Nine parallel readers audited every doc against measured ground truth; every
finding was re-verified against the file before any edit, and the sweep fixed
by PROPERTY, not by flag — wording the readers caught in one repo was hunted
in all siblings (the two-button README sentence existed in all four forks,
not the three flagged; likewise the cone-overclaim in TRUSTED-BASE item 1).
This repo: see the diff. Records were not rewritten; clarifications are
dated. Doc-only except where noted in the estate summary; every gated doc
change was followed by a green button run.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Proven & compiling (check.sh): PPallas primality cert, Denote (Montgomery
denotation + Canon), HelperSpecs (adc/sbb/mac exact specs), SubNegSpec
(sub/neg), ConstSpecs (R/R2/INV/zero/one) — all against the real extraction,
no bridge axioms.
Diagnosed and documented: add/mul/montgomery_reduce/square/invert/FieldMain
overflow the Lean kernel's proof-checking memory because omega certificates
with 2^256/2^512-scale coefficients (intrinsic to 4x64 Montgomery arithmetic)
exceed the kernel budget. Drafts + the standalone-proven montgomery accounting
lemma retained under Proofs/drafts/. Fix (linear_combination + context-free
big-coefficient lemmas) is mechanical, not yet complete. Documented honestly,
not shipped behind an axiom.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
AddSpec: sub_spec preconditions discharged by exact matches (the blanket
simp[*] discharge here is what OOM-crashed the session — see
formal-verification-control/POSTMORTEM-2026-07-02.md). ConstSpecs: R/R2/INV/
zero/one literal specs. ReduceSpec: full HAC 14.32 Montgomery accounting —
per-round dropped-limb-is-zero facts from k = r·INV, exact t'·2^256 = t + m·p
identity, composition with the general sub_spec reduction. MulSpec: 16-mac
schoolbook accounting via zify + linear_combination (nonlinear cross-products
are atoms), composed with montgomery_reduce_spec. DRAFTS: written against the
generated code but not yet compiled; README carries an explicit construction
note until check.sh goes green.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
