main.tex

\documentclass[a4paper,names,dvipsnames]{article}

\usepackage[T1]{fontenc}
\usepackage[colorinlistoftodos]{todonotes}
\usepackage[inference]{semantic}
\usepackage{mathrsfs}
\usepackage{mathtools}
\usepackage{xcolor}
\usepackage{hyperref}
\usepackage{glossaries}
\usepackage{enumerate}
\usepackage{enumitem}
\usepackage{amsmath}
\usepackage{amsthm}
\usepackage{amssymb}
\usepackage{stmaryrd}
\usepackage{marvosym}
\usepackage{halloweenmath}
\usepackage[capitalize]{cleveref}
\usepackage{bm}
\usepackage{xspace}
\usepackage{etoolbox}
\usepackage{natbib}
\usepackage{xfrac}
\usepackage{graphicx}
\usepackage{adjustbox}
\usepackage{scontents}
\usepackage{comment}
\usepackage{fontawesome5}

% workaround to use extpfeil and stmaryrd together.
% see https://tex.stackexchange.com/questions/297108/
\expandafter\def\csname opt@stmaryrd.sty\endcsname
{only,shortleftarrow,shortrightarrow}
\usepackage{extpfeil}

\usepackage{tikz}
\usetikzlibrary{positioning,calc}

\newtheorem{example}{Example}
\newtheorem{definition}{Definition}
\newtheorem{lemma}{Lemma}
\newcounter{theoremcounter}
\newtheorem{theorem}[theoremcounter]{Theorem}

\input{includes}
\makeglossaries

\newcommand{\MK}[1]{}
\newcommand{\MP}[1]{}

% Definition of Ddots
\makeatletter
\def\Ddots{\mathinner{\mkern1mu\raise\p@
\vbox{\kern7\p@\hbox{.}}\mkern2mu
\raise4\p@\hbox{.}\mkern2mu\raise7\p@\hbox{.}\mkern1mu}}
\makeatother

\begin{document}
\tableofcontents
\printglossaries
\clearpage

\section{Preliminaries}

In comparison to the paper, some notation is different. 
This document should be considered work-in-progress, we want to make sure both the report and the paper use similar notation. 
A non-exhaustive description of differences is: compilers are not $\gamma$, but $\mmlAmmlAtcomp{\bullet}$.
Trace relations are written $\xlangtraceeq{}{}$ or $\tospecificevs{\bullet}$.




\begin{definition}[Events]\label{def:events}
  $\events$ is the set of atomic propositions hereby called events or actions.
  The internal action is $\emptyevent$.
  The action $\terminationevent$ is program termination.
\end{definition}


We assume that any programming language can be enriched with a self-composition operator in the style of \cite{barthe11}.
Furthermore, we also assume the existence of a low-equivalence relation that distinguishes program states only by their public memory.
Two traces $\trace_{1}$,$\trace_{2}$ are low-equivalent $\loweq{\trace_{1}}{\trace_{2}}$ iff all their public events coincide.

\begin{definition}[Programming Languages]\label{def:pl}
A programming language is a tuple $\left(\partials,\wellf,\singlestep,\linker\right)$ s.t.:

\begin{itemize}
  \item[$\partials$] : Set - is a set of admissible, partial programs.
  \item[$\wellf$] : $\partials$ - a judgement that holds iff a program is not partial.
  \item[$\singlestep$] : $\wholes\to\events\to\wholes$ - a step relation, where $\wholes=\{w\in\partials\ |\ \wellf w\}$.
        For $e\in\events$ and $p,p'\in\wholes$ we say for $\estep{p}{e}{p'}$ that program $p$ performs a step with action $e$ to program $p'$.
        If $e=\emptyevent$, we write $\step{p}{p'}$.
        In case $e=\terminationevent$, we write $\terminates{p}$.
  \item[$\linker$] : $\partials\to\partials\to\partials$ - links two partial programs together in some way, resulting in a new partial program.
\end{itemize}
\end{definition}
Let $\src{S},\irl{I},$ and $\trg{T}$ be any programming language.

% if we get τ1 and τ2, then there is aontehr program that does τ3 which does τ1 and τ2 in parallel
% define self-composition. and then define it with respect to low-equivalent programs
%

\begin{definition}[Notation for Sequences]
  For any sequence of events, let $\seqnil$ denote the empty sequence and $\seqcons{e}{\bar{t}}$ the sequence that starts with $e$ and continues with $\bar{t}$.
  Hereby, it does not matter whether $\bar{t}$ is finite or infinite, it's merely syntactic sugar to work on sequences of events.
\end{definition}

\begin{definition}[Traces]
  A trace $\trace$ is an infinite sequence of events that results from the relation $\singlestep$.
  That is, we obtain the trace $\trace=\seqcons{e_{0}}{\seqcons{e_{1}}{\dots}}$ for the execution sequence $\estep{p}{e_{0}}{\estep{p'}{e_{1}}{\dots}}$ and write $\mktrace{p}{\trace}$.
  The set of all traces is $\traces$.
\end{definition}
\noindent
We assume $\lightning$ to occur in traces representing terminating programs such that it occurs infinitely often in a one-by-one sequence.

\begin{definition}[Once]
  Given an event $\event$ and a trace $\trace$, we say $\event$ appears exactly once in the trace, written $\event\in_{!}\trace$, iff

  If $n\in\nat$ such that $\trace{[n]}=\event$, then for any $m\in\nat$ such that $\trace{[m]}=\event$ we have $n = m$.
\end{definition}

\begin{definition}[Before]
  Given two events $\event[_0],\event[_1]$ and a trace $\trace$, event $\event[_0]$ occurs before $\event[_1]$ in $\trace$, written
  $\event{_0}\le_{\trace}\event{_1}$, iff

  If $n\in\nat$ such that $\trace{[n]} = \event[_{0}]$, then $\exists m\in\nat, \trace{[m]} = \event[_1] \wedge n< m$
\end{definition}


\begin{definition}[Finite Trace Prefixes]
  A finite sequence of events $m$ is a finite trace prefix of $\trace$ iff it satisfies the following judgement.

  $$
    \inference{}{\cdot\le\trace}\hspace{2em}\inference{m\le\trace}{\seqcons{e}{m}\le \seqcons{e}{\trace}}
  $$
\end{definition}

\begin{definition}[Behavior]
  The behavior of a whole program $p$ is a set of all traces it produces, i.e. $\behav{p}=\{\trace\ |\ \mktrace{p}{\trace}\}$.
\end{definition}

\begin{definition}[Observation]
  An observation is a finite set of finite trace prefixes.
  We say that an observation $o$ is the prefix of a behavior $b$ iff $$\forall m\in o.\exists \trace\in b.m\le t$$.
\end{definition}

\begin{definition}[Properties]
  A property $\prop$ is a set of admissible traces. For a program $p$ to satisfy $\prop$ it must not produce a trace that is not part of $\prop$. Thus, $p$ satisfies $\prop$ iff $\behav{p}\subseteq\prop$ and we write $\sat{p}{\prop}$.
\end{definition}

\begin{definition}[Hyperproperties]
  A hyperproperty $H$ is a set of admissible sets of traces. Thus, if $p$ satisfies $H$ (also written $\sat{p}{H}$), then $\behav{p}\in H$.
\end{definition}

\begin{lemma}[Lifting Properties]
  Given a property $\pi$, there exists a unique hyperproperty $\lift{\pi}$ that satisfies the exact same policy.
\end{lemma}
\begin{proof}
  We want $\forall p \in\partials, \sat{p}{\prop}\equiv\sat{p}{\lift{\prop}}$.
  Henceforth, given a $p\in\partials$, we have $\behav{p}\subseteq\prop$ iff $\behav{p}\in\lift{\prop}$.
  Note that if $\behav{p}\subseteq\prop$, we have $\behav{p}\in\left\{\Pi\ |\ \Pi=\behav{p}\subseteq\prop\right\}$.
  Thus, $\lift{\prop}$ is the set of all possible program behaviors that are a subset of $\prop$.
  This is exactly the powerset of $\prop$ and we conclude $\lift{\prop}=\powerset{\prop}$.
\end{proof}
\noindent
The lifting of properties to a singleton set does not suffice, since the empty behavior trivially satisfies any property $\emptyset\subseteq\prop=\{\trace\}$, but if we would define $\lift{\trace}=\{\{\trace\}\}$, then $\emptyset\not\in\lift{\trace}$.

\begin{lemma}[Property Satisfaction Refinement]
  For a property $\prop$ that refines $\prop'$, i.e. $\prop\subseteq\prop'$, if any $p\in\partials$ satisfies $\sat{p}{\prop'}$, then $\sat{p}{\prop}$.
\end{lemma}
\begin{proof}
  Pick any property $\prop'$ and $p\in\partials$ such that $\sat{p}{\prop}$ and assume $\prop\subseteq\prop'$.
  Simple unfolding reveals $\behav{p}\subseteq\prop\implies\behav{p}\subseteq\prop'$.
\end{proof}
\noindent
For lifted properties, this refinement property also holds on the hyperproperty level.
However, it does not work for any hyperproperty~\cite{clarkson08}.

\begin{definition}[Robust Property Satisfaction]
  A program $p$ robustly satisfies a property $\prop$, written $\rsat{p}{\prop}$, iff $\forall C\in\partials,\sat{C\linker p}{\prop}$. The same notation is used for robust hyperproperty satisfaction.
\end{definition}

\begin{lemma}[Weakening Robust Satisfaction]\label{lem:weaken-rsat}
  Given classes $\cC_{1}, \cC_{2}$ and any program $p$ such that
  \begin{assumptions}
    \item\label{lem:weaken-rsat:ass:a} $\cC_{1}\subseteq\cC_{2}$
    \item\label{lem:weaken-rsat:ass:b} $\rsat{p}{\cC_{2}}$
  \end{assumptions}
  We show
  \begin{goals}
    \item\label{lem:weaken-rsat:goal:i} $\rsat{p}{\cC_{1}}$
  \end{goals}
\end{lemma}
\begin{proof}
  Unfolding \Thmref{lem:weaken-rsat:goal:i}, let $\Pi\in\cC_{2}$ and $p$ be a program, we want to show that $\rsat{p}{\Pi}$.
  By \Thmref{lem:weaken-rsat:ass:a}, we also know that $\Pi\in\cC_{1}$.
  Thus, we can use \Thmref{lem:weaken-rsat:ass:b} to conclude.
\end{proof}

\begin{definition}[Classes]
  A class of hyperproperties $\cC$ is a set of hyperproperties.
  Likewise, a class of properties $\cC$ is a set of hyperproperties, where every property is lifted to the hyperproperty level.
  From now on, we use $\Pi$ for elements of any class $\cC$ in case it does not matter whether it is a lifted property or any hyperproperty.
\end{definition}

\begin{definition}[Compilers]
  A compiler between languages $\S$ and $\T$ is a partial function $\stcomp{\bullet}$ from $\src{\partials}$ to $\trg{\partials}$.
\end{definition}

\section{Compositionality of Secure Compilers}

\begin{definition}[Universal Image]\label{def:sigma}
  \[
  \sigma_{\sim}(\trg{\pi}) = \left\{ \src{\trace} | \forall\trg{\trace},\src{\trace}\sim\trg{\trace}\implies\trg{\trace}\in\trg{\pi}\right\}
\]
\end{definition}
\begin{definition}[Existential Image]\label{def:tau}
  \[
  \tau_{\sim}(\src{\pi}) = \left\{ \trg{\trace} | \exists\src{\trace},\src{\trace}\sim\trg{\trace}\wedge\src{\trace}\in\src{\pi}\right\}
\]
\end{definition}

\begin{definition}[Robust Trace-Hyperproperty Preservation with Universal Image]\label{def:rtp:sigma}
  For a given class $\trg{\cC}$, a compiler from languages $\S$ to $\T$ robustly preserves $\trg{\cC}$ iff
  $$
  \forall\trg{\Pi}\in\trg{\cC},\forall\src{p}\in\src{\partials},\rsat{\src{p}}{\sigma_{\sim}(\trg{\Pi})}\implies\rsat{\stcomp{\src{p}}}{\trg{\Pi}}
  $$
  We write $\rtpsigma{\stcomp{\bullet}}{\trg{\cC}}$.
\end{definition}


\begin{definition}[Robust Trace-Hyperproperty Preservation with Existential Image]\label{def:rtp:tau}
  For a given class $\cC$, a compiler from languages $\S$ to $\T$ robustly preserves $\src{\cC}$ iff
  $$
  \forall\src{\Pi}\in\src{\cC},\forall\src{p}\in\src{\partials},\rsat{\src{p}}{\src{\Pi}}\implies\rsat{\stcomp{\src{p}}}{\tau_{\sim}(\src{\Pi})}
  $$
  We write $\rtptau{\stcomp{\bullet}}{\src{\cC}}$.
\end{definition}

\begin{definition}[Robust Trace-Hyperproperty Preservation]\label{def:rtp}
  For a given class $\cC$, a compiler from languages $\S$ to $\T$ robustly preserves $\cC$ iff
  $$
  \forall\Pi\in\cC,\forall\src{p}\in\src{\partials},\rsat{\src{p}}{\Pi}\implies\rsat{\stcomp{\src{p}}}{\Pi}
  $$
  We write $\rtp{\stcomp{\bullet}}{\cC}$.
\end{definition}

\begin{definition}[Sequential Composition of Compilers]
  Given two compilers $\sicomp{\bullet}$ and $\itcomp{\bullet}$, their sequential composition is $\sitcomp{\bullet}=\itcompN{\sicomp{\bullet}}$.
\end{definition}
% we can propagate through the assumptions from src langs to intermediate langs
%

\begin{lemma}[Weakening RTP]\label{lem:weaken}
  Given classes $\cC_{1}, \cC_{2}$ such that
  \begin{assumptions}
    \item $\cC_{1}\subseteq\cC_{2}$
    \item $\rtp{\stcomp{\bullet}}{\cC_{2}}$
  \end{assumptions}
  We show
  \begin{goals}
    \item $\rtp{\stcomp{\bullet}}{\cC_{1}}$
  \end{goals}
\end{lemma}
\begin{proof}
  Using \Cref{def:rtp} on the goal, let $\Pi\in\cC_{1}$ and $\src{p}\in\src{\partials}$ such that $\rsat{\src{p}}{\Pi}$, so what's left to prove is $\rsat{\stcomp{p}}{\Pi}$.
  Since $\cC_{1}\subseteq\cC_{2}$ and $\Pi\in\cC_{1}$, we know that $\Pi\in\cC_{2}$.
  Thus, we can apply the assumption $\rtp{\stcomp{\bullet}}{\cC_{2}}$ to our goal, leaving us with $\rsat{\src{p}}{\Pi}$ to show, which was an assumption we made.
\end{proof}

\begin{definition}[Well-formedness of $\sim$ for a Class $\src{\cC}$]\label{def:wfc:tau:tracerel}
  % $$

  \[
    \wfctau{\sim}{\src{\cC}} := \forall \src{\pi}\in\src{\cC}, \tau_{\sim}(\src{\pi})\in\tau_{\sim}(\src{\cC})
  \]
  % $$
\end{definition}
\begin{definition}[Well-formedness of $\sim$ for a Class $\trg{\cC}$]\label{def:wfc:sig:tracerel}
  % $$

  \[
    \wfcsig{\sim}{\trg{\cC}} := \forall \trg{\pi}\in\trg{\cC}, \sigma_{\sim}(\trg{\pi})\in\sigma_{\sim}(\trg{\cC})
  \]
  % $$
\end{definition}

\begin{definition}[Safety Properties]
  The class of safety properties contains the lifting of all properties that can be refuted with a finite trace prefix:
  $$
  \cSafety = \left\{\lift{\prop}\ |\ \forall \trace\in\traces, t\not\in\lift{\prop} \text{ iff } \exists m\ge\trace,\forall \trace'\in\traces,m\le\trace'\implies\trace'\not\in\lift{\prop}\right\}
  $$
\end{definition}

\begin{definition}[Hypersafety Properties]\label{def:hsafety}
  The class of hypersafety properties contains all hyperpropert that can be refuted with an observation:
  $$
  \cHSafety = \left\{\Pi\ |\ \forall b\in 2^{\traces},b\not\in\Pi\text{ iff  }\exists o\ge b,\forall b'\in 2^{\traces},o\le b'\implies b'\not\in\Pi\right\}
  $$
\end{definition}

\begin{definition}[Subset Closed Hyperproperties]
  The class of hyperproperties that are closed with respect to the subset relation is
  $$
  \cSS = \left\{H\ |\ \forall X\in H, \forall Y\subseteq X, Y \in H\right\}
  $$
\end{definition}

\begin{lemma}[Hypersafety is entailed in SSC]
  $\cHSafety\subseteq\cSS$.
\end{lemma}
\begin{proof}
  \cite{clarkson08}
\end{proof}

\begin{definition}[K-Hypersafety]
  Exactly the same as \Cref{def:hsafety}, but the observations $o$ are restricted to cardinality $k$.
  2-Hypersafety is simply $k=2$. \Cref{def:ni} gives an example instance of a classic 2-hypersafe property.
\end{definition}

\begin{definition}[Non-Interference ($\Ni$)]\label{def:ni}
  We define the class containing the non-interference hyperproperty as:
  $$
  \Ni = \left\{ H | \forall \trace_{1},\trace_{2}\in H. \loweq{\trace_{1}}{\trace_{2}}\implies\trace_{1}=\trace_{2} \right\}
  $$
\end{definition}
Note that $=$ may not be strict equality, but some suitable trace equivalence that checks both public and private actions, instead of just public.

\section{Composition of Previous Results}

\begin{lemma}[Sequential Composition with RTP$\tau$]\label{lem:seqcompo:tau}
  Given $\wfctau{\sim_1}{\src{\cC_2}}$, $\rtptau[\sim_1]{\sicomp{\bullet}}{\src{\cC_{1}}}$, and $\rtptau[\sim_2]{\itcomp{\bullet}}{\tau_{\sim_1}(\src{\cC_{2}})}$, then $\rtptau[\sim_1\circ\sim_2]{\sitcomp{\bullet}}{\src{\cC_{1}}\cap\src{\cC_{2}}}$.
\end{lemma}
\begin{proof} 
  We need to show $\rtptau[\sim_1\circ\sim_2]{\sitcomp{\bullet}}{\src{\cC_{1}}\cap\src{\cC_{2}}}$.
  By definition, assume $\src{\pi}\in\src{\cC_{1}}\cap\src{\cC_{2}}$ and $\src{p}\in\src{\partials}$ such that $\rsat{\src{p}}{\src{\pi}}$.
  What is left to show is $\rsat{\sitcomp{\src{p}}}{\tau_{\sim_1\circ\sim_2}(\src{\pi})}$.
  Note that $\src{\pi}\in\src{\cC_{1}}$ as well as $\src{\pi}\in\src{\cC_2}$. 
  Also, $\sicomp{\src{p}}\in\irl{\partials}$ and $\tau_{\sim_1\circ\sim_2}(\src{\pi})=\tau_{\sim_2}(\tau_{\sim_1}(\src{\pi}))$. 
  Since $\sim_1$ is well-formed with respect to $\src{\cC_2}$, we can apply $\rtptau[\sim_2]{\itcomp{\bullet}}{\tau_{\sim_1}(\src{\cC_{2}})}$, changing our goal to $\rsat{\sicomp{\src{p}}}{\tau_{\sim_1}(\src{\pi})}$.
  Since $\src{\pi}\in\src{\cC_{1}}$ also holds, we can this time apply $\rtptau[\sim_1]{\stcomp{\bullet}}{\src{\cC_{1}}}$.
  What is left to show is $\rsat{\src{p}}{\src{\pi}}$, which is an assumption of ours.
\end{proof}
\begin{lemma}[Sequential Composition with RTP$\sigma$]\label{lem:seqcompo:sigma}
  Given $\wfcsig{\sim_2}{\trg{\cC_1}}$, $\rtpsigma[\sim_1]{\sicomp{\bullet}}{\sigma_{\sim_2}(\trg{\cC_{1}})}$, and $\rtpsigma[\sim_2]{\itcomp{\bullet}}{\trg{\cC_{2}}}$, then $\rtpsigma[\sim_1\circ\sim_2]{\sitcomp{\bullet}}{\trg{\cC_{1}}\cap\trg{\cC_{2}}}$.
\end{lemma}
\begin{proof} 
  Dual to \Cref{lem:seqcompo:tau}.
\end{proof}

\begin{lemma}[Sequential Composition with RTP]\label{lem:seqcompo}
  Given $\rtp{\sicomp{\bullet}}{\cC_{1}}$ and $\rtp{\itcomp{\bullet}}{\cC_{2}}$, then $\rtp{\sitcomp{\bullet}}{\cC_{1}\cap\cC_{2}}$.
\end{lemma}
\begin{proof}
  Simple consequence from either \Cref{lem:seqcompo:tau} or \Cref{lem:seqcompo:sigma} by setting the cross-language trace relations to =.
\end{proof}

\begin{definition}[Upper Composition]
  Given two compilers $\stcomp{\bullet}$ and $\itcomp{\bullet}$, their upper composition is

  $$\uhcsitcomp{\bullet}=\lambda p.\begin{cases}\stcomp{p} &\text{if }p\in\src{\partials}\\
                                                \itcomp{p} &\text{if }p\in\irl{\partials}\end{cases}$$.
\end{definition}

\begin{lemma}[Upper Composition with RTP]
  Given $\rtp{\stcomp{\bullet}}{\cC_{1}}$ and $\rtp{\itcomp{\bullet}}{\cC_{2}}$, then $\rtp{\uhcsitcomp{\bullet}}{\cC_{1}\cap\cC_{2}}$.
\end{lemma}
\begin{proof}
  Analogous argument as in \Thmref{lem:seqcompo}, but with a case distinction on whether the source program is element of $\S$ or $\I$.
\end{proof}
% S = while,    I = while with exceptions           => modularization

% another idea: certified nugget -> minimal RSP compiler

\begin{definition}[Lower Composition]
  Given two compilers $\stcomp{\bullet}$ and $\sicomp{\bullet}$, their lower composition is $\lhcsitcomp{\bullet}$.
\end{definition}

\begin{lemma}[Lower Composition with RTP]
  Given $\rtp{\stcomp{\bullet}}{\cC_{1}}$ and $\rtp{\sicomp{\bullet}}{\cC_{2}}$, then $\rtp{\lhcsitcomp{\bullet}}{\cC_{1}\cap\cC_{2}}$.
\end{lemma}
\begin{proof}
  Analogous argument as in \Thmref{lem:seqcompo}, but with a case distinction on whether the compiled source program is element of $\I$ or $\T$.
\end{proof}

\begin{lemma}[Diamond]\label{lem:diamond}
  Given $\rtp{\lhcsiocomp{\bullet}}{\cC_{1}}$ and $\rtp{\uhciotcomp{\bullet}}{\cC_{2}}$ with $\stcomp{\bullet} = \lambda\src{p}.\uhciotcomp{\lhcsiocomp{p}}$, then $\rtp{\stcomp{\bullet}}{\cC_{1}\cap\cC_{2}}$.
\end{lemma}
\begin{proof}
  Straightforward using \Thmref{lem:seqcompo}.
\end{proof}

\begin{lemma}[Swappable]\label{lem:swappable}
  Given $\rtp{\ttcomp{\bullet}_{(1)}}{\cC_{1}}$ and $\rtp{\ttcomp{\bullet}_{(2)}}{\cC_{2}}$, then $\rtp{\ttcompN{\ttcomp{\bullet}_{(2)}}_{(1)}}{\cC_{2}\cap\cC_{1}}$ and $\rtp{\ttcompN{\ttcomp{\bullet}_{(1)}}_{(2)}}{\cC_{1}\cap\cC_{2}}$.
\end{lemma}
\begin{proof}
  Both follow from \Thmref{lem:seqcompo}.
\end{proof}

\begin{lemma}[Swappable$\sigma$]\label{lem:swappable:sigma}
  Given $\wfcsig{\sim_2}{\trg{\cC_1}}$, $\wfcsig{\sim_1}{\trg{\cC_2}}$, $\rtpsigma[\sim_1]{\ttcomp{\bullet}_{(1)}}{\trg{\cC_{1}}}$, $\rtpsigma[\sim_1]{\ttcomp{\bullet}_{(1)}}{\sigma_{\sim_2}(\trg{\cC_1})}$, $\rtpsigma[\sim_2]{\ttcomp{\bullet}_{(2)}}{\sigma_{\sim_1}(\trg{\cC_{2}})}$, and $\rtpsigma[\sim_2]{\ttcomp{\bullet}_{(2)}}{\trg{\cC_{2}}}$, then $\rtpsigma[\sim_1\circ\sim_2]{\ttcompN{\ttcomp{\bullet}_{(2)}}_{(1)}}{\cC_{2}\cap\cC_{1}}$ and $\rtpsigma[\sim_2\circ\sim_1]{\ttcompN{\ttcomp{\bullet}_{(1)}}_{(2)}}{\cC_{1}\cap\cC_{2}}$.
\end{lemma}
\begin{proof}
  Easy from \Thmref{lem:seqcompo:sigma}.
\end{proof}
\begin{lemma}[Swappable$\tau$]\label{lem:swappable:tau}
  Given $\wfctau{\sim_2}{\trg{\cC_1}}$, $\wfctau{\sim_1}{\trg{\cC_2}}$, $\rtptau[\sim_1]{\ttcomp{\bullet}_{(1)}}{\trg{\cC_{1}}}$, $\rtptau[\sim_1]{\ttcomp{\bullet}_{(1)}}{\tau_{\sim_2}(\trg{\cC_1})}$, $\rtptau[\sim_2]{\ttcomp{\bullet}_{(2)}}{\tau_{\sim_1}(\trg{\cC_{2}})}$, and $\rtptau[\sim_2]{\ttcomp{\bullet}_{(2)}}{\trg{\cC_{2}}}$, then $\rtptau[\sim_1\circ\sim_2]{\ttcompN{\ttcomp{\bullet}_{(2)}}_{(1)}}{\cC_{2}\cap\cC_{1}}$ and $\rtptau[\sim_2\circ\sim_1]{\ttcompN{\ttcomp{\bullet}_{(1)}}_{(2)}}{\cC_{1}\cap\cC_{2}}$.
\end{lemma}
\begin{proof}
  Easy from \Thmref{lem:seqcompo:tau}.
\end{proof}

\section{Case Study}

\subsection{Specification Language}

We introduce a set of actions that allows us to describe properties abstractly instead of a language specific manner.

\myfig{
  \begin{gather*}
  \begin{aligned}
    \mi{Control\ Tag}~\sandboxtag\bnfdef&\ \ctx \mid \comp \hspace{0.5cm}
    \mi{Security\ Tag}~\specificev{\sigma} \bnfdef\ \specificev{\lock} \mid \specificev{\unlock} \\
    \mi{Pre\text{--}Events}~\msevent_{b} \bnfdef&\ \specificev{Alloc\ \loc\ n} \mid \specificev{Dealloc\ \loc} \mid \specificev{Use\ \loc\ n} \mid \specificev{Branch\ n} \mid \specificev{Binop\ n} \\
    \mi{Events}~\msevent \bnfdef&\ \specificev{\emptyevent}\mid \specificev{\lightning} \mid \specificev{\msevent_{b}};\sandboxtag;\specificev{\sigma} \\
  \end{aligned}
  \end{gather*}
}{w-specific-events}{Specification Events.}


\begin{definition}[\glsfirst*{tms}]\label{def:tms}\label{def:tempmemsafe}
  $$
  \text{tms}:=\left\{\trace[_{\mssafe}] \left| \begin{array}{rcl}
    \specificev{Alloc\ \loc\ n}&\le_{\trace[_{\mssafe}]}&\specificev{Dealloc\ \loc} \\
    \specificev{Use\ \loc\ n}&\le_{\trace[_{\mssafe}]}&\specificev{Dealloc\ \loc} \\
    \specificev{Dealloc\ \loc}&\in_{!}&\trace[_{\mssafe}] \\
    \specificev{Alloc\ \loc\ n}&\in_{!}&\trace[_{\mssafe}] \\
  \end{array}\right.\right\}
  $$
\end{definition}

\subsubsection{\gls*{tms} Monitor}
In order to just talk about temporal memory safety, we introduce a monitor that works on more abstract monitor-actions, without any other events besides those relevant to temporal memory safety.

\myfig{
  \begin{gather*}
    \begin{aligned}
      \mi{Abstract\ Store}~\tmsmonitor =&\{A : \specificev{L}\times\sandboxtag, F : \specificev{L}\times\sandboxtag\} \\
      \mi{Abstract\ Events}~\absevent \bnfdef&\ \bm{\varepsilon} \mid \textbf{Alloc}\ \specificev{\loc}\ \sandboxtag \mid \textbf{Dealloc}\ \specificev{\loc}\ \sandboxtag \mid \textbf{Use}\ \specificev{\loc}\ \sandboxtag \mid \abstermination\\[0.3cm]
      \tmsmonitor\subseteq_F \tmsmonitor['] &\text{ iff } \tmsmonitor[.F] \subseteq \tmsmonitor['.F]\\
      \absevent\in \tmsmonitor &\text{ iff } \absevent \in {\tmsmonitor[.A]} \wedge \absevent \notin {\tmsmonitor[.F]}\\
      \absevent\notin \tmsmonitor &\text{ iff } \absevent \notin {\tmsmonitor[.A]} \wedge \absevent \notin {\tmsmonitor[.F]}\\
      \{(\specificev{\loc};\sandboxtag)\}\cup \tmsmonitor &= \{A : \{(\specificev{\loc};\sandboxtag)\}\cup \tmsmonitor[.A], F : \tmsmonitor[.F]\}\\
      \tmsmonitor\setminus\{(\specificev{\loc};\sandboxtag)\} &= \{A : \tmsmonitor[.A]\setminus\{(\specificev{\loc};\sandboxtag)\}, F : \tmsmonitor[.F]\cup\left\{(\specificev{\loc};\sandboxtag)\right\}\}\\
      \tmsmonitor\cup \tmsmonitor' &= \{A : \tmsmonitor[.A]\cup \tmsmonitor['.A], F : \tmsmonitor[.F]\cup \tmsmonitor['.F]\}\\
    \end{aligned}
  \end{gather*}
}{tms-monitor}{\gls{tms} Monitor.}

As before, when doing structural induction over primitive steps (\Cref{fig:w-expr-prim-eval}) we may encounter the $\src{\emptyevent}$, for which $\tospecificevs{\emptyevent}=\specificev{\emptyevent}$, which needs a ,,partner'' in the abstract events as defined in \Cref{fig:tms-monitor}: $\bm{\varepsilon}$.

\myfig{
  \begin{center}
    \judgbox{\monitorcheck[]{\tmsmonitor}{\tmsmonitor[']}{\absevent}}{,,Given abstract state $\tmsmonitor$, step to abstract state $\tmsmonitor'$\\ emitting an abstract event $\absevent$.''}
    \judgbox{\monitorcheck{\tmsmonitor}{\tmsmonitor[']}{\abstrace}}{,,Reflexive-Transitive closure of above judgement.\\$\abstrace$ is a list of abstract events.''}
    \typerule{TMS-Uninteresting}{
    }{
      \monitorcheck[]{\tmsmonitor}{\tmsmonitor}{\bm{\varepsilon}}
    }{tms-uninteresting}
    %
    \typerule{TMS-Abort}{
    }{
      \monitorcheck[]{\tmsmonitor}{\tmsmonitor}{\bm{\lightning}}
    }{tms-abort}
    %
    \typerule{TMS-Use}{
      (\specificev{\loc};\sandboxtag)\in \tmsmonitor
    }{
      \monitorcheck[]{\tmsmonitor}{\tmsmonitor}{\textbf{Use}\ \specificev{\loc}\ \sandboxtag}
    }{tms-use}
    %
    \typerule{TMS-Alloc}{
      \tmsmonitor[']=\left\{(\specificev{\loc};\sandboxtag)\right\}\cup\tmsmonitor&
      (\specificev{\loc};\sandboxtag)\notin \tmsmonitor
    }{
      \monitorcheck[]{\tmsmonitor}{\tmsmonitor[']}{\textbf{Alloc}\ \specificev{\loc}\ \sandboxtag}
    }{tms-alloc}
    %
    \typerule{TMS-Dealloc}{
      (\specificev{\loc};\sandboxtag)\in \tmsmonitor &
      \tmsmonitor[']=\tmsmonitor\setminus\left\{(\specificev{\loc};\sandboxtag)\right\}
    }{
      \monitorcheck[]{\tmsmonitor}{\tmsmonitor[']}{\textbf{Dealloc}\ \specificev{\loc}\ \sandboxtag}
    }{tms-dealloc}
    %
    \typerule{TMS-Refl}{
      \tmsmonitor[.A]=\emptyset
    }{
      \monitorcheck{\tmsmonitor}{\tmsmonitor}{\hole{\cdot}}
    }{tms-refl}
    %
    \typerule{TMS-Trans}{
      \monitorcheck[]{\tmsmonitor}{\tmsmonitor[']}{\absevent}&
      \monitorcheck{\tmsmonitor[']}{\tmsmonitor['']}{\abstrace}&
    }{
      \monitorcheck{\tmsmonitor}{\tmsmonitor['']}{\absevent\cdot\abstrace}
    }{tms-trans}
  \end{center}
}{tms-step}{Steps of \gls{tms} Monitor.}

The monitor-state contains two sets of locations that represent the ones that are active and the ones that have been deallocated, respectively.
As seen in \Cref{tr:tms-dealloc}, the monitor only steps if the intuitive condition is true: a location can only be deallocated if it is part of the set of allocated locations.
\Cref{tr:tms-use} ensures that only allocated locations occur in events representing usage, the monitor cannot step if the location has been deallocated before.

As before, we need a way to translate one set of actions to another:

\myfig{
  \begin{center}
    \judgbox{\tmstraceagree{\msevent}{\absevent}}{,,Memory-Safety specific event $\msevent$ describes same action as $\absevent$.''}
    %
    \typerule{TMS-Alloc-Authentic}{
    }{
      \tmstraceagree{\specificev{Alloc\ \loc\ n};\sandboxtag;\specificev{\sigma}}{\textbf{Alloc}\ \specificev{\loc}\ \sandboxtag}
    }{tms-alloc-auth}
    %
    \typerule{TMS-Dealloc-Authentic}{
    }{
      \tmstraceagree{\specificev{Dealloc\ \loc};\sandboxtag;\specificev{\sigma}}{\textbf{Dealloc}\ \specificev{\loc}\ \sandboxtag}
    }{tms-dealloc-auth}
    %
    \typerule{TMS-Use-Authentic}{
    }{
      \tmstraceagree{\specificev{Use\ \loc\ n};\sandboxtag;\specificev{\sigma}}{\textbf{Use}\ \specificev{\loc}\ \sandboxtag}
    }{tms-use-auth}
    %
    \typerule{TMS-Abort-Authentic}{
    }{
      \tmstraceagree{\specificev{\lightning}}{\bm{\lightning}}
    }{tms-abort-auth}
    %
    \typerule{TMS-None-Authentic}{
    }{
      \tmstraceagree{\specificev{\varepsilon}}{\bm{\varepsilon}}
    }{tms-none-auth}
    %
    \typerule{TMS-Branch-Authentic}{
    }{
      \tmstraceagree{\specificev{Branch\ n};\sandboxtag;\specificev{\sigma}}{\bm{\varepsilon}}
    }{tms-branch-auth}
    %
    \typerule{TMS-Binop-Authentic}{
    }{
      \tmstraceagree{\specificev{Binop\ n};\sandboxtag;\specificev{\sigma}}{\bm{\varepsilon}}
    }{tms-binop-auth}
    %
    \judgbox{\tmstraceagree[^*]{\mstrace}{\abstrace}}{,,Memory-Safety specific trace $\mstrace$ describes same trace as $\abstrace$.''}
    %
    \typerule{TMS-Refl-Authentic}{
    }{
      \tmstraceagree[^*]{\hole{\cdot}}{\hole{\cdot}}
    }{tms-refl-auth}
    %
    \typerule{TMS-Trans-Authentic}{
      \tmstraceagree{\msevent}{\absevent} &
      \tmstraceagree[^*]{\mstrace}{\abstrace}
    }{
      \tmstraceagree[^*]{\msevent\cdot\mstrace}{\absevent\cdot\abstrace}
    }{tms-trans-auth}
    %
    \typerule{TMS-Trans-Authentic-Lign}{
      \tmstraceagree[^*]{\mstrace}{\abstrace}
    }{
      \tmstraceagree[^*]{\specificev{\emptyevent}\cdot\mstrace}{\abstrace}
    }{tms-trans-auth-lign}
    %
    \typerule{TMS-Trans-Authentic-Rign}{
      \tmstraceagree[^*]{\mstrace}{\abstrace}
    }{
      \tmstraceagree[^*]{\mstrace}{\bm{\emptyevent}\cdot\abstrace}
    }{tms-trans-auth-rign}
  \end{center}
}{tms-trace-agreement}{Trace Agreement.}

\begin{definition}[Trace is temporal memory safe via monitor.]\label{def:src:trace:tms}
  We say $\texttt{TMS}(\mstrace)$ iff $\exists \delta_{\text{tms}}\ \abstrace\ \tmsmonitor$ such that:
  \begin{itemize}
    \item $\tmstraceagree{\mstrace}{\abstrace}$
    \item and $\monitorcheck{\emptyset}{\tmsmonitor}{\abstrace}$
  \end{itemize}
\end{definition}

\begin{lemma}[$\texttt{TMS}(\mstrace)$ implies $\mstrace\in\operatorname{tmsafe}$]\label{lem:tmssafe-tracetms}
  If
  \begin{assumptions}
    \item\label[ass]{asm:tmssafe-tracetms:tms} $\texttt{TMS}(\mstrace)$
  \end{assumptions}
  Then
  \begin{goals}
    \item $\mstrace\in\operatorname{tmsafe}$
  \end{goals}
\end{lemma}
\begin{proof}
  Invert \Cref{asm:tmssafe-tracetms:tms}:
  \begin{passumptions}{H}
    \item\label[ass]{asm:tmssafe-tracetms:traceag} $\tmstraceagree{\mstrace}{\abstrace}$
    \item\label[ass]{asm:tmssafe-tracetms:monstep} $\monitorcheck{\emptyset}{\tmsmonitor}{\abstrace}$
  \end{passumptions}
  The proof follows with an induction on \Cref{asm:tmssafe-tracetms:monstep}.
\end{proof}

\subsubsection{\gls*{sms} Monitor}

\myfig{
  \begin{gather*}
    \begin{aligned}
      \mi{Abstract\ Store}~\smsmonitor =&\ \specificev{L}\times\sandboxtag\times\nat \\
      \mi{Abstract\ Events}~\absevent \bnfdef&\ \bm{\varepsilon}\mid \textbf{Alloc}\ \specificev{\loc}\ \sandboxtag\ \bm{n} \mid \textbf{Use}\ \specificev{\loc}\ \sandboxtag\ \bm{n} \mid \abstermination\\
    \end{aligned}
  \end{gather*}
}{sms-monitor}{\gls{sms} Monitor.}

\begin{definition}[\glsfirst*{sms}]\label{def:trace:smsdef}\label{def:sms}\label{def:spatmemsafe}
% \small
  % \begin{nscenter}

  \noindent
  \[
  \smssafe:=\left\{\trace[_{\mssafe}] \left|\begin{array}{rcl}
      \text{If }\specificev{Alloc\ \loc\ n}\le_{\trace_{\mssafe}}\specificev{Use\ \loc\ m}, \text{ then }m<n
  \end{array}\right.\right\}
  \]
  % \end{nscenter}
\end{definition}

\myfig{
  \begin{center}
    \judgbox{\monitorcheck[]{\smsmonitor}{\smsmonitor[']}{\absevent}}{,,Given abstract state $\smsmonitor$, step to abstract state $\smsmonitor'$\\ emitting an abstract event $\absevent$.''}
    \judgbox{\monitorcheck{\smsmonitor}{\smsmonitor[']}{\abstrace}}{,,Reflexive-Transitive closure of above judgement.\\$\abstrace$ is a list of abstract events.''}
    %
    \typerule{sms-None}{
    }{
      \monitorcheck[]{\smsmonitor}{\smsmonitor}{\bm{\varepsilon}}
    }{sms-none}
    %
    \typerule{sms-Abort}{
    }{
      \monitorcheck[]{\smsmonitor}{\smsmonitor}{\bm{\lightning}}
    }{sms-abort}
    %
    \typerule{sms-Use}{
      (\specificev{\loc};\sandboxtag;m) \in \smsmonitor&
      n < m
    }{
      \monitorcheck[]{\smsmonitor}{\smsmonitor}{\textbf{Use}\ \loc\ \sandboxtag\ \bm{n}}
    }{sms-use}
    %
    \typerule{sms-Alloc}{
      (\specificev{\loc};\sandboxtag;m) \notin \text{dom }\smsmonitor
    }{
      \monitorcheck[]{\smsmonitor}{\smsmonitor\cup\left\{(\specificev{\loc};\sandboxtag;n)\right\}}{\textbf{Alloc}\ \specificev{\loc}\ \sandboxtag\ \bm{n}}
    }{sms-alloc}
    %
    \typerule{sms-Refl}{
    }{
      \monitorcheck{\smsmonitor}{\smsmonitor}{\hole{\cdot}}
    }{sms-refl}
    %
    \typerule{sms-Trans}{
      \monitorcheck[]{\smsmonitor}{\smsmonitor[']}{\absevent}&
      \monitorcheck{\smsmonitor[']}{\smsmonitor['']}{\abstrace}
    }{
      \monitorcheck{\smsmonitor}{\smsmonitor['']}{\absevent\cdot\abstrace}
    }{sms-trans}
  \end{center}
}{sms-step}{Steps of \gls{sms} Monitor.}

\myfig{
  \begin{center}
    \judgbox{\smstraceagree{\msevent}{\absevent}}{,,Memory-Safety specific event $\msevent$ describes same action as $\absevent$.''}
    %
    \typerule{SMS-Alloc-Authentic}{
    }{
      \smstraceagree{\specificev{Alloc\ \loc\ n};\sandboxtag;\specificev{\sigma}}{\textbf{Alloc}\ \specificev{\loc}\ \sandboxtag\ \bm{n}}
    }{sms-alloc-auth}
    %
    \typerule{SMS-Dealloc-Authentic}{
    }{
      \smstraceagree{\specificev{Dealloc\ \loc};\sandboxtag;\specificev{\sigma}}{\bm{\emptyevent}}
    }{sms-dealloc-auth}
    %
    \typerule{SMS-Use-Authentic}{
    }{
      \smstraceagree{\specificev{Use\ \loc\ n};\sandboxtag;\specificev{\sigma}}{\textbf{Use}\ \specificev{\loc}\ \sandboxtag\ \bm{n}}
    }{sms-use-auth}
    %
    \typerule{SMS-None-Authentic}{
    }{
      \smstraceagree{\specificev{\varepsilon}}{\bm{\varepsilon}}
    }{sms-none-auth}
    %
    \typerule{SMS-Branch-Authentic}{
    }{
      \smstraceagree{\specificev{Branch\ n};\sandboxtag;\specificev{\sigma}}{\bm{\varepsilon}}
    }{sms-branch-auth}
    %
    \typerule{SMS-Binop-Authentic}{
    }{
      \smstraceagree{\specificev{Binop\ n};\sandboxtag;\specificev{\sigma}}{\bm{\varepsilon}}
    }{sms-binop-auth}
    %
    \typerule{SMS-Abort-Authentic}{
    }{
      \smstraceagree{\specificev{\lightning}}{\bm{\lightning}}
    }{sms-abort-auth}
    %
    \judgbox{\smstraceagree[^{*}]{\mstrace}{\abstrace}}{,,Memory-Safety specific trace $\mstrace$ describes same trace as $\abstrace$.''}
    %
    \typerule{SMS-Refl-Authentic}{
    }{
      \smstraceagree{\hole{\cdot}}{\hole{\cdot}}
    }{sms-refl-auth}
    %
    \typerule{SMS-Trans-Authentic}{
      \smstraceagree{\msevent}{\absevent} &
      \smstraceagree{\mstrace}{\abstrace}
    }{
      \smstraceagree{\msevent \cdot \mstrace}{\absevent \cdot \abstrace}
    }{sms-trans-auth}
    %
    \typerule{SMS-Trans-Authentic-Lign}{
      \smstraceagree[^*]{\mstrace}{\abstrace}
    }{
      \smstraceagree[^*]{\specificev{\emptyevent}\cdot\mstrace}{\abstrace}
    }{sms-trans-auth-lign}
    %
    \typerule{SMS-Trans-Authentic-Rign}{
      \smstraceagree[^*]{\mstrace}{\abstrace}
    }{
      \smstraceagree[^*]{\mstrace}{\bm{\emptyevent}\cdot\abstrace}
    }{sms-trans-auth-rign}
  \end{center}
}{sms-trace-agreement}{Trace Agreement.}

\begin{definition}[Trace is spatial memory safe via monitor.]\label{def:src:trace:sms}
  We say $\texttt{SMS}(\mstrace)$ iff $\exists \abstrace\ \smsmonitor$ such that:
  \begin{itemize}
    \item $\smstraceagree{\mstrace}{\abstrace}$
    \item and $\monitorcheck{\emptyset}{\smsmonitor}{\abstrace}$
  \end{itemize}
\end{definition}

\begin{lemma}[$\texttt{SMS}(\mstrace)$ implies $\mstrace\in\operatorname{smsafe}$]\label{lem:smssafe-tracesms}
  If
  \begin{assumptions}
    \item\label[ass]{asm:smssafe-tracesms:sms} $\texttt{SMS}(\mstrace)$
  \end{assumptions}
  Then
  \begin{goals}
    \item $\mstrace\in\operatorname{smsafe}$
  \end{goals}
\end{lemma}
\begin{proof}
  Invert \Cref{asm:smssafe-tracesms:sms}:
  \begin{passumptions}{H}
    \item\label[ass]{asm:smssafe-tracesms:traceag} $\smstraceagree{\mstrace}{\abstrace}$
    \item\label[ass]{asm:smssafe-tracesms:monstep} $\monitorcheck{\emptyset}{\smsmonitor}{\abstrace}$
  \end{passumptions}
  The proof follows with an induction on \Cref{asm:smssafe-tracesms:monstep}.
\end{proof}

\subsubsection{\gls*{ms} Monitor}

\myfig{
  \begin{gather*}
    \begin{aligned}
      \mi{Abstract\ Store}~\msmonitor =&\ \tmsmonitor\times\smsmonitor \\
      \mi{Abstract\ Events}~\absevent \bnfdef&\ \absevent_{\tmssafe}\times\absevent_{\smssafe}\\
    \end{aligned}
  \end{gather*}
}{ms-monitor}{\gls{ms} Monitor.}

\begin{definition}[\glsfirst*{ms}]\label{def:trace:msdef}\label{def:memsafe}
  $
  \mssafe:=\tmssafe \cap \smssafe
  $
\end{definition}

\myfig{
  \begin{center}
    \typerule{tms-sms-E}{
      \monitorcheck[]{\smsmonitor}{\smsmonitor}{\absevent[_{\tmssafe}]} &
      \monitorcheck[]{\tmsmonitor}{\tmsmonitor}{\absevent[_{\smssafe}]} \\
    }{
      \monitorcheck[]{(\tmsmonitor;\smsmonitor)}{(\tmsmonitor['];\smsmonitor['])}{\absevent[_{tms}];\absevent[_{sms}]}
    }{tms-sms-empty}
    %
    \typerule{tms-sms-Refl}{
      \monitorcheck{\tmsmonitor}{\tmsmonitor}{\hole{\cdot}} &
      \monitorcheck{\smsmonitor}{\smsmonitor}{\hole{\cdot}}
    }{
      \monitorcheck{(\tmsmonitor;\smsmonitor)}{(\tmsmonitor;\smsmonitor)}{\hole{\cdot}}
    }{tms-sms-refl}
    %
    \typerule{tms-sms-Trans}{
      \monitorcheck[]{T}{T'}{\absevent}&
      \monitorcheck{T'}{T''}{\abstrace}&
    }{
      \monitorcheck{T}{T''}{\absevent\cdot\abstrace}
    }{tms-sms-trans}
  \end{center}
}{tms-sms-step}{Steps of combined \gls{tms} + \gls{sms} Monitor.}
\myfig{
  \begin{center}
    \judgbox{\mstraceagree[^{*}]{\mstrace}{\abstrace}}{,,Memory-Safety specific trace $\mstrace$ describes same trace as $\abstrace$.''}
    %
    \typerule{MS-Refl-Authentic}{
    }{
      \mstraceagree{\hole{\cdot}}{\hole{\cdot}}
    }{ms-refl-auth}
    %
    \typerule{MS-Trans-Authentic}{
      \mstraceagree{\msevent}{\absevent[_{\tmssafe}]} &
      \mstraceagree{\msevent}{\absevent[_{\smssafe}]} &
      \mstraceagree{\mstrace}{\abstrace}
    }{
      \mstraceagree{\msevent \cdot \mstrace}{(\absevent[_{\tmssafe}];\absevent[_{\smssafe}]) \cdot \abstrace}
    }{ms-trans-auth}
    %
    \typerule{MS-Trans-Authentic-Lign}{
      \mstraceagree[^*]{\mstrace}{\abstrace}
    }{
      \mstraceagree[^*]{\specificev{\emptyevent}\cdot\mstrace}{\abstrace}
    }{ms-trans-auth-lign}
    %
    \typerule{MS-Trans-Authentic-Rign}{
      \mstraceagree[^*]{\mstrace}{\abstrace}
    }{
      \mstraceagree[^*]{\mstrace}{\bm{\emptyevent}\cdot\abstrace}
    }{ms-trans-auth-rign}
  \end{center}
}{ms-trace-agreement}{Trace Agreement.}



\begin{definition}[Trace is memory safe via monitor.]\label{def:src:trace:ms}
  We say $\texttt{MS}(\mstrace)$ iff $\exists \abstrace\ \msmonitor$ such that:
  \begin{itemize}
    \item $\mstraceagree{\mstrace}{\abstrace}$
    \item and $\monitorcheck{\emptyset}{\msmonitor}{\abstrace}$
  \end{itemize}
\end{definition}

\begin{lemma}[$\texttt{MS}(\mstrace)$ implies $\mstrace\in\operatorname{msafe}$]\label{lem:mssafe-tracems}
  If
  \begin{assumptions}
    \item\label[ass]{asm:mssafe-tracems:ms} $\texttt{MS}(\mstrace)$
  \end{assumptions}
  Then
  \begin{goals}
    \item $\mstrace\in\operatorname{msafe}$
  \end{goals}
\end{lemma}
\begin{proof}
  Invert \Cref{asm:mssafe-tracems:ms}:
  \begin{passumptions}{H}
    \item\label[ass]{asm:mssafe-tracems:traceag} $\mstraceagree{\mstrace}{\abstrace}$
    \item\label[ass]{asm:mssafe-tracems:monstep} $\monitorcheck{\emptyset}{\msmonitor}{\abstrace}$
  \end{passumptions}
  The proof follows with \Cref{lem:tmssafe-tracetms,lem:smssafe-tracesms}.
\end{proof}

\subsubsection{\gls*{scct} Monitor}
\sCCT-Problems:
\begin{itemize}
  \item branching or predicated execution
  \item comparisons are an issue: can only get the content of special flag register by branching
  \item timing of loads/stores changes
  \item mult/div is problematic. mult is safe on modern procs, but not on microprocs
  \item bitshifts may translate into loops (unless bitshift by constant)
\end{itemize}

To remedy most of these real-world problems, which are dependent on the hardware, we introduce another language which has $\sCCT$-hardened instructions.
That is, we assume there exists an $\hat{\oplus}$ which behaves similarily to $\oplus$, but without leaking timing information.
Moreover, we also assume that there are $\sCCT$-versions of reading and writing.
If the instruction set architecture does not support these, we argue that there is some encoding that can be done in the style of FaCT that the compiler would have to do.
For example, to circumvent loading/storing and ensure $\sCCT$-versions, the register allocator could ensure that this variable stays in a register. Whenever this is not possible, one could spill and, prior to re-loading the variable, invalidate the caches. Another option is to simply load the whole array sequentially and select the relevant entry using a bitmask operation.

\myfig{
  \begin{gather*}
    \begin{aligned}
      \mi{Abstract\ Store}~\scctmonitor =&\ \emptyset \\
      \mi{Abstract\ Security\ Tag}~\bm{\sigma} \bnfdef&\ \lock \mid \unlock \\
      \mi{Abstract\ Pre-Events}~\absevent_{b} \bnfdef&\ \textbf{Any} \\
      \mi{Abstract\ Events}~\absevent \bnfdef&\ \bm{\varepsilon} \mid \absevent_{b};\bm{\sigma} \mid \abstermination
    \end{aligned}
  \end{gather*}
}{scct-monitor}{\gls{scct} Monitor.}
The \sCCT monitor serves as an overapproximation for cryptographic constant-time code.
Here, any event whatsoever is considered bad, since this leaks information by means of a sidechannel.


\begin{definition}[\glsfirst*{scct}]\label{def:trace:scctdef}\label{def:scct}
% \begin{nscenter}
  
  \noindent\[
  \scctsafe:=\left\{\trace[_{\ctsafe}] \left|\begin{array}{l}
      \trace[_{\ctsafe}]=\hole{\cdot} \text{ or } \exists\trace[_{\ctsafe}'],\trace[_{\ctsafe}]=\event[_b^{\ctsafe}];\unlock\cdot\trace[_{\ctsafe}'] \wedge \trace[_{\ctsafe}']\in\scctsafe
    \end{array}\right.\right\}
  \]
% \end{nscenter}
\end{definition}

\myfig{
  \begin{center}
    \judgbox{\monitorcheck[]{\scctmonitor}{\scctmonitor[']}{\absevent}}{,,Given abstract state $\scctmonitor$, step to abstract state $\scctmonitor'$\\ emitting an abstract event $\absevent$.''}
    \judgbox{\monitorcheck{\scctmonitor}{\scctmonitor[']}{\abstrace}}{,,Reflexive-Transitive closure of above judgement.\\$\abstrace$ is a list of abstract events.''}
    %
    \typerule{scct-None}{
    }{
      \monitorcheck[]{\scctmonitor}{\scctmonitor}{\bm{\varepsilon}}
    }{scct-none}
    %
    \typerule{scct-Abort}{
    }{
      \monitorcheck[]{\scctmonitor}{\scctmonitor}{\bm{\lightning};\bm{\unlock}}
    }{scct-abort}
    %
    \typerule{scct-Refl}{
    }{
      \monitorcheck{\scctmonitor}{\scctmonitor}{\hole{\cdot}}
    }{scct-refl}
    %
    \typerule{scct-Trans}{
      \monitorcheck[]{\scctmonitor}{\scctmonitor[']}{\absevent}&
      \monitorcheck{\scctmonitor[']}{\scctmonitor['']}{\abstrace}
    }{
      \monitorcheck{\scctmonitor}{\scctmonitor['']}{\absevent\cdot\abstrace}
    }{scct-trans}
  \end{center}
}{scct-step}{Steps of \gls{scct} Monitor.}

\myfig{
  \begin{center}
    \judgbox{\specificev{\sigma}=\bm{\sigma}}{,,Equality of Security Tags.''}$\;$\\
    %
    \typerule{secure-eq}{
    }{
      \specificev{\lock}=\lock
    }{secure-eq}
    %
    \typerule{insecure-eq}{
    }{
      \specificev{\unlock}=\unlock
    }{insecure-eq}
    %
    \judgbox{\sccttraceagree{\msevent}{\absevent}}{,,Memory-Safety specific event $\msevent$ describes same action as $\absevent$.''}
    %
    \typerule{\sCCT-Public-Authentic}{
    }{
      \sccttraceagree{\msevent[_b];\sandboxtag;\specificev{\unlock}}{\bm{\varepsilon}}
    }{scct-public-auth}
    %
    \typerule{\sCCT-Use-Authentic}{
    }{
      \sccttraceagree{\specificev{Use\ \loc\ n};\sandboxtag;\specificev{\lock}}{\textbf{Any};\bm{\lock}}
    }{scct-use-auth}
    %
    \typerule{\sCCT-Abort-Authentic}{
    }{
      \sccttraceagree{\specificev{\lightning}}{\bm{\lightning}}
    }{scct-abort-auth}
    %
    \typerule{\sCCT-None-Authentic}{
    }{
      \sccttraceagree{\specificev{\varepsilon}}{\bm{\varepsilon}}
    }{scct-none-auth}
    %
    \typerule{\sCCT-Branch-Authentic}{
    }{
      \sccttraceagree{\specificev{Branch\ n};\sandboxtag;\specificev{\lock}}{\textbf{Any};\bm{\lock}}
    }{scct-branch-auth}
    %
    \typerule{\sCCT-Binop-Authentic}{
    }{
      \sccttraceagree{\specificev{Binop\ n};\sandboxtag;\specificev{\lock}}{\textbf{Any};\bm{\lock}}
    }{scct-binop-auth}
    %
    \judgbox{\sccttraceagree[^*]{\mstrace}{\abstrace}}{,,Memory-Safety specific trace $\mstrace$ describes same trace as $\abstrace$.''}
    %
    \typerule{\sCCT-Refl-Authentic}{
    }{
      \sccttraceagree[^*]{\hole{\cdot}}{\hole{\cdot}}
    }{scct-refl-auth}
    %
    \typerule{\sCCT-Trans-Authentic}{
      \sccttraceagree{\msevent}{\absevent} &
      \sccttraceagree[^*]{\mstrace}{\abstrace}
    }{
      \sccttraceagree[^*]{\msevent\cdot\mstrace}{\absevent\cdot\abstrace}
    }{scct-trans-auth}
    %
    \typerule{\sCCT-Trans-Authentic-Lign}{
      \sccttraceagree[^*]{\mstrace}{\abstrace}
    }{
      \sccttraceagree[^*]{\specificev{\emptyevent}\cdot\sccttrace}{\abstrace}
    }{scct-trans-auth-lign}
    %
    \typerule{\sCCT-Trans-Authentic-Rign}{
      \sccttraceagree[^*]{\mstrace}{\abstrace}
    }{
      \sccttraceagree[^*]{\mstrace}{\bm{\emptyevent}\cdot\abstrace}
    }{scct-trans-auth-rign}
  \end{center}
}{scct-trace-agreement}{Trace Agreement.}

\begin{definition}[Trace is strictly cryptographic constant time via monitor.]\label{def:src:trace:scct}
  We say $\texttt{\sCCT}(\mstrace)$ iff $\exists \abstrace\ \scctmonitor$ such that:
  \begin{itemize}
    \item $\sccttraceagree{\mstrace}{\abstrace}$
    \item and $\monitorcheck{\emptyset}{\scctmonitor}{\abstrace}$
  \end{itemize}
\end{definition}

\begin{lemma}[$\texttt{SCCT}(\mstrace)$ implies $\mstrace\in\operatorname{scct}$]\label{lem:scctsafe-tracems}
  If
  \begin{assumptions}
    \item\label[ass]{asm:scctsafe-tracems:ms} $\texttt{SCCT}(\mstrace)$
  \end{assumptions}
  Then
  \begin{goals}
    \item $\mstrace\in\operatorname{scct}$
  \end{goals}
\end{lemma}
\begin{proof}
  Invert \Cref{asm:scctsafe-tracems:ms}:
  \begin{passumptions}{H}
    \item\label[ass]{asm:scctsafe-tracems:traceag} $\mstraceagree{\mstrace}{\abstrace}$
    \item\label[ass]{asm:scctsafe-tracems:monstep} $\monitorcheck{\emptyset}{\scctmonitor}{\abstrace}$
  \end{passumptions}
  The proof follows with an induction on \Cref{asm:scctsafe-tracems:monstep}.
\end{proof}

\subsubsection{\gls*{ss} Monitor}

\myfig{
  \begin{gather*}
    \begin{aligned}
      \mi{Abstract\ Store}~\specmonitor =&\ \emptyset \\
      \mi{Abstract\ SPECTRE\ Label}~\bm{vX} \bnfdef&\ \textbf{NONE} \mid \textbf{PHT} \\
      \mi{Abstract\ Security\ Tag}~\bm{\sigma} \bnfdef&\ \lock_{\bm{vX}} \mid \unlock \\
      \mi{Abstract\ Pre-Events}~\absevent_{b} \bnfdef&\ \textbf{Any} \\
      \mi{Abstract\ Events}~\absevent \bnfdef&\ \bm{\varepsilon} \mid \absevent_{b};\bm{\sigma} \mid \abstermination
    \end{aligned}
  \end{gather*}
}{spec-monitor}{\gls{ss} Monitor.}
The spec monitor serves as an overapproximation for speculative non-interference.

\begin{definition}[\glsfirst*{ss}]\label{def:trace:specdef}\label{def:spec}
  \noindent

  \[
    \specsafe:=\left\{\trace[_{\mathghost}] \left|\begin{array}{l}
      \trace[_{\mathghost}]=\hole{\cdot} \text{ or } \exists\trace[_{\mathghost}'].\\
      \left(\trace[_{\mathghost}]=\event[_b^{\mathghost}];\unlock\cdot\trace[_{\mathghost}'] \text{or }\trace[_{\mathghost}]=\event[_b^{\mathghost}];\lock_{\text{NONE}}\cdot\trace[_{\mathghost}']\right)\\
      \text{and }\ \trace[_{\mathghost}']\in\specsafe
                                 \end{array}\right.\right\}
  \]
\end{definition}

\myfig{
  \begin{center}
    \judgbox{\monitorcheck[]{\specmonitor}{\specmonitor[']}{\absevent}}{,,Given abstract state $\specmonitor$, step to abstract state $\specmonitor'$\\ emitting an abstract event $\absevent$.''}
    \judgbox{\monitorcheck{\specmonitor}{\specmonitor[']}{\abstrace}}{,,Reflexive-Transitive closure of above judgement.\\$\abstrace$ is a list of abstract events.''}
    %
    \typerule{spec-None}{
    }{
      \monitorcheck[]{\specmonitor}{\specmonitor}{\bm{\varepsilon}}
    }{spec-none}
    %
    \typerule{spec-Leak-None}{
    }{
      \monitorcheck[]{\specmonitor}{\specmonitor}{\absevent[_b];\lock_{\textbf{NONE}}}
    }{spec-leak-none}
    %
    \typerule{spec-Abort}{
    }{
      \monitorcheck[]{\specmonitor}{\specmonitor}{\bm{\lightning};\bm{\unlock}}
    }{spec-abort}
    %
    \typerule{spec-Refl}{
    }{
      \monitorcheck{\specmonitor}{\specmonitor}{\hole{\cdot}}
    }{spec-refl}
    %
    \typerule{spec-Trans}{
      \monitorcheck[]{\specmonitor}{\specmonitor[']}{\absevent}&
      \monitorcheck{\specmonitor[']}{\specmonitor['']}{\abstrace}
    }{
      \monitorcheck{\specmonitor}{\specmonitor['']}{\absevent\cdot\abstrace}
    }{spec-trans}
  \end{center}
}{spec-step}{Steps of \gls{ss} Monitor.}

\myfig{
  \begin{center}
    \judgbox{\specificev{\sigma}=\bm{\sigma}}{,,Equality of Security Tags.''}$\;$\\
    %
    \typerule{spec-secure-eq}{
    }{
      \specificev{\lock}=\lock_{\bm{vX}}
    }{spec-secure-eq}
    %
    \typerule{spec-insecure-eq}{
    }{
      \specificev{\unlock}=\unlock
    }{spec-insecure-eq}
    %
    \judgbox{\spectraceagree{\msevent}{\absevent}}{,,Memory-Safety specific event $\msevent$ describes same action as $\absevent$.''}
    %
    \typerule{spec-Public-Authentic}{
    }{
      \spectraceagree{\msevent[_b];\sandboxtag;\specificev{\unlock}}{\bm{\varepsilon}}
    }{spec-public-auth}
    %
    \typerule{spec-Use-Authentic}{
    }{
      \spectraceagree{\specificev{Use\ \loc\ n};\sandboxtag;\specificev{\lock}}{\textbf{Any};\bm{\lock}}
    }{spec-use-auth}
    %
    \typerule{spec-Abort-Authentic}{
    }{
      \spectraceagree{\specificev{\lightning}}{\bm{\lightning}}
    }{spec-abort-auth}
    %
    \typerule{spec-None-Authentic}{
    }{
      \spectraceagree{\specificev{\varepsilon}}{\bm{\varepsilon}}
    }{spec-none-auth}
    %
    \typerule{spec-Branch-Authentic}{
    }{
      \spectraceagree{\specificev{Branch\ n};\sandboxtag;\specificev{\lock}}{\textbf{Any};\bm{\lock}}
    }{spec-branch-auth}
    %
    \typerule{spec-Binop-Authentic}{
    }{
      \spectraceagree{\specificev{Binop\ n};\sandboxtag;\specificev{\lock}}{\textbf{Any};\bm{\lock}}
    }{spec-binop-auth}
    %
    \judgbox{\spectraceagree[^*]{\mstrace}{\abstrace}}{,,Memory-Safety specific trace $\mstrace$ describes same trace as $\abstrace$.''}
    %
    \typerule{spec-Refl-Authentic}{
    }{
      \spectraceagree[^*]{\hole{\cdot}}{\hole{\cdot}}
    }{spec-refl-auth}
    %
    \typerule{spec-Trans-Authentic}{
      \spectraceagree{\msevent}{\absevent} &
      \spectraceagree[^*]{\mstrace}{\abstrace}
    }{
      \spectraceagree[^*]{\msevent\cdot\mstrace}{\absevent\cdot\abstrace}
    }{spec-trans-auth}
    %
    \typerule{spec-Trans-Authentic-Lign}{
      \spectraceagree[^*]{\mstrace}{\abstrace}
    }{
      \spectraceagree[^*]{\specificev{\emptyevent}\cdot\mstrace}{\abstrace}
    }{spec-trans-auth-lign}
    %
    \typerule{spec-Trans-Authentic-Rign}{
      \spectraceagree[^*]{\mstrace}{\abstrace}
    }{
      \spectraceagree[^*]{\mstrace}{\bm{\emptyevent}\cdot\abstrace}
    }{spec-trans-auth-rign}
  \end{center}
}{spec-trace-agreement}{Trace Agreement.}

\begin{definition}[Trace is strictly cryptographic constant time via monitor.]\label{def:src:trace:spec}
  We say $\texttt{SPEC}(\mstrace)$ iff $\exists \abstrace\ \specmonitor$ such that:
  \begin{itemize}
    \item $\spectraceagree{\mstrace}{\abstrace}$
    \item and $\monitorcheck{\emptyset}{\specmonitor}{\abstrace}$
  \end{itemize}
\end{definition}

\begin{lemma}[$\texttt{SPEC}(\mstrace)$ implies $\mstrace\in\operatorname{spec}$]\label{lem:specsafe-tracems}
  If
  \begin{assumptions}
    \item\label[ass]{asm:specsafe-tracems:ms} $\texttt{spec}(\mstrace)$
  \end{assumptions}
  Then
  \begin{goals}
    \item $\mstrace\in\operatorname{spec}$
  \end{goals}
\end{lemma}
\begin{proof}
  Invert \Cref{asm:specsafe-tracems:ms}:
  \begin{passumptions}{H}
    \item\label[ass]{asm:specsafe-tracems:traceag} $\mstraceagree{\mstrace}{\abstrace}$
    \item\label[ass]{asm:specsafe-tracems:monstep} $\monitorcheck{\emptyset}{\specmonitor}{\abstrace}$
  \end{passumptions}
  The proof follows with an induction on \Cref{asm:specsafe-tracems:monstep}.
\end{proof}

\subsection{Source Language}
\subsubsection{Syntax}

\myfig{
	\vspace{-1em}
  \begin{gather*}
  \begin{aligned}
  \mi{Final\ Result}\ \src{\finalexprnoerr} \bnfdef&\ \src{\valueexpr} \mid \src{x} \hspace{0.5cm}
  \mi{May\ be\ a\ Result}\ \src{\finalexpr} \bnfdef\ \src{\finalexprnoerr} \mid \src{stuck} \\
  %
  \mi{Expressions}~\src{e} \bnfdef&\ \src{\finalexpr} \mid \src{e_{1} \oplus e_{2}} \mid \src{x[e]} \mid \src{let\ x = e_{1}\ in\ e_{2}}\mid \src{x[e_{1}]\leftarrow e_{2}} \\
  & \mid \src{let\ x=new\ e_{1}\ in\ e_{2}} \mid \src{delete\ x} \mid \src{return\ e} \mid \src{call\ foo\ e} \\
  & \mid \src{ifz\ e_1\ then\ e_2\ else\ e_3} \hspace{0.5cm} \text{where } \src{\oplus}\in\{\src{+},\src{-},\src{\times},\src{<}\}\\
  %
  \mi{Functions}~\src{\asymbol} \bnfdef&\ \src{let\ foo\ x : \type}_{\lambda}\src{:= e} \\
  %
  \mi{Expr.\ Types}~\types_{\src{e}} \bnfdef&\ \src{\nat} \mid \src{ref_q\ \nat} \hspace{0.25cm}
  %
  \mi{Qualifier}~\src{q} \bnfdef\ \full \mid \half\hspace{0.25cm}
  \mi{Values}~\src{\valueexpr} \bnfdef\ \src{n}\in\src{\nat} \\
  %
  \mi{Ectx\ Types}~\types_{\lambda}\ \bnfdef& \types_{\src{e}}\to\types_{\src{e}} \hspace{0.25cm}
  \mi{Types}~\types \bnfdef \types_{\src{e}}\mid\types_{\lambda}\mid\types_{\src{e}}\src{\to\bot} \hspace{0.25cm}
  %
  \mi{References}~\src{\loc}\in\src{\nat} \\
  \mi{Eval. Ctx.}~\src{K}\bnfdef &\ \src{\hole{\cdot}}\mid \src{K\oplus e}\mid \src{v\oplus K}\mid \src{x[K]}\mid \src{let\ x=K\ in\ e}\\
                     &\ \mid\src{x[K]\leftarrow e}\mid \src{x[v]\leftarrow K}\mid \src{let\ x=new\ K\ in\ e} \\
                     &\ \mid\src{ifz\ K\ then\ e_1\ else\ e_2} \mid \src{call\ foo\ K}\mid \src{return\ K} \\
  %
  \mi{Variables}~\ &\src{x} \mid \src{y} \mid \src{foo} \mid \dots \hspace{0.5cm}
  %
  \mi{Poison}~\ \src{\poison}~\bnfdef\ \src{\poisonless} \mid \src{\poisoned}\\
  \mi{Sandbox\ Tag}~&\ \src{\sandboxtag}~\bnfdef\ \src{\ctx} \mid \src{\comp}\\
  %
  \mi{Typing. Env.}~\src{\Gamma} \bnfdef&\ \src{\hole{\cdot}} \mid \Gammas,\src{x:\type}\hspace{0.5cm}
  \mi{Store}~\src{\Delta} \bnfdef\ \src{\hole{\cdot}} \mid \src{x\mapsto(\loc;\sandboxtag;\poison;n)},\Deltas\\
  %
  \mi{Communication}~\src{\comm} \bnfdef&\ \src{\ctxtocomp} \mid \src{\comptoctx} \mid \src{\nocomm} \hspace{0.5cm}
  \mi{Heaps}~\src{H} \bnfdef\ \src{\hole{\cdot}} \mid \src{H}::\src{n} \\
  %
  \mi{Cont.\ Stack}~\src{\kontstack} \bnfdef&\ \src{\hole{\cdot}} \mid (\src{K};\src{foo}),\src{\kontstack} \hspace{0.5cm}
  \mi{Library}~\src{\library} \bnfdef\ \src{\hole{\cdot}} \mid \src{\asymbol},\src{\library} \\
  \mi{Relevant}\ \src{\commlib} \bnfdef& \src{\hole{\cdot}} \mid \src{foo},\src{\commlib}\hspace{0.5cm}
  \mi{State}~\configs\ \bnfdef\ \src{\cfstate;\sandboxtag;\memstate}\\
  \mi{Flow\ State}~\src{\cfstate}\bnfdef&\ \src{\commlib;\library;\kontstack}\hspace{0.5cm}
  \mi{Memory\ State}~\src{\memstate}\bnfdef\ \src{H^{\ctx};H^{\comp};\Delta} \\
  %
  \mi{Programs}\ &\src{prog\ \library_{ctx}\ \library_{comp}} \hspace{0.35cm}
  \mi{Substitutions}~\src{\gamma} \bnfdef \src{[\valueexpr/x],\gamma}\ \vert\ \src{\hole{\cdot}} \\
  \end{aligned}
  \end{gather*}
}{mmla-syntax}{Syntax of $\mmlAs$}

Most of the syntax is more or less standard.
Qualifiers $\src{q}$ can be attached to pointers to signal ownership.
Hereby, the qualifier $\src{\full}$ means "fully owned", meaning we may and also must delete the pointer at some point, while we cannot do the same for $\src{\half}$, which forbids us to delete.
Poison $\src{\poison}$ marks locations in the execution-context $\src{\Omega}$ as ,,to-be-deleted'' ($\src{\poisonless}$) or ,,deleted'' ($\src{\poisoned}$).
$\src{\commlib}$ contains a list of identifiers referencing what functions are considered a component.
Anything not present in $\src{\commlib}$ is considered to be a context.
We describe the act of calling or returning from component to context or vice versa as ,,crossing the boundary''.
The heap is split into two parts, such that any component listed in $\src{\commlib}$ will allocate in $\src{H^{\comp}}$ and anything else in $\src{H^{\ctx}}$.
Objects pointed at by a location $\src{\loc}$ are marshalled when they are passed across the boundary.
Without the heap sandboxing, contexts can arbitrarily rewrite a component's memory, which incurs compiler correctness issues.
We chose to distinguish between successful final results ($\src{\finalexprnoerr}$) and potentially crashed results ($\src{\finalexpr}$).
Note that a final result may also be an identifier, which we keep around as abstract representation for locations of pointers.
However, we still distinct them from ordinary values ($\src{\valueexpr}$), since they don't behave like normal values.
For example, we cannot make canonical typing lemmas for them without the additional information contained in a non-empty typing-context.
When discussing secure compilation, there is a notion of ,,context'' and ,,component'', where the latter is usually the part one cares about.
We use the term ,,context-switching'' with its usual meaning, i.e. change in control flow to some other procedure.
For $\src{\comm}$, the representation $\src{\ctxtocomp}$ signalizes a context switch from context to component, $\src{\comptoctx}$ from component to context, and $\src{\nocomm}$ signals an internal change, either inside the context or inside the component.
The state $\configs$ carries information on what the current context is and the continuation stack $\src{\kontstack}$ is used in the semantics to mark events with above policy accordingly.
Continuations $\src{K}$ in the stack are annotated with the name of the function $\src{foo}$ the continuation originates from.
Programs $\src{prog\ \library_{ctx}\ \library_{comp}}$ contain two lists of top-level definitions $\src{\library_{ctx}}$ and $\src{\library_{comp}}$.
$\src{\library_{ctx}}$ takes the role as attacker code.
We reason explicitly about substitutions in the dynamic semantics.

\subsubsection{Static Semantics}
\myfig{
  \begin{center}
    \judgbox{\vdash\src{\tau}\operatorname{int}}{,,$\src{\tau}$ is an interface type.''}$\;$\\
  \typerule{int-$\src{\nat}$}{
  }{
    \vdash\src{\nat}\operatorname{int}
  }{src-int-type-nat}
  \end{center}
}{src-int-types}{Interface types of $\mmlAs$.}

We introduce interface types to explicitly disallow passing owned pointers.

\myfig{
  \begin{center}
  \judgbox{\Gammas \equiv \src{\Gamma_1}\circ\src{\Gamma_2}}{,,Environment $\Gammas$ can be split into $\src{\Gamma_1}$ and $\src{\Gamma_2}$.''}
  %
  $\;$\\
  \typerule{splitEmpty}{
  }{
    \src{\hole{\cdot}} \equiv \src{\hole{\cdot}}\circ\src{\hole{\cdot}}
  }{t-empty-split}
  %
  \typerule{splitEmptyL}{
  }{
    \src{\Gamma} \equiv \src{\hole{\cdot}}\circ\src{\Gamma}
  }{t-empty-splitL}
  %
  \typerule{splitEmptyR}{
  }{
    \src{\Gamma} \equiv \src{\Gamma}\circ\src{\hole{\cdot}}
  }{t-empty-splitR}
  %
  \typerule{$\nat$split}{
    \Gammas \equiv \src{\Gamma_1}\circ\src{\Gamma_2}
  }{
    \src{x:\nat},\Gammas \equiv \src{x:\nat},\src{\Gamma_1}\circ\src{x:\nat},\src{\Gamma_2}
  }{t-nat-split}
  %
  \typerule{weakPtrSplit}{
    \Gammas \equiv \src{\Gamma_1}\circ\src{\Gamma_2}
  }{
    \src{x:\wptr},\Gammas \equiv \src{x:\wptr},\src{\Gamma_1}\circ\src{x:\wptr},\src{\Gamma_2}
  }{t-wptr-split}
  %
  \typerule{ptrLSplit}{
    \Gammas \equiv \src{\Gamma_1}\circ\src{\Gamma_2}
  }{
    \src{x:\ptr},\Gammas \equiv \src{x:\ptr},\src{\Gamma_1}\circ\src{\Gamma_2}
  }{t-ptr-l-split}
  %
  \typerule{ptrRSplit}{
    \Gammas \equiv \src{\Gamma_1}\circ\src{\Gamma_2}
  }{
    \src{x:\ptr},\Gammas \equiv \src{x:\wptr,\Gamma_1}\circ\src{x:\ptr},\src{\Gamma_2}
  }{t-ptr-r-split}
  %
  \typerule{arrowSplit}{
    \vdash\src{\type_e^{(1)}}\ \operatorname{int} &
    \vdash\src{\type_e^{(2)}}\ \operatorname{int} &
    \src{\Gamma}\equiv\src{\Gamma_1}\circ\src{\Gamma_2}
  }{
    \src{foo:\type_e^{(1)}\to\type_e^{(2)}},\Gammas \equiv \src{foo:\type_e^{(1)}\to\type_e^{(2)}},\src{\Gamma_1}\circ\src{foo:\type_e^{(1)}\to\type_e^{(2)}},\src{\Gamma_2}
  }{t-arrow-split}
  \end{center}
}{w-ctx-split}{Context Splitting of $\mmlAs$ typing contexts.}

The splitting of contexts takes care to propagate owned-pointers towards the end.
This way, no non-owned pointer occurs in the context after an owned one, where both have the same identifier.
Note that non-owned pointers and values may be freely duplicated and that we can generate non-owned pointers if we have ownership.

\begin{definition}[NoOwnedPtr]
  We write $\src{\noptr{\Gamma}}$ iff for any $\src{x}, \src{\type}$, if $\src{x} : \src{\type}\in\src{\Gamma}$, then $\types\not=\ptr$.
\end{definition}
\myfig{
  \judgbox{\typechecks{\Gamma}{e}{\types}}{,,Under environment $\Gammas$ the expression $\src{e}$ has type $\types$.''}

  \begin{center}
  \typerule{$t-\src{var}$}{
  \src{\noptr{\Gamma_1,x:\type,\Gamma_2}}
	}{
    \typechecks{\Gamma_1,x:\type,\Gamma_2}{x}{\type}
	}{t-var}
  %
  \typerule{$t-\src{\nat}$}{
    \src{\noptr{\Gamma}}
  }{
    \typechecks{\Gamma}{n}{\nat}
  }{t-nat}
  %
  \typerule{$t-\src{\oplus}$}{
    \typechecks{\Gamma_1}{e_1}{\nat} &
    \typechecks{\Gamma_2}{e_2}{\nat}
  }{
    \typechecks{\Gamma_1\circ\Gamma_2}{e_1\oplus e_2}{\nat}
  }{t-binop}
  %
  \typerule{$t-$get}{
    \typechecks{\Gamma_2}{x}{\wptr} &
    \typechecks{\Gamma_1}{e}{\nat}
  }{
    \typechecks{\Gamma_1\circ\Gamma_2}{x[e]}{\nat}
  }{t-get}
  %
  \typerule{$t-$set}{
    \typechecks{\Gamma_3}{x}{\wptr} &
    \typechecks{\Gamma_1}{e_1}{\nat} &
    \typechecks{\Gamma_2}{e_2}{\nat}
  }{
    \typechecks{(\Gamma_1\circ\Gamma_2)\circ\Gamma_3}{x[e_1]\leftarrow e_2}{\nat}
  }{t-set}
  %
  \typerule{$t-\src{let}$}{
    \typechecks{\Gamma_1}{e_1}{\type_{e}^{(1)}} &
    \typechecks{x:\type_{e}^{(1)},\Gamma_2}{e_2}{\type^{(2)}}
  }{
    \typechecks{\Gamma_1\circ\Gamma_2}{let\ x=e_1\ in\ e_2}{\type^{(2)}}
  }{t-let}
  %
  \typerule{$t-\src{new}$}{
    \typechecks{\Gamma_1}{e_1}{\nat} &
    \typechecks{x:\ptr,\Gamma_2}{e_2}{\nat}
  }{
    \typechecks{\Gamma_1\circ\Gamma_2}{let\ x=new\ e_1\ in\ e_2}{\nat}
  }{w-t-new}
  %
  \typerule{$t-\src{delete}$}{
    \src{\noptr{\Gamma_1}} & \src{\noptr{\Gamma_2}}
  }{
    \typechecks{\Gamma_1,x:\ptr,\Gamma_2}{delete\ x}{\nat}
  }{w-t-delete}
  %
  \typerule{$t-\src{call}$}{
    \vdash\src{\type_e^{(1)}}\ \operatorname{int} &
    \vdash\src{\type_e^{(2)}}\ \operatorname{int} \\
    \typechecks{\Gamma}{foo}{\type_e^{(1)}\to\type_e^{(2)}} &
    \typechecks{\Gamma}{e}{\type_e^{(1)}}
  }{
    \typechecks{\Gamma}{call\ foo\ e}{\type_e^{(2)}}
  }{t-call}
  %
  \typerule{$t-\src{return}$}{
    \src{\type_e}\ \operatorname{int} &
    \typechecks{\Gamma}{e}{\type_e}
  }{
    \typechecks{\Gamma}{return\ e}{\type_e\to\bot}
  }{t-return}
  %
  \typerule{$t-\src{ifz}$}{
    \typechecks{\Gamma_1}{e_1}{\nat} &
    \typechecks{\Gamma_2}{e_2}{\type} &
    \typechecks{\Gamma_2}{e_3}{\type}
  }{
    \typechecks{\Gamma_1\circ\Gamma_2}{ifz\ e_1\ then\ e_2\ else\ e_3}{\type}
  }{w-t-if}
  %
  \typerule{$t-\src{abort}$}{
  }{
    \typechecks{\Gamma}{abort()}{\type}
  }{w-t-abort}
  \end{center}
}{w-expr-ty}{Checking of $\mmlAs$ expressions.}
The context splitting takes care that for e.g. \Cref{tr:t-binop} it cannot happen that we do something like $\src{(delete\ x) + x[0]}$.
For \Cref{tr:t-var,tr:t-nat} we require that the contexts do not contain any owned pointer.
Intuitively, an owned pointer is useless upto getting a non-owned version from context splitting, because we cannot do anything with it besides deleting.
This is inspired by linear logic.

\myfig{
  \judgbox{\typechecks{\Gamma}{K}{\types^{(1)}\to\types^{(2)}}}{,,Under environment $\Gammas$ the evaluation context $\src{K}$ requires an\\object of type $\src{\type^{(1)}}$ and yields one of type $\src{\type^{(2)}}$.''}
  \begin{center}
    \typerule{et-$\src{\hole{\cdot}}$}{
    }{
      \typechecks{\Gamma}{\hole{\cdot}}{\type\to\type}
    }{w-te-hole}
    %
    \typerule{et-$\src{\oplus}$R}{
      \typechecks{\Gamma}{\valueexpr}{\nat} &
      \typechecks{\Gamma}{K}{\type\to\nat}
    }{
      \typechecks{\Gamma}{\valueexpr\oplus K}{\type\to\nat}
    }{w-te-bionpR}
    %
    \typerule{et-$\src{\oplus}$L}{
      \typechecks{\Gamma}{K}{\type\to\nat} &
      \typechecks{\Gamma}{e}{\nat}
    }{
      \typechecks{\Gamma}{K\oplus e}{\type\to\nat}
    }{w-te-bionpL}
    %
    \typerule{et-get}{
      \typechecks{\Gamma}{x}{\wptr} &
      \typechecks{\Gamma}{K}{\type\to\nat}
    }{
      \typechecks{\Gamma}{x[K]}{\type\to\nat}
    }{w-te-get}
    %
    \typerule{et-setR}{
      \typechecks{\Gamma}{v}{\nat} &
      \typechecks{\Gamma}{K}{\type\to\nat}
    }{
      \typechecks{\Gamma}{x[\valueexpr]\leftarrow K}{\type\to\nat}
    }{w-te-setR}
    %
    \typerule{et-setL}{
      \typechecks{\Gamma}{K}{\type\to\nat} &
      \typechecks{\Gamma}{e}{\nat}
    }{
      \typechecks{\Gamma}{x[K]\leftarrow e}{\type\to\nat}
    }{w-te-setL}
    %
    \typerule{et-let}{
      \typechecks{\Gamma}{K}{\type^{(1)}\to\type_{e}'} &
      \typechecks{x:\type_{e}',\Gamma}{e}{\type^{(2)}}
    }{
      \typechecks{\Gamma}{let\ x=K\ in\ e}{\type^{(1)}\to\type^{(2)}}
    }{w-te-let}
    %
    \typerule{et-new}{
      \typechecks{\Gamma}{K}{\type^{(1)}\to\nat} &
      \typechecks{x:\ptr,\Gamma}{e}{\type^{(2)}}
    }{
      \typechecks{\Gamma}{let\ x=new\ K\ in\ e}{\type^{(1)}\to\type^{(2)}}
    }{w-te-new}
    %
    \typerule{et-ifz}{
      \typechecks{\Gamma}{K}{\type^{(1)}\to\nat} &
      \typechecks{\Gamma}{e_2}{\type^{(2)}}&
      \typechecks{\Gamma}{e_3}{\type^{(2)}}&
    }{
      \typechecks{\Gamma}{ifz\ K\ then\ e_2\ else\ e_3}{\type^{(1)}\to\type^{(2)}}
    }{w-te-ifz}
    %
    \typerule{et-call}{
      \typechecks{\Gamma}{K}{\type^{(1)}\to\type'} &
      \typechecks{\Gamma}{foo}{\type'\to\type^{(2)}}
    }{
      \typechecks{\Gamma}{call\ foo\ K}{\type^{(1)}\to\type^{(2)}}
    }{w-te-call}
    %
    \typerule{et-ret}{
      \typechecks{\Gamma}{K}{\type^{(1)}\to\type^{(2)}}
    }{
      \typechecks{\Gamma}{return\ K}{\type^{(1)}\to(\type^{(2)}\to\bot)}
    }{w-te-ret}
  \end{center}
}{w-ectx-ty}{Checking of $\mmlAs$ evaluation contexts.}

\myfig{
  \judgbox{\src{\library}\downarrow=\src{\Gamma}}{,,Project $\mmlAs$ library to static typing context.''}$\;$\\
  \begin{center}
    \typerule{$\src{\library}$-proj-$\src{\hole{\cdot}}$}{
    }{
      \src{\hole{\cdot}}\downarrow = \src{\hole{\cdot}}
    }{w-lib-proj-empty}
    %
    \typerule{$\src{\library}$-proj-cons}{
      \src{\library}\downarrow = \src{\Gamma}
    }{
      (\src{let\ foo\ x : \type}_\lambda\src{:= e})\src{,\library}\downarrow = (\src{foo \mapsto \type}_\lambda),\src{\Gamma}
    }{w-lib-proj-cons}
  \end{center}
  %
  \judgbox{\operatorname{dom}\ \src{\library}=\src{foo},\dots,\src{bar}}{,,Collect function names.''}$\;$\\
  \begin{center}
    \typerule{$\src{\library}$-dom-$\src{\hole{\cdot}}$}{
    }{
      \operatorname{dom}\ \src{\hole{\cdot}} = \src{\hole{\cdot}}
    }{w-lib-dom-empty}
    %
    \typerule{$\src{\library}$-dom-cons}{
      \operatorname{dom}\ \src{\library} = \src{D}
    }{
      \operatorname{dom}\ (\src{let\ foo\ x : \type}_\lambda\src{:= e})\src{,\library} = \src{foo},\src{D}
    }{w-lib-dom-cons}
  \end{center}
}{w-gamma-of-symbols}{Extracting type annotations and function names.}

\myfig{
  \begin{center}
    \judgbox{\src{\library}\equiv\src{\library_1}\cup\src{\library_2}}{,,Merging $\mmlAs$ libraries.''}$\;$\\
    \typerule{lib-merge-empty}{
      \src{\library}=\src{\library_1}
    }{
      \src{\library}\equiv\src{\library_1}\cup\src{\hole{\cdot}}
    }{src-lib-merge-empty}
    %
    \typerule{lib-merge-cons}{
      \src{\library}\equiv\src{\library_1}\cup\src{\library_2}
    }{
      \src{\asymbol,\library}\equiv\src{\library_1}\cup\src{\asymbol,\library_2}
    }{src-lib-merge-cons}

    \judgbox{\src{\library_1\linker\library_2}=\src{\library}}{,,Syntactically linking $\mmlAs$ libraries.''}$\;$\\
    \typerule{syntactic-plugging}{
      \operatorname{dom}\src{\library_1}\cap\operatorname{dom}\src{\library_2} = \emptyset &
      \src{\library}\equiv\src{\library_1}\cup\src{\library_2}
    }{
      \src{\library_1\linker\library_2} = \src{\library}
    }{src-plugging}
  \end{center}
}{w-plugging-s}{$\mmlAs$ plugging of libraries.}

\myfig{
  \begin{center}
    \judgbox{\src{\Gamma}\vdash\src{\library}\ \operatorname{ok}}{,,$\mmlAs$ library typechecks.''}$\;$\\
    %
    \typerule{t-$\src{\library}$-empty}{
    }{
      \src{\Gamma}\vdash\src{\hole{\cdot}}\ \operatorname{ok}
    }{w-t-lib-empty}
    %
    \typerule{t-$\src{\library}$-cons}{
      \src{\type_e^{(1)}}\ \operatorname{int} &
      \src{\type_e^{(2)}}\ \operatorname{int} &
      \src{\Gamma}\vdash\src{\library}\ \operatorname{ok} &
      \typechecks{x:\type_e^{(1)},\Gamma}{e}{\type_{e}^{(2)}\to\bot}
    }{
      \src{\Gamma}\vdash(\src{let\ foo\ x : \type_e^{(1)}}\to\src{\type_e^{(2)}:= e}),\src{\library}\ \operatorname{ok}
    }{w-t-lib-cons}\\[0.33cm]
    %
    \judgbox{\vdash\src{prog\ \library_{ctx}\ \library_{comp}}\dashv\src{\library},\src{\commlib}}{,,$\mmlAs$ program $\src{prog\ \library_{ctx}\ \library_{comp}}$ typechecks. $\src{\library}$ is the\\result of linking $\src{\library_{ctx}}$ and $\src{\library_{comp}}$. $\src{\commlib}$ is $\operatorname{dom}\ \src{\library_{comp}}$.''}$\;$\\
    %
    \typerule{$t-\text{prog}$}{
      \src{\library}=\src{\library_{ctx}\linker\library_{comp}} &
      \src{\library}\downarrow = \src{\Gamma_0} &
      \src{main}\in\operatorname{dom} \src{\Gamma_0} &
      \src{\Gamma_0}\vdash\src{\library}\ \operatorname{ok} \\
      \typechecks{\Gamma_0}{call\ main\ 0}{\nat\to\nat}
    }{
      \vdash\src{prog\ \library_{ctx}\ \library_{comp}}\dashv \src{\library},\operatorname{dom}\ \src{\library_{comp}}
    }{w-t-wprog}
    %
    \judgbox{\typechecks{}{\configs\triangleright e}{\type}}{,,$\mmlAs$ runtime program $\src{\configs\triangleright e}$ typechecks.''}$\;$\\
    \typerule{$t-\text{prog}-\text{runtime}$}{
      \typechecks{\library}{\Delta}{\Gamma}&
      \typechecks{\Gamma}{e}{\type}
    }{
      \typechecks{}{\commlib;\library;\kontstack;\sandboxtag;H^\ctx;H^\comp;\Delta\triangleright e}{\type}
    }{w-t-prog-runtime}
  \end{center}
}{w-program-ty}{Checking of $\mmlAs$ contexts, components, programs, and whole programs.}
Perhaps most interesting is \Cref{tr:w-t-prog-runtime} which generates a suitable typing context from the execution context.
\Cref{fig:store-ty} shows how this works exactly.

\myfig{
  \begin{center}
    \judgbox{\typechecks{\library}{\Delta}{\Gamma}}{,,$\mmlAs$ location map $\Deltas$ yields static typing environment $\Gammas$.''}
    \typerule{$T\text{empty}\src{\Delta}$}{
      \src{\library}\downarrow=\src{\Gamma}
    }{
      \typechecks{\library}{\hole{\cdot}}{\Gammas}
    }{t-empty-store}
    %
    \typerule{$T\ptr$}{
    \typechecks{\library}{\Delta}{\Gamma}
    }{
    \typechecks{\library}{x\mapsto(\loc;\sandboxtag;\poisonless;n),\Delta}{x:\ptr,\Gamma}
    }{t-ptr-store}
    %
    \typerule{$T\ptr\text{poison}$}{
    \typechecks{\library}{\Delta}{\Gamma}
    }{
    \typechecks{\library}{x\mapsto(\loc;\sandboxtag;\poisoned;n),\Delta}{\Gamma}
    }{t-poison-store}
  \end{center}
}{store-ty}{$\mmlAs$ store typing.}
Here, we want to populate the typing context with all {\em valid} pointers, which are those that are not poisoned.
Pointers of type $\src{\wptr}$ are implicitly generated during elaboration, see \Cref{fig:w-ctx-split}.

\subsubsection{Dynamic Semantics}

The language trivially satisfies \gls{scct}.
It does not satisfy \gls{sms}, as seen in \Thmref{thm:lms:notspatmemsafe}.

\myfig{
  \begin{gather*}
  \begin{aligned}
  \mi{Base\ Events}~\src{\event_{b}} \bnfdef&\ \src{Alloc\ \loc\ \valueexpr} \mid \src{Dealloc\ \loc} \mid \src{Get\ \loc\ \valueexpr} \mid \src{Set\ \loc\ \valueexpr\ \valueexpr'} \\
                                  & \mid \src{Call\ \comm\ foo\ \valueexpr} \mid \src{Ret\ \comm\ \valueexpr} \mid \src{Start} \mid \src{End\ \valueexpr}\\
  \mi{Events}~\src{\event} \bnfdef&\ \src{\emptyevent} \mid \src{\event_{b};\sandboxtag} \mid \src{\lightning}
  \end{aligned}
  \end{gather*}
}{w-events}{Events of $\mmlAs$.}

\myfig{
  \judgbox{\exprevals{\configs}{e}{\configs'}{e'}{\event}}{,,Expression $\src{e}$ applied evaluates under configuration $\configs$\\to $\src{e'}$ and new configuration $\src{\configs'}$, emitting event $\src{\event}$.''}
  %
  \typerule{$e-\src{\oplus}$}{
    \src{n_1}\oplus\src{n_2}=\src{n_3}
  }{
    \exprevals{\configs}{n_1 \oplus n_2}{\configs}{n_3}{\emptyevent}
  }{w-e-oplus}
  %
  \typerule{$e-\src{get}-\in$}{
    \src{\memstate}=\src{H^{\ctx};H^{\comp};\Delta_1,x\mapsto(\loc;\sandboxtag;\poison;m),\Delta_2} &
    \src{\loc}+\src{n}\in\text{dom }\src{\memstate.H^{\sandboxtag}}
  }{
    \exprevals{\cfstate;\sandboxtag';\memstate}{x[n]}{\cfstate;\sandboxtag';\memstate}{H^{\sandboxtag}(\loc+n)}{Get\ \loc\ n;\sandboxtag}
  }{w-e-get-in}
  %
  \typerule{$e-\src{get}-\notin$}{
    \src{\memstate.\Delta}=\src{\Delta_1,x\mapsto(\loc;\sandboxtag;\poison;m),\Delta_2} &
    \src{\loc+\src{n}}\notin\text{dom }\src{\memstate.H^{\sandboxtag}}
  }{
    \exprevals{\cfstate;\sandboxtag';\memstate}{x[n]}{\cfstate;\sandboxtag';\memstate}{1729}{Get\ \loc\ n;\sandboxtag}
  }{w-e-get-notin}
  %
  \typerule{$e-\src{set}-\in$}{
    \src{\memstate.\Delta}=\src{\Delta_1,x\mapsto(\loc;\sandboxtag;\poison;m),\Delta_2} &
    \src{\loc+\src{n}}\in\operatorname{dom}\src{\memstate.H^{\sandboxtag}}\\
    \src{H^{\sandboxtag}_1} = \src{\memstate.H^{\sandboxtag}}(\src{\loc+n}\mapsto \src{v}) &
    \src{\memstate'}=\src{\memstate[H^{\sandboxtag}\leftarrow H^{\sandboxtag}_1]}
  }{
    \exprevals{\cfstate;\sandboxtag_0;\memstate}{x[n]\leftarrow v}{\cfstate;\sandboxtag_0;\memstate'}{v}{Set\ \loc\ n\ v;\sandboxtag_0}
  }{w-e-set-in}
  %
  \typerule{$e-\src{set}-\notin$}{
    \src{\memstate.\Delta}=\src{\Delta_1,x\mapsto(\loc;\sandboxtag;\poison;m),\Delta_2} &
    \src{\loc+\src{n}}\notin\operatorname{dom}\src{\memstate.H^{\sandboxtag}}
  }{
    \exprevals{\cfstate;\sandboxtag_0;\memstate}{x[n]\leftarrow v}{\cfstate;\sandboxtag_0;\memstate'}{v}{Set\ \loc\ n\ v;\sandboxtag_0}
  }{w-e-set-notin}
  %
  \typerule{$e-\src{let}-\src{\finalexprnoerr}$}{
  }{
    \exprevals{\Omega}{let\ x=\finalexprnoerr\ in\ e}{\Omega}{e[\finalexprnoerr/x]}{\emptyevent}
  }{w-e-let-f}
  %
  \typerule{$e-\src{delete}$}{
    \src{\memstate}=\src{H^{\ctx};H^{\comp};\Delta_1,x\mapsto(\loc;\sandboxtag;\poisonless;n),\Delta_2} \\
    \src{\memstate}=\src{H^{\ctx};H^{\comp};\Delta_1,x\mapsto(\loc;\sandboxtag;\poisoned;n),\Delta_2}
  }{
    \exprevals{\cfstate;\sandboxtag;\memstate}{delete\ x}{\cfstate;\sandboxtag;\memstate'}{0}{Dealloc\ \loc;\sandboxtag}
  }{w-e-delete}
  %
  \typerule{$e-\src{new}$}{
    \fresh{\src{\memstate.\Delta}}{\src{\loc}} &
    \fresh{\src{\memstate.\Delta}}{\src{z}} &
    \src{H^{\sandboxtag}_1} = \src{\memstate.H^{\sandboxtag}} \ll \src{n} \\
    \src{\memstate'} = \src{\memstate[H^{\sandboxtag} \leftarrow H^{\sandboxtag}_1][\Delta \leftarrow z\mapsto(\loc,\sandboxtag,\poisonless;n),\memstate.\Delta]}
  }{
    \exprevals{\cfstate;\sandboxtag;\memstate}{let\ x=new\ n\ in\ e}{\cfstate;\sandboxtag;\memstate'}{e[z/x]}{Alloc\ \loc\ n;\sandboxtag}
  }{w-e-let-new}
  %
  \typerule{$e-\src{ifz}-$true}{
  }{
  \exprevals{\Omega}{ifz\ 0\ then\ e_1\ else\ e_2}{\Omega}{e_1}{\emptyevent}
  }{w-e-if-true}
  %
  \typerule{$e-\src{ifz}-$false}{
  }{
  \exprevals{\Omega}{ifz\ S(n)\ then\ e_1\ else\ e_2}{\Omega}{e_2}{\emptyevent}
  }{w-e-if-false}
  %
  \typerule{$e-\src{abort}$}{
  }{
    \exprevals{\Omega}{abort()}{\lightning}{stuck}{\lightning}
  }{w-e-abort}
}{w-expr-prim-eval}{Primitive Evaluation of $\mmlAs$ expressions.}
Evaluation is mostly straightforward, the only interesting cases involve the pointers.
Specifically, \Cref{tr:w-e-delete} demonstrates why we need the poison-tag on the locations: Regardless of the current tag, emit a $\src{Dealloc\ \loc}$ event and mark $\src{\loc}$ as poisoned ($\src{\poisoned}$).
The intuitive solution, removing the mapping on deletion, doesn't allow to run programs that delete twice.
However, we want to model memory effects and show that such situations never happen, even though they {\em could}.
Given a poisoned location, we can still do everything with it: reading, writing, or deletion.
When generating the static context from the execution context, \Cref{tr:t-poison-store} allows us to disregard deleted locations which will help us reason that the given execution could not have been happening if the program was well-typed to begin with.
For sake of readablity, we will omit $\src{\gamma}=\src{\hole{\cdot}}$ when writing down evaluation steps.
That is, whenever we have $\exprevals{\configs}{e\hole{\cdot}}{\configs'}{e'\hole{\cdot}}{\event}$, it's written $\exprevals{\configs}{e}{\configs'}{e'}{\event}$.
Moreover, $\src{\gamma}$ as postfix binds anything before it up to $\triangleright$, so $\src{let\ x=e_{1}\ in\ e_{2}\gamma}$ is $\src{(let\ x=e_{1}\ in\ e_{2})\gamma}$.


\myfig{
  \begin{center}
    \judgbox{\execs[]{\configs}{K[e]}{\configs'}{K'[e']}{\event}}{,,Given an evaluation context $\src{K}$ and an expression $\src{e}$\\it evaluates under configuration $\configs$ to $\src{e'}$ and new\\configuration $\src{\configs'}$ in context $\src{K}$, emitting event $\src{\event}$.''}
    %
    \typerule{$e-\text{ctx}$}{
      \exprevals{\Omega}{e}{\Omega'}{e'}{\event}
    }{
      \execs[]{\Omega}{K[e]}{\Omega'}{K[e']}{\event}
    }{w-e-ectx}
    %
    \typerule{$e-\text{ctx}-\src{stuck}$}{
      \exprevals{\Omega}{e}{\Omega'}{stuck}{\lightning}
    }{
      \execs[]{\Omega}{K[e]}{\Omega'}{stuck}{\lightning}
    }{w-e-ectx-stuck}
    %
    \typerule{$e-\text{ctx}-\src{call}-$main}{
      \src{\Omega}=\src{\commlib;\library;\hole{\cdot};\comp;\memstate} &
      \src{\library}=\src{\library_1,}(\src{let\ main\ x:\type}_\lambda\src{:=e})\src{,\library_2}\\
      \src{\Omega'}=\src{\commlib;\library;\ctx;(K;main),\hole{\cdot};\memstate}
    }{
      \execs[]{\Omega}{K[call\ main\ \valueexpr]}{\Omega'}{e[x/\valueexpr]}{Start;\comp}
    }{w-e-ectx-call-main}
    %
    \typerule{$e-\text{ctx}-\src{call}-\text{notsame}$}{
      \src{\Omega}=\src{\commlib;\library;\kontstack;\sandboxtag;\memstate} &
      \src{\library}=\src{\library_1,}(\src{let\ foo\ x:\type}_\lambda\src{:=e})\src{,\library_2} \\
      %\rho_{\tiny call}(\src{\commlib},\src{foo},\src{\kontstack},\src{v}) = \src{\event},\src{\comm} &
      \src{foo}\in_{\src{\neg\sandboxtag}}\src{\commlib} &
      \rho\left(\src{\sandboxtag}\right) = \src{\comm} &
      \src{\Omega'}=\src{\commlib;\library;(K;foo),\kontstack;\neg\sandboxtag;\memstate} \\
    }{
      \execs[]{\Omega}{K[call\ foo\ \valueexpr]}{\Omega'}{e[x/\valueexpr]}{Call\ \comm\ foo\ \valueexpr;\sandboxtag}
    }{w-e-ectx-call-notsame}
    %
    \typerule{$e-\text{ctx}-\src{call}-\text{same}$}{
      \src{\Omega}=\src{\commlib;\library;\kontstack;\sandboxtag;\memstate} &
      \src{\library}=\src{\library_1,}(\src{let\ foo\ x:\type}_\lambda\src{:=e})\src{,\library_2} \\
      %\rho_{\tiny call}(\src{\commlib},\src{foo},\src{\kontstack},\src{v}) = \src{\event},\src{\comm} &
      \src{foo}\in_{\src{\sandboxtag}}\src{\commlib} &
      \src{\Omega'}=\src{\commlib;\library;(K;foo),\kontstack;\sandboxtag;\memstate} \\
    }{
      \execs[]{\Omega}{K[call\ foo\ \valueexpr]}{\Omega'}{e[x/\valueexpr]}{Call\ \nocomm\ foo\ \valueexpr;\sandboxtag}
    }{w-e-ectx-call-same}
    %
    \typerule{$e-\text{ctx}-\src{return}-$main}{
    }{
      \exec[]{\src{\commlib;\library;\hole{\cdot}^{main},\hole{\cdot};\ctx;\memstate}}{\src{K'[return\ \valueexpr]}}{\src{\commlib;\library;\hole{\cdot};\comp;\memstate}}{\src{\valueexpr}}{\src{End\ \valueexpr;\sandboxtag}}
    }{w-e-ectx-ret-main}
    %
    \typerule{$e-\text{ctx}-\src{return}-\text{notsame}$}{
      \src{foo}\in_{\src{\neg\sandboxtag}}\src{\commlib} &
      \rho\left(\src{\sandboxtag}\right) = \src{\comm}
    }{
      \exec[]{\src{\commlib;\library;(K;foo),\kontstack;\sandboxtag;\memstate}}{\src{K'[return\ \valueexpr]}}{\src{\commlib;\library;\kontstack;\neg\sandboxtag;\memstate}}{\src{K[\valueexpr]}}{\src{Ret\ \comm\ \valueexpr;\sandboxtag}}
    }{w-e-ectx-ret-notsame}
    %
    \typerule{$e-\text{ctx}-\src{return}-\text{same}$}{
      \src{foo}\in_{\src{\sandboxtag}}\src{\commlib}
    }{
      \exec[]{\src{\commlib;\library;(K;foo),\kontstack;\sandboxtag;\memstate}}{\src{K'[return\ \valueexpr]}}{\src{\commlib;\library;\kontstack;\sandboxtag;\memstate}}{\src{K[\valueexpr]}}{\src{Ret\ \nocomm\ \valueexpr;\sandboxtag}}
    }{w-e-ectx-ret-same}
    %
    \judgbox{\rho(\src{\sandboxtag})=\src{\comm}}{,,Returns either $\src{\ctxtocomp}$ or $\src{\comptoctx}$ depending on $\src{\sandboxtag}$.''}\\
    %
    \typerule{comm-ctxtocomp}{
    }{
      \rho(\src{\ctx})=\src{\ctxtocomp}
    }{w-comm-ctxtocomp}
    %
    \typerule{comm-comptoctx}{
    }{
      \rho(\src{\comp})=\src{\comptoctx}
    }{w-comm-comptoctx}\\[0.33cm]
    %
    \judgbox{\src{\neg\sandboxtag}=\src{\sandboxtag'}}{,,Negation of $\src{\sandboxtag}$.''}\\
    %
    \typerule{neg-ctx}{
    }{
      \src{\neg\ctx}=\src{\comp}
    }{w-neg-ctx}
    %
    \typerule{neg-comp}{
    }{
      \src{\neg\comp}=\src{\ctx}
    }{w-neg-comp}
  \end{center}
}{w-expr-ctx-eval}{Contextual Evaluation of $\mmlAs$ expressions.}
\myfig{
  \begin{center}
    \judgbox{\execs{\configs}{e}{\configs'}{e'}{\trace}}{,,Expression $\src{e}$ evaluates under configuration $\configs$ to $\src{e'}$ and\\new configuration $\src{\configs'}$, emitting list of events $\src{\trace}$.''}
    %
    \typerule{$es-\text{refl}$}{
    }{
      \execs{\configs}{\finalexprnoerr}{\configs}{\finalexprnoerr}{\hole{\cdot}}
    }{ws-e-refl}
    %
    \typerule{$es-\text{trans}-$important}{
      \execs[]{\configs}{e}{\configs'}{e'}{\event}&
      \execs{\configs'}{e'}{\configs''}{e''}{\trace}&
      \src{\event}\not=\src{\emptyevent}
    }{
      \execs{\configs}{e}{\configs''}{e''}{\event \cdot \trace}
    }{ws-e-trans-important}
    %
    \typerule{$es-\text{trans}-$unimportant}{
      \execs[]{\configs}{e}{\configs'}{e'}{\emptyevent}&
      \execs{\configs'}{e'}{\configs''}{e''}{\trace}&
    }{
      \execs{\configs}{e}{\configs''}{e''}{\trace}
    }{ws-e-trans-unimportant}
    %
    \judgbox{\execsn{\configs}{e}{\configs'}{e'}{\trace}}{,,Expression $\src{e}$ evaluates in $n$ steps under configuration $\configs$ to $\src{e'}$\\and new configuration $\src{\configs'}$, emitting list of events $\src{\trace}$.''}
    %
    \typerule{$en-\text{refl}$}{
    }{
      \execsn[^0]{\configs}{e}{\configs}{e}{\emptyevent}
    }{wsn-e-refl}
    %
    \typerule{$en-\text{trans}-$important}{
      \execs[]{\configs}{e}{\configs'}{e'}{\event} &
      \execsn[^n]{\configs'}{e'}{\configs''}{e''}{\trace} &
      \src{\event}\not=\src{\emptyevent}
    }{
      \execsn[^{(n+1)}]{\configs}{e}{\configs''}{e''}{\event\cdot\trace}
    }{wsn-e-trans-important}
    %
    \typerule{$en-\text{trans}-$unimportant}{
      \execs[]{\configs}{e}{\configs'}{e'}{\emptyevent} &
      \execsn[^n]{\configs'}{e'}{\configs''}{e''}{\trace} &
    }{
      \execsn[^{(n+1)}]{\configs}{e}{\configs''}{e''}{\trace}
    }{wsn-e-trans-unimportant}
  \end{center}
}{w-steps}{Trace prefix generation given a $\mmlAs$ program using the reflexive-transitive closure.}

\myfig{
  \begin{center}
    \judgbox{\wexecs{prog\ \library_{ctx}\ \library_{comp}}{\configs}{\finalexprnoerr}{\trace}}{,,Run $\mmlAs$ program $\src{prog\ \library_{ctx}\ \library_{comp}}$, giving dynamic state\\$\configs$ and emitting trace $\src{\trace}$.''}
    \typerule{$e-\text{wprog}$}{
      \vdash\src{prog\ \library_{ctx}\ \library_{comp}}\dashv \src{\commlib},\src{\library} &
      \src{main}\notin\src{\commlib}\\
      \execs{\commlib;\library;\hole{\cdot};\comp;\hole{\cdot};\hole{\cdot};\hole{\cdot}}{call\ main\ 0}{\Omega}{\finalexprnoerr}{\trace}
    }{
      \wexecs{prog\ \library_{ctx}\ \library_{comp}}{\configs}{\finalexprnoerr}{\trace}
    }{ws-e-prog}
    %
    \typerule{$e-\text{wprog}-\lightning$}{
      \vdash\src{prog\ \library_{ctx}\ \library_{comp}}\dashv \src{\commlib},\src{\library} &
      \src{main}\notin\src{\commlib}\\
      \execs{\commlib;\library;\hole{\cdot};\comp;\hole{\cdot};\hole{\cdot};\hole{\cdot}}{call\ main\ 0}{\Omega}{\finalexpr}{\trace\cdot\lightning;\sandboxtag}
    }{
      \wexecs{prog\ \library_{ctx}\ \library_{comp}}{\configs}{\finalexpr}{\trace\cdot\lightning;\sandboxtag}
    }{ws-e-prog-crash}
  \end{center}
}{wprog-run}{Running a whole $\mmlAs$ program.}

\subsubsection{Translation to Specification Events}
We need a way to translate from concrete actions, as emitted by a program's execution, to abstract actions.
The translation is, however, standard.
The empty action $\specificev{\emptyevent}$ is necessary. When proving lemmas by structural induction on the primitive steps (\Cref{fig:w-expr-prim-eval}), we get a concrete event $\src{\emptyevent}$ that needs to be related to some $\msevent$. The natural candidate is $\specificev{\emptyevent}$.
We also use it to project the call/return events onto it.

\myfig{
  \begin{center}
    \judgbox{\delta_{MS}(\src{\loc})=\specificev{\loc}}{,,A map from $\mmlAs$ memory locations $\src{\loc}$ to specification locations $\specificev{\loc}$.''}
    \judgbox{\tospecificevs[_{\delta_{MS}}]{\event} = \msevent}{,,Project an $\mmlAs$ event to specification events.''}
    %
    \typerule{filter-context}{
      \src{\event_b} \not= \src{\lightning}
    }{
      \tospecificevs[_{\delta_{MS}}]{\event_b;\ctx} = \specificev{\emptyevent}
    }{filter-context}
    %
    \typerule{filter-comp-start}{
    }{
      \tospecificevs[_{\delta_{MS}}]{Start;\comp} = \specificev{\emptyevent}
    }{filter-comp-start}
    %
    \typerule{filter-comp-alloc}{
      \delta_{MS}(\src{\loc})=\specificev{\loc} &
      \specificev{n}=\src{n}
    }{
      \tospecificevs[_{\delta_{MS}}]{Alloc\ \loc\ n;\comp} = \specificev{Alloc\ \loc\ n}
    }{filter-comp-alloc}
    %
    \typerule{filter-comp-dealloc}{
      \delta_{MS}(\src{\loc})=\specificev{\loc}
    }{
      \tospecificevs[_{\delta_{MS}}]{Dealloc\ \loc;\comp} = \specificev{Dealloc\ \loc}
    }{filter-comp-dealloc}
    %
    \typerule{filter-comp-get}{
      \delta_{MS}(\src{\loc})=\specificev{\loc} &
      \specificev{n}=\src{n}
    }{
      \tospecificevs[_{\delta_{MS}}]{Get\ \loc\ n;\comp} = \specificev{Use\ \loc\ n}
    }{filter-comp-get}
    %
    \typerule{filter-comp-set}{
      \delta_{MS}(\src{\loc})=\specificev{\loc} &
      \specificev{n}=\src{n}
    }{
      \tospecificevs[_{\delta_{MS}}]{Set\ \loc\ n\ \valueexpr;\comp} = \specificev{Use\ \loc\ n}
    }{filter-comp-set}
    %
    \typerule{filter-comp-call}{
    }{
      \tospecificevs[_{\delta_{MS}}]{Call\ \comm\ foo\ \valueexpr;\comp} = \specificev{\emptyevent}
    }{filter-comp-call}
    %
    \typerule{filter-comp-ret}{
    }{
      \tospecificevs[_{\delta_{MS}}]{Ret\ \comm\ \valueexpr;\comp} = \specificev{\emptyevent}
    }{filter-comp-ret}
    %
    \typerule{filter-abort}{
    }{
      \tospecificevs[_{\delta_{MS}}]{\lightning;\sandboxtag} = \specificev{\lightning}
    }{filter-abort}
    %
    \judgbox{\tospecificevs[^*_{\delta_{MS}}]{\trace} = \mstrace}{,,Project an $\mmlAs$ trace to specification traces.''}
    %
    \typerule{filter-empty}{
    }{
      \tospecificevs[^*_{\delta_{MS}}]{\hole{\cdot}} = \specificev{\hole{\cdot}}
    }{filter-empty}
    %
    \typerule{filter-cons-relevant}{
      \tospecificevs[_{\delta_{MS}}]{\event} = \specificev{\event} &
      \tospecificevs[^*_{\delta_{MS}}]{\trace} = \mstrace &
      \specificev{\event} \not= \specificev{\emptyevent}
    }{
      \tospecificevs[^*_{\delta_{MS}}]{\event\cdot\trace} = \specificev{\event}\cdot\mstrace
    }{filter-cons-relevant}
    %
    \typerule{filter-cons-relevant}{
      \tospecificevs[_{\delta_{MS}}]{\event} = \specificev{\emptyevent} &
      \tospecificevs[^*_{\delta_{MS}}]{\trace} = \mstrace
    }{
      \tospecificevs[^*_{\delta_{MS}}]{\event\cdot\trace} = \mstrace
    }{filter-cons}
  \end{center}
}{w-events-project-to-specific}{Projection of $\mmlAs$ events to specification events.}

\myfig{
  \begin{center}
    \judgbox{\delta_{MS}(\src{\loc})=\specificev{\loc}}{,,Map $\mmlAs$ locations $\src{\loc}$ to abstract locations $\specificev{\loc}$.''}
    \judgbox{\storeagreetms{\tmsmonitor}{\src{\Delta}}}{,,Abstract memory state $\tmsmonitor$ describes the concrete state $\src{\Delta}$.''}
    \typerule{Empty-Agree}{
    }{
      \storeagreetms{\emptyset}{\src{\hole{\cdot}}}
    }{store-empty-agree}
    %
    \typerule{Abort-Agree}{
    }{
      \storeagreetms{\emptyset}{\src{\lightning}}
    }{store-abort-agree}
    %
    \typerule{Cons-Agree}{
      \delta_{MS}(\src{\loc})=\specificev{\loc}&
      \specificev{\loc}\notin\tmsmonitor&
      \storeagreetms{\tmsmonitor}{\src{\Delta}}
    }{
      \storeagreetms{\left\{\specificev{\loc}\right\}\cup \tmsmonitor}{\src{x\mapsto(\loc;\sandboxtag;\poisonless;n),\Delta}}
    }{store-cons-agree}
    %
    \typerule{Poison-Agree}{
      \delta_{MS}(\src{\loc})=\specificev{\loc}&
      \storeagreetms{\tmsmonitor}{\src{\Delta}}
    }{
      \storeagreetms{\tmsmonitor}{\src{x\mapsto(\loc;\sandboxtag;\poisoned;n),\Delta}}
    }{store-poison-agree}
  \end{center}
}{tms-store-agreement}{Store Agreement.}

\begin{scontents}[store-env=buffer]
  If
  \begin{assumptions}
  \item\label[ass]{asm:mmlatmsviamonitor:run} $\wexecs{prog\ \library_{ctx}\ \library_{comp}}{\configs}{\finalexpr}{\trace}$
  \end{assumptions}
  Then
  \begin{goals}
  \item $\tospecificevs[^{*}_{\delta_{ms}}]{\trace}\in\operatorname{tmsafe}$
  \end{goals}.
\end{scontents}
\mockthm{thm:mmlAs:tmssafe}{1}

\begin{scontents}[store-env=buffer]
  There is a well-typed $\mmlAs$ component that does not robustly satisfy \Cref{def:spatmemsafe}:
  $\rsat{\src{\library}}{smsafe}$
\end{scontents}

\realthm{thm:mmlAs:not:smssafe}{2}{$\mmlAs$ is not spatially memory safe}\label{thm:lms:notspatmemsafe}
\begin{proof}
  We pick:
  $$\src{\library_{comp}} = \src{let\ foo\ x:\nat\to\nat:=let\ z=new\ x\ in\ let\ w = z[1337]\ in\ let\ \_ = delete\ z\ in\ w},\src{\hole{\cdot}}$$
  and
  $
  \src{\library_{ctx}} = \src{let\ main\ z:\nat\to\nat:=call\ foo\ 42},\src{\hole{\cdot}}
  $.
  Let $\src{\library} \equiv \src{\library_{comp}}\cup\src{\library_{ctx}}$.
  We show $\vdash\src{prog\ \library_{ctx}\ \library_{comp}}\dashv\src{\library},\left\{\src{foo}\right\}$.
  First note that $\src{\library}=\src{\library_{ctx}\linker\library_{comp}}$, since $\operatorname{dom}\ \src{\library_{ctx}}\cap\operatorname{dom\ \src{\library_{comp}}}=\emptyset$ and $\src{\library}\equiv\src{\library_{ctx}\cup\library_{comp}}$ by definition.
  Now, $\operatorname{dom}\ \src{\library_{comp}}=\left\{\src{foo}\right\}$ and $\src{\library}\downarrow=\src{foo\mapsto\nat\to\nat,main\mapsto\nat\to\nat,\hole{\cdot}}=\src{\Gamma_{0}}$ by \Cref{tr:w-lib-proj-empty,tr:w-lib-proj-cons}.
  Consequently, $\src{main}\in\operatorname{dom}\src{\Gamma_{0}}=\left\{\src{foo},\src{main}\right\}$.
  Note that \Cref{tr:src-int-type-nat} gives $\src{\nat}\ \operatorname{int}$.
  Using \Cref{tr:w-t-lib-empty,tr:w-t-lib-cons}, what is left to show are the following:
  \begin{enumerate}
    \item $\typechecks{x:\nat,\Gamma_{0}}{let\ z=new\ x\ in\ let\ w = z[1337]\ in\ delete\ z; w}{\nat}$
    \item $\typechecks{z:\nat,\Gamma_{0}}{call\ foo\ 42}{\nat}$
  \end{enumerate}

  Let $\src{e_w}=\src{let\ w=z[1337]\ in\ delete\ z; w}$, $\Gammas=\src{z:\ptr,x:\nat,\hole{\cdot}}$, and $\src{\Gamma'}=\src{z:\wptr,x:\nat,\hole{\cdot}}$ due to space constraints.

  \bigskip
  \noindent\makebox[\textwidth]{%
    \typerulederiv{$\text{\Cref{tr:w-t-new}}$}{
      \typerulederiv{$\text{\Cref{tr:t-var}}$}{
        \src{\nat}\not=\src{\ptr}
      }{
        \typechecks{x:\nat,\hole{\cdot}}{x}{\nat}
      } &
      \typerulederiv{$\text{\Cref{tr:t-let}}$}{
        \typechecks{\Gamma'}{z[1337]}{\nat} &
        \typechecks{w:\nat,\Gamma}{delete\ z;w}{\nat}
      }{
        \typechecks{\Gamma'\circ\Gamma}{e_w}{\nat}
      }
    }{
      \typechecks{x:\nat,\hole{\cdot}\circ x:\nat,\hole{\cdot}}{let\ z=new\ x\ in\ let\ w = z[1337]\ in\ delete\ z; w}{\nat}
    }}
  \bigskip

  Observe that:

  \bigskip
  \noindent\makebox[\textwidth]{%
    \typerulederiv{$\text{\Cref{tr:t-get}}$}{
      \typerulederiv{$\text{\Cref{tr:t-var}}$}{
        \src{\wptr}\not=\src{\ptr}&
        \src{\nat}\not=\src{\ptr}
      }{
        \typechecks{\Gamma'}{z}{\wptr}
      } &
      \typerulederiv{$\text{\Cref{tr:t-var}}$}{
        \src{\wptr}\not=\src{\ptr}&
        \src{\nat}\not=\src{\ptr}
      }{
        \typechecks{\Gamma'}{x}{\nat}
      }
    }{
      \typechecks{\Gamma'\circ\Gamma'}{z[1337]}{\nat}
  }}
  \bigskip

  And:

  \bigskip
  \noindent\makebox[\textwidth]{%
    \typerulederiv{$\text{\Cref{tr:t-let}}$}{
      \typerulederiv{$\text{\Cref{tr:w-t-delete}}$}{
        \src{\nat}\not=\src{\ptr} &
        \src{\nat}\not=\src{\ptr}
      }{
        \typechecks{w:\nat,z:\ptr,x:\nat,\hole{\cdot}}{delete\ z}{\nat}
      }&
      \typerulederiv{$\text{\Cref{tr:t-var}}$}{
        \src{\nat}\not=\src{\ptr} &
        \src{\nat}\not=\src{\ptr}
      }{
        \typechecks{w:\nat,x:\nat,\hole{\cdot}}{w}{\nat}
      }
    }{
      \typechecks{w:\nat,z:\ptr,x:\nat,\hole{\cdot}\circ w:\nat,x:\nat,\hole{\cdot}}{delete\ z;w}{\nat}
    }}
  \bigskip

  Thus, it typechecks.\\[0.3cm]
  Now consider the other case:

  \bigskip
  \noindent\makebox[\textwidth]{%
    \typerulederiv{$\text{\Cref{tr:t-call}}$}{
      \typerulederiv{$\text{\Cref{tr:t-var}}$}{}{\typechecks{z:\nat,\Gamma_0}{foo}{\nat\to\nat}}&
      \typerulederiv{$\text{\Cref{tr:t-nat}}$}{}{\typechecks{z:\nat,\Gamma_0}{42}{\nat}}&
      \typerulederiv{$\text{\Cref{tr:src-int-type-nat}}$}{}{\src{\nat}\ \operatorname{int}}
    }{
      \typecheck{\src{z:\nat,\Gamma_0}}{\src{call\ foo\ 42}}{\src{\nat}}
    }}
  \bigskip

  Note that $\src{NoOwnedPtr\ z:\nat,\Gamma_{0}}$ holds by $\src{\nat}\not=\src{\ptr}$ and $\src{\nat\to\nat}\not=\src{\ptr}$

  Running the whole program via \Cref{tr:ws-e-prog} yields trace prefix\\$\src{\trace}=\src{Start;\comp}\cdot\src{Call\ !foo\ 42;\ctx}\cdot\src{Alloc\ \loc\ 42;\comp}\cdot\src{Get\ \loc\ 1337;\comp}\cdot\src{Dealloc\ \loc;\comp}\cdot\src{Ret\ ?1729;\comp}\cdot\src{End\ 1729;\ctx}$.
  We omit the precise derivation for brevity, but note that \thmref{lem:toplevel:progress} gives us the necessary execution.\\[0.3cm]
  Let $\delta_{ms}=\{\src{\loc}\mapsto\specificev{\loc}\}$, by \Cref{fig:w-events-project-to-specific}, $\tospecificevs[^*_{\delta_{ms}}]{\trace}=\specificev{Alloc\ \loc\ 42}\cdot\specificev{Use\ \loc\ 1337}\cdot\specificev{Dealloc\ \loc}$.\\[0.3cm]
  For \Cref{def:spatmemsafe}, note that $\specificev{Alloc\ \loc\ 42}\in\tospecificevs[^*_{\delta_{ms}}]{\trace}$ and $\specificev{Use\ \loc\ 1337}\in\tospecificevs[^*_{\delta_{ms}}]{\trace}$, but ${1337}\not<{42}$, hence $\nrsat{\src{\library_{comp}}}{{smsafe}}$.
\end{proof}

\subsubsection{Auxiliary Definitions and Lemmas}\label{sec:mmla:aux}

\begin{lemma}[$\rightarrow^{n}_{\ctx}$ and $\rightarrow^{*}_{\ctx}$ yield $\rightarrow^{*}_{\ctx}$]\label{lem:execsn:yields:execs}
  If
  \begin{assumptions}
    \item\label[ass]{asm:execsn:yields:execs:execsn} $\execsn[^{n}]{\Omega}{e}{\Omega'}{e'}{\trace}$
    \item $\execs{\Omega'}{e'}{\Omega''}{\finalexpr}{\trace[']}$
  \end{assumptions}
  Then
  \begin{goals}
    \item $\execs{\Omega}{e}{\Omega''}{\finalexpr}{\trace\cdot\trace[']}$
  \end{goals}
\end{lemma}
\begin{proof}
  Induction on \Cref{asm:execsn:yields:execs:execsn}.
\end{proof}

\begin{lemma}[$\rightarrow^{*}_{\ctx}$ splits into $\rightarrow^{n}_{\ctx}$ and $\rightarrow^{*}_{\ctx}$]\label{lem:execs:splitsinto:execsn}
  If
  \begin{assumptions}
    \item\label[ass]{asm:execs:splitsinto:execsn} $\execs{\Omega}{e}{\Omega'}{\finalexpr}{\trace[_{0}]\cdot\trace[_{1}]}$
  \end{assumptions}
  Then $\exists \src{\Omega_{0}}\ \src{e_{0}}\ n$,
  \begin{goals}
    \item $\execsn{\Omega}{e}{\Omega_{0}}{e_{0}}{\trace[_{0}]}$
    \item $\execs{\Omega_{0}}{e_{0}}{\Omega'}{\finalexpr}{\trace_{1}}$
  \end{goals}
\end{lemma}
\begin{proof}
  Induction on \Cref{asm:execs:splitsinto:execsn}.
\end{proof}

\begin{lemma}[Static Typing implies Runtime Typing (Toplevel)]\label{lem:static-implies-runtime:toplevel}
  If
  \begin{assumptions}
    \item\label[ass]{asm:static-implies-runtime:gamma} $\src{\library}\downarrow=\src{\Gamma_{0}}$
    \item\label[ass]{asm:static-implies-runtime:static} $\typechecks{\Gamma_0}{call\ main\ 0}{\nat}$
  \end{assumptions}
  Then
  \begin{goals}
    \item $\typechecks{}{\commlib;\library;\hole{\cdot};\comp;\hole{\cdot}^{\ctx};\hole{\cdot}^{\comp};\hole{\cdot}\triangleright call\ main\ 0}{\nat}$
  \end{goals}
\end{lemma}
\begin{proof}
  Use \Cref{tr:w-t-prog-runtime,tr:t-call,tr:t-var,tr:t-nat,tr:src-int-type-nat}.
\end{proof}

\begin{lemma}[Typed Linking Recomposition]\label{lem:typed:linking:recomposition}
  If
  \begin{assumptions}
    \item $\src{\library} = \src{\library_{1}\linker\library_{2}}$
    \item $\Gammas\vdash\src{\library_{1}}\operatorname{ok}$
    \item $\Gammas\vdash\src{\library_{2}}\operatorname{ok}$
  \end{assumptions}
  Then
  \begin{goals}
    \item $\Gammas\vdash\src{\library}\operatorname{ok}$
  \end{goals}
\end{lemma}
\begin{proof}
  Easy.
\end{proof}

\begin{lemma}[Typing Decomposition]\label{lem:ctxtyping:plugged}
  If
  \begin{assumptions}
    \item $\typechecks{\Gamma}{K[e]}{\type}$
  \end{assumptions}
  Then $\exists \src{\type_{e}}$,
  \begin{goals}
    \item $\typechecks{\Gamma}{K}{\type_{e}\to\type}$
    \item $\typechecks{\Gamma}{e}{\type_{e}}$
  \end{goals}
\end{lemma}
\begin{proof}
  Induction on $\src{K}$.
\end{proof}
\begin{lemma}[Typing Composition]\label{lem:ctxtyping:compos}
  If
  \begin{assumptions}
    \item\label[ass]{asm:ctxtyping:compos:K} $\typechecks{\Gamma}{K}{\type_{e}\to\type}$
    \item $\typechecks{\Gamma}{e}{\type_{e}}$
  \end{assumptions}
  Then
  \begin{goals}
    \item $\typechecks{\Gamma}{K[e]}{\type}$
  \end{goals}
\end{lemma}
\begin{proof}
  Induction on \Cref{asm:ctxtyping:compos:K}.
\end{proof}
\begin{lemma}[Runtime Typing Decomposition]\label{lem:rtctxtyping:plugged}
  If
  \begin{assumptions}
    \item $\typechecks{}{\Omega \triangleright K[e]}{\type}$
  \end{assumptions}
  Then $\exists \src{\type_{e}}$,
  \begin{goals}
    \item $\typechecks{}{\Omega \triangleright K}{\type_{e}\to\type}$
    \item $\typechecks{}{\Omega \triangleright e}{\type_{e}}$
  \end{goals}
\end{lemma}
\begin{proof}
  Use \Cref{lem:ctxtyping:plugged}.
\end{proof}
\begin{lemma}[Runtime Typing Composition]\label{lem:rtctxtyping:compos}
  If
  \begin{assumptions}
    \item $\typechecks{}{\Omega \triangleright K}{\type_{e}\to\type}$
    \item $\typechecks{}{\Omega \triangleright e}{\type_{e}}$
  \end{assumptions}
  Then
  \begin{goals}
    \item $\typechecks{}{\Omega \triangleright K[e]}{\type}$
  \end{goals}
\end{lemma}
\begin{proof}
  Use \Cref{lem:ctxtyping:compos}.
\end{proof}

\begin{lemma}[Store Agree Weaken]\label{lem:store-agree-weaken}
  If
  \begin{assumptions}
    \item $\storeagreetms{\tmsmonitor}{\src{\Delta}}$
    \item $\delta_{\text{MS}}\subseteq\delta_{\text{MS}}'$
  \end{assumptions}
  Then
  \begin{goals}
    \item $\storeagreetms[\delta_{\text{MS}}']{\tmsmonitor}{\src{\Delta}}$
  \end{goals}
\end{lemma}
\begin{proof}
  Induction on $\storeagreetms{\tmsmonitor}{\src{\Delta}}$.
\end{proof}

\begin{lemma}[Filter Weaken]\label{lem:filter-weaken}
  If
  \begin{assumptions}
    \item $\theta_{\delta_{ms}}^{*}\left(\src{\trace}\right) \not=\specificev{\hole{\cdot}}$
    \item $\delta_{ms}\subseteq\delta_{ms}'$
  \end{assumptions}
  Then
  \begin{goals}
    \item $\theta_{\delta_{ms}}^{*}\left(\src{\trace}\right) = \theta_{\delta_{ms}'}^{*}\left(\src{\trace}\right)$
  \end{goals}
\end{lemma}

\begin{lemma}[\gls{tms}-$\src{\Delta}$-split]\label{lem:tms:store:split}
  If
  \begin{assumptions}
    \item\label[ass]{asm:tms:store:split:as} $\storeagreetms{\tmsmonitor}{\src{\Delta_{1},x\mapsto(\loc;\sandboxtag;\poison;n),\Delta_{2}}}$
  \end{assumptions}
  Then $\exists \tmsmonitor[_{1}]\ \tmsmonitor[_{2}]\ \specificev{\loc}$,
  \begin{goals}
    \item $\storeagreetms{\tmsmonitor[_{1}]}{\src{\Delta_{1}}}$
    \item $\storeagreetms{\{\specificev{\loc}\}\cup\emptyset}{\src{x\mapsto(\loc;\sandboxtag;\poison;n),\hole{\cdot}}}$
    \item $\storeagreetms{\tmsmonitor[_{2}]}{\src{\Delta_{2}}}$
    \item $\tmsmonitor=\tmsmonitor_{1}\cup\{\specificev{\loc}\}\cup\tmsmonitor_{2}$
  \end{goals}
\end{lemma}
\begin{proof}
  Induction on \Cref{asm:tms:store:split:as}.
\end{proof}


\begin{lemma}[Trace-based Transitivity Authentic]\label{lem:trace-agree-trans}
  If
  \begin{assumptions}
    \item $\tmstraceagree[^{*}]{\mstrace[_{1}]}{\abstrace_{1}}$
    \item $\tmstraceagree[^{*}]{\mstrace[_{2}]}{\abstrace_{2}}$
  \end{assumptions}
  Then
  \begin{goals}
    \item $\tmstraceagree[^{*}]{\mstrace[_{1}]\cdot\mstrace[_{2}]}{\abstrace_{1}\cdot\abstrace_{2}}$
  \end{goals}
\end{lemma}
\begin{proof}
  Easy using \Cref{tr:tms-trans-auth}.
\end{proof}

\begin{lemma}[Monitor Step Subset]\label{lem:monitor-step-subset}
  If
  \begin{assumptions}
    \item $\monitorcheck[]{\tmsmonitor}{\tmsmonitor[']}{\absevent}$
  \end{assumptions}
  Then
  \begin{goals}
    \item $\tmsmonitor\subseteq_F \tmsmonitor[']$
  \end{goals}
\end{lemma}
\begin{proof}
  Easy induction on $\monitorcheck[]{\tmsmonitor}{\tmsmonitor[']}{\absevent}$.
\end{proof}

\begin{lemma}[Monitor Steps Subset]\label{lem:monitor-steps-subset}
  If
  \begin{assumptions}
    \item $\monitorcheck{\tmsmonitor}{\tmsmonitor[']}{\absevent}$
  \end{assumptions}
  Then
  \begin{goals}
    \item $\tmsmonitor\subseteq_F \tmsmonitor[']$
  \end{goals}
\end{lemma}
\begin{proof}
  Easy induction on $\monitorcheck{\tmsmonitor}{\tmsmonitor[']}{\absevent}$ using \Thmref{lem:monitor-step-subset}.
\end{proof}

\begin{lemma}[$\alpha$-conv. Typing]\label{lem:alpha-conv-typing}
  If
  \begin{assumptions}
    \item\label[ass]{asm:alpha-conv-typing:typs} $\typechecks{\Gamma}{e}{\type}$
  \end{assumptions}
  Then
  \begin{goals}
    \item $\typechecks{\Gamma[z:\type'/x:\type']}{e[z/x]}{\type}$
  \end{goals}.
\end{lemma}
\begin{proof}
  Induction on \Cref{asm:alpha-conv-typing:typs}.
\end{proof}

\begin{lemma}[Substitution]\label{lem:substitution}
  If
  \begin{assumptions}
    \item\label[ass]{asm:substitution:typs} $\typechecks{x:\type',\Gamma_1}{e}{\type}$
    \item $\typechecks{\Gamma_2}{v}{\type'}$
    \item $\src{\Gamma_3}=\src{\Gamma_1}\circ\src{\Gamma_2}$
  \end{assumptions}
  Then
  \begin{goals}
    \item $\typechecks{\Gamma_3}{e[v/x]}{\type}$
  \end{goals}.
\end{lemma}
\begin{proof}
  By induction on \Cref{asm:substitution:typs}.
\end{proof}

\begin{lemma}[Base Preservation]\label{lem:base-preservation}
  If
  \begin{assumptions}
    \item $\typechecks{}{\src{\Omega}\triangleright e\gamma}{\src{\type}}$
    \item\label[ass]{asm:basepres:step} $\exprevals{\configs}{e\gamma}{\configs'}{e'\gamma'}{\event}$
    \item $\configs'\not=\src{\lightning}$
  \end{assumptions}
  Then
  \begin{goals}
    \item $\typechecks{}{\src{\Omega'}\triangleright e'\gamma'}{\src{\type}}$
  \end{goals}.
\end{lemma}
\begin{proof}
  Induction on \Cref{asm:basepres:step}.
\end{proof}

\begin{lemma}[Ctx Preservation]\label{lem:ctx-preservation}
  If
  \begin{assumptions}
    \item $\typechecks{}{\src{\Omega}\triangleright e\gamma}{\src{\type}}$
    \item\label[ass]{asm:ctxpres:step} $\execs[]{\configs}{e\gamma}{\configs'}{e'\gamma'}{\event}$
  \end{assumptions}
  Then
  \begin{goals}
    \item $\typechecks{}{\src{\Omega'}\triangleright e'\gamma'}{\src{\type}}$
  \end{goals}.
\end{lemma}
\begin{proof}
  Induction on \Cref{asm:ctxpres:step}.
\end{proof}

\begin{lemma}[N-Steps Preservation]\label{lem:nsteps-preservation}
  If
  \begin{assumptions}
    \item $\typechecks{}{\src{\Omega}\triangleright e\gamma}{\src{\type}}$
    \item\label[ass]{asm:npres:step} $\execsn{\configs}{e\gamma}{\configs'}{e'\gamma'}{\trace}$
  \end{assumptions}
  Then
  \begin{goals}
    \item $\typechecks{}{\src{\Omega'}\triangleright e'\gamma'}{\src{\type}}$
  \end{goals}.
\end{lemma}
\begin{proof}
  Induction on \Cref{asm:npres:step}.
\end{proof}

\begin{lemma}[Steps Preservation]\label{lem:steps-preservation}
  If
  \begin{assumptions}
    \item $\typechecks{}{\src{\Omega}\triangleright e\gamma}{\src{\type}}$
    \item\label[ass]{asm:starpres:step} $\execs{\configs}{e\gamma}{\configs'}{e'\gamma'}{\trace}$
  \end{assumptions}
  Then
  \begin{goals}
    \item $\typechecks{}{\src{\Omega'}\triangleright e'\gamma'}{\src{\type}}$
  \end{goals}.
\end{lemma}
\begin{proof}
  Induction on \Cref{asm:starpres:step}.
\end{proof}

\begin{lemma}[Progress]\label{lem:progress}
  If
  \begin{assumptions}
    \item\label[ass]{asm:progress:typs} $\typechecks{}{\src{\Omega}\triangleright e\gamma}{\src{\type}}$
  \end{assumptions}
  Then $\exists \src{\Omega'}\ \src{\finalexpr}\ \src{\trace}$,
  \begin{goals}
  \item $\execs{\configs}{e}{\configs'}{\finalexpr}{\trace}$
  \end{goals}.
\end{lemma}
\begin{proof}
  Nested induction on \Cref{asm:progress:typs}.
\end{proof}

\begin{scontents}[store-env=buffer]
  If
  \begin{assumptions}
  \item $\typechecks{}{e}{\type}$
  \end{assumptions}
  Then $\exists \src{\Omega}\ \src{\trace}\ \src{\finalexpr}$,
  \begin{goals}
  \item $\execs{\hole{\cdot};\hole{\cdot}}{e}{\Omega}{\finalexpr}{\trace}$
  \item $\typechecks{}{\finalexprnoerr}{\type}$
  \end{goals}.
\end{scontents}
% \realthm{thm:mmlAs:typesafe}{3}{Type Safety}
% \begin{proof}
%   Easy consequence from \Cref{lem:progress,lem:steps-preservation}.
% \end{proof}

\begin{lemma}[Top-Level Progress]\label{lem:toplevel:progress}
  If
  \begin{assumptions}
    \item $\vdash\src{prog\ \library_{ctx}\ \library_{comp}}\dashv\src{\library},\src{\commlib}$
  \end{assumptions}
  Then $\exists \configs\ \src{\finalexpr}\ \src{\trace}$,
  \begin{goals}
  \item $\wexecs{prog\ \library_{ctx}\ \library_{comp}}{\Omega}{\finalexpr}{\trace}$
  \item $\src{\Omega.\library}=\src{\library}$
  \item $\src{\Omega.\commlib}=\src{\commlib}$
  \end{goals}.
\end{lemma}
\begin{proof}
  Immediate consequence of \Cref{lem:progress}.
\end{proof}

\begin{lemma}[Base \gls{tms} via Monitor]\label{lem:basetmsmonitor}
  If
  \begin{assumptions}
    \item $\typechecks{}{\src{\Omega}\triangleright e\gamma}{\src{\type}}$
    \item $\exprevals{\configs}{e\gamma}{\configs'}{e'\gamma'}{\event}$
    \item $\storeagreetms{\tmsmonitor}{\src{\Omega}.\src{\Delta}}$
  \end{assumptions}
  Then $\exists \absevent\ \delta_{\text{MS}}'\ \tmsmonitor['],$
  \begin{goals}
    \item $\delta_{\text{MS}}\subseteq\delta_{\text{MS}}'$
    \item $\tmstraceagree{\tospecificevs[_{\delta_{\text{MS}}'}]{\event}}{\absevent}$
    \item $\monitorcheck[]{\tmsmonitor}{\tmsmonitor[']}{\absevent}$
    \item $\storeagreetms[\delta_{\text{MS}}']{\tmsmonitor[']}{\src{\Omega'}.\src{\Delta}}$
  \end{goals}.
\end{lemma}
\begin{proof}
  First, we note
  \begin{itemize}
    \item $\src{\Omega}=\src{\cfstate;\sandboxtag;\memstate}$
    \item $\src{\cfstate}=\src{\commlib;\library;\kontstack}$
    \item $\src{\memstate}=\src{H^{\ctx};H^{\comp};\Delta}$
  \end{itemize}
  Induction on $\exprevals{\configs}{e\gamma}{\configs'}{e'\gamma'}{\event}$.
  \begin{description}
    \case{tr:w-e-delete}
      If
      \begin{passumptions}{H}
        \item $\src{\gamma}=\src{\gamma'}=\src{\hole{\cdot}}$
        \item $\typechecks{}{\src{\cfstate;\sandboxtag;H^{\ctx};H^{\comp};\Delta_1,x\mapsto(\loc;\sandboxtag;\poison;n),\Delta_2}\triangleright \src{delete\ x}}{\type}$
        \item\label[ass]{asm:basetmsmonitor:storeagree} $\storeagreetms{\tmsmonitor}{\src{\Delta_1,x\mapsto(\loc;\sandboxtag;\poison;n),\Delta_2}}$
      \end{passumptions}
      Then $\exists \absevent\ \delta_{\text{MS}}'\ \tmsmonitor['],$
      \begin{goals}
        \item\label[goal]{goal:basetmsmonitor:subseteq} $\delta_{\text{MS}}\subseteq\delta_{\text{MS}}'$
        \item\label[goal]{goal:basetmsmonitor:tmstraceagree} $\traceagree{\specificev{Dealloc\ }\delta_{\text{MS}}'(\src{\loc})}{\absevent}$
        \item $\monitorcheck[]{\tmsmonitor}{\tmsmonitor[']}{\absevent}$
        \item $\storeagreetms[\delta_{\text{MS}}']{\tmsmonitor[']}{\src{\Delta_1,x\mapsto(\loc;\sandboxtag;\poisoned;n),\Delta_2}}$
      \end{goals}

      Apply \Thmref{lem:tms:store:split} on \Cref{asm:basetmsmonitor:storeagree}:
      \begin{passumptions}{F}
        \item $\storeagreetms{\tmsmonitor[_{1}]}{\src{\Delta_{1}}}$
        \item\label[ass]{asm:basetmsmonitor:storeagree:unfolded} $\storeagreetms{\{\specificev{\loc}\}\cup\emptyset}{\src{x\mapsto(\loc;\sandboxtag;\poison;n),\hole{\cdot}}}$
        \item $\storeagreetms{\tmsmonitor[_{2}]}{\src{\Delta_{2}}}$
        \item $\tmsmonitor=\tmsmonitor_{1}\cup\{\specificev{\loc}\}\cup\tmsmonitor_{2}$
      \end{passumptions}
      Invert \Cref{asm:basetmsmonitor:storeagree:unfolded} to conclude $\delta_{\text{MS}}(\src{\loc})=\specificev{\loc}$.
      Choose $\absevent=\textbf{Dealloc\ }\specificev{\loc}$ and $\delta_{\text{MS}}'=\delta_{\text{MS}}$.

      \Cref{goal:basetmsmonitor:subseteq}, $\delta_{\text{MS}}\subseteq\delta_{\text{MS}}$, follows trivially.

        For $\tmstraceagree{\specificev{Dealloc\ }\delta_{\text{MS}}'(\src{\loc})}{\textbf{Dealloc}\ \specificev{\loc}}$ (\Cref{goal:basetmsmonitor:tmstraceagree}), apply \Cref{tr:tms-dealloc-auth}.

      The inversion yields two cases:
      \begin{description}
      \case{tr:store-cons-agree}
        If
        \begin{passumptions}{F}
        \item $\typechecks{}{\src{\cfstate;\sandboxtag;H^{\ctx};H^{\comp};\Delta_1},\src{x\mapsto(\loc;\sandboxtag;\poisonless;n),\src{\Delta_2}\triangleright \src{delete\ x}}}{\type}$
        \item $\storeagreetms{\tmsmonitor[_1]}{\src{\Delta_1}}$
        \item $\delta_{\text{MS}}(\src{\loc})=\specificev{\loc}$
        \item $\storeagreetms{\tmsmonitor[_2]}{\src{\Delta_2}}$
        \item $\tmsmonitor=\tmsmonitor[_1]\cup\left\{\specificev{\loc}\right\}\cup \tmsmonitor[_2]$
        \end{passumptions}
        then $\exists \tmsmonitor[']$,
        \begin{goals}
        \item\label[goal]{goal:basetmsmonitor:monitorcheck1} $\monitorcheck[]{\tmsmonitor}{\tmsmonitor[']}{\textbf{Dealloc}\ \specificev{\loc}}$
        \item\label[goal]{goal:basetmsmonitor:storeagree1} $\storeagreetms[\delta_{\text{MS}}']{\tmsmonitor[']}{\src{\Delta_1,x\mapsto(\loc;\sandboxtag;\poisoned;n),\Delta_2}}$
        \end{goals}
        Choose $\tmsmonitor[']=\tmsmonitor[_1]\cup \tmsmonitor[_2]$.

        \Cref{goal:basetmsmonitor:monitorcheck1}, $\monitorcheck[]{\tmsmonitor}{\tmsmonitor[']}{\textbf{Dealloc}\ \specificev{\loc}}$, follows immediately by \Cref{tr:tms-dealloc}.

        \Cref{goal:basetmsmonitor:storeagree1}, $\storeagreetms[\delta_{\text{MS}}']{\tmsmonitor[']}{\src{\Delta_1,x\mapsto(\loc;\sandboxtag;\poisoned;n),\Delta_2}}$, follows immediately by \Cref{tr:store-poison-agree}.

      \case{tr:store-poison-agree}
        If
        \begin{passumptions}{F}
        \item\label[ass]{asm:basetmsmonitor:typing} $\typechecks{}{\src{\cfstate;\sandboxtag;H^{\ctx};H^{\comp};\Delta_1},\src{x\mapsto(\loc;\sandboxtag;\poisoned;n)},\src{\Delta_2}\triangleright \src{delete\ x}}{\type}$
        \item $\storeagreetms{\tmsmonitor[_1]}{\src{\Delta_1}}$
        \item $\delta_{\text{MS}}(\src{\loc})=\specificev{\loc}$
        \item $\storeagreetms{\tmsmonitor[_2]}{\src{\Delta_2}}$
        \item $\tmsmonitor=\tmsmonitor[_1]\cup \tmsmonitor[_2]$
        \end{passumptions}
        then $\exists \tmsmonitor[']$,
        \begin{goals}
        \item\label[goal]{goal:basetmsmonitor:monitorcheck2} $\monitorcheck[]{\tmsmonitor}{\tmsmonitor[']}{\textbf{Dealloc}\ \specificev{\loc}}$
        \item\label[goal]{goal:basetmsmonitor:storeagree2} $\storeagreetms[\delta_{\text{MS}}']{\tmsmonitor[']}{\src{\Delta_1,x\mapsto(\loc;\sandboxtag;\poisoned;n),\Delta_2}}$
        \end{goals}.

        Invert \Cref{asm:basetmsmonitor:typing} to get
        \begin{passumptions}{F}
          \setcounter{enumi}{6}
          \item\label[ass]{asm:basetmsmonitor:storechecks} $\typechecks{\library}{\src{\Delta_1,x\mapsto(\loc;\sandboxtag;\poisoned;n),\Delta_2}}{\Gammas}$
          \item\label[ass]{asm:basetmsmonitor:freechecks} $\typechecks{\Gammas}{delete\ x}{\nat}$
        \end{passumptions}

      Due to \Cref{asm:basetmsmonitor:storechecks}, we know $\src{x:\ptr}\not\in\Gammas$.

      But, that contradicts \Cref{asm:basetmsmonitor:freechecks}.
      \end{description}

    \case{tr:w-e-oplus}
      If
      \begin{passumptions}{H}
        \item $\src{\gamma}=\src{\gamma'}=\src{\hole{\cdot}}$
        \item $\typechecks{}{\src{\Omega}\triangleright\src{n_1+n_2}}{\type}$
        \item $\storeagreetms{\tmsmonitor}{\src{\Omega}}$
      \end{passumptions}
      Then $\exists \absevent\ \delta_{\text{MS}}'\ \tmsmonitor['],$
      \begin{goals}
        \item $\delta_{\text{MS}}\subseteq\delta_{\text{MS}}'$
        \item $\traceagree{\specificev{\varepsilon}}{\absevent}$
        \item $\monitorcheck[]{\tmsmonitor}{\tmsmonitor[']}{\absevent}$
        \item $\storeagreetms[\delta_{\text{MS}}']{\tmsmonitor[']}{\src{\Omega}}$
      \end{goals}
      Choose $\absevent=\bm{\varepsilon}$, $\delta'_{\text{MS}}=\delta_{\text{MS}}$, and $\tmsmonitor[']=\tmsmonitor$.

      All goals are completely trivial.

    \case{tr:w-e-let-f}
      If
      \begin{passumptions}{H}
        \item $\src{\gamma}=\src{\hole{\cdot}}$
        \item $\src{\gamma'}=\src{[\finalexprnoerr/x],\hole{\cdot}}$
        \item $\typechecks{}{\src{\Omega}\triangleright\src{let\ x=\finalexprnoerr\ in\ e'}}{\type}$
        \item $\storeagreetms{\tmsmonitor}{\src{\Omega}}$
      \end{passumptions}
      Then $\exists \absevent\ \delta_{\text{MS}}'\ \tmsmonitor['],$
      \begin{goals}
        \item $\delta_{\text{MS}}\subseteq\delta_{\text{MS}}'$
        \item $\traceagree{\specificev{\varepsilon}}{\absevent}$
        \item $\monitorcheck[]{\tmsmonitor}{\tmsmonitor[']}{\absevent}$
        \item $\storeagreetms[\delta_{\text{MS}}']{\tmsmonitor[']}{\src{\Omega}}$
      \end{goals}
      Choose $\absevent=\bm{\varepsilon}$, $\delta'_{\text{MS}}=\delta_{\text{MS}}$, and $\tmsmonitor[']=\tmsmonitor$.

      All goals are completely trivial.


    \case{tr:w-e-if-true}
      If
      \begin{passumptions}{H}
        \item $\src{\gamma}=\src{\gamma'}=\src{\hole{\cdot}}$
        \item $\typechecks{}{\src{\Omega}\triangleright\src{ifz\ 0\ then\ e_1\ else\ e_2}}{\type}$
        \item $\storeagreetms{\tmsmonitor}{\src{\Omega}}$
      \end{passumptions}
      Then $\exists \absevent\ \delta_{\text{MS}}'\ \tmsmonitor['],$
      \begin{goals}
        \item $\delta_{\text{MS}}\subseteq\delta_{\text{MS}}'$
        \item $\traceagree{\specificev{\varepsilon}}{\absevent}$
        \item $\monitorcheck[]{\tmsmonitor}{\tmsmonitor[']}{\absevent}$
        \item $\storeagreetms[\delta_{\text{MS}}']{\tmsmonitor[']}{\src{\Omega}}$
      \end{goals}
      Choose $\absevent=\bm{\emptyevent}$, $\delta'_{\text{MS}}=\delta_{\text{MS}}$, and $\tmsmonitor[']=\tmsmonitor$.

      All goals are completely trivial.

    \case{tr:w-e-if-false}
      If
      \begin{passumptions}{H}
        \item $\src{\gamma}=\src{\gamma'}=\src{\hole{\cdot}}$
        \item $\typechecks{}{\src{\Omega}\triangleright\src{ifz\ S(n)\ then\ e_1\ else\ e_2}}{\type}$
        \item $\storeagreetms{\tmsmonitor}{\src{\Omega}}$
      \end{passumptions}
      Then $\exists \absevent\ \delta_{\text{MS}}'\ \tmsmonitor['],$
      \begin{goals}
        \item $\delta_{\text{MS}}\subseteq\delta_{\text{MS}}'$
        \item $\traceagree[]{\specificev{\varepsilon}}{\absevent}$
        \item $\monitorcheck[]{\tmsmonitor}{\tmsmonitor[']}{\absevent}$
        \item $\storeagreetms[\delta_{\text{MS}}']{\tmsmonitor[']}{\src{\Omega}}$
      \end{goals}
      Choose $\absevent=\bm{\emptyevent}$, $\delta'_{\text{MS}}=\delta_{\text{MS}}$, and $\tmsmonitor[']=\tmsmonitor$.

      All goals are completely trivial.

    \case{tr:w-e-abort}
      If
      \begin{passumptions}{H}
        \item $\src{\gamma}=\src{\gamma'}=\src{\hole{\cdot}}$
        \item $\typechecks{}{\src{\Omega}\triangleright\src{abort()}}{\type}$
        \item $\storeagreetms{\tmsmonitor}{\src{\Omega}}$
      \end{passumptions}
      Then $\exists \absevent\ \delta_{\text{MS}}'\ \tmsmonitor['],$
      \begin{goals}
        \item $\delta_{\text{MS}}\subseteq\delta_{\text{MS}}'$
        \item $\traceagree[]{\specificev{\lightning}}{\absevent}$
        \item $\monitorcheck[]{\tmsmonitor}{\tmsmonitor[']}{\absevent}$
        \item $\storeagreetms[\delta_{\text{MS}}']{\tmsmonitor[']}{\src{\lightning}}$
      \end{goals}
      Choose $\absevent=\bm{\lightning}$, $\delta'_{\text{MS}}=\delta_{\text{MS}}$, and $\tmsmonitor[']=\emptyset$.

      All goals are completely trivial.

    \case{tr:w-e-let-new}
      If
      \begin{passumptions}{H}
        \item $\src{\gamma}=\src{\hole{\cdot}}$
        \item $\src{\gamma'}=\src{[z/x],\hole{\cdot}}$
        \item $\typechecks{}{\src{\Omega}}{\type}$
        \item\label[ass]{asm:basetmsmonitor:case4:storeagree} $\storeagreetms{\tmsmonitor}{\src{\Omega}}$
        \item $\fresh{\src{\Delta}}{\src{\loc}}$
        \item $\fresh{\src{\Delta}}{\src{z}}$
        \item $\src{H^{\sandboxtag'}}=\src{H^{\sandboxtag}}\ll\src{n}$
      \end{passumptions}
      Then $\exists \absevent\ \delta_{\text{MS}}'\ \tmsmonitor['],$
      \begin{goals}
        \item $\delta_{\text{MS}}\subseteq\delta_{\text{MS}}'$
        \item $\traceagree{\specificev{Alloc\ }\delta_{\text{MS}}'(\loc)\specificev{\ n}}{\absevent}$
        \item $\monitorcheck[]{\tmsmonitor}{\tmsmonitor[']}{\absevent}$
        \item $\storeagreetms[\delta_{\text{MS}}']{\tmsmonitor[']}{\src{z\mapsto(\loc;\sandboxtag;\poisonless;n),\Delta}}$
      \end{goals}
      Let $\specificev{\loc}$ be such that $\fresh{\operatorname{dom} \delta_{\text{MS}}}{\specificev{\loc}}$.
      Choose $\absevent=\bm{Alloc\ }\specificev{\loc}$, $\delta'_{\text{MS}}=\delta_{\text{MS}}\cup\left\{\src{\loc}\mapsto\specificev{\loc}\right\}$, and $\tmsmonitor[']=\left\{\specificev{\loc}\right\}\cup\tmsmonitor$.
      The goals become:
      \begin{goals}
        \item\label[goal]{goal:basetmsmonitor:case4:subseteq} $\delta_{\text{MS}}\subseteq\delta_{\text{MS}}\cup\left\{\src{\loc}\mapsto\specificev{\loc}\right\}$
        \item\label[goal]{goal:basetmsmonitor:case4:tmstraceagree} $\traceagree{\specificev{Alloc\ \loc\ n}}{\bm{Alloc\ }\specificev{\loc}}$
        \item\label[goal]{goal:basetmsmonitor:case4:monitorstep} $\monitorcheck[]{\tmsmonitor}{\left\{A:\tmsmonitor.A\cup\left\{\specificev{\loc}\right\},F:\tmsmonitor.F\right\}}{\bm{Alloc\ }\specificev{\loc}}$
        \item\label[goal]{goal:basetmsmonitor:case4:storeagree} $\storeagreetms[\delta_{MS}\cup\left\{\src{\loc}\mapsto\specificev{\loc}\right\}]{\left\{\specificev{\loc}\right\}\cup\tmsmonitor}{\src{z\mapsto(\loc;\sandboxtag;\poisonless;n),\Delta}}$
      \end{goals}

      \Cref{goal:basetmsmonitor:case4:subseteq} is trivial.

      \Cref{goal:basetmsmonitor:case4:tmstraceagree} follows immediately by \Cref{tr:tms-alloc-auth}.

      \Cref{goal:basetmsmonitor:case4:monitorstep} follows by \Cref{tr:tms-alloc}.

      \Cref{goal:basetmsmonitor:case4:storeagree} follows by \Cref{tr:store-cons-agree}.

    \case{tr:w-e-get-in}
      The proof is analogous to the next, up to the nested case analysis.
    \case{tr:w-e-get-notin}
      If
      \begin{passumptions}{H}
        \item $\src{\gamma}=\src{\gamma'}=\src{\hole{\cdot}}$
        \item $\typechecks{}{\src{\cfstate};\sandboxtag;\src{H^{\ctx}};\src{H^{\comp}};\src{\Delta_1,x\mapsto(\loc;\sandboxtag;\poison;m),\Delta_2}\triangleright\src{x[n]}}{\type}$
        \item $\storeagreetms{\tmsmonitor}{\src{\Delta_1,x\mapsto(\loc;\sandboxtag;\poison;m),\Delta_2}}$
        \item $\src{\loc}\in\operatorname{dom}\src{H^{\sandboxtag}}\implies \src{v}=\src{H^{\sandboxtag}}\left(\src{\loc+n}\right)$
        \item $\src{\loc}\not\in\operatorname{dom}\src{H^{\sandboxtag}}\implies \src{v}=\src{1729}$
      \end{passumptions}
      Then $\exists \absevent\ \delta_{\text{MS}}'\ \tmsmonitor['],$
      \begin{goals}
        \item $\delta_{\text{MS}}\subseteq\delta_{\text{MS}}'$
        \item $\traceagree[\delta_{\text{MS}}']{\specificev{Use\ }\delta_{\text{MS}}'(\loc)\specificev{\ n}}{\absevent}$
        \item $\monitorcheck[]{\tmsmonitor}{\tmsmonitor[']}{\absevent}$
        \item $\storeagreetms[\delta_{\text{MS}}']{\tmsmonitor[']}{\src{\Delta_1,x\mapsto(\loc;\sandboxtag;\poison;m),\Delta_2}}$
      \end{goals}

      Apply \Thmref{lem:tms:store:split} on \Cref{asm:basetmsmonitor:storeagree}:
      \begin{passumptions}{F}
        \item $\storeagreetms{\tmsmonitor[_{1}]}{\src{\Delta_{1}}}$
        \item\label[ass]{asm:basetmsmonitor:storeagree:unfolded2} $\storeagreetms{\{\specificev{\loc}\}\cup\emptyset}{\src{x\mapsto(\loc;\sandboxtag;\poison;m),\hole{\cdot}}}$
        \item $\storeagreetms{\tmsmonitor[_{2}]}{\src{\Delta_{2}}}$
        \item $\tmsmonitor=\tmsmonitor_{1}\cup\{\specificev{\loc}\}\cup\tmsmonitor_{2}$
      \end{passumptions}
      Invert \Cref{asm:basetmsmonitor:storeagree:unfolded2} to conclude $\delta_{\text{MS}}(\src{\loc})=\specificev{\loc}$.
      Choose $\absevent=\bm{Use\ }\specificev{\loc}$, $\delta'_{\text{MS}}=\delta_{\text{MS}}$, and $\tmsmonitor[']=\tmsmonitor$.
      The goals become:
      \begin{goals}
        \item $\delta_{\text{MS}}\subseteq\delta_{\text{MS}}$
        \item $\traceagree{\specificev{Use\ \loc\ n}}{\bm{Use\ }\specificev{\loc}}$
        \item $\monitorcheck[]{\tmsmonitor}{\tmsmonitor}{\bm{Use\ }\specificev{\loc}}$
        \item $\storeagreetms[\delta_{\text{MS}}]{\tmsmonitor}{\src{\Delta_1,x\mapsto(\loc;\sandboxtag;\poison;m),\Delta_2}}$
      \end{goals}
      All goals follow easily.

    \case{tr:w-e-set-in}
      The proof is analogous to the next, up to the nested case analysis.
    \case{tr:w-e-set-notin}
      If
      \begin{passumptions}{H}
        \item $\src{\gamma}=\src{\gamma'}=\src{\hole{\cdot}}$
        \item $\typechecks{}{\src{\cfstate};\sandboxtag;\src{H};\src{\Delta_1,x\mapsto(\loc;\sandboxtag;\poison;m),\Delta_2}\triangleright\src{x[n]}}{\type}$
        \item $\storeagreetms{\tmsmonitor}{\src{\Delta_1,x\mapsto(\loc;\sandboxtag;\poison;m),\Delta_2}}$
        \item $\src{\loc+n}\in\operatorname{dom}\src{H^{\sandboxtag}}\implies \src{H^{\sandboxtag'}}=\src{H^{\sandboxtag}}\left(\src{\loc+n}\mapsto\src{\valueexpr}\right)$
        \item $\src{\loc+n}\not\in\operatorname{dom}\src{H^{\sandboxtag}}\implies \src{H^{\sandboxtag'}}=\src{H^{\sandboxtag}}$
      \end{passumptions}
      Then $\exists \absevent\ \delta_{\text{MS}}'\ \tmsmonitor['],$
      \begin{goals}
        \item $\delta_{\text{MS}}\subseteq\delta_{\text{MS}}'$
        \item $\traceagree{\specificev{Use\ \loc\ n}}{\absevent}$
        \item $\monitorcheck[]{\tmsmonitor}{\tmsmonitor[']}{\absevent}$
        \item $\storeagreetms[\delta_{\text{MS}}']{\tmsmonitor[']}{\src{\Delta_1,x\mapsto(\loc;\sandboxtag;\poison;m),\Delta_2}}$
      \end{goals}
      Apply \Thmref{lem:tms:store:split} on \Cref{asm:basetmsmonitor:storeagree}:
      \begin{passumptions}{F}
        \item $\storeagreetms{\tmsmonitor[_{1}]}{\src{\Delta_{1}}}$
        \item\label[ass]{asm:basetmsmonitor:storeagree:unfolded3} $\storeagreetms{\{\specificev{\loc}\}\cup\emptyset}{\src{x\mapsto(\loc;\sandboxtag;\poison;m),\hole{\cdot}}}$
        \item $\storeagreetms{\tmsmonitor[_{2}]}{\src{\Delta_{2}}}$
        \item $\tmsmonitor=\tmsmonitor_{1}\cup\{\specificev{\loc}\}\cup\tmsmonitor_{2}$
      \end{passumptions}
      Invert \Cref{asm:basetmsmonitor:storeagree:unfolded3} to conclude $\delta_{\text{MS}}(\src{\loc})=\specificev{\loc}$.
      Choose $\absevent=\bm{Use\ }\specificev{\loc}$, $\delta'_{\text{MS}}=\delta_{\text{MS}}$, and $\tmsmonitor[']=\tmsmonitor$.
      The goals become:
      \begin{goals}
        \item $\delta_{\text{MS}}\subseteq\delta_{\text{MS}}$
        \item $\traceagree[\delta_{\text{MS}}']{\specificev{Use\ \loc\ n}}{\bm{Use\ }\specificev{\loc}}$
        \item $\monitorcheck[]{\tmsmonitor}{\tmsmonitor}{\bm{Use\ }\specificev{\loc}}$
        \item $\storeagreetms[\delta_{\text{MS}}']{\tmsmonitor}{\src{\Delta_1,x\mapsto(\loc;\sandboxtag;\poison;m),\Delta_2}}$
      \end{goals}
      All goals follow easily.
  \end{description}
\end{proof}

\begin{lemma}[Ctx \gls{tms} via Monitor]\label{lem:ctxsteptmsmonitor}
  If
  \begin{assumptions}
    \item\label[ass]{asm:ctxtmsmonitor:typechecks} $\typechecks{}{\src{\Omega}\triangleright e\gamma}{\src{\type}}$
    \item\label[ass]{asm:ctxtmsmonitor:ctxstep} $\execs[]{\configs}{e\gamma}{\configs'}{e'\gamma'}{\event}$
    \item\label[ass]{asm:ctxtmsmonitor:storeagree} $\storeagreetms{\tmsmonitor}{\src{\Omega}.\src{\Delta}}$
  \end{assumptions}
  Then $\exists \absevent\ \delta_{\text{MS}}'\ \tmsmonitor['],$
  \begin{goals}
    \item $\delta_{\text{MS}}\subseteq\delta_{\text{MS}}'$
    \item $\tmstraceagree{\tospecificevs[_{\delta_{\text{MS}}'}]{\event}}{\absevent}$
    \item $\monitorcheck[]{\tmsmonitor}{\tmsmonitor[']}{\absevent}$
    \item $\storeagreetms[\delta_{\text{MS}}']{\tmsmonitor[']}{\src{\Omega'}.\src{\Delta}}$
  \end{goals}.
\end{lemma}
\begin{proof}
  Induction on \Cref{asm:ctxtmsmonitor:ctxstep}.
  \begin{description}
    \case{tr:w-e-ectx}
      Analogous to next case.
    \case{tr:w-e-ectx-stuck}
    If
    \begin{passumptions}{H}
      \item\label[ass]{asm:ctxtmsmonitor:ctxstep:case0:typ0} $\src{e\gamma}=\src{K[e_{0}]}$
      \item\label[ass]{asm:ctxtmsmonitor:ctxstep:case0:typ1} $\src{e'\gamma'}=\src{K[e_{0}']}$
      \item\label[ass]{asm:ctxtmsmonitor:ctxstep:case0:typs} $\typechecks{}{\Omega\triangleright e\gamma}{\type}$
      \item\label[ass]{asm:ctxtmsmonitor:ctxstep:case0:exec} $\exprevals{\configs}{e_{0}}{\configs'}{e_{0}'}{\event}$
      \item\label[ass]{asm:ctxtmsmonitor:ctxstep:case0:monrel} $\storeagreetms{\tmsmonitor}{\src{\Omega}.\src{\Delta}}$
    \end{passumptions}
    Then $\exists \absevent\ \delta_{\text{MS}}'\ \tmsmonitor['],$
    \begin{goals}
      \item $\delta_{\text{MS}}\subseteq\delta_{\text{MS}}'$
      \item $\tmstraceagree{\tospecificevs[_{\delta_{\text{MS}}'}]{\event}}{\absevent}$
      \item $\monitorcheck[]{\tmsmonitor}{\tmsmonitor[']}{\absevent}$
      \item $\storeagreetms[\delta_{\text{MS}}']{\tmsmonitor[']}{\src{\Omega'}.\src{\Delta}}$
    \end{goals}
    Rewrite \Cref{asm:ctxtmsmonitor:ctxstep:case0:typs} using \Cref{asm:ctxtmsmonitor:ctxstep:case0:typ0}:
    \begin{passumptions}{H}
      \setcounter{enumi}{5}
      \item\label[ass]{asm:ctxtmsmonitor:ctxstep:case0:typsrw} $\typechecks{}{\Omega\triangleright K[e_{0}]}{\type}$
    \end{passumptions}
    Apply \Thmref{lem:rtctxtyping:plugged} on \Cref{asm:ctxtmsmonitor:ctxstep:case0:typsrw}:
    \begin{passumptions}{H}
      \setcounter{enumi}{6}
      \item\label[ass]{asm:ctxtmsmonitor:ctxstep:case0:Krttyps} $\typechecks{}{\Omega\triangleright K}{\type_{e}\to\type}$
      \item\label[ass]{asm:ctxtmsmonitor:ctxstep:case0:e0rttyps} $\typechecks{}{\Omega\triangleright e_{0}}{\type_{e}}$
    \end{passumptions}

    Apply \Thmref{lem:basetmsmonitor} on \Cref{asm:ctxtmsmonitor:ctxstep:case0:monrel,asm:ctxtmsmonitor:ctxstep:case0:exec,asm:ctxtmsmonitor:ctxstep:case0:e0rttyps}, giving us exactly the assumptions necessary to prove the goals.

    \case{tr:w-e-ectx-call-main}
    If
    \begin{passumptions}{H}
      \item\label[ass]{asm:ctxtmsmonitor:ctxstep:case1:typ0} $\src{e\gamma}=\src{K[call\ main\ 0]}$
      \item\label[ass]{asm:ctxtmsmonitor:ctxstep:case1:typ1} $\src{\gamma'}=\src{[0/x]}$
      \item\label[ass]{asm:ctxtmsmonitor:ctxstep:case1:typs} $\typechecks{}{\Omega\triangleright e\gamma}{\type}$
      \item\label[ass]{asm:ctxtmsmonitor:ctxstep:case1:monrel} $\storeagreetms{\tmsmonitor}{\src{\Omega}.\src{\Delta}}$
    \end{passumptions}
    Then $\exists \absevent\ \delta_{\text{MS}}'\ \tmsmonitor['],$
    \begin{goals}
      \item $\delta_{\text{MS}}\subseteq\delta_{\text{MS}}'$
      \item $\tmstraceagree{\tospecificevs[_{\delta_{\text{MS}}'}]{Start;\ctx}}{\absevent}$
      \item $\monitorcheck[]{\tmsmonitor}{\tmsmonitor[']}{\absevent}$
      \item $\storeagreetms[\delta_{\text{MS}}']{\tmsmonitor[']}{\src{\Omega'}.\src{\Delta}}$
    \end{goals}

    Note that $\tospecificevs[_{\delta_{\text{MS}}}]{Start;\ctx}=\specificev{\varepsilon}$ for any $\delta_{\text{MS}}$ whatsoever.
    So, instantiate $\absevent=\bm{\varepsilon}$, $\delta_{\text{MS}}'=\delta_{\text{MS}}$, and $\tmsmonitor[']=\tmsmonitor$.
    All goals follow easily.

    \case{tr:w-e-ectx-call-same}
      Mostly similar to next case.
    \case{tr:w-e-ectx-call-notsame}
    If
    \begin{passumptions}{H}
      \item\label[ass]{asm:ctxtmsmonitor:ctxstep:case2:typ0} $\src{e\gamma}=\src{K[call\ foo\ \valueexpr]}$
      \item\label[ass]{asm:ctxtmsmonitor:ctxstep:case2:typ1} $\src{\gamma'}=\src{[\valueexpr/x]}$
      \item\label[ass]{asm:ctxtmsmonitor:ctxstep:case2:typs} $\typechecks{}{\Omega\triangleright e\gamma}{\type}$
      \item\label[ass]{asm:ctxtmsmonitor:ctxstep:case2:monrel} $\storeagreetms{\tmsmonitor}{\src{\Omega}.\src{\Delta}}$
    \end{passumptions}
    Then $\exists \absevent\ \delta_{\text{MS}}'\ \tmsmonitor['],$
    \begin{goals}
      \item $\delta_{\text{MS}}\subseteq\delta_{\text{MS}}'$
      \item $\tmstraceagree{\tospecificevs[_{\delta_{\text{MS}}'}]{Call\ \comm\ foo\ \valueexpr;\sandboxtag}}{\absevent}$
      \item $\monitorcheck[]{\tmsmonitor}{\tmsmonitor[']}{\absevent}$
      \item $\storeagreetms[\delta_{\text{MS}}']{\tmsmonitor[']}{\src{\Omega'}.\src{\Delta}}$
    \end{goals}

    Note that $\tospecificevs[_{\delta_{\text{MS}}}]{Call\ \comm\ foo\ \valueexpr;\sandboxtag}=\specificev{\varepsilon}$ for any $\delta_{\text{MS}}$ and $\src{\sandboxtag}$ whatsoever.
    So, instantiate $\absevent=\bm{\varepsilon}$, $\delta_{\text{MS}}'=\delta_{\text{MS}}$, and $\tmsmonitor[']=\tmsmonitor$.
    All goals follow easily.

    \case{tr:w-e-ectx-ret-main}
    If
    \begin{passumptions}{H}
      \item\label[ass]{asm:ctxtmsmonitor:ctxstep:case3:typ0} $\src{e\gamma}=\src{K[return\ \valueexpr]}$
      \item\label[ass]{asm:ctxtmsmonitor:ctxstep:case3:typ1} $\src{e'\gamma'}=\src{v}$
      \item\label[ass]{asm:ctxtmsmonitor:ctxstep:case3:typs} $\typechecks{}{\Omega\triangleright e\gamma}{\type}$
      \item\label[ass]{asm:ctxtmsmonitor:ctxstep:case3:monrel} $\storeagreetms{\tmsmonitor}{\src{\Omega}.\src{\Delta}}$
    \end{passumptions}
    Then $\exists \absevent\ \delta_{\text{MS}}'\ \tmsmonitor['],$
    \begin{goals}
      \item $\delta_{\text{MS}}\subseteq\delta_{\text{MS}}'$
      \item $\tmstraceagree{\tospecificevs[_{\delta_{\text{MS}}'}]{End\ \valueexpr;\ctx}}{\absevent}$
      \item $\monitorcheck[]{\tmsmonitor}{\tmsmonitor[']}{\absevent}$
      \item $\storeagreetms[\delta_{\text{MS}}']{\tmsmonitor[']}{\src{\Omega'}.\src{\Delta}}$
    \end{goals}

    Note that $\tospecificevs[_{\delta_{\text{MS}}}]{End\ \valueexpr;\ctx}=\specificev{\varepsilon}$ for any $\delta_{\text{MS}}$ whatsoever.
    So, instantiate $\absevent=\bm{\varepsilon}$, $\delta_{\text{MS}}'=\delta_{\text{MS}}$, and $\tmsmonitor[']=\tmsmonitor$.
    All goals follow easily.

    \case{tr:w-e-ectx-ret-same}
    Mostly similar to next case.
    \case{tr:w-e-ectx-ret-notsame}
    If
    \begin{passumptions}{H}
      \item\label[ass]{asm:ctxtmsmonitor:ctxstep:case4:typ0} $\src{e\gamma}=\src{K'[return\ \valueexpr]}$
      \item\label[ass]{asm:ctxtmsmonitor:ctxstep:case4:typ1} $\src{e\gamma'}=\src{K[\valueexpr]}$
      \item\label[ass]{asm:ctxtmsmonitor:ctxstep:case4:typs} $\typechecks{}{\Omega\triangleright e\gamma}{\type}$
      \item\label[ass]{asm:ctxtmsmonitor:ctxstep:case4:monrel} $\storeagreetms{\tmsmonitor}{\src{\Omega}.\src{\Delta}}$
    \end{passumptions}
    Then $\exists \absevent\ \delta_{\text{MS}}'\ \tmsmonitor['],$
    \begin{goals}
      \item $\delta_{\text{MS}}\subseteq\delta_{\text{MS}}'$
      \item $\tmstraceagree{\tospecificevs[_{\delta_{\text{MS}}'}]{Ret\ \comm\ \valueexpr;\sandboxtag}}{\absevent}$
      \item $\monitorcheck[]{\tmsmonitor}{\tmsmonitor[']}{\absevent}$
      \item $\storeagreetms[\delta_{\text{MS}}']{\tmsmonitor[']}{\src{\Omega'}.\src{\Delta}}$
    \end{goals}

    Note that $\tospecificevs[_{\delta_{\text{MS}}}]{Ret\ \comm\ \valueexpr;\sandboxtag}=\specificev{\varepsilon}$ for any $\delta_{\text{MS}}$ and $\src{\sandboxtag}$ whatsoever.
    So, instantiate $\absevent=\bm{\varepsilon}$, $\delta_{\text{MS}}'=\delta_{\text{MS}}$, and $\tmsmonitor[']=\tmsmonitor$.
    All goals follow easily.
  \end{description}
\end{proof}

\begin{lemma}[Steps \gls{tms} via Monitor]\label{lem:generaltms:monitor}
  If
  \begin{assumptions}
    \item\label[ass]{asm:stepstmsmonitor:typing} $\typechecks{}{\src{\Omega}\triangleright e\gamma}{\src{\type}}$
    \item\label[ass]{asm:stepstmsmonitor:exec} $\execs{\configs}{e\gamma}{\configs'}{e'\gamma'}{\trace}$
    \item\label[ass]{asm:stepstmsmonitor:storeagree} $\storeagreetms{\tmsmonitor}{\src{\Omega}.\src{\Delta}}$
  \end{assumptions}
  Then $\exists \abstrace\ \delta_{\text{MS}}'\ \tmsmonitor['],$
  \begin{goals}
    \item\label[goal]{goal:stepstmsmonitor:delta} $\delta_{\text{MS}}\subseteq\delta_{\text{MS}}'$
    \item\label[goal]{goal:stepstmsmonitor:traceagree} $\tmstraceagree[^{*}]{\tospecificevs[_{\delta_{\text{MS}}'}]{\trace}}{\abstrace}$
    \item\label[goal]{goal:stepstmsmonitor:monitorstep} $\monitorcheck{\tmsmonitor}{\tmsmonitor[']}{\abstrace}$
    \item\label[goal]{goal:stepstmsmonitor:storeagree} $\storeagreetms[\delta_{\text{MS}}']{\tmsmonitor[']}{\src{\Omega'}.\src{\Delta}}$
  \end{goals}.
\end{lemma}
\begin{proof}
  Induction on \Cref{asm:stepstmsmonitor:exec}.
  \begin{description}
    \item[$\src{\configs'}=\configs$, $\src{e'}=\src{e}$, and $\src{\trace}=\src{\hole{\cdot}}$:]
          This case is easy, since nothing did change.
          Instantiate $\abstrace=\hole{\cdot}$, $\delta_{\text{MS}}'=\delta_{\text{MS}}$, and $\tmsmonitor[']=\tmsmonitor$.
          Then, \Cref{goal:stepstmsmonitor:delta,goal:stepstmsmonitor:traceagree,goal:stepstmsmonitor:monitorstep} follow immediately by reflexivity and \Cref{goal:stepstmsmonitor:storeagree} by \Cref{asm:stepstmsmonitor:storeagree}.

    \item[Induction step:]
          The inductive hypothesis is as follows.
          If
          \begin{passumptions}{A}
            \item $\typechecks{}{\src{\Omega_{\IH}}\triangleright e_{\IH}\gamma_{\IH}}{\src{\type}}$
            \item $\storeagreetms[\delta^{0}_{\text{MS}}]{\tmsmonitor[_{\IH}]}{\src{\Omega_{\IH}}.\src{\Delta}}$
          \end{passumptions}
          then $\exists \abstrace_{\IH}\ \delta_{\text{MS}}^{\IH}\ \tmsmonitor[_{\IH}'],$
          \begin{passumptions}{\IH}
            \item $\delta_{\text{MS}}^{0}\subseteq\delta_{\text{MS}}^{\IH}$
            \item $\tmstraceagree{\tospecificevs[_{\delta^{\IH}_{\text{MS}}}]{\trace}}{\abstrace_{\IH}}$
            \item $\monitorcheck{\tmsmonitor_{\IH}}{\tmsmonitor[_{\IH}']}{\abstrace_{\IH}}$
            \item $\storeagreetms[\delta^{\IH}_{\text{MS}}]{\tmsmonitor[_{\IH}']}{\src{\Omega'}.\src{\Delta}}$
          \end{passumptions}
          Note that above, anything not bound by $\exists$ is universally quantified, besides $\src{\type}$ and $\src{\Omega'}$.
          While our remaining context (excluding the inductive hypothesis) is:
          If
          \begin{passumptions}{H}
            \item\label[ass]{asm:stepstmsmonitor:case0:step} $\execs[]{\configs}{e\gamma}{\configs_{0}}{e_{0}\gamma_{0}}{\event[_0]}$
            \item\label[ass]{asm:stepstmsmonitor:case0:steps} $\execs{\configs_{0}}{e_{0}\gamma_{0}}{\configs'}{e'\gamma'}{\trace}$
            \item\label[ass]{asm:stepstmsmonitor:case0:checks} $\typechecks{}{\src{\Omega}\triangleright e\gamma}{\src{\type}}$
            \item\label[ass]{asm:stepstmsmonitor:case0:storeagree} $\storeagreetms{\tmsmonitor}{\src{\Omega}.\src{\Delta}}$
          \end{passumptions}
          Then $\exists \abstrace\ \delta_{\text{MS}}'\ \tmsmonitor['],$
          \begin{goals}
            \item\label[goal]{goal:stepstmsmonitor:final:delta} $\delta_{\text{MS}}\subseteq\delta_{\text{MS}}'$
            \item\label[goal]{goal:stepstmsmonitor:final:traceagree} $\tmstraceagree{\tospecificevs[_{\delta_{\text{MS}}'}]{\event[_{0}]\cdot\trace}}{\abstrace}$
            \item\label[goal]{goal:stepstmsmonitor:final:monitorstep} $\monitorcheck{\tmsmonitor}{\tmsmonitor[']}{\abstrace}$
            \item\label[goal]{goal:stepstmsmonitor:final:storeagree} $\storeagreetms[\delta_{\text{MS}}']{\tmsmonitor[']}{\src{\Omega'}.\src{\Delta}}$
          \end{goals}
          Use \Thmref{lem:ctxsteptmsmonitor} with \Cref{asm:stepstmsmonitor:case0:step,asm:stepstmsmonitor:case0:checks,asm:stepstmsmonitor:case0:storeagree}, obtaining:
          \begin{passumptions}{F}
            \item\label[ass]{asm:stepstmsmonitor:deltasubset0} $\delta_{\text{MS}}\subseteq\delta_{\text{MS}}^{0}$
            \item\label[ass]{asm:stepstmsmonitor:traceagree0} $\tmstraceagree{\tospecificevs[_{\delta^{0}_{\text{MS}}}]{\event[_{0}]}}{\absevent_{0}}$
            \item\label[ass]{asm:stepstmsmonitor:monitorcheck0} $\monitorcheck[]{\tmsmonitor}{\tmsmonitor[_{0}]}{\absevent_{0}}$
            \item\label[ass]{asm:stepstmsmonitor:case0:storeagree1} $\storeagreetms[\delta^{0}_{\text{MS}}]{\tmsmonitor[_{0}]}{\src{\Omega_{0}}.\src{\Delta}}$
          \end{passumptions}
          Discharge the inductive hypothesis with \Cref{asm:stepstmsmonitor:case0:storeagree1} and the result of applying \Thmref{lem:ctx-preservation} using \Cref{asm:stepstmsmonitor:case0:step,asm:stepstmsmonitor:case0:checks}:
          \begin{passumptions}{G}
            \item\label[ass]{asm:stepstmsmonitor:deltasubset1} $\delta_{\text{MS}}^{0}\subseteq\delta_{\text{MS}}^{\IH}$
            \item\label[ass]{asm:stepstmsmonitor:traceagree1} $\tmstraceagree{\tospecificevs[_{\delta^{\IH}_{\text{MS}}}]{\trace}}{\abstrace_{\IH}}$
            \item\label[ass]{asm:stepstmsmonitor:monitorcheck1} $\monitorcheck{\tmsmonitor_{0}}{\tmsmonitor[^{\IH}]}{\abstrace_{\IH}}$
            \item\label[ass]{asm:stepstmsmonitor:case0:storeagree2} $\storeagreetms[\delta^{\IH}]{\tmsmonitor[^{\IH}]}{\src{\Omega'}.\src{\Delta}}$
          \end{passumptions}

          We solve our goals by instantiating $\abstrace=\absevent\cdot\abstrace_{\IH}$, $\delta_{\text{MS}}'=\delta_{\text{MS}}^{\IH}$, and $\tmsmonitor[']=\tmsmonitor[^{\IH}]$.
          \Cref{goal:stepstmsmonitor:final:delta} follows by transitivity using \Cref{asm:stepstmsmonitor:deltasubset0,asm:stepstmsmonitor:deltasubset1}.

          Similarily for \Cref{goal:stepstmsmonitor:final:traceagree} using \Cref{asm:stepstmsmonitor:traceagree0,asm:stepstmsmonitor:traceagree1} and \Thmref{lem:filter-weaken}.

          \Cref{goal:stepstmsmonitor:final:monitorstep} also by transitivity using \Cref{asm:stepstmsmonitor:monitorcheck0,asm:stepstmsmonitor:monitorcheck1}.

          \Cref{goal:stepstmsmonitor:final:storeagree}, again, by transitivity using \Cref{asm:stepstmsmonitor:case0:storeagree1,asm:stepstmsmonitor:case0:storeagree2}, making use of \Thmref{lem:store-agree-weaken}.
  \end{description}
\end{proof}

\realthm{thm:mmlAs:tmssafe}{1}{$\mmlAs$ is \gls{tms} via Monitor}
\begin{proof}
  Apply \Thmref{lem:tmssafe-tracetms} on the goal, what is left to show is:
  \begin{goals}
    \item $\texttt{TMS}(\theta_{\delta_{ms}}(\src{\trace}))$
  \end{goals}

  Inverting \Cref{asm:mmlatmsviamonitor:run} and omitting the spurious cases, we get
  \begin{passumptions}{H}
    \item\label[ass]{asm:mmlatmsviamonitor:progtyps} $\typechecks{}{prog\ \library_{ctx}\ \library_{comp}}{\commlib,\library}$
    \item\label[ass]{asm:mmlatmsviamonitor:exec} $\execs{\commlib;\library;\comp;\hole{\cdot};\hole{\cdot};\hole{\cdot}}{call\ main\ 0}{\Omega}{\finalexpr}{\trace}$
  \end{passumptions}
  Invert \Cref{asm:mmlatmsviamonitor:progtyps}:
  \begin{passumptions}{H}
    \setcounter{enumi}{2}
    \item\label[ass]{asm:mmlatmsviamonitor:librarylink} $\src{\library}=\src{\library_{\ctx}\linker\library_{\comp}}$
    \item\label[ass]{asm:mmlatmsviamonitor:libgamma} $\src{\library}\downarrow=\src{\Gamma_{0}}$
    \item\label[ass]{asm:mmlatmsviamonitor:mainindom} $\src{main}\in\src{\Gamma_{0}}$
    \item\label[ass]{asm:mmlatmsviamonitor:libok} $\src{\Gamma_{0}}\vdash\src{\library}\operatorname{ok}$
    \item\label[ass]{asm:mmlatmsviamonitor:mainchecks} $\typechecks{\Gamma_{0}}{call\ main\ 0}{\nat}$
  \end{passumptions}

  Apply \Thmref{lem:static-implies-runtime:toplevel} on \Cref{asm:mmlatmsviamonitor:mainchecks,asm:mmlatmsviamonitor:libgamma}:
  \begin{passumptions}{H}
    \setcounter{enumi}{7}
    \item\label[ass]{asm:mmlatmsviamonitor:rttypes} $\typechecks{}{\commlib;\library;\hole{\cdot};\comp;\hole{\cdot}^{\ctx};\hole{\cdot}^{\comp};\hole{\cdot}\triangleright call\ main\ 0}{\nat}$
  \end{passumptions}

  Note that by definition, we have:
  \begin{passumptions}{H}
    \setcounter{enumi}{8}
    \item\label[ass]{asm:mmlatmsviamonitor:emptystart} $\storeagreetms[\delta_{ms}]{\emptyset}{\src{\hole{\cdot}}}$
  \end{passumptions}
  With \Cref{asm:mmlatmsviamonitor:rttypes,asm:mmlatmsviamonitor:emptystart,asm:mmlatmsviamonitor:exec} apply \Thmref{lem:generaltms:monitor}:
  \begin{passumptions}{H}
    \setcounter{enumi}{9}
    \item\label[ass]{asm:mmlatmsviamonitor:m1:deltasubset} $\delta_{\text{ms}}\subseteq\delta_{\text{ms}}'$
    \item\label[ass]{asm:mmlatmsviamonitor:m1:traceagree} $\tmstraceagree[^{*}]{\tospecificevs[_{\delta_{\text{MS}}'}]{\trace}}{\abstrace}$
    \item\label[ass]{asm:mmlatmsviamonitor:m1:monitorstep} $\monitorcheck{\emptyset}{\tmsmonitor}{\abstrace}$
    \item\label[ass]{asm:mmlatmsviamonitor:m1:storeagree} $\storeagreetms[\delta_{\text{MS}}']{\tmsmonitor}{\src{\Omega}.\src{\Delta}}$
  \end{passumptions}

  Immediately, we instantiate our goal with $\delta_{\text{ms}}', \abstrace$, and $\tmsmonitor$.
  Make use of \Thmref{lem:filter-weaken} on the first part, and \Thmref{lem:store-agree-weaken} on the second part, noting that \Cref{asm:mmlatmsviamonitor:m1:deltasubset}.
  Now, \Cref{asm:mmlatmsviamonitor:m1:traceagree,asm:mmlatmsviamonitor:m1:monitorstep} are precisely what is required in \Thmref{def:src:trace:tms}.
\end{proof}

\subsection{Target Language}
\subsubsection{Syntax}

%%%%
%% TARGET

\myfig{
	\vspace{-1em}
  \begin{gather*}
  \begin{aligned}
  \mi{Final\ Result}\ \trg{\finalexprnoerr} \bnfdef&\ \trg{\valueexpr} \mid \trg{x}\hspace{0.5cm}
  \mi{May\ be\ a\ Result}\ \trg{\finalexpr} \bnfdef\ \trg{\finalexprnoerr} \mid \trg{stuck} \\
  \mi{Expressions}~\trg{e} \bnfdef&\ \trg{\finalexpr} \mid \trg{e_{1} \oplus e_{2}} \mid \trg{x[e]} \mid \trg{let\ x = e_{1}\ in\ e_{2}}\mid \trg{x[e_{1}]\leftarrow e_{2}} \\
    & \mid \trg{let\ x=new\ e_{1}\ in\ e_{2}} \mid \trg{delete\ x} \mid \trg{return\ e} \mid \trg{call\ foo\ e} \\
    & \mid \trg{ifz\ e_1\ then\ e_2\ else\ e_3} \mid \trg{abort()} \mid \trg{x\ is\ \poisoned} \\
    & \mid \trg{\langle e_1;e_2\rangle} \mid \trg{\pi_1\ e} \mid \trg{\pi_2\ e}\mid \trg{e\ has\ \type}
  \hspace{0.5cm} \text{where } \trg{\oplus}\in\{\trg{+},\trg{-},\trg{\times},\trg{<}\}\\
  \mi{Functions}~\trg{\asymbol} \bnfdef&\ \trg{let\ foo\ x:=e}\hspace{0.5cm}
  \mi{Types}~\trg{\type} \bnfdef\ \trg{\nat}\mid\trg{\nat\times\nat} \\
  %
  \mi{Values}~\trg{v} \bnfdef&\ \trg{\langle n_{1}, n_{2}\rangle} \mid \trg{n}\in\trg{\nat} \hspace{0.5cm}
  \mi{References}~\trg{\loc}\in\trg{\nat} \\
  \mi{Eval.Ctx.}~\trg{K}\bnfdef &\ \trg{\hole{\cdot}}\mid \trg{K\oplus e}\mid \trg{v\oplus E}\mid \trg{x[K]}\mid \trg{let\ x=K\ in\ e} \\
                 &\mid \trg{x[K]\leftarrow e}\mid \trg{x[v]\leftarrow K}\mid \trg{let\ x=new\ K\ in\ e} \\
                 &\mid \trg{\langle K; e\rangle} \mid \trg{\langle n; K\rangle} \mid \trg{ifz\ K\ then\ e_1\ else\ e_2} \mid \trg{\pi_{1}\ K} \mid \trg{\pi_{2}\ K} \\
                 &\mid \trg{K\ has\ \type}\mid\trg{call\ foo\ K}\mid\trg{return\ K} \\
  %
  \mi{Variables}~\ \trg{x} &\mid \trg{y} \mid \trg{foo} \mid \dots \hspace{0.35cm}
  %
  \mi{Poison}~\ \trg{\poison}~\bnfdef\ \trg{\poisonless} \mid \trg{\poisoned}\\
  \mi{Sandbox\ Tag}~&\ \trg{\sandboxtag}~\bnfdef\ \trg{\ctx} \mid \trg{\comp}\\
  %
  \mi{Store}~\trg{\Delta} \bnfdef&\ \trg{\hole{\cdot}} \mid \trg{x\mapsto(\loc;\sandboxtag;\poison;n)},\Deltat\hspace{0.35cm}
  \mi{Communication}~\trg{\comm} \bnfdef\ \trg{\ctxtocomp} \mid \trg{\comptoctx} \mid \trg{\nocomm}\\
  \mi{Cont.\ Stack}~\trg{\kontstack} \bnfdef&\ \trg{\hole{\cdot}} \mid \trg{(K;foo)},\trg{\kontstack} \hspace{0.5cm}
  \mi{Library}~\trg{\library} \bnfdef\ \trg{\hole{\cdot}} \mid \trg{\asymbol},\trg{\library}\\
  %
  \mi{Relevant}~\trg{\commlib} \bnfdef&\ \trg{\hole{\cdot}} \mid \trg{foo},\trg{\commlib}\hspace{0.35cm}
  \mi{Heaps}~\trg{H} \bnfdef\ \trg{\hole{\cdot}} \mid \trg{H}::\trg{n} \hspace{0.35cm}
  \mi{State}\ \configt \bnfdef\ \trg{\cfstate;\sandboxtag;\memstate} \\
  %
  \mi{Flow\ State}\ \trg{\cfstate} \bnfdef&\ \trg{\commlib;\library;\kontstack}\hspace{0.35cm}
  \mi{Memory\ State}\ \trg{\memstate} \bnfdef \trg{H^{\ctx};H^{\comp};\Delta}\\
  %
  \mi{Programs}\ &\trg{prog\ \library_{ctx}\ \library_{comp}} \hspace{0.35cm}
  \mi{Substitutions}~\trg{\gamma} \bnfdef \trg{[\valueexpr/x],\gamma}\ \vert\ \trg{\hole{\cdot}} \\
  \end{aligned}
  \end{gather*}
}{mmlat-syntax}{Syntax of $\mmlAt$}

The target language is very similar to the source language presented in the previous section.
However, it does contain simple, non-nested pairs and dynamic type checks.

\subsubsection{Dynamic Semantics}

\myfig{
  \judgbox{\operatorname{dom}\ \trg{\library}=\trg{foo},\dots,\trg{bar}}{,,Collect function names.''}$\;$\\
  \begin{center}
    \typerule{$\trg{\library}$-dom-$\trg{\hole{\cdot}}$}{
    }{
      \operatorname{dom}\ \trg{\hole{\cdot}} = \trg{\hole{\cdot}}
    }{wt-lib-dom-empty}
    %
    \typerule{$\trg{\library}$-dom-cons}{
      \operatorname{dom}\ \trg{\library} = \trg{D}
    }{
      \operatorname{dom}\ (\trg{let\ foo\ x : \type}_\lambda\trg{:= e})\trg{,\library} = \trg{foo},\trg{D}
    }{wt-lib-dom-cons}
  \end{center}
  \begin{center}
    \judgbox{\trg{\library}\equiv\trg{\library_1}\cup\trg{\library_2}}{,,Merging $\mmlAt$ libraries.''}$\;$\\
    \typerule{lib-merge-empty}{
      \trg{\library}=\trg{\library_1}
    }{
      \trg{\library}\equiv\trg{\library_1}\cup\trg{\hole{\cdot}}
    }{trg-lib-merge-empty}
    %
    \typerule{lib-merge-cons}{
      \trg{\library}\equiv\trg{\library_1}\cup\trg{\library_2}
    }{
      \trg{\asymbol,\library}\equiv\trg{\library_1}\cup\trg{\asymbol,\library_2}
    }{trg-lib-merge-cons}

    \judgbox{\trg{\library_1\linker\library_2}=\trg{\library}}{,,Syntactically linking $\mmlAt$ libraries.''}$\;$\\
    \typerule{syntactic-plugging}{
      \operatorname{dom}\trg{\library_1}\cap\operatorname{dom}\trg{\library_2} = \emptyset &
      \trg{\library}\equiv\trg{\library_1}\cup\trg{\library_2}
    }{
      \trg{\library_1\linker\library_2} = \trg{\library}
    }{trg-plugging}
  \end{center}
}{w-plugging-t}{$\mmlAt$ plugging of libraries and collecting of function names.}


\myfig{
  \begin{gather*}
  \begin{aligned}
  \mi{Base~Events}~\trg{\event_{b}} \bnfdef&\ \trg{Alloc\ \loc\ \valueexpr} \mid \trg{Dealloc\ \loc} \mid \trg{Get\ \loc\ \valueexpr} \mid \trg{Set\ \loc\ \valueexpr\ \valueexpr'} \mid \trg{\lightning}\\
                                                     & \mid \trg{Call\ \comm\ foo\ \valueexpr} \mid \trg{Ret\ \comm\ \valueexpr} \mid \trg{Start} \mid \trg{End\ \valueexpr} \\
  \mi{Events}~\trg{\event} \bnfdef&\ \trg{\emptyevent} \mid \trg{\event_{b};\sandboxtag}
  \end{aligned}
  \end{gather*}
}{tw-events}{Events of $\mmlAt$.}

\myfig{
  \judgbox{\exprevalt{\configt}{e}{\configt'}{e'}{\event}}{,,Expression $\trg{e}$ evaluates under configuration $\configt$ to $\trg{e'}$ and\\new configuration $\trg{\configt'}$, emitting event $\trg{\event}$.''}
  %
  \typerule{$e-\trg{\oplus}$}{
    \trg{n_1}\oplus\trg{n_2}=\trg{n_3}
  }{
    \exprevalt{\configt}{n_1\oplus n_2}{\configt}{n_3}{\emptyevent}
  }{tw-e-oplus}
  %
  \typerule{$e-\trg{get}-\in$}{
    \trg{\memstate}=\trg{H^{\ctx};H^{\comp};\Delta_1,x\mapsto(\loc;\sandboxtag;\poison;m),\Delta_2} &
    \trg{\loc}+\trg{n}\in\text{dom }\trg{H^{\sandboxtag}}
  }{
    \exprevalt{\cfstate;\sandboxtag';\memstate}{x[n]}{\cfstate;\sandboxtag';\memstate}{H^{\sandboxtag}(\loc+n)}{Get\ \loc\ n;\sandboxtag}
  }{tw-e-get-in}
  %
  \typerule{$e-\trg{get}-\notin$}{
    \trg{\memstate}=\trg{H^{\ctx};H^{\comp};\Delta_1,x\mapsto(\loc;\sandboxtag;\poison;m),\Delta_2} &
    \trg{\loc}\notin\text{dom }\trg{H^{\sandboxtag}}
  }{
    \exprevalt{\cfstate;\sandboxtag';\memstate}{x[n]}{\cfstate;\sandboxtag';\memstate}{1729}{Get\ \loc\ n;\sandboxtag}
  }{tw-e-get-notin}
  %
  \typerule{$e-\trg{set}-\ctx$}{
    \trg{\memstate}=\trg{H^{\ctx};H^{\comp};\Delta_1,x\mapsto(\loc;\ctx;\poison;n),\Delta_2} &
    \trg{H^{\ctx'}} = \trg{H^{\ctx}}(\trg{\loc+n}\mapsto \trg{v}) \\
    \trg{\memstate'}=\trg{H^{\ctx'};H^{\comp};\Delta_1,x\mapsto(\loc;\ctx;\poison;n),\Delta_2}
  }{
    \exprevalt{\cfstate;\ctx;\memstate}{x[n]\leftarrow v}{\cfstate;\ctx;\memstate'}{v}{Set\ \loc\ n\ v;\ctx}
  }{tw-e-set-ctx}
  %
  \typerule{$e-\trg{set}-\comp$}{
    \trg{\memstate}=\trg{H^{\ctx};H^{\comp};\Delta_1,x\mapsto(\loc;\comp;\poison;n),\Delta_2} &
    \trg{H^{\comp'}} = \trg{H^{\comp}}(\trg{\loc+n}\mapsto \trg{v}) \\
    \trg{\memstate'}=\trg{H^{\ctx};H^{\comp'};\Delta_1,x\mapsto(\loc;\comp;\poison;n),\Delta_2}
  }{
    \exprevalt{\cfstate;\comp;\memstate}{x[n]\leftarrow v}{\cfstate;\comp;\memstate'}{v}{Set\ \loc\ n\ v;\comp}
  }{tw-e-set-comp}
  %
  \typerule{$e-\trg{let}-\trg{\finalexprnoerr}$}{
  }{
    \exprevalt{\Omega}{let\ x=\finalexprnoerr\ in\ e}{\Omega}{e[\finalexprnoerr/x]}{\emptyevent}
  }{tw-e-let-f}
  %
  \typerule{$e-\trg{delete}$}{
    \trg{\memstate}=\trg{H^{\ctx};H^{\comp};\Delta_1,x\mapsto(\loc;\sandboxtag;\poisonless;n),\Delta_2} \\
    \trg{\memstate}=\trg{H^{\ctx};H^{\comp};\Delta_1,x\mapsto(\loc;\sandboxtag;\poisoned;n),\Delta_2}
  }{
    \exprevalt{\cfstate;\sandboxtag;\memstate}{delete\ x}{\cfstate;\sandboxtag;\memstate'}{0}{Dealloc\ \loc;\sandboxtag}
  }{tw-e-delete}
  %
  \typerule{$e-\trg{new}-ctx$}{
    \fresh{\trg{\Delta}}{\trg{\loc}} &
    \fresh{\trg{\Delta}}{\trg{z}} &
    \trg{H^{\ctx'}} = \trg{H^{\ctx}} \ll \trg{n} \\
    \trg{\memstate} = \trg{H^{\ctx'};H^{\comp};z\mapsto (\loc;\ctx;\poisonless;n),\Delta}
  }{
    \exprevalt{\cfstate;\ctx;H^{\ctx};H^{\comp};\Delta}{let\ x=new\ n\ in\ e}{\cfstate;\ctx;\memstate}{e[z/x]}{Alloc\ \loc\ n;\ctx}
  }{tw-e-let-new-ctx}
  %
  \typerule{$e-\trg{new}-comp$}{
    \fresh{\trg{\Delta}}{\trg{\loc}} &
    \fresh{\trg{\Delta}}{\trg{z}} &
    \trg{H^{\comp'}} = \trg{H^{\comp}} \ll \trg{n} \\
    \trg{\memstate} = \trg{H^{\ctx};H^{\comp'};z\mapsto (\loc;\ctx;\poisonless;n),\Delta}
  }{
    \exprevalt{\cfstate;\comp;H^{\ctx};H^{\comp};\Delta}{let\ x=new\ n\ in\ e}{\cfstate;\comp;\memstate}{e[z/x]}{Alloc\ \loc\ n;\comp}
  }{tw-e-let-new-comp}
  %
  \typerule{$e-\trg{ifz}-$true}{
  }{
    \exprevalt{\configt}{ifz\ 0\ then\ e_1\ else\ e_2}{\configt}{e_1}{\emptyevent}
  }{tw-e-if-true}
  %
  \typerule{$e-\trg{ifz}-$false}{
    \trg{n} \not= \trg{0}
  }{
    \exprevalt{\configt}{ifz\ n\ then\ e_1\ else\ e_2}{\configt}{e_2}{\emptyevent}
  }{tw-e-if-false}
  %
  \typerule{$e-\trg{abort}$}{
  }{
    \exprevalt{\configt}{abort()}{\configt}{stuck}{\lightning}
  }{tw-e-abort}
  %
}{tw-expr-eval}{Evaluation of $\mmlAt$ expressions.}

\myfig{
  \typerule{$e-\trg{\pi_1}$}{
  }{
    \exprevalt{\configt}{\pi_1\langle n_1;n_2\rangle}{\configt}{n_1}{\emptyevent}
  }{tw-e-proj1}
  %
  \typerule{$e-\trg{\pi_2}$}{
  }{
    \exprevalt{\configt}{\pi_2\langle n_1;n_2\rangle}{\configt}{n_2}{\emptyevent}
  }{tw-e-proj2}
  %
  \typerule{$e-\trg{x\ is\ \poisoned}-$yes}{
    \trg{\memstate}=\trg{H;\Delta} &
    \trg{\Delta}=\trg{\Delta_1,x\mapsto(\loc;\sandboxtag;\poisoned;n),\Delta_2}
  }{
    \exprevalt{\cfstate;\sandboxtag';\memstate}{x\ is\ \poisoned}{\cfstate;\sandboxtag';\memstate}{0}{\emptyevent}
  }{tw-e-x-is-poisoned-yes}
  %
  \typerule{$e-\trg{x\ is\ \poisoned}-$no}{
    \trg{\memstate}=\trg{H;\Delta} &
    \trg{\Delta}=\trg{\Delta_1,x\mapsto(\loc;\sandboxtag;\poisonless;n),\Delta_2}
  }{
    \exprevalt{\cfstate;\sandboxtag';\memstate}{x\ is\ \poisoned}{\cfstate;\sandboxtag';\memstate}{1}{\emptyevent}
  }{tw-e-x-is-poisoned-no}
  %
  \typerule{$e-\trg{n\ has\ \nat}$}{
  }{
    \exprevalt{\configt}{n\ has\ \nat}{\configt}{0}{\emptyevent}
  }{tw-e-n-hasnat}
  %
  \typerule{$e-pair-\trg{has\ \nat}$}{
  }{
    \exprevalt{\configt}{\langle n_1,n_2\rangle\ has\ \nat}{\configt}{1}{\emptyevent}
  }{tw-e-pair-hasnat}
  %
  \typerule{$e-\trg{x\ has\ \nat}$}{
  }{
    \exprevalt{\configt}{x\ has\ \nat}{\configt}{1}{\emptyevent}
  }{tw-e-x-hasnat}
  %
  \typerule{$e-\trg{n\ has\ \nat\times\nat}$}{
  }{
    \exprevalt{\configt}{n\ has\ \nat\times\nat}{\configt}{1}{\emptyevent}
  }{tw-e-n-haspair}
  %
  \typerule{$e-pair-\trg{has\ \nat\times\nat}$}{
  }{
    \exprevalt{\configt}{\langle n_1,n_2\rangle\ has\ \nat\times\nat}{\configt}{0}{\emptyevent}
  }{tw-e-pair-haspair}
  %
  \typerule{$e-\trg{x\ has\ \nat\times\nat}$}{
  }{
    \exprevalt{\configt}{x\ has\ \nat\times\nat}{\configt}{1}{\emptyevent}
  }{tw-e-x-haspair}
}{tw-expr-eval-continued}{Evaluation of $\mmlAt$ expressions, continued.}

$\trg{\gamma}$ acts as postfix and binds anything before it up to $\triangleright$, so $\trg{let\ x=e_{1}\ in\ e_{2}\gamma}$ is $\trg{(let\ x=e_{1}\ in\ e_{2})\gamma}$.


\myfig{
  \begin{center}
    \judgbox{\exect[]{\configt}{K[e]}{\configt'}{K[e']}{\event}}{,,Given an evaluation context $\trg{K}$ and an expression\\ $\trg{e}$, it evaluates under configuration $\configt$ to $\trg{e'}$ and new\\configuration $\trg{\configt'}$ in context $\trg{K}$, emitting event $\trg{\event}$.''}
    %
    \typerule{$e-\text{ctx}$}{
      \exprevalt{\Omega}{e}{\Omega'}{e'}{\event}
    }{
      \exect[]{\Omega}{K[e]}{\Omega'}{K[e']}{\event}
    }{tw-e-ectx}
    %
    \typerule{$e-\text{ctx}-\trg{stuck}$}{
      \exprevalt{\Omega}{e}{\Omega'}{stuck}{\lightning}
    }{
      \exect[]{\Omega}{K[e]}{\Omega'}{stuck}{\lightning}
    }{tw-e-ectx-stuck}
    %
    \typerule{$e-\text{ctx}-\trg{call}-$main}{
      \trg{\Omega}=\trg{\commlib;\library;\hole{\cdot};\comp;\memstate} &
      \trg{\library}=\trg{\library_1,}(\trg{let\ main\ x:\type}_\lambda\trg{:=e})\trg{,\library_2}\\
      \trg{\Omega'}=\trg{\commlib;\library;\ctx;K^{main},\hole{\cdot};\memstate}
    }{
      \exect[]{\Omega}{K[call\ main\ \valueexpr]}{\Omega'}{e[x/\valueexpr]}{Start;\comp}
    }{tw-e-ectx-call-main}
    %
    \typerule{$e-\text{ctx}-\trg{call}-\text{notsame}$}{
      \trg{\Omega}=\trg{\commlib;\library;\kontstack;\sandboxtag;\memstate} &
      \trg{\library}=\trg{\library_1,}(\trg{let\ foo\ x:\type}_\lambda\trg{:=e})\trg{,\library_2} \\
      %\rho_{\tiny call}(\trg{\commlib},\trg{foo},\trg{\kontstack},\trg{v}) = \trg{\event},\trg{\comm} &
      \trg{foo}\in_{\trg{\neg\sandboxtag}}\trg{\commlib} &
      \rho\left(\trg{\neg\sandboxtag}\right) = \trg{\comm} &
      \trg{\Omega'}=\trg{\commlib;\library;K^{foo},\kontstack;\neg\sandboxtag;\memstate} \\
    }{
      \exect[]{\Omega}{K[call\ foo\ \valueexpr]}{\Omega'}{e[x/\valueexpr]}{Call\ \comm\ foo\ \valueexpr;\sandboxtag}
    }{tw-e-ectx-call-notsame}
    %
    \typerule{$e-\text{ctx}-\trg{call}-\text{same}$}{
      \trg{\Omega}=\trg{\commlib;\library;\kontstack;\sandboxtag;\memstate} &
      \trg{\library}=\trg{\library_1,}(\trg{let\ foo\ x:\type}_\lambda\trg{:=e})\trg{,\library_2} \\
      %\rho_{\tiny call}(\trg{\commlib},\trg{foo},\trg{\kontstack},\trg{v}) = \trg{\event},\trg{\comm} &
      \trg{foo}\in_{\trg{\sandboxtag}}\trg{\commlib} &
      \trg{\Omega'}=\trg{\commlib;\library;K^{foo},\kontstack;\sandboxtag;\memstate} \\
    }{
      \exect[]{\Omega}{K[call\ foo\ \valueexpr]}{\Omega'}{e[x/\valueexpr]}{Call\ \nocomm\ foo\ \valueexpr;\sandboxtag}
    }{tw-e-ectx-call-same}
    %
    \typerule{$e-\text{ctx}-\trg{return}-$main}{
    }{
      \exec[]{\trg{\commlib;\library;\hole{\cdot}^{main},\hole{\cdot};\ctx;\memstate}}{\trg{K'[return\ \valueexpr]}}{\trg{\commlib;\library;\hole{\cdot};\comp;\memstate}}{\trg{\valueexpr}}{\trg{End\ \valueexpr;\sandboxtag}}
    }{tw-e-ectx-ret-main}
    %
    \typerule{$e-\text{ctx}-\trg{return}-\text{notsame}$}{
      \trg{foo}\in_{\trg{\neg\sandboxtag}}\trg{\commlib} &
      \rho\left(\trg{\neg\sandboxtag}\right) = \trg{\comm;\sandboxtag}
    }{
      \exec[]{\trg{\commlib;\library;K^{foo},\kontstack;\sandboxtag;\memstate}}{\trg{K'[return\ \valueexpr]}}{\trg{\commlib;\library;\kontstack;\neg\sandboxtag;\memstate}}{\trg{K[\valueexpr]}}{\trg{Ret\ \comm\ \valueexpr;\sandboxtag}}
    }{tw-e-ectx-ret-notsame}
    %
    \typerule{$e-\text{ctx}-\trg{return}-\text{same}$}{
      \trg{foo}\in_{\trg{\sandboxtag}}\trg{\commlib}
    }{
      \exec[]{\trg{\commlib;\library;K^{foo},\kontstack;\sandboxtag;\memstate}}{\trg{K'[return\ \valueexpr]}}{\trg{\commlib;\library;\kontstack;\sandboxtag;\memstate}}{\trg{K[\valueexpr]}}{\trg{Ret\ \nocomm\ \valueexpr;\sandboxtag}}
    }{tw-e-ectx-ret-same}
    %
    \judgbox{\rho(\trg{\sandboxtag})=\trg{\comm}}{,,Returns either $\trg{\ctxtocomp}$ or $\trg{\comptoctx}$ depending on $\trg{\sandboxtag}$.''}\\
    %
    \typerule{comm-ctxtocomp}{
    }{
      \rho(\trg{\ctx})=\trg{\ctxtocomp}
    }{tw-comm-ctxtocomp}
    %
    \typerule{comm-comptoctx}{
    }{
      \rho(\trg{\comp})=\trg{\comptoctx}
    }{tw-comm-comptoctx}\\[0.33cm]
    %
    \judgbox{\trg{\neg\sandboxtag}=\trg{\sandboxtag'}}{,,Negation of $\trg{\sandboxtag}$.''}\\
    %
    \typerule{neg-ctx}{
    }{
      \trg{\neg\ctx}=\trg{\comp}
    }{tw-neg-ctx}
    %
    \typerule{neg-comp}{
    }{
      \trg{\neg\comp}=\trg{\ctx}
    }{tw-neg-comp}
  \end{center}
}{w-t-expr-ctx-eval}{Contextual Evaluation of $\mmlAt$ expressions.}

\myfig{
  \begin{center}
    \judgbox{\exect{\configt}{e}{\configt'}{e'}{\trace}}{,,Expression $\trg{e}$ evaluates under configuration $\configt$ to $\trg{e'}$ and\\new configuration $\trg{\configt'}$, emitting list of events $\trg{\trace}$.''}
    %
    \typerule{$et-\text{refl}$}{
    }{
      \exect{\configt}{\finalexpr}{\configt}{\finalexpr}{\hole{\cdot}}
    }{wt-e-refl}
    \typerule{$et-\text{trans}-$important}{
      \exect[]{\configt}{e}{\configt'}{e'}{\event}&
      \exect{\configt'}{e'}{\configt''}{e''}{\trace}&
      \trg{a}\not=\trg{\emptyevent}
    }{
      \exect{\configt}{e}{\configt''}{e''}{\event \cdot \trace}
    }{wt-e-trans-important}
    \typerule{$et-\text{trans}-$unimportant}{
      \exect[]{\configt}{e}{\configt'}{e'}{\emptyevent}&
      \exect{\configt'}{e'}{\configt''}{e''}{\trace}&
    }{
      \exect{\configt}{e}{\configt''}{e''}{\trace}
    }{wt-e-trans-unimportant}
    %
    %
    \judgbox{\exectN{\configt}{e}{\configt'}{e'}{\trace}}{,,Expression $\trg{e}$ evaluates in $n$ steps under configuration $\configt$ to\\$\trg{e'}$ and new configuration $\trg{\configt'}$, emitting list of events $\trg{\trace}$.''}
    %
    \typerule{$en-\text{refl}$}{
    }{
      \exectN[^0]{\configt}{e}{\configt}{e}{\emptyevent}
    }{wtn-e-refl}
    %
    \typerule{$en-\text{trans}-$important}{
      \exect[]{\configt}{e}{\configt'}{e'}{\event} &
      \exectN[^n]{\configt'}{e'}{\configt''}{e''}{\trace} &
      \trg{\event}\not=\trg{\emptyevent}
    }{
      \exectN[^{(n+1)}]{\configt}{e}{\configt''}{e''}{\event\cdot\trace}
    }{wtn-e-trans-important}
    %
    \typerule{$en-\text{trans}-$unimportant}{
      \exect[]{\configt}{e}{\configt'}{e'}{\emptyevent} &
      \exectN[^n]{\configt'}{e'}{\configt''}{e''}{\trace} &
    }{
      \exectN[^{(n+1)}]{\configt}{e}{\configt''}{e''}{\trace}
    }{wtn-e-trans-unimportant}
  \end{center}
}{wt-steps}{Trace prefix generation given a $\mmlAt$ program using the reflexive-transitive closure.}

\myfig{
  \begin{center}
    \judgbox{\wexect{prog\ \library_{ctx}\ \library_{comp}}{\configt}{\finalexprnoerr}{\trace}}{,,Run $\mmlAt$ program $\trg{prog\ \library_{ctx}\ \library_{comp}}$, giving\\dynamic state $\configt$ and emitting trace $\trg{\trace}$.''}
    \typerule{$e-\text{wprog}$}{
      \trg{\library}=\trg{\library_{ctx}\linker\library_{comp}} &
      \trg{main}\notin\trg{\commlib} &
      \trg{\commlib}=\operatorname{dom}\ \trg{\library_{comp}} \\
      \exect{\commlib;\library;\hole{\cdot};\sandboxtag;\hole{\cdot};\hole{\cdot}}{call\ main\ 0}{\Omega}{\finalexpr}{\trace}
    }{
      \wexect{prog\ \library_{ctx}\ \library_{comp}}{\configt}{\finalexpr}{\trace}
    }{wt-e-prog}
    %
    \typerule{$e-\text{wprog}-\lightning$}{
      \trg{\library}=\trg{\library_{ctx}\linker\library_{comp}} &
      \trg{main}\notin\trg{\commlib} &
      \trg{\commlib}=\operatorname{dom}\ \trg{\library_{comp}} \\
      \exect{\commlib;\library;\hole{\cdot};\sandboxtag;\hole{\cdot};\hole{\cdot}}{call\ main\ 0}{\Omega}{\finalexpr}{\trace\cdot\lightning;\sandboxtag}
    }{
      \wexect{prog\ \library_{ctx}\ \library_{comp}}{\configt}{\finalexpr}{\trace\cdot\lightning;\sandboxtag}
    }{wt-e-prog-crash}
  \end{center}
}{twprog-run}{Running a whole $\mmlAt$ program.}

\subsubsection{Proofs and Auxiliary Lemmas}

\begin{lemma}[Determinism of Step]\label{lem:determ:step}
  If
  \begin{assumptions}
  \item\label[ass]{asm:determ:step:a} $\exprevalt{\Omega}{e\gamma}{\Omega'}{e_1\gamma'}{\event_{1}}$
  \item $\exprevalt{\Omega}{e\gamma}{\Omega''}{e_2\gamma''}{\event_{2}}$
  \end{assumptions}
  Then
  \begin{goals}
  \item $\trg{e_{1}}=\trg{e_{2}}$
  \item $\trg{\gamma'}=\trg{\gamma''}$
  \item $\trg{\Omega'}=\trg{\Omega''}$
  \item $\trg{\event_{1}}=\trg{\event_{2}}$
  \end{goals}
\end{lemma}
\begin{proof}
  By induction on \Cref{asm:determ:step:a}.
\end{proof}

\begin{lemma}[Determinism of Ctx-Step]\label{lem:determ:ctxstep}
  If
  \begin{assumptions}
  \item\label[ass]{asm:determ:ctxstep:a} $\exect[]{\Omega}{e\gamma}{\Omega'}{e_1\gamma'}{\event_{2}}$
  \item $\exect[]{\Omega}{e\gamma}{\Omega''}{e_2\gamma''}{\event_{1}}$
  \end{assumptions}
  Then
  \begin{goals}
  \item $\trg{e_{1}}=\trg{e_{2}}$
  \item $\trg{\gamma'}=\trg{\gamma''}$
  \item $\trg{\Omega'}=\trg{\Omega''}$
  \item $\trg{\event_{1}}=\trg{\event_{2}}$
  \end{goals}
\end{lemma}
\begin{proof}
  By induction on \Cref{asm:determ:ctxstep:a} making use of \Thmref{lem:determ:step}.
\end{proof}

\begin{lemma}[Determinism of $n$-Steps]\label{lem:determ:nsteps}
  If
  \begin{assumptions}
  \item\label[ass]{asm:determ:nsteps:a} $\exectN{\Omega}{e\gamma}{\Omega'}{e_1\gamma'}{\trace[_{1}]}$
  \item $\exectN{\Omega}{e\gamma}{\Omega''}{e_2\gamma''}{\trace[_{2}]}$
  \end{assumptions}
  Then
  \begin{goals}
  \item $\trg{e_{1}}=\trg{e_{2}}$
  \item $\trg{\gamma'}=\trg{\gamma''}$
  \item $\trg{\Omega'}=\trg{\Omega''}$
  \item $\trg{\trace[_{1}]}=\trg{\trace[_{2}]}$
  \end{goals}
\end{lemma}
\begin{proof}
  By induction on \Cref{asm:determ:nsteps:a} making use of \Thmref{lem:determ:ctxstep}.
\end{proof}

\begin{lemma}[Determinism of Steps]\label{lem:determ:steps}
  If
  \begin{assumptions}
  \item\label[ass]{asm:determ:steps:a} $\exect{\Omega}{e\gamma}{\Omega'}{\finalexpr^1\gamma'}{\trace[_{1}]}$
  \item $\exect{\Omega}{e\gamma}{\Omega''}{\finalexpr^2\gamma''}{\trace[_{2}]}$
  \end{assumptions}
  Then
  \begin{goals}
  \item $\trg{\finalexpr^{1}}=\trg{\finalexpr^{2}}$
  \item $\trg{\gamma'}=\trg{\gamma''}$
  \item $\trg{\Omega'}=\trg{\Omega''}$
  \item $\trg{\trace[_{1}]}=\trg{\trace[_{2}]}$
  \end{goals}
\end{lemma}
\begin{proof}
  By induction on \Cref{asm:determ:steps:a} making use of \Thmref{lem:determ:ctxstep}.
\end{proof}

\subsection{Robust \gls*{tms} Preserving Compiler}

\subsubsection{Compiler}

\myfig{
  \begin{center}
    \begin{gather*}
    \judgbox{\mmlAmmlAtcomp{e}=\trg{e}}{,,Compile $\mmlAs$ expression $\src{e}$ to $\mmlAt$ expression $\trg{e}$.}\\
    \judgbox{\mmlAmmlAtcomp{\left[\valueexpr / x\right]}=\trg{\left[\valueexpr / x\right]}}{,,Compile $\mmlAs$ substitution to $\mmlAt$ substitution.''} \\
    \judgbox{\mmlAmmlAtcomp{\commlib}=\trg{\commlib}}{,,Compile $\mmlAs$ component library to $\mmlAt$ component library.''} \\
    \end{gather*}
    $$
    \begin{array}{rll}
    \mmlAmmlAtcomp{\finalexpr} &\ = & \trg{\finalexpr} \\
    \mmlAmmlAtcomp{call\ foo\ e} &\ = & \trg{call\ }\mmlAmmlAtcomp{foo}\ \mmlAmmlAtcomp{e}\\
    \mmlAmmlAtcomp{return\ e} &\ = & \trg{return\ }\mmlAmmlAtcomp{e}\\
    \mmlAmmlAtcomp{e_1\oplus e_2} &\ = & \mmlAmmlAtcomp{e_1} \trg{\oplus} \mmlAmmlAtcomp{e_2} \\
    \mmlAmmlAtcomp{x[e]} &\ = & \mmlAmmlAtcomp{x}\trg{[}\mmlAmmlAtcomp{e}\trg{]} \\
    \mmlAmmlAtcomp{let\ x= e_1\ in\ e_2} &\ = & \trg{let\ }\mmlAmmlAtcomp{x}\trg{=} \mmlAmmlAtcomp{e_1}\trg{\ in\ }\mmlAmmlAtcomp{e_2} \\
    \mmlAmmlAtcomp{x[e_1]\leftarrow e_2} &\ = & \mmlAmmlAtcomp{x}\trg{[}\mmlAmmlAtcomp{e_1}\trg{]\leftarrow }\mmlAmmlAtcomp{e_2} \\
    \mmlAmmlAtcomp{let\ x=new\ e_1\ in\ e_2} &\ = & \trg{let\ }\mmlAmmlAtcomp{x}\trg{=new\ }\mmlAmmlAtcomp{e_1}\trg{\ in\ }\mmlAmmlAtcomp{e_2} \\
    \mmlAmmlAtcomp{delete\ x} &\ = & \trg{delete\ }\mmlAmmlAtcomp{x} \\
    \mmlAmmlAtcomp{ifz\ e_1\ then\ e_2\ else\ e_3} &\ = & \trg{ifz\ }\mmlAmmlAtcomp{e_1}\\
                                                        &&\trg{then\ }\mmlAmmlAtcomp{e_2} \\
                                                        &&\trg{else\ }\mmlAmmlAtcomp{e_3} \\[0.5cm]
    %
    \mmlAmmlAtcomp{\left[\src{v}/\src{x}\right]}&\ = & \trg{\left[\right.}\mmlAmmlAtcomp{v}\trg{/}\mmlAmmlAtcomp{x}\trg{\left.\right]} \\[0.5cm]
    %
    \mmlAmmlAtcomp{\hole{\cdot}}&\ = & \trg{\hole{\cdot}} \\
    \mmlAmmlAtcomp{foo,\commlib}&\ = & \trg{foo,}\mmlAmmlAtcomp{\commlib} \\
    \end{array}
    $$
  \end{center}
}{tms-pres-compiler}{Compiler from $\mmlAs$ to $\mmlAt$.}
\myfig{
  \begin{center}
    \begin{gather*}
    \judgbox{\mmlAmmlAtcomp{F}=\trg{F}}{,,Compile $\mmlAs$ procedures to $\mmlAt$ procedures.''}
    \end{gather*}
    $$
    \begin{array}{rll}
    %
      \mmlAmmlAtcompN{\src{let\ foo\ x :\nat \to \type_{e} := e}}&\ = & \trg{let\ }\mmlAmmlAtcomp{foo}\ \mmlAmmlAtcomp{x}\trg{ := }\\
                               && \trg{ifz\ }\mmlAmmlAtcomp{x}\trg{\ has\ \nat\ then}\\
                               && \ \ \mmlAmmlAtcomp{e}\\
                               && \trg{else}\\
                               && \ \ \trg{abort()}\\
    \end{array}
    $$
    \begin{gather*}
    \judgbox{\mmlAmmlAtcomp{\library}=\trg{\library}}{,,Compile $\mmlAs$ libraries to $\mmlAt$ libraries.''}
    \end{gather*}
    $$
    \begin{array}{rll}
      \mmlAmmlAtcomp{\hole{\cdot}}&\ = & \trg{\hole{\cdot}} \\
      \mmlAmmlAtcomp{F,\library}&\ = & \mmlAmmlAtcomp{F}\trg{,}\mmlAmmlAtcomp{\library} \\
    \end{array}
    $$
  \end{center}
}{tms-pres-compiler-comp}{Compiler from $\mmlAs$ components to $\mmlAt$ components.}
\myfig{
  \begin{center}
    \begin{gather*}
      \judgbox{\mmlAmmlAtcomp{K}=\trg{K}}{,,Compile $\mmlAs$ evaluation contexts to $\mmlAt$ evaluation contexts.''}
    \end{gather*}
    $$
    \begin{array}{rll}
      \mmlAmmlAtcomp{\hole{\cdot}} &\ = & \trg{\hole{\cdot}} \\
      \mmlAmmlAtcomp{K \oplus e} &\ = & \mmlAmmlAtcomp{K}\trg{\oplus}\mmlAmmlAtcomp{e} \\
      \mmlAmmlAtcomp{\valueexpr \oplus K} &\ = & \mmlAmmlAtcomp{\valueexpr}\trg{\oplus}\mmlAmmlAtcomp{K} \\
      \mmlAmmlAtcomp{x[K]} &\ = & \mmlAmmlAtcomp{x}\trg{[}\mmlAmmlAtcomp{K}\trg{]} \\
      \mmlAmmlAtcomp{let\ x\ = K\ in\ e} &\ = & \trg{let\ }\mmlAmmlAtcomp{x}\trg{\ = }\mmlAmmlAtcomp{K}\trg{\ in\ }\mmlAmmlAtcomp{e} \\
      \mmlAmmlAtcomp{x[K] \leftarrow e} &\ = & \mmlAmmlAtcomp{x}\trg{[}\mmlAmmlAtcomp{K}\trg{]\leftarrow} \mmlAmmlAtcomp{e} \\
      \mmlAmmlAtcomp{x[\valueexpr] \leftarrow K} &\ = & \mmlAmmlAtcomp{x}\trg{[}\mmlAmmlAtcomp{\valueexpr}\trg{]\leftarrow }\mmlAmmlAtcomp{K} \\
      \mmlAmmlAtcomp{let\ x\ = new\ K\ in\ e} &\ = & \trg{let\ }\mmlAmmlAtcomp{x}\trg{\ = new\ }\mmlAmmlAtcomp{K}\trg{\ in\ }\mmlAmmlAtcomp{e} \\
      \mmlAmmlAtcomp{ifz\ K\ then\ e_{1}\ else\ e_{2}} &\ = & \trg{ifz\ }\mmlAmmlAtcomp{K}\trg{\ then\ }\\
                               &&\ \ \mmlAmmlAtcomp{e_{1}}\\
                               &&\trg{else\ }\\
                               &&\ \ \mmlAmmlAtcomp{e_{2}} \\
      \mmlAmmlAtcomp{call\ foo\ K} &\ = & \trg{call\ }\mmlAmmlAtcomp{foo}\ \mmlAmmlAtcomp{K}\\
      \mmlAmmlAtcomp{return\ K} &\ = & \trg{return\ }\mmlAmmlAtcomp{K}\\
    \end{array}
    $$
  \end{center}
}{tms-pres-compiler-ctx}{Compiling $\mmlAs$ evaluation contexts to $\mmlAt$ evaluation contexts.}
Compiling components requires a wrapper to ensure that target contexts invoke the compiled component with the right runtime terms.
For example, by adding the dynamic type check we prevent contexts from binding $\trg{\langle 42,1729 \rangle}$ to $\trg{x}$, which is never valid for $\mmlAs$ components.

\myfig{
  \begin{center}
    \judgbox{\tospecificevt[_{\trg{\bullet}}]{\event} = \trg{\event}}{,,Filter an $\mmlAt$ event.''}
    %
    \typerule{trg-filter-context}{
      \trg{\event_b} = \trg{\lightning} \vee
      \trg{\event_b} = \trg{Alloc\ \loc\ n} \vee 
      \trg{\event_b} = \trg{Dealloc\ \loc} \vee\\
      \trg{\event_b} = \trg{Get\ \loc\ n} \vee
      \trg{\event_b} = \trg{Set\ \loc\ n\ m} \vee\\
      \trg{\event_b} = \trg{Call\ \emptyset\ foo\ n} \vee
      \trg{\event_b} = \trg{Ret\ \emptyset\ n} 
    }{
      \tospecificevt[_{\trg{\bullet}}]{\event_b;\ctx} = \trg{\emptyevent}
    }{trg-filter-context}
    %
    \typerule{trg-filter-unimportant}{
    }{
      \tospecificevt[_{\trg{\bullet}}]{\emptyevent;\sandboxtag} = \trg{\emptyevent}
    }{trg-filter-unimportant}
    %
    \typerule{trg-filter-comp-start}{
    }{
      \tospecificevt[_{\trg{\bullet}}]{Start;\comp} = \trg{\emptyevent}
    }{trg-filter-comp-start}
    %
    \typerule{trg-filter-comp-alloc}{
    }{
      \tospecificevt[_{\trg{\bullet}}]{Alloc\ \loc\ n;\comp} = \trg{Alloc\ \loc\ n}
    }{trg-filter-comp-alloc}
    %
    \typerule{trg-filter-comp-dealloc}{
    }{
      \tospecificevt[_{\trg{\bullet}}]{Dealloc\ \loc;\comp} = \trg{Dealloc\ \loc}
    }{trg-filter-comp-dealloc}
    %
    \typerule{trg-filter-comp-get}{
    }{
      \tospecificevt[_{\trg{\bullet}}]{Get\ \loc\ n;\comp} = \trg{Get\ \loc\ n}
    }{trg-filter-comp-get}
    %
    \typerule{trg-filter-comp-set}{
    }{
      \tospecificevt[_{\trg{\bullet}}]{Set\ \loc\ n\ \valueexpr;\comp} = \trg{Set\ \loc\ n\ \valueexpr}
    }{trg-filter-comp-set}
    %
    \typerule{trg-filter-comp-call}{
    }{
      \tospecificevt[_{\trg{\bullet}}]{Call\ \comm\ foo\ \valueexpr;\sandboxtag} = \trg{Call\ \comm\ foo\ \valueexpr;\sandboxtag}
    }{trg-filter-comp-call}
    %
    \typerule{trg-filter-comp-ret}{
    }{
      \tospecificevt[_{\trg{\bullet}}]{Ret\ \comm\ \valueexpr;\sandboxtag} = \trg{Ret\ \comm\ \valueexpr;\sandboxtag}
    }{trg-filter-comp-ret}
    %
    \typerule{trg-filter-abort}{
    }{
      \tospecificevt[_{\trg{\bullet}}]{\lightning;\sandboxtag} = \trg{\lightning}
    }{trg-filter-abort}
    %
    %
    \judgbox{\tospecificevt[^*_{\trg{\bullet}}]{\trace} = \trg{\trace'}}{,,Filter an $\mmlAt$ trace.''}
    %
    \typerule{trg-filter-empty}{
    }{
      \tospecificevt[^*_{\trg{\bullet}}]{\hole{\cdot}} = \trg{\hole{\cdot}}
    }{trg-filter-empty}
    %
    \typerule{trg-filter-cons-relevant}{
      \tospecificevt[_{\trg{\bullet}}]{\event} = \trg{\event} \not= \trg{\emptyevent} &
      \tospecificevt[^*_{\trg{\bullet}}]{\trace} = \trg{\trace}
    }{
      \tospecificevt[^*_{\trg{\bullet}}]{\event\cdot\trace} = \trg{\event}\cdot\trg{\trace}
    }{trg-filter-cons-relevant}
    %
    \typerule{trg-filter-cons-relevant}{
      \tospecificevt[_{\trg{\bullet}}]{\event} = \trg{\emptyevent} &
      \tospecificevt[^*_{\trg{\bullet}}]{\trace} = \trg{\trace}
    }{
      \tospecificevt[^*_{\trg{\bullet}}]{\event\cdot\trace} = \trg{\trace}
    }{trg-filter-cons}
  \end{center}
}{wt-events-filter-for-BT}{Filtering of $\mmlAt$ events, getting rid of unimportant ones, for backtranslation.}

\myfig{
  \begin{center}
    \judgbox{\src{\sandboxtag}=\trg{\sandboxtag}}{,,Equality of sandboxtags between $\mmlAs$ and $\mmlAt$.''}\\
    %
    \typerule{sandboxtag-ctx}{
    }{
      \src{\ctx}=\trg{\ctx}
    }{sandboxtag-eq-ctx}
    %
    \typerule{sandboxtag-comp}{
    }{
      \src{\comp}=\trg{\comp}
    }{sandboxtag-eq-comp}
    \\
    %
    \judgbox{\delta(\src{\loc})=\trg{\loc}}{,,Map from $\mmlAs$ locations $\src{\loc}$ to $\mmlAt$ locations $\trg{\loc}$.''} \\
    \judgbox{\xlangtraceeq{\trace}{\trace}}{,,The $\mmlAs$ trace $\src{\trace}$ describes the same actions as $\mmlAt$ trace $\trg{\trace}$. Any action in\\$\src{X}$ is ignored, these are generated by the backtranslation wrapper.''} \\
    \typerule{empty-trace-eq}{
    }{
      \xlangtraceeq{\hole{\cdot}}{\hole{\cdot}}
    }{empty-trace-eq}
    %
    \typerule{cons-trace-eq}{
      \src{\event_{b}}\notin\src{X} &
      \src{\sandboxtag}=\trg{\sandboxtag} &
      \xlangeventeq{\event_{b}}{\event_{b}} &
      \xlangtraceeq{\trace}{\trace}
    }{
      \xlangtraceeq{\event_{b};\sandboxtag\cdot\trace}{\event_{b};\sandboxtag\cdot\trace}
    }{cons-trace-eq}
    %
    \typerule{ignore-cons-trace-eq}{
      \src{\event_{b}}\in\src{X} &
      \xlangtraceeq{\trace}{\trace}
    }{
      \xlangtraceeq{\event_{b};\sandboxtag\cdot\trace}{\trace}
    }{ignore-cons-trace-eq}
    %
    \judgbox{\xlangeventeq{\event_{b}}{\event_{b}}}{,,The $\mmlAs$ event $\src{\event_b}$ describes the same action as $\mmlAt$ event $\trg{\event_b}$.''} \\
    %
    \typerule{start-event-eq}{
    }{
      \xlangeventeq{Start}{Start}
    }{start-event-eq}
    %
    \typerule{end-event-eq}{
      \src{\valueexpr} = \mmlAmmlAtbackv{\valueexpr}
    }{
      \xlangeventeq{End\ \valueexpr}{End\ \valueexpr}
    }{end-event-eq}
    %
    \typerule{alloc-event-eq}{
      \mmlAmmlAtcomp{n}=\trg{n} &
      \delta(\src{\loc})=\trg{\loc}
    }{
      \xlangeventeq{Alloc\ \loc\ n}{Alloc\ \loc\ n}
    }{alloc-event-eq}
    %
    \typerule{dealloc-event-eq}{
      \delta(\src{\loc})=\trg{\loc}
    }{
      \xlangeventeq{Dealloc\ \loc}{Dealloc\ \loc}
    }{dealloc-event-eq}
    %
    \typerule{get-event-eq}{
      \mmlAmmlAtcomp{n} = \trg{n} &
      \delta(\src{\loc}) = \trg{\loc}
    }{
      \xlangeventeq{Get\ \loc\ n}{Get\ \loc\ n}
    }{get-event-eq}
    %
    \typerule{set-event-eq}{
      \mmlAmmlAtcomp{n} = \trg{n} &
      \mmlAmmlAtcomp{\valueexpr} = \trg{\valueexpr} &
      \delta(\src{\loc}) = \trg{\loc}
    }{
      \xlangeventeq{Set\ \loc\ n\ \valueexpr}{Set\ \loc\ n\ \valueexpr}
    }{set-event-eq}
    %
    \typerule{call-event-eq}{
      \mmlAmmlAtcomp{n} = \trg{n} &
      \mmlAmmlAtcomp{foo} = \trg{foo} &
      \src{\comm} = \trg{\comm}
    }{
      \xlangeventeq{Call\ \comm\ foo\ n}{Call\ \comm\ foo\ n}
    }{call-event-eq}
    %
    \typerule{ret-event-eq}{
      \mmlAmmlAtcomp{n} = \trg{n} &
      \src{\comm} = \trg{\comm}
    }{
      \xlangeventeq{Ret\ \comm\ n}{Ret\ \comm\ n}
    }{ret-event-eq}
    %
    \typerule{$\src{\emptyevent}$-event-eq}{
    }{
      \xlangeventeq{\emptyevent}{\emptyevent}
    }{emptyevent-event-eq}
    %
    \typerule{$\src{\lightning}$-event-eq}{
    }{
      \xlangeventeq{\lightning}{\lightning}
    }{abort-event-eq}
    $\;$\\
    %
    \judgbox{\src{\comm} = \trg{\comm}}{,,Communications are equal.''} \\
    %
    \typerule{$\src{\ctxtocomp}=\trg{\ctxtocomp}$}{
    }{
      \src{\ctxtocomp}=\trg{\ctxtocomp}
    }{sctxtocomp-eq-tctxtocomp}
    %
    \typerule{$\src{\comptoctx}=\trg{\comptoctx}$}{
    }{
      \src{\comptoctx}=\trg{\comptoctx}
    }{scomptoctx-eq-tcomptoctx}
    %
    \typerule{$\src{\nocomm}=\trg{\nocomm}$}{
    }{
      \src{\nocomm}=\trg{\nocomm}
    }{snocomm-eq-tnocomm}
  \end{center}
}{tms-pres-trace-relation}{Trace Relation from $\mmlAs$ to $\mmlAt$.}

\myfig{
  \begin{center}
    \judgbox{\delta(\src{\loc})=\trg{\loc}}{,,The $\mmlAs$ memory location $\src{\loc}$ corresponds to\\the $\mmlAt$ memory location $\trg{\loc}$.''} \\
    \judgbox{\xlangstateeq{\Omega}{\Omega}}{,,The $\mmlAs$ state $\configs$ agrees with $\mmlAt$ state $\configt$. $\src{L}$ contains locations introduced\\by the backtranslation wrapper, which are subsequently ignored.''} \\
    %
    \typerule{state-eq}{
      \src{\Omega}=\src{\cfstate;\sandboxtag;\memstate} &
      \trg{\Omega}=\trg{\cfstate;\sandboxtag;\memstate} &
      \src{\sandboxtag} = \trg{\sandboxtag} \\
      \xlangstateeq[]{\cfstate}{\cfstate} &
      \xlangstateeq{\memstate}{\memstate}
    }{
      \xlangstateeq{\Omega}{\Omega}
    }{state-eq}
    %
    \typerule{abort-state-eq}{
    }{
      \xlangstateeq{\lightning}{\lightning}
    }{abort-eq}
    %
    \judgbox{\xlangstateeq{\memstate}{\memstate}}{,,The $\mmlAs$ memory-state $\src{\memstate}$ agrees with $\mmlAt$ one $\trg{\memstate}$. $\src{L}$ contains locations\\introduced by the backtranslation wrapper.''}\\
    %
    \typerule{empty-memstate-eq}{
    }{
      \xlangstateeq{\hole{\cdot};\hole{\cdot};\hole{\cdot}}{\hole{\cdot};\hole{\cdot};\hole{\cdot}}
    }{empty-memstate-eq}
    %
    \typerule{comp-cons-memstate-eq}{
      \src{\loc}\not\in\src{L} &
      \src{n}=\trg{n} &
      \src{\poison}=\trg{\poison} &
      \delta\left(\src{\loc}\right)=\trg{\loc} \\
      \src{\loc},\src{n}\vdash_{\delta}\src{H^{\comp}}\approx\trg{H^{\comp}} &
      \xlangstateeq{H^{\ctx};H^{\comp};\Delta}{H^{\ctx};H^{\comp};\Delta_{1},\Delta_{2}}
    }{
      \xlangstateeq{H^{\ctx};H^{\comp};x\mapsto(\loc;\comp;\poison;n),\Delta}{H^{\ctx};H^{\comp};\Delta_{1},x\mapsto(\loc;\comp;\poison;n),\Delta_{2}}
    }{comp-cons-memstate-eq}
    %
    \typerule{ctx-cons-memstate-eq}{
      \src{\loc}\not\in\src{L} &
      \xlangstateeq{H^{\ctx};H^{\comp};\Delta}{H^{\ctx};H^{\comp};\Delta}
    }{
      \xlangstateeq{H^{\ctx};H^{\comp};x\mapsto(\loc;\ctx;\poison;n),\Delta}{H^{\ctx};H^{\comp};\Delta}
    }{ctx-cons-memstate-eq}
    %
    \typerule{whatever-cons-memstate-eq}{
      \src{\loc}\in\src{L} &
      \xlangstateeq{H^{\ctx};H^{\comp};\Delta}{H^{\ctx};H^{\comp};\Delta}
    }{
      \xlangstateeq{H^{\ctx};H^{\comp};x\mapsto(\loc;\sandboxtag;\poison;n),\Delta}{H^{\ctx};H^{\comp};\Delta}
    }{whatever-cons-memstate-eq}
    %
    %
    \judgbox{\src{\loc},\src{n}\vdash_{\delta}\src{H^{\comp}}\approx\trg{H^{\comp}}}{,,The heaps $\src{H^{\comp}}$ and $\trg{H^{\comp}}$ are related at $\src{\loc}$ for\\$\src{n}$ memory cells.''}
    %
    \typerule{heap-related}{
      \mmlAmmlAtcomp{n}=\trg{n} &
      \delta(\src{\loc}) = \trg{\loc} \\
      \forall \src{0}\le\src{m}<\src{n},\ \trg{0}\le\trg{m}<\trg{n},\src{H^{\comp}}\left(\src{\loc} + \src{m}\right)=\trg{H^{\comp}}\left(\trg{\loc} + \trg{m}\right)
    }{
      \src{\loc},\src{n}\vdash_{\delta}\src{H^{\comp}}\approx\trg{H^{\comp}}
    }{heap-related}
    %
    \judgbox{\xlangstateeq[]{\cfstate}{\cfstate}}{,,The $\mmlAs$ control-flow-state $\src{\cfstate}$ agrees with $\mmlAt$ one $\trg{\cfstate}$.''} \\
    %
    \typerule{cfstate-eq}{
      \src{\cfstate}=\src{\commlib;\library;\kontstack} &
      \trg{\cfstate}=\trg{\commlib;\library;\kontstack} \\
      \xlangstateeq[]{\library}{\library} &
      \xlangstateeq[\src{\commlib}]{\kontstack}{\kontstack} &
      \trg{\commlib}=\mmlAmmlAtcomp{\commlib}
    }{
      \xlangstateeq[]{\cfstate}{\cfstate}
    }{cfstate-eq}$\;$\\
    %
    %
    \judgbox{\src{\poison}=\trg{\poison}}{,,$\mmlAs$ poison equals $\mmlAt$ one $\trg{\poison}$.''} \\
    %
    \typerule{$\poisoned$-equal}{
    }{
      \src{\poisoned}=\trg{\poisoned}
    }{poisoned-equal}
    %
    \typerule{$\poisonless$-equal}{
    }{
      \src{\poisonless}=\trg{\poisonless}
    }{poisonless-equal}
  \end{center}
}{tms-pres-state-relations-first}{State Relation from $\mmlAs$ to $\mmlAt$. This is meant to relate the states whenever we are ,,inside'' a component.}

\myfig{
  \begin{center}
    %
    \judgbox{\xlangstateeq[]{\library}{\library}}{,,The procedures of $\mmlAs$ agree with $\mmlAt$ ones.''} \\
    %
    \typerule{empty-commlib-lib-eq}{
    }{
      \xlangstateeq[]{\hole{\cdot}}{\library}
    }{empty-commlib-eq}
    %
    \typerule{cons-commlib-eq}{
      \mmlAmmlAtcomp{let\ foo\ x:\type_{\color{black}\lambda} := e} = \trg{let\ foo\ x := e} &
      \xlangstateeq[]{\library}{\library_1,\library_2}
    }{
      \xlangstateeq[]{(let\ foo\ x:\type_{\color{black}\lambda} := e),\library}{\library_1,(let\ foo\ x := e),\library_2}
    }{cons-commlib-eq}
    %
    %
    \judgbox{\xlangstateeq[\src{\commlib}]{\kontstack}{\kontstack}}{,,The stack of $\mmlAs$ continuations $\src{\kontstack}$ agrees with $\mmlAt$ one $\trg{\kontstack}$.\\Only checks $\src{foo}\in\src{\commlib}$''} \\
    %
    \typerule{empty-kontstack-eq}{
    }{
      \xlangstateeq[\src{\commlib}]{\hole{\cdot}}{\hole{\cdot}}
    }{empty-kontstack-eq}
    %
    \typerule{ign-cons-kontstack-eq}{
      \src{foo}\notin\src{\commlib} &
      \trg{foo}=\mmlAmmlAtcomp{foo} &
      \xlangstateeq[\src{\commlib}]{\kontstack}{\kontstack}
    }{
      \xlangstateeq[\src{\commlib}]{\kontstack}{(K;foo),\kontstack}
    }{ign-cons-kontstack-eq}
    %
    \typerule{cons-kontstack-eq}{
      \src{foo}\in\src{\commlib} &
      \src{foo}=\trg{foo} &
      \xlangstateeq[\src{\commlib}]{\kontstack}{\kontstack}
    }{
      \xlangstateeq[\src{\commlib}]{(K;foo),\kontstack}{(K;foo),\kontstack}
    }{cons-kontstack-eq}
  \end{center}
}{tms-pres-memstate-relations}{Memory-State Relations from $\mmlAs$ to $\mmlAt$.}

\myfig{
  \begin{center}
    \judgbox{\delta(\src{\loc})=\trg{\loc}}{,,The $\mmlAs$ memory location $\src{\loc}$ corresponds to\\the $\mmlAt$ memory location $\trg{\loc}$.''} \\
    \judgbox{\xlangbackstateeq{\Omega}{\Omega}}{,,The $\mmlAs$ state $\configs$ agrees with $\mmlAt$ state $\configt$. $\src{L}$ contains locations introduced\\by the backtranslation wrapper, which are subsequently ignored.''} \\
    %
    \typerule{state-qe}{
      \src{\Omega}=\src{\cfstate;\sandboxtag;\memstate} &
      \trg{\Omega}=\trg{\cfstate;\sandboxtag;\memstate} \\
      \xlangbackstateeq[]{\cfstate}{\cfstate} &
      \xlangbackstateeq{\memstate}{\memstate}
    }{
      \xlangbackstateeq{\Omega}{\Omega}
    }{state-qe}
    %
    \typerule{abort-state-qe}{
    }{
      \xlangbackstateeq{\lightning}{\lightning}
    }{abort-qe}
    %
    \judgbox{\xlangbackstateeq{\memstate}{\memstate}}{,,The $\mmlAs$ memory-state $\src{\memstate}$ agrees with $\mmlAt$ one $\trg{\memstate}$. $\src{L}$ contains locations\\introduced by the backtranslation wrapper.''}\\
    %
    \typerule{memstate-qe}{
      \xlangstateeq{\memstate}{\memstate}
    }{
      \xlangbackstateeq{\memstate}{\memstate}
    }{memstate-qe}$\;$\\
    %
    %
    \judgbox{\xlangbackstateeq[]{\cfstate}{\cfstate}}{,,The $\mmlAs$ control-flow-state $\src{\cfstate}$ agrees with $\mmlAt$ one $\trg{\cfstate}$.''} \\
    %
    \typerule{cfstate-qe}{
      \xlangstateeq[]{\cfstate}{\cfstate}
    }{
      \xlangbackstateeq[]{\cfstate}{\cfstate}
    }{cfstate-qe}
  \end{center}
}{tms-pres-state-relations-second}{State Relation from $\mmlAt$ to $\mmlAs$. This is meant to relate the states whenever we are ,,inside'' a context.}

\begin{lemma}[Compiler Injective]\label{lem:injective:comp}
  If
  \begin{assumptions}
    \item $\mmlAmmlAtcomp{e}=\trg{e}$
    \item $\mmlAmmlAtcomp{e}=\trg{e'}$
  \end{assumptions}
  Then
  \begin{goals}
    \item $\trg{e}=\trg{e'}$
  \end{goals}
\end{lemma}
\begin{proof}
  Simple induction on $\src{e}$.
\end{proof}


\begin{lemma}[Substitution Commutes with $\mmlAmmlAtcomp{\bullet}$]\label{lem:subst:commute:comp}$\;$
  \begin{goals}
    \item $\mmlAmmlAtcomp{e[\valueexpr/x]}=\mmlAmmlAtcomp{e}\mmlAmmlAtcomp{[\valueexpr/x]}$
  \end{goals}
\end{lemma}
\begin{proof}
  Induction on $\src{e}$.
\end{proof}


\begin{lemma}[Step Forward Simulation]\label{lem:step:forwardsim}
  If
  \begin{assumptions}
    \item\label[ass]{asm:step:forwardsim:srcstep} $\exprevals{\Omega}{e\gamma}{\Omega'}{e'\gamma'}{\event}$
    \item $\xlangstateeq{\Omega}{\Omega}$
    \item\label[ass]{asm:step:forwardsim:srccheck} $\typechecks{}{\Omega\triangleright e\gamma}{\nat}$
  \end{assumptions}
  Then $\exists\delta'\ \trg{\Omega'}\ \trg{\event}$,
  \begin{goals}
    \item $\delta\subseteq\delta'$
    \item $\expreval{\trg{\Omega}}{\mmlAmmlAtcomp{e}\mmlAmmlAtcomp{\gamma}}{\trg{\Omega'}}{\mmlAmmlAtcomp{e'}\mmlAmmlAtcomp{\gamma'}}{\trg{\event}}$
    \item $\xlangeventeq[\delta']{\event}{\event}$
    \item $\xlangstateeq[\delta']{\Omega'}{\Omega'}$
  \end{goals}
\end{lemma}
\begin{proof}
  We proceed by induction on \Cref{asm:step:forwardsim:srcstep}.
  \begin{description}
    \case{tr:w-e-oplus}

      If
      \begin{passumptions}{H}
      \item $\src{\gamma}=\src{\gamma'}=\src{\hole{\cdot}}$
      \item\label[ass]{asm:step:forwardsim:case1:stateeq} $\xlangstateeq{\Omega}{\Omega}$
      \item $\typechecks{}{\Omega\triangleright n_1+n_2}{\nat}$
      \item\label[ass]{asm:step:forwardsim:case1:additioneq} $n_3=n_1+n_2$
      \end{passumptions}
      Then $\exists\delta'\ \trg{\Omega'}\ \trg{\event}$,
      \begin{goals}
        \item $\delta\subseteq\delta'$
        \item $\expreval{\trg{\Omega}}{\mmlAmmlAtcomp{n_1+n_2}}{\trg{\Omega'}}{\mmlAmmlAtcomp{n_3}}{\trg{\event}}$
        \item $\xlangeventeq{\varepsilon}{\event}$
        \item $\xlangstateeq{\Omega}{\Omega'}$
      \end{goals}

      Instantiate the goal with $\delta'=\delta,\ \trg{\Omega'}=\trg{\Omega}$, and $\trg{\event}=\trg{\varepsilon}$, so that what is left to prove is:
      \begin{goals}
        \item\label[goal]{goal:step:forwardsim:case1:deltasubset} $\delta\subseteq\delta$
        \item\label[goal]{goal:step:forwardsim:case1:eval} $\expreval{\trg{\Omega}}{\trg{n_1+n_2}}{\trg{\Omega}}{\trg{n_3}}{\trg{\varepsilon}}$
        \item\label[goal]{goal:step:forwardsim:case1:eventeq} $\xlangeventeq{\varepsilon}{\varepsilon}$
        \item\label[goal]{goal:step:forwardsim:case1:stateeq} $\xlangstateeq{\Omega}{\Omega}$
      \end{goals}

      \Cref{goal:step:forwardsim:case1:deltasubset} follows immediately from reflexivity of the subset relation.

      \Cref{goal:step:forwardsim:case1:eval} follows using \Cref{tr:tw-e-oplus} and \Cref{asm:step:forwardsim:case1:additioneq}.

      \Cref{goal:step:forwardsim:case1:eventeq} follows using \Cref{tr:emptyevent-event-eq}.

      \Cref{goal:step:forwardsim:case1:stateeq} follows using \Cref{asm:step:forwardsim:case1:stateeq}.

    \case{tr:w-e-delete}

      If
      \begin{passumptions}{H}
      \item $\src{\gamma}=\src{\gamma'}=\src{\hole{\cdot}}$
      \item\label[ass]{asm:step:forwardsim:case2:stateeq} $\xlangstateeq{\cfstate;\sandboxtag';H^{\ctx};H^{\comp};\Delta_1,x\mapsto(\loc;\sandboxtag;\poison;n),\Delta_2}{\trg{\Omega}}$
      \item $\typechecks{}{\cfstate;\sandboxtag';H^{\ctx};H^{\comp};\Delta_1,x\mapsto(\loc;\sandboxtag;\poison;n),\Delta_2\triangleright delete\ x}{\nat}$
      \end{passumptions}
      Then $\exists\delta'\ \trg{\Omega'}\ \trg{\event}$,
      \begin{goals}
        \item $\delta\subseteq\delta'$
        \item $\expreval{\trg{\Omega}}{\mmlAmmlAtcomp{delete\ x}}{\trg{\Omega'}}{\mmlAmmlAtcomp{0}}{\trg{\event}}$
        \item $\xlangeventeq{Dealloc\ \loc}{\event}$
        \item $\xlangstateeq{\cfstate;\sandboxtag';H^{\ctx};H^{\comp};\Delta_1,x\mapsto(\loc;\sandboxtag;\poisoned;n),\Delta_2}{\Omega'}$
      \end{goals}

      First note that $\trg{\Omega}=\trg{\cfstate;\sandboxtag';H^{\ctx};H^{\comp};\Delta_1,x\mapsto(\loc;\sandboxtag;\poison;n),\Delta_2}$, because of \Cref{asm:step:forwardsim:case2:stateeq}.

      Instantiate the goal with $\delta'=\delta,\ \trg{\Omega'}=\trg{\cfstate;\sandboxtag';H^{\ctx};H^{\comp};\Delta_1,x\mapsto(\loc;\sandboxtag;\poisoned;n),\Delta_2}$, and $\trg{\event}=\trg{Dealloc\ \loc;\sandboxtag'}$ so that what is left to prove is:
      \begin{goals}
      \item\label[goal]{goal:step:forwardsim:case2:deltasubset} $\delta\subseteq\delta$
      \item\label[goal]{goal:step:forwardsim:case2:eval} $\expreval{\trg{\cfstate;\sandboxtag';H^{\ctx};H^{\comp};\Delta_1,x\mapsto(\loc;\sandboxtag;\poison;n),\Delta_2}}{\trg{delete\ x}}{\trg{\cfstate;\sandboxtag';H^{\ctx};H^{\comp};\Delta_1,x\mapsto(\loc;\sandboxtag;\poisoned;n),\Delta_2}}{\trg{0}}{\trg{Dealloc\ \loc}}$
      \item\label[goal]{goal:step:forwardsim:case2:eventeq} $\xlangeventeq{Dealloc\ \loc;\sandboxtag'}{Dealloc\ \loc;\sandboxtag'}$
      \item\label[goal]{goal:step:forwardsim:case2:stateeq} $\xlangstateeq{\cfstate;\sandboxtag';H^{\ctx};H^{\comp};\Delta_1,x\mapsto(\loc;\sandboxtag;\poisoned;n),\Delta_2}{\cfstate;\sandboxtag';H^{\ctx};H^{\comp};\Delta_1,x\mapsto(\loc;\sandboxtag;\poisoned;n),\Delta_2}$
      \end{goals}

      \Cref{goal:step:forwardsim:case2:deltasubset} follows immediately from reflexivity of the subset relation.

      \Cref{goal:step:forwardsim:case2:eval} follows using \Cref{tr:tw-e-delete}.

      For \Cref{goal:step:forwardsim:case2:eventeq}, apply \Cref{tr:dealloc-event-eq}, what is left to show is $\delta(\src{\loc})=\trg{\loc}$.

      Similarily for \Cref{goal:step:forwardsim:case2:stateeq}, apply \Cref{tr:state-eq} and \Cref{tr:comp-cons-memstate-eq} or \Cref{tr:ctx-cons-memstate-eq} (depending on the shape of $\src{\sandboxtag}$) ,,suitably'' so that what is left to show is
      $\xlangstateeq{\cfstate}{\cfstate}$, $\xlangstateeq{H}{H}$, $\xlangstateeq{\Delta_1}{\Delta_1}$, $\xlangstateeq{\Delta_2}{\Delta_2}$, $\mmlAmmlAtcomp{x}=\trg{x}$, and, like in the previous case, $\delta(\src{\loc})=\trg{\loc}$.

      $\mmlAmmlAtcomp{x}=\trg{x}$ follows by definition of the compiler, anything else follows immediately by inverting \Cref{asm:step:forwardsim:case2:stateeq} ,,suitably''.

    \case{tr:w-e-get-in}
      Analogous to next case, up to nested case analysis.
    \case{tr:w-e-get-notin}

      If
      \begin{passumptions}{H}
      \item $\src{\gamma}=\src{\gamma'}=\src{\hole{\cdot}}$
      \item\label[ass]{asm:step:forwardsim:case3:stateeq} $\xlangstateeq{\cfstate;\sandboxtag';H^{\ctx};H^{\comp};\Delta_1,x\mapsto(\loc;\sandboxtag;\poison;n'),\Delta_2}{\Omega}$
      \item $\typechecks{}{\cfstate;\sandboxtag;H^{\ctx};H^{\comp};\Delta_1,x\mapsto(\loc;\sandboxtag;\poison;n'),\Delta_2\triangleright x[n]}{\nat}$
      \item\label[ass]{asm:step:forwardsim:case3:dom1} $\src{\loc}\in\operatorname{dom} \src{H^{\sandboxtag'}}\implies\src{v}=\src{H^{\sandboxtag'}}(\src{\loc+n})$
      \item\label[ass]{asm:step:forwardsim:case3:dom2} $\src{\loc}\not\in\operatorname{dom} \src{H^{\sandboxtag'}}\implies\src{v}=\src{1729}$
      \end{passumptions}
      Then $\exists\delta'\ \trg{\Omega'}\ \trg{\event}$,
      \begin{goals}
        \item $\delta\subseteq\delta'$
        \item $\expreval{\trg{\Omega}}{\mmlAmmlAtcomp{x[n]}}{\trg{\Omega'}}{\mmlAmmlAtcomp{v}}{\trg{\event}}$
        \item $\xlangeventeq{Get\ \loc\ n;\sandboxtag'}{\event}$
        \item $\xlangstateeq{\cfstate;\sandboxtag;H^{\ctx};H^{\comp};\Delta_1,x\mapsto(\loc;\sandboxtag;\poison;n'),\Delta_2}{\Omega'}$
      \end{goals}
      First note that $\trg{\Omega}=\trg{\cfstate;\sandboxtag;H^{\ctx};H^{\comp};\Delta_1,x\mapsto(\loc;\sandboxtag;\poison;n'),\Delta_2}$, because of \Cref{asm:step:forwardsim:case3:stateeq}.

      Instantiate the goal with $\delta'=\delta,\ \trg{\Omega'}=\trg{\cfstate;\sandboxtag;H^{\ctx};H^{\comp};\Delta_1,x\mapsto(\loc;\sandboxtag;\poison;n'),\Delta_2}$, and $\trg{\event}=\trg{Get\ \loc\ n;\sandboxtag'}$, so that what is left to prove is:
      \begin{goals}
      \item\label[goal]{goal:step:forwardsim:case3:deltasubset} $\delta\subseteq\delta$
        \setcounter{enumi}{2}
      \item\label[goal]{goal:step:forwardsim:case3:eventeq} $\xlangeventeq{Get\ \loc\ n;\sandboxtag'}{Get\ \loc\ n;\sandboxtag'}$
      \item\label[goal]{goal:step:forwardsim:case3:stateeq} $\xlangstateeq{\cfstate;\sandboxtag;H^{\ctx};H^{\comp};\Delta_1,x\mapsto(\loc;\sandboxtag;\poison;n'),\Delta_2}{\cfstate;\sandboxtag;H^{\ctx};H^{\comp};\Delta_1,x\mapsto(\loc;\sandboxtag;\poison;n'),\Delta_2}$
        \setcounter{enumi}{1}
      \item\label[goal]{goal:step:forwardsim:case3:eval} $\expreval{\trg{\cfstate;\sandboxtag;H^{\ctx};H^{\comp};\Delta_1,x\mapsto(\loc;\sandboxtag;\poison;n'),\Delta_2}}{\trg{x[n]}}{\trg{\cfstate;\sandboxtag;H^{\ctx};H^{\comp};\Delta_1,x\mapsto(\loc;\sandboxtag;\poison;n'),\Delta_2}}{\trg{v}}{\trg{Get\ \loc\ n;\sandboxtag'}}$
      \end{goals}

      \Cref{goal:step:forwardsim:case3:deltasubset} follows immediately from reflexivity of the subset relation.

      For \Cref{goal:step:forwardsim:case3:eventeq}, invert \Cref{asm:step:forwardsim:case3:stateeq} ,,suitably'' to obtain the assumption $\delta(\src{\loc})=\trg{\loc}$. The claim then follows by applying \Cref{tr:get-event-eq}.

      \Cref{goal:step:forwardsim:case3:stateeq} follows immediately from \Cref{asm:step:forwardsim:case3:stateeq}.

      \Cref{goal:step:forwardsim:case3:eval} is a bit technical. First apply \Cref{tr:tw-e-get-in,tr:tw-e-get-notin}, what is left to show is:
      \begin{goals}
        \setcounter{enumi}{4}
        \item $\trg{\loc}\in\operatorname{dom} \trg{H^{\sandboxtag'}}\implies\trg{v}=\trg{H^{\sandboxtag'}}(\trg{\loc+n})$
      \item $\trg{\loc}\not\in\operatorname{dom} \trg{H^{\sandboxtag'}}\implies\trg{v}=\trg{1729}$
      \end{goals}

      Now, note that $\src{\loc}\in\operatorname{dom}\src{H^{\sandboxtag'}}\Leftrightarrow\delta(\src{\loc})=\trg{\loc}\in\operatorname{dom}\trg{H^{\sandboxtag'}}$.
      We continue with a case distinction.
      \begin{description}
        \item \textbf{Case }$\src{\loc}\in\operatorname{dom}\src{H^{\sandboxtag'}}$\textbf{:}

          \Cref{asm:step:forwardsim:case3:dom1} gives $\src{v}=\src{H^{\sandboxtag'}}(\src{\loc+n})$.
          Since $\trg{v}=\mmlAmmlAtcomp{v}$, $\trg{v}=\mmlAmmlAtcomp{H^{\sandboxtag'}(\loc+n)}$.
          Using \Cref{asm:step:forwardsim:case3:stateeq}, $\trg{v}=\trg{H^{\sandboxtag'}(\loc+n)}$, done.

        \item \textbf{Case }$\src{\loc}\not\in\operatorname{dom}\src{H^{\sandboxtag'}}$\textbf{:}

          \Cref{asm:step:forwardsim:case3:dom2} gives $\src{v}=\src{1729}$.
          Since $\trg{v}=\mmlAmmlAtcomp{v}$, $\trg{v}=\mmlAmmlAtcomp{1729}=\trg{1729}$, done.
      \end{description}

    \case{tr:w-e-set-in}
      Analogous to next case, up to nested case analysis.
    \case{tr:w-e-set-notin}

      If
      \begin{passumptions}{H}
      \item $\src{\gamma}=\src{\gamma'}=\src{\hole{\cdot}}$
      \item\label[ass]{asm:step:forwardsim:case4:stateeq} $\xlangstateeq{\cfstate;\sandboxtag';H^{\ctx};H^{\comp};\Delta_1,x\mapsto(\loc;\sandboxtag;\poison;n'),\Delta_2}{\Omega}$
      \item $\typechecks{}{\cfstate;\sandboxtag';H^{\ctx};H^{\comp};\Delta_1,x\mapsto(\loc;\sandboxtag;\poison;n'),\Delta_2\triangleright x[n]}{\nat}$
      \item\label[ass]{asm:step:forwardsim:case4:update} $\src{H'}=\src{H}(\src{\loc+n}\mapsto\src{v})$
      \end{passumptions}
      Then $\exists\delta'\ \trg{\Omega'}\ \trg{\event}$,
      \begin{goals}
        \item $\delta\subseteq\delta'$
        \item $\expreval{\trg{\Omega}}{\mmlAmmlAtcomp{x[n]\leftarrow v}}{\trg{\Omega'}}{\mmlAmmlAtcomp{\valueexpr}}{\trg{\event}}$
        \item $\xlangeventeq{Set\ \loc\ n;\sandboxtag'}{\event}$
        \item $\xlangstateeq{\cfstate;\sandboxtag';H^{ctx};H^{\comp'};\Delta_1,x\mapsto(\loc;\sandboxtag;\poison;n'),\Delta_2}{\Omega'}$
      \end{goals}
      First note that $\trg{\Omega}=\trg{\cfstate;\sandboxtag';H^{\ctx};H^{\comp};\Delta_1,x\mapsto(\loc;\sandboxtag;\poison;n'),\Delta_2}$, because of \Cref{asm:step:forwardsim:case4:stateeq}.

      Instantiate the goal with $\delta'=\delta,\ \trg{\Omega'}=\trg{\cfstate;\sandboxtag';H^{\ctx};H^{\comp'};\Delta_1,x\mapsto(\loc;\sandboxtag;\poison;n'),\Delta_2}$, and $\trg{\event}=\trg{Set\ \loc\ n\ m}$, so that what is left to prove is:
      \begin{goals}
      \item\label[goal]{goal:step:forwardsim:case4:deltasubset} $\delta\subseteq\delta$
      \item\label[goal]{goal:step:forwardsim:case4:eval} $\expreval{\trg{\cfstate;\sandboxtag';H^{\ctx};H^{\comp};\Delta_1,x\mapsto(\loc;\sandboxtag;\poison;n'),\Delta_2}}{\trg{x[n]\leftarrow v}}{\trg{\cfstate;\sandboxtag;H^{\ctx};H^{\comp'};\Delta_1,x\mapsto(\loc;\sandboxtag;\poison;n'),\Delta_2}}{\trg{v}}{\trg{Set\ \loc\ n\ m;\sandboxtag'}}$
      \item\label[goal]{goal:step:forwardsim:case4:eventeq} $\xlangeventeq{Set\ \loc\ n\ m;\sandboxtag'}{Set\ \loc\ n\ m;\sandboxtag'}$
      \item\label[goal]{goal:step:forwardsim:case4:stateeq} $\xlangstateeq{\cfstate;\sandboxtag';H^{\ctx};H^{\comp'};\Delta_1,x\mapsto(\loc;\sandboxtag;\poison;n'),\Delta_2}{\cfstate;\sandboxtag';H^{\ctx};H^{\comp'};\Delta_1,x\mapsto(\loc;\sandboxtag;\poison;n'),\Delta_2}$
      \end{goals}

      \Cref{goal:step:forwardsim:case4:deltasubset} follows immediately from reflexivity of the subset relation.

      For \Cref{goal:step:forwardsim:case4:eval}, apply \Cref{tr:tw-e-set-ctx,tr:tw-e-set-comp} depending on the shape of $\trg{\sandboxtag}$.
      What is left to prove is $\trg{H^{\sandboxtag'}} = \trg{H^{\sandboxtag}}(\trg{\loc+n}\mapsto \trg{v})$.
      This follows by \Cref{asm:step:forwardsim:case4:stateeq}.%\MK{technical lemma: compatibility with update}

      Apply \Cref{tr:set-event-eq} on \Cref{goal:step:forwardsim:case4:eventeq}, what is left to show is $\mmlAmmlAtcomp{n}=\trg{n}$, which is trivial, and $\delta(\src{\loc})=\trg{\loc}$.
      The latter can be obtained by a ,,suitable'' inversion of \Cref{asm:step:forwardsim:case4:stateeq}.

      \Cref{goal:step:forwardsim:case4:stateeq} is assumed in \Cref{asm:step:forwardsim:case4:stateeq}.

      \case{tr:w-e-let-new}

      If
      \begin{passumptions}{H}
      \item $\src{\gamma}=\src{\hole{\cdot}}$
      \item $\src{\gamma'}=\src{[z/x]}$
      \item\label[ass]{asm:step:forwardsim:case5:stateeq} $\xlangstateeq{\cfstate;\sandboxtag';H^{\ctx};H^{\comp};\Delta}{\Omega}$
      \item $\typechecks{}{\cfstate;\sandboxtag';H^{\ctx};H^{\comp};\Delta\triangleright let\ x\ =\ new\ n\ in\ e}{\nat}$
      \item\label[ass]{asm:step:forwardsim:case5:update} $\src{H^{\sandboxtag'}}=\src{H^{\sandboxtag'}}\ll\src{n}$
      \end{passumptions}
      Then $\exists\delta'\ \trg{\Omega'}\ \trg{\event}$,
      \begin{goals}
        \item $\delta\subseteq\delta'$
        \item $\expreval{\trg{\Omega}}{\mmlAmmlAtcomp{let\ x\ =\ new\ n\ in\ e}}{\trg{\Omega'}}{\mmlAmmlAtcomp{e}\mmlAmmlAtcomp{[z/x]}}{\trg{\event}}$
        \item $\xlangeventeq{Alloc\ \loc\ n;\sandboxtag'}{\event}$
        \item $\xlangstateeq{\cfstate;\sandboxtag';H^{\ctx};H^{\comp'};z\mapsto(\loc;\sandboxtag;\poisonless;n),\Delta}{\Omega'}$
      \end{goals}
      First note that $\trg{\memstate}=\trg{H^{\ctx};H^{\comp};z\mapsto(\loc;\sandboxtag;\poisonless;n),\Delta}$, because of \Cref{asm:step:forwardsim:case5:stateeq}.

      Instantiate the goal with $\delta'=\delta\cup\left\{\src{\loc}\mapsto\trg{\loc}\right\},\ \trg{\Omega'}=\trg{\cfstate;\sandboxtag';H^{\ctx};H^{\comp};z\mapsto(\loc;\sandboxtag;\poisonless;n),\Delta}$, and $\trg{\event}=\trg{Alloc\ \loc\ n;\sandboxtag'}$, so that what is left to prove is:

      \begin{goals}
      \item\label[goal]{goal:step:forwardsim:case5:deltasubset} $\delta\subseteq\delta\cup\left\{\src{\loc}\mapsto\trg{\loc}\right\}$
      \item\label[goal]{goal:step:forwardsim:case5:eval} $\expreval{\trg{\cfstate;\sandboxtag';H^{\ctx};H^{\comp};\Delta}}{\trg{let\ x\ =\ new\ n\ in\ }\mmlAmmlAtcomp{e}}{\trg{\cfstate;\sandboxtag';H^{\ctx};H^{\comp'};z\mapsto(\loc;\sandboxtag;\poisonless;n),\Delta}}{\mmlAmmlAtcomp{e}\trg{[z/x]}}{\trg{Alloc\ \loc\ n;\sandboxtag'}}$
      \item\label[goal]{goal:step:forwardsim:case5:eventeq} $\xlangeventeq[\delta\cup\left\{\src{\loc}\mapsto\trg{\loc}\right\}]{Alloc\ \loc\ n;\sandboxtag'}{Alloc\ \loc\ n;\sandboxtag'}$
      \item\label[goal]{goal:step:forwardsim:case5:stateeq} $\xlangstateeq[\delta\cup\left\{\src{\loc}\mapsto\trg{\loc}\right\}]{\cfstate;\sandboxtag';H^{\ctx};H^{\comp'};z\mapsto(\loc;\sandboxtag;\poisonless;n),\Delta}{\cfstate;\sandboxtag';H^{\ctx};H^{\comp'};z\mapsto(\loc;\sandboxtag;\poisonless;n),\Delta}$
      \end{goals}

      \Cref{goal:step:forwardsim:case5:deltasubset} follows by rewriting it as $\forall x, x\in\delta\implies x\in\delta\vee x\in\left\{\src{\loc}\mapsto\trg{\loc}\right\}$, then just choose the left side of the disjunction.

      Apply \Cref{tr:tw-e-let-new-ctx,tr:tw-e-let-new-comp} depending on the shape of $\sandboxtag$ on \Cref{goal:step:forwardsim:case5:eval}, what is left to show is $\trg{H^{\sandboxtag}} = \trg{H^{\sandboxtag}} \ll \trg{n}$.
      This follows by \Cref{asm:step:forwardsim:case5:stateeq}.%\MK{technical lemma: compatibility with grow}

      Apply \Cref{tr:set-event-eq} on \Cref{goal:step:forwardsim:case5:eventeq}, what is left to show is $\mmlAmmlAtcomp{n}=\trg{n}$, follows immediately by definition of the compiler, and $(\delta\cup\left\{\src{\loc}\mapsto\trg{\loc}\right\})(\src{\loc})=\trg{\loc}$, which follows by definition.

      Apply \Cref{tr:state-eq,tr:ctx-cons-memstate-eq,tr:comp-cons-memstate-eq} depending on the shape of $\sandboxtag$ on \Cref{goal:step:forwardsim:case5:stateeq}, what is left to show is $\mmlAmmlAtcomp{x}=\trg{x}$, follows immediately by definition of the compiler, and $(\delta\cup\left\{\src{\loc}\mapsto\trg{\loc}\right\})(\src{\loc})=\trg{\loc}$, which follows by definition.

    \case{tr:w-e-abort}

      If
      \begin{passumptions}{H}
      \item $\src{\gamma}=\src{\gamma'}=\src{\hole{\cdot}}$
      \item\label[ass]{asm:step:forwardsim:case6:stateeq} $\xlangstateeq{\Omega}{\Omega}$
      \item\label[ass]{asm:step:forwardsim:case6:typechecks} $\typechecks{}{\Omega\triangleright abort()}{\nat}$
      \end{passumptions}
      Then $\exists\delta'\ \trg{\Omega'}\ \trg{\event}$,
      \begin{goals}
        \item $\delta\subseteq\delta'$
        \item $\expreval{\trg{\Omega}}{\mmlAmmlAtcomp{abort()}}{\trg{\Omega'}}{\mmlAmmlAtcomp{stuck}}{\trg{\event}}$
        \item $\xlangeventeq{\lightning;\sandboxtag}{\event}$
        \item $\xlangstateeq{\lightning}{\Omega'}$
      \end{goals}

          Instantiate the goal with $\delta'=\delta,\ \trg{\Omega'}=\trg{\lightning}$, and $\trg{\event}=\trg{\lightning;\sandboxtag}$.
          All goals go through easily.

    \case{tr:w-e-let-f}

      If
      \begin{passumptions}{H}
      \item $\src{\gamma}=\src{\hole{\cdot}}$
      \item $\src{\gamma'}=\src{[\valueexpr/x]}$
      \item\label[ass]{asm:step:forwardsim:case7:stateeq} $\xlangstateeq{\Omega}{\Omega}$
      \item $\typechecks{}{\Omega\triangleright let\ x\ = \valueexpr\ in\ e}{\nat}$
      \end{passumptions}
      Then $\exists\delta'\ \trg{\Omega'}\ \trg{\event}$,
      \begin{goals}
        \item $\delta\subseteq\delta'$
        \item $\expreval{\trg{\Omega}}{\mmlAmmlAtcomp{let\ x\ = \valueexpr\ in\ e}}{\trg{\Omega'}}{\mmlAmmlAtcomp{e}\mmlAmmlAtcomp{[\valueexpr/x]}}{\trg{\event}}$
        \item $\xlangeventeq{\varepsilon}{\event}$
        \item $\xlangstateeq{\Omega}{\Omega'}$
      \end{goals}

      Instantiate the goal with $\delta'=\delta,\ \trg{\Omega'}=\trg{\Omega}$, and $\trg{\event}=\trg{\varepsilon}$, so that what is left to prove is:

      \begin{goals}
        \item\label[goal]{goal:step:forwardsim:case7:deltasubset} $\delta\subseteq\delta$
        \item\label[goal]{goal:step:forwardsim:case7:eval} $\expreval{\trg{\Omega}}{\trg{let\ x\ = \valueexpr\ in\ }\mmlAmmlAtcomp{e}}{\trg{\Omega}}{\mmlAmmlAtcomp{e}\trg{[\valueexpr/x]}}{\trg{\varepsilon}}$
        \item\label[goal]{goal:step:forwardsim:case7:eventeq} $\xlangeventeq{\varepsilon}{\varepsilon}$
        \item\label[goal]{goal:step:forwardsim:case7:stateeq} $\xlangstateeq{\Omega}{\Omega}$
      \end{goals}

      \Cref{goal:step:forwardsim:case7:deltasubset} follows by reflexivity of the subset relation.

      \Cref{goal:step:forwardsim:case7:eval} follows by definition of \Cref{tr:tw-e-let-f}.

      \Cref{goal:step:forwardsim:case7:eventeq} follows by definition of \Cref{tr:emptyevent-event-eq}.

      \Cref{goal:step:forwardsim:case7:stateeq} follows by \Cref{asm:step:forwardsim:case7:stateeq}.

    \case{tr:w-e-if-true}

      If
      \begin{passumptions}{H}
      \item $\src{\gamma}=\src{\gamma'}=\src{\hole{\cdot}}$
      \item\label[ass]{asm:step:forwardsim:case9:stateeq} $\xlangstateeq{\Omega}{\Omega}$
      \item $\typechecks{}{\Omega\triangleright ifz\ 0\ then\ e_1\ else\ e_2}{\nat}$
      \end{passumptions}
      Then $\exists\delta'\ \trg{\Omega'}\ \trg{\event}$,
      \begin{goals}
        \item $\delta\subseteq\delta'$
        \item $\expreval{\trg{\Omega}}{\mmlAmmlAtcomp{ifz\ 0\ then\ e_1\ else\ e_2}}{\trg{\Omega'}}{\mmlAmmlAtcomp{e_1}}{\trg{\event}}$
        \item $\xlangeventeq{\varepsilon}{\event}$
        \item $\xlangstateeq{\Omega}{\Omega'}$
      \end{goals}

      Instantiate the goal with $\delta'=\delta,\ \trg{\Omega'}=\trg{\Omega}$, and $\trg{\event}=\trg{\varepsilon}$, so that what is left to prove is:

      \begin{goals}
        \item\label[goal]{goal:step:forwardsim:case9:deltasubset} $\delta\subseteq\delta$
        \item\label[goal]{goal:step:forwardsim:case9:eval} $\expreval{\trg{\Omega}}{\trg{ifz\ 0\ then\ }\mmlAmmlAtcomp{e_1}\trg{\ else\ }\mmlAmmlAtcomp{e_2}}{\trg{\Omega}}{\mmlAmmlAtcomp{e_1}}{\trg{\varepsilon}}$
        \item\label[goal]{goal:step:forwardsim:case9:eventeq} $\xlangeventeq{\varepsilon}{\varepsilon}$
        \item\label[goal]{goal:step:forwardsim:case9:stateeq} $\xlangstateeq{\Omega}{\Omega}$
      \end{goals}

      \Cref{goal:step:forwardsim:case9:deltasubset} follows by reflexivity of the subset relation.

      \Cref{goal:step:forwardsim:case9:eval} follows by definition of \Cref{tr:tw-e-if-true}.

      \Cref{goal:step:forwardsim:case9:eventeq} follows by definition of \Cref{tr:emptyevent-event-eq}.

      \Cref{goal:step:forwardsim:case9:stateeq} follows by \Cref{asm:step:forwardsim:case9:stateeq}.

    \case{tr:w-e-if-false}

      This case is completely analogous to the previous case, the only difference is the use of \Cref{tr:tw-e-if-false} instead of \Cref{tr:tw-e-if-true}.

  \end{description}
\end{proof}

\begin{lemma}[Ctx Step Forward Simulation]\label{lem:ctxstep:forwardsim}
  If
  \begin{assumptions}
    \item\label[ass]{asm:ctxstep:forwardsim:srcstep} $\execs[]{\Omega}{e\gamma}{\Omega'}{e'\gamma'}{\event}$
    \item\label[ass]{asm:ctxstep:forwardsim:staterel} $\xlangstateeq{\Omega}{\Omega}$
    \item\label[ass]{asm:ctxstep:forwardsim:typechecks} $\typechecks{}{\Omega\triangleright e\gamma}{\nat}$
  \end{assumptions}
  Then $\exists\delta'\ \trg{\Omega'}\ \trg{\event}$,
  \begin{goals}
    \item $\delta\subseteq\delta'$
    \item $\exec[]{\trg{\Omega}}{\mmlAmmlAtcomp{e\gamma}}{\trg{\Omega'}}{\mmlAmmlAtcomp{e'\gamma'}}{\trg{\event}}$
    \item $\xlangeventeq{\event}{\event}$
    \item $\xlangstateeq{\Omega'}{\Omega'}$
  \end{goals}
\end{lemma}
\begin{proof}
  Induction on \Cref{asm:ctxstep:forwardsim:srcstep}.
\end{proof}

\begin{lemma}[Forward Simulation]\label{lem:forwardsim}
  If
  \begin{assumptions}
    \item\label[ass]{asm:forwardsim:starstep} $\execs{\Omega}{e\gamma}{\Omega'}{\finalexpr\gamma'}{\trace}$
    \item\label[ass]{asm:forwardsim:staterel} $\xlangstateeq{\Omega}{\Omega}$
    \item\label[ass]{asm:forwardsim:typechecks} $\typechecks{}{\Omega\triangleright e\gamma}{\nat}$
  \end{assumptions}
  Then $\exists\delta'\ \trg{\Omega'}\ \trg{\trace}$,
  \begin{goals}
    \item $\delta\subseteq\delta'$
    \item $\exec{\trg{\Omega}}{\mmlAmmlAtcomp{e}\mmlAmmlAtcomp{\gamma}}{\trg{\Omega'}}{\mmlAmmlAtcomp{\finalexpr}\mmlAmmlAtcomp{\gamma'}}{\trg{\trace}}$
    \item $\xlangtraceeq[\delta']{\trace}{\trace}$
    \item $\xlangstateeq[\delta']{\Omega'}{\Omega'}$
  \end{goals}
\end{lemma}
\begin{proof}
  Induction on \Cref{asm:forwardsim:starstep}.
  \begin{description}
    \case{tr:ws-e-refl}
          Trivial. Witnesses are $\delta, \trg{\Omega}$, and $\trg{\hole{\cdot}}$, goals follow immediately by reflexivity of the respective relation.

    \case{tr:ws-e-trans-important}
      Very similar to next case.
    \case{tr:ws-e-trans-unimportant}
          \begin{passumptions}{H}
            \item\label[ass]{asm:forwardsim:ctxstep} $\execs[]{\Omega}{e\gamma}{\Omega_{0}}{e_0\gamma_{0}}{\event}$
            \item $\execs{\Omega_{0}}{e_0\gamma_{0}}{\Omega'}{\finalexpr\gamma'}{\trace}$
          \end{passumptions}
          With the inductive hypothesis: $\forall\delta_{\forall}\ \trg{\Omega_{\forall}}$,
          If
          \begin{passumptions}{\IH^{(as)}}
            \item $\xlangstateeq[\delta_{\forall}]{\Omega_{0}}{\Omega_{\forall}}$
            \item $\typechecks{}{\Omega_{0}\triangleright e_{0}\gamma_{0}}{\nat}$
          \end{passumptions}
          Then $\exists \delta_{\IH}\ \trg{\Omega_{\IH}}\ \trg{\trace[_{\IH}]},$
          \begin{passumptions}{\IH}
            \item $\delta_{\forall}\subseteq\delta_{\IH}$
            \item $\exec{\trg{\Omega_{\forall}}}{\mmlAmmlAtcomp{e_{0}}\mmlAmmlAtcomp{\gamma_{0}}}{\trg{\Omega_{{\IH}}}}{\mmlAmmlAtcomp{\finalexpr}\mmlAmmlAtcomp{\gamma'}}{\trg{\trace[_{{\IH}}]}}$
            \item\label[ass]{asm:forwardsim:justraceeq} $\xlangtraceeq[\delta_{\IH}]{\trace}{\trace[_{\IH}]}$
            \item $\xlangstateeq[\delta_{\IH}]{\Omega'}{\Omega_{\IH}}$
          \end{passumptions}

          Now apply \Thmref{lem:ctxstep:forwardsim} on \Cref{asm:forwardsim:ctxstep} using \Cref{asm:forwardsim:staterel,asm:forwardsim:typechecks},
          giving us witnesses $\delta_0\ \trg{\Omega_{0}}\ \trg{\event}$,
          \begin{passumptions}{F}
            \item\label[ass]{asm:forwardsim:deltasubset0} $\delta\subseteq\delta_{0}$
            \item\label[ass]{asm:forwardsim:thectxstep} $\exec[]{\trg{\Omega}}{\mmlAmmlAtcomp{e}\mmlAmmlAtcomp{\gamma}}{\trg{\Omega_{0}}}{\mmlAmmlAtcomp{e_{0}}\mmlAmmlAtcomp{\gamma_{0}}}{\trg{\event}}$
            \item\label[ass]{asm:forwardsim:eventeq} $\xlangeventeq[\delta_{0}]{\event}{\event}$
            \item\label[ass]{asm:forwardsim:stateeq0} $\xlangstateeq[\delta_{0}]{\Omega_{0}}{\Omega_{0}}$
          \end{passumptions}

          Apply \Thmref{lem:ctx-preservation} on \Cref{asm:forwardsim:ctxstep,asm:forwardsim:typechecks}:
          \begin{passumptions}{F}
            \setcounter{enumi}{4}
            \item\label[ass]{asm:forwardsim:e0typs} $\typechecks{}{\Omega_{0}\triangleright e_{0}\gamma_{0}}{\nat}$
          \end{passumptions}

          Instantiate the inductive hypothesis with $\delta_{\forall}=\delta_{0}$ and $\trg{\Omega_{\forall}}=\trg{\Omega_{0}}$, provide \Cref{asm:forwardsim:stateeq0} and \Cref{asm:forwardsim:e0typs}, and obtain witnesses
          $\delta_{\IH}, \trg{\Omega_{\IH}}$, and $\trg{\trace[_{\IH}]}$ such that:
          \begin{passumptions}{\IH'}
            \item\label[ass]{asm:forwardsim:deltasubset:IH} $\delta_{0}\subseteq\delta_{\IH}$
            \item\label[ass]{asm:forwardsim:steps} $\exec{\trg{\Omega_{0}}}{\mmlAmmlAtcomp{e_{0}}\mmlAmmlAtcomp{\gamma_{0}}}{\trg{\Omega_{{\IH}}}}{\mmlAmmlAtcomp{\finalexpr}\mmlAmmlAtcomp{\gamma'}}{\trg{\trace[_{{\IH}}]}}$
            \item $\xlangtraceeq[\delta_{\IH}]{\trace}{\trace[_{\IH}]}$
            \item $\xlangstateeq[\delta_{\IH}]{\Omega'}{\Omega_{\IH}}$
          \end{passumptions}

          Our goal looks as follows: $\exists \delta'\ \trg{\Omega'}\ \trg{\trace[']}$,
          \begin{goals}
            \item\label[goal]{goal:forwardsim:deltasubset} $\delta\subseteq\delta'$
            \item\label[goal]{goal:forwardsim:steps} $\exec{\trg{\Omega}}{\mmlAmmlAtcomp{e}}{\trg{\Omega'}}{\mmlAmmlAtcomp{\finalexpr}}{\trg{\trace}}$
            \item\label[goal]{goal:forwardsim:traceeq} $\xlangtraceeq{\event\cdot\trace}{\trace[']}$
            \item\label[goal]{goal:forwardsim:staterel} $\xlangstateeq{\Omega'}{\Omega'}$
          \end{goals}

          \begin{description}
            \item \textbf{Case $\src{\event}\not=\src{\varepsilon}$:}
                \begin{passumptions}{H}
                  \item\label[ass]{asm:forwardsim:evnoteps} $\src{a}\not=\src{\varepsilon}$
                \end{passumptions}
                Instantiate the goal with $\delta_{\IH}, \trg{\Omega_{\IH}}, \trg{\event\cdot\trace}$.
                Note that $\delta\subseteq\delta_{\IH}$ (\Cref{goal:forwardsim:deltasubset}) follows by transitivity using \Cref{asm:forwardsim:deltasubset0,asm:forwardsim:deltasubset:IH}.
                Similarily for \Cref{goal:forwardsim:staterel}.

                Apply \Cref{tr:wt-e-trans-important} on \Cref{goal:forwardsim:steps}. So, what is left to show is
                \begin{goals}
                  \setcounter{enumi}{2}
                  \item\label[goal]{goal:forwardsim:tracerel} $\xlangtraceeq{\event\cdot\trace}{\event\cdot\trace}$
                  \setcounter{enumi}{4}
                  \item\label[goal]{goal:forwardsim:noeps:ctxstep} $\exec[]{\trg{\Omega}}{\mmlAmmlAtcomp{e}}{\trg{\Omega_{0}}}{\mmlAmmlAtcomp{e_{0}}}{\trg{\event}}$
                  \item\label[goal]{goal:forwardsim:noeps:steps} $\exec{\trg{\Omega_{0}}}{\mmlAmmlAtcomp{e_{0}}}{\trg{\Omega_{\IH}}}{\mmlAmmlAtcomp{\finalexpr}}{\trg{\trace}}$
                \end{goals}
                \Cref{goal:forwardsim:tracerel} follows from \Cref{asm:forwardsim:justraceeq,asm:forwardsim:eventeq} using \Cref{tr:cons-trace-eq}.
                \Cref{goal:forwardsim:noeps:ctxstep} is proven by \Cref{asm:forwardsim:thectxstep}.
                \Cref{goal:forwardsim:noeps:steps} is proven by \Cref{asm:forwardsim:steps}.
            \item \textbf{Case $\src{\event}=\src{\varepsilon}$:}
                  Similar to the other case, but instantiate with $\trg{\trace[_{\IH}]}$ instead of $\trg{\event\cdot\trace[_{\IH}]}$ and use \Cref{tr:wt-e-trans-unimportant}
          \end{description}
  \end{description}
\end{proof}

\begin{lemma}[Different Reduction]\label{lem:differentreduction}
  If
  \begin{assumptions}
    \item\label[ass]{asm:differentreduction:nored} $\neg\left(\execs{\Omega}{e\gamma}{\Omega'}{\finalexpr}{\trace}\right)$
    \item\label[ass]{asm:differentreduction:red} $\execs{\Omega}{e\gamma}{\Omega'}{\finalexpr'}{\trace}$
  \end{assumptions}
  Then
  \begin{goals}
    \item $\src{\finalexpr}\not=\src{\finalexpr'}$
  \end{goals}
\end{lemma}
\begin{proof}
  Assume $\src{\finalexpr}=\src{\finalexpr'}$, apply \Cref{asm:differentreduction:nored} to the goal $\bot$, rewrite in the goal using $\src{\finalexpr}=\src{\finalexpr'}$ and solve the goal by \Cref{asm:differentreduction:red}.
\end{proof}

\begin{lemma}[Expression Correctness]\label{lem:expression:correctness}
  If
  \begin{assumptions}
  \item\label[ass]{asm:exprcorrect:exec1:trg} $\exec{\trg{\Omega}}{\mmlAmmlAtcomp{e}\mmlAmmlAtcomp{\gamma}}{\trg{\Omega'}}{\mmlAmmlAtcomp{\finalexpr}\mmlAmmlAtcomp{\gamma'}}{\trg{\trace}}$
  \item\label[ass]{asm:exprcorrect:stateeq} $\xlangstateeq{\Omega}{\Omega}$
  \item\label[ass]{asm:expr:corr:typechecks} $\typechecks{}{\Omega\triangleright e\gamma}{\nat}$
  \end{assumptions}
  Then $\exists \delta'\ \src{\Omega'}\ \src{\trace}$,
  \begin{goals}
  \item $\delta\subseteq\delta'$
  \item $\execs{\Omega}{e\gamma}{\Omega'}{\finalexpr\gamma'}{\trace}$
  \item $\xlangstateeq[\delta';\src{L}]{\Omega'}{\Omega'}$
  \item $\xlangtraceeq[\delta';\src{X}]{\trace}{\trace}$
  \end{goals}
\end{lemma}
\begin{proof}
  We prove this by contradiction. So, we get the assumption:
  \begin{passumptions}{I}
    \item\label[ass]{asm:exprcorr:toplevel} $\forall\delta'\ \src{\Omega'}\ \src{\trace},\delta'\subset\delta\vee\neg\left(\execs{\Omega}{e\gamma}{\Omega'}{\finalexpr\gamma'}{\trace}\right)\vee\xlangstateneq[\delta']{\Omega'}{\Omega'}\vee\xlangtraceneq[\delta']{\trace}{\trace}$
  \end{passumptions}
  and need to prove $\bot$.
  Apply \Thmref{lem:progress} on \Cref{asm:expr:corr:typechecks}, so:
  \begin{passumptions}{I}
    \setcounter{enumi}{1}
    \item\label[ass]{asm:exprcorr:progressor} $\exists\src{\Omega'}\ \src{\finalexpr}\ \src{\trace},\execs{\Omega}{e\gamma}{\Omega'}{\finalexpr}{\trace}$
  \end{passumptions}
    First extract the witnesses and obtain:
    \begin{passumptions}{H}
      \item\label[ass]{asm:exprcorr:ereduce} $\execs{\Omega}{e\gamma}{\Omega'}{\finalexpr'}{\trace}$
    \end{passumptions}

    Apply \Thmref{lem:forwardsim} to \Cref{asm:exprcorr:ereduce} with \Cref{asm:exprcorrect:stateeq,asm:expr:corr:typechecks} to get:
    \begin{passumptions}{F}
      \item\label[ass]{asm:exprcorrect:deltavsubset} $\delta\subseteq\delta_{v}$
      \item\label[ass]{asm:exprcorrect:exec2:trg} $\exec{\trg{\Omega}}{\mmlAmmlAtcomp{e}\mmlAmmlAtcomp{\gamma}}{\trg{\Omega_{v}'}}{\mmlAmmlAtcomp{\finalexpr'}}{\trg{\trace[_{v}]}}$
      \item\label[ass]{asm:exprcorrect:stateeq2} $\xlangstateeq[\delta_{v}]{\Omega'}{\Omega_{v}'}$
      \item\label[ass]{asm:exprcorrect:traceeq2} $\xlangtraceeq[\delta_{v}]{\trace}{\trace[_{v}]}$
    \end{passumptions}

    Use \Thmref{lem:determ:steps} on \Cref{asm:exprcorrect:exec1:trg,asm:exprcorrect:exec2:trg}, giving us:
    \begin{passumptions}{K}
      \item\label[ass]{asm:exprcorrect:compiledvalueseq} $\mmlAmmlAtcomp{\finalexpr}=\mmlAmmlAtcomp{\finalexpr'}$
      \item\label[ass]{asm:exprcorrect:stateequal} $\trg{\Omega'}=\trg{\Omega_{v}'}$
      \item\label[ass]{asm:exprcorrect:traceequal} $\trg{\trace}=\trg{\trace[_{v}]}$
    \end{passumptions}
    Rewrite using \Cref{asm:exprcorrect:stateequal} in \Cref{asm:exprcorrect:stateeq2}, similarily \Cref{asm:exprcorrect:traceequal} in \Cref{asm:exprcorrect:traceeq2}:
    \begin{passumptions}{F'}
      \setcounter{enumi}{2}
      \item\label[ass]{asm:exprcorrect:stateeq3} $\xlangstateeq[\delta_{v}]{\Omega'}{\Omega'}$
      \item\label[ass]{asm:exprcorrect:traceeq3} $\xlangtraceeq[\delta_{v}]{\trace}{\trace}$
    \end{passumptions}
    Specialize \Cref{asm:exprcorr:toplevel} for $\delta'=\delta_{v}$, $\src{\Omega'}=\src{\Omega'},$ and $\src{\trace}=\src{\trace}$.
    We proceed by case analysis:
    \begin{description}
      \item \textbf{Case $\neg\left(\delta\subseteq\delta_{v}\right)$:} Apply $\neg\left(\delta\subseteq\delta_{v}\right)$ on our goal $\bot$, then $\delta\subseteq\delta_{v}$ immediately follows from \Cref{asm:exprcorrect:deltavsubset}.

      \item \textbf{Case }$\neg\left(\execs{\Omega}{e\gamma}{\Omega'}{\finalexpr}{\trace}\right)$\textbf{:}
        Using \Cref{asm:exprcorr:ereduce} and the assumption $\neg\left(\execs{\Omega}{e\gamma}{\Omega'}{\finalexpr'}{\trace}\right)$, we conclude $\src{\finalexpr}\not=\src{\finalexpr'}$ using \Thmref{lem:differentreduction}.
        Apply \Thmref{lem:injective:comp} on \Cref{asm:exprcorrect:compiledvalueseq}, so $\src{\finalexpr}=\src{\finalexpr'}$, contradicting the above.

      \item \textbf{Case }$\xlangstateneq[\delta_{v}]{\Omega'}{\Omega'}$\textbf{:} Immediate contradiction with \Cref{asm:exprcorrect:stateeq3}.
      \item \textbf{Case }$\xlangtraceneq[\delta_{v}]{\trace}{\trace}$\textbf{:} Immediate contradiction with \Cref{asm:exprcorrect:traceeq3}.
    \end{description}
\end{proof}

\begin{lemma}[Component Correctness]\label{lem:component:correctness}
  If
  \begin{assumptions}
    \item $\execN{\trg{\Omega}}{\mmlAmmlAtcomp{e}}{\trg{\Omega'}}{\trg{K[return\ \valueexpr]}}{\trg{\trace}}$
    \item $\xlangstateeq{\Omega}{\Omega}$
    \item $\typechecks{}{\Omega\triangleright e}{\nat}$
  \end{assumptions}
  Then $\exists \delta'\ \src{\Omega'}\ \src{\trace}$
  \begin{goals}
    \item $\delta\subseteq\delta'$
    \item $\exectN{\Omega}{e}{\Omega'}{K[return\ \valueexpr]}{\trace}$
    \item $\xlangstateeq{\Omega'}{\Omega'}$
    \item $\xlangtraceeq{\trace}{\trace}$
  \end{goals}
\end{lemma}
\begin{incompleteproof}
\end{incompleteproof}


\subsubsection{Trace-based Backtranslation}

\myfig{
  \begin{center}
    \judgbox{\mmlAmmlAtbackv[]{\valueexpr} = \src{\valueexpr}}{,,Map an $\mmlAt$ value to an $\mmlAs$ value.''}$\;$\\
    \typerule{backtrans-value}{
    }{
      \mmlAmmlAtbackv[]{n} = \src{n}
    }{backtrans-value}
  \end{center}
}{backtrans-values}{Backtranslation of $\mmlAt$ values to $\mmlAs$ values.}

\myfig{
  \begin{center}
    \judgbox{\mmlAmmlAtbackdetail[]{\trace}=\src{e}}{,,Backtranslate a non-interface trace $\trg{\trace}$ to an $\mmlAs$ expression.''}
    %
    \typerule{backtrans-empty}{
    }{
      \mmlAmmlAtbackdetail[]{\hole{\cdot}}=\src{42}
    }{backtrans-empty}
    \typerule{backtrans-alloc}{
      \mmlAmmlAtbackdetail[]{\trg{\trace}}=\src{e}
    }{
      \mmlAmmlAtbackdetail[]{\trg{Alloc\ \loc\ s;\sandboxtag}\cdot\trg{\trace}}=\src{e}
    }{backtrans-alloc}
    \typerule{backtrans-dealloc}{
      \mmlAmmlAtbackdetail[]{\trg{\trace}}=\src{e}
    }{
      \mmlAmmlAtbackdetail[]{\trg{Dealloc\ \loc;\sandboxtag}\cdot\trg{\trace}}=\src{e}
    }{backtrans-dealloc}
    \typerule{backtrans-set}{
      \mmlAmmlAtbackdetail[]{\trg{\trace}}=\src{e}
    }{
      \mmlAmmlAtbackdetail[]{\trg{Set\ \loc\ n\ \valueexpr;\sandboxtag}\cdot\trg{\trace}}=\src{e}
    }{backtrans-set}
    \typerule{backtrans-get}{
      \mmlAmmlAtbackdetail[]{\trg{\trace}}=\src{e}
    }{
      \mmlAmmlAtbackdetail[]{\trg{Get\ \loc\ n;\sandboxtag}\cdot\trg{\trace}}=\src{e}
    }{backtrans-get}
    \typerule{backtrans-abort}{
    }{
      \mmlAmmlAtbackdetail[]{\lightning;\sandboxtag}=\src{abort()}
    }{backtrans-abort}
    %
  \end{center}
}{tms-pres-backtrans}{Trace-Based Backtranslation from $\mmlAt$ backtranslation-events to $\mmlAs$ terms.}
\myfig{
  \begin{center}
    \judgbox{\Game\left(\src{\loc}\right)=\src{x}}{,,Map an $\mmlAs$ location to an $\mmlAs$ identifier.''}
    \judgbox{\mmlAmmlAtbackcomptoctx[\Game;\delta;\trg{\overline{\loc}}]{\event}=\trg{\overline{\loc'}};\src{e}}{,,Given a \varmapbacktransds $\Game$, $\delta$, and $\trg{\overline{\loc}}$, yield\\another stack of locations $\trg{\overline{\loc'}}$, and an $\mmlAs$\\expression from target $\comptoctx$-interaction-event $\trg{\event}$.''}
    %
    \typerule{backtrans-start}{
    }{
      \mmlAmmlAtbackcomptoctx[\emptyset;\emptyset;\trg{\hole{\cdot}}]{\trg{Start}} = \trg{\hole{\cdot}};\src{42}
    }{backtrans-start}
    %
%   \typerule{backtrans-call-comptoctx}{
%   }{
%     \mmlAmmlAtbackcomptoctx[\Game;\delta;\trg{\overline{\loc}}]{\trg{Call\ \comptoctx\ foo\ \valueexpr}}=\trg{\overline{\loc}};\src{42}
%   }{backtrans-call-comptoctx}
    %
    \typerule{backtrans-ret-comptoctx}{
      \delta(\src{\loc})=\trg{\loc} &
      \src{z}=\Game(\src{\loc}) &
      \src{e}=\src{delete\ z}
    }{
      \mmlAmmlAtbackcomptoctx[\Game;\delta;\trg{\loc,\overline{\loc}}]{\trg{Ret\ \comptoctx\ \valueexpr}}=\trg{\overline{\loc}};\src{e;}\mmlAmmlAtbackv[]{\valueexpr}
    }{backtrans-ret-comptoctx}
    %
    %
    \judgbox{\mmlAmmlAtbackctxtocomp[\Game;\delta;\trg{\overline{\loc}}]{\event}=\Game';\delta';\trg{\overline{\loc'}};\src{e}}{,,Given a \varmapbacktransds $\Game$, $\delta$, and $\trg{\overline{\loc}}$, construct a \varmapbacktransds $\Game'$,\\ a $\delta'$, another stack of locations $\trg{\overline{\loc'}}$, and an $\mmlAs$\\expression from target $\ctxtocomp$-interaction-event $\trg{\event}$.''}
    %
    \typerule{backtrans-call-ctxtocomp}{
      \fresh{\Game,\delta}{\src{\loc}}&
      \fresh{\Game}{\src{z}}&
      \fresh{\delta}{\trg{\loc}}\\
      \Game_z=\Game\cup\{\src{\loc}\mapsto\src{z}\} &
      \delta'=\delta\cup\{\src{\loc}\mapsto\trg{\loc}\}\\
      \src{e}=\src{let\ z = new\ 42\ in\ call\ }\mmlAmmlAtbackdetail[]{foo}\ \mmlAmmlAtbackv[]{\valueexpr}
    }{
      \mmlAmmlAtbackctxtocomp[\Game;\delta;\trg{\overline{\loc}}]{\trg{Call\ \ctxtocomp\ foo\ \valueexpr}}=\Game_z;\delta';\trg{\loc,\overline{\loc}};\src{e}
    }{backtrans-call-ctxtocomp}
    %
%   \typerule{backtrans-ret-ctxtocomp}{
%     \fresh{\Game}{\src{x}}
%   }{
%     \mmlAmmlAtbackctxtocomp[\Game,\trg{\overline{\loc}}]{\trg{Ret\ \ctxtocomp\ \valueexpr}}=\Game,\trg{\overline{\loc}},\src{let\ x = new\ 1\ in\ delete\ x;return\ }\mmlAmmlAtbackv{\valueexpr}
%   }{backtrans-ret-ctxtocomp}
    %
    \typerule{backtrans-end-ctxtocomp}{
      \fresh{\Game,\delta}{\src{\loc}}&
      \fresh{\Game}{\src{z}}&
      \fresh{\delta}{\trg{\loc}}\\
      \Game_z=\Game\cup\{\src{\loc}\mapsto\src{z}\} &
      \delta'=\delta\cup\{\src{\loc}\mapsto\trg{\loc}\}\\
      \src{e}=\src{let\ z=new\ 42\ in\ delete\ z;return\ }\mmlAmmlAtbackv[]{\valueexpr}
    }{
      \mmlAmmlAtbackctxtocomp[\Game;\delta;\trg{\hole{\cdot}}]{\trg{End\ \valueexpr}}=\Game_z;\delta';\trg{\hole{\cdot}};\src{e}
    }{backtrans-end-ctxtocomp}
  \end{center}
}{tms-pres-backtrans-interact}{Backtranslation of interaction-events from $\mmlAt$ backtranslation-events to $\mmlAs$ terms.}
\myfig{
  \begin{center}
    \typerule{non-interface-$\trg{\varepsilon}$}{
    }{
      \vdash \trg{\varepsilon} \operatorname{non-int-\trg{\event}}
    }{non-interface-epsilon}
    %
    \typerule{non-interface-$\trg{Alloc}$}{
    }{
      \vdash \trg{Alloc\ \loc\ n;\sandboxtag} \operatorname{non-int-\trg{\event}}
    }{non-interface-alloc}
    %
    \typerule{non-interface-$\trg{Dealloc}$}{
    }{
      \vdash \trg{Dealloc\ \loc;\sandboxtag} \operatorname{non-int-\trg{\event}}
    }{non-interface-dealloc}
    %
    \typerule{non-interface-$\trg{Get}$}{
    }{
      \vdash \trg{Get\ \loc\ n;\sandboxtag} \operatorname{non-int-\trg{\event}}
    }{non-interface-get}
    %
    \typerule{non-interface-$\trg{Set}$}{
    }{
      \vdash \trg{Set\ \loc\ n;\sandboxtag} \operatorname{non-int-\trg{\event}}
    }{non-interface-set}
    %
    \typerule{non-interface-$\trg{\lightning}$}{
    }{
      \vdash \trg{\lightning;\sandboxtag} \operatorname{non-int-\trg{\event}}
    }{non-interface-abort}
    %
    \typerule{non-interface-trace-empty}{
    }{
      \vdash \trg{\hole{\cdot}} \operatorname{non-int-\trg{\trace}}
    }{non-interface-trace-empty}
    %
    \typerule{non-interface-trace-cons}{
      \vdash \trg{\event} \operatorname{non-int-\trg{\trace}} &
      \vdash \trg{\trace} \operatorname{non-int-\trg{\trace}}
    }{
      \vdash \trg{\event\cdot\trace} \operatorname{non-int-\trg{\trace}}
    }{non-interface-trace-cons}
  \end{center}
}{tms-non-interfacing-events}{Non-Interfacing events.}
\myfig{
  \begin{center}
    \judgbox{\mmlAmmlAtbacksubtop[\Game;\delta; \trg{\overline{\loc}}]{\event[_1]\cdot\trace\cdot\event[_2]}=\Game';\delta';\trg{\overline{\loc'}};\src{e_1};\src{e_2};\src{e_3}}{,,Given a \varmapbacktransds $\Game$, $\delta$, and $\trg{\overline{\loc}}$,\\construct a \varmapbacktransds $\Game'$, a $\delta'$, another\\stack of locations $\trg{\overline{\loc'}}$, and an $\mmlAs$\\ensemble of expressions from target-\\trace $\trg{\mstrace}$ which starts with a $\ctxtocomp$ event\\and ends in a $\comptoctx$.''}
    %
    \typerule{subtoplevel-backtrans}{
      \vdash \trg{\trace} \operatorname{non-int-\trg{\trace}}\\
      \mmlAmmlAtbackcomptoctx[\Game;\delta;\trg{\overline{\loc}}]{\trg{\event[_1]}}=\trg{\overline{\loc'}};\src{e_1} &
      \mmlAmmlAtbackdetail[]{\trg{\trace}}=\src{e_2} &
      \mmlAmmlAtbackctxtocomp[\Game;\delta;\trg{\overline{\loc'}}]{\trg{\event[_2]}}=\Game';\delta';\trg{\overline{\loc''}};\src{e_3} \\
    }{
      \mmlAmmlAtbacksubtop[\Game;\delta;\trg{\overline{\loc}}]{\trg{\event[_1]\cdot\trace\cdot\event[_2]}}=\Game';\delta';\trg{\overline{\loc''}}; \src{e_1}; \src{e_2}; \src{e_3}
    }{subtoplevel-backtrans}
    %
%   \typerule{subtoplevel-backtrans-indu}{
%     \trg{\trace[_1]}=\trg{\event[^A_1]\cdot\trace[^A]\cdot\event[^A_2]} &
%     \vdash\trg{\trace[^A]}\ \operatorname{non-int-\trg{\trace}} \\
%     \mmlAmmlAtbackcomptoctx[\Game,\trg{\overline{\loc}}]{\trg{\event[^A_1]}}=\Game',\trg{\overline{\loc'}},\src{e_1^A} &
%     \mmlAmmlAtbackdetail[\Game',\trg{\overline{\loc'}}]{\trg{\trace^A}}=\Game'',\trg{\overline{\loc''}}, \src{e_2^A} \\
%     \mmlAmmlAtbackctxtocomp[\Game'',\trg{\overline{\loc''}}]{\trg{\event[^A_2]}}=\Game''',\trg{\overline{\loc'''}},\src{let\ x_0=new\ n_0\ in\ e_3^A} \\
%     \mmlAmmlAtbacksubtop[\Game''',\trg{\overline{\loc'''}}]{\trace[_2]} = \Game'''',\trg{\overline{\loc''''}},\src{e_1^B},\src{e_2^B},\src{e_3^B} \\
%     \src{e^A}=\src{e^A_1;e^A_2;let\ x_0=new\ n_0\ in\ (e_3^A;e_1^B)}
%   }{
%     \mmlAmmlAtbacksubtop[\Game,\trg{\overline{\loc}}]{\trg{\trace[_1]\cdot\trace[_2]}}=\Game'''',\trg{\overline{\loc''''}},\src{e^A},\src{e^B_2},\src{e^B_3}
%   }{subtoplevel-backtrans-indu}
  \end{center}
}{tms-pres-subtop-backtrans}{Interaction-Trace-Based Backtranslation from $\mmlAt$ backtranslation-events to $\mmlAs$ terms.}

\myfig{
  \begin{center}
    \judgbox{\mmlAmmlAtback[\Game;\delta]{\mstrace} = \Game';\delta;\src{\library}}{,,Top-Level backtranslation of $\trg{\trace}$ to $\mmlAs$ library $\src{\library}$.''}
    %
    \typerule{backtrans-top-level}{
      \trg{\trace}=\trg{\trace[_0]\cdot\trace[^{comp}]\cdot\trace[_1]} &
      \vdash \trg{\trace[^{comp}]} \operatorname{non-int-\trg{\trace}} \\
      \trg{\trace[_0]}=\trg{Start\cdot\trace[_0']\cdot Call\ \ctxtocomp\ foo\ \valueexpr_1} &
      \trg{\trace[_1]}=\trg{Ret\ \comptoctx\ \valueexpr_2\cdot\trace[_0']\cdot End\ \valueexpr_3}\\
      \mmlAmmlAtbacksubtop[\emptyset;\emptyset;\trg{\hole{\cdot}}]{\color{black}\tospecificevt[^*_\trg{\bullet}]{\trace[_0]}} = \Game; \delta; \trg{\overline{\loc}}; \src{e_0};\src{e_0'};\src{let\ x_0 = new\ n_0\ in\ e_0''} \\
      \mmlAmmlAtbacksubtop[\Game;\delta;\trg{\overline{\loc}}]{\color{black}\tospecificevt[^*_\trg{\bullet}]{\trace[_1]}} = \Game'; \delta'; \trg{\hole{\cdot}}; \src{e_1};\src{e_1'};\src{e_1''} \\
      \src{e} = \src{e_0;e_0';let\ x_0 = new\ n_0\ in\ (e_0'';e_1);e_1';e_1''}
    }{
      \mmlAmmlAtback[\emptyset;\emptyset]{\trace} = \Game';\delta'; \src{let\ main\ x : \nat\to\nat := e, \hole{\cdot}}
    }{backtrans-top-level}
  \end{center}
}{tms-pres-top-level-backtrans}{Top-Level trace-based Backtranslation from $\mmlAt$ trace $\trg{\trace}$ to $\mmlAs$ context $\src{\library}$.}

\subsubsection{Proofs and Auxiliary Lemmas}

\begin{lemma}[$\theta^{*}_{\trg{\bullet}}$ distributive]\label{lem:trgfilter:distributive}$\;$\\
  \begin{goals}
    \item $\tospecificevt[^{*}_{\trg{\bullet}}]{\trace[_{1}]\cdot\trace[_{2}]}=\tospecificevt[^{*}_{\trg{\bullet}}]{\trace[_{1}]}\trg{\cdot}\tospecificevt[^{*}_{\trg{\bullet}}]{\trace[_{2}]}$
  \end{goals}
\end{lemma}
\begin{proof}
  Induction on $\trg{\trace[_{1}]}$.
\end{proof}

\begin{lemma}[$\theta_{\trg{\bullet}}$ invert concrete]\label{lem:trgfilter:invert:concrete}
  If
  \begin{goals}
    \item $\trg{\event}=\trg{\event_{b};\sandboxtag}$
    \item $\forall\trg{\loc}\ \trg{n}\ \trg{m},\trg{\sandboxtag}=\trg{\ctx}\implies\trg{event_{b}}\notin\{\trg{Alloc\ \loc\ n},\trg{Dealloc\ \loc},\trg{Get\ \loc\ n},\trg{Set\ \loc\ n\ m}\}$
  \end{goals}
  Then
  \begin{assumptions}
    \item $\tospecificevt{\event}=\trg{\event}$
  \end{assumptions}
\end{lemma}
\begin{proof}
  Induction on $\trg{\trace[_{b}]}$.
\end{proof}

\begin{lemma}[$\xlangstateeq{\commlib;\library;\hole{\cdot}}{\commlib;\library;\hole{\cdot}}$ holds]\label{lem:cfeq:refl}
  If
  \begin{assumptions}
    \item $\xlangstateeq{\library}{\library}$
  \end{assumptions}
  Then
  \begin{goals}
    \item $\xlangstateeq{\commlib;\library;\hole{\cdot}}{\commlib;\library;\hole{\cdot}}$
  \end{goals}
\end{lemma}
\begin{proof}
  Easy.
\end{proof}

\begin{lemma}[if $\src{\loc}\in\src{L}$, then $\src{\poison}$ doesn't matter]\label{lem:locinL:poisondoesntmatter}
  If
  \begin{assumptions}
    \item $\src{\memstate}=\src{H;\Delta_{1},x\mapsto(\loc;\sandboxtag;\poison;m),\Delta_{2}}$
    \item $\src{\memstate'}=\src{H;\Delta_{1},x\mapsto(\loc;\sandboxtag;\poison';m),\Delta_{2}}$
    \item $\src{\loc}\in\src{L}$
    \item $\xlangbackstateeq{\memstate}{\memstate}$
  \end{assumptions}
  Then
  \begin{goals}
    \item $\xlangbackstateeq{\memstate}{\memstate'}$
  \end{goals}
\end{lemma}
\begin{proof}
  Easy.
\end{proof}

\begin{lemma}[$\src{\loc}\in\operatorname{dom}\delta$ decomposes $\src{\Delta}$]\label{lem:deltadecomposeDelta}
  If
  \begin{assumptions}
    \item $\src{\loc}\in\operatorname{dom}\delta$
    \item $\xlangstateeq{H^{\ctx};H^{\comp};\Delta}{H^{\ctx};H^{\comp};\Delta}$
  \end{assumptions}
  Then $\exists \src{\Delta_{1}}\ \src{x}\ \src{\sandboxtag}\ \src{\poison}\ \src{m}\ \src{\Delta_{2}}$,
  \begin{goals}
    \item $\src{\Delta}=\src{\Delta_{1},x\mapsto(\loc;\sandboxtag;\poison;m),\Delta_{2}}$
  \end{goals}
\end{lemma}
\begin{proof}
  Easy.
\end{proof}

\begin{lemma}[MS-Location Generator]\label{lem:mslocgen}
  If
  \begin{assumptions}
    \item there is a set of locations $\src{L}$
  \end{assumptions}
  Then $\exists \delta_{MS}$
  \begin{goals}
    \item left-total, injective $\delta_{MS} : \src{L}\to\specificev{L}$
  \end{goals}
\end{lemma}
\begin{proof}
  This can be done by just generating fresh names $\specificev{\loc}$ and assign them to each $\src{\loc}\in\src{L}$.
\end{proof}

\begin{lemma}[Filters Equal]\label{lem:msfiltereq}
  If
  \begin{assumptions}
    \item $\forall\src{\loc}\ \trg{\loc},\delta(\src{\loc})=\trg{\loc}\implies \delta_{MS}(\src{\loc})=\delta_{MS}(\delta^{-1}(\trg{\loc}))$
    \item\label[ass]{asm:msfiltereq:eq} $\xlangtraceeq{\trace}{\trace}$
  \end{assumptions}
  Then
  \begin{goals}
    \item $\tospecificevs[^{*}_{\delta_{MS}}]{\trace}=\tospecificevt[^{*}_{\delta_{MS}'}]{\trace}$
  \end{goals}
\end{lemma}
\begin{proof}
  Induction on \Cref{asm:msfiltereq:eq}.
\end{proof}


\begin{lemma}[Backtranslation for Non-Interacting Traces is Well-Typed]\label{lem:expr:backtranslation:welltyped}
  If
  \begin{assumptions}
  \item\label[ass]{asm:nonintwt:nonint} $\vdash\trg{\trace} \operatorname{non-int-\trg{\trace}}$
  \item $\mmlAmmlAtbackdetail[]{\color{black}\tospecificevt[^{*}_{\trg{\bullet}}]{\trace}}=\src{e}$
  \end{assumptions}
  Then
  \begin{goals}
  \item $\typechecks{}{e}{\nat}$
  \end{goals}
\end{lemma}
\begin{proof}
  Note that $\tospecificevt[^{*}_{\trg{\bullet}}]{\trace}=\trg{\hole{\cdot}}\vee\tospecificevt[^{*}_{\trg{\bullet}}]{\trace}=\trg{\lightning}$ because of \Cref{asm:nonintwt:nonint}.
  So, the only left cases are $\src{e}=\src{42}$ and $\src{e}=\src{abort()}$.
  Both terms easily typecheck under an empty gamma.
\end{proof}

\begin{lemma}[Backtranslation for $\comptoctx$-Interacting Events is Well-Typed]\label{lem:expr:interact:comptoctx:backtranslation:welltyped}
  If
  \begin{assumptions}
  \item\label[ass]{asm:expr:interact:comptoctx:backtranslation:welltyped} $\mmlAmmlAtbackcomptoctx[\Game;\delta;\trg{\overline{\loc}}]{\color{black}\tospecificevt[^{*}_{\trg{\bullet}}]{\event}}=\src{e}$
  \end{assumptions}
  Then $\exists \src{\Gamma}$,
  \begin{goals}
  \item $\typechecks{\Gamma}{e}{\nat}$
  \end{goals}
\end{lemma}
\begin{proof}
  Inverting \Cref{asm:expr:interact:comptoctx:backtranslation:welltyped} yields two cases, so we continue with them:
  \begin{description}
    \item \textbf{Case }$\trg{\event} = \trg{Start}$\textbf{:}

    Here, $\src{e} = \src{42}$. Let $\src{\Gamma} = \src{\hole{\cdot}}$, it's easy to see that $\typechecks{}{42}{\nat}$ holds by \Cref{tr:t-nat}.

    \item \textbf{Case }$\trg{\event} = \trg{Ret\ \comptoctx\ \valueexpr}$\textbf{:}

    $\src{e} = \src{delete\ z;}\mmlAmmlAtbackv[]{\valueexpr}$, where $\delta(\src{\loc})=\trg{\loc}$, $\src{z} = \Game\left(\src{\loc}\right)$ and $\trg{\loc}$ is at the top of the stack of locations $\trg{\overline{\loc}}$.
    Choose $\src{\Gamma} = \src{z:\ptr,\hole{\cdot}}$, the typing follows using \Cref{tr:w-t-delete}.
  \end{description}
\end{proof}

\begin{lemma}[Backtranslation for Call-$\ctxtocomp$ is Well-Typed]\label{lem:expr:interact:call:comptoctx:backtranslation:welltyped}
  If
  \begin{assumptions}
  \item\label[ass]{asm:expr:interact:call:ctxtocomp:backtranslation:welltyped} $\mmlAmmlAtbackctxtocomp[\Game;\delta;\trg{\loc,\overline{\loc}}]{\color{black}\tospecificevt[^{*}_{\trg{\bullet}}]{Call\ \ctxtocomp\ foo\ \valueexpr}}=\Game';\delta;\trg{\loc,\overline{\loc'}};\src{e'}$
  \item $\delta(\src{\loc})=\trg{\loc}$
  \item $\src{z} = \Game'\left(\src{\loc}\right)$
  \item $\src{e}=\src{e';\ delete\ z;}\mmlAmmlAtbackv[]{\valueexpr'}$
  \item\label[ass]{asm:expr:interact:call:ctxtocomp:backtranslation:gamma} $\src{\Gamma}=\src{\Gamma_{1}, foo:\nat\to\nat ,\Gamma_{2}}$
  \end{assumptions}
  Then,
  \begin{goals}
  \item $\typechecks{\Gamma}{e}{\nat}$
  \end{goals}
\end{lemma}
\begin{proof}
  Invert \Cref{asm:expr:interact:call:ctxtocomp:backtranslation:welltyped} giving\\$\src{e}=\src{let\ z=new\ 42\ in\ call\ }\mmlAmmlAtbackv[]{foo}\ \mmlAmmlAtbackv[]{\valueexpr}\src{;\ delete\ z;}\mmlAmmlAtbackv[]{\valueexpr'}$.
  The claim follows using \Cref{tr:w-t-new,tr:w-t-delete} and \Cref{tr:t-let,tr:t-call}, where the latter uses \Cref{asm:expr:interact:call:ctxtocomp:backtranslation:gamma}.
\end{proof}

\begin{lemma}[Backtranslation for End-$\ctxtocomp$ is Well-Typed]\label{lem:expr:interact:end:ctxtocomp:backtranslation:welltyped}
  If
  \begin{assumptions}
  \item\label[ass]{asm:expr:interact:ret:ctxtocomp:backtranslation:welltyped} $\mmlAmmlAtbackctxtocomp[\Game;\delta;\trg{\hole{\cdot}}]{\color{black}\tospecificevt[^{*}_{\trg{\bullet}}]{End\ \valueexpr}}=\Game';\delta';\trg{\hole{\cdot}};\src{e}$
  \end{assumptions}
  Then,
  \begin{goals}
  \item $\typechecks{}{e}{\nat\to\bot}$
  \end{goals}
\end{lemma}
\begin{proof}
  Invert \Cref{asm:expr:interact:ret:ctxtocomp:backtranslation:welltyped} giving $\src{e}=\src{let\ z=new\ 42\ in\ delete\ z;\ return\ }\mmlAmmlAtbackv{\valueexpr}$, where $\fresh{\Game}{\src{z}}$.
  The claim follows using \Cref{tr:w-t-new,tr:w-t-delete,tr:t-return}.
\end{proof}

\begin{lemma}[Backtranslation is Well-Typed]\label{lem:backtranslation:welltyped}
  If
  \begin{assumptions}
  \item\label[ass]{asm:backtranslation:welltyped:backtrans} $\mmlAmmlAtback[\emptyset;\emptyset]{\trace}=\Game;\delta;\src{\library_{ctx}}$
  \item $\src{\library}=\src{\library_{ctx}\linker\library_{comp}}$
  \item $\Gammas\vdash\src{\library_{comp}}\operatorname{ok}$
  \end{assumptions}
  Then,
  \begin{goals}
  \item $\Gammas\vdash\src{\library}\operatorname{ok}$
  \end{goals}
\end{lemma}
\begin{proof}
  First up, note that $\Gammas\vdash\src{\library_{comp}}\operatorname{ok}$, so it suffices to check $\Gammas\vdash\src{\library_{ctx}}\operatorname{ok}$ by \Thmref{lem:typed:linking:recomposition}.
  By inverting \Cref{asm:backtranslation:welltyped:backtrans} we get $\trg{\trace}=\trg{\trace[_{0}]\cdot\trace[^{comp}]\cdot\trace[_{1}]}$ and\\$\src{e}=\src{e_{0};e_{0}';let\ x_{0}=new\ n_{0}\ in\ \left(e_{0}'';e_{1}\right);e_{1}';e_{1}''}$, where:
  \begin{passumptions}{H}
    \item $\vdash\trg{\trace[^{comp}]}\operatorname{non-int-\trg{\trace}}$
    \item\label[ass]{asm:backtranslation:welltyped:subtop1} $\mmlAmmlAtbackdetail[\emptyset;\emptyset;\trg{\hole{\cdot}}]{\color{black}\tospecificevt[^*_{\color{red}\bullet}]{\trace[_{0}]}}=\Game';\delta';\trg{\overline{\loc}};\src{e_{0}};\src{e_{0}'};\src{let\ x_{0} = new\ n_{0}\ in\ e_{0}''}$
    \item\label[ass]{asm:backtranslation:welltyped:subtop2} $\mmlAmmlAtbackdetail[\Game';\delta';\trg{\overline{\loc}}]{\color{black}\tospecificevt[^*_{\color{red}\bullet}]{\trace[_{1}]}}=\Game'';\delta'';\trg{\hole{\cdot}};\src{e_{1}};\src{e_{1}'};\src{e_{1}''}$.
  \end{passumptions}
  Inverting \Cref{asm:backtranslation:welltyped:subtop1,asm:backtranslation:welltyped:subtop2}, first take note that\\$\trg{\trace[_0]}=\trg{Start\cdot\trace[_0']\cdot Call\ \ctxtocomp\ foo\ \valueexpr_2}$ and $\trg{\trace[_1]}=\trg{Ret\ \ctxtocomp\ \valueexpr_3\cdot\trace[_1']\cdot End\ \valueexpr_4}$.
  Furthermore, $\src{e_{0}}=\src{42}$, $\mmlAmmlAtbackdetail[]{\trace[_{0}']}=\src{e_{0}'}$, and $\src{e_0''}=\src{let\ z=new\ 42\ in\ call\ foo\ n}$, where $\src{z}=\Game'\left(\src{\loc}\right)$ and $\delta(\src{\loc})=\trg{\loc}$, $\src{n}=\mmlAmmlAtbackv[]{\valueexpr_{2}}$, and $\mmlAmmlAtcomp{foo}=\trg{foo}$ with $\src{foo}\in\operatorname{dom}\src{\library_{comp}}$.
  Also, $\src{e_{1}}=\src{delete\ z}$, $\mmlAmmlAtbackdetail[]{\trace[_{1}']}=\src{e_{1}'}$, and $\src{e_{1}''}=\src{let\ x = new\ 42\ in\ delete\ x;return\ m}$, where $\src{m}=\mmlAmmlAtbackv[]{\valueexpr_{4}}$ and $\fresh{\Game''}{\src{x}}$.
  Therefore: $$\src{e}=\src{42;e_{0}';let\ z=new\ 42\ in\ \left(call\ foo\ n; delete\ z\right);e_{1}';let\ x=\ new\ 42\ in\ delete\ x;return\ m}$$

  This typechecks easily, making use of \Cref{tr:w-t-new,tr:w-t-delete} and \Cref{tr:t-let,tr:t-return,tr:t-call}, as well as \Thmref{lem:expr:backtranslation:welltyped}.
\end{proof}

\begin{lemma}[Backtranslation Correctness of $\trg{Start}$]\label{lem:exprbacktranslation:vbeg:wrapper:correct}
  If
  \begin{assumptions}
  \item $\trg{\library}=\trg{\library_{ctx}\linker}\mmlAmmlAtcomp{\library_{comp}}$
  \item $\trg{\commlib}=\mmlAmmlAtcomp{\commlib}=\operatorname{dom}\ \mmlAmmlAtcomp{\library_{comp}}$
  \item\label[ass]{asm:exprbacktranslation:vbeg:wrapper:correct:exect} $\exect[]{\commlib;\library;\hole{\cdot};\comp;\hole{\cdot};\hole{\cdot};\hole{\cdot}}{call\ main\ 0}{\commlib;\library;(\hole{\cdot}; main),\hole{\cdot};\ctx;\hole{\cdot};\hole{\cdot};\hole{\cdot}}{e_{main}[0/x]}{Start;\comp}$
  \item $\mmlAmmlAtbackcomptoctx[\emptyset;\emptyset;\trg{\hole{\cdot}}]{\color{black}\tospecificevt[_{\trg{\bullet}}]{Start}}=\trg{\hole{\cdot}};\src{42}$
  \item $\xlangstateeq[\emptyset;\src{\hole{\cdot}}]{\commlib;\library;\hole{\cdot};\comp;\hole{\cdot};\hole{\cdot};\hole{\cdot}}{\commlib;\library;\hole{\cdot};\comp;\hole{\cdot};\hole{\cdot};\hole{\cdot}}$
  \item $\src{\library}=\left\{\src{main}\mapsto\src{42;e_{main}}\right\}\src{\linker\library_{comp}}$
  \end{assumptions}
  Then $\exists n$
  \begin{goals}
  \item\label[goal]{goal:exprbacktranslation:vbeg:wrapper:correct:execs} $\execN[^{n}]{\src{\commlib;\library;\hole{\cdot};\comp;\hole{\cdot};\hole{\cdot};\hole{\cdot}}}{\src{call\ main\ 0}}{\src{\commlib;\library;(\hole{\cdot};main),\hole{\cdot};\ctx;\hole{\cdot};\hole{\cdot};\hole{\cdot}}}{\src{e_{main}[0/x]}}{\src{Start;\comp}}$
  \item\label[goal]{goal:exprbacktranslation:vbeg:wrapper:correct:backstateeq} $\xlangbackstateeq[\emptyset;\src{\hole{\cdot}}]{\commlib;\library;(\hole{\cdot};main),\hole{\cdot};\ctx;\hole{\cdot};\hole{\cdot};\hole{\cdot}}{\src{\commlib;\library;(\hole{\cdot};main),\hole{\cdot};\ctx;\hole{\cdot};\hole{\cdot}}}$
  \item\label[goal]{goal:exprbacktranslation:vbeg:wrapper:correct:eventeq} $\src{Start}\thexlangtraceeq[\emptyset;\src{\hole{\cdot}}]\trg{Start}$
  \end{goals}
\end{lemma}
\begin{proof}
  Note using \Cref{tr:w-e-ectx-call-main} we can easily conclude:
  \begin{passumptions}{H}
    \item\label[ass]{asm:exprbacktranslation:vbeg:wrapper:correct:execs0} $\execsn[^{1}]{\commlib;\library;\hole{\cdot};\comp;\hole{\cdot};\hole{\cdot};\hole{\cdot}}{call\ main\ 0}{\commlib;\library;(\hole{\cdot};main),\hole{\cdot};\ctx;\hole{\cdot};\hole{\cdot};\hole{\cdot}}{let\ \_=42\ in\ e_{main}[0/x]}{Start;\comp}$
  \end{passumptions}
  On \Cref{asm:exprbacktranslation:vbeg:wrapper:correct:execs0} apply \Cref{tr:w-e-ectx,tr:w-e-let-f}
  \begin{passumptions}{H}
    \setcounter{enumi}{1}
    \item\label[ass]{asm:exprbacktranslation:vbeg:wrapper:correct:execs1} $\execsn[^{1}]{\commlib;\library;(\hole{\cdot},main),\hole{\cdot};\ctx;\hole{\cdot};\hole{\cdot};\hole{\cdot}}{let\ \_{=42\ in\ e_{main}}[0/x]}{\commlib;\library;(\hole{\cdot},main),\hole{\cdot};\ctx;\hole{\cdot};\hole{\cdot};\hole{\cdot}}{e_{main}[0/x]}{\emptyevent}$
  \end{passumptions}
  Use \Cref{asm:exprbacktranslation:vbeg:wrapper:correct:execs0,asm:exprbacktranslation:vbeg:wrapper:correct:execs1} on \Cref{tr:wsn-e-trans-important,tr:wsn-e-refl}:
  \begin{passumptions}{H}
    \setcounter{enumi}{2}
    \item\label[ass]{asm:exprbacktranslation:vbeg:wrapper:correct:execs} $\execsn[^{2}]{\commlib;\library;\hole{\cdot};\comp;\hole{\cdot};\hole{\cdot};\hole{\cdot}}{call\ main\ 0}{\commlib;\library;(\hole{\cdot},main),\hole{\cdot};\ctx;\hole{\cdot};\hole{\cdot};\hole{\cdot}}{e_{main}[0/x]}{Start}$
  \end{passumptions}
  So, instantiating $n=2$ concludes \Cref{goal:exprbacktranslation:vbeg:wrapper:correct:execs}.

  \Cref{goal:exprbacktranslation:vbeg:wrapper:correct:backstateeq} by \Cref{tr:state-qe}, \Cref{tr:memstate-qe,tr:cfstate-qe} and \Cref{tr:empty-kontstack-eq,tr:empty-commlib-eq,tr:empty-memstate-eq}.
  \Cref{goal:exprbacktranslation:vbeg:wrapper:correct:eventeq} follow \Cref{tr:start-event-eq}.
\end{proof}

\begin{lemma}[Backtranslation Correctness of $\trg{Ret}$]\label{lem:exprbacktranslation:beg:wrapper:correct}
  If
  \begin{assumptions}
  \item $\trg{\Omega}=\trg{\commlib;\library;(K;foo),\kontstack;\comp;\memstate}$
  \item $\trg{\library}=\trg{\library_{ctx}\linker}\mmlAmmlAtcomp{\library_{comp}}$
  \item $\trg{\commlib}=\mmlAmmlAtcomp{\commlib}=\operatorname{dom}\ \mmlAmmlAtcomp{\library_{comp}}$
  \item\label[ass]{asm:exprbacktranslation:beg:wrapper:correct:exect} $\exect[]{\Omega}{K_{component}[return\ \valueexpr]}{\Omega'}{K[\valueexpr]}{Ret\ \comptoctx\ \valueexpr;\comp}$
  \item $\trg{K_{component}}=\mmlAmmlAtcomp{K_{component}}$
  \item $\mmlAmmlAtbackcomptoctx[\Game;\delta;\trg{\overline{\loc}}]{\color{black}\tospecificevt[_{\trg{\bullet}}]{Ret\ \comptoctx\ \valueexpr}}=\trg{\overline{\loc'}};\src{delete\ z;}\mmlAmmlAtbackv[]{\valueexpr}$
  \item\label[ass]{asm:exprbacktranslation:beg:wrapper:correct:staterel} $\xlangstateeq{\Omega}{\Omega}$
  \item\label[ass]{asm:exprbacktranslation:beg:wrapper:correct:omegas} $\src{\Omega}=\src{\commlib;\library;(K,foo),\kontstack;\comp;\memstate}$
  \item\label[ass]{asm:exprbacktranslation:beg:wrapper:correct:K} $\src{K}=\src{\hole{\cdot};delete\ z;K[}\mmlAmmlAtbackv[]{\valueexpr}\src{]}$
  \item $\src{\library}=\left\{\src{main}\mapsto\src{e_{main}}\right\}\src{\linker\library_{comp}}$
  \item\label[ass]{asm:exprbacktranslation:beg:wrapper:correct:delta} $\delta\left(\src{\loc}\right)=\trg{\loc}$
  \item\label[ass]{asm:exprbacktranslation:beg:wrapper:correct:z} $\src{z}=\Game(\src{\loc})$
  \item\label[ass]{asm:exprbacktranslation:beg:wrapper:correct:linL} $\src{\loc}\in\src{L}$
  \item\label[ass]{asm:exprbacktranslation:beg:wrapper:correct:fooinlibctx} $\trg{foo}\in\trg{\library_{\comp}}$
  \end{assumptions}
  then $\exists n\ \src{\trace}\ \src{\memstate'}$,
  \begin{goals}
  \item\label[goal]{goal:exprbacktranslation:beg:wrapper:correct:Xsubset} $\src{X'}=\src{X}\cup\{\src{Dealloc\ \loc}\}$
  \item\label[goal]{goal:exprbacktranslation:beg:wrapper:correct:execs} $\exec[n]{\src{\Omega}}{\src{K_{component}[return\ }\mmlAmmlAtbackv[]{\trg{\valueexpr}}\src{]}}{\src{\commlib;\library;\kontstack;\ctx;\memstate'}}{\src{K[}\mmlAmmlAtbackv[]{v}\src{]}}{\src{\trace}}$
  \item\label[goal]{goal:exprbacktranslation:beg:wrapper:correct:stateeq} $\xlangbackstateeq[\delta;\src{L}]{\Omega'}{\src{\commlib;\library;(\hole{\cdot};main),\hole{\cdot};\ctx;\memstate'}}$
  \item\label[goal]{goal:exprbacktranslation:beg:wrapper:correct:traceeq} $\src{\trace}\thexlangtraceeq[\delta;\src{X'}]\trg{Ret\ \comptoctx\ \valueexpr}$
  \end{goals}
\end{lemma}
\begin{proof}
  From \Cref{asm:exprbacktranslation:beg:wrapper:correct:delta} it is clear that:
  \begin{passumptions}{H}
    \item\label[ass]{asm:exprbacktranslation:beg:wrapper:correct:locindom} $\src{\loc}\in\operatorname{dom}\delta$
  \end{passumptions}
  Invert \Cref{asm:exprbacktranslation:beg:wrapper:correct:staterel}:
  \begin{passumptions}{H}
    \setcounter{enumi}{1}
    \item $\src{\Omega}=\src{\cfstate;\comp;\memstate}$
    \item $\trg{\Omega}=\trg{\cfstate;\comp;\memstate}$
    \item $\xlangstateeq[]{\cfstate}{\cfstate}$
    \item\label[ass]{asm:exprbacktranslation:beg:wrapper:correct:memstaterel} $\xlangstateeq{\memstate}{\memstate}$
  \end{passumptions}
  Decompose $\src{\memstate}$ into $\src{H^{\ctx};H^{\comp};\Delta}$.
  Make use of \Cref{asm:exprbacktranslation:beg:wrapper:correct:memstaterel,asm:exprbacktranslation:beg:wrapper:correct:locindom} with \Thmref{lem:deltadecomposeDelta}:
  \begin{passumptions}{H}
    \setcounter{enumi}{5}
    \item $\src{\Delta}=\src{\Delta_{1},x\mapsto(\loc;\sandboxtag';\poison;m),\Delta_{2}}$
  \end{passumptions}
  For the goals, instantiate the existentials with:
  \begin{passumptions}{E}
    \item $n=3$
    \item $\src{X'}=\src{X}\cup\left\{\src{Dealloc\ \loc}\right\}$
    \item $\src{\trace}=\src{Dealloc\ \loc\cdot Ret\ \comptoctx\ }\mmlAmmlAtbackv{\valueexpr}$
    \item $\src{\memstate'}=\src{H^{\ctx};H^{\comp};\Delta_{1},x\mapsto(\loc;\sandboxtag';\poisoned;m),\Delta_{2}}$
  \end{passumptions}
  \Cref{goal:exprbacktranslation:beg:wrapper:correct:Xsubset} is easy.
  Let $\src{n}=\mmlAmmlAtbackv[]{\valueexpr}$.
  For \Cref{goal:exprbacktranslation:beg:wrapper:correct:execs}, first note \Cref{asm:exprbacktranslation:beg:wrapper:correct:omegas}, use \Cref{tr:w-e-ectx-ret-notsame} and rewrite $\src{K}$ using \Cref{asm:exprbacktranslation:beg:wrapper:correct:K}:
  \begin{passumptions}{H}
    \setcounter{enumi}{6}
    \item\label[ass]{asm:exprbacktranslation:beg:wrapper:correct:execs0a} $\execs[]{\commlib;\library;(K;foo),\kontstack;\comp;\memstate}{K_{component}\hole{return\ n}}{\commlib;\library;\kontstack;\ctx;\memstate}{n;delete\ z;K[n]}{Ret\ \comptoctx\ n}$
  \end{passumptions}
  This works, because of \Cref{asm:exprbacktranslation:beg:wrapper:correct:fooinlibctx}, then $\rho(\src{\comp})=\src{\comptoctx}$.
  Note, \Cref{asm:exprbacktranslation:beg:wrapper:correct:execs0a}, continue with \Cref{tr:w-e-ectx,tr:w-e-let-f}:
  \begin{passumptions}{H}
    \setcounter{enumi}{7}
    \item\label[ass]{asm:exprbacktranslation:beg:wrapper:correct:execs1} $\execs[]{\commlib;\library;\kontstack;\ctx;\memstate}{K_{component}\hole{return\ n}}{\commlib;\library;\kontstack;\ctx;\memstate}{delete\ z;K[n]}{\emptyevent}$
  \end{passumptions}
  Finally, use \Cref{tr:w-e-ectx,tr:w-e-delete} on \Cref{asm:exprbacktranslation:beg:wrapper:correct:execs1}:
  \begin{passumptions}{H}
    \setcounter{enumi}{8}
    \item\label[ass]{asm:exprbacktranslation:beg:wrapper:correct:execs2} $\execs[]{\commlib;\library;\kontstack;\ctx;\memstate}{delete\ z;K[n]}{\commlib;\library;\kontstack;\ctx;\memstate'}{K[n]}{Dealloc\ \loc}$
  \end{passumptions}
  Use \Cref{asm:exprbacktranslation:beg:wrapper:correct:execs0a,asm:exprbacktranslation:beg:wrapper:correct:execs1,asm:exprbacktranslation:beg:wrapper:correct:execs2} on \Cref{tr:wsn-e-trans-important}, \Cref{tr:wsn-e-trans-unimportant,tr:wsn-e-refl} to get exactly what \Cref{goal:exprbacktranslation:beg:wrapper:correct:execs} wants us to prove.

  With \Cref{asm:exprbacktranslation:beg:wrapper:correct:omegas}, invert \Cref{asm:exprbacktranslation:beg:wrapper:correct:staterel}:
  \begin{passumptions}{H}
    \setcounter{enumi}{9}
    \item $\trg{\Omega}=\trg{\cfstate;\comp;\memstate}$
    \item $\trg{\cfstate}=\trg{\commlib;\library;(K;foo),\kontstack}$
    \item\label[ass]{asm:exprbacktranslation:beg:wrapper:correct:cfstateeq} $\xlangstateeq[]{\cfstate}{\cfstate}$
    \item\label[ass]{asm:exprbacktranslation:beg:wrapper:correct:memstaterell} $\xlangstateeq{\memstate}{\memstate}$
  \end{passumptions}
  Invert \Cref{asm:exprbacktranslation:beg:wrapper:correct:exect} to extract:
  \begin{passumptions}{H}
    \setcounter{enumi}{13}
    \item $\trg{\Omega'}=\trg{\cfstate';\ctx;\memstate}$
    \item $\trg{\cfstate'}=\trg{\commlib;\library;\kontstack}$
  \end{passumptions}
  Let $\src{\cfstate'}=\src{\commlib;\library;\kontstack}$.

  Use \Cref{tr:state-qe} on \Cref{goal:exprbacktranslation:beg:wrapper:correct:stateeq} giving goals:
  \begin{goals}
    \setcounter{enumi}{4}
    \item\label[goal]{goal:exprbacktranslation:beg:wrapper:correct:cfstateeq} $\xlangstateeq[]{\cfstate'}{\cfstate'}$
    \item\label[goal]{goal:exprbacktranslation:beg:wrapper:correct:memstateeq} $\xlangstateeq[\delta;\src{L'}]{\memstate'}{\memstate}$
  \end{goals}
  \Cref{goal:exprbacktranslation:beg:wrapper:correct:cfstateeq} follows by \Cref{asm:exprbacktranslation:beg:wrapper:correct:cfstateeq}.

  Note that $\src{\memstate'}=\src{H^{\ctx};H^{\comp};\Delta_{1},x\mapsto(\loc;\sandboxtag';\poisoned;m),\Delta_{2}}$ and remember that $\src{\memstate}=\src{H^{\ctx};H^{\comp};\Delta_{1},x\mapsto(\loc;\sandboxtag';\poison;m),\Delta_{2}}$, of which we know \Cref{asm:exprbacktranslation:beg:wrapper:correct:memstaterell}.
  So, \Cref{goal:exprbacktranslation:beg:wrapper:correct:memstateeq} follows from \Thmref{lem:locinL:poisondoesntmatter}, which needs \Cref{asm:exprbacktranslation:beg:wrapper:correct:linL}.
  Now \Cref{goal:exprbacktranslation:beg:wrapper:correct:traceeq}:
  First apply \Cref{tr:ignore-cons-trace-eq}, given that $\src{Dealloc\ \loc}\in\src{X'}$.
  What is left to show is:
  \begin{goals}
    \setcounter{enumi}{6}
    \item\label[goal]{goal:exprbacktranslation:beg:wrapper:correct:eventeq} $\xlangtraceeq[\delta;\src{X'}]{Ret\ \comptoctx\ \valueexpr}{Ret\ \comptoctx\ \valueexpr}$
  \end{goals}
  \Cref{goal:exprbacktranslation:beg:wrapper:correct:eventeq} follows by \Cref{tr:cons-trace-eq,tr:ret-event-eq,tr:empty-trace-eq}.
\end{proof}

\begin{lemma}[Middle of Backtranslation Correctness]\label{lem:exprbacktranslation:mid:wrapper:correct}
  If
  \begin{assumptions}
  \item $\trg{\Omega}=\trg{\commlib;\library;\kontstack;\ctx;\memstate}$
  \item $\trg{\library}=\trg{\library_{ctx}\linker}\mmlAmmlAtcomp{\library_{comp}}$
  \item $\trg{\commlib}=\mmlAmmlAtcomp{\commlib}=\operatorname{dom}\ \mmlAmmlAtcomp{\library_{comp}}$
  \item\label[ass]{asm:exprbacktranslation:mid:correct:execs} $\exectN[^{n}]{\Omega}{e\gamma}{\Omega'}{e'\gamma'}{\trace}$
  \item\label[ass]{asm:exprbacktranslation:mid:correct:backtrans} $\mmlAmmlAtbackdetail[]{\color{black}\tospecificevt[^{*}_{\trg{\bullet}}]{\trace}}=\src{e}$
  \item\label[ass]{asm:exprbacktranslation:mid:correct:nonint} $\vdash\trg{\trace}\operatorname{ non-int-}\trg{\trace}$
  \item\label[ass]{asm:exprbacktranslation:mid:correct:staterel} $\xlangbackstateeq{\Omega}{\Omega}$
  \item $\src{\Omega}=\src{\commlib;\library;\kontstack;\ctx;\memstate}$
  \item $\src{\library}=\src{\library_{ctx}\linker\library_{comp}}$
%  \item $\src{\library}=\left\{\src{main}\mapsto\src{e_{main}}\right\}\src{\linker\library_{comp}}$
  \end{assumptions}
  then $\exists n'\ \src{\trace}$,
  \begin{goals}
  \item\label[goal]{goal:exprbacktranslation:mid:correct:execs} $\execN[^{n'}]{\src{\Omega}}{\src{K[e]}}{\src{\commlib;\library;\kontstack;\memstate'}}{\src{K[42]}}{\src{\trace}}$
  \item\label[goal]{goal:exprbacktranslation:mid:correct:staterel} $\xlangbackstateeq[\delta;\src{L}]{\Omega'}{\src{\commlib;\library;\kontstack;\memstate'}}$
  \item\label[goal]{goal:exprbacktranslation:mid:correct:tracerel} $\src{\trace}\thexlangtraceeq[\delta;\emptyset]\trg{\hole{\cdot}}$
  \end{goals}
\end{lemma}
\begin{proof}
  Induction on \Cref{asm:exprbacktranslation:mid:correct:nonint}.

  \begin{description}
  \item \textbf{Case $\trg{\trace}=\trg{\hole{\cdot}}$}

  Invert \Cref{asm:exprbacktranslation:mid:correct:backtrans} to obtain:
  \begin{passumptions}{H}
    \item $\src{e}=\src{42}$
  \end{passumptions}
  $\src{e}=\src{abort()}$ is not an option, since it contradicts \Cref{asm:exprbacktranslation:mid:correct:execs}.

  Instantiate our goals with:
  \begin{passumptions}{H}
    \setcounter{enumi}{1}
    \item $n=0$
    \item $\src{\trace}=\src{\hole{\cdot}}$
  \end{passumptions}

  \Cref{goal:exprbacktranslation:mid:correct:execs} follows by reflexivity.

  \noindent Use \Cref{asm:exprbacktranslation:mid:correct:staterel} to solve \Cref{goal:exprbacktranslation:mid:correct:staterel}.

  \noindent For \Cref{goal:exprbacktranslation:mid:correct:tracerel}, use \Cref{tr:empty-trace-eq}.

  \item \textbf{Case $\trg{\trace}=\trg{\event\cdot\trace}$:}

  Regardless of the shape of $\trg{\event}$ (noting that it cannot be $\trg{\lightning}$) note that $\mmlAmmlAtbackdetail[]{\event\cdot\trace}=\mmlAmmlAtbackdetail[]{\trace}$.
  Thus, all cases follow immediately by the induction hypothesis.
  \end{description}
\end{proof}

\begin{lemma}[Backtranslation Correctness of $\trg{Call\ \ctxtocomp}$]\label{lem:exprbacktranslation:end:wrapper:correct}
  If
  \begin{assumptions}
  \item $\trg{\Omega}=\trg{\commlib;\library;\kontstack;\ctx;\memstate}$
  \item\label[ass]{asm:exprbacktranslation:end:wrapper:correct:kontstack} $\trg{\kontstack}=\trg{(K';bar),\kontstack'}$
  \item $\trg{\library}=\trg{\library_{ctx}\linker}\mmlAmmlAtcomp{\library_{comp}}$
  \item $\trg{\commlib}=\mmlAmmlAtcomp{\commlib}=\operatorname{dom}\ \mmlAmmlAtcomp{\library_{comp}}$
  \item $\exect[]{\Omega}{K\hole{call\ foo\ \valueexpr}}{\commlib;\library;(K;foo),\kontstack;\comp;\memstate}{{\color{black}\mmlAmmlAtcomp{e_{foo}}}[\valueexpr/y]}{Call\ \ctxtocomp\ foo\ \valueexpr;\ctx}$
  \item $\mmlAmmlAtbackctxtocomp[\Game;\delta;\trg{\overline{\loc}}]{\color{black}\tospecificevt[_{\trg{\bullet}}]{Call\ \ctxtocomp\ foo\ \valueexpr}}=\Game';\delta';\trg{\overline{\loc'}};\src{let\ z = new\ 42\ in\ call\ foo\ }\mmlAmmlAtbackv[]{\valueexpr}$
  \item\label[ass]{lem:exprbacktranslation:end:wrapper:correct:backstateeq} $\xlangbackstateeq{\Omega}{\Omega}$
  \item $\src{\Omega}=\src{\commlib;\library;\kontstack;\ctx;\memstate}$
  \item $\src{let\ foo\ y:\type_{\color{black}\lambda}:=e_{foo}}\in\src{\library_{comp}}$
  \item\label[ass]{lem:exprbacktranslation:end:wrapper:correct:freshlocs} $\fresh{\Game,\delta}{\src{\loc}}$
  \item\label[ass]{lem:exprbacktranslation:end:wrapper:correct:freshz} $\fresh{\Game}{\src{z}}$
  \item\label[ass]{lem:exprbacktranslation:end:wrapper:correct:freshloct} $\fresh{\delta}{\trg{\loc}}$
  \item $\delta'(\src{\loc})=\trg{\loc}$
  \item $\Game'(\src{\loc})=\src{z}$
  \item $\src{\library}=\src{\library_{ctx}\linker\library_{comp}}$
%  \item $\src{\library}=\left\{\src{main}\mapsto\src{e_{main}}\right\}\src{\linker\library_{comp}}$
  \end{assumptions}
  then $\exists n\ \src{\trace}\ \src{\memstate'}$,
  \begin{goals}
%  \item\label[goal]{goal:exprbacktranslation:end:wrapper:correct:deltasubset} $\delta\subseteq\delta'$
  \item\label[goal]{goal:exprbacktranslation:end:wrapper:correct:Lsubset} $\src{L'}=\src{L}\cup\{\src{\loc}\}$
  \item\label[goal]{goal:exprbacktranslation:end:wrapper:correct:Xsubset} $\src{X'}=\src{X}\cup\{\src{Alloc\ \loc\ 42}\}$
  \item\label[goal]{goal:exprbacktranslation:end:wrapper:correct:execs} $\execN[^{n}]{\src{\Omega}}{\src{K[let\ z = new\ 42\ in\ call\ foo\ }\mmlAmmlAtbackv[]{\valueexpr}\src{]}}{\src{\commlib;\library;(K;foo),\kontstack;\comp;\memstate'}}{\src{e_{foo}\gamma}}{\src{\trace}}$
  \item\label[goal]{goal:exprbacktranslation:end:wrapper:correct:stateeq} $\xlangstateeq[\delta';\src{L'}]{\src{\commlib;\library;(K,foo),\kontstack;\comp;\memstate'}}{\commlib;\library;(K;foo),\kontstack;\comp;\memstate}$
  \item\label[goal]{goal:exprbacktranslation:end:wrapper:correct:traceeq} $\src{\trace}\thexlangtraceeq[\delta';\src{X'}]\trg{Call\ \ctxtocomp\ foo\ \valueexpr;\ctx}$
  \end{goals}
\end{lemma}
\begin{proof}
  First, we unfold the source memory state:
  \begin{passumptions}{H}
    \item $\src{\memstate} = \src{H^{\ctx};H^{\comp};\Delta}$
  \end{passumptions}
  Let $\src{\valueexpr}=\mmlAmmlAtbackv[]{\valueexpr}$.
  Next, we instantiate the existentials in the goals as follows:
  \begin{passumptions}{H}
    \setcounter{enumi}{5}
%    \item $\delta' = \delta \cup \left\{\src{\loc}\mapsto\trg{z}\right\}$
    \item $n=2$
    \item $\src{L'} = \src{L} \cup \left\{\src{\loc}\right\}$
    \item $\src{X'} = \src{X} \cup \left\{\src{Alloc\ \loc\ 42}\right\}$
    \item $\src{\trace} = \src{Alloc\ \loc\ 42;\ctx\cdot Call\ \ctxtocomp\ foo\ \valueexpr;\ctx}$
    \item $\src{\memstate'} = \underbrace{\src{0,\cdots,0}}_{42-times}\src{,H^{\ctx};H^{\comp};z\mapsto(\loc;\ctx;\poisonless;42),\Delta}$
    \item $\src{\gamma} = \src{[}\mmlAmmlAtbackv[]{\valueexpr}\src{/y]}$
  \end{passumptions}
  %\Cref{goal:exprbacktranslation:end:wrapper:correct:deltasubset,}
  \Cref{goal:exprbacktranslation:end:wrapper:correct:Lsubset,goal:exprbacktranslation:end:wrapper:correct:Xsubset} follow easily.
  For \Cref{goal:exprbacktranslation:end:wrapper:correct:execs}, first use \Cref{tr:w-e-ectx,tr:w-e-let-new}, noting \Cref{lem:exprbacktranslation:end:wrapper:correct:freshlocs,lem:exprbacktranslation:end:wrapper:correct:freshz}:
  \begin{passumptions}{H}
    \setcounter{enumi}{10}
    \item\label[ass]{asm:exprbacktranslation:end:wrapper:correct:execs0} $\execN[^{1}]{\src{\Omega}}{\src{K[let\ z = new\ 42\ in\ call\ foo\ \valueexpr]}}{\src{\commlib;\library;\kontstack;\ctx;\memstate'}}{\src{K[call\ foo\ \valueexpr]}}{\src{Alloc\ \loc\ 42;\ctx}}$
  \end{passumptions}
  Now use \Cref{tr:w-e-ectx-ret-notsame}:
  \begin{passumptions}{H}
    \setcounter{enumi}{11}
    \item\label[ass]{asm:exprbacktranslation:end:wrapper:correct:execs1b} $\execN[^{1}]{\src{\commlib;\library;\kontstack;\ctx;\memstate'}}{\src{K[call\ foo\ \valueexpr]}}{\src{\commlib;\library;(K;foo),\kontstack;\ctx;\memstate'}}{\src{e_{foo}[\valueexpr/y]}}{\src{Call\ \ctxtocomp\ foo\ z;\ctx}}$
  \end{passumptions}
  Use \Cref{asm:exprbacktranslation:end:wrapper:correct:execs0,asm:exprbacktranslation:end:wrapper:correct:execs1b} on \Cref{tr:wsn-e-trans-important,tr:wsn-e-refl} to get exactly what \Cref{goal:exprbacktranslation:end:wrapper:correct:execs} wants us to prove.

  Invert \Cref{lem:exprbacktranslation:end:wrapper:correct:backstateeq}:
  \begin{passumptions}{H}
    \setcounter{enumi}{11}
    \item $\src{\Omega}=\src{\commlib;\library;\kontstack;\ctx;\memstate}$
    \item $\trg{\Omega}=\trg{\commlib;\library;\kontstack;\ctx;\memstate}$
    \item\label[ass]{asm:exprbacktranslation:end:wrapper:correct:cfstateeq} $\xlangbackstateeq[]{\cfstate}{\cfstate}$
    \item\label[ass]{asm:exprbacktranslation:end:wrapper:correct:memstateeq} $\xlangbackstateeq{\memstate}{\memstate}$
  \end{passumptions}
  Invert \Cref{asm:exprbacktranslation:end:wrapper:correct:cfstateeq}:
  \begin{passumptions}{H}
    \setcounter{enumi}{15}
    \item\label[ass]{asm:exprbacktranslation:end:wrapper:correct:lib} $\xlangstateeq[]{\library}{\library}$
    \item\label[ass]{asm:exprbacktranslation:end:wrapper:correct:kontsqe} $\xlangbackstateeq[]{\kontstack}{\kontstack}$
  \end{passumptions}
  Invert \Cref{asm:exprbacktranslation:end:wrapper:correct:memstateeq}
  \begin{passumptions}{H}
    \setcounter{enumi}{17}
    \item $\trg{\memstate}=\trg{H^{\ctx};H^{\comp};\Delta}$
    \item\label[ass]{asm:exprbacktranslation:end:wrapper:correct:hdeltaeq}
     $\xlangstateeq[\delta;\src{L}]{H^{\ctx};H^{\comp};\Delta}{H^{\ctx};H^{\comp};\Delta}$
  \end{passumptions}

  Apply \Cref{tr:state-eq} on \Cref{goal:exprbacktranslation:end:wrapper:correct:stateeq}:
  \begin{goals}
    \setcounter{enumi}{4}
    \item\label[goal]{goal:exprbacktranslation:end:wrapper:correct:hdeltaeq} $\xlangstateeq[\delta';\src{L'}]{{\color{black}\underbrace{\src{0,\dots,0}}_{42-times}},H^{\ctx};H^{\comp};z\mapsto(\loc;\ctx;\poisonless;42),\Delta}{H^{\ctx};H^{\comp};\Delta}$
    \item\label[goal]{goal:exprbacktranslation:end:wrapper:correct:cfstateeq} $\xlangstateeq[]{\commlib;\library;(K;foo),\kontstack}{\commlib;\library;(K;foo),\kontstack}$
  \end{goals}
  Use \Cref{tr:whatever-cons-memstate-eq} on \Cref{goal:exprbacktranslation:end:wrapper:correct:hdeltaeq}, since $\src{\loc}\in\src{L'}$:
  \begin{goals}
    \setcounter{enumi}{6}
    \item\label[goal]{goal:exprbacktranslation:end:wrapper:correct:hdeltaeq2} $\xlangstateeq[\delta';\src{L'}]{H^{\ctx};H^{\comp};\Delta}{H^{\ctx};H^{\comp};\Delta}$
  \end{goals}

  \noindent\Cref{goal:exprbacktranslation:end:wrapper:correct:hdeltaeq2} can be resolved by \Cref{asm:exprbacktranslation:end:wrapper:correct:hdeltaeq}. % FIXME: delta and L grows

  \noindent Apply \Cref{tr:cfstate-eq} on \Cref{goal:exprbacktranslation:end:wrapper:correct:cfstateeq}:
  \begin{goals}
    \setcounter{enumi}{8}
    \item\label[goal]{goal:exprbacktranslation:end:wrapper:correct:lib} $\xlangstateeq[]{\library}{\library}$
    \item\label[goal]{goal:exprbacktranslation:end:wrapper:correct:konts} $\xlangstateeq[]{(K;foo),\kontstack}{(K;foo),\kontstack}$
  \end{goals}
  \Cref{goal:exprbacktranslation:end:wrapper:correct:lib} is resolved by \Cref{asm:exprbacktranslation:end:wrapper:correct:lib}. % FIXME: delta grows

  \noindent Apply \Cref{tr:cons-kontstack-eq} to \Cref{goal:exprbacktranslation:end:wrapper:correct:konts}, leaving us with:
  \begin{goals}
    \setcounter{enumi}{10}
    \item\label[goal]{goal:exprbacktranslation:end:wrapper:correct:konts2} $\xlangstateeq[]{\kontstack}{\kontstack}$
  \end{goals}
  Invert \Cref{asm:exprbacktranslation:end:wrapper:correct:kontsqe}:
  \begin{passumptions}{H}
    \setcounter{enumi}{19}
    \item\label[ass]{asm:exprbacktranslation:end:wrapper:correct:kontstackk} $\xlangstateeq[]{\kontstack}{\kontstack}$
  \end{passumptions}
  \Cref{asm:exprbacktranslation:end:wrapper:correct:kontstackk} can now be used to solve \Cref{goal:exprbacktranslation:end:wrapper:correct:konts2}.

  \noindent Lastly, apply \Cref{tr:ignore-cons-trace-eq} on \Cref{goal:exprbacktranslation:end:wrapper:correct:traceeq}, given that $\src{Alloc\ \loc\ 42}\in\src{X'}$.
  What is left to show is:
  \begin{goals}
    \setcounter{enumi}{6}
    \item\label[goal]{goal:exprbacktranslation:end:wrapper:correct:eventeq} $\xlangtraceeq[\delta;\src{X'}]{Call\ \ctxtocomp\ foo\  \valueexpr}{Call\ \ctxtocomp\ foo\ \valueexpr}$
  \end{goals}
  \Cref{goal:exprbacktranslation:end:wrapper:correct:eventeq} follows by \Cref{tr:cons-trace-eq,tr:call-event-eq,tr:empty-trace-eq}.
\end{proof}

\begin{lemma}[Backtranslation Correctness of $\trg{End}$]\label{lem:exprbacktranslation:vend:wrapper:correct}
  If
  \begin{assumptions}
  \item $\trg{\library}=\trg{\library_{ctx}\linker}\mmlAmmlAtcomp{\library_{comp}}$
  \item $\trg{\commlib}=\mmlAmmlAtcomp{\commlib}=\operatorname{dom}\ \mmlAmmlAtcomp{\library_{comp}}$
  \item $\exect[]{\commlib;\library;(\hole{\cdot};main),\hole{\cdot};\ctx;\memstate}{K\hole{return\ n}}{\commlib;\library;\hole{\cdot};\comp;\memstate}{n}{End\ n;\ctx}$
  \item\label[ass]{lem:exprbacktranslation:vend:wrapper:correct:backtrans} $\mmlAmmlAtbackctxtocomp[\Game;\delta;\trg{\hole{\cdot}}]{\color{black}\tospecificevt[_{\trg{\bullet}}]{End\ n}}=\Game';\delta';\trg{\hole{\cdot}};\src{let\ z=new\ 42\ in\ delete\ z;return\ }\mmlAmmlAtbackv[]{\valueexpr}$
  \item\label[ass]{lem:exprbacktranslation:vend:wrapper:correct:backstateeq} $\xlangbackstateeq{\commlib;\library;(\hole{\cdot};main),\hole{\cdot};\ctx;\memstate}{\commlib;\library;(\hole{\cdot};main),\hole{\cdot};\ctx;\memstate}$
  \item $\src{\library}=\src{\library_{ctx}\linker\library_{comp}}$
  \item\label[ass]{lem:exprbacktranslation:vend:wrapper:correct:freshlocs} $\fresh{\Game,\delta}{\src{\loc}}$
  \item\label[ass]{lem:exprbacktranslation:vend:wrapper:correct:freshz} $\fresh{\Game}{\src{z}}$
  \item\label[ass]{lem:exprbacktranslation:vend:wrapper:correct:freshloct} $\fresh{\delta}{\trg{\loc}}$
  \item $\delta'(\src{\loc})=\trg{\loc}$
  \item $\Game'(\src{\loc})=\src{z}$
  \end{assumptions}
  then $\exists n\ \src{\trace}\ \src{\memstate'}$,
  \begin{goals}
%  \item\label[goal]{goal:exprbacktranslation:end:wrapper:correct:deltasubset} $\delta\subseteq\delta'$
  \item\label[goal]{goal:exprbacktranslation:vend:wrapper:correct:Lsubset} $\src{L'}=\src{L}\cup\{\src{\loc}\}$
  \item\label[goal]{goal:exprbacktranslation:vend:wrapper:correct:Xsubset} $\src{X'}=\src{X}\cup\{\src{Alloc\ \loc\ 42},\src{Dealloc\ \loc}\}$
  \item\label[goal]{goal:exprbacktranslation:vend:wrapper:correct:execs} $\exec[^{n}]{\src{\Omega}}{\src{K[let\ z = new\ 42\ in\ delete\ z;return\ }\mmlAmmlAtbackv[]{\valueexpr}\src{]}}{\src{\commlib;\library;\hole{\cdot};\comp;\memstate'}}{\mmlAmmlAtbackv[]{\valueexpr}}{\src{\trace}}$
  \item\label[goal]{goal:exprbacktranslation:vend:wrapper:correct:stateeq} $\xlangstateeq[\delta';\src{L'}]{\src{\commlib;\library;\hole{\cdot};\comp;\memstate'}}{\commlib;\library;\hole{\cdot};\comp;\memstate}$
  \item\label[goal]{goal:exprbacktranslation:vend:wrapper:correct:traceeq} $\src{\trace}\thexlangtraceeq[\delta';\src{X'}]\trg{End\ \valueexpr;\ctx}$
  \end{goals}
\end{lemma}
\begin{proof}
  First, we unfold the source memory state:
  \begin{passumptions}{H}
    \item $\src{\memstate} = \src{H^{\ctx};H^{\comp};\Delta}$
  \end{passumptions}
  Let $\src{\valueexpr}=\mmlAmmlAtbackv[]{\valueexpr}$.
  Next, we instantiate the existentials in the goals as follows:
  \begin{passumptions}{H}
    \setcounter{enumi}{5}
%    \item $\delta' = \delta \cup \left\{\src{\loc}\mapsto\trg{z}\right\}$
    \item $n=3$
    \item $\src{L'} = \src{L} \cup \left\{\src{\loc}\right\}$
    \item $\src{X'} = \src{X} \cup \left\{\src{Alloc\ \loc\ 42, Dealloc\ \loc}\right\}$
    \item $\src{\trace} = \src{Alloc\ \loc\ 42;\ctx\cdot Dealloc\ \loc;\ctx\cdot End\ \valueexpr;\ctx}$
    \item $\src{\memstate'} = \underbrace{\src{0,\cdots,0}}_{42-times}\src{,H^{\ctx};H^{\comp};z\mapsto(\loc;\ctx;\poisoned;42),\Delta}$
  \end{passumptions}
  Let $\src{\memstate_{\poisonless}} = \underbrace{\src{0,\cdots,0}}_{42-times}\src{,H^{\ctx};H^{\comp};z\mapsto(\loc;\ctx;\poisonless;42),\Delta}$.

  Let $\src{\kontstack}=\src{(\hole{\cdot};main),\hole{\cdot}}$.
  \Cref{goal:exprbacktranslation:vend:wrapper:correct:Lsubset,goal:exprbacktranslation:vend:wrapper:correct:Xsubset} follow easily.
  For \Cref{goal:exprbacktranslation:vend:wrapper:correct:execs}, first use \Cref{tr:w-e-ectx,tr:w-e-let-new}, noting \Cref{lem:exprbacktranslation:vend:wrapper:correct:freshlocs,lem:exprbacktranslation:vend:wrapper:correct:freshz}:
  \begin{passumptions}{H}
    \setcounter{enumi}{9}
    \item\label[ass]{asm:exprbacktranslation:vend:wrapper:correct:execs0} $\execN[]{\src{\Omega}}{\src{K[let\ z = new\ 42\ in\ delete\ z; return\ \valueexpr]}}{\src{\commlib;\library;\kontstack;\ctx;\ \memstate_{\poisonless}}}{\src{K[delete\ z; return\ \valueexpr]}}{\src{Alloc\ \loc\ 42;\ctx}}$
  \end{passumptions}

  Next, use \Cref{tr:w-e-ectx,tr:w-e-delete,tr:w-e-let-f,tr:wsn-e-trans-unimportant,tr:wsn-e-refl} on \Cref{asm:exprbacktranslation:vend:wrapper:correct:execs0}:

  \begin{passumptions}{H}
    \setcounter{enumi}{10}
    \item\label[ass]{asm:exprbacktranslation:vend:wrapper:correct:execs1} $\exec[^{2}]{\src{\commlib;\library;\kontstack;\ctx;\memstate_{\poisonless}}}{\src{K[let\ \_=delete\ z\ in\ return\ \valueexpr]}}{\src{\commlib;\library;\kontstack;\ctx;\memstate'}}{\src{K[return\ \valueexpr]}}{\src{Dealloc\ \loc;\ctx}}$
  \end{passumptions}

  Now, apply \Cref{tr:w-e-ectx,tr:w-e-ectx-ret-main} on \Cref{asm:exprbacktranslation:vend:wrapper:correct:execs1}.

  \begin{passumptions}{H}
    \setcounter{enumi}{11}
    \item\label[ass]{asm:exprbacktranslation:vend:wrapper:correct:execs2} $\exec[]{\src{\commlib;\library;(\hole{\cdot},main),\hole{\cdot};\ctx;\memstate'}}{\src{K[return\ \valueexpr]}}{\src{\commlib;\library;\hole{\cdot};\comp;\memstate'}}{\src{\valueexpr}}{\src{End\ \valueexpr;\ctx}}$
  \end{passumptions}

  Use \Cref{asm:exprbacktranslation:vend:wrapper:correct:execs0,asm:exprbacktranslation:vend:wrapper:correct:execs1,asm:exprbacktranslation:vend:wrapper:correct:execs2} on \Cref{tr:wsn-e-trans-important,tr:wsn-e-refl} to get exactly what \Cref{goal:exprbacktranslation:vend:wrapper:correct:execs} wants us to prove.

  Invert \Cref{lem:exprbacktranslation:vend:wrapper:correct:backstateeq}:
  \begin{passumptions}{H}
    \setcounter{enumi}{12}
    \item $\src{\Omega}=\src{\commlib;\library;(\hole{\cdot};main),\hole{\cdot};\ctx;\memstate}$
    \item $\trg{\Omega}=\trg{\commlib;\library;(\hole{\cdot};main),\hole{\cdot};\ctx;\memstate}$
    \item\label[ass]{asm:exprbacktranslation:vend:wrapper:correct:cfstateeq} $\xlangbackstateeq[]{\commlib;\library;(\hole{\cdot};main),\hole{\cdot}}{\commlib;\library;(\hole{\cdot};main),\hole{\cdot}}$
    \item\label[ass]{asm:exprbacktranslation:vend:wrapper:correct:memstateeq} $\xlangbackstateeq[\delta;\src{L}]{\memstate}{\memstate_{0}}$
  \end{passumptions}
  Invert \Cref{asm:exprbacktranslation:vend:wrapper:correct:cfstateeq}:
  \begin{passumptions}{H}
    \setcounter{enumi}{15}
    \item\label[ass]{asm:exprbacktranslation:vend:wrapper:correct:lib} $\xlangstateeq[]{\library}{\library}$
    \item\label[ass]{asm:exprbacktranslation:vend:wrapper:correct:kontsqe} $\xlangbackstateeq[\src{\commlib}]{(\hole{\cdot};main),\hole{\cdot}}{(\hole{\cdot};main),\hole{\cdot}}$
  \end{passumptions}
  Invert \Cref{asm:exprbacktranslation:vend:wrapper:correct:memstateeq}
  \begin{passumptions}{H}
    \setcounter{enumi}{18}
    \item\label[ass]{asm:exprbacktranslation:vend:wrapper:correct:state0} $\src{\memstate_{0}}=\src{H^{\ctx};H^{\comp};\Delta}$
    \item $\trg{\memstate}=\trg{H^{\ctx};H^{\comp};\Delta}$
    \item\label[ass]{asm:exprbacktranslation:vend:wrapper:correct:hdeltaeq}
     $\xlangstateeq[\delta;\src{L}]{H^{\ctx};H^{\comp};\Delta}{H^{\ctx};H^{\comp};\Delta}$
  \end{passumptions}

  \noindent
  Use \Cref{asm:exprbacktranslation:vend:wrapper:correct:hdeltaeq,tr:empty-kontstack-eq,asm:exprbacktranslation:vend:wrapper:correct:lib} to solve \Cref{goal:exprbacktranslation:vend:wrapper:correct:stateeq}.

  \noindent Lastly, apply \Cref{tr:ignore-cons-trace-eq} on \Cref{goal:exprbacktranslation:vend:wrapper:correct:traceeq}, given that $\{\src{Alloc\ \loc\ 42},\src{Dealloc\ \loc}\}\subseteq\src{X'}$.
  What is left to show is:
  \begin{goals}
    \setcounter{enumi}{6}
    \item\label[goal]{goal:exprbacktranslation:vend:wrapper:correct:eventeq} $\xlangtraceeq[\delta;\src{X'}]{End\ \valueexpr}{End\ \valueexpr}$
  \end{goals}
  \Cref{goal:exprbacktranslation:vend:wrapper:correct:eventeq} follows by \Cref{tr:cons-trace-eq,tr:call-event-eq,tr:empty-trace-eq}.
\end{proof}

\begin{lemma}[Backtranslation Correctness]\label{lem:backtranslation:correct}
  If
  \begin{assumptions}
  \item\label[ass]{asm:backtrans:correct:exect0} $\exect{\Omega}{call\ main\ 0}{\Omega'}{\finalexpr}{\trace}$
  \item\label[ass]{asm:backtrans:correct:backtrans} $\mmlAmmlAtback[\emptyset;\emptyset]{\trace}=\Game;\delta;\src{\library_{ctx}}$
  \item\label[ass]{asm:backtrans:correct:initstaterel} $\xlangstateeq[\emptyset;\emptyset]{\Omega}{\Omega}$
  \item $\trg{\Omega}=\trg{foo,\hole{\cdot};\library;\hole{\cdot};\comp;\hole{\cdot};\hole{\cdot};\hole{\cdot}}$
  \item\label[ass]{asm:backtrans:correct:omegais} $\src{\Omega}=\src{\commlib;\library;\kontstack;\comp;\memstate}$
  \item\label[ass]{asm:backtrans:correct:srclinks} $\src{\library}=\src{\library_{ctx}\linker\library_{comp}}$
  \item\label[ass]{asm:backtrans:correct:typing} $\src{\Gamma}\vdash\src{\library_{comp}}\operatorname{ok}$
  \end{assumptions}
  then $\exists \delta_{e}\ \src{L_{e}}\ \src{X_{e}}\ \src{\Omega_{e}'}\ \src{\trace_{e}}$,
  \begin{goals}
  \item\label[goal]{goal:backtrans:correct:execs} $\exec{\configs}{\src{call\ main\ 0}}{\src{\Omega_{e}'}}{\mmlAmmlAtbackv[]{\finalexpr}}{\src{\trace_{e}}}$
  \item\label[goal]{goal:backtrans:correct:stateeq} $\xlangstateeq[\delta_{e};\src{L_{e}}]{\Omega_{e}'}{\Omega'}$
  \item\label[goal]{goal:backtrans:correct:traceeq} $\src{\trace_{e}}\thexlangtraceeq[\delta_{e};\src{X_{e}}]\trg{\trace}$
  \end{goals}
\end{lemma}
\begin{proof}
  Inverting \Cref{asm:backtrans:correct:backtrans} gives:
  \begin{passumptions}{H}
    \item\label[ass]{asm:backtrans:correct:traceeq0} $\tospecificevt[^{*}_{\trg{\bullet}}]{\trace} = \trg{Start;\comp\cdot\trace[_{0}]\cdot Call\ \ctxtocomp\ foo\ \valueexpr_{0};\ctx\cdot\trace[_{comp}]\cdot Ret\ \comptoctx\ \valueexpr_{1};\comp\cdot\trace[_{1}]\cdot End\ \valueexpr_{2};\ctx}$
    \item $\vdash\trg{\trace[_{comp}]}\operatorname{non-int-\trg{\trace}}$
    \item\label[ass]{asm:backtrans:correct:subtop1} $\mmlAmmlAtbackctxtocomp[\emptyset;\emptyset;\trg{\hole{\cdot}}]{Start\cdot\trace[_{0}]\cdot Call\ \ctxtocomp\ foo\ \valueexpr_{0}} = \Game;\delta;\trg{\overline{\loc}};\src{e_{0}};\src{e_{0}'};\src{let\ x_{0} = new\ n_{0}\ in\ e_{0}''}$
    \item\label[ass]{asm:backtrans:correct:subtop2} $\mmlAmmlAtbackcomptoctx[\Game;\delta;\trg{\overline{\loc}}]{Ret\ \comptoctx\ \valueexpr_{1}\cdot\trace[_{1}]\cdot End\ \valueexpr_{2}} = \Game';\delta';\trg{\hole{\cdot}};\src{e_{1}};\src{e_{1}'};\src{let\ x_{1} = new\ n_{1}\ in\ e_{1}''}$
    \item $\src{e}=\src{e_{0};e_{0}';let\ x_{0}=new\ n_{0}\ in\ \left(e_{0}'';e_{1}\right);e_{1}';let\ x_{1} =new\ n_{1}\ in\ e_{1}''}$
    \item\label[ass]{asm:backtrans:correct:links} $\src{\library_{ctx}}=\src{let\ main\ x:\nat\to\nat:=e,\hole{\cdot}}$
  \end{passumptions}
  Inverting \Cref{asm:backtrans:correct:subtop1}:
  \begin{passumptions}{H}
    \setcounter{enumi}{6}
    \item\label[ass]{asm:backtranscorr:nonint0} $\vdash\trg{\trace[_{0}]}\operatorname{non-int-\trg{\trace}}$
    \item\label[ass]{asm:backtranscorr:backtrans:start0} $\mmlAmmlAtbackcomptoctx[\emptyset;\emptyset;\trg{\hole{\cdot}}]{Start} = \trg{\overline{\loc_{0}}}; \src{e_{0}}$
    \item\label[ass]{asm:backtranscorr:backtrans:mid0} $\mmlAmmlAtbackdetail[]{\trace[_{0}]} = \src{e_{0}'}$
    \item\label[ass]{asm:backtranscorr:backtrans:call09} $\mmlAmmlAtbackctxtocomp[\emptyset;\emptyset;\trg{\overline{\loc_{0}}}]{Call\ \ctxtocomp\ foo\ \valueexpr_{0}} = \Game;\delta;\trg{\overline{\loc}}, \src{let\ x_{0}=new\ n_{0}\ in\ e_{0}''}$
  \end{passumptions}
  Inverting \Cref{asm:backtrans:correct:subtop2}:
  \begin{passumptions}{H}
    \setcounter{enumi}{10}
    \item\label[ass]{asm:backtranscorr:nonint1} $\vdash\trg{\trace[_{1}]}\operatorname{non-int-\trg{\trace}}$
    \item\label[ass]{asm:backtranscorr:backtrans:ret1} $\mmlAmmlAtbackcomptoctx[\Game;\delta;\trg{\overline{\loc}}]{Ret\ \comptoctx\ \valueexpr_{1}} = \trg{\overline{\loc_{1}}}; \src{e_{1}}$
    \item\label[ass]{asm:backtranscorr:backtrans:mid1} $\mmlAmmlAtbackdetail[]{\trace[_{1}]} = \src{e_{1}'}$
    \item\label[ass]{asm:backtranscorr:backtrans:end} $\mmlAmmlAtbackctxtocomp[\Game;\delta;\trg{\overline{\loc_{1}}}]{End\ \valueexpr_{2}} = \Game';\delta';\trg{\hole{\cdot}}; \src{let\ x_{1}=new\ n_{1}\ in\ e_{1}''}$
  \end{passumptions}
  By \Cref{lem:trgfilter:invert:concrete,lem:trgfilter:distributive,asm:backtranscorr:nonint0,asm:backtranscorr:nonint1} and noting that $\trg{\trace[_{0}]}$ and $\trg{\trace[_{1}]}$ are all tagged with $\trg{\ctx}$, we can conclude:
  \begin{passumptions}{H}
    \setcounter{enumi}{14}
    \item\label[ass]{asm:backtrans:correct:filter:nonint0} $\trg{\trace[_{0}]}=\trg{\hole{\cdot}}$
    \item\label[ass]{asm:backtrans:correct:filter:nonint1} $\trg{\trace[_{1}]}=\trg{\hole{\cdot}}$
  \end{passumptions}

  Invert \Cref{asm:backtrans:correct:exect0} and noting \Cref{asm:backtrans:correct:traceeq0}:
  \begin{passumptions}{H}
    \setcounter{enumi}{14}
    \item $\trg{\trace}=\trg{Start;\comp\cdot\trace[_{a}]}$
    \item\label[ass]{asm:backtranscorr:exect0} $\exect[]{\Omega}{call\ main\ 0}{foo,\hole{\cdot};\library;(\hole{\cdot};main),\hole{\cdot};\ctx;\hole{\cdot};\hole{\cdot};\hole{\cdot}}{e_{0}[0/x]}{Start;\comp}$
    \item\label[ass]{asm:backtranscorr:exect0a} $\exect{foo,\hole{\cdot};\library;(\hole{\cdot};main),\hole{\cdot};\ctx;\hole{\cdot};\hole{\cdot};\hole{\cdot}}{e_{0}[0/x]}{\Omega'}{\finalexprnoerr}{\trace[_{a}]}$
  \end{passumptions}

  Invert \Cref{asm:backtrans:correct:initstaterel}:
  \begin{passumptions}{H}
    \setcounter{enumi}{17}
    \item $\src{\Omega}=\src{\cfstate;\comp;\memstate}$
    \item $\trg{\Omega}=\trg{\cfstate;\comp;\memstate}$
    \item\label[ass]{asm:backtrans:correct:cfstaterel} $\xlangstateeq[]{\cfstate}{\cfstate}$
    \item\label[ass]{asm:backtrans:correct:memstaterel} $\xlangstateeq[\emptyset;\emptyset]{\memstate}{\memstate}$
  \end{passumptions}
  Subsequently inverting \Cref{asm:backtrans:correct:cfstaterel}:
  \begin{passumptions}{H}
    \setcounter{enumi}{21}
    \item $\src{\cfstate}=\src{\commlib;\library;\kontstack}$
    \item $\trg{\cfstate}=\trg{foo,\hole{\cdot};\library;\hole{\cdot}}$
    \item\label[ass]{asm:backtrans:correct:libeq} $\xlangstateeq[]{\library}{\library}$
    \item\label[ass]{asm:backtrans:correct:kontstack} $\xlangstateeq[]{\kontstack}{\hole{\cdot}}$
  \end{passumptions}
  Inverting \Cref{asm:backtrans:correct:kontstack}:
  \begin{passumptions}{H}
    \setcounter{enumi}{25}
    \item $\src{\kontstack}=\src{\hole{\cdot}}$
  \end{passumptions}
  Similarily, inverting \Cref{asm:backtrans:correct:memstaterel} and noting that $\trg{\memstate}=\trg{\hole{\cdot};\hole{\cdot};\hole{\cdot}}$:
  \begin{passumptions}{H}
    \setcounter{enumi}{26}
    \item $\src{\memstate}=\src{\hole{\cdot};\hole{\cdot};\hole{\cdot}}$
  \end{passumptions}
  Use \Cref{asm:backtrans:correct:libeq} to conclude:
  \begin{passumptions}{H}
    \setcounter{enumi}{27}
    \item\label[ass]{asm:backtranscorr:liblink} $\trg{\library}=\trg{\library_{ctx}\linker}\mmlAmmlAtcomp{\library_{comp}}$
    \item\label[ass]{asm:backtranscorr:rellibdom} $\trg{\commlib}=\mmlAmmlAtcomp{\commlib}=\operatorname{dom}\mmlAmmlAtcomp{\library_{comp}}$
  \end{passumptions}

  Note by inversion on \Cref{asm:backtranscorr:backtrans:start0} we have:
  \begin{passumptions}{H}
    \setcounter{enumi}{29}
    \item $\trg{\loc_{0}}=\trg{\hole{\cdot}}$
    \item $\src{e_{0}}=\src{42}$
    \item\label[ass]{asm:backtranscorr:backtrans:start} $\mmlAmmlAtbackcomptoctx[\emptyset;\emptyset;\trg{\hole{\cdot}}]{Start} = \trg{\hole{\cdot}}; \src{42}$
  \end{passumptions}
  Thus also:
  \begin{passumptions}{H}
    \setcounter{enumi}{32}
    \item\label[ass]{asm:backtranscorr:backtrans:call0} $\mmlAmmlAtbackctxtocomp[\emptyset;\emptyset;\trg{\hole{\cdot}}]{Call\ \ctxtocomp\ foo\ \valueexpr_{0}} = \Game;\delta;\trg{\overline{\loc}}; \src{let\ x_{0}=new\ n_{0}\ in\ e_{0}''}$
  \end{passumptions}

  From previous assumptions, we also know:
  \begin{passumptions}{H}
    \setcounter{enumi}{33}
    \item\label[ass]{asm:backtranscorr:staterel0} $\xlangstateeq[\emptyset;\emptyset]{foo,\hole{\cdot};\library;\hole{\cdot};\comp;\hole{\cdot};\hole{\cdot};\hole{\cdot}}{foo,\hole{\cdot};\library;\hole{\cdot};\comp;\hole{\cdot};\hole{\cdot};\hole{\cdot}}$
    \item\label[ass]{asm:backtranscorr:sctx0} $\src{\library_{\ctx}}=\src{let\ main\ x:\nat\to\nat:=42;e_{01},\hole{\cdot}}$
  \end{passumptions}

  \noindent Now use \Thmref{lem:exprbacktranslation:vbeg:wrapper:correct} on \Cref{asm:backtranscorr:liblink,asm:backtranscorr:rellibdom,asm:backtranscorr:exect0,asm:backtranscorr:backtrans:start,asm:backtranscorr:staterel0,asm:backtranscorr:sctx0} to get
  \begin{passumptions}{H}
    \setcounter{enumi}{35}
    \item\label[ass]{asm:backtrans:execs0} $\execsn[^{n_{0}'}]{foo,\hole{\cdot};\library;\hole{\cdot};\comp;\hole{\cdot};\hole{\cdot};\hole{\cdot}}{call\ main\ 0}{\commlib;\library;(\hole{\cdot};main),\hole{\cdot};\ctx;\hole{\cdot};\hole{\cdot};\hole{\cdot}}{e_{01}[0/x]}{Start;\comp}$
    \item\label[ass]{asm:backtrans:correct:backstaterel0} $\xlangbackstateeq[\emptyset;\emptyset]{\commlib;\library;(\hole{\cdot};main),\hole{\cdot};\ctx;\hole{\cdot};\hole{\cdot};\hole{\cdot}}{\commlib;\library;(\hole{\cdot};main),\hole{\cdot};\ctx;\hole{\cdot};\hole{\cdot};\hole{\cdot}}$
    \item\label[ass]{asm:backtrans:ttraceeq0} $\src{Start;\comp}\thexlangtraceeq[\emptyset;\emptyset]\trg{Start;\comp}$
  \end{passumptions}

  By transitivity, we can split \Cref{asm:backtranscorr:exect0a} arbitrarily, noting \Cref{asm:backtranscorr:nonint0}.
  So let $n_{1}$ be such that:
  \begin{passumptions}{H}
    \setcounter{enumi}{38}
    \item\label[ass]{asm:backtranscorr:exect1} $\exectN[^{n_{0}}]{foo,\hole{\cdot};\library;(\hole{\cdot};main),\hole{\cdot};\ctx;\hole{\cdot};\hole{\cdot};\hole{\cdot}}{e_{0}[0/x]}{foo,\hole{\cdot};\library;\kontstack,(\hole{\cdot};main),\hole{\cdot};\ctx;H^{\ctx}_{0};\hole{\cdot};\Delta_{0}}{e_{1}}{\trace_{0}}$
    \item\label[ass]{asm:backtranscorr:exect1a} $\exect{foo,\hole{\cdot};\library;(\hole{\cdot};main),\hole{\cdot};\ctx;H^{\ctx};\hole{\cdot};\Delta_{0}}{e_{1}}{\Omega'}{\finalexprnoerr}{\trace_{b}}$
    \item\label[ass]{asm:backtranscorr:traceeq0} $\trg{\trace[_{a}]}=\trg{\trace[_{0}]\cdot\trace[_{b}]}$
  \end{passumptions}


  With \Cref{asm:backtranscorr:liblink,asm:backtranscorr:rellibdom,asm:backtranscorr:exect1,asm:backtranscorr:backtrans:mid0,asm:backtranscorr:nonint0,asm:backtrans:correct:backstaterel0,asm:backtrans:correct:links}, we can use \Thmref{lem:exprbacktranslation:mid:wrapper:correct} to obtain:
  \begin{passumptions}{H}
    \setcounter{enumi}{41}
    \item\label[ass]{asm:backtrans:execs1} $\execsn[^{n_{1}'}]{foo,\hole{\cdot};\library;(\hole{\cdot};main),\hole{\cdot};\ctx;\hole{\cdot};\hole{\cdot};\hole{\cdot}}{e_{01}[0/x]}{\commlib;\library;(\hole{\cdot};main),\hole{\cdot};\ctx;\hole{\cdot};\hole{\cdot};\hole{\cdot}}{K\hole{42}}{\trace[_{0}]}$
    \item\label[ass]{asm:backtrans:correct:backstaterel1} $\xlangbackstateeq[\emptyset;\emptyset]{foo,\hole{\cdot};\library;(\hole{\cdot};main),\hole{\cdot};\ctx;\hole{\cdot};\hole{\cdot};\hole{\cdot}}{\commlib;\library;(\hole{\cdot};main),\hole{\cdot};\ctx;\hole{\cdot};\hole{\cdot};\hole{\cdot}}$
    \item\label[ass]{asm:backtrans:ttraceeq1} $\src{\trace[_{0}]}\thexlangtraceeq[\emptyset;\emptyset]\trg{\trace[_{0}]}$
  \end{passumptions}

  By previous assumptions, it is clear that $\trg{\trace[_{b}]}=\trg{Call\ \ctxtocomp\ foo\ \valueexpr_{0};\ctx\cdot\trace[_{c}]}$, so by inversion on the execution \Cref{asm:backtranscorr:exect1a}, we know $\trg{e_{1}}=\trg{K'\hole{call\ foo\ \valueexpr_{0}}}$.

  By transitivity, we can split \Cref{asm:backtranscorr:exect1a} arbitrarily:
  \begin{passumptions}{H}
    \setcounter{enumi}{44}
    \item\label[ass]{asm:backtranscorr:exect2} $\exect[]{foo,\hole{\cdot};\library;\kontstack,(\hole{\cdot};main),\hole{\cdot};\ctx;H^{\ctx}_{0};\hole{\cdot};\Delta_{0}}{K\hole{call\ foo\ \valueexpr_{0}}}{foo,\hole{\cdot};\library;(K;foo),\kontstack,(\hole{\cdot};main),\hole{\cdot};\comp;H^{\ctx}_{0};\hole{\cdot};\Delta_{0}}{e_{foo}[\valueexpr_{0}/y]}{Call\ \ctxtocomp\ foo\ \valueexpr_{0};\ctx}$
    \item\label[ass]{asm:backtranscorr:exect2a} $\exect{foo,\hole{\cdot};\library;(K;foo),\kontstack,(\hole{\cdot};main),\hole{\cdot};\comp;H^{\ctx}_{0};\hole{\cdot};\Delta_{0}}{e_{foo}}{\Omega'}{\finalexprnoerr}{\trace_{c}}$
    \item\label[ass]{asm:backtranscorr:traceeq1} $\trg{\trace[_{b}]}=\trg{Call\ \ctxtocomp\ foo\ \valueexpr_{0};\ctx\cdot\trace[_{c}]}$
  \end{passumptions}

  By the fact that $\trg{foo}\in\trg{\commlib}$, we have $\trg{foo}\in\operatorname{dom}\mmlAmmlAtcomp{\library_{comp}}$ and thus $\trg{e_{foo}}=\mmlAmmlAtcomp{e_{foo}}$, where $\src{let\ foo\ x:\type_{\color{black}\lambda}:=e_{foo}}\in\src{\library_{comp}}$.
  Now, let:
  \begin{passumptions}{H}
    \setcounter{enumi}{44}
    \item\label[ass]{asm:backtranscorr:freshsloc0} $\fresh{}{\src{\loc}}$
    \item\label[ass]{asm:backtranscorr:freshtloc0} $\fresh{\src{\Delta_{0}}}{\trg{\loc}}$
    \item\label[ass]{asm:backtranscorr:freshz0} $\fresh{}{\src{z}}$
    \item\label[ass]{asm:backtranscorr:deltadef} $\delta = \{\src{\loc}\mapsto\trg{\loc}\}$
    \item\label[ass]{asm:backtranscorr:gamedef} $\Game = \{\src{\loc}\mapsto\src{z}\}$
  \end{passumptions}
  We are ready to apply \Thmref{lem:exprbacktranslation:end:wrapper:correct} with \Cref{asm:backtranscorr:liblink,asm:backtranscorr:rellibdom,asm:backtranscorr:exect2,asm:backtranscorr:backtrans:call0,asm:backtrans:correct:backstaterel1,asm:backtranscorr:freshsloc0,asm:backtranscorr:freshtloc0,asm:backtranscorr:freshz0,asm:backtranscorr:deltadef,asm:backtranscorr:gamedef}:
  \begin{passumptions}{H}
    \setcounter{enumi}{49}
    \item\label[ass]{asm:backtranscorr:locinL} $\src{L}=\{\src{\loc}\}$
    \item $\src{X}=\{\src{Alloc\ \loc\ 42}\}$
    \item\label[ass]{asm:backtrans:execs2} $\execsn[^{n_{2}'}]{foo,\hole{\cdot};\library;(\hole{\cdot};main),\hole{\cdot};\ctx;\hole{\cdot};\hole{\cdot};\hole{\cdot}}{K'[let\ x=new\ 42\ in\ call\ foo\ {\color{black}\mmlAmmlAtbackv[]{\valueexpr_{0}}}] }{foo,\hole{\cdot};\library;(K,foo),(\hole{\cdot};main),\hole{\cdot};\comp;\memstate}{e_{foo}[{\color{black}\mmlAmmlAtbackv[]{\valueexpr_{0}}}/y]}{\trace[_{1}]}$
    \item\label[ass]{asm:backtranscorr:staterel1} $\xlangstateeq[\delta;\src{L}]{foo,\hole{\cdot};\library;(K;foo),(\hole{\cdot};main),\hole{\cdot};\comp;\memstate}{foo,\hole{\cdot};\library;(K;foo),\kontstack,(\hole{\cdot};main),\hole{\cdot};\comp;H^{\ctx}_{0};\hole{\cdot};\Delta_{0}}$
    \item\label[ass]{asm:backtrans:ttraceeq2} $\src{\trace[_{1}]}\thexlangtraceeq[\delta;\src{X}]\trg{Call\ \ctxtocomp\ foo\ \valueexpr_{0};\ctx}$
  \end{passumptions}

  By transitivity, we can split \Cref{asm:backtranscorr:exect2a} arbitrarily, noting that the immediate next action after $\trg{\trace[_{comp}]}$ is $\trg{Ret\ \comptoctx\ \valueexpr_{1}}$.
  So let $n_{3}$ be such that:
  \begin{passumptions}{H}
    \setcounter{enumi}{54}
    \item\label[ass]{asm:backtranscorr:exect3} $\exectN[^{n_{3}}]{foo,\hole{\cdot};\library;(K;foo),\kontstack,(\hole{\cdot};main),\hole{\cdot};\comp;H^{\ctx}_{0};\hole{\cdot};\Delta_{0}}{e_{foo}[\valueexpr_{0}/y]}{foo,\hole{\cdot};\library;(K;foo),\kontstack,(\hole{\cdot};main),\hole{\cdot};\comp;H^{\ctx}_{0};H^{\comp}_{0};\Delta_{1}}{K_{c}[return\ \valueexpr_{1}]}{\trace[_{comp}]}$
    \item\label[ass]{asm:backtranscorr:exect3a} $\exect{foo,\hole{\cdot};\library;(K;foo),\kontstack,(\hole{\cdot};main),\hole{\cdot};\comp;H^{\ctx}_{0};H^{\comp}_{0};\Delta_{1}}{K_{c}[return\ \valueexpr_{1}]}{\Omega'}{\finalexprnoerr}{\trace_{d}}$
    \item\label[ass]{asm:backtranscorr:traceeq2} $\trg{\trace[_{c}]}=\trg{\trace[_{\comp}]\cdot\trace[_{d}]}$
  \end{passumptions}

  Remember that $\mmlAmmlAtcomp{e_{foo}}=\trg{e_{foo}}$.

  With \Cref{asm:backtrans:correct:typing} use \Thmref{lem:backtranslation:welltyped}:
  \begin{passumptions}{H}
    \setcounter{enumi}{57}
    \item\label[ass]{asm:backtrans:correct:BTtyps} $\src{\Gamma}\vdash\src{\library}\operatorname{ok}$
  \end{passumptions}
  Now note that \Thmref{lem:static-implies-runtime:toplevel} with \Cref{asm:backtrans:correct:BTtyps} gives:
  \begin{passumptions}{H}
    \setcounter{enumi}{58}
    \item\label[ass]{asm:backtrans:correct:toptyps} $\typechecks{}{foo,\hole{\cdot};\library;\hole{\cdot};\comp;\hole{\cdot};\hole{\cdot};\hole{\cdot}\triangleright call\ main\ 0}{\nat}$
  \end{passumptions}
  By \Thmref{lem:steps-preservation} with \Cref{asm:backtrans:correct:toptyps,asm:backtrans:execs0}:
  \begin{passumptions}{H}
    \setcounter{enumi}{59}
    \item\label[ass]{asm:backtrans:correct:typ0} $\typechecks{}{\commlib;\library;(\hole{\cdot};main),\hole{\cdot};\ctx;\hole{\cdot};\hole{\cdot};\hole{\cdot}\triangleright e_{01}[0/x]}{\nat}$
  \end{passumptions}
  By \Thmref{lem:steps-preservation} with \Cref{asm:backtrans:correct:typ0,asm:backtrans:execs1}:
  \begin{passumptions}{H}
    \setcounter{enumi}{60}
    \item\label[ass]{asm:backtrans:correct:typ1} $\typechecks{}{\commlib;\library;(\hole{\cdot};main),\hole{\cdot};\ctx;\hole{\cdot};\hole{\cdot};\hole{\cdot}\triangleright K[42]}{\nat}$
  \end{passumptions}
  By \Thmref{lem:steps-preservation} with \Cref{asm:backtrans:correct:typ1,asm:backtrans:execs2}:
  \begin{passumptions}{H}
    \setcounter{enumi}{61}
    \item\label[ass]{asm:backtranscorr:comptypchecks} $\typechecks{}{foo,\hole{\cdot};\library;(K,foo),(\hole{\cdot};main),\hole{\cdot};\comp;\memstate\triangleright e_{foo}[{\color{black}\mmlAmmlAtbackv[]{\valueexpr_{0}}}/y]}{\nat}$
  \end{passumptions}
  Using \Cref{asm:backtranscorr:backtrans:ret1}:
  \begin{passumptions}{H}
    \setcounter{enumi}{57}
    \item\label[ass]{asm:backtranscorr:Kshape} $\src{K}=\src{\hole{\cdot};delete\ z;\src{K_{r}}[}\mmlAmmlAtbackv[]{\valueexpr_{1}}\src{]}$
  \end{passumptions}

  Use \Cref{asm:backtranscorr:staterel1,asm:backtranscorr:comptypchecks,asm:backtranscorr:exect3} to apply \Thmref{lem:component:correctness}:
  \begin{passumptions}{H}
    \setcounter{enumi}{59}
    \item\label[ass]{asm:backtranscorr:deltasubs0} $\delta\subseteq\delta'$
    \item\label[ass]{asm:backtrans:execs3} $\execsn[^{n_{3}'}]{foo,\hole{\cdot};\library;(K;foo),(\hole{\cdot};main),\hole{\cdot};\comp;\memstate}{e_{foo}[\valueexpr_{0}/y]}{foo,\hole{\cdot};\library;(K;foo),(\hole{\cdot};main),\hole{\cdot};\comp;\memstate'}{K_{c}[return\ \valueexpr_{1}]}{\trace[_{comp}]}$
    \item\label[ass]{asm:backtranscorr:staterel2} $\xlangstateeq[\delta';\src{L}]{foo,\hole{\cdot};\library;(K;foo),(\hole{\cdot};main),\hole{\cdot};\comp;\memstate'}{foo,\hole{\cdot};\library;(K;foo),\kontstack,(\hole{\cdot};main),\hole{\cdot};\comp;H^{\ctx}_{0};H^{\comp}_{0};\Delta_{1}}$
    \item\label[ass]{asm:backtrans:ttraceeq3} $\xlangtraceeq[\delta';\src{X}]{\trace[_{comp}]}{\trace[_{comp}]}$
  \end{passumptions}

  By transitivity, we can split \Cref{asm:backtranscorr:exect3a} arbitrarily:
  \begin{passumptions}{H}
    \setcounter{enumi}{63}
    \item\label[ass]{asm:backtranscorr:exect4} $\exect[]{foo,\hole{\cdot};\library;(K;foo),\kontstack,(\hole{\cdot};main),\hole{\cdot};\comp;\memstate'}{K_{c}[return\ \valueexpr_{1}]}{foo,\hole{\cdot};\library;\kontstack,(\hole{\cdot};main),\hole{\cdot};\ctx;\memstate'}{K[\valueexpr_{1}]}{Ret\ \comptoctx\ \valueexpr_{1}}$
    \item\label[ass]{asm:backtranscorr:exect4a} $\exect{foo,\hole{\cdot};\library;\kontstack,(\hole{\cdot};main),\hole{\cdot};\ctx;\memstate'}{K[\valueexpr_{1}]}{\Omega'}{\finalexprnoerr}{\trace_{e}}$
    \item\label[ass]{asm:backtranscorr:traceeq3} $\trg{\trace[_{d}]}=\trg{Ret\ \comptoctx\ \valueexpr_{1}\cdot\trace[_{e}]}$
  \end{passumptions}
  Remember that $\mmlAmmlAtcomp{e_{foo}}=\trg{e_{foo}}$, so:
  \begin{passumptions}{H}
    \setcounter{enumi}{66}
    \item\label[ass]{asm:backtranscorr:kontcomp} $\mmlAmmlAtcomp{K_{c}}=\trg{K_{c}}$.
  \end{passumptions}
  Using \Cref{asm:backtranscorr:deltadef,asm:backtranscorr:deltasubs0}:
  \begin{passumptions}{H}
    \setcounter{enumi}{67}
    \item\label[ass]{asm:backtranscorr:deltaprimeloc} $\delta'(\src{\loc}) = \trg{\loc}$
  \end{passumptions}

  We are ready to apply \Thmref{lem:exprbacktranslation:beg:wrapper:correct} with \Cref{asm:backtranscorr:liblink,asm:backtranscorr:rellibdom,asm:backtranscorr:exect4,asm:backtranscorr:backtrans:ret1,asm:backtranscorr:staterel2,asm:backtranscorr:kontcomp,asm:backtranscorr:Kshape,asm:backtranscorr:deltaprimeloc,asm:backtranscorr:gamedef,asm:backtranscorr:locinL}:
  \begin{passumptions}{H}
    \setcounter{enumi}{68}
    \item $\src{X'}=\src{X}\cup\{\src{Dealloc\ \loc}\}$
    \item\label[ass]{asm:backtrans:execs4} $\execsn[^{n_{4}'}]{foo,\hole{\cdot};\library;(K;foo),(\hole{\cdot};main),\hole{\cdot};\comp;\memstate'}{K_{c}[return\ \valueexpr_{1}]}{foo,\hole{\cdot};\library;(\hole{\cdot};main),\hole{\cdot};\ctx;\memstate'}{K[\valueexpr_{1}]}{\trace[_{2}]}$
    \item\label[ass]{asm:backtranscorr:backstaterel2} $\xlangbackstateeq[\delta';\src{X'}]{foo,\hole{\cdot};\library;\kontstack,(\hole{\cdot};main),\hole{\cdot};\ctx;\memstate'}{foo,\hole{\cdot};\library;(\hole{\cdot};main),\hole{\cdot};\ctx;\memstate'}$
    \item\label[ass]{asm:backtrans:ttraceeq4} $\xlangtraceeq[\delta';\src{L}]{\trace[_{2}]}{Ret\ \comptoctx\ \valueexpr_{1}}$
  \end{passumptions}

  By transitivity, we can split \Cref{asm:backtranscorr:exect4a} arbitrarily, noting that the immediate next action after $\trg{\trace[_{1}]}$ is $\trg{End\ \valueexpr_{2}}$.
  So, let $n_{5}$ be such that:
  \begin{passumptions}{H}
    \setcounter{enumi}{72}
    \item\label[ass]{asm:backtranscorr:exect5} $\exect[^{n_{5}}]{foo,\hole{\cdot};\library;\kontstack,(\hole{\cdot};main),\hole{\cdot};\ctx;\memstate'}{K[\valueexpr_{1}]}{foo,\hole{\cdot};\library;(\hole{\cdot};main),\hole{\cdot};\ctx;\memstate''}{K_{e}[\valueexpr_{2}]}{\trace[_{1}]}$
    \item\label[ass]{asm:backtranscorr:exect5a} $\exect{foo,\hole{\cdot};\library;(\hole{\cdot};main),\hole{\cdot};\ctx;\memstate''}{K_{e}[\valueexpr_{2}]}{\Omega'}{\finalexprnoerr}{End\ \valueexpr_{2}}$
    \item\label[ass]{asm:backtranscorr:traceeq4} $\trg{\trace[_{e}]}=\trg{\trace[_{1}]\cdot End\ \valueexpr_{2}}$
  \end{passumptions}

  With \Cref{asm:backtranscorr:liblink,asm:backtranscorr:rellibdom,asm:backtranscorr:exect5,asm:backtranscorr:backtrans:mid1,asm:backtranscorr:nonint1,asm:backtranscorr:backstaterel2,asm:backtrans:correct:links}, we can use \Thmref{lem:exprbacktranslation:mid:wrapper:correct} to obtain:
  \begin{passumptions}{H}
    \setcounter{enumi}{75}
    \item\label[ass]{asm:backtrans:execs5} $\execsn[^{n_{5}'}]{foo,\hole{\cdot};\library;\kontstack,(\hole{\cdot};main),\hole{\cdot};\ctx;\memstate'}{K[\valueexpr_{1}]}{\commlib;\library;(\hole{\cdot};main),\hole{\cdot};\ctx;\memstate'}{K_{e}\hole{42}}{\trace[_{3}]}$
    \item\label[ass]{asm:backtrans:correct:backstaterel3} $\xlangbackstateeq[\delta';\emptyset]{foo,\hole{\cdot};\library;(\hole{\cdot};main),\hole{\cdot};\ctx;\memstate''}{\commlib;\library;(\hole{\cdot};main),\hole{\cdot};\ctx;\memstate'}$
    \item\label[ass]{asm:backtrans:ttraceeq5} $\src{\trace[_{3}]}\thexlangtraceeq[\delta';\emptyset]\trg{\trace[_{1}]}$
  \end{passumptions}

  Let:
  \begin{passumptions}{H}
    \setcounter{enumi}{78}
    \item\label[ass]{asm:backtrans:corr:slocfresh} $\fresh{\Game,\delta'}{\src{\loc'}}$
    \item\label[ass]{asm:backtrans:corr:zfresh} $\fresh{\Game}{\src{w}}$
    \item\label[ass]{asm:backtrans:corr:tloc} $\fresh{\delta}{\trg{\loc'}}$
    \item\label[ass]{asm:backtrans:corr:indelta} $\delta''=\delta'\cup\{\src{\loc'}\mapsto\trg{\loc'}\}$
    \item\label[ass]{asm:backtrans:corr:ingame} $\Game'=\Game\cup\{\src{\loc'}\mapsto\src{w}\}$
  \end{passumptions}

  Finally, use \Thmref{lem:exprbacktranslation:vend:wrapper:correct} with \Cref{asm:backtranscorr:liblink,asm:backtranscorr:rellibdom,asm:backtranscorr:exect5a,asm:backtranscorr:backtrans:end,asm:backtrans:correct:backstaterel3,asm:backtrans:corr:slocfresh,asm:backtrans:corr:zfresh,asm:backtrans:corr:tloc,asm:backtrans:corr:indelta,asm:backtrans:corr:ingame} to acquire:
  \begin{passumptions}{H}
    \setcounter{enumi}{78}
    \item $\src{L'}=\src{L}\cup\{\src{\loc'}\}$
    \item $\src{X''}=\src{X'}\cup\{\src{Alloc\ \loc'\ 42},\src{Dealloc\ \loc'}\}$
    \item\label[ass]{asm:backtrans:execs6} $\execsn[^{n_{6}'}]{foo,\hole{\cdot};\library;(\hole{\cdot};main),\hole{\cdot};\ctx;\memstate''}{K_{e}[42]}{\commlib;\library;\hole{\cdot};\ctx;\memstate''}{\valueexpr_{2}}{\trace_{4}}$
    \item\label[ass]{asm:backtrans:staterelfinal} $\xlangstateeq[\delta'';\src{L'}]{\commlib;\library;\hole{\cdot};\ctx;\memstate''}{foo,\hole{\cdot};\library;\hole{\cdot};\ctx;\memstate''}$
    \item\label[ass]{asm:backtrans:ttraceeq6} $\src{\trace_{4}}\thexlangtraceeq[\delta'';\src{X''}]\trg{End\ \valueexpr_{2}}$
  \end{passumptions}

  Finally, instantiate the existentials in our goals as follows:
  \begin{passumptions}{H}
    \setcounter{enumi}{83}
    \item $\delta_{e}=\delta''$
    \item $\src{L_{e}}=\src{L'}$
    \item $\src{X_{e}}=\src{X''}$
    \item $\src{\Omega'_{e}}=\src{\commlib;\library;\hole{\cdot};\ctx;\memstate''}$
    \item $\src{\trace_{e}}=\src{Start;\comp\cdot\trace[_{0}]\cdot\trace[_{1}]\cdot\trace[_{\comp}]\cdot\trace[_{2}]\cdot\trace[_{3}]\cdot\trace[_{4}]}$
  \end{passumptions}

  We solve \Cref{goal:backtrans:correct:execs} by transitivity, making use of \Cref{asm:backtrans:execs0,asm:backtrans:execs1,asm:backtrans:execs2,asm:backtrans:execs3,asm:backtrans:execs4,asm:backtrans:execs5,asm:backtrans:execs6} and \Thmref{lem:execsn:yields:execs}.

  \Cref{goal:backtrans:correct:stateeq} by \Cref{asm:backtrans:staterelfinal}.

  Lastly, \Cref{goal:backtrans:correct:traceeq} by transitivity, making use of \Cref{asm:backtrans:ttraceeq0,asm:backtrans:ttraceeq1,asm:backtrans:ttraceeq2,asm:backtrans:ttraceeq3,asm:backtrans:ttraceeq4,asm:backtrans:ttraceeq5,asm:backtrans:ttraceeq6}.
\end{proof}

\begin{definition}[$\mmlAs$ Robust Satisfaction]
  We write $\src{\library_{\comp}}\vDash_{R}\pi$ for
  If
  \begin{assumptions}
    \item $\wexecs{prog\ \library_{\ctx}\ \library_{\comp}}{\Omega}{\finalexpr}{\trace}$
  \end{assumptions}
  Then $\exists \delta_{MS}$
  \begin{goals}
    \item $\tospecificevs[_{\delta_{MS}}]{\trace}\in\pi$
  \end{goals}
\end{definition}

\begin{definition}[$\mmlAt$ Robust Satisfaction]
  We write $\trg{\library_{\comp}}\vDash_{R}\pi$ for
  If
  \begin{assumptions}
    \item $\wexect{prog\ \library_{\ctx}\ \library_{\comp}}{\Omega}{\finalexpr}{\trace}$
  \end{assumptions}
  Then $\exists \delta_{MS}$
  \begin{goals}
    \item $\tospecificevt[_{\delta_{MS}}]{\trace}\in\pi$
  \end{goals}
\end{definition}

\begin{scontents}[store-env=buffer]
  $\;$\\
%  If
%  \begin{assumptions}
%  \item\label[ass]{asm:rtmsp:srctms} $\forall \delta_{MS}\ \src{\library_{ctx}}\ \src{\library_{comp}}\ \src{\trace}\ \src{\Omega}\ \src{v}, \wexecs{prog\ \library_{ctx}\ \library_{comp}}{\configs}{\finalexpr}{\trace}\rightarrow\tospecificevs[_{\delta_{MS}}]{\trace}\in\operatorname{tmsafe}$
%  \item\label[ass]{asm:rtmsp:trgexec} $\wexec{\trg{prog\ \library_{ctx}\ }\mmlAmmlAtcomp{\library_{comp}}}{\trg{\configt}}{\trg{\finalexpr}}{\trg{\trace}}$
%  \end{assumptions}
%  then
  \begin{goals}
    \item $\vdash\mmlAmmlAtcomp{\bullet}:\lceil\operatorname{tmssafe}\rceil$
%    \item $\mmlAmmlAtcomp{\library_{\ctx}}\vDash_{R}\pi$
%    \item\label[goal]{rtmsp:tms} $\tospecificevt[_{\delta_{MS}'}]{\trace}\in\operatorname{tmsafe}$
  \end{goals}
\end{scontents}

\realthm{thm:rtmsp}{4}{Robust \gls{tms} Preservation}
\begin{proof}
  Unfolding the definition:
  If
  \begin{assumptions}
    \item $\pi\in\lceil\operatorname{tmssafe}\rceil$
    \item $\src{\library_{\comp}}\vDash_{R}\pi$
  \end{assumptions}
  then
  \begin{goals}
    \item\label[ass]{asm:rtmsp:rsatt} $\mmlAmmlAtcomp{\library_{\comp}}\vDash_{R}\pi$
  \end{goals}
  Unfold \Cref{asm:rtmsp:rsatt}:
  If
  \begin{passumptions}{F}
    \item\label[ass]{asm:rtmsp:trgexec} $\wexec{\trg{prog\ \library_{\ctx}\ }\mmlAmmlAtcomp{\library_{\comp}}}{\trg{\Omega}}{\trg{\finalexpr}}{\trace}$
  \end{passumptions}
  then $\exists \delta_{\text{MS}}$
  \begin{goals}
    \item $\tospecificevt[_{\delta_{\text{MS}}}]{\trace}\in\pi$
  \end{goals}
  Suppose $\trg{\finalexpr}=\trg{\valueexpr}$.%\MK{take care of fail}
  Invert \Cref{asm:rtmsp:trgexec}:
  \begin{passumptions}{H}
    \item\label[ass]{asm:rtmsp:liblink} $\trg{\library}=\trg{\library_{ctx}\linker}\mmlAmmlAtcomp{\library_{comp}}$
    \item $\trg{main}\notin\trg{\commlib}$
    \item $\trg{\commlib}=\operatorname{dom}\ \mmlAmmlAtcomp{\library_{comp}}$
    \item\label[ass]{rtmsp:runt} $\exec{\mmlAmmlAtcomp{\commlib}\trg{;\library;\emptyset;\comp;\emptyset;\emptyset;\emptyset}}{\trg{call\ main\ 0}}{\trg{\Omega}}{\trg{\valueexpr}}{\trg{\trace}}$
  \end{passumptions}

  We backtranslate:
  \begin{passumptions}{H}
    \setcounter{enumi}{4}
    \item\label[ass]{asm:rtmsp:backtrans} $\mmlAmmlAtback[\emptyset;\emptyset]{\trg{\trace}}=\Game;\delta;\src{let\ main\ z\ := e},\src{\hole{\cdot}}$.
  \end{passumptions}
  Invert \Cref{asm:rtmsp:backtrans}, so we can decompose $\trg{\trace}$ into\\$\trg{Start\cdot\trace[^{ctx}_{0}]\cdot Call\ \ctxtocomp\ foo\ n\cdot\trace[^{comp}]\cdot Ret\ \comptoctx\ m\cdot\trace[^{ctx}_{1}]\cdot End\ n'}$ such that $\vdash\trg{\trace[^{comp}]}\ \operatorname{non-int-\trg{trace}}$, $\vdash\trg{\trace[^{ctx}_{0}]}\ \operatorname{non-int-\trg{trace}}$, and $\vdash\trg{\trace[^{ctx}_{1}]}\ \operatorname{non-int-\trg{trace}}$.%\MK{use backtrans correctness!!}



  By \Thmref{lem:mslocgen} using $\operatorname{dom}\delta$, there is a $\delta_{MS}:\src{\bullet}\to\specificev{\bullet}$ injective.

  Instantiate the goal:
  \begin{passumptions}{H}
    \setcounter{enumi}{5}
    \item $\delta_{MS}' : \trg{\bullet}\to\specificev{\bullet}, \trg{\loc}:\trg{L}\mapsto \delta_{MS}(\delta^{-1}(\trg{\loc}))$
  \end{passumptions}

  From the shape of the trace $\trg{\trace}$, $\trg{foo}\in\mmlAmmlAtcomp{\library_{comp}}$.

  So $\src{foo}\in\src{\library_{comp}}$ and $\trg{main}\in\trg{\library_{ctx}}$.

  Let $\src{\library_{ctx}}=(\src{let\ main\ z\ := e})\src{,\hole{\cdot}}$.

  Let $\src{\library} = \src{\library_{ctx}\linker\library_{comp}}$ which follows by inverting \Cref{asm:rtmsp:liblink}.

  Let $\src{\Gamma_0}=\src{\library}\downarrow$ and note that $\src{main}\in\operatorname{dom}\src{\Gamma_0}$.

  We need to verify that $\src{\Gamma_0}\vdash\src{\library}\operatorname{ok}$ to conclude $\vdash\src{prog\ \library_{ctx}\ \library_{comp}}\dashv\src{\library},\operatorname{dom}\src{\library_{comp}}$.
  This follows from \Thmref{lem:backtranslation:welltyped}.

  By \Cref{tr:state-eq,tr:empty-memstate-eq,tr:cfstate-eq,tr:empty-commlib-eq,tr:cons-commlib-eq,tr:empty-kontstack-eq}, we have $\xlangstateeq{\commlib;\library;\emptyset;\comp;\emptyset;\emptyset;\emptyset}{{\color{black}\mmlAmmlAtcomp{\commlib}};\library;\emptyset;\comp;\emptyset;\emptyset;\emptyset}$.

  Finally, use \Thmref{lem:msfiltereq}, whose assumptions are satisfied by the results we got from applying backtranslation correctness.
\end{proof}

\myfig{
  \begin{center}
    \begin{tikzpicture}[state/.style={minimum height=0.6cm}]
      % relative horizontal/vertical distance between states
      \pgfmathsetmacro{\hdist}{0.85}
      \pgfmathsetmacro{\vdist}{1.25}
      \pgfmathsetmacro{\halfvdist}{0.625}

      % row of src states
      \node[state] (srcempty) {$\src{\emptyset}$};
      \foreach \s [remember=\s as \cur (initially empty)] in {1,w_1,p,w_2,2} {
        \node[state,right=\hdist of src\cur] (src\s) {$\src{\Omega_{\s}}$};
      }
      % row of trg states
      \node[state,below=\vdist of srcempty] (trgempty) {$\trg{\emptyset}$};
      \foreach \s in {1,w_1,p,w_2,2} {
        \node[state,below=\vdist of src\s] (trg\s) {$\trg{\Omega_{\s}}$};
      }
      %% illustrations
        % backtrans wrapper 1
        \draw[thick,loosely dotted,Peach!50,rounded corners] (src1.north east) -- (srcw\string_1.north east)
          -- (trgw\string_1.south east) -- (trg1.south west) -- (src1.north west) -- cycle;
        % backtrans wrapper 2
        \draw[thick,loosely dotted,Peach!50,rounded corners] (srcp.north east) -- (srcw\string_2.north east)
          -- (trgw\string_2.south east) -- (trgp.south west) -- (srcp.north west) -- cycle;
        % compiler correctness
        \draw[thick,loosely dashed,Emerald!50,rounded corners] ($(srcw\string_1.north east)+(0,0.05)$) -- ($(srcp.north east)+(0,0.05)$)
          -- ($(trgw\string_2.north east)+(0.05,0)$) -- ($(trgw\string_2.south east)+(0.05,-0.05)$)
          -- ($(trg1.south west)+(-0.05,-0.05)$) -- ($(trg1.north west)+(-0.05,0)$) -- ($(srcw\string_1.north west)+(0,0.05)$) -- cycle;
      % state relations
      \path (srcempty) edge[draw=gray!25] node[pos=0.5,sloped,rotate=180,fill=white] {\scriptsize$\multimap_\emptyset$} (trgempty)
        (src1) edge[draw=gray!25] node[pos=0.5,sloped,rotate=180,fill=white] {\scriptsize$\multimap_{\delta_1}$} (trg1)
        (srcp) edge[draw=gray!25] node[pos=0.5,sloped,fill=white] {\scriptsize$\approx_{\delta_p}$} (trgp)
        (src2) edge[draw=gray!25] node[pos=0.5,sloped,rotate=180,fill=white] {\scriptsize$\multimap_{\delta_2}$} (trg2)
        (srcw\string_1) edge[draw=gray!25] node[pos=0.5,sloped,fill=white] {\scriptsize$\approx_{\delta_{w_1}}$} (trgw\string_1)
        (srcw\string_2) edge[draw=gray!25] node[pos=0.5,sloped,rotate=180,fill=white] {\scriptsize$\multimap_{\delta_{w_2}}$} (trgw\string_2)
        % diagonals
        (srcw\string_1) edge[draw=gray!25] node[pos=0.16,sloped,rotate=180,fill=white] {\scriptsize$\approx_{\delta_{w_1}}$} (trg1)
        (src1) edge[draw=gray!25] node[pos=0.16,sloped,rotate=180,fill=white] {\scriptsize$\multimap_{\delta_1}$} (trgw\string_1)
        (srcp) edge[draw=gray!25] node[pos=0.2,sloped,fill=white] {\scriptsize$\approx_{\delta_p}$} (trgw\string_2)
        (trgp) edge[draw=gray!25] node[pos=0.2,sloped,fill=white] {\scriptsize$\multimap_{\delta_{w_2}}$} (srcw\string_2)
        ;
      %\drawpolygon src1,srcw\string_1,trgw\string_1,trg1;
      %\drawpolygon srcp,srcw\string_2,trgw\string_2,trgp;
      %\node[font=\tiny,align=center,above=0.2 of srcw1srcp] (wrapper) {Backtranslation\\Wrapper};
      %\path[->,draw] (wrapper) -- (srcw\string_1);
      %\path[->,draw] (wrapper) -- (srcp);
      % steps
      \path[color=\stlccol] (srcempty) edge[draw=none] node {\ $\xrightarrow{\trace[_1]}{}{\kern-3.5pt}_{\text{ctx}}^*$} (src1)
        (src1) edge[draw=none] node {\ $\xrightarrow{\trace[_c]}{}{\kern-3.5pt}_{\text{ctx}}$} (srcw\string_1)
        (srcw\string_1) edge[draw=none] node {\ $\xrightarrow{\trace[_p]}{}{\kern-3.5pt}_{\text{ctx}}^*$} (srcp)
        (srcp) edge[draw=none] node[fill=white,inner sep=0,outer sep=0] {\ $\xrightarrow{\trace[_r]}{}{\kern-3.5pt}_{\text{ctx}}$} (srcw\string_2)
        (srcw\string_2) edge[draw=none] node {\ $\xrightarrow{\trace[_2]}{}{\kern-3.5pt}_{\text{ctx}}^*$} (src2)
        ;
      \path[color=\ulccol] (trgempty) edge[draw=none] node[fill=white,inner sep=0,outer sep=0] {\ $\xrightarrow{\phantom{\trace[_1]}}{}{\kern-3.5pt}_{\text{ctx}}^*$} (trg1)
        (trg1) edge[draw=none] node {\ $\xrightarrow{\phantom{\trace[_p]}}{}{\kern-3.5pt}_{\text{ctx}}^*$} (trgw\string_1)
        (trgw\string_1) edge[draw=none] node[fill=white,inner sep=0,outer sep=0] {\ $\xrightarrow{\phantom{\trace[_p]}}{}{\kern-3.5pt}_{\text{ctx}}^*$} (trgp)
        (trgp) edge[draw=none] node {\ $\xrightarrow{\phantom{\trace[_p]}}{}{\kern-3.5pt}_{\text{ctx}}^*$} (trgw\string_2)
        (trgw\string_2) edge[draw=none] node {\ $\xrightarrow{\phantom{\trace[_2]}}{}{\kern-3.5pt}_{\text{ctx}}^*$} (trg2)
        ;
      % legend
      \node[align=left,below right=0.3 and 0.3 of trgempty,font=\tiny] (legend) {%
        $\xlangtraceeqn{\src{\trace[_c]}}{\mmlAmmlAtback[]{Call\ ?\finalexprnoerr_i}}$\\%
        $\xlangtraceeqn{\src{\trace[_r]}}{\mmlAmmlAtback[]{Ret\ !\finalexprnoerr_o}}$
        };
      \draw[thick,loosely dotted,Peach!50,rounded corners] ($(legend.north east)+(0.5,-0.4)$) -- ($(legend.north east)+(1,-0.4)$);
      \node at ($(legend.north east)+(1.5,-0.4)$) (legendwrapper) {};
      \node[right of=legendwrapper] {\tiny Backtranslation Wrapper};
      \draw[thick,loosely dashed,Emerald!50,rounded corners] ($(legend.south east)+(0.5,0.2)$) -- ($(legend.south east)+(1,0.2)$);
      \node at ($(legend.south east)+(1.5,0.2)$) (legendcorrectness) {};
      \node[right of=legendcorrectness] {\tiny Compiler Correctness};
    \end{tikzpicture}
  \end{center}
}{rtmsp-sketch}{Sketch of the proof of \Thmref{thm:rtmsp}. %
  Arrows in the horizontal direction are the usual step relations, but the term is omitted for clarity. %
  Likewise for the emitted target-level traces. %
  Trace $\src{\trace[_1]}$ starts with $\src{Start}$ and $\src{\trace[_2]}$ ends with $\src{End\ \valueexpr}$, where $\src{\valueexpr}$ is the final result of the program. %
  Target states $\trg{\Omega_1}$ and $\trg{\Omega_{w_1}}$ are exactly equal, so are $\trg{\Omega_p}$ and $\trg{\Omega_{w_2}}$. They are drawn for aesthetic purposes.}

\clearpage

\subsection{Robust SMS Preserving Compiler}\label{subsec:rsms}

For instrumented $\mmlAt$ code, we'll write $\mmlAtms$.
The syntax and semantics are entirely identical.

\subsubsection{Translation to Specification Events}

\myfig{
  \begin{center}
    \judgbox{\delta_{MS}(\trg{\loc})=\specificev{\loc}}{,,Map $\mmlAt$ locations $\trg{\loc}$ to abstract locations $\specificev{\loc}$.''}
    \judgbox{\storeagreesms{\smsmonitor}{\trg{\Delta}}}{,,Abstract memory state $\tmsmonitor$ describes the concrete state $\trg{\Delta}$.''}
    \typerule{SMS-Empty-Agree}{
    }{
      \storeagreesms{\emptyset}{\trg{\hole{\cdot}}}
    }{sms-store-empty-agree}
    %
    \typerule{SMS-Abort-Agree}{
    }{
      \storeagreesms{\emptyset}{\trg{\lightning}}
    }{sms-store-abort-agree}
    %
    \typerule{SMS-Cons-Agree}{
      \delta_{MS}(\trg{\loc})=\specificev{\loc}&
      \specificev{\loc}\notin\smsmonitor&
      \storeagreesms{\smsmonitor}{\trg{\Delta}}
    }{
      \storeagreesms{\left\{\left(\specificev{\loc},\bm{m}\right)\right\}\cup \smsmonitor}{\trg{x\mapsto(\loc;\comp;\poison;n),\Delta}}
    }{sms-store-cons-agree}
    %
    \typerule{SMS-Ignore-Agree}{
      \storeagreesms{\smsmonitor}{\trg{\Delta}}
    }{
      \storeagreesms{\smsmonitor}{\trg{x\mapsto(\loc;\ctx;\poison;n),\Delta}}
    }{sms-store-ignore-agree}
  \end{center}
}{sms-store-agreement}{Store Agreement.}

\myfig{
  \begin{center}
    \judgbox{\delta_{MS}(\trg{\loc})=\specificev{\loc}}{,,A map from $\mmlAt$ memory locations $\trg{\loc}$ to specification locations $\specificev{\loc}$.''}
    \judgbox{\tospecificevt[_{\delta_{MS}}]{\event} = \msevent}{,,Project an $\mmlAt$ event to specification events.''}
    %
    \typerule{t-filter-context}{
      \trg{\event_b} \not= \trg{\lightning}
    }{
      \tospecificevt[_{\delta_{MS}}]{\event_b;\ctx} = \specificev{\emptyevent}
    }{t-filter-context}
    %
    \typerule{t-filter-comp-start}{
    }{
      \tospecificevt[_{\delta_{MS}}]{Start;\comp} = \specificev{\emptyevent}
    }{t-filter-comp-start}
    %
    \typerule{t-filter-comp-alloc}{
      \delta_{MS}(\trg{\loc})=\specificev{\loc} &
      \specificev{n}=\trg{n}
    }{
      \tospecificevt[_{\delta_{MS}}]{Alloc\ \loc\ n;\comp} = \specificev{Alloc\ \loc\ n}
    }{t-filter-comp-alloc}
    %
    \typerule{t-filter-comp-dealloc}{
      \delta_{MS}(\trg{\loc})=\specificev{\loc}
    }{
      \tospecificevt[_{\delta_{MS}}]{Dealloc\ \loc;\comp} = \specificev{Dealloc\ \loc}
    }{t-filter-comp-dealloc}
    %
    \typerule{t-filter-comp-get}{
      \delta_{MS}(\trg{\loc})=\specificev{\loc} &
      \specificev{n}=\trg{n}
    }{
      \tospecificevt[_{\delta_{MS}}]{Get\ \loc\ n;\comp} = \specificev{Use\ \loc\ n}
    }{t-filter-comp-get}
    %
    \typerule{t-filter-comp-set}{
      \delta_{MS}(\trg{\loc})=\specificev{\loc} &
      \specificev{n}=\trg{n}
    }{
      \tospecificevt[_{\delta_{MS}}]{Set\ \loc\ n\ \valueexpr;\comp} = \specificev{Use\ \loc\ n}
    }{t-filter-comp-set}
    %
    \typerule{t-filter-comp-call}{
    }{
      \tospecificevt[_{\delta_{MS}}]{Call\ \comm\ foo\ \valueexpr;\comp} = \specificev{\emptyevent}
    }{t-filter-comp-call}
    %
    \typerule{t-filter-comp-ret}{
    }{
      \tospecificevt[_{\delta_{MS}}]{Ret\ \comm\ \valueexpr;\comp} = \specificev{\emptyevent}
    }{t-filter-comp-ret}
    %
    \typerule{t-filter-abort}{
    }{
      \tospecificevt[_{\delta_{MS}}]{\lightning;\sandboxtag} = \specificev{\lightning}
    }{t-filter-abort}
    %
    \judgbox{\tospecificevt[^*_{\delta_{MS}}]{\trace} = \mstrace}{,,Project an $\mmlAt$ trace to specification traces.''}
    %
    \typerule{t-filter-empty}{
    }{
      \tospecificevt[^*_{\delta_{MS}}]{\hole{\cdot}} = \specificev{\hole{\cdot}}
    }{t-filter-empty}
    %
    \typerule{t-filter-cons-relevant}{
      \tospecificevt[_{\delta_{MS}}]{\event} = \specificev{\event} &
      \tospecificevt[^*_{\delta_{MS}}]{\trace} = \mstrace &
      \specificev{\event} \not= \specificev{\emptyevent}
    }{
      \tospecificevt[^*_{\delta_{MS}}]{\event\cdot\trace} = \specificev{\event}\cdot\mstrace
    }{t-filter-cons-relevant}
    %
    \typerule{t-filter-cons-relevant}{
      \tospecificevt[_{\delta_{MS}}]{\event} = \specificev{\emptyevent} &
      \tospecificevt[^*_{\delta_{MS}}]{\trace} = \mstrace
    }{
      \tospecificevt[^*_{\delta_{MS}}]{\event\cdot\trace} = \mstrace
    }{t-filter-cons}
  \end{center}
}{wt-events-project-to-specific}{Projection of $\mmlAt$ events to specification events.}

\subsubsection{Compiler}

\myfig{
  \begin{center}
    \begin{gather*}
    \judgbox{\mmlAtmmlAtmscomp{e}=\irl{e'}}{,,Compile $\mmlAt$ expression $\trg{e}$ to $\mmlAt$ expression $\irl{e'}$.''}\\
    \judgbox{\mmlAtmmlAtmscomp{\left[\valueexpr / x\right]}=\irl{\left[\valueexpr / x\right]}}{,,Compile $\mmlAt$ substitution to $\mmlAtms$ substitution.''} \\
    \judgbox{\mmlAtmmlAtmscomp{\commlib}=\irl{\commlib'}}{,,Compile $\mmlAt$ component library to $\mmlAtms$ component library.''} \\
    \end{gather*}
    $$
    \begin{array}{rll}
    \mmlAtmmlAtmscomp{\finalexpr} &\ = & \irl{\finalexpr} \\
    \mmlAtmmlAtmscomp{call\ foo\ e} &\ = & \irl{call\ }\mmlAtmmlAtmscomp{foo}\ \mmlAtmmlAtmscomp{e}\\
    \mmlAtmmlAtmscomp{return\ e} &\ = & \irl{return\ }\mmlAtmmlAtmscomp{e}\\
    \mmlAtmmlAtmscomp{e_1\oplus e_2} &\ = & \mmlAtmmlAtmscomp{e_1} \irl{\oplus} \mmlAtmmlAtmscomp{e_2} \\
      \mmlAtmmlAtmscomp{x[e]} &\ = & \irl{let\ x_{ACCESS}=}\mmlAtmmlAtmscomp{e}\irl{\ in\ }\\
                                &&\irl{ifz\ 0\le x_{ACCESS}<x_{SIZE}\ then}\\&&\ \ \irl{x[x_{ACCESS}]}\\
                                && \irl{else\ abort()}\\
    \mmlAtmmlAtmscomp{let\ x= e_1\ in\ e_2} &\ = & \irl{let\ x=} \mmlAtmmlAtmscomp{e_1}\irl{\ in\ }\mmlAtmmlAtmscomp{e_2} \\
      \mmlAtmmlAtmscomp{x[e_1]\leftarrow e_2} &\ = & \irl{let\ x_{ACCESS}=}\mmlAtmmlAtmscomp{e_1}\irl{\ in\ }\\
      &&\irl{ifz\ 0\le x_{ACCESS}<x_{SIZE}\ then}\\&&\ \ \irl{x[x_{ACCESS}]\leftarrow }\mmlAtmmlAtmscomp{e_2} \\
      &&\irl{else\ abort()} \\
    \mmlAtmmlAtmscomp{let\ x=new\ e_1\ in\ e_2} &\ = & \irl{let\ x_{\texttt{SIZE}}=}\mmlAtmmlAtmscomp{e_1}\irl{\ in\ }\\&&\irl{let\ x}\irl{=new\ x_{\texttt{SIZE}}}\irl{\ in\ }\mmlAtmmlAtmscomp{e_2} \\
    \mmlAtmmlAtmscomp{delete\ x} &\ = & \irl{delete\ x} \\
    \mmlAtmmlAtmscomp{x\ is\ \poisoned} &\ = & \irl{x\ is\ \poisoned} \\
    \mmlAtmmlAtmscomp{\lparen e_1;e_2\rparen} &\ = & \irl{\lparen}\mmlAtmmlAtmscomp{e_1}\irl{;}\mmlAtmmlAtmscomp{e_2}\irl{\rparen}\\
    \mmlAtmmlAtmscomp{\pi_1\ e} &\ = & \irl{\pi_1\ }\mmlAtmmlAtmscomp{e}\\
    \mmlAtmmlAtmscomp{\pi_2\ e} &\ = & \irl{\pi_2\ }\mmlAtmmlAtmscomp{e}\\
    \mmlAtmmlAtmscomp{e\ has\ \type} &\ = & \mmlAtmmlAtmscomp{e}\ \irl{has\ \type}\\
    \mmlAtmmlAtmscomp{ifz\ e_1\ then\ e_2\ else\ e_3} &\ = & \irl{ifz\ }\mmlAtmmlAtmscomp{e_1}\\
                                                        &&\irl{then\ }\mmlAtmmlAtmscomp{e_2} \\
                                                        &&\irl{else\ }\mmlAtmmlAtmscomp{e_3} \\[0.5cm]
    %
    \mmlAtmmlAtmscomp{\left[\valueexpr/x\right]}&\ = & \irl{\left[\right.}\mmlAtmmlAtmscomp{v}\irl{/}\mmlAtmmlAtmscomp{x}\irl{\left.\right]} \\[0.5cm]
    %
    \mmlAtmmlAtmscomp{\hole{\cdot}}&\ = & \irl{\hole{\cdot}} \\
    \mmlAtmmlAtmscomp{foo,\commlib}&\ = & \irl{foo,}\mmlAtmmlAtmscomp{\commlib} \\
    \end{array}
    $$
  \end{center}
}{sms-pres-compiler}{Compiler from $\mmlAt$ to $\mmlAtms$.}
\myfig{
  \begin{center}
    \begin{gather*}
    \judgbox{\mmlAtmmlAtmscomp{F}=\irl{F}}{,,Compile $\mmlAt$ procedures to $\mmlAtms$ procedures.''}
    \end{gather*}
    $$
    \begin{array}{rll}
    %
      \mmlAtmmlAtmscomp{let\ foo\ x := e}&\ = & \irl{let\ foo\ x := }\mmlAtmmlAtmscomp{e}\\
    \end{array}
    $$
    \begin{gather*}
    \judgbox{\mmlAtmmlAtmscomp{\library}=\irl{\library}}{,,Compile $\mmlAt$ libraries to $\mmlAtms$ libraries.''}
    \end{gather*}
    $$
    \begin{array}{rll}
      \mmlAtmmlAtmscomp{\hole{\cdot}}&\ = & \irl{\hole{\cdot}} \\
      \mmlAtmmlAtmscomp{F,\library}&\ = & \mmlAtmmlAtmscomp{F}\irl{,}\mmlAtmmlAtmscomp{\library} \\
    \end{array}
    $$
  \end{center}
}{sms-pres-compiler-comp}{Compiler from $\mmlAt$ components to $\mmlAtms$ components.}
\myfig{
  \begin{center}
    \begin{gather*}
      \judgbox{\mmlAtmmlAtmscomp{K}=\irl{K}}{,,Compile $\mmlAt$ evaluation contexts to $\mmlAtms$ evaluation contexts.''}
    \end{gather*}
    $$
    \begin{array}{rll}
      \mmlAtmmlAtmscomp{\hole{\cdot}} &\ = & \irl{\hole{\cdot}} \\
      \mmlAtmmlAtmscomp{K \oplus e} &\ = & \mmlAtmmlAtmscomp{K}\irl{\oplus}\mmlAtmmlAtmscomp{e} \\
      \mmlAtmmlAtmscomp{\valueexpr \oplus K} &\ = & \mmlAtmmlAtmscomp{\valueexpr}\irl{\oplus}\mmlAtmmlAtmscomp{K} \\
      \mmlAtmmlAtmscomp{x[K]} &\ = & \irl{let\ x_{ACCESS}=}\mmlAtmmlAtmscomp{K}\irl{\ in} \\
                                &&\irl{if\ 0\le x_{ACCESS}<x_{SIZE}\ then}\\
                                &&\ \ \irl{x[x_{ACCESS}]}\\
                                &&\irl{else\ abort()}\\
      \mmlAtmmlAtmscomp{let\ x\ = K\ in\ e} &\ = & \irl{let\ x\ = }\mmlAtmmlAtmscomp{K}\irl{\ in\ }\mmlAtmmlAtmscomp{e} \\
      \mmlAtmmlAtmscomp{x[K] \leftarrow e} &\ = & \irl{let\ x_{ACCESS} = }\mmlAtmmlAtmscomp{K}\irl{\ in}\\
                                &&\irl{if\ 0\le x_{ACCESS}<x_{SIZE}\ then}\\
      &&\ \ \irl{x[x_{ACCESS}]\leftarrow}\mmlAtmmlAtmscomp{e} \\
      &&\irl{else\ abort()} \\
      \mmlAtmmlAtmscomp{x[n] \leftarrow K} &\ = & \irl{if\ 0\le n<x_{SIZE}\ then}\\
      &&\ \ \irl{x[n]\leftarrow }\mmlAtmmlAtmscomp{K} \\
      &&\irl{else\ abort()} \\
      \mmlAtmmlAtmscomp{let\ x\ = new\ K\ in\ e} &\ = & \irl{let\ x_{SIZE}=}\mmlAtmmlAtmscomp{K}\irl{\ in\ }\\
                                &&\irl{let\ x = new\ x_{SIZE}\ in\ }\mmlAtmmlAtmscomp{e} \\
      \mmlAtmmlAtmscomp{ifz\ K\ then\ e_{1}\ else\ e_{2}} &\ = & \irl{ifz\ }\mmlAtmmlAtmscomp{K}\irl{\ then\ }\\
                               &&\ \ \mmlAtmmlAtmscomp{e_{1}}\\
                               &&\irl{else\ }\\
                               &&\ \ \mmlAtmmlAtmscomp{e_{2}} \\
      \mmlAtmmlAtmscomp{call\ foo\ K} &\ = & \irl{call\ foo\ }\mmlAtmmlAtmscomp{K}\\
      \mmlAtmmlAtmscomp{return\ K} &\ = & \irl{return\ }\mmlAtmmlAtmscomp{K}\\
    \end{array}
    $$
  \end{center}
}{sms-pres-compiler-ctx}{Compiling $\mmlAt$ evaluation contexts to $\mmlAtms$ evaluation contexts.}

\myfig{
 \begin{center}
    \typerule{$\irl{\gamma}$-$\irl{x_{SIZE}}$-preserve}{
      \irl{\Delta_1,x\mapsto(\loc;\comp;\poison;m),\Delta_2} \Vdash \irl{\gamma}
    }{
      \irl{\Delta_1,x\mapsto(\loc;\comp;\poison;m),\Delta_2} \Vdash \irl{[m/x_{SIZE}],\gamma}
    }{gamma-xsize-preserve}
    %
    \typerule{$\irl{\gamma}$-$\irl{x_{SIZE}}$-skip}{
      \irl{\Delta} \Vdash \irl{\gamma}
    }{
      \irl{\Delta} \Vdash \irl{[\valueexpr/x],\gamma}
    }{gamma-xsize-skip}
    %
    \typerule{$\irl{\gamma}$-$\irl{x_{SIZE}}$-empty}{
    }{
      \irl{\Delta} \Vdash \irl{\hole{\cdot}}
    }{gamma-xsize-empty}
  \end{center}
}{sms-well-formed-subst}{Well formed $\mmlAtms$ substitutions.}

\myfig{
  \begin{center}
    \typerule{subst-subset-empy}{
    }{
      \trg{\hole{\cdot}}\prec\irl{\hole{\cdot}}
    }{sms-subst-subset-empty}
    %
    \typerule{subst-subset-cons}{
      \trg{x}=\irl{x} &
      \trg{\valueexpr}=\irl{\valueexpr} &
      \trg{\gamma}\prec\irl{\gamma}
    }{
      \trg{[\valueexpr/x],\gamma}\prec\irl{[\valueexpr/x],\gamma}
    }{sms-subst-subset-cons}
    %
    \typerule{subst-subset-$\irl{x_{SIZE}}$}{
      \trg{\gamma}\prec\irl{\gamma}
    }{
      \trg{\gamma}\prec\irl{[\valueexpr/x_{SIZE}],\gamma}
    }{sms-subst-subset-xsize}
  \end{center}
}{sms-substs-subsets}{Cross-Language Substitutions subset.}

\myfig{
  \begin{center}
    \judgbox{\delta_{\sCCT}(\irl{\loc})=\specificev{\loc}}{,,A map from $\mmlAtms$ memory locations $\irl{\loc}$ to specification locations $\specificev{\loc}$.''}
    \judgbox{\tospecificevi[_{\delta_{\sCCT}}]{\event} = \scctevent}{,,Project an $\mmlAtms$ event to specification events.''}
    %
    \typerule{i-scct-filter-context}{
      \irl{\event_b} \not= \irl{\lightning}
    }{
      \tospecificevi[_{\delta_{\sCCT}}]{\event_b;\ctx} = \specificev{\emptyevent}
    }{i-scct-filter-context}
    %
    \typerule{i-scct-filter-comp-start}{
    }{
      \tospecificevi[_{\delta_{\sCCT}}]{Start;\comp} = \specificev{\emptyevent}
    }{i-scct-filter-comp-start}
    %
    \typerule{i-scct-filter-comp-end}{
    }{
      \tospecificevi[_{\delta_{\sCCT}}]{End\ \valueexpr;\comp} = \specificev{\emptyevent}
    }{i-scct-filter-comp-end}
    %
    \typerule{i-scct-filter-comp-alloc}{
      \delta_{\sCCT}(\irl{\loc})=\specificev{\loc} &
      \specificev{n}=\irl{n}
    }{
      \tospecificevi[_{\delta_{\sCCT}}]{Alloc\ \loc\ n;\comp} = \specificev{Alloc\ \loc\ n;\unlock}
    }{i-scct-filter-comp-alloc}
    %
    \typerule{i-scct-filter-comp-dealloc}{
      \delta_{\sCCT}(\irl{\loc})=\specificev{\loc}
    }{
      \tospecificevi[_{\delta_{\sCCT}}]{Dealloc\ \loc;\comp} = \specificev{Dealloc\ \loc;\unlock}
    }{i-scct-filter-comp-dealloc}
    %
    \typerule{i-scct-filter-comp-get-noleak}{
      \delta_{\sCCT}(\irl{\loc})=\specificev{\loc} &
      \specificev{n}=\irl{n}
    }{
      \tospecificevi[_{\delta_{\sCCT}}]{Get\ \loc\ n;\comp} = \specificev{\emptyevent}
    }{i-scct-filter-comp-get-noleak}
    %
    \typerule{i-scct-filter-comp-set-noleak}{
      \delta_{\sCCT}(\irl{\loc})=\specificev{\loc} &
      \specificev{n}=\irl{n}
    }{
      \tospecificevi[_{\delta_{\sCCT}}]{Set\ \loc\ n\ \valueexpr;\comp} = \specificev{\emptyevent}
    }{i-scct-filter-comp-set-noleak}
    %
    \typerule{i-scct-filter-comp-call}{
    }{
      \tospecificevi[_{\delta_{\sCCT}}]{Call\ \comm\ foo\ \valueexpr;\comp} = \specificev{\emptyevent}
    }{i-scct-filter-comp-call}
    %
    \typerule{i-scct-filter-comp-ret}{
    }{
      \tospecificevi[_{\delta_{\sCCT}}]{Ret\ \comm\ \valueexpr;\comp} = \specificev{\emptyevent}
    }{i-scct-filter-comp-ret}
    %
    \typerule{i-scct-filter-abort}{
    }{
      \tospecificevi[_{\delta_{\sCCT}}]{\lightning;\sandboxtag} = \specificev{\lightning;\unlock}
    }{i-scct-filter-abort}
    %
    \typerule{i-scct-filter-emptyevent}{
    }{
      \tospecificevi[_{\delta_{\sCCT}}]{\emptyevent} = \specificev{\emptyevent}
    }{i-scct-filter-emptyevent}
    %
    \judgbox{\tospecificevi[^*_{\delta_{\sCCT}}]{\trace} = \sccttrace}{,,Project an $\mmlAtms$ trace to specification traces.''}
    %
    \typerule{i-scct-filter-empty}{
    }{
      \tospecificevi[^*_{\delta_{\sCCT}}]{\hole{\cdot}} = \specificev{\hole{\cdot}}
    }{i-scct-filter-empty}
    %
    \typerule{i-scct-filter-cons-relevant}{
      \tospecificevi[_{\delta_{\sCCT}}]{\event} = \specificev{\event} &
      \tospecificevi[^*_{\delta_{\sCCT}}]{\trace} = \sccttrace &
      \specificev{\event} \not= \specificev{\emptyevent}
    }{
      \tospecificevi[^*_{\delta_{\sCCT}}]{\event\cdot\trace} = \specificev{\event}\cdot\sccttrace
    }{i-scct-filter-cons-relevant}
    %
    \typerule{i-scct-filter-cons-relevant}{
      \tospecificevi[_{\delta_{\sCCT}}]{\event} = \specificev{\emptyevent} &
      \tospecificevi[^*_{\delta_{\sCCT}}]{\trace} = \sccttrace
    }{
      \tospecificevi[^*_{\delta_{\sCCT}}]{\event\cdot\trace} = \sccttrace
    }{i-scct-filter-cons}
  \end{center}
}{wi-scct-events-project-to-specific}{Projection of $\mmlAtms$ events to specification events.}


\begin{lemma}[Injective Compiler (for final expressions)]\label{lem:smscomp:inject}
  If
  \begin{assumptions}
    \item $\mmlAtmmlAtmscomp{\finalexpr}=\irl{e_0}$
    \item $\mmlAtmmlAtmscomp{\finalexpr}=\irl{e_1}$
  \end{assumptions}
  Then
  \begin{goals}
    \item $\irl{e_0}=\irl{e_1}$
  \end{goals}
\end{lemma}
\begin{proof}
  Case analysis on $\irl{\finalexprnoerr}$.
\end{proof}

\begin{lemma}[Subst $\mmlAtmmlAtmscomp{\bullet}$ Compatibility]\label{thm:mscomp:subst:compat}
  $\;$
  \begin{goals}
    \item $\mmlAtmmlAtmscomp{e\gamma}=\mmlAtmmlAtmscomp{e}\mmlAtmmlAtmscomp{\gamma}$
  \end{goals}
\end{lemma}
\begin{proof}
  Induction on $\trg{e}$.
\end{proof}

\begin{lemma}[Prim. Forward Simulation]\label{lem:sms:primforwardsim}
  If
  \begin{assumptions}
    \item\label[ass]{asm:sms:ctxforwardsim:evalt} $\exprevalt{\Omega}{e\gamma}{\Omega'}{e'\gamma'}{\event}$
    \item $\trg{\Omega}=\irl{\Omega}=\trg{\memstate;\comp;\cfstate}$
    \item $\monitorcheck[]{\smsmonitor}{\smsmonitor'}{\absevent}$
    \item $\storeagreesms[\delta]{\smsmonitor}{\trg{\Omega}}$
    \item $\traceagree[]{\theta_{\delta}\left(\trg{\event}\right)}{\absevent}$
    \item $\trg{\event}=\irl{\event}$
    \item $\trg{\Omega'}=\irl{\Omega'}$
    \item $\irl{\Omega.\Delta}\Vdash\irl{\gamma}$
    \item $\trg{\gamma}\prec\irl{\gamma}$
  \end{assumptions}
  Then $\exists \irl{\gamma'}$,
  \begin{goals}
    \item $\exec{\irl{\Omega}}{\mmlAtmmlAtmscomp{e}\irl{\gamma}}{\irl{\Omega'}}{\mmlAtmmlAtmscomp{e'}\irl{\gamma'}}{\irl{\event}}$
    \item $\storeagreesms[\delta]{\smsmonitor'}{\trg{\Omega'}}$
    \item $\irl{\Omega'.\Delta}\Vdash\irl{\gamma'}$
    \item $\trg{\gamma'}\prec\irl{\gamma'}$
  \end{goals}
\end{lemma}
\begin{proof}
  Induction on \Cref{asm:sms:ctxforwardsim:evalt}.

  \begin{description}
    \case{tr:tw-e-oplus}
          If
          \begin{passumptions}{H}
            \item $n_{3}=n_{1}\oplus n_{2}$
            \item $\trg{\gamma}=\trg{\gamma'}=\trg{\hole{\cdot}}$
            \item $\exprevalt{\Omega}{n_{1}+n_{2}}{\Omega}{n_{3}}{\emptyevent}$
            \item $\trg{\Omega}=\irl{\Omega}=\trg{\memstate;\comp;\cfstate}$
            \item $\monitorcheck[]{\smsmonitor}{\smsmonitor'}{\absevent}$
            \item $\storeagreesms[\delta]{\smsmonitor}{\trg{\Omega}}$
            \item $\trg{\emptyevent}=\irl{\event}$
            \item $\traceagree[]{\theta_{\delta}\left(\trg{\emptyevent}\right)}{\absevent}$
            \item $\irl{\Omega.\Delta}\Vdash\irl{\gamma}$
            \item $\trg{\gamma}\prec\irl{\gamma}$
          \end{passumptions}
          Then $\exists \irl{\gamma'}$,
          \begin{goals}
            \item $\exec{\irl{\Omega}}{\mmlAtmmlAtmscomp{n_{1}\oplus n_{2}}\irl{\gamma}}{\irl{\Omega}}{\mmlAtmmlAtmscomp{n_{3}}\irl{\gamma'}}{\irl{\event}}$
            \item $\storeagreesms[\delta]{\smsmonitor'}{\trg{\Omega}}$
            \item $\irl{\Omega.\Delta}\Vdash\irl{\gamma'}$
            \item $\trg{\gamma'}\prec\irl{\gamma'}$
          \end{goals}
          Just instantiate $\irl{\gamma'}=\irl{\hole{\cdot}}$ and note that no substitutions are applicable to $\mmlAtmmlAtmscomp{n_{1}\oplus n_{2}}=\irl{n_{1}\oplus n_{2}}$ as well as $\mmlAtmmlAtmscomp{n_{3}}=\irl{n_{3}}$.
          Induce on $\trg{\gamma}\prec\irl{\gamma}$ and see that no substitution changes the expression.
          Now, all goals follow immediately from assumptions.

    \case{tr:tw-e-get-in}
          If
          \begin{passumptions}{H}
            \item $\trg{\memstate}=\trg{H^{\ctx};H^{\comp};\Delta_{1},x\mapsto(\loc;\comp;\poison;m),\Delta_{2}}$
            \item $\trg{\loc}+\trg{n}\in\operatorname{dom}\trg{H^{\comp}}$
            \item $\trg{\gamma}=\trg{\gamma'}=\trg{\hole{\cdot}}$
            \item $\exprevalt{\cfstate;\comp;\memstate}{x[n]}{\cfstate;\comp;\memstate}{H^{\comp}(\loc+n)}{Get\ \loc\ n;\comp}$
            \item $\trg{\Omega}=\irl{\Omega}=\trg{\memstate;\comp;\cfstate}$
            \item\label[ass]{asm:sms:primforwardsim:monitorstep:get} $\monitorcheck[]{\smsmonitor}{\smsmonitor'}{\absevent}$
            \item\label[ass]{asm:sms:primforwardsim:storeagree:get} $\storeagreesms[\delta]{\smsmonitor}{\trg{\Omega}}$
            \item $\trg{Get\ \loc\ n;\comp}=\irl{\event}$
            \item\label[ass]{asm:sms:primforwardsim:trace:get} $\traceagree[]{\theta_{\delta}\left(\trg{Get\ \loc\ n;\comp}\right)}{\absevent}$
            \item\label[ass]{asm:sms:primforwardsim:explicitsubst:get} $\irl{\Omega.\Delta}\Vdash\irl{\gamma}$
            \item $\trg{\gamma}\prec\irl{\gamma}$
          \end{passumptions}
          Then $\exists \irl{\gamma'}$,
          \begin{goals}
            \item $\exec{\irl{\Omega}}{\mmlAtmmlAtmscomp{x[n]}\irl{\gamma}}{\irl{\Omega}}{\mmlAtmmlAtmscomp{H^{\comp}(\loc+n)}\irl{\gamma'}}{\irl{\event}}$
            \item $\storeagreesms[\delta]{\smsmonitor'}{\trg{\Omega}}$
            \item $\irl{\Omega.\Delta}\Vdash\irl{\gamma}$
            \item $\trg{\gamma'}\prec\irl{\gamma'}$
          \end{goals}
          Instantiate $\irl{\gamma'}=\irl{\hole{\cdot}}$.

          Note that by inversion on \Cref{asm:sms:primforwardsim:trace:get,asm:sms:primforwardsim:monitorstep:get,asm:sms:primforwardsim:storeagree:get} we have:
          \begin{passumptions}{H}
            \item $\absevent=\bm{Use\ }\specificev{\loc}\bm{\ n}$
            \item $\trg{n}=\bm{n}$
            \item $(\specificev{\loc},\bm{m})\in\smsmonitor$
            \item $\bm{n}<\bm{m}$
            \item $\bm{m}=\trg{m}$
            \item $\smsmonitor'=\smsmonitor$
          \end{passumptions}
          From that, it's easy to conclude $\trg{n}<\trg{m}=\irl{m}$.

          Note that $\begin{array}{ll}\mmlAtmmlAtmscomp{x[n]}=\irl{let\ x_{ACCESS}=}&\mmlAtmmlAtmscomp{n}\irl{\ in\ ifz\ 0\le x_{ACCESS}\le x_{SIZE}\ then}\\&\irl{\ x[x_{ACCESS}]\ else\ abort()}\end{array}$.

          Induce on \Cref{asm:sms:primforwardsim:explicitsubst:get}. The base case is spurious, since we have at least $\irl{x\mapsto(\loc;\comp;\poison;m)}$ in $\irl{\Omega.\Delta}$.
          The inductive case splits into two other cases: Either we have a substitution with $\irl{x_{SIZE}}$ or not.
          If not, make use of the inductive hypothesis. %and \Cref{tr:tw-e-subst}.
          If yes, then we know by definition that $\irl{x_{SIZE}=m}$.

          Thus, we can execute to the desired state $\irl{\Omega}$ with just $\irl{Get\ \loc\ n;\comp}$.
          The other goals follow by assumption or are an immediate consequence.


    \case{tr:tw-e-get-notin}
          If
          \begin{passumptions}{H}
            \item $\trg{\memstate}=\trg{H^{\ctx};H^{\comp};\Delta_{1},x\mapsto(\loc;\comp;\poison;m),\Delta_{2}}$
            \item $\trg{\gamma}=\trg{\gamma'}=\trg{\hole{\cdot}}$
            \item\label[ass]{asm:sms:primforwardsim:notdom:nget} $\trg{\loc}+\trg{n}\notin\operatorname{dom}\trg{H^{\comp}}$
            \item $\exprevalt{\cfstate;\comp;\memstate}{x[n]}{\cfstate;\comp;\memstate}{H^{\comp}(\loc+n)}{Get\ \loc\ n;\comp}$
            \item $\trg{\Omega}=\irl{\Omega}=\trg{\memstate;\comp;\cfstate}$
            \item $\monitorcheck[]{\smsmonitor}{\smsmonitor'}{\absevent}$
            \item\label[ass]{asm:sms:primforwardsim:storeagree:nget} $\storeagreesms[\delta]{\smsmonitor}{\trg{\Omega}}$
            \item $\trg{Get\ \loc\ n;\comp}=\irl{\event}$
            \item $\traceagree[]{\theta_{\delta}\left(\trg{Get\ \loc\ n;\comp}\right)}{\absevent}$
            \item $\irl{\Omega.\Delta}\Vdash\irl{\gamma}$
            \item $\trg{\gamma}\prec\irl{\gamma}$
          \end{passumptions}
          Then $\exists \irl{\gamma'}$,
          \begin{goals}
            \item $\exec{\irl{\Omega}}{\mmlAtmmlAtmscomp{x[n]}}{\irl{\Omega}}{\mmlAtmmlAtmscomp{H^{\comp}(\loc+n)}}{\irl{\event}}$
            \item $\storeagreesms[\delta]{\smsmonitor'}{\trg{\Omega}}$
            \item $\irl{\Omega.\Delta}\Vdash\irl{\gamma'}$
            \item $\trg{\gamma'}\prec\irl{\gamma'}$
          \end{goals}

          Immediate contradiction of \Cref{asm:sms:primforwardsim:storeagree:nget,asm:sms:primforwardsim:notdom:nget}.

    \case{tr:tw-e-set-comp}
          If
          \begin{passumptions}{H}
            \item $\trg{\memstate}=\trg{H^{\ctx};H^{\comp};\Delta_{1},x\mapsto(\loc;\comp;\poison;m),\Delta_{2}}$
            \item $\trg{H^{\comp'}}=\trg{H^{\comp}}\left(\trg{\loc+n}\mapsto\trg{\valueexpr}\right)$
            \item $\trg{\memstate'}=\trg{H^{\ctx};H^{\comp'};\Delta_{1},x\mapsto(\loc;\comp;\poison;m),\Delta_{2}}$
            \item $\trg{\gamma}=\trg{\gamma'}=\trg{\hole{\cdot}}$
            \item $\exprevalt{\cfstate;\comp;\memstate}{x[n]\leftarrow\valueexpr}{\cfstate;\comp;\memstate'}{\valueexpr}{Set\ \loc\ n\ \valueexpr;\comp}$
            \item $\trg{\Omega}=\irl{\Omega}=\trg{\memstate;\comp;\cfstate}$
            \item\label[ass]{asm:sms:primforwardsim:monitorstep:set} $\monitorcheck[]{\smsmonitor}{\smsmonitor'}{\absevent}$
            \item\label[ass]{asm:sms:primforwardsim:trace:set} $\traceagree[]{\theta_{\delta}\left(\trg{Set\ \loc\ n\ \valueexpr;\comp}\right)}{\absevent}$
            \item\label[ass]{asm:sms:primforwardsim:storeagree:set} $\storeagreesms[\delta]{\smsmonitor}{\trg{\Omega}}$
            \item $\irl{\Omega'}=\trg{\cfstate;\comp;\memstate'}$
            \item $\irl{\event}=\trg{Set\ \loc\ n\ \valueexpr;\comp}$
            \item\label[ass]{asm:sms:primforwardsim:storeagree:subst} $\irl{\Omega.\Delta}\Vdash\irl{\gamma}$
            \item $\trg{\gamma}\prec\irl{\gamma}$
          \end{passumptions}
          Then $\exists \irl{\gamma'}$,
          \begin{goals}
            \item $\exec{\irl{\Omega}}{\mmlAtmmlAtmscomp{x[n]\leftarrow\valueexpr}}{\irl{\Omega'}}{\mmlAtmmlAtmscomp{\valueexpr}}{\irl{\event}}$
            \item $\storeagreesms[\delta]{\smsmonitor'}{\trg{\cfstate;\comp;\memstate'}}$
            \item $\irl{\gamma'}\Vdash\irl{\Omega.\Delta}$
            \item $\trg{\gamma'}\prec\irl{\gamma'}$
          \end{goals}
          Instantiate $\irl{\gamma'}=\irl{\hole{\cdot}}$.

          Note that by inversion on \Cref{asm:sms:primforwardsim:trace:set,asm:sms:primforwardsim:monitorstep:set,asm:sms:primforwardsim:storeagree:set} we have:
          \begin{passumptions}{H}
            \item $\absevent=\bm{Use\ }\specificev{\loc}\bm{\ n}$
            \item $\trg{n}=\bm{n}$
            \item $(\specificev{\loc},\bm{m})\in\smsmonitor$
            \item $\bm{n}<\bm{m}$
            \item $\bm{m}=\trg{m}$
            \item $\smsmonitor'=\smsmonitor$
          \end{passumptions}
          From that, it's easy to conclude $\trg{n}<\trg{m}=\irl{m}$.

          Note that $\begin{array}{ll}\mmlAtmmlAtmscomp{x[n]\leftarrow\valueexpr}=\irl{let\ x_{ACCESS}=}&\mmlAtmmlAtmscomp{n}\irl{\ in\ ifz\ 0\le x_{ACCESS}\le x_{SIZE}\ then}\\&\irl{\ x[x_{ACCESS}]\leftarrow}\mmlAtmmlAtmscomp{\valueexpr}\irl{\ else\ abort()}\end{array}$.

          Induce on \Cref{asm:sms:primforwardsim:storeagree:subst}. The base case is spurious, since we have at least $\irl{x\mapsto(\loc;\comp;\poison;m)}$ in $\irl{\Omega.\Delta}$.
          The inductive case splits into two other cases: Either we have a substitution with $\irl{x_{SIZE}}$ or not. If not, make use of the inductive hypothesis.% and \Cref{tr:tw-e-subst}.
          If yes, then we know by definition that $\irl{x_{SIZE}=m}$.

          Thus, we can execute to the desired state $\irl{\Omega}$ with just $\irl{Set\ \loc\ n\ \valueexpr;\comp}$.
          The other goals follow by assumption or are an immediate consequence.

    \case{tr:tw-e-let-new-comp}
          If
          \begin{passumptions}{H}
            \item $\trg{\memstate}=\trg{H^{\ctx};H^{\comp};\Delta}$
            \item $\fresh{\trg{\Delta}}{\trg{\loc}}$
            \item $\fresh{\trg{\Delta}}{\trg{z}}$
            \item $\trg{H^{\comp'}}=\trg{H^{\comp}}\ll\trg{n}$
            \item $\trg{\memstate'}=\trg{H^{\ctx};H^{\comp'};z\mapsto(\loc;\ctx;\poisonless;n),\Delta}$
            \item $\trg{\gamma}=\trg{\hole{\cdot}}$
            \item $\trg{\gamma'}=\trg{[z/x],\hole{\cdot}}$
            \item $\exprevalt{\cfstate;\comp;\memstate}{let\ x=new\ n\ in\ e}{\cfstate;\comp;\memstate'}{e[z/x]}{Alloc\ \loc\ n;\comp}$
            \item $\trg{\Omega}=\irl{\Omega}$
            \item\label[ass]{asm:sms:primforwardsim:monitorstep:new} $\monitorcheck[]{\smsmonitor}{\smsmonitor'}{\absevent}$
            \item\label[ass]{asm:sms:primforwardsim:trace:new} $\traceagree[]{\theta_{\delta}\left(\trg{Alloc\ \loc\ n;\comp}\right)}{\absevent}$
            \item\label[ass]{asm:sms:primforwardsim:storeagree:new} $\storeagreesms[\delta]{\smsmonitor}{\trg{\Omega}}$
            \item $\irl{\Omega'}=\trg{\cfstate;\comp;\memstate'}$
            \item $\irl{\event}=\trg{Alloc\ \loc\ n;\comp}$
            \item\label[ass]{asm:sms:primforwardsim:subst:new} $\irl{\Omega.\Delta}\Vdash\irl{\gamma}$
            \item $\trg{\gamma}\prec\irl{\gamma}$
          \end{passumptions}
          Then $\exists \irl{\gamma'}$,
          \begin{goals}
            \item $\exec{\irl{\Omega}}{\mmlAtmmlAtmscomp{let\ x=new\ n\ in\ e}\irl{\gamma}}{\irl{\Omega'}}{\mmlAtmmlAtmscomp{e}\irl{\gamma'}}{\irl{\event}}$
            \item $\storeagreesms[\delta]{\smsmonitor'}{\trg{\cfstate;\comp;\memstate'}}$
            \item $\irl{\gamma'}\Vdash\irl{\Omega.\Delta}$
            \item $\trg{\gamma'}\prec\irl{\gamma'}$
          \end{goals}
          Note that by inversion on \Cref{asm:sms:primforwardsim:trace:set,asm:sms:primforwardsim:monitorstep:set,asm:sms:primforwardsim:storeagree:set} we have:
          \begin{passumptions}{H}
            \item $\absevent=\bm{Alloc\ }\specificev{\loc}\bm{\ n}$
            \item $\trg{n}=\bm{n}$
            \item $\specificev{\loc}\notin\operatorname{dom}\smsmonitor$
            \item $\smsmonitor=(\specificev{\loc},\bm{n})\cup\smsmonitor$
          \end{passumptions}

          Note that $\begin{array}{ll}\mmlAtmmlAtmscomp{let\ x=new\ n\ in\ e}=&\irl{let\ x_{SIZE}=}\mmlAtmmlAtmscomp{n}\irl{\ in\ }\\&\irl{let\ x=new\ x_{SIZE}\ in\ }\mmlAtmmlAtmscomp{e}\end{array}$.

          Instantiate $\irl{\gamma'}=\irl{[}\mmlAtmmlAtmscomp{n}\irl{/x_{SIZE}],[z/x],\gamma}$ and let $\irl{n}=\mmlAtmmlAtmscomp{n}$.

          We make use of compatibility of substitution with the compiler\MK{factor out as separate lemma}: $\mmlAtmmlAtmscomp{let\ x=new\ n\ in\ e}\irl{\gamma}=\irl{let\ x_{SIZE}=n\ in\ let\ x=new\ n\ in\ (}\mmlAtmmlAtmscomp{e}\irl{\gamma)}$

          Now observe that we can perform the steps: (abusing compatiblity of substitution on-the-fly)
          \begin{itemize}
            \item $\exec{\irl{\Omega}}{\irl{let\ x_{SIZE}=n\ in\ let\ x=new\ n\ in\ (}\mmlAtmmlAtmscomp{e}\irl{\gamma)}}{\irl{\Omega}}{\irl{let\ x=new\ n\ in\ (}\mmlAtmmlAtmscomp{e}\irl{[n/x_{SIZE}],\gamma)}}{\irl{\emptyevent;\comp}}$
            \item $\exec{\irl{\Omega}}{\irl{let\ x=new\ n\ in\ (}\mmlAtmmlAtmscomp{e}\irl{[z/x],[n/x_{SIZE}],\gamma)}}{\irl{\Omega'}}{\mmlAtmmlAtmscomp{e}\irl{\gamma'}}{\irl{Alloc\ \loc\ n;\comp}}$
          \end{itemize}

          So, it's easy to see that execute to the desired state $\irl{\Omega'}$ with just $\irl{Alloc\ \loc\ n;\comp}$.
          The other goals are easy as well. For the last, make use of \Cref{tr:sms-subst-subset-cons,tr:sms-subst-subset-xsize}.

    \case{tr:tw-e-let-new-ctx}
          Does not apply, since the sandboxtag is $\trg{\comp}$, but the rule requires $\trg{\ctx}$.

    \case{tr:tw-e-set-ctx}
          Does not apply, since the sandboxtag is $\trg{\comp}$, but the rule requires $\trg{\ctx}$.

    \case{tr:tw-e-delete}
          If
          \begin{passumptions}{H}
            \item $\trg{\memstate}=\trg{H^{\ctx};H^{\comp};\Delta_{1},x\mapsto(\loc;\comp;\poisonless;m),\Delta_{2}}$
            \item $\trg{\memstate'}=\trg{H^{\ctx};H^{\comp};\Delta_{1},x\mapsto(\loc;\comp;\poisoned;m),\Delta_{2}}$
            \item $\trg{\gamma}=\trg{\gamma'}=\trg{\hole{\cdot}}$
            \item $\exprevalt{\cfstate;\comp;\memstate}{delete\ x}{\cfstate;\comp;\memstate'}{0}{Dealloc\ \loc;\comp}$
            \item $\trg{\Omega}=\irl{\Omega}=\trg{\cfstate;\comp;\memstate}$
            \item $\monitorcheck[]{\smsmonitor}{\smsmonitor'}{\absevent}$
            \item\label[ass]{asm:sms:primforwardsim:storeagree:del} $\storeagreesms[\delta]{\smsmonitor}{\trg{\Omega}}$
            \item\label[ass]{asm:sms:primforwardsim:trace:del} $\traceagree[]{\theta_{\delta}\left(\trg{Dealloc\ \loc;\comp}\right)}{\absevent}$
            \item $\irl{\Omega'}=\trg{\Omega'}=\trg{\cfstate;\comp;\memstate'}$
            \item $\irl{\event}=\trg{Dealloc\ \loc;\comp}$
            \item\label[ass]{asm:sms:primforwardsim:subst:del} $\irl{\Omega.\Delta}\Vdash\irl{\gamma}$
            \item $\trg{\gamma}\prec\irl{\gamma}$
          \end{passumptions}
          Then $\exists \irl{\gamma'}$,
          \begin{goals}
            \item $\exec{\irl{\Omega}}{\mmlAtmmlAtmscomp{delete\ x}}{\irl{\Omega'}}{\mmlAtmmlAtmscomp{0}}{\irl{\event}}$
            \item $\storeagreesms[\delta]{\smsmonitor'}{\trg{\Omega'}}$
            \item $\irl{\gamma'}\Vdash\irl{\Omega.\Delta}$
            \item $\trg{\gamma'}\prec\irl{\gamma'}$
          \end{goals}
          Just pick $\irl{\gamma'}=\irl{\hole{\cdot}}$.

          Since $\mmlAtmmlAtmscomp{delete\ x}=\irl{delete\ x}$, this case is entirely trivial up to an induction on \Cref{asm:sms:primforwardsim:subst:del}.% applying \Cref{tr:tw-e-subst} in the inductive case.

    \case{tr:tw-e-let-f}
          If
          \begin{passumptions}{H}
            \item $\trg{\Omega}=\irl{\Omega}=\trg{\cfstate;\comp;\memstate}$
            \item $\trg{\gamma}=\trg{\hole{\cdot}}$
            \item $\trg{\gamma'}=\trg{[\valueexpr/x],\hole{\cdot}}$
            \item $\exprevalt{\Omega}{let\ x=\valueexpr\ in\ e}{\Omega}{e[\valueexpr/x]}{\emptyevent;\comp}$
            \item $\monitorcheck[]{\smsmonitor}{\smsmonitor'}{\absevent}$
            \item\label[ass]{asm:sms:primforwardsim:storeagree:let} $\storeagreesms[\delta]{\smsmonitor}{\trg{\Omega}}$
            \item\label[ass]{asm:sms:primforwardsim:trace:let} $\traceagree[]{\theta_{\delta}\left(\trg{\emptyevent;\comp}\right)}{\absevent}$
            \item $\irl{\event}=\trg{\emptyevent;\comp}$
            \item\label[ass]{asm:sms:primforwardsim:subst:let} $\irl{\Omega.\Delta}\Vdash\irl{\gamma}$
            \item $\trg{\gamma}\prec\irl{\gamma}$
          \end{passumptions}
          Then $\exists \irl{\gamma'}$,
          \begin{goals}
            \item $\exec{\irl{\Omega}}{\mmlAtmmlAtmscomp{let\ x=\valueexpr\ in\ e}\irl{\gamma}}{\irl{\Omega}}{\mmlAtmmlAtmscomp{e}\irl{\gamma'}}{\irl{\event}}$
            \item $\storeagreesms[\delta]{\smsmonitor}{\trg{\Omega}}$
            \item $\irl{\gamma'}\Vdash\irl{\Omega.\Delta}$
            \item $\trg{\gamma'}\prec\irl{\gamma'}$
          \end{goals}
          Let $\irl{\valueexpr}=\mmlAtmmlAtmscomp{\valueexpr}$.
          Pick $\irl{\gamma}=\irl{[\valueexpr/x],\hole{\cdot}}$.

          Note that $\mmlAtmmlAtmscomp{let\ x=\valueexpr\ in\ e}=\irl{let\ x=}\mmlAtmmlAtmscomp{\valueexpr}\irl{\ in\ }\mmlAtmmlAtmscomp{e}$.

          Induce on \Cref{asm:sms:primforwardsim:subst:let}.
          In the base-case, we can immediately step to the desired term and all goals go through trivially.
          The inductive cases go through easily. %, make use of \Cref{tr:tw-e-subst}, the other goals also go through easily.


      \case{tr:tw-e-abort} \MK{maybe do this case}
        This case and all following are entirely similar to case \ref{tr:tw-e-delete} or \ref{tr:tw-e-oplus}.
      \case{tr:tw-e-x-is-poisoned-yes}
      \case{tr:tw-e-x-is-poisoned-no}
      \case{tr:tw-e-proj1}
      \case{tr:tw-e-proj2}
      \case{tr:tw-e-x-hasnat}
      \case{tr:tw-e-n-hasnat}
      \case{tr:tw-e-pair-hasnat}
      \case{tr:tw-e-x-haspair}
      \case{tr:tw-e-n-haspair}
      \case{tr:tw-e-pair-haspair}
      \case{tr:tw-e-if-true}
      \case{tr:tw-e-if-false}

  \end{description}

\end{proof}

\begin{lemma}[Ctx. Forward Simulation]\label{lem:sms:ctxforwardsim}
  If
  \begin{assumptions}
    \item $\exect[]{\Omega}{e}{\Omega'}{e'}{\trace}$
    \item $\trg{\Omega}=\irl{\Omega}=\irl{\memstate;\comp;\cfstate}$
    \item $\monitorcheck[]{\smsmonitor}{\smsmonitor'}{\absevent}$
    \item $\storeagreesms[\delta]{\smsmonitor}{\trg{\Omega}}$
    \item $\traceagree[]{\theta_{\delta}\left(\trg{\event}\right)}{\absevent}$
    \item $\irl{\event}=\trg{\event}$
    \item $\trg{\Omega'}=\irl{\Omega'}$
  \end{assumptions}
  Then
  \begin{goals}
    \item $\exec{\irl{\Omega}}{\mmlAtmmlAtmscomp{e}}{\irl{\Omega'}}{\mmlAtmmlAtmscomp{e'}}{\irl{\event}}$
    \item $\storeagreesms[\delta]{\smsmonitor'}{\trg{\Omega'}}$
  \end{goals}
\end{lemma}
\begin{incompleteproof}
  Unfolding and using \Cref{lem:sms:primforwardsim}.
\end{incompleteproof}

\begin{lemma}[Forward Simulation]\label{lem:sms:forwardsim}
  If
  \begin{assumptions}
    \item $\exect{\Omega}{e}{\Omega'}{\finalexprnoerr}{\trace}$
    \item $\trg{\Omega}=\irl{\Omega}$
    \item $\trg{\trace}=\irl{\trace}$
    \item $\trg{\Omega'}=\irl{\Omega'}$
    \item $\monitorcheck{\smsmonitor}{\smsmonitor'}{\abstrace}$
    \item $\traceagree{\theta_{\delta}^{*}(\trg{\trace})}{\abstrace}$
    \item $\storeagreesms[\delta]{\smsmonitor}{\trg{\Omega}}$
  \end{assumptions}
  Then
  \begin{goals}
    \item $\exec{\irl{\Omega}}{\mmlAtmmlAtmscomp{e}}{\irl{\Omega'}}{\mmlAtmmlAtmscomp{\finalexprnoerr}}{\irl{\trace}}$
    \item $\storeagreesms[\delta]{\smsmonitor'}{\trg{\Omega'}}$
  \end{goals}
\end{lemma}
\begin{proof}
  Proof is similar to \Thmref{lem:generaltms:monitor}.
\end{proof}

\begin{lemma}[Backward Simulation]\label{lem:sms:backwardsim}
  If
  \begin{assumptions}
    \item $\exec{\irl{\Omega}}{\mmlAtmmlAtmscomp{e}}{\irl{\Omega'}}{\mmlAtmmlAtmscomp{\finalexprnoerr}}{\irl{\trace}}$
    \item $\trg{\Omega}=\irl{\Omega}$
    \item $\trg{\trace}=\irl{\trace}$
    \item $\trg{\Omega'}=\irl{\Omega'}$
  \end{assumptions}
  Then
  \begin{goals}
    \item $\exect{\Omega}{e}{\Omega'}{\finalexprnoerr}{\trace}$\MK{substitutions}
  \end{goals}
\end{lemma}
\begin{proof}
  Case analysis on wether $\exists \trg{\finalexprnoerr'},\exect{\Omega}{e}{\Omega'}{\finalexprnoerr'}{\trace}$ holds or not.
  \begin{description}
    \item \textbf{Case} $\exists \trg{\finalexprnoerr'},\exect{\Omega}{e}{\Omega'}{\finalexprnoerr'}{\trace}$\textbf{:}
          By \Thmref{lem:sms:forwardsim}\MK{patch this app: supply all assumptions} on what we assume in this case:
          \begin{passumptions}{H}
            \item\label[ass]{asm:sms:backwardsim:execms} $\exec{\irl{\Omega}}{\mmlAtmmlAtmscomp{e}}{\irl{\Omega'}}{\mmlAtmmlAtmscomp{\finalexprnoerr'}}{\irl{\trace}}$
            \item $\trg{\trace}=\irl{\trace}$
            \item $\trg{\Omega'}=\irl{\Omega'}$
          \end{passumptions}
          By \Thmref{lem:determ:steps}:
          \begin{passumptions}{H}
            \setcounter{enumi}{3}
            \item $\mmlAtmmlAtmscomp{\finalexprnoerr}=\mmlAtmmlAtmscomp{\finalexprnoerr'}$
          \end{passumptions}
          Subsequently, by \Thmref{lem:smscomp:inject}:
          \begin{passumptions}{H}
            \setcounter{enumi}{4}
            \item\label[ass]{asm:sms:backwardsim:eq} $\trg{\finalexprnoerr}=\trg{\finalexprnoerr'}$
          \end{passumptions}
          Rewrite \Cref{asm:sms:backwardsim:execms} using \Cref{asm:sms:backwardsim:eq}, solving our goal.

    \item \textbf{Case} $\neg(\exists\trg{\finalexprnoerr'},\exect{\Omega}{e}{\Omega'}{\finalexprnoerr'}{\trace})$\textbf{:}
          We can rewrite the assumption done in this case as:
          \begin{passumptions}{H}
            \item\label[ass]{asm:sms:backwardsim:noex} $\forall\trg{\finalexprnoerr'},\exectn{\Omega}{e}{\Omega'}{\finalexprnoerr'}{\trace}$
          \end{passumptions}
          We prove the goal by contradiction, so we have to prove $\bot$, assuming:
          \begin{passumptions}{H}
            \setcounter{enumi}{1}
            \item\label[ass]{asm:sms:backwardsim:ex2} $\exect{\Omega}{e}{\Omega'}{\finalexprnoerr}{\trace}$
          \end{passumptions}
          \Cref{asm:sms:backwardsim:ex2} contradicts \Cref{asm:sms:backwardsim:noex}.
  \end{description}
\end{proof}

\begin{lemma}[Top-Level Backward Simulation]\label{lem:backtransms}
  If
  \begin{assumptions}
    \item $\irl{\library}=\irl{\library_{ctx}\linker}\mmlAtmmlAtmscomp{\library_{comp}}$
    \item $\irl{\library_{ctx}}=\trg{\library_{ctx}}$
    \item $\irl{\commlib}=\mmlAtmmlAtmscomp{\commlib}=\operatorname{dom}\mmlAtmmlAtmscomp{\library_{comp}}$
    \item $\exec{\irl{\commlib;\library;\hole{\cdot};\comp;\hole{\cdot};\hole{\cdot};\hole{\cdot}}}{\irl{call\ main\ 0}}{\irl{\commlib;\library;\kontstack;\ctx;H^{\ctx};H^{\comp};\Delta}}{\irl{\finalexprnoerr}}{\irl{\trace}}$
    \item $\irl{\commlib}=\trg{\commlib}$
  \end{assumptions}
  Then $\exists \trg{\trace}\ \trg{\kontstack}\ \trg{H^{\ctx}}\ \trg{H^{\comp}}\ \trg{\Delta}$,
  \begin{goals}
    \item $\exec{\trg{\commlib;\library;\hole{\cdot};\comp;\hole{\cdot};\hole{\cdot};\hole{\cdot}}}{\trg{call\ main\ 0}}{\trg{\commlib;\library;\kontstack;\ctx;H^{\ctx};H^{\comp};\Delta}}{\trg{\finalexprnoerr}}{\trg{\trace}}$
    \item $\irl{\kontstack}=\trg{\kontstack}$
    \item $\irl{H^{\ctx}}=\trg{H^{\ctx}}$
    \item $\irl{H^{\comp}}=\trg{H^{\comp}}$
    \item $\irl{\Delta}=\trg{\Delta}$
    \item $\irl{\trace}=\trg{\trace}$
  \end{goals}
\end{lemma}
\begin{proof}
  Suppose control is never handled over to $\mmlAtmmlAtmscomp{\library_{comp}}$; that is, there is no $\irl{Call\ ?\ foo\ n}$ in $\irl{\trace}$.
  In this case, the goals follow easily, since the semantics of $\mmlAt$ and $\mmlAtms$ are identical and $\irl{\library_{ctx}}=\trg{\library_{ctx}}$.

  If control is handled over, we have, at some point in the reduction by transitivty, $\exec{\irl{\Omega_{0}}}{\mmlAtmmlAtmscomp{e_{foo}}\irl{[\valueexpr/x]}}{\irl{\commlib;\library;\kontstack;\ctx;H^{\ctx};H^{\comp};\Delta}}{\irl{\finalexprnoerr}}{\irl{\trace}}$.
  Thus, we can apply \Thmref{lem:sms:backwardsim} and are done.
\end{proof}


\begin{lemma}[Program Backward Simulation]\label{lem:backwardsim:toplevel}
  If
  \begin{assumptions}
    \item $\wexec{\irl{prog\ \library_{ctx}\ }\mmlAtmmlAtmscomp{\library_{comp}}}{\irl{\Omega}}{\irl{\finalexpr}}{\irl{\trace}}$
    \item $\irl{\library_{ctx}}=\trg{\library_{ctx}}$
    \item $\irl{\Omega}=\trg{\Omega}$
    \item $\irl{\trace}=\trg{\trace}$
    \item $\irl{\finalexprnoerr}=\trg{\finalexprnoerr}$
  \end{assumptions}
  Then
  \begin{goals}
    \item $\wexec{\trg{prog\ \library_{ctx}\ \library_{comp}}}{\trg{\Omega}}{\trg{\finalexpr}}{\trg{\trace}}$
  \end{goals}
\end{lemma}
\begin{proof}
  Immediate consequence of \Thmref{lem:backtransms}.
\end{proof}


\begin{theorem}[TMS Relation Correctness for $\mmlAtmmlAtmscomp{\bullet}$]\label{thm:tms-rel-corr:lsmslms}
  \begin{align*}
    \text{ if }& 
    \tospecificevi[^*_{\delta_{MS}}]{\color{black}\sigma_{\tospecificevi[^*_{\delta_{MS}}]{\bullet}}(\tmssafe)} = \tmssafe
    \text{ and } 
    \xlangtraceeq{\color{black}\sigma_{\xlangtraceeq{}{}}(\sigma_{\tospecificevt[^*_{\delta_{MS}}]{\bullet}}(\tmssafe))}{\color{black}\sigma_{\tospecificevi[^*_{\delta_{MS}}]{\bullet}}(\tmssafe)}
    \\
    \text{ then }& 
    \tospecificevt[^*_{\delta_{MS}}]{\color{black}\sigma_{\xlangtraceeq{}{}}(\sigma_{\tospecificevi[^*_{\delta_{MS}}]{\bullet}}(\tmssafe))} = \tmssafe 
  \end{align*}
\end{theorem}
\begin{proof}
  unfolding.
\end{proof}
\begin{theorem}[SMS Relation Correctness for $\mmlAtmmlAtmscomp{\bullet}$]\label{thm:sms-rel-corr:lsmslms}
  \begin{align*}
    \text{ if }& 
    \tospecificevi[^*_{\delta_{MS}}]{\color{black}\sigma_{\tospecificevi[^*_{\delta_{MS}}]{\bullet}}(\smssafe)} = \smssafe
    \text{ and } 
    \xlangtraceeq{\color{black}\sigma_{\xlangtraceeq{}{}}(\sigma_{\tospecificevt[^*_{\delta_{MS}}]{\bullet}}(\smssafe))}{\color{black}\sigma_{\tospecificevi[^*_{\delta_{MS}}]{\bullet}}(\smssafe)}
    \\
    \text{ then }& 
    \tospecificevt[^*_{\delta_{MS}}]{\color{black}\sigma_{\xlangtraceeq{}{}}(\sigma_{\tospecificevi[^*_{\delta_{MS}}]{\bullet}}(\smssafe))} = \smssafe 
  \end{align*}
\end{theorem}
\begin{proof}
  unfolding, works since memory accesses need to be in bounds.
\end{proof}
\begin{theorem}[sCCT Relation Correctness for $\mmlAtmmlAtmscomp{\bullet}$]\label{thm:scct-rel-corr:lsmslms}
  \begin{align*}
    \text{ if }& 
    \tospecificevi[^*_{\delta_{MS}}]{\color{black}\sigma_{\tospecificevi[^*_{\delta_{MS}}]{\bullet}}(\scctsafe)} = \scctsafe
    \text{ and } 
    \xlangtraceeq{\color{black}\sigma_{\xlangtraceeq{}{}}(\sigma_{\tospecificevt[^*_{\delta_{MS}}]{\bullet}}(\scctsafe))}{\color{black}\sigma_{\tospecificevi[^*_{\delta_{MS}}]{\bullet}}(\scctsafe)}
    \\
    \text{ then }& 
    \tospecificevt[^*_{\delta_{MS}}]{\color{black}\sigma_{\xlangtraceeq{}{}}(\sigma_{\tospecificevi[^*_{\delta_{MS}}]{\bullet}}(\scctsafe))} = \scctsafe 
  \end{align*}
\end{theorem}
\begin{proof}
  unfolding.
\end{proof}
\begin{theorem}[SS Relation Correctness for $\mmlAtmmlAtmscomp{\bullet}$]\label{thm:spec-rel-corr:lsmslms}
  \begin{align*}
    \text{ if }& 
    \tospecificevi[^*_{\delta_{MS}}]{\color{black}\sigma_{\tospecificevi[^*_{\delta_{MS}}]{\bullet}}(\specsafe)} = \specsafe
    \text{ and } 
    \xlangtraceeq{\color{black}\sigma_{\xlangtraceeq{}{}}(\sigma_{\tospecificevt[^*_{\delta_{MS}}]{\bullet}}(\specsafe))}{\color{black}\sigma_{\tospecificevi[^*_{\delta_{MS}}]{\bullet}}(\specsafe)}
    \\
    \text{ then }& 
    \tospecificevt[^*_{\delta_{MS}}]{\color{black}\sigma_{\xlangtraceeq{}{}}(\sigma_{\tospecificevi[^*_{\delta_{MS}}]{\bullet}}(\specsafe))} = \specsafe 
  \end{align*}
\end{theorem}
\begin{proof}
  unfolding.
\end{proof}

\begin{theorem}[SMS Relation Correctness for $\mmlAtmsmmlAtscctcomp{\bullet}$]\label{thm:sms-rel-corr:lmslscct}
  \begin{align*}
    \text{ if }& 
    \tospecificevo[^*_{\delta_{MS}}]{\color{black}\sigma_{\tospecificevo[^*_{\delta_{MS}}]{\bullet}}(\smssafe)} = \smssafe
    \text{ and } 
    \xlangtraceeq{\color{black}\sigma_{\xlangtraceeq{}{}}(\sigma_{\tospecificevi[^*_{\delta_{MS}}]{\bullet}}(\smssafe))}{\color{black}\sigma_{\tospecificevo[^*_{\delta_{MS}}]{\bullet}}(\smssafe)}
    \\
    \text{ then }& 
    \tospecificevi[^*_{\delta_{MS}}]{\color{black}\sigma_{\xlangtraceeq{}{}}(\sigma_{\tospecificevo[^*_{\delta_{MS}}]{\bullet}}(\smssafe))} = \smssafe 
  \end{align*}
\end{theorem}
\begin{proof}
  unfolding.
\end{proof}
\begin{theorem}[sCCT Relation Correctness for $\mmlAtmsmmlAtscctcomp{\bullet}$]\label{thm:scct-rel-corr:lmslscct}
  \begin{align*}
    \text{ if }& 
    \tospecificevo[^*_{\delta_{MS}}]{\color{black}\sigma_{\tospecificevo[^*_{\delta_{MS}}]{\bullet}}(\scctsafe)} = \scctsafe
    \text{ and } 
    \xlangtraceeq{\color{black}\sigma_{\xlangtraceeq{}{}}(\sigma_{\tospecificevi[^*_{\delta_{MS}}]{\bullet}}(\scctsafe))}{\color{black}\sigma_{\tospecificevo[^*_{\delta_{MS}}]{\bullet}}(\scctsafe)}
    \\
    \text{ then }& 
    \tospecificevi[^*_{\delta_{MS}}]{\color{black}\sigma_{\xlangtraceeq{}{}}(\sigma_{\tospecificevo[^*_{\delta_{MS}}]{\bullet}}(\scctsafe))} = \scctsafe 
  \end{align*}
\end{theorem}
\begin{proof}
  unfolding, works since there must not occur leaks according to the x-lang relation.
\end{proof}
\begin{theorem}[SS Relation Correctness for $\mmlAtmsmmlAtscctcomp{\bullet}$]\label{thm:spec-rel-corr:lmslscct}
  \begin{align*}
    \text{ if }& 
    \tospecificevo[^*_{\delta_{MS}}]{\color{black}\sigma_{\tospecificevo[^*_{\delta_{MS}}]{\bullet}}(\specsafe)} = \specsafe
    \text{ and } 
    \xlangtraceeq{\color{black}\sigma_{\xlangtraceeq{}{}}(\sigma_{\tospecificevi[^*_{\delta_{MS}}]{\bullet}}(\specsafe))}{\color{black}\sigma_{\tospecificevo[^*_{\delta_{MS}}]{\bullet}}(\specsafe)}
    \\
    \text{ then }& 
    \tospecificevi[^*_{\delta_{MS}}]{\color{black}\sigma_{\xlangtraceeq{}{}}(\sigma_{\tospecificevo[^*_{\delta_{MS}}]{\bullet}}(\specsafe))} = \specsafe 
  \end{align*}
\end{theorem}
\begin{proof}
  unfolding.
\end{proof}

\begin{definition}[$\mmlAtms$ Robust Satisfaction]
  We write $\irl{\library_{ctx}}\vDash_{R}\pi$ for
  $$
    \forall \irl{\library_{comp}}\ \irl{\trace}\ \irl{\Omega}\ \irl{\finalexpr}, \wexect{\irl{prog\ \library_{\ctx}\ \library_{\comp}}}{\irl{\Omega}}{\irl{\finalexpr}}{\irl{\trace}} \implies \exists \delta_{MS}, \tospecificevt[_{\delta_{MS}}]{\irl{\trace}}\in\pi
  $$
\end{definition}

\begin{scontents}[store-env=buffer]
  $\;$\\
% If
% \begin{assumptions}
% \item\label[ass]{asm:rsmsp:srcsms} $\forall \delta_{MS}\ \trg{\library_{ctx}}\ \trg{\library_{comp}}\ \trg{\trace}\ \trg{\Omega}\ \trg{v}, \wexect{prog\ \library_{ctx}\ \library_{comp}}{\configt}{\finalexpr}{\trace}\rightarrow\tospecificevt[_{\delta_{MS}}]{\trace}\in\operatorname{smsafe}$
% \item\label[ass]{asm:rsmsp:irlexec} $\wexec{\irl{prog\ \library_{ctx}\ }\mmlAtmmlAtmscomp{\library_{comp}}}{\irl{\Omega}}{\irl{\finalexpr}}{\irl{\trace}}$
% \end{assumptions}
% then $\exists \delta_{MS}',$
  \begin{goals}
%    \item\label[goal]{rsmsp:sms} $\tospecificevi[_{\delta_{MS}'}]{\trace}\in\operatorname{smsafe}$
    \item\label[ass]{asm:rsmsp:comp} $\vdash\mmlAtmmlAtmscomp{\bullet}:\lceil\operatorname{smsafe}\rceil$
  \end{goals}
\end{scontents}

\realthm{thm:rsmsp}{5}{Robust \gls{sms} Preservation}
\begin{proof}
  Unfold \Cref{asm:rsmsp:comp}, so if:
  \begin{passumptions}{H}
    \item $\pi\in\lceil\operatorname{smsafe}\rceil$
    \item\label[ass]{asm:rsmsp:srcsms} $\trg{\library_{\comp}}\vDash_{R}\pi$
  \end{passumptions}
  then
  \begin{goals}
    \item\label[ass]{asm:rsmsp:rsatt} $\mmlAtmmlAtmscomp{\library_{\comp}}\vDash_{R}\pi$
  \end{goals}
  Unfold \Cref{asm:rsmsp:rsatt}:
  If
  \begin{passumptions}{H}
    \setcounter{enumi}{2}
    \item\label[ass]{asm:rsmsp:wexecirl} $\wexec{\irl{prog\ \library_{\ctx}\ }\color{black}\mmlAtmmlAtmscomp{\library_{\comp}}}{\irl{\Omega}}{\irl{\finalexpr}}{\irl{\trace}}$
  \end{passumptions}
  then $\exists \delta_{MS}$
  \begin{goals}
    \item $\tospecificevt[_{\delta_{MS}}]{\irl{\trace}}\in\pi$
  \end{goals}
  Use \Thmref{lem:backwardsim:toplevel} on \Cref{asm:rsmsp:wexecirl}: (remember that $\irl{\trace}=\trg{\trace}$, since $\mmlAtms=\mmlAt$)
  \begin{passumptions}{H}
    \setcounter{enumi}{3}
    \item\label[ass]{asm:rsmsp:twprog} $\wexec{\trg{prog\ \library_{ctx}\ \library_{comp}}}{\trg{\Omega}}{\trg{\finalexpr}}{\trg{\trace}}$
  \end{passumptions}
  Apply \Cref{asm:rsmsp:srcsms} to our goal.

  Conclude with \Cref{asm:rsmsp:twprog}.
\end{proof}

\begin{scontents}[store-env=buffer]
  $\;$\\
%  If
%  \begin{assumptions}
%  \item\label[ass]{asm:rsmsp:srcsms} $\forall \delta_{MS}\ \src{\library_{ctx}}\ \src{\library_{comp}}\ \src{\trace}\ \src{\Omega}\ \src{v}, \wexecs{prog\ \library_{ctx}\ \library_{comp}}{\configs}{\finalexpr}{\trace}\rightarrow\tospecificevs[_{\delta_{MS}}]{\trace}\in\operatorname{msafe}$
%  \item\label[ass]{asm:rsmsp:irlexec} $\wexec{\irl{prog\ \library_{ctx}\ }\mmlAtmmlAtmscomp{\color{black}\mmlAmmlAtcomp{\library_{comp}}}}{\irl{\Omega}}{\irl{\finalexpr}}{\irl{\trace}}$
%  \end{assumptions}
  \begin{goals}
%    \item\label[goal]{rsmsp:sms} $\tospecificevi[_{\delta_{MS}'}]{\trace}\in\operatorname{msafe}$
    \item $\vdash\mmlAtmmlAtmscomp{\color{black}\mmlAmmlAtcomp{\bullet}}:\lceil\operatorname{msafe}\rceil$
  \end{goals}
\end{scontents}
\realthm{thm:rmsp}{6}{Robust Memory Safety Preservation}
\begin{proof}
  Note from \Thmref{thm:rtmsp} and \Thmref{thm:rsmsp}:
  \begin{passumptions}{H}
    \item\label[ass]{ass:msmsp:tms} $\rtp{\mmlAmmlAtcomp{\bullet}}{\lceil\operatorname{tmsafe}\rceil}$
    \item\label[ass]{ass:msmsp:sms} $\rtp{\mmlAtmmlAtmscomp{\bullet}}{\lceil\operatorname{smsafe}\rceil}$
  \end{passumptions}
  By \Thmref{lem:seqcompo} using \Cref{ass:msmsp:tms,ass:msmsp:sms}, we have:
  \begin{passumptions}{H}
    \item $\rtp{\mmlAtmmlAtmscomp{\color{black}\mmlAmmlAtcomp{\bullet}}}{\lceil\operatorname{tmsafe}\rceil\cap\lceil\operatorname{smsafe}\rceil}$
  \end{passumptions}
  This is exactly what we want to prove here, since by \Cref{def:memsafe}, $\operatorname{msafe}=\operatorname{tmsafe}\cap\operatorname{smsafe}$, noting that the powerset is closed under intersection.
\end{proof}
\begin{proof}[Proof (Alternative)]
  By definition, if
  \begin{passumptions}{H}
    \item\label[ass]{asm:rmtsp:pi:msafe} $\pi\in\lceil\operatorname{msafe}\rceil$
    \item\label[ass]{asm:rmtsp:srcrsat} $\src{\library_{\ctx}}\vDash_{R}\pi$
  \end{passumptions}
  Then
  \begin{goals}
    \item\label[goal]{goal:rmtsp:rsat} $\mmlAtmmlAtmscomp{\color{black}\mmlAmmlAtcomp{\library_{\ctx}}}\vDash_{R}\pi$
  \end{goals}

  By \Cref{def:memsafe}, we have $\operatorname{msafe}=\operatorname{tmsafe}\cap\operatorname{smsafe}$.

  So, since powerset is closed under intersection, we can split \Cref{asm:rmtsp:pi:msafe} into:
  \begin{passumptions}{H}
    \setcounter{enumi}{2}
    \item\label[ass]{asm:rmtsp:pi:tmsafe} $\pi\in\lceil\operatorname{tmsafe}\rceil$
    \item\label[ass]{asm:rmtsp:pi:smsafe} $\pi\in\lceil\operatorname{smsafe}\rceil$
  \end{passumptions}

  With \Cref{asm:rmtsp:pi:tmsafe,asm:rmtsp:srcrsat} we use \Thmref{thm:rtmsp}:
  \begin{passumptions}{H}
    \setcounter{enumi}{4}
    \item\label[ass]{asm:rmtsp:trgrsat} $\mmlAmmlAtcomp{\library_{\ctx}}\vDash_{R}\pi$
  \end{passumptions}

  With \Cref{asm:rmtsp:pi:smsafe,asm:rmtsp:trgrsat} we use \Thmref{thm:rsmsp}:
  \begin{passumptions}{H}
    \setcounter{enumi}{5}
    \item\label[ass]{asm:rmtsp:smsrsat} $\mmlAtmmlAtmscomp{\color{black}\mmlAmmlAtcomp{\library_{\ctx}}}\vDash_{R}\pi$
  \end{passumptions}
  This solves \Cref{goal:rmtsp:rsat}.
\end{proof}

\begin{theorem}[TMS Relation Correctness for $\mmlAmmlAtcomp{\bullet}$]\label{thm:tms-rel-corr:ltmslsms}
  \begin{align*}
    \text{ if }& 
    \tospecificevs[^*_{\delta_{MS}}]{\color{black}\sigma_{\tospecificevs[^*_{\delta_{MS}}]{\bullet}}(\tmssafe)} = \tmssafe
    \text{ and } 
    \xlangtraceeq{\color{black}\sigma_{\xlangtraceeq{}{}}(\sigma_{\tospecificevt[^*_{\delta_{MS}}]{\bullet}}(\tmssafe))}{\color{black}\sigma_{\tospecificevt[^*_{\delta_{MS}}]{\bullet}}(\tmssafe)}
    \\
    \text{ then }& 
    \tospecificevs[^*_{\delta_{MS}}]{\color{black}\sigma_{\xlangtraceeq{}{}}(\sigma_{\tospecificevt[^*_{\delta_{MS}}]{\bullet}}(\tmssafe))} = \tmssafe 
  \end{align*}
\end{theorem}
\begin{proof}
  unfolding.
\end{proof}
\begin{theorem}[SMS Relation Correctness for $\mmlAmmlAtcomp{\bullet}$]\label{thm:sms-rel-corr:ltmslsms}
  \begin{align*}
    \text{ if }& 
    \tospecificevs[^*_{\delta_{MS}}]{\color{black}\sigma_{\tospecificevs[^*_{\delta_{MS}}]{\bullet}}(\smssafe)} = \smssafe
    \text{ and } 
    \xlangtraceeq{\color{black}\sigma_{\xlangtraceeq{}{}}(\sigma_{\tospecificevt[^*_{\delta_{MS}}]{\bullet}}(\smssafe))}{\color{black}\sigma_{\tospecificevt[^*_{\delta_{MS}}]{\bullet}}(\smssafe)}
    \\
    \text{ then }& 
    \tospecificevs[^*_{\delta_{MS}}]{\color{black}\sigma_{\xlangtraceeq{}{}}(\sigma_{\tospecificevt[^*_{\delta_{MS}}]{\bullet}}(\smssafe))} = \smssafe 
  \end{align*}
\end{theorem}
\begin{proof}
  unfolding.
\end{proof}
\begin{theorem}[sCCT Relation Correctness for $\mmlAmmlAtcomp{\bullet}$]\label{thm:scct-rel-corr:ltmslsms}
  \begin{align*}
    \text{ if }& 
    \tospecificevs[^*_{\delta_{MS}}]{\color{black}\sigma_{\tospecificevs[^*_{\delta_{MS}}]{\bullet}}(\scctsafe)} = \scctsafe
    \text{ and } 
    \xlangtraceeq{\color{black}\sigma_{\xlangtraceeq{}{}}(\sigma_{\tospecificevt[^*_{\delta_{MS}}]{\bullet}}(\scctsafe))}{\color{black}\sigma_{\tospecificevt[^*_{\delta_{MS}}]{\bullet}}(\scctsafe)}
    \\
    \text{ then }& 
    \tospecificevs[^*_{\delta_{MS}}]{\color{black}\sigma_{\xlangtraceeq{}{}}(\sigma_{\tospecificevt[^*_{\delta_{MS}}]{\bullet}}(\scctsafe))} = \scctsafe 
  \end{align*}
\end{theorem}
\begin{proof}
  unfolding.
\end{proof}
\begin{theorem}[SS Relation Correctness for $\mmlAmmlAtcomp{\bullet}$]\label{thm:spec-rel-corr:ltmslsms}
  \begin{align*}
    \text{ if }& 
    \tospecificevs[^*_{\delta_{MS}}]{\color{black}\sigma_{\tospecificevs[^*_{\delta_{MS}}]{\bullet}}(\specsafe)} = \specsafe
    \text{ and } 
    \xlangtraceeq{\color{black}\sigma_{\xlangtraceeq{}{}}(\sigma_{\tospecificevt[^*_{\delta_{MS}}]{\bullet}}(\specsafe))}{\color{black}\sigma_{\tospecificevt[^*_{\delta_{MS}}]{\bullet}}(\specsafe)}
    \\
    \text{ then }& 
    \tospecificevs[^*_{\delta_{MS}}]{\color{black}\sigma_{\xlangtraceeq{}{}}(\sigma_{\tospecificevt[^*_{\delta_{MS}}]{\bullet}}(\specsafe))} = \specsafe 
  \end{align*}
\end{theorem}
\begin{proof}
  unfolding.
\end{proof}


\subsection{Optimising Passes}
\subsubsection{DCE}

\myfig{
  \begin{center}
    \begin{gather*}
    \judgbox{\dcecomp{e}=\irl{e'}}{,,Compile $\mmlAtms$ expression $\irl{e}$ to $\mmlAtms$ expression $\irl{e'}$.''}\\
    \judgbox{\dcecomp{\left[\valueexpr / x\right]}=\irl{\left[\valueexpr / x\right]}}{,,Compile $\mmlAtms$ substitution to $\mmlAtms$ substitution.''} \\
    \judgbox{\dcecomp{\commlib}=\irl{\commlib'}}{,,Compile $\mmlAtms$ component library to $\mmlAtms$ component library.''} \\
    \end{gather*}
    $$
    \begin{array}{rll}
    \dcecomp{\finalexpr} &\ = & \irl{\finalexpr} \\
    \dcecomp{call\ foo\ e} &\ = & \irl{call\ }\dcecomp{foo}\ \dcecomp{e}\\
    \dcecomp{return\ e} &\ = & \irl{return\ }\dcecomp{e}\\
    \dcecomp{e_1\oplus e_2} &\ = & \dcecomp{e_1} \irl{\oplus} \dcecomp{e_2} \\
    \dcecomp{x[e]} &\ = & \irl{x[}\dcecomp{e}\irl{]}\\
    \dcecomp{let\ x= e_1\ in\ e_2} &\ = & \irl{let\ x=} \dcecomp{e_1}\irl{\ in\ }\dcecomp{e_2} \\
    \dcecomp{x[e_1]\leftarrow e_2} &\ = & \irl{x[}\dcecomp{e_1}\irl{]\leftarrow }\dcecomp{e_2} \\
    \dcecomp{let\ x=new\ e_1\ in\ e_2} &\ = & \irl{let\ x=new\ } \dcecomp{e_1}\irl{\ in\ }\dcecomp{e_2} \\
    \dcecomp{delete\ x} &\ = & \irl{delete\ x} \\
    \dcecomp{x\ is\ \poisoned} &\ = & \irl{x\ is\ \poisoned} \\
    \dcecomp{\lparen e_1;e_2\rparen} &\ = & \irl{\lparen}\dcecomp{e_1}\irl{;}\dcecomp{e_2}\irl{\rparen}\\
    \dcecomp{\pi_1\ e} &\ = & \irl{\pi_1\ }\dcecomp{e}\\
    \dcecomp{\pi_2\ e} &\ = & \irl{\pi_2\ }\dcecomp{e}\\
    \dcecomp{e\ has\ \type} &\ = & \dcecomp{e}\ \irl{has\ \type}\\
    \dcecomp{ifz\ true\ then\ e_2\ else\ e_3} &\ = & \irl{e_2} \\
    \dcecomp{ifz\ true\ then\ e_3\ else\ e_3} &\ = & \irl{e_3} \\
    \dcecomp{ifz\ e_1\ then\ e_2\ else\ e_3} &\ = & \irl{ifz\ }\dcecomp{e_1}\\
                                                        &&\irl{then\ }\dcecomp{e_2} \\
                                                        &&\irl{else\ }\dcecomp{e_3} \\[0.5cm]

    %
    \dcecomp{\left[\valueexpr/x\right]}&\ = & \irl{\left[\right.}\dcecomp{v}\irl{/}\dcecomp{x}\irl{\left.\right]} \\[0.5cm]
    %
    \dcecomp{\hole{\cdot}}&\ = & \irl{\hole{\cdot}} \\
    \dcecomp{foo,\commlib}&\ = & \irl{foo,}\dcecomp{\commlib} \\
    \end{array}
    $$
  \end{center}
}{dce-compiler}{Compiler from $\mmlAtms$ to $\mmlAtms$, performing dead code elimination.}

Since the traces do not change after compiling with $\dcecomp{\bullet}$, the security proof follows easily using a context-based backtranslation that is essentially just the identity. 
Anything else is similar to \Cref{subsec:rsms}.

\subsubsection{CF}

\myfig{
  \begin{center}
    \begin{gather*}
    \judgbox{\cfcomp{e}=\irl{e'}}{,,Compile $\mmlAtms$ expression $\irl{e}$ to $\mmlAtms$ expression $\irl{e'}$.''}\\
    \judgbox{\cfcomp{\commlib}=\irl{\commlib'}}{,,Compile $\mmlAtms$ component library to $\mmlAtms$ component library.''} \\
    \end{gather*}
    $$
    \begin{array}{rll}
      \cfcomp{x} &\ = & \irl{v}\text{\ \ \ \ \ if }\irl{[v\text{ for }x]}\in\irl{\overline{\rho}} \\
      \cfcomp{x} &\ = & \irl{x}\text{\ \ \ \ \ if }\irl{[v\text{ for }x]}\not\in\irl{\overline{\rho}} \\
    \cfcomp{\finalexpr} &\ = & \irl{\finalexpr} \\
    \cfcomp{call\ foo\ e} &\ = & \irl{call\ }\cfcomp{foo}\ \cfcomp{e}\\
    \cfcomp{return\ e} &\ = & \irl{return\ }\cfcomp{e}\\
    \cfcomp{n\oplus m} &\ = & \irl{k}\text{\ \ \ \ where }\irl{k}=\irl{n}\oplus\irl{m}\\
    \cfcomp{e_1\oplus e_2} &\ = & \cfcomp{e_1} \irl{\oplus} \cfcomp{e_2} \\
    \cfcomp{x[e]} &\ = & \irl{x[}\cfcomp{e}\irl{]}\\
    \cfcomp{let\ x= v\ in\ e} &\ = & \cfcomp[\text{[}v\text{ for }x\text{]}\cdot\overline{\rho}]{e_2} \\
    \cfcomp{let\ x= e_1\ in\ e_2} &\ = & \irl{let\ x=} \cfcomp{e_1}\irl{\ in\ }\cfcomp{e_2} \\
    \cfcomp{x[e_1]\leftarrow e_2} &\ = & \irl{x[}\cfcomp{e_1}\irl{]\leftarrow }\cfcomp{e_2} \\
    \cfcomp{let\ x=new\ e_1\ in\ e_2} &\ = & \irl{let\ x=new\ } \cfcomp{e_1}\irl{\ in\ }\cfcomp{e_2} \\
    \cfcomp{delete\ x} &\ = & \irl{delete\ x} \\
    \cfcomp{x\ is\ \poisoned} &\ = & \irl{x\ is\ \poisoned} \\
    \cfcomp{\lparen e_1;e_2\rparen} &\ = & \irl{\lparen}\cfcomp{e_1}\irl{;}\cfcomp{e_2}\irl{\rparen}\\
    \cfcomp{\pi_1\ e} &\ = & \irl{\pi_1\ }\cfcomp{e}\\
    \cfcomp{\pi_2\ e} &\ = & \irl{\pi_2\ }\cfcomp{e}\\
    \cfcomp{e\ has\ \type} &\ = & \cfcomp{e}\ \irl{has\ \type}\\
    \cfcomp{ifz\ e_1\ then\ e_2\ else\ e_3} &\ = & \irl{ifz\ }\cfcomp{e_1}\\
                                                        &&\irl{then\ }\cfcomp{e_2} \\
                                                        &&\irl{else\ }\cfcomp{e_3} \\[0.5cm]

    %
    \cfcomp{\hole{\cdot}}&\ = & \irl{\hole{\cdot}} \\
    \cfcomp{foo,\commlib}&\ = & \irl{foo,}\cfcomp{\commlib} \\
    \end{array}
    $$
  \end{center}
}{cf-compiler}{Compiler from $\mmlAtms$ to $\mmlAtms$, performing constant folding.}

Since the traces do not change after compiling with $\cfcomp{\bullet}$, the security proof follows easily using a context-based backtranslation that is essentially just the identity. 
Anything else is similar to \Cref{subsec:rsms}.

\subsection{Object Language}

\myfig{
	\vspace{-1em}
  \begin{gather*}
  \begin{aligned}
  \mi{Final\ Result}\ \obj{\finalexprnoerr} \bnfdef&\ \obj{\valueexpr^{\sigma}} \mid \obj{x^{\sigma}} \hspace{0.5cm}
  \mi{May\ be\ a\ Result}\ \obj{\finalexpr} \bnfdef\ \obj{\finalexprnoerr} \mid \obj{stuck} \\
  %
  \mi{Expressions}~\obj{e} \bnfdef&\ \obj{\finalexpr} \mid \obj{e_{1} \oplus e_{2}} \mid \obj{x[e]} \mid \obj{getDIT\ x\ in\ e} \mid \obj{setDIT\ e} \\
  & \mid \obj{let\ x = e_{1}\ in\ e_{2}} \mid \obj{x[e_{1}]\leftarrow e_{2}} \\
  & \mid \obj{let\ x = new\ e_{1}\ in\ e_{2}} \mid \obj{delete\ x} \\
  & \mid \obj{return\ e} \mid \obj{call\ foo\ e} \mid \obj{ifz\ e_{1}\ then\ e_{2}\ else\ e_{3}} \\
  & \mid \obj{abort()} \mid \obj{x\ is\ \poisoned} \\
  & \mid \obj{\langle e_{1},e_{2}\rangle} \mid \obj{\pi_{1} e} \mid \obj{\pi_{2} e} \mid \obj{e\ has\ \type} \\
   &\text{where } \obj{\oplus}\in\{\obj{+},\obj{-},\obj{\times},\obj{<},\obj{/}\}\\
  %
  \mi{Functions}~\obj{\asymbol} \bnfdef&\ \obj{let\ foo\ x:= e} \hspace{0.25cm}
  \mi{Types}~\obj{\type} \bnfdef\ \obj{\nat} \mid \obj{\nat\times\nat} \\
  %
  \mi{Values}~\obj{\valueexpr} \bnfdef&\ \obj{n}\in\obj{\nat} \hspace{0.25cm}
  %
  \mi{References}~\obj{\loc}\in\obj{\nat} \\
  \mi{Eval. Ctx.}~\obj{K}\bnfdef &\ \obj{\hole{\cdot}}\mid \obj{K\oplus e}\mid \obj{v\oplus K}\mid \obj{x[K]}\mid \obj{let\ x=K\ in\ e}\\
                     &\ \mid\obj{x[K]\leftarrow e}\mid \obj{x[v]\leftarrow K}\mid \obj{let\ x=new\ K\ in\ e} \\
                     &\ \mid\obj{ifz\ K\ then\ e_1\ else\ e_2} \mid \obj{call\ foo\ K}\mid \obj{return\ K} \\
                     &\ \mid\obj{\langle K, e\rangle} \mid \obj{\langle \valueexpr, K \rangle } \mid \obj{\pi_{1} K} \mid \obj{\pi_{2} K} \mid \obj{K\ has\ \type} \\
                     &\ \mid\obj{ifz\ K\ then\ e_{1}\ else\ e_{2}} \mid \obj{setDIT\ K} \\
  %
  \mi{Variables}~\ &\obj{x} \mid \obj{y} \mid \obj{foo} \mid \dots \hspace{0.5cm}
  %
  \mi{Poison}~\ \obj{\poison}~\bnfdef\ \obj{\poisonless} \mid \obj{\poisoned}\\
  \mi{Sandbox\ Tag}~&\ \obj{\sandboxtag}~\bnfdef\ \obj{\ctx} \mid \obj{\comp}\\
  %
  \mi{Typing. Env.}~\obj{\Gamma} \bnfdef&\ \obj{\hole{\cdot}} \mid \obj{\Gamma,x:\type}\hspace{0.5cm}
  \mi{Store}~\obj{\Delta} \bnfdef\ \obj{\hole{\cdot}} \mid \obj{x\mapsto(\loc;\sandboxtag;\poison;n),\Delta}\\
  %
  \mi{Communication}~\obj{\comm} \bnfdef&\ \obj{\ctxtocomp} \mid \obj{\comptoctx} \mid \obj{\nocomm} \hspace{0.5cm}
  \mi{Heaps}~\obj{H} \bnfdef\ \obj{\hole{\cdot}} \mid \obj{H}::\obj{n} \\
  %
  \mi{Cont.\ Stack}~\obj{\kontstack} \bnfdef&\ \obj{\hole{\cdot}} \mid (\obj{K};\obj{foo}),\obj{\kontstack} \hspace{0.5cm}
  \mi{Library}~\obj{\library} \bnfdef\ \obj{\hole{\cdot}} \mid \obj{\asymbol},\obj{\library} \\
  \mi{Relevant}\ \obj{\commlib} \bnfdef& \obj{\hole{\cdot}} \mid \obj{foo},\obj{\commlib}\hspace{0.5cm}
  \mi{State}~\obj{\Omega}\ \bnfdef\ \obj{\cfstate;\sandboxtag;n;\memstate}\\
  \mi{Flow\ State}~\obj{\cfstate}\bnfdef&\ \obj{\commlib;\library;\kontstack}\hspace{0.5cm}
  \mi{Memory\ State}~\obj{\memstate}\bnfdef\ \obj{H^{\ctx};H^{\comp};\Delta} \\
  %
  \mi{Programs}\ &\obj{prog\ \library_{ctx}\ \library_{comp}} \hspace{0.35cm}
  \mi{Substitutions}~\obj{\gamma} \bnfdef \obj{[\valueexpr/x],\gamma}\ \vert\ \obj{\hole{\cdot}} \\
  \mi{Security\ Tag}~\obj{\sigma} \bnfdef&\ \obj{\lock} \mid \obj{\unlock}
  \end{aligned}
  \end{gather*}
}{mmlao-syntax}{Syntax of $\mmlAtscct$}

The only difference between $\mmlAtms$ and $\mmlAtscct$ is that we have access to model specific registers by means of the $\obj{getDIT}$ and $\obj{setDIT}$ instructions.
Thus, we also extend the dynamic state with a special purpose register representing a model specific register for a data operand independent timing mode).
Whenever this flag is set, certain instructions will run in a ,,constant-time mode''.
Usually, access to model specific registers requires privileged execution. Since we want to model the strongest possible attacker, we disregard privilege and, thus, grant contexts access to that variable.

The language also has security tags to model annotations to variables (and, by taint analysis, to expressions) as high or low.
$\obj{\lock}$ means it's high, while $\obj{\unlock}$ means it's low. We have an $\obj{\cdot}\le\obj{\cdot}$ such that $\obj{\lock}\le\obj{\unlock}$.
Final results are tagged with the respected taint and the semantics keeps track of this taint during execution.

\subsubsection{Dynamic Semantics}

\myfig{
  \judgbox{\operatorname{dom}\ \obj{\library}=\obj{foo},\dots,\obj{bar}}{,,Collect function names.''}$\;$\\
  \begin{center}
    \typerule{$\obj{\library}$-dom-$\obj{\hole{\cdot}}$}{
    }{
      \operatorname{dom}\ \obj{\hole{\cdot}} = \obj{\hole{\cdot}}
    }{wo-lib-dom-empty}
    %
    \typerule{$\obj{\library}$-dom-cons}{
      \operatorname{dom}\ \obj{\library} = \obj{D}
    }{
      \operatorname{dom}\ (\obj{let\ foo\ x : \type}_\lambda\obj{:= e})\obj{,\library} = \obj{foo},\obj{D}
    }{wo-lib-dom-cons}
  \end{center}
  \begin{center}
    \judgbox{\obj{\library}\equiv\obj{\library_1}\cup\obj{\library_2}}{,,Merging $\mmlAo$ libraries.''}$\;$\\
    \typerule{lib-merge-empty}{
      \obj{\library}=\obj{\library_1}
    }{
      \obj{\library}\equiv\obj{\library_1}\cup\obj{\hole{\cdot}}
    }{obj-lib-merge-empty}
    %
    \typerule{lib-merge-cons}{
      \obj{\library}\equiv\obj{\library_1}\cup\obj{\library_2}
    }{
      \obj{\asymbol,\library}\equiv\obj{\library_1}\cup\obj{\asymbol,\library_2}
    }{obj-lib-merge-cons}

    \judgbox{\obj{\library_1\linker\library_2}=\obj{\library}}{,,Syntactically linking $\mmlAo$ libraries.''}$\;$\\
    \typerule{syntactic-plugging}{
      \operatorname{dom}\obj{\library_1}\cap\operatorname{dom}\obj{\library_2} = \emptyset &
      \obj{\library}\equiv\obj{\library_1}\cup\obj{\library_2}
    }{
      \obj{\library_1\linker\library_2} = \obj{\library}
    }{obj-plugging}
  \end{center}
}{w-plugging-o}{$\mmlAo$ plugging of libraries and collecting of function names.}


\myfig{
  \begin{gather*}
  \begin{aligned}
  \mi{Base~Events}~\obj{\event_{b}} \bnfdef&\ \obj{Alloc\ \loc\ \valueexpr} \mid \obj{Dealloc\ \loc} \mid \obj{Get\ \loc\ \valueexpr} \mid \obj{Set\ \loc\ \valueexpr\ \valueexpr'} \mid \obj{\lightning}\\
                                           & \mid \obj{Call\ \comm\ foo\ \valueexpr} \mid \obj{Ret\ \comm\ \valueexpr} \mid \obj{Start} \mid \obj{End\ \valueexpr} \\
                                           & \mid \obj{Branch\ n} \mid \obj{Binop\ n\ m} \\
    & \mid \obj{{iGet}\ \loc\ \valueexpr} \mid \obj{{iSet}\ \loc\ \valueexpr\ \valueexpr'} \\
  \mi{Events}~\obj{\event} \bnfdef&\ \obj{\emptyevent} \mid \obj{\event_{b};\sandboxtag;\sigma}
  \end{aligned}
  \end{gather*}
}{to-events}{Events of $\mmlAo$.}

\myfig{
  \begin{center}
    \judgbox{\obj{\cdot}\le\obj{\cdot}}{,,Order of security labels.''}$\;$\\
    %
    \typerule{leq-$\obj{\unlock}$-refl}{
    }{
      \obj{\unlock}\le\obj{\unlock}
    }{leq-unlock-refl}
    %
    \typerule{leq-lock}{
    }{
      \obj{\lock}\le\obj{\sigma}
    }{leq-lock}
    %

    \judgbox{\obj{\cdot}\sqcap\obj{\cdot}}{,,Meet of security labels.''}$\;$\\
    %
    \typerule{meet-refl}{
    }{
      \obj{\sigma}\sqcap\obj{\sigma}=\obj{\sigma}
    }{meet-refl}
    %
    \typerule{meet-ineq}{
      \obj{\sigma}\not=\obj{\sigma'}
    }{
      \obj{\sigma}\sqcap\obj{\sigma'}=\obj{\unlock}
    }{meet-ineq}
  \end{center}
}{to-security-meet}{Lattice operations for security labels.}

\myfig{
  \judgbox{\exprevalo{\Omega}{e}{\Omega'}{e'}{\event}}{,,Expression $\obj{e}$ evaluates under Configuration $\obj{\Omega}$ to $\obj{e'}$ and\\new Configuration $\obj{\Omega'}$, emitting event $\obj{\event}$.''}
  %
  \typerule{$e-\obj{\oplus}-$noleak-op}{
    \obj{n_1}\oplus\obj{n_2}=\obj{n_3} &
    \obj{\oplus}\notin\{\obj{*},\obj{/},\obj{<}\} \\
    \obj{\sigma''}=\obj{\sigma\sqcap\sigma'}
  }{
    \exprevalo{\Omega}{n_1^\sigma \oplus n_2^{\sigma'}}{\Omega}{n_3^{\sigma''}}{\emptyevent}
  }{to-e-oplus-noleak-op}
  %
  \typerule{$e-\obj{\oplus}-$leak}{
    \obj{n_1}\oplus\obj{n_2}=\obj{n_3} &
    \obj{\oplus}\in\{\obj{*},\obj{/},\obj{<}\} \\
    \obj{\sigma''}=\obj{\sigma\sqcap\sigma'}
  }{
    \exprevalo{\cfstate;\sandboxtag;0;\memstate}{n_1^\sigma\oplus n_2^{\sigma'}}{\cfstate;\sandboxtag;0;\memstate}{n_3^{\sigma''}}{Binop\ n_1\ n_2;\sandboxtag;\sigma''}
  }{to-e-oplus-leak}
  %
  \typerule{$e-\obj{\oplus}-$noleak-doit}{
    \obj{n_1}\oplus\obj{n_2}=\obj{n_3} &
    \obj{\oplus}\in\{\obj{*},\obj{/},\obj{<}\} \\
    \obj{\sigma''}=\obj{\sigma\sqcap\sigma'}
  }{
    \exprevalo{\cfstate;\sandboxtag;m+1;\memstate}{n_1^\sigma\oplus n_2^{\sigma'}}{\cfstate;\sandboxtag;m+1;\memstate}{n_3^{\sigma''}}{\emptyevent}
  }{to-e-oplus-leak-doit}
  %
  \typerule{$e-\obj{get}-\in-$leak}{
    \obj{\memstate}=\obj{H^{\ctx};H^{\comp};\Delta_1,x\mapsto(\loc;\sandboxtag;\poison;m),\Delta_2} &
    \obj{\loc}+\obj{n}\in\text{dom }\obj{H^{\sandboxtag}} \\
    \obj{\sigma''}=\obj{\sigma\sqcap\sigma'}
  }{
    \exprevalo{\cfstate;\sandboxtag';0;\memstate}{x^\sigma[n^{\sigma'}]}{\cfstate;\sandboxtag';0;\memstate}{(H^{\sandboxtag}(\loc+n))^{\sigma''}}{Get\ \loc\ n;\sandboxtag;\sigma''}
  }{to-e-get-in-leak}
  %
  \typerule{$e-\obj{get}-\notin-$leak}{
    \obj{\memstate}=\obj{H^{\ctx};H^{\comp};\Delta_1,x\mapsto(\loc;\sandboxtag;\poison;m),\Delta_2} &
    \obj{\loc}\notin\text{dom }\obj{H^{\sandboxtag}} \\
    \obj{\sigma''}=\obj{\sigma\sqcap\sigma'}
  }{
    \exprevalo{\cfstate;\sandboxtag';0;\memstate}{x^\sigma[n^{\sigma'}]}{\cfstate;\sandboxtag';0;\memstate}{1729^{\unlock}}{Get\ \loc\ n;\sandboxtag;\sigma''}
  }{to-e-get-notin-leak}
  %
  \typerule{$e-\obj{get}-\in-$noleak}{
    \obj{\memstate}=\obj{H^{\ctx};H^{\comp};\Delta_1,x\mapsto(\loc;\sandboxtag;\poison;m),\Delta_2} &
    \obj{\loc}+\obj{n}\in\text{dom }\obj{H^{\sandboxtag}} \\
    \obj{\sigma''}=\obj{\sigma\sqcap\sigma'}
  }{
    \exprevalo{\cfstate;\sandboxtag';m+1;\memstate}{x^\sigma[n^{\sigma'}]}{\cfstate;\sandboxtag';m+1;\memstate}{(H^{\sandboxtag}(\loc+n))^{\sigma''}}{{iGet}\ \loc\ n;\sandboxtag;\sigma''}
  }{to-e-get-in-noleak}
  %
  \typerule{$e-\obj{get}-\notin-$noleak}{
    \obj{\memstate}=\obj{H^{\ctx};H^{\comp};\Delta_1,x\mapsto(\loc;\sandboxtag;\poison;m),\Delta_2} &
    \obj{\loc}\notin\text{dom }\obj{H^{\sandboxtag}} \\
    \obj{\sigma''}=\obj{\sigma\sqcap\sigma'}
  }{
    \exprevalo{\cfstate;\sandboxtag';m+1;\memstate}{x^\sigma[n^{\sigma'}]}{\cfstate;\sandboxtag';m+1;\memstate}{1729^{\unlock}}{{iGet}\ \loc\ n;\sandboxtag;\sigma''}
  }{to-e-get-notin-noleak}
  %
  \typerule{$e-\obj{set}-\ctx-$leak}{
    \obj{\memstate}=\obj{H^{\ctx};H^{\comp};\Delta_1,x\mapsto(\loc;\ctx;\poison;n),\Delta_2} &
    \obj{H^{\ctx'}} = \obj{H^{\ctx}}(\obj{\loc+n}\mapsto \obj{v}) \\
    \obj{\memstate'}=\obj{H^{\ctx'};H^{\comp};\Delta_1,x\mapsto(\loc;\ctx;\poison;n),\Delta_2} &
    \obj{\sigma'''}=\obj{\sigma\sqcap\sigma'}
  }{
    \exprevalo{\cfstate;\ctx;0;\memstate}{x^\sigma[n^{\sigma'}]\leftarrow v^{\sigma''}}{\cfstate;\ctx;0;\memstate'}{v^{\sigma''}}{Set\ \loc\ n\ v;\ctx;\sigma'''}
  }{to-e-set-ctx-leak}
  %
  \typerule{$e-\obj{set}-\comp-$leak}{
    \obj{\memstate}=\obj{H^{\ctx};H^{\comp};\Delta_1,x\mapsto(\loc;\comp;\poison;n),\Delta_2} &
    \obj{H^{\comp'}} = \obj{H^{\comp}}(\obj{\loc+n}\mapsto \obj{v}) \\
    \obj{\memstate'}=\obj{H^{\ctx};H^{\comp'};\Delta_1,x\mapsto(\loc;\comp;\poison;n),\Delta_2} &
    \obj{\sigma'''}=\obj{\sigma\sqcap\sigma'}
  }{
    \exprevalo{\cfstate;\comp;0;\memstate}{x^\sigma[n^{\sigma'}]\leftarrow v^{\sigma''}}{\cfstate;\comp;0;\memstate'}{v^{\sigma''}}{Set\ \loc\ n\ v;\comp;\sigma'''}
  }{to-e-set-comp-leak}
}{to-expr-eval-0}{Evaluation of $\mmlAtscct$ expressions.}
\myfig{
  \typerule{$e-\obj{set}-\ctx-$noleak}{
    \obj{\memstate}=\obj{H^{\ctx};H^{\comp};\Delta_1,x\mapsto(\loc;\ctx;\poison;n),\Delta_2} &
    \obj{H^{\ctx'}} = \obj{H^{\ctx}}(\obj{\loc+n}\mapsto \obj{v}) \\
    \obj{\memstate'}=\obj{H^{\ctx'};H^{\comp};\Delta_1,x\mapsto(\loc;\ctx;\poison;n),\Delta_2} &
    \obj{\sigma'''}=\obj{\sigma\sqcap\sigma'}
  }{
    \exprevalo{\cfstate;\ctx;m+1;\memstate}{x^\sigma[n^{\sigma'}]\leftarrow v^{\sigma''}}{\cfstate;\ctx;m+1;\memstate'}{v^{\sigma''}}{{iSet}\ \loc\ n\ v;\ctx;\sigma'''}
  }{to-e-set-ctx-noleak}
  %
  \typerule{$e-\obj{set}-\comp-$noleak}{
    \obj{\memstate}=\obj{H^{\ctx};H^{\comp};\Delta_1,x\mapsto(\loc;\comp;\poison;n),\Delta_2} &
    \obj{H^{\comp'}} = \obj{H^{\comp}}(\obj{\loc+n}\mapsto \obj{v}) \\
    \obj{\memstate'}=\obj{H^{\ctx};H^{\comp'};\Delta_1,x\mapsto(\loc;\comp;\poison;n),\Delta_2} &
    \obj{\sigma'''}=\obj{\sigma\sqcap\sigma'}
  }{
    \exprevalo{\cfstate;\comp;m+1;\memstate}{x^\sigma[n^{\sigma'}]\leftarrow v^{\sigma''}}{\cfstate;\comp;m+1;\memstate'}{v^{\sigma''}}{{iSet}\ \loc\ n\ v;\comp;\sigma'''}
  }{to-e-set-comp-noleak}
  %
  \typerule{$e-\obj{let}-\obj{\finalexprnoerr}$}{
    \obj{\sigma''}=\obj{\sigma\sqcap\sigma'}
  }{
    \exprevalo{\Omega}{let\ x^\sigma=\finalexprnoerr^{\sigma'}\ in\ e}{\Omega}{e[\finalexprnoerr^{\sigma''}/x]}{\emptyevent}
  }{to-e-let-f}
  %
  \typerule{$e-\obj{delete}$}{
    \obj{\memstate}=\obj{H^{\ctx};H^{\comp};\Delta_1,x\mapsto(\loc;\sandboxtag;\poisonless;n),\Delta_2} \\
    \obj{\memstate}=\obj{H^{\ctx};H^{\comp};\Delta_1,x\mapsto(\loc;\sandboxtag;\poisoned;n),\Delta_2}
  }{
    \exprevalo{\cfstate;\sandboxtag;m;\memstate}{delete\ x^\sigma}{\cfstate;\sandboxtag;m;\memstate'}{0^\unlock}{Dealloc\ \loc;\sandboxtag;\sigma}
  }{to-e-delete}
  %
  \typerule{$e-\obj{new}-ctx$}{
    \fresh{\obj{\Delta}}{\obj{\loc}} &
    \fresh{\obj{\Delta}}{\obj{z}} &
    \obj{H^{\ctx'}} = \obj{H^{\ctx}} \ll \obj{n} \\
    \obj{\memstate} = \obj{H^{\ctx'};H^{\comp};z\mapsto (\loc;\ctx;\poisonless;n),\Delta} &
    \obj{\sigma''}=\obj{\sigma\sqcap\sigma'}
  }{
    \exprevalo{\cfstate;\ctx;m;H^{\ctx};H^{\comp};\Delta}{let\ x^\sigma=new\ n^{\sigma'}\ in\ e}{\cfstate;\ctx;m;\memstate}{e[z^{\sigma''}/x]}{Alloc\ \loc\ n;\ctx;\sigma''}
  }{to-e-let-new-ctx}
  %
  \typerule{$e-\obj{new}-comp$}{
    \fresh{\obj{\Delta}}{\obj{\loc}} &
    \fresh{\obj{\Delta}}{\obj{z}} &
    \obj{H^{\comp'}} = \obj{H^{\comp}} \ll \obj{n} \\
    \obj{\memstate} = \obj{H^{\ctx};H^{\comp'};z\mapsto (\loc;\ctx;\poisonless;n),\Delta} &
    \obj{\sigma''}=\obj{\sigma\sqcap\sigma'}
  }{
    \exprevalo{\cfstate;\comp;m;H^{\ctx};H^{\comp};\Delta}{let\ x^\sigma=new\ n^{\sigma'}\ in\ e}{\cfstate;\comp;m;\memstate}{e[z^{\sigma''}/x]}{Alloc\ \loc\ n;\comp;\sigma''}
  }{to-e-let-new-comp}
  %
  \typerule{$e-\obj{ifz}-$true-noleak}{
  }{
    \exprevalo{\cfstate;\sandboxtag;0;\memstate}{ifz\ 0^\sigma\ then\ e_1\ else\ e_2}{\cfstate;\sandboxtag;0;\memstate}{e_1}{Branch\ 0;\sandboxtag;\sigma}
  }{to-e-if-true-noleak}
  %
  \typerule{$e-\obj{ifz}-$false-noleak}{
  }{
    \exprevalo{\cfstate;\sandboxtag;0;\memstate}{ifz\ (S\ n)^\sigma\ then\ e_1\ else\ e_2}{\cfstate;\sandboxtag;0;\memstate}{e_2}{Branch\ S(n);\sandboxtag;\sigma}
  }{to-e-if-false-noleak}
  %
  \typerule{$e-\obj{ifz}-$true-leak}{
  }{
    \exprevalo{\cfstate;\sandboxtag;m+1;\memstate}{ifz\ 0^\sigma\ then\ e_1\ else\ e_2}{\cfstate;\sandboxtag;m+1;\memstate}{e_1}{\emptyevent}
  }{to-e-if-true-leak}
  %
  \typerule{$e-\obj{ifz}-$false-leak}{
  }{
    \exprevalo{\cfstate;\sandboxtag;m+1;\memstate}{ifz\ (S\ n)^\sigma\ then\ e_1\ else\ e_2}{\cfstate;\sandboxtag;m+1;\memstate}{e_2}{\emptyevent}
  }{to-e-if-false-leak}
  %
  \typerule{$e-\obj{abort}$}{
  }{
    \exprevalo{\cfstate;\sandboxtag;m;\memstate}{abort()}{\cfstate;\sandboxtag;m;\memstate}{stuck}{\lightning;\sandboxtag;\unlock}
  }{to-e-abort}
}{to-expr-eval-1}{Evaluation of $\mmlAtscct$ expressions, continued.}

\myfig{
  \typerule{$e-\obj{\pi_1}$}{
  }{
    \exprevalo{\Omega}{\pi_1\langle n_1^\sigma;n_2^{\sigma'}\rangle}{\Omega}{n_1^\sigma}{\emptyevent}
  }{to-e-proj1}
  %
  \typerule{$e-\obj{\pi_2}$}{
  }{
    \exprevalo{\Omega}{\pi_2\langle n_1^\sigma;n_2^{\sigma'}\rangle}{\Omega}{n_2^{\sigma'}}{\emptyevent}
  }{to-e-proj2}
  %
  \typerule{$e-\obj{x\ is\ \poisoned}-$yes}{
    \obj{\memstate}=\obj{H^{\ctx};H^{\comp};\Delta} &
    \obj{\Delta}=\obj{\Delta_1,x\mapsto(\loc;\sandboxtag;\poisoned;n),\Delta_2}
  }{
    \exprevalo{\cfstate;\sandboxtag';m;\memstate}{x^\sigma\ is\ \poisoned}{\cfstate;\sandboxtag';m;\memstate}{0^\unlock}{\emptyevent}
  }{to-e-x-is-poisoned-yes}
  %
  \typerule{$e-\obj{x\ is\ \poisoned}-$no}{
    \obj{\memstate}=\obj{H^{\ctx};H^{\comp};\Delta} &
    \obj{\Delta}=\obj{\Delta_1,x\mapsto(\loc;\sandboxtag;\poisonless;n),\Delta_2}
  }{
    \exprevalo{\cfstate;\sandboxtag';m;\memstate}{x^\sigma\ is\ \poisoned}{\cfstate;\sandboxtag';m;\memstate}{1^\unlock}{\emptyevent}
  }{to-e-x-is-poisoned-no}
  %
  \typerule{$e-\obj{n\ has\ \nat}$}{
  }{
    \exprevalo{\Omega}{n^\sigma\ has\ \nat}{\Omega}{0^\unlock}{\emptyevent}
  }{to-e-n-hasnat}
  %
  \typerule{$e-pair-\obj{has\ \nat}$}{
  }{
    \exprevalo{\Omega}{\langle n_1^\sigma,n_2^{\sigma'}\rangle\ has\ \nat}{\Omega}{1^\unlock}{\emptyevent}
  }{to-e-pair-hasnat}
  %
  \typerule{$e-\obj{x\ has\ \nat}$}{
  }{
    \exprevalo{\Omega}{x^\sigma\ has\ \nat}{\Omega}{1^\unlock}{\emptyevent}
  }{to-e-x-hasnat}
  %
  \typerule{$e-\obj{n\ has\ \nat\times\nat}$}{
  }{
    \exprevalo{\Omega}{n^\sigma\ has\ \nat\times\nat}{\Omega}{1^\unlock}{\emptyevent}
  }{to-e-n-haspair}
  %
  \typerule{$e-pair-\obj{has\ \nat\times\nat}$}{
  }{
    \exprevalo{\Omega}{\langle n_1^\sigma,n_2^{\sigma'}\rangle\ has\ \nat\times\nat}{\Omega}{0^\unlock}{\emptyevent}
  }{to-e-pair-haspair}
  %
  \typerule{$e-\obj{x\ has\ \nat\times\nat}$}{
  }{
    \exprevalo{\Omega}{x^\sigma\ has\ \nat\times\nat}{\Omega}{1^\unlock}{\emptyevent}
  }{to-e-x-haspair}
  %
  \typerule{$e-\obj{setDIT\ n}$}{
  }{
    \exprevalo{\cfstate;\sandboxtag;m;\memstate}{setDIT\ n^\sigma}{\cfstate;\sandboxtag;n;\memstate}{n^\sigma}{\emptyevent}
  }{to-e-setDIT}
  %
  \typerule{$e-\obj{getDIT\ x\ in\ e}$}{
  }{
    \exprevalo{\cfstate;\sandboxtag;n;\memstate}{getDIT\ x^\sigma\ in\ e}{\cfstate;\sandboxtag;n;\memstate}{e[n^\sigma/x]}{\emptyevent}
  }{to-e-getDIT}
}{to-expr-eval-2}{Evaluation of $\mmlAo$ expressions, continued.}

\myfig{
  \begin{center}
    \judgbox{\execo[]{\Omega}{K[e]}{\Omega'}{K[e']}{\event}}{,,Given an evaluation context $\obj{K}$ and an expression\\ $\obj{e}$, it evaluates under configuration $\Omega$ to $\obj{e'}$ and new\\configuration $\obj{\Omega'}$ in context $\obj{K}$, emitting event $\obj{\event}$.''}
    %
    \typerule{$e-\text{ctx}$}{
      \exprevalo{\Omega}{e}{\Omega'}{e'}{\event}
    }{
      \execo[]{\Omega}{K[e]}{\Omega'}{K[e']}{\event}
    }{to-e-ectx}
    %
    \typerule{$e-\text{ctx}-\obj{stuck}$}{
      \exprevalo{\Omega}{e}{\Omega'}{stuck}{\lightning}
    }{
      \execo[]{\Omega}{K[e]}{\Omega'}{stuck}{\lightning}
    }{to-e-ectx-stuck}
    %
    \typerule{$e-\text{ctx}-\obj{call}-$main}{
      \obj{\Omega}=\obj{\commlib;\library;\hole{\cdot};\comp;0;\memstate} &
      \obj{\library}=\obj{\library_1,}(\obj{let\ main\ x:\type}_\lambda\obj{:=e})\obj{,\library_2}\\
      \obj{\Omega'}=\obj{\commlib;\library;K^{main},\hole{\cdot};\ctx;0;\memstate}
    }{
      \execo[]{\Omega}{K[call\ main^\sigma\ \valueexpr^{\sigma'}]}{\Omega'}{e[\valueexpr^{\sigma'}/x]}{Start;\comp;\sigma'}
    }{to-e-ectx-call-main}
    %
    \typerule{$e-\text{ctx}-\obj{call}-\text{notsame}$}{
      \obj{\Omega}=\obj{\commlib;\library;\kontstack;\sandboxtag;m;\memstate} &
      \obj{\library}=\obj{\library_1,}(\obj{let\ foo\ x:\type}_\lambda\obj{:=e})\obj{,\library_2} \\
      %\rho_{\tiny call}(\obj{\commlib},\obj{foo},\obj{\kontstack},\obj{v}) = \obj{\event},\obj{\comm} &
      \obj{foo}\in_{\obj{\neg\sandboxtag}}\obj{\commlib} &
      \rho\left(\obj{\neg\sandboxtag}\right) = \obj{\comm} &
      \obj{\Omega'}=\obj{\commlib;\library;K^{foo},\kontstack;\neg\sandboxtag;m;\memstate} \\
    }{
      \execo[]{\Omega}{K[call\ foo^\sigma\ \valueexpr^{\sigma'}]}{\Omega'}{e[\valueexpr^{\sigma'}/x]}{Call\ \comm\ foo\ \valueexpr;\sandboxtag;\sigma'}
    }{to-e-ectx-call-notsame}
    %
    \typerule{$e-\text{ctx}-\obj{call}-\text{same}$}{
      \obj{\Omega}=\obj{\commlib;\library;\kontstack;\sandboxtag;m;\memstate} &
      \obj{\library}=\obj{\library_1,}(\obj{let\ foo\ x:\type}_\lambda\obj{:=e})\obj{,\library_2} \\
      %\rho_{\tiny call}(\obj{\commlib},\obj{foo},\obj{\kontstack},\obj{v}) = \obj{\event},\obj{\comm} &
      \obj{foo}\in_{\obj{\sandboxtag}}\obj{\commlib} &
      \obj{\Omega'}=\obj{\commlib;\library;K^{foo},\kontstack;\sandboxtag;m;\memstate} \\
    }{
      \execo[]{\Omega}{K[call\ foo^\sigma\ \valueexpr^{\sigma'}]}{\Omega'}{e[\valueexpr^{\sigma'}/x]}{Call\ \nocomm\ foo\ \valueexpr;\sandboxtag;\sigma'}
    }{to-e-ectx-call-same}
    %
    \typerule{$e-\text{ctx}-\obj{return}-$main}{
    }{
      \exec[]{\obj{\commlib;\library;\hole{\cdot}^{main},\hole{\cdot};\ctx;m;\memstate}}{\obj{K'[return\ \valueexpr^\sigma]}}{\obj{\commlib;\library;\hole{\cdot};\comp;1;\memstate}}{\obj{\valueexpr^\sigma}}{\obj{End\ \valueexpr;\sandboxtag;\sigma}}
    }{to-e-ectx-ret-main}
    %
    \typerule{$e-\text{ctx}-\obj{return}-\text{notsame}$}{
      \obj{foo}\in_{\obj{\neg\sandboxtag}}\obj{\commlib} &
      \rho\left(\obj{\neg\sandboxtag}\right) = \obj{\comm;\sandboxtag}
    }{
      \exec[]{\obj{\commlib;\library;K^{foo},\kontstack;\sandboxtag;m;\memstate}}{\obj{K'[return\ \valueexpr^\sigma]}}{\obj{\commlib;\library;\kontstack;\neg\sandboxtag;m;\memstate}}{\obj{K[\valueexpr^\sigma]}}{\obj{Ret\ \comm\ \valueexpr;\sandboxtag;\sigma}}
    }{to-e-ectx-ret-notsame}
    %
    \typerule{$e-\text{ctx}-\obj{return}-\text{same}$}{
      \obj{foo}\in_{\obj{\sandboxtag}}\obj{\commlib}
    }{
      \exec[]{\obj{\commlib;\library;K^{foo},\kontstack;\sandboxtag;m;\memstate}}{\obj{K'[return\ \valueexpr^\sigma]}}{\obj{\commlib;\library;\kontstack;\sandboxtag;m;\memstate}}{\obj{K[\valueexpr^\sigma]}}{\obj{Ret\ \nocomm\ \valueexpr;\sandboxtag;\sigma}}
    }{to-e-ectx-ret-same}
    %
    \judgbox{\rho(\obj{\sandboxtag})=\obj{\comm}}{,,Returns either $\obj{\ctxtocomp}$ or $\obj{\comptoctx}$ depending on $\obj{\sandboxtag}$.''}\\
    %
    \typerule{comm-ctxtocomp}{
    }{
      \rho(\obj{\ctx})=\obj{\ctxtocomp}
    }{to-comm-ctxtocomp}
    %
    \typerule{comm-comptoctx}{
    }{
      \rho(\obj{\comp})=\obj{\comptoctx}
    }{to-comm-comptoctx}\\[0.33cm]
    %
    \judgbox{\obj{\neg\sandboxtag}=\obj{\sandboxtag'}}{,,Negation of $\obj{\sandboxtag}$.''}\\
    %
    \typerule{neg-ctx}{
    }{
      \obj{\neg\ctx}=\obj{\comp}
    }{to-neg-ctx}
    %
    \typerule{neg-comp}{
    }{
      \obj{\neg\comp}=\obj{\ctx}
    }{to-neg-comp}
  \end{center}
}{w-o-expr-ctx-eval}{Contextual Evaluation of $\mmlAtscct$ expressions.}

\myfig{
  \begin{center}
    \judgbox{\execo{\Omega}{e}{\Omega'}{e'}{\trace}}{,,Expression $\obj{e}$ evaluates under configuration $\obj{\Omega}$ to $\obj{e'}$ and\\new configuration $\obj{\Omega'}$, emitting list of events $\obj{\trace}$.''}
    %
    \typerule{$et-\text{refl}$}{
    }{
      \execo{\Omega}{\finalexpr}{\Omega}{\finalexpr}{\hole{\cdot}}
    }{wo-e-refl}
    \typerule{$et-\text{trans}-$important}{
      \execo[]{\Omega}{e}{\Omega'}{e'}{\event}&
      \execo{\Omega'}{e'}{\Omega''}{e''}{\trace}&
      \obj{a}\not=\obj{\emptyevent}
    }{
      \execo{\Omega}{e}{\Omega''}{e''}{\event \cdot \trace}
    }{wo-e-trans-important}
    \typerule{$et-\text{trans}-$unimportant}{
      \execo[]{\Omega}{e}{\Omega'}{e'}{\emptyevent}&
      \execo{\Omega'}{e'}{\Omega''}{e''}{\trace}&
    }{
      \execo{\Omega}{e}{\Omega''}{e''}{\trace}
    }{wo-e-trans-unimportant}
    %
    %
    \judgbox{\execoN{\Omega}{e}{\Omega'}{e'}{\trace}}{,,Expression $\obj{e}$ evaluates in $n$ steps under configuration $\obj{\Omega}$ to\\$\obj{e'}$ and new configuration $\obj{\Omega'}$, emitting list of events $\obj{\trace}$.''}
    %
    \typerule{$en-\text{refl}$}{
    }{
      \execoN[^0]{\Omega}{e}{\Omega}{e}{\emptyevent}
    }{won-e-refl}
    %
    \typerule{$en-\text{trans}-$important}{
      \execo[]{\Omega}{e}{\Omega'}{e'}{\event} &
      \execoN[^n]{\Omega'}{e'}{\Omega''}{e''}{\trace} &
      \obj{\event}\not=\obj{\emptyevent}
    }{
      \execoN[^{(n+1)}]{\Omega}{e}{\Omega''}{e''}{\event\cdot\trace}
    }{won-e-trans-important}
    %
    \typerule{$en-\text{trans}-$unimportant}{
      \execo[]{\Omega}{e}{\Omega'}{e'}{\emptyevent} &
      \execoN[^n]{\Omega'}{e'}{\Omega''}{e''}{\trace} &
    }{
      \execoN[^{(n+1)}]{\Omega}{e}{\Omega''}{e''}{\trace}
    }{won-e-trans-unimportant}
  \end{center}
}{wo-steps}{Trace prefix generation given a $\mmlAtscct$ program using the reflexive-transitive closure.}

\myfig{
  \begin{center}
    \judgbox{\wexeco{prog\ \library_{ctx}\ \library_{comp}}{\Omega}{\finalexprnoerr}{\trace}}{,,Run $\mmlAtscct$ program $\obj{prog\ \library_{ctx}\ \library_{comp}}$, giving\\dynamic state $\obj{\Omega}$ and emitting trace $\obj{\trace}$.''}
    \typerule{$e-\text{wprog}$}{
      \obj{\library}=\obj{\library_{ctx}\linker\library_{comp}} &
      \obj{main}\notin\obj{\commlib} &
      \obj{\commlib}=\operatorname{dom}\ \obj{\library_{comp}} \\
      \execo{\commlib;\library;\hole{\cdot};\sandboxtag;1;\hole{\cdot};\hole{\cdot};\hole{\cdot}}{call\ main\ 0}{\Omega}{\finalexpr}{\trace}
    }{
      \wexeco{prog\ \library_{ctx}\ \library_{comp}}{\Omega}{\finalexpr}{\trace}
    }{wo-e-prog}
    %
    \typerule{$e-\text{wprog}-\lightning$}{
      \obj{\library}=\obj{\library_{ctx}\linker\library_{comp}} &
      \obj{main}\notin\obj{\commlib} &
      \obj{\commlib}=\operatorname{dom}\ \obj{\library_{comp}} \\
      \execo{\commlib;\library;\hole{\cdot};\sandboxtag;1;\hole{\cdot};\hole{\cdot};\hole{\cdot}}{call\ main\ 0}{\Omega}{\finalexpr}{\trace\cdot\lightning;\sandboxtag}
    }{
      \wexeco{prog\ \library_{ctx}\ \library_{comp}}{\Omega}{\finalexpr}{\trace\cdot\lightning;\sandboxtag}
    }{wo-e-prog-crash}
  \end{center}
}{toprog-run}{Running a whole $\mmlAtscct$ program.}

\subsubsection{Translation to Specification Events}

\myfig{
  \begin{center}
    \judgbox{\delta_{MS}(\obj{\loc})=\specificev{\loc}}{,,A map from $\mmlAo$ memory locations $\obj{\loc}$ to specification locations $\specificev{\loc}$.''}
    \judgbox{\tospecificevo[_{\delta_{MS}}]{\event} = \msevent}{,,Project an $\mmlAo$ event to specification events.''}
    %
    \typerule{o-filter-context}{
      \obj{\event_b} \not= \obj{\lightning}
    }{
      \tospecificevo[_{\delta_{MS}}]{\event_b;\ctx;\sigma} = \specificev{\emptyevent}
    }{o-filter-context}
    %
    \typerule{o-filter-comp-start}{
    }{
      \tospecificevo[_{\delta_{MS}}]{Start;\comp;\sigma} = \specificev{\emptyevent}
    }{o-filter-comp-start}
    %
    \typerule{o-filter-comp-end}{
    }{
      \tospecificevo[_{\delta_{MS}}]{End\ \valueexpr;\comp;\sigma} = \specificev{\emptyevent}
    }{o-filter-comp-end}
    %
    \typerule{o-filter-comp-alloc}{
      \delta_{MS}(\obj{\loc})=\specificev{\loc} &
      \specificev{n}=\obj{n}
    }{
      \tospecificevo[_{\delta_{MS}}]{Alloc\ \loc\ n;\comp;\sigma} = \specificev{Alloc\ \loc\ n}
    }{o-filter-comp-alloc}
    %
    \typerule{o-filter-comp-dealloc}{
      \delta_{MS}(\obj{\loc})=\specificev{\loc}
    }{
      \tospecificevo[_{\delta_{MS}}]{Dealloc\ \loc;\comp;\sigma} = \specificev{Dealloc\ \loc}
    }{o-filter-comp-dealloc}
    %
    \typerule{o-filter-comp-get-noleak}{
      \delta_{MS}(\obj{\loc})=\specificev{\loc} &
      \specificev{n}=\obj{n}
    }{
      \tospecificevo[_{\delta_{MS}}]{{iGet}\ \loc\ n;\comp;\sigma} = \specificev{Use\ \loc\ n}
    }{o-filter-comp-get-noleak}
    %
    \typerule{o-filter-comp-set-noleak}{
      \delta_{MS}(\obj{\loc})=\specificev{\loc} &
      \specificev{n}=\obj{n}
    }{
      \tospecificevo[_{\delta_{MS}}]{{iSet}\ \loc\ n\ \valueexpr;\comp;\sigma} = \specificev{Use\ \loc\ n}
    }{o-filter-comp-set-noleak}
    %
    \typerule{o-filter-comp-get-leak}{
      \delta_{MS}(\obj{\loc})=\specificev{\loc} &
      \specificev{n}=\obj{n}
    }{
      \tospecificevo[_{\delta_{MS}}]{Get\ \loc\ n;\comp;\sigma} = \specificev{Use\ \loc\ n}
    }{o-filter-comp-get-leak}
    %
    \typerule{o-filter-comp-set-leak}{
      \delta_{MS}(\obj{\loc})=\specificev{\loc} &
      \specificev{n}=\obj{n}
    }{
      \tospecificevo[_{\delta_{MS}}]{Set\ \loc\ n\ \valueexpr;\comp;\sigma} = \specificev{Use\ \loc\ n}
    }{o-filter-comp-set-leak}
    %
    \typerule{o-filter-comp-call}{
    }{
      \tospecificevo[_{\delta_{MS}}]{Call\ \comm\ foo\ \valueexpr;\comp;\sigma} = \specificev{\emptyevent}
    }{o-filter-comp-call}
    %
    \typerule{o-filter-comp-ret}{
    }{
      \tospecificevo[_{\delta_{MS}}]{Ret\ \comm\ \valueexpr;\comp;\sigma} = \specificev{\emptyevent}
    }{o-filter-comp-ret}
    %
    \typerule{o-filter-comp-binop}{
    }{
      \tospecificevo[_{\delta_{MS}}]{Binop\ n_1\ n_2;\comp;\sigma} = \specificev{\emptyevent}
    }{o-filter-comp-binop}
    %
    \typerule{o-filter-comp-branch}{
    }{
      \tospecificevo[_{\delta_{MS}}]{Branch\ n;\comp;\sigma} = \specificev{\emptyevent}
    }{o-filter-comp-branch}
    %
    \typerule{o-filter-abort}{
    }{
      \tospecificevo[_{\delta_{MS}}]{\lightning;\sandboxtag;\sigma} = \specificev{\lightning}
    }{o-filter-abort}
    %
    \judgbox{\tospecificevo[^*_{\delta_{MS}}]{\trace} = \mstrace}{,,Project an $\mmlAo$ trace to specification traces.''}
    %
    \typerule{o-filter-empty}{
    }{
      \tospecificevo[^*_{\delta_{MS}}]{\hole{\cdot}} = \specificev{\hole{\cdot}}
    }{o-filter-empty}
    %
    \typerule{o-filter-cons-relevant}{
      \tospecificevo[_{\delta_{MS}}]{\event} = \specificev{\event} &
      \tospecificevo[^*_{\delta_{MS}}]{\trace} = \mstrace &
      \specificev{\event} \not= \specificev{\emptyevent}
    }{
      \tospecificevo[^*_{\delta_{MS}}]{\event\cdot\trace} = \specificev{\event}\cdot\mstrace
    }{o-filter-cons-relevant}
    %
    \typerule{o-filter-cons-relevant}{
      \tospecificevo[_{\delta_{MS}}]{\event} = \specificev{\emptyevent} &
      \tospecificevo[^*_{\delta_{MS}}]{\trace} = \mstrace
    }{
      \tospecificevo[^*_{\delta_{MS}}]{\event\cdot\trace} = \mstrace
    }{o-filter-cons}
  \end{center}
}{wo-ms-events-project-to-specific}{Projection of $\mmlAo$ events to specification events, but for memory safety. Since the security tag of specification events for memory safety doesn't play any role whatsoever, we leave them out for brevity.}
\myfig{
  \begin{center}
    \judgbox{\delta_{\sCCT}(\obj{\loc})=\specificev{\loc}}{,,A map from $\mmlAo$ memory locations $\obj{\loc}$ to specification locations $\specificev{\loc}$.''}
    \judgbox{\tospecificevo[_{\delta_{\sCCT}}]{\event} = \scctevent}{,,Project an $\mmlAo$ event to specification events.''}
    %
    \typerule{o-scct-filter-context}{
      \obj{\event_b} \not= \obj{\lightning}
    }{
      \tospecificevo[_{\delta_{\sCCT}}]{\event_b;\ctx;\sigma} = \specificev{\emptyevent}
    }{o-scct-filter-context}
    %
    \typerule{o-scct-filter-comp-start}{
    }{
      \tospecificevo[_{\delta_{\sCCT}}]{Start;\comp;\sigma} = \specificev{\emptyevent}
    }{o-scct-filter-comp-start}
    %
    \typerule{o-scct-filter-comp-end}{
    }{
      \tospecificevo[_{\delta_{\sCCT}}]{End\ \valueexpr;\comp;\sigma} = \specificev{\emptyevent}
    }{o-scct-filter-comp-end}
    %
    \typerule{o-scct-filter-comp-alloc}{
      \delta_{\sCCT}(\obj{\loc})=\specificev{\loc} &
      \specificev{n}=\obj{n}
    }{
      \tospecificevo[_{\delta_{\sCCT}}]{Alloc\ \loc\ n;\comp;\sigma} = \specificev{Alloc\ \loc\ n;\unlock}
    }{o-scct-filter-comp-alloc}
    %
    \typerule{o-scct-filter-comp-dealloc}{
      \delta_{\sCCT}(\obj{\loc})=\specificev{\loc}
    }{
      \tospecificevo[_{\delta_{\sCCT}}]{Dealloc\ \loc;\comp;\sigma} = \specificev{Dealloc\ \loc;\unlock}
    }{o-scct-filter-comp-dealloc}
    %
    \typerule{o-scct-filter-comp-get-noleak}{
      \delta_{\sCCT}(\obj{\loc})=\specificev{\loc} &
      \specificev{n}=\obj{n}
    }{
      \tospecificevo[_{\delta_{\sCCT}}]{{iGet}\ \loc\ n;\comp;\sigma} = \specificev{\emptyevent}
    }{o-scct-filter-comp-get-noleak}
    %
    \typerule{o-scct-filter-comp-set-noleak}{
      \delta_{\sCCT}(\obj{\loc})=\specificev{\loc} &
      \specificev{n}=\obj{n}
    }{
      \tospecificevo[_{\delta_{\sCCT}}]{{iSet}\ \loc\ n\ \valueexpr;\comp;\sigma} = \specificev{\emptyevent}
    }{o-scct-filter-comp-set-noleak}
    %
    \typerule{o-scct-filter-comp-get-leak}{
      \delta_{\sCCT}(\obj{\loc})=\specificev{\loc} &
      \specificev{n}=\obj{n}
    }{
      \tospecificevo[_{\delta_{\sCCT}}]{Get\ \loc\ n;\comp;\sigma} = \specificev{Use\ \loc\ n;\sigma}
    }{o-scct-filter-comp-get-leak}
    %
    \typerule{o-scct-filter-comp-set-leak}{
      \delta_{\sCCT}(\obj{\loc})=\specificev{\loc} &
      \specificev{n}=\obj{n}
    }{
      \tospecificevo[_{\delta_{\sCCT}}]{Set\ \loc\ n\ \valueexpr;\comp;\sigma} = \specificev{Use\ \loc\ n;\sigma}
    }{o-scct-filter-comp-set-leak}
    %
    \typerule{o-scct-filter-comp-call}{
    }{
      \tospecificevo[_{\delta_{\sCCT}}]{Call\ \comm\ foo\ \valueexpr;\comp;\sigma} = \specificev{\emptyevent}
    }{o-scct-filter-comp-call}
    %
    \typerule{o-scct-filter-comp-ret}{
    }{
      \tospecificevo[_{\delta_{\sCCT}}]{Ret\ \comm\ \valueexpr;\comp;\sigma} = \specificev{\emptyevent}
    }{o-scct-filter-comp-ret}
    %
    \typerule{o-scct-filter-comp-binop}{
    }{
      \tospecificevo[_{\delta_{\sCCT}}]{Binop\ n_1\ n_2;\comp;\sigma} = \specificev{Binop\ n_1\ n_2;\sigma}
    }{o-scct-filter-comp-binop}
    %
    \typerule{o-scct-filter-comp-branch}{
    }{
      \tospecificevo[_{\delta_{\sCCT}}]{Branch\ n;\comp;\sigma} = \specificev{Branch\ n;\sigma}
    }{o-scct-filter-comp-branch}
    %
    \typerule{o-scct-filter-abort}{
    }{
      \tospecificevo[_{\delta_{\sCCT}}]{\lightning;\sandboxtag;\sigma} = \specificev{\lightning;\sigma}
    }{o-scct-filter-abort}
    %
    \typerule{o-scct-filter-emptyevent}{
    }{
      \tospecificevo[_{\delta_{\sCCT}}]{\emptyevent} = \specificev{\emptyevent}
    }{o-scct-filter-emptyevent}
    %
    \judgbox{\tospecificevo[^*_{\delta_{\sCCT}}]{\trace} = \sccttrace}{,,Project an $\mmlAo$ trace to specification traces.''}
    %
    \typerule{o-scct-filter-empty}{
    }{
      \tospecificevo[^*_{\delta_{\sCCT}}]{\hole{\cdot}} = \specificev{\hole{\cdot}}
    }{o-scct-filter-empty}
    %
    \typerule{o-scct-filter-cons-relevant}{
      \tospecificevo[_{\delta_{\sCCT}}]{\event} = \specificev{\event} &
      \tospecificevo[^*_{\delta_{\sCCT}}]{\trace} = \sccttrace &
      \specificev{\event} \not= \specificev{\emptyevent}
    }{
      \tospecificevo[^*_{\delta_{\sCCT}}]{\event\cdot\trace} = \specificev{\event}\cdot\sccttrace
    }{o-scct-filter-cons-relevant}
    %
    \typerule{o-scct-filter-cons-relevant}{
      \tospecificevo[_{\delta_{\sCCT}}]{\event} = \specificev{\emptyevent} &
      \tospecificevo[^*_{\delta_{\sCCT}}]{\trace} = \sccttrace
    }{
      \tospecificevo[^*_{\delta_{\sCCT}}]{\event\cdot\trace} = \sccttrace
    }{o-scct-filter-cons}
  \end{center}
}{wo-scct-events-project-to-specific}{Projection of $\mmlAo$ events to specification events.}

\myfig{
  \begin{center}
    \judgbox{\delta(\irl{\loc})=\obj{\loc}}{,,Map from $\mmlAtms$ locations $\irl{\loc}$ to $\mmlAtscct$ locations $\obj{\loc}$.''} \\
    \judgbox{\xlangtraceeqc{\trace}{\trace}}{,,The $\mmlAtms$ trace $\irl{\trace}$ describes the same actions as $\mmlAtscct$ trace $\obj{\trace}$.''} \\
    \typerule{scct-empty-trace-eq}{
    }{
      \xlangtraceeqc{\hole{\cdot}}{\hole{\cdot}}
    }{scct-empty-trace-eq}
    %
    \typerule{scct-cons-trace-eq}{
      \irl{\sandboxtag}=\obj{\sandboxtag} &
      \xlangeventeqc{\event_{b}}{\event_{b}} &
      \xlangtraceeqc{\trace}{\trace}
    }{
      \xlangtraceeqc{\event_{b};\sandboxtag\cdot\trace}{\event_{b};\sandboxtag;\sigma\cdot\trace}
    }{scct-cons-trace-eq}
    %
    \judgbox{\xlangeventeqc{\event_{b}}{\event_{b}}}{,,The $\mmlAtms$ event $\irl{\event_b}$ describes the same action as $\mmlAtms$ event $\obj{\event_b}$.''} \\
    %
    \typerule{scct-start-event-eq}{
    }{
      \xlangeventeqc{Start}{Start}
    }{scct-start-event-eq}
    %
    \typerule{scct-end-event-eq}{
      \mmlAtmsmmlAtscctcomp{\valueexpr} = \obj{\valueexpr}
    }{
      \xlangeventeqc{End\ \valueexpr}{End\ \valueexpr}
    }{scct-end-event-eq}
    %
    \typerule{scct-alloc-event-eq}{
      \mmlAtmsmmlAtscctcomp{n}=\obj{n} &
      \delta(\irl{\loc})=\obj{\loc}
    }{
      \xlangeventeqc{Alloc\ \loc\ n}{Alloc\ \loc\ n}
    }{scct-alloc-event-eq}
    %
    \typerule{scct-dealloc-event-eq}{
      \delta(\irl{\loc})=\obj{\loc}
    }{
      \xlangeventeqc{Dealloc\ \loc}{Dealloc\ \loc}
    }{scct-dealloc-event-eq}
    %
    \typerule{scct-get-event-eq-noleak}{
      \mmlAtmsmmlAtscctcomp{n} = \obj{n} &
      \delta(\irl{\loc}) = \obj{\loc}
    }{
      \xlangeventeqc{Set\ \loc\ n\ \valueexpr}{{iGet}\ \loc\ n}
    }{scct-get-event-eq-noleak}
    %
    \typerule{scct-get-event-eq-leak}{
      \mmlAtmsmmlAtscctcomp{n} = \obj{n} &
      \delta(\irl{\loc}) = \obj{\loc}
    }{
      \xlangeventeqc{Get\ \loc\ n}{Get\ \loc\ n}
    }{scct-get-event-eq-leak}
    %
    \typerule{scct-set-event-eq-leak}{
      \mmlAtmsmmlAtscctcomp{n} = \obj{n} &
      \mmlAtmsmmlAtscctcomp{\valueexpr} = \obj{\valueexpr} &
      \delta(\irl{\loc}) = \obj{\loc}
    }{
      \xlangeventeqc{Set\ \loc\ n\ \valueexpr}{Set\ \loc\ n\ \valueexpr}
    }{scct-set-event-eq-leak}
    %
    \typerule{scct-set-event-eq-noleak}{
      \mmlAtmsmmlAtscctcomp{n} = \obj{n} &
      \mmlAtmsmmlAtscctcomp{\valueexpr} = \obj{\valueexpr} &
      \delta(\irl{\loc}) = \obj{\loc}
    }{
      \xlangeventeqc{Set\ \loc\ n\ \valueexpr}{{iSet}\ \loc\ n\ \valueexpr}
    }{scct-set-event-eq-noleak}
    %
    \typerule{scct-call-event-eq}{
      \mmlAtmsmmlAtscctcomp{n} = \obj{n} &
      \mmlAtmsmmlAtscctcomp{foo} = \obj{foo} &
      \irl{\comm} = \obj{\comm}
    }{
      \xlangeventeqc{Call\ \comm\ foo\ n}{Call\ \comm\ foo\ n}
    }{scct-call-event-eq}
    %
    \typerule{scct-ret-event-eq}{
      \mmlAtmsmmlAtscctcomp{n} = \obj{n} &
      \irl{\comm} = \obj{\comm}
    }{
      \xlangeventeqc{Ret\ \comm\ n}{Ret\ \comm\ n}
    }{scct-ret-event-eq}
    %
    \typerule{scct-$\irl{\emptyevent}$-event-eq}{
    }{
      \xlangeventeqc{\emptyevent}{\emptyevent}
    }{scct-emptyevent-event-eq}
    %
    \typerule{scct-$\irl{\lightning}$-event-eq}{
    }{
      \xlangeventeqc{\lightning}{\lightning}
    }{scct-abort-event-eq}
    %
    \typerule{scct-binop-event-eq-leak}{
    }{
      \xlangeventeqc{\emptyevent}{Binop\ n_1\ n_2}
    }{scct-binop-event-eq-leak}
    %
    \typerule{scct-branch-event-eq-leak}{
    }{
      \xlangeventeqc{\emptyevent}{Branch\ n}
    }{scct-branch-event-eq-leak}
    $\;$\\
    %
    \judgbox{\irl{\comm} = \obj{\comm}}{,,Communications are equal.''} \\
    %
    \typerule{$\irl{\ctxtocomp}=\obj{\ctxtocomp}$}{
    }{
      \irl{\ctxtocomp}=\obj{\ctxtocomp}
    }{scct-sctxtocomp-eq-tctxtocomp}
    %
    \typerule{$\irl{\comptoctx}=\obj{\comptoctx}$}{
    }{
      \irl{\comptoctx}=\obj{\comptoctx}
    }{scct-scomptoctx-eq-tcomptoctx}
    %
    \typerule{$\irl{\nocomm}=\obj{\nocomm}$}{
    }{
      \irl{\nocomm}=\obj{\nocomm}
    }{scct-snocomm-eq-tnocomm}
  \end{center}
}{scct-pres-trace-relation}{Trace Relation from $\mmlAtms$ to $\mmlAtscct$.}

\myfig{
  \begin{center}
    \judgbox{\delta(\irl{\loc})=\obj{\loc}}{,,The $\mmlAtms$ memory location $\irl{\loc}$ corresponds to\\the $\mmlAtscct$ memory location $\obj{\loc}$.''} \\
    \judgbox{\xlangstateeqc{\Omega}{\Omega}}{,,The $\mmlAtms$ state $\irl{\Omega}$ agrees with $\mmlAtms$ state $\obj{\Omega}$.''} \\
    %
    \typerule{scct-state-eq}{
      \irl{\Omega}=\irl{\cfstate;\sandboxtag;\memstate} &
      \obj{\Omega}=\obj{\cfstate;\sandboxtag;n;\memstate} \\
      \obj{n}\not=\obj{0} &
      \irl{\sandboxtag} = \obj{\sandboxtag} &
      \xlangstateeqc[]{\cfstate}{\cfstate} &
      \xlangstateeqc{\memstate}{\memstate}
    }{
      \xlangstateeqc{\Omega}{\Omega}
    }{scct-state-eq}
    %
    \typerule{scct-abort-state-eq}{
    }{
      \xlangstateeqc{\lightning}{\lightning}
    }{scct-abort-eq}
    %
    \judgbox{\xlangstateeqc{\memstate}{\memstate}}{,,The $\mmlAtms$ memory-state $\irl{\memstate}$ agrees with $\mmlAtscct$ one $\obj{\memstate}$. $\irl{L}$ contains locations\\introduced by the backtranslation wrapper.''}\\
    %
    \typerule{scct-empty-memstate-eq}{
    }{
      \xlangstateeqc{\hole{\cdot};\hole{\cdot};\hole{\cdot}}{\hole{\cdot};\hole{\cdot};\hole{\cdot}}
    }{scct-empty-memstate-eq}
    %
    \typerule{scct-comp-cons-memstate-eq}{
      \irl{\loc}\not\in\irl{L} &
      \irl{n}=\obj{n} &
      \irl{\poison}=\obj{\poison} &
      \delta\left(\irl{\loc}\right)=\obj{\loc} \\
      \irl{\loc},\irl{n}\vdash_{\delta}\irl{H^{\comp}}\approx\obj{H^{\comp}} &
      \xlangstateeqc{H^{\ctx};H^{\comp};\Delta}{H^{\ctx};H^{\comp};\Delta_{1},\Delta_{2}}
    }{
      \xlangstateeqc{H^{\ctx};H^{\comp};x\mapsto(\loc;\comp;\poison;n),\Delta}{H^{\ctx};H^{\comp};\Delta_{1},x\mapsto(\loc;\comp;\poison;n),\Delta_{2}}
    }{scct-comp-cons-memstate-eq}
    %
    \typerule{scct-ctx-cons-memstate-eq}{
      \irl{\loc}\not\in\irl{L} &
      \xlangstateeqc{H^{\ctx};H^{\comp};\Delta}{H^{\ctx};H^{\comp};\Delta}
    }{
      \xlangstateeqc{H^{\ctx};H^{\comp};x\mapsto(\loc;\ctx;\poison;n),\Delta}{H^{\ctx};H^{\comp};\Delta}
    }{scct-ctx-cons-memstate-eq}
    %
    \typerule{scct-whatever-cons-memstate-eq}{
      \irl{\loc}\in\irl{L} &
      \xlangstateeqc{H^{\ctx};H^{\comp};\Delta}{H^{\ctx};H^{\comp};\Delta}
    }{
      \xlangstateeqc{H^{\ctx};H^{\comp};x\mapsto(\loc;\sandboxtag;\poison;n),\Delta}{H^{\ctx};H^{\comp};\Delta}
    }{scct-whatever-cons-memstate-eq}
    %
    %
    \judgbox{\irl{\loc},\irl{n}\vdash_{\delta}\irl{H^{\comp}}\approx\obj{H^{\comp}}}{,,The heaps $\irl{H^{\comp}}$ and $\obj{H^{\comp}}$ are related at $\irl{\loc}$ for\\$\irl{n}$ memory cells.''}
    %
    \typerule{scct-heap-related}{
      \mmlAtmsmmlAtscctcomp{n}=\obj{n} &
      \delta(\irl{\loc}) = \obj{\loc} \\
      \forall \irl{0}\le\irl{m}<\irl{n},\ \obj{0}\le\obj{m}<\obj{n},\irl{H^{\comp}}\left(\irl{\loc} + \irl{m}\right)=\obj{H^{\comp}}\left(\obj{\loc} + \obj{m}\right)
    }{
      \irl{\loc},\irl{n}\vdash_{\delta}\irl{H^{\comp}}\approx\obj{H^{\comp}}
    }{scct-heap-related}
    %
    \judgbox{\xlangstateeqc[]{\cfstate}{\cfstate}}{,,The $\mmlAtms$ control-flow-state $\irl{\cfstate}$ agrees with $\mmlAtscct$ one $\obj{\cfstate}$.''} \\
    %
    \typerule{scct-cfstate-eq}{
      \irl{\cfstate}=\irl{\commlib;\library;\kontstack} &
      \obj{\cfstate}=\obj{\commlib;\library;\kontstack} \\
      \xlangstateeqc[]{\library}{\library} &
      \xlangstateeqc[\irl{\commlib}]{\kontstack}{\kontstack} &
      \obj{\commlib}=\mmlAtmsmmlAtscctcomp{\commlib}
    }{
      \xlangstateeqc[]{\cfstate}{\cfstate}
    }{scct-cfstate-eq}$\;$\\
    %
    %
    \judgbox{\irl{\poison}=\obj{\poison}}{,,$\mmlAtms$ poison equals $\mmlAtscct$ one $\obj{\poison}$.''} \\
    %
    \typerule{$\poisoned$-equal}{
    }{
      \irl{\poisoned}=\obj{\poisoned}
    }{scct-poisoned-equal}
    %
    \typerule{$\poisonless$-equal}{
    }{
      \irl{\poisonless}=\obj{\poisonless}
    }{scct-poisonless-equal}
  \end{center}
}{scct-pres-state-relations-first}{State Relation from $\mmlAtms$ to $\mmlAtscct$. This is meant to relate the states whenever we are ,,inside'' a component. Note that the DOIT flag is required to be non-zero.}

\myfig{
  \begin{center}
    %
    \judgbox{\xlangstateeqc[]{\library}{\library}}{,,The procedures of $\mmlAtms$ agree with $\mmlAtscct$ ones.''} \\
    %
    \typerule{scct-empty-commlib-lib-eq}{
    }{
      \xlangstateeqc[]{\hole{\cdot}}{\library}
    }{scct-empty-commlib-eq}
    %
    \typerule{scct-cons-commlib-eq}{
      \mmlAtmsmmlAtscctcomp{let\ foo\ x:\type_{\color{black}\lambda} := e} = \obj{let\ foo\ x := e} &
      \xlangstateeqc[]{\library}{\library_1,\library_2}
    }{
      \xlangstateeqc[]{(let\ foo\ x:\type_{\color{black}\lambda} := e),\library}{\library_1,(let\ foo\ x := e),\library_2}
    }{scct-cons-commlib-eq}
    %
    %
    \judgbox{\xlangstateeqc[\irl{\commlib}]{\kontstack}{\kontstack}}{,,The stack of $\mmlAtms$ continuations $\irl{\kontstack}$ agrees with $\mmlAtscct$ one $\obj{\kontstack}$.\\Only checks $\irl{foo}\in\irl{\commlib}$''} \\
    %
    \typerule{scct-empty-kontstack-eq}{
    }{
      \xlangstateeqc[\irl{\commlib}]{\hole{\cdot}}{\hole{\cdot}}
    }{scct-empty-kontstack-eq}
    %
    \typerule{scct-ign-cons-kontstack-eq}{
      \irl{foo}\notin\irl{\commlib} &
      \obj{foo}=\mmlAtmsmmlAtscctcomp{foo} &
      \xlangstateeqc[\irl{\commlib}]{\kontstack}{\kontstack}
    }{
      \xlangstateeqc[\irl{\commlib}]{\kontstack}{(K;foo),\kontstack}
    }{scct-ign-cons-kontstack-eq}
    %
    \typerule{cons-kontstack-eq}{
      \irl{foo}\in\irl{\commlib} &
      \irl{foo}=\obj{foo} &
      \xlangstateeqc[\irl{\commlib}]{\kontstack}{\kontstack}
    }{
      \xlangstateeqc[\irl{\commlib}]{(K;foo),\kontstack}{(K;foo),\kontstack}
    }{scct-cons-kontstack-eq}
  \end{center}
}{scct-pres-memstate-relations}{Memory-State Relations from $\mmlAtms$ to $\mmlAtscct$.}

\myfig{
  \begin{center}
    \judgbox{\delta(\irl{\loc})=\obj{\loc}}{,,The $\mmlAtms$ memory location $\irl{\loc}$ corresponds to\\the $\mmlAtscct$ memory location $\obj{\loc}$.''} \\
    \judgbox{\xlangbackstateeqc{\Omega}{\Omega}}{,,The $\mmlAtms$ state $\irl{\Omega}$ agrees with $\mmlAtscct$ state $\obj{\Omega}$. $\irl{L}$ contains locations\\introduced by the backtranslation wrapper, which are subsequently ignored.''} \\
    %
    \typerule{state-qe}{
      \irl{\Omega}=\irl{\cfstate;\sandboxtag;\memstate} &
      \obj{\Omega}=\obj{\cfstate;\sandboxtag;n;\memstate} \\
      \xlangbackstateeqc[]{\cfstate}{\cfstate} &
      \xlangbackstateeqc{\memstate}{\memstate}
    }{
      \xlangbackstateeqc{\Omega}{\Omega}
    }{scct-state-qe}
    %
    \typerule{abort-state-qe}{
    }{
      \xlangbackstateeqc{\lightning}{\lightning}
    }{scct-abort-qe}
    %
    \judgbox{\xlangbackstateeqc{\memstate}{\memstate}}{,,The $\mmlAtms$ memory-state $\irl{\memstate}$ agrees with $\mmlAtscct$ one $\obj{\memstate}$. $\irl{L}$ contains locations\\introduced by the backtranslation wrapper.''}\\
    %
    \typerule{memstate-qe}{
      \xlangstateeqc{\memstate}{\memstate}
    }{
      \xlangbackstateeqc{\memstate}{\memstate}
    }{scct-memstate-qe}$\;$\\
    %
    %
    \judgbox{\xlangbackstateeqc[]{\cfstate}{\cfstate}}{,,The $\mmlAtms$ control-flow-state $\irl{\cfstate}$ agrees with $\mmlAtscct$ one $\obj{\cfstate}$.''} \\
    %
    \typerule{cfstate-qe}{
      \xlangstateeqc[]{\cfstate}{\cfstate}
    }{
      \xlangbackstateeqc[]{\cfstate}{\cfstate}
    }{scct-cfstate-qe}
  \end{center}
}{scct-pres-state-relations-second}{State Relation from $\mmlAtms$ to $\mmlAtscct$. This is meant to relate the states whenever we are ,,inside'' a context.}

\subsection{Robustly Preserving $\sCCT$}

\subsubsection{Compiler}

\myfig{
  \begin{center}
    \begin{gather*}
    \judgbox{\mmlAtmsmmlAtscctcomp{e}=\obj{e'}}{,,Compile $\mmlAtms$ expression $\irl{e}$ to $\mmlAtscct$ expression $\obj{e'}$.''}\\
    \judgbox{\mmlAtmsmmlAtscctcomp{\left[\valueexpr / x\right]}=\obj{\left[\valueexpr / x\right]}}{,,Compile $\mmlAtms$ substitution to $\mmlAtscct$ substitution.''} \\
    \judgbox{\mmlAtmsmmlAtscctcomp{\commlib}=\obj{\commlib'}}{,,Compile $\mmlAtms$ component library to $\mmlAtscct$ component library.''} \\
    \end{gather*}
    $$
    \begin{array}{rll}
    \mmlAtmsmmlAtscctcomp{\finalexpr} &\ = & \obj{\finalexpr} \\
    \mmlAtmsmmlAtscctcomp{call\ foo\ e} &\ = & \obj{call\ }\mmlAtmsmmlAtscctcomp{foo}\ \mmlAtmsmmlAtscctcomp{e}\obj{;setDIT\ 1}\\
    \mmlAtmsmmlAtscctcomp{return\ e} &\ = & \obj{return\ }\mmlAtmsmmlAtscctcomp{e}\\
    \mmlAtmsmmlAtscctcomp{e_1\oplus e_2} &\ = & \mmlAtmsmmlAtscctcomp{e_1} \obj{\oplus} \mmlAtmsmmlAtscctcomp{e_2} \\
    \mmlAtmsmmlAtscctcomp{x[e]} &\ = & \obj{x[}\mmlAtmsmmlAtscctcomp{e}\obj{]} \\
    \mmlAtmsmmlAtscctcomp{let\ x= e_1\ in\ e_2} &\ = & \obj{let\ x=} \mmlAtmsmmlAtscctcomp{e_1}\obj{\ in\ }\mmlAtmsmmlAtscctcomp{e_2} \\
    \mmlAtmsmmlAtscctcomp{x[e_1]\leftarrow e_2} &\ = & \obj{x[}\mmlAtmsmmlAtscctcomp{e_1}\obj{]\leftarrow} \mmlAtmsmmlAtscctcomp{e_2} \\
    \mmlAtmsmmlAtscctcomp{let\ x=new\ e_1\ in\ e_2} &\ = & \obj{let\ x=new\ }\mmlAtmsmmlAtscctcomp{e_1}\obj{\ in\ }\mmlAtmsmmlAtscctcomp{e_2} \\
    \mmlAtmsmmlAtscctcomp{delete\ x} &\ = & \obj{delete\ x} \\
    \mmlAtmsmmlAtscctcomp{x\ is\ \poisoned} &\ = & \obj{x\ is\ \poisoned} \\
    \mmlAtmsmmlAtscctcomp{\lparen e_1;e_2\rparen} &\ = & \obj{\lparen}\mmlAtmsmmlAtscctcomp{e_1}\obj{;}\mmlAtmsmmlAtscctcomp{e_2}\obj{\rparen}\\
    \mmlAtmsmmlAtscctcomp{\pi_1\ e} &\ = & \obj{\pi_1\ }\mmlAtmsmmlAtscctcomp{e}\\
    \mmlAtmsmmlAtscctcomp{\pi_2\ e} &\ = & \obj{\pi_2\ }\mmlAtmsmmlAtscctcomp{e}\\
    \mmlAtmsmmlAtscctcomp{e\ has\ \type} &\ = & \mmlAtmsmmlAtscctcomp{e}\ \obj{has\ \type}\\
    \mmlAtmsmmlAtscctcomp{ifz\ e_1\ then\ e_2\ else\ e_3} &\ = & \obj{ifz\ }\mmlAtmsmmlAtscctcomp{e_1}\\
                                                        &&\obj{then\ }\mmlAtmsmmlAtscctcomp{e_2} \\
                                                        &&\obj{else\ }\mmlAtmsmmlAtscctcomp{e_3} \\[0.5cm]
    %
    \mmlAtmsmmlAtscctcomp{\left[\valueexpr/x\right]}&\ = & \obj{\left[\right.}\mmlAtmsmmlAtscctcomp{v}\obj{/}\mmlAtmsmmlAtscctcomp{x}\obj{\left.\right]} \\[0.5cm]
    %
    \mmlAtmsmmlAtscctcomp{\hole{\cdot}}&\ = & \obj{\hole{\cdot}} \\
    \mmlAtmsmmlAtscctcomp{foo,\commlib}&\ = & \obj{foo,}\mmlAtmsmmlAtscctcomp{\commlib} \\
    \end{array}
    $$
  \end{center}
}{scct-pres-compiler}{Compiler from $\mmlAtms$ to $\mmlAtscct$.}
\myfig{
  \begin{center}
    \begin{gather*}
    \judgbox{\mmlAtmsmmlAtscctcomp{F}=\obj{F}}{,,Compile $\mmlAtms$ procedures to $\mmlAtscct$ procedures.''}
    \end{gather*}
    $$
    \begin{array}{rll}
    %
      \mmlAtmsmmlAtscctcomp{let\ foo\ x := e}&\ = & \obj{let\ foo\ x := setDIT\ 1;}\mmlAtmsmmlAtscctcomp{e}\\
    \end{array}
    $$
    \begin{gather*}
    \judgbox{\mmlAtmsmmlAtscctcomp{\library}=\obj{\library}}{,,Compile $\mmlAtms$ libraries to $\mmlAtscct$ libraries.''}
    \end{gather*}
    $$
    \begin{array}{rll}
      \mmlAtmsmmlAtscctcomp{\hole{\cdot}}&\ = & \obj{\hole{\cdot}} \\
      \mmlAtmsmmlAtscctcomp{F,\library}&\ = & \mmlAtmsmmlAtscctcomp{F}\irl{,}\mmlAtmsmmlAtscctcomp{\library} \\
    \end{array}
    $$
  \end{center}
}{scct-pres-compiler-comp}{Compiler from $\mmlAtms$ components to $\mmlAtscct$ components.}

\subsubsection{Proofs and Auxiliary Lemmas}

\begin{lemma}[Trace Equality transfer Safety]\label{lem:scctfiltereq}
  If
  \begin{assumptions}
    \item $\forall\irl{\loc}\ \obj{\loc},\delta(\irl{\loc})=\obj{\loc}\implies \delta_{scct}(\irl{\loc})=\delta_{scct}(\delta^{-1}(\obj{\loc}))$
    \item\label[ass]{asm:scctfiltereq:eq} $\xlangtraceeqc[\delta]{\trace}{\trace}$
    \item\label[ass]{asm:scctfiltereq:objtoabs} $\traceagree{\tospecificevo[^{*}_{\delta_{scct}\circ\delta^{-1}}]{\trace}}{\abstrace}$
    \item $\monitorcheck{\scctmonitor}{\scctmonitor'}{\abstrace}$
  \end{assumptions}
  Then
  \begin{goals}
    \item $\traceagree{\tospecificevi[_{\delta_{scct}}]{\trace}}{\abstrace}$
  \end{goals}
\end{lemma}
\begin{proof}
  Induction on \Cref{asm:scctfiltereq:eq}.

  \begin{description}
    \case{tr:scct-empty-trace-eq}
      By \Cref{tr:i-scct-filter-empty} we know $\tospecificevi[_{\delta_{scct}}]{\hole{\cdot}}=\specificev{\hole{\cdot}}$ and similarily \Cref{tr:o-scct-filter-empty} we know $\tospecificevo[_{\delta_{scct}\circ\delta^{-1}}]{\hole{\cdot}}=\specificev{\hole{\cdot}}$.
      Invert \Cref{asm:scctfiltereq:objtoabs} to know that $\abstrace=\bm{\hole{\cdot}}$.
      \Cref{tr:scct-none} resolves the goal.

    \case{tr:scct-cons-trace-eq}

      For readability, we repeat the proof context:
      If
      \begin{passumptions}{H}
        \item\label[ass]{asm:scctfiltereq:indu:delta} $\forall\irl{\loc}\ \obj{\loc},\delta(\irl{\loc})=\obj{\loc}\implies \delta_{scct}(\irl{\loc})=\delta_{scct}(\delta^{-1}(\obj{\loc}))$
        \item\label[ass]{asm:scctfiltereq:indu:eq} $\xlangtraceeqc[\delta]{\event[_{b}];\sandboxtag\cdot\trace}{\event[_{b}];\sandboxtag;\sigma\cdot\trace}$
        \item $\traceagree{\tospecificevo[^{*}_{\delta_{scct}\circ\delta^{-1}}]{\event[_{b}];\sandboxtag;\sigma\cdot\trace}}{\abstrace}$
        \item\label[ass]{asm:scctfiltereq:indu:monitorcheck} $\monitorcheck{\scctmonitor}{\scctmonitor[']}{\abstrace}$
      \end{passumptions}
      \begin{passumptions}{\IH}
        \item\label[ass]{asm:scctfiltereq:indu:hyp} Given $\abstrace[_{\IH}], \scctmonitor[_{\IH}], \scctmonitor['_{\IH}]$,\\
        if $\xlangtraceeqc[\delta]{\trace}{\trace}$ \\
        and $\tospecificevo[^{*}_{\delta_{scct}\circ\delta^{-1}}]{\trace}=\abstrace[_{\IH}]$\\
        and $\monitorcheck{\scctmonitor[_{\IH}]}{\scctmonitor['_{\IH}]}{\abstrace[_{\IH}]}$\\
        then $\tospecificevi[^{*}_{\delta_{scct}}]{\trace}=\abstrace[_{\IH}]$
      \end{passumptions}
      Then
      \begin{goals}
        \item\label[goal]{goal:scctfiltereq:irltoabs} $\traceagree{\tospecificevi[^{*}_{\delta_{scct}}]{\event[_{b}];\sandboxtag\cdot\trace}}{\abstrace}$
      \end{goals}

      Invert \Cref{asm:scctfiltereq:indu:eq} to get:
      \begin{passumptions}{H}
        \setcounter{enumi}{4}
        \item $\irl{\sandboxtag}=\obj{\sandboxtag}$
        \item\label[ass]{asm:scctfiltereq:indu:eventeq} $\xlangeventeqc[\delta]{\event[_{b}]}{\event[_{b}]}$
        \item\label[ass]{asm:scctfiltereq:indu:traceeq} $\xlangtraceeqc[\delta]{\trace}{\trace}$
      \end{passumptions}

      \noindent
      Note that $\tospecificevo[^{*}_{\delta_{scct}\circ\delta^{-1}}]{\event\cdot\trace}=\tospecificevo[^{*}_{\delta_{scct}\circ\delta^{-1}}]{\event}\specificev{\cdot}\:\tospecificevo[^{*}_{\delta_{scct}\circ\delta^{-1}}]{\trace}$ and rewrite \Cref{asm:scctfiltereq:objtoabs} with that.\MK{make this a lemma?}

      So, by inversion on \Cref{asm:scctfiltereq:objtoabs} we know:
      \begin{passumptions}{H}
        \setcounter{enumi}{7}
        \item $\abstrace=\absevent\cdot\abstrace'$
        \item\label[ass]{asm:scctfiltereq:objtoabsev} $\sccttraceagree{\tospecificevo[^{*}_{\delta_{scct}\circ\delta^{-1}}]{\event}}{\absevent}$
        \item\label[ass]{asm:scctfiltereq:objtoabstr} $\sccttraceagree[^{*}]{\tospecificevo[^{*}_{\delta_{scct}\circ\delta^{-1}}]{\trace}}{\abstrace'}$
      \end{passumptions}

      Invert \Cref{asm:scctfiltereq:indu:monitorcheck}:
      \begin{passumptions}{H}
        \setcounter{enumi}{10}
        \item\label[ass]{asm:scctfiltereq:indu:monitorcheckev} $\monitorcheck[]{\scctmonitor}{\scctmonitor_{0}}{\absevent}$
        \item\label[ass]{asm:scctfiltereq:indu:monitorchecktr} $\monitorcheck{\scctmonitor_{0}}{\scctmonitor'}{\abstrace}$
      \end{passumptions}

      Rewrite \Cref{goal:scctfiltereq:irltoabs}, exploiting distributivity of the filter:\MK{lemma?}
      \begin{goals}
        \item\label[goal]{goal:scctfiltereq:irltoabsev} $\traceagree{\tospecificevi[^{*}_{\delta_{scct}}]{\event[_{b}];\sandboxtag}}{\absevent}$
        \item\label[goal]{goal:scctfiltereq:irltoabstr} $\traceagree{\tospecificevi[^{*}_{\delta_{scct}}]{\trace}}{\abstrace'}$
      \end{goals}
      We are ready to solve \Cref{goal:scctfiltereq:irltoabstr} with \Cref{asm:scctfiltereq:indu:hyp} using \Cref{asm:scctfiltereq:indu:traceeq,asm:scctfiltereq:objtoabstr,asm:scctfiltereq:indu:monitorchecktr}.

      For \Cref{goal:scctfiltereq:irltoabsev}, perform case analysis on \Cref{asm:scctfiltereq:indu:eventeq}.
      We leave cases with $\irl{\sandboxtag}=\irl{\ctx}$ out, they are easy by \Cref{tr:i-scct-filter-context}, noting that by inverting \Cref{asm:scctfiltereq:objtoabsev} would give us $\absevent=\bm{\varepsilon}$, which then allows us to apply \Cref{tr:scct-none-auth}.
      So, in the following, let $\irl{\sandboxtag}=\irl{\comp}$ and $\obj{\sandboxtag}=\obj{\comp}$.

      \begin{description}
        \case{tr:scct-start-event-eq}
          Invert \Cref{asm:scctfiltereq:objtoabsev} to get $\absevent=\bm{\varepsilon}$.
          Note \Cref{tr:i-scct-filter-comp-start}, so \Cref{goal:scctfiltereq:irltoabsev} follows from \Cref{tr:scct-none-auth}.

        \case{tr:scct-end-event-eq}
          Invert \Cref{asm:scctfiltereq:objtoabsev} to get $\absevent=\bm{\varepsilon}$.
          Note \Cref{tr:i-scct-filter-comp-end}, so \Cref{goal:scctfiltereq:irltoabsev} follows from \Cref{tr:scct-none-auth}.

        \case{tr:scct-alloc-event-eq}
          Invert \Cref{asm:scctfiltereq:objtoabsev} to get $\absevent=\bm{Any;\unlock}$.
          Note \Cref{tr:i-scct-filter-comp-alloc}, so \Cref{goal:scctfiltereq:irltoabsev} follows from \Cref{tr:scct-public-auth}.

        \case{tr:scct-dealloc-event-eq}
          Invert \Cref{asm:scctfiltereq:objtoabsev} to get $\absevent=\bm{Any;\unlock}$.
          Note \Cref{tr:i-scct-filter-comp-dealloc}, so \Cref{goal:scctfiltereq:irltoabsev} follows from \Cref{tr:scct-public-auth}.

        \case{tr:scct-get-event-eq-noleak}
          Invert \Cref{asm:scctfiltereq:objtoabsev} to get $\absevent=\bm{\varepsilon}$.
          Note \Cref{tr:i-scct-filter-comp-get-noleak}, so \Cref{goal:scctfiltereq:irltoabsev} follows from \Cref{tr:scct-none-auth}.

        \case{tr:scct-set-event-eq-noleak}
          Invert \Cref{asm:scctfiltereq:objtoabsev} to get $\absevent=\bm{\varepsilon}$.
          Note \Cref{tr:i-scct-filter-comp-set-noleak}, so \Cref{goal:scctfiltereq:irltoabsev} follows from \Cref{tr:scct-none-auth}.

        \case{tr:scct-get-event-eq-leak}
          Case analysis on $\bm{\sigma}$.
          \begin{description}
            \item \textbf{Case }$\bm{\sigma}=\unlock$\textbf{:}
              Invert \Cref{asm:scctfiltereq:objtoabsev} to get:
              \begin{passumptions}{F}
                \item $\absevent=\bm{\varepsilon}$.
              \end{passumptions}
              Note \Cref{tr:i-scct-filter-comp-get-noleak}, so \Cref{goal:scctfiltereq:irltoabsev} follows from \Cref{tr:scct-none-auth}.

            \item \textbf{Case }$\bm{\sigma}=\lock$\textbf{:}
              Inverting \Cref{asm:scctfiltereq:indu:monitorcheckev} immediately gives us a contradiction, because there is no matching rule that steps on \lock.
          \end{description}

        \case{tr:scct-set-event-eq-leak}
          Case analysis on $\bm{\sigma}$.
          \begin{description}
            \item \textbf{Case }$\bm{\sigma}=\unlock$\textbf{:}
              Invert \Cref{asm:scctfiltereq:objtoabsev} to get:
              \begin{passumptions}{F}
                \item $\absevent=\bm{\varepsilon}$.
              \end{passumptions}
              Note \Cref{tr:i-scct-filter-comp-set-noleak}, so \Cref{goal:scctfiltereq:irltoabsev} follows from \Cref{tr:scct-none-auth}.

            \item \textbf{Case }$\bm{\sigma}=\lock$\textbf{:}
              Inverting \Cref{asm:scctfiltereq:indu:monitorcheckev} immediately gives us a contradiction, because there is no matching rule that steps on \lock.
          \end{description}

        \case{tr:scct-call-event-eq}
          Invert \Cref{asm:scctfiltereq:objtoabsev} to get $\absevent=\bm{\varepsilon}$.
          Note \Cref{tr:i-scct-filter-comp-call}, so \Cref{goal:scctfiltereq:irltoabsev} follows from \Cref{tr:scct-none-auth}.

        \case{tr:scct-ret-event-eq}
          Invert \Cref{asm:scctfiltereq:objtoabsev} to get $\absevent=\bm{\varepsilon}$.
          Note \Cref{tr:i-scct-filter-comp-ret}, so \Cref{goal:scctfiltereq:irltoabsev} follows from \Cref{tr:scct-none-auth}.

        \case{tr:scct-emptyevent-event-eq}
          Invert \Cref{asm:scctfiltereq:objtoabsev} to get $\absevent=\bm{\varepsilon}$.
          Note \Cref{tr:i-scct-filter-emptyevent}, so \Cref{goal:scctfiltereq:irltoabsev} follows from \Cref{tr:scct-none-auth}.

        \case{tr:scct-abort-event-eq}
          Invert \Cref{asm:scctfiltereq:objtoabsev} to get:
          \begin{passumptions}{F}
            \item $\specificev{\sigma}=\bm{\sigma}$
            \item $\absevent=\bm{\lightning};\bm{\sigma}$.
          \end{passumptions}
          Case analysis on $\bm{\sigma}$.
          \begin{description}
            \item \textbf{Case }$\bm{\sigma}=\unlock$\textbf{:}
              Note \Cref{tr:i-scct-filter-abort}, so \Cref{goal:scctfiltereq:irltoabsev} follows from \Cref{tr:scct-abort-auth}.

            \item \textbf{Case }$\bm{\sigma}=\lock$\textbf{:}
              Inverting \Cref{asm:scctfiltereq:indu:monitorcheckev} immediately gives us a contradiction, because there is no matching rule that steps on \lock.
          \end{description}

        \case{tr:scct-binop-event-eq-leak}
          This case is very similar to the next case.
        \case{tr:scct-branch-event-eq-leak}
          Case analysis on $\bm{\sigma}$.
          \begin{description}
            \item \textbf{Case }$\bm{\sigma}=\unlock$\textbf{:}
              Invert \Cref{asm:scctfiltereq:objtoabsev} to get:
              \begin{passumptions}{F}
                \item $\absevent=\bm{\varepsilon}$.
              \end{passumptions}
              Note \Cref{tr:i-scct-filter-emptyevent}, so \Cref{goal:scctfiltereq:irltoabsev} follows from \Cref{tr:scct-none-auth}.

            \item \textbf{Case }$\bm{\sigma}=\lock$\textbf{:}
              Inverting \Cref{asm:scctfiltereq:indu:monitorcheckev} immediately gives us a contradiction, because there is no matching rule that steps on \lock.
          \end{description}
      \end{description}
  \end{description}
\end{proof}


\begin{lemma}[Primitive Forward Simulation]\label{lem:prim:forwardsim:scct}
  If
  \begin{assumptions}
    \item\label[ass]{asm:prim:forwardsim:scct:execi} $\exprevali{\Omega}{e\gamma}{\Omega'}{e'\gamma'}{\event}$
    \item $\monitorcheck[]{\scctmonitor}{\scctmonitor'}{\absevent}$
    \item $\sccttraceagree{\theta_{\delta}(\irl{\event})}{\absevent}$
    \item $\xlangstateeqc{\Omega}{\Omega}$
  \end{assumptions}
  Then $\exists \delta_{scct}'\ \obj{\event}\ \obj{\Omega'}$,
  \begin{goals}
    \item $\exprevalo{\Omega}{\color{black}\mmlAtmsmmlAtscctcomp{e}\mmlAtmsmmlAtscctcomp{\gamma}}{\Omega'}{\color{black}\mmlAtmsmmlAtscctcomp{e'}\mmlAtmsmmlAtscctcomp{\gamma'}}{\event}$
    \item $\xlangeventeqc[\delta_{scct}']{\event}{\event}$
    \item $\xlangstateeqc[\delta_{scct}']{\Omega'}{\Omega'}$
    \item $\sccttraceagree{\theta_{\delta_{scct}'}(\obj{\event})}{\absevent}$
  \end{goals}
\end{lemma}
\begin{proof}
  Case analysis on \Cref{asm:prim:forwardsim:scct:execi}.
\end{proof}

\begin{lemma}[Contextual Forward Simulation]\label{lem:ctx:forwardsim:scct}
  If
  \begin{assumptions}
    \item\label[ass]{asm:ctx:forwardsim:scct:execi} $\exectms[]{\Omega}{e\gamma}{\Omega'}{e'\gamma'}{\event}$
    \item $\monitorcheck[]{\scctmonitor}{\scctmonitor'}{\absevent}$
    \item $\sccttraceagree{\theta_{\delta}(\irl{\event})}{\absevent}$
    \item $\xlangstateeqc{\Omega}{\Omega}$
  \end{assumptions}
  Then $\exists \delta_{scct}'\ \obj{\event}\ \obj{\Omega'}$,
  \begin{goals}
    \item $\execo[]{\Omega}{\color{black}\mmlAtmsmmlAtscctcomp{e}\mmlAtmsmmlAtscctcomp{\gamma}}{\Omega'}{\color{black}\mmlAtmsmmlAtscctcomp{e'}\mmlAtmsmmlAtscctcomp{\gamma'}}{\event}$
    \item $\xlangeventeqc[\delta_{scct}']{\event}{\event}$
    \item $\xlangstateeqc[\delta_{scct}']{\Omega'}{\Omega'}$
    \item $\sccttraceagree{\theta_{\delta_{scct}'}(\obj{\event})}{\absevent}$
  \end{goals}
\end{lemma}
\begin{proof}
  Case analysis on \Cref{asm:ctx:forwardsim:scct:execi} and using \Thmref{lem:prim:forwardsim:scct}.
\end{proof}

\begin{lemma}[Forward Simulation]\label{lem:steps:forwardsim:scct}
  If
  \begin{assumptions}
    \item\label[ass]{asm:steps:forwardsim:scct:execi} $\exectms{\Omega}{e\gamma}{\Omega'}{e'\gamma'}{\event}$
    \item $\monitorcheck[]{\scctmonitor}{\scctmonitor'}{\absevent}$
    \item $\sccttraceagree{\theta_{\delta}(\irl{\event})}{\absevent}$
    \item $\xlangstateeqc{\Omega}{\Omega}$
  \end{assumptions}
  Then $\exists \delta_{scct}'\ \obj{\event}\ \obj{\Omega'}$,
  \begin{goals}
    \item $\execo{\Omega}{\color{black}\mmlAtmsmmlAtscctcomp{e}\mmlAtmsmmlAtscctcomp{\gamma}}{\Omega'}{\color{black}\mmlAtmsmmlAtscctcomp{e'}\mmlAtmsmmlAtscctcomp{\gamma'}}{\event}$
    \item $\xlangeventeqc[\delta_{scct}']{\event}{\event}$
    \item $\xlangstateeqc[\delta_{scct}']{\Omega'}{\Omega'}$
    \item $\sccttraceagree{\theta_{\delta_{scct}'}(\obj{\event})}{\absevent}$
  \end{goals}
\end{lemma}
\begin{proof}
  Case analysis on \Cref{asm:steps:forwardsim:scct:execi} and using \Thmref{lem:ctx:forwardsim:scct}.
\end{proof}


\begin{lemma}[Backward Simulation]
  If
  \begin{assumptions}
    \item $\execo{\Omega}{\color{black}\mmlAtmsmmlAtscctcomp{e}\mmlAtmsmmlAtscctcomp{\gamma}}{\Omega'}{\color{black}\mmlAtmsmmlAtscctcomp{e'}\mmlAtmsmmlAtscctcomp{\gamma'}}{\trace}$
    \item $\xlangstateeqc[\delta_{scct}]{\Omega}{\Omega}$
    \item $\monitorcheck{\scctmonitor}{\scctmonitor'}{\absevent}$
    \item $\sccttraceagree{\theta_{\delta}(\irl{\event})}{\absevent}$
  \end{assumptions}
  Then $\exists \delta_{scct}'\ \irl{\Omega'}\ \irl{\trace}$
  \begin{goals}
    \item $\delta_{scct}\subseteq\delta_{scct}'$
    \item $\exectms{\Omega}{e\gamma}{\Omega'}{e'\gamma'}{\trace}$
    \item $\xlangstateeqc[\delta_{scct}']{\Omega'}{\Omega'}$
    \item $\xlangtraceeqc[\delta_{scct}']{\trace}{\trace}$
    \item $\sccttraceagree{\theta_{\delta_{scct}'}(\obj{\trace})}{\abstrace}$
  \end{goals}
\end{lemma}
\begin{proof}
  Follows from \Cref{lem:steps:forwardsim:scct} and determinism.
\end{proof}

\subsubsection{Backtranslation}

\myfig{
  \begin{center}
    \judgbox{\tospecificevo[_{\obj{\bullet}}]{\event} = \obj{\event}}{,,Filter an $\mmlAtscct$ event.''}
    %
    \typerule{obj-filter-context}{
      \obj{\event_b} = \obj{Alloc\ \loc\ n} \vee
      \obj{\event_b} = \obj{Dealloc\ \loc} \vee\\
      \obj{\event_b} = \obj{Get\ \loc\ n} \vee
      \obj{\event_b} = \obj{Set\ \loc\ n\ m} \vee\\
      \obj{\event_b} = \obj{Call\ \emptyset\ foo\ n} \vee
      \obj{\event_b} = \obj{Ret\ \emptyset\ n}\vee\\
      \obj{\event_b} = \obj{{iGet}\ \loc\ n} \vee
      \obj{\event_b} = \obj{{iSet}\ \loc\ n\ m} \vee\\
      \obj{\event_b} = \obj{Branch\ n}\vee
      \obj{\event_b} = \obj{Binop\ n_1\ n_2}
    }{
      \tospecificevo[_{\obj{\bullet}}]{\event_b;\ctx;\sigma} = \obj{\emptyevent}
    }{obj-filter-context}
    %
    \typerule{obj-filter-unimportant}{
    }{
      \tospecificevo[_{\obj{\bullet}}]{\emptyevent} = \obj{\emptyevent}
    }{obj-filter-unimportant}
    %
    \typerule{obj-filter-comp-start}{
    }{
      \tospecificevo[_{\obj{\bullet}}]{Start;\comp;\sigma} = \obj{\emptyevent}
    }{obj-filter-comp-start}
    %
    \typerule{obj-filter-comp-alloc}{
    }{
      \tospecificevo[_{\obj{\bullet}}]{Alloc\ \loc\ n;\comp;\sigma} = \obj{Alloc\ \loc\ n}
    }{obj-filter-comp-alloc}
    %
    \typerule{obj-filter-comp-dealloc}{
    }{
      \tospecificevo[_{\obj{\bullet}}]{Dealloc\ \loc;\comp;\sigma} = \obj{Dealloc\ \loc}
    }{obj-filter-comp-dealloc}
    %
    \typerule{obj-filter-comp-get-noleak}{
    }{
      \tospecificevo[_{\obj{\bullet}}]{{iGet}\ \loc\ n;\comp;\sigma} = \obj{{iGet}\ \loc\ n}
    }{obj-filter-comp-get-noleak}
    %
    \typerule{obj-filter-comp-set-noleak}{
    }{
      \tospecificevo[_{\obj{\bullet}}]{{iSet}\ \loc\ n\ \valueexpr;\comp;\sigma} = \obj{{iSet}\ \loc\ n\ \valueexpr}
    }{obj-filter-comp-set-noleak}
    %
    \typerule{obj-filter-comp-get-leak}{
    }{
      \tospecificevo[_{\obj{\bullet}}]{Get\ \loc\ n;\comp;\sigma} = \obj{Get\ \loc\ n}
    }{obj-filter-comp-get-leak}
    %
    \typerule{obj-filter-comp-set-leak}{
    }{
      \tospecificevo[_{\obj{\bullet}}]{Set\ \loc\ n\ \valueexpr;\comp;\sigma} = \obj{Set\ \loc\ n\ \valueexpr}
    }{obj-filter-comp-set-leak}
    %
    \typerule{obj-filter-comp-call}{
    }{
      \tospecificevo[_{\obj{\bullet}}]{Call\ \comm\ foo\ \valueexpr;\sandboxtag;\sigma} = \obj{Call\ \comm\ foo\ \valueexpr;\sandboxtag}
    }{obj-filter-comp-call}
    %
    \typerule{obj-filter-comp-ret}{
    }{
      \tospecificevo[_{\obj{\bullet}}]{Ret\ \comm\ \valueexpr;\sandboxtag;\sigma} = \obj{Ret\ \comm\ \valueexpr;\sandboxtag}
    }{obj-filter-comp-ret}
    %
    \typerule{obj-filter-branch}{
    }{
      \tospecificevo[_{\obj{\bullet}}]{Branch\ n;\comp;\sigma} = \obj{Branch\ n}
    }{obj-filter-branch-leak}
    %
    \typerule{obj-filter-binop}{
    }{
      \tospecificevo[_{\obj{\bullet}}]{Binop\ n_1\ n_2;\comp;\sigma} = \obj{Binop\ n_1\ n_2}
    }{obj-filter-binop}
    %
    \typerule{obj-filter-abort}{
    }{
      \tospecificevo[_{\obj{\bullet}}]{\lightning;\sandboxtag;\sigma} = \obj{\lightning}
    }{obj-filter-abort}
    %
    %
    \judgbox{\tospecificevo[^*_{\obj{\bullet}}]{\trace} = \obj{\trace'}}{,,Filter an $\mmlAtscct$ trace.''}
    %
    \typerule{obj-filter-empty}{
    }{
      \tospecificevo[^*_{\obj{\bullet}}]{\hole{\cdot}} = \obj{\hole{\cdot}}
    }{obj-filter-empty}
    %
    \typerule{obj-filter-cons-relevant}{
      \tospecificevo[_{\obj{\bullet}}]{\event} = \obj{\event} \not= \obj{\emptyevent} &
      \tospecificevo[^*_{\obj{\bullet}}]{\trace} = \obj{\trace}
    }{
      \tospecificevo[^*_{\obj{\bullet}}]{\event\cdot\trace} = \obj{\event}\cdot\obj{\trace}
    }{obj-filter-cons-relevant}
    %
    \typerule{obj-filter-cons-relevant}{
      \tospecificevo[_{\obj{\bullet}}]{\event} = \obj{\emptyevent} &
      \tospecificevo[^*_{\obj{\bullet}}]{\trace} = \obj{\trace}
    }{
      \tospecificevo[^*_{\obj{\bullet}}]{\event\cdot\trace} = \obj{\trace}
    }{obj-filter-cons}
  \end{center}
}{scct-events-filter-for-BT}{Filtering of $\mmlAtscct$ events, getting rid of unimportant ones, for backtranslation.}

\myfig{
  \begin{center}
    \judgbox{\mmlAtmsmmlAtscctv[]{\valueexpr} = \irl{\valueexpr}}{,,Map an $\mmlAtscct$ value to an $\mmlAtms$ value.''}$\;$\\
    \typerule{scct-backtrans-value}{
    }{
      \mmlAtmsmmlAtscctv[]{n} = \irl{n}
    }{scct-backtrans-value}
  \end{center}
}{scct-backtrans-values}{Backtranslation of $\mmlAtscct$ values to $\mmlAtms$ values.}

\myfig{
  \begin{center}
    \judgbox{\mmlAtmsmmlAtscctdetail[]{\trace}=\irl{e}}{,,Backtranslate a non-interface trace $\obj{\trace}$ to an $\mmlAtms$ expression.''}
    %
    \typerule{scct-backtrans-empty}{
    }{
      \mmlAtmsmmlAtscctdetail[]{\hole{\cdot}}=\irl{42}
    }{scct-backtrans-empty}
    \typerule{scct-backtrans-alloc}{
      \mmlAtmsmmlAtscctdetail[]{\obj{\trace}}=\irl{e}
    }{
      \mmlAtmsmmlAtscctdetail[]{\obj{Alloc\ \loc\ s;\sandboxtag;\sigma}\cdot\obj{\trace}}=\irl{e}
    }{scct-backtrans-alloc}
    \typerule{scct-backtrans-dealloc}{
      \mmlAtmsmmlAtscctdetail[]{\obj{\trace}}=\irl{e}
    }{
      \mmlAtmsmmlAtscctdetail[]{\obj{Dealloc\ \loc;\sandboxtag;\sigma}\cdot\obj{\trace}}=\irl{e}
    }{scct-backtrans-dealloc}
    \typerule{scct-backtrans-set}{
      \mmlAtmsmmlAtscctdetail[]{\obj{\trace}}=\irl{e}
    }{
      \mmlAtmsmmlAtscctdetail[]{\obj{Set\ \loc\ n\ \valueexpr;\sandboxtag;\sigma}\cdot\obj{\trace}}=\irl{e}
    }{scct-backtrans-set}
    \typerule{scct-backtrans-get}{
      \mmlAtmsmmlAtscctdetail[]{\obj{\trace}}=\irl{e}
    }{
      \mmlAtmsmmlAtscctdetail[]{\obj{Get\ \loc\ n;\sandboxtag;\sigma}\cdot\obj{\trace}}=\irl{e}
    }{scct-backtrans-get}
    \typerule{scct-backtrans-abort}{
    }{
      \mmlAtmsmmlAtscctdetail[]{\lightning;\sandboxtag;\sigma}=\irl{abort()}
    }{scct-backtrans-abort}
    %
  \end{center}
}{scct-pres-backtrans}{Trace-Based Backtranslation from $\mmlAtscct$ backtranslation-events to $\mmlAtms$ terms.}
\myfig{
  \begin{center}
    \judgbox{\mmlAtmsmmlAtscctcomptoctx[\Game]{\event}=\irl{e}}{,,Yield an $\mmlAtms$ expression from target $\comptoctx$-interaction-event $\obj{\event}$.''}
    %
    \typerule{scct-backtrans-start}{
    }{
      \mmlAtmsmmlAtscctcomptoctx[]{\obj{Start}} = \irl{42}
    }{scct-backtrans-start}
    %
%   \typerule{scct-backtrans-call-comptoctx}{
%   }{
%     \mmlAtmsmmlAtscctcomptoctx[\Game;\delta;\obj{\overline{\loc}}]{\obj{Call\ \comptoctx\ foo\ \valueexpr}}=\obj{\overline{\loc}};\irl{42}
%   }{scct-backtrans-call-comptoctx}
    %
    \typerule{scct-backtrans-ret-comptoctx}{
%     \delta(\irl{\loc})=\obj{\loc} &
%     \irl{z}=\Game(\irl{\loc}) &
%     \irl{e}=\irl{delete\ z}
    }{
%     \mmlAtmsmmlAtscctcomptoctx[\Game;\delta;\obj{\loc,\overline{\loc}}]{\obj{Ret\ \comptoctx\ \valueexpr}}=\obj{\overline{\loc}};\irl{e;}\mmlAtmsmmlAtscctv[]{\valueexpr}
      \mmlAtmsmmlAtscctcomptoctx[]{\obj{Ret\ \comptoctx\ \valueexpr}}=\mmlAtmsmmlAtscctv[]{\valueexpr}
    }{scct-backtrans-ret-comptoctx}
    %
    %
    \judgbox{\mmlAtmsmmlAtscctctxtocomp[]{\event}=\irl{e}}{,,Create an $\mmlAtscct$ expression from target\\$\ctxtocomp$-interaction-event $\obj{\event}$.''}
    %
    \typerule{scct-backtrans-call-ctxtocomp}{
%     \fresh{\Game,\delta}{\irl{\loc}}&
%     \fresh{\Game}{\irl{z}}&
%     \fresh{\delta}{\obj{\loc}}\\
%     \Game_z=\Game\cup\{\irl{\loc}\mapsto\irl{z}\} &
%     \delta'=\delta\cup\{\irl{\loc}\mapsto\obj{\loc}\}\\
%     \irl{e}=\irl{let\ z = new\ 42\ in\ call\ }\mmlAtmsmmlAtscctdetail[]{foo}\ \mmlAtmsmmlAtscctv[]{\valueexpr}
    }{
%     \mmlAtmsmmlAtscctctxtocomp[\Game;\delta;\obj{\overline{\loc}}]{\obj{Call\ \ctxtocomp\ foo\ \valueexpr}}=\Game_z;\delta';\obj{\loc,\overline{\loc}};\irl{e}
      \mmlAtmsmmlAtscctctxtocomp[]{\obj{Call\ \ctxtocomp\ foo\ \valueexpr}}=\mmlAtmsmmlAtscctv[]{\valueexpr}
    }{scct-backtrans-call-ctxtocomp}
    %
%   \typerule{scct-backtrans-ret-ctxtocomp}{
%     \fresh{\Game}{\irl{x}}
%   }{
%     \mmlAtmsmmlAtscctctxtocomp[\Game,\obj{\overline{\loc}}]{\obj{Ret\ \ctxtocomp\ \valueexpr}}=\Game,\obj{\overline{\loc}},\irl{let\ x = new\ 1\ in\ delete\ x;return\ }\mmlAtmsmmlAtscctv{\valueexpr}
%   }{scct-backtrans-ret-ctxtocomp}
    %
    \typerule{scct-backtrans-end-ctxtocomp}{
%     \fresh{\Game,\delta}{\irl{\loc}}&
%     \fresh{\Game}{\irl{z}}&
%     \fresh{\delta}{\obj{\loc}}\\
%     \Game_z=\Game\cup\{\irl{\loc}\mapsto\irl{z}\} &
%     \delta'=\delta\cup\{\irl{\loc}\mapsto\obj{\loc}\}\\
%     \irl{e}=\irl{let\ z=new\ 42\ in\ delete\ z;return\ }\mmlAtmsmmlAtscctv[]{\valueexpr}
    }{
%     \mmlAtmsmmlAtscctctxtocomp[\Game;\delta;\obj{\hole{\cdot}}]{\obj{End\ \valueexpr}}=\Game_z;\delta';\obj{\hole{\cdot}};\irl{e}
      \mmlAtmsmmlAtscctctxtocomp[]{\obj{End\ \valueexpr}}=\mmlAtmsmmlAtscctv[]{\valueexpr}
    }{scct-backtrans-end-ctxtocomp}
  \end{center}
}{scct-pres-backtrans-interact}{scct-backtranslation of interaction-events from $\mmlAtscct$ specification events to $\mmlAtms$ terms.}
\myfig{
  \begin{center}
    \typerule{scct-non-interface-$\obj{\varepsilon}$}{
    }{
      \vdash \obj{\varepsilon} \operatorname{non-int-\obj{\event}}
    }{scct-non-interface-epsilon}
    %
    \typerule{scct-non-interface-$\obj{Alloc}$}{
    }{
      \vdash \obj{Alloc\ \loc\ n;\sandboxtag;\sigma} \operatorname{non-int-\obj{\event}}
    }{scct-non-interface-alloc}
    %
    \typerule{scct-non-interface-$\obj{Dealloc}$}{
    }{
      \vdash \obj{Dealloc\ \loc;\sandboxtag;\sigma} \operatorname{non-int-\obj{\event}}
    }{scct-non-interface-dealloc}
    %
    \typerule{scct-non-interface-$\obj{Get}$}{
    }{
      \vdash \obj{Get\ \loc\ n;\sandboxtag;\sigma} \operatorname{non-int-\obj{\event}}
    }{scct-non-interface-get}
    %
    \typerule{scct-non-interface-$\obj{Set}$}{
    }{
      \vdash \obj{Set\ \loc\ n;\sandboxtag;\sigma} \operatorname{non-int-\obj{\event}}
    }{scct-non-interface-set}
    %
    \typerule{scct-non-interface-$\obj{Binop}$}{
    }{
      \vdash \obj{Binop\ n_{1}\ n_{2};\sandboxtag;\sigma} \operatorname{non-int-\obj{\event}}
    }{scct-non-interface-binop}
    %
    \typerule{scct-non-interface-$\obj{Branch}$}{
    }{
      \vdash \obj{Branch\ n;\sandboxtag;\sigma} \operatorname{non-int-\obj{\event}}
    }{scct-non-interface-branch}
    %
    \typerule{scct-non-interface-$\obj{\lightning}$}{
    }{
      \vdash \obj{\lightning;\sandboxtag;\sigma} \operatorname{non-int-\obj{\event}}
    }{scct-non-interface-abort}
    %
    \typerule{scct-non-interface-trace-empty}{
    }{
      \vdash \obj{\hole{\cdot}} \operatorname{non-int-\obj{\trace}}
    }{scct-non-interface-trace-empty}
    %
    \typerule{scct-non-interface-trace-cons}{
      \vdash \obj{\event} \operatorname{non-int-\obj{\trace}} &
      \vdash \obj{\trace} \operatorname{non-int-\obj{\trace}}
    }{
      \vdash \obj{\event\cdot\trace} \operatorname{non-int-\obj{\trace}}
    }{scct-non-interface-trace-cons}
  \end{center}
}{scct-non-interfacing-events}{Non-Interfacing events.}
\myfig{
  \begin{center}
    \judgbox{\mmlAtmsmmlAtscctsubtop[]{\event[_1]\cdot\trace\cdot\event[_2]}=\irl{e_1};\irl{e_2};\irl{e_3}}{,,Construct an $\mmlAtms$ ensemble of expressions from target-\\trace $\obj{\trace}$ which starts with a $\ctxtocomp$ event\\and ends in a $\comptoctx$.''}
    %
    \typerule{scct-subtoplevel-backtrans}{
      \vdash \obj{\trace} \operatorname{non-int-\obj{\trace}}\\
      \mmlAtmsmmlAtscctcomptoctx[]{\obj{\event[_1]}}=\irl{e_1} &
      \mmlAtmsmmlAtscctdetail[]{\obj{\trace}}=\irl{e_2} &
      \mmlAtmsmmlAtscctctxtocomp[]{\obj{\event[_2]}}=\irl{e_3} \\
    }{
      \mmlAtmsmmlAtscctsubtop[]{\obj{\event[_1]\cdot\trace\cdot\event[_2]}}=\irl{e_1}; \irl{e_2}; \irl{e_3}
    }{scct-subtoplevel-backtrans}
    %
%   \typerule{subtoplevel-backtrans-indu}{
%     \obj{\trace[_1]}=\obj{\event[^A_1]\cdot\trace[^A]\cdot\event[^A_2]} &
%     \vdash\obj{\trace[^A]}\ \operatorname{non-int-\obj{\trace}} \\
%     \mmlAtmsmmlAtscctcomptoctx[\Game,\obj{\overline{\loc}}]{\obj{\event[^A_1]}}=\Game',\obj{\overline{\loc'}},\irl{e_1^A} &
%     \mmlAtmsmmlAtscctdetail[\Game',\obj{\overline{\loc'}}]{\obj{\trace^A}}=\Game'',\obj{\overline{\loc''}}, \irl{e_2^A} \\
%     \mmlAtmsmmlAtscctctxtocomp[\Game'',\obj{\overline{\loc''}}]{\obj{\event[^A_2]}}=\Game''',\obj{\overline{\loc'''}},\irl{let\ x_0=new\ n_0\ in\ e_3^A} \\
%     \mmlAtmsmmlAtscctsubtop[\Game''',\obj{\overline{\loc'''}}]{\trace[_2]} = \Game'''',\obj{\overline{\loc''''}},\irl{e_1^B},\irl{e_2^B},\irl{e_3^B} \\
%     \irl{e^A}=\irl{e^A_1;e^A_2;let\ x_0=new\ n_0\ in\ (e_3^A;e_1^B)}
%   }{
%     \mmlAtmsmmlAtscctsubtop[\Game,\obj{\overline{\loc}}]{\obj{\trace[_1]\cdot\trace[_2]}}=\Game'''',\obj{\overline{\loc''''}},\irl{e^A},\irl{e^B_2},\irl{e^B_3}
%   }{subtoplevel-backtrans-indu}
  \end{center}
}{scct-pres-subtop-backtrans}{Interaction-Trace-Based Backtranslation from $\mmlAtscct$ specification events to $\mmlAtms$ terms.}

\myfig{
  \begin{center}
    \judgbox{\mmlAtmsmmlAtscct[]{\mstrace} = \irl{\library}}{,,Top-Level backtranslation of $\obj{\trace}$ to $\mmlAtms$ library $\irl{\library}$.''}
    %
    \typerule{scct-backtrans-top-level}{
      \obj{\trace}=\obj{\trace[_0]\cdot\trace[^{comp}]\cdot\trace[_1]} &
      \vdash \obj{\trace[^{comp}]} \operatorname{non-int-\obj{\trace}} \\
      \obj{\trace[_0]}=\obj{Start\cdot\trace[_0']\cdot Call\ \ctxtocomp\ foo\ \valueexpr_1} &
      \obj{\trace[_1]}=\obj{Ret\ \comptoctx\ \valueexpr_2\cdot\trace[_0']\cdot End\ \valueexpr_3}\\
%      \mmlAtmsmmlAtscctsubtop[\emptyset;\emptyset;\obj{\hole{\cdot}}]{\color{black}\tospecificevo[^*_\obj{\bullet}]{\trace[_0]}} = \Game; \delta; \obj{\overline{\loc}}; \irl{e_0};\irl{e_0'};\irl{let\ x_0 = new\ n_0\ in\ e_0''} \\
      \mmlAtmsmmlAtscctsubtop[]{\color{black}\tospecificevo[^*_\obj{\bullet}]{\trace[_0]}} = \irl{e_0};\irl{e_0'};\irl{e_0''} \\
      \mmlAtmsmmlAtscctsubtop[]{\color{black}\tospecificevo[^*_\obj{\bullet}]{\trace[_1]}} = \irl{e_1};\irl{e_1'};\irl{e_1''} \\
%      \irl{e} = \irl{e_0;e_0';let\ x_0 = new\ n_0\ in\ (e_0'';e_1);e_1';e_1''}
      \irl{e} = \irl{e_0;e_0';e_0'';e_1;e_1';e_1''}
    }{
      \mmlAtmsmmlAtscct[]{\trace} = \irl{let\ main\ x : \nat\to\nat := e, \hole{\cdot}}
    }{scct-backtrans-top-level}
  \end{center}
}{scct-pres-top-level-backtrans}{Top-Level trace-based Backtranslation from $\mmlAtscct$ trace $\obj{\trace}$ to $\mmlAtms$ context $\irl{\library}$.}

\begin{lemma}[Backtranslation Correctness of $\obj{Start}$]\label{lem:scct:exprbacktranslation:vbeg:wrapper:correct}
  If
  \begin{assumptions}
  \item $\obj{\library}=\obj{\library_{ctx}\linker}\mmlAtmsmmlAtscctcomp{\library_{comp}}$
  \item\label[ass]{asm:scct:vbeg:exprbacktranslation:commlib} $\obj{\commlib}=\mmlAtmsmmlAtscctcomp{\commlib}=\operatorname{dom}\ \mmlAtmsmmlAtscctcomp{\library_{comp}}$
  \item $\obj{\sigma''}=\obj{\sigma\sqcap\sigma'}$
  \item\label[ass]{asm:scct:exprbacktranslation:vbeg:wrapper:correct:exect} $\execo[]{\commlib;\library;\hole{\cdot};\comp;1;\hole{\cdot};\hole{\cdot};\hole{\cdot}}{call\ main^{\sigma}\ 0^{\sigma'}}{\commlib;\library;(\hole{\cdot}; main),\hole{\cdot};\ctx;1;\hole{\cdot};\hole{\cdot};\hole{\cdot}}{e_{main}[0^{\sigma'}/x]}{Start;\comp;\sigma''}$
  \item $\mmlAtmsmmlAtscctcomptoctx[]{\color{black}\tospecificevo[_{\obj{\bullet}}]{Start;\comp;\sigma''}}=\irl{42}$
  \item\label[ass]{asm:scct:vbeg:exprbacktranslation:staterel} $\xlangstateeqc[\emptyset;\irl{\hole{\cdot}}]{\commlib;\library;\hole{\cdot};\comp;\hole{\cdot};\hole{\cdot};\hole{\cdot}}{\commlib;\library;\hole{\cdot};\comp;1;\hole{\cdot};\hole{\cdot};\hole{\cdot}}$
  \item $\irl{\library}=\left\{\irl{main}\mapsto\irl{42;e_{main}}\right\}\irl{\linker\library_{comp}}$
  \end{assumptions}
  Then $\exists n$
  \begin{goals}
  \item\label[goal]{goal:scct:exprbacktranslation:vbeg:wrapper:correct:execs} $\execN[^{n}]{\irl{\commlib;\library;\hole{\cdot};\comp;\hole{\cdot};\hole{\cdot};\hole{\cdot}}}{\irl{call\ main\ 0}}{\irl{\commlib;\library;(\hole{\cdot};main),\hole{\cdot};\ctx;\hole{\cdot};\hole{\cdot};\hole{\cdot}}}{\irl{e_{main}[0/x]}}{\irl{Start;\comp}}$
  \item\label[goal]{goal:scct:exprbacktranslation:vbeg:wrapper:correct:backstateeq} $\xlangbackstateeqc[\emptyset]{\commlib;\library;(\hole{\cdot};main),\hole{\cdot};\ctx;\hole{\cdot};\hole{\cdot};\hole{\cdot}}{\commlib;\library;(\hole{\cdot};main),\hole{\cdot};\ctx;1;\hole{\cdot};\hole{\cdot}}$
  \item\label[goal]{goal:scct:exprbacktranslation:vbeg:wrapper:correct:eventeq} $\irl{Start}\thexlangtraceeq[\emptyset]\obj{Start}$
  \end{goals}
\end{lemma}
\begin{proof}
  With \Cref{tr:tw-e-ectx-call-main,tr:wtn-e-trans-important,tr:wtn-e-refl} one can conclude:
  \begin{passumptions}{H}
    \item\label[ass]{asm:scct:vbeg:execiN:main} $\execiN[^1]{\commlib;\library;\hole{\cdot};\comp;\hole{\cdot};\hole{\cdot};\hole{\cdot}}{call\ main\ 0}{\commlib;\library;(\hole{\cdot};main),\hole{\cdot};\ctx;\hole{\cdot};\hole{\cdot};\hole{\cdot}}{let\ \_ = 42\ in\ e_{main}[0/x]}{Start;\comp}$
  \end{passumptions}
  Now following with \Cref{tr:tw-e-let-f,tr:wtn-e-trans-unimportant,tr:wtn-e-refl}:
  \begin{passumptions}{H}
    \setcounter{enumi}{1}
    \item\label[ass]{asm:scct:vbeg:execiN:let} $\execiN[^1]{\commlib;\library;(\hole{\cdot};main),\hole{\cdot};\comp;\hole{\cdot};\hole{\cdot};\hole{\cdot}}{let\ \_ = 42\ in\ e_{main}[0/x]}{\commlib;\library;(\hole{\cdot};main),\hole{\cdot};\ctx;\hole{\cdot};\hole{\cdot};\hole{\cdot}}{e_{main}[0/x]}{\varepsilon}$
  \end{passumptions}
  Combine \Cref{asm:scct:vbeg:execiN:main,asm:scct:vbeg:execiN:let} with \Cref{tr:wtn-e-trans-important,tr:wtn-e-trans-unimportant,tr:wtn-e-refl}:
  \begin{passumptions}{H}
    \setcounter{enumi}{2}
    \item\label[ass]{asm:scct:vbeg:execiN:final} $\execiN[^2]{\commlib;\library;\hole{\cdot};\comp;\hole{\cdot};\hole{\cdot};\hole{\cdot}}{call\ main\ 0}{\commlib;\library;(\hole{\cdot};main),\hole{\cdot};\ctx;\hole{\cdot};\hole{\cdot};\hole{\cdot}}{e_{main}[0/x]}{Start;\comp}$
  \end{passumptions}
  Instantiate $n=2$ and \Cref{asm:scct:vbeg:execiN:final} solves \Cref{goal:scct:exprbacktranslation:vbeg:wrapper:correct:execs}.

  \noindent\Cref{goal:scct:exprbacktranslation:vbeg:wrapper:correct:backstateeq} by \Cref{tr:scct-state-qe,tr:scct-cfstate-qe,tr:scct-empty-memstate-eq,tr:scct-empty-kontstack-eq,asm:scct:vbeg:exprbacktranslation:commlib,asm:scct:vbeg:exprbacktranslation:staterel}.

  \noindent
  \Cref{goal:scct:exprbacktranslation:vbeg:wrapper:correct:eventeq} by \Cref{tr:scct-start-event-eq}.
\end{proof}

\begin{lemma}[Backtranslation Correctness of $\obj{Ret}$]\label{lem:scct:exprbacktranslation:beg:wrapper:correct}
  If
  \begin{assumptions}
  \item $\obj{\Omega}=\obj{\commlib;\library;(K;foo),\kontstack;\comp;1;\memstate}$
  \item $\obj{\library}=\obj{\library_{ctx}\linker}\mmlAtmsmmlAtscctcomp{\library_{comp}}$
  \item $\obj{\commlib}=\mmlAtmsmmlAtscctcomp{\commlib}=\operatorname{dom}\ \mmlAtmsmmlAtscctcomp{\library_{comp}}$
  \item\label[ass]{asm:scct:exprbacktranslation:beg:wrapper:correct:exect} $\execo[]{\Omega}{K_{component}[return\ \valueexpr^{\sigma}]}{\Omega'}{K[\valueexpr^{\sigma}]}{Ret\ \comptoctx\ \valueexpr;\comp;\sigma}$
  \item $\obj{K_{component}}=\mmlAtmsmmlAtscctcomp{K_{component}}$
  \item $\mmlAtmsmmlAtscctcomptoctx[]{\color{black}\tospecificevo[_{\obj{\bullet}}]{Ret\ \comptoctx\ \valueexpr;\comp;\sigma}}=\mmlAtmsmmlAtscctv[]{\valueexpr}$
  \item\label[ass]{asm:scct:exprbacktranslation:beg:wrapper:correct:staterel} $\xlangstateeqc{\Omega}{\Omega}$
  \item\label[ass]{asm:scct:exprbacktranslation:beg:wrapper:correct:omegas} $\irl{\Omega}=\irl{\commlib;\library;(K,foo),\kontstack;\comp;\memstate}$
  \item $\irl{\library}=\left\{\irl{main}\mapsto\irl{e_{main}}\right\}\irl{\linker\library_{comp}}$
  \end{assumptions}
  then $\exists n\ \irl{\trace}$,
  \begin{goals}
  \item\label[goal]{goal:scct:exprbacktranslation:beg:wrapper:correct:execs} $\execN{\irl{\Omega}}{\irl{K_{component}[return\ }\mmlAtmsmmlAtscctv[]{\obj{\valueexpr}}\irl{]}}{\irl{\commlib;\library;\kontstack;\ctx;\memstate}}{\irl{K[}\mmlAtmsmmlAtscctv[]{v}\irl{]}}{\irl{\trace}}$
  \item\label[goal]{goal:scct:exprbacktranslation:beg:wrapper:correct:stateeq} $\xlangbackstateeqc[\delta_{scct}]{\commlib;\library;\kontstack;\ctx;\memstate}{\Omega'}$
  \item\label[goal]{goal:scct:exprbacktranslation:beg:wrapper:correct:traceeq} $\irl{\trace}\thexlangtraceeq[\delta]\obj{Ret\ \comptoctx\ \valueexpr}$
  \end{goals}
\end{lemma}
\begin{proof}
  Instantiate the existentials with $n=1$ and $\irl{\trace}=\irl{Ret\ \comptoctx\ }\mmlAtmsmmlAtscctv{\valueexpr}$.
  Let $\irl{\valueexpr}=\mmlAtmsmmlAtscctv{\valueexpr}$.
  For \Cref{goal:scct:exprbacktranslation:beg:wrapper:correct:execs} use \Cref{tr:tw-e-ectx-ret-notsame}.
  \begin{passumptions}{H}
    \item $\execiN[^{1}]{\commlib;\library;(K;foo),\kontstack;\comp;\memstate}{K_{component}[return\ \valueexpr]}{\commlib;\library;\kontstack;\comp;\memstate}{K[\valueexpr]}{Ret\ \ctxtocomp\ \valueexpr}$
  \end{passumptions}
  This solves \Cref{goal:scct:exprbacktranslation:beg:wrapper:correct:execs}.

  By inverting \Cref{asm:scct:exprbacktranslation:beg:wrapper:correct:exect} we have $\obj{\Omega.\memstate}=\obj{\Omega'.\memstate}$.
  Invert \Cref{asm:scct:exprbacktranslation:beg:wrapper:correct:staterel}:
  \begin{passumptions}{H}
    \setcounter{enumi}{1}
    \item $\obj{1}\not=\obj{0}$
    \item $\irl{\comp}=\obj{\comp}$
    \item $\xlangstateeqc{\memstate}{\memstate}$
    \item $\xlangstateeqc{\commlib;\library;(K;foo),\kontstack}{\commlib;\library;(K;foo),\kontstack}$
  \end{passumptions}
  From this, \Cref{goal:scct:exprbacktranslation:beg:wrapper:correct:stateeq} follows easily.

  \Cref{goal:scct:exprbacktranslation:beg:wrapper:correct:traceeq} by \Cref{tr:scct-ret-event-eq}.
\end{proof}

\begin{lemma}[Middle of Backtranslation Correctness]\label{lem:scct:exprbacktranslation:mid:wrapper:correct}
  If
  \begin{assumptions}
  \item $\obj{\Omega}=\obj{\commlib;\library;\kontstack;\ctx;m;\memstate}$
  \item $\obj{\library}=\obj{\library_{ctx}\linker}\mmlAtmsmmlAtscctcomp{\library_{comp}}$
  \item $\obj{\commlib}=\mmlAtmsmmlAtscctcomp{\commlib}=\operatorname{dom}\ \mmlAtmsmmlAtscctcomp{\library_{comp}}$
  \item\label[ass]{asm:scct:exprbacktranslation:mid:correct:execs} $\execoN[^{n}]{\Omega}{e\gamma}{\Omega'}{e'\gamma'}{\trace}$
  \item\label[ass]{asm:scct:exprbacktranslation:mid:correct:backtrans} $\mmlAtmsmmlAtscctdetail[]{\color{black}\tospecificevo[^{*}_{\obj{\bullet}}]{\trace}}=\irl{e}$
  \item\label[ass]{asm:scct:exprbacktranslation:mid:correct:nonint} $\vdash\obj{\trace}\operatorname{ non-int-}\obj{\trace}$
  \item\label[ass]{asm:scct:exprbacktranslation:mid:correct:staterel} $\xlangbackstateeqc{\Omega}{\Omega}$
  \item $\irl{\Omega}=\irl{\commlib;\library;\kontstack;\ctx;\memstate}$
  \item $\irl{\library}=\irl{\library_{ctx}\linker\library_{comp}}$
%  \item $\irl{\library}=\left\{\irl{main}\mapsto\irl{e_{main}}\right\}\irl{\linker\library_{comp}}$
  \end{assumptions}
  then $\exists n'\ \irl{\trace}$,
  \begin{goals}
  \item\label[goal]{goal:scct:exprbacktranslation:mid:correct:execs} $\execN[^{n'}]{\irl{\Omega}}{\irl{K[e]}}{\irl{\commlib;\library;\kontstack;\memstate'}}{\irl{K[42]}}{\irl{\trace}}$
  \item\label[goal]{goal:scct:exprbacktranslation:mid:correct:staterel} $\xlangbackstateeqc[\delta_{scct}]{\Omega'}{\irl{\commlib;\library;\kontstack;\memstate'}}$
  \item\label[goal]{goal:scct:exprbacktranslation:mid:correct:tracerel} $\irl{\trace}\thexlangtraceeq[\delta_{scct}]\obj{\hole{\cdot}}$
  \end{goals}
\end{lemma}
\begin{proof}
  Similar to \Cref{lem:exprbacktranslation:mid:wrapper:correct}.
\end{proof}

\begin{lemma}[Backtranslation Correctness of $\obj{Call\ \ctxtocomp}$]\label{lem:scct:exprbacktranslation:end:wrapper:correct}
  If
  \begin{assumptions}
  \item $\obj{\Omega}=\obj{\commlib;\library;\kontstack;\ctx;n;\memstate}$
  \item\label[ass]{asm:scct:exprbacktranslation:end:wrapper:correct:kontstack} $\obj{\kontstack}=\obj{(K';bar),\kontstack'}$
  \item $\obj{\library}=\obj{\library_{ctx}\linker}\mmlAtmsmmlAtscctcomp{\library_{comp}}$
  \item $\obj{\commlib}=\mmlAtmsmmlAtscctcomp{\commlib}=\operatorname{dom}\ \mmlAtmsmmlAtscctcomp{\library_{comp}}$
  \item $\execoN[^{2}]{\Omega}{K\hole{call\ foo^{\sigma}\ \valueexpr^{\sigma'}}}{\commlib;\library;(K;foo),\kontstack;\comp;1;\memstate}{{\color{black}\mmlAtmsmmlAtscctcomp{e_{foo}}}[\valueexpr^{\sigma'}/y]}{Call\ \ctxtocomp\ foo\ \valueexpr;\ctx;\sigma'}$
  \item $\mmlAtmsmmlAtscctctxtocomp[]{\color{black}\tospecificevo[_{\obj{\bullet}}]{Call\ \ctxtocomp\ foo\ \valueexpr}}=\irl{call\ foo\ }\mmlAtmsmmlAtscctv[]{\valueexpr}$
  \item\label[ass]{asm:scct:exprbacktranslation:end:wrapper:correct:backstateeq} $\xlangbackstateeqc[\delta]{\Omega}{\Omega}$
  \item $\irl{\Omega}=\irl{\commlib;\library;\kontstack;\ctx;\memstate}$
  \item $\irl{let\ foo\ y:=e_{foo}}\in\irl{\library_{comp}}$
  \item $\irl{\library}=\irl{\library_{ctx}\linker\library_{comp}}$
%  \item $\irl{\library}=\left\{\irl{main}\mapsto\irl{e_{main}}\right\}\irl{\linker\library_{comp}}$
  \end{assumptions}
  then $\exists n\ \irl{\trace}$,
  \begin{goals}
%  \item\label[goal]{goal:scct:exprbacktranslation:end:wrapper:correct:deltasubset} $\delta\subseteq\delta'$
  \item\label[goal]{goal:scct:exprbacktranslation:end:wrapper:correct:execs} $\execN[^{n}]{\irl{\Omega}}{\irl{K[call\ foo\ }\mmlAtmsmmlAtscctv[]{\valueexpr}\irl{]}}{\irl{\commlib;\library;(K;foo),\kontstack;\comp;\memstate}}{\irl{e_{foo}[\valueexpr/y]}}{\irl{\trace}}$
  \item\label[goal]{goal:scct:exprbacktranslation:end:wrapper:correct:stateeq} $\xlangstateeqc[\delta]{\irl{\commlib;\library;(K,foo),\kontstack;\comp;\memstate}}{\commlib;\library;(K;foo),\kontstack;\comp;1;\memstate}$
  \item\label[goal]{goal:scct:exprbacktranslation:end:wrapper:correct:traceeq} $\irl{\trace}\thexlangtraceeq[\delta]\obj{Call\ \ctxtocomp\ foo\ \valueexpr;\ctx;\sigma'}$
  \end{goals}
\end{lemma}
\begin{proof}
  Let $\irl{\valueexpr}=\mmlAtmsmmlAtscctv{\valueexpr}$.
  Instantiate the existentials of the goal $n=1$ and $\irl{\trace}=\irl{Call\ \ctxtocomp\ foo\ \valueexpr;\ctx,\hole{\cdot}}$.

  \noindent
  \Cref{goal:scct:exprbacktranslation:end:wrapper:correct:execs} follows immediately from \Cref{tr:tw-e-ectx-call-notsame}.

  \noindent
  \Cref{goal:scct:exprbacktranslation:end:wrapper:correct:stateeq} follows immediately from \Cref{tr:scct-state-eq}.

  \noindent
  \Cref{goal:scct:exprbacktranslation:end:wrapper:correct:traceeq} follows immediately from \Cref{tr:scct-cons-trace-eq,tr:scct-call-event-eq}.
\end{proof}

\begin{lemma}[Backtranslation Correctness of $\obj{End}$]\label{lem:scct:exprbacktranslation:vend:wrapper:correct}
  If
  \begin{assumptions}
  \item $\obj{\library}=\obj{\library_{ctx}\linker}\mmlAtmsmmlAtscctcomp{\library_{comp}}$
  \item $\obj{\commlib}=\mmlAtmsmmlAtscctcomp{\commlib}=\operatorname{dom}\ \mmlAtmsmmlAtscctcomp{\library_{comp}}$
  \item $\execoN[^{2}]{\commlib;\library;(\hole{\cdot};main),\hole{\cdot};\ctx;n;\memstate}{K\hole{return\ \valueexpr^{\sigma}}}{\commlib;\library;\hole{\cdot};\comp;1;\memstate}{\valueexpr^{\sigma}}{End\ \valueexpr;\ctx;\sigma}$
  \item\label[ass]{asm:scct:exprbacktranslation:vend:wrapper:correct:backtrans} $\mmlAtmsmmlAtscctctxtocomp[]{\color{black}\tospecificevo[_{\obj{\bullet}}]{End\ \valueexpr;\ctx;\sigma}}=\irl{return\ }\mmlAtmsmmlAtscctv[]{\valueexpr}$
  \item\label[ass]{asm:scct:exprbacktranslation:vend:wrapper:correct:backstateeq} $\xlangbackstateeqc[_{\delta}]{\commlib;\library;(\hole{\cdot};main),\hole{\cdot};\ctx;\memstate}{\commlib;\library;(\hole{\cdot};main),\hole{\cdot};\ctx;n;\memstate}$
  \item $\irl{\library}=\irl{\library_{ctx}\linker\library_{comp}}$
  \end{assumptions}
  then $\exists n\ \irl{\trace}$,
  \begin{goals}
%  \item\label[goal]{goal:scct:exprbacktranslation:end:wrapper:correct:deltasubset} $\delta\subseteq\delta'$
  \item\label[goal]{goal:scct:exprbacktranslation:vend:wrapper:correct:execs} $\exec[^{n}]{\irl{\Omega}}{\irl{K[return\ }\mmlAtmsmmlAtscctv[]{\valueexpr}\irl{]}}{\irl{\commlib;\library;\hole{\cdot};\comp;\memstate}}{\mmlAtmsmmlAtscctv[]{\valueexpr}}{\irl{\trace}}$
  \item\label[goal]{goal:scct:exprbacktranslation:vend:wrapper:correct:stateeq} $\xlangstateeqc[\delta']{\irl{\commlib;\library;\hole{\cdot};\comp;\memstate}}{\commlib;\library;\hole{\cdot};\comp;1;\memstate}$
  \item\label[goal]{goal:scct:exprbacktranslation:vend:wrapper:correct:traceeq} $\irl{\trace}\thexlangtraceeq[\delta']\obj{End\ \valueexpr;\ctx;\sigma}$
  \end{goals}
\end{lemma}
\begin{proof}
  Instantiate the goal with $n=1$ and $\irl{\trace}=\irl{End\ \valueexpr;\ctx}$.
  \Cref{goal:scct:exprbacktranslation:vend:wrapper:correct:execs} by \Cref{tr:tw-e-ectx-ret-main}.

  \noindent
  \Cref{goal:scct:exprbacktranslation:vend:wrapper:correct:stateeq} by inversion on \Cref{asm:scct:exprbacktranslation:vend:wrapper:correct:backstateeq}.

  \noindent
  \Cref{goal:scct:exprbacktranslation:vend:wrapper:correct:traceeq} by \Cref{tr:scct-cons-trace-eq,tr:scct-end-event-eq}.
\end{proof}

\begin{lemma}[Backtranslation Correctness]\label{lem:scct:backtranslation:correct}
  If
  \begin{assumptions}
  \item\label[ass]{asm:scct:backtrans:correct:exect0} $\execo{\Omega}{call\ main\ 0}{\Omega'}{\finalexpr}{\trace}$
  \item\label[ass]{asm:scct:backtrans:correct:backtrans} $\mmlAtmsmmlAtscct[]{\trace}=\irl{\library_{ctx}}$
  \item\label[ass]{asm:scct:backtrans:correct:initstaterel} $\xlangstateeqc[\emptyset]{\Omega}{\Omega}$
  \item $\obj{\Omega}=\obj{foo,\hole{\cdot};\library;\hole{\cdot};\comp;1;\hole{\cdot};\hole{\cdot};\hole{\cdot}}$
  \item\label[ass]{asm:scct:backtrans:correct:omegais} $\irl{\Omega}=\irl{\commlib;\library;\kontstack;\comp;\memstate}$
  \item\label[ass]{asm:scct:backtrans:correct:irllinks} $\irl{\library}=\irl{\library_{ctx}\linker\library_{comp}}$
  \end{assumptions}
  then $\exists \delta_{e}\ \irl{\Omega_{e}'}\ \irl{\trace_{e}}$,
  \begin{goals}
  \item\label[goal]{goal:scct:backtrans:correct:execs} $\exec{\irl{\Omega}}{\irl{call\ main\ 0}}{\irl{\Omega_{e}'}}{\mmlAtmsmmlAtscctv[]{\finalexpr}}{\irl{\trace_{e}}}$
  \item\label[goal]{goal:scct:backtrans:correct:stateeq} $\xlangstateeqc[\delta_{e}]{\Omega_{e}'}{\Omega'}$
  \item\label[goal]{goal:scct:backtrans:correct:traceeq} $\irl{\trace_{e}}\thexlangtraceeq[\delta_{e}]\obj{\trace}$
  \end{goals}
\end{lemma}
\begin{incompleteproof}
  Inverting \Cref{asm:scct:backtrans:correct:backtrans} gives:
  \begin{passumptions}{H}
    \item $\obj{\trace}=\obj{\trace[_{0}]\cdot\trace[_{comp}]\cdot\trace[_{1}]}$
    \item $\obj{\trace[_{0}]}=\obj{Start\cdot\trace[_{0}']\cdot Call\ \ctxtocomp\ foo\ \valueexpr}$
    \item $\obj{\trace[_{1}]}=\obj{Ret\ \comptoctx\ \valueexpr'\cdot\trace[_{1}]'\cdot End\ \valueexpr''}$
    \item $\vdash\obj{\trace[_{comp}]}\operatorname{non-int-\obj{\trace}}$
    \item\label[ass]{asm:scct:backtrans:subtop1} $\mmlAtmsmmlAtscctsubtop[]{\color{black}\tospecificevo[^{*}_{\obj{\bullet}}]{\trace[_{0}]}}=\irl{e_{0};e_{0}';e_{0}''}$
    \item\label[ass]{asm:scct:backtrans:subtop2} $\mmlAtmsmmlAtscctsubtop[]{\color{black}\tospecificevo[^{*}_{\obj{\bullet}}]{\trace[_{1}]}}=\irl{e_{1};e_{1}';e_{1}''}$
  \end{passumptions}
  By definition of $\tospecificevo[_{\obj{\bullet}}]{\cdot}$\MK{lemma?}, we have:
  \begin{passumptions}{H}
    \setcounter{enumi}{6}
    \item $\tospecificevo[^{*}_{\obj{\bullet}}]{\trace[_{0}]}=\obj{Start\cdot Call\ \ctxtocomp\ foo\ \valueexpr}$
    \item $\tospecificevo[^{*}_{\obj{\bullet}}]{\trace[_{1}]}=\obj{Ret\ \comptoctx\ \valueexpr'\cdot End\ \valueexpr''}$
  \end{passumptions}
  Invert \Cref{asm:scct:backtrans:subtop1,asm:scct:backtrans:subtop2}:
  \begin{passumptions}{H}
    \setcounter{enumi}{8}
    \item\label[ass]{asm:scct:backtrans:subtop1:e0} $\mmlAtmsmmlAtscctcomptoctx[]{Start}=\irl{e_{0}}$
    \item\label[ass]{asm:scct:backtrans:subtop1:e1} $\mmlAtmsmmlAtscctdetail[]{\hole{\cdot}}=\irl{e_{0}'}$
    \item\label[ass]{asm:scct:backtrans:subtop1:e2} $\mmlAtmsmmlAtscctctxtocomp[]{Call\ \ctxtocomp\ foo\ \valueexpr}=\irl{e_{0}''}$
    \item\label[ass]{asm:scct:backtrans:subtop2:e0} $\mmlAtmsmmlAtscctcomptoctx[]{Ret\ \comptoctx\ \valueexpr'}=\irl{e_{1}}$
    \item\label[ass]{asm:scct:backtrans:subtop2:e1} $\mmlAtmsmmlAtscctdetail[]{\hole{\cdot}}=\irl{e_{1}'}$
    \item\label[ass]{asm:scct:backtrans:subtop2:e2} $\mmlAtmsmmlAtscctctxtocomp[]{End\ \valueexpr''}=\irl{e_{1}''}$
  \end{passumptions}
  Invert \Cref{asm:scct:backtrans:subtop1:e0,asm:scct:backtrans:subtop1:e1,asm:scct:backtrans:subtop1:e2,asm:scct:backtrans:subtop2:e0,asm:scct:backtrans:subtop2:e1,asm:scct:backtrans:subtop2:e2}:
  \begin{passumptions}{H}
    \setcounter{enumi}{14}
    \item\label[ass]{asm:scct:backtrans:subtop1:e0p} $\irl{e_{0}}=\irl{42}$
    \item\label[ass]{asm:scct:backtrans:subtop1:e1p} $\irl{e_{0}'}=\irl{42}$
    \item\label[ass]{asm:scct:backtrans:subtop1:e2p} $\irl{e_{0}''}=\irl{call\ foo }\mmlAtmsmmlAtscctv[]{\valueexpr}$
    \item\label[ass]{asm:scct:backtrans:subtop2:e0p} $\irl{e_{1}}=\mmlAtmsmmlAtscctv[]{\valueexpr'}$
    \item\label[ass]{asm:scct:backtrans:subtop2:e1p} $\irl{e_{1}'}=\irl{42}$
    \item\label[ass]{asm:scct:backtrans:subtop2:e2p} $\irl{e_{1}''}=\mmlAtmsmmlAtscctv[]{\valueexpr''}$
  \end{passumptions}
  Let $\irl{\valueexpr}=\mmlAtmsmmlAtscctv[]{\valueexpr}$ and $\irl{\valueexpr'}=\mmlAtmsmmlAtscctv[]{\valueexpr'}$ and $\irl{\valueexpr''}=\mmlAtmsmmlAtscctv[]{\valueexpr''}$.

  By \Cref{tr:tw-e-ectx-call-main}, we have\MK{apply BT corr of start}
  \begin{passumptions}{H}
    \setcounter{enumi}{20}
    \item $\exec[]{\irl{\Omega}}{\irl{call\ main\ 0}}{\irl{foo,\hole{\cdot};\library;(main;\hole{\cdot}),\hole{\cdot};\comp;\memstate}}{\irl{42;42;call\ foo\ \valueexpr;v';42;\valueexpr''}}{\irl{Start}}$
  \end{passumptions}
  It's easy to see that this reduces further to:
  \begin{passumptions}{H}
    \setcounter{enumi}{21}
    \item $\execN[^{3}]{\irl{\Omega}}{\irl{42;42;call\ foo\ \valueexpr;v';42;\valueexpr''}}{\irl{foo},\irl{\hole{\cdot}};\irl{\library};(\irl{\hole{\cdot}};\irl{\valueexpr';42;\valueexpr''}),(\irl{main};\irl{\hole{\cdot}}),\irl{\hole{\cdot}};\irl{\comp};\irl{\memstate}}{\irl{e_{foo}}}{\irl{Call\ \ctxtocomp\ foo\ \valueexpr}}$
  \end{passumptions}

  Now by backward simulation

  then the other BT correctness lemmas
\end{incompleteproof}

\begin{theorem}[TMS Relation Correctness for $\mmlAtmsmmlAtscctcomp{\bullet}$]\label{thm:tms-rel-corr:lmslscct}
  \begin{align*}
    \text{ if }& 
    \tospecificevo[^*_{\delta_{MS}}]{\color{black}\sigma_{\tospecificevo[^*_{\delta_{MS}}]{\bullet}}(\tmssafe)} = \tmssafe
    \text{ and } 
    \xlangtraceeq{\color{black}\sigma_{\xlangtraceeq{}{}}(\sigma_{\tospecificevi[^*_{\delta_{MS}}]{\bullet}}(\tmssafe))}{\color{black}\sigma_{\tospecificevo[^*_{\delta_{MS}}]{\bullet}}(\tmssafe)}
    \\
    \text{ then }& 
    \tospecificevi[^*_{\delta_{MS}}]{\color{black}\sigma_{\xlangtraceeq{}{}}(\sigma_{\tospecificevo[^*_{\delta_{MS}}]{\bullet}}(\tmssafe))} = \tmssafe 
  \end{align*}
\end{theorem}
\begin{proof}
  unfolding.
\end{proof}

\begin{definition}[$\mmlAtms$ Robust Satisfaction]
  We write $\irl{\library_{\comp}}\vDash_{R}\pi$ for
  If
  \begin{assumptions}
    \item $\wexec{\irl{prog\ \library_{\ctx}\ \library_{\comp}}}{\irl{\Omega}}{\irl{\finalexpr}}{\irl{\trace}}$
  \end{assumptions}
  Then $\exists \delta_{sCCT}$
  \begin{goals}
    \item $\tospecificevi[_{\delta_{sCCT}}]{\trace}\in\pi$
  \end{goals}
\end{definition}

\begin{definition}[$\mmlAtscct$ Robust Satisfaction]
  We write $\obj{\library_{\comp}}\vDash_{R}\pi$ for
  If
  \begin{assumptions}
    \item $\wexeco{prog\ \library_{\ctx}\ \library_{\comp}}{\Omega}{\finalexpr}{\trace}$
  \end{assumptions}
  Then $\exists \delta_{sCCT}$
  \begin{goals}
    \item $\tospecificevo[_{\delta_{sCCT}}]{\trace}\in\pi$
  \end{goals}
\end{definition}

\begin{scontents}[store-env=buffer]
  $\;$\\
  \begin{goals}
    \item $\vdash\mmlAtmsmmlAtscctcomp{\bullet}:\lceil\operatorname{\sCCT}\rceil$
  \end{goals}
\end{scontents}
\realthm{thm:rscctp}{7}{Robust Strict Cryptographic Constant Time Preservation}
\begin{incompleteproof}
\end{incompleteproof}

\begin{scontents}[store-env=buffer]
  $\;$\\
  \begin{goals}
    \item $\vdash\mmlAtmsmmlAtscctcomp{\color{black}\mmlAtmmlAtmscomp{\color{black}\mmlAmmlAtcomp{\bullet}}}:\lceil\operatorname{msafe}\rceil\cap\lceil\operatorname{\sCCT}\rceil$
  \end{goals}
\end{scontents}
\realthm{thm:rmsscctp}{8}{Robust Memory Safety and Strict Cryptographic Constant Time Preservation}
\begin{proof}
  Note from \Thmref{thm:rmsp} and \Thmref{thm:rscctp}:
  \begin{passumptions}{H}
    \item\label[ass]{ass:crpms} $\rtp{\mmlAtmmlAtmscomp{\color{black}\mmlAmmlAtcomp{\bullet}}}{\lceil\operatorname{msafe}\rceil}$
    \item\label[ass]{ass:crpscct} $\rtp{\mmlAtmsmmlAtscctcomp{\bullet}}{\lceil\operatorname{\sCCT}\rceil}$
  \end{passumptions}
  By \Thmref{lem:seqcompo} using \Cref{ass:crpms,ass:crpscct} we have:
  \begin{passumptions}{H}
    \setcounter{enumi}{2}
    \item $\vdash\mmlAtmsmmlAtscctcomp{\color{black}\mmlAtmmlAtmscomp{\color{black}\mmlAmmlAtcomp{\bullet}}}:\lceil\operatorname{msafe}\rceil\cap\lceil\operatorname{\sCCT}\rceil$
  \end{passumptions}
  This solves our goal.
\end{proof}


\subsection{Low-Level Language}

The next language is ,,low-level'', because it extends the previous one with speculation.

\myfig{
	\vspace{-1em}
  \begin{gather*}
  \begin{aligned}
  \mi{Final\ Result}\ \ird{\finalexprnoerr} \bnfdef&\ \ird{\valueexpr^{\sigma}} \mid \ird{x^{\sigma}} \hspace{0.5cm}
  \mi{May\ be\ a\ Result}\ \ird{\finalexpr} \bnfdef\ \ird{\finalexprnoerr} \mid \ird{stuck} \\
  %
  \mi{Expressions}~\ird{e} \bnfdef&\ \ird{\finalexpr} \mid \ird{e_{1} \oplus e_{2}} \mid \ird{x[e]} \mid \ird{getDIT\ x\ in\ e} \mid \ird{setDIT\ e} \\
  & \mid \ird{let\ x = e_{1}\ in\ e_{2}} \mid \ird{x[e_{1}]\leftarrow e_{2}} \\
  & \mid \ird{let\ x = new\ e_{1}\ in\ e_{2}} \mid \ird{delete\ x} \\
  & \mid \ird{return\ e} \mid \ird{call\ foo\ e} \mid \ird{ifz\ e_{1}\ then\ e_{2}\ else\ e_{3}} \\
  & \mid \ird{abort()} \mid \ird{x\ is\ \poisoned} \\
  & \mid \ird{\langle e_{1},e_{2}\rangle} \mid \ird{\pi_{1} e} \mid \ird{\pi_{2} e} \mid \ird{e\ has\ \type} \\
   &\text{where } \ird{\oplus}\in\{\ird{+},\ird{-},\ird{\times},\ird{<},\ird{/}\}\\
  %
  \mi{Functions}~\ird{\asymbol} \bnfdef&\ \ird{let\ foo\ x:= e} \hspace{0.25cm}
  \mi{Types}~\ird{\type} \bnfdef\ \ird{\nat} \mid \ird{\nat\times\nat} \\
  %
  \mi{Values}~\ird{\valueexpr} \bnfdef&\ \ird{n}\in\ird{\nat} \hspace{0.25cm}
  %
  \mi{References}~\ird{\loc}\in\ird{\nat} \\
  \mi{Eval. Ctx.}~\ird{K}\bnfdef &\ \ird{\hole{\cdot}}\mid \ird{K\oplus e}\mid \ird{v\oplus K}\mid \ird{x[K]}\mid \ird{let\ x=K\ in\ e}\\
                     &\ \mid\ird{x[K]\leftarrow e}\mid \ird{x[v]\leftarrow K}\mid \ird{let\ x=new\ K\ in\ e} \\
                     &\ \mid\ird{ifz\ K\ then\ e_1\ else\ e_2} \mid \ird{call\ foo\ K}\mid \ird{return\ K} \\
                     &\ \mid\ird{\langle K, e\rangle} \mid \ird{\langle \valueexpr, K \rangle } \mid \ird{\pi_{1} K} \mid \ird{\pi_{2} K} \mid \ird{K\ has\ \type} \mid \ird{barrier} \\
                     &\ \mid\ird{ifz\ K\ then\ e_{1}\ else\ e_{2}} \mid \ird{setDIT\ K} \\
  %
  \mi{Variables}~\ &\ird{x} \mid \ird{y} \mid \ird{foo} \mid \dots \hspace{0.5cm}
  %
  \mi{Poison}~\ \ird{\poison}~\bnfdef\ \ird{\poisonless} \mid \ird{\poisoned}\\
  \mi{Sandbox\ Tag}~&\ \ird{\sandboxtag}~\bnfdef\ \ird{\ctx} \mid \ird{\comp}\\
  %
  \mi{Typing. Env.}~\ird{\Gamma} \bnfdef&\ \ird{\hole{\cdot}} \mid \ird{\Gamma,x:\type}\hspace{0.5cm}
  \mi{Store}~\ird{\Delta} \bnfdef\ \ird{\hole{\cdot}} \mid \ird{x\mapsto(\loc;\sandboxtag;\poison;n),\Delta}\\
  %
  \mi{Communication}~\ird{\comm} \bnfdef&\ \ird{\ctxtocomp} \mid \ird{\comptoctx} \mid \ird{\nocomm} \hspace{0.5cm}
  \mi{Heaps}~\ird{H} \bnfdef\ \ird{\hole{\cdot}} \mid \ird{H}::\ird{n} \\
  %
  \mi{Cont.\ Stack}~\ird{\kontstack} \bnfdef&\ \ird{\hole{\cdot}} \mid (\ird{K};\ird{foo}),\ird{\kontstack} \hspace{0.5cm}
  \mi{Library}~\ird{\library} \bnfdef\ \ird{\hole{\cdot}} \mid \ird{\asymbol},\ird{\library} \\
  \mi{Relevant}\ \ird{\commlib} \bnfdef& \ird{\hole{\cdot}} \mid \ird{foo},\ird{\commlib}\hspace{0.5cm}
  \mi{State}~\ird{\Omega}\ \bnfdef\ \ird{\cfstate;\sandboxtag;n;\memstate}\\
  \mi{Flow\ State}~\ird{\cfstate}\bnfdef&\ \ird{\commlib;\library;\kontstack}\hspace{0.5cm}
  \mi{Memory\ State}~\ird{\memstate}\bnfdef\ \ird{H^{\ctx};H^{\comp};\Delta} \\
  %
  \mi{Programs}\ &\ird{prog\ \library_{ctx}\ \library_{comp}} \hspace{0.35cm}
  \mi{Substitutions}~\ird{\gamma} \bnfdef \ird{[\valueexpr/x],\gamma}\ \vert\ \ird{\hole{\cdot}} \\
  \mi{Security\ Tag}~\ird{\sigma} \bnfdef&\ \ird{\lock_{vX}} \mid \ird{\unlock} \\
  \mi{Leak\ Tag}~\ird{vX} \bnfdef&\ \ird{NONE} \mid \ird{PHT} 
  \end{aligned}
  \end{gather*}
}{mmlao-syntax}{Syntax of $\mmlAspec$}

The only difference between $\mmlAtscct$ and $\mmlAspec$ is speculative semantics.

\subsubsection{Dynamic Semantics}

\myfig{
  \judgbox{\operatorname{dom}\ \ird{\library}=\ird{foo},\dots,\ird{bar}}{,,Collect function names.''}$\;$\\
  \begin{center}
    \typerule{$\ird{\library}$-dom-$\ird{\hole{\cdot}}$}{
    }{
      \operatorname{dom}\ \ird{\hole{\cdot}} = \ird{\hole{\cdot}}
    }{wo-lib-dom-empty}
    %
    \typerule{$\ird{\library}$-dom-cons}{
      \operatorname{dom}\ \ird{\library} = \ird{D}
    }{
      \operatorname{dom}\ (\ird{let\ foo\ x : \type}_\lambda\ird{:= e})\ird{,\library} = \ird{foo},\ird{D}
    }{wo-lib-dom-cons}
  \end{center}
  \begin{center}
    \judgbox{\ird{\library}\equiv\ird{\library_1}\cup\ird{\library_2}}{,,Merging $\mmlAspec$ libraries.''}$\;$\\
    \typerule{lib-merge-empty}{
      \ird{\library}=\ird{\library_1}
    }{
      \ird{\library}\equiv\ird{\library_1}\cup\ird{\hole{\cdot}}
    }{spec-lib-merge-empty}
    %
    \typerule{lib-merge-cons}{
      \ird{\library}\equiv\ird{\library_1}\cup\ird{\library_2}
    }{
      \ird{\asymbol,\library}\equiv\ird{\library_1}\cup\ird{\asymbol,\library_2}
    }{spec-lib-merge-cons}

    \judgbox{\ird{\library_1\linker\library_2}=\ird{\library}}{,,Syntactically linking $\mmlAspec$ libraries.''}$\;$\\
    \typerule{syntactic-plugging}{
      \operatorname{dom}\ird{\library_1}\cap\operatorname{dom}\ird{\library_2} = \emptyset &
      \ird{\library}\equiv\ird{\library_1}\cup\ird{\library_2}
    }{
      \ird{\library_1\linker\library_2} = \ird{\library}
    }{spec-plugging}
  \end{center}
}{w-plugging-o}{$\mmlAspec$ plugging of libraries and collecting of function names.}


\myfig{
  \begin{gather*}
  \begin{aligned}
  \mi{Base~Events}~\ird{\event_{b}} \bnfdef&\ \ird{Alloc\ \loc\ \valueexpr} \mid \ird{Dealloc\ \loc} \mid \ird{Get\ \loc\ \valueexpr} \mid \ird{Set\ \loc\ \valueexpr\ \valueexpr'} \mid \ird{\lightning}\\
                                           & \mid \ird{Call\ \comm\ foo\ \valueexpr} \mid \ird{Ret\ \comm\ \valueexpr} \mid \ird{Start} \mid \ird{End\ \valueexpr} \\
                                           & \mid \ird{Branch\ n} \mid \ird{Binop\ n\ m} \\
    & \mid \ird{{iGet}\ \loc\ \valueexpr} \mid \ird{{iSet}\ \loc\ \valueexpr\ \valueexpr'} \\
    & \mid \ird{Spec} \mid \ird{Rlb} \mid \ird{Barrier} \\
  \mi{Events}~\ird{\event} \bnfdef&\ \ird{\emptyevent} \mid \ird{\event_{b};\sandboxtag;\sigma}
  \end{aligned}
  \end{gather*}
}{to-events}{Events of $\mmlAspec$.}

% \myfig{
%   \judgbox{\exprevald{\Omega}{e}{\Omega'}{e'}{\event}}{,,Expression $\ird{e}$ evaluates under Configuration $\ird{\Omega}$ to $\ird{e'}$ and\\new Configuration $\ird{\Omega'}$, emitting event $\ird{\event}$.''}
%   %
%   \typerule{$e-\ird{\oplus}-$noleak-op}{
%     \ird{n_1}\oplus\ird{n_2}=\ird{n_3} &
%     \ird{\oplus}\notin\{\ird{*},\ird{/},\ird{<}\} \\
%     \ird{\sigma''}=\ird{\sigma\sqcap\sigma'}
%   }{
%     \exprevalo{\Omega}{n_1^\sigma \oplus n_2^{\sigma'}}{\Omega}{n_3^{\sigma''}}{\emptyevent}
%   }{to-e-oplus-noleak-op}
%   %
%   \typerule{$e-\ird{\oplus}-$leak}{
%     \ird{n_1}\oplus\ird{n_2}=\ird{n_3} &
%     \ird{\oplus}\in\{\ird{*},\ird{/},\ird{<}\} \\
%     \ird{\sigma''}=\ird{\sigma\sqcap\sigma'}
%   }{
%     \exprevalo{\cfstate;\sandboxtag;0;\memstate}{n_1^\sigma\oplus n_2^{\sigma'}}{\cfstate;\sandboxtag;0;\memstate}{n_3^{\sigma''}}{Binop\ n_1\ n_2;\sandboxtag;\sigma''}
%   }{to-e-oplus-leak}
%   %
%   \typerule{$e-\ird{\oplus}-$noleak-doit}{
%     \ird{n_1}\oplus\ird{n_2}=\ird{n_3} &
%     \ird{\oplus}\in\{\ird{*},\ird{/},\ird{<}\} \\
%     \ird{\sigma''}=\ird{\sigma\sqcap\sigma'}
%   }{
%     \exprevalo{\cfstate;\sandboxtag;m+1;\memstate}{n_1^\sigma\oplus n_2^{\sigma'}}{\cfstate;\sandboxtag;m+1;\memstate}{n_3^{\sigma''}}{\emptyevent}
%   }{to-e-oplus-leak-doit}
%   %
%   \typerule{$e-\ird{get}-\in-$leak}{
%     \ird{\memstate}=\ird{H^{\ctx};H^{\comp};\Delta_1,x\mapsto(\loc;\sandboxtag;\poison;m),\Delta_2} &
%     \ird{\loc}+\ird{n}\in\text{dom }\ird{H^{\sandboxtag}} \\
%     \ird{\sigma''}=\ird{\sigma\sqcap\sigma'}
%   }{
%     \exprevalo{\cfstate;\sandboxtag';0;\memstate}{x^\sigma[n^{\sigma'}]}{\cfstate;\sandboxtag';0;\memstate}{(H^{\sandboxtag}(\loc+n))^{\sigma''}}{Get\ \loc\ n;\sandboxtag;\sigma''}
%   }{to-e-get-in-leak}
%   %
%   \typerule{$e-\ird{get}-\notin-$leak}{
%     \ird{\memstate}=\ird{H^{\ctx};H^{\comp};\Delta_1,x\mapsto(\loc;\sandboxtag;\poison;m),\Delta_2} &
%     \ird{\loc}\notin\text{dom }\ird{H^{\sandboxtag}} \\
%     \ird{\sigma''}=\ird{\sigma\sqcap\sigma'}
%   }{
%     \exprevalo{\cfstate;\sandboxtag';0;\memstate}{x^\sigma[n^{\sigma'}]}{\cfstate;\sandboxtag';0;\memstate}{1729^{\unlock}}{Get\ \loc\ n;\sandboxtag;\sigma''}
%   }{to-e-get-notin-leak}
%   %
%   \typerule{$e-\ird{get}-\in-$noleak}{
%     \ird{\memstate}=\ird{H^{\ctx};H^{\comp};\Delta_1,x\mapsto(\loc;\sandboxtag;\poison;m),\Delta_2} &
%     \ird{\loc}+\ird{n}\in\text{dom }\ird{H^{\sandboxtag}} \\
%     \ird{\sigma''}=\ird{\sigma\sqcap\sigma'}
%   }{
%     \exprevalo{\cfstate;\sandboxtag';m+1;\memstate}{x^\sigma[n^{\sigma'}]}{\cfstate;\sandboxtag';m+1;\memstate}{(H^{\sandboxtag}(\loc+n))^{\sigma''}}{\widehat{Get}\ \loc\ n;\sandboxtag;\sigma''}
%   }{to-e-get-in-noleak}
%   %
%   \typerule{$e-\ird{get}-\notin-$noleak}{
%     \ird{\memstate}=\ird{H^{\ctx};H^{\comp};\Delta_1,x\mapsto(\loc;\sandboxtag;\poison;m),\Delta_2} &
%     \ird{\loc}\notin\text{dom }\ird{H^{\sandboxtag}} \\
%     \ird{\sigma''}=\ird{\sigma\sqcap\sigma'}
%   }{
%     \exprevalo{\cfstate;\sandboxtag';m+1;\memstate}{x^\sigma[n^{\sigma'}]}{\cfstate;\sandboxtag';m+1;\memstate}{1729^{\unlock}}{\widehat{Get}\ \loc\ n;\sandboxtag;\sigma''}
%   }{to-e-get-notin-noleak}
%   %
%   \typerule{$e-\ird{set}-\ctx-$leak}{
%     \ird{\memstate}=\ird{H^{\ctx};H^{\comp};\Delta_1,x\mapsto(\loc;\ctx;\poison;n),\Delta_2} &
%     \ird{H^{\ctx'}} = \ird{H^{\ctx}}(\ird{\loc+n}\mapsto \ird{v}) \\
%     \ird{\memstate'}=\ird{H^{\ctx'};H^{\comp};\Delta_1,x\mapsto(\loc;\ctx;\poison;n),\Delta_2} &
%     \ird{\sigma'''}=\ird{\sigma\sqcap\sigma'}
%   }{
%     \exprevalo{\cfstate;\ctx;0;\memstate}{x^\sigma[n^{\sigma'}]\leftarrow v^{\sigma''}}{\cfstate;\ctx;0;\memstate'}{v^{\sigma''}}{Set\ \loc\ n\ v;\ctx;\sigma'''}
%   }{to-e-set-ctx-leak}
%   %
%   \typerule{$e-\ird{set}-\comp-$leak}{
%     \ird{\memstate}=\ird{H^{\ctx};H^{\comp};\Delta_1,x\mapsto(\loc;\comp;\poison;n),\Delta_2} &
%     \ird{H^{\comp'}} = \ird{H^{\comp}}(\ird{\loc+n}\mapsto \ird{v}) \\
%     \ird{\memstate'}=\ird{H^{\ctx};H^{\comp'};\Delta_1,x\mapsto(\loc;\comp;\poison;n),\Delta_2} &
%     \ird{\sigma'''}=\ird{\sigma\sqcap\sigma'}
%   }{
%     \exprevalo{\cfstate;\comp;0;\memstate}{x^\sigma[n^{\sigma'}]\leftarrow v^{\sigma''}}{\cfstate;\comp;0;\memstate'}{v^{\sigma''}}{Set\ \loc\ n\ v;\comp;\sigma'''}
%   }{to-e-set-comp-leak}
% }{to-expr-eval-0}{Evaluation of $\mmlAtscct$ expressions.}
% \myfig{
%   \typerule{$e-\ird{set}-\ctx-$noleak}{
%     \ird{\memstate}=\ird{H^{\ctx};H^{\comp};\Delta_1,x\mapsto(\loc;\ctx;\poison;n),\Delta_2} &
%     \ird{H^{\ctx'}} = \ird{H^{\ctx}}(\ird{\loc+n}\mapsto \ird{v}) \\
%     \ird{\memstate'}=\ird{H^{\ctx'};H^{\comp};\Delta_1,x\mapsto(\loc;\ctx;\poison;n),\Delta_2} &
%     \ird{\sigma'''}=\ird{\sigma\sqcap\sigma'}
%   }{
%     \exprevalo{\cfstate;\ctx;m+1;\memstate}{x^\sigma[n^{\sigma'}]\leftarrow v^{\sigma''}}{\cfstate;\ctx;m+1;\memstate'}{v^{\sigma''}}{\widehat{Set}\ \loc\ n\ v;\ctx;\sigma'''}
%   }{to-e-set-ctx-noleak}
%   %
%   \typerule{$e-\ird{set}-\comp-$noleak}{
%     \ird{\memstate}=\ird{H^{\ctx};H^{\comp};\Delta_1,x\mapsto(\loc;\comp;\poison;n),\Delta_2} &
%     \ird{H^{\comp'}} = \ird{H^{\comp}}(\ird{\loc+n}\mapsto \ird{v}) \\
%     \ird{\memstate'}=\ird{H^{\ctx};H^{\comp'};\Delta_1,x\mapsto(\loc;\comp;\poison;n),\Delta_2} &
%     \ird{\sigma'''}=\ird{\sigma\sqcap\sigma'}
%   }{
%     \exprevalo{\cfstate;\comp;m+1;\memstate}{x^\sigma[n^{\sigma'}]\leftarrow v^{\sigma''}}{\cfstate;\comp;m+1;\memstate'}{v^{\sigma''}}{\widehat{Set}\ \loc\ n\ v;\comp;\sigma'''}
%   }{to-e-set-comp-noleak}
%   %
%   \typerule{$e-\ird{let}-\ird{\finalexprnoerr}$}{
%     \ird{\sigma''}=\ird{\sigma\sqcap\sigma'}
%   }{
%     \exprevalo{\Omega}{let\ x^\sigma=\finalexprnoerr^{\sigma'}\ in\ e}{\Omega}{e[\finalexprnoerr^{\sigma''}/x]}{\emptyevent}
%   }{to-e-let-f}
%   %
%   \typerule{$e-\ird{delete}$}{
%     \ird{\memstate}=\ird{H^{\ctx};H^{\comp};\Delta_1,x\mapsto(\loc;\sandboxtag;\poisonless;n),\Delta_2} \\
%     \ird{\memstate}=\ird{H^{\ctx};H^{\comp};\Delta_1,x\mapsto(\loc;\sandboxtag;\poisoned;n),\Delta_2}
%   }{
%     \exprevalo{\cfstate;\sandboxtag;m;\memstate}{delete\ x^\sigma}{\cfstate;\sandboxtag;m;\memstate'}{0^\unlock}{Dealloc\ \loc;\sandboxtag;\sigma}
%   }{to-e-delete}
%   %
%   \typerule{$e-\ird{new}-ctx$}{
%     \fresh{\ird{\Delta}}{\ird{\loc}} &
%     \fresh{\ird{\Delta}}{\ird{z}} &
%     \ird{H^{\ctx'}} = \ird{H^{\ctx}} \ll \ird{n} \\
%     \ird{\memstate} = \ird{H^{\ctx'};H^{\comp};z\mapsto (\loc;\ctx;\poisonless;n),\Delta} &
%     \ird{\sigma''}=\ird{\sigma\sqcap\sigma'}
%   }{
%     \exprevalo{\cfstate;\ctx;m;H^{\ctx};H^{\comp};\Delta}{let\ x^\sigma=new\ n^{\sigma'}\ in\ e}{\cfstate;\ctx;m;\memstate}{e[z^{\sigma''}/x]}{Alloc\ \loc\ n;\ctx;\sigma''}
%   }{to-e-let-new-ctx}
%   %
%   \typerule{$e-\ird{new}-comp$}{
%     \fresh{\ird{\Delta}}{\ird{\loc}} &
%     \fresh{\ird{\Delta}}{\ird{z}} &
%     \ird{H^{\comp'}} = \ird{H^{\comp}} \ll \ird{n} \\
%     \ird{\memstate} = \ird{H^{\ctx};H^{\comp'};z\mapsto (\loc;\ctx;\poisonless;n),\Delta} &
%     \ird{\sigma''}=\ird{\sigma\sqcap\sigma'}
%   }{
%     \exprevalo{\cfstate;\comp;m;H^{\ctx};H^{\comp};\Delta}{let\ x^\sigma=new\ n^{\sigma'}\ in\ e}{\cfstate;\comp;m;\memstate}{e[z^{\sigma''}/x]}{Alloc\ \loc\ n;\comp;\sigma''}
%   }{to-e-let-new-comp}
%   %
%   \typerule{$e-\ird{ifz}-$true-noleak}{
%   }{
%     \exprevalo{\cfstate;\sandboxtag;0;\memstate}{ifz\ 0^\sigma\ then\ e_1\ else\ e_2}{\cfstate;\sandboxtag;0;\memstate}{e_1}{Branch\ 0;\sandboxtag;\sigma}
%   }{to-e-if-true-noleak}
%   %
%   \typerule{$e-\ird{ifz}-$false-noleak}{
%   }{
%     \exprevalo{\cfstate;\sandboxtag;0;\memstate}{ifz\ (S\ n)^\sigma\ then\ e_1\ else\ e_2}{\cfstate;\sandboxtag;0;\memstate}{e_2}{Branch\ S(n);\sandboxtag;\sigma}
%   }{to-e-if-false-noleak}
%   %
%   \typerule{$e-\ird{ifz}-$true-leak}{
%   }{
%     \exprevalo{\cfstate;\sandboxtag;m+1;\memstate}{ifz\ 0^\sigma\ then\ e_1\ else\ e_2}{\cfstate;\sandboxtag;m+1;\memstate}{e_1}{\emptyevent}
%   }{to-e-if-true-leak}
%   %
%   \typerule{$e-\ird{ifz}-$false-leak}{
%   }{
%     \exprevalo{\cfstate;\sandboxtag;m+1;\memstate}{ifz\ (S\ n)^\sigma\ then\ e_1\ else\ e_2}{\cfstate;\sandboxtag;m+1;\memstate}{e_2}{\emptyevent}
%   }{to-e-if-false-leak}
%   %
%   \typerule{$e-\ird{abort}$}{
%   }{
%     \exprevalo{\cfstate;\sandboxtag;m;\memstate}{abort()}{\cfstate;\sandboxtag;m;\memstate}{stuck}{\lightning;\sandboxtag;\unlock}
%   }{to-e-abort}
% }{to-expr-eval-1}{Evaluation of $\mmlAtscct$ expressions, continued.}

% \myfig{
%   \typerule{$e-\ird{\pi_1}$}{
%   }{
%     \exprevalo{\Omega}{\pi_1\langle n_1^\sigma;n_2^{\sigma'}\rangle}{\Omega}{n_1^\sigma}{\emptyevent}
%   }{to-e-proj1}
%   %
%   \typerule{$e-\ird{\pi_2}$}{
%   }{
%     \exprevalo{\Omega}{\pi_2\langle n_1^\sigma;n_2^{\sigma'}\rangle}{\Omega}{n_2^{\sigma'}}{\emptyevent}
%   }{to-e-proj2}
%   %
%   \typerule{$e-\ird{x\ is\ \poisoned}-$yes}{
%     \ird{\memstate}=\ird{H^{\ctx};H^{\comp};\Delta} &
%     \ird{\Delta}=\ird{\Delta_1,x\mapsto(\loc;\sandboxtag;\poisoned;n),\Delta_2}
%   }{
%     \exprevalo{\cfstate;\sandboxtag';m;\memstate}{x^\sigma\ is\ \poisoned}{\cfstate;\sandboxtag';m;\memstate}{0^\unlock}{\emptyevent}
%   }{to-e-x-is-poisoned-yes}
%   %
%   \typerule{$e-\ird{x\ is\ \poisoned}-$no}{
%     \ird{\memstate}=\ird{H^{\ctx};H^{\comp};\Delta} &
%     \ird{\Delta}=\ird{\Delta_1,x\mapsto(\loc;\sandboxtag;\poisonless;n),\Delta_2}
%   }{
%     \exprevalo{\cfstate;\sandboxtag';m;\memstate}{x^\sigma\ is\ \poisoned}{\cfstate;\sandboxtag';m;\memstate}{1^\unlock}{\emptyevent}
%   }{to-e-x-is-poisoned-no}
%   %
%   \typerule{$e-\ird{n\ has\ \nat}$}{
%   }{
%     \exprevalo{\Omega}{n^\sigma\ has\ \nat}{\Omega}{0^\unlock}{\emptyevent}
%   }{to-e-n-hasnat}
%   %
%   \typerule{$e-pair-\ird{has\ \nat}$}{
%   }{
%     \exprevalo{\Omega}{\langle n_1^\sigma,n_2^{\sigma'}\rangle\ has\ \nat}{\Omega}{1^\unlock}{\emptyevent}
%   }{to-e-pair-hasnat}
%   %
%   \typerule{$e-\ird{x\ has\ \nat}$}{
%   }{
%     \exprevalo{\Omega}{x^\sigma\ has\ \nat}{\Omega}{1^\unlock}{\emptyevent}
%   }{to-e-x-hasnat}
%   %
%   \typerule{$e-\ird{n\ has\ \nat\times\nat}$}{
%   }{
%     \exprevalo{\Omega}{n^\sigma\ has\ \nat\times\nat}{\Omega}{1^\unlock}{\emptyevent}
%   }{to-e-n-haspair}
%   %
%   \typerule{$e-pair-\ird{has\ \nat\times\nat}$}{
%   }{
%     \exprevalo{\Omega}{\langle n_1^\sigma,n_2^{\sigma'}\rangle\ has\ \nat\times\nat}{\Omega}{0^\unlock}{\emptyevent}
%   }{to-e-pair-haspair}
%   %
%   \typerule{$e-\ird{x\ has\ \nat\times\nat}$}{
%   }{
%     \exprevalo{\Omega}{x^\sigma\ has\ \nat\times\nat}{\Omega}{1^\unlock}{\emptyevent}
%   }{to-e-x-haspair}
%   %
%   \typerule{$e-\ird{setDIT\ n}$}{
%   }{
%     \exprevalo{\cfstate;\sandboxtag;m;\memstate}{setDIT\ n^\sigma}{\cfstate;\sandboxtag;n;\memstate}{n^\sigma}{\emptyevent}
%   }{to-e-setDIT}
%   %
%   \typerule{$e-\ird{getDIT\ x\ in\ e}$}{
%   }{
%     \exprevalo{\cfstate;\sandboxtag;n;\memstate}{getDIT\ x^\sigma\ in\ e}{\cfstate;\sandboxtag;n;\memstate}{e[n^\sigma/x]}{\emptyevent}
%   }{to-e-getDIT}
% }{to-expr-eval-2}{Evaluation of $\mmlAo$ expressions, continued.}

% \myfig{
%   \begin{center}
%     \judgbox{\execo[]{\Omega}{K[e]}{\Omega'}{K[e']}{\event}}{,,Given an evaluation context $\ird{K}$ and an expression\\ $\ird{e}$, it evaluates under configuration $\Omega$ to $\ird{e'}$ and new\\configuration $\ird{\Omega'}$ in context $\ird{K}$, emitting event $\ird{\event}$.''}
%     %
%     \typerule{$e-\text{ctx}$}{
%       \exprevalo{\Omega}{e}{\Omega'}{e'}{\event}
%     }{
%       \execo[]{\Omega}{K[e]}{\Omega'}{K[e']}{\event}
%     }{to-e-ectx}
%     %
%     \typerule{$e-\text{ctx}-\ird{stuck}$}{
%       \exprevalo{\Omega}{e}{\Omega'}{stuck}{\lightning}
%     }{
%       \execo[]{\Omega}{K[e]}{\Omega'}{stuck}{\lightning}
%     }{to-e-ectx-stuck}
%     %
%     \typerule{$e-\text{ctx}-\ird{call}-$main}{
%       \ird{\Omega}=\ird{\commlib;\library;\hole{\cdot};\comp;0;\memstate} &
%       \ird{\library}=\ird{\library_1,}(\ird{let\ main\ x:\type}_\lambda\ird{:=e})\ird{,\library_2}\\
%       \ird{\Omega'}=\ird{\commlib;\library;K^{main},\hole{\cdot};\ctx;0;\memstate}
%     }{
%       \execo[]{\Omega}{K[call\ main^\sigma\ \valueexpr^{\sigma'}]}{\Omega'}{e[\valueexpr^{\sigma'}/x]}{Start;\comp;\sigma'}
%     }{to-e-ectx-call-main}
%     %
%     \typerule{$e-\text{ctx}-\ird{call}-\text{notsame}$}{
%       \ird{\Omega}=\ird{\commlib;\library;\kontstack;\sandboxtag;m;\memstate} &
%       \ird{\library}=\ird{\library_1,}(\ird{let\ foo\ x:\type}_\lambda\ird{:=e})\ird{,\library_2} \\
%       %\rho_{\tiny call}(\ird{\commlib},\ird{foo},\ird{\kontstack},\ird{v}) = \ird{\event},\ird{\comm} &
%       \ird{foo}\in_{\ird{\neg\sandboxtag}}\ird{\commlib} &
%       \rho\left(\ird{\neg\sandboxtag}\right) = \ird{\comm} &
%       \ird{\Omega'}=\ird{\commlib;\library;K^{foo},\kontstack;\neg\sandboxtag;m;\memstate} \\
%     }{
%       \execo[]{\Omega}{K[call\ foo^\sigma\ \valueexpr^{\sigma'}]}{\Omega'}{e[\valueexpr^{\sigma'}/x]}{Call\ \comm\ foo\ \valueexpr;\sandboxtag;\sigma'}
%     }{to-e-ectx-call-notsame}
%     %
%     \typerule{$e-\text{ctx}-\ird{call}-\text{same}$}{
%       \ird{\Omega}=\ird{\commlib;\library;\kontstack;\sandboxtag;m;\memstate} &
%       \ird{\library}=\ird{\library_1,}(\ird{let\ foo\ x:\type}_\lambda\ird{:=e})\ird{,\library_2} \\
%       %\rho_{\tiny call}(\ird{\commlib},\ird{foo},\ird{\kontstack},\ird{v}) = \ird{\event},\ird{\comm} &
%       \ird{foo}\in_{\ird{\sandboxtag}}\ird{\commlib} &
%       \ird{\Omega'}=\ird{\commlib;\library;K^{foo},\kontstack;\sandboxtag;m;\memstate} \\
%     }{
%       \execo[]{\Omega}{K[call\ foo^\sigma\ \valueexpr^{\sigma'}]}{\Omega'}{e[\valueexpr^{\sigma'}/x]}{Call\ \nocomm\ foo\ \valueexpr;\sandboxtag;\sigma'}
%     }{to-e-ectx-call-same}
%     %
%     \typerule{$e-\text{ctx}-\ird{return}-$main}{
%     }{
%       \exec[]{\ird{\commlib;\library;\hole{\cdot}^{main},\hole{\cdot};\ctx;m;\memstate}}{\ird{K'[return\ \valueexpr^\sigma]}}{\ird{\commlib;\library;\hole{\cdot};\comp;1;\memstate}}{\ird{\valueexpr^\sigma}}{\ird{End\ \valueexpr;\sandboxtag;\sigma}}
%     }{to-e-ectx-ret-main}
%     %
%     \typerule{$e-\text{ctx}-\ird{return}-\text{notsame}$}{
%       \ird{foo}\in_{\ird{\neg\sandboxtag}}\ird{\commlib} &
%       \rho\left(\ird{\neg\sandboxtag}\right) = \ird{\comm;\sandboxtag}
%     }{
%       \exec[]{\ird{\commlib;\library;K^{foo},\kontstack;\sandboxtag;m;\memstate}}{\ird{K'[return\ \valueexpr^\sigma]}}{\ird{\commlib;\library;\kontstack;\neg\sandboxtag;m;\memstate}}{\ird{K[\valueexpr^\sigma]}}{\ird{Ret\ \comm\ \valueexpr;\sandboxtag;\sigma}}
%     }{to-e-ectx-ret-notsame}
%     %
%     \typerule{$e-\text{ctx}-\ird{return}-\text{same}$}{
%       \ird{foo}\in_{\ird{\sandboxtag}}\ird{\commlib}
%     }{
%       \exec[]{\ird{\commlib;\library;K^{foo},\kontstack;\sandboxtag;m;\memstate}}{\ird{K'[return\ \valueexpr^\sigma]}}{\ird{\commlib;\library;\kontstack;\sandboxtag;m;\memstate}}{\ird{K[\valueexpr^\sigma]}}{\ird{Ret\ \nocomm\ \valueexpr;\sandboxtag;\sigma}}
%     }{to-e-ectx-ret-same}
%     %
%     \judgbox{\rho(\ird{\sandboxtag})=\ird{\comm}}{,,Returns either $\ird{\ctxtocomp}$ or $\ird{\comptoctx}$ depending on $\ird{\sandboxtag}$.''}\\
%     %
%     \typerule{comm-ctxtocomp}{
%     }{
%       \rho(\ird{\ctx})=\ird{\ctxtocomp}
%     }{to-comm-ctxtocomp}
%     %
%     \typerule{comm-comptoctx}{
%     }{
%       \rho(\ird{\comp})=\ird{\comptoctx}
%     }{to-comm-comptoctx}\\[0.33cm]
%     %
%     \judgbox{\ird{\neg\sandboxtag}=\ird{\sandboxtag'}}{,,Negation of $\ird{\sandboxtag}$.''}\\
%     %
%     \typerule{neg-ctx}{
%     }{
%       \ird{\neg\ctx}=\ird{\comp}
%     }{to-neg-ctx}
%     %
%     \typerule{neg-comp}{
%     }{
%       \ird{\neg\comp}=\ird{\ctx}
%     }{to-neg-comp}
%   \end{center}
% }{w-o-expr-ctx-eval}{Contextual Evaluation of $\mmlAtscct$ expressions.}

% \myfig{
%   \begin{center}
%     \judgbox{\execo{\Omega}{e}{\Omega'}{e'}{\trace}}{,,Expression $\ird{e}$ evaluates under configuration $\ird{\Omega}$ to $\ird{e'}$ and\\new configuration $\ird{\Omega'}$, emitting list of events $\ird{\trace}$.''}
%     %
%     \typerule{$et-\text{refl}$}{
%     }{
%       \execo{\Omega}{\finalexpr}{\Omega}{\finalexpr}{\hole{\cdot}}
%     }{wo-e-refl}
%     \typerule{$et-\text{trans}-$important}{
%       \execo[]{\Omega}{e}{\Omega'}{e'}{\event}&
%       \execo{\Omega'}{e'}{\Omega''}{e''}{\trace}&
%       \ird{a}\not=\ird{\emptyevent}
%     }{
%       \execo{\Omega}{e}{\Omega''}{e''}{\event \cdot \trace}
%     }{wo-e-trans-important}
%     \typerule{$et-\text{trans}-$unimportant}{
%       \execo[]{\Omega}{e}{\Omega'}{e'}{\emptyevent}&
%       \execo{\Omega'}{e'}{\Omega''}{e''}{\trace}&
%     }{
%       \execo{\Omega}{e}{\Omega''}{e''}{\trace}
%     }{wo-e-trans-unimportant}
%     %
%     %
%     \judgbox{\execoN{\Omega}{e}{\Omega'}{e'}{\trace}}{,,Expression $\ird{e}$ evaluates in $n$ steps under configuration $\ird{\Omega}$ to\\$\ird{e'}$ and new configuration $\ird{\Omega'}$, emitting list of events $\ird{\trace}$.''}
%     %
%     \typerule{$en-\text{refl}$}{
%     }{
%       \execoN[^0]{\Omega}{e}{\Omega}{e}{\emptyevent}
%     }{won-e-refl}
%     %
%     \typerule{$en-\text{trans}-$important}{
%       \execo[]{\Omega}{e}{\Omega'}{e'}{\event} &
%       \execoN[^n]{\Omega'}{e'}{\Omega''}{e''}{\trace} &
%       \ird{\event}\not=\ird{\emptyevent}
%     }{
%       \execoN[^{(n+1)}]{\Omega}{e}{\Omega''}{e''}{\event\cdot\trace}
%     }{won-e-trans-important}
%     %
%     \typerule{$en-\text{trans}-$unimportant}{
%       \execo[]{\Omega}{e}{\Omega'}{e'}{\emptyevent} &
%       \execoN[^n]{\Omega'}{e'}{\Omega''}{e''}{\trace} &
%     }{
%       \execoN[^{(n+1)}]{\Omega}{e}{\Omega''}{e''}{\trace}
%     }{won-e-trans-unimportant}
%   \end{center}
% }{wo-steps}{Trace prefix generation given a $\mmlAtscct$ program using the reflexive-transitive closure.}

% \myfig{
%   \begin{center}
%     \judgbox{\wexeco{prog\ \library_{ctx}\ \library_{comp}}{\Omega}{\finalexprnoerr}{\trace}}{,,Run $\mmlAtscct$ program $\ird{prog\ \library_{ctx}\ \library_{comp}}$, giving\\dynamic state $\ird{\Omega}$ and emitting trace $\ird{\trace}$.''}
%     \typerule{$e-\text{wprog}$}{
%       \ird{\library}=\ird{\library_{ctx}\linker\library_{comp}} &
%       \ird{main}\notin\ird{\commlib} &
%       \ird{\commlib}=\operatorname{dom}\ \ird{\library_{comp}} \\
%       \execo{\commlib;\library;\hole{\cdot};\sandboxtag;1;\hole{\cdot};\hole{\cdot};\hole{\cdot}}{call\ main\ 0}{\Omega}{\finalexpr}{\trace}
%     }{
%       \wexeco{prog\ \library_{ctx}\ \library_{comp}}{\Omega}{\finalexpr}{\trace}
%     }{wo-e-prog}
%     %
%     \typerule{$e-\text{wprog}-\lightning$}{
%       \ird{\library}=\ird{\library_{ctx}\linker\library_{comp}} &
%       \ird{main}\notin\ird{\commlib} &
%       \ird{\commlib}=\operatorname{dom}\ \ird{\library_{comp}} \\
%       \execo{\commlib;\library;\hole{\cdot};\sandboxtag;1;\hole{\cdot};\hole{\cdot};\hole{\cdot}}{call\ main\ 0}{\Omega}{\finalexpr}{\trace\cdot\lightning;\sandboxtag}
%     }{
%       \wexeco{prog\ \library_{ctx}\ \library_{comp}}{\Omega}{\finalexpr}{\trace\cdot\lightning;\sandboxtag}
%     }{wo-e-prog-crash}
%   \end{center}
% }{toprog-run}{Running a whole $\mmlAtscct$ program.}
 Rest similar to \cite{exorcisingSpectres}.

\subsection{Robustly Preserving $\specsafe$}

\subsubsection{Compiler}

\myfig{
  \begin{center}
    \begin{gather*}
    \judgbox{\mmlAtscctmmlAspeccomp{e}=\ird{e'}}{,,Compile $\mmlAtscct$ expression $\obj{e}$ to $\mmlAspec$ expression $\ird{e'}$.''}\\
    \judgbox{\mmlAtscctmmlAspeccomp{\left[\valueexpr / x\right]}=\ird{\left[\valueexpr / x\right]}}{,,Compile $\mmlAtscct$ substitution to $\mmlAspec$ substitution.''} \\
    \judgbox{\mmlAtscctmmlAspeccomp{\commlib}=\ird{\commlib'}}{,,Compile $\mmlAtscct$ component library to $\mmlAspec$ component library.''} \\
    \end{gather*}
    $$
    \begin{array}{rll}
    \mmlAtscctmmlAspeccomp{\finalexpr} &\ = & \ird{\finalexpr} \\
    \mmlAtscctmmlAspeccomp{call\ foo\ e} &\ = & \ird{call\ }\mmlAtscctmmlAspeccomp{foo}\ \mmlAtscctmmlAspeccomp{e}\\
    \mmlAtscctmmlAspeccomp{return\ e} &\ = & \ird{return\ }\mmlAtscctmmlAspeccomp{e}\\
    \mmlAtscctmmlAspeccomp{e_1\oplus e_2} &\ = & \mmlAtscctmmlAspeccomp{e_1} \ird{\oplus} \mmlAtscctmmlAspeccomp{e_2} \\
    \mmlAtscctmmlAspeccomp{x[e]} &\ = & \ird{x[}\mmlAtscctmmlAspeccomp{e}\ird{]} \\
    \mmlAtscctmmlAspeccomp{let\ x= e_1\ in\ e_2} &\ = & \ird{let\ x=} \mmlAtscctmmlAspeccomp{e_1}\ird{\ in\ }\mmlAtscctmmlAspeccomp{e_2} \\
    \mmlAtscctmmlAspeccomp{x[e_1]\leftarrow e_2} &\ = & \ird{x[}\mmlAtscctmmlAspeccomp{e_1}\ird{]\leftarrow} \mmlAtscctmmlAspeccomp{e_2} \\
    \mmlAtscctmmlAspeccomp{let\ x=new\ e_1\ in\ e_2} &\ = & \ird{let\ x=new\ }\mmlAtscctmmlAspeccomp{e_1}\ird{\ in\ }\mmlAtscctmmlAspeccomp{e_2} \\
    \mmlAtscctmmlAspeccomp{delete\ x} &\ = & \ird{delete\ x} \\
    \mmlAtscctmmlAspeccomp{x\ is\ \poisoned} &\ = & \ird{x\ is\ \poisoned} \\
    \mmlAtscctmmlAspeccomp{\lparen e_1;e_2\rparen} &\ = & \ird{\lparen}\mmlAtscctmmlAspeccomp{e_1}\ird{;}\mmlAtscctmmlAspeccomp{e_2}\ird{\rparen}\\
    \mmlAtscctmmlAspeccomp{\pi_1\ e} &\ = & \ird{\pi_1\ }\mmlAtscctmmlAspeccomp{e}\\
    \mmlAtscctmmlAspeccomp{\pi_2\ e} &\ = & \ird{\pi_2\ }\mmlAtscctmmlAspeccomp{e}\\
    \mmlAtscctmmlAspeccomp{e\ has\ \type} &\ = & \mmlAtscctmmlAspeccomp{e}\ \ird{has\ \type}\\
    \mmlAtscctmmlAspeccomp{ifz\ e_1\ then\ e_2\ else\ e_3} &\ = & \ird{ifz\ }\mmlAtscctmmlAspeccomp{e_1}\\
                                                        &&\ird{then\ barrier;}\mmlAtscctmmlAspeccomp{e_2} \\
                                                        &&\ird{else\ barrier;}\mmlAtscctmmlAspeccomp{e_3} \\[0.5cm]
    %
    \mmlAtscctmmlAspeccomp{\left[\valueexpr/x\right]}&\ = & \ird{\left[\right.}\mmlAtscctmmlAspeccomp{v}\ird{/}\mmlAtscctmmlAspeccomp{x}\ird{\left.\right]} \\[0.5cm]
    %
    \mmlAtscctmmlAspeccomp{\hole{\cdot}}&\ = & \ird{\hole{\cdot}} \\
    \mmlAtscctmmlAspeccomp{foo,\commlib}&\ = & \ird{foo,}\mmlAtscctmmlAspeccomp{\commlib} \\
    \end{array}
    $$
  \end{center}
}{scct-pres-compiler}{Compiler from $\mmlAtscct$ to $\mmlAspec$.}
\myfig{
  \begin{center}
    \begin{gather*}
    \judgbox{\mmlAtscctmmlAspeccomp{F}=\ird{F}}{,,Compile $\mmlAtscct$ procedures to $\mmlAspec$ procedures.''}
    \end{gather*}
    $$
    \begin{array}{rll}
    %
      \mmlAtscctmmlAspeccomp{let\ foo\ x := e}&\ = & \mmlAtscctmmlAspeccomp{e}\\
    \end{array}
    $$
    \begin{gather*}
    \judgbox{\mmlAtscctmmlAspeccomp{\library}=\ird{\library}}{,,Compile $\mmlAtscct$ libraries to $\mmlAspec$ libraries.''}
    \end{gather*}
    $$
    \begin{array}{rll}
      \mmlAtscctmmlAspeccomp{\hole{\cdot}}&\ = & \ird{\hole{\cdot}} \\
      \mmlAtscctmmlAspeccomp{F,\library}&\ = & \mmlAtscctmmlAspeccomp{F}\obj{,}\mmlAtscctmmlAspeccomp{\library} \\
    \end{array}
    $$
  \end{center}
}{scct-pres-compiler-comp}{Compiler from $\mmlAtscct$ components to $\mmlAspec$ components.}

\begin{scontents}[store-env=buffer]
  $\;$\\
  \begin{goals}
    \item $\vdash\mmlAtscctmmlAspeccomp{\bullet}:\lceil\specsafe\rceil$
  \end{goals}
\end{scontents}
\realthm{thm:rssp}{9}{Robust Speculative Safety Preservation}
\begin{incompleteproof}
  Analogous to \Cref{thm:rscctp}.
\end{incompleteproof}

\begin{scontents}[store-env=buffer]
  $\;$\\
  \begin{goals}
  \item $\vdash\mmlAtscctmmlAspeccomp{\color{black}\mmlAtmsmmlAtscctcomp{\color{black}\mmlAtmmlAtmscomp{\color{black}\mmlAmmlAtcomp{\bullet}}}}:\lceil\operatorname{msafe}\rceil\cap\lceil\operatorname{sCCT}\rceil\cap\lceil\specsafe\rceil$
  \end{goals}
\end{scontents}
\realthm{thm:rmsscctssp}{10}{Robust Memory Safety, Strict Cryptographic Constant Time, and Speculation Safety Preservation}
\begin{proof}
  By \Thmref{lem:seqcompo}, \Thmref{thm:rmsp}, \Thmref{thm:rscctp}, and \Thmref{thm:rssp}.
\end{proof}

\clearpage

\bibliographystyle{plain}
\bibliography{library}

\end{document}