update to nominal calculus, fully proven type safe