Point A.
--------
Interval implementations have to trust the user to get (*) right. Consider Arnold's example below, which can be written
g(x)= (x1-x2)/(x1+x2)
h(x) = 2/(1+x2/x1) - 1
where x = (x1,x2). A computer algebra system can easily see h is a rearrangement of g, so (*) holds; but no practical implementation will check this at run time--if I suggested such a thing, Nate would flatten me, and rightly so.
So if there is a typo in the code, how will this be revealed?
Point B.
--------
Let (*) hold. Write Dg and Dh for the domains of g and h, and let xx be an input box. Then, whether intersection is appropriate to apply seems to depend on how xx relates to Dg and Dh. Let g(xx) denote the result of interval-evaluating g with input xx, etc.
I think what we are REALLY after is
a tight enclosure of range(f,xx)
plus
some knowledge of the relation between xx and f.
Theory gives these elementary facts:
(a) gg = g(xx) encloses range(g,xx), by FTIA; but is usually bigger.
(b) hh = h(xx) encloses range(h,xx), ditto.
(c) range(f,xx) = range(g,xx) if xx happens to be a subset of Dg.
(d) As (c) with g changed to h.
(e) Df = (Dg union Dh) in all cases.
(f) range(f,xx) = ( range(g,xx) union range(h,xx) ) in all cases.
Now using the AN+JDP (ill<emp<con<def<saf) scheme, let gg and hh become decorated intervals (gg,dg) and (hh,dh).
(i) I think the only situation where intersection is appropriate is when BOTH of dg,dh are in {def,saf}. Then we know xx is a subset of both Dg and Dh (hence of Df). Then (a,b,c,d) above imply
(gg intersection hh) encloses range(f,xx).
And if EITHER of dg,dh is saf, we know f is "safe" on xx; otherwise, at least we know f is everywhere defined on xx.
Hence in this case we can return
(ff,df) = (gg intersection hh, max(dg,dh))
as a decorated enclosure of range(f,xx).