a nonzero natural has a highest set bit, with every bit above it zero

Identifier: F:nat-exists-most-significant-bit
Proof route: kernel-lean
External status: Not recorded
Axiom footprint: Empty

Recorded description

For every natural n: if n != 0 then there is an index i such that testBit(n, i) = 1 and for every j > i, testBit(n, j) = 0.

Formal statement

theorem Nat.exists_most_significant_bit : ((x0 : AxNat) -> ((x1 : ((x1 : Eq.{1} AxNat x0 AxNat.zero) -> False)) -> Exists.{1} AxNat (fun (x2 : AxNat) => And (Eq.{1} AxNat (AxNat.testBit x0 x2) (AxNat.succ AxNat.zero)) (((x3 : AxNat) -> ((x4 : AxNat.lt x2 x3) -> Eq.{1} AxNat (AxNat.testBit x0 x3) AxNat.zero))))))

Dependencies

The graph shows direct ledger edges. Follow a node to open its artifact page.

1 direct dependencies 1 direct dependents

Evidence

kernel-Nat.exists_most_significant_bit

Kind: kernel-term
Status: checked

Supports: Nat.exists_most_significant_bit is admitted by the trusted kernel gate with the type recorded in formal.statement.

Checker command

cargo run -q --release -p axeyum-lean-kernel --example nat_theorem_inventory -- exists_most_significant_bit 2>/dev/null | grep -Ec '^Nat\.exists_most_significant_bit[[:space:]]'

Evidence notes

`build_nat_prelude` admits this theorem only through the trusted `Kernel::add_declaration` gate, which re-checks the proof term against the stated type. `nat_theorem_inventory` exits non-zero for a name that does not exist, and `grep -Ec` consumes the pipe so the tested count (expected >= 1) decides the exit status, never `grep -q` under pipefail. Anchored with `[[:space:]]`, never a literal tab. `--release` is mandatory: this tool builds `creal`/`complex`/`cpoint`, which overflow the default debug thread stack.

instance-Nat.exists_most_significant_bit

Kind: kernel-term
Status: checked

Supports: Applies at a CONCRETE discriminating instance (n := 5 = 101_2), confirming the witness's index 2 really has testBit 5 2 = 1 while testBit 5 1 is NOT 1 (ruling out an off-by-one or vacuous witness), AND symbolically at a genuinely FREE n with a free `n != 0` hypothesis, confirming the declared Exists shape independently of `bit_order.rs`'s own predicate-building helpers.

Checker command

cargo test -p axeyum-lean-kernel --lib nat_prelude::nat_prelude_tests::exists_most_significant_bit_applies_at_a_concrete_instance_and_symbolically

Evidence notes

The Exists shape is restated independently of `bit_order.rs`'s own `msb_predicate`/`msb_exists_ty` helpers rather than calling them, so a bug in those helpers could not be invisible to this check.

footprint-Nat.exists_most_significant_bit

Kind: instance-pin
Status: checked

Supports: axiom_footprint: [] -- the Nat environment admits no trusted declaration

Checker command

cargo run -q --release -p axeyum-lean-kernel --example nat_axiom_inventory -- --require-axiom-free nat

Evidence notes

Reports `nat: axiom=0 opaque=0 quotient=0 total_trusted=0`, over the FULL trusted surface rather than `Declaration::Axiom` alone. The enumeration is per-environment, not per-theorem; it bounds this theorem's footprint (and the fuel-generalized `Nat.msb_exists_of_le_fuel` it is built from) because a proof cannot depend on a trusted declaration the environment does not contain.

Provenance

{
  "date": "2026-08-29",
  "established_by": "axeyum-lean-kernel build_nat_prelude, lane nat-msb-hard",
  "source": "theorem name and canonical type read directly via nat_theorem_inventory, which prints render_lean of the admitted type."
}