]pgfstrokecolorrgb0.5,0.5,0 @color@cmyk@stroke001.5 @color@cmyk@fill001.5 q $ 62.37962pt $ G_l 1.0mu 1.0mu_L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_r 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q?a 10000\ G_l 1.0mu 1.0mu_L,R∪\ q\ [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G _r$$ 10000\ 10000\ [RRcv] array array Figure 4. Global semantics: standard rules (top) and new rules for MC (bottom) Let ℓ=ℓ0,…,ℓn = _0,…, _n be a (possibly empty) vector. We write 0→ ℓn+1 G_0 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ G_n+1 if ∀i∈0,…,n.i→ℓi+1i+1∀ i∈0,…,n.\, G_i 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 _i+1 10000\ G_i+1, (or simply →∗′ G 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ -3.44444pt^* 10000\ G when labels are irrelevant). We say ′ G is reachable from G if →∗′ G 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ -3.44444pt^* 10000\ G . We just say ′ G is reachable if it is reachable from an initial global type. Labels or reached states may be omitted. The LTS for global types has a monotonicity property: the sets ℒL and ℛR of a MC are monotonically non-decreasing with respect to transition. Example 3.6 (Global MC steps). One way a well-formed MC may proceed is shown below. In the second line, assume 1→∗1′ G_1 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ -3.44444pt^* 10000\ G_1 on the LHS where observer p is not the subject in any of those steps. ⇾:a1.1⊳c⇾:a2.2→νc⇾:a1.1▶∅,∅c⇾:a2.2→∗ :a1a1.1′▶∅,∅c⇾:a2.2(∗) array[]l q p:a_1. G_1 [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100 1.0mu ^c 1.0mu p q:a_2. G_2& 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 ν c 10000& q p:a_1. G_1 _ , ^c p q:a_2. G_2\\ & 10000\ 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ -3.44444pt^* 10000& q 0.56905pt to8.94pt to3.31pt -1.65598pt to0.0pt @beginscope @invoke pgfstrokecolorrgb0,0,0 @color@rgb@stroke000 @invoke @color@rgb@fill000 @invoke @setlinewidth @invoke to0.0pt @beginscope @invoke @beginscope @invoke @roundcap @invoke @moveto0.0pt0.0pt @lineto0.0pt0.0pt @lineto0.92499pt0.8pt @lineto2.775pt-0.8pt @lineto4.625pt0.8pt @lineto5.55002pt0.0pt @lineto5.55002pt0.0pt @lineto5.56764pt0.0pt @stroke @invoke @beginscope @invoke @transformcm1.00.00.01.05.66763pt0.0pt @invoke @invoke @invoke @endscope @invoke @endscope @invoke @endscope @discardpath @invoke @endscope p:a_1\a_1. G_1 \ _ , ^c p q:a_2. G_2 (*)\\ array The marked state may then proceed one of two ways. In the upper of the paths below, observer p also commits to the LHS, followed by q and other roles after some more steps. (∗)(*)1′▶,∅c⇾:a2.2 G_1 _\ p\, ^c [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5 p q:a_2. G_2→∗1′▶,,…,∅c⇾:a2.2 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ -3.44444pt^* 10000\ 10000\ G_1 _\ p, q,...\, ^c [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5 p q:a_2. G_2 :a1a1.1′▶∅,c :a2a2.2′→∗ :a1a1.1′▶∅,,,…c2′ q 0.56905pt to8.94pt to3.31pt -1.65598pt to0.0pt @beginscope @invoke pgfstrokecolorrgb0,0,0 @color@rgb@stroke000 @invoke @color@rgb@fill000 @invoke @setlinewidth @invoke to0.0pt @beginscope @invoke @beginscope @invoke @roundcap @invoke @moveto0.0pt0.0pt @lineto0.0pt0.0pt @lineto0.92499pt0.8pt @lineto2.775pt-0.8pt @lineto4.625pt0.8pt @lineto5.55002pt0.0pt @lineto5.55002pt0.0pt @lineto5.56764pt0.0pt @stroke @invoke @beginscope @invoke @transformcm1.00.00.01.05.66763pt0.0pt @invoke @invoke @invoke @endscope @invoke @endscope @invoke @endscope @discardpath @invoke @endscope p:a_1\a_1. G_1 \ _ ,\ p\^c p 0.56905pt to8.94pt to3.31pt -1.65598pt to0.0pt @beginscope @invoke pgfstrokecolorrgb0,0,0 @color@rgb@stroke000 @invoke @color@rgb@fill000 @invoke @setlinewidth @invoke to0.0pt @beginscope @invoke @beginscope @invoke @roundcap @invoke @moveto0.0pt0.0pt @lineto0.0pt0.0pt @lineto0.92499pt0.8pt @lineto2.775pt-0.8pt @lineto4.625pt0.8pt @lineto5.55002pt0.0pt @lineto5.55002pt0.0pt @lineto5.56764pt0.0pt @stroke @invoke @beginscope @invoke @transformcm1.00.00.01.05.66763pt0.0pt @invoke @invoke @invoke @endscope @invoke @endscope @invoke @endscope @discardpath @invoke @endscope q:a_2\a_2. G_2 \ 10000\ 10000\ 10000\ 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ -3.44444pt^* 10000\ 10000\ [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5 q 0.56905pt to8.94pt to3.31pt -1.65598pt to0.0pt @beginscope @invoke [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @invoke @color@gray@fill.5 @invoke @setlinewidth @invoke to0.0pt @beginscope @invoke @beginscope @invoke @roundcap @invoke @moveto0.0pt0.0pt @lineto0.0pt0.0pt @lineto0.92499pt0.8pt @lineto2.775pt-0.8pt @lineto4.625pt0.8pt @lineto5.55002pt0.0pt @lineto5.55002pt0.0pt @lineto5.56764pt0.0pt @stroke @invoke @beginscope @invoke @transformcm1.00.00.01.05.66763pt0.0pt @invoke @invoke @invoke @endscope @invoke @endscope @invoke @endscope @discardpath @invoke @endscope p:a_1\a_1. G_1 \ _ ,\ p, q,…\^c G_2 →?a1 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 q p?a_1 10000\ →!a2 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q!a_2 10000\ The lower path corresponds to the race condition situation where q instead commits on the RHS, leading to a (transient) period with active interactions (e.g., 0.56905pt to8.94pt to3.31pt -1.65598pt to0.0pt @beginscope @invoke pgfstrokecolorrgb0,0,0 @color@rgb@stroke000 @invoke @color@rgb@fill000 @invoke @setlinewidth @invoke to0.0pt @beginscope @invoke @beginscope @invoke @roundcap @invoke @moveto0.0pt0.0pt @lineto0.0pt0.0pt @lineto0.92499pt0.8pt @lineto2.775pt-0.8pt @lineto4.625pt0.8pt @lineto5.55002pt0.0pt @lineto5.55002pt0.0pt @lineto5.56764pt0.0pt @stroke @invoke @beginscope @invoke @transformcm1.00.00.01.05.66763pt0.0pt @invoke @invoke @invoke @endscope @invoke @endscope @invoke @endscope @discardpath @invoke @endscope ) by roles on both sides of the MC. However, assuming that all roles have appropriate inputs on the RHS by which they can learn of q’s decision (such as the a1a_1 input by p), they will eventually follow the observer into committing on the RHS and no further actions will occur on the LHS. The conditions for ensuring safe eventual commitment by all roles are formalised in the next subsection. 3.3. Progress of Global Types Progress ensures that any role ∈() p∈ R( G) either (1) can make a move (immediately or after actions by other roles) or (2) is in a final state. Intuitively, this means that no role is permanently stuck. The notion of final state is captured syntactically by () R( G): if ∈() r∈ R( G) then r is not in a final state (i.e., it is still active in G). Recall that (1▶ℒ,ℛ2)=(1)∖ℛ∪(2)∖ℒ R( G_1 1.0mu 1.0mu_L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_2)= R( G_1) 10000\ ∪ 10000\ R( G_2) and hence, once a role is committed to one block, it is not active in the other block. For example, both p and q are in a final state in :a.▶∅,, p 0.56905pt to8.94pt to3.31pt -1.65598pt to0.0pt @beginscope @invoke pgfstrokecolorrgb0,0,0 @color@rgb@stroke000 @invoke @color@rgb@fill000 @invoke @setlinewidth @invoke to0.0pt @beginscope @invoke @beginscope @invoke @roundcap @invoke @moveto0.0pt0.0pt @lineto0.0pt0.0pt @lineto0.92499pt0.8pt @lineto2.775pt-0.8pt @lineto4.625pt0.8pt @lineto5.55002pt0.0pt @lineto5.55002pt0.0pt @lineto5.56764pt0.0pt @stroke @invoke @beginscope @invoke @transformcm1.00.00.01.05.66763pt0.0pt @invoke @invoke @invoke @endscope @invoke @endscope @invoke @endscope @discardpath @invoke @endscope q:\a. end\\, 1.0mu 1.0mu_ ,\ p, q\ [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 end. Definition 3.7 (Progress). G enjoys progress if for all ′ G reachable from G the following holds: ∈(′)⇒′→∗→ℓ with (ℓ)= r∈ R( G ) G 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 -3.44444pt^* 10000\ -5.69046pt 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ 10000\ with 10000\ sbj( )= r As standard in MST (Honda et al., 2008; Coppo et al., 2016), not all global types enjoy progress. We give two sufficient333Complete decidable conditions are, unfortunately, not possible (Gouda et al., 1984). conditions for progress: awareness and balance. Awareness guarantees that each role eventually commits when the RHS is taken, and that each role with a terminating execution commits when the LHS is taken. Awareness builds on two relations over roles (Definition˜3.8). Definition 3.8 (Role dependencies <<_ G and ≪ _ G). Let ,∈() p, q∈ R( G). We define two kinds of dependencies between roles: strict dependence, written < p<_ G q, and eventual dependence, written ≪ p _ G q. • < p<_ G q, if →ℓ→ℓ∧(ℓ)= G 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 \, _ q 10000\ 10000\ 10000\ sbj( _ q)= q implies ∃ℓ∈ℓ→.(ℓ)=∃ ∈ . 10000\ sbj( )= p • ≪ p _ G q, if →ℓ→′ G 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ G implies ∃a.!a∈ℓ→∨′→∗→!a∃ a. 10000\ p q!a∈ 10000\ 10000\ G 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 -3.44444pt^* 10000\ 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q!a 10000\ Namely: < p<_ G q if q will only take action after p does, and ≪ p _ G q if it is always possible for p to send a message to q. We say that p diverges in G if →∗′ G 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 -3.44444pt^* 10000\ G implies ′→∗→ℓ G 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 -3.44444pt^* 10000\ 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ with (ℓ)= sbj( )= p. Definition 3.9 (Awareness). An active MC =1▶ℒ,ℛ2 G= G_1 1.0mu 1.0mu p_L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_2 is aware if for all ∈()∖ r∈ R( G) p: (1) ℛ=∅⟹<2 10000\ R= 10000\ 10000\ p<_ G_2 r (single-decision), (2) ℒ=∅⟹≪1 10000\ L= 10000\ 10000\ p _ G_1 r or r diverges in 1 G_1 (clear-termination). Similarly, an MC definition =1⊳2 G= G_1 [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100 1.0mu p 1.0mu G_2 is aware if for all ∈() r∈ R( G), <2 p<_ G_2 r and ≪1 p _ G_1 r. A global type G is aware if all MC definitions and active MC in () U( G) are aware. Single-decision requires that, on the RHS, all roles depend on the observer until committed. Clear termination allows the roles to start communicating on the LHS without waiting for a committing message. However, if their execution terminates, they must receive a committing message; this is key to progress, as illustrated below in Example 3.10. The use of () U( G) is necessary to deal with label capture (as shown in Example 3.2). Example 3.10 (Clear termination). In the type below (left): if observer p receives a and terminates, then q is unable to locally determine whether to terminate or continue waiting for a b that will never arrive (i.e., termination is not clear); one fix is to add ⇾:c p q:c on the LHS. As a generalisation, however we can safely lift eventual dependency for infinite executions, as shown in a stream exception pattern below (right) where q establishes a communication (label c) and immediately starts the stream, and potentially handle later a connection failure message (b by p): ⇾:a.⊳⇾:b.✗⇾:c.μ.(⇾:a.)⊳⇾:b.✓ q p:a. 10000\ end [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100 1.0mu 1.0mu p q:b. 10000\ end 10000\ 10000\ [rgb]1,0,0 [named]pgfstrokecolorrgb1,0,0 55 q p:c.\,μ t.( q p:a. 10000\ t) [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100 1.0mu 1.0mu p q:b. 10000\ end 10000\ 10000\ [rgb]0,1,0 [named]pgfstrokecolorrgb0,1,0 51 Consider now a third-party exception below, where a ‘third-party’ observer r may decide, after some interactions between p and q, to either commit on the LHS or raise the RHS exception: ⇾:c.μ.(⇾:a.)⊳⇾:b.⇾:b.✓ q r:c.\,μ t.( q p:a. 10000\ t) [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100 1.0mu 1.0mu r q:b.\, r p:b. 10000\ end 10000\ 10000\ [rgb]0,1,0 [named]pgfstrokecolorrgb0,1,0 51 Clear-termination holds because: (i) r is able to commit to the LHS by receiving c, (i) all other roles ( p, q) do not need to commit because they diverge within the LHS. Example 3.11 (Interrupt pattern). Interrupts can be modelled with a minor extension to the theory (implemented in Section˜5.2), if we allow the observer to interact on the LHS before committing on that side. To this aim, allocate a set D [rgb]1,0,0 [named]pgfstrokecolorrgb1,0,0D of choice labels used by observers to commit on the LHS. The interrupt pattern can then be expressed as the global type below, letting d∈D [rgb]1,0,0 [named]pgfstrokecolorrgb1,0,0d∈ [rgb]1,0,0 [named]pgfstrokecolorrgb1,0,0D and a,b,c∉Da,b,c ∈ [rgb]1,0,0 [named]pgfstrokecolorrgb1,0,0D: ⇾:c.μ.(⇾:a.,d.⇾:e.)⊳⇾:b. q p:c.\,μ t.( q p:\a. 10000\ t,\, [rgb]1,0,0 [named]pgfstrokecolorrgb1,0,0d.\, p q:e.\, end\) [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100 1.0mu 1.0mu p q:b. 10000\ end Unlike in the stream exception (Example 3.10), now p can repeatedly receive messages a from q before, possibly, throwing the interrupt b (or committing/terminating on the LHS). Our theory can be easily adapted to support interrupt patterns using D [rgb]1,0,0 [named]pgfstrokecolorrgb1,0,0D by: (1) updating the definition of committing set so that the committing chains on the LHS start with actions in D [rgb]1,0,0 [named]pgfstrokecolorrgb1,0,0D (see Section˜C.1), (2) adjusting the existential quantifier in Definition˜3.8 (eventual dependence ≪ _ G) by requiring label a to be in D [rgb]1,0,0 [named]pgfstrokecolorrgb1,0,0D (i.e., ∃a∈D∃a∈ [rgb]1,0,0 [named]pgfstrokecolorrgb1,0,0D). Awareness ensures convergence of the roles in a block by requiring dependencies with the observer. However, if a role does not appear in some execution branches, it may not be able to converge with the observer’s decision. This is a known problem also with branching choices: (3) ⇾:a.⇾:c.,b.⇾:c. p q:\a.\, q r:\c. end\, 10000\ b.\, q p:\c. end\\ In (3), role r does not know whether to terminate or wait for a message, and thus does not terminate. Balance (Definition˜3.12) generalizes this idea to MC, operating on the unfolding () U( G) to account for label capture. Definition˜3.12 also uses a truncation operator () Trunc( G) that replaces each recursive subterm in G with end. Assuming G has no free recursion variables: (μ.′)=()= Trunc(μ t. G )= Trunc( end)= end. All other cases are defined inductively. Truncation prevents expressiveness loss: Definition˜3.12 universally quantifies over subterms of () U( G) which would consider recursive subterms out of their intended context. For example, without truncation any instantiation of example (1) in Section˜3.1 would (unnecessarily) be excluded as unbalanced. Definition 3.12 (Balance). A global type G is balanced if for all subterms ′ G of (()) Trunc( U( G)): (1) ′=⇾:S⇒∀1,2∈(S),(1)∖,=(2)∖, G = p q: [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S 10000\ 10000\ 10000\ 10000\ ∀ G_1, G_2∈ types( [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S), 10000\ 10000\ R( G_1) \ p, q\= R( G_2) \ p, q\ (2) ′=1⊳2⇒(1)=(2) G = G_1 [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100 1.0mu 10000\ 1.0mu G_2 10000\ 10000\ 10000\ 10000\ R( G_1)= R( G_2) (3) ′=1▶ℒ,ℛ2⇒(1)∪ℒ=(2)∪ℛ G = G_1 1.0mu 1.0mu 10000\ _L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_2 10000\ 10000\ 10000\ 10000\ R( G_1) = R( G_2) Case (3) allows committed roles to ‘disappear’ from a block. Case (1) is normally entailed by projection. We give it here for a simpler presentation and separation of concerns. Theorem 3.13 (Progress). If G is initial, aware, and balanced then it enjoys progress. The proof relies on a coherence property: all the committed roles are committed to the same side. Formally, if =[1▶ℒ,ℛ2] G=C[\, G_1 1.0mu 1.0mu_L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_2\,] then ℒ=∅∨ℛ=∅L= \, \,R= . Essentially, we prove that (1) awareness, balance, and coherence are preserved by transition, and (2) balanced, aware, and coherent global types enjoy progress. Theorem˜3.13 follows since initial global types are always coherent. See Section˜D.8 for details of the proofs. 4. Local Types The syntax of local types is given by the following grammar: ::=&i∈Iai.i∣⊕i∈Iai.i∣μ.∣1⊳c2∣1▶c2∣▶c∙∣∙▶c L::= p \&_i∈ Ia_i. L_i 10000\ 10000\ p _i∈ Ia_i. L_i 10000\ 10000\ μ t. L 10000\ 10000\ t 10000\ 10000\ end 10000\ 10000\ L_1 [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100 1.0mu ^c 1.0mu L_2 10000\ 10000\ L_1 1.0mu ^c 1.0mu L_2 10000\ 10000\ L 1.0mu ^c 1.0mu 10000\ 10000\ 1.0mu ^c 1.0mu L The first five terms are standard; the notation for roles and labels are as in global types. We recall &i∈Iai.i p \&_i∈ Ia_i. L_i is a branching type, waiting for one of the labels aii∈I\a_i\_i∈ I and continuing as the corresponding i L_i. Term ⊕i∈Iai.i p _i∈ Ia_i. L_i is the corresponding send/selection type. We often omit end. Terms 1⊳c2 L_1 [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100 1.0mu ^c 1.0mu L_2 and 1▶c2 L_1 1.0mu ^c 1.0mu L_2 are for MC definition and active MC, respectively. The terms ▶c∙ L 1.0mu ^c 1.0mu and ∙▶c 1.0mu ^c 1.0mu L model run-time states in which the role has committed on the LHS or the RHS, respectively. We omit the annotation c when it is clear from context or not relevant. In-transit/buffered (i.e., yet to be consumed) messages are modelled using FIFO queues. The localised view of a global type for a given role is thus a configuration (,,σ)( p, L,σ) where p is the role, L is the local type specifying the behaviour of p, and σ is a local FIFO queue of messages that have been sent to p (and possibly arrived) but not consumed. A global type therefore corresponds overall to a collection of local configurations. We call this collection a system, ranged over by Y,Y′Y,Y . Y::=(i,i,σi)i∈Iσ:↦ m::=(a,π)π::=ϵ|l.π|r.π array[]lY::=( p_i, L_i, _i)_i∈ I 10000\ 10000\ &σ: q m 10000\ 10000\ &m::=(a,\,π) &π::=ε\;|\; l.π\;|\; r.π array We assume the configurations of a system have pairwise-distinct roles. Messages carry a path π, which fully qualifies the active MC context under which the message was sent. A path specifies left-to-right the top-most MC to the inner MC of the sending local type. We often omit the trailing ϵε. As an example, (1▶⊕a)▶⊕b( L_1 [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100 p a) [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100 p b may send two messages: (a,l.r)(a,\, l. r) and (b,r)(b, r). In global types, the equivalent path information is implicit in the global type context (nested active MCs) in which the corresponding in-transit message term ( 0.56905pt to8.94pt to3.31pt -1.65598pt to0.0pt @beginscope @invoke pgfstrokecolorrgb0,0,0 @color@rgb@stroke000 @invoke @color@rgb@fill000 @invoke @setlinewidth @invoke to0.0pt @beginscope @invoke @beginscope @invoke @roundcap @invoke @moveto0.0pt0.0pt @lineto0.0pt0.0pt @lineto0.92499pt0.8pt @lineto2.775pt-0.8pt @lineto4.625pt0.8pt @lineto5.55002pt0.0pt @lineto5.55002pt0.0pt @lineto5.56764pt0.0pt @stroke @invoke @beginscope @invoke @transformcm1.00.00.01.05.66763pt0.0pt @invoke @invoke @invoke @endscope @invoke @endscope @invoke @endscope @discardpath @invoke @endscope ) occurs. 4.1. Operational Semantics The local operational semantics uses the labels below and two main judgments: ℓ::=!a|?a|νc|ρY→ℓY′π:Y→ℓY′ array[]c ::= p q!a\;|\; p q?a\;|\;ν c\;|\;ρ Y 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ Y [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5π: [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0Y 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ Y array Labels ℓ now include ρ for stale message purging from local queues. The first judgment Y→ℓY′Y 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ Y is for top-level concurrent execution of systems. It has just three rules. ℓ→Y′ ℓ→Y,Y′Y′,Y′ [Par] =gc(L,σ)σ′ ρ→(p,L,σ)(p,L,σ′) [Discard] :ϵℓ→Y′ ℓ→Y′ [Low] array[]c 4.78665pt $ $ 18.54918pt $ Y 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ Y $ 32.11783pt $ Y,Y 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ Y ,Y $$ to0.0pt$\; [Par]$ $ 18.49988pt 18.49988pt 5.03665pt $ $ 25.24113pt $ gc( L,σ)=σ $ 38.96638pt $ ( p, L,σ) 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 ρ 10000\ ( p, L,σ )$$ to0.0pt$\; [Discard]$ $ 18.49988pt 18.49988pt 18.49988pt 3.91165pt $ $ 23.12502pt $ [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5ε: [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0Y 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ Y $ $ Y 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ Y $$ to0.0pt$\; [Low]$ $ array Rule [Par] is a structural rule that models concurrent execution. Rule [Low] uses lower-level judgments of the form π:Y→ℓY′ [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5π: [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0Y 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ Y (see below). Rule [Discard] performs stale message purging on the local queue σ of a configuration. This is necessary to maintain correspondence between the executions of global and local types. Consider the example in (4) where the right-hand side term is reached after the following sequence of actions: (1) q sends c to p and commits to the RHS, (2) p sends a to q (on the LHS), (3) p receives c and commits to the RHS, (3) p sends d to q on the RHS. (4) Y,(,&a.⊕b.▶⊕c.&d.,σ)→∗Y′,(,∙▶&d.,σ:↦(a,l),(d,r))Y,( q,\, p\&a. p b. end 1.0mu 1.0mu p c. p\&d. end,σ) 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 -3.44444pt^* 10000\ Y ,( q,\, 1.0mu 1.0mu p\&d. end,σ: p (a, l),(d, r)) In the reached term – on the right-hand side of (4) – the enqueued message (a,l)(a, l) pertains to the LHS of the MC and is essentially garbage. The presence of (a,l)(a, l) in q’s queue would naively break correspondence (Section˜4.3) with the projection of the corresponding metatheoretical global type :a.⇾:b.▶∅,, :d. p 0.56905pt to8.94pt to3.31pt -1.65598pt to0.0pt @beginscope @invoke pgfstrokecolorrgb0,0,0 @color@rgb@stroke000 @invoke @color@rgb@fill000 @invoke @setlinewidth @invoke to0.0pt @beginscope @invoke @beginscope @invoke @roundcap @invoke @moveto0.0pt0.0pt @lineto0.0pt0.0pt @lineto0.92499pt0.8pt @lineto2.775pt-0.8pt @lineto4.625pt0.8pt @lineto5.55002pt0.0pt @lineto5.55002pt0.0pt @lineto5.56764pt0.0pt @stroke @invoke @beginscope @invoke @transformcm1.00.00.01.05.66763pt0.0pt @invoke @invoke @invoke @endscope @invoke @endscope @invoke @endscope @discardpath @invoke @endscope q:a. q p:b. end _ ,\ p, q\ p 0.56905pt to8.94pt to3.31pt -1.65598pt to0.0pt @beginscope @invoke pgfstrokecolorrgb0,0,0 @color@rgb@stroke000 @invoke @color@rgb@fill000 @invoke @setlinewidth @invoke to0.0pt @beginscope @invoke @beginscope @invoke @roundcap @invoke @moveto0.0pt0.0pt @lineto0.0pt0.0pt @lineto0.92499pt0.8pt @lineto2.775pt-0.8pt @lineto4.625pt0.8pt @lineto5.55002pt0.0pt @lineto5.55002pt0.0pt @lineto5.56764pt0.0pt @stroke @invoke @beginscope @invoke @transformcm1.00.00.01.05.66763pt0.0pt @invoke @invoke @invoke @endscope @invoke @endscope @invoke @endscope @discardpath @invoke @endscope q:\,d. end. Fortunately, local types allow us to define a purge function gc that operates solely on information that is local to the configuration. In the general case of nested MC, we identify stale messages by traversing the MC structures of the receiver’s local type L using the sender’s path π included in the message. This check is defined inductively as a predicate (π,) stale(π, L), which returns true if following π in L hits a stale (∙ ) side. Below, the otherwise cases may include non-initialized MC which are never stale as still uncommitted, and (ϵ,)= stale(ε, L)= false for all L. (l.π,)==∙▶2(π,1)=1▶2 or =1▶∙otherwise(r.π,)==1▶∙(π,2)=1▶2 or =∙▶2otherwise array[]llcll array[]llcll stale( l.π, L)= cases true& L= L_2\\ stale(π, L_1)& L= L_1 L_2 or \\ & 10000\ L= L_1 \\ false&otherwise cases&& stale( r.π, L)= cases true& L= L_1 \\ stale(π, L_2)& L= L_1 L_2 or \\ & 10000\ L= L_2\\ false&otherwise cases array array Purge (a.k.a. garbage collection) (,σ) gc( L,σ) looks into σ (for all p in its domain) and removes all messages (a,π)(a,π) for which (π,) stale(π, L) is true. Lower-level judgements π⊢Y→ℓY′π Y 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ Y model the main behaviour of configurations. The environment π records the MC context for messages being sent. The first three rules in Figure 5 are standard for communications and recursion. Rule [Snd] appends an aka_k message to the receiver’s queue and continues as k L_k. The message is annotated with π from the context. Dually, rule [Rcv] consumes the first such message aka_k annotated by π and continues as k L_k. [Rec] is standard. The remaining rules are new and define the semantics for MC. [New] instantiates a MC definition. [LSnd] executes an output action in the LHS of an active but not committed MC. The context π is updated to π.lπ. l to indicate the action is happening on the LHS of the current MC. Analogously to global types, sending on the LHS is never committing. For LHS receive actions we have two rules: [LRcv1] (committing) and [LRcv2] (non-committing). As in the global semantics, we infer committing labels from the base ¯ G.444Observe that this is purely static information and can be derived (pre-processed) from the source global type. Equivalently, we could embed this information into local types by adding annnotations. [RSnd] is for sending on the RHS which is always committing; likewise [RRcv] for receiving on the RHS (symmetric to [LRcv1]). See Section˜E.1 for the full rules, including a structural rule [RCtxt] (which is symmetric to [LCtxt]), and structural rules [NLCtxt] and [NRCtxt] for νcν c actions on the LHS and RHS of 1▶2 L_1 L_2, respectively. ∈kI=m(ak,π) π:(p,q⊕∈iIai.Li,σ),(q,L,σ′[↦p ])!pqak→(p,Lk,σ),(q,L,σ′[↦p⋅ ]) [Snd] ∈kI= ⋅ 1(ak,π) 2∉(a,π) 1 :πpq?ak→(q,p&∈iIai.Li,σ[↦p ])(q,Lk,σ[↦p⋅ 1 2]) [Rcv] :πℓ→(p,L[μt./Lt],σ),Y′ :πℓ→(p,μt.L,σ),Y′ π:(,⊳c′,σ)→νc(,▶c′,σ)[Rec/New] π.l:(p,L1,σ),Y!pqa→(p,L′1,σ),Y′ π:(▶p,L1L2,σ),Y!pqa→(▶p,L′1L2,σ),Y′ π.r:(p,L2,σ),Y!pqa→(p,L′2,σ),Y′ π:(▶p,L1L2,σ),Y!pqa→(p,∙▶L′2,σ),Y′ [LSnd/RSnd] ∈π.l:(p,L1,σ)pq?a→(p,L′1,σ′)a⇓c(¯G) :πpq?a→(▶p,L1L2,σ)(▶p,L′1∙,σ′) ∉π.l:(p,L1,σ)pq?a→(p,L′1,σ′)a⇓c(¯G) :πpq?a→(▶p,L1L2,σ)(▶p,L′1L2,σ′) [LRcv1/2] π.r:(q,L2,σ)pq?a→(q,L′2,σ′) :πpq?a→(▶q,L1L2,σ)(q,∙▶L′2,σ′) π.l:(p,L,σ),Yℓ→(p,L′,σ′),Y′ π:(▶p,L∙,σ),Yℓ→(▶p,L′∙,σ′),Y′ [RRcv/LCtxt] array[]cr $ 43.20511pt $ k∈ I 18.49988ptm=(a_k,\,π)$ 140.0075pt $ [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5π: [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0( p, q _i∈ Ia_i. L_i,σ),( q, L,σ [ p m]) 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q!a_k 10000\ ( p, L_k,σ),( q, L,σ [ p m· m])$$& [Snd]\\[22.76228pt] $ 108.44254pt $ k∈ I 18.49988pt m= m_1·(a_k,\,π)· m_2 18.49988pt(a,π) ∈ m_1$ 112.68758pt $ [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5π: [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0( q, p \&_i∈ Ia_i. L_i,σ[ p m]) 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q?a_k 10000\ ( q, L_k,σ[ p m_1· m_2])$$& [Rcv]\\[17.07182pt] $ 56.3013pt $ [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5π: [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0( p, L[μ t. L/ t],σ),Y 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ Y $ 47.46527pt $ [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5π: [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0( p,μ t. L,σ),Y 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ Y $$ 18.49988pt [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5π: [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0( p, L [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100 1.0mu ^c 1.0mu L ,σ) 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 ν c 10000\ ( p, L 1.0mu ^c 1.0mu L ,σ)& [Rec/New]\\[17.07182pt] $ 64.10316pt $ array[]l [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5π. l: [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0( p, L_1,σ),Y 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q!a 10000\ ( p, L _1,σ),Y array$ 84.9752pt $ [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5π: [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0( p, L_1 1.0mu 1.0mu L_2,σ),Y 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q!a 10000\ ( p, L _1 1.0mu 1.0mu L_2,σ),Y $$ 10000\ 10000\ 10000\ $ 64.10316pt $ array[]l [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5π. r: [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0( p, L_2,σ),Y 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q!a 10000\ ( p, L _2,σ),Y array$ 82.75024pt $ [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5π: [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0( p, L_1 1.0mu 1.0mu L_2,σ),Y 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q!a 10000\ ( p, 1.0mu 1.0mu L _2,σ),Y $$& [LSnd/RSnd]\\ \\ $ 75.77946pt $ array[]l [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5π. l: [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0( p, L_1,σ) 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q?a 10000\ ( p, L _1,σ ) array [rgb]0.5,0.5,0 [named]pgfstrokecolorrgb0.5,0.5,0 @color@cmyk@stroke001.5 @color@cmyk@fill001.5a∈ ^c -2.84526pt( G)$ 71.92949pt $ [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5π: [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0( p, L_1 1.0mu 1.0mu L_2,σ) 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q?a 10000\ ( p, L _1 1.0mu 1.0mu ,σ )$$ $ 79.15446pt $ array[]l [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5π. l: [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0( p, L_1,σ) 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q?a 10000\ ( p, L _1,σ ) array [rgb]0.5,0.5,0 [named]pgfstrokecolorrgb0.5,0.5,0 @color@cmyk@stroke001.5 @color@cmyk@fill001.5a ∈ ^c -2.84526pt( G)$ 74.15445pt $ [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5π: [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0( p, L_1 1.0mu 1.0mu L_2,σ) 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q?a 10000\ ( p, L _1 1.0mu 1.0mu L_2,σ )$$& [LRcv1/2]\\ \\ $ 54.82407pt $ array[]l [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5π. r: [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0( q, L_2,σ) 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q?a 10000\ ( q, L _2,σ ) array$ 71.92949pt $ [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5π: [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0( q, L_1 1.0mu 1.0mu L_2,σ) 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q?a 10000\ ( q, 1.0mu 1.0mu L _2,σ )$$ $ 61.78996pt $ [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5π. l: [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0( p, L,σ),Y 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ ( p, L ,σ ),Y $ 74.84406pt $ [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5π: [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0( p, L 1.0mu 1.0mu ,σ),Y 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ ( p, L 1.0mu 1.0mu ,σ ),Y $$& [RRcv/LCtxt] array Figure 5. Local semantics, selected rules. See Section˜E.1 for omitted structural rules. and the two context rules, [NLCtxt] and [NRCtxt], for νcν c actions on the LHS and RHS of 1▶2 L_1 L_2, respectively. 4.2. Projection The distributed counterpart of a global type is a system of configurations derived by projection. The projection of a global type G onto a role ∈() r ∈ R( G), written ↾ G r, returns a pair (,σ)( L,σ) of a local type and its queue. Recall, the queue σ is a mapping from roles ′∈() r ∈ R( G) to a vector of messages received, but not consumed, by r from ′ r . The main rules for projection, given in Figure˜6, take a context path π, which is needed to define messages m being enqueued. Top-level projection ↾ G r is bootstrapped as ϵ⊢↾ [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5ε [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 r [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0. π⊢⇾:ai:ii∈I↾=⊕i∈Iai.i,σif =where in all cases ∀i∈I,i,σ=π⊢i↾&i∈Iai.i,σif =⊓i∈Ii,σif ∉,π⊢ :kai.ii∈I↾=k,σkif =&i∈Iai.i,σk[↦(ak,π)⋅σk()]if =k,σkif ∉,where in all cases ∀i∈I,i,σi=π⊢i↾ and ∀i∈I∖k,σi=σ0π⊢1⊳2↾=1⊳2,σ0where ∀i∈1,2,i,σ0=π⊢i↾π⊢1▶ℒ,ℛ2↾=1▶∙,σ1if ∈ℒ and 1,σ1=π.l⊢1↾∙▶2,σ2if ∈ℛ and 2,σ2=π.r⊢2↾1▶2,σ1∘σ2if ∉ℒ∪ℛ and ∀i∈1,2,i,σi=πi⊢i↾ with π1=π.l and π2=π.rπ⊢μ.↾=,σ0 if =π⊢↾=,σ0′,σ0 if =′∧′≠π⊢↾=,σ0μ.,σ otherwise, with π⊢↾=,σ array[]l [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5π [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 p q:\a_i: G_i\_i∈ I [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 r [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0= cases q _i∈ Ia_i. L_i,σ&if r= p in all cases ∀ i∈ I,\, [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 L_i,σ= [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5π [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_i [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 r [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0\\ p\&_i∈ Ia_i. L_i,σ&if r= q \\ _i∈ I L_i,σ&if r ∈\ p, q\ cases\\[19.91684pt] [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5π [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 p 0.56905pt to8.94pt to3.31pt -1.65598pt to0.0pt @beginscope @invoke [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @invoke @color@gray@fill0 @invoke @setlinewidth @invoke to0.0pt @beginscope @invoke @beginscope @invoke @roundcap @invoke @moveto0.0pt0.0pt @lineto0.0pt0.0pt @lineto0.92499pt0.8pt @lineto2.775pt-0.8pt @lineto4.625pt0.8pt @lineto5.55002pt0.0pt @lineto5.55002pt0.0pt @lineto5.56764pt0.0pt @stroke @invoke @beginscope @invoke @transformcm1.00.00.01.05.66763pt0.0pt @invoke @invoke @invoke @endscope @invoke @endscope @invoke @endscope @discardpath @invoke @endscope q:k\,\a_i. G_i\_i∈ I [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 r [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0= cases L_k, _k&if r= p\\ p\&_i∈ Ia_i. L_i,\, _k[ p (a_k,\,π) · _k( p)]&if r= q\\ L_k, _k&if r ∈\ p, q\ cases\\ 122.34692ptwhere in all cases ∀ i∈ I,\, [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 L_i, _i= [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5π [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_i [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 r [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 and ∀ i∈ I \k\,\, _i= _0\\[2.84544pt] [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5π [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_1\, [rgb].75,0,.25 [named]pgfstrokecolorrgb.75,0,.25 \, G_2 [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 r [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 10000\ 10000\ = 10000\ 10000\ L_1\, [rgb].75,0,.25 [named]pgfstrokecolorrgb.75,0,.25 \, L_2, _0 18.49988ptwhere ∀ i∈\1,2\,\, [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 L_i, _0= [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5π [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_i [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 r [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0\\[2.84544pt] [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5π [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_1 1.0mu 1.0mu_L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_2 [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 r [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0= cases L_1 1.0mu 1.0mu , _1&if r ∈L 10000\ 10000\ and 10000\ 10000\ [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 L_1, _1= [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5π. l [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_1 [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 r [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0\\ 1.0mu 1.0mu L_2, _2&if r ∈R 10000\ 10000\ and 10000\ 10000\ [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 L_2, _2= [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5π. r [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_2 [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 r [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0\\ L_1 1.0mu 1.0mu L_2, _1 _2&if r ∈L ∪R 10000\ and 10000\ ∀ i∈\1,2\,\, L_i, _i= [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5 _i [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_i [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 r [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0\\ & with 10000\ _1=π. l 10000\ and 10000\ _2=π. r cases\\[22.76228pt] array[]c [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5π [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0μ t. G [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 r [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0= cases end, _0& 10000\ if G= t 113.81102pt [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5π [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 t [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 r [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0= t, _0\\ t , _0& 10000\ if G= t t ≠ t 78.24507pt [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5π [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 end [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 r [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0= end, _0\\ μ t. L,σ& 10000\ otherwise, with [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5π [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 r [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0= L,σ cases array array Figure 6. Projection of global types to local types and input FIFOs The first two rules for interaction and in-transit messages are standard, except we also project the queues. Notation σ0 _0 stands for an ‘empty queue’ that maps each p in its domain to ϵε. The projection of a message in transit :kai.i p 0.56905pt to8.94pt to3.31pt -1.65598pt to0.0pt @beginscope @invoke pgfstrokecolorrgb0,0,0 @color@rgb@stroke000 @invoke @color@rgb@fill000 @invoke @setlinewidth @invoke to0.0pt @beginscope @invoke @beginscope @invoke @roundcap @invoke @moveto0.0pt0.0pt @lineto0.0pt0.0pt @lineto0.92499pt0.8pt @lineto2.775pt-0.8pt @lineto4.625pt0.8pt @lineto5.55002pt0.0pt @lineto5.55002pt0.0pt @lineto5.56764pt0.0pt @stroke @invoke @beginscope @invoke @transformcm1.00.00.01.05.66763pt0.0pt @invoke @invoke @invoke @endscope @invoke @endscope @invoke @endscope @discardpath @invoke @endscope q:k\,a_i. G_i uses the context π to construct the queued message. The case of projection for an active MC, of the form 1▶2 G_1 1.0mu 1.0mu G_2, uses the operation σ1∘σ2 _1 _2 to concatenate queues: if (σ1)=(σ2) dom( _1)= dom( _2) then σ1∘σ2=↦σ1(r)⋅σ2(r)∣∈(σ1) _1 _2=\ r _1(r) · _2(r) r ∈ dom( _1)\. The behaviour of an MC can be considered as starting from the LHS before possibly switching to the RHS, hence the projection accordingly concatenates the LHS and RHS queues in this order. The notation ⊓i∈Ii _i∈ I L_i is the standard notion of merge (Deniélou and Yoshida, 2012) for projecting onto third-party roles. For example, the projection of ⇾:a1.⇾:a1.,a2.⇾:a2. p q:\a_1.\, q r:\a_1. end\,\,a_2.\, q r:\a_2. end\\ onto r is defined as &a1.⊓&a2. p\&a_1. end p\&a_2. end, yielding &i∈1,2ai. p\&_i∈\1,2\a_i. end. The definition (omitted) implicitly handles MC in the same way as other non-branching constructs, i.e., the projection of each case must be the same. We extend projection to systems and define the system derived from G as ↾=(,,σ)∈() G -2.84526pt \,=\( r, L_ r, _ r)\_ r∈ R( G) where ∀∈().,σ=↾∀ r∈ R( G)\;.\; L_ r, _ r= G r. 4.3. Operational Correspondence We establish an operational correspondence, called fidelity, between global types and the systems obtained by projection. Fidelity is defined as a weak correspondence relation over pairs of global types and systems, treating νcν c and ρ actions as the silent action τ. This correspondence is precise, comprising a top-down and a bottom-up property, as depicted below. G′ G Y_ GY′<:Y′Y [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 <:Y_ G ↾ (bottom-up)→ℓ(bottom-up) 18.49988pt 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ →ℓ 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ →∗ 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 ρ -3.09999pt^* 10000\ ↾ GY_ G′ G Y′<:Y′Y [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0<:Y_ G →ℓ 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ →∗ 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 ρ -3.09999pt^* 10000\ ↾ (top-down)→ℓ(top-down) 18.49988pt 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ ↾ Bottom-up fidelity states that each action of a system can be matched with the same action by the corresponding global type, preserving the correspondence given by projection modulo garbage collection and a preorder ‘<:<:’ over local types (discussed below). Top-down fidelity, conversely, states that each step of G can be matched by a step of Y. The asynchronous nature of mixed choices and the decentralised semantics of systems raise two main challenges: (1) upon commitment of a configuration to a MC block, some messages in its queue may become stale; and (2) localised MC instantiations and recursive unfoldings can cause (a minor form of) misalignment of the configurations. So far, our definitions have paved the way for tackling (1): we use local states ▶∙ L 1.0mu 1.0mu and ∙▶ 1.0mu 1.0mu L to keep track of local commitments, and use function () gc() and action ρ to (locally) identify and remove stale messages. Both top-down and bottom-up fidelity may require some number of ρ steps to preserve correspondence. We address (2) using a preorder ‘<:<:’ on pairs of systems, as we now discuss. In a global type, a MC is instantiated with a single “centralised” action νcν c, whereas the local configurations in the derived system independently perform separate decentralised νcν c actions. Decentralised MC instantiation can cause administrative issues for the correspondence. Consider the global types below where 1=⇾:a1. G_1= q p:a_1. end and c is instantiated before q’s first send action: P=⇾:b.(1⊳c⇾:a2.)→νc→!a2⇾:b.(1▶∅,c :2a2.)=P′ array[]l G_P= q r:b.( G_1 [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100 1.0mu ^c 1.0mu p q:a_2. end) 10000\ 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 ν c 10000\ 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q!a_2 10000\ q r:b.\,( G_1 1.0mu 1.0mu^c_ ,\ p\ [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 p 0.56905pt to8.94pt to3.31pt -1.65598pt to0.0pt @beginscope @invoke [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @invoke @color@gray@fill0 @invoke @setlinewidth @invoke to0.0pt @beginscope @invoke @beginscope @invoke @roundcap @invoke @moveto0.0pt0.0pt @lineto0.0pt0.0pt @lineto0.92499pt0.8pt @lineto2.775pt-0.8pt @lineto4.625pt0.8pt @lineto5.55002pt0.0pt @lineto5.55002pt0.0pt @lineto5.56764pt0.0pt @stroke @invoke @beginscope @invoke @transformcm1.00.00.01.05.66763pt0.0pt @invoke @invoke @invoke @endscope @invoke @endscope @invoke @endscope @discardpath @invoke @endscope q:2\,a_2. end\,)= G_P array Consider now configuration Y_ q obtained by projecting P G_P on q: Y=(,⊕b.(⊕a1.⊳c&a2.),σ0)Y′=(,⊕b.(⊕a1.▶c&a2.),σ0)Y_ q=( q,\, r b.\,( p a_1. end [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100 1.0mu ^c 1.0mu q\,\&\,a_2. end),\, _0) Y _ q=( q,\, r b.\,( p a_1. end 1.0mu ^c 1.0mu q\,\&\,a_2. end),\, _0) In Y_ q, q cannot instantiate the MC before it sends b to r (i.e., Y_ q cannot reduce to Y′Y _ q). Namely, the system derived from P G_P cannot reach the state derived from P′ G_P where all configurations have instantiated c (yet q has not sent b). The preorder ‘<:<:’ is introduced to regulate this deferral of instantiations which may need to be interleaved with other actions. In the example above Y<:Y′Y_ q<:Y _ q. The key rule for MC is given below (left). L is the local type used to bootstrap the derivation at the configuration level (below right). Essentially, the other cases (except for axioms <: end<: end and <: t<: t) are defined inductively, and the preorder is applied to systems pointwise. <:L1′L1<:L2′L2 L1′⊳c<:L2′L1▶cL2 <:L′L <:(p,L′,σ)(p,L,σ) array[]c $ 45.02777pt $ L_1 <: L_1 L_2 10000\ <: 10000\ L_2$ 46.87917pt $ L_1 \, [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100 1.0mu ^c 1.0mu\, L_2 10000\ <: 10000\ L_1 1.0mu ^c 1.0mu L_2$$ $ $ L <: L$ 37.8946pt $ ( p, L ,σ) <:( p, L,σ)$$ array Lemma 4.1 (Bottom-up fidelity). Let G be a global type reachable from an initial, aware, and balanced global type, and let Y=↾Y_ G= G -2.84526pt \,. Then the following holds: (1) Y→ℓY∧ℓ≠ρ⟹→ℓ′∧∃Y′.Y→∗Y′∧Y′<:′↾Y_ G 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ Y 10000\ 10000\ 10000\ ≠ρ 10000\ 10000\ 10000\ 10000\ 10000\ 10000\ 10000\ 10000\ G 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ G ∃ Y . 10000\ Y [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1\, 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 ρ 10000\ -3.41432pt*\,Y 10000\ 10000\ 10000\ 10000\ Y <: G -2.84526pt \, (2) Y→Y⟹Y=Y=↾Y_ G 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 ρ 10000\ Y 10000\ 10000\ 10000\ 10000\ 10000\ 10000\ 10000\ 10000\ Y_ G=Y= G -2.84526pt \, In case (1), if the action by G is committing (say for p), then it may cause some of the messages in p’s queue in Y to become stale, hence a ρ action may be needed to restore correspondence. Case (2) highlights a property of projection: derived systems have no stale messages. Lemma 4.2 (Top-down fidelity). Let G be a global type reachable from an initial, aware, and balanced global type, and let Y=↾Y_ G= G -2.84526pt \,. Then the following holds: (1) →a′⟹∃Y′.Y→a→∗Y′∧Y′<:′↾(∈!,?) G 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q\, (3.0,6.0)[]\,a 10000\ G ∃ Y . 10000\ 10000\ 10000\ Y_ G 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q\, (3.0,6.0)[]\,a 10000\ -5.69054pt [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1\, 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 ρ 10000\ -3.41432pt*\,Y 10000\ 10000\ 10000\ 10000\ 10000\ 10000\ Y <: G -2.84526pt \, (\, (3.0,6.0)[]\,∈\!,?\) (2) →νc′⟹∃Y′.Y→νc→Y′∧Y′<:′↾ G 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 ν c 10000\ G ∃ Y . 10000\ 10000\ 10000\ Y_ G 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 ν c 10000\ Y 10000\ 10000\ 10000\ 10000\ 10000\ 10000\ Y <: G -2.84526pt \, Case (1) is symmetric to case (1) of bottom-up fidelity. In case (2) action ν can be immediately matched with several actions ν by Y (others may be deferred by ‘<:<:’). The operational correspondence is formulated in terms of a weak relation over pairs of global types and systems, where ν and ρ are renamed as τ. We write →∗ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1\, 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ 10000\ -3.41432pt*\, for a possibly empty sequence of τ actions and define @arrow0359 @ℓ=→∗→ℓ→∗ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1\, @arrow 0359 @ \,= [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1\, 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ 10000\ -3.41432pt*\, 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1\, 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ 10000\ -3.41432pt*\, if ℓ≠τ ≠τ and @arrow0359 @ℓ=→∗ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1\, @arrow 0359 @ \,= [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1\, 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ 10000\ -3.41432pt*\, otherwise. Definition 4.3 (Weak Correspondence). A relation ℛR over (,Y)( G,Y) is a weak correspondence if whenever (,Y)∈ℛ( G,Y) then: (1) If →ℓ′ G 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ G then Y @arrow0359 @ℓY′Y [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1\, @arrow 0359 @ \,Y and (′,Y′)∈ℛ( G ,Y ) ; (2) If Y→ℓY′Y 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ Y then @arrow0359 @ℓ′ G\, [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1\, @arrow 0359 @ \,\, G and Y′ @arrow0359 @Y′Y [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1\, @arrow 0359 @\,Y with (′,Y′)∈ℛ( G ,Y ) . Two states G and Y are weakly correspondent, written ≈Y G≈ Y, if and only if there exists a weak correspondence ℛR such that (,Y)∈ℛ( G,Y) . Theorem 4.4. Let G be reachable from an initial, aware and balanced global type, then ≈↾ G≈ G -2.84526pt \,. (Theorem˜4.4) follows from top-down and bottom-up fidelity, since Y<:↾Y<: G -2.84526pt \, implies ≈Y G≈ Y, which is mechanical by induction. 4.4. Further Properties of Systems Local progress ensures that each configuration in a system can make further actions, unless it is in a final state (or it is final for short). Configuration (,L,σ)( p,L,σ) is final if L≡L≡ end, where ≡ is the structural equivalence defined by the following rules: ▶∙≡∙▶≡▶≡ end ≡ end≡ end end≡ end. Observe that L≡L≡ end implies that p has no further actions in L and is committed in all MC in L. Definition 4.5 (Local Progress). Y enjoys progress if for all Y′Y reachable from Y: (,,σ) in Y′ is not final ⇒Y′→∗→ℓ∧(ℓ)=( p, L,σ) 10000\ in 10000\ Y 10000\ is not final Y 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 -3.44444pt^* 10000\ 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ 10000\ 10000\ 10000\ 10000\ sbj( )= p The Corollary˜4.6 of Theorem˜4.4 lifts global progress (Theorem˜3.13) to systems. Corollary 4.6 (Local Progress). If G is initial, aware and balanced then ↾ G -2.84526pt \, enjoys progress. From local progress we further establish orphan message freedom (OMF), which states that every message in a queue can eventually be received (see Appendix˜G for details). Theorem 4.7 (name=OMF). Let Y,(,,σ)Y,( q, L,σ) be a system reachable from the projection of an initial, aware, and balanced global type. If σ[]=m1→⋅(ak,π)⋅m2→σ[ p]= m_1·(a_k,π)· m_2 with (ak,π)∉m1→(a_k,π) ∈ m_1, then there exists Y′,(,′,σ′)Y ,( q, L ,σ ) reachable from Y,(,,σ)Y,( q, L,σ) such that either (1) (π,′) stale(π, L ), or (2) Y′,(,′,σ′)→?(ak,π)Y ,( q, L ,σ ) 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q?(a_k,π) 10000\ . OMF in MST was first formulated (Deniélou and Yoshida, 2012, 2013) to state that final (terminated) states have empty queues. Our Theorem˜4.7 is more general because it also covers non-terminating systems. In our setting, we can state the weaker property of Deniélou and Yoshida modulo stale message purging as: if Y is final and derived from the projection of an initial, aware and balanced G, then for all (,,σ)( p, L,σ) in Y, (,σ)=∅ gc( L,σ)= . This follows immediately from Theorem˜4.7: if a non-stale message were present in Y, by Theorem˜4.7 there would exist Y′Y reachable from Y where that message is consumed or stale, contradicting the finality of Y. A stronger version of OMF (Chen et al., 2017) has been studied in the setting of (binary) session types with fairness conditions by Padovani and Zavattaro (2025). Due to MC, our Theorem˜4.7 first differs by considering garbage collection (case (1) in Theorem˜4.7). Secondly, their fair termination condition enforces that every message is necessarily received in every possible execution, whereas our Theorem˜4.7 ensures that every enqueued message may always be possibly received or garbage collected (e.g., given μ.⇾:a.μ t.\, p q:a.\, t, it is always possible for q to receive but the unfair execution where p sends forever while q never receives is also possible). We leave to future work an investigation of fairness conditions à la Ciccone et al. (2024); Padovani and Zavattaro (2025) for asynchronous MC in MST. Section˜6 gives further comparisons with Ciccone et al. (2024). 5. Implementation and Further Examples 5.1. Toolchain Implementation Global protocol validation We have implemented mMST as an extension to the Scribble protocol language (Yoshida et al., 2013; Hu and Yoshida, 2016). The practical syntax for our MC is as demonstrated in Section˜2. Following our formal theory, our implementation allows MC to be combined with the standard MST constructs for regular directed choice (non-mixed branch/select) and recursion to express a range of patterns and DS constructs found in practical applications. Our toolchain internally translates Scribble specifications to a representation based on our formal definitions and syntactically checks the source protocol for (a) the well-formedness of committing message labels (Definition˜3.4), (b) awareness (Definition˜3.9) and balance (Definition˜3.12), and (c) projectability (Section˜4.2) onto all roles. In our current implementation, checking (b) syntactically means inferring role occurrences and dependencies between roles as written in the source protocol without (semantically) unfolding recursive types. This is sound: such syntactically inferred dependencies conservatively imply our formal conditions. Code generation. The toolchain implements projection of global types to local types following the formal theory. Each local type is then translated to an event-driven finite state machine (EFSM) representation. As described in Section˜2.2, from the EFSM we generate two Erlang modules for each role: a role module (RM) and a callback module (CM). In Figure˜3, we showed the CM for role B. In Figure˜7, we show the corresponding RM for B. The RM builds on gen_statem, providing an EFSM structure to manage state transitions and message passing in accordance with the protocol. Specifically, it provides state function definitions (Figure˜7, lines 27-40), and callback specifications (Figure˜7, lines 2-8) that must be implemented by the CM to handle incoming messages and internal events. It also provides functions for sending messages (Figure˜7, lines 17-23). Moreover, it leverages gen_statem’s asynchronous selective receive to defer out-of-order events by returning a postpone action (e.g. keep_state, Data, [postpone]) (lines 27-28), requeuing them until the state machine transitions into a state that can properly handle them. Following Erlang convention, the RM excludes any application-specific logic, which instead is left to callbacks in the CM. ⬇ 1% -------- Callback specifications -------- 2-callback s5(term(), atom(), state_data()) →\ stop, normal, state_data(). 3-callback s1(term(), atom() | pid(), term(), state_data()) →\ 4 next_state, s5, state_data(), [next_event, internal, ’TOc’] | keep_state, state_data() | 5 keep_state, state_data(), [postpone] | next_state, s2, state_data(), [next_event, internal, a3]. 6-callback s2(term(), atom(), state_data()) →\ 7 next_state, s3, state_data(), [next_event, internal, a4] | keep_state, state_data(). 8-callback s3(term(), atom(), state_data()) →\ stop, normal, state_data(). 9%% -------- Record and type definitions for maintaining state -------- 10-record(data, a_pid :: pid(), c_pid :: pid() ). %% Process identifiers for roles A and C. 11%% -------- Send helpers -------- 12send_s1_TOa(APid, Data) →\ gen_statem:cast(APid, self(), ’TOa’, Path). 13send_s5_TOc(CPid, Data) →\ gen_statem:cast(CPid, self(), ’TOc’, Path). 14send_s3_a4(APid, Data) →\ gen_statem:cast(APid, self(), a4, Path). 15send_s2_a3(CPid, Data) →\ gen_statem:cast(CPid, self(), a3, Path). 16%% ---------- Callback function definitions delegate the processing to the CM ---------- 17s1(EventType, APid, a1, Pi, Data) →\ 18 case stale(Pi, left) of 19 true →\ keep_state, Data; 20 false →\ Side == CallbackModule:s1(EventType, APid, a1, Data) 21 case Side of next_state, s6, _ →\ commit_entry(?MC1, left), Side; 22 next_state, s3, _ →\ commit_entry(?MC1, right), Side 23 end; 24 end; 25s1(EventType, ’TOa’, Data) →\ Side == CallbackModule:s1(EventType, ’TOa’, Data) 26 case Side of next_state, s6, _ →\ commit_entry(?MC1, left), Side; 27 next_state, s3, _ →\ commit_entry(?MC1, right), Side 28 end. 29s5(EventType, ’TOc’, Data) →\ CallbackModule:s5(EventType, ’TOc’, Data). 30s2(EventType, a3, Data) →\ CallbackModule:s2(EventType, a3, Data). 31s3(EventType, a4, Data) →\ CallbackModule:s3(EventType, a4, Data). Figure 7. Extract from the RM generated for B in Timeout, implementing its protocol- and role-specific gen_statem behaviour and declaring the callback functions to be implented by the CM. In mixed choices, participants may receive messages from non-selected branches until all participants become committed. To prevent protocol violations stemming from these stale messages, the toolchain implements event queue management and state data tracking within the gen_statem framework. The implementation follows the theory, and derives the stale messages to be purged from the global type, as defined in Section˜4.1. gen_statem maintains an event queue where incoming events are enqueued and dispatched sequentially based on arrival order and their priority, with internal events being prioritised over external events. Each incoming MC message carries a path Pi recording the sides taken through active MCs. The RM keeps a local commitment map, and as illustrated in Figure˜7, lines 22-26, when an event is received the RM module purges the event if the path Pi is stale, otherwise it forwards the event to the CM module. Runtime requirements. Our implementation uses Erlang’s core features for process spawning and asynchronous message passing, and the built-in gen_statem library for executing event-driven finite state machines (EFSMs). However, a runtime for our theory can be implemented in any setting that supports event-driven concurrency and asynchronous messaging, over which a framework for session-based EFMSs can be readily developed (Viering et al., 2021) if not directly supported as in Erlang. Our protocol validation and projection is independent of Erlang. 5.2. Expressiveness by Examples Table˜1 summarises a range of examples from MST literature that we have extended with mixed choice (MC) to support features such as timeouts and exceptions. Our MC allows use cases like SMTP to be expressed more fully than in prior MST systems due to supporting timeouts (prior works simply disregarded that aspect). Our examples test the static elements of protocol validation, projection, EFSM translation and Erlang module generation. We also implemented minimal but functional skeleton programs for each role of the examples to test the runtime I/O and event handling dynamics, and embedded MC mechanisms such as stale message purging. However, our minimal implementations generally do not perform the full application logic of the examples. Table 1. MST examples extended with asynchronous mixed choice (MC). M=Multiparty B/S=Branch/Select Rec=Recursion nMC=nested MC ndMC=non-directed MC GC=purging Example M B/S Rec MC nMC ndMC GC Source Calculator ✓ ✓ ✓ ✓ [Hu and Yoshida, 2016] CircuitBreaker ✓ ✓ ✓ ✓ ✓ ✓ [Lagaillardie, Neykova and Yoshida 2022] DistributedLogging ✓ ✓ ✓ ✓ [Lagaillardie, Neykova and Yoshida 2022] Fibonacci ✓ ✓ ✓ ✓ [Hu and Yoshida, 2016] SMTP ✓ ✓ ✓ ✓ ✓ [Hu and Yoshida, 2016] TwoBuyer ✓ ✓ ✓ ✓ ✓ ✓ [Honda, Yoshida, Carbone, 2008] TravelAgency ✓ ✓ ✓ ✓ ✓ [Hu, Yoshida and Honda 2008] OnlineWallet ✓ ✓ ✓ ✓ ✓ ✓ [Neykova, Yoshida and Hu, 2013] Distributed system constructs. A key motivation for mMST is to provide a core construct that can express a range of important constructs – building blocks of many practical distributed systems – that were previously only supported by bespoke and disparate MST extensions. These include exceptions (Carbone et al., 2008), interrupts (Demangeon et al., 2015), timeouts (Pears et al., 2023; Hou et al., 2024), and failure handling (Viering et al., 2018). A basic timeout pattern was illustrated in Section˜2; exceptions are similar. We illustrate interrupts and failure handling below. Failure handling. We give an example of MC drawn from the major topic of failure handling and fault-tolerance in MST (Viering et al., 2018, 2021; Barwell et al., 2023; Peters et al., 2023; Brun and Dardha, 2024). The existing work typically models application protocols assuming that failure detection (FD) is implicitly provided by the runtime infrastructure. With MC as a core construct, we can now explicitly model such mechanisms and how role behaviours may depend on them. Figure˜8 (left) gives a small example, where Worker W is a failure-prone role and the observer FD represents the FD service, based on the use cases of Viering et al. (2018, 2021) featuring heartbeat-based FD. We specify it as a recursive MC where in each iteration (i.e., unfolding of the recursive type) FD waits to receive a heartbeat (HB) from W with the option to send a Crash notification to M (e.g., upon a timeout, connection error, or other failure condition). The annotation on L11 is given by a simple variant of our core theory where protocol validation prohibits further usage of a role considered failed (i.e., W cannot occur again in the continuation of the protocol after L11). The Timeout message is useful if the connection is actually still live, allowing W to handle its own (reported) demise, but can be considered redundant otherwise. Following our theory, protocol validation allows the awareness of W in the LHS to be transitively relayed from FD to M via OK, then to W via more. ⬇ 1global protocol FailH(role M, role W, role FD) 2 init(Data) from M to W; 3 rec X 4 mixed // LHS 5 HB() from W to FD; 6 OK() from FD to M; 7 result(Data) from W to M; 8 more(Data) from M to W; 9 continue X; 10 or // RHS 11 Timeout() from FD to W; @’failed W’ 12 Crash() from FD to M; 13 ⬇ 1@’explicit-observer-left-commits’ 2global protocol Interr(role P, role Q) 3 mixed // LHS 4 Start() from Q to P; 5 rec X 6 choice at Q 7 More() from Q to P; continue X; 8 or 9 Stop() from Q to P*; // P commits 10 Ack() from P to Q; 11 12 or // RHS 13 Interrupt() from P to Q; Figure 8. Heartbeat-based failure detection (left), and an asynchronous interrupt (right). Interrupts. Recall the interrupt patterns using MC in Example˜3.11. The interrupt pattern can be expressed in our Scribble extension as in Figure 8 (right). We make an option for the user to explicitly indicate the committing interactions for observers in the LHS of an MC (as opposed to the observer implicitly committing on the first such message received as in the core theory). The explicit committing interaction is marked by a * on the observer role occurrence, e.g., P* on Line 9. 5.3. Case Study: RabbitMQ We apply our toolchain to a non-trivial, real-world case study, RabbitMQ. The toolchain can generate code for each participant in the chosen subset of the AMQP protocol, while also allowing for interoperability: the code generated for one participant (e.g., Consumer) can interoperate with pre-existing RabbitMQ implementations. The Advanced Message Queuing Protocol555https://w.amqp.org/ (AMQP) is an open-standard protocol designed for message-oriented middleware. RabbitMQ, a widely-used open-source message broker adhering to the AMQP standard, leverages the Erlang client library amqp_client666https://github.com/rabbitmq/rabbitmq-server/tree/main/deps/amqp_client to facilitate interaction between Erlang and Elixir applications and RabbitMQ nodes. Within this ecosystem, the amqp_selective_consumer module, implemented alongside its behaviour amqp_gen_consumer, plays a crucial role in managing message consumption with precise control over delivery and cancellation. Notably, amqp_selective_consumer is already implemented as a state machine using Erlang’s gen_server behaviour; however, this implementation is relatively ad-hoc. We replace the amqp_selective_consumer, and its implemented behaviour amqp_gen_consumer from the RabbitMQ Erlang client library, amqp_client with a behaviour and a callback module generated from a session type representation of the protocol. We model the relevant part of the AMQP protocol in Scribble, Figure˜9, capturing the interactions between the consumer C, channel H, and server S roles for selective message delivery. The consumer registers with the channel and initiates a basic_consume request, which is forwarded to the server. The server responds with basic_consume_ok, confirming the consumer’s subscription. The SelectiveMessageDelivery recursive block models ongoing message exchanges, using an MC construct to represent message processing on one hand and cancellation on the other. MC is essential for accurately modelling the concurrency and asynchronous behaviour in AMQP. It allows the protocol to express that either the server may deliver a new message – basic_deliver, or the consumer may choose to cancel the subscription – basic_cancel. Our toolchain validates this global type, projects it to a local type for each role, and constructs an EFSM representation of each local type. For the consumer role, C, the toolchain generates a correct-by-construction behaviour and callback modules. The generated modules replace amqp_selective_consumer and amqp_gen_consumer, implementing the same interfaces expected by other components. All features of amqp_selective_consumer are preserved, including message consumption, and cancellation. We use RabbitMQ’s existing test suite to validate the new amqp_selective_consumer implementation. ⬇ // roles: C == Consumer, H == Channel, S == Server global protocol AMQP(role C, role H, role S) register_default_consumer() from C to H; basic_consume(consumer_tag, nowait) from C to H; basic_consume(consumer_tag, nowait) from H to S; basic_consume_ok(consumer_tag) from S to H; basic_consume_ok(consumer_tag) from H to C; rec SelectiveMessageDelivery mixed basic_deliver(consumer_tag, delivery_tag, exchange, routing_key) from S to H; // Continued on right column... ⬇ process_message() from H to C; basic_deliver(consumer_tag, delivery_tag, exchange, routing_key) from H to C; processing_complete(delivery_tag) from C to H; update_delivery_state(delivery_tag) from H to S; continue SelectiveMessageDelivery; or basic_cancel(consumer_tag, nowait) from C to H; basic_cancel(consumer_tag, nowait) from H to S; basic_cancel_ok(consumer_tag) from S to H; basic_cancel_ok(consumer_tag) from H to C; Figure 9. Subset of AMQP using a recursive MC in our extended Scribble. 6. Related Work, Limitations and Future Work This paper presents the first asynchronous multiparty session type system with a core construct for mixed choice. There are two main lines of related work in the literature: session types with synchronous mixed choices, and MST extensions for bespoke exception-like constructs. The literature includes several works on synchronous mixed choices for binary (Vasconcelos et al., 2020; Casal et al., 2020, 2022) and multiparty (Castagna et al., 2012; Jongmans and Yoshida, 2020; Jongmans and Ferreira, 2023; Peters and Yoshida, 2024) session types. In synchronous settings, mixed choices behave very similarly to regular (non-mixed) choice: both can be modelled by an atomic reduction step (e.g., G1+G2→Gi′G_1 +G_2 →G_i for i∈1,2i ∈\1,2\ and Gi→Gi′G_i →G_i ). Reasoning about safety of asynchronous mixed choices (MC) and disciplining the inherent race conditions is a substantially different endeavour, as shown by our developments through the design of our MC, static validation, runtime mechanisms and metatheory. We note the work of Pears et al. (2023) on asynchronous binary session types with mixed choice, where each choice has a timing constraint. Their system allows choices with a mix of input and output actions, but they statically enforce that actions in different directions are never viable at the same point in time. Similar approaches based on timed session types (Hou et al., 2024) share this limitation. By contrast, we deal with bona fide asynchronous MC where both communication directions w.r.t. all pairs of participants are concurrently viable. This paper aims to distill the essence of mixed choice in asynchronous (M)ST, various aspects of which were studied in several areas; e.g., interaction exceptions (Carbone et al., 2008) (binary), interaction handlers (Capecchi et al., 2016) (with synchronous triggers), interruptible blocks (Demangeon et al., 2015) (where default/interrupted blocks share common continuations), and internal exceptions (Fowler et al., 2019) (local failure control, no type construct). We have shown how MC can express multiparty asynchronous timeouts and interrupts; exceptions are similar. A crucial area for real-world applicability of session types is support for failure handling, where aspects of mixed choice arise intrinsically. Viering et al. (2018, 2021) developed an MST system with try-handle constructs for handling partial failures of a protocol due to (suspected) participant crashes. In these works a process may be faced with a choice between outputs in the normal protocol flow mixed with potential inputs related to failure detection/notification. The (supposed) failure of a participant rules out all interactions with that participant thereafter. By contrast, our MC has a finer-grained notion of commitment that is per instance of an MC (not per protocol). Section˜5.2 demonstrated such a failure handling pattern using our MC. Barwell et al. (2023) present an approach to failure handling in MST that avoids syntactic extensions (cf. (Bettini et al., 2008)). Their system designates a special message label crash to denote failure of the “sending” participant, which otherwise behaves as a regular label in choice constructs. E.g., ⇾:a.1,.2 p q:\a.\, [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5 G_1, crash. [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5 G_2\ specifies that q awaits either message a from p or notification of p’s crash. As in the related work above, crash events may occur concurrently with the I/O actions of the main protocol flow and their system incorporates some related machinery (e.g., queue cleaning); however, neither their user-level types nor processes have explicit constructs for mixed choice. See Appendix˜A for further notes on the above works. Communicating systems featuring mixed choice have been studied outside of session types. Communicating automata (Brand and Zafiropulo, 1983) for instance do not rule out mixed choices but progress is, in general, undecidable. Lange et al. (2018) present a tool that infers behavioural types (Hüttel et al., 2016) for channel-based, shared-memory concurrency programs in Go. Their system permits mixed choice for the select construct and assumes finitely buffered channels, enabling decidable model checking (e.g., deadlock-freedom) of the inferred types. Our work instead supports asynchronous communication over unbounded channels. Recently, Li et al. (2023) presented the first sound and complete projection method for global types generalised with sender-driven choice (→i:mi.GiI p →\ q_i:m_i.G_i\_I). Their automata-theoretic approach separates local machine synthesis from implementability checking, but, like Majumdar et al. (2021), do not support mixed choice. By contrast, our work builds on classical MST with regular (non-mixed) choices restricted to directed choice and syntactic projection. This is because our asynchronous MC is influenced by the other works discussed above on, e.g., interrupts and failure handling. Ciccone et al. (2024) presented an MST system for fair termination in a synchronous session π-calculus without mixed choice. Their system guarantees processes (with multiple sessions) will fairly terminate by combining: a validation that session types always potentially terminate, a restricted fusing of session initiation and process spawning (Wadler, 2014; Caires et al., 2016), a notion of ranking that limits processes to finite behaviours, a liveness-preserving subtyping relation, and a fairness assumption on executions (potential termination leads to actual termination). There may be connections between our notion of clear termination, that is per MC, with their notion of (whole) protocol termination; at present, our system differs in that we allow a session to be unbounded provided each MC individually satisfies awareness. Padovani and Zavattaro (2025) recently developed fair termination for asynchronous binary sessions (as mentioned in Sec. 4.4). Limitations and future work. Our system builds on classical MST with regular choices restricted to directed choice, and syntactic projection and merge (Stutz, 2023; Scalas and Yoshida, 2019). This yields a projection that is sound but not complete in the base MST constructs (directed choice, recursion), let alone with MC. In future work, we plan to investigate (conservative forms of) mixed choice in the generalised automata-theoretic setting of Li et al. (2023). The challenges include reconciling their language-based approach with our mechanisms (e.g., stale message purging) and metatheory (e.g., operational correspondence and preservation of projection). Another issue is that their projection yields state machines that are more general than local types: accepting (terminating) states may have outgoing transitions, and choice branches may be unbalanced across roles. Such generality must be reconciled with the objective of our system (and classical MST) that all projected behaviours, including MCs, be realisable as fully distributed processes; e.g., we typically aim to rule out protocols where termination could be non-deterministic (cf. Def. 3.9). Building on the above, Stutz and D’Osualdo (2025) recently extended projection to a larger class of automata-based global specifications, but show that the projectability of mixed choice in their more general setting is undecidable. Their negative result motivates pragmatic approaches to supporting mixed choice such as in this paper. The automata-based system of Lange and Yoshida (2019) may also provide avenues for lifting directed choice and generalising our protocol validation. One of our present limitations is that our system does not incorporate delegation (Honda et al., 2008; Bettini et al., 2008). Considering our MC concepts (e.g., stale message purging and path identifiers) in a setting with delegation is a topic for future work. An interesting question is how fair multiparty termination (Ciccone et al., 2024) may be extended to asynchronous mixed choices. One direction could be to investigate fair termination for our notion of MC global/local types and formalise a process-level language. Unlike the ‘multithreaded’ π-calculi in the mentioned works, however, the model of concurrency in our practical Erlang setting is event-driven (Hu et al., 2010; Viering et al., 2021) and does not have a specific primitive for fusing session initiation and process spawning. Adapting their notion of static typing of process ranks may be a challenge in languages such as Erlang. Data-Availability Statement The source code of our toolchain, examples and RabbitMQ case study is available online.777https://github.com/rhu1/scribble-gt-scala/tree/artifact It will be submitted for review as an artifact. Acknowledgements.This work was partially funded by EPSRC project EP/T014512/1, EP/T014628/1 (STARDUST). References M. Adameit, K. Peters, and U. Nestmann (2017) Session types for link failures. In FORTE, Lecture Notes in Computer Science, Vol. 10321, p. 1–16. Cited by: §1. A. D. Barwell, P. Hou, N. Yoshida, and F. Zhou (2023) Designing asynchronous multiparty protocols with crash-stop failures. In 37th European Conference on Object-Oriented Programming, ECOOP 2023, July 17-21, 2023, Seattle, Washington, United States, K. Ali and G. Salvaneschi (Eds.), LIPIcs, Vol. 263, p. 1:1–1:30. External Links: Link, Document Cited by: §1, §5.2, §6. A. D. Barwell, A. Scalas, N. Yoshida, and F. Zhou (2022) Generalised multiparty session types with crash-stop failures. In 33rd International Conference on Concurrency Theory, CONCUR 2022, September 12-16, 2022, Warsaw, Poland, B. Klin, S. Lasota, and A. Muscholl (Eds.), LIPIcs, Vol. 243, p. 35:1–35:25. External Links: Link, Document Cited by: §1. L. Bettini, M. Coppo, L. D’Antoni, M. D. Luca, M. Dezani-Ciancaglini, and N. Yoshida (2008) Global progress in dynamically interleaved multiparty sessions. See 20, p. 418–433. Cited by: §1, §6, §6. L. Bocchi, D. Orchard, and A. L. Voinea (2023) A theory of composing protocols. Art Sci. Eng. Program. 7 (2). External Links: Link, Document Cited by: Appendix B. D. Brand and P. Zafiropulo (1983) On communicating finite-state machines. J. ACM 30 (2), p. 323?342. External Links: ISSN 0004-5411, Link, Document Cited by: §6. M. A. L. Brun and O. Dardha (2023) MAGπ: types for failure-prone communication. In Programming Languages and Systems - 32nd European Symposium on Programming, ESOP 2023, Held as Part of the European Joint Conferences on Theory and Practice of Software, ETAPS 2023, Paris, France, April 22-27, 2023, Proceedings, T. Wies (Ed.), Lecture Notes in Computer Science, Vol. 13990, p. 363–391. External Links: Link, Document Cited by: Appendix A. M. A. L. Brun and O. Dardha (2024) MAGπ!: the role of replication in typing failure-prone communication. In Formal Techniques for Distributed Objects, Components, and Systems - 44th IFIP WG 6.1 International Conference, FORTE 2024, Held as Part of the 19th International Federated Conference on Distributed Computing Techniques, DisCoTec 2024, Groningen, The Netherlands, June 17-21, 2024, Proceedings, V. Castiglioni and A. Francalanza (Eds.), Lecture Notes in Computer Science, Vol. 14678, p. 99–117. External Links: Link, Document Cited by: Appendix A, §1, §5.2. L. Caires, F. Pfenning, and B. Toninho (2016) Linear logic propositions as session types. Math. Struct. Comput. Sci. 26 (3), p. 367–423. External Links: Link, Document Cited by: Appendix B, §6. S. Capecchi, E. Giachino, and N. Yoshida (2016) Global escape in multiparty sessions. Math. Struct. Comput. Sci. 26 (2), p. 156–205. External Links: Link, Document Cited by: Appendix A, §1, §6. M. Carbone, K. Honda, and N. Yoshida (2008) Structured interactional exceptions in session types. In CONCUR 2008 - Concurrency Theory, 19th International Conference, CONCUR 2008, Toronto, Canada, August 19-22, 2008. Proceedings, F. van Breugel and M. Chechik (Eds.), Lecture Notes in Computer Science, Vol. 5201, p. 402–417. External Links: Link, Document Cited by: Appendix A, §5.2, §6. F. Casal, A. Mordido, and V. T. Vasconcelos (2020) Mixed sessions: the other side of the tape. In Proceedings of the 12th International Workshop on Programming Language Approaches to Concurrency- and Communication-cEntric Software, PLACES@ETAPS 2020, Dublin, Ireland, 26th April 2020, S. Balzer and L. Padovani (Eds.), EPTCS, Vol. 314, p. 46–60. External Links: Link, Document Cited by: Appendix A, §6. F. Casal, A. Mordido, and V. T. Vasconcelos (2022) Mixed sessions. Theor. Comput. Sci. 897, p. 23–48. External Links: Link, Document Cited by: Appendix A, §6. G. Castagna, M. Dezani-Ciancaglini, and L. Padovani (2012) On global types and multi-party session. Log. Methods Comput. Sci. 8 (1). External Links: Link, Document Cited by: Appendix A, Appendix A, §6. D. Castro-Perez, R. Hu, S. Jongmans, N. Ng, and N. Yoshida (2019) Distributed programming using role-parametric session types in go: statically-typed endpoint apis for dynamically-instantiated communication structures. Proc. ACM Program. Lang. 3 (POPL), p. 29:1–29:30. External Links: Link, Document Cited by: Appendix A, Appendix A, Appendix A. D. Castro-Perez and N. Yoshida (2023) Dynamically updatable multiparty session protocols: generating concurrent go code from unbounded protocols. In 37th European Conference on Object-Oriented Programming, ECOOP 2023, July 17-21, 2023, Seattle, Washington, United States, K. Ali and G. Salvaneschi (Eds.), LIPIcs, Vol. 263, p. 6:1–6:30. External Links: Link, Document Cited by: Appendix A. T. Chen, M. Dezani-Ciancaglini, A. Scalas, and N. Yoshida (2017) On the preciseness of subtyping in session types. Log. Methods Comput. Sci. 13 (2). External Links: Link, Document Cited by: §4.4. T. Chen, M. Viering, A. Bejleri, L. Ziarek, and P. Eugster (2016) A type theory for robust failure handling in distributed systems. In Formal Techniques for Distributed Objects, Components, and Systems - 36th IFIP WG 6.1 International Conference, FORTE 2016, Held as Part of the 11th International Federated Conference on Distributed Computing Techniques, DisCoTec 2016, Heraklion, Crete, Greece, June 6-9, 2016, Proceedings, E. Albert and I. Lanese (Eds.), Lecture Notes in Computer Science, Vol. 9688, p. 96–113. External Links: Link, Document Cited by: §1. L. Ciccone, F. Dagnino, and L. Padovani (2024) Fair termination of multiparty sessions. J. Log. Algebraic Methods Program. 139, p. 100964. External Links: Link, Document Cited by: Appendix B, §4.4, §6, §6. [20] (2008) CONCUR. LNCS, Vol. 5201. External Links: ISBN 978-3-540-85360-2 Cited by: L. Bettini, M. Coppo, L. D’Antoni, M. D. Luca, M. Dezani-Ciancaglini, and N. Yoshida (2008). M. Coppo, M. Dezani-Ciancaglini, L. Padovani, and N. Yoshida (2015) A gentle introduction to multiparty asynchronous session types. In Formal Methods for Multicore Programming - 15th International School on Formal Methods for the Design of Computer, Communication, and Software Systems, SFM 2015, Bertinoro, Italy, June 15-19, 2015, Advanced Lectures, M. Bernardo and E. B. Johnsen (Eds.), Lecture Notes in Computer Science, Vol. 9104, p. 146–178. External Links: Link, Document Cited by: §1. M. Coppo, M. Dezani-Ciancaglini, N. Yoshida, and L. Padovani (2016) Global progress for dynamically interleaved multiparty sessions. Math. Struct. Comput. Sci. 26 (2), p. 238–302. Cited by: Appendix B, §2.1, §3.3. R. Demangeon, K. Honda, R. Hu, R. Neykova, and N. Yoshida (2015) Practical interruptible conversations: distributed dynamic verification with multiparty session types and python. Formal Methods Syst. Des. 46 (3), p. 197–225. External Links: Link, Document Cited by: Appendix A, §1, §5.2, §6. R. Demangeon and K. Honda (2012) Nested protocols in session types. In CONCUR 2012 - Concurrency Theory - 23rd International Conference, CONCUR 2012, Newcastle upon Tyne, UK, September 4-7, 2012. Proceedings, M. Koutny and I. Ulidowski (Eds.), Lecture Notes in Computer Science, Vol. 7454, p. 272–286. External Links: Link, Document Cited by: Appendix A. P. Deniélou, N. Yoshida, A. Bejleri, and R. Hu (2012) Parameterised multiparty session types. Log. Methods Comput. Sci. 8 (4). External Links: Link, Document Cited by: Appendix A. P. Deniélou and N. Yoshida (2012) Multiparty session types meet communicating automata. In ESOP, LNCS, Vol. 7211, p. 194–213. Cited by: §4.2, §4.4. P. Deniélou and N. Yoshida (2013) Multiparty compatibility in communicating automata: characterisation and synthesis of global session types. In ICALP, LNCS, Vol. 7966, p. 174–186. Cited by: §3.2, §3, §4.4. S. Fowler, S. Lindley, J. G. Morris, and S. Decova (2019) Exceptional asynchronous session types: session types without tiers. Proc. ACM Program. Lang. 3 (POPL), p. 28:1–28:29. External Links: Link, Document Cited by: Appendix A, §1, §6. M. G. Gouda, E. G. Manning, and Y. Yu (1984) On the progress of communications between two finite state machines. Inf. Control. 63 (3), p. 200–216. External Links: Link, Document Cited by: footnote 3. K. Honda, N. Yoshida, and M. Carbone (2008) Multiparty asynchronous session types. In Proceedings of the 35th ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages, POPL 2008, San Francisco, California, USA, January 7-12, 2008, G. C. Necula and P. Wadler (Eds.), p. 273–284. External Links: Link, Document Cited by: Appendix A, §1, §1, §3.3, §6. K. Honda, N. Yoshida, and M. Carbone (2016) Multiparty asynchronous session types. J. ACM 63 (1), p. 9:1–9:67. External Links: Link, Document Cited by: §2.1. P. Hou, N. Lagaillardie, and N. Yoshida (2024) Fearless asynchronous communications with timed multiparty session protocols. In 38th European Conference on Object-Oriented Programming, ECOOP 2024, September 16-20, 2024, Vienna, Austria, J. Aldrich and G. Salvaneschi (Eds.), LIPIcs, Vol. 313, p. 19:1–19:30. External Links: Link, Document Cited by: §1, §5.2, §6. R. Hu, D. Kouzapas, O. Pernet, N. Yoshida, and K. Honda (2010) Type-safe eventful sessions in java. In ECOOP 2010 - Object-Oriented Programming, 24th European Conference, Maribor, Slovenia, June 21-25, 2010. Proceedings, T. D’Hondt (Ed.), Lecture Notes in Computer Science, Vol. 6183, p. 329–353. External Links: Link, Document Cited by: Appendix B, §6. R. Hu, R. Neykova, N. Yoshida, R. Demangeon, and K. Honda (2013) Practical interruptible conversations. In Runtime Verification, A. Legay and S. Bensalem (Eds.), Berlin, Heidelberg, p. 130–148. Cited by: Appendix A, Appendix A. R. Hu and N. Yoshida (2016) Hybrid session verification through endpoint API generation. In Fundamental Approaches to Software Engineering - 19th International Conference, FASE 2016, Held as Part of the European Joint Conferences on Theory and Practice of Software, ETAPS 2016, Eindhoven, The Netherlands, April 2-8, 2016, Proceedings, P. Stevens and A. Wasowski (Eds.), Lecture Notes in Computer Science, Vol. 9633, p. 401–418. External Links: Link, Document Cited by: Appendix A, §2.1, §5.1. R. Hu and N. Yoshida (2017) Explicit connection actions in multiparty session types. In Fundamental Approaches to Software Engineering - 20th International Conference, FASE 2017, Held as Part of the European Joint Conferences on Theory and Practice of Software, ETAPS 2017, Uppsala, Sweden, April 22-29, 2017, Proceedings, M. Huisman and J. Rubin (Eds.), Lecture Notes in Computer Science, Vol. 10202, p. 116–133. External Links: Link, Document Cited by: Appendix A. H. Hüttel, I. Lanese, V. T. Vasconcelos, L. Caires, M. Carbone, P. Deniélou, D. Mostrous, L. Padovani, A. Ravara, E. Tuosto, H. T. Vieira, and G. Zavattaro (2016) Foundations of session types and behavioural contracts. ACM Comput. Surv. 49 (1), p. 3:1–3:36. External Links: Link, Document Cited by: §6. G. Iraci, C. Chuang, R. Hu, and L. Ziarek (2023) Validating iot devices with rate-based session types. Proc. ACM Program. Lang. 7 (OOPSLA2), p. 1589–1617. External Links: Link, Document Cited by: §1. S. Jongmans and F. Ferreira (2023) Synthetic behavioural typing: sound, regular multiparty sessions via implicit local types (pearl/brave new idea). In 37th European Conference on Object-Oriented Programming, ECOOP 2023, July 17-21, 2023, Seattle, Washington, United States, K. Ali and G. Salvaneschi (Eds.), LIPIcs, Vol. 263, p. 42:1–42:30. External Links: Link, Document Cited by: Appendix A, §6. S. Jongmans and N. Yoshida (2020) Exploring type-level bisimilarity towards more expressive multiparty session types. In Programming Languages and Systems - 29th European Symposium on Programming, ESOP 2020, Held as Part of the European Joint Conferences on Theory and Practice of Software, ETAPS 2020, Dublin, Ireland, April 25-30, 2020, Proceedings, P. Müller (Ed.), Lecture Notes in Computer Science, Vol. 12075, p. 251–279. External Links: Link, Document Cited by: Appendix A, Appendix A, §6. D. Kouzapas, N. Yoshida, R. Hu, and K. Honda (2016) On asynchronous eventful session semantics. Math. Struct. Comput. Sci. 26 (2), p. 303–364. External Links: Link, Document Cited by: Appendix B. J. Lange, N. Ng, B. Toninho, and N. Yoshida (2018) A static verification framework for message passing in go using behavioural types. In Proceedings of the 40th International Conference on Software Engineering, ICSE 2018, Gothenburg, Sweden, May 27 - June 03, 2018, M. Chaudron, I. Crnkovic, M. Chechik, and M. Harman (Eds.), p. 1137–1148. External Links: Link, Document Cited by: §6. J. Lange and N. Yoshida (2019) Verifying asynchronous interactions via communicating session automata. In Computer Aided Verification - 31st International Conference, CAV 2019, New York City, NY, USA, July 15-18, 2019, Proceedings, Part I, I. Dillig and S. Tasiran (Eds.), Lecture Notes in Computer Science, Vol. 11561, p. 97–117. External Links: Link, Document Cited by: §1, §6. E. Li, F. Stutz, T. Wies, and D. Zufferey (2023) Complete multiparty session type projection with automata. In Computer Aided Verification - 35th International Conference, CAV 2023, Paris, France, July 17-22, 2023, Proceedings, Part I, C. Enea and A. Lal (Eds.), Lecture Notes in Computer Science, Vol. 13966, p. 350–373. External Links: Link, Document Cited by: Appendix A, §1, §6, §6. R. Majumdar, M. Mukund, F. Stutz, and D. Zufferey (2021) Generalising projection in asynchronous multiparty session types. In 32nd International Conference on Concurrency Theory, CONCUR 2021, August 24-27, 2021, Virtual Conference, S. Haddad and D. Varacca (Eds.), LIPIcs, Vol. 203, p. 35:1–35:24. External Links: Link, Document Cited by: Appendix A, §6. R. Neykova, R. Hu, N. Yoshida, and F. Abdeljallal (2018) A session type provider: compile-time API generation of distributed protocols with refinements in f#. In Proceedings of the 27th International Conference on Compiler Construction, C 2018, February 24-25, 2018, Vienna, Austria, C. Dubach and J. Xue (Eds.), p. 128–138. External Links: Link, Document Cited by: Appendix A. L. Padovani, V. T. Vasconcelos, and H. T. Vieira (2014) Typing liveness in multiparty communicating systems. In Coordination Models and Languages - 16th IFIP WG 6.1 International Conference, COORDINATION 2014, Held as Part of the 9th International Federated Conferences on Distributed Computing Techniques, DisCoTec 2014, Berlin, Germany, June 3-5, 2014, Proceedings, E. Kühn and R. Pugliese (Eds.), Lecture Notes in Computer Science, Vol. 8459, p. 147–162. External Links: Link, Document Cited by: Appendix B. L. Padovani and G. Zavattaro (2025) Fair termination of asynchronous binary sessions. In 39th European Conference on Object-Oriented Programming, ECOOP 2025, June 30 to July 2, 2025, Bergen, Norway, J. Aldrich and A. Silva (Eds.), LIPIcs, Vol. 333, p. 24:1–24:29. External Links: Link, Document Cited by: §4.4, §6. J. Pears, L. Bocchi, and A. King (2023) Safe asynchronous mixed-choice for timed interactions. In Coordination Models and Languages - 25th IFIP WG 6.1 International Conference, COORDINATION 2023, Held as Part of the 18th International Federated Conference on Distributed Computing Techniques, DisCoTec 2023, Lisbon, Portugal, June 19-23, 2023, Proceedings, S. Jongmans and A. Lopes (Eds.), Lecture Notes in Computer Science, Vol. 13908, p. 214–231. External Links: Link, Document Cited by: Appendix A, §1, §5.2, §6. K. Peters, U. Nestmann, and C. Wagner (2023) FTMPST: fault-tolerant multiparty session types. Log. Methods Comput. Sci. 19 (4). External Links: Link, Document Cited by: §1, §5.2. K. Peters and N. Yoshida (2024) Separation and encodability in mixed choice multiparty sessions (technical report). CoRR abs/2405.08104. Note: [To appear at LICS ’24.] External Links: Link, Document, 2405.08104 Cited by: Appendix A, §6. A. Scalas and N. Yoshida (2019) Less is more: multiparty session types revisited. Proc. ACM Program. Lang. 3 (POPL), p. 30:1–30:29. External Links: Link, Document Cited by: Appendix A, §6. F. Stutz and E. D’Osualdo (2025) An automata-theoretic basis for specification and type checking of multiparty protocols. CoRR abs/2501.16977. External Links: Link, Document, 2501.16977 Cited by: §6. F. Stutz (2023) Asynchronous multiparty session type implementability is decidable - lessons learned from message sequence charts. In 37th European Conference on Object-Oriented Programming, ECOOP 2023, July 17-21, 2023, Seattle, Washington, United States, K. Ali and G. Salvaneschi (Eds.), LIPIcs, Vol. 263, p. 32:1–32:31. External Links: Link, Document Cited by: §6. V. T. Vasconcelos, F. Casal, B. Almeida, and A. Mordido (2020) Mixed sessions. In Programming Languages and Systems - 29th European Symposium on Programming, ESOP 2020, Held as Part of the European Joint Conferences on Theory and Practice of Software, ETAPS 2020, Dublin, Ireland, April 25-30, 2020, Proceedings, P. Müller (Ed.), Lecture Notes in Computer Science, Vol. 12075, p. 715–742. External Links: Link, Document Cited by: Appendix A, §6. V. T. Vasconcelos (2012) Fundamentals of session types. Inf. Comput. 217, p. 52–70. External Links: ISSN 0890-5401, Link, Document Cited by: Appendix A. M. Viering, T. Chen, P. Eugster, R. Hu, and L. Ziarek (2018) A typing discipline for statically verified crash failure handling in distributed systems. In Programming Languages and Systems - 27th European Symposium on Programming, ESOP 2018, Held as Part of the European Joint Conferences on Theory and Practice of Software, ETAPS 2018, Thessaloniki, Greece, April 14-20, 2018, Proceedings, A. Ahmed (Ed.), Lecture Notes in Computer Science, Vol. 10801, p. 799–826. External Links: Link, Document Cited by: Appendix A, §1, §5.2, §5.2, §6. M. Viering, R. Hu, P. Eugster, and L. Ziarek (2021) A multiparty session typing discipline for fault-tolerant event-driven distributed programming. Proc. ACM Program. Lang. 5 (OOPSLA), p. 1–30. External Links: Link, Document Cited by: Appendix A, Appendix B, Appendix B, §1, §5.1, §5.2, §6, §6. P. Wadler (2014) Propositions as sessions. J. Funct. Program. 24 (2-3), p. 384–418. External Links: Link, Document Cited by: Appendix B, §6. N. Yoshida, R. Hu, R. Neykova, and N. Ng (2013) The scribble protocol language. In Trustworthy Global Computing - 8th International Symposium, TGC 2013, Buenos Aires, Argentina, August 30-31, 2013, Revised Selected Papers, M. Abadi and A. Lluch-Lafuente (Eds.), Lecture Notes in Computer Science, Vol. 8358, p. 22–41. External Links: Link, Document Cited by: §2.1, §5.1. F. Zhou, F. Ferreira, R. Hu, R. Neykova, and N. Yoshida (2020) Statically verified refinements for multiparty protocols. Proc. ACM Program. Lang. 4 (OOPSLA), p. 148:1–148:30. External Links: Link, Document Cited by: Appendix A, Appendix A. Appendix˜A Additional notes on related work (cf. Section˜6). Appendix˜B Additional notes on handling multiple sessions Appendix˜C Full definitions of committing and non-committing label sets (cf. Section˜3.1). Section˜D.8 Progress of global types: Omitted definitions and proofs (cf. Section˜3.3). Appendix˜E Local types: Full definitions (cf. Sections˜4.1 and 4.2). Appendix˜F Operational correspondence: Omitted definitions and proofs (cf. Section˜4.3). Appendix˜G Orphan messages: Omitted definitions and proofs (cf. Section˜4.4). Appendix A Additional Notes on Related Work Mixed choice in binary sessions. Vasconcelos et al. (2020) developed a binary session type system for synchronous sessions with mixed choice. Casal et al. (2020, 2022) further established a type preservation property for mixed sessions, an embedding of classical sessions (Vasconcelos, 2012) into the mixed sessions, and a partial encoding in the reverse direction. All of these works are limited to binary sessions with synchronous communication, where mixed choice subsumes non-mixed choice. By contrast, mixed choice in (safe) asynchronous sessions gives rise to (transient) inconsistencies between the views of the protocol from different participants, which are precluded by the power of synchrony. Pears et al. (2023) developed a system with binary session types for mixed choice with timing constraints for asynchronous sessions. Their system syntactically allows two-party choices with a mix of input and output actions with the (statically enforced) restriction that actions of different directions are never viable at the same point in time. By contrast the entire purpose of our system is to permit and safely deal with truly asynchronous mixed choices where both communication directions w.r.t. all pairs of participants are concurrently viable. In the binary settings of the above works, note that the notion of fidelity is in a sense moot since two-party local types effectively coincide with their (conceptually) associated global type. By constrast, multiparty local type projections are, in general, partial w.r.t. the global type, necessitating our developments to establish an operational correspondence between asynchronous global and local types featuring mixed choice (cf. Section˜4). Mixed choice in synchronous multiparty sessions. In MST, existing work on mixed choice has been limited to synchronous sessions. A consequence is that the constructs for mixed choice in all the following works are symmetric in nature, unlike the asymmetric construct we have developed in this paper for safety in asynchronous sessions. Castagna et al. (2012) developed a set-theoretic semantic framework for global types and multiparty sessions based on a trace semantics. Although their global types include the syntax for G∨G′G G , the choice constructs in their local types are further syntactically constrainted to T⊕T′T T or T+T+T representing the traditional internal-only and external-only choices. Moreover, their trace semantics does not model the intermediary (and potentially inconsistent) states that may arise from asynchronous mixed choice, and each trace element denotes an atomic interaction between the sender and receiver, in contrast to the intermediary states represented by, e.g., 0.56905pt to8.94pt to3.31pt -1.65598pt to0.0pt @beginscope @invoke pgfstrokecolorrgb0,0,0 @color@rgb@stroke000 @invoke @color@rgb@fill000 @invoke @setlinewidth @invoke to0.0pt @beginscope @invoke @beginscope @invoke @roundcap @invoke @moveto0.0pt0.0pt @lineto0.0pt0.0pt @lineto0.92499pt0.8pt @lineto2.775pt-0.8pt @lineto4.625pt0.8pt @lineto5.55002pt0.0pt @lineto5.55002pt0.0pt @lineto5.56764pt0.0pt @stroke @invoke @beginscope @invoke @transformcm1.00.00.01.05.66763pt0.0pt @invoke @invoke @invoke @endscope @invoke @endscope @invoke @endscope @discardpath @invoke @endscope types (e.g., Section˜3) that expose the inherent race conditions. Jongmans and Yoshida (2020) studied weak bisimulation between global and local types featuring the ‘++’ operator for choice in a synchronous system. They informally remark on encoding a form of asynchrony by representing buffered channels explicitly as roles, e.g., encoding an asynchronous p⇾aqp _aq interaction as the pair of synchronous interactions p⇾sbpq.bpq→sqp _sb_pq.b_pq _sq where bpqb_pq is a role that represents a message buffer from p to q. However, this does not amount to asynchrony as we model in this paper because a mixed choice becomes (p⇾sbpq.G1′)+(q⇾sbqp.G2′)(p _sb_pq. [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5G_1 )+(q _sb_qp. [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5G_2 ) where by their (synchronous) semantics either output action by p or q instantly commits all roles to that branch and precludes the other action from occurring, thus precluding any intermediary states and the problematic race conditions. Jongmans and Ferreira (2023) present rules for extending a similar simulation approach to processes featuring the same formulation of ‘++’ for (mixed) choice as Jongmans and Yoshida (2020). Their system is again synchronous with the same operational semantics; all the preceding comparison points with Jongmans and Yoshida (2020) apply here. Peters and Yoshida (2024) present a typing system between local types and processes with mixed choice. Their system is synchronous and their work does not include global types nor operational correspondence between global and local types as in our system. We note, however, that our present paper shares some simplifications with the above works. For example, our system focuses on modelling the semantics of a single session; this is the same as in all of the MST works mentioned above, Consequently, none of these works nor our present paper has studied mixed choice for multiparty sessions in the presence of session delegation (Honda et al., 2008), where a session message carries another session channel as a payload. Exception-like communications patterns in session types. As discussed in Section˜1, mixed choice is at the heart of many crucial communication patterns in real-world distributed systems. One motivation for our paper is to distil the essence of mixed choice in asynchronous MST, various aspects of which have been studied in several prominent areas. Exceptions and interrupts. Carbone et al. (2008) developed a binary session type system for processes with interaction exception handlers. Their try-catch type α[β]α\\![β]\!\ specifies a normal protocol α, and an exceptional protocol β triggered by throwing an exception. This allows situations where a process may be faced with, say, an input in its normal protocol but an output in the triggered exception handler, and dually for its binary peer. Their approach introduces a notion of meta reduction P⇘P′P P to deal with propagating exceptions, nested exceptions and queue cleaning, which is related to our garbage collection. Capecchi et al. (2016) extend MST with interaction handlers that require reasoning about concurrency of exceptions raised by multiple peers. Their approach introduces an exception environment Σ into the reduction relation Σ⊢P→Σ′⊢P′ P→ P , where Σ records the raised exceptions. It is notable, however, that Σ is operated on synchronously and atomically by all multiparty participants, i.e., raising an exception notifies all parties instantly. Demangeon et al. (2015) proposed types for interruptible blocks in multiparty sessions. In their type |G|⟨ℓ by r⟩;G′\\!|G|\!\ by r ;G , the G can be interrupted by r at any point. Whether or not G is interrupted it is followed by G′G , unlike our present paper that supports safe mixed choice between different continuations. Their restriction permits a synchronous operational semantics for global types (the derivative relation) with atomic steps for both interactions and the signalling of interrupts. Fowler et al. (2019) develop a functional language with binary session types and primitives for raising and handling exceptions. Their system focuses on exceptions as a local control flow feature external to their session types, i.e., there is no type construct for exceptions, unlike our mixed choice in this paper or all the other works discussed above. Brun and Dardha (2023, 2024) recently developed timeout branches for a low-level MST where messages can be arbitrarily reordered and lost, which is a radically different communication model than in our paper and the other works mentioned above. Consequently, their notion of safety is weaker than in standard MST: they enforce that timeout branches are always defined, and ensure that if a message is received then it has the expected payload. Failure handling. A crucial area towards the application of session types to real-world distributed systems is support for failure handling, where aspects of mixed choice arise naturally. Viering et al. (2018) develop an asynchronous MST system with a try-handle construct for handling partial failures of a protocol due to participant crashes. They target distributed system with central coordinators for reliable failure detection. By contrast, Viering et al. (2021) developed an asynchronous MST system that extends subsessions (Demangeon and Honda, 2012) with handlers for peer-based unreliable failure detection. These works both treat patterns where a process may be faced with a choice between outputs in the normal protocol flow mixed with potential inputs related to failure detection/notification. Participant failure handling is an instance of mixed choice where the (supposed) failure of a participant rules out all interactions with that participant henceforth, unlike our mixed choice in this paper where the fine-grained notion of commitment is per instance of a mixed choice (a participant failure could be considered a coarse-grained commitment to all active and future instances of a particular mixed choice). Practical MST frameworks based on API generation from global protocols. Our paper shares the motivation of a range of works on developing MST frameworks for practical applications, e.g., (Hu et al., 2013; Castro-Perez et al., 2019; Zhou et al., 2020). Like the mentioned works, our overall framework has a two-stage design: (i) formal metatheory of global and local types (eschewing a process-level language) for validating protocol specifications, and (i) a practical methodology for implementing MST-based sessions. Also like the mentioned works and others based on Scribble (Hu and Yoshida, 2016), our practical methodology provides a toolchain for formally-grounded protocol validation and projection (based on the theory), and correct-by-construction code generation and/or runtime mechanisms for processes. Some works offload aspects of the protocol validation to supplementary methods outside the core syntactic type system, including model checkers (Scalas and Yoshida, 2019) and SMT solvers (Neykova et al., 2018; Castro-Perez et al., 2019; Zhou et al., 2020). Regarding the code generation and/or runtime mechanisms aspect, Hu et al. (2013) developed a tool for generating protocol-specific runtime monitors for sessions in Python; Castro-Perez et al. (2019) employed API generation for Go backed up by Z3 for solving indexing constraints in role-parametric types; and Zhou et al. (2020) developed types generation for static refinement typing in F⋆. In this paper, we develop code generation for protocol- and role-specific gen_statem callbacks and runtime mechanisms for automated stale message purging. As discussed, a key motivation for this paper is to develop a core construct for MC to capture and unify the essence of practical constructs such as exceptions, timeouts and failure handling. Ultimately, a goal for the research community is to develop a complete system that can integrate the full breadth of features needed by many practical applications in addition to MC patterns, such as parameterisation of protocols (Deniélou et al., 2012; Castro-Perez et al., 2019) and dynamic topologies (Hu and Yoshida, 2017; Castro-Perez and Yoshida, 2023). Other MST works that focus on a formal theory of global-local types without a process-level language include works on richer global types and completeness of projection (Majumdar et al., 2021; Li et al., 2023), and the semantics of multiparty sessions (Castagna et al., 2012). Appendix B Handling Multiple Sessions The key properties in our metatheory are the progress of valid global types, and the operational correspondence (fidelity) between a valid global type and its distributed local type projections; the latter entails a preservation property for projection, and transfers global progress to the local level. These results pertain formally to a single multiparty session. As such, our toolchain is primarily designed at present to generate a set of Erlang modules from one source protocol and ensure the aforementioned (single-session) properties. Nevertheless, a programmer may (e.g.) use the modules of multiple, separate protocols to implement a multi-session program. We can informally outline the pragmatic conditions for (multi-session) progress in our practical framework. There are two main facets. Local computations and inter-session dependencies. The first facet concerns the preconditions (i.e., assumptions) of our practical framework regarding local computations and events. Section˜2 described the usage contract of our toolchain regarding the generated Erlang modules: the user must not modify the generated protocol- and role-specific module called the Role Module (RM), and can only modify the generated template callback module called the Callback Module (CM) according to the pre-generated structures of the EFSM and callback functions. Two key subconditions related to the latter are that the user must ensure: • Any internal or local computation event required to fire a pending callback will eventually occur. • Beyond its specific session I/O actions, every fired callback performs only non-blocking actions (e.g., local computations), and eventually terminates successfully to cede control back to the Erlang runtime (in order to fire the next callback). Note, these conditions are independent of whether a program has a single session or multiple sessions. In short, it is the user’s responsibility to ensure the correctness of local computations, i.e., all Erlang code beyond session I/O and callback actions, including arithmetic/logical expressions, general data processing and library calls. To implement a multi-session program, the user generates the (separate) RM and CM modules for the relevant roles of each protocol, and implements the necessary callbacks of each CM. Inter-session dependencies that are internal to a local program can be expressed in various ways according to the dependency. To illustrate, take the two protocols in Figure˜10. Consider implementing one Alice program to participate in two sessions, one for each protocol. Figure˜11 gives two rudimentary examples of cross-session dependencies (we mention alternative and safer approaches below under “Future work”). • (Left) The start of one session is chained to the completion of the other. Assume an Alice program that first starts the runtime handling for only the Heartbeat session. Eventually, the shown s7 callback is fired when Alice is ready to fire pong (some time after the preceding handling of ping has finished), leading to the (local, non-blocking) start_link action by Alice to start handling the Request session. Bob may asynchronously send request before or after that point; even if before, Alice consumes the request message only after ping and s7. • (Right) The handling of an event is postponed until some local condition is fulfilled. Assume an Alice program that starts the runtime handling for both sessions. Eventually, the shown s5 callback is fired when Alice receives request. If the local condition LocalCond is not yet fulfilled, Alice postpones the handling of the request message by deferring the active handler (in this example for 50ms). LocalCond may be set by some arbitrary local computation – or a local event triggered by (e.g.) the ping handler in the other session – either way, our framework does rely on the programmer to ensure the correctness of internal computations/events, as stated earlier. ⬇ 1global protocol Heartbeat(role Alice, role Carol) 2 ping() from Carol to Alice; 3 pong() from Alice to Carol; 4 ⬇ 1global protocol Request(role Alice, role Bob) 2 request() from Bob to Alice; 3 response() from Alice to Bob; 4 Figure 10. Two simple protocols for an example multi-session program. ⬇ 1s7(internal, pong, Data) →\ 2 gen_alice:send_s7_pong(CarolPid, Data), 3 _ == gen_alice2:start_link(alice2, []); 4 stop, normal, Data. 5 6 7 ⬇ 1s5(cast, BobPid, request, Data) →\ 2 case LocalCond of 3 true →\ 4 next_state, s7, Data, [next_event, internal, response]; 5 _ →\ 6 defer(BobPid, request, 50), keep_state, Data 7 end. Figure 11. Basic inter-session dependencies internal to a local Erlang program: trigger vs. defer Event-driven sessions and progress. The second main facet is that our Erlang sessions are event-driven (ED), rather than the typical ‘multithreaded’ model of π-calculi. The key points (in addition to those stated earlier) are that: • The Erlang runtime fires a callback and activates the relevant session only when the expected event has occurred and is ready for consumption. Otherwise sessions are passively suspended, meaning that no session ever actively blocks another session’s callback from firing. • Interleaving of multiple sessions is enacted semantically by the Erlang runtime interleaving the firing of callbacks on different sessions, one by one, as their events occur. That is as opposed to the syntactic interleaving of the typical I/O prefixes within a π-calculus process, where a prefix on one session can actively block a prefix on another session from being executed (which could, e.g., cause a deadlock cycle). The above concepts are found in many practical systems (e.g., Erlang, Akka, Java NIO, etc), and have been previously formalised in the setting of (linearly-typed) ED session π-calculi (Hu et al., 2010; Kouzapas et al., 2016; Viering et al., 2021). A global progress property related to the above points was formally established in the specific setting of Viering et al. (2021). Altogether, (multi-session) progress in our Erlang programs can be understood by considering the combination of these points: (1) our formal result that every distributed MC protocol individually satisfies progress (Theorems˜3.13 and 4.4); (2) the characteristics of ED sessions; (3) our assumptions on local computations in the practical programs; and (4) inter-session dependencies within a local program expressed by local computations/events. Some multi-session programs may involve only (1)-(3), e.g., as in some client-server applications that spawn a fully independent session per client; in such cases, the ED framework can effectively transfer global type progress to the multi-session process level directly. Some cases of (4) can also be limited to ensure progress, such as when sessions are strictly chained to spawn and run consecutively, or spawned in a restricted tree topology of parent-child subsessions (as found in systems based on linear logic (Wadler, 2014; Caires et al., 2016)). As mentioned, however, our practical framework does rely on the user to ensure the correctness of internal computations/events, including more advanced inter-session dependencies, in full generality. Future work. In future work, we will consider extending our toolchain to support the specification of inter-protocol dependencies via composition constraints in the style of Bocchi et al. (2023). This will allow ad hoc inter-session dependencies at the process level to instead be expressed at the protocol level. The toolchain can compose such protocols into a single EFSM and generate APIs that safely embed the dependencies correctly by construction, rather than relying on the programmer to express them via local computations as illustrated above. We also plan to investigate formalising the event-driven (ED) concurrency of Erlang’s gen_statem and its correctness properties at the process level; however, it should be noted that Erlang is dynamically typed by default. By contrast, Ciccone et al. (2024) recently proved a formal multi-session progress property for a ‘multithreaded’ session π-calculus system based on fair termination (see Section˜6). There may be connections between their notion of fair termination and our practical condition that callbacks and local computations should eventually terminate: their work may give directions for formalising ED callback termination. Viering et al. (2021) established a progress property for an ED π-calculus involving multiple sessions (their principles for ED progress are similar to those we described in the earlier paragraph). Earlier works (Padovani et al., 2014; Coppo et al., 2016) developed multi-session progress properties using additional analysis mechanisms on top of session typing. Appendix C Committing and non-committing sets - full definitions The auxiliary function for committing sets is defined as follows: ⇓c(⇾:S,C)=(S)∪⋃∈(S)⇓c(,C∪)∈C∧∉C⋃∈(S)⇓c(,C)otherwise⇓c(1⊳c′2,C)=⇓c(1,C)∪⇓c(2,C)c≠c′⇓c(μ.,C)=⇓c(,C)∅otherwise⇓c(,C)=⇓c(,C)=∅ array[]l ^c -2.84526pt( p q: [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S, [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5C)= cases labels( [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S) 10000\ ∪ _ G∈ types( [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S) -11.38092pt ^c -2.84526pt( G, [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5C∪\ q\)& p∈ C 10000\ 10000\ q ∈ C\\[17.07182pt] _ G∈ types( [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S) -11.38092pt ^c -2.84526pt( G, [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5C)& cases\\[28.45274pt] ^c -2.84526pt( G_1 [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100 1.0mu ^c 1.0mu G_2, [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5C) 10000\ = 10000\ cases ^c -2.84526pt( G_1, [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5C) 10000\ 10000\ ∪ ^c -2.84526pt( G_2, [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5C)&c≠ c 51.21504pt ^c -2.84526pt(μ t. G, [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5C)= ^c -2.84526pt( G, [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5C)\\ &otherwise 36.98866pt ^c -2.84526pt( end, [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5C)= ^c -2.84526pt( t, [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5C)= cases array The dual auxiliary function for non-committing sets is defined as follows: ⇑c(⇾:S,C)=⋃∈(S)⇑c(,C∪)∈C∧∉C(S)∪⋃∈(S)⇑c(,C)otherwise⇑c(1⊳c′2,C)=⇑c(1,C)∪⇑c(2,C)c≠c′⇑c(μ.,C)=⇑c(,C)∅otherwise⇑c(,C)=⇑c(,C)=∅ array[]l ^c -2.84526pt( p q: [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S, [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5C)= cases _ G∈ types( [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S) -11.38092pt ^c -2.84526pt( G, [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5C∪\ q\)& p∈ C 10000\ 10000\ q ∈ C\\[17.07182pt] labels( [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S) 10000\ ∪ _ G∈ types( [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S) -11.38092pt ^c -2.84526pt( G, [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5C)& cases\\[28.45274pt] ^c -2.84526pt( G_1 [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100 1.0mu ^c 1.0mu G_2, [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5C) 10000\ = 10000\ cases ^c -2.84526pt( G_1, [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5C) 10000\ 10000\ ∪ ^c -2.84526pt( G_2, [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5C)&c≠ c 48.36958pt ^c -2.84526pt(μ t. G, [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5C)= ^c -2.84526pt( G, [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5C)\\ &otherwise 36.98866pt ^c -2.84526pt( end, [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5C)= ^c -2.84526pt( t, [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5C)= cases array C.1. Extension using observers committing sets Let G be an initial type and ⇾:S1⊳c⇾:S2 q p:\, [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S_1 [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100 1.0mu 1.0mu [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100c\, p q:\, [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S_2 in () U( G) a MC definition in () U( G). Fix a special set of labels D [rgb]1,0,0 [named]pgfstrokecolorrgb1,0,0D of committing actions for the LHS of MC c by its observer p. We define the D [rgb]1,0,0 [named]pgfstrokecolorrgb1,0,0D-committing set of c as (S1∩D)∪(S2)∪⋃G∈(S1∩D)⇓c(G,C∪)∪⋃G∈(S1∖D)⇓c(G,C)∪⋃G∈(S2)⇓c(G,C∪,) array[]l labels( [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S_1\,∩\, [rgb]1,0,0 [named]pgfstrokecolorrgb1,0,0D) 10000\ ∪ 10000\ labels( [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S_2)\\ ∪ 10000\ _G∈ types( [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S_1∩ [rgb]1,0,0 [named]pgfstrokecolorrgb1,0,0D) ^c -2.84526pt(G, [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5C∪\ p\)\\ ∪ 10000\ _G∈ types( [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S_1 [rgb]1,0,0 [named]pgfstrokecolorrgb1,0,0D) ^c -2.84526pt(G, [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5C)\\ ∪ 10000\ _G∈ types( [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S_2) ^c -2.84526pt(G, [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5C∪\ p, q\) array where ⇓c(,C) ^c -2.84526pt( G, [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5C) is defined as: ⇓c(⇾:ai.ii∈I,C)=⋃i∈Iai∪⇓c(Gi,C∪)∈C∧∉C(⋃i∈Iai∩D)∪⇓c(Gi,C∪)|ai∈D∪⇓c(Gi,C)|ai∉Dotw⇓c(μ.,C)=⇓c(,C)⇓c(,C)=⇓c(,C)=∅ array[]l ^c -2.84526pt( p q:\a_i. G_i\_i∈ I, [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5C)=\\ cases _i∈ I\a_i\ 10000\ ∪ ^c -2.84526pt(G_i, [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5C∪\ q\)& p∈ C q ∈ C\\ ( _i∈ I\a_i\∩ [rgb]1,0,0 [named]pgfstrokecolorrgb1,0,0D)∪\ ^c -2.84526pt(G_i, [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5C∪\ q\) 10000\ | 10000\ a_i∈ [rgb]1,0,0 [named]pgfstrokecolorrgb1,0,0D\∪\ ^c -2.84526pt(G_i, [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5C) 10000\ | 10000\ a_i ∈ [rgb]1,0,0 [named]pgfstrokecolorrgb1,0,0D\&otw cases\\[17.07182pt] ^c -2.84526pt(μ t. G, [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5C)= ^c -2.84526pt( G, [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5C)\\[11.38092pt] ^c -2.84526pt( t, [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5C)= ^c -2.84526pt( end, [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5C)= array The definition of eventual dependency based on D [rgb]1,0,0 [named]pgfstrokecolorrgb1,0,0D is as follows: q eventually depends on p in G (wrt D [rgb]1,0,0 [named]pgfstrokecolorrgb1,0,0D), written ≪ p _ G q, if →ℓ→′ G 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ G implies ∃a∈D.!a∈ℓ→∨′→∗→!a∃ a∈ [rgb]1,0,0 [named]pgfstrokecolorrgb1,0,0D. 10000\ p q!a∈ 10000\ 10000\ G 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 -3.44444pt^* 10000\ 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q!a 10000\ . Appendix D Progress of Global Types: extended definitions and proofs Progress is proved via a number of properties. The principal ones have been discussed in the main text. Here, we give full definitions of all properties needed in the proof of progress. First, in Section D.4 we discuss well-nestedness, an auxiliary property on the structure of MC, preserved by transition. In Section D.5 we prove preservation of awareness and in Section D.6 we discuss preservation of balance. We then elaborate on their role to yield the progress property via an invariant property called coherence in Section D.7. We finally wrap up the progress property in Section D.8. Remark 1 (Instance annotations). To facilitate reasoning on the instances of MC on a global type we annotate MC instance with an instance identifier n. This annotation will be used only to prove global properties. The properties non correspondence rely on the non-annotated semantics. D.1. Global types with annotated MC The syntax of global types with annotated MC is defined by the grammar below: ::=⇾:S∣ :kS∣μ.∣⇾:S1⊳c:⇾:S2∣1▶ℒ,ℛι:2 array[]l G::= p q: [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S p 0.56905pt to8.94pt to3.31pt -1.65598pt to0.0pt @beginscope @invoke pgfstrokecolorrgb0,0,0 @color@rgb@stroke000 @invoke @color@rgb@fill000 @invoke @setlinewidth @invoke to0.0pt @beginscope @invoke @beginscope @invoke @roundcap @invoke @moveto0.0pt0.0pt @lineto0.0pt0.0pt @lineto0.92499pt0.8pt @lineto2.775pt-0.8pt @lineto4.625pt0.8pt @lineto5.55002pt0.0pt @lineto5.55002pt0.0pt @lineto5.56764pt0.0pt @stroke @invoke @beginscope @invoke @transformcm1.00.00.01.05.66763pt0.0pt @invoke @invoke @invoke @endscope @invoke @endscope @invoke @endscope @discardpath @invoke @endscope q:k\, [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S μ t. G t end q p: [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S_1 [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100 1.0mu ^c: p 1.0mu p q: [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S_2 G_1 1.0mu 1.0mu : p_L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_2 array We annotate MC definitions with a unique MC name c. Active MC are annotated with ι=c,n =c,n, which are pairs of MC names and counters n∈ℕ≥0n _≥ 0. Since a MC may be in the body of a recursive type, many instances of that MC may be generated upon recursive unfolding. We use ι to identify these instances. For readability, we omit annotations p, c,nc,n, ι , ℒL, or ℛR when not needed. The semantics of global types is defined as a Labelled Transition System over terms G with labels ℓ:=!a∣?a∣νc,n := p q!a p q?a ν c,n The semantics uses a mapping Θ from global types and MC names to ℕ≥0N_≥ 0, that gives the greatest counter among all active MC c in G Θ(,c)=(0∪n| has active MC with identifier c,n) ( G,c)= max(\0\∪\n\,|\,$ G$ has active MC with identifier $c,n$\) Θ is used to ensure that active MC are uniquely identified by c,nc,n. ⇾:ai.ii∈I→!ak :kai.ii∈I(k∈I)[] :kai.ii∈I→?akk[] ∈∀iIℓ→GiG′ip,∉qsbj(ℓ) ⇾pq:ai.Gi∈iIℓ→p⇾q:ai.G′i∈iI [] ℓ→G[μt./Gt]G′ μt.ℓ→G′ [] ℓ→GkG′k∉qsbj(ℓ)∈∀i∖Ik.=GiGi′ pq:kai.Gi∈iIℓ→p q:kai.G′i∈iI [] <Θ(⊳:cpG1G2,c)n G1⊳:cpG2νc,n→G1▶:c,np∅,∅G2 [] Glνc,n→Gl′R(¯G)≠RΘ(G,c)<n G=Gl▶L,RGrνc,n→G′l▶L,RGr [] Grνc,n→Gr′L=∅Θ(G,c)<n G=Gl▶L,RGrνc,n→Gl▶L,RGr′ [] Gl!pqa→Gl′p∉R Gl▶L,RGr!pqa→G′l▶L,RGr [] pq?a→GlGl′∉qR∈a⇓c(¯G) Gl▶L,RGrpq?a→G′l▶∪Lq,RGr [] pq?a→GlGl′∉qR∉a⇓c(¯G) Gl▶L,RGrpq?a→G′l▶L,RGr [] !pqa→GrGr′∉pL Gl▶L,RGr!pqa→Gl▶L,∪RpG′r [] Grpq?a→Gr′q∉L Gl▶L,RGrpq?a→Gl▶L,∪RqG′r [] array[]c array[]c p q:\a_i. G_i\_i∈ I 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q!a_k 10000\ p 0.56905pt to8.94pt to3.31pt -1.65598pt to0.0pt @beginscope @invoke pgfstrokecolorrgb0,0,0 @color@rgb@stroke000 @invoke @color@rgb@fill000 @invoke @setlinewidth @invoke to0.0pt @beginscope @invoke @beginscope @invoke @roundcap @invoke @moveto0.0pt0.0pt @lineto0.0pt0.0pt @lineto0.92499pt0.8pt @lineto2.775pt-0.8pt @lineto4.625pt0.8pt @lineto5.55002pt0.0pt @lineto5.55002pt0.0pt @lineto5.56764pt0.0pt @stroke @invoke @beginscope @invoke @transformcm1.00.00.01.05.66763pt0.0pt @invoke @invoke @invoke @endscope @invoke @endscope @invoke @endscope @discardpath @invoke @endscope q:k\a_i. G_i\_i∈ I 10000\ 10000\ 10000\ (k∈ I) 10000\ 10000\ [Snd]\\[8.5359pt] p 0.56905pt to8.94pt to3.31pt -1.65598pt to0.0pt @beginscope @invoke pgfstrokecolorrgb0,0,0 @color@rgb@stroke000 @invoke @color@rgb@fill000 @invoke @setlinewidth @invoke to0.0pt @beginscope @invoke @beginscope @invoke @roundcap @invoke @moveto0.0pt0.0pt @lineto0.0pt0.0pt @lineto0.92499pt0.8pt @lineto2.775pt-0.8pt @lineto4.625pt0.8pt @lineto5.55002pt0.0pt @lineto5.55002pt0.0pt @lineto5.56764pt0.0pt @stroke @invoke @beginscope @invoke @transformcm1.00.00.01.05.66763pt0.0pt @invoke @invoke @invoke @endscope @invoke @endscope @invoke @endscope @discardpath @invoke @endscope q:k\a_i. G_i\_i∈ I 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q?a_k 10000\ G_k 10000\ 10000\ 10000\ [Rcv] 10000\ 10000\ 10000\ 18.49988pt $ 74.91872pt $ ∀ i∈ I 18.49988pt G_i 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ G _i 18.49988pt p, q ∈ sbj( )$ 70.21185pt $ p q:\a_i. G_i\_i∈ I 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ p q:\a_i. G _i\_i∈ I$$ 10000\ 10000\ [Cont1]\\[19.91684pt] $ 30.7383pt $ G[μ t. G/ t] 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ G $ 21.13144pt $ μ t. G 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ G $$ 10000\ 10000\ [Rec] 18.49988pt 10000\ 10000\ $ 93.12206pt $ G_k 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ G _k 18.49988pt q ∈ sbj( ) 18.49988pt∀ i∈ I k.\, G_i= G_i $ 80.5609pt $ p 0.56905pt to8.94pt to3.31pt -1.65598pt to0.0pt @beginscope @invoke pgfstrokecolorrgb0,0,0 @color@rgb@stroke000 @invoke @color@rgb@fill000 @invoke @setlinewidth @invoke to0.0pt @beginscope @invoke @beginscope @invoke @roundcap @invoke @moveto0.0pt0.0pt @lineto0.0pt0.0pt @lineto0.92499pt0.8pt @lineto2.775pt-0.8pt @lineto4.625pt0.8pt @lineto5.55002pt0.0pt @lineto5.55002pt0.0pt @lineto5.56764pt0.0pt @stroke @invoke @beginscope @invoke @transformcm1.00.00.01.05.66763pt0.0pt @invoke @invoke @invoke @endscope @invoke @endscope @invoke @endscope @discardpath @invoke @endscope q:k\a_i. G_i\_i∈ I 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ p 0.56905pt to8.94pt to3.31pt -1.65598pt to0.0pt @beginscope @invoke pgfstrokecolorrgb0,0,0 @color@rgb@stroke000 @invoke @color@rgb@fill000 @invoke @setlinewidth @invoke to0.0pt @beginscope @invoke @beginscope @invoke @roundcap @invoke @moveto0.0pt0.0pt @lineto0.0pt0.0pt @lineto0.92499pt0.8pt @lineto2.775pt-0.8pt @lineto4.625pt0.8pt @lineto5.55002pt0.0pt @lineto5.55002pt0.0pt @lineto5.56764pt0.0pt @stroke @invoke @beginscope @invoke @transformcm1.00.00.01.05.66763pt0.0pt @invoke @invoke @invoke @endscope @invoke @endscope @invoke @endscope @discardpath @invoke @endscope q:k\a_i. G _i\_i∈ I$$ 10000\ 10000\ [Cont2]\\[19.91684pt] \\ array\\ array[]r $ 39.19582pt $ ( G_1 [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100 1.0mu ^c: p 1.0mu G_2,c)<n$ 55.95325pt $ G_1 [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100 1.0mu ^c: p 1.0mu G_2 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 ν c,n 10000\ G_1 1.0mu 1.0mu^c,n: p_ , [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_2$$ 10000\ 10000\ [Inst]& $ 70.28915pt $ G_l 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 ν c,n 10000\ G_l R( G) ( G,c)<n$ 60.69478pt $ G= G_l 1.0mu 1.0mu_L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_r 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 ν c,n 10000\ G _l 1.0mu 1.0mu_L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_r$$ 10000\ 10000\ [Ctx1]\\[25.6073pt] $ 65.17732pt $ G_r 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 ν c,n 10000\ G_r = ( G,c)<n$ 52.30295pt $ G= G_l 1.0mu 1.0mu 10000\ _L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_r 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 ν c,n 10000\ G_l 1.0mu 1.0mu 10000\ _L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_r $$ 10000\ 10000\ [Ctx2]& $ 39.36888pt $ G_l 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q!a 10000\ G_l [rgb]0.5,0.5,0 [named]pgfstrokecolorrgb0.5,0.5,0 @color@cmyk@stroke001.5 @color@cmyk@fill001.5 p $ 54.02489pt $ G_l 1.0mu 1.0mu_L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_r 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q!a 10000\ G _l 1.0mu 1.0mu_L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_r$$ 10000\ 10000\ [LSnd]\\[25.6073pt] $ 70.28879pt $ G_l 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q?a 10000\ G_l 18.49988pt [rgb]0.5,0.5,0 [named]pgfstrokecolorrgb0.5,0.5,0 @color@cmyk@stroke001.5 @color@cmyk@fill001.5 q 18.49988pta∈ ^c -2.84526pt( G)$ 63.04315pt $ G_l 1.0mu 1.0mu_L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_r 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q?a 10000\ G _l 1.0mu 1.0mu_L∪\ q\,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_r$$ 10000\ 10000\ [LRcv1]& $ 73.66379pt $ G_l 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q?a 10000\ G_l 18.49988pt [rgb]0.5,0.5,0 [named]pgfstrokecolorrgb0.5,0.5,0 @color@cmyk@stroke001.5 @color@cmyk@fill001.5 q 18.49988pta ∈ ^c -2.84526pt( G)$ 54.73946pt $ G_l 1.0mu 1.0mu_L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_r 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q?a 10000\ G _l 1.0mu 1.0mu_L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_r$$ 10000\ 10000\ [LRcv2]\\[25.6073pt] $ 44.80702pt $ G_r 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q!a 10000\ G_r 18.49988pt [rgb]0.5,0.5,0 [named]pgfstrokecolorrgb0.5,0.5,0 @color@cmyk@stroke001.5 @color@cmyk@fill001.5 p $ 61.66504pt $ G_l 1.0mu 1.0mu_L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_r 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q!a 10000\ G_l 1.0mu 1.0mu_L,R∪\ p\ [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G _r$$ 10000\ 10000\ [RSnd]& $ 40.89662pt $ G_r 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q?a 10000\ G_r [rgb]0.5,0.5,0 [named]pgfstrokecolorrgb0.5,0.5,0 @color@cmyk@stroke001.5 @color@cmyk@fill001.5 q $ 62.37962pt $ G_l 1.0mu 1.0mu_L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_r 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q?a 10000\ G_l 1.0mu 1.0mu_L,R∪\ q\ [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G _r$$ 10000\ 10000\ [RRcv] array array Figure 12. Global semantics: standard rules (top) and new rules for MC (bottom) The rules for annotated semantics are given in Figure˜12. We comment on the differences with the rules given in the paper (in Figure˜4). [] [Inst] instantiates a MC uning Θ . [] [Ctx1] and [] [Ctx2] handle nested instantiations, using Θ to ensure that n is strictly greater than any other counter for c, and label νc,nν c,n to propagate this requirement across the derivation tree (to ensure uniqueness). The other rules are unchanged with respect to Figure˜4. D.2. Unique instances Proposition D.1 (Unique instances). If 1▶c,n2 G_1 ^c,n G_2 and 1′▶c,m2′ G_1 ^c,m G_2 are distinguished subterms of a reachable G then n≠mn≠ m. Proof. Fix Θ appropriate for G such that →′ G 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ G . The proof is by induction on the derivation, proceeding by case analysis on the last rule used. Base case There is only one base case by rule [] [Inst]. [] [Inst] that increments Θ(c) (c) by one unit. Since Θ is appropriate for G (hypothesis) then Θ(c)+1 (c)+1 will be strictly greater than any instance number occurring in G for c. Inductive cases In case of transitions by [] [Cont1], [] [Cont2], [] [Rec], and [] [Ctx1] (and symmetric) the thesis holds directly by induction. Remarkably, [] [Ctx2] ensures that an instantiation with n happens in only one side of a timeout for any one transition. Observe that rule [] [RTAct], allowing the two sides to move in the same transition, cannot be applied to instantiate a timeout because of premise ℓ∉νc,n|c∈∧n∈ℕ+ ∈\ν c,n\,|\,c n ^+\. ∎ D.3. Monotonicity Proposition D.2 (Monotonicity). For any global type of the form [1▶ℒ,ℛι2]C[ G_1 1.0mu 1.0mu _L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_2]: [1▶ℒ,ℛι2]→′[1′▶ℒ′,ℛ′ι2′]⇒ℒ′⊇ℒ∧ℛ′⊇ℛ [ G_1 1.0mu 1.0mu _L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_2] 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ C [ G_1 1.0mu 1.0mu _L ,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_2 ] 10000\ 10000\ 10000\ 10000\ R Monotonicity extends trivially to MC definitions, which have no commitments and are instantiated into active MC with empty commitment sets. Proof. We show that, given a MC with identifier ι , a transition can only extend its commitment sets ℒL and ℛR. Let =[1⊳c:2] G=C[ G_1 [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100 1.0mu ^c: p 1.0mu G_2] or =[1▶ℒ,ℛc,n:2] G=C[ G_1 1.0mu 1.0mu^c,n: p_L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_2]. We proceed by induction on C. In the base case, =[_]C=[\,\_\,], we proceed by analysis on the last rule used for the transition, which can be: [] [LSnd], [] [LRcv1], [] [LRcv2], [] [RSnd], or [] [RRcv], or [] [RTAct]. None of these rules is removing elements from ℛR and ℒL hence the thesis. In the inductive case, if C is an interaction it can move by either (a) [] [Snd] or [] [Rcv] leaving the continuations unchanged and yielding the thesis, or (b) [] [Cont1] or [] [Cont2] yielding the thesis by induction. If =[_]▶ℒ′,ℛ′c′,n′:′2′C=[\,\_\,] 1.0mu 1.0mu^c ,n : p _L ,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_2 then one of the following three cases can happen: (a) 2′ G_2 moves by [] [RSnd] or [] [RRcv] not affecting the right-hand side of timeout c′,n′:′c ,n : p hence yielding the thesis; (b) the left-hand side moves and the thesis follows by induction; (c) both sides move by [] [RTAct] with the thesis following by induction. The case for =1′▶ℒ′,ℛ′c′,n′:′[_]C= G_1 1.0mu 1.0mu^c ,n : p _L ,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0[\,\_\,] is symmetric. The two cases for not initialized timeout context and recursion are vacuous since all timeouts are initially timeout definitions and initialization happens in nesting order. The case for recursion is vacuous since a recursion only has timeout definitions. ∎ D.4. Well-nestedness We define a structural invariant on MCs with respect to ℒL and ℛR. Definition D.3 (Well-nested G). G is well-nested if =[1▶ℒ,ℛ2] G=C[\, G_1 1.0mu 1.0mu q_L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_2\,] implies (1) ℒ≠∅∨1=⇾:S∨1= :kSL = 10000\ 10000\ G_1= p q: [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S 10000\ 10000\ G_1= p 0.56905pt to8.94pt to3.31pt -1.65598pt to0.0pt @beginscope @invoke pgfstrokecolorrgb0,0,0 @color@rgb@stroke000 @invoke @color@rgb@fill000 @invoke @setlinewidth @invoke to0.0pt @beginscope @invoke @beginscope @invoke @roundcap @invoke @moveto0.0pt0.0pt @lineto0.0pt0.0pt @lineto0.92499pt0.8pt @lineto2.775pt-0.8pt @lineto4.625pt0.8pt @lineto5.55002pt0.0pt @lineto5.55002pt0.0pt @lineto5.56764pt0.0pt @stroke @invoke @beginscope @invoke @transformcm1.00.00.01.05.66763pt0.0pt @invoke @invoke @invoke @endscope @invoke @endscope @invoke @endscope @discardpath @invoke @endscope q:k\, [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S for some p, S [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S, and (2) ℛ≠∅∨2=⇾:SR = 10000\ 10000\ G_2= p q: [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S for some p, S [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S. Lemma D.4 (Well-nested preservation). If G is well-nested and →ℓ′ G 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ G then ′ G is well-nested. Proof. Since G is well-nested, fix C to be any context such that =[1▶ℒ,ℛc,n:2] G=C[\, G_1 1.0mu 1.0mu^c,n: q_L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_2\,]. We first consider case (1) of Definition D.3. • Base case =[_]C=[\,\_\,]. – if G is of the form ⇾:S p q: [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S or :kS p 0.56905pt to8.94pt to3.31pt -1.65598pt to0.0pt @beginscope @invoke pgfstrokecolorrgb0,0,0 @color@rgb@stroke000 @invoke @color@rgb@fill000 @invoke @setlinewidth @invoke to0.0pt @beginscope @invoke @beginscope @invoke @roundcap @invoke @moveto0.0pt0.0pt @lineto0.0pt0.0pt @lineto0.92499pt0.8pt @lineto2.775pt-0.8pt @lineto4.625pt0.8pt @lineto5.55002pt0.0pt @lineto5.55002pt0.0pt @lineto5.56764pt0.0pt @stroke @invoke @beginscope @invoke @transformcm1.00.00.01.05.66763pt0.0pt @invoke @invoke @invoke @endscope @invoke @endscope @invoke @endscope @discardpath @invoke @endscope q:k\, [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S we have two cases: (1) the prefix moves, which leaves S [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S unchanged hence done, (2) C moves and the thesis is by inner induction. – if =1▶ℒ,ℛc,n:2 G= G_1 1.0mu 1.0mu^c,n: q_L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_2 and ℒ≠∅L = then the thesis follows observing that no rules remove roles from ℒL and hence this set will still be non-empty after transition. If ℒ=∅L= then by well-nestedness of G we have one of the following cases: * =⇾:S▶ℒ,ℛc,n:2 G= p q: [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S 1.0mu 1.0mu^c,n: q_L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_2. If 2 G_2 or S [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S moves, the thesis is by inner induction. If the prefix moves then it moves by [][ LSnd] to :kS▶ℒ,ℛc,n:2 s 0.56905pt to8.94pt to3.31pt -1.65598pt to0.0pt @beginscope @invoke pgfstrokecolorrgb0,0,0 @color@rgb@stroke000 @invoke @color@rgb@fill000 @invoke @setlinewidth @invoke to0.0pt @beginscope @invoke @beginscope @invoke @roundcap @invoke @moveto0.0pt0.0pt @lineto0.0pt0.0pt @lineto0.92499pt0.8pt @lineto2.775pt-0.8pt @lineto4.625pt0.8pt @lineto5.55002pt0.0pt @lineto5.55002pt0.0pt @lineto5.56764pt0.0pt @stroke @invoke @beginscope @invoke @transformcm1.00.00.01.05.66763pt0.0pt @invoke @invoke @invoke @endscope @invoke @endscope @invoke @endscope @discardpath @invoke @endscope r:k\, [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S 1.0mu 1.0mu^c,n: p_L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_2 for some k, which is still well-nested. * = :kS▶ℒ,ℛq2 G= s 0.56905pt to8.94pt to3.31pt -1.65598pt to0.0pt @beginscope @invoke pgfstrokecolorrgb0,0,0 @color@rgb@stroke000 @invoke @color@rgb@fill000 @invoke @setlinewidth @invoke to0.0pt @beginscope @invoke @beginscope @invoke @roundcap @invoke @moveto0.0pt0.0pt @lineto0.0pt0.0pt @lineto0.92499pt0.8pt @lineto2.775pt-0.8pt @lineto4.625pt0.8pt @lineto5.55002pt0.0pt @lineto5.55002pt0.0pt @lineto5.56764pt0.0pt @stroke @invoke @beginscope @invoke @transformcm1.00.00.01.05.66763pt0.0pt @invoke @invoke @invoke @endscope @invoke @endscope @invoke @endscope @discardpath @invoke @endscope r:k\, [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S 1.0mu 1.0mu^q_L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_2. Again, if 2 G_2 or C moves, the thesis is by inner induction. If the prefix moves, it is for [][ LRcv1] since ℒ=∅L= to S▶ℒ∪,ℛc,n:2 [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S 1.0mu 1.0mu^c,n: q_L∪\ q\,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_2 which is well-nested since ℒ∪≠∅L∪\ q\ = . – If = :kS▶ℒ,ℛq2 G= p 0.56905pt to8.94pt to3.31pt -1.65598pt to0.0pt @beginscope @invoke pgfstrokecolorrgb0,0,0 @color@rgb@stroke000 @invoke @color@rgb@fill000 @invoke @setlinewidth @invoke to0.0pt @beginscope @invoke @beginscope @invoke @roundcap @invoke @moveto0.0pt0.0pt @lineto0.0pt0.0pt @lineto0.92499pt0.8pt @lineto2.775pt-0.8pt @lineto4.625pt0.8pt @lineto5.55002pt0.0pt @lineto5.55002pt0.0pt @lineto5.56764pt0.0pt @stroke @invoke @beginscope @invoke @transformcm1.00.00.01.05.66763pt0.0pt @invoke @invoke @invoke @endscope @invoke @endscope @invoke @endscope @discardpath @invoke @endscope q:k\, [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S 1.0mu 1.0mu^q_L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_2 the case is similar to the above. • Inductive cases =⇾:S∪a.[_]C= p q: [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S∪\a.[\,\_\,]\ or :kS∪ak.[_] p 0.56905pt to8.94pt to3.31pt -1.65598pt to0.0pt @beginscope @invoke pgfstrokecolorrgb0,0,0 @color@rgb@stroke000 @invoke @color@rgb@fill000 @invoke @setlinewidth @invoke to0.0pt @beginscope @invoke @beginscope @invoke @roundcap @invoke @moveto0.0pt0.0pt @lineto0.0pt0.0pt @lineto0.92499pt0.8pt @lineto2.775pt-0.8pt @lineto4.625pt0.8pt @lineto5.55002pt0.0pt @lineto5.55002pt0.0pt @lineto5.56764pt0.0pt @stroke @invoke @beginscope @invoke @transformcm1.00.00.01.05.66763pt0.0pt @invoke @invoke @invoke @endscope @invoke @endscope @invoke @endscope @discardpath @invoke @endscope q:k\, [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S∪\a_k.[\,\_\,]\, either by outer induction of S [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S (if S [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S changes) or inner induction on G if the hole changes. • Inductive case =[_]▶ℒ,ℛc,n:C=[\,\_\,] 1.0mu 1.0mu^c,n: q_L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G. If ℒ≠∅L = then the thesis follows observing that no rules remove roles from ℒL and hence this set will still be non-empty after transition. If ℒ=∅L= then =⇾:S▶ℒ,ℛc,n:′ G= s r: [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S 1.0mu 1.0mu^c,n: q_L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G or = :kS▶ℒ,ℛc,n:′ G= s 0.56905pt to8.94pt to3.31pt -1.65598pt to0.0pt @beginscope @invoke pgfstrokecolorrgb0,0,0 @color@rgb@stroke000 @invoke @color@rgb@fill000 @invoke @setlinewidth @invoke to0.0pt @beginscope @invoke @beginscope @invoke @roundcap @invoke @moveto0.0pt0.0pt @lineto0.0pt0.0pt @lineto0.92499pt0.8pt @lineto2.775pt-0.8pt @lineto4.625pt0.8pt @lineto5.55002pt0.0pt @lineto5.55002pt0.0pt @lineto5.56764pt0.0pt @stroke @invoke @beginscope @invoke @transformcm1.00.00.01.05.66763pt0.0pt @invoke @invoke @invoke @endscope @invoke @endscope @invoke @endscope @discardpath @invoke @endscope r:k\, [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S 1.0mu 1.0mu^c,n: q_L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G by well-nestedness of G. The case is similar to the second base case for =[_]C=[\,\_\,]. • Inductive case =′▶ℒ,ℛc,n:[_]C= G 1.0mu 1.0mu^c,n: q_L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0[\,\_\,]. Similar to the above. • Inductive cases =[_]⊳c: G=[\,\_\,] [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100 1.0mu ^c: p 1.0mu G or =⊳c:[_] G= G [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100 1.0mu ^c: p 1.0mu[\,\_\,] : the move can only be by [][ Inst] which does not change the structure of the process, hence done. • Inductive case =μ.[_] G=μ t.[\,\_\,] : the move can only be by [][ Rec], and by its premise the type in the hole preserves well-nestedness. The thesis is by induction. The case for Definition D.3(2) is similar to the one for Definition D.3(1): either ℛ=∅R= with some participants on the right-hand side of the MC, or the next committing role is included in ℛR by [] [Rsnd]. ∎ D.5. Preservation of awareness Awareness is preserved by transition. Before proving this property we give an auxiliary proposition. Proposition˜D.5 states that if all roles in G depend on p then the first action of G is an action by p. Proposition D.5. If < p<_ G and →ℓ G 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ then (ℓ)= sbj( )= p. Proposition D.6 (Awareness Preservation). is aware ∧→′⇒′ is aware. G is aware 10000\ 10000\ G 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ G 10000\ 10000\ 10000\ 10000\ G is aware. Proof. The proof is by induction on the derivation, proceeding by case analysis on the last rule used. Base cases If the transition is by [] [Snd], any MC in any continuation i G_i, which is aware in G by hypothesis, remains unchanged hence aware. The case for [] [Rcv] is similar. The case for [] [Inst] only changes the outer MC definition into an active MC with empty L-set and R-set. If L-set and R-set are empty awareness for MC definitions is equivalent to awareness for active MC. The thesis is therefore straightforward by awareness of G. Inductive cases Cases for [][ Cont1] and [][ Cont2] are straightforward by induction. For [][ Rec], observe that a recursive type has a transition ℓ if and only if its one-time unfolding has a transition ℓ , and they both reach the same state. Therefore, if =μ.′ G=μ t. G is aware then also ′[μ.′/] G \,[μ t. G / t] is aware and after a transition they reach the same state ′ G . By inductive hypothesis and awareness of ′[μ.′/] G \,[μ t. G / t] it follows that ′ G is aware hence done. For [][ Ctx1] then =▶ℒ,ℛ G= G_ l 1.0mu 1.0mu 10000\ _L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_ r and by induction if G_ l makes a move to ′ G_ l then l′ G_l is aware. So ′ G_ l and G_ r are aware (the second directly by hypothesis) meaning that all MC in them are aware. It remains to show that the outermost MC ▶ℒ,ℛ G_ l 1.0mu 1.0mu 10000\ _L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_ r is still aware after the transition. This follows by the fact that the move with label νc,nν c,n leaves LR-sets, and participants and dependencies unchanged from G_ l to ′ G_ l . The symmetric case is similar. For [][ LSnd] assume =▶ℒ,ℛr G= G_ l 1.0mu 1.0mu 10000\ _L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_r and ′=′▶ℒ,ℛr G = G_ l 1.0mu 1.0mu 10000\ _L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_r and the observer of G is p. Single decision and clear termination of G_ l follow by induction and awareness of r G_r follows by hypothesis. Single decision of G follows by single decision of G_ l and by the fact that r G_r is unchanged by the transition. We only need to show clear termination of the outermost MC in ′ G . If ℒ≠∅L = then the outermost MC in ′ G is clear termination since the premise in the implication of case (2) of Definition 3.9 is negative. Assume now ℒ=∅L= . By clear-termination of G at least one of the following holds: (a) all roles diverge in 1 G_1, (b) every state reached by 1 G_1 and any role in 1 G_1, it is possible to reach a state where that roles makes an action. (a) is clearly preserved by reduction (an infinite execution remains infinite if we remove a finite prefix). (b) is also preserved since rule [][ LSnd] does not change ℒL and hence future committing action that makes 1 G_1 clear-termination is also available in 1′ G_1 . For [][ LRcv1] assume =l▶ℒ,ℛc,n:r G= G_l 1.0mu 1.0mu^c,n: r_L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_r and the reached state has type ′=l′▶ℒ∪,ℛc,n:r G = G _l 1.0mu 1.0mu^c,n: r_L∪\ q\,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_r. To show clear-termination, observe that the reached state has L-set ℒ∪≠∅L∪\ q\ = and hence clear-termination of ′ G follows immediately (by negative premise). Single decision is trivial since the right-hand side of the MC remains unchanged (hence still enjoys single decision). Case [][ LRcv2] (single-decision and clear-termination) is similar to [][ LSnd] except we now know that the action does not have the observer as subject by premise of the rule [][ LRcv2]. Cases [][ RSnd] and [][ RRcv]: clear termination follows by hypothesis since the left-hand side of the MC does not change, single decision follows by negative premise since the L-set in the reached state includes the subject of ℓ and hence is not empty. ∎ D.6. Preservation of balance Balance is not, in general, preserved by transition. For example, the global type on the left of (5) is balanced and it reduces to a state, on the right of (5), that is not since q is nor in the roles of the LHS nor in the left commit set. (5) ⇾:ak.▶∅,∅⇾:S→!ak :kak.▶∅,∅⇾:S q p:a_k. end 1.0mu 1.0mu p_ , [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 p q: [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S 10000\ 10000\ 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q!a_k 10000\ 10000\ 10000\ q 0.56905pt to8.94pt to3.31pt -1.65598pt to0.0pt @beginscope @invoke [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @invoke @color@gray@fill0 @invoke @setlinewidth @invoke to0.0pt @beginscope @invoke @beginscope @invoke @roundcap @invoke @moveto0.0pt0.0pt @lineto0.0pt0.0pt @lineto0.92499pt0.8pt @lineto2.775pt-0.8pt @lineto4.625pt0.8pt @lineto5.55002pt0.0pt @lineto5.55002pt0.0pt @lineto5.56764pt0.0pt @stroke @invoke @beginscope @invoke @transformcm1.00.00.01.05.66763pt0.0pt @invoke @invoke @invoke @endscope @invoke @endscope @invoke @endscope @discardpath @invoke @endscope p:k\,a_k. end\, 1.0mu 1.0mu p_ , [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 p q: [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S However, in presence of awareness, balance is preserved by transition. Proposition D.7 (Balance & Preservation). is aware and balanced ∧→′⇒′ is balanced. G is aware and balanced 10000\ 10000\ G 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ G 10000\ 10000\ 10000\ 10000\ G is balanced. The proof of Proposition D.7 is mechanical by induction on the transition. One key point to observe is that clear-termination always ensures that any role r not yet committed in a MC still appears in the LHS (either because it has to receive a committing message, or because it diverges in the LHS). In the first case each role will naturally occur until it is committed, in the second case it will occur in the unfolding. This is key to preserve balance. D.7. Coherence Definition D.8 (Coherent G). G is coherent if: =[1▶ℒ,ℛ2]⟹ℒ=∅∨ℛ=∅ G=C[\, G_1 1.0mu 1.0mu_L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_2\,]\, \,L= \, \,R= Informally, coherence of G requires that no role is committed to different sides of the same active MC in G. Coherence is preserved by transition and hence is invariant for all states reachable from an initial global types enjoying balance and awareness. The proof of coherence is given after a few auxiliaries. Definition D.9 (Ready roles). We say that a role is ready in G, written ∈() p∈ ready( G), if there exists ℓ such that →ℓ G 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ and (ℓ)= sbj( )= p. Namely, a role p is ready in G if p can immediately make a send or receive action. The following proposition can be proved mechanically by induction on the syntax of 1 G_1, observing that the definition of committing set always adds the observer of a MC first, to the committing set of a mixed choice, before all other causally related actions. Proposition D.10. Given a MC 1⊳2 G_1 [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100 1.0mu 1.0mu G_2 with observer p and (finite or infinite) execution 1→l→ G_1 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 l 10000\ , the first committing action in vector ℓ (if any is committing) has subject p. Proposition D.11 (LR-initiation). Consider an aware active MC of the form [1▶ℒ,ℛ2]C[ G_1 1.0mu 1.0mu p_L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_2] (1) If ∈(2)∖ r∈ ready( G_2) \ p\ then ∈ℛ p . (2) If ∉ℛ p then ℛ=∅R= . (3) If ∉ℒ p then ℒ=∅L= . Proof. (sketch) To prove (1,2) observe that the execution of any good state G is in one of the following four meta-states: (1) (initial): 1⊳c:2 G_1 [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100 1.0mu ^c: p 1.0mu G_2 is a subterm of G and G has no active MC instances c,nc,n; (2) (initialized) 1▶ℒ,∅c,n:2 G_1 1.0mu 1.0mu^c,n: p_L, [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_2 is a subterm of G; (3) (R-committed) 1▶ℒ,ℛ∪c,n:2 G_1 1.0mu 1.0mu^c,n: p_L,R∪\ p\ [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_2. In state (1) G can make: • transitions that are not with label νc,n′ν c,n with n′∈ℕn . This can be by [][ Snd], [][ Rcv], [][ Cont1], [][ Cont2], [][ Rec] that will preserve state (1), • a transition with label νc,n′ν c,n with n′<n <n and move to state (1), • a transition with label νc,nν c,n and move to state (2). In state (2) G can make • non-committing actions by [][ LSnd], [][ LRcv2], [][ RTAct] that preserve state (2), • an action committing on the left by [][ LRcv1] which also preserves state (2), • an action committing on the right. Since ℛ=∅R= and the first committing action on the RHS is by the observer (by awareness - single decision) hence reaches a state with subterm 1▶ℒ,c,n:2 G_1 1.0mu 1.0mu^c,n: p_L,\ p\ [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_2 and which is in state (3). Any transition from (3) lead to state (3) by monotonicity (Proposition˜D.2). The case (3) that ∉ℒ p implies ℒ=∅L= can be proved similarly with meta states (1) (initial): 1⊳c:2 G_1 [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100 1.0mu ^c: p 1.0mu G_2 is a subterm of G but G has no MC c,nc,n; (2) (initialized) 1▶∅,ℛc,n:2 G_1 1.0mu 1.0mu^c,n: p_ ,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_2 is a subterm of G; (3) (L-committed) 1▶ℒ∪,ℛc,n:2 G_1 1.0mu 1.0mu^c,n: p_L∪\ p\,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_2. In this case the only committing action on the left-hand side (main block) would be for rule [][ LRcv1] from meta-state (2) to meta-state (3) which is the only rule allowing for a committing action (i.e., altering ℒL). By Proposition D.10 this action is by the observer. Preservation of meta-state (3) is by monotonicity (Proposition˜D.2). ∎ Proposition˜D.11 shows that the observer of a MC (1) is always the one making the first action on the RHS and (2,3) is always the first one to commit to any side. Lemma D.12 (Coherence Preservation). is coherent and aware ∧→′⇒′ is coherent G is coherent and aware 10000\ G 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ G G is coherent Proof. Coherence relies on the dependency between actions guaranteed by awareness. Let =[h] G=C[\, G_h\,] for some h G_h. We proceed by induction on the syntax of C and inner induction on the syntax of h G_h. Case =[_]C=[\,\_\,] (base case outer induction). In this case h= G_h= G. If = G= end the thesis is immediate. If G is a communication the thesis follow by inner induction on G. If G is a recursion then action ℓ is by rule [] [Rec] and ′=′[μ./] G = G [μ t. G/ t]. ′ G is coherent by inner induction, and μ.μ t. G is coherent by hypothesis. It follows that ′ G is coherent, hence done. The interesting case is for =1▶ℒ,ℛc,n:2 G= G_1 1.0mu 1.0mu^c,n: p_L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_2 We proceed by case analysis on the last rule used to derive transition. The last rule applied is one of the following: • [] [Snd] or [] [Rcv] : the thesis follows by the coherence hypothesis and the fact that ℒL and ℛR are not modified by these rules. • [] [Inst], [] [Ctx1] or [] [Ctx2] : These rules do not change ℒL and ℛR so in case of [] [Inst] the thesis is immediate, in case of [] [Ctx1] and [] [Ctx2] it is directly by induction. • [] [LSnd] or [] [LRcv2] : 1→ℓ1′ G_1 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ G_1 with 1′ G_1 coherent by (inner) induction. The transition does not change ℒL, ℛR, and 2 G_2. Then ′=1′▶ℒ,ℛc,n:2 G = G_1 1.0mu 1.0mu^c,n: p_L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_2 is also coherent, hence done. • [] [LRcv1] : 1→?a1′ G_1 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 s r?a 10000\ G_1 with 1′ G_1 coherent by (inner) induction and a committing in G. Since a is a committing receive action, the corresponding send action is also committing, the We have two cases: – if ∈ℒ s then ℛ=∅R= by coherence of G. – if ∉ℒ s then = s= p (i.e., s is the observer). By premise of [] [LRcv1] i̸n s in r and by Proposition˜D.11– LR-initiation (2) if the observer is not in ℛR then ℛ=∅R= . In either of the cases above ℛ=∅R= , hence ′=1′▶ℒ∪,∅c,n:2 G = G_1 1.0mu 1.0mu^c,n: p_L∪\ q\, [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_2 is coherent. • [] [RSnd] : in this case ′=1▶ℒ,ℛ∪c,n:2′ G = G_1 1.0mu 1.0mu^c,n: p_L,R∪\ r\ [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_2 . Since the rule adds an element to ℛR we need to show that ℒL is empty. We have two cases: – if = r= p, since ∉ℒ p (by premise of [] [RSnd]) then ℒ=∅L= (by Lemma D.11(3)) – if ≠ r = p then since r is R-acting we have ∈ℛ p (by Lemma D.11(1)). By coherence of G and ∈ℛ p it follows ℒ=∅L= . Since ℒL is unchanged in ′ G then ′ G is coherent. • [] [RRcv] : Similar to the case for [] [RSnd]. • [] [RTAct] : 1→ℓ1′ G_1 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ G_1 and 2→ℓ2′ G_2 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ G_2 . Since 1′ G_1 and 2′ G_2 are coherent by induction and ℒL and ℛR remain unchanged, then ′=1′▶ℒ,ℛc,n:2′ G = G_1 1.0mu 1.0mu^c,n: p_L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_2 is also coherent. • [] [Cont1] or [] [Cont2]: immediate by (inner) induction. Case C is a prefix. If C is a prefix, either communication or message in transit, the transition of G is by [] [Snd] or [] [Rcv], this case is similar to the first case for =[_]C=[\,\_\,]. The case for transition by [] [Cont1] or [] [Cont2] is also similar, by inner induction. Case =[_]▶ℒ,ℛc,n:2C=[\,\_\,] 1.0mu 1.0mu^c,n: r_L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_2. By hypothesis, either ℒ=∅L= or ℛ=∅R= . If By Lemma D.4 (well-nestedness) the form of C can be assumed to be ⇾:S∪a.[_]▶ℒ,ℛc,n:2 p q: [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S∪\a.[\,\_\,]\ 1.0mu 1.0mu^c,n: p_L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_2. Proceed by case analysis on the last rule used in the derivation: • [] [Lsnd] : in the premise, either C moves by [] [Lsnd] or G (the global type in the hole) moves. In the first case, only the MCs in the selected branch appear in the context after transition and, in those MCs, the sets do not change. The thesis then follows by coherence of G. If h→ℓh′ G_h 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ G_h by inner induction h′ G_h is coherent, hence, since ℒL, ℛR, and 2 G_2 are coherent by hypothesis, also ′ G is coherent. • [] [LRcv1] : if C moves by [] [Snd] this case is similar to the one above for [] [LSnd]. • [] [LRcv2] : Similar to [] [LSnd]. • [] [RSnd] : since this rules adds q to ℒL by Proposition˜D.11 – LR-initiation (3) – it must be ∈ℒ p and hence ℛ=∅R= for coherence of G. • [] [RRcv] : This rule adds an element of the right-hand side set. By Proposition˜D.11 – LR-initiation (1) if ℛR is not empty then ∈ℛ q hence ℒ=∅L= . Case =1▶ℒ,ℛr⇾:S∪a.[_]C= G_1 1.0mu 1.0mu^r_L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 p q: [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S∪\a.[\,\_\,]\. Similar to the symmetric one. Case =[_]⊳c:2C=[\,\_\,] [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100 1.0mu ^c: p 1.0mu G_2 or =1⊳c:[_]C= G_1 [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100 1.0mu ^c: p 1.0mu[\,\_\,] . Immediate by hypothesis since G only allows an action by [Inst] which does not change ℒL and ℛR. Case μ.[_]μ t.[\,\_\,] By induction. ∎ Next, Since initial states are coherent, then all states reachable from an initial one are coherent. Corollary D.13 (Coherence Invariant). Any G reachable from an initial global type that enjoys balance and awareness is coherent. D.8. Progress Progress is proved by first looking at single steps (Lemma˜D.14). The diagram below gives a highlight of how the auxiliary lemmata and definitions contribute to Lemma˜D.14. The diagram outlines the dependencies of progress from the definitions (shown in blue) and lemmata given before. The final result Theorem˜3.13 follows from Lemma˜D.14 observing that initial well set global types are aware and balanced, and that these properties are preserved by transition. Awareness(Definition˜3.9)Coherencepreservation(Lemma˜D.12)LR-initiation(Proposition˜D.11)Progress(Lemma˜D.14)Balance(Definition˜3.12)Well-nestedness(Lemma˜D.4)Monotonicity(Proposition˜D.2)Coherence(Definition˜D.8) Lemma D.14 (Progress). If G is aware, balanced, and coherent then G enjoys progress. Proof. We proceed by case analysis on the syntax of G. If =⇾:ai.ii∈I G= p q:\a_i. G_i\_i∈ I since ∈() r∈ R( G) then either ∈, r∈\ p, q\ or ∈i r∈ G_i for all i (by balance of G). If ∈, r∈\ p, q\ then the thesis holds immediately after either a step !ai! p qa_i or a step !ai! p qa_i followed by ?ai? p qa_i. Assume ∈i r∈ G_i for all i∈Ii∈ I. Fix j∈Ij∈ I, j G_j is coherent and balanced by inductive definitions of coherence and balance. By induction, (6) j→∗→ℓ with (ℓ)= G_j 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 -3.44444pt^* 10000\ -5.69046pt 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ with sbj( )= r hence, by applying [][ Snd] and [][ Rcv] to G and then (6) to j G_j: →!aj :jai.ii∈I→?ajj→∗→ℓ with (ℓ)= G 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 ! p qa_j 10000\ p 0.56905pt to8.94pt to3.31pt -1.65598pt to0.0pt @beginscope @invoke pgfstrokecolorrgb0,0,0 @color@rgb@stroke000 @invoke @color@rgb@fill000 @invoke @setlinewidth @invoke to0.0pt @beginscope @invoke @beginscope @invoke @roundcap @invoke @moveto0.0pt0.0pt @lineto0.0pt0.0pt @lineto0.92499pt0.8pt @lineto2.775pt-0.8pt @lineto4.625pt0.8pt @lineto5.55002pt0.0pt @lineto5.55002pt0.0pt @lineto5.56764pt0.0pt @stroke @invoke @beginscope @invoke @transformcm1.00.00.01.05.66763pt0.0pt @invoke @invoke @invoke @endscope @invoke @endscope @invoke @endscope @discardpath @invoke @endscope q:j\,\a_i. G_i\_i∈ I 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 ? p qa_j 10000\ G_j 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 -3.44444pt^* 10000\ -5.69046pt 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ with sbj( )= r Which satisfies the thesis. The case for = :kai.ii∈I G= p 0.56905pt to8.94pt to3.31pt -1.65598pt to0.0pt @beginscope @invoke pgfstrokecolorrgb0,0,0 @color@rgb@stroke000 @invoke @color@rgb@fill000 @invoke @setlinewidth @invoke to0.0pt @beginscope @invoke @beginscope @invoke @roundcap @invoke @moveto0.0pt0.0pt @lineto0.0pt0.0pt @lineto0.92499pt0.8pt @lineto2.775pt-0.8pt @lineto4.625pt0.8pt @lineto5.55002pt0.0pt @lineto5.55002pt0.0pt @lineto5.56764pt0.0pt @stroke @invoke @beginscope @invoke @transformcm1.00.00.01.05.66763pt0.0pt @invoke @invoke @invoke @endscope @invoke @endscope @invoke @endscope @discardpath @invoke @endscope q:k\,\a_i. G_i\_i∈ I is similar. If =1▶ℒ,ℛc,n:2 G= G_1 1.0mu 1.0mu^c,n: p_L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_2, by coherence of G (hypothesis) we can assume ℒ=∅L= or ℛ=∅R= . So we have three cases. (1) assume ℒ=∅∧ℛ≠∅L= ≠ . Since ∈() r∈ R( G) then (7) ∈(1)∖ℛ∪∈(2)∖∅(by definition of ()) r∈ R( G_1) ∪ r∈ R( G_2) (by definition of $ R( G)$) and (8) (1)∪∅=(2)∪ℛ(by balance) R( G_1)∪ = R( G_2) (by balance) By combining (7) and (8) we know ∈(2) r∈ R( G_2). Observe that 2 G_2 is participating, aware, coherent (by inductive definitions, and universal quantification of awareness over all MCs) and hence, by induction, 2 G_2 enjoys progress: 2→∗→ℓ with (ℓ)= G_2 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 -3.44444pt^* 10000\ -5.69046pt 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ with sbj( )= r We need to check that all actions of 2 G_2 that bring to action ℓ , and ℓ itself, can also be executed by the MC. By inspection of the rules, actions on the right-hand side of the MC can be lifted to the MC context using one of the following rules: [] [RSnd], [] [RRcv], or [] [Ctx1]. Rule [] [RRcv] can only be applied. Rules [] [RSnd] and [] [Ctx2] can be applied if the subject of the action is not in ℒL. This is the case by coherence preservation. (2) assume ℛ=∅R= and ℒ≠∅L≠ . By definition of () R( G) we have that ∈() r∈ R( G) implies ∈(1)∖∅ r∈ R( G_1) or ∈(2)∖ℒ r∈ R( G_2) . As in the symmetric case, by balance of G, we can infer ∈(1) r∈ R( G_1). By coherence and balance of G also 1 G_1 is coherent, and enjoys balance. By induction, 1 G_1 enjoys progress: 1→∗→ℓ with (ℓ)= G_1 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 -3.44444pt^* 10000\ -5.69046pt 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ with sbj( )= r First observe that by clear-termination if ∈2 r∈ R G_2 then it is also in and To lift each action of 1 G_1 to G we need to use, for each transition, one of the rules below (as last applied rule) [] [LSnd], [] [LRcv1], [] [LRcv2], or [] [Ctx1]. Rule [] [LSnd] requires that the subject of the action is not in ℛR which holds by since ℛ=∅R= in G and this is preserved by coherence since ℒ≠∅L = . Similarly, [] [Ctx1] requires that ℛR does not coincide with the set of roles of the base type which is true since ℛ=∅R= . The only premise that would disallow the same transition to G is that the subject of that action must not be in ℛR in [] [LSnd], [] [LRcv1], and [] [Lrcv2], which follows since in this case we assume ℛ=∅R= . Similarly, the premise of [] [Ctx1] that (¯)≠ℛ R( G) =R (all roles of the base type have committed on the right), holds since ℛ=∅R= . (3) assume ℛ=ℒ=∅R=L= . By balance of G, r is in both (1) R( G_1) and (2) R( G_2). By coherence and balance of G also 1 G_1 and 2 G_2 are both coherent, and enjoy balance. By induction, for i∈1,2i∈\1,2\, i G_i enjoys progress: i→∗→ℓ with (ℓ)= G_i 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 -3.44444pt^* 10000\ -5.69046pt 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ with sbj( )= r We have two cases: (1) all actions in →∗ 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 -3.44444pt^* 10000\ are non-committing, or (2) there is at least one committing action in →∗ 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 -3.44444pt^* 10000\ . In case (1), the ℒL and ℛR of the intermediate states will be left empty, and hence all actions can be lifted to G as the only premises for an action on the RHS (resp. LHS) is that the subject of the action is not in ℒL (resp. ℛR). Similarly for the context rules for MC initialization. In case (2), without loss of generality, assume i→∗ G_i 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 -3.44444pt^* 10000\ is broken into the sequence i→∗→ℓc→∗ G_i 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 -3.44444pt^* 10000\ 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 _c 10000\ 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 -3.44444pt^* 10000\ such that all actions before ℓc _c are non-committing and ℓc _c is committing. Let c G_c be the state reached after ℓc _c. All actions before ℓc _c can be lifted to G (it can be shown using the arguments in case (1) above). Action ℓc _c itself can be lifted to side i as the corresponding commitment set (ℛR or ℒL) is empty leading to a coherent MC where one commitment set is empty and one is the singleton (ℓc)\ sbj( _c)\. We have reduced this case to one of the cases ℒ=∅∧ℛ≠∅L= ≠ or ℒ≠∅∧ℛ=∅L≠ = and the proof can be concluded using the arguments of these cases. The other cases are either trivial or straightforward by induction. ∎ Appendix E Local Types: full definitions E.1. Operational Semantics: complete rules We give the full transition rules in Figure˜13 as some rules ([RCtxt], [NLCtxt], and [NRCtxt]) are omitted in the paper. ∈kI=m(ak,π) π:(p,q⊕∈iIai.Li,σ),(q,L,σ′[↦p ])!pqak→(p,Lk,σ),(q,L,σ′[↦p⋅ ]) [Snd] ∈kI= ⋅ 1(ak,π) 2∉(a,π) 1 :πpq?ak→(q,p&∈iIai.Li,σ[↦p ])(q,Lk,σ[↦p⋅ 1 2]) [Rcv] :πℓ→(p,L[μt./Lt],σ),Y′ :πℓ→(p,μt.L,σ),Y′ π:(,⊳c′,σ)→νc(,▶c′,σ)[Rec/New] π.l:(p,L1,σ),Y!pqa→(p,L′1,σ),Y′ π:(▶p,L1L2,σ),Y!pqa→(▶p,L′1L2,σ),Y′ π.r:(p,L2,σ),Y!pqa→(p,L′2,σ),Y′ π:(▶p,L1L2,σ),Y!pqa→(p,∙▶L′2,σ),Y′ [LSnd/RSnd] ∈π.l:(p,L1,σ)pq?a→(p,L′1,σ′)a⇓c(¯G) :πpq?a→(▶p,L1L2,σ)(▶p,L′1∙,σ′) ∉π.l:(p,L1,σ)pq?a→(p,L′1,σ′)a⇓c(¯G) :πpq?a→(▶p,L1L2,σ)(▶p,L′1L2,σ′) [LRcv1/2] π.r:(q,L2,σ)pq?a→(q,L′2,σ′) :πpq?a→(▶q,L1L2,σ)(q,∙▶L′2,σ′) [RRcv] π.l:(p,L,σ),Yℓ→(p,L′,σ′),Y′ π:(▶p,L∙,σ),Yℓ→(▶p,L′∙,σ′),Y′ π.r:(p,L,σ),Yℓ→(p,L′,σ′),Y′ π:(p,∙▶L,σ),Yℓ→(p,∙▶L′,σ′),Y′ [LCtxt/RCtxt] π.l:(p,L1,σ),Yνc→(p,L1′,σ),Y π:(▶p,L1L2,σ),Yνc→(▶p,L1′L2,σ),Y π.r:(p,L2,σ),Yνc→(p,L2′,σ),Y π:(▶p,L1L2,σ),Yνc→(▶p,L1L2′,σ),Y [NLCtxt/NRCtxt] array[]cr $ 43.20511pt $ k∈ I 18.49988ptm=(a_k,\,π)$ 140.0075pt $ [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5π: [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0( p, q _i∈ Ia_i. L_i,σ),( q, L,σ [ p m]) 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q!a_k 10000\ ( p, L_k,σ),( q, L,σ [ p m· m])$$& [Snd]\\ \\ $ 108.44254pt $ k∈ I 18.49988pt m= m_1·(a_k,\,π)· m_2 18.49988pt(a,π) ∈ m_1$ 112.68758pt $ [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5π: [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0( q, p \&_i∈ Ia_i. L_i,σ[ p m]) 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q?a_k 10000\ ( q, L_k,σ[ p m_1· m_2])$$& [Rcv]\\ \\ $ 56.3013pt $ [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5π: [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0( p, L[μ t. L/ t],σ),Y 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ Y $ 47.46527pt $ [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5π: [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0( p,μ t. L,σ),Y 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ Y $$ 18.49988pt [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5π: [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0( p, L [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100 1.0mu ^c 1.0mu L ,σ) 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 ν c 10000\ ( p, L 1.0mu ^c 1.0mu L ,σ)& [Rec/New]\\ \\ $ 64.10316pt $ array[]l [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5π. l: [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0( p, L_1,σ),Y 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q!a 10000\ ( p, L _1,σ),Y array$ 84.9752pt $ [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5π: [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0( p, L_1 1.0mu 1.0mu L_2,σ),Y 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q!a 10000\ ( p, L _1 1.0mu 1.0mu L_2,σ),Y $$ 10000\ 10000\ 10000\ $ 64.10316pt $ array[]l [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5π. r: [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0( p, L_2,σ),Y 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q!a 10000\ ( p, L _2,σ),Y array$ 82.75024pt $ [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5π: [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0( p, L_1 1.0mu 1.0mu L_2,σ),Y 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q!a 10000\ ( p, 1.0mu 1.0mu L _2,σ),Y $$& [LSnd/RSnd]\\ \\ $ 75.77946pt $ array[]l [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5π. l: [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0( p, L_1,σ) 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q?a 10000\ ( p, L _1,σ ) array [rgb]0.5,0.5,0 [named]pgfstrokecolorrgb0.5,0.5,0 @color@cmyk@stroke001.5 @color@cmyk@fill001.5a∈ ^c -2.84526pt( G)$ 71.92949pt $ [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5π: [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0( p, L_1 1.0mu 1.0mu L_2,σ) 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q?a 10000\ ( p, L _1 1.0mu 1.0mu ,σ )$$ $ 79.15446pt $ array[]l [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5π. l: [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0( p, L_1,σ) 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q?a 10000\ ( p, L _1,σ ) array [rgb]0.5,0.5,0 [named]pgfstrokecolorrgb0.5,0.5,0 @color@cmyk@stroke001.5 @color@cmyk@fill001.5a ∈ ^c -2.84526pt( G)$ 74.15445pt $ [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5π: [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0( p, L_1 1.0mu 1.0mu L_2,σ) 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q?a 10000\ ( p, L _1 1.0mu 1.0mu L_2,σ )$$& [LRcv1/2]\\[22.76228pt] $ 54.82407pt $ array[]l [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5π. r: [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0( q, L_2,σ) 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q?a 10000\ ( q, L _2,σ ) array$ 71.92949pt $ [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5π: [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0( q, L_1 1.0mu 1.0mu L_2,σ) 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q?a 10000\ ( q, 1.0mu 1.0mu L _2,σ )$$& [RRcv]\\[22.76228pt] $ 61.78996pt $ [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5π. l: [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0( p, L,σ),Y 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ ( p, L ,σ ),Y $ 74.84406pt $ [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5π: [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0( p, L 1.0mu 1.0mu ,σ),Y 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ ( p, L 1.0mu 1.0mu ,σ ),Y $$ $ 61.78996pt $ [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5π. r: [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0( p, L,σ),Y 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ ( p, L ,σ ),Y $ 74.84406pt $ [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5π: [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0( p, 1.0mu 1.0mu L,σ),Y 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ ( p, 1.0mu 1.0mu L ,σ ),Y $$& [LCtxt/RCtxt]\\[22.76228pt] $ 64.01944pt $ [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5π. l: [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0( p, L_1,σ),Y 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 ν c 10000\ ( p, L_1 ,σ),Y$ 81.52345pt $ [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5π: [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0( p, L_1 1.0mu 1.0mu L_2,σ),Y 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 ν c 10000\ ( p, L_1 1.0mu 1.0mu L_2,σ),Y$$ $ 64.01944pt $ [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5π. r: [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0( p, L_2,σ),Y 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 ν c 10000\ ( p, L_2 ,σ),Y$ 81.52345pt $ [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5π: [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0( p, L_1 1.0mu 1.0mu L_2,σ),Y 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 ν c 10000\ ( p, L_1 1.0mu 1.0mu L_2 ,σ),Y$$& [NLCtxt/NRCtxt] array Figure 13. Local semantics: complete rules. E.2. Projection: definition of merge The projection of a communication and message in transit relies on a merge operator. We give below the full definition of merge, which extends the standard merge to MC trivially, by using the first identity case for both MC definitions and active MC. 1⊓2=11=2&ai.i1i∈I∖J∪bj.j2j∈J∖I∪ai.i1i∈I∩J1=&ai.i1i∈I, and 2=&bj.j2j∈J and ∀i∈I∩J.ai.i1=bi.i2μ.(1′⊓2′)i=μ.i′,i∈1,2⊥ otherwise array[]l L_1 L_2= cases L_1& 10000\ 10000\ L_1= L_2\\[14.22636pt] p\&\a_i. L_i^1\_i∈ I J∪\b_j. L_j^2\_j∈ J I∪\a_i. L_i^1\_i∈ I∩ J& array[]l L_1= p\&\a_i. L_i^1\_i∈ I, and \\ L_2= p\&\b_j. L_j^2\_j∈ J and \\ ∀ i∈ I∩ J.\,a_i. L_i^1=b_i. L_i^2 array\\[22.76228pt] μ t.( L_1 L_2 )& array[]l L_i=μ t. L_i , 10000\ 10000\ i∈\1,2\ array\\[14.22636pt] & 10000\ otherwise cases array Appendix F Operational Correspondence F.1. Full definition of <:<: The full definition of preorder ‘<:<:’ on pairs of local types, and its lifting to configurations and systems is defined below. ∈<:Li′Li(∈∀iI)&,⊕ pi∈Iai.<:Li′pi∈Iai.Li ∈<:Lk′LkkI &i∈Ipai.&<:Li′pak.Lk ∈<:Li′Li(∈∀i1,2)⊳,▶ L1′L2′<:L1L2 <:L1′L1<:L2′L2 L1′⊳c<:L2′L1▶cL2 <:L1′L1 L1′▶c∙<:L1▶c∙ <:L2′L2 ∙▶cL2′<:∙▶cL2 <:L′L μt.<:L′μt.L <:L′[μt./L′t]L μt.<:L′L <:t <:endend <:L′L <:(p,L′,σ)(p,L,σ) [] ∀r∈R<:Yr′Yr <:Yr′∈rRYrr∈R [] array[]c $ 65.66972pt $ L_i <: L_i (∀ i∈ I) \, (3.0,6.0)[]\,∈\\&,\, \$ 49.97285pt $ p\,\, (3.0,6.0)[]\,_i ∈I\,a_i. L_i <: p\,\, (3.0,6.0)[]\,_i ∈I\,a_i. L_i$$ $ 31.90967pt $ L_k <: L_k k∈ I$ 51.82726pt $ p\,\&_i ∈I\,a_i. L_i <: p\,\&\,a_k. L_k$$\\ \\ $ 76.96832pt $ L_i <: L_i (∀ i∈\1,2\) \, (3.0,6.0)[]\,∈\ [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100 1.0mu 1.0mu, 1.0mu 1.0mu\$ 33.0831pt $ L_1 \,\, (3.0,6.0)[]\,\,\, L_2 <: L_1\,\, (3.0,6.0)[]\,\,\, L_2$$\\ \\ $ 40.02777pt $ L_1 <: L_1 L_2 <: L_2$ 45.21254pt $ L_1 [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100 1.0mu ^c 1.0mu L_2 10000\ <: 10000\ L_1 1.0mu ^c 1.0mu L_2$$ $ $ L_1 <: L_1$ 40.75424pt $ L_1 1.0mu ^c 1.0mu 10000\ <: 10000\ L_1 1.0mu ^c 1.0mu $$ $ $ L_2 <: L_2$ 39.08762pt $ ^c L_2 10000\ <: 10000\ ^c L_2$$\\ \\ $ $ L <: L$ 25.98375pt $ μ t. L <:μ t. L$$ $ 30.88766pt $ L [μ t. L / t] <: L$ $ μ t. L <: L$$ $ $ t <: t$$ $ $ end <: end$$\\[14.22636pt] \\ $ $ L <: L $ 37.8946pt $ ( p, L ,σ) <:( p, L,σ)$$ 10000\ 10000\ [PConfig] $ 35.88504pt $ ∀ r ∈R 10000\ 10000\ Y_ r <:Y_ r$ 43.10452pt $ \Y_ r \_ r∈ R <:\Y_ r\_ r ∈R$$ 10000\ 10000\ 10000\ 10000\ [PSystem] array F.2. Fidelity F.2.1. Auxiliaries First, observe that projected local configurations do not have garbage. This simplifies our reasoning about the correspondence. Lemma F.1. Let πout⊢↾=,σ _out G r= L,σ for ∈() r∈ R( G). Then for all ∈(),(a,π)∈σ() p∈ R( G),\,(a,π)∈σ( p), (πin)= stale( _in)= false where π=πout.πinπ= _out. _in. Proof. By induction on the syntax of G. The base cases for ∈, G∈\ end,\, t\ follow by observing that forall π, (π,)=(π,)= stale(π, end)= stale(π, t)= false. If =⇾:ai:ii∈I G= p q:\a_i: G_i\_i∈ I, in the first two cases of the corresponding projection rule the local type has a send or a receive prefix, hence no path is stale for them. The third case using merge follows by induction. Similarly, if =1⊳2 G= G_1 [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100 1.0mu 1.0mu G_2 and =μ.′ G=μ t. G : the projection is not stale for any path. The interesting case is the one for =1▶2 G= G_1 1.0mu 1.0mu G_2. Since L is a mixed choice then πout′ _out is not empty (by projection, one side, left or right is added to the path). So, without loss of generality, assume π=πout..πinπ= _out. s. _in with ∈l,r s∈\ l, r\. If ∈ℒ r then by induction forall (a,π)(a,π) in some of r’s queues σ, we have (πin,1)= stale( _in, L_1)= false with π=πout..πinπ= _out. s. _in. Since =1▶∙ L= L_1 1.0mu 1.0mu hence =l s= l, hence (πin,1)=⟹(l.πin,1▶∙)= stale( _in, L_1)= false 10000\ 10000\ 10000\ 10000\ stale( l. _in, L_1 1.0mu 1.0mu )= false as desired. The case for ∈ℒ r is symmetric to the case above for ∈ℛ r . The otherwise case for ∉ℒ∪ℛ r also follows by observing that, whatever the MC side that originated the message, (πin,i)=⟹(i.πin,i▶∙)= stale( _in, L_i)= false 10000\ 10000\ 10000\ 10000\ stale( s_i. _in, L_i 1.0mu 1.0mu )= false with 1=l s_1= l and 2=r s_2= r. ∎ Lemma F.2 (Garbageless Projections). Let ϵ⊢↾=,σε G r= L,σ for a ∈() r∈ R( G). Then (,σ,)→(,σ′,′)⇒σ=σ′( r,σ, L) 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 ρ 10000\ ( r,σ , L ) 10000\ 10000\ 10000\ 10000\ σ=σ Proof. This lemma follows from Lemma˜F.1 with π=ϵπ=ε, observing that in absence of stale messages garbage collection on σ returns σ itself. ∎ In Proposition˜F.3 (and in the rest of the paper), by projectability of G on p we intend the fact that the projection of G on p returns. We say that G is projectable if the (partial) projection function ↾ G p returns for all ∈() p∈ R( G). Proposition F.3 (Projectability Preservation). If G is projectable and →ℓ′ G 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ G then ′ G is projectable. Proposition F.4. If π⊢⇾:S↾=,σπ p q:S q= L,σ then σ()σ( p) is the empty message sequence ϵε. Proposition F.5 (Determinism of σ). 1,σ→ℓ1′,σ1∧2,σ→ℓ2′,σ2⟹σ1=σ2 G_1,σ 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ G_1 , _1 10000\ 10000\ 10000\ 10000\ G_2,σ 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ G_2 , _2 10000\ 10000\ _1= _2 Proposition F.6. If μ.1⊓μ.2μ t. L_1 μ t. L_2 is defined then 1[μ.1/]⊓2[μ.2/] L_1[μ t. L_1/ t] L_2[μ t. L_2/ t] is defined. Proposition F.7. 1[μ.1′/]⊓2[μ.2′/]=1⊓2[μ.1′⊓2′/] L_1[μ t. L_1 / t] L_2[μ t. L_2 / t]= L_1 L_2[μ t. L_1 L_2 / t]. Proposition F.8 (Merge and <:<:). Consider local types 11 L_1^1, 12 L_1^2, 12 L_1^2, 22 L_2^2. Assume that for all i∈1,2i∈\1,2\, i1<:i2 L_i^1<: L_i^2 and 1i⊓2i L_1^i L_2^i is defined. Then 11⊓21<:12⊓22 L_1^1 L_2^1<: L_1^2 L_2^2 Proof. By induction on the depth of the derivation syntax of 11<:21 L_1^1<: L_2^1. Base cases. There are two axioms in the judgments in Section˜F.1, for t and end. If 11= L_1^1= t it can only be t<:12=t<: L_1^2= t. Since 11⊓21 L_1^1 L_2^1 is defined, then 21= L_2^1= t and by definition of ‘<:<:’ we have 22= L_2^2= t. Since ⊓= t t= t the thesis is immediate by hypothesis. The case for 11= L_1^1= end is similar. Inductive cases - prefix rule. If the first rule is used then 11 L_1^1 is either a sending or a receiving prefix. If 11=&i∈Iai.i L_1^1= p\&_i∈ Ia_i. L_i then by definition of ‘<:<:’ we have 12=&i∈Iai.i′ L_1^2= p\&_i∈ Ia_i. L_i with (9) i<:i′∀i∈I L_i<: L_i ∀ i∈ I Note that by ‘<:<:’ both 11 L_1^1 and 12 L_1^2 have choices over the same set I. By definedness of 11⊓21 L_1^1 L_2^1 then 21=&j∈Jaj.j′ L_2^1= p\&_j∈ Ja_j. L_j . By 21<:22 L_2^1<: L_2^2 we have 22=&j∈Jaj.j′ L_2^2= p\&_j∈ Ja_j. L_j with (10) i′<:i′∀j∈J L_i <: L_i ∀ j∈ J By definition of merge, 11⊓21 L_1^1 L_2^1 has the following form: 11⊓21=&ai.ii∈I∖J∪aj.j′j∈J∖I∪ai.i⊓i′i∈I∖J L_1^1 L_2^1= p\&\a_i. L_i\_i∈ I J 10000\ ∪ 10000\ \a_j. L_j \_j∈ J I 10000\ ∪ 10000\ \a_i. L_i L _i\_i∈ I J and similarly 12⊓22=&ai.i′i∈I∖J∪aj.j′j∈J∖I∪ai.i′⊓i′i∈I∩J L_1^2 L_2^2= p\&\a_i. L_i \_i∈ I J 10000\ ∪ 10000\ \a_j. L_j \_j∈ J I 10000\ ∪ 10000\ \a_i. L_i L_i \_i∈ I∩ J Since merge is defined inductively, if 11⊓21 L_1^1 L_2^1 (resp. 21⊓22 L_2^1 L_2^2) is defined then all i⊓i′ L_i L _i (resp. i′⊓i′ L_i L _i) are defined for i∈I∖Ji∈ I J. Therefore we can apply induction on the continuations obtaining (11) i⊓i′<:i′⊓i′∀i∈I∩J L_i L_i <: L_i L_i ∀ i∈ I∩ J Using (9), (10) and (11) as premises for ‘<:<:’ (first rule) we obtain the thesis 11⊓21<:12⊓22 L_1^1 L_2^1<: L_1^2 L_2^2 for this case. If 11=⊕i∈Iai.i L_1^1= p _i∈ Ia_i. L_i the thesis is immediate by induction since 11⊓21=11 L_1^1 L_2^1= L_1^1. Inductive cases - MC rules. The cases for MC, where 11 L_1^1 and 21 L_2^1 have the same type of mixed choice (second, fourth and fifth rules of ‘<:<:’ in Section˜F.1) is also immediate by induction. The case for the third rule also follows by induction observing 11 L_1^1 and 21 L_2^1 have the same MC configurations, and so do 12 L_1^2 and 22 L_2^2, and also observing that the definition of merge does not alter such configuration, being the identity (first rule of merge). Inductive cases - recursion rules. If 11=μ.1′ L_1^1=μ . L_1 we have two cases. If 21=μ.2′ L_2^1=μ . L_2 then the thesis is by induction using the first rule in the third line (Section˜F.1). If unfolding is needed then the rule applied to derive i1<:i2 L_i^1<: L_i^2 is <:Li′[μt./Li′t]Li2 =Li1μt.<:Li′Li2 33.07603pt $ L_i [μ t. L_i / t] <: L_i^2$ 30.45102pt $ L_i^1=μ t. L_i <: L_i^2$ By hypothesis μ.1′⊓μ.2′μ t. L_1 μ t. L_2 is defined and hence by Proposition˜F.6 1′[μ.1′/]⊓2′[μ.2′/] L_1 [μ t. L_1 / t] L_2 [μ t. L_2 / t] is defined. By induction, therefore, (12) 1′[μ.1′/]⊓2′[μ.2′/]<:i2⊓22 L_1 [μ t. L_1 / t] L_2 [μ t. L_2 / t] <: L_i^2 L_2^2 By Proposition˜F.7, 1′[μ.1′/]⊓2′[μ.2′/]=1′⊓2′[μ.1′⊓2′/] L_1 [μ t. L_1 / t] L_2 [μ t. L_2 / t]= L_1 L_2 [μ t. L_1 L_2 / t] hence (12) becomes (13) 1′⊓2′[μ.1′⊓2′/]<:i2⊓22 L_1 L_2 [μ t. L_1 L_2 / t] <: L_i^2 L_2^2 By applying 13 as a premise for the second rule in the third row (Section˜F.1) we obtain the thesis. ∎ Lemma F.9 (Send-project). Let ↾=(,,σ),Y G =( q, L,σ),Y and assume that (,,σ),Y→!a(,′,σ′),Y′( q, L,σ),Y 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q!a 10000\ ( q, L ,σ ),Y and →!a′ G 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q!a 10000\ G , then =′ L= L . Proof. We give a proof sketch. By analysis of the global semantics rules there exists C such that =[⇾:S] G=C[ p q: [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S] and ′=[ :kS∪ak.] G =C[ p 0.56905pt to8.94pt to3.31pt -1.65598pt to0.0pt @beginscope @invoke pgfstrokecolorrgb0,0,0 @color@rgb@stroke000 @invoke @color@rgb@fill000 @invoke @setlinewidth @invoke to0.0pt @beginscope @invoke @beginscope @invoke @roundcap @invoke @moveto0.0pt0.0pt @lineto0.0pt0.0pt @lineto0.92499pt0.8pt @lineto2.775pt-0.8pt @lineto4.625pt0.8pt @lineto5.55002pt0.0pt @lineto5.55002pt0.0pt @lineto5.56764pt0.0pt @stroke @invoke @beginscope @invoke @transformcm1.00.00.01.05.66763pt0.0pt @invoke @invoke @invoke @endscope @invoke @endscope @invoke @endscope @discardpath @invoke @endscope q:k\, [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S∪\a_k.C\]. The thesis is by induction on the structure of C, where in the base case for =[]C=[\,] we observe that ⇾:S↾ p q: [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S q and :kS∪ak.↾ p 0.56905pt to8.94pt to3.31pt -1.65598pt to0.0pt @beginscope @invoke pgfstrokecolorrgb0,0,0 @color@rgb@stroke000 @invoke @color@rgb@fill000 @invoke @setlinewidth @invoke to0.0pt @beginscope @invoke @beginscope @invoke @roundcap @invoke @moveto0.0pt0.0pt @lineto0.0pt0.0pt @lineto0.92499pt0.8pt @lineto2.775pt-0.8pt @lineto4.625pt0.8pt @lineto5.55002pt0.0pt @lineto5.55002pt0.0pt @lineto5.56764pt0.0pt @stroke @invoke @beginscope @invoke @transformcm1.00.00.01.05.66763pt0.0pt @invoke @invoke @invoke @endscope @invoke @endscope @invoke @endscope @discardpath @invoke @endscope q:k\, [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S∪\a_k.C\ q give the same local type. ∎ Lemma F.10 (Stale). Let ↾=(,,σ),Y G =( q, L,σ),Y and assume that (,,σ),Y→!a(,,σ′),Y′( q, L,σ),Y 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q!a 10000\ ( q, L,σ ),Y and →!a′ G 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q!a 10000\ G . Then the following hold: ¬(π,)iffσ′=σ[↦σ()⋅(a,π)] stale(π, L) σ =σ[ p σ( p)·(a,π)] Namely, projection includes in the queue all and only messages that are not stale. Proof. Observe that the last message sent is at the tail of the queue σ()σ( p). By induction on the derivation of the local transition, proceeding by case analysis on the last rule applied. Base case - axiom [] [Snd] In this case we have no MC context. So G has the form of an interaction from p to q (either top level or as continuation of other interactions from different participants). ↾=⊕ai.ii∈I G p= q \a_i. L_ pi\_i∈ I and ↾=&ai.ii∈I G q= p\&\a_i. L_ qi\_i∈ I. By [] [Snd] σ′=σ[↦σ()⋅(a,π)]σ =σ[ p σ( p)·(a,π)]. Since π=0π=0 we have trivially ¬(0,) stale(0, L) hence done. Inductive cases There are four send rules in the local semantics: [] [LSnd], [] [LCtxt], [] [RSnd], and [] [RCtxt]. The cases for [] [LSnd] and [] [LCtxt] – send action on the left – proceed similarly, because the local type in the configuration of p (i.e., whether sender p is committed in the outmost MC) is not relevant to the proof. Similarly [] [RSnd] and [] [RCtxt] proceed in the same way for send action on the right. We only show the cases for [] [LSnd], and [] [RSnd]. Without loss of generality assume that =1▶2 G= G_1 G_2 and L is a MC. If the local action is by [] [LSnd] then we can infer π=l.π′π= l.π for some π′π , and also that p’s local type is a MC. By inspection of the global rules and hypothesis we can infer 1→!a1′ G_1 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q!a 10000\ G_1 for some 1′ G_1 . Now L can have one of the following forms: • =1▶2 L= L_1 L_2. Let σL _L and σR _R be the queues obtained by projecting 1 G_1 and 2 G_2, on q. Recall that actions on the RHS are always committing, and that p must not be committed to the RHS when making a LHS step, hence σR=ϵ _R=ε. By projection (active MC, third case): (14) σ=σL∘σR=σLσ′=σL′∘σR=σL′(with σL′ projection of 1′ on and σR=ϵ)σ= _L _R= _L σ = _L _R= _L (with $ _L $ projection of $ G_1 $ on $ q$ and $ _R=ε$) By induction ¬(π′,1) stale(π , L_1) iff σL′=σL[↦σL()⋅(a,π)] _L = _L[ p _L( p)·(a,π)] which gives the thesis by observing that ¬(π′,1) stale(π , L_1) iff ¬(l.π’,) stale( l.π’, L) by definition of stale. • =1▶∙ L= L_1 . Again, let σL _L be the queue obtained by projecting 1 G_1 on q. By the projection (active MC, second case) σ=σLσ= _L and σ′=σL′σ = _L (for σL′ _L projection of 1′ G_1 on q). By induction ¬(π′,1) stale(π , L_1) iff σL′=σL[↦(a,π),σL()] _L = _L[ p (a,π), _L( p)] which gives the thesis via observing ¬(π′,1) stale(π , L_1) iff ¬(l.π’,) stale( l.π’, L) by definition of stale. • =∙▶2 L= L_2. In this case ¬(l.π′,) stale( l.π , L) which yields the if direction. For the only-if case we need to show σ′≠σ[↦(a,π)⋅σ()]σ ≠σ[ p (a,π)·σ( p)] which follows by σ′=σR=σ = _R=σ. Namely (a,π)(a,π) is not in σ′σ . If the action is by [] [RSnd] then 2→!a2′ G_2 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q!a 10000\ G_2 and π=r.π′π= r.π . We have three cases. • =1▶2 L= L_1 L_2. We have σ=σL∘σRσ= _L _R and σ′=σL∘σR′σ = _L _R for some σR′ _R resulting from projection of 2′ G_2 on r. In this case, however, it can be that both σL _L and σR′ _R are non empty. By induction ¬(π′,2) stale(π , L_2) iff σR′=σR[↦(a,π)⋅σR(p)] _R = _R[ p (a,π)· _R(p)]. The thesis follows from observing: (a) ¬(π′,2) stale(π , L_2) iff ¬(r.π′,) stale( r.π , L) (by definition of stale), (b) σL∘σR′=σL∘σR[↦(a,π)⋅σR(p)] _L _R = _L _R[ p (a,π)· _R(p)] (by induction) which by definition of ∘ (which is not commutative and concatenates the messages of σR() _R( p) after those of σL() _L( p) we have σL∘(σR[↦(a,π)⋅σR(p)])=(σL∘σR)[↦(a,π)⋅σL(p)∘σ(R)()]=σ′ _L ( _R[ p (a,π)· _R(p)])=( _L _R)[ p (a,π)· _L(p) σ(R)( p)]=σ as required. • =1▶∙ L= L_1 . This case is symmetric to the corresponding (third) case for [] [LSnd] but observing ¬(r.π′,) stale( r.π , L) for the if direction and σ′=σL=σ = _L=σ (the new message is not in σ′σ ). • =∙▶2 L= L_2 is symmetric to case (2) for [] [LSnd]. ∎ F.3. Bottom-up fidelity See 4.1 Proof. Property (2) follows from Lemma˜F.2 (projected systems have no stale messages). We focus on property (1). Let π⊢↾=,σπ G r= L_ r, _ r for all ∈() r∈ R( G). We also set Y=(,,σ)Y_ r=( r, L_ r, _ r) and Y=Y∈()Y_ G=\Y_ r\_ r∈ R( G). The move by Y is by [] [Par] or [] [Low]. The case for [] [Discard] is not possible since ℓ≠ρ ≠ρ. The case for ρ actions is handled in (2). Without loss of generality we We focus on In case of [] [Par], and then one of the rules for configurations in Figure 5, we reason by induction on the syntax of G. 1. Communication Assume =→:ai:ii∈I G= p→ q:\a_i: G_i\_i∈ I and, without loss of generality, Y=Y,Y,YRY_ G=Y_ p,Y_ q,Y_R where Y=(,q⊕i∈Iai.i,σ)Y=(,&i∈Iai.i,σ[↦ϵ])YR=(,⊓i∈Ii,σ)∈()∖, array[]cclY_ p&=&( p, 10000\ q _i∈ Ia_i. L_ pi, 10000\ _ p)\\ Y_ q&=&( q, 10000\ p\&_i∈ Ia_i. L_ qi, 10000\ _ q[ p ε])\\ Y_R&=&\( r, 10000\ _i∈ I L_ ri, 10000\ _ r)\_ r∈ R( G) \ p, q\ array noting that σ() _ q( p) is empty (Proposition˜F.4). Without loss of generality, the transition Y→ℓY_ G 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ is by: (1) a send action by Y_ p 888Role q cannot move and its first action needs to be the reception of the message from p since local types are mono-threaded by construction), or (2) an action by a role r in YRY_R, or (3) a MC instantiation by a configuration in YRY_R. In case (1) the last rule applied (after [Par]) is [LSnd] of the local semantics: π:Y→!ak(,k,σ),(,&i∈Iai.i,σ[↦(ak,π′)]),YR [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5π: [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0Y_ G 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q!a_k 10000\ ( p, L_ pk, _ p),( q, 10000\ p\&_i∈ Ia_i. L_ qi, 10000\ _ q[ p (a_k,π )]),Y_R for some path π′π . By rule [] [Snd] of the global semantics →!ak↝:kai:ii∈I=′ G 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q!a_k 10000\ p q:k\a_i: G_i\_i∈ I= G The projection of ′ G on role p is (,k,σ)( p, L_ pk, _ p), the projection on role q is (,&i∈Iai.i,σ[↦(ak,π′)]( q, p\&_i∈ Ia_i. L_ qi, _ q[ p (a_k,π )], and the projection on the roles of the configurations in YRY_R is unchanged. Note that the definition of merge (for each role r in YRY_R is not affected by the selection of branch k by p). Consider now case (2) where the action is by a configuration (,,σ)( r,\, L_ r,\, _ r) in YRY_R with (ℓ)= sbj( )= r. Let, for all i∈Ii∈ I, i↾=i,σi G_i r= L_ ri, _ ri. Observe =⊓i∈Ii L_ r= _i∈ I L_ ri and by projection (15) ∀i,j∈I.σi=σj∀ i,j∈ I. 10000\ _ ri= _ rj We will therefore denote any σi _ ri as σ _ r. The transition has the following form: Y=(,,σ),(,,σ),Y′→ℓ(,′,σ′),(,,σ′),Y′Y_ G=( r,\, L_ r,\, _ r),( t,\, L_ t,\, _ t),Y 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ ( r,\, L_ r ,\, _ r ),( t, L_ t, _ t ),Y Note that if ℓ is a send action (assume to is from role t without loss of generality) then σ=σ′ _ r= _ r , and if ℓ is a receive action (assume it is from role t without loss of generality) then σ=σ′ _ t= _ t . By induction, for all i∈Ii∈ I (16) i→ℓi′ G_i 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ G_i and (17) i′,σi′→∗i′,σig<:i′↾ L_ ri ,\, _ ri 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 ρ -3.44444pt^* 10000\ L_ ri ,\, _ ri^g<: G_i r By (15) follows that (17) is equivalent to (18) i′,σ′→∗i,σig<:i′↾ L_ ri ,\, _ r 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 ρ -3.44444pt^* 10000\ L_ ri,\, _ ri^g<: G_i r and by Proposition˜F.5 we have that (18) is equivalent to (19) i′,σ′→∗i,σg<:i′↾ L_ ri ,\, _ r 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 ρ -3.44444pt^* 10000\ L_ ri,\, _ r^g<: G_i r By using (16) as a premise in rule [] [Cont1] of the global semantics we obtain →ℓ′ G 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ G It remains to show the second part of the thesis: (20) Y′→∗Yg<:′↾Y 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 ρ -3.44444pt^* 10000\ Y_g<: G -2.84526pt We decompose the reasoning, considering each configuration in Y′Y : • for role r we need to show (,′,σ′)→∗<:′↾( r, L_ r , _ r ) 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 ρ -3.44444pt^* 10000\ <: G r The first part (garbage collection) (,′,σ′)→∗(,′,σg)( r, L_ r , _ r ) 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 ρ -3.44444pt^* 10000\ ( r, L_ r , _ r^g) follows by (19) and Proposition˜F.5. The second part (preorder) (,′,σg)<:′↾( r, L_ r , _ r^g)<: G r follows by using (17) as hypothesis Proposition˜F.8 (merge with ‘<:<:’). • For t, the thesis follows again by induction and Proposition˜F.5, observing that all i′↾ G_i t are the same for all i∈Ii∈ I. • For all other roles the thesis holds by hypothesis since the local types are unchanged, and the queues as well. In case (3) if MC is an instantiation action, the thesis is by induction. 2. Message in transit Assume = :kai.ii∈I G= p 0.56905pt to8.94pt to3.31pt -1.65598pt to0.0pt @beginscope @invoke pgfstrokecolorrgb0,0,0 @color@rgb@stroke000 @invoke @color@rgb@fill000 @invoke @setlinewidth @invoke to0.0pt @beginscope @invoke @beginscope @invoke @roundcap @invoke @moveto0.0pt0.0pt @lineto0.0pt0.0pt @lineto0.92499pt0.8pt @lineto2.775pt-0.8pt @lineto4.625pt0.8pt @lineto5.55002pt0.0pt @lineto5.55002pt0.0pt @lineto5.56764pt0.0pt @stroke @invoke @beginscope @invoke @transformcm1.00.00.01.05.66763pt0.0pt @invoke @invoke @invoke @endscope @invoke @endscope @invoke @endscope @discardpath @invoke @endscope q:k\,\a_i. G_i\_i∈ I and, without loss of generality, Y=Y,YRY=(,&i∈Iai.i,σ[↦(ak,π′)])Y_ G=Y_ q,Y_R Y_ q=( q, 10000\ p\&_i∈ Ia_i. L_ qi, 10000\ _ q[ p (a_k,π )]) There are two cases: (1) the transition of Y_ G is a receive action by Y_ q or (2) an action by one other configuration in YRY_R. In case (1) we have by [LRcv]: Y→?ak(,k,σ[↦ϵ])=Y′Y_ q 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q?a_k 10000\ ( q, 10000\ L_ qk, 10000\ _ q[ p ε])=Y_ q and by [Par] Y→?akY′,YRY_ G 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q?a_k 10000\ Y_ q ,Y_R By rule [] [Rcv] of the global semantics = :kai.ii∈I→?akk G= p 0.56905pt to8.94pt to3.31pt -1.65598pt to0.0pt @beginscope @invoke pgfstrokecolorrgb0,0,0 @color@rgb@stroke000 @invoke @color@rgb@fill000 @invoke @setlinewidth @invoke to0.0pt @beginscope @invoke @beginscope @invoke @roundcap @invoke @moveto0.0pt0.0pt @lineto0.0pt0.0pt @lineto0.92499pt0.8pt @lineto2.775pt-0.8pt @lineto4.625pt0.8pt @lineto5.55002pt0.0pt @lineto5.55002pt0.0pt @lineto5.56764pt0.0pt @stroke @invoke @beginscope @invoke @transformcm1.00.00.01.05.66763pt0.0pt @invoke @invoke @invoke @endscope @invoke @endscope @invoke @endscope @discardpath @invoke @endscope q:k\,\a_i. G_i\_i∈ I 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q?a_k 10000\ G_k It remains to show the second part of the thesis: (21) Y′→∗Yg<:′↾Y 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 ρ -3.44444pt^* 10000\ Y_g<: G -2.84526pt We decompose the reasoning, considering each configuration in Y′Y : • For q, by induction k,σ′→∗k,σg<:k↾ L_ qk, _ q 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 ρ -3.44444pt^* 10000\ L_ qk, _ q^g<: G_k q which directly yields the thesis. • The cases for other configurations are straightforward by hypothesis as YRY_R is nto changed. Case (2) where a configuration in YRY_R makes a step in the continuations i G_i proceeds analogously to case (2) for communications. 4. MC definition Assume =1⊳c2 G= G_1 [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100 1.0mu ^c 1.0mu G_2 and instantiation is triggered by configuration of role 1 r_1 in Y_ G. Observe that by projection σ1=σ0 _1= _0 and 1=11⊳c12 L_1= L^1_1 [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100 1.0mu ^c 1.0mu L^2_1 with (22) π⊢1↾1=11,σ0π G_1 r_1= L_1^1, _0 By the form of L the transition can only be by rule [New] of the local semantics: π:(1,11⊳c12,σ0),Y2→νc(1,11▶c12,σ0),Y2 [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5π: [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0( r1, L_1^1 [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100 1.0mu ^c 1.0mu L^2_1, _0),Y_2 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 ν c 10000\ ( r_1, L_1^1 1.0mu ^c 1.0mu L^2_1, _0),Y_2 By rule [] [Inst] of the global semantics 1⊳c2→νc1▶∅,∅c2=′ G_1 [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100 1.0mu ^c 1.0mu G_2 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 ν c 10000\ G_1 1.0mu 1.0mu^c_ , [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_2= G The projection of ′ G is as follows: π⊢1▶∅,∅c2↾1=11▶c12,σ0π G_1 1.0mu 1.0mu^c_ , [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_2 r_1= L_1^1 ^c L^2_1, _0 where (22) was used to develop the projections of 1 G_1 and 2 G_2 on p, to derive σ0 _0 as σ0∘σ0 _0 _0 as desired for Y1Y_1. To conclude this case we need to consider Y=Y1,Y2Y=Y_1,Y_2. Observe that Y2Y_2 is unchanged by the transition, that ′↾2=21▶c22,σ0 G r_2= L_2^1 ^c L^2_2, _0 and that 21⊳c22<:21▶c22 L_2^1 [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100 1.0mu ^c 1.0mu L^2_2<: L_2^1 1.0mu ^c 1.0mu L_2^2 as desired. This case, when only one configuration instantiate a MC – not immediately paired with the other ones, unlike the global case, justifies the need for the preorder <:<: in the statement. 4. Active MC In this case =1▶ℒ,ℛc2 G= G_1 1.0mu 1.0mu^c_L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_2. Without loss of generality we consider three cases in which: (1) 1 r_1 is not in ℛ∪ℒR , (2) 1∈ℒ r_1 , and (3) 1∈ℛ r_1 . In (1), Y1=(1,11▶c12,σ1)Y_1=( r_1, L_11 ^c L_12, _1) and Y2=(2,2,σ2)Y_2=( r_2, L_2, _2). We first consider the case where the last rule applied is on the left. We show the case for [LSnd]. The cases for [LRcv1] and [LRcv2] proceed similarly (but with no need of garbage collection - the only interesting but is observing that commitment in global types reflects directly on local types by projection) whereas [LCtxt] is straightforward by induction. [LSnd] for some path π: π′:(1,11▶c12,σ1),(2,2,σ2)→12!ak(1,11′▶c12,σ1),(2,2,σ2[1↦σ2⋅(ak,π)]) array[]l [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5π : [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0( r_1, L_11 ^c L_12, _1),( r_2, L_2, _2) 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 r_1 r_2!a_k 10000\\ ( r_1, L_11 ^c L_12, _1),( r_2, L_2, _2[ r_1 _2·(a_k,π)]) array with premise (23) π′.l:(1,11,σ1),(2,2,σ2)→12!ak(1,11′,σ1),(2,2,σ2[1↦(ak,π)]) array[]l [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5π . l: [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0( r_1, L_11, _1),( r_2, L_2, _2) 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 r_1 r_2!a_k 10000\\ ( r_1, L_11 , _1),( r_2, L_2, _2[ r_1 (a_k,π)]) array Observe that π may refer to a MC that is nested inside c. By induction on the premise (23)( eq:prem11) we have that 1→12!ak1′ G_1 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 r_1 r_2!a_k 10000\ G_1 and the projection of 1′ G_1 on role 1 r_1 is 11′,σ1 L_11 , _1 with 11′<:11′ L_11 <: L_11 . The assumption for this case (1), that 1∉ℛ r_1 , satistfies the premise of rule [] [LSnd] of the global semantics, which we can then apply: 1▶ℒ,ℛc2→12!ak1′▶ℒ,ℛc2=′ G_1 1.0mu 1.0mu^c_L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_2 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 r_1 r_2!a_k 10000\ G_1 1.0mu 1.0mu^c_L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_2= G It remains to show the thesis for the projection of ′ G on 2 r_2. Recall (2,2,σ2)( r_2, L_2, _2) moves to (2,2,σ2[1↦(ak,π)])( r_2, L_2, _2[ r_1 (a_k,π)]). By Lemma˜F.9 the projected local type from ′ G on 1 r_1 is 2 L_2 itself. So, ′↾2=2,σ2′ G r_2= L_2,\, _2 for some σ2′ _2 . It remains to show that σ′=(σ2[1↦(ak,π)])σ = gc( _2[ r_1 (a_k,π)]) that is, the new message (ak,π)(a_k,π) is in the projected queue if and only if it is not garbage collected (i.e., not stale), which follows by Lemma˜F.10. If Y moves on the RHS we have three possible rules: [RSnd] or [RRcv] or [RCtxt]. We show [RSnd] below. Let Y2=(2,2,σ2)Y_2=( r_2, L_2, _2). By [RSnd]: π′:(1,11▶c12,σ1),(2,2,σ2)→12!ak(1,∙▶c12′,σ1),(2,2,σ2[1↦σ2⋅(ak,π)]) array[]l [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5π : [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0( r_1, L_11 1.0mu ^c 1.0mu L_12, _1),( r_2, L_2, _2) 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 r_1 r_2!a_k 10000\\ ( r_1, 1.0mu ^c 1.0mu L_12 , _1),( r_2, L_2, _2[ r_1 _2·(a_k,π)]) array with premise (24) π′.r:(1,12,σ1),(2,2,σ2)→12!ak(1,12′,σ1),(2,2,σ2[1↦(ak,π)]) array[]l [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5π . r: [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0( r_1, L_12, _1),( r_2, L_2, _2) 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 r_1 r_2!a_k 10000\\ ( r_1, L_12 , _1),( r_2, L_2, _2[ r_1 (a_k,π)]) array By induction on the premise (24)( eq:prem1) we have 2→12!ak2′ G_2 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 r_1 r_2!a_k 10000\ G_2 and the projection of 2′ G_2 on role 1 r_1 is 12′,σ1 L_12 , _1 with 12′<:12′ L_12 <: L_12 . Since 1∈ℛ r_1 then 2 G_2 cannot make action 12!ak r_1 r_2!a_k hence we can apply [] [RSnd] of the global semantics obtaining: 1▶ℒ,ℛc2→12!ak1▶ℒ,ℛ∪1c2′=′ G_1 1.0mu 1.0mu^c_L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_2 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 r_1 r_2!a_k 10000\ G_1 1.0mu 1.0mu^c_L,R∪\ r_1\ [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_2 = G The projection of ′ G on 1 r_1 is ∙▶ι12′,σ1 L_12 , _1 since 1 r_1 is committed to the RHS, with the projection of the LHS given by induction. Also by induction 12′<:12′ L_12 <: L_12 hence by definition of ‘<:<:’ we have ∙▶ι12′<:∙▶ι12′ L_12 <: L_12 as desired for 1 r_1. The thesis for 2 r_2 follows by Lemma˜F.9 (the local type is unchanged) and Lemma˜F.10 (the queue of the reached state is the projected queue modulo garbage collection). Case (2) is similar to case (1) but simpler, since only LHS moves are possible by 1 r_1. In case (3) we have Y1=(1,∙▶ι12,σ1)Y_1=( r_1, L_12, _1) hence the last rule applied is [RCtxt] and the thesis is straightforward by induction. 5.Recursion Directly by induction. ∎ F.4. Top-Down fidelity See 4.2 Proof. Lemma˜4.1 follows directly from the more general property for transitions with general π environments. Let π⊢↾=,σπ G r= L_ r, _ r for all ∈() r∈ R( G). We also set Y=(,,σ)Y_ r=( r, L_ r, _ r) and Y=Y∈()Y_ G=\Y_ r\_ r∈ R( G). We proceed by induction on the transition of G, reasoning by case analysis on the last rule used. [] [Snd] Assume =⇾:ai.ii∈I G= p q:\a_i. G_i\_i∈ I. By projection Y=(,⊕i∈Iai.i,σ),(,&i∈Iai.i,σ),YrY_ G=( p, q _i∈ Ia_i. L_i, _ p),( q, p\&_i∈ Ia_i. L_i, _ q),Y_r with YrY_r being the configuration of participants in ()∖, R( G) \ p, q\. By [] [Snd] of the global semantics, for a k∈Ik∈ I, ⇾:ai.ii∈I→!ak :kai.ii∈I p q:\a_i. G_i\_i∈ I 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q!a_k 10000\ p 0.56905pt to8.94pt to3.31pt -1.65598pt to0.0pt @beginscope @invoke pgfstrokecolorrgb0,0,0 @color@rgb@stroke000 @invoke @color@rgb@fill000 @invoke @setlinewidth @invoke to0.0pt @beginscope @invoke @beginscope @invoke @roundcap @invoke @moveto0.0pt0.0pt @lineto0.0pt0.0pt @lineto0.92499pt0.8pt @lineto2.775pt-0.8pt @lineto4.625pt0.8pt @lineto5.55002pt0.0pt @lineto5.55002pt0.0pt @lineto5.56764pt0.0pt @stroke @invoke @beginscope @invoke @transformcm1.00.00.01.05.66763pt0.0pt @invoke @invoke @invoke @endscope @invoke @endscope @invoke @endscope @discardpath @invoke @endscope q:k\a_i. G_i\_i∈ I By one application of rule [Par] of the local semantics with one application of [Snd] as a premise: ϵ:(,⊕i∈Iai.i,σ),(,&i∈Iai.i,σq[↦m→]),Yr→!akYp′,Yq′,Yr array[]l [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5ε: [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0( p, q _i∈ Ia_i. L_i, _ p),( q, p\&_i∈ Ia_i. L_i, _q[ p m]),Y_r 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q!a_k 10000\ Y_p ,Y_q ,Y_r array with Yp′=(,k,σ)Y_p =( p, L_k, _ p) and Yq′=(,&i∈Iai.i,σq[↦m→⋅(ak,ϵ)])Y_q =( q, p\&_i∈ Ia_i. L_i, _q[ p m·(a_k,ε)]). The projection of :kai.ii∈I p 0.56905pt to8.94pt to3.31pt -1.65598pt to0.0pt @beginscope @invoke pgfstrokecolorrgb0,0,0 @color@rgb@stroke000 @invoke @color@rgb@fill000 @invoke @setlinewidth @invoke to0.0pt @beginscope @invoke @beginscope @invoke @roundcap @invoke @moveto0.0pt0.0pt @lineto0.0pt0.0pt @lineto0.92499pt0.8pt @lineto2.775pt-0.8pt @lineto4.625pt0.8pt @lineto5.55002pt0.0pt @lineto5.55002pt0.0pt @lineto5.56764pt0.0pt @stroke @invoke @beginscope @invoke @transformcm1.00.00.01.05.66763pt0.0pt @invoke @invoke @invoke @endscope @invoke @endscope @invoke @endscope @discardpath @invoke @endscope q:k\a_i. G_i\_i∈ I on p and q are k,σ L_k, _ p and &i∈Iai.i,σq[↦m→⋅(ak,ϵ)] p\&_i∈ Ia_i. L_i, _q[ p m·(a_k,ε)], respectively, which correspond to the types and queues in Yp′Y_p and Yq′Y_q . The configurations for the other participants are unchanged in the projection (they remain the merge of the projection on that participant of all i G_i with i∈Ii∈ I – the third-party case of projection for interaction and message in transit are the same) and after the transition, hence done. [] [Rcv] This case proceeds as [] [Snd] except the precise correspondence between ′ G and Y′Y is lost and ‘<:<:’ is required. Assume = :kai.ii∈I G= p 0.56905pt to8.94pt to3.31pt -1.65598pt to0.0pt @beginscope @invoke pgfstrokecolorrgb0,0,0 @color@rgb@stroke000 @invoke @color@rgb@fill000 @invoke @setlinewidth @invoke to0.0pt @beginscope @invoke @beginscope @invoke @roundcap @invoke @moveto0.0pt0.0pt @lineto0.0pt0.0pt @lineto0.92499pt0.8pt @lineto2.775pt-0.8pt @lineto4.625pt0.8pt @lineto5.55002pt0.0pt @lineto5.55002pt0.0pt @lineto5.56764pt0.0pt @stroke @invoke @beginscope @invoke @transformcm1.00.00.01.05.66763pt0.0pt @invoke @invoke @invoke @endscope @invoke @endscope @invoke @endscope @discardpath @invoke @endscope q:k\a_i. G_i\_i∈ I. The projection is of the form Y=(,&i∈Iai.i,σq[↦(ak,ϵ)⋅m→]),(,⊓i∈Ii′,σ),Yp,YrY_ G=( q, p\&_i∈ Ia_i. L_i, _q[ p (a_k,ε)· m]),( r, _i∈ I L _i, _ q),Y_p,Y_r where YpY_p is the projection on the sender (not important in this case) and ∉, r ∈\ p, q\ (without loss of generality we focus on one single r). By [] [Rcv] of the global semantics, :kai.ii∈I→?akk p 0.56905pt to8.94pt to3.31pt -1.65598pt to0.0pt @beginscope @invoke pgfstrokecolorrgb0,0,0 @color@rgb@stroke000 @invoke @color@rgb@fill000 @invoke @setlinewidth @invoke to0.0pt @beginscope @invoke @beginscope @invoke @roundcap @invoke @moveto0.0pt0.0pt @lineto0.0pt0.0pt @lineto0.92499pt0.8pt @lineto2.775pt-0.8pt @lineto4.625pt0.8pt @lineto5.55002pt0.0pt @lineto5.55002pt0.0pt @lineto5.56764pt0.0pt @stroke @invoke @beginscope @invoke @transformcm1.00.00.01.05.66763pt0.0pt @invoke @invoke @invoke @endscope @invoke @endscope @invoke @endscope @discardpath @invoke @endscope q:k\a_i. G_i\_i∈ I 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q?a_k 10000\ G_k By one application of rule [Par] of the local semantics with one application of [Snd] as a premise: ϵ:Y→?ak(,k,σq[↦m→]),(,⊓i∈Ii′,σ),Yp,Yr array[]l [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5ε: [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0Y_ G 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q?a_k 10000\ ( q, L_k, _q[ p m]),( r, _i∈ I L _i, _ q),Y_p,Y_r array Note that Y_ r is unchanged (as all other roles other than q. The projection of k G_k on p is still Yp=↾ϵkY_p= ε G_k p. The projection of k G_k on q is indeed the state reached by q, that is (,k,σq[↦m→])( q, L_k, _q[ p m]) with σk=σq[↦m→] _k= _q[ p m]. As to all other r, their projection is now ↾ϵk=k,σk ε G_k r= L_k, _k. But (25) ⊓i∈Ii<:k _i∈ I L_i<: L_k hence done. Observe that (25) holds: (1) by ‘<:<:’ (second rule) if r has a receive/branching prefix, (2) otherwise by ⊓i∈Ii=k _i∈ I L_i= L_k. [] [Cont1], [] [Cont2], and [] [Rec] are straightforward by induction. [] [Inst] We can assume =1⊳c2 G= G_1 [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100 1.0mu ^c 1.0mu G_2. By projection (26) Y=(,1⊳c′2,σ0)∈()Y_ G=\( p, L_1 p [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100 1.0mu ^c 1.0mu L_2 p, _0)\_ p∈ R( G) By [] [Inst] of the global semantics 1⊳c2→νc1▶∅,∅c2 G_1 [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100 1.0mu ^c 1.0mu G_2 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 ν c 10000\ G_1 1.0mu 1.0mu^c_ , [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_2 with 1▶∅,∅c2↾=(,1▶c2,σ0)∈() G_1 1.0mu 1.0mu^c_ , [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_2 10000\ =\( p, L_1 p 1.0mu ^c 1.0mu L_2 p, _0)\_ p∈ R( G) A configuration in Y that has been projected can either have MC c to instantiate top level or after some communication actions. Let J⊆()J R( G) be the roles whose configurations have the MC c instantiated by G at top level, and m=|J|m=|J|. With m applications of rule [Par] with [New] of the local semantics as premise: ϵ:Y→ ν(,1▶c2,σ0)∈()∩J∪(,1⊳c2,σ0)∈J array[]l [rgb].5,.5,.5 [named]pgfstrokecolorrgb.5,.5,.5 @color@gray@stroke.5 @color@gray@fill.5ε: [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0Y_ G 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 ν 10000\ \( p, L_1 p 1.0mu ^c 1.0mu L_2 p, _0)\_ p∈ R( G)∩ J∪\( p, L_1 p [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100 1.0mu ^c 1.0mu L_2 p, _0)\_ p∈ J array The thesis follows by observing that for all ∈J p∈ J, (,1⊳c′2,σ0)<:(,1▶c′2,σ0)( p, L_1 p [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100 1.0mu ^c 1.0mu L_2 p, _0)<:( p, L_1 p 1.0mu ^c 1.0mu L_2 p, _0). [] [Ctx1] Assume =1▶ℒ,ℛc,n2 G= G_1 1.0mu 1.0mu^c,n_L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_2. By projection we have two cases: either ℒL is empty or not. First, assume ℒ≠∅L≠ . Since G is reachable from an aware and balanced state (hypothesis), it is coherent (Lemma D.12) and hence ℛ=∅R= . Without loss of generality assume Y=(,▶∙,σ)∈()∩ℒ∪(,1▶2,σ)∈()∖ℒY_ G=\( p, L_ p\, \, , _ p)\_ p∈ R( G) 10000\ 10000\ ∪ 10000\ 10000\ \( p, L_1 p\, \, L_2 p, _ p)\_ p∈ R( G) where () R( G) is partitioned in the set of committed roles (in ℒL), and not committed roles (not in ℒL). By [] [Ctx1] of the global semantics (omitting c,nc,n), (27) νc→G1G1′ G1▶L,RG2νc→G1′▶L,RG2 21.0276pt $ G_1 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 ν c 10000\ G_1 $ 55.94421pt $ G_1 1.0mu 1.0mu_L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_2 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 ν c 10000\ G_1 1.0mu 1.0mu_L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_2$ Focussing on the LHS blocks of the local types in Y_ G: Y1=(,,σ)∈()∩ℒ∪(,1,σ1)∈()∖ℒY_1=\( p, L_ p, _ p)\_ p∈ R( G) 10000\ ∪ 10000\ \( p, L_1 p, _1 p)\_ p∈ R( G) By induction, looking at the premise in (27) Y1→ νc(,′,σ)∈()∩ℒ∪(,1′,σ1)∈()∖ℒY_1 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 ν c 10000\ \( p, L_ p , _ p)\_ p∈ R( G) 10000\ ∪ 10000\ \( p, L_1 p , _1 p)\_ p∈ R( G) where for all ∈()∖ℒ p∈ R( G) , σ=σ1∘σ2 _ p= _1 p _2 p for some σ2 _2 p. Moreover, (28) ∀∈()∩ℒ,l⊢1′↾=′,σ∀ p∈ R( G) , 10000\ 10000\ 10000\ l G_1 p= L_ p , _ p and (29) ∀∈()∖ℒ,l⊢1′↾=1′,σ1∀ p∈ R( G) , 10000\ 10000\ 10000\ l G_1 p= L_1 p , _1 p We need to check that the projection of ′ G is Y′Y . The thesis for roles committed on the LHS is straightforward by induction, as shown in (28). The case for ∈()∖ℒ p∈ R( G) follows by observing that: (1) projection of 1′ G_1 into 1,σ1 L_1 p, _1 p follows by induction as shown in (29); (2) 2 L_2 is unchanged hence projection of 2′ G_2 into 2,σ2 L_2 p, _2 p follows by hypothesis and projection. The queues are unchanged hence still σ=σ1∘σ2 _ p= _1 p _2 p. The case for ℒ=∅L= is symmetric, with possibly some role committed on the RHS: Y=(,∙▶,σ)∈()∩ℛ∪(,1▶2,σ)∈()∖ℛY_ G=\( p, \, \, L_ p\,, _ p)\_ p∈ R( G) 10000\ 10000\ ∪ 10000\ 10000\ \( p, L_1 p\, \, L_2 p, _ p)\_ p∈ R( G) By [] [Ctx1] of the global semantics, νc→G1G1′ G1▶c,nL,RG2νι→G1′▶c,nL,RG2 21.0276pt $ G_1 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 ν c 10000\ G_1 $ 53.40414pt $ G_1 1.0mu 1.0mu^c,n_L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_2 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 ν 10000\ G_1 1.0mu 1.0mu^c,n_L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_2$ By induction, (where YcY_c are the configurations of roles in ()∩ℛ R( G) – already committed on the right): (30) Y1=(,1,σ1)∈()∖ℛ∪Yc→ νc(,1′,σ1)∈()∖ℛ∪YcY_1=\( p, L_1 p, _1 p)\_ p∈ R( G) ∪ Y_c 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 ν c 10000\ \( p, L_1 p , _1 p)\_ p∈ R( G) ∪ Y_c where for all ∈()∖ℛ p∈ R( G) , σ=σ1∘σ2 _ p= _1 p _2 p for some σ2 _2 p. By induction, (31) ∀∈()∖ℛ,l⊢1′↾=1′,σ1∀ p∈ R( G) , 10000\ 10000\ 10000\ l G_1 p= L_1 p , _1 p The thesis for ∈()∖ℛ p∈ R( G) follows from observing that projection is defined inductively on the two sides and: (1) (31) and (30) for the LHS block; (2) the global and local types are unchanged hence the thesis for the RHS follows by hypothesis. The queues are unchanged hence still σ=σ1∘σ2 _ p= _1 p _2 p. [] [LSnd] Let =1▶ℒ,ℛ2 G= G_1 1.0mu 1.0mu_L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_2. By [] [LSnd] (32) !pqak→G1G1′ G!pqak→G1′▶L,RG2 26.39761pt $ G_1 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q!a_k 10000\ G_1 $ 41.61285pt $ G 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q!a_k 10000\ G_1 1.0mu 1.0mu_L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_2$ We have two cases: (a) p is uncommitted, (b) p is committed. Case (a): If p is uncommitted, let Y1Y_1 be the system obtained by projecting 1 G_1 on all its roles. By induction, by the premise in (32) it follows, observing that the definition of ‘<:<:’ for systems ignores the queues (see Section˜F.1): (33) Y1→!akY1′∧Y1′<:1′↾Y_1 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q!a_k 10000\ Y_1 10000\ 10000\ 10000\ 10000\ 10000\ 10000\ Y_1 <: G_1 From Equation˜33 we obtain (via definition of ’<:<:’) Y1′▶Y2<:Y′Y_1 Y_2<:Y . Lookinq at the queues now, without loss of generality, assume the only queue that changed in the transition from Y to Y′Y is q’s. Denoting the queue of q in Y as σ _ q and the queue of q in Y′Y as σ′ _ q we have σ′=σ[↦σ()⋅(ak,π)] _ q = _ q[ p _ q( p)·(a_k,π)]. The queues of all other roles are unchanged. By Lemma˜F.2 (garbageless projections) Y’s queues have no stale messages. Hence the only message that may cause the queues of Y′Y be different from thos of ′↾ G is (ak,π)(a_k,π). By Lemma˜F.10 we have that (ak,π)(a_k,π) is stale (can be garbage collected) if and only if it is not in in the queues of ′↾ G , as desired. Case (b) is essentially as case (a) except the projection of L_ p ignores the right-hand side process. [] [LRcv1] Let =1▶ℒ,ℛ2 G= G_1 1.0mu 1.0mu_L,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_2. By [] [LRcv1] pq?ak→G1G1′∉q∧R(p∈∨Lq=r) Gpq?ak→G1′▶∪Lq,RG2 81.81769pt $ G_1 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q?a_k 10000\ G_1 q ( p q= r)$ 50.99548pt $ G 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q?a_k 10000\ G_1 1.0mu 1.0mu_L∪\ q\,R [rgb]0,0,0 [named]pgfstrokecolorrgb0,0,0 @color@gray@stroke0 @color@gray@fill0 G_2$ Without loss of generality, (34) Y=Y,YrestY_ G=Y_ q,Y_rest where either (a) Y=(,1▶2,σ)Y_ q=( q, L_1 q\, \, L_2 q, _ q) or (b) Yq=(,1▶∙,σ)Y_q=( q, L_1 q\, \, , _ q). In either case the thesis follows by projection where the LHS of the outmost MC is the projection of 1′ G_1 by induction, whereas the RHS of the MC is just left out by the second projection rule for active MC. In the case for [] [LRcv2] either q is already committed or remains uncommitted. In the first case, Y=(,1▶∙,σ)Y_ q=( q, L_1 q\, \, , _ q) and in the second case (,1▶2,σ)( q, L_1 q\, \, L_2 q, _ q). The case is similar to [] [LRcv1], except the action is not a committing action hence Y_ q and Y′Y_ q have the same form. The case for [] [RSnd] is symmetric to the case for [] [LSnd] but simpler: no action can happen on the right hand side if ℒL is not empty so there is no need for garbage collection. The case for [] [RRcv] is as [] [RSnd] since on the right-hand side both send and receive are committing. ∎ F.5. Lemmata for Theorem˜4.4 Theorem 4.4 requires to show that the following relation is a weak correspondence (Definition˜4.3). (35) R=(,Y)| is reachable from an initial, aware, balanced global type .Y<:↾R=\( G,Y) 10000\ | 10000\ G is reachable from an initial, aware, balanced global type . 10000\ Y<: G \ Lemma˜4.2 and Lemma˜4.1 gives us only one step of correspondence when Y=↾Y= G . We need to show the transitive closure holds with Y<:↾Y<: G . Given a pair (,Y)∈R( G,Y)∈ R, we use the notation ≈(1)Y G≈^(1)Y to denote condition (1) in Definition˜4.3 and ≈(2)Y G≈^(2)Y to denote condition (2) in Definition˜4.3. The fact that R is a weak correspondence follows from Lemma˜F.12 and Lemma˜F.15. Lemma F.11. If <:′ L<: L and (,,σ)→ℓ(,′,σ)( p, L,σ) 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ ( p, L ,σ) then (,′,σ)→ℓ(,′,σ)( p, L ,σ) 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ ( p, L ,σ) and ′<:′ L <: L . Proof. (sketch) The proof is by induction on the derivation of <:′ L<: L proceeding by case analysis on the last rules in Section˜F.1. The base cases are trivial as end and t do not make any transition. The case for ∈<:Lk′LkkI &i∈Ipai.&<:Li′pak.Lk 31.90967pt $ L_k <: L_k k∈ I$ 51.82726pt $ p\,\&_i ∈I\,a_i. L_i <: p\,\&\,a_k. L_k$ follows by induction since ′=&i∈Iai.i′ L = p\,\&_i ∈I\,a_i. L_i has more action options than =&ak.k L= p\,\&\,a_k. L_k and k<:k′ L_k<: L_k by inductive definition of ‘<:<:’. The cases for rule <:L1′L1<:L2′L2 L1′⊳c<:L2′L1▶cL2 40.02777pt $ L_1 <: L_1 L_2 <: L_2$ 45.21254pt $ L_1 [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100 1.0mu ^c 1.0mu L_2 10000\ <: 10000\ L_1 1.0mu ^c 1.0mu L_2$ with =1′⊳c2′ L= L_1 [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100 1.0mu ^c 1.0mu L_2 and ′=1▶c2 L = L_1 1.0mu ^c 1.0mu L_2 follows by observing that the two terms in the conclusion can perform the same actions modulo a MC instantiation (i.e., τ) that 1′⊳c2′ L_1 [rgb]1,0,1 [named]pgfstrokecolorrgb1,0,1 @color@cmyk@stroke0100 @color@cmyk@fill0100 1.0mu ^c 1.0mu L_2 can always perform by local semantic rule [New]. Similarly for the rule below, by action [Rec]. <:L′[μt./L′t]L μt.<:L′L 30.88766pt $ L [μ t. L / t] <: L$ $ μ t. L <: L$ All other rules are straightforward by induction as left and right-hand side terms of ‘<:<:’ in the conclusions are the same. ∎ Lemma F.12. If (,Y)∈R( G,Y)∈ R then ≈(1)Y G≈^(1)Y. Proof. By R we have ↾<:Y G 10000\ <:Y. If →ℓ′ G 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ G by Lemma˜4.2 ↾→ℓ∗Y′ G 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 -3.44444pt^* 10000\ Y and Y′<:′↾Y <: G . We extend Lemma˜F.11 to configurations: observe that ↾ G and Y can be decomposed into a finite number of configurations by rule [] [PSystem], recalled below for convenience with Y=Y2∈PY=\Y_ r^2\_ r∈ P and ↾=Y1∈P G =\Y_ r^1\_ r∈ P. ∀r∈P<:Yr2Yr1 <:Yr2∈rPYr1r∈P [] array[]l $ 35.95448pt $ ∀ r ∈P 10000\ 10000\ Y_ r^2 <:Y_ r^1$ 43.21214pt $ \Y_ r^2\_ r∈ P <:\Y_ r^1\_ r ∈P$$ 10000\ 10000\ 10000\ 10000\ [PSystem] array By applying Lemma˜F.11 to the pairs of corresponding (same participant) configurations, by hypothesis ↾<:Y G 10000\ <:Y we obtain Y→ℓ∗Y′Y 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 -3.44444pt^* 10000\ Y and Y′<:Y′Y <:Y . Hence, by transitivity of ‘<:<:’ we have Y′<:′↾Y <: G as desired. ∎ Lemma F.13. If 1<:2 10000\ L_1<: L_2, (,1,σ)→ℓ(,1′,σ)( p, L_1,σ) 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ ( p, L_1 ,σ), and ℓ is not a receive action, then (,2,σ)→ℓ∗(,2′,σ)( p, L_2,σ) 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 -3.44444pt^* 10000\ ( p, L_2 ,σ) and 1′<:2′ L_1 <: L_2 . Proof. First, we show that (,2,σ)→ℓ( p, L_2,σ) 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ by induction on the derivation 1<:2 L_1<: L_2 proceeding by case analysis on the last rule used. Since (,,σ)( p, L,σ) does not make a receive action, then the last rule used cannot be a receive/branching (first rule where =&\, (3.0,6.0)[]\,=\& and second rule in Section˜F.1). By inspection of the remaining rules, the thesis follows by inductive hypothesis. Action ℓ can be mimicked immediately unless L is a MC definition, in which case it is mimicked after a MC initialization (i.e., a τ action). The fact that the continuation is still in a preorder relation is given by <:′ L<: L and by inductive definition of ‘<:<:’. ∎ For receiving actions, we have a weaker lemma which follows mechanically by induction on the derivation of ‘<:<:’. Lemma F.14. If 1<:2 10000\ L_1<: L_2, (,1,σ)→ℓ(,1′,σ)( p, L_1,σ) 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ ( p, L_1 ,σ) with ℓ a receive action, and (,2,σ)→ℓ∗(,2′,σ)( p, L_2,σ) 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 -3.44444pt^* 10000\ ( p, L_2 ,σ) then 1′<:2′ L_1 <: L_2 . Lemma F.15. If (,Y)∈R( G,Y)∈ R then ≈(2)Y G≈^(2)Y. Proof. By hypothesis we have Y<:↾Y<: G . First, assume Y→ℓY′Y 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ Y and ℓ is not a receive action. By Lemma˜F.13 we have ↾→ℓ∗Y′ G 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 -3.44444pt^* 10000\ Y and Y′<:Y′Y <:Y . By Lemma˜4.1 →ℓ′ G 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ G and Y′→∗Y′Y 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 -3.44444pt^* 10000\ Y with Y′<:′↾Y <: G . Again, since Y′→∗Y′Y 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 -3.44444pt^* 10000\ Y and Y→ℓY′Y 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ Y , by Lemma˜F.13 we have Y′→∗Y′Y 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 -3.44444pt^* 10000\ Y and Y′<:Y′Y <:Y . By transitivity of ‘<:<:’ we have Y′<:′↾Y <: G as desired. 999Note, the step Y′→∗Y′Y 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 -3.44444pt^* 10000\ Y is necessary when the role that is supposed to receive the message sent (for now stored in its queue) is getting a message that commits them to the opposite side wrt where the message is received. In this case, the queue of the receiver may include stale messages that need to be purged to restore equality of the queues between Y′Y and ′↾ G (projected systems never have stale messages). The case for receive action is interesting. If Y→ℓY′Y 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ Y by a receive action, say ℓ=?(ak,π) = p q?(a_k,π) then this action only involves one configuration in Y: the configuration of the receiver (,2,σ2)( q, L_2 q, _2 q) and σ2()=m1→⋅(ak,π)⋅m2→ _2 q( p)= m_1·(a_k,π)· m_2. This case is interesting because the local type of ↾ G q could be of the form &aj.j′ p\,\&\,a_j. L_j where q is already set to receive a specific label j by the second rule of <:<: in Section˜F.1 and this requires us to show that k=jk=j for any k that q may have chosen in Y. We use hypothesis Y<:↾Y<: G focussing on the configurations Y_ p of sender p and Y_ q receiver q. Let ↾=,σ G p= L_ p, _ p and ↾=,σ G q= L_ q, _ q. By [] [PConfig] we have Y<:(,,σ)Y_ p<:( p, L_ p, _ p) and Y<:(,,σ)Y_ q<:( q, L_ q, _ q). If (ak,π)(a_k,π) is in the queue of q in Y_ q then it is also in σ() _ q( p), which means p has already sent the message k in G. More precisely, G must have a subterm which is a message in transit by p to q of label aka_k in the path π. So, the branch selected by p in Y must be the same as the one selected by ↾ G yielding j=kj=k. Hence, also ↾→?(ak,π)Y′ G 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q?(a_k,π) 10000\ Y and by Lemma˜F.14 Y′<:Y′Y <:Y . This case now proceeds as the one above for non-receiving actions. ∎ Appendix G Orphan Message Freedom (OMF) To reason on orphan messages is presence of MC, it helps to define the notion of active context. Intuitively, an active context is a context where the hole is not in a stale path. Definition G.1 (Active Contexts). We define below global active contexts ()C_ G( p). Global active contexts are parameterized on a role p. Parameterization is necessary as some contexts may be active only for some participants when other participants have already committed to the opposite side. We write C_ G (omitting the parameter for readability) when not relevant or clear from the context. ()::=[]∣⇾:S∪a.()∣ :kS∪ak.()∣()▶ℒ,ℛ(ℒ∪ℛ⊆() and ∉ℛ)∣▶ℒ,ℛ()(ℒ∪ℛ⊆() and ∉ℒ) array[]rcllC_ G( p)&::=&[]\\ & & p q: [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S∪\a.C_ G( p)\\\ & & p 0.56905pt to8.94pt to3.31pt -1.65598pt to0.0pt @beginscope @invoke pgfstrokecolorrgb0,0,0 @color@rgb@stroke000 @invoke @color@rgb@fill000 @invoke @setlinewidth @invoke to0.0pt @beginscope @invoke @beginscope @invoke @roundcap @invoke @moveto0.0pt0.0pt @lineto0.0pt0.0pt @lineto0.92499pt0.8pt @lineto2.775pt-0.8pt @lineto4.625pt0.8pt @lineto5.55002pt0.0pt @lineto5.55002pt0.0pt @lineto5.56764pt0.0pt @stroke @invoke @beginscope @invoke @transformcm1.00.00.01.05.66763pt0.0pt @invoke @invoke @invoke @endscope @invoke @endscope @invoke @endscope @discardpath @invoke @endscope q:k\, [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S∪\a_k.C_ G( p)\\\ & &C_ G( p) _L,R G& (L R( G) and p )\\ & & G _L,RC_ G( p)& (L R( G) and p )\\ array We write ∘C_ G to denote a general global context obtained by the rules for C_ G but omitting the side conditions ∉ℛ p and ∉ℒ p in the fourth and fifth grammar rules, respectively. Note that ∘C_ G may contain stale paths. Note also that ∘C_ G differs from C defined in the main text of this paper as the former only involves runtime elements, no MC definitions and recursive types. The following definition is useful to correlate paths of global types with message paths of corresponding local types. Definition G.2 (Path of global active contexts). Define the path of an active context inductively as follows: ([])=ϵ(⇾:S∪a.)=(()( :kS∪ak.)=()(▶ℒ,ℛ)=l.()(▶ℒ,ℛ)=r.() array[]l Path([])=ε\\ Path( p q: [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S∪\a.C_ G\)= Path(C_ G()\\ Path( p 0.56905pt to8.94pt to3.31pt -1.65598pt to0.0pt @beginscope @invoke pgfstrokecolorrgb0,0,0 @color@rgb@stroke000 @invoke @color@rgb@fill000 @invoke @setlinewidth @invoke to0.0pt @beginscope @invoke @beginscope @invoke @roundcap @invoke @moveto0.0pt0.0pt @lineto0.0pt0.0pt @lineto0.92499pt0.8pt @lineto2.775pt-0.8pt @lineto4.625pt0.8pt @lineto5.55002pt0.0pt @lineto5.55002pt0.0pt @lineto5.56764pt0.0pt @stroke @invoke @beginscope @invoke @transformcm1.00.00.01.05.66763pt0.0pt @invoke @invoke @invoke @endscope @invoke @endscope @invoke @endscope @discardpath @invoke @endscope q:k\, [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S∪\a_k.C_ G\)= Path(C_ G)\\ Path(C_ G _L,R G)= l. Path(C_ G)\\ Path( G _L,RC_ G)= r. Path(C_ G) array Definition G.3 (Actions →ℓ@π 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 @π 10000\ ). We say that []C_ G[ G] moves at π with label ℓ , written []→ℓ@πC_ G[ G] 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 @π 10000\ if []→ℓ′[′]C_ G[ G] 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ C_ G [ G ] with ≠′ G≠ G and π=()=(′)π= Path(C_ G)= Path(C_ G ). Definition G.4 (Global staleness). We say that π is stale in G if there exists no C_ G such that =[′] G=C_ G[ G ] and ()=π Path(C_ G)=π. Proposition G.5. For all =()[ :kai.ii∈I] G=C_ G( q)[ p 0.56905pt to8.94pt to3.31pt -1.65598pt to0.0pt @beginscope @invoke pgfstrokecolorrgb0,0,0 @color@rgb@stroke000 @invoke @color@rgb@fill000 @invoke @setlinewidth @invoke to0.0pt @beginscope @invoke @beginscope @invoke @roundcap @invoke @moveto0.0pt0.0pt @lineto0.0pt0.0pt @lineto0.92499pt0.8pt @lineto2.775pt-0.8pt @lineto4.625pt0.8pt @lineto5.55002pt0.0pt @lineto5.55002pt0.0pt @lineto5.56764pt0.0pt @stroke @invoke @beginscope @invoke @transformcm1.00.00.01.05.66763pt0.0pt @invoke @invoke @invoke @endscope @invoke @endscope @invoke @endscope @discardpath @invoke @endscope q:k\,\a_i. G_i\_i∈ I] reachable from an initial, aware, balanced global type, (with π=()π= Path(C_ G)), there exists ′ G reachable from G such that either ′→?ak@π G 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q?a_k@π 10000\ or π is stale in ′ G . Proof. (sketch) We reason by induction on the structure of C_ G. Case =[]C_ G=[]. The thesis ′→?ak@π G 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q?a_k@π 10000\ follows immediately by an action for [] [Rcv] with =′ G= G . Case =⇾:S∪a.′C_ G= s r: [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S∪\a.C_ G \. By induction: ′[ :kai.ii∈I]→∗→?ak@π′C_ G [ p 0.56905pt to8.94pt to3.31pt -1.65598pt to0.0pt @beginscope @invoke pgfstrokecolorrgb0,0,0 @color@rgb@stroke000 @invoke @color@rgb@fill000 @invoke @setlinewidth @invoke to0.0pt @beginscope @invoke @beginscope @invoke @roundcap @invoke @moveto0.0pt0.0pt @lineto0.0pt0.0pt @lineto0.92499pt0.8pt @lineto2.775pt-0.8pt @lineto4.625pt0.8pt @lineto5.55002pt0.0pt @lineto5.55002pt0.0pt @lineto5.56764pt0.0pt @stroke @invoke @beginscope @invoke @transformcm1.00.00.01.05.66763pt0.0pt @invoke @invoke @invoke @endscope @invoke @endscope @invoke @endscope @discardpath @invoke @endscope q:k\,\a_i. G_i\_i∈ I] 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ ^* 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q?a_k@π 10000\ with π′=(′)π = Path(C_ G ). By two applications of rule [] [Snd] and [] [Rcv], respectively, →!a,?a′[ :kai.ii∈I] G 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 s r!a, s r?a 10000\ C_ G [ p 0.56905pt to8.94pt to3.31pt -1.65598pt to0.0pt @beginscope @invoke pgfstrokecolorrgb0,0,0 @color@rgb@stroke000 @invoke @color@rgb@fill000 @invoke @setlinewidth @invoke to0.0pt @beginscope @invoke @beginscope @invoke @roundcap @invoke @moveto0.0pt0.0pt @lineto0.0pt0.0pt @lineto0.92499pt0.8pt @lineto2.775pt-0.8pt @lineto4.625pt0.8pt @lineto5.55002pt0.0pt @lineto5.55002pt0.0pt @lineto5.56764pt0.0pt @stroke @invoke @beginscope @invoke @transformcm1.00.00.01.05.66763pt0.0pt @invoke @invoke @invoke @endscope @invoke @endscope @invoke @endscope @discardpath @invoke @endscope q:k\,\a_i. G_i\_i∈ I]. Observe that (′)=()=π Path(C_ G )= Path(C_ G)=π and hence →∗→?ak@π G 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ ^* 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q?a_k@π 10000\ with the last action being at ()=π Path(C_ G)=π as required. The case for :kS∪ak. p 0.56905pt to8.94pt to3.31pt -1.65598pt to0.0pt @beginscope @invoke pgfstrokecolorrgb0,0,0 @color@rgb@stroke000 @invoke @color@rgb@fill000 @invoke @setlinewidth @invoke to0.0pt @beginscope @invoke @beginscope @invoke @roundcap @invoke @moveto0.0pt0.0pt @lineto0.0pt0.0pt @lineto0.92499pt0.8pt @lineto2.775pt-0.8pt @lineto4.625pt0.8pt @lineto5.55002pt0.0pt @lineto5.55002pt0.0pt @lineto5.56764pt0.0pt @stroke @invoke @beginscope @invoke @transformcm1.00.00.01.05.66763pt0.0pt @invoke @invoke @invoke @endscope @invoke @endscope @invoke @endscope @discardpath @invoke @endscope q:k\, [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1S∪\a_k.C_ G\ is similar. Case ()=′()▶ℒ,ℛC_ G( q)=C_ G ( q) _L,R G_ r (with ∉ℛ q ). By induction (36) ′[ :kai.ii∈I]→∗in′C_ G [ p 0.56905pt to8.94pt to3.31pt -1.65598pt to0.0pt @beginscope @invoke pgfstrokecolorrgb0,0,0 @color@rgb@stroke000 @invoke @color@rgb@fill000 @invoke @setlinewidth @invoke to0.0pt @beginscope @invoke @beginscope @invoke @roundcap @invoke @moveto0.0pt0.0pt @lineto0.0pt0.0pt @lineto0.92499pt0.8pt @lineto2.775pt-0.8pt @lineto4.625pt0.8pt @lineto5.55002pt0.0pt @lineto5.55002pt0.0pt @lineto5.56764pt0.0pt @stroke @invoke @beginscope @invoke @transformcm1.00.00.01.05.66763pt0.0pt @invoke @invoke @invoke @endscope @invoke @endscope @invoke @endscope @discardpath @invoke @endscope q:k\,\a_i. G_i\_i∈ I] 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ ^* G_in and either (1) in′→?ak@π′ G_in 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q?a_k@π 10000\ with π′=(′)π = Path(C_ G ) or (2) π′π is stale in in′ G_in . We have two cases: • if ℛ≠∅R≠ then, since there is an active dependency from the observer of the mixed choice and q, q will commit to the RHS, which will make π stale in the reached state as desired. Here it does not matter if π′π in the induction step is stale or not – case 1 or 2 following (36), as the whole π becomes stale by effect of an action on the RHS of the larger context. • if ℛ=∅R= and (36) holds by case (1) then we need to show that all actions by ′[ :kai.ii∈I]C_ G [ p 0.56905pt to8.94pt to3.31pt -1.65598pt to0.0pt @beginscope @invoke pgfstrokecolorrgb0,0,0 @color@rgb@stroke000 @invoke @color@rgb@fill000 @invoke @setlinewidth @invoke to0.0pt @beginscope @invoke @beginscope @invoke @roundcap @invoke @moveto0.0pt0.0pt @lineto0.0pt0.0pt @lineto0.92499pt0.8pt @lineto2.775pt-0.8pt @lineto4.625pt0.8pt @lineto5.55002pt0.0pt @lineto5.55002pt0.0pt @lineto5.56764pt0.0pt @stroke @invoke @beginscope @invoke @transformcm1.00.00.01.05.66763pt0.0pt @invoke @invoke @invoke @endscope @invoke @endscope @invoke @endscope @discardpath @invoke @endscope q:k\,\a_i. G_i\_i∈ I] can also be performed by the larger context ′[ :kai.ii∈I]▶ℒ,∅cC_ G [ p 0.56905pt to8.94pt to3.31pt -1.65598pt to0.0pt @beginscope @invoke pgfstrokecolorrgb0,0,0 @color@rgb@stroke000 @invoke @color@rgb@fill000 @invoke @setlinewidth @invoke to0.0pt @beginscope @invoke @beginscope @invoke @roundcap @invoke @moveto0.0pt0.0pt @lineto0.0pt0.0pt @lineto0.92499pt0.8pt @lineto2.775pt-0.8pt @lineto4.625pt0.8pt @lineto5.55002pt0.0pt @lineto5.55002pt0.0pt @lineto5.56764pt0.0pt @stroke @invoke @beginscope @invoke @transformcm1.00.00.01.05.66763pt0.0pt @invoke @invoke @invoke @endscope @invoke @endscope @invoke @endscope @discardpath @invoke @endscope q:k\,\a_i. G_i\_i∈ I] _L, ^c G_ r. First, observe that no action on the LHS of MC c can change the right-hand side set c and hence ′[ :kai.ii∈I]▶ℒ,∅→∗C_ G [ p 0.56905pt to8.94pt to3.31pt -1.65598pt to0.0pt @beginscope @invoke pgfstrokecolorrgb0,0,0 @color@rgb@stroke000 @invoke @color@rgb@fill000 @invoke @setlinewidth @invoke to0.0pt @beginscope @invoke @beginscope @invoke @roundcap @invoke @moveto0.0pt0.0pt @lineto0.0pt0.0pt @lineto0.92499pt0.8pt @lineto2.775pt-0.8pt @lineto4.625pt0.8pt @lineto5.55002pt0.0pt @lineto5.55002pt0.0pt @lineto5.56764pt0.0pt @stroke @invoke @beginscope @invoke @transformcm1.00.00.01.05.66763pt0.0pt @invoke @invoke @invoke @endscope @invoke @endscope @invoke @endscope @discardpath @invoke @endscope q:k\,\a_i. G_i\_i∈ I] _L, G_ r 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ ^* with lead to an outer context where ℛ=∅R= . We omit the (mechanical) inner induction on the length of →∗→?ak@π′ 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ ^* 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q?a_k@π 10000\ and show that any action ℓ can be executed by its context proceeding by case analysis on the last transition rule used. The possible cases are: (i) instantiation actions, which can occur in C_ G by [] [Ctx1] (if there are still uncommitted roles in ′C_ G then there are also in C_ G hence the premise of [] [Ctx1] holds for C_ G), (i) non committing receive actions that can occur in the larger context by [] [LRcv2], and (i) send actions that can occur by [] [LSnd]. As to committing actions – that can be only receive actions as no participant can commit on the LHS with a send action (iv): receive actions can occur in C_ G by [] [LRcv1] and change the context into ▶ℒ∪′,ℛ′C_ G _L∪\ r \,R G_ r where ′ r is the subject of the receive action. Observe that the path of the new context is still π: (′▶ℒ∪′,∅)=π Path(C_ G _L∪\ r \, G_ r)=π. The previous four cases show that ′[ :kai.ii∈I]▶ℒ,∅→∗→?ak@l.π′C_ G [ p 0.56905pt to8.94pt to3.31pt -1.65598pt to0.0pt @beginscope @invoke pgfstrokecolorrgb0,0,0 @color@rgb@stroke000 @invoke @color@rgb@fill000 @invoke @setlinewidth @invoke to0.0pt @beginscope @invoke @beginscope @invoke @roundcap @invoke @moveto0.0pt0.0pt @lineto0.0pt0.0pt @lineto0.92499pt0.8pt @lineto2.775pt-0.8pt @lineto4.625pt0.8pt @lineto5.55002pt0.0pt @lineto5.55002pt0.0pt @lineto5.56764pt0.0pt @stroke @invoke @beginscope @invoke @transformcm1.00.00.01.05.66763pt0.0pt @invoke @invoke @invoke @endscope @invoke @endscope @invoke @endscope @discardpath @invoke @endscope q:k\,\a_i. G_i\_i∈ I] _L, G_ r 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ ^* 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q?a_k@ l.π 10000\ where, by the structure of C_ G, l.π′=π l.π =π, as desired. If ℛ=∅R= and (36) holds then let, with no loss of generality, ℓi∈ℓ→ _i∈ be the first action in the sequence ′[ :kai.ii∈I]→ℓ→in′C_ G [ p 0.56905pt to8.94pt to3.31pt -1.65598pt to0.0pt @beginscope @invoke pgfstrokecolorrgb0,0,0 @color@rgb@stroke000 @invoke @color@rgb@fill000 @invoke @setlinewidth @invoke to0.0pt @beginscope @invoke @beginscope @invoke @roundcap @invoke @moveto0.0pt0.0pt @lineto0.0pt0.0pt @lineto0.92499pt0.8pt @lineto2.775pt-0.8pt @lineto4.625pt0.8pt @lineto5.55002pt0.0pt @lineto5.55002pt0.0pt @lineto5.56764pt0.0pt @stroke @invoke @beginscope @invoke @transformcm1.00.00.01.05.66763pt0.0pt @invoke @invoke @invoke @endscope @invoke @endscope @invoke @endscope @discardpath @invoke @endscope q:k\,\a_i. G_i\_i∈ I] 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ G_in by which π′π becomes stale. Using a similar reasoning to case (1) all actions of the inner context can be performed by the outer MC context, including ℓi _i. The thesis follows by observing that a context with a stale subterm is also stale hence if π′π becomes stale then also π does. Case =▶∅,ℛ′C_ G= G_ l _ ,RC_ G is symmetric. ∎ Proposition G.6 (Stale persistency). If Y,(,,σ)→ℓY′,(,′,σ′)Y,( q, L,σ) 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ Y ,( q, L ,σ ) and (π,) stale(π, L) then (π,′) stale(π, L ). The proof is mechanical by induction on the transition, reasoning by case analysis on the last rule applied. Observe that transitions never remove MC instances and can only change the tree structure of nested MC by either expanding the leaves with new instantiations, or committing hence adding (never removing) stale sides ∙ . Proposition G.7 (Local-global activeness). Let Y,(,,σ)=↾Y,( q, L,σ)= G and σ[]=(a,π)⋅m→σ[ p]=(a,π)· m then =()[ :kai.ii∈I] G=C_ G( q)[ p 0.56905pt to8.94pt to3.31pt -1.65598pt to0.0pt @beginscope @invoke pgfstrokecolorrgb0,0,0 @color@rgb@stroke000 @invoke @color@rgb@fill000 @invoke @setlinewidth @invoke to0.0pt @beginscope @invoke @beginscope @invoke @roundcap @invoke @moveto0.0pt0.0pt @lineto0.0pt0.0pt @lineto0.92499pt0.8pt @lineto2.775pt-0.8pt @lineto4.625pt0.8pt @lineto5.55002pt0.0pt @lineto5.55002pt0.0pt @lineto5.56764pt0.0pt @stroke @invoke @beginscope @invoke @transformcm1.00.00.01.05.66763pt0.0pt @invoke @invoke @invoke @endscope @invoke @endscope @invoke @endscope @discardpath @invoke @endscope q:k\,\a_i. G_i\_i∈ I] for some C_ G where ()=π Path(C_ G)=π. Proof. (sketch) Observe that ¬(π,) stale(π, L) by garbageless projection (Lemma˜F.2). By inspection of the projection rules, the only global type that can produce a message (a,π)(a,π) that is, by the second projection rule for messages in transit :kai.ii∈I p 0.56905pt to8.94pt to3.31pt -1.65598pt to0.0pt @beginscope @invoke pgfstrokecolorrgb0,0,0 @color@rgb@stroke000 @invoke @color@rgb@fill000 @invoke @setlinewidth @invoke to0.0pt @beginscope @invoke @beginscope @invoke @roundcap @invoke @moveto0.0pt0.0pt @lineto0.0pt0.0pt @lineto0.92499pt0.8pt @lineto2.775pt-0.8pt @lineto4.625pt0.8pt @lineto5.55002pt0.0pt @lineto5.55002pt0.0pt @lineto5.56764pt0.0pt @stroke @invoke @beginscope @invoke @transformcm1.00.00.01.05.66763pt0.0pt @invoke @invoke @invoke @endscope @invoke @endscope @invoke @endscope @discardpath @invoke @endscope q:k\,\a_i. G_i\_i∈ I. Assume without loss of generality that =∘[′()[ :kai.ii∈I]] G=C_ G [C_ G ( q)[ p 0.56905pt to8.94pt to3.31pt -1.65598pt to0.0pt @beginscope @invoke pgfstrokecolorrgb0,0,0 @color@rgb@stroke000 @invoke @color@rgb@fill000 @invoke @setlinewidth @invoke to0.0pt @beginscope @invoke @beginscope @invoke @roundcap @invoke @moveto0.0pt0.0pt @lineto0.0pt0.0pt @lineto0.92499pt0.8pt @lineto2.775pt-0.8pt @lineto4.625pt0.8pt @lineto5.55002pt0.0pt @lineto5.55002pt0.0pt @lineto5.56764pt0.0pt @stroke @invoke @beginscope @invoke @transformcm1.00.00.01.05.66763pt0.0pt @invoke @invoke @invoke @endscope @invoke @endscope @invoke @endscope @discardpath @invoke @endscope q:k\,\a_i. G_i\_i∈ I]] (the inner active context may be just the hole). We need to show that ∘C_ G is an active context for q with path π. The proof is by induction on the structure of π. Case π=ϵπ=ε. Application of the second rule on :kai.ii∈I p 0.56905pt to8.94pt to3.31pt -1.65598pt to0.0pt @beginscope @invoke pgfstrokecolorrgb0,0,0 @color@rgb@stroke000 @invoke @color@rgb@fill000 @invoke @setlinewidth @invoke to0.0pt @beginscope @invoke @beginscope @invoke @roundcap @invoke @moveto0.0pt0.0pt @lineto0.0pt0.0pt @lineto0.92499pt0.8pt @lineto2.775pt-0.8pt @lineto4.625pt0.8pt @lineto5.55002pt0.0pt @lineto5.55002pt0.0pt @lineto5.56764pt0.0pt @stroke @invoke @beginscope @invoke @transformcm1.00.00.01.05.66763pt0.0pt @invoke @invoke @invoke @endscope @invoke @endscope @invoke @endscope @discardpath @invoke @endscope q:k\,\a_i. G_i\_i∈ I can occur after a finite number of applications of instances of the first or the second projection rule (for communication and message in transit). It results that =∘[ :kai.ii∈I] G=C_ G [ p 0.56905pt to8.94pt to3.31pt -1.65598pt to0.0pt @beginscope @invoke pgfstrokecolorrgb0,0,0 @color@rgb@stroke000 @invoke @color@rgb@fill000 @invoke @setlinewidth @invoke to0.0pt @beginscope @invoke @beginscope @invoke @roundcap @invoke @moveto0.0pt0.0pt @lineto0.0pt0.0pt @lineto0.92499pt0.8pt @lineto2.775pt-0.8pt @lineto4.625pt0.8pt @lineto5.55002pt0.0pt @lineto5.55002pt0.0pt @lineto5.56764pt0.0pt @stroke @invoke @beginscope @invoke @transformcm1.00.00.01.05.66763pt0.0pt @invoke @invoke @invoke @endscope @invoke @endscope @invoke @endscope @discardpath @invoke @endscope q:k\,\a_i. G_i\_i∈ I] where ∘C_ G is either a hole [][] or a finite concatenation of communication actions and messages in transit. In all these cases, since no MC occurs in ∘C_ G then ∘C_ G is an active context on q hence =()[ :kai.ii∈I] G=C_ G( q)[ p 0.56905pt to8.94pt to3.31pt -1.65598pt to0.0pt @beginscope @invoke pgfstrokecolorrgb0,0,0 @color@rgb@stroke000 @invoke @color@rgb@fill000 @invoke @setlinewidth @invoke to0.0pt @beginscope @invoke @beginscope @invoke @roundcap @invoke @moveto0.0pt0.0pt @lineto0.0pt0.0pt @lineto0.92499pt0.8pt @lineto2.775pt-0.8pt @lineto4.625pt0.8pt @lineto5.55002pt0.0pt @lineto5.55002pt0.0pt @lineto5.56764pt0.0pt @stroke @invoke @beginscope @invoke @transformcm1.00.00.01.05.66763pt0.0pt @invoke @invoke @invoke @endscope @invoke @endscope @invoke @endscope @discardpath @invoke @endscope q:k\,\a_i. G_i\_i∈ I] with ∘=()C_ G =C_ G( q) and ()=π=ϵ Path(C_ G)=π=ε as required. If π=π′.lπ=π . l then without loss of generality =∘[′()[ :kai.ii∈I]] G=C_ G [C_ G ( q)[ p 0.56905pt to8.94pt to3.31pt -1.65598pt to0.0pt @beginscope @invoke pgfstrokecolorrgb0,0,0 @color@rgb@stroke000 @invoke @color@rgb@fill000 @invoke @setlinewidth @invoke to0.0pt @beginscope @invoke @beginscope @invoke @roundcap @invoke @moveto0.0pt0.0pt @lineto0.0pt0.0pt @lineto0.92499pt0.8pt @lineto2.775pt-0.8pt @lineto4.625pt0.8pt @lineto5.55002pt0.0pt @lineto5.55002pt0.0pt @lineto5.56764pt0.0pt @stroke @invoke @beginscope @invoke @transformcm1.00.00.01.05.66763pt0.0pt @invoke @invoke @invoke @endscope @invoke @endscope @invoke @endscope @discardpath @invoke @endscope q:k\,\a_i. G_i\_i∈ I]] where ′()C_ G ( q) is the largest context with only send/receive actions, and since by definition it has no MC it is active. We now use the form of π to decompose ∘C_ G and show it is active. By inspection of the projection rules (by either fourth rule, first and third case) we have observe that ∘C_ G has the following form: ∘=∘′[′()▶ℒ,ℛ2]C_ G =C_ G [C_ G ( q) _L,R G_2] If the fourth projection rule - first case - was used to project G, then ∈ℒ q hence by coherence ∉ℛ q . If the fourth rule - third case - was used again, by side condition ∉ℒ∪ℛ q we have ∉ℛ q . Since in both cases ∉ℛ q then []▶ℒ,ℛ2[] _L,R G_2 is active, and hence ′()▶ℒ,ℛ2C_ G ( q) _L,R G_2 is also active, as obtained by plugging an active context into another active one. By induction, we have ∘′C_ G is active for q with path π′π . Hence, ∘C_ G is active because it is obtained by plugging context ′()▶ℒ,ℛ2C_ G ( q) _L,R G_2 that is active for p with π into another context ∘′C_ G that is also active for q with π (this is by definition of active contexts). The case for π=π′.rπ=π . r is symmetric. ∎ Proposition˜G.8 follows by generalizing Proposition˜G.7, by mechanical induction on the length of m1→ m_1 and on the derivation of Y<:↾Y<: G . Proposition G.8 (Local-global activeness (general)). Let Y,(,,σ)<:↾Y,( q, L,σ)<: G and σ[]=m1→⋅(a,π)⋅m2→σ[ p]= m_1·(a,π)· m_2 then =()[ :kai.ii∈I] G=C_ G( q)[ p 0.56905pt to8.94pt to3.31pt -1.65598pt to0.0pt @beginscope @invoke pgfstrokecolorrgb0,0,0 @color@rgb@stroke000 @invoke @color@rgb@fill000 @invoke @setlinewidth @invoke to0.0pt @beginscope @invoke @beginscope @invoke @roundcap @invoke @moveto0.0pt0.0pt @lineto0.0pt0.0pt @lineto0.92499pt0.8pt @lineto2.775pt-0.8pt @lineto4.625pt0.8pt @lineto5.55002pt0.0pt @lineto5.55002pt0.0pt @lineto5.56764pt0.0pt @stroke @invoke @beginscope @invoke @transformcm1.00.00.01.05.66763pt0.0pt @invoke @invoke @invoke @endscope @invoke @endscope @invoke @endscope @discardpath @invoke @endscope q:k\,\a_i. G_i\_i∈ I] for some C_ G where ()=π Path(C_ G)=π. See 4.7 Proof. If (π,) stale(π, L) the thesis follows immediately. If ¬(π,) stale(π, L) then by Proposition˜G.8 Y,(,,σ)<:↾Y,( q, L,σ)<: G for some =[ :kai.ii∈I] G=C_ G[ p 0.56905pt to8.94pt to3.31pt -1.65598pt to0.0pt @beginscope @invoke pgfstrokecolorrgb0,0,0 @color@rgb@stroke000 @invoke @color@rgb@fill000 @invoke @setlinewidth @invoke to0.0pt @beginscope @invoke @beginscope @invoke @roundcap @invoke @moveto0.0pt0.0pt @lineto0.0pt0.0pt @lineto0.92499pt0.8pt @lineto2.775pt-0.8pt @lineto4.625pt0.8pt @lineto5.55002pt0.0pt @lineto5.55002pt0.0pt @lineto5.56764pt0.0pt @stroke @invoke @beginscope @invoke @transformcm1.00.00.01.05.66763pt0.0pt @invoke @invoke @invoke @endscope @invoke @endscope @invoke @endscope @discardpath @invoke @endscope q:k\,\a_i. G_i\_i∈ I] with ()=π Path(C_ G)=π. By Proposition˜G.5 there exists ′ G reachable from G such that ′→?ak@() G 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q?a_k@ Path(C_ G) 10000\ . By Theorem˜4.4 since ≈↾ G≈ G we obtain ↾→∗→?(ak,π) G 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ ^* 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q?(a_k,π) 10000\ . By Y,(,,σ)<:↾Y,( q, L,σ)<: G and Lemma˜F.12 we obtain Y,(,,σ)→∗→?(akπ)Y,( q, L,σ) 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 10000\ ^* 10000\ [rgb]0,0,1 [named]pgfstrokecolorrgb0,0,1 p q?(a_kπ) 10000\ , with π=()π= Path(C_ G) as desired. ∎