diff --git a/.github/workflows/lean-specification-proofs.yml b/.github/workflows/lean-specification-proofs.yml new file mode 100644 index 000000000..2b847d847 --- /dev/null +++ b/.github/workflows/lean-specification-proofs.yml @@ -0,0 +1,59 @@ +name: Lean statement proofs (kernel evidence about registered Props only, no scientific promotion) + +'on': + pull_request: + paths: + - 'specifications/lean_statement_proofs_20261011/**' + - 'specifications/lean_statements_20261010/**' + - '.github/workflows/lean-specification-proofs.yml' + workflow_dispatch: + +permissions: + contents: read + +jobs: + proof-evidence: + runs-on: ubuntu-latest + timeout-minutes: 90 + env: + LEAN_NUM_THREADS: 2 + PYTHONDONTWRITEBYTECODE: '1' + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 + with: + persist-credentials: false + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 + with: + python-version: '3.11.16' + - name: Unit tests in both Python modes and the source check (no Lean) + run: | + set -euo pipefail + P=specifications/lean_statement_proofs_20261011 + python -B -S "$P/test_check.py" + python -B -O -S "$P/test_check.py" + python -B -S "$P/check.py" + - name: Install pinned Lean and retrieve the Mathlib cache + uses: leanprover/lean-action@f061402b660e0c34644504b324e830f2991d4865 + with: + lake-package-directory: specifications/lean_statement_proofs_20261011 + auto-config: 'false' + build: 'false' + test: 'false' + lint: 'false' + use-mathlib-cache: 'true' + use-github-cache: 'false' + - name: Lean-driving unit tests on dependency-free fixture packages (environment audit, its controls, the escapes it must refuse) + run: python -B -S specifications/lean_statement_proofs_20261011/test_check.py LeanHelpers + - name: "Exact Lean version, fresh build (statement packet from source, then the proof modules), leanchecker, #check and #print axioms of every inventoried theorem, environment audit, negative controls, receipt" + run: python -B -S specifications/lean_statement_proofs_20261011/check.py --execute + - name: Tracked tree unchanged + run: git diff --exit-code + - name: Preserve logs and receipt + if: always() + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a + with: + name: lean-specification-proofs-${{ github.run_id }}-${{ github.run_attempt }} + path: specifications/lean_statement_proofs_20261011/.lake/evidence/ + include-hidden-files: true + if-no-files-found: error + retention-days: 14 diff --git a/specifications/lean_statement_proofs_20261011/.gitignore b/specifications/lean_statement_proofs_20261011/.gitignore new file mode 100644 index 000000000..ae7367994 --- /dev/null +++ b/specifications/lean_statement_proofs_20261011/.gitignore @@ -0,0 +1,2 @@ +.lake/ +__pycache__/ diff --git a/specifications/lean_statement_proofs_20261011/README.md b/specifications/lean_statement_proofs_20261011/README.md new file mode 100644 index 000000000..19978b48c --- /dev/null +++ b/specifications/lean_statement_proofs_20261011/README.md @@ -0,0 +1,128 @@ +# Lean statement proofs (`specifications/lean_statement_proofs_20261011`) + +**Scientific effect: NONE.** Organizational-independence credit: 0 (Anthropic / Claude). Alignment +status of every statement proved here: **PENDING_INDEPENDENT_REVIEW**. No claim, premise, obligation +or disposition changes status because of anything in this directory. + +## What this packet is + +Kernel-checked Lean 4 proofs of statements that are *already registered* in the statement packet +[`specifications/lean_statements_20261010`](../lean_statements_20261010) (`REGISTER.json`, modules +`Specifications/{Field,Lifetime,Side24,RN,P15}.lean`). That packet holds `def … : Prop` +declarations and interface `structure`s and nothing stronger; this packet depends on it by path +(`lakefile.toml`, `[[require]] path = "../lean_statements_20261010"`) and never edits it. + +Every theorem in the inventory has as its *type* a registered Prop constant applied to exactly the +theorem's own parameters: + +```lean +theorem rhoStarBelowSixSevenths : UniversalLaw.Spec.P15.RhoStarBelowSixSevenths := … +theorem fullBlockCoverIff {X : Type} [Fintype X] [DecidableEq X] (F : RealizedData X) : + UniversalLaw.Spec.P15.FullBlockCoverIff F := … +``` + +A theorem of the shape `theorem foo (h : extra) : P` or `theorem foo : P → P` or +`theorem foo (n : ℕ) : P (n + 1)` is **refused**: an extra hypothesis or a narrowed argument is a +finding about the statement (report it), never a theorem of it. + +## What a green run establishes, and what it does not + +| established by a green `check.py --execute` | not established | +|---|---| +| each inventoried theorem was accepted by the Lean kernel (`lake build`, replayed by `leanchecker`) at Lean `v4.34.1` (commit `5045d005…`), Mathlib `d13f23b7…`, against the statement modules whose SHA-256 the receipt records | that any informal Layer 0 claim is true, aligned with its Lean statement, reviewed or accepted | +| its transitive axioms are within `propext`, `Classical.choice`, `Quot.sound` (`#print axioms`, and Lean's `collectAxioms` on every constant the modules add) | anything about the statement's fidelity to its source: alignment is PENDING_INDEPENDENT_REVIEW and is written only by an independent reviewer | +| its type, after `forallTelescope`, is a registered Prop constant applied to exactly the telescope's variables (Lean's `ConstantInfo`, not source text), and Lean's inventory equals the lexical scan's | any change to `REGISTER.json`: the register's labels (`specified` for every statement of the statement packet) are untouched; a register row of kind `theorem` naming this packet is the statement packet maintainers' decision, not this gate's | +| no `sorry`, `axiom`, `native_decide`, `unsafe`, `opaque` or proof-written-as-`def` anywhere in the modules; `maxHeartbeats` above 400000 only with a justifying comment | a LANDING_CLAIMS disposition (`HOLD_WITH_DOMAIN`, `FAIL_CLOSED`, `EXACT_COUNTEREXAMPLE`, `REVIEWED_SCOPED`, `ENGINEERING_HOLD`): transcribed in the register, never derived here | +| the negative controls refused for the intended reasons (sorry via the axiom audit; a custom axiom; an unregistered type; a smuggled hypothesis and a `P → P` implication; a tightened false arithmetic statement rejected by Lean) | the parent theorems, the identification of interface structures with the informal objects, independence (credit 0), or any prize claim | + +Vocabulary (docs/FORMAL_VERIFICATION.md): the source-mode summary says `formalization_status: +"proved"` (the label of a committed proof package); `kernel-checked` appears **only** in a run +receipt (`.lake/evidence/receipt.json`). On the evidence ladder a kernel-checked theorem is L5 +*for that Prop*; the informal claim it serves keeps the ladder level and formal-progress label the +register gives it. + +## Registered Props without a theorem here, and why + +Inventory at this commit: 52 theorems, 51 of the 141 registered `def … : Prop` declarations (`TriangleNeedsThree` +is proved twice). The other 90 fall into the groups below. None is weakened, restated or relabelled: the register +keeps every one at `specified`, and a group's reason is a statement about what Mathlib and this packet can reach +today, not about the truth of the Prop. + +| group | Props (names without `UniversalLaw.Spec..`) | why no theorem here | +|---|---|---| +| P15 parametrised predicates | `IsRealizedFamily`, `IsGood`, `IsKDecomposable`, `IsGeneratorCover`, `IsPaletteFeasible`, `IsMinimalForbidden`, `IsTransversal`, `IsProperDownset` | predicates with free arguments, not closed statements: a theorem of their type would assert them for every argument, which is false (`IsGood F Finset.univ` fails for every realized family). They are the vocabulary of the other Props, not targets. | +| P15 hazard interpolation (full-price note Section 2) | `CoordinatewiseConcavity`, `HazardProductBound` (F6), `HazardPhiBound` (F7), `FullGroundPriceBound` (F8), `FullGroundBudgetIff` | need the concavity of `t ↦ -log μ_{p(t)}(A)`, `p_i(t) = 1 - e^{-t_i}`, in each coordinate, i.e. the derivative formulas (F4)-(F5) that the source does not display and the statement packet does not specify; a real-analysis development (differentiability of finite exponential sums, sign of the second derivative) with no Mathlib shortcut. (F7), (F8) and the `iff` are its consequences. | +| P15 full budget | `LocalPriceBoundFull` (F12), `FullTransformedPriceBudget` (F2) | (F12) is (F8) applied to each block's capacity family together with `H_(n,a) ≥ h_star` (`CapacityWorstCase`, proved) and `rho_star = 1/h_star`; (F2) assembles (F12) through (F13) (`GlobalAssemblyHazard`, proved) and the cover criterion (`FullBlockCoverIff`, proved). Both wait on the group above. | +| P15 enclosure | `RhoStarEnclosure` (F3) | twenty decimal digits of `1/(3 - log(3e - 2))`: needs certified `exp` and `log` enclosures far beyond Mathlib's nine-digit `Real.exp_one_lt_d9`; a proof-producing interval pipeline (Taylor remainders at some twenty-five terms in exact rationals) is the route. `RhoStarBelowSixSevenths` and `SixSeventhsCertificate` (proved) are the coarse version. | +| Side24 derivative bounds | `IsUnitTuple` (predicate), `DerivativePairingBound`, `DerivativeBoundAtLeastOne`, `DerivativeBoundAtZero` | explicit `iteratedFDeriv ℝ q (fun x => exp (-‖x‖² / 2))` in arbitrary unit directions: Mathlib has no closed form for the iterated Fréchet derivatives of a Gaussian (the Hermite expansion behind the pairing sums); the arithmetic of the pairing sums is kernel-proved on main (`UniversalLaw.Side24.pairing_sum_six`, …). | +| Side24 lattice sums | `ThetaSummable`, `LatticeImageSumBound`, `ImageBound` | summability of `n ↦ exp (-‖z + 24 n‖² / 2)` over `Fin d → ℤ` and the explicit tail `≤ 1458 e^{-288}`: Gaussian-decay summability over `ℤ^d` and a shell count; Mathlib's Jacobi-theta results are one-dimensional. | +| Side24 covariance and density | `NegDefCone` (predicate), `ReferenceOddAndPinBlocks`, `CovarianceOrdering`, `EntrywiseCovarianceBound`, `ReferenceCovarianceLowerBound`, `DensityComparison`, `IntegrandRatioBounds`, `ReferencePinDensityProduct` | built on the derivative contractions above (`jointCov`, `gradCov`, `pinCov`, `derivContraction`); the matrix arithmetic is kernel-proved on main, the evaluation of the Fréchet derivatives is not available. | +| Side24 interface statements | `ConeMomentD1Identity`, `ConeMomentD2Identity`, `TraceMoments`, `RayleighSquareLaw` (over `ConeMomentInterface`); `CoefficientEnclosure`, `ReferenceComparison` (over `PeriodicCoefficientInterface`) | quantify over an interface whose fields are given, not constructed: the Gaussian moment identities need the conditional law `A_u \| V_u = 0` built in Mathlib's Gaussian measure theory; the enclosure needs the numerical pipeline. `ConeMomentD2Algebra`, `ElementaryConeIntegral` and `ReferenceCoefficientIdentity` (proved) are the parts that need neither. | +| RN beyond (N1)-(N5), Lifetime, Field | the 22 RN Props other than `HolderCountBoundN1`, `HolderConsequenceN2`, `ConditionalMeanIdentityN3`, `UniformCounterexampleN4`, `ExponentialTailLayerCakeN5`; all 21 Lifetime and 10 Field Props | statements about the Gaussian field through interface structures (`PinnedLawInterface`, `GaussianFieldInterface`, …): the D5 window bounds, the dimension lift, the Palm and Fourier routes, the remote-collision and annulus-bridge bounds, the parent Theorems A/B/C, the planar elder gap, the remainder (R1), and the critical-point predicates. These are the programme's open research claims: a proof would be the research result itself, not a formalisation of an existing argument, and the interfaces do not carry the Kac–Rice data the informal arguments use. | + +The register (`../lean_statements_20261010/REGISTER.json`) says the same per claim row in its `not_established` and +`next_step` fields; this table is the packet-side summary and decides nothing. + +## Layout + +``` +README.md SCOPE.md check.py test_check.py replay.sh +lakefile.toml lean-toolchain lake-manifest.json SpecificationProofs.lean +SpecificationProofs/.lean namespace UniversalLaw.Proofs.; P15 is split by theme into + P15Elementary, P15Structure, P15Hazard, P15Covers, P15Budget (in + import order), Side24Elementary and RNProbability are one each +``` + +Rules for every module (enforced by `check.py`, see its module docstring): + +* imports only `Specifications.`, Mathlib and sibling proof modules `SpecificationProofs.` of + this packet (Lean forbids cycles; the axiom audit is transitive, so a reused `Aux` lemma is audited where it + is used as well as where it is proved), nothing else; +* exactly one top-level `namespace UniversalLaw.Proofs.`; helpers are `private` or live under + a `…Aux` namespace and are not inventory items; +* every non-aux theorem's docstring carries `Proves:` (naming the registered Prop), `Method:` and + `Does not establish:`; +* no `sorry`, `admit`, `axiom`, `native_decide`, `unsafe`, `opaque`, `partial`, `implemented_by`, + `extern`, `include`, `_root_`, metaprogramming commands, `#` commands, `debug.*`/`bootstrap.*` + options or `autoImplicit`; declaration and scope keywords start their own line. + +## How to run + +```bash +export PATH="$HOME/.elan/bin:$PATH" +P=specifications/lean_statement_proofs_20261011 +python3 -B -S $P/check.py # source mode (git identity, lexical scan, inventory); add --allow-dirty locally +python3 -B -S $P/test_check.py # unit tests; the LeanHelpers class runs only when `lake` is on PATH +python3 -B -O -S $P/test_check.py +python3 -B -S $P/check.py --execute # fresh lake build, leanchecker, #check/#print axioms, environment audit, controls, receipt +bash $P/replay.sh [--allow-dirty] # all of the above in order +``` + +Compile one module while writing it: `cd $P && lake env lean -DwarningAsError=true +SpecificationProofs/.lean`. The gate refuses warnings in proof modules in the build log. +Never run `lake update`; `.lake/packages` may be a symlink to a prebuilt dependency tree locally (the +receipt records `packages_dir`), and each package directory must be at its locked revision. +`lakefile.toml` is pinned byte-exactly (Lake would accept a `moreLeanArgs = ["-Ddebug.skipKernelTC=true"]` +line that no "contains these lines" check sees). + +Resource needs of `--execute`: the `leanchecker` replay of the Mathlib-importing environment holds +roughly 14 GB of anonymous memory (it was memcg-killed at 13.5 GB RSS on a shared 16 GB machine; on +an idle one it finishes in about a minute), the fresh `lake build` of the packet takes a few minutes +once the Mathlib oleans are present. The hosted runner (`ubuntu-latest`) is where the first receipt +for a commit exists. On a smaller machine `LEAN_PROOF_SKIP_LEANCHECKER=1 python3 -B -S $P/check.py +--execute --allow-dirty` runs every other stage; the variable is honoured only together with +`--allow-dirty` (never in CI), the receipt then reads `leanchecker: "SKIPPED_LOCAL_ONLY"` and, like +every `--allow-dirty` receipt, is not evidence about any commit. + +CI: [`.github/workflows/lean-specification-proofs.yml`](../../.github/workflows/lean-specification-proofs.yml) +(`leanprover/lean-action`, `use-mathlib-cache: 'true'`; the statement packet, a path dependency, +builds from source) uploads `.lake/evidence/` as an artifact. A green workflow is a run, not a review. + +## Receipt + +`.lake/evidence/receipt.json` (`LEAN-PROOF-RECEIPT-20261011-v1`): `checked_commit`, `worktree` +(`CLEAN` or `UNVERIFIED` with `--allow-dirty`, in which case the receipt is not evidence about any +commit), the Lean version line, dependency revisions, SHA-256 of the register, the statement modules +and the proof modules, the theorem inventory (name, module, registered Prop, claim ids it serves, +axioms), the environment-audit class counts, the negative-control outcomes and the log digests. +`theorems.json` beside it carries the elaborated signatures. diff --git a/specifications/lean_statement_proofs_20261011/SCOPE.md b/specifications/lean_statement_proofs_20261011/SCOPE.md new file mode 100644 index 000000000..e60a08579 --- /dev/null +++ b/specifications/lean_statement_proofs_20261011/SCOPE.md @@ -0,0 +1,54 @@ +# Scope of the proof packet + +Scientific effect: **NONE**. Scientific status authority: none. Alignment status of every registered +statement proved here: **PENDING_INDEPENDENT_REVIEW**. Organizational-independence credit: 0. + +## In scope + +* Theorems whose type is exactly a registered `def … : Prop` of + `specifications/lean_statements_20261010/REGISTER.json`, applied to the theorem's own parameters, + with proofs the Lean kernel accepts under `propext`, `Classical.choice` and `Quot.sound` only. +* Helper lemmas and definitions needed by those proofs, `private` or under an `Aux` namespace, never + counted as inventory and audited for axioms like everything else. +* The gate (`check.py`), its tests, the replay script and the CI workflow that produce a run receipt. + +## Out of scope (and refused by the gate where it can see them) + +* Editing any statement module or the register. A proof that needs a statement changed, or an extra + hypothesis to go through, is a **finding** about the statement: report it; do not smuggle the + premise into the theorem (`theorem foo (h : …) : P` and `theorem foo : P → P` are refused), do not + narrow the statement (`theorem foo (n : ℕ) : P (n + 1)` is refused). +* Any proof of an informal claim as such. The register's claim-level `formal_progress` stays what the + register says (`none` or `specified`); no research claim of this programme is `proved`. +* Alignment verdicts (ALIGNED / ALIGNED AT NARROWER SCOPE / MISALIGNED): written only by an + independent reviewer, never here. +* Transcribed LANDING_CLAIMS dispositions: never re-derived or changed. +* The vault, `legacy/`, `quarantine/` material, and anything under + `02_LEGACY_Q0_ARCHIVE`: not cited, not used. + +## What a kernel-checked theorem here means, per family + +| family | the theorems establish | not established | +|---|---|---| +| P15 (`Specifications.P15`, modules P15Elementary, P15Structure, P15Hazard, P15Covers, P15Budget) | exact finite arithmetic and finite combinatorics of the registered Props: generator prices, the demand-one refutation data, `ρ* < 6/7` and its certificate, the 816-benchmark counts, palette identities, cover (816 and not 815) and union bound (P11); Proposition P1; both halves of Theorem P2 as the Props state them (the cover criterion (P7) and the hazard bound (P8) for prices `0 ≤ c_v ≤ p_v`) with the local statements (P2)-(P5); the restricted transformed-price budget (T1) with (T4), (T5) and the six-block transformed range; (F9), (F13), the sharpness clause of `ρ*` for the triple block; all for the formal `RealizedData` record, downset, `coverCost` (an `sInf`) and `mu` | the informal P15 claims (P15-PRICE-BOUNDARY, P15-REALIZED-COVERS, FULL-PRICE, PRICE-BUDGET), their dispositions, Theorem F itself: the hazard interpolation (F4)-(F8), the block bound (F12) and the budget (F2), the 20-digit `ρ*` enclosure (F3); attainment of the `sInf`; alignment of `RealizedData`/`IsRealizedFamily`/`downset`/`coverCost`/`mu` with the informal objects (PENDING_INDEPENDENT_REVIEW), any prize statement | +| Side24 (`Specifications.Side24`) | elementary exponential bounds, a term-ratio bound, the D2 cone-moment algebra, the reference-coefficient identity, the elementary cone integral, as the Props state them | the coefficient enclosure `c_{d,24}` (REVIEWED_SCOPED is transcribed, not derived), the Gaussian-moment and derivative-bound statements, the lattice image sum over a `tsum`, the interface-level statements | +| RN (`Specifications.RN`) | the elementary probability identities and bounds N1–N5 as the Props state them, for the interface objects they quantify over | the Radon–Nikodym uniformity lemma `D3-LEMMA-RN-UNIF` (OPEN), the five validity premises of Theorem D1 v2.2(2) (OPEN), any identification of the interface with the actual field | +| Lifetime, Field | nothing is expected to be provable (interface-level statements); no theorem is inventoried | everything | + +The three lines of each theorem's docstring (`Proves:`, `Method:`, `Does not establish:`) are the +per-theorem version of this table and are required by the gate. + +## Labels + +* Source mode prints `formalization_status: "proved"`: the label of a committed proof package. +* The run receipt prints `formalization_status: "kernel-checked"`: a label that appears only in a + receipt, about the inventoried theorems, after a fresh build, `leanchecker` and `#print axioms`. +* `alignment_status: "PENDING_INDEPENDENT_REVIEW"` everywhere. +* `scientific_effect: "NONE"`, `scientific_status_authority: false` everywhere. +* A receipt produced with `--allow-dirty` says `worktree: "UNVERIFIED"` and is not evidence about + any commit. + +## Next step + +Independent (not same-provider) alignment review of each registered statement against its Layer 0 +anchor, recorded in the review lane; nothing in this packet substitutes for it. diff --git a/specifications/lean_statement_proofs_20261011/SpecificationProofs.lean b/specifications/lean_statement_proofs_20261011/SpecificationProofs.lean new file mode 100644 index 000000000..7ad5fd68a --- /dev/null +++ b/specifications/lean_statement_proofs_20261011/SpecificationProofs.lean @@ -0,0 +1,7 @@ +import SpecificationProofs.P15Elementary +import SpecificationProofs.P15Structure +import SpecificationProofs.P15Hazard +import SpecificationProofs.P15Covers +import SpecificationProofs.P15Budget +import SpecificationProofs.Side24Elementary +import SpecificationProofs.RNProbability diff --git a/specifications/lean_statement_proofs_20261011/SpecificationProofs/P15Budget.lean b/specifications/lean_statement_proofs_20261011/SpecificationProofs/P15Budget.lean new file mode 100644 index 000000000..1bf98aaed --- /dev/null +++ b/specifications/lean_statement_proofs_20261011/SpecificationProofs/P15Budget.lean @@ -0,0 +1,469 @@ +import Specifications.P15 +import SpecificationProofs.P15Structure +import SpecificationProofs.P15Elementary +import SpecificationProofs.P15Hazard + +/-! +# P15 budget proofs: the hazard bound (P8), the restricted transformed-price budget (T1), (T4), +(T5) and the six-block transformed range + +Scientific effect: NONE. Organizational-independence credit: 0 (Anthropic / Claude). + +Every theorem outside the `Aux` namespace has as its type exactly one registered `Prop` of +`Specifications/P15.lean` (statement packet `specifications/lean_statements_20261010`, which is +not modified here). A kernel-checked proof of such a `Prop` is evidence about that `Prop` only: +it does not make the informal Layer 0 note reviewed, accepted or "verified", it does not +identify the formal definitions with the informal objects (that alignment is +PENDING_INDEPENDENT_REVIEW), and it promotes, closes, discharges or reclassifies nothing. + +Helper lemmas live in `UniversalLaw.Proofs.P15Budget.Aux`; the gate inventories only the +theorems outside that namespace. The module assembles the block-local price bounds of +`P15Hazard` (the marginal bound `prod_{v in S} p_v ≤ q_i` for `|S| ≥ a_i + 1`) and of +`P15Elementary` (`-log(1-p) ≤ p/(1-p)` and the exponent arithmetic `4^(a+1)/3^n ≤ 16/27`) with +the cover criterion `fullBlockCoverIff` of `P15Structure` and the factorised hazard +`sum_i q_i ≤ -log mu_p(D)` of `P15Hazard` into bounds on the infimum `coverCost`: the set of cover +prices is bounded below by `0`, the cover `{∅}` has price `1`, and the full-block family covers +the obstruction exactly when `K ≥ K_H(d)`. +-/ + +namespace UniversalLaw.Proofs.P15Budget + +open UniversalLaw.Spec.P15 +open Finset + +namespace Aux + +/-! ### Cover prices and the infimum `coverCost` -/ + +/-- Family prices are nonnegative for nonnegative prices. -/ +theorem famPrice_nonneg {Y : Type} {c : Y → ℝ} (hc : ∀ v, 0 ≤ c v) (G : Finset (Finset Y)) : + 0 ≤ famPrice c G := + Finset.sum_nonneg fun _ _ => Finset.prod_nonneg fun v _ => hc v + +/-- The set of prices of generator covers is bounded below by `0`. -/ +theorem coverSet_bddBelow {X : Type} [Fintype X] [DecidableEq X] (F : RealizedData X) (K : ℕ) + {c : X → ℝ} (hc : ∀ v, 0 ≤ c v) : + BddBelow {t : ℝ | ∃ G : Finset (Finset X), IsGeneratorCover F K G ∧ famPrice c G = t} := by + refine ⟨0, ?_⟩ + rintro t ⟨G, -, rfl⟩ + exact famPrice_nonneg hc G + +/-- The infimum is at most the price of any generator cover. -/ +theorem coverCost_le_famPrice {X : Type} [Fintype X] [DecidableEq X] (F : RealizedData X) + (K : ℕ) {c : X → ℝ} (hc : ∀ v, 0 ≤ c v) {G : Finset (Finset X)} + (hG : IsGeneratorCover F K G) : coverCost F K c ≤ famPrice c G := + csInf_le (coverSet_bddBelow F K hc) ⟨G, hG, rfl⟩ + +/-- `{∅}` covers every obstruction. -/ +theorem isGeneratorCover_singleton_empty {X : Type} [Fintype X] [DecidableEq X] + (F : RealizedData X) (K : ℕ) : IsGeneratorCover F K {∅} := + fun U _ => ⟨∅, Finset.mem_singleton_self _, Finset.empty_subset U⟩ + +/-- The cover `{∅}` has price `1`. -/ +theorem famPrice_singleton_empty {Y : Type} (c : Y → ℝ) : famPrice c {∅} = 1 := by + simp [famPrice, genPrice] + +/-- `covercost ≤ 1` (the cover `{∅}`). -/ +theorem coverCost_le_one {X : Type} [Fintype X] [DecidableEq X] (F : RealizedData X) (K : ℕ) + {c : X → ℝ} (hc : ∀ v, 0 ≤ c v) : coverCost F K c ≤ 1 := by + have h := coverCost_le_famPrice F K hc (isGeneratorCover_singleton_empty F K) + rwa [famPrice_singleton_empty] at h + +/-- For `K ≥ K_H(d)` the full blocks cover, so `covercost ≤ sum_i price(X_i)`. -/ +theorem coverCost_le_sum_block {X : Type} [Fintype X] [DecidableEq X] {F : RealizedData X} + (hF : IsRealizedFamily F) {c : X → ℝ} (hc : ∀ v, 0 ≤ c v) {K : ℕ} + (hK : paletteNumber F.b F.H F.d ≤ K) : + coverCost F K c ≤ ∑ i, genPrice c (block F i) := by + have hcover : IsGeneratorCover F K (fullBlockFamily F) := + (P15Structure.fullBlockCoverIff F hF K).2 hK + rw [← P15Structure.Aux.famPrice_fullBlockFamily hF c] + exact coverCost_le_famPrice F K hc hcover + +/-- A quantity at most `1` and, for `m > 0`, at most `ρ (-log m)` is at most the capped hazard. -/ +theorem le_cappedHazard_of {ρ m x : ℝ} (hx1 : x ≤ 1) (hx2 : 0 < m → x ≤ ρ * -Real.log m) : + x ≤ cappedHazard ρ m := by + unfold cappedHazard + split_ifs with h + · exact le_min hx1 (hx2 h) + · exact hx1 + +/-- `sum_i q_i ≤ -log mu_p(D)` when `mu_p(D) > 0` (display (P5)/(T6), from `P15Hazard`). -/ +theorem sum_localFailure_le_neg_log_mu {X : Type} [Fintype X] [DecidableEq X] + {F : RealizedData X} (hF : IsRealizedFamily F) {p : X → ℝ} (hp : ∀ v, 0 ≤ p v ∧ p v ≤ 1) + (hmu : 0 < mu F p) : ∑ i, localFailure F p i ≤ -Real.log (mu F p) := by + have h := (P15Hazard.independentBlockHazard F hF p hp).2 hmu + exact h.1.trans h.2 + +/-! ### The ratio bound of (T3)/(T5) -/ + +/-- `phi(p) ≤ p/(1-p)` for `0 ≤ p < 1` (display (T2)). -/ +theorem phi_le_div {p : ℝ} (h0 : 0 ≤ p) (h1 : p < 1) : phi p ≤ p / (1 - p) := by + unfold phi + simp only [h1, ↓reduceIte] + exact (min_le_right _ _).trans (P15Elementary.logRatioBound p h0 h1) + +/-- The first two steps of (T3): `prod_{X_i} c ≤ prod_{X_i} p/(1-p)`, split along `S ⊆ X_i`. -/ +theorem genPrice_le_ratio {X : Type} [Fintype X] [DecidableEq X] (F : RealizedData X) + {p c : X → ℝ} (hc : ∀ v, 0 ≤ c v ∧ c v ≤ phi (p v)) {i : Fin F.b} + (hp : ∀ v ∈ block F i, 0 ≤ p v ∧ p v < 1) {S : Finset X} (hS : S ⊆ block F i) : + genPrice c (block F i) ≤ + (∏ v ∈ S, p v) * ((∏ v ∈ block F i \ S, p v) * ∏ v ∈ block F i, (1 - p v)⁻¹) := by + have h1 : genPrice c (block F i) ≤ ∏ v ∈ block F i, p v * (1 - p v)⁻¹ := by + unfold genPrice + refine Finset.prod_le_prod₀ (fun v _ => (hc v).1) fun v hv => ?_ + rw [← div_eq_mul_inv] + exact (hc v).2.trans (phi_le_div (hp v hv).1 (hp v hv).2) + refine h1.trans (le_of_eq ?_) + rw [Finset.prod_mul_distrib, + show ∏ v ∈ block F i, p v = (∏ v ∈ block F i \ S, p v) * ∏ v ∈ S, p v from + (Finset.prod_sdiff hS).symm] + ring + +/-- A product of coordinates in `[0, B]` is at most `B^|s|`. -/ +theorem prod_le_pow_of_le {X : Type} {s : Finset X} {p : X → ℝ} {B : ℝ} + (hp : ∀ v ∈ s, 0 ≤ p v ∧ p v ≤ B) : ∏ v ∈ s, p v ≤ B ^ s.card := by + rw [← Finset.prod_const] + exact Finset.prod_le_prod₀ (fun v hv => (hp v hv).1) (fun v hv => (hp v hv).2) + +/-- A product of `(1 - p_v)⁻¹` with `p_v ≤ B < 1` is at most `((1 - B)⁻¹)^|s|`. -/ +theorem prod_inv_le_pow {X : Type} {s : Finset X} {p : X → ℝ} {B : ℝ} (hB : B < 1) + (hp : ∀ v ∈ s, p v ≤ B) : ∏ v ∈ s, (1 - p v)⁻¹ ≤ ((1 - B)⁻¹) ^ s.card := by + rw [← Finset.prod_const] + refine Finset.prod_le_prod₀ (fun v hv => ?_) (fun v hv => ?_) + · exact inv_nonneg.2 (by linarith [hp v hv]) + · exact inv_anti₀ (by linarith) (by linarith [hp v hv]) + +/-- The ratio bound: for `0 ≤ c ≤ phi(p)`, `0 ≤ p ≤ B < 1` on the block and `S ⊆ X_i`, +`price(X_i) ≤ (prod_{S} p) * B^(n - |S|) * (1 - B)^(-n)`. -/ +theorem genPrice_le_prod_mul_ratio {X : Type} [Fintype X] [DecidableEq X] (F : RealizedData X) + {p c : X → ℝ} (hc : ∀ v, 0 ≤ c v ∧ c v ≤ phi (p v)) {i : Fin F.b} {B : ℝ} (hB0 : 0 ≤ B) + (hB : B < 1) (hp : ∀ v ∈ block F i, 0 ≤ p v ∧ p v ≤ B) {S : Finset X} + (hS : S ⊆ block F i) : + genPrice c (block F i) ≤ + (∏ v ∈ S, p v) * (B ^ ((block F i).card - S.card) * ((1 - B)⁻¹) ^ (block F i).card) := by + have hp' : ∀ v ∈ block F i, 0 ≤ p v ∧ p v < 1 := + fun v hv => ⟨(hp v hv).1, (hp v hv).2.trans_lt hB⟩ + refine (genPrice_le_ratio F hc hp' hS).trans ?_ + refine mul_le_mul_of_nonneg_left ?_ (Finset.prod_nonneg fun v hv => (hp v (hS hv)).1) + rw [← Finset.card_sdiff_of_subset hS] + refine mul_le_mul (prod_le_pow_of_le fun v hv => hp v (mem_sdiff.1 hv).1) + (prod_inv_le_pow hB fun v hv => (hp v hv).2) + (Finset.prod_nonneg fun v hv => inv_nonneg.2 (by linarith [(hp' v hv).2])) + (pow_nonneg hB0 _) + +/-- The exponent identity behind (T3): `(1/4)^m (4/3)^(m+k) = 4^k / 3^(m+k)`. -/ +theorem quarter_pow_identity (m k : ℕ) : + (1 / 4 : ℝ) ^ m * (4 / 3) ^ (m + k) = 4 ^ k / 3 ^ (m + k) := by + rw [div_pow, div_pow, one_pow, pow_add] + field_simp + +/-- Display (T3) in the form used here: for `a ≥ 1`, `n ≥ 2a + 1`, +`(1/4)^(n-a-1) (3/4)^(-n) ≤ 16/27`. -/ +theorem quarter_ratio_le {a n : ℕ} (ha : 1 ≤ a) (hn : 2 * a + 1 ≤ n) : + (1 / 4 : ℝ) ^ (n - (a + 1)) * ((1 - 1 / 4)⁻¹) ^ n ≤ 16 / 27 := by + obtain ⟨m, rfl⟩ : ∃ m, n = m + (a + 1) := ⟨n - (a + 1), (Nat.sub_add_cancel (by omega)).symm⟩ + rw [Nat.add_sub_cancel, show ((1 : ℝ) - 1 / 4)⁻¹ = 4 / 3 by norm_num, quarter_pow_identity] + have h := P15Elementary.ratioExponentBound a (m + (a + 1)) ha hn + exact h.1.trans h.2 + +/-! ### Block-local hypotheses -/ + +/-- `localGood` depends on `p` only through its values on the block. -/ +theorem localGood_congr {X : Type} [Fintype X] [DecidableEq X] (F : RealizedData X) + {p p' : X → ℝ} {i : Fin F.b} (h : ∀ v ∈ block F i, p v = p' v) : + localGood F p i = localGood F p' i := by + unfold localGood + refine Finset.sum_congr rfl fun S hS => ?_ + rw [mem_powerset] at hS + have e1 : ∏ v ∈ S, p v = ∏ v ∈ S, p' v := Finset.prod_congr rfl fun v hv => h v (hS hv) + have e2 : ∏ v ∈ block F i \ S, (1 - p v) = ∏ v ∈ block F i \ S, (1 - p' v) := + Finset.prod_congr rfl fun v hv => by rw [h v (mem_sdiff.1 hv).1] + by_cases hmem : S ∈ downset F + · rw [Set.indicator_of_mem hmem, Set.indicator_of_mem hmem, e1, e2] + · rw [Set.indicator_of_notMem hmem, Set.indicator_of_notMem hmem] + +/-- `localFailure` depends on `p` only through its values on the block. -/ +theorem localFailure_congr {X : Type} [Fintype X] [DecidableEq X] (F : RealizedData X) + {p p' : X → ℝ} {i : Fin F.b} (h : ∀ v ∈ block F i, p v = p' v) : + localFailure F p i = localFailure F p' i := by + unfold localFailure + rw [localGood_congr F h] + +/-- The marginal bound `prod_{v in S} p_v ≤ q_i` of `P15Hazard` under block-local hypotheses +only (`p` is replaced by its restriction to the block, zero elsewhere). -/ +theorem prod_le_localFailure_of_card_local {X : Type} [Fintype X] [DecidableEq X] + (F : RealizedData X) {p : X → ℝ} {i : Fin F.b} (hp : ∀ v ∈ block F i, 0 ≤ p v ∧ p v ≤ 1) + {S : Finset X} (hS : S ⊆ block F i) (hcard : F.a i + 1 ≤ S.card) : + ∏ v ∈ S, p v ≤ localFailure F p i := by + set p' : X → ℝ := fun v => if v ∈ block F i then p v else 0 with hp'def + have hagree : ∀ v ∈ block F i, p v = p' v := fun v hv => by simp [hp'def, hv] + have hp' : ∀ v, 0 ≤ p' v ∧ p' v ≤ 1 := fun v => by + by_cases hv : v ∈ block F i + · simp only [hp'def, hv, ↓reduceIte] + exact hp v hv + · simp only [hp'def, hv, ↓reduceIte] + exact ⟨le_rfl, zero_le_one⟩ + rw [localFailure_congr F hagree, Finset.prod_congr rfl fun v hv => hagree v (hS hv)] + exact P15Hazard.Aux.prod_le_localFailure_of_card F hp' hS hcard + +/-! ### The local budget (T4) -/ + +/-- Display (T4), first inequality: for `a_i ≥ 1`, `d_i ≥ 2`, `0 ≤ p ≤ 1/4` and +`0 ≤ c ≤ phi(p)`, `price(X_i) ≤ (16/27) q_i`. -/ +theorem genPrice_le_budget {X : Type} [Fintype X] [DecidableEq X] {F : RealizedData X} + (hF : IsRealizedFamily F) (hd : ∀ i, 2 ≤ F.d i) {p c : X → ℝ} + (hp : ∀ v, 0 ≤ p v ∧ p v ≤ 1 / 4) (hc : ∀ v, 0 ≤ c v ∧ c v ≤ phi (p v)) (i : Fin F.b) : + genPrice c (block F i) ≤ (16 / 27) * localFailure F p i := by + have hn : (block F i).card = F.a i * F.d i + 1 := hF.2.2.1 i + have ha : 1 ≤ F.a i := hF.1 i + have hmul : F.a i * 2 ≤ F.a i * F.d i := Nat.mul_le_mul_left (F.a i) (hd i) + have hn2 : 2 * F.a i + 1 ≤ (block F i).card := by rw [hn]; linarith + have hcard : F.a i + 1 ≤ (block F i).card := by linarith + obtain ⟨S, hS, hScard⟩ := Finset.exists_subset_card_eq hcard + have hp1 : ∀ v, 0 ≤ p v ∧ p v ≤ 1 := fun v => ⟨(hp v).1, (hp v).2.trans (by norm_num)⟩ + have h1 := genPrice_le_prod_mul_ratio F hc (by norm_num : (0 : ℝ) ≤ 1 / 4) + (by norm_num : (1 / 4 : ℝ) < 1) (fun v _ => hp v) hS + have hprodS : ∏ v ∈ S, p v ≤ localFailure F p i := + P15Hazard.Aux.prod_le_localFailure_of_card F hp1 hS (by rw [hScard]) + have hprodS0 : 0 ≤ ∏ v ∈ S, p v := Finset.prod_nonneg fun v _ => (hp v).1 + calc genPrice c (block F i) + ≤ (∏ v ∈ S, p v) * + ((1 / 4) ^ ((block F i).card - S.card) * ((1 - 1 / 4)⁻¹) ^ (block F i).card) := h1 + _ ≤ (∏ v ∈ S, p v) * (16 / 27) := by + refine mul_le_mul_of_nonneg_left ?_ hprodS0 + rw [hScard] + exact quarter_ratio_le ha hn2 + _ = (16 / 27) * ∏ v ∈ S, p v := mul_comm _ _ + _ ≤ (16 / 27) * localFailure F p i := mul_le_mul_of_nonneg_left hprodS (by norm_num) + +/-- The summed budget: `sum_i price(X_i) ≤ (16/27) (-log mu_p(D))` when `mu_p(D) > 0`. -/ +theorem sum_genPrice_le_budget {X : Type} [Fintype X] [DecidableEq X] {F : RealizedData X} + (hF : IsRealizedFamily F) (hd : ∀ i, 2 ≤ F.d i) {p c : X → ℝ} + (hp : ∀ v, 0 ≤ p v ∧ p v ≤ 1 / 4) (hc : ∀ v, 0 ≤ c v ∧ c v ≤ phi (p v)) + (hmu : 0 < mu F p) : + ∑ i, genPrice c (block F i) ≤ (16 / 27) * -Real.log (mu F p) := by + have hp1 : ∀ v, 0 ≤ p v ∧ p v ≤ 1 := fun v => ⟨(hp v).1, (hp v).2.trans (by norm_num)⟩ + calc ∑ i, genPrice c (block F i) + ≤ ∑ i, (16 / 27) * localFailure F p i := + Finset.sum_le_sum fun i _ => genPrice_le_budget hF hd hp hc i + _ = (16 / 27) * ∑ i, localFailure F p i := by rw [Finset.mul_sum] + _ ≤ (16 / 27) * -Real.log (mu F p) := + mul_le_mul_of_nonneg_left (sum_localFailure_le_neg_log_mu hF hp1 hmu) (by norm_num) + +/-! ### Positivity of `mu_p(D)` -/ + +/-- The weight is nonnegative for `p in [0,1]^X`. -/ +theorem weight_nonneg {Y : Type} [Fintype Y] [DecidableEq Y] {p : Y → ℝ} + (hp : ∀ v, 0 ≤ p v ∧ p v ≤ 1) (U : Finset Y) : 0 ≤ weight p U := by + unfold weight + refine mul_nonneg (Finset.prod_nonneg fun v _ => (hp v).1) (Finset.prod_nonneg fun v _ => ?_) + linarith [(hp v).2] + +/-- The empty set is good when every edge of `H` has at least two elements. -/ +theorem isGood_empty {X : Type} [Fintype X] [DecidableEq X] {F : RealizedData X} + (hH : ∀ e ∈ F.H, 2 ≤ e.card) : IsGood F ∅ := by + refine ⟨fun i => by simp, fun e he hsub => ?_⟩ + have h0 : e = ∅ := subset_empty.1 (by simpa [supp] using hsub) + have h2 := hH e he + rw [h0, card_empty] at h2 + omega + +/-- `mu_p(D) > 0` for `0 ≤ p < 1` coordinatewise: the empty set is good and has positive weight. -/ +theorem mu_pos {X : Type} [Fintype X] [DecidableEq X] {F : RealizedData X} + (hF : IsRealizedFamily F) {p : X → ℝ} (hp : ∀ v, 0 ≤ p v ∧ p v < 1) : 0 < mu F p := by + have hp1 : ∀ v, 0 ≤ p v ∧ p v ≤ 1 := fun v => ⟨(hp v).1, (hp v).2.le⟩ + have hterm : ∀ U ∈ (univ : Finset X).powerset, 0 ≤ Set.indicator (downset F) (weight p) U := + fun U _ => Set.indicator_nonneg (fun T _ => weight_nonneg hp1 T) U + have hle := Finset.single_le_sum hterm (mem_powerset.2 (empty_subset univ)) + refine lt_of_lt_of_le ?_ hle + rw [Set.indicator_of_mem (show (∅ : Finset X) ∈ downset F from isGood_empty hF.2.2.2.1)] + unfold weight + rw [prod_empty, one_mul] + exact Finset.prod_pos fun v _ => by linarith [(hp v).2] + +/-! ### The six-block benchmark at `p = 1/40900` -/ + +/-- `log(40900/40899) ≤ 1/40899`. -/ +theorem log_benchmark_le : Real.log (40900 / 40899) ≤ 1 / 40899 := by + have h := Real.log_le_sub_one_of_pos (by norm_num : (0 : ℝ) < 40900 / 40899) + linarith + +/-- `phi(1/40900) = log(40900/40899)`. -/ +theorem phi_benchmark : phi (1 / 40900) = Real.log (40900 / 40899) := by + have hlt : (1 : ℝ) / 40900 < 1 := by norm_num + unfold phi + simp only [hlt, ↓reduceIte] + rw [show (1 : ℝ) - 1 / 40900 = (40900 / 40899)⁻¹ by norm_num, Real.log_inv, neg_neg] + exact min_eq_right (log_benchmark_le.trans (by norm_num)) + +/-- Each full-block price at `c ≤ log(40900/40899)` is at most `1/40899`. -/ +theorem genPrice_benchmark_le {c : Fin 6 × Fin 409 → ℝ} + (hc : ∀ v, 0 ≤ c v ∧ c v ≤ Real.log (40900 / 40899)) (i : Fin benchmark816.b) : + genPrice c (block benchmark816 i) ≤ 1 / 40899 := by + calc genPrice c (block benchmark816 i) + ≤ ∏ _v ∈ block benchmark816 i, (1 / 40899 : ℝ) := + Finset.prod_le_prod₀ (fun v _ => (hc v).1) (fun v _ => (hc v).2.trans log_benchmark_le) + _ = (1 / 40899) ^ 409 := by rw [prod_const, P15Structure.Aux.card_block_benchmark816] + _ ≤ 1 / 40899 := pow_le_of_le_one (by norm_num) (by norm_num) (by norm_num) + +/-- The full-block price at `c ≤ log(40900/40899)` is at most `6/40899 ≤ 1`. -/ +theorem famPrice_benchmark_le_one {c : Fin 6 × Fin 409 → ℝ} + (hc : ∀ v, 0 ≤ c v ∧ c v ≤ Real.log (40900 / 40899)) : + famPrice c (fullBlockFamily benchmark816) ≤ 1 := by + rw [P15Structure.Aux.famPrice_fullBlockFamily P15Structure.Aux.benchmark816_isRealized c] + calc ∑ i, genPrice c (block benchmark816 i) + ≤ ∑ _i : Fin benchmark816.b, (1 / 40899 : ℝ) := + Finset.sum_le_sum fun i _ => genPrice_benchmark_le hc i + _ = 6 * (1 / 40899) := by + rw [sum_const, card_univ] + change (6 : ℕ) • ((1 : ℝ) / 40899) = 6 * (1 / 40899) + rw [nsmul_eq_mul] + norm_num + _ ≤ 1 := by norm_num + +end Aux + +/-! ## Inventory theorems -/ + +/-- Proves: `UniversalLaw.Spec.P15.CoverCostHazardBound` (claim `p15-realized-covers`, display +(P8)). +Method: the set of cover prices is bounded below by `0`; the cover `{∅}` has price `1`, so +`covercost ≤ 1` (`csInf_le`); for `K ≥ K_H(d)` the full blocks cover (`fullBlockCoverIff`), so +`covercost ≤ sum_i price(X_i) ≤ sum_i q_i` (display (P4), `P15Hazard.localPriceChain`) and, when +`mu_p(D) > 0`, `sum_i q_i ≤ -log mu_p(D)` (display (P5), `P15Hazard.independentBlockHazard`). +Does not establish: the informal display (P8) or its review and acceptance; anything for prices +`c_v > p_v`; attainment of the infimum; the alignment of `coverCost`, `mu`, `localFailure` with +the source's objects (PENDING_INDEPENDENT_REVIEW); the unrestricted P15 prize or original P15-B; +the disposition HOLD_WITH_DOMAIN of `p15-realized-covers`, which is transcribed in the register, +not derived here. -/ +theorem coverCostHazardBound {X : Type} [Fintype X] [DecidableEq X] (F : RealizedData X) : + UniversalLaw.Spec.P15.CoverCostHazardBound F := by + intro hF p c hp hc K hK + have hc0 : ∀ v, 0 ≤ c v := fun v => (hc v).1 + refine Aux.le_cappedHazard_of (Aux.coverCost_le_one F K hc0) fun hmu => ?_ + rw [one_mul] + calc coverCost F K c ≤ ∑ i, genPrice c (block F i) := Aux.coverCost_le_sum_block hF hc0 hK + _ ≤ ∑ i, localFailure F p i := by + refine Finset.sum_le_sum fun i _ => ?_ + have h := P15Hazard.localPriceChain F hF p c hp hc i + exact h.1.trans h.2.1 + _ ≤ -Real.log (mu F p) := Aux.sum_localFailure_le_neg_log_mu hF hp hmu + +/-- Proves: `UniversalLaw.Spec.P15.RestrictedLocalBudget` (claim `p15-price-budget-restricted`, +display (T4)). +Method: `phi(p) ≤ -log(1-p) ≤ p/(1-p)` (display (T2), `P15Elementary.logRatioBound`); a subset +`S ⊆ X_i` with `|S| = a_i + 1` exists since `|X_i| = a_i d_i + 1`; `prod_{X_i} c ≤ prod_{X_i} +p/(1-p) ≤ (prod_S p) (1/4)^(n-a-1) (4/3)^n = (prod_S p) 4^(a+1)/3^n ≤ (16/27) prod_S p` +(display (T3), `P15Elementary.ratioExponentBound` with `n ≥ 2a + 1` from `d_i ≥ 2`); `prod_S p ≤ +q_i` (block-local marginal bound of `P15Hazard`); `(16/27) q ≤ q ≤ phi(q)` on `[0, 1]`. +Does not establish: the informal display (T4) or its review and acceptance; sharpness of the +range `p_v ≤ 1/4` (the source: "a sufficient range, not an asserted sharp threshold"); anything +at `d_i = 1` (the source's refutation stands); the alignment of `localFailure`, `phi` with the +source's objects (PENDING_INDEPENDENT_REVIEW); the disposition HOLD_WITH_DOMAIN of +`p15-price-budget-restricted`, which is transcribed in the register, not derived here. -/ +theorem restrictedLocalBudget {X : Type} [Fintype X] [DecidableEq X] (F : RealizedData X) : + UniversalLaw.Spec.P15.RestrictedLocalBudget F := by + intro hF hd p c hp hc i + have hp1 : ∀ v, 0 ≤ p v ∧ p v ≤ 1 := fun v => ⟨(hp v).1, (hp v).2.trans (by norm_num)⟩ + refine ⟨Aux.genPrice_le_budget hF hd hp hc i, ?_⟩ + have hq0 := P15Hazard.Aux.localFailure_nonneg F hp1 i + have hq1 := P15Hazard.Aux.localFailure_le_one F hp1 i + calc (16 / 27) * localFailure F p i ≤ 1 * localFailure F p i := + mul_le_mul_of_nonneg_right (by norm_num) hq0 + _ = localFailure F p i := one_mul _ + _ ≤ phi (localFailure F p i) := P15Hazard.Aux.le_phi_self hq1 + +/-- Proves: `UniversalLaw.Spec.P15.RhoTestSufficient` (claim `p15-price-budget-restricted`, +display (T5)). +Method: the same ratio argument as (T3) with the common bound `p_*`: for `S ⊆ X_i` with +`|S| = a_i + 1`, `prod_{X_i} c ≤ prod_{X_i} p/(1-p) ≤ (prod_S p) p_*^(n-a-1) (1-p_*)^(-n) = +(prod_S p) rho(a_i, d_i, p_*) ≤ prod_S p` since `n = a_i d_i + 1`, and `prod_S p ≤ q_i` by the +block-local marginal bound (`p` restricted to the block, as only the block's coordinates enter +`q_i`). +Does not establish: the informal display (T5) or its review and acceptance; anything when +`rho > 1` (the source: "rho>1 is not a counterexample and must not be labeled infeasible"); the +alignment of `localFailure`, `phi`, `rhoTest` with the source's objects +(PENDING_INDEPENDENT_REVIEW); the disposition HOLD_WITH_DOMAIN of `p15-price-budget-restricted`, +which is transcribed in the register, not derived here. -/ +theorem rhoTestSufficient {X : Type} [Fintype X] [DecidableEq X] (F : RealizedData X) : + UniversalLaw.Spec.P15.RhoTestSufficient F := by + intro hF p c pBound hB0 hB1 hc i hp hrho + have hn : (block F i).card = F.a i * F.d i + 1 := hF.2.2.1 i + have hcard : F.a i + 1 ≤ (block F i).card := by + rw [hn] + have := Nat.le_mul_of_pos_right (F.a i) (hF.2.1 i) + omega + obtain ⟨S, hS, hScard⟩ := Finset.exists_subset_card_eq hcard + have h1 := Aux.genPrice_le_prod_mul_ratio F hc hB0 hB1 hp hS + have hprodS0 : 0 ≤ ∏ v ∈ S, p v := Finset.prod_nonneg fun v hv => (hp v (hS hv)).1 + have hp1 : ∀ v ∈ block F i, 0 ≤ p v ∧ p v ≤ 1 := + fun v hv => ⟨(hp v hv).1, (hp v hv).2.trans hB1.le⟩ + have hprodS : ∏ v ∈ S, p v ≤ localFailure F p i := + Aux.prod_le_localFailure_of_card_local F hp1 hS (by rw [hScard]) + have hrho' : pBound ^ ((block F i).card - S.card) * ((1 - pBound)⁻¹) ^ (block F i).card = + rhoTest (F.a i) (F.d i) pBound := by + rw [hScard, hn, rhoTest, Nat.add_sub_add_right, div_eq_mul_inv, inv_pow] + calc genPrice c (block F i) + ≤ (∏ v ∈ S, p v) * + (pBound ^ ((block F i).card - S.card) * ((1 - pBound)⁻¹) ^ (block F i).card) := h1 + _ = (∏ v ∈ S, p v) * rhoTest (F.a i) (F.d i) pBound := by rw [hrho'] + _ ≤ (∏ v ∈ S, p v) * 1 := mul_le_mul_of_nonneg_left hrho hprodS0 + _ = ∏ v ∈ S, p v := mul_one _ + _ ≤ localFailure F p i := hprodS + +/-- Proves: `UniversalLaw.Spec.P15.RestrictedTransformedPriceBudget` (claim +`p15-price-budget-restricted`, display (T1)). +Method: `covercost ≤ 1` by the cover `{∅}`; for `K ≥ K_H(d)` the full blocks cover +(`fullBlockCoverIff`), so `covercost ≤ sum_i price(X_i) ≤ (16/27) sum_i q_i` (display (T4), the +local budget of this module) and, when `mu_p(D) > 0`, `sum_i q_i ≤ -log mu_p(D)` (display (T6), +`P15Hazard.independentBlockHazard`); the capped hazard handles `mu_p(D) = 0` by its convention. +Does not establish: the informal display (T1) or its review and acceptance; any retraction of the +demand-one refutation; the unrestricted prize; new classical coloring theory; attainment of the +infimum; the alignment of `coverCost`, `mu`, `phi` with the source's objects +(PENDING_INDEPENDENT_REVIEW); the disposition HOLD_WITH_DOMAIN of `p15-price-budget-restricted`, +which is transcribed in the register, not derived here. -/ +theorem restrictedTransformedPriceBudget {X : Type} [Fintype X] [DecidableEq X] + (F : RealizedData X) : UniversalLaw.Spec.P15.RestrictedTransformedPriceBudget F := by + intro hF hd p c hp hc K hK + have hc0 : ∀ v, 0 ≤ c v := fun v => (hc v).1 + refine Aux.le_cappedHazard_of (Aux.coverCost_le_one F K hc0) fun hmu => ?_ + exact (Aux.coverCost_le_sum_block hF hc0 hK).trans (Aux.sum_genPrice_le_budget hF hd hp hc hmu) + +/-- Proves: `UniversalLaw.Spec.P15.Benchmark816TransformedRange` (claim +`p15-price-budget-restricted`, Section 4 of price_budget PROOF.md). +Method: `1 - 1/40900 = (40900/40899)⁻¹`, `Real.log_inv` and `log(40900/40899) ≤ 1/40899 ≤ 1` +for the value of `phi`; the cover from `fullBlockCoverIff` and `K_H(408, ..., 408) = 816` +(`P15Structure.benchmark816Palette`); the price bound from six block prices `≤ (1/40899)^409 ≤ +1/40899` and from the summed local budget (T4) at `p_v = 1/40900 ≤ 1/4`, `d_i = 408 ≥ 2`, with +`mu_p(D) > 0` because the empty set is good with positive weight; the `covercost` bound is +`RestrictedTransformedPriceBudget` at these data. +Does not establish: the informal Section 4 or its review and acceptance; optimality of the +816-label cover; the whole-ground value `818` (a separate `Prop`); the alignment of the formal +objects with the source's (PENDING_INDEPENDENT_REVIEW); the disposition HOLD_WITH_DOMAIN of +`p15-price-budget-restricted`, which is transcribed in the register, not derived here. -/ +theorem benchmark816TransformedRange : UniversalLaw.Spec.P15.Benchmark816TransformedRange := by + have hF := P15Structure.Aux.benchmark816_isRealized + have hK : paletteNumber benchmark816.b benchmark816.H benchmark816.d ≤ 816 := + le_of_eq P15Structure.benchmark816Palette + have hcover : IsGeneratorCover benchmark816 816 (fullBlockFamily benchmark816) := + (P15Structure.fullBlockCoverIff benchmark816 hF 816).2 hK + refine ⟨Aux.phi_benchmark, hcover, fun c hc => ?_⟩ + have hp : ∀ v : Fin 6 × Fin 409, + 0 ≤ (fun _ => (1 : ℝ) / 40900) v ∧ (fun _ => (1 : ℝ) / 40900) v ≤ 1 / 4 := + fun _ => ⟨by norm_num, by norm_num⟩ + have hc' : ∀ v, 0 ≤ c v ∧ c v ≤ phi ((fun _ => (1 : ℝ) / 40900) v) := fun v => by + refine ⟨(hc v).1, ?_⟩ + show c v ≤ phi (1 / 40900) + rw [Aux.phi_benchmark] + exact (hc v).2 + have hd : ∀ i, 2 ≤ benchmark816.d i := fun _ => by + show (2 : ℕ) ≤ 408 + norm_num + have hmu : 0 < mu benchmark816 (fun _ => (1 : ℝ) / 40900) := + Aux.mu_pos hF fun _ => ⟨by norm_num, by norm_num⟩ + refine ⟨Aux.le_cappedHazard_of (Aux.famPrice_benchmark_le_one hc) fun _ => ?_, + restrictedTransformedPriceBudget benchmark816 hF hd _ c hp hc' 816 hK⟩ + rw [P15Structure.Aux.famPrice_fullBlockFamily hF c] + exact Aux.sum_genPrice_le_budget hF hd hp hc' hmu + +end UniversalLaw.Proofs.P15Budget diff --git a/specifications/lean_statement_proofs_20261011/SpecificationProofs/P15Covers.lean b/specifications/lean_statement_proofs_20261011/SpecificationProofs/P15Covers.lean new file mode 100644 index 000000000..70d845d7f --- /dev/null +++ b/specifications/lean_statement_proofs_20261011/SpecificationProofs/P15Covers.lean @@ -0,0 +1,285 @@ +import Specifications.P15 +import SpecificationProofs.P15Structure +import SpecificationProofs.P15Elementary + +/-! +# P15 realized-cover proofs: the six-block cover, the local restriction, attainment of the +palette number and the union bound (P11) + +Scientific effect: NONE. Organizational-independence credit: 0 (Anthropic / Claude). + +Every theorem in this module has as its type exactly one registered `Prop` of +`Specifications/P15.lean` (statement packet `specifications/lean_statements_20261010`, which is +not modified here). A kernel-checked proof of such a `Prop` is evidence about that `Prop` only: +it does not make the informal Layer 0 note reviewed, accepted or "verified", it does not +identify the formal definitions with the informal objects (that alignment is +PENDING_INDEPENDENT_REVIEW), and it promotes, closes, discharges or reclassifies nothing. + +Helper lemmas live in `UniversalLaw.Proofs.P15Covers.Aux`; the gate inventories only the +theorems outside that namespace. The general lemmas of `Aux` (the marginal identity +`sum_weight_filter_superset`, the union bound `one_sub_mu_le_sum_prod`, the existence of a +minimal forbidden subset of a bad set and the cardinality of a transversal) are stated for an +arbitrary finite ground type so that other modules may reuse them. +-/ + +namespace UniversalLaw.Proofs.P15Covers + +open UniversalLaw.Spec.P15 +open Finset + +namespace Aux + +/-! ### The product measure: nonnegative weights and the marginal of a fixed subset -/ + +/-- Weights are nonnegative for `p` in `[0,1]^Y`. -/ +theorem weight_nonneg {Y : Type} [Fintype Y] [DecidableEq Y] {p : Y → ℝ} + (hp : ∀ v, 0 ≤ p v ∧ p v ≤ 1) (U : Finset Y) : 0 ≤ weight p U := by + unfold weight + exact mul_nonneg (prod_nonneg fun v _ => (hp v).1) + (prod_nonneg fun v _ => by linarith [(hp v).2]) + +/-- The sets containing `M` are exactly the sets `M ∪ T` with `T ⊆ univ \ M`. -/ +theorem filter_superset_eq_image {Y : Type} [Fintype Y] [DecidableEq Y] (M : Finset Y) : + (univ : Finset Y).powerset.filter (fun U => M ⊆ U) = + ((univ : Finset Y) \ M).powerset.image (fun T => M ∪ T) := by + ext U + simp only [mem_filter, mem_powerset, subset_univ, true_and, mem_image] + constructor + · intro hMU + exact ⟨U \ M, sdiff_subset_sdiff (subset_univ U) subset_rfl, union_sdiff_of_subset hMU⟩ + · rintro ⟨T, -, rfl⟩ + exact subset_union_left + +/-- The weight of `M ∪ T` for `T` disjoint from `M` factors as the product of `p` over `M` times +the weight of `T` relative to the ground set `univ \ M`. -/ +theorem weight_union_of_disjoint {Y : Type} [Fintype Y] [DecidableEq Y] (p : Y → ℝ) + {M T : Finset Y} (h : Disjoint M T) : + weight p (M ∪ T) = + (∏ v ∈ M, p v) * ((∏ v ∈ T, p v) * ∏ v ∈ ((univ : Finset Y) \ M) \ T, (1 - p v)) := by + have hs : (univ : Finset Y) \ (M ∪ T) = ((univ : Finset Y) \ M) \ T := by + ext v + simp only [mem_sdiff, mem_univ, true_and, mem_union, not_or] + unfold weight + rw [prod_union h, mul_assoc, hs] + +/-- The marginal identity: the total weight of the sets containing a fixed `M` is +`∏_{v ∈ M} p v`, for any real vector `p` (no range hypothesis is needed). -/ +theorem sum_weight_filter_superset {Y : Type} [Fintype Y] [DecidableEq Y] (p : Y → ℝ) + (M : Finset Y) : + ∑ U ∈ (univ : Finset Y).powerset.filter (fun U => M ⊆ U), weight p U = ∏ v ∈ M, p v := by + rw [filter_superset_eq_image, sum_image] + · have h : ∀ T ∈ ((univ : Finset Y) \ M).powerset, weight p (M ∪ T) = + (∏ v ∈ M, p v) * ((∏ v ∈ T, p v) * ∏ v ∈ ((univ : Finset Y) \ M) \ T, (1 - p v)) := by + intro T hT + rw [mem_powerset] at hT + exact weight_union_of_disjoint p (disjoint_of_subset_right hT disjoint_sdiff) + rw [sum_congr rfl h, ← mul_sum, ← prod_add p (fun v => 1 - p v)] + have h1 : ∏ v ∈ (univ : Finset Y) \ M, (p v + (1 - p v)) = 1 := + prod_eq_one fun v _ => by ring + rw [h1, mul_one] + · intro T₁ hT₁ T₂ hT₂ h + rw [mem_coe, mem_powerset] at hT₁ hT₂ + have h' : M ∪ T₁ = M ∪ T₂ := h + have e₁ := union_sdiff_cancel_left (disjoint_of_subset_right hT₁ disjoint_sdiff (s := M)) + have e₂ := union_sdiff_cancel_left (disjoint_of_subset_right hT₂ disjoint_sdiff (s := M)) + rw [← e₁, ← e₂, h'] + +/-- The same marginal identity with the superset condition written as an `if`. -/ +theorem sum_weight_ite_superset {Y : Type} [Fintype Y] [DecidableEq Y] (p : Y → ℝ) + (M : Finset Y) : + ∑ U ∈ (univ : Finset Y).powerset, (if M ⊆ U then weight p U else 0) = ∏ v ∈ M, p v := by + rw [← sum_filter, sum_weight_filter_superset] + +/-! ### The bad probability and the union bound over a covering family -/ + +open Classical in +/-- `1 - mu_p(D)` is the total weight of the bad sets (classical decidability of `IsGood`). -/ +theorem one_sub_mu_eq {X : Type} [Fintype X] [DecidableEq X] (F : RealizedData X) (p : X → ℝ) : + 1 - mu F p = + ∑ U ∈ (univ : Finset X).powerset, (if IsGood F U then 0 else weight p U) := by + classical + have hmu : mu F p = ∑ U ∈ (univ : Finset X).powerset, (if IsGood F U then weight p U else 0) := by + unfold mu + refine sum_congr rfl fun U _ => ?_ + rw [Set.indicator_apply] + exact if_congr Iff.rfl rfl rfl + rw [hmu, ← UniversalLaw.Proofs.P15Elementary.Aux.sum_weight_eq_one p, ← sum_sub_distrib] + refine sum_congr rfl fun U _ => ?_ + split_ifs <;> ring + +/-- The union bound: if every bad set contains a member of the family `𝓜`, then +`1 - mu_p(D) ≤ ∑_{M ∈ 𝓜} ∏_{v ∈ M} p v`, for `p` in `[0,1]^X`. -/ +theorem one_sub_mu_le_sum_prod {X : Type} [Fintype X] [DecidableEq X] (F : RealizedData X) + (p : X → ℝ) (hp : ∀ v, 0 ≤ p v ∧ p v ≤ 1) (𝓜 : Finset (Finset X)) + (h𝓜 : ∀ U : Finset X, ¬ IsGood F U → ∃ M ∈ 𝓜, M ⊆ U) : + 1 - mu F p ≤ ∑ M ∈ 𝓜, ∏ v ∈ M, p v := by + classical + have hterm : ∀ U : Finset X, ∀ M : Finset X, + 0 ≤ (if M ⊆ U then weight p U else 0) := fun U M => by + split_ifs + · exact weight_nonneg hp U + · exact le_rfl + have h2 : ∀ U ∈ (univ : Finset X).powerset, (if IsGood F U then 0 else weight p U) ≤ + ∑ M ∈ 𝓜, (if M ⊆ U then weight p U else 0) := by + intro U _ + split_ifs with hU + · exact sum_nonneg fun M _ => hterm U M + · obtain ⟨M, hM, hMU⟩ := h𝓜 U hU + calc weight p U = (if M ⊆ U then weight p U else 0) := by simp [hMU] + _ ≤ ∑ M ∈ 𝓜, (if M ⊆ U then weight p U else 0) := + single_le_sum (fun M _ => hterm U M) hM + rw [one_sub_mu_eq] + calc ∑ U ∈ (univ : Finset X).powerset, (if IsGood F U then 0 else weight p U) + ≤ ∑ U ∈ (univ : Finset X).powerset, ∑ M ∈ 𝓜, (if M ⊆ U then weight p U else 0) := + sum_le_sum h2 + _ = ∑ M ∈ 𝓜, ∑ U ∈ (univ : Finset X).powerset, (if M ⊆ U then weight p U else 0) := + sum_comm + _ = ∑ M ∈ 𝓜, ∏ v ∈ M, p v := sum_congr rfl fun M _ => sum_weight_ite_superset p M + +/-! ### Minimal forbidden subsets of bad sets; the size of a transversal -/ + +/-- Every bad set contains an inclusion-minimal forbidden set. -/ +theorem exists_minimalForbidden_subset {X : Type} [Fintype X] [DecidableEq X] + (F : RealizedData X) (U : Finset X) (hU : ¬ IsGood F U) : + ∃ M : Finset X, IsMinimalForbidden F M ∧ M ⊆ U := by + induction U using Finset.strongInduction with + | H U ih => + by_cases h : ∃ v ∈ U, ¬ IsGood F (U.erase v) + · obtain ⟨v, hv, hbad⟩ := h + obtain ⟨M, hM, hMU⟩ := ih (U.erase v) (erase_ssubset hv) hbad + exact ⟨M, hM, hMU.trans (erase_subset v U)⟩ + · exact ⟨U, ⟨hU, fun v hv => of_not_not fun hb => h ⟨v, hv, hb⟩⟩, subset_rfl⟩ + +/-- A transversal of `e` has exactly `|e|` elements (one per block of `e`). -/ +theorem card_of_isTransversal {X : Type} [Fintype X] [DecidableEq X] {F : RealizedData X} + {e : Finset (Fin F.b)} {U : Finset X} (h : IsTransversal F e U) : U.card = e.card := by + obtain ⟨hsupp, hone⟩ := h + have hU : U = e.biUnion (fun i => U ∩ block F i) := by + ext v + simp only [mem_biUnion, mem_inter, UniversalLaw.Proofs.P15Structure.Aux.mem_block_iff] + constructor + · intro hv + refine ⟨F.blk v, ?_, hv, rfl⟩ + rw [← hsupp] + exact mem_image_of_mem _ hv + · rintro ⟨i, -, hv, -⟩ + exact hv + rw [hU, card_biUnion] + · rw [sum_congr rfl hone] + simp + · intro i _ j _ hij + exact (UniversalLaw.Proofs.P15Structure.Aux.block_disjoint F hij).mono + inter_subset_right inter_subset_right + +/-! ### The six-block benchmark at `p_v = 1/40900` -/ + +open UniversalLaw.Proofs.P15Structure.Aux in +/-- Every bad set of the six-block benchmark contains an internal pair or a transversal +quadruple. -/ +theorem benchmark816_bad_covered (U : Finset (Fin 6 × Fin 409)) + (hU : ¬ IsGood benchmark816 U) : ∃ M ∈ pairs816 ∪ transAll816, M ⊆ U := by + obtain ⟨M, hM, hMU⟩ := exists_minimalForbidden_subset benchmark816 U hU + refine ⟨M, ?_, hMU⟩ + rw [mem_union, mem_pairs816, mem_transAll816] + exact (minForb816_iff M).1 hM + +-- The style linter `constructorNameAsVariable` (variable names shadowing constructor names) +-- exhausts the recursion limit on this local context (as in `P15Structure`); it is a naming +-- linter, not a check. +set_option linter.constructorNameAsVariable false in +open UniversalLaw.Proofs.P15Structure.Aux in +/-- Display (P11), first line: the union bound over the `6 * C(409,2)` pairs and the +`15 * 409^4` transversal quadruples at `p_v = 1/40900`. -/ +theorem benchmark816_one_sub_mu_le : + 1 - mu benchmark816 (fun _ => (1 : ℝ) / 40900) ≤ 500616 / 40900 ^ 2 + 15 / 100 ^ 4 := by + have hp : ∀ v : Fin 6 × Fin 409, + 0 ≤ (fun _ => (1 : ℝ) / 40900) v ∧ (fun _ => (1 : ℝ) / 40900) v ≤ 1 := + fun _ => by norm_num + refine (one_sub_mu_le_sum_prod benchmark816 _ hp _ benchmark816_bad_covered).trans ?_ + rw [sum_union disjoint_pairs816_transAll816] + have hpair : ∀ M ∈ pairs816, ∏ v ∈ M, (fun _ => (1 : ℝ) / 40900) v = (1 / 40900) ^ 2 := by + intro M hM + obtain ⟨_, -, hcard⟩ := mem_pairs816.1 hM + rw [prod_const, hcard] + have htrans : ∀ M ∈ transAll816, + ∏ v ∈ M, (fun _ => (1 : ℝ) / 40900) v = (1 / 40900) ^ 4 := by + intro M hM + rw [mem_transAll816] at hM + obtain ⟨e, he, hT⟩ := hM + rw [prod_const, card_of_isTransversal hT, mem_H_benchmark816 he] + rw [sum_congr rfl hpair, sum_congr rfl htrans, sum_const, sum_const, card_pairs816, + card_transAll816, nsmul_eq_mul, nsmul_eq_mul] + have hc : Nat.choose 409 2 = 83436 := by + rw [Nat.choose_two_right] + rw [hc] + push_cast + norm_num + +end Aux + +/-- Proves: `UniversalLaw.Spec.P15.Benchmark816Cover` (claim `p15-realized-covers`, Section 6 of +P15_REALIZED_COVERS.md: "At816 colors it covers the obstruction; at815 it does not"). +Method: Proposition P2 (`FullBlockCoverIff`) for the six-block data, which satisfy +`IsRealizedFamily` (`Benchmark816IsRealized`), reduces both clauses to `816 ≤ K`, and +`Benchmark816Palette` evaluates the palette number to `816`. +Does not establish: the informal claim, its review or acceptance; alignment of the formal +`IsGeneratorCover`/`obstruction` with the informal notions; optimality of any other cover +(disposition transcribed in the statement: HOLD_WITH_DOMAIN). -/ +theorem benchmark816Cover : UniversalLaw.Spec.P15.Benchmark816Cover := by + have h := UniversalLaw.Proofs.P15Structure.fullBlockCoverIff benchmark816 + UniversalLaw.Proofs.P15Structure.benchmark816IsRealized + have hpal : paletteNumber benchmark816.b benchmark816.H benchmark816.d = 816 := + UniversalLaw.Proofs.P15Structure.benchmark816Palette + refine ⟨(h 816).2 (by rw [hpal]), fun hc => ?_⟩ + have h815 := (h 815).1 hc + rw [hpal] at h815 + omega + +/-- Proves: `UniversalLaw.Spec.P15.LocalRestriction` (claim `p15-realized-covers`, display (P2) of +P15_REALIZED_COVERS.md: `D_i = D ∩ 2^(X_i) = {S ⊆ X_i : |S| ≤ a_i}`). +Method: for `S ⊆ X_i`, `S ∩ X_i = S`, so goodness gives `|S| ≤ a_i`; conversely a subset of one +block with at most `a_i` elements is good because its support has at most one index and every +edge has at least two (`P15Structure.Aux.good_of_subset_block`). +Does not establish: the informal claim, its review or acceptance; alignment of `IsGood` with the +informal downset `D`. -/ +theorem localRestriction {X : Type} [Fintype X] [DecidableEq X] (F : RealizedData X) : + UniversalLaw.Spec.P15.LocalRestriction F := by + intro hF i S hS + constructor + · intro hgood + have h := hgood.1 i + rwa [inter_eq_left.2 hS] at h + · intro hcard + exact UniversalLaw.Proofs.P15Structure.Aux.good_of_subset_block hF hS hcard + +/-- Proves: `UniversalLaw.Spec.P15.PaletteNumberAttained` (claim `p15-realized-covers`, Section 4 +of P15_REALIZED_COVERS.md: "By discarding excess labels within blocks, one may take |P_i|=d_i"; +the feasible set of palette sizes is nonempty). +Method: disjoint label intervals of lengths `d_i` form a feasible palette of size `∑ d_i` when +every edge has at least two indices (`P15Structure.Aux.isPaletteFeasible_paletteNumber`), so the +infimum over `ℕ` is attained (`csInf_mem` of a nonempty set of naturals). +Does not establish: the informal claim, its review or acceptance; the value of the palette +number for any family. -/ +theorem paletteNumberAttained {X : Type} [Fintype X] (F : RealizedData X) : + UniversalLaw.Spec.P15.PaletteNumberAttained F := + fun hF => UniversalLaw.Proofs.P15Structure.Aux.isPaletteFeasible_paletteNumber F.H F.d hF.2.2.2.1 + +/-- Proves: `UniversalLaw.Spec.P15.Benchmark816UnionBound` (claim `p15-realized-covers`, display +(P11) of P15_REALIZED_COVERS.md: `Q = 1 - mu_p(D) ≤ 500616/40900^2 + 15/100^4 = +2449227/8180000000 < 3/10000` at `p_v = 1/40900`). +Method: `1 - mu_p(D)` is the total weight of the bad sets; every bad set contains a minimal +forbidden set, which by Proposition P1 for the six-block data is an internal pair (`6 * C(409,2)` +of them) or a transversal quadruple (`15 * 409^4`); the union bound exchanges the two sums and the +marginal identity `∑_{U ⊇ M} w(U) = ∏_{v ∈ M} p_v` evaluates each term to `(1/40900)^|M|`; the +two rational identities are exact arithmetic (`norm_num`), and the last clause follows from the +first three by `linarith`. +Does not establish: the informal claim, its review or acceptance; the exact value of the bad +probability (the source stresses "only a union bound, not an equality of the global bad +probability"); alignment of `mu`/`IsGood` with the informal objects. -/ +theorem benchmark816UnionBound : UniversalLaw.Spec.P15.Benchmark816UnionBound := by + have h1 := Aux.benchmark816_one_sub_mu_le + have h3 : (500616 / 40900 ^ 2 + 15 / 100 ^ 4 : ℝ) < 3 / 10000 := by norm_num + refine ⟨h1, by norm_num, by norm_num, ?_⟩ + linarith + +end UniversalLaw.Proofs.P15Covers diff --git a/specifications/lean_statement_proofs_20261011/SpecificationProofs/P15Elementary.lean b/specifications/lean_statement_proofs_20261011/SpecificationProofs/P15Elementary.lean new file mode 100644 index 000000000..d68e35e6e --- /dev/null +++ b/specifications/lean_statement_proofs_20261011/SpecificationProofs/P15Elementary.lean @@ -0,0 +1,1015 @@ +import Specifications.P15 + +/-! +# P15: kernel-checked proofs of elementary registered `Prop`s (statement module `Specifications.P15`) + +Scientific effect: NONE. Organizational-independence credit: 0 (Anthropic / Claude). + +Every theorem below has as its TYPE a registered `Prop` constant of +`UniversalLaw.Spec.P15` (statement packet `specifications/lean_statements_20261010`, commit +pinned there). A kernel-checked proof of such a `Prop` is evidence about that `Prop` only: it +does not make the informal Layer 0 claim accepted, reviewed or "verified", does not change any +LANDING_CLAIMS disposition, and does not touch the statement register (the statement module is +not edited here). Helper lemmas live in the `Aux` namespace and are not inventory items. + +Allowed transitive axioms: `propext`, `Classical.choice`, `Quot.sound` only (checked by +`#print axioms`, see the run receipt). No `sorry`, `native_decide`, `decide` on `ℝ`, or custom +axioms. The three `decide` calls in this module act on finite `Finset`/`Fin` data (ground sets of +size at most three) and are kernel-reduced. + +Covered (fifteen `Prop`s): `TwoCoordGeneratorPrices`, `LogOnePlusBelowIdentity`, `LogRatioBound`, +`CapTestAtTwoThirds`, `RatioExponentBound`, `RhoStarBelowSixSevenths`, `SixSeventhsCertificate`, +`HStarExceedsOne`, `PhiAtPStar`, `OddMajorityIdentity`, `HazardStarPositive`, +`DemandOneBoundary`, `DemandOneRefutation`, `CapacityWorstCase`, `TriangleNeedsThree`. + +Also covered (two further `Prop`s, proved in the final section of this module, so seventeen in +all): `CapacityHazardIsBinomial`, `SharpnessOfRhoStar`. + +Not covered here: `IsProperDownset` (a parametrised predicate, not a concrete-instance `Prop`; +it is false for the empty family, so no theorem of that type can exist), `ElementaryPaletteFormula` +(display (P9) quantified over all `b`, `s`, `d`: genuine combinatorics, not a finite statement), +and everything listed as hard analysis or large-benchmark in the proof-packet contract. +-/ + +namespace UniversalLaw.Proofs.P15Elementary + +open UniversalLaw.Spec.P15 + +namespace Aux + +/-! ### Real-analytic constants -/ + +/-- `2 < e` from Mathlib's decimal bound. -/ +theorem two_lt_exp_one : (2 : ℝ) < Real.exp 1 := by + have := Real.exp_one_gt_d9; linarith + +/-- `3e - 2 > 0`. -/ +theorem three_exp_sub_two_pos : (0 : ℝ) < 3 * Real.exp 1 - 2 := by + have := two_lt_exp_one; linarith + +/-- `exp 2 = (exp 1)^2`. -/ +theorem exp_two_eq : Real.exp 2 = Real.exp 1 ^ 2 := by + rw [← Real.exp_nat_mul]; norm_num + +/-- `exp (-2) = (exp (-1))^2`. -/ +theorem exp_neg_two_eq : Real.exp (-2) = Real.exp (-1) ^ 2 := by + rw [← Real.exp_nat_mul]; norm_num + +/-- `exp (-3) = (exp (-1))^3`. -/ +theorem exp_neg_three_eq : Real.exp (-3) = Real.exp (-1) ^ 3 := by + rw [← Real.exp_nat_mul]; norm_num + +/-- `log(3e - 2) < 2`, from `3e - 2 < e^2`, i.e. `(e-1)(e-2) > 0`. -/ +theorem log_three_exp_sub_two_lt_two : Real.log (3 * Real.exp 1 - 2) < 2 := by + rw [Real.log_lt_iff_lt_exp three_exp_sub_two_pos, exp_two_eq] + have := two_lt_exp_one + nlinarith + +/-- `1 < h_star`. -/ +theorem one_lt_hStar : 1 < hStar := by + unfold hStar; have := log_three_exp_sub_two_lt_two; linarith + +/-- The Taylor sum of the Section 6 certificate, evaluated exactly. -/ +theorem taylor_sum_eq : + (∑ j ∈ Finset.range 6, (11 / 6 : ℝ) ^ j / (Nat.factorial j : ℝ)) = + 197 / 32 + 26081 / 933120 := by + simp [Finset.sum_range_succ, Nat.factorial] + norm_num + +/-- `197/32 < exp(11/6)` by the degree-5 Taylor lower bound. -/ +theorem exp_eleven_sixths_gt : (197 / 32 : ℝ) < Real.exp (11 / 6) := by + have h := Real.sum_le_exp_of_nonneg (by norm_num : (0 : ℝ) ≤ 11 / 6) 6 + rw [taylor_sum_eq] at h + linarith + +/-- `3e - 2 < 197/32` from `e < 2.7182818286`. -/ +theorem three_exp_sub_two_lt : 3 * Real.exp 1 - 2 < (197 / 32 : ℝ) := by + have := Real.exp_one_lt_d9; linarith + +/-- `log(3e - 2) < 11/6`. -/ +theorem log_three_exp_sub_two_lt : Real.log (3 * Real.exp 1 - 2) < 11 / 6 := by + rw [Real.log_lt_iff_lt_exp three_exp_sub_two_pos] + exact lt_trans three_exp_sub_two_lt exp_eleven_sixths_gt + +/-- `7/6 < h_star`. -/ +theorem seven_sixths_lt_hStar : (7 / 6 : ℝ) < hStar := by + unfold hStar; have := log_three_exp_sub_two_lt; linarith + +/-- `rho_star < 6/7`. -/ +theorem rhoStar_lt_six_sevenths : rhoStar < 6 / 7 := by + unfold rhoStar + have h : (7 / 6 : ℝ) < 3 - Real.log (3 * Real.exp 1 - 2) := seven_sixths_lt_hStar + rw [div_lt_iff₀ (by linarith)] + linarith + +/-- `0 < p_star`. -/ +theorem pStar_pos : 0 < pStar := by + unfold pStar; have := Real.exp_neg_one_lt_half; linarith + +/-- `1/2 < p_star`. -/ +theorem pStar_gt_half : 1 / 2 < pStar := by + unfold pStar; have := Real.exp_neg_one_lt_half; linarith + +/-- `p_star < 1`. -/ +theorem pStar_lt_one : pStar < 1 := by + unfold pStar; have := Real.exp_pos (-1); linarith + +/-! ### Product weights -/ + +/-- The weights of all subsets sum to one (`Finset.prod_add` with `f = p`, `g = 1 - p`). -/ +theorem sum_weight_eq_one {Y : Type} [Fintype Y] [DecidableEq Y] (p : Y → ℝ) : + ∑ U ∈ (Finset.univ : Finset Y).powerset, weight p U = 1 := by + have h := Finset.prod_add p (fun v => 1 - p v) (Finset.univ : Finset Y) + have hl : ∏ v : Y, (p v + (1 - p v)) = 1 := by simp + rw [hl] at h + unfold weight + exact h.symm + +/-! ### Binomial lower tails -/ + +/-- One more trial: `P(Bin(n+1,p) ≤ k) = P(Bin(n,p) ≤ k) - C(n,k) p^(k+1) (1-p)^(n-k)` for +`k ≤ n` (Pascal's rule, induction on `k`). -/ +theorem binomTail_succ_left (n k : ℕ) (p : ℝ) (hk : k ≤ n) : + binomTail (n + 1) k p = + binomTail n k p - (Nat.choose n k : ℝ) * p ^ (k + 1) * (1 - p) ^ (n - k) := by + induction k with + | zero => + simp [binomTail] + ring + | succ k ih => + have hk' : k ≤ n := by omega + have e1 : binomTail (n + 1) (k + 1) p = binomTail (n + 1) k p + + (Nat.choose (n + 1) (k + 1) : ℝ) * p ^ (k + 1) * (1 - p) ^ (n + 1 - (k + 1)) := by + unfold binomTail; rw [Finset.sum_range_succ] + have e2 : binomTail n (k + 1) p = binomTail n k p + + (Nat.choose n (k + 1) : ℝ) * p ^ (k + 1) * (1 - p) ^ (n - (k + 1)) := by + unfold binomTail; rw [Finset.sum_range_succ] + rw [e1, e2, ih hk', Nat.choose_succ_succ'] + have h1 : n + 1 - (k + 1) = n - k := by omega + have h2 : n - k = (n - (k + 1)) + 1 := by omega + rw [h1, h2, pow_succ] + push_cast + ring + +/-- (F9) as an identity: the product measure of the capacity family at a constant vector is the +binomial lower tail (stated for `a ≤ n`). -/ +theorem muOf_capacityFamily (n a : ℕ) (han : a ≤ n) (c : ℝ) : + muOf (capacityFamily n a) (fun _ => c) = binomTail n a c := by + unfold muOf capacityFamily binomTail + have hw : ∀ U : Finset (Fin n), + weight (fun _ : Fin n => c) U = c ^ U.card * (1 - c) ^ (n - U.card) := by + intro U; unfold weight; simp [Finset.card_univ_sdiff] + rw [Finset.sum_filter] + simp_rw [hw] + rw [Finset.sum_powerset_apply_card (fun m => if m ≤ a then c ^ m * (1 - c) ^ (n - m) else 0)] + simp only [Finset.card_univ, Fintype.card_fin, nsmul_eq_mul, mul_ite, mul_zero] + rw [← Finset.sum_filter] + have hr : (Finset.range (n + 1)).filter (fun m => m ≤ a) = Finset.range (a + 1) := by + ext m; simp; omega + rw [hr] + exact Finset.sum_congr rfl (fun j _ => by ring) + +/-- The lower tail decreases when one trial is added (`a ≤ n`, `0 ≤ c ≤ 1`). -/ +theorem binomTail_antitone_step (n a : ℕ) (han : a ≤ n) (c : ℝ) (h0 : 0 ≤ c) (h1 : c ≤ 1) : + binomTail (n + 1) a c ≤ binomTail n a c := by + rw [binomTail_succ_left n a c han] + have : 0 ≤ (Nat.choose n a : ℝ) * c ^ (a + 1) * (1 - c) ^ (n - a) := + mul_nonneg (mul_nonneg (Nat.cast_nonneg _) (pow_nonneg h0 _)) (pow_nonneg (by linarith) _) + linarith + +/-- Monotonicity in the number of trials: `binomTail n a c ≤ binomTail m a c` for `a ≤ m ≤ n`. -/ +theorem binomTail_le_of_le (a m n : ℕ) (hm : a ≤ m) (hmn : m ≤ n) (c : ℝ) (h0 : 0 ≤ c) + (h1 : c ≤ 1) : binomTail n a c ≤ binomTail m a c := by + induction n, hmn using Nat.le_induction with + | base => exact le_refl _ + | succ k hk ih => exact le_trans (binomTail_antitone_step k a (le_trans hm hk) c h0 h1) ih + +/-- The lower tail is positive for `0 ≤ c < 1` (the `j = 0` term is `(1-c)^n > 0`). -/ +theorem binomTail_pos (n a : ℕ) (c : ℝ) (h0 : 0 ≤ c) (h1 : c < 1) : 0 < binomTail n a c := by + unfold binomTail + rw [Finset.sum_range_succ'] + have hpos : 0 < (Nat.choose n 0 : ℝ) * c ^ 0 * (1 - c) ^ (n - 0) := by + simp + exact pow_pos (by linarith) _ + have hnn : 0 ≤ ∑ j ∈ Finset.range a, + (Nat.choose n (j + 1) : ℝ) * c ^ (j + 1) * (1 - c) ^ (n - (j + 1)) := + Finset.sum_nonneg (fun j _ => + mul_nonneg (mul_nonneg (Nat.cast_nonneg _) (pow_nonneg h0 _)) (pow_nonneg (by linarith) _)) + linarith + +/-- `P(Bin(3, p_star) ≤ 1) = 3e^{-2} - 2e^{-3}`. -/ +theorem binomTail_three_one : binomTail 3 1 pStar = 3 * Real.exp (-2) - 2 * Real.exp (-3) := by + unfold binomTail pStar + simp [Finset.sum_range_succ] + rw [exp_neg_two_eq, exp_neg_three_eq] + ring + +/-! ### One block, no edges, capacity `cap`, demand one, ground set of size `cap + 1` -/ + +section OneBlock + +variable (cap : ℕ) + +/-- The single block is the whole ground set. -/ +theorem oneBlock_block (i : Fin 1) : block (demandOneBlock cap) i = Finset.univ := by + unfold block + rw [Fin.fin_one_eq_zero i] + simp [demandOneBlock] + +/-- A proper subset of a `(cap+1)`-set has at most `cap` elements. -/ +theorem card_le_of_ne_univ (U : Finset (Fin (cap + 1))) (h : U ≠ Finset.univ) : + U.card ≤ cap := by + have h1 : U.card ≤ Fintype.card (Fin (cap + 1)) := Finset.card_le_univ U + have h2 : U.card ≠ Fintype.card (Fin (cap + 1)) := + fun e => h ((Finset.card_eq_iff_eq_univ U).mp e) + rw [Fintype.card_fin] at h1 h2 + omega + +/-- Goodness is the capacity constraint. -/ +theorem oneBlock_isGood (U : Finset (Fin (cap + 1))) : + IsGood (demandOneBlock cap) U ↔ U.card ≤ cap := by + show (∀ i : Fin 1, (U ∩ block (demandOneBlock cap) i).card ≤ cap) ∧ + (∀ e ∈ (∅ : Finset (Finset (Fin 1))), ¬ e ⊆ supp (demandOneBlock cap) U) ↔ U.card ≤ cap + simp [oneBlock_block] + +/-- One-piece decomposability is goodness (for any family). -/ +theorem decomp_one {X : Type} [Fintype X] [DecidableEq X] (F : RealizedData X) (U : Finset X) : + IsKDecomposable F 1 U ↔ IsGood F U := by + unfold IsKDecomposable + constructor + · rintro ⟨parts, hgood, -, hU⟩ + have : U = parts 0 := by rw [← hU]; simp + rw [this]; exact hgood 0 + · intro h + refine ⟨fun _ => U, fun _ => h, fun j j' hjj' => absurd (Subsingleton.elim j j') hjj', ?_⟩ + simp + +/-- At `K = 1` the sole obstruction is the full block. -/ +theorem oneBlock_obstruction (U : Finset (Fin (cap + 1))) : + U ∈ obstruction (demandOneBlock cap) 1 ↔ U = Finset.univ := by + unfold obstruction + change ¬ IsKDecomposable (demandOneBlock cap) 1 U ↔ U = Finset.univ + rw [decomp_one, oneBlock_isGood, not_le] + constructor + · intro h + by_contra hne + have := card_le_of_ne_univ cap U hne + omega + · rintro rfl + rw [Finset.card_univ, Fintype.card_fin]; omega + +/-- The side conditions hold for `cap ≥ 1`. -/ +theorem oneBlock_isRealized (hcap : 1 ≤ cap) : IsRealizedFamily (demandOneBlock cap) := by + refine ⟨fun _ => hcap, fun _ => le_refl 1, ?_, ?_, ?_⟩ + · change ∀ i : Fin 1, (block (demandOneBlock cap) i).card = cap * 1 + 1 + intro i + rw [oneBlock_block] + simp + · change ∀ e ∈ (∅ : Finset (Finset (Fin 1))), 2 ≤ e.card + simp + · change ∀ e ∈ (∅ : Finset (Finset (Fin 1))), ∀ f ∈ (∅ : Finset (Finset (Fin 1))), + e ⊆ f → e = f + simp + +/-- `mu_p(D) = 1 - prod_v p_v`: every set but the full block is good. -/ +theorem oneBlock_mu (p : Fin (cap + 1) → ℝ) : + mu (demandOneBlock cap) p = 1 - ∏ v, p v := by + unfold mu + have hmem : (Finset.univ : Finset (Fin (cap + 1))) ∈ + (Finset.univ : Finset (Fin (cap + 1))).powerset := + Finset.mem_powerset.mpr (subset_refl _) + rw [← Finset.add_sum_erase _ _ hmem] + have h0 : Set.indicator (downset (demandOneBlock cap)) (weight p) Finset.univ = 0 := by + apply Set.indicator_of_notMem + show ¬ IsGood (demandOneBlock cap) Finset.univ + rw [oneBlock_isGood, Finset.card_univ, Fintype.card_fin] + omega + rw [h0, zero_add] + have h1 : ∀ U ∈ (Finset.univ : Finset (Fin (cap + 1))).powerset.erase Finset.univ, + Set.indicator (downset (demandOneBlock cap)) (weight p) U = weight p U := by + intro U hU + rw [Finset.mem_erase] at hU + apply Set.indicator_of_mem + show IsGood (demandOneBlock cap) U + rw [oneBlock_isGood] + exact card_le_of_ne_univ cap U hU.1 + rw [Finset.sum_congr rfl h1] + have h2 := Finset.add_sum_erase (Finset.univ : Finset (Fin (cap + 1))).powerset (weight p) hmem + rw [sum_weight_eq_one] at h2 + have h3 : weight p Finset.univ = ∏ v, p v := by unfold weight; simp + linarith + +/-- At unit prices every cover of `{X}` costs at least one. -/ +theorem oneBlock_coverCost_ge_one : + 1 ≤ coverCost (demandOneBlock cap) 1 (fun _ => (1 : ℝ)) := by + unfold coverCost + apply le_csInf + · refine ⟨1, {Finset.univ}, ?_, ?_⟩ + · intro U hU + rw [oneBlock_obstruction] at hU + exact ⟨Finset.univ, Finset.mem_singleton_self _, by rw [hU]⟩ + · simp [famPrice, genPrice] + · rintro t ⟨G, hG, rfl⟩ + have huniv : Finset.univ ∈ obstruction (demandOneBlock cap) 1 := + (oneBlock_obstruction cap _).mpr rfl + obtain ⟨g, hg, -⟩ := hG Finset.univ huniv + unfold famPrice + calc (1 : ℝ) = genPrice (fun _ => (1 : ℝ)) g := by simp [genPrice] + _ ≤ ∑ g ∈ G, genPrice (fun _ => (1 : ℝ)) g := + Finset.single_le_sum (fun g _ => by simp [genPrice]) hg + +end OneBlock + +/-- The two-coordinate record of the price boundary is the `cap = 1` demand-one block. -/ +theorem twoCoord_eq : twoCoord = demandOneBlock 1 := rfl + +/-! ### The triangle palette instance -/ + +/-- Three singletons are a feasible palette of size three for the triangle. -/ +theorem triangle_feasible3 : IsPaletteFeasible 3 (completeClutter 3 1) (fun _ => 1) 3 := by + refine ⟨fun i => {i}, fun i => by simp, ?_⟩ + decide + +/-- No palette of size zero. -/ +theorem triangle_not_feasible0 : ¬ IsPaletteFeasible 3 (completeClutter 3 1) (fun _ => 1) 0 := by + rintro ⟨P, hP, -⟩ + have h1 : 1 ≤ (P 0).card := hP 0 + have h0 : (P 0).card ≤ Fintype.card (Fin 0) := Finset.card_le_univ _ + rw [Fintype.card_fin] at h0 + omega + +/-- No palette of size one (finite check). -/ +theorem triangle_not_feasible1 : ¬ IsPaletteFeasible 3 (completeClutter 3 1) (fun _ => 1) 1 := by + unfold IsPaletteFeasible + decide + +/-- No palette of size two (finite check over the `4^3` label-set assignments). -/ +theorem triangle_not_feasible2 : ¬ IsPaletteFeasible 3 (completeClutter 3 1) (fun _ => 1) 2 := by + unfold IsPaletteFeasible + decide + +end Aux + +/-! ## Price boundary (demand one) -/ + +/-- Proves: `UniversalLaw.Spec.P15.TwoCoordGeneratorPrices` (register rows `p15-price-boundary`, +`math.p15-price-boundary`). +Method: unfold `genPrice`/`twoCoordC`, evaluate the four finite products with `simp`/`norm_num`. +Does not establish: the demand-one refutation itself (`DemandOneRefutation`), any review or +acceptance of P15-PRICE-BOUNDARY-20260924-v1; the disposition EXACT_COUNTEREXAMPLE is +transcribed in the register, not derived here. -/ +theorem twoCoordGeneratorPrices : UniversalLaw.Spec.P15.TwoCoordGeneratorPrices := by + unfold UniversalLaw.Spec.P15.TwoCoordGeneratorPrices + refine ⟨?_, ?_, ?_, ?_⟩ + · simp [genPrice] + · simp [genPrice, twoCoordC] + · simp [genPrice, twoCoordC] + · simp [genPrice, twoCoordC, Finset.prod_const] + norm_num + +/-- Proves: `UniversalLaw.Spec.P15.LogOnePlusBelowIdentity` (register row `p15-price-boundary`). +Method: `Real.log_lt_sub_one_of_pos` at `1 + x`. +Does not establish: anything about the refutation beyond this elementary inequality. -/ +theorem logOnePlusBelowIdentity : UniversalLaw.Spec.P15.LogOnePlusBelowIdentity := by + intro x hx + have h := Real.log_lt_sub_one_of_pos (by linarith : (0 : ℝ) < 1 + x) + (by intro h; linarith : (1 : ℝ) + x ≠ 1) + linarith + +/-- Proves: `UniversalLaw.Spec.P15.DemandOneRefutation` (register rows `p15-price-boundary`, +`math.p15-price-boundary`). +Method: `twoCoord` is definitionally the `cap = 1` demand-one block, so the one-block lemmas +give the side conditions, the obstruction `{X}` and `mu_p(D) = 1 - (1/2)^2 = 3/4`; `K_H(d) = 1` +by `Nat.sInf_le`/`le_csInf` (no palette of size `0`); admissibility and `phi(1/2) = log 2` from +`Real.log_two_gt_d9`/`Real.log_two_lt_d9`; every cover contains a generator `g ⊆ X`, whose price +`(2/3)^|g| ≥ 4/9`, and `{X}` attains `4/9` (`IsLeast.csInf_eq`); `log(4/3) < 1/3` from +`Real.log_lt_sub_one_of_pos`. +Does not establish: that the refutation contradicts original P15-B ("It does not contradict the +original P15-B amalgamation"), anything at the `408` scale or about the unrestricted prize, the +source's integral representation of `log 2`, nonauthor review or acceptance; the disposition +EXACT_COUNTEREXAMPLE is transcribed, not derived. -/ +theorem demandOneRefutation : UniversalLaw.Spec.P15.DemandOneRefutation := by + unfold UniversalLaw.Spec.P15.DemandOneRefutation + have hlog2 := Real.log_two_gt_d9 + have hlog2' := Real.log_two_lt_d9 + have hphi : phi (1 / 2) = Real.log 2 := by + unfold phi + have h : (1 : ℝ) / 2 < 1 := by norm_num + simp only [h, ↓reduceIte] + rw [show (1 : ℝ) - 1 / 2 = (2 : ℝ)⁻¹ by norm_num, Real.log_inv, neg_neg] + exact min_eq_right (by linarith) + have hobs : ∀ U : Finset (Fin 2), U ∈ obstruction twoCoord 1 ↔ U = Finset.univ := + Aux.oneBlock_obstruction 1 + have hmu : mu twoCoord twoCoordP = 3 / 4 := by + have h := Aux.oneBlock_mu 1 twoCoordP + rw [show mu twoCoord twoCoordP = mu (demandOneBlock 1) twoCoordP from rfl, h] + simp [twoCoordP] + norm_num + have hlog43 : Real.log (4 / 3) < 1 / 3 := by + have h := Real.log_lt_sub_one_of_pos (by norm_num : (0 : ℝ) < 4 / 3) (by norm_num) + linarith + have hch : cappedHazard 1 (mu twoCoord twoCoordP) = Real.log (4 / 3) := by + rw [hmu] + unfold cappedHazard + have h : (0 : ℝ) < 3 / 4 := by norm_num + simp only [h, ↓reduceIte, one_mul] + rw [show (3 / 4 : ℝ) = (4 / 3)⁻¹ by norm_num, Real.log_inv, neg_neg] + exact min_eq_right (by linarith) + have hcover : ∀ G : Finset (Finset (Fin 2)), IsGeneratorCover twoCoord 1 G → + 4 / 9 ≤ famPrice twoCoordC G := by + intro G hG + have huniv : (Finset.univ : Finset (Fin 2)) ∈ obstruction twoCoord 1 := (hobs _).mpr rfl + obtain ⟨g, hg, -⟩ := hG _ huniv + unfold famPrice + have hgp : genPrice twoCoordC g = (2 / 3) ^ g.card := by + simp [genPrice, twoCoordC, div_pow] + have hcard : g.card ≤ 2 := by + have := Finset.card_le_univ g; simpa using this + calc (4 / 9 : ℝ) = (2 / 3) ^ 2 := by norm_num + _ ≤ (2 / 3) ^ g.card := pow_le_pow_of_le_one (by norm_num) (by norm_num) hcard + _ = genPrice twoCoordC g := hgp.symm + _ ≤ ∑ g ∈ G, genPrice twoCoordC g := + Finset.single_le_sum (fun g _ => by + unfold genPrice + exact Finset.prod_nonneg (fun v _ => by unfold twoCoordC; norm_num)) hg + have hcc : coverCost twoCoord 1 twoCoordC = 4 / 9 := by + unfold coverCost + apply IsLeast.csInf_eq + refine ⟨⟨{Finset.univ}, ?_, ?_⟩, ?_⟩ + · intro U hU + rw [hobs] at hU + exact ⟨Finset.univ, Finset.mem_singleton_self _, by rw [hU]⟩ + · simp [famPrice, genPrice, twoCoordC] + norm_num + · rintro t ⟨G, hG, rfl⟩ + exact hcover G hG + have hpal : paletteNumber 1 ∅ (fun _ => 1) = 1 := by + unfold paletteNumber + have h1 : (1 : ℕ) ∈ {K : ℕ | IsPaletteFeasible 1 ∅ (fun _ => 1) K} := by + refine ⟨fun _ => {0}, fun _ => by simp, fun e he => by simp at he⟩ + apply le_antisymm (Nat.sInf_le h1) + apply le_csInf ⟨1, h1⟩ + intro K hK + obtain ⟨P, hP, -⟩ := hK + by_contra hlt + have hK0 : K = 0 := by omega + subst hK0 + have h1le : 1 ≤ (P 0).card := hP 0 + have h0 : (P 0).card ≤ Fintype.card (Fin 0) := Finset.card_le_univ _ + rw [Fintype.card_fin] at h0 + omega + refine ⟨Aux.oneBlock_isRealized 1 le_rfl, hpal, hobs, ?_, hphi, by linarith, hmu, hch, hlog43, + hcover, hcc, by norm_num, ?_⟩ + · intro v + show (2 / 3 : ℝ) ≤ phi (1 / 2) + rw [hphi]; linarith + · rw [hch, hcc]; linarith + +/-! ## Restricted price budget: elementary displays -/ + +/-- Proves: `UniversalLaw.Spec.P15.LogRatioBound` (register row `p15-price-budget-restricted`). +Method: `Real.log_le_sub_one_of_pos` at `(1 - p)⁻¹` and `Real.log_inv`. +Does not establish: display (T1) or the restricted budget; the source's integral representation +of `-log(1-p)` is not formalised. -/ +theorem logRatioBound : UniversalLaw.Spec.P15.LogRatioBound := by + intro p hp0 hp1 + have h1p : 0 < 1 - p := by linarith + have h := Real.log_le_sub_one_of_pos (inv_pos.mpr h1p) + rw [Real.log_inv] at h + have e : (1 - p)⁻¹ - 1 = p / (1 - p) := by + field_simp + ring + linarith + +/-- Proves: `UniversalLaw.Spec.P15.CapTestAtTwoThirds` (register row `p15-price-budget-restricted`). +Method: `log 3 > 1` from `exp 1 < 3` (Mathlib's `Real.exp_one_lt_d9`); for `2/3 ≤ q < 1`, +`-log(1-q) ≥ log 3 > 1` so the `min` is `1`; at `q = 1` the definition of `phi` gives `1`. +Does not establish: the checker program of the source's Section 5, nor any budget statement. -/ +theorem capTestAtTwoThirds : UniversalLaw.Spec.P15.CapTestAtTwoThirds := by + unfold UniversalLaw.Spec.P15.CapTestAtTwoThirds + have hlog3 : 1 < Real.log 3 := by + rw [Real.lt_log_iff_exp_lt (by norm_num)] + have := Real.exp_one_lt_d9 + linarith + refine ⟨hlog3, ?_⟩ + intro q hq1 hq2 + unfold phi + rcases lt_or_eq_of_le hq2 with h | h + · simp only [h, ↓reduceIte] + have h1q : 0 < 1 - q := by linarith + have hle : 1 - q ≤ 1 / 3 := by linarith + have hl : Real.log (1 - q) ≤ Real.log (1 / 3) := Real.log_le_log h1q hle + rw [one_div, Real.log_inv] at hl + exact min_eq_left (by linarith) + · subst h + simp + +/-- Proves: `UniversalLaw.Spec.P15.RatioExponentBound` (register row `p15-price-budget-restricted`). +Method: `3^n ≥ 3^(2a+1)` and the exact identity `4^(a+1)/3^(2a+1) = (4/3)(4/9)^a`; then +`(4/9)^a ≤ 4/9` for `a ≥ 1`. +Does not establish: the ratio steps of (T3) preceding the exponent arithmetic, or (T4)/(T1). -/ +theorem ratioExponentBound : UniversalLaw.Spec.P15.RatioExponentBound := by + intro a n ha hn + constructor + · have h3 : (3 : ℝ) ^ (2 * a + 1) ≤ 3 ^ n := pow_le_pow_right₀ (by norm_num) hn + have h3pos : (0 : ℝ) < 3 ^ (2 * a + 1) := by positivity + calc (4 : ℝ) ^ (a + 1) / 3 ^ n ≤ 4 ^ (a + 1) / 3 ^ (2 * a + 1) := + div_le_div_of_nonneg_left (by positivity) h3pos h3 + _ = (4 / 3) * (4 / 9) ^ a := by + rw [pow_succ, pow_succ, pow_mul, div_pow] + norm_num + ring + · have h : (4 / 9 : ℝ) ^ a ≤ (4 / 9) ^ 1 := pow_le_pow_of_le_one (by norm_num) (by norm_num) ha + nlinarith [h] + +/-! ## Full price: the constant `rho_star` -/ + +/-- Proves: `UniversalLaw.Spec.P15.RhoStarBelowSixSevenths` (register row `p15-full-price`). +Method: `3e - 2 < 197/32 < exp(11/6)` (decimal bound on `e`; degree-5 Taylor lower bound on +`exp`), hence `h_star > 7/6` and `rho_star = 1/h_star < 6/7`. +Does not establish: the 20-digit enclosure (F3) (`RhoStarEnclosure`), the budget (F2), or any +review/acceptance of P15-FULL-TRANSFORMED-PRICE-20260924-v1 (disposition REVIEWED_SCOPED is +transcribed, not derived). -/ +theorem rhoStarBelowSixSevenths : UniversalLaw.Spec.P15.RhoStarBelowSixSevenths := + Aux.rhoStar_lt_six_sevenths + +/-- Proves: `UniversalLaw.Spec.P15.SixSeventhsCertificate` (register row `p15-full-price`). +Method: `Real.exp_one_lt_d9` for `e < 31967/11760`; `norm_num` for the two rational identities; +`Real.sum_le_exp_of_nonneg` with six terms for `197/32 < exp(11/6)`; then `log` monotonicity. +Does not establish: the series and geometric-tail bounds the source uses for `e < 31967/11760` +(a sharper Mathlib bound is used instead), nor anything about (F2). -/ +theorem sixSeventhsCertificate : UniversalLaw.Spec.P15.SixSeventhsCertificate := by + unfold UniversalLaw.Spec.P15.SixSeventhsCertificate + have he := Real.exp_one_lt_d9 + refine ⟨by linarith, by norm_num, by norm_num, ?_, by norm_num, Aux.three_exp_sub_two_lt, + Aux.exp_eleven_sixths_gt, Aux.seven_sixths_lt_hStar, Aux.rhoStar_lt_six_sevenths⟩ + rw [Aux.taylor_sum_eq] + norm_num + +/-- Proves: `UniversalLaw.Spec.P15.HStarExceedsOne` (register row `p15-full-price`). +Method: `2 < e` from `Real.exp_one_gt_d9`; `ring` for the factorisation; `u = exp(-1) < 1/2` +and `u(1-u)(1-2u) > 0` for `3e^{-2} - 2e^{-3} < e^{-1}`; `log(3e-2) < 2` from `3e-2 < e^2`. +Does not establish: (F11) for general `(n, a)` (that is `CapacityWorstCase`). -/ +theorem hStarExceedsOne : UniversalLaw.Spec.P15.HStarExceedsOne := by + unfold UniversalLaw.Spec.P15.HStarExceedsOne + have he := Aux.two_lt_exp_one + refine ⟨he, by ring, mul_pos (by linarith) (by linarith), ?_, Aux.one_lt_hStar⟩ + rw [Aux.exp_neg_two_eq, Aux.exp_neg_three_eq] + have hu : 0 < Real.exp (-1) := Real.exp_pos _ + have hu2 : Real.exp (-1) < 1 / 2 := Real.exp_neg_one_lt_half + nlinarith [mul_pos (mul_pos hu (by linarith : (0 : ℝ) < 1 - Real.exp (-1))) + (by linarith : (0 : ℝ) < 1 - 2 * Real.exp (-1))] + +/-- Proves: `UniversalLaw.Spec.P15.PhiAtPStar` (register row `p15-full-price`). +Method: `p_star < 1`, `1 - p_star = exp(-1)`, `Real.log_exp`. +Does not establish: equality of the two sides of (F7) (not specified separately). -/ +theorem phiAtPStar : UniversalLaw.Spec.P15.PhiAtPStar := by + unfold UniversalLaw.Spec.P15.PhiAtPStar phi pStar + have hpos := Real.exp_pos (-1) + have hlt : (1 : ℝ) - Real.exp (-1) < 1 := by linarith + simp only [hlt, ↓reduceIte] + have e : (1 : ℝ) - (1 - Real.exp (-1)) = Real.exp (-1) := by ring + rw [e, Real.log_exp] + norm_num + +/-! ## Full price: hazard positivity, binomial identities, worst case -/ + +/-- Proves: `UniversalLaw.Spec.P15.HazardStarPositive` (register row `p15-full-price`). +Method: at the constant vector `p_star ∈ (0,1)` all weights are nonnegative, the empty set +contributes `(1-p_star)^n > 0`, and since `X ∉ A` the mass is at most `1 - p_star^n < 1` +(all weights sum to one by `Finset.prod_add`); then `Real.log_neg`. +Does not establish: the bounds (F5)-(F8) that use `H_A > 0`. -/ +theorem hazardStarPositive : UniversalLaw.Spec.P15.HazardStarPositive := by + intro n A _ hA + obtain ⟨hempty, huniv, -⟩ := hA + unfold hazardStar + have hp0 := Aux.pStar_pos + have hp1 := Aux.pStar_lt_one + have hw_nonneg : ∀ U : Finset (Fin n), 0 ≤ weight (fun _ : Fin n => pStar) U := by + intro U; unfold weight + apply mul_nonneg + · exact Finset.prod_nonneg (fun v _ => hp0.le) + · exact Finset.prod_nonneg (fun v _ => by linarith) + have hempty_w : 0 < weight (fun _ : Fin n => pStar) (∅ : Finset (Fin n)) := by + unfold weight + simp + exact pow_pos (by linarith) _ + have hpos : 0 < muOf A (fun _ : Fin n => pStar) := by + unfold muOf + exact lt_of_lt_of_le hempty_w (Finset.single_le_sum (fun U _ => hw_nonneg U) hempty) + have hsub : A ⊆ (Finset.univ : Finset (Fin n)).powerset.erase Finset.univ := by + intro U hU + rw [Finset.mem_erase] + exact ⟨fun h => huniv (h ▸ hU), Finset.mem_powerset.mpr (Finset.subset_univ U)⟩ + have hle : muOf A (fun _ : Fin n => pStar) ≤ + ∑ U ∈ (Finset.univ : Finset (Fin n)).powerset.erase Finset.univ, + weight (fun _ : Fin n => pStar) U := + Finset.sum_le_sum_of_subset_of_nonneg hsub (fun U _ _ => hw_nonneg U) + have hmem : (Finset.univ : Finset (Fin n)) ∈ (Finset.univ : Finset (Fin n)).powerset := + Finset.mem_powerset.mpr (subset_refl _) + have hsum := Finset.add_sum_erase (Finset.univ : Finset (Fin n)).powerset + (weight (fun _ : Fin n => pStar)) hmem + rw [Aux.sum_weight_eq_one] at hsum + have huniv_w : 0 < weight (fun _ : Fin n => pStar) (Finset.univ : Finset (Fin n)) := by + unfold weight + simp + exact pow_pos hp0 _ + have hlt : muOf A (fun _ : Fin n => pStar) < 1 := by linarith + have := Real.log_neg hpos hlt + linarith + +/-- Proves: `UniversalLaw.Spec.P15.OddMajorityIdentity` (register row `p15-full-price`). +Method: the one-trial recursion `binomTail (n+1) k = binomTail n k - C(n,k) p^(k+1) (1-p)^(n-k)` +(Pascal's rule, induction on `k`) applied twice, Pascal's rule once more, `ring`; the second +form by `Nat.choose_symm_half`; negativity from `p(1-2p) < 0` and a positive factor. +Does not establish: (F11) itself (the chain over `a` is in `CapacityWorstCase`). -/ +theorem oddMajorityIdentity : UniversalLaw.Spec.P15.OddMajorityIdentity := by + intro a p + have e1 := Aux.binomTail_succ_left (2 * a + 2) (a + 1) p (by omega) + have e2 : binomTail (2 * a + 2) (a + 1) p = binomTail (2 * a + 1) (a + 1) p - + (Nat.choose (2 * a + 1) (a + 1) : ℝ) * p ^ (a + 1 + 1) * (1 - p) ^ (2 * a + 1 - (a + 1)) := + Aux.binomTail_succ_left (2 * a + 1) (a + 1) p (by omega) + have e3 : binomTail (2 * a + 1) (a + 1) p = binomTail (2 * a + 1) a p + + (Nat.choose (2 * a + 1) (a + 1) : ℝ) * p ^ (a + 1) * (1 - p) ^ (2 * a + 1 - (a + 1)) := by + unfold binomTail; rw [Finset.sum_range_succ] + have hc : (Nat.choose (2 * a + 2) (a + 1) : ℝ) = + (Nat.choose (2 * a + 1) a : ℝ) + (Nat.choose (2 * a + 1) (a + 1) : ℝ) := by + exact_mod_cast Nat.choose_succ_succ' (2 * a + 1) a + have x1 : 2 * a + 2 - (a + 1) = a + 1 := by omega + have x2 : 2 * a + 1 - (a + 1) = a := by omega + have hd : binomTail (2 * a + 3) (a + 1) p - binomTail (2 * a + 1) a p = + (1 - p) ^ 2 * ((Nat.choose (2 * a + 1) (a + 1) : ℝ) * p ^ (a + 1) * (1 - p) ^ a) - + p ^ 2 * ((Nat.choose (2 * a + 1) a : ℝ) * p ^ a * (1 - p) ^ (a + 1)) := by + rw [show 2 * a + 3 = 2 * a + 2 + 1 by omega, e1, e2, e3, hc, x1, x2] + ring + have hd2 : binomTail (2 * a + 3) (a + 1) p - binomTail (2 * a + 1) a p = + p * (1 - 2 * p) * ((Nat.choose (2 * a + 1) a : ℝ) * p ^ a * (1 - p) ^ (a + 1)) := by + rw [hd, Nat.choose_symm_half] + ring + refine ⟨hd, hd2, ?_⟩ + intro hp1 hp2 + rw [hd2] + have hneg : p * (1 - 2 * p) < 0 := mul_neg_of_pos_of_neg (by linarith) (by linarith) + have hpos : 0 < (Nat.choose (2 * a + 1) a : ℝ) * p ^ a * (1 - p) ^ (a + 1) := + mul_pos (mul_pos (Nat.cast_pos.mpr (Nat.choose_pos (by omega))) (pow_pos (by linarith) _)) + (pow_pos (by linarith) _) + exact mul_neg_of_neg_of_pos hneg hpos + +namespace Aux + +/-- The chain of (F10) at `p ∈ (1/2, 1)`: `P(Bin(2a+1,p) ≤ a) ≤ P(Bin(3,p) ≤ 1)` for `a ≥ 1`. -/ +theorem binomTail_odd_chain (a : ℕ) (ha : 1 ≤ a) (c : ℝ) (hc : 1 / 2 < c) (hc1 : c < 1) : + binomTail (2 * a + 1) a c ≤ binomTail 3 1 c := by + induction a, ha using Nat.le_induction with + | base => exact le_refl _ + | succ k hk ih => + have h := (oddMajorityIdentity k c).2.2 hc hc1 + rw [show 2 * (k + 1) + 1 = 2 * k + 3 by ring] + linarith + +end Aux + +/-- Proves: `UniversalLaw.Spec.P15.CapacityWorstCase` (register row `p15-full-price`). +Method: `mu_{p_star}(capacityFamily n a) = binomTail n a p_star` (`Finset.sum_powerset_apply_card`), +the tail decreases in `n` (one-trial recursion) and along `a ↦ a+1` at `p_star > 1/2` (F10), so +`binomTail n a ≤ binomTail 3 1` and `-log` reverses the order; `binomTail 3 1 p_star` evaluates +to `3e^{-2} - 2e^{-3} = (3e-2)e^{-3}`, whose `-log` is `h_star`; `h_star > 1` as in +`HStarExceedsOne`. +Does not establish: the local price bound (F12) or the assembly (F13); the source's remark "it +is not a finite-grid extrapolation" is a statement about its own proof, not re-derived. -/ +theorem capacityWorstCase : UniversalLaw.Spec.P15.CapacityWorstCase := by + unfold UniversalLaw.Spec.P15.CapacityWorstCase + have hp0 := Aux.pStar_pos + have hp12 := Aux.pStar_gt_half + have hp1 := Aux.pStar_lt_one + have hid : ∀ n a : ℕ, a ≤ n → + hazardStar (capacityFamily n a) = -Real.log (binomTail n a pStar) := by + intro n a h; unfold hazardStar; rw [Aux.muOf_capacityFamily n a h] + refine ⟨?_, ?_, ?_, Aux.one_lt_hStar⟩ + · intro a n ha hn + rw [hid 3 1 (by norm_num), hid n a (by omega)] + have h1 : binomTail n a pStar ≤ binomTail (2 * a + 1) a pStar := + Aux.binomTail_le_of_le a (2 * a + 1) n (by omega) hn pStar hp0.le hp1.le + have h2 : binomTail (2 * a + 1) a pStar ≤ binomTail 3 1 pStar := + Aux.binomTail_odd_chain a ha pStar hp12 hp1 + have hpos := Aux.binomTail_pos n a pStar hp0.le hp1 + have := Real.log_le_log hpos (le_trans h1 h2) + linarith + · rw [hid 3 1 (by norm_num), Aux.binomTail_three_one] + · unfold hStar + have e : 3 * Real.exp (-2) - 2 * Real.exp (-3) = (3 * Real.exp 1 - 2) * Real.exp (-3) := by + rw [show Real.exp (-2) = Real.exp 1 * Real.exp (-3) by rw [← Real.exp_add]; norm_num] + ring + rw [e, Real.log_mul (ne_of_gt Aux.three_exp_sub_two_pos) (Real.exp_pos _).ne', Real.log_exp] + ring + +/-! ## Full price Section 5: the exact demand boundary -/ + +/-- Proves: `UniversalLaw.Spec.P15.DemandOneBoundary` (register row `p15-full-price`). +Method: one-block lemmas (block = ground set, good ⇔ `|U| ≤ cap`, obstruction `{X}` at `K = 1`, +`mu_p(D) = 1 - prod p_v` via `Finset.prod_add`, unit-price covers cost at least one by +`le_csInf`); `p_star^(cap+1) < p_star` for `cap ≥ 1`; `Real.log_lt_log`; for `rho ≤ 1` the capped +hazard is `min(1, rho(-log mu)) ≤ -log mu < 1 ≤ covercost`. +Does not establish: any retraction of original P15-B ("whose local-budget premise is missing in +that case"); the equality `covercost = 1` (only the lower bound is needed and stated). -/ +theorem demandOneBoundary : UniversalLaw.Spec.P15.DemandOneBoundary := by + intro cap hcap + have hp0 := Aux.pStar_pos + have hp1 := Aux.pStar_lt_one + have h1p : 1 - pStar = Real.exp (-1) := by unfold pStar; ring + have hmu : mu (demandOneBlock cap) (fun _ => pStar) = 1 - pStar ^ (cap + 1) := by + rw [Aux.oneBlock_mu]; simp + have hpow : pStar ^ (cap + 1) < pStar := by + calc pStar ^ (cap + 1) ≤ pStar ^ 2 := pow_le_pow_of_le_one hp0.le hp1.le (by omega) + _ < pStar := by nlinarith + have hexp : Real.exp (-1) < 1 - pStar ^ (cap + 1) := by linarith + have hmu_pos : 0 < mu (demandOneBlock cap) (fun _ => pStar) := by + rw [hmu]; have := Real.exp_pos (-1); linarith + have hmu_lt : mu (demandOneBlock cap) (fun _ => pStar) < 1 := by + rw [hmu]; have := pow_pos hp0 (cap + 1); linarith + have hlog : -Real.log (mu (demandOneBlock cap) (fun _ => pStar)) < 1 := by + rw [hmu] + have := Real.log_lt_log (Real.exp_pos _) hexp + rw [Real.log_exp] at this + linarith + have hcc := Aux.oneBlock_coverCost_ge_one cap + refine ⟨Aux.oneBlock_isRealized cap hcap, Aux.oneBlock_obstruction cap, hcc, hmu, hexp, hlog, + ?_⟩ + intro ρ hρ + unfold cappedHazard + simp only [hmu_pos, ↓reduceIte] + have hL : 0 < -Real.log (mu (demandOneBlock cap) (fun _ => pStar)) := by + have := Real.log_neg hmu_pos hmu_lt; linarith + have hmul := mul_le_mul_of_nonneg_right hρ hL.le + calc min 1 (ρ * -Real.log (mu (demandOneBlock cap) (fun _ => pStar))) + ≤ ρ * -Real.log (mu (demandOneBlock cap) (fun _ => pStar)) := min_le_right _ _ + _ < 1 := by linarith + _ ≤ coverCost (demandOneBlock cap) 1 (fun _ => (1 : ℝ)) := hcc + +/-! ## Realized covers Section 5: the triangle -/ + +/-- Proves: `UniversalLaw.Spec.P15.TriangleNeedsThree` (register row `p15-realized-covers`). +Method: `K_H(d) = sInf` of the feasible set; three singletons are feasible at `K = 3` +(`Nat.sInf_le`); sizes `0`, `1`, `2` are infeasible (`K = 0` by cardinality, `K = 1, 2` by +kernel `decide` over the finitely many label-set assignments), so `le_csInf` gives `3 ≤ sInf`. +Does not establish: display (P9) (`ElementaryPaletteFormula`), the matroid palette formula, or +anything about the realized-covers budget (P8). -/ +theorem triangleNeedsThree : UniversalLaw.Spec.P15.TriangleNeedsThree := by + unfold UniversalLaw.Spec.P15.TriangleNeedsThree paletteNumber + have h3 : (3 : ℕ) ∈ {K : ℕ | IsPaletteFeasible 3 (completeClutter 3 1) (fun _ => 1) K} := + Aux.triangle_feasible3 + apply le_antisymm (Nat.sInf_le h3) + apply le_csInf ⟨3, h3⟩ + intro K hK + by_contra hlt + have hK : IsPaletteFeasible 3 (completeClutter 3 1) (fun _ => 1) K := hK + interval_cases K + · exact Aux.triangle_not_feasible0 hK + · exact Aux.triangle_not_feasible1 hK + · exact Aux.triangle_not_feasible2 hK + +/-! ## Full price Sections 3 and 5: (F9) for every `a`, and the sharpness of `rho_star` -/ + +namespace Aux + +/-- (F9) as an identity for every `a` (no `a ≤ n` hypothesis): the extra terms `j > n` of the +tail vanish since `Nat.choose n j = 0`. -/ +theorem muOf_capacityFamily_all (n a : ℕ) (c : ℝ) : + muOf (capacityFamily n a) (fun _ => c) = binomTail n a c := by + unfold muOf capacityFamily binomTail + have hw : ∀ U : Finset (Fin n), + weight (fun _ : Fin n => c) U = c ^ U.card * (1 - c) ^ (n - U.card) := by + intro U; unfold weight; simp [Finset.card_univ_sdiff] + rw [Finset.sum_filter] + simp_rw [hw] + rw [Finset.sum_powerset_apply_card (fun m => if m ≤ a then c ^ m * (1 - c) ^ (n - m) else 0)] + simp only [Finset.card_univ, Fintype.card_fin, nsmul_eq_mul, mul_ite, mul_zero] + rw [← Finset.sum_filter] + have hr : (Finset.range (n + 1)).filter (fun m => m ≤ a) = + (Finset.range (a + 1)).filter (fun m => m ≤ n) := by + ext m; simp; omega + rw [hr, Finset.sum_filter] + refine Finset.sum_congr rfl (fun j _ => ?_) + split_ifs with h + · ring + · rw [Nat.choose_eq_zero_of_lt (by omega)]; simp + +/-! ### The triple block: one block, `a = 1`, `d = 2`, ground set of size three, no edges -/ + +/-- The single block is the whole ground set. -/ +theorem tripleBlock_block (i : Fin 1) : block tripleBlock i = Finset.univ := by + unfold block + rw [Fin.fin_one_eq_zero i] + simp [tripleBlock] + +/-- Goodness is the capacity constraint `|U| ≤ 1`. -/ +theorem tripleBlock_isGood (U : Finset (Fin 3)) : IsGood tripleBlock U ↔ U.card ≤ 1 := by + show (∀ i : Fin 1, (U ∩ block tripleBlock i).card ≤ 1) ∧ + (∀ e ∈ (∅ : Finset (Finset (Fin 1))), ¬ e ⊆ supp tripleBlock U) ↔ U.card ≤ 1 + simp [tripleBlock_block] + +/-- Two-decomposability is `|U| ≤ 2`: two good parts have at most two elements in all +(`Finset.card_biUnion_le`), and a set of size `≤ 2` splits into singletons and empties. -/ +theorem tripleBlock_decomp (U : Finset (Fin 3)) : + IsKDecomposable tripleBlock 2 U ↔ U.card ≤ 2 := by + unfold IsKDecomposable + constructor + · rintro ⟨parts, hgood, -, hU⟩ + rw [← hU] + calc ((Finset.univ : Finset (Fin 2)).biUnion parts).card + ≤ ∑ j : Fin 2, (parts j).card := Finset.card_biUnion_le + _ ≤ ∑ _j : Fin 2, 1 := Finset.sum_le_sum (fun j _ => (tripleBlock_isGood _).mp (hgood j)) + _ = 2 := by simp + · intro h + have hc : U.card = 0 ∨ U.card = 1 ∨ U.card = 2 := by omega + rcases hc with h0 | h1 | h2 + · rw [Finset.card_eq_zero] at h0 + subst h0 + refine ⟨fun _ => ∅, ?_, ?_, ?_⟩ + · intro j; rw [tripleBlock_isGood]; simp + · intro j j' _; exact Finset.disjoint_empty_left _ + · ext v + simp + · obtain ⟨x, rfl⟩ := Finset.card_eq_one.mp h1 + refine ⟨fun j => if j = 0 then {x} else ∅, ?_, ?_, ?_⟩ + · intro j; rw [tripleBlock_isGood]; dsimp only; split_ifs <;> simp + · intro j j' hjj' + fin_cases j <;> fin_cases j' <;> simp_all + · ext v + simp + · obtain ⟨x, y, hxy, rfl⟩ := Finset.card_eq_two.mp h2 + refine ⟨fun j => if j = 0 then {x} else {y}, ?_, ?_, ?_⟩ + · intro j; rw [tripleBlock_isGood]; dsimp only; split_ifs <;> simp + · intro j j' hjj' + fin_cases j <;> fin_cases j' <;> simp_all [hxy.symm] + · ext v + simp + +/-- At `K = 2` the sole obstruction is the full triple. -/ +theorem tripleBlock_obstruction (U : Finset (Fin 3)) : + U ∈ obstruction tripleBlock 2 ↔ U = Finset.univ := by + unfold obstruction + change ¬ IsKDecomposable tripleBlock 2 U ↔ U = Finset.univ + rw [tripleBlock_decomp, not_le] + constructor + · intro h + by_contra hne + have := card_le_of_ne_univ 2 U hne + omega + · rintro rfl + rw [Finset.card_univ, Fintype.card_fin]; omega + +/-- The side conditions: `a = 1 ≥ 1`, `d = 2 ≥ 1`, `|X| = 3 = 1 * 2 + 1`, no edges. -/ +theorem tripleBlock_isRealized : IsRealizedFamily tripleBlock := by + refine ⟨fun _ => le_rfl, fun _ => by simp [tripleBlock], ?_, ?_, ?_⟩ + · change ∀ i : Fin 1, (block tripleBlock i).card = 1 * 2 + 1 + intro i + rw [tripleBlock_block] + simp + · change ∀ e ∈ (∅ : Finset (Finset (Fin 1))), 2 ≤ e.card + simp + · change ∀ e ∈ (∅ : Finset (Finset (Fin 1))), ∀ f ∈ (∅ : Finset (Finset (Fin 1))), + e ⊆ f → e = f + simp + +/-- The full-block family is `{X}`. -/ +theorem tripleBlock_fullBlockFamily : fullBlockFamily tripleBlock = {Finset.univ} := by + ext g + simp only [fullBlockFamily, Finset.mem_image, Finset.mem_univ, true_and, Finset.mem_singleton] + constructor + · rintro ⟨i, rfl⟩ + exact tripleBlock_block i + · rintro rfl + exact ⟨(0 : Fin 1), tripleBlock_block 0⟩ + +/-- `K_H(d) = 2` for one block of demand two and no edges: `{0, 1}` is feasible at `K = 2`, and +a label set of size `≥ 2` needs `K ≥ 2`. -/ +theorem tripleBlock_palette : paletteNumber 1 ∅ (fun _ => 2) = 2 := by + unfold paletteNumber + have h2 : (2 : ℕ) ∈ {K : ℕ | IsPaletteFeasible 1 ∅ (fun _ => 2) K} := by + refine ⟨fun _ => Finset.univ, fun _ => by simp, fun e he => by simp at he⟩ + apply le_antisymm (Nat.sInf_le h2) + apply le_csInf ⟨2, h2⟩ + intro K hK + obtain ⟨P, hP, -⟩ := hK + have h2le : 2 ≤ (P 0).card := hP 0 + have h0 : (P 0).card ≤ Fintype.card (Fin K) := Finset.card_le_univ _ + rw [Fintype.card_fin] at h0 + omega + +/-- `mu_p(D)` for the triple block is the mass of the capacity family `(3, 1)`. -/ +theorem tripleBlock_mu (p : Fin 3 → ℝ) : mu tripleBlock p = muOf (capacityFamily 3 1) p := by + unfold mu muOf capacityFamily + rw [Finset.sum_filter] + refine Finset.sum_congr rfl (fun U _ => ?_) + by_cases h : U.card ≤ 1 + · rw [Set.indicator_of_mem (show U ∈ downset tripleBlock from (tripleBlock_isGood U).mpr h)] + simp [h] + · rw [Set.indicator_of_notMem + (show U ∉ downset tripleBlock from fun hm => h ((tripleBlock_isGood U).mp hm))] + simp [h] + +/-- At unit prices every generator costs one (the empty generator included). -/ +theorem genPrice_one (g : Finset (Fin 3)) : genPrice (fun _ => (1 : ℝ)) g = 1 := by + simp [genPrice] + +/-- At unit prices every cover of `{X}` costs at least one. -/ +theorem tripleBlock_cover_ge_one (G : Finset (Finset (Fin 3))) + (hG : IsGeneratorCover tripleBlock 2 G) : 1 ≤ famPrice (fun _ => (1 : ℝ)) G := by + have huniv : (Finset.univ : Finset (Fin 3)) ∈ obstruction tripleBlock 2 := + (tripleBlock_obstruction _).mpr rfl + obtain ⟨g, hg, -⟩ := hG Finset.univ huniv + unfold famPrice + calc (1 : ℝ) = genPrice (fun _ => (1 : ℝ)) g := (genPrice_one g).symm + _ ≤ ∑ g ∈ G, genPrice (fun _ => (1 : ℝ)) g := + Finset.single_le_sum (fun g _ => by rw [genPrice_one]; norm_num) hg + +/-- The full-block family `{X}` covers the obstruction `{X}`. -/ +theorem tripleBlock_fullBlock_cover : + IsGeneratorCover tripleBlock 2 (fullBlockFamily tripleBlock) := by + intro U hU + rw [tripleBlock_obstruction] at hU + rw [tripleBlock_fullBlockFamily] + exact ⟨Finset.univ, Finset.mem_singleton_self _, by rw [hU]⟩ + +/-- The full-block cover costs exactly one at unit prices. -/ +theorem tripleBlock_fullBlock_price : + famPrice (fun _ => (1 : ℝ)) (fullBlockFamily tripleBlock) = 1 := by + rw [tripleBlock_fullBlockFamily] + simp [famPrice, genPrice] + +/-- The exact cover cost is one: `{X}` attains the lower bound one. -/ +theorem tripleBlock_coverCost : coverCost tripleBlock 2 (fun _ => (1 : ℝ)) = 1 := by + unfold coverCost + apply IsLeast.csInf_eq + refine ⟨⟨fullBlockFamily tripleBlock, tripleBlock_fullBlock_cover, + tripleBlock_fullBlock_price⟩, ?_⟩ + rintro t ⟨G, hG, rfl⟩ + exact tripleBlock_cover_ge_one G hG + +/-- `mu_{p_star}(D) = P(Bin(3, p_star) ≤ 1) = 3e^{-2} - 2e^{-3}`. -/ +theorem tripleBlock_mu_pStar : + mu tripleBlock (fun _ => pStar) = 3 * Real.exp (-2) - 2 * Real.exp (-3) := by + rw [tripleBlock_mu, muOf_capacityFamily_all, binomTail_three_one] + +/-- The available hazard of the triple block at `p_star` is `h_star`. -/ +theorem tripleBlock_hazard : -Real.log (mu tripleBlock (fun _ => pStar)) = hStar := by + rw [tripleBlock_mu_pStar] + exact capacityWorstCase.2.2.1 + +/-- Any `ρ < ρ_star = 1/h_star` makes the capped hazard `min(1, ρ h_star)` strictly less than +one. -/ +theorem tripleBlock_sharp (ρ : ℝ) (hρ : ρ < rhoStar) : + cappedHazard ρ (mu tripleBlock (fun _ => pStar)) < 1 := by + have hmu_pos : 0 < mu tripleBlock (fun _ => pStar) := by + rw [tripleBlock_mu, muOf_capacityFamily_all] + exact binomTail_pos 3 1 pStar pStar_pos.le pStar_lt_one + have hlog := tripleBlock_hazard + have hh : 0 < hStar := by linarith [one_lt_hStar] + have hrho : rhoStar * hStar = 1 := by + show 1 / hStar * hStar = 1 + exact one_div_mul_cancel hh.ne' + unfold cappedHazard + simp only [hmu_pos, ↓reduceIte] + rw [hlog] + calc min 1 (ρ * hStar) ≤ ρ * hStar := min_le_right _ _ + _ < rhoStar * hStar := mul_lt_mul_of_pos_right hρ hh + _ = 1 := hrho + +end Aux + +/-- Proves: `UniversalLaw.Spec.P15.CapacityHazardIsBinomial` (claim `p15-full-price`, display (F9)). +Method: `hazardStar` unfolds to `-log (muOf (capacityFamily n a) p_star)`, and the mass of the +capacity family at a constant vector is `binomTail n a` for EVERY `a` (`Finset.sum_powerset_apply_card` +groups the subsets by cardinality; for `a > n` the extra terms `j > n` vanish since +`Nat.choose n j = 0`), which extends `Aux.muOf_capacityFamily` beyond `a ≤ n`. +Does not establish: the informal claim's review or acceptance; the alignment of `capacityFamily` and +`binomTail` with the source's `A = {S : |S| ≤ a}` and `P(Bin(n, p_star) ≤ a)` +(PENDING_INDEPENDENT_REVIEW); displays (F10)-(F11) (`CapacityWorstCase`) or anything about the +budget (F2). -/ +theorem capacityHazardIsBinomial : UniversalLaw.Spec.P15.CapacityHazardIsBinomial := by + intro n a + unfold hazardStar + rw [Aux.muOf_capacityFamily_all n a] + +/-- Proves: `UniversalLaw.Spec.P15.SharpnessOfRhoStar` (claim `math.p15-full-price`, full-price note Section 5). +Method: for `tripleBlock` the single block is the ground set, good sets are those of size `≤ 1`, and a +set is `2`-decomposable iff it has size `≤ 2` (two singletons/empties; `Finset.card_biUnion_le` for the +converse), so the obstruction at `K = 2` is `{X}`; `K_H(d) = 2` by `Nat.sInf_le`/`le_csInf`; at unit +prices every generator costs `1`, every cover of `{X}` costs `≥ 1` (`Finset.single_le_sum`) and the +full-block cover `{X}` costs `1`, hence `coverCost = 1` (`IsLeast.csInf_eq`); `mu_p(D)` is the mass of +the capacity family `(3, 1)`, i.e. `binomTail 3 1 p_star = 3e^{-2} - 2e^{-3}`, whose `-log` is `h_star` +(the identity proved in `capacityWorstCase`); for `ρ < ρ_star = 1/h_star`, +`min 1 (ρ h_star) ≤ ρ h_star < 1`. +Does not establish: the informal sharpness claim's review or acceptance; the alignment of the Lean +`tripleBlock`, `obstruction`, `coverCost` and `cappedHazard` with the source's objects +(PENDING_INDEPENDENT_REVIEW); sharpness for any family other than the triple block; the budget (F2) +itself; any necessity claim for multi-block families with some demand one ("other constraints may +change its budget"). -/ +theorem sharpnessOfRhoStar : UniversalLaw.Spec.P15.SharpnessOfRhoStar := + ⟨Aux.tripleBlock_isRealized, Aux.tripleBlock_palette, Aux.tripleBlock_obstruction, phiAtPStar, + Aux.genPrice_one, Aux.tripleBlock_cover_ge_one, Aux.tripleBlock_fullBlock_cover, + Aux.tripleBlock_fullBlock_price, Aux.tripleBlock_coverCost, Aux.tripleBlock_hazard, + Aux.tripleBlock_sharp⟩ + +end UniversalLaw.Proofs.P15Elementary diff --git a/specifications/lean_statement_proofs_20261011/SpecificationProofs/P15Hazard.lean b/specifications/lean_statement_proofs_20261011/SpecificationProofs/P15Hazard.lean new file mode 100644 index 000000000..37b6a3760 --- /dev/null +++ b/specifications/lean_statement_proofs_20261011/SpecificationProofs/P15Hazard.lean @@ -0,0 +1,404 @@ +import Specifications.P15 + +/-! +# P15 hazard proofs: the local price chain (P4), the independent-block hazard (P5) and the +global assembly (F13) + +Scientific effect: NONE. Organizational-independence credit: 0 (Anthropic / Claude). + +Every theorem outside the `Aux` namespace has as its type exactly one registered `Prop` of +`Specifications/P15.lean` (statement packet `specifications/lean_statements_20261010`, which is +not modified here). A kernel-checked proof of such a `Prop` is evidence about that `Prop` only: +it does not make the informal Layer 0 note reviewed, accepted or "verified", it does not +identify the formal definitions with the informal objects (that alignment is +PENDING_INDEPENDENT_REVIEW), and it promotes, closes, discharges or reclassifies nothing. + +Helper lemmas live in `UniversalLaw.Proofs.P15Hazard.Aux`; the gate inventories only the +theorems outside that namespace. The heart of the module is the factorisation +`Aux.mu_le_prod_localGood`: the product weight of a subset `U` of the ground set factors over +the blocks as `prod_i w_i(U ∩ X_i)`, a good set has good block restrictions, and the sum over +`2^X` of a product of block-local quantities is the product of the block-local sums (the +bijection `U ↦ (i ↦ U ∩ X_i)` onto `prod_i 2^(X_i)`). No independence of crossing events is used +or asserted. The block-local marginal identity `Aux.sum_blockWeight_filter_supset` and its +consequence `Aux.prod_le_localFailure_of_card` are exported for the price-budget module. +-/ + +namespace UniversalLaw.Proofs.P15Hazard + +open UniversalLaw.Spec.P15 +open Finset + +namespace Aux + +/-! ### The block-local weight -/ + +/-- The block-restricted weight `w_i(S) = prod_{v in S} p_v prod_{v in X_i \ S} (1 - p_v)`; the +integrand of `localGood`. -/ +noncomputable def blockWeight {X : Type} [Fintype X] [DecidableEq X] (F : RealizedData X) + (p : X → ℝ) (i : Fin F.b) (S : Finset X) : ℝ := + (∏ v ∈ S, p v) * ∏ v ∈ block F i \ S, (1 - p v) + +/-- `localGood` is the sum of the indicator of the downset times the block weight. -/ +theorem localGood_eq {X : Type} [Fintype X] [DecidableEq X] (F : RealizedData X) (p : X → ℝ) + (i : Fin F.b) : + localGood F p i = + ∑ S ∈ (block F i).powerset, Set.indicator (downset F) (blockWeight F p i) S := rfl + +/-- Block weights are nonnegative for `p in [0,1]^X`. -/ +theorem blockWeight_nonneg {X : Type} [Fintype X] [DecidableEq X] (F : RealizedData X) + {p : X → ℝ} (hp : ∀ v, 0 ≤ p v ∧ p v ≤ 1) (i : Fin F.b) (S : Finset X) : + 0 ≤ blockWeight F p i S := by + unfold blockWeight + refine mul_nonneg (Finset.prod_nonneg fun v _ => (hp v).1) (Finset.prod_nonneg fun v _ => ?_) + linarith [(hp v).2] + +/-- The block weights of all subsets of a block sum to one (`Finset.prod_add`). -/ +theorem sum_blockWeight_eq_one {X : Type} [Fintype X] [DecidableEq X] (F : RealizedData X) + (p : X → ℝ) (i : Fin F.b) : + ∑ S ∈ (block F i).powerset, blockWeight F p i S = 1 := by + have h := Finset.prod_add p (fun v => 1 - p v) (block F i) + have hl : ∏ v ∈ block F i, (p v + (1 - p v)) = 1 := by simp + rw [hl] at h + unfold blockWeight + exact h.symm + +/-- The marginal identity: for `S ⊆ X_i`, the block weights of the supersets of `S` inside the +block sum to `prod_{v in S} p_v` (bijection `T ↦ T \ S` onto `2^(X_i \ S)`). -/ +theorem sum_blockWeight_filter_supset {X : Type} [Fintype X] [DecidableEq X] + (F : RealizedData X) (p : X → ℝ) (i : Fin F.b) {S : Finset X} (hS : S ⊆ block F i) : + ∑ T ∈ (block F i).powerset with S ⊆ T, blockWeight F p i T = ∏ v ∈ S, p v := by + have h1 : ∑ T ∈ (block F i).powerset with S ⊆ T, blockWeight F p i T = + ∑ R ∈ (block F i \ S).powerset, + (∏ v ∈ S, p v) * ((∏ v ∈ R, p v) * ∏ v ∈ (block F i \ S) \ R, (1 - p v)) := by + refine Finset.sum_nbij' (fun T => T \ S) (fun R => R ∪ S) ?_ ?_ ?_ ?_ ?_ + · intro T hT + rw [mem_filter, mem_powerset] at hT + exact mem_powerset.2 (sdiff_subset_sdiff hT.1 (subset_refl _)) + · intro R hR + rw [mem_powerset] at hR + rw [mem_filter, mem_powerset] + exact ⟨union_subset (hR.trans sdiff_subset) hS, subset_union_right⟩ + · intro T hT + rw [mem_filter] at hT + exact sdiff_union_of_subset hT.2 + · intro R hR + rw [mem_powerset] at hR + exact union_sdiff_cancel_right (sdiff_disjoint.mono_left hR) + · intro T hT + rw [mem_filter, mem_powerset] at hT + unfold blockWeight + rw [← prod_sdiff hT.2] + have hset : (block F i \ S) \ (T \ S) = block F i \ T := by + ext v + simp only [mem_sdiff, not_and, not_not] + constructor + · rintro ⟨⟨hb, hs⟩, h⟩ + exact ⟨hb, fun ht => hs (h ht)⟩ + · rintro ⟨hb, ht⟩ + exact ⟨⟨hb, fun hs => ht (hT.2 hs)⟩, fun ht' => (ht ht').elim⟩ + rw [hset] + ring + have h2 := Finset.prod_add p (fun v => 1 - p v) (block F i \ S) + have hl : ∏ v ∈ block F i \ S, (p v + (1 - p v)) = 1 := by simp + rw [hl] at h2 + rw [h1, ← Finset.mul_sum, ← h2, mul_one] + +/-! ### Bounds on the local good and failure probabilities -/ + +/-- `0 ≤ mu_p(D_i)`. -/ +theorem localGood_nonneg {X : Type} [Fintype X] [DecidableEq X] (F : RealizedData X) + {p : X → ℝ} (hp : ∀ v, 0 ≤ p v ∧ p v ≤ 1) (i : Fin F.b) : 0 ≤ localGood F p i := by + rw [localGood_eq] + exact Finset.sum_nonneg fun S _ => + Set.indicator_nonneg (fun T _ => blockWeight_nonneg F hp i T) S + +/-- `mu_p(D_i) ≤ 1`. -/ +theorem localGood_le_one {X : Type} [Fintype X] [DecidableEq X] (F : RealizedData X) + {p : X → ℝ} (hp : ∀ v, 0 ≤ p v ∧ p v ≤ 1) (i : Fin F.b) : localGood F p i ≤ 1 := by + rw [localGood_eq, ← sum_blockWeight_eq_one F p i] + exact Finset.sum_le_sum fun S _ => + Set.indicator_apply_le' (fun _ => le_rfl) (fun _ => blockWeight_nonneg F hp i S) + +/-- `0 ≤ q_i`. -/ +theorem localFailure_nonneg {X : Type} [Fintype X] [DecidableEq X] (F : RealizedData X) + {p : X → ℝ} (hp : ∀ v, 0 ≤ p v ∧ p v ≤ 1) (i : Fin F.b) : 0 ≤ localFailure F p i := by + unfold localFailure + linarith [localGood_le_one F hp i] + +/-- `q_i ≤ 1`. -/ +theorem localFailure_le_one {X : Type} [Fintype X] [DecidableEq X] (F : RealizedData X) + {p : X → ℝ} (hp : ∀ v, 0 ≤ p v ∧ p v ≤ 1) (i : Fin F.b) : localFailure F p i ≤ 1 := by + unfold localFailure + linarith [localGood_nonneg F hp i] + +/-- `1 - q_i = mu_p(D_i)`. -/ +theorem one_sub_localFailure {X : Type} [Fintype X] [DecidableEq X] (F : RealizedData X) + (p : X → ℝ) (i : Fin F.b) : 1 - localFailure F p i = localGood F p i := by + unfold localFailure + ring + +/-- Every subset of the block containing `a_i + 1` or more coordinates is bad, so +`mu_p(D_i) ≤ 1 - prod_{v in S} p_v` for every such `S ⊆ X_i` (marginal identity plus the +termwise bound `indicator ≤ weight`). -/ +theorem localGood_le_one_sub_prod {X : Type} [Fintype X] [DecidableEq X] (F : RealizedData X) + {p : X → ℝ} (hp : ∀ v, 0 ≤ p v ∧ p v ≤ 1) {i : Fin F.b} {S : Finset X} + (hS : S ⊆ block F i) (hcard : F.a i + 1 ≤ S.card) : + localGood F p i ≤ 1 - ∏ v ∈ S, p v := by + rw [localGood_eq, ← Finset.sum_filter_add_sum_filter_not ((block F i).powerset) (fun T => S ⊆ T)] + have h0 : ∑ T ∈ (block F i).powerset with S ⊆ T, + Set.indicator (downset F) (blockWeight F p i) T = 0 := by + refine Finset.sum_eq_zero fun T hT => ?_ + rw [mem_filter, mem_powerset] at hT + refine Set.indicator_of_notMem (fun hgood => ?_) _ + have h1 : (T ∩ block F i).card ≤ F.a i := hgood.1 i + rw [Finset.inter_eq_left.2 hT.1] at h1 + have h2 := card_le_card hT.2 + omega + have h3 : ∑ T ∈ (block F i).powerset with ¬ S ⊆ T, + Set.indicator (downset F) (blockWeight F p i) T ≤ + ∑ T ∈ (block F i).powerset with ¬ S ⊆ T, blockWeight F p i T := + Finset.sum_le_sum fun T _ => + Set.indicator_apply_le' (fun _ => le_rfl) (fun _ => blockWeight_nonneg F hp i T) + have h4 := Finset.sum_filter_add_sum_filter_not ((block F i).powerset) (fun T => S ⊆ T) + (blockWeight F p i) + rw [sum_blockWeight_eq_one F p i, sum_blockWeight_filter_supset F p i hS] at h4 + linarith + +/-- The block-local price bound of the (T3)/(T5) arguments: for `S ⊆ X_i` with +`|S| ≥ a_i + 1`, `prod_{v in S} p_v ≤ q_i`. -/ +theorem prod_le_localFailure_of_card {X : Type} [Fintype X] [DecidableEq X] + (F : RealizedData X) {p : X → ℝ} (hp : ∀ v, 0 ≤ p v ∧ p v ≤ 1) {i : Fin F.b} + {S : Finset X} (hS : S ⊆ block F i) (hcard : F.a i + 1 ≤ S.card) : + ∏ v ∈ S, p v ≤ localFailure F p i := by + unfold localFailure + linarith [localGood_le_one_sub_prod F hp hS hcard] + +/-- The full block has `a_i d_i + 1 ≥ a_i + 1` coordinates, so `prod_{v in X_i} p_v ≤ q_i`. -/ +theorem prod_block_le_localFailure {X : Type} [Fintype X] [DecidableEq X] + {F : RealizedData X} (hF : IsRealizedFamily F) {p : X → ℝ} + (hp : ∀ v, 0 ≤ p v ∧ p v ≤ 1) (i : Fin F.b) : + ∏ v ∈ block F i, p v ≤ localFailure F p i := by + refine prod_le_localFailure_of_card F hp (subset_refl _) ?_ + rw [hF.2.2.1 i] + have := Nat.le_mul_of_pos_right (F.a i) (hF.2.1 i) + omega + +/-! ### The transformed price `phi` -/ + +/-- `q ≤ -log(1 - q)` for `q < 1` (from `1 - q ≤ exp(-q)`). -/ +theorem neg_log_one_sub_ge {q : ℝ} (hq : q < 1) : q ≤ -Real.log (1 - q) := by + have h1 : 1 - q ≤ Real.exp (-q) := by + have := Real.add_one_le_exp (-q) + linarith + have h2 := Real.log_le_log (by linarith : (0 : ℝ) < 1 - q) h1 + rw [Real.log_exp] at h2 + linarith + +/-- `q ≤ phi(q)` for `q ≤ 1` (in particular on `[0, 1]`). -/ +theorem le_phi_self {q : ℝ} (h1 : q ≤ 1) : q ≤ phi q := by + unfold phi + split_ifs with h + · exact le_min h1 (neg_log_one_sub_ge h) + · exact h1 + +/-! ### Blocks partition the ground set -/ + +/-- The traces `T ∩ X_i` of a set on the blocks are pairwise disjoint. -/ +theorem pairwiseDisjoint_inter_block {X : Type} [Fintype X] [DecidableEq X] + (F : RealizedData X) (T : Finset X) : + (↑(univ : Finset (Fin F.b)) : Set (Fin F.b)).PairwiseDisjoint + (fun i => T ∩ block F i) := by + intro i _ j _ hij + show Disjoint (T ∩ block F i) (T ∩ block F j) + rw [Finset.disjoint_left] + intro v hvi hvj + simp only [block, mem_inter, mem_filter, mem_univ, true_and] at hvi hvj + exact hij (hvi.2.symm.trans hvj.2) + +/-- The traces of a set on the blocks reassemble it. -/ +theorem biUnion_inter_block {X : Type} [Fintype X] [DecidableEq X] (F : RealizedData X) + (T : Finset X) : (univ : Finset (Fin F.b)).biUnion (fun i => T ∩ block F i) = T := by + ext v + simp [block] + +/-- A product over a set factors over its traces on the blocks. -/ +theorem prod_eq_prod_blocks {X : Type} [Fintype X] [DecidableEq X] (F : RealizedData X) + (f : X → ℝ) (T : Finset X) : ∏ v ∈ T, f v = ∏ i, ∏ v ∈ T ∩ block F i, f v := by + calc ∏ v ∈ T, f v = ∏ v ∈ (univ : Finset (Fin F.b)).biUnion (fun i => T ∩ block F i), f v := by + rw [biUnion_inter_block] + _ = ∏ i, ∏ v ∈ T ∩ block F i, f v := Finset.prod_biUnion (pairwiseDisjoint_inter_block F T) + +/-- The complement's trace on a block is the block minus the trace. -/ +theorem compl_inter_block {X : Type} [Fintype X] [DecidableEq X] (F : RealizedData X) + (U : Finset X) (i : Fin F.b) : (univ \ U) ∩ block F i = block F i \ (U ∩ block F i) := by + ext v + simp only [mem_inter, mem_sdiff, mem_univ, true_and, not_and] + tauto + +/-- The weight of a subset factors over the blocks: `w(U) = prod_i w_i(U ∩ X_i)`. -/ +theorem weight_eq_prod_blockWeight {X : Type} [Fintype X] [DecidableEq X] (F : RealizedData X) + (p : X → ℝ) (U : Finset X) : weight p U = ∏ i, blockWeight F p i (U ∩ block F i) := by + unfold weight blockWeight + rw [show ∏ v ∈ U, p v = ∏ i, ∏ v ∈ U ∩ block F i, p v from prod_eq_prod_blocks F p U, + show ∏ v ∈ univ \ U, (1 - p v) = ∏ i, ∏ v ∈ (univ \ U) ∩ block F i, (1 - p v) from + prod_eq_prod_blocks F (fun v => 1 - p v) (univ \ U), + ← Finset.prod_mul_distrib] + refine Finset.prod_congr rfl fun i _ => ?_ + rw [compl_inter_block] + +/-! ### Good sets have good block restrictions -/ + +/-- `U in D` implies `U ∩ X_i in D`. -/ +theorem isGood_inter_block {X : Type} [Fintype X] [DecidableEq X] {F : RealizedData X} + {U : Finset X} (hU : IsGood F U) (i : Fin F.b) : IsGood F (U ∩ block F i) := by + refine ⟨fun j => ?_, fun e he hsub => hU.2 e he (hsub.trans ?_)⟩ + · exact (card_le_card (inter_subset_inter inter_subset_left (subset_refl _))).trans (hU.1 j) + · exact image_subset_image inter_subset_left + +/-- Termwise: `1_D(U) w(U) ≤ prod_i 1_D(U ∩ X_i) w_i(U ∩ X_i)`. -/ +theorem indicator_weight_le {X : Type} [Fintype X] [DecidableEq X] (F : RealizedData X) + {p : X → ℝ} (hp : ∀ v, 0 ≤ p v ∧ p v ≤ 1) (U : Finset X) : + Set.indicator (downset F) (weight p) U ≤ + ∏ i, Set.indicator (downset F) (blockWeight F p i) (U ∩ block F i) := by + by_cases hU : U ∈ downset F + · rw [Set.indicator_of_mem hU, weight_eq_prod_blockWeight F p U] + refine le_of_eq (Finset.prod_congr rfl fun i _ => ?_) + rw [Set.indicator_of_mem (show U ∩ block F i ∈ downset F from isGood_inter_block hU i)] + · rw [Set.indicator_of_notMem hU] + exact Finset.prod_nonneg fun i _ => + Set.indicator_nonneg (fun T _ => blockWeight_nonneg F hp i T) _ + +/-! ### The factorisation of a block-local product over `2^X` -/ + +/-- `sum_{U ⊆ X} prod_i g_i(U ∩ X_i) = prod_i sum_{S ⊆ X_i} g_i(S)`: the bijection +`U ↦ (i ↦ U ∩ X_i)` from `2^X` onto `prod_i 2^(X_i)` with inverse `x ↦ ⋃_i x_i`. -/ +theorem sum_prod_blocks {X : Type} [Fintype X] [DecidableEq X] (F : RealizedData X) + (g : Fin F.b → Finset X → ℝ) : + ∑ U ∈ (univ : Finset X).powerset, ∏ i, g i (U ∩ block F i) = + ∏ i, ∑ S ∈ (block F i).powerset, g i S := by + rw [Finset.prod_univ_sum] + refine Finset.sum_nbij' (fun U => fun i => U ∩ block F i) (fun x => univ.biUnion x) ?_ ?_ ?_ ?_ + ?_ + · intro U _ + exact Fintype.mem_piFinset.2 fun i => mem_powerset.2 inter_subset_right + · intro x _ + exact mem_powerset.2 (subset_univ _) + · intro U _ + exact biUnion_inter_block F U + · intro x hx + have hx' : ∀ j, x j ⊆ block F j := fun j => mem_powerset.1 (Fintype.mem_piFinset.1 hx j) + funext i + ext v + simp only [mem_inter, mem_biUnion, mem_univ, true_and] + constructor + · rintro ⟨⟨j, hj⟩, hi⟩ + have h1 : F.blk v = j := by simpa [block] using hx' j hj + have h2 : F.blk v = i := by simpa [block] using hi + rw [← h2, h1] + exact hj + · intro hv + exact ⟨⟨i, hv⟩, hx' i hv⟩ + · intro U _ + rfl + +/-- The factorisation `mu_p(D) ≤ prod_i mu_p(D_i)` for `p in [0,1]^X`: termwise domination of +`1_D(U) w(U)` by the product of block restrictions, then the block-product bijection. -/ +theorem mu_le_prod_localGood {X : Type} [Fintype X] [DecidableEq X] (F : RealizedData X) + {p : X → ℝ} (hp : ∀ v, 0 ≤ p v ∧ p v ≤ 1) : mu F p ≤ ∏ i, localGood F p i := by + unfold mu + calc ∑ U ∈ (univ : Finset X).powerset, Set.indicator (downset F) (weight p) U + ≤ ∑ U ∈ (univ : Finset X).powerset, + ∏ i, Set.indicator (downset F) (blockWeight F p i) (U ∩ block F i) := + Finset.sum_le_sum fun U _ => indicator_weight_le F hp U + _ = ∏ i, ∑ S ∈ (block F i).powerset, Set.indicator (downset F) (blockWeight F p i) S := + sum_prod_blocks F (fun i S => Set.indicator (downset F) (blockWeight F p i) S) + _ = ∏ i, localGood F p i := by + refine Finset.prod_congr rfl fun i _ => ?_ + rw [localGood_eq] + +/-- When `mu_p(D) > 0`, every local good probability is positive (a zero factor would zero the +product that dominates `mu_p(D)`). -/ +theorem localGood_pos_of_mu_pos {X : Type} [Fintype X] [DecidableEq X] (F : RealizedData X) + {p : X → ℝ} (hp : ∀ v, 0 ≤ p v ∧ p v ≤ 1) (hmu : 0 < mu F p) (i : Fin F.b) : + 0 < localGood F p i := by + by_contra h + have h0 : localGood F p i = 0 := le_antisymm (not_lt.mp h) (localGood_nonneg F hp i) + have := mu_le_prod_localGood F hp + rw [Finset.prod_eq_zero (mem_univ i) h0] at this + linarith + +/-- `-log prod_i mu_p(D_i) = sum_i -log mu_p(D_i)` when `mu_p(D) > 0`. -/ +theorem neg_log_prod_localGood {X : Type} [Fintype X] [DecidableEq X] (F : RealizedData X) + {p : X → ℝ} (hp : ∀ v, 0 ≤ p v ∧ p v ≤ 1) (hmu : 0 < mu F p) : + -Real.log (∏ i, localGood F p i) = ∑ i, -Real.log (localGood F p i) := by + rw [Real.log_prod (fun i _ => (localGood_pos_of_mu_pos F hp hmu i).ne'), Finset.sum_neg_distrib] + +/-- `-log prod_i mu_p(D_i) ≤ -log mu_p(D)` when `mu_p(D) > 0`. -/ +theorem neg_log_prod_localGood_le {X : Type} [Fintype X] [DecidableEq X] (F : RealizedData X) + {p : X → ℝ} (hp : ∀ v, 0 ≤ p v ∧ p v ≤ 1) (hmu : 0 < mu F p) : + -Real.log (∏ i, localGood F p i) ≤ -Real.log (mu F p) := + neg_le_neg (Real.log_le_log hmu (mu_le_prod_localGood F hp)) + +end Aux + +/-! ## Inventory theorems -/ + +/-- Proves: `UniversalLaw.Spec.P15.LocalPriceChain` (claim `p15-realized-covers`, display (P4)). +Method: `Finset.prod_le_prod₀` for `0 ≤ c ≤ p`; the block-local marginal bound +`Aux.prod_le_localFailure_of_card` at `S = X_i` (the full block has `a_i d_i + 1 ≥ a_i + 1` +coordinates and is therefore bad); `q ≤ phi(q)` on `[0,1]` from `1 - q ≤ exp(-q)`. +Does not establish: the informal display (P4) or its review and acceptance; the alignment of +`localFailure` with the source's `q_i` (PENDING_INDEPENDENT_REVIEW); the identification +`prod p_v = P(U_i = X_i)` as a probabilistic statement; the disposition HOLD_WITH_DOMAIN of +`p15-realized-covers`, which is transcribed in the register, not derived here. -/ +theorem localPriceChain {X : Type} [Fintype X] [DecidableEq X] (F : RealizedData X) : + UniversalLaw.Spec.P15.LocalPriceChain F := by + intro hF p c hp hc i + refine ⟨?_, Aux.prod_block_le_localFailure hF hp i, + Aux.le_phi_self (Aux.localFailure_le_one F hp i)⟩ + unfold genPrice + exact Finset.prod_le_prod₀ (fun v _ => (hc v).1) (fun v _ => (hc v).2) + +/-- Proves: `UniversalLaw.Spec.P15.IndependentBlockHazard` (claim `p15-realized-covers`, display +(P5)). +Method: `1 - q_i = mu_p(D_i)`; the factorisation `Aux.mu_le_prod_localGood` (block-product +bijection on `2^X`, no independence assumption); when `mu_p(D) > 0` every `mu_p(D_i) > 0`, so +`Real.log_prod` turns `-log prod` into `sum -log`, each `q_i ≤ -log(1 - q_i)` by +`Aux.neg_log_one_sub_ge`, and `-log prod ≤ -log mu` by monotonicity of `log`. +Does not establish: the informal display (P5) or its review and acceptance; any independence of +crossing events (none is used); the price bound `sum_i price(G_i) ≤ sum_i q_i` (that is (P4) +summed, not part of this `Prop`); the alignment of the formal `mu`, `localFailure` with the +source's objects (PENDING_INDEPENDENT_REVIEW); the disposition HOLD_WITH_DOMAIN of +`p15-realized-covers`. -/ +theorem independentBlockHazard {X : Type} [Fintype X] [DecidableEq X] (F : RealizedData X) : + UniversalLaw.Spec.P15.IndependentBlockHazard F := by + intro _ p hp + have hprod : ∏ i, (1 - localFailure F p i) = ∏ i, localGood F p i := + Finset.prod_congr rfl fun i _ => Aux.one_sub_localFailure F p i + rw [hprod] + refine ⟨Aux.mu_le_prod_localGood F hp, fun hmu => ⟨?_, Aux.neg_log_prod_localGood_le F hp hmu⟩⟩ + rw [Aux.neg_log_prod_localGood F hp hmu] + refine Finset.sum_le_sum fun i _ => ?_ + rw [← Aux.one_sub_localFailure F p i] + refine Aux.neg_log_one_sub_ge ?_ + have := Aux.localGood_pos_of_mu_pos F hp hmu i + unfold localFailure + linarith + +/-- Proves: `UniversalLaw.Spec.P15.GlobalAssemblyHazard` (claim `p15-full-price`, display (F13)). +Method: the factorisation `Aux.mu_le_prod_localGood` (every good set has good block +restrictions; the weight factors over the blocks; the block-product bijection on `2^X`), then, +when `mu_p(D) > 0`, every `mu_p(D_i) > 0`, `Real.log_prod` and the monotonicity of `log`. +Does not establish: the informal display (F13) or its review and acceptance; the local bound +(F12) or the full-price theorem (F2); any independence of crossing failures (none is used); the +alignment of the formal `mu`, `localGood` with the source's `mu_p(D)`, `mu_p(D_i)` +(PENDING_INDEPENDENT_REVIEW); the disposition of `p15-full-price`, which is transcribed in the +register, not derived here. -/ +theorem globalAssemblyHazard {X : Type} [Fintype X] [DecidableEq X] (F : RealizedData X) : + UniversalLaw.Spec.P15.GlobalAssemblyHazard F := by + intro _ p hp + refine ⟨Aux.mu_le_prod_localGood F hp, fun hmu => ?_⟩ + rw [← Aux.neg_log_prod_localGood F hp hmu] + exact Aux.neg_log_prod_localGood_le F hp hmu + +end UniversalLaw.Proofs.P15Hazard diff --git a/specifications/lean_statement_proofs_20261011/SpecificationProofs/P15Structure.lean b/specifications/lean_statement_proofs_20261011/SpecificationProofs/P15Structure.lean new file mode 100644 index 000000000..22fbee548 --- /dev/null +++ b/specifications/lean_statement_proofs_20261011/SpecificationProofs/P15Structure.lean @@ -0,0 +1,1278 @@ +import Specifications.P15 + +/-! +# P15 finite-structure proofs (benchmark instance and general finite statements) + +Scientific effect: NONE. Organizational-independence credit: 0 (Anthropic / Claude). + +Every theorem in this module has as its type exactly one registered `Prop` of +`Specifications/P15.lean` (statement packet `specifications/lean_statements_20261010`, which is +not modified here). A kernel-checked proof of such a `Prop` is evidence about that `Prop` only: +it does not make the informal Layer 0 note reviewed, accepted or "verified", it does not +identify the formal definitions with the informal objects (that alignment is +PENDING_INDEPENDENT_REVIEW), and it promotes, closes, discharges or reclassifies nothing. + +Helper lemmas live in `UniversalLaw.Proofs.P15Structure.Aux`; the gate inventories only the +theorems outside that namespace. +-/ + +namespace UniversalLaw.Proofs.P15Structure + +open UniversalLaw.Spec.P15 +open Finset + +namespace Aux + +/-! ### Blocks of a realized family -/ + +/-- The blocks of a realized family are nonempty (they have `a_i d_i + 1 ≥ 1` elements). -/ +theorem block_nonempty {X : Type} [Fintype X] {F : RealizedData X} (hF : IsRealizedFamily F) + (i : Fin F.b) : (block F i).Nonempty := by + rw [← Finset.card_pos, hF.2.2.1 i] + exact Nat.succ_pos _ + +/-- An element of `block F i` has block index `i`. -/ +theorem blk_eq_of_mem_block {X : Type} [Fintype X] {F : RealizedData X} {i : Fin F.b} {v : X} + (hv : v ∈ block F i) : F.blk v = i := by + simpa [block] using hv + +/-- Membership in a block. -/ +theorem mem_block_iff {X : Type} [Fintype X] {F : RealizedData X} {i : Fin F.b} {v : X} : + v ∈ block F i ↔ F.blk v = i := by + simp [block] + +/-- The block map of a realized family is injective (blocks are nonempty fibres). -/ +theorem block_injective {X : Type} [Fintype X] {F : RealizedData X} + (hF : IsRealizedFamily F) : Function.Injective (block F) := by + intro i j hij + obtain ⟨v, hv⟩ := block_nonempty hF i + have hvj : v ∈ block F j := hij ▸ hv + rw [← blk_eq_of_mem_block hv, blk_eq_of_mem_block hvj] + +/-- The price of the full-block family is the sum of the block prices. -/ +theorem famPrice_fullBlockFamily {X : Type} [Fintype X] [DecidableEq X] {F : RealizedData X} + (hF : IsRealizedFamily F) (c : X → ℝ) : + famPrice c (fullBlockFamily F) = ∑ i, genPrice c (block F i) := by + unfold famPrice fullBlockFamily + rw [Finset.sum_image (fun i _ j _ h => block_injective hF h)] + +/-! ### The six-block benchmark -/ + +theorem block_benchmark816 (i : Fin 6) : + block benchmark816 i = {i} ×ˢ (univ : Finset (Fin 409)) := by + ext ⟨x, y⟩ + simp only [block, mem_filter, mem_univ, true_and, mem_product, mem_singleton, and_true] + exact Iff.rfl + +theorem card_block_benchmark816' (i : Fin 6) : (block benchmark816 i).card = 409 := by + rw [block_benchmark816 i, card_product, card_singleton, card_univ, Fintype.card_fin] + +/-- The same statement at the dependent index type `Fin benchmark816.b` (definitionally `Fin 6`), +so that it can be used by `rw` on goals produced from the general definitions. -/ +theorem card_block_benchmark816 (i : Fin benchmark816.b) : (block benchmark816 i).card = 409 := + card_block_benchmark816' i + +theorem mem_H_benchmark816' {e : Finset (Fin 6)} (he : e ∈ completeClutter 6 3) : e.card = 4 := by + rw [completeClutter, mem_powersetCard] at he + exact he.2 + +theorem mem_H_benchmark816 {e : Finset (Fin benchmark816.b)} (he : e ∈ benchmark816.H) : + e.card = 4 := + mem_H_benchmark816' he + +theorem benchmark816_isRealized : IsRealizedFamily benchmark816 := by + refine ⟨fun _ => le_rfl, fun _ => ?_, fun i => ?_, fun e he => ?_, fun e he f hf hef => ?_⟩ + · change (1 : ℕ) ≤ 408 + norm_num + · change (block benchmark816 i).card = 1 * 408 + 1 + rw [card_block_benchmark816 i] + · rw [mem_H_benchmark816 he] + norm_num + · exact eq_of_subset_of_card_le hef (by rw [mem_H_benchmark816 he, mem_H_benchmark816 hf]) + +/-- The price of the six full blocks at a constant price vector. -/ +theorem famPrice_const_benchmark816 (r : ℝ) : + famPrice (fun _ => r) (fullBlockFamily benchmark816) = 6 * r ^ 409 := by + rw [famPrice_fullBlockFamily benchmark816_isRealized] + have h : ∀ i : Fin benchmark816.b, genPrice (fun _ => r) (block benchmark816 i) = r ^ 409 := + fun i => by rw [genPrice, prod_const, card_block_benchmark816 i] + rw [Finset.sum_congr rfl (fun i _ => h i), sum_const, card_univ] + change (6 : ℕ) • r ^ 409 = 6 * r ^ 409 + rw [nsmul_eq_mul] + norm_num + +/-- Lower bound on `-log(1 - x)` from the Taylor estimate of Mathlib with three terms. -/ +theorem neg_log_one_sub_gt (x : ℝ) (hx0 : 0 < x) (hx1 : x < 1 / 4) : + x + x ^ 2 / 2 < -Real.log (1 - x) := by + have habs : |x| < 1 := by rw [abs_of_pos hx0]; linarith + have h := Real.abs_log_sub_add_sum_range_le habs 3 + rw [abs_of_pos hx0] at h + simp only [Finset.sum_range_succ, Finset.sum_range_zero] at h + rw [abs_le] at h + obtain ⟨_, h2⟩ := h + have hpos : 0 < 1 - x := by linarith + have key : x ^ 4 / (1 - x) < x ^ 3 / 3 := by + rw [div_lt_div_iff₀ hpos (by norm_num)] + nlinarith [pow_pos hx0 3] + norm_num at h2 + linarith [h2, key] + + +/-! ### Palette numbers of complete clutters -/ + +/-- For the clutter of all `(s+1)`-subsets, the edge condition of a palette says exactly that every +label lies in at most `s` of the label sets. -/ +theorem completeClutter_edge_iff (b s : ℕ) {K : ℕ} (P : Fin b → Finset (Fin K)) : + (∀ e ∈ completeClutter b s, ∀ ℓ : Fin K, ∃ i ∈ e, ℓ ∉ P i) ↔ + ∀ ℓ : Fin K, (univ.filter (fun i => ℓ ∈ P i)).card ≤ s := by + constructor + · intro h ℓ + by_contra hlt + rw [not_le] at hlt + obtain ⟨e, he, hecard⟩ := exists_subset_card_eq (Nat.succ_le_of_lt hlt) + have hmem : e ∈ completeClutter b s := by + rw [completeClutter, mem_powersetCard] + exact ⟨subset_univ _, hecard⟩ + obtain ⟨i, hi, hni⟩ := h e hmem ℓ + exact hni (mem_filter.1 (he hi)).2 + · intro h e he ℓ + rw [completeClutter, mem_powersetCard] at he + by_contra hcon + simp only [not_exists, not_and, not_not] at hcon + have hsub : e ⊆ univ.filter (fun i => ℓ ∈ P i) := + fun i hi => mem_filter.2 ⟨mem_univ _, hcon i hi⟩ + have := card_le_card hsub + have := h ℓ + omega + +/-- Double counting: the total size of the label sets is the sum over labels of their +multiplicities. -/ +theorem sum_card_eq_sum_fiber {b K : ℕ} (P : Fin b → Finset (Fin K)) : + ∑ i, (P i).card = ∑ ℓ : Fin K, (univ.filter (fun i => ℓ ∈ P i)).card := by + have h1 : ∀ i, (P i).card = ∑ ℓ : Fin K, if ℓ ∈ P i then 1 else 0 := fun i => by + rw [sum_boole, Nat.cast_id] + congr 1 + ext ℓ + simp + simp_rw [h1, card_filter] + exact sum_comm + +/-- The two necessary conditions for a feasible palette of the complete clutter. -/ +theorem palette_lower_bounds {b s K : ℕ} {d : Fin b → ℕ} + (hK : IsPaletteFeasible b (completeClutter b s) d K) : + (∀ i, d i ≤ K) ∧ ∑ i, d i ≤ s * K := by + obtain ⟨P, hPd, hPe⟩ := hK + rw [completeClutter_edge_iff] at hPe + refine ⟨fun i => (hPd i).trans (card_finset_fin_le _), ?_⟩ + calc ∑ i, d i ≤ ∑ i, (P i).card := sum_le_sum (fun i _ => hPd i) + _ = ∑ ℓ : Fin K, (univ.filter (fun i => ℓ ∈ P i)).card := sum_card_eq_sum_fiber P + _ ≤ ∑ _ℓ : Fin K, s := sum_le_sum (fun ℓ _ => hPe ℓ) + _ = s * K := by rw [sum_const, card_univ, Fintype.card_fin, smul_eq_mul, mul_comm] + +/-- Prefix sums of the demands: `c_i = sum_{j < i} d_j`. -/ +def prefixSum {b : ℕ} (d : Fin b → ℕ) (i : Fin b) : ℕ := + ∑ j ∈ univ.filter (fun j => j < i), d j + +theorem prefixSum_add_le_of_lt {b : ℕ} (d : Fin b → ℕ) {i i' : Fin b} (h : i < i') : + prefixSum d i + d i ≤ prefixSum d i' := by + unfold prefixSum + have hnot : i ∉ univ.filter (fun j => j < i) := by simp + rw [add_comm, ← sum_insert hnot] + apply sum_le_sum_of_subset + intro j hj + simp only [mem_insert, mem_filter, mem_univ, true_and] at hj ⊢ + rcases hj with rfl | hj + · exact h + · exact hj.trans h + +theorem prefixSum_add_le {b : ℕ} (d : Fin b → ℕ) (i : Fin b) : + prefixSum d i + d i ≤ ∑ j, d j := by + unfold prefixSum + have hnot : i ∉ univ.filter (fun j => j < i) := by simp + rw [add_comm, ← sum_insert hnot] + exact sum_le_sum_of_subset (subset_univ _) + +/-- The cyclic label of a position. -/ +def cycLabel (K : ℕ) (hK : 0 < K) (n : ℕ) : Fin K := ⟨n % K, Nat.mod_lt _ hK⟩ + +/-- The cyclic palette: block `i` receives the labels of the positions `c_i, ..., c_i + d_i - 1` +reduced modulo `K`. -/ +def cycPalette {b : ℕ} (d : Fin b → ℕ) (K : ℕ) (hK : 0 < K) (i : Fin b) : Finset (Fin K) := + (Ico (prefixSum d i) (prefixSum d i + d i)).image (cycLabel K hK) + +theorem mem_cycPalette {b : ℕ} (d : Fin b → ℕ) (K : ℕ) (hK : 0 < K) (i : Fin b) (ℓ : Fin K) : + ℓ ∈ cycPalette d K hK i ↔ + ∃ n, n ∈ Ico (prefixSum d i) (prefixSum d i + d i) ∧ n % K = ℓ.val := by + unfold cycPalette cycLabel + simp only [mem_image, Fin.ext_iff] + +theorem card_cycPalette {b : ℕ} (d : Fin b → ℕ) (K : ℕ) (hK : 0 < K) (i : Fin b) + (hd : d i ≤ K) : (cycPalette d K hK i).card = d i := by + unfold cycPalette + rw [card_image_of_injOn, Nat.card_Ico, Nat.add_sub_cancel_left] + intro n hn n' hn' hnn' + simp only [coe_Ico, Set.mem_Ico] at hn hn' + simp only [cycLabel, Fin.mk.injEq] at hnn' + rcases le_total n n' with h | h + · have h1 := Nat.sub_mod_eq_zero_of_mod_eq hnn'.symm + have h2 : n' - n < K := by omega + rw [Nat.mod_eq_of_lt h2] at h1 + omega + · have h1 := Nat.sub_mod_eq_zero_of_mod_eq hnn' + have h2 : n - n' < K := by omega + rw [Nat.mod_eq_of_lt h2] at h1 + omega + +open Classical in +/-- The first position of block `i` carrying the label `ℓ` (or `0` if there is none). -/ +noncomputable def firstPos {b : ℕ} (d : Fin b → ℕ) (K ℓ : ℕ) (i : Fin b) : ℕ := + if h : ∃ n, n ∈ Ico (prefixSum d i) (prefixSum d i + d i) ∧ n % K = ℓ then Nat.find h else 0 + +theorem firstPos_spec {b : ℕ} (d : Fin b → ℕ) (K ℓ : ℕ) (i : Fin b) + (hex : ∃ n, n ∈ Ico (prefixSum d i) (prefixSum d i + d i) ∧ n % K = ℓ) : + firstPos d K ℓ i ∈ Ico (prefixSum d i) (prefixSum d i + d i) ∧ firstPos d K ℓ i % K = ℓ := by + unfold firstPos + split_ifs + exact Nat.find_spec hex + +/-- At most `s` positions below `s * K` carry a given residue modulo `K`. -/ +theorem card_residue_le {K s D : ℕ} (hK : 0 < K) (hD : D ≤ s * K) (ℓ : ℕ) : + ((range D).filter (fun n => n % K = ℓ)).card ≤ s := by + calc ((range D).filter (fun n => n % K = ℓ)).card ≤ (range s).card := + card_le_card_of_injOn (fun n => n / K) ?_ ?_ + _ = s := card_range s + · intro n hn + simp only [mem_coe, mem_filter, mem_range] at hn ⊢ + exact (Nat.div_lt_iff_lt_mul hK).2 (hn.1.trans_le hD) + · intro n hn n' hn' h + simp only [mem_coe, mem_filter, mem_range] at hn hn' + have h' : n / K = n' / K := h + calc n = K * (n / K) + n % K := (Nat.div_add_mod n K).symm + _ = K * (n' / K) + n' % K := by rw [h', hn.2, hn'.2] + _ = n' := Nat.div_add_mod n' K + +/-- The cyclic palette is feasible for the complete clutter whenever the two necessary conditions +hold. -/ +theorem palette_witness {b s K : ℕ} (d : Fin b → ℕ) (hdK : ∀ i, d i ≤ K) + (hsum : ∑ i, d i ≤ s * K) : IsPaletteFeasible b (completeClutter b s) d K := by + rcases Nat.eq_zero_or_pos K with hK0 | hK + · subst hK0 + refine ⟨fun _ => ∅, fun i => by simpa using hdK i, fun e _ ℓ => ℓ.elim0⟩ + · refine ⟨cycPalette d K hK, fun i => (card_cycPalette d K hK i (hdK i)).ge, ?_⟩ + rw [completeClutter_edge_iff] + intro ℓ + calc (univ.filter (fun i => ℓ ∈ cycPalette d K hK i)).card + ≤ ((range (∑ i, d i)).filter (fun n => n % K = ℓ.val)).card := + card_le_card_of_injOn (firstPos d K ℓ.val) ?_ ?_ + _ ≤ s := card_residue_le hK hsum ℓ.val + · intro i hi + simp only [mem_coe, mem_filter, mem_univ, true_and, mem_cycPalette] at hi + obtain ⟨h1, h2⟩ := firstPos_spec d K ℓ.val i hi + simp only [mem_coe, mem_filter, mem_range] + refine ⟨?_, h2⟩ + have := (mem_Ico.1 h1).2 + have := prefixSum_add_le d i + omega + · intro i hi i' hi' hii' + simp only [mem_coe, mem_filter, mem_univ, true_and, mem_cycPalette] at hi hi' + have h1 := mem_Ico.1 (firstPos_spec d K ℓ.val i hi).1 + have h2 := mem_Ico.1 (firstPos_spec d K ℓ.val i' hi').1 + rw [hii'] at h1 + by_contra hne + rcases lt_or_gt_of_ne hne with hlt | hlt + · have := prefixSum_add_le_of_lt d hlt + omega + · have := prefixSum_add_le_of_lt d hlt + omega + +/-- The palette number of the complete clutter, display (P9), in expanded form. -/ +theorem paletteNumber_completeClutter (b s : ℕ) (d : Fin b → ℕ) (hs : 1 ≤ s) : + paletteNumber b (completeClutter b s) d = + max (univ.sup d) ⌈((∑ i, d i : ℕ) : ℚ) / (s : ℚ)⌉₊ := by + have hs' : (0 : ℚ) < s := by exact_mod_cast hs + apply IsLeast.csInf_eq + constructor + · show IsPaletteFeasible b (completeClutter b s) d _ + apply palette_witness + · intro i + exact (le_sup (mem_univ i)).trans (le_max_left _ _) + · have h1 : ((∑ i, d i : ℕ) : ℚ) / s ≤ ⌈((∑ i, d i : ℕ) : ℚ) / s⌉₊ := Nat.le_ceil _ + have h2 : (⌈((∑ i, d i : ℕ) : ℚ) / s⌉₊ : ℚ) ≤ + (max (univ.sup d) ⌈((∑ i, d i : ℕ) : ℚ) / (s : ℚ)⌉₊ : ℕ) := by + exact_mod_cast le_max_right _ _ + rw [div_le_iff₀ hs'] at h1 + have h3 : ((∑ i, d i : ℕ) : ℚ) ≤ + (s : ℚ) * (max (univ.sup d) ⌈((∑ i, d i : ℕ) : ℚ) / (s : ℚ)⌉₊ : ℕ) := by + calc ((∑ i, d i : ℕ) : ℚ) ≤ (⌈((∑ i, d i : ℕ) : ℚ) / s⌉₊ : ℚ) * s := h1 + _ ≤ (max (univ.sup d) ⌈((∑ i, d i : ℕ) : ℚ) / (s : ℚ)⌉₊ : ℕ) * s := + mul_le_mul_of_nonneg_right h2 hs'.le + _ = _ := mul_comm _ _ + exact_mod_cast h3 + · intro K hK + obtain ⟨h1, h2⟩ := palette_lower_bounds hK + apply max_le + · exact Finset.sup_le (fun i _ => h1 i) + · rw [Nat.ceil_le, div_le_iff₀ hs'] + exact_mod_cast (by rw [mul_comm]; exact h2 : ∑ i, d i ≤ K * s) + + +/-! ### Palettes exist and are upward closed -/ + +/-- Disjoint label intervals give a feasible palette of size `sum d_i` for any clutter whose edges +have at least two elements. -/ +theorem isPaletteFeasible_sum {b : ℕ} (H : Finset (Finset (Fin b))) (d : Fin b → ℕ) + (hH : ∀ e ∈ H, 2 ≤ e.card) : IsPaletteFeasible b H d (∑ i, d i) := by + refine ⟨fun i => (Ico (prefixSum d i) (prefixSum d i + d i)).attachFin + (fun m hm => lt_of_lt_of_le (mem_Ico.1 hm).2 (prefixSum_add_le d i)), fun i => ?_, ?_⟩ + · rw [card_attachFin, Nat.card_Ico, Nat.add_sub_cancel_left] + · intro e he ℓ + by_contra hcon + simp only [not_exists, not_and, mem_attachFin, mem_Ico] at hcon + have h2 := hH e he + obtain ⟨i, hi⟩ : e.Nonempty := card_pos.1 (by omega) + obtain ⟨j, hj, hji⟩ := exists_mem_ne (by omega : 1 < e.card) i + have h1 := hcon i hi + have h2 := hcon j hj + rcases lt_or_gt_of_ne hji with hlt | hlt + · have := prefixSum_add_le_of_lt d hlt + omega + · have := prefixSum_add_le_of_lt d hlt + omega + +/-- Feasibility is upward closed in the palette size (for clutters with edges of size `≥ 2`). -/ +theorem isPaletteFeasible_mono {b : ℕ} (H : Finset (Finset (Fin b))) (d : Fin b → ℕ) + (hH : ∀ e ∈ H, 2 ≤ e.card) {K K' : ℕ} (hKK' : K ≤ K') + (h : IsPaletteFeasible b H d K) : IsPaletteFeasible b H d K' := by + obtain ⟨P, hPd, hPe⟩ := h + refine ⟨fun i => (P i).map (Fin.castLEEmb hKK'), fun i => ?_, ?_⟩ + · rw [card_map] + exact hPd i + · intro e he ℓ + by_cases hℓ : ℓ.val < K + · obtain ⟨i, hi, hni⟩ := hPe e he ⟨ℓ.val, hℓ⟩ + refine ⟨i, hi, fun hmem => hni ?_⟩ + rw [mem_map] at hmem + obtain ⟨ℓ', hℓ', hcast⟩ := hmem + have : ℓ' = ⟨ℓ.val, hℓ⟩ := by + apply Fin.ext + have := congrArg Fin.val hcast + simpa using this + rw [← this] + exact hℓ' + · have h2 := hH e he + obtain ⟨i, hi⟩ : e.Nonempty := card_pos.1 (by omega) + refine ⟨i, hi, fun hmem => hℓ ?_⟩ + rw [mem_map] at hmem + obtain ⟨ℓ', _, hcast⟩ := hmem + rw [← hcast] + simp + +/-- The palette number is attained and bounded by `sum d_i` when every edge has size `≥ 2`. -/ +theorem isPaletteFeasible_paletteNumber {b : ℕ} (H : Finset (Finset (Fin b))) (d : Fin b → ℕ) + (hH : ∀ e ∈ H, 2 ≤ e.card) : IsPaletteFeasible b H d (paletteNumber b H d) := by + have h : sInf {K : ℕ | IsPaletteFeasible b H d K} ∈ {K : ℕ | IsPaletteFeasible b H d K} := + csInf_mem ⟨∑ i, d i, isPaletteFeasible_sum H d hH⟩ + exact h + +theorem isPaletteFeasible_of_paletteNumber_le {b : ℕ} (H : Finset (Finset (Fin b))) + (d : Fin b → ℕ) (hH : ∀ e ∈ H, 2 ≤ e.card) {K : ℕ} (hK : paletteNumber b H d ≤ K) : + IsPaletteFeasible b H d K := + isPaletteFeasible_mono H d hH hK (isPaletteFeasible_paletteNumber H d hH) + +theorem paletteNumber_le_of_feasible {b : ℕ} (H : Finset (Finset (Fin b))) (d : Fin b → ℕ) + {K : ℕ} (hK : IsPaletteFeasible b H d K) : paletteNumber b H d ≤ K := + csInf_le' (show K ∈ {K : ℕ | IsPaletteFeasible b H d K} from hK) + +/-! ### Decompositions of a set into good parts versus palettes -/ + +section Decomp + +variable {X : Type} [Fintype X] [DecidableEq X] {F : RealizedData X} + +/-- A `K`-decomposition of `U` yields a palette with `|U ∩ X_i| ≤ a_i |P_i|`: `P_i` is the set of +parts meeting `X_i`. -/ +theorem palette_of_decomposable {K : ℕ} {U : Finset X} (h : IsKDecomposable F K U) : + ∃ P : Fin F.b → Finset (Fin K), (∀ i, (U ∩ block F i).card ≤ F.a i * (P i).card) ∧ + ∀ e ∈ F.H, ∀ ℓ : Fin K, ∃ i ∈ e, ℓ ∉ P i := by + obtain ⟨parts, hgood, -, hunion⟩ := h + refine ⟨fun i => univ.filter (fun ℓ => (parts ℓ ∩ block F i).Nonempty), fun i => ?_, ?_⟩ + · set S := univ.filter (fun ℓ => (parts ℓ ∩ block F i).Nonempty) with hS + have hU : U ∩ block F i = S.biUnion (fun ℓ => parts ℓ ∩ block F i) := by + ext v + simp only [hS, mem_inter, mem_biUnion, mem_filter, mem_univ, true_and] + constructor + · rintro ⟨hvU, hvb⟩ + rw [← hunion, mem_biUnion] at hvU + obtain ⟨ℓ, -, hvℓ⟩ := hvU + exact ⟨ℓ, ⟨v, mem_inter.2 ⟨hvℓ, hvb⟩⟩, hvℓ, hvb⟩ + · rintro ⟨ℓ, -, hvℓ, hvb⟩ + refine ⟨?_, hvb⟩ + rw [← hunion, mem_biUnion] + exact ⟨ℓ, mem_univ _, hvℓ⟩ + rw [hU] + calc (S.biUnion (fun ℓ => parts ℓ ∩ block F i)).card + ≤ ∑ ℓ ∈ S, (parts ℓ ∩ block F i).card := card_biUnion_le + _ ≤ ∑ _ℓ ∈ S, F.a i := sum_le_sum (fun ℓ _ => (hgood ℓ).1 i) + _ = F.a i * S.card := by rw [sum_const, smul_eq_mul, mul_comm] + · intro e he ℓ + by_contra hcon + simp only [not_exists, not_and, not_not, mem_filter, mem_univ, true_and] at hcon + apply (hgood ℓ).2 e he + intro i hi + obtain ⟨v, hv⟩ := hcon i hi + rw [mem_inter] at hv + rw [supp, mem_image] + exact ⟨v, hv.1, blk_eq_of_mem_block hv.2⟩ + +/-- The index of `v` within `U ∩ X_i` (`0` if `v` is not there). -/ +noncomputable def idxIn (F : RealizedData X) (U : Finset X) (i : Fin F.b) (v : X) : ℕ := + if h : v ∈ U ∩ block F i then ((U ∩ block F i).equivFin ⟨v, h⟩).val else 0 + +theorem idxIn_lt (F : RealizedData X) (U : Finset X) (i : Fin F.b) {v : X} + (hv : v ∈ U ∩ block F i) : idxIn F U i v < (U ∩ block F i).card := by + unfold idxIn + split_ifs + exact Fin.isLt _ + +theorem idxIn_inj (F : RealizedData X) (U : Finset X) (i : Fin F.b) {v w : X} + (hv : v ∈ U ∩ block F i) (hw : w ∈ U ∩ block F i) (h : idxIn F U i v = idxIn F U i w) : + v = w := by + unfold idxIn at h + split_ifs at h + have := (U ∩ block F i).equivFin.injective (Fin.ext h) + exact congrArg Subtype.val this + +/-- The `r`-th label of `P_i`, as an `Option`. -/ +noncomputable def labOf {b K : ℕ} (P : Fin b → Finset (Fin K)) (i : Fin b) (r : ℕ) : + Option (Fin K) := + if h : r < (P i).card then some ((P i).orderEmbOfFin rfl ⟨r, h⟩) else none + +theorem labOf_mem {b K : ℕ} (P : Fin b → Finset (Fin K)) (i : Fin b) (r : ℕ) (ℓ : Fin K) + (h : labOf P i r = some ℓ) : ℓ ∈ P i := by + unfold labOf at h + split_ifs at h with hr + rw [Option.some_inj] at h + rw [← h] + exact orderEmbOfFin_mem _ _ _ + +theorem labOf_inj {b K : ℕ} (P : Fin b → Finset (Fin K)) (i : Fin b) {r r' : ℕ} {ℓ : Fin K} + (h : labOf P i r = some ℓ) (h' : labOf P i r' = some ℓ) : r = r' := by + unfold labOf at h h' + split_ifs at h h' with hr hr' + rw [Option.some_inj] at h h' + have := ((P i).orderEmbOfFin rfl).injective (h.trans h'.symm) + exact Fin.mk.inj_iff.1 this + +theorem labOf_isSome {b K : ℕ} (P : Fin b → Finset (Fin K)) (i : Fin b) {r : ℕ} + (hr : r < (P i).card) : ∃ ℓ, labOf P i r = some ℓ := by + unfold labOf + split_ifs + exact ⟨_, rfl⟩ + +/-- The colour of `v`: the `(idx v / a_i)`-th label of `P_{blk v}`. -/ +noncomputable def colOf (F : RealizedData X) (U : Finset X) {K : ℕ} + (P : Fin F.b → Finset (Fin K)) (v : X) : Option (Fin K) := + labOf P (F.blk v) (idxIn F U (F.blk v) v / F.a (F.blk v)) + +/-- The colour class of `ℓ` inside `U`. -/ +noncomputable def partOf (F : RealizedData X) (U : Finset X) {K : ℕ} + (P : Fin F.b → Finset (Fin K)) (ℓ : Fin K) : Finset X := + U.filter (fun v => colOf F U P v = some ℓ) + +theorem colOf_isSome (hF : IsRealizedFamily F) {U : Finset X} {K : ℕ} + {P : Fin F.b → Finset (Fin K)} (hcard : ∀ i, (U ∩ block F i).card ≤ F.a i * (P i).card) + {v : X} (hv : v ∈ U) : ∃ ℓ, colOf F U P v = some ℓ := by + apply labOf_isSome + have hvi : v ∈ U ∩ block F (F.blk v) := mem_inter.2 ⟨hv, mem_block_iff.2 rfl⟩ + have h1 := idxIn_lt F U (F.blk v) hvi + have h2 := hcard (F.blk v) + have ha : 0 < F.a (F.blk v) := hF.1 (F.blk v) + rw [Nat.div_lt_iff_lt_mul ha] + calc idxIn F U (F.blk v) v < (U ∩ block F (F.blk v)).card := h1 + _ ≤ F.a (F.blk v) * (P (F.blk v)).card := h2 + _ = (P (F.blk v)).card * F.a (F.blk v) := mul_comm _ _ + +theorem partOf_good (hF : IsRealizedFamily F) {U : Finset X} {K : ℕ} + {P : Fin F.b → Finset (Fin K)} + (hedge : ∀ e ∈ F.H, ∀ ℓ : Fin K, ∃ i ∈ e, ℓ ∉ P i) (ℓ : Fin K) : + IsGood F (partOf F U P ℓ) := by + refine ⟨fun i => ?_, fun e he hsub => ?_⟩ + · by_cases hne : (partOf F U P ℓ ∩ block F i).Nonempty + · obtain ⟨v₀, hv₀⟩ := hne + have ha : 0 < F.a i := hF.1 i + have hr : ∀ v ∈ partOf F U P ℓ ∩ block F i, + idxIn F U i v / F.a i = idxIn F U i v₀ / F.a i := by + intro v hv + rw [mem_inter, partOf, mem_filter] at hv hv₀ + have hbv := blk_eq_of_mem_block hv.2 + have hbv₀ := blk_eq_of_mem_block hv₀.2 + have h1 := hv.1.2 + have h2 := hv₀.1.2 + unfold colOf at h1 h2 + rw [hbv] at h1 + rw [hbv₀] at h2 + exact labOf_inj P i h1 h2 + calc (partOf F U P ℓ ∩ block F i).card + ≤ (Ico (idxIn F U i v₀ / F.a i * F.a i) + ((idxIn F U i v₀ / F.a i + 1) * F.a i)).card := + card_le_card_of_injOn (idxIn F U i) ?_ ?_ + _ = F.a i := by rw [Nat.card_Ico, add_mul, one_mul, Nat.add_sub_cancel_left] + · intro v hv + rw [mem_coe] at hv + have hr' := hr v hv + rw [mem_coe, mem_Ico] + constructor + · exact (Nat.le_div_iff_mul_le ha).1 hr'.ge + · have : idxIn F U i v / F.a i < idxIn F U i v₀ / F.a i + 1 := by + rw [hr'] + exact Nat.lt_succ_self _ + exact (Nat.div_lt_iff_lt_mul ha).1 this + · intro v hv w hw hvw + rw [mem_coe, mem_inter, partOf, mem_filter] at hv hw + exact idxIn_inj F U i (mem_inter.2 ⟨hv.1.1, hv.2⟩) (mem_inter.2 ⟨hw.1.1, hw.2⟩) hvw + · rw [not_nonempty_iff_eq_empty] at hne + rw [hne, card_empty] + exact Nat.zero_le _ + · obtain ⟨i, hi, hni⟩ := hedge e he ℓ + have := hsub hi + rw [supp, mem_image] at this + obtain ⟨v, hv, hbv⟩ := this + rw [partOf, mem_filter] at hv + have h1 := hv.2 + unfold colOf at h1 + rw [hbv] at h1 + exact hni (labOf_mem P i _ ℓ h1) + +theorem partOf_disjoint (F : RealizedData X) (U : Finset X) {K : ℕ} + (P : Fin F.b → Finset (Fin K)) {ℓ ℓ' : Fin K} (h : ℓ ≠ ℓ') : + Disjoint (partOf F U P ℓ) (partOf F U P ℓ') := by + rw [disjoint_left] + intro v hv hv' + rw [partOf, mem_filter] at hv hv' + apply h + rw [← Option.some_inj, ← hv.2, ← hv'.2] + +theorem biUnion_partOf (hF : IsRealizedFamily F) {U : Finset X} {K : ℕ} + {P : Fin F.b → Finset (Fin K)} (hcard : ∀ i, (U ∩ block F i).card ≤ F.a i * (P i).card) : + (univ : Finset (Fin K)).biUnion (partOf F U P) = U := by + ext v + rw [mem_biUnion] + constructor + · rintro ⟨ℓ, -, hv⟩ + exact (mem_filter.1 hv).1 + · intro hv + obtain ⟨ℓ, hℓ⟩ := colOf_isSome hF hcard hv + exact ⟨ℓ, mem_univ _, mem_filter.2 ⟨hv, hℓ⟩⟩ + +/-- A palette with `|U ∩ X_i| ≤ a_i |P_i|` yields a `K`-decomposition of `U`. -/ +theorem decomposable_of_palette (hF : IsRealizedFamily F) {K : ℕ} {U : Finset X} + (P : Fin F.b → Finset (Fin K)) (hcard : ∀ i, (U ∩ block F i).card ≤ F.a i * (P i).card) + (hedge : ∀ e ∈ F.H, ∀ ℓ : Fin K, ∃ i ∈ e, ℓ ∉ P i) : IsKDecomposable F K U := + ⟨partOf F U P, fun ℓ => partOf_good hF hedge ℓ, fun _ _ h => partOf_disjoint F U P h, + biUnion_partOf hF hcard⟩ + +omit [DecidableEq X] in +/-- Blocks are pairwise disjoint. -/ +theorem block_disjoint (F : RealizedData X) {i j : Fin F.b} (h : i ≠ j) : + Disjoint (block F i) (block F j) := by + rw [disjoint_left] + intro v hv hv' + exact h ((blk_eq_of_mem_block hv).symm.trans (blk_eq_of_mem_block hv')) + +/-- Section 3: `I_k(D_i) = {S : |S| ≤ a_i k}`, in expanded form. -/ +theorem localDecomposability_expanded (hF : IsRealizedFamily F) (i : Fin F.b) (k : ℕ) + (S : Finset X) (hS : S ⊆ block F i) : IsKDecomposable F k S ↔ S.card ≤ F.a i * k := by + constructor + · intro h + obtain ⟨P, hcard, -⟩ := palette_of_decomposable h + have := hcard i + rw [inter_eq_left.2 hS] at this + exact this.trans (Nat.mul_le_mul_left _ (card_finset_fin_le _)) + · intro h + classical + apply decomposable_of_palette hF (fun j => if j = i then univ else ∅) + · intro j + by_cases hj : j = i + · subst hj + rw [inter_eq_left.2 hS, ite_eq_left rfl, card_univ, Fintype.card_fin] + exact h + · rw [ite_eq_right hj] + have : S ∩ block F j = ∅ := by + rw [← disjoint_iff_inter_eq_empty] + exact (block_disjoint F (Ne.symm hj)).mono_left hS + rw [this, card_empty, card_empty] + exact Nat.zero_le _ + · intro e he ℓ + have h2 := hF.2.2.2.1 e he + obtain ⟨j, hj, hji⟩ := exists_mem_ne (by omega : 1 < e.card) i + refine ⟨j, hj, ?_⟩ + rw [ite_eq_right hji] + exact notMem_empty _ + +end Decomp + + +/-! ### Minimal forbidden sets -/ + +section MinForb + +variable {X : Type} [Fintype X] [DecidableEq X] {F : RealizedData X} + +omit [Fintype X] [DecidableEq X] in +theorem mem_supp_iff {U : Finset X} {i : Fin F.b} : i ∈ supp F U ↔ ∃ v ∈ U, F.blk v = i := by + rw [supp, mem_image] + +/-- A subset of one block with at most `a_i` elements is good. -/ +theorem good_of_subset_block (hF : IsRealizedFamily F) {i : Fin F.b} {S : Finset X} + (hS : S ⊆ block F i) (hcard : S.card ≤ F.a i) : IsGood F S := by + refine ⟨fun j => ?_, fun e he hsub => ?_⟩ + · by_cases hj : j = i + · subst hj + rw [inter_eq_left.2 hS] + exact hcard + · have : S ∩ block F j = ∅ := by + rw [← disjoint_iff_inter_eq_empty] + exact (block_disjoint F (Ne.symm hj)).mono_left hS + rw [this, card_empty] + exact Nat.zero_le _ + · have hsupp : supp F S ⊆ {i} := by + intro j hj + obtain ⟨v, hv, rfl⟩ := mem_supp_iff.1 hj + rw [mem_singleton] + exact blk_eq_of_mem_block (hS hv) + have h1 := card_le_card (hsub.trans hsupp) + have h2 := hF.2.2.2.1 e he + rw [card_singleton] at h1 + omega + +/-- Removing an element outside `X_i` does not change the intersection with `X_i`. -/ +theorem erase_inter_block_of_blk_ne {U : Finset X} {v : X} {i : Fin F.b} (h : F.blk v ≠ i) : + U.erase v ∩ block F i = U ∩ block F i := by + ext w + simp only [mem_inter, mem_erase, mem_block_iff] + constructor + · rintro ⟨⟨-, hw⟩, hb⟩ + exact ⟨hw, hb⟩ + · rintro ⟨hw, hb⟩ + refine ⟨⟨fun hwv => h (hwv ▸ hb), hw⟩, hb⟩ + +/-- Proposition P1 in expanded form. -/ +theorem minimalForbidden_iff (hF : IsRealizedFamily F) (U : Finset X) : + IsMinimalForbidden F U ↔ + ((∃ i, U ⊆ block F i ∧ U.card = F.a i + 1) ∨ ∃ e ∈ F.H, IsTransversal F e U) := by + constructor + · rintro ⟨hbad, hmin⟩ + by_cases hcap : ∃ i, F.a i < (U ∩ block F i).card + · obtain ⟨i, hi⟩ := hcap + left + have hsub : U ⊆ block F i := by + intro v hv + by_contra hvb + have hne : F.blk v ≠ i := fun h => hvb (mem_block_iff.2 h) + have := (hmin v hv).1 i + rw [erase_inter_block_of_blk_ne hne] at this + omega + refine ⟨i, hsub, ?_⟩ + rw [inter_eq_left.2 hsub] at hi + by_contra hne + have hgt : F.a i + 1 < U.card := by omega + obtain ⟨v, hv⟩ : U.Nonempty := card_pos.1 (by omega) + have := (hmin v hv).1 i + rw [inter_eq_left.2 ((erase_subset _ _).trans hsub), card_erase_of_mem hv] at this + omega + · right + have hcap' : ∀ i, (U ∩ block F i).card ≤ F.a i := by + intro i + by_contra h + exact hcap ⟨i, by omega⟩ + have hex : ¬ ∀ e ∈ F.H, ¬ e ⊆ supp F U := fun hB => hbad ⟨hcap', hB⟩ + simp only [not_forall, not_not] at hex + obtain ⟨e, he, hsub⟩ := hex + -- every element of `U` is alone in its block, and its block lies in `e` + have key : ∀ v ∈ U, F.blk v ∈ e ∧ ∀ w ∈ U, F.blk w = F.blk v → w = v := by + intro v hv + have hgood := (hmin v hv).2 e he + have : ∃ i ∈ e, i ∉ supp F (U.erase v) := by + by_contra hall + simp only [not_exists, not_and, not_not] at hall + exact hgood (fun i hi => hall i hi) + obtain ⟨i, hi, hni⟩ := this + obtain ⟨w, hw, hwi⟩ := mem_supp_iff.1 (hsub hi) + have hwv : w = v := by + by_contra hwv + exact hni (mem_supp_iff.2 ⟨w, mem_erase.2 ⟨hwv, hw⟩, hwi⟩) + subst hwv + refine ⟨hwi ▸ hi, fun u hu hub => ?_⟩ + by_contra huw + exact hni (mem_supp_iff.2 ⟨u, mem_erase.2 ⟨huw, hu⟩, hub.trans hwi⟩) + refine ⟨e, he, ?_, fun i hi => ?_⟩ + · apply Subset.antisymm + · intro i hi + obtain ⟨v, hv, rfl⟩ := mem_supp_iff.1 hi + exact (key v hv).1 + · exact hsub + · obtain ⟨v, hv, hvi⟩ := mem_supp_iff.1 (hsub hi) + rw [card_eq_one] + refine ⟨v, ?_⟩ + ext w + simp only [mem_inter, mem_block_iff, mem_singleton] + constructor + · rintro ⟨hw, hwi⟩ + exact (key v hv).2 w hw (hwi.trans hvi.symm) + · rintro rfl + exact ⟨hv, hvi⟩ + · rintro (⟨i, hU, hcard⟩ | ⟨e, he, hsupp, hone⟩) + · refine ⟨fun hg => ?_, fun v hv => ?_⟩ + · have := hg.1 i + rw [inter_eq_left.2 hU] at this + omega + · apply good_of_subset_block hF ((erase_subset _ _).trans hU) + rw [card_erase_of_mem hv, hcard] + exact Nat.le_refl _ + · refine ⟨fun hg => hg.2 e he (by rw [hsupp]), fun v hv => ⟨fun i => ?_, fun f hf hsub => ?_⟩⟩ + · refine (card_le_card (inter_subset_inter_right (erase_subset v U))).trans ?_ + by_cases hi : i ∈ e + · rw [hone i hi] + exact hF.1 i + · have : U ∩ block F i = ∅ := by + rw [eq_empty_iff_forall_notMem] + intro w hw + rw [mem_inter, mem_block_iff] at hw + exact hi (hsupp ▸ mem_supp_iff.2 ⟨w, hw.1, hw.2⟩) + rw [this, card_empty] + exact Nat.zero_le _ + · have hbv : F.blk v ∈ e := hsupp ▸ mem_supp_iff.2 ⟨v, hv, rfl⟩ + have hsub' : supp F (U.erase v) ⊆ e.erase (F.blk v) := by + intro j hj + obtain ⟨w, hw, rfl⟩ := mem_supp_iff.1 hj + rw [mem_erase] at hw + rw [mem_erase] + refine ⟨fun hwv => hw.1 ?_, hsupp ▸ mem_supp_iff.2 ⟨w, hw.2, rfl⟩⟩ + have hle : (U ∩ block F (F.blk v)).card ≤ 1 := by rw [hone (F.blk v) hbv] + rw [card_le_one] at hle + exact hle w (mem_inter.2 ⟨hw.2, mem_block_iff.2 hwv⟩) v + (mem_inter.2 ⟨hv, mem_block_iff.2 rfl⟩) + have hfe : f ⊆ e := hsub.trans (hsub'.trans (erase_subset _ _)) + have := hF.2.2.2.2 f hf e he hfe + subst this + exact notMem_erase (F.blk v) f (hsub'.trans' hsub hbv) + +end MinForb + + +/-! ### Counting the minimal forbidden sets of the six-block benchmark -/ + +section Count816 + +/-- Proposition P1 for the six-block data (`a_i = 1`). -/ +theorem minForb816_iff (U : Finset (Fin 6 × Fin 409)) : + IsMinimalForbidden benchmark816 U ↔ + ((∃ i, U ⊆ block benchmark816 i ∧ U.card = 2) ∨ + ∃ e ∈ benchmark816.H, IsTransversal benchmark816 e U) := + minimalForbidden_iff benchmark816_isRealized U + +theorem supp_eq_singleton_of_pair {U : Finset (Fin 6 × Fin 409)} {i : Fin benchmark816.b} + (hU : U ⊆ block benchmark816 i) (hcard : U.card = 2) : supp benchmark816 U = {i} := by + apply Subset.antisymm + · intro j hj + obtain ⟨v, hv, rfl⟩ := mem_supp_iff.1 hj + rw [mem_singleton] + exact blk_eq_of_mem_block (hU hv) + · intro j hj + rw [mem_singleton] at hj + subst hj + obtain ⟨v, hv⟩ : U.Nonempty := card_pos.1 (by omega) + exact mem_supp_iff.2 ⟨v, hv, blk_eq_of_mem_block (hU hv)⟩ + +/-- The pairs inside a single block. -/ +def pairs816 : Finset (Finset (Fin 6 × Fin 409)) := + (univ : Finset (Fin benchmark816.b)).biUnion (fun i => (block benchmark816 i).powersetCard 2) + +theorem mem_pairs816 {U : Finset (Fin 6 × Fin 409)} : + U ∈ pairs816 ↔ ∃ i, U ⊆ block benchmark816 i ∧ U.card = 2 := by + simp only [pairs816, mem_biUnion, mem_univ, true_and, mem_powersetCard] + +theorem card_pairs816 : pairs816.card = 6 * Nat.choose 409 2 := by + unfold pairs816 + rw [card_biUnion] + · have h : ∀ i : Fin benchmark816.b, + ((block benchmark816 i).powersetCard 2).card = Nat.choose 409 2 := fun i => by + rw [card_powersetCard, card_block_benchmark816 i] + rw [Finset.sum_congr rfl (fun i _ => h i), sum_const, card_univ, Fintype.card_fin] + have hb : benchmark816.b = 6 := rfl + rw [hb, smul_eq_mul] + · intro i _ j _ hij + rw [Function.onFun, disjoint_left] + intro U hUi hUj + rw [mem_powersetCard] at hUi hUj + obtain ⟨v, hv⟩ : U.Nonempty := card_pos.1 (by omega) + exact hij ((blk_eq_of_mem_block (hUi.1 hv)).symm.trans (blk_eq_of_mem_block (hUj.1 hv))) + +end Count816 + +section Transversals + +variable {ι β : Type} [Fintype ι] [DecidableEq ι] [Fintype β] [DecidableEq β] + +/-- The candidate transversals of `e` in a product ground type: the images of `e` under +`i ↦ (σ i, g i)` for `g` ranging over a product set (`b₀` is a dummy value off `e`). -/ +def transOf (F : RealizedData (ι × β)) (σ : Fin F.b → ι) (b₀ : β) (e : Finset (Fin F.b)) : + Finset (Finset (ι × β)) := + (Fintype.piFinset (fun i : Fin F.b => if i ∈ e then (univ : Finset β) else {b₀})).image + (fun g => e.image (fun i => (σ i, g i))) + +omit [Fintype ι] [DecidableEq ι] [Fintype β] [DecidableEq β] in +theorem sigma_injective {F : RealizedData (ι × β)} {σ : Fin F.b → ι} (b₀ : β) + (hσ : ∀ (v : ι × β) (i : Fin F.b), F.blk v = i ↔ v.1 = σ i) : Function.Injective σ := by + intro i j h + have hi : F.blk (σ i, b₀) = i := (hσ _ _).2 rfl + have hj : F.blk (σ i, b₀) = j := (hσ _ _).2 h + exact hi.symm.trans hj + +theorem mem_transOf {F : RealizedData (ι × β)} {σ : Fin F.b → ι} {b₀ : β} + (hσ : ∀ (v : ι × β) (i : Fin F.b), F.blk v = i ↔ v.1 = σ i) (e : Finset (Fin F.b)) + (U : Finset (ι × β)) : U ∈ transOf F σ b₀ e ↔ IsTransversal F e U := by + have hinj := sigma_injective b₀ hσ + constructor + · intro hU + rw [transOf, mem_image] at hU + obtain ⟨g, -, rfl⟩ := hU + refine ⟨?_, fun i hi => ?_⟩ + · ext j + rw [mem_supp_iff] + constructor + · rintro ⟨v, hv, hvj⟩ + rw [mem_image] at hv + obtain ⟨i, hi, rfl⟩ := hv + rw [hσ] at hvj + exact hinj hvj ▸ hi + · intro hj + exact ⟨(σ j, g j), mem_image.2 ⟨j, hj, rfl⟩, (hσ _ _).2 rfl⟩ + · rw [card_eq_one] + refine ⟨(σ i, g i), ?_⟩ + ext v + rw [mem_inter, mem_block_iff, mem_singleton, mem_image] + constructor + · rintro ⟨⟨j, hj, rfl⟩, hji⟩ + rw [hσ] at hji + have := hinj hji + subst this + rfl + · rintro rfl + exact ⟨⟨i, hi, rfl⟩, (hσ _ _).2 rfl⟩ + · rintro ⟨hsupp, hone⟩ + classical + rw [transOf, mem_image] + let g : Fin F.b → β := fun i => if h : ∃ y, (σ i, y) ∈ U then Classical.choose h else b₀ + have hg : ∀ i ∈ e, (σ i, g i) ∈ U := by + intro i hi + obtain ⟨v, hv, hvi⟩ := mem_supp_iff.1 (hsupp ▸ hi) + rw [hσ] at hvi + have hex : ∃ y, (σ i, y) ∈ U := ⟨v.2, by rw [← hvi]; exact hv⟩ + show (σ i, if h : ∃ y, (σ i, y) ∈ U then Classical.choose h else b₀) ∈ U + rw [dite_eq_left hex] + exact Classical.choose_spec hex + refine ⟨g, ?_, ?_⟩ + · rw [Fintype.mem_piFinset] + intro i + by_cases hi : i ∈ e + · rw [ite_eq_left hi] + exact mem_univ _ + · rw [ite_eq_right hi, mem_singleton] + have hex : ¬ ∃ y, (σ i, y) ∈ U := by + rintro ⟨y, hy⟩ + exact hi (hsupp ▸ mem_supp_iff.2 ⟨(σ i, y), hy, (hσ _ _).2 rfl⟩) + show (if h : ∃ y, (σ i, y) ∈ U then Classical.choose h else b₀) = b₀ + rw [dite_eq_right hex] + · apply Subset.antisymm + · intro v hv + rw [mem_image] at hv + obtain ⟨i, hi, rfl⟩ := hv + exact hg i hi + · intro v hv + have hv1 : F.blk v ∈ e := hsupp ▸ mem_supp_iff.2 ⟨v, hv, rfl⟩ + have hle : (U ∩ block F (F.blk v)).card ≤ 1 := by rw [hone _ hv1] + rw [card_le_one] at hle + have := hle v (mem_inter.2 ⟨hv, mem_block_iff.2 rfl⟩) (σ (F.blk v), g (F.blk v)) + (mem_inter.2 ⟨hg _ hv1, mem_block_iff.2 ((hσ _ _).2 rfl)⟩) + rw [mem_image] + exact ⟨F.blk v, hv1, this.symm⟩ + +omit [Fintype ι] in +theorem card_transOf {F : RealizedData (ι × β)} {σ : Fin F.b → ι} {b₀ : β} + (hσ : ∀ (v : ι × β) (i : Fin F.b), F.blk v = i ↔ v.1 = σ i) (e : Finset (Fin F.b)) : + (transOf F σ b₀ e).card = Fintype.card β ^ e.card := by + have hinj := sigma_injective b₀ hσ + unfold transOf + rw [card_image_of_injOn] + · rw [Fintype.card_piFinset] + have h : ∀ i : Fin F.b, + (if i ∈ e then (univ : Finset β) else {b₀}).card = if i ∈ e then Fintype.card β else 1 := by + intro i + split_ifs + · rw [card_univ] + · rw [card_singleton] + rw [Finset.prod_congr rfl (fun i _ => h i), prod_ite_mem, univ_inter, prod_const] + · intro g hg g' hg' hgg' + rw [mem_coe, Fintype.mem_piFinset] at hg hg' + have hgg'' : e.image (fun i => (σ i, g i)) = e.image (fun i => (σ i, g' i)) := hgg' + funext i + by_cases hi : i ∈ e + · have : (σ i, g i) ∈ e.image (fun i => (σ i, g' i)) := by + rw [← hgg'', mem_image] + exact ⟨i, hi, rfl⟩ + rw [mem_image] at this + obtain ⟨j, -, hj⟩ := this + have h1 := congrArg Prod.fst hj + have h2 := congrArg Prod.snd hj + simp only at h1 h2 + have := hinj h1 + subst this + exact h2.symm + · have h1 := hg i + have h2 := hg' i + rw [ite_eq_right hi, mem_singleton] at h1 h2 + rw [h1, h2] + +end Transversals + +section Count816b + +/-- The index map of the six-block benchmark is the identity (definitionally). -/ +theorem hσ816 : ∀ (v : Fin 6 × Fin 409) (i : Fin benchmark816.b), + benchmark816.blk v = i ↔ v.1 = (fun i => i : Fin benchmark816.b → Fin 6) i := + fun _ _ => Iff.rfl + +/-- All transversals of all edges. -/ +def transAll816 : Finset (Finset (Fin 6 × Fin 409)) := + benchmark816.H.biUnion (transOf benchmark816 (fun i => i) 0) + +theorem mem_transAll816 {U : Finset (Fin 6 × Fin 409)} : + U ∈ transAll816 ↔ ∃ e ∈ benchmark816.H, IsTransversal benchmark816 e U := by + simp only [transAll816, mem_biUnion, mem_transOf hσ816] + +theorem card_H816 : benchmark816.H.card = 15 := by + change (completeClutter 6 3).card = 15 + rw [completeClutter, card_powersetCard, card_univ, Fintype.card_fin] + rfl + +theorem card_transAll816 : transAll816.card = 15 * 409 ^ 4 := by + unfold transAll816 + rw [card_biUnion] + · have h : ∀ e ∈ benchmark816.H, (transOf benchmark816 (fun i => i) 0 e).card = 409 ^ 4 := + fun e he => by rw [card_transOf hσ816, Fintype.card_fin, mem_H_benchmark816 he] + rw [Finset.sum_congr rfl h, sum_const, card_H816, smul_eq_mul] + · intro e _ e' _ hee' + rw [Function.onFun, disjoint_left] + intro U hU hU' + rw [mem_transOf hσ816] at hU hU' + exact hee' (hU.1.symm.trans hU'.1) + +-- The style linter `constructorNameAsVariable` (variable names shadowing constructor names) +-- exhausts the recursion limit on this local context; it is a naming linter, not a check. +set_option linter.constructorNameAsVariable false in +theorem disjoint_pairs816_transAll816 : Disjoint pairs816 transAll816 := by + rw [disjoint_left] + intro U hU hU' + rw [mem_pairs816] at hU + rw [mem_transAll816] at hU' + obtain ⟨i, hUi, hcard⟩ := hU + obtain ⟨e, he, hsupp, -⟩ := hU' + have h1 := supp_eq_singleton_of_pair hUi hcard + have h2 := mem_H_benchmark816 he + rw [hsupp] at h1 + rw [h1, card_singleton] at h2 + exact absurd h2 (by norm_num) + +theorem minForbSet_eq : + {U : Finset (Fin 6 × Fin 409) | IsMinimalForbidden benchmark816 U} = + ↑(pairs816 ∪ transAll816) := by + ext U + simp only [Set.mem_ofPred_eq, coe_union, Set.mem_union, mem_coe, mem_pairs816, mem_transAll816] + exact minForb816_iff U + +theorem minForbSet1_eq : + {U : Finset (Fin 6 × Fin 409) | + IsMinimalForbidden benchmark816 U ∧ (supp benchmark816 U).card = 1} = ↑pairs816 := by + ext U + simp only [Set.mem_ofPred_eq, mem_coe, mem_pairs816, minForb816_iff] + constructor + · rintro ⟨h | ⟨e, he, hsupp, -⟩, hcard⟩ + · exact h + · exfalso + rw [hsupp, mem_H_benchmark816 he] at hcard + omega + · rintro ⟨i, hUi, hcard⟩ + refine ⟨Or.inl ⟨i, hUi, hcard⟩, ?_⟩ + rw [supp_eq_singleton_of_pair hUi hcard, card_singleton] + +theorem minForbSet4_eq : + {U : Finset (Fin 6 × Fin 409) | + IsMinimalForbidden benchmark816 U ∧ (supp benchmark816 U).card = 4} = ↑transAll816 := by + ext U + simp only [Set.mem_ofPred_eq, mem_coe, mem_transAll816, minForb816_iff] + constructor + · rintro ⟨⟨i, hUi, hcard⟩ | h, hcard4⟩ + · exfalso + rw [supp_eq_singleton_of_pair hUi hcard, card_singleton] at hcard4 + omega + · exact h + · rintro ⟨e, he, hsupp, hone⟩ + refine ⟨Or.inr ⟨e, he, hsupp, hone⟩, ?_⟩ + rw [hsupp, mem_H_benchmark816 he] + +end Count816b + +end Aux + +/-- Proves: `UniversalLaw.Spec.P15.Benchmark816IsRealized` (claim `p15-realized-covers`, Section 6 +of P15_REALIZED_COVERS.md: six blocks of `409` coordinates with `a_i = 1`, `d_i = 408`, `H` all +four-block subsets). +Method: block cardinality `1 * 409 = 409` via the product decomposition of the fibre; clutter +property of `powersetCard 4` by `eq_of_subset_of_card_le`. +Does not establish: anything about the informal six-block realization beyond this data record +satisfying the formal side conditions; no review, acceptance or alignment. -/ +theorem benchmark816IsRealized : UniversalLaw.Spec.P15.Benchmark816IsRealized := + Aux.benchmark816_isRealized + +/-- Proves: `UniversalLaw.Spec.P15.Benchmark816Price` (claim `p15-realized-covers`, Section 6: +"6/(40900^409)>0"). +Method: the full-block family is the image of the injective block map, so its price is the sum +of six block prices `(1/40900)^409`. +Does not establish: that this cover is optimal or that it covers the obstruction +(`Benchmark816Cover` is a separate `Prop`); no review or acceptance. -/ +theorem benchmark816Price : UniversalLaw.Spec.P15.Benchmark816Price := by + refine ⟨?_, by positivity⟩ + rw [Aux.famPrice_const_benchmark816, one_div, div_eq_mul_inv, ← inv_pow] + +/-- Proves: `UniversalLaw.Spec.P15.Benchmark816RationalPrice` (claim `p15-price-budget-restricted`, +display (T7) and the explicit rational price of Section 4 of price_budget PROOF.md). +Method: `log x ≤ x - 1` for the upper bound; Mathlib's Taylor estimate +`Real.abs_log_sub_add_sum_range_le` with three terms for `p + p^2/2 < -log(1 - p)`; exact +rational arithmetic by `norm_num`; the full-block price as six equal block prices. +Does not establish: the (T1) budget itself, admissibility of any other price vector, or the +informal claim; no review or acceptance. -/ +theorem benchmark816RationalPrice : UniversalLaw.Spec.P15.Benchmark816RationalPrice := by + refine ⟨?_, by norm_num, ?_, ?_⟩ + · have hpos : (0 : ℝ) < 40900 / 40899 := by norm_num + have hlog_le : Real.log (40900 / 40899) ≤ 1 / 40899 := by + have := Real.log_le_sub_one_of_pos hpos + linarith + have hlog_nn : 0 ≤ Real.log (40900 / 40899) := Real.log_nonneg (by norm_num) + have hpow := pow_le_pow_left₀ hlog_nn hlog_le 409 + calc 6 * Real.log (40900 / 40899) ^ 409 ≤ 6 * (1 / 40899 : ℝ) ^ 409 := + mul_le_mul_of_nonneg_left hpow (by norm_num) + _ = 6 / 40899 ^ 409 := by rw [one_div, div_eq_mul_inv, ← inv_pow] + · unfold phi + split_ifs with h + · apply lt_min (by norm_num) + have := Aux.neg_log_one_sub_gt (1 / 40900) (by norm_num) (by norm_num) + linarith + · exfalso + exact h (by norm_num) + · exact Aux.famPrice_const_benchmark816 _ + +/-- Proves: `UniversalLaw.Spec.P15.ElementaryPaletteFormula` (claim `p15-realized-covers`, display +(P9) of P15_REALIZED_COVERS.md: for `H` all `(s+1)`-subsets, `K_H(d) = max(max_i d_i, +ceil(sum_i d_i / s))`). +Method: for the complete clutter the edge condition says each label lies in at most `s` label +sets; double counting gives the two necessary conditions `d_i ≤ K` and `sum d_i ≤ s K`; the +cyclic palette (block `i` takes positions `c_i, …, c_i + d_i - 1` reduced modulo `K`) realizes +them; `IsLeast.csInf_eq` identifies `sInf`. +Does not establish: the matroid palette formula of Section 5, anything about non-complete +clutters, or the informal claim; the hypotheses `s ≤ b` and `1 ≤ d_i` of the `Prop` are not +needed by this proof and are simply carried; no review or acceptance. -/ +theorem elementaryPaletteFormula : UniversalLaw.Spec.P15.ElementaryPaletteFormula := + fun b s d hs _ _ => Aux.paletteNumber_completeClutter b s d hs + +/-- Proves: `UniversalLaw.Spec.P15.TriangleNeedsThree` (claim `p15-realized-covers`, Section 5: +the triangle at unit demands needs `3` colors). +Method: the complete-clutter formula at `b = 3`, `s = 1`, `d = 1`: `max 1 ⌈3/1⌉₊ = 3`. +Does not establish: the informal remark about "size-two edge loads"; no review or acceptance. -/ +theorem triangleNeedsThree : UniversalLaw.Spec.P15.TriangleNeedsThree := by + unfold UniversalLaw.Spec.P15.TriangleNeedsThree + rw [Aux.paletteNumber_completeClutter 3 1 (fun _ => 1) le_rfl] + rw [sup_const univ_nonempty, sum_const, card_univ, Fintype.card_fin, smul_eq_mul] + norm_num + +/-- Proves: `UniversalLaw.Spec.P15.Benchmark816Palette` (claim `p15-realized-covers`, Section 6: +`K_H(408,...,408) = 816`). +Method: the complete-clutter formula at `b = 6`, `s = 3`, `d = 408`: `max 408 ⌈2448/3⌉₊ = 816`. +Does not establish: that the full blocks cover the obstruction (`Benchmark816Cover`), or the +informal claim; no review or acceptance. -/ +theorem benchmark816Palette : UniversalLaw.Spec.P15.Benchmark816Palette := by + unfold UniversalLaw.Spec.P15.Benchmark816Palette + rw [Aux.paletteNumber_completeClutter 6 3 (fun _ => 408) (by norm_num)] + rw [sup_const univ_nonempty, sum_const, card_univ, Fintype.card_fin, smul_eq_mul] + norm_num + +/-- Proves: `UniversalLaw.Spec.P15.LocalDecomposability` (claim `p15-realized-covers`, Section 3 of +P15_REALIZED_COVERS.md: `I_k(D_i) = {S : |S| <= a_i k}`). +Method: a decomposition of `S ⊆ X_i` into `k` good parts has parts of size `≤ a_i`; conversely +the chunks of size `≤ a_i` of an enumeration of `S` are good (one block, support of size `≤ 1` +contains no edge of size `≥ 2`), via the general palette/decomposition correspondence. +Does not establish: the informal claim or its review; alignment of `IsKDecomposable` with the +informal `I_k`. -/ +theorem localDecomposability {X : Type} [Fintype X] [DecidableEq X] (F : RealizedData X) : + UniversalLaw.Spec.P15.LocalDecomposability F := + fun hF i k S hS => Aux.localDecomposability_expanded hF i k S hS + +/-- Proves: `UniversalLaw.Spec.P15.LocalObstructionIsFullBlock` (claim `p15-realized-covers`, +display (P3): the only `d_i`-obstructed subset of `X_i` is `X_i`). +Method: `LocalDecomposability` at `k = d_i` and `|X_i| = a_i d_i + 1`. +Does not establish: the informal claim or its review. -/ +theorem localObstructionIsFullBlock {X : Type} [Fintype X] [DecidableEq X] (F : RealizedData X) : + UniversalLaw.Spec.P15.LocalObstructionIsFullBlock F := by + intro hF i S hS + rw [Aux.localDecomposability_expanded hF i (F.d i) S hS, not_le] + have hcard := hF.2.2.1 i + constructor + · intro h + exact eq_of_subset_of_card_le hS (by omega) + · intro h + rw [h, hcard] + exact Nat.lt_succ_self _ + +/-- Proves: `UniversalLaw.Spec.P15.FullBlockCoverIff` (claim `p15-realized-covers`, Proposition +P2, display (P7): the family of full blocks covers `O_K(D)` iff `K >= K_H(d)`). +Method: a set containing no full block has `|U ∩ X_i| ≤ a_i d_i`, so a palette for `d` at `K` +colours it; conversely the set missing one chosen vertex per block is `K`-decomposable, and the +parts meeting each block form a feasible palette, so `K_H(d) ≤ K`. Attainment of `K_H(d)` and +upward closure of feasibility are proved via disjoint label intervals. +Does not establish: optimality of other covers, the unrestricted prize, the informal claim or +its review (disposition transcribed in the statement: HOLD_WITH_DOMAIN). -/ +theorem fullBlockCoverIff {X : Type} [Fintype X] [DecidableEq X] (F : RealizedData X) : + UniversalLaw.Spec.P15.FullBlockCoverIff F := by + intro hF K + have hH : ∀ e ∈ F.H, 2 ≤ e.card := hF.2.2.2.1 + constructor + · intro hcover + classical + -- one chosen vertex per block + let pick : Fin F.b → X := fun i => (Aux.block_nonempty hF i).choose + have hpick : ∀ i, pick i ∈ block F i := fun i => (Aux.block_nonempty hF i).choose_spec + let U : Finset X := univ.filter (fun v => v ≠ pick (F.blk v)) + have hUdec : IsKDecomposable F K U := by + by_contra hobs + obtain ⟨g, hg, hgU⟩ := hcover U hobs + rw [fullBlockFamily, mem_image] at hg + obtain ⟨i, -, rfl⟩ := hg + have := hgU (hpick i) + simp only [U, mem_filter, mem_univ, true_and] at this + exact this (by rw [Aux.blk_eq_of_mem_block (hpick i)]) + obtain ⟨P, hcard, hedge⟩ := Aux.palette_of_decomposable hUdec + apply Aux.paletteNumber_le_of_feasible + refine ⟨P, fun i => ?_, hedge⟩ + have h1 := hcard i + have h2 : U ∩ block F i = (block F i).erase (pick i) := by + ext v + simp only [U, mem_inter, mem_filter, mem_univ, true_and, mem_erase] + constructor + · rintro ⟨hne, hv⟩ + exact ⟨by rwa [Aux.blk_eq_of_mem_block hv] at hne, hv⟩ + · rintro ⟨hne, hv⟩ + exact ⟨by rwa [Aux.blk_eq_of_mem_block hv], hv⟩ + rw [h2, card_erase_of_mem (hpick i), hF.2.2.1 i, Nat.add_sub_cancel] at h1 + exact Nat.le_of_mul_le_mul_left h1 (hF.1 i) + · intro hK U hU + obtain ⟨P, hPd, hPe⟩ := Aux.isPaletteFeasible_of_paletteNumber_le F.H F.d hH hK + by_contra hnone + simp only [not_exists, not_and] at hnone + apply hU + apply Aux.decomposable_of_palette hF P _ hPe + intro i + have hsub : U ∩ block F i ⊆ block F i := inter_subset_right + have hne : U ∩ block F i ≠ block F i := by + intro heq + apply hnone (block F i) (mem_image_of_mem _ (mem_univ i)) + intro v hv + rw [← heq] at hv + exact (mem_inter.1 hv).1 + have hlt := card_lt_card (Finset.ssubset_iff_subset_ne.2 ⟨hsub, hne⟩) + rw [hF.2.2.1 i] at hlt + calc (U ∩ block F i).card ≤ F.a i * F.d i := by omega + _ ≤ F.a i * (P i).card := Nat.mul_le_mul_left _ (hPd i) + +/-- Proves: `UniversalLaw.Spec.P15.WholeGroundChromaticNumber` (claim `p15-realized-covers`, +Section 4: the chromatic number of the entire ground set is `K_H(d+1)`). +Method: the palette/decomposition correspondence with `|X_i| = a_i d_i + 1`, which lies in +`(a_i d_i, a_i (d_i + 1)]`, so the demands are exactly `d_i + 1`. +Does not establish: the informal claim or its review. -/ +theorem wholeGroundChromaticNumber {X : Type} [Fintype X] [DecidableEq X] (F : RealizedData X) : + UniversalLaw.Spec.P15.WholeGroundChromaticNumber F := by + intro hF K + have hH : ∀ e ∈ F.H, 2 ≤ e.card := hF.2.2.2.1 + constructor + · intro h + obtain ⟨P, hcard, hedge⟩ := Aux.palette_of_decomposable h + apply Aux.paletteNumber_le_of_feasible + refine ⟨P, fun i => ?_, hedge⟩ + have h1 := hcard i + rw [univ_inter, hF.2.2.1 i] at h1 + show F.d i + 1 ≤ (P i).card + by_contra hlt + rw [not_le] at hlt + have hle : (P i).card ≤ F.d i := Nat.lt_succ_iff.1 hlt + have : F.a i * (P i).card ≤ F.a i * F.d i := Nat.mul_le_mul_left _ hle + omega + · intro hK + obtain ⟨P, hPd, hPe⟩ := + Aux.isPaletteFeasible_of_paletteNumber_le F.H (fun i => F.d i + 1) hH hK + apply Aux.decomposable_of_palette hF P _ hPe + intro i + rw [univ_inter, hF.2.2.1 i] + have ha := hF.1 i + calc F.a i * F.d i + 1 ≤ F.a i * (F.d i + 1) := by rw [mul_add, mul_one]; omega + _ ≤ F.a i * (P i).card := Nat.mul_le_mul_left _ (hPd i) + +/-- Proves: `UniversalLaw.Spec.P15.Benchmark816WholeGround` (claim `p15-realized-covers`, Section +6: the whole ground set needs `818` colors). +Method: `WholeGroundChromaticNumber` for the six-block data and the complete-clutter palette +formula at demands `409`: `max 409 ⌈2454/3⌉₊ = 818`. +Does not establish: the informal claim or its review. -/ +theorem benchmark816WholeGround : UniversalLaw.Spec.P15.Benchmark816WholeGround := by + have h := wholeGroundChromaticNumber benchmark816 Aux.benchmark816_isRealized + have hpal : paletteNumber benchmark816.b benchmark816.H (fun i => benchmark816.d i + 1) = 818 := by + change paletteNumber 6 (completeClutter 6 3) (fun _ => 409) = 818 + rw [Aux.paletteNumber_completeClutter 6 3 (fun _ => 409) (by norm_num)] + rw [sup_const univ_nonempty, sum_const, card_univ, Fintype.card_fin, smul_eq_mul] + norm_num + constructor + · rw [h 818, hpal] + · rw [h 817, hpal] + norm_num + +/-- Proves: `UniversalLaw.Spec.P15.MinimalForbiddenCharacterisation` (claim `p15-realized-covers`, +Proposition P1 of P15_REALIZED_COVERS.md: the inclusion-minimal forbidden sets are exactly the +`(a_i+1)`-subsets of a single block and the transversals of the edges). +Method: a capacity violation in block `i` forces `U ⊆ X_i` with `|U| = a_i + 1` (removing any +outside vertex or any vertex keeps the violation); otherwise an edge `e ⊆ supp U` forces each +vertex to be alone in its block with its block in `e`. Conversely both families are forbidden +and every one-vertex deletion is good (one-block sets of size `≤ a_i`; the clutter property for +transversals). +Does not establish: the informal claim or its review; alignment of `IsMinimalForbidden` with the +informal notion. -/ +theorem minimalForbiddenCharacterisation {X : Type} [Fintype X] [DecidableEq X] + (F : RealizedData X) : UniversalLaw.Spec.P15.MinimalForbiddenCharacterisation F := + fun hF U => Aux.minimalForbidden_iff hF U + +/-- Proves: `UniversalLaw.Spec.P15.Benchmark816MinimalForbiddenCounts` (claim +`p15-realized-covers`, display (P10): `6 * binom(409,2)` internal pairs, `15 * 409^4` crossing +transversal quadruples, and nothing else). +Method: Proposition P1 (`MinimalForbiddenCharacterisation`) for the six-block data; the pairs +are the disjoint union over the six blocks of `powersetCard 2`; the transversals of a four-edge +are the images of `e` under `i ↦ (i, g i)` for `g` in a product set of size `409^4`, counted by +`card_image_of_injOn` and `Fintype.card_piFinset`; the two families are disjoint by the size of +the support. No enumeration of subsets is performed. +Does not establish: the informal claim or its review; the evaluations `500616` and +`419743994415` (core-Lean targets on main). -/ +theorem benchmark816MinimalForbiddenCounts : + UniversalLaw.Spec.P15.Benchmark816MinimalForbiddenCounts := by + refine ⟨?_, ?_, ?_⟩ + · rw [Aux.minForbSet1_eq, Set.ncard_coe_finset, Aux.card_pairs816] + · rw [Aux.minForbSet4_eq, Set.ncard_coe_finset, Aux.card_transAll816] + · rw [Aux.minForbSet_eq, Set.ncard_coe_finset, + card_union_of_disjoint Aux.disjoint_pairs816_transAll816, Aux.card_pairs816, + Aux.card_transAll816] + +end UniversalLaw.Proofs.P15Structure diff --git a/specifications/lean_statement_proofs_20261011/SpecificationProofs/RNProbability.lean b/specifications/lean_statement_proofs_20261011/SpecificationProofs/RNProbability.lean new file mode 100644 index 000000000..198cad8b0 --- /dev/null +++ b/specifications/lean_statement_proofs_20261011/SpecificationProofs/RNProbability.lean @@ -0,0 +1,363 @@ +import Specifications.RN + +/-! +# RN: kernel-checked proofs of the abstract probability `Prop`s (N1)-(N5) (statement module +# `Specifications.RN`) + +Scientific effect: NONE. Organizational-independence credit: 0 (Anthropic / Claude). + +Every theorem below has as its TYPE a registered `Prop` constant of `UniversalLaw.Spec.RN` +(statement packet `specifications/lean_statements_20261010`, commit pinned there). A +kernel-checked proof of such a `Prop` is evidence about that `Prop` only: it does not make the +informal Layer 0 claim (RN_COUNT_INTERFACE.md, Theorem N) accepted, reviewed or "verified", +does not change its LANDING_CLAIMS disposition (HOLD_WITH_DOMAIN, transcribed by the register), +says nothing about any count of the Gaussian model, and does not touch the statement register +(the statement module is not edited here). Helper lemmas live in the `Aux` namespace and are not +inventory items. + +Allowed transitive axioms: `propext`, `Classical.choice`, `Quot.sound` only (checked by +`#print axioms`, see the run receipt). No `sorry`, `native_decide`, `decide` on `ℝ`, or custom +axioms. + +Covered (five `Prop`s): `HolderCountBoundN1`, `HolderConsequenceN2`, +`ConditionalMeanIdentityN3`, `UniformCounterexampleN4`, `ExponentialTailLayerCakeN5`. +-/ + +namespace UniversalLaw.Proofs.RNProbability + +open MeasureTheory UniversalLaw.Spec.RN + +namespace Aux + +/-- `N · 1_E = 1_E · N` pointwise. -/ +theorem mul_indicator_one_eq {Ω : Type} (Ev : Set Ω) (N : Ω → ℕ) (ω : Ω) : + (N ω : ℝ) * Ev.indicator (fun _ => (1 : ℝ)) ω = Ev.indicator (fun ω => (N ω : ℝ)) ω := by + by_cases h : ω ∈ Ev + · simp [h] + · simp [h] + +end Aux + +/-- Proves: `UniversalLaw.Spec.RN.ConditionalMeanIdentityN3` (register claims +`rn-count-interface`, `math.rn-count-interface`). +Method: unfold `ProbabilityTheory.cond = (P E)⁻¹ • P.restrict E`, `integral_smul_measure`, +`integral_indicator`, cancel `P(E) · P(E)⁻¹`. +Does not establish: the informal Theorem N, the bounded-conditional-mean equivalence, the lower +comparison `q ≥ c r^3`, anything about the Gaussian model, review or acceptance. -/ +theorem conditionalMeanIdentityN3 : ConditionalMeanIdentityN3 := by + intro Ω _ P _ Ev N hEv hpos _hint + simp_rw [Aux.mul_indicator_one_eq] + rw [integral_indicator hEv, ProbabilityTheory.cond, integral_smul_measure, smul_eq_mul, + ENNReal.toReal_inv, ← mul_assoc, mul_inv_cancel₀ hpos.ne', one_mul] + +/-- Proves: `UniversalLaw.Spec.RN.HolderCountBoundN1` (register claims `rn-count-interface`, +`math.rn-count-interface`). +Method: Mathlib's Hölder inequality `integral_mul_le_Lp_mul_Lq_of_nonneg` with the conjugate +exponent `q = p/(p-1)`, `MemLp` of `N` recovered from the integrability of `N^p`, and +`∫ 1_E^q = P(E)`. +Does not establish: the informal Theorem N, that any Gaussian count satisfies the moment +hypothesis, any rate in `r`, review or acceptance. -/ +theorem holderCountBoundN1 : HolderCountBoundN1 := by + intro Ω _ P _ Ev N p hEv hp hint + have hpq : p.HolderConjugate (Real.conjExponent p) := Real.HolderConjugate.conjExponent hp + have hp0 : 0 < p := by linarith + have hq0 : 0 < Real.conjExponent p := hpq.symm.pos + have hNmeas : AEStronglyMeasurable (fun ω => (N ω : ℝ)) P := by + have h1 : AEStronglyMeasurable (fun ω => (N ω : ℝ) ^ p) P := hint.aestronglyMeasurable + have h2 : (fun ω => (N ω : ℝ)) = fun ω => ((N ω : ℝ) ^ p) ^ p⁻¹ := by + funext ω; rw [Real.rpow_rpow_inv (Nat.cast_nonneg _) hp0.ne'] + rw [h2] + exact (Real.continuous_rpow_const (inv_nonneg.mpr hp0.le)).comp_aestronglyMeasurable h1 + have hfLp : MemLp (fun ω => (N ω : ℝ)) (ENNReal.ofReal p) P := by + have hne : ENNReal.ofReal p ≠ 0 := by + rw [ne_eq, ENNReal.ofReal_eq_zero]; exact not_le.mpr hp0 + have hnt : ENNReal.ofReal p ≠ ⊤ := ENNReal.ofReal_ne_top + rw [← memLp_norm_rpow_iff hNmeas hne hnt, ENNReal.div_self hne hnt, memLp_one_iff_integrable] + have : (fun ω => ‖(N ω : ℝ)‖ ^ (ENNReal.ofReal p).toReal) = fun ω => (N ω : ℝ) ^ p := by + funext ω + rw [Real.norm_of_nonneg (Nat.cast_nonneg _), ENNReal.toReal_ofReal hp0.le] + rw [this] + exact hint + have hgLp : MemLp (Ev.indicator fun _ => (1 : ℝ)) (ENNReal.ofReal (Real.conjExponent p)) P := + memLp_indicator_const _ hEv 1 (Or.inr (measure_ne_top P Ev)) + have hfnn : 0 ≤ᵐ[P] fun ω => (N ω : ℝ) := ae_of_all _ (fun ω => Nat.cast_nonneg _) + have hgnn : 0 ≤ᵐ[P] Ev.indicator fun _ => (1 : ℝ) := + ae_of_all _ (fun ω => Set.indicator_nonneg (fun _ _ => zero_le_one) ω) + have key := integral_mul_le_Lp_mul_Lq_of_nonneg hpq hfnn hgnn hfLp hgLp + have hind : (fun a => Ev.indicator (fun _ => (1 : ℝ)) a ^ Real.conjExponent p) = + Ev.indicator (fun _ => (1 : ℝ)) := by + funext a + by_cases h : a ∈ Ev + · simp [h] + · simp [h, Real.zero_rpow hq0.ne'] + rw [hind, integral_indicator_const (1 : ℝ) hEv, measureReal_def, smul_eq_mul, mul_one] at key + have h1q : 1 / Real.conjExponent p = 1 - 1 / p := by + rw [one_div, one_div, hpq.one_sub_inv] + rw [h1q] at key + exact key + +/-- Proves: `UniversalLaw.Spec.RN.HolderConsequenceN2` (register claims `rn-count-interface`, +`math.rn-count-interface`). +Method: `holderCountBoundN1`, then monotonicity of `x ↦ x^(1/p)` and `x ↦ x^(1-1/p)` on +`[0, ∞)` and the rpow algebra `(A r^(-β))^(1/p) (C r^3)^(1-1/p) = A^(1/p) C^(1-1/p) +r^((3(p-1)-β)/p)`. +Does not establish: the informal Theorem N, that the exponent can be rounded up to `3`, that +any Gaussian count satisfies the hypotheses, review or acceptance. -/ +theorem holderConsequenceN2 : HolderConsequenceN2 := by + intro Ω _ P _ Ev N p A β C r hEv hp hA hC hr hint hmom hprob + have h1 := holderCountBoundN1 Ω P Ev N p hEv hp hint + have hp0 : 0 < p := by linarith + have h1p : 0 ≤ 1 / p := by positivity + have h1p' : 0 ≤ 1 - 1 / p := by + rw [sub_nonneg, div_le_one hp0]; exact hp.le + have hI : 0 ≤ ∫ ω, (N ω : ℝ) ^ p ∂P := + integral_nonneg (fun ω => Real.rpow_nonneg (Nat.cast_nonneg _) p) + have h2 : (∫ ω, (N ω : ℝ) ^ p ∂P) ^ (1 / p) ≤ (A * r ^ (-β)) ^ (1 / p) := + Real.rpow_le_rpow hI hmom h1p + have h3 : (P Ev).toReal ^ (1 - 1 / p) ≤ (C * r ^ 3) ^ (1 - 1 / p) := + Real.rpow_le_rpow ENNReal.toReal_nonneg hprob h1p' + have hrb : 0 ≤ r ^ (-β) := Real.rpow_nonneg hr.le _ + have hr3 : 0 ≤ r ^ 3 := pow_nonneg hr.le 3 + have hexp : r ^ (-β * (1 / p)) * r ^ ((3 : ℝ) * (1 - 1 / p)) = r ^ ((3 * (p - 1) - β) / p) := by + rw [← Real.rpow_add hr]; congr 1; field_simp; ring + calc ∫ ω, (N ω : ℝ) * Ev.indicator (fun _ => (1 : ℝ)) ω ∂P + ≤ (∫ ω, (N ω : ℝ) ^ p ∂P) ^ (1 / p) * (P Ev).toReal ^ (1 - 1 / p) := h1 + _ ≤ (A * r ^ (-β)) ^ (1 / p) * (C * r ^ 3) ^ (1 - 1 / p) := + mul_le_mul h2 h3 (Real.rpow_nonneg ENNReal.toReal_nonneg _) + (Real.rpow_nonneg (mul_nonneg hA hrb) _) + _ = A ^ (1 / p) * r ^ (-β * (1 / p)) * (C ^ (1 - 1 / p) * r ^ ((3 : ℝ) * (1 - 1 / p))) := by + rw [Real.mul_rpow hA hrb, Real.mul_rpow hC hr3, ← Real.rpow_mul hr.le, + ← Real.rpow_natCast r 3, ← Real.rpow_mul hr.le] + push_cast + ring + _ = A ^ (1 / p) * C ^ (1 - 1 / p) * r ^ ((3 * (p - 1) - β) / p) := by + rw [← hexp]; ring + +namespace Aux + +/-- The uniform law of `Iic a` for `0 ≤ a ≤ 1` is `a`. -/ +theorem uniformLaw_Iic {a : ℝ} (ha0 : 0 ≤ a) (ha1 : a ≤ 1) : + (uniformLaw (Set.Iic a)).toReal = a := by + rw [uniformLaw, Measure.restrict_apply measurableSet_Iic] + have : Set.Iic a ∩ Set.Icc 0 1 = Set.Icc 0 a := by + ext x + simp only [Set.mem_inter_iff, Set.mem_Iic, Set.mem_Icc] + constructor + · rintro ⟨h1, h2, _⟩; exact ⟨h2, h1⟩ + · rintro ⟨h1, h2⟩; exact ⟨h2, h1, h2.trans ha1⟩ + rw [this, Real.volume_Icc, sub_zero, ENNReal.toReal_ofReal ha0] + +/-- `∫ N_r dU = ceil(log(1/r)) · U(E_r)`. -/ +theorem integral_counterCount (r : ℝ) : + ∫ u, counterCount r u ∂uniformLaw = + (⌈Real.log (1 / r)⌉₊ : ℝ) * (uniformLaw (Set.Iic (r ^ 3))).toReal := by + unfold counterCount + rw [integral_const_mul, integral_indicator_const (1 : ℝ) measurableSet_Iic, measureReal_def, + smul_eq_mul, mul_one] + +/-- `∫ N_r^p dU = ceil(log(1/r))^p · U(E_r)` for `p ≠ 0`. -/ +theorem integral_counterCount_rpow (r : ℝ) {p : ℝ} (hp : p ≠ 0) : + ∫ u, counterCount r u ^ p ∂uniformLaw = + (⌈Real.log (1 / r)⌉₊ : ℝ) ^ p * (uniformLaw (Set.Iic (r ^ 3))).toReal := by + have : (fun u => counterCount r u ^ p) = + (Set.Iic (r ^ 3)).indicator (fun _ => (⌈Real.log (1 / r)⌉₊ : ℝ) ^ p) := by + funext u + unfold counterCount + by_cases h : u ∈ Set.Iic (r ^ 3) + · simp [h] + · simp [h, Real.zero_rpow hp] + rw [this, integral_indicator_const _ measurableSet_Iic, measureReal_def, smul_eq_mul, mul_comm] + +/-- The two displays of (N4) for a fixed `0 < r ≤ e^(-1)`. -/ +theorem n4_fixed (r : ℝ) (hr : 0 < r) (hre : r ≤ Real.exp (-1)) : + (uniformLaw (Set.Iic (r ^ 3))).toReal = r ^ 3 ∧ + (∫ u, counterCount r u ∂uniformLaw) / r ^ 3 = (⌈Real.log (1 / r)⌉₊ : ℝ) := by + have hr3 : 0 < r ^ 3 := pow_pos hr 3 + have hr1 : r ≤ 1 := hre.trans (Real.exp_lt_one_iff.mpr (by norm_num)).le + have hr31 : r ^ 3 ≤ 1 := pow_le_one₀ hr.le hr1 + have hmeas : (uniformLaw (Set.Iic (r ^ 3))).toReal = r ^ 3 := uniformLaw_Iic hr3.le hr31 + refine ⟨hmeas, ?_⟩ + rw [integral_counterCount, hmeas, mul_div_assoc, div_self hr3.ne', mul_one] + +/-- `log (1/r) ≥ 1` for `0 < r ≤ e^(-1)`. -/ +theorem one_le_log_one_div {r : ℝ} (hr : 0 < r) (hre : r ≤ Real.exp (-1)) : + 1 ≤ Real.log (1 / r) := by + rw [Real.le_log_iff_exp_le (by positivity), le_one_div (Real.exp_pos _) hr, one_div, + ← Real.exp_neg] + exact hre + +/-- `r^3 = exp(-3 log(1/r))` for `r > 0`. -/ +theorem pow_three_eq_exp {r : ℝ} (hr : 0 < r) : + r ^ 3 = Real.exp (-(3 * Real.log (1 / r))) := by + have : r = Real.exp (-Real.log (1 / r)) := by + rw [Real.exp_neg, Real.exp_log (by positivity), one_div, inv_inv] + conv_lhs => rw [this] + rw [← Real.exp_nat_mul] + congr 1 + push_cast + ring + +/-- `∫_0^∞ exp(-s/B) ds = B` for `B > 0`. -/ +theorem integral_exp_neg_div_Ioi_zero {B : ℝ} (hB : 0 < B) : + ∫ s in Set.Ioi (0 : ℝ), Real.exp (-s / B) = B := by + have h := integral_comp_mul_left_Ioi (fun x => Real.exp (-x)) 0 (inv_pos.mpr hB) + simp only [mul_zero, inv_inv, smul_eq_mul, integral_exp_neg_Ioi_zero, mul_one] at h + have hfun : (fun s : ℝ => Real.exp (-s / B)) = fun x => Real.exp (-(B⁻¹ * x)) := by + funext s; congr 1; ring + rw [hfun] + exact h + +end Aux + +/-- Proves: `UniversalLaw.Spec.RN.UniformCounterexampleN4` (register claims +`rn-count-interface`, `math.rn-count-interface`). +Method: `U(E_r) = r^3` from `volume.restrict` on `Icc 0 1`; `∫ N_r dU = ceil(log(1/r)) r^3` +by `integral_indicator_const`; the limit from `log ∘ inv → ∞` on `𝓝[>] 0` and +`x ≤ ⌈x⌉₊`; the moment bound with the explicit constant `A_p = 2^n n!`, `n = ⌈p⌉₊`, via +`⌈t⌉₊^p ≤ (2t)^n` for `t = log(1/r) ≥ 1` and `t^n ≤ n! e^t`. +Does not establish: the source's sharper bound `sup_(t>=1) e^(-3t)(t+1)^p`, the one-`p` +sharpness construction, anything about the Gaussian field, the informal Theorem N, review or +acceptance. -/ +theorem uniformCounterexampleN4 : UniformCounterexampleN4 := by + refine ⟨fun r hr hre => Aux.n4_fixed r hr hre, ?_, ?_⟩ + · have hev : (fun r : ℝ => (⌈Real.log (1 / r)⌉₊ : ℝ)) =ᶠ[nhdsWithin (0 : ℝ) (Set.Ioi 0)] + fun r => (∫ u, counterCount r u ∂uniformLaw) / r ^ 3 := by + have h1 : ∀ᶠ r in nhdsWithin (0 : ℝ) (Set.Ioi 0), 0 < r := self_mem_nhdsWithin + have h2 : ∀ᶠ r in nhdsWithin (0 : ℝ) (Set.Ioi 0), r < Real.exp (-1) := + nhdsWithin_le_nhds (Iio_mem_nhds (Real.exp_pos _)) + filter_upwards [h1, h2] with r hr hre + exact ((Aux.n4_fixed r hr hre.le).2).symm + refine Filter.Tendsto.congr' hev ?_ + refine Filter.tendsto_atTop_mono (fun r => Nat.le_ceil (Real.log (1 / r))) ?_ + have : (fun r : ℝ => Real.log (1 / r)) = Real.log ∘ (fun r : ℝ => r⁻¹) := by + funext r; simp [one_div] + rw [this] + exact Real.tendsto_log_atTop.comp tendsto_inv_nhdsGT_zero + · intro p hp + refine ⟨2 ^ ⌈p⌉₊ * ((⌈p⌉₊).factorial : ℝ), ?_⟩ + intro r hr hre + have hp0 : p ≠ 0 := by linarith + rw [Aux.integral_counterCount_rpow r hp0, (Aux.n4_fixed r hr hre).1] + set n := ⌈p⌉₊ with hn + set t := Real.log (1 / r) with ht + have ht1 : 1 ≤ t := Aux.one_le_log_one_div hr hre + have hc1 : (1 : ℝ) ≤ (⌈t⌉₊ : ℝ) := by + exact_mod_cast Nat.one_le_ceil_iff.mpr (by linarith) + have hc2 : (⌈t⌉₊ : ℝ) ≤ 2 * t := by + have := Nat.ceil_lt_add_one (by linarith : (0 : ℝ) ≤ t); linarith + have hr3 : r ^ 3 = Real.exp (-(3 * t)) := Aux.pow_three_eq_exp hr + have hcp : (⌈t⌉₊ : ℝ) ^ p ≤ (⌈t⌉₊ : ℝ) ^ n := by + rw [← Real.rpow_natCast] + exact Real.rpow_le_rpow_of_exponent_le hc1 (Nat.le_ceil p) + have hcn : (⌈t⌉₊ : ℝ) ^ n ≤ (2 * t) ^ n := pow_le_pow_left₀ (by linarith) hc2 n + have hexp : t ^ n ≤ (n.factorial : ℝ) * Real.exp t := by + have := Real.pow_div_factorial_le_exp t (by linarith) n + rw [div_le_iff₀ (by positivity)] at this + linarith + have hexp2 : Real.exp (-(2 * t)) ≤ 1 := Real.exp_le_one_iff.mpr (by linarith) + calc (⌈t⌉₊ : ℝ) ^ p * r ^ 3 ≤ (2 * t) ^ n * Real.exp (-(3 * t)) := by + rw [hr3] + exact mul_le_mul (hcp.trans hcn) le_rfl (Real.exp_pos _).le (by positivity) + _ = 2 ^ n * (t ^ n * Real.exp (-(3 * t))) := by rw [mul_pow]; ring + _ ≤ 2 ^ n * ((n.factorial : ℝ) * Real.exp t * Real.exp (-(3 * t))) := by + apply mul_le_mul_of_nonneg_left _ (by positivity) + exact mul_le_mul_of_nonneg_right hexp (Real.exp_pos _).le + _ = 2 ^ n * (n.factorial : ℝ) * Real.exp (-(2 * t)) := by + have : Real.exp t * Real.exp (-(3 * t)) = Real.exp (-(2 * t)) := by + rw [← Real.exp_add]; congr 1; ring + rw [mul_assoc ((n.factorial : ℝ)), this]; ring + _ ≤ 2 ^ n * (n.factorial : ℝ) := mul_le_of_le_one_right (by positivity) hexp2 + +/-- Proves: `UniversalLaw.Spec.RN.ExponentialTailLayerCakeN5` (register claims +`rn-count-interface`, `math.rn-count-interface`). +Method: with `t₀ = B log(A/q) ≥ 0`, the pointwise bound `N 1_E ≤ t₀ 1_E + (N - t₀)⁺`; the +layer-cake formula `Integrable.integral_eq_integral_meas_lt` for `(N - t₀)⁺`; the tail +hypothesis at `t = s + t₀`; and `∫_0^∞ A e^(-(s+t₀)/B) ds = A B e^(-t₀/B) = B q` +(`integral_comp_mul_left_Ioi`, `integral_exp_neg_Ioi_zero`). +Does not establish: the source's intermediate identity `∫_0^∞ min(q, A e^(-t/B)) dt`, that +the logarithmic loss is attained, anything about the Gaussian model, the informal Theorem N, +review or acceptance. -/ +theorem exponentialTailLayerCakeN5 : ExponentialTailLayerCakeN5 := by + intro Ω _ P _ Ev N A B hEv hA hB hq hint htail + set q : ℝ := (P Ev).toReal with hqdef + set t₀ : ℝ := B * Real.log (A / q) with ht₀ + have hq1 : q ≤ 1 := by + rw [hqdef, ← measureReal_def]; exact measureReal_le_one + have hAq : 1 ≤ A / q := by rw [le_div_iff₀ hq]; linarith + have hlog : 0 ≤ Real.log (A / q) := Real.log_nonneg hAq + have ht₀0 : 0 ≤ t₀ := mul_nonneg hB.le hlog + -- pointwise: N 1_E ≤ t₀ 1_E + (N - t₀)⁺ + have hpt : ∀ ω, (N ω : ℝ) * Ev.indicator (fun _ => (1 : ℝ)) ω ≤ + Ev.indicator (fun _ => t₀) ω + max ((N ω : ℝ) - t₀) 0 := by + intro ω + by_cases h : ω ∈ Ev + · simp only [Set.indicator_of_mem h, mul_one] + have := le_max_left ((N ω : ℝ) - t₀) 0 + linarith + · simp only [Set.indicator_of_notMem h, mul_zero, zero_add] + exact le_max_right _ _ + have hint_t : Integrable (Ev.indicator (fun _ => t₀)) P := (integrable_const t₀).indicator hEv + have hint_pos : Integrable (fun ω => max ((N ω : ℝ) - t₀) 0) P := + (hint.sub (integrable_const t₀)).pos_part + have step1 : ∫ ω, (N ω : ℝ) * Ev.indicator (fun _ => (1 : ℝ)) ω ∂P ≤ + t₀ * q + ∫ ω, max ((N ω : ℝ) - t₀) 0 ∂P := by + calc ∫ ω, (N ω : ℝ) * Ev.indicator (fun _ => (1 : ℝ)) ω ∂P + ≤ ∫ ω, (Ev.indicator (fun _ => t₀) ω + max ((N ω : ℝ) - t₀) 0) ∂P := by + apply integral_mono_of_nonneg + · exact ae_of_all _ (fun ω => mul_nonneg (Nat.cast_nonneg _) + (Set.indicator_nonneg (fun _ _ => zero_le_one) ω)) + · exact hint_t.add hint_pos + · exact ae_of_all _ hpt + _ = t₀ * q + ∫ ω, max ((N ω : ℝ) - t₀) 0 ∂P := by + rw [integral_add hint_t hint_pos, integral_indicator_const _ hEv, measureReal_def, + smul_eq_mul, mul_comm] + -- layer cake for (N - t₀)⁺ + have hnn : 0 ≤ᵐ[P] fun ω => max ((N ω : ℝ) - t₀) 0 := ae_of_all _ (fun ω => le_max_right _ _) + have hlc := hint_pos.integral_eq_integral_meas_lt hnn + have hbound : ∀ s ∈ Set.Ioi (0 : ℝ), P.real {a | s < max ((N a : ℝ) - t₀) 0} ≤ + A * Real.exp (-t₀ / B) * Real.exp (-s / B) := by + intro s hs + have hs' : 0 < s := hs + have hsub : {a | s < max ((N a : ℝ) - t₀) 0} ⊆ {ω | (s + t₀) < (N ω : ℝ)} := by + intro a ha + have ha' : s < max ((N a : ℝ) - t₀) 0 := ha + show s + t₀ < (N a : ℝ) + rcases lt_max_iff.mp ha' with h | h + · linarith + · exact absurd h (not_lt.mpr hs'.le) + calc P.real {a | s < max ((N a : ℝ) - t₀) 0} ≤ P.real {ω | (s + t₀) < (N ω : ℝ)} := + measureReal_mono hsub (measure_ne_top _ _) + _ ≤ A * Real.exp (-(s + t₀) / B) := htail (s + t₀) (by linarith) + _ = A * Real.exp (-t₀ / B) * Real.exp (-s / B) := by + rw [mul_assoc, ← Real.exp_add]; congr 2; ring + have hint_g : IntegrableOn (fun s : ℝ => A * Real.exp (-t₀ / B) * Real.exp (-s / B)) + (Set.Ioi 0) := by + have h0 := exp_neg_integrableOn_Ioi 0 (inv_pos.mpr hB) + have h2 : (fun s : ℝ => A * Real.exp (-t₀ / B) * Real.exp (-s / B)) = + fun s => A * Real.exp (-t₀ / B) * Real.exp (-B⁻¹ * s) := by + funext s; congr 2; ring + rw [h2] + exact h0.const_mul _ + have step2 : ∫ ω, max ((N ω : ℝ) - t₀) 0 ∂P ≤ B * q := by + rw [hlc] + have hexp : Real.exp (-t₀ / B) = q / A := by + have h1 : -t₀ / B = -Real.log (A / q) := by rw [ht₀]; field_simp + rw [h1, Real.exp_neg, Real.exp_log (by positivity), inv_div] + calc ∫ s in Set.Ioi 0, P.real {a | s < max ((N a : ℝ) - t₀) 0} + ≤ ∫ s in Set.Ioi 0, A * Real.exp (-t₀ / B) * Real.exp (-s / B) := by + apply integral_mono_of_nonneg + · exact ae_of_all _ (fun s => measureReal_nonneg) + · exact hint_g + · exact ae_restrict_of_forall_mem measurableSet_Ioi hbound + _ = A * Real.exp (-t₀ / B) * ∫ s in Set.Ioi 0, Real.exp (-s / B) := integral_const_mul _ _ + _ = A * Real.exp (-t₀ / B) * B := by rw [Aux.integral_exp_neg_div_Ioi_zero hB] + _ = B * q := by + rw [hexp] + have hA0 : A ≠ 0 := by linarith + field_simp + calc ∫ ω, (N ω : ℝ) * Ev.indicator (fun _ => (1 : ℝ)) ω ∂P + ≤ t₀ * q + ∫ ω, max ((N ω : ℝ) - t₀) 0 ∂P := step1 + _ ≤ t₀ * q + B * q := by linarith [step2] + _ = B * q * (1 + Real.log (A / q)) := by rw [ht₀]; ring + +end UniversalLaw.Proofs.RNProbability diff --git a/specifications/lean_statement_proofs_20261011/SpecificationProofs/Side24Elementary.lean b/specifications/lean_statement_proofs_20261011/SpecificationProofs/Side24Elementary.lean new file mode 100644 index 000000000..9d4d045c8 --- /dev/null +++ b/specifications/lean_statement_proofs_20261011/SpecificationProofs/Side24Elementary.lean @@ -0,0 +1,212 @@ +import Specifications.Side24 + +/-! +# SIDE24: kernel-checked proofs of elementary registered `Prop`s (statement module `Specifications.Side24`) + +Scientific effect: NONE. Organizational-independence credit: 0 (Anthropic / Claude). + +Every theorem below has as its TYPE a registered `Prop` constant of +`UniversalLaw.Spec.Side24` (statement packet `specifications/lean_statements_20261010`, commit +pinned there). A kernel-checked proof of such a `Prop` is evidence about that `Prop` only: it +does not make the informal Layer 0 claim (SIDE24-COEFFICIENT-D23-20260924-v1) accepted, +reviewed or "verified", does not change its LANDING_CLAIMS disposition (REVIEWED_SCOPED, +transcribed), does not enclose the coefficient `c_{d,24}`, and does not touch the statement +register (the statement module is not edited here). Helper lemmas live in the `Aux` namespace +and are not inventory items. + +Allowed transitive axioms: `propext`, `Classical.choice`, `Quot.sound` only (checked by +`#print axioms`, see the run receipt). No `sorry`, `native_decide`, `decide` on `ℝ`, or custom +axioms. + +Covered (five `Prop`s): `ExponentialBounds`, `SuccessiveTermRatio`, `ConeMomentD2Algebra`, +`ReferenceCoefficientIdentity`, `ElementaryConeIntegral`. + +Not covered here: `TraceMoments`, `ConeMomentD1Identity`, `ConeMomentD2Identity`, +`RayleighSquareLaw` (Gaussian moment integrals over an interface measure, not algebra); +`ReferenceOddAndPinBlocks`, `DerivativeBoundAtZero`, `DerivativePairingBound`, +`DerivativeBoundAtLeastOne` (explicit `iteratedFDeriv` of the Gaussian kernel on +`EuclideanSpace` through order six); `LatticeImageSumBound` (a `tsum` over `Fin d → ℤ` with a +shell decomposition); and every interface-level or analytic statement of the module. +-/ + +namespace UniversalLaw.Proofs.Side24Elementary + +open UniversalLaw.Spec.Side24 + +namespace Aux + +/-! ### Exponential bounds -/ + +/-- The degree-nine Taylor polynomial of `exp` at `288/125` exceeds `10` (exact rational +arithmetic). -/ +theorem ten_lt_taylor_sum : + (10 : ℝ) < ∑ i ∈ Finset.range 10, (288 / 125 : ℝ) ^ i / (Nat.factorial i : ℝ) := by + simp [Finset.sum_range_succ, Nat.factorial] + norm_num + +/-- `10 < exp (288/125)` by the Taylor lower bound `Real.sum_le_exp_of_nonneg`. -/ +theorem ten_lt_exp : (10 : ℝ) < Real.exp (288 / 125) := by + have h := Real.sum_le_exp_of_nonneg (by norm_num : (0 : ℝ) ≤ 288 / 125) 10 + exact lt_of_lt_of_le ten_lt_taylor_sum h + +/-- `10^125 < exp 288`, raising the previous bound to the `125`-th power. -/ +theorem pow_ten_lt_exp : (10 : ℝ) ^ 125 < Real.exp 288 := by + have h : Real.exp 288 = Real.exp (288 / 125) ^ 125 := by + rw [← Real.exp_nat_mul]; norm_num + rw [h] + exact pow_lt_pow_left₀ ten_lt_exp (by norm_num) (by norm_num) + +/-- `exp (-288) < 1 / 10^125`. -/ +theorem exp_neg_lt : Real.exp (-288) < 1 / 10 ^ 125 := by + rw [Real.exp_neg, one_div] + exact inv_strictAnti₀ (by positivity) pow_ten_lt_exp + +/-- `1024 < exp 864` by the quadratic lower bound. -/ +theorem big_lt_exp : (1024 : ℝ) < Real.exp 864 := by + have := Real.quadratic_le_exp_of_nonneg (by norm_num : (0 : ℝ) ≤ 864) + linarith + +/-- The geometric-ratio constant: `512 exp (-864) < 1/2`. -/ +theorem ratio_const_lt_half : 512 * Real.exp (-864) < (1 / 2 : ℝ) := by + rw [Real.exp_neg, mul_inv_lt_iff₀ (Real.exp_pos _)] + have := big_lt_exp + linarith + +/-- The term ratio for `j ≥ 1`: `(j+1)^9 ≤ 512 j^9` since `j + 1 ≤ 2 j`. -/ +theorem pow_succ_le (j : ℕ) (hj : 1 ≤ j) : ((j : ℝ) + 1) ^ 9 ≤ 512 * (j : ℝ) ^ 9 := by + have hj' : (1 : ℝ) ≤ j := by exact_mod_cast hj + have h : ((j : ℝ) + 1) ≤ 2 * j := by linarith + calc ((j : ℝ) + 1) ^ 9 ≤ (2 * j) ^ 9 := pow_le_pow_left₀ (by linarith) h 9 + _ = 512 * (j : ℝ) ^ 9 := by ring + +/-- The exponential factor for `j ≥ 1`: `exp (-288 (j+1)^2) ≤ exp (-864) exp (-288 j^2)`. -/ +theorem exp_succ_le (j : ℕ) (hj : 1 ≤ j) : + Real.exp (-288 * ((j : ℝ) + 1) ^ 2) ≤ Real.exp (-864) * Real.exp (-288 * (j : ℝ) ^ 2) := by + have hj' : (1 : ℝ) ≤ j := by exact_mod_cast hj + rw [← Real.exp_add, Real.exp_le_exp] + nlinarith + +/-! ### Square-root algebra -/ + +/-- `sqrt (3/8) = sqrt 6 / 4`. -/ +theorem sqrt_three_eighths : Real.sqrt (3 / 8) = Real.sqrt 6 / 4 := by + rw [show (3 / 8 : ℝ) = 6 / 4 ^ 2 by norm_num, Real.sqrt_div' _ (by norm_num), + Real.sqrt_sq (by norm_num)] + +/-- `(sqrt 6)^(4/3) = 24^(1/3) (3/2)^(1/3)`, i.e. `6^(2/3) = 36^(1/3)` and `24 * 3/2 = 36`. -/ +theorem sqrt_six_rpow : (Real.sqrt 6) ^ ((4 : ℝ) / 3) = + (24 : ℝ) ^ ((1 : ℝ) / 3) * (3 / 2 : ℝ) ^ ((1 : ℝ) / 3) := by + rw [← Real.mul_rpow (by norm_num) (by norm_num), Real.sqrt_eq_rpow, + ← Real.rpow_mul (by norm_num), show (1 / (2 : ℝ)) * (4 / 3) = 2 * (1 / 3) by norm_num, + Real.rpow_mul (by norm_num), Real.rpow_two] + norm_num + +/-! ### The elementary cone integral -/ + +/-- The antiderivative `F z = -((a-z)^2 - 4(a-z) + 8) exp (-z/2)` of +`(a-z)^2 exp (-z/2) / 2`. -/ +theorem hasDerivAt_antideriv (a z : ℝ) : + HasDerivAt (fun z : ℝ => -(((a - z) ^ 2 - 4 * (a - z) + 8) * Real.exp (-z / 2))) + ((a - z) ^ 2 * Real.exp (-z / 2) / 2) z := by + have h1 : HasDerivAt (fun z : ℝ => a - z) (-1) z := + (hasDerivAt_id' z).const_sub a + have h2 : HasDerivAt (fun z : ℝ => (a - z) ^ 2) (((2 : ℕ) : ℝ) * (a - z) ^ (2 - 1) * (-1)) z := + h1.fun_pow 2 + have h3 : HasDerivAt (fun z : ℝ => 4 * (a - z)) (4 * (-1)) z := h1.const_mul 4 + have h4 : HasDerivAt (fun z : ℝ => (a - z) ^ 2 - 4 * (a - z) + 8) + (((2 : ℕ) : ℝ) * (a - z) ^ (2 - 1) * (-1) - 4 * (-1) + 0) z := + (h2.sub h3).add (hasDerivAt_const z (8 : ℝ)) + have h5 : HasDerivAt (fun z : ℝ => -z / 2) (-1 / 2) z := + ((hasDerivAt_id' z).neg).div_const 2 + have h6 : HasDerivAt (fun z : ℝ => Real.exp (-z / 2)) (Real.exp (-z / 2) * (-1 / 2)) z := h5.exp + have h7 := (h4.mul h6).neg + convert h7 using 1 + push_cast + ring + +end Aux + +/-! ## Section 2 exponential and ratio facts -/ + +/-- Proves: `UniversalLaw.Spec.Side24.ExponentialBounds` (register row `side24-coefficient`). +Method: degree-nine Taylor lower bound `Real.sum_le_exp_of_nonneg` at `288/125` evaluated in +exact rational arithmetic, then `exp 288 = exp (288/125)^125 > 10^125` and inversion. +Does not establish: the lattice-image bound or display (2) of the source, any enclosure of the +coefficient, nonauthor review or acceptance of SIDE24-COEFFICIENT-D23-20260924-v1. -/ +theorem exponentialBounds : UniversalLaw.Spec.Side24.ExponentialBounds := + ⟨Aux.ten_lt_exp, Aux.exp_neg_lt⟩ + +/-- Proves: `UniversalLaw.Spec.Side24.SuccessiveTermRatio` (register row `side24-coefficient`). +Method: `(j+1)^9 ≤ (2j)^9 = 512 j^9` and `-288 (j+1)^2 ≤ -864 - 288 j^2` for `j ≥ 1`; +`512 exp (-864) < 1/2` from the quadratic lower bound `1 + 864 + 864^2/2 ≤ exp 864`. +Does not establish: the lattice-image sum bound `LatticeImageSumBound` (the geometric +summation itself is not performed here), any enclosure of the coefficient, nonauthor review +or acceptance. -/ +theorem successiveTermRatio : UniversalLaw.Spec.Side24.SuccessiveTermRatio := by + refine ⟨fun j hj => ?_, Aux.ratio_const_lt_half⟩ + calc ((j : ℝ) + 1) ^ 9 * Real.exp (-288 * ((j : ℝ) + 1) ^ 2) + ≤ (512 * (j : ℝ) ^ 9) * (Real.exp (-864) * Real.exp (-288 * (j : ℝ) ^ 2)) := + mul_le_mul (Aux.pow_succ_le j hj) (Aux.exp_succ_le j hj) (Real.exp_pos _).le + (by positivity) + _ = 512 * Real.exp (-864) * ((j : ℝ) ^ 9 * Real.exp (-288 * (j : ℝ) ^ 2)) := by ring + +/-! ## Section 1 algebra -/ + +/-- Proves: `UniversalLaw.Spec.Side24.ConeMomentD2Algebra` (register row `side24-coefficient`). +Method: `sqrt (3/8) = sqrt 6 / 4` (`Real.sqrt_div'`, `Real.sqrt_sq`), then `ring`. +Does not establish: the Gaussian identity `ConeMomentD2Identity` (that `D_2` is the cone +expectation), any enclosure of the coefficient, nonauthor review or acceptance. -/ +theorem coneMomentD2Algebra : UniversalLaw.Spec.Side24.ConeMomentD2Algebra := by + unfold UniversalLaw.Spec.Side24.ConeMomentD2Algebra coneMomentD2 + rw [Aux.sqrt_three_eighths] + ring + +/-- Proves: `UniversalLaw.Spec.Side24.ReferenceCoefficientIdentity` (register row +`side24-coefficient`). +Method: case split `d = 2`, `d = 3`; `(sqrt 6)^(4/3) = 24^(1/3) (3/2)^(1/3)` through +`Real.sqrt_eq_rpow`, `Real.rpow_mul`, `Real.mul_rpow`; `(2 pi)^(-d)` through `Real.rpow_neg` +and `Real.rpow_natCast`; then `field_simp` and `ring` with `pi`, `sqrt pi`, `sqrt 3`, +`24^(1/3)` nonzero. +Does not establish: that the left side is the parent formula (15.2) evaluated at the reference +law (rotational invariance of `K_infty` is not specified), the value of `Gamma (7/6)`, equality +of the periodic and reference coefficients (the source says it is NOT claimed), any enclosure +of the coefficient, nonauthor review or acceptance. -/ +theorem referenceCoefficientIdentity : UniversalLaw.Spec.Side24.ReferenceCoefficientIdentity := by + intro d hd + have hpi := Real.pi_pos + have hsqpi : 0 < Real.sqrt Real.pi := Real.sqrt_pos.mpr hpi + have hsq3 : 0 < Real.sqrt 3 := Real.sqrt_pos.mpr (by norm_num) + have h24 : 0 < (24 : ℝ) ^ ((1 : ℝ) / 3) := Real.rpow_pos_of_pos (by norm_num) _ + have h32 : 0 < (3 / 2 : ℝ) ^ ((1 : ℝ) / 3) := Real.rpow_pos_of_pos (by norm_num) _ + have hG := Real.Gamma_pos_of_pos (by norm_num : (0 : ℝ) < 7 / 6) + rw [Aux.sqrt_six_rpow, Real.rpow_neg (by positivity), Real.rpow_natCast] + rcases hd with rfl | rfl + · simp only [cRef, sphereArea, coneMomentRef] + norm_num + field_simp + · simp only [cRef, sphereArea, coneMomentRef] + norm_num + field_simp + ring + +/-- Proves: `UniversalLaw.Spec.Side24.ElementaryConeIntegral` (register row +`side24-coefficient`). +Method: fundamental theorem of calculus `intervalIntegral.integral_eq_sub_of_hasDerivAt` with +the explicit antiderivative `-((a-z)^2 - 4(a-z) + 8) exp (-z/2)` (derivative rules +`HasDerivAt.fun_pow`, `.mul`, `.exp`), integrability from continuity (`fun_prop`). +Does not establish: the Rayleigh law of `R^2` (`RayleighSquareLaw`), the cone-moment identity +`ConeMomentD2Identity`, any enclosure of the coefficient, nonauthor review or acceptance. -/ +theorem elementaryConeIntegral : UniversalLaw.Spec.Side24.ElementaryConeIntegral := by + intro a _ + have hderiv : ∀ z ∈ Set.uIcc (0 : ℝ) a, + HasDerivAt (fun z : ℝ => -(((a - z) ^ 2 - 4 * (a - z) + 8) * Real.exp (-z / 2))) + ((a - z) ^ 2 * Real.exp (-z / 2) / 2) z := + fun z _ => Aux.hasDerivAt_antideriv a z + have hint : IntervalIntegrable (fun z : ℝ => (a - z) ^ 2 * Real.exp (-z / 2) / 2) + MeasureTheory.volume 0 a := + (by fun_prop : Continuous fun z : ℝ => (a - z) ^ 2 * Real.exp (-z / 2) / 2).intervalIntegrable 0 a + rw [intervalIntegral.integral_eq_sub_of_hasDerivAt hderiv hint] + simp + ring + +end UniversalLaw.Proofs.Side24Elementary diff --git a/specifications/lean_statement_proofs_20261011/check.py b/specifications/lean_statement_proofs_20261011/check.py new file mode 100644 index 000000000..9b0bf0f3c --- /dev/null +++ b/specifications/lean_statement_proofs_20261011/check.py @@ -0,0 +1,1337 @@ +#!/usr/bin/env python3 +"""Source and execution checker for the proof packet +`specifications/lean_statement_proofs_20261011` (standard library only). + + python3 check.py [source] source mode: packet identity against git HEAD, the lexical + refusal list on every module, the theorem inventory (every + non-aux theorem must have as its type a registered `def … : + Prop` of the statement register, applied to exactly its own + parameters), docstring labels, root imports, dependency lock, + byte-exact lakefile.toml, toolchain pin + python3 check.py --execute the same, then the exact Lean version, a fresh `lake build`, + `leanchecker`, `#check` and `#print axioms` of every + inventoried theorem, the environment audit (every constant + Lean added for the modules, classified by its ConstantInfo + and its type after `forallTelescope`), real negative controls, + a receipt under .lake/evidence/ + python3 check.py --allow-dirty local development only: the clean-worktree requirement is + skipped; a receipt then records the worktree as unverified + and must not be trusted as evidence about any commit. With + LEAN_PROOF_SKIP_LEANCHECKER=1 (honoured only together with + --allow-dirty, never in CI) the leanchecker replay, which + needs roughly 14 GB of memory on the Mathlib-importing + environment, is skipped and the receipt records the skip + +Scientific effect: NONE. The packet holds proofs of registered statements: theorems whose types +are `def … : Prop` constants of `specifications/lean_statements_20261010/REGISTER.json`. A green +check means that those theorems were accepted by the Lean kernel at the pinned toolchain and +Mathlib, depend on no axiom outside propext, Classical.choice and Quot.sound, and that every +non-aux theorem of the modules proves a registered Prop applied to exactly its own parameters. +That is kernel evidence about those Props only. It is not a proof of any informal claim, not an +alignment review (alignment is PENDING_INDEPENDENT_REVIEW), not an acceptance, and it changes no +label of the statement register, which this packet never edits. Nothing here can raise any claim. + +Two independent stages enforce the theorem shape. The source scan is a fail-closed pre-Lean stage +over comment-stripped text: whole-token refusals (sorry, axiom, native_decide, unsafe, opaque, …), +`set_option maxHeartbeats` above 400000 without a justifying comment, declaration keywords off +column 0, and a lexical parse of every theorem header (binders, result type, head constant resolved +through the opened namespaces, explicit binders passed as arguments). It is not a Lean elaborator. +The authority is the `--execute` environment audit: Lean's own `ConstantInfo` of every constant +the modules add (`.lake/evidence/Environment.lean`) refuses axioms, opaque and unsafe constants, +definitions whose type is a proposition, any transitive axiom outside the allowed three, and any +non-aux theorem whose type after `forallTelescope` is not a registered Prop constant applied to +exactly the telescope's variables (an extra hypothesis or a narrowed argument is a finding about +the statement, never a theorem of it); and it requires Lean's theorem inventory to equal the scan's. +""" +from __future__ import annotations + +import argparse +import copy +import hashlib +import json +import os +from pathlib import Path, PurePosixPath +import re +import shutil +import subprocess +import sys + +ROOT = Path(__file__).resolve().parent +REPO = ROOT.parents[1] +PACKAGE = 'specifications/lean_statement_proofs_20261011' +STATEMENT_PACKAGE = 'specifications/lean_statements_20261010' +STATEMENT_DIR = '../lean_statements_20261010' # the path dependency, relative to the packet +REPOSITORY = 'd6g8k5htny-coder/Math-' +WORKFLOW = '.github/workflows/lean-specification-proofs.yml' +ROOT_MODULE = 'SpecificationProofs' +STATEMENT_ROOT_MODULE = 'Specifications' +NAMESPACE = 'UniversalLaw.Proofs.' +STATEMENT_NAMESPACE = 'UniversalLaw.Spec.' +AUX = 'Aux' +CONTROL_NS = 'UniversalLaw.Proofs.Control' +TOOLCHAIN = 'leanprover/lean4:v4.34.1' +LEAN_COMMIT = '5045d0056413266e57c625dcd7c365b10e377c52' +MATHLIB_REV = 'd13f23b723b8a846827a245b89c10fc7d3f11612' +LOCK_NAME = 'universal_law_specification_proofs' +STATEMENT_LOCK_NAME = 'universal_law_specifications' +REGISTER_OBJECT = 'LEAN-STATEMENT-REGISTER-20261010-v1' +RECEIPT_OBJECT = 'LEAN-PROOF-RECEIPT-20261011-v1' +ALLOWED_AXIOMS = frozenset({'propext', 'Classical.choice', 'Quot.sound'}) +MAX_HEARTBEATS = 400000 +LABELS = ('Proves:', 'Method:', 'Does not establish:') +LEAN_OPTIONS_LINE = 'leanOptions = { autoImplicit = false }' +PATH_DEPENDENCY = {'type': 'path', 'name': STATEMENT_LOCK_NAME, 'dir': STATEMENT_DIR, 'manifestFile': 'lake-manifest.json', + 'inherited': False, 'configFile': 'lakefile.toml'} +# The packet's lakefile.toml, byte-exactly: Lake accepts options such as `moreLeanArgs = +# ["-Ddebug.skipKernelTC=true"]` at package or library level and a "contains these lines" check +# would let them through, so the whole file is pinned like lean-toolchain is. +LAKEFILE = (f'name = "{LOCK_NAME}"\nversion = "0.1.0"\ndefaultTargets = ["{ROOT_MODULE}"]\n\n' + f'[[require]]\nname = "mathlib"\ngit = "https://github.com/leanprover-community/mathlib4.git"\nrev = "{MATHLIB_REV}"\n\n' + f'[[require]]\nname = "{STATEMENT_LOCK_NAME}"\npath = "{STATEMENT_DIR}"\n\n' + f'[[lean_lib]]\nname = "{ROOT_MODULE}"\n{LEAN_OPTIONS_LINE}\n') +SKIP_LEANCHECKER_ENV = 'LEAN_PROOF_SKIP_LEANCHECKER' +# Lexical refusal list (DESIGN2, theorem shape): proof escapes (sorry and its axiom sorryAx, admit, +# axiom, native_decide and `decide +native` through the token `native`, its axiom ofReduceBool, +# trustCompiler), constants the kernel does not check (unsafe, opaque, partial, implemented_by, +# extern), options that skip or fake checking (debug.skipKernelTC, debug.byAsSorry), +# metaprogramming and syntax that can add declarations under other names (macro, syntax, elab, +# notation, run_cmd, initialize, export, alias, irreducible_def), `include` (forces a section +# hypothesis into every theorem) and `_root_` (escapes the module namespace). Matched as whole +# identifier tokens of the comment-stripped code, so a docstring may mention them. Not an +# elaboration check: the environment audit in --execute is the Lean-side authority. +REFUSED_TOKENS = ('sorry', 'sorryAx', 'admit', 'axiom', 'native_decide', 'native', 'ofReduceBool', 'trustCompiler', 'unsafe', + 'opaque', 'partial', 'implemented_by', 'extern', 'skipKernelTC', 'byAsSorry', 'macro', 'macro_rules', 'syntax', + 'elab', 'elab_rules', 'notation', 'infix', 'infixl', 'infixr', 'prefix', 'postfix', 'run_cmd', 'run_tac', + 'run_elab', 'initialize', 'builtin_initialize', 'declare_syntax_cat', 'export', 'alias', + 'irreducible_def', 'include', '_root_') +REFUSED_OPTION_PREFIXES = ('debug.', 'bootstrap.', 'compiler.') +REFUSED_OPTIONS = ('autoImplicit', 'relaxedAutoImplicit') +DECLARATION_KEYWORDS = ('theorem', 'lemma', 'def', 'abbrev', 'instance', 'structure', 'inductive', 'example') +MODIFIERS = ('private', 'protected', 'noncomputable') +SCOPE_KEYWORDS = ('namespace', 'section', 'end', 'variable', 'universe') +# Lean commands are not indentation-sensitive, so a declaration or scope keyword anywhere but at +# the start of its own line (after attributes and modifiers) is refused. `open … in` and +# `set_option … in` may chain a command onto the NEXT line and may also appear inside tactic blocks, +# so they are not policed here; the environment audit sees whatever Lean adds. +COLUMN0_KEYWORDS = DECLARATION_KEYWORDS + MODIFIERS + SCOPE_KEYWORDS +ALLOWED_COMMANDS = frozenset(COLUMN0_KEYWORDS) | {'import', 'open', 'set_option', 'attribute', 'deriving', 'omit'} +CONTINUATIONS = ('|', 'termination_by', 'decreasing_by') +COMMAND_KEYWORD = re.compile(r"(?\n]*>>') +FIXED_FILES = ('.gitignore', 'README.md', 'SCOPE.md', 'check.py', 'test_check.py', 'replay.sh', 'lakefile.toml', + 'lean-toolchain', 'lake-manifest.json', ROOT_MODULE + '.lean') +SKIP_DIRS = frozenset({'.lake', '__pycache__'}) +HEX40 = re.compile(r'[0-9a-f]{40}') +AXIOM_LINE = re.compile(r"'([^'\s]+)' (?:depends on axioms: \[([^\]]*)\]|does not depend on any axioms)") +AUDIT_LINE = re.compile(r'\bAUDIT (\S+) (\S+)(?: (\S+))?$', re.M) +AUDIT_END = re.compile(r'\bAUDIT END (\d+) (\d+) (\d+)$', re.M) +AUDIT_CLASSES = frozenset({'theorem', 'aux_theorem', 'auxiliary', 'generated'}) +LEAN_ERROR = re.compile(r':\d+:\d+: error(?:\([^)]*\))?:') # Lean 4.34 may tag errors: `error(lean.unknownIdentifier):` +MODULE_WARNING = re.compile(r'warning: \S*' + ROOT_MODULE + r'/[A-Za-z0-9_]+\.lean:\d+:\d+:|' + ROOT_MODULE + r'/[A-Za-z0-9_]+\.lean:\d+:\d+: warning') +BRACKETS = {'(': ')', '[': ']', '{': '}', '⦃': '⦄', '⟨': '⟩'} +CLOSERS = frozenset(BRACKETS.values()) +BINDER_KINDS = {'(': 'explicit', '{': 'implicit', '⦃': 'strict', '[': 'instance'} + + +def sha(data: bytes) -> str: + return hashlib.sha256(data).hexdigest() + + +def require(condition, message): + if not condition: + raise ValueError(message) + + +def load_json(text: str): + """Strict JSON: duplicate keys, non-integer numbers and NaN/Infinity are refused.""" + def unique(pairs): + obj = {} + for key, value in pairs: + require(key not in obj, 'duplicate JSON key: ' + key) + obj[key] = value + return obj + + def reject(token): + raise ValueError('non-integer or non-finite JSON number refused: ' + token) + return json.loads(text, object_pairs_hook=unique, parse_float=reject, parse_constant=reject) + + +def safe_path(root: Path, relative) -> Path: + require(isinstance(relative, str) and relative and '\\' not in relative, f'invalid path: {relative!r}') + pure = PurePosixPath(relative) + require(not pure.is_absolute() and '..' not in pure.parts and str(pure) == relative, f'unsafe path: {relative}') + path = root + for part in pure.parts: + path = path / part + require(not path.is_symlink(), f'symlink refused: {relative}') + require(path.is_file() and path.resolve().is_relative_to(root.resolve()), f'missing or escaping file: {relative}') + return path + + +# ----------------------------------------------------------------------------- Lean source scan + +def lex(text: str): + """Comment-stripped code with every newline preserved, plus the docstring blocks `/-- … -/` + as (first_line, last_line, raw_text). Nested block comments are supported; an unterminated + block comment, string literal or guillemet name is refused. A string literal or guillemet + name outside a comment is copied verbatim into the code, so a `/-`, `-/` or `--` inside it + never opens or closes a comment.""" + out, docs, i, n, depth, line, start = [], [], 0, len(text), 0, 0, None + while i < n: + two = text[i:i + 2] + if depth: + if two == '/-': + depth, i = depth + 1, i + 2 + elif two == '-/': + depth, i = depth - 1, i + 2 + if depth == 0 and start is not None: + docs.append((start[0], line, text[start[1]:i])) + start = None + else: + if text[i] == '\n': + out.append('\n') + line += 1 + else: + out.append(' ') + i += 1 + elif two == '/-': + depth = 1 + if text.startswith('/--', i): + start = (line, i) + i += 2 + elif two == '--': + end = text.find('\n', i) + i = n if end < 0 else end + elif text[i] in '"«': + if text[i] == '"': + j = i + 1 + while j < n and text[j] != '"': + j += 2 if text[j] == '\\' else 1 + else: + j = text.find('»', i) + j = n if j < 0 else j + require(j < n, 'unterminated string literal or guillemet name') + segment = text[i:j + 1] + out.append(segment) + line += segment.count('\n') + i = j + 1 + else: + if text[i] == '\n': + line += 1 + out.append(text[i]) + i += 1 + require(depth == 0, 'unterminated block comment') + return ''.join(out), docs + + +def refused_tokens(code: str) -> list: + words = set(re.findall(r'[A-Za-z_][A-Za-z0-9_]*', code)) + return sorted(set(REFUSED_TOKENS) & words) + + +def depth_zero(text: str) -> str: + """`text` with everything inside brackets blanked (same length), for depth-zero tests.""" + depth, out = 0, [] + for ch in text: + if ch in BRACKETS: + depth += 1 + elif ch in CLOSERS: + depth -= 1 + out.append(ch if depth == 0 and ch not in CLOSERS else ' ') + return ''.join(out) + + +def header(lines: list, i: int, after: str) -> str: + """Declaration header text: from `after` (the rest of line i past the name) up to the first + bracket-depth-zero `:=`, `where` or leading `| `, or up to the next column-0 line.""" + parts, depth, k, seg = [], 0, i, after + while True: + p = 0 + while p < len(seg): + c = seg[p] + if c in BRACKETS: + depth += 1 + elif c in CLOSERS: + depth -= 1 + elif depth == 0: + if seg.startswith(':=', p): + parts.append(seg[:p]) + return ''.join(parts) + if (p == 0 or seg[p - 1].isspace()) and re.match(r'where(?![A-Za-z0-9_])', seg[p:]): + parts.append(seg[:p]) + return ''.join(parts) + p += 1 + parts.append(seg + '\n') + k += 1 + if k >= len(lines): + return ''.join(parts) + seg = lines[k] + if (seg and not seg[0].isspace()) or (depth == 0 and seg.lstrip().startswith('| ')): + return ''.join(parts) + + +def first_colon(text: str): + """Index of the first bracket-depth-zero `:` that is not part of `:=` or `::`, or None.""" + depth = 0 + for p, c in enumerate(text): + if c in BRACKETS: + depth += 1 + elif c in CLOSERS: + depth -= 1 + elif c == ':' and depth == 0 and text[p:p + 2] != ':=' and (p == 0 or text[p - 1] != ':') and text[p + 1:p + 2] != ':': + return p + return None + + +def parse_binders(text: str) -> list: + """Binder groups of a header: [{kind: explicit|implicit|strict|instance, names: [...]}]. + A bare identifier is an explicit binder; an instance binder may be unnamed.""" + out, i, n = [], 0, len(text) + while i < n: + c = text[i] + if c.isspace(): + i += 1 + continue + if c in BRACKETS: + require(c in BINDER_KINDS, f'unexpected binder bracket {c!r} in a theorem header') + depth, j = 1, i + 1 + while j < n and depth: + if text[j] in BRACKETS: + depth += 1 + elif text[j] in CLOSERS: + depth -= 1 + j += 1 + require(depth == 0, 'unbalanced brackets in a theorem header') + inner = text[i + 1:j - 1] + colon = first_colon(inner) + if colon is None: + names = [] if BINDER_KINDS[c] == 'instance' else inner.split() + else: + names = inner[:colon].split() + out.append({'kind': BINDER_KINDS[c], 'names': names}) + i = j + else: + m = IDENT_RE.match(text, i) + require(m is not None, f'unparsable binder text {text[i:i + 24]!r} in a theorem header') + out.append({'kind': 'explicit', 'names': [m.group()]}) + i = m.end() + return out + + +def result_head(type_text: str): + """(head constant name, [argument names]) of a result type written as a constant applied to + bare parameter names; anything else (a quantifier, an implication, a relation, a bracketed + argument) is refused: the type of an inventory theorem must be exactly a registered Prop + constant applied to the theorem's own parameters.""" + normalized = ' '.join(type_text.split()) + require(normalized, 'theorem without a result type') + require(all(ch not in BRACKETS for ch in depth_zero(normalized) if ch != ' ') and not any(ch in BRACKETS for ch in normalized), + f'result type {normalized!r}: arguments of the registered Prop must be bare parameter names (no bracketed ' + 'expressions; a narrowed argument is a finding about the statement, not a theorem of it)') + tokens = normalized.split() + for t in tokens: + require(IDENT_RE.fullmatch(t) is not None and not t.startswith('_root_'), + f'result type {normalized!r}: must be a registered Prop constant applied to parameter names; found {t!r} ' + '(no `∀`, `→`, `∃`, relations or operators at depth zero: move quantifiers into binders)') + return tokens[0], tokens[1:] + + +def head_candidates(head: str, opens: list, namespaces: list) -> set: + """Every global name `head` may denote under Lean's resolution: as written, relative to a + prefix of the current namespace, or through an opened namespace (itself possibly relative).""" + prefixes = set() + for ns in namespaces: + parts = ns.split('.') + for k in range(1, len(parts) + 1): + prefixes.add('.'.join(parts[:k])) + candidates = {head} | {p + '.' + head for p in prefixes} + for o in opens: + candidates.add(o + '.' + head) + candidates.update(p + '.' + o + '.' + head for p in prefixes) + return candidates + + +def resolve_head(head: str, opens: list, namespaces: list, registered: dict, local=frozenset()) -> str: + """The unique registered Prop that `head` denotes: as written, or through an opened + namespace, or relative to a prefix of the current namespace (Lean's name resolution). A + candidate that is a declaration of the module itself (`local`) is refused first: Lean resolves + a name of the current namespace before an opened one, so a module-local `def A : Prop` would + silently make `theorem t : A` a theorem about the local definition, not the registered Prop.""" + candidates = head_candidates(head, opens, namespaces) + shadow = sorted(candidates & set(local)) + require(not shadow, f'result type head {head!r} is shadowed by the module-local declaration(s) {shadow!r}: a proof module may ' + 'not declare a name that a registered Prop resolves through (Lean resolves the current namespace before an opened one)') + hits = sorted(candidates & set(registered)) + require(hits, f'result type head {head!r} is not a registered `def … : Prop` of the statement register ' + f'(resolution tried {len(candidates)} names through the opened namespaces)') + require(len(hits) == 1, f'result type head {head!r} resolves to several registered Props: {hits!r}') + return hits[0] + + +def names_prop(text: str, head: str) -> bool: + """`text` names the registered Prop `head` as a whole token: its qualified name, or its last + component preceded at most by a namespace prefix, and not as a prefix or suffix of a longer + identifier (`AA`, `A.eq_1` do not name `A`).""" + last = head.rsplit('.', 1)[-1] + pattern = r"(? dict: + """The three labelled lines DESIGN2 requires of an inventory theorem's docstring; the + `Proves:` line must name the registered Prop it proves (qualified or by its last component) + as a whole token.""" + body = raw[3:-2] + found = {} + for label in LABELS: + hits = re.findall(r'^[ \t]*' + re.escape(label) + r'(.*)$', body, re.M) + require(len(hits) == 1, f'{name}: docstring must carry exactly one `{label}` line (found {len(hits)})') + require(hits[0].strip(), f'{name}: empty `{label}` entry in docstring (the entry starts on the label\'s line)') + found[label] = hits[0].strip() + require(names_prop(found['Proves:'], head), f'{name}: the `Proves:` line must name the registered Prop {head} as a whole token') + return found + + +def legal_head(text: str) -> bool: + """A declaration or scope keyword may be preceded on its line only by attribute groups and + modifiers, starting at column 0 (an indented keyword is refused).""" + if text[:1].isspace(): + return False + s = text + while s.startswith('@['): + depth, j = 0, 0 + while j < len(s): + if s[j] == '[': + depth += 1 + elif s[j] == ']': + depth -= 1 + if depth == 0: + break + j += 1 + if j >= len(s): + return False + s = s[j + 1:].lstrip() + return all(tok in MODIFIERS for tok in s.split()) + + +def open_targets(block: str) -> list: + """Namespaces named by an `open` command (the tokens before any `(`, `hiding`, `renaming` + or `in`), `scoped` dropped.""" + out = [] + for tok in block.split()[1:]: + if tok in ('hiding', 'renaming', 'in') or tok.startswith('('): + break + if tok != 'scoped': + out.append(tok) + return out + + +def check_set_options(code: str, raw_lines: list, stem: str): + """Options a proof module may set: never a `debug.`, `bootstrap.` or `compiler.` option, never + autoImplicit; `maxHeartbeats` above 400000 (or 0, unlimited) only with a justifying comment on + the same line or on the line before. Returns the options seen.""" + seen = [] + for m in SET_OPTION.finditer(code): + name, value = m.groups() + line_no = code.count('\n', 0, m.start()) + require(not name.startswith(REFUSED_OPTION_PREFIXES) and name not in REFUSED_OPTIONS, + f'{stem}:{line_no + 1}: refused option `set_option {name}` (checking-weakening or implicit-binding option)') + if name == 'maxHeartbeats': + require(value.isdigit(), f'{stem}:{line_no + 1}: maxHeartbeats must be a literal number') + v = int(value) + if v == 0 or v > MAX_HEARTBEATS: + here = raw_lines[line_no] + prev = next((ln for ln in reversed(raw_lines[:line_no]) if ln.strip()), '') + justified = '--' in here[here.find('set_option'):] or prev.lstrip().startswith('--') or prev.rstrip().endswith('-/') + require(justified, f'{stem}:{line_no + 1}: `set_option maxHeartbeats {value}` exceeds {MAX_HEARTBEATS} without a ' + 'justifying comment on the same line or the line before') + seen.append({'line': line_no + 1, 'option': name, 'value': value}) + return seen + + +def scan_module(text: str, stem: str, registered: dict) -> dict: + """One proof module: imports, namespaces, the theorem inventory and the auxiliary counts. + Refuses the lexical list, `#` commands, refused options, declaration and scope keywords off + column 0, column-0 commands outside the allowed set, unbalanced scoping, declarations outside + the module namespace UniversalLaw.Proofs., and any non-aux theorem (not private, not + under an `Aux` namespace) whose header does not read `name : + ` with every explicit binder passed, whose head is a parameter or a name the + module itself declares (shadowing), or that lacks the three docstring labels. A pre-Lean + stage: the environment audit of --execute is the authority on what the modules declare.""" + code, docs = lex(text) + raw_lines = text.split('\n') + bad = refused_tokens(code) + require(not bad, f'refused token(s) in {stem}: {bad!r}') + m = HASH_COMMAND.search(code) + require(m is None, f'{stem}:{code.count(chr(10), 0, m.start()) + 1 if m else 0}: `#` commands have no place in a proof module') + options = check_set_options(code, raw_lines, stem) + dz = depth_zero(code) + for m in COMMAND_KEYWORD.finditer(dz): + head = code[code.rfind('\n', 0, m.start()) + 1:m.start()] + require(legal_head(head), f'{stem}:{code.count(chr(10), 0, m.start()) + 1}: keyword `{m.group(1)}` off column 0 ' + '(every declaration and scope command must start its own line, after attributes and modifiers only)') + expected_ns = NAMESPACE + stem + doc_end = {end: raw for _, end, raw in docs} + lines = code.split('\n') + imports, stack, namespaces, theorems = [], [], [], [] + local_names = set() # every name the module declares, fully qualified (shadowing check) + aux_theorems = auxiliary = 0 + pending_opens = [] + i = 0 + while i < len(lines): + line = lines[i] + if not line or line[0].isspace(): + i += 1 + continue + tok = line.split()[0] + if tok.startswith('@['): + # an attribute line; the declaration follows on this or a later line (DECL_LINE handles both) + if DECL_LINE.match(line) is None: + i += 1 + continue + tok = DECL_LINE.match(line).group(3) + if tok in CONTINUATIONS or tok.startswith('|'): + i += 1 + continue + require(tok in ALLOWED_COMMANDS, f'{stem}:{i + 1}: column-0 command not allowed in a proof module: {tok!r}') + if tok == 'import': + m = re.match(r'^import\s+(\S+)\s*$', line) + require(m is not None, f'{stem}:{i + 1}: unparsable import line') + imports.append(m.group(1)) + i += 1 + continue + if tok == 'namespace': + m = re.match(r'^namespace\s+(\S+)\s*$', line) + require(m is not None, f'{stem}:{i + 1}: anonymous or unparsable namespace') + prefix = [n for k, n, _, _ in stack if k == 'namespace'] + fq = '.'.join(prefix + [m.group(1)]) + require(fq == expected_ns or fq.startswith(expected_ns + '.'), + f'{stem}:{i + 1}: namespace {fq} is outside the module namespace {expected_ns}') + namespaces.append(fq) + stack.append(('namespace', m.group(1), [], [])) + i += 1 + continue + if tok == 'section' or (tok == 'noncomputable' and line.split()[1:2] == ['section']): + m = re.match(r'^(?:noncomputable\s+)?section(?:\s+(\S+))?\s*$', line) + require(m is not None, f'{stem}:{i + 1}: unparsable section line') + stack.append(('section', m.group(1), [], [])) + i += 1 + continue + if tok == 'end': + m = re.match(r'^end(?:\s+(\S+))?\s*$', line) + require(m is not None and stack, f'{stem}:{i + 1}: `end` without an open namespace or section') + kind, name, _, _ = stack.pop() + require(name == m.group(1), f'{stem}:{i + 1}: `end {m.group(1)}` does not close `{kind} {name}`') + i += 1 + continue + if tok in ('open', 'set_option', 'omit', 'variable', 'attribute', 'universe', 'deriving'): + block, k = [line], i + 1 + while k < len(lines) and lines[k] and lines[k][0].isspace(): + block.append(lines[k]) + k += 1 + joined = '\n'.join(block) + chained = IN_TOKEN.search(depth_zero(joined)) is not None + if tok in ('open', 'set_option', 'omit'): + require(not chained or re.search(r'(?= 0 and j not in doc_end and (not lines[j].strip() or lines[j].startswith('@[')): + j -= 1 + require(j in doc_end, f'{fq}: inventory theorem has no docstring immediately before it') + doc = theorem_doc(doc_end[j], fq, proves) + theorems.append({'name': fq, 'line': i + 1, 'proves': proves, 'binders': binders, 'arguments': args, + 'doc': {'proves': doc['Proves:'], 'method': doc['Method:'], 'does_not_establish': doc['Does not establish:']}, + 'resolution': (head, opens, scopes)}) + i += 1 + require(not stack, f'{stem}: unclosed namespace or section: {[(k, n) for k, n, _, _ in stack]!r}') + for t in theorems: + # shadowing is decided once every declaration of the module is known (a declaration after the + # theorem is refused too: the rule is conservative, Lean's resolution order is the reason) + head, opens, scopes = t.pop('resolution') + try: + resolve_head(head, opens, scopes, registered, local_names) + except ValueError as exc: + raise ValueError(f'{stem}:{t["line"]}: theorem {t["name"]}: {exc}') from None + require(namespaces and namespaces[0] == expected_ns, f'{stem}: the first namespace must be {expected_ns}: {namespaces!r}') + require(imports, f'{stem}: no import') + for imp in imports: + require(imp == 'Mathlib' or imp.startswith('Mathlib.') + or (imp.startswith(STATEMENT_ROOT_MODULE + '.') and imp.count('.') == 1) + or (imp.startswith(ROOT_MODULE + '.') and imp.count('.') == 1 and imp != ROOT_MODULE + '.' + stem), + f'{stem}: imports must be `Specifications.`, Mathlib or a sibling `SpecificationProofs.` of this packet, nothing else: {imp!r}') + require(any(imp.startswith(STATEMENT_ROOT_MODULE + '.') for imp in imports), f'{stem}: no statement module is imported') + return {'stem': stem, 'imports': imports, 'namespaces': namespaces, 'theorems': theorems, 'aux_theorems': aux_theorems, + 'auxiliary_definitions': auxiliary, 'set_options': options} + + +# ----------------------------------------------------------------------------- packet checks + +def git(repo: Path, *args, timeout=120): + return subprocess.run(['git', '-C', str(repo), *args], capture_output=True, text=True, timeout=timeout) + + +def check_identity(repo: Path, allow_dirty: bool): + proc = git(repo, 'rev-parse', 'HEAD') + head = proc.stdout.strip() if proc.returncode == 0 and HEX40.fullmatch(proc.stdout.strip()) else None + if allow_dirty: + return head, 'UNVERIFIED' + require(head is not None, 'not a git repository with a 40-hex HEAD (local development may pass --allow-dirty)') + status = git(repo, 'status', '--porcelain', '--untracked-files=all', '--', PACKAGE, STATEMENT_PACKAGE, WORKFLOW) + require(status.returncode == 0, 'git status failed: ' + status.stderr.strip()[:300]) + require(status.stdout.strip() == '', + 'proof packet, statement packet or workflow differ from HEAD (uncommitted or untracked):\n' + status.stdout[:2000]) + require(git(repo, 'ls-files', '--error-unmatch', WORKFLOW).returncode == 0, 'workflow is not tracked: ' + WORKFLOW) + if os.environ.get('GITHUB_ACTIONS') == 'true': + require(os.environ.get('GITHUB_SHA') == head, 'GITHUB_SHA differs from the checked-out HEAD') + require(os.environ.get('GITHUB_REPOSITORY') == REPOSITORY, 'unexpected GITHUB_REPOSITORY') + return head, 'CLEAN' + + +def load_register(statement_root: Path): + """The registered `def … : Prop` declarations of the statement packet, {name: {module, + claim_ids}}, plus the registered structures (never a theorem type). The register's own + invariants are the statement packet's gate; here only the pins and the inventory are read.""" + raw = safe_path(statement_root, 'REGISTER.json').read_bytes() + reg = load_json(raw.decode('utf-8')) + require(isinstance(reg, dict) and reg.get('object') == REGISTER_OBJECT, 'REGISTER.json object must be ' + REGISTER_OBJECT) + require(reg.get('scientific_effect') == 'NONE' and reg.get('scientific_status_authority') is False + and reg.get('alignment_status') == 'PENDING_INDEPENDENT_REVIEW', 'REGISTER.json scope fields differ from the contract') + require(reg.get('toolchain') == {'lean': TOOLCHAIN, 'lean_commit': LEAN_COMMIT, 'mathlib': MATHLIB_REV}, 'register toolchain pins differ') + require(isinstance(reg.get('claims'), list), 'REGISTER.json claims must be a list') + registered, structures = {}, set() + for row in reg['claims']: + require(isinstance(row, dict) and isinstance(row.get('claim_id'), str) and isinstance(row.get('statements'), list), 'malformed claim row') + for st in row['statements']: + require(isinstance(st, dict) and all(k in st for k in ('package', 'module', 'declaration', 'kind', 'formal_progress')), 'malformed statement row') + if st['package'] != STATEMENT_PACKAGE: + continue + require(st['formal_progress'] == 'specified', f'{st["declaration"]}: a statement of the statement packet is specified; ' + 'the proof packet never relabels the register') + require(st['declaration'].startswith(STATEMENT_NAMESPACE), f'{st["declaration"]}: registered name outside {STATEMENT_NAMESPACE}') + if st['kind'] == 'def_prop': + entry = registered.setdefault(st['declaration'], {'module': st['module'], 'claim_ids': []}) + require(entry['module'] == st['module'], f'{st["declaration"]}: registered in two modules') + if row['claim_id'] not in entry['claim_ids']: + entry['claim_ids'].append(row['claim_id']) + elif st['kind'] == 'structure': + structures.add(st['declaration']) + require(registered, 'the register names no `def … : Prop` of the statement packet') + for name, entry in registered.items(): + safe_path(statement_root, entry['module']) + return registered, structures, sha(raw) + + +def packet_files(root: Path) -> list: + files = [] + for dirpath, dirnames, filenames in os.walk(root): + for d in dirnames: + require(not (Path(dirpath) / d).is_symlink(), 'symlink directory refused: ' + d) + dirnames[:] = sorted(d for d in dirnames if d not in SKIP_DIRS) + for f in filenames: + p = Path(dirpath) / f + require(not p.is_symlink(), 'symlink refused: ' + p.relative_to(root).as_posix()) + files.append(p.relative_to(root).as_posix()) + return sorted(files) + + +def check_tree(root: Path) -> list: + """The packet holds exactly the fixed files and `SpecificationProofs/.lean` modules; + returns the module paths found.""" + present = packet_files(root) + modules = [f for f in present if re.fullmatch(ROOT_MODULE + r'/[A-Z][A-Za-z0-9]*\.lean', f)] + expected = sorted(set(FIXED_FILES) | set(modules)) + require(present == expected, 'packet tree differs from the fixed inventory: unexpected ' + + repr(sorted(set(present) - set(expected))) + ', missing ' + repr(sorted(set(expected) - set(present)))) + require(modules, 'no proof module under ' + ROOT_MODULE + '/') + require('.lake/' in (root / '.gitignore').read_text(encoding='utf-8').splitlines(), '.gitignore must ignore .lake/') + return modules + + +def check_lock(root: Path, statement_root: Path) -> dict: + """lean-toolchain and lakefile.toml byte-exact (Mathlib rev, the path dependency, autoImplicit + off, and nothing else: no `moreLeanArgs`, no extra dependency, library or executable) and + lake-manifest.json == the statement packet's lock plus the path dependency. Returns the git + dependency revisions.""" + require((root / 'lean-toolchain').read_bytes() == (TOOLCHAIN + '\n').encode(), 'lean-toolchain must read exactly ' + TOOLCHAIN) + require((statement_root / 'lean-toolchain').read_bytes() == (TOOLCHAIN + '\n').encode(), 'statement packet lean-toolchain differs') + lakefile = (root / 'lakefile.toml').read_bytes() + if lakefile != LAKEFILE.encode(): + actual, expected = lakefile.decode('utf-8', 'replace').split('\n'), LAKEFILE.split('\n') + k = next(i for i in range(max(len(actual), len(expected))) if actual[i:i + 1] != expected[i:i + 1]) + raise ValueError('lakefile.toml must be byte-exactly the pinned manifest (Mathlib rev, the path dependency, autoImplicit off and ' + f'no other option, dependency or target): line {k + 1} reads {actual[k:k + 1]!r}, expected {expected[k:k + 1]!r}') + lock = load_json((root / 'lake-manifest.json').read_text(encoding='utf-8')) + require(isinstance(lock, dict) and lock.get('name') == LOCK_NAME, 'lake-manifest.json name must be ' + LOCK_NAME) + ref = load_json(safe_path(statement_root, 'lake-manifest.json').read_text(encoding='utf-8')) + require(ref.get('name') == STATEMENT_LOCK_NAME, 'statement packet lake-manifest.json name must be ' + STATEMENT_LOCK_NAME) + packages = lock.get('packages') + require(isinstance(packages, list) and packages and packages[-1] == PATH_DEPENDENCY, + 'lake-manifest.json must end with the path dependency on the statement packet exactly: ' + json.dumps(PATH_DEPENDENCY)) + require(packages[:-1] == ref['packages'], 'lake-manifest.json git dependencies differ from the statement packet lock') + require({k: v for k, v in lock.items() if k not in ('name', 'packages')} == {k: v for k, v in ref.items() if k not in ('name', 'packages')}, + 'lake-manifest.json differs from the statement packet lock beyond name and packages') + revs = {p['name']: p['rev'] for p in packages[:-1]} + require(len(revs) == len(packages) - 1 and all(isinstance(v, str) and HEX40.fullmatch(v) for v in revs.values()), + 'duplicate or unpinned dependency in lake-manifest.json') + require(revs.get('mathlib') == MATHLIB_REV, 'lake-manifest.json Mathlib rev differs from the pin') + return revs + + +def check_root(root: Path, module_files: list) -> list: + """The root module imports exactly the module files present, one per line; returns the + modules in root order.""" + code, _ = lex((root / (ROOT_MODULE + '.lean')).read_text(encoding='utf-8')) + lines = [line for line in code.splitlines() if line.strip()] + imports = [] + for line in lines: + m = re.fullmatch(r'import ' + ROOT_MODULE + r'\.([A-Z][A-Za-z0-9]*)', line) + require(m is not None, 'root module lines must read `import ' + ROOT_MODULE + '.`: ' + repr(line)) + imports.append(ROOT_MODULE + '/' + m.group(1) + '.lean') + require(len(imports) == len(set(imports)), 'root module imports a module twice') + require(set(imports) == set(module_files), 'root module must import exactly the modules present under ' + ROOT_MODULE + + '/: imported ' + repr(sorted(set(imports) - set(module_files))) + ' missing, present but not imported ' + + repr(sorted(set(module_files) - set(imports)))) + return imports + + +def check_docs(root: Path): + for name in ('README.md', 'SCOPE.md'): + text = (root / name).read_text(encoding='utf-8') + hits = PLACEHOLDER.findall(text) + require(not hits, f'{name} still carries unfilled placeholder(s): {hits[:4]!r}') + for phrase in ('Scientific effect', 'NONE', 'PENDING_INDEPENDENT_REVIEW'): + require(phrase in text, f'{name} must state the scientific effect (`Scientific effect` … `NONE`) and the alignment status ' + f'(`PENDING_INDEPENDENT_REVIEW`) literally; missing {phrase!r}') + + +def statement_modules(statement_root: Path) -> dict: + files = sorted((statement_root / STATEMENT_ROOT_MODULE).glob('*.lean')) + require(files, 'statement packet has no modules') + return {STATEMENT_ROOT_MODULE + '/' + p.name: sha(p.read_bytes()) for p in files if not p.is_symlink()} + + +def source_check(root: Path = ROOT, repo: Path = REPO, allow_dirty: bool = False) -> dict: + root, repo = Path(root).resolve(), Path(repo).resolve() + head, worktree = check_identity(repo, allow_dirty) + statement_root = (root / STATEMENT_DIR).resolve() + require(statement_root.is_dir() and statement_root == (repo / STATEMENT_PACKAGE).resolve(), + f'the path dependency {STATEMENT_DIR} must be the statement packet {STATEMENT_PACKAGE} of the same repository') + registered, structures, register_sha = load_register(statement_root) + stmt_hashes = statement_modules(statement_root) + module_files = check_tree(root) + revs = check_lock(root, statement_root) + modules = check_root(root, module_files) + scans = {m: scan_module(safe_path(root, m).read_text(encoding='utf-8'), PurePosixPath(m).stem, registered) for m in modules} + for m, scan in scans.items(): + for imp in scan['imports']: + if imp.startswith(STATEMENT_ROOT_MODULE + '.'): + path = STATEMENT_ROOT_MODULE + '/' + imp.split('.', 1)[1] + '.lean' + require(path in stmt_hashes, f'{m}: imports {imp}, which is not a module of the statement packet') + elif imp.startswith(ROOT_MODULE + '.'): + path = ROOT_MODULE + '/' + imp.split('.', 1)[1] + '.lean' + require(path in modules, f'{m}: imports {imp}, which is not a proof module of this packet') + check_docs(root) + theorems = [dict(t, module=m) for m in modules for t in scans[m]['theorems']] + names = [t['name'] for t in theorems] + require(len(names) == len(set(names)), 'two inventory theorems share a name') + for t in theorems: + t['claim_ids'] = registered[t['proves']]['claim_ids'] + t['statement_module'] = registered[t['proves']]['module'] + covered = sorted({t['proves'] for t in theorems}) + duplicates = sorted({t['proves'] for t in theorems if sum(u['proves'] == t['proves'] for u in theorems) > 1}) + return {'scientific_effect': 'NONE', 'formalization_status': 'proved', 'alignment_status': 'PENDING_INDEPENDENT_REVIEW', + 'checked_commit': head, 'worktree': worktree, 'register_sha256': register_sha, 'statement_module_sha256': stmt_hashes, + 'module_sha256': {m: sha((root / m).read_bytes()) for m in modules}, 'dependency_revisions': revs, 'modules': modules, + 'registered_props': len(registered), 'theorem_count': len(theorems), 'covered_props': covered, 'duplicate_proofs': duplicates, + 'aux_theorems': sum(s['aux_theorems'] for s in scans.values()), + 'auxiliary_definitions': sum(s['auxiliary_definitions'] for s in scans.values()), + 'set_options': {m: s['set_options'] for m, s in scans.items() if s['set_options']}, + 'theorems': [{'name': t['name'], 'module': t['module'], 'line': t['line'], 'proves': t['proves'], + 'statement_module': t['statement_module'], 'claim_ids': t['claim_ids'], + 'binder_count': len(t['binders']), 'argument_count': len(t['arguments']), + 'explicit_parameters': sum(len(b['names']) for b in t['binders'] if b['kind'] == 'explicit'), + 'doc': t['doc']} for t in theorems], + 'registered': registered, 'scans': scans} + + +# ----------------------------------------------------------------------------- Lean execution + +def lake_binary(): + found = shutil.which('lake') + if found: + return found + candidate = Path.home() / '.elan/bin/lake' + return str(candidate) if candidate.is_file() else None + + +def lean_env(lake: str) -> dict: + return dict(os.environ, PATH=f'{Path(lake).parent}{os.pathsep}{os.environ.get("PATH", "")}') + + +def run(command, label, out: Path, cwd: Path, env, expect_success=True, timeout=3600): + proc = subprocess.run(command, cwd=cwd, text=True, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, + timeout=timeout, env=env, encoding='utf-8', errors='replace') + (out / (label + '.log')).write_text(proc.stdout, encoding='utf-8') + print(label + ': exit ' + str(proc.returncode), flush=True) + require((proc.returncode == 0) == expect_success, 'unexpected process outcome: ' + label + '\n' + proc.stdout[-6000:]) + return proc.stdout + + +def check_lean_version(text: str) -> str: + """The last line of `lake env lean --version` (lake may print `info:` lines first) must be the + pinned release exactly: version, release commit and Release build.""" + lines = [line.strip() for line in text.splitlines() if line.strip()] + require(lines and all(line.startswith('info:') for line in lines[:-1]), 'unexpected output around the Lean version: ' + repr(text[:200])) + version = lines[-1] + require(re.fullmatch(r'Lean \(version 4\.34\.1, [^()\r\n]+, commit ' + LEAN_COMMIT + r', Release\)', version) is not None, + 'running Lean is not the pinned release: ' + repr(version[:160])) + return version + + +def dependency_state(root: Path, revs: dict) -> dict: + """Every git dependency checkout under .lake/packages is at its locked revision and clean; + the path dependency resolves to the statement packet. `.lake/packages` itself may be a symlink + to a prebuilt dependency tree (recorded in the receipt), each package directory may not.""" + actual = {} + for name, rev in revs.items(): + pkg = root / '.lake' / 'packages' / name + require(pkg.is_dir() and not pkg.is_symlink(), 'dependency checkout missing: ' + name) + actual[name] = subprocess.check_output(['git', '-C', str(pkg), 'rev-parse', 'HEAD'], text=True).strip() + status = subprocess.check_output(['git', '-C', str(pkg), 'status', '--porcelain', '--untracked-files=normal'], text=True) + require(status.strip() == '', f'dependency worktree is not clean: {name}: {status.strip()[:200]}') + require(actual == revs, 'checked-out dependency revisions differ from lake-manifest.json: ' + repr(actual)) + return actual + + +def audit_axioms(text: str, targets: list) -> dict: + require(isinstance(targets, list) and targets and len(set(targets)) == len(targets), 'empty or duplicate target list') + records = {} + for match in AXIOM_LINE.finditer(text): + name, raw = match.groups() + require(name in targets and name not in records, 'unexpected or duplicate axiom report: ' + name) + axioms = [] if raw is None or not raw.strip() else [a.strip() for a in raw.split(',')] + require(all(re.fullmatch(r"[A-Za-z_][A-Za-z0-9_.']*", a) for a in axioms), 'malformed axiom name') + require(set(axioms) <= ALLOWED_AXIOMS, 'forbidden transitive axiom: ' + repr(sorted(set(axioms) - ALLOWED_AXIOMS))) + records[name] = sorted(set(axioms)) + require(not AXIOM_LINE.sub('', text).strip(), 'unrecognized audit output') + require(set(records) == set(targets), 'missing axiom report: ' + repr(sorted(set(targets) - set(records)))) + return records + + +def signatures(log: str, names: list) -> dict: + """One elaborated signature per name from the `#check` log: the block starting at the line + that begins with the name, continued by indented lines (the pretty printer wraps).""" + lines, found = log.splitlines(), {} + for n in names: + starts = [i for i, line in enumerate(lines) if re.match(re.escape(n) + r'(?![A-Za-z0-9_.])', line)] + require(len(starts) == 1, 'no unique elaborated signature reported for ' + n) + i = starts[0] + 1 + while i < len(lines) and lines[i] and lines[i][0].isspace(): + i += 1 + found[n] = '\n'.join(lines[starts[0]:i]) + return found + + +def kernel_audit(lake: str, root: Path, env: dict, out: Path, names: list, root_module: str = ROOT_MODULE): + """`#print axioms` (parsed, allowed set only) and `#check` (logged, one signature per name) of + every inventoried theorem. Returns the axiom records and the elaborated signatures.""" + audit = out / 'Audit.lean' + audit.write_text('import ' + root_module + '\n' + ''.join(f'#print axioms {n}\n' for n in names), encoding='utf-8') + axioms = audit_axioms(run([lake, 'env', 'lean', str(audit)], 'axioms', out, root, env), names) + types = out / 'Types.lean' + types.write_text('import ' + root_module + '\n' + ''.join(f'#check {n}\n' for n in names), encoding='utf-8') + log = run([lake, 'env', 'lean', str(types)], 'types', out, root, env) + require(LEAN_ERROR.search(log) is None, 'the elaborated-types log reports an error') + return axioms, signatures(log, names) + + +AUDIT_PROGRAM = ''' +/-! Every constant of the audited modules (or, when `auditModules` is empty, every constant of +this file under `auditPrefix`, private names included) is classified by Lean's own `ConstantInfo` +and type, never by source text. `theorem`: a theorem that is not private, not under an `Aux` +namespace and carries a declaration range, whose type after `forallTelescope` is a registered Prop +constant applied to exactly the telescope's variables (reported with that constant). `aux_theorem`: +a private theorem or one under `Aux`. `generated`: a range-less theorem (structure `injEq`, +`sizeOf_spec`, `_proof_*`, an equation lemma `eq_*` of an unfolded statement definition, which may +be generated in several modules and is audited once), refused if its head is a registered Prop. `auxiliary`: definitions, +instances, inductive types, constructors and recursors whose type is not a proposition. +`REFUSED:`: an axiom, opaque, quotient or unsafe constant; a definition whose type is a +proposition (a proof written as `def`); a non-aux theorem whose head is not registered (`type`) or +whose arguments are not exactly its own parameters (`premise`: an extra hypothesis or a narrowed +argument); any transitive axiom outside propext, Classical.choice and Quot.sound (`axioms`). +One `AUDIT []` line per constant, then `AUDIT END +`; any refusal makes the file fail. -/ +run_cmd do + let env ← getEnv + let allowed : Array Name := #[``propext, ``Classical.choice, ``Quot.sound] + let mut constants : Array ConstantInfo := #[] + if auditModules.isEmpty then + constants := env.constants.foldStage2 (fun acc _ ci => + let user := (privateToUserName? ci.name).getD ci.name + if auditPrefix.isPrefixOf user then acc.push ci else acc) #[] + else + let mut found : Array Name := #[] + for (modName, data) in env.header.moduleNames.zip env.header.moduleData do + if auditModules.contains modName then + found := found.push modName + constants := constants ++ data.constants + unless found.size == auditModules.size do + throwError "AUDIT REFUSED: audited module not imported: {auditModules.filter (!found.contains ·)}" + -- an equation lemma of an imported definition (`foo.eq_1`) is generated on demand in every module + -- that unfolds it and is one constant of the environment: audit each name once + let mut seen : NameSet := {} + let mut unique : Array ConstantInfo := #[] + for ci in constants do + unless seen.contains ci.name do + seen := seen.insert ci.name + unique := unique.push ci + constants := unique + let mut refused := 0 + let mut theorems := 0 + for ci in constants do + let n := ci.name + let axioms ← collectAxioms n + let bad := axioms.filter (!allowed.contains ·) + let range ← findDeclarationRanges? n + let user := (privateToUserName? n).getD n + let isAux := isPrivateName n || user.components.contains `Aux + let (head, exact) ← liftTermElabM do + forallTelescope ci.type fun xs body => do + let args := body.getAppArgs + let exact := args.size == xs.size && args.all (fun a => xs.contains a) && xs.all (fun x => args.contains x) + pure (body.getAppFn.constName?, exact) + let headStr : String := match head with | some c => toString c | none => "nonconstant" + let registeredHead := match head with | some c => registeredProps.contains c | none => false + let isP ← liftTermElabM (isProp ci.type) + let kind : String := + if ci.isUnsafe then "REFUSED:unsafe" else + match ci with + | .axiomInfo _ => "REFUSED:axiom" + | .opaqueInfo _ => "REFUSED:opaque" + | .quotInfo _ => "REFUSED:quot" + | .inductInfo _ => "auxiliary" + | .ctorInfo _ => "auxiliary" + | .recInfo _ => "auxiliary" + | .defnInfo _ => if isP then "REFUSED:proof_as_def" else "auxiliary" + | .thmInfo _ => + if isAux then "aux_theorem" + else if range.isNone then (if registeredHead then s!"REFUSED:generated_proof:{headStr}" else "generated") + else if registeredHead then (if exact then "theorem" else s!"REFUSED:premise:{headStr}") + else s!"REFUSED:type:{headStr}" + let verdict : String := + if kind.startsWith "REFUSED" || bad.isEmpty then kind + else "REFUSED:axioms:" ++ ",".intercalate (bad.map toString).toList + if verdict.startsWith "REFUSED" then refused := refused + 1 + if verdict == "theorem" then + theorems := theorems + 1 + logInfo m!"AUDIT theorem {n} {headStr}" + else + logInfo m!"AUDIT {verdict} {n}" + logInfo m!"AUDIT END {constants.size} {refused} {theorems}" + if refused > 0 then throwError "AUDIT REFUSED {refused} constant(s); see the AUDIT lines" +''' + + +def audit_source(root_module: str, module_names: list, registered: list, declarations: str = '') -> str: + """The environment-audit file: imports, the audited module list (empty: this file), the + registered Prop names, optional control declarations, and the fixed audit program.""" + modules = '#[' + ', '.join('`' + m for m in module_names) + ']' + props = '#[' + ', '.join('`' + r for r in registered) + ']' + return (f'import Lean\nimport {root_module}\nopen Lean Meta Elab Command\n\n' + f'/-- Modules whose constants are audited; empty means the constants of this file under `auditPrefix`. -/\n' + f'def auditModules : Array Name := {modules}\n' + f'/-- Namespace of the control declarations audited when `auditModules` is empty. -/\n' + f'def auditPrefix : Name := `{CONTROL_NS}\n' + f'/-- The registered `def … : Prop` constants of the statement register. -/\n' + f'def registeredProps : Array Name := {props}\n{declarations}{AUDIT_PROGRAM}') + + +def parse_audit(log: str): + """`AUDIT []` lines as ({class: set(names)}, {theorem: head}); the + `AUDIT END` line must account for every line, every refusal and every theorem.""" + classes, heads, seen = {}, {}, set() + for m in AUDIT_LINE.finditer(log): + verdict, name, head = m.groups() + if verdict == 'END': + continue + require(name not in seen, 'duplicate audit line for ' + name) + seen.add(name) + classes.setdefault(verdict, set()).add(name) + if verdict == 'theorem': + require(head is not None, 'theorem audit line without its head: ' + name) + heads[name] = head + ends = AUDIT_END.findall(log) + require(len(ends) == 1, 'the environment audit did not report exactly one END line') + total, refused, theorems = (int(x) for x in ends[0]) + require(total == len(seen), f'environment audit reported {total} constants but {len(seen)} AUDIT lines') + require(refused == sum(len(v) for k, v in classes.items() if k.startswith('REFUSED')), 'environment audit refusal count differs from its lines') + require(theorems == len(heads), 'environment audit theorem count differs from its lines') + return classes, heads + + +def environment_audit(lake: str, root: Path, env: dict, out: Path, module_names: list, registered: list, expected: dict, + root_module: str = ROOT_MODULE) -> dict: + """Lean's own inventory of the modules (see AUDIT_PROGRAM) must pass with no refusal, and its + theorem inventory {name: registered head} must equal the scan's exactly.""" + path = out / 'Environment.lean' + path.write_text(audit_source(root_module, module_names, registered), encoding='utf-8') + classes, heads = parse_audit(run([lake, 'env', 'lean', str(path)], 'environment', out, root, env)) + require(set(classes) <= AUDIT_CLASSES, 'environment audit refused constant(s): ' + repr(sorted(set(classes) - AUDIT_CLASSES))) + require(heads == expected, 'environment audit: Lean\'s theorem inventory differs from the scan: unexpected ' + + repr(sorted(set(heads) - set(expected))[:8]) + ', missing ' + repr(sorted(set(expected) - set(heads))[:8]) + + ', head differs ' + repr(sorted(n for n in set(heads) & set(expected) if heads[n] != expected[n])[:8])) + return {k: len(v) for k, v in sorted(classes.items())} + + +def parameterless_prop(statement_root: Path, registered: dict) -> str: + """A registered Prop with no parameters (`def : Prop :=` in its statement module), used + by the controls to state refused theorems of a registered type.""" + for module in sorted({e['module'] for e in registered.values()}): + code, _ = lex(safe_path(statement_root, module).read_text(encoding='utf-8')) + for m in re.finditer(r'^(?:noncomputable )?def\s+(\S+)\s*:\s*Prop\s*:=', code, re.M): + name = STATEMENT_NAMESPACE + PurePosixPath(module).stem + '.' + m.group(1) + if name in registered: + return name + raise ValueError('no parameterless registered Prop available for the controls') + + +HIDDEN_CONTROL = ''' +namespace {ns} +theorem sorried : {prop} := sorry +axiom hidden : False +theorem usesAxiom : {prop} := hidden.elim +theorem unregistered : True := trivial +theorem smuggled (h : False) : {prop} := h.elim +theorem implication : {prop} → {prop} := fun h => h +def proofAsDef : (2 : Nat) + 2 = 4 := rfl +opaque opq : Nat +unsafe def unsafeDef : Nat := 0 +end {ns} +''' +HONEST_CONTROL = ''' +namespace {ns} +/-- Control: a theorem of a registered type, proved by the packet's own theorem. -/ +theorem honest : {prop} := {witness} +/-- Control: a helper under Aux (not inventory). -/ +theorem Aux.helper : True := trivial +/-- Control: a private helper (not inventory). -/ +private theorem privateHelper : True := trivial +/-- Control: an auxiliary definition. -/ +def helper (n : Nat) : Nat := n + 1 +/-- Control: an instance is an auxiliary definition. -/ +instance controlInst : Inhabited Nat := ⟨0⟩ +end {ns} +''' + + +def lean_control_environment(lake: str, root: Path, env: dict, out: Path, registered: list, prop: str, witness, + root_module: str = ROOT_MODULE) -> str: + """Two Lean-side controls of the environment audit itself, over the constants of a control + file (never a packet module): a hidden file (sorry, custom axiom and a theorem using it, an + unregistered type, a smuggled hypothesis, a `P → P` implication, a proof written as def, an + opaque and an unsafe constant) must be refused for exactly those reasons; an honest file + (a theorem of registered type proved by the packet's witness when one is parameterless, an + Aux helper, a private helper, a definition, an instance) must be classified exactly.""" + hidden = out / 'controls' / 'ControlEnvironmentHidden.lean' + hidden.write_text(audit_source(root_module, [], registered, HIDDEN_CONTROL.format(ns=CONTROL_NS, prop=prop)), encoding='utf-8') + log = run([lake, 'env', 'lean', str(hidden)], 'control_environment_hidden', out, root, env, expect_success=False) + require('AUDIT REFUSED' in log and LEAN_ERROR.search(log) is not None, 'hidden environment control failed for the wrong reason') + classes, heads = parse_audit(log) + c = CONTROL_NS + '.' + expected = {'REFUSED:axioms:sorryAx': {c + 'sorried'}, 'REFUSED:axiom': {c + 'hidden'}, + 'REFUSED:axioms:' + c + 'hidden': {c + 'usesAxiom'}, 'REFUSED:type:True': {c + 'unregistered'}, + 'REFUSED:premise:' + prop: {c + 'smuggled', c + 'implication'}, 'REFUSED:proof_as_def': {c + 'proofAsDef'}, + 'REFUSED:opaque': {c + 'opq'}, 'REFUSED:unsafe': {c + 'unsafeDef'}} + require(classes == expected and not heads, 'hidden environment control was not refused for exactly the expected reasons: ' + + repr({k: sorted(v) for k, v in classes.items()})) + honest = out / 'controls' / 'ControlEnvironmentHonest.lean' + text = HONEST_CONTROL.format(ns=CONTROL_NS, prop=prop, witness=witness) + if witness is None: + text = re.sub(r'/-- Control: a theorem of a registered type[^\n]*\ntheorem honest[^\n]*\n', '', text) + honest.write_text(audit_source(root_module, [], registered, text), encoding='utf-8') + classes, heads = parse_audit(run([lake, 'env', 'lean', str(honest)], 'control_environment_honest', out, root, env)) + private = {n for n in classes.get('aux_theorem', set()) if n.startswith('_private.') and n.endswith('.privateHelper')} + require(set(classes) <= AUDIT_CLASSES and heads == ({c + 'honest': prop} if witness else {}) + and classes.get('aux_theorem', set()) == {c + 'Aux.helper'} | private and len(private) == 1 + and classes.get('auxiliary') == {c + 'helper', c + 'controlInst'}, + 'honest environment control was not classified exactly: ' + repr({k: sorted(v) for k, v in classes.items()})) + return ('REFUSED_BY_ENVIRONMENT_AUDIT (sorry, custom axiom and its user, unregistered type, smuggled hypothesis, P → P ' + 'implication, proof as def, opaque, unsafe) and the honest control classified exactly' + + ('' if witness else ' (no parameterless inventory theorem: the honest control carries no registered-type theorem)')) + + +def lean_control_sorry_axioms(lake: str, root: Path, env: dict, out: Path, prop: str, root_module: str = ROOT_MODULE) -> str: + """A `sorry` theorem of a registered type passes Lean with a warning; `#print axioms` reports + sorryAx and the axiom audit refuses it.""" + path = out / 'controls' / 'ControlSorry.lean' + name = CONTROL_NS + '.sorried' + path.write_text(f'import {root_module}\n\ntheorem {name} : {prop} := sorry\n#print axioms {name}\n', encoding='utf-8') + log = run([lake, 'env', 'lean', str(path)], 'control_sorry_axioms', out, root, env) + require('declaration uses' in log and 'sorryAx' in log, 'sorry control did not report sorryAx: ' + log[-400:]) + try: + audit_axioms('\n'.join(line for line in log.splitlines() if "'" in line and 'axioms' in line), [name]) + except ValueError as exc: + require('forbidden transitive axiom' in str(exc) and 'sorryAx' in str(exc), 'sorry control refused for the wrong reason: ' + str(exc)) + return 'REFUSED_BY_AXIOM_AUDIT (sorryAx)' + raise ValueError('the axiom audit accepted a sorry theorem') + + +def lean_control_false_arithmetic(lake: str, root: Path, env: dict, out: Path, root_module: str = ROOT_MODULE) -> str: + """A true bound of the packet's kind tightened into a false one: `6/7 ≤ 6/7 - 10^-20` and + `16·7 < 16·7`; Lean must leave the goal `False` unsolved.""" + path = out / 'controls' / 'ControlFalseArithmetic.lean' + path.write_text(f'import {root_module}\n\n/-- Negative control: a tightened false arithmetic statement. Lean must refuse it. -/\n' + f'theorem {CONTROL_NS}.tightened : (6 : ℝ) / 7 ≤ 6 / 7 - 1 / 10 ^ 20 := by norm_num\n' + f'theorem {CONTROL_NS}.tightened2 : (16 : ℝ) * 7 < 16 * 7 := by norm_num\n', encoding='utf-8') + log = run([lake, 'env', 'lean', str(path)], 'control_false_arithmetic', out, root, env, expect_success=False) + require(len(re.findall(r'error: unsolved goals\s*\n⊢ False', log)) == 2 and LEAN_ERROR.search(log) is not None, + 'false-arithmetic control failed for the wrong reason: ' + log[-600:]) + return 'REJECTED_BY_LEAN (unsolved goal False, twice)' + + +def lean_control_missing(lake: str, root: Path, env: dict, out: Path, name: str, root_module: str = ROOT_MODULE) -> str: + path = out / 'controls' / 'ControlMissing.lean' + path.write_text('import ' + root_module + '\n#check ' + name + '\n', encoding='utf-8') + log = run([lake, 'env', 'lean', str(path)], 'control_missing_declaration', out, root, env, expect_success=False) + require(('unknown identifier' in log.lower() or 'unknown constant' in log.lower()) and LEAN_ERROR.search(log) is not None, + 'missing-declaration control failed for the wrong reason: ' + log[-600:]) + return 'REJECTED_BY_LEAN' + + +def expect_refusal(fn, fragment: str, label: str): + try: + fn() + except ValueError as exc: + require(fragment in str(exc), f'negative control {label} was refused for the wrong reason: {exc}') + return 'REFUSED_BY_SOURCE_CHECK' + raise ValueError('negative control escaped the source check: ' + label) + + +def source_controls(info: dict, ctrl: Path) -> dict: + """Source-side negative controls (no Lean): module copies carrying a `sorry`, an `axiom`, a + `native_decide`, an unjustified `maxHeartbeats 800000`, a theorem of unregistered type, a + theorem with a smuggled explicit hypothesis, a `P → P` theorem and a theorem without the + docstring labels, each run through `scan_module`; the packet itself is never modified.""" + registered = info['registered'] + module = info['modules'][0] + stem = PurePosixPath(module).stem + ns = NAMESPACE + stem + prop = next(iter(sorted(registered))) + stmt_module = STATEMENT_ROOT_MODULE + '.' + PurePosixPath(registered[prop]['module']).stem + doc = f'/-- Proves: `{prop}`.\nMethod: control.\nDoes not establish: anything. -/\n' + + def mod(body): + return f'import {stmt_module}\n\nnamespace {ns}\n\n{body}\n\nend {ns}\n' + cases = { + 'sorry': (mod(f'{doc}theorem control : {prop} := sorry'), 'refused token'), + 'axiom': (mod(f'axiom hidden : False\n\n{doc}theorem control : {prop} := hidden.elim'), 'refused token'), + 'native_decide': (mod(f'{doc}theorem control : {prop} := by native_decide'), 'refused token'), + 'maxHeartbeats_unjustified': (mod(f'set_option maxHeartbeats 800000 in\n{doc}theorem control : {prop} := by trivial'), 'justifying comment'), + 'unregistered_type': (mod('/-- Proves: `True`.\nMethod: control.\nDoes not establish: anything. -/\ntheorem control : True := trivial'), + 'not a registered'), + 'smuggled_hypothesis': (mod(f'{doc}theorem control (h : False) : {prop} := h.elim'), 'not passed to'), + 'implication': (mod(f'{doc}theorem control : {prop} → {prop} := fun h => h'), 'must be a registered Prop constant applied'), + 'missing_docstring_labels': (mod(f'/-- No labels. -/\ntheorem control : {prop} := by trivial'), 'docstring must carry'), + } + outcomes = {} + for label, (text, fragment) in cases.items(): + (ctrl / f'Source_{label}.lean.txt').write_text(text, encoding='utf-8') + outcomes[label] = expect_refusal(lambda: scan_module(text, stem, registered), fragment, label) + justified = mod(f'-- justification: the control proof is heavy\nset_option maxHeartbeats 800000 in\n{doc}theorem control : {prop} := by trivial') + scan = scan_module(justified, stem, registered) + require(len(scan['theorems']) == 1 and scan['set_options'][0]['value'] == '800000', 'justified maxHeartbeats control was not accepted') + outcomes['maxHeartbeats_justified'] = 'ACCEPTED_BY_SOURCE_CHECK (comment on the line before)' + return outcomes + + +def negative_controls(lake: str, root: Path, env: dict, out: Path, info: dict, statement_root: Path) -> dict: + ctrl = out / 'controls' + ctrl.mkdir() + outcomes = source_controls(info, ctrl) + registered = sorted(info['registered']) + # a parameterless registered Prop for the controls: preferably one the packet proves without parameters (then the + # honest control re-proves it from the packet's theorem), else any parameterless Prop of the statement modules + prop, witness = next(((t['proves'], t['name']) for t in info['theorems'] if t['binder_count'] == 0 and t['argument_count'] == 0), (None, None)) + if prop is None: + prop = parameterless_prop(statement_root, info['registered']) + outcomes['sorry_axiom_audit'] = lean_control_sorry_axioms(lake, root, env, out, prop) + outcomes['false_arithmetic'] = lean_control_false_arithmetic(lake, root, env, out) + outcomes['missing_declaration'] = lean_control_missing(lake, root, env, out, CONTROL_NS + '.DoesNotExist') + outcomes['environment_audit'] = lean_control_environment(lake, root, env, out, registered, prop, witness) + return outcomes + + +def leanchecker_mode(allow_dirty: bool) -> str: + """`RUN`, or `SKIPPED_LOCAL_ONLY` when LEAN_PROOF_SKIP_LEANCHECKER=1 is set together with + --allow-dirty outside CI. The leanchecker replay of the Mathlib-importing environment needs + roughly 14 GB of memory; skipping it lets the remaining stages be exercised on a smaller + machine, and the receipt it yields is already non-evidential (worktree UNVERIFIED). Setting + the variable without --allow-dirty, or in CI, is refused rather than ignored.""" + if os.environ.get(SKIP_LEANCHECKER_ENV) != '1': + return 'RUN' + require(os.environ.get('GITHUB_ACTIONS') != 'true', SKIP_LEANCHECKER_ENV + ' is refused in CI: a receipt without leanchecker is local-only') + require(allow_dirty, SKIP_LEANCHECKER_ENV + ' is honoured only together with --allow-dirty: a receipt without leanchecker is local-only') + return 'SKIPPED_LOCAL_ONLY' + + +def execute(root: Path, repo: Path, info: dict, allow_dirty: bool) -> dict: + root, repo = Path(root).resolve(), Path(repo).resolve() + statement_root = (root / STATEMENT_DIR).resolve() + leanchecker = leanchecker_mode(allow_dirty) + lake = lake_binary() + require(lake is not None, 'lake not found on PATH or in ~/.elan/bin') + env = lean_env(lake) + out = root / '.lake' / 'evidence' + require(not (root / '.lake').is_symlink() and not out.is_symlink() and not (root / '.lake' / 'build').is_symlink(), 'symlink build directory') + if out.exists(): + shutil.rmtree(out) + out.mkdir(parents=True) + version = check_lean_version(run([lake, 'env', 'lean', '--version'], 'version', out, root, env)) + revs = dependency_state(root, info['dependency_revisions']) + if (root / '.lake' / 'build').exists(): + shutil.rmtree(root / '.lake' / 'build') # fresh build of this packet only; dependency builds are untouched + log = run([lake, 'build'], 'build', out, root, env) + require(LEAN_ERROR.search(log) is None and re.search(r'\berror\b', log, re.I) is None, 'build log reports an error') + require('declaration uses' not in log, 'build log reports sorry or a similar escape') + require('is a proposition; use' not in log, 'build log reports a definition whose type is a proposition (a proof written as def)') + require(MODULE_WARNING.search(log) is None, 'build log reports a warning in a proof module (modules are held to -DwarningAsError=true)') + if leanchecker == 'RUN': + run([lake, 'env', 'leanchecker', ROOT_MODULE], 'leanchecker', out, root, env) + else: + print('leanchecker: SKIPPED_LOCAL_ONLY (' + SKIP_LEANCHECKER_ENV + '=1 with --allow-dirty); the receipt records the skip and is ' + 'not evidence about any commit', file=sys.stderr, flush=True) + names = [t['name'] for t in info['theorems']] + require(names, 'no inventory theorem to audit') + axioms, sigs = kernel_audit(lake, root, env, out, names) + expected = {t['name']: t['proves'] for t in info['theorems']} + registered = sorted(info['registered']) + environment = environment_audit(lake, root, env, out, [m[:-5].replace('/', '.') for m in info['modules']], registered, expected) + outcomes = negative_controls(lake, root, env, out, info, statement_root) + after = source_check(root, repo, allow_dirty) + require(after['register_sha256'] == info['register_sha256'] and after['module_sha256'] == info['module_sha256'] + and after['statement_module_sha256'] == info['statement_module_sha256'] and after['checked_commit'] == info['checked_commit'], + 'packet changed during execution') + theorems = [dict(t, axioms=axioms[t['name']], signature=sigs[t['name']], formal_progress='kernel-checked') for t in info['theorems']] + (out / 'theorems.json').write_text(json.dumps(theorems, indent=2, ensure_ascii=False) + '\n', encoding='utf-8') + receipt = {'schema_version': 1, 'object': RECEIPT_OBJECT, 'scientific_effect': 'NONE', 'scientific_status_authority': False, + 'package': PACKAGE, 'statement_package': STATEMENT_PACKAGE, 'formalization_status': 'kernel-checked', + 'alignment_status': 'PENDING_INDEPENDENT_REVIEW', + 'meaning': 'The inventoried theorems were accepted by the Lean kernel at the checked commit against the pinned Mathlib ' + 'and statement packet, depend on no axiom outside propext, Classical.choice and Quot.sound, and each has as ' + 'its type a registered Prop constant applied to exactly its own parameters (Lean\'s own inventory equals the ' + 'scan\'s). This is kernel evidence about those Props only: not that any informal claim is true, aligned with ' + 'its source, reviewed or accepted. The statement register is not edited by this packet and no claim, premise ' + 'or obligation changes status because of this receipt.', + 'checked_commit': info['checked_commit'], 'worktree': info['worktree'], + 'receipt_trust': 'CLEAN worktree at checked_commit' if info['worktree'] == 'CLEAN' else + 'LOCAL_ONLY: the worktree was not verified against checked_commit; not evidence about any commit' + + ('; leanchecker was skipped' if leanchecker != 'RUN' else ''), + 'repository': os.environ.get('GITHUB_REPOSITORY'), 'workflow_run_id': os.environ.get('GITHUB_RUN_ID'), + 'workflow_run_attempt': os.environ.get('GITHUB_RUN_ATTEMPT'), 'lean_version': version, 'toolchain': TOOLCHAIN, + 'dependency_revisions': revs, 'packages_dir': 'symlink' if (root / '.lake' / 'packages').is_symlink() else 'directory', + 'register_sha256': info['register_sha256'], 'statement_module_sha256': info['statement_module_sha256'], + 'module_sha256': info['module_sha256'], 'modules': info['modules'], 'registered_props': info['registered_props'], + 'theorem_count': len(names), 'covered_props': info['covered_props'], 'duplicate_proofs': info['duplicate_proofs'], + 'aux_theorems': info['aux_theorems'], 'auxiliary_definitions': info['auxiliary_definitions'], + 'theorems': [{'name': t['name'], 'module': t['module'], 'proves': t['proves'], 'claim_ids': t['claim_ids'], + 'axioms': t['axioms'], 'formal_progress': 'kernel-checked'} for t in theorems], + 'axioms': axioms, 'environment_audit': environment, 'lean_options': {'autoImplicit': False}, + 'negative_controls': outcomes, 'build': 'PASS', 'leanchecker': 'PASS' if leanchecker == 'RUN' else leanchecker, + 'dependency_worktrees': 'CLEAN'} + receipt['logs'] = {p.name: sha(p.read_bytes()) for p in sorted(out.glob('*.log'))} + (out / 'receipt.json').write_text(json.dumps(receipt, indent=2, sort_keys=True) + '\n', encoding='utf-8') + return receipt + + +def main(argv=None) -> int: + p = argparse.ArgumentParser(description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter) + p.add_argument('mode', nargs='?', choices=['source'], help='optional; `source` names the default mode') + p.add_argument('--root', type=Path, default=ROOT, help='packet directory') + p.add_argument('--repo', type=Path, default=REPO, help='repository root (holds both packets and the workflow)') + p.add_argument('--execute', action='store_true', help='fresh build, leanchecker, #check/#print axioms, environment audit, controls, receipt') + p.add_argument('--allow-dirty', action='store_true', help='local development only: skip the clean-worktree requirement') + args = p.parse_args(argv) + try: + info = source_check(args.root, args.repo, args.allow_dirty) + if info['worktree'] != 'CLEAN': + print('WORKTREE_UNVERIFIED: packet identity against HEAD was not checked (--allow-dirty); nothing printed here ' + 'is evidence about a commit', file=sys.stderr) + summary = {k: v for k, v in info.items() if k not in ('scans', 'registered', 'module_sha256', 'statement_module_sha256')} + if args.execute: + receipt = execute(args.root, args.repo, info, args.allow_dirty) + print(json.dumps({'passed': True, 'formalization_status': receipt['formalization_status'], + 'alignment_status': receipt['alignment_status'], 'checked_commit': receipt['checked_commit'], + 'worktree': receipt['worktree'], 'leanchecker': receipt['leanchecker'], 'theorem_count': receipt['theorem_count'], + 'covered_props': receipt['covered_props'], 'negative_controls': receipt['negative_controls']}, + indent=2, sort_keys=True)) + else: + print('SOURCE_CHECK_PASS (proofs of registered statements only: not a Lean build, not a review, not an acceptance)') + print(json.dumps(summary, indent=2, sort_keys=True)) + except (ValueError, KeyError, TypeError, OSError, UnicodeDecodeError, subprocess.SubprocessError) as exc: + print('LEAN_PROOF_CHECK_FAIL: ' + str(exc), file=sys.stderr) + return 1 + return 0 + + +if __name__ == '__main__': + sys.exit(main()) diff --git a/specifications/lean_statement_proofs_20261011/lake-manifest.json b/specifications/lean_statement_proofs_20261011/lake-manifest.json new file mode 100644 index 000000000..550a1b0ce --- /dev/null +++ b/specifications/lean_statement_proofs_20261011/lake-manifest.json @@ -0,0 +1,125 @@ +{ + "version": "1.2.0", + "packagesDir": ".lake/packages", + "packages": [ + { + "name": "plausible", + "url": "https://github.com/leanprover-community/plausible", + "type": "git", + "subDir": null, + "scope": "leanprover-community", + "rev": "118aa17ee84656b8bd727fef7c458ee8c833385c", + "manifestFile": "lake-manifest.json", + "inputRev": "main", + "inherited": true, + "configFile": "lakefile.toml" + }, + { + "name": "LeanSearchClient", + "url": "https://github.com/leanprover-community/LeanSearchClient", + "type": "git", + "subDir": null, + "scope": "leanprover-community", + "rev": "ddf04cf3949fa556442341e87d47f9f6e6074707", + "manifestFile": "lake-manifest.json", + "inputRev": "main", + "inherited": true, + "configFile": "lakefile.toml" + }, + { + "name": "importGraph", + "url": "https://github.com/leanprover-community/import-graph", + "type": "git", + "subDir": null, + "scope": "leanprover-community", + "rev": "e928b72544873815af278d38681b31c0293588e3", + "manifestFile": "lake-manifest.json", + "inputRev": "main", + "inherited": true, + "configFile": "lakefile.toml" + }, + { + "name": "proofwidgets", + "url": "https://github.com/leanprover-community/ProofWidgets4", + "type": "git", + "subDir": null, + "scope": "leanprover-community", + "rev": "106ff4fafc74ef4ac99d81dbf3ab399118f497a5", + "manifestFile": "lake-manifest.json", + "inputRev": "main", + "inherited": true, + "configFile": "lakefile.lean" + }, + { + "name": "aesop", + "url": "https://github.com/leanprover-community/aesop", + "type": "git", + "subDir": null, + "scope": "leanprover-community", + "rev": "355695d523e41d0554926416cba2a2b3544fbbc9", + "manifestFile": "lake-manifest.json", + "inputRev": "master", + "inherited": true, + "configFile": "lakefile.toml" + }, + { + "name": "Qq", + "url": "https://github.com/leanprover-community/quote4", + "type": "git", + "subDir": null, + "scope": "leanprover-community", + "rev": "6a489d9af5d0c47e5b259e2e8bcdfc1811b5a259", + "manifestFile": "lake-manifest.json", + "inputRev": "master", + "inherited": true, + "configFile": "lakefile.toml" + }, + { + "name": "batteries", + "url": "https://github.com/leanprover-community/batteries", + "type": "git", + "subDir": null, + "scope": "leanprover-community", + "rev": "f2effa3d803fda822b1f97b806c47cf2adfbcbc2", + "manifestFile": "lake-manifest.json", + "inputRev": "main", + "inherited": true, + "configFile": "lakefile.toml" + }, + { + "name": "Cli", + "url": "https://github.com/leanprover/lean4-cli", + "type": "git", + "subDir": null, + "scope": "leanprover", + "rev": "e92c9f15fdfacc8536f31cfb3b7ad26c3c8cd204", + "manifestFile": "lake-manifest.json", + "inputRev": "v4.34.0", + "inherited": true, + "configFile": "lakefile.toml" + }, + { + "name": "mathlib", + "url": "https://github.com/leanprover-community/mathlib4.git", + "type": "git", + "subDir": null, + "scope": "", + "rev": "d13f23b723b8a846827a245b89c10fc7d3f11612", + "manifestFile": "lake-manifest.json", + "inputRev": "d13f23b723b8a846827a245b89c10fc7d3f11612", + "inherited": false, + "configFile": "lakefile.lean" + }, + { + "type": "path", + "name": "universal_law_specifications", + "dir": "../lean_statements_20261010", + "manifestFile": "lake-manifest.json", + "inherited": false, + "configFile": "lakefile.toml" + } + ], + "name": "universal_law_specification_proofs", + "lakeDir": ".lake", + "fixedToolchain": true +} diff --git a/specifications/lean_statement_proofs_20261011/lakefile.toml b/specifications/lean_statement_proofs_20261011/lakefile.toml new file mode 100644 index 000000000..0256ce649 --- /dev/null +++ b/specifications/lean_statement_proofs_20261011/lakefile.toml @@ -0,0 +1,16 @@ +name = "universal_law_specification_proofs" +version = "0.1.0" +defaultTargets = ["SpecificationProofs"] + +[[require]] +name = "mathlib" +git = "https://github.com/leanprover-community/mathlib4.git" +rev = "d13f23b723b8a846827a245b89c10fc7d3f11612" + +[[require]] +name = "universal_law_specifications" +path = "../lean_statements_20261010" + +[[lean_lib]] +name = "SpecificationProofs" +leanOptions = { autoImplicit = false } diff --git a/specifications/lean_statement_proofs_20261011/lean-toolchain b/specifications/lean_statement_proofs_20261011/lean-toolchain new file mode 100644 index 000000000..ba8ebf2db --- /dev/null +++ b/specifications/lean_statement_proofs_20261011/lean-toolchain @@ -0,0 +1 @@ +leanprover/lean4:v4.34.1 diff --git a/specifications/lean_statement_proofs_20261011/replay.sh b/specifications/lean_statement_proofs_20261011/replay.sh new file mode 100755 index 000000000..490100da4 --- /dev/null +++ b/specifications/lean_statement_proofs_20261011/replay.sh @@ -0,0 +1,20 @@ +#!/usr/bin/env bash +# Local replay of the proof-packet check. Scientific effect: NONE. +# Order: source check (fails closed before any Lean), unit tests in both Python modes, then the +# Lean execution (exact Lean version, fresh lake build, leanchecker, #check / #print axioms of +# every inventoried theorem, the environment audit of every constant the modules add, the +# negative controls, receipt under .lake/evidence/). +# Extra arguments are passed to check.py (local development: --allow-dirty; a receipt produced +# that way records the worktree as unverified and is not evidence about any commit). +set -euo pipefail +ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)" +P="$ROOT/specifications/lean_statement_proofs_20261011" +cd "$ROOT" +export PATH="$HOME/.elan/bin:$PATH" +export PYTHONDONTWRITEBYTECODE=1 +mkdir -p "$P/.lake" +python3 -B -S "$P/check.py" "$@" +python3 -B -S "$P/test_check.py" 2>&1 | tee "$P/.lake/tests.log" +python3 -B -O -S "$P/test_check.py" 2>&1 | tee "$P/.lake/tests-optimized.log" +python3 -B -S "$P/check.py" --execute "$@" +echo 'PASS: inventoried theorems kernel-checked against their registered Props; formal progress of the theorems kernel-checked (receipt only); the register and every claim label unchanged; alignment PENDING_INDEPENDENT_REVIEW; scientific effect NONE.' diff --git a/specifications/lean_statement_proofs_20261011/test_check.py b/specifications/lean_statement_proofs_20261011/test_check.py new file mode 100644 index 000000000..5d5c9d485 --- /dev/null +++ b/specifications/lean_statement_proofs_20261011/test_check.py @@ -0,0 +1,1331 @@ +#!/usr/bin/env python3 +"""Positive and negative controls for the proof-packet checker (standard library only). + +Synthetic controls build a disposable repository holding a miniature statement packet (two +modules, a register) and a miniature proof packet, so that every refusal is exercised in +isolation. Real-tree controls read the committed packets' pins and scan the modules present. +Lean is required only by the `LeanHelpers` class, guarded by `skipUnless(lake)`; it builds two +dependency-free fixture packages (a statement package and a proof package depending on it by +path), never Mathlib. No test here is evidence about any mathematical claim; scientific effect +NONE. +""" +import contextlib +import importlib.util +import io +import json +import os +from pathlib import Path +import re +import shutil +import subprocess +import sys +import tempfile +import unittest +from unittest import mock + +HERE = Path(__file__).resolve().parent +spec = importlib.util.spec_from_file_location('lean_proof_check', HERE / 'check.py') +check = importlib.util.module_from_spec(spec) +spec.loader.exec_module(check) + +LOCK = {'version': '1.2.0', 'packagesDir': '.lake/packages', 'packages': [ + {'name': 'batteries', 'url': 'https://github.com/leanprover-community/batteries', 'type': 'git', 'subDir': None, + 'scope': 'leanprover-community', 'rev': 'f2effa3d803fda822b1f97b806c47cf2adfbcbc2', 'manifestFile': 'lake-manifest.json', + 'inputRev': 'main', 'inherited': True, 'configFile': 'lakefile.toml'}, + {'name': 'mathlib', 'url': 'https://github.com/leanprover-community/mathlib4.git', 'type': 'git', 'subDir': None, + 'scope': '', 'rev': check.MATHLIB_REV, 'manifestFile': 'lake-manifest.json', 'inputRev': check.MATHLIB_REV, + 'inherited': False, 'configFile': 'lakefile.lean'}], + 'name': check.STATEMENT_LOCK_NAME, 'lakeDir': '.lake', 'fixedToolchain': True} +STATEMENT_LAKEFILE = ('name = "' + check.STATEMENT_LOCK_NAME + '"\nversion = "0.1.0"\ndefaultTargets = ["Specifications"]\n\n[[require]]\n' + 'name = "mathlib"\ngit = "https://github.com/leanprover-community/mathlib4.git"\nrev = "' + check.MATHLIB_REV + + '"\n\n[[lean_lib]]\nname = "Specifications"\n' + check.LEAN_OPTIONS_LINE + '\n') +PROOF_LAKEFILE = check.LAKEFILE # pinned byte-exactly by check_lock +DOC = 'Scientific effect: NONE. Alignment: PENDING_INDEPENDENT_REVIEW.\n' + +STATEMENT_DEMO = '''import Mathlib + +namespace UniversalLaw.Spec.Demo + +/-- A. -/ +def A : Prop := (2 : ℕ) + 2 = 4 + +/-- B. -/ +def B (n : ℕ) : Prop := n + 0 = n + +/-- C. -/ +def C {X : Type} [Fintype X] (s : Finset X) : Prop := s ⊆ s + +/-- An interface. -/ +structure Iface (d : ℕ) where + x : ℕ + +end UniversalLaw.Spec.Demo +''' +STATEMENT_OTHER = '''import Mathlib + +namespace UniversalLaw.Spec.Other + +/-- D. -/ +def D : Prop := True + +/-- A, again (ambiguity control). -/ +def A : Prop := True + +end UniversalLaw.Spec.Other +''' +PROOF_DEMO = '''import Specifications.Demo +import Specifications.Other + +/-! Demo proof module. A module docstring may mention sorry, axiom and native_decide. -/ + +namespace UniversalLaw.Proofs.Demo + +open UniversalLaw.Spec.Demo + +namespace Aux + +/-- A helper (not inventory). -/ +theorem helper : True := trivial + +end Aux + +private theorem hiddenHelper : True := trivial + +/-- An auxiliary definition. -/ +def twice (n : ℕ) : ℕ := 2 * n + +/-- Proves: `UniversalLaw.Spec.Demo.A` (register row `demo-claim`). +Method: norm_num. +Does not establish: the informal claim, its review or acceptance. -/ +theorem a : UniversalLaw.Spec.Demo.A := by + norm_num [UniversalLaw.Spec.Demo.A] + +/-- Proves: `B` (register row `demo-claim`). +Method: rfl. +Does not establish: anything beyond the Prop. -/ +@[simp] +theorem b (n : ℕ) : B n := rfl + +section Params + +variable {X : Type} [Fintype X] + +/-- Proves: `UniversalLaw.Spec.Demo.C` (register row `demo-node`). +Method: subset_rfl. +Does not establish: anything beyond the Prop. -/ +theorem c (s : Finset X) : + UniversalLaw.Spec.Demo.C s := + Finset.Subset.refl s + +end Params + +open UniversalLaw.Spec.Other in +/-- Proves: `D` (register row `demo-node`). +Method: trivial. +Does not establish: anything beyond the Prop. -/ +theorem d : D := trivial + +end UniversalLaw.Proofs.Demo +''' + + +def statement(module, declaration, kind='def_prop', package=check.STATEMENT_PACKAGE, progress='specified'): + return {'package': package, 'module': module, 'declaration': declaration, 'kind': kind, 'formal_progress': progress, + 'anchor': 'two and two make four', 'does_not_claim': 'the source theorem; review; acceptance'} + + +def register(): + return { + 'schema_version': 1, 'object': check.REGISTER_OBJECT, 'scientific_effect': 'NONE', 'scientific_status_authority': False, + 'alignment_status': 'PENDING_INDEPENDENT_REVIEW', 'meaning': 'inventory of formal statements; labels only', + 'toolchain': {'lean': check.TOOLCHAIN, 'lean_commit': check.LEAN_COMMIT, 'mathlib': check.MATHLIB_REV}, + 'vocabulary': {'formal_progress': ['none', 'specified', 'proved', 'kernel-checked']}, 'sources': [], + 'claims': [ + {'claim_id': 'demo-claim', 'kind': 'landing_claim', 'title': 'Demo claim', 'layer0': {'source_id': None, 'heading': None}, + 'disposition_transcribed': None, 'formal_progress': 'specified', + 'statements': [statement('Specifications/Demo.lean', 'UniversalLaw.Spec.Demo.A'), + statement('Specifications/Demo.lean', 'UniversalLaw.Spec.Demo.B'), + statement('Specifications/Demo.lean', 'UniversalLaw.Spec.Demo.Iface', 'structure'), + statement('UniversalLaw/Demo.lean', 'UniversalLaw.Demo.two_add', 'theorem', 'formal', 'proved')], + 'kernel_evidence': [], 'not_established': 'the claim itself', 'next_step': 'independent alignment review'}, + {'claim_id': 'demo-node', 'kind': 'graph_node', 'title': 'Demo node', 'layer0': {'source_id': None, 'heading': None}, + 'disposition_transcribed': None, 'formal_progress': 'specified', + 'statements': [statement('Specifications/Demo.lean', 'UniversalLaw.Spec.Demo.A'), + statement('Specifications/Demo.lean', 'UniversalLaw.Spec.Demo.C'), + statement('Specifications/Other.lean', 'UniversalLaw.Spec.Other.D'), + statement('Specifications/Other.lean', 'UniversalLaw.Spec.Other.A')], + 'kernel_evidence': [], 'not_established': 'everything beyond the statement', 'next_step': 'none planned'}]} + + +class Fixture: + """A disposable repository with a miniature statement packet and a miniature proof packet + that passes the source check.""" + + def __init__(self): + self.tmp = tempfile.mkdtemp() + self.repo = Path(self.tmp) / 'repo' + self.packet = self.repo / check.PACKAGE + self.statements = self.repo / check.STATEMENT_PACKAGE + (self.packet / 'SpecificationProofs').mkdir(parents=True) + (self.statements / 'Specifications').mkdir(parents=True) + self.write(check.WORKFLOW, 'name: placeholder\n', repo=True) + # statement packet + self.write('lakefile.toml', STATEMENT_LAKEFILE, stmt=True) + self.write('lean-toolchain', check.TOOLCHAIN + '\n', stmt=True) + self.write('lake-manifest.json', json.dumps(LOCK, indent=2) + '\n', stmt=True) + self.write('Specifications.lean', 'import Specifications.Demo\nimport Specifications.Other\n', stmt=True) + self.write('Specifications/Demo.lean', STATEMENT_DEMO, stmt=True) + self.write('Specifications/Other.lean', STATEMENT_OTHER, stmt=True) + self.write('REGISTER.json', json.dumps(register(), indent=2, ensure_ascii=False) + '\n', stmt=True) + # proof packet + self.write('.gitignore', '.lake/\n__pycache__/\n') + for name in ('check.py', 'test_check.py', 'replay.sh'): + self.write(name, '# bound copy\n') + self.write('README.md', '# Demo\n\n' + DOC) + self.write('SCOPE.md', '# Scope\n\n' + DOC) + self.write('lakefile.toml', PROOF_LAKEFILE) + self.write('lean-toolchain', check.TOOLCHAIN + '\n') + lock = dict(LOCK, name=check.LOCK_NAME, packages=LOCK['packages'] + [dict(check.PATH_DEPENDENCY)]) + self.write('lake-manifest.json', json.dumps(lock, indent=2) + '\n') + self.write('SpecificationProofs.lean', 'import SpecificationProofs.Demo\n') + self.write('SpecificationProofs/Demo.lean', PROOF_DEMO) + + def path(self, rel, repo=False, stmt=False): + return (self.repo if repo else self.statements if stmt else self.packet) / rel + + def write(self, rel, text, repo=False, stmt=False): + p = self.path(rel, repo, stmt) + p.parent.mkdir(parents=True, exist_ok=True) + p.write_text(text, encoding='utf-8') + + def read(self, rel, repo=False, stmt=False): + return self.path(rel, repo, stmt).read_text(encoding='utf-8') + + def mutate(self, rel, old, new, repo=False, stmt=False, count=1): + text = self.read(rel, repo, stmt) + if old not in text: + raise AssertionError(f'{old!r} not in {rel}') + self.write(rel, text.replace(old, new, count), repo, stmt) + + def inject(self, line, rel='SpecificationProofs/Demo.lean'): + """Insert column-0 text before the closing `end` of the proof module.""" + text = self.read(rel) + head, _, tail = text.rpartition('\nend ') + self.write(rel, head + '\n' + line + '\n\nend ' + tail) + + def register(self): + return json.loads(self.read('REGISTER.json', stmt=True)) + + def save_register(self, reg): + self.write('REGISTER.json', json.dumps(reg, indent=2, ensure_ascii=False) + '\n', stmt=True) + + def run(self, allow_dirty=True): + return check.source_check(self.packet, self.repo, allow_dirty) + + def cleanup(self): + shutil.rmtree(self.tmp, ignore_errors=True) + + +DOCSTRING = '/-- Proves: `{prop}`.\nMethod: control.\nDoes not establish: anything. -/\n' + + +def thm(name, prop='UniversalLaw.Spec.Demo.A', binders='', type_text=None, body='by norm_num [UniversalLaw.Spec.Demo.A]', doc=True): + head = DOCSTRING.format(prop=prop) if doc else '' + return f'{head}theorem {name}{(" " + binders) if binders else ""} : {type_text or prop} := {body}' + + +class Base(unittest.TestCase): + def setUp(self): + # Fixture packets are synthetic: their worktree is not a CI checkout, so the CI-only + # requirements that check.py applies when GITHUB_ACTIONS is set (GITHUB_SHA == HEAD, + # repository name) must not apply to them. Identity.test_clean_and_dirty_worktrees re-enables + # CI mode explicitly inside its own patch to test exactly those refusals. + patcher = mock.patch.dict(os.environ) + patcher.start() + self.addCleanup(patcher.stop) + for key in ('GITHUB_ACTIONS', 'GITHUB_SHA', 'GITHUB_REPOSITORY', 'GITHUB_RUN_ID', 'GITHUB_RUN_ATTEMPT'): + os.environ.pop(key, None) + self.f = Fixture() + self.addCleanup(self.f.cleanup) + + def assertRefused(self, fragment, allow_dirty=True): + with self.assertRaises(ValueError) as ctx: + self.f.run(allow_dirty) + self.assertIn(fragment, str(ctx.exception)) + return str(ctx.exception) + + +class Positive(Base): + def test_fixture_passes(self): + info = self.f.run() + self.assertEqual(info['formalization_status'], 'proved') + self.assertEqual(info['alignment_status'], 'PENDING_INDEPENDENT_REVIEW') + self.assertEqual((info['checked_commit'], info['worktree']), (None, 'UNVERIFIED')) + self.assertEqual(info['theorem_count'], 4) + self.assertEqual(info['covered_props'], ['UniversalLaw.Spec.Demo.A', 'UniversalLaw.Spec.Demo.B', 'UniversalLaw.Spec.Demo.C', + 'UniversalLaw.Spec.Other.D']) + self.assertEqual(info['duplicate_proofs'], []) + self.assertEqual((info['aux_theorems'], info['auxiliary_definitions'], info['registered_props']), (2, 1, 5)) + self.assertEqual(info['modules'], ['SpecificationProofs/Demo.lean']) + self.assertEqual(info['dependency_revisions']['mathlib'], check.MATHLIB_REV) + by_name = {t['name'].rsplit('.', 1)[1]: t for t in info['theorems']} + self.assertEqual(by_name['a']['claim_ids'], ['demo-claim', 'demo-node']) + self.assertEqual(by_name['c']['claim_ids'], ['demo-node']) + self.assertEqual((by_name['c']['binder_count'], by_name['c']['explicit_parameters']), (1, 1)) + self.assertEqual(by_name['b']['proves'], 'UniversalLaw.Spec.Demo.B') + self.assertEqual(by_name['d']['proves'], 'UniversalLaw.Spec.Other.D') + self.assertEqual(by_name['a']['doc']['method'], 'norm_num.') + self.assertIn('Specifications/Demo.lean', info['statement_module_sha256']) + self.assertEqual(len(info['register_sha256']), 64) + + def test_cli(self): + cmd = [sys.executable, '-B', '-S', str(HERE / 'check.py'), '--root', str(self.f.packet), '--repo', str(self.f.repo), '--allow-dirty'] + proc = subprocess.run(cmd, capture_output=True, text=True) + self.assertEqual(proc.returncode, 0, proc.stderr) + self.assertIn('SOURCE_CHECK_PASS', proc.stdout) + self.assertIn('"formalization_status": "proved"', proc.stdout) + self.assertIn('WORKTREE_UNVERIFIED', proc.stderr) + proc = subprocess.run(cmd + ['source'], capture_output=True, text=True) + self.assertEqual(proc.returncode, 0, proc.stderr) + proc = subprocess.run(cmd + ['execute'], capture_output=True, text=True) + self.assertEqual(proc.returncode, 2, 'only `source` is a positional mode') + self.f.inject(thm('s', body='sorry')) + proc = subprocess.run(cmd, capture_output=True, text=True) + self.assertEqual(proc.returncode, 1) + self.assertIn('LEAN_PROOF_CHECK_FAIL', proc.stderr) + self.assertIn('refused token', proc.stderr) + self.assertNotIn('SOURCE_CHECK_PASS', proc.stdout) + + def test_sibling_proof_module_import_is_accepted(self): + self.f.write('SpecificationProofs/Second.lean', 'import Specifications.Demo\n\nnamespace UniversalLaw.Proofs.Second\n\n' + 'namespace Aux\ntheorem helper : True := trivial\nend Aux\n\nend UniversalLaw.Proofs.Second\n') + self.f.write('SpecificationProofs.lean', 'import SpecificationProofs.Second\nimport SpecificationProofs.Demo\n') + self.f.mutate('SpecificationProofs/Demo.lean', 'import Specifications.Demo\n', 'import Specifications.Demo\nimport SpecificationProofs.Second\n') + info = self.f.run() + self.assertEqual(info['modules'], ['SpecificationProofs/Second.lean', 'SpecificationProofs/Demo.lean']) + self.assertEqual(info['theorem_count'], 4) + + def test_duplicate_proofs_are_reported_not_refused(self): + self.f.write('SpecificationProofs/Second.lean', 'import Specifications.Demo\n\nnamespace UniversalLaw.Proofs.Second\n\n' + + thm('aAgain') + '\n\nend UniversalLaw.Proofs.Second\n') + self.f.write('SpecificationProofs.lean', 'import SpecificationProofs.Second\nimport SpecificationProofs.Demo\n') + info = self.f.run() + self.assertEqual(info['modules'], ['SpecificationProofs/Second.lean', 'SpecificationProofs/Demo.lean']) + self.assertEqual(info['theorem_count'], 5) + self.assertEqual(info['duplicate_proofs'], ['UniversalLaw.Spec.Demo.A']) + + def test_comments_may_mention_refused_words(self): + self.f.inject('-- theorem sorry axiom native_decide set_option maxHeartbeats 999999999 unsafe opaque') + self.f.mutate('SpecificationProofs/Demo.lean', 'Method: rfl.', 'Method: rfl (the source says theorem; no sorry anywhere).') + self.f.run() + + def test_relative_and_opened_resolution(self): + self.f.inject(thm('aRel', type_text='Spec.Demo.A')) + self.f.inject(thm('aShort', type_text='A', prop='UniversalLaw.Spec.Demo.A')) + info = self.f.run() + self.assertEqual(info['theorem_count'], 6) + self.assertEqual(info['duplicate_proofs'], ['UniversalLaw.Spec.Demo.A']) + + def test_ambiguous_short_name_is_refused(self): + self.f.mutate('SpecificationProofs/Demo.lean', 'open UniversalLaw.Spec.Demo\n', 'open UniversalLaw.Spec.Demo UniversalLaw.Spec.Other\n') + self.f.inject(thm('aShort', type_text='A')) + self.assertRefused('resolves to several registered Props') + + def test_aux_and_private_theorems_may_have_any_type(self): + self.f.inject('theorem Aux.dotted (n : ℕ) : n = n := rfl\nprivate theorem priv2 : 1 = 1 := rfl\n' + 'namespace Aux\nnamespace Inner\ntheorem deep : True := trivial\nend Inner\nend Aux\nprotected theorem Aux.prot : True := trivial') + info = self.f.run() + self.assertEqual(info['aux_theorems'], 6) + self.assertEqual(info['theorem_count'], 4) + + def test_protected_theorem_is_inventory(self): + self.f.inject(DOCSTRING.format(prop='UniversalLaw.Spec.Demo.A') + 'protected theorem prot : UniversalLaw.Spec.Demo.A := by norm_num [UniversalLaw.Spec.Demo.A]') + self.assertEqual(self.f.run()['theorem_count'], 5) + self.f.inject('protected theorem protBad : True := trivial') + self.assertRefused('not a registered') + + def test_continuation_lines_and_attributes(self): + self.f.inject('def f : ℕ → ℕ\n| 0 => 0\n| n + 1 => f n\ntermination_by n => n\n\n@[simp, norm_cast]\n' + thm('attr')) + info = self.f.run() + self.assertEqual((info['theorem_count'], info['auxiliary_definitions']), (5, 2)) + + def test_set_option_justified(self): + for text in ('set_option maxHeartbeats 800000 in -- heavy norm_num\n' + thm('h1'), + '-- heavy norm_num\nset_option maxHeartbeats 800000 in\n' + thm('h2'), + '/- heavy\nnorm_num -/\nset_option maxHeartbeats 800000 in\n' + thm('h3'), + 'set_option maxHeartbeats 400000 in\n' + thm('h4'), + 'set_option linter.unusedVariables false in\n' + thm('h5')): + with self.subTest(text=text[:40]): + f = Fixture() + self.addCleanup(f.cleanup) + f.inject(text) + info = f.run() + self.assertEqual(info['theorem_count'], 5) + self.assertEqual(len(info['set_options']['SpecificationProofs/Demo.lean']), 1) + + +class Identity(Base): + def test_requires_git_without_allow_dirty(self): + self.assertRefused('not a git repository', allow_dirty=False) + + @unittest.skipUnless(shutil.which('git'), 'git not available') + def test_clean_and_dirty_worktrees(self): + def g(*args): + return subprocess.run(['git', '-C', str(self.f.repo), '-c', 'user.name=t', '-c', 'user.email=t@t', '-c', 'commit.gpgsign=false', + *args], capture_output=True, text=True, check=True).stdout + g('init', '-q') + g('add', '-A') + g('commit', '-q', '-m', 'fixture') + info = self.f.run(allow_dirty=False) + self.assertEqual(info['worktree'], 'CLEAN') + self.assertRegex(info['checked_commit'], '^[0-9a-f]{40}$') + self.f.mutate('SpecificationProofs/Demo.lean', 'Method: rfl.', 'Method: rfl!') + self.assertRefused('uncommitted or untracked', allow_dirty=False) + g('checkout', '--', '.') + self.f.mutate('Specifications/Demo.lean', '/-- A. -/', '/-- A! -/', stmt=True) + self.assertRefused('uncommitted or untracked', allow_dirty=False) + g('checkout', '--', '.') + self.f.write('SpecificationProofs/Extra.lean', 'untracked\n') + self.assertRefused('uncommitted or untracked', allow_dirty=False) + self.f.path('SpecificationProofs/Extra.lean').unlink() + self.f.run(allow_dirty=False) + os.environ['GITHUB_ACTIONS'] = 'true' + os.environ['GITHUB_SHA'] = '0' * 40 + os.environ['GITHUB_REPOSITORY'] = check.REPOSITORY + self.assertRefused('GITHUB_SHA', allow_dirty=False) + os.environ['GITHUB_SHA'] = info['checked_commit'] + os.environ['GITHUB_REPOSITORY'] = 'someone/fork' + self.assertRefused('GITHUB_REPOSITORY', allow_dirty=False) + os.environ['GITHUB_REPOSITORY'] = check.REPOSITORY + self.f.run(allow_dirty=False) + + +class Lexical(Base): + def test_refused_tokens(self): + cases = {'sorry': thm('t', body='sorry'), 'admit': thm('t', body='by admit'), 'axiom': 'axiom hidden : False', + 'native_decide': thm('t', body='by native_decide'), 'ofReduceBool': thm('t', body='Lean.ofReduceBool _ _ rfl'), + 'unsafe': 'unsafe def u : ℕ := 0', 'opaque': 'opaque o : ℕ', 'partial': 'partial def p (n : ℕ) : ℕ := p n', + 'implemented_by': '@[implemented_by twice] def i (n : ℕ) : ℕ := n', 'extern': '@[extern "x"] def e : ℕ := 0', + 'skipKernelTC': 'set_option debug.skipKernelTC true in\n' + thm('t'), 'byAsSorry': 'set_option debug.byAsSorry true in\n' + thm('t'), + 'macro': 'macro "tt" : term => `(True)', 'notation': 'notation "⊤⊤" => True', 'syntax': 'syntax "tt" : term', + 'elab': 'elab "tt" : term => pure (mkConst ``True)', 'run_cmd': 'run_cmd pure ()', 'initialize': 'initialize x : ℕ ← pure 0', + 'export': 'export Nat (succ)', 'alias': 'alias succ := Nat.succ', 'irreducible_def': 'irreducible_def x : ℕ := 0', + 'include': 'variable (h : False)\ninclude h\n' + thm('t', body='h.elim'), '_root_': 'theorem _root_.Escaped : True := trivial', + 'trustCompiler': thm('t', body='Lean.trustCompiler'), 'sorryAx': thm('t', body='sorryAx _ false'), + 'native': thm('t', body='by decide +native'), 'native (config)': thm('t', body='by decide (config := { native := true })')} + for token, line in cases.items(): + with self.subTest(token=token): + f = Fixture() + self.addCleanup(f.cleanup) + f.inject(line) + with self.assertRaises(ValueError) as ctx: + f.run() + self.assertIn('refused token', str(ctx.exception)) + self.assertIn(token.split()[0], str(ctx.exception)) + + def test_refused_token_detection_unit(self): + self.assertEqual(check.refused_tokens('theorem t : False := by sorry\n'), ['sorry']) + self.assertEqual(check.refused_tokens('exact sorryAx _ false\n'), ['sorryAx']) + self.assertEqual(check.refused_tokens('by decide +native\n'), ['native']) + self.assertEqual(check.refused_tokens('by decide +kernel\n'), []) + self.assertEqual(check.refused_tokens('def partialSups : ℕ := 0\n'), []) + self.assertEqual(check.refused_tokens('def x := Foo.sorry\n'), ['sorry']) + self.assertEqual(check.refused_tokens('exact Classical.axiomOfChoice\n'), []) + + def test_hash_commands(self): + for line in ('#check Nat', '#eval 1', '#exit', ' #print axioms Nat'): + with self.subTest(line=line): + f = Fixture() + self.addCleanup(f.cleanup) + f.inject(line) + with self.assertRaises(ValueError) as ctx: + f.run() + self.assertIn('`#` commands', str(ctx.exception)) + self.f.inject('def arr : Array ℕ := #[1, 2]') + self.f.run() + + def test_keywords_off_column_0(self): + for line in (' theorem hidden : True := trivial', 'open Classical in theorem hidden : True := trivial', + 'set_option maxHeartbeats 1000 in theorem hidden : True := trivial', thm('two') + ' theorem hidden : True := trivial', + ' def hidden : ℕ := 0', ' namespace Hidden\n end Hidden', ' private theorem hidden : True := trivial', + ' section\n end', ' example : True := trivial', ' variable (h : False)', ' abbrev x : ℕ := 0', + ' instance : Inhabited ℕ := ⟨0⟩', ' structure S where\n n : ℕ', ' inductive I | a'): + with self.subTest(line=line): + f = Fixture() + self.addCleanup(f.cleanup) + f.inject(line) + with self.assertRaises(ValueError) as ctx: + f.run() + self.assertIn('off column 0', str(ctx.exception)) + + def test_tactic_block_open_and_set_option_are_fine(self): + self.f.inject(thm('t', body='by\n open Classical in\n set_option maxHeartbeats 1000 in\n norm_num [UniversalLaw.Spec.Demo.A]')) + self.assertEqual(self.f.run()['theorem_count'], 5) + + def test_instance_attribute_in_brackets_is_fine(self): + self.f.inject('attribute [local instance] Classical.propDecidable') + self.f.run() + + def test_column0_commands_not_allowed(self): + for line, fragment in (('mutual\nend', 'column-0 command'), ('local notation "x" => True', 'refused token'), + ('scoped instance : Inhabited ℕ := ⟨0⟩', 'off column 0'), ('class K where\n n : ℕ', 'column-0 command'), + ('| 0 => 0', None), ('universe u', None)): + with self.subTest(line=line): + f = Fixture() + self.addCleanup(f.cleanup) + f.inject(line) + if fragment is None: + f.run() + else: + with self.assertRaises(ValueError) as ctx: + f.run() + self.assertIn(fragment, str(ctx.exception)) + + def test_set_option_refusals(self): + for line, fragment in (('set_option maxHeartbeats 800000 in\n' + thm('h'), 'justifying comment'), + ('set_option maxHeartbeats 400001 in\n' + thm('h'), 'justifying comment'), + ('set_option maxHeartbeats 0 in\n' + thm('h'), 'justifying comment'), + ('set_option maxHeartbeats 800000\n' + thm('h'), 'justifying comment'), + (thm('h', body='by\n set_option maxHeartbeats 800000 in\n norm_num [UniversalLaw.Spec.Demo.A]'), 'justifying comment'), + ('set_option autoImplicit true in\n' + thm('h'), 'refused option'), + ('set_option relaxedAutoImplicit true in\n' + thm('h'), 'refused option'), + ('set_option debug.terminalTacticsAsSorry true in\n' + thm('h'), 'refused option'), + ('set_option bootstrap.genMatcherCode false in\n' + thm('h'), 'refused option'), + ('set_option compiler.extract_closed false in\n' + thm('h'), 'refused option'), + ('set_option maxHeartbeats n in\n' + thm('h'), 'literal number')): + with self.subTest(line=line[:60]): + f = Fixture() + self.addCleanup(f.cleanup) + f.inject(line) + with self.assertRaises(ValueError) as ctx: + f.run() + self.assertIn(fragment, str(ctx.exception)) + + def test_open_in_must_end_its_line(self): + self.f.inject('open Classical in def x : ℕ := 0') + self.assertRefused('off column 0') + self.f = Fixture() + self.addCleanup(self.f.cleanup) + self.f.inject('set_option maxHeartbeats 1000 in def x : ℕ := 0') + self.assertRefused('off column 0') + + def test_variable_in_refused(self): + self.f.inject('variable (n : ℕ) in\n' + thm('v')) + self.assertRefused('`variable … in`') + + def test_string_literals_do_not_hide_tokens(self): + self.f.inject('def opener : String := "/-"\ntheorem smuggled : True := sorry\ndef closer : String := "-/"') + msg = self.assertRefused('refused token') + self.assertIn('sorry', msg) + + def test_unterminated_comment(self): + self.f.inject('/- never closed') + self.assertRefused('unterminated block comment') + + +class Shape(Base): + """Every way a non-aux theorem can fail the theorem-shape rule at source.""" + + def test_unregistered_and_structure_types(self): + for type_text in ('True', 'UniversalLaw.Spec.Demo.Iface 3', '(2 : ℕ) + 2 = 4', 'UniversalLaw.Spec.Demo.Ghost'): + with self.subTest(type_text=type_text): + f = Fixture() + self.addCleanup(f.cleanup) + f.inject(thm('t', type_text=type_text, body='trivial')) + with self.assertRaises(ValueError) as ctx: + f.run() + self.assertRegex(str(ctx.exception), 'not a registered|must be a registered Prop constant|bare parameter names') + + def test_quantifiers_implications_and_expressions(self): + for type_text, fragment in (('UniversalLaw.Spec.Demo.A → UniversalLaw.Spec.Demo.A', 'must be a registered Prop constant applied'), + ('∀ n : ℕ, UniversalLaw.Spec.Demo.B n', 'must be a registered Prop constant applied'), + ('UniversalLaw.Spec.Demo.B (n + 1)', 'bare parameter names'), + ('UniversalLaw.Spec.Demo.A ∧ UniversalLaw.Spec.Demo.A', 'must be a registered Prop constant applied'), + ('¬ UniversalLaw.Spec.Demo.A', 'must be a registered Prop constant applied'), + ('@UniversalLaw.Spec.Demo.B n', 'must be a registered Prop constant applied'), + ('(UniversalLaw.Spec.Demo.A)', 'bare parameter names')): + with self.subTest(type_text=type_text): + f = Fixture() + self.addCleanup(f.cleanup) + f.inject(thm('t', binders='(n : ℕ)', type_text=type_text, body='by trivial')) + with self.assertRaises(ValueError) as ctx: + f.run() + self.assertIn(fragment, str(ctx.exception)) + + def test_smuggled_explicit_hypothesis(self): + self.f.inject(thm('t', binders='(h : False)', body='h.elim')) + self.assertIn("'h'", self.assertRefused('not passed to')) + self.f = Fixture() + self.addCleanup(self.f.cleanup) + self.f.inject(thm('t', binders='(n : ℕ) (m : ℕ)', prop='UniversalLaw.Spec.Demo.B', type_text='UniversalLaw.Spec.Demo.B n', body='rfl')) + self.assertIn("'m'", self.assertRefused('not passed to')) + + def test_implicit_hypothesis_passes_source_and_is_left_to_lean(self): + """An implicit extra binder is invisible to the lexical rule (implicit binders may be + passed implicitly); the environment audit refuses it (LeanHelpers).""" + self.f.inject(thm('t', binders='{h : False}', body='h.elim')) + self.assertEqual(self.f.run()['theorem_count'], 5) + + def test_argument_not_a_parameter(self): + self.f.inject(thm('t', binders='(n : ℕ)', prop='UniversalLaw.Spec.Demo.B', type_text='UniversalLaw.Spec.Demo.B m', body='rfl')) + self.assertRefused('is not a parameter of the theorem') + self.f = Fixture() + self.addCleanup(self.f.cleanup) + self.f.inject(thm('t', binders='(n : ℕ)', prop='UniversalLaw.Spec.Demo.B', type_text='UniversalLaw.Spec.Demo.B n n', body='rfl')) + self.assertRefused('repeated argument') + + def test_section_variables_are_parameters(self): + self.f.inject('section S\nvariable (k : ℕ)\n' + thm('t', prop='UniversalLaw.Spec.Demo.B', type_text='UniversalLaw.Spec.Demo.B k', body='rfl') + '\nend S') + self.assertEqual(self.f.run()['theorem_count'], 5) + + def test_missing_type_and_docstring(self): + self.f.inject('/-- Proves: `A`.\nMethod: x.\nDoes not establish: y. -/\ntheorem t := trivial') + self.assertRefused('without an explicit result type') + for text, fragment in ((thm('t', doc=False), 'no docstring'), + ('/-- No labels. -/\n' + thm('t', doc=False), 'docstring must carry exactly one `Proves:`'), + ('/-- Proves: `A`.\nMethod: x. -/\n' + thm('t', doc=False), '`Does not establish:`'), + ('/-- Proves: `A`.\nProves: `A`.\nMethod: x.\nDoes not establish: y. -/\n' + thm('t', doc=False), 'exactly one `Proves:`'), + ('/-- Proves: `B`.\nMethod: x.\nDoes not establish: y. -/\n' + thm('t', doc=False), 'must name the registered Prop'), + ('/-- Proves: `AA`.\nMethod: x.\nDoes not establish: y. -/\n' + thm('t', doc=False), 'as a whole token'), + ('/-- Proves: `A.eq_1`.\nMethod: x.\nDoes not establish: y. -/\n' + thm('t', doc=False), 'as a whole token'), + ('/-- Proves: `xA`.\nMethod: x.\nDoes not establish: y. -/\n' + thm('t', doc=False), 'as a whole token'), + ("/-- Proves: `A'`.\nMethod: x.\nDoes not establish: y. -/\n" + thm('t', doc=False), 'as a whole token'), + ('/-- Proves: `Spec.Demo.A` (row x).\nMethod: x.\nDoes not establish: y. -/\n' + thm('t', doc=False), None), + ('/-- Proves: the Prop A of the register.\nMethod: x.\nDoes not establish: y. -/\n' + thm('t', doc=False), None), + ('/-- Proves:\nMethod: x.\nDoes not establish: y. -/\n' + thm('t', doc=False), 'empty `Proves:`'), + ('/-- Proves: `A`.\nMethod: x.\nDoes not establish: y. -/\n\n-- a comment between\n' + thm('t', doc=False), None), + ('/-- Proves: `A`.\nMethod: x.\nDoes not establish: y. -/\n@[simp]\n' + thm('t', doc=False), None)): + with self.subTest(text=text[:50]): + f = Fixture() + self.addCleanup(f.cleanup) + f.inject(text) + if fragment is None: + f.run() + else: + with self.assertRaises(ValueError) as ctx: + f.run() + self.assertIn(fragment, str(ctx.exception)) + + def test_underscore_name_component(self): + self.f.inject(thm('_hidden')) + self.assertRefused('may not start with `_`') + + def test_module_local_declaration_shadowing_a_registered_prop(self): + """Lean resolves a name of the current namespace before an opened one: with a module-local + `def A : Prop`, `theorem t : A` is about the local definition, so the source scan refuses + the collision (declared before or after the theorem, as def, abbrev, structure, private or + under an opened local namespace); an unrelated local name is fine.""" + for text in ('def A : Prop := True\n' + thm('tA', type_text='A'), + thm('tA', type_text='A') + '\ndef A : Prop := True', + 'abbrev A : Prop := True\n' + thm('tA', type_text='A'), + 'structure A where\n n : ℕ\n' + thm('tA', type_text='A'), + 'private def A : Prop := True\n' + thm('tA', type_text='A'), + 'noncomputable def A : Prop := True\n' + thm('tA', type_text='A'), + 'def Spec.Demo.A : Prop := True\n' + thm('tA', type_text='Spec.Demo.A'), + 'def UniversalLaw.Spec.Demo.A : Prop := True\n' + thm('tA'), + 'namespace Local\ndef A : Prop := True\nend Local\nopen Local in\n' + thm('tA', type_text='A'), + 'theorem Aux.A : True := trivial\nopen Aux in\n' + thm('tA', type_text='A')): + with self.subTest(text=text[:60]): + f = Fixture() + self.addCleanup(f.cleanup) + f.inject(text) + with self.assertRaises(ValueError) as ctx: + f.run() + self.assertIn('shadowed by the module-local declaration', str(ctx.exception)) + # the fixture's own `theorem a : UniversalLaw.Spec.Demo.A` is refused first when the local name shadows the qualified one + self.assertRegex(str(ctx.exception), r'theorem UniversalLaw\.Proofs\.Demo\.(tA|a): ') + self.f.inject('def a2 : Prop := True\ndef Spec.A : Prop := True\n' + thm('tA', type_text='A')) + self.assertEqual(self.f.run()['theorem_count'], 5) + + def test_bound_variable_head(self): + """A theorem whose result type is one of its own parameters or a section variable named + like a registered Prop is not about the registered Prop.""" + self.f.inject(thm('t', binders='(A : Prop) (hA : A)', type_text='A', body='hA')) + self.assertRefused('is a parameter or section variable of the theorem') + self.f = Fixture() + self.addCleanup(self.f.cleanup) + self.f.inject('section S\nvariable (A : Prop)\n' + thm('t', type_text='A', body='trivial') + '\nend S') + self.assertRefused('is a parameter or section variable of the theorem') + self.f = Fixture() + self.addCleanup(self.f.cleanup) + self.f.inject(thm('t', binders='{A : Prop}', type_text='A', body='trivial')) + self.assertRefused('is a parameter or section variable of the theorem') + + +class Structure(Base): + def test_declaration_outside_namespace(self): + self.f.mutate('SpecificationProofs/Demo.lean', 'namespace UniversalLaw.Proofs.Demo\n', 'theorem early : True := trivial\n\nnamespace UniversalLaw.Proofs.Demo\n') + self.assertRefused('declaration outside namespace') + + def test_wrong_or_foreign_namespace(self): + self.f.mutate('SpecificationProofs/Demo.lean', 'namespace UniversalLaw.Proofs.Demo\n', 'namespace UniversalLaw.Proofs.Other\n') + self.f.mutate('SpecificationProofs/Demo.lean', 'end UniversalLaw.Proofs.Demo\n', 'end UniversalLaw.Proofs.Other\n') + self.assertRefused('outside the module namespace') + self.f = Fixture() + self.addCleanup(self.f.cleanup) + self.f.write('SpecificationProofs/Demo.lean', self.f.read('SpecificationProofs/Demo.lean') + + '\nnamespace UniversalLaw.Spec.Demo\ntheorem leak : True := trivial\nend UniversalLaw.Spec.Demo\n') + self.assertRefused('outside the module namespace') + + def test_unbalanced_scoping(self): + self.f.inject('section S') + self.assertRefused('does not close') + self.f = Fixture() + self.addCleanup(self.f.cleanup) + self.f.mutate('SpecificationProofs/Demo.lean', '\nend UniversalLaw.Proofs.Demo\n', '\n') + self.assertRefused('unclosed') + self.f = Fixture() + self.addCleanup(self.f.cleanup) + self.f.inject('end Nope') + self.assertRefused('does not close') + self.f = Fixture() + self.addCleanup(self.f.cleanup) + self.f.inject('end') + self.assertRefused('does not close') + + def test_noncomputable_section(self): + self.f.inject('noncomputable section\nnoncomputable def r : ℝ := 1\nend') + self.assertEqual(self.f.run()['auxiliary_definitions'], 2) + + def test_imports(self): + for imports, fragment in (('import Mathlib\n', 'no statement module is imported'), + ('import Specifications.Demo\nimport SpecificationProofs.Other\n', 'not a proof module of this packet'), + ('import Specifications.Demo\nimport SpecificationProofs.Demo\n', 'nothing else'), + ('import Specifications.Demo\nimport SpecificationProofs.Other.Deep\n', 'nothing else'), + ('import Specifications.Demo\nimport Specifications.Other.Deep\n', 'nothing else'), + ('import Specifications.Demo\nimport Other.Demo\n', 'nothing else'), + ('import Specifications.Demo\nimport Specifications.Ghost\n', 'not a module of the statement packet'), + ('import Specifications.Demo\nimport Mathlib.Data.Real.Basic\n', None)): + with self.subTest(imports=imports): + f = Fixture() + self.addCleanup(f.cleanup) + f.mutate('SpecificationProofs/Demo.lean', 'import Specifications.Demo\nimport Specifications.Other\n', imports) + if fragment is None: + f.mutate('SpecificationProofs/Demo.lean', 'open UniversalLaw.Spec.Other in\n', '') + f.mutate('SpecificationProofs/Demo.lean', 'theorem d : D := trivial', 'theorem d : UniversalLaw.Spec.Demo.A := by norm_num [UniversalLaw.Spec.Demo.A]') + f.mutate('SpecificationProofs/Demo.lean', 'Proves: `D` (register row `demo-node`).', 'Proves: `A` (register row `demo-node`).') + f.run() + else: + with self.assertRaises(ValueError) as ctx: + f.run() + self.assertIn(fragment, str(ctx.exception)) + + +class Packet(Base): + def test_root_imports(self): + self.f.write('SpecificationProofs.lean', '') + self.assertRefused('root module must import exactly') + self.f.write('SpecificationProofs.lean', 'import SpecificationProofs.Demo\nimport SpecificationProofs.Ghost\n') + self.assertRefused('root module must import exactly') + self.f.write('SpecificationProofs.lean', 'import SpecificationProofs.Demo\nimport Mathlib\n') + self.assertRefused('root module lines must read') + self.f.write('SpecificationProofs.lean', 'import SpecificationProofs.Demo\nimport SpecificationProofs.Demo\n') + self.assertRefused('twice') + + def test_tree(self): + self.f.write('SpecificationProofs/notes.txt', 'x\n') + self.assertRefused('packet tree differs') + self.f.path('SpecificationProofs/notes.txt').unlink() + self.f.write('SpecificationProofs/lower.lean', 'x\n') + self.assertRefused('packet tree differs') + self.f.path('SpecificationProofs/lower.lean').unlink() + self.f.path('README.md').unlink() + self.assertRefused('packet tree differs') + self.f.write('README.md', '# Demo\n\n' + DOC) + self.f.write('.gitignore', '__pycache__/\n') + self.assertRefused('.gitignore must ignore') + self.f.write('.gitignore', '.lake/\n__pycache__/\n') + self.f.path('SpecificationProofs/Demo.lean').unlink() + self.assertRefused('no proof module') + + def test_lock_and_toolchain(self): + self.f.write('lean-toolchain', 'leanprover/lean4:v4.34.0\n') + self.assertRefused('lean-toolchain must read exactly') + self.f.write('lean-toolchain', check.TOOLCHAIN + '\n') + self.f.mutate('lakefile.toml', 'rev = "' + check.MATHLIB_REV + '"', 'rev = "' + '0' * 40 + '"') + self.assertIn('line 8', self.assertRefused('lakefile.toml must be byte-exactly')) + self.f.mutate('lakefile.toml', 'rev = "' + '0' * 40 + '"', 'rev = "' + check.MATHLIB_REV + '"') + self.f.mutate('lakefile.toml', check.LEAN_OPTIONS_LINE, 'leanOptions = { autoImplicit = true }') + self.assertRefused('lakefile.toml must be byte-exactly') + self.f.mutate('lakefile.toml', 'leanOptions = { autoImplicit = true }', check.LEAN_OPTIONS_LINE) + self.f.run() + self.f.mutate('lakefile.toml', '[[lean_lib]]', '[[require]]\nname = "extra"\ngit = "https://x"\nrev = "' + '1' * 40 + '"\n\n[[lean_lib]]') + self.assertRefused('lakefile.toml must be byte-exactly') + self.f = Fixture() + self.addCleanup(self.f.cleanup) + lock = json.loads(self.f.read('lake-manifest.json')) + lock['packages'][1]['rev'] = '0' * 40 + self.f.write('lake-manifest.json', json.dumps(lock) + '\n') + self.assertRefused('git dependencies differ from the statement packet lock') + lock = json.loads(self.f.read('lake-manifest.json')) + lock['packages'][1]['rev'] = check.MATHLIB_REV + lock['packages'][2]['dir'] = '../elsewhere' + self.f.write('lake-manifest.json', json.dumps(lock) + '\n') + self.assertRefused('path dependency') + lock['packages'][2]['dir'] = check.STATEMENT_DIR + lock['name'] = 'other' + self.f.write('lake-manifest.json', json.dumps(lock) + '\n') + self.assertRefused('lake-manifest.json name must be') + lock['name'] = check.LOCK_NAME + lock['version'] = '1.2.1' + self.f.write('lake-manifest.json', json.dumps(lock) + '\n') + self.assertRefused('beyond name and packages') + + def test_lakefile_extra_lines_refused(self): + """Lake accepts options that weaken checking (`moreLeanArgs = ["-Ddebug.skipKernelTC=true"]` + at library or package level) and extra targets; a byte-exact pin refuses every extra line.""" + for old, new in (('leanOptions = { autoImplicit = false }\n', 'leanOptions = { autoImplicit = false }\nmoreLeanArgs = ["-Ddebug.skipKernelTC=true"]\n'), + ('version = "0.1.0"\n', 'version = "0.1.0"\nmoreLeanArgs = ["-Ddebug.skipKernelTC=true"]\n'), + ('version = "0.1.0"\n', 'version = "0.1.0"\nmoreServerArgs = ["-Ddebug.byAsSorry=true"]\n'), + ('leanOptions = { autoImplicit = false }\n', 'leanOptions = { autoImplicit = false }\n\n[[lean_exe]]\nname = "x"\nroot = "X"\n'), + ('leanOptions = { autoImplicit = false }\n', 'leanOptions = { autoImplicit = false, debug.skipKernelTC = true }\n'), + ('defaultTargets = ["SpecificationProofs"]\n', 'defaultTargets = ["SpecificationProofs"]\nleanOptions = { debug.skipKernelTC = true }\n'), + ('name = "mathlib"\n', 'name = "mathlib"\nsubDir = "x"\n'), + ('leanOptions = { autoImplicit = false }\n', 'leanOptions = { autoImplicit = false }\n\n'), + ('\n[[lean_lib]]', '\n# a comment\n[[lean_lib]]')): + with self.subTest(new=new): + f = Fixture() + self.addCleanup(f.cleanup) + f.mutate('lakefile.toml', old, new) + with self.assertRaises(ValueError) as ctx: + f.run() + self.assertIn('lakefile.toml must be byte-exactly', str(ctx.exception)) + self.assertEqual(check.LAKEFILE.count('[[require]]'), 2) + self.assertEqual(check.LAKEFILE.count('[[lean_lib]]'), 1) + self.assertNotIn('moreLeanArgs', check.LAKEFILE) + self.assertIn('rev = "' + check.MATHLIB_REV + '"\n', check.LAKEFILE) + self.assertIn('path = "' + check.STATEMENT_DIR + '"\n', check.LAKEFILE) + + def test_register(self): + reg = register() + reg['object'] = 'OTHER' + self.f.save_register(reg) + self.assertRefused('object must be') + reg = register() + reg['claims'][0]['statements'][0]['formal_progress'] = 'proved' + self.f.save_register(reg) + self.assertRefused('never relabels the register') + reg = register() + reg['toolchain']['mathlib'] = '0' * 40 + self.f.save_register(reg) + self.assertRefused('toolchain pins differ') + reg = register() + for row in reg['claims']: + row['statements'] = [st for st in row['statements'] if st['kind'] != 'def_prop'] + self.f.save_register(reg) + self.assertRefused('names no `def') + reg = register() + reg['claims'][1]['statements'][0]['module'] = 'Specifications/Other.lean' + self.f.save_register(reg) + self.assertRefused('registered in two modules') + reg = register() + reg['alignment_status'] = 'ALIGNED' + self.f.save_register(reg) + self.assertRefused('scope fields') + reg = register() + reg['claims'][1]['statements'][2]['module'] = 'Specifications/Ghost.lean' + self.f.save_register(reg) + self.assertRefused('missing or escaping file') + + def test_statement_packet_must_be_the_path_dependency(self): + shutil.rmtree(self.f.statements) + self.assertRefused('must be the statement packet') + + def test_docs(self): + self.f.write('README.md', '# Demo\n\n<>\n' + DOC) + self.assertRefused('placeholder') + self.f.write('README.md', '# Demo\n\nScientific effect: NONE.\n') + self.assertIn("missing 'PENDING_INDEPENDENT_REVIEW'", self.assertRefused('must state the scientific effect')) + self.f.write('README.md', '# Demo\n\nEffect: NONE. Alignment: PENDING_INDEPENDENT_REVIEW.\n') + self.assertIn("missing 'Scientific effect'", self.assertRefused('must state the scientific effect')) + self.f.write('README.md', '# Demo\n\nScientific effect: none. Alignment: PENDING_INDEPENDENT_REVIEW.\n') + self.assertIn("missing 'NONE'", self.assertRefused('must state the scientific effect')) + self.f.write('README.md', '# Demo\n\n' + DOC) + self.f.write('SCOPE.md', '# Scope\n\nScientific effect: NONE.\n') + self.assertIn('SCOPE.md', self.assertRefused('must state the scientific effect')) + + +class Units(unittest.TestCase): + def test_result_head(self): + self.assertEqual(check.result_head(' UniversalLaw.Spec.P15.Foo F '), ('UniversalLaw.Spec.P15.Foo', ['F'])) + self.assertEqual(check.result_head('Foo\n x y'), ('Foo', ['x', 'y'])) + self.assertEqual(check.result_head("Foo x' y₁"), ('Foo', ["x'", 'y₁'])) + for bad in ('Foo (x)', 'Foo → Foo', '∀ x, Foo x', 'Foo ∧ Bar', '¬ Foo', '', '@Foo x', 'Foo _root_.x'): + with self.subTest(bad=bad): + with self.assertRaises(ValueError): + check.result_head(bad) + + def test_parse_binders(self): + out = check.parse_binders(' {X : Type} [Fintype X] [inst : DecidableEq X] (F G : RealizedData X) ⦃k : ℕ⦄ (n : ℕ := 3) (z) m ') + self.assertEqual([(b['kind'], b['names']) for b in out], + [('implicit', ['X']), ('instance', []), ('instance', ['inst']), ('explicit', ['F', 'G']), ('strict', ['k']), + ('explicit', ['n']), ('explicit', ['z']), ('explicit', ['m'])]) + self.assertEqual(check.parse_binders(''), []) + self.assertEqual(check.parse_binders('(h : ∀ x : ℕ, x = x)'), [{'kind': 'explicit', 'names': ['h']}]) + with self.assertRaises(ValueError): + check.parse_binders('(x : ℕ') + with self.assertRaises(ValueError): + check.parse_binders('⟨a, b⟩') + + def test_first_colon(self): + self.assertEqual(check.first_colon('(x : ℕ) : P x'), 8) + self.assertEqual(check.first_colon(' := rfl'), None) + self.assertEqual(check.first_colon('(h : a :: l = m) : Q'), 17) + + def test_legal_head(self): + for head, ok in (('', True), ('private ', True), ('protected noncomputable ', True), ('@[simp] ', True), ('@[simp, norm_cast] private ', True), + ('open Classical in ', False), (' ', False), (' private ', False), ('set_option x y in ', False), ('exact ', False), ('@[simp', False)): + with self.subTest(head=head): + self.assertEqual(check.legal_head(head), ok) + + def test_open_targets(self): + self.assertEqual(check.open_targets('open Finset Real'), ['Finset', 'Real']) + self.assertEqual(check.open_targets('open scoped BigOperators'), ['BigOperators']) + self.assertEqual(check.open_targets('open Finset (sum prod)'), ['Finset']) + self.assertEqual(check.open_targets('open Finset hiding card'), ['Finset']) + self.assertEqual(check.open_targets('open Classical in'), ['Classical']) + + def test_resolve_head(self): + reg = {'UniversalLaw.Spec.Demo.A': {}, 'UniversalLaw.Spec.Other.A': {}} + ns = ['UniversalLaw.Proofs.Demo'] + self.assertEqual(check.resolve_head('UniversalLaw.Spec.Demo.A', [], ns, reg), 'UniversalLaw.Spec.Demo.A') + self.assertEqual(check.resolve_head('Spec.Demo.A', [], ns, reg), 'UniversalLaw.Spec.Demo.A') + self.assertEqual(check.resolve_head('A', ['UniversalLaw.Spec.Demo'], ns, reg), 'UniversalLaw.Spec.Demo.A') + self.assertEqual(check.resolve_head('A', ['Spec.Demo'], ns, reg), 'UniversalLaw.Spec.Demo.A') + with self.assertRaises(ValueError): + check.resolve_head('A', ['UniversalLaw.Spec.Demo', 'UniversalLaw.Spec.Other'], ns, reg) + with self.assertRaises(ValueError): + check.resolve_head('A', [], ns, reg) + local = {'UniversalLaw.Proofs.Demo.A', 'UniversalLaw.Proofs.Demo.twice'} + with self.assertRaises(ValueError) as ctx: + check.resolve_head('A', ['UniversalLaw.Spec.Demo'], ns, reg, local) + self.assertIn('shadowed by the module-local declaration', str(ctx.exception)) + self.assertEqual(check.resolve_head('UniversalLaw.Spec.Demo.A', [], ns, reg, local), 'UniversalLaw.Spec.Demo.A') + self.assertEqual(check.resolve_head('Spec.Demo.A', [], ns, reg, local), 'UniversalLaw.Spec.Demo.A') + self.assertEqual(check.head_candidates('A', ['Spec.Demo'], ns), + {'A', 'UniversalLaw.A', 'UniversalLaw.Proofs.A', 'UniversalLaw.Proofs.Demo.A', 'Spec.Demo.A', 'UniversalLaw.Spec.Demo.A', + 'UniversalLaw.Proofs.Spec.Demo.A', 'UniversalLaw.Proofs.Demo.Spec.Demo.A'}) + + def test_names_prop(self): + head = 'UniversalLaw.Spec.Demo.A' + for text, ok in (('`UniversalLaw.Spec.Demo.A` (row x)', True), ('`A`.', True), ('`Spec.Demo.A`', True), ('the Prop A of', True), + ('`AA`', False), ('`xA`', False), ("`A'`", False), ('`A.eq_1`', False), ('`A_1`', False), ('`UniversalLaw.Spec.Demo.AA`', False), + ('A.', True), ('(A)', True), ('', False), ('`B`', False)): + with self.subTest(text=text): + self.assertEqual(check.names_prop(text, head), ok) + + def test_leanchecker_mode(self): + with mock.patch.dict(os.environ): + os.environ.pop(check.SKIP_LEANCHECKER_ENV, None) + os.environ.pop('GITHUB_ACTIONS', None) + self.assertEqual((check.leanchecker_mode(False), check.leanchecker_mode(True)), ('RUN', 'RUN')) + os.environ[check.SKIP_LEANCHECKER_ENV] = '0' + self.assertEqual((check.leanchecker_mode(False), check.leanchecker_mode(True)), ('RUN', 'RUN')) + os.environ[check.SKIP_LEANCHECKER_ENV] = '1' + self.assertEqual(check.leanchecker_mode(True), 'SKIPPED_LOCAL_ONLY') + with self.assertRaises(ValueError) as ctx: + check.leanchecker_mode(False) + self.assertIn('only together with --allow-dirty', str(ctx.exception)) + os.environ['GITHUB_ACTIONS'] = 'true' + with self.assertRaises(ValueError) as ctx: + check.leanchecker_mode(True) + self.assertIn('refused in CI', str(ctx.exception)) + + def test_parse_audit(self): + log = ('x.lean:1:0: info: AUDIT theorem UniversalLaw.Proofs.D.a UniversalLaw.Spec.D.A\nAUDIT aux_theorem UniversalLaw.Proofs.D.Aux.h\n' + 'AUDIT auxiliary UniversalLaw.Proofs.D.f\nAUDIT generated UniversalLaw.Proofs.D.S.injEq\nAUDIT END 4 0 1\n') + classes, heads = check.parse_audit(log) + self.assertEqual(heads, {'UniversalLaw.Proofs.D.a': 'UniversalLaw.Spec.D.A'}) + self.assertEqual(set(classes), check.AUDIT_CLASSES) + with self.assertRaises(ValueError): + check.parse_audit(log.replace('AUDIT END 4 0 1', 'AUDIT END 5 0 1')) + with self.assertRaises(ValueError): + check.parse_audit(log.replace('AUDIT END 4 0 1', 'AUDIT END 4 1 1')) + with self.assertRaises(ValueError): + check.parse_audit(log.replace('AUDIT END 4 0 1', 'AUDIT END 4 0 2')) + with self.assertRaises(ValueError): + check.parse_audit(log.replace('UniversalLaw.Proofs.D.a UniversalLaw.Spec.D.A', 'UniversalLaw.Proofs.D.a')) + with self.assertRaises(ValueError): + check.parse_audit(log + 'AUDIT END 4 0 1\n') + refused = log.replace('AUDIT auxiliary UniversalLaw.Proofs.D.f', 'AUDIT REFUSED:premise:UniversalLaw.Spec.D.A UniversalLaw.Proofs.D.f').replace('END 4 0 1', 'END 4 1 1') + classes, _ = check.parse_audit(refused) + self.assertIn('REFUSED:premise:UniversalLaw.Spec.D.A', classes) + + def test_audit_axioms(self): + text = "'A.a' depends on axioms: [propext, Classical.choice, Quot.sound]\n'A.b' does not depend on any axioms\n" + self.assertEqual(check.audit_axioms(text, ['A.a', 'A.b']), {'A.a': ['Classical.choice', 'Quot.sound', 'propext'], 'A.b': []}) + with self.assertRaises(ValueError) as ctx: + check.audit_axioms(text.replace('Quot.sound', 'sorryAx'), ['A.a', 'A.b']) + self.assertIn('forbidden transitive axiom', str(ctx.exception)) + with self.assertRaises(ValueError): + check.audit_axioms(text, ['A.a']) + with self.assertRaises(ValueError): + check.audit_axioms(text, ['A.a', 'A.b', 'A.c']) + with self.assertRaises(ValueError): + check.audit_axioms(text + 'stray line\n', ['A.a', 'A.b']) + + def test_signatures_and_version(self): + log = 'A.a : UniversalLaw.Spec.D.A\nA.b (n : ℕ) :\n UniversalLaw.Spec.D.B n\n' + self.assertEqual(check.signatures(log, ['A.a', 'A.b'])['A.b'], 'A.b (n : ℕ) :\n UniversalLaw.Spec.D.B n') + with self.assertRaises(ValueError): + check.signatures(log, ['A.c']) + good = f'Lean (version 4.34.1, x86_64-unknown-linux-gnu, commit {check.LEAN_COMMIT}, Release)' + self.assertEqual(check.check_lean_version('info: x\n' + good + '\n'), good) + with self.assertRaises(ValueError): + check.check_lean_version(good.replace('4.34.1', '4.34.0')) + with self.assertRaises(ValueError): + check.check_lean_version(good.replace(check.LEAN_COMMIT, '0' * 40)) + + def test_audit_source_and_controls_text(self): + src = check.audit_source('SpecificationProofs', ['SpecificationProofs.Demo'], ['UniversalLaw.Spec.Demo.A']) + self.assertIn('def registeredProps : Array Name := #[`UniversalLaw.Spec.Demo.A]', src) + self.assertIn('def auditModules : Array Name := #[`SpecificationProofs.Demo]', src) + self.assertIn('REFUSED:premise', src) + self.assertIn('run_cmd', src) + hidden = check.HIDDEN_CONTROL.format(ns=check.CONTROL_NS, prop='P') + for word in ('sorry', 'axiom hidden', 'theorem smuggled (h : False) : P', 'theorem implication : P → P', 'opaque', 'unsafe def'): + self.assertIn(word, hidden) + + +class Controls(Base): + def test_source_controls(self): + info = self.f.run() + ctrl = Path(self.f.tmp) / 'controls' + ctrl.mkdir() + outcomes = check.source_controls(info, ctrl) + self.assertEqual({k: v for k, v in outcomes.items() if k != 'maxHeartbeats_justified'}, + {k: 'REFUSED_BY_SOURCE_CHECK' for k in ('sorry', 'axiom', 'native_decide', 'maxHeartbeats_unjustified', 'unregistered_type', + 'smuggled_hypothesis', 'implication', 'missing_docstring_labels')}) + self.assertTrue(outcomes['maxHeartbeats_justified'].startswith('ACCEPTED')) + self.assertEqual(len(list(ctrl.glob('Source_*.lean.txt'))), 8) + + def test_parameterless_prop(self): + info = self.f.run() + self.assertEqual(check.parameterless_prop(self.f.statements, info['registered']), 'UniversalLaw.Spec.Demo.A') + self.f.mutate('Specifications/Demo.lean', 'def A : Prop :=', 'def A (u : Unit) : Prop :=', stmt=True) + self.f.mutate('Specifications/Other.lean', 'def D : Prop :=', 'def D (u : Unit) : Prop :=', stmt=True) + self.f.mutate('Specifications/Other.lean', 'def A : Prop :=', 'def A (u : Unit) : Prop :=', stmt=True) + with self.assertRaises(ValueError): + check.parameterless_prop(self.f.statements, info['registered']) + + def test_expect_refusal(self): + def ok(): + return 1 + + def bad(): + raise ValueError('wrong reason') + with self.assertRaises(ValueError) as ctx: + check.expect_refusal(ok, 'x', 'escaped') + self.assertIn('escaped the source check', str(ctx.exception)) + with self.assertRaises(ValueError) as ctx: + check.expect_refusal(bad, 'other', 'label') + self.assertIn('wrong reason', str(ctx.exception)) + + +# ----------------------------------------------------------------------------- Lean-driving tests + +LAKE = check.lake_binary() +FIXTURE_STATEMENT = '''namespace UniversalLaw.Spec.Demo + +/-- A. -/ +def A : Prop := 1 + 1 = 2 + +/-- B. -/ +def B (n : Nat) : Prop := n + 0 = n + +/-- C. -/ +def C {X : Type} [Inhabited X] (x : X) : Prop := x = x + +/-- Iface. -/ +structure Iface where + x : Nat + +end UniversalLaw.Spec.Demo +''' +FIXTURE_PROOFS = '''import Specifications.Demo + +namespace UniversalLaw.Proofs.Demo + +open UniversalLaw.Spec.Demo + +namespace Aux +theorem helper : True := trivial +end Aux + +private theorem hiddenHelper : True := trivial + +def twice (n : Nat) : Nat := 2 * n + +instance demoInst : Inhabited Nat := ⟨0⟩ + +structure Pair where + a : Nat + b : Nat + +/-- Proves: `A`. +Method: rfl. +Does not establish: anything. -/ +theorem a : UniversalLaw.Spec.Demo.A := rfl + +/-- Proves: `B`. +Method: rfl. +Does not establish: anything. -/ +theorem b (n : Nat) : B n := by + simp [UniversalLaw.Spec.Demo.B] + +section Params + +variable {X : Type} [Inhabited X] + +/-- Proves: `C`. +Method: rfl. +Does not establish: anything. -/ +theorem c (x : X) : UniversalLaw.Spec.Demo.C x := rfl + +end Params + +end UniversalLaw.Proofs.Demo +''' +FIXTURE_PROOFS2 = '''import Specifications.Demo + +namespace UniversalLaw.Proofs.Demo2 + +/-- Proves: `B`. +Method: simp (generates the equation lemma of `B` in this module too). +Does not establish: anything. -/ +theorem bAgain (n : Nat) : UniversalLaw.Spec.Demo.B n := by + simp [UniversalLaw.Spec.Demo.B] + +end UniversalLaw.Proofs.Demo2 +''' +FIXTURE_REGISTERED = ['UniversalLaw.Spec.Demo.A', 'UniversalLaw.Spec.Demo.B', 'UniversalLaw.Spec.Demo.C'] +FIXTURE_EXPECTED = {'UniversalLaw.Proofs.Demo.a': 'UniversalLaw.Spec.Demo.A', 'UniversalLaw.Proofs.Demo.b': 'UniversalLaw.Spec.Demo.B', + 'UniversalLaw.Proofs.Demo.c': 'UniversalLaw.Spec.Demo.C', 'UniversalLaw.Proofs.Demo2.bAgain': 'UniversalLaw.Spec.Demo.B'} + + +@unittest.skipUnless(LAKE, 'lake not available') +class LeanHelpers(unittest.TestCase): + """Two dependency-free fixture packages (a statement package and a proof package depending on + it by path): real `lake build`, `leanchecker`, `#check`, `#print axioms`, the environment + audit, its controls, and module copies carrying each escape family that the environment audit + must refuse. No Mathlib; nothing here is about the real modules.""" + + def setUp(self): + self.tmp = Path(tempfile.mkdtemp()) + self.addCleanup(shutil.rmtree, self.tmp, True) + stmt, self.proofs = self.tmp / 'stmt', self.tmp / 'proofs' + (stmt / 'Specifications').mkdir(parents=True) + (self.proofs / 'SpecificationProofs').mkdir(parents=True) + (stmt / 'lakefile.toml').write_text('name = "spec_fixture_statements"\ndefaultTargets = ["Specifications"]\n\n[[lean_lib]]\n' + 'name = "Specifications"\n' + check.LEAN_OPTIONS_LINE + '\n') + (stmt / 'lean-toolchain').write_text(check.TOOLCHAIN + '\n') + (stmt / 'lake-manifest.json').write_text(json.dumps({'version': '1.2.0', 'packagesDir': '.lake/packages', 'packages': [], + 'name': 'spec_fixture_statements', 'lakeDir': '.lake'}) + '\n') + (stmt / 'Specifications.lean').write_text('import Specifications.Demo\n') + (stmt / 'Specifications/Demo.lean').write_text(FIXTURE_STATEMENT) + (self.proofs / 'lakefile.toml').write_text('name = "spec_fixture_proofs"\ndefaultTargets = ["SpecificationProofs"]\n\n[[require]]\n' + 'name = "spec_fixture_statements"\npath = "../stmt"\n\n[[lean_lib]]\n' + 'name = "SpecificationProofs"\n' + check.LEAN_OPTIONS_LINE + '\n') + (self.proofs / 'lean-toolchain').write_text(check.TOOLCHAIN + '\n') + (self.proofs / 'lake-manifest.json').write_text(json.dumps({'version': '1.2.0', 'packagesDir': '.lake/packages', 'packages': [ + {'type': 'path', 'name': 'spec_fixture_statements', 'dir': '../stmt', 'manifestFile': 'lake-manifest.json', 'inherited': False, + 'configFile': 'lakefile.toml'}], 'name': 'spec_fixture_proofs', 'lakeDir': '.lake'}) + '\n') + (self.proofs / 'SpecificationProofs.lean').write_text('import SpecificationProofs.Demo\nimport SpecificationProofs.Demo2\n') + (self.proofs / 'SpecificationProofs/Demo.lean').write_text(FIXTURE_PROOFS) + (self.proofs / 'SpecificationProofs/Demo2.lean').write_text(FIXTURE_PROOFS2) + self.out = self.proofs / '.lake' / 'evidence' + (self.out / 'controls').mkdir(parents=True) + self.env = check.lean_env(LAKE) + + def build(self, module_text=None, expect_success=True): + if module_text is not None: + (self.proofs / 'SpecificationProofs/Demo.lean').write_text(module_text) + if (self.proofs / '.lake' / 'build').exists(): + shutil.rmtree(self.proofs / '.lake' / 'build') + return check.run([LAKE, 'build'], 'build', self.out, self.proofs, self.env, expect_success=expect_success) + + def audit(self, expected=FIXTURE_EXPECTED, registered=FIXTURE_REGISTERED): + return check.environment_audit(LAKE, self.proofs, self.env, self.out, ['SpecificationProofs.Demo', 'SpecificationProofs.Demo2'], registered, expected) + + def test_fixture_packages(self): + names = list(FIXTURE_EXPECTED) + with contextlib.redirect_stdout(io.StringIO()): + check.check_lean_version(check.run([LAKE, 'env', 'lean', '--version'], 'version', self.out, self.proofs, self.env)) + log = self.build() + self.assertNotIn('is a proposition; use', log) + self.assertIsNone(check.MODULE_WARNING.search(log)) + check.run([LAKE, 'env', 'leanchecker', 'SpecificationProofs'], 'leanchecker', self.out, self.proofs, self.env) + axioms, sigs = check.kernel_audit(LAKE, self.proofs, self.env, self.out, names) + self.assertEqual(set(axioms), set(names)) + self.assertTrue(all(set(v) <= check.ALLOWED_AXIOMS for v in axioms.values()), axioms) + self.assertEqual((axioms['UniversalLaw.Proofs.Demo.a'], axioms['UniversalLaw.Proofs.Demo.c']), ([], [])) + self.assertEqual(sigs['UniversalLaw.Proofs.Demo.a'], 'UniversalLaw.Proofs.Demo.a : UniversalLaw.Spec.Demo.A') + self.assertEqual(sigs['UniversalLaw.Proofs.Demo.b'], 'UniversalLaw.Proofs.Demo.b (n : Nat) : UniversalLaw.Spec.Demo.B n') + counts = self.audit() + self.assertEqual((counts['theorem'], counts['aux_theorem']), (4, 2)) + env_log = (self.out / 'environment.log').read_text() + eqns = re.findall(r'AUDIT generated (UniversalLaw\.Spec\.Demo\.B\.eq_\w+)', env_log) + self.assertTrue(eqns, 'the equation lemma of B, generated in both modules, is audited as generated: ' + env_log) + self.assertEqual(len(eqns), len(set(eqns)), 'each equation lemma is audited once although two modules generate it') + self.assertGreaterEqual(counts['auxiliary'], 4, 'twice, demoInst, Pair and its constructor/recursor/projections') + env_log = (self.out / 'environment.log').read_text() + self.assertIn('AUDIT aux_theorem UniversalLaw.Proofs.Demo.Aux.helper', env_log) + self.assertRegex(env_log, r'AUDIT aux_theorem _private\.\S*hiddenHelper') + self.assertIn('AUDIT auxiliary UniversalLaw.Proofs.Demo.twice', env_log) + self.assertIn('AUDIT auxiliary UniversalLaw.Proofs.Demo.demoInst', env_log) + self.assertIn('AUDIT theorem UniversalLaw.Proofs.Demo.c UniversalLaw.Spec.Demo.C', env_log) + self.assertNotIn('REFUSED', env_log) + with self.assertRaises(ValueError) as ctx: + self.audit({**FIXTURE_EXPECTED, 'UniversalLaw.Proofs.Demo.ghost': 'UniversalLaw.Spec.Demo.A'}) + self.assertIn('missing', str(ctx.exception)) + with self.assertRaises(ValueError) as ctx: + self.audit({k: v for k, v in FIXTURE_EXPECTED.items() if not k.endswith('.a')}) + self.assertIn('unexpected', str(ctx.exception)) + with self.assertRaises(ValueError) as ctx: + self.audit({**FIXTURE_EXPECTED, 'UniversalLaw.Proofs.Demo.a': 'UniversalLaw.Spec.Demo.B'}) + self.assertIn('head differs', str(ctx.exception)) + with self.assertRaises(ValueError): + check.environment_audit(LAKE, self.proofs, self.env, self.out, ['SpecificationProofs.Missing'], FIXTURE_REGISTERED, FIXTURE_EXPECTED) + # a registered set that lacks A: Lean refuses `a` as REFUSED:type even though it compiles + with self.assertRaises(ValueError) as ctx: + self.audit(registered=FIXTURE_REGISTERED[1:]) + self.assertIn('REFUSED:type:UniversalLaw.Spec.Demo.A', str(ctx.exception) + (self.out / 'environment.log').read_text()) + self.assertEqual(check.lean_control_missing(LAKE, self.proofs, self.env, self.out, 'UniversalLaw.Proofs.Demo.Missing'), 'REJECTED_BY_LEAN') + with self.assertRaises(ValueError): + check.kernel_audit(LAKE, self.proofs, self.env, self.out, names + ['UniversalLaw.Proofs.Demo.Missing']) + self.assertTrue(check.lean_control_sorry_axioms(LAKE, self.proofs, self.env, self.out, 'UniversalLaw.Spec.Demo.A').startswith('REFUSED_BY_AXIOM_AUDIT')) + verdict = check.lean_control_environment(LAKE, self.proofs, self.env, self.out, FIXTURE_REGISTERED, 'UniversalLaw.Spec.Demo.A', + 'UniversalLaw.Proofs.Demo.a') + self.assertIn('REFUSED_BY_ENVIRONMENT_AUDIT', verdict) + self.assertNotIn('no parameterless', verdict) + hidden_log = (self.out / 'control_environment_hidden.log').read_text() + c = check.CONTROL_NS + '.' + for verdict_line in ('REFUSED:axioms:sorryAx ' + c + 'sorried', 'REFUSED:axiom ' + c + 'hidden', + 'REFUSED:axioms:' + c + 'hidden ' + c + 'usesAxiom', 'REFUSED:type:True ' + c + 'unregistered', + 'REFUSED:premise:UniversalLaw.Spec.Demo.A ' + c + 'smuggled', 'REFUSED:premise:UniversalLaw.Spec.Demo.A ' + c + 'implication', + 'REFUSED:proof_as_def ' + c + 'proofAsDef', 'REFUSED:opaque ' + c + 'opq', 'REFUSED:unsafe ' + c + 'unsafeDef'): + self.assertIn('AUDIT ' + verdict_line, hidden_log) + honest_log = (self.out / 'control_environment_honest.log').read_text() + self.assertIn('AUDIT theorem ' + c + 'honest UniversalLaw.Spec.Demo.A', honest_log) + verdict = check.lean_control_environment(LAKE, self.proofs, self.env, self.out, FIXTURE_REGISTERED, 'UniversalLaw.Spec.Demo.A', None) + self.assertIn('no parameterless', verdict) + self.assertNotIn('AUDIT theorem', (self.out / 'control_environment_honest.log').read_text()) + + def test_environment_audit_refuses_escapes_lean_accepts(self): + """Module copies Lean builds without error must be refused by the environment audit, each + for its own reason: the shape rules the source scan cannot see (an implicit extra binder, + a narrowed argument after `open`, a theorem in a non-Aux sub-namespace), and the escapes + the scan does see but that must also fail at the Lean side.""" + tail = 'end UniversalLaw.Proofs.Demo' + cases = { + 'implicit smuggled hypothesis': ('theorem t {h : False} : UniversalLaw.Spec.Demo.A := h.elim', 'REFUSED:premise:UniversalLaw.Spec.Demo.A'), + 'explicit smuggled hypothesis': ('theorem t (h : False) : UniversalLaw.Spec.Demo.A := h.elim', 'REFUSED:premise:UniversalLaw.Spec.Demo.A'), + 'narrowed argument': ('theorem t (k : Nat) : B (k + 1) := rfl', 'REFUSED:premise:UniversalLaw.Spec.Demo.B'), + 'fixed instance argument': ('theorem t : UniversalLaw.Spec.Demo.C (0 : Nat) := rfl', 'REFUSED:premise:UniversalLaw.Spec.Demo.C'), + 'implication P → P': ('theorem t : UniversalLaw.Spec.Demo.A → UniversalLaw.Spec.Demo.A := fun h => h', 'REFUSED:premise:UniversalLaw.Spec.Demo.A'), + 'unregistered type': ('theorem t : True := trivial', 'REFUSED:type:True'), + 'structure type is not a Prop': ('theorem t : (2 : Nat) + 2 = 4 := rfl', 'REFUSED:type:Eq'), + 'non-Aux sub-namespace': ('namespace Helpers\ntheorem t : True := trivial\nend Helpers', 'REFUSED:type:True'), + 'indented hidden theorem': (' theorem t : True := trivial', 'REFUSED:type:True'), + 'theorem between string literals': ('def opener : String := "/-"\ntheorem t : True := trivial\ndef closer : String := "-/"', 'REFUSED:type:True'), + 'axiom': ('axiom hidden : False', 'REFUSED:axiom'), + 'axiom used by a registered-type theorem': ('axiom hidden : False\ntheorem t : UniversalLaw.Spec.Demo.A := hidden.elim', + 'REFUSED:axioms:UniversalLaw.Proofs.Demo.hidden'), + 'opaque': ('opaque opq : Nat', 'REFUSED:opaque'), + 'unsafe': ('unsafe def u : Nat := 0', 'REFUSED:unsafe'), + 'bound-variable type': ('theorem t (p : Prop) (hp : p) : p := hp', 'REFUSED:type:nonconstant'), + 'module-local def shadowing the registered Prop': ('def A : Prop := True\ntheorem tA : A := trivial', 'REFUSED:type:UniversalLaw.Proofs.Demo.A'), + 'decide +native (per-use native axiom)': ('theorem t : (1 : Nat) + 1 = 2 := by decide +native', 'REFUSED:axiom'), + } + with contextlib.redirect_stdout(io.StringIO()): + for label, (text, fragment) in cases.items(): + with self.subTest(label=label): + self.build(FIXTURE_PROOFS.replace(tail, text + '\n' + tail)) + with self.assertRaises(ValueError) as ctx: + self.audit() + self.assertIn(fragment, str(ctx.exception) + (self.out / 'environment.log').read_text()) + log = self.build(FIXTURE_PROOFS.replace(tail, 'def proofAsDef : (2 : Nat) + 2 = 4 := rfl\nabbrev proofAsAbbrev : True := trivial\n' + tail)) + self.assertIn('is a proposition; use', log, 'the build-log check of execute() refuses the defProp linter warning') + with self.assertRaises(ValueError): + self.audit() + env_log = (self.out / 'environment.log').read_text() + self.assertIn('AUDIT REFUSED:proof_as_def UniversalLaw.Proofs.Demo.proofAsDef', env_log) + self.assertIn('AUDIT REFUSED:proof_as_def UniversalLaw.Proofs.Demo.proofAsAbbrev', env_log) + log = self.build(FIXTURE_PROOFS.replace(tail, 'theorem t : UniversalLaw.Spec.Demo.A := sorry\n' + tail)) + self.assertIn('declaration uses', log) + with self.assertRaises(ValueError): + self.audit() + self.assertIn('AUDIT REFUSED:axioms:sorryAx UniversalLaw.Proofs.Demo.t', (self.out / 'environment.log').read_text()) + # a registered-type theorem under Aux is an aux theorem, never inventory; one more inventory theorem is `unexpected` + self.build(FIXTURE_PROOFS.replace(tail, 'theorem Aux.a2 : UniversalLaw.Spec.Demo.A := rfl\ntheorem a3 : UniversalLaw.Spec.Demo.A := rfl\n' + tail)) + with self.assertRaises(ValueError) as ctx: + self.audit() + self.assertIn('unexpected', str(ctx.exception)) + self.assertIn("['UniversalLaw.Proofs.Demo.a3']", str(ctx.exception)) + self.assertIn('AUDIT aux_theorem UniversalLaw.Proofs.Demo.Aux.a2', (self.out / 'environment.log').read_text()) + + def test_auto_implicit_is_off(self): + """With `autoImplicit = false` an unbound name in a header is an error instead of a silent + implicit parameter.""" + with contextlib.redirect_stdout(io.StringIO()): + log = self.build(FIXTURE_PROOFS.replace('theorem b (n : Nat) : B n := by', 'theorem b : B n := by'), expect_success=False) + self.assertIn('Unknown identifier `n`', log) + + +# ----------------------------------------------------------------------------- real tree + +REAL_REPO = HERE.parents[1] +REAL_STATEMENTS = (HERE / check.STATEMENT_DIR).resolve() + + +@unittest.skipUnless((REAL_STATEMENTS / 'REGISTER.json').is_file() and (HERE / 'lakefile.toml').is_file(), 'real tree not present') +class RealPacket(unittest.TestCase): + """The committed packets' pins and the scans of the modules present, independent of git state.""" + + def test_pins(self): + revs = check.check_lock(HERE, REAL_STATEMENTS) + self.assertEqual(revs['mathlib'], check.MATHLIB_REV) + self.assertEqual(len(revs), 9) + lock = json.loads((HERE / 'lake-manifest.json').read_text()) + self.assertEqual(lock['packages'][-1], check.PATH_DEPENDENCY) + self.assertIn('.lake/', (HERE / '.gitignore').read_text().splitlines()) + self.assertIn(check.LEAN_OPTIONS_LINE, (HERE / 'lakefile.toml').read_text().splitlines()) + self.assertEqual((HERE / 'lakefile.toml').read_bytes(), check.LAKEFILE.encode(), 'lakefile.toml is pinned byte-exactly') + self.assertEqual((HERE / 'lean-toolchain').read_text(), check.TOOLCHAIN + '\n') + + def test_register_inventory(self): + registered, structures, digest = check.load_register(REAL_STATEMENTS) + self.assertGreaterEqual(len(registered), 100) + self.assertIn('UniversalLaw.Spec.P15.RhoStarBelowSixSevenths', registered) + self.assertTrue(all(n.startswith(check.STATEMENT_NAMESPACE) for n in registered)) + self.assertEqual(len(digest), 64) + self.assertIn(check.parameterless_prop(REAL_STATEMENTS, registered), registered) + + def test_modules_scan(self): + registered, _, _ = check.load_register(REAL_STATEMENTS) + modules = sorted((HERE / check.ROOT_MODULE).glob('*.lean')) + self.assertTrue(modules, 'at least one proof module is present') + for m in modules: + with self.subTest(module=m.name): + scan = check.scan_module(m.read_text(encoding='utf-8'), m.stem, registered) + self.assertTrue(scan['theorems'], m.name + ' declares at least one inventory theorem') + for t in scan['theorems']: + self.assertIn(t['proves'], registered) + + def test_root_imports_present_modules(self): + modules = sorted(check.ROOT_MODULE + '/' + p.name for p in (HERE / check.ROOT_MODULE).glob('*.lean')) + check.check_root(HERE, modules) + + def test_workflow(self): + path = REAL_REPO / check.WORKFLOW + if not path.is_file(): + self.skipTest('workflow not present in this tree') + text = path.read_text(encoding='utf-8') + for needle in ('lake-package-directory: ' + check.PACKAGE, "use-mathlib-cache: 'true'", "- '" + check.PACKAGE + "/**'", + "- '" + check.STATEMENT_PACKAGE + "/**'", 'check.py --execute', 'test_check.py LeanHelpers', '.lake/evidence/', + 'python -B -O -S'): + self.assertIn(needle, text) + + +if __name__ == '__main__': + unittest.main(verbosity=2) diff --git a/specifications/lean_statements_20261010/README.md b/specifications/lean_statements_20261010/README.md index 7d4732f4b..1f5d71922 100644 --- a/specifications/lean_statements_20261010/README.md +++ b/specifications/lean_statements_20261010/README.md @@ -2,8 +2,14 @@ Scientific effect: **NONE**. Organizational-independence credit of this packet: 0 (Anthropic / Claude, delegated AI work). Alignment status of every statement: `PENDING_INDEPENDENT_REVIEW`. -Formal progress of every declaration here: `specified`. No claim, premise, obligation or -disposition changes because this packet exists, builds, or is green in CI. +Formal progress of every declaration here: `specified`. The sibling proof packet +`specifications/lean_statement_proofs_20261011` holds theorems whose type is exactly one of these +Props (51 of the 141 Props, 52 theorems); the register lists them under the claim rows as +statement entries of kind `theorem` with label `proved` (all of them kernel-checked by the hosted run 38121713840: PR head 910809d6, +actual tested merge 5b198699… with base b2d70d77…, same tree as the head), +which changes no +label of this packet and no claim-level label. No claim, premise, obligation or +disposition changes because this packet exists, builds, or is green in CI, or because a Prop of it is proved. ## What this packet is @@ -40,201 +46,202 @@ ladder; it is `specified`. | `check.py`, `test_check.py`, `replay.sh` | the checker, its unit tests and negative controls, the local replay | | `lakefile.toml`, `lean-toolchain`, `lake-manifest.json` | Lean `leanprover/lean4:v4.34.1`, Mathlib `d13f23b723b8a846827a245b89c10fc7d3f11612`, lock identical to `formal/lake-manifest.json`; `autoImplicit = false` so an unbound name in a header is an error, never a silent implicit parameter | | `.github/workflows/lean-specifications.yml` | CI: tests, source check, `lean-action` with the Mathlib cache, `check.py --execute`, artifact of `.lake/evidence/` | +| `../lean_statement_proofs_20261011/` | the sibling proof packet (path dependency on this packet, never edits it): theorems typed exactly as registered Props, its own gate `check.py` and workflow `.github/workflows/lean-specification-proofs.yml`; its theorems appear in `REGISTER.json` as `proved` statement entries | ## Declarations -150 registered declarations (141 `def … : Prop`, 9 interface `structure`), every one with formal progress `specified`; the 123 auxiliary definitions and abbreviations of the modules are inventory only and are not register statements. Names are given without the module namespace `UniversalLaw.Spec..`; the source column is the pinned source named by the docstring's `Source:` line. Anchors and "Not established" cells are copied verbatim from the Lean docstrings (`Anchor:` and `Does not claim:` lines) through REGISTER.json. +150 registered declarations (141 `def … : Prop`, 9 interface `structure`), every one with formal progress `specified` in this package; the 123 auxiliary definitions and abbreviations of the modules are inventory only and are not register statements. Names are given without the module namespace `UniversalLaw.Spec..`; the source column is the pinned source named by the docstring's `Source:` line. Anchors and "Not established" cells are copied verbatim from the Lean docstrings (`Anchor:` and `Does not claim:` lines) through REGISTER.json. The last column names the theorems of the sibling proof packet `specifications/lean_statement_proofs_20261011` whose type is exactly the declaration (namespace `UniversalLaw.Proofs..`): 51 of the 141 Props have one (52 theorems; `TriangleNeedsThree` is proved twice), each listed in the register under the claim rows as a statement entry of kind `theorem` with label `proved` (the label of a committed proof package; `kernel-checked` appears only in a run receipt: the hosted `lean-specification-proofs.yml` run 38121713840 receipted all of them and run 38116277597 the first 38; a pull_request run checks out the synthetic merge of the PR head into the base, so each receipt records as checked_commit that merge and not the head: run 38121713840 PR head 910809d6, actual tested merge 5b198699308e0585904c21d12bf540cf2475d2f0 with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2; run 38116277597 PR head 00d2ac6e, actual tested merge c4c66bb8cb26f0cd9bc03d52bb25f1b3925b272c with the same base; run 38122386459 corroborates on PR head d9b8dd33, actual tested merge 866136cca66b46e6dbd3186b47c9340f7e93b4f6; each merge has the same tree as its head). That label belongs to the theorem, not to the declaration here, which stays `specified`, and not to any claim row; a kernel-checked theorem is evidence about its Prop only, and alignment of every statement is `PENDING_INDEPENDENT_REVIEW`. ### `Specifications/Field.lean` (12 registered declarations) -| declaration | kind | source | registered under claim rows | -|---|---|---|---| -| `IsLPeriodic` | def_prop | `lifetime-parent` | `math.uniform-matrix-cap-lifetime` | -| `IsSmooth` | def_prop | `lifetime-parent` | `math.uniform-matrix-cap-lifetime` | -| `GaussianFieldInterface` | structure | `lifetime-parent` | `math.uniform-matrix-cap-lifetime` | -| `IsCriticalPoint` | def_prop | `lifetime-parent` | `math.uniform-matrix-cap-lifetime` | -| `HessianHasInertia` | def_prop | `lifetime-parent` | `math.uniform-matrix-cap-lifetime` | -| `IsNondegMax` | def_prop | `lifetime-parent` | `math.uniform-matrix-cap-lifetime` | -| `IsIndexSaddle` | def_prop | `lifetime-parent` | `math.uniform-matrix-cap-lifetime` | -| `IsCandidatePair` | def_prop | `lifetime-parent` | `math.uniform-matrix-cap-lifetime` | -| `IsMorseDistinct` | def_prop | `lifetime-parent` | `math.uniform-matrix-cap-lifetime` | -| `SuperlevelBarInterface` | structure | `lifetime-parent` | `math.uniform-matrix-cap-lifetime` | -| `IsFiniteBar` | def_prop | `lifetime-parent` | `math.uniform-matrix-cap-lifetime` | -| `IsLifetimeDensityVersion` | def_prop | `lifetime-parent` | `math.uniform-matrix-cap-lifetime` | +| declaration | kind | source | registered under claim rows | proved by (proof packet, `proved`; kernel-checked by hosted run 38121713840: PR head 910809d6, actual tested merge 5b198699… with base b2d70d77…, same tree as the head) | +|---|---|---|---|---| +| `IsLPeriodic` | def_prop | `lifetime-parent` | `math.uniform-matrix-cap-lifetime` | — | +| `IsSmooth` | def_prop | `lifetime-parent` | `math.uniform-matrix-cap-lifetime` | — | +| `GaussianFieldInterface` | structure | `lifetime-parent` | `math.uniform-matrix-cap-lifetime` | — | +| `IsCriticalPoint` | def_prop | `lifetime-parent` | `math.uniform-matrix-cap-lifetime` | — | +| `HessianHasInertia` | def_prop | `lifetime-parent` | `math.uniform-matrix-cap-lifetime` | — | +| `IsNondegMax` | def_prop | `lifetime-parent` | `math.uniform-matrix-cap-lifetime` | — | +| `IsIndexSaddle` | def_prop | `lifetime-parent` | `math.uniform-matrix-cap-lifetime` | — | +| `IsCandidatePair` | def_prop | `lifetime-parent` | `math.uniform-matrix-cap-lifetime` | — | +| `IsMorseDistinct` | def_prop | `lifetime-parent` | `math.uniform-matrix-cap-lifetime` | — | +| `SuperlevelBarInterface` | structure | `lifetime-parent` | `math.uniform-matrix-cap-lifetime` | — | +| `IsFiniteBar` | def_prop | `lifetime-parent` | `math.uniform-matrix-cap-lifetime` | — | +| `IsLifetimeDensityVersion` | def_prop | `lifetime-parent` | `math.uniform-matrix-cap-lifetime` | — | ### `Specifications/Lifetime.lean` (24 registered declarations) -| declaration | kind | source | registered under claim rows | -|---|---|---|---| -| `IsLPeriodic` | def_prop | `lifetime-parent` | `math.uniform-matrix-cap-lifetime` | -| `IsSmooth` | def_prop | `lifetime-parent` | `math.uniform-matrix-cap-lifetime` | -| `GaussianFieldInterface` | structure | `lifetime-parent` | `math.uniform-matrix-cap-lifetime` | -| `IsCriticalPoint` | def_prop | `lifetime-parent` | `math.uniform-matrix-cap-lifetime` | -| `HessianHasInertia` | def_prop | `lifetime-parent` | `math.uniform-matrix-cap-lifetime` | -| `IsNondegMax` | def_prop | `lifetime-parent` | `math.uniform-matrix-cap-lifetime` | -| `IsIndexSaddle` | def_prop | `lifetime-parent` | `math.uniform-matrix-cap-lifetime` | -| `IsCandidatePair` | def_prop | `lifetime-parent` | `math.uniform-matrix-cap-lifetime` | -| `IsMorseDistinct` | def_prop | `lifetime-parent` | `math.uniform-matrix-cap-lifetime` | -| `SuperlevelBarInterface` | structure | `lifetime-parent` | `math.uniform-matrix-cap-lifetime` | -| `IsFiniteBar` | def_prop | `lifetime-parent` | `math.uniform-matrix-cap-lifetime` | -| `IsLifetimeDensityVersion` | def_prop | `lifetime-parent` | `lifetime-remainder`, `math.uniform-matrix-cap-lifetime`, `D1-THM-B` | -| `IsWindowPair` | def_prop | `lifetime-parent` | `math.uniform-matrix-cap-lifetime`, `D1-THM-B` | -| `IsWindowElderPair` | def_prop | `lifetime-parent` | `math.uniform-matrix-cap-lifetime`, `D1-THM-B` | -| `IsUnrestrictedPair` | def_prop | `lifetime-parent` | `lifetime-remainder`, `math.uniform-matrix-cap-lifetime`, `D1-THM-C` | -| `PairLawInterface` | structure | `lifetime-parent` | `math.uniform-matrix-cap-lifetime`, `D1-THM-A` | -| `ParentUniformSelectionA` | def_prop | `lifetime-parent` | `math.uniform-matrix-cap-lifetime`, `D1-THM-A` | -| `ParentCompactWindowDensityB` | def_prop | `lifetime-parent` | `math.uniform-matrix-cap-lifetime`, `D1-THM-B` | -| `IsUnrestrictedLeadingCoefficient` | def_prop | `lifetime-parent` | `lifetime-remainder`, `math.uniform-matrix-cap-lifetime`, `D1-THM-C` | -| `ParentUnrestrictedLeadingDensityC` | def_prop | `lifetime-parent` | `math.uniform-matrix-cap-lifetime`, `D1-THM-C` | -| `RemainderBoundedR1` | def_prop | `lifetime-remainder` | `lifetime-remainder`, `math.lifetime-remainder` | -| `PlanarElderLowerE2` | def_prop | `elder-lower-density-gap` | `OA-ELDER-LOWER-DENSITY-GAP-20260928-v1` | -| `PlanarTwoSidedRateE4` | def_prop | `elder-lower-density-gap` | `OA-ELDER-LOWER-DENSITY-GAP-20260928-v1` | -| `PlanarDensityGapE11` | def_prop | `elder-lower-density-gap` | `OA-ELDER-LOWER-DENSITY-GAP-20260928-v1` | +| declaration | kind | source | registered under claim rows | proved by (proof packet, `proved`; kernel-checked by hosted run 38121713840: PR head 910809d6, actual tested merge 5b198699… with base b2d70d77…, same tree as the head) | +|---|---|---|---|---| +| `IsLPeriodic` | def_prop | `lifetime-parent` | `math.uniform-matrix-cap-lifetime` | — | +| `IsSmooth` | def_prop | `lifetime-parent` | `math.uniform-matrix-cap-lifetime` | — | +| `GaussianFieldInterface` | structure | `lifetime-parent` | `math.uniform-matrix-cap-lifetime` | — | +| `IsCriticalPoint` | def_prop | `lifetime-parent` | `math.uniform-matrix-cap-lifetime` | — | +| `HessianHasInertia` | def_prop | `lifetime-parent` | `math.uniform-matrix-cap-lifetime` | — | +| `IsNondegMax` | def_prop | `lifetime-parent` | `math.uniform-matrix-cap-lifetime` | — | +| `IsIndexSaddle` | def_prop | `lifetime-parent` | `math.uniform-matrix-cap-lifetime` | — | +| `IsCandidatePair` | def_prop | `lifetime-parent` | `math.uniform-matrix-cap-lifetime` | — | +| `IsMorseDistinct` | def_prop | `lifetime-parent` | `math.uniform-matrix-cap-lifetime` | — | +| `SuperlevelBarInterface` | structure | `lifetime-parent` | `math.uniform-matrix-cap-lifetime` | — | +| `IsFiniteBar` | def_prop | `lifetime-parent` | `math.uniform-matrix-cap-lifetime` | — | +| `IsLifetimeDensityVersion` | def_prop | `lifetime-parent` | `lifetime-remainder`, `math.uniform-matrix-cap-lifetime`, `D1-THM-B` | — | +| `IsWindowPair` | def_prop | `lifetime-parent` | `math.uniform-matrix-cap-lifetime`, `D1-THM-B` | — | +| `IsWindowElderPair` | def_prop | `lifetime-parent` | `math.uniform-matrix-cap-lifetime`, `D1-THM-B` | — | +| `IsUnrestrictedPair` | def_prop | `lifetime-parent` | `lifetime-remainder`, `math.uniform-matrix-cap-lifetime`, `D1-THM-C` | — | +| `PairLawInterface` | structure | `lifetime-parent` | `math.uniform-matrix-cap-lifetime`, `D1-THM-A` | — | +| `ParentUniformSelectionA` | def_prop | `lifetime-parent` | `math.uniform-matrix-cap-lifetime`, `D1-THM-A` | — | +| `ParentCompactWindowDensityB` | def_prop | `lifetime-parent` | `math.uniform-matrix-cap-lifetime`, `D1-THM-B` | — | +| `IsUnrestrictedLeadingCoefficient` | def_prop | `lifetime-parent` | `lifetime-remainder`, `math.uniform-matrix-cap-lifetime`, `D1-THM-C` | — | +| `ParentUnrestrictedLeadingDensityC` | def_prop | `lifetime-parent` | `math.uniform-matrix-cap-lifetime`, `D1-THM-C` | — | +| `RemainderBoundedR1` | def_prop | `lifetime-remainder` | `lifetime-remainder`, `math.lifetime-remainder` | — | +| `PlanarElderLowerE2` | def_prop | `elder-lower-density-gap` | `OA-ELDER-LOWER-DENSITY-GAP-20260928-v1` | — | +| `PlanarTwoSidedRateE4` | def_prop | `elder-lower-density-gap` | `OA-ELDER-LOWER-DENSITY-GAP-20260928-v1` | — | +| `PlanarDensityGapE11` | def_prop | `elder-lower-density-gap` | `OA-ELDER-LOWER-DENSITY-GAP-20260928-v1` | — | ### `Specifications/Side24.lean` (28 registered declarations) -| declaration | kind | source | registered under claim rows | -|---|---|---|---| -| `ThetaSummable` | def_prop | `side24-proof` | `side24-coefficient` | -| `IsUnitTuple` | def_prop | `side24-proof` | `side24-coefficient` | -| `DerivativePairingBound` | def_prop | `side24-proof` | `side24-coefficient` | -| `DerivativeBoundAtLeastOne` | def_prop | `side24-proof` | `side24-coefficient` | -| `DerivativeBoundAtZero` | def_prop | `side24-proof` | `side24-coefficient` | -| `LatticeImageSumBound` | def_prop | `side24-proof` | `side24-coefficient` | -| `SuccessiveTermRatio` | def_prop | `side24-proof` | `side24-coefficient` | -| `ExponentialBounds` | def_prop | `side24-proof` | `side24-coefficient` | -| `ImageBound` | def_prop | `side24-proof` | `side24-coefficient` | -| `CovarianceOrdering` | def_prop | `side24-proof` | `side24-coefficient` | -| `EntrywiseCovarianceBound` | def_prop | `side24-proof` | `side24-coefficient` | -| `ReferenceCovarianceLowerBound` | def_prop | `side24-proof` | `side24-coefficient` | -| `ReferenceOddAndPinBlocks` | def_prop | `side24-proof` | `side24-coefficient` | -| `DensityComparison` | def_prop | `side24-proof` | `side24-coefficient` | -| `IntegrandRatioBounds` | def_prop | `side24-proof` | `side24-coefficient` | -| `ReferencePinDensityProduct` | def_prop | `side24-proof` | `side24-coefficient` | -| `ReferenceCoefficientIdentity` | def_prop | `side24-proof` | `side24-coefficient` | -| `ConeMomentInterface` | structure | `side24-proof` | `side24-coefficient` | -| `NegDefCone` | def_prop | `side24-proof` | `side24-coefficient` | -| `ConeMomentD1Identity` | def_prop | `side24-proof` | `side24-coefficient` | -| `ConeMomentD2Identity` | def_prop | `side24-proof` | `side24-coefficient` | -| `ConeMomentD2Algebra` | def_prop | `side24-proof` | `side24-coefficient` | -| `TraceMoments` | def_prop | `side24-proof` | `side24-coefficient` | -| `RayleighSquareLaw` | def_prop | `side24-proof` | `side24-coefficient` | -| `ElementaryConeIntegral` | def_prop | `side24-proof` | `side24-coefficient` | -| `PeriodicCoefficientInterface` | structure | `side24-proof` | `side24-coefficient`, `math.side24-coefficient` | -| `CoefficientEnclosure` | def_prop | `side24-proof` | `side24-coefficient`, `math.side24-coefficient` | -| `ReferenceComparison` | def_prop | `side24-proof` | `side24-coefficient`, `math.side24-coefficient` | +| declaration | kind | source | registered under claim rows | proved by (proof packet, `proved`; kernel-checked by hosted run 38121713840: PR head 910809d6, actual tested merge 5b198699… with base b2d70d77…, same tree as the head) | +|---|---|---|---|---| +| `ThetaSummable` | def_prop | `side24-proof` | `side24-coefficient` | — | +| `IsUnitTuple` | def_prop | `side24-proof` | `side24-coefficient` | — | +| `DerivativePairingBound` | def_prop | `side24-proof` | `side24-coefficient` | — | +| `DerivativeBoundAtLeastOne` | def_prop | `side24-proof` | `side24-coefficient` | — | +| `DerivativeBoundAtZero` | def_prop | `side24-proof` | `side24-coefficient` | — | +| `LatticeImageSumBound` | def_prop | `side24-proof` | `side24-coefficient` | — | +| `SuccessiveTermRatio` | def_prop | `side24-proof` | `side24-coefficient` | `Side24Elementary.successiveTermRatio` | +| `ExponentialBounds` | def_prop | `side24-proof` | `side24-coefficient` | `Side24Elementary.exponentialBounds` | +| `ImageBound` | def_prop | `side24-proof` | `side24-coefficient` | — | +| `CovarianceOrdering` | def_prop | `side24-proof` | `side24-coefficient` | — | +| `EntrywiseCovarianceBound` | def_prop | `side24-proof` | `side24-coefficient` | — | +| `ReferenceCovarianceLowerBound` | def_prop | `side24-proof` | `side24-coefficient` | — | +| `ReferenceOddAndPinBlocks` | def_prop | `side24-proof` | `side24-coefficient` | — | +| `DensityComparison` | def_prop | `side24-proof` | `side24-coefficient` | — | +| `IntegrandRatioBounds` | def_prop | `side24-proof` | `side24-coefficient` | — | +| `ReferencePinDensityProduct` | def_prop | `side24-proof` | `side24-coefficient` | — | +| `ReferenceCoefficientIdentity` | def_prop | `side24-proof` | `side24-coefficient` | `Side24Elementary.referenceCoefficientIdentity` | +| `ConeMomentInterface` | structure | `side24-proof` | `side24-coefficient` | — | +| `NegDefCone` | def_prop | `side24-proof` | `side24-coefficient` | — | +| `ConeMomentD1Identity` | def_prop | `side24-proof` | `side24-coefficient` | — | +| `ConeMomentD2Identity` | def_prop | `side24-proof` | `side24-coefficient` | — | +| `ConeMomentD2Algebra` | def_prop | `side24-proof` | `side24-coefficient` | `Side24Elementary.coneMomentD2Algebra` | +| `TraceMoments` | def_prop | `side24-proof` | `side24-coefficient` | — | +| `RayleighSquareLaw` | def_prop | `side24-proof` | `side24-coefficient` | — | +| `ElementaryConeIntegral` | def_prop | `side24-proof` | `side24-coefficient` | `Side24Elementary.elementaryConeIntegral` | +| `PeriodicCoefficientInterface` | structure | `side24-proof` | `side24-coefficient`, `math.side24-coefficient` | — | +| `CoefficientEnclosure` | def_prop | `side24-proof` | `side24-coefficient`, `math.side24-coefficient` | — | +| `ReferenceComparison` | def_prop | `side24-proof` | `side24-coefficient`, `math.side24-coefficient` | — | ### `Specifications/RN.lean` (28 registered declarations) -| declaration | kind | source | registered under claim rows | -|---|---|---|---| -| `IsCriticalPoint` | def_prop | `lifetime-parent` | `rn-fixed-remote-window` | -| `HessianHasInertia` | def_prop | `lifetime-parent` | `rn-fixed-remote-window` | -| `HolderCountBoundN1` | def_prop | `rn-count-interface` | `rn-count-interface`, `math.rn-count-interface` | -| `HolderConsequenceN2` | def_prop | `rn-count-interface` | `rn-count-interface`, `math.rn-count-interface` | -| `ConditionalMeanIdentityN3` | def_prop | `rn-count-interface` | `rn-count-interface`, `math.rn-count-interface` | -| `UniformCounterexampleN4` | def_prop | `rn-count-interface` | `rn-count-interface`, `math.rn-count-interface` | -| `ExponentialTailLayerCakeN5` | def_prop | `rn-count-interface` | `rn-count-interface`, `math.rn-count-interface` | -| `PinnedLawInterface` | structure | `rn-fixed-remote-window` | `rn-fixed-remote-window`, `math.rn-fixed-remote-window` | -| `FixedRemoteMeanMeasureA2` | def_prop | `rn-fixed-remote-window` | `rn-fixed-remote-window`, `math.rn-fixed-remote-window`, `math.rn-region.fixed-remote`, `math.d5-component.remote-window-proof` | -| `FixedRemoteCountBoundA3` | def_prop | `rn-fixed-remote-window` | `rn-fixed-remote-window`, `math.rn-fixed-remote-window`, `math.rn-region.fixed-remote`, `math.d5-component.remote-window-proof` | -| `FixedAnnulusWindowCandidateA2` | def_prop | `rn-fixed-annulus-window` | `rn-fixed-annulus-window`, `math.rn-fixed-annulus-window`, `math.rn-region.fixed-annulus-window` | -| `AnnulusBridgeAllHeight2` | def_prop | `rn-annulus-bridge` | `math.rn-region.mesoscopic-scaled-annulus`, `math.d5-component.annulus-proof` | -| `D5aPuncturedPinDisks` | def_prop | `d5-reconciliation` | `math.rn-region.pin-collision`, `math.d5-pin-neighborhood-first-moment`, `math.d5-component.punctured-pin-proof` | -| `D5bMicrodisk` | def_prop | `d5-reconciliation` | `math.rn-region.pin-collision`, `math.d5-pin-neighborhood-first-moment`, `math.d5-component.punctured-pin-proof` | -| `D5cCollarC1` | def_prop | `d5-reconciliation` | `math.d5-pin-neighborhood-first-moment`, `math.d5-component.collar-proof` | -| `D5dSummedPinNeighbourhoodC2` | def_prop | `d5-reconciliation` | `math.rn-region.mesoscopic-scaled-annulus`, `math.rn-region.pin-collision`, `math.d5-pin-neighborhood-first-moment` | -| `D5eIntermediateShellsI3I4` | def_prop | `d5-reconciliation` | `math.rn-region.intermediate-r-to-rho`, `math.d5-pin-neighborhood-first-moment`, `math.d5-component.intermediate-window-proof` | -| `D5fGlobalWindowFirstMomentI5` | def_prop | `d5-reconciliation` | `math.d5-pin-neighborhood-first-moment`, `math.d5-component.intermediate-window-proof` | -| `DimensionLiftPuncturedPinBallP` | def_prop | `d5-dimension-lift` | `CL-D5-DIMENSION-LIFT-20260929-v1` | -| `DimensionLiftCompactCollarC` | def_prop | `d5-dimension-lift` | `CL-D5-DIMENSION-LIFT-20260929-v1` | -| `DimensionLiftIntermediateShellsI` | def_prop | `d5-dimension-lift` | `CL-D5-DIMENSION-LIFT-20260929-v1` | -| `DimensionLiftGlobalWindowG` | def_prop | `d5-dimension-lift` | `CL-D5-DIMENSION-LIFT-20260929-v1` | -| `FourierCutoffPlanarSecondFactorialF4` | def_prop | `c6-fourier-cutoff` | `OA-C6-FOURIER-20260929-v1` | -| `PalmRouteFactorialMomentsQ` | def_prop | `c6-palm-route` | `CL-C6-PALM-20260929-v1` | -| `PalmRouteSecondFactorialTheta` | def_prop | `c6-palm-route` | `CL-C6-PALM-20260929-v1` | -| `RareClusterPoissonObstructionO` | def_prop | `c6-rare-cluster` | `OA-C6-RARE-CLUSTER-20260929-v1` | -| `RemoteCollisionSecondFactorialD` | def_prop | `remote-collision` | `math.rn-region.witness-collision`, `CL-D5-REMOTE-COLLISION-20260928-v1` | -| `WitnessCollisionNearPinPairsTarget` | def_prop | `d5-reconciliation` | `math.rn-region.witness-collision` | +| declaration | kind | source | registered under claim rows | proved by (proof packet, `proved`; kernel-checked by hosted run 38121713840: PR head 910809d6, actual tested merge 5b198699… with base b2d70d77…, same tree as the head) | +|---|---|---|---|---| +| `IsCriticalPoint` | def_prop | `lifetime-parent` | `rn-fixed-remote-window` | — | +| `HessianHasInertia` | def_prop | `lifetime-parent` | `rn-fixed-remote-window` | — | +| `HolderCountBoundN1` | def_prop | `rn-count-interface` | `rn-count-interface`, `math.rn-count-interface` | `RNProbability.holderCountBoundN1` | +| `HolderConsequenceN2` | def_prop | `rn-count-interface` | `rn-count-interface`, `math.rn-count-interface` | `RNProbability.holderConsequenceN2` | +| `ConditionalMeanIdentityN3` | def_prop | `rn-count-interface` | `rn-count-interface`, `math.rn-count-interface` | `RNProbability.conditionalMeanIdentityN3` | +| `UniformCounterexampleN4` | def_prop | `rn-count-interface` | `rn-count-interface`, `math.rn-count-interface` | `RNProbability.uniformCounterexampleN4` | +| `ExponentialTailLayerCakeN5` | def_prop | `rn-count-interface` | `rn-count-interface`, `math.rn-count-interface` | `RNProbability.exponentialTailLayerCakeN5` | +| `PinnedLawInterface` | structure | `rn-fixed-remote-window` | `rn-fixed-remote-window`, `math.rn-fixed-remote-window` | — | +| `FixedRemoteMeanMeasureA2` | def_prop | `rn-fixed-remote-window` | `rn-fixed-remote-window`, `math.rn-fixed-remote-window`, `math.rn-region.fixed-remote`, `math.d5-component.remote-window-proof` | — | +| `FixedRemoteCountBoundA3` | def_prop | `rn-fixed-remote-window` | `rn-fixed-remote-window`, `math.rn-fixed-remote-window`, `math.rn-region.fixed-remote`, `math.d5-component.remote-window-proof` | — | +| `FixedAnnulusWindowCandidateA2` | def_prop | `rn-fixed-annulus-window` | `rn-fixed-annulus-window`, `math.rn-fixed-annulus-window`, `math.rn-region.fixed-annulus-window` | — | +| `AnnulusBridgeAllHeight2` | def_prop | `rn-annulus-bridge` | `math.rn-region.mesoscopic-scaled-annulus`, `math.d5-component.annulus-proof` | — | +| `D5aPuncturedPinDisks` | def_prop | `d5-reconciliation` | `math.rn-region.pin-collision`, `math.d5-pin-neighborhood-first-moment`, `math.d5-component.punctured-pin-proof` | — | +| `D5bMicrodisk` | def_prop | `d5-reconciliation` | `math.rn-region.pin-collision`, `math.d5-pin-neighborhood-first-moment`, `math.d5-component.punctured-pin-proof` | — | +| `D5cCollarC1` | def_prop | `d5-reconciliation` | `math.d5-pin-neighborhood-first-moment`, `math.d5-component.collar-proof` | — | +| `D5dSummedPinNeighbourhoodC2` | def_prop | `d5-reconciliation` | `math.rn-region.mesoscopic-scaled-annulus`, `math.rn-region.pin-collision`, `math.d5-pin-neighborhood-first-moment` | — | +| `D5eIntermediateShellsI3I4` | def_prop | `d5-reconciliation` | `math.rn-region.intermediate-r-to-rho`, `math.d5-pin-neighborhood-first-moment`, `math.d5-component.intermediate-window-proof` | — | +| `D5fGlobalWindowFirstMomentI5` | def_prop | `d5-reconciliation` | `math.d5-pin-neighborhood-first-moment`, `math.d5-component.intermediate-window-proof` | — | +| `DimensionLiftPuncturedPinBallP` | def_prop | `d5-dimension-lift` | `CL-D5-DIMENSION-LIFT-20260929-v1` | — | +| `DimensionLiftCompactCollarC` | def_prop | `d5-dimension-lift` | `CL-D5-DIMENSION-LIFT-20260929-v1` | — | +| `DimensionLiftIntermediateShellsI` | def_prop | `d5-dimension-lift` | `CL-D5-DIMENSION-LIFT-20260929-v1` | — | +| `DimensionLiftGlobalWindowG` | def_prop | `d5-dimension-lift` | `CL-D5-DIMENSION-LIFT-20260929-v1` | — | +| `FourierCutoffPlanarSecondFactorialF4` | def_prop | `c6-fourier-cutoff` | `OA-C6-FOURIER-20260929-v1` | — | +| `PalmRouteFactorialMomentsQ` | def_prop | `c6-palm-route` | `CL-C6-PALM-20260929-v1` | — | +| `PalmRouteSecondFactorialTheta` | def_prop | `c6-palm-route` | `CL-C6-PALM-20260929-v1` | — | +| `RareClusterPoissonObstructionO` | def_prop | `c6-rare-cluster` | `OA-C6-RARE-CLUSTER-20260929-v1` | — | +| `RemoteCollisionSecondFactorialD` | def_prop | `remote-collision` | `math.rn-region.witness-collision`, `CL-D5-REMOTE-COLLISION-20260928-v1` | — | +| `WitnessCollisionNearPinPairsTarget` | def_prop | `d5-reconciliation` | `math.rn-region.witness-collision` | — | ### `Specifications/P15.lean` (58 registered declarations) -| declaration | kind | source | registered under claim rows | -|---|---|---|---| -| `RealizedData` | structure | `p15-realized-covers` | `p15-realized-covers` | -| `IsRealizedFamily` | def_prop | `p15-realized-covers` | `p15-realized-covers` | -| `IsGood` | def_prop | `p15-realized-covers` | `p15-realized-covers` | -| `IsKDecomposable` | def_prop | `p15-realized-covers` | `p15-realized-covers` | -| `IsGeneratorCover` | def_prop | `p15-realized-covers` | `p15-realized-covers` | -| `IsPaletteFeasible` | def_prop | `p15-realized-covers` | `p15-realized-covers` | -| `PaletteNumberAttained` | def_prop | `p15-realized-covers` | `p15-realized-covers` | -| `IsMinimalForbidden` | def_prop | `p15-realized-covers` | `p15-realized-covers` | -| `IsTransversal` | def_prop | `p15-realized-covers` | `p15-realized-covers` | -| `MinimalForbiddenCharacterisation` | def_prop | `p15-realized-covers` | `p15-realized-covers` | -| `LocalRestriction` | def_prop | `p15-realized-covers` | `p15-realized-covers` | -| `LocalDecomposability` | def_prop | `p15-realized-covers` | `p15-realized-covers` | -| `LocalObstructionIsFullBlock` | def_prop | `p15-realized-covers` | `p15-realized-covers` | -| `LocalPriceChain` | def_prop | `p15-realized-covers` | `p15-realized-covers` | -| `IndependentBlockHazard` | def_prop | `p15-realized-covers` | `p15-realized-covers` | -| `FullBlockCoverIff` | def_prop | `p15-realized-covers` | `p15-realized-covers` | -| `CoverCostHazardBound` | def_prop | `p15-realized-covers` | `p15-realized-covers` | -| `WholeGroundChromaticNumber` | def_prop | `p15-realized-covers` | `p15-realized-covers` | -| `ElementaryPaletteFormula` | def_prop | `p15-realized-covers` | `p15-realized-covers` | -| `TriangleNeedsThree` | def_prop | `p15-realized-covers` | `p15-realized-covers` | -| `Benchmark816IsRealized` | def_prop | `p15-realized-covers` | `p15-realized-covers` | -| `Benchmark816Palette` | def_prop | `p15-realized-covers` | `p15-realized-covers` | -| `Benchmark816Cover` | def_prop | `p15-realized-covers` | `p15-realized-covers` | -| `Benchmark816WholeGround` | def_prop | `p15-realized-covers` | `p15-realized-covers` | -| `Benchmark816MinimalForbiddenCounts` | def_prop | `p15-realized-covers` | `p15-realized-covers` | -| `Benchmark816Price` | def_prop | `p15-realized-covers` | `p15-realized-covers` | -| `Benchmark816UnionBound` | def_prop | `p15-realized-covers` | `p15-realized-covers` | -| `TwoCoordGeneratorPrices` | def_prop | `p15-price-boundary` | `p15-price-boundary`, `math.p15-price-boundary` | -| `DemandOneRefutation` | def_prop | `p15-price-boundary` | `p15-price-boundary`, `math.p15-price-boundary` | -| `LogOnePlusBelowIdentity` | def_prop | `p15-price-boundary` | `p15-price-boundary` | -| `LogRatioBound` | def_prop | `p15-price-budget` | `p15-price-budget-restricted` | -| `RatioExponentBound` | def_prop | `p15-price-budget` | `p15-price-budget-restricted` | -| `RestrictedLocalBudget` | def_prop | `p15-price-budget` | `p15-price-budget-restricted` | -| `RestrictedTransformedPriceBudget` | def_prop | `p15-price-budget` | `p15-price-budget-restricted` | -| `RhoTestSufficient` | def_prop | `p15-price-budget` | `p15-price-budget-restricted` | -| `CapTestAtTwoThirds` | def_prop | `p15-price-budget` | `p15-price-budget-restricted` | -| `Benchmark816TransformedRange` | def_prop | `p15-price-budget` | `p15-price-budget-restricted` | -| `Benchmark816RationalPrice` | def_prop | `p15-price-budget` | `p15-price-budget-restricted` | -| `FullTransformedPriceBudget` | def_prop | `p15-full-price` | `p15-full-price`, `math.p15-full-price` | -| `RhoStarEnclosure` | def_prop | `p15-full-price` | `p15-full-price`, `math.p15-full-price` | -| `RhoStarBelowSixSevenths` | def_prop | `p15-full-price` | `p15-full-price` | -| `IsProperDownset` | def_prop | `p15-full-price` | `p15-full-price` | -| `HazardStarPositive` | def_prop | `p15-full-price` | `p15-full-price` | -| `CoordinatewiseConcavity` | def_prop | `p15-full-price` | `p15-full-price` | -| `HazardProductBound` | def_prop | `p15-full-price` | `p15-full-price` | -| `HazardPhiBound` | def_prop | `p15-full-price` | `p15-full-price` | -| `FullGroundPriceBound` | def_prop | `p15-full-price` | `p15-full-price` | -| `PhiAtPStar` | def_prop | `p15-full-price` | `p15-full-price` | -| `FullGroundBudgetIff` | def_prop | `p15-full-price` | `p15-full-price` | -| `CapacityHazardIsBinomial` | def_prop | `p15-full-price` | `p15-full-price` | -| `OddMajorityIdentity` | def_prop | `p15-full-price` | `p15-full-price` | -| `CapacityWorstCase` | def_prop | `p15-full-price` | `p15-full-price` | -| `HStarExceedsOne` | def_prop | `p15-full-price` | `p15-full-price` | -| `LocalPriceBoundFull` | def_prop | `p15-full-price` | `p15-full-price` | -| `GlobalAssemblyHazard` | def_prop | `p15-full-price` | `p15-full-price` | -| `SharpnessOfRhoStar` | def_prop | `p15-full-price` | `p15-full-price`, `math.p15-full-price` | -| `DemandOneBoundary` | def_prop | `p15-full-price` | `p15-full-price` | -| `SixSeventhsCertificate` | def_prop | `p15-full-price` | `p15-full-price` | +| declaration | kind | source | registered under claim rows | proved by (proof packet, `proved`; kernel-checked by hosted run 38121713840: PR head 910809d6, actual tested merge 5b198699… with base b2d70d77…, same tree as the head) | +|---|---|---|---|---| +| `RealizedData` | structure | `p15-realized-covers` | `p15-realized-covers` | — | +| `IsRealizedFamily` | def_prop | `p15-realized-covers` | `p15-realized-covers` | — | +| `IsGood` | def_prop | `p15-realized-covers` | `p15-realized-covers` | — | +| `IsKDecomposable` | def_prop | `p15-realized-covers` | `p15-realized-covers` | — | +| `IsGeneratorCover` | def_prop | `p15-realized-covers` | `p15-realized-covers` | — | +| `IsPaletteFeasible` | def_prop | `p15-realized-covers` | `p15-realized-covers` | — | +| `PaletteNumberAttained` | def_prop | `p15-realized-covers` | `p15-realized-covers` | `P15Covers.paletteNumberAttained` | +| `IsMinimalForbidden` | def_prop | `p15-realized-covers` | `p15-realized-covers` | — | +| `IsTransversal` | def_prop | `p15-realized-covers` | `p15-realized-covers` | — | +| `MinimalForbiddenCharacterisation` | def_prop | `p15-realized-covers` | `p15-realized-covers` | `P15Structure.minimalForbiddenCharacterisation` | +| `LocalRestriction` | def_prop | `p15-realized-covers` | `p15-realized-covers` | `P15Covers.localRestriction` | +| `LocalDecomposability` | def_prop | `p15-realized-covers` | `p15-realized-covers` | `P15Structure.localDecomposability` | +| `LocalObstructionIsFullBlock` | def_prop | `p15-realized-covers` | `p15-realized-covers` | `P15Structure.localObstructionIsFullBlock` | +| `LocalPriceChain` | def_prop | `p15-realized-covers` | `p15-realized-covers` | `P15Hazard.localPriceChain` | +| `IndependentBlockHazard` | def_prop | `p15-realized-covers` | `p15-realized-covers` | `P15Hazard.independentBlockHazard` | +| `FullBlockCoverIff` | def_prop | `p15-realized-covers` | `p15-realized-covers` | `P15Structure.fullBlockCoverIff` | +| `CoverCostHazardBound` | def_prop | `p15-realized-covers` | `p15-realized-covers` | `P15Budget.coverCostHazardBound` | +| `WholeGroundChromaticNumber` | def_prop | `p15-realized-covers` | `p15-realized-covers` | `P15Structure.wholeGroundChromaticNumber` | +| `ElementaryPaletteFormula` | def_prop | `p15-realized-covers` | `p15-realized-covers` | `P15Structure.elementaryPaletteFormula` | +| `TriangleNeedsThree` | def_prop | `p15-realized-covers` | `p15-realized-covers` | `P15Elementary.triangleNeedsThree`, `P15Structure.triangleNeedsThree` | +| `Benchmark816IsRealized` | def_prop | `p15-realized-covers` | `p15-realized-covers` | `P15Structure.benchmark816IsRealized` | +| `Benchmark816Palette` | def_prop | `p15-realized-covers` | `p15-realized-covers` | `P15Structure.benchmark816Palette` | +| `Benchmark816Cover` | def_prop | `p15-realized-covers` | `p15-realized-covers` | `P15Covers.benchmark816Cover` | +| `Benchmark816WholeGround` | def_prop | `p15-realized-covers` | `p15-realized-covers` | `P15Structure.benchmark816WholeGround` | +| `Benchmark816MinimalForbiddenCounts` | def_prop | `p15-realized-covers` | `p15-realized-covers` | `P15Structure.benchmark816MinimalForbiddenCounts` | +| `Benchmark816Price` | def_prop | `p15-realized-covers` | `p15-realized-covers` | `P15Structure.benchmark816Price` | +| `Benchmark816UnionBound` | def_prop | `p15-realized-covers` | `p15-realized-covers` | `P15Covers.benchmark816UnionBound` | +| `TwoCoordGeneratorPrices` | def_prop | `p15-price-boundary` | `p15-price-boundary`, `math.p15-price-boundary` | `P15Elementary.twoCoordGeneratorPrices` | +| `DemandOneRefutation` | def_prop | `p15-price-boundary` | `p15-price-boundary`, `math.p15-price-boundary` | `P15Elementary.demandOneRefutation` | +| `LogOnePlusBelowIdentity` | def_prop | `p15-price-boundary` | `p15-price-boundary` | `P15Elementary.logOnePlusBelowIdentity` | +| `LogRatioBound` | def_prop | `p15-price-budget` | `p15-price-budget-restricted` | `P15Elementary.logRatioBound` | +| `RatioExponentBound` | def_prop | `p15-price-budget` | `p15-price-budget-restricted` | `P15Elementary.ratioExponentBound` | +| `RestrictedLocalBudget` | def_prop | `p15-price-budget` | `p15-price-budget-restricted` | `P15Budget.restrictedLocalBudget` | +| `RestrictedTransformedPriceBudget` | def_prop | `p15-price-budget` | `p15-price-budget-restricted` | `P15Budget.restrictedTransformedPriceBudget` | +| `RhoTestSufficient` | def_prop | `p15-price-budget` | `p15-price-budget-restricted` | `P15Budget.rhoTestSufficient` | +| `CapTestAtTwoThirds` | def_prop | `p15-price-budget` | `p15-price-budget-restricted` | `P15Elementary.capTestAtTwoThirds` | +| `Benchmark816TransformedRange` | def_prop | `p15-price-budget` | `p15-price-budget-restricted` | `P15Budget.benchmark816TransformedRange` | +| `Benchmark816RationalPrice` | def_prop | `p15-price-budget` | `p15-price-budget-restricted` | `P15Structure.benchmark816RationalPrice` | +| `FullTransformedPriceBudget` | def_prop | `p15-full-price` | `p15-full-price`, `math.p15-full-price` | — | +| `RhoStarEnclosure` | def_prop | `p15-full-price` | `p15-full-price`, `math.p15-full-price` | — | +| `RhoStarBelowSixSevenths` | def_prop | `p15-full-price` | `p15-full-price` | `P15Elementary.rhoStarBelowSixSevenths` | +| `IsProperDownset` | def_prop | `p15-full-price` | `p15-full-price` | — | +| `HazardStarPositive` | def_prop | `p15-full-price` | `p15-full-price` | `P15Elementary.hazardStarPositive` | +| `CoordinatewiseConcavity` | def_prop | `p15-full-price` | `p15-full-price` | — | +| `HazardProductBound` | def_prop | `p15-full-price` | `p15-full-price` | — | +| `HazardPhiBound` | def_prop | `p15-full-price` | `p15-full-price` | — | +| `FullGroundPriceBound` | def_prop | `p15-full-price` | `p15-full-price` | — | +| `PhiAtPStar` | def_prop | `p15-full-price` | `p15-full-price` | `P15Elementary.phiAtPStar` | +| `FullGroundBudgetIff` | def_prop | `p15-full-price` | `p15-full-price` | — | +| `CapacityHazardIsBinomial` | def_prop | `p15-full-price` | `p15-full-price` | `P15Elementary.capacityHazardIsBinomial` | +| `OddMajorityIdentity` | def_prop | `p15-full-price` | `p15-full-price` | `P15Elementary.oddMajorityIdentity` | +| `CapacityWorstCase` | def_prop | `p15-full-price` | `p15-full-price` | `P15Elementary.capacityWorstCase` | +| `HStarExceedsOne` | def_prop | `p15-full-price` | `p15-full-price` | `P15Elementary.hStarExceedsOne` | +| `LocalPriceBoundFull` | def_prop | `p15-full-price` | `p15-full-price` | — | +| `GlobalAssemblyHazard` | def_prop | `p15-full-price` | `p15-full-price` | `P15Hazard.globalAssemblyHazard` | +| `SharpnessOfRhoStar` | def_prop | `p15-full-price` | `p15-full-price`, `math.p15-full-price` | `P15Elementary.sharpnessOfRhoStar` | +| `DemandOneBoundary` | def_prop | `p15-full-price` | `p15-full-price` | `P15Elementary.demandOneBoundary` | +| `SixSeventhsCertificate` | def_prop | `p15-full-price` | `p15-full-price` | `P15Elementary.sixSeventhsCertificate` | ## Claims -171 claim rows: 10 `landing_claim`, 33 `graph_node`, 2 `open_obligation`, 95 `proof_index_result`, 7 `existing_lean_package`, 12 `main_experiment_proof`, 12 `exact_certificate`. Claim-level formal progress: 33 `specified` (a `def … : Prop` stating the claim itself is registered), 138 `none`; no research claim is `proved` or `kernel-checked`. 197 statement entries point at the 150 declarations of this package (all `specified`); 31 statement entries are kernel-proved arithmetic theorems of main's `formal/` package (label `proved`: the 31 Side24 targets at origin/main `f6deeba7`; main's 28 P15 arithmetic targets are NOT listed because they exist only in this programme's uncommitted main worktree, on no commit), listed as the arithmetic skeleton of the claim they sit under and never as the claim. `disposition` is the verbatim LANDING_CLAIMS value or `—` (null). Nothing in these tables is a scientific status, a review verdict or an acceptance; alignment of every statement is `PENDING_INDEPENDENT_REVIEW`. +171 claim rows: 10 `landing_claim`, 33 `graph_node`, 2 `open_obligation`, 95 `proof_index_result`, 7 `existing_lean_package`, 12 `main_experiment_proof`, 12 `exact_certificate`. Claim-level formal progress: 33 `specified` (a `def … : Prop` stating the claim itself is registered), 138 `none`; no research claim is `proved` or `kernel-checked`. 197 statement entries point at the 150 declarations of this package (all `specified`). 132 statement entries carry the label `proved` and are theorems of other packages, listed as the arithmetic skeleton or the Prop-level proof of the claim they sit under and never as the claim: 31 are the 31 Side24 arithmetic targets of main's `formal/` at origin/main `f6deeba7`; 41 are the 28 P15 arithmetic targets of main's `formal/` at `91cffbb5` (main PR #358, not yet on main; kernel evidence the hosted workspace-landing run 38096827443), each listed on every P15 row whose layer 0 source it anchors to; 60 are theorems of the proof packet `specifications/lean_statement_proofs_20261011` whose type is exactly a registered Prop of this package (52 theorems, 51 distinct Props, each listed on every row that registers its Prop; the hosted `lean-specification-proofs.yml` run 38121713840 receipted all of them as kernel-checked and run 38116277597 the first 38; a pull_request run checks out the synthetic merge of the PR head into the base, which the receipt records as checked_commit: run 38121713840 PR head 910809d6, actual tested merge 5b198699308e0585904c21d12bf540cf2475d2f0 with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2; run 38116277597 PR head 00d2ac6e, actual tested merge c4c66bb8cb26f0cd9bc03d52bb25f1b3925b272c with the same base; run 38122386459 corroborates on PR head d9b8dd33, actual tested merge 866136cca66b46e6dbd3186b47c9340f7e93b4f6; same trees as the heads). Exactly one Prop registered as stating a claim itself has such a theorem: `DemandOneRefutation` on rows `p15-price-boundary` and `math.p15-price-boundary`; their claim-level label stays `specified` (the register admits only none/specified at claim level, alignment of the Prop with the source paragraph is PENDING_INDEPENDENT_REVIEW, and a receipt is about the Prop only), as the rows' `not established` cells record. `disposition` is the verbatim LANDING_CLAIMS value or `—` (null). Nothing in these tables is a scientific status, a review verdict or an acceptance; alignment of every statement is `PENDING_INDEPENDENT_REVIEW`. | claim_id | kind | disposition (LANDING_CLAIMS, verbatim) | formal_progress | layer 0 source | statements | |---|---|---|---|---|---| -| `side24-coefficient` | landing_claim | REVIEWED_SCOPED | `specified` | `side24-proof` | 28 specified: `ThetaSummable`, `IsUnitTuple`, `DerivativePairingBound`, `DerivativeBoundAtLeastOne`, `DerivativeBoundAtZero`, `LatticeImageSumBound`, `SuccessiveTermRatio`, `ExponentialBounds`, `ImageBound`, `CovarianceOrdering`, `EntrywiseCovarianceBound`, `ReferenceCovarianceLowerBound`, `ReferenceOddAndPinBlocks`, `DensityComparison`, `IntegrandRatioBounds`, `ReferencePinDensityProduct`, `ReferenceCoefficientIdentity`, `ConeMomentInterface`, `NegDefCone`, `ConeMomentD1Identity`, `ConeMomentD2Identity`, `ConeMomentD2Algebra`, `TraceMoments`, `RayleighSquareLaw`, `ElementaryConeIntegral`, `PeriodicCoefficientInterface`, `CoefficientEnclosure`, `ReferenceComparison`; 27 proved (main): `pairing_sum_six`, `pairing_sum_le_six`, `pairing_terms_six`, `sixth_moment_double_factorial`, `lattice_shell_constant`, `geometric_ratio_constants`, `period_exponent`, `image_constant_value`, `exp_taylor_partial_sum_gt_ten`, `covariance_relative_bound`, `odd_block_eigenvalues`, `odd_block_shifted_minors`, `smaller_eigenvalue_exceeds_third`, `exponent_bounds`, `exponent_values`, `ratio_constant_ordering`, `density_comparison_below_reported`, `conditional_third_derivative_variance`, `transverse_covariance_entries_thirds`, `cone_moment_m1_thirds`, `trace_and_traceless_variances`, `fourth_moment_of_trace`, `exponential_moment_of_trace`, `cone_moment_m2_algebra`, `cube_root_simplification`, `pin_determinant_and_joint_dimension`, `hessian_block_eigenvalues` | +| `side24-coefficient` | landing_claim | REVIEWED_SCOPED | `specified` | `side24-proof` | 28 specified: `ThetaSummable`, `IsUnitTuple`, `DerivativePairingBound`, `DerivativeBoundAtLeastOne`, `DerivativeBoundAtZero`, `LatticeImageSumBound`, `SuccessiveTermRatio`, `ExponentialBounds`, `ImageBound`, `CovarianceOrdering`, `EntrywiseCovarianceBound`, `ReferenceCovarianceLowerBound`, `ReferenceOddAndPinBlocks`, `DensityComparison`, `IntegrandRatioBounds`, `ReferencePinDensityProduct`, `ReferenceCoefficientIdentity`, `ConeMomentInterface`, `NegDefCone`, `ConeMomentD1Identity`, `ConeMomentD2Identity`, `ConeMomentD2Algebra`, `TraceMoments`, `RayleighSquareLaw`, `ElementaryConeIntegral`, `PeriodicCoefficientInterface`, `CoefficientEnclosure`, `ReferenceComparison`; 27 proved (main, origin/main f6deeba7): `pairing_sum_six`, `pairing_sum_le_six`, `pairing_terms_six`, `sixth_moment_double_factorial`, `lattice_shell_constant`, `geometric_ratio_constants`, `period_exponent`, `image_constant_value`, `exp_taylor_partial_sum_gt_ten`, `covariance_relative_bound`, `odd_block_eigenvalues`, `odd_block_shifted_minors`, `smaller_eigenvalue_exceeds_third`, `exponent_bounds`, `exponent_values`, `ratio_constant_ordering`, `density_comparison_below_reported`, `conditional_third_derivative_variance`, `transverse_covariance_entries_thirds`, `cone_moment_m1_thirds`, `trace_and_traceless_variances`, `fourth_moment_of_trace`, `exponential_moment_of_trace`, `cone_moment_m2_algebra`, `cube_root_simplification`, `pin_determinant_and_joint_dimension`, `hessian_block_eigenvalues`; 5 proved (proof packet): `Side24Elementary.exponentialBounds`, `Side24Elementary.successiveTermRatio`, `Side24Elementary.coneMomentD2Algebra`, `Side24Elementary.referenceCoefficientIdentity`, `Side24Elementary.elementaryConeIntegral` | | `lifetime-remainder` | landing_claim | REVIEWED_SCOPED | `specified` | `lifetime-remainder` | 4 specified: `RemainderBoundedR1`, `IsUnrestrictedPair`, `IsUnrestrictedLeadingCoefficient`, `IsLifetimeDensityVersion` | -| `rn-count-interface` | landing_claim | HOLD_WITH_DOMAIN | `none` | `rn-count-interface` | 5 specified: `HolderCountBoundN1`, `HolderConsequenceN2`, `ConditionalMeanIdentityN3`, `UniformCounterexampleN4`, `ExponentialTailLayerCakeN5` | +| `rn-count-interface` | landing_claim | HOLD_WITH_DOMAIN | `none` | `rn-count-interface` | 5 specified: `HolderCountBoundN1`, `HolderConsequenceN2`, `ConditionalMeanIdentityN3`, `UniformCounterexampleN4`, `ExponentialTailLayerCakeN5`; 5 proved (proof packet): `RNProbability.conditionalMeanIdentityN3`, `RNProbability.holderCountBoundN1`, `RNProbability.holderConsequenceN2`, `RNProbability.uniformCounterexampleN4`, `RNProbability.exponentialTailLayerCakeN5` | | `rn-fixed-remote-window` | landing_claim | HOLD_WITH_DOMAIN | `specified` | `rn-fixed-remote-window` | 5 specified: `PinnedLawInterface`, `IsCriticalPoint`, `HessianHasInertia`, `FixedRemoteMeanMeasureA2`, `FixedRemoteCountBoundA3` | | `rn-fixed-annulus-window` | landing_claim | REVIEWED_SCOPED | `specified` | `rn-fixed-annulus-window` | 1 specified: `FixedAnnulusWindowCandidateA2` | -| `p15-realized-covers` | landing_claim | HOLD_WITH_DOMAIN | `specified` | `p15-realized-covers` | 27 specified: `RealizedData`, `IsRealizedFamily`, `IsGood`, `IsKDecomposable`, `IsGeneratorCover`, `IsPaletteFeasible`, `PaletteNumberAttained`, `IsMinimalForbidden`, `IsTransversal`, `MinimalForbiddenCharacterisation`, `LocalRestriction`, `LocalDecomposability`, `LocalObstructionIsFullBlock`, `LocalPriceChain`, `IndependentBlockHazard`, `FullBlockCoverIff`, `CoverCostHazardBound`, `WholeGroundChromaticNumber`, `ElementaryPaletteFormula`, `TriangleNeedsThree`, `Benchmark816IsRealized`, `Benchmark816Palette`, `Benchmark816Cover`, `Benchmark816WholeGround`, `Benchmark816MinimalForbiddenCounts`, `Benchmark816Price`, `Benchmark816UnionBound` | -| `p15-price-boundary` | landing_claim | EXACT_COUNTEREXAMPLE | `specified` | `p15-price-boundary` | 3 specified: `TwoCoordGeneratorPrices`, `DemandOneRefutation`, `LogOnePlusBelowIdentity` | -| `p15-price-budget-restricted` | landing_claim | HOLD_WITH_DOMAIN | `specified` | `p15-price-budget` | 8 specified: `LogRatioBound`, `RatioExponentBound`, `RestrictedLocalBudget`, `RestrictedTransformedPriceBudget`, `RhoTestSufficient`, `CapTestAtTwoThirds`, `Benchmark816TransformedRange`, `Benchmark816RationalPrice` | -| `p15-full-price` | landing_claim | REVIEWED_SCOPED | `specified` | `p15-full-price` | 20 specified: `FullTransformedPriceBudget`, `RhoStarEnclosure`, `RhoStarBelowSixSevenths`, `IsProperDownset`, `HazardStarPositive`, `CoordinatewiseConcavity`, `HazardProductBound`, `HazardPhiBound`, `FullGroundPriceBound`, `PhiAtPStar`, `FullGroundBudgetIff`, `CapacityHazardIsBinomial`, `OddMajorityIdentity`, `CapacityWorstCase`, `HStarExceedsOne`, `LocalPriceBoundFull`, `GlobalAssemblyHazard`, `SharpnessOfRhoStar`, `DemandOneBoundary`, `SixSeventhsCertificate` | +| `p15-realized-covers` | landing_claim | HOLD_WITH_DOMAIN | `specified` | `p15-realized-covers` | 27 specified: `RealizedData`, `IsRealizedFamily`, `IsGood`, `IsKDecomposable`, `IsGeneratorCover`, `IsPaletteFeasible`, `PaletteNumberAttained`, `IsMinimalForbidden`, `IsTransversal`, `MinimalForbiddenCharacterisation`, `LocalRestriction`, `LocalDecomposability`, `LocalObstructionIsFullBlock`, `LocalPriceChain`, `IndependentBlockHazard`, `FullBlockCoverIff`, `CoverCostHazardBound`, `WholeGroundChromaticNumber`, `ElementaryPaletteFormula`, `TriangleNeedsThree`, `Benchmark816IsRealized`, `Benchmark816Palette`, `Benchmark816Cover`, `Benchmark816WholeGround`, `Benchmark816MinimalForbiddenCounts`, `Benchmark816Price`, `Benchmark816UnionBound`; 12 proved (main 91cffbb5, PR #358, not on main): `benchmark_block_and_ground_sizes`, `four_block_supports_fifteen`, `minimal_forbidder_counts`, `palette_816_from_two_label_classes`, `palette_815_fails_by_counting`, `whole_ground_chromatic_818`, `elementary_palette_formula_instances`, `macro_triangle_three_colors`, `ceil_block_over_capacity_instances`, `block_occupancy_one_percent`, `low_failure_union_bound_arithmetic`, `cover_price_numerator_and_denominator_positive`; 20 proved (proof packet): `P15Elementary.triangleNeedsThree`, `P15Structure.benchmark816IsRealized`, `P15Structure.benchmark816Price`, `P15Structure.elementaryPaletteFormula`, `P15Structure.triangleNeedsThree`, `P15Structure.benchmark816Palette`, `P15Structure.localDecomposability`, `P15Structure.localObstructionIsFullBlock`, `P15Structure.fullBlockCoverIff`, `P15Structure.wholeGroundChromaticNumber`, `P15Structure.benchmark816WholeGround`, `P15Structure.minimalForbiddenCharacterisation`, `P15Structure.benchmark816MinimalForbiddenCounts`, `P15Hazard.localPriceChain`, `P15Hazard.independentBlockHazard`, `P15Covers.benchmark816Cover`, `P15Covers.localRestriction`, `P15Covers.paletteNumberAttained`, `P15Covers.benchmark816UnionBound`, `P15Budget.coverCostHazardBound` | +| `p15-price-boundary` | landing_claim | EXACT_COUNTEREXAMPLE | `specified` | `p15-price-boundary` | 3 specified: `TwoCoordGeneratorPrices`, `DemandOneRefutation`, `LogOnePlusBelowIdentity`; 6 proved (main 91cffbb5, PR #358, not on main): `smallest_member_block_size`, `demand_one_good_sets`, `demand_one_obstruction`, `good_measure_three_quarters`, `generator_prices_ninths`, `minimum_generator_price_exceeds_third`; 3 proved (proof packet): `P15Elementary.twoCoordGeneratorPrices`, `P15Elementary.logOnePlusBelowIdentity`, `P15Elementary.demandOneRefutation` | +| `p15-price-budget-restricted` | landing_claim | HOLD_WITH_DOMAIN | `specified` | `p15-price-budget` | 8 specified: `LogRatioBound`, `RatioExponentBound`, `RestrictedLocalBudget`, `RestrictedTransformedPriceBudget`, `RhoTestSufficient`, `CapTestAtTwoThirds`, `Benchmark816TransformedRange`, `Benchmark816RationalPrice`; 3 proved (main 91cffbb5, PR #358, not on main): `t3_ratio_at_minimal_block`, `t3_bound_finite_instances`, `explicit_rational_price_above_p`; 8 proved (proof packet): `P15Elementary.logRatioBound`, `P15Elementary.capTestAtTwoThirds`, `P15Elementary.ratioExponentBound`, `P15Structure.benchmark816RationalPrice`, `P15Budget.restrictedLocalBudget`, `P15Budget.rhoTestSufficient`, `P15Budget.restrictedTransformedPriceBudget`, `P15Budget.benchmark816TransformedRange` | +| `p15-full-price` | landing_claim | REVIEWED_SCOPED | `specified` | `p15-full-price` | 20 specified: `FullTransformedPriceBudget`, `RhoStarEnclosure`, `RhoStarBelowSixSevenths`, `IsProperDownset`, `HazardStarPositive`, `CoordinatewiseConcavity`, `HazardProductBound`, `HazardPhiBound`, `FullGroundPriceBound`, `PhiAtPStar`, `FullGroundBudgetIff`, `CapacityHazardIsBinomial`, `OddMajorityIdentity`, `CapacityWorstCase`, `HStarExceedsOne`, `LocalPriceBoundFull`, `GlobalAssemblyHazard`, `SharpnessOfRhoStar`, `DemandOneBoundary`, `SixSeventhsCertificate`; 7 proved (main 91cffbb5, PR #358, not on main): `rho_star_endpoints_adjacent`, `rho_star_upper_endpoint_below_six_sevenths`, `sixteen_twentysevenths_below_six_sevenths`, `minimal_block_size_instances`, `e_rational_bounds_ordering`, `exp_eleven_sixths_taylor_certificate`, `h_star_rational_certificate_constants`; 11 proved (proof packet): `P15Elementary.rhoStarBelowSixSevenths`, `P15Elementary.sixSeventhsCertificate`, `P15Elementary.hStarExceedsOne`, `P15Elementary.phiAtPStar`, `P15Elementary.hazardStarPositive`, `P15Elementary.oddMajorityIdentity`, `P15Elementary.capacityWorstCase`, `P15Elementary.demandOneBoundary`, `P15Elementary.capacityHazardIsBinomial`, `P15Elementary.sharpnessOfRhoStar`, `P15Hazard.globalAssemblyHazard` | | `downstream-hard-gate` | landing_claim | ENGINEERING_HOLD | `none` | `downstream-graph` | — | | `math.uniform-matrix-cap-lifetime` | graph_node | — | `specified` | `lifetime-parent` | 32 specified: `IsLPeriodic`, `IsSmooth`, `GaussianFieldInterface`, `IsCriticalPoint`, `HessianHasInertia`, `IsNondegMax`, `IsIndexSaddle`, `IsCandidatePair`, `IsMorseDistinct`, `SuperlevelBarInterface`, `IsFiniteBar`, `IsLifetimeDensityVersion`, `IsLPeriodic`, `IsSmooth`, `GaussianFieldInterface`, `IsCriticalPoint`, `HessianHasInertia`, `IsNondegMax`, `IsIndexSaddle`, `IsCandidatePair`, `IsMorseDistinct`, `SuperlevelBarInterface`, `IsFiniteBar`, `IsLifetimeDensityVersion`, `IsWindowPair`, `IsWindowElderPair`, `IsUnrestrictedPair`, `PairLawInterface`, `ParentUniformSelectionA`, `ParentCompactWindowDensityB`, `IsUnrestrictedLeadingCoefficient`, `ParentUnrestrictedLeadingDensityC` | | `math.d1-component.congruence-erratum` | graph_node | — | `none` | `downstream-graph` | — | @@ -243,7 +250,7 @@ ladder; it is `specified`. | `math.d1-component.reconciliation-record` | graph_node | — | `none` | `downstream-graph` | — | | `math.lifetime-remainder` | graph_node | — | `specified` | `lifetime-remainder` | 1 specified: `RemainderBoundedR1` | | `math.side24-coefficient` | graph_node | — | `specified` | `side24-proof` | 3 specified: `PeriodicCoefficientInterface`, `CoefficientEnclosure`, `ReferenceComparison` | -| `math.rn-count-interface` | graph_node | — | `none` | `rn-count-interface` | 5 specified: `HolderCountBoundN1`, `HolderConsequenceN2`, `ConditionalMeanIdentityN3`, `UniformCounterexampleN4`, `ExponentialTailLayerCakeN5` | +| `math.rn-count-interface` | graph_node | — | `none` | `rn-count-interface` | 5 specified: `HolderCountBoundN1`, `HolderConsequenceN2`, `ConditionalMeanIdentityN3`, `UniformCounterexampleN4`, `ExponentialTailLayerCakeN5`; 5 proved (proof packet): `RNProbability.conditionalMeanIdentityN3`, `RNProbability.holderCountBoundN1`, `RNProbability.holderConsequenceN2`, `RNProbability.uniformCounterexampleN4`, `RNProbability.exponentialTailLayerCakeN5` | | `math.rn-fixed-remote-window` | graph_node | — | `specified` | `rn-fixed-remote-window` | 3 specified: `PinnedLawInterface`, `FixedRemoteMeanMeasureA2`, `FixedRemoteCountBoundA3` | | `math.rn-region.fixed-remote` | graph_node | — | `specified` | `downstream-graph` | 2 specified: `FixedRemoteMeanMeasureA2`, `FixedRemoteCountBoundA3` | | `math.rn-region.mesoscopic-scaled-annulus` | graph_node | — | `specified` | `d5-reconciliation` | 2 specified: `D5dSummedPinNeighbourhoodC2`, `AnnulusBridgeAllHeight2` | @@ -251,8 +258,8 @@ ladder; it is `specified`. | `math.rn-region.intermediate-r-to-rho` | graph_node | — | `specified` | `d5-reconciliation` | 1 specified: `D5eIntermediateShellsI3I4` | | `math.rn-region.witness-collision` | open_obligation | — | `specified` | `d5-reconciliation` | 2 specified: `WitnessCollisionNearPinPairsTarget`, `RemoteCollisionSecondFactorialD` | | `math.rn-mesoscopic-reduction` | graph_node | — | `none` | `downstream-graph` | — | -| `math.p15-full-price` | graph_node | — | `specified` | `p15-full-price` | 3 specified: `FullTransformedPriceBudget`, `RhoStarEnclosure`, `SharpnessOfRhoStar` | -| `math.p15-price-boundary` | graph_node | — | `specified` | `p15-price-boundary` | 2 specified: `TwoCoordGeneratorPrices`, `DemandOneRefutation` | +| `math.p15-full-price` | graph_node | — | `specified` | `p15-full-price` | 3 specified: `FullTransformedPriceBudget`, `RhoStarEnclosure`, `SharpnessOfRhoStar`; 7 proved (main 91cffbb5, PR #358, not on main): `rho_star_endpoints_adjacent`, `rho_star_upper_endpoint_below_six_sevenths`, `sixteen_twentysevenths_below_six_sevenths`, `minimal_block_size_instances`, `e_rational_bounds_ordering`, `exp_eleven_sixths_taylor_certificate`, `h_star_rational_certificate_constants`; 1 proved (proof packet): `P15Elementary.sharpnessOfRhoStar` | +| `math.p15-price-boundary` | graph_node | — | `specified` | `p15-price-boundary` | 2 specified: `TwoCoordGeneratorPrices`, `DemandOneRefutation`; 6 proved (main 91cffbb5, PR #358, not on main): `smallest_member_block_size`, `demand_one_good_sets`, `demand_one_obstruction`, `good_measure_three_quarters`, `generator_prices_ninths`, `minimum_generator_price_exceeds_third`; 2 proved (proof packet): `P15Elementary.twoCoordGeneratorPrices`, `P15Elementary.demandOneRefutation` | | `math.rn-selector-region-crosswalk` | graph_node | — | `none` | `downstream-graph` | — | | `math.rn-fixed-annulus-window` | graph_node | — | `specified` | `rn-fixed-annulus-window` | 1 specified: `FixedAnnulusWindowCandidateA2` | | `math.rn-region.fixed-annulus-window` | graph_node | — | `specified` | `downstream-graph` | 1 specified: `FixedAnnulusWindowCandidateA2` | @@ -284,7 +291,7 @@ ladder; it is `specified`. | `CL-D5-REMOTE-COLLISION-20260928-v1` | proof_index_result | — | `none` | `remote-collision` | 1 specified: `RemoteCollisionSecondFactorialD` | | `cumulative-transfer-correction` | proof_index_result | — | `none` | `cumulative-transfer-correction` | — | | `hist.D0-RN-UNIF-historical-predicates` | open_obligation | — | `none` | `downstream-graph` | — | -| `lean:main-formal-UniversalLaw` | existing_lean_package | — | `none` | `side24-enclosure` | 4 proved (main): `d2_endpoints_adjacent`, `d3_endpoints_adjacent`, `d3_below_d2`, `endpoints_in_unit_tenth` | +| `lean:main-formal-UniversalLaw` | existing_lean_package | — | `none` | `side24-enclosure` | 4 proved (main, origin/main f6deeba7): `d2_endpoints_adjacent`, `d3_endpoints_adjacent`, `d3_below_d2`, `endpoints_in_unit_tenth` | | `lean:math-formal-ResearchFormalCoreR1` | existing_lean_package | — | `none` | `—` | — | | `lean:math-companion-d2_moment_bridge_20261006` | existing_lean_package | — | `none` | `—` | — | | `lean:math-companion-d2_square_schur_20261006` | existing_lean_package | — | `none` | `—` | — | @@ -345,6 +352,18 @@ Packets listed by PROOF_INDEX by id only (82 rows, kind `proof_index_result`, fo question (DESIGN honesty checklist). The register only records `PENDING_INDEPENDENT_REVIEW`. * Not a scientific status. Dispositions in the register are transcribed verbatim from `claims/LANDING_CLAIMS.json` at the pinned commit; the checker refuses any other value. +* Not changed by the proof packet. `specifications/lean_statement_proofs_20261011` depends on this + packet by path and holds 52 theorems whose type is exactly one of 51 registered Props (P15, Side24 + and RN families; see the last column of the declaration tables). The register lists those theorems + under the claim rows with label `proved`, the label of a committed proof package; `kernel-checked` + appears only in that packet's hosted run receipts (`lean-specification-proofs.yml`; run 38121713840 receipted all of its + theorems and run 38116277597 the first 38; each receipt's checked_commit is the synthetic merge of the PR head into the + base that a pull_request run checks out, not the head itself: run 38121713840 PR head 910809d6, actual tested merge 5b198699…; run 38116277597 + PR head 00d2ac6e, actual tested merge c4c66bb8…; both with base b2d70d77… and each with the same tree as its head). + The 150 declarations here remain `specified`; a kernel-checked theorem is evidence about its Prop + only, never about the informal claim, its alignment (PENDING_INDEPENDENT_REVIEW), review or + acceptance; no claim-level label is `proved`, including the one row (`p15-price-boundary`) whose + claim-stating Prop `DemandOneRefutation` has a theorem. * Not a kernel receipt for the research claims. `--execute` shows that the statements elaborate and depend on no axiom beyond `propext`, `Classical.choice`, `Quot.sound`; the receipt says `formalization_status: "specified"` and nothing stronger. diff --git a/specifications/lean_statements_20261010/REGISTER.json b/specifications/lean_statements_20261010/REGISTER.json index 4bcbd16e0..42f317888 100644 --- a/specifications/lean_statements_20261010/REGISTER.json +++ b/specifications/lean_statements_20261010/REGISTER.json @@ -733,6 +733,51 @@ "formal_progress": "proved", "anchor": "The reference Hessian block has eigenvalues d+2 on trace and2 on traceless matrices", "does_not_claim": "the spectral decomposition" + }, + { + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "module": "SpecificationProofs/Side24Elementary.lean", + "declaration": "UniversalLaw.Proofs.Side24Elementary.exponentialBounds", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "hence e^(-288)<10^(-125) and the geometric-ratio inequality follows too.", + "does_not_claim": "the lattice-image bound or display (2) of the source, any enclosure of the coefficient, nonauthor review or acceptance of SIDE24-COEFFICIENT-D23-20260924-v1." + }, + { + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "module": "SpecificationProofs/Side24Elementary.lean", + "declaration": "UniversalLaw.Proofs.Side24Elementary.successiveTermRatio", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "successive terms have ratio at most512e^(-864)<1/2.", + "does_not_claim": "the lattice-image sum bound `LatticeImageSumBound` (the geometric summation itself is not performed here), any enclosure of the coefficient, nonauthor review or acceptance." + }, + { + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "module": "SpecificationProofs/Side24Elementary.lean", + "declaration": "UniversalLaw.Proofs.Side24Elementary.coneMomentD2Algebra", + "kind": "theorem", + "formal_progress": "proved", + "anchor": " = 29/6-sqrt(6).", + "does_not_claim": "the Gaussian identity `ConeMomentD2Identity` (that `D_2` is the cone expectation), any enclosure of the coefficient, nonauthor review or acceptance." + }, + { + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "module": "SpecificationProofs/Side24Elementary.lean", + "declaration": "UniversalLaw.Proofs.Side24Elementary.referenceCoefficientIdentity", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "This eliminates BOTH the angular and cone integrals for the reference expression.", + "does_not_claim": "that the left side is the parent formula (15.2) evaluated at the reference law (rotational invariance of `K_infty` is not specified), the value of `Gamma (7/6)`, equality of the periodic and reference coefficients (the source says it is NOT claimed), any enclosure of the coefficient, nonauthor review or acceptance." + }, + { + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "module": "SpecificationProofs/Side24Elementary.lean", + "declaration": "UniversalLaw.Proofs.Side24Elementary.elementaryConeIntegral", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "integral_0^a (a-z)^2 e^(-z/2) dz/2 = a^2-4a+8-8e^(-a/2).", + "does_not_claim": "the Rayleigh law of `R^2` (`RayleighSquareLaw`), the cone-moment identity `ConeMomentD2Identity`, any enclosure of the coefficient, nonauthor review or acceptance." } ], "kernel_evidence": [ @@ -740,10 +785,15 @@ "package": "d6g8k5htny-coder/main formal/ (UniversalLaw, side24-arithmetic-skeleton)", "receipt_or_workflow": ".github/workflows/formal-verification.yml (tools/formal_gate_check.py --run-lean inside the required aggregate `verify`); receipt formal/.lake/formal-evidence/receipt.json is a workflow artifact, none is committed in tree", "note": "The 31 Side24 targets at origin/main f6deeba7 are decide-proved integer or cross-multiplied rational facts (manifest label `proved`; `kernel-checked` only in a run receipt). Arithmetic skeleton only: formal/SCOPE.md says none of them is the coefficient enclosure." + }, + { + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "receipt_or_workflow": ".github/workflows/lean-specification-proofs.yml; hosted run 38121713840 (PR head 910809d6; actual tested checkout the merge commit 5b198699308e0585904c21d12bf540cf2475d2f0 of that head into base b2d70d77876a10c365f5db5d3b6cafcf180af4e2, the synthetic merge GitHub builds for a pull_request run, whose tree equals the head's and which the receipt records as checked_commit) (job proof-evidence, artifact lean-specification-proofs-38121713840-1, sha256 640682d631d052f4903d66f506740ae8fa91d19185001e70a1502f404eb44175): receipt formalization_status kernel-checked, leanchecker PASS, theorem_count 52, worktree CLEAN; the 38 theorems of PR head 00d2ac6e were first receipted by run 38116277597 (actual tested merge c4c66bb8cb26f0cd9bc03d52bb25f1b3925b272c with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2, same tree as the head; artifact lean-specification-proofs-38116277597-1); corroborated on PR head d9b8dd33 by run 38122386459 (actual tested merge 866136cca66b46e6dbd3186b47c9340f7e93b4f6 with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2, same tree as the head; receipt formalization_status kernel-checked, theorem_count 52, worktree CLEAN; artifact lean-specification-proofs-38122386459-1, sha256 edd52190d6af5828e8229c161c3b77e87a540caf440070d66b1b7f415008ebc3)", + "note": "5 theorem(s) of this row (Side24Elementary.exponentialBounds, Side24Elementary.successiveTermRatio, Side24Elementary.coneMomentD2Algebra, Side24Elementary.referenceCoefficientIdentity, Side24Elementary.elementaryConeIntegral) are inventoried by the proof packet's check.py (source mode SOURCE_CHECK_PASS: 52 inventory theorems over SpecificationProofs/{P15Elementary,P15Structure,P15Hazard,P15Covers,P15Budget,Side24Elementary,RNProbability}.lean, 51 distinct registered Props, each theorem typed exactly as its registered Prop, applied to its own parameters). 5 of them (Side24Elementary.exponentialBounds, Side24Elementary.successiveTermRatio, Side24Elementary.coneMomentD2Algebra, Side24Elementary.referenceCoefficientIdentity, Side24Elementary.elementaryConeIntegral) are among the 38 theorems of PR head 00d2ac6e kernel-checked by the hosted run 38116277597 (actual tested merge c4c66bb8cb26f0cd9bc03d52bb25f1b3925b272c with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2; job proof-evidence: fresh build, leanchecker PASS, `#print axioms` within {propext, Classical.choice, Quot.sound} for each, receipt formalization_status kernel-checked, worktree CLEAN; artifact lean-specification-proofs-38116277597-1), and again by the hosted run 38121713840 (PR head 910809d6; actual tested merge 5b198699308e0585904c21d12bf540cf2475d2f0 with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2). `proved` is the label of a committed proof package; `kernel-checked` appears only in a run receipt. Evidence about the registered Props only: not about the informal claim, its alignment (PENDING_INDEPENDENT_REVIEW), review or acceptance; the claim-level label is unchanged; organizational-independence credit 0 (Anthropic / Claude)." } ], - "not_established": "Nothing here encloses the coefficient. CoefficientEnclosure and ReferenceComparison are statements for any object satisfying PeriodicCoefficientInterface; the interface takes the cone moment D_u of (15.1) as a GIVEN field, so c_{d,24} is not uniquely determined in Lean and no inhabitant is constructed. The 27 main theorems listed as `proved` are the integer/rational arithmetic skeleton of PROOF.md sections 1-4 (coefficient sums, shell constants, Taylor partial sum, block minors, cone-moment algebra), not the Gaussian conditioning, the Rayleigh cone integration, the Stirling log-gamma step (section 5, not specified), the interval arithmetic of coefficient.py, or the enclosure itself. The persistence interpretation through the parent Theorem C (eq. 15.2) is conditional on the parent and untouched. Disposition REVIEWED_SCOPED is transcribed, not re-derived. Nonauthor review and acceptance are not claimed by any statement; alignment of every statement with its anchor is PENDING_INDEPENDENT_REVIEW; organizational-independence credit of this packet is 0. The interface does not determine c_{d,24}: CoefficientEnclosure and ReferenceComparison are predicates on the interface object, not closed statements; their universal closure over all inhabitants is false whenever the interface is inhabited (scaling the given cone moment by a positive constant scales c24 through eq_15_2 and gives another inhabitant), and `specified` refers to the statement shape at the source's object, which is not constructed.", - "next_step": "Formal lane (Math- Mathlib package, by the lane's admission rules): construct the conditional law A_u | V_u = 0 and prove ConeMomentD1Identity / ConeMomentD2Identity for the reference law under ConeMomentInterface; then prove ReferenceCoefficientIdentity; the enclosure needs a proof-producing interval pipeline for Gamma(7/6), pi, exp and the theta sums (the numerical formalizer work offer of main docs/FORMAL_VERIFICATION.md). Independent reviewer: alignment verdicts on the 28 Side24 statements." + "not_established": "Nothing here encloses the coefficient. CoefficientEnclosure and ReferenceComparison are statements for any object satisfying PeriodicCoefficientInterface; the interface takes the cone moment D_u of (15.1) as a GIVEN field, so c_{d,24} is not uniquely determined in Lean and no inhabitant is constructed. The 27 main theorems listed as `proved` are the integer/rational arithmetic skeleton of PROOF.md sections 1-4 (coefficient sums, shell constants, Taylor partial sum, block minors, cone-moment algebra), not the Gaussian conditioning, the Rayleigh cone integration, the Stirling log-gamma step (section 5, not specified), the interval arithmetic of coefficient.py, or the enclosure itself. ExponentialBounds, SuccessiveTermRatio, ConeMomentD2Algebra, ReferenceCoefficientIdentity and ElementaryConeIntegral have theorems of exactly their type in the proof packet specifications/lean_statement_proofs_20261011 (5 entries below, label `proved`; the hosted lean-specification-proofs.yml run 38116277597 (PR head 00d2ac6e; actual tested merge c4c66bb8cb26f0cd9bc03d52bb25f1b3925b272c with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2) kernel-checked them (receipt formalization_status kernel-checked, leanchecker PASS, `#print axioms` within {propext, Classical.choice, Quot.sound})): elementary real inequalities, the term ratio, the D2 cone-moment algebra, the reference-coefficient identity as stated (its left side is not identified with the parent formula (15.2) at the reference law: rotational invariance of K_infty is not specified) and the elementary cone integral; none of them is the Gaussian conditioning, ConeMomentD1Identity / ConeMomentD2Identity, RayleighSquareLaw, LatticeImageSumBound or any enclosure of the coefficient, and the claim-level label stays `specified`. The persistence interpretation through the parent Theorem C (eq. 15.2) is conditional on the parent and untouched. Disposition REVIEWED_SCOPED is transcribed, not re-derived. Nonauthor review and acceptance are not claimed by any statement; alignment of every statement with its anchor is PENDING_INDEPENDENT_REVIEW; organizational-independence credit of this packet is 0. The interface does not determine c_{d,24}: CoefficientEnclosure and ReferenceComparison are predicates on the interface object, not closed statements; their universal closure over all inhabitants is false whenever the interface is inhabited (scaling the given cone moment by a positive constant scales c24 through eq_15_2 and gives another inhabitant), and `specified` refers to the statement shape at the source's object, which is not constructed.", + "next_step": "Formal lane (Math- Mathlib package, by the lane's admission rules): construct the conditional law A_u | V_u = 0 and prove ConeMomentD1Identity / ConeMomentD2Identity for the reference law under ConeMomentInterface, RayleighSquareLaw and LatticeImageSumBound (ReferenceCoefficientIdentity is proved as stated; the identification of its left side with (15.2) at the reference law is not specified); the hosted run 38116277597 (PR head 00d2ac6e; actual tested merge c4c66bb8cb26f0cd9bc03d52bb25f1b3925b272c with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2) kernel-checked the 5 proved entries; the enclosure needs a proof-producing interval pipeline for Gamma(7/6), pi, exp and the theta sums (the numerical formalizer work offer of main docs/FORMAL_VERIFICATION.md). Independent reviewer: alignment verdicts on the 28 Side24 statements." }, { "claim_id": "lifetime-remainder", @@ -852,11 +902,62 @@ "formal_progress": "specified", "anchor": "= B q[1+log(A/q)].", "does_not_claim": "the intermediate integral identity `integral_0^infinity min(q,Ae^(-t/B))dt`; that the logarithmic loss is attained (the source's remark about (N4)); anything about the Gaussian model; the result or its proof; nonauthor review or acceptance (the landing disposition HOLD_WITH_DOMAIN of rn-count-interface is transcribed by the register, not here)." + }, + { + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "module": "SpecificationProofs/RNProbability.lean", + "declaration": "UniversalLaw.Proofs.RNProbability.conditionalMeanIdentityN3", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "E[N_r 1_Er]=q E[N_r | E_r].", + "does_not_claim": "the informal Theorem N, the bounded-conditional-mean equivalence, the lower comparison `q ≥ c r^3`, anything about the Gaussian model, review or acceptance." + }, + { + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "module": "SpecificationProofs/RNProbability.lean", + "declaration": "UniversalLaw.Proofs.RNProbability.holderCountBoundN1", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "E[N_r 1_Er] <= (E N_r^p)^(1/p) P(E_r)^(1-1/p).", + "does_not_claim": "the informal Theorem N, that any Gaussian count satisfies the moment hypothesis, any rate in `r`, review or acceptance." + }, + { + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "module": "SpecificationProofs/RNProbability.lean", + "declaration": "UniversalLaw.Proofs.RNProbability.holderConsequenceN2", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "E[N_r 1_Er] <= A^(1/p) C^(1-1/p)", + "does_not_claim": "the informal Theorem N, that the exponent can be rounded up to `3`, that any Gaussian count satisfies the hypotheses, review or acceptance." + }, + { + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "module": "SpecificationProofs/RNProbability.lean", + "declaration": "UniversalLaw.Proofs.RNProbability.uniformCounterexampleN4", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "E N_r/r^3=ceil(log(1/r)) -> infinity.", + "does_not_claim": "the source's sharper bound `sup_(t>=1) e^(-3t)(t+1)^p`, the one-`p` sharpness construction, anything about the Gaussian field, the informal Theorem N, review or acceptance." + }, + { + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "module": "SpecificationProofs/RNProbability.lean", + "declaration": "UniversalLaw.Proofs.RNProbability.exponentialTailLayerCakeN5", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "= B q[1+log(A/q)].", + "does_not_claim": "the source's intermediate identity `∫_0^∞ min(q, A e^(-t/B)) dt`, that the logarithmic loss is attained, anything about the Gaussian model, the informal Theorem N, review or acceptance." } ], - "kernel_evidence": [], - "not_established": "No Prop states Theorem N as a whole: (N1)-(N5) (Hoelder bound, its power-law consequence, the conditional-mean identity, the uniform counterexample, the exponential-tail layer cake) are stated as abstract probability-space Props; (N6) (the full-pin weighted Kac-Rice expression for E_Q^W N_B) and (N7) (the enclosure-to-rate implication under Z_r >= z_* r^2) are NOT stated, and they are the Gaussian numerator interface that the disposition reason calls \"a target rather than a discharged global RN theorem\". Nothing about the Gaussian model is stated or proved; no RN rate, no 24-jet enclosure, no ENV-RESCOV discharge. Disposition HOLD_WITH_DOMAIN is transcribed, not re-derived. Nonauthor review and acceptance are not claimed by any statement; alignment of every statement with its anchor is PENDING_INDEPENDENT_REVIEW; organizational-independence credit of this packet is 0.", - "next_step": "State (N7) as an implication with the Kac-Rice numerator as an interface field (the integral of (N6) as a given quantity) and Z_r >= z_* r^2 as a hypothesis; then the claim would be `specified`. (N1)-(N3), (N5) are candidates for proofs in the Math- Mathlib lane (Hoelder, layer cake). Independent reviewer: alignment of the five Props with (N1)-(N5)." + "kernel_evidence": [ + { + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "receipt_or_workflow": ".github/workflows/lean-specification-proofs.yml; hosted run 38121713840 (PR head 910809d6; actual tested checkout the merge commit 5b198699308e0585904c21d12bf540cf2475d2f0 of that head into base b2d70d77876a10c365f5db5d3b6cafcf180af4e2, the synthetic merge GitHub builds for a pull_request run, whose tree equals the head's and which the receipt records as checked_commit) (job proof-evidence, artifact lean-specification-proofs-38121713840-1, sha256 640682d631d052f4903d66f506740ae8fa91d19185001e70a1502f404eb44175): receipt formalization_status kernel-checked, leanchecker PASS, theorem_count 52, worktree CLEAN; the 38 theorems of PR head 00d2ac6e were first receipted by run 38116277597 (actual tested merge c4c66bb8cb26f0cd9bc03d52bb25f1b3925b272c with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2, same tree as the head; artifact lean-specification-proofs-38116277597-1); corroborated on PR head d9b8dd33 by run 38122386459 (actual tested merge 866136cca66b46e6dbd3186b47c9340f7e93b4f6 with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2, same tree as the head; receipt formalization_status kernel-checked, theorem_count 52, worktree CLEAN; artifact lean-specification-proofs-38122386459-1, sha256 edd52190d6af5828e8229c161c3b77e87a540caf440070d66b1b7f415008ebc3)", + "note": "5 theorem(s) of this row (RNProbability.conditionalMeanIdentityN3, RNProbability.holderCountBoundN1, RNProbability.holderConsequenceN2, RNProbability.uniformCounterexampleN4, RNProbability.exponentialTailLayerCakeN5) are inventoried by the proof packet's check.py (source mode SOURCE_CHECK_PASS: 52 inventory theorems over SpecificationProofs/{P15Elementary,P15Structure,P15Hazard,P15Covers,P15Budget,Side24Elementary,RNProbability}.lean, 51 distinct registered Props, each theorem typed exactly as its registered Prop, applied to its own parameters). 5 of them (RNProbability.conditionalMeanIdentityN3, RNProbability.holderCountBoundN1, RNProbability.holderConsequenceN2, RNProbability.uniformCounterexampleN4, RNProbability.exponentialTailLayerCakeN5) are among the 38 theorems of PR head 00d2ac6e kernel-checked by the hosted run 38116277597 (actual tested merge c4c66bb8cb26f0cd9bc03d52bb25f1b3925b272c with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2; job proof-evidence: fresh build, leanchecker PASS, `#print axioms` within {propext, Classical.choice, Quot.sound} for each, receipt formalization_status kernel-checked, worktree CLEAN; artifact lean-specification-proofs-38116277597-1), and again by the hosted run 38121713840 (PR head 910809d6; actual tested merge 5b198699308e0585904c21d12bf540cf2475d2f0 with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2). `proved` is the label of a committed proof package; `kernel-checked` appears only in a run receipt. Evidence about the registered Props only: not about the informal claim, its alignment (PENDING_INDEPENDENT_REVIEW), review or acceptance; the claim-level label is unchanged; organizational-independence credit 0 (Anthropic / Claude)." + } + ], + "not_established": "No Prop states Theorem N as a whole, so the claim-level label stays none: (N1)-(N5) (Hoelder bound, its power-law consequence, the conditional-mean identity, the uniform counterexample, the exponential-tail layer cake) are stated as abstract probability-space Props and each has a theorem of exactly its type in the proof packet specifications/lean_statement_proofs_20261011 (5 entries below, label `proved`; the hosted lean-specification-proofs.yml run 38116277597 (PR head 00d2ac6e; actual tested merge c4c66bb8cb26f0cd9bc03d52bb25f1b3925b272c with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2) kernel-checked them (receipt formalization_status kernel-checked, leanchecker PASS, `#print axioms` within {propext, Classical.choice, Quot.sound})); (N6) (the full-pin weighted Kac-Rice expression for E_Q^W N_B) and (N7) (the enclosure-to-rate implication under Z_r >= z_* r^2) are NOT stated, and they are the Gaussian numerator interface that the disposition reason calls \"a target rather than a discharged global RN theorem\". The five theorems prove the Props for the abstract probability spaces and counts they quantify over: nothing about the Gaussian model is stated or proved; no RN rate, no 24-jet enclosure, no ENV-RESCOV discharge; D3-LEMMA-RN-UNIF stays not closed. Disposition HOLD_WITH_DOMAIN is transcribed, not re-derived. Nonauthor review and acceptance are not claimed by any statement or theorem; alignment of every statement with its anchor is PENDING_INDEPENDENT_REVIEW; organizational-independence credit of this packet and of the proof packet is 0.", + "next_step": "State (N7) as an implication with the Kac-Rice numerator as an interface field (the integral of (N6) as a given quantity) and Z_r >= z_* r^2 as a hypothesis; then the claim would be `specified`. The hosted run 38116277597 (PR head 00d2ac6e; actual tested merge c4c66bb8cb26f0cd9bc03d52bb25f1b3925b272c with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2) kernel-checked the five proved entries. Independent reviewer: alignment of the five Props with (N1)-(N5)." }, { "claim_id": "rn-fixed-remote-window", @@ -1197,11 +1298,310 @@ "formal_progress": "specified", "anchor": " =2449227/8180000000 < 3/10000. (P11)", "does_not_claim": "the bound (statement only; \"only a union bound, not an equality of the global bad probability\"); the two rational identities are core-Lean targets on main." + }, + { + "package": "d6g8k5htny-coder/main formal/ at 91cffbb51d1636f382e9d61a1ecb6f7cd38e1d06 (PR #358, not yet on main)", + "module": "UniversalLaw/P15/RealizedCovers.lean", + "declaration": "UniversalLaw.P15.benchmark_block_and_ground_sizes", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "EACH original block has409 vertices and the original ground set has2454 vertices", + "does_not_claim": "the construction (P1)–(P2), Proposition P1, probability semantics; Theorem P2; prize status" + }, + { + "package": "d6g8k5htny-coder/main formal/ at 91cffbb51d1636f382e9d61a1ecb6f7cd38e1d06 (PR #358, not yet on main)", + "module": "UniversalLaw/P15/RealizedCovers.lean", + "declaration": "UniversalLaw.P15.four_block_supports_fifteen", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "H consists of all15 four-block subsets", + "does_not_claim": "the clutter structure of H or Proposition P1; Theorem P2; prize status" + }, + { + "package": "d6g8k5htny-coder/main formal/ at 91cffbb51d1636f382e9d61a1ecb6f7cd38e1d06 (PR #358, not yet on main)", + "module": "UniversalLaw/P15/RealizedCovers.lean", + "declaration": "UniversalLaw.P15.minimal_forbidder_counts", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "6*binom(409,2)=500616 internal pairs,\n 15*409^4=419743994415 crossing transversal quadruples.", + "does_not_claim": "that these numbers count the minimal forbidders (Proposition P1); Theorem P2; prize status" + }, + { + "package": "d6g8k5htny-coder/main formal/ at 91cffbb51d1636f382e9d61a1ecb6f7cd38e1d06 (PR #358, not yet on main)", + "module": "UniversalLaw/P15/RealizedCovers.lean", + "declaration": "UniversalLaw.P15.palette_816_from_two_label_classes", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "K_H(408,...,408)=816", + "does_not_claim": "that the two label classes satisfy (P6) or that no smaller palette does (the palette optimum); Theorem P2; prize status" + }, + { + "package": "d6g8k5htny-coder/main formal/ at 91cffbb51d1636f382e9d61a1ecb6f7cd38e1d06 (PR #358, not yet on main)", + "module": "UniversalLaw/P15/RealizedCovers.lean", + "declaration": "UniversalLaw.P15.palette_815_fails_by_counting", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "omitting one vertex from each block leaves2448 vertices, each color holds at most3, and815*3<2448", + "does_not_claim": "that each colour class holds at most three vertices (the combinatorial step); Theorem P2; prize status" + }, + { + "package": "d6g8k5htny-coder/main formal/ at 91cffbb51d1636f382e9d61a1ecb6f7cd38e1d06 (PR #358, not yet on main)", + "module": "UniversalLaw/P15/RealizedCovers.lean", + "declaration": "UniversalLaw.P15.whole_ground_chromatic_818", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "needs818 colors, since2454/3=818", + "does_not_claim": "the chromatic number of the ground set (K_H(d+1)) or the palette argument; Theorem P2; prize status" + }, + { + "package": "d6g8k5htny-coder/main formal/ at 91cffbb51d1636f382e9d61a1ecb6f7cd38e1d06 (PR #358, not yet on main)", + "module": "UniversalLaw/P15/RealizedCovers.lean", + "declaration": "UniversalLaw.P15.elementary_palette_formula_instances", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "K_H(d)=max(max_i d_i, ceil(sum_i d_i/s))", + "does_not_claim": "the formula (P9) itself (cyclic-word construction and lower bounds); that K_H of the section-6 benchmark equals the (P9) value; Theorem P2; prize status" + }, + { + "package": "d6g8k5htny-coder/main formal/ at 91cffbb51d1636f382e9d61a1ecb6f7cd38e1d06 (PR #358, not yet on main)", + "module": "UniversalLaw/P15/RealizedCovers.lean", + "declaration": "UniversalLaw.P15.macro_triangle_three_colors", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "The macro triangle at unit demands needs3 colors", + "does_not_claim": "that the triangle needs 3 colours (the formula (P9) and its applicability); the comparison with a size-two edge-load formula; Theorem P2; prize status" + }, + { + "package": "d6g8k5htny-coder/main formal/ at 91cffbb51d1636f382e9d61a1ecb6f7cd38e1d06 (PR #358, not yet on main)", + "module": "UniversalLaw/P15/RealizedCovers.lean", + "declaration": "UniversalLaw.P15.ceil_block_over_capacity_instances", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "ceil(n_i/a_i)=d_i+1", + "does_not_claim": "the identity for all a_i >= 1; that the whole-ground chromatic number is K_H(d+1); Theorem P2; prize status" + }, + { + "package": "d6g8k5htny-coder/main formal/ at 91cffbb51d1636f382e9d61a1ecb6f7cd38e1d06 (PR #358, not yet on main)", + "module": "UniversalLaw/P15/RealizedCovers.lean", + "declaration": "UniversalLaw.P15.block_occupancy_one_percent", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "each block's occupancy probability is at most409p=1/100", + "does_not_claim": "the union bound giving occupancy probability at most 409p; probability semantics; Theorem P2; prize status" + }, + { + "package": "d6g8k5htny-coder/main formal/ at 91cffbb51d1636f382e9d61a1ecb6f7cd38e1d06 (PR #358, not yet on main)", + "module": "UniversalLaw/P15/RealizedCovers.lean", + "declaration": "UniversalLaw.P15.low_failure_union_bound_arithmetic", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "=2449227/8180000000 < 3/10000", + "does_not_claim": "the union bound Q <= ..., the independence of block occupancies, that Q = 1 - mu_p(D) is the global bad probability, probability semantics, display (P8); Theorem P2; prize status" + }, + { + "package": "d6g8k5htny-coder/main formal/ at 91cffbb51d1636f382e9d61a1ecb6f7cd38e1d06 (PR #358, not yet on main)", + "module": "UniversalLaw/P15/RealizedCovers.lean", + "declaration": "UniversalLaw.P15.cover_price_numerator_and_denominator_positive", + "kind": "theorem", + "formal_progress": "proved", + "anchor": " 6/(40900^409)>0.", + "does_not_claim": "the price identity 6/(40900^409) for the six-generator cover (the kernel does not evaluate the power, only its positivity); probability semantics; Theorem P2; prize status" + }, + { + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "module": "SpecificationProofs/P15Elementary.lean", + "declaration": "UniversalLaw.Proofs.P15Elementary.triangleNeedsThree", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "at unit demands needs3 colors, although a formula considering only size-two edge loads would give2.", + "does_not_claim": "display (P9) (`ElementaryPaletteFormula`), the matroid palette formula, or anything about the realized-covers budget (P8)." + }, + { + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "module": "SpecificationProofs/P15Structure.lean", + "declaration": "UniversalLaw.Proofs.P15Structure.benchmark816IsRealized", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "Every D-color class contains at most one vertex per block and occupies at most three blocks.", + "does_not_claim": "anything about the informal six-block realization beyond this data record satisfying the formal side conditions; no review, acceptance or alignment." + }, + { + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "module": "SpecificationProofs/P15Structure.lean", + "declaration": "UniversalLaw.Proofs.P15Structure.benchmark816Price", + "kind": "theorem", + "formal_progress": "proved", + "anchor": " 6/(40900^409)>0.", + "does_not_claim": "that this cover is optimal or that it covers the obstruction (`Benchmark816Cover` is a separate `Prop`); no review or acceptance." + }, + { + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "module": "SpecificationProofs/P15Structure.lean", + "declaration": "UniversalLaw.Proofs.P15Structure.elementaryPaletteFormula", + "kind": "theorem", + "formal_progress": "proved", + "anchor": " K_H(d)=max(max_i d_i, ceil(sum_i d_i/s)). (P9)", + "does_not_claim": "the matroid palette formula of Section 5, anything about non-complete clutters, or the informal claim; the hypotheses `s ≤ b` and `1 ≤ d_i` of the `Prop` are not needed by this proof and are simply carried; no review or acceptance." + }, + { + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "module": "SpecificationProofs/P15Structure.lean", + "declaration": "UniversalLaw.Proofs.P15Structure.triangleNeedsThree", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "at unit demands needs3 colors, although a formula considering only size-two edge loads would give2.", + "does_not_claim": "the informal remark about \"size-two edge loads\"; no review or acceptance." + }, + { + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "module": "SpecificationProofs/P15Structure.lean", + "declaration": "UniversalLaw.Proofs.P15Structure.benchmark816Palette", + "kind": "theorem", + "formal_progress": "proved", + "anchor": " K_H(408,...,408)=816.", + "does_not_claim": "that the full blocks cover the obstruction (`Benchmark816Cover`), or the informal claim; no review or acceptance." + }, + { + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "module": "SpecificationProofs/P15Structure.lean", + "declaration": "UniversalLaw.Proofs.P15Structure.localDecomposability", + "kind": "theorem", + "formal_progress": "proved", + "anchor": " I_k(D_i)={S:|S|<=a_i k}.", + "does_not_claim": "the informal claim or its review; alignment of `IsKDecomposable` with the informal `I_k`." + }, + { + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "module": "SpecificationProofs/P15Structure.lean", + "declaration": "UniversalLaw.Proofs.P15Structure.localObstructionIsFullBlock", + "kind": "theorem", + "formal_progress": "proved", + "anchor": " G_i={X_i} (P3)", + "does_not_claim": "the informal claim or its review." + }, + { + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "module": "SpecificationProofs/P15Structure.lean", + "declaration": "UniversalLaw.Proofs.P15Structure.fullBlockCoverIff", + "kind": "theorem", + "formal_progress": "proved", + "anchor": " K>=K_H(d). (P7)", + "does_not_claim": "optimality of other covers, the unrestricted prize, the informal claim or its review (disposition transcribed in the statement: HOLD_WITH_DOMAIN)." + }, + { + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "module": "SpecificationProofs/P15Structure.lean", + "declaration": "UniversalLaw.Proofs.P15Structure.wholeGroundChromaticNumber", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "the chromatic number of the ENTIRE ground set X is K_H(d+1), because ceil(n_i/a_i)=d_i+1.", + "does_not_claim": "the informal claim or its review." + }, + { + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "module": "SpecificationProofs/P15Structure.lean", + "declaration": "UniversalLaw.Proofs.P15Structure.benchmark816WholeGround", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "The whole ground set, unlike the cover-avoiding sets, needs818 colors, since2454/3=818.", + "does_not_claim": "the informal claim or its review." + }, + { + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "module": "SpecificationProofs/P15Structure.lean", + "declaration": "UniversalLaw.Proofs.P15Structure.minimalForbiddenCharacterisation", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "(a) every (a_i+1)-subset of a single X_i;", + "does_not_claim": "the informal claim or its review; alignment of `IsMinimalForbidden` with the informal notion." + }, + { + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "module": "SpecificationProofs/P15Structure.lean", + "declaration": "UniversalLaw.Proofs.P15Structure.benchmark816MinimalForbiddenCounts", + "kind": "theorem", + "formal_progress": "proved", + "anchor": " 15*409^4=419743994415 crossing transversal quadruples. (P10)", + "does_not_claim": "the informal claim or its review; the evaluations `500616` and `419743994415` (core-Lean targets on main)." + }, + { + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "module": "SpecificationProofs/P15Hazard.lean", + "declaration": "UniversalLaw.Proofs.P15Hazard.localPriceChain", + "kind": "theorem", + "formal_progress": "proved", + "anchor": " =P(U_i=X_i)<=q_i<=phi(q_i), (P4)", + "does_not_claim": "the informal display (P4) or its review and acceptance; the alignment of `localFailure` with the source's `q_i` (PENDING_INDEPENDENT_REVIEW); the identification `prod p_v = P(U_i = X_i)` as a probabilistic statement; the disposition HOLD_WITH_DOMAIN of `p15-realized-covers`, which is transcribed in the register, not derived here." + }, + { + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "module": "SpecificationProofs/P15Hazard.lean", + "declaration": "UniversalLaw.Proofs.P15Hazard.independentBlockHazard", + "kind": "theorem", + "formal_progress": "proved", + "anchor": " <=-log(product_i(1-q_i))<=-log mu_p(D). (P5)", + "does_not_claim": "the informal display (P5) or its review and acceptance; any independence of crossing events (none is used); the price bound `sum_i price(G_i) ≤ sum_i q_i` (that is (P4) summed, not part of this `Prop`); the alignment of the formal `mu`, `localFailure` with the source's objects (PENDING_INDEPENDENT_REVIEW); the disposition HOLD_WITH_DOMAIN of `p15-realized-covers`." + }, + { + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "module": "SpecificationProofs/P15Covers.lean", + "declaration": "UniversalLaw.Proofs.P15Covers.benchmark816Cover", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "At816 colors it covers the obstruction; at815 it does not, because omitting one vertex from each block leaves2448 vertices, each color holds at most3, and815*3<2448.", + "does_not_claim": "the informal claim, its review or acceptance; alignment of the formal `IsGeneratorCover`/`obstruction` with the informal notions; optimality of any other cover (disposition transcribed in the statement: HOLD_WITH_DOMAIN)." + }, + { + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "module": "SpecificationProofs/P15Covers.lean", + "declaration": "UniversalLaw.Proofs.P15Covers.localRestriction", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "D_i=D intersect 2^(X_i)={S subset X_i: |S|<=a_i}. (P2)", + "does_not_claim": "the informal claim, its review or acceptance; alignment of `IsGood` with the informal downset `D`." + }, + { + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "module": "SpecificationProofs/P15Covers.lean", + "declaration": "UniversalLaw.Proofs.P15Covers.paletteNumberAttained", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "By discarding excess labels within blocks, one may take |P_i|=d_i.", + "does_not_claim": "the informal claim, its review or acceptance; the value of the palette number for any family." + }, + { + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "module": "SpecificationProofs/P15Covers.lean", + "declaration": "UniversalLaw.Proofs.P15Covers.benchmark816UnionBound", + "kind": "theorem", + "formal_progress": "proved", + "anchor": " =2449227/8180000000 < 3/10000. (P11)", + "does_not_claim": "the informal claim, its review or acceptance; the exact value of the bad probability (the source stresses \"only a union bound, not an equality of the global bad probability\"); alignment of `mu`/`IsGood` with the informal objects." + }, + { + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "module": "SpecificationProofs/P15Budget.lean", + "declaration": "UniversalLaw.Proofs.P15Budget.coverCostHazardBound", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "covercost_c(O_K(D)) <= min(1,-log mu_p(D)). (P8)", + "does_not_claim": "the informal display (P8) or its review and acceptance; anything for prices `c_v > p_v`; attainment of the infimum; the alignment of `coverCost`, `mu`, `localFailure` with the source's objects (PENDING_INDEPENDENT_REVIEW); the unrestricted P15 prize or original P15-B; the disposition HOLD_WITH_DOMAIN of `p15-realized-covers`, which is transcribed in the register, not derived here." } ], - "kernel_evidence": [], - "not_established": "MinimalForbiddenCharacterisation (Proposition P1), FullBlockCoverIff (Theorem P2, (P7)) and CoverCostHazardBound ((P8)) state the results for every realized family; none is proved here. No `proved` statement is listed: main's 12 P15 arithmetic theorems for this claim (finite arithmetic of Section 6: 409, 2454, 15, 500616, 419743994415, 816, 815*3 < 2448, 818, 409p = 1/100, the (P11) rational bound, positivity of 6/40900^409, and the elementary instances of (P9)) exist only in this programme's uncommitted main worktree, on no commit, and are not listed until a commit and a hosted formal-verification.yml run exist; even then they would not count the minimal forbidders, show the palette is 816 or evaluate 6/40900^409. The benchmark Props Benchmark816Cover/WholeGround/MinimalForbiddenCounts/Price/UnionBound quantify over 2^2454 subsets and are not decidable in practice; PaletteNumberAttained (nonemptiness of the feasible palette set) is stated, not proved. Nothing is asserted for prices p_v < c_v <= phi(p_v), for arbitrary P15 inputs or for the prize (original_prize_closed stays false). Disposition HOLD_WITH_DOMAIN is transcribed, not re-derived. Nonauthor review and acceptance are not claimed by any statement; alignment of every statement with its anchor is PENDING_INDEPENDENT_REVIEW; organizational-independence credit of this packet is 0.", - "next_step": "Proof lane: TriangleNeedsThree, Benchmark816IsRealized, LocalRestriction and LocalDecomposability are finite or elementary and are the first kernel targets; PaletteNumberAttained via the disjoint-palette witness. Independent reviewer: alignment of MinimalForbiddenCharacterisation with Proposition P1 (completeness clause) and of FullBlockCoverIff with (P7). main: commit and push the P15 modules (hosted formal-verification.yml green), then list the P15 arithmetic theorems here as `proved` statements citing the 40-hex commit and the workflow run; until then no P15 theorem is listed." + "kernel_evidence": [ + { + "package": "d6g8k5htny-coder/main formal/ at 91cffbb51d1636f382e9d61a1ecb6f7cd38e1d06 (PR #358, not yet on main)", + "receipt_or_workflow": "workspace-landing run 38096827443, job formal / formal-evidence, artifact formal-verification-38096827443", + "note": "The 12 P15 targets of source p15-realized-covers (UniversalLaw/P15/RealizedCovers.lean: benchmark_block_and_ground_sizes, four_block_supports_fifteen, minimal_forbidder_counts, palette_816_from_two_label_classes, palette_815_fails_by_counting, whole_ground_chromatic_818, elementary_palette_formula_instances, macro_triangle_three_colors, ceil_block_over_capacity_instances, block_occupancy_one_percent, low_failure_union_bound_arithmetic, cover_price_numerator_and_denominator_positive) are decide-proved integer or cross-multiplied rational facts at commit 91cffbb5 of main PR #358, not on main (manifest label `proved`; `kernel-checked` only in the run receipt, a workflow artifact of the hosted run, none committed in tree). Arithmetic skeleton only: main formal/SCOPE.md says none of these targets is Theorem F (F2), Theorem (T1), Theorem P2, Proposition P1, the enclosure (F3) of rho_star, any inequality involving log, exp or e, the probability semantics of mu_p, the union bound (P11), p_star, the P15-B amalgamation or any prize status; alignment PENDING_INDEPENDENT_REVIEW; organizational-independence credit 0 (Anthropic / Claude)." + }, + { + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "receipt_or_workflow": ".github/workflows/lean-specification-proofs.yml; hosted run 38121713840 (PR head 910809d6; actual tested checkout the merge commit 5b198699308e0585904c21d12bf540cf2475d2f0 of that head into base b2d70d77876a10c365f5db5d3b6cafcf180af4e2, the synthetic merge GitHub builds for a pull_request run, whose tree equals the head's and which the receipt records as checked_commit) (job proof-evidence, artifact lean-specification-proofs-38121713840-1, sha256 640682d631d052f4903d66f506740ae8fa91d19185001e70a1502f404eb44175): receipt formalization_status kernel-checked, leanchecker PASS, theorem_count 52, worktree CLEAN; the 38 theorems of PR head 00d2ac6e were first receipted by run 38116277597 (actual tested merge c4c66bb8cb26f0cd9bc03d52bb25f1b3925b272c with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2, same tree as the head; artifact lean-specification-proofs-38116277597-1); corroborated on PR head d9b8dd33 by run 38122386459 (actual tested merge 866136cca66b46e6dbd3186b47c9340f7e93b4f6 with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2, same tree as the head; receipt formalization_status kernel-checked, theorem_count 52, worktree CLEAN; artifact lean-specification-proofs-38122386459-1, sha256 edd52190d6af5828e8229c161c3b77e87a540caf440070d66b1b7f415008ebc3)", + "note": "20 theorem(s) of this row (P15Elementary.triangleNeedsThree, P15Structure.benchmark816IsRealized, P15Structure.benchmark816Price, P15Structure.elementaryPaletteFormula, P15Structure.triangleNeedsThree, P15Structure.benchmark816Palette, P15Structure.localDecomposability, P15Structure.localObstructionIsFullBlock, P15Structure.fullBlockCoverIff, P15Structure.wholeGroundChromaticNumber, P15Structure.benchmark816WholeGround, P15Structure.minimalForbiddenCharacterisation, P15Structure.benchmark816MinimalForbiddenCounts, P15Hazard.localPriceChain, P15Hazard.independentBlockHazard, P15Covers.benchmark816Cover, P15Covers.localRestriction, P15Covers.paletteNumberAttained, P15Covers.benchmark816UnionBound, P15Budget.coverCostHazardBound) are inventoried by the proof packet's check.py (source mode SOURCE_CHECK_PASS: 52 inventory theorems over SpecificationProofs/{P15Elementary,P15Structure,P15Hazard,P15Covers,P15Budget,Side24Elementary,RNProbability}.lean, 51 distinct registered Props, each theorem typed exactly as its registered Prop, applied to its own parameters). 13 of them (P15Elementary.triangleNeedsThree, P15Structure.benchmark816IsRealized, P15Structure.benchmark816Price, P15Structure.elementaryPaletteFormula, P15Structure.triangleNeedsThree, P15Structure.benchmark816Palette, P15Structure.localDecomposability, P15Structure.localObstructionIsFullBlock, P15Structure.fullBlockCoverIff, P15Structure.wholeGroundChromaticNumber, P15Structure.benchmark816WholeGround, P15Structure.minimalForbiddenCharacterisation, P15Structure.benchmark816MinimalForbiddenCounts) are among the 38 theorems of PR head 00d2ac6e kernel-checked by the hosted run 38116277597 (actual tested merge c4c66bb8cb26f0cd9bc03d52bb25f1b3925b272c with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2; job proof-evidence: fresh build, leanchecker PASS, `#print axioms` within {propext, Classical.choice, Quot.sound} for each, receipt formalization_status kernel-checked, worktree CLEAN; artifact lean-specification-proofs-38116277597-1), and again by the hosted run 38121713840 (PR head 910809d6; actual tested merge 5b198699308e0585904c21d12bf540cf2475d2f0 with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2). 7 (P15Hazard.localPriceChain, P15Hazard.independentBlockHazard, P15Covers.benchmark816Cover, P15Covers.localRestriction, P15Covers.paletteNumberAttained, P15Covers.benchmark816UnionBound, P15Budget.coverCostHazardBound) were added after commit 00d2ac6e and kernel-checked by the hosted run 38121713840 (PR head 910809d6; actual tested merge 5b198699308e0585904c21d12bf540cf2475d2f0 with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2) (job proof-evidence: fresh build, leanchecker PASS, `#print axioms` within {propext, Classical.choice, Quot.sound}, receipt formalization_status kernel-checked, worktree CLEAN). `proved` is the label of a committed proof package; `kernel-checked` appears only in a run receipt. Evidence about the registered Props only: not about the informal claim, its alignment (PENDING_INDEPENDENT_REVIEW), review or acceptance; the claim-level label is unchanged; organizational-independence credit 0 (Anthropic / Claude)." + } + ], + "not_established": "Props of this row with a theorem of exactly their type in the proof packet specifications/lean_statement_proofs_20261011: PaletteNumberAttained, MinimalForbiddenCharacterisation, LocalRestriction, LocalDecomposability, LocalObstructionIsFullBlock, LocalPriceChain, IndependentBlockHazard, FullBlockCoverIff, CoverCostHazardBound, WholeGroundChromaticNumber, ElementaryPaletteFormula, TriangleNeedsThree, Benchmark816IsRealized, Benchmark816Palette, Benchmark816Cover, Benchmark816WholeGround, Benchmark816MinimalForbiddenCounts, Benchmark816Price, Benchmark816UnionBound (20 entries below, label `proved`; 13 of them (P15Structure.minimalForbiddenCharacterisation, P15Structure.localDecomposability, P15Structure.localObstructionIsFullBlock, P15Structure.fullBlockCoverIff, P15Structure.wholeGroundChromaticNumber, P15Structure.elementaryPaletteFormula, P15Elementary.triangleNeedsThree, P15Structure.triangleNeedsThree, P15Structure.benchmark816IsRealized, P15Structure.benchmark816Palette, P15Structure.benchmark816WholeGround, P15Structure.benchmark816MinimalForbiddenCounts, P15Structure.benchmark816Price) kernel-checked by the hosted run 38116277597 (PR head 00d2ac6e; actual tested merge c4c66bb8cb26f0cd9bc03d52bb25f1b3925b272c with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2); 7 of them (P15Covers.paletteNumberAttained, P15Covers.localRestriction, P15Hazard.localPriceChain, P15Hazard.independentBlockHazard, P15Budget.coverCostHazardBound, P15Covers.benchmark816Cover, P15Covers.benchmark816UnionBound) added after commit 00d2ac6e and kernel-checked by the hosted run 38121713840 (PR head 910809d6; actual tested merge 5b198699308e0585904c21d12bf540cf2475d2f0 with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2) (job proof-evidence: fresh build, leanchecker PASS, `#print axioms` within {propext, Classical.choice, Quot.sound}, receipt formalization_status kernel-checked, worktree CLEAN)); among them Proposition P1 (MinimalForbiddenCharacterisation), both halves of Theorem P2 (FullBlockCoverIff, display (P7), and CoverCostHazardBound, display (P8)), the local statements (P2)-(P5) and the benchmark Props including the union bound (P11). Theorem-shaped Props of this row still `specified` with no theorem: none; the parametrised predicates IsRealizedFamily, IsGood, IsKDecomposable, IsGeneratorCover, IsPaletteFeasible, IsMinimalForbidden, IsTransversal are the vocabulary of the other Props, not closed statements (a theorem of their type would assert them for every argument, which is false), and are not targets. Theorem P2 is proved as the two Props state it (for the formal RealizedData record and the formal downset, prices 0 <= c_v <= p_v), which is a statement about those Props, not acceptance of the informal theorem: the claim-level label stays `specified` (this register admits only none/specified at claim level), alignment of RealizedData / IsRealizedFamily / downset / coverCost / mu with the informal objects is PENDING_INDEPENDENT_REVIEW, and the price range p_v < c_v <= phi(p_v) is a different claim row. The 12 main P15 arithmetic theorems listed as `proved` (finite arithmetic of Section 6: 409, 2454, 15, 500616, 419743994415, 816, 815*3 < 2448, 818, 409p = 1/100, the (P11) rational bound, positivity of 6/40900^409, the elementary instances of (P9)) are at commit 91cffbb5 of main PR #358, not on main; they do not count the minimal forbidders, show the palette is 816 or evaluate 6/40900^409, and the proof-packet theorems that do (Benchmark816MinimalForbiddenCounts, Benchmark816Palette, Benchmark816Price) do so for the formal RealizedData record, whose identification with the informal six-block construction is an alignment question. Nothing is asserted for prices p_v < c_v <= phi(p_v) (row p15-price-budget-restricted), for arbitrary P15 inputs or for the prize (original_prize_closed stays false). Disposition HOLD_WITH_DOMAIN is transcribed, not re-derived. Nonauthor review and acceptance are not claimed by any statement or theorem; alignment of every statement with its anchor is PENDING_INDEPENDENT_REVIEW; organizational-independence credit of this packet and of the proof packet is 0.", + "next_step": "Proof lane: every theorem-shaped Prop of this row has a theorem (the parametrised predicates IsRealizedFamily, IsGood, IsKDecomposable, IsGeneratorCover, IsPaletteFeasible, IsMinimalForbidden, IsTransversal are vocabulary, not targets); every theorem of this row has a hosted receipt (run 38121713840 (PR head 910809d6; actual tested merge 5b198699308e0585904c21d12bf540cf2475d2f0 with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2)). Independent reviewer: alignment of MinimalForbiddenCharacterisation with Proposition P1 (completeness clause), of FullBlockCoverIff with (P7), of CoverCostHazardBound with (P8) (the sInf cover cost, the cappedHazard endpoint convention) and of the Benchmark816 data record with the Section 6 construction. main: PR #358 merge (operator) so the 12 arithmetic theorems are on main." }, { "claim_id": "p15-price-boundary", @@ -1240,11 +1640,103 @@ "formal_progress": "specified", "anchor": "using log(1+x)0.", "does_not_claim": "the inequality (statement only; the source proves it, this module does not)." + }, + { + "package": "d6g8k5htny-coder/main formal/ at 91cffbb51d1636f382e9d61a1ecb6f7cd38e1d06 (PR #358, not yet on main)", + "module": "UniversalLaw/P15/PriceBoundary.lean", + "declaration": "UniversalLaw.P15.smallest_member_block_size", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "one-block member: a_1=d_1=1, X={x,y}", + "does_not_claim": "the realized-cover theorem or its family; the probability or price semantics; the two log inequalities; Theorem F; prize status" + }, + { + "package": "d6g8k5htny-coder/main formal/ at 91cffbb51d1636f382e9d61a1ecb6f7cd38e1d06 (PR #358, not yet on main)", + "module": "UniversalLaw/P15/PriceBoundary.lean", + "declaration": "UniversalLaw.P15.demand_one_good_sets", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "Its good sets are the empty\nset and singletons", + "does_not_claim": "the downset D beyond the four enumerated subsets; the log inequalities phi(1/2)=log 2>2/3 and log(4/3)<1/3; Theorem F; prize status" + }, + { + "package": "d6g8k5htny-coder/main formal/ at 91cffbb51d1636f382e9d61a1ecb6f7cd38e1d06 (PR #358, not yet on main)", + "module": "UniversalLaw/P15/PriceBoundary.lean", + "declaration": "UniversalLaw.P15.demand_one_obstruction", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "its one-piece obstruction\nis exactly {X}", + "does_not_claim": "the identity I_1(D)=D in general; cover semantics; the log inequalities; Theorem F; prize status" + }, + { + "package": "d6g8k5htny-coder/main formal/ at 91cffbb51d1636f382e9d61a1ecb6f7cd38e1d06 (PR #358, not yet on main)", + "module": "UniversalLaw/P15/PriceBoundary.lean", + "declaration": "UniversalLaw.P15.good_measure_three_quarters", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "Nevertheless mu_p(D)=3/4", + "does_not_claim": "the product-measure semantics of mu_p; the identity min(1,-log mu_p(D))=log(4/3); the inequality log(4/3)<1/3; Theorem F; prize status" + }, + { + "package": "d6g8k5htny-coder/main formal/ at 91cffbb51d1636f382e9d61a1ecb6f7cd38e1d06 (PR #358, not yet on main)", + "module": "UniversalLaw/P15/PriceBoundary.lean", + "declaration": "UniversalLaw.P15.generator_prices_ninths", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "The possible generator costs are1,2/3,2/3,4/9", + "does_not_claim": "admissibility of c=2/3 as a transformed price (phi(1/2)=log 2>2/3 is a log inequality); that extra generators cannot lower the minimum; Theorem F; prize status" + }, + { + "package": "d6g8k5htny-coder/main formal/ at 91cffbb51d1636f382e9d61a1ecb6f7cd38e1d06 (PR #358, not yet on main)", + "module": "UniversalLaw/P15/PriceBoundary.lean", + "declaration": "UniversalLaw.P15.minimum_generator_price_exceeds_third", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "covercost_c(O_1(D))=4/9 > 1/3 > log(4/3)", + "does_not_claim": "that the minimum over the four subsets is the exact optimal cover price (every cover of {X} containing a generator inside X, and extra nonnegative-price generators not lowering it, are set-theoretic steps of the source); the inequality 1/3 > log(4/3); that the same-palette extension to c<=phi(p) is false in general; Theorem F; prize status" + }, + { + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "module": "SpecificationProofs/P15Elementary.lean", + "declaration": "UniversalLaw.Proofs.P15Elementary.twoCoordGeneratorPrices", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "The possible generator costs are1,2/3,2/3,4/9 for the empty", + "does_not_claim": "the demand-one refutation itself (`DemandOneRefutation`), any review or acceptance of P15-PRICE-BOUNDARY-20260924-v1; the disposition EXACT_COUNTEREXAMPLE is transcribed in the register, not derived here." + }, + { + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "module": "SpecificationProofs/P15Elementary.lean", + "declaration": "UniversalLaw.Proofs.P15Elementary.logOnePlusBelowIdentity", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "using log(1+x)0.", + "does_not_claim": "anything about the refutation beyond this elementary inequality." + }, + { + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "module": "SpecificationProofs/P15Elementary.lean", + "declaration": "UniversalLaw.Proofs.P15Elementary.demandOneRefutation", + "kind": "theorem", + "formal_progress": "proved", + "anchor": " covercost_c(O_1(D))=4/9 > 1/3 > log(4/3).", + "does_not_claim": "that the refutation contradicts original P15-B (\"It does not contradict the original P15-B amalgamation\"), anything at the `408` scale or about the unrestricted prize, the source's integral representation of `log 2`, nonauthor review or acceptance; the disposition EXACT_COUNTEREXAMPLE is transcribed, not derived." } ], - "kernel_evidence": [], - "not_established": "DemandOneRefutation states the refutation (the two-coordinate data form a realized family with K_H(d) = 1, obstruction {X}, admissible prices 2/3, mu_p(D) = 3/4, cover cost 4/9 > 1/3 > log(4/3)); it is not proved. No `proved` statement is listed: main's 6 P15 arithmetic theorems for this claim (the finite arithmetic: good sets, obstruction, 3/4 over denominator 4, prices 9,6,6,4 over 9, 3*4 > 9) exist only in this programme's uncommitted main worktree, on no commit, and are not listed until a commit and a hosted formal-verification.yml run exist; the two logarithm inequalities phi(1/2) = log 2 > 2/3 and log(4/3) < 1/3 are analysis and are not proved anywhere; log(1+x) < x (LogOnePlusBelowIdentity) is stated only. The counterexample does not refute d_i >= 2 successors or original P15-B (the disposition reason). Disposition EXACT_COUNTEREXAMPLE is transcribed, not re-derived. Nonauthor review and acceptance are not claimed by any statement; alignment of every statement with its anchor is PENDING_INDEPENDENT_REVIEW; organizational-independence credit of this packet is 0.", - "next_step": "Math- Mathlib lane: prove the two logarithm inequalities (Real.log bounds) and the finite conjuncts of DemandOneRefutation; this is the smallest complete research statement in the packet that could move from `specified` to `proved`. Independent reviewer: alignment of DemandOneRefutation with the source paragraph. main: commit and push the P15 modules (hosted formal-verification.yml green), then list the P15 arithmetic theorems here as `proved` statements citing the 40-hex commit and the workflow run; until then no P15 theorem is listed." + "kernel_evidence": [ + { + "package": "d6g8k5htny-coder/main formal/ at 91cffbb51d1636f382e9d61a1ecb6f7cd38e1d06 (PR #358, not yet on main)", + "receipt_or_workflow": "workspace-landing run 38096827443, job formal / formal-evidence, artifact formal-verification-38096827443", + "note": "The 6 P15 targets of source p15-price-boundary (UniversalLaw/P15/PriceBoundary.lean: smallest_member_block_size, demand_one_good_sets, demand_one_obstruction, good_measure_three_quarters, generator_prices_ninths, minimum_generator_price_exceeds_third) are decide-proved integer or cross-multiplied rational facts at commit 91cffbb5 of main PR #358, not on main (manifest label `proved`; `kernel-checked` only in the run receipt, a workflow artifact of the hosted run, none committed in tree). Arithmetic skeleton only: main formal/SCOPE.md says none of these targets is Theorem F (F2), Theorem (T1), Theorem P2, Proposition P1, the enclosure (F3) of rho_star, any inequality involving log, exp or e, the probability semantics of mu_p, the union bound (P11), p_star, the P15-B amalgamation or any prize status; alignment PENDING_INDEPENDENT_REVIEW; organizational-independence credit 0 (Anthropic / Claude)." + }, + { + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "receipt_or_workflow": ".github/workflows/lean-specification-proofs.yml; hosted run 38121713840 (PR head 910809d6; actual tested checkout the merge commit 5b198699308e0585904c21d12bf540cf2475d2f0 of that head into base b2d70d77876a10c365f5db5d3b6cafcf180af4e2, the synthetic merge GitHub builds for a pull_request run, whose tree equals the head's and which the receipt records as checked_commit) (job proof-evidence, artifact lean-specification-proofs-38121713840-1, sha256 640682d631d052f4903d66f506740ae8fa91d19185001e70a1502f404eb44175): receipt formalization_status kernel-checked, leanchecker PASS, theorem_count 52, worktree CLEAN; the 38 theorems of PR head 00d2ac6e were first receipted by run 38116277597 (actual tested merge c4c66bb8cb26f0cd9bc03d52bb25f1b3925b272c with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2, same tree as the head; artifact lean-specification-proofs-38116277597-1); corroborated on PR head d9b8dd33 by run 38122386459 (actual tested merge 866136cca66b46e6dbd3186b47c9340f7e93b4f6 with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2, same tree as the head; receipt formalization_status kernel-checked, theorem_count 52, worktree CLEAN; artifact lean-specification-proofs-38122386459-1, sha256 edd52190d6af5828e8229c161c3b77e87a540caf440070d66b1b7f415008ebc3)", + "note": "3 theorem(s) of this row (P15Elementary.twoCoordGeneratorPrices, P15Elementary.logOnePlusBelowIdentity, P15Elementary.demandOneRefutation) are inventoried by the proof packet's check.py (source mode SOURCE_CHECK_PASS: 52 inventory theorems over SpecificationProofs/{P15Elementary,P15Structure,P15Hazard,P15Covers,P15Budget,Side24Elementary,RNProbability}.lean, 51 distinct registered Props, each theorem typed exactly as its registered Prop, applied to its own parameters). 3 of them (P15Elementary.twoCoordGeneratorPrices, P15Elementary.logOnePlusBelowIdentity, P15Elementary.demandOneRefutation) are among the 38 theorems of PR head 00d2ac6e kernel-checked by the hosted run 38116277597 (actual tested merge c4c66bb8cb26f0cd9bc03d52bb25f1b3925b272c with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2; job proof-evidence: fresh build, leanchecker PASS, `#print axioms` within {propext, Classical.choice, Quot.sound} for each, receipt formalization_status kernel-checked, worktree CLEAN; artifact lean-specification-proofs-38116277597-1), and again by the hosted run 38121713840 (PR head 910809d6; actual tested merge 5b198699308e0585904c21d12bf540cf2475d2f0 with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2). `proved` is the label of a committed proof package; `kernel-checked` appears only in a run receipt. Evidence about the registered Props only: not about the informal claim, its alignment (PENDING_INDEPENDENT_REVIEW), review or acceptance; the claim-level label is unchanged; organizational-independence credit 0 (Anthropic / Claude)." + } + ], + "not_established": "DemandOneRefutation states the refutation (the two-coordinate data form a realized family with K_H(d) = 1, obstruction {X}, admissible prices 2/3, mu_p(D) = 3/4, cover cost 4/9 > 1/3 > log(4/3)). DemandOneRefutation, TwoCoordGeneratorPrices and LogOnePlusBelowIdentity each have a theorem of exactly their type in the proof packet specifications/lean_statement_proofs_20261011 (listed below as `proved`, the label of a committed proof package; the hosted lean-specification-proofs.yml run 38116277597 (PR head 00d2ac6e; actual tested merge c4c66bb8cb26f0cd9bc03d52bb25f1b3925b272c with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2) kernel-checked them (receipt formalization_status kernel-checked, leanchecker PASS, `#print axioms` within {propext, Classical.choice, Quot.sound})); the two logarithm inequalities phi(1/2) = log 2 > 2/3 and log(4/3) < 1/3 are conjuncts of DemandOneRefutation and are proved inside its theorem from Mathlib's Real.log bounds. The claim-level label stays `specified`, not `proved`: this register admits only none/specified at claim level (no research claim of this programme is proved), whether DemandOneRefutation says what the source paragraph says is the independent reviewer's alignment question (PENDING_INDEPENDENT_REVIEW), the hosted run 38116277597 (PR head 00d2ac6e; actual tested merge c4c66bb8cb26f0cd9bc03d52bb25f1b3925b272c with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2) kernel-checked the Prop and nothing more, and a kernel-checked Prop is evidence about that Prop only. This is the one row of the register where a theorem proves the Prop registered as stating the claim itself; it is recorded here for the operator and not acted on. The 6 main P15 arithmetic theorems listed as `proved` (good sets, obstruction, 3/4 over denominator 4, prices 9,6,6,4 over 9, 3*4 > 9) are at commit 91cffbb5 of main PR #358, not on main; they are finite arithmetic, not the refutation. The counterexample does not refute d_i >= 2 successors or original P15-B (the disposition reason; the theorem's docstring says the same). Disposition EXACT_COUNTEREXAMPLE is transcribed, not re-derived. Nonauthor review and acceptance are not claimed by any statement or theorem; alignment of every statement with its anchor is PENDING_INDEPENDENT_REVIEW; organizational-independence credit of this packet and of the proof packet is 0.", + "next_step": "The hosted lean-specification-proofs.yml run 38116277597 (PR head 00d2ac6e; actual tested merge c4c66bb8cb26f0cd9bc03d52bb25f1b3925b272c with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2) produced the first receipt (`kernel-checked` appears only there); later commits need their own run. Independent (non-Anthropic) reviewer: alignment of DemandOneRefutation with the source paragraph (same two-coordinate family, prices, cover cost and the \"does not contradict original P15-B\" scope); any claim-level label beyond none/specified is a register-schema decision for the operator after that review, which no receipt produces. main: PR #358 merge (operator) so the 6 arithmetic theorems are on main." }, { "claim_id": "p15-price-budget-restricted", @@ -1285,54 +1777,164 @@ "does_not_claim": "the bound (statement only); the source notes \"The extra demand hypothesis d>=2 is load-bearing\" and that `p_v <= 1/4` \"is a sufficient range, not an asserted sharp threshold\"." }, { - "package": "specifications/lean_statements_20261010", - "module": "Specifications/P15.lean", - "declaration": "UniversalLaw.Spec.P15.RestrictedTransformedPriceBudget", - "kind": "def_prop", - "formal_progress": "specified", - "anchor": " covercost_c(O_K(D)) <= min(1,(16/27)*[-log mu_p(D)]). (T1)", - "does_not_claim": "the bound (statement only); any retraction of the demand-one refutation; the unrestricted prize; new classical coloring theory; disposition transcribed from LANDING_CLAIMS for p15-price-budget-restricted: HOLD_WITH_DOMAIN; nonauthor review (\"nonauthor review open\") and acceptance are not claimed here." + "package": "specifications/lean_statements_20261010", + "module": "Specifications/P15.lean", + "declaration": "UniversalLaw.Spec.P15.RestrictedTransformedPriceBudget", + "kind": "def_prop", + "formal_progress": "specified", + "anchor": " covercost_c(O_K(D)) <= min(1,(16/27)*[-log mu_p(D)]). (T1)", + "does_not_claim": "the bound (statement only); any retraction of the demand-one refutation; the unrestricted prize; new classical coloring theory; disposition transcribed from LANDING_CLAIMS for p15-price-budget-restricted: HOLD_WITH_DOMAIN; nonauthor review (\"nonauthor review open\") and acceptance are not claimed here." + }, + { + "package": "specifications/lean_statements_20261010", + "module": "Specifications/P15.lean", + "declaration": "UniversalLaw.Spec.P15.RhoTestSufficient", + "kind": "def_prop", + "formal_progress": "specified", + "anchor": "If rho<=1 the same argument proves price({X})<=q for that block.", + "does_not_claim": "the statement (statement only); anything when `rho > 1` (the source: a block with `rho > 1` \"must not be labeled infeasible\")." + }, + { + "package": "specifications/lean_statements_20261010", + "module": "Specifications/P15.lean", + "declaration": "UniversalLaw.Spec.P15.CapTestAtTwoThirds", + "kind": "def_prop", + "formal_progress": "specified", + "anchor": "or if q>=2/3 (then phi(q)=1, since log3>1)", + "does_not_claim": "the statement (statement only); the integral proof of `log 3 > 1` is not specified; the checker program of that section is not specified." + }, + { + "package": "specifications/lean_statements_20261010", + "module": "Specifications/P15.lean", + "declaration": "UniversalLaw.Spec.P15.Benchmark816TransformedRange", + "kind": "def_prop", + "formal_progress": "specified", + "anchor": " 0<=c_v<=log(40900/40899),", + "does_not_claim": "the statement (statement only); \"No large witness enumeration\" is involved, nor any claim about earlier P15 inputs." + }, + { + "package": "specifications/lean_statements_20261010", + "module": "Specifications/P15.lean", + "declaration": "UniversalLaw.Spec.P15.Benchmark816RationalPrice", + "kind": "def_prop", + "formal_progress": "specified", + "anchor": " 6*log(40900/40899)^409 <=6/(40899^409). (T7)", + "does_not_claim": "the statements (statement only); the rational identity `1/40900 + (1/40900)^2/2 = 81801/3345620000` is exact arithmetic not re-proved here; admissibility rests on `integral_0^p 1/(1-t) dt > integral_0^p (1+t) dt`, which is not specified." + }, + { + "package": "d6g8k5htny-coder/main formal/ at 91cffbb51d1636f382e9d61a1ecb6f7cd38e1d06 (PR #358, not yet on main)", + "module": "UniversalLaw/P15/FullPrice.lean", + "declaration": "UniversalLaw.P15.t3_ratio_at_minimal_block", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "= (4^(a+1))/(3^n)\n <= (4/3)*(4/9)^a <=16/27.", + "does_not_claim": "the ratio chain (T3) (which uses (T2), p_v <= 1/4 and independence); Theorem (T1); the demand-one counterexample's applicability at a = d = 1; prize status" + }, + { + "package": "d6g8k5htny-coder/main formal/ at 91cffbb51d1636f382e9d61a1ecb6f7cd38e1d06 (PR #358, not yet on main)", + "module": "UniversalLaw/P15/FullPrice.lean", + "declaration": "UniversalLaw.P15.t3_bound_finite_instances", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "<= (4/3)*(4/9)^a <=16/27", + "does_not_claim": "the inequalities for all a >= 1, n >= 2a+1; (T2); Theorem (T1); prize status" + }, + { + "package": "d6g8k5htny-coder/main formal/ at 91cffbb51d1636f382e9d61a1ecb6f7cd38e1d06 (PR #358, not yet on main)", + "module": "UniversalLaw/P15/FullPrice.lean", + "declaration": "UniversalLaw.P15.explicit_rational_price_above_p", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "c=p+p^2/2=81801/3345620000", + "does_not_claim": "admissibility c <= phi(p) (the integral inequality); the price bound (T7); that the 816-label cover is valid at these prices; prize status" + }, + { + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "module": "SpecificationProofs/P15Elementary.lean", + "declaration": "UniversalLaw.Proofs.P15Elementary.logRatioBound", + "kind": "theorem", + "formal_progress": "proved", + "anchor": " -log(1-p)=integral_0^p dt/(1-t) <= p/(1-p). (T2)", + "does_not_claim": "display (T1) or the restricted budget; the source's integral representation of `-log(1-p)` is not formalised." + }, + { + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "module": "SpecificationProofs/P15Elementary.lean", + "declaration": "UniversalLaw.Proofs.P15Elementary.capTestAtTwoThirds", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "or if q>=2/3 (then phi(q)=1, since log3>1)", + "does_not_claim": "the checker program of the source's Section 5, nor any budget statement." + }, + { + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "module": "SpecificationProofs/P15Elementary.lean", + "declaration": "UniversalLaw.Proofs.P15Elementary.ratioExponentBound", + "kind": "theorem", + "formal_progress": "proved", + "anchor": " <= (4/3)*(4/9)^a <=16/27. (T3)", + "does_not_claim": "the ratio steps of (T3) preceding the exponent arithmetic, or (T4)/(T1)." + }, + { + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "module": "SpecificationProofs/P15Structure.lean", + "declaration": "UniversalLaw.Proofs.P15Structure.benchmark816RationalPrice", + "kind": "theorem", + "formal_progress": "proved", + "anchor": " 6*log(40900/40899)^409 <=6/(40899^409). (T7)", + "does_not_claim": "the (T1) budget itself, admissibility of any other price vector, or the informal claim; no review or acceptance." + }, + { + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "module": "SpecificationProofs/P15Budget.lean", + "declaration": "UniversalLaw.Proofs.P15Budget.restrictedLocalBudget", + "kind": "theorem", + "formal_progress": "proved", + "anchor": " price({X}) <= (16/27)q <= phi(q). (T4)", + "does_not_claim": "the informal display (T4) or its review and acceptance; sharpness of the range `p_v ≤ 1/4` (the source: \"a sufficient range, not an asserted sharp threshold\"); anything at `d_i = 1` (the source's refutation stands); the alignment of `localFailure`, `phi` with the source's objects (PENDING_INDEPENDENT_REVIEW); the disposition HOLD_WITH_DOMAIN of `p15-price-budget-restricted`, which is transcribed in the register, not derived here." }, { - "package": "specifications/lean_statements_20261010", - "module": "Specifications/P15.lean", - "declaration": "UniversalLaw.Spec.P15.RhoTestSufficient", - "kind": "def_prop", - "formal_progress": "specified", + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "module": "SpecificationProofs/P15Budget.lean", + "declaration": "UniversalLaw.Proofs.P15Budget.rhoTestSufficient", + "kind": "theorem", + "formal_progress": "proved", "anchor": "If rho<=1 the same argument proves price({X})<=q for that block.", - "does_not_claim": "the statement (statement only); anything when `rho > 1` (the source: a block with `rho > 1` \"must not be labeled infeasible\")." + "does_not_claim": "the informal display (T5) or its review and acceptance; anything when `rho > 1` (the source: \"rho>1 is not a counterexample and must not be labeled infeasible\"); the alignment of `localFailure`, `phi`, `rhoTest` with the source's objects (PENDING_INDEPENDENT_REVIEW); the disposition HOLD_WITH_DOMAIN of `p15-price-budget-restricted`, which is transcribed in the register, not derived here." }, { - "package": "specifications/lean_statements_20261010", - "module": "Specifications/P15.lean", - "declaration": "UniversalLaw.Spec.P15.CapTestAtTwoThirds", - "kind": "def_prop", - "formal_progress": "specified", - "anchor": "or if q>=2/3 (then phi(q)=1, since log3>1)", - "does_not_claim": "the statement (statement only); the integral proof of `log 3 > 1` is not specified; the checker program of that section is not specified." + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "module": "SpecificationProofs/P15Budget.lean", + "declaration": "UniversalLaw.Proofs.P15Budget.restrictedTransformedPriceBudget", + "kind": "theorem", + "formal_progress": "proved", + "anchor": " covercost_c(O_K(D)) <= min(1,(16/27)*[-log mu_p(D)]). (T1)", + "does_not_claim": "the informal display (T1) or its review and acceptance; any retraction of the demand-one refutation; the unrestricted prize; new classical coloring theory; attainment of the infimum; the alignment of `coverCost`, `mu`, `phi` with the source's objects (PENDING_INDEPENDENT_REVIEW); the disposition HOLD_WITH_DOMAIN of `p15-price-budget-restricted`, which is transcribed in the register, not derived here." }, { - "package": "specifications/lean_statements_20261010", - "module": "Specifications/P15.lean", - "declaration": "UniversalLaw.Spec.P15.Benchmark816TransformedRange", - "kind": "def_prop", - "formal_progress": "specified", + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "module": "SpecificationProofs/P15Budget.lean", + "declaration": "UniversalLaw.Proofs.P15Budget.benchmark816TransformedRange", + "kind": "theorem", + "formal_progress": "proved", "anchor": " 0<=c_v<=log(40900/40899),", - "does_not_claim": "the statement (statement only); \"No large witness enumeration\" is involved, nor any claim about earlier P15 inputs." + "does_not_claim": "the informal Section 4 or its review and acceptance; optimality of the 816-label cover; the whole-ground value `818` (a separate `Prop`); the alignment of the formal objects with the source's (PENDING_INDEPENDENT_REVIEW); the disposition HOLD_WITH_DOMAIN of `p15-price-budget-restricted`, which is transcribed in the register, not derived here." + } + ], + "kernel_evidence": [ + { + "package": "d6g8k5htny-coder/main formal/ at 91cffbb51d1636f382e9d61a1ecb6f7cd38e1d06 (PR #358, not yet on main)", + "receipt_or_workflow": "workspace-landing run 38096827443, job formal / formal-evidence, artifact formal-verification-38096827443", + "note": "The 3 P15 targets of source p15-price-budget (UniversalLaw/P15/FullPrice.lean: t3_ratio_at_minimal_block, t3_bound_finite_instances, explicit_rational_price_above_p) are decide-proved integer or cross-multiplied rational facts at commit 91cffbb5 of main PR #358, not on main (manifest label `proved`; `kernel-checked` only in the run receipt, a workflow artifact of the hosted run, none committed in tree). Arithmetic skeleton only: main formal/SCOPE.md says none of these targets is Theorem F (F2), Theorem (T1), Theorem P2, Proposition P1, the enclosure (F3) of rho_star, any inequality involving log, exp or e, the probability semantics of mu_p, the union bound (P11), p_star, the P15-B amalgamation or any prize status; alignment PENDING_INDEPENDENT_REVIEW; organizational-independence credit 0 (Anthropic / Claude)." }, { - "package": "specifications/lean_statements_20261010", - "module": "Specifications/P15.lean", - "declaration": "UniversalLaw.Spec.P15.Benchmark816RationalPrice", - "kind": "def_prop", - "formal_progress": "specified", - "anchor": " 6*log(40900/40899)^409 <=6/(40899^409). (T7)", - "does_not_claim": "the statements (statement only); the rational identity `1/40900 + (1/40900)^2/2 = 81801/3345620000` is exact arithmetic not re-proved here; admissibility rests on `integral_0^p 1/(1-t) dt > integral_0^p (1+t) dt`, which is not specified." + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "receipt_or_workflow": ".github/workflows/lean-specification-proofs.yml; hosted run 38121713840 (PR head 910809d6; actual tested checkout the merge commit 5b198699308e0585904c21d12bf540cf2475d2f0 of that head into base b2d70d77876a10c365f5db5d3b6cafcf180af4e2, the synthetic merge GitHub builds for a pull_request run, whose tree equals the head's and which the receipt records as checked_commit) (job proof-evidence, artifact lean-specification-proofs-38121713840-1, sha256 640682d631d052f4903d66f506740ae8fa91d19185001e70a1502f404eb44175): receipt formalization_status kernel-checked, leanchecker PASS, theorem_count 52, worktree CLEAN; the 38 theorems of PR head 00d2ac6e were first receipted by run 38116277597 (actual tested merge c4c66bb8cb26f0cd9bc03d52bb25f1b3925b272c with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2, same tree as the head; artifact lean-specification-proofs-38116277597-1); corroborated on PR head d9b8dd33 by run 38122386459 (actual tested merge 866136cca66b46e6dbd3186b47c9340f7e93b4f6 with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2, same tree as the head; receipt formalization_status kernel-checked, theorem_count 52, worktree CLEAN; artifact lean-specification-proofs-38122386459-1, sha256 edd52190d6af5828e8229c161c3b77e87a540caf440070d66b1b7f415008ebc3)", + "note": "8 theorem(s) of this row (P15Elementary.logRatioBound, P15Elementary.capTestAtTwoThirds, P15Elementary.ratioExponentBound, P15Structure.benchmark816RationalPrice, P15Budget.restrictedLocalBudget, P15Budget.rhoTestSufficient, P15Budget.restrictedTransformedPriceBudget, P15Budget.benchmark816TransformedRange) are inventoried by the proof packet's check.py (source mode SOURCE_CHECK_PASS: 52 inventory theorems over SpecificationProofs/{P15Elementary,P15Structure,P15Hazard,P15Covers,P15Budget,Side24Elementary,RNProbability}.lean, 51 distinct registered Props, each theorem typed exactly as its registered Prop, applied to its own parameters). 4 of them (P15Elementary.logRatioBound, P15Elementary.capTestAtTwoThirds, P15Elementary.ratioExponentBound, P15Structure.benchmark816RationalPrice) are among the 38 theorems of PR head 00d2ac6e kernel-checked by the hosted run 38116277597 (actual tested merge c4c66bb8cb26f0cd9bc03d52bb25f1b3925b272c with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2; job proof-evidence: fresh build, leanchecker PASS, `#print axioms` within {propext, Classical.choice, Quot.sound} for each, receipt formalization_status kernel-checked, worktree CLEAN; artifact lean-specification-proofs-38116277597-1), and again by the hosted run 38121713840 (PR head 910809d6; actual tested merge 5b198699308e0585904c21d12bf540cf2475d2f0 with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2). 4 (P15Budget.restrictedLocalBudget, P15Budget.rhoTestSufficient, P15Budget.restrictedTransformedPriceBudget, P15Budget.benchmark816TransformedRange) were added after commit 00d2ac6e and kernel-checked by the hosted run 38121713840 (PR head 910809d6; actual tested merge 5b198699308e0585904c21d12bf540cf2475d2f0 with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2) (job proof-evidence: fresh build, leanchecker PASS, `#print axioms` within {propext, Classical.choice, Quot.sound}, receipt formalization_status kernel-checked, worktree CLEAN). `proved` is the label of a committed proof package; `kernel-checked` appears only in a run receipt. Evidence about the registered Props only: not about the informal claim, its alignment (PENDING_INDEPENDENT_REVIEW), review or acceptance; the claim-level label is unchanged; organizational-independence credit 0 (Anthropic / Claude)." } ], - "kernel_evidence": [], - "not_established": "RestrictedTransformedPriceBudget states (T1) for every realized family with a_i >= 1, d_i >= 2, p_v <= 1/4, c_v <= phi(p_v); not proved. (T2), the exponent arithmetic of (T3), (T4), the per-block sufficient test (T5), the cap test and the Section 4 benchmark statements are stated only; the intermediate ratio steps of (T3), the integral representation behind (T2) and the admissibility integral are not specified. No `proved` statement is listed: main's 3 P15 arithmetic theorems for this claim (the a = 1, n = 3 instance 16/27, finite instances of the (T3) bound and the rational identity 81801/3345620000) exist only in this programme's uncommitted main worktree, on no commit, and are not listed until a commit and a hosted formal-verification.yml run exist; they are not (T1) in any case. The dependency on claim p15-realized-covers is not discharged here. Disposition HOLD_WITH_DOMAIN (\"independent theorem review not yet source-bound in manifest\") is transcribed, not re-derived. Nonauthor review and acceptance are not claimed by any statement; alignment of every statement with its anchor is PENDING_INDEPENDENT_REVIEW; organizational-independence credit of this packet is 0.", - "next_step": "Math- Mathlib lane: LogRatioBound (-log(1-p) <= p/(1-p)) and RatioExponentBound are provable from Mathlib Real.log facts and are the first targets; independent reviewer: alignment of RestrictedTransformedPriceBudget with (T1) including the per-coordinate price hypothesis and the K >= K_H(d) palette. main: commit and push the P15 modules (hosted formal-verification.yml green), then list the P15 arithmetic theorems here as `proved` statements citing the 40-hex commit and the workflow run; until then no P15 theorem is listed." + "not_established": "RestrictedTransformedPriceBudget states (T1) for every realized family with a_i >= 1, d_i >= 2, p_v <= 1/4, c_v <= phi(p_v) and is proved as stated in the proof packet; that is evidence about the Prop (for the formal RealizedData record, downset, coverCost and mu), not acceptance of the informal theorem: the claim-level label stays `specified` (claim-level vocabulary none/specified; alignment PENDING_INDEPENDENT_REVIEW). Props of this row with a theorem of exactly their type in the proof packet specifications/lean_statement_proofs_20261011: LogRatioBound, RatioExponentBound, RestrictedLocalBudget, RestrictedTransformedPriceBudget, RhoTestSufficient, CapTestAtTwoThirds, Benchmark816TransformedRange, Benchmark816RationalPrice (8 entries below, label `proved`; 4 of them (P15Elementary.logRatioBound, P15Elementary.ratioExponentBound, P15Elementary.capTestAtTwoThirds, P15Structure.benchmark816RationalPrice) kernel-checked by the hosted run 38116277597 (PR head 00d2ac6e; actual tested merge c4c66bb8cb26f0cd9bc03d52bb25f1b3925b272c with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2); 4 of them (P15Budget.restrictedLocalBudget, P15Budget.restrictedTransformedPriceBudget, P15Budget.rhoTestSufficient, P15Budget.benchmark816TransformedRange) added after commit 00d2ac6e and kernel-checked by the hosted run 38121713840 (PR head 910809d6; actual tested merge 5b198699308e0585904c21d12bf540cf2475d2f0 with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2) (job proof-evidence: fresh build, leanchecker PASS, `#print axioms` within {propext, Classical.choice, Quot.sound}, receipt formalization_status kernel-checked, worktree CLEAN)). Theorem-shaped Props of this row still `specified` with no theorem: none. The intermediate ratio steps of (T3) are proved inside the theorems that use them; the integral representation behind (T2), the admissibility integral and the Section 5 checker program are not specified. The 3 main P15 arithmetic theorems listed as `proved` (the a = 1, n = 3 instance 16/27, finite instances of the (T3) bound and the rational identity 81801/3345620000) are at commit 91cffbb5 of main PR #358, not on main; they are not (T1). The dependency on claim p15-realized-covers is discharged only to the extent that row records. Disposition HOLD_WITH_DOMAIN (\"independent theorem review not yet source-bound in manifest\") is transcribed, not re-derived. Nonauthor review and acceptance are not claimed by any statement or theorem; alignment of every statement with its anchor is PENDING_INDEPENDENT_REVIEW; organizational-independence credit of this packet and of the proof packet is 0.", + "next_step": "Math- Mathlib lane: every theorem-shaped Prop of this row has a theorem; every theorem of this row has a hosted receipt (run 38121713840 (PR head 910809d6; actual tested merge 5b198699308e0585904c21d12bf540cf2475d2f0 with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2)). Independent reviewer: alignment of RestrictedTransformedPriceBudget with (T1) including the per-coordinate price hypothesis, the K >= K_H(d) palette and the cappedHazard endpoint convention. main: PR #358 merge (operator) so the 3 arithmetic theorems are on main." }, { "claim_id": "p15-full-price", @@ -1524,11 +2126,184 @@ "formal_progress": "specified", "anchor": "Therefore 3e-2<197/327/6 and rho_star<6/7.", "does_not_claim": "the statements (statement only); the two exact rational identities are exact arithmetic not re-proved here; the series and geometric-tail bounds behind `e < 31967/11760` are not specified." + }, + { + "package": "d6g8k5htny-coder/main formal/ at 91cffbb51d1636f382e9d61a1ecb6f7cd38e1d06 (PR #358, not yet on main)", + "module": "UniversalLaw/P15/FullPrice.lean", + "declaration": "UniversalLaw.P15.rho_star_endpoints_adjacent", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "0.84547981724898672067 < rho_star", + "does_not_claim": "that rho_star = 1/(3 - log(3e - 2)) lies between them (needs Real.exp/Real.log; Mathlib lane); Theorem F; prize status" + }, + { + "package": "d6g8k5htny-coder/main formal/ at 91cffbb51d1636f382e9d61a1ecb6f7cd38e1d06 (PR #358, not yet on main)", + "module": "UniversalLaw/P15/FullPrice.lean", + "declaration": "UniversalLaw.P15.rho_star_upper_endpoint_below_six_sevenths", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "< 0.84547981724898672068 < 6/7", + "does_not_claim": "rho_star < 6/7 as a statement about the real number; h_star > 7/6; Theorem F; prize status" + }, + { + "package": "d6g8k5htny-coder/main formal/ at 91cffbb51d1636f382e9d61a1ecb6f7cd38e1d06 (PR #358, not yet on main)", + "module": "UniversalLaw/P15/FullPrice.lean", + "declaration": "UniversalLaw.P15.sixteen_twentysevenths_below_six_sevenths", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "gives the stronger factor16/27 on its smaller domain", + "does_not_claim": "Theorem (T1) or its domain p_v <= 1/4; that 16/27 < rho_star as a real-number statement; Theorem F; prize status" + }, + { + "package": "d6g8k5htny-coder/main formal/ at 91cffbb51d1636f382e9d61a1ecb6f7cd38e1d06 (PR #358, not yet on main)", + "module": "UniversalLaw/P15/FullPrice.lean", + "declaration": "UniversalLaw.P15.minimal_block_size_instances", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "Our n=ad+1 and d>=2 imply n>=2a+1.", + "does_not_claim": "the implication for all a >= 1, d >= 2; the binomial tail comparison (F9)–(F11); the sharpness argument of section 5; Theorem F; prize status" + }, + { + "package": "d6g8k5htny-coder/main formal/ at 91cffbb51d1636f382e9d61a1ecb6f7cd38e1d06 (PR #358, not yet on main)", + "module": "UniversalLaw/P15/FullPrice.lean", + "declaration": "UniversalLaw.P15.e_rational_bounds_ordering", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "e < 31967/11760 < 87/32,\n 87/32-31967/11760=11/23520.", + "does_not_claim": "e < 31967/11760 (exponential series plus geometric tail); any statement about e; Theorem F; prize status" + }, + { + "package": "d6g8k5htny-coder/main formal/ at 91cffbb51d1636f382e9d61a1ecb6f7cd38e1d06 (PR #358, not yet on main)", + "module": "UniversalLaw/P15/FullPrice.lean", + "declaration": "UniversalLaw.P15.exp_eleven_sixths_taylor_certificate", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "sum_(j=0)^5 (11/6)^j/j! -197/32=26081/933120>0", + "does_not_claim": "that the partial sum is below exp(11/6) (positivity of the omitted terms is analysis); 197/32 < exp(11/6); Theorem F; prize status" + }, + { + "package": "d6g8k5htny-coder/main formal/ at 91cffbb51d1636f382e9d61a1ecb6f7cd38e1d06 (PR #358, not yet on main)", + "module": "UniversalLaw/P15/FullPrice.lean", + "declaration": "UniversalLaw.P15.h_star_rational_certificate_constants", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "Therefore 3e-2<197/327/6 and rho_star<6/7.", + "does_not_claim": "e < 87/32, 197/32 < exp(11/6), monotonicity of log, h_star > 7/6 and rho_star < 6/7 as real-number statements; Theorem F; prize status" + }, + { + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "module": "SpecificationProofs/P15Elementary.lean", + "declaration": "UniversalLaw.Proofs.P15Elementary.rhoStarBelowSixSevenths", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "Thus 6/7 is a simpler valid rational factor.", + "does_not_claim": "the 20-digit enclosure (F3) (`RhoStarEnclosure`), the budget (F2), or any review/acceptance of P15-FULL-TRANSFORMED-PRICE-20260924-v1 (disposition REVIEWED_SCOPED is transcribed, not derived)." + }, + { + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "module": "SpecificationProofs/P15Elementary.lean", + "declaration": "UniversalLaw.Proofs.P15Elementary.sixSeventhsCertificate", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "Therefore 3e-2<197/327/6 and rho_star<6/7.", + "does_not_claim": "the series and geometric-tail bounds the source uses for `e < 31967/11760` (a sharper Mathlib bound is used instead), nor anything about (F2)." + }, + { + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "module": "SpecificationProofs/P15Elementary.lean", + "declaration": "UniversalLaw.Proofs.P15Elementary.hStarExceedsOne", + "kind": "theorem", + "formal_progress": "proved", + "anchor": " e^2-(3e-2)=(e-1)(e-2)>0,", + "does_not_claim": "(F11) for general `(n, a)` (that is `CapacityWorstCase`)." + }, + { + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "module": "SpecificationProofs/P15Elementary.lean", + "declaration": "UniversalLaw.Proofs.P15Elementary.phiAtPStar", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "at every p_i=p_star and every c_i=1, the two sides of (F7) are equal", + "does_not_claim": "equality of the two sides of (F7) (not specified separately)." + }, + { + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "module": "SpecificationProofs/P15Elementary.lean", + "declaration": "UniversalLaw.Proofs.P15Elementary.hazardStarPositive", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "The probability is positive on this compact cube because the empty set is admitted and every p_i(t)<1.", + "does_not_claim": "the bounds (F5)-(F8) that use `H_A > 0`." + }, + { + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "module": "SpecificationProofs/P15Elementary.lean", + "declaration": "UniversalLaw.Proofs.P15Elementary.oddMajorityIdentity", + "kind": "theorem", + "formal_progress": "proved", + "anchor": " =p(1-2p)P(S=a)<0. (F10)", + "does_not_claim": "(F11) itself (the chain over `a` is in `CapacityWorstCase`)." + }, + { + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "module": "SpecificationProofs/P15Elementary.lean", + "declaration": "UniversalLaw.Proofs.P15Elementary.capacityWorstCase", + "kind": "theorem", + "formal_progress": "proved", + "anchor": " =3-log(3e-2)=h_star>1. (F11)", + "does_not_claim": "the local price bound (F12) or the assembly (F13); the source's remark \"it is not a finite-grid extrapolation\" is a statement about its own proof, not re-derived." + }, + { + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "module": "SpecificationProofs/P15Elementary.lean", + "declaration": "UniversalLaw.Proofs.P15Elementary.demandOneBoundary", + "kind": "theorem", + "formal_progress": "proved", + "anchor": " mu_p(D)=1-p_star^(a+1)>1-p_star=exp(-1),", + "does_not_claim": "any retraction of original P15-B (\"whose local-budget premise is missing in that case\"); the equality `covercost = 1` (only the lower bound is needed and stated)." + }, + { + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "module": "SpecificationProofs/P15Elementary.lean", + "declaration": "UniversalLaw.Proofs.P15Elementary.capacityHazardIsBinomial", + "kind": "theorem", + "formal_progress": "proved", + "anchor": " H_(n,a)=-log P(Bin(n,p_star)<=a). (F9)", + "does_not_claim": "the informal claim's review or acceptance; the alignment of `capacityFamily` and `binomTail` with the source's `A = {S : |S| ≤ a}` and `P(Bin(n, p_star) ≤ a)` (PENDING_INDEPENDENT_REVIEW); displays (F10)-(F11) (`CapacityWorstCase`) or anything about the budget (F2)." + }, + { + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "module": "SpecificationProofs/P15Elementary.lean", + "declaration": "UniversalLaw.Proofs.P15Elementary.sharpnessOfRhoStar", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "Replacing rho_star by any smaller constant in (F2) would make its right side strictly less than one.", + "does_not_claim": "the informal sharpness claim's review or acceptance; the alignment of the Lean `tripleBlock`, `obstruction`, `coverCost` and `cappedHazard` with the source's objects (PENDING_INDEPENDENT_REVIEW); sharpness for any family other than the triple block; the budget (F2) itself; any necessity claim for multi-block families with some demand one (\"other constraints may change its budget\")." + }, + { + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "module": "SpecificationProofs/P15Hazard.lean", + "declaration": "UniversalLaw.Proofs.P15Hazard.globalAssemblyHazard", + "kind": "theorem", + "formal_progress": "proved", + "anchor": " sum_i [-log mu_p(D_i)] <= -log mu_p(D). (F13)", + "does_not_claim": "the informal display (F13) or its review and acceptance; the local bound (F12) or the full-price theorem (F2); any independence of crossing failures (none is used); the alignment of the formal `mu`, `localGood` with the source's `mu_p(D)`, `mu_p(D_i)` (PENDING_INDEPENDENT_REVIEW); the disposition of `p15-full-price`, which is transcribed in the register, not derived here." } ], - "kernel_evidence": [], - "not_established": "FullTransformedPriceBudget states (F2), RhoStarEnclosure states (F3), SharpnessOfRhoStar states the attainment clause; none is proved. The hazard interpolation lemma is stated as separate coordinatewise concavity (CoordinatewiseConcavity) and its consequences (F6)-(F8); the derivative formulas (F4)-(F5) are not specified. No `proved` statement is listed: main's 7 P15 arithmetic theorems for this claim (finite arithmetic of the Section 6 certificate chain: adjacent 20-digit endpoints as Nat, 16/27 < 6/7, n >= 2a+1 instances, the rational orderings and the degree-5 Taylor partial sum) exist only in this programme's uncommitted main worktree, on no commit, and are not listed until a commit and a hosted formal-verification.yml run exist; they would not place rho_star = 1/(3 - log(3e - 2)) between the endpoints, prove e < 87/32 or 197/32 < exp(11/6), or be Theorem F. The full_price.py Fraction procedure is not a kernel proof and is not specified. No arbitrary-downset or unrestricted P15 prize statement (original_prize_closed stays false). Disposition REVIEWED_SCOPED is transcribed, not re-derived. Nonauthor review and acceptance are not claimed by any statement; alignment of every statement with its anchor is PENDING_INDEPENDENT_REVIEW; organizational-independence credit of this packet is 0.", - "next_step": "Math- Mathlib lane: RhoStarBelowSixSevenths / SixSeventhsCertificate (Real.exp and Real.log bounds e < 31967/11760 < 87/32, 197/32 < exp(11/6)) are the next full-theorem target named in main docs/FORMAL_VERIFICATION_ROLLOUT_20260927.md; then HStarExceedsOne and PhiAtPStar. Independent reviewer: alignment of FullTransformedPriceBudget with (F2), in particular the quantification over ALL p in [0,1]^X and the SAME palette K >= K_H(d). main: commit and push the P15 modules (hosted formal-verification.yml green), then list the P15 arithmetic theorems here as `proved` statements citing the 40-hex commit and the workflow run; until then no P15 theorem is listed." + "kernel_evidence": [ + { + "package": "d6g8k5htny-coder/main formal/ at 91cffbb51d1636f382e9d61a1ecb6f7cd38e1d06 (PR #358, not yet on main)", + "receipt_or_workflow": "workspace-landing run 38096827443, job formal / formal-evidence, artifact formal-verification-38096827443", + "note": "The 7 P15 targets of source p15-full-price (UniversalLaw/P15/FullPrice.lean: rho_star_endpoints_adjacent, rho_star_upper_endpoint_below_six_sevenths, sixteen_twentysevenths_below_six_sevenths, minimal_block_size_instances, e_rational_bounds_ordering, exp_eleven_sixths_taylor_certificate, h_star_rational_certificate_constants) are decide-proved integer or cross-multiplied rational facts at commit 91cffbb5 of main PR #358, not on main (manifest label `proved`; `kernel-checked` only in the run receipt, a workflow artifact of the hosted run, none committed in tree). Arithmetic skeleton only: main formal/SCOPE.md says none of these targets is Theorem F (F2), Theorem (T1), Theorem P2, Proposition P1, the enclosure (F3) of rho_star, any inequality involving log, exp or e, the probability semantics of mu_p, the union bound (P11), p_star, the P15-B amalgamation or any prize status; alignment PENDING_INDEPENDENT_REVIEW; organizational-independence credit 0 (Anthropic / Claude)." + }, + { + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "receipt_or_workflow": ".github/workflows/lean-specification-proofs.yml; hosted run 38121713840 (PR head 910809d6; actual tested checkout the merge commit 5b198699308e0585904c21d12bf540cf2475d2f0 of that head into base b2d70d77876a10c365f5db5d3b6cafcf180af4e2, the synthetic merge GitHub builds for a pull_request run, whose tree equals the head's and which the receipt records as checked_commit) (job proof-evidence, artifact lean-specification-proofs-38121713840-1, sha256 640682d631d052f4903d66f506740ae8fa91d19185001e70a1502f404eb44175): receipt formalization_status kernel-checked, leanchecker PASS, theorem_count 52, worktree CLEAN; the 38 theorems of PR head 00d2ac6e were first receipted by run 38116277597 (actual tested merge c4c66bb8cb26f0cd9bc03d52bb25f1b3925b272c with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2, same tree as the head; artifact lean-specification-proofs-38116277597-1); corroborated on PR head d9b8dd33 by run 38122386459 (actual tested merge 866136cca66b46e6dbd3186b47c9340f7e93b4f6 with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2, same tree as the head; receipt formalization_status kernel-checked, theorem_count 52, worktree CLEAN; artifact lean-specification-proofs-38122386459-1, sha256 edd52190d6af5828e8229c161c3b77e87a540caf440070d66b1b7f415008ebc3)", + "note": "11 theorem(s) of this row (P15Elementary.rhoStarBelowSixSevenths, P15Elementary.sixSeventhsCertificate, P15Elementary.hStarExceedsOne, P15Elementary.phiAtPStar, P15Elementary.hazardStarPositive, P15Elementary.oddMajorityIdentity, P15Elementary.capacityWorstCase, P15Elementary.demandOneBoundary, P15Elementary.capacityHazardIsBinomial, P15Elementary.sharpnessOfRhoStar, P15Hazard.globalAssemblyHazard) are inventoried by the proof packet's check.py (source mode SOURCE_CHECK_PASS: 52 inventory theorems over SpecificationProofs/{P15Elementary,P15Structure,P15Hazard,P15Covers,P15Budget,Side24Elementary,RNProbability}.lean, 51 distinct registered Props, each theorem typed exactly as its registered Prop, applied to its own parameters). 8 of them (P15Elementary.rhoStarBelowSixSevenths, P15Elementary.sixSeventhsCertificate, P15Elementary.hStarExceedsOne, P15Elementary.phiAtPStar, P15Elementary.hazardStarPositive, P15Elementary.oddMajorityIdentity, P15Elementary.capacityWorstCase, P15Elementary.demandOneBoundary) are among the 38 theorems of PR head 00d2ac6e kernel-checked by the hosted run 38116277597 (actual tested merge c4c66bb8cb26f0cd9bc03d52bb25f1b3925b272c with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2; job proof-evidence: fresh build, leanchecker PASS, `#print axioms` within {propext, Classical.choice, Quot.sound} for each, receipt formalization_status kernel-checked, worktree CLEAN; artifact lean-specification-proofs-38116277597-1), and again by the hosted run 38121713840 (PR head 910809d6; actual tested merge 5b198699308e0585904c21d12bf540cf2475d2f0 with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2). 3 (P15Elementary.capacityHazardIsBinomial, P15Elementary.sharpnessOfRhoStar, P15Hazard.globalAssemblyHazard) were added after commit 00d2ac6e and kernel-checked by the hosted run 38121713840 (PR head 910809d6; actual tested merge 5b198699308e0585904c21d12bf540cf2475d2f0 with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2) (job proof-evidence: fresh build, leanchecker PASS, `#print axioms` within {propext, Classical.choice, Quot.sound}, receipt formalization_status kernel-checked, worktree CLEAN). `proved` is the label of a committed proof package; `kernel-checked` appears only in a run receipt. Evidence about the registered Props only: not about the informal claim, its alignment (PENDING_INDEPENDENT_REVIEW), review or acceptance; the claim-level label is unchanged; organizational-independence credit 0 (Anthropic / Claude)." + } + ], + "not_established": "FullTransformedPriceBudget states (F2), not proved; RhoStarEnclosure states (F3), not proved; SharpnessOfRhoStar states the attainment clause and is proved as stated. The claim-level label stays `specified` (claim-level vocabulary none/specified; a theorem of a Prop is evidence about that Prop, for the formal objects, not acceptance of Theorem F; alignment PENDING_INDEPENDENT_REVIEW). Props of this row with a theorem of exactly their type in the proof packet specifications/lean_statement_proofs_20261011: RhoStarBelowSixSevenths, HazardStarPositive, PhiAtPStar, CapacityHazardIsBinomial, OddMajorityIdentity, CapacityWorstCase, HStarExceedsOne, GlobalAssemblyHazard, SharpnessOfRhoStar, DemandOneBoundary, SixSeventhsCertificate (11 entries below, label `proved`; 8 of them (P15Elementary.rhoStarBelowSixSevenths, P15Elementary.hazardStarPositive, P15Elementary.phiAtPStar, P15Elementary.oddMajorityIdentity, P15Elementary.capacityWorstCase, P15Elementary.hStarExceedsOne, P15Elementary.demandOneBoundary, P15Elementary.sixSeventhsCertificate) kernel-checked by the hosted run 38116277597 (PR head 00d2ac6e; actual tested merge c4c66bb8cb26f0cd9bc03d52bb25f1b3925b272c with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2); 3 of them (P15Elementary.capacityHazardIsBinomial, P15Hazard.globalAssemblyHazard, P15Elementary.sharpnessOfRhoStar) added after commit 00d2ac6e and kernel-checked by the hosted run 38121713840 (PR head 910809d6; actual tested merge 5b198699308e0585904c21d12bf540cf2475d2f0 with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2) (job proof-evidence: fresh build, leanchecker PASS, `#print axioms` within {propext, Classical.choice, Quot.sound}, receipt formalization_status kernel-checked, worktree CLEAN)). Theorem-shaped Props of this row still `specified` with no theorem: FullTransformedPriceBudget, RhoStarEnclosure, CoordinatewiseConcavity, HazardProductBound, HazardPhiBound, FullGroundPriceBound, FullGroundBudgetIff, LocalPriceBoundFull; the parametrised predicates IsProperDownset are the vocabulary of the other Props, not closed statements (a theorem of their type would assert them for every argument, which is false), and are not targets. The derivative formulas (F4)-(F5) are not specified. SixSeventhsCertificate uses Mathlib's decimal bound on e in place of the source's series argument. The 7 main P15 arithmetic theorems listed as `proved` (finite arithmetic of the Section 6 certificate chain: adjacent 20-digit endpoints as Nat, 16/27 < 6/7, n >= 2a+1 instances, the rational orderings and the degree-5 Taylor partial sum) are at commit 91cffbb5 of main PR #358, not on main; they do not place rho_star = 1/(3 - log(3e - 2)) between the endpoints (nothing does: RhoStarEnclosure is specified only), do not prove e < 87/32 or 197/32 < exp(11/6) as real-number facts (the SixSeventhsCertificate theorem does, as that Prop states them), and are not Theorem F. The full_price.py Fraction procedure is not a kernel proof and is not specified. No arbitrary-downset or unrestricted P15 prize statement (original_prize_closed stays false). Disposition REVIEWED_SCOPED is transcribed, not re-derived. Nonauthor review and acceptance are not claimed by any statement or theorem; alignment of every statement with its anchor is PENDING_INDEPENDENT_REVIEW; organizational-independence credit of this packet and of the proof packet is 0.", + "next_step": "Math- Mathlib lane: FullTransformedPriceBudget, RhoStarEnclosure, CoordinatewiseConcavity, HazardProductBound, HazardPhiBound, FullGroundPriceBound, FullGroundBudgetIff, LocalPriceBoundFull remain the targets of this row (RhoStarEnclosure ((F3), 20 digits) needs proof-producing exp/log enclosures; (F6)-(F8), (F12) and (F2) need the coordinatewise concavity (F4)-(F5), which is not specified); every theorem of this row has a hosted receipt (run 38121713840 (PR head 910809d6; actual tested merge 5b198699308e0585904c21d12bf540cf2475d2f0 with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2)). Independent reviewer: alignment of FullTransformedPriceBudget with (F2), in particular the quantification over ALL p in [0,1]^X and the SAME palette K >= K_H(d). main: PR #358 merge (operator) so the 7 arithmetic theorems are on main." }, { "claim_id": "downstream-hard-gate", @@ -1986,7 +2761,7 @@ "note": "The 31 Side24 targets at origin/main f6deeba7 are decide-proved integer or cross-multiplied rational facts (manifest label `proved`; `kernel-checked` only in a run receipt). Arithmetic skeleton only: formal/SCOPE.md says none of them is the coefficient enclosure." } ], - "not_established": "See row side24-coefficient: the enclosure is stated for any object satisfying PeriodicCoefficientInterface and is not proved; the \"evaluates_eq_15_2\" edge to the parent is represented only by the interface field that takes (15.2) as a hypothesis. No finite-radius band. The 27 arithmetic theorems of main are listed on the landing row. Nonauthor review and acceptance are not claimed by any statement; alignment of every statement with its anchor is PENDING_INDEPENDENT_REVIEW; organizational-independence credit of this packet is 0. The interface does not determine c_{d,24}: CoefficientEnclosure and ReferenceComparison are predicates on the interface object, not closed statements; their universal closure over all inhabitants is false whenever the interface is inhabited (scaling the given cone moment by a positive constant scales c24 through eq_15_2 and gives another inhabitant), and `specified` refers to the statement shape at the source's object, which is not constructed.", + "not_established": "See row side24-coefficient: the enclosure is stated for any object satisfying PeriodicCoefficientInterface and is not proved; the \"evaluates_eq_15_2\" edge to the parent is represented only by the interface field that takes (15.2) as a hypothesis. No finite-radius band. The 27 arithmetic theorems of main and the 5 proof-packet theorems (ExponentialBounds, SuccessiveTermRatio, ConeMomentD2Algebra, ReferenceCoefficientIdentity, ElementaryConeIntegral; none of them the enclosure; kernel-checked by the hosted run 38116277597 (PR head 00d2ac6e; actual tested merge c4c66bb8cb26f0cd9bc03d52bb25f1b3925b272c with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2)) are listed on the landing row. Nonauthor review and acceptance are not claimed by any statement; alignment of every statement with its anchor is PENDING_INDEPENDENT_REVIEW; organizational-independence credit of this packet is 0. The interface does not determine c_{d,24}: CoefficientEnclosure and ReferenceComparison are predicates on the interface object, not closed statements; their universal closure over all inhabitants is false whenever the interface is inhabited (scaling the given cone moment by a positive constant scales c24 through eq_15_2 and gives another inhabitant), and `specified` refers to the statement shape at the source's object, which is not constructed.", "next_step": "As for row side24-coefficient." }, { @@ -2044,10 +2819,61 @@ "formal_progress": "specified", "anchor": "= B q[1+log(A/q)].", "does_not_claim": "the intermediate integral identity `integral_0^infinity min(q,Ae^(-t/B))dt`; that the logarithmic loss is attained (the source's remark about (N4)); anything about the Gaussian model; the result or its proof; nonauthor review or acceptance (the landing disposition HOLD_WITH_DOMAIN of rn-count-interface is transcribed by the register, not here)." + }, + { + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "module": "SpecificationProofs/RNProbability.lean", + "declaration": "UniversalLaw.Proofs.RNProbability.conditionalMeanIdentityN3", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "E[N_r 1_Er]=q E[N_r | E_r].", + "does_not_claim": "the informal Theorem N, the bounded-conditional-mean equivalence, the lower comparison `q ≥ c r^3`, anything about the Gaussian model, review or acceptance." + }, + { + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "module": "SpecificationProofs/RNProbability.lean", + "declaration": "UniversalLaw.Proofs.RNProbability.holderCountBoundN1", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "E[N_r 1_Er] <= (E N_r^p)^(1/p) P(E_r)^(1-1/p).", + "does_not_claim": "the informal Theorem N, that any Gaussian count satisfies the moment hypothesis, any rate in `r`, review or acceptance." + }, + { + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "module": "SpecificationProofs/RNProbability.lean", + "declaration": "UniversalLaw.Proofs.RNProbability.holderConsequenceN2", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "E[N_r 1_Er] <= A^(1/p) C^(1-1/p)", + "does_not_claim": "the informal Theorem N, that the exponent can be rounded up to `3`, that any Gaussian count satisfies the hypotheses, review or acceptance." + }, + { + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "module": "SpecificationProofs/RNProbability.lean", + "declaration": "UniversalLaw.Proofs.RNProbability.uniformCounterexampleN4", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "E N_r/r^3=ceil(log(1/r)) -> infinity.", + "does_not_claim": "the source's sharper bound `sup_(t>=1) e^(-3t)(t+1)^p`, the one-`p` sharpness construction, anything about the Gaussian field, the informal Theorem N, review or acceptance." + }, + { + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "module": "SpecificationProofs/RNProbability.lean", + "declaration": "UniversalLaw.Proofs.RNProbability.exponentialTailLayerCakeN5", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "= B q[1+log(A/q)].", + "does_not_claim": "the source's intermediate identity `∫_0^∞ min(q, A e^(-t/B)) dt`, that the logarithmic loss is attained, anything about the Gaussian model, the informal Theorem N, review or acceptance." } ], - "kernel_evidence": [], - "not_established": "See row rn-count-interface: (N1)-(N5) stated, (N6)-(N7) not stated, so no Prop states the interface as a whole; nothing proved. Nonauthor review and acceptance are not claimed by any statement; alignment of every statement with its anchor is PENDING_INDEPENDENT_REVIEW; organizational-independence credit of this packet is 0.", + "kernel_evidence": [ + { + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "receipt_or_workflow": ".github/workflows/lean-specification-proofs.yml; hosted run 38121713840 (PR head 910809d6; actual tested checkout the merge commit 5b198699308e0585904c21d12bf540cf2475d2f0 of that head into base b2d70d77876a10c365f5db5d3b6cafcf180af4e2, the synthetic merge GitHub builds for a pull_request run, whose tree equals the head's and which the receipt records as checked_commit) (job proof-evidence, artifact lean-specification-proofs-38121713840-1, sha256 640682d631d052f4903d66f506740ae8fa91d19185001e70a1502f404eb44175): receipt formalization_status kernel-checked, leanchecker PASS, theorem_count 52, worktree CLEAN; the 38 theorems of PR head 00d2ac6e were first receipted by run 38116277597 (actual tested merge c4c66bb8cb26f0cd9bc03d52bb25f1b3925b272c with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2, same tree as the head; artifact lean-specification-proofs-38116277597-1); corroborated on PR head d9b8dd33 by run 38122386459 (actual tested merge 866136cca66b46e6dbd3186b47c9340f7e93b4f6 with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2, same tree as the head; receipt formalization_status kernel-checked, theorem_count 52, worktree CLEAN; artifact lean-specification-proofs-38122386459-1, sha256 edd52190d6af5828e8229c161c3b77e87a540caf440070d66b1b7f415008ebc3)", + "note": "5 theorem(s) of this row (RNProbability.conditionalMeanIdentityN3, RNProbability.holderCountBoundN1, RNProbability.holderConsequenceN2, RNProbability.uniformCounterexampleN4, RNProbability.exponentialTailLayerCakeN5) are inventoried by the proof packet's check.py (source mode SOURCE_CHECK_PASS: 52 inventory theorems over SpecificationProofs/{P15Elementary,P15Structure,P15Hazard,P15Covers,P15Budget,Side24Elementary,RNProbability}.lean, 51 distinct registered Props, each theorem typed exactly as its registered Prop, applied to its own parameters). 5 of them (RNProbability.conditionalMeanIdentityN3, RNProbability.holderCountBoundN1, RNProbability.holderConsequenceN2, RNProbability.uniformCounterexampleN4, RNProbability.exponentialTailLayerCakeN5) are among the 38 theorems of PR head 00d2ac6e kernel-checked by the hosted run 38116277597 (actual tested merge c4c66bb8cb26f0cd9bc03d52bb25f1b3925b272c with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2; job proof-evidence: fresh build, leanchecker PASS, `#print axioms` within {propext, Classical.choice, Quot.sound} for each, receipt formalization_status kernel-checked, worktree CLEAN; artifact lean-specification-proofs-38116277597-1), and again by the hosted run 38121713840 (PR head 910809d6; actual tested merge 5b198699308e0585904c21d12bf540cf2475d2f0 with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2). `proved` is the label of a committed proof package; `kernel-checked` appears only in a run receipt. Evidence about the registered Props only: not about the informal claim, its alignment (PENDING_INDEPENDENT_REVIEW), review or acceptance; the claim-level label is unchanged; organizational-independence credit 0 (Anthropic / Claude)." + } + ], + "not_established": "See row rn-count-interface: (N1)-(N5) stated and each proved as a theorem of the proof packet (5 entries below, `proved`; kernel-checked by the hosted run 38116277597 (PR head 00d2ac6e; actual tested merge c4c66bb8cb26f0cd9bc03d52bb25f1b3925b272c with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2)), (N6)-(N7) not stated, so no Prop states the interface as a whole and the node stays none; nothing about the Gaussian model is proved. Nonauthor review and acceptance are not claimed by any statement or theorem; alignment of every statement with its anchor is PENDING_INDEPENDENT_REVIEW; organizational-independence credit of this packet and of the proof packet is 0.", "next_step": "As for row rn-count-interface." }, { @@ -2315,10 +3141,93 @@ "formal_progress": "specified", "anchor": "Replacing rho_star by any smaller constant in (F2) would make its right side strictly less than one.", "does_not_claim": "the statements (statement only; the finite parts are decidable in principle); a necessity claim for multi-block families with some demand one (the source: \"other constraints may change its budget\")." + }, + { + "package": "d6g8k5htny-coder/main formal/ at 91cffbb51d1636f382e9d61a1ecb6f7cd38e1d06 (PR #358, not yet on main)", + "module": "UniversalLaw/P15/FullPrice.lean", + "declaration": "UniversalLaw.P15.rho_star_endpoints_adjacent", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "0.84547981724898672067 < rho_star", + "does_not_claim": "that rho_star = 1/(3 - log(3e - 2)) lies between them (needs Real.exp/Real.log; Mathlib lane); Theorem F; prize status" + }, + { + "package": "d6g8k5htny-coder/main formal/ at 91cffbb51d1636f382e9d61a1ecb6f7cd38e1d06 (PR #358, not yet on main)", + "module": "UniversalLaw/P15/FullPrice.lean", + "declaration": "UniversalLaw.P15.rho_star_upper_endpoint_below_six_sevenths", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "< 0.84547981724898672068 < 6/7", + "does_not_claim": "rho_star < 6/7 as a statement about the real number; h_star > 7/6; Theorem F; prize status" + }, + { + "package": "d6g8k5htny-coder/main formal/ at 91cffbb51d1636f382e9d61a1ecb6f7cd38e1d06 (PR #358, not yet on main)", + "module": "UniversalLaw/P15/FullPrice.lean", + "declaration": "UniversalLaw.P15.sixteen_twentysevenths_below_six_sevenths", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "gives the stronger factor16/27 on its smaller domain", + "does_not_claim": "Theorem (T1) or its domain p_v <= 1/4; that 16/27 < rho_star as a real-number statement; Theorem F; prize status" + }, + { + "package": "d6g8k5htny-coder/main formal/ at 91cffbb51d1636f382e9d61a1ecb6f7cd38e1d06 (PR #358, not yet on main)", + "module": "UniversalLaw/P15/FullPrice.lean", + "declaration": "UniversalLaw.P15.minimal_block_size_instances", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "Our n=ad+1 and d>=2 imply n>=2a+1.", + "does_not_claim": "the implication for all a >= 1, d >= 2; the binomial tail comparison (F9)–(F11); the sharpness argument of section 5; Theorem F; prize status" + }, + { + "package": "d6g8k5htny-coder/main formal/ at 91cffbb51d1636f382e9d61a1ecb6f7cd38e1d06 (PR #358, not yet on main)", + "module": "UniversalLaw/P15/FullPrice.lean", + "declaration": "UniversalLaw.P15.e_rational_bounds_ordering", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "e < 31967/11760 < 87/32,\n 87/32-31967/11760=11/23520.", + "does_not_claim": "e < 31967/11760 (exponential series plus geometric tail); any statement about e; Theorem F; prize status" + }, + { + "package": "d6g8k5htny-coder/main formal/ at 91cffbb51d1636f382e9d61a1ecb6f7cd38e1d06 (PR #358, not yet on main)", + "module": "UniversalLaw/P15/FullPrice.lean", + "declaration": "UniversalLaw.P15.exp_eleven_sixths_taylor_certificate", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "sum_(j=0)^5 (11/6)^j/j! -197/32=26081/933120>0", + "does_not_claim": "that the partial sum is below exp(11/6) (positivity of the omitted terms is analysis); 197/32 < exp(11/6); Theorem F; prize status" + }, + { + "package": "d6g8k5htny-coder/main formal/ at 91cffbb51d1636f382e9d61a1ecb6f7cd38e1d06 (PR #358, not yet on main)", + "module": "UniversalLaw/P15/FullPrice.lean", + "declaration": "UniversalLaw.P15.h_star_rational_certificate_constants", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "Therefore 3e-2<197/327/6 and rho_star<6/7.", + "does_not_claim": "e < 87/32, 197/32 < exp(11/6), monotonicity of log, h_star > 7/6 and rho_star < 6/7 as real-number statements; Theorem F; prize status" + }, + { + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "module": "SpecificationProofs/P15Elementary.lean", + "declaration": "UniversalLaw.Proofs.P15Elementary.sharpnessOfRhoStar", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "Replacing rho_star by any smaller constant in (F2) would make its right side strictly less than one.", + "does_not_claim": "the informal sharpness claim's review or acceptance; the alignment of the Lean `tripleBlock`, `obstruction`, `coverCost` and `cappedHazard` with the source's objects (PENDING_INDEPENDENT_REVIEW); sharpness for any family other than the triple block; the budget (F2) itself; any necessity claim for multi-block families with some demand one (\"other constraints may change its budget\")." } ], - "kernel_evidence": [], - "not_established": "See row p15-full-price: (F2), (F3) and sharpness stated, not proved; the price-boundary refutation is a scope boundary (GRAPH edge boundary_counterexample_not_required_premise), not a hypothesis. Nonauthor review and acceptance are not claimed by any statement; alignment of every statement with its anchor is PENDING_INDEPENDENT_REVIEW; organizational-independence credit of this packet is 0.", + "kernel_evidence": [ + { + "package": "d6g8k5htny-coder/main formal/ at 91cffbb51d1636f382e9d61a1ecb6f7cd38e1d06 (PR #358, not yet on main)", + "receipt_or_workflow": "workspace-landing run 38096827443, job formal / formal-evidence, artifact formal-verification-38096827443", + "note": "The 7 P15 targets of source p15-full-price (UniversalLaw/P15/FullPrice.lean: rho_star_endpoints_adjacent, rho_star_upper_endpoint_below_six_sevenths, sixteen_twentysevenths_below_six_sevenths, minimal_block_size_instances, e_rational_bounds_ordering, exp_eleven_sixths_taylor_certificate, h_star_rational_certificate_constants) are decide-proved integer or cross-multiplied rational facts at commit 91cffbb5 of main PR #358, not on main (manifest label `proved`; `kernel-checked` only in the run receipt, a workflow artifact of the hosted run, none committed in tree). Arithmetic skeleton only: main formal/SCOPE.md says none of these targets is Theorem F (F2), Theorem (T1), Theorem P2, Proposition P1, the enclosure (F3) of rho_star, any inequality involving log, exp or e, the probability semantics of mu_p, the union bound (P11), p_star, the P15-B amalgamation or any prize status; alignment PENDING_INDEPENDENT_REVIEW; organizational-independence credit 0 (Anthropic / Claude)." + }, + { + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "receipt_or_workflow": ".github/workflows/lean-specification-proofs.yml; hosted run 38121713840 (PR head 910809d6; actual tested checkout the merge commit 5b198699308e0585904c21d12bf540cf2475d2f0 of that head into base b2d70d77876a10c365f5db5d3b6cafcf180af4e2, the synthetic merge GitHub builds for a pull_request run, whose tree equals the head's and which the receipt records as checked_commit) (job proof-evidence, artifact lean-specification-proofs-38121713840-1, sha256 640682d631d052f4903d66f506740ae8fa91d19185001e70a1502f404eb44175): receipt formalization_status kernel-checked, leanchecker PASS, theorem_count 52, worktree CLEAN; the 38 theorems of PR head 00d2ac6e were first receipted by run 38116277597 (actual tested merge c4c66bb8cb26f0cd9bc03d52bb25f1b3925b272c with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2, same tree as the head; artifact lean-specification-proofs-38116277597-1); corroborated on PR head d9b8dd33 by run 38122386459 (actual tested merge 866136cca66b46e6dbd3186b47c9340f7e93b4f6 with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2, same tree as the head; receipt formalization_status kernel-checked, theorem_count 52, worktree CLEAN; artifact lean-specification-proofs-38122386459-1, sha256 edd52190d6af5828e8229c161c3b77e87a540caf440070d66b1b7f415008ebc3)", + "note": "1 theorem(s) of this row (P15Elementary.sharpnessOfRhoStar) are inventoried by the proof packet's check.py (source mode SOURCE_CHECK_PASS: 52 inventory theorems over SpecificationProofs/{P15Elementary,P15Structure,P15Hazard,P15Covers,P15Budget,Side24Elementary,RNProbability}.lean, 51 distinct registered Props, each theorem typed exactly as its registered Prop, applied to its own parameters). 1 (P15Elementary.sharpnessOfRhoStar) were added after commit 00d2ac6e and kernel-checked by the hosted run 38121713840 (PR head 910809d6; actual tested merge 5b198699308e0585904c21d12bf540cf2475d2f0 with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2) (job proof-evidence: fresh build, leanchecker PASS, `#print axioms` within {propext, Classical.choice, Quot.sound}, receipt formalization_status kernel-checked, worktree CLEAN). `proved` is the label of a committed proof package; `kernel-checked` appears only in a run receipt. Evidence about the registered Props only: not about the informal claim, its alignment (PENDING_INDEPENDENT_REVIEW), review or acceptance; the claim-level label is unchanged; organizational-independence credit 0 (Anthropic / Claude)." + } + ], + "not_established": "See row p15-full-price. Of the three Props of this node, with a theorem of exactly their type in the proof packet: SharpnessOfRhoStar (1 entries below, label `proved`; 1 of them (P15Elementary.sharpnessOfRhoStar) added after commit 00d2ac6e and kernel-checked by the hosted run 38121713840 (PR head 910809d6; actual tested merge 5b198699308e0585904c21d12bf540cf2475d2f0 with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2) (job proof-evidence: fresh build, leanchecker PASS, `#print axioms` within {propext, Classical.choice, Quot.sound}, receipt formalization_status kernel-checked, worktree CLEAN)); stated, not proved: FullTransformedPriceBudget, RhoStarEnclosure. A theorem of SharpnessOfRhoStar is about the formal triple block and the formal cover cost; none of this is Theorem F, and the node-level label stays `specified`. The 7 main P15 arithmetic theorems of source p15-full-price (at commit 91cffbb5 of main PR #358, not on main) are listed here as the arithmetic skeleton, never as the node. The price-boundary refutation is a scope boundary (GRAPH edge boundary_counterexample_not_required_premise), not a hypothesis. Nonauthor review and acceptance are not claimed by any statement or theorem; alignment of every statement with its anchor is PENDING_INDEPENDENT_REVIEW; organizational-independence credit of this packet and of the proof packet is 0.", "next_step": "As for row p15-full-price." }, { @@ -2349,10 +3258,93 @@ "formal_progress": "specified", "anchor": " covercost_c(O_1(D))=4/9 > 1/3 > log(4/3).", "does_not_claim": "the statement (statement only; the finite parts are decidable in principle, the two logarithm inequalities are analysis); that this contradicts original P15-B (\"It does not contradict the original P15-B amalgamation\"); anything about the `408`-scale or the unrestricted prize; the integral representation `log 2 = 2 integral_0^(1/3) 1/(1-t^2) dt` is not specified; disposition transcribed from LANDING_CLAIMS for p15-price-boundary: EXACT_COUNTEREXAMPLE; nonauthor review and acceptance are not claimed here." + }, + { + "package": "d6g8k5htny-coder/main formal/ at 91cffbb51d1636f382e9d61a1ecb6f7cd38e1d06 (PR #358, not yet on main)", + "module": "UniversalLaw/P15/PriceBoundary.lean", + "declaration": "UniversalLaw.P15.smallest_member_block_size", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "one-block member: a_1=d_1=1, X={x,y}", + "does_not_claim": "the realized-cover theorem or its family; the probability or price semantics; the two log inequalities; Theorem F; prize status" + }, + { + "package": "d6g8k5htny-coder/main formal/ at 91cffbb51d1636f382e9d61a1ecb6f7cd38e1d06 (PR #358, not yet on main)", + "module": "UniversalLaw/P15/PriceBoundary.lean", + "declaration": "UniversalLaw.P15.demand_one_good_sets", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "Its good sets are the empty\nset and singletons", + "does_not_claim": "the downset D beyond the four enumerated subsets; the log inequalities phi(1/2)=log 2>2/3 and log(4/3)<1/3; Theorem F; prize status" + }, + { + "package": "d6g8k5htny-coder/main formal/ at 91cffbb51d1636f382e9d61a1ecb6f7cd38e1d06 (PR #358, not yet on main)", + "module": "UniversalLaw/P15/PriceBoundary.lean", + "declaration": "UniversalLaw.P15.demand_one_obstruction", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "its one-piece obstruction\nis exactly {X}", + "does_not_claim": "the identity I_1(D)=D in general; cover semantics; the log inequalities; Theorem F; prize status" + }, + { + "package": "d6g8k5htny-coder/main formal/ at 91cffbb51d1636f382e9d61a1ecb6f7cd38e1d06 (PR #358, not yet on main)", + "module": "UniversalLaw/P15/PriceBoundary.lean", + "declaration": "UniversalLaw.P15.good_measure_three_quarters", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "Nevertheless mu_p(D)=3/4", + "does_not_claim": "the product-measure semantics of mu_p; the identity min(1,-log mu_p(D))=log(4/3); the inequality log(4/3)<1/3; Theorem F; prize status" + }, + { + "package": "d6g8k5htny-coder/main formal/ at 91cffbb51d1636f382e9d61a1ecb6f7cd38e1d06 (PR #358, not yet on main)", + "module": "UniversalLaw/P15/PriceBoundary.lean", + "declaration": "UniversalLaw.P15.generator_prices_ninths", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "The possible generator costs are1,2/3,2/3,4/9", + "does_not_claim": "admissibility of c=2/3 as a transformed price (phi(1/2)=log 2>2/3 is a log inequality); that extra generators cannot lower the minimum; Theorem F; prize status" + }, + { + "package": "d6g8k5htny-coder/main formal/ at 91cffbb51d1636f382e9d61a1ecb6f7cd38e1d06 (PR #358, not yet on main)", + "module": "UniversalLaw/P15/PriceBoundary.lean", + "declaration": "UniversalLaw.P15.minimum_generator_price_exceeds_third", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "covercost_c(O_1(D))=4/9 > 1/3 > log(4/3)", + "does_not_claim": "that the minimum over the four subsets is the exact optimal cover price (every cover of {X} containing a generator inside X, and extra nonnegative-price generators not lowering it, are set-theoretic steps of the source); the inequality 1/3 > log(4/3); that the same-palette extension to c<=phi(p) is false in general; Theorem F; prize status" + }, + { + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "module": "SpecificationProofs/P15Elementary.lean", + "declaration": "UniversalLaw.Proofs.P15Elementary.twoCoordGeneratorPrices", + "kind": "theorem", + "formal_progress": "proved", + "anchor": "The possible generator costs are1,2/3,2/3,4/9 for the empty", + "does_not_claim": "the demand-one refutation itself (`DemandOneRefutation`), any review or acceptance of P15-PRICE-BOUNDARY-20260924-v1; the disposition EXACT_COUNTEREXAMPLE is transcribed in the register, not derived here." + }, + { + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "module": "SpecificationProofs/P15Elementary.lean", + "declaration": "UniversalLaw.Proofs.P15Elementary.demandOneRefutation", + "kind": "theorem", + "formal_progress": "proved", + "anchor": " covercost_c(O_1(D))=4/9 > 1/3 > log(4/3).", + "does_not_claim": "that the refutation contradicts original P15-B (\"It does not contradict the original P15-B amalgamation\"), anything at the `408` scale or about the unrestricted prize, the source's integral representation of `log 2`, nonauthor review or acceptance; the disposition EXACT_COUNTEREXAMPLE is transcribed, not derived." } ], - "kernel_evidence": [], - "not_established": "See row p15-price-boundary: the refutation is stated, its two logarithm inequalities are not proved anywhere; REFUTED is the graph classification of the extension, transcribed as source identity. Nonauthor review and acceptance are not claimed by any statement; alignment of every statement with its anchor is PENDING_INDEPENDENT_REVIEW; organizational-independence credit of this packet is 0.", + "kernel_evidence": [ + { + "package": "d6g8k5htny-coder/main formal/ at 91cffbb51d1636f382e9d61a1ecb6f7cd38e1d06 (PR #358, not yet on main)", + "receipt_or_workflow": "workspace-landing run 38096827443, job formal / formal-evidence, artifact formal-verification-38096827443", + "note": "The 6 P15 targets of source p15-price-boundary (UniversalLaw/P15/PriceBoundary.lean: smallest_member_block_size, demand_one_good_sets, demand_one_obstruction, good_measure_three_quarters, generator_prices_ninths, minimum_generator_price_exceeds_third) are decide-proved integer or cross-multiplied rational facts at commit 91cffbb5 of main PR #358, not on main (manifest label `proved`; `kernel-checked` only in the run receipt, a workflow artifact of the hosted run, none committed in tree). Arithmetic skeleton only: main formal/SCOPE.md says none of these targets is Theorem F (F2), Theorem (T1), Theorem P2, Proposition P1, the enclosure (F3) of rho_star, any inequality involving log, exp or e, the probability semantics of mu_p, the union bound (P11), p_star, the P15-B amalgamation or any prize status; alignment PENDING_INDEPENDENT_REVIEW; organizational-independence credit 0 (Anthropic / Claude)." + }, + { + "package": "d6g8k5htny-coder/Math- specifications/lean_statement_proofs_20261011", + "receipt_or_workflow": ".github/workflows/lean-specification-proofs.yml; hosted run 38121713840 (PR head 910809d6; actual tested checkout the merge commit 5b198699308e0585904c21d12bf540cf2475d2f0 of that head into base b2d70d77876a10c365f5db5d3b6cafcf180af4e2, the synthetic merge GitHub builds for a pull_request run, whose tree equals the head's and which the receipt records as checked_commit) (job proof-evidence, artifact lean-specification-proofs-38121713840-1, sha256 640682d631d052f4903d66f506740ae8fa91d19185001e70a1502f404eb44175): receipt formalization_status kernel-checked, leanchecker PASS, theorem_count 52, worktree CLEAN; the 38 theorems of PR head 00d2ac6e were first receipted by run 38116277597 (actual tested merge c4c66bb8cb26f0cd9bc03d52bb25f1b3925b272c with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2, same tree as the head; artifact lean-specification-proofs-38116277597-1); corroborated on PR head d9b8dd33 by run 38122386459 (actual tested merge 866136cca66b46e6dbd3186b47c9340f7e93b4f6 with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2, same tree as the head; receipt formalization_status kernel-checked, theorem_count 52, worktree CLEAN; artifact lean-specification-proofs-38122386459-1, sha256 edd52190d6af5828e8229c161c3b77e87a540caf440070d66b1b7f415008ebc3)", + "note": "2 theorem(s) of this row (P15Elementary.twoCoordGeneratorPrices, P15Elementary.demandOneRefutation) are inventoried by the proof packet's check.py (source mode SOURCE_CHECK_PASS: 52 inventory theorems over SpecificationProofs/{P15Elementary,P15Structure,P15Hazard,P15Covers,P15Budget,Side24Elementary,RNProbability}.lean, 51 distinct registered Props, each theorem typed exactly as its registered Prop, applied to its own parameters). 2 of them (P15Elementary.twoCoordGeneratorPrices, P15Elementary.demandOneRefutation) are among the 38 theorems of PR head 00d2ac6e kernel-checked by the hosted run 38116277597 (actual tested merge c4c66bb8cb26f0cd9bc03d52bb25f1b3925b272c with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2; job proof-evidence: fresh build, leanchecker PASS, `#print axioms` within {propext, Classical.choice, Quot.sound} for each, receipt formalization_status kernel-checked, worktree CLEAN; artifact lean-specification-proofs-38116277597-1), and again by the hosted run 38121713840 (PR head 910809d6; actual tested merge 5b198699308e0585904c21d12bf540cf2475d2f0 with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2). `proved` is the label of a committed proof package; `kernel-checked` appears only in a run receipt. Evidence about the registered Props only: not about the informal claim, its alignment (PENDING_INDEPENDENT_REVIEW), review or acceptance; the claim-level label is unchanged; organizational-independence credit 0 (Anthropic / Claude)." + } + ], + "not_established": "See row p15-price-boundary: TwoCoordGeneratorPrices and DemandOneRefutation (the two Props of this node) have theorems of exactly their type in the proof packet (listed as `proved`; kernel-checked by the hosted run 38116277597 (PR head 00d2ac6e; actual tested merge c4c66bb8cb26f0cd9bc03d52bb25f1b3925b272c with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2)), the two logarithm inequalities included; the claim-level label stays `specified` for the reasons given there (claim-level vocabulary none/specified, alignment PENDING_INDEPENDENT_REVIEW, a Prop-level proof is evidence about the Prop only, whatever the hosted run 38116277597 receipted). The 6 main P15 arithmetic theorems of source p15-price-boundary (at commit 91cffbb5 of main PR #358, not on main) are listed as the arithmetic skeleton, never as the node. REFUTED is the graph classification of the extension, transcribed as source identity. Nonauthor review and acceptance are not claimed by any statement or theorem; alignment of every statement with its anchor is PENDING_INDEPENDENT_REVIEW; organizational-independence credit of this packet and of the proof packet is 0.", "next_step": "As for row p15-price-boundary." }, { @@ -4403,7 +5395,7 @@ { "claim_id": "lean:main-formal-UniversalLaw", "kind": "existing_lean_package", - "title": "main formal/ UniversalLaw (package side24-arithmetic-skeleton, core Lean v4.34.1, no Mathlib): 31 Side24 integer targets at origin/main f6deeba7 (Ledger 17, ConeMoments 10, Endpoints 4; author Anthropic/Claude via Cursor, 2026-09-27) plus 28 P15 targets staged uncommitted in this programme's worktree (PriceBoundary 6, RealizedCovers 12, FullPrice 10; on no commit, so not listed as statements here); manifest formalization_status proved, alignment_status PENDING_INDEPENDENT_REVIEW", + "title": "main formal/ UniversalLaw (package side24-arithmetic-skeleton, core Lean v4.34.1, no Mathlib): 31 Side24 integer targets at origin/main f6deeba7 (Ledger 17, ConeMoments 10, Endpoints 4; author Anthropic/Claude via Cursor, 2026-09-27) plus 28 P15 targets at commit 91cffbb51d1636f382e9d61a1ecb6f7cd38e1d06 of main PR #358 (PriceBoundary 6, RealizedCovers 12, FullPrice 10; not yet on main; listed as `proved` statements on the six P15 claim rows); manifest formalization_status proved, alignment_status PENDING_INDEPENDENT_REVIEW", "layer0": { "source_id": "side24-enclosure", "heading": "ENCLOSURE.json (the four Endpoints targets anchor here; the other 55 targets are listed on the claim rows side24-coefficient, p15-price-boundary, p15-realized-covers, p15-price-budget-restricted, p15-full-price)" @@ -4453,10 +5445,15 @@ "package": "d6g8k5htny-coder/main formal/ (UniversalLaw, side24-arithmetic-skeleton)", "receipt_or_workflow": ".github/workflows/formal-verification.yml (tools/formal_gate_check.py --run-lean inside the required aggregate `verify`); receipt formal/.lake/formal-evidence/receipt.json is a workflow artifact, none is committed in tree", "note": "The 31 Side24 targets at origin/main f6deeba7 are decide-proved integer or cross-multiplied rational facts (manifest label `proved`; `kernel-checked` only in a run receipt). Arithmetic skeleton only: formal/SCOPE.md says none of them is the coefficient enclosure." + }, + { + "package": "d6g8k5htny-coder/main formal/ at 91cffbb51d1636f382e9d61a1ecb6f7cd38e1d06 (PR #358, not yet on main)", + "receipt_or_workflow": "workspace-landing run 38096827443, job formal / formal-evidence, artifact formal-verification-38096827443", + "note": "The 28 P15 targets (PriceBoundary 6, RealizedCovers 12, FullPrice 10) at commit 91cffbb5 of main PR #358, not on main: decide-proved integer or cross-multiplied rational facts (manifest label `proved`; `kernel-checked` only in the run receipt, a workflow artifact, none committed in tree), listed as `proved` statements on the six P15 claim rows. Arithmetic skeleton only (main formal/SCOPE.md)." } ], - "not_established": "The package states no research claim as a Prop, so the claim-level label is none; its 31 theorems at origin/main f6deeba7 are finite integer/cross-multiplied rational facts proved by decide (label `proved` in the manifest, `kernel-checked` only in a run receipt). The four Endpoints theorems listed here show the published 20-digit endpoints are adjacent, ordered and below 1/10 as Nat; they do not place c_{2,24} or c_{3,24} between them and say nothing about the true coefficients (the module's own note). The 28 P15 arithmetic targets of this programme's main worktree are on no commit, are not listed in this register, and have only a local untrusted --run-lean receipt. main has NO mechanism for `specified`: its gate refuses any manifest label but `proved`, so statement-only work cannot live in this package. Alignment review by a non-Anthropic lane is an open ask (formal/reviews holds only the template).", - "next_step": "Commit and push the P15 modules so the hosted formal-verification.yml run produces a trusted receipt, then list them here as `proved` statements citing the 40-hex commit and the run; obtain a non-Anthropic alignment review of the 31 committed targets (59 once the P15 modules are committed); keep real-number statements in the Math- Mathlib lane." + "not_established": "The package states no research claim as a Prop, so the claim-level label is none; its 31 theorems at origin/main f6deeba7 are finite integer/cross-multiplied rational facts proved by decide (label `proved` in the manifest, `kernel-checked` only in a run receipt). The four Endpoints theorems listed here show the published 20-digit endpoints are adjacent, ordered and below 1/10 as Nat; they do not place c_{2,24} or c_{3,24} between them and say nothing about the true coefficients (the module's own note). The 28 P15 arithmetic targets are at commit 91cffbb5 of main PR #358 (not on main), are listed as `proved` statements on the rows p15-price-boundary, math.p15-price-boundary, p15-realized-covers, p15-price-budget-restricted, p15-full-price and math.p15-full-price, and have the hosted workspace-landing run 38096827443 (job formal / formal-evidence, artifact formal-verification-38096827443) as kernel evidence; they are finite arithmetic and none is Theorem F (F2), Theorem (T1), Theorem P2, Proposition P1, the enclosure (F3) of rho_star or any inequality involving log, exp or e (main formal/SCOPE.md). main has NO mechanism for `specified`: its gate refuses any manifest label but `proved`, so statement-only work cannot live in this package. Alignment review by a non-Anthropic lane is an open ask (formal/reviews holds only the template).", + "next_step": "PR #358 merge is the operator's decision; until then the 28 P15 targets are on a branch, not on main. Obtain a non-Anthropic alignment review of the 59 targets; keep real-number statements in the Math- Mathlib lane (the proof packet specifications/lean_statement_proofs_20261011 now holds the real-number P15 theorems, kernel-checked by the hosted run 38116277597 (PR head 00d2ac6e; actual tested merge c4c66bb8cb26f0cd9bc03d52bb25f1b3925b272c with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2))." }, { "claim_id": "lean:math-formal-ResearchFormalCoreR1", @@ -4946,8 +5943,8 @@ "formal_progress": "none", "statements": [], "kernel_evidence": [], - "not_established": "L2 exact-arithmetic evidence (stdlib Fraction) for finite rational facts; not a kernel proof. The FullPrice.lean module staged in this programme's uncommitted main worktree (on no commit; not listed in this register) targets only the adjacency of the endpoints as Nat, 16/27 < 6/7 and the rational orderings / Taylor partial sum of Section 6, not that rho_star = 1/(3 - log(3e - 2)) lies between the endpoints (RhoStarEnclosure, specified only). The finite suite \"supports algebra only\" (the source's own words); no prize status (original_prize_closed stays false).", - "next_step": "Prove RhoStarBelowSixSevenths / SixSeventhsCertificate in the Math- Mathlib lane (Real.exp / Real.log bounds); then RhoStarEnclosure via proof-producing exp/log enclosures." + "not_established": "L2 exact-arithmetic evidence (stdlib Fraction) for finite rational facts; not a kernel proof. The FullPrice.lean module at commit 91cffbb5 of main PR #358 (not on main; its 10 targets are listed as `proved` statements on the rows p15-full-price, math.p15-full-price and p15-price-budget-restricted) targets only the adjacency of the endpoints as Nat, 16/27 < 6/7 and the rational orderings / Taylor partial sum of Section 6, not that rho_star = 1/(3 - log(3e - 2)) lies between the endpoints (RhoStarEnclosure, specified only); RhoStarBelowSixSevenths and SixSeventhsCertificate are proved as the Props state them in the proof packet specifications/lean_statement_proofs_20261011 (kernel-checked by the hosted run 38116277597 (PR head 00d2ac6e; actual tested merge c4c66bb8cb26f0cd9bc03d52bb25f1b3925b272c with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2)), which places rho_star below 6/7, not between the 20-digit endpoints. The finite suite \"supports algebra only\" (the source's own words); no prize status (original_prize_closed stays false).", + "next_step": "Prove RhoStarEnclosure in the Math- Mathlib lane via proof-producing exp/log enclosures (RhoStarBelowSixSevenths / SixSeventhsCertificate are already proved in specifications/lean_statement_proofs_20261011 and kernel-checked by the hosted run 38116277597 (PR head 00d2ac6e; actual tested merge c4c66bb8cb26f0cd9bc03d52bb25f1b3925b272c with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2))." } ] } diff --git a/specifications/lean_statements_20261010/SCOPE.md b/specifications/lean_statements_20261010/SCOPE.md index 6edc61286..ca462675a 100644 --- a/specifications/lean_statements_20261010/SCOPE.md +++ b/specifications/lean_statements_20261010/SCOPE.md @@ -5,7 +5,11 @@ Scientific effect: **NONE**. Formal progress: `specified` for every declaration. ## Boundary -This package states; it does not prove. The five modules under `Specifications/` declare, as +This package states; it does not prove. Proofs of some of its Props live in the sibling proof packet +`specifications/lean_statement_proofs_20261011` (52 theorems typed exactly as 51 of the 141 Props; +the last column of the declaration tables and the `proved (proof packet …)` entries of the claims table); +that packet depends on this one by path, never edits it, and its theorems change no label here and no +claim-level label. The five modules under `Specifications/` declare, as `def … : Prop` and interface `structure`s in the namespaces `UniversalLaw.Spec.`, the objects and results of the byte-pinned Layer 0 texts in `sources/`. Anything the informal text leaves informal (a Kac–Rice representation, "versions of the densities", the elder pairing, the @@ -55,198 +59,198 @@ a theorem between string literals, an indented Prop definition, a proof written ## Declarations -150 registered declarations (141 `def … : Prop`, 9 interface `structure`), every one with formal progress `specified`; the 123 auxiliary definitions and abbreviations of the modules are inventory only and are not register statements. Names are given without the module namespace `UniversalLaw.Spec..`; the source column is the pinned source named by the docstring's `Source:` line. Anchors and "Not established" cells are copied verbatim from the Lean docstrings (`Anchor:` and `Does not claim:` lines) through REGISTER.json. +150 registered declarations (141 `def … : Prop`, 9 interface `structure`), every one with formal progress `specified` in this package; the 123 auxiliary definitions and abbreviations of the modules are inventory only and are not register statements. Names are given without the module namespace `UniversalLaw.Spec..`; the source column is the pinned source named by the docstring's `Source:` line. Anchors and "Not established" cells are copied verbatim from the Lean docstrings (`Anchor:` and `Does not claim:` lines) through REGISTER.json. The last column names the theorems of the sibling proof packet `specifications/lean_statement_proofs_20261011` whose type is exactly the declaration (namespace `UniversalLaw.Proofs..`): 51 of the 141 Props have one (52 theorems; `TriangleNeedsThree` is proved twice), each listed in the register under the claim rows as a statement entry of kind `theorem` with label `proved` (the label of a committed proof package; `kernel-checked` appears only in a run receipt: the hosted `lean-specification-proofs.yml` run 38121713840 receipted all of them and run 38116277597 the first 38; a pull_request run checks out the synthetic merge of the PR head into the base, so each receipt records as checked_commit that merge and not the head: run 38121713840 PR head 910809d6, actual tested merge 5b198699308e0585904c21d12bf540cf2475d2f0 with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2; run 38116277597 PR head 00d2ac6e, actual tested merge c4c66bb8cb26f0cd9bc03d52bb25f1b3925b272c with the same base; run 38122386459 corroborates on PR head d9b8dd33, actual tested merge 866136cca66b46e6dbd3186b47c9340f7e93b4f6; each merge has the same tree as its head). That label belongs to the theorem, not to the declaration here, which stays `specified`, and not to any claim row; a kernel-checked theorem is evidence about its Prop only, and alignment of every statement is `PENDING_INDEPENDENT_REVIEW`. ### `Specifications/Field.lean` (12 registered declarations) -| declaration | kind | source | exact coverage (verbatim anchor) | Not established (verbatim `Does not claim:`) | -|---|---|---|---|---| -| `IsLPeriodic` | def_prop | `lifetime-parent` | On the flat torus X = R^d/(L Z^d), let f be the centered stationary Gaussian field of variance one with covariance | anything about the field. | -| `IsSmooth` | def_prop | `lifetime-parent` | In particular the field has a smooth version and all finite moments of its global derivative suprema exist. | existence of a smooth version, or moment bounds on derivative suprema. | -| `GaussianFieldInterface` | structure | `lifetime-parent` | On the flat torus X = R^d/(L Z^d), let f be the centered stationary Gaussian field of variance one with covariance | existence or uniqueness in law of the field; the Fourier representation and positive spectrum of Section 2; almost-sure Morse genericity of Section 8. | -| `IsCriticalPoint` | def_prop | `lifetime-parent` | grad f(M)=grad f(S)=0. | differentiability of `g` at `x` (if `g` is not differentiable, `fderiv` is `0`). | -| `HessianHasInertia` | def_prop | `lifetime-parent` | The index counts negative eigenvalues. | equivalence with an eigenvalue count for a non-symmetric form. | -| `IsNondegMax` | def_prop | `lifetime-parent` | A maximum has d negative Hessian eigenvalues; the relevant saddle has d-1 negative and one positive eigenvalue. | that every local maximum of a sample path is nondegenerate (Morse genericity is Section 8 of the source). | -| `IsIndexSaddle` | def_prop | `lifetime-parent` | A maximum has d negative Hessian eigenvalues; the relevant saddle has d-1 negative and one positive eigenvalue. | that such a saddle is a merging saddle of any superlevel bar. | -| `IsCandidatePair` | def_prop | `lifetime-parent` | let nu_cand^all(ell) count ALL ordered maximum/index-(d-1)-saddle pairs with height difference ell>0, and let nu_eld^all(ell) count all finite ordinary superlevel H0 persistence bars, both in expectation per unit volume. | positivity of the height gap (added separately where the source requires it). | -| `IsMorseDistinct` | def_prop | `lifetime-parent` | Countable exhaustion now proves that Q is almost surely Morse with distinct critical values. | that sample paths are almost surely Morse (Section 8 of the source). | -| `SuperlevelBarInterface` | structure | `lifetime-parent` | On the Morse distinct-value locus it expresses ordinary elder death at S; an essential maximum has no older endpoint. | Borel measurability of the elder event (Section 8 / the Section 9 replacement), identification with a persistence-module elder rule, or any behaviour off the Morse distinct-value locus. | -| `IsFiniteBar` | def_prop | `lifetime-parent` | each finite superlevel H0 bar has exactly one local-maximum birth and one index-(d-1) merging-saddle death. | the identification of these pairs with bars of a persistence module; that the count of such pairs equals the finite-bar count off the Morse locus. | -| `IsLifetimeDensityVersion` | def_prop | `lifetime-parent` | These densities admit versions with | existence of a version; the weighted Kac-Rice identity; the radial ledger (10.2). Measurability of the pair count as a function of the sample is REQUIRED by the predicate (through `Integrable`, hence `AEStronglyMeasurable`), not established here. | +| declaration | kind | source | exact coverage (verbatim anchor) | Not established (verbatim `Does not claim:`) | proved by (proof packet, `proved`; kernel-checked by hosted run 38121713840: PR head 910809d6, actual tested merge 5b198699… with base b2d70d77…, same tree as the head) | +|---|---|---|---|---|---| +| `IsLPeriodic` | def_prop | `lifetime-parent` | On the flat torus X = R^d/(L Z^d), let f be the centered stationary Gaussian field of variance one with covariance | anything about the field. | — | +| `IsSmooth` | def_prop | `lifetime-parent` | In particular the field has a smooth version and all finite moments of its global derivative suprema exist. | existence of a smooth version, or moment bounds on derivative suprema. | — | +| `GaussianFieldInterface` | structure | `lifetime-parent` | On the flat torus X = R^d/(L Z^d), let f be the centered stationary Gaussian field of variance one with covariance | existence or uniqueness in law of the field; the Fourier representation and positive spectrum of Section 2; almost-sure Morse genericity of Section 8. | — | +| `IsCriticalPoint` | def_prop | `lifetime-parent` | grad f(M)=grad f(S)=0. | differentiability of `g` at `x` (if `g` is not differentiable, `fderiv` is `0`). | — | +| `HessianHasInertia` | def_prop | `lifetime-parent` | The index counts negative eigenvalues. | equivalence with an eigenvalue count for a non-symmetric form. | — | +| `IsNondegMax` | def_prop | `lifetime-parent` | A maximum has d negative Hessian eigenvalues; the relevant saddle has d-1 negative and one positive eigenvalue. | that every local maximum of a sample path is nondegenerate (Morse genericity is Section 8 of the source). | — | +| `IsIndexSaddle` | def_prop | `lifetime-parent` | A maximum has d negative Hessian eigenvalues; the relevant saddle has d-1 negative and one positive eigenvalue. | that such a saddle is a merging saddle of any superlevel bar. | — | +| `IsCandidatePair` | def_prop | `lifetime-parent` | let nu_cand^all(ell) count ALL ordered maximum/index-(d-1)-saddle pairs with height difference ell>0, and let nu_eld^all(ell) count all finite ordinary superlevel H0 persistence bars, both in expectation per unit volume. | positivity of the height gap (added separately where the source requires it). | — | +| `IsMorseDistinct` | def_prop | `lifetime-parent` | Countable exhaustion now proves that Q is almost surely Morse with distinct critical values. | that sample paths are almost surely Morse (Section 8 of the source). | — | +| `SuperlevelBarInterface` | structure | `lifetime-parent` | On the Morse distinct-value locus it expresses ordinary elder death at S; an essential maximum has no older endpoint. | Borel measurability of the elder event (Section 8 / the Section 9 replacement), identification with a persistence-module elder rule, or any behaviour off the Morse distinct-value locus. | — | +| `IsFiniteBar` | def_prop | `lifetime-parent` | each finite superlevel H0 bar has exactly one local-maximum birth and one index-(d-1) merging-saddle death. | the identification of these pairs with bars of a persistence module; that the count of such pairs equals the finite-bar count off the Morse locus. | — | +| `IsLifetimeDensityVersion` | def_prop | `lifetime-parent` | These densities admit versions with | existence of a version; the weighted Kac-Rice identity; the radial ledger (10.2). Measurability of the pair count as a function of the sample is REQUIRED by the predicate (through `Integrable`, hence `AEStronglyMeasurable`), not established here. | — | ### `Specifications/Lifetime.lean` (24 registered declarations) -| declaration | kind | source | exact coverage (verbatim anchor) | Not established (verbatim `Does not claim:`) | -|---|---|---|---|---| -| `IsLPeriodic` | def_prop | `lifetime-parent` | On the flat torus X = R^d/(L Z^d), let f be the centered stationary Gaussian field of variance one with covariance | anything about the field. | -| `IsSmooth` | def_prop | `lifetime-parent` | In particular the field has a smooth version and all finite moments of its global derivative suprema exist. | existence of a smooth version, or moment bounds on derivative suprema. | -| `GaussianFieldInterface` | structure | `lifetime-parent` | On the flat torus X = R^d/(L Z^d), let f be the centered stationary Gaussian field of variance one with covariance | existence or uniqueness in law of the field; the Fourier representation and positive spectrum of Section 2; almost-sure Morse genericity of Section 8. | -| `IsCriticalPoint` | def_prop | `lifetime-parent` | grad f(M)=grad f(S)=0. | differentiability of `g` at `x` (if `g` is not differentiable, `fderiv` is `0`). | -| `HessianHasInertia` | def_prop | `lifetime-parent` | The index counts negative eigenvalues. | equivalence with an eigenvalue count for a non-symmetric form. | -| `IsNondegMax` | def_prop | `lifetime-parent` | A maximum has d negative Hessian eigenvalues; the relevant saddle has d-1 negative and one positive eigenvalue. | that every local maximum of a sample path is nondegenerate (Morse genericity is Section 8 of the source). | -| `IsIndexSaddle` | def_prop | `lifetime-parent` | A maximum has d negative Hessian eigenvalues; the relevant saddle has d-1 negative and one positive eigenvalue. | that such a saddle is a merging saddle of any superlevel bar. | -| `IsCandidatePair` | def_prop | `lifetime-parent` | let nu_cand^all(ell) count ALL ordered maximum/index-(d-1)-saddle pairs with height difference ell>0, and let nu_eld^all(ell) count all finite ordinary superlevel H0 persistence bars, both in expectation per unit volume. | positivity of the height gap (added separately where the source requires it). | -| `IsMorseDistinct` | def_prop | `lifetime-parent` | Countable exhaustion now proves that Q is almost surely Morse with distinct critical values. | that sample paths are almost surely Morse (Section 8 of the source). | -| `SuperlevelBarInterface` | structure | `lifetime-parent` | On the Morse distinct-value locus it expresses ordinary elder death at S; an essential maximum has no older endpoint. | Borel measurability of the elder event (Section 8 / the Section 9 replacement), identification with a persistence-module elder rule, or any behaviour off the Morse distinct-value locus. | -| `IsFiniteBar` | def_prop | `lifetime-parent` | each finite superlevel H0 bar has exactly one local-maximum birth and one index-(d-1) merging-saddle death. | the identification of these pairs with bars of a persistence module; that the count of such pairs equals the finite-bar count off the Morse locus. | -| `IsLifetimeDensityVersion` | def_prop | `lifetime-parent` | These densities admit versions with | existence of a version; the weighted Kac-Rice identity; the radial ledger (10.2). Measurability of the pair count as a function of the sample is REQUIRED by the predicate (through `Integrable`, hence `AEStronglyMeasurable`), not established here. | -| `IsWindowPair` | def_prop | `lifetime-parent` | Count ordered maximum/saddle pairs with 00, and let nu_eld^all(ell) count all finite ordinary superlevel H0 persistence bars, both in expectation per unit volume. | anything about the off-diagonal (far) population separately (Section 14 of the source). | -| `PairLawInterface` | structure | `lifetime-parent` | Let p_r(b,k,R) be the Q^W probability that the **global ordinary superlevel elder death partner** of M is S. | existence of the regression law, the typed weight, the full normalizer `Z_r > 0`, or that `p` is the probability of any event under any measure declared here; that `p` depends on `G` or `I` in any way (no field mentions them; they only record which field and elder relation the law is meant to refer to). | -| `ParentUniformSelectionA` | def_prop | `lifetime-parent` | There exist r_*>0 and C= c r^3, 00, and let nu_eld^all(ell) count all finite ordinary superlevel H0 persistence bars, both in expectation per unit volume. | positivity of the height gap (added separately where the source requires it). | — | +| `IsMorseDistinct` | def_prop | `lifetime-parent` | Countable exhaustion now proves that Q is almost surely Morse with distinct critical values. | that sample paths are almost surely Morse (Section 8 of the source). | — | +| `SuperlevelBarInterface` | structure | `lifetime-parent` | On the Morse distinct-value locus it expresses ordinary elder death at S; an essential maximum has no older endpoint. | Borel measurability of the elder event (Section 8 / the Section 9 replacement), identification with a persistence-module elder rule, or any behaviour off the Morse distinct-value locus. | — | +| `IsFiniteBar` | def_prop | `lifetime-parent` | each finite superlevel H0 bar has exactly one local-maximum birth and one index-(d-1) merging-saddle death. | the identification of these pairs with bars of a persistence module; that the count of such pairs equals the finite-bar count off the Morse locus. | — | +| `IsLifetimeDensityVersion` | def_prop | `lifetime-parent` | These densities admit versions with | existence of a version; the weighted Kac-Rice identity; the radial ledger (10.2). Measurability of the pair count as a function of the sample is REQUIRED by the predicate (through `Integrable`, hence `AEStronglyMeasurable`), not established here. | — | +| `IsWindowPair` | def_prop | `lifetime-parent` | Count ordered maximum/saddle pairs with 00, and let nu_eld^all(ell) count all finite ordinary superlevel H0 persistence bars, both in expectation per unit volume. | anything about the off-diagonal (far) population separately (Section 14 of the source). | — | +| `PairLawInterface` | structure | `lifetime-parent` | Let p_r(b,k,R) be the Q^W probability that the **global ordinary superlevel elder death partner** of M is S. | existence of the regression law, the typed weight, the full normalizer `Z_r > 0`, or that `p` is the probability of any event under any measure declared here; that `p` depends on `G` or `I` in any way (no field mentions them; they only record which field and elder relation the law is meant to refer to). | — | +| `ParentUniformSelectionA` | def_prop | `lifetime-parent` | There exist r_*>0 and C= c r^3, 0 6` (the source restricts to `q ≤ 6`); nothing here encloses the coefficient. | -| `DerivativeBoundAtLeastOne` | def_prop | `side24-proof` | At \|x\|>=1 this is at most76 \|x\|^6 e^(-\|x\|^2/2). | the bound (statement only); the coefficient arithmetic `1+15+45+15=76` and `76` bounding the smaller orders are kernel-checked on main (`UniversalLaw.Side24.pairing_sum_six`, `pairing_sum_le_six`), not here; nothing here encloses the coefficient. | -| `DerivativeBoundAtZero` | def_prop | `side24-proof` | contraction has absolute value at most15. | the bound (statement only); `5!! = 15` is kernel-checked on main (`UniversalLaw.Side24.sixth_moment_double_factorial`), not here. | -| `LatticeImageSumBound` | def_prop | `side24-proof` | <=1458 e^(-288). | the bound (statement only); the intermediate `729 sum_j j^9 e^(-288 j^2)` shell count is not specified; `27*27 = 729`, `729*2 = 1458` are kernel-checked on main (`UniversalLaw.Side24.lattice_shell_constant`), not here. | -| `SuccessiveTermRatio` | def_prop | `side24-proof` | successive terms have ratio at most512e^(-864)<1/2. | the bounds (statement only); `2^9 = 512`, `288*3 = 864` are kernel-checked on main (`UniversalLaw.Side24.geometric_ratio_constants`), not here. | -| `ExponentialBounds` | def_prop | `side24-proof` | hence e^(-288)<10^(-125) and the geometric-ratio inequality follows too. | the inequalities (statement only); the rational Taylor sum through degree 20 exceeding `10` is kernel-checked on main (the `UniversalLaw.Side24` Taylor-sum target in `Ledger.lean`), not here. | -| `ImageBound` | def_prop | `side24-proof` | \|D^q K_24(0)-D^q K_infty(0)\| | the bound (statement only); differentiability of `K_24` (if `K_24` is not `C^q` the derivative is `0` in Lean); nothing here encloses the coefficient; nonauthor review or acceptance. | -| `CovarianceOrdering` | def_prop | `side24-proof` | The inequalities are in the positive-semidefinite ordering and hold in every | the ordering (statement only); the passage to marginal and conditional covariances (not specified); `60E < epsilon` is kernel-checked on main (`UniversalLaw.Side24.covariance_relative_bound`), not here; nothing here encloses the coefficient; nonauthor review or acceptance. | -| `EntrywiseCovarianceBound` | def_prop | `side24-proof` | Each covariance entry differs from the reference by at most2E, by (2). | the bound (statement only); the spectral-norm bound `20E` (not specified); nonauthor review or acceptance. | -| `ReferenceCovarianceLowerBound` | def_prop | `side24-proof` | Thus C_ref >= I/3 and | the bound (statement only); the odd-block eigenvalues `8 ± sqrt 58` and the minors `2/3`, `7/9` are kernel-checked on main (`UniversalLaw.Side24.odd_block_eigenvalues`, `odd_block_shifted_minors`, `smaller_eigenvalue_exceeds_third`), not here. | -| `ReferenceOddAndPinBlocks` | def_prop | `side24-proof` | Var(t)=15, Cov(t,G)=(-3,0,...,0), | the identities (statement only); `15 - 9 = 6` is kernel-checked on main (`UniversalLaw.Side24.conditional_third_derivative_variance`), not here. | -| `DensityComparison` | def_prop | `side24-proof` | [(1-epsilon)/(1+epsilon)]^(n/2) phi_((1-epsilon)C0) | the comparison (statement only); the cone-moment consequence `(1 ± epsilon)^m D0` and the scaling `a^m` of `h(A) = det(A)^2 1{A<0}` (not specified); nothing here encloses the coefficient; nonauthor review or acceptance. | -| `IntegrandRatioBounds` | def_prop | `side24-proof` | ratio between1-13epsilon and | the bounds (statement only); that the integrand ratio of the source equals these power quotients (not specified); `13 ≤ 32`, `28 ≤ 32` and `32*10^(-108) < 10^(-106)` are kernel-checked on main (`UniversalLaw.Side24.ratio_constant_ordering`, `density_comparison_below_reported`), not here. | -| `ReferencePinDensityProduct` | def_prop | `side24-proof` | p_G(0) p_V(0) = (2pi)^(-d) / sqrt(3). | the identity (statement only); `det diag(3,1,…,1) = 3` is kernel-checked on main (`UniversalLaw.Side24.pin_determinant_and_joint_dimension`), not here. | -| `ReferenceCoefficientIdentity` | def_prop | `side24-proof` | This eliminates BOTH the angular and cone integrals for the reference expression. | the identity (statement only); that the left side is the parent formula (15.2) evaluated at the reference law (the angular integrand is constant by rotational invariance of `K_infty`, a fact not specified here); `6^2*2 = 3*24` is kernel-checked on main (`UniversalLaw.Side24.cube_root_simplification`), not here; nonauthor review or acceptance. | -| `ConeMomentInterface` | structure | `side24-proof` | Var(s)=5/3 and Var(x)=Var(y)=1. The negative-definite cone is s<-R, | that these laws are the conditional law `A \| V = 0` of the reference field (the source derives them; here they are hypotheses); the derivation of `Var(s) = 5/3` from the `(2/3) delta delta + …` formula (kernel-checked arithmetic on main, `UniversalLaw.Side24.trace_and_traceless_variances`). | -| `NegDefCone` | def_prop | `side24-proof` | R=sqrt(x^2+y^2), and det A=s^2-R^2. | the source's reduction of the cone to `s < -R` (not specified; the cone is taken by its definition). | -| `ConeMomentD1Identity` | def_prop | `side24-proof` | D_1=E[A^2 1{A<0}]=4/3. | the identity (statement only); that `D_1` is the parent's cone moment `D_u` of (15.1) for the reference law; nothing here encloses the coefficient. | -| `ConeMomentD2Identity` | def_prop | `side24-proof` | D_2 = (1/2)[25/3-20/3+8-8sqrt(3/8)] | the identity (statement only); the Rayleigh integration route; that `D_2` is the parent's `D_u` for the reference law; nothing here encloses the coefficient; nonauthor review or acceptance. | -| `ConeMomentD2Algebra` | def_prop | `side24-proof` | = 29/6-sqrt(6). | the identity (statement only); its rational part and `4 sqrt(3/8) = sqrt 6` are kernel-checked on main (`UniversalLaw.Side24.cone_moment_m2_algebra`), not here. | -| `TraceMoments` | def_prop | `side24-proof` | E s^2=5/3, E s^4=25/3 and | the identities (statement only); `3 (5/3)^2 = 25/3` and `1 + 5/3 = 8/3` are kernel-checked on main (`UniversalLaw.Side24.fourth_moment_of_trace`, `exponential_moment_of_trace`), not here. | -| `RayleighSquareLaw` | def_prop | `side24-proof` | The variable R^2 has density e^(-z/2)/2. | the law (statement only); measurability of the event (if the event is not measurable, `P` is its outer measure). | -| `ElementaryConeIntegral` | def_prop | `side24-proof` | integral_0^a (a-z)^2 e^(-z/2) dz/2 = a^2-4a+8-8e^(-a/2). | the identity (statement only). | -| `PeriodicCoefficientInterface` | structure | `side24-proof` | Let c_d,24 be precisely its equation (15.2), using ordinary sphere area, ordered | existence of an object satisfying this interface; that `c24` is the finite-bar asymptotic constant (that reading is conditional on the parent's results, which are not touched); that the parent's "ordered maximum/saddle roles and the full height/gradient pin Jacobian" are encoded beyond the prefactor of (15.2). | -| `CoefficientEnclosure` | def_prop | `side24-proof` | 0.07340691930603427103 < c_2,24 < 0.07340691930603427104, | the enclosures (statement only: nothing here encloses the coefficient); that an object satisfying the interface exists or is the coefficient of the source; the parent's results or the persistence interpretation; any finite-radius error estimate, unrestricted remainder or RN/24-jet statement; the arithmetic skeleton (endpoint adjacency, `d3 < d2`, endpoints in `(0, 1/10)`) is kernel-checked on main (31 `UniversalLaw.Side24` targets at origin/main f6deeba7), not here; nonauthor review or acceptance. | -| `ReferenceComparison` | def_prop | `side24-proof` | \|c_d,24/c_d,ref -1\| < 10^(-106), d=2,3. | the bound (statement only); equality of the periodic and reference constants (the source says it is NOT claimed); `32*10^(-108) < 10^(-106)` is kernel-checked on main (`UniversalLaw.Side24.density_comparison_below_reported`), not here; nothing here encloses the coefficient. | +| declaration | kind | source | exact coverage (verbatim anchor) | Not established (verbatim `Does not claim:`) | proved by (proof packet, `proved`; kernel-checked by hosted run 38121713840: PR head 910809d6, actual tested merge 5b198699… with base b2d70d77…, same tree as the head) | +|---|---|---|---|---|---| +| `ThetaSummable` | def_prop | `side24-proof` | K_24(z) = sum_{n in Z^d} exp(-\|z+24n\|^2/2) | that the family is summable (true, but not shown here). | — | +| `IsUnitTuple` | def_prop | `side24-proof` | For q<=6 unit directional differentiations of phi(x)=exp(-\|x\|^2/2), product-rule | anything. | — | +| `DerivativePairingBound` | def_prop | `side24-proof` | pairings bound the absolute derivative by | the bound (statement only); validity for `q > 6` (the source restricts to `q ≤ 6`); nothing here encloses the coefficient. | — | +| `DerivativeBoundAtLeastOne` | def_prop | `side24-proof` | At \|x\|>=1 this is at most76 \|x\|^6 e^(-\|x\|^2/2). | the bound (statement only); the coefficient arithmetic `1+15+45+15=76` and `76` bounding the smaller orders are kernel-checked on main (`UniversalLaw.Side24.pairing_sum_six`, `pairing_sum_le_six`), not here; nothing here encloses the coefficient. | — | +| `DerivativeBoundAtZero` | def_prop | `side24-proof` | contraction has absolute value at most15. | the bound (statement only); `5!! = 15` is kernel-checked on main (`UniversalLaw.Side24.sixth_moment_double_factorial`), not here. | — | +| `LatticeImageSumBound` | def_prop | `side24-proof` | <=1458 e^(-288). | the bound (statement only); the intermediate `729 sum_j j^9 e^(-288 j^2)` shell count is not specified; `27*27 = 729`, `729*2 = 1458` are kernel-checked on main (`UniversalLaw.Side24.lattice_shell_constant`), not here. | — | +| `SuccessiveTermRatio` | def_prop | `side24-proof` | successive terms have ratio at most512e^(-864)<1/2. | the bounds (statement only); `2^9 = 512`, `288*3 = 864` are kernel-checked on main (`UniversalLaw.Side24.geometric_ratio_constants`), not here. | `Side24Elementary.successiveTermRatio` | +| `ExponentialBounds` | def_prop | `side24-proof` | hence e^(-288)<10^(-125) and the geometric-ratio inequality follows too. | the inequalities (statement only); the rational Taylor sum through degree 20 exceeding `10` is kernel-checked on main (the `UniversalLaw.Side24` Taylor-sum target in `Ledger.lean`), not here. | `Side24Elementary.exponentialBounds` | +| `ImageBound` | def_prop | `side24-proof` | \|D^q K_24(0)-D^q K_infty(0)\| | the bound (statement only); differentiability of `K_24` (if `K_24` is not `C^q` the derivative is `0` in Lean); nothing here encloses the coefficient; nonauthor review or acceptance. | — | +| `CovarianceOrdering` | def_prop | `side24-proof` | The inequalities are in the positive-semidefinite ordering and hold in every | the ordering (statement only); the passage to marginal and conditional covariances (not specified); `60E < epsilon` is kernel-checked on main (`UniversalLaw.Side24.covariance_relative_bound`), not here; nothing here encloses the coefficient; nonauthor review or acceptance. | — | +| `EntrywiseCovarianceBound` | def_prop | `side24-proof` | Each covariance entry differs from the reference by at most2E, by (2). | the bound (statement only); the spectral-norm bound `20E` (not specified); nonauthor review or acceptance. | — | +| `ReferenceCovarianceLowerBound` | def_prop | `side24-proof` | Thus C_ref >= I/3 and | the bound (statement only); the odd-block eigenvalues `8 ± sqrt 58` and the minors `2/3`, `7/9` are kernel-checked on main (`UniversalLaw.Side24.odd_block_eigenvalues`, `odd_block_shifted_minors`, `smaller_eigenvalue_exceeds_third`), not here. | — | +| `ReferenceOddAndPinBlocks` | def_prop | `side24-proof` | Var(t)=15, Cov(t,G)=(-3,0,...,0), | the identities (statement only); `15 - 9 = 6` is kernel-checked on main (`UniversalLaw.Side24.conditional_third_derivative_variance`), not here. | — | +| `DensityComparison` | def_prop | `side24-proof` | [(1-epsilon)/(1+epsilon)]^(n/2) phi_((1-epsilon)C0) | the comparison (statement only); the cone-moment consequence `(1 ± epsilon)^m D0` and the scaling `a^m` of `h(A) = det(A)^2 1{A<0}` (not specified); nothing here encloses the coefficient; nonauthor review or acceptance. | — | +| `IntegrandRatioBounds` | def_prop | `side24-proof` | ratio between1-13epsilon and | the bounds (statement only); that the integrand ratio of the source equals these power quotients (not specified); `13 ≤ 32`, `28 ≤ 32` and `32*10^(-108) < 10^(-106)` are kernel-checked on main (`UniversalLaw.Side24.ratio_constant_ordering`, `density_comparison_below_reported`), not here. | — | +| `ReferencePinDensityProduct` | def_prop | `side24-proof` | p_G(0) p_V(0) = (2pi)^(-d) / sqrt(3). | the identity (statement only); `det diag(3,1,…,1) = 3` is kernel-checked on main (`UniversalLaw.Side24.pin_determinant_and_joint_dimension`), not here. | — | +| `ReferenceCoefficientIdentity` | def_prop | `side24-proof` | This eliminates BOTH the angular and cone integrals for the reference expression. | the identity (statement only); that the left side is the parent formula (15.2) evaluated at the reference law (the angular integrand is constant by rotational invariance of `K_infty`, a fact not specified here); `6^2*2 = 3*24` is kernel-checked on main (`UniversalLaw.Side24.cube_root_simplification`), not here; nonauthor review or acceptance. | `Side24Elementary.referenceCoefficientIdentity` | +| `ConeMomentInterface` | structure | `side24-proof` | Var(s)=5/3 and Var(x)=Var(y)=1. The negative-definite cone is s<-R, | that these laws are the conditional law `A \| V = 0` of the reference field (the source derives them; here they are hypotheses); the derivation of `Var(s) = 5/3` from the `(2/3) delta delta + …` formula (kernel-checked arithmetic on main, `UniversalLaw.Side24.trace_and_traceless_variances`). | — | +| `NegDefCone` | def_prop | `side24-proof` | R=sqrt(x^2+y^2), and det A=s^2-R^2. | the source's reduction of the cone to `s < -R` (not specified; the cone is taken by its definition). | — | +| `ConeMomentD1Identity` | def_prop | `side24-proof` | D_1=E[A^2 1{A<0}]=4/3. | the identity (statement only); that `D_1` is the parent's cone moment `D_u` of (15.1) for the reference law; nothing here encloses the coefficient. | — | +| `ConeMomentD2Identity` | def_prop | `side24-proof` | D_2 = (1/2)[25/3-20/3+8-8sqrt(3/8)] | the identity (statement only); the Rayleigh integration route; that `D_2` is the parent's `D_u` for the reference law; nothing here encloses the coefficient; nonauthor review or acceptance. | — | +| `ConeMomentD2Algebra` | def_prop | `side24-proof` | = 29/6-sqrt(6). | the identity (statement only); its rational part and `4 sqrt(3/8) = sqrt 6` are kernel-checked on main (`UniversalLaw.Side24.cone_moment_m2_algebra`), not here. | `Side24Elementary.coneMomentD2Algebra` | +| `TraceMoments` | def_prop | `side24-proof` | E s^2=5/3, E s^4=25/3 and | the identities (statement only); `3 (5/3)^2 = 25/3` and `1 + 5/3 = 8/3` are kernel-checked on main (`UniversalLaw.Side24.fourth_moment_of_trace`, `exponential_moment_of_trace`), not here. | — | +| `RayleighSquareLaw` | def_prop | `side24-proof` | The variable R^2 has density e^(-z/2)/2. | the law (statement only); measurability of the event (if the event is not measurable, `P` is its outer measure). | — | +| `ElementaryConeIntegral` | def_prop | `side24-proof` | integral_0^a (a-z)^2 e^(-z/2) dz/2 = a^2-4a+8-8e^(-a/2). | the identity (statement only). | `Side24Elementary.elementaryConeIntegral` | +| `PeriodicCoefficientInterface` | structure | `side24-proof` | Let c_d,24 be precisely its equation (15.2), using ordinary sphere area, ordered | existence of an object satisfying this interface; that `c24` is the finite-bar asymptotic constant (that reading is conditional on the parent's results, which are not touched); that the parent's "ordered maximum/saddle roles and the full height/gradient pin Jacobian" are encoded beyond the prefactor of (15.2). | — | +| `CoefficientEnclosure` | def_prop | `side24-proof` | 0.07340691930603427103 < c_2,24 < 0.07340691930603427104, | the enclosures (statement only: nothing here encloses the coefficient); that an object satisfying the interface exists or is the coefficient of the source; the parent's results or the persistence interpretation; any finite-radius error estimate, unrestricted remainder or RN/24-jet statement; the arithmetic skeleton (endpoint adjacency, `d3 < d2`, endpoints in `(0, 1/10)`) is kernel-checked on main (31 `UniversalLaw.Side24` targets at origin/main f6deeba7), not here; nonauthor review or acceptance. | — | +| `ReferenceComparison` | def_prop | `side24-proof` | \|c_d,24/c_d,ref -1\| < 10^(-106), d=2,3. | the bound (statement only); equality of the periodic and reference constants (the source says it is NOT claimed); `32*10^(-108) < 10^(-106)` is kernel-checked on main (`UniversalLaw.Side24.density_comparison_below_reported`), not here; nothing here encloses the coefficient. | — | ### `Specifications/RN.lean` (28 registered declarations) -| declaration | kind | source | exact coverage (verbatim anchor) | Not established (verbatim `Does not claim:`) | -|---|---|---|---|---| -| `IsCriticalPoint` | def_prop | `lifetime-parent` | grad f(M)=grad f(S)=0. | differentiability of `g` at `x` (if `g` is not differentiable, `fderiv` is `0`). | -| `HessianHasInertia` | def_prop | `lifetime-parent` | The index counts negative eigenvalues. | equivalence with an eigenvalue count for a non-symmetric form. | -| `HolderCountBoundN1` | def_prop | `rn-count-interface` | E[N_r 1_Er] <= (E N_r^p)^(1/p) P(E_r)^(1-1/p). | that any count of the Gaussian model satisfies the moment hypothesis; the result or its proof; any rate in `r`; nonauthor review or acceptance (the landing disposition HOLD_WITH_DOMAIN of rn-count-interface is transcribed by the register, not here). | -| `HolderConsequenceN2` | def_prop | `rn-count-interface` | E[N_r 1_Er] <= A^(1/p) C^(1-1/p) | that the exponent can be rounded up to `3`; that any Gaussian count satisfies the hypotheses; the result or its proof; nonauthor review or acceptance (the landing disposition HOLD_WITH_DOMAIN of rn-count-interface is transcribed by the register, not here). | -| `ConditionalMeanIdentityN3` | def_prop | `rn-count-interface` | E[N_r 1_Er]=q E[N_r \| E_r]. | the equivalence with a bounded conditional mean, the lower comparison `q ≥ c r^3`, or anything about the Gaussian model; the result or its proof; nonauthor review or acceptance (the landing disposition HOLD_WITH_DOMAIN of rn-count-interface is transcribed by the register, not here). | -| `UniformCounterexampleN4` | def_prop | `rn-count-interface` | E N_r/r^3=ceil(log(1/r)) -> infinity. | the explicit bound `sup_(t>=1) e^(-3t)(t+1)^p` (only existence of a `p`-dependent bound); the one-`p` sharpness construction `N_r=ceil(r^(-3/p))1_Er`; the exponential-tail remark after (N5); that the construction says anything about the Gaussian field; the result or its proof; nonauthor review or acceptance (the landing disposition HOLD_WITH_DOMAIN of rn-count-interface is transcribed by the register, not here). | -| `ExponentialTailLayerCakeN5` | def_prop | `rn-count-interface` | = B q[1+log(A/q)]. | the intermediate integral identity `integral_0^infinity min(q,Ae^(-t/B))dt`; that the logarithmic loss is attained (the source's remark about (N4)); anything about the Gaussian model; the result or its proof; nonauthor review or acceptance (the landing disposition HOLD_WITH_DOMAIN of rn-count-interface is transcribed by the register, not here). | -| `PinnedLawInterface` | structure | `rn-fixed-remote-window` | Q_r denotes continuous Gaussian regression on these 2(d+1) observations. | that `Q_r` is the Gaussian regression of any field; that `W_r` equals `F_d(H_M) F_(d-1)(H_S)`; the normalizer floor `Z_r >= z_* r^2`; that `Λ` is given by (13); existence or uniqueness of an object satisfying the interface (an inhabitant is not asserted; the consistency remark above is not stated); that `0 < r < L` is the sources' unspecified `small r` threshold. | -| `FixedRemoteMeanMeasureA2` | def_prop | `rn-fixed-remote-window` | \| E_(Q_r^W) N_(r,j)(E)/(k r^3) | the result or its proof (uniform remote nondegeneracy, coupling (5), weight expansion (10), normalizer (11)); identification of `I.Λ` with the kernel (13); the total-variation convergence remark; the multi-witness Section 6; any numerical `C` or `r_*`; uniformity as `ρ → 0`; nonauthor review or acceptance (the landing disposition HOLD_WITH_DOMAIN is transcribed by the register, not here). | -| `FixedRemoteCountBoundA3` | def_prop | `rn-fixed-remote-window` | E_(Q_r^W) N_(r,j)(E) <= C k r^3 \|E\|, | a matching lower bound on the event probability (the source says this is NOT one); the unnormalized numerator bound (14); the result or its proof; any numerical constant; nonauthor review or acceptance. | -| `FixedAnnulusWindowCandidateA2` | def_prop | `rn-fixed-annulus-window` | E_Qr^W N_j(r E0) <= C*k*r^3*area(E0), | the result or its proof (contact vector (A10), eigenfloor (A12), cutoff (A13), three-Hessian estimate (A18), inner-strip bound (A26)); the all-index sum or the Markov event bound; an all-height assertion; uniformity in `L`, as `k → 0`, as `B0 → ∞`, or for `d ≥ 3`; any numerical constant; nonauthor review or acceptance (the landing disposition REVIEWED_SCOPED is transcribed by the register, not here). | -| `AnnulusBridgeAllHeight2` | def_prop | `rn-annulus-bridge` | E_(Q_r^W) N_j(rE) <= C r^3 area(E), 0=0} dTV(Law N, Pois(lambda)) <= A r^3. | the result (Theorem O) or its proof; that `2a ≤ A` (derived in the source, not a hypothesis here); that H1 or H2 hold for the Gaussian window count (the source takes them from [D5] Theorem G_d and [C6] Corollary Theta); the mean-matched statement `lambda = mu`; Theorems C and S, the factorial-moment matching or the independent-replica limit; the conditional-law liminf remark; that the upper half is the source's infimum bound verbatim: `∃ lam ≥ 0, dTV(Law N_r, Pois(lam)) ≤ A r^3` implies `inf_{lam ≥ 0} dTV ≤ A r^3` and is stronger unless the infimum is attained, and the existential form is used because the source's proof exhibits the witness `lam = 0` (the source: The upper bound in (3.1) uses Pois(0)=delta_0 and dTV(Law N,delta_0)=p); nonauthor review or acceptance. | -| `RemoteCollisionSecondFactorialD` | def_prop | `remote-collision` | E_(Q_r^W) N(E)(N(E)-1) <= C r^5 \|E\|, | Theorem C (the ordered near-pair count) or its proof (Lemmas 1-5); Corollaries E and F; a torus-wide second factorial moment or `math.rn-region.witness-collision` in its full sense; pairs with a witness near the pins; equality of `N(E)` with the all-critical-point count `windowCountAll` (they agree only off the degenerate locus); any numerical constant; nonauthor review or acceptance. | -| `WitnessCollisionNearPinPairsTarget` | def_prop | `d5-reconciliation` | A torus-wide second factorial moment `E_{Q_r^W} N(N−1)` for the window count, with pairs where at least | that this target holds, is attainable, or is implied by any reviewed source (the Palm route's Theorem Q is an author-side candidate whose `q = 2` case would imply it; that candidate is stated separately as `PalmRouteFactorialMomentsQ` and is not consumed here); that the lower obstruction `E N(N−1) ≥ 2c r³` is stated here; the optimal order; any status transition of the node. | +| declaration | kind | source | exact coverage (verbatim anchor) | Not established (verbatim `Does not claim:`) | proved by (proof packet, `proved`; kernel-checked by hosted run 38121713840: PR head 910809d6, actual tested merge 5b198699… with base b2d70d77…, same tree as the head) | +|---|---|---|---|---|---| +| `IsCriticalPoint` | def_prop | `lifetime-parent` | grad f(M)=grad f(S)=0. | differentiability of `g` at `x` (if `g` is not differentiable, `fderiv` is `0`). | — | +| `HessianHasInertia` | def_prop | `lifetime-parent` | The index counts negative eigenvalues. | equivalence with an eigenvalue count for a non-symmetric form. | — | +| `HolderCountBoundN1` | def_prop | `rn-count-interface` | E[N_r 1_Er] <= (E N_r^p)^(1/p) P(E_r)^(1-1/p). | that any count of the Gaussian model satisfies the moment hypothesis; the result or its proof; any rate in `r`; nonauthor review or acceptance (the landing disposition HOLD_WITH_DOMAIN of rn-count-interface is transcribed by the register, not here). | `RNProbability.holderCountBoundN1` | +| `HolderConsequenceN2` | def_prop | `rn-count-interface` | E[N_r 1_Er] <= A^(1/p) C^(1-1/p) | that the exponent can be rounded up to `3`; that any Gaussian count satisfies the hypotheses; the result or its proof; nonauthor review or acceptance (the landing disposition HOLD_WITH_DOMAIN of rn-count-interface is transcribed by the register, not here). | `RNProbability.holderConsequenceN2` | +| `ConditionalMeanIdentityN3` | def_prop | `rn-count-interface` | E[N_r 1_Er]=q E[N_r \| E_r]. | the equivalence with a bounded conditional mean, the lower comparison `q ≥ c r^3`, or anything about the Gaussian model; the result or its proof; nonauthor review or acceptance (the landing disposition HOLD_WITH_DOMAIN of rn-count-interface is transcribed by the register, not here). | `RNProbability.conditionalMeanIdentityN3` | +| `UniformCounterexampleN4` | def_prop | `rn-count-interface` | E N_r/r^3=ceil(log(1/r)) -> infinity. | the explicit bound `sup_(t>=1) e^(-3t)(t+1)^p` (only existence of a `p`-dependent bound); the one-`p` sharpness construction `N_r=ceil(r^(-3/p))1_Er`; the exponential-tail remark after (N5); that the construction says anything about the Gaussian field; the result or its proof; nonauthor review or acceptance (the landing disposition HOLD_WITH_DOMAIN of rn-count-interface is transcribed by the register, not here). | `RNProbability.uniformCounterexampleN4` | +| `ExponentialTailLayerCakeN5` | def_prop | `rn-count-interface` | = B q[1+log(A/q)]. | the intermediate integral identity `integral_0^infinity min(q,Ae^(-t/B))dt`; that the logarithmic loss is attained (the source's remark about (N4)); anything about the Gaussian model; the result or its proof; nonauthor review or acceptance (the landing disposition HOLD_WITH_DOMAIN of rn-count-interface is transcribed by the register, not here). | `RNProbability.exponentialTailLayerCakeN5` | +| `PinnedLawInterface` | structure | `rn-fixed-remote-window` | Q_r denotes continuous Gaussian regression on these 2(d+1) observations. | that `Q_r` is the Gaussian regression of any field; that `W_r` equals `F_d(H_M) F_(d-1)(H_S)`; the normalizer floor `Z_r >= z_* r^2`; that `Λ` is given by (13); existence or uniqueness of an object satisfying the interface (an inhabitant is not asserted; the consistency remark above is not stated); that `0 < r < L` is the sources' unspecified `small r` threshold. | — | +| `FixedRemoteMeanMeasureA2` | def_prop | `rn-fixed-remote-window` | \| E_(Q_r^W) N_(r,j)(E)/(k r^3) | the result or its proof (uniform remote nondegeneracy, coupling (5), weight expansion (10), normalizer (11)); identification of `I.Λ` with the kernel (13); the total-variation convergence remark; the multi-witness Section 6; any numerical `C` or `r_*`; uniformity as `ρ → 0`; nonauthor review or acceptance (the landing disposition HOLD_WITH_DOMAIN is transcribed by the register, not here). | — | +| `FixedRemoteCountBoundA3` | def_prop | `rn-fixed-remote-window` | E_(Q_r^W) N_(r,j)(E) <= C k r^3 \|E\|, | a matching lower bound on the event probability (the source says this is NOT one); the unnormalized numerator bound (14); the result or its proof; any numerical constant; nonauthor review or acceptance. | — | +| `FixedAnnulusWindowCandidateA2` | def_prop | `rn-fixed-annulus-window` | E_Qr^W N_j(r E0) <= C*k*r^3*area(E0), | the result or its proof (contact vector (A10), eigenfloor (A12), cutoff (A13), three-Hessian estimate (A18), inner-strip bound (A26)); the all-index sum or the Markov event bound; an all-height assertion; uniformity in `L`, as `k → 0`, as `B0 → ∞`, or for `d ≥ 3`; any numerical constant; nonauthor review or acceptance (the landing disposition REVIEWED_SCOPED is transcribed by the register, not here). | — | +| `AnnulusBridgeAllHeight2` | def_prop | `rn-annulus-bridge` | E_(Q_r^W) N_j(rE) <= C r^3 area(E), 0=0} dTV(Law N, Pois(lambda)) <= A r^3. | the result (Theorem O) or its proof; that `2a ≤ A` (derived in the source, not a hypothesis here); that H1 or H2 hold for the Gaussian window count (the source takes them from [D5] Theorem G_d and [C6] Corollary Theta); the mean-matched statement `lambda = mu`; Theorems C and S, the factorial-moment matching or the independent-replica limit; the conditional-law liminf remark; that the upper half is the source's infimum bound verbatim: `∃ lam ≥ 0, dTV(Law N_r, Pois(lam)) ≤ A r^3` implies `inf_{lam ≥ 0} dTV ≤ A r^3` and is stronger unless the infimum is attained, and the existential form is used because the source's proof exhibits the witness `lam = 0` (the source: The upper bound in (3.1) uses Pois(0)=delta_0 and dTV(Law N,delta_0)=p); nonauthor review or acceptance. | — | +| `RemoteCollisionSecondFactorialD` | def_prop | `remote-collision` | E_(Q_r^W) N(E)(N(E)-1) <= C r^5 \|E\|, | Theorem C (the ordered near-pair count) or its proof (Lemmas 1-5); Corollaries E and F; a torus-wide second factorial moment or `math.rn-region.witness-collision` in its full sense; pairs with a witness near the pins; equality of `N(E)` with the all-critical-point count `windowCountAll` (they agree only off the degenerate locus); any numerical constant; nonauthor review or acceptance. | — | +| `WitnessCollisionNearPinPairsTarget` | def_prop | `d5-reconciliation` | A torus-wide second factorial moment `E_{Q_r^W} N(N−1)` for the window count, with pairs where at least | that this target holds, is attainable, or is implied by any reviewed source (the Palm route's Theorem Q is an author-side candidate whose `q = 2` case would imply it; that candidate is stated separately as `PalmRouteFactorialMomentsQ` and is not consumed here); that the lower obstruction `E N(N−1) ≥ 2c r³` is stated here; the optimal order; any status transition of the node. | — | ### `Specifications/P15.lean` (58 registered declarations) -| declaration | kind | source | exact coverage (verbatim anchor) | Not established (verbatim `Does not claim:`) | -|---|---|---|---|---| -| `RealizedData` | structure | `p15-realized-covers` | Choose positive integers a_i,d_i and disjoint original-coordinate blocks X_i with | that the data satisfy the sources' side conditions (that is `IsRealizedFamily`). | -| `IsRealizedFamily` | def_prop | `p15-realized-covers` | n_i=\|X_i\|=a_i d_i+1. | that any particular data record satisfies it. | -| `IsGood` | def_prop | `p15-realized-covers` | D={U subset X: \|U intersect X_i\|<=a_i for every i, | that `D` is decreasing or contains the empty set (facts of the sources, not stated separately). | -| `IsKDecomposable` | def_prop | `p15-realized-covers` | write I_k(D) for sets partitionable into at most k members of D | equivalence with coverings by at most `k` good sets (true for a decreasing family, not stated). | -| `IsGeneratorCover` | def_prop | `p15-realized-covers` | A generator cover G of O_k(D) means every obstructed set contains some g in G. | anything. | -| `IsPaletteFeasible` | def_prop | `p15-realized-covers` | intersection_(i in e) P_i = empty, for every e in H. (P6) | upward closure in `K` (true, not stated). | -| `PaletteNumberAttained` | def_prop | `p15-realized-covers` | By discarding excess labels within blocks, one may take \|P_i\|=d_i. | the statement (not proved here; disjoint palettes of sizes `d_i` are a witness in the sources' argument). | -| `IsMinimalForbidden` | def_prop | `p15-realized-covers` | The inclusion-minimal forbidden ORIGINAL sets are exactly | anything. | -| `IsTransversal` | def_prop | `p15-realized-covers` | (b) for each e in H, EVERY transversal {x_i:i in e}, with x_i in X_i. | anything. | -| `MinimalForbiddenCharacterisation` | def_prop | `p15-realized-covers` | (a) every (a_i+1)-subset of a single X_i; | the characterisation (statement only); its completeness clause is what the source calls "completeness, not just existence of some witnesses". | -| `LocalRestriction` | def_prop | `p15-realized-covers` | D_i=D intersect 2^(X_i)={S subset X_i: \|S\|<=a_i}. (P2) | the identity (statement only). | -| `LocalDecomposability` | def_prop | `p15-realized-covers` | I_k(D_i)={S:\|S\|<=a_i k}. | the identity (statement only). | -| `LocalObstructionIsFullBlock` | def_prop | `p15-realized-covers` | G_i={X_i} (P3) | the statement (statement only). | -| `LocalPriceChain` | def_prop | `p15-realized-covers` | =P(U_i=X_i)<=q_i<=phi(q_i), (P4) | the chain (statement only); the identity `prod p_v = P(U_i = X_i)` is the definition of the weight. | -| `IndependentBlockHazard` | def_prop | `p15-realized-covers` | <=-log(product_i(1-q_i))<=-log mu_p(D). (P5) | the inequalities (statement only); independence of crossing events ("Crossing events are not declared independent"). | -| `FullBlockCoverIff` | def_prop | `p15-realized-covers` | K>=K_H(d). (P7) | the criterion (statement only); optimality of any other cover ("It does not prove that no different cover with the same budget works at fewer colors"); unrestricted prize optimality; disposition transcribed from LANDING_CLAIMS for p15-realized-covers: HOLD_WITH_DOMAIN; nonauthor review and acceptance are not claimed here. | -| `CoverCostHazardBound` | def_prop | `p15-realized-covers` | covercost_c(O_K(D)) <= min(1,-log mu_p(D)). (P8) | the bound (statement only); anything for `c_v > p_v`; the unrestricted P15 prize; original P15-B; disposition transcribed from LANDING_CLAIMS for p15-realized-covers: HOLD_WITH_DOMAIN; nonauthor review and acceptance are not claimed here. | -| `WholeGroundChromaticNumber` | def_prop | `p15-realized-covers` | the chromatic number of the ENTIRE ground set X is K_H(d+1), because ceil(n_i/a_i)=d_i+1. | the statement (statement only). | -| `ElementaryPaletteFormula` | def_prop | `p15-realized-covers` | K_H(d)=max(max_i d_i, ceil(sum_i d_i/s)). (P9) | the formula (statement only); the matroid palette formula of Section 5 (not specified). | -| `TriangleNeedsThree` | def_prop | `p15-realized-covers` | at unit demands needs3 colors, although a formula considering only size-two edge loads would give2. | the value (statement only; finite and decidable in principle). | -| `Benchmark816IsRealized` | def_prop | `p15-realized-covers` | Every D-color class contains at most one vertex per block and occupies at most three blocks. | the statement (finite, decidable in principle; not proved here). | -| `Benchmark816Palette` | def_prop | `p15-realized-covers` | K_H(408,...,408)=816. | the value (statement only); the arithmetic `max(408, ceil(2448/3)) = 816` is a core-Lean target on main, not here. | -| `Benchmark816Cover` | def_prop | `p15-realized-covers` | At816 colors it covers the obstruction; at815 it does not, because omitting one vertex from each block leaves2448 vertices, each color holds at most3, and815*3<2448. | the statement (finite over `2^2454` subsets, not decidable in practice); `815*3 < 2448` is a core-Lean target on main. | -| `Benchmark816WholeGround` | def_prop | `p15-realized-covers` | The whole ground set, unlike the cover-avoiding sets, needs818 colors, since2454/3=818. | the statement (statement only); `2454/3 = 818` is a core-Lean target on main. | -| `Benchmark816MinimalForbiddenCounts` | def_prop | `p15-realized-covers` | 15*409^4=419743994415 crossing transversal quadruples. (P10) | the counts (statement only); the evaluations `500616` and `419743994415` are core-Lean targets on main; the source stresses these are "not a claim that the program enumerated more than four hundred billion sets". | -| `Benchmark816Price` | def_prop | `p15-realized-covers` | 6/(40900^409)>0. | the identity (statement only; the six blocks are distinct members of the image). | -| `Benchmark816UnionBound` | def_prop | `p15-realized-covers` | =2449227/8180000000 < 3/10000. (P11) | the bound (statement only; "only a union bound, not an equality of the global bad probability"); the two rational identities are core-Lean targets on main. | -| `TwoCoordGeneratorPrices` | def_prop | `p15-price-boundary` | The possible generator costs are1,2/3,2/3,4/9 for the empty | the values (statement only; as integers over `9` they are core-Lean targets on main). | -| `DemandOneRefutation` | def_prop | `p15-price-boundary` | covercost_c(O_1(D))=4/9 > 1/3 > log(4/3). | the statement (statement only; the finite parts are decidable in principle, the two logarithm inequalities are analysis); that this contradicts original P15-B ("It does not contradict the original P15-B amalgamation"); anything about the `408`-scale or the unrestricted prize; the integral representation `log 2 = 2 integral_0^(1/3) 1/(1-t^2) dt` is not specified; disposition transcribed from LANDING_CLAIMS for p15-price-boundary: EXACT_COUNTEREXAMPLE; nonauthor review and acceptance are not claimed here. | -| `LogOnePlusBelowIdentity` | def_prop | `p15-price-boundary` | using log(1+x)0. | the inequality (statement only; the source proves it, this module does not). | -| `LogRatioBound` | def_prop | `p15-price-budget` | -log(1-p)=integral_0^p dt/(1-t) <= p/(1-p). (T2) | the inequality (statement only); the integral representation is not specified. | -| `RatioExponentBound` | def_prop | `p15-price-budget` | <= (4/3)*(4/9)^a <=16/27. (T3) | the inequalities (statement only); the preceding ratio steps of (T3) (price over `prod_{v in S} p_v`) are stated through their consequence `RestrictedLocalBudget`; the case `a = 1, n = 3` giving `16/27` is a core-Lean target on main. | -| `RestrictedLocalBudget` | def_prop | `p15-price-budget` | price({X}) <= (16/27)q <= phi(q). (T4) | the bound (statement only); the source notes "The extra demand hypothesis d>=2 is load-bearing" and that `p_v <= 1/4` "is a sufficient range, not an asserted sharp threshold". | -| `RestrictedTransformedPriceBudget` | def_prop | `p15-price-budget` | covercost_c(O_K(D)) <= min(1,(16/27)*[-log mu_p(D)]). (T1) | the bound (statement only); any retraction of the demand-one refutation; the unrestricted prize; new classical coloring theory; disposition transcribed from LANDING_CLAIMS for p15-price-budget-restricted: HOLD_WITH_DOMAIN; nonauthor review ("nonauthor review open") and acceptance are not claimed here. | -| `RhoTestSufficient` | def_prop | `p15-price-budget` | If rho<=1 the same argument proves price({X})<=q for that block. | the statement (statement only); anything when `rho > 1` (the source: a block with `rho > 1` "must not be labeled infeasible"). | -| `CapTestAtTwoThirds` | def_prop | `p15-price-budget` | or if q>=2/3 (then phi(q)=1, since log3>1) | the statement (statement only); the integral proof of `log 3 > 1` is not specified; the checker program of that section is not specified. | -| `Benchmark816TransformedRange` | def_prop | `p15-price-budget` | 0<=c_v<=log(40900/40899), | the statement (statement only); "No large witness enumeration" is involved, nor any claim about earlier P15 inputs. | -| `Benchmark816RationalPrice` | def_prop | `p15-price-budget` | 6*log(40900/40899)^409 <=6/(40899^409). (T7) | the statements (statement only); the rational identity `1/40900 + (1/40900)^2/2 = 81801/3345620000` is exact arithmetic not re-proved here; admissibility rests on `integral_0^p 1/(1-t) dt > integral_0^p (1+t) dt`, which is not specified. | -| `FullTransformedPriceBudget` | def_prop | `p15-full-price` | covercost_c(O_K(D)) <= min(1,rho_star[-log mu_p(D)]). (F2) | the bound (statement only); optimality of `rho_star` (that is `SharpnessOfRhoStar`); any unrestricted downset or prize statement (the source: "palette size remains K_H(d), which can depend on H and d"); the nonauthor review recorded in LANDING_CLAIMS (REVIEWED_SCOPED) is not reproduced or extended here. | -| `RhoStarEnclosure` | def_prop | `p15-full-price` | 0.84547981724898672067 < rho_star | the enclosure (statement only; the source's `full_price.py` Fraction procedure is not a kernel proof and is not specified); this is the next full-result target named in main's `docs/FORMAL_VERIFICATION_ROLLOUT_20260927.md`, still at `specified`. | -| `RhoStarBelowSixSevenths` | def_prop | `p15-full-price` | Thus 6/7 is a simpler valid rational factor. | the inequality (statement only); `16/27 < 6/7` is a core-Lean target on main. | -| `IsProperDownset` | def_prop | `p15-full-price` | Let A be any proper decreasing family on n>=1 coordinates containing the empty set. | anything. | -| `HazardStarPositive` | def_prop | `p15-full-price` | The probability is positive on this compact cube because the empty set is admitted and every p_i(t)<1. | the statement (statement only). | -| `CoordinatewiseConcavity` | def_prop | `p15-full-price` | Only SEPARATE coordinatewise concavity is asserted; joint concavity is not needed or claimed. | the statement (statement only); joint concavity; the derivative formulas (F4)-(F5) themselves (not specified; concavity is their consequence). | -| `HazardProductBound` | def_prop | `p15-full-price` | F_A(t) >= (product_i t_i) H_A. (F6) | the inequality (statement only). | -| `HazardPhiBound` | def_prop | `p15-full-price` | -log mu_p(A) >= H_A product_i phi(p_i). (F7) | the inequality (statement only). | -| `FullGroundPriceBound` | def_prop | `p15-full-price` | product_i c_i <= min(1, [-log mu_p(A)]/H_A). (F8) | the inequality (statement only); that the full-ground generator covers any obstruction ("It does not assert that this generator alone covers an arbitrary obstruction"). | -| `PhiAtPStar` | def_prop | `p15-full-price` | at every p_i=p_star and every c_i=1, the two sides of (F7) are equal | the identity (statement only). | -| `FullGroundBudgetIff` | def_prop | `p15-full-price` | a full-ground generator universally meets the capped hazard budget precisely when H_A>=1 | the equivalence (statement only); coverage of arbitrary `A` ("it does not infer coverage of arbitrary A"). | -| `CapacityHazardIsBinomial` | def_prop | `p15-full-price` | H_(n,a)=-log P(Bin(n,p_star)<=a). (F9) | the identity (statement only; a finite identity for each `n`, general in `n`). | -| `OddMajorityIdentity` | def_prop | `p15-full-price` | =p(1-2p)P(S=a)<0. (F10) | the identities (statement only; polynomial identities in `p`, a future kernel target for each fixed `a` and by induction in general). | -| `CapacityWorstCase` | def_prop | `p15-full-price` | =3-log(3e-2)=h_star>1. (F11) | the statements (statement only); the source stresses "it is not a finite-grid extrapolation". | -| `HStarExceedsOne` | def_prop | `p15-full-price` | e^2-(3e-2)=(e-1)(e-2)>0, | the statements (statement only). | -| `LocalPriceBoundFull` | def_prop | `p15-full-price` | price({X_i}) <= rho_star [-log mu_p(D_i)], (F12) | the bound (statement only); `price <= q_i` ("The inequality price<=q_i is NOT required and is in general stronger than what is proved here"). | -| `GlobalAssemblyHazard` | def_prop | `p15-full-price` | sum_i [-log mu_p(D_i)] <= -log mu_p(D). (F13) | the inequalities (statement only; "without independence of crossing failures"). | -| `SharpnessOfRhoStar` | def_prop | `p15-full-price` | Replacing rho_star by any smaller constant in (F2) would make its right side strictly less than one. | the statements (statement only; the finite parts are decidable in principle); a necessity claim for multi-block families with some demand one (the source: "other constraints may change its budget"). | -| `DemandOneBoundary` | def_prop | `p15-full-price` | mu_p(D)=1-p_star^(a+1)>1-p_star=exp(-1), | the statements (statement only); any retraction of original P15-B ("whose local-budget premise is missing in that case"). | -| `SixSeventhsCertificate` | def_prop | `p15-full-price` | Therefore 3e-2<197/327/6 and rho_star<6/7. | the statements (statement only); the two exact rational identities are exact arithmetic not re-proved here; the series and geometric-tail bounds behind `e < 31967/11760` are not specified. | +| declaration | kind | source | exact coverage (verbatim anchor) | Not established (verbatim `Does not claim:`) | proved by (proof packet, `proved`; kernel-checked by hosted run 38121713840: PR head 910809d6, actual tested merge 5b198699… with base b2d70d77…, same tree as the head) | +|---|---|---|---|---|---| +| `RealizedData` | structure | `p15-realized-covers` | Choose positive integers a_i,d_i and disjoint original-coordinate blocks X_i with | that the data satisfy the sources' side conditions (that is `IsRealizedFamily`). | — | +| `IsRealizedFamily` | def_prop | `p15-realized-covers` | n_i=\|X_i\|=a_i d_i+1. | that any particular data record satisfies it. | — | +| `IsGood` | def_prop | `p15-realized-covers` | D={U subset X: \|U intersect X_i\|<=a_i for every i, | that `D` is decreasing or contains the empty set (facts of the sources, not stated separately). | — | +| `IsKDecomposable` | def_prop | `p15-realized-covers` | write I_k(D) for sets partitionable into at most k members of D | equivalence with coverings by at most `k` good sets (true for a decreasing family, not stated). | — | +| `IsGeneratorCover` | def_prop | `p15-realized-covers` | A generator cover G of O_k(D) means every obstructed set contains some g in G. | anything. | — | +| `IsPaletteFeasible` | def_prop | `p15-realized-covers` | intersection_(i in e) P_i = empty, for every e in H. (P6) | upward closure in `K` (true, not stated). | — | +| `PaletteNumberAttained` | def_prop | `p15-realized-covers` | By discarding excess labels within blocks, one may take \|P_i\|=d_i. | the statement (not proved here; disjoint palettes of sizes `d_i` are a witness in the sources' argument). | `P15Covers.paletteNumberAttained` | +| `IsMinimalForbidden` | def_prop | `p15-realized-covers` | The inclusion-minimal forbidden ORIGINAL sets are exactly | anything. | — | +| `IsTransversal` | def_prop | `p15-realized-covers` | (b) for each e in H, EVERY transversal {x_i:i in e}, with x_i in X_i. | anything. | — | +| `MinimalForbiddenCharacterisation` | def_prop | `p15-realized-covers` | (a) every (a_i+1)-subset of a single X_i; | the characterisation (statement only); its completeness clause is what the source calls "completeness, not just existence of some witnesses". | `P15Structure.minimalForbiddenCharacterisation` | +| `LocalRestriction` | def_prop | `p15-realized-covers` | D_i=D intersect 2^(X_i)={S subset X_i: \|S\|<=a_i}. (P2) | the identity (statement only). | `P15Covers.localRestriction` | +| `LocalDecomposability` | def_prop | `p15-realized-covers` | I_k(D_i)={S:\|S\|<=a_i k}. | the identity (statement only). | `P15Structure.localDecomposability` | +| `LocalObstructionIsFullBlock` | def_prop | `p15-realized-covers` | G_i={X_i} (P3) | the statement (statement only). | `P15Structure.localObstructionIsFullBlock` | +| `LocalPriceChain` | def_prop | `p15-realized-covers` | =P(U_i=X_i)<=q_i<=phi(q_i), (P4) | the chain (statement only); the identity `prod p_v = P(U_i = X_i)` is the definition of the weight. | `P15Hazard.localPriceChain` | +| `IndependentBlockHazard` | def_prop | `p15-realized-covers` | <=-log(product_i(1-q_i))<=-log mu_p(D). (P5) | the inequalities (statement only); independence of crossing events ("Crossing events are not declared independent"). | `P15Hazard.independentBlockHazard` | +| `FullBlockCoverIff` | def_prop | `p15-realized-covers` | K>=K_H(d). (P7) | the criterion (statement only); optimality of any other cover ("It does not prove that no different cover with the same budget works at fewer colors"); unrestricted prize optimality; disposition transcribed from LANDING_CLAIMS for p15-realized-covers: HOLD_WITH_DOMAIN; nonauthor review and acceptance are not claimed here. | `P15Structure.fullBlockCoverIff` | +| `CoverCostHazardBound` | def_prop | `p15-realized-covers` | covercost_c(O_K(D)) <= min(1,-log mu_p(D)). (P8) | the bound (statement only); anything for `c_v > p_v`; the unrestricted P15 prize; original P15-B; disposition transcribed from LANDING_CLAIMS for p15-realized-covers: HOLD_WITH_DOMAIN; nonauthor review and acceptance are not claimed here. | `P15Budget.coverCostHazardBound` | +| `WholeGroundChromaticNumber` | def_prop | `p15-realized-covers` | the chromatic number of the ENTIRE ground set X is K_H(d+1), because ceil(n_i/a_i)=d_i+1. | the statement (statement only). | `P15Structure.wholeGroundChromaticNumber` | +| `ElementaryPaletteFormula` | def_prop | `p15-realized-covers` | K_H(d)=max(max_i d_i, ceil(sum_i d_i/s)). (P9) | the formula (statement only); the matroid palette formula of Section 5 (not specified). | `P15Structure.elementaryPaletteFormula` | +| `TriangleNeedsThree` | def_prop | `p15-realized-covers` | at unit demands needs3 colors, although a formula considering only size-two edge loads would give2. | the value (statement only; finite and decidable in principle). | `P15Elementary.triangleNeedsThree`, `P15Structure.triangleNeedsThree` | +| `Benchmark816IsRealized` | def_prop | `p15-realized-covers` | Every D-color class contains at most one vertex per block and occupies at most three blocks. | the statement (finite, decidable in principle; not proved here). | `P15Structure.benchmark816IsRealized` | +| `Benchmark816Palette` | def_prop | `p15-realized-covers` | K_H(408,...,408)=816. | the value (statement only); the arithmetic `max(408, ceil(2448/3)) = 816` is a core-Lean target on main, not here. | `P15Structure.benchmark816Palette` | +| `Benchmark816Cover` | def_prop | `p15-realized-covers` | At816 colors it covers the obstruction; at815 it does not, because omitting one vertex from each block leaves2448 vertices, each color holds at most3, and815*3<2448. | the statement (finite over `2^2454` subsets, not decidable in practice); `815*3 < 2448` is a core-Lean target on main. | `P15Covers.benchmark816Cover` | +| `Benchmark816WholeGround` | def_prop | `p15-realized-covers` | The whole ground set, unlike the cover-avoiding sets, needs818 colors, since2454/3=818. | the statement (statement only); `2454/3 = 818` is a core-Lean target on main. | `P15Structure.benchmark816WholeGround` | +| `Benchmark816MinimalForbiddenCounts` | def_prop | `p15-realized-covers` | 15*409^4=419743994415 crossing transversal quadruples. (P10) | the counts (statement only); the evaluations `500616` and `419743994415` are core-Lean targets on main; the source stresses these are "not a claim that the program enumerated more than four hundred billion sets". | `P15Structure.benchmark816MinimalForbiddenCounts` | +| `Benchmark816Price` | def_prop | `p15-realized-covers` | 6/(40900^409)>0. | the identity (statement only; the six blocks are distinct members of the image). | `P15Structure.benchmark816Price` | +| `Benchmark816UnionBound` | def_prop | `p15-realized-covers` | =2449227/8180000000 < 3/10000. (P11) | the bound (statement only; "only a union bound, not an equality of the global bad probability"); the two rational identities are core-Lean targets on main. | `P15Covers.benchmark816UnionBound` | +| `TwoCoordGeneratorPrices` | def_prop | `p15-price-boundary` | The possible generator costs are1,2/3,2/3,4/9 for the empty | the values (statement only; as integers over `9` they are core-Lean targets on main). | `P15Elementary.twoCoordGeneratorPrices` | +| `DemandOneRefutation` | def_prop | `p15-price-boundary` | covercost_c(O_1(D))=4/9 > 1/3 > log(4/3). | the statement (statement only; the finite parts are decidable in principle, the two logarithm inequalities are analysis); that this contradicts original P15-B ("It does not contradict the original P15-B amalgamation"); anything about the `408`-scale or the unrestricted prize; the integral representation `log 2 = 2 integral_0^(1/3) 1/(1-t^2) dt` is not specified; disposition transcribed from LANDING_CLAIMS for p15-price-boundary: EXACT_COUNTEREXAMPLE; nonauthor review and acceptance are not claimed here. | `P15Elementary.demandOneRefutation` | +| `LogOnePlusBelowIdentity` | def_prop | `p15-price-boundary` | using log(1+x)0. | the inequality (statement only; the source proves it, this module does not). | `P15Elementary.logOnePlusBelowIdentity` | +| `LogRatioBound` | def_prop | `p15-price-budget` | -log(1-p)=integral_0^p dt/(1-t) <= p/(1-p). (T2) | the inequality (statement only); the integral representation is not specified. | `P15Elementary.logRatioBound` | +| `RatioExponentBound` | def_prop | `p15-price-budget` | <= (4/3)*(4/9)^a <=16/27. (T3) | the inequalities (statement only); the preceding ratio steps of (T3) (price over `prod_{v in S} p_v`) are stated through their consequence `RestrictedLocalBudget`; the case `a = 1, n = 3` giving `16/27` is a core-Lean target on main. | `P15Elementary.ratioExponentBound` | +| `RestrictedLocalBudget` | def_prop | `p15-price-budget` | price({X}) <= (16/27)q <= phi(q). (T4) | the bound (statement only); the source notes "The extra demand hypothesis d>=2 is load-bearing" and that `p_v <= 1/4` "is a sufficient range, not an asserted sharp threshold". | `P15Budget.restrictedLocalBudget` | +| `RestrictedTransformedPriceBudget` | def_prop | `p15-price-budget` | covercost_c(O_K(D)) <= min(1,(16/27)*[-log mu_p(D)]). (T1) | the bound (statement only); any retraction of the demand-one refutation; the unrestricted prize; new classical coloring theory; disposition transcribed from LANDING_CLAIMS for p15-price-budget-restricted: HOLD_WITH_DOMAIN; nonauthor review ("nonauthor review open") and acceptance are not claimed here. | `P15Budget.restrictedTransformedPriceBudget` | +| `RhoTestSufficient` | def_prop | `p15-price-budget` | If rho<=1 the same argument proves price({X})<=q for that block. | the statement (statement only); anything when `rho > 1` (the source: a block with `rho > 1` "must not be labeled infeasible"). | `P15Budget.rhoTestSufficient` | +| `CapTestAtTwoThirds` | def_prop | `p15-price-budget` | or if q>=2/3 (then phi(q)=1, since log3>1) | the statement (statement only); the integral proof of `log 3 > 1` is not specified; the checker program of that section is not specified. | `P15Elementary.capTestAtTwoThirds` | +| `Benchmark816TransformedRange` | def_prop | `p15-price-budget` | 0<=c_v<=log(40900/40899), | the statement (statement only); "No large witness enumeration" is involved, nor any claim about earlier P15 inputs. | `P15Budget.benchmark816TransformedRange` | +| `Benchmark816RationalPrice` | def_prop | `p15-price-budget` | 6*log(40900/40899)^409 <=6/(40899^409). (T7) | the statements (statement only); the rational identity `1/40900 + (1/40900)^2/2 = 81801/3345620000` is exact arithmetic not re-proved here; admissibility rests on `integral_0^p 1/(1-t) dt > integral_0^p (1+t) dt`, which is not specified. | `P15Structure.benchmark816RationalPrice` | +| `FullTransformedPriceBudget` | def_prop | `p15-full-price` | covercost_c(O_K(D)) <= min(1,rho_star[-log mu_p(D)]). (F2) | the bound (statement only); optimality of `rho_star` (that is `SharpnessOfRhoStar`); any unrestricted downset or prize statement (the source: "palette size remains K_H(d), which can depend on H and d"); the nonauthor review recorded in LANDING_CLAIMS (REVIEWED_SCOPED) is not reproduced or extended here. | — | +| `RhoStarEnclosure` | def_prop | `p15-full-price` | 0.84547981724898672067 < rho_star | the enclosure (statement only; the source's `full_price.py` Fraction procedure is not a kernel proof and is not specified); this is the next full-result target named in main's `docs/FORMAL_VERIFICATION_ROLLOUT_20260927.md`, still at `specified`. | — | +| `RhoStarBelowSixSevenths` | def_prop | `p15-full-price` | Thus 6/7 is a simpler valid rational factor. | the inequality (statement only); `16/27 < 6/7` is a core-Lean target on main. | `P15Elementary.rhoStarBelowSixSevenths` | +| `IsProperDownset` | def_prop | `p15-full-price` | Let A be any proper decreasing family on n>=1 coordinates containing the empty set. | anything. | — | +| `HazardStarPositive` | def_prop | `p15-full-price` | The probability is positive on this compact cube because the empty set is admitted and every p_i(t)<1. | the statement (statement only). | `P15Elementary.hazardStarPositive` | +| `CoordinatewiseConcavity` | def_prop | `p15-full-price` | Only SEPARATE coordinatewise concavity is asserted; joint concavity is not needed or claimed. | the statement (statement only); joint concavity; the derivative formulas (F4)-(F5) themselves (not specified; concavity is their consequence). | — | +| `HazardProductBound` | def_prop | `p15-full-price` | F_A(t) >= (product_i t_i) H_A. (F6) | the inequality (statement only). | — | +| `HazardPhiBound` | def_prop | `p15-full-price` | -log mu_p(A) >= H_A product_i phi(p_i). (F7) | the inequality (statement only). | — | +| `FullGroundPriceBound` | def_prop | `p15-full-price` | product_i c_i <= min(1, [-log mu_p(A)]/H_A). (F8) | the inequality (statement only); that the full-ground generator covers any obstruction ("It does not assert that this generator alone covers an arbitrary obstruction"). | — | +| `PhiAtPStar` | def_prop | `p15-full-price` | at every p_i=p_star and every c_i=1, the two sides of (F7) are equal | the identity (statement only). | `P15Elementary.phiAtPStar` | +| `FullGroundBudgetIff` | def_prop | `p15-full-price` | a full-ground generator universally meets the capped hazard budget precisely when H_A>=1 | the equivalence (statement only); coverage of arbitrary `A` ("it does not infer coverage of arbitrary A"). | — | +| `CapacityHazardIsBinomial` | def_prop | `p15-full-price` | H_(n,a)=-log P(Bin(n,p_star)<=a). (F9) | the identity (statement only; a finite identity for each `n`, general in `n`). | `P15Elementary.capacityHazardIsBinomial` | +| `OddMajorityIdentity` | def_prop | `p15-full-price` | =p(1-2p)P(S=a)<0. (F10) | the identities (statement only; polynomial identities in `p`, a future kernel target for each fixed `a` and by induction in general). | `P15Elementary.oddMajorityIdentity` | +| `CapacityWorstCase` | def_prop | `p15-full-price` | =3-log(3e-2)=h_star>1. (F11) | the statements (statement only); the source stresses "it is not a finite-grid extrapolation". | `P15Elementary.capacityWorstCase` | +| `HStarExceedsOne` | def_prop | `p15-full-price` | e^2-(3e-2)=(e-1)(e-2)>0, | the statements (statement only). | `P15Elementary.hStarExceedsOne` | +| `LocalPriceBoundFull` | def_prop | `p15-full-price` | price({X_i}) <= rho_star [-log mu_p(D_i)], (F12) | the bound (statement only); `price <= q_i` ("The inequality price<=q_i is NOT required and is in general stronger than what is proved here"). | — | +| `GlobalAssemblyHazard` | def_prop | `p15-full-price` | sum_i [-log mu_p(D_i)] <= -log mu_p(D). (F13) | the inequalities (statement only; "without independence of crossing failures"). | `P15Hazard.globalAssemblyHazard` | +| `SharpnessOfRhoStar` | def_prop | `p15-full-price` | Replacing rho_star by any smaller constant in (F2) would make its right side strictly less than one. | the statements (statement only; the finite parts are decidable in principle); a necessity claim for multi-block families with some demand one (the source: "other constraints may change its budget"). | `P15Elementary.sharpnessOfRhoStar` | +| `DemandOneBoundary` | def_prop | `p15-full-price` | mu_p(D)=1-p_star^(a+1)>1-p_star=exp(-1), | the statements (statement only); any retraction of original P15-B ("whose local-budget premise is missing in that case"). | `P15Elementary.demandOneBoundary` | +| `SixSeventhsCertificate` | def_prop | `p15-full-price` | Therefore 3e-2<197/327/6 and rho_star<6/7. | the statements (statement only); the two exact rational identities are exact arithmetic not re-proved here; the series and geometric-tail bounds behind `e < 31967/11760` are not specified. | `P15Elementary.sixSeventhsCertificate` | ## Claims and what is not established -171 claim rows: 10 `landing_claim`, 33 `graph_node`, 2 `open_obligation`, 95 `proof_index_result`, 7 `existing_lean_package`, 12 `main_experiment_proof`, 12 `exact_certificate`. Claim-level formal progress: 33 `specified` (a `def … : Prop` stating the claim itself is registered), 138 `none`; no research claim is `proved` or `kernel-checked`. 197 statement entries point at the 150 declarations of this package (all `specified`); 31 statement entries are kernel-proved arithmetic theorems of main's `formal/` package (label `proved`: the 31 Side24 targets at origin/main `f6deeba7`; main's 28 P15 arithmetic targets are NOT listed because they exist only in this programme's uncommitted main worktree, on no commit), listed as the arithmetic skeleton of the claim they sit under and never as the claim. `disposition` is the verbatim LANDING_CLAIMS value or `—` (null). Nothing in these tables is a scientific status, a review verdict or an acceptance; alignment of every statement is `PENDING_INDEPENDENT_REVIEW`. +171 claim rows: 10 `landing_claim`, 33 `graph_node`, 2 `open_obligation`, 95 `proof_index_result`, 7 `existing_lean_package`, 12 `main_experiment_proof`, 12 `exact_certificate`. Claim-level formal progress: 33 `specified` (a `def … : Prop` stating the claim itself is registered), 138 `none`; no research claim is `proved` or `kernel-checked`. 197 statement entries point at the 150 declarations of this package (all `specified`). 132 statement entries carry the label `proved` and are theorems of other packages, listed as the arithmetic skeleton or the Prop-level proof of the claim they sit under and never as the claim: 31 are the 31 Side24 arithmetic targets of main's `formal/` at origin/main `f6deeba7`; 41 are the 28 P15 arithmetic targets of main's `formal/` at `91cffbb5` (main PR #358, not yet on main; kernel evidence the hosted workspace-landing run 38096827443), each listed on every P15 row whose layer 0 source it anchors to; 60 are theorems of the proof packet `specifications/lean_statement_proofs_20261011` whose type is exactly a registered Prop of this package (52 theorems, 51 distinct Props, each listed on every row that registers its Prop; the hosted `lean-specification-proofs.yml` run 38121713840 receipted all of them as kernel-checked and run 38116277597 the first 38; a pull_request run checks out the synthetic merge of the PR head into the base, which the receipt records as checked_commit: run 38121713840 PR head 910809d6, actual tested merge 5b198699308e0585904c21d12bf540cf2475d2f0 with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2; run 38116277597 PR head 00d2ac6e, actual tested merge c4c66bb8cb26f0cd9bc03d52bb25f1b3925b272c with the same base; run 38122386459 corroborates on PR head d9b8dd33, actual tested merge 866136cca66b46e6dbd3186b47c9340f7e93b4f6; same trees as the heads). Exactly one Prop registered as stating a claim itself has such a theorem: `DemandOneRefutation` on rows `p15-price-boundary` and `math.p15-price-boundary`; their claim-level label stays `specified` (the register admits only none/specified at claim level, alignment of the Prop with the source paragraph is PENDING_INDEPENDENT_REVIEW, and a receipt is about the Prop only), as the rows' `not established` cells record. `disposition` is the verbatim LANDING_CLAIMS value or `—` (null). Nothing in these tables is a scientific status, a review verdict or an acceptance; alignment of every statement is `PENDING_INDEPENDENT_REVIEW`. | claim_id | kind | disposition | formal_progress | statements | not established | next step | |---|---|---|---|---|---|---| -| `side24-coefficient` | landing_claim | REVIEWED_SCOPED | `specified` | 28 specified: `ThetaSummable`, `IsUnitTuple`, `DerivativePairingBound`, `DerivativeBoundAtLeastOne`, `DerivativeBoundAtZero`, `LatticeImageSumBound`, `SuccessiveTermRatio`, `ExponentialBounds`, `ImageBound`, `CovarianceOrdering`, `EntrywiseCovarianceBound`, `ReferenceCovarianceLowerBound`, `ReferenceOddAndPinBlocks`, `DensityComparison`, `IntegrandRatioBounds`, `ReferencePinDensityProduct`, `ReferenceCoefficientIdentity`, `ConeMomentInterface`, `NegDefCone`, `ConeMomentD1Identity`, `ConeMomentD2Identity`, `ConeMomentD2Algebra`, `TraceMoments`, `RayleighSquareLaw`, `ElementaryConeIntegral`, `PeriodicCoefficientInterface`, `CoefficientEnclosure`, `ReferenceComparison`; 27 proved (main): `pairing_sum_six`, `pairing_sum_le_six`, `pairing_terms_six`, `sixth_moment_double_factorial`, `lattice_shell_constant`, `geometric_ratio_constants`, `period_exponent`, `image_constant_value`, `exp_taylor_partial_sum_gt_ten`, `covariance_relative_bound`, `odd_block_eigenvalues`, `odd_block_shifted_minors`, `smaller_eigenvalue_exceeds_third`, `exponent_bounds`, `exponent_values`, `ratio_constant_ordering`, `density_comparison_below_reported`, `conditional_third_derivative_variance`, `transverse_covariance_entries_thirds`, `cone_moment_m1_thirds`, `trace_and_traceless_variances`, `fourth_moment_of_trace`, `exponential_moment_of_trace`, `cone_moment_m2_algebra`, `cube_root_simplification`, `pin_determinant_and_joint_dimension`, `hessian_block_eigenvalues` | Nothing here encloses the coefficient. CoefficientEnclosure and ReferenceComparison are statements for any object satisfying PeriodicCoefficientInterface; the interface takes the cone moment D_u of (15.1) as a GIVEN field, so c_{d,24} is not uniquely determined in Lean and no inhabitant is constructed. The 27 main theorems listed as `proved` are the integer/rational arithmetic skeleton of PROOF.md sections 1-4 (coefficient sums, shell constants, Taylor partial sum, block minors, cone-moment algebra), not the Gaussian conditioning, the Rayleigh cone integration, the Stirling log-gamma step (section 5, not specified), the interval arithmetic of coefficient.py, or the enclosure itself. The persistence interpretation through the parent Theorem C (eq. 15.2) is conditional on the parent and untouched. Disposition REVIEWED_SCOPED is transcribed, not re-derived. Nonauthor review and acceptance are not claimed by any statement; alignment of every statement with its anchor is PENDING_INDEPENDENT_REVIEW; organizational-independence credit of this packet is 0. The interface does not determine c_{d,24}: CoefficientEnclosure and ReferenceComparison are predicates on the interface object, not closed statements; their universal closure over all inhabitants is false whenever the interface is inhabited (scaling the given cone moment by a positive constant scales c24 through eq_15_2 and gives another inhabitant), and `specified` refers to the statement shape at the source's object, which is not constructed. | Formal lane (Math- Mathlib package, by the lane's admission rules): construct the conditional law A_u \| V_u = 0 and prove ConeMomentD1Identity / ConeMomentD2Identity for the reference law under ConeMomentInterface; then prove ReferenceCoefficientIdentity; the enclosure needs a proof-producing interval pipeline for Gamma(7/6), pi, exp and the theta sums (the numerical formalizer work offer of main docs/FORMAL_VERIFICATION.md). Independent reviewer: alignment verdicts on the 28 Side24 statements. | +| `side24-coefficient` | landing_claim | REVIEWED_SCOPED | `specified` | 28 specified: `ThetaSummable`, `IsUnitTuple`, `DerivativePairingBound`, `DerivativeBoundAtLeastOne`, `DerivativeBoundAtZero`, `LatticeImageSumBound`, `SuccessiveTermRatio`, `ExponentialBounds`, `ImageBound`, `CovarianceOrdering`, `EntrywiseCovarianceBound`, `ReferenceCovarianceLowerBound`, `ReferenceOddAndPinBlocks`, `DensityComparison`, `IntegrandRatioBounds`, `ReferencePinDensityProduct`, `ReferenceCoefficientIdentity`, `ConeMomentInterface`, `NegDefCone`, `ConeMomentD1Identity`, `ConeMomentD2Identity`, `ConeMomentD2Algebra`, `TraceMoments`, `RayleighSquareLaw`, `ElementaryConeIntegral`, `PeriodicCoefficientInterface`, `CoefficientEnclosure`, `ReferenceComparison`; 27 proved (main, origin/main f6deeba7): `pairing_sum_six`, `pairing_sum_le_six`, `pairing_terms_six`, `sixth_moment_double_factorial`, `lattice_shell_constant`, `geometric_ratio_constants`, `period_exponent`, `image_constant_value`, `exp_taylor_partial_sum_gt_ten`, `covariance_relative_bound`, `odd_block_eigenvalues`, `odd_block_shifted_minors`, `smaller_eigenvalue_exceeds_third`, `exponent_bounds`, `exponent_values`, `ratio_constant_ordering`, `density_comparison_below_reported`, `conditional_third_derivative_variance`, `transverse_covariance_entries_thirds`, `cone_moment_m1_thirds`, `trace_and_traceless_variances`, `fourth_moment_of_trace`, `exponential_moment_of_trace`, `cone_moment_m2_algebra`, `cube_root_simplification`, `pin_determinant_and_joint_dimension`, `hessian_block_eigenvalues`; 5 proved (proof packet): `Side24Elementary.exponentialBounds`, `Side24Elementary.successiveTermRatio`, `Side24Elementary.coneMomentD2Algebra`, `Side24Elementary.referenceCoefficientIdentity`, `Side24Elementary.elementaryConeIntegral` | Nothing here encloses the coefficient. CoefficientEnclosure and ReferenceComparison are statements for any object satisfying PeriodicCoefficientInterface; the interface takes the cone moment D_u of (15.1) as a GIVEN field, so c_{d,24} is not uniquely determined in Lean and no inhabitant is constructed. The 27 main theorems listed as `proved` are the integer/rational arithmetic skeleton of PROOF.md sections 1-4 (coefficient sums, shell constants, Taylor partial sum, block minors, cone-moment algebra), not the Gaussian conditioning, the Rayleigh cone integration, the Stirling log-gamma step (section 5, not specified), the interval arithmetic of coefficient.py, or the enclosure itself. ExponentialBounds, SuccessiveTermRatio, ConeMomentD2Algebra, ReferenceCoefficientIdentity and ElementaryConeIntegral have theorems of exactly their type in the proof packet specifications/lean_statement_proofs_20261011 (5 entries below, label `proved`; the hosted lean-specification-proofs.yml run 38116277597 (PR head 00d2ac6e; actual tested merge c4c66bb8cb26f0cd9bc03d52bb25f1b3925b272c with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2) kernel-checked them (receipt formalization_status kernel-checked, leanchecker PASS, `#print axioms` within {propext, Classical.choice, Quot.sound})): elementary real inequalities, the term ratio, the D2 cone-moment algebra, the reference-coefficient identity as stated (its left side is not identified with the parent formula (15.2) at the reference law: rotational invariance of K_infty is not specified) and the elementary cone integral; none of them is the Gaussian conditioning, ConeMomentD1Identity / ConeMomentD2Identity, RayleighSquareLaw, LatticeImageSumBound or any enclosure of the coefficient, and the claim-level label stays `specified`. The persistence interpretation through the parent Theorem C (eq. 15.2) is conditional on the parent and untouched. Disposition REVIEWED_SCOPED is transcribed, not re-derived. Nonauthor review and acceptance are not claimed by any statement; alignment of every statement with its anchor is PENDING_INDEPENDENT_REVIEW; organizational-independence credit of this packet is 0. The interface does not determine c_{d,24}: CoefficientEnclosure and ReferenceComparison are predicates on the interface object, not closed statements; their universal closure over all inhabitants is false whenever the interface is inhabited (scaling the given cone moment by a positive constant scales c24 through eq_15_2 and gives another inhabitant), and `specified` refers to the statement shape at the source's object, which is not constructed. | Formal lane (Math- Mathlib package, by the lane's admission rules): construct the conditional law A_u \| V_u = 0 and prove ConeMomentD1Identity / ConeMomentD2Identity for the reference law under ConeMomentInterface, RayleighSquareLaw and LatticeImageSumBound (ReferenceCoefficientIdentity is proved as stated; the identification of its left side with (15.2) at the reference law is not specified); the hosted run 38116277597 (PR head 00d2ac6e; actual tested merge c4c66bb8cb26f0cd9bc03d52bb25f1b3925b272c with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2) kernel-checked the 5 proved entries; the enclosure needs a proof-producing interval pipeline for Gamma(7/6), pi, exp and the theta sums (the numerical formalizer work offer of main docs/FORMAL_VERIFICATION.md). Independent reviewer: alignment verdicts on the 28 Side24 statements. | | `lifetime-remainder` | landing_claim | REVIEWED_SCOPED | `specified` | 4 specified: `RemainderBoundedR1`, `IsUnrestrictedPair`, `IsUnrestrictedLeadingCoefficient`, `IsLifetimeDensityVersion` | RemainderBoundedR1 states the shape of (R1) for versions of the densities under the interface structures; the result is not proved. Not stated: (R19)-(R20), the observation transform and determinant lemmas R3.1/R3.2, the cap-loss bound, the parent interfaces D1-A-E it imports, the marked-cylinder-cap support. The coefficient c enters only through IsUnrestrictedLeadingCoefficient (c > 0 and the leading-term role), not through the representation (15.2). No numerical C or ell_*, no second coefficient, no convergence of the remainder, no compact-window O(ell^(2/3)) difference without cutoffs. The identification of the interface structures (GaussianFieldInterface, SuperlevelBarInterface, PairLawInterface) with the source's field, elder rule and weighted regression law is not established: the Props hold for every object satisfying the interface, and no inhabitant is constructed. Disposition REVIEWED_SCOPED is transcribed, not re-derived. Nonauthor review and acceptance are not claimed by any statement; alignment of every statement with its anchor is PENDING_INDEPENDENT_REVIEW; organizational-independence credit of this packet is 0. | State (R19) (cumulative form) as a further Prop; transcribe the parent interfaces consumed (section 8 comparison, section 9 as replaced by v1.1, section 10, (14.1), (15.2)) as explicit hypotheses; independent reviewer: alignment verdict on RemainderBoundedR1 against (R1), including the "versions" clause and the exclusion of the essential global maximum. | -| `rn-count-interface` | landing_claim | HOLD_WITH_DOMAIN | `none` | 5 specified: `HolderCountBoundN1`, `HolderConsequenceN2`, `ConditionalMeanIdentityN3`, `UniformCounterexampleN4`, `ExponentialTailLayerCakeN5` | No Prop states Theorem N as a whole: (N1)-(N5) (Hoelder bound, its power-law consequence, the conditional-mean identity, the uniform counterexample, the exponential-tail layer cake) are stated as abstract probability-space Props; (N6) (the full-pin weighted Kac-Rice expression for E_Q^W N_B) and (N7) (the enclosure-to-rate implication under Z_r >= z_* r^2) are NOT stated, and they are the Gaussian numerator interface that the disposition reason calls "a target rather than a discharged global RN theorem". Nothing about the Gaussian model is stated or proved; no RN rate, no 24-jet enclosure, no ENV-RESCOV discharge. Disposition HOLD_WITH_DOMAIN is transcribed, not re-derived. Nonauthor review and acceptance are not claimed by any statement; alignment of every statement with its anchor is PENDING_INDEPENDENT_REVIEW; organizational-independence credit of this packet is 0. | State (N7) as an implication with the Kac-Rice numerator as an interface field (the integral of (N6) as a given quantity) and Z_r >= z_* r^2 as a hypothesis; then the claim would be `specified`. (N1)-(N3), (N5) are candidates for proofs in the Math- Mathlib lane (Hoelder, layer cake). Independent reviewer: alignment of the five Props with (N1)-(N5). | +| `rn-count-interface` | landing_claim | HOLD_WITH_DOMAIN | `none` | 5 specified: `HolderCountBoundN1`, `HolderConsequenceN2`, `ConditionalMeanIdentityN3`, `UniformCounterexampleN4`, `ExponentialTailLayerCakeN5`; 5 proved (proof packet): `RNProbability.conditionalMeanIdentityN3`, `RNProbability.holderCountBoundN1`, `RNProbability.holderConsequenceN2`, `RNProbability.uniformCounterexampleN4`, `RNProbability.exponentialTailLayerCakeN5` | No Prop states Theorem N as a whole, so the claim-level label stays none: (N1)-(N5) (Hoelder bound, its power-law consequence, the conditional-mean identity, the uniform counterexample, the exponential-tail layer cake) are stated as abstract probability-space Props and each has a theorem of exactly its type in the proof packet specifications/lean_statement_proofs_20261011 (5 entries below, label `proved`; the hosted lean-specification-proofs.yml run 38116277597 (PR head 00d2ac6e; actual tested merge c4c66bb8cb26f0cd9bc03d52bb25f1b3925b272c with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2) kernel-checked them (receipt formalization_status kernel-checked, leanchecker PASS, `#print axioms` within {propext, Classical.choice, Quot.sound})); (N6) (the full-pin weighted Kac-Rice expression for E_Q^W N_B) and (N7) (the enclosure-to-rate implication under Z_r >= z_* r^2) are NOT stated, and they are the Gaussian numerator interface that the disposition reason calls "a target rather than a discharged global RN theorem". The five theorems prove the Props for the abstract probability spaces and counts they quantify over: nothing about the Gaussian model is stated or proved; no RN rate, no 24-jet enclosure, no ENV-RESCOV discharge; D3-LEMMA-RN-UNIF stays not closed. Disposition HOLD_WITH_DOMAIN is transcribed, not re-derived. Nonauthor review and acceptance are not claimed by any statement or theorem; alignment of every statement with its anchor is PENDING_INDEPENDENT_REVIEW; organizational-independence credit of this packet and of the proof packet is 0. | State (N7) as an implication with the Kac-Rice numerator as an interface field (the integral of (N6) as a given quantity) and Z_r >= z_* r^2 as a hypothesis; then the claim would be `specified`. The hosted run 38116277597 (PR head 00d2ac6e; actual tested merge c4c66bb8cb26f0cd9bc03d52bb25f1b3925b272c with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2) kernel-checked the five proved entries. Independent reviewer: alignment of the five Props with (N1)-(N5). | | `rn-fixed-remote-window` | landing_claim | HOLD_WITH_DOMAIN | `specified` | 5 specified: `PinnedLawInterface`, `IsCriticalPoint`, `HessianHasInertia`, `FixedRemoteMeanMeasureA2`, `FixedRemoteCountBoundA3` | FixedRemoteMeanMeasureA2 and FixedRemoteCountBoundA3 state the shapes of displays (2) and (3) for any object satisfying PinnedLawInterface (the regression law Q_r, the weight W_r, the normalizer and the contact kernel Lambda_j are interface fields, gated on 0 < r < L); no inhabitant of the interface is constructed and the kernel is not identified with formula (13). Not stated: the observation transform U_r and target v_r, the coupling (5), the weight expansion (10)-(11), the Kac-Rice formula (12), the kernel formula (13), the unnormalized numerator bound (14), and the multi-witness Section 6 displays (15)-(16). Nothing is proved; no numerical C or r_*; no shrinking exclusion rho -> 0, no collisions, no global RN complement (the disposition reason). Disposition HOLD_WITH_DOMAIN is transcribed, not re-derived. Nonauthor review and acceptance are not claimed by any statement; alignment of every statement with its anchor is PENDING_INDEPENDENT_REVIEW; organizational-independence credit of this packet is 0. | State Section 6 ((15)-(16), separated m-tuples) as Props; record an inhabitant construction of PinnedLawInterface as a proof-lane target (Dirac mass at one admissible smooth path); independent reviewer: alignment of A2/A3 with displays (2)-(3), in particular the uniformity in b, k, R, j, E and the fixed rho. | | `rn-fixed-annulus-window` | landing_claim | REVIEWED_SCOPED | `specified` | 1 specified: `FixedAnnulusWindowCandidateA2` | FixedAnnulusWindowCandidateA2 states the shape of (A2) (d = 2, fixed L, fixed scaled annulus, compact positive gaps, between-pin height window) over PinnedLawInterface; the result is not proved. Not stated: the six-pin regression (A3)-(A5), normalizer (A8), contact vector (A10)-(A12), cutoff (A13)-(A14), density (A17), Hessian bounds (A18)-(A20), intensities (A21)-(A26), the TWO_SCALE_ADDENDUM S6-S21 support (not pinned here), the eight reviewed interfaces as separate statements. No all-height assertion, no positive leading coefficient, no probability lower bound, no uniformity as k -> 0, B0 -> infinity, in L or for d >= 3; no global D5/RN/JETMOD transfer. Disposition REVIEWED_SCOPED is transcribed, not re-derived. Nonauthor review and acceptance are not claimed by any statement; alignment of every statement with its anchor is PENDING_INDEPENDENT_REVIEW; organizational-independence credit of this packet is 0. | Pin TWO_SCALE_ADDENDUM.md and state (S3)-(S5) and (S20)-(S21); independent reviewer: alignment of FixedAnnulusWindowCandidateA2 with (A2), checking that the height window is strict and the constants depend only on L, A0, B0 and the mark compacts. | -| `p15-realized-covers` | landing_claim | HOLD_WITH_DOMAIN | `specified` | 27 specified: `RealizedData`, `IsRealizedFamily`, `IsGood`, `IsKDecomposable`, `IsGeneratorCover`, `IsPaletteFeasible`, `PaletteNumberAttained`, `IsMinimalForbidden`, `IsTransversal`, `MinimalForbiddenCharacterisation`, `LocalRestriction`, `LocalDecomposability`, `LocalObstructionIsFullBlock`, `LocalPriceChain`, `IndependentBlockHazard`, `FullBlockCoverIff`, `CoverCostHazardBound`, `WholeGroundChromaticNumber`, `ElementaryPaletteFormula`, `TriangleNeedsThree`, `Benchmark816IsRealized`, `Benchmark816Palette`, `Benchmark816Cover`, `Benchmark816WholeGround`, `Benchmark816MinimalForbiddenCounts`, `Benchmark816Price`, `Benchmark816UnionBound` | MinimalForbiddenCharacterisation (Proposition P1), FullBlockCoverIff (Theorem P2, (P7)) and CoverCostHazardBound ((P8)) state the results for every realized family; none is proved here. No `proved` statement is listed: main's 12 P15 arithmetic theorems for this claim (finite arithmetic of Section 6: 409, 2454, 15, 500616, 419743994415, 816, 815*3 < 2448, 818, 409p = 1/100, the (P11) rational bound, positivity of 6/40900^409, and the elementary instances of (P9)) exist only in this programme's uncommitted main worktree, on no commit, and are not listed until a commit and a hosted formal-verification.yml run exist; even then they would not count the minimal forbidders, show the palette is 816 or evaluate 6/40900^409. The benchmark Props Benchmark816Cover/WholeGround/MinimalForbiddenCounts/Price/UnionBound quantify over 2^2454 subsets and are not decidable in practice; PaletteNumberAttained (nonemptiness of the feasible palette set) is stated, not proved. Nothing is asserted for prices p_v < c_v <= phi(p_v), for arbitrary P15 inputs or for the prize (original_prize_closed stays false). Disposition HOLD_WITH_DOMAIN is transcribed, not re-derived. Nonauthor review and acceptance are not claimed by any statement; alignment of every statement with its anchor is PENDING_INDEPENDENT_REVIEW; organizational-independence credit of this packet is 0. | Proof lane: TriangleNeedsThree, Benchmark816IsRealized, LocalRestriction and LocalDecomposability are finite or elementary and are the first kernel targets; PaletteNumberAttained via the disjoint-palette witness. Independent reviewer: alignment of MinimalForbiddenCharacterisation with Proposition P1 (completeness clause) and of FullBlockCoverIff with (P7). main: commit and push the P15 modules (hosted formal-verification.yml green), then list the P15 arithmetic theorems here as `proved` statements citing the 40-hex commit and the workflow run; until then no P15 theorem is listed. | -| `p15-price-boundary` | landing_claim | EXACT_COUNTEREXAMPLE | `specified` | 3 specified: `TwoCoordGeneratorPrices`, `DemandOneRefutation`, `LogOnePlusBelowIdentity` | DemandOneRefutation states the refutation (the two-coordinate data form a realized family with K_H(d) = 1, obstruction {X}, admissible prices 2/3, mu_p(D) = 3/4, cover cost 4/9 > 1/3 > log(4/3)); it is not proved. No `proved` statement is listed: main's 6 P15 arithmetic theorems for this claim (the finite arithmetic: good sets, obstruction, 3/4 over denominator 4, prices 9,6,6,4 over 9, 3*4 > 9) exist only in this programme's uncommitted main worktree, on no commit, and are not listed until a commit and a hosted formal-verification.yml run exist; the two logarithm inequalities phi(1/2) = log 2 > 2/3 and log(4/3) < 1/3 are analysis and are not proved anywhere; log(1+x) < x (LogOnePlusBelowIdentity) is stated only. The counterexample does not refute d_i >= 2 successors or original P15-B (the disposition reason). Disposition EXACT_COUNTEREXAMPLE is transcribed, not re-derived. Nonauthor review and acceptance are not claimed by any statement; alignment of every statement with its anchor is PENDING_INDEPENDENT_REVIEW; organizational-independence credit of this packet is 0. | Math- Mathlib lane: prove the two logarithm inequalities (Real.log bounds) and the finite conjuncts of DemandOneRefutation; this is the smallest complete research statement in the packet that could move from `specified` to `proved`. Independent reviewer: alignment of DemandOneRefutation with the source paragraph. main: commit and push the P15 modules (hosted formal-verification.yml green), then list the P15 arithmetic theorems here as `proved` statements citing the 40-hex commit and the workflow run; until then no P15 theorem is listed. | -| `p15-price-budget-restricted` | landing_claim | HOLD_WITH_DOMAIN | `specified` | 8 specified: `LogRatioBound`, `RatioExponentBound`, `RestrictedLocalBudget`, `RestrictedTransformedPriceBudget`, `RhoTestSufficient`, `CapTestAtTwoThirds`, `Benchmark816TransformedRange`, `Benchmark816RationalPrice` | RestrictedTransformedPriceBudget states (T1) for every realized family with a_i >= 1, d_i >= 2, p_v <= 1/4, c_v <= phi(p_v); not proved. (T2), the exponent arithmetic of (T3), (T4), the per-block sufficient test (T5), the cap test and the Section 4 benchmark statements are stated only; the intermediate ratio steps of (T3), the integral representation behind (T2) and the admissibility integral are not specified. No `proved` statement is listed: main's 3 P15 arithmetic theorems for this claim (the a = 1, n = 3 instance 16/27, finite instances of the (T3) bound and the rational identity 81801/3345620000) exist only in this programme's uncommitted main worktree, on no commit, and are not listed until a commit and a hosted formal-verification.yml run exist; they are not (T1) in any case. The dependency on claim p15-realized-covers is not discharged here. Disposition HOLD_WITH_DOMAIN ("independent theorem review not yet source-bound in manifest") is transcribed, not re-derived. Nonauthor review and acceptance are not claimed by any statement; alignment of every statement with its anchor is PENDING_INDEPENDENT_REVIEW; organizational-independence credit of this packet is 0. | Math- Mathlib lane: LogRatioBound (-log(1-p) <= p/(1-p)) and RatioExponentBound are provable from Mathlib Real.log facts and are the first targets; independent reviewer: alignment of RestrictedTransformedPriceBudget with (T1) including the per-coordinate price hypothesis and the K >= K_H(d) palette. main: commit and push the P15 modules (hosted formal-verification.yml green), then list the P15 arithmetic theorems here as `proved` statements citing the 40-hex commit and the workflow run; until then no P15 theorem is listed. | -| `p15-full-price` | landing_claim | REVIEWED_SCOPED | `specified` | 20 specified: `FullTransformedPriceBudget`, `RhoStarEnclosure`, `RhoStarBelowSixSevenths`, `IsProperDownset`, `HazardStarPositive`, `CoordinatewiseConcavity`, `HazardProductBound`, `HazardPhiBound`, `FullGroundPriceBound`, `PhiAtPStar`, `FullGroundBudgetIff`, `CapacityHazardIsBinomial`, `OddMajorityIdentity`, `CapacityWorstCase`, `HStarExceedsOne`, `LocalPriceBoundFull`, `GlobalAssemblyHazard`, `SharpnessOfRhoStar`, `DemandOneBoundary`, `SixSeventhsCertificate` | FullTransformedPriceBudget states (F2), RhoStarEnclosure states (F3), SharpnessOfRhoStar states the attainment clause; none is proved. The hazard interpolation lemma is stated as separate coordinatewise concavity (CoordinatewiseConcavity) and its consequences (F6)-(F8); the derivative formulas (F4)-(F5) are not specified. No `proved` statement is listed: main's 7 P15 arithmetic theorems for this claim (finite arithmetic of the Section 6 certificate chain: adjacent 20-digit endpoints as Nat, 16/27 < 6/7, n >= 2a+1 instances, the rational orderings and the degree-5 Taylor partial sum) exist only in this programme's uncommitted main worktree, on no commit, and are not listed until a commit and a hosted formal-verification.yml run exist; they would not place rho_star = 1/(3 - log(3e - 2)) between the endpoints, prove e < 87/32 or 197/32 < exp(11/6), or be Theorem F. The full_price.py Fraction procedure is not a kernel proof and is not specified. No arbitrary-downset or unrestricted P15 prize statement (original_prize_closed stays false). Disposition REVIEWED_SCOPED is transcribed, not re-derived. Nonauthor review and acceptance are not claimed by any statement; alignment of every statement with its anchor is PENDING_INDEPENDENT_REVIEW; organizational-independence credit of this packet is 0. | Math- Mathlib lane: RhoStarBelowSixSevenths / SixSeventhsCertificate (Real.exp and Real.log bounds e < 31967/11760 < 87/32, 197/32 < exp(11/6)) are the next full-theorem target named in main docs/FORMAL_VERIFICATION_ROLLOUT_20260927.md; then HStarExceedsOne and PhiAtPStar. Independent reviewer: alignment of FullTransformedPriceBudget with (F2), in particular the quantification over ALL p in [0,1]^X and the SAME palette K >= K_H(d). main: commit and push the P15 modules (hosted formal-verification.yml green), then list the P15 arithmetic theorems here as `proved` statements citing the 40-hex commit and the workflow run; until then no P15 theorem is listed. | +| `p15-realized-covers` | landing_claim | HOLD_WITH_DOMAIN | `specified` | 27 specified: `RealizedData`, `IsRealizedFamily`, `IsGood`, `IsKDecomposable`, `IsGeneratorCover`, `IsPaletteFeasible`, `PaletteNumberAttained`, `IsMinimalForbidden`, `IsTransversal`, `MinimalForbiddenCharacterisation`, `LocalRestriction`, `LocalDecomposability`, `LocalObstructionIsFullBlock`, `LocalPriceChain`, `IndependentBlockHazard`, `FullBlockCoverIff`, `CoverCostHazardBound`, `WholeGroundChromaticNumber`, `ElementaryPaletteFormula`, `TriangleNeedsThree`, `Benchmark816IsRealized`, `Benchmark816Palette`, `Benchmark816Cover`, `Benchmark816WholeGround`, `Benchmark816MinimalForbiddenCounts`, `Benchmark816Price`, `Benchmark816UnionBound`; 12 proved (main 91cffbb5, PR #358, not on main): `benchmark_block_and_ground_sizes`, `four_block_supports_fifteen`, `minimal_forbidder_counts`, `palette_816_from_two_label_classes`, `palette_815_fails_by_counting`, `whole_ground_chromatic_818`, `elementary_palette_formula_instances`, `macro_triangle_three_colors`, `ceil_block_over_capacity_instances`, `block_occupancy_one_percent`, `low_failure_union_bound_arithmetic`, `cover_price_numerator_and_denominator_positive`; 20 proved (proof packet): `P15Elementary.triangleNeedsThree`, `P15Structure.benchmark816IsRealized`, `P15Structure.benchmark816Price`, `P15Structure.elementaryPaletteFormula`, `P15Structure.triangleNeedsThree`, `P15Structure.benchmark816Palette`, `P15Structure.localDecomposability`, `P15Structure.localObstructionIsFullBlock`, `P15Structure.fullBlockCoverIff`, `P15Structure.wholeGroundChromaticNumber`, `P15Structure.benchmark816WholeGround`, `P15Structure.minimalForbiddenCharacterisation`, `P15Structure.benchmark816MinimalForbiddenCounts`, `P15Hazard.localPriceChain`, `P15Hazard.independentBlockHazard`, `P15Covers.benchmark816Cover`, `P15Covers.localRestriction`, `P15Covers.paletteNumberAttained`, `P15Covers.benchmark816UnionBound`, `P15Budget.coverCostHazardBound` | Props of this row with a theorem of exactly their type in the proof packet specifications/lean_statement_proofs_20261011: PaletteNumberAttained, MinimalForbiddenCharacterisation, LocalRestriction, LocalDecomposability, LocalObstructionIsFullBlock, LocalPriceChain, IndependentBlockHazard, FullBlockCoverIff, CoverCostHazardBound, WholeGroundChromaticNumber, ElementaryPaletteFormula, TriangleNeedsThree, Benchmark816IsRealized, Benchmark816Palette, Benchmark816Cover, Benchmark816WholeGround, Benchmark816MinimalForbiddenCounts, Benchmark816Price, Benchmark816UnionBound (20 entries below, label `proved`; 13 of them (P15Structure.minimalForbiddenCharacterisation, P15Structure.localDecomposability, P15Structure.localObstructionIsFullBlock, P15Structure.fullBlockCoverIff, P15Structure.wholeGroundChromaticNumber, P15Structure.elementaryPaletteFormula, P15Elementary.triangleNeedsThree, P15Structure.triangleNeedsThree, P15Structure.benchmark816IsRealized, P15Structure.benchmark816Palette, P15Structure.benchmark816WholeGround, P15Structure.benchmark816MinimalForbiddenCounts, P15Structure.benchmark816Price) kernel-checked by the hosted run 38116277597 (PR head 00d2ac6e; actual tested merge c4c66bb8cb26f0cd9bc03d52bb25f1b3925b272c with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2); 7 of them (P15Covers.paletteNumberAttained, P15Covers.localRestriction, P15Hazard.localPriceChain, P15Hazard.independentBlockHazard, P15Budget.coverCostHazardBound, P15Covers.benchmark816Cover, P15Covers.benchmark816UnionBound) added after commit 00d2ac6e and kernel-checked by the hosted run 38121713840 (PR head 910809d6; actual tested merge 5b198699308e0585904c21d12bf540cf2475d2f0 with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2) (job proof-evidence: fresh build, leanchecker PASS, `#print axioms` within {propext, Classical.choice, Quot.sound}, receipt formalization_status kernel-checked, worktree CLEAN)); among them Proposition P1 (MinimalForbiddenCharacterisation), both halves of Theorem P2 (FullBlockCoverIff, display (P7), and CoverCostHazardBound, display (P8)), the local statements (P2)-(P5) and the benchmark Props including the union bound (P11). Theorem-shaped Props of this row still `specified` with no theorem: none; the parametrised predicates IsRealizedFamily, IsGood, IsKDecomposable, IsGeneratorCover, IsPaletteFeasible, IsMinimalForbidden, IsTransversal are the vocabulary of the other Props, not closed statements (a theorem of their type would assert them for every argument, which is false), and are not targets. Theorem P2 is proved as the two Props state it (for the formal RealizedData record and the formal downset, prices 0 <= c_v <= p_v), which is a statement about those Props, not acceptance of the informal theorem: the claim-level label stays `specified` (this register admits only none/specified at claim level), alignment of RealizedData / IsRealizedFamily / downset / coverCost / mu with the informal objects is PENDING_INDEPENDENT_REVIEW, and the price range p_v < c_v <= phi(p_v) is a different claim row. The 12 main P15 arithmetic theorems listed as `proved` (finite arithmetic of Section 6: 409, 2454, 15, 500616, 419743994415, 816, 815*3 < 2448, 818, 409p = 1/100, the (P11) rational bound, positivity of 6/40900^409, the elementary instances of (P9)) are at commit 91cffbb5 of main PR #358, not on main; they do not count the minimal forbidders, show the palette is 816 or evaluate 6/40900^409, and the proof-packet theorems that do (Benchmark816MinimalForbiddenCounts, Benchmark816Palette, Benchmark816Price) do so for the formal RealizedData record, whose identification with the informal six-block construction is an alignment question. Nothing is asserted for prices p_v < c_v <= phi(p_v) (row p15-price-budget-restricted), for arbitrary P15 inputs or for the prize (original_prize_closed stays false). Disposition HOLD_WITH_DOMAIN is transcribed, not re-derived. Nonauthor review and acceptance are not claimed by any statement or theorem; alignment of every statement with its anchor is PENDING_INDEPENDENT_REVIEW; organizational-independence credit of this packet and of the proof packet is 0. | Proof lane: every theorem-shaped Prop of this row has a theorem (the parametrised predicates IsRealizedFamily, IsGood, IsKDecomposable, IsGeneratorCover, IsPaletteFeasible, IsMinimalForbidden, IsTransversal are vocabulary, not targets); every theorem of this row has a hosted receipt (run 38121713840 (PR head 910809d6; actual tested merge 5b198699308e0585904c21d12bf540cf2475d2f0 with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2)). Independent reviewer: alignment of MinimalForbiddenCharacterisation with Proposition P1 (completeness clause), of FullBlockCoverIff with (P7), of CoverCostHazardBound with (P8) (the sInf cover cost, the cappedHazard endpoint convention) and of the Benchmark816 data record with the Section 6 construction. main: PR #358 merge (operator) so the 12 arithmetic theorems are on main. | +| `p15-price-boundary` | landing_claim | EXACT_COUNTEREXAMPLE | `specified` | 3 specified: `TwoCoordGeneratorPrices`, `DemandOneRefutation`, `LogOnePlusBelowIdentity`; 6 proved (main 91cffbb5, PR #358, not on main): `smallest_member_block_size`, `demand_one_good_sets`, `demand_one_obstruction`, `good_measure_three_quarters`, `generator_prices_ninths`, `minimum_generator_price_exceeds_third`; 3 proved (proof packet): `P15Elementary.twoCoordGeneratorPrices`, `P15Elementary.logOnePlusBelowIdentity`, `P15Elementary.demandOneRefutation` | DemandOneRefutation states the refutation (the two-coordinate data form a realized family with K_H(d) = 1, obstruction {X}, admissible prices 2/3, mu_p(D) = 3/4, cover cost 4/9 > 1/3 > log(4/3)). DemandOneRefutation, TwoCoordGeneratorPrices and LogOnePlusBelowIdentity each have a theorem of exactly their type in the proof packet specifications/lean_statement_proofs_20261011 (listed below as `proved`, the label of a committed proof package; the hosted lean-specification-proofs.yml run 38116277597 (PR head 00d2ac6e; actual tested merge c4c66bb8cb26f0cd9bc03d52bb25f1b3925b272c with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2) kernel-checked them (receipt formalization_status kernel-checked, leanchecker PASS, `#print axioms` within {propext, Classical.choice, Quot.sound})); the two logarithm inequalities phi(1/2) = log 2 > 2/3 and log(4/3) < 1/3 are conjuncts of DemandOneRefutation and are proved inside its theorem from Mathlib's Real.log bounds. The claim-level label stays `specified`, not `proved`: this register admits only none/specified at claim level (no research claim of this programme is proved), whether DemandOneRefutation says what the source paragraph says is the independent reviewer's alignment question (PENDING_INDEPENDENT_REVIEW), the hosted run 38116277597 (PR head 00d2ac6e; actual tested merge c4c66bb8cb26f0cd9bc03d52bb25f1b3925b272c with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2) kernel-checked the Prop and nothing more, and a kernel-checked Prop is evidence about that Prop only. This is the one row of the register where a theorem proves the Prop registered as stating the claim itself; it is recorded here for the operator and not acted on. The 6 main P15 arithmetic theorems listed as `proved` (good sets, obstruction, 3/4 over denominator 4, prices 9,6,6,4 over 9, 3*4 > 9) are at commit 91cffbb5 of main PR #358, not on main; they are finite arithmetic, not the refutation. The counterexample does not refute d_i >= 2 successors or original P15-B (the disposition reason; the theorem's docstring says the same). Disposition EXACT_COUNTEREXAMPLE is transcribed, not re-derived. Nonauthor review and acceptance are not claimed by any statement or theorem; alignment of every statement with its anchor is PENDING_INDEPENDENT_REVIEW; organizational-independence credit of this packet and of the proof packet is 0. | The hosted lean-specification-proofs.yml run 38116277597 (PR head 00d2ac6e; actual tested merge c4c66bb8cb26f0cd9bc03d52bb25f1b3925b272c with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2) produced the first receipt (`kernel-checked` appears only there); later commits need their own run. Independent (non-Anthropic) reviewer: alignment of DemandOneRefutation with the source paragraph (same two-coordinate family, prices, cover cost and the "does not contradict original P15-B" scope); any claim-level label beyond none/specified is a register-schema decision for the operator after that review, which no receipt produces. main: PR #358 merge (operator) so the 6 arithmetic theorems are on main. | +| `p15-price-budget-restricted` | landing_claim | HOLD_WITH_DOMAIN | `specified` | 8 specified: `LogRatioBound`, `RatioExponentBound`, `RestrictedLocalBudget`, `RestrictedTransformedPriceBudget`, `RhoTestSufficient`, `CapTestAtTwoThirds`, `Benchmark816TransformedRange`, `Benchmark816RationalPrice`; 3 proved (main 91cffbb5, PR #358, not on main): `t3_ratio_at_minimal_block`, `t3_bound_finite_instances`, `explicit_rational_price_above_p`; 8 proved (proof packet): `P15Elementary.logRatioBound`, `P15Elementary.capTestAtTwoThirds`, `P15Elementary.ratioExponentBound`, `P15Structure.benchmark816RationalPrice`, `P15Budget.restrictedLocalBudget`, `P15Budget.rhoTestSufficient`, `P15Budget.restrictedTransformedPriceBudget`, `P15Budget.benchmark816TransformedRange` | RestrictedTransformedPriceBudget states (T1) for every realized family with a_i >= 1, d_i >= 2, p_v <= 1/4, c_v <= phi(p_v) and is proved as stated in the proof packet; that is evidence about the Prop (for the formal RealizedData record, downset, coverCost and mu), not acceptance of the informal theorem: the claim-level label stays `specified` (claim-level vocabulary none/specified; alignment PENDING_INDEPENDENT_REVIEW). Props of this row with a theorem of exactly their type in the proof packet specifications/lean_statement_proofs_20261011: LogRatioBound, RatioExponentBound, RestrictedLocalBudget, RestrictedTransformedPriceBudget, RhoTestSufficient, CapTestAtTwoThirds, Benchmark816TransformedRange, Benchmark816RationalPrice (8 entries below, label `proved`; 4 of them (P15Elementary.logRatioBound, P15Elementary.ratioExponentBound, P15Elementary.capTestAtTwoThirds, P15Structure.benchmark816RationalPrice) kernel-checked by the hosted run 38116277597 (PR head 00d2ac6e; actual tested merge c4c66bb8cb26f0cd9bc03d52bb25f1b3925b272c with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2); 4 of them (P15Budget.restrictedLocalBudget, P15Budget.restrictedTransformedPriceBudget, P15Budget.rhoTestSufficient, P15Budget.benchmark816TransformedRange) added after commit 00d2ac6e and kernel-checked by the hosted run 38121713840 (PR head 910809d6; actual tested merge 5b198699308e0585904c21d12bf540cf2475d2f0 with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2) (job proof-evidence: fresh build, leanchecker PASS, `#print axioms` within {propext, Classical.choice, Quot.sound}, receipt formalization_status kernel-checked, worktree CLEAN)). Theorem-shaped Props of this row still `specified` with no theorem: none. The intermediate ratio steps of (T3) are proved inside the theorems that use them; the integral representation behind (T2), the admissibility integral and the Section 5 checker program are not specified. The 3 main P15 arithmetic theorems listed as `proved` (the a = 1, n = 3 instance 16/27, finite instances of the (T3) bound and the rational identity 81801/3345620000) are at commit 91cffbb5 of main PR #358, not on main; they are not (T1). The dependency on claim p15-realized-covers is discharged only to the extent that row records. Disposition HOLD_WITH_DOMAIN ("independent theorem review not yet source-bound in manifest") is transcribed, not re-derived. Nonauthor review and acceptance are not claimed by any statement or theorem; alignment of every statement with its anchor is PENDING_INDEPENDENT_REVIEW; organizational-independence credit of this packet and of the proof packet is 0. | Math- Mathlib lane: every theorem-shaped Prop of this row has a theorem; every theorem of this row has a hosted receipt (run 38121713840 (PR head 910809d6; actual tested merge 5b198699308e0585904c21d12bf540cf2475d2f0 with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2)). Independent reviewer: alignment of RestrictedTransformedPriceBudget with (T1) including the per-coordinate price hypothesis, the K >= K_H(d) palette and the cappedHazard endpoint convention. main: PR #358 merge (operator) so the 3 arithmetic theorems are on main. | +| `p15-full-price` | landing_claim | REVIEWED_SCOPED | `specified` | 20 specified: `FullTransformedPriceBudget`, `RhoStarEnclosure`, `RhoStarBelowSixSevenths`, `IsProperDownset`, `HazardStarPositive`, `CoordinatewiseConcavity`, `HazardProductBound`, `HazardPhiBound`, `FullGroundPriceBound`, `PhiAtPStar`, `FullGroundBudgetIff`, `CapacityHazardIsBinomial`, `OddMajorityIdentity`, `CapacityWorstCase`, `HStarExceedsOne`, `LocalPriceBoundFull`, `GlobalAssemblyHazard`, `SharpnessOfRhoStar`, `DemandOneBoundary`, `SixSeventhsCertificate`; 7 proved (main 91cffbb5, PR #358, not on main): `rho_star_endpoints_adjacent`, `rho_star_upper_endpoint_below_six_sevenths`, `sixteen_twentysevenths_below_six_sevenths`, `minimal_block_size_instances`, `e_rational_bounds_ordering`, `exp_eleven_sixths_taylor_certificate`, `h_star_rational_certificate_constants`; 11 proved (proof packet): `P15Elementary.rhoStarBelowSixSevenths`, `P15Elementary.sixSeventhsCertificate`, `P15Elementary.hStarExceedsOne`, `P15Elementary.phiAtPStar`, `P15Elementary.hazardStarPositive`, `P15Elementary.oddMajorityIdentity`, `P15Elementary.capacityWorstCase`, `P15Elementary.demandOneBoundary`, `P15Elementary.capacityHazardIsBinomial`, `P15Elementary.sharpnessOfRhoStar`, `P15Hazard.globalAssemblyHazard` | FullTransformedPriceBudget states (F2), not proved; RhoStarEnclosure states (F3), not proved; SharpnessOfRhoStar states the attainment clause and is proved as stated. The claim-level label stays `specified` (claim-level vocabulary none/specified; a theorem of a Prop is evidence about that Prop, for the formal objects, not acceptance of Theorem F; alignment PENDING_INDEPENDENT_REVIEW). Props of this row with a theorem of exactly their type in the proof packet specifications/lean_statement_proofs_20261011: RhoStarBelowSixSevenths, HazardStarPositive, PhiAtPStar, CapacityHazardIsBinomial, OddMajorityIdentity, CapacityWorstCase, HStarExceedsOne, GlobalAssemblyHazard, SharpnessOfRhoStar, DemandOneBoundary, SixSeventhsCertificate (11 entries below, label `proved`; 8 of them (P15Elementary.rhoStarBelowSixSevenths, P15Elementary.hazardStarPositive, P15Elementary.phiAtPStar, P15Elementary.oddMajorityIdentity, P15Elementary.capacityWorstCase, P15Elementary.hStarExceedsOne, P15Elementary.demandOneBoundary, P15Elementary.sixSeventhsCertificate) kernel-checked by the hosted run 38116277597 (PR head 00d2ac6e; actual tested merge c4c66bb8cb26f0cd9bc03d52bb25f1b3925b272c with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2); 3 of them (P15Elementary.capacityHazardIsBinomial, P15Hazard.globalAssemblyHazard, P15Elementary.sharpnessOfRhoStar) added after commit 00d2ac6e and kernel-checked by the hosted run 38121713840 (PR head 910809d6; actual tested merge 5b198699308e0585904c21d12bf540cf2475d2f0 with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2) (job proof-evidence: fresh build, leanchecker PASS, `#print axioms` within {propext, Classical.choice, Quot.sound}, receipt formalization_status kernel-checked, worktree CLEAN)). Theorem-shaped Props of this row still `specified` with no theorem: FullTransformedPriceBudget, RhoStarEnclosure, CoordinatewiseConcavity, HazardProductBound, HazardPhiBound, FullGroundPriceBound, FullGroundBudgetIff, LocalPriceBoundFull; the parametrised predicates IsProperDownset are the vocabulary of the other Props, not closed statements (a theorem of their type would assert them for every argument, which is false), and are not targets. The derivative formulas (F4)-(F5) are not specified. SixSeventhsCertificate uses Mathlib's decimal bound on e in place of the source's series argument. The 7 main P15 arithmetic theorems listed as `proved` (finite arithmetic of the Section 6 certificate chain: adjacent 20-digit endpoints as Nat, 16/27 < 6/7, n >= 2a+1 instances, the rational orderings and the degree-5 Taylor partial sum) are at commit 91cffbb5 of main PR #358, not on main; they do not place rho_star = 1/(3 - log(3e - 2)) between the endpoints (nothing does: RhoStarEnclosure is specified only), do not prove e < 87/32 or 197/32 < exp(11/6) as real-number facts (the SixSeventhsCertificate theorem does, as that Prop states them), and are not Theorem F. The full_price.py Fraction procedure is not a kernel proof and is not specified. No arbitrary-downset or unrestricted P15 prize statement (original_prize_closed stays false). Disposition REVIEWED_SCOPED is transcribed, not re-derived. Nonauthor review and acceptance are not claimed by any statement or theorem; alignment of every statement with its anchor is PENDING_INDEPENDENT_REVIEW; organizational-independence credit of this packet and of the proof packet is 0. | Math- Mathlib lane: FullTransformedPriceBudget, RhoStarEnclosure, CoordinatewiseConcavity, HazardProductBound, HazardPhiBound, FullGroundPriceBound, FullGroundBudgetIff, LocalPriceBoundFull remain the targets of this row (RhoStarEnclosure ((F3), 20 digits) needs proof-producing exp/log enclosures; (F6)-(F8), (F12) and (F2) need the coordinatewise concavity (F4)-(F5), which is not specified); every theorem of this row has a hosted receipt (run 38121713840 (PR head 910809d6; actual tested merge 5b198699308e0585904c21d12bf540cf2475d2f0 with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2)). Independent reviewer: alignment of FullTransformedPriceBudget with (F2), in particular the quantification over ALL p in [0,1]^X and the SAME palette K >= K_H(d). main: PR #358 merge (operator) so the 7 arithmetic theorems are on main. | | `downstream-hard-gate` | landing_claim | ENGINEERING_HOLD | `none` | — | An engineering control, not a mathematical claim: there is no theorem to state in Lean and none is stated. The gate's terminal classifications and non-discharge tokens are transcribed in the graph_node rows of this register only as source identity. Disposition ENGINEERING_HOLD ("repository-wide external controlling-source binding remains unresolved") is transcribed, not re-derived. | No Lean target. The control's semantics live in Math- frontiers/downstream_gate_20260925 and its workflow; the register only records that every GRAPH math.* node has a row here. | | `math.uniform-matrix-cap-lifetime` | graph_node | — | `specified` | 32 specified: `IsLPeriodic`, `IsSmooth`, `GaussianFieldInterface`, `IsCriticalPoint`, `HessianHasInertia`, `IsNondegMax`, `IsIndexSaddle`, `IsCandidatePair`, `IsMorseDistinct`, `SuperlevelBarInterface`, `IsFiniteBar`, `IsLifetimeDensityVersion`, `IsLPeriodic`, `IsSmooth`, `GaussianFieldInterface`, `IsCriticalPoint`, `HessianHasInertia`, `IsNondegMax`, `IsIndexSaddle`, `IsCandidatePair`, `IsMorseDistinct`, `SuperlevelBarInterface`, `IsFiniteBar`, `IsLifetimeDensityVersion`, `IsWindowPair`, `IsWindowElderPair`, `IsUnrestrictedPair`, `PairLawInterface`, `ParentUniformSelectionA`, `ParentCompactWindowDensityB`, `IsUnrestrictedLeadingCoefficient`, `ParentUnrestrictedLeadingDensityC` | ParentUniformSelectionA, ParentCompactWindowDensityB and ParentUnrestrictedLeadingDensityC state the shapes of (1.1), (1.2), (1.3) for every object satisfying the interfaces; nothing is proved. The identification of the interface structures (GaussianFieldInterface, SuperlevelBarInterface, PairLawInterface) with the source's field, elder rule and weighted regression law is not established: the Props hold for every object satisfying the interface, and no inhabitant is constructed. The reading rule that the GRAPH binds to this node (congruence erratum E1, Section 9 replacement v1.1, marked-cylinder cap sections 1-5, reconciliation record with W1 and the embedding radius r < L/(4 sqrt 2)) is NOT transcribed into any hypothesis; the Props are stated from the parent bytes alone. Not stated: the regression law Q_{r,b,k,R}, the typed weight W_r, the full normalizer Z_r and Q^W (p_r is a primitive interface field), the marked Kac-Rice representation (Sections 9-10, radial ledger (10.2)), the Gaussian/angular representation (15.2) of c_{d,L} and (11.3) of c_{B,K}, (12.1)-(12.3), (14.1), (5.5), Sections 2-8. No numerical r_*, C, z_*, c_{B,K}, c_{d,L}; no lower bound for d >= 3. The GRAPH classification PROVED_REVIEWED and the review disposition ACCEPT_AT_EXISTENTIAL_SCOPE are source identity, not re-derived; the five validity premises of the hardening-branch claim graph are not touched. Nonauthor review and acceptance are not claimed by any statement; alignment of every statement with its anchor is PENDING_INDEPENDENT_REVIEW; organizational-independence credit of this packet is 0. The interface does not determine p or the field: the parent-shape Props are predicates on the interface objects, not closed statements; the universal closure of ParentUniformSelectionA over all inhabitants is false whenever the interfaces are inhabited (take p identically 0), and `specified` refers to the statement shape at the source's object, which is not constructed. | Pin ERRATUM_CONGRUENCE.md, REPAIR.md (Section 9 v1.1) and the reconciliation record, and add the reading rule as explicit hypotheses or separate Props; state (15.2) as a Prop over an explicit Gaussian conditional law; independent reviewer: alignment of the three parent Props against (1.1)-(1.3) with the honesty checklist (quantifier order, existential constants outside the universal quantifiers, "versions", compact marks, all frames). | | `math.d1-component.congruence-erratum` | graph_node | — | `none` | — | No Lean statement: the erratum's source bytes are not pinned in this packet and no Prop states the corrected congruence D_r H_i D_r or det(D_r H_i D_r) = det(H_i)/r. The parent Props of this register do not transcribe section 5 at all, so the amendment has nothing to attach to yet. | Pin ERRATUM_CONGRUENCE.md (blob 213594d6, 1782 B); state the corrected congruence as a matrix identity over Matrix (Fin d) (Fin d) R (a candidate kernel-proof target: block-matrix algebra). | @@ -254,8 +258,8 @@ a theorem between string literals, an indented Prop definition, a proof written | `math.d1-component.marked-cylinder-cap` | graph_node | — | `none` | — | No Prop of this package states the deterministic cap theorem (unique transverse ridge, closed cap through S separating M from every older point, elder death partner of M is S under conditions (1)). The pinned bytes exist (sources/marked-cylinder-cap). Kernel evidence exists outside this package: Math- frontiers/cap_first_exit_lean_20261002 proves the topological global step and the analytic chain L1-L13, L16-L20 (torus_capHyp_blocks, torus_elder_death_level_blocks), but its 152 declarations are not registered here with anchors, its alignment review is NOT_CLAIMED, and it does not formalize that the field on G_r satisfies SP section 2, L14/L15, L23 or the persistence-pairing identification. The probabilistic corollary (2)-(3) and sections 6-8 are not consumed by D1 and not stated. | Register the CapFirstExit declarations here with their ALIGNMENT.md anchors against the pinned CAP bytes (statements of kind theorem, label proved, kernel_evidence cap-first-exit-lean.yml), or state the deterministic theorem as a def : Prop in Lifetime.lean so that the Math- lane's delta review has a target; independent (non-Claude) reviewer for the v1.5-v2.6 delta. | | `math.d1-component.reconciliation-record` | graph_node | — | `none` | — | A review/reading-rule record, not a mathematical statement: nothing to state in Lean beyond what its components say. The embedding-radius condition r < L/(4 sqrt 2) and the W1 wording are not transcribed into any hypothesis of the parent Props. Its ACCEPT verdicts are not re-derived; the OpenAI author-provider check it records is non-discharge by its own terms. | Add the embedding radius as an explicit hypothesis to ParentUniformSelectionA / PairLawInterface once the reading rule is pinned; no proof target. | | `math.lifetime-remainder` | graph_node | — | `specified` | 1 specified: `RemainderBoundedR1` | See row lifetime-remainder: (R1) is stated, not proved; the imports of parent interfaces D1-A-E are not transcribed; Theorem A's cubic bound (1.1) is not consumed by R and is not a hypothesis here. The GRAPH classification and review disposition are source identity only. Nonauthor review and acceptance are not claimed by any statement; alignment of every statement with its anchor is PENDING_INDEPENDENT_REVIEW; organizational-independence credit of this packet is 0. | As for row lifetime-remainder. | -| `math.side24-coefficient` | graph_node | — | `specified` | 3 specified: `PeriodicCoefficientInterface`, `CoefficientEnclosure`, `ReferenceComparison` | See row side24-coefficient: the enclosure is stated for any object satisfying PeriodicCoefficientInterface and is not proved; the "evaluates_eq_15_2" edge to the parent is represented only by the interface field that takes (15.2) as a hypothesis. No finite-radius band. The 27 arithmetic theorems of main are listed on the landing row. Nonauthor review and acceptance are not claimed by any statement; alignment of every statement with its anchor is PENDING_INDEPENDENT_REVIEW; organizational-independence credit of this packet is 0. The interface does not determine c_{d,24}: CoefficientEnclosure and ReferenceComparison are predicates on the interface object, not closed statements; their universal closure over all inhabitants is false whenever the interface is inhabited (scaling the given cone moment by a positive constant scales c24 through eq_15_2 and gives another inhabitant), and `specified` refers to the statement shape at the source's object, which is not constructed. | As for row side24-coefficient. | -| `math.rn-count-interface` | graph_node | — | `none` | 5 specified: `HolderCountBoundN1`, `HolderConsequenceN2`, `ConditionalMeanIdentityN3`, `UniformCounterexampleN4`, `ExponentialTailLayerCakeN5` | See row rn-count-interface: (N1)-(N5) stated, (N6)-(N7) not stated, so no Prop states the interface as a whole; nothing proved. Nonauthor review and acceptance are not claimed by any statement; alignment of every statement with its anchor is PENDING_INDEPENDENT_REVIEW; organizational-independence credit of this packet is 0. | As for row rn-count-interface. | +| `math.side24-coefficient` | graph_node | — | `specified` | 3 specified: `PeriodicCoefficientInterface`, `CoefficientEnclosure`, `ReferenceComparison` | See row side24-coefficient: the enclosure is stated for any object satisfying PeriodicCoefficientInterface and is not proved; the "evaluates_eq_15_2" edge to the parent is represented only by the interface field that takes (15.2) as a hypothesis. No finite-radius band. The 27 arithmetic theorems of main and the 5 proof-packet theorems (ExponentialBounds, SuccessiveTermRatio, ConeMomentD2Algebra, ReferenceCoefficientIdentity, ElementaryConeIntegral; none of them the enclosure; kernel-checked by the hosted run 38116277597 (PR head 00d2ac6e; actual tested merge c4c66bb8cb26f0cd9bc03d52bb25f1b3925b272c with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2)) are listed on the landing row. Nonauthor review and acceptance are not claimed by any statement; alignment of every statement with its anchor is PENDING_INDEPENDENT_REVIEW; organizational-independence credit of this packet is 0. The interface does not determine c_{d,24}: CoefficientEnclosure and ReferenceComparison are predicates on the interface object, not closed statements; their universal closure over all inhabitants is false whenever the interface is inhabited (scaling the given cone moment by a positive constant scales c24 through eq_15_2 and gives another inhabitant), and `specified` refers to the statement shape at the source's object, which is not constructed. | As for row side24-coefficient. | +| `math.rn-count-interface` | graph_node | — | `none` | 5 specified: `HolderCountBoundN1`, `HolderConsequenceN2`, `ConditionalMeanIdentityN3`, `UniformCounterexampleN4`, `ExponentialTailLayerCakeN5`; 5 proved (proof packet): `RNProbability.conditionalMeanIdentityN3`, `RNProbability.holderCountBoundN1`, `RNProbability.holderConsequenceN2`, `RNProbability.uniformCounterexampleN4`, `RNProbability.exponentialTailLayerCakeN5` | See row rn-count-interface: (N1)-(N5) stated and each proved as a theorem of the proof packet (5 entries below, `proved`; kernel-checked by the hosted run 38116277597 (PR head 00d2ac6e; actual tested merge c4c66bb8cb26f0cd9bc03d52bb25f1b3925b272c with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2)), (N6)-(N7) not stated, so no Prop states the interface as a whole and the node stays none; nothing about the Gaussian model is proved. Nonauthor review and acceptance are not claimed by any statement or theorem; alignment of every statement with its anchor is PENDING_INDEPENDENT_REVIEW; organizational-independence credit of this packet and of the proof packet is 0. | As for row rn-count-interface. | | `math.rn-fixed-remote-window` | graph_node | — | `specified` | 3 specified: `PinnedLawInterface`, `FixedRemoteMeanMeasureA2`, `FixedRemoteCountBoundA3` | See row rn-fixed-remote-window: displays (2)-(3) stated over PinnedLawInterface, not proved; Section 6 not stated; no inhabitant of the interface. Nonauthor review and acceptance are not claimed by any statement; alignment of every statement with its anchor is PENDING_INDEPENDENT_REVIEW; organizational-independence credit of this packet is 0. | As for row rn-fixed-remote-window. | | `math.rn-region.fixed-remote` | graph_node | — | `specified` | 2 specified: `FixedRemoteMeanMeasureA2`, `FixedRemoteCountBoundA3` | The region's mathematical content is the fixed-remote Theorem A at exactly this scope, stated by A2/A3 and not proved. The coverage classification itself (COVERED_BY_CANDIDATE, coverage_source) is graph bookkeeping and is not a Lean statement. No all-height bound on the remote region, no rho -> 0. Nonauthor review and acceptance are not claimed by any statement; alignment of every statement with its anchor is PENDING_INDEPENDENT_REVIEW; organizational-independence credit of this packet is 0. | As for row rn-fixed-remote-window; nothing region-specific to add. | | `math.rn-region.mesoscopic-scaled-annulus` | graph_node | — | `specified` | 2 specified: `D5dSummedPinNeighbourhoodC2`, `AnnulusBridgeAllHeight2` | D5dSummedPinNeighbourhoodC2 states the summed pin-neighbourhood bound (all heights, scaled ball of radius R minus the pins) and AnnulusBridgeAllHeight2 the all-height fixed-annulus bridge; neither is proved, and the "covers the reviewed fixed annulus" reading (R >= B) is not a Lean statement. No d > 2, no numerical constants, no elder selection, no JETMOD or witness-collision closure. The eight reading-rule component nodes are source identity, not transcribed. Nonauthor review and acceptance are not claimed by any statement; alignment of every statement with its anchor is PENDING_INDEPENDENT_REVIEW; organizational-independence credit of this packet is 0. | Independent reviewer: alignment of D5dSummedPinNeighbourhoodC2 with row D5-d; proof lane: none yet (the composition D5-a + D5-c at eta = 1/4 is a proof, not a statement). | @@ -263,13 +267,13 @@ a theorem between string literals, an indented Prop definition, a proof written | `math.rn-region.intermediate-r-to-rho` | graph_node | — | `specified` | 1 specified: `D5eIntermediateShellsI3I4` | D5eIntermediateShellsI3I4 states the window-only bound E N <= C r^3 (A_0^(-2) + rho^2) on {A_0 r <= \|X\| <= rho} with side conditions taken from dimension-lift (1.6); not proved. The I3/I4 source (frontiers/intermediate_window_20260928) is not pinned here; no all-height intermediate count exists or is claimed; no numerical constants. Nonauthor review and acceptance are not claimed by any statement; alignment of every statement with its anchor is PENDING_INDEPENDENT_REVIEW; organizational-independence credit of this packet is 0. | Pin intermediate_window_20260928/PROOF.md and anchor the single-shell display there; independent reviewer: alignment of D5eIntermediateShellsI3I4 with row D5-e and with dimension-lift (1.6). | | `math.rn-region.witness-collision` | open_obligation | — | `specified` | 2 specified: `WitnessCollisionNearPinPairsTarget`, `RemoteCollisionSecondFactorialD` | WitnessCollisionNearPinPairsTarget states the OPEN obligation as a target Prop, not as a result: nothing asserts that the target holds, is attainable, or follows from any reviewed source. RemoteCollisionSecondFactorialD states only the fixed-remote, fixed-eta part (Corollary D of remote_collision), which the GRAPH records as reviewed evidence and NOT as a proof of this node. The Palm route's Theorem Q (q = 2) would imply the target but is an author-side candidate stated separately (PalmRouteFactorialMomentsQ) and not consumed here; the c6_witness_collision reconciliation's proposed discharge is declarative with execution pending. The node stays OPEN_ACTIVE; this register cannot and does not change that. Nonauthor review and acceptance are not claimed by any statement; alignment of every statement with its anchor is PENDING_INDEPENDENT_REVIEW; organizational-independence credit of this packet is 0. | None for Lean beyond the target statement: the obligation needs a source-bound proof and nonauthor review in Math-; if Theorem Q is folded, re-anchor the target to the fold record. | | `math.rn-mesoscopic-reduction` | graph_node | — | `none` | — | No Lean statement: the PR7 route's bytes (frontiers/rn_mesoscopic_20260925/PROOF.md) are not pinned here and its Lemma A (positive-definite covariance of the rows of (U_0, J_0(y)) on K_AB) is not stated. The supersession is a graph classification, not mathematics. | Pin rn_mesoscopic_20260925/PROOF.md and state Lemma A (Matrix.PosDef lower bound on a compact annulus) if the route is ever revived; otherwise none. | -| `math.p15-full-price` | graph_node | — | `specified` | 3 specified: `FullTransformedPriceBudget`, `RhoStarEnclosure`, `SharpnessOfRhoStar` | See row p15-full-price: (F2), (F3) and sharpness stated, not proved; the price-boundary refutation is a scope boundary (GRAPH edge boundary_counterexample_not_required_premise), not a hypothesis. Nonauthor review and acceptance are not claimed by any statement; alignment of every statement with its anchor is PENDING_INDEPENDENT_REVIEW; organizational-independence credit of this packet is 0. | As for row p15-full-price. | -| `math.p15-price-boundary` | graph_node | — | `specified` | 2 specified: `TwoCoordGeneratorPrices`, `DemandOneRefutation` | See row p15-price-boundary: the refutation is stated, its two logarithm inequalities are not proved anywhere; REFUTED is the graph classification of the extension, transcribed as source identity. Nonauthor review and acceptance are not claimed by any statement; alignment of every statement with its anchor is PENDING_INDEPENDENT_REVIEW; organizational-independence credit of this packet is 0. | As for row p15-price-boundary. | +| `math.p15-full-price` | graph_node | — | `specified` | 3 specified: `FullTransformedPriceBudget`, `RhoStarEnclosure`, `SharpnessOfRhoStar`; 7 proved (main 91cffbb5, PR #358, not on main): `rho_star_endpoints_adjacent`, `rho_star_upper_endpoint_below_six_sevenths`, `sixteen_twentysevenths_below_six_sevenths`, `minimal_block_size_instances`, `e_rational_bounds_ordering`, `exp_eleven_sixths_taylor_certificate`, `h_star_rational_certificate_constants`; 1 proved (proof packet): `P15Elementary.sharpnessOfRhoStar` | See row p15-full-price. Of the three Props of this node, with a theorem of exactly their type in the proof packet: SharpnessOfRhoStar (1 entries below, label `proved`; 1 of them (P15Elementary.sharpnessOfRhoStar) added after commit 00d2ac6e and kernel-checked by the hosted run 38121713840 (PR head 910809d6; actual tested merge 5b198699308e0585904c21d12bf540cf2475d2f0 with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2) (job proof-evidence: fresh build, leanchecker PASS, `#print axioms` within {propext, Classical.choice, Quot.sound}, receipt formalization_status kernel-checked, worktree CLEAN)); stated, not proved: FullTransformedPriceBudget, RhoStarEnclosure. A theorem of SharpnessOfRhoStar is about the formal triple block and the formal cover cost; none of this is Theorem F, and the node-level label stays `specified`. The 7 main P15 arithmetic theorems of source p15-full-price (at commit 91cffbb5 of main PR #358, not on main) are listed here as the arithmetic skeleton, never as the node. The price-boundary refutation is a scope boundary (GRAPH edge boundary_counterexample_not_required_premise), not a hypothesis. Nonauthor review and acceptance are not claimed by any statement or theorem; alignment of every statement with its anchor is PENDING_INDEPENDENT_REVIEW; organizational-independence credit of this packet and of the proof packet is 0. | As for row p15-full-price. | +| `math.p15-price-boundary` | graph_node | — | `specified` | 2 specified: `TwoCoordGeneratorPrices`, `DemandOneRefutation`; 6 proved (main 91cffbb5, PR #358, not on main): `smallest_member_block_size`, `demand_one_good_sets`, `demand_one_obstruction`, `good_measure_three_quarters`, `generator_prices_ninths`, `minimum_generator_price_exceeds_third`; 2 proved (proof packet): `P15Elementary.twoCoordGeneratorPrices`, `P15Elementary.demandOneRefutation` | See row p15-price-boundary: TwoCoordGeneratorPrices and DemandOneRefutation (the two Props of this node) have theorems of exactly their type in the proof packet (listed as `proved`; kernel-checked by the hosted run 38116277597 (PR head 00d2ac6e; actual tested merge c4c66bb8cb26f0cd9bc03d52bb25f1b3925b272c with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2)), the two logarithm inequalities included; the claim-level label stays `specified` for the reasons given there (claim-level vocabulary none/specified, alignment PENDING_INDEPENDENT_REVIEW, a Prop-level proof is evidence about the Prop only, whatever the hosted run 38116277597 receipted). The 6 main P15 arithmetic theorems of source p15-price-boundary (at commit 91cffbb5 of main PR #358, not on main) are listed as the arithmetic skeleton, never as the node. REFUTED is the graph classification of the extension, transcribed as source identity. Nonauthor review and acceptance are not claimed by any statement or theorem; alignment of every statement with its anchor is PENDING_INDEPENDENT_REVIEW; organizational-independence credit of this packet and of the proof packet is 0. | As for row p15-price-boundary. | | `math.rn-selector-region-crosswalk` | graph_node | — | `none` | — | An engineering inventory, not a mathematical claim; nothing to state in Lean and nothing stated. | No Lean target. | | `math.rn-fixed-annulus-window` | graph_node | — | `specified` | 1 specified: `FixedAnnulusWindowCandidateA2` | See row rn-fixed-annulus-window: (A2) stated, not proved; no global D5/RN/JETMOD, k -> 0, d >= 3, pin-neighbourhood, intermediate-scale, collision or elder-selection closure. Nonauthor review and acceptance are not claimed by any statement; alignment of every statement with its anchor is PENDING_INDEPENDENT_REVIEW; organizational-independence credit of this packet is 0. | As for row rn-fixed-annulus-window. | | `math.rn-region.fixed-annulus-window` | graph_node | — | `specified` | 1 specified: `FixedAnnulusWindowCandidateA2` | The region's content is (A2) at its exact scope, stated and not proved; the coverage classification is graph bookkeeping, not a Lean statement; the superseded high-jet route (regional.fixed-annulus.high-jet-route, SUPERSEDED_NONBLOCKING) is not represented. Nonauthor review and acceptance are not claimed by any statement; alignment of every statement with its anchor is PENDING_INDEPENDENT_REVIEW; organizational-independence credit of this packet is 0. | As for row rn-fixed-annulus-window. | | `math.d5-pin-neighborhood-first-moment` | graph_node | — | `specified` | 6 specified: `D5aPuncturedPinDisks`, `D5bMicrodisk`, `D5cCollarC1`, `D5dSummedPinNeighbourhoodC2`, `D5eIntermediateShellsI3I4`, `D5fGlobalWindowFirstMomentI5` | The six row shapes are stated for any object satisfying PinnedLawInterface (sample space Omega, gated pin regime 0 < r < L) and are not proved. The consumption graph (D5-d from D5-a + D5-c, D5-f from D5-d + I4 + remote Theorem A) is a proof structure and is not stated; the component sources PUNCTURED_PIN_PROOF.md, COLLAR_PROOF.md and intermediate_window PROOF.md are not pinned here, so D5a/b/c/e/f are anchored to the reconciliation's row text. The lower bound c r^3 <= P(A_r) of D5-f has its source in remote_collision Corollary F-, not pinned. No d > 2, no numerical constants, no uniformity in T, R, eta, k -> 0; no elder pairing; no RN/24-jet/JETMOD; the witness-collision region stays OPEN_ACTIVE. The STATUS.md note that D5 GRAPH transitions were not executed by that summary is a recorded discrepancy, not resolved here. Nonauthor review and acceptance are not claimed by any statement; alignment of every statement with its anchor is PENDING_INDEPENDENT_REVIEW; organizational-independence credit of this packet is 0. | Pin the three component proofs and re-anchor; independent reviewer: alignment of the six Props with the section 2 table (all-height versus window I_r per row, exclusion of M and S). | -| `math.d5-component.punctured-pin-proof` | graph_node | — | `specified` | 2 specified: `D5aPuncturedPinDisks`, `D5bMicrodisk` | The Props state rows D5-a and D5-b as the reconciliation transcribes P2, not P2 from its own bytes (not pinned); the slices P4, P9, P17, P20 and the continuum argument reviewed are not stated; nothing is proved. Nonauthor review and acceptance are not claimed by any statement; alignment of every statement with its anchor is PENDING_INDEPENDENT_REVIEW; organizational-independence credit of this packet is 0. | Pin PUNCTURED_PIN_PROOF.md (blob f972e50b per GRAPH fingerprint) and anchor D5a/D5b to its own displays. | +| `math.d5-component.punctured-pin-proof` | graph_node | — | `specified` | 2 specified: `D5aPuncturedPinDisks`, `D5bMicrodisk` | The Props state rows D5-a and D5-b as the reconciliation transcribes P2, not P2 from its own bytes (not pinned); the slices P4, P9, P17, P20 and the continuum argument reviewed are not stated; nothing is proved. Nonauthor review and acceptance are not claimed by any statement; alignment of every statement with its anchor is PENDING_INDEPENDENT_REVIEW; organizational-independence credit of this packet is 0. | Pin PUNCTURED_PIN_PROOF.md (SHA-256 f972e50b… (GRAPH.json fingerprint)) and anchor D5a/D5b to its own displays. | | `math.d5-component.punctured-pin-review-111` | graph_node | — | `none` | — | A review record (or its checker) is not a mathematical statement; nothing to state in Lean and nothing stated. Its verdict is source identity in the GRAPH and is not re-derived or re-graded here; all lanes share one GitHub account, so no record carries organizational-independence credit. | No Lean target. The proof it reviews is specified under its proof-component row. | | `math.d5-component.punctured-pin-continuum-review` | graph_node | — | `none` | — | A review record (or its checker) is not a mathematical statement; nothing to state in Lean and nothing stated. Its verdict is source identity in the GRAPH and is not re-derived or re-graded here; all lanes share one GitHub account, so no record carries organizational-independence credit. | No Lean target. The proof it reviews is specified under its proof-component row. | | `math.d5-component.punctured-pin-continuum-check` | graph_node | — | `none` | — | A review record (or its checker) is not a mathematical statement; nothing to state in Lean and nothing stated. Its verdict is source identity in the GRAPH and is not re-derived or re-graded here; all lanes share one GitHub account, so no record carries organizational-independence credit. | No Lean target. The proof it reviews is specified under its proof-component row. | @@ -278,9 +282,9 @@ a theorem between string literals, an indented Prop definition, a proof written | `math.d5-component.i5-review-xai` | graph_node | — | `none` | — | A review record (or its checker) is not a mathematical statement; nothing to state in Lean and nothing stated. Its verdict is source identity in the GRAPH and is not re-derived or re-graded here; all lanes share one GitHub account, so no record carries organizational-independence credit. | No Lean target. The proof it reviews is specified under its proof-component row. | | `math.d5-component.i5-review-claude` | graph_node | — | `none` | — | A review record (or its checker) is not a mathematical statement; nothing to state in Lean and nothing stated. Its verdict is source identity in the GRAPH and is not re-derived or re-graded here; all lanes share one GitHub account, so no record carries organizational-independence credit. | No Lean target. The proof it reviews is specified under its proof-component row. | | `math.d5-component.offpin-second-moment-review` | graph_node | — | `none` | — | A review record (or its checker) is not a mathematical statement; nothing to state in Lean and nothing stated. Its verdict is source identity in the GRAPH and is not re-derived or re-graded here; all lanes share one GitHub account, so no record carries organizational-independence credit. | No Lean target. The proof it reviews is specified under its proof-component row. | -| `math.d5-component.collar-proof` | graph_node | — | `specified` | 1 specified: `D5cCollarC1` | D5cCollarC1 states row D5-c as the reconciliation transcribes C1, not C1 from its own bytes (not pinned); the normalizer (P14) it imports and the corollary C2 are not stated separately; nothing is proved. Nonauthor review and acceptance are not claimed by any statement; alignment of every statement with its anchor is PENDING_INDEPENDENT_REVIEW; organizational-independence credit of this packet is 0. | Pin COLLAR_PROOF.md (blob 794babe0 per GRAPH fingerprint) and anchor D5cCollarC1 to display (C1). | +| `math.d5-component.collar-proof` | graph_node | — | `specified` | 1 specified: `D5cCollarC1` | D5cCollarC1 states row D5-c as the reconciliation transcribes C1, not C1 from its own bytes (not pinned); the normalizer (P14) it imports and the corollary C2 are not stated separately; nothing is proved. Nonauthor review and acceptance are not claimed by any statement; alignment of every statement with its anchor is PENDING_INDEPENDENT_REVIEW; organizational-independence credit of this packet is 0. | Pin COLLAR_PROOF.md (SHA-256 794babe0… (GRAPH.json fingerprint)) and anchor D5cCollarC1 to display (C1). | | `math.d5-component.annulus-proof` | graph_node | — | `specified` | 1 specified: `AnnulusBridgeAllHeight2` | AnnulusBridgeAllHeight2 states display (2) (d = 2, fixed L, compact birth, k_- > 0, 1 < A < B, all heights) over PinnedLawInterface; not proved. Not stated: displays (4)-(20), the R1-R7 review interfaces as separate statements, the deterministic three-Hessian lemma, the crossover factor min(1,(r/\|v\|)^6). No matching lower bound, no numerical constant or radius, no pin neighbourhoods, no k -> 0 uniformity, no d >= 3, no fixed-remote all-height bound, no all-scales RN theorem. Nonauthor review and acceptance are not claimed by any statement; alignment of every statement with its anchor is PENDING_INDEPENDENT_REVIEW; organizational-independence credit of this packet is 0. | State the R1-R7 interfaces as Props; independent reviewer: alignment of AnnulusBridgeAllHeight2 with display (2), checking "all heights" and the uniformity over E and j. | -| `math.d5-component.intermediate-window-proof` | graph_node | — | `specified` | 2 specified: `D5eIntermediateShellsI3I4`, `D5fGlobalWindowFirstMomentI5` | The Props state rows D5-e and D5-f as the reconciliation transcribes I3/I4/I5, not from the proof's own bytes (not pinned); the tiling N1 of the Claude review and the planar F+ lower bound source are not stated; nothing is proved. Nonauthor review and acceptance are not claimed by any statement; alignment of every statement with its anchor is PENDING_INDEPENDENT_REVIEW; organizational-independence credit of this packet is 0. | Pin intermediate_window_20260928/PROOF.md (blob b3eb9456 per GRAPH fingerprint) and anchor the shell displays there. | +| `math.d5-component.intermediate-window-proof` | graph_node | — | `specified` | 2 specified: `D5eIntermediateShellsI3I4`, `D5fGlobalWindowFirstMomentI5` | The Props state rows D5-e and D5-f as the reconciliation transcribes I3/I4/I5, not from the proof's own bytes (not pinned); the tiling N1 of the Claude review and the planar F+ lower bound source are not stated; nothing is proved. Nonauthor review and acceptance are not claimed by any statement; alignment of every statement with its anchor is PENDING_INDEPENDENT_REVIEW; organizational-independence credit of this packet is 0. | Pin intermediate_window_20260928/PROOF.md (SHA-256 b3eb9456… (GRAPH.json fingerprint)) and anchor the shell displays there. | | `math.d5-component.remote-window-proof` | graph_node | — | `specified` | 2 specified: `FixedRemoteMeanMeasureA2`, `FixedRemoteCountBoundA3` | See rows rn-fixed-remote-window and math.rn-fixed-remote-window; the D5 consumption at rho = s_0 is a proof step, not stated. Nonauthor review and acceptance are not claimed by any statement; alignment of every statement with its anchor is PENDING_INDEPENDENT_REVIEW; organizational-independence credit of this packet is 0. | As for row rn-fixed-remote-window. | | `D1-THM-A` | proof_index_result | — | `specified` | 2 specified: `PairLawInterface`, `ParentUniformSelectionA` | ParentUniformSelectionA states the shape of (1.1): existential r_* > 0, C < infinity outside the universal quantifiers over 0 < r <= r_*, b in [bLo,bHi], k in [kLo,kHi] and all frames, for the interface field p of PairLawInterface. Not stated or proved: the full-normalizer floor Z_r >= z_* r^2 (5.5), the transverse-matrix boundary layer, the regression law and typed weight, the reading-rule amendments (E1, Section 9 v1.1, W1, r < L/(4 sqrt 2)), any numerical r_*, C, z_*. The identification of the interface structures (GaussianFieldInterface, SuperlevelBarInterface, PairLawInterface) with the source's field, elder rule and weighted regression law is not established: the Props hold for every object satisfying the interface, and no inhabitant is constructed. No globally uniform constant over unbounded b, k; no lower bound. Nonauthor review and acceptance are not claimed by any statement; alignment of every statement with its anchor is PENDING_INDEPENDENT_REVIEW; organizational-independence credit of this packet is 0. The interface does not determine p: ParentUniformSelectionA is a predicate on the interface objects, not a closed statement; its universal closure over all inhabitants is false whenever the interfaces are inhabited (take p identically 0), and `specified` refers to the statement shape at the source's object, which is not constructed. | Independent reviewer: alignment of ParentUniformSelectionA with (1.1) under the honesty checklist; formal lane: none until the regression law is constructed. | | `D1-THM-B` | proof_index_result | — | `specified` | 4 specified: `IsWindowPair`, `IsWindowElderPair`, `IsLifetimeDensityVersion`, `ParentCompactWindowDensityB` | ParentCompactWindowDensityB states the shape of (1.2) (asymptotics of versions of nu_cand and nu_eld, c_{B,K} > 0, the O(ell^(2/3)) difference) for compact B, K of positive length; not proved. Not stated: the exact coefficient formula (11.3), the radial ledger (10.2), the pushforward r = (ell/k)^(1/3); the distance cutoff is quantified existentially and not identified with the r_* of (1.1). The difference is NOT asserted for unrestricted densities; no numerical c_{B,K}, C_{B,K}; the historical H3 finite-band floor is not re-certified. The identification of the interface structures (GaussianFieldInterface, SuperlevelBarInterface, PairLawInterface) with the source's field, elder rule and weighted regression law is not established: the Props hold for every object satisfying the interface, and no inhabitant is constructed. Nonauthor review and acceptance are not claimed by any statement; alignment of every statement with its anchor is PENDING_INDEPENDENT_REVIEW; organizational-independence credit of this packet is 0. | State (11.3) as a Prop over an explicit Gaussian conditional law; independent reviewer: alignment of ParentCompactWindowDensityB with (1.2), including the positive-length requirement. | @@ -296,7 +300,7 @@ a theorem between string literals, an indented Prop definition, a proof written | `CL-D5-REMOTE-COLLISION-20260928-v1` | proof_index_result | — | `none` | 1 specified: `RemoteCollisionSecondFactorialD` | Only Corollary D (second factorial moment <= C r^5 \|E\| in the fixed remote region) is stated; Theorem C (ordered near-pair count), Corollaries E and F (event asymptotics, torus-wide lower bound) are not, so the packet is not specified as a whole. Nothing proved; pairs with a witness near the pins are excluded; no torus-wide second factorial moment; this is explicitly NOT the open witness-collision mechanism. Author Anthropic/Claude: same provider as this packet, independence credit 0. Nonauthor review and acceptance are not claimed by any statement; alignment of every statement with its anchor is PENDING_INDEPENDENT_REVIEW; organizational-independence credit of this packet is 0. | State Theorem C and Corollaries E, F; independent (non-Anthropic) reviewer for both the source and the Props. | | `cumulative-transfer-correction` | proof_index_result | — | `none` | — | No Prop states the corrected cumulative theorem (sigma-finite (Z, lambda), alpha > -1, m > 0, ratio hypothesis h/(kappa r^m) -> 1, limit N(ell)/ell^beta -> (1/(alpha+1)) int B0 kappa^(-beta)), although its bytes are pinned. Nothing is proved; the correction does not license inferring a density asymptotic from a cumulative one; Section A of NOTE.md is outside both acceptances. | State the corrected theorem as a def : Prop over MeasureTheory.Measure Z (an abstract measure-space statement with no Gaussian input; a natural Mathlib-lane proof target afterwards). | | `hist.D0-RN-UNIF-historical-predicates` | open_obligation | — | `none` | — | No Lean statement: the historical numerical RN all-cell / 24-jet certification predicates have no in-tree source text to anchor (their carriers are ABSENT by fingerprint) and no Prop states any of them. The GRAPH records no complete proof where not explicitly superseded, and hist.lemma_closed is FALSE; this register changes none of that. The regional bypass (regional.fixed-annulus.high-jet-route, SUPERSEDED_NONBLOCKING) does not reopen or close these predicates in their original replay scopes; no numerical certificate exists in tree. | None for Lean until a source text exists; recovery of the absent carriers is a custody question (reviews/d0_custody_audit_20260926), not a formalization one. | -| `lean:main-formal-UniversalLaw` | existing_lean_package | — | `none` | 4 proved (main): `d2_endpoints_adjacent`, `d3_endpoints_adjacent`, `d3_below_d2`, `endpoints_in_unit_tenth` | The package states no research claim as a Prop, so the claim-level label is none; its 31 theorems at origin/main f6deeba7 are finite integer/cross-multiplied rational facts proved by decide (label `proved` in the manifest, `kernel-checked` only in a run receipt). The four Endpoints theorems listed here show the published 20-digit endpoints are adjacent, ordered and below 1/10 as Nat; they do not place c_{2,24} or c_{3,24} between them and say nothing about the true coefficients (the module's own note). The 28 P15 arithmetic targets of this programme's main worktree are on no commit, are not listed in this register, and have only a local untrusted --run-lean receipt. main has NO mechanism for `specified`: its gate refuses any manifest label but `proved`, so statement-only work cannot live in this package. Alignment review by a non-Anthropic lane is an open ask (formal/reviews holds only the template). | Commit and push the P15 modules so the hosted formal-verification.yml run produces a trusted receipt, then list them here as `proved` statements citing the 40-hex commit and the run; obtain a non-Anthropic alignment review of the 31 committed targets (59 once the P15 modules are committed); keep real-number statements in the Math- Mathlib lane. | +| `lean:main-formal-UniversalLaw` | existing_lean_package | — | `none` | 4 proved (main, origin/main f6deeba7): `d2_endpoints_adjacent`, `d3_endpoints_adjacent`, `d3_below_d2`, `endpoints_in_unit_tenth` | The package states no research claim as a Prop, so the claim-level label is none; its 31 theorems at origin/main f6deeba7 are finite integer/cross-multiplied rational facts proved by decide (label `proved` in the manifest, `kernel-checked` only in a run receipt). The four Endpoints theorems listed here show the published 20-digit endpoints are adjacent, ordered and below 1/10 as Nat; they do not place c_{2,24} or c_{3,24} between them and say nothing about the true coefficients (the module's own note). The 28 P15 arithmetic targets are at commit 91cffbb5 of main PR #358 (not on main), are listed as `proved` statements on the rows p15-price-boundary, math.p15-price-boundary, p15-realized-covers, p15-price-budget-restricted, p15-full-price and math.p15-full-price, and have the hosted workspace-landing run 38096827443 (job formal / formal-evidence, artifact formal-verification-38096827443) as kernel evidence; they are finite arithmetic and none is Theorem F (F2), Theorem (T1), Theorem P2, Proposition P1, the enclosure (F3) of rho_star or any inequality involving log, exp or e (main formal/SCOPE.md). main has NO mechanism for `specified`: its gate refuses any manifest label but `proved`, so statement-only work cannot live in this package. Alignment review by a non-Anthropic lane is an open ask (formal/reviews holds only the template). | PR #358 merge is the operator's decision; until then the 28 P15 targets are on a branch, not on main. Obtain a non-Anthropic alignment review of the 59 targets; keep real-number statements in the Math- Mathlib lane (the proof packet specifications/lean_statement_proofs_20261011 now holds the real-number P15 theorems, kernel-checked by the hosted run 38116277597 (PR head 00d2ac6e; actual tested merge c4c66bb8cb26f0cd9bc03d52bb25f1b3925b272c with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2)). | | `lean:math-formal-ResearchFormalCoreR1` | existing_lean_package | — | `none` | — | The package states no research claim of this register as a Prop and none of its statements can be listed here: its bound sources (P02-LM-008 proof.md.export.txt at 22876eda, MOMENT_TAIL.md, WEIGHT_PERTURBATION.md, the D2 small-L NOTE.md) are not among this packet's pinned sources, so no verbatim anchor is available. Not established by the package (its own does_not_establish): any concrete Gaussian or typed Palm law, moment bounds M, cW, cZ, lower normalizers, event tails, constant uniformity, GT5, P0.2, the parent persistence theorem, identification of weightedLaw with the program's conditioned law, D2 Schur in d >= 3, the coefficient formula (15.2). Alignment: ACCEPTED for 20 targets at an older head only, STALE for the current 63, credit 0. | Pin the Math- formal sources in a later packet revision and register the 63 targets as `proved` statements with anchors; obtain a fresh alignment record for the 63-target manifest from a lane differing in provider, family and agent. | | `lean:math-companion-d2_moment_bridge_20261006` | existing_lean_package | — | `none` | — | States no research claim of this register; its sources (Math-#302 NOTE.md section 4 / C7, #326, #328, #343 comments) are not pinned here, so no statement can be anchored and listed. Does not establish: no uniform spectral floor, no concrete periodic probability law, no moment summability for that law, no trigonometric q map, no Gaussian/Palm identification, no interval quadrature, no numerical coefficient or persistence/cap theorem; the finite countermodel law is tested in Python, not constructed in Lean. Same GitHub account as every lane: organizational-independence credit 0. | Pin the companion sources and register its theorems as `proved` statements in a later packet revision; a reviewer differing in provider, family and agent for alignment. | | `lean:math-companion-d2_square_schur_20261006` | existing_lean_package | — | `none` | — | States no research claim of this register; its sources (Math-#302 NOTE.md section 4 / C7, #326, #328, #343 comments) are not pinned here, so no statement can be anchored and listed. Does not establish: no atom-measure integral lower bound, moment realizability, periodic spectral law, trigonometric parameterization, Gaussian/Palm covariance identification, quadrature or persistence theorem; the #328 Part B stronger proposal is not incorporated. Same GitHub account as every lane: organizational-independence credit 0. | Pin the companion sources and register its theorems as `proved` statements in a later packet revision; a reviewer differing in provider, family and agent for alignment. | @@ -326,7 +330,7 @@ a theorem between string literals, an indented Prop definition, a proof written | `cert:main-periodic_h0-count_confidence1` | exact_certificate | — | `none` | — | L2 exact-arithmetic evidence (Python stdlib Fraction / integer) about one finite rounded object: a Python certificate is not a kernel proof and is not Lean. The CERTIFICATE.json scope flags are all false for what is not certified (gaussian_law, infinite_field, lifetime_law, historical_fft / historical_gaussian_draw, iid_input_law where present; input_law_is_hypothesis true where present): no Gaussian law, infinite field, lifetime law or held-out confirmation is certified. No Lean statement exists or is stated here; the CERTIFICATE.json bytes are not pinned in this packet. | Restate the finite inequality that the Python certificate checks in exact rational arithmetic (the bounds for the fixed object) as a Lean Prop over ℚ / ℕ and prove it in a proof package (norm_num / decide, or interval arithmetic in Mathlib for the pi / sqrt / exp / log bound helpers); the input-law hypotheses stay hypotheses. | | `cert:main-universality-fold_controls` | exact_certificate | — | `none` | — | Exact Fraction toy control (L2 evidence), by its own words "no random-field admissibility or Lean claim": not a stationary random-field counterexample, not a formal kernel proof, not stated in Lean. | The exact pushforward exponent identities are elementary and could be stated and proved over ℚ in a proof package; low priority. | | `cert:math-side24_v1-coefficient.py` | exact_certificate | — | `none` | — | L2 exact-arithmetic evidence: a Python outward-rounding procedure is not a kernel proof, and main's 31 Side24 theorems formalize only its integer arithmetic skeleton (not the interval arithmetic, not the Gamma / pi / exp enclosures, not the theta sums). The enclosure statement itself is CoefficientEnclosure (specified, not proved) on row side24-coefficient; ENCLOSURE.json says scientific_acceptance false. | A proof-producing enclosure pipeline (the numerical formalizer work offer of main docs/FORMAL_VERIFICATION.md): proof-producing Gamma(7/6), pi, exp and theta-sum enclosures in Mathlib, then CoefficientEnclosure under ConeMomentInterface. | -| `cert:math-full_price-full_price.py` | exact_certificate | — | `none` | — | L2 exact-arithmetic evidence (stdlib Fraction) for finite rational facts; not a kernel proof. The FullPrice.lean module staged in this programme's uncommitted main worktree (on no commit; not listed in this register) targets only the adjacency of the endpoints as Nat, 16/27 < 6/7 and the rational orderings / Taylor partial sum of Section 6, not that rho_star = 1/(3 - log(3e - 2)) lies between the endpoints (RhoStarEnclosure, specified only). The finite suite "supports algebra only" (the source's own words); no prize status (original_prize_closed stays false). | Prove RhoStarBelowSixSevenths / SixSeventhsCertificate in the Math- Mathlib lane (Real.exp / Real.log bounds); then RhoStarEnclosure via proof-producing exp/log enclosures. | +| `cert:math-full_price-full_price.py` | exact_certificate | — | `none` | — | L2 exact-arithmetic evidence (stdlib Fraction) for finite rational facts; not a kernel proof. The FullPrice.lean module at commit 91cffbb5 of main PR #358 (not on main; its 10 targets are listed as `proved` statements on the rows p15-full-price, math.p15-full-price and p15-price-budget-restricted) targets only the adjacency of the endpoints as Nat, 16/27 < 6/7 and the rational orderings / Taylor partial sum of Section 6, not that rho_star = 1/(3 - log(3e - 2)) lies between the endpoints (RhoStarEnclosure, specified only); RhoStarBelowSixSevenths and SixSeventhsCertificate are proved as the Props state them in the proof packet specifications/lean_statement_proofs_20261011 (kernel-checked by the hosted run 38116277597 (PR head 00d2ac6e; actual tested merge c4c66bb8cb26f0cd9bc03d52bb25f1b3925b272c with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2)), which places rho_star below 6/7, not between the 20-digit endpoints. The finite suite "supports algebra only" (the source's own words); no prize status (original_prize_closed stays false). | Prove RhoStarEnclosure in the Math- Mathlib lane via proof-producing exp/log enclosures (RhoStarBelowSixSevenths / SixSeventhsCertificate are already proved in specifications/lean_statement_proofs_20261011 and kernel-checked by the hosted run 38116277597 (PR head 00d2ac6e; actual tested merge c4c66bb8cb26f0cd9bc03d52bb25f1b3925b272c with base b2d70d77876a10c365f5db5d3b6cafcf180af4e2)). | ### Packets listed by id only (82 rows) @@ -432,4 +436,8 @@ Kind `proof_index_result`, formal progress `none`, no statements, no kernel evid The identification of any interface structure with the object of the source texts, the parent theorems themselves, the review of the statements, and acceptance of any claim remain open. Nothing under this directory may be cited as evidence that a research claim is proved, verified, -closed or certified. +closed or certified. A `proved` statement entry of another package listed in the register is evidence +about the registered Prop it names (and, for main's `formal/` targets, about a finite arithmetic +identity), never about the claim row it sits under; `kernel-checked` is a run-receipt word (the proof packet's +hosted run 38121713840 receipted all of its theorems: PR head 910809d6, actual tested merge 5b198699… with base b2d70d77…, the +synthetic merge a pull_request run checks out, same tree as the head).