Contract Assertion. Contract assertion starts after evaluating the first expression to a subject value v and evaluating the contract definition to a contract C. Figure 5.19 shows its evaluation rules. Rule Flat starts evaluating a flat contract by applying the predicate to the wrapped subject value. Meta-function drop (v, ι, σ, ς) first drops all non-compatible delayed contracts (cf. Section 5.6) on the subject value. It removes all contract wrappers that do not belong to the same side of an intersection or union. Function wrap wraps the resulting value in a sandbox proxy to avoid interference (cf. Section 5.4.6). Afterwards, it triggers the predicate evaluation on the wrapped subject value. All operations happen under a new context, which is the current flat contract. This ensures that all contract violations that happen during the predicate evaluation blame the contract, instead of the global context. The rules Intersection and Union implement contract checking of top-level intersection and union contracts. Both rules assert the first sub-contract to the subject value and assert the second sub-contract to the resulting behavior of the first assertion. The contract evaluation installs a new constraint that links the outcome of both sub-contracts to the satisfaction of the contract. Finally, rule Delayed wraps a subject value and a delayed contract together with the associated blame identifiers in a contract proxy that later checks the contract when the value is used (see also Section 5.4.5). Flat ' ' = σ (l) drop (v, ι, σ, ς) = (w, σ ) wrap (w, ρ, σ , ς) = (w, σ , ς ) ⟨ρ^, λx.e⟩ ( ) ) ^ ^ '' ' flat l , ρ ▶ σ'', ς', v@c (x x^ ⇓ σ''', ς'', b Union κ, ρ ▶ σ, ς, v@cflat (l) ⇓ σ''', ς'', b ι1, ι2 ∈/ dom (ς) κ, ρ ▶ σ, ι K (ι1 ∪ ι2) : ς, (v@c1 C) @c2 Ð ⇓ σ', ς', b κ, ρ ▶ σ, ς, v@c(C ∪ Ð) ⇓ σ', ς', b Intersection ι1, ι2 ∈/ dom (ς) κ, ρ ▶ σ, ι K (ι1 ∩ ι2) : ς, (v@c1 𝓧) @c2 C ⇓ σ', ς', b κ, ρ ▶ σ, ς, v@c(𝓧 ∩ C) ⇓ σ', ς', b Delayed l' ∈/ dom (σ) σ' = σ [l' '→ ⟨l, ι, Q⟩] κ, ρ ▶ σ, ς, v@cQ ⇓ σ', ς, l'
