S2 Fable-5 re-audit: close the kbelow/RFC-fidelity gap (kbelow_pow2)

Adversarial statement-level re-verification of everything S2 shipped,
against paper SS5.3 and the deployed Python verifier: Path recursion,
Root_left/Root_right fold shapes (none exactly where the deployed code
rejects), incl_complete as Theorem 1 verbatim (getD default unreachable
under m < |D|), MTH([]) = H(epsilon) per RFC. All faithful.

One genuine gap found and closed: the kbelow lemmas bounded k but never
established k is a power of two, leaving 'our split point = the RFC
split point' as by-construction folklore. kbelow_pow2 (cone: propext,
Quot.sound) now pins it: 2^j = k < n <= 2k = 2^(j+1) uniquely
determines the RFC 9162 split. THE button green. LTL untouched.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

verification/Proofs/AxiomCheck.lean

@@ -5,6 +5,7 @@ import Proofs.Completeness
 #print axioms LTLAcc.kbelow_pos
 #print axioms LTLAcc.kbelow_lt
 #print axioms LTLAcc.le_two_kbelow
+#print axioms LTLAcc.kbelow_pow2
 #print axioms LTLAcc.MTH
 #print axioms LTLAcc.Root
 #print axioms LTLAcc.ConsRec

verification/Proofs/Basic.lean

@@ -57,6 +57,20 @@ theorem le_two_kbelow (n : Nat) (h : 2 ≤ n) : n ≤ 2 * kbelow n := by
       have := ih h2
       omega
 
+/-- `kbelow` is a genuine power of two. Together with `kbelow_lt` and
+    `le_two_kbelow` (`2^j = k < n ≤ 2k = 2^(j+1)`) this pins `kbelow n`
+    as THE largest power of two strictly below `n` — the RFC 9162 split
+    point, uniquely determined. -/
+theorem kbelow_pow2 (n : Nat) : ∃ j, kbelow n = 2 ^ j := by
+  induction n using kbelow.induct with
+  | case1 n hle => exact ⟨0, by rw [kbelow]; simp only [if_pos hle]⟩
+  | case2 n hgt ih =>
+      obtain ⟨j, hj⟩ := ih
+      refine ⟨j + 1, ?_⟩
+      rw [kbelow]
+      simp only [if_neg hgt]
+      rw [hj, Nat.pow_succ, Nat.mul_comm]
+
 /-- `MTH` (paper §5.3): the RFC 9162 tree head over a leaf-data list.
     `MTH [] = H(ε)`, `MTH [d] = hleaf d`, and for `n ≥ 2` the split at
     `k = kbelow n`. -/

verification/check.sh

@@ -26,6 +26,7 @@ declare -A CONES=(
   [LTLAcc.kbelow_pos]="propext, Quot.sound"
   [LTLAcc.kbelow_lt]="propext, Quot.sound"
   [LTLAcc.le_two_kbelow]="propext, Quot.sound"
+  [LTLAcc.kbelow_pow2]="propext, Quot.sound"
   [LTLAcc.MTH]="propext, LTLAcc.sha256, Quot.sound"
   [LTLAcc.Root]="propext, LTLAcc.sha256, Quot.sound"
   [LTLAcc.ConsRec]="propext, LTLAcc.sha256, Quot.sound"