ldiff decodes through a bit-appended argument

Identifier: F:nat-ldiff-bit
Proof route: kernel-lean
External status: proved
Axiom footprint: Empty

Recorded description

For every Bool a, Nat m, Bool b, Nat n: ldiff(bit(a, m), bit(b, n)) = bit(a && !b, ldiff(m, n)).

Formal statement

theorem Nat.ldiff_bit : ((x0 : Bool) -> ((x1 : AxNat) -> ((x2 : Bool) -> ((x3 : AxNat) -> Eq.{1} AxNat (AxNat.ldiff (AxNat.bit x0 x1) (AxNat.bit x2 x3)) (AxNat.bit ((fun (x4 : Bool) => fun (x5 : Bool) => Bool.rec.{1} (fun (x6 : Bool) => Bool) Bool.false (Bool.rec.{1} (fun (x6 : Bool) => Bool) Bool.true Bool.false x5) x4) x0 x2) (AxNat.ldiff x1 x3))))))

Dependencies

The graph shows direct ledger edges. Follow a node to open its artifact page.

5 direct dependencies 0 direct dependents

Evidence

kernel-Nat.ldiff_bit

Kind: kernel-term
Status: checked

Supports: Nat.ldiff_bit is admitted by the trusted kernel gate with the type recorded in formal.statement.

Checker command

test "$(cargo run -q -p axeyum-lean-kernel --example nat_theorem_inventory -- ldiff_bit 2>/dev/null | grep -Ec '^Nat\.ldiff_bit[[:space:]]')" -ge 1

Evidence notes

`build_nat_prelude` admits this theorem only through the trusted `Kernel::add_declaration` gate, which re-checks the proof term against the stated type. `nat_theorem_inventory` exits non-zero for a name that does not exist, and `grep -Ec` consumes the pipe so the tested count decides the exit status. Anchored with `^Nat\.ldiff_bit[[:space:]]` so a future sibling cannot satisfy this row.

compute-Nat.ldiff_bit

Kind: kernel-term
Status: checked

Supports: ldiff(bit(true, 2), bit(false, 3)) = ldiff(5, 6) = 1 (0b101 AND NOT 0b110 = 0b101 AND 0b001 = 0b001), against bit(true && !false, ldiff(2, 3)) = bit(true, 0) = 1 (ldiff(2,3) = 0b10 AND NOT 0b11 = 0b10 AND 0b100 = 0) -- the SAME shared instance as F:nat-land-bit/F:nat-lor-bit (a=true, m=2, b=false, n=3): land gives 4, lor gives 7, ldiff gives 1 at identical operands, so a wrong-way combine does not land on 1 here.

Checker command

cargo test -p axeyum-lean-kernel --lib nat_prelude::nat_prelude_tests::ldiff_bit_applies_at_a_concrete_discriminating_instance

Evidence notes

Applies `Nat.ldiff_bit` both against fully free (a, m, b, n) -- by re-declaring the statement as a fresh closed theorem over Pi/lambda-bound variables and requiring the kernel admit it -- and at the concrete, bit-differing instance (a=true, m=2, b=false, n=3), confirming both instantiations compute to the stated values.

footprint-Nat.ldiff_bit

Kind: instance-pin
Status: checked

Supports: axiom_footprint: [] -- the Nat environment admits no trusted declaration

Checker command

cargo run -q -p axeyum-lean-kernel --example nat_axiom_inventory -- --require-axiom-free nat

Evidence notes

Reports `nat: axiom=0 opaque=0 quotient=0 total_trusted=0`, over the FULL trusted surface rather than `Declaration::Axiom` alone. The enumeration is per-environment, not per-theorem; it bounds this theorem's footprint because a proof cannot depend on a trusted declaration the environment does not contain.

Provenance

{
  "date": "2026-08-29",
  "established_by": "axeyum-lean-kernel build_nat_prelude, lane nat-lor-ldiff-bit",
  "source": "theorem name and canonical type read directly via nat_theorem_inventory, which prints render_lean of the admitted type."
}