A list's per-element count agrees with its computed multiset's count

Identifier: F:list-count-to-multiset
Proof route: kernel-lean
External status: proved
Axiom footprint: Empty

Recorded description

For any element a and list l over Nat, the number of times a occurs in l (List.count) equals the multiplicity Nat.Multiset assigns to a in the multiset built by folding l (List.toMultiset) -- the new ordinary-inductive List carrier and the earlier function-plus-bound Nat.Multiset carrier (ADR-1520) agree on how many times a value occurs.

Formal statement

theorem List.count_toMultiset : ((x0 : AxNat) -> ((x1 : List.{0} AxNat) -> Eq.{1} AxNat (List.count x0 x1) (AxNat.Multiset.count (List.toMultiset x1) x0)))

Dependencies

The graph shows direct ledger edges. Follow a node to open its artifact page.

4 direct dependencies 0 direct dependents

Evidence

kernel-list-count-to-multiset

Kind: kernel-term
Status: checked

Supports: List.count_toMultiset is admitted by the trusted kernel gate with the type recorded in formal.statement.

Checker command

test "$(cargo run -q --release -p axeyum-lean-kernel --example list_theorem_inventory -- List.count_toMultiset 2>/dev/null | grep -Fc '((x0 : AxNat) -> ((x1 : List.{0} AxNat) -> Eq.{1} AxNat (List.count x0 x1) (AxNat.Multiset.count (List.toMultiset x1) x0)))')" -ge 1

Evidence notes

The pattern is the FULL admitted type (rendered by Kernel::render_lean via list_theorem_inventory), not the theorem's name -- a drifted statement would fail this check. This theorem was recorded as NOT landed by list-carrier-1 (docs/plan/archive/lanes/460-list-carrier-1.md); list-carrier-2 found the blocker it named -- a beq-to-ne bridge lemma -- was unnecessary, since Nat.Multiset.count_singleton_of_ne is already stated directly in terms of beq.

footprint-list-count-to-multiset

Kind: instance-pin
Status: checked

Supports: axiom_footprint: [] -- read from Kernel::axiom_footprint for this declaration, not from a maintained list

Checker command

cargo test -q --release -p axeyum-lean-kernel --lib -- list_prelude::bridge::bridge_tests::count_to_multiset_landed_axiom_free_and_matches_concretely --test-threads=1

Evidence notes

This test asserts ListNatBridge::count_to_multiset is Some (not the None list-carrier-1 recorded) and Kernel::axiom_footprint(name).is_empty(), read directly from the kernel.

evaluation-list-count-to-multiset

Kind: instance-pin
Status: checked

Supports: The general (a,l-symbolic) theorem, instantiated at concrete arguments, both type-checks and matches independently evaluated count/Multiset.count values, with negative controls.

Checker command

cargo test -q --release -p axeyum-lean-kernel --lib -- list_prelude:: --test-threads=4

Evidence notes

count_to_multiset_landed_axiom_free_and_matches_concretely instantiates the theorem at (a:=1, l:=[1,2,1]) and (a:=3, l:=[1,2,1]), checks Kernel::infer succeeds at both, and confirms count 1 [1,2,1] = 2 (not 0) and count 3 [1,2,1] = 0 (not 2) by def_eq.

Provenance

{
  "date": "2026-09-03",
  "established_by": "axeyum-lean-kernel build_list_nat_bridge",
  "source": "theorem name and canonical type read directly via list_theorem_inventory, which prints render_lean of the admitted type; declared by list_prelude/bridge.rs (lane list-carrier-2, ADR-1583 amending ADR-1579)."
}