Mathlib v4.30 source proposition Nat.add_eq_max_iff

`build_nat_prelude` admits `Nat.add_eq_max_iff` through the trusted `Kernel::add_declaration` gate, declared in `nat_prelude/minmax_lemmas.rs`. `nat_theorem_inventory`'s rendered type is `((x0 : AxNat) -> ((x1 : AxNat) -> Iff (Eq.{1} AxNat (AxNat.add x0 x1) (Max.max x0 x1)) (Or (Eq.{1} AxNat x0 AxNat.zero) (Eq.{1} AxNat x1 AxNat.zero))))`, matching this fact's `formal.statement` modulo binder info. The flip is honest under the def-vs-theorem criterion, checked at the pinned toolchain source rather than from a paraphrase: Lean core's `max`/`min` at `Nat` ARE `if a <= b then b else a` / `if a <= b then a else b` (`Init/Prelude.lean:1311` `maxOfLe`, `:1328` `minOfLe`, `Init/Data/Nat/Basic.lean:873` `instance : Max Nat := maxOfLe`, `Init/Prelude.lean:2088` `instance : Min Nat := minOfLe`, and `Basic.lean:871` `Nat.min_def : min n m = if n <= m then n else m := rfl`), decided by `Nat.decLe` i.e. `Nat.ble`. `nat_prelude/minmax.rs` declares `Max.max`/`Min.min` with exactly that body, so this is the SAME function and only the delivery (a class projection at an instance) differs -- the same relation `HAdd.hAdd`/`instAddNat` bear to `Nat.add` in every already-settled mirror mentioning `+`. The rendered type differs from the pinned surface statement only in binder INFO (all binders explicit here; Mathlib marks some implicit), which is elaboration, not proposition. The tool exits non-zero for a name that does not exist, and the `grep -c` count (tested `-ge 1`, consuming the pipe, never `grep -q`) requires the admitted declaration to actually be printed; verified both ways -- the real name greps to a count `-ge 1`, a made-up `Nat.add_eq_max_iff_bogus` greps to `0`. Note `nat_theorem_inventory` keeps only its LAST name argument, so this command passes exactly one.

The kernel gate says the proof term checks; it does not say the STATEMENT is the intended one. `minmax_lemmas_tests.rs` infers each applied theorem's type with `Kernel::infer`/`infer_in` and compares it against an independently built expectation, at BOTH orderings (`Le a b` and `Le b a` select opposite arms of the `Bool.rec`), at the `a = b` boundary where `Nat.ble a b` is `true` yet `max_eq_left`/`min_eq_right` return the other argument, and at genuinely free variables where nothing reduces. Each check carries a transposed negative control. One control was measured VACUOUS on the first run -- at `(7, 2)` the max reduces to `7`, so `a <= max a b` and `max a b <= a` are the same proposition -- and was moved to the symbolic instance, which is where it discriminates. The suite is ungated (no `#![cfg(feature ...)]`) and reports 9 tests.

`nat_axiom_inventory --require-axiom-free nat` enumerates the built Nat environment and exits non-zero unless it admits no Axiom, Opaque or Quotient declaration. A theorem cannot depend on a trusted declaration the environment does not contain, so an empty trusted surface bounds every individual theorem's footprint by []. `nat_prelude_tests::every_nat_declaration_is_checked_and_axiom_free` additionally derives its coverage from `kernel.environment()` -- not from a hand list -- and so fails if `Nat.add_eq_max_iff` were live but unlisted; it checks this theorem's own `Kernel::axiom_footprint` directly. `minmax_lemmas_tests::the_minmax_order_theory_rests_on_zero_axioms` names all eighteen of the module's declarations and asserts each is live in the environment with an empty footprint.