# inventory-allowlist.txt — the pinned audit surface (Phase 3b).
#
# One line per constant in the compiled environment of the corpus
# modules (GEN_MODULES + PROOFS in check.sh), emitted by
# Proofs/Inventory.lean:   INV|<fully-qualified name>|<kind>|<axiom cone>
#
# EVERYTHING the kernel saw is here — including compiler-generated
# auxiliaries (match_*/eq_*/induct/_proof_*/_unary and _private.*
# mangles). There is no filtering, so there is no name shape that can
# escape: a new, renamed, re-namespaced, private, attributed, indented,
# or instance declaration changes the environment and fails the diff.
# Regenerate ONLY by reviewing `lean-guard Proofs/Inventory.lean` output
# line by line; every addition must be justified in STATEMENT-MAP.md or
# be a compiler-generated auxiliary of a justified declaration.
#
# Invariant checked by check.sh on top of the diff:
#   exactly ONE axiom line in this file, and it is LTLAcc.sha256.
INV|LTLAcc.Bytes|def|
INV|LTLAcc.ConsRec._unary._proof_1|theorem|Quot.sound,propext
INV|LTLAcc.ConsRec._unary._proof_2|theorem|Quot.sound,propext
INV|LTLAcc.ConsRec._unary.eq_def|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.ConsRec._unary.induct|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.ConsRec._unary|def|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.ConsRec.eq_1|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.ConsRec.eq_def|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.ConsRec.induct|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.ConsRec.match_1|def|
INV|LTLAcc.ConsRec|def|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.Hash|def|
INV|LTLAcc.IsCollision|def|LTLAcc.sha256
INV|LTLAcc.MTH._proof_1|theorem|Quot.sound,propext
INV|LTLAcc.MTH._proof_2|theorem|Quot.sound,propext
INV|LTLAcc.MTH.eq_1|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.MTH.eq_def|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.MTH_single|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.MTH_split._proof_1_2|theorem|Quot.sound,propext
INV|LTLAcc.MTH_split._proof_1_3|theorem|Quot.sound,propext
INV|LTLAcc.MTH_split|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.MTH|def|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.Path._unary._proof_1|theorem|Quot.sound,propext
INV|LTLAcc.Path._unary._proof_2|theorem|Quot.sound,propext
INV|LTLAcc.Path._unary.eq_def|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.Path._unary.induct|theorem|Quot.sound,propext
INV|LTLAcc.Path._unary|def|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.Path.eq_1|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.Path.eq_def|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.Path.induct|theorem|Quot.sound,propext
INV|LTLAcc.Path|def|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.Root._unary._proof_1|theorem|Quot.sound,propext
INV|LTLAcc.Root._unary._proof_2|theorem|Quot.sound,propext
INV|LTLAcc.Root._unary.eq_def|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.Root._unary|def|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.Root.eq_1|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.Root.eq_def|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.Root.match_1|def|
INV|LTLAcc.Root_left._proof_1_1|theorem|Quot.sound,propext
INV|LTLAcc.Root_left._proof_1_2|theorem|Quot.sound,propext
INV|LTLAcc.Root_left|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.Root_one_cons|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.Root_one|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.Root_right._proof_1_1|theorem|Quot.sound,propext
INV|LTLAcc.Root_right._proof_1_2|theorem|Quot.sound,propext
INV|LTLAcc.Root_right|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.Root|def|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.acceptCons_sound._proof_1_1|theorem|Quot.sound,propext
INV|LTLAcc.acceptCons_sound|theorem|Classical.choice,LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.acceptCons|def|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.acceptIncl_complete|theorem|Classical.choice,LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.acceptIncl_sound|theorem|Classical.choice,LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.acceptIncl|def|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.consRecBinding._proof_1_10|theorem|Quot.sound,propext
INV|LTLAcc.consRecBinding._proof_1_11|theorem|Quot.sound,propext
INV|LTLAcc.consRecBinding._proof_1_12|theorem|Quot.sound,propext
INV|LTLAcc.consRecBinding._proof_1_13|theorem|Quot.sound,propext
INV|LTLAcc.consRecBinding._proof_1_14|theorem|Quot.sound,propext
INV|LTLAcc.consRecBinding._proof_1_15|theorem|Quot.sound,propext
INV|LTLAcc.consRecBinding._proof_1_16|theorem|Quot.sound,propext
INV|LTLAcc.consRecBinding._proof_1_17|theorem|Quot.sound,propext
INV|LTLAcc.consRecBinding._proof_1_5|theorem|Quot.sound,propext
INV|LTLAcc.consRecBinding._proof_1_6|theorem|Quot.sound,propext
INV|LTLAcc.consRecBinding._proof_1_7|theorem|Quot.sound,propext
INV|LTLAcc.consRecBinding._proof_1_8|theorem|Quot.sound,propext
INV|LTLAcc.consRecBinding.match_1|def|
INV|LTLAcc.consRecBinding|theorem|Classical.choice,LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.consRec_base_false_eq._sparseCasesOn_1|def|propext
INV|LTLAcc.consRec_base_false_eq._sparseCasesOn_2|def|propext
INV|LTLAcc.consRec_base_false_eq.match_1|def|propext
INV|LTLAcc.consRec_base_false_eq|theorem|Classical.choice,Quot.sound,propext
INV|LTLAcc.consRec_base_true_eq.match_1|def|propext
INV|LTLAcc.consRec_base_true_eq|theorem|propext
INV|LTLAcc.consRec_some_le._proof_1_1|theorem|Quot.sound,propext
INV|LTLAcc.consRec_some_le|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.domsep|theorem|
INV|LTLAcc.eq_dropLast_append_of_getLast?|theorem|propext
INV|LTLAcc.exists_singleton_of_length_one|theorem|Classical.choice,Quot.sound,propext
INV|LTLAcc.extractCons.eq_1|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.extractCons.match_1|def|
INV|LTLAcc.extractConsNode._unary._proof_1|theorem|Quot.sound,propext
INV|LTLAcc.extractConsNode._unary._proof_2|theorem|Quot.sound,propext
INV|LTLAcc.extractConsNode._unary.eq_def|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.extractConsNode._unary|def|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.extractConsNode.eq_1|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.extractConsNode.eq_def|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.extractConsNode.match_1|def|
INV|LTLAcc.extractConsNode|def|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.extractCons_correct._proof_1_2|theorem|Quot.sound,propext
INV|LTLAcc.extractCons_correct._proof_1_3|theorem|Quot.sound,propext
INV|LTLAcc.extractCons_correct_paper._proof_1_1|theorem|Quot.sound,propext
INV|LTLAcc.extractCons_correct_paper|theorem|Classical.choice,LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.extractCons_correct|theorem|Classical.choice,LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.extractCons_nonvacuous._proof_1_2|theorem|Quot.sound,propext
INV|LTLAcc.extractCons_nonvacuous|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.extractCons|def|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.extractIncl._unary._proof_1|theorem|Quot.sound,propext
INV|LTLAcc.extractIncl._unary._proof_2|theorem|Quot.sound,propext
INV|LTLAcc.extractIncl._unary.eq_def|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.extractIncl._unary|def|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.extractIncl.eq_1|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.extractIncl.eq_def|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.extractIncl.match_1|def|
INV|LTLAcc.extractIncl_correct._proof_1_1|theorem|Quot.sound,propext
INV|LTLAcc.extractIncl_correct._proof_1_3|theorem|Quot.sound,propext
INV|LTLAcc.extractIncl_correct._proof_1_4|theorem|Quot.sound,propext
INV|LTLAcc.extractIncl_correct._proof_1_5|theorem|Quot.sound,propext
INV|LTLAcc.extractIncl_correct._proof_1_6|theorem|Quot.sound,propext
INV|LTLAcc.extractIncl_correct._proof_1_7|theorem|Quot.sound,propext
INV|LTLAcc.extractIncl_correct._proof_1_8|theorem|Quot.sound,propext
INV|LTLAcc.extractIncl_correct._proof_1_9|theorem|Quot.sound,propext
INV|LTLAcc.extractIncl_correct|theorem|Classical.choice,LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.extractIncl_nonvacuous._proof_1_2|theorem|Quot.sound,propext
INV|LTLAcc.extractIncl_nonvacuous|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.extractIncl|def|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.extractMTH._unary._proof_1|theorem|Quot.sound,propext
INV|LTLAcc.extractMTH._unary._proof_2|theorem|Quot.sound,propext
INV|LTLAcc.extractMTH._unary.eq_def|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.extractMTH._unary.induct|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.extractMTH._unary|def|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.extractMTH.eq_1|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.extractMTH.eq_def|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.extractMTH.induct|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.extractMTH_correct._proof_1_10|theorem|Quot.sound,propext
INV|LTLAcc.extractMTH_correct._proof_1_4|theorem|Quot.sound,propext
INV|LTLAcc.extractMTH_correct._proof_1_5|theorem|Quot.sound,propext
INV|LTLAcc.extractMTH_correct._proof_1_6|theorem|Quot.sound,propext
INV|LTLAcc.extractMTH_correct._proof_1_7|theorem|Quot.sound,propext
INV|LTLAcc.extractMTH_correct._proof_1_8|theorem|Quot.sound,propext
INV|LTLAcc.extractMTH_correct._proof_1_9|theorem|Quot.sound,propext
INV|LTLAcc.extractMTH_correct|theorem|Classical.choice,LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.extractMTH_nonvacuous._proof_1_2|theorem|Quot.sound,propext
INV|LTLAcc.extractMTH_nonvacuous|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.extractMTH|def|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.fork_distinct|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.getD_drop._proof_1_1|theorem|Quot.sound,propext
INV|LTLAcc.getD_drop|theorem|Quot.sound,propext
INV|LTLAcc.getD_take._proof_1_1|theorem|Quot.sound,propext
INV|LTLAcc.getD_take._proof_1_2|theorem|Quot.sound,propext
INV|LTLAcc.getD_take|theorem|Quot.sound,propext
INV|LTLAcc.hleaf|def|LTLAcc.sha256
INV|LTLAcc.hnode_preimage_inj|theorem|propext
INV|LTLAcc.hnode|def|LTLAcc.sha256
INV|LTLAcc.incl_complete._proof_1_3|theorem|Quot.sound,propext
INV|LTLAcc.incl_complete._proof_1_5|theorem|Quot.sound,propext
INV|LTLAcc.incl_complete._proof_1_6|theorem|Quot.sound,propext
INV|LTLAcc.incl_complete._proof_1_7|theorem|Quot.sound,propext
INV|LTLAcc.incl_complete._proof_1_8|theorem|Quot.sound,propext
INV|LTLAcc.incl_complete._proof_1_9|theorem|Quot.sound,propext
INV|LTLAcc.incl_complete|theorem|Classical.choice,LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.instDecidableEqHash._proof_1|theorem|
INV|LTLAcc.instDecidableEqHash|def|
INV|LTLAcc.instInhabitedHash._proof_1|theorem|propext
INV|LTLAcc.instInhabitedHash|def|propext
INV|LTLAcc.kbelow._proof_1|theorem|Quot.sound,propext
INV|LTLAcc.kbelow._unsafe_rec|def|
INV|LTLAcc.kbelow.eq_1|theorem|Quot.sound,propext
INV|LTLAcc.kbelow.eq_def|theorem|Quot.sound,propext
INV|LTLAcc.kbelow.induct|theorem|Quot.sound,propext
INV|LTLAcc.kbelow_eq_of_pow2_between._proof_1_1|theorem|Quot.sound,propext
INV|LTLAcc.kbelow_eq_of_pow2_between._proof_1_2|theorem|Quot.sound,propext
INV|LTLAcc.kbelow_eq_of_pow2_between._proof_1_3|theorem|Quot.sound,propext
INV|LTLAcc.kbelow_eq_of_pow2_between._proof_1_4|theorem|Quot.sound,propext
INV|LTLAcc.kbelow_eq_of_pow2_between|theorem|Quot.sound,propext
INV|LTLAcc.kbelow_lt._proof_1_3|theorem|Quot.sound,propext
INV|LTLAcc.kbelow_lt._proof_1_4|theorem|Quot.sound,propext
INV|LTLAcc.kbelow_lt._proof_1_5|theorem|Quot.sound,propext
INV|LTLAcc.kbelow_lt|theorem|Quot.sound,propext
INV|LTLAcc.kbelow_pos|theorem|Quot.sound,propext
INV|LTLAcc.kbelow_pow2|theorem|Quot.sound,propext
INV|LTLAcc.kbelow_prefix_eq._proof_1_1|theorem|Quot.sound,propext
INV|LTLAcc.kbelow_prefix_eq|theorem|Quot.sound,propext
INV|LTLAcc.kbelow|def|Quot.sound,propext
INV|LTLAcc.le_two_kbelow._proof_1_3|theorem|Quot.sound,propext
INV|LTLAcc.le_two_kbelow._proof_1_4|theorem|Quot.sound,propext
INV|LTLAcc.le_two_kbelow|theorem|Quot.sound,propext
INV|LTLAcc.pinAccept_monotone._proof_1_1|theorem|Quot.sound,propext
INV|LTLAcc.pinAccept_monotone._proof_1_2|theorem|Quot.sound,propext
INV|LTLAcc.pinAccept_monotone|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.pinAccept|def|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.pinExtract.eq_1|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.pinExtract|def|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.pin_prefix_correct._proof_1_2|theorem|Quot.sound,propext
INV|LTLAcc.pin_prefix_correct|theorem|Classical.choice,LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.pin_prefix_nonvacuous._proof_1_2|theorem|Quot.sound,propext
INV|LTLAcc.pin_prefix_nonvacuous|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.pow2_exp_unique._proof_1_1|theorem|Quot.sound,propext
INV|LTLAcc.pow2_exp_unique._proof_1_2|theorem|Quot.sound,propext
INV|LTLAcc.pow2_exp_unique._proof_1_3|theorem|Quot.sound,propext
INV|LTLAcc.pow2_exp_unique|theorem|Quot.sound,propext
INV|LTLAcc.sha256|axiom|LTLAcc.sha256
INV|LTLAcc.take_all|theorem|propext
INV|LTLAcc.take_append_drop|theorem|
INV|LTLAcc.take_drop_prefix|theorem|Classical.choice,Quot.sound,propext
INV|LTLAcc.take_take_le._proof_1_1|theorem|Quot.sound,propext
INV|LTLAcc.take_take_le|theorem|Quot.sound,propext
INV|_private.Proofs.Basic.0.LTLAcc.ConsRec.match_1.eq_1|theorem|
INV|_private.Proofs.Basic.0.LTLAcc.ConsRec.match_1.eq_2|theorem|
INV|_private.Proofs.Basic.0.LTLAcc.ConsRec.match_1.splitter|def|
INV|_private.Proofs.Basic.0.LTLAcc.Root.match_1.eq_1|theorem|
INV|_private.Proofs.Basic.0.LTLAcc.Root.match_1.eq_2|theorem|
INV|_private.Proofs.Basic.0.LTLAcc.Root.match_1.splitter|def|
INV|_private.Proofs.Basic.0.PSigma.casesOn._arg_pusher|theorem|
INV|_private.Proofs.Binding3.0.LTLAcc.ConsRec.match_1.eq_1|theorem|
INV|_private.Proofs.Binding3.0.LTLAcc.ConsRec.match_1.eq_2|theorem|
INV|_private.Proofs.Binding3.0.LTLAcc.ConsRec.match_1.splitter|def|
INV|_private.Proofs.Binding3.0.LTLAcc.Root.match_1.eq_1|theorem|
INV|_private.Proofs.Binding3.0.LTLAcc.Root.match_1.eq_2|theorem|
INV|_private.Proofs.Binding3.0.LTLAcc.Root.match_1.splitter|def|
INV|_private.Proofs.Binding3.0.LTLAcc.consRecBinding.match_1.eq_1|theorem|
INV|_private.Proofs.Binding3.0.LTLAcc.consRecBinding.match_1.eq_2|theorem|
INV|_private.Proofs.Binding3.0.LTLAcc.consRecBinding.match_1.splitter|def|
INV|_private.Proofs.Completeness.0.PSigma.casesOn._arg_pusher|theorem|
INV|_private.Proofs.Consistency.0.LTLAcc.extractConsNode.match_1.eq_1|theorem|
INV|_private.Proofs.Consistency.0.LTLAcc.extractConsNode.match_1.eq_2|theorem|
INV|_private.Proofs.Consistency.0.LTLAcc.extractConsNode.match_1.splitter|def|
INV|_private.Proofs.Consistency.0.PSigma.casesOn._arg_pusher|theorem|
INV|_private.Proofs.Descent.0.PSigma.casesOn._arg_pusher|theorem|
INV|_private.Proofs.Extract.0.LTLAcc.extractIncl.match_1.eq_1|theorem|
INV|_private.Proofs.Extract.0.LTLAcc.extractIncl.match_1.eq_2|theorem|
INV|_private.Proofs.Extract.0.LTLAcc.extractIncl.match_1.splitter|def|
INV|_private.Proofs.Extract.0.PSigma.casesOn._arg_pusher|theorem|