2.1 Annotated formulas

The proof systems that we shall introduce here admit formulas with quantified versions of the fixpoint operators, involving a countable set $\mathrm {OV}$ of ordinal variables (denoted $\kappa , \lambda , \kappa _0, \ldots $ ). Since we will also allow quantifiers over these ordinal variables, the formulas that we work with will be of the following form:

A formula which does not contain any ordinal variables, i.e., a formula of the two-way modal $\mu $ -calculus, is called plain. The underlying plain formula of a formula $\varphi $ , denoted $\mathsf {u}(\varphi )$ , is the plain formula obtained from erasing all ordinal annotations and quantifiers from $\varphi $ :

$$ \begin{gather*} \begin{aligned} \mathsf{u}(x) &= x & \mathsf{u}(\varphi \wedge \psi ) &= \mathsf{u}(\varphi ) \wedge \mathsf{u}(\psi) & \mathsf{u}( [a] \varphi ) &= [a] \mathsf{u}(\varphi ), \\ \mathsf{u}(p) &= p & \mathsf{u}(\varphi \vee \psi ) &= \mathsf{u}(\varphi ) \vee \mathsf{u}(\psi) & \mathsf{u}( {\langle{a}\rangle} \varphi ) &= {\langle{a}\rangle} \mathsf{u}(\varphi ), \end{aligned} \\ \begin{aligned} \mathsf{u}( \eta x^{\kappa} \varphi ) &= \eta x \, \mathsf{u}(\varphi ) & \mathsf{u}( \forall \lambda < \kappa \, \varphi ) &= \mathsf{u}(\varphi ), \\ \mathsf{u}( \eta x \varphi ) &= \eta x \, \mathsf{u}(\varphi ) & \mathsf{u}( \exists \lambda < \kappa \, \varphi ) &= \mathsf{u}(\varphi ). \end{aligned} \end{gather*} $$

The semantics of this language can be defined as follows. If $f \colon \mathcal {P} W \rightarrow \mathcal {P} W$ is a monotone function on the powerset of W we identify two ways of iterating f along ordinals: $f^{\kappa }_{\top } \in \mathcal {P} W$ denotes the result of iterating $f \ \kappa $ -many times on the starting from W, and $f^{\kappa } _{\bot } \in \mathcal {P} W$ the $\kappa $ -th iterant of f starting from $\emptyset $ :

$$\begin{align*}f^{\kappa} _{\top} = \bigcap_{\xi < \kappa } f( f^{\xi}_{\top} ) \qquad\qquad f^{\kappa} _{\bot} = \bigcup_{\xi < \kappa } f( f^{\xi}_{\bot} ). \end{align*}$$

Note that $f^0_{\top } = W$ and $f^0_{\bot } = \emptyset $ . Given a model $M = (W,R,V)$ , an ordinal assignment is a map o assigning an ordinal $o(\kappa )$ to each ordinal variable $\kappa $ . Then the meaning $[\![\varphi ]\!]^o_M$ of a formula $\varphi $ in this model and under this assignment is inductively defined as follows. We write $[\![\lambda x. \varphi ]\!]$ to express the monotone map $Z \mapsto [\![\varphi ]\!]^o_{M[x\mapsto Z]}$ on $\mathcal {P} W$ .

• • For a propositional variable p, $[\![p]\!]^o_M = V(p)$ .

• • Standard clauses for Booleans and modalities.

• • $[\![\mu x^{\kappa }.\varphi ]\!]^o_M $ is the $o(\kappa )$ -th iterant of $[\![\lambda x. \varphi ]\!]$ on $\emptyset $ , i.e., $[\![\mu x^{\kappa }.\varphi ]\!]^o_M = [\![\lambda x. \varphi ]\!]_{\bot }^{o(\kappa )}$ .

• • $[\![\nu x.\varphi ^{\kappa }]\!]^o_M $ is the $o(\kappa )$ -th iterant of $[\![\lambda x. \varphi ]\!]$ on W, i.e., $[\![\nu x^{\kappa }.\varphi ]\!]^o_M = [\![\lambda x. \varphi ]\!]_{\top }^{o(\kappa )}$ .

• • $[\![\mu x.\varphi ]\!]^o_M$ is the least fixpoint $[\![\lambda x. \varphi ]\!]$ , namely $ [\![\mu x.\varphi ]\!]^o_M = \bigcup _{\xi } [\![ \lambda x. \varphi ]\!]^{\xi }_{\bot }$ .

• • $[\![\nu x.\varphi ]\!]^o_M$ is the greatest fixpoint of $[\![\lambda x. \varphi ]\!]$ , namely $ [\![\nu x.\varphi ]\!]^o_M = \bigcap _{\xi } [\![ \lambda x. \varphi ]\!]^{\xi }_{\top }$ .

• • $[\![\exists \lambda < \kappa .\varphi ]\!]^o_M = \{u \in W \mid \exists \xi < o(\kappa ) : u \in [\![\varphi ]\!]^{o[\lambda \mapsto \xi ]} _M \}$ .

• • $[\![\forall \lambda < \kappa .\varphi ]\!]^o_M = \{u \in W \mid \forall \xi < o(\kappa ) : u \in [\![\varphi ]\!]^{o[\lambda \mapsto \xi ]} _M \}$ .

We write $M,u \vDash _o \varphi $ if $u \in [\![\varphi ]\!]^o_M$ . If $\varphi $ is a plain formula we may write simply $M,u\vDash \varphi $ .

We think of negation as an operation on sentences, extending the involution on proposition letters, and determined by connective duality. Inductively we define the operation $\varphi \mapsto \overline {\varphi }$ for all formulas:

$$ \begin{align*} \overline{x} &= x & \overline{\varphi \wedge \psi} &= \overline{\varphi } \lor \overline{\psi} & \overline{[a] \varphi } &= {\langle{a}\rangle} \overline{\varphi } & \overline{\mu x^{\kappa} \varphi } &= \nu x^{\kappa} \, \overline{\varphi } & \overline{\forall \lambda < \kappa \, \varphi } &= \exists \lambda < \kappa \, \overline{\varphi } \\ & & \overline{\varphi \lor \psi} &= \overline{\varphi } \land \overline{\psi} & \overline{{\langle{a}\rangle} \varphi } &= [a] \overline{\varphi } & \overline{\nu x^{\kappa} \varphi } &= \mu x^{\kappa} \, \overline{\varphi } & \overline{\exists \lambda < \kappa \, \varphi } &= \forall \lambda < \kappa \, \overline{\varphi }. \end{align*} $$

It is routine to show that on the set of sentences this operation indeed behaves as classical negation. Furthermore, observe that this operation is an involution on the set of formulas, and that the negation of a plain formula is plain.

2.2 Subsumption, well-annotated formulas, and active variables

In this subsection we define some notions that are not needed in the definition of the proof systems but play a key role in our reasoning about the properties of the proof system.

The subsumption order $<_{\rho }$ associated with a formula $\rho $ is defined as the smallest preorder on $\mathrm {Var}(\rho )$ such that $x <_{\rho } y$ if $\rho $ has a subformula $\sigma y \psi $ of which x is a free variable. Observe that the subsumption order of a fixpoint formula is identical to that of its unfolding. By taking, if needed, alphabetic variants (i.e., renaming the bound variables in $\rho $ ) we may always assume that the subsumption order of a given formula is a strict partial order. It may occasionally be convenient to make the following assumption which is possible without loss of generality.

Definition 2.2. An annotation is a partial function from fixed point variables to ordinal variables. Let $x_0 , x_1 , \dotsc $ enumerate the fixed point variables in decreasing order with respect to subsumption. Given an annotation o and $n \in \omega $ , $o \upharpoonright n$ is the restriction of o to the domain $\{ x_i \mid i < n \}$ . Given a plain formula $\varphi $ and annotation $o \colon \mathrm {FV} \to \mathrm {OV}$ define a (nonplain) formula $\varphi ^o$ as follows:

$$ \begin{gather*} \begin{aligned} x^o &= x &\qquad ( \psi \wedge \theta )^o &= \psi^o \wedge \theta^o &\qquad ([a] \varphi )^o &= [a] \varphi ^o, \\ p^o &= p & ( \psi \vee \theta )^o &= \psi^o \vee \theta^o & ( {\langle{a}\rangle} \varphi )^o &= {\langle{a}\rangle} \varphi ^o, \end{aligned} \\ ( \eta x_i \psi )^o = \begin{cases} \eta x_i^{o(x_i)} \psi^{o \upharpoonright i }, & \text{if } x_i \in \mathop{dom} o, \\ \eta x_i \psi^{o \upharpoonright i }, & \text{otherwise.} \end{cases} \end{gather*} $$

Note that plain formulas are positively annotated, and that well-annotated formulas do not contain quantifiers.

2.3 Game semantics

In this section we briefly review the game-theoretic semantics for the two-way $\mu $ -calculus; this will prove to be a useful approach in the completeness argument further on.

The evaluation game $\mathcal {E}(M,\varphi )$ of a formula $\varphi $ on a model $M = (W,R,V)$ is an infinite board game, the players of which we shall call Verifier and Falsifier. The positions of the game are all pairs of the form $(w,\psi )$ , where $w \in W$ and $\psi \in \mathrm {Clos}(\varphi )$ . The player to move at a given position and the moves at his or her disposal are listed in Table 1.

Table 1 The evaluation game $\mathcal {E}(M,\varphi )$ .

Any match or play of this game consists of a (finite or infinite) sequence $(w_n,\varphi _n)_{n<\kappa }$ of positions (with $\kappa \leq \omega $ ). A finite match, i.e., with $\kappa < \omega $ , is won by a player if it is their opponent who is supposed to move at the last position $(w_{\kappa -1}, \varphi _{\kappa -1})$ , while there is no move available.

To determine the winner of an infinite match $(w_n,\varphi _n)_{n<\omega }$ we observe that the induced sequence $(\varphi _n)_{n<\omega }$ of formulas is an infinite trace, that is: for every $i<\omega $ , either $\varphi _i$ is a fixpoint formula and $\varphi _{i+1}$ is its unfolding, or else $\varphi _{i+1}$ is a direct (modal or Boolean) subformula of $\varphi _i$ . It is well known that for every infinite trace $\tau = (\varphi _n)_{n<\omega }$ there is a unique formula that occurs infinitely often on $\tau $ and is a subformula of $\varphi _n$ for cofinitely many n. We will call this formula, which must be a fixpoint formula, the most significant formula of $\tau $ , and we declare Verifier (Falsifier) to be the winner of an infinite match $(w_n,\varphi _n)_{n<\omega }$ if the most significant formula of the induced trace $(\varphi _n)_{n<\omega }$ is a $\nu $ -formula (a $\mu $ -formula, respectively). It is well known that this winning condition can be formulated as a parity condition and that consequently the game $\mathcal {E}(M,\varphi )$ has positional determinacy.

For a proof of the theorem see, e.g., [Reference Demri, Goranko and Lange6].

3.1 Sequents and constraints

The sequents in our proof system contain a constraint that describes the relative size of ordinal variables and keeps track of the order in which they are introduced.

Given a constraint $\mathcal {O} = ( O , <_{\mathcal {O}} , \triangleleft _{\mathcal {O}} )$ , we write $\mathrm {OV}(\mathcal {O})$ for O, the set of ordinal variables appearing in $\mathcal {O}$ . When there is no risk of confusion, we identify the constraint $\mathcal {O}$ with the set $\mathrm {OV}(\mathcal {O})$ , writing $\kappa \in \mathcal {O}$ rather than the formally precise $\kappa \in \mathrm {OV}(\mathcal {O})$ . The reflexive closure of $<_{\mathcal {O}}$ is denoted $\le _{\mathcal {O}}$ .

Given a constraint $\mathcal {O}$ and $\kappa \in \mathcal {O}$ , a descendant of $\kappa $ is any $\lambda \in \mathcal {O}$ such that $\lambda <_{\mathcal {O}} \kappa $ , in which case $\kappa $ is called an ancestor of $\lambda $ (in $\mathcal {O}$ ). We say $\lambda $ is a child of $\kappa $ , or that $\kappa $ is the parent of $\lambda $ , if $\lambda <_{\mathcal {O}} \kappa $ and there is no $\rho \in \mathcal {O}$ such that $\lambda <_{\mathcal {O}} \rho $ and $\rho <_{\mathcal {O}} \kappa $ . Every $\kappa \in \mathcal {O}$ has at most one parent, but may have multiple children. If $\kappa \triangleleft _{\mathcal {O}} \lambda $ we say that $\kappa $ is older than $\lambda $ (relative to $\mathcal {O}$ ).

A substitution on ordinal variables is simply a map $\sigma : \mathrm {OV} \to \mathrm {OV}$ . With respect to a constraint $\mathcal {O}$ we call a substitution $\sigma $ increasing if $\lambda \le _{\mathcal {O}} \sigma (\lambda )$ for all $\lambda $ , and decreasing if $\sigma (\lambda ) \le _{\mathcal {O}} \lambda $ for all $\lambda $ .

For later use we introduce two auxiliary relations on a constraint $\mathcal {O}$ . First of all, we say that $\lambda $ is to the left of $\rho $ if $\lambda $ and $\rho $ are incomparable with respect to $\leq _{\mathcal {O}}$ and $\lambda ' \triangleleft _{\mathcal {O}} \rho '$ , where $\lambda '$ is the $<$ -greatest ancestor of $ \lambda $ that is not an ancestor of $ \rho $ and $ \rho ' $ is the $<$ -greatest ancestor of $ \rho $ that is not an ancestor of $ \lambda $ . We then define $\lambda \prec _{\mathcal {O}} \rho $ if $\lambda <_{\mathcal {O}} \rho $ or $ \lambda $ is to the left of $ \rho $ , and we sometimes denote $\lambda \prec _{\mathcal {O}} \rho $ as $\lambda \prec _{\mathcal {O}} \rho $ . As we will see later, $\prec _{\mathcal {O}}$ is in fact a strict linear order.

Here is an example to illustrate the different orders on ordinal variables and how they are related. Consider a constraint $\mathcal {O}$ containing seven ordinal variables , where $\kappa _0 \triangleleft _{\mathcal {O}} \dotsm \triangleleft _{\mathcal {O}} \kappa _{6}$ and $<_{\mathcal {O}}$ is the transitive closure of

$$\begin{align*}\{(\kappa_3,\kappa_1),(\kappa_4,\kappa_1),(\kappa_5,\kappa_2),(\kappa_6,\kappa_2),(\kappa_1,\kappa_0),(\kappa_2,\kappa_0)\}.\end{align*}$$

Represented as a tree the $<_{\mathcal {O}}$ -relation is shown in Figure 1. The figure is drawn so that, with the age relation as specified, the “left-of” relation between ${<_{\mathcal {O}}}$ -incomparable variables can be read off directly from the diagram. So $\kappa _3$ is to the left of $\kappa _2,\kappa _4,\kappa _5,\kappa _6$ , while $\kappa _1$ is to the left of $\kappa _2,\kappa _5,\kappa _6$ , etc. The $\prec _{\mathcal {O}}$ relation is thus the strict linear order given by

$$\begin{align*}\kappa_3 \prec_{\mathcal{O}} \kappa_4 \prec_{\mathcal{O}} \kappa_1 \prec_{\mathcal{O}} \kappa_5 \prec_{\mathcal{O}} \kappa_6 \prec_{\mathcal{O}} \kappa_2 \prec_{\mathcal{O}} \kappa_0.\end{align*}$$

To simplify notation we introduce a special symbol $\star $ and write $o(x) = \star $ for an annotation o if $x \notin \mathop {dom} (o)$ . Given an ordinal constraint $\mathcal {O}$ , we extend the order $<_{\mathcal {O}}$ to $\mathcal {O} \cup \{\star \}$ by setting $\kappa <_{\mathcal {O}} \star $ for every ordinal variable $\kappa $ in $\mathcal {O}$ . Note that $\prec _{\mathcal {O}}$ , with its definition extended to incorporate $\star $ , is still a linear order over $\mathcal {O} \cup \{\star \}$ and $\kappa \prec _{\mathcal {O}} \star $ for every ordinal variable $\kappa $ in $\mathcal {O}$ .

Figure 1 A sample constraint.

The semantics of sequents is given as follows.

3.2 Rules and derivations

The sequent calculus we introduce makes use of three operations on constraints: The operation denoted $ \mathcal {O} + \lambda $ extends $\mathcal {O}$ by a fresh variable $ \lambda $ as the youngest element and makes no change to the descendant relation. As a variation, in $ \mathcal {O}+_{\kappa } \lambda $ the variable $ \lambda $ is also added as a child of $\kappa $ . That is, for $\mathcal {O} = ( O , < , \triangleleft )$ , $\lambda \in O$ and $\kappa \in O$ :

$$ \begin{align*} \mathcal{O} + \lambda &= ( O \cup \{ \lambda \} , \mathord< , \mathord \triangleleft \cup \{ ( \rho , \lambda ) \mid \rho \in O \} ), \\ \mathcal{O} +_{\kappa} \lambda &= ( O \cup \{ \lambda \} , \mathord< \cup \{ ( \lambda , \kappa ' ) \mid \kappa \leq \kappa' \} , \mathord \triangleleft \cup \{ ( \rho , \lambda ) \mid \rho \in O \} ). \end{align*} $$

In both the above constructions it is a requirement that $\lambda $ does not occur already in $\mathcal {O}$ .

The third construction is the restriction of a constraint to a set of ordinal variables. Given $\mathcal {O}$ as above and $V \subseteq O$ , we define $\mathcal {O} \setminus V$ to be the constraint

$$\begin{align*}\mathcal{O} \setminus V = ( O' , \mathord < \cap ( O' \times O' ) , \mathord \triangleleft \cap ( O' \times O ') ) \qquad\text{where } O' = O \setminus V. \end{align*}$$

Using these operations we can define the inference rules of our sequent calculus. These are presented in Table 2, where we use the expression $\mathcal {O}(\lambda < \kappa )$ to refer to a constraint $\mathcal {O}$ such that $\lambda <_{\mathcal {O}} \kappa $ . A tree constructed by applications of these rules, and labelled with sequents and names of the rules applied, will be called a derivation. We shall reserve the term proof for derivations satisfying one of several syntactic criteria guaranteeing validity, defined in the following sections. Given a derivation $\Pi $ and a vertex m in $\Pi $ , the sequent labelling m is denoted $\Pi (m)$ .

Table 2 Rules of sequent calculus.

Note that these rules feature no side conditions, besides the obvious constraint that all sequents involved in a rule instance must be bona fide sequents. This means that the $\forall $ -rule satisfies the usual eigenvariable condition: the variable $\lambda $ appearing in the premise cannot occur in the conclusion. If it had occurred in some formula, then by definition of a sequent it should also appear in the constraint, meaning that the constraint $\mathcal {O}+_{\kappa } \lambda $ appearing in the premise would not be well-defined. A similar eigenvariable constraint holds for the rule $\nu (\kappa )$ , and for the same reason. In the same vein, observe that in an application of $\mathsf {lw}$ , for the premise to be a well-formed sequent, no ordinal variable in the set V may occur free in $\Gamma $ .

The reader may have noticed that the cut rule also has a hidden restriction due to the definition of a sequent: the cut formula will never contain an ordinal variable that does not occur in the conclusion. This is not as restrictive as it may at first seem. Cuts can still be used to introduce new ordinal variables in proof search, since the cut formulas may contain quantifiers which can then be instantiated, such as in the following:

The calculus does not feature a rule for introducing an unapproximated least fixed point from an approximant, for instance,

Although sound, the above rule is not necessary for a complete sequent calculus. Without such a rule, derivations have the property that explicitly approximated least fixed points only arise from premises of the cut rule.

Further on we shall frequently need to employ the following minimisation rule:

This rule is easily derived via a cut:

Intuitively, we can view the minimisation rule as expressing a case distinction for how we may construct a counter-model to $\Gamma $ , in particular when $\Gamma $ contains the formula $\varphi [\nu x^{\kappa }\psi /z]$ : either we decide that $\kappa $ is the smallest ordinal approximant of the fixpoint $\nu x \psi $ for which the formula fails to hold, or we introduce a name $\kappa _0$ for smaller ordinal approximant such that $\varphi [\nu x^{\kappa _0}\psi /z]$ fails to hold. In the sequel we shall assume that the minimisation rule is a rule of our proof systems.

3.3 Cyclic proofs

We now present our main notion of a valid proof, which is based on “cyclic” derivations, which can be seen as finite representations of infinite but regular, non-wellfounded proof trees. It is straightforward to show that having no restrictions on allowed cycles trivialises the calculus, allowing any sequent to be derived by a cyclic proof. The notion of cyclic proof therefore comes equipped with a condition on cycles, called the correctness criterion, ensuring only valid sequents are derivable. First, we define more precisely what is meant by a “cycle.”

Note that our requirement that a leaf l is labelled by the same sequent as its companion $c(l)$ entails more than just the same formulas occurring in the leaf and companion. It also implies that the constraints are identical, which means in particular that the relative ages of ordinal variables in leaf and companion are the same. This plays a dual role. On one hand, it facilitates proof search, and will be used extensively in our completeness argument. For this purpose, however, it is not clear that the age ordering needs to be incorporated directly into the definition of a valid proof. We shall see that, in fact, the age ordering also plays a crucial role in ensuring that the proof system is sound. It is for this reason that it is explicitly part of the proof system, rather than just an auxiliary technical device used to prove completeness.

It remains to formulate a criterion for distinguishing valid cyclic proofs from invalid derivations. For our purposes, the correctness criterion can be formulated as a particular instance of the structural rule $\mathsf {lw}$ occurring on the path between companion and leaf. We thus begin with isolating these special instances of weakening, henceforth called resets.

Definition 3.6. The reset rule is any instance of constraint weakening of the form

such that:

1. 1. $\kappa \in \mathcal {O}$ and $\kappa $ does not occur in $\Gamma $ .

2. 2. K is the set of children of $\kappa $ in $\mathcal {O}$ .

Note that, since derivations are assumed to be well formed, the children of $\kappa $ , namely the variables in K above, do not occur in $\Gamma $ .

We can now stipulate the correctness criterion for cyclic proofs.

Examples of cyclic proofs are given in Figures 2 and 3. The former presents a simple case of excluded middle for the formula $\mu y.\, p \vee {\langle {a}\rangle } y$ . The proof involves a single non-axiomatic leaf, denoted by $\ast $ . Along the path from this leaf to its companion (also marked $\ast $ ), the variable $\kappa $ appears in every constraint and is reset. Hence, this path is successful. A cyclic proof of the formula $p \rightarrow \nu x.\, [\breve {a}] x \wedge \mu y.\, p \vee {\langle {a}\rangle } y$ is given in Figure 3. This formula expresses the property that for every $\breve {a}$ -path there is a “returning” a-path. The proof in Figure 3 also displays a single non-axiomatic leaf whose companion is the inner sequent marked as †, though each of the five omitted subproofs of $\overline Y , Y$ also involves an internal leaf-companion pair as per Figure 2. As the variable $\kappa $ occurs in the constraint of every sequent along the connecting path, this leaf is successful. Note that in both examples, the repeating cycles require two applications of the reset rule. The reason for this is that we require leaves and companions to be identical as sequents. This is just a technical convenience; one could instead formulate a weaker condition on leaf-companion pairs, requiring identity only up to a renaming of ordinal variables. Some care is needed to ensure soundness however; the precise formulation of such a condition was worked out in [Reference Afshari, Enqvist and Leigh1].

Figure 2 Cyclic proof of the sequent $\overline {\mu y.\, p \vee {\langle {a}\rangle } y} , \mu y.\, p \vee {\langle {a}\rangle } y$ . The relation of non-axiomatic leaves to companions is denoted by $\ast $ . The proof employs the following abbreviations: Y and $Y^{\kappa }$ denote the formulas $\mu y.\, p \vee {\langle {a}\rangle } y$ and $\mu y^{\kappa }.\, p \vee {\langle {a}\rangle } y$ respectively; constraints are abbreviated to $\kappa $ for $( \{ \kappa \} , \emptyset , \emptyset )$ , $\kappa \kappa '$ for $\kappa +_{\kappa } \kappa '$ and $\kappa \kappa ' \kappa "$ for $(\kappa \kappa ') +_{\kappa '} \kappa "$ .

Figure 3 Cyclic proof of the formula $\overline p \vee \nu x.\, [\breve {a}] x \wedge \mu y.\, p \vee {\langle {a}\rangle } y$ . Subproofs of the sequent $\emptyset : \overline Y , Y$ are as in Figure 2 and omitted. The relation of non-axiomatic leaves to companions is denoted by †. The proof employs the same abbreviations as Figure 2 with, in addition, X and $X^{\kappa }$ denoting formulas $\nu x.\, [\breve {a}] x \wedge Y$ and $\nu x^{\kappa }.\, [\breve {a}] x \wedge Y$ respectively.

For certain proofs in the following, it will be convenient to consider a conditional notion of cyclic proof, i.e., cyclic proofs from assumptions. For this notion of proof it is important to restrict the application of structural rules on paths from the conclusion to assumptions.

We are now ready to state our main result:

The remainder of the paper is devoted to proving Theorem 3.10. Section 4 culminates in the proof of soundness. Completeness is the subject of Sections 5 and 6.

The proof of completeness of the cyclic proof system relies on completeness of non-wellfounded proofs, where the correctness condition on infinite branches is stipulated in terms of infinite descending chains of ordinal variables in the controls of sequents along infinite paths. In their most general formulation, completeness for such proofs is easy to prove, but not very helpful towards proving the main theorem since non-wellfounded proofs can be highly non-regular without any bound on the size of sequents in a proof tree.

Therefore, we isolate a sub-class of non-wellfounded proofs, called slim proofs, which, although not finitely presentable in general, are in an important sense closer to the finitary notion of provability: in slim proofs, the number of formulas that can appear in sequents is bounded. Constraints, however, can grow without bound. Finitising the constraints is the second step towards obtaining a cyclic proof for a valid sequent. Completeness with respect to slim proofs is established via a two-player game that we call the mosaic game, in which one player (Prover) tries to construct a proof of the root formula, and the opposing player (Refuter) attempts to build a counter-model by selecting certain “saturated” sequents called tiles.

With completeness of slim proofs in place, the next step is to insert uses of the reset rule in order to bound the size of constraints. This transformation alters the correctness condition on infinite paths from an infinite descent condition to an infinitary version of the reset condition from cyclic proofs: every infinite branch features some ordinal variable that is reset infinitely often. The final step of the completeness argument is to show that any non-wellfounded slim derivation satisfying the infinite reset condition can be pruned to a finite, cyclic proof.

3.4 Non-wellfounded proofs

In the proof of completeness for cyclic derivations we will make extensive use of an intermediate notion of proof based on infinite, or non-wellfounded, derivations. In analogy with the case of cyclic proofs, an infinite derivation will be considered a proof provided every infinite path in the derivation fulfils a syntactic criterion. Later we will consider infinite proofs where correctness is based on an (infinitary) notion of reset variable. For now we introduce the concept of an infinite descent proof where the requirement on infinite paths is that the sequence of constraints in the path induces an infinite descending sequence of ordinal variables.

5.1 Slim proofs

We start by defining the notion of a slim proof.

Observe that because infinite branches in slim proofs do not contain applications of $\mathsf {lw}$ the set of ordinal variables in the constraint only grows as we move along the branch. We can thus define the following notion of the limit constraint of a branch:

It is clear that in slim proofs an infinite $<$ -descending chain of ordinals in a branch $\beta $ , according to Definition 3.11 is the same as an infinite descending chain in the order $<_{\beta }$ , according to the usual definition of an infinite descending chain in some order. The same holds for infinite $\prec $ -descending chains.

Proof It is clear that it suffices to prove this result for the orders $\prec _{\beta }$ and $<_{\beta }$ from Definition 5.4. We write $\mathcal {O}, \prec , <$ , and $\triangleleft $ for $\mathcal {O}_{\beta }, \prec _{\beta }, <_{\beta }$ , and $\triangleleft _{\beta }$ , respectively. The direction from right to left follows directly from the definitions of $<_{\beta }$ and $\prec _{\beta }$ and the relation between $<_i$ and $\prec _i$ at any finite $i \in \omega $ .

For the direction from left to right assume that we have an infinite descending chain $\kappa _0 \succ \kappa _1 \succ \cdots $ of ordinal variables in $\mathcal {O}$ . The aim is to use König’s lemma to prove that there is an infinite descending chain in $<_{\mathcal {O}_{\beta }}$ .

Consider the following set of variables from $\mathcal {O}$ :

$$\begin{align*}F = \{ \lambda \in \mathcal{O} \mid \lambda \geq \kappa_i \mbox{ for some } i \in \omega\}. \end{align*}$$

Because by Proposition 5.5 $<$ is upwards linear and conversely well-founded we can consider F to be a forest under the order $<$ . The set F is infinite because it contains the infinitely many distinct $\kappa _i$ for $i \in \omega $ . We first show that there is an infinite subset $T \subseteq F$ that is a tree under $<$ .

Claim 2. There are only finitely many $<$ -maximal elements in F.

Proof of Claim 2

First, note that because F is upwards closed in $<$ the concepts of being $<$ -maximal and of being $<$ -maximal in F coincide. Assume then for a contradiction that there are infinitely many $<$ -maximal elements in F. Because $\triangleleft $ is a linear order and it is well-founded this means that we can build an infinite chain $\delta _0 \triangleleft \delta _1 \triangleleft \cdots $ of $<$ -maximal elements in F. By definition of F we have for each $i \in \omega $ some $k_i \in \omega $ such that $\kappa _{k_i} \leq \delta _i$ . It follows by item 5 of Proposition 5.5 that there is an infinite ascending $\kappa _{k_0} \prec \kappa _{k_1} \prec \cdots $ . But because of the infinite descending chain $\kappa _0 \succ \kappa _1 \succ \cdots $ , this contradicts the fact that $\prec $ is a partial order.

It follows by the pigeonhole principle that there must be one $<$ -maximal element r below which there are infinitely many elements from F. We define the set $T \subseteq F$ to be all those elements from F that are $<$ -smaller than r. The set T is an infinite tree under the order $<$ . The claim of the proposition then follows by König’s lemma if we can show that this tree T is finitely branching. This is shown in the following claim:

Claim 3. Every variable $\lambda \in T$ has only finitely many $<$ -children in T.

Proof of Claim 3

Assume for a contradiction that some $\lambda \in T$ has infinitely many $<$ -children in T. Because $\triangleleft $ is a linear order and it is well-founded this means that we can build an infinite chain $\delta _0 \triangleleft \delta _1 \triangleleft \cdots $ of $<$ -children of $\lambda $ with $\delta _i \in T$ for all i. By the definition of T we can find, for every $i \in \omega $ , some $k_i \in \omega $ such that $\kappa _{k_i} \leq \delta _i$ . It follows by item 5 of Proposition 5.5 that $\kappa _{k_0} \prec \kappa _{k_1} \prec \cdots $ , because as the $\delta _i$ are $<$ -siblings they must be $<$ -greatest ancestors of the $\kappa _{k_i}$ without being each other’s ancestors. But this contradicts the fact that $\prec $ is a partial order and the assumption that $\kappa _0 \succ \kappa _1 \succ \cdots $ .

This finishes the proof of Proposition 5.6.

A basic property of slim proofs that will be useful is the provability of the following generalized version of excluded middle:

Proof The proposition is proved by a formula induction, which we illustrate by considering the case where $\varphi = \nu x^{\kappa _0} \psi $ .

By the inductive hypothesis there is a slim proof $\Pi $ for any sequent $\mathcal {O}': \psi ', \overline {\psi '[\sigma ]}$ , where $\psi '$ is the formula $\psi [p/x]$ , for some fresh proposition letter p. Let $\Pi '$ be the derivation we obtain from $\Pi $ by replacing every occurrence of p with the formula $\nu x^{\kappa _1} \psi $ , and every occurrence of $\overline {p}$ with the formula $\mu x^{\kappa _0} \overline {\psi [\sigma ]}$ . Now consider the following derivation $\Pi _1$ (where we write $\lambda $ for $\sigma (\kappa _0)$ ):

Note that $\Pi _1$ need not be a proof, since there may be leaves in $\Pi _1$ , that were labeled in $\Pi '$ by an axiom $\mathcal {O}': p, \overline {p}$ , but in $\pi _1$ are labeled with the sequent $\mathcal {O}': \nu x^{\kappa _1} \psi , \mu x^{\kappa _0} \psi [\sigma ]$ . However, to any such leaf we may apply the same construction that we just described, with $\sigma [\kappa _0/\kappa _1]$ taking the role of $\sigma $ . Iterating this procedure we arrive at a slim proof in which any newly created infinite branch carries an infinitely descending sequence of variables $\cdots < \kappa _2 < \kappa _1 < \kappa _0$ .

The following is an immediate corollary of Proposition 5.7.

The remainder of this section is devoted to proving completeness for slim proofs (Theorem 5.28). The proof is carried out in several steps, so a high-level sketch may be helpful:

The first step is to define a particular kind of sequents, called tiles, that will be used as building blocks from which we construct a counter-model to a given formula that is not provable. Tiles are saturated sequents of a bounded size, where the saturation conditions are intended to mimic the conditions under which all formulas in the sequent are false; for example if a disjunction is present in the sequent, both disjuncts should be false, and if a formula $\forall \lambda < \kappa \varphi (\lambda )$ is present in the sequent then there should be some witness $\xi $ for which $\varphi (\xi )$ is false. However, adding such saturation conditions naïvely—e.g., if the sequent contains $\forall \lambda < \kappa \varphi (\lambda )$ then it contains $\varphi (\xi )$ for some $\xi < \kappa $ —would quickly destroy any hopes of maintaining a bound on the number of formulas appearing in a sequent. The appropriate saturation conditions have to be formulated carefully; the precise definition is Definition 5.13.

Completeness is proved in Section 5.4. A determined two-player game called the mosaic game is defined, in which “Prover” tries to produce a slim proof of a given formula, and the opposing player “Refuter” tries to construct a counter-model from tiles. The most difficult part of the completeness proof is to show that a winning strategy for Refuter actually provides a counter-model. To get some intuition about what the difficulty is, and how it is handled, consider a formula $[{a}]\nu x^{\kappa } \langle \breve {a}\rangle \varphi (x)$ , and say that Refuter is trying to construct a counter-model for some tile $\Gamma $ containing this formula. In the mosaic game, Prover can “attack” the box $[{a}]$ and ask Refuter to present some tile $\Psi $ which is to be ${a}$ -accessible from $\Gamma $ , and contains $\nu x^{\kappa } \langle \breve {a}\rangle \varphi (x)$ . In order to falsify $\nu x^{\kappa } \langle \breve {a}\rangle \varphi (x)$ at $\Psi $ , Refuter has to saturate by adding some child $\lambda $ of the variable $\kappa $ to the constraint of $\Psi $ , along with the formula $\langle \breve {a} \rangle \varphi (\nu x^{\lambda } \langle \breve {a} \rangle \varphi (x))$ . So here, the variable $\kappa $ has progressed to the “smaller” $\lambda $ . But if $\Psi $ was to be ${a}$ -accessible from $\Gamma $ , this means that Refuter has to make sure that the formula $\nu x^{\lambda } \langle \breve {a} \rangle \varphi (x)$ is false at $\Gamma $ . In other words, already when the tile $\Gamma $ was constructed, Refuter has to anticipate that the variable $\kappa $ will progress due to later steps in the counter-model construction.

The solution to handling this sort of back-and-forth behaviour is to make sure that $\Gamma $ already contains some formula which is “as good as” the formula $\nu x^{\lambda } \langle \breve {a} \rangle \varphi (x)$ , in some sense. It is quite tricky to formulate an appropriate saturation condition corresponding to this intuition. The notion of a minimality assumption introduced in Definition 5.9 will be the key concept used to handle this, with the saturation condition given in Definition 5.13. Definition 5.17 defines a notion of ${a}$ -successor of a tile, which is intended to capture the coherence conditions we require of the ${a}$ -accessibility relation in the counter-model construction used in the completeness proof. The key technical result that is used to handle the difficulty sketched above is Proposition 5.24, which captures the sense in which a tile anticipates progressions of ordinal variables that may occur in its ${a}$ -successors.

5.2 Pre-tiles and tiles

Our completeness proof for slim proofs will build a counter-model for an unprovable formula out of building blocks that we call tiles, which are essentially “small” but saturated sequents. The precise notion of “saturated” that we will use is quite technical, since a naïve concept of saturation would be incompatible with maintaining a bound on the number of formulas appearing in a sequent. It will be convenient to first define the notion of a “pre-tile” to capture the general structure of the sequents that we will be working with, and then define a tile as a pre-tile that satisfies appropriate saturation conditions.

Observe that, for every plain formula $ \varphi $ , adding the empty constraint yields an example of a pre-tile, viz., $\emptyset : \varphi $ . Note that this pre-tile is of a special shape: the negative part and the set of minimality assumptions are empty. In general we can think of the partition of pre-tiles into these three parts—positive, negative, and minimality assumptions—as keeping track of the different roles that formulas play in the completeness proof. The positive part of a pre-tile is the “main” part in a sense; our goal from the start is to construct a counter-model to the positive part of a pre-tile of the form $\emptyset : \varphi $ . Along the way, assumptions may be introduced via cuts. In a two-sided sequent notation we can think of pre-tiles as sequents of the shape:

$$\begin{align*}\mathcal{O} : \Gamma, \Delta \Rightarrow \Theta,\end{align*}$$

where $\Delta , \Theta $ consist of positively annotated formulas, and $\Gamma $ consists of formulas of the form $\forall \lambda < \kappa \;\psi $ where $\psi \in \Theta $ . The function of the sets $\Gamma ,\Delta $ is essentially to constrain what formulas can belong to the positive part ( $\Theta $ ) without making the sequent provable. A formula $\psi \in \Delta $ belonging to the negative part ensures that $\psi $ cannot belong to the positive part, or “on the right-hand side” of the sequent, since that would result in a trivially provable sequent. Similarly, a minimality assumption $\forall \lambda < \kappa \;\psi (\lambda ) \in \Gamma $ ensures that $\Theta $ cannot contain the formula $\psi (\xi )$ for any $\xi <_{\mathcal {O}} \kappa $ , since that would also make the sequent provable.

We can now prove that small $\rho $ -pre-tiles are indeed small in the sense that there is a bound on the number of formulas that they contain.

Note that essentially the same proof with some minor modifications can be used to show that, for any slim proof $\Pi $ , there is a bound on the number of formulas that can occur in any sequent in $\Pi $ up to renaming of bound ordinal variables. We sometimes abuse notation by writing just $\Gamma $ instead of $\mathcal {O} : \Gamma $ . In such cases we let $\mathcal {O}(\Gamma )$ denote $\mathcal {O}$ . From now on, without further mention we will equate formulas that differ only by a renaming of bound variables, and similarly we count two pre-tiles as the same if they are equal up to renaming of bound ordinal variables.

The last condition in Definition 5.13 expresses a saturation condition corresponding to the minimisation rule. We can understand it semantically as follows: suppose we wish to construct a counter-model for the unprovable sequent $\mathcal {O}: \Gamma $ , where $\varphi (\nu x^{\kappa }\psi ) \in \Gamma $ (or some $\preceq $ -smaller formula belongs to $\Gamma $ ). By the minimisation rule, either $\mathcal {O} : \Gamma , \exists \lambda < \kappa : \overline {\varphi }(\mu x^{\lambda } \overline {\psi })$ is unprovable, or $\mathcal {O}+_{\kappa } \kappa _0 : \Gamma , \varphi (\nu x^{\kappa _0}\psi )$ is unprovable. In either of these two sequents, we have more information about how the ordinal variable $\kappa $ must be evaluated in a refuting model. In any counter-model for $\mathcal {O} : \Gamma , \exists \lambda < \kappa : \overline {\varphi }(\mu x^{\lambda } \overline {\psi })$ , we know that $\kappa $ has to be evaluated as the smallest ordinal that refutes $\varphi (\nu x^{\kappa } \psi )$ . Otherwise it would not be a counter-model, as the formula $\exists \lambda < \kappa : \overline {\varphi }(\mu x^{\lambda } \overline {\psi })$ would be true. In a counter-model for the sequent $\mathcal {O}+_{\kappa } \kappa _0 : \Gamma , \varphi (\nu x^{\kappa _0}\psi )$ , the opposite holds: there is some ordinal smaller than the value of $\kappa $ that refutes the formula $\varphi (\nu x^{\kappa } \psi )$ , and we have introduced a fresh name $\kappa _0$ for this ordinal.

In the next subsection we will show how an unprovable pre-tile can be “saturated” to an unprovable tile. For technical reasons it will be necessary to be careful with how this saturation is carried out, so that a given pre-tile stands in a suitable relationship to the corresponding tiles. This relationship $\preceq $ is spelled out in the following definition; intuitively, we can read $\Psi \preceq \Gamma $ as “ $\Psi $ is at least as saturated as $\Gamma $ .”

Proof Reflexivity is trivial ( $\Gamma \preceq _{\emptyset } \Gamma $ ), so we check transitivity. Let $\Gamma _2 \preceq _{L_1} \Gamma _1 \preceq _{L_0} \Gamma _0$ . We show that $\Gamma _2 \preceq _{L_0 \uplus L_1} \Gamma _0$ , checking each condition individually.

1. We have

$$ \begin{align*} \mathrm{OV}(\mathcal{O}(\Gamma_2)) & = \mathrm{OV}(\mathcal{O}(\Gamma_1)) \uplus L_1 \\ & = \mathrm{OV}(\mathcal{O}(\Gamma_0)) \uplus L_0 \uplus L_1. \end{align*} $$

2. Straightforward.

3. We have

$$ \begin{align*} \mathrm{Act}(\Gamma_2) & \subseteq \mathrm{Act}(\Gamma_1) \uplus L_1 \\ & \subseteq \mathrm{Act}(\Gamma_0) \uplus L_0 \uplus L_1. \end{align*} $$

4. No variable in $L_0$ is older than any variable in $\mathcal {O}(\Gamma _0)$ , and no variable in $L_1$ is older than any variable in $\mathcal {O}(\Gamma _1)$ . But $\mathcal {O}(\Gamma _1) = \mathcal {O}(\Gamma _0) \uplus L_0$ , so this means that no variable in $L_1$ is older than any variable in $\mathcal {O}(\Gamma _0)$ . Hence no variable in $L_0 \uplus L_1$ is older than any variable in $\mathcal {O}(\Gamma _0)$ .

5. No variable in $L_0$ is an ancestor of any variable in $\mathcal {O}(\Gamma _0)$ , and no variable in $L_1$ is an ancestor of any variable in $\mathcal {O}(\Gamma _1)$ . But $\mathcal {O}(\Gamma _1) = \mathcal {O}(\Gamma _0) \uplus L_0$ , so this means that no variable in $L_1$ is an ancestor of any variable in $\mathcal {O}(\Gamma _0)$ . Hence no variable in $L_0 \uplus L_1$ is an ancestor of any variable in $\mathcal {O}(\Gamma _0)$ .

6. Suppose $\kappa \in \mathcal {O}(\Gamma _0)$ and $\lambda \in L_0 \uplus L_1$ , where $\lambda <_{\mathcal {O}(\Gamma _2)} \kappa $ . If $\lambda \in L_0$ then since $\Gamma _1 \preceq _{L_0} \Gamma _0$ it follows that there is some $\lambda ' \in \mathrm {Act}(\Gamma _0)$ such that $\lambda <_{\mathcal {O}(\Gamma _1)} \lambda ' \leq _{\mathcal {O}(\Gamma _1)} \kappa $ . But then $\lambda <_{\mathcal {O}(\Gamma _2)} \lambda ' \leq _{\mathcal {O}(\Gamma _2)} \kappa $ as well. If $\lambda \in L_1$ , then since $\kappa \in \mathcal {O}(\Gamma _1)$ and $\Gamma _2 \preceq _{L_1} \Gamma _1$ , there is some $\lambda ' \in \mathrm {Act}(\Gamma _1)$ such that $\lambda <_{\mathcal {O}(\Gamma _2)} \lambda ' \leq \kappa $ . But $\mathrm {Act}(\Gamma _1) \subseteq \mathrm {Act}(\Gamma _0) \uplus L_0$ . If $\lambda ' \in \mathrm {Act}(\Gamma _0)$ then we are done. If $\lambda ' \in L_0$ , then $\lambda ' <_{\mathcal {O}(\Gamma _1)} \kappa $ and so since $\Gamma _1 \preceq _{L_0} \Gamma _0$ there is some $\lambda " \in \mathrm {Act}(\Gamma _0)$ such that $\lambda ' <_{\mathcal {O}(\Gamma _1)} \lambda " \leq _{\mathcal {O}(\Gamma _1)} \kappa $ . But then we have

$$ \begin{align*}\lambda <_{\mathcal{O}(\Gamma_1)} \lambda' <_{\mathcal{O}(\Gamma_1)} \lambda" \leq_{\mathcal{O}(\Gamma_1)} \kappa\end{align*} $$

and so we are done.

7. Let $\varphi \in \Gamma _0^+$ . Since $\Gamma _1 \preceq \Gamma _0$ there is some formula $\varphi ' \in \Gamma _1^+$ such that $\varphi ' \preceq _{\mathcal {O}(\Gamma _1)} \varphi $ . Since $\Gamma _2 \preceq \Gamma _1$ there is some formula $\varphi " \in \Gamma _2^+$ such that $\varphi " \preceq _{\mathcal {O}(\Gamma _2)} \varphi '$ . But clearly $\varphi ' \preceq _{\mathcal {O}(\Gamma _1)} \varphi $ entails $\varphi ' \preceq _{\mathcal {O}(\Gamma _2)} \varphi $ , so transitivity of $\preceq _{\mathcal {O}(\Gamma _2)}$ we get $\varphi " \preceq _{\mathcal {O}(\Gamma _2)} \varphi $ .