kernel-Nat.exists_prime_dvd
- Kind
- kernel-term
- Status
- checked
Supports: For every m with 2 <= m there is a prime p dividing m, with primality spelled inline.
test "$(cargo run -q -p axeyum-lean-kernel --example nat_theorem_inventory -- exists_prime_dvd 2>/dev/null | tr '\t' ' ' | grep -Fc 'Nat.exists_prime_dvd 4 ((x0 : AxNat) -> ((x1 : AxNat.le (AxNat.succ (AxNat.succ AxNat.zero)) x0) -> Exists.{1} AxNat (fun (x2 : AxNat) => And (And (AxNat.le (AxNat.succ (AxNat.succ AxNat.zero)) x2) (((x3 : AxNat) -> ((x4 : AxNat.dvd x3 x2) -> Or (Eq.{1} AxNat x3 (AxNat.succ AxNat.zero)) (Eq.{1} AxNat x3 x2))))) (AxNat.dvd x2 x0))))')" -ge 1 Evidence notes
The grep pins the WHOLE rendered type, not the name, and that is the point of this row rather than tidiness. `build_nat_prelude` admits the declaration through the trusted `Kernel::add_declaration` gate, which re-checks the proof term against the stated type -- so the kernel already refuses a false theorem, and a witness that was not prime (say `m` itself at `m = 6`) never gets in. What the kernel cannot notice is a statement that is WEAKER than intended. Measured 2026-08-17: spelling the primality lower bound `1 <= p` instead of `2 <= p` still type-checks, still admits, still passes every existing test including axiom-freedom and the determinism count -- and is satisfied by `p = 1`, whose only divisor is 1, which closes nothing. That mutation was run: exactly one test died (`every_number_at_least_two_has_a_prime_divisor`, which compares the admitted type against an independently built term) and 288 others passed. A name-only grep would have survived it, so this command greps the `AxNat.succ (AxNat.succ AxNat.zero)` bound inside the existential explicitly. `nat_theorem_inventory` additionally exits non-zero for a name that does not exist.