At the Eisenstein shape the row floor never exceeds the rectangle's height

Identifier: F:nat-div-mul-succ-le-of-le
Proof route: kernel-lean
External status: proved
Axiom footprint: Empty

Recorded description

For every `m`, `n` and every `x` with `x + 1 <= m`: `floor((2n+1)(x+1) / (2m+1)) <= n`. This is the one arithmetic fact ADR-1544's residue 5 was short of, and it is a fact about the Eisenstein shape rather than about counting. WHY IT IS NOT ONE LINE: the bound is `q(x+1) <= q*m < pp(n+1)`, and the strict half is `2nm + m < 2mn + 2m + n + 1`, i.e. `0 < m + n + 1`. But `mul q m` is STUCK in both directions -- `Nat.mul` recurses on its RIGHT argument, so `mul q m` with `m` symbolic reduces to nothing, and `mul pp n` likewise. One `Nat.mul_comm` on each turns them into `mul m (succ (2n))` and `mul n (succ (2m))`, which iota-reduce to `mul m (2n) + m` and `mul n (2m) + n`, and the two leading products are the same number `2mn` written two different ways -- a nine-step chain through `mul_assoc`, `right_distrib` and `mul_comm` to identify. Everything after that is `Nat.add_lt_add_left`, `Nat.succ_le_succ`, `Nat.mul_le_mul_left`, `Nat.lt_of_le_of_lt`, `Nat.div_lt_of_lt_mul` and `Nat.le_of_lt_succ`, plus four one-hole transports at `Le`/`Lt` positions where the Nat-valued `NatOps::congr` does not apply. `Kernel::axiom_footprint` is EMPTY. Admitted on the first attempt.

Formal statement

theorem Nat.div_mul_succ_le_of_le : ((x0 : AxNat) -> ((x1 : AxNat) -> ((x2 : AxNat) -> ((x3 : AxNat.le (AxNat.succ x2) x0) -> AxNat.le (AxNat.div (AxNat.mul (AxNat.succ (AxNat.mul (AxNat.succ (AxNat.succ AxNat.zero)) x1)) (AxNat.succ x2)) (AxNat.succ (AxNat.mul (AxNat.succ (AxNat.succ AxNat.zero)) x0))) x1))))

Dependencies

The graph shows direct ledger edges. Follow a node to open its artifact page.

15 direct dependencies 1 direct dependents Graph shows the first 8 on each side.

Evidence

kernel-Nat.div_mul_succ_le_of_le

Kind: kernel-term
Status: checked

Supports: Nat.div_mul_succ_le_of_le is admitted by the trusted kernel gate with the type recorded in formal.statement.

Checker command

cargo run -q --release -p axeyum-lean-kernel --example theorem_dependency_inventory -- Nat.div_mul_succ_le_of_le 2>/dev/null | grep -cE '^Nat\.div_mul_succ_le_of_le[[:space:]]'

Evidence notes

Two independent failure modes, so the exit status depends on the finding rather than on the run completing: theorem_dependency_inventory exits non-zero when a NAMED filter matches nothing, and grep -c exits 1 printing 0 when the anchored line is absent. RUN WITH A NEGATIVE CONTROL and it was: the real name prints 1 with both pipeline stages at 0, a one-character typo prints 0 with both stages at 1. Anchored with [[:space:]], never \t -- in a scripted (GNU) grep \t is a literal t. grep -c rather than grep -q, which would SIGPIPE the producer under pipefail. --release is MANDATORY, and so is a FRESH build: this lane hit the stale-binary trap here, and a prebuilt inventory reported this very theorem ABSENT. `cargo run` rebuilds; a prebuilt binary does not. Pass ONE name per invocation.

footprint-Nat.div_mul_succ_le_of_le

Kind: exhaustive-enumeration
Status: checked

Supports: axiom_footprint: [] -- the natural-number prelude's trusted surface is empty, which bounds Nat.div_mul_succ_le_of_le.

Checker command

cargo run -q --release -p axeyum-lean-kernel --example nat_axiom_inventory -- --require-axiom-free nat

Evidence notes

--require-axiom-free exits non-zero when the named prelude's trusted surface (Axiom + Opaque + Quotient) is not empty, and errors rather than silently passing for a prelude the run never built. A declaration cannot depend on a trusted declaration the environment does not contain, so an empty nat surface bounds every declaration in it. This is a whole-prelude bound, not a per-declaration measurement; the per-declaration figure is measured 0 by the axiom-footprint assertion in eisenstein_floor_min_free_tests.rs.

numeric-Nat.div_mul_succ_le_of_le

Kind: exhaustive-enumeration
Status: checked

Supports: C6 of ADR-1552's check script verifies the min-free identity at 317 coprime odd pairs, and C6b verifies separately that the cap never binds on either axis at any of them -- the fact the bound lemma states. M11 refutes the same reading at pp=2, q=5, m=1, n=0, a general instance where the cap does bind.

Checker command

python3 docs/research/09-decisions/adr-1552-eisenstein-checks.py

Evidence notes

Exit status depends on the finding: a claim that fails, or a control that behaves other than as recorded, exits 1. Verified by mutating the script itself in a scratch copy with one uniquely-named file per mutant: 19 of 19 mutations exit 1, including shifting the min-free floor sum, making C6b's cap check fire spuriously, and making M11's witness satisfy the cap. TWO mutations were deliberately NOT run and the omissions are recorded: vacuity edits (`if FAILURES:` and C6b's cap condition replaced by `if False:`) are no-ops against a PASSING baseline, so running them would measure nothing.

Provenance

{
  "date": "2026-09-02",
  "curation": "curated",
  "established_by": "axeyum-lean-kernel build_nat_prelude (crates/axeyum-lean-kernel/src/nat_prelude/eisenstein_floor_min_free.rs)",
  "source": "formal.statement is taken verbatim from the kernel's own rendering (Kernel::render_lean of the admitted declaration type; the same string is pinned character for character in eisenstein_floor_min_free_tests.rs). depends_on is the direct-theorem column of theorem_dependency_inventory intersected with this ledger's registered facts, so it is an INTERSECTION and not the full dependency set. Nothing about the statement was hand transcribed; title, statement and the evidence notes were authored (lane eisenstein-3)."
}