Adding a nonnegative integer into a normalized difference, at the representation level

Identifier: F:int-of-nat-add-sub-nat-nat
Proof route: kernel-lean
External status: proved
Axiom footprint: Empty

Recorded description

For naturals a, b and c, a + subNatNat(b, c) = subNatNat(a + b, c) -- a representation-level lemma folding an ofNat-constructed addend into subNatNat's first argument.

Formal statement

theorem Int.ofNat_add_subNatNat : ((x0 : AxNat) -> ((x1 : AxNat) -> ((x2 : AxNat) -> Eq.{1} Int (Int.add (Int.ofNat x0) (Int.subNatNat x1 x2)) (Int.subNatNat (AxNat.add x0 x1) x2))))

Dependencies

The graph shows direct ledger edges. Follow a node to open its artifact page.

7 direct dependencies 3 direct dependents

Evidence

kernel-Int.ofNat_add_subNatNat

Kind: kernel-term
Status: checked

Supports: Int.ofNat_add_subNatNat is admitted by the trusted kernel gate with the type recorded in formal.statement.

Checker command

cargo run -q --release -p axeyum-lean-kernel --example theorem_dependency_inventory -- Int.ofNat_add_subNatNat 2>/dev/null | grep -cE '^Int\.ofNat_add_subNatNat[[:space:]]'

Evidence notes

`build_int_prelude` admits Int.ofNat_add_subNatNat through the trusted `Kernel::add_declaration` gate, which re-checks the proof term against the stated type, so a line in `theorem_dependency_inventory`'s output for the exact name is a machine-checked proof having been admitted. That tool exits non-zero for a named filter matching nothing (a deleted theorem cannot read as a re-derived one), and `grep -c` (never `-q`) both avoids a SIGPIPE-under-pipefail false negative and independently asserts the exact tab-anchored line is present. `--release` is MANDATORY: this tool unconditionally also builds `creal`/`complex`/`cpoint`, which recurse deep enough in a debug build to overflow the default thread stack (measured: release exits 0, debug SIGABRTs at 134).

footprint-Int.ofNat_add_subNatNat

Kind: exhaustive-enumeration
Status: checked

Supports: axiom_footprint: [] -- Int.ofNat_add_subNatNat lives in the Int prelude's trusted surface, which is empty.

Checker command

cargo run -q -p axeyum-lean-kernel --example nat_axiom_inventory -- --require-axiom-free integer

Evidence notes

`nat_axiom_inventory --require-axiom-free integer` builds the Int environment as its own group and reports `integer: axiom=0 opaque=0 quotient=0 total_trusted=0` (re-measured on this tree), exiting 0 with `ok: integer trusted surface = 0`. That bounds every individual Int theorem's footprint by [], since Int.ofNat_add_subNatNat cannot depend on a trusted declaration the environment does not contain. `--require-axiom-free <name>` is an error (not a silent pass) for a prelude this run never built, which is what makes `integer` here a claim rather than an absence.

Provenance

{
  "date": "2026-08-25",
  "established_by": "axeyum-lean-kernel build_int_prelude",
  "source": "theorem name and dependency edges from theorem_dependency_inventory; canonical type read via int_theorem_inventory, which already prints Int declarations with their canonical type and axiom footprint -- no probe crate was needed for this batch."
}