DERIVED: Theorem named 'topological_entropy_exponential' in the v1_3_DriveMathFormalization_0521 family -- registry statement: CUB integration: cubie-core

Theorem topological_entropy_exponential : forall n, n < separatedOrbits n.


DERIVED: Lemma named 'two_pow_pos' in the v1_3_DriveMathFormalization_0521 family -- registry statement: CUB integration: cubie-core

Lemma two_pow_pos : forall n, 0 < 2 ^ n.

not stated in registry status for this row

(empty -- not bound to any bare-metal exec fn/crate)


DERIVED: Theorem named 'belnap_assoc' in the v1_4_BexarMetalFormalization_0521 family -- registry statement: CUB integration: cubie-core

Theorem belnap_assoc : forall a b c,
  belnapMeet (belnapMeet a b) c = belnapMeet a (belnapMeet b c).


DERIVED: Theorem named 'belnap_idem' in the v1_4_BexarMetalFormalization_0521 family -- registry statement: CUB integration: cubie-core

Theorem belnap_idem : forall a, belnapMeet a a = a. Proof. destruct a; reflexivity. Qed.


DERIVED: Theorem named 'belnap_top_unit' in the v1_4_BexarMetalFormalization_0521 family -- registry statement: CUB integration: cubie-core

Theorem belnap_top_unit : forall a, belnapMeet a true = a. Proof. destruct a; reflexivity. Qed.


DERIVED: Theorem named 'bounded_depth_bounds_exposure' in the v1_4_BexarMetalFormalization_0521 family -- registry statement: CUB integration: cubie-core

Theorem bounded_depth_bounds_exposure : forall N Dmax, N <= Dmax -> exposure N <= exposure Dmax.


DERIVED: Theorem named 'corner_consensus_weakest' in the v1_4_BexarMetalFormalization_0521 family -- registry statement: CUB integration: cubie-core

Theorem corner_consensus_weakest : forall j1 j2 j3,
  cornerConsensus j1 j2 j3 = true -> j1 = true /\ j2 = true /\ j3 = true.


DERIVED: Theorem named 'corners_independent' in the v1_4_BexarMetalFormalization_0521 family -- registry statement: CUB integration: cubie-core

Theorem corners_independent : writeOK true false = false /\ writeOK false true = false.


DERIVED: Theorem named 'crowd_le_exposure' in the v1_4_BexarMetalFormalization_0521 family -- registry statement: CUB integration: cubie-core

Theorem crowd_le_exposure : forall N, crowd N <= exposure N.


Coq: AXIOM-FREE (0 axioms, live coqc/coqchk-verified) | Lean: NOT AXIOM-FREE -- depends on: propext

0 axioms (Lean 4.30.0 print axioms: propext only, no sorryAx; Coq text scan: no Axiom/Admitted in coq/CubieBexarMetalV1_4Gap.v; coqc/coqchk not run in this workspace) [SUPERSEDED by live coqc/coqchk 2026-08-15: Print Assumptions confirms 'Closed under the global context' (0 axioms) via live coqc+coqchk in coqorg/coq:8.18, not a text scan -- see docs/evidence/2026-08-15_cub_coq_kernel_verification.md]

DERIVED: Theorem named 'denial_admit_iff_zero' in the v1_4_BexarMetalFormalization_0521 family -- registry statement: CUB integration: cubie-core

Theorem cub_3064_denial_admit_iff_zero : forall d, admits d = true <-> denialCode d = 0.

theorem cub_3064_denial_admit_iff_zero (d : Denial) : admits d = true ↔ denialCode d = 0

Coq kernel-checked 8.18.0 (coqc+coqchk live, 2026-08-15); Verus PENDING-VERUS-KERNEL; Lean kernel-checked 4.30.0

proof fn cub_3064_denial_admit_iff_zero(d: GapDenial)
    ensures gap_admits(d) <==> gap_denial_code(d) == 0

PENDING -- verus binary not on PATH in this workspace


DERIVED: Theorem named 'goodput_no_overcommit' in the v1_4_BexarMetalFormalization_0521 family -- registry statement: CUB integration: cubie-core

Theorem goodput_no_overcommit : forall pool cost, cost <= pool ->
  cost + (pool - cost) = pool /\ pool - cost <= pool.


DERIVED: Theorem named 'ha_fail_closed' in the v1_4_BexarMetalFormalization_0521 family -- registry statement: CUB integration: cubie-core

Theorem ha_fail_closed : forall base, appliedCost base false <= appliedCost base true.


DERIVED: Theorem named 'interface_count' in the v1_4_BexarMetalFormalization_0521 family -- registry statement: CUB integration: cubie-core

Theorem interface_count : interfaceSites = 48. Proof. reflexivity. Qed.


DERIVED: Theorem named 'interface_dominates' in the v1_4_BexarMetalFormalization_0521 family -- registry statement: CUB integration: cubie-core

Theorem interface_dominates :
  totalSites - interfaceSites = 6 /\ interfaceSites > totalSites - interfaceSites.


DERIVED: theorem named 'interface_law_8_over_9' in the v1_4_BexarMetalFormalization_0521 family -- registry statement: CUB integration: cubie-core

Theorem interface_law_8_over_9 : 9 * interfaceSites = 8 * totalSites. Proof. reflexivity. Qed.

theorem interface_law_8_over_9 : 9 * interfaceSites = 8 * totalSites


DERIVED: Lemma named 'mul_pow_eq' in the v1_4_BexarMetalFormalization_0521 family -- registry statement: CUB integration: cubie-core

Lemma mul_pow_eq : forall a b n, (a * b) ^ n = a ^ n * b ^ n.


DERIVED: Lemma named 'pow_le_pow_base' in the v1_4_BexarMetalFormalization_0521 family -- registry statement: CUB integration: cubie-core

Lemma pow_le_pow_base : forall a b n, a <= b -> a ^ n <= b ^ n.


DERIVED: Theorem named 'seam_exposed_ratio' in the v1_4_BexarMetalFormalization_0521 family -- registry statement: CUB integration: cubie-core

Theorem seam_exposed_ratio : forall N, 9 * seamExposed N = 8 * 54 ^ (N + 1).


DERIVED: Theorem named 'seam_requires_lineage' in the v1_4_BexarMetalFormalization_0521 family -- registry statement: CUB integration: cubie-core

Theorem seam_requires_lineage : forall jid jpur jtime jlin jver jsco,
  seam jid jpur jtime jlin jver jsco = true -> jlin = true.


DERIVED: theorem named 'signal_le_crowd' in the v1_4_BexarMetalFormalization_0521 family -- registry statement: CUB integration: cubie-core

Theorem signal_le_crowd : forall N, goldenPath N <= crowd N.

theorem signal_le_crowd (N : Nat) : goldenPath N ≤ crowd N


DERIVED: Theorem named 'signal_to_crowd_gap' in the v1_4_BexarMetalFormalization_0521 family -- registry statement: CUB integration: cubie-core

Theorem signal_to_crowd_gap : forall N, 5 ^ N * goldenPath N <= crowd N.


DERIVED: Theorem named 'signal_to_exposure_gap' in the v1_4_BexarMetalFormalization_0521 family -- registry statement: CUB integration: cubie-core

Theorem signal_to_exposure_gap : forall N, 10 ^ N * goldenPath N <= exposure N.


DERIVED: theorem named 'surface_decomposition' in the v1_4_BexarMetalFormalization_0521 family -- registry statement: CUB integration: cubie-core

Theorem surface_decomposition : 6 + 24 + 24 = 54. Proof. reflexivity. Qed.

theorem surface_decomposition : 6 + 24 + 24 = 54


DERIVED: Theorem named 'surface_spoofing_kill' in the v1_4_BexarMetalFormalization_0521 family -- registry statement: CUB integration: cubie-core

Theorem surface_spoofing_kill : forall jid jpur jtime jver jsco,
  seam jid jpur jtime false jver jsco = false.


DERIVED: Theorem named 'two_corner_decomposition' in the v1_4_BexarMetalFormalization_0521 family -- registry statement: CUB integration: cubie-core

Theorem two_corner_decomposition : forall deploy gpu,
  writeOK deploy gpu = true <-> deploy = true /\ gpu = true.


DERIVED: Theorem named 'vn_symmetry' in the v1_4_BexarMetalFormalization_0521 family -- registry statement: CUB integration: cubie-core

Theorem vn_symmetry : forall a b x, vnExtract a b = Some x -> vnExtract b a = Some (negb x).


DERIVED: Theorem named 'witness_64_byte_atomic' in the v1_4_BexarMetalFormalization_0521 family -- registry statement: CUB integration: cubie-core

Theorem witness_64_byte_atomic : fold_right Nat.add 0 fieldSizes = 64.


DERIVED: Lemma named 'andb_split_9' in the v3_0_CubieMaster_0517 family -- registry statement: CUB integration: cubie-core

Lemma andb_split_9 : forall a1 a2 a3 a4 a5 a6 a7 a8 a9 : bool,
  (a1 && a2 && a3 && a4 && a5 && a6 && a7 && a8 && a9) = true ->
  a1 = true /\ a2 = true /\ a3 = true /\ a4 = true /\ a5 = true
  /\ a6 = true /\ a7 = true /\ a8 = true /\ a9 = true.


DERIVED: theorem named 'interlock_count_false' in the v3_0_CubieMaster_0517 family -- registry statement: CUB integration: cubie-core

Lemma interlock_count_false :
  forall s n k,
    k <= n ->
    s k = Tamper ->
    interlock_count s n = false.

theorem interlock_count_false (s : Swarm) (n : Nat) :
    ∀ k, k ≤ n → s k = .tamper → interlock_count s n = false


propext (Lean); Coq Axioms:none expected (Print Assumptions)

DERIVED: Theorem named 'cub_3108_no_admission_without_credential' in the SF024CredentialGate family -- registry statement: SF-024 workload-credential egress gate

Theorem cub_3108_no_admission_without_credential :
  forall (cred : Credential) (verdict : bool),
    apply_sidecar Enforce cred verdict = Allow -> cred = true.

PENDING -- coqc/coqchk not on PATH in this workspace

theorem cub_3108_no_admission_without_credential (cred : Credential) (verdict : Bool)
    (h : applySidecar EgressMode.enforce cred verdict = EgressDecision.allow) : cred = true


DERIVED: Theorem named 'cub_3109_record_bumps_exactly_one_axis' in the SF024CredentialGate family -- registry statement: SF-025 saturating single-axis metering

Theorem cub_3109_record_bumps_exactly_one_axis :
  forall (t : UsageTally) (d : EgressDecision),
    (d = Allow ->
       admitted (record t d) = sat_add1 (admitted t) /\ denied (record t d) = denied t)
 /\ (d = Deny ->
       denied (record t d) = sat_add1 (denied t) /\ admitted (record t d) = admitted t).

theorem cub_3109_record_bumps_exactly_one_axis (t : UsageTally) (d : EgressDecision) :
    (d = EgressDecision.allow →
        (record t d).admitted = satAdd1 t.admitted ∧ (record t d).denied = t.denied)
    ∧ (d = EgressDecision.deny →
        (record t d).denied = satAdd1 t.denied ∧ (record t d).admitted = t.admitted)


DERIVED: Theorem named 'no_spoof_only_valid_verifies' in the OttFailClosedVerification family -- registry statement: SF-024 fail-closed OTT verification (SF #4)

Theorem cub_3110_no_spoof_only_valid_verifies :
  forall v : OttVerify,
    verified (credential_of v) = true <-> v = Valid.

theorem cub_3110_no_spoof_only_valid_verifies :
    forall v : OttVerify,
      (credentialOf v).verified = true <-> v = OttVerify.Valid

YES -- verified-locally (registry status)

Coq PENDING-COQ-KERNEL; Lean verified-locally


DERIVED: Theorem named 'fail_closed_default_is_enforce' in the OttFailClosedVerification family -- registry statement: SF-024 fail-closed OTT verification (SF #4)

Theorem cub_3111_fail_closed_default_is_enforce :
  resolve_gate_mode None = Enforce.

theorem cub_3111_fail_closed_default_is_enforce :
    resolveGateMode none = EgressMode.Enforce


DERIVED: Theorem named 'unverified_ott_denied_in_enforce' in the OttFailClosedVerification family -- registry statement: SF-024 fail-closed OTT verification (SF #4)

Theorem cub_3112_unverified_ott_denied_in_enforce :
  forall (v : OttVerify) (verdict : bool),
    v <> Valid ->
    gate Enforce (credential_of v) verdict = Deny.

theorem cub_3112_unverified_ott_denied_in_enforce :
    forall (v : OttVerify) (verdict : Bool),
      v ≠ OttVerify.Valid ->
      gate EgressMode.Enforce (credentialOf v) verdict = EgressDecision.Deny


DERIVED: Theorem named 'belnap_negate_involution' in the BelnapNegationLaws family -- registry statement: Corrected Belnap dual-operator negation laws (Wave 13B)

theorem cub_3114_belnap_negate_involution (a : Nat) (ha : cellValid a) :
    belnapNegate (belnapNegate a) = a

Coq+Lean+Verus verified-locally (Wave 13B correction)


DERIVED: Theorem named 'belnap_negate_fixed_points' in the BelnapNegationLaws family -- registry statement: Corrected Belnap dual-operator negation laws (Wave 13B)

theorem cub_3115_belnap_negate_fixed_points :
    belnapNegate CELL_TAMPER = CELL_TAMPER ∧
    belnapNegate CELL_FLUID = CELL_FLUID ∧
    belnapNegate CELL_FAIL  = CELL_PASS  ∧
    belnapNegate CELL_PASS  = CELL_FAIL


DERIVED: Theorem named 'belnap_negate_knowledge_meet_hom' in the BelnapNegationLaws family -- registry statement: Corrected Belnap dual-operator negation laws (Wave 13B)

theorem cub_3116_belnap_negate_knowledge_meet_hom (a b : Nat)
    (ha : cellValid a) (hb : cellValid b) :
    belnapNegate (knowledgeMeet a b) =
    knowledgeMeet (belnapNegate a) (belnapNegate b)


DERIVED: Theorem named 'belnap_negate_knowledge_join_hom' in the BelnapNegationLaws family -- registry statement: Corrected Belnap dual-operator negation laws (Wave 13B)

theorem cub_3117_belnap_negate_knowledge_join_hom (a b : Nat)
    (ha : cellValid a) (hb : cellValid b) :
    belnapNegate (knowledgeJoin a b) =
    knowledgeJoin (belnapNegate a) (belnapNegate b)


DERIVED: Theorem named 'belnap_negate_truth_de_morgan_meet' in the BelnapNegationLaws family -- registry statement: Corrected Belnap dual-operator negation laws (Wave 13B)

theorem cub_3118_belnap_negate_truth_de_morgan_meet (a b : Nat)
    (ha : cellValid a) (hb : cellValid b) :
    belnapNegate (truthMeet a b) =
    truthJoin (belnapNegate a) (belnapNegate b)


DERIVED: Theorem named 'belnap_negate_truth_de_morgan_join' in the BelnapNegationLaws family -- registry statement: Corrected Belnap dual-operator negation laws (Wave 13B)

theorem cub_3119_belnap_negate_truth_de_morgan_join (a b : Nat)
    (ha : cellValid a) (hb : cellValid b) :
    belnapNegate (truthJoin a b) =
    truthMeet (belnapNegate a) (belnapNegate b)


DERIVED: Theorem named 'runtime_negate_knowledge_de_morgan' in the BelnapNegationLaws family -- registry statement: Corrected Belnap dual-operator negation laws (Wave 13B)

theorem cub_3120_runtime_negate_knowledge_de_morgan (a b : Nat)
    (ha : cellValid a) (hb : cellValid b) :
    runtimeNegate (knowledgeMeet a b) =
    knowledgeJoin (runtimeNegate a) (runtimeNegate b)


DERIVED: Theorem named 'swap_negate_de_morgan_counterexample' in the BelnapNegationLaws family -- registry statement: Corrected Belnap dual-operator negation laws (Wave 13B)

theorem cub_3121_swap_negate_de_morgan_counterexample :
    belnapNegate (knowledgeMeet CELL_TAMPER CELL_FAIL) ≠
    knowledgeJoin (belnapNegate CELL_TAMPER) (belnapNegate CELL_FAIL)


AUDIT-ONLY row -- no theorem_name/statement in source; see wiring/invocation fields only.

AUDIT-ONLY -- no theorem_name in master_theorem_table.csv; kernel status not tracked at row level

AUDIT-ONLY (wiring/invocation only, no theorem_name/statement in source)


ported from cubie-research (PR #756, renumbered from 3122 collision)


none (Coq Print Assumptions: closed under global context x4; Lean #print axioms: no axioms x4)

DERIVED: Theorem named 'cub_3127b_cusum_channel_noninterference' in the HostSimPatchNonInterference family -- registry statement: host-sim (std;mock) patch soundness: CUSUM channel non-interference

Theorem cub_3127b_cusum_channel_noninterference :
  forall fs h1 h2 s k ht,
    map proj (run h1 s fs k ht) = map proj (run h2 s fs k ht).

theorem cub_3127b_cusum_channel_noninterference (fs : List Faces)
    (h1 h2 : HwState) (s k ht : Int) :
    (run h1 s fs k ht).map proj = (run h2 s fs k ht).map proj

proof fn cub_3127b_cusum_channel_noninterference(
    h1: HwState, h2: HwState, s: int, fs: Seq<Faces>, k: int, ht: int,
)
    ensures
        run(h1, s, fs, k, ht).len() == run(h2, s, fs, k, ht).len(),
        forall|i: int|
            0 <= i < run(h1, s, fs, k, ht).len() ==> proj(
                #[trigger] run(h1, s, fs, k, ht)[i],
            ) == proj(run(h2, s, fs, k, ht)[i]),
    decreases fs.len(),


Coq Axioms:none (coqchk 8.18 + Print Assumptions closed); propext (Lean)

DERIVED: Theorem named 'cub_3128_c2_verdict_monotone' in the WwtClassifierPriority family -- registry statement: WWT gateway classifier priority chain (alias CUB-CLASSIFIER-PRIORITY-001)

Theorem cub_3128_c2_verdict_monotone :
  forall i1 p1 sc1 m1 rt1 b1 i2 p2 sc2 m2 rt2 b2,
    trig_le i1 p1 sc1 m1 rt1 b1 i2 p2 sc2 m2 rt2 b2 = true ->
    N.leb (verdict_severity (classify_t i1 p1 sc1 m1 rt1 b1))
          (verdict_severity (classify_t i2 p2 sc2 m2 rt2 b2)) = true.

theorem cub_3128_c2_verdict_monotone
    (i1 p1 sc1 m1 rt1 b1 i2 p2 sc2 m2 rt2 b2 : Bool)
    (h : trigLe i1 p1 sc1 m1 rt1 b1 i2 p2 sc2 m2 rt2 b2 = true) :
    verdictSeverity (classifyT i1 p1 sc1 m1 rt1 b1)
      ≤ verdictSeverity (classifyT i2 p2 sc2 m2 rt2 b2)

proof fn cub_3128_c2_verdict_monotone()
    ensures
        forall|a: Trig, b: Trig|
            #[trigger] trig_le(a, b)
                ==> verdict_severity(classify_t(a)) <= verdict_severity(classify_t(b)),


none (Coq Print Assumptions: closed under global context x3; Lean #print axioms: propext only x6)

DERIVED: Theorem named 'cub_3132_b3_concrete_reachability' in the WwtWhereTenantBoundary family -- registry statement: WHERE face tenant-boundary detection: soundness + reachability + placement + CUSUM non-interference

Theorem cub_3132_b3_concrete_reachability :
  where_count (fun t s => negb (N.eqb t s)) [clean_req 1 2] = 1.

theorem cub_3132_b3_concrete_reachability :
    whereCount (fun t s => t != s) [cleanReq 1 2] = 1

proof fn cub_3132_b3_concrete_reachability()
    ensures
        where_count(|t: int, s: int| t != s, seq![clean_req(1, 2)]) == 1,


none (Coq Print Assumptions: closed under global context x9; coqchk Axioms:<none>; Lean #print axioms: core-only propext/Classical.choice/Quot.sound + 2 axiom-free; no sorryAx)

DERIVED: Theorem named 'cub_3133b_bounded_window' in the WwtSlidingWindowRateLimit family -- registry statement: wwt-gateway sliding-window per-key rate limiter (proofs-first; no runtime change)

Theorem cub_3133b_bounded_window : forall w limit s,
  tsorted s ->
  forall k t, count w k t (process_from w limit [] s) <= limit.

theorem cub_3133b_bounded_window (w limit : Nat) (s : List Event)
    (hs : tsorted s) (k t : Nat) :
    count w k t (processFrom w limit [] s) ≤ limit

pub proof fn cub_3133b_bounded_window(w: nat, limit: nat, s: Seq<Event>, k: nat, t: nat)
    requires
        tsorted(s),
    ensures
        count(w, k, t, process_from(w, limit, Seq::empty(), s)) <= limit,


none (Coq Print Assumptions: closed under global context x3; coqchk 8.18 Modules successfully checked; Lean #print axioms: propext + Quot.sound only; no sorryAx)

DERIVED: Theorem named 'cub_3137a_core_mask_is_shipping_constant' in the EpochRotationCoreMaskCC0 family -- registry statement: Epoch-rotation SHIPPING core mask at offset CC=0 (resolves audit P2-#14)

theorem cub_3137a_core_mask_is_shipping_constant :
    coreMaskFromBits = CORE_MASK_CC0


DERIVED: Theorem named 'drift_zero_iff_equal' in the TwinDriftMetric family -- registry statement: CUB-3138 twin-observation drift metric

Theorem drift_zero_iff_equal : forall t o, drift t o = 0 <-> t = o.

theorem drift_zero_iff_equal (t o : TwinState) : drift t o = 0 ↔ t = o


2 abstraction axioms Seam+SeamValid (coqchk context clean; Lean #print axioms: SeamValid only)

DERIVED: Theorem named 'cub_1940_seam_validity_append' in the SeamValidityAppend family -- registry statement: Seam validity: append decomposition (re-keyed from flat CUB-1940 seam-validity family)

Theorem cub_1940_seam_validity_append :
  forall xs ys : list Seam,
    all_seams_valid (xs ++ ys) <-> all_seams_valid xs /\ all_seams_valid ys.

theorem cub_1940_seam_validity_append :
    ∀ xs ys : List Seam,
      allSeamsValid (xs ++ ys) ↔ allSeamsValid xs ∧ allSeamsValid ys


DERIVED: Theorem named 'cub_1941_seam_validity_take' in the SeamValidityTake family -- registry statement: Seam validity: prefix (firstn) preservation (re-keyed from flat CUB-1941 seam-validity family)

Theorem cub_1941_seam_validity_take :
  forall (n : nat) (xs : list Seam),
    all_seams_valid xs -> all_seams_valid (firstn n xs).

theorem cub_1941_seam_validity_take :
    ∀ (xs : List Seam) (n : Nat),
      allSeamsValid xs → allSeamsValid (xs.take n)


DERIVED: Theorem named 'cub_1942_seam_validity_drop' in the SeamValidityDrop family -- registry statement: Seam validity: suffix (skipn) preservation (re-keyed from flat CUB-1942 seam-validity family)

Theorem cub_1942_seam_validity_drop :
  forall (n : nat) (xs : list Seam),
    all_seams_valid xs -> all_seams_valid (skipn n xs).

theorem cub_1942_seam_validity_drop :
    ∀ (xs : List Seam) (n : Nat),
      allSeamsValid xs → allSeamsValid (xs.drop n)


1 abstraction axiom SeamValid (Seam is Inductive; coqchk context clean; Lean #print axioms: SeamValid only)

DERIVED: Theorem named 'cub_1943_seam_validity_singleton' in the SeamValiditySingleton family -- registry statement: Seam validity: singleton characterization (re-keyed from flat CUB-1943 seam-validity family)

Theorem cub_1943_seam_validity_singleton :
  forall e : Seam, all_seams_valid [e] <-> SeamValid e.

theorem cub_1943_seam_validity_singleton :
    ∀ e : Seam, allSeamsValid [e] ↔ SeamValid e


1 abstraction axiom SeamValid (Seam is Inductive; coqchk context clean; Lean #print axioms: propext + SeamValid)

DERIVED: Theorem named 'cub_1944_seam_validity_reverse' in the SeamValidityReverse family -- registry statement: Seam validity: reversal preservation (re-keyed from flat CUB-1944 seam-validity family)

Theorem cub_1944_seam_validity_reverse :
  forall xs : list Seam, all_seams_valid xs <-> all_seams_valid (rev xs).

theorem cub_1944_seam_validity_reverse :
    ∀ (xs : List Seam), allSeamsValid xs ↔ allSeamsValid xs.reverse


none (coqchk Axioms: <none>; Lean #print axioms: propext + Classical.choice + Quot.sound, core omega footprint)

DERIVED: Theorem named 'cub_3166_poison_jump_old_accepts_new_rejects' in the SeqFreshnessWraparoundSafe family -- registry statement: Wraparound-safe sequence freshness (wave3 lane C repair of the replay.rs u64::MAX acceptance, P3-#553)

Theorem cub_3166_poison_jump_old_accepts_new_rejects :
  forall M w,
    1 < M -> w < M - 1 ->
    sequence_id_fresh_old 0 (M - 1) /\ ~ seq_fresh_wraparound_safe M 0 (M - 1) w.

theorem cub_3166_poison_jump_old_accepts_new_rejects (M w : Nat)
    (hM : 1 < M) (hw : w < M - 1) :
    sequenceIdFreshOld 0 (M - 1) ∧ ¬ seqFreshWraparoundSafe M 0 (M - 1) w

proof fn cub_3166_poison_jump_old_accepts_new_rejects(window: u64)
    requires
        window < u64::MAX,
    ensures
        spec_sequence_id_fresh_old_3166(0u64, u64::MAX),
        !spec_seq_fresh_wraparound_safe_3166(0u64, u64::MAX, window),


none (coqchk: Closed under the global context; Lean #print axioms: none)

DERIVED: Theorem named 'cub_3168_gateway_parity' in the GatewayCanonicalBinding family -- registry statement: Shared MCP and pre-inference gateway canonical binding, including explicit RuntimePlan, ShadowCubie, and mirror commitments

Theorem cub_3168_gateway_parity :
  forall expected mcp inference,
    binding_passes expected mcp ->
    binding_passes expected inference ->
    binding_matches mcp inference.

theorem cub_3168_gateway_parity
    (expected mcp inference : GatewayBinding)
    (hmcp : bindingPasses expected mcp)
    (hinference : bindingPasses expected inference) :
    bindingMatches mcp inference

pub proof fn cub_3168_gateway_parity(
    expected: GatewayBinding,
    mcp: GatewayBinding,
    inference: GatewayBinding,
)
    requires
        binding_passes(expected, mcp),
        binding_passes(expected, inference),
    ensures
        mcp.program == inference.program,
        mcp.topology == inference.topology,
        mcp.profile == inference.profile,
        mcp.policy == inference.policy,
        mcp.verifier == inference.verifier,
        mcp.runtime_plan == inference.runtime_plan,


none (coqchk closed; Lean #print axioms: none)

DERIVED: Theorem named 'cub_3169_allow_requires_solved_counts' in the RuntimeBareMetalAttestation family -- registry statement: Runtime bare-metal V2 attestation coherence

Theorem cub_3169_allow_requires_solved_counts :
  forall output faces seams vertices,
    coherent true output faces seams vertices = true ->
    output = true /\ faces = 6 /\ seams = 12 /\ vertices = 8.

theorem cub_3169_allow_requires_solved_counts
    (output : Bool) (faces seams vertices : Nat)
    (h : coherent true output faces seams vertices = true) :
    output = true ∧ faces = 6 ∧ seams = 12 ∧ vertices = 8

pub proof fn cub_3169_allow_requires_solved_counts(
    output_is_allow: bool,
    faces: u8,
    seams: u8,
    vertices: u8,
)
    requires coherent(true, output_is_allow, faces, seams, vertices),
    ensures
        output_is_allow,
        faces == 6,
        seams == 12,
        vertices == 8,


DERIVED: Theorem named 'cub_3170_match_iff_both_bytes_equal' in the RuntimeQecObservation family -- registry statement: Live QEC observation matches V2 attestation bytes

Theorem cub_3170_match_iff_both_bytes_equal :
  forall ls as_ lc ac,
    observation_matches ls as_ lc ac = true <-> ls = as_ /\ lc = ac.

theorem cub_3170_match_iff_both_bytes_equal (ls as_ lc ac : Nat) :
    observationMatches ls as_ lc ac = true ↔ ls = as_ ∧ lc = ac


DERIVED: Theorem named 'cub_3171_shadow_is_verdict_neutral' in the OpenvinoShadowSemantics family -- registry statement: OpenVINO shadow screening is observable and verdict-neutral

Theorem cub_3171_shadow_is_verdict_neutral :
  forall allowed why,
    egress_allowed (apply_shadow allowed why) = true
    /\ screened (apply_shadow allowed why) = true
    /\ shadow_denied (apply_shadow allowed why) = negb allowed
    /\ reason (apply_shadow allowed why) = why.

theorem cub_3171_shadow_is_verdict_neutral (allowed : Bool) (reason : Nat) :
    (applyShadow allowed reason).egressAllowed = true
    ∧ (applyShadow allowed reason).screened = true
    ∧ (applyShadow allowed reason).shadowDenied = !allowed
    ∧ (applyShadow allowed reason).reason = reason

pub proof fn cub_3171_shadow_is_verdict_neutral(verdict_allowed: bool, reason: u8)
    ensures
        apply_shadow(verdict_allowed, reason).egress_allowed,
        apply_shadow(verdict_allowed, reason).screened,
        apply_shadow(verdict_allowed, reason).shadow_denied == !verdict_allowed,
        apply_shadow(verdict_allowed, reason).reason == reason,


DERIVED: Theorem named 'cub_3172_only_satisfied_requirements_are_clean' in the MetadataRequirementsFailClosed family -- registry statement: Metadata proof requirements fail closed for declared artifacts and routes

Theorem cub_3172_only_satisfied_requirements_are_clean :
  forall missing required matches,
    metadata_requirement_code missing required matches = 0 ->
    missing = 0 /\ (required = false \/ matches = true).

theorem cub_3172_only_satisfied_requirements_are_clean
    (missing : Nat) (required routeMatches : Bool)
    (h : metadataRequirementCode missing required routeMatches = 0) :
    missing = 0 ∧ (required = false ∨ routeMatches = true)

pub proof fn cub_3172_only_satisfied_requirements_are_clean(
    missing: u16,
    route_required: bool,
    route_matches: bool,
)
    requires metadata_requirement_code(missing, route_required, route_matches) == 0,
    ensures
        missing == 0,
        !route_required || route_matches,


DERIVED: Theorem named 'agent_anomaly_iff_nonzero' in the AgentRuntimeObservation family -- registry statement: Agent detector syndrome and anomaly coherence

Theorem agent_anomaly_iff_nonzero :
  forall syndrome,
    agent_anomaly syndrome = true <-> syndrome <> 0%N.


DERIVED: Theorem named 'tenant_anomaly_iff_nonzero' in the TenantRuntimeObservation family -- registry statement: Datacenter detector syndrome and anomaly coherence

Theorem tenant_anomaly_iff_nonzero :
  forall syndrome,
    tenant_anomaly syndrome = true <-> syndrome <> 0%N.


DERIVED: Theorem named 'zero_capacity_is_undeclared' in the WorkflowCapacityDeclaration family -- registry statement: Workflow capacity must be explicitly nonzero

Theorem zero_capacity_is_undeclared : capacity_declared 0 0 = false.

theorem zero_capacity_is_undeclared : capacityDeclared 0 0 = false

proof fn zero_capacity_is_undeclared()
    ensures !capacity_declared(0, 0),


DERIVED: Theorem named 'unready_allow_is_rejected' in the TdxPreAdmitFailClosed family -- registry statement: TDX ingress gates admission and fails closed

Theorem unready_allow_is_rejected : tdx_fail_closed false true = false.

theorem unready_allow_is_rejected : tdxFailClosed false true = false

proof fn unready_allow_is_rejected()
    ensures !tdx_fail_closed(false, true),


DERIVED: Theorem named 'any_failed_descriptor_gate_rejects' in the EpochDescriptorRuntime family -- registry statement: Epoch descriptor runtime gates form one fail-closed readiness decision

Theorem any_failed_descriptor_gate_rejects :
  epoch_descriptor_ready false true true = false /\
  epoch_descriptor_ready true false true = false /\
  epoch_descriptor_ready true true false = false.

theorem any_failed_descriptor_gate_rejects :
    And (epochDescriptorReady false true true = false)
      (And (epochDescriptorReady true false true = false)
        (epochDescriptorReady true true false = false))

proof fn any_failed_descriptor_gate_rejects()
    ensures
        !epoch_descriptor_ready(false, true, true),
        !epoch_descriptor_ready(true, false, true),
        !epoch_descriptor_ready(true, true, false),


DERIVED: Theorem named 'above_maximum_days_reject' in the OscalCivilDateBounds family -- registry statement: OSCAL civil-date conversion ends at RFC3339 year 9999

Theorem above_maximum_days_reject :
  forall days, 2932896 < days -> ~ civil_days_supported days.

theorem above_maximum_days_reject (days : Int) (h : 2932896 < days) :
    Not (civilDaysSupported days)


DERIVED: Theorem named 'any_nonzero_report_type_byte_rejects' in the TdxReportType family -- registry statement: TDX report type accepts only a zero 64-bit REPORTTYPE field

Theorem any_nonzero_report_type_byte_rejects :
  report_type_is_tdx true false false false false false false false = false /\
  report_type_is_tdx false true false false false false false false = false /\
  report_type_is_tdx false false true false false false false false = false /\
  report_type_is_tdx false false false true false false false false = false /\
  report_type_is_tdx false false false false true false false false = false /\
  report_type_is_tdx false false false false false true false false = false /\
  report_type_is_tdx false false false false false false true false = false /\
  report_type_is_tdx false false false false false false false true = false.

theorem any_nonzero_report_type_byte_rejects :
    And (reportTypeIsTdx true false false false false false false false = false)
      (And (reportTypeIsTdx false true false false false false false false = false)
        (And (reportTypeIsTdx false false true false false false false false = false)
          (And (reportTypeIsTdx false false false true false false false false = false)
            (And (reportTypeIsTdx false false false false true false false false = false)
              (And (reportTypeIsTdx false false false false false true false false = false)
                (And (reportTypeIsTdx false false false false false false true false = false)
                  (reportTypeIsTdx false false false false false false false true = false)))))))


DERIVED: Theorem named 'missing_governance_precondition_rejects' in the GovernanceRuntimeAllow family -- registry statement: Governance preserves allow only with a healthy precondition

Theorem missing_governance_precondition_rejects :
  governance_allow false false = false /\
  governance_allow false true = false.

theorem missing_governance_precondition_rejects :
    And (governanceAllow false false = false)
      (governanceAllow false true = false)

proof fn missing_governance_precondition_rejects()
    ensures
        !governance_allow(false, false),
        !governance_allow(false, true),


DERIVED: Theorem named 'changed_policy_hash_rejects' in the GovernancePolicyHash family -- registry statement: Governance policy hash equality is byte-complete and fail-closed

Theorem changed_policy_hash_rejects :
  governance_policy_hash_equal false = false.

theorem changed_policy_hash_rejects :
    governancePolicyHashEqual false = false

proof fn changed_policy_hash_rejects()
    ensures !governance_policy_hash_equal(false),


DERIVED: Theorem named 'outside_freshness_window_rejects' in the IdentityFreshness family -- registry statement: Identity temporal coherence is symmetric and bounded

Theorem outside_freshness_window_rejects :
  forall drift window,
    drift > window ->
    identity_fresh drift window = false.

theorem outside_freshness_window_rejects
    (drift window : Nat) (h : window < drift) :
    identityFresh drift window = false

proof fn outside_freshness_window_rejects(drift: nat, window: nat)
    requires drift > window,
    ensures !identity_fresh(drift, window),


DERIVED: Theorem named 'trusted_vlan_implies_allowed' in the SentinelGate family -- registry statement: Trusted VLAN routing requires the full sentinel gate

Theorem trusted_vlan_implies_allowed :
  forall allowed failed_percolation_only,
    sentinel_target_vlan allowed failed_percolation_only = 100 ->
    allowed = true.

theorem trusted_vlan_implies_allowed (allowed failedPercolationOnly : Bool)
    (h : sentinelTargetVlan allowed failedPercolationOnly = 100) :
    allowed = true

proof fn trusted_vlan_implies_allowed(allowed: bool, failed_percolation_only: bool)
    ensures sentinel_target_vlan(allowed, failed_percolation_only) == 100 ==> allowed,


DERIVED: Theorem named 'out_of_range_step_rejects' in the PriorStepMask family -- registry statement: Orchestrator step masks enforce shift bounds before proof invocation

Theorem out_of_range_step_rejects :
  forall step_id,
    step_id >= 32 ->
    orchestrator_step_in_domain step_id = false.

theorem out_of_range_step_rejects
    (stepId : Nat) (h : 32 <= stepId) :
    orchestratorStepInDomain stepId = false

proof fn out_of_range_step_rejects(step_id: nat)
    requires step_id >= 32,
    ensures !orchestrator_step_in_domain(step_id),


DERIVED: Theorem named 'denied_byte_is_zero' in the MintDenyAirgap family -- registry statement: A denied ephemeral mint emits no key or quote bytes

Theorem denied_byte_is_zero :
  forall candidate,
    mint_output_byte false candidate = 0.

theorem denied_byte_is_zero (candidate : Nat) :
    mintOutputByte false candidate = 0

proof fn denied_byte_is_zero(candidate: u8)
    ensures mint_output_byte(false, candidate) == 0u8,


DERIVED: Theorem named 'excessive_steps_reject' in the BoundedGrgRuntime family -- registry statement: Checked GRG recurrence rejects excessive work and arithmetic overflow

Theorem excessive_steps_reject :
  forall n,
    n > 64 ->
    runtime_accepts_steps n = false.

theorem excessive_steps_reject (n : Nat) (h : 64 < n) :
    runtimeAcceptsSteps n = false

proof fn excessive_steps_reject(n: nat)
    requires n > 64,
    ensures !runtime_accepts_steps(n),


DERIVED: Theorem named 'mask_one_iff_all_gates' in the FourGateMask family -- registry statement: Four-gate constant-time mask is one iff every gate passes

Theorem mask_one_iff_all_gates :
  forall gpu_ok hmac_ok pcie_ok consent_ok,
    four_gate_mask gpu_ok hmac_ok pcie_ok consent_ok = 1 <->
    gpu_ok = true /\ hmac_ok = true /\ pcie_ok = true /\ consent_ok = true.

theorem mask_one_iff_all_gates
    (gpuOk hmacOk pcieOk consentOk : Bool) :
    fourGateMask gpuOk hmacOk pcieOk consentOk = 1 ↔
      gpuOk = true ∧ hmacOk = true ∧ pcieOk = true ∧ consentOk = true

proof fn mask_one_iff_all_gates(
    gpu_ok: bool,
    hmac_ok: bool,
    pcie_ok: bool,
    consent_ok: bool,
)
    ensures
        (four_gate_mask(gpu_ok, hmac_ok, pcie_ok, consent_ok) == 1)
            <==> (gpu_ok && hmac_ok && pcie_ok && consent_ok),


DERIVED: Theorem named 'below_threshold_not_shattered' in the MetaCubeShatter family -- registry statement: Meta-cube shatter latches exactly at its bounce threshold

Theorem below_threshold_not_shattered :
  forall bounces threshold,
    bounces < threshold ->
    shatter_latched bounces threshold = false.

theorem below_threshold_not_shattered
    (bounces threshold : Nat) (h : bounces < threshold) :
    shatterLatched bounces threshold = false

proof fn below_threshold_not_shattered(bounces: nat, threshold: nat)
    requires bounces < threshold,
    ensures !shatter_latched(bounces, threshold),


DERIVED: Theorem named 'cub_3189_shard_frontier' in the StickerCompilerShardLowerBound family -- registry statement: K_lower is the minimum shard count and no placement fits below it

Theorem cub_3189_shard_frontier :
  forall k ra rp rt, fits3 k ra rp rt <-> k >= k_lower3 ra rp rt.

theorem cub_3189_shard_frontier (k a p t : Nat) :
    CapacityHolds k a p t ↔ k ≥ kLower a p t

consumed during keyed precompile and independently recomputed when the signed compiled-sticker store loads; the request ledger carries the resulting receipt digest

abstract mirrors plus exact runtime observations, not executable theorem calls; invalid bundle/digest/observation refuses store activation before request forwarding

pub proof fn cub_3189_shard_frontier(k: int, ra: int, rp: int, rt: int)
    ensures
        fits3(k, ra, rp, rt) <==> k >= k_lower3(ra, rp, rt),


DERIVED: Theorem named 'cub_3190_bound_achieved' in the StickerCompilerConstructiveKLower family -- registry statement: The K_lower shard bound is achievable in the abstract lattice (fits at k=K_lower)

Theorem cub_3190_bound_achieved :
  forall ra rp rt, fits3 (k_lower3 ra rp rt) ra rp rt.

theorem cub_3190_bound_achieved (a p t : Nat) : CapacityHolds (kLower a p t) a p t

pub proof fn cub_3190_bound_achieved(ra: int, rp: int, rt: int)
    ensures
        fits3(k_lower3(ra, rp, rt), ra, rp, rt),


DERIVED: Theorem named 'cub_3191_alias_resolves' in the StickerCompilerAliasResolution family -- registry statement: Canonical shared-metric alias resolution: consistent references to one metric resolve to one version

Theorem cub_3191_alias_resolves :
  forall m1 v1 m2 v2 : nat,
    m1 = m2 -> (m1 = m2 -> v1 = v2) -> v1 = v2.

theorem cub_3191_alias_resolves (m1 v1 m2 v2 : Nat)
    (hm : m1 = m2) (h : m1 = m2 → v1 = v2) : v1 = v2

pub proof fn cub_3191_alias_resolves(m1: int, v1: int, m2: int, v2: int)
    requires
        m1 == m2,
        alias_ok(m1, v1, m2, v2),
    ensures
        v1 == v2,


DERIVED: Theorem named 'cub_3192_complete_iff' in the StickerCompilerPlacementGrade family -- registry statement: Placement grade never exceeds total and is complete iff every item is realised

Theorem cub_3192_complete_iff :
  forall ga gp gt na np nt,
    ga <= na -> gp <= np -> gt <= nt ->
    (grade ga gp gt = na + np + nt <-> (ga = na /\ gp = np /\ gt = nt)).

theorem cub_3192_complete_iff (ga gp gt na np nt : Nat)
    (ha : ga ≤ na) (hp : gp ≤ np) (ht : gt ≤ nt) :
    grade ga gp gt = na + np + nt ↔ (ga = na ∧ gp = np ∧ gt = nt)

pub proof fn cub_3192_complete_iff(
    ga: int, gp: int, gt: int,
    na: int, np: int, nt: int,
)
    requires
        0 <= ga <= na,
        0 <= gp <= np,
        0 <= gt <= nt,
    ensures
        (grade(ga, gp, gt) == total(na, np, nt)) <==> (ga == na && gp == np && gt == nt),


DERIVED: Theorem named 'cub_3193_mismatch_detected' in the StickerCompilerVerifierDivergence family -- registry statement: Any mismatch among the recomputed commitment fields implies not-verified (divergence)

Theorem cub_3193_mismatch_detected :
  forall rk dk rs ds rh dh,
    (rk <> dk \/ rs <> ds \/ rh <> dh) -> ~ verified rk dk rs ds rh dh.

theorem cub_3193_mismatch_detected (rk dk rs ds rh dh : Nat)
    (h : rk ≠ dk ∨ rs ≠ ds ∨ rh ≠ dh) : ¬ Verified rk dk rs ds rh dh

pub proof fn cub_3193_mismatch_detected(
    rk: int, dk: int, rs: int, ds: int, rh: int, dh: int,
)
    requires
        rk != dk || rs != ds || rh != dh,
    ensures
        !verified(rk, dk, rs, ds, rh, dh),


DERIVED: Theorem named 'cub_3194_unsupported_forbids_pass' in the StickerCompilerVerdictBoundary family -- registry statement: PASS requires supported+approved+non-contradictory; unsupported forbids PASS

Theorem cub_3194_unsupported_forbids_pass :
  forall s a c, s = false -> ~ pass_ok s a c.

theorem cub_3194_unsupported_forbids_pass (s a c : Bool) (h : s = false) :
    ¬ PassOk s a c

pub proof fn cub_3194_unsupported_forbids_pass(s: bool, a: bool, c: bool)
    requires
        !s,
    ensures
        !pass_ok(s, a, c),


none (coqchk Axioms: <none>; Lean core omega footprint)

DERIVED: Theorem named 'admit_all_sound' in the LeaseComposition family -- registry statement: Assume-guarantee lease composition: child narrows parent scope AND sum(sibling budgets) <= parent budget => tree-wide containment; runtime LeaseTree::add_child fail-closes scope-widening/over-budget children

Theorem admit_all_sound :
  forall l parent committed c',
    committed <= parent ->
    admit_all parent committed l = Some c' ->
    c' <= parent /\ c' = committed + sum l.


DERIVED: Theorem named 'fuse_assoc_64' in the BelnapFusionMonoid family -- registry statement: Belnap evidence-fusion monoid (Omega join): associativity/commutativity/idempotence, identity TAMPER, absorber FLUID

Theorem fuse_assoc_64 : forall a b c, fuse (fuse a b) c = fuse a (fuse b c).

theorem fuse_assoc_64 : ∀ a b c, fuse (fuse a b) c = fuse a (fuse b c)


DERIVED: Theorem named 'gauge_invariance' in the BelnapGaugeMonotone family -- registry statement: Gauge invariance (PASS/FAIL channel-swap automorphism) + knowledge-order monotonicity of the fusion join

Theorem gauge_invariance : forall a b, gauge (fuse a b) = fuse (gauge a) (gauge b).

theorem gauge_invariance : ∀ a b, gauge (fuse a b) = fuse (gauge a) (gauge b)

proof fn gauge_invariance(a: u8, b: u8)
    ensures gauge(fuse(a, b)) == fuse(gauge(a), gauge(b)),


DERIVED: Theorem named 'cert_survival' in the ScenarioBound family -- registry statement: Finite-class scenario certificate predicate cert(C n en ed dn dd) := C*(ed-en)^n*dd <= dn*ed^n: reflection (boolean = integer inequality) + monotonicity in samples and eps; PAC out-of-sample probability interpretation is cited provenance NOT a proved theorem

Theorem cert_survival : forall C n en ed dn dd,
  cert C n en ed dn dd = true <->
  C * (ed - en) ^ n * dd <= dn * ed ^ n.

theorem cert_survival (w n en ed dn : Nat) :
    cert w n en ed dn = true ↔ certP w n en ed dn


DERIVED: Theorem named 'u0_vote_inadmissible' in the UnifiedCapstone family -- registry statement: Unified admission capstone: V(cells)=fold-fuse join (order-independent, monotone, gauge-invariant); LEMMA U0 the majority-3 vote is inadmissible (non-monotone) so the join replaces it by necessity; total deterministic 4-way AdmissionDecision projection; Admit gated on clause-4 risk (CUB-3198) + clause-5 lease (CUB-3195) witnesses

Theorem u0_vote_inadmissible : ~ admissible maj3.

theorem u0_vote_inadmissible : ¬ admissible maj3


DERIVED: Theorem named 'cub_3200_present_pass_or_fail' in the StickerRuntimeCellEquality family -- registry statement: Present-value runtime cell equals the abstraction projection of the transformed field (PASS/FAIL only; never FLUID/TAMPER)

Theorem cub_3200_present_pass_or_fail :
  forall kind param norm,
    presentVerdictTag kind param norm = tag_pass
    \/ presentVerdictTag kind param norm = tag_fail.

theorem cub_3200_present_pass_or_fail (t v : Int) :
    presentVerdictTagGe t v = tagPass ∨ presentVerdictTagGe t v = tagFail

pub proof fn cub_3200_present_pass_or_fail(kind: int, param: int, norm: int)
    ensures
        present_verdict_tag(kind, param, norm) == tag_pass()
            || present_verdict_tag(kind, param, norm) == tag_fail(),


DERIVED: Theorem named 'cub_3201_offset_monotone' in the StickerRuntimeTransformTotality family -- registry statement: TransformV1::apply is a total panic-free fixed-point: clamp stays in range and is idempotent, Offset saturates and is monotone, zero denominator degrades to identity

Theorem cub_3201_offset_monotone :
  forall lo hi r1 r2 delta,
    lo <= hi -> r1 <= r2 -> satAdd lo hi r1 delta <= satAdd lo hi r2 delta.

theorem cub_3201_offset_monotone (lo hi r1 r2 delta : Int)
    (h : lo ≤ hi) (hr : r1 ≤ r2) :
    satAdd lo hi r1 delta ≤ satAdd lo hi r2 delta

pub proof fn cub_3201_offset_monotone(r1: int, r2: int, delta: int, lo: int, hi: int)
    requires
        r1 <= r2,
        lo <= hi,
    ensures
        sat_add(r1, delta, lo, hi) <= sat_add(r2, delta, lo, hi),


DERIVED: Theorem named 'cub_3202_ge_lt_complement' in the StickerRuntimeAbstractionTotality family -- registry statement: AbstractionV1::apply is a total deterministic projection to a cell state; ThresholdGe and ThresholdLt are exact complements at every value

Theorem cub_3202_ge_lt_complement :
  forall t v, abstPass 1 t v = negb (abstPass 2 t v).

theorem cub_3202_ge_lt_complement (t v : Int) : PassGe t v ↔ ¬ PassLt t v

pub proof fn cub_3202_ge_lt_complement(t: int, v: int)
    ensures
        abst_pass(1, t, v) == !abst_pass(2, t, v),


DERIVED: Theorem named 'cub_3203_pass_iff_all_pass' in the StickerRuntimeVerdictLattice family -- registry statement: Verdict composition is the TAMPER>FAIL>FLUID>PASS max-lattice: PASS only if every cell passes, any FLUID/TAMPER forbids PASS, composition is monotone

Theorem cub_3203_pass_iff_all_pass :
  forall a b,
    tag_pass <= a <= tag_tamper -> tag_pass <= b <= tag_tamper ->
    (vmax a b = tag_pass <-> (a = tag_pass /\ b = tag_pass)).

theorem cub_3203_pass_iff_all_pass (a b : Int)
    (ha : tagPass ≤ a ∧ a ≤ tagTamper) (hb : tagPass ≤ b ∧ b ≤ tagTamper) :
    vmax a b = tagPass ↔ (a = tagPass ∧ b = tagPass)

pub proof fn cub_3203_pass_iff_all_pass(a: int, b: int)
    requires
        tag_pass() <= a <= tag_tamper(),
        tag_pass() <= b <= tag_tamper(),
    ensures
        (vmax(a, b) == tag_pass()) <==> (a == tag_pass() && b == tag_pass()),


DERIVED: Theorem named 'cub_3204_order_sensitive' in the StickerRuntimeReceiptDeterminism family -- registry statement: Decision receipt is a deterministic, order-sensitive, program-hash-binding commitment over the program hash and ordered cell outcomes

Theorem cub_3204_order_sensitive :
  forall ph c0 c1, c0 <> c1 -> commit2 ph c0 c1 <> commit2 ph c1 c0.

theorem cub_3204_order_sensitive (ph c0 c1 : Int) (h : c0 ≠ c1) :
    commit2 ph c0 c1 ≠ commit2 ph c1 c0

pub proof fn cub_3204_order_sensitive(ph: int, c0: int, c1: int)
    requires
        c0 != c1,
    ensures
        commit2(ph, c0, c1) != commit2(ph, c1, c0),


DERIVED: Theorem named 'delta_fold_coherence' in the DeltaFoldCoherence family -- registry statement: Delta-fold coherence + streaming/batch representation independence: fold_left(fuse,l,acc)=fold_right(fuse,acc,l); V_from(acc,l++d)=fuse(V_from(acc,l),V(d)); verdict invariant under ANY evidence-list permutation (full S_n, extending CUB-3199's adjacent-swap generator); appending a delta never lowers knowledge; FLUID is a stream trap state

Theorem delta_fold_coherence : forall acc l d,
  verdict_from acc (l ++ d) = fuse (verdict_from acc l) (verdict d).

theorem delta_fold_coherence (acc : Cell) (l d : List Cell) :
    verdictFrom acc (l ++ d) = fuse (verdictFrom acc l) (verdict d)


DERIVED: Theorem named 'cub_3206_tighten_only' in the CubieOperatorResourceHotGateV1_0 family -- registry statement: OperatorResource hot-gate tighten-only + MMIO enforce authorization

theorem cub_3206_tighten_only (current proposed : Nat)
    (hc : validVerdictRank current) (hp : validVerdictRank proposed) :
    (tightenVerdictRank current proposed).2 = true →
      (tightenVerdictRank current proposed).1 > current ∧
      (tightenVerdictRank current proposed).1 = proposed

proof fn cub_3206_tighten_only(current: u8, proposed: u8)
    requires
        valid_verdict_rank(current),
        valid_verdict_rank(proposed),
    ensures
        (


DERIVED: Theorem named 'cell_meet' in the CubieAntiUpgradeCellMeetV1_0 family -- registry statement: Anti-upgrade cell meet bound to shipping snap


DERIVED: Theorem named 'cub_3208_compose_pass_nonempty' in the CubieEvidenceNonVacuityV1_0 family -- registry statement: Empty witness set / empty cell fold cannot PASS; shipping evidence_nonempty + compose gate

Theorem cub_3208_compose_pass_nonempty :
  forall cells : list Verdict, fst (compose cells) = VPass -> cells <> [].

theorem cub_3208_compose_pass_nonempty (cells : List Verdict)
    (h : (compose cells).fst = Verdict.pass) : cells ≠ []


DERIVED: Theorem named 'cub_3209_compile_verified_requires_verified' in the CubieVerifiedStickerProgramV1_0 family -- registry statement: VerifiedStickerProgram capability; evaluate requires verify_into_capability/compile_verified

Theorem cub_3209_compile_verified_requires_verified :
  forall (co : CompileOutcome) (verify : nat -> VerifyResult)
         (c : VerifiedProgram),
    compile_verified co verify = Some c ->
    exists p, co = Compiled p /\ verify p = Verified.

theorem cub_3209_compile_verified_requires_verified
    (co : CompileOutcome) (verify : Nat → VerifyResult) (c : VerifiedProgram)
    (h : compileVerified co verify = some c) :
    ∃ p, co = CompileOutcome.compiled p ∧ verify p = VerifyResult.verified


DERIVED: Theorem named 'cub_3210_scale_some_nonzero' in the CubieScaleNonZeroTransformV1_0 family -- registry statement: TransformV1::scale rejects den==0 (NonZeroI64); invalid policy fails construction

Theorem cub_3210_scale_some_nonzero :
  forall num den p, scale num den = Some p -> den <> 0.

theorem cub_3210_scale_some_nonzero (num den : Int) (p : Int × Int)
    (h : scale num den = some p) : den ≠ 0


DERIVED: Theorem named 'peak_kv_bound_soundness' in the WorkloadBoundPeakKv family -- registry statement: Peak KV V1 bound soundness

consumed only when OperatorResource receipt assembly executes; the runtime and its kill switch can disable that path

receipt and logical container bind the bundle; invalid integrity degrades to Unavailable; ProofStatusV1 stays NotBound/NotVerified


DERIVED: Theorem named 'candidate_feasibility_recompute' in the WorkloadBoundFeasibility family -- registry statement: Candidate feasibility recompute


DERIVED: Theorem named 'equality_implies_optimality' in the WorkloadBoundEquality family -- registry statement: Equality implies optimality label


DERIVED: Theorem named 'workload_bound_trichotomy' in the WorkloadBoundTrichotomy family -- registry statement: Comparison trichotomy


DERIVED: Theorem named 'digest_unit_consistency' in the WorkloadBoundDigestUnits family -- registry statement: Digest and unit consistency


DERIVED: Theorem named 'peak_kv_monotone_tokens' in the WorkloadBoundMonotonicity family -- registry statement: Workload monotonicity

Theorem peak_kv_monotone_tokens :
  forall L Hkv D B T1 T2,
    T1 <= T2 ->
    peak_kv L Hkv D T1 B <= peak_kv L Hkv D T2 B.

theorem peak_kv_monotone_tokens (L Hkv D B T1 T2 : Nat) (h : T1 ≤ T2) :
    peakKv L Hkv D T1 B ≤ peakKv L Hkv D T2 B


DERIVED: Theorem named 'overflow_fail_closed' in the WorkloadBoundOverflow family -- registry statement: Overflow fail-closed


DERIVED: Theorem named 'in_canonical_domain' in the CubieCanonicalDomainV1_0 family -- registry statement: Canonical topology domain membership bound to CanonicalTopologyState::new


DERIVED: Theorem named 'cell_meet' in the CubieResolutionAuthorityV1_0 family -- registry statement: Resolution authority: PASS meet requires a PASS witness operand


DERIVED: Theorem named 'placement_cell_in_range' in the CubiePlacementCellSafetyV1_0 family -- registry statement: Placement cell-domain safety + typed placement boundary


DERIVED: Theorem named 'compose' in the CubieVerdictFoldGeneralityV1_0 family -- registry statement: Verdict-fold generality: order-independent reduction with empty=NoEvidence


DERIVED: Theorem named 'lane_receipt_set_v2' in the LaneReceiptSetV2Retention family -- registry statement: Seven-lane LaneReceiptSetV2 retains one slot per lane without pairwise overwrite


DERIVED: Theorem named 'sticker_evidence_digest' in the StickerLaneNonCircularEvidence family -- registry statement: Sticker lane consumes sticker compiler/runtime evidence digests


DERIVED: Theorem named 'decision_receipt_v2' in the DecisionReceiptV2Binding family -- registry statement: Versioned domain-separated DecisionReceiptV2 binds request/policy/schema/compiler/evidence/freshness/signer


DERIVED: Theorem named 'independently_verify' in the DecisionReceiptV2IndependentVerify family -- registry statement: Independent verify recomputes digests and rejects tamper/replay/stale epoch


DERIVED: Theorem named 'verify_production' in the ProvenanceProductionVerifyContext family -- registry statement: Production provenance verify(VerificationContext, LiveEpochKeyStore, ReplayStore)


DERIVED: Theorem named 'observation_snapshot' in the ObservationSnapshotV1UnboundFluid family -- registry statement: ObservationSnapshotV1 unbound default projects Fluid never PASS-from-absence


DERIVED: Theorem named 'logical_work_container_v1' in the LogicalWorkContainerV1Identity family -- registry statement: Authoritative LogicalWorkContainerV1 identity fields from authenticated sources only


DERIVED: Theorem named 'admit_telemetry_record' in the AdmitTelemetryEnqueueNoIo family -- registry statement: Admit record path is bounded nonblocking enqueue without filesystem I/O


DERIVED: Theorem named 'cub_3230_authority_preemption_prevented' in the RoleAwareToolInstructionPrevention family -- registry statement: Tool-origin authority/preemption or explicit override evidence is blocked without making user-origin text satisfy the indirect-instruction predicate

Theorem cub_3230_authority_preemption_prevented :
  forall policy_allow evidence_valid,
    blocked_and_prevented
      policy_allow evidence_valid true true true false = true.

theorem cub_3230_authority_preemption_prevented
    (policyAllow evidenceValid : Bool) :
    blockedAndPrevented policyAllow evidenceValid true true true false = true

consumed only when the signed-context admission backend executes; HostSim and classifier-only paths do not consume it

signed-context only; invalid bundle fails closed; HostSim remains advisory and does not consume or control the receipt

proof fn cub_3230_authority_preemption_prevented(
    policy_allow: bool,
    evidence_valid: bool,
)
    ensures
        blocked_and_prevented(
            policy_allow,
            evidence_valid,
            true,
            true,
            true,
            false,
        ),


DERIVED: Theorem named 'cub_3231_maximal_feasible_prefix' in the BoundedToolScanOptimality family -- registry statement: The selected prefix min(input_len cap) is within both limits and maximal among all feasible prefixes

Theorem cub_3231_maximal_feasible_prefix :
  forall input_len cap candidate,
    candidate <= input_len ->
    candidate <= cap ->
    candidate <= bounded_prefix input_len cap.

theorem cub_3231_maximal_feasible_prefix
    (inputLen cap candidate : Nat)
    (hInput : candidate ≤ inputLen)
    (hCap : candidate ≤ cap) :
    candidate ≤ boundedPrefix inputLen cap

proof fn cub_3231_maximal_feasible_prefix(
    input_len: nat,
    cap: nat,
    candidate: nat,
)
    requires
        candidate <= input_len,
        candidate <= cap,
    ensures
        candidate <= bounded_prefix(input_len, cap),


DERIVED: Theorem named 'center_cell_in_face' in the CanonicalSlotVerify family -- registry statement: Canonical slot opposite-axis seam rejection and center-cell identity under Order B faces

Theorem center_cell_in_face :
  forall face, face < 6 ->
    face * 9 <= center_cell face < face * 9 + 9
    /\ center_cell face = face * 9 + 4.

proof fn center_cell_in_face(face: int)
    requires
        0 <= face < 6,
    ensures
        face * 9 <= center_cell(face) < face * 9 + 9,
        center_cell(face) == face * 9 + 4,


DERIVED: -- registry statement: Bounded TEP specialist-attribution bits occupy only logical syndrome bits 21 through 23; zero specialist input is non-interfering with the base syndrome.

Dependency-free reference carrier only; does not prove provider validity, replay sensitivity, FAR, authorization, or product runtime consumption.


DERIVED: -- registry statement: The typed 54-cell TEP placement-to-semantic coordinate map is a bounded permutation with an inverse on its declared carrier.

Dependency-free coordinate carrier; excludes ontology, source-field, unit, provider-authority, UI, and production-activation claims.

coordinates::translate_cell + typed wrappers (crates/cubie-tep-reference/src/coordinates.rs)


DERIVED: -- registry statement: The declared three-term marginal and six-term conditional already-quantized predictor descriptors equal their sequential left-fold reference semantics.

Starts after term construction and quantization; excludes source-float lowering, full residual/replay parity, and product invocation. Schema-v3 checked mixed-scale folding is scoped separately by CUB-3255.

predictor::marginal_ar3 + predictor::conditional_poly_var3 (crates/cubie-tep-reference/src/predictor.rs)


DERIVED: -- registry statement: For every declared fractional width 0 through 61, checked mixed-scale coefficient application equals arithmetic floor division and accepts exactly when the shifted result fits signed i64; signed i64 products fit i128.

Includes the recovered negative-coefficient Q16-zero and higher-scale witnesses. Does not prove the host compiler's ties-even or greatest-safe-scale selection algorithm, provider completeness, or product authority.


DERIVED: -- registry statement: The effective TEP active mask is requested AND in-carrier AND data-bearing; it is a subset of the requested mask and preserves requested data-bearing pairs, including relocated logical cells 52 and 53.

The reference validator accepts exactly 50 data-bearing cells; mappings to sentinel variables 52 and 53 remain inactive while logical cells 52->37 and 53->38 remain eligible. Excludes provider parsing and replay parity.

active_mask::effective_active + active_mask::effective_mask (crates/cubie-tep-reference/src/active_mask.rs)


DERIVED: -- registry statement: Checked signed addition and arithmetic-shifted Q16 multiplication accept exact in-range results, reject overflow, and compose as the declared six-term sequential left fold when every prefix fits i64.

Reference arithmetic carrier for schema-v3 folds; excludes coefficient recovery, float/model parity, complete-provider existence, replay parity, and product invocation.

predictor::checked_q16_mul + predictor::checked_left_fold (crates/cubie-tep-reference/src/predictor.rs)


DERIVED: -- registry statement: Under sustained positive drift, the strict Page-CUSUM crossing occurs first at floor(h/delta)+1; a separately bound c-sample same-cell confirmation policy yields the arithmetic index floor(h/delta)+c.

Reference tests separately exercise freshness, same-cell streaks, and confirmed-cell-only reset; the theorem itself proves only crossing/delay arithmetic and does not establish empirical calibration, FAR, coverage, or production readiness. Distinct from CUB-CUSUM-MIXED-001.


DERIVED: Theorem named 'execution_settlement_v1' in the ExecutionSettlementV2Binding family -- registry statement: Versioned domain-separated ExecutionSettlementV2 binds receipt digests/dispatch/capacity/route/forecast-observed/telemetry/cache/timing/kill-switch/proof-runtime-registry


DERIVED: Theorem named 'independently_verify_settlement' in the ExecutionSettlementV2IndependentVerify family -- registry statement: Independent V2 verification recomputes the receipt link and rejects legacy schema/domain bytes plus tamper/replay/stale independent receipt or settlement epochs


DERIVED: Theorem named 'logical_work_container_v2' in the LogicalWorkContainerV2Immutable family -- registry statement: LogicalWorkContainerV2 is immutable and excludes route/capacity grant refs


DERIVED: Theorem named 'capacity_observations' in the AuthenticatedCapacityObservationV1 family -- registry statement: Normalized capacity observations never invent absent measurements


DERIVED: Theorem named 'capacity_grant_v1' in the CapacityGrantV1ReceiverLease family -- registry statement: Forecast vs Granted vs Unavailable; HMAC shared-key; Forecast is not a receiver grant; capacity signals never security deny


DERIVED: Theorem named 'virtual_queue_phase' in the BoundedPhaseVirtualQueues family -- registry statement: Sharded prefill/decode/colocated queues with idle reclaim; schedule recommendation actuator off in Shadow


DERIVED: Theorem named 'route_plan_v1' in the RoutePlanV1WouldRoute family -- registry statement: Topology-aware RoutePlanV1 records would_route vs actual upstream; disaggregate only when isolation beats KV/network cost


DERIVED: Theorem named 'backpressure_v1' in the ClosedLoopBackpressureNotices family -- registry statement: Signed pressure notices with TTL/hysteresis/recovery; congestion vs health-fault; would_defer/would_reroute never authorization failure


DERIVED: Theorem named 'stickers_is_arity' in the CubieArityMeet family -- registry statement: Arity unification: sticker count = arity = blast radius; Belnap 2-bit meet PASS meet FAIL = TAMPER corner coherence

Theorem stickers_is_arity : forall c, sticker_count c = arity c.

theorem stickers_is_arity (c : CarrierClass) : stickerCount c = arity c


DERIVED: -- registry statement: CMI Turing-machine model plus the class DEFINITIONS P and NP over a binary alphabet. Class_P was machine-checked VACUOUS in its loose form and was tightened (fixed budget + required halting); Class_NP was NOT vacuous and got the same form for consistency. Both confirmed satisfiable (not over-tight). Definitions only -- proves nothing about P vs NP.


DERIVED: -- registry statement: Binary serialization of a TSP decision instance and the TSP decision language L_TSP (a CMI Language). Definition only. (compute_tour_cost fixed: a v::_ as t match parsed as tail-of-tail and summed alternating pairs -- a latent bug nothing constrained; now a clean head-carrying helper summing consecutive edges.)


DERIVED: -- registry statement: Executable poly-time NP-RELATION checker for TSP (Hamiltonicity + budget) -- Verus companion to L_TSP. Verus-verified: panic-free/in-bounds/terminating and postcondition BUDGET-SOUNDNESS (is_valid => cost <= budget). Structural checks execute but are NOT lifted into the spec; NOT a proof that L_TSP in NP.


DERIVED: -- registry statement: Canonical polynomial-time many-one reduction relation poly_reduces over the faithful finite STM: TapeSym has distinct Blank and Bit bool constructors, reachable states are bounded by s_num_states, one (k,c) is fixed up front, execution uses the exact polynomial budget, and the machine must have halted. The former Boolean-tape Blank=false relation is preserved only as legacy_poly_reduces because word_reduce is proven trailing-false-sensitive.

canonical contract repair; canonical_poly_reduces_is_strict is reflexive; no semantic erasure bridge


DERIVED: -- registry statement: 3-CNF syntax/semantics/total binary parser and the 3-SAT decision language L_3SAT. Definition only.


DERIVED: -- registry statement: NP_Hard/NP_Complete DEFINITIONS over the real L_3SAT/L_TSP. Cook-Levin and TSP-completeness are STATED as open; the sole THEOREM is conditional (L_TSP NP-complete IF poly_reduces is transitive). No Admitted; 0 axioms.


DERIVED: -- registry statement: Boundary marker separating easy-sub-family from P vs NP. PROVEN (0 axioms): all-accepting and all-rejecting languages are in Class_P -- so Class_P membership of a restricted/finite/structured TSP variant says NOTHING about the general L_TSP. tsp_in_P_open := Class_P L_TSP is STATED open (a P=NP resolution is exactly its proof; its negation is P<>NP). Refutes the wreath/RG easy-sub-family = P=NP error inside the kernel.


DERIVED: -- registry statement: Binary serialization + syntax/semantics of the Directed Hamiltonian Cycle decision language L_DHC (structural mirror of L_TSP). Infrastructure for the Karp chain L_3SAT <=p L_DHC <=p L_UHC <=p L_TSP. Definition only; the reductions (NP-hardness Karp 1972) are in progress. Not P vs NP.


DERIVED: -- registry statement: Karp Phase 2 node-tripling DHC->UHC PROVEN as a 0-axiom IFF (dhc_to_uhc_correct: dhc_instance_solvable d <-> uhc_instance_solvable (dhc_to_uhc_instance d); v -> in=3v mid=3v+1 out=3v+2; directed edge u->v -> undirected out_u--in_v). FORWARD (dhc_to_uhc_forward) via tripled_path (removelast p). BACKWARD (dhc_to_uhc_backward): traversal-forcing FULLY MECHANISED -- mid degree-2 inversions (mid_neighbor_inv/'), mid_flanked + junction_next_mid force each block, front-peel induction forward_reconstruct proves a forward-started valid UHC walk IS a tripled walk, orientation dispatched (mid0_dispatch + is_valid_uhc_rev via matrix symmetry), tripled_edges_to_chain + chain->nth bridges + project yield is_valid_dhc. NP-hardness (Karp 1972) not P vs NP.


DERIVED: -- registry statement: many_one reduction algebra (poly_bound output-length + membership-preserving map): reflexivity; non-vacuity; TRANSITIVITY with the composed budget (k1*k2; c2*(c1+1)^k2) -- discharging UNCONDITIONALLY the reduction-transitivity that CUB-COMPLEXITY-005 leaves as a hypothesis; at the many_one (output-length) level which is STRICTLY WEAKER than poly_reduces (no TM required). Capstone tsp_nphard_via_many_one derives L_TSP NP-completeness from the concrete reduction with NO transitivity assumption. The stronger poly_reduces/s_poly_reduces transitivity stays gated on the item-4 word_reduce machine. 0 axioms; coqchk Axioms: <none>.


DERIVED: -- registry statement: Capstone composing the Karp chain at instance-solvability level. PROVEN (0 axioms): threesat_to_dhc_reduction, dhc_to_uhc_reduction, uhc_to_tsp_reduction, and karp_chain_solvability_closed discharge all three instance phases. word_reduce_correct packages the total membership-preserving Word map. The canonical finite-machine Phase-4 wrapper is discharged downstream by CUB-COMPLEXITY-STRICT-ENCODE-TSP. NP-hardness (Karp 1972), not P vs NP.

instance chain closed in this module; canonical poly_reduces close is phase4_poly_reduces in proofs/coq/ComplexityStrictEncodeTsp.v

karp_chain_solvability_closed + threesat_to_dhc_reduction + word_reduce_correct


DERIVED: -- registry statement: concrete instantiation of the many_one algebra: many_one L_3SAT L_TSP is now a 0-axiom THEOREM via word_reduce. The content is poly_bound 4 (7*72*72) word_reduce -- output length <= 36288*(|w|+1)^4 -- proven from the UNARY-parser size lemmas (split_clauses_length; decode_len; formula_maxvar via trues-conservation -> num_clauses/num_vars <= O(|w|)) chained through karp_g_size_poly + word_reduce_length. Discharges the reduction premise of tsp_nphard_via_many_one; the premise-lighter capstone tsp_nphard_via_many_one_concrete needs ONLY Cook-Levin + TSP-in-NP (both open). LENGTH side only -- poly-TIME poly_reduces/s_poly_reduces still needs the item-4 machine. 0 axioms; coqchk Axioms: <none>.


DERIVED: -- registry statement: Resolution propositional proof system (literals/clauses/CNF + the resolution rule) with a PROVEN soundness theorem (a refutation deriving the empty clause => the CNF is unsatisfiable; 0 axioms). Soundness is a CORRECTNESS property NOT a lower bound. Haken 1985 (Resolution refutations of PHP_{N+1,N} have size 2^Omega(N)) is STATED over the concrete generator generate_PHP_CNF and the resolution_size metric as open obligation haken_resolution_lower_bound_open NOT proven. Proof-complexity infrastructure; does not approach P vs NP.


DERIVED: -- registry statement: first brick toward Haken 1985 over generate_PHP_CNF. php_unsatisfiable: PHP_N unsatisfiable for every N (constructive finite pigeonhole no_injection + hole-function extraction). php_refutation_contains_every_axiom: minimal unsatisfiability -- every Resolution refutation of PHP_N contains every axiom clause (derivation_avoid filtering + resolution_soundness + explicit matching-assignment witnesses php_minus_pigeon_sat/php_minus_hole_sat). php_resolution_cubic_lower_bound: 2*size >= 4 + 2(N+1) + N^2(N+1), an Omega(N^3) size lower bound for all N>=1. php1_refutation_min_size: PHP_1 refutations need >= 5 lines (tight). HONEST SCOPE: Omega(N^3) is polynomial -- haken_resolution_lower_bound_open (exponential) remains OPEN; next brick = width bound via matching-restricted entailment measure (Ben-Sasson--Wigderson route).

coqchk Axioms:<none>; 34 Qed; coq-only proof-complexity corpus, no Lean/Verus mirror

php_unsatisfiable + php_refutation_contains_every_axiom + php_resolution_cubic_lower_bound + php1_refutation_min_size


DERIVED: -- registry statement: Haken chain brick 1/4: matching-assignment layer over generate_PHP_CNF. pmatching + pm_wf (partial injection pigeons->holes, total on holes: |M|=N) + pm_assign (induced assignment via phi encoding) + entails_m (matching-restricted entailment). Lemmas: total_matching_exists (id_matching wf), hole_axioms_entailed, entails_m_weaken, pm_assign_true_iff.

coqchk Axioms:<none>; coq-only proof-complexity corpus

pmatching + pm_assign + entails_m + hole_axioms_entailed


DERIVED: -- registry statement: Haken chain brick 2/4: the mu measure in predicate form. covers N S C (every wf matching satisfying pigeon axioms of S satisfies C) + mu_at_most N k C (exists covering pigeon-set of size <= k). mu_hole_axiom (<=0), mu_pigeon_axiom (<=1), mu_subadditive (resolvent covered by S1++S2, deduped), mu_empty_clause_hard (~mu_at_most N N empty_clause via skip_matching construction).

covers + mu_at_most + mu_subadditive + mu_empty_clause_hard


DERIVED: -- registry statement: Haken chain brick 3a/4: decidability by finite enumeration -- the constructive excluded-middle the IVT walk needs (repo forbids classical axioms). sublists (2^n) + sublists_complete; covers_b + covers_b_iff (full two-directional reflection); mu_at_most_b + mu_at_most_b_iff; mu_at_most_dec.

covers_b_iff + mu_at_most_b_iff + mu_at_most_dec


DERIVED: -- registry statement: Haken chain brick 3b/4: the IVT walk. derivation_first_failure (generic decidable first-failure over a derivation: failing line is axiom or resolvent of two passing lines) + ivt_medium_mu: every refutation of PHP_N (N>=3) contains a clause C with ~mu_at_most N (N/3) C and mu_at_most N (2*(N/3)) C -- exact constant 2*(N/3), tighter than 2*(N/3)+1.

ivt_medium_mu + derivation_first_failure + mu_at_most_mono_k


DERIVED: -- registry statement: Haken chain brick 4/4 -- THE WIDTH LOWER BOUND (Ben-Sasson--Wigderson stepping stone to Haken 1985). php_width_lower_bound: every resolution refutation of generate_PHP_CNF N (N>=3) contains a clause of width > N/3 (strict; K=3, the full textbook constant). Engine: minimize_cover (constructive minimal covering set via covers_b reflection), witness_unmatched, swap_flip_literal (total-matching swap flip), dichotomy count (every p in S0 mentioned => width >= |S0| > N/3; some p unmentioned => every eligible swap edge yields a distinct literal => width >= N-|S0|+1 > N/3). HONEST SCOPE: the exponential haken_resolution_lower_bound_open remains OPEN -- the missing step is the size-width tradeoff.

coqchk Axioms:<none>; coq-only proof-complexity corpus; 351 lines

php_width_lower_bound + minimize_cover + swap_flip_literal


DERIVED: -- registry statement: single-polynomial BUDGET WRAPPER closing the composition layer (the item-(i) gap bricks 6/7 left open): machine-intrinsic output bound (clean_output_length -- tape grows <=1 cell per step via s_step_tsize; s_extract <= tape; s_init <= |w|+1 cells; so |f w| <= |w|+1+budget with NO poly_bound hypothesis); explicit budget algebra seq_K=(k1+1)*(k2+1) and seq_C=2*(c1+c2+c2*(2c1+1)^k2)*2^seq_K (seq_budget; (n+1)-power basis + pow_base_succ_le conversion keep nia on small symbolic terms); stm_seq_clean_computes_poly (clean o computes = genuine s_computes_in_poly_strict at the explicit budget -- brick 6 upgraded); stm_seq_clean_preserves_poly (clean o clean = clean at the explicit budget; composite halt time pinned <=t1+t2 by never-halts-early minimality -- brick 7 upgraded); s_bounded_halt_has_first derives the least/never-early halt witness from any bounded halt; s_clean_implies_computes; capstone s_phase4_from_stage_machines: two clean transducers g1 g2 + a computer g3 with g3(g2(g1 w)) = word_reduce w discharge s_poly_reduces L_3SAT L_TSP outright. Does NOT build any stage machine; strict wrapper remains OPEN reduced to exactly the three stage machines. NP-hardness (Karp 1972) not P vs NP.

coqchk Axioms:<none>; coq-only strict-TM corpus (Complexity* convention), no Lean/Verus mirror

s_phase4_from_stage_machines + stm_seq_clean_computes_poly + stm_seq_clean_preserves_poly + s_bounded_halt_has_first


DERIVED: -- registry statement: Ten-state total fused unary halve-plus-successor. s_ceilhalve_clean_pad computes repeat true (S (halve (bit_to_nat w))) for every word with first-halt minimality, canonical blank padding, and budget 6*|w|^2+6; unary specialization is the terminal num_vars arithmetic.

coqchk Axioms:<none>; wrong-halving and missing-successor Fail controls included

s_ceilhalve_run + ch_total_fuel_quadratic + s_ceilhalve_clean_pad


DERIVED: -- registry statement: {1,2}-cell reduction of strict Phase-4: word_reduce_stream's grid cells are 1 (edge) or 2 (non-edge) per the UHC->TSP cost gadget, budget B=N. word_reduce_stream_bit restates the emission as enc_nat N (twice) ++ an N*N grid of edge-bit-selected 2/3-bit constants; strict_phase4_reduced_to_edge_decision shows a strict machine for that form closes s_poly_reduces (via s_phase4_from_stream). Narrows the SOLE open residual from 'compute an arbitrary nat per cell' to 'decide one edge bit karp_edge = uhc_matrix(dhc_to_uhc(threesat_to_dhc2(parse_3sat w))) u v'. This module does NOT build that decider. CLOSED by proofs/coq/ComplexityStrictCellClose.v (2026-08-12): word_reduce IS the {1,2}-cell emission (word_reduce_bit_form), so the s_encode_tsp witness of CUB-COMPLEXITY-STRICT-ENCODE-TSP discharges the exact existential premise (strict_cell_premise) and strict_cell_residual_closed derives strict s_poly_reduces L_3SAT L_TSP through strict_phase4_reduced_to_edge_decision itself. NP-hardness (Karp 1972), not P vs NP.

coqchk Axioms:<none>; coq-only strict-TM corpus (Complexity* convention), no Lean/Verus mirror; closure theorems live in proofs/coq/ComplexityStrictCellClose.v (ComplexityStrictCell.v itself byte-unchanged)

word_reduce_bit_form + s_encode_tsp_computes_bit_form + strict_cell_premise + strict_cell_residual_closed + strict_cell_residual_closed_canonical


DERIVED: -- registry statement: Canonical clean-word packaging for the total parser-faithful literal-table machine. The canonical bit-only record is false :: sat_N_frame(w) ++ [false] ++ true^i ++ [false] ++ true^j ++ [false;pos;acc], whose exact length is clause_seek_span(w,i,j). A well-formed 9-state physical unpacker converts only its marker and three serialized separators to distinct Blank cells, preserving arbitrary metadata behind the frame/base sentinel and landing at the existing selector-ready raw layout. The unchanged well-formed 252-state total raw machine executes, and a well-formed 8-state physical packer restores every serialized separator and the leading marker. Their well-formed 269-state composition has a least halt within 70*(clause_seek_span w i j)^2 for every w,i,j,pos,acc and arbitrary TapeSym base, preserves the complete frame/query/base, and changes only acc to acc OR serialized_literal_table(sat_N_frame w,i,j,pos). For base=[] the result is exactly blank_padded and extracts to the canonical output word. Controls execute default and in-range branches, polarity mutation, partial-clause parsing, nonzero fields, exact early nonhalt, arbitrary mixed base preservation, and rejected wrong accumulator/marker/separator layouts. This is an indexed canonical-record theorem, not a decoder or acceptance claim for arbitrary malformed Words. Finite descriptor encoding/comparison, karp_edge, grid emission, encode_tsp, and the strict reduction capstone remain OPEN.

Print Assumptions Closed; targeted pinned Coq compile and coqchk Axioms:<none>; exact 269-state product and 70*span^2 least-halt bound; malformed-record semantics intentionally unspecified; descriptor/edge stage remains open

sat_literal_query_word_span + s_literal_query_unpack_state_bound + s_literal_query_unpack_well_formed + literal_query_unpack_exact_run + literal_query_unpack_first_halt + s_literal_query_pack_state_bound + s_literal_query_pack_well_formed + literal_query_pack_exact_run + literal_query_pack_first_halt + s_sat_literal_table_clean_state_bound + s_sat_literal_table_clean_well_formed + sat_literal_table_clean_first_halt_span_base + sat_literal_table_clean_first_halt_span + sat_literal_table_clean_extract


DERIVED: -- registry statement: the FIRST machine-to-parse bridge, closing the Div3 brick's recorded honest-scope gap: split_len_terminated (on delimiter-terminated encodings -- last w false = false, [] included via the default -- #parts = #false exactly; the dangling-true divergence is precisely what termination excludes), decode_len_div3 (clauses consume three parts at a time = floor division, fuel-indexed depth-3 induction), num_clauses_parse (num_clauses (parse_3sat w) = #false(w)/3 on terminated w). HEADLINE clause_counter_counts_clauses: on every delimiter-terminated encoding the strict machine clause_counter HALTS within its proven polynomial budget with s_extract = repeat true (num_clauses (parse_3sat w)) -- a strict finite machine provably producing a parameter of the PARSED formula. Two Symbol-vs-bool elaboration traps resolved (forall w : Word annotation; conversion-change over rewrite for mixed @cons elaborations). Stage bodies num_vars/N/grid remain; strict wrapper OPEN. NP-hardness (Karp 1972) not P vs NP.


DERIVED: -- registry statement: Standalone parser-default clause-query cycle. The well-formed 10-state s_clause_default_scan_raw walks the selector-ready SAT frame and unary i/j query fields, preserves every cell, and computes sticky acc OR (i=0 AND pos) at the far-right Blank in exactly |sat_N_frame w|+i+j+5 steps. Hstate0 is the exact existing qrf_start_cfg; composition with the 8-state reframe gives the well-formed 18-state s_sat_clause_default_cycle_raw. Its whole-product first halt returns the exact selector-ready layout within 2*clause_seek_span for every i and j. Under num_clauses(parse_3sat w)<=j, the output is exactly acc OR serialized_literal_table(sat_N_frame w,i,j,pos). Executable controls cover empty/default-positive, one-step-early nonhalt, sticky accumulator, and a rejected wrong output. This remains the standalone default branch body; the parser-faithful range marker and physical router now compose it with the in-range product as a total raw machine. No |w|-only bound is claimed for arbitrary external unary j. Canonical clean padding, karp_edge, grid emission, encode_tsp, and the strict capstone remain OPEN.

Print Assumptions Closed; exact 18-state default body; total raw routing closed in CUB-COMPLEXITY-STRICT-CLAUSE-ROUTER; clean-pad interface remains open

tally_bits_right_same + s_clause_default_scan_raw_state_bound + s_clause_default_scan_raw_well_formed + clause_default_scan_exact_run + clause_default_scan_first_halt + s_sat_clause_default_cycle_raw_state_bound + s_sat_clause_default_cycle_raw_well_formed + sat_clause_default_cycle_first_halt_span + sat_clause_default_cycle_literal_table_first_halt_span


DERIVED: -- registry statement: Total payload-preserving clause-field appender and parser-safe joint-frame specification. The 28-state s_clauseframe_raw preserves every input bit and appends enc_nat(count_false(w)/3), with first-halt minimality, canonical blank padding, and budget 24*|w|^2+24 on every word. The 41-state s_clauseframe precomposes normalization and emits normalize_complete_clauses(w) ++ enc_nat(num_clauses(parse_3sat w)) under one seq_K/seq_C budget. sat_parameter_frame proves that exactly two suffix fields, num_vars then num_clauses, preserve parse_3sat and are physically recoverable; appending a third field is an executable negative control. The payload-preserving num_vars machine needed to compute that two-field target remains open.

coqchk Axioms:<none>; total formula-plus-clause machine closed; two-field joint-frame semantics pinned; payload-preserving num_vars/N/grid/final reduction open

s_clauseframe_raw_clean_pad + s_clauseframe_clean_pad + sat_parameter_frame_parse + sat_parameter_fields_exact


DERIVED: -- registry statement: Thirteen-state total parser-preserving complete-clause normalizer. normalize_mod3_correct identifies the executable machine specification with normalize_complete_clauses; s_clause_normalize_clean_pad proves first-halt minimality, canonical blank padding, and budget 3*|w|+3 for every word.

coqchk Axioms:<none>; Route B total normalizer; negative mutation control included


DERIVED: -- registry statement: IN-RANGE first-literal operational composition. The 61-state s_sat_clause_first_query_raw is the finite product of the 22-state preservation-safe clause selector and the 39-state arbitrary-middle query. The exact selector halt is physically identical to the query start; the whole product has a least halt within 20*(frame+i+j+6)^2, and under grid-range premises within the explicit strict quartic constant (20*900*16)*|w|^4+(20*900*16). Its final tapes exactly encode acc OR the selected clause's first tally. A checked negative control proves direct query reentry halts on the far-right Blank, so a real reframe/reselect adapter is required before later tallies. The complete in-range three-tally product is closed separately; total out-of-range behavior, clean padding, karp_edge, grid emission, encode_tsp, and the strict capstone remain OPEN.

Print Assumptions Closed; pinned Coq compile; whole-product halt minimality and explicit quartic input budget; one-tally in-range raw brick

s_sat_clause_first_query_raw_state_bound + s_sat_clause_first_query_raw_well_formed + sat_clause_seek_literal_init + sat_clause_first_query_first_halt_span + sat_clause_first_query_first_halt_strict_quartic + slm_done_direct_reentry_halted


DERIVED: -- registry statement: Complete IN-RANGE three-literal table query product. The well-formed 212-state s_sat_clause_three_query_raw composes three selector/query/reframe cycles: 69 states for tally one, 71 for tally two after one delimiter, and 72 for tally three after two delimiters. Its whole-product least halt returns the exact selector-ready SAT frame within 63*(clause_seek_span)^2, with the sticky accumulator equal to acc OR serialized_literal_table(sat_N_frame w,i,j,pos). Under grid-range premises the explicit strict quartic constant is 63*900*16 = 907200. Third-prefix reconstruction proves the physical Blank frame/base sentinel remains load-bearing. A checked halted-machine counterexample at j=num_clauses directly disagrees with the serialized parser table, so this standalone selector cannot decide range. The parser-default body, range marker, and physical router are closed separately as the total raw literal-table product. This theorem remains the raw internal-layout, j-in-range branch result; canonical clean padding, finite karp_edge, grid emission, encode_tsp, and the strict capstone remain OPEN.

Print Assumptions Closed; exact 212-state in-range product; total raw routing closed in CUB-COMPLEXITY-STRICT-CLAUSE-ROUTER; clean-pad stage remains open

ci_third_query_frame_reconstruct + s_sat_clause_third_cycle_raw_state_bound + s_sat_clause_three_query_raw_state_bound + s_sat_clause_three_query_raw_well_formed + sat_clause_three_query_out_correct + sat_clause_three_query_literal_table_first_halt_span + sat_clause_three_query_literal_table_first_halt_strict_quartic


DERIVED: -- registry statement: Complete in-range second-literal query cycle. The reusable stm_seq_first_halt_layout theorem composes arbitrary internal-layout stages from least-halt and exact Hstate0 contracts without pretending they are clean s_init transducers. The well-formed 71-state s_sat_clause_second_cycle_raw is selector -> one-delimiter skip -> 39-state literal query -> 8-state reframe. Its whole-product first halt returns the exact selector-ready SAT frame with accumulator updated by tally two within 21*(clause_seek_span)^2. The second-query prefix/base reconstruction proves the Blank sentinel remains load-bearing and recovers the original sat_N_frame exactly. A sticky-accumulator control and false dropped-accumulator statement are checked. This cycle remains explicitly j-in-range; the combined in-range first/second/third product is closed separately. The total out-of-range default branch, clean padding, karp_edge, grid emission, encode_tsp, and the strict capstone remain OPEN.

Print Assumptions Closed; targeted pinned Coq compile and coqchk; exact 71-state cycle; in-range three-query product closed separately

stm_seq_first_halt_layout + ci_second_query_frame_reconstruct + sat_clause_second_query_reframe_start + s_sat_clause_second_cycle_raw_state_bound + s_sat_clause_second_cycle_raw_well_formed + sat_clause_second_cycle_first_halt_span


DERIVED: -- registry statement: Total parser-faithful range marker for canonical SAT clause queries. The well-formed 19-state s_clause_range_raw counts Bit-false delimiters modulo three across the exact sat_N_frame, cancels one unary j bit per complete clause, restores every temporary frame and query mark, and replaces only the frame-boundary Blank with Bit(j < num_clauses(parse_3sat w)). The exact theorem quantifies over every w, i, and j; the least halt is bounded by 5*(clause_seek_span w i j)^2. The two enc_nat suffix fields are load-bearing and independently cross-checked by count_false(sat_N_frame w)/3 = num_clauses(parse_3sat w). Executable controls cover empty input, equality and greater-than bounds, multiple clauses, a partial clause, a one-bit completion that flips the flag, full restoration with a nonempty base, one-step-early nonhalting, and a rejected wrong flag. This remains the standalone internal-layout marker; the physical router and total raw literal-table product are closed separately. Canonical padding, karp_edge, grid emission, encode_tsp, and the strict capstone remain OPEN.

Print Assumptions Closed; exact 19-state total range marker and 5*span^2 internal-layout budget; total raw router closed in CUB-COMPLEXITY-STRICT-CLAUSE-ROUTER

s_clause_range_raw_state_bound + s_clause_range_raw_well_formed + clause_range_core_exact_run + sat_clause_range_exact_run + sat_clause_range_exact_first_halt + sat_clause_range_fuel_span_quadratic + sat_clause_range_first_halt_span + clause_range_done_Hstate0


DERIVED: -- registry statement: IN-RANGE first-query reframe brick. The well-formed 8-state s_clause_query_reframe_raw starts at the literal-query far-right Blank, preserves every tape cell while crossing the flag, metadata, index, and serialized-frame regions, then uses the explicit frame/base Blank sentinel to turn right and halt in the selector-ready layout with the updated OR accumulator. Its exact fuel is |sat_N_frame w|+i+j+7 = S(clause_seek_span), with least-halt/no-early evidence and the explicit bound 31*(|w|+1)^2 under grid-range premises. The sentinel is load-bearing because generic slm_done_cfg base/k parameters are not uniquely recoverable. A checked wrong-accumulator negative control prevents restoration of the stale input accumulator. Delimiter skips and all three in-range cycles are closed separately; the total out-of-range branch, clean padding, karp_edge, grid emission, encode_tsp, and the strict capstone remain OPEN.

Print Assumptions Closed; pinned Coq compile; exact physical reframe and selector-ready handoff; in-range internal-layout brick

s_clause_query_reframe_raw_state_bound + s_clause_query_reframe_raw_well_formed + qrf_exact_run + qrf_first_halt + qrf_slm_done_start + sat_clause_first_query_reframe_selector_ready + sat_clause_first_query_reframe_fuel_grid_quadratic + sat_clause_first_query_reframe_first_halt_span


DERIVED: -- registry statement: Total parser-faithful raw serialized-literal-table machine. The 19-state range marker writes the physical Boolean j<num_clauses(parse_3sat w). The well-formed 233-state router reads only that tape marker, erases it to Blank, physically rewinds across the complete preserved sat_N_frame to its explicit Blank sentinel, and dispatches through disjoint finite slices: states [3,215) execute the existing 212-state in-range three-literal query and states [215,233) execute the existing 18-state parser-default cycle; malformed Blank marker starts halt closed. The well-formed 252-state s_sat_literal_table_raw composes marker and router for every w, unary i and j, polarity, incoming accumulator, and arbitrary base. Its first halt is bounded by 69*(clause_seek_span w i j)^2 and returns the exact selector-ready layout with accumulator acc OR serialized_literal_table(sat_N_frame w,i,j,pos), with no clause-range or delimiter premise. Executable and Fail Example controls cover both branches, empty/partial/complete formulas, greater out-of-range indices, sticky accumulation, polarity, arbitrary nonempty base, one-step-early nonhalting, malformed markers, wrong output, and wrong branch. This closes only the total RAW internal-layout stage; canonical clean padding, finite karp_edge, grid emission, encode_tsp, and the strict reduction capstone remain OPEN.

Print Assumptions Closed; targeted pinned Coq compile and coqchk; exact 233-state physical router and 252-state total raw product; 69*span^2 least-halt bound; clean-pad interface remains open

s_clause_query_router_raw_state_bound + s_clause_query_router_raw_well_formed + sat_clause_query_router_true_rewind_exact + sat_clause_query_router_false_rewind_exact + sat_clause_query_router_true_first_halt_span + sat_clause_query_router_false_first_halt_span + sat_clause_query_router_literal_table_first_halt_span + s_sat_literal_table_raw_state_bound + s_sat_literal_table_raw_well_formed + sat_literal_table_raw_first_halt_span


DERIVED: -- registry statement: IN-RANGE preservation-safe serialized clause selector and literal-query handoff. The 22-state s_clause_seek_raw is finite and well formed; ci_full_exact_run and ci_full_safe_run move across an explicit clause prefix, restore every skipped clause and query field, and halt with the target first tally under the head. SAT-frame glue proves a least halt within 424*|w|^3+424 when i and j are in range, identifies the selected three-tally OR with serialized_literal_table, and proves that resetting the halt state yields the existing 39-state slm_init_cfg with identical tapes. The parser's out-of-range value and positive-x0 default representation are pinned as pure semantics. The in-range three-tally product is closed separately; the total out-of-range branch, clean padding, karp_edge, grid, encode_tsp, and strict capstone remain OPEN.

Print Assumptions Closed; targeted pinned Coq compile; default tally 1 parity control; selector is not a total literal-table transducer

s_clause_seek_raw_state_bound + s_clause_seek_raw_well_formed + ci_full_exact_run + ci_full_safe_run + sat_clause_seek_safe_first_halt_strict_cubic + ci_done_literal_init + sat_target_clause_or + sat_N_literal_table_out_of_range


DERIVED: -- registry statement: Preservation-safe clause-tally adapters. The well-formed 2-state s_tally_skip_raw scans one unary tally, crosses exactly one Bit-false delimiter, preserves every tape cell, and halts on the next tally in exactly k+1 steps. The well-formed 3-state s_tally_skip_two_raw directly crosses the first two delimiters after fresh reselection and lands on tally three in exactly (a+1)+(b+1) steps. Both have least-halt/no-early witnesses; resetting their halt states gives the exact existing literal-query starts. SAT specializations connect an in-range selector halt to either the second- or third-query start, and the two-skip fuel is bounded by clause_seek_span. Empty/nonempty controls and intentionally false over/under-skip results are checked. The complete in-range selector/query/reframe product is closed separately; the total out-of-range branch, clean padding, karp_edge, grid emission, encode_tsp, and strict capstone remain OPEN.

Print Assumptions Closed; targeted pinned Coq compile; exact delimiter crossings; in-range three-query product closed separately

s_tally_skip_raw_state_bound + s_tally_skip_raw_well_formed + tally_skip_exact_run + tally_skip_first_halt + s_tally_skip_two_raw_state_bound + s_tally_skip_two_raw_well_formed + tally_skip_two_exact_run + tally_skip_two_first_halt + sat_clause_seek_skip_to_second_query_reentry + sat_clause_seek_skip_to_third_query_reentry + sat_clause_skip_two_fuel_le_span


DERIVED: -- registry statement: item-4 the s_iter x s_emit HANDOFF: s_copy (5-state) drives an s_emit-style output write once per counter unit -- UNARY ADDITION across a gap (counter b | gap | output o -> output := b + o; counter consumed to Blanks). Proven 0-axiom by the fold-over-the-counter induction s_copy_run (recursive-fuel shadow of the run) built on copy_cycle (one full cycle: consume + copy_out output round-trip + refind frontier) reusing four march-folds copy_m1-4. s_copy_run/extract: s_extract = repeat true (S k + o). UNARY MULTIPLY is this nested with a source-preserving s_emit body. coqchk Axioms: <none>.


DERIVED: -- registry statement: unary FLOOR-DIVISION BY 3 as a single right scan: s_div3 (3-state; the finite control IS the mod-3 counter via the explicit finite match st3 -- no Nat.modulo in the machine) keeps the true completing each triple, erases other trues + every false to Blank, halts on Blank. Proven via the spec fold div3_cells + the 6-case value lemma div3_cells_value: s_div3_computes = w -> repeat true (bit_to_nat w / 3), k=1 c=1, |w|+1 steps. Composed through the closed stack: clause_counter := stm_seq (s_map_prepend negb) s_div3 computes repeat true (#false(w)/3) at the explicit (seq_K 1 1, seq_C 1 4 1 1) budget (clause_counter_computes) -- on the false-terminated 3SAT literal encoding that is NUM_CLAUSES IN UNARY: the first full parse-parameter machine. Honest scope: computes #false/3 of the RAW input; the #parts-vs-#false trailing-true adjustment lemma equating it to num_clauses(parse_3sat w) is a pure-Coq successor, not claimed. Design falsifiers div3_check1/2 committed. Strict wrapper OPEN. NP-hardness (Karp 1972) not P vs NP.


DERIVED: -- registry statement: Division-free semantic bridge for the physical edge handlers. Valid exit/entry operands reduce cyclic successor to ordinary successor or the unique nv wrap; the last row is the physically measurable false tally of sat_N_frame; clause slots are three unary copies of j plus fixed two/three-cell suffixes; and edge_program_machine_eval contains neither mod nor edge_row_len. Under valid operands and the exact frame tally it equals edge_program_eval and therefore edge_unode_adj. This row is a proof specification for later finite handlers, not a tape machine.

Print Assumptions Closed; division/modulo eliminated from the machine-facing evaluator; pure semantic bridge only

edge_exit_entry_successor_short_circuit + edge_row_last_from_sat_N_frame + edge_clause_positive_slot_unary + edge_clause_negative_slot_unary + edge_program_machine_eval_correct + edge_program_machine_eval_sat_correct


DERIVED: -- registry statement: Physical marker handoff around preservation-safe unary equality. The two-state s_edge_compare_finish moves from the restored first operand to the equality marker without altering tape data. Its exact well-formed composition with the 11-state comparator has 13 states, preserves arbitrary mixed base, header, both canonical unary operands, separators, and arbitrary mixed metadata, and halts with the head directly on Bit(Nat.eqb a b) so a later finite router can branch on the physical tape. Exact least-halt and bounded-run theorems give unary_eq_fuel(a,b)+1 <= (a+b+2)^2+1, including both zero and mismatch. Operand preparation, handler routing, finite karp_edge, grid emission, encode_tsp, and the strict capstone remain OPEN.

Print Assumptions Closed; targeted pinned Coq compile and coqchk; exact 2-state finisher and 13-state product; arbitrary base/header/meta preserved

s_edge_compare_finish_state_bound + s_edge_compare_finish_well_formed + edge_compare_finish_exact_run + s_edge_compare_call_state_bound + s_edge_compare_call_well_formed + edge_compare_call_first_halt + edge_compare_call_exact_bounded_run + edge_compare_call_bound_square + edge_compare_call_first_halt_square


DERIVED: -- registry statement: Finite terminal destruction of compared unary operands. The exact well-formed 12-state machine reads the physical equality marker, stores only that Boolean in finite control, erases both unary fields and separators to Blank cells, restores the marker, and halts on it in 2*a+2*b+6 steps with least-halt semantics. Blank at dispatch refuses rather than selecting a branch.

Print Assumptions Closed; targeted pinned Coq compile and coqchk; exact 12 states; physical marker dispatch and malformed refusal

s_edge_compare_cleanup_state_bound + s_edge_compare_cleanup_well_formed + edge_compare_cleanup_exact_run + edge_compare_cleanup_first_halt + edge_compare_cleanup_blank_refuses


DERIVED: -- registry statement: Finite reusable recycling of compared unary operands. The exact well-formed 10-state machine reads the physical equality marker, rewrites both unary fields and both separators into Bit-false frame cells, physically rewinds, restores the marker, and halts on it in 2*a+2*b+6 steps with least-halt semantics. Unlike terminal Blank cleanup, the resulting all-bit suffix can be incorporated into another canonical edge frame; Blank dispatch fails closed.

Print Assumptions Closed; targeted pinned Coq compile and coqchk; exact 10-state physical recycling; arbitrary base/header/meta preserved

s_edge_compare_recycle_state_bound + s_edge_compare_recycle_well_formed + edge_compare_recycle_exact_run + edge_compare_recycle_first_halt + edge_compare_recycle_blank_refuses


DERIVED: -- registry statement: Canonical bit-only serialization contract for division-free edge descriptor pairs. edge_pair_word emits the fixed header 01;role(a);role(b);kind(a);kind(b), followed by four delimiter-terminated unary coordinates. The strict partial decoder rejects invalid role 11, truncated/missing unary terminators, noncanonical non-row y coordinates, and trailing cells. It has both roundtrip and canonical inverse theorems, hence injectivity, an exact length 14+xa+ya+xb+yb, reflected descriptor-range validity, bounded numbered IDs, an evaluator-success iff theorem exposing canonicality plus validity, and a validity-scoped bridge showing evaluation over sat_N_frame equals the existing numbered karp_edge. This file claims a serialization/specification layer only; it does not claim a decoder machine or finite edge machine. The physical selected-field stager, frame false-tally builder, nv-suffix stager, literal-query adapter, finite karp_edge, grid emission, encode_tsp, and strict reduction capstone remain OPEN.

Print Assumptions Closed; targeted pinned Coq compile and coqchk; pure canonical encoding/decoder contract; no finite edge machine claimed

edge_take_unary_enc_nat + edge_take_unary_sound + edge_decode_pair_encode + edge_decode_pair_canonical + edge_pair_encode_injective + edge_pair_word_length + edge_dnode_validb_spec + edge_pair_validb_spec + edge_pair_ids_bound + edge_pair_word_valid_length + edge_pair_eval_some_iff + edge_pair_eval_sat_N_frame