Classifying Topoi in Synthetic Guarded Domain Theory The Universal Property of Multi-clock Guarded Recursion

Several diﬀerent topoi have played an important role in the development and applications of synthetic guarded domain theory (SGDT), a new kind of synthetic domain theory that abstracts the concept of guarded recursion frequently employed in the semantics of programming languages. In order to unify the accounts of guarded recursion and coinduction, several authors have enriched SGDT with multiple “clocks” parameterizing diﬀerent time-streams, leading to more complex and diﬃcult to understand topos models. Until now these topoi have been understood very concretely qua categories of presheaves, and the logico-geometrical question of what theories these topoi classify has remained open. We show that several important topos models of SGDT classify very simple geometric theories, and that the passage to various forms of multi-clock guarded recursion can be rephrased more compositionally in terms of the lower bagtopos construction of Vickers and variations thereon due to Johnstone. We contribute to the consolidation of SGDT by isolating the universal property of multi-clock guarded recursion as a modular construction that applies to any topos model of single-clock guarded recursion.


Synthetic guarded domain theory
Beginning with Scott and Strachey's groundbreaking investigations in 1969, the scientific study of programming semantics has been guided by the search for a topology of computation -embodied in monoidal closed categories of spaces called domains whose points can be thought of as the values of datatypes and computer programs [47,48,49,50].The thesis of denotational semantics under Scott and Strachey is that the computational behavior of expressions in a programming language can be studied by characterizing what values they take when interpreted as continuous functions between domains; the advantage of denotational semantics over the direct/operational study of program behavior is that, unlike the latter, it is compositional and amenable to mathematical methods of reduction and abstraction.
The need to reason about increasingly complex programming languages has drawn researchers toward alternative theories of domains based on (complete, bounded, ultra-) metric spaces [37,1,46,17,8].Metric domain theory has proved instrumental in untangling the circularities of programming language semantics involving higher-order store [9]; categories of metric spaces come equipped with a pointed endofunctor 1  2 • − to scale a given space by half, which in combination with Banach's fixed point theorem can be used to prove algebraic compactness relative to mixed-variance endofunctors whose recursive variables are guarded by 1  2 • −.From this one obtains a relatively simple interpretation of both recursive types and programs.Ideas from metric domain theory have been later simplified and generalized to categories of sheaves on frames with well-founded bases and the even simpler case of presheaves on well-founded posets [6], allowing for a synthetic and topos-theoretic approach to guarded domain theory along the lines of synthetic domain theory [28] or synthetic differential geometry [35].The core idea of synthetic guarded domain theory (SGDT) is to work with a topos S that is equipped with an endofunctor called the later modality , together with a natural transformation next : id S and a "guarded" fixed point operator − † ensuring that for each f : A A, there exists a unique f † : 1 S A such that f • next A • f † = f † .Under mild assumptions (e.g.left exactness of ), it can be seen that extends to an endofunctor on the fundamental fibration P S S and therefore gives rise to a true connective in the internal dependent type theory of S. Synthetic guarded domain theory has been employed as a metalanguage for the denotational and operational semantics of simple programming languages such as PCF and FPC [45,41,44]; the models of op.cit.can be seen as synthetic versions of Escardó's "analytic" metric model of PCF [24].Synthetic guarded domain theory also provides the mathematical basis [11] for Iris, a higher-order guarded separation logic that has been used to develop operationally-based program logics for sophisticated programming languages involving higher-order store, concurrency, and a number of other computational effects [33,32].

Multi-clock guarded recursion and coinduction
Unlike both classical and ordinary synthetic domain theory, the synthetic guarded domain theory is effective in the sense that it gives rise to type theories satisfying the canonicity property [26]; this means that synthetic guarded domain theory is a programming language in addition to a semantic universe for denotational semantics.One early application of guarded recursion in this sense was to provide a more ergonomic and compositional method to write programs involving coinductive types or final coalgebras.
Consider the type of infinite streams SA as an example; this type is the final coalgebra for the endofunctor F A X = A × X, and because F A is ω-cocontinuous we may compute SA as the limit of the ω-chain F n A 1 ∼ = A n by Adámek's theorem.A stream producer α : X SA must therefore decompose into a cone of finite approximations α n : X A n for all n ∈ ω; in simpler terms, we must be able to compute any finite approximation of a stream.It is not difficult to imagine programming partial functions on streams β : SA SB by general recursion; such a programming style is easily supported in languages like Haskell.But what is the appropriate linguistic construct for defining total functions β : SA SB? Just as in the dual case for inductive data, a programming language must verify that recursive calls are justified and reject any recursive calls that would make (for instance) the projections β n : SA B n ill-defined.One method to ensure that recursive functions on coinductive types are total is to impose a syntactic guardedness check: every recursive call must be wrapped in a call to a constructor.Syntactic guardedness checks are employed in several type theoretic languages, such as Agda [43], Coq [22], and Idris [15,16], but they are unfortunately very brittle and not at all conducive to compositional and modular programming with higher-order functions.Type-based approaches such as sized types have been proposed as a more compositional alternative to syntactic checks [27], but the meaning of sized types as they are used in practice remains poorly understood -for instance, the version of sized types implemented in Agda is clearly inconsistent as it asserts the well-foundedness of an order with ∞ ≺ ∞; yet it remains unclear whether many sized Agda programs would survive the transition to a system in which ∞ ≺ ∞. 1A sound and thus more promising type-based approach to ensuring the guardedness of recursive calls arises from the later modality , first viewed as a programming construct by Nakano [42]. 2 The idea is to approximate the coinductive type SA ∼ = A × SA by the guarded recursive type S A ∼ = A × S A: Palombi and Sterling

12-3
The guarded fixed point operator then allows recursive definitions of functions on guarded streams, with the caveat that recursive calls must appear underneath the later modality.While this semantic / type-based restriction does automatically ensure totality, it is too conservative: we cannot, for instance, define the projection functions S A → A n .For instance, the following attempted definition is not well-typed:

Atkey and McBride's clock-indexed guarded recursion
At the heart of the problem discussed above is the fact that the guarded streams only approximate the coinductive streams.The remarkable suggestion of Atkey and McBride [3] is to define real coinductive types in terms of their guarded approximations by adding an additional notion of clock to the language; with this combination of features, arbitrary functions on coinductive types can be defined using guarded recursion.In the setting of Atkey and McBride, the later modality ensures that functions are welldefined and the clocks allow the later modality to be removed in a type-constrained way.The language of Atkey and McBride contains a new sort of clocks k, together with a clock-indexed family of later modalities k as well as a clock quantifier ∀k.A[k].In the case where A does not depend on the clock variable k, a clock irrelevance principle is asserted stating that A = ∀k.A; finally the canonical map is asserted to have an inverse force.A clock can be thought of metaphorically as a "time stream"; thus an element of ∀k.k A exhibits an element of k A in all time streams k; thus under this metaphor, the force operation simply instantiates this family at an earlier time stream to obtain an element of A. With the clock-indexed later modality in hand, it is now possible to define coinductive streams in terms of their guarded approximations by setting SA := ∀k.S k A; thus we may use guarded recursion to define the take function on coinductive streams: 1.2.2Bizjak and Møgelberg's clock synchronization; Sterling and Harper's variant One aspect of Atkey and McBride's clocks that has proved difficult to account for in a well-behaved way is that the substitution of clock variables is restricted to avoid identifying "time streams" within types: to be precise, arbitrary substitutions [k /k] are permitted in terms, but a substitution in a type is only permitted when it does not cause two distinct clocks to be identified.To implement this restriction, a somewhat bizarre side condition on the instantiation rule for ∀k.A[k] is needed, which unfortunately appears to preclude the generalization of Atkey and McBride's clocks to the dependently typed setting, pace a worthy attempt by Møgelberg [40] which was thwarted by the failure of the substitution lemma.
Bizjak and Møgelberg [13] subsequently resolved these difficulties in 2015 by simply removing the restriction on clock substitution entirely: to substantiate this simplified language, they construct a fibered presheaf model that supports diagonal substitutions of clocks, which they refer to as clock synchronization.With synchronization in place, there were two remaining problems left unresolved by op.cit.: (i) the fibered character of the model caused coherence problems that impede the interpretation of the syntax of dependent type theory; (ii) also missing was the clock irrelevance principle, which should at a minimum ensure that the canonical map A ∀k.A is an isomorphism for any type A that doesn't depend on k.
A solution to the coherence problem was found in 2017 by Sterling and Harper [52], who employed the Grothendieck construction to replace the fibered presheaf model by an equivalent ordinary presheaf model.
Sterling and Harper also addressed clock irrelevance in two steps: first, they interpreted the clock quantifier ∀k as an intersection type in an internal realizability model;3 then they ensured that this intersection is non-trivial by forcing the proposition ∃k. in the ambient topos.Around the same time, Bizjak and Møgelberg [14] returned to the clock synchronization model with an analogous solution to the coherence problem and a more general approach to clock irrelevance: the quantifier ∀k remains a dependent product, but they restrict the language to types that are orthogonal to the object of clock names.The solution of Bizjak and Møgelberg is more broadly applicable than that of Sterling and Harper because intersection need not be meaningful in an arbitrary category whereas products have a very simple universal property.

Goals and structure of this paper
Most models of single-clock synthetic guarded domain theory are given by presheaf topoi; the models of multi-clock synthetic guarded domain theory are also taken in presheaves, but of a different kind than the single-clock version.Thus the work of [3,13,14,52] on multi-clock guarded recurison raises two questions concerning the relationship between the existing models of single-clock and multi-clock guarded recursion: (i) Does the passage from single-clock to multi-clock topos models have a universal property?(ii) Can the multi-clock model be rephrased as a special case of the single-clock model of SGDT?
In this paper we answer both questions positively.Each multi-clock topos can be seen to be a partial product or bagtopos [55,29,30] for a certain cocartesian fibration of topoi applied at a given model of singleclock guarded recursion as hinted by Sterling [51, §2.2.6]; moreover we show that the model of synthetic guarded domain theory in the multi-clock setting is an instance of the single-clock model generalized to the relative Grothendieck topos theory over a given elementary topos S. Thus we have contributed a completely modular toolkit for negotiating the two orthogonal axes of variation in multi-clock synthetic guarded domain theory: the properties of the object of clocks, and the properties of each later modality k .

Structure of this paper
In Section 2, we introduce the topos and category theory that is needed for our technical development.As relative topos theory plays an important role in our work, we pay special attention to it.In Section 3, we define elementary axioms for both single-clock and multi-clock synthetic guarded domain theory in a topos, and we contribute a toolkit for constructing and transforming models of both.
(i) In Sections 3.3 and 3.4 we show that synthetic guarded domain theory is stable under both presheaves and localization, hence any bounded geometric morphism into a topos model of SGDT lifts this model into its domain.(ii) In Section 3.5 we generalize the results of Birkedal et al .[6] by constructing models of SGDT in sheaves on frames with a well-founded basis over an arbitrary base topos with a natural numbers object.This generalization requires a subtle change to the definition of well-founded poset, as well as new constructive proofs of the existence of term-level guarded fixed points.
In Section 4 we provide an explicit description of the geometric theories that extant presheaf models of single-clock guarded recursion classify.In Section 5 we give a general construction of a multi-clock model from a single-clock model using the bagtopoi of Vickers [55]: in particular, a multi-clock topos classifies the theory of a "bag" or "multi-set" of points of the corresponding single-clock topos.Our characterization thus provides a geometrical universal property for multi-clock guarded recursion as a model construction on topoi, and as an explicit transformation of geometric theories.Finally in Section 6, we use these new universal properties to give a new and more abstract proof that the multi-clock topoi are in fact models of synthetic guarded domain theory in each clock.
Because the topic of the present paper is logico-geometric duality in guarded domain theory, we are careful to distinguish the spatial aspects of topoi from the logical ones in both our terminology and notations.Similar conventions are employed by Vickers [56], Bunge and Funk [21], and Anel and Joyal [2].Definition 2.1.A geometric universe 4 is a cartesian closed category E that has finite limits, a subobject classifier Ω, and a natural numbers object N. A morphism F : E F of geometric universes is given by a left exact functor ∆ We will write GU for the meta-2-category of all geometric universes.
Definition 2.2.A left exact localization of a geometric universe S is defined to be a morphism L : S T of geometric universes such that the right adjoint functor Γ L : T S is fully faithful.
Definition 2.3.A topos over a geometric universe S is defined to be a geometric universe S X equipped with a structure morphism X : S S X of geometric universes such that the gluing fibration S g such that the following wiring diagrams are equal (denote the same 2-cell): Classifying Topoi in Synthetic Guarded Domain Theory We will write Top S for the meta-2-category of S-topoi for a geometric universe S. We will write Log S = Top • S for the meta-2-category obtained by reversing the 1-cells but not the 2-cells; we refer to an object of Log S as an S-logos.Given a topos X, we may think of the dual logos S X as the category of S-valued sheaves on the space X.Indeed, the relative Giraud theorem states that the logos S X can be equivalently presented as a left exact localization of a category of internal diagrams [C, S] for some internal category C in S.

Geometric theories and classifying topoi
The notion of geometric theory elucidates the relationship between topoi and logoi.There are several possible notions of geometric theory over S; for the sake of this paper, we choose a particularly syntactical one.Informally a geometric theory over S is given by a collection of sorts σ and predicates x : σ | φ(x), together with a collection of sequents x : σ | φ(x) ψ(x) in which φ, ψ are defined using I , n , ∃, ∃!, = where I ranges over an object of S. To be precise, all these collections are parameterized in objects of S, so the correct category of geometric theories arises as a fibration Thy S S whose fiber at J ∈ S is the category of J-indexed families of geometric theories with morphisms given by translations of sorts, operations, and derivable sequents.In practice, all these notions are conveniently manipulated in the internal type theory of S.
Construction 2.4.The free finite product completion C × of any internal S-category C can be computed explicitly in the internal language of S as follows: (i) an object Ψ ∈ C × is a finite S-cardinal 5 |Ψ| together with a "type assignment" We will write − : C C × for the functor sending an object to the corresponding unary product.
Example 2.5.The theory of an object ob over S has a single sort K, no operations, and no axioms.To be more formal, the sorts of ob are parameterized by the terminal object 1 S ∈ S and the operations and axioms are parameterized by the initial object ∅ S ∈ S. Letting O = 1 × be the free internal S-category with finite products generated by a single object, then S [ob] is the category of S-valued presheaves on O.
Example 2.6.The theory of a pointed object el over S has a single sort K, a single constant k : K, and no axioms.Recalling O from Example 2.5, then S [el] is the category of S-valued presheaves on O ↓ * .

Morphisms of topoi as relative topoi
Let γ : E B be a morphism of S-topoi.In other words, we have morphisms E : S S E , B : S S B , S γ : S B S E , and an isomorphism φ γ : E B; S γ as in the following wiring diagram: Forgetting the rest of the structure, the morphism S γ : S B S E of geometric universes also exhibits S E as the geometric universe underlying a S B -topos [31,Lemma B3.1.10(ii)].In this scenario, we shall write E γ : S B S E = S Eγ for this S B -topos.This perspective allows us to take any property P of topoi, e.g.local connectedness, and rephrase it as a property of morphisms of topoi by viewing the morphism as a topos over a different base geometric universe: Convention 2.7 (Relative point of view).A morphism γ : E B of S-topoi is said to have property P if E γ has property P when viewed as a S B -topos.

Internal presheaves, algebraic topoi, algebraic morphisms
Let C be an internal category in a geometric universe S; we may consider the category Pr S C of S-valued presheaves on C. The constant presheaves functor C : S Pr S C is then an S-topos with S C = Pr S C; following the terminology of Vickers [56] and Johnstone [29] we will refer to any S-topos equivalent to one of the form C as a algebraic S-topos. 6Thus: Definition 2.8 (Algebraic topos).An S-topos X is called algebraic when there exists an internal category C ∈ S and an equivalence of S-topoi X C.
Employing Convention 2.7 we generalize Definition 2.8 to morphisms of topoi. 7  Definition 2.9 (Algebraic morphism).A morphism β : E B of S-topoi is likewise called algebraic when E β is an algebraic S B -topos, i.e. there exists an internal category C ∈ S B such that there exists an equivalence of S B -topoi In the scenario of Definition 2.9, we will speak of β : E B as the algebraic morphism presented by the S B -category C. (u , v ) is given by a pair (f, g) where f : u u and g : v f * v . 6The "algebraic topos" terminology tracks an precise analogy with algebraic dcpos discussed by Vickers [56]. 7Not to be confused with the convention of referring to the inverse image f * : S Y S X of a morphism of topoi f : X Y as an "algebraic morphism", which we do not employ in this paper.
Thus algebraic morphisms are closed under composition, and moreover, composition of algebraic morphisms corresponds to the Grothendieck construction for the internal categories that determine them.

Slices and étale morphisms
Let S be a geometric universe and fix an object A ∈ S. It is sometimes referred to as the "fundamental theorem of topos theory" that the slice S ↓ A is again a geometric universe; moreover, the pullback functor A * : S S ↓ A can be seen to be the left adjoint part of a morphism of geometric universes As any object A ∈ S determines a discrete internal S-category el A, it is not difficult to see that any étale S-topos is also algebraic in a canonical way: we have [A] = el A. There is furthermore an analogue to Observation 2.10 concerning the composition of étale morphisms of topoi:

Partial products of topoi
We recall the theory of partial products from Johnstone [31].Let K be a finitely complete 2-category and let p : E B be an cocartesian fibration in K in the sense of [31, Definition B4.4.1]. 8Given an object A ∈ K, a partial product cone over (p, A) at stage C ∈ K is defined to be a diagram of the following form in K, which we write as a pair (u, ): Johnstone defines a morphism between partial product cones (u, ) (u , ) to be a pair (α, β) of 2-cells as depicted below, where α !: u * E u * E is the 1-cell assigning cocartesian lifts along α : u u : We have a 2-fibration [18] of partial product cones PPCone(p, A) K whose fiber at each C ∈ K is the category of partial product cones for (p, A) with vertex C as defined above.Then the partial product of (p, A) is defined to be a representing object P p A ∈ K for the fibration PPCone(p, A) K, if it exists.In other words, for any C ∈ K the category of morphisms C P p A is equivalent to the category of partial product cones for (p, A) with vertex C. Johnstone [31] points out that the partial product can be written in the "internal language" of the 2-category K as the polynomial expression P p A = b:B e:p[b] A.

Elementary synthetic guarded domain theory
In this section, we set down elementary axioms for synthetic guarded domain theory in a geometric universe S. In Sections 3.3 and 3.4 we study the stability of these axioms under the two fundamental topos-theoretic constructions: presheaves and left exact localization.In Section 3.5 we generalize the results of Birkedal et al .to construct a base model from a frame with a well-founded basis over any base geometric universe.

Elementary axioms for synthetic guarded domain theory
Definition 3.1.A later modality structure on S is given by a left exact endofunctor : S S called the later modality together with a natural transformation next : id S .
Definition 3.2.Following the terminology of Kelly [34] we refer to a later modality structure as wellpointed when the following identity of wiring diagrams holds: When the later modality has a left adjoint , the well-pointedness condition of Definition 3.2 is equivalent to the tick irrelevance property isolated by Mannaa, Møgelberg, and Veltri [38].
Remark 3.4.As the later modality is left exact, it internalizes as a modality : Ω Ω on the subobject classifier that preserves finite conjunctions.Likewise, the later modality internalizes as a fibered endofunctor on the fundamental fibered category of S as in Birkedal et al .[6], and can hence be used informally in the internal dependent type theory of S. Definition 3.5.A later modality structure is said to support Löb induction when the sequent φ : Ω | φ ⇒ φ φ holds in the internal logic of S. It is said to support guarded recursive terms when for any morphism f : A A there exists a unique element The following result follows from the unique choice principle valid in any geometric universe.
Lemma 3.6.A well-pointed later modality structure supports guarded recursive terms if and only if it supports Löb induction.
Scholium 3.7.As a consequence of Lemma 3.6, it is rarely necessary to verify the guarded recursive terms property, which is always more complex to check than Löb induction.In fact, Lemma 3.6 is an important ingredient to our constructivization of the results of Birkedal et al .[6] in Section 3.5: it allows us to sidestep the very technical and non-constructive proof of Lemma 8.13 in op.cit.
We do not here consider algebraic compactness conditions on S with respect to contractive functors, although these usually play an important role in the solution of domain equations in synthetic guarded domain theory [6].Instead we take the point of view of Birkedal and Møgelberg [5] and advocate solving domain equations internally to S using term-level guarded recursion on universe objects.Thus we adopt the following elementary definition of a model of synthetic guarded domain theory.Definition 3.8.An elementary geometric model of synthetic guarded domain theory is given by a geometric universe S equipped with a well-pointed later modality ( , next) that supports Löb induction.
Every geometric universe S carries a trivial model of synthetic guarded domain theory where A = 1 S .It is therefore important to distinguish non-trivial models in order to implement adequate denotational semantics; the following definition is one possible restraint on the later modality: Definition 3.9.Let S be a geometric universe equipped with a later modality structure ( , next), and let S : U S be a morphism of geometric universes.We say that ( , next) is globally adequate relative to S : U S when the following 2-cell is an isomorphism, i.e. we have a canonical isomorphism force : Γ S N ∼ = Γ S N where N is the natural numbers object of S:

Elementary axioms for multi-clock synthetic guarded domain theory
The multi-clock variants of synthetic guarded domain theory are also accommodated under Definition 3.8; indeed, we may define an elementary geometric model of multi-clock synthetic guarded domain theory to be a geometric universe S equipped with an object K ∈ S and an elementary geometric model of synthetic guarded domain theory in the slice S ↓ K.In this scenario, K is the object of clocks and clock quantification is implemented by the dependent product functor K * : S ↓ K S.

Stability under presheaves
Let C be an internal category in a geometric universe S, i.e. a small category over S. Supposing in addition that S is an elementary geometric model of synthetic guarded domain theory, we may define a later modality structure pointwise on the geometric universe S C of internal presheaves.In particular, we define C : S C is an elementary geometric model of synthetic guarded domain theory.

Stability under left exact localization
Construction 3.12 (Localized later modality).Let L : S T be a left exact localization, and let ( , next) be a later-modality structure on S. We may define a canonical later-modality structure ( L , next L ) on T by conjugating with the adjunction ∆ L Γ L .We define L : T T to be the composite functor Γ L ; ; ∆ L and we define next L : id T L to be the natural transformation depicted in the following wiring diagram, in which −1 is the inverse to the counit : The following can be proved pictorially in the language of wiring diagrams; see Appendix A.2 for details.
Lemma 3.13.If ( , next) is a well-pointed later modality structure on S and L : S T is a left exact localization, then the later modality structure ( L , next L ) defined in Construction 3.12 is well-pointed.Theorem 3.14 follows nearly immediately from an internal logic argument, using the closure modality associated to any left exact localization.By the above, we may conclude that any category E of S-valued sheaves inherits an elementary model of synthetic guarded domain theory from the base geometric universe S, if it is so-equipped; note this model could depend on the chosen presentation of E by an S-site.Special care must be taken, as localizations need not preserve global adequacy; for example, the localization could trivialize the later modality in the sense of making L A = 1 T for all A ∈ T.

Base models from intuitionistic well-founded posets
In the preceeding sections we have shown stability of elementary geometric models of synthetic guarded domain theory under basic topos theoretic constructions: presheaves and localization; from these stability properties it follows that the logos presented by any E-site inherits guarded recursion from an elementary geometric model E. But how do we construct a geometric model E in the first place?Birkedal et al .[6] provide a simple recipe for constructing such models, working in the more restrictive setting of Set-logoi; in particular, it is verified that for any Set-locale X whose frame of opens O X has a well-founded basis, the logos S X is an elementary geometric model of synthetic guarded domain theory.
In this section, we carry out a (non-trivial) generalization of the results of op.cit. to S-locales for an arbitrary geometric universe S. Indeed, not only are the arguments of op.cit.non-constructive and thus invalid over an arbitrary geometric universe: the definition of well-founded poset must be adjusted as well: (i) It will not do to define u < v as ¬(v ≤ u) unless S is boolean; thus the well-founded order on a poset must be an additional structure that is compatible with the original order in a certain way.(ii) The classical definition of well-foundedness in terms of infinite descending chains is correct if and only if S satisfies dependent choice.
3.5.1 Basic definitions: intuitionistic well-founded posets and frames Definition 3.15.Let R ⊆ P × P be a binary relation in S. The R-accessible elements of P are the smallest subset Acc R ⊆ P spanned by elements u ∈ P such that for all v R u we have v ∈ Acc R .We say that R is well-founded when Acc R ⊆ P is P itself.
Definition 3.16.Let (P, ≤) be a preorder in S; we define a compatible well-founded relation on (P, ≤) to be a transitive binary subrelation ≺ ⊆ ≤ ⊆ P × P satisfying the following additional axioms: (iii) Well-foundedness.The relation ≺ ⊆ P × P is well-founded.
Definition 3.17.We define an intuitionistic well-founded preorder to be a triple (P, ≤, ≺) in S such that (P, ≤) is a preorder and ≺ is a compatible well-founded relation on (P, ≤).Likewise we will speak of an intuitionistic well-founded poset to refer to an intuitionistic well-founded preorder for which ≤ satisfies anti-symmetry.
Definition 3.18 (Connected poset).Let P poset object in S. We say that u, v ∈ P are comparable if u ≤ v or v ≤ u.A poset object is connected if for each u, v ∈ P there exists a finite sequence u = c 0 , . . ., c n = v in P such that c i and c i+1 are comparable for each i.

Definition 3.19 (Internal frames).
A frame in S is defined to be a poset object that is closed under S-joins and finite meets, such that finite meets distribute over S-joins.
Definition 3.20 (Basis for a frame).Let A be a frame in S and let K ⊆ A be a subposet of A; then K is called a basis for A when every u ∈ A is the least upper bound of all the k ∈ K such that k ≤ u.

A base model in sheaves on a frame with well-founded basis
Any frame A in S gives rise to an internal site; the underlying internal category is A itself, and a family {v i ≤ u} is covering when u = i v i .We will write A for the S-topos obtained by setting S A to be the category of S-valued sheaves on the internal site A, letting the structure map A : S S A take any object of S to its constant sheaf.Of course we have an embedding of S-topoi i : A A such that the direct image i * regards a sheaf as a presheaf and the inverse image i * sheafifies a presheaf.
We first construct a later modality structure on the presheaf logos S A = Pr S A = [A • , S] assuming that there exists an intuitionistic well-founded preorder (K, ≤, ≺) that forms a basis for A. For each u ∈ A, we will write K ≤u ⊆ K for the subposet spanned by k ∈ K such that k ≤ u and K ≺u for the subposet spanned by k ∈ K such that there exists l ∈ K ≤u with k ≺ K l.Following Birkedal et al .[6] we may define a predecessor operation on A as a monotone endofunction: The predecessor operation induces an essential morphism of S-topoi p : A A whose inverse image functor p * : S A

S
A is given by precomposition with p.We have a natural transformation ν : id S p p * Proof.By Diaconescu's theorem [23], the topos P classifies the theory of (internally) S-valued flat functors on P. A flat functor a poset is the same as a filter on that poset.
Example 4.3 (The topos of trees).The topos of trees [6] over a geometric universe S is defined to be the algebraic topos ω where ω is the natural numbers object of S with its usual order; this is the "standard" model of synthetic guarded domain theory.We recall that ω = [filter(ω)] from Lemma 4.2; because (ω, ≤) is a total order in S, the downward-directedness axiom for filters can be dropped and we see that ω classifies models of the following even simpler geometric theory: Example 4.4 (Successor ordinals).We may consider the successor ω + = ω {∞} that adjoins a terminal element to ω.The algebraic topos ω + classifies a geometric theory analogous to that of Example 4.3, but it can also be seen to classify a simpler cartesian theory by virtue of the fact that ω + has all finite meets: Let (P, , ) be an intuitionistic well-founded preorder and let q : (P, ) (P , ≤) be its poset reflection.We may define a compatible well-founded order ≺⊆≤ on P by considering the image of in P , i.e. u ≺ v ⇐⇒ ∀x, y.u = qx → v = qy → x y.The order above is adapted from Taylor [53] and called the plump ordering on W p .By Lemma 4.5 we have a weakly equivalent intuitionistic well-founded poset (W p / ∼, ≤, ≺), and thus the classifying topos of filters on this poset carries a model of SGDT.It is not difficult to see by unrolling definitions that Example 4.3 is the special case of this construction for the family p : E 2 whose fibers are ∅ S and 1 S .
5 The universal property of multi-clock guarded recursion

Bagtopoi as partial products
Given a geometric theory T over S, there exists a geometric theory bag(T) over S of families of T-models indexed by an object of S. We will give an explicit description of bag(T) for T a propositional geometric theory (i.e. a theory with no sorts and only nullary predicates).
Definition 5.1 (Johnstone [29]).Let T be a propositional geometric theory.Then bag(T) is the theory with a single sort K together with:

A universal property for Bizjak and Møgelberg's clocks
Let K be the S-category having as its objects pairs (U, f ∈ ω U ) with U a finite S-cardinal, while morphisms (U, f ) → (V, g) are given by functions h : U → V such that h; g ≤ f ∈ ω U in the pointwise ordering.The internal category K above is exactly the category of time objects written T by Bizjak and Møgelberg [14], relativized over an arbitrary geometric universe.It was left unmentioned by op.cit.that K is the free finite coproduct completion of ω • , an observation that sets the stage for our present results.
We observe that K • is the free finite product completion ω × of ω; thus we define the Bizjak-Møgelberg topos over S to be the algebraic S-topos BM := ω × whose total geometric universe is S BM = [K, S].Corollary 5.5 (Universal property).The Bizjak-Møgelberg topos BM is equivalent to the bagtopos B L ω, hence BM classifies the geometric theory bag(filter(ω)).In other words, the category of morphisms of topoi X BM is exactly the category of pairs (K, φ) where K ∈ S X and φ ⊆ K × ω is an K-indexed family of filters on ω internal to S X .

A universal property for Sterling and Harper's clocks
Let be the S-category having as its objects pairs (U, f ∈ ω U ) with U a finite, nonzero S-cardinal, while morphisms (U, f ) → (V, g) are given by functions h : U → V such that h; f ≤ g ∈ ω U in the pointwise ordering.Observe how is exactly the category of clocks described by Sterling and Harper [52], relativized over an arbitrary geometric universe.Remark 5.6 (Image factorization [2, 3.2.11-12]).Each morphism of topoi f : X Y can be factored in a composition of a surjection followed by an embedding.If moreover f is étale, then the components of its factorization are also étale.
Example 5.7.The theory of an inhabited object inh over S has a single sort K together with the axiom ∃k : K. .Let C be an internal S-category, and let C × inh be the full subcategory of C × whose objects are nonzero cardinals.Then S [inh] is the category of S-valued presheaves on 1 × inh .
Definition 5.8.Let T be a geometric theory.Then bag inh (T) is obtained by extending bag(T) with an additional axiom requiring that the sort K is inhabited.We observe that ∼ = ω × inh ; thus we define the Sterling-Harper topos over S to be the algebraic S-topos SH := ω × inh whose total geometric universe is S SH = Pr S (ω × inh ).Lemma 5.11.If E is the algebraic S-topos presented by an S-category C, then the inhabited bagtopos B inh L E admits an algebraic presentation by C × inh ; in other words, we have B inh L C C × inh .Corollary 5.12 (Universal property).The Sterling-Harper topos SH is equivalent to the inhabited bagtopos B inh L ω, hence SH classifies the geometric theory bag inh (filter(ω)).In other words, the category of morphisms of topoi X SH is exactly the category of pairs (K, φ) where K ∈ S X is inhabited and φ ⊆ K × ω is a K-indexed family of filters on ω internal to S X .

Lifting guarded recursion to the bagtopos
In this section, we combine the relative point of view with our general stability results for models of SGDT to obtain an abstract proof that the Bizjak-Møgelberg topos BM carries a model of multi-clock guarded recursion.The results of this section carry over mutatis mutandis to the other variants of the bagtopos considered in the preceeding section.Observation 6.1.The universal property of the Bizjak-Møgelberg topos BM as the partial product P p ω determines a morphism of S-topoi : [K] ω in the following configuration, where [K] BM is the étale morphism corresponding to the generic object: Recall that a point of ω is an ω-filter and a point of BM is an indexed family of ω-filters, and moreover a point of [K] is such an family equipped with a distinguished index; then the morphism : [K] ω should be thought of as taking that distinguished index to the corresponding filter.Lemma 6.2.The morphism : [K] ω is an algebraic morphism of S-topoi that presents [K] as the algebraic S ω -topos C for an internal S ω -category C with a terminal object.
Proof.Letting 1 be the terminal S-topos (so S 1 = S), we observe that the composite [K] → ω → 1 is the algebraic morphism of S-topoi presented by the semidirect product ω × K and ω is the algebraic S-topos presented by ω itself.There is a small fibration π : ω × K ω that projects out the "value" assigned to the generic clock, in which cartesian morphisms are those that leave everything but the value of the generic clock unchanged.As this fibration is small, there exists an internal category E in S ω such that π : ω × K ω is its externalization; explicitly, the fiber E(n) for n ∈ ω is equivalent to the full subcategory of ω × spanned by objects of the form Γ × n .We finally deduce that : [K] ω is the algebraic morphism of S-topoi presented by the S ω -category E: the inverse image functor * takes the generic ω-filter y ω − to the relatively constant ω-filter ∆ E y ω − = π * y ω −.

A Proofs of results
A.1 Guarded recursive terms vs. Löb induction Notation A.1 (Internal language).When working in the internal language of an elementary geometric model E of synthetic guarded domain theory, we will make use of the notations of guarded dependent type theory [12].In particular, we employ the notation of delayed substitutions for the dependent version of the later modality defined schematically below for a pair of dependent types Γ A type and Γ, x : A Bx type: Proof.The only-if direction is immediate.For the converse, we will employ the principle of unique choice.In particular, we consider the predicate x : A | φ x defined like so: To show that there exists x : A such that φx holds, it suffices by Löb induction to assume ∃x : A.φx and then exhibit x : A satisfying φx.By Observation A.2 we may assume that there exists some u : A such that [z ← u]φz holds.We choose x := f u and must check that φ (f x) holds.u = k∈Ku k, so by local character it suffices to verify that k k * φ = for each k ∈ K u .By well-founded induction we may assume that l l * φ = for all l ≺ k.From this assumption we have k p * (k * φ = ) and hence k (k * φ = ), so by our assumption that u ( φ ⇒ φ) = we are done.
Each geometric theory T determines a classifying topos [T] whose points form the category of T-models and T-model homomorphisms; the dual logos S [T] is then the classifying category or category of contexts and substitutions for the theory T. It is also useful to think of S [T] as the universal extension of the geometric universe S by an indeterminate T-model in the same way that the polynomial ring A[x] is the free extension of a ring A by an indeterminate element.

Observation 2 . 10 (
Johnstone [31, Lemma B2.5.3]).If E B is the algebraic morphism presented by an internal category E ∈ S B and F E is the algebraic morphism presented by an internal category O ∈ S E Pr S B E, then the composite F B is the algebraic morphism presented by the internal category E O ∈ S B whose objects are given by pairs (u, v) with u ∈ E and v ∈ Ou such that a morphism (u, v) [A] = (A * A * ).Thus [A] can be viewed as a discrete S-topos where S [A] = S ↓ A such that the points of the S-valued topos [A] are exactly the elements of A. Such a topos is usually referred to as étale: Definition 2.11.An S-topos A is called étale when there exists an object A ∈ S and an equivalence of S-topoi A [A]. Via Convention 2.7 we generalize the notion of étale S-topos to morphisms between S-topoi: Definition 2.12.A morphism p : E B of S-topoi is called étale when the S B -topos E p is étale, i.e. there exists a sheaf B ∈ S B together with an equivalence of S B -topoi E p [B].

Observation 2 .
13.If E B is the étale morphism presented by a sheaf E ∈ S B and F E is the étale morphism presented by a sheaf F ∈ S E S B ↓ E, then the composite F B is the étale morphism presented by the dependent sum E F ∈ S B .

CSCLemma 3 . 10 (Theorem 3 . 11 (
to take an internal presheaf E to c → E c in the internal language of S; likewise the natural transformation next C : id S C C is given pointwise.The following Lemma 3.10 is verified by rewriting in the pictorial language of wiring diagrams, using the fact that when C has a terminal object, the global sections functor Γ C :S C S is S-cocontinuous and hence preserves the natural numbers object.Global adequacy in presheaves).If the internal category C has a terminal object and ( , next) is globally adequate relative to S : U S, then ( C , next C ) is globally adequate relative to the composite map S; C : U S C .Stability under presheaves).The pointwise later modality structure ( C , next C ) on S C is well-pointed and supports Löb induction.Hence the category of diagrams S

Theorem 3 . 14 (
Stability under localization).If the later modality structure ( , next) on S supports Löb induction, then so does ( L , next L ) for a left exact localization L : S T. Hence if S is an elementary geometric model of synthetic guarded domain theory, then so is any left exact localization of S.

Example 4 . 6 (
Well-founded trees and the plump ordering).Let p : E B be a morphism in S and consider the corresponding polynomial endofunctor P p : S S taking X ∈ S to P p X = b:B e:p[b] X.As S supports W-types [39, Proposition 3.6], we may form the initial algebra σ : P p W p W p of this polynomial endofunctor.Following Fiore, Pitts, and Steenkamp [25, Example 5.4] we may equip W p as an intuitionistic well-founded preorder, letting ( , ) be the smallest relations closed under the following: (∀x : p[a].cxw) → σ(a, c) w (∃x : p[a].wcx) → w σ(a, c)

Lemma 5 . 4 (
Johnstone [31, Example B4.4.17]).If E is the algebraic S-topos presented by an S-category C, then the bagtopos B L E admits an algebraic presentation by C × ; in other words, we have B L C C × .

Definition 5 . 9 .Observation 5 . 10 .
Let e : [el] [inh] be the surjective part of the image factorization for the generic étale morphism of S-topoi.Then the inhabited bagtopos of an S-topos E is the partial product B inh L E := P e E. For a geometric theory T, the inhabited bagtopos B inh L [T] is the classifying S-topos for the theory bag inh (T), i.e. we have B inh L [T] [bag inh (T)].

Corollary 6 . 3 .
The Bizjak-Møgelberg topos BM carries a globally adequate model of multi-clock synthetic guarded domain theory, parameterized in the generic indexing object K ∈ S BM .Proof.The result follows from Lemma 6.2 via Lemma 4.1.Viewing [K] as an algebraic topos over ω, we automatically have a model of synthetic guarded domain theory by Theorem 3.11.Global adequacy follows from Lemma 4.1 via Lemma 3.10.

2 .
Let φ : A Ω be a predicate that holds for at most one element of A; then ∃x : A.φx implies ∃u : A. [x ← u]φx.Lemma 3.6.A well-pointed later modality structure supports guarded recursive terms if and only if it supports Löb induction.