The 'descend' step of the paper's Theorem 3, built extractor-first per
the S3.5 lesson (never a bare '∨ collision'):
- extractMTH (D D'): total function that, given two equal-length leaf
lists sharing a Merkle root, walks the common-shape tree to the first
divergence and returns the concrete colliding preimage pair (a node
pair, or a leaf pair at the bottom).
- extractMTH_correct: |D|=|D'| ∧ D≠D' ∧ MTH D = MTH D' →
IsCollision (extractMTH D D'). Proven by functional induction on
extractMTH; composite case uses MTH_split + append_inj (fixed-width
Hash) to split node preimages or exhibit the node collision.
- extractMTH_nonvacuous: equal lists → output NOT a collision (pinned),
so the conclusion is false for some inputs ⇒ choice-proof.
This also RESTORES, in explicit non-vacuous form, the receipt-uniqueness
content of Lemma 2 deleted in the S3.5 cleanup (re-audit F2): the honest
Merkle fold is injective up to a collision.
18 certs green. Fable statement-audit passed (matches paper Thm 3 step 3
verbatim). LTL untouched (12 leaves, bcd15f9d).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
