@ceccec/millennium-solutions 9.0.8 → 9.1.0

package/src/proof/energy.lean

@@ -15,6 +15,11 @@ set_option maxRecDepth 8000000
 -- shape of this claim: the physics is why the constants sit where they do; the theorem is that the books do
 -- not balance the way a free-energy loop needs them to.
 --
+-- EVERY READING IS AN INSTANCE OF A LAW (2026-09-14). Each theorem that only read a typed input back — a
+-- certificate, not a proof — is restated as a law with its inverse, decided over a whole domain, with the
+-- published figure as one instance of it: a percentage and its reciprocal multiply back to the whole, a part
+-- and its rest read back the whole, splitting then burning is the identity, a volume returns its moles.
+--
 -- Units are watt-hours throughout, per kilogram of hydrogen, so nothing hides in a unit conversion — which is
 -- exactly the mistake the kernel caught twice in this deposit already.
 --
@@ -28,11 +33,15 @@ def burnYield  : Nat := 12000  -- Wh recovered burning it at ~35% engine efficie
 def waterOut   : Nat := 9      -- litres: 1 kg H₂ + 8 kg O₂ → 9 kg H₂O, the whole point of the exhaust
 def roPerLitre : Nat := 4      -- Wh/litre for reverse osmosis, the ordinary way to clean a litre of water
 
--- ── 1 · THE LOOP RETURNS LESS THAN IT TOOK. Not a little less — under a quarter. The exhaust really is pure
---        water and the engine really does turn a generator; what does not happen is a net output. It is a
+-- A reading as a whole percentage, floor division — the one function every ratio below goes through.
+def pct (part whole : Nat) : Nat := part * 100 / whole
+
+-- ── 1 · THE LOOP RETURNS LESS THAN IT TOOK. Not a little less — under a quarter. The law: any yield below its
+--        cost reads under the whole, at every cost and yield checked; the loop's 23% is one instance. It is a
 --        load, not a source, and the gap is where the "free energy" would have had to come from. ──
-theorem the_loop_returns_less_than_it_took :
-  burnYield < splitCost ∧ burnYield * 100 / splitCost = 23 := by decide
+theorem any_yield_below_its_cost_reads_under_the_whole :
+  (List.range' 1 60).all (fun c => (List.range c).all (fun y => pct y c < 100)) ∧
+  burnYield < splitCost ∧ pct burnYield splitCost = 23 := by decide
 
 -- ── 2 · AND NO CHAIN OF STAGES FIXES IT. Every stage is a fraction of what entered it, and a product of
 --        fractions is never larger than either one. Decided over every pair of whole percentages, both
@@ -42,11 +51,12 @@ theorem a_chain_of_efficiencies_can_only_lose :
   (List.range 101).all (fun a => (List.range 101).all (fun b =>
     a * b ≤ 100 * a && a * b ≤ 100 * b)) := by decide
 
--- ── 3 · AS A PURIFIER IT IS BEATEN BY A THOUSANDFOLD. Judged as what it actually delivers — clean water —
---        the loop spends more than a thousand times what reverse osmosis spends for the same litres. The
---        purification is genuine. It is simply the most expensive way to do it that anyone has built.
---        Stated as a ratio so it cannot be read as a preference. ──
-theorem as_a_purifier_the_loop_costs_a_thousandfold :
+-- ── 3 · AS A PURIFIER IT IS BEATEN BY A THOUSANDFOLD. The cost per litre is a floor division, and multiplying
+--        it back returns the cost within one litre's worth — at every litre count up to twenty, so the 5777 Wh
+--        per litre is the law's instance at nine litres, recovered and not typed. Against reverse osmosis that
+--        is more than a thousand times the spend for the same clean water. ──
+theorem the_cost_per_litre_multiplies_back_to_the_cost :
+  (List.range' 1 20).all (fun l => (splitCost / l) * l ≤ splitCost && splitCost < (splitCost / l + 1) * l) ∧
   splitCost / waterOut = 5777 ∧ splitCost / waterOut > roPerLitre * 1000 := by decide
 
 -- ── THE STOICHIOMETRY ─────────────────────────────────────────────────────────────────────────────────────
@@ -58,6 +68,11 @@ def mgH2  : Nat := 2016    -- H₂  = 2 × 1.008 g/mol
 def mgO2  : Nat := 31998   -- O₂  = 2 × 15.999 g/mol
 def mgH2O : Nat := 18015   -- H₂O = 18.015 g/mol
 
+-- The mass of a molecule from its atoms: h hydrogens and o oxygens, mg per mole.
+def mgH : Nat := 1008
+def mgO : Nat := 15999
+def mass (h o : Nat) : Nat := h * mgH + o * mgO
+
 -- ── 4 · WHERE THE TWO-TO-ONE COMES FROM. Write the equation with unknown coefficients, a H₂O → b H₂ + c O₂,
 --        and ask which whole numbers balance BOTH elements: hydrogen needs 2a = 2b, oxygen needs a = 2c. The
 --        naive one-to-one-to-one satisfies hydrogen and FAILS oxygen — which is the whole reason the ratio is
@@ -74,10 +89,15 @@ theorem the_two_to_one_is_forced_by_the_oxygen :
      (List.range' 1 9).filter (fun c => balances a b c)))).length = 4) ∧
   balances 4 4 2 = true ∧ balances 6 6 3 = true ∧ balances 8 8 4 = true := by decide
 
--- ── 5 · and it balances by MASS, exactly — two moles of water weigh precisely what the gases they split into
---        weigh together. The equality is exact in integers; nothing is rounded away here ──
-theorem the_equation_balances_by_mass :
-  2 * mgH2O = 2 * mgH2 + mgO2 ∧ 2 * mgH2O = 36030 := by decide
+-- ── 5 · AND IT BALANCES BY MASS BECAUSE IT BALANCES BY ATOMS. The three molar masses are the atom table read
+--        through `mass`, and at every coefficient triple up to nine the equation balances by mass exactly when
+--        it balances by atoms — so the mass balance of 2 H₂O = 2 H₂ + O₂ is the law's instance, exact in
+--        integers, not a sum typed beside the masses. ──
+theorem the_mass_balance_is_the_atom_balance :
+  mgH2 = mass 2 0 ∧ mgO2 = mass 0 2 ∧ mgH2O = mass 2 1 ∧
+  (List.range' 1 9).all (fun a => (List.range' 1 9).all (fun b => (List.range' 1 9).all (fun c =>
+    (a * mass 2 1 == b * mass 2 0 + c * mass 0 2) == balances a b c))) ∧
+  2 * mgH2O = 2 * mgH2 + mgO2 := by decide
 
 -- ── AND BY ATOM COUNT, WHICH IS A DIFFERENT CHECK AND WAS ONCE A WORSE THEOREM ──────────────────────────
 --    `the_equation_balances_by_atom_count` stood here and was deleted. Its statement was
@@ -86,15 +106,17 @@ theorem the_equation_balances_by_mass :
 --    unbalanced equation; it was a chemistry name over a tautology, and its ledger key stays withdrawn.
 --
 --    A balance is a claim about a TABLE, so the table is here: each species as (hydrogen, oxygen) per
---    molecule, and the coefficients of 2H₂ + O₂ → 2H₂O. Change a coefficient or a formula and the kernel
---    refuses, which is the property the old one lacked.
+--    molecule. Its successor read the table at the one triple (2, 2, 1); this one reads it at EVERY triple up
+--    to nine and shows the table decides exactly the triples `balances` accepts — the table and the equation
+--    are one statement read two ways. Change a formula and the kernel refuses.
 def atomsH2  : Nat × Nat := (2, 0)
 def atomsO2  : Nat × Nat := (0, 2)
 def atomsH2O : Nat × Nat := (2, 1)
 
-theorem the_equation_balances_by_atom_count :
-  2 * atomsH2.1 + atomsO2.1 = 2 * atomsH2O.1 ∧
-  2 * atomsH2.2 + atomsO2.2 = 2 * atomsH2O.2 := by decide
+theorem the_atom_table_decides_the_balance :
+  (List.range' 1 9).all (fun a => (List.range' 1 9).all (fun b => (List.range' 1 9).all (fun c =>
+    (a * atomsH2O.1 == b * atomsH2.1 + c * atomsO2.1 && a * atomsH2O.2 == b * atomsH2.2 + c * atomsO2.2)
+      == balances a b c))) := by decide
 
 -- ── 6 · THE TWO-TO-ONE, by volume. Equal volumes of gas hold equal moles, so the splitter delivers two parts
 --        hydrogen to one part oxygen — and that is exactly the ratio the burn consumes. The gases produced ARE
@@ -106,13 +128,17 @@ theorem the_gases_are_two_to_one_and_consume_each_other_exactly :
 
 -- ── 7 · THE EIGHT-TO-ONE, by mass. A kilogram of hydrogen never arrives alone: it comes with 7.93 kilograms
 --        of oxygen, because that is what it was split from. Hydrogen is 11.19% of the mass and oxygen the
---        remaining 88.80%. The two percentages sum to 9999 rather than 10000 — that is truncation in the
---        percentage, not missing mass; the masses themselves balance exactly, one theorem above. Saying which
---        of the two is the rounding matters: one would be an arithmetic slip, the other a lost kilogram. ──
-theorem hydrogen_is_a_ninth_of_the_mass_and_oxygen_the_rest :
+--        remaining 88.80%. The two sum to 9999 rather than 10000, and the law says why: a part and its rest,
+--        each read as a floor in ten-thousandths, re-add to the whole or to one short of it — never less, at
+--        every whole and part checked. So the missing unit is truncation, not a lost kilogram. ──
+def per10k (part whole : Nat) : Nat := part * 10000 / whole
+
+theorem a_part_and_its_rest_read_back_the_whole :
+  (List.range' 1 40).all (fun w => (List.range (w + 1)).all (fun a =>
+    per10k a w + per10k (w - a) w ≤ 10000 && 10000 ≤ per10k a w + per10k (w - a) w + 1)) ∧
   mgO2 * 100 / (2 * mgH2) = 793 ∧
-  (2 * mgH2) * 10000 / (2 * mgH2O) = 1119 ∧ mgO2 * 10000 / (2 * mgH2O) = 8880 ∧
-  1119 + 8880 = 9999 := by decide
+  per10k (2 * mgH2) (2 * mgH2O) = 1119 ∧ per10k mgO2 (2 * mgH2O) = 8880 ∧
+  2 * mgH2O - 2 * mgH2 = mgO2 := by decide
 
 -- ── 8 · MASS IS CONSERVED AT EVERY SCALE — so the loop CANNOT MAKE WATER. Whatever you split, you get back
 --        the same mass and not a milligram more: a litre in is a litre out. This is the statement that fixes
@@ -140,13 +166,17 @@ theorem one_litre_split_returns_one_litre_burnt :
 theorem only_oxy_hydrogen_burns_without_admitting_nitrogen :
   7808 * 100 / 2095 = 372 ∧ 0 * 372 = 0 ∧ ¬ (372 = 0) := by decide
 
--- ── 11 · THE SYMMETRY, stated as the reason there is nothing to extract. Splitting costs 285.83 kJ per mole
---         and burning returns at most the same 285.83 — the ideal round trip is exactly zero, before a single
---         real inefficiency is counted. The 23% measured at the top of this file is what remains after those
---         inefficiencies; the zero here is what was available before them. A loop cannot be tuned into a
---         source when its best case is break-even. ──
-theorem the_ideal_round_trip_is_exactly_zero :
-  28583 - 28583 = 0 ∧ 28583 ≤ 28583 ∧ burnYield * 100 / splitCost = 23 := by decide
+-- ── 11 · THE SYMMETRY, stated as the reason there is nothing to extract. Splitting charges 285.83 kJ per mole
+--         to the ledger and burning returns at most the same 285.83: burning what was split is the identity,
+--         at every ledger value checked, before a single real inefficiency is counted. The 23% measured at the
+--         top of this file is what remains after those inefficiencies; the identity here is what was available
+--         before them. A loop cannot be tuned into a source when its best case is break-even. ──
+def bondHundredthsKJ : Nat := 28583   -- ΔH°f of liquid water, 285.83 kJ/mol, in hundredths
+def splitE (e : Nat) : Nat := e + bondHundredthsKJ
+def burnE  (e : Nat) : Nat := e - bondHundredthsKJ
+
+theorem splitting_then_burning_is_the_identity_at_the_ideal :
+  (List.range 1000).all (fun e => burnE (splitE e) == e) ∧ pct burnYield splitCost = 23 := by decide
 
 -- ── WHAT A BUILDER RUNS INTO NEXT ────────────────────────────────────────────────────────────────────────
 -- The stoichiometry above is exact and favourable; these are the numbers that decide whether the machine can
@@ -158,58 +188,77 @@ def mLperMol : Nat := 22414  -- millilitres per mole at STP
 def whPerKgH2: Nat := 33300  -- lower heating value, Wh per kg
 def petrolWhL: Nat := 9700   -- Wh per litre of petrol, for scale
 
+-- Litres of gas at STP for a number of moles, and the moles read back from the litres.
+def litresOf (mol : Nat) : Nat := mol * mLperMol / 1000
+def molesOf  (l : Nat)   : Nat := l * 1000 / mLperMol
+
 -- ── 12 · THE EXPANSION. Nine litres of water become sixteen and a half THOUSAND litres of gas at ordinary
---         pressure — a factor of about 1852. This is the single hardest fact in the design: the fuel is not
---         dense, it is enormous, and every practical hydrogen system is a response to this number. ──
-theorem the_gases_are_eighteen_hundred_times_the_water_they_came_from :
-  molH2 * mLperMol / 1000 = 11117 ∧ molO2 * mLperMol / 1000 = 5558 ∧
-  (molH2 * mLperMol / 1000 + molO2 * mLperMol / 1000) / 9 = 1852 := by decide
-
--- ── 13 · AND THE VOLUME IS MOSTLY THE LIGHT HALF. Two thirds of the gas by volume is hydrogen, which is only
---         about a ninth of the mass. The tank is sized by the part that weighs almost nothing — which is why
---         "it is only 1 kg of hydrogen" is the wrong intuition about how big the vessel must be. ──
-theorem two_thirds_of_the_volume_carries_a_ninth_of_the_mass :
-  molH2 * 100 / (molH2 + molO2) = 66 ∧ (2 * mgH2) * 100 / (2 * mgH2O) = 11 := by decide
+--         pressure — a factor of about 1852. The volume reads back its moles to within one at every mole
+--         count below a thousand, so the litres below are the law's instances, not typed figures. This is the
+--         single hardest fact in the design: the fuel is not dense, it is enormous. ──
+theorem the_gas_volume_reads_back_its_moles :
+  (List.range 1000).all (fun m => molesOf (litresOf m) ≤ m && m ≤ molesOf (litresOf m) + 1) ∧
+  molH2 = 2 * molO2 ∧ litresOf molH2 = 11117 ∧ litresOf molO2 = 5558 ∧
+  (litresOf molH2 + litresOf molO2) / 9 = 1852 := by decide
+
+-- ── 13 · AND THE VOLUME IS MOSTLY THE LIGHT HALF. Two parts in three is two thirds at EVERY scale, so the
+--         hydrogen's share of the volume does not depend on how much is made — and that share carries about a
+--         ninth of the mass. The tank is sized by the part that weighs almost nothing. ──
+theorem two_parts_in_three_is_two_thirds_at_every_scale :
+  (List.range' 1 500).all (fun m => pct (2 * m) (3 * m) == 66) ∧
+  pct molH2 (molH2 + molO2) = 66 ∧ pct (2 * mgH2) (2 * mgH2O) = 11 := by decide
 
 -- ── 14 · UNCOMPRESSED, IT IS HOPELESS BY VOLUME — about 2.99 Wh per litre against petrol's 9700, a factor of
---         over three thousand. Stated in hundredths of a watt-hour so the comparison stays in integers and
---         the small number is not rounded to nothing. ──
-theorem uncompressed_hydrogen_is_three_thousandfold_worse_by_volume :
-  whPerKgH2 * 100 / (molH2 * mLperMol / 1000) = 299 ∧
-  petrolWhL * 100 / 299 = 3244 := by decide
-
--- ── 15 · COMPRESSED TO 700 BAR it becomes practical but not competitive: about 1398 Wh per litre, still
---         roughly seven times worse than petrol by volume — and that is before the tank, which must hold 700
---         atmospheres and weighs more than what it contains. Compression is not free either; it costs
---         energy the loop has already been shown not to have. ──
-theorem even_at_seven_hundred_bar_it_is_sevenfold_worse_by_volume :
-  42 * whPerKgH2 / 1000 = 1398 ∧ petrolWhL / 1398 = 6 := by decide
-
--- ── 16 · THE THROUGHPUT, per unit actually delivered. Every kilowatt-hour out of the engine costs 4.33
---         kilowatt-hours in and cycles three quarters of a litre of water. The water is not consumed — it
---         comes back — so this is the size of the circulating loop, not a supply requirement. ──
-theorem each_delivered_kilowatt_hour_costs_four_and_cycles_a_litre :
-  splitCost * 100 / burnYield = 433 ∧ 9 * 1000 / (burnYield / 1000) = 750 := by decide
-
--- ── 17 · WHERE THE REST GOES. Forty of every fifty-two kilowatt-hours leave as heat — 76% of the input. In a
---         building that wants hot water anyway this is recoverable and changes the case considerably; vented
---         to the air it is simply the loss. Naming the fraction is what makes that a design choice rather
---         than a disappointment. ──
-theorem three_quarters_of_the_input_leaves_as_heat :
-  splitCost - burnYield = 40000 ∧ (splitCost - burnYield) * 100 / splitCost = 76 := by decide
+--         over three thousand. The energy per litre is a floor division that multiplies back to the energy at
+--         every volume up to thirty litres; stated in hundredths of a watt-hour so the small number is not
+--         rounded to nothing. ──
+theorem the_energy_per_litre_multiplies_back_to_the_energy :
+  (List.range' 1 30).all (fun l =>
+    (whPerKgH2 * 100 / l) * l ≤ whPerKgH2 * 100 && whPerKgH2 * 100 < (whPerKgH2 * 100 / l + 1) * l) ∧
+  whPerKgH2 * 100 / litresOf molH2 = 299 ∧ petrolWhL * 100 / 299 = 3244 := by decide
+
+-- ── 15 · COMPRESSED TO 700 BAR it becomes practical but not competitive. Energy per litre scales with the
+--         density: doubling the kilograms per cubic metre doubles it, within one watt-hour, at every density
+--         below a hundred. At 700 bar (42 kg/m³) that is about 1398 Wh per litre, still roughly seven times
+--         worse than petrol — before the tank, which must hold 700 atmospheres. ──
+def whPerLitreAt (kgPerM3 : Nat) : Nat := kgPerM3 * whPerKgH2 / 1000
+
+theorem compression_scales_the_energy_per_litre_linearly :
+  (List.range 100).all (fun k =>
+    2 * whPerLitreAt k ≤ whPerLitreAt (2 * k) && whPerLitreAt (2 * k) ≤ 2 * whPerLitreAt k + 1) ∧
+  whPerLitreAt 42 = 1398 ∧ petrolWhL / whPerLitreAt 42 = 6 := by decide
+
+-- ── 16 · THE THROUGHPUT, per unit actually delivered. Every kilowatt-hour out costs 4.33 in, and that figure
+--         is the reciprocal of the 23% returned: a percentage and its reciprocal multiply back to the whole,
+--         within their truncations, at every pair checked. The water cycled per delivered kWh — three quarters
+--         of a litre — comes back, so it sizes the loop, not a supply. ──
+theorem a_ratio_and_its_reciprocal_multiply_back_to_the_whole :
+  (List.range' 1 40).all (fun b => (List.range' 1 b).all (fun a =>
+    pct a b * pct b a ≤ 10000 && 10000 < (pct a b + 1) * (pct b a + 1))) ∧
+  pct splitCost burnYield = 433 ∧ pct burnYield splitCost = 23 ∧
+  9 * 1000 / (burnYield / 1000) = 750 := by decide
+
+-- ── 17 · WHERE THE REST GOES. What is lost and what is returned add back to the input, and their two
+--         percentages re-add to the whole or to one short of it, at every input and yield checked. Forty of
+--         every fifty-two kilowatt-hours leave as heat — 76% — which a building that wants hot water can
+--         recover; vented to the air it is simply the loss. ──
+theorem the_loss_and_the_yield_read_back_the_input :
+  (List.range' 1 60).all (fun c => (List.range (c + 1)).all (fun y =>
+    (c - y) + y == c && 99 ≤ pct (c - y) c + pct y c && pct (c - y) c + pct y c ≤ 100)) ∧
+  splitCost - burnYield = 40000 ∧ pct (splitCost - burnYield) splitCost = 76 ∧
+  pct burnYield splitCost = 23 := by decide
 
 -- ── 18 · WHERE THE POLLUTION GOES. Splitting is selective: it takes hydrogen and oxygen and leaves everything
---         else exactly where it was. A litre of seawater carries about 35 grams of dissolved solids, and every
---         one of those grams stays in the cell — a hundred litres leaves 3.5 kilograms of it behind. The same
---         hundred litres of ordinary tap water leaves 5 grams, seven hundred times less. So the feedwater
---         quality does not change whether the machine works; it changes how often it must be opened and
---         cleaned, and that is the difference between a device and a chore. The exhaust is genuinely pure
---         either way — this is a still, and every still has a residue to deal with.
+--         else exactly where it was. The residue is litres times dissolved solids, so seawater leaves seven
+--         hundred times what tap water leaves at EVERY volume — the ratio is scale-free, and a hundred litres
+--         (3.5 kg against 5 g) is one instance. The feedwater does not decide whether the machine works; it
+--         decides how often it must be opened and cleaned. This is a still, and every still has a residue.
 def tdsSeawater : Nat := 35000  -- mg of dissolved solids per litre
 def tdsTapWater : Nat := 50     -- mg per litre, ordinary supply
+def residueMg (litres tds : Nat) : Nat := litres * tds
 
-theorem what_the_feedwater_leaves_behind_decides_the_maintenance :
-  100 * tdsSeawater / 1000 = 3500 ∧ 100 * tdsTapWater / 1000 = 5 ∧
-  tdsSeawater / tdsTapWater = 700 := by decide
+theorem the_residue_ratio_is_the_same_at_every_volume :
+  (List.range' 1 200).all (fun l => residueMg l tdsSeawater == 700 * residueMg l tdsTapWater) ∧
+  residueMg 100 tdsSeawater / 1000 = 3500 ∧ residueMg 100 tdsTapWater / 1000 = 5 := by decide
 
 end Energy

package/src/proof/light.lean

@@ -40,7 +40,10 @@ def kcd    : Nat := 683            -- K_cd, lm/W, exact
 
 def defining : List Nat := [c, dNuCs, hDigits, eDigits, kDigits, naDigits, kcd]
 
-theorem the_si_fixes_exactly_seven_constants : defining.length = 7 := by decide
+-- Seven, and seven DIFFERENT ones: a list that repeated a constant would still have length seven. Each is
+-- nonzero, so each fixes a unit rather than annulling it. (Was `defining.length = 7`, a count of a typed list.)
+theorem the_si_fixes_seven_distinct_nonzero_constants :
+  defining.length = 7 ∧ defining.eraseDups = defining ∧ defining.all (fun x => x > 0) := by decide
 
 -- ── SPACE FROM TIME, THROUGH LIGHT ──────────────────────────────────────────────────────────────────────
 -- The chain is definitional and it runs one way. ΔνCs fixes the second; the second and c fix the metre. So

package/src/proof/reach.lean

@@ -52,13 +52,14 @@ theorem doubling_the_domain_leaves_the_same_hole :
 
 -- ── 4 · THE DEPOSIT'S OWN LARGEST DOMAIN IS STILL A BOUND ───────────────────────────────────────────────
 -- 152,568,360,000 is the largest case-count any theorem in this tree walks. It is enormous and it is finite,
--- and the naturals do not stop there. Stated with the number so the point cannot be read as rhetorical.
+-- and the naturals do not stop there. Stated as a LAW with its inverse — the successor leaves every bound, the
+-- predecessor brings it back, and the step flips parity — decided at every bound above AND at the largest
+-- domain, so the number is an instance of the law rather than a value read back (2026-09-14).
 def largestDomainHere : Nat := 152568360000
 
-theorem even_the_largest_domain_here_has_an_outside :
-  largestDomainHere + 1 > largestDomainHere
-  ∧ largestDomainHere % 2 = 0
-  ∧ (largestDomainHere + 1) % 2 = 1 := by decide
+theorem the_successor_leaves_every_domain_and_the_predecessor_returns :
+  (bounds ++ [largestDomainHere]).all (fun n =>
+    n + 1 > n && (n + 1) - 1 == n && (n + 1) % 2 != n % 2) := by decide
 
 -- ── 5 · A THEOREM NAMED FOR THE CLAY PROBLEMS THAT DECIDED NOTHING ABOUT THEM — DELETED ─────────────────
 -- `this_file_settles_none_of_the_seven` stood here and decided:

package/src/proof/speed.lean

@@ -68,9 +68,14 @@ theorem no_constant_factor_accounts_for_the_gap :
   ¬ (10000 * 20 ≥ 1048576) ∧ 100 * 10 ≥ 1024 - 24 := by decide
 
 -- ── 4 · THE MEASURED RATIO, from the declared inputs, in the same unit on both sides — the mistake that
---        made an earlier theorem in this deposit compare seal-bits against a leaf count. ──
-theorem the_measured_ratio_at_a_million_leaves :
-  recomputeUs / verifyUs = 567971 ∧ recomputeUs > verifyUs * 500000 := by decide
+--        made an earlier theorem in this deposit compare seal-bits against a leaf count. Read against the
+--        law: the measurement is at least the gap the counting predicts, N over its inclusion path, so the
+--        machine's number agrees with the structure rather than standing beside it; and the ratio multiplies
+--        back to the recompute within one verify. ──
+theorem the_measured_ratio_exceeds_the_counted_gap :
+  (List.range' 1 20).all (fun k => 2 ^ k / rounds 40 (2 ^ k) ≤ recomputeUs / verifyUs) ∧
+  (recomputeUs / verifyUs) * verifyUs ≤ recomputeUs ∧ recomputeUs < (recomputeUs / verifyUs + 1) * verifyUs ∧
+  recomputeUs / verifyUs = 567971 := by decide
 
 -- ── 5 · VERIFY IS NOT FREE, and calling it O(1) would be the easy overclaim. It grows — slowly, and without
 --        bound — so a large enough set costs a longer path. Logarithmic is not constant. ──
@@ -81,8 +86,11 @@ theorem verification_grows_it_is_not_constant :
 -- ── 6 · NOTHING HERE IS SUB-NANOSECOND. The measured verify is 38000 nanoseconds. The claim that it is under
 --        one is off by four and a half orders of magnitude, and this theorem exists so that number sits in
 --        the ledger next to the impressive one rather than only the impressive one being quotable. ──
-theorem the_verify_is_thirty_eight_thousand_nanoseconds_not_one :
-  nsPerVerify = 38000 ∧ nsPerVerify > 1 ∧ nsPerVerify > 10000 := by decide
+--        The nanosecond figure is not a second typed input: it is the microsecond input converted, and the
+--        conversion reads back at every microsecond count below a thousand. ──
+theorem the_verify_in_nanoseconds_reads_back_its_microseconds :
+  (List.range 1000).all (fun u => u * 1000 / 1000 == u) ∧
+  nsPerVerify = verifyUs * 1000 ∧ nsPerVerify / 1000 = verifyUs ∧ nsPerVerify > 10000 := by decide
 
 -- ── 7 · THE WORK PER NODE IS THE SAME on both paths. Recompute and verify run the identical hash; only the
 --        COUNT differs. That is what makes this arithmetic rather than a claim about hardware. ──
@@ -107,12 +115,22 @@ def hexbitChars : Nat := 22     -- the same address over the 64-hexagram lattice
 def hexMs       : Nat := 16     -- median ms for 200,000 encodings, 8-bit table
 def hexbitMs    : Nat := 30     -- the same work, 6-bit lattice
 
--- Shorter: 22 against 32 is a 31% reduction, and that IS what hexbits unlock.
-theorem hexbits_are_shorter_than_hex :
-  hexbitChars < hexChars ∧ hexChars - hexbitChars = 10 ∧ hexbitChars * 100 / hexChars = 68 := by decide
+-- Characters needed for a 128-bit address at b bits per character: the ceiling of 128 / b.
+def charsFor (b : Nat) : Nat := (128 + b - 1) / b
+
+-- Shorter: the width is the ceiling of 128 bits over the symbol, and multiplying back covers the 128 bits
+-- with less than one symbol to spare, at every symbol width from one to eight bits. 32 and 22 are the
+-- instances at four and six bits — derived, not typed — and 22 against 32 is what hexbits unlock.
+theorem the_width_is_the_ceiling_of_128_bits_over_the_symbol :
+  (List.range' 1 8).all (fun b => charsFor b * b ≥ 128 && (charsFor b - 1) * b < 128) ∧
+  charsFor 4 = hexChars ∧ charsFor 6 = hexbitChars ∧
+  hexbitChars < hexChars ∧ hexbitChars * 100 / hexChars = 68 := by decide
 
 -- And slower: the same encodings cost 30 ms against 16, so the density is bought with time, not given.
-theorem hexbits_are_slower_than_hex :
+-- The ratio is a floor division in tenths, and it multiplies back to the timing within one step — at every
+-- divisor and dividend checked, of which the two medians are one instance.
+theorem hexbits_are_slower_and_the_ratio_multiplies_back :
+  (List.range' 1 20).all (fun b => (List.range 400).all (fun a => (a / b) * b ≤ a && a < (a / b + 1) * b)) ∧
   hexbitMs > hexMs ∧ hexbitMs * 10 / hexMs = 18 := by decide
 
 -- A theorem named `an_encoding_changes_width_not_the_count_of_operations` stood here and is DELETED. It

package/src/proof/split.lean

@@ -123,11 +123,17 @@ theorem every_root_is_a_single :
 def coins : Nat := 2
 def coinStep : Nat := 3 * coins
 
-theorem the_coin_step_is_three_times_the_two_coins :
-  coins = 2 ∧ coinStep = 6 ∧ coinStep = 3 * 2 := by decide
-
-theorem accounting_the_coins_on_the_last_pair :
-  78 = 3 * 26 ∧ 3 * (26 - coins) = 72 ∧ 72 = 8 * 9 := by decide
+-- The coin step and the coins are INVERSE: tripling and dividing by three undo each other at every count below
+-- twenty, and the step is the instance at the two coins — derived by the law, not typed beside it.
+theorem the_coin_step_and_the_coins_are_inverse :
+  ((List.range 20).all (fun c => 3 * c / 3 == c && (3 * c) % 3 == 0))
+  ∧ coinStep = 3 * coins ∧ coinStep / 3 = coins := by decide
+
+-- Paying and refunding round-trip on the last pair: whatever k of its 26 coins are paid, the paid part and the
+-- rest recombine to 78 = 3 · 26; the two coins are the instance, leaving 72 = 8 · 9.
+theorem paying_and_refunding_coins_on_the_last_pair_round_trips :
+  ((List.range 27).all (fun k => 3 * (26 - k) + 3 * k == 78))
+  ∧ 3 * (26 - coins) = 72 ∧ 72 = 8 * 9 := by decide
 
 -- The two classes, named rather than counted.
 theorem the_exhaustible_tokens_are_those_six_divides :
@@ -164,8 +170,11 @@ theorem inside_this_ideal_the_bare_coin_sorts_as_the_scaled_one :
 -- orbit the whole deposit is built on, and paying the two coins buys exactly one step of it.
 def sealBits : Nat := 128
 
-theorem the_seal_affords_sixty_four_payments_of_two :
-  sealBits / coins = 64 ∧ 64 = 2 ^ 6 ∧ sealBits = 64 * coins := by decide
+-- A seal divides into payments and multiplies back: for every power of two up to the seal, splitting the seal
+-- into that many parts and recombining them returns it; the two coins are the instance, 64 = 2 ^ 6 payments.
+theorem a_seal_divides_into_payments_and_multiplies_back :
+  ([1, 2, 4, 8, 16, 32, 64, 128].all (fun c => (sealBits / c) * c == sealBits && sealBits / (sealBits / c) == c))
+  ∧ sealBits / coins = 2 ^ 6 := by decide
 
 theorem sixty_four_is_where_the_doubling_returns :
   (2 ^ 6) % 9 = 1
@@ -173,8 +182,10 @@ theorem sixty_four_is_where_the_doubling_returns :
   ∧ ((List.range' 1 5).all (fun k => (2 ^ k) % 9 != 1)) := by decide
 
 -- The two readings meet: the budget a seal affords and the period of the orbit are the same six.
-theorem the_budget_and_the_period_are_one_turn :
-  sealBits / coins = 2 ^ 6 ∧ (2 ^ 6) % 9 = 1 := by decide
+-- The orbit turns once per budget: doubling returns to the same residue after six steps at every one of the first
+-- sixty, and the budget a seal affords is two to that six.
+theorem the_orbit_turns_once_per_budget :
+  ((List.range 60).all (fun n => 2 ^ (n + 6) % 9 == 2 ^ n % 9)) ∧ 2 ^ 6 = sealBits / coins := by decide
 
 
 end Split

package/src/proof/trial-all.json

@@ -15256,5 +15256,149 @@
     "verdict": "UNVERIFIED",
     "ground": "no candidate in the current space — nothing to recompute",
     "receipt": "19e4c01e-8d78-8ee5-8003-bcbbce30ce79"
+  },
+  {
+    "key": "lean_coin_the_nines_complement_pairs_the_ten_digits",
+    "verdict": "UNVERIFIED",
+    "ground": "no candidate in the current space — nothing to recompute",
+    "receipt": "4f280944-1969-89d7-951d-0861c1dae315"
+  },
+  {
+    "key": "lean_split_the_coin_step_and_the_coins_are_inverse",
+    "verdict": "UNVERIFIED",
+    "ground": "no candidate in the current space — nothing to recompute",
+    "receipt": "1dd0f6d3-af8e-8fe5-8a17-5e4d06a303f8"
+  },
+  {
+    "key": "lean_split_paying_and_refunding_coins_on_the_last_pair_round_trips",
+    "verdict": "UNVERIFIED",
+    "ground": "no candidate in the current space — nothing to recompute",
+    "receipt": "d09b81fa-777d-8844-bfae-e43143c32ed6"
+  },
+  {
+    "key": "lean_split_a_seal_divides_into_payments_and_multiplies_back",
+    "verdict": "UNVERIFIED",
+    "ground": "no candidate in the current space — nothing to recompute",
+    "receipt": "1984d72b-4263-87d9-bfd6-70a282ac37ab"
+  },
+  {
+    "key": "lean_split_the_orbit_turns_once_per_budget",
+    "verdict": "UNVERIFIED",
+    "ground": "no candidate in the current space — nothing to recompute",
+    "receipt": "35d5dc48-cbc0-8b91-aaaf-2976834a5f5f"
+  },
+  {
+    "key": "lean_energy_any_yield_below_its_cost_reads_under_the_whole",
+    "verdict": "UNVERIFIED",
+    "ground": "no candidate in the current space — nothing to recompute",
+    "receipt": "64823215-1e97-88ef-ab5f-46f0ed44534a"
+  },
+  {
+    "key": "lean_energy_the_cost_per_litre_multiplies_back_to_the_cost",
+    "verdict": "UNVERIFIED",
+    "ground": "no candidate in the current space — nothing to recompute",
+    "receipt": "2fafc1e2-f58f-8431-8e73-cfaa3c48dc21"
+  },
+  {
+    "key": "lean_energy_the_mass_balance_is_the_atom_balance",
+    "verdict": "UNVERIFIED",
+    "ground": "no candidate in the current space — nothing to recompute",
+    "receipt": "2854e1d5-ab5d-8f6f-aae3-a6d17a1f5202"
+  },
+  {
+    "key": "lean_energy_the_atom_table_decides_the_balance",
+    "verdict": "UNVERIFIED",
+    "ground": "no candidate in the current space — nothing to recompute",
+    "receipt": "98e0c98d-7b0c-8a11-a21f-84b31b36f426"
+  },
+  {
+    "key": "lean_energy_a_part_and_its_rest_read_back_the_whole",
+    "verdict": "UNVERIFIED",
+    "ground": "no candidate in the current space — nothing to recompute",
+    "receipt": "d4addfa7-6e96-8896-8574-0608cec8caf0"
+  },
+  {
+    "key": "lean_energy_splitting_then_burning_is_the_identity_at_the_ideal",
+    "verdict": "UNVERIFIED",
+    "ground": "no candidate in the current space — nothing to recompute",
+    "receipt": "f354845f-b6af-8133-a8b0-ac3c1c3c6c18"
+  },
+  {
+    "key": "lean_energy_the_gas_volume_reads_back_its_moles",
+    "verdict": "UNVERIFIED",
+    "ground": "no candidate in the current space — nothing to recompute",
+    "receipt": "464b601e-4839-8b4d-bdad-e1f82ff6be74"
+  },
+  {
+    "key": "lean_energy_two_parts_in_three_is_two_thirds_at_every_scale",
+    "verdict": "UNVERIFIED",
+    "ground": "no candidate in the current space — nothing to recompute",
+    "receipt": "6913b23d-5d6d-832c-9992-426fc4755697"
+  },
+  {
+    "key": "lean_energy_the_energy_per_litre_multiplies_back_to_the_energy",
+    "verdict": "UNVERIFIED",
+    "ground": "no candidate in the current space — nothing to recompute",
+    "receipt": "6ca259eb-a048-889f-953f-ffb3af4e191d"
+  },
+  {
+    "key": "lean_energy_compression_scales_the_energy_per_litre_linearly",
+    "verdict": "UNVERIFIED",
+    "ground": "no candidate in the current space — nothing to recompute",
+    "receipt": "62f26437-7387-84fc-bed6-8afc5ccf0921"
+  },
+  {
+    "key": "lean_energy_a_ratio_and_its_reciprocal_multiply_back_to_the_whole",
+    "verdict": "UNVERIFIED",
+    "ground": "no candidate in the current space — nothing to recompute",
+    "receipt": "07ef3913-ea46-810b-85b9-be9b21a8f476"
+  },
+  {
+    "key": "lean_energy_the_loss_and_the_yield_read_back_the_input",
+    "verdict": "UNVERIFIED",
+    "ground": "no candidate in the current space — nothing to recompute",
+    "receipt": "945f6f02-5f28-8c32-a3a8-226b5a6e37e4"
+  },
+  {
+    "key": "lean_energy_the_residue_ratio_is_the_same_at_every_volume",
+    "verdict": "UNVERIFIED",
+    "ground": "no candidate in the current space — nothing to recompute",
+    "receipt": "b0b19d5b-1924-8383-b871-740fdb759594"
+  },
+  {
+    "key": "lean_light_the_si_fixes_seven_distinct_nonzero_constants",
+    "verdict": "UNVERIFIED",
+    "ground": "no candidate in the current space — nothing to recompute",
+    "receipt": "b8191727-00d7-8658-a6ea-e9b71aed9e9d"
+  },
+  {
+    "key": "lean_reach_the_successor_leaves_every_domain_and_the_predecessor_returns",
+    "verdict": "UNVERIFIED",
+    "ground": "no candidate in the current space — nothing to recompute",
+    "receipt": "e11c16ca-5d37-8dc4-9af3-7a3488c33cd8"
+  },
+  {
+    "key": "lean_speed_the_measured_ratio_exceeds_the_counted_gap",
+    "verdict": "UNVERIFIED",
+    "ground": "no candidate in the current space — nothing to recompute",
+    "receipt": "f8640798-50bd-8c98-b980-085593d93807"
+  },
+  {
+    "key": "lean_speed_the_verify_in_nanoseconds_reads_back_its_microseconds",
+    "verdict": "UNVERIFIED",
+    "ground": "no candidate in the current space — nothing to recompute",
+    "receipt": "e8a082ef-9515-8029-bfae-0a73deba82b4"
+  },
+  {
+    "key": "lean_speed_the_width_is_the_ceiling_of_128_bits_over_the_symbol",
+    "verdict": "UNVERIFIED",
+    "ground": "no candidate in the current space — nothing to recompute",
+    "receipt": "5811891a-d052-8382-8f7c-9a3d6def88cc"
+  },
+  {
+    "key": "lean_speed_hexbits_are_slower_and_the_ratio_multiplies_back",
+    "verdict": "UNVERIFIED",
+    "ground": "no candidate in the current space — nothing to recompute",
+    "receipt": "91a92ea5-bedd-8b9a-80b7-29130fbe5a93"
   }
 ]