ldiff(m, 0) = m

Identifier: F:nat-ldiff-zero-right
Proof route: kernel-lean
External status: proved
Axiom footprint: Empty

Recorded description

The bitwise AND-NOT of any natural number m with 0 is m.

Formal statement

theorem Nat.ldiff_zero_right : ((x0 : AxNat) -> Eq.{1} AxNat (AxNat.ldiff x0 AxNat.zero) x0)

Dependencies

The graph shows direct ledger edges. Follow a node to open its artifact page.

1 direct dependencies 1 direct dependents

Evidence

kernel-Nat.ldiff_zero_right

Kind: kernel-term
Status: checked

Supports: ldiff(m, 0) = m

Checker command

test "$(cargo run -q -p axeyum-lean-kernel --example nat_theorem_inventory -- ldiff_zero_right 2>/dev/null | grep -Ec '^Nat\.ldiff_zero_right[[:space:]]')" -ge 1

Evidence notes

`build_nat_prelude` admits this theorem through the trusted `Kernel::add_declaration` gate, which re-checks the proof term against the stated type, so producing this row at all is a machine-checked proof. Unlike `ldiff_zero_left`, `ldiff m 0 = m` is not `refl` at symbolic `m` -- the outer `Nat.rec` on the fuel (which is `m` itself) is stuck until `m`'s constructor shape is exposed -- so the proof is by induction on `m`. Both the base and step case close by `Eq.refl`, with the induction hypothesis unused in the step: the `n = 0` guard is tested OUTERMOST in `ldiffAux`'s succ case (unchanged from `land`/`lor`, for the identical proof-cost reason -- see `nat_prelude::ldiff`'s module doc), so it collapses the whole term to `m` unchanged regardless of the (possibly symbolic) fuel predecessor. `nat_theorem_inventory` exits non-zero for a name that does not exist, and `grep -Ec` consumes the pipe and the count is tested, so the exit status depends on what the run found. Anchored with `^Nat\.ldiff_zero_right[[:space:]]` (verified exactly 1 row).

compute-Nat.ldiff_zero_right

Kind: kernel-term
Status: checked

Supports: the equation instantiates correctly and states the value m unchanged, not 0

Checker command

cargo test -p axeyum-lean-kernel --lib nat_prelude::nat_prelude_tests::ldiff_computes_and_its_boundary_theorems_apply

Evidence notes

`Kernel::def_eq` reduces `ldiff m 0` at m in {5, 1} to m directly (definition unfolding, no boundary theorem invoked), and separately confirms `Nat.ldiff_zero_right`'s ADMITTED TYPE (via `Kernel::infer`, instantiated at m = 9) is exactly `Eq (ldiff 9 0) 9` -- with a negative control asserting the inferred type must NOT def_eq `Eq (ldiff 9 0) 0` (the absorbing-zero-shaped wrong answer, i.e. `land`'s shape at this same boundary), so this cannot pass on a statement claiming the wrong value.

footprint-Nat.ldiff_zero_right

Kind: exhaustive-enumeration
Status: checked

Supports: axiom_footprint: [] -- the Nat prelude's trusted surface is empty

Checker command

cargo run -q -p axeyum-lean-kernel --example nat_axiom_inventory -- --require-axiom-free nat

Evidence notes

`nat_axiom_inventory --require-axiom-free nat` enumerates the built Nat environment and exits non-zero unless it admits no Axiom, Opaque or Quotient declaration. The induction used here is ordinary `Nat.rec` over `Prop`, the same combinator every other induction in this prelude uses; this command is what makes the axiom-freedom claim falsifiable rather than asserted.

Provenance

{
  "date": "2026-08-28",
  "established_by": "axeyum-lean-kernel build_nat_prelude, lane 226-nat-ldiff",
  "source": "one of four boundary/sanity theorems `declare_ldiff_all` (`crates/axeyum-lean-kernel/src/nat_prelude/ldiff.rs`) admits alongside the `Nat.ldiff`/`Nat.ldiffAux` definitions"
}