Identifier
F:shipped-front-door-refutes-over-constructed-reals
Proof route
kernel-lean
External status
proved
Axiom footprint
Empty

Recorded description

prove_unsat_to_lean_module -- the public entry point that turns an unsatisfiable query into a self-contained Lean module -- dispatches ProofFragment::Lra, ProofFragment::DisjunctiveLra and ProofFragment::Sos to a reconstruction context whose ordered-ring carrier is CReal, the Bishop setoid of regular rational sequences, with the equality slot ADOPTED from CRealPrelude's own theorems rather than axiomatized. For each of three front-door fixtures the resulting proof of False has an axiom footprint consisting ONLY of the query's own variable and hypothesis axioms: zero carrier axioms, against 12, 17 and 8 for the identical refutation over the axiomatized AxReal package. This is a statement about what the shipped route runs, not about what it could run: the same claim over a hand-built context is F:farkas-refutation-over-constructed-reals.

Formal statement
For each fixture F, let p = reconstruct_{lra,sos}_proof(LraReconstructCtx::try_new_over_constructed_reals(), F). Then p : False in the kernel, and Kernel::axiom_footprint(p) contains no name outside the axeyum.reconstruct. namespace, while the same construction over LraReconstructCtx::try_new() (the AxReal package) contains 12, 17 and 8 such names respectively. Separately, prove_unsat_to_lean_module(F) emits a module declaring the constructed carrier and NOT `axiom AxReal : Sort`.

Dependencies

The graph shows direct ledger edges. Follow a node to open its artifact page.

Direct dependencies appear to the left. The current fact is in the center. Facts that depend directly on it appear to the right. A Farkas refutation closes over The 30 AxReal axioms are satisf Current fact No shipped reconstruction route
2 direct dependencies 1 direct dependents

Evidence

front-door-emits-the-constructed-carrier

Kind
kernel-term
Status
checked

Supports: All three fixtures routed through prove_unsat_to_lean_module emit a module naming the constructed carrier and not the axiomatized one.

Checker command
out=$(cargo run -q -p axeyum-solver --features full --example front_door_carrier 2>&1) && test "$(printf '%s\n' "$out" | grep -cE 'carrier CReal [(]constructed[)]$')" = 3 && test "$(printf '%s\n' "$out" | grep -cE 'carrier AxReal [(]AXIOMATIZED[)]$')" = 0
Evidence notes

Counts rather than greps: `grep -q` would pass on ONE surviving fixture if the other two regressed or were dropped, and the second test rules out a mixed result rather than inferring it from the first. The example decides the carrier by the module's carrier DECLARATION, because every `CReal.foo` name contains the substring `Real.foo` and a `contains("Real.lt")` test survives the flip unchanged -- one shipped test did exactly that and asserted nothing. The names in this paragraph are the OLD ones on purpose: ADR-0522 renamed the axiomatized package `Real` -> `AxReal` on 2026-08-19 precisely so that no such substring exists, and rewriting the sentence would erase the hazard it records. Two more sites were found that day by the rename alone, both green.

zero-carrier-axioms-through-the-front-door

Kind
kernel-term
Status
checked

Supports: Kernel::axiom_footprint of the shipped route's proof of False contains no carrier axiom on any fixture.

Checker command
out=$(cargo run -q -p axeyum-solver --features full --example front_door_carrier 2>&1) && test "$(printf '%s\n' "$out" | grep -cE '^[[:space:]]+over CReal : footprint [0-9]+ of which 0 are CARRIER axioms')" = 3
Evidence notes

The footprint SIZE is left free (2, 3, 5) because it is the query's own variables and hypotheses and legitimately differs per fixture; what is pinned is that none of it is carrier. Carrier is computed as the footprint minus the `axeyum.reconstruct.` namespace, which is where this route mints every axiom of its own, so the split cannot be gamed by renaming a carrier declaration.

the-real-control-is-not-vacuous

Kind
kernel-term
Status
checked

Supports: The same three queries over the axiomatized AxReal package carry 12, 17 and 8 carrier axioms, so the zero above is a reduction rather than a broken measurement.

Checker command
out=$(cargo run -q -p axeyum-solver --features full --example front_door_carrier 2>&1) && test "$(printf '%s\n' "$out" | grep -cE '^[[:space:]]+over AxReal: footprint [0-9]+ of which (12|17|8) are CARRIER axioms')" = 3 && test "$(printf '%s\n' "$out" | grep -cE '^[[:space:]]+over AxReal: footprint [0-9]+ of which 0 are CARRIER axioms')" = 0
Evidence notes

Without this row the fact would still pass if the AxReal route quietly stopped depending on its own axioms, which would mean the comparison had become trivial rather than that CReal had achieved anything. The second test is the explicit negative: no AxReal fixture may report zero.

the-emitted-module-declares-only-the-querys-own-axioms

Kind
kernel-term
Status
checked

Supports: The self-contained Lean module the front door returns declares 3, 5 and 2 axioms -- the query's own variables and hypotheses -- against 15, 22 and 10 for the same refutations over the AxReal package.

Checker command
out=$(cargo run -q -p axeyum-solver --features full --example front_door_carrier 2>&1) && test "$(printf '%s\n' "$out" | grep -xFc "the module's axiom lines equal the kernel footprint: true")" -ge 1 && test "$(printf '%s\n' "$out" | grep -cE 'over CReal : footprint [0-9]+ of which 0 are CARRIER axioms; module [0-9]+ bytes [(][0-9]+x[)], [0-9]+ .axiom. lines')" = 3
Evidence notes

The equality of the two counts is computed BY THE EXAMPLE, per fixture, over both carriers, and reported as its own verdict line -- a regex backreference was the first attempt and this host's `grep` does not support one, which would have made the row silently unrunnable. `grep -x` on the whole line including the trailing `true` because an unanchored match also accepts the `false` rendering. This row also refutes a claim recorded on 2026-08-18 in F:farkas-refutation-over-constructed-reals -- that a rendered module over CReal would emit the whole constructed development as axioms and defeat the claim. It does not: `write_lean_module_impl` emits every reachable inductive as a real Lean `inductive`, so the development contributes zero axiom lines and the module declares 3, 5 and 2 (the query's own) against 15, 22 and 10 over AxReal.

real-lean-accepts-the-module

Kind
kernel-term
Status
checked

Supports: The modules the flipped routes emit are accepted by the real Lean kernel, so the claim is not confined to this repository's own checker.

Checker command
cargo test -q -p axeyum-solver --features full --test lean_crosscheck -- --nocapture 2>&1 | awk -F'[|=]' '/^LEAN_CROSSCHECK/ {for (i = 2; i < NF; i += 2) v[$i] = $(i+1)} END {exit !(NR > 0 && v["modules"] + 0 > 0 && v["checked"] == v["modules"] && v["failed"] + 0 == 0 && v["budget_skipped"] + 0 == 0)}'
Evidence notes

awk rather than grep: `checked` MUST equal `modules` and `modules` must be nonzero, because the suite SKIPS itself when no `lean` binary is present and a row asserting only `failed=0` would pass on a host that checked nothing -- and this host's `grep` has no backreferences, so the equality cannot be written as a pattern. `END { exit ... }` with `NR > 0` also fails when the LEAN_CROSSCHECK line is absent entirely. Measured 2026-08-18 against lean 4.30.0: 77 of 77, 0 failed. This row is not decoration: the carrier flip initially FAILED it -- 5 of 77 modules rejected with `Unknown constant Int.natAbs`, because the renderer ordered an inductive by its own type while writing its constructors, which mention later definitions, inline. That defect is fixed in the same change and guarded by two kernel unit tests that need no `lean` binary.

the-verdict-lines-and-the-exit-status

Kind
kernel-term
Status
checked

Supports: The example's four aggregate verdicts, and an exit status that depends on all four.

Checker command
cargo run -q -p axeyum-solver --features full --example front_door_carrier -- --require-axiom-free >/dev/null 2>&1 && out=$(cargo run -q -p axeyum-solver --features full --example front_door_carrier 2>&1) && test "$(printf '%s\n' "$out" | grep -cxE "(shipped front door emits the CONSTRUCTED carrier|refutations over CReal rest on zero carrier axioms|the AxReal control is non-vacuous|the module's axiom lines equal the kernel footprint): true")" = 4
Evidence notes

Without `--require-axiom-free` the example exits 0 on a negative result, which is exactly the failure mode this ledger keeps finding; the flag is what makes the status depend on the finding. The four lines are counted, not grepped, so a dropped verdict is a failure rather than a quieter pass, and matched with `grep -x` including the trailing `true` so the `false` rendering of the same sentence cannot satisfy it.

Provenance

{
  "date": "2026-08-18",
  "established_by": "PreludeKey::CReal (ADR-0464) + LraReconstructCtx::try_new_over_constructed_reals; agent-creal-default lane; ADR-0512 phase R4",
  "source": "hand-built; Farkas' lemma and the SOS route over an ordered commutative ring, instantiated at a constructed carrier"
}