The quotient and remainder of a division are unique

Identifier: F:nat-div-mod-unique
Proof route: kernel-lean
External status: proved
Axiom footprint: Empty

Recorded description

If n = d*q1 + r1 with r1 < d and n = d*q2 + r2 with r2 < d, then q1 = q2 and r1 = r2.

Formal statement

theorem Nat.div_mod_unique : ((x0 : AxNat) -> ((x1 : AxNat) -> ((x2 : AxNat) -> ((x3 : AxNat) -> ((x4 : AxNat) -> ((x5 : AxNat) -> ((x6 : AxNat.divMod x0 x1 x2 x3) -> ((x7 : AxNat.divMod x0 x1 x4 x5) -> And (Eq.{1} AxNat x2 x4) (Eq.{1} AxNat x3 x5)))))))))

Dependencies

The graph shows direct ledger edges. Follow a node to open its artifact page.

9 direct dependencies 28 direct dependents Graph shows the first 8 on each side.

Evidence

kernel-Nat.div_mod_unique

Kind: kernel-term
Status: checked

Supports: If n = d*q1 + r1 with r1 < d and n = d*q2 + r2 with r2 < d, then q1 = q2 and r1 = r2.

Checker command

test "$(cargo run -q -p axeyum-lean-kernel --example nat_theorem_inventory -- div_mod_unique 2>/dev/null | grep -Ec '^Nat\.div_mod_unique[[:space:]]')" -ge 1

Evidence notes

`build_nat_prelude` admits this theorem through the trusted `Kernel::add_declaration` gate, which re-checks the proof term against the stated type, so producing the row at all is a machine-checked proof. TIGHTENED 2026-08-16: the command was `cargo test -p axeyum-lean-kernel --lib nat_prelude`, a whole-suite run that passes or fails identically for every fact citing it and would stay green if THIS theorem were deleted. It now names its own subject twice over -- `nat_theorem_inventory` exits non-zero for a name that does not exist, and the `grep -q` requires the admitted declaration to be printed.

footprint-Nat.div_mod_unique

Kind: exhaustive-enumeration
Status: checked

Supports: axiom_footprint: [] -- the Nat prelude's trusted surface is empty

Checker command

cargo run -q -p axeyum-lean-kernel --example nat_axiom_inventory -- --require-axiom-free nat

Evidence notes

`nat_axiom_inventory` enumerates the built Nat environment and reports `nat: axiom=0 opaque=0 quotient=0 total_trusted=0` (re-run 2026-08-14 by this lane). That is the whole environment, not this theorem, and that is what makes it sound as a footprint: a theorem cannot depend on a trusted declaration the environment does not contain, so an empty trusted surface bounds every individual footprint by []. Counting `Declaration::Axiom` alone would NOT have sufficed -- `Opaque` has no proof body and `Quotient` admits `Quot.sound`, one of Lean's own axioms -- so the enumeration covers all three.

Provenance

{
  "date": "2026-08-14",
  "established_by": "axeyum-lean-kernel build_nat_prelude, re-measured by lane facts-number",
  "source": "proposition extracted from the S:number / S:arithmetic-structure strands of the math-education concept graph; statement authored here, nothing copied"
}