[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-82326-en":3,"doc-seo-82326-105":29,"detail-sidebar-cat-0-en-105":91},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":13,"seo_description":14,"update_tm":27,"read_time":28},82326,1374391974585,"Genevieve","https://ap-avatar.wpscdn.com/davatar_276721f389ce27ea32af1340a28f341c",8,"Research & Report","System Capybara: Tracking Capabilities for Separation and Freshness","System Capybara retrofits static alias-control guarantees into Scala without imposing global ownership or exclusivity. It builds on Scala capture checking where capabilities are ordinary values and types record capture sets. Capybara adds a selective layer that tracks separation, consumption, freshness, and read-only access, enabling substructural reasoning locally. A type-preserving translation from Capybara to CoreCapybara is proved sound in Lean 4, yielding type safety, memory safety, read-only immutability, and data-race freedom, and is implemented via Scala 3’s separation checker.","arXiv :2607 .09383v 1 [ cs .PL] 10 Jul 2026  \nSystem Capybara: Tracking Capabilities for Separation and Freshness (Extended Version)  \nYICHEN XU, EPFL, Switzerland  \nOLIVER BRAČEVAC, EPFL, Switzerland CAO NGUYEN PHAM, EPFL, Switzerland YAOYU ZHAO, EPFL, Switzerland MARTIN ODERSKY, EPFL, Switzerland  \nSubstructural type systems give strong static control over aliasing. Examples include uniqueness, separation, and borrowing. How can such control be brought to established languages whose programming models rely on higher-order abstraction, unrestricted aliasing, and pervasive sharing? We study this problem in the context of Scala. We show how to retrofit these guarantees selectively instead of globally: ordinary code keeps Scala’s usual aliasing discipline, while stronger guarantees can be enforced where they matter.  \nOur starting point is Scala’s capture checking, whose treatment of capabilities is inspired by the objectcapability tradition: capabilities are ordinary values, and capture sets record, in a value’s type, which capabilities the value may use. We develop System Capybara, which adds a selective alias-control layer to this mechanism. By tracking separation, consumption, freshness, and read-only access for capabilities, Capybara recovers key reasoning principles from substructural and ownership-based disciplines without global invariants.  \nWe give a type-preserving translation from the surface calculus Capybara to CoreCapybara, a core calculus extending System Capless, the earlier foundation for capture checking. The translation uses quantifiers for capture polymorphism and freshness, and constraint-indexed modal types for separation. We prove a semantic soundness result for the core calculus in Lean 4 and derive type safety, memory safety (no use-after-free or double-free), immutability of read-only computations, and data-race freedom for well-typed programs.  \nFinally, we implement Scala 3’s new separation checker, which brings higher-order separation reasoning about effects, capabilities, and resources to ordinary Scala, including fearless concurrency.  \n1 Introduction  \nModern safety guarantees often rest on controlling aliasing. Memory safety, deterministic resource management, and data-race freedom all require knowing when computations may touch the same mutable resource. This is hard in languages with unrestricted aliasing: objects cross abstraction boundaries, closures capture mutable state, and higher-order functions defer effects until invocation. The style is expressive, but mutability undermines local reasoning: a write through one reference can silently change what another reads, the familiar “spooky action at a distance”. With deallocation or parallelism, the same aliasing problem may lead to dangling pointers, double-frees, or data races. Rust [41, 45] shows the value of static alias control. Its ownership and borrowing discipline supports safe resource management, memory safety without a garbage collector, and fearless concurrency [44] . But Rust obtains these guarantees by making exclusivity part of the language’s programming discipline. That design is hard to retrofit into languages where sharing is pervasive.  \nThe tension appears even in a small Rust example. A mutable borrow and a shared borrow of the same value cannot both be live at once. Here a closure logs the vector’s length, with a push between two calls to it:  \n\n| let mut v = vec![1, 2, 3]; |  |  |\n| --- | --- | --- |\n| let log_length\u003Cbr>log_length(); | = || println!( \"{} \" , v.len()); | // borrows v |\n| v.push(4); | // error : cannot borrow `v ` as | mutable |\n\nAuthors’ Contact Information: Yichen Xu, yichen.xu@epfl.ch, EPFL, Switzerland; Oliver Bračevac, [oliver.bracevac@epfl.ch](oliver.bracevac@epfl.ch), EPFL, Switzerland; Cao Nguyen Pham, nguyen.pham@epfl.ch, EPFL, Switzerland; Yaoyu Zhao, yaoyu.zhao@epfl.ch, EPFL, Switzerland; Martin Odersky, [martin.odersky@epfl.ch](martin.odersky@epfl.ch), EPFL, Switzerland.  \n2 Xu et al.  \nlog_leng","cbCaisp15QcTZexr","https://ap.wps.com/l/cbCaisp15QcTZexr","pdf",1035895,1,64,"English","en",105,"# Introduction\n## Problem: aliasing and local reasoning\n## Example: closure borrows and mutation rejection\n## Goal: selective guarantees in Scala\n## Capturing types and capture checking\n# System Capybara Framework\n## Capability capture sets and object-capability inspiration\n## Selective alias-control layer\n# Formalization and Proofs\n## Translation to CoreCapybara\n## Soundness in Lean 4 and safety results\n# Implementation and Impact\n## Scala 3 separation checker and fearless concurrency","[{\"question\":\"What problem does System Capybara address in Scala?\",\"answer\":\"System Capybara targets the difficulty of enforcing static reasoning about aliasing when programming models rely on higher-order abstraction, pervasive sharing, and unrestricted aliasing, which can break local reasoning for memory safety and data-race freedom.\"},{\"question\":\"How does Capybara build on Scala capture checking?\",\"answer\":\"Capybara starts from Scala’s capture checking, where capabilities are ordinary values and capture sets in a value’s type record which capabilities the value may use. It then adds a selective alias-control layer to track separation, consumption, freshness, and read-only access.\"},{\"question\":\"What guarantees are proved for well-typed programs?\",\"answer\":\"The paper proves semantic soundness for the core calculus in Lean 4 and derives type safety, memory safety (no use-after-free or double-free), immutability of read-only computations, and data-race freedom for well-typed programs.\"}]",1784179667,161,{"code":4,"msg":30,"data":31},"ok",{"site_id":24,"language":23,"slug":32,"title":13,"keywords":33,"description":14,"schema_data":34,"social_meta":86,"head_meta":88,"extra_data":90,"updated_unix":27},"system-capybara-tracking-capabilities-for-separation-and-freshness","",{"@graph":35,"@context":85},[36,53,68],{"@type":37,"itemListElement":38},"BreadcrumbList",[39,43,47,50],{"item":40,"name":41,"@type":42,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":44,"name":45,"@type":42,"position":46},"https://docshare.wps.com/document/","Document",2,{"item":48,"name":12,"@type":42,"position":49},"https://docshare.wps.com/document/research-report/",3,{"item":51,"name":13,"@type":42,"position":52},"https://docshare.wps.com/document/system-capybara-tracking-capabilities-for-separation-and-freshness/82326/",4,{"url":51,"name":13,"@type":54,"author":55,"headline":13,"publisher":57,"fileFormat":60,"inLanguage":23,"description":14,"dateModified":61,"datePublished":62,"encodingFormat":60,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":56},"Person",{"url":40,"name":58,"@type":59},"DocShare","Organization","application/pdf","2026-07-17","2026-07-16",true,{"@type":65,"interactionType":66,"userInteractionCount":20},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71,77,81],{"name":72,"@type":73,"acceptedAnswer":74},"What problem does System Capybara address in Scala?","Question",{"text":75,"@type":76},"System Capybara targets the difficulty of enforcing static reasoning about aliasing when programming models rely on higher-order abstraction, pervasive sharing, and unrestricted aliasing, which can break local reasoning for memory safety and data-race freedom.","Answer",{"name":78,"@type":73,"acceptedAnswer":79},"How does Capybara build on Scala capture checking?",{"text":80,"@type":76},"Capybara starts from Scala’s capture checking, where capabilities are ordinary values and capture sets in a value’s type record which capabilities the value may use. It then adds a selective alias-control layer to track separation, consumption, freshness, and read-only access.",{"name":82,"@type":73,"acceptedAnswer":83},"What guarantees are proved for well-typed programs?",{"text":84,"@type":76},"The paper proves semantic soundness for the core calculus in Lean 4 and derives type safety, memory safety (no use-after-free or double-free), immutability of read-only computations, and data-race freedom for well-typed programs.","https://schema.org",{"og:url":51,"og:type":87,"og:title":13,"og:site_name":58,"og:description":14},"article",{"robots":89,"canonical":51},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":92},[93,97,101,105,110,115,120,123,128,131,135],{"id":20,"doc_module":4,"doc_module_name":45,"category_name":94,"show_sort_weight":95,"slug":96},"Story & Novel",90,"story-novel",{"id":46,"doc_module":4,"doc_module_name":45,"category_name":98,"show_sort_weight":99,"slug":100},"Literature",80,"literature",{"id":52,"doc_module":4,"doc_module_name":45,"category_name":102,"show_sort_weight":103,"slug":104},"Exam",70,"exam",{"id":106,"doc_module":4,"doc_module_name":45,"category_name":107,"show_sort_weight":108,"slug":109},5,"Comic",60,"comic",{"id":111,"doc_module":4,"doc_module_name":45,"category_name":112,"show_sort_weight":113,"slug":114},6,"Technology",50,"technology",{"id":116,"doc_module":4,"doc_module_name":45,"category_name":117,"show_sort_weight":118,"slug":119},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":45,"category_name":12,"show_sort_weight":121,"slug":122},30,"research-report",{"id":124,"doc_module":4,"doc_module_name":45,"category_name":125,"show_sort_weight":126,"slug":127},9,"Religion & Spirituality",20,"religion-spirituality",{"id":126,"doc_module":4,"doc_module_name":45,"category_name":129,"show_sort_weight":126,"slug":130},"World Cup","world-cup",{"id":132,"doc_module":4,"doc_module_name":45,"category_name":133,"show_sort_weight":132,"slug":134},10,"Lifestyle","lifestyle",{"id":136,"doc_module":4,"doc_module_name":45,"category_name":137,"show_sort_weight":106,"slug":138},19,"General","general"]