%!TEX root = forallxcam.tex
\part{Natural deduction for FOL}
\label{ch.NDFOL}

\chapter{Basic rules for FOL}\label{s:BasicFOL}

The language of FOL uses of all of the connectives of TFL. So proofs in FOL will use all of the basic and derived rules from chapter \ref{ch.NDTFL}. We shall also use the proof-theoretic notions (particularly, the symbol `$\proves$') introduced in that chapter. However, we will also need some new basic rules to govern the quantifiers, and to govern the identity sign.

\section{Universal elimination}

From the claim that everything is F, you can infer that any particular thing is F. You name it; it's F. So the following should be fine:
\begin{proof}
	\hypo{a}{\forall xRxxd}
	\have{c}{Raad} \Ae{a}
\end{proof}
We obtained line 2 by dropping the universal quantifier and replacing every instance of `$x$' with `$a$'. Equally, the following should be allowed:
\begin{proof}
	\hypo{a}{\forall xRxxd}
	\have{c}{Rddd} \Ae{a}
\end{proof}
We obtained line 2 here by dropping the universal quantifier and replacing every instance of `$x$' with `$d$'. We could have done the same with any other name we wanted.

This motivates the universal elimination rule ($\forall$E):
\factoidbox{
\begin{proof}
	\have[m]{a}{\forall \meta{x}\meta{A}(\ldots \meta{x} \ldots \meta{x}\ldots)}
	\have[\ ]{c}{\meta{A}(\ldots \meta{c} \ldots \meta{c}\ldots)} \Ae{a}
\end{proof}}
The notation here was introduced in \S\ref{s:TruthFOL}. The point is that you can obtain any \emph{substitution instance} of a universally quantified formula: replace every instance of the quantified variable with any name you like.

I should emphasise that (as with every elimination rule) you can only apply the $\forall$E rule when the universal quantifier is the main logical operator. So the following is \emph{banned}:
\begin{proof}
	\hypo{a}{\forall x Bx \eif Bk}
	\have{c}{Bb \eif Bk}\by{naughtily attempting to invoke $\forall$E}{a}
\end{proof}
This is illegitimate, since `$\forall x$' is not the main logical operator in line 1. (If you need a reminder as to why this sort of inference should be banned, reread \S\ref{s:MoreMonadic}.)

\section{Existential introduction}
From the claim that some particular thing is an F, you can infer that something is an F. So we ought to allow:
\begin{proof}
	\hypo{a}{Raad}
	\have{b}{\exists x Raax} \Ei{a}
\end{proof}
Here, we have replaced the name `$d$' with a variable `$x$', and then existentially quantified over it. Equally, we would have allowed:
\begin{proof}
	\hypo{a}{Raad}
	\have{c}{\exists x Rxxd} \Ei{a}
\end{proof}
Here we have replaced both instances of the name `$a$' with a variable, and then existentially generalised. But we do not need to replace \emph{both} instances of a name with a variable: if Narcissus loves himself, then there is someone who loves Narcissus. So we  also allow:
\begin{proof}
	\hypo{a}{Raad}
	\have{d}{\exists x Rxad} \Ei{a}
\end{proof}
Here we have replaced \emph{one} instance of the name `$a$' with a variable, and then existentially generalised. These observations motivate our introduction rule, although to explain it, we shall need to introduce some new notation.

Where $\meta{A}$ is a sentence containing the name $\meta{c}$, we can emphasise this by writing `$\meta{A}(\ldots \meta{c} \ldots \meta{c}\ldots)$'. We shall write `$\meta{A}(\ldots \meta{x} \ldots \meta{c}\ldots)$' to indicate any formula obtained by replacing \emph{some or all} of the instances of the name \meta{c} with the variable \meta{x}. Armed with this, our introduction rule is:
\factoidbox{
\begin{proof}
	\have[m]{a}{\meta{A}(\ldots \meta{c} \ldots \meta{c}\ldots)}
	\have[\ ]{c}{\exists \meta{x}\meta{A}(\ldots \meta{x} \ldots \meta{c}\ldots)} \Ei{a}
\end{proof}
\meta{x} must not occur in $\meta{A}(\ldots \meta{c} \ldots \meta{c}\ldots)$}
The constraint is included to guarantee that any application of the rule yields a  sentence of FOL. Thus the following is allowed:
\begin{proof}
	\hypo{a}{Raad}
	\have{d}{\exists x Rxad} \Ei{a}
	\have{e}{\exists y \exists x Rxyd} \Ei{d}
\end{proof}
But this is banned:
\begin{proof}
	\hypo{a}{Raad}
	\have{d}{\exists x Rxad} \Ei{a}
	\have{e}{\exists x \exists x Rxxd}\by{naughtily attempting to invoke $\exists$I}{d}
\end{proof}
since the expression on line 3 contains clashing variables, and so is not a sentence of FOL.

\section{Empty domains}
The following proof combines our two new rules for quantifiers:
	\begin{proof}
		\hypo{a}{\forall x Fx}
		\have{in}{Fa}\Ae{a}
		\have{e}{\exists x Fx}\Ei{in}
	\end{proof}
Could this be a bad proof? If anything exists at all, then certainly we can infer that something is F, from the fact that everything is F. But what if \emph{nothing} exists at all? Then it is surely vacuously true that everything is F; however, it does not following that something is F, for there is nothing to \emph{be} F. So if we claim that, as a matter of logic alone, `$\exists x Fx$' follows from `$\forall x Fx$', then we are claiming that, as a matter of \emph{logic alone}, there is something rather than nothing. This might strike us as a bit odd.

Actually, we are already committed to this oddity. In \S\ref{s:FOLBuildingBlocks}, we stipulated that domains in FOL must have at least one member. We then defined a logical truth (of FOL) as a sentence which is true in every interpretation. Since `$\exists x\ x=x$' will be true in every interpretation, this \emph{also} had the effect of stipulating that it is a matter of logic that there is something rather than nothing.

Since it is far from clear that logic should tell us that there must be something rather than nothing, we might well be cheating a bit here.

If we refuse to cheat, though, then we pay a high cost. Here are three things that we want to hold on to:
	\begin{ebullet}
		\item $\forall x Fx \proves Fa$: after all, that was $\forall$E.
		\item $Fa \proves \exists x Fx$: after all, that was $\exists$I.
		\item the ability to copy-and-paste proofs together: after all, reasoning works by putting lots of little steps together into rather big chains.
	\end{ebullet}
If we get what we want on all three counts, then we have to countenance that $\forall xFx \proves \exists x Fx$. So, if we get what we want on all three counts, the proof system alone tells us that there is something rather than nothing. And if we refuse to accept that, then we have to surrender one of the three things that we want to hold on to!

Before we start thinking about which to surrender, we might want to ask how \emph{much} of a cheat this is. Granted, it may make it harder to engage in theological debates about why there is something rather than nothing. But the rest of the time, we will get along just fine. So maybe we should just regard our proof system (and FOL, more generally) as having a very slightly limited purview. If we ever want to allow for the possibility of \emph{nothing}, then we shall have to cast around for a more complicated proof system. But for as long as we are content to ignore that possibility, our proof system is perfectly in order. (As, similarly, is the stipulation that every domain must contain at least one object.)

\section{Universal introduction}
Suppose you had shown of each particular thing that it is F (and that there are no other things to consider). Then you would be justified in claiming that everything is F. This would motivate the following proof rule. If you had established each and every single substitution instance of `$\forall x Fx$', then you can infer `$\forall x Fx$'.

Unfortunately, that rule would be utterly unusable. To establish each and every single substitution instance would require proving `$Fa$', `$Fb$', $\ldots$, `$Fj_2$', $\ldots$, `$Fr_{79002}$', $\ldots$, and so on. Indeed, since there are infinitely many names in FOL, this process would never come to an end. So we could never apply that rule. We need to be a bit more cunning in coming up with our rule for introducing universal quantification.

Our cunning thought will be inspired by considering:
$$\forall x Fx \therefore \forall y Fy$$
This argument should \emph{obviously} be valid. After all, alphabetical variation ought to be a matter of taste, and of no logical consequence. But how might our proof system reflect this? Suppose we begin a proof thus:
\begin{proof}
	\hypo{x}{\forall x Fx}
	\have{a}{Fa} \Ae{x}
\end{proof}
We have proved `$Fa$'. And, of course, nothing stops us from using the same justification to prove `$Fb$', `$Fc$', $\ldots$, `$Fj_2$', $\ldots$, `$Fr_{79002}, \ldots$, and so on until we run out of space, time, or patience. But reflecting on this, we see that there is a way to prove $F\meta{c}$, for any name \meta{c}. And if we can do it for \emph{any} thing, we should surely be able to say that `$F$' is true of \emph{everything}. This therefore justifies us in inferring `$\forall y Fy$', thus:
\begin{proof}
	\hypo{x}{\forall x Fx}
	\have{a}{Fa} \Ae{x}
	\have{y}{\forall y Fy} \Ai{a}
\end{proof}
The crucial thought here is that `$a$' was just some \emph{arbitrary} name. There was nothing special about it---we might have chosen any other name---and still the proof would be fine. And this crucial thought motivates the universal introduction rule ($\forall$I):
\factoidbox{
\begin{proof}
	\have[m]{a}{\meta{A}(\ldots \meta{c} \ldots \meta{c}\ldots)}
	\have[\ ]{c}{\forall \meta{x}\meta{A}(\ldots \meta{x} \ldots \meta{x}\ldots)} \Ai{a}
\end{proof}
	\meta{c} must not occur in any undischarged assumption\\
	\meta{x} must not occur in $\meta{A}(\ldots \meta{c} \ldots \meta{c}\ldots)$}
A crucial aspect of this rule, though, is bound up in the first constraint. This constraint ensures that we are always reasoning at a sufficiently general level.\footnote{Recall from \S\ref{s:BasicTFL} that we are treating `$\ered$' as a canonical contradiction. But if it were the canonical contradiction as involving some \emph{constant}, it might interfere with the constraint mentioned here. To avoid such problems, we shall treat `$\ered$' as a canonical contradiction \emph{that involves no particular names}.} To see the constraint in action, consider this terrible argument:
	\begin{quote}
		Everyone loves Kylie Minogue; therefore everyone loves themselves.
	\end{quote}
We might symbolise this obviously invalid inference pattern as:
$$\forall x Lxk \therefore \forall x Lxx$$
Now, suppose we tried to offer a proof that vindicates this argument:
\begin{proof}
	\hypo{x}{\forall x Lxk}
	\have{a}{Lkk} \Ae{x}
	\have{y}{\forall x Lxx} \by{naughtily attempting to invoke $\forall$I}{a}
\end{proof}\noindent
This is not allowed, because `$k$' occurred already in an undischarged assumption, namely, on line 1. The crucial point is that, if we have made any assumptions about the object we are working with, then we are not reasoning generally enough to license $\forall$I.

Although the name may not occur in any \emph{undischarged} assumption, it may occur in a \emph{discharged} assumption. That is, it may occur in a subproof that we have already closed. For example, this is just fine:
\begin{proof}
	\open
		\hypo{f1}{Gd}
		\have{f2}{Gd}\by{R}{f1}
	\close
	\have{ff}{Gd \eif Gd}\ci{f1-f2}
	\have{zz}{\forall z(Gz \eif Gz)}\Ai{ff}
\end{proof}
This tells us that `$\forall z (Gz \eif Gz)$' is a \emph{theorem}. And that is as it should be.

I should emphasise one last point. As per the conventions of \S\ref{s:MainLogicalOperatorQuantifier}, the use of $\forall$I requires that we are replacing \emph{every} instance of the name \meta{c} in $\meta{A}(\ldots \meta{x}\ldots\meta{x}\ldots)$ with the variable \meta{x}. If we only replace \emph{some} names and not others, we end up `proving' silly things. For example, consider the argument:
	\begin{quote}
	Everyone is as old as themselves; so everyone is as old as Judi Dench
	\end{quote}
We might symbolise this as follows:
$$\forall x Oxx \therefore \forall x Oxd$$
But now suppose we tried to \emph{vindicate} this terrible argument with the following:
\begin{proof}
	\hypo{x}{\forall x Oxx}
	\have{a}{Odd}\Ae{x}
	\have{y}{\forall x Oxd}\by{naughtily attempting to invoke $\forall$I}{a}
\end{proof}
Fortunately, our rules do not allow for us to do this: the attempted proof is banned, since it doesn't replace \emph{every} occurrence of `$d$' in line $2$ with an `$x$'.

\section{Existential elimination}
Suppose we know that \emph{something} is F. The problem is that simply knowing this does not tell us which thing is F. So it would seem that from `$\exists x Fx$' we cannot immediately conclude `$Fa$', `$Fe_{23}$', or any other substitution instance of the sentence. What can we do?

Suppose we know that something is F, and that everything which is F is G. In (almost) natural English, we might reason thus:
	\begin{quote}
		Since something is F, there is some particular thing which is an F. We do not know anything about it, other than that it's an F, but for convenience, let's call it `obbie'. So: obbie is F. Since everything which is F is G, it follows that obbie is G. But since obbie is G, it follows that something is G. And nothing depended on which object, exactly, obbie was. So, something is G.
	\end{quote}
We might try to capture this reasoning pattern in a proof as follows:
\begin{proof}
	\hypo{es}{\exists x Fx}
	\hypo{ast}{\forall x(Fx \eif Gx)}
	\open
		\hypo{s}{Fo}
		\have{st}{Fo \eif Go}\Ae{ast}
		\have{t}{Go} \ce{st, s}
		\have{et1}{\exists x Gx}\Ei{t}
	\close
	\have{et2}{\exists x Gx}\Ee{es,s-et1}
\end{proof}\noindent
Breaking this down: we started by writing down our assumptions. At line 3, we made an additional assumption: `$Fo$'. This was just a substitution instance of `$\exists x Fx$'. On this assumption, we established `$\exists x Gx$'. But note that we had made no \emph{special} assumptions about the object named by `$o$'; we had \emph{only} assumed that it satisfies `$Fx$'. So nothing depends upon which object it is. And line 1 told us that \emph{something} satisfies `$Fx$'. So our reasoning pattern was perfectly general. We can discharge the specific assumption `$Fo$', and simply infer `$\exists x Gx$' on its own.

Putting this together, we obtain the existential elimination rule ($\exists$E):
\factoidbox{
\begin{proof}
	\have[m]{a}{\exists \meta{x}\meta{A}(\ldots \meta{x} \ldots \meta{x}\ldots)}
	\open
		\hypo[i]{b}{\meta{A}(\ldots \meta{c} \ldots \meta{c}\ldots)}
		\have[j]{c}{\meta{B}}
	\close
	\have[\ ]{d}{\meta{B}} \Ee{a,b-c}
\end{proof}
\meta{c} must not occur in any assumption undischarged before line $i$\\
\meta{c} must not occur in $\exists \meta{x}\meta{A}(\ldots \meta{x} \ldots \meta{x}\ldots)$\\
\meta{c} must not occur in \meta{B}}
As with universal introduction, the constraints are extremely important. To see why, consider the following terrible argument:
	\begin{quote}
		Tim Button is a lecturer. Someone is not a lecturer. So Tim Button is both a lecturer and not a lecturer.
	\end{quote}
We might symbolise this obviously invalid inference pattern as follows:
$$Lb, \exists x \enot Lx \therefore Lb \eand \enot Lb$$
Now, suppose we tried to offer a proof that vindicates this argument:
\begin{proof}
	\hypo{f}{Lb}
	\hypo{nf}{\exists x \enot Lx}
	\open
		\hypo{na}{\enot Lb}
		\have{con}{Lb \eand \enot Lb}\ae{f, na}
	\close
	\have{econ1}{Lb \eand \enot Lb}\by{naughtily attempting to invoke $\exists$E }{nf, na-con}
\end{proof}
The last line of the proof is not allowed. The name that we used in our substitution instance for `$\exists x \enot Lx$' on line 3, namely `$b$', occurs in line 4. And this would be no better:
\begin{proof}
	\hypo{f}{Lb}
	\hypo{nf}{\exists x \enot Lx}
	\open
		\hypo{na}{\enot Lb}
		\have{con}{Lb \eand \enot Lb}\ae{f, na}
		\have{con1}{\exists x (Lx \eand \enot Lx)}\Ei{con}
	\close
	\have{econ1}{\exists x (Lx \eand \enot Lx)}\by{naughtily attempting to invoke $\exists$E }{nf, na-con1}
\end{proof}
The last line is still not be allowed. For the name that we used in our substitution instance for `$\exists x \enot Lx$', namely `$b$', occurs in an undischarged assumption, namely line 1.

The moral of the story is this. \emph{If you want to squeeze information out of an existential quantifier, choose a new name for your substitution instance.} That way, you can guarantee that you meet all the constraints on the rule for $\exists$E.

\practiceproblems
\problempart
Explain why these two `proofs' are incorrect. Also, provide interpretations invalidate the fallacious argument forms the `proofs' enshrine:
\begin{multicols}{2}
	\begin{proof}
		\hypo{Rxx}{\forall x Rxx}
		\have{Raa}{Raa}\Ae{Rxx}
		\have{Ray}{\forall y Ray}\Ai{Raa}
		\have{Rxy}{\forall x \forall y Rxy}\Ai{Ray}
	\end{proof}
	\begin{proof}
		\hypo{AE}{\forall x \exists y Rxy}
		\have{E}{\exists y Ray}\Ae{AE}
		\open
			\hypo{ass}{Raa}
			\have{Ex}{\exists x Rxx}\Ei{ass}
		\close
		\have{con}{\exists x Rxx}\Ee{E, ass-Ex}
	\end{proof}
\end{multicols}

\problempart
\label{pr.justifyFOLproof}
The following three proofs are missing their citations (rule and line numbers). Add them, to turn them into bona fide proofs.
\begin{proof}
\hypo{p1}{\forall x\exists y(Rxy \eor Ryx)}
\hypo{p2}{\forall x\enot Rmx}
\have{3}{\exists y(Rmy \eor Rym)}{}
	\open
		\hypo{a1}{Rma \eor Ram}
		\have{a2}{\enot Rma}{}
		\have{a3}{Ram}{}
		\have{a4}{\exists x Rxm}{}
	\close
\have{n}{\exists x Rxm} {}
\end{proof}
\begin{multicols}{2}
\begin{proof}
\hypo{1}{\forall x(\exists yLxy \eif \forall zLzx)}
\hypo{2}{Lab}
\have{3}{\exists y Lay \eif \forall zLza}{}
\have{4}{\exists y Lay} {}
\have{5}{\forall z Lza} {}
\have{6}{Lca}{}
\have{7}{\exists y Lcy \eif \forall zLzc}{}
\have{8}{\exists y Lcy}{}
\have{9}{\forall z Lzc}{}
\have{10}{Lcc}{}
\have{11}{\forall x Lxx}{}
\end{proof}
\begin{proof}
\hypo{a}{\forall x(Jx \eif Kx)}
\hypo{b}{\exists x\forall y Lxy}
\hypo{c}{\forall x Jx}
\open
	\hypo{2}{\forall y Lay}
	\have{3}{Laa}{}
	\have{d}{Ja}{}
	\have{e}{Ja \eif Ka}{}
	\have{f}{Ka}{}
	\have{4}{Ka \eand Laa}{}
	\have{5}{\exists x(Kx \eand Lxx)}{}
\close
\have{j}{\exists x(Kx \eand Lxx)}{}
\end{proof}
\end{multicols}

\problempart
\label{pr.BarbaraEtc.proof1}
In \S\ref{s:MoreMonadic} problem part A, we considered fifteen syllogistic figures of Aristotelian logic. Provide proofs for each of the argument forms. NB: You will find it \emph{much} easier if you symbolise (for example) `No F is G' as `$\forall x (Fx \eif \enot Gx)$'.

\

\problempart
\label{pr.BarbaraEtc.proof2}
Aristotle and his successors identified other syllogistic forms which depended upon `existential import'. Symbolise each of these argument forms in FOL and offer proofs.
\begin{ebullet}
	\item \textbf{Barbari.} Something is H. All G are F. All H are G. So: Some H is F
	\item \textbf{Celaront.} Something is H. No G are F. All H are G. So: Some H is not F
	\item \textbf{Cesaro.} Something is H. No F are G. All H are G. So: Some H is not F.
	\item \textbf{Camestros.} Something is H. All F are G. No H are G. So: Some H is not F.
	\item \textbf{Felapton.} Something is G. No G are F. All G are H. So: Some H is not F.
	\item \textbf{Darapti.} Something is G. All G are F. All G are H. So: Some H is F.
	\item \textbf{Calemos.} Something is H. All F are G. No G are H. So: Some H is not F.
	\item \textbf{Fesapo.} Something is G. No F is G. All G are H. So: Some H is not F.
	\item \textbf{Bamalip.} Something is F. All F are G. All G are H. So: Some H are F.
\end{ebullet}

\problempart
\label{pr.someFOLproofs}
Provide a proof of each claim.
\begin{earg}
\item $\proves \forall x Fx \eor \enot \forall x Fx$
\item $\proves\forall z (Pz \eor \enot Pz)$
\item $\forall x(Ax\eif Bx), \exists x Ax \proves \exists x Bx$
\item $\forall x(Mx \eiff Nx), Ma\eand\exists x Rxa\proves \exists x Nx$
\item $\forall x \forall y Gxy\proves\exists x Gxx$
\item $\proves\forall x Rxx\eif \exists x \exists y Rxy$
\item $\proves\forall y \exists x (Qy \eif Qx)$
\item $Na \eif \forall x(Mx \eiff Ma), Ma, \enot Mb\proves \enot Na$
\item $\forall x \forall y (Gxy \eif Gyx) \proves \forall x\forall y (Gxy \eiff Gyx)$
\item $\forall x(\enot Mx \eor Ljx), \forall x(Bx\eif Ljx), \forall x(Mx\eor Bx)\proves \forall xLjx$
\end{earg}

\problempart
\label{pr.likes}
Write a symbolisation key for the following argument, symbolise it, and prove it:
\begin{quote}
There is someone who likes everyone who likes everyone that she likes. Therefore, there is someone who likes herself.
\end{quote}

\problempart
\label{pr.FOLequivornot}
For each of the following pairs of sentences: If they are provably equivalent, give proofs to show this. If they are not, construct an interpretation to show that they are not logically equivalent.
\begin{earg}
\item $\forall x Px \eif Qc, \forall x (Px \eif Qc)$
\item $\forall x\forall y \forall z Bxyz, \forall x Bxxx$
\item $\forall x\forall y Dxy, \forall y\forall x Dxy$
\item $\exists x\forall y Dxy, \forall y\exists x Dxy$
\item $\forall x (Rca \eiff Rxa), Rca \eiff \forall x Rxa$
\end{earg}

\problempart
\label{pr.FOLvalidornot}
For each of the following arguments: If it is valid in FOL, give a proof. If it is invalid, construct an interpretation to show that it is invalid.
\begin{earg}
\item $\exists y\forall x Rxy \therefore \forall x\exists y Rxy$
\item $\exists x(Px \eand \enot Qx) \therefore \forall x(Px \eif \enot Qx)$
\item $\forall x(Sx \eif Ta), Sd \therefore Ta$
\item $\forall x(Ax\eif Bx), \forall x(Bx \eif Cx) \therefore \forall x(Ax \eif Cx)$
\item $\exists x(Dx \eor Ex), \forall x(Dx \eif Fx) \therefore \exists x(Dx \eand Fx)$
\item $\forall x\forall y(Rxy \eor Ryx) \therefore Rjj$
\item $\exists x\exists y(Rxy \eor Ryx) \therefore Rjj$
\item $\forall x Px \eif \forall x Qx, \exists x \enot Px \therefore \exists x \enot Qx$
\end{earg}

\chapter{Conversion of quantifiers}\label{s:CQ}

In this section, we shall add some additional rules to the basic rules of the previous section. These govern the interaction of quantifiers and negation.

In \S\ref{s:FOLBuildingBlocks}, we noted that $\enot\exists x\meta{A}$ is logically equivalent to $\forall x \enot\meta{A}$. We shall add some rules to our proof system that govern this. In particular, we add:
	\factoidbox{
	\begin{proof}
		\have[m]{a}{\forall \meta{x} \enot\meta{A}}
		\have[\ ]{con}{\enot \exists \meta{x} \meta{A}}\cq{a}
	\end{proof}}
and
\factoidbox{
	\begin{proof}
		\have[m]{a}{ \enot \exists \meta{x} \meta{A}}
		\have[\ ]{con}{\forall  \meta{x} \enot \meta{A}}\cq{a}
	\end{proof}}
Equally, we add:
\factoidbox{
	\begin{proof}
		\have[m]{a}{\exists \meta{x}\enot \meta{A}}
		\have[\ ]{con}{\enot \forall \meta{x} \meta{A}}\cq{a}
	\end{proof}}
and
\factoidbox{
	\begin{proof}
		\have[m]{a}{\enot \forall \meta{x} \meta{A}}
		\have[\ ]{con}{\exists \meta{x} \enot \meta{A}}\cq{a}
	\end{proof}}

\practiceproblems

\problempart
Show that the following are jointly contrary:
\begin{earg}
\item $Sa\eif Tm, Tm \eif Sa, Tm \eand \enot Sa$
\item $\enot\exists x Rxa, \forall x \forall y Ryx$
\item $\enot\exists x \exists y Lxy, Laa$
\item $\forall x(Px \eif Qx), \forall z(Pz \eif Rz), \forall y Py, \enot Qa \eand \enot Rb$
\end{earg}

\problempart
Show that each pair of sentences is provably equivalent:
\begin{earg}
\item $\forall x (Ax\eif \enot Bx), \enot\exists x(Ax \eand Bx)$
\item $\forall x (\enot Ax\eif Bd), \forall x Ax \eor Bd$
\end{earg}

\problempart
In \S\ref{s:MoreMonadic}, I considered what happens when we move quantifiers `across' various logical operators. Show that each pair of sentences is provably equivalent:
\begin{earg}
\item $\forall x (Fx \eand Ga), \forall x Fx \eand Ga$
\item $\exists x (Fx \eor Ga), \exists x Fx \eor Ga$
\item $\forall x(Ga \eif Fx), Ga \eif \forall x Fx$
\item $\forall x(Fx \eif Ga), \exists x Fx \eif Ga$
\item $\exists x(Ga \eif Fx), Ga \eif \exists x Fx$
\item $\exists x(Fx \eif Ga), \forall x Fx \eif Ga$
\end{earg}
NB: the variable `$x$' does not occur in `$Ga$'. When all the quantifiers occur at the beginning of a sentence, that sentence is said to be in \emph{prenex normal form}. These equivalences are sometimes called \emph{prenexing rules}, since they give us a means for putting any sentence into prenex normal form.

\chapter{Rules for identity}
In \S\ref{s:Interpretations}, I mentioned the philosophically contentious thesis of the \emph{identity of indiscernibles}. This is the claim that objects which are indiscernible in every way are, in fact, identical to each other. I also mentioned that we will not subscribe to this thesis. It follows that, no matter how much you tell me about two objects, I cannot prove that they are identical. Unless, of course, you tell me that the two objects are, in fact, identical. But then the proof will hardly be very illuminating.

The general point, though, is that \emph{no sentences} which do not already contain the identity predicate could justify an inference to `$a=b$'. So our identity introduction rule cannot allow us to infer to an identity claim containing two \emph{different} names.

However, every object is identical to itself. No premises, then, are required in order to conclude that something is identical to itself. So this will be the identity introduction rule:
\factoidbox{
\begin{proof}
	\have[\ \,\,\,]{x}{\meta{c}=\meta{c}} \by{=I}{}
\end{proof}}
Notice that this rule does not require referring to any prior lines of the proof. For any name \meta{c}, you can write $\meta{c}=\meta{c}$ on any point, with only the {=}I rule as justification.

Our elimination rule is more fun. If you have established `$a=b$', then anything that is true of the object named by `$a$' must also be true of the object named by `$b$'. For any sentence with `$a$' in it, you can replace some or all of the occurrences of `$a$' with `$b$' and produce an equivalent sentence. For example, from `$Raa$' and `$a = b$', you are justified in inferring `$Rab$', `$Rba$' or `$Rbb$'. More generally:
\factoidbox{\begin{proof}
	\have[m]{e}{\meta{a}=\meta{b}}
	\have[n]{a}{\meta{A}(\ldots \meta{a} \ldots \meta{a}\ldots)}
	\have[\ ]{ea1}{\meta{A}(\ldots \meta{b} \ldots \meta{a}\ldots)} \by{=E}{e,a}
\end{proof}}
The notation here is as for $\exists$I. So $\meta{A}(\ldots \meta{a} \ldots \meta{a}\ldots)$ is a formula containing the name $\meta{a}$, and $\meta{A}(\ldots \meta{b} \ldots \meta{a}\ldots)$ is a formula obtained by replacing one or more instances of the name $\meta{a}$ with the name $\meta{b}$. Lines $m$ and $n$ can occur in either order, and do not need to be adjacent, but we always cite the statement of identity first. Symmetrically, we allow:
\factoidbox{\begin{proof}
	\have[m]{e}{\meta{a}=\meta{b}}
	\have[n]{a}{\meta{A}(\ldots \meta{b} \ldots \meta{b}\ldots)}
	\have[\ ]{ea2}{\meta{A}(\ldots \meta{a} \ldots \meta{b}\ldots)} \by{=E}{e,a}
\end{proof}}
This rule is sometimes called \emph{Leibniz's Law}, after Gottfried Leibniz.

To see the rules in action, we shall prove some quick results. First, we shall prove that identity is \emph{symmetric}:
\begin{proof}
	\open
		\hypo{ab}{a = b}
		\have{aa}{a = a}\by{=I}{}
		\have{ba}{b = a}\by{=E}{ab, aa}
	\close
	\have{abba}{a = b \eif b =a}\ci{ab-ba}
	\have{ayya}{\forall y (a = y \eif y = a)}\Ai{abba}
	\have{xyyx}{\forall x \forall y (x = y \eif y = x)}\Ai{ayya}
\end{proof}
We obtain line 3 by replacing one instance of `$a$' in line 2 with an instance of `$b$'; this is justified given `$a= b$'.

Second, we shall prove that identity is \emph{transitive}:
\begin{proof}
	\open
		\hypo{abc}{a = b \eand b = c}
		\have{ab}{a = b}\ae{abc}
		\have{bc}{b = c}\ae{abc}
		\have{ac}{a = c}\by{=E}{ab, bc}
	\close
	\have{con}{(a = b \eand b =c) \eif a = c}\ci{abc-ac}
	\have{conz}{\forall z((a = b \eand b = z) \eif a = z)}\Ai{con}
	\have{cony}{\forall y\forall z((a = y \eand y = z) \eif a = z)}\Ai{conz}
	\have{conx}{\forall x \forall y \forall z((x = y \eand y = z) \eif x = z)}\Ai{cony}
\end{proof}
We obtain line 4 by replacing `$b$' in line 3 with `$a$'; this is justified given `$a= b$'.

\practiceproblems
\problempart
\label{pr.identity}
Provide a proof of each claim.
\begin{earg}
\item $Pa \eor Qb, Qb \eif b=c, \enot Pa \proves Qc$
\item $m=n \eor n=o, An \proves Am \eor Ao$
\item $\forall x\ x=m, Rma\proves \exists x Rxx$
\item $\forall x\forall y(Rxy \eif x=y)\proves Rab \eif Rba$
\item $\enot \exists x\enot x = m \proves \forall x\forall y (Px \eif Py)$
\item $\exists x Jx, \exists x \enot Jx\proves \exists x \exists y\ \enot x = y$
\item $\forall x(x=n \eiff Mx), \forall x(Ox \eor \enot Mx)\proves On$
\item $\exists x Dx, \forall x(x=p \eiff Dx)\proves Dp$
\item $\exists x\bigl[(Kx \eand \forall y(Ky \eif x=y)) \eand Bx\bigr], Kd\proves Bd$
\item $\proves Pa \eif \forall x(Px \eor \enot x = a)$
\end{earg}

\problempart
Show that the following are provably equivalent:
\begin{ebullet}
\item $\exists x \bigl([Fx \eand \forall y (Fy \eif x = y)] \eand x = n\bigr)$
\item $Fn \eand \forall y (Fy \eif n= y)$
\end{ebullet}
And hence that both have a decent claim to symbolise the English sentence `Nick is the F'.

\

\problempart
In \S\ref{sec.identity}, I claimed that the following are logically equivalent symbolisations of the English sentence `there is exactly one F':
\begin{ebullet}
\item $\exists x Fx \eand \forall x \forall y \bigl[(Fx \eand Fy) \eif x = y\bigr]$
\item $\exists x \bigl[Fx \eand \forall y (Fy \eif x = y)\bigr]$
\item $\exists x \forall y (Fy \eiff x = y)$
\end{ebullet}
Show that they are all provably equivalent. (\emph{Hint}: to show that three claims are provably equivalent, it suffices to show that the first proves the second, the second proves the third and the third proves the first; think about why.)

\
\problempart
Symbolise the following argument
	\begin{quote}
		There is exactly one F. There is exactly one G. Nothing is both F and G. So: there are exactly two things that are either F or G.
	\end{quote}
And offer a proof of it.
%\begin{ebullet}
%\item  $\exists x \bigl[Fx \eand \forall y (Fy \eif x = y)\bigr], \exists x \bigl[Gx \eand \forall y ( Gy \eif x = y)\bigr], \forall x (\enot Fx \eor \enot Gx) \proves \exists x \exists y \bigl[\enot x = y \eand \forall z ((Fz \eor Gz) \eif (x = y \eor x = z))\bigr]$
%\end{ebullet}

\chapter{Derived rules}\label{s:DerivedFOL}
As in the case of TFL, I first introduced some rules for FOL as basic (in \S\ref{s:BasicFOL}), and then added some further rules for conversion of quantifiers (in \S\ref{s:CQ}). In fact, the CQ rules should be regarded as \emph{derived} rules, for they can be derived from the  \emph{basic} rules of \S\ref{s:BasicFOL}. (The point here is as in \S\ref{s:Derived}.) Here is a justification for the first CQ rule:
\begin{proof}
	\hypo[m]{An}{\forall x \enot A x}
	\open
		\hypo[k]{E}{\exists x Ax}
		\open
			\hypo{c}{Ac}%\by{for $\exists$E}{}
			\have{nc}{\enot Ac}\Ae{An}
			\have{red}{\ered}\ri{c,nc}
		\close
		\have{red2}{\ered}\Ee{E,c-red}
	\close
	\have{dada}{\enot \exists x Ax}\ni{E-red2}
\end{proof}
%You will note that on line 3 I have written `for $\exists$E'. This is not technically a part of the proof. It is just a reminder---to me and to you---of why I have bothered to introduce `$\enot Ac$' out of the blue. You might find it helpful to add similar annotations to assumptions when performing proofs. But do not add annotations on lines other than assumptions: the proof requires its own citation, and your annotations will clutter it.
Here is a justification of the second CQ rule:
\begin{proof}
	\hypo[m]{nEna}{\exists x  \enot Ax}
	\open
		\hypo[k]{Aa}{\forall x Ax}
		\open
			\hypo{nac}{\enot Ac}%\by{for $\exists$E}{}
			\have{a}{Ac}\Ae{Aa}
			\have{con}{\ered}\ri{a,nac}
		\close
		\have{con1}{\ered}\Ee{nEna, nac-con}
	\close
	\have{dada}{\enot \forall x Ax}\ni{Aa-con1}
\end{proof}
This explains why the CQ rules can be treated as derived. Similar justifications can be offered for the other two CQ rules.

\practiceproblems

\problempart
Offer proofs which justify the addition of the third and fourth CQ rules as derived rules.

\chapter{Proof-theoretic concepts and semantic concepts}
We have used two different turnstiles in this book.  This:
$$\meta{A}_1, \meta{A}_2, \ldots, \meta{A}_n \proves \meta{C}$$
means that there is some proof which ends with $\meta{C}$ and whose only undischarged assumptions are among $\meta{A}_1, \meta{A}_2, \ldots, \meta{A}_n$. This is a \emph{proof-theoretic notion}. By contrast, this:
$$\meta{A}_1, \meta{A}_2, \ldots, \meta{A}_n \entails \meta{C}$$
means that  no valuation (or interpretation) makes all of $\meta{A}_1, \meta{A}_2, \ldots, \meta{A}_n$ true and $\meta{C}$ false. This concerns assignments of truth and falsity to sentences. It is a \emph{semantic notion}.

I cannot emphasise enough that these are different notions. But I can emphasise it a bit more: \emph{They are different notions.}

At the risk of repetition:  \emph{They are different notions.}

Once you have fully internalised this point, continue reading.

Although our semantic and proof-theoretic notions are different, there is a deep connection between them. To explain this connection, I shall start by considering the relationship between logical truths and theorems.

To show that a sentence is a theorem, you need only perform a proof. Granted, it may be hard to produce a twenty line proof, but it is not so hard to check each line of the proof and confirm that it is legitimate; and if each line of the proof individually is legitimate, then the whole proof is legitimate. Showing that a sentence is a logical truth, though, requires reasoning about all possible interpretations. Given a choice between showing that a sentence is a theorem and showing that it is a logical truth, it would be easier to show that it is a theorem.

Contrawise, to show that a sentence is \emph{not} a theorem is hard. We would need to reason about all (possible) proofs. That is very difficult. But to show that a sentence is not a logical truth, you need only construct an interpretation in which the sentence is false. Granted, it may be hard to come up with the interpretation; but once you have done so, it is relatively straightforward to check what truth value it assigns to a sentence. Given a choice between showing that a sentence is not a theorem and showing that it is not a logical truth, it would be easier to show that it is not a logical truth.

Fortunately, \emph{a sentence is a theorem if and only if it is a logical truth}. As a result, if we provide a proof of $\meta{A}$ on no assumptions, and thus show that $\meta{A}$ is a theorem, i.e.\ ${}\proves \meta{A}$, we can legitimately infer that $\meta{A}$ is a logical truth, i.e., $\entails\meta{A}$. Similarly, if we construct a model in which \meta{A} is false and thus show that it is not a logical truth, i.e.\ $\nentails \meta{A}$, it follows that \meta{A} is not a theorem, i.e.\  $\nproves \meta{A}$.

More generally, we have the following powerful result:
$$\meta{A}_1, \meta{A}_2, \ldots, \meta{A}_n \proves\meta{B} \textbf{ iff }\meta{A}_1, \meta{A}_2, \ldots, \meta{A}_n \entails\meta{B}$$
This shows that, whilst provability and entailment are \emph{different} notions, they are extensionally equivalent. As such:
	\begin{ebullet}
		\item An argument is \emph{valid} iff \emph{the conclusion can be proved from the premises}.
		\item Two sentences are \emph{logically equivalent} iff they are \emph{provably equivalent}.
		\item Sentences are \emph{jointly consistent} iff they are \emph{not jointly contrary}.
	\end{ebullet}
For this reason, you can pick and choose when to think in terms of proofs and when to think in terms of valuations/interpretations, doing whichever is easier for a given task. The table on the next page summarises which is (usually) easier.

It is intuitive that provability and semantic entailment should agree. But---let me repeat this---do not be fooled by the similarity of the symbols `$\entails$' and `$\proves$'. These two symbols have very different meanings. And the fact that provability and semantic entailment agree is not an easy result to come by.

In fact, demonstrating that provability and semantic entailment agree is, very decisively, the point at which introductory logic becomes intermediary logic. Agreement, in the case of TFL, is covered in a little sequel to this book, \texttt{Metatheory}. Agreement, in the case of FOL, is one of the first big results in mathematical logic.

\begin{sidewaystable}
\begin{center}
\begin{tabular*}{\textwidth}{p{.25\textheight}p{.325\textheight}p{.325\textheight}}
 & \textbf{Yes}  & \textbf{No}\\
\\
Is \meta{A} a \textbf{logical truth}?
& give a proof which shows $\proves\meta{A}$
& give an interpretation in which \meta{A} is false\\
\\
Is \meta{A} a \textbf{contradiction}? &
give a proof which shows $\proves\enot\meta{A}$ &
give an interpretation in which \meta{A} is true\\
\\
%Is \meta{A} contingent? &
%give two interpretations, one in which \meta{A} is true and another in which \meta{A} is false & give a proof which either shows $\proves\meta{A}$ or $\proves\enot\meta{A}$\\
%\\
Are \meta{A} and \meta{B} \textbf{equivalent}? &
give two proofs, one for $\meta{A}\proves\meta{B}$ and one for $\meta{B}\proves\meta{A}$
& give an interpretation in which \meta{A} and \meta{B} have different truth values\\
\\
Are $\meta{A}_1, \meta{A}_2, \ldots, \meta{A}_n$ \textbf{jointly consistent}?
& give an interpretation in which all of $\meta{A}_1, \meta{A}_2, \ldots, \meta{A}_n$ are true
& prove a contradiction from assumptions $\meta{A}_1, \meta{A}_2, \ldots, \meta{A}_n$\\
\\
Is $\meta{A}_1, \meta{A}_2, \ldots, \meta{A}_n \therefore \meta{C}$ \textbf{valid}?
& give a proof with assumptions $\meta{A}_1, \meta{A}_2, \ldots, \meta{A}_n$ and concluding with \meta{C}
& give an interpretation in which each of $\meta{A}_1, \meta{A}_2, \ldots, \meta{A}_n$ is true and \meta{C} is false\\
\end{tabular*}
\end{center}
\end{sidewaystable}


\section{OFE and COFE Constructions}

\subsection{Trivial Pointwise Lifting}

The (C)OFE structure on many types can be easily obtained by pointwise lifting of the structure of the components.
This is what we do for option $\maybe\cofe$, product $(M_i)_{i \in I}$ (with $I$ some finite index set), sum $\cofe + \cofe'$ and finite partial functions $K \fpfn \monoid$ (with $K$ infinite countable).

\subsection{Next (Type-Level Later)}

Given a OFE $\cofe$, we define $\latert\cofe$ as follows (using a datatype-like notation to define the type):
\begin{align*}
  \latert\cofe \eqdef{}& \latertinj(x:\cofe) \\
  \latertinj(x) \nequiv{n} \latertinj(y) \eqdef{}& n = 0 \lor x \nequiv{n-1} y
\end{align*}
Note that in the definition of the carrier $\latert\cofe$, $\latertinj$ is a constructor (like the constructors in Coq), \ie this is short for $\setComp{\latertinj(x)}{x \in \cofe}$.

$\latert(-)$ is a locally \emph{contractive} functor from $\OFEs$ to $\OFEs$.

\subsection{Uniform Predicates}

Given a camera $\monoid$, we define the COFE $\UPred(\monoid)$ of \emph{uniform predicates} over $\monoid$ as follows:
\begin{align*}
\monoid \monnra \SProp \eqdef{}& \setComp{\pred: \monoid \nfn \SProp}
{\All n, \melt, \meltB. \melt \mincl[n] \meltB \Ra \pred(\melt) \nincl{n} \pred(\meltB)} \\
  \UPred(\monoid) \eqdef{}&  \faktor{\monoid \monnra \SProp}{\equiv} \\
  \pred \equiv \predB \eqdef{}& \All m, \melt. m \in \mval(\melt) \Ra (m \in \pred(\melt) \iff  m \in \predB(\melt)) \\
  \pred \nequiv{n} \predB \eqdef{}& \All m \le n, \melt. m \in \mval(\melt) \Ra (m \in \pred(\melt) \iff  m \in \predB(\melt))
\end{align*}
You can think of uniform predicates as monotone, step-indexed predicates over a camera that ``ignore'' invalid elements (as defined by the quotient).

$\UPred(-)$ is a locally non-expansive functor from $\CMRAs$ to $\COFEs$.

It is worth noting that the above quotient admits canonical
representatives. More precisely, one can show that every
equivalence class contains exactly one element $P_0$ such that:
\begin{align*}
  \All n, \melt.  (\mval(\melt) \nincl{n} P_0(\melt)) \Ra n \in P_0(\melt)  \tagH{UPred-canonical}
\end{align*}
Intuitively, this says that $P_0$ trivially holds whenever the resource is invalid.
Starting from any element $P$, one can find this canonical
representative by choosing $P_0(\melt) := \setComp{n}{n \in \mval(\melt) \Ra n \in P(\melt)}$.

Hence, as an alternative definition of $\UPred$, we could use the set
of canonical representatives. This alternative definition would
save us from using a quotient. However, the definitions of the various
connectives would get more complicated, because we have to make sure
they all verify \ruleref{UPred-canonical}, which sometimes requires some adjustments. We
would moreover need to prove one more property for every logical
connective.

\clearpage
\section{RA and Camera Constructions}

\subsection{Product}
\label{sec:prodm}

Given a family $(M_i)_{i \in I}$ of cameras ($I$ finite), we construct a camera for the product $\prod_{i \in I} M_i$ by lifting everything pointwise.

Frame-preserving updates on the $M_i$ lift to the product:
\begin{mathpar}
  \inferH{prod-update}
  {\melt \mupd_{M_i} \meltsB}
  {\mapinsert i \melt f \mupd \setComp{ \mapinsert i \meltB f}{\meltB \in \meltsB}}
\end{mathpar}

\subsection{Sum}
\label{sec:summ}

The \emph{sum camera} $\monoid_1 \csumm \monoid_2$ for any cameras $\monoid_1$ and $\monoid_2$ is defined as (again, we use a datatype-like notation):
\begin{align*}
  \monoid_1 \csumm \monoid_2 \eqdef{}& \cinl(\melt_1:\monoid_1) \mid \cinr(\melt_2:\monoid_2) \mid \mundef \\
  \mval(\mundef) \eqdef{}& \emptyset \\
  \mval(\cinl(\melt)) \eqdef{}& \mval_1(\melt)  \\
  \cinl(\melt_1) \mtimes \cinl(\meltB_1) \eqdef{}& \cinl(\melt_1 \mtimes \meltB_1)  \\
%  \munit \mtimes \ospending \eqdef{}& \ospending \mtimes \munit \eqdef \ospending \\
%  \munit \mtimes \osshot(\melt) \eqdef{}& \osshot(\melt) \mtimes \munit \eqdef \osshot(\melt) \\
  \mcore{\cinl(\melt_1)} \eqdef{}& \begin{cases}\mnocore & \text{if $\mcore{\melt_1} = \mnocore$} \\ \cinl({\mcore{\melt_1}}) & \text{otherwise} \end{cases}
\end{align*}
Above, $\mval_1$ refers to the validity of $\monoid_1$.
The validity, composition and core for $\cinr$ are defined symmetrically.
The remaining cases of the composition and core are all $\mundef$.

Notice that we added the artificial ``invalid'' (or ``undefined'') element $\mundef$ to this camera just in order to make certain compositions of elements (in this case, $\cinl$ and $\cinr$) invalid.

The step-indexed equivalence is inductively defined as follows:
\begin{mathpar}
  \infer{x \nequiv{n} y}{\cinl(x) \nequiv{n} \cinl(y)}

  \infer{x \nequiv{n} y}{\cinr(x) \nequiv{n} \cinr(y)}

  \axiom{\mundef \nequiv{n} \mundef}
\end{mathpar}

We obtain the following frame-preserving updates, as well as their symmetric counterparts:
\begin{mathpar}
  \inferH{sum-update}
  {\melt \mupd_{M_1} \meltsB}
  {\cinl(\melt) \mupd \setComp{ \cinl(\meltB)}{\meltB \in \meltsB}}

  \inferH{sum-swap}
  {\All \melt_\f \in M, n. n  \notin \mval(\melt \mtimes \melt_\f) \and \mvalFull(\meltB)}
  {\cinl(\melt) \mupd \cinr(\meltB)}
\end{mathpar}
Crucially, the second rule allows us to \emph{swap} the ``side'' of the sum that the camera is on if $\mval$ has \emph{no possible frame}.

\subsection{Option}

The definition of the camera/RA axioms already lifted the composition operation on $\monoid$ to one on $\maybe\monoid$.
We can easily extend this to a full camera by defining a suitable core, namely
\begin{align*}
  \mcore{\mnocore} \eqdef{}& \mnocore & \\
  \mcore{\maybe\melt} \eqdef{}& \mcore\melt & \text{If $\maybe\melt \neq \mnocore$}
\end{align*}
Notice that this core is total, as the result always lies in $\maybe\monoid$ (rather than in $\maybe{\mathord{\maybe\monoid}}$).

\subsection{Finite Partial Functions}
\label{sec:fpfnm}

Given some infinite countable $K$ and some camera $\monoid$, the set of finite partial functions $K \fpfn \monoid$ is equipped with a camera structure by lifting everything pointwise.

We obtain the following frame-preserving updates:
\begin{mathpar}
  \inferH{fpfn-alloc-strong}
  {\text{$G$ infinite} \and \mvalFull(\melt)}
  {\emptyset \mupd \setComp{\mapsingleton \gname \melt}{\gname \in G}}

  \inferH{fpfn-alloc}
  {\mvalFull(\melt)}
  {\emptyset \mupd \setComp{\mapsingleton \gname \melt}{\gname \in K}}

  \inferH{fpfn-update}
  {\melt \mupd_\monoid \meltsB}
  {\mapinsert i \melt f] \mupd \setComp{ \mapinsert i \meltB f}{\meltB \in \meltsB}}
\end{mathpar}
Above, $\mvalFull$ refers to the (full) validity of $\monoid$.

$K \fpfn (-)$ is a locally non-expansive functor from $\CMRAs$ to $\CMRAs$.

\subsection{Agreement}

Given some OFE $\cofe$, we define the camera $\agm(\cofe)$ as follows:
\begin{align*}
  \agm(\cofe) \eqdef{}& \setComp{\melt \in \finpset\cofe}{\melt \neq \emptyset} /\ {\sim} \\[-0.2em]
  \melt \nequiv{n} \meltB \eqdef{}& (\All x \in \melt. \Exists y \in \meltB. x \nequiv{n} y) \land (\All y \in \meltB. \Exists x \in \melt. x \nequiv{n} y) \\
  \textnormal{where }& \melt \sim \meltB \eqdef{} \All n. \melt \nequiv{n} \meltB  \\
~\\
%    \All n \in {\melt.V}.\, \melt.x \nequiv{n} \meltB.x \\
  \mval(\melt) \eqdef{}& \setComp{n}{ \All x, y \in \melt. x \nequiv{n} y } \\
  \mcore\melt \eqdef{}& \melt \\
  \melt \mtimes \meltB \eqdef{}& \melt \cup \meltB
\end{align*}
%Note that the carrier $\agm(\cofe)$ is a \emph{record} consisting of the two fields $c$ and $V$.

$\agm(-)$ is a locally non-expansive functor from $\OFEs$ to $\CMRAs$.

We define a non-expansive injection $\aginj$ into $\agm(\cofe)$ as follows:
\[ \aginj(x) \eqdef \set{x} \]
There are no interesting frame-preserving updates for $\agm(\cofe)$, but we can show the following:
\begin{mathpar}
  \axiomH{ag-val}{\mvalFull(\aginj(x))}

  \axiomH{ag-dup}{\aginj(x) = \aginj(x)\mtimes\aginj(x)}

  \axiomH{ag-agree}{n \in \mval(\aginj(x) \mtimes \aginj(y)) \Ra x \nequiv{n} y}
\end{mathpar}

\subsection{Exclusive Camera}

Given an OFE $\cofe$, we define a camera $\exm(\cofe)$ such that at most one $x \in \cofe$ can be owned:
\begin{align*}
  \exm(\cofe) \eqdef{}& \exinj(\cofe) \mid \mundef \\
  \mval(\melt) \eqdef{}& \setComp{n}{\melt \notnequiv{n} \mundef}
\end{align*}
All cases of composition go to $\mundef$.
\begin{align*}
  \mcore{\exinj(x)} \eqdef{}& \mnocore &
  \mcore{\mundef} \eqdef{}& \mundef
\end{align*}
Remember that $\mnocore$ is the ``dummy'' element in $\maybe\monoid$ indicating (in this case) that $\exinj(x)$ has no core.

The step-indexed equivalence is inductively defined as follows:
\begin{mathpar}
  \infer{x \nequiv{n} y}{\exinj(x) \nequiv{n} \exinj(y)}

  \axiom{\mundef \nequiv{n} \mundef}
\end{mathpar}
$\exm(-)$ is a locally non-expansive functor from $\OFEs$ to $\CMRAs$.

We obtain the following frame-preserving update:
\begin{mathpar}
  \inferH{ex-update}{}
  {\exinj(x) \mupd \exinj(y)}
\end{mathpar}

\subsection{Fractions}

We define an RA structure on the rational numbers in $(0, 1]$ as follows:
\begin{align*}
  \fracm \eqdef{}& \fracinj(\mathbb{Q} \cap (0, 1]) \mid \mundef \\
  \mvalFull(\melt) \eqdef{}& \melt \neq \mundef \\
  \fracinj(q_1) \mtimes \fracinj(q_2) \eqdef{}& \fracinj(q_1 + q_2) \quad \text{if $q_1 + q_2 \leq 1$} \\
  \mcore{\fracinj(x)} \eqdef{}& \bot \\
  \mcore{\mundef} \eqdef{}& \mundef
\end{align*}
All remaining cases of composition go to $\mundef$.
Frequently, we will write just $x$ instead of $\fracinj(x)$.

The most important property of this RA is that $1$ has no frame.
This is useful in combination with \ruleref{sum-swap}, and also when used with pairs:
\begin{mathpar}
  \inferH{pair-frac-change}{}
  {(1, a) \mupd (1, b)}
\end{mathpar}

%TODO: These need syncing with Coq
% \subsection{Finite Powerset Monoid}

% Given an infinite set $X$, we define a monoid $\textmon{PowFin}$ with carrier $\mathcal{P}^{\textrm{fin}}(X)$ as follows:
% \[
% \melt \cdot \meltB \;\eqdef\; \melt \cup \meltB \quad \mbox{if } \melt \cap \meltB = \emptyset
% \]

% We obtain:
% \begin{mathpar}
% 	\inferH{PowFinUpd}{}
% 		{\emptyset \mupd \{ \{x\} \mid x \in X  \}}
% \end{mathpar}

% \begin{proof}[Proof of \ruleref{PowFinUpd}]
% 	Assume some frame $\melt_\f \sep \emptyset$. Since $\melt_\f$ is finite and $X$ is infinite, there exists an $x \notin \melt_\f$.
% 	Pick that for the result.
% \end{proof}

% The powerset monoids is cancellative.
% \begin{proof}[Proof of cancellativity]
% 	Let $\melt_\f \mtimes \melt = \melt_\f \mtimes \meltB \neq \mzero$.
% 	So we have $\melt_\f \sep \melt$ and $\melt_\f \sep \meltB$, and we have to show $\melt = \meltB$.
% 	Assume $x \in \melt$. Hence $x \in \melt_\f \mtimes \melt$ and thus $x \in \melt_\f \mtimes \meltB$.
% 	By disjointness, $x \notin \melt_\f$ and hence $x \in meltB$.
% 	The other direction works the same way.
% \end{proof}

\subsection{Authoritative}
\label{sec:auth-camera}

Given a camera $M$, we construct $\authm(M)$ modeling someone owning an \emph{authoritative} element $\melt$ of $M$, and others potentially owning fragments $\meltB \mincl \melt$ of $\melt$.
We assume that $M$ has a unit $\munit$, and hence its core is total.
(If $M$ is an exclusive monoid, the construction is very similar to a half-ownership monoid with two asymmetric halves.)
\begin{align*}
\authm(M) \eqdef{}& \maybe{\exm(M)} \times M \\
\mval( (x, \meltB ) ) \eqdef{}& \setComp{ n }{ (x = \mnocore \land n \in \mval(\meltB)) \lor (\Exists \melt. x = \exinj(\melt) \land \meltB \mincl_n \melt \land n \in \mval(\melt)) } \\
  (x_1, \meltB_1) \mtimes (x_2, \meltB_2) \eqdef{}& (x_1 \mtimes x_2, \meltB_2 \mtimes \meltB_2) \\
  \mcore{(x, \meltB)} \eqdef{}& (\mnocore, \mcore\meltB) \\
  (x_1, \meltB_1) \nequiv{n} (x_2, \meltB_2) \eqdef{}& x_1 \nequiv{n} x_2 \land \meltB_1 \nequiv{n} \meltB_2
\end{align*}
Note that $(\mnocore, \munit)$ is the unit and asserts no ownership whatsoever, but $(\exinj(\munit), \munit)$ asserts that the authoritative element is $\munit$.

Let $\melt, \meltB \in M$.
We write $\authfull \melt$ for full ownership $(\exinj(\melt), \munit)$ and $\authfrag \meltB$ for fragmental ownership $(\mnocore, \meltB)$ and $\authfull \melt , \authfrag \meltB$ for combined ownership $(\exinj(\melt), \meltB)$.

The frame-preserving update involves the notion of a \emph{local update}:
\newcommand\lupd{\stackrel{\mathrm l}{\mupd}}
\begin{defn}
  It is possible to do a \emph{local update} from $\melt_1$ and $\meltB_1$ to $\melt_2$ and $\meltB_2$, written $(\melt_1, \meltB_1) \lupd (\melt_2, \meltB_2)$, if
  \[ \All n, \maybe{\melt_\f}. n \in \mval(\melt_1) \land \melt_1 \nequiv{n} \meltB_1 \mtimes \maybe{\melt_\f} \Ra n \in \mval(\melt_2) \land \melt_2 \nequiv{n} \meltB_2 \mtimes \maybe{\melt_\f} \]
\end{defn}
In other words, the idea is that for every possible frame $\maybe{\melt_\f}$ completing $\meltB_1$ to $\melt_1$, the same frame also completes $\meltB_2$ to $\melt_2$.

We then obtain
\begin{mathpar}
  \inferH{auth-update}
  {(\melt_1, \meltB_1) \lupd (\melt_2, \meltB_2)}
  {\authfull \melt_1 , \authfrag \meltB_1 \mupd \authfull \melt_2 , \authfrag \meltB_2}
\end{mathpar}

\subsection{STS with Tokens}
\label{sec:sts-camera}

Given a state-transition system~(STS, \ie a directed graph) $(\STSS, {\stsstep} \subseteq \STSS \times \STSS)$, a set of tokens $\STST$, and a labeling $\STSL: \STSS \ra \wp(\STST)$ of \emph{protocol-owned} tokens for each state, we construct an RA modeling an authoritative current state and permitting transitions given a \emph{bound} on the current state and a set of \emph{locally-owned} tokens.

The construction follows the idea of STSs as described in CaReSL \cite{caresl}.
We first lift the transition relation to $\STSS \times \wp(\STST)$ (implementing a \emph{law of token conservation}) and define a stepping relation for the \emph{frame} of a given token set:
\begin{align*}
 (s, T) \stsstep (s', T') \eqdef{}& s \stsstep s' \land \STSL(s) \uplus T = \STSL(s') \uplus T' \\
 s \stsfstep{T} s' \eqdef{}& \Exists T_1, T_2. T_1 \disj \STSL(s) \cup T \land (s, T_1) \stsstep (s', T_2)
\end{align*}

We further define \emph{closed} sets of states (given a particular set of tokens) as well as the \emph{closure} of a set:
\begin{align*}
\STSclsd(S, T) \eqdef{}& \All s \in S. \STSL(s) \disj T \land \left(\All s'. s \stsfstep{T} s' \Ra s' \in S\right) \\
\upclose(S, T) \eqdef{}& \setComp{ s' \in \STSS}{\Exists s \in S. s \stsftrans{T} s' }
\end{align*}

The STS RA is defined as follows
\begin{align*}
  \monoid \eqdef{}& \STSauth(s:\STSS, T:\wp(\STST) \mid \STSL(s) \disj T) \mid{}\\& \STSfrag(S: \wp(\STSS), T: \wp(\STST) \mid \STSclsd(S, T) \land S \neq \emptyset) \mid \mundef \\
  \mvalFull(\melt) \eqdef{}& \melt \neq \mundef \\
  \STSfrag(S_1, T_1) \mtimes \STSfrag(S_2, T_2) \eqdef{}& \STSfrag(S_1 \cap S_2, T_1 \cup T_2) \qquad\qquad\qquad \text{if $T_1 \disj T_2$ and $S_1 \cap S_2 \neq \emptyset$} \\
  \STSfrag(S, T) \mtimes \STSauth(s, T') \eqdef{}& \STSauth(s, T') \mtimes \STSfrag(S, T) \eqdef \STSauth(s, T \cup T') \qquad \text{if $T \disj T'$ and $s \in S$} \\
  \mcore{\STSfrag(S, T)} \eqdef{}& \STSfrag(\upclose(S, \emptyset), \emptyset) \\
  \mcore{\STSauth(s, T)} \eqdef{}& \STSfrag(\upclose(\set{s}, \emptyset), \emptyset)
\end{align*}
The remaining cases are all $\mundef$.

We will need the following frame-preserving update:
\begin{mathpar}
  \inferH{sts-step}{(s, T) \ststrans (s', T')}
  {\STSauth(s, T) \mupd \STSauth(s', T')}

  \inferH{sts-weaken}
  {\STSclsd(S_2, T_2) \and S_1 \subseteq S_2 \and T_2 \subseteq T_1}
  {\STSfrag(S_1, T_1) \mupd \STSfrag(S_2, T_2)}
\end{mathpar}

\paragraph{The core is not a homomorphism.}
The core of the STS construction is only satisfying the RA axioms because we are \emph{not} demanding the core to be a homomorphism---all we demand is for the core to be monotone with respect the \ruleref{ra-incl}.

In other words, the following does \emph{not} hold for the STS core as defined above:
\[ \mcore\melt \mtimes \mcore\meltB = \mcore{\melt\mtimes\meltB} \]

To see why, consider the following STS:
\newcommand\st{\textlog{s}}
\newcommand\tok{\textmon{t}}
\begin{center}
  \begin{tikzpicture}[sts]
    \node at (0,0)   (s1) {$\st_1$};
    \node at (3,0)  (s2) {$\st_2$};
    \node at (9,0) (s3) {$\st_3$};
    \node at (6,0)  (s4) {$\st_4$\\$[\tok_1, \tok_2]$};

    \path[sts_arrows] (s2) edge  (s4);
    \path[sts_arrows] (s3) edge  (s4);
  \end{tikzpicture}
\end{center}
Now consider the following two elements of the STS RA:
\[ \melt \eqdef \STSfrag(\set{\st_1,\st_2}, \set{\tok_1}) \qquad\qquad
  \meltB \eqdef \STSfrag(\set{\st_1,\st_3}, \set{\tok_2}) \]

We have:
\begin{mathpar}
  {\melt\mtimes\meltB = \STSfrag(\set{\st_1}, \set{\tok_1, \tok_2})}

  {\mcore\melt = \STSfrag(\set{\st_1, \st_2, \st_4}, \emptyset)}

  {\mcore\meltB = \STSfrag(\set{\st_1, \st_3, \st_4}, \emptyset)}

  {\mcore\melt \mtimes \mcore\meltB = \STSfrag(\set{\st_1, \st_4}, \emptyset) \neq
    \mcore{\melt \mtimes \meltB} = \STSfrag(\set{\st_1}, \emptyset)}
\end{mathpar}

%%% Local Variables:
%%% mode: latex
%%% TeX-master: "iris"
%%% End:


% -*- mode: LaTeX; TeX-PDF-mode: t; -*-
\input{./econtexRoot}\documentclass[PortfolioChoiceWithRiskyHousing]{subfiles}
\input{./econtexRoot}\input{\LaTeXInputs/econtex_onlyinsubfile}
\onlyinsubfile{\externaldocument{PortfolioChoiceWithRiskyHousing}} % Get xrefs -- esp to appendix -- from main file; only works properly if main file has already been compiled;

\begin{document}

\section{The Portfolio Choice Problem for Rental Households}

Households that do not own and instead rent their homes have to decide how much to consume, how much to spend on rent, and how much to save. Their normalized problem can be stated as:

\begin{equation}
	\begin{split}
		\wFunc_{t}(\mRat_{t}) & = \max_{\{\aRat_{t}, \hRat_{t}, \riskyshare_{t}\}} \utilFunc(\cRat_{t}, \hRat_{t}) + \DiscFac \Ex_{t} \left[ \PGro_{t+1}^{1-\CRRA} \wFunc_{t+1}(\mRat_{t+1}) \right] \\
		& \text{s.t.} \\
		\aRat_{t} & = \mRat_{t} - \cRat_{t} - \hRat_{t} \\
		\Rport_{t+1}(\riskyshare_{t}) & = \Rfree + (\Risky_{t+1} - \Rfree)\riskyshare_{t} \\
		\mRat_{t+1} & = \aRat_{t}\Rport_{t+1}(\riskyshare_{t})/\PGro_{t+1} + \tShkEmp_{t+1}
	\end{split}
\end{equation}

Consider the problem of a consumer that has $\xRat_{t}$ to spend on consumption and housing. Their problem is

\begin{equation}
	\begin{split}
		\utilFunc(\xRat) & = \max_{\{\cRat, h\}} \utilFunc(\cRat, h) \\
		& \text{s.t.} \\
		\xRat & = \cRat + h
	\end{split}
\end{equation}

%The first order condition with respect to $\cRat$ implies
%
%\begin{equation}
%	\utilFunc^{\cRat}(\cRat, h) = \utilFunc^{h}(\cRat, h)
%\end{equation}

Given the functional form of utility we are using (CRRA with paramter $\CRRA$), the well known solution to this simple problem is $\cRat_{*} = (1-\alpha)\xRat$ and $\hRat_{*} = \alpha \xRat$. Restating the problem in terms of $\xRat$, we obtain:

\begin{equation}
	\utilFunc(\xRat) = \utilFunc(\cRat_{*}, \hRat_{*}) = \frac{(\cRat_{*}^{1-\alpha}\hRat_{*}^{\alpha})^{1-\CRRA}}{1-\CRRA} = \xFer \frac{\xRat^{1-\CRRA}}{1-\CRRA}
\end{equation}

where $\xFer = \left( (1-\alpha)^{1-\alpha}\alpha^{\alpha} \right)^{1-\CRRA}$. Because both consumption and housing are non-durable in the case of a rental household, the consumer can first decide how much to spend on both goods ($\xRat_{t}$) and then decide how much to spend on each of the goods without changing the problem. A further step to simplify the problem is to use iterated expectations to split up the problem into subperiods. We can define

\begin{equation}
	\begin{split}
		\wOpt_{t}(\bRat_{t+1}) & = \Ex_{t}\left[ \PGro_{t+1}^{1-\CRRA} \wFunc_{t+1}(\mRat_{t+1}) \right] \\
		& \text{where} \\
		\mRat_{t+1} & = \bRat_{t+1}/\PGro_{t+1} + \tShkEmp_{t+1}
	\end{split}
\end{equation}

Now, we can rewrite our original problem as

\begin{equation}
	\begin{split}
		\wFunc_{t}(\mRat_{t}) & = \max_{\{\aRat_{t}, \riskyshare_{t}\}} \utilFunc(\xRat_{t}) + \DiscFac \Ex_{t} \left[ \wOpt_{t}(\bRat_{t+1}) \right] \\
		& \text{s.t.} \\
		\aRat_{t} & = \mRat_{t} - \xRat_{t} \\
		\Rport_{t+1}(\riskyshare_{t}) & = \Rfree + (\Risky_{t+1} - \Rfree)\riskyshare_{t} \\
		\bRat_{t+1} & = \aRat_{t}\Rport_{t+1}(\riskyshare_{t})
	\end{split}
\end{equation}

which embeds the simple subproblem and our defined iterated expectation.

We can rewrite the problem as

\begin{equation}
	\wFunc_{t}(\mRat_{t}) = \max_{\{\aRat_{t}, \riskyshare_{t}\}} \utilFunc(\mRat_{t} - \aRat_{t}) + \DiscFac \Ex_{t} \left[ \wOpt_{t}\left( \aRat_{t}(\Rfree + (\Risky_{t+1} - \Rfree)\riskyshare_{t}) \right) \right] \\
\end{equation}

First order condition with respect to $\aRat$ provides the Euler equation

\begin{equation}
	\utilFunc'(\xRat_{t}) = \DiscFac \Ex_{t} \left[ \wOpt_{t}'(\bRat_{t+1})\Rport_{t+1}(\riskyshare_{t}) \right]
\end{equation}

and the first order condition with respect to $\riskyshare_{t}$ is

\begin{equation}
	\DiscFac \Ex_{t} \left[ \wOpt_{t}'(\bRat_{t+1})\aRat_{t}(\Risky_{t+1}-\Rfree) \right] = 0
\end{equation}

The envelope condition is given by

\begin{equation}
	\wFunc_{t}'(\mRat_{t}) = \utilFunc'(\xRat_{t})
\end{equation}

And finally,

\begin{equation}
	\wOpt_{t}'(\bRat_{t+1}) = \Ex_{t} \left[ \PGro_{t+1}^{1-\CRRA} \wFunc_{t+1}'(\mRat_{t+1})/\PGro_{t+1} \right] = \Ex_{t} \left[ \PGro_{t+1}^{-\CRRA} \wFunc_{t+1}'(\mRat_{t+1}) \right]
\end{equation}

\section{The portfolio problem of a homeowner with no mortgage}

A homeowner with no mortgage debt is allowed to invest more on their house to increase its size (or they can let it depreciate). In doing so, they choose home investment, consumption, and savings. Their problem is summarized as follows:

\begin{equation}
	\begin{split}
		\vFunc_{t}(\mRat_{t}, \hRat_{t-1}) = \max_{\aRat_{t}, \riskyshare_{t}, \iRat_{t}} \utilFunc(\cRat_{t}, \hRat_{t}) & + \DiscFac \Ex_{t} \left[ \PGro_{t+1}^{1-\CRRA} \left( (1-\timeRate) \vFunc_{t+1}(\mRat_{t+1}, \hRat_{t+1}) + \timeRate \wFunc_{t+1}(\mRat_{t+1}^{\wFunc}) \right) \right] \\
		&\text{s.t.} \\
		\hRat_{t} & = (1-\depr)\hRat_{t-1} +  \iRat_{t}/\Qrisky_0 \\
		\hRat_{t+1} & = \hRat_{t}/\PGro_{t+1} \\
		\aRat_{t} & = \mRat_{t} - \cRat_{t} - \iRat_{t} \\
		\Rport_{t+1}(\riskyshare_{t}) & = \Rfree + (\Risky_{t+1} - \Rfree)\riskyshare_{t} \\
		\mRat_{t+1} & = \aRat_{t}\Rport_{t+1}(\riskyshare_{t})/\PGro_{t+1} + \tShkEmp_{t+1} \\
		\mRat_{t+1}^{\wFunc} & = \mRat_{t+1} + \Qrisky_{t+1}\hRat_{t+1}
	\end{split}
\end{equation}

%OR
%
%\begin{equation}
%	\begin{split}
%		\vFunc_{t}(\mRat_{t}, \hRat_{t}) = \max_{\aRat_{t}, \riskyshare_{t}, \iRat_{t}} \utilFunc(\cRat_{t}, \hRat_{t}) & + \DiscFac \Ex_{t} \left[ \PGro_{t+1}^{1-\CRRA} \left( (1-\timeRate) \vFunc_{t+1}(\mRat_{t+1}, \hRat_{t+1}) + \timeRate \wFunc_{t+1}(\mRat_{t+1}^{\wFunc}) \right) \right] \\
%		&\text{s.t.} \\
%		\hRat_{t+1} & = ((1-\depr)\hRat_{t-1} + \Qrisky_0 \iRat_{t})/\PGro_{t+1} \\
%		\aRat_{t} & = \mRat_{t} - \cRat_{t} - \iRat_{t} \\
%		\Rport_{t+1}(\riskyshare_{t}) & = \Rfree + (\Risky_{t+1} - \Rfree)\riskyshare_{t} \\
%		\mRat_{t+1} & = \aRat_{t}\Rport_{t+1}(\riskyshare_{t})/\PGro_{t+1} + \tShkEmp_{t+1} \\
%		\mRat_{t+1}^{\wFunc} & = \mRat_{t+1} + \Qrisky_{t+1}\hRat_{t+1}
%	\end{split}
%\end{equation}

To facilitate the solution method, we can split the above problem into different subperiods.

In the first subperiod, the household arrives with cash on hand and their previous housing size. They then pick their current size by investing $\iRat_{t}$ where housing costs are $\Qrisky_0$. After investing, they are left with net cash on hand after housing costs, and a new housing size.

\begin{equation}
	\begin{split}
		\vFunc_{t}(\mRat_{t}, \hRat_{t-1}) & = \max_{\iRat_{t}} \vOpt_{t}(\nRat_{t}, \hRat_{t}) \\
		& \text{s.t.} \\
		\nRat_{t} & = \mRat_{t} - \iRat_{t} \\
		\hRat_{t} & = (1-\depr)\hRat_{t-1} + \iRat_{t}/\Qrisky_0
	\end{split}
\end{equation}

In the second subperiod, the household arrives with net cash on hand and their current housing size. This subperiod is a standard portfolio choice problem, indexed by their house size. The agent must then choose a level of savings $\aRat_{t}$ and the proportion of their savings that will go into the risky asset $\riskyshare_{t}$ versus the safe asset $(1-\riskyshare_{t})$.

\begin{equation}
	\begin{split}
		\vOpt_{t}(\nRat_{t}, \hRat_{t}) & = \max_{\{\aRat_{t}, \riskyshare_{t}\}} \utilFunc(\cRat_{t}, \hRat_{t}) + \DiscFac \Ex_{t}\left[ \vOptAlt_{t}(\bRat_{t+1}, \hRat_{t}) \right] \\
		\aRat_{t} & = \nRat_{t} - \cRat_{t} \\
		\Rport_{t+1}(\riskyshare_{t}) & = \Rfree + (\Risky_{t+1} - \Rfree)\riskyshare_{t} \\
		\bRat_{t+1} & = \aRat_{t}\Rport_{t+1}(\riskyshare_{t})
	\end{split}
\end{equation}

Finally in the last subperiod, the household's uncertainty is realized. Simultaneously, they observe their permanent and transitory income shocks, whether they will become renters in the next period (function $\wFunc_{t+1}$ with probability $\timeRate$), and if they do become renters, the liquidation price of their house per unit of housing.

\begin{equation}
	\begin{split}
		\vOptAlt_{t}(\bRat_{t+1}, \hRat_{t}) & = \Ex_{t} \left[ \PGro_{t+1}^{1-\CRRA} \left( (1-\timeRate) \vFunc_{t+1}(\mRat_{t+1}, \hRat_{t+1}) + \timeRate \wFunc_{t+1}(\mRat_{t+1}^{\wFunc}) \right) \right] \\
		& \text{where} \\
		\hRat_{t+1} & = \hRat_{t}/\PGro_{t+1} \\
		\mRat_{t+1} & = \bRat_{t+1}/\PGro_{t+1} + \tShkEmp_{t+1} \\
		\mRat_{t+1}^{\wFunc} & = \mRat_{t+1} + \hRat_{t+1} \Qrisky_{t+1}
	\end{split}
\end{equation}

\subsection{First order conditions: Choosing home investment}

The problem is

\begin{equation}
	\vFunc_{t}(\mRat_{t}, \hRat_{t-1}) = \max_{\iRat_{t}} \vOpt_{t}(\mRat_{t} - \iRat_{t}, (1-\depr)\hRat_{t-1} + \iRat_{t}/\Qrisky_0)
\end{equation}

The first order condition with respect to $\iRat_{t}$ is

\begin{equation}
	\vOpt_{t}^{\nRat}(\nRat_{t}, \hRat_{t}) =  \vOpt_{t}^{\hRat}(\nRat_{t}, \hRat_{t})/\Qrisky_0
\end{equation}

which equalizes the marginal benefit of additional net cash-on-hand (cash-on-hand net of home investment) with the marginal cost of a larger house. The envelope conditions are

\begin{equation}
	\begin{split}
		\vFunc_{t}^{\mRat}(\mRat_{t}, \hRat_{t-1}) & = \vOpt_{t}^{\nRat}(\nRat_{t}, \hRat_{t}) \\
		\vFunc_{t}^{\hRat}(\mRat_{t}, \hRat_{t-1}) & = \vOpt_{t}^{\hRat}(\nRat_{t}, \hRat_{t})(1-\depr)
	\end{split}
\end{equation}

\subsection{First order conditions: Choosing consumption and portfolio investment}

Once again, let's reduce the problem to 1 line.

\begin{equation}
	\vOpt_{t}(\nRat_{t}, \hRat_{t}) = \max_{\{\aRat_{t}, \riskyshare_{t}\}} \utilFunc(\nRat_{t} - \aRat_{t}, \hRat_{t}) + \DiscFac \Ex_{t}\left[ \vOptAlt_{t}(\aRat_{t}(\Rfree + (\Risky_{t+1} - \Rfree)\riskyshare_{t}), \hRat_{t}) \right]
\end{equation}

Notice that $\hRat_{t}$ passes through this problem unaltered. Indeed, in this subproblem, the house size indexes the portfolio choice (and may affect marginal utility) but does not need further addressing beyond a simple portfolio choice model.

The first order condition with respect to $\aRat_{t}$ is

\begin{equation}
	\utilFunc^{\cRat}(\cRat_{t}, \hRat_{t})  = \DiscFac \Ex_{t} \left[ \vOptAlt_{t}^{\bRat}(\bRat_{t+1}, \hRat_{t})\Rport_{t+1}(\riskyshare_{t}) \right]
\end{equation}

The first order condition with respect to $\riskyshare_{t}$ is

\begin{equation}
	\DiscFac \Ex_{t}\left[ \vOptAlt_{t}^{\bRat}(\bRat_{t+1}, \hRat_{t})\aRat_{t}(\Risky_{t+1}-\Rfree) \right] = 0
\end{equation}

Finally, the envelope conditions are

\begin{equation}
	\begin{split}
		\vOpt_{t}^{\nRat}(\nRat_{t}, \hRat_{t})  &  = \utilFunc^{\cRat}(\cRat_{t}, \hRat_{t}) \\
		\vOpt_{t}^{\hRat}(\nRat_{t}, \hRat_{t}) & = \utilFunc^{\hRat}(\cRat_{t}, \hRat_{t}) + \DiscFac \Ex_{t} \left[ \vOptAlt_{t}^{\hRat}(\bRat_{t+1}, \hRat_{t}) \right]
	\end{split}
\end{equation}

The second envelope condition is due to the nature of the $\hRat_{t}$ pass-through.

\subsection{Envelope conditions: Uncertainty is realized}

The last subperiod is harder to re-write in one line, but because there is no maximization it is straight forward to calculate the derivatives.

\begin{equation}
	\begin{split}
		\vOptAlt_{t}^{\bRat}(\bRat_{t+1}, \hRat_{t}) & = \Ex_{t} \left[ \PGro_{t+1}^{-\CRRA} \left( (1-\timeRate)\vFunc_{t+1}^{\mRat}(\mRat_{t+1}, \hRat_{t+1}) + \timeRate \wFunc_{t+1}^{\mRat}(\mRat_{t+1}^{\wFunc}) \right) \right] \\
		\vOptAlt_{t}^{\hRat}(\bRat_{t+1}, \hRat_{t} ) & = \Ex_{t} \left[ \PGro_{t+1}^{-\CRRA} \left( (1-\timeRate)\vFunc_{t+1}^{\hRat}(\mRat_{t+1}, \hRat_{t+1}) + \timeRate \wFunc_{t+1}^{\mRat}(\mRat_{t+1}^{\wFunc})\Qrisky_{t+1} \right) \right]
	\end{split}
\end{equation}

\section{Solving the homeowner with mortgage problem}

\begin{equation}
	\begin{split}
		\vFunc_{t}(\mRat_{t}, \hRat_{t}, \dRat_{t-1}) & = \max_{\aRat_{t}, \riskyshare_{t}, \iRat_{t}} \utilFunc(\cRat_{t}, \hRat_{t}) + \DiscFac \Ex_{t} \left[ \PGro_{t+1}^{1-\CRRA} \vFunc_{t+1}(\mRat_{t+1}, \hRat_{t+1}, \dRat_{t+1}) \right] \\
		&\text{s.t.} \\
		\dRat_{t} & = \dRat_{t-1} + (1-\depr)\hRat_{t} - \iRat_{t} \\
		\aRat_{t} & = \mRat_{t} - \cRat_{t} - \iRat_{t} \\
		\Rport_{t+1}(\riskyshare_{t}) & = \Rfree + (\Risky_{t+1} - \Rfree)\riskyshare_{t} \\
		\mRat_{t+1} & = \aRat_{t}\Rport_{t+1}(\riskyshare_{t})/\PGro_{t+1} + \tShkEmp_{t+1} \\
		\hRat_{t+1} & = \hRat_{t}/\PGro_{t+1} \\
		\mRat_{t+1}^{\wFunc} & = \mRat_{t+1} + \Qrisky_{t+1}\hRat_{t+1}
	\end{split}
\end{equation}

Can also be split up into subparts

\begin{equation}
	\begin{split}
		\vFunc_{t}(\mRat_{t}, \hRat_{t}, \dRat_{t-1}) & = \max_{\iRat_{t}} \vOpt_{t}(\nRat_{t}, \hRat_{t}, \dRat_{t}) \\
		\nRat_{t} & = \mRat_{t} - \iRat_{t} \\
		\dRat_{t} & = \dRat_{t-1} + (1-\depr)\hRat_{t} - \iRat_{t}
	\end{split}
\end{equation}

\begin{equation}
	\begin{split}
		\vOpt_{t}(\nRat_{t}, \hRat_{t}, \dRat_{t}) & = \max_{\{\aRat_{t}, \riskyshare_{t}\}} \utilFunc(\cRat_{t}, \hRat_{t}) + \DiscFac \Ex_{t}\left[ \vOptAlt_{t}(\bRat_{t+1}, \hRat_{t}, \dRat_{t}) \right] \\
		\aRat_{t} & = \nRat_{t} - \cRat_{t} \\
		\Rport_{t+1}(\riskyshare_{t}) & = \Rfree + (\Risky_{t+1} - \Rfree)\riskyshare_{t} \\
		\bRat_{t+1} & = \aRat_{t}\Rport_{t+1}(\riskyshare_{t})
	\end{split}
\end{equation}

\begin{equation}
	\begin{split}
		\vOptAlt_{t}(\bRat_{t+1}, \hRat_{t}, \dRat_{t}) & = \Ex_{t} \left[ \PGro_{t+1}^{1-\CRRA} \vFunc_{t+1}(\mRat_{t+1}, \hRat_{t+1}, \dRat_{t+1}) \right] \\
		& \text{where} \\
		\hRat_{t+1} & = \hRat_{t}/\PGro_{t+1} \\
		\dRat_{t+1} & = \dRat_{t}\Rfree_{D}/\PGro_{t+1} \\
		\mRat_{t+1} & = \bRat_{t+1}/\PGro_{t+1} + \tShkEmp_{t+1} \\
		\mRat_{t+1}^{\wFunc} & = \mRat_{t+1} + \hRat_{t+1} \Qrisky_{t+1}
	\end{split}
\end{equation}

\end{document}
\endinput


\section{Performance}\label{sec:performance}

We benchmark the performance of our own variants of the Union-Find decoder, as well as the Union-Find Partitioned-Growth (UFPG) decoder of Algorithm \ref{algo:ufbb}. Decoding rate $d$ for a given lattice size $L$ and physical error rate is acquired by Monte Carlo simulations. We compare the performance under the independent noise model of only i.i.d. bit-flip errors with chance $p_X$ and the phenomenological noise model, which adds faulty syndrome measurements occurring at chance $p_X$. Code thresholds $p_{\text{th}}$ are obtained by curve fitting for the crossing point of decoding rates plotted in $(p_X, d)$ space, for a range of values for $L$ and $p_X$ \cite{wang2003confinement}. We also use the decoding rate at the threshold $d(p_{\text{th}})= d_{\text{th}}$ as a metric to compare decoders.

\subsection{Union-Find decoder variants}

First, we show that $p_{\text{th}}$ can be increased, and the matching weight $\abs{\m{C}}$ can be decreased within the Union-Find decoder \textbf{without} the Partitioned-Growth data structure. We compare distinct variants of our implementation of the Union-Find decoder, that either implements Weighted Growth via bucket sort or no Weighted Growth, and either constructs a forest $F$ of grown clusters post-growth, which is the case in the original Union-Find decoder, or maintains acyclic vertex-trees $\vset$ during cluster growth. The latter is achieved by applying lines \ref{algo:dfa}-\ref{algo:dfb} of Algorithm \ref{algo:ufbb} in the UF decoder. The labels used for each variant are listed in \Cref{tab:uftable}. The full descriptions for each of the variants can be found in \cite{markthesis}.

\Figure[b](topskip=0pt, botskip=0pt, midskip=0pt){figures/python/comp_matching_weight.pdf}{
  The matching weight $\abs{\m{C}}$ of the Union-Find decoder variants (Table \ref{tab:uftable}) and the UFPG decoder, normalized to the minimum weight $\min{\abs{\m{C}}}$ of the Minimum-Weight Perfect Matching decoder. All weights are obtained by Monte Carlo simulations on $p_X=0.098$ with a minimum of $100.000$ samples. The x-axis scales linearly with $N = L^2$. \label{comp_weight}}

\begin{table}[htb]
  \centering
  \begin{tabularx}{\linewidth} { | R{2} || C{.5} | C{.5} | }
    \hline
    & $\mathbf{F}$ &  $\pmb{\vset}$\\
    \hhline{|=::=:=|}
    No Weighted Growth & fUF  & vUF \\
    \hline
    \textbf{B}ucket sort Weighted Growth & bfUF & bvUF \\
    \hline
  \end{tabularx}
  \caption{Abbreviated names for the variants of the Union-Find decoder.}\label{tab:uftable}
\end{table}

\Figure[bt](topskip=0pt, botskip=0pt, midskip=0pt){figures/python/threshold_ufpg.pdf}{
  The decoding rates $d$ of \emph{(a)} the UFPG decoder and \emph{(c)} the bvUF and MWPM decoders, obtained via Monte Carlo simulations with a minimum of 100.000 samples per lattice size per error rate. \emph{(a)} The decoding rates of the UFPG decoder do not cross in a single point, such that there is no apparent code threshold. \emph{(b)} The intersections of threshold curves of subsequent lattice sizes are the so-called threshold coordinates, which follow a trend in $(p_X, d)$ space as the lattice sizes increase. \emph{(c)} The threshold coordinates of the UFPG decoder occupy the region in $(p_X, d)$ space of the MWPM decoder. \label{threshold_ufpg}}

\begin{table}[htb]
  \centering
  \begin{tabularx}{\linewidth} { | R{1} || C{1} | C{1} | C{1} | C{1} | }
    \hline
    \multirow{2}{*}{} & \multicolumn{2}{c|}{Independent}& \multicolumn{2}{c|}{Phenomenological} \\
    \cline{2-5}
      & $p_{\text{th}}$ & $d_{\text{th}}$ & $p_{\text{th}}$ & $d_{\text{th}}$ \\
    \hhline{|=::=:=:=:=|}
    fUF & $9.72\%$ & $73.34\%$ & $ 2.53\%$ & $92.39\%$ \\
    \hline
    vUF & $9.79\%$ & $74.32\%$ & $2.56\%$ & $93.64\%$ \\
    \hline
    bfUF & $9.98\%$ & $72.71\%$ & $2.68\%$ & $91.32\%$ \\
    \hline
    bvUF & $10.01\%$ & $72.86\%$ & $2.69\%$ & $92.08\%$ \\
    \hline
    MWPM & $10.35\%$ & $71.58\%$ & $2.97\%$ & $90.24\%$\\
    \hline
  \end{tabularx}
  \caption{Threshold error rates $p_{\text{th}}$ and threshold decoding success rates $d_{\text{th}}$ for the implementations of the  Union-Find decoder of \Cref{tab:uftable}.}\label{tab:ufndfwug}
\end{table}

\Figure[t](topskip=0pt, botskip=0pt, midskip=0pt){figures/python/comp_time.pdf}{
  The mean computation time of the UFPG, bvUF, and MWPM decoders near the threshold error rate. All weights are obtained by Monte Carlo simulations for $p_X=0.098$ with a minimum of $100.000$ samples. The x-axis scales linearly with $N = L^2$.\label{comp_time}}

The values for $p_{\text{th}}$ and $d_{\text{th}}$ for each variant, including the Minimum-Weight Perfect Matching (MWPM) decoder, are listed in \Cref{tab:ufndfwug}. Weighted Growth has the expected behavior of increasing $p_{\text{th}}$. While there is no major increase in $p_{\text{th}}$ from the $\vset$-variants over the $F$-variants, a significant increase in $d_{\text{th}}$ can be observed. We suspect that the acyclic graphs of $\vset$ have shorter branches in between junctions compared to $F$, which leads to a decreased matching weight and increased $d_{\text{th}}$. We plot the matching weight $\abs{\m{C}}$ of the UF variants, normalized to the minimum weight of the MWPM decoder for $p_X = 0.098$ in \Cref{comp_weight}. Here we see a correlation between a decrease in $\abs{\m{C}}$ and increase in performance: both Weighted Growth and maintaining $\vset$ during growth increase performance and decrease matching weight. Furthermore, the matching weight in $\vset$-variants have a relatively low and constant factor over the minimum weight, which improves upon the $L$-dependent behavior of $F$-variants.

\subsection{Union-Find Partitioned-Growth decoder}

We benchmark the performance of the Union-Find Partitioned-Growth (UFPG) decoder of Algorithm \ref{algo:ufbb}. The decoding rates are plotted in \Cref{threshold_ufpg}\emph{a} per lattice size. We discover that the curves related to the decoding rates do not cross in a single point, such that there is no clear threshold $p_{\text{th}}$. In fact, the intersections of two curves of subsequent lattice sizes, which we dub threshold coordinates, follow a trend where larger input lattice sizes results in a decrease in $p_{\text{th}}$ but an increase in $d_{\text{th}}$. We ascribe the degradation of the threshold coordinate for larger lattices to the Parity Inversion effect. These threshold coordinates $(p_{\text{th}}, d_{\text{th}})$ are plotted in \Cref{threshold_ufpg}\emph{b}. When these coordinates are plotted together with the bvUF and MWPM decoders' decoding rates, such as in \Cref{threshold_ufpg}\emph{c}, we see that the threshold coordinate for small lattice sizes is similar to the MWPM threshold coordinate. For larger lattice sizes, UFPG threshold coordinates move towards the bvUF threshold on the $p_X$ axis, but still has an increased performance due to the increased $d_{\text{th}}$. Overall, the threshold coordinates occupy a region in $(p_X, d)$ space previously reserved to the MWPM decoder. A direct comparison between the Union-Find, bvUF, UFPG and MWPM decoders is included in \Cref{thres_comp}.

The matching weight $\abs{\m{C}}$ of the UFPG decoder is successfully decreased compared to all UF variants of \Cref{tab:uftable}. For $p_X = 0.098$, an error rate close to $p_{\text{th}}$ for all decoders, the normalized matching weight is halved compared to the bvUF decoder (\Cref{comp_weight}). We compare the average running time of Monte Carlo simulations to obtain a matching between the UFPG, bvUF, and MWPM decoders. A comparison for a physical error rate near the threshold is included in \Cref{comp_time}. The average running time of UFPG, while not behaving according to worst-case $\m{O}(n \log{n})$, is also not linear.

Finally, we show in \Cref{comp_lowerror} the performance of the UFPG decoder in the low-error regime with phenomenological noise. The decoding rate of the UFPG decoder is improved from the bvUF decoder and behaves similarly to the MWPM decoder. The mean computation time of the decoders in this regime, plotted in \Cref{comp_lowerror_time}, shows that the UFPG decoder performs at about the same speed as the bvUF decoder.\par

The simulator for the surface code, the Union-Find decoder variants, and the Union-Find Partitioned-Growth decoder have all been implemented in Python using our application \cite{qsurface}. The MWPM decoder utilizes the C implementation of BlossomV \cite{kolmogorov2009blossom} due to substantial slow performances of Python implementations. Simulations were initially performed on a single 3.20 GHz Intel Core i5 CPU but later parallelized on all 24 threads of 3.60 GHz Intel Xeon E5 CPU's.