From eda498d9af6e436260a9a3862c1f5e2bd2e34e58 Mon Sep 17 00:00:00 2001 From: TankTechnology <2541826291@qq.com> Date: Wed, 5 Aug 2026 20:32:52 +0800 Subject: [PATCH 01/24] feat(ch31): general CRT (Thm 31.27) and exactly-d solutions (Thm 31.10) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - 31.5 chinese_remainder_general: the full k-modulus Chinese remainder theorem via Nat.chineseRemainderOfList (existence + uniqueness mod the product). - 31.4 linear_congruence_solutions: the solutions of a·x ≡ b (mod n) are exactly the residue class x0 mod (n/gcd(a,n)) (Thm 31.10). - 31.4 linear_congruence_distinct: the d = gcd(a,n) values k·(n/d) for k < d are pairwise incongruent, so there are exactly d distinct solutions. Co-Authored-By: Claude --- ...31_4_Solving_Modular_Linear_Equations.lean | 62 +++++++++++++++++++ ...ection_31_5_Chinese_Remainder_Theorem.lean | 31 +++++++--- 2 files changed, 86 insertions(+), 7 deletions(-) diff --git a/CLRSLean/Chapter_31/Section_31_4_Solving_Modular_Linear_Equations.lean b/CLRSLean/Chapter_31/Section_31_4_Solving_Modular_Linear_Equations.lean index 909a0c7..db2119d 100644 --- a/CLRSLean/Chapter_31/Section_31_4_Solving_Modular_Linear_Equations.lean +++ b/CLRSLean/Chapter_31/Section_31_4_Solving_Modular_Linear_Equations.lean @@ -16,6 +16,11 @@ Main results: - {lit}`linear_congruence_all_solutions`: if `x₀` and `x` both solve `a·x ≡ b (mod n)`, then `x ≡ x₀ (mod n/d)` — every solution differs from `x₀` by a multiple of `n/d`. +- Theorem {lit}`linear_congruence_solutions` (Theorem 31.10): the solutions + are exactly the residue class `x₀ mod (n/d)`. +- Theorem {lit}`linear_congruence_distinct` (Theorem 31.10): the `d` values + `k·(n/d)` for `0 ≤ k < d` are pairwise incongruent, so the congruence has + exactly `d` distinct solutions. Notation: @@ -93,6 +98,63 @@ theorem linear_congruence_all_solutions {a b x x₀ n : ℕ} [NeZero n] exact Nat.coprime_div_gcd_div_gcd hd exact Nat.ModEq.cancel_left_of_coprime (by simpa [Nat.gcd_comm] using hcop'.gcd_eq_one) hax2 +/-- **The solutions of a linear congruence (CLRS Theorem 31.10).** If `x₀` +solves `a·x ≡ b (mod n)`, then a value `x` solves the congruence exactly when +`x ≡ x₀ (mod n/d)` for `d = gcd(a, n)`: the solutions form one residue class +modulo `n/d`. -/ +theorem linear_congruence_solutions {a b x₀ n : ℕ} [NeZero n] (h : a * x₀ ≡ b [MOD n]) : + ∀ x : ℕ, (a * x ≡ b [MOD n]) ↔ x ≡ x₀ [MOD (n / Nat.gcd a n)] := by + intro x + constructor + · intro hx + exact linear_congruence_all_solutions hx h + · intro hx + have h1 : a * x ≡ a * x₀ [MOD a * (n / Nat.gcd a n)] := by + rw [Nat.ModEq] at hx ⊢ + rw [Nat.mul_mod_mul_left, Nat.mul_mod_mul_left] + rw [hx] + have h2 : a * x ≡ a * x₀ [MOD n] := by + rw [mul_nat_div_eq a n] at h1 + exact Nat.ModEq.of_dvd (dvd_mul_left n (a / Nat.gcd a n)) h1 + exact h2.trans h + +/-- **The `d = gcd(a, n)` solutions are distinct modulo `n` (CLRS Theorem +31.10).** The values `k·(n/d)` for `0 ≤ k < d` are pairwise incongruent +modulo `n`, so together with {lit}`linear_congruence_shift` they give exactly +`d` distinct solutions. -/ +theorem linear_congruence_distinct {a n : ℕ} [NeZero n] (k₁ k₂ : ℕ) + (hk₁ : k₁ < Nat.gcd a n) (hk₂ : k₂ < Nat.gcd a n) (hk : k₁ < k₂) : + ¬ k₁ * (n / Nat.gcd a n) ≡ k₂ * (n / Nat.gcd a n) [MOD n] := by + intro hc + have hd : n ∣ (k₂ - k₁) * (n / Nat.gcd a n) := by + have hle : k₁ * (n / Nat.gcd a n) ≤ k₂ * (n / Nat.gcd a n) := by + exact Nat.mul_le_mul_right _ (Nat.le_of_lt hk) + have hmod : (k₂ * (n / Nat.gcd a n) - k₁ * (n / Nat.gcd a n)) % n = 0 := by + have hsub := Nat.ModEq.sub (Nat.le_refl (k₁ * (n / Nat.gcd a n))) hle hc (Nat.ModEq.refl (k₁ * (n / Nat.gcd a n))) + have h0 : k₁ * (n / Nat.gcd a n) - k₁ * (n / Nat.gcd a n) = 0 := by omega + rw [h0] at hsub + simpa [Nat.ModEq, Nat.zero_mod] using hsub.symm + have hsub' : (k₂ - k₁) * (n / Nat.gcd a n) = k₂ * (n / Nat.gcd a n) - k₁ * (n / Nat.gcd a n) := by + rw [Nat.sub_mul] + rw [hsub'] + exact Nat.dvd_of_mod_eq_zero hmod + have hn0 : 0 < n / Nat.gcd a n := by + exact Nat.div_pos (Nat.le_of_dvd (Nat.pos_of_neZero (n := n)) (Nat.gcd_dvd_right a n)) (Nat.gcd_pos_of_pos_right a (Nat.pos_of_neZero (n := n))) + have hpos : 0 < (k₂ - k₁) * (n / Nat.gcd a n) := by + have hk0 : 0 < k₂ - k₁ := by omega + exact Nat.mul_pos hk0 hn0 + have hlt : (k₂ - k₁) * (n / Nat.gcd a n) < n := by + have hk2 : k₂ - k₁ < Nat.gcd a n := by omega + have hdn : (Nat.gcd a n) * (n / Nat.gcd a n) = n := Nat.mul_div_cancel' (Nat.gcd_dvd_right a n) + calc + (k₂ - k₁) * (n / Nat.gcd a n) < Nat.gcd a n * (n / Nat.gcd a n) := Nat.mul_lt_mul_of_pos_right hk2 hn0 + _ = n := hdn + have hm0 : (k₂ - k₁) * (n / Nat.gcd a n) = 0 := by + have hmod : (k₂ - k₁) * (n / Nat.gcd a n) % n = 0 := Nat.mod_eq_zero_of_dvd hd + have hmod' : (k₂ - k₁) * (n / Nat.gcd a n) % n = (k₂ - k₁) * (n / Nat.gcd a n) := Nat.mod_eq_of_lt hlt + omega + omega + end Chapter31 end CLRS diff --git a/CLRSLean/Chapter_31/Section_31_5_Chinese_Remainder_Theorem.lean b/CLRSLean/Chapter_31/Section_31_5_Chinese_Remainder_Theorem.lean index f2c671f..266fe97 100644 --- a/CLRSLean/Chapter_31/Section_31_5_Chinese_Remainder_Theorem.lean +++ b/CLRSLean/Chapter_31/Section_31_5_Chinese_Remainder_Theorem.lean @@ -8,11 +8,9 @@ CLRS §31.5: the **Chinese remainder theorem** (Theorem 31.27) — if the moduli `n₁, …, nₖ` are pairwise relatively prime, then the system of congruences `x ≡ aᵢ (mod nᵢ)` has a unique solution modulo `n₁·…·nₖ`. -This section formalizes the two-modulus form (the building block of the full -theorem): for coprime `n` and `m`, the system `x ≡ a (mod n)`, `x ≡ b (mod m)` -has a solution, and any two solutions agree modulo `n·m`. Mathlib's -`Nat.chineseRemainder` supplies existence; uniqueness uses -`Nat.modEq_and_modEq_iff_modEq_mul`. +This section formalizes both the two-modulus form and the general list form +of the theorem. Mathlib's `Nat.chineseRemainder` supplies existence for two +moduli; `Nat.chineseRemainderOfList` handles the general case. Main results: @@ -20,14 +18,17 @@ Main results: `x ≡ a (mod n)`, `x ≡ b (mod m)` has a solution. - Theorem {lit}`chinese_remainder_unique`: any two solutions agree modulo `n·m`. +- Theorem {lit}`chinese_remainder_general` (Theorem 31.27, general form): for + a list of pairwise-coprime moduli, a solution exists, unique modulo the + product. Notation: - {lit}`a ≡ b [MOD n]` : `Nat.ModEq`. - {lit}`Nat.Coprime n m` : `gcd n m = 1`. -Deferred: the general `k`-modulus form via `Nat.chineseRemainderOfList` / -`ZMod.chineseRemainder`, and the CRT-based RSA proofs (§31.7). +Deferred: the `ZMod.chineseRemainder` ring-isomorphism packaging, and the +CRT-based RSA proofs (§31.7). -/ namespace CLRS @@ -67,6 +68,22 @@ theorem chinese_remainder {n m a b : ℕ} (hcop : Nat.Coprime n m) : intro y hy₁ hy₂ exact chinese_remainder_unique hcop ⟨hx₁, hx₂⟩ ⟨hy₁, hy₂⟩ +/-- +**Chinese remainder theorem, general form (CLRS Theorem 31.27).** For a list +of pairwise-coprime moduli `s i` and residues `a i`, the system of congruences +`x ≡ a i (mod s i)` has a solution, unique modulo the product of the moduli. +-/ +theorem chinese_remainder_general {ι : Type} (a s : ι → ℕ) (l : List ι) + (co : List.Pairwise (Function.onFun Nat.Coprime s) l) : + ∃ x : ℕ, (∀ i ∈ l, x ≡ a i [MOD s i]) ∧ + ∀ y : ℕ, (∀ i ∈ l, y ≡ a i [MOD s i]) → x ≡ y [MOD (List.map s l).prod] := by + let crt := Nat.chineseRemainderOfList a s l co + refine ⟨crt.1, ?_⟩ + constructor + · exact crt.2 + · intro y hy + exact (Nat.chineseRemainderOfList_modEq_unique a s l co hy).symm + end Chapter31 end CLRS From 81ac64e865d98e0f85d3189a3ff6737d69f3fd66 Mon Sep 17 00:00:00 2001 From: TankTechnology <2541826291@qq.com> Date: Wed, 5 Aug 2026 20:42:35 +0800 Subject: [PATCH 02/24] feat(ch31): RSA general message case (Thm 31.36 complete) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - rsa_pow_cong: for prime p and e*d ≡ 1 (mod p-1), m^(e*d) ≡ m (mod p) — covering both p|m and p∤m via ZMod.pow_card_sub_one. - rsa_correct_general: for distinct primes p q and e*d ≡ 1 (mod (p-1)(q-1)), m^(e*d) ≡ m (mod p*q) for every m, via the per-prime congruences and the Chinese remainder theorem. - prime_coprime: distinct primes are coprime. Co-Authored-By: Claude --- CLRSLean/Chapter_31/Section_31_7_RSA.lean | 71 ++++++++++++++++++++++- 1 file changed, 69 insertions(+), 2 deletions(-) diff --git a/CLRSLean/Chapter_31/Section_31_7_RSA.lean b/CLRSLean/Chapter_31/Section_31_7_RSA.lean index 45e8a9b..92297d6 100644 --- a/CLRSLean/Chapter_31/Section_31_7_RSA.lean +++ b/CLRSLean/Chapter_31/Section_31_7_RSA.lean @@ -1,5 +1,6 @@ import Mathlib import CLRSLean.Chapter_31.Section_31_6_Powers_Of_An_Element +import CLRSLean.Chapter_31.Section_31_5_Chinese_Remainder_Theorem /-! # 31.7 The RSA Public-Key Cryptosystem @@ -16,14 +17,18 @@ Main results: - Theorem {lit}`rsa_correct` (CLRS Theorem 31.36): if `e·d ≡ 1 (mod φ(n))` and `gcd(m, n) = 1`, then `m^(e·d) ≡ m (mod n)` — decryption undoes encryption. +- Theorem {lit}`rsa_correct_general` (CLRS Theorem 31.36, general message): + for distinct primes `p q` and `e·d ≡ 1 (mod (p−1)(q−1))`, `m^(e·d) ≡ m + (mod p·q)` for every `m` — via Fermat modulo each prime and the Chinese + remainder theorem. Notation: - {lit}`Nat.totient n` : Euler's totient `φ(n)`. - {lit}`a ≡ b [MOD n]` : `Nat.ModEq`. -Deferred: the full proof for `m` sharing a factor with `n` (the general RSA -argument), and the running-time / key-generation analysis. +Deferred: the running-time / key-generation analysis and the RSA +security (one-way function) claims. -/ namespace CLRS @@ -67,6 +72,68 @@ theorem rsa_correct {m e d n : ℕ} (hle : 1 ≤ e * d) exact h3 exact (by simpa using (h1.trans hmid)) +/-- For prime `p` and `e·d ≡ 1 (mod p−1)`, `m^(e·d) ≡ m (mod p)`: the RSA +exponentiation recovers `m` modulo each prime factor of the modulus (the +`p`-side of the general RSA correctness). -/ +lemma rsa_pow_cong {p m e d : ℕ} (hp : Nat.Prime p) (hle : 1 ≤ e * d) + (hmed : e * d ≡ 1 [MOD p - 1]) : m ^ (e * d) ≡ m [MOD p] := by + letI : Fact (Nat.Prime p) := ⟨hp⟩ + haveI : NeZero p := ⟨Nat.Prime.ne_zero hp⟩ + rcases (Nat.modEq_iff_exists_eq_add hle).mp hmed.symm with ⟨k, hk⟩ + have hz0 : (m : ZMod p) ^ (e * d) = (m : ZMod p) := by + rw [hk, pow_add, pow_one, pow_mul] + by_cases hm0 : (m : ZMod p) = 0 + · rw [hm0] + simp + · have hp1 : (m : ZMod p) ^ (p - 1) = 1 := by + simpa [hm0] using (ZMod.pow_card_sub_one (p := p) (a := (m : ZMod p))) + rw [hp1] + simp + rw [Nat.ModEq] + calc + (m ^ (e * d)) % p = (↑(m ^ (e * d)) : ZMod p).val := (ZMod.val_natCast p (m ^ (e * d))).symm + _ = ((m : ZMod p) ^ (e * d)).val := by rw [Nat.cast_pow] + _ = (m : ZMod p).val := by rw [hz0] + _ = m % p := ZMod.val_natCast p m + +/-- Distinct primes are coprime. -/ +lemma prime_coprime {p q : ℕ} (hp : Nat.Prime p) (hq : Nat.Prime q) (hpq : p ≠ q) : + Nat.Coprime p q := by + rw [Nat.Prime.coprime_iff_not_dvd hp] + intro hpq_dvd + rcases (Nat.Prime.eq_one_or_self_of_dvd hq p hpq_dvd) with h1 | heq + · exfalso + have hp2 : 2 ≤ p := Nat.Prime.two_le hp + omega + · exact hpq heq + +/-- +**RSA is correct for every message (CLRS Theorem 31.36).** For distinct +primes `p q`, `n = p·q`, and exponents with `e·d ≡ 1 (mod (p−1)(q−1))`, +`m^(e·d) ≡ m (mod p·q)` for **every** `m` — including messages sharing a +factor with `n`. The proof shows the congruence modulo each prime factor +({lit}`rsa_pow_cong`, which covers both `p | m` and `p ∤ m` via Fermat) and +combines them with the Chinese remainder theorem. +-/ +theorem rsa_correct_general {p q m e d : ℕ} (hp : Nat.Prime p) (hq : Nat.Prime q) + (hpq : p ≠ q) (hle : 1 ≤ e * d) (hmed : e * d ≡ 1 [MOD (p - 1) * (q - 1)]) : + m ^ (e * d) ≡ m [MOD p * q] := by + have hp_cong : m ^ (e * d) ≡ m [MOD p] := by + apply rsa_pow_cong hp hle + rw [Nat.ModEq] at hmed ⊢ + have hd : p - 1 ∣ (p - 1) * (q - 1) := by simpa [Nat.mul_comm] using (dvd_mul_left (p - 1) (q - 1)) + rw [← Nat.mod_mod_of_dvd (e * d) hd] + rw [hmed] + rw [Nat.mod_mod_of_dvd 1 hd] + have hq_cong : m ^ (e * d) ≡ m [MOD q] := by + apply rsa_pow_cong hq hle + rw [Nat.ModEq] at hmed ⊢ + have hd : q - 1 ∣ (p - 1) * (q - 1) := by simpa [Nat.mul_comm] using (dvd_mul_right (q - 1) (p - 1)) + rw [← Nat.mod_mod_of_dvd (e * d) hd] + rw [hmed] + rw [Nat.mod_mod_of_dvd 1 hd] + exact chinese_remainder_unique (prime_coprime hp hq hpq) ⟨hp_cong, hq_cong⟩ ⟨Nat.ModEq.refl m, Nat.ModEq.refl m⟩ + end Chapter31 end CLRS From 3fd0f179681e141c1ec6624b399cf6b1b8ca2c90 Mon Sep 17 00:00:00 2001 From: TankTechnology <2541826291@qq.com> Date: Wed, 5 Aug 2026 20:49:59 +0800 Subject: [PATCH 03/24] docs(ch31): sync deferred list and progress CSV with general CRT/RSA work Drop the 31.5 general-CRT and 31.7 RSA general-message items from the chapter guide deferred list and raise the tracked-theorem count to 19, matching the proofs landed in eda498d (Thm 31.10, 31.27) and 81ac64e (Thm 31.36 general case). Co-Authored-By: Claude --- CLRSLean/Chapter_31.lean | 3 --- docs/clrs-proof-progress.csv | 2 +- 2 files changed, 1 insertion(+), 4 deletions(-) diff --git a/CLRSLean/Chapter_31.lean b/CLRSLean/Chapter_31.lean index 3adc6f1..48ecf9d 100644 --- a/CLRSLean/Chapter_31.lean +++ b/CLRSLean/Chapter_31.lean @@ -83,9 +83,6 @@ primality test, and the Pollard's-rho factorization heuristic. ## Deferred Work * 31.2 running-time (Lamé / Fibonacci) analysis of EUCLID. -* 31.5 the general `k`-modulus CRT via `Nat.chineseRemainderOfList` / - `ZMod.chineseRemainder`. -* 31.7 the RSA proof for messages sharing a factor with the modulus. * 31.8 Carmichael numbers and the Miller-Rabin test. * 31.9 the full Pollard's-rho algorithm and its birthday-paradox analysis. -/ diff --git a/docs/clrs-proof-progress.csv b/docs/clrs-proof-progress.csv index 76e37a1..ef4c3aa 100644 --- a/docs/clrs-proof-progress.csv +++ b/docs/clrs-proof-progress.csv @@ -29,7 +29,7 @@ chapter_no,chapter_title,repo_status,represented_sections,tracked_key_theorems,p 28,Matrix Operations,main-proof-complete,28.1;28.2;28.3,9,9,0,"Sections 28.1 (LUP decomposition and solving, Theorems 28.1-28.2, Lemmas 28.1-28.2), 28.2 (inversion), and 28.3 (SPD, Cholesky, least squares) are complete. Section 28.1 proves the LUP decomposition, the constructive forward/back substitution lemmas with LUP-SOLVE, uniqueness of solutions, the determinant-via-LUP corollary, and the CLRS running-time bounds (LUP-SOLVE Theta(n^2), LUP/inversion/Cholesky Theta(n^3)). Section 28.3 proves the Cholesky decomposition (Theorem 28.3) and its uniqueness, and the least-squares minimization theorem (Theorem 28.4).",exists_lup_decomposition (Theorem 28.1); forwardSubst_spec (Lemma 28.1); backSubst_spec (Lemma 28.2); lupSolve_correct (LUP-SOLVE); inv_eq_lup (Theorem 28.2); cholesky_decomposition (Theorem 28.3); cholesky_unique; normal_equations_minimizes (Theorem 28.4); det_eq_sign_mul_det_of_lup (Corollary to Thm 28.1),None,CLRSLean/Chapter_28.lean; CLRSLean/Chapter_28/Section_28_1_Linear_Equations.lean; CLRSLean/Chapter_28/Section_28_2_Inverting_Matrices.lean; CLRSLean/Chapter_28/Section_28_3_Symmetric_Positive_Definite.lean,"Sections 28.1-28.3 are complete: LUP decomposition and solving (Theorems 28.1-28.2, Lemmas 28.1-28.2, Algorithm LUP-SOLVE), the det-via-LUP corollary, matrix inversion, the Cholesky decomposition (Theorem 28.3) with uniqueness, least-squares approximation (Theorem 28.4), and the CLRS running-time cost bounds." 29,Linear Programming,main-proof-complete,29.1;29.2;29.3;29.4;29.5,17,17,0,"The Chapter 29 main text is complete at the finite real-matrix and pure-functional tableau layer: all textbook formulations, terminating initialized SIMPLEX, strong duality, and complementary slackness are kernel-checked",isFeasible_iff_exists_slackExtension; shortest-path LP lower-bound and attained-optimum theorems; maximum-flow LP equivalence; minimum-cost-flow LP equivalence; multicommodity-flow LP equivalence; dictionary/basic-solution and exact PIVOT semantics; deterministic Bland selectors and three-way simplexStep; optimal and unbounded exit correctness; bland_no_repeated_basis; simplexRun_basisCount_not_exhausted and simplex_optimal_or_unbounded; weak_duality (Theorem 29.8); terminal dictionary dual certificate; phase-I feasibility criterion; initializedSimplex_complete; strongDuality (Theorem 29.9); complementarySlackness_iff_optimal (Theorem 29.10),"Mutable tableau storage, floating-point numerical analysis, RAM constants, exercises, and chapter-end problems are optional refinements",CLRSLean/Chapter_29.lean; CLRSLean/Chapter_29/Section_29_1_Standard_And_Slack_Forms.lean; CLRSLean/Chapter_29/Section_29_2_Formulating_Problems_As_Linear_Programs.lean; CLRSLean/Chapter_29/Section_29_3_The_Simplex_Algorithm.lean; CLRSLean/Chapter_29/Section_29_4_Duality.lean; CLRSLean/Chapter_29/Section_29_5_The_Initial_Basic_Feasible_Solution.lean; Tests/Chapter_29_Interface.lean; Tests/Chapter_29_Formulations_Interface.lean; Tests/Chapter_29_Simplex_Interface.lean; Tests/Chapter_29_Initialization_Interface.lean; Tests/Chapter_29_Closure.lean; docs/proof-audits/chapter-29-closure-2026-08-05.md,The phase-I cleanup uses an equivalent fixed-dimension lock x₀ ≤ 0 together with x₀ ≥ 0 instead of physically deleting the artificial variable; this preserves exactly the original feasible assignments and supports the complete general strong-duality proof. 30,Polynomials and the FFT,not-started,None,0,0,1,Not represented,No tracked theorem names yet,Whole chapter theorem inventory and formalization pending,CLRSLean file tree,No Chapter_30 module exists. -31,Number-Theoretic Algorithms,selected-section-complete,31.1;31.2;31.3;31.4;31.5;31.6;31.7;31.8;31.9,16,16,0,"Sections 31.1-31.9 (number-theoretic algorithms) are complete: divisibility and the division theorem; the gcd, Euclid and extended-Euclid; modular arithmetic; linear congruences; the Chinese remainder theorem; powers of an element (Fermat and Euler); RSA; primality testing; and Pollard-s-rho factorization.",division_theorem (Theorem 31.1); euclid_recursion (Lemma 31.2); gcd_is_linear_combination (Lemma 31.3); gcd_is_smallest_positive_linear_combination (Theorem 31.2); exists_mul_inverse_mod (Theorem 31.6); modular_linear_solvable (Theorem 31.11); chinese_remainder (Theorem 31.27); fermat_little_theorem (Theorem 31.30); euler_theorem; rsa_correct (Theorem 31.36); fermat_test (Theorem 31.31); rho_collision_factor,"Running-time analyses, the general CRT, Miller-Rabin, and the full Pollard-s-rho probabilistic analysis (see chapter guide)",CLRSLean/Chapter_31.lean; CLRSLean/Chapter_31/Section_31_1_Elementary_Number_Theory.lean; CLRSLean/Chapter_31/Section_31_2_Greatest_Common_Divisor.lean; CLRSLean/Chapter_31/Section_31_3_Modular_Arithmetic.lean; CLRSLean/Chapter_31/Section_31_4_Solving_Modular_Linear_Equations.lean; CLRSLean/Chapter_31/Section_31_5_Chinese_Remainder_Theorem.lean; CLRSLean/Chapter_31/Section_31_6_Powers_Of_An_Element.lean; CLRSLean/Chapter_31/Section_31_7_RSA.lean; CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean; CLRSLean/Chapter_31/Section_31_9_Integer_Factorization.lean,Sections 31.1-31.9 fully proved; running-time and probabilistic analyses deferred. +31,Number-Theoretic Algorithms,selected-section-complete,31.1;31.2;31.3;31.4;31.5;31.6;31.7;31.8;31.9,19,19,0,"Sections 31.1-31.9 (number-theoretic algorithms) are complete: divisibility and the division theorem; the gcd, Euclid and extended-Euclid; modular arithmetic; linear congruences; the Chinese remainder theorem; powers of an element (Fermat and Euler); RSA; primality testing; and Pollard-s-rho factorization.",division_theorem (Theorem 31.1); euclid_recursion (Lemma 31.2); gcd_is_linear_combination (Lemma 31.3); gcd_is_smallest_positive_linear_combination (Theorem 31.2); exists_mul_inverse_mod (Theorem 31.6); modular_linear_solvable (Theorem 31.11); linear_congruence_solutions (Theorem 31.10); chinese_remainder (Theorem 31.27); chinese_remainder_general (Theorem 31.27); fermat_little_theorem (Theorem 31.30); euler_theorem; rsa_correct (Theorem 31.36); rsa_correct_general (Theorem 31.36); fermat_test (Theorem 31.31); rho_collision_factor,"Running-time analyses (Lamé), Miller-Rabin, and the full Pollard-s-rho probabilistic analysis (see chapter guide)",CLRSLean/Chapter_31.lean; CLRSLean/Chapter_31/Section_31_1_Elementary_Number_Theory.lean; CLRSLean/Chapter_31/Section_31_2_Greatest_Common_Divisor.lean; CLRSLean/Chapter_31/Section_31_3_Modular_Arithmetic.lean; CLRSLean/Chapter_31/Section_31_4_Solving_Modular_Linear_Equations.lean; CLRSLean/Chapter_31/Section_31_5_Chinese_Remainder_Theorem.lean; CLRSLean/Chapter_31/Section_31_6_Powers_Of_An_Element.lean; CLRSLean/Chapter_31/Section_31_7_RSA.lean; CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean; CLRSLean/Chapter_31/Section_31_9_Integer_Factorization.lean,"Sections 31.1-31.9 fully proved; Lamé, Miller-Rabin, and Pollard-s-rho probabilistic analyses deferred." 32,String Matching,selected-section-complete,32.1,19,19,0,Section 32.1 fully proved,String model (14 lemmas); naiveMatcher soundness/completeness (5 theorems),Rabin-Karp hash proofs; finite-automaton construction; KMP prefix-function correctness,CLRSLean/Chapter_32.lean; CLRSLean/Chapter_32/Section_32_1_String_Model.lean; CLRSLean/Chapter_32/Section_32_1_String_Model/Naive_Matcher.lean,All 19 theorems are kernel-checked. Sections 32.2-32.4 deferred. Original formalization by caiwei2026 (PR #85). 33,Computational Geometry,partial,33.1,7,7,1,Section 33.1 definitions plus cross-product algebra and orientation specification are represented,Six cross-product algebra theorems; orientation_spec,Prove segmentIntersect soundness and completeness against an independent geometric-intersection specification including shared-endpoint cases; Sections 33.2-33.4 remain unrepresented,CLRSLean/Chapter_33.lean; CLRSLean/Chapter_33/Section_33_1_Line_Segment_Properties.lean,All 7 tracked theorems are kernel-checked but segmentIntersect bboxIntersect and sharesEndpoint currently have definitions without correctness theorems. 34,NP-Completeness,not-started,None,0,0,1,Not represented,No tracked theorem names yet,Whole chapter theorem inventory and formalization pending,CLRSLean file tree,No Chapter_34 module exists. From 9dce175a4da57e31bf05f6b4f2183f6e95d41bdb Mon Sep 17 00:00:00 2001 From: TankTechnology <2541826291@qq.com> Date: Wed, 5 Aug 2026 21:16:11 +0800 Subject: [PATCH 04/24] =?UTF-8?q?feat(ch31):=20Lam=C3=A9=20running-time=20?= =?UTF-8?q?analysis=20of=20EUCLID=20(31.2=20complete)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add the Fibonacci running-time analysis of the Euclidean algorithm, closing the last 31.2 deferred item: - euclidDivisions counts the recursive calls of CLRS EUCLID. - fib_le_of_euclidDivisions (CLRS Lemma 31.10): k calls with a > b >= 1 force b >= F_{k+1} and a >= F_{k+2}, by strong induction on b. - euclidDivisions_lt (CLRS Theorem 31.11, Lamé's theorem): b < F_{k+1} implies fewer than k calls. - euclidDivisions_le_two_log (CLRS Corollary 31.12): at most 2*log2 b + 2 calls, i.e. O(log b), via new exponential growth lemmas fib_two_step_ge_pow_two / pow_two_le_fib (2^(n/2) <= F_{n+2}). All theorems kernel-checked with clean axioms; progress CSV bumped to 22/22 tracked theorems and docs/proof-map.md updated. Co-Authored-By: Claude --- CLRSLean/Chapter_31.lean | 9 +- .../Section_31_2_Greatest_Common_Divisor.lean | 191 +++++++++++++++++- CLRSLean/Progress.lean | 6 +- docs/clrs-proof-progress.csv | 2 +- docs/proof-map.md | 13 ++ 5 files changed, 214 insertions(+), 7 deletions(-) diff --git a/CLRSLean/Chapter_31.lean b/CLRSLean/Chapter_31.lean index 48ecf9d..5dcfca9 100644 --- a/CLRSLean/Chapter_31.lean +++ b/CLRSLean/Chapter_31.lean @@ -36,6 +36,14 @@ primality test, and the Pollard's-rho factorization heuristic. {lit}`CLRS.Chapter31.gcd_is_smallest_positive_linear_combination` (Theorem 31.2), the Corollary 31.3/31.4 facts, and {lit}`CLRS.Chapter31.extendedEuclid` + `extendedEuclid_spec`. +* **Running time (Lamé / Fibonacci)**: {lit}`CLRS.Chapter31.euclidDivisions` + counts the recursive calls of `EUCLID`; + {lit}`CLRS.Chapter31.fib_le_of_euclidDivisions` (Lemma 31.10) gives + `a ≥ F_{k+2}`, `b ≥ F_{k+1}` for `k` calls; + {lit}`CLRS.Chapter31.euclidDivisions_lt` (Theorem 31.11, Lamé) bounds the + call count by `b < F_{k+1}`; and + {lit}`CLRS.Chapter31.euclidDivisions_le_two_log` (Corollary 31.12) is the + `O(log b)` bound. ### 31.3 Modular Arithmetic @@ -82,7 +90,6 @@ primality test, and the Pollard's-rho factorization heuristic. ## Deferred Work -* 31.2 running-time (Lamé / Fibonacci) analysis of EUCLID. * 31.8 Carmichael numbers and the Miller-Rabin test. * 31.9 the full Pollard's-rho algorithm and its birthday-paradox analysis. -/ diff --git a/CLRSLean/Chapter_31/Section_31_2_Greatest_Common_Divisor.lean b/CLRSLean/Chapter_31/Section_31_2_Greatest_Common_Divisor.lean index 54681e0..9e5178f 100644 --- a/CLRSLean/Chapter_31/Section_31_2_Greatest_Common_Divisor.lean +++ b/CLRSLean/Chapter_31/Section_31_2_Greatest_Common_Divisor.lean @@ -15,6 +15,16 @@ Main results: `gcd(0, b) = b`, `gcd(a, 0) = a`. - {lit}`euclid` + {lit}`euclid_eq_gcd` + {lit}`euclid_terminates`: the EUCLID algorithm is a total function and always returns `Nat.gcd a b`. +- **Running time (Lamé / Fibonacci)**: {lit}`euclidDivisions` counts the + recursive calls of `EUCLID`. Lemma 31.10 + ({lit}`fib_le_of_euclidDivisions`) gives the Fibonacci lower bounds + `a ≥ F_{k+2}` and `b ≥ F_{k+1}` for `k` calls; Theorem 31.11, **Lamé's + theorem** ({lit}`euclidDivisions_lt`), is the running-time bound + `b < F_{k+1} ⇒` fewer than `k` calls; and Corollary 31.12 + ({lit}`euclidDivisions_le_two_log`) records the `O(log b)` bound. The + helper lemmas {lit}`fib_two_step_ge_pow_two` and {lit}`pow_two_le_fib` + prove the exponential Fibonacci growth `2^(n/2) ≤ F_{n+2}` used by + Corollary 31.12. - Lemma 31.3 ({lit}`gcd_is_linear_combination`): **Bezout's identity** — `gcd a b` is an integer linear combination of `a` and `b`. - Theorem 31.2 ({lit}`gcd_is_smallest_positive_linear_combination`): `gcd a b` @@ -35,10 +45,12 @@ Notation: - {lit}`Nat.gcdA a b` / {lit}`Nat.gcdB a b` : the Bezout coefficients. - `x·a + y·b` : integer linear combinations (coefficients in `ℤ`). -Deferred: the running-time (Lamé / Fibonacci) analysis of EUCLID, and -modular arithmetic, primality testing, and RSA (§31.3–31.9). +This section is complete. Modular arithmetic, primality testing, and RSA +are covered in their own sections (§31.3–31.9). -/ +open Nat + namespace CLRS namespace Chapter31 @@ -84,6 +96,181 @@ theorem euclid_eq_gcd (a b : ℕ) : euclid a b = Nat.gcd a b := by theorem euclid_terminates (a b : ℕ) : ∃ r : ℕ, euclid a b = r := ⟨euclid a b, rfl⟩ +/-- +**EUCLID division count (CLRS §31.2).** The number of recursive calls that +`EUCLID(a, b)` makes under CLRS's recursion `EUCLID(a, b) = EUCLID(b, a mod b)` +for `b > 0`, with `EUCLID(a, 0) = a`. Total by well-founded recursion on the +second argument (each call drops to `a mod b < b`). +-/ +def euclidDivisions : ℕ → ℕ → ℕ + | _, 0 => 0 + | a, b + 1 => 1 + euclidDivisions (b + 1) (a % (b + 1)) +termination_by _ b => b +decreasing_by + exact Nat.mod_lt a (Nat.succ_pos b) + +/-- +**Lemma 31.10 (Lamé, core direction).** If `EUCLID(a, b)` with `a > b ≥ 1` +invokes `k` recursive calls, then the Fibonacci bounds `b ≥ F_{k+1}` and +`a ≥ F_{k+2}` hold. +-/ +theorem fib_le_of_euclidDivisions (a b : ℕ) (hb0 : 0 < b) (hba : b < a) : + fib (euclidDivisions a b + 1) ≤ b ∧ fib (euclidDivisions a b + 2) ≤ a := by + revert a hb0 hba + induction b using Nat.strong_induction_on with + | h b ih => + intro a hb0 hba + cases b with + | zero => omega + | succ b' => + let r := a % (b' + 1) + have hmain : euclidDivisions a (b' + 1) = 1 + euclidDivisions (b' + 1) r := by + simp [euclidDivisions, r] + by_cases hr0 : r = 0 + · have hk1 : euclidDivisions a (b' + 1) = 1 := by + rw [hmain] + simp [euclidDivisions, r, hr0] + constructor + · rw [hk1] + simp [fib_two] + · rw [hk1] + simp [fib_add_two] + have hdvd : b' + 1 ∣ a := by + exact Nat.dvd_of_mod_eq_zero (by simpa [r] using hr0) + rcases hdvd with ⟨q, ha⟩ + have hqb : b' + 1 < (b' + 1) * q := by + simpa [ha] using hba + have hq : 1 < q := by + exact (Nat.mul_lt_mul_left (by omega : 0 < b' + 1)).mp (by simpa using hqb) + have hle : 2 ≤ (b' + 1) * q := by + simpa using (Nat.mul_le_mul (by omega : 1 ≤ b' + 1) (Nat.succ_le_of_lt hq)) + rw [ha] + exact hle + · have hrpos : 0 < r := Nat.pos_of_ne_zero hr0 + have hrlt : r < b' + 1 := by + simpa [r] using (Nat.mod_lt a (Nat.succ_pos b')) + have ih' := ih r hrlt (b' + 1) hrpos hrlt + let k' := euclidDivisions (b' + 1) r + have hk' : euclidDivisions a (b' + 1) = 1 + k' := by + simpa [k'] using hmain + constructor + · rw [hk'] + have harg : (1 + k') + 1 = k' + 2 := by omega + rw [harg] + simpa [k'] using ih'.2 + · rw [hk'] + have hfib3 : fib (k' + 3) = fib (k' + 1) + fib (k' + 2) := by + simpa [Nat.add_assoc] using (fib_add_two (n := k' + 1)) + have hfib_sum : fib (k' + 1) + fib (k' + 2) ≤ r + (b' + 1) := by + exact Nat.add_le_add (by simpa [k'] using ih'.1) (by simpa [k'] using ih'.2) + have hra : r + (b' + 1) ≤ a := by + have hmod : a = a / (b' + 1) * (b' + 1) + r := by + change a = a / (b' + 1) * (b' + 1) + a % (b' + 1) + rw [mul_comm] + exact (Nat.div_add_mod a (b' + 1)).symm + have hq1 : 1 ≤ a / (b' + 1) := by + rw [Nat.le_div_iff_mul_le (Nat.succ_pos b')] + simpa using (Nat.le_of_lt hba) + rw [hmod] + have hle : b' + 1 ≤ a / (b' + 1) * (b' + 1) := by + simpa using (Nat.mul_le_mul_right (b' + 1) hq1) + omega + have harg : (1 + k') + 2 = k' + 3 := by omega + calc + fib ((1 + k') + 2) = fib (k' + 3) := by rw [harg] + _ = fib (k' + 1) + fib (k' + 2) := hfib3 + _ ≤ r + (b' + 1) := hfib_sum + _ ≤ a := hra + +/-- +**Theorem 31.11 (Lamé's theorem).** For `k ≥ 1`, if `a > b ≥ 1` and +`b < F_{k+1}`, then `EUCLID(a, b)` makes fewer than `k` recursive calls — +equivalently, `EUCLID` needs `O(log b)` calls for inputs `a > b`. +-/ +theorem euclidDivisions_lt {a b k : ℕ} (_hk : 1 ≤ k) (hb0 : 0 < b) (hba : b < a) + (hbf : b < fib (k + 1)) : euclidDivisions a b < k := by + have hcore := fib_le_of_euclidDivisions a b hb0 hba + by_contra hnot + have hge : k ≤ euclidDivisions a b := Nat.le_of_not_gt hnot + have hmono : fib (k + 1) ≤ fib (euclidDivisions a b + 1) := by + exact fib_mono (by omega) + have : fib (k + 1) ≤ b := le_trans hmono hcore.1 + exact (not_lt_of_ge this) hbf + +/-- +**Exponential Fibonacci growth.** For every `t`, `fib(2t+2) ≥ 2^t` and +`fib(2t+3) ≥ 2^t`; hence the Fibonacci sequence grows at least like +`2^(n/2)`. This is the exponential bound that turns Lamé's theorem into the +`O(log b)` running-time bound. +-/ +theorem fib_two_step_ge_pow_two (t : ℕ) : + (2 ^ t ≤ fib (2 * t + 2)) ∧ (2 ^ t ≤ fib (2 * t + 3)) := by + induction t with + | zero => + constructor <;> norm_num [fib_two, fib_add_two, fib_one] + | succ t ih => + have hA0 : 2 ^ t ≤ fib (2 * t + 2) := ih.1 + have hB0 : 2 ^ t ≤ fib (2 * t + 3) := ih.2 + have hA1 : 2 ^ (t + 1) ≤ fib (2 * (t + 1) + 2) := by + have hfib : fib (2 * (t + 1) + 2) = fib (2 * t + 2) + fib (2 * t + 3) := by + rw [show 2 * (t + 1) + 2 = 2 * t + 4 by ring] + have h := fib_add_two (n := 2 * t + 2) + rw [show (2 * t + 2) + 2 = 2 * t + 4 by omega, + show (2 * t + 2) + 1 = 2 * t + 3 by omega] at h + exact h + rw [hfib] + rw [show 2 ^ (t + 1) = 2 ^ t + 2 ^ t by rw [pow_succ]; ring] + exact Nat.add_le_add hA0 hB0 + have hB1 : 2 ^ (t + 1) ≤ fib (2 * (t + 1) + 3) := by + have hfib : fib (2 * (t + 1) + 3) = fib (2 * t + 3) + fib (2 * t + 4) := by + rw [show 2 * (t + 1) + 3 = 2 * t + 5 by ring] + have h := fib_add_two (n := 2 * t + 3) + rw [show (2 * t + 3) + 2 = 2 * t + 5 by omega, + show (2 * t + 3) + 1 = 2 * t + 4 by omega] at h + exact h + rw [hfib] + have hA1' : 2 ^ (t + 1) ≤ fib (2 * t + 4) := by + simpa [show 2 * (t + 1) + 2 = 2 * t + 4 by ring] using hA1 + exact le_trans (Nat.le_add_left _ _) + (by simpa [Nat.add_comm] using (Nat.add_le_add hB0 hA1')) + exact ⟨hA1, hB1⟩ + +/-- The Fibonacci sequence grows exponentially: `2^(n/2) ≤ fib (n+2)` for all +`n`. -/ +theorem pow_two_le_fib (n : ℕ) : 2 ^ (n / 2) ≤ fib (n + 2) := by + rcases Nat.even_or_odd n with ⟨t, rfl⟩ | ⟨t, rfl⟩ + · have h2 : t + t = 2 * t := by omega + simpa [h2] using (fib_two_step_ge_pow_two t).1 + · have hdiv : (2 * t + 1) / 2 = t := by + simpa [show 1 / 2 = 0 by norm_num] using (Nat.mul_add_div (by decide : 2 > 0) t 1) + rw [hdiv] + have harg : (2 * t + 1) + 2 = 2 * t + 3 := by omega + rw [harg] + exact (fib_two_step_ge_pow_two t).2 + +/-- +**Corollary 31.12.** For `a > b ≥ 1`, `EUCLID(a, b)` makes at most +`2·log₂ b + 2` recursive calls — i.e. `O(log b)`. Combining Lemma 31.10 +with `b ≥ F_{k+1} ≥ 2^{(k−1)/2}` bounds the division count logarithmically. +-/ +theorem euclidDivisions_le_two_log (a b : ℕ) (hb0 : 0 < b) (hba : b < a) : + euclidDivisions a b ≤ 2 * Nat.log 2 b + 2 := by + have hkge1 : 1 ≤ euclidDivisions a b := by + rcases b with _ | b' + · omega + · simp [euclidDivisions] + have hcore := fib_le_of_euclidDivisions a b hb0 hba + have hpow_le_fib : 2 ^ ((euclidDivisions a b - 1) / 2) ≤ fib (euclidDivisions a b + 1) := by + have h := pow_two_le_fib (euclidDivisions a b - 1) + rwa [show (euclidDivisions a b - 1) + 2 = euclidDivisions a b + 1 by omega] at h + have hpow_le_b : 2 ^ ((euclidDivisions a b - 1) / 2) ≤ b := le_trans hpow_le_fib hcore.1 + have hlog : (euclidDivisions a b - 1) / 2 ≤ Nat.log 2 b := + Nat.le_log_of_pow_le (by decide : 1 < 2) hpow_le_b + have hk1 : euclidDivisions a b - 1 ≤ 2 * Nat.log 2 b + 1 := by + rw [Nat.div_le_iff_le_mul_add_pred (by decide : 0 < 2)] at hlog + exact hlog + omega + /-- Lemma 31.3 (**Bezout's identity**): `gcd a b` is an integer linear combination of `a` and `b`. -/ theorem gcd_is_linear_combination (a b : ℕ) : diff --git a/CLRSLean/Progress.lean b/CLRSLean/Progress.lean index 9a4a7db..cc3e8e9 100644 --- a/CLRSLean/Progress.lean +++ b/CLRSLean/Progress.lean @@ -10,8 +10,8 @@ When the CSV changes, regenerate this page with * CLRS chapters tracked: 35. * Chapters represented in Lean: 32. -* Tracked reader-facing theorem entries: 1747. -* Proved tracked theorem entries: 1747. +* Tracked reader-facing theorem entries: 1753. +* Proved tracked theorem entries: 1753. * Remaining core theorem groups: 4. Tracked theorem entries count the public theorem groups currently represented @@ -62,7 +62,7 @@ Ch Chapter Status 28 28. Matrix Operations main-proof-complete 28.1;28.2;28.3 9 0 29 29. Linear Programming main-proof-complete 29.1;29.2;29.3;29.4;29.5 17 0 30 30. Polynomials and the FFT not-started not represented 0 1 -31 31. Number-Theoretic Algorithms selected-section-complete 31.1;31.2;31.3;31.4;31.5;31. 16 0 +31 31. Number-Theoretic Algorithms selected-section-complete 31.1;31.2;31.3;31.4;31.5;31. 22 0 32 32. String Matching selected-section-complete 32.1 19 0 33 33. Computational Geometry partial 33.1 7 1 34 34. NP-Completeness not-started not represented 0 1 diff --git a/docs/clrs-proof-progress.csv b/docs/clrs-proof-progress.csv index ef4c3aa..b496157 100644 --- a/docs/clrs-proof-progress.csv +++ b/docs/clrs-proof-progress.csv @@ -29,7 +29,7 @@ chapter_no,chapter_title,repo_status,represented_sections,tracked_key_theorems,p 28,Matrix Operations,main-proof-complete,28.1;28.2;28.3,9,9,0,"Sections 28.1 (LUP decomposition and solving, Theorems 28.1-28.2, Lemmas 28.1-28.2), 28.2 (inversion), and 28.3 (SPD, Cholesky, least squares) are complete. Section 28.1 proves the LUP decomposition, the constructive forward/back substitution lemmas with LUP-SOLVE, uniqueness of solutions, the determinant-via-LUP corollary, and the CLRS running-time bounds (LUP-SOLVE Theta(n^2), LUP/inversion/Cholesky Theta(n^3)). Section 28.3 proves the Cholesky decomposition (Theorem 28.3) and its uniqueness, and the least-squares minimization theorem (Theorem 28.4).",exists_lup_decomposition (Theorem 28.1); forwardSubst_spec (Lemma 28.1); backSubst_spec (Lemma 28.2); lupSolve_correct (LUP-SOLVE); inv_eq_lup (Theorem 28.2); cholesky_decomposition (Theorem 28.3); cholesky_unique; normal_equations_minimizes (Theorem 28.4); det_eq_sign_mul_det_of_lup (Corollary to Thm 28.1),None,CLRSLean/Chapter_28.lean; CLRSLean/Chapter_28/Section_28_1_Linear_Equations.lean; CLRSLean/Chapter_28/Section_28_2_Inverting_Matrices.lean; CLRSLean/Chapter_28/Section_28_3_Symmetric_Positive_Definite.lean,"Sections 28.1-28.3 are complete: LUP decomposition and solving (Theorems 28.1-28.2, Lemmas 28.1-28.2, Algorithm LUP-SOLVE), the det-via-LUP corollary, matrix inversion, the Cholesky decomposition (Theorem 28.3) with uniqueness, least-squares approximation (Theorem 28.4), and the CLRS running-time cost bounds." 29,Linear Programming,main-proof-complete,29.1;29.2;29.3;29.4;29.5,17,17,0,"The Chapter 29 main text is complete at the finite real-matrix and pure-functional tableau layer: all textbook formulations, terminating initialized SIMPLEX, strong duality, and complementary slackness are kernel-checked",isFeasible_iff_exists_slackExtension; shortest-path LP lower-bound and attained-optimum theorems; maximum-flow LP equivalence; minimum-cost-flow LP equivalence; multicommodity-flow LP equivalence; dictionary/basic-solution and exact PIVOT semantics; deterministic Bland selectors and three-way simplexStep; optimal and unbounded exit correctness; bland_no_repeated_basis; simplexRun_basisCount_not_exhausted and simplex_optimal_or_unbounded; weak_duality (Theorem 29.8); terminal dictionary dual certificate; phase-I feasibility criterion; initializedSimplex_complete; strongDuality (Theorem 29.9); complementarySlackness_iff_optimal (Theorem 29.10),"Mutable tableau storage, floating-point numerical analysis, RAM constants, exercises, and chapter-end problems are optional refinements",CLRSLean/Chapter_29.lean; CLRSLean/Chapter_29/Section_29_1_Standard_And_Slack_Forms.lean; CLRSLean/Chapter_29/Section_29_2_Formulating_Problems_As_Linear_Programs.lean; CLRSLean/Chapter_29/Section_29_3_The_Simplex_Algorithm.lean; CLRSLean/Chapter_29/Section_29_4_Duality.lean; CLRSLean/Chapter_29/Section_29_5_The_Initial_Basic_Feasible_Solution.lean; Tests/Chapter_29_Interface.lean; Tests/Chapter_29_Formulations_Interface.lean; Tests/Chapter_29_Simplex_Interface.lean; Tests/Chapter_29_Initialization_Interface.lean; Tests/Chapter_29_Closure.lean; docs/proof-audits/chapter-29-closure-2026-08-05.md,The phase-I cleanup uses an equivalent fixed-dimension lock x₀ ≤ 0 together with x₀ ≥ 0 instead of physically deleting the artificial variable; this preserves exactly the original feasible assignments and supports the complete general strong-duality proof. 30,Polynomials and the FFT,not-started,None,0,0,1,Not represented,No tracked theorem names yet,Whole chapter theorem inventory and formalization pending,CLRSLean file tree,No Chapter_30 module exists. -31,Number-Theoretic Algorithms,selected-section-complete,31.1;31.2;31.3;31.4;31.5;31.6;31.7;31.8;31.9,19,19,0,"Sections 31.1-31.9 (number-theoretic algorithms) are complete: divisibility and the division theorem; the gcd, Euclid and extended-Euclid; modular arithmetic; linear congruences; the Chinese remainder theorem; powers of an element (Fermat and Euler); RSA; primality testing; and Pollard-s-rho factorization.",division_theorem (Theorem 31.1); euclid_recursion (Lemma 31.2); gcd_is_linear_combination (Lemma 31.3); gcd_is_smallest_positive_linear_combination (Theorem 31.2); exists_mul_inverse_mod (Theorem 31.6); modular_linear_solvable (Theorem 31.11); linear_congruence_solutions (Theorem 31.10); chinese_remainder (Theorem 31.27); chinese_remainder_general (Theorem 31.27); fermat_little_theorem (Theorem 31.30); euler_theorem; rsa_correct (Theorem 31.36); rsa_correct_general (Theorem 31.36); fermat_test (Theorem 31.31); rho_collision_factor,"Running-time analyses (Lamé), Miller-Rabin, and the full Pollard-s-rho probabilistic analysis (see chapter guide)",CLRSLean/Chapter_31.lean; CLRSLean/Chapter_31/Section_31_1_Elementary_Number_Theory.lean; CLRSLean/Chapter_31/Section_31_2_Greatest_Common_Divisor.lean; CLRSLean/Chapter_31/Section_31_3_Modular_Arithmetic.lean; CLRSLean/Chapter_31/Section_31_4_Solving_Modular_Linear_Equations.lean; CLRSLean/Chapter_31/Section_31_5_Chinese_Remainder_Theorem.lean; CLRSLean/Chapter_31/Section_31_6_Powers_Of_An_Element.lean; CLRSLean/Chapter_31/Section_31_7_RSA.lean; CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean; CLRSLean/Chapter_31/Section_31_9_Integer_Factorization.lean,"Sections 31.1-31.9 fully proved; Lamé, Miller-Rabin, and Pollard-s-rho probabilistic analyses deferred." +31,Number-Theoretic Algorithms,selected-section-complete,31.1;31.2;31.3;31.4;31.5;31.6;31.7;31.8;31.9,22,22,0,"Sections 31.1-31.9 (number-theoretic algorithms) are complete: divisibility and the division theorem; the gcd, Euclid and extended-Euclid; modular arithmetic; linear congruences; the Chinese remainder theorem; powers of an element (Fermat and Euler); RSA; primality testing; and Pollard-s-rho factorization.",division_theorem (Theorem 31.1); euclid_recursion (Lemma 31.2); gcd_is_linear_combination (Lemma 31.3); gcd_is_smallest_positive_linear_combination (Theorem 31.2); exists_mul_inverse_mod (Theorem 31.6); modular_linear_solvable (Theorem 31.11); linear_congruence_solutions (Theorem 31.10); chinese_remainder (Theorem 31.27); chinese_remainder_general (Theorem 31.27); fermat_little_theorem (Theorem 31.30); euler_theorem; rsa_correct (Theorem 31.36); rsa_correct_general (Theorem 31.36); fermat_test (Theorem 31.31); rho_collision_factor; fib_le_of_euclidDivisions (Lemma 31.10); euclidDivisions_lt (Theorem 31.11); euclidDivisions_le_two_log (Corollary 31.12),"Miller-Rabin, and the full Pollard-s-rho probabilistic analysis (see chapter guide)",CLRSLean/Chapter_31.lean; CLRSLean/Chapter_31/Section_31_1_Elementary_Number_Theory.lean; CLRSLean/Chapter_31/Section_31_2_Greatest_Common_Divisor.lean; CLRSLean/Chapter_31/Section_31_3_Modular_Arithmetic.lean; CLRSLean/Chapter_31/Section_31_4_Solving_Modular_Linear_Equations.lean; CLRSLean/Chapter_31/Section_31_5_Chinese_Remainder_Theorem.lean; CLRSLean/Chapter_31/Section_31_6_Powers_Of_An_Element.lean; CLRSLean/Chapter_31/Section_31_7_RSA.lean; CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean; CLRSLean/Chapter_31/Section_31_9_Integer_Factorization.lean,"Sections 31.1-31.9 fully proved, including the Lamé running-time analysis of EUCLID (Lemmas 31.10 and Theorem 31.11, Corollary 31.12); Miller-Rabin and the full Pollard-s-rho probabilistic analyses deferred." 32,String Matching,selected-section-complete,32.1,19,19,0,Section 32.1 fully proved,String model (14 lemmas); naiveMatcher soundness/completeness (5 theorems),Rabin-Karp hash proofs; finite-automaton construction; KMP prefix-function correctness,CLRSLean/Chapter_32.lean; CLRSLean/Chapter_32/Section_32_1_String_Model.lean; CLRSLean/Chapter_32/Section_32_1_String_Model/Naive_Matcher.lean,All 19 theorems are kernel-checked. Sections 32.2-32.4 deferred. Original formalization by caiwei2026 (PR #85). 33,Computational Geometry,partial,33.1,7,7,1,Section 33.1 definitions plus cross-product algebra and orientation specification are represented,Six cross-product algebra theorems; orientation_spec,Prove segmentIntersect soundness and completeness against an independent geometric-intersection specification including shared-endpoint cases; Sections 33.2-33.4 remain unrepresented,CLRSLean/Chapter_33.lean; CLRSLean/Chapter_33/Section_33_1_Line_Segment_Properties.lean,All 7 tracked theorems are kernel-checked but segmentIntersect bboxIntersect and sharesEndpoint currently have definitions without correctness theorems. 34,NP-Completeness,not-started,None,0,0,1,Not represented,No tracked theorem names yet,Whole chapter theorem inventory and formalization pending,CLRSLean file tree,No Chapter_34 module exists. diff --git a/docs/proof-map.md b/docs/proof-map.md index f34090d..a97d347 100644 --- a/docs/proof-map.md +++ b/docs/proof-map.md @@ -4198,6 +4198,19 @@ No core proof group remains within the selected milestone. Sections 26.4 and including `coprime (a/g) (b/g)` for `g = gcd a b`. - `extendedEuclid` + `extendedEuclid_spec`: EXTENDED-EUCLID returns `(d, x, y)` with `d = gcd a b = a·x + b·y`. + - Running time (Lamé / Fibonacci): `euclidDivisions` counts the recursive + calls of `EUCLID` (CLRS recursion `EUCLID(a, b) = EUCLID(b, a mod b)`). + `fib_le_of_euclidDivisions` (CLRS Lemma 31.10): `k` calls with `a > b ≥ 1` + force `b ≥ F_{k+1}` and `a ≥ F_{k+2}`, proved by strong induction on `b` + (base case `a ≥ 2b` when `a mod b = 0`; step via `F_{k+3} = F_{k+1} + + F_{k+2}` and `a ≥ b + (a mod b)`). + `euclidDivisions_lt` (CLRS Theorem 31.11, **Lamé's theorem**): for + `k ≥ 1`, `b < F_{k+1}` implies fewer than `k` calls (contrapositive via + `Nat.fib_mono`). + `euclidDivisions_le_two_log` (CLRS Corollary 31.12): at most + `2·log₂ b + 2` calls, i.e. `O(log b)`, via the exponential growth lemmas + `fib_two_step_ge_pow_two` and `pow_two_le_fib` (`2^(n/2) ≤ F_{n+2}`) and + `Nat.le_log_of_pow_le`. ### Section 31.3 - Modular Arithmetic From 41fcc0068ca0083ab4ec0c284e5bf85e42bb85f9 Mon Sep 17 00:00:00 2001 From: TankTechnology <2541826291@qq.com> Date: Wed, 5 Aug 2026 21:22:20 +0800 Subject: [PATCH 05/24] feat(ch31): Carmichael numbers in 31.8 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add the Carmichael-number half of the 31.8 deferred work: - isCarmichael n: composite and a^(n-1) ≡ 1 (mod n) for every a coprime to n, with the projection lemmas and carmichael_fermatPseudoprime (a Carmichael number is a Fermat pseudoprime to every coprime base). - isCarmichael_561: the smallest Carmichael number is 561, shown via fermat_test for the prime factors 3, 11, 17 and the new helper modeq_of_coprime_mul (combining congruences under coprime moduli). This concretely shows PSEUDOPRIME cannot certify primality. Kernel-clean axioms; progress CSV bumped to 24/24 and docs updated. Co-Authored-By: Claude --- CLRSLean/Chapter_31.lean | 6 +- .../Section_31_8_Primality_Testing.lean | 83 ++++++++++++++++++- CLRSLean/Progress.lean | 6 +- docs/clrs-proof-progress.csv | 2 +- docs/proof-map.md | 10 +++ 5 files changed, 99 insertions(+), 8 deletions(-) diff --git a/CLRSLean/Chapter_31.lean b/CLRSLean/Chapter_31.lean index 5dcfca9..a2280b3 100644 --- a/CLRSLean/Chapter_31.lean +++ b/CLRSLean/Chapter_31.lean @@ -80,6 +80,10 @@ primality test, and the Pollard's-rho factorization heuristic. * {lit}`CLRS.Chapter31.fermat_test` (Theorem 31.31), {lit}`CLRS.Chapter31.fermatPseudoprime`, and {lit}`CLRS.Chapter31.pseudoprime` + `pseudoprime_correct`. +* **Carmichael numbers**: {lit}`CLRS.Chapter31.isCarmichael` — a composite `n` + passing the Fermat test for every coprime base + ({lit}`CLRS.Chapter31.carmichael_fermatPseudoprime`); + {lit}`CLRS.Chapter31.isCarmichael_561` exhibits the smallest one. ### 31.9 Integer Factorization @@ -90,7 +94,7 @@ primality test, and the Pollard's-rho factorization heuristic. ## Deferred Work -* 31.8 Carmichael numbers and the Miller-Rabin test. +* 31.8 the Miller-Rabin test. * 31.9 the full Pollard's-rho algorithm and its birthday-paradox analysis. -/ diff --git a/CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean b/CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean index 0b1dc39..834af53 100644 --- a/CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean +++ b/CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean @@ -1,4 +1,5 @@ import Mathlib +import CLRSLean.Chapter_31.Section_31_5_Chinese_Remainder_Theorem import CLRSLean.Chapter_31.Section_31_6_Powers_Of_An_Element /-! @@ -17,15 +18,21 @@ Main results: `a^(n−1) ≡ 1 (mod n)` for a given `a`. - {lit}`pseudoprime` + {lit}`pseudoprime_correct` (CLRS PSEUDOPRIME): the executable test returns whether `2^(n−1) ≡ 1 (mod n)`. +- {lit}`isCarmichael` (**Carmichael numbers**): a composite `n` passing the + Fermat test for every `a` coprime to `n`; a Carmichael number is a Fermat + pseudoprime to every coprime base + ({lit}`carmichael_fermatPseudoprime`). {lit}`isCarmichael_561` shows the + smallest Carmichael number is 561, so `PSEUDOPRIME` cannot certify + primality. The helper {lit}`modeq_of_coprime_mul` combines congruences + under coprime moduli. Notation: - {lit}`a ≡ b [MOD n]` : `Nat.ModEq`. - {lit}`Nat.totient n` : Euler's totient. -Deferred: Carmichael numbers, the Miller-Rabin test and its error bound, and -the random-witness analysis (§31.8); the executable pseudoprime loop with an -operation count. +Deferred: the Miller-Rabin test and its error bound, and the random-witness +analysis (§31.8); the executable pseudoprime loop with an operation count. -/ namespace CLRS @@ -68,6 +75,76 @@ theorem pseudoprime_correct {n : ℕ} (hn : Nat.Prime n) (hn2 : n ≠ 2) : have hcop : Nat.Coprime 2 n := (Nat.Prime.coprime_iff_not_dvd Nat.prime_two).2 hnot exact fermat_test hn hcop +/-- +`n` is a **Carmichael number** if it is composite and passes the Fermat test +`a^(n−1) ≡ 1 (mod n)` for every `a` coprime to `n` (CLRS §31.8). Such numbers +fool the Fermat primality test for every base, so the test alone cannot +certify primality. +-/ +def isCarmichael (n : ℕ) : Prop := + ¬ Nat.Prime n ∧ 1 < n ∧ ∀ a : ℕ, Nat.Coprime a n → a ^ (n - 1) ≡ 1 [MOD n] + +/-- A Carmichael number is composite. -/ +theorem carmichael_not_prime {n : ℕ} (h : isCarmichael n) : ¬ Nat.Prime n := h.1 + +/-- A Carmichael number is larger than one. -/ +theorem carmichael_gt_one {n : ℕ} (h : isCarmichael n) : 1 < n := h.2.1 + +/-- A Carmichael number passes the Fermat test for every base coprime to it. -/ +theorem carmichael_passes_fermat {n a : ℕ} (h : isCarmichael n) (hcop : Nat.Coprime a n) : + a ^ (n - 1) ≡ 1 [MOD n] := h.2.2 a hcop + +/-- A Carmichael number is a Fermat pseudoprime to every base coprime to it. -/ +theorem carmichael_fermatPseudoprime {n a : ℕ} (h : isCarmichael n) (hcop : Nat.Coprime a n) : + fermatPseudoprime n a := + ⟨carmichael_not_prime h, carmichael_passes_fermat h hcop⟩ + +/-- +**Combining congruences under coprime moduli.** If `a ≡ b (mod m)` and +`a ≡ b (mod n)` with `m`, `n` coprime, then `a ≡ b (mod m·n)`. This is the +"glue" needed to lift a congruence from pairwise-coprime prime factors to +their product (used to verify that 561 is a Carmichael number). +-/ +theorem modeq_of_coprime_mul {a b m n : ℕ} (hcop : Nat.Coprime m n) + (hm : a ≡ b [MOD m]) (hn : a ≡ b [MOD n]) : a ≡ b [MOD m * n] := by + rcases chinese_remainder (n := m) (m := n) (a := b) (b := b) hcop with + ⟨x, hx₁, hx₂, huniq⟩ + have hxb : x ≡ b [MOD m * n] := huniq b (Nat.ModEq.refl b) (Nat.ModEq.refl b) + have hax : x ≡ a [MOD m * n] := huniq a hm hn + exact hax.symm.trans hxb + +/-- +**561 is a Carmichael number.** The smallest Carmichael number (CLRS §31.8). +It shows the Fermat test can be fooled by a composite integer for every base +coprime to it, so `PSEUDOPRIME` cannot certify primality. +-/ +theorem isCarmichael_561 : isCarmichael 561 := by + constructor + · intro hp + have hdiv3 : 3 ∣ 561 := by norm_num + rcases (Nat.Prime.eq_one_or_self_of_dvd hp 3 hdiv3) with h1 | h561 + · norm_num at h1 + · norm_num at h561 + · constructor + · norm_num + · intro a hcop + have hcop3 : Nat.Coprime a 3 := + (Nat.Coprime.of_dvd_left (by norm_num : 3 ∣ 561) hcop.symm).symm + have hcop11 : Nat.Coprime a 11 := + (Nat.Coprime.of_dvd_left (by norm_num : 11 ∣ 561) hcop.symm).symm + have hcop17 : Nat.Coprime a 17 := + (Nat.Coprime.of_dvd_left (by norm_num : 17 ∣ 561) hcop.symm).symm + have h3 : a ^ 560 ≡ 1 [MOD 3] := by + simpa [← pow_mul] using (fermat_test (p := 3) (by norm_num : Nat.Prime 3) hcop3).pow 280 + have h11 : a ^ 560 ≡ 1 [MOD 11] := by + simpa [← pow_mul] using (fermat_test (p := 11) (by norm_num : Nat.Prime 11) hcop11).pow 56 + have h17 : a ^ 560 ≡ 1 [MOD 17] := by + simpa [← pow_mul] using (fermat_test (p := 17) (by norm_num : Nat.Prime 17) hcop17).pow 35 + have h33 : a ^ 560 ≡ 1 [MOD 3 * 11] := modeq_of_coprime_mul (by norm_num) h3 h11 + have hfull : a ^ 560 ≡ 1 [MOD 3 * 11 * 17] := + modeq_of_coprime_mul (by norm_num) h33 h17 + simpa [show 3 * 11 * 17 = 561 by norm_num] using hfull + end Chapter31 end CLRS diff --git a/CLRSLean/Progress.lean b/CLRSLean/Progress.lean index cc3e8e9..9a97d84 100644 --- a/CLRSLean/Progress.lean +++ b/CLRSLean/Progress.lean @@ -10,8 +10,8 @@ When the CSV changes, regenerate this page with * CLRS chapters tracked: 35. * Chapters represented in Lean: 32. -* Tracked reader-facing theorem entries: 1753. -* Proved tracked theorem entries: 1753. +* Tracked reader-facing theorem entries: 1755. +* Proved tracked theorem entries: 1755. * Remaining core theorem groups: 4. Tracked theorem entries count the public theorem groups currently represented @@ -62,7 +62,7 @@ Ch Chapter Status 28 28. Matrix Operations main-proof-complete 28.1;28.2;28.3 9 0 29 29. Linear Programming main-proof-complete 29.1;29.2;29.3;29.4;29.5 17 0 30 30. Polynomials and the FFT not-started not represented 0 1 -31 31. Number-Theoretic Algorithms selected-section-complete 31.1;31.2;31.3;31.4;31.5;31. 22 0 +31 31. Number-Theoretic Algorithms selected-section-complete 31.1;31.2;31.3;31.4;31.5;31. 24 0 32 32. String Matching selected-section-complete 32.1 19 0 33 33. Computational Geometry partial 33.1 7 1 34 34. NP-Completeness not-started not represented 0 1 diff --git a/docs/clrs-proof-progress.csv b/docs/clrs-proof-progress.csv index b496157..1f0cd51 100644 --- a/docs/clrs-proof-progress.csv +++ b/docs/clrs-proof-progress.csv @@ -29,7 +29,7 @@ chapter_no,chapter_title,repo_status,represented_sections,tracked_key_theorems,p 28,Matrix Operations,main-proof-complete,28.1;28.2;28.3,9,9,0,"Sections 28.1 (LUP decomposition and solving, Theorems 28.1-28.2, Lemmas 28.1-28.2), 28.2 (inversion), and 28.3 (SPD, Cholesky, least squares) are complete. Section 28.1 proves the LUP decomposition, the constructive forward/back substitution lemmas with LUP-SOLVE, uniqueness of solutions, the determinant-via-LUP corollary, and the CLRS running-time bounds (LUP-SOLVE Theta(n^2), LUP/inversion/Cholesky Theta(n^3)). Section 28.3 proves the Cholesky decomposition (Theorem 28.3) and its uniqueness, and the least-squares minimization theorem (Theorem 28.4).",exists_lup_decomposition (Theorem 28.1); forwardSubst_spec (Lemma 28.1); backSubst_spec (Lemma 28.2); lupSolve_correct (LUP-SOLVE); inv_eq_lup (Theorem 28.2); cholesky_decomposition (Theorem 28.3); cholesky_unique; normal_equations_minimizes (Theorem 28.4); det_eq_sign_mul_det_of_lup (Corollary to Thm 28.1),None,CLRSLean/Chapter_28.lean; CLRSLean/Chapter_28/Section_28_1_Linear_Equations.lean; CLRSLean/Chapter_28/Section_28_2_Inverting_Matrices.lean; CLRSLean/Chapter_28/Section_28_3_Symmetric_Positive_Definite.lean,"Sections 28.1-28.3 are complete: LUP decomposition and solving (Theorems 28.1-28.2, Lemmas 28.1-28.2, Algorithm LUP-SOLVE), the det-via-LUP corollary, matrix inversion, the Cholesky decomposition (Theorem 28.3) with uniqueness, least-squares approximation (Theorem 28.4), and the CLRS running-time cost bounds." 29,Linear Programming,main-proof-complete,29.1;29.2;29.3;29.4;29.5,17,17,0,"The Chapter 29 main text is complete at the finite real-matrix and pure-functional tableau layer: all textbook formulations, terminating initialized SIMPLEX, strong duality, and complementary slackness are kernel-checked",isFeasible_iff_exists_slackExtension; shortest-path LP lower-bound and attained-optimum theorems; maximum-flow LP equivalence; minimum-cost-flow LP equivalence; multicommodity-flow LP equivalence; dictionary/basic-solution and exact PIVOT semantics; deterministic Bland selectors and three-way simplexStep; optimal and unbounded exit correctness; bland_no_repeated_basis; simplexRun_basisCount_not_exhausted and simplex_optimal_or_unbounded; weak_duality (Theorem 29.8); terminal dictionary dual certificate; phase-I feasibility criterion; initializedSimplex_complete; strongDuality (Theorem 29.9); complementarySlackness_iff_optimal (Theorem 29.10),"Mutable tableau storage, floating-point numerical analysis, RAM constants, exercises, and chapter-end problems are optional refinements",CLRSLean/Chapter_29.lean; CLRSLean/Chapter_29/Section_29_1_Standard_And_Slack_Forms.lean; CLRSLean/Chapter_29/Section_29_2_Formulating_Problems_As_Linear_Programs.lean; CLRSLean/Chapter_29/Section_29_3_The_Simplex_Algorithm.lean; CLRSLean/Chapter_29/Section_29_4_Duality.lean; CLRSLean/Chapter_29/Section_29_5_The_Initial_Basic_Feasible_Solution.lean; Tests/Chapter_29_Interface.lean; Tests/Chapter_29_Formulations_Interface.lean; Tests/Chapter_29_Simplex_Interface.lean; Tests/Chapter_29_Initialization_Interface.lean; Tests/Chapter_29_Closure.lean; docs/proof-audits/chapter-29-closure-2026-08-05.md,The phase-I cleanup uses an equivalent fixed-dimension lock x₀ ≤ 0 together with x₀ ≥ 0 instead of physically deleting the artificial variable; this preserves exactly the original feasible assignments and supports the complete general strong-duality proof. 30,Polynomials and the FFT,not-started,None,0,0,1,Not represented,No tracked theorem names yet,Whole chapter theorem inventory and formalization pending,CLRSLean file tree,No Chapter_30 module exists. -31,Number-Theoretic Algorithms,selected-section-complete,31.1;31.2;31.3;31.4;31.5;31.6;31.7;31.8;31.9,22,22,0,"Sections 31.1-31.9 (number-theoretic algorithms) are complete: divisibility and the division theorem; the gcd, Euclid and extended-Euclid; modular arithmetic; linear congruences; the Chinese remainder theorem; powers of an element (Fermat and Euler); RSA; primality testing; and Pollard-s-rho factorization.",division_theorem (Theorem 31.1); euclid_recursion (Lemma 31.2); gcd_is_linear_combination (Lemma 31.3); gcd_is_smallest_positive_linear_combination (Theorem 31.2); exists_mul_inverse_mod (Theorem 31.6); modular_linear_solvable (Theorem 31.11); linear_congruence_solutions (Theorem 31.10); chinese_remainder (Theorem 31.27); chinese_remainder_general (Theorem 31.27); fermat_little_theorem (Theorem 31.30); euler_theorem; rsa_correct (Theorem 31.36); rsa_correct_general (Theorem 31.36); fermat_test (Theorem 31.31); rho_collision_factor; fib_le_of_euclidDivisions (Lemma 31.10); euclidDivisions_lt (Theorem 31.11); euclidDivisions_le_two_log (Corollary 31.12),"Miller-Rabin, and the full Pollard-s-rho probabilistic analysis (see chapter guide)",CLRSLean/Chapter_31.lean; CLRSLean/Chapter_31/Section_31_1_Elementary_Number_Theory.lean; CLRSLean/Chapter_31/Section_31_2_Greatest_Common_Divisor.lean; CLRSLean/Chapter_31/Section_31_3_Modular_Arithmetic.lean; CLRSLean/Chapter_31/Section_31_4_Solving_Modular_Linear_Equations.lean; CLRSLean/Chapter_31/Section_31_5_Chinese_Remainder_Theorem.lean; CLRSLean/Chapter_31/Section_31_6_Powers_Of_An_Element.lean; CLRSLean/Chapter_31/Section_31_7_RSA.lean; CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean; CLRSLean/Chapter_31/Section_31_9_Integer_Factorization.lean,"Sections 31.1-31.9 fully proved, including the Lamé running-time analysis of EUCLID (Lemmas 31.10 and Theorem 31.11, Corollary 31.12); Miller-Rabin and the full Pollard-s-rho probabilistic analyses deferred." +31,Number-Theoretic Algorithms,selected-section-complete,31.1;31.2;31.3;31.4;31.5;31.6;31.7;31.8;31.9,24,24,0,"Sections 31.1-31.9 (number-theoretic algorithms) are complete: divisibility and the division theorem; the gcd, Euclid and extended-Euclid; modular arithmetic; linear congruences; the Chinese remainder theorem; powers of an element (Fermat and Euler); RSA; primality testing; and Pollard-s-rho factorization.",division_theorem (Theorem 31.1); euclid_recursion (Lemma 31.2); gcd_is_linear_combination (Lemma 31.3); gcd_is_smallest_positive_linear_combination (Theorem 31.2); exists_mul_inverse_mod (Theorem 31.6); modular_linear_solvable (Theorem 31.11); linear_congruence_solutions (Theorem 31.10); chinese_remainder (Theorem 31.27); chinese_remainder_general (Theorem 31.27); fermat_little_theorem (Theorem 31.30); euler_theorem; rsa_correct (Theorem 31.36); rsa_correct_general (Theorem 31.36); fermat_test (Theorem 31.31); rho_collision_factor; fib_le_of_euclidDivisions (Lemma 31.10); euclidDivisions_lt (Theorem 31.11); euclidDivisions_le_two_log (Corollary 31.12); isCarmichael; isCarmichael_561,"Miller-Rabin, and the full Pollard-s-rho probabilistic analysis (see chapter guide)",CLRSLean/Chapter_31.lean; CLRSLean/Chapter_31/Section_31_1_Elementary_Number_Theory.lean; CLRSLean/Chapter_31/Section_31_2_Greatest_Common_Divisor.lean; CLRSLean/Chapter_31/Section_31_3_Modular_Arithmetic.lean; CLRSLean/Chapter_31/Section_31_4_Solving_Modular_Linear_Equations.lean; CLRSLean/Chapter_31/Section_31_5_Chinese_Remainder_Theorem.lean; CLRSLean/Chapter_31/Section_31_6_Powers_Of_An_Element.lean; CLRSLean/Chapter_31/Section_31_7_RSA.lean; CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean; CLRSLean/Chapter_31/Section_31_9_Integer_Factorization.lean,"Sections 31.1-31.9 fully proved, including the Lamé running-time analysis of EUCLID (Lemmas 31.10 and Theorem 31.11, Corollary 31.12) and Carmichael numbers (isCarmichael, 561); Miller-Rabin and the full Pollard-s-rho probabilistic analyses deferred." 32,String Matching,selected-section-complete,32.1,19,19,0,Section 32.1 fully proved,String model (14 lemmas); naiveMatcher soundness/completeness (5 theorems),Rabin-Karp hash proofs; finite-automaton construction; KMP prefix-function correctness,CLRSLean/Chapter_32.lean; CLRSLean/Chapter_32/Section_32_1_String_Model.lean; CLRSLean/Chapter_32/Section_32_1_String_Model/Naive_Matcher.lean,All 19 theorems are kernel-checked. Sections 32.2-32.4 deferred. Original formalization by caiwei2026 (PR #85). 33,Computational Geometry,partial,33.1,7,7,1,Section 33.1 definitions plus cross-product algebra and orientation specification are represented,Six cross-product algebra theorems; orientation_spec,Prove segmentIntersect soundness and completeness against an independent geometric-intersection specification including shared-endpoint cases; Sections 33.2-33.4 remain unrepresented,CLRSLean/Chapter_33.lean; CLRSLean/Chapter_33/Section_33_1_Line_Segment_Properties.lean,All 7 tracked theorems are kernel-checked but segmentIntersect bboxIntersect and sharesEndpoint currently have definitions without correctness theorems. 34,NP-Completeness,not-started,None,0,0,1,Not represented,No tracked theorem names yet,Whole chapter theorem inventory and formalization pending,CLRSLean file tree,No Chapter_34 module exists. diff --git a/docs/proof-map.md b/docs/proof-map.md index a97d347..209e2a1 100644 --- a/docs/proof-map.md +++ b/docs/proof-map.md @@ -4274,6 +4274,16 @@ No core proof group remains within the selected milestone. Sections 26.4 and - `fermat_test` (CLRS Theorem 31.31): prime `p` and `gcd(a,p)=1` give `a^(p−1) ≡ 1 (mod p)`. - `fermatPseudoprime`, `pseudoprime` + `pseudoprime_correct` (PSEUDOPRIME). + - `isCarmichael` (**Carmichael numbers**): composite `n` passing the Fermat + test `a^(n−1) ≡ 1 (mod n)` for every `a` coprime to `n`; + `carmichael_fermatPseudoprime` shows such `n` fool the Fermat test for + every coprime base. + - `isCarmichael_561`: 561 is a Carmichael number — via `fermat_test` for the + prime factors 3, 11, 17 (with `2·280`, `10·56`, `16·35` all equal to 560) + and the helper `modeq_of_coprime_mul` combining congruences under coprime + moduli. This shows `PSEUDOPRIME` cannot certify primality. + - Deferred: the Miller-Rabin test, its error bound, and the random-witness + analysis. ### Section 31.9 - Integer Factorization From 88fce0ddd7e48e4e2269883a73eef0300a62d420 Mon Sep 17 00:00:00 2001 From: TankTechnology <2541826291@qq.com> Date: Wed, 5 Aug 2026 21:27:17 +0800 Subject: [PATCH 06/24] feat(ch31): Miller-Rabin definitions in 31.8 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Define the Miller-Rabin machinery (correctness/error bound deferred): - strongTestParams: write n-1 = 2^s * d with d odd via Nat.factorization. - strongPseudoprime (STRONG-PSEUDOPRIME): a^d ≡ 1 or a^(2^i * d) ≡ -1 for some i < s (i ranging over Fin s for decidability). - Witness: a base that refutes strong pseudoprimality. - millerRabin: the executable single-base decision procedure. - instDecidableStrongPseudoprime for the Fin-bounded search. Computational sanity checks: millerRabin 5 2 = true, 9 2 = false, and 561 2 = false - although 561 is a Carmichael number, base 2 witnesses that it is composite, illustrating why Miller-Rabin beats PSEUDOPRIME. Kernel-clean; docs and proof map updated; correctness/error bound remain deferred. Co-Authored-By: Claude --- CLRSLean/Chapter_31.lean | 8 ++- .../Section_31_8_Primality_Testing.lean | 49 ++++++++++++++++++- docs/clrs-proof-progress.csv | 2 +- docs/proof-map.md | 9 +++- 4 files changed, 62 insertions(+), 6 deletions(-) diff --git a/CLRSLean/Chapter_31.lean b/CLRSLean/Chapter_31.lean index a2280b3..2cfe825 100644 --- a/CLRSLean/Chapter_31.lean +++ b/CLRSLean/Chapter_31.lean @@ -84,6 +84,11 @@ primality test, and the Pollard's-rho factorization heuristic. passing the Fermat test for every coprime base ({lit}`CLRS.Chapter31.carmichael_fermatPseudoprime`); {lit}`CLRS.Chapter31.isCarmichael_561` exhibits the smallest one. +* **Miller-Rabin**: {lit}`CLRS.Chapter31.strongTestParams` (the `2^s·d` + decomposition), {lit}`CLRS.Chapter31.strongPseudoprime` (STRONG-PSEUDOPRIME), + {lit}`CLRS.Chapter31.Witness`, and the executable + {lit}`CLRS.Chapter31.millerRabin` test. (The correctness and error-bound + theorems remain deferred.) ### 31.9 Integer Factorization @@ -94,7 +99,8 @@ primality test, and the Pollard's-rho factorization heuristic. ## Deferred Work -* 31.8 the Miller-Rabin test. +* 31.8 Miller-Rabin correctness (primes never have a witness) and the + error bound (at most 1/4 of the bases are strong liars). * 31.9 the full Pollard's-rho algorithm and its birthday-paradox analysis. -/ diff --git a/CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean b/CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean index 834af53..450e10b 100644 --- a/CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean +++ b/CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean @@ -25,14 +25,22 @@ Main results: smallest Carmichael number is 561, so `PSEUDOPRIME` cannot certify primality. The helper {lit}`modeq_of_coprime_mul` combines congruences under coprime moduli. +- **Miller-Rabin**: {lit}`strongTestParams` writes `n−1 = 2^s·d` with `d` odd; + {lit}`strongPseudoprime` (STRONG-PSEUDOPRIME) is the strong probable-prime + condition; {lit}`Witness` is a base that refutes it; and + {lit}`millerRabin` is the executable single-base test. (Evaluating + `millerRabin 561 2` returns `false`: although 561 is a Carmichael number, + base 2 witnesses that it is composite.) Notation: - {lit}`a ≡ b [MOD n]` : `Nat.ModEq`. - {lit}`Nat.totient n` : Euler's totient. -Deferred: the Miller-Rabin test and its error bound, and the random-witness -analysis (§31.8); the executable pseudoprime loop with an operation count. +Deferred: the Miller-Rabin correctness theorem (primes never have a witness) +and the error bound (at most a quarter of the bases are strong liars), plus +the random-witness analysis (§31.8); the executable pseudoprime loop with an +operation count. -/ namespace CLRS @@ -145,6 +153,43 @@ theorem isCarmichael_561 : isCarmichael 561 := by modeq_of_coprime_mul (by norm_num) h33 h17 simpa [show 3 * 11 * 17 = 561 by norm_num] using hfull +/-- +**STRONG-PSEUDOPRIME parameters (CLRS §31.8).** Write `n−1 = 2^s · d` with +`d` odd: `s` is the exponent of 2 in the prime factorization of `n−1`, and +`d` is the odd part. +-/ +def strongTestParams (n : ℕ) : ℕ × ℕ := + (Nat.factorization (n - 1) 2, (n - 1) / 2 ^ Nat.factorization (n - 1) 2) + +/-- +**STRONG-PSEUDOPRIME (CLRS §31.8).** `n` is a strong probable prime to base +`a` if, writing `n−1 = 2^s·d` with `d` odd, either `a^d ≡ 1 (mod n)` or +`a^(2^i·d) ≡ −1 (mod n)` for some `i < s`. +-/ +def strongPseudoprime (n a : ℕ) : Prop := + let s := (strongTestParams n).1 + let d := (strongTestParams n).2 + a ^ d ≡ 1 [MOD n] ∨ ∃ i : Fin s, a ^ (2 ^ (i : ℕ) * d) ≡ n - 1 [MOD n] + +/-- +**WITNESS (CLRS §31.8).** A base `a` witnesses that `n` is composite when +`n` fails the strong-pseudoprime test to base `a`. A witness certifies +`¬ Nat.Prime n`. +-/ +def Witness (n a : ℕ) : Prop := + ¬ strongPseudoprime n a + +instance instDecidableStrongPseudoprime (n a : ℕ) : Decidable (strongPseudoprime n a) := by + unfold strongPseudoprime + infer_instance + +/-- +**MILLER-RABIN (single base, CLRS §31.8).** The executable decision procedure +returning whether `n` is a strong probable prime to base `a`. +-/ +def millerRabin (n a : ℕ) : Bool := + decide (strongPseudoprime n a) + end Chapter31 end CLRS diff --git a/docs/clrs-proof-progress.csv b/docs/clrs-proof-progress.csv index 1f0cd51..bc81635 100644 --- a/docs/clrs-proof-progress.csv +++ b/docs/clrs-proof-progress.csv @@ -29,7 +29,7 @@ chapter_no,chapter_title,repo_status,represented_sections,tracked_key_theorems,p 28,Matrix Operations,main-proof-complete,28.1;28.2;28.3,9,9,0,"Sections 28.1 (LUP decomposition and solving, Theorems 28.1-28.2, Lemmas 28.1-28.2), 28.2 (inversion), and 28.3 (SPD, Cholesky, least squares) are complete. Section 28.1 proves the LUP decomposition, the constructive forward/back substitution lemmas with LUP-SOLVE, uniqueness of solutions, the determinant-via-LUP corollary, and the CLRS running-time bounds (LUP-SOLVE Theta(n^2), LUP/inversion/Cholesky Theta(n^3)). Section 28.3 proves the Cholesky decomposition (Theorem 28.3) and its uniqueness, and the least-squares minimization theorem (Theorem 28.4).",exists_lup_decomposition (Theorem 28.1); forwardSubst_spec (Lemma 28.1); backSubst_spec (Lemma 28.2); lupSolve_correct (LUP-SOLVE); inv_eq_lup (Theorem 28.2); cholesky_decomposition (Theorem 28.3); cholesky_unique; normal_equations_minimizes (Theorem 28.4); det_eq_sign_mul_det_of_lup (Corollary to Thm 28.1),None,CLRSLean/Chapter_28.lean; CLRSLean/Chapter_28/Section_28_1_Linear_Equations.lean; CLRSLean/Chapter_28/Section_28_2_Inverting_Matrices.lean; CLRSLean/Chapter_28/Section_28_3_Symmetric_Positive_Definite.lean,"Sections 28.1-28.3 are complete: LUP decomposition and solving (Theorems 28.1-28.2, Lemmas 28.1-28.2, Algorithm LUP-SOLVE), the det-via-LUP corollary, matrix inversion, the Cholesky decomposition (Theorem 28.3) with uniqueness, least-squares approximation (Theorem 28.4), and the CLRS running-time cost bounds." 29,Linear Programming,main-proof-complete,29.1;29.2;29.3;29.4;29.5,17,17,0,"The Chapter 29 main text is complete at the finite real-matrix and pure-functional tableau layer: all textbook formulations, terminating initialized SIMPLEX, strong duality, and complementary slackness are kernel-checked",isFeasible_iff_exists_slackExtension; shortest-path LP lower-bound and attained-optimum theorems; maximum-flow LP equivalence; minimum-cost-flow LP equivalence; multicommodity-flow LP equivalence; dictionary/basic-solution and exact PIVOT semantics; deterministic Bland selectors and three-way simplexStep; optimal and unbounded exit correctness; bland_no_repeated_basis; simplexRun_basisCount_not_exhausted and simplex_optimal_or_unbounded; weak_duality (Theorem 29.8); terminal dictionary dual certificate; phase-I feasibility criterion; initializedSimplex_complete; strongDuality (Theorem 29.9); complementarySlackness_iff_optimal (Theorem 29.10),"Mutable tableau storage, floating-point numerical analysis, RAM constants, exercises, and chapter-end problems are optional refinements",CLRSLean/Chapter_29.lean; CLRSLean/Chapter_29/Section_29_1_Standard_And_Slack_Forms.lean; CLRSLean/Chapter_29/Section_29_2_Formulating_Problems_As_Linear_Programs.lean; CLRSLean/Chapter_29/Section_29_3_The_Simplex_Algorithm.lean; CLRSLean/Chapter_29/Section_29_4_Duality.lean; CLRSLean/Chapter_29/Section_29_5_The_Initial_Basic_Feasible_Solution.lean; Tests/Chapter_29_Interface.lean; Tests/Chapter_29_Formulations_Interface.lean; Tests/Chapter_29_Simplex_Interface.lean; Tests/Chapter_29_Initialization_Interface.lean; Tests/Chapter_29_Closure.lean; docs/proof-audits/chapter-29-closure-2026-08-05.md,The phase-I cleanup uses an equivalent fixed-dimension lock x₀ ≤ 0 together with x₀ ≥ 0 instead of physically deleting the artificial variable; this preserves exactly the original feasible assignments and supports the complete general strong-duality proof. 30,Polynomials and the FFT,not-started,None,0,0,1,Not represented,No tracked theorem names yet,Whole chapter theorem inventory and formalization pending,CLRSLean file tree,No Chapter_30 module exists. -31,Number-Theoretic Algorithms,selected-section-complete,31.1;31.2;31.3;31.4;31.5;31.6;31.7;31.8;31.9,24,24,0,"Sections 31.1-31.9 (number-theoretic algorithms) are complete: divisibility and the division theorem; the gcd, Euclid and extended-Euclid; modular arithmetic; linear congruences; the Chinese remainder theorem; powers of an element (Fermat and Euler); RSA; primality testing; and Pollard-s-rho factorization.",division_theorem (Theorem 31.1); euclid_recursion (Lemma 31.2); gcd_is_linear_combination (Lemma 31.3); gcd_is_smallest_positive_linear_combination (Theorem 31.2); exists_mul_inverse_mod (Theorem 31.6); modular_linear_solvable (Theorem 31.11); linear_congruence_solutions (Theorem 31.10); chinese_remainder (Theorem 31.27); chinese_remainder_general (Theorem 31.27); fermat_little_theorem (Theorem 31.30); euler_theorem; rsa_correct (Theorem 31.36); rsa_correct_general (Theorem 31.36); fermat_test (Theorem 31.31); rho_collision_factor; fib_le_of_euclidDivisions (Lemma 31.10); euclidDivisions_lt (Theorem 31.11); euclidDivisions_le_two_log (Corollary 31.12); isCarmichael; isCarmichael_561,"Miller-Rabin, and the full Pollard-s-rho probabilistic analysis (see chapter guide)",CLRSLean/Chapter_31.lean; CLRSLean/Chapter_31/Section_31_1_Elementary_Number_Theory.lean; CLRSLean/Chapter_31/Section_31_2_Greatest_Common_Divisor.lean; CLRSLean/Chapter_31/Section_31_3_Modular_Arithmetic.lean; CLRSLean/Chapter_31/Section_31_4_Solving_Modular_Linear_Equations.lean; CLRSLean/Chapter_31/Section_31_5_Chinese_Remainder_Theorem.lean; CLRSLean/Chapter_31/Section_31_6_Powers_Of_An_Element.lean; CLRSLean/Chapter_31/Section_31_7_RSA.lean; CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean; CLRSLean/Chapter_31/Section_31_9_Integer_Factorization.lean,"Sections 31.1-31.9 fully proved, including the Lamé running-time analysis of EUCLID (Lemmas 31.10 and Theorem 31.11, Corollary 31.12) and Carmichael numbers (isCarmichael, 561); Miller-Rabin and the full Pollard-s-rho probabilistic analyses deferred." +31,Number-Theoretic Algorithms,selected-section-complete,31.1;31.2;31.3;31.4;31.5;31.6;31.7;31.8;31.9,24,24,0,"Sections 31.1-31.9 (number-theoretic algorithms) are complete: divisibility and the division theorem; the gcd, Euclid and extended-Euclid; modular arithmetic; linear congruences; the Chinese remainder theorem; powers of an element (Fermat and Euler); RSA; primality testing; and Pollard-s-rho factorization.",division_theorem (Theorem 31.1); euclid_recursion (Lemma 31.2); gcd_is_linear_combination (Lemma 31.3); gcd_is_smallest_positive_linear_combination (Theorem 31.2); exists_mul_inverse_mod (Theorem 31.6); modular_linear_solvable (Theorem 31.11); linear_congruence_solutions (Theorem 31.10); chinese_remainder (Theorem 31.27); chinese_remainder_general (Theorem 31.27); fermat_little_theorem (Theorem 31.30); euler_theorem; rsa_correct (Theorem 31.36); rsa_correct_general (Theorem 31.36); fermat_test (Theorem 31.31); rho_collision_factor; fib_le_of_euclidDivisions (Lemma 31.10); euclidDivisions_lt (Theorem 31.11); euclidDivisions_le_two_log (Corollary 31.12); isCarmichael; isCarmichael_561,"Miller-Rabin, and the full Pollard-s-rho probabilistic analysis (see chapter guide)",CLRSLean/Chapter_31.lean; CLRSLean/Chapter_31/Section_31_1_Elementary_Number_Theory.lean; CLRSLean/Chapter_31/Section_31_2_Greatest_Common_Divisor.lean; CLRSLean/Chapter_31/Section_31_3_Modular_Arithmetic.lean; CLRSLean/Chapter_31/Section_31_4_Solving_Modular_Linear_Equations.lean; CLRSLean/Chapter_31/Section_31_5_Chinese_Remainder_Theorem.lean; CLRSLean/Chapter_31/Section_31_6_Powers_Of_An_Element.lean; CLRSLean/Chapter_31/Section_31_7_RSA.lean; CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean; CLRSLean/Chapter_31/Section_31_9_Integer_Factorization.lean,"Sections 31.1-31.9 fully proved, including the Lamé running-time analysis of EUCLID (Lemmas 31.10 and Theorem 31.11, Corollary 31.12) and Carmichael numbers (isCarmichael, 561); Miller-Rabin is defined (strongPseudoprime, Witness, millerRabin) but its correctness and error bound, and the full Pollard-s-rho probabilistic analysis, are deferred." 32,String Matching,selected-section-complete,32.1,19,19,0,Section 32.1 fully proved,String model (14 lemmas); naiveMatcher soundness/completeness (5 theorems),Rabin-Karp hash proofs; finite-automaton construction; KMP prefix-function correctness,CLRSLean/Chapter_32.lean; CLRSLean/Chapter_32/Section_32_1_String_Model.lean; CLRSLean/Chapter_32/Section_32_1_String_Model/Naive_Matcher.lean,All 19 theorems are kernel-checked. Sections 32.2-32.4 deferred. Original formalization by caiwei2026 (PR #85). 33,Computational Geometry,partial,33.1,7,7,1,Section 33.1 definitions plus cross-product algebra and orientation specification are represented,Six cross-product algebra theorems; orientation_spec,Prove segmentIntersect soundness and completeness against an independent geometric-intersection specification including shared-endpoint cases; Sections 33.2-33.4 remain unrepresented,CLRSLean/Chapter_33.lean; CLRSLean/Chapter_33/Section_33_1_Line_Segment_Properties.lean,All 7 tracked theorems are kernel-checked but segmentIntersect bboxIntersect and sharesEndpoint currently have definitions without correctness theorems. 34,NP-Completeness,not-started,None,0,0,1,Not represented,No tracked theorem names yet,Whole chapter theorem inventory and formalization pending,CLRSLean file tree,No Chapter_34 module exists. diff --git a/docs/proof-map.md b/docs/proof-map.md index 209e2a1..c54edf4 100644 --- a/docs/proof-map.md +++ b/docs/proof-map.md @@ -4282,8 +4282,13 @@ No core proof group remains within the selected milestone. Sections 26.4 and prime factors 3, 11, 17 (with `2·280`, `10·56`, `16·35` all equal to 560) and the helper `modeq_of_coprime_mul` combining congruences under coprime moduli. This shows `PSEUDOPRIME` cannot certify primality. - - Deferred: the Miller-Rabin test, its error bound, and the random-witness - analysis. + - `strongTestParams` / `strongPseudoprime` / `Witness` / `millerRabin` + (Miller-Rabin): the `2^s·d` decomposition of `n−1` (via `Nat.factorization`), + the STRONG-PSEUDOPRIME condition, the witness predicate, and the executable + single-base test. `millerRabin 561 2` evaluates to `false`: although 561 is + a Carmichael number, base 2 witnesses that it is composite. + - Deferred: the Miller-Rabin correctness theorem (primes never have a + witness), its error bound, and the random-witness analysis. ### Section 31.9 - Integer Factorization From 9ebf427da735a5f9784d2f4a39b5721b27559410 Mon Sep 17 00:00:00 2001 From: TankTechnology <2541826291@qq.com> Date: Wed, 5 Aug 2026 21:51:35 +0800 Subject: [PATCH 07/24] =?UTF-8?q?feat(ch31):=20Miller-Rabin=20correctness?= =?UTF-8?q?=20=E2=80=94=20a=20prime=20never=20has=20a=20witness?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Prove the prime direction of Miller-Rabin correctness in 31.8: - strongTestParams_spec: the 2^s·d decomposition of n-1 (via Nat.Prime.pow_dvd_iff_le_factorization and Nat.mul_div_cancel'). - modeq_neg_one_of_sq_eq_one: for a prime p, x^2 ≡ 1 and x ≢ 1 (mod p) imply x ≡ -1 — the roots-of-unity fact via Nat.sq_sub_sq and Nat.Prime.dvd_mul. - strongPseudoprime_of_prime: for prime n and a coprime to n, the sequence a^d, a^(2d), ..., a^(2^s·d) reaches 1 (Fermat); at the first such index the previous value is a square root of 1 that is not 1, hence -1. Uses Nat.find for the minimal index. - not_witness_of_prime (a prime has no witness) and witness_not_prime (a witness certifies compositeness). Kernel-clean axioms; progress CSV bumped to 26/26; only the Miller-Rabin error bound and Pollard's-rho analysis remain deferred. Co-Authored-By: Claude --- CLRSLean/Chapter_31.lean | 11 +- .../Section_31_8_Primality_Testing.lean | 128 +++++++++++++++++- CLRSLean/Progress.lean | 6 +- docs/clrs-proof-progress.csv | 2 +- docs/proof-map.md | 9 +- 5 files changed, 142 insertions(+), 14 deletions(-) diff --git a/CLRSLean/Chapter_31.lean b/CLRSLean/Chapter_31.lean index 2cfe825..4b8b91f 100644 --- a/CLRSLean/Chapter_31.lean +++ b/CLRSLean/Chapter_31.lean @@ -87,8 +87,11 @@ primality test, and the Pollard's-rho factorization heuristic. * **Miller-Rabin**: {lit}`CLRS.Chapter31.strongTestParams` (the `2^s·d` decomposition), {lit}`CLRS.Chapter31.strongPseudoprime` (STRONG-PSEUDOPRIME), {lit}`CLRS.Chapter31.Witness`, and the executable - {lit}`CLRS.Chapter31.millerRabin` test. (The correctness and error-bound - theorems remain deferred.) + {lit}`CLRS.Chapter31.millerRabin` test. Correctness: + {lit}`CLRS.Chapter31.strongPseudoprime_of_prime` (a prime passes every + base), {lit}`CLRS.Chapter31.not_witness_of_prime`, and + {lit}`CLRS.Chapter31.witness_not_prime` (a witness certifies + compositeness). (The error bound remains deferred.) ### 31.9 Integer Factorization @@ -99,8 +102,8 @@ primality test, and the Pollard's-rho factorization heuristic. ## Deferred Work -* 31.8 Miller-Rabin correctness (primes never have a witness) and the - error bound (at most 1/4 of the bases are strong liars). +* 31.8 the Miller-Rabin error bound (at most 1/4 of the bases are strong + liars for an odd composite `n`). * 31.9 the full Pollard's-rho algorithm and its birthday-paradox analysis. -/ diff --git a/CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean b/CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean index 450e10b..acf4604 100644 --- a/CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean +++ b/CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean @@ -31,16 +31,21 @@ Main results: {lit}`millerRabin` is the executable single-base test. (Evaluating `millerRabin 561 2` returns `false`: although 561 is a Carmichael number, base 2 witnesses that it is composite.) +- **Miller-Rabin correctness**: {lit}`strongPseudoprime_of_prime` shows a + prime is a strong probable prime to every coprime base — the repeated + squaring in STRONG-PSEUDOPRIME can only reach `1` through `−1` modulo a + prime (via {lit}`modeq_neg_one_of_sq_eq_one`, the roots-of-unity fact). + Consequently {lit}`not_witness_of_prime` (a prime has no witness) and + {lit}`witness_not_prime` (a witness certifies compositeness) hold. Notation: - {lit}`a ≡ b [MOD n]` : `Nat.ModEq`. - {lit}`Nat.totient n` : Euler's totient. -Deferred: the Miller-Rabin correctness theorem (primes never have a witness) -and the error bound (at most a quarter of the bases are strong liars), plus -the random-witness analysis (§31.8); the executable pseudoprime loop with an -operation count. +Deferred: the Miller-Rabin error bound (at most a quarter of the bases are +strong liars) and the random-witness analysis (§31.8); the executable +pseudoprime loop with an operation count. -/ namespace CLRS @@ -190,6 +195,121 @@ returning whether `n` is a strong probable prime to base `a`. def millerRabin (n a : ℕ) : Bool := decide (strongPseudoprime n a) +/-- +**STRONG-PSEUDOPRIME decomposition (CLRS §31.8).** For `n ≠ 0`, +`n = 2^s · (n / 2^s)` where `s` is the exponent of 2 in `n` — i.e. the odd part +of `n` times `2^s` recovers `n`. +-/ +theorem strongTestParams_spec (n : ℕ) (hn : n ≠ 0) : + n = 2 ^ (n.factorization 2) * (n / 2 ^ (n.factorization 2)) := by + have hdvd : 2 ^ (n.factorization 2) ∣ n := by + exact (Nat.Prime.pow_dvd_iff_le_factorization (by decide : Nat.Prime 2) hn).2 le_rfl + exact (Nat.mul_div_cancel' hdvd).symm + +/-- +**Roots of unity modulo a prime.** If `b^2 ≡ 1 (mod p)` for a prime `p` and +`b ≢ 1 (mod p)`, then `b ≡ −1 (mod p)`. This is the only fact about prime +moduli needed by the Miller-Rabin correctness proof: repeatedly squaring a +root of unity can only reach `1` through `−1`. +-/ +theorem modeq_neg_one_of_sq_eq_one {p b : ℕ} (hp : Nat.Prime p) (hb : 1 ≤ b) + (hb2 : b ^ 2 ≡ 1 [MOD p]) (hbne : ¬ b ≡ 1 [MOD p]) : + b ≡ p - 1 [MOD p] := by + have hb2' : 1 ≡ b ^ 2 [MOD p] := hb2.symm + have hb2_dvd : p ∣ b ^ 2 - 1 := by + exact (Nat.modEq_iff_dvd' (by nlinarith : 1 ≤ b ^ 2)).mp hb2' + have hsq : b ^ 2 - 1 = (b - 1) * (b + 1) := by + have hsub := Nat.sq_sub_sq b 1 + simpa [mul_comm] using hsub + rw [hsq] at hb2_dvd + have hdvd_or := (hp.dvd_mul).1 hb2_dvd + rcases hdvd_or with hd1 | hd2 + · exfalso + exact hbne ((Nat.modEq_iff_dvd' hb).mpr hd1).symm + · have h0 : b + 1 ≡ 0 [MOD p] := hd2.modEq_zero_nat + have h1 : (p - 1) + 1 ≡ 0 [MOD p] := by + rw [Nat.sub_add_cancel (Nat.one_le_of_lt hp.pos)] + exact Nat.modEq_zero_iff_dvd.mpr (dvd_refl p) + have h : b + 1 ≡ (p - 1) + 1 [MOD p] := h0.trans h1.symm + exact Nat.ModEq.add_right_cancel (Nat.ModEq.refl 1) h + +/-- +**Miller-Rabin correctness, prime direction.** If `n` is prime and `a` is +coprime to `n`, then `n` is a strong probable prime to base `a` — i.e. a prime +has no witness. Writing `n−1 = 2^s·d`, the sequence `a^d, a^{2d}, …, a^{2^s·d}` +ends at `1` (Fermat); at the first index where it reaches `1`, the previous +value is a square root of `1` that is not `1`, hence `−1` (mod a prime). +-/ +theorem strongPseudoprime_of_prime {n a : ℕ} (hn : Nat.Prime n) (hcop : Nat.Coprime a n) : + strongPseudoprime n a := by + have hn2 : 2 ≤ n := hn.two_le + have hnm1 : n - 1 ≠ 0 := by omega + have hdecomp : n - 1 = 2 ^ (strongTestParams n).1 * (strongTestParams n).2 := by + have h := strongTestParams_spec (n - 1) hnm1 + simpa [strongTestParams] using h + have hfermat : a ^ (n - 1) ≡ 1 [MOD n] := fermat_test hn hcop + let s := (strongTestParams n).1 + let d := (strongTestParams n).2 + have h1 : a ^ (2 ^ s * d) ≡ 1 [MOD n] := by + rw [← hdecomp] + exact hfermat + let P : ℕ → Prop := fun i => a ^ (2 ^ i * d) ≡ 1 [MOD n] + have hP_s : P s := by + simpa [P, hdecomp] using hfermat + let i0 := Nat.find ⟨s, hP_s⟩ + have hP0 : P i0 := by + exact Nat.find_spec ⟨s, hP_s⟩ + have hmin : ∀ m, m < i0 → ¬ P m := by + intro m hm + exact Nat.find_min ⟨s, hP_s⟩ (by simpa [i0] using hm) + have hile : i0 ≤ s := by simpa [i0] using (Nat.find_le (h := ⟨s, hP_s⟩) hP_s) + by_cases hi00 : i0 = 0 + · left + have : P 0 := by simpa [hi00] using hP0 + simpa [P] using this + · right + let j := i0 - 1 + have hj : j < s := by omega + have hjlt_i0 : j < i0 := by omega + have hj1 : j + 1 = i0 := by omega + have hb : a ^ (2 ^ j * d) ≡ n - 1 [MOD n] := by + have hb2 : (a ^ (2 ^ j * d)) ^ 2 ≡ 1 [MOD n] := by + have hsq : (a ^ (2 ^ j * d)) ^ 2 = a ^ (2 ^ i0 * d) := by + rw [← pow_mul] + congr 1 + rw [mul_assoc, mul_comm d 2, ← mul_assoc, ← pow_succ, hj1] + rw [hsq] + simpa [P] using hP0 + have hbne : ¬ a ^ (2 ^ j * d) ≡ 1 [MOD n] := by + exact hmin j hjlt_i0 + have ha1 : 1 ≤ a := by + have ha_ne : a ≠ 0 := by + intro ha + have hg : Nat.gcd a n = 1 := hcop + have hn1 : n = 1 := by + rw [ha, Nat.gcd_zero_left] at hg + exact hg + omega + exact Nat.succ_le_of_lt (Nat.pos_of_ne_zero ha_ne) + have hb1 : 1 ≤ a ^ (2 ^ j * d) := by + exact one_le_pow₀ ha1 + exact modeq_neg_one_of_sq_eq_one hn hb1 hb2 hbne + exact ⟨⟨j, hj⟩, hb⟩ + +/-- **A prime has no witness**: for `n` prime and `a` coprime to `n`, `a` does +not witness compositeness of `n`. -/ +theorem not_witness_of_prime {n a : ℕ} (hn : Nat.Prime n) (hcop : Nat.Coprime a n) : + ¬ Witness n a := by + intro hw + exact hw (strongPseudoprime_of_prime hn hcop) + +/-- **A witness certifies compositeness**: for `n` and a coprime base `a`, if +`a` is a witness then `n` is not prime. -/ +theorem witness_not_prime {n a : ℕ} (hcop : Nat.Coprime a n) (hw : Witness n a) : + ¬ Nat.Prime n := by + intro hn + exact (not_witness_of_prime hn hcop) hw + end Chapter31 end CLRS diff --git a/CLRSLean/Progress.lean b/CLRSLean/Progress.lean index 9a97d84..45fc48b 100644 --- a/CLRSLean/Progress.lean +++ b/CLRSLean/Progress.lean @@ -10,8 +10,8 @@ When the CSV changes, regenerate this page with * CLRS chapters tracked: 35. * Chapters represented in Lean: 32. -* Tracked reader-facing theorem entries: 1755. -* Proved tracked theorem entries: 1755. +* Tracked reader-facing theorem entries: 1757. +* Proved tracked theorem entries: 1757. * Remaining core theorem groups: 4. Tracked theorem entries count the public theorem groups currently represented @@ -62,7 +62,7 @@ Ch Chapter Status 28 28. Matrix Operations main-proof-complete 28.1;28.2;28.3 9 0 29 29. Linear Programming main-proof-complete 29.1;29.2;29.3;29.4;29.5 17 0 30 30. Polynomials and the FFT not-started not represented 0 1 -31 31. Number-Theoretic Algorithms selected-section-complete 31.1;31.2;31.3;31.4;31.5;31. 24 0 +31 31. Number-Theoretic Algorithms selected-section-complete 31.1;31.2;31.3;31.4;31.5;31. 26 0 32 32. String Matching selected-section-complete 32.1 19 0 33 33. Computational Geometry partial 33.1 7 1 34 34. NP-Completeness not-started not represented 0 1 diff --git a/docs/clrs-proof-progress.csv b/docs/clrs-proof-progress.csv index bc81635..fb5977c 100644 --- a/docs/clrs-proof-progress.csv +++ b/docs/clrs-proof-progress.csv @@ -29,7 +29,7 @@ chapter_no,chapter_title,repo_status,represented_sections,tracked_key_theorems,p 28,Matrix Operations,main-proof-complete,28.1;28.2;28.3,9,9,0,"Sections 28.1 (LUP decomposition and solving, Theorems 28.1-28.2, Lemmas 28.1-28.2), 28.2 (inversion), and 28.3 (SPD, Cholesky, least squares) are complete. Section 28.1 proves the LUP decomposition, the constructive forward/back substitution lemmas with LUP-SOLVE, uniqueness of solutions, the determinant-via-LUP corollary, and the CLRS running-time bounds (LUP-SOLVE Theta(n^2), LUP/inversion/Cholesky Theta(n^3)). Section 28.3 proves the Cholesky decomposition (Theorem 28.3) and its uniqueness, and the least-squares minimization theorem (Theorem 28.4).",exists_lup_decomposition (Theorem 28.1); forwardSubst_spec (Lemma 28.1); backSubst_spec (Lemma 28.2); lupSolve_correct (LUP-SOLVE); inv_eq_lup (Theorem 28.2); cholesky_decomposition (Theorem 28.3); cholesky_unique; normal_equations_minimizes (Theorem 28.4); det_eq_sign_mul_det_of_lup (Corollary to Thm 28.1),None,CLRSLean/Chapter_28.lean; CLRSLean/Chapter_28/Section_28_1_Linear_Equations.lean; CLRSLean/Chapter_28/Section_28_2_Inverting_Matrices.lean; CLRSLean/Chapter_28/Section_28_3_Symmetric_Positive_Definite.lean,"Sections 28.1-28.3 are complete: LUP decomposition and solving (Theorems 28.1-28.2, Lemmas 28.1-28.2, Algorithm LUP-SOLVE), the det-via-LUP corollary, matrix inversion, the Cholesky decomposition (Theorem 28.3) with uniqueness, least-squares approximation (Theorem 28.4), and the CLRS running-time cost bounds." 29,Linear Programming,main-proof-complete,29.1;29.2;29.3;29.4;29.5,17,17,0,"The Chapter 29 main text is complete at the finite real-matrix and pure-functional tableau layer: all textbook formulations, terminating initialized SIMPLEX, strong duality, and complementary slackness are kernel-checked",isFeasible_iff_exists_slackExtension; shortest-path LP lower-bound and attained-optimum theorems; maximum-flow LP equivalence; minimum-cost-flow LP equivalence; multicommodity-flow LP equivalence; dictionary/basic-solution and exact PIVOT semantics; deterministic Bland selectors and three-way simplexStep; optimal and unbounded exit correctness; bland_no_repeated_basis; simplexRun_basisCount_not_exhausted and simplex_optimal_or_unbounded; weak_duality (Theorem 29.8); terminal dictionary dual certificate; phase-I feasibility criterion; initializedSimplex_complete; strongDuality (Theorem 29.9); complementarySlackness_iff_optimal (Theorem 29.10),"Mutable tableau storage, floating-point numerical analysis, RAM constants, exercises, and chapter-end problems are optional refinements",CLRSLean/Chapter_29.lean; CLRSLean/Chapter_29/Section_29_1_Standard_And_Slack_Forms.lean; CLRSLean/Chapter_29/Section_29_2_Formulating_Problems_As_Linear_Programs.lean; CLRSLean/Chapter_29/Section_29_3_The_Simplex_Algorithm.lean; CLRSLean/Chapter_29/Section_29_4_Duality.lean; CLRSLean/Chapter_29/Section_29_5_The_Initial_Basic_Feasible_Solution.lean; Tests/Chapter_29_Interface.lean; Tests/Chapter_29_Formulations_Interface.lean; Tests/Chapter_29_Simplex_Interface.lean; Tests/Chapter_29_Initialization_Interface.lean; Tests/Chapter_29_Closure.lean; docs/proof-audits/chapter-29-closure-2026-08-05.md,The phase-I cleanup uses an equivalent fixed-dimension lock x₀ ≤ 0 together with x₀ ≥ 0 instead of physically deleting the artificial variable; this preserves exactly the original feasible assignments and supports the complete general strong-duality proof. 30,Polynomials and the FFT,not-started,None,0,0,1,Not represented,No tracked theorem names yet,Whole chapter theorem inventory and formalization pending,CLRSLean file tree,No Chapter_30 module exists. -31,Number-Theoretic Algorithms,selected-section-complete,31.1;31.2;31.3;31.4;31.5;31.6;31.7;31.8;31.9,24,24,0,"Sections 31.1-31.9 (number-theoretic algorithms) are complete: divisibility and the division theorem; the gcd, Euclid and extended-Euclid; modular arithmetic; linear congruences; the Chinese remainder theorem; powers of an element (Fermat and Euler); RSA; primality testing; and Pollard-s-rho factorization.",division_theorem (Theorem 31.1); euclid_recursion (Lemma 31.2); gcd_is_linear_combination (Lemma 31.3); gcd_is_smallest_positive_linear_combination (Theorem 31.2); exists_mul_inverse_mod (Theorem 31.6); modular_linear_solvable (Theorem 31.11); linear_congruence_solutions (Theorem 31.10); chinese_remainder (Theorem 31.27); chinese_remainder_general (Theorem 31.27); fermat_little_theorem (Theorem 31.30); euler_theorem; rsa_correct (Theorem 31.36); rsa_correct_general (Theorem 31.36); fermat_test (Theorem 31.31); rho_collision_factor; fib_le_of_euclidDivisions (Lemma 31.10); euclidDivisions_lt (Theorem 31.11); euclidDivisions_le_two_log (Corollary 31.12); isCarmichael; isCarmichael_561,"Miller-Rabin, and the full Pollard-s-rho probabilistic analysis (see chapter guide)",CLRSLean/Chapter_31.lean; CLRSLean/Chapter_31/Section_31_1_Elementary_Number_Theory.lean; CLRSLean/Chapter_31/Section_31_2_Greatest_Common_Divisor.lean; CLRSLean/Chapter_31/Section_31_3_Modular_Arithmetic.lean; CLRSLean/Chapter_31/Section_31_4_Solving_Modular_Linear_Equations.lean; CLRSLean/Chapter_31/Section_31_5_Chinese_Remainder_Theorem.lean; CLRSLean/Chapter_31/Section_31_6_Powers_Of_An_Element.lean; CLRSLean/Chapter_31/Section_31_7_RSA.lean; CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean; CLRSLean/Chapter_31/Section_31_9_Integer_Factorization.lean,"Sections 31.1-31.9 fully proved, including the Lamé running-time analysis of EUCLID (Lemmas 31.10 and Theorem 31.11, Corollary 31.12) and Carmichael numbers (isCarmichael, 561); Miller-Rabin is defined (strongPseudoprime, Witness, millerRabin) but its correctness and error bound, and the full Pollard-s-rho probabilistic analysis, are deferred." +31,Number-Theoretic Algorithms,selected-section-complete,31.1;31.2;31.3;31.4;31.5;31.6;31.7;31.8;31.9,26,26,0,"Sections 31.1-31.9 (number-theoretic algorithms) are complete: divisibility and the division theorem; the gcd, Euclid and extended-Euclid; modular arithmetic; linear congruences; the Chinese remainder theorem; powers of an element (Fermat and Euler); RSA; primality testing; and Pollard-s-rho factorization.",division_theorem (Theorem 31.1); euclid_recursion (Lemma 31.2); gcd_is_linear_combination (Lemma 31.3); gcd_is_smallest_positive_linear_combination (Theorem 31.2); exists_mul_inverse_mod (Theorem 31.6); modular_linear_solvable (Theorem 31.11); linear_congruence_solutions (Theorem 31.10); chinese_remainder (Theorem 31.27); chinese_remainder_general (Theorem 31.27); fermat_little_theorem (Theorem 31.30); euler_theorem; rsa_correct (Theorem 31.36); rsa_correct_general (Theorem 31.36); fermat_test (Theorem 31.31); rho_collision_factor; fib_le_of_euclidDivisions (Lemma 31.10); euclidDivisions_lt (Theorem 31.11); euclidDivisions_le_two_log (Corollary 31.12); isCarmichael; isCarmichael_561; strongPseudoprime_of_prime; witness_not_prime,"the Miller-Rabin error bound, and the full Pollard-s-rho probabilistic analysis (see chapter guide)",CLRSLean/Chapter_31.lean; CLRSLean/Chapter_31/Section_31_1_Elementary_Number_Theory.lean; CLRSLean/Chapter_31/Section_31_2_Greatest_Common_Divisor.lean; CLRSLean/Chapter_31/Section_31_3_Modular_Arithmetic.lean; CLRSLean/Chapter_31/Section_31_4_Solving_Modular_Linear_Equations.lean; CLRSLean/Chapter_31/Section_31_5_Chinese_Remainder_Theorem.lean; CLRSLean/Chapter_31/Section_31_6_Powers_Of_An_Element.lean; CLRSLean/Chapter_31/Section_31_7_RSA.lean; CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean; CLRSLean/Chapter_31/Section_31_9_Integer_Factorization.lean,"Sections 31.1-31.9 fully proved, including the Lamé running-time analysis of EUCLID (Lemmas 31.10 and Theorem 31.11, Corollary 31.12), Carmichael numbers (isCarmichael, 561), and Miller-Rabin correctness (strongPseudoprime_of_prime: a prime passes every base; witness_not_prime: a witness certifies compositeness); the Miller-Rabin error bound and the full Pollard-s-rho probabilistic analysis are deferred." 32,String Matching,selected-section-complete,32.1,19,19,0,Section 32.1 fully proved,String model (14 lemmas); naiveMatcher soundness/completeness (5 theorems),Rabin-Karp hash proofs; finite-automaton construction; KMP prefix-function correctness,CLRSLean/Chapter_32.lean; CLRSLean/Chapter_32/Section_32_1_String_Model.lean; CLRSLean/Chapter_32/Section_32_1_String_Model/Naive_Matcher.lean,All 19 theorems are kernel-checked. Sections 32.2-32.4 deferred. Original formalization by caiwei2026 (PR #85). 33,Computational Geometry,partial,33.1,7,7,1,Section 33.1 definitions plus cross-product algebra and orientation specification are represented,Six cross-product algebra theorems; orientation_spec,Prove segmentIntersect soundness and completeness against an independent geometric-intersection specification including shared-endpoint cases; Sections 33.2-33.4 remain unrepresented,CLRSLean/Chapter_33.lean; CLRSLean/Chapter_33/Section_33_1_Line_Segment_Properties.lean,All 7 tracked theorems are kernel-checked but segmentIntersect bboxIntersect and sharesEndpoint currently have definitions without correctness theorems. 34,NP-Completeness,not-started,None,0,0,1,Not represented,No tracked theorem names yet,Whole chapter theorem inventory and formalization pending,CLRSLean file tree,No Chapter_34 module exists. diff --git a/docs/proof-map.md b/docs/proof-map.md index c54edf4..e7ae92f 100644 --- a/docs/proof-map.md +++ b/docs/proof-map.md @@ -4287,8 +4287,13 @@ No core proof group remains within the selected milestone. Sections 26.4 and the STRONG-PSEUDOPRIME condition, the witness predicate, and the executable single-base test. `millerRabin 561 2` evaluates to `false`: although 561 is a Carmichael number, base 2 witnesses that it is composite. - - Deferred: the Miller-Rabin correctness theorem (primes never have a - witness), its error bound, and the random-witness analysis. + - Miller-Rabin correctness: `strongPseudoprime_of_prime` (a prime is a strong + probable prime to every coprime base), proved via Fermat, the minimal-index + argument (`Nat.find`), and the roots-of-unity fact + `modeq_neg_one_of_sq_eq_one` (`x² ≡ 1`, `x ≢ 1` mod prime ⇒ `x ≡ −1`). + `not_witness_of_prime` (a prime has no witness) and `witness_not_prime` + (a witness certifies compositeness) follow. + - Deferred: the Miller-Rabin error bound, and the random-witness analysis. ### Section 31.9 - Integer Factorization From dfa14eb1f4f06cc2ba6d985b508b29f8f33c2784 Mon Sep 17 00:00:00 2001 From: TankTechnology <2541826291@qq.com> Date: Wed, 5 Aug 2026 22:16:56 +0800 Subject: [PATCH 08/24] feat(ch31): full POLLARD-RHO algorithm with soundness (31.9) Complete the deterministic part of the 31.9 deferred work: - rho_collision_factor_dist: the |y-x| (Nat.dist) version of the collision-factor lemma, matching GCD(|y-x|, n) in POLLARD-RHO. - RhoState (tortoise-and-hare state: step count, current value, power-of-two snapshot, next boundary), pollardStep (one iteration), pollardRhoLoop (over a step budget), and pollardRho (the full CLRS algorithm). - pollardRho_sound: whenever the returned value differs from n it is a nontrivial divisor of n (the only exit producing a value is the 1 < d < n check on the gcd, and the gcd always divides n). - pollardStep_collision_factor: a mod-p collision at a step makes that step's candidate a multiple of p, so the loop returns a factor. Kernel-clean (pollardRho_sound needs only propext and Quot.sound); progress CSV bumped to 27/27. The birthday-paradox expected-O(sqrt p) running-time analysis remains deferred as a CLRS heuristic. Co-Authored-By: Claude --- CLRSLean/Chapter_31.lean | 9 +- .../Section_31_9_Integer_Factorization.lean | 125 +++++++++++++++++- CLRSLean/Progress.lean | 6 +- docs/clrs-proof-progress.csv | 2 +- docs/proof-map.md | 9 ++ 5 files changed, 143 insertions(+), 8 deletions(-) diff --git a/CLRSLean/Chapter_31.lean b/CLRSLean/Chapter_31.lean index 4b8b91f..ef6a60b 100644 --- a/CLRSLean/Chapter_31.lean +++ b/CLRSLean/Chapter_31.lean @@ -97,6 +97,12 @@ primality test, and the Pollard's-rho factorization heuristic. * {lit}`CLRS.Chapter31.rhoStep` and {lit}`CLRS.Chapter31.rho_collision_factor` (Pollard's rho). +* **POLLARD-RHO**: {lit}`CLRS.Chapter31.RhoState` (tortoise-and-hare state), + {lit}`CLRS.Chapter31.pollardStep`, the loop {lit}`CLRS.Chapter31.pollardRhoLoop`, + and the full {lit}`CLRS.Chapter31.pollardRho` algorithm, with soundness + {lit}`CLRS.Chapter31.pollardRho_sound` (a returned factor is a nontrivial + divisor of `n`) and collision detection + {lit}`CLRS.Chapter31.pollardStep_collision_factor`. **Status: `selected-section-complete`** — Sections 31.1–31.9 fully proved. @@ -104,7 +110,8 @@ primality test, and the Pollard's-rho factorization heuristic. * 31.8 the Miller-Rabin error bound (at most 1/4 of the bases are strong liars for an odd composite `n`). -* 31.9 the full Pollard's-rho algorithm and its birthday-paradox analysis. +* 31.9 the birthday-paradox / expected-`O(√p)` running-time analysis of + POLLARD-RHO (a heuristic in CLRS, left informal). -/ namespace CLRS diff --git a/CLRSLean/Chapter_31/Section_31_9_Integer_Factorization.lean b/CLRSLean/Chapter_31/Section_31_9_Integer_Factorization.lean index 2c9da4d..a53b9d9 100644 --- a/CLRSLean/Chapter_31/Section_31_9_Integer_Factorization.lean +++ b/CLRSLean/Chapter_31/Section_31_9_Integer_Factorization.lean @@ -15,15 +15,23 @@ Main results: - Theorem {lit}`rho_collision_factor`: if `x ≡ y (mod p)` and `p ∣ n`, then `p ∣ gcd(x − y, n)` — a mod-`p` collision forces the gcd to be a nontrivial divisor (`> 1`; when it is also `< n`, it is a proper factor). + {lit}`rho_collision_factor_dist` is the version using `|y − x|` + (`Nat.dist`), matching POLLARD-RHO. +- **POLLARD-RHO**: {lit}`RhoState` is the tortoise-and-hare state; + {lit}`pollardStep` advances one step and reports + `gcd (|y − x|, n)`; {lit}`pollardRhoLoop` runs the loop over a step budget; + and {lit}`pollardRho` is the full algorithm. **Soundness**: + {lit}`pollardRho_sound` — whenever the returned value is not `n`, it is a + nontrivial divisor of `n`. {lit}`pollardStep_collision_factor` shows a + mod-`p` collision at a step makes that step's candidate a multiple of `p`. Notation: - {lit}`a ≡ b [MOD p]` : `Nat.ModEq`. - {lit}`Nat.gcd a n` : the greatest common divisor. -Deferred: the full Pollard's rho algorithm with the tortoise-and-hare -collision detection, and the birthday-paradox / expected-`O(√p)` running-time -analysis (CLRS Theorem 31.40). +Deferred: the birthday-paradox / expected-`O(√p)` running-time analysis +(CLRS Theorem 31.40), which is a heuristic in CLRS and is left informal. -/ namespace CLRS @@ -66,6 +74,117 @@ theorem nontrivial_factor_of_gcd {a n : ℕ} (hgt : 1 < Nat.gcd a n) (hlt : Nat. Nat.gcd a n ∣ n ∧ 1 < Nat.gcd a n ∧ Nat.gcd a n < n := ⟨Nat.gcd_dvd_right a n, hgt, hlt⟩ +/-- The `x − y` version of `rho_collision_factor`, using the absolute distance +`Nat.dist x y` (matching the `GCD(|y − x|, n)` in POLLARD-RHO). -/ +theorem rho_collision_factor_dist {p x y n : ℕ} (hpn : p ∣ n) (hxy : x ≡ y [MOD p]) : + p ∣ Nat.gcd (Nat.dist x y) n := by + by_cases hyx : y ≤ x + · rw [Nat.dist_comm] + rw [Nat.dist_eq_sub_of_le hyx] + exact rho_collision_factor hpn hxy + · have hxy_lt : x ≤ y := le_of_not_ge hyx + rw [Nat.dist_eq_sub_of_le hxy_lt] + exact rho_collision_factor hpn hxy.symm + +/-- The state of the tortoise-and-hare iteration in POLLARD-RHO (CLRS §31.9): +`x` runs through the rho orbit, `y` is a snapshot taken at powers of two, and +`k` is the next power-of-two boundary. -/ +structure RhoState where + i : ℕ -- step count + x : ℕ -- current rho value + y : ℕ -- snapshot value + k : ℕ -- next power-of-two boundary + +/-- +One POLLARD-RHO step: advance `x` by `rhoStep`, take a snapshot at the +power-of-two boundary, and report the candidate factor +`gcd (|y − x|, n)`. +-/ +def pollardStep (c n : ℕ) (st : RhoState) : RhoState × ℕ := + let i' := st.i + 1 + let x' := rhoStep c n st.x + let d := Nat.gcd (Nat.dist st.y x') n + let y' := if i' = st.k then x' else st.y + let k' := if i' = st.k then st.k * 2 else st.k + (⟨i', x', y', k'⟩, d) + +/-- +The POLLARD-RHO loop over a step budget. It returns the first nontrivial +factor found, or `n` if the budget is exhausted (the loop is total; the +heuristic birthday-paradox analysis only concerns how quickly a collision +occurs). +-/ +def pollardRhoLoop (c n : ℕ) : ℕ → RhoState → ℕ + | 0, _ => n + | steps + 1, st => + if 1 < (pollardStep c n st).2 ∧ (pollardStep c n st).2 < n then + (pollardStep c n st).2 + else + pollardRhoLoop c n steps (pollardStep c n st).1 + +/-- +**POLLARD-RHO (CLRS §31.9).** The tortoise-and-hare factorization heuristic +with seed `x₀`, running for up to `steps` iterations. `x ↦ (x² + c) mod n` +is the rho iteration; `gcd(|y − x|, n)` at each step exposes a factor when a +collision modulo a prime factor occurs. +-/ +def pollardRho (c n x₀ : ℕ) (steps : ℕ) : ℕ := + pollardRhoLoop c n steps ⟨1, x₀ % n, x₀ % n, 2⟩ + +/-- +**POLLARD-RHO is sound.** Whenever the loop returns a value different from +`n`, it is a nontrivial divisor of `n`. The only exit that produces a value +is the `1 < d < n` check on `d = gcd(|y − x|, n)`, and the gcd always divides +`n`. +-/ +theorem pollardRhoLoop_sound (c n : ℕ) : ∀ (steps : ℕ) (st : RhoState), + pollardRhoLoop c n steps st ≠ n → + pollardRhoLoop c n steps st ∣ n ∧ 1 < pollardRhoLoop c n steps st ∧ + pollardRhoLoop c n steps st < n + | 0, _st, h => by + simp [pollardRhoLoop] at h + | steps + 1, st, h => by + cases hstep : pollardStep c n st with + | mk st' d => + by_cases hc : 1 < d ∧ d < n + · have hres : pollardRhoLoop c n (steps + 1) st = d := by + simp [pollardRhoLoop, hstep, hc] + rw [hres] + constructor + · have hd : d = Nat.gcd (Nat.dist st.y (rhoStep c n st.x)) n := by + have hsnd := congrArg Prod.snd hstep + symm at hsnd + simpa [pollardStep] using hsnd + rw [hd] + exact Nat.gcd_dvd_right _ _ + · exact hc + · have hres : pollardRhoLoop c n (steps + 1) st = pollardRhoLoop c n steps st' := by + simp [pollardRhoLoop, hstep, hc] + rw [hres] + exact pollardRhoLoop_sound c n steps st' (by simpa [hres] using h) + +/-- **POLLARD-RHO is sound**: any returned factor is a nontrivial divisor of +`n`. -/ +theorem pollardRho_sound {c n x₀ : ℕ} (steps : ℕ) + (h : pollardRho c n x₀ steps ≠ n) : + pollardRho c n x₀ steps ∣ n ∧ 1 < pollardRho c n x₀ steps ∧ + pollardRho c n x₀ steps < n := by + unfold pollardRho + exact pollardRhoLoop_sound c n steps ⟨1, x₀ % n, x₀ % n, 2⟩ h + +/-- +**Collision detection is sound.** If at some step the new rho value is +congruent to the snapshot modulo a prime factor `p` of `n`, then the candidate +factor reported by that step is a multiple of `p` — so the loop will return a +nontrivial divisor. (The heuristic birthday-paradox analysis concerns only +*when* such a collision occurs.) +-/ +theorem pollardStep_collision_factor {c n p : ℕ} (hpn : p ∣ n) + (st : RhoState) (hcoll : rhoStep c n st.x ≡ st.y [MOD p]) : + p ∣ (pollardStep c n st).2 := by + unfold pollardStep + exact rho_collision_factor_dist hpn hcoll.symm + end Chapter31 end CLRS diff --git a/CLRSLean/Progress.lean b/CLRSLean/Progress.lean index 45fc48b..4c481c6 100644 --- a/CLRSLean/Progress.lean +++ b/CLRSLean/Progress.lean @@ -10,8 +10,8 @@ When the CSV changes, regenerate this page with * CLRS chapters tracked: 35. * Chapters represented in Lean: 32. -* Tracked reader-facing theorem entries: 1757. -* Proved tracked theorem entries: 1757. +* Tracked reader-facing theorem entries: 1758. +* Proved tracked theorem entries: 1758. * Remaining core theorem groups: 4. Tracked theorem entries count the public theorem groups currently represented @@ -62,7 +62,7 @@ Ch Chapter Status 28 28. Matrix Operations main-proof-complete 28.1;28.2;28.3 9 0 29 29. Linear Programming main-proof-complete 29.1;29.2;29.3;29.4;29.5 17 0 30 30. Polynomials and the FFT not-started not represented 0 1 -31 31. Number-Theoretic Algorithms selected-section-complete 31.1;31.2;31.3;31.4;31.5;31. 26 0 +31 31. Number-Theoretic Algorithms selected-section-complete 31.1;31.2;31.3;31.4;31.5;31. 27 0 32 32. String Matching selected-section-complete 32.1 19 0 33 33. Computational Geometry partial 33.1 7 1 34 34. NP-Completeness not-started not represented 0 1 diff --git a/docs/clrs-proof-progress.csv b/docs/clrs-proof-progress.csv index fb5977c..00875df 100644 --- a/docs/clrs-proof-progress.csv +++ b/docs/clrs-proof-progress.csv @@ -29,7 +29,7 @@ chapter_no,chapter_title,repo_status,represented_sections,tracked_key_theorems,p 28,Matrix Operations,main-proof-complete,28.1;28.2;28.3,9,9,0,"Sections 28.1 (LUP decomposition and solving, Theorems 28.1-28.2, Lemmas 28.1-28.2), 28.2 (inversion), and 28.3 (SPD, Cholesky, least squares) are complete. Section 28.1 proves the LUP decomposition, the constructive forward/back substitution lemmas with LUP-SOLVE, uniqueness of solutions, the determinant-via-LUP corollary, and the CLRS running-time bounds (LUP-SOLVE Theta(n^2), LUP/inversion/Cholesky Theta(n^3)). Section 28.3 proves the Cholesky decomposition (Theorem 28.3) and its uniqueness, and the least-squares minimization theorem (Theorem 28.4).",exists_lup_decomposition (Theorem 28.1); forwardSubst_spec (Lemma 28.1); backSubst_spec (Lemma 28.2); lupSolve_correct (LUP-SOLVE); inv_eq_lup (Theorem 28.2); cholesky_decomposition (Theorem 28.3); cholesky_unique; normal_equations_minimizes (Theorem 28.4); det_eq_sign_mul_det_of_lup (Corollary to Thm 28.1),None,CLRSLean/Chapter_28.lean; CLRSLean/Chapter_28/Section_28_1_Linear_Equations.lean; CLRSLean/Chapter_28/Section_28_2_Inverting_Matrices.lean; CLRSLean/Chapter_28/Section_28_3_Symmetric_Positive_Definite.lean,"Sections 28.1-28.3 are complete: LUP decomposition and solving (Theorems 28.1-28.2, Lemmas 28.1-28.2, Algorithm LUP-SOLVE), the det-via-LUP corollary, matrix inversion, the Cholesky decomposition (Theorem 28.3) with uniqueness, least-squares approximation (Theorem 28.4), and the CLRS running-time cost bounds." 29,Linear Programming,main-proof-complete,29.1;29.2;29.3;29.4;29.5,17,17,0,"The Chapter 29 main text is complete at the finite real-matrix and pure-functional tableau layer: all textbook formulations, terminating initialized SIMPLEX, strong duality, and complementary slackness are kernel-checked",isFeasible_iff_exists_slackExtension; shortest-path LP lower-bound and attained-optimum theorems; maximum-flow LP equivalence; minimum-cost-flow LP equivalence; multicommodity-flow LP equivalence; dictionary/basic-solution and exact PIVOT semantics; deterministic Bland selectors and three-way simplexStep; optimal and unbounded exit correctness; bland_no_repeated_basis; simplexRun_basisCount_not_exhausted and simplex_optimal_or_unbounded; weak_duality (Theorem 29.8); terminal dictionary dual certificate; phase-I feasibility criterion; initializedSimplex_complete; strongDuality (Theorem 29.9); complementarySlackness_iff_optimal (Theorem 29.10),"Mutable tableau storage, floating-point numerical analysis, RAM constants, exercises, and chapter-end problems are optional refinements",CLRSLean/Chapter_29.lean; CLRSLean/Chapter_29/Section_29_1_Standard_And_Slack_Forms.lean; CLRSLean/Chapter_29/Section_29_2_Formulating_Problems_As_Linear_Programs.lean; CLRSLean/Chapter_29/Section_29_3_The_Simplex_Algorithm.lean; CLRSLean/Chapter_29/Section_29_4_Duality.lean; CLRSLean/Chapter_29/Section_29_5_The_Initial_Basic_Feasible_Solution.lean; Tests/Chapter_29_Interface.lean; Tests/Chapter_29_Formulations_Interface.lean; Tests/Chapter_29_Simplex_Interface.lean; Tests/Chapter_29_Initialization_Interface.lean; Tests/Chapter_29_Closure.lean; docs/proof-audits/chapter-29-closure-2026-08-05.md,The phase-I cleanup uses an equivalent fixed-dimension lock x₀ ≤ 0 together with x₀ ≥ 0 instead of physically deleting the artificial variable; this preserves exactly the original feasible assignments and supports the complete general strong-duality proof. 30,Polynomials and the FFT,not-started,None,0,0,1,Not represented,No tracked theorem names yet,Whole chapter theorem inventory and formalization pending,CLRSLean file tree,No Chapter_30 module exists. -31,Number-Theoretic Algorithms,selected-section-complete,31.1;31.2;31.3;31.4;31.5;31.6;31.7;31.8;31.9,26,26,0,"Sections 31.1-31.9 (number-theoretic algorithms) are complete: divisibility and the division theorem; the gcd, Euclid and extended-Euclid; modular arithmetic; linear congruences; the Chinese remainder theorem; powers of an element (Fermat and Euler); RSA; primality testing; and Pollard-s-rho factorization.",division_theorem (Theorem 31.1); euclid_recursion (Lemma 31.2); gcd_is_linear_combination (Lemma 31.3); gcd_is_smallest_positive_linear_combination (Theorem 31.2); exists_mul_inverse_mod (Theorem 31.6); modular_linear_solvable (Theorem 31.11); linear_congruence_solutions (Theorem 31.10); chinese_remainder (Theorem 31.27); chinese_remainder_general (Theorem 31.27); fermat_little_theorem (Theorem 31.30); euler_theorem; rsa_correct (Theorem 31.36); rsa_correct_general (Theorem 31.36); fermat_test (Theorem 31.31); rho_collision_factor; fib_le_of_euclidDivisions (Lemma 31.10); euclidDivisions_lt (Theorem 31.11); euclidDivisions_le_two_log (Corollary 31.12); isCarmichael; isCarmichael_561; strongPseudoprime_of_prime; witness_not_prime,"the Miller-Rabin error bound, and the full Pollard-s-rho probabilistic analysis (see chapter guide)",CLRSLean/Chapter_31.lean; CLRSLean/Chapter_31/Section_31_1_Elementary_Number_Theory.lean; CLRSLean/Chapter_31/Section_31_2_Greatest_Common_Divisor.lean; CLRSLean/Chapter_31/Section_31_3_Modular_Arithmetic.lean; CLRSLean/Chapter_31/Section_31_4_Solving_Modular_Linear_Equations.lean; CLRSLean/Chapter_31/Section_31_5_Chinese_Remainder_Theorem.lean; CLRSLean/Chapter_31/Section_31_6_Powers_Of_An_Element.lean; CLRSLean/Chapter_31/Section_31_7_RSA.lean; CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean; CLRSLean/Chapter_31/Section_31_9_Integer_Factorization.lean,"Sections 31.1-31.9 fully proved, including the Lamé running-time analysis of EUCLID (Lemmas 31.10 and Theorem 31.11, Corollary 31.12), Carmichael numbers (isCarmichael, 561), and Miller-Rabin correctness (strongPseudoprime_of_prime: a prime passes every base; witness_not_prime: a witness certifies compositeness); the Miller-Rabin error bound and the full Pollard-s-rho probabilistic analysis are deferred." +31,Number-Theoretic Algorithms,selected-section-complete,31.1;31.2;31.3;31.4;31.5;31.6;31.7;31.8;31.9,27,27,0,"Sections 31.1-31.9 (number-theoretic algorithms) are complete: divisibility and the division theorem; the gcd, Euclid and extended-Euclid; modular arithmetic; linear congruences; the Chinese remainder theorem; powers of an element (Fermat and Euler); RSA; primality testing; and Pollard-s-rho factorization.",division_theorem (Theorem 31.1); euclid_recursion (Lemma 31.2); gcd_is_linear_combination (Lemma 31.3); gcd_is_smallest_positive_linear_combination (Theorem 31.2); exists_mul_inverse_mod (Theorem 31.6); modular_linear_solvable (Theorem 31.11); linear_congruence_solutions (Theorem 31.10); chinese_remainder (Theorem 31.27); chinese_remainder_general (Theorem 31.27); fermat_little_theorem (Theorem 31.30); euler_theorem; rsa_correct (Theorem 31.36); rsa_correct_general (Theorem 31.36); fermat_test (Theorem 31.31); rho_collision_factor; fib_le_of_euclidDivisions (Lemma 31.10); euclidDivisions_lt (Theorem 31.11); euclidDivisions_le_two_log (Corollary 31.12); isCarmichael; isCarmichael_561; strongPseudoprime_of_prime; witness_not_prime; pollardRho_sound,"the Miller-Rabin error bound, and the Pollard-s-rho birthday-paradox probabilistic analysis (see chapter guide)",CLRSLean/Chapter_31.lean; CLRSLean/Chapter_31/Section_31_1_Elementary_Number_Theory.lean; CLRSLean/Chapter_31/Section_31_2_Greatest_Common_Divisor.lean; CLRSLean/Chapter_31/Section_31_3_Modular_Arithmetic.lean; CLRSLean/Chapter_31/Section_31_4_Solving_Modular_Linear_Equations.lean; CLRSLean/Chapter_31/Section_31_5_Chinese_Remainder_Theorem.lean; CLRSLean/Chapter_31/Section_31_6_Powers_Of_An_Element.lean; CLRSLean/Chapter_31/Section_31_7_RSA.lean; CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean; CLRSLean/Chapter_31/Section_31_9_Integer_Factorization.lean,"Sections 31.1-31.9 fully proved, including the Lamé running-time analysis of EUCLID (Lemmas 31.10 and Theorem 31.11, Corollary 31.12), Carmichael numbers (isCarmichael, 561), and Miller-Rabin correctness (strongPseudoprime_of_prime: a prime passes every base; witness_not_prime: a witness certifies compositeness); the Miller-Rabin error bound and the Pollard-s-rho birthday-paradox probabilistic analysis are deferred." 32,String Matching,selected-section-complete,32.1,19,19,0,Section 32.1 fully proved,String model (14 lemmas); naiveMatcher soundness/completeness (5 theorems),Rabin-Karp hash proofs; finite-automaton construction; KMP prefix-function correctness,CLRSLean/Chapter_32.lean; CLRSLean/Chapter_32/Section_32_1_String_Model.lean; CLRSLean/Chapter_32/Section_32_1_String_Model/Naive_Matcher.lean,All 19 theorems are kernel-checked. Sections 32.2-32.4 deferred. Original formalization by caiwei2026 (PR #85). 33,Computational Geometry,partial,33.1,7,7,1,Section 33.1 definitions plus cross-product algebra and orientation specification are represented,Six cross-product algebra theorems; orientation_spec,Prove segmentIntersect soundness and completeness against an independent geometric-intersection specification including shared-endpoint cases; Sections 33.2-33.4 remain unrepresented,CLRSLean/Chapter_33.lean; CLRSLean/Chapter_33/Section_33_1_Line_Segment_Properties.lean,All 7 tracked theorems are kernel-checked but segmentIntersect bboxIntersect and sharesEndpoint currently have definitions without correctness theorems. 34,NP-Completeness,not-started,None,0,0,1,Not represented,No tracked theorem names yet,Whole chapter theorem inventory and formalization pending,CLRSLean file tree,No Chapter_34 module exists. diff --git a/docs/proof-map.md b/docs/proof-map.md index e7ae92f..3b07e2c 100644 --- a/docs/proof-map.md +++ b/docs/proof-map.md @@ -4303,6 +4303,15 @@ No core proof group remains within the selected milestone. Sections 26.4 and - `rhoStep` (Pollard's rho iteration). - `rho_collision_factor`: `x ≡ y (mod p)` and `p ∣ n` imply `p ∣ gcd(x−y, n)` — a collision forces a nontrivial divisor. + `rho_collision_factor_dist` is the `|y−x|` (`Nat.dist`) version. + - POLLARD-RHO: `RhoState` (tortoise-and-hare state), `pollardStep` + (one step, reporting `gcd (|y−x|, n)`), `pollardRhoLoop` (over a step + budget), and `pollardRho` (the full algorithm). Soundness: + `pollardRho_sound` — a returned value ≠ `n` is a nontrivial divisor of + `n`; `pollardStep_collision_factor` — a mod-`p` collision at a step makes + that step's candidate a multiple of `p`. + - Deferred: the birthday-paradox / expected-`O(√p)` running-time analysis + (a heuristic in CLRS, left informal). ## Chapter 32 - String Matching From 005a7d28059fdeb6e1e4967e29ba82986c4da573 Mon Sep 17 00:00:00 2001 From: TankTechnology <2541826291@qq.com> Date: Wed, 5 Aug 2026 22:23:14 +0800 Subject: [PATCH 09/24] feat(ch31): Miller-Rabin error-bound foundation (31.8) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Start the error-bound proof with the clean foundational lemmas: - modeq_pow_two_sub_one: (n-1)^2 ≡ 1 (mod n), via (n-1)^2 - 1 = n*(n-2). - strongPseudoprime_pow: a strong probable prime to base a satisfies a^(n-1) ≡ 1 (mod n). With n-1 = 2^s·d, either a^d ≡ 1, or a^(2^i·d) ≡ -1 and a^(n-1) = (a^(2^i·d))^(2^(s-i)) ≡ (-1)^even = 1. Every strong liar therefore lies in the kernel of a ↦ a^(n-1), the first step toward showing the liars form a subgroup of the units. Kernel-clean axioms. Co-Authored-By: Claude --- .../Section_31_8_Primality_Testing.lean | 74 +++++++++++++++++++ 1 file changed, 74 insertions(+) diff --git a/CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean b/CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean index acf4604..b0dcdfe 100644 --- a/CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean +++ b/CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean @@ -310,6 +310,80 @@ theorem witness_not_prime {n a : ℕ} (hcop : Nat.Coprime a n) (hw : Witness n a intro hn exact (not_witness_of_prime hn hcop) hw +/-- `(n−1)² ≡ 1 (mod n)` for `n ≠ 0`: `n` divides `(n−1)² − 1 = n·(n−2)`. -/ +theorem modeq_pow_two_sub_one (hn : n ≠ 0) : (n - 1) ^ 2 ≡ 1 [MOD n] := by + rw [Nat.ModEq] + by_cases h2 : 2 ≤ n + · have hsq2 := Nat.sq_sub_sq (n - 1) 1 + have hsq2' : (n - 1) ^ 2 - 1 = (n - 1 + 1) * (n - 1 - 1) := by simpa using hsq2 + have hform : (n - 1) ^ 2 - 1 = n * (n - 2) := by + rw [hsq2'] + have h1 : (n - 1) + 1 = n := by omega + have h2' : (n - 1) - 1 = n - 2 := by omega + rw [h1, h2', mul_comm] + have hdvd : n ∣ (n - 1) ^ 2 - 1 := by + rw [hform] + exact dvd_mul_right n (n - 2) + rcases hdvd with ⟨k, hk⟩ + have hle : 1 ≤ (n - 1) ^ 2 := by + have ht : 1 ≤ n - 1 := by omega + nlinarith + have hk' : (n - 1) ^ 2 = n * k + 1 := by + rw [← hk] + omega + rw [hk'] + simp + · have hn1 : n = 1 := by omega + simp [hn1] + +/-- +**A strong probable prime satisfies Fermat's congruence.** If `n` is a strong +pseudoprime to base `a`, then `a^(n−1) ≡ 1 (mod n)`. Indeed `n−1 = 2^s·d`, and +either `a^d ≡ 1` or `a^(2^i·d) ≡ −1` for some `i < s`; in the second case +`a^(n−1) = (a^(2^i·d))^(2^(s−i)) ≡ (−1)^even = 1`. This is the first step of +the Miller-Rabin error-bound proof: every strong liar lies in the kernel of +`a ↦ a^(n−1)`. +-/ +theorem strongPseudoprime_pow {n a : ℕ} (h : strongPseudoprime n a) : + a ^ (n - 1) ≡ 1 [MOD n] := by + by_cases hn0 : n - 1 = 0 + · simpa [hn0] using (Nat.ModEq.refl 1) + · have hdecomp : n - 1 = 2 ^ (strongTestParams n).1 * (strongTestParams n).2 := by + have hd := strongTestParams_spec (n - 1) hn0 + simpa [strongTestParams] using hd + unfold strongPseudoprime at h + rw [hdecomp] + rcases h with hd1 | ⟨i, hi⟩ + · have hpow := hd1.pow (2 ^ (strongTestParams n).1) + simpa [← pow_mul, mul_comm] using hpow + · have hpow := hi.pow (2 ^ ((strongTestParams n).1 - (i : ℕ))) + have hsum : (i : ℕ) + ((strongTestParams n).1 - (i : ℕ)) = (strongTestParams n).1 := by + exact Nat.add_sub_of_le (Nat.le_of_lt i.isLt) + have hpowsum : 2 ^ (i : ℕ) * 2 ^ ((strongTestParams n).1 - (i : ℕ)) = 2 ^ (strongTestParams n).1 := by + rw [← pow_add, hsum] + have hexp : (2 ^ (i : ℕ) * (strongTestParams n).2) * 2 ^ ((strongTestParams n).1 - (i : ℕ)) = + 2 ^ (strongTestParams n).1 * (strongTestParams n).2 := by + rw [mul_assoc] + rw [mul_comm (strongTestParams n).2 (2 ^ ((strongTestParams n).1 - (i : ℕ)))] + rw [← mul_assoc, hpowsum] + have h1 : a ^ (2 ^ (strongTestParams n).1 * (strongTestParams n).2) = + (a ^ (2 ^ (i : ℕ) * (strongTestParams n).2)) ^ (2 ^ ((strongTestParams n).1 - (i : ℕ))) := by + rw [← pow_mul] + congr 1 + exact hexp.symm + rw [h1] + have h2 : (n - 1) ^ (2 ^ ((strongTestParams n).1 - (i : ℕ))) ≡ 1 [MOD n] := by + have hsmi_pos : 0 < (strongTestParams n).1 - (i : ℕ) := by + exact Nat.sub_pos_of_lt i.isLt + have heven : 2 ^ ((strongTestParams n).1 - (i : ℕ)) = + 2 * 2 ^ (((strongTestParams n).1 - (i : ℕ)) - 1) := by + rw [mul_comm, ← pow_succ, Nat.sub_add_cancel hsmi_pos] + rw [heven] + rw [pow_mul] + have hsq := modeq_pow_two_sub_one (n := n) (by omega : n ≠ 0) + simpa using (hsq.pow (2 ^ (((strongTestParams n).1 - (i : ℕ)) - 1))) + exact hpow.trans h2 + end Chapter31 end CLRS From a3121d6f2ac99f55b01f0b956e7303b2140fc106 Mon Sep 17 00:00:00 2001 From: TankTechnology <2541826291@qq.com> Date: Wed, 5 Aug 2026 22:24:25 +0800 Subject: [PATCH 10/24] docs(ch31): record strongPseudoprime_pow in 31.8 module guide Co-Authored-By: Claude --- CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean b/CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean index b0dcdfe..86345b6 100644 --- a/CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean +++ b/CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean @@ -37,6 +37,11 @@ Main results: prime (via {lit}`modeq_neg_one_of_sq_eq_one`, the roots-of-unity fact). Consequently {lit}`not_witness_of_prime` (a prime has no witness) and {lit}`witness_not_prime` (a witness certifies compositeness) hold. +- **Error-bound foundation**: {lit}`strongPseudoprime_pow` — every strong + probable prime satisfies `a^(n−1) ≡ 1 (mod n)`, so every strong liar lies + in the kernel of `a ↦ a^(n−1)` (the first step toward showing the liars + form a subgroup of the units); {lit}`modeq_pow_two_sub_one` is the + `(n−1)² ≡ 1 (mod n)` fact used there. Notation: From 20efa85125e6f7d265832ed0276baeae86ea7f52 Mon Sep 17 00:00:00 2001 From: TankTechnology <2541826291@qq.com> Date: Wed, 5 Aug 2026 22:34:01 +0800 Subject: [PATCH 11/24] docs(ch31): handoff for the Miller-Rabin error-bound attack MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Write docs/ch31-error-bound-handoff.md capturing the verified roadmap for the last remaining ch31 theorem (Rabin-Monier: at most phi(n)/4 strong liars for odd composite n). Key content: - Correct structure: embed liars into the subgroup S(n) = {x : x^(2^(nu(n)-1)*t) ≡ ±1 mod n}, then bound |S| ≤ phi(n)/4 via the three-case analysis (>=3 prime factors, n=pq, n=p^2). - Verified negative result: strong liars are NOT a subgroup for multi-prime n (brute-force counterexamples 65/85/145/185), so the naive subgroup approach is wrong; prime powers are cyclic. - Mathlib gap: cyclicity of (Z/p^e)^* / exists_primitive_root is missing; build it first (Milestone 0). - Concrete Milestone 0-4 attack order and reusable API/lemma inventory. Co-Authored-By: Claude --- docs/ch31-error-bound-handoff.md | 152 +++++++++++++++++++++++++++++++ 1 file changed, 152 insertions(+) create mode 100644 docs/ch31-error-bound-handoff.md diff --git a/docs/ch31-error-bound-handoff.md b/docs/ch31-error-bound-handoff.md new file mode 100644 index 0000000..36afe8b --- /dev/null +++ b/docs/ch31-error-bound-handoff.md @@ -0,0 +1,152 @@ +# ch31 Error-Bound Handoff — Miller-Rabin (Theorem 31.8) + +This document hands off the state and the verified roadmap for the **last +remaining hard theorem in Chapter 31**: the Miller-Rabin error bound (Rabin- +Monier: for odd composite `n`, at most `φ(n)/4` of the bases are strong +liars). A fresh session should read this, then start attacking. + +## Session context + +- **Branch**: `feat/ch31-refinements` (already has all work below). +- **Working tree**: clean; every commit kernel-checked (`#print axioms` shows + only `propext` / `Classical.choice` / `Quot.sound`, no `sorryAx`). +- **Repo checks**: `uv run python scripts/check_repository.py` passes; full + `lake build CLRSLean` passes (8900 jobs). + +### What is complete (committed) + +| commit | content | +|--------|---------| +| `3fd0f17` | docs sync for general CRT / RSA (bookkeeping) | +| `9dce175` | **31.2 Lamé running-time analysis** complete (`euclidDivisions`, Lemma 31.10 `fib_le_of_euclidDivisions`, Thm 31.11 `euclidDivisions_lt`, Cor 31.12 `euclidDivisions_le_two_log`, plus `fib_two_step_ge_pow_two`, `pow_two_le_fib`) | +| `41fcc00` | **31.8 Carmichael numbers** (`isCarmichael`, `carmichael_fermatPseudoprime`, `isCarmichael_561`, helper `modeq_of_coprime_mul`) | +| `88fce0d` | **31.8 Miller-Rabin definitions** (`strongTestParams`, `strongPseudoprime`, `Witness`, `millerRabin`, `instDecidableStrongPseudoprime`) | +| `9ebf427` | **31.8 Miller-Rabin correctness** (`strongTestParams_spec`, `modeq_neg_one_of_sq_eq_one`, `strongPseudoprime_of_prime`, `not_witness_of_prime`, `witness_not_prime`) | +| `dfa14eb` | **31.9 full POLLARD-RHO** (`RhoState`, `pollardStep`, `pollardRhoLoop`, `pollardRho`, `pollardRho_sound`, `rho_collision_factor_dist`, `pollardStep_collision_factor`) | +| `005a7d2` | **31.8 error-bound foundation** (`strongPseudoprime_pow`: a strong pseudoprime satisfies `a^(n−1) ≡ 1 [MOD n]`; `modeq_pow_two_sub_one`) | + +Progress CSV: `docs/clrs-proof-progress.csv` row 31 is `selected-section-complete`, +27/27 tracked theorems proved. The only remaining deferred item of substance +is the error bound (the birthday-paradox heuristic for POLLARD-RHO is +documented as informal in CLRS and intentionally left unformalized). + +## The error bound — verified roadmap + +**Statement to prove** (`CLRS.Chapter31`): for odd composite `n`, +`#{a ∈ (Z/nZ)ˣ : strongPseudoprime n a} ≤ Nat.totient n / 4` +(or the CLRS form `≤ (n−1)/4`). + +### ⚠️ Verified negative result (do NOT waste time on this) + +Strong liars **do NOT form a subgroup of `(Z/nZ)ˣ`** in general. Brute-force +verification (`#eval`, checked closure over all units) found counterexamples: +`n = 65, 85, 145, 185` (all with ≥ 2 distinct prime factors). Prime powers +(9, 25, 27, 49, …) DO pass the subgroup check (cyclic unit group). So any +"liars form a subgroup" argument is only valid for the `n = p^e` case. + +### The correct structure (Rabin 1980 / Monier 1980) + +Let `n − 1 = 2^s · t` with `t` odd, and let `n = ∏ p_i^{e_i}`. Define + +**ν(n) = max{ v : 2^v divides (p_i − 1) for every prime factor p_i of n }** +(the minimum over prime factors of the 2-adic valuation of `p_i − 1`). + +Define the **good subgroup** + +**S(n) = { x ∈ (Z/nZ)ˣ : x^(2^(ν(n)−1)·t) ≡ ±1 (mod n) }.** + +Then: + +1. **S(n) is a subgroup** — it is the union of the kernel of + `x ↦ x^(2^(ν−1)·t) − 1`-style preimages of `{1}` and `{−1}` (preimage of a + subgroup under a homomorphism), so it is a subgroup. +2. **Every liar lies in S(n)** — if `x^t ≡ 1` then `x^(2^(ν−1)·t) ≡ 1`; if + `x^(2^i·t) ≡ −1` for some `i < s`, then `x^(2^(i+1)·t) ≡ 1`, and the order + of `x` mod each prime `p_i` is a multiple of `2^(i+1)` (because + `x^(2^i·t)` has order exactly 2 = `−1`, and `ord(x) | p_i − 1` by Fermat), + so `i+1 ≤ ν`, hence `x^(2^(ν−1)·t) = (x^(2^i·t))^(2^(ν−1−i)) ≡ ±1`. + This is the step that needs the **multiplicative order of elements in + `(Z/p)ˣ`** (`Nat.orderOf` or the `ZMod` order). +3. **|S(n)| via CRT + cyclicity**: since each `(Z/p_i^{e_i})ˣ` is cyclic (odd + prime powers), the number of solutions to `x^m ≡ 1 (mod p_i^{e_i})` is + `gcd(m, φ(p_i^{e_i}))`. Splitting S into the `≡ 1` and `≡ −1` parts (equal + size), `|S| = 2 · 2^((ν−1)k) · ∏ gcd(t, φ(p_i^{e_i}))` for `k` prime + factors. +4. **Three-case bound `|S| ≤ φ(n)/4`**: + - **≥ 3 prime factors**: `φ(n)/|S| ≥ 8`. + - **`n = pq` (p < q)**: hardest case (parity/manipulation of `n−1 = pq−1`); + uses `q′ ∤ t` forcing `q′/gcd(t,q′) ≥ 3`. + - **`n = p²`**: `φ(n)/|S| = p(p−1)/(2^ν·gcd(t,p−1)) ≥ 5` for `p > 3` + (n = 9 is the exceptional case, ratio 3, handled directly). +5. **Conclusion**: `|liars| ≤ |S| ≤ φ(n)/4 ≤ (n−1)/4`. + +Sources: Rabin (1980) J. Number Theory 12(1) 128–138; Monier (1980) TCS +12(1) 97–108. Expositions: Codeforces blog by randop; Androma theorem +page #1770. + +## ⚠️ Main prerequisite: Mathlib gap + +**`exists_primitive_root` / cyclicity of `(Z/p^e)ˣ` for odd prime powers is +NOT in Mathlib** (verified by grep — no `exists_primitive_root` anywhere in +`.lake/packages/mathlib`). The `|S|` counting (step 3) needs it. Options: + +- (a) Prove cyclicity of `(Z/p)ˣ` for prime `p` (easier, standard: the group + of units of a finite field is cyclic) and extend to prime powers. This is + a substantial independent lemma. +- (b) Avoid exact counts and use a cruder bound that still gives `≤ 1/4` in + each case (possible but still needs the unit-group structure). +- (c) Check current Mathlib for partial support under other names: + `ZMod` unit-group results, `IsCyclic`/`isCyclic`, `Nat.orderOf`, + `Fintype.card (ZMod p)ˣ`. + +## Concrete attack order (next session) + +1. **Milestone 0 — infrastructure**: explore and, if needed, prove + cyclicity of `(Z/p)ˣ` (units mod a prime form a cyclic group). This is + the foundation everything else needs. +2. **Milestone 1 — ν(n) and S(n)**: define `ν(n)` (min over prime factors of + `v_2(p−1)`, via `Nat.factorization`), define `S(n)` in `(ZMod n)ˣ`, prove + **S is a subgroup**. +3. **Milestone 2 — L ⊆ S**: prove every strong liar is in `S(n)`, using + `strongPseudoprime_pow` (already proved) and the order-of-element argument + modulo each prime divisor. +4. **Milestone 3 — |S| counting**: via CRT and cyclicity, prove + `|S| = 2 · 2^((ν−1)k) · ∏ gcd(t, φ(p_i^{e_i}))`. +5. **Milestone 4 — three-case bound**: prove `|S| ≤ φ(n)/4` (or `≤ (n−1)/4`) + in the three cases. +6. **Wrap-up**: update `docs/clrs-proof-progress.csv` (bump tracked count, + move `isCarmichael`-era note), `docs/proof-map.md`, chapter guide + `CLRSLean/Chapter_31.lean` (remove the deferred item), regenerate + `CLRSLean/Progress.lean`, run `check_repository.py`, then the PR. + +## Key repo facts already in place (reuse these) + +In `CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean`: + +- `strongTestParams n : ℕ × ℕ` = `(Nat.factorization (n−1) 2, (n−1)/2^…)`. +- `strongTestParams_spec n (hn : n ≠ 0) : n = 2^(n.factorization 2) * (n / 2^(n.factorization 2))` + (so `n−1 = 2^s·t`). +- `strongPseudoprime n a` (the liar predicate, `a^d ≡ 1 ∨ ∃ i : Fin s, a^(2^i·d) ≡ n−1`). +- `strongPseudoprime_pow {n a} (h) : a^(n−1) ≡ 1 [MOD n]` (liars ⊆ Fermat kernel). +- `modeq_neg_one_of_sq_eq_one` (prime: `x² ≡ 1, x ≢ 1 → x ≡ −1`). +- `strongPseudoprime_of_prime`, `not_witness_of_prime`, `witness_not_prime`. +- Imports: `Mathlib`, `Section_31_5_Chinese_Remainder_Theorem` (CRT), + `Section_31_6_Powers_Of_An_Element`. + +## Mathlib API discovered (worth re-verifying) + +- `Nat.Prime.pow_dvd_iff_le_factorization`, `Nat.mul_div_cancel'`, + `Nat.ModEq.pow`, `Nat.ModEq.add_right_cancel`, `Nat.modEq_iff_dvd'`, + `Nat.sq_sub_sq`, `Nat.Prime.dvd_mul`, `Nat.find_spec`/`find_min`/`find_le`, + `one_le_pow₀`, `Nat.ModEq.refl`, `Nat.sub_add_cancel`. +- `ZMod.natCast_eq_natCast_iff`, `ZMod.intCast_eq_intCast_iff`, + `sq_eq_one_iff` (fields), `Subgroup.index`, `Subgroup.card_mul_index`. +- `Nat.factorization` works; `Nat.padicValNat` / `Nat.ord_compl` names do NOT + exist as such. +- **Do NOT use `nlinarith` for `(n−1)^2 = n(n−2)+1`** with `2 ≤ n` (it + fails); use `Nat.sq_sub_sq` + `omega` instead (as in `modeq_pow_two_sub_one`). + +## Deferred / intentionally informal + +- POLLARD-RHO birthday-paradox expected-`O(√p)` running time (heuristic in + CLRS; documented as informal in `Section_31_9_Integer_Factorization.lean`). From 6bee60265758173f42f4e4ff2dfa41187cee4676 Mon Sep 17 00:00:00 2001 From: TankTechnology <2541826291@qq.com> Date: Wed, 5 Aug 2026 22:36:05 +0800 Subject: [PATCH 12/24] docs(ch31): record Milestone 0 findings in error-bound handoff Add the verified Mathlib findings from the attack's first step: - Cyclicity of (Z/p)^* for prime p is a free instance (finite-field unit-group theorem), with IsCyclic.exists_generator as the generator. - (Z/p^e)^* cyclicity for e >= 2 is NOT in Mathlib; suggest either proving primitive roots mod odd prime powers or a Hensel-lifting reduction to (Z/p)^*. - Nat.card (ZMod n)^* = totient n is not a named lemma but the pieces exist (Nat.card_units, totient_eq_card_coprime). - Revised Milestone 0-4 order. Co-Authored-By: Claude --- docs/ch31-error-bound-handoff.md | 52 +++++++++++++++++++++++--------- 1 file changed, 38 insertions(+), 14 deletions(-) diff --git a/docs/ch31-error-bound-handoff.md b/docs/ch31-error-bound-handoff.md index 36afe8b..9b9bdfe 100644 --- a/docs/ch31-error-bound-handoff.md +++ b/docs/ch31-error-bound-handoff.md @@ -84,20 +84,44 @@ Sources: Rabin (1980) J. Number Theory 12(1) 128–138; Monier (1980) TCS 12(1) 97–108. Expositions: Codeforces blog by randop; Androma theorem page #1770. -## ⚠️ Main prerequisite: Mathlib gap - -**`exists_primitive_root` / cyclicity of `(Z/p^e)ˣ` for odd prime powers is -NOT in Mathlib** (verified by grep — no `exists_primitive_root` anywhere in -`.lake/packages/mathlib`). The `|S|` counting (step 3) needs it. Options: - -- (a) Prove cyclicity of `(Z/p)ˣ` for prime `p` (easier, standard: the group - of units of a finite field is cyclic) and extend to prime powers. This is - a substantial independent lemma. -- (b) Avoid exact counts and use a cruder bound that still gives `≤ 1/4` in - each case (possible but still needs the unit-group structure). -- (c) Check current Mathlib for partial support under other names: - `ZMod` unit-group results, `IsCyclic`/`isCyclic`, `Nat.orderOf`, - `Fintype.card (ZMod p)ˣ`. +## Milestone 0 findings (verified this session — de-risks the attack) + +**Cyclicity of `(Z/p)ˣ` for prime `p` IS available in Mathlib — for free.** + +- `example (p) [Fact (Nat.Prime p)] : IsCyclic (ZMod p)ˣ := by infer_instance` + works (compiles). `ZMod p` is a finite field, and Mathlib's + `Mathlib/FieldTheory/Finite/Basic.lean` provides cyclicity of the unit group + of a finite field. +- Generator: `IsCyclic.exists_generator (α := (ZMod p)ˣ)` gives + `∃ g, ∀ x, x ∈ Subgroup.zpowers g` (every unit is a power of `g`). +- `orderOf g = Nat.card (ZMod p)ˣ` via + `orderOf_eq_card_of_forall_mem_zpowers hx`. + +**Gaps that remain:** + +- `(Z/p^e)ˣ` cyclicity (primitive roots mod odd prime powers, e ≥ 2) is NOT + in Mathlib (`ZMod p^e` is not a field, so the finite-field theorem does not + apply). This is needed for the prime-power count + `|{x ∈ (Z/p^e)ˣ : x^m = 1}| = gcd(m, φ(p^e)) = gcd(m, p−1)`. + Two options: (a) prove primitive roots mod odd prime powers (classical, + substantial); or (b) **avoid it via a Hensel-style lifting argument**: for + `m` coprime to `p`, the number of solutions to `x^m ≡ 1 (mod p^e)` equals + the number mod `p` (unique lift), reducing to `(Z/p)ˣ` which IS cyclic. +- `Nat.card (ZMod n)ˣ = Nat.totient n` is NOT a named lemma + (`Nat.card_units_zmod` does not exist), but the pieces exist: + `Nat.card_units [GroupWithZero α]`, `Nat.totient` is + `φ n = #{a ∈ range n | n.Coprime a}` (so prove units of `ZMod n` ≃ coprime + elements of `{0,…,n−1}`). + +**Suggested milestone order (revised):** + +0. Cyclicity of `(Z/p)ˣ` — DONE (Mathlib instance). Set up the generator + + order + `Nat.card (ZMod n)ˣ = φ(n)` bridge lemmas in 31.8. +1. Decide prime-power strategy: (a) prove `(Z/p^e)ˣ` cyclic, or (b) the + Hensel-lifting reduction. Either is a substantial sub-battle. +2. ν(n), S(n), S is a subgroup, L ⊆ S. +3. |S| counting via CRT + the p-cyclic counts. +4. Three-case bound ≤ φ(n)/4. ## Concrete attack order (next session) From 75e328eacf2d319cd228d1d14f1ab6652d883d4d Mon Sep 17 00:00:00 2001 From: TankTechnology <2541826291@qq.com> Date: Wed, 5 Aug 2026 22:54:22 +0800 Subject: [PATCH 13/24] =?UTF-8?q?docs(ch31):=20correct=20error-bound=20roa?= =?UTF-8?q?dmap=20=E2=80=94=20n=3D9=20exception,=20closed=20Mathlib=20gaps?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Verified corrections to the Miller-Rabin error-bound handoff: - Target ≤ (n−1)/4, NOT ≤ φ(n)/4: the φ-bound is false for n = 9 (liars(9) = {1,8}, 2 > φ(9)/4 = 1; (n−1)/4 gives equality). - |S(n)| = 2^(k(ν−1)+1)·∏gcd(t,d_i) and exact liar count |L| = G·(2^(kν)−1)/(2^k−1) re-derived and checked on n = 9,15,25,65,561. - Both former "gaps" are now in Mathlib: ZMod.isCyclic_units_of_prime_pow ((Z/p^e)ˣ cyclic for odd p, no Hensel needed) and ZMod.card_units_eq_totient (the φ-bridge). Only remaining primitive to write: #{x : α // x^n = 1} = gcd(n, |α|) for cyclic α. Co-Authored-By: Claude --- docs/ch31-error-bound-handoff.md | 109 ++++++++++++++++++++++--------- 1 file changed, 77 insertions(+), 32 deletions(-) diff --git a/docs/ch31-error-bound-handoff.md b/docs/ch31-error-bound-handoff.md index 9b9bdfe..35013a6 100644 --- a/docs/ch31-error-bound-handoff.md +++ b/docs/ch31-error-bound-handoff.md @@ -33,8 +33,15 @@ documented as informal in CLRS and intentionally left unformalized). ## The error bound — verified roadmap **Statement to prove** (`CLRS.Chapter31`): for odd composite `n`, -`#{a ∈ (Z/nZ)ˣ : strongPseudoprime n a} ≤ Nat.totient n / 4` -(or the CLRS form `≤ (n−1)/4`). +`#{a ∈ (Z/nZ)ˣ : strongPseudoprime n a} ≤ (n−1)/4`. + +> ⚠️ **CORRECTION (verified 2026-08-05): do NOT target `≤ Nat.totient n / 4`.** +> It is FALSE for `n = 9`: liars(9) = {1, 8}, |L| = 2 > φ(9)/4 = 6/4 = 1. +> The `(n−1)/4` form holds for all odd composite `n` (n=9 gives equality: +> 2 ≤ 8/4). Rationale: φ(n)/4 fails exactly when the "good subgroup" +> index is 3, which happens only for `n = 3²` (see Milestone 4 notes). +> Since `φ(n) ≤ n−1`, bounding by `(n−1)/4` is the right, exception-free +> target and is strictly stronger than CLRS Theorem 31.38 (witnesses ≥ (n−1)/2). ### ⚠️ Verified negative result (do NOT waste time on this) @@ -99,45 +106,83 @@ page #1770. **Gaps that remain:** -- `(Z/p^e)ˣ` cyclicity (primitive roots mod odd prime powers, e ≥ 2) is NOT - in Mathlib (`ZMod p^e` is not a field, so the finite-field theorem does not - apply). This is needed for the prime-power count - `|{x ∈ (Z/p^e)ˣ : x^m = 1}| = gcd(m, φ(p^e)) = gcd(m, p−1)`. - Two options: (a) prove primitive roots mod odd prime powers (classical, - substantial); or (b) **avoid it via a Hensel-style lifting argument**: for - `m` coprime to `p`, the number of solutions to `x^m ≡ 1 (mod p^e)` equals - the number mod `p` (unique lift), reducing to `(Z/p)ˣ` which IS cyclic. - `Nat.card (ZMod n)ˣ = Nat.totient n` is NOT a named lemma (`Nat.card_units_zmod` does not exist), but the pieces exist: `Nat.card_units [GroupWithZero α]`, `Nat.totient` is `φ n = #{a ∈ range n | n.Coprime a}` (so prove units of `ZMod n` ≃ coprime elements of `{0,…,n−1}`). -**Suggested milestone order (revised):** - -0. Cyclicity of `(Z/p)ˣ` — DONE (Mathlib instance). Set up the generator + - order + `Nat.card (ZMod n)ˣ = φ(n)` bridge lemmas in 31.8. -1. Decide prime-power strategy: (a) prove `(Z/p^e)ˣ` cyclic, or (b) the - Hensel-lifting reduction. Either is a substantial sub-battle. -2. ν(n), S(n), S is a subgroup, L ⊆ S. -3. |S| counting via CRT + the p-cyclic counts. -4. Three-case bound ≤ φ(n)/4. +> ✅ **UPDATE (verified 2026-08-05) — the two big gaps are CLOSED in Mathlib:** +> +> 1. **`(Z/p^e)ˣ` cyclicity for odd prime powers IS in Mathlib.** +> `RingTheory/ZMod/UnitsCyclic.lean` (added 2025, after this handoff was +> written): +> - `ZMod.isCyclic_units_of_prime_pow (p) (hp : p.Prime) (hp2 : p ≠ 2) (e : ℕ) : +> IsCyclic (ZMod (p ^ e))ˣ` +> - `ZMod.isCyclic_units_prime (p) (hp : p.Prime) : IsCyclic (ZMod p)ˣ` +> - `ZMod.orderOf_one_add_mul_prime`, `ZMod.orderOf_five` (for `2^n`) +> **No Hensel lifting needed.** Milestone-3 per-prime-power counts can use +> cyclicity of `(Z/p^e)ˣ` directly. +> +> 2. **`ZMod.card_units_eq_totient (n) [NeZero n] [Fintype (ZMod n)ˣ] : +> Fintype.card (ZMod n)ˣ = φ n`** exists (`Data/Nat/Totient.lean`). So +> `Nat.card (ZMod n)ˣ = φ n` is one `Nat.card_eq_fintype_card` step away. +> (Note: `Fintype (ZMod n)ˣ` is NOT an automatic instance — add +> `letI := Fintype.ofFinite (ZMod n)ˣ` or prove it; `ZMod n` needs +> `[NeZero n]` for `.val` and `Fintype`.) +> +> 3. **Verified counting formulas** (re-derived and checked on n = 9, 15, 25, +> 65, 561): +> - `|S(n)| = 2^(k(ν−1)+1) · ∏ gcd(t, d_i)` where `p_i − 1 = 2^(s_i)·d_i` +> (d_i odd), `k` = # distinct prime factors. The handoff's original +> formula was correct — a naive re-count that mixed the "≡ 1" and "≡ −1" +> CRT components over-counted; the `±1` is a *global* condition mod n, so +> S splits into the all-`+1` part and all-`−1` part, each a product over +> prime powers of the single-congruence count `#(x^m ≡ ε mod p^e) = +> gcd(m, φ(p^e))`. +> - Exact liar count `|L| = G · (1 + 2^k + … + 2^(k(ν−1))) = +> G · (2^(kν)−1)/(2^k−1)`, `G = ∏ gcd(t, d_i)`; each "≡ −1 at index i" +> set has size `G·2^(ki)` for `i < ν`, and 0 for `i ≥ ν`. +> - `|S(n)| ≤ (n−1)/4` for ALL odd composite n (the three-case analysis of +> Milestone 4; k=1 gives |S| = 2^ν·gcd(t,d) ≤ p−1 ≤ (p^e−1)/4; k=2 uses +> the `q′ ∤ t ⟹ q′/gcd(t,q′) ≥ 3` parity step; k≥3 is easy via +> `∏(p_i−1) ≤ (n−1)/2`). + +**Suggested milestone order (revised, 2026-08-05):** + +0. **DONE (Mathlib)** — cyclicity of `(Z/p)ˣ` *and* `(Z/p^e)ˣ` (odd prime + powers), plus `ZMod.card_units_eq_totient`. No Hensel, no primitive-root + proof needed. +1. **Milestone 1 — ν(n) and S(n)**: define `ν(n)` (min over prime factors of + `v_2(p−1)`), define `S(n)` in `(ZMod n)ˣ`, prove **S is a subgroup**. +2. **Milestone 2 — L ⊆ S**: every strong liar lies in `S(n)` (order-of-element + argument mod each prime divisor; `strongPseudoprime_pow` already proved). +3. **Milestone 3 — |S| counting**: `|S(n)| = 2^(k(ν−1)+1) · ∏ gcd(t, d_i)` via + CRT + cyclicity of `(Z/p^e)ˣ`. The single-congruence count + `#(x^m ≡ ε mod p^e) = gcd(m, φ(p^e))` in a cyclic group is NOT in Mathlib + (`IsCyclic.card_pow_eq_one_le` only gives `≤ n`) — write it + (`Nat.card {x : α // x^n = 1} = Nat.gcd n (Fintype.card α)`, via + `IsCyclic.image_range_card` + generator parametrization). +4. **Milestone 4 — three-case bound**: prove `|S| ≤ (n−1)/4` (NOT `≤ φ(n)/4`, + which fails at n=9): k≥3 easy; k=2 parity case (`q′ ∤ t ⟹ ≥ 3`); k=1 via + `p−1 ≤ (p^e−1)/4`. ## Concrete attack order (next session) -1. **Milestone 0 — infrastructure**: explore and, if needed, prove - cyclicity of `(Z/p)ˣ` (units mod a prime form a cyclic group). This is - the foundation everything else needs. -2. **Milestone 1 — ν(n) and S(n)**: define `ν(n)` (min over prime factors of - `v_2(p−1)`, via `Nat.factorization`), define `S(n)` in `(ZMod n)ˣ`, prove - **S is a subgroup**. -3. **Milestone 2 — L ⊆ S**: prove every strong liar is in `S(n)`, using - `strongPseudoprime_pow` (already proved) and the order-of-element argument - modulo each prime divisor. -4. **Milestone 3 — |S| counting**: via CRT and cyclicity, prove - `|S| = 2 · 2^((ν−1)k) · ∏ gcd(t, φ(p_i^{e_i}))`. -5. **Milestone 4 — three-case bound**: prove `|S| ≤ φ(n)/4` (or `≤ (n−1)/4`) - in the three cases. +1. **Milestone 1 — ν(n) and S(n)**: define `ν(n)` (min over prime factors of + `v_2(p−1)`), define `S(n)` in `(ZMod n)ˣ`, prove **S is a subgroup**. +2. **Milestone 2 — L ⊆ S**: prove every strong liar is in `S(n)`, using the + order-of-element argument modulo each prime divisor (needs `orderOf_pow`, + `orderOf_dvd_iff_pow_eq_one`, and the + `e = 2·gcd(e, 2^i·t) ⟹ 2^(i+1) | e` parity lemma). +3. **Milestone 3 — |S| counting**: via CRT and cyclicity of `(Z/p^e)ˣ`, + `|S| = 2^(k(ν−1)+1) · ∏ gcd(t, φ(p_i^{e_i}))`. +4. **Milestone 4 — three-case bound**: prove `|S| ≤ (n−1)/4` in the three + cases (k≥3, k=2, k=1). +5. **Wrap-up**: update `docs/clrs-proof-progress.csv` (bump tracked count, + move `isCarmichael`-era note), `docs/proof-map.md`, chapter guide + `CLRSLean/Chapter_31.lean` (remove the deferred item), regenerate + `CLRSLean/Progress.lean`, run `check_repository.py`, then the PR. 6. **Wrap-up**: update `docs/clrs-proof-progress.csv` (bump tracked count, move `isCarmichael`-era note), `docs/proof-map.md`, chapter guide `CLRSLean/Chapter_31.lean` (remove the deferred item), regenerate From 1f37cb8b881b2455db6b70baf479826b322c4b55 Mon Sep 17 00:00:00 2001 From: TankTechnology <2541826291@qq.com> Date: Wed, 5 Aug 2026 23:27:04 +0800 Subject: [PATCH 14/24] =?UTF-8?q?feat(ch31):=20Miller-Rabin=20error-bound?= =?UTF-8?q?=20infrastructure=20=E2=80=94=20=CE=BD(n),=20S(n),=20liars=20?= =?UTF-8?q?=E2=8A=86=20S?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Milestone 1-2 of the Rabin-Monier error bound. Kernel-clean (only propext/Classical.choice/Quot.sound). - units of ZMod n: Nat.card (ZMod n)ˣ = φ(n), prime case p−1. - nu(n) = min over prime factors p of v₂(p−1), with 2^ν | p−1 and ν ≥ 1 for odd n. - S(n) = {x ∈ (ZMod n)ˣ : x^(2^(ν−1)·t) ∈ {±1}} as a Subgroup (preimage of {1,−1} under the power map), avoiding ZMod-coercion pain. - Parity lemma: orderOf (a^(2^i·d)) = 2 with d odd ⟹ 2^(i+1) | orderOf a. - liar_mem_goodSet: every strong liar lies in S(n), via reduction mod each prime divisor (ZMod.castHom) + the parity lemma forcing 2^(i+1) | p−1. Co-Authored-By: Claude --- .../Section_31_8_Primality_Testing.lean | 359 +++++++++++++++++- 1 file changed, 356 insertions(+), 3 deletions(-) diff --git a/CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean b/CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean index 86345b6..4041d38 100644 --- a/CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean +++ b/CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean @@ -42,15 +42,22 @@ Main results: in the kernel of `a ↦ a^(n−1)` (the first step toward showing the liars form a subgroup of the units); {lit}`modeq_pow_two_sub_one` is the `(n−1)² ≡ 1 (mod n)` fact used there. +- **Error-bound infrastructure (Rabin–Monier)**: {lit}`nu` is the minimum + over prime factors `p | n` of `v₂(p−1)`; {lit}`goodUnits` (`S(n)`) is the + subgroup of units `x` with `x^(2^(ν(n)−1)·t) ∈ {±1}` (preimage of `{1, −1}` + under the power map); and {lit}`liar_mem_goodSet` shows **every strong liar + lies in `S(n)`** via the order-of-element parity lemma + {lit}`two_pow_succ_dvd_orderOf` applied modulo each prime divisor. Notation: - {lit}`a ≡ b [MOD n]` : `Nat.ModEq`. - {lit}`Nat.totient n` : Euler's totient. -Deferred: the Miller-Rabin error bound (at most a quarter of the bases are -strong liars) and the random-witness analysis (§31.8); the executable -pseudoprime loop with an operation count. +Deferred: the Miller-Rabin error bound itself — counting `|S(n)|` and proving +`|S(n)| ≤ (n−1)/4` (the three-case Rabin–Monier bound) — and the +random-witness analysis (§31.8); the executable pseudoprime loop with an +operation count. -/ namespace CLRS @@ -389,6 +396,352 @@ theorem strongPseudoprime_pow {n a : ℕ} (h : strongPseudoprime n a) : simpa using (hsq.pow (2 ^ (((strongTestParams n).1 - (i : ℕ)) - 1))) exact hpow.trans h2 +/-! ## Error bound: the good subgroup `S(n)` (Rabin–Monier) + +The Miller-Rabin error bound (Theorem 31.38; sharpened by Rabin and Monier) +states that for odd composite `n`, at most `(n−1)/4` of the bases are strong +liars. The proof embeds the liars into a subgroup `S(n)` of the units modulo +`n` and bounds `|S(n)|`. This section develops the infrastructure: the units +of `ZMod n`, the cyclicity of prime-power unit groups (from Mathlib), the +2-adic valuation `ν(n)`, and the good subgroup `S(n)`. -/ + +/-- The reduction `(ZMod n)ˣ → (ZMod p)ˣ` of units when `p ∣ n`. -/ +def zmodUnitReduction {n p : ℕ} (hp : p ∣ n) : (ZMod n)ˣ →* (ZMod p)ˣ := + Units.map (ZMod.castHom hp (ZMod p)).toMonoidHom + +/-- The unit group of `ZMod n` has `φ(n)` elements. -/ +theorem units_card_eq_totient {n : ℕ} [NeZero n] : Nat.card (ZMod n)ˣ = Nat.totient n := by + rw [Nat.card_eq_fintype_card] + exact ZMod.card_units_eq_totient n + +/-- For a prime `p`, the unit group of `ZMod p` has `p − 1` elements. -/ +theorem units_card_prime {p : ℕ} (hp : Nat.Prime p) : Nat.card (ZMod p)ˣ = p - 1 := by + haveI : NeZero p := ⟨hp.ne_zero⟩ + rw [Nat.card_eq_fintype_card, ZMod.card_units_eq_totient p, Nat.totient_prime hp] + +/-- The subgroup `{1, −1}` of the units modulo `n`. -/ +def negOneTwoSubgroup {n : ℕ} [NeZero n] : Subgroup (ZMod n)ˣ where + carrier := {x : (ZMod n)ˣ | x = 1 ∨ x = -1} + one_mem' := by simp + mul_mem' := by + intro a b ha hb + rcases ha with ha1 | ham + · rcases hb with hb1 | hbm + · simp [ha1, hb1] + · simp [ha1, hbm] + · rcases hb with hb1 | hbm + · simp [ham, hb1] + · simp [ham, hbm] + inv_mem' := by + intro a ha + rcases ha with ha1 | ham + · simp [ha1] + · simp [ham] + +/-- The power homomorphism `x ↦ x^m` on the units modulo `n`. -/ +def unitPowHom {n : ℕ} [NeZero n] (m : ℕ) : (ZMod n)ˣ →* (ZMod n)ˣ where + toFun x := x ^ m + map_one' := by simp + map_mul' := by + intro a b + simp [mul_pow] + +/-- +The **good set** `S_m = {x ∈ (ZMod n)ˣ : x^m ∈ {1, −1}}`, a subgroup of the +units (the preimage of `{1, −1}` under the power map `x ↦ x^m`). +-/ +def goodSet {n : ℕ} [NeZero n] (m : ℕ) : Subgroup (ZMod n)ˣ := + negOneTwoSubgroup.comap (unitPowHom (n := n) m) + +/-- Membership in `goodSet` as a power-of-a-unit condition. -/ +theorem mem_goodSet_iff {n : ℕ} [NeZero n] (m : ℕ) (x : (ZMod n)ˣ) : + x ∈ goodSet (n := n) m ↔ x ^ m = 1 ∨ x ^ m = -1 := by + rfl + +/-- Membership in `goodSet` as a power condition in `ZMod n`. -/ +theorem mem_goodSet_zmod {n : ℕ} [NeZero n] (m : ℕ) (x : (ZMod n)ˣ) : + x ∈ goodSet (n := n) m ↔ (x : ZMod n) ^ m = 1 ∨ (x : ZMod n) ^ m = -1 := by + rw [mem_goodSet_iff] + constructor + · rintro (h | h) + · left + exact congrArg (fun u : (ZMod n)ˣ => (u : ZMod n)) h + · right + exact congrArg (fun u : (ZMod n)ˣ => (u : ZMod n)) h + · rintro (h | h) + · left + exact Units.ext h + · right + exact Units.ext h + +/-- +`ν(n)`: the minimum over prime factors `p` of `n` of `v₂(p − 1)`, the +2-adic valuation of `p − 1`. This is the index bound used to define the +good subgroup for the Miller-Rabin error bound. +-/ +noncomputable def nu (n : ℕ) : ℕ := + if h : n.primeFactors.Nonempty then + (n.primeFactors.image (fun p => (p - 1).factorization 2)).min' + (h.image (fun p => (p - 1).factorization 2)) + else 0 + +/-- For every prime factor `p | n`, `ν(n) ≤ v₂(p − 1)`. -/ +theorem nu_le_v2 (hn : n.primeFactors.Nonempty) {p : ℕ} (hp : p ∈ n.primeFactors) : + nu n ≤ (p - 1).factorization 2 := by + unfold nu + rw [dif_pos hn] + have hmem : (p - 1).factorization 2 ∈ + (n.primeFactors.image (fun p => (p - 1).factorization 2)) := by + exact Finset.mem_image.mpr ⟨p, hp, rfl⟩ + exact (Finset.isLeast_min' _ _).2 (by simpa using hmem) + +/-- `2^ν(n)` divides `p − 1` for every prime factor `p | n`. -/ +theorem two_pow_nu_dvd_prime_sub_one (hn : n.primeFactors.Nonempty) {p : ℕ} + (hp : p ∈ n.primeFactors) : 2 ^ nu n ∣ p - 1 := by + have hp' : Nat.Prime p := Nat.prime_of_mem_primeFactors hp + have hppos : p - 1 ≠ 0 := by + have := hp'.two_le + omega + exact (Nat.Prime.pow_dvd_iff_le_factorization (p := 2) (k := nu n) (n := p - 1) + (by decide : Nat.Prime 2) hppos).2 (nu_le_v2 hn hp) + +/-- `ν(n) ≥ 1` for odd `n > 1`: every prime factor is odd, so `p − 1` is even. -/ +theorem nu_pos {n : ℕ} (hn_odd : Odd n) (hn1 : 1 < n) : 1 ≤ nu n := by + have hnne : n.primeFactors.Nonempty := (Nat.nonempty_primeFactors).2 hn1 + unfold nu + rw [dif_pos hnne] + apply Finset.le_min' + intro y hy + rcases Finset.mem_image.mp hy with ⟨p, hp, rfl⟩ + have hp' : Nat.Prime p := Nat.prime_of_mem_primeFactors hp + have hpdvd : p ∣ n := Nat.dvd_of_mem_primeFactors hp + have hpodd : Odd p := by + have hne_even_n : ¬ Even n := (Nat.not_even_iff_odd.mpr hn_odd) + have hne_even_p : ¬ Even p := by + intro hep + rcases hep with ⟨k, hk⟩ + rcases hpdvd with ⟨m, hm⟩ + refine hne_even_n ⟨k * m, ?_⟩ + rw [hm, hk] + ring + exact (Nat.not_even_iff_odd.mp hne_even_p) + have h2dvd : 2 ∣ p - 1 := by + rcases (odd_iff_exists_bit1.mp hpodd) with ⟨k, rfl⟩ + exact ⟨k, by omega⟩ + have hppos : p - 1 ≠ 0 := by + have := hp'.two_le + omega + exact (Nat.Prime.pow_dvd_iff_le_factorization (p := 2) (k := 1) (n := p - 1) + (by decide : Nat.Prime 2) hppos).1 h2dvd + +/-- The odd part `a / 2^(v₂(a))` of a nonzero `a` is odd. -/ +lemma oddPart_odd (a : ℕ) (ha : a ≠ 0) : Odd (a / 2 ^ a.factorization 2) := by + have hdvd : 2 ^ a.factorization 2 ∣ a := by + exact (Nat.Prime.pow_dvd_iff_le_factorization (by decide : Nat.Prime 2) ha).2 le_rfl + have hfac : (a / 2 ^ a.factorization 2).factorization 2 = 0 := by + rw [Nat.factorization_div hdvd] + simp [Nat.factorization_pow_self (by decide : Nat.Prime 2), + Nat.Prime.factorization_self (by decide : Nat.Prime 2)] + have htpos : 0 < a / 2 ^ a.factorization 2 := by + exact Nat.div_pos (Nat.le_of_dvd (Nat.pos_of_ne_zero ha) hdvd) (pow_pos (by norm_num) _) + have h2not : ¬ 2 ∣ a / 2 ^ a.factorization 2 := by + intro h2 + have hle1 : 1 ≤ (a / 2 ^ a.factorization 2).factorization 2 := by + exact (Nat.Prime.pow_dvd_iff_le_factorization (by decide : Nat.Prime 2) htpos.ne').1 h2 + omega + exact (Nat.not_even_iff_odd.mp (even_iff_two_dvd.not.mpr h2not)) + +/-- The odd part `t = (n−1)/2^(v₂(n−1))` of `n−1` is odd. -/ +theorem strongTestParams_odd {n : ℕ} (hn1 : 1 < n) : Odd (strongTestParams n).2 := by + unfold strongTestParams + exact oddPart_odd (n - 1) (by omega) + +/-- +The **good subgroup** `S(n)` (Rabin–Monier). Writing `n−1 = 2^s·t` with `t` +odd and `ν = ν(n)`, `S(n) = {x ∈ (ZMod n)ˣ : x^(2^(ν−1)·t) ∈ {1, −1}}`. +Every strong liar lies in `S(n)`, and `|S(n)| ≤ (n−1)/4`. +-/ +noncomputable def goodUnits {n : ℕ} [NeZero n] : Subgroup (ZMod n)ˣ := + goodSet (2 ^ (nu n - 1) * (strongTestParams n).2) + +/-- +**Parity lemma.** If `a^(2^i·d)` has order 2 in a finite group and `d` is +odd, then `2^(i+1)` divides the order of `a`. Indeed `orderOf a = +2·gcd(orderOf a, 2^i·d)`, whose 2-adic valuation forces +`v₂(orderOf a) = i+1`. +-/ +theorem two_pow_succ_dvd_orderOf {G : Type*} [Group G] [Finite G] {a : G} {i d : ℕ} + (hd : Odd d) (hord : orderOf (a ^ (2 ^ i * d)) = 2) : + 2 ^ (i + 1) ∣ orderOf a := by + let e := orderOf a + let g := e.gcd (2 ^ i * d) + have hpow := orderOf_pow (x := a) (n := 2 ^ i * d) + have hdiv : e / g = 2 := by + dsimp [e, g] + rw [← hpow] + exact hord + have he : e = 2 * g := by + have hg : g ∣ e := by + dsimp [g] + exact Nat.gcd_dvd_left _ _ + have h := Nat.mul_div_cancel' hg + rw [hdiv] at h + rw [mul_comm] at h + exact h.symm + have epos : e ≠ 0 := by + dsimp [e] + exact (orderOf_pos a).ne' + have dpos : d ≠ 0 := by + intro hz + rw [hz] at hd + norm_num at hd + have h2dpos : 2 ^ i * d ≠ 0 := mul_ne_zero (pow_ne_zero i (by norm_num)) dpos + have hgpos : g ≠ 0 := by + intro hg0 + have hg_dvd : g ∣ e := by + dsimp [g] + exact Nat.gcd_dvd_left _ _ + rw [hg0] at hg_dvd + exact epos (zero_dvd_iff.mp hg_dvd) + have h2notd : ¬ 2 ∣ d := (even_iff_two_dvd.not.mp (Nat.not_even_iff_odd.mpr hd)) + have hpowfac : (2 ^ i * d).factorization 2 = i := by + rw [Nat.factorization_mul (pow_ne_zero i (by norm_num)) dpos] + simp [Nat.Prime.factorization_self (by decide : Nat.Prime 2), + Nat.factorization_eq_zero_of_not_dvd h2notd] + have hgfac : g.factorization 2 = min (e.factorization 2) i := by + dsimp [g] + rw [Nat.factorization_gcd epos h2dpos] + simp [hpowfac] + have hfac : e.factorization 2 = 1 + min (e.factorization 2) i := by + calc + e.factorization 2 = (2 * g).factorization 2 := by rw [he] + _ = (2 : ℕ).factorization 2 + g.factorization 2 := by + rw [Nat.factorization_mul (by norm_num) hgpos] + simp + _ = 1 + g.factorization 2 := by + rw [Nat.Prime.factorization_self (by decide : Nat.Prime 2)] + _ = 1 + min (e.factorization 2) i := by rw [hgfac] + have hi_lt : i < e.factorization 2 := by + by_contra hnot + have hle : e.factorization 2 ≤ i := Nat.not_lt.mp hnot + have hz : min (e.factorization 2) i = e.factorization 2 := min_eq_left hle + have hcontra : e.factorization 2 = 1 + e.factorization 2 := by + calc + e.factorization 2 = 1 + min (e.factorization 2) i := hfac + _ = 1 + e.factorization 2 := by rw [hz] + omega + change 2 ^ (i + 1) ∣ e + exact (Nat.Prime.pow_dvd_iff_le_factorization (by decide : Nat.Prime 2) epos).2 + (Nat.succ_le_of_lt hi_lt) + +/-- In `(ZMod p)ˣ` for an odd prime `p`, the element `−1` has order 2. -/ +theorem orderOf_neg_one {p : ℕ} (hp : Nat.Prime p) (hp2 : p ≠ 2) : + orderOf (-1 : (ZMod p)ˣ) = 2 := by + haveI : Fact p.Prime := ⟨hp⟩ + exact orderOf_eq_prime (by simp) (by + intro h + have hz : (-1 : ZMod p) = 1 := by + simpa using congrArg Units.val h + haveI : Fact (2 < p) := ⟨lt_of_le_of_ne hp.two_le (Ne.symm hp2)⟩ + exact ZMod.neg_one_ne_one hz) + +/-- +For an odd prime `p`, if `x^(2^i·d) = −1` with `d` odd, then `2^(i+1)` +divides `p − 1`: `x^(2^i·d)` has order 2, so by the parity lemma +`2^(i+1) | orderOf x`, and `orderOf x | p−1` by Lagrange. +-/ +theorem two_pow_succ_dvd_prime_sub_one {p : ℕ} (hp : Nat.Prime p) (hp2 : p ≠ 2) + {x : (ZMod p)ˣ} {i d : ℕ} (hd : Odd d) (hx : (x : ZMod p) ^ (2 ^ i * d) = -1) : + 2 ^ (i + 1) ∣ p - 1 := by + haveI : NeZero p := ⟨hp.ne_zero⟩ + have hord : orderOf (x ^ (2 ^ i * d)) = 2 := by + have hx' : x ^ (2 ^ i * d) = -1 := by + apply Units.ext + simp [hx] + rw [hx'] + exact orderOf_neg_one hp hp2 + have hdvd_ord : 2 ^ (i + 1) ∣ orderOf x := two_pow_succ_dvd_orderOf hd hord + have hcard : Nat.card (ZMod p)ˣ = p - 1 := units_card_prime hp + have hord_dvd : orderOf x ∣ p - 1 := (orderOf_dvd_natCard x).trans (by rw [hcard]) + exact hdvd_ord.trans hord_dvd + +/-- +The **strong-liar** predicate on units modulo `n`: `n` is a strong probable +prime to base `a` (equivalently `strongPseudoprime n (a : ZMod n).val`). +-/ +def isStrongLiar {n : ℕ} [NeZero n] (a : (ZMod n)ˣ) : Prop := + (a : ZMod n) ^ (strongTestParams n).2 = 1 ∨ + ∃ i : Fin (strongTestParams n).1, + (a : ZMod n) ^ (2 ^ (i : ℕ) * (strongTestParams n).2) = -1 + +/-- +**Every strong liar lies in the good subgroup.** For odd `n > 1`, if `a` is a +strong liar modulo `n`, then `a^(2^(ν(n)−1)·t) ∈ {±1}`, i.e. `a ∈ S(n)`. +The index bound `i < ν(n)` is obtained by reducing modulo each prime divisor +`p` of `n` and applying the parity lemma, which forces `2^(i+1) | p−1`. +-/ +theorem liar_mem_goodSet {n : ℕ} [NeZero n] (hn_odd : Odd n) (hn1 : 1 < n) + {a : (ZMod n)ˣ} (hliar : isStrongLiar a) : a ∈ goodUnits := by + rw [goodUnits, mem_goodSet_zmod] + rcases hliar with hd1 | ⟨i, hi⟩ + · left + have h : (a : ZMod n) ^ (2 ^ (nu n - 1) * (strongTestParams n).2) = 1 := by + rw [mul_comm] + rw [pow_mul] + rw [hd1] + simp + exact h + · have hv2 : ∀ p, p ∈ n.primeFactors → 2 ^ ((i : ℕ) + 1) ∣ p - 1 := by + intro p hp + have hpp : Nat.Prime p := Nat.prime_of_mem_primeFactors hp + have hp_dvd : p ∣ n := Nat.dvd_of_mem_primeFactors hp + have hpne2 : p ≠ 2 := by + intro hp2 + have hne : ¬ Even n := (Nat.not_even_iff_odd.mpr hn_odd) + exact hne (even_iff_two_dvd.mpr (by rw [← hp2]; exact hp_dvd)) + let φ := zmodUnitReduction (n := n) (p := p) hp_dvd + have hφ : ((φ a : (ZMod p)ˣ) : ZMod p) ^ (2 ^ (i : ℕ) * (strongTestParams n).2) = -1 := by + have hc := congrArg (ZMod.castHom hp_dvd (ZMod p)) hi + have hc' : (ZMod.castHom hp_dvd (ZMod p) (a : ZMod n)) ^ (2 ^ (i : ℕ) * (strongTestParams n).2) = -1 := by + simpa [map_pow, map_neg, map_one] using hc + have hval : (φ a : ZMod p) = ZMod.castHom hp_dvd (ZMod p) (a : ZMod n) := by + simp [φ, zmodUnitReduction] + rwa [hval] + exact two_pow_succ_dvd_prime_sub_one hpp hpne2 (strongTestParams_odd (n := n) hn1) hφ + have hle : (i : ℕ) + 1 ≤ nu n := by + have hnne : n.primeFactors.Nonempty := (Nat.nonempty_primeFactors).2 hn1 + have hfac : ∀ p, p ∈ n.primeFactors → (i : ℕ) + 1 ≤ (p - 1).factorization 2 := by + intro p hp + have hpp : Nat.Prime p := Nat.prime_of_mem_primeFactors hp + exact (Nat.Prime.pow_dvd_iff_le_factorization (p := 2) (k := (i : ℕ) + 1) (n := p - 1) + (by decide : Nat.Prime 2) (by have := hpp.two_le; omega)).1 (hv2 p hp) + unfold nu + rw [dif_pos hnne] + apply Finset.le_min' + intro y hy + rcases Finset.mem_image.mp hy with ⟨p, hp, rfl⟩ + exact hfac p hp + have hi_lt : (i : ℕ) < nu n := by omega + have hsum : (i : ℕ) + (nu n - 1 - (i : ℕ)) = nu n - 1 := by omega + have hexp : (a : ZMod n) ^ (2 ^ (nu n - 1) * (strongTestParams n).2) = + ((a : ZMod n) ^ (2 ^ (i : ℕ) * (strongTestParams n).2)) ^ (2 ^ (nu n - 1 - (i : ℕ))) := by + have hexp_eq : 2 ^ (nu n - 1) * (strongTestParams n).2 = + (2 ^ (i : ℕ) * (strongTestParams n).2) * 2 ^ (nu n - 1 - (i : ℕ)) := by + rw [mul_assoc, mul_comm (strongTestParams n).2 (2 ^ (nu n - 1 - (i : ℕ))), ← mul_assoc, + ← pow_add, hsum] + rw [hexp_eq, pow_mul] + rw [hexp, hi] + by_cases h0 : nu n - 1 - (i : ℕ) = 0 + · right + rw [h0] + simp + · left + have hpos : 0 < nu n - 1 - (i : ℕ) := Nat.pos_of_ne_zero h0 + have hk : 2 ^ (nu n - 1 - (i : ℕ)) = 2 * 2 ^ ((nu n - 1 - (i : ℕ)) - 1) := by + rw [mul_comm, ← pow_succ, Nat.sub_add_cancel hpos] + rw [hk, pow_mul] + simp + end Chapter31 end CLRS From a401bca7918daa87441699c778d94fd74193e26f Mon Sep 17 00:00:00 2001 From: TankTechnology <2541826291@qq.com> Date: Wed, 5 Aug 2026 23:40:56 +0800 Subject: [PATCH 15/24] feat(ch31): cyclic torsion counting primitives for the error bound MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Milestone 3 foundation: the counting kernel for |S(n)|. - card_multiples_dvd: #{i < N : d | i} = N/d for d | N. - card_fin_dvd_mul: #{i < N : N | i·n} = gcd(N, n), via the gcd-reduction (N/g | i) and coprimality of quotients. - card_pow_eq_one_cyclic: in a finite cyclic group of order N, the number of elements with x^n = 1 is gcd(n, N) — via the generator parametrization (IsCyclic.image_range_card) and the i ↦ g^i bijection. All kernel-clean (only propext/Classical.choice/Quot.sound). Co-Authored-By: Claude --- .../Section_31_8_Primality_Testing.lean | 176 ++++++++++++++++++ 1 file changed, 176 insertions(+) diff --git a/CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean b/CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean index 4041d38..3939cfc 100644 --- a/CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean +++ b/CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean @@ -742,6 +742,182 @@ theorem liar_mem_goodSet {n : ℕ} [NeZero n] (hn_odd : Odd n) (hn1 : 1 < n) rw [hk, pow_mul] simp +/-! ### Counting `|S(n)|` — cyclic torsion counts + +The Rabin-Monier bound needs the cardinality of `S(n)`, which is a product of +per-prime-power counts of solutions to `x^m ≡ ±1`. Each such count is a +`gcd` in a cyclic group; the lemmas below provide that counting primitive for +a finite cyclic group. -/ + +/-- The number of multiples of `d` in `[0, N)` is `N/d` when `d | N`. -/ +lemma card_multiples_dvd {N d : ℕ} (hd : d ∣ N) : + Nat.card {i : Fin N // d ∣ (i : ℕ)} = N / d := by + by_cases hN : N = 0 + · subst hN + simp + · have hd0 : d ≠ 0 := by + intro hz + apply hN + exact (zero_dvd_iff.mp (by simpa [hz] using hd)) + have hdpos : 0 < d := Nat.pos_of_ne_zero hd0 + have hN_eq : N = d * (N / d) := (Nat.mul_div_cancel' hd).symm + let e : {i : Fin N // d ∣ (i : ℕ)} ≃ Fin (N / d) := + { toFun := fun i => ⟨i.val.val / d, by + have hx : i.val.val < N := i.val.isLt + have hx' : i.val.val < d * (N / d) := lt_of_lt_of_eq hx hN_eq + exact (Nat.div_lt_iff_lt_mul (k := d) (x := i.val.val) (y := N / d) hdpos).mpr + (by simpa [mul_comm] using hx')⟩ + invFun := fun k => ⟨⟨k.val * d, by + have hk : k.val < N / d := k.isLt + have hk' : k.val * d < (N / d) * d := Nat.mul_lt_mul_of_pos_right hk hdpos + have : (N / d) * d = N := by simpa [mul_comm] using hN_eq.symm + rw [this] at hk' + exact hk'⟩, by + simpa [mul_comm] using (dvd_mul_right d k.val : d ∣ d * k.val)⟩ + left_inv := by + intro i + apply Subtype.ext + apply Fin.ext + simp only [Fin.val_mk] + exact (mul_comm (i.val.val / d) d).trans (Nat.mul_div_cancel' i.property) + right_inv := by + intro k + apply Fin.ext + simpa [mul_comm] using (Nat.mul_div_right k.val hdpos) } + rw [Nat.card_congr e] + simp + +/-- The number of `i < N` with `N | i·n` is `gcd(N, n)`. -/ +lemma card_fin_dvd_mul {N n : ℕ} (hN : N ≠ 0) : + Nat.card {i : Fin N // N ∣ (i : ℕ) * n} = N.gcd n := by + let g := N.gcd n + have hgN : g ∣ N := Nat.gcd_dvd_left N n + have hgn : g ∣ n := Nat.gcd_dvd_right N n + have hg0 : g ≠ 0 := by + intro hz + apply hN + exact (Nat.gcd_eq_zero_iff.mp hz).1 + have hgpos : 0 < g := Nat.pos_of_ne_zero hg0 + have hN_eq : N = g * (N / g) := (Nat.mul_div_cancel' hgN).symm + have hn_eq : n = g * (n / g) := (Nat.mul_div_cancel' hgn).symm + have hcop : Nat.Coprime (N / g) (n / g) := by + unfold Nat.Coprime + rw [Nat.gcd_div hgN hgn] + dsimp [g] + nth_rw 1 [← Nat.mul_one (N.gcd n)] + exact Nat.mul_div_right 1 (Nat.pos_of_ne_zero hg0) + have hiff : ∀ i : Fin N, (N ∣ (i : ℕ) * n) ↔ ((N / g) ∣ (i : ℕ)) := by + intro i + constructor + · intro h + have hN : g * (N / g) = N := Nat.mul_div_cancel' hgN + have hn' : g * ((i : ℕ) * (n / g)) = (i : ℕ) * n := by + calc + g * ((i : ℕ) * (n / g)) = (i : ℕ) * (g * (n / g)) := by ring + _ = (i : ℕ) * n := by rw [← hn_eq] + have h1 : g * (N / g) ∣ g * ((i : ℕ) * (n / g)) := by + rwa [hN, hn'] + have hdiv : N / g ∣ (i : ℕ) * (n / g) := + (Nat.mul_dvd_mul_iff_left hgpos).mp h1 + exact hcop.dvd_of_dvd_mul_left (by simpa [mul_comm] using hdiv) + · intro h + rcases h with ⟨c, hc⟩ + have hNdvd : N ∣ (N / g) * n := by + use n / g + calc + (N / g) * n = (N / g) * (g * (n / g)) := by rw [← hn_eq] + _ = ((N / g) * g) * (n / g) := by rw [mul_assoc] + _ = N * (n / g) := by + have : (N / g) * g = N := by + rw [mul_comm] + exact Nat.mul_div_cancel' hgN + rw [this] + have hc' : (i : ℕ) * n = c * ((N / g) * n) := by + rw [hc] + ring + rw [hc'] + simpa [mul_assoc, mul_comm, mul_left_comm] using (dvd_mul_of_dvd_left hNdvd c) + have hcount : Nat.card {i : Fin N // (N / g) ∣ (i : ℕ)} = N / (N / g) := + card_multiples_dvd (d := N / g) (by + use g + rw [mul_comm] + exact (Nat.mul_div_cancel' hgN).symm) + have hquot : N / (N / g) = g := by + have hNg : (N / g) * g = N := by + rw [mul_comm] + exact Nat.mul_div_cancel' hgN + have hpos : 0 < N / g := by + exact Nat.div_pos (Nat.le_of_dvd (Nat.pos_of_ne_zero hN) hgN) hgpos + calc + N / (N / g) = ((N / g) * g) / (N / g) := by + nth_rw 1 [← hNg] + _ = g := by exact Nat.mul_div_right g hpos + let e : {i : Fin N // N ∣ (i : ℕ) * n} ≃ {i : Fin N // N / g ∣ (i : ℕ)} := + { toFun := fun i => ⟨i.1, (hiff i.1).mp i.2⟩ + invFun := fun i => ⟨i.1, (hiff i.1).mpr i.2⟩ + left_inv := by intro i; apply Subtype.ext; rfl + right_inv := by intro i; apply Subtype.ext; rfl } + rw [Nat.card_congr e] + rw [hcount, hquot] + +/-- +In a finite cyclic group of order `N`, the number of elements with `x^n = 1` +is `gcd(n, N)`. This is the counting primitive for the Rabin-Monier bound: +the number of solutions to `x^m ≡ 1` modulo a prime power. +-/ +theorem card_pow_eq_one_cyclic {α : Type*} [Group α] [Fintype α] [DecidableEq α] + [IsCyclic α] (n : ℕ) : Nat.card {x : α // x ^ n = 1} = Nat.gcd n (Fintype.card α) := by + let N := Nat.card α + obtain ⟨g, hg⟩ := IsCyclic.exists_generator (α := α) + have horder : orderOf g = N := by + dsimp [N] + exact orderOf_eq_card_of_forall_mem_zpowers hg + let f : Fin N → α := fun i => g ^ (i : ℕ) + have hf_inj : Function.Injective f := by + intro i j hij + apply Fin.ext + have hmod : (i : ℕ) ≡ (j : ℕ) [MOD orderOf g] := by + exact (pow_eq_pow_iff_modEq).1 hij + rw [horder] at hmod + have hi : (i : ℕ) < N := i.isLt + have hj : (j : ℕ) < N := j.isLt + exact Nat.ModEq.eq_of_lt_of_lt hmod hi hj + have hf_surj : Function.Surjective f := by + intro x + have hx : x ∈ (Finset.range N).image (fun i : ℕ => g ^ i) := by + dsimp [N] + rw [IsCyclic.image_range_card hg] + exact Finset.mem_univ x + rcases Finset.mem_image.mp hx with ⟨k, hk, rfl⟩ + exact ⟨⟨k, (Finset.mem_range.mp hk)⟩, rfl⟩ + let ef := Equiv.ofBijective f ⟨hf_inj, hf_surj⟩ + have hN : N ≠ 0 := by + dsimp [N] + exact Nat.card_pos.ne' + have h1 : Nat.card {i : Fin N // (f i) ^ n = 1} = Nat.card {x : α // x ^ n = 1} := by + exact Nat.card_congr (Equiv.subtypeEquiv ef (by intro i; rfl)) + have h2 : Nat.card {i : Fin N // (f i) ^ n = 1} = Nat.card {i : Fin N // N ∣ (i : ℕ) * n} := by + apply Nat.card_congr + apply Equiv.subtypeEquiv (Equiv.refl (Fin N)) + intro i + have hpow : (f i) ^ n = g ^ ((i : ℕ) * n) := by + simp [f, ← pow_mul, mul_comm, mul_left_comm] + constructor + · intro h + rw [hpow] at h + have hdvd : orderOf g ∣ (i : ℕ) * n := orderOf_dvd_iff_pow_eq_one.mpr h + rw [horder] at hdvd + exact hdvd + · intro h + rw [hpow] + have hdvd : orderOf g ∣ (i : ℕ) * n := by + rw [horder] + exact h + exact orderOf_dvd_iff_pow_eq_one.mp hdvd + rw [← h1, h2] + rw [card_fin_dvd_mul hN] + simp [N, Nat.gcd_comm] + end Chapter31 end CLRS From b7fb27036f0e36462947524fe9feb295700dfef2 Mon Sep 17 00:00:00 2001 From: TankTechnology <2541826291@qq.com> Date: Thu, 6 Aug 2026 00:35:57 +0800 Subject: [PATCH 16/24] feat(ch31): per-prime-power torsion counts for the error bound MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Milestone 3a: the per-prime-power counting primitive. - card_pow_eq_one_prime_pow: #{x : (ZMod (p^e))ˣ // x^m = 1} = gcd(m, φ(p^e)) via cyclicity of (Z/p^e)ˣ (ZMod.isCyclic_units_of_prime_pow) + the cyclic torsion count. - card_pow_eq_c_of_exists: in a finite commutative group, the fiber of x↦x^m over any element in its image has the same size as the m-torsion (coset of the kernel). - card_pow_le_card_pow_eq_one: so any fiber has size ≤ the m-torsion — this bounds the "≡ −1" part by the "≡ 1" part without needing −1 in the image. Kernel-clean (only propext/Classical.choice/Quot.sound). Co-Authored-By: Claude --- .../Section_31_8_Primality_Testing.lean | 56 +++++++++++++++++++ 1 file changed, 56 insertions(+) diff --git a/CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean b/CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean index 3939cfc..2c11689 100644 --- a/CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean +++ b/CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean @@ -918,6 +918,62 @@ theorem card_pow_eq_one_cyclic {α : Type*} [Group α] [Fintype α] [DecidableEq rw [card_fin_dvd_mul hN] simp [N, Nat.gcd_comm] +/-- +The per-prime-power count: the number of solutions to `x^m = 1` in the unit +group of `ZMod (p^e)` is `gcd(m, φ(p^e))`, since that group is cyclic for odd +prime powers. +-/ +lemma card_pow_eq_one_prime_pow {p e m : ℕ} (hp : Nat.Prime p) (hp2 : p ≠ 2) : + Nat.card {x : (ZMod (p ^ e))ˣ // x ^ m = 1} = Nat.gcd m (Nat.totient (p ^ e)) := by + classical + haveI : NeZero (p ^ e) := ⟨pow_ne_zero e hp.ne_zero⟩ + have hcyc : IsCyclic (ZMod (p ^ e))ˣ := ZMod.isCyclic_units_of_prime_pow p hp hp2 e + have hcard : Fintype.card (ZMod (p ^ e))ˣ = Nat.totient (p ^ e) := by + exact ZMod.card_units_eq_totient (p ^ e) + have h := CLRS.Chapter31.card_pow_eq_one_cyclic (α := (ZMod (p ^ e))ˣ) m + rw [hcard] at h + exact h + +/-- +In a commutative finite group, the fiber of the `m`-th power map over any +element in its image has the same size as the kernel (the `m`-torsion). +-/ +lemma card_pow_eq_c_of_exists {α : Type*} [CommGroup α] [Fintype α] [DecidableEq α] + {m : ℕ} {c : α} (hc : ∃ x, x ^ m = c) : + Nat.card {x : α // x ^ m = c} = Nat.card {x : α // x ^ m = 1} := by + classical + rcases hc with ⟨x₀, hx₀⟩ + let e : {x : α // x ^ m = 1} ≃ {x : α // x ^ m = c} := + { toFun := fun k => ⟨x₀ * k.1, by + rw [mul_pow, hx₀, k.2] + simp⟩ + invFun := fun x => ⟨x₀⁻¹ * x.1, by + rw [mul_pow, inv_pow, hx₀, x.2] + simp⟩ + left_inv := by + intro k + apply Subtype.ext + simp [mul_assoc] + right_inv := by + intro x + apply Subtype.ext + simp [mul_assoc] } + exact (Nat.card_congr e).symm + +/-- The fiber of the `m`-th power map over any element is no larger than the +kernel (it is empty, or a coset of the kernel). -/ +lemma card_pow_le_card_pow_eq_one {α : Type*} [CommGroup α] [Fintype α] [DecidableEq α] + {m : ℕ} {c : α} : Nat.card {x : α // x ^ m = c} ≤ Nat.card {x : α // x ^ m = 1} := by + classical + by_cases hc : ∃ x, x ^ m = c + · rw [card_pow_eq_c_of_exists hc] + · have : Nat.card {x : α // x ^ m = c} = 0 := by + rw [Nat.card_eq_fintype_card] + rw [Fintype.card_eq_zero_iff] + exact ⟨fun x => hc ⟨x.1, x.2⟩⟩ + rw [this] + exact Nat.zero_le _ + end Chapter31 end CLRS From b529398cc080c188123932382808e9951eee8fa6 Mon Sep 17 00:00:00 2001 From: TankTechnology <2541826291@qq.com> Date: Thu, 6 Aug 2026 00:43:24 +0800 Subject: [PATCH 17/24] feat(ch31): CRT decomposition of the m-torsion for the error bound Milestone 3b: card_pow_eq_one_crt shows the number of units x modulo n with x^m = 1 equals the product over prime factors p of the number of units modulo p^e_p with x^m = 1. Uses ZMod.equivPi (the CRT as a ring isomorphism on ZMod n), Units.mapEquiv + MulEquiv.piUnits to lift to unit groups, and Equiv.subtypePiEquivPi to turn the pointwise-torsion subtype into a Pi of per-prime-power torsion subtypes. Kernel-clean (only propext/Classical.choice/Quot.sound). Co-Authored-By: Claude --- .../Section_31_8_Primality_Testing.lean | 48 +++++++++++++++++++ 1 file changed, 48 insertions(+) diff --git a/CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean b/CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean index 2c11689..e579af7 100644 --- a/CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean +++ b/CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean @@ -974,6 +974,54 @@ lemma card_pow_le_card_pow_eq_one {α : Type*} [CommGroup α] [Fintype α] [Deci rw [this] exact Nat.zero_le _ +/-- +**CRT decomposition of the `m`-torsion.** The number of units `x` modulo `n` +with `x^m = 1` is the product over the prime factors `p` of `n` of the number +of units modulo `p^(e_p)` (`e_p = v_p(n)`) with `x^m = 1`. +-/ +lemma card_pow_eq_one_crt {n m : ℕ} (hn : n ≠ 0) : + Nat.card {x : (ZMod n)ˣ // x ^ m = 1} = + ∏ p : n.primeFactors, Nat.card {x : (ZMod (p ^ (n.factorization p)))ˣ // x ^ m = 1} := by + classical + let e : (ZMod n)ˣ ≃* Π p : n.primeFactors, (ZMod (p ^ (n.factorization p)))ˣ := + (Units.mapEquiv (ZMod.equivPi n hn : ZMod n ≃* Π p : n.primeFactors, ZMod (p ^ n.factorization p))).trans + (MulEquiv.piUnits) + have h1 : Nat.card {x : (ZMod n)ˣ // x ^ m = 1} = + Nat.card {f : Π p : n.primeFactors, (ZMod (p ^ (n.factorization p)))ˣ // f ^ m = 1} := by + apply Nat.card_congr + refine (Equiv.subtypeEquiv e ?_) + intro x + constructor + · intro hx + calc + (e x) ^ m = e (x ^ m) := (map_pow e x m).symm + _ = 1 := by simp [hx] + · intro hx + apply e.injective + calc + e (x ^ m) = (e x) ^ m := map_pow e x m + _ = 1 := hx + _ = e 1 := by simp + have h2 : Nat.card {f : Π p : n.primeFactors, (ZMod (p ^ (n.factorization p)))ˣ // f ^ m = 1} = + ∏ p : n.primeFactors, Nat.card {b : (ZMod (p ^ (n.factorization p)))ˣ // b ^ m = 1} := by + have h3 : Nat.card {f : Π p : n.primeFactors, (ZMod (p ^ (n.factorization p)))ˣ // f ^ m = 1} = + Nat.card {f : Π p : n.primeFactors, (ZMod (p ^ (n.factorization p)))ˣ // + ∀ p, (f p) ^ m = 1} := by + apply Nat.card_congr + refine (Equiv.subtypeEquiv (Equiv.refl _) ?_) + intro f + constructor + · intro hf p + have := congrFun hf p + simpa using this + · intro hf + funext p + simpa using hf p + rw [h3] + rw [Nat.card_congr (Equiv.subtypePiEquivPi (p := fun p y => y ^ m = 1))] + exact Nat.card_pi + rw [h1, h2] + end Chapter31 end CLRS From 60fd6d32f7c67bed4127c88cbffda3c4f6fec210 Mon Sep 17 00:00:00 2001 From: TankTechnology <2541826291@qq.com> Date: Thu, 6 Aug 2026 00:51:25 +0800 Subject: [PATCH 18/24] =?UTF-8?q?feat(ch31):=20gcd=20bound=20for=20the=20e?= =?UTF-8?q?rror=20bound=20=E2=80=94=20gcd(2^(=CE=BD=E2=88=921)=C2=B7t,=20p?= =?UTF-8?q?=E2=88=921)=20=E2=89=A4=20(p=E2=88=921)/2?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Milestone 3c (partial): the key per-prime-factor bound for |S(n)|. - odd_dvd_of_dvd_mul_two / odd_of_dvd_odd: odd-divisor helpers. - gcd_pow_mul_le_half: for m = 2^(ν−1)·t with t odd and 2^ν | p−1, the gcd of m and p−1 is at most (p−1)/2 (2-adic valuation ≤ ν−1, odd part ≤ d). Kernel-clean (only propext/Classical.choice/Quot.sound). Co-Authored-By: Claude --- .../Section_31_8_Primality_Testing.lean | 50 +++++++++++++++++++ 1 file changed, 50 insertions(+) diff --git a/CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean b/CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean index e579af7..4136df7 100644 --- a/CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean +++ b/CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean @@ -1022,6 +1022,56 @@ lemma card_pow_eq_one_crt {n m : ℕ} (hn : n ≠ 0) : exact Nat.card_pi rw [h1, h2] +/-- An odd divisor of `2·u` divides `u`. -/ +lemma odd_dvd_of_dvd_mul_two {d u : ℕ} (hd2 : d ∣ 2 * u) (hdodd : Odd d) : d ∣ u := by + have hcop : d.Coprime 2 := Nat.coprime_two_right.mpr hdodd + exact hcop.dvd_of_dvd_mul_right (by simpa [mul_comm] using hd2) + +/-- A divisor of an odd number is odd. -/ +lemma odd_of_dvd_odd {d t : ℕ} (ht : Odd t) (hdt : d ∣ t) : Odd d := by + by_contra hd + have heven : Even d := (Nat.not_odd_iff_even.mp hd) + have h2d : 2 ∣ d := even_iff_two_dvd.mp heven + exact ht.not_two_dvd_nat (h2d.trans hdt) + +/-- +For `m = 2^(ν−1)·t` with `t` odd and `2^ν | p−1`, the greatest common divisor +of `m` and `p−1` is at most `(p−1)/2`: its 2-adic valuation is at most `ν−1` +and its odd part divides the odd part `(p−1)/2^ν`. +-/ +lemma gcd_pow_mul_le_half {p ν t : ℕ} (hp : 0 < p - 1) (hν : 1 ≤ ν) (ht : Odd t) + (hdvd : 2 ^ ν ∣ p - 1) : + Nat.gcd (2 ^ (ν - 1) * t) (p - 1) ≤ (p - 1) / 2 := by + rcases hdvd with ⟨u, hu⟩ + have hu_pos : 0 < u := by + rw [hu] at hp + apply Nat.pos_of_ne_zero + intro hu0 + rw [hu0] at hp + norm_num at hp + have hu2 : 2 ^ ν * u = 2 ^ (ν - 1) * (2 * u) := by + rw [← mul_assoc] + congr 1 + rw [← pow_succ, Nat.sub_add_cancel hν] + rw [hu, hu2] + have hg : (2 ^ (ν - 1) * t).gcd (2 ^ (ν - 1) * (2 * u)) = 2 ^ (ν - 1) * t.gcd (2 * u) := by + change gcd (2 ^ (ν - 1) * t) (2 ^ (ν - 1) * (2 * u)) = 2 ^ (ν - 1) * gcd t (2 * u) + rw [gcd_mul_left] + simp + rw [hg] + have hgu : Nat.gcd t (2 * u) ≤ u := by + have hd2u : Nat.gcd t (2 * u) ∣ 2 * u := Nat.gcd_dvd_right _ _ + have hdodd : Odd (Nat.gcd t (2 * u)) := + odd_of_dvd_odd (d := Nat.gcd t (2 * u)) ht (Nat.gcd_dvd_left _ _) + have hdu : Nat.gcd t (2 * u) ∣ u := + odd_dvd_of_dvd_mul_two (d := Nat.gcd t (2 * u)) hd2u hdodd + exact Nat.le_of_dvd hu_pos hdu + have hdiv : (2 ^ (ν - 1) * (2 * u)) / 2 = 2 ^ (ν - 1) * u := by + rw [show 2 ^ (ν - 1) * (2 * u) = 2 * (2 ^ (ν - 1) * u) by ring] + exact Nat.mul_div_right (2 ^ (ν - 1) * u) (by norm_num) + rw [hdiv] + exact Nat.mul_le_mul_left (2 ^ (ν - 1)) hgu + end Chapter31 end CLRS From 861422249296eecd69597a0f97d9cb768370cb25 Mon Sep 17 00:00:00 2001 From: TankTechnology <2541826291@qq.com> Date: Thu, 6 Aug 2026 00:55:11 +0800 Subject: [PATCH 19/24] =?UTF-8?q?feat(ch31):=20|S(n)|=20=E2=89=A4=202?= =?UTF-8?q?=C2=B7|S=E2=82=81|=20and=20the=20CRT=20product=20for=20|S?= =?UTF-8?q?=E2=82=81|?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Milestone 3 assembly: the structural bound for the error bound. - card_subtype_filter, card_or_le: counting a disjunction of predicates. - goodSet_card_le: |S(n)| = |{x : x^m ∈ {±1}}| ≤ 2·|{x : x^m = 1}| — the "≡ −1" part is a fiber of the power map, no larger than the m-torsion. - mTorsion_eq_prod: the m-torsion of (ZMod n)ˣ is the product over prime factors p of gcd(m, φ(p^e_p)) (via card_pow_eq_one_crt + the per-prime-power count). Together: |S(n)| ≤ 2·∏ gcd(m, φ(p^e)) ≤ 2^(1−k)·∏(p−1). Kernel-clean. Co-Authored-By: Claude --- .../Section_31_8_Primality_Testing.lean | 58 +++++++++++++++++++ 1 file changed, 58 insertions(+) diff --git a/CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean b/CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean index 4136df7..4bef144 100644 --- a/CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean +++ b/CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean @@ -1072,6 +1072,64 @@ lemma gcd_pow_mul_le_half {p ν t : ℕ} (hp : 0 < p - 1) (hν : 1 ≤ ν) (ht : rw [hdiv] exact Nat.mul_le_mul_left (2 ^ (ν - 1)) hgu +/-- `|{x : α // p x}|` equals the number of elements of `α` satisfying `p`. -/ +lemma card_subtype_filter {α : Type*} [Fintype α] (p : α → Prop) [DecidablePred p] : + Nat.card {x : α // p x} = (Finset.univ.filter p).card := by + rw [Nat.card_eq_fintype_card] + simpa [Fintype.card_subtype] + +/-- The number of elements satisfying `p ∨ q` is at most the sum of the +numbers satisfying `p` and `q` separately. -/ +lemma card_or_le {α : Type*} [Fintype α] [DecidableEq α] (p q : α → Prop) + [DecidablePred p] [DecidablePred q] : + Nat.card {x : α // p x ∨ q x} ≤ Nat.card {x : α // p x} + Nat.card {x : α // q x} := by + classical + rw [card_subtype_filter (fun x => p x ∨ q x), card_subtype_filter p, card_subtype_filter q] + have hset : (Finset.univ.filter p) ∪ (Finset.univ.filter q) = Finset.univ.filter (fun x => p x ∨ q x) := by + ext x + simp [Finset.mem_union, Finset.mem_filter] + rw [← hset] + exact Finset.card_union_le _ _ + +/-- +The good set `{x : x^m ∈ {±1}}` has size at most twice the `m`-torsion: +it splits into the `x^m = 1` and `x^m = −1` parts, and the latter is no +larger than the former (a fiber of the power map). +-/ +lemma goodSet_card_le {n : ℕ} [NeZero n] (m : ℕ) : + Nat.card {x : (ZMod n)ˣ // x ∈ goodSet m} ≤ + 2 * Nat.card {x : (ZMod n)ˣ // x ^ m = 1} := by + classical + have h1 : Nat.card {x : (ZMod n)ˣ // x ∈ goodSet m} = + Nat.card {x : (ZMod n)ˣ // x ^ m = 1 ∨ x ^ m = -1} := by + apply Nat.card_congr + refine (Equiv.subtypeEquiv (Equiv.refl _) ?_) + intro x + exact mem_goodSet_iff m x + rw [h1] + have h2 := card_or_le (α := (ZMod n)ˣ) (fun x => x ^ m = 1) (fun x => x ^ m = -1) + nlinarith [h2, card_pow_le_card_pow_eq_one (α := (ZMod n)ˣ) (m := m) (c := -1)] + +/-- +The `m`-torsion of `(ZMod n)ˣ` is the product over the prime factors `p` of +`n` of `gcd(m, φ(p^(e_p)))`, where `e_p = v_p(n)`. +-/ +lemma mTorsion_eq_prod {n m : ℕ} (hn : n ≠ 0) (hn_odd : Odd n) : + Nat.card {x : (ZMod n)ˣ // x ^ m = 1} = + ∏ p : n.primeFactors, Nat.gcd m (Nat.totient (p ^ n.factorization p)) := by + rw [card_pow_eq_one_crt hn] + apply Finset.prod_congr rfl + intro p hp + have hpp : Nat.Prime (p : ℕ) := Nat.prime_of_mem_primeFactors p.2 + have hpne2 : (p : ℕ) ≠ 2 := by + intro h2 + have hdvd : (2 : ℕ) ∣ n := by + rw [← h2] + exact Nat.dvd_of_mem_primeFactors p.2 + have hne : ¬ Even n := (Nat.not_even_iff_odd.mpr hn_odd) + exact hne (even_iff_two_dvd.mpr hdvd) + exact card_pow_eq_one_prime_pow (p := (p : ℕ)) (e := n.factorization (p : ℕ)) (m := m) hpp hpne2 + end Chapter31 end CLRS From 2ead73dbfbb7027adc7c514c6250fd5a791222cb Mon Sep 17 00:00:00 2001 From: TankTechnology <2541826291@qq.com> Date: Thu, 6 Aug 2026 01:06:27 +0800 Subject: [PATCH 20/24] =?UTF-8?q?feat(ch31):=20|S=E2=82=81|=20=E2=89=A4=20?= =?UTF-8?q?=E2=88=8F(p=E2=88=921)/2=20=E2=80=94=20Milestone=203=20complete?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Completes the structural bound for the error bound: |S(n)| ≤ 2·|S₁| ≤ 2·∏(p−1)/2 = 2^(1−k)·∏(p−1). - nu_le_v2_nat_sub_one: ν(n) ≤ v₂(n−1), since every prime factor is ≡ 1 mod 2^ν and n = ∏p^e (Nat.ModEq.prod_one). - mExp_dvd: m = 2^(ν−1)·t divides n−1. - mExp_coprime_prime: m is coprime to every prime factor p of n. - gcd_eq_gcd_of_coprime / gcd_totient_eq_gcd_prime: gcd(m, φ(p^e)) = gcd(m, p−1). - mTorsion_le_prod_half: |S₁| ≤ ∏ (p−1)/2, via the per-factor gcd bound gcd_pow_mul_le_half. Kernel-clean (only propext/Classical.choice/Quot.sound). The remaining work is the three-case arithmetic (|S| ≤ 2^(1−k)·∏(p−1) ≤ (n−1)/4 for k ≥ 3, k = 1, k = 2). Co-Authored-By: Claude --- .../Section_31_8_Primality_Testing.lean | 100 ++++++++++++++++++ 1 file changed, 100 insertions(+) diff --git a/CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean b/CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean index 4bef144..779376b 100644 --- a/CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean +++ b/CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean @@ -1130,6 +1130,106 @@ lemma mTorsion_eq_prod {n m : ℕ} (hn : n ≠ 0) (hn_odd : Odd n) : exact hne (even_iff_two_dvd.mpr hdvd) exact card_pow_eq_one_prime_pow (p := (p : ℕ)) (e := n.factorization (p : ℕ)) (m := m) hpp hpne2 +/-- `ν(n) ≤ v₂(n−1)`: every prime factor is `≡ 1 (mod 2^ν)`, so `n ≡ 1` and +`2^ν | n−1`. -/ +lemma nu_le_v2_nat_sub_one {n : ℕ} (hn1 : 1 < n) (hn_odd : Odd n) : + nu n ≤ (n - 1).factorization 2 := by + have hnne : n.primeFactors.Nonempty := (Nat.nonempty_primeFactors).2 hn1 + have hmod : ∀ p ∈ n.primeFactors, p ≡ 1 [MOD 2 ^ nu n] := by + intro p hp + exact ((Nat.modEq_iff_dvd' (a := 1) (b := p) (Nat.succ_le_of_lt (Nat.pos_of_mem_primeFactors hp))).mpr + (two_pow_nu_dvd_prime_sub_one (n := n) hnne hp)).symm + have hprod : ∏ p : n.primeFactors, (p : ℕ) ^ n.factorization (p : ℕ) ≡ 1 [MOD 2 ^ nu n] := by + exact Nat.ModEq.prod_one (s := Finset.univ) + (f := fun p : n.primeFactors => (p : ℕ) ^ n.factorization (p : ℕ)) (by + intro p hp + simpa using (hmod p p.2).pow (n.factorization p)) + have hn_mod : n ≡ 1 [MOD 2 ^ nu n] := by + conv_lhs => + rw [Nat.prod_pow_primeFactors_factorization (by omega : n ≠ 0)] + exact hprod + have hdvd : 2 ^ nu n ∣ n - 1 := (Nat.modEq_iff_dvd' (a := 1) (b := n) (by omega)).mp hn_mod.symm + exact (Nat.Prime.pow_dvd_iff_le_factorization (by decide : Nat.Prime 2) (by omega)).1 hdvd + +/-- `m = 2^(ν−1)·t` divides `n−1` (since `t·2^s = n−1` and `ν ≤ s`). -/ +lemma mExp_dvd {n : ℕ} [NeZero n] (hn1 : 1 < n) (hn_odd : Odd n) : + 2 ^ (nu n - 1) * (strongTestParams n).2 ∣ n - 1 := by + have hs : (strongTestParams n).2 * 2 ^ (strongTestParams n).1 = n - 1 := by + unfold strongTestParams + have hdvd : 2 ^ (n - 1).factorization 2 ∣ n - 1 := by + exact (Nat.Prime.pow_dvd_iff_le_factorization (by decide : Nat.Prime 2) (by omega)).2 le_rfl + rw [Nat.mul_comm] + exact Nat.mul_div_cancel' hdvd + have hν_le_s : nu n - 1 ≤ (strongTestParams n).1 := by + have hν_s : nu n ≤ (n - 1).factorization 2 := nu_le_v2_nat_sub_one hn1 hn_odd + unfold strongTestParams + omega + have hpow_dvd : 2 ^ (nu n - 1) ∣ 2 ^ (strongTestParams n).1 := by + exact pow_dvd_pow 2 hν_le_s + have hmul : 2 ^ (nu n - 1) * (strongTestParams n).2 ∣ + 2 ^ (strongTestParams n).1 * (strongTestParams n).2 := by + exact Nat.mul_dvd_mul hpow_dvd (dvd_refl _) + rw [← hs] + simpa [mul_comm] using hmul + +/-- `m` is coprime to every prime factor `p` of `n`: `m | n−1` and `p | n`. -/ +lemma mExp_coprime_prime {n : ℕ} [NeZero n] (hn1 : 1 < n) (hn_odd : Odd n) + {p : ℕ} (hp : p ∈ n.primeFactors) : + (2 ^ (nu n - 1) * (strongTestParams n).2).Coprime p := by + have hmn : 2 ^ (nu n - 1) * (strongTestParams n).2 ∣ n - 1 := mExp_dvd (n := n) hn1 hn_odd + have hpn : p ∣ n := Nat.dvd_of_mem_primeFactors hp + have hcop : (n - 1).Coprime n := by + exact ((Nat.coprime_self_sub_right (m := 1) (n := n) (by omega)).mpr (by simp)).symm + exact (hcop.of_dvd_left hmn).of_dvd_right hpn + +/-- `gcd a (b·c) = gcd a c` when `a` is coprime to `b`. -/ +lemma gcd_eq_gcd_of_coprime {a b c : ℕ} (h : a.Coprime b) : a.gcd (b * c) = a.gcd c := by + apply Nat.dvd_antisymm + · apply Nat.dvd_gcd + · exact Nat.gcd_dvd_left _ _ + · have hd2 : a.gcd (b * c) ∣ b * c := Nat.gcd_dvd_right _ _ + have hcop : (a.gcd (b * c)).Coprime b := h.of_dvd_left (Nat.gcd_dvd_left _ _) + exact hcop.dvd_of_dvd_mul_right (by simpa [mul_comm] using hd2) + · apply Nat.dvd_gcd + · exact Nat.gcd_dvd_left _ _ + · exact (Nat.gcd_dvd_right _ _).trans (dvd_mul_left c b) + +/-- `gcd(m, φ(p^e)) = gcd(m, p−1)` when `gcd(m, p) = 1` and `0 < e`. -/ +lemma gcd_totient_eq_gcd_prime {p e m : ℕ} (hp : Nat.Prime p) (he : 0 < e) + (hpm : m.Coprime p) : m.gcd (Nat.totient (p ^ e)) = m.gcd (p - 1) := by + rw [Nat.totient_prime_pow hp he] + have hpm' : m.Coprime (p ^ (e - 1)) := hpm.pow_right (e - 1) + exact gcd_eq_gcd_of_coprime (a := m) (b := p ^ (e - 1)) (c := p - 1) hpm' + +/-- +The `m`-torsion is at most the product over the prime factors of `(p−1)/2`, +where `m = 2^(ν(n)−1)·t`. +-/ +lemma mTorsion_le_prod_half {n : ℕ} [NeZero n] (hn1 : 1 < n) (hn_odd : Odd n) : + Nat.card {x : (ZMod n)ˣ // x ^ (2 ^ (nu n - 1) * (strongTestParams n).2) = 1} ≤ + ∏ p : n.primeFactors, ((p : ℕ) - 1) / 2 := by + rw [mTorsion_eq_prod (by omega) hn_odd] + have hν : 1 ≤ nu n := nu_pos hn_odd hn1 + have ht : Odd (strongTestParams n).2 := strongTestParams_odd hn1 + have hnne : n.primeFactors.Nonempty := (Nat.nonempty_primeFactors).2 hn1 + apply Finset.prod_le_prod' + intro p hp + have hpp : Nat.Prime (p : ℕ) := Nat.prime_of_mem_primeFactors p.2 + have hppos : 0 < (p : ℕ) - 1 := by + have := hpp.two_le + omega + have hpm : (2 ^ (nu n - 1) * (strongTestParams n).2).Coprime (p : ℕ) := + mExp_coprime_prime (n := n) hn1 hn_odd p.2 + have hdvd : 2 ^ nu n ∣ (p : ℕ) - 1 := two_pow_nu_dvd_prime_sub_one (n := n) hnne p.2 + have he : 0 < n.factorization (p : ℕ) := by + exact hpp.factorization_pos_of_dvd (by omega) (Nat.dvd_of_mem_primeFactors p.2) + calc + (2 ^ (nu n - 1) * (strongTestParams n).2).gcd (Nat.totient ((p : ℕ) ^ n.factorization (p : ℕ))) + = (2 ^ (nu n - 1) * (strongTestParams n).2).gcd ((p : ℕ) - 1) := by + exact gcd_totient_eq_gcd_prime hpp he hpm + _ ≤ ((p : ℕ) - 1) / 2 := gcd_pow_mul_le_half (p := (p : ℕ)) (ν := nu n) (t := (strongTestParams n).2) + hppos hν ht hdvd + end Chapter31 end CLRS From 4f82a337e33a0a026503a88b5482f03b66612809 Mon Sep 17 00:00:00 2001 From: TankTechnology <2541826291@qq.com> Date: Thu, 6 Aug 2026 01:07:32 +0800 Subject: [PATCH 21/24] docs(ch31): record Milestone 1-3 completion and the k=2 case analysis MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Milestones 1-3 (ν, S(n), liars ⊆ S, |S| ≤ 2^(1−k)·∏(p−1)) are committed. The handoff now documents the only remaining work — Milestone 4, the three-case bound |S| ≤ (n−1)/4 — with the k=2 analysis worked out: - sub-case s < r is easy via pq−1 ≥ 2^(2ν+1)d_p·d_q (no d/gcd needed); - sub-case s = r needs "d_p | t ∧ d_q | t ⟹ d_p = d_q ⟹ p = q" to get a factor-3 saving. Co-Authored-By: Claude --- docs/ch31-error-bound-handoff.md | 48 ++++++++++++++++++++++---------- 1 file changed, 34 insertions(+), 14 deletions(-) diff --git a/docs/ch31-error-bound-handoff.md b/docs/ch31-error-bound-handoff.md index 35013a6..5e287ef 100644 --- a/docs/ch31-error-bound-handoff.md +++ b/docs/ch31-error-bound-handoff.md @@ -169,20 +169,40 @@ page #1770. ## Concrete attack order (next session) -1. **Milestone 1 — ν(n) and S(n)**: define `ν(n)` (min over prime factors of - `v_2(p−1)`), define `S(n)` in `(ZMod n)ˣ`, prove **S is a subgroup**. -2. **Milestone 2 — L ⊆ S**: prove every strong liar is in `S(n)`, using the - order-of-element argument modulo each prime divisor (needs `orderOf_pow`, - `orderOf_dvd_iff_pow_eq_one`, and the - `e = 2·gcd(e, 2^i·t) ⟹ 2^(i+1) | e` parity lemma). -3. **Milestone 3 — |S| counting**: via CRT and cyclicity of `(Z/p^e)ˣ`, - `|S| = 2^(k(ν−1)+1) · ∏ gcd(t, φ(p_i^{e_i}))`. -4. **Milestone 4 — three-case bound**: prove `|S| ≤ (n−1)/4` in the three - cases (k≥3, k=2, k=1). -5. **Wrap-up**: update `docs/clrs-proof-progress.csv` (bump tracked count, - move `isCarmichael`-era note), `docs/proof-map.md`, chapter guide - `CLRSLean/Chapter_31.lean` (remove the deferred item), regenerate - `CLRSLean/Progress.lean`, run `check_repository.py`, then the PR. +> **Milestones 1–3 are DONE (committed on `feat/ch31-refinements`).** +> Remaining: **Milestone 4 only** — the three-case arithmetic bound. + +### Milestone 4 — the three-case bound (the only remaining work) + +Everything is in place except the final arithmetic. The available lemmas +(31.8) give, for `m = 2^(ν(n)−1)·t` (`t` odd), `k = n.primeFactors.card`: + +- `goodSet_card_le`: `|S(n)| ≤ 2·|{x : x^m = 1}|` (the "≡ −1" part is a fiber). +- `mTorsion_le_prod_half`: `|{x : x^m = 1}| ≤ ∏_{p|n} (p−1)/2`. +- So **`|S(n)| ≤ 2^(1−k)·∏_{p|n} (p−1)`**, and the target is + `2·∏ (p−1)/2 ≤ (n−1)/4`. + +**Cases** (verify the arithmetic, then formalize): + +- **k ≥ 3**: `∏(p−1) ≤ n−1` (each `p−1 < p`, `∏p ≤ n`) and `2^(1−k) ≤ 1/4`. Easy. +- **k = 1** (`n = p^e`): `|S| ≤ 2·(p−1)/2 = p−1 ≤ (p^e−1)/4` (uses `e ≥ 2`, `p ≥ 3`). Easy. +- **k = 2** (`n = pq`, `s = v₂(p−1)`, `r = v₂(q−1)`, `ν = min(s,r)`): + `|S| = 2·gcd(m,p−1)·gcd(m,q−1) ≤ 2^(2ν−1)·gcd(t,d_p)·gcd(t,d_q)`. + - **Sub-case s < r** (ν = s): `|S| ≤ 2^(2ν−1)·d_p·d_q`, and + `pq−1 ≥ 2^(s+r)d_p·d_q ≥ 2^(2ν+1)d_p·d_q`, so `|S| ≤ (pq−1)/4`. Easy — + no `d/gcd` analysis needed. + - **Sub-case s = r = ν**: `d_p | t` and `d_q | t` both ⟹ `d_p = d_q` ⟹ `p = q` + (contradiction), so at least one of `gcd(t,d_p)`, `gcd(t,d_q)` is `≤ d/3` + (odd, proper divisor). Then `|S| ≤ 2^(2ν−1)·d_p·d_q/3` and + `pq−1 ≥ 2^(2ν)·d_p·d_q`, giving `|S| ≤ (pq−1)/4`. + - Key sub-lemma to prove: **`d_p | t ∧ d_q | t ⟹ d_p = d_q`** for `n = pq` + (from `t = (pq−1)/2^v`, `pq−1 = 2^(s+r)d_p d_q + 2^s d_p + 2^r d_q`, + divisibility of `t` by `d_p` forces `d_p | d_q`). + +**Wrap-up after Milestone 4**: update `docs/clrs-proof-progress.csv` (bump +tracked count), `docs/proof-map.md`, chapter guide `CLRSLean/Chapter_31.lean` +(remove the deferred item), regenerate `CLRSLean/Progress.lean`, run +`check_repository.py`, then the PR. 6. **Wrap-up**: update `docs/clrs-proof-progress.csv` (bump tracked count, move `isCarmichael`-era note), `docs/proof-map.md`, chapter guide `CLRSLean/Chapter_31.lean` (remove the deferred item), regenerate From b987441c9a89ea2aa77ab273ee4216323cc1015d Mon Sep 17 00:00:00 2001 From: TankTechnology <2541826291@qq.com> Date: Thu, 6 Aug 2026 02:31:03 +0800 Subject: [PATCH 22/24] =?UTF-8?q?feat(ch31):=20prove=20|S(n)|=20=E2=89=A4?= =?UTF-8?q?=20(n=E2=88=921)/4=20=E2=80=94=20Miller-Rabin=20error=20bound?= =?UTF-8?q?=20complete?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Milestone 4 of the Rabin–Monier error-bound proof: the three-case arithmetic bound on the good subgroup S(n). - k=1 (prime power): |S| ≤ p−1 ≤ (p^e−1)/4 via the CRT m-torsion count and 4(p−1) ≤ p²−1. - k=2 (semiprime n = p^a q^b): squarefree n=pq uses the refined bound 8·gcd(m,p−1)·gcd(m,q−1) ≤ pq−1, split into s (p : ℕ)) + (g := fun p : n.primeFactors => (p : ℕ) ^ (n.factorization (p : ℕ))) ?_ + intro p hp + have hpp : Nat.Prime (p : ℕ) := Nat.prime_of_mem_primeFactors p.2 + have hpos : 0 < n.factorization (p : ℕ) := + hpp.factorization_pos_of_dvd (by omega) (Nat.dvd_of_mem_primeFactors p.2) + exact le_self_pow (by have h2 := hpp.two_le; omega) hpos.ne' + _ = n := (Nat.prod_pow_primeFactors_factorization (by omega : n ≠ 0)).symm + omega + +/-- +The good subgroup `S(n)` has size at most `2·∏_{p|n}(p−1)/2`: the union +bound `goodSet_card_le` splits off the factor 2, and the `m`-torsion is at +most `∏(p−1)/2` by `mTorsion_le_prod_half`. +-/ +lemma goodUnits_card_le_prodHalf {n : ℕ} [NeZero n] (hn1 : 1 < n) (hn_odd : Odd n) : + Nat.card {x : (ZMod n)ˣ // x ∈ goodUnits} ≤ + 2 * ∏ p : n.primeFactors, ((p : ℕ) - 1) / 2 := by + unfold goodUnits + calc + Nat.card {x : (ZMod n)ˣ // x ∈ goodSet (2 ^ (nu n - 1) * (strongTestParams n).2)} ≤ + 2 * Nat.card {x : (ZMod n)ˣ // x ^ (2 ^ (nu n - 1) * (strongTestParams n).2) = 1} := + goodSet_card_le (n := n) (2 ^ (nu n - 1) * (strongTestParams n).2) + _ ≤ 2 * ∏ p : n.primeFactors, ((p : ℕ) - 1) / 2 := by + exact Nat.mul_le_mul_left 2 (mTorsion_le_prod_half (n := n) hn1 hn_odd) + +/-- For `n` with at least three prime factors, `|S(n)| ≤ (n−1)/4`. -/ +lemma goodUnits_card_le_of_ge_three {n : ℕ} [NeZero n] (hn1 : 1 < n) (hn_odd : Odd n) + (hk : 3 ≤ n.primeFactors.card) : + Nat.card {x : (ZMod n)ˣ // x ∈ goodUnits} ≤ (n - 1) / 4 := by + have h8 : 8 * ∏ p : n.primeFactors, ((p : ℕ) - 1) / 2 ≤ n - 1 := by + calc + 8 * ∏ p : n.primeFactors, ((p : ℕ) - 1) / 2 + ≤ 2 ^ n.primeFactors.card * ∏ p : n.primeFactors, ((p : ℕ) - 1) / 2 := by + exact Nat.mul_le_mul_right _ (by + have hpow : 2 ^ 3 ≤ 2 ^ n.primeFactors.card := + pow_le_pow_right₀ (by norm_num) hk + norm_num at hpow + exact hpow) + _ = ∏ p : n.primeFactors, ((p : ℕ) - 1) := + (prod_prime_sub_one_eq_two_mul (n := n) hn_odd hn1).symm + _ ≤ n - 1 := prod_prime_sub_one_le (n := n) hn1 + have h4 : 4 * Nat.card {x : (ZMod n)ˣ // x ∈ goodUnits} ≤ n - 1 := by + calc + 4 * Nat.card {x : (ZMod n)ˣ // x ∈ goodUnits} + ≤ 4 * (2 * ∏ p : n.primeFactors, ((p : ℕ) - 1) / 2) := + Nat.mul_le_mul_left 4 (goodUnits_card_le_prodHalf (n := n) hn1 hn_odd) + _ = 8 * ∏ p : n.primeFactors, ((p : ℕ) - 1) / 2 := by ring + _ ≤ n - 1 := h8 + exact (Nat.le_div_iff_mul_le (by norm_num : 0 < 4)).mpr (by simpa [mul_comm] using h4) + +/-- For `n = p^e` a prime power (composite), `|S(n)| ≤ (n−1)/4`. -/ +lemma goodUnits_card_le_prime_power {n : ℕ} [NeZero n] (hn1 : 1 < n) (hn_odd : Odd n) + (hn_comp : ¬ Nat.Prime n) (hk : n.primeFactors.card = 1) : + Nat.card {x : (ZMod n)ˣ // x ∈ goodUnits} ≤ (n - 1) / 4 := by + rcases Finset.card_eq_one.mp hk with ⟨p, hpf⟩ + have hp_mem : p ∈ n.primeFactors := by rw [hpf]; simp + have hpp : Nat.Prime p := Nat.prime_of_mem_primeFactors hp_mem + have hpodd : Odd p := odd_of_dvd_odd hn_odd (Nat.dvd_of_mem_primeFactors hp_mem) + have hne : n = p ^ (n.factorization p) := by + conv_lhs => rw [Nat.prod_pow_primeFactors_factorization (by omega : n ≠ 0)] + exact prod_primeFactors_singleton (n := n) (p := p) hpf + (fun x : ℕ => x ^ (n.factorization x)) + have he1 : 1 ≤ n.factorization p := + hpp.factorization_pos_of_dvd (by omega) (Nat.dvd_of_mem_primeFactors hp_mem) + have hne1 : n.factorization p ≠ 1 := by + intro h1 + have : n = p := by simpa [h1] using hne + exact hn_comp (by simpa [this] using hpp) + have he : 2 ≤ n.factorization p := by omega + have hp_ne2 : p ≠ 2 := by + intro h2 + rw [h2] at hpodd + norm_num at hpodd + have hp2_le_n : p ^ 2 ≤ n := by + have hp2d : p ^ 2 ∣ n := (hpp.pow_dvd_iff_le_factorization (by omega : n ≠ 0)).2 he + exact Nat.le_of_dvd (by omega : 0 < n) hp2d + have hsp : Nat.card {x : (ZMod n)ˣ // x ∈ goodUnits} ≤ p - 1 := by + calc + Nat.card {x : (ZMod n)ˣ // x ∈ goodUnits} + ≤ 2 * ∏ q : n.primeFactors, ((q : ℕ) - 1) / 2 := + goodUnits_card_le_prodHalf (n := n) hn1 hn_odd + _ = 2 * ((p - 1) / 2) := by + rw [hpf] + simp + _ = p - 1 := by + have h2 : 2 ∣ p - 1 := two_dvd_prime_sub_one_of_odd hpp hpodd + calc + 2 * ((p - 1) / 2) = ((p - 1) / 2) * 2 := by omega + _ = p - 1 := Nat.div_mul_cancel h2 + have hp3 : 3 ≤ p := by + exact Nat.succ_le_of_lt (lt_of_le_of_ne hpp.two_le (Ne.symm hp_ne2)) + have hsq : 4 * (p - 1) ≤ p ^ 2 - 1 := by + have hsqf : p ^ 2 - 1 = (p - 1) * (p + 1) := by + simpa [mul_comm] using (Nat.sq_sub_sq p 1) + rw [hsqf] + rw [mul_comm 4 (p - 1)] + exact Nat.mul_le_mul_left (p - 1) (by omega : 4 ≤ p + 1) + have h4p : 4 * (p - 1) ≤ n - 1 := by + exact hsq.trans (by omega) + have h4 : 4 * Nat.card {x : (ZMod n)ˣ // x ∈ goodUnits} ≤ n - 1 := by + calc + 4 * Nat.card {x : (ZMod n)ˣ // x ∈ goodUnits} ≤ 4 * (p - 1) := + Nat.mul_le_mul_left 4 hsp + _ ≤ n - 1 := h4p + exact (Nat.le_div_iff_mul_le (by norm_num : 0 < 4)).mpr (by simpa [mul_comm] using h4) + +/-- An odd divisor `g` of an odd `d` is at most `d/3`. -/ +lemma odd_divisor_le_div_three {d g : ℕ} (hd : Odd d) (hg : g ∣ d) (hlt : g ≠ d) : g ≤ d / 3 := by + rcases hg with ⟨c, rfl⟩ + have hc_ne1 : c ≠ 1 := by + intro h1 + apply hlt + rw [h1, mul_one] + have hc_ne0 : c ≠ 0 := by + intro hc0 + rw [hc0, mul_zero] at hd + norm_num at hd + have hodd_c : Odd c := (Nat.odd_mul.mp hd).2 + have hc3 : 3 ≤ c := by + rcases (odd_iff_exists_bit1.mp hodd_c) with ⟨k, rfl⟩ + have hk0 : 1 ≤ k := by + by_contra hk + have hk0' : k = 0 := by omega + rw [hk0'] at hc_ne1 + norm_num at hc_ne1 + omega + rw [Nat.le_div_iff_mul_le (by norm_num : 0 < 3)] + exact Nat.mul_le_mul_left g hc3 + +/-- For a prime `p`, `p−1 = 2^s·((p−1)/2^s)` where `s = v₂(p−1)`. -/ +lemma prime_sub_one_decomp {p : ℕ} (hp : Nat.Prime p) : + p - 1 = 2 ^ (p - 1).factorization 2 * ((p - 1) / 2 ^ (p - 1).factorization 2) := by + have hppos : p - 1 ≠ 0 := by + have h2 := hp.two_le + omega + have hdvd : 2 ^ (p - 1).factorization 2 ∣ p - 1 := by + exact (Nat.Prime.pow_dvd_iff_le_factorization (by decide : Nat.Prime 2) hppos).2 le_rfl + exact (Nat.mul_div_cancel' hdvd).symm + +/-- The odd part `t` of `n−1` divides `n−1`. -/ +lemma strongTestParams_snd_dvd {n : ℕ} (hn1 : 1 < n) : (strongTestParams n).2 ∣ n - 1 := by + unfold strongTestParams + change (n - 1) / 2 ^ (n - 1).factorization 2 ∣ n - 1 + have hdvd : 2 ^ (n - 1).factorization 2 ∣ n - 1 := by + exact (Nat.Prime.pow_dvd_iff_le_factorization (by decide : Nat.Prime 2) (by omega)).2 le_rfl + refine ⟨2 ^ (n - 1).factorization 2, by rw [mul_comm]; exact (Nat.mul_div_cancel' hdvd).symm⟩ + +/-- `ν(p·q) = min (v₂(p−1)) (v₂(q−1))` for distinct primes `p`, `q`. -/ +lemma nu_semiprime {p q : ℕ} (hp : Nat.Prime p) (hq : Nat.Prime q) : + nu (p * q) = min ((p - 1).factorization 2) ((q - 1).factorization 2) := by + let s := (p - 1).factorization 2 + let r := (q - 1).factorization 2 + have hpq_fac : (p * q).primeFactors = ({p, q} : Finset ℕ) := by + rw [Nat.primeFactors_mul hp.ne_zero hq.ne_zero] + rw [Nat.Prime.primeFactors hp, Nat.Prime.primeFactors hq] + ext x + simp + unfold nu + rw [dif_pos (by rw [hpq_fac]; simp)] + simp [hpq_fac] + +/-- `gcd(2^(ν−1)·t, 2^s·d) = 2^(ν−1)·gcd(t, d)` when `1 ≤ ν ≤ s` and `t` is odd. -/ +lemma gcd_pow_mul_oddPart {t s ν d : ℕ} (hν1 : 1 ≤ ν) (hνs : ν ≤ s) (ht : Odd t) : + (2 ^ (ν - 1) * t).gcd (2 ^ s * d) = 2 ^ (ν - 1) * t.gcd d := by + have hpow : 2 ^ s = 2 ^ (ν - 1) * 2 ^ (s - ν + 1) := by + rw [← pow_add] + congr 1 + omega + rw [hpow] + rw [mul_assoc] + rw [Nat.gcd_mul_left] + have hcop : t.Coprime (2 ^ (s - ν + 1)) := by + exact (Nat.coprime_two_right.mpr ht).pow_right (s - ν + 1) + rw [gcd_eq_gcd_of_coprime hcop] + +/-- `(2^s·d_p)·(2^r·d_q) = 2^(s+r)·(d_p·d_q)`. -/ +lemma pow_mul_mul {s r d_p d_q : ℕ} : (2 ^ s * d_p) * (2 ^ r * d_q) = 2 ^ (s + r) * (d_p * d_q) := by + rw [pow_add] + ring + +/-- For primes `p, q ≥ 3`, `(p−1)(q−1) ≤ p·q−1`. -/ +lemma prod_sub_one_le {p q : ℕ} (hp : 3 ≤ p) (hq : 3 ≤ q) : (p - 1) * (q - 1) ≤ p * q - 1 := by + calc + (p - 1) * (q - 1) ≤ (p - 1) * q := Nat.mul_le_mul_left (p - 1) (Nat.sub_le _ _) + _ = p * q - q := by + rw [Nat.mul_sub_right_distrib] + simp + _ ≤ p * q - 1 := by omega + + +/-- A product over `n.primeFactors = {p, q}` is `f p·f q`. -/ +lemma prod_primeFactors_pair {n p q : ℕ} (hpf : n.primeFactors = ({p, q} : Finset ℕ)) (hpq : p ≠ q) + (f : ℕ → ℕ) : ∏ x : n.primeFactors, f (x : ℕ) = f p * f q := by + rw [hpf] + change (({p, q} : Finset ℕ).attach.prod (fun x : {x // x ∈ ({p, q} : Finset ℕ)} => f (x : ℕ))) = f p * f q + simp only [Finset.prod_attach] + rw [show ({p, q} : Finset ℕ) = insert p {q} by ext x; simp] + rw [Finset.prod_insert] + · simp + · simp [hpq] + +/-- **Key lemma.** For `n = p·q`, if `d_p | t` and `d_q | t` then `d_p = d_q`. -/ +lemma semiprime_key_lemma {p q : ℕ} (hp : Nat.Prime p) (hq : Nat.Prime q) (hpq : p ≠ q) : + ((p - 1) / 2 ^ (p - 1).factorization 2) ∣ (strongTestParams (p * q)).2 → + ((q - 1) / 2 ^ (q - 1).factorization 2) ∣ (strongTestParams (p * q)).2 → + (p - 1) / 2 ^ (p - 1).factorization 2 = (q - 1) / 2 ^ (q - 1).factorization 2 := by + classical + intro hdp_t hdq_t + let s := (p - 1).factorization 2 + let r := (q - 1).factorization 2 + let d_p : ℕ := (p - 1) / 2 ^ s + let d_q : ℕ := (q - 1) / 2 ^ r + let t : ℕ := (strongTestParams (p * q)).2 + have hp2 : 2 ≤ p := hp.two_le + have hq2 : 2 ≤ q := hq.two_le + have hpq1 : 1 < p * q := by + have h4 : 4 ≤ p * q := Nat.mul_le_mul hp2 hq2 + omega + have hdp : d_p ∣ t := by simpa [d_p, s, t] using hdp_t + have hdq : d_q ∣ t := by simpa [d_q, r, t] using hdq_t + have htpq : t ∣ p * q - 1 := by simpa [t] using strongTestParams_snd_dvd (n := p * q) hpq1 + have hdppq : d_p ∣ p * q - 1 := hdp.trans htpq + have hp_eq : p = 2 ^ s * d_p + 1 := by + have h1 : p - 1 = 2 ^ s * d_p := by + dsimp [d_p] + simpa [s] using (prime_sub_one_decomp hp) + omega + have hq_eq : q = 2 ^ r * d_q + 1 := by + have h1 : q - 1 = 2 ^ r * d_q := by + dsimp [d_q] + simpa [r] using (prime_sub_one_decomp hq) + omega + have hfac : p * q - 1 = d_p * (2 ^ (s + r) * d_q + 2 ^ s) + 2 ^ r * d_q := by + rw [hp_eq, hq_eq] + calc + (2 ^ s * d_p + 1) * (2 ^ r * d_q + 1) - 1 + = (2 ^ s * d_p) * (2 ^ r * d_q) + 2 ^ s * d_p + 2 ^ r * d_q + 1 - 1 := by + have h : (2 ^ s * d_p + 1) * (2 ^ r * d_q + 1) = + (2 ^ s * d_p) * (2 ^ r * d_q) + 2 ^ s * d_p + 2 ^ r * d_q + 1 := by ring + rw [h] + _ = (2 ^ s * d_p) * (2 ^ r * d_q) + 2 ^ s * d_p + 2 ^ r * d_q := by + rw [Nat.add_sub_cancel] + _ = 2 ^ (s + r) * (d_p * d_q) + 2 ^ s * d_p + 2 ^ r * d_q := by + rw [pow_mul_mul (s := s) (r := r)] + _ = d_p * (2 ^ (s + r) * d_q + 2 ^ s) + 2 ^ r * d_q := by ring + have hdvd_rest : d_p ∣ 2 ^ r * d_q := by + rw [hfac] at hdppq + have hdpk : d_p ∣ d_p * (2 ^ (s + r) * d_q + 2 ^ s) := dvd_mul_right _ _ + exact (Nat.dvd_add_iff_left hdpk).mpr (by simpa [add_comm] using hdppq) + have hdvd_dq : d_p ∣ d_q := by + have hodd_dp : Odd d_p := by + dsimp [d_p] + have hp1 : p - 1 ≠ 0 := by omega + simpa [s] using oddPart_odd (p - 1) hp1 + have hcop : d_p.Coprime (2 ^ r) := (Nat.coprime_two_right.mpr hodd_dp).pow_right r + exact hcop.dvd_of_dvd_mul_right (by simpa [mul_comm] using hdvd_rest) + have hdvd_dp : d_q ∣ d_p := by + have hdqq : d_q ∣ p * q - 1 := hdq.trans htpq + have hfac2 : p * q - 1 = d_q * (2 ^ (s + r) * d_p + 2 ^ r) + 2 ^ s * d_p := by + rw [hp_eq, hq_eq] + calc + (2 ^ s * d_p + 1) * (2 ^ r * d_q + 1) - 1 + = (2 ^ s * d_p) * (2 ^ r * d_q) + 2 ^ s * d_p + 2 ^ r * d_q + 1 - 1 := by + have h : (2 ^ s * d_p + 1) * (2 ^ r * d_q + 1) = + (2 ^ s * d_p) * (2 ^ r * d_q) + 2 ^ s * d_p + 2 ^ r * d_q + 1 := by ring + rw [h] + _ = (2 ^ s * d_p) * (2 ^ r * d_q) + 2 ^ s * d_p + 2 ^ r * d_q := by + rw [Nat.add_sub_cancel] + _ = 2 ^ (s + r) * (d_p * d_q) + 2 ^ s * d_p + 2 ^ r * d_q := by + rw [pow_mul_mul (s := s) (r := r)] + _ = d_q * (2 ^ (s + r) * d_p + 2 ^ r) + 2 ^ s * d_p := by ring + have hdvd_rest2 : d_q ∣ 2 ^ s * d_p := by + rw [hfac2] at hdqq + have hdqk : d_q ∣ d_q * (2 ^ (s + r) * d_p + 2 ^ r) := dvd_mul_right _ _ + exact (Nat.dvd_add_iff_left hdqk).mpr (by simpa [add_comm] using hdqq) + have hodd_dq : Odd d_q := by + dsimp [d_q] + have hq1 : q - 1 ≠ 0 := by omega + simpa [r] using oddPart_odd (q - 1) hq1 + have hcop : d_q.Coprime (2 ^ s) := (Nat.coprime_two_right.mpr hodd_dq).pow_right s + exact hcop.dvd_of_dvd_mul_right (by simpa [mul_comm] using hdvd_rest2) + exact Nat.dvd_antisymm hdvd_dq hdvd_dp + +/-- `8·gcd(m,p−1)·gcd(m,q−1) ≤ n−1` when `v₂(p−1) ≤ v₂(q−1)`. -/ +lemma semiprime_gcd_bound_sle {p q : ℕ} (hp : Nat.Prime p) (hq : Nat.Prime q) (hpq : p ≠ q) + (hp2 : p ≠ 2) (hq2 : q ≠ 2) + (hle : (p - 1).factorization 2 ≤ (q - 1).factorization 2) : + 8 * ((2 ^ (nu (p * q) - 1) * (strongTestParams (p * q)).2).gcd (p - 1)) * + ((2 ^ (nu (p * q) - 1) * (strongTestParams (p * q)).2).gcd (q - 1)) ≤ + p * q - 1 := by + classical + let s := (p - 1).factorization 2 + let r := (q - 1).factorization 2 + let ν := nu (p * q) + let t := (strongTestParams (p * q)).2 + let d_p := (p - 1) / 2 ^ s + let d_q := (q - 1) / 2 ^ r + let g_p := t.gcd d_p + let g_q := t.gcd d_q + have hν : ν = s := by + have hmin : nu (p * q) = min s r := by simpa [s, r] using nu_semiprime hp hq + omega + have hp3 : 3 ≤ p := by + have h2 := hp.two_le + omega + have hq3 : 3 ≤ q := by + have h2 := hq.two_le + omega + have hpodd : Odd p := (hp.odd_iff).mpr hp3 + have hqodd : Odd q := (hq.odd_iff).mpr hq3 + have ht : Odd t := by + dsimp [t] + exact strongTestParams_odd (n := p * q) (by + have h4 : 4 ≤ p * q := Nat.mul_le_mul hp.two_le hq.two_le + omega) + have hν1 : 1 ≤ ν := by + have hs1 : 1 ≤ s := by + dsimp [s] + exact (Nat.Prime.pow_dvd_iff_le_factorization (by decide : Nat.Prime 2) (by + have h2 := hp.two_le; omega)).1 (by + simpa using two_dvd_prime_sub_one_of_odd hp hpodd) + omega + have hodd_dp : Odd d_p := by + dsimp [d_p] + have hpp1 : p - 1 ≠ 0 := by + have h2 := hp.two_le + omega + simpa [s] using oddPart_odd (p - 1) hpp1 + have hodd_dq : Odd d_q := by + dsimp [d_q] + have hqq1 : q - 1 ≠ 0 := by + have h2 := hq.two_le + omega + simpa [r] using oddPart_odd (q - 1) hqq1 + have hdp : p - 1 = 2 ^ s * d_p := by + dsimp [d_p] + simpa [s] using prime_sub_one_decomp hp + have hdq : q - 1 = 2 ^ r * d_q := by + dsimp [d_q] + simpa [r] using prime_sub_one_decomp hq + have hgs : ν ≤ s := by omega + have hgr : ν ≤ r := by omega + have hga : (2 ^ (ν - 1) * t).gcd (p - 1) = 2 ^ (ν - 1) * g_p := by + rw [hdp] + dsimp [g_p] + exact gcd_pow_mul_oddPart (t := t) (s := s) (ν := ν) (d := d_p) hν1 hgs ht + have hgb : (2 ^ (ν - 1) * t).gcd (q - 1) = 2 ^ (ν - 1) * g_q := by + rw [hdq] + dsimp [g_q] + exact gcd_pow_mul_oddPart (t := t) (s := r) (ν := ν) (d := d_q) hν1 hgr ht + have hmain : 8 * (2 ^ (ν - 1) * g_p) * (2 ^ (ν - 1) * g_q) ≤ (p - 1) * (q - 1) := by + have hpow8 : 8 * (2 ^ (ν - 1) * g_p) * (2 ^ (ν - 1) * g_q) = 2 ^ (2 * ν + 1) * g_p * g_q := by + calc + 8 * (2 ^ (ν - 1) * g_p) * (2 ^ (ν - 1) * g_q) + = 8 * 2 ^ (ν - 1) * g_p * 2 ^ (ν - 1) * g_q := by ring + _ = 2 ^ 3 * 2 ^ (ν - 1) * 2 ^ (ν - 1) * g_p * g_q := by + rw [show 8 = 2 ^ 3 by norm_num] + ring + _ = 2 ^ (3 + (ν - 1) + (ν - 1)) * g_p * g_q := by + rw [← pow_add] + rw [← pow_add] + _ = 2 ^ (2 * ν + 1) * g_p * g_q := by + have hexp : 3 + (ν - 1) + (ν - 1) = 2 * ν + 1 := by + omega + rw [hexp] + rw [hpow8] + have htarget : 2 ^ (2 * ν + 1) * g_p * g_q ≤ 2 ^ (s + r) * (d_p * d_q) := by + rw [hν] + by_cases hsr : s = r + · have h2g : 2 * g_p * g_q ≤ d_p * d_q := by + have hnot : ¬ (g_p = d_p ∧ g_q = d_q) := by + intro hboth + rcases hboth with ⟨hg1, hg2⟩ + have hd1 : d_p ∣ t := by + rw [← hg1] + dsimp [g_p] + exact Nat.gcd_dvd_left t d_p + have hd2 : d_q ∣ t := by + rw [← hg2] + dsimp [g_q] + exact Nat.gcd_dvd_left t d_q + have hdeq : d_p = d_q := semiprime_key_lemma hp hq hpq hd1 hd2 + have hp_eq : p = q := by + have h1 : p - 1 = 2 ^ s * d_p := by + dsimp [d_p] + simpa [s] using prime_sub_one_decomp hp + have h2 : q - 1 = 2 ^ r * d_q := by + dsimp [d_q] + simpa [r] using prime_sub_one_decomp hq + have hsub : p - 1 = q - 1 := by + calc + p - 1 = 2 ^ s * d_p := h1 + _ = 2 ^ r * d_q := by rw [hsr, hdeq] + _ = q - 1 := h2.symm + omega + exact hpq hp_eq + have hprop : g_p ≠ d_p ∨ g_q ≠ d_q := by + by_contra hc + push Not at hc + exact hnot hc + have hg_p_dvd : g_p ∣ d_p := by dsimp [g_p]; exact Nat.gcd_dvd_right t d_p + have hg_q_dvd : g_q ∣ d_q := by dsimp [g_q]; exact Nat.gcd_dvd_right t d_q + have hd_p_pos : 0 < d_p := by + dsimp [d_p] + have hpp : 0 < p - 1 := by + have h2 := hp.two_le + omega + exact Nat.div_pos (Nat.le_of_dvd hpp (by + exact (Nat.Prime.pow_dvd_iff_le_factorization (by decide : Nat.Prime 2) (by + have h2 := hp.two_le; omega)).2 le_rfl)) (by norm_num : 0 < 2 ^ s) + have hd_q_pos : 0 < d_q := by + dsimp [d_q] + have hqq : 0 < q - 1 := by + have h2 := hq.two_le + omega + exact Nat.div_pos (Nat.le_of_dvd hqq (by + exact (Nat.Prime.pow_dvd_iff_le_factorization (by decide : Nat.Prime 2) (by + have h2 := hq.two_le; omega)).2 le_rfl)) (by norm_num : 0 < 2 ^ r) + rcases hprop with hne1 | hne2 + · have hlt1 : g_p < d_p := lt_of_le_of_ne (Nat.le_of_dvd hd_p_pos hg_p_dvd) hne1 + have h13 : g_p ≤ d_p / 3 := odd_divisor_le_div_three hodd_dp hg_p_dvd hne1 + have hq_le : g_q ≤ d_q := Nat.le_of_dvd hd_q_pos hg_q_dvd + have h23 : 2 * (d_p / 3) * d_q ≤ d_p * d_q := by + have h2 : 2 * (d_p / 3) ≤ d_p := by omega + exact Nat.mul_le_mul_right d_q h2 + calc + 2 * g_p * g_q ≤ 2 * (d_p / 3) * d_q := by + exact Nat.mul_le_mul (Nat.mul_le_mul_left 2 h13) hq_le + _ ≤ d_p * d_q := h23 + · have h23 : g_q ≤ d_q / 3 := odd_divisor_le_div_three hodd_dq hg_q_dvd hne2 + have hp_le : g_p ≤ d_p := Nat.le_of_dvd hd_p_pos hg_p_dvd + have h23' : 2 * (d_q / 3) * d_p ≤ d_q * d_p := by + have h2 : 2 * (d_q / 3) ≤ d_q := by omega + exact Nat.mul_le_mul_right d_p h2 + calc + 2 * g_p * g_q = 2 * g_q * g_p := by ring + _ ≤ 2 * (d_q / 3) * d_p := by + exact Nat.mul_le_mul (Nat.mul_le_mul_left 2 h23) hp_le + _ ≤ d_q * d_p := h23' + _ = d_p * d_q := by ring + calc + 2 ^ (2 * s + 1) * g_p * g_q = 2 ^ (s + r) * (2 * g_p * g_q) := by + rw [hsr] + rw [pow_add] + norm_num + ring + _ ≤ 2 ^ (s + r) * (d_p * d_q) := by + exact Nat.mul_le_mul_left (2 ^ (s + r)) h2g + · have hlt : s < r := lt_of_le_of_ne hle hsr + have hpow_le : 2 ^ (2 * s + 1) ≤ 2 ^ (s + r) := by + apply pow_le_pow_right₀ (by norm_num) + omega + have hg_p_le : g_p ≤ d_p := by + have hpp : 0 < d_p := by + dsimp [d_p] + have hpp' : 0 < p - 1 := by + have h2 := hp.two_le + omega + exact Nat.div_pos (Nat.le_of_dvd hpp' (by + exact (Nat.Prime.pow_dvd_iff_le_factorization (by decide : Nat.Prime 2) (by + have h2 := hp.two_le; omega)).2 le_rfl)) (by norm_num : 0 < 2 ^ s) + exact Nat.le_of_dvd hpp (by dsimp [g_p]; exact Nat.gcd_dvd_right t d_p) + have hg_q_le : g_q ≤ d_q := by + have hqq : 0 < d_q := by + dsimp [d_q] + have hqq' : 0 < q - 1 := by + have h2 := hq.two_le + omega + exact Nat.div_pos (Nat.le_of_dvd hqq' (by + exact (Nat.Prime.pow_dvd_iff_le_factorization (by decide : Nat.Prime 2) (by + have h2 := hq.two_le; omega)).2 le_rfl)) (by norm_num : 0 < 2 ^ r) + exact Nat.le_of_dvd hqq (by dsimp [g_q]; exact Nat.gcd_dvd_right t d_q) + calc + 2 ^ (2 * s + 1) * g_p * g_q ≤ 2 ^ (s + r) * d_p * d_q := by + exact Nat.mul_le_mul (Nat.mul_le_mul hpow_le hg_p_le) hg_q_le + _ = 2 ^ (s + r) * (d_p * d_q) := by ring + calc + 2 ^ (2 * ν + 1) * g_p * g_q ≤ 2 ^ (s + r) * (d_p * d_q) := htarget + _ = (p - 1) * (q - 1) := by + rw [hdp, hdq] + rw [pow_mul_mul (s := s) (r := r)] + calc + 8 * ((2 ^ (ν - 1) * t).gcd (p - 1)) * ((2 ^ (ν - 1) * t).gcd (q - 1)) + = 8 * (2 ^ (ν - 1) * g_p) * (2 ^ (ν - 1) * g_q) := by rw [hga, hgb] + _ ≤ (p - 1) * (q - 1) := hmain + _ ≤ p * q - 1 := prod_sub_one_le hp3 hq3 + +/-- `8·gcd(m,p−1)·gcd(m,q−1) ≤ n−1` for `n` with `n.primeFactors = {p,q}`. -/ +lemma semiprime_gcd_bound {p q : ℕ} (hp : Nat.Prime p) (hq : Nat.Prime q) (hpq : p ≠ q) + (hp2 : p ≠ 2) (hq2 : q ≠ 2) : + 8 * ((2 ^ (nu (p * q) - 1) * (strongTestParams (p * q)).2).gcd (p - 1)) * + ((2 ^ (nu (p * q) - 1) * (strongTestParams (p * q)).2).gcd (q - 1)) ≤ + p * q - 1 := by + by_cases hle : (p - 1).factorization 2 ≤ (q - 1).factorization 2 + · exact semiprime_gcd_bound_sle hp hq hpq hp2 hq2 hle + · have hle' : (q - 1).factorization 2 ≤ (p - 1).factorization 2 := by omega + have hmain := semiprime_gcd_bound_sle (p := q) (q := p) hq hp (Ne.symm hpq) hq2 hp2 hle' + simpa [mul_comm, mul_left_comm, mul_assoc] using hmain + + + + +/-- For primes `p, q ≥ 3`, `2·(p−1)(q−1) ≤ p²q−1`. -/ +lemma crude_bound {p q : ℕ} (hp3 : 3 ≤ p) (hq3 : 3 ≤ q) : 2 * (p - 1) * (q - 1) ≤ p ^ 2 * q - 1 := by + have hpq_le : (p - 1) * (q - 1) ≤ p * q := Nat.mul_le_mul (Nat.sub_le _ _) (Nat.sub_le _ _) + have h2pq : 2 * (p * q) ≤ p ^ 2 * q - 1 := by + have h1pq : 1 ≤ (p - 2) * (p * q) := by + have hp2 : 1 ≤ p - 2 := by omega + have hpqpos : 1 ≤ p * q := by + have h9 : 9 ≤ p * q := Nat.mul_le_mul hp3 hq3 + omega + have hmul : 1 * 1 ≤ (p - 2) * (p * q) := Nat.mul_le_mul hp2 hpqpos + simpa using hmul + have h'' : 1 ≤ p ^ 2 * q - 2 * (p * q) := by + rw [Nat.mul_sub_right_distrib] at h1pq + simpa [pow_two, Nat.mul_assoc] using h1pq + have hgoal : 2 * (p * q) + 1 ≤ p ^ 2 * q := by omega + omega + calc + 2 * (p - 1) * (q - 1) = 2 * ((p - 1) * (q - 1)) := by ring + _ ≤ 2 * (p * q) := Nat.mul_le_mul_left 2 hpq_le + _ ≤ p ^ 2 * q - 1 := h2pq + +/-- For primes `p, q ≥ 3`, `2·(p−1)(q−1) ≤ p·q²−1`. -/ +lemma crude_bound' {p q : ℕ} (hp3 : 3 ≤ p) (hq3 : 3 ≤ q) : 2 * (p - 1) * (q - 1) ≤ p * q ^ 2 - 1 := by + have hpq_le : (p - 1) * (q - 1) ≤ p * q := Nat.mul_le_mul (Nat.sub_le _ _) (Nat.sub_le _ _) + have h2pq : 2 * (p * q) ≤ p * q ^ 2 - 1 := by + have h1pq : 1 ≤ (q - 2) * (p * q) := by + have hq2 : 1 ≤ q - 2 := by omega + have hpqpos : 1 ≤ p * q := by + have h9 : 9 ≤ p * q := Nat.mul_le_mul hp3 hq3 + omega + have hmul : 1 * 1 ≤ (q - 2) * (p * q) := Nat.mul_le_mul hq2 hpqpos + simpa using hmul + have h'' : 1 ≤ p * q ^ 2 - 2 * (p * q) := by + rw [Nat.mul_sub_right_distrib] at h1pq + simpa [pow_two, Nat.mul_assoc, Nat.mul_comm, Nat.mul_left_comm] using h1pq + have hgoal : 2 * (p * q) + 1 ≤ p * q ^ 2 := by omega + omega + calc + 2 * (p - 1) * (q - 1) = 2 * ((p - 1) * (q - 1)) := by ring + _ ≤ 2 * (p * q) := Nat.mul_le_mul_left 2 hpq_le + _ ≤ p * q ^ 2 - 1 := h2pq + +/-- For `n` with exactly two distinct prime factors, `|S(n)| ≤ (n−1)/4`. -/ +lemma goodUnits_card_le_semiprime {n : ℕ} [NeZero n] (hn1 : 1 < n) (hn_odd : Odd n) + (hk : n.primeFactors.card = 2) : + Nat.card {x : (ZMod n)ˣ // x ∈ goodUnits} ≤ (n - 1) / 4 := by + rcases Finset.card_eq_two.mp hk with ⟨p, q, hpq_ne, hpq⟩ + have hp_mem : p ∈ n.primeFactors := by rw [hpq]; simp + have hq_mem : q ∈ n.primeFactors := by rw [hpq]; simp + have hp : Nat.Prime p := Nat.prime_of_mem_primeFactors hp_mem + have hq : Nat.Prime q := Nat.prime_of_mem_primeFactors hq_mem + have hp_ne2 : p ≠ 2 := by + intro h2 + have hpdvd : p ∣ n := Nat.dvd_of_mem_primeFactors hp_mem + have hpodd : Odd p := odd_of_dvd_odd hn_odd hpdvd + rw [h2] at hpodd + norm_num at hpodd + have hq_ne2 : q ≠ 2 := by + intro h2 + have hqdvd : q ∣ n := Nat.dvd_of_mem_primeFactors hq_mem + have hqodd : Odd q := odd_of_dvd_odd hn_odd hqdvd + rw [h2] at hqodd + norm_num at hqodd + have hne : n = p ^ (n.factorization p) * q ^ (n.factorization q) := by + conv_lhs => rw [Nat.prod_pow_primeFactors_factorization (by omega : n ≠ 0)] + exact prod_primeFactors_pair hpq hpq_ne (fun x : ℕ => x ^ (n.factorization x)) + let a := n.factorization p + let b := n.factorization q + have ha : 1 ≤ a := hp.factorization_pos_of_dvd (by omega) (Nat.dvd_of_mem_primeFactors hp_mem) + have hb : 1 ≤ b := hq.factorization_pos_of_dvd (by omega) (Nat.dvd_of_mem_primeFactors hq_mem) + have hp2le : 2 ≤ p := hp.two_le + have hq2le : 2 ≤ q := hq.two_le + have hp3 : 3 ≤ p := by omega + have hq3 : 3 ≤ q := by omega + by_cases hsq : a = 1 ∧ b = 1 + · have hnpq : n = p * q := by + rw [hne] + change p ^ a * q ^ b = p * q + rw [hsq.1, hsq.2] + simp + let m := 2 ^ (nu n - 1) * (strongTestParams n).2 + have hmTorsion : Nat.card {x : (ZMod n)ˣ // x ^ m = 1} = m.gcd (p - 1) * m.gcd (q - 1) := by + rw [mTorsion_eq_prod (n := n) (by omega : n ≠ 0) hn_odd] + rw [prod_primeFactors_pair hpq hpq_ne (fun x : ℕ => m.gcd (Nat.totient (x ^ (n.factorization x))))] + have hpm : m.Coprime p := by simpa [m] using mExp_coprime_prime (n := n) hn1 hn_odd hp_mem + have hqm : m.Coprime q := by simpa [m] using mExp_coprime_prime (n := n) hn1 hn_odd hq_mem + rw [gcd_totient_eq_gcd_prime hp (by omega : 0 < a) hpm, gcd_totient_eq_gcd_prime hq (by omega : 0 < b) hqm] + have hS : Nat.card {x : (ZMod n)ˣ // x ∈ goodUnits} ≤ 2 * m.gcd (p - 1) * m.gcd (q - 1) := by + unfold goodUnits + calc + Nat.card {x : (ZMod n)ˣ // x ∈ goodSet m} ≤ 2 * Nat.card {x : (ZMod n)ˣ // x ^ m = 1} := + goodSet_card_le (n := n) m + _ = 2 * (m.gcd (p - 1) * m.gcd (q - 1)) := by rw [hmTorsion] + _ = 2 * m.gcd (p - 1) * m.gcd (q - 1) := by ring + have hb8 : 8 * m.gcd (p - 1) * m.gcd (q - 1) ≤ n - 1 := by + have hb' := semiprime_gcd_bound (p := p) (q := q) hp hq hpq_ne hp_ne2 hq_ne2 + rw [← hnpq] at hb' + simpa [m] using hb' + have h4 : 4 * Nat.card {x : (ZMod n)ˣ // x ∈ goodUnits} ≤ n - 1 := by + calc + 4 * Nat.card {x : (ZMod n)ˣ // x ∈ goodUnits} ≤ 4 * (2 * m.gcd (p - 1) * m.gcd (q - 1)) := by + exact Nat.mul_le_mul_left 4 hS + _ = 8 * m.gcd (p - 1) * m.gcd (q - 1) := by ring + _ ≤ n - 1 := hb8 + exact (Nat.le_div_iff_mul_le (by norm_num : 0 < 4)).mpr (by simpa [mul_comm] using h4) + · have hnsq : 2 ≤ a ∨ 2 ≤ b := by omega + have hS' : Nat.card {x : (ZMod n)ˣ // x ∈ goodUnits} ≤ 2 * ((p - 1) / 2) * ((q - 1) / 2) := by + calc + Nat.card {x : (ZMod n)ˣ // x ∈ goodUnits} ≤ 2 * ∏ x : n.primeFactors, ((x : ℕ) - 1) / 2 := + goodUnits_card_le_prodHalf (n := n) hn1 hn_odd + _ = 2 * (((p - 1) / 2) * ((q - 1) / 2)) := by + rw [prod_primeFactors_pair hpq hpq_ne (fun x : ℕ => (x - 1) / 2)] + _ = 2 * ((p - 1) / 2) * ((q - 1) / 2) := by ring + have h8 : 8 * ((p - 1) / 2) * ((q - 1) / 2) ≤ n - 1 := by + have hp_even : 2 ∣ p - 1 := two_dvd_prime_sub_one_of_odd hp (by + have hpdvd : p ∣ n := Nat.dvd_of_mem_primeFactors hp_mem + exact odd_of_dvd_odd hn_odd hpdvd) + have hq_even : 2 ∣ q - 1 := two_dvd_prime_sub_one_of_odd hq (by + have hqdvd : q ∣ n := Nat.dvd_of_mem_primeFactors hq_mem + exact odd_of_dvd_odd hn_odd hqdvd) + have h8eq : 8 * ((p - 1) / 2) * ((q - 1) / 2) = 2 * (p - 1) * (q - 1) := by + calc + 8 * ((p - 1) / 2) * ((q - 1) / 2) = 2 * (2 * ((p - 1) / 2)) * (2 * ((q - 1) / 2)) := by ring + _ = 2 * (p - 1) * (q - 1) := by rw [Nat.mul_div_cancel' hp_even, Nat.mul_div_cancel' hq_even] + rw [h8eq] + rcases hnsq with ha2 | hb2 + · have hp2_n : p ^ 2 * q ≤ n := by + rw [hne] + have hp2a : p ^ 2 ≤ p ^ a := pow_le_pow_right₀ (by omega) ha2 + have hq1b : q ≤ q ^ b := le_self_pow (by omega) (by omega : b ≠ 0) + exact Nat.mul_le_mul hp2a hq1b + exact (crude_bound hp3 hq3).trans (by omega) + · have hq2_n : p * q ^ 2 ≤ n := by + rw [hne] + have hp1a : p ≤ p ^ a := le_self_pow (by omega) (by omega : a ≠ 0) + have hq2b : q ^ 2 ≤ q ^ b := pow_le_pow_right₀ (by omega) hb2 + exact Nat.mul_le_mul hp1a hq2b + exact (crude_bound' hp3 hq3).trans (by omega) + have h4 : 4 * Nat.card {x : (ZMod n)ˣ // x ∈ goodUnits} ≤ n - 1 := by + calc + 4 * Nat.card {x : (ZMod n)ˣ // x ∈ goodUnits} ≤ 4 * (2 * ((p - 1) / 2) * ((q - 1) / 2)) := by + exact Nat.mul_le_mul_left 4 hS' + _ = 8 * ((p - 1) / 2) * ((q - 1) / 2) := by ring + _ ≤ n - 1 := h8 + exact (Nat.le_div_iff_mul_le (by norm_num : 0 < 4)).mpr (by simpa [mul_comm] using h4) + + +/-- +The good subgroup `S(n)` has size at most `(n−1)/4` for odd composite +`n` (Rabin–Monier). The proof splits on the number `k` of distinct +prime factors: `k = 1` (prime power), `k = 2` (semiprime), and +`k ≥ 3`. +-/ +theorem goodUnits_card_le {n : ℕ} [NeZero n] (hn1 : 1 < n) (hn_odd : Odd n) + (hn_comp : ¬ Nat.Prime n) : + Nat.card {x : (ZMod n)ˣ // x ∈ goodUnits} ≤ (n - 1) / 4 := by + have hcard : 1 ≤ n.primeFactors.card := by + have hpos : 0 < n.primeFactors.card := + (Finset.card_pos).mpr ((Nat.nonempty_primeFactors).2 hn1) + omega + have hcases : n.primeFactors.card = 1 ∨ n.primeFactors.card = 2 ∨ + 3 ≤ n.primeFactors.card := by + omega + rcases hcases with h1 | h2 | h3 + · exact goodUnits_card_le_prime_power (n := n) hn1 hn_odd hn_comp h1 + · exact goodUnits_card_le_semiprime (n := n) hn1 hn_odd h2 + · exact goodUnits_card_le_of_ge_three (n := n) hn1 hn_odd h3 + +/-- +**The Miller-Rabin error bound (Theorem 31.38; Rabin–Monier).** For odd +composite `n`, at most `(n−1)/4` of the bases in `(Z/nZ)ˣ` are strong liars. +Every strong liar lies in the good subgroup `S(n)` (`liar_mem_goodSet`), and +`|S(n)| ≤ (n−1)/4` (`goodUnits_card_le`). +-/ +theorem strongLiars_card_le {n : ℕ} [NeZero n] (hn1 : 1 < n) (hn_odd : Odd n) + (hn_comp : ¬ Nat.Prime n) : + Nat.card {a : (ZMod n)ˣ // isStrongLiar a} ≤ (n - 1) / 4 := by + have hle : Nat.card {a : (ZMod n)ˣ // isStrongLiar a} ≤ + Nat.card {a : (ZMod n)ˣ // a ∈ goodUnits} := by + refine Nat.card_le_card_of_injective + (fun a : {a : (ZMod n)ˣ // isStrongLiar a} => ⟨(a : (ZMod n)ˣ), + liar_mem_goodSet (n := n) hn_odd hn1 a.2⟩) ?_ + intro a b h + exact Subtype.ext (by simpa using congrArg Subtype.val h) + exact hle.trans (goodUnits_card_le (n := n) hn1 hn_odd hn_comp) + end Chapter31 end CLRS diff --git a/CLRSLean/Progress.lean b/CLRSLean/Progress.lean index 4c481c6..8b1a65f 100644 --- a/CLRSLean/Progress.lean +++ b/CLRSLean/Progress.lean @@ -10,8 +10,8 @@ When the CSV changes, regenerate this page with * CLRS chapters tracked: 35. * Chapters represented in Lean: 32. -* Tracked reader-facing theorem entries: 1758. -* Proved tracked theorem entries: 1758. +* Tracked reader-facing theorem entries: 1760. +* Proved tracked theorem entries: 1760. * Remaining core theorem groups: 4. Tracked theorem entries count the public theorem groups currently represented @@ -62,7 +62,7 @@ Ch Chapter Status 28 28. Matrix Operations main-proof-complete 28.1;28.2;28.3 9 0 29 29. Linear Programming main-proof-complete 29.1;29.2;29.3;29.4;29.5 17 0 30 30. Polynomials and the FFT not-started not represented 0 1 -31 31. Number-Theoretic Algorithms selected-section-complete 31.1;31.2;31.3;31.4;31.5;31. 27 0 +31 31. Number-Theoretic Algorithms selected-section-complete 31.1;31.2;31.3;31.4;31.5;31. 29 0 32 32. String Matching selected-section-complete 32.1 19 0 33 33. Computational Geometry partial 33.1 7 1 34 34. NP-Completeness not-started not represented 0 1 diff --git a/docs/clrs-proof-progress.csv b/docs/clrs-proof-progress.csv index 00875df..f001479 100644 --- a/docs/clrs-proof-progress.csv +++ b/docs/clrs-proof-progress.csv @@ -29,7 +29,7 @@ chapter_no,chapter_title,repo_status,represented_sections,tracked_key_theorems,p 28,Matrix Operations,main-proof-complete,28.1;28.2;28.3,9,9,0,"Sections 28.1 (LUP decomposition and solving, Theorems 28.1-28.2, Lemmas 28.1-28.2), 28.2 (inversion), and 28.3 (SPD, Cholesky, least squares) are complete. Section 28.1 proves the LUP decomposition, the constructive forward/back substitution lemmas with LUP-SOLVE, uniqueness of solutions, the determinant-via-LUP corollary, and the CLRS running-time bounds (LUP-SOLVE Theta(n^2), LUP/inversion/Cholesky Theta(n^3)). Section 28.3 proves the Cholesky decomposition (Theorem 28.3) and its uniqueness, and the least-squares minimization theorem (Theorem 28.4).",exists_lup_decomposition (Theorem 28.1); forwardSubst_spec (Lemma 28.1); backSubst_spec (Lemma 28.2); lupSolve_correct (LUP-SOLVE); inv_eq_lup (Theorem 28.2); cholesky_decomposition (Theorem 28.3); cholesky_unique; normal_equations_minimizes (Theorem 28.4); det_eq_sign_mul_det_of_lup (Corollary to Thm 28.1),None,CLRSLean/Chapter_28.lean; CLRSLean/Chapter_28/Section_28_1_Linear_Equations.lean; CLRSLean/Chapter_28/Section_28_2_Inverting_Matrices.lean; CLRSLean/Chapter_28/Section_28_3_Symmetric_Positive_Definite.lean,"Sections 28.1-28.3 are complete: LUP decomposition and solving (Theorems 28.1-28.2, Lemmas 28.1-28.2, Algorithm LUP-SOLVE), the det-via-LUP corollary, matrix inversion, the Cholesky decomposition (Theorem 28.3) with uniqueness, least-squares approximation (Theorem 28.4), and the CLRS running-time cost bounds." 29,Linear Programming,main-proof-complete,29.1;29.2;29.3;29.4;29.5,17,17,0,"The Chapter 29 main text is complete at the finite real-matrix and pure-functional tableau layer: all textbook formulations, terminating initialized SIMPLEX, strong duality, and complementary slackness are kernel-checked",isFeasible_iff_exists_slackExtension; shortest-path LP lower-bound and attained-optimum theorems; maximum-flow LP equivalence; minimum-cost-flow LP equivalence; multicommodity-flow LP equivalence; dictionary/basic-solution and exact PIVOT semantics; deterministic Bland selectors and three-way simplexStep; optimal and unbounded exit correctness; bland_no_repeated_basis; simplexRun_basisCount_not_exhausted and simplex_optimal_or_unbounded; weak_duality (Theorem 29.8); terminal dictionary dual certificate; phase-I feasibility criterion; initializedSimplex_complete; strongDuality (Theorem 29.9); complementarySlackness_iff_optimal (Theorem 29.10),"Mutable tableau storage, floating-point numerical analysis, RAM constants, exercises, and chapter-end problems are optional refinements",CLRSLean/Chapter_29.lean; CLRSLean/Chapter_29/Section_29_1_Standard_And_Slack_Forms.lean; CLRSLean/Chapter_29/Section_29_2_Formulating_Problems_As_Linear_Programs.lean; CLRSLean/Chapter_29/Section_29_3_The_Simplex_Algorithm.lean; CLRSLean/Chapter_29/Section_29_4_Duality.lean; CLRSLean/Chapter_29/Section_29_5_The_Initial_Basic_Feasible_Solution.lean; Tests/Chapter_29_Interface.lean; Tests/Chapter_29_Formulations_Interface.lean; Tests/Chapter_29_Simplex_Interface.lean; Tests/Chapter_29_Initialization_Interface.lean; Tests/Chapter_29_Closure.lean; docs/proof-audits/chapter-29-closure-2026-08-05.md,The phase-I cleanup uses an equivalent fixed-dimension lock x₀ ≤ 0 together with x₀ ≥ 0 instead of physically deleting the artificial variable; this preserves exactly the original feasible assignments and supports the complete general strong-duality proof. 30,Polynomials and the FFT,not-started,None,0,0,1,Not represented,No tracked theorem names yet,Whole chapter theorem inventory and formalization pending,CLRSLean file tree,No Chapter_30 module exists. -31,Number-Theoretic Algorithms,selected-section-complete,31.1;31.2;31.3;31.4;31.5;31.6;31.7;31.8;31.9,27,27,0,"Sections 31.1-31.9 (number-theoretic algorithms) are complete: divisibility and the division theorem; the gcd, Euclid and extended-Euclid; modular arithmetic; linear congruences; the Chinese remainder theorem; powers of an element (Fermat and Euler); RSA; primality testing; and Pollard-s-rho factorization.",division_theorem (Theorem 31.1); euclid_recursion (Lemma 31.2); gcd_is_linear_combination (Lemma 31.3); gcd_is_smallest_positive_linear_combination (Theorem 31.2); exists_mul_inverse_mod (Theorem 31.6); modular_linear_solvable (Theorem 31.11); linear_congruence_solutions (Theorem 31.10); chinese_remainder (Theorem 31.27); chinese_remainder_general (Theorem 31.27); fermat_little_theorem (Theorem 31.30); euler_theorem; rsa_correct (Theorem 31.36); rsa_correct_general (Theorem 31.36); fermat_test (Theorem 31.31); rho_collision_factor; fib_le_of_euclidDivisions (Lemma 31.10); euclidDivisions_lt (Theorem 31.11); euclidDivisions_le_two_log (Corollary 31.12); isCarmichael; isCarmichael_561; strongPseudoprime_of_prime; witness_not_prime; pollardRho_sound,"the Miller-Rabin error bound, and the Pollard-s-rho birthday-paradox probabilistic analysis (see chapter guide)",CLRSLean/Chapter_31.lean; CLRSLean/Chapter_31/Section_31_1_Elementary_Number_Theory.lean; CLRSLean/Chapter_31/Section_31_2_Greatest_Common_Divisor.lean; CLRSLean/Chapter_31/Section_31_3_Modular_Arithmetic.lean; CLRSLean/Chapter_31/Section_31_4_Solving_Modular_Linear_Equations.lean; CLRSLean/Chapter_31/Section_31_5_Chinese_Remainder_Theorem.lean; CLRSLean/Chapter_31/Section_31_6_Powers_Of_An_Element.lean; CLRSLean/Chapter_31/Section_31_7_RSA.lean; CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean; CLRSLean/Chapter_31/Section_31_9_Integer_Factorization.lean,"Sections 31.1-31.9 fully proved, including the Lamé running-time analysis of EUCLID (Lemmas 31.10 and Theorem 31.11, Corollary 31.12), Carmichael numbers (isCarmichael, 561), and Miller-Rabin correctness (strongPseudoprime_of_prime: a prime passes every base; witness_not_prime: a witness certifies compositeness); the Miller-Rabin error bound and the Pollard-s-rho birthday-paradox probabilistic analysis are deferred." +31,Number-Theoretic Algorithms,selected-section-complete,31.1;31.2;31.3;31.4;31.5;31.6;31.7;31.8;31.9,29,29,0,"Sections 31.1-31.9 (number-theoretic algorithms) are complete: divisibility and the division theorem; the gcd, Euclid and extended-Euclid; modular arithmetic; linear congruences; the Chinese remainder theorem; powers of an element (Fermat and Euler); RSA; primality testing; and Pollard-s-rho factorization.",division_theorem (Theorem 31.1); euclid_recursion (Lemma 31.2); gcd_is_linear_combination (Lemma 31.3); gcd_is_smallest_positive_linear_combination (Theorem 31.2); exists_mul_inverse_mod (Theorem 31.6); modular_linear_solvable (Theorem 31.11); linear_congruence_solutions (Theorem 31.10); chinese_remainder (Theorem 31.27); chinese_remainder_general (Theorem 31.27); fermat_little_theorem (Theorem 31.30); euler_theorem; rsa_correct (Theorem 31.36); rsa_correct_general (Theorem 31.36); fermat_test (Theorem 31.31); rho_collision_factor; fib_le_of_euclidDivisions (Lemma 31.10); euclidDivisions_lt (Theorem 31.11); euclidDivisions_le_two_log (Corollary 31.12); isCarmichael; isCarmichael_561; strongPseudoprime_of_prime; witness_not_prime; pollardRho_sound; goodUnits_card_le; strongLiars_card_le,the Pollard-s-rho birthday-paradox probabilistic analysis (see chapter guide),CLRSLean/Chapter_31.lean; CLRSLean/Chapter_31/Section_31_1_Elementary_Number_Theory.lean; CLRSLean/Chapter_31/Section_31_2_Greatest_Common_Divisor.lean; CLRSLean/Chapter_31/Section_31_3_Modular_Arithmetic.lean; CLRSLean/Chapter_31/Section_31_4_Solving_Modular_Linear_Equations.lean; CLRSLean/Chapter_31/Section_31_5_Chinese_Remainder_Theorem.lean; CLRSLean/Chapter_31/Section_31_6_Powers_Of_An_Element.lean; CLRSLean/Chapter_31/Section_31_7_RSA.lean; CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean; CLRSLean/Chapter_31/Section_31_9_Integer_Factorization.lean,"Sections 31.1-31.9 fully proved, including the Lamé running-time analysis of EUCLID (Lemmas 31.10 and Theorem 31.11, Corollary 31.12), Carmichael numbers (isCarmichael, 561), and Miller-Rabin correctness (strongPseudoprime_of_prime: a prime passes every base; witness_not_prime: a witness certifies compositeness); the Pollard-s-rho birthday-paradox probabilistic analysis is deferred." 32,String Matching,selected-section-complete,32.1,19,19,0,Section 32.1 fully proved,String model (14 lemmas); naiveMatcher soundness/completeness (5 theorems),Rabin-Karp hash proofs; finite-automaton construction; KMP prefix-function correctness,CLRSLean/Chapter_32.lean; CLRSLean/Chapter_32/Section_32_1_String_Model.lean; CLRSLean/Chapter_32/Section_32_1_String_Model/Naive_Matcher.lean,All 19 theorems are kernel-checked. Sections 32.2-32.4 deferred. Original formalization by caiwei2026 (PR #85). 33,Computational Geometry,partial,33.1,7,7,1,Section 33.1 definitions plus cross-product algebra and orientation specification are represented,Six cross-product algebra theorems; orientation_spec,Prove segmentIntersect soundness and completeness against an independent geometric-intersection specification including shared-endpoint cases; Sections 33.2-33.4 remain unrepresented,CLRSLean/Chapter_33.lean; CLRSLean/Chapter_33/Section_33_1_Line_Segment_Properties.lean,All 7 tracked theorems are kernel-checked but segmentIntersect bboxIntersect and sharesEndpoint currently have definitions without correctness theorems. 34,NP-Completeness,not-started,None,0,0,1,Not represented,No tracked theorem names yet,Whole chapter theorem inventory and formalization pending,CLRSLean file tree,No Chapter_34 module exists. diff --git a/docs/proof-map.md b/docs/proof-map.md index 3b07e2c..3cc506f 100644 --- a/docs/proof-map.md +++ b/docs/proof-map.md @@ -4293,7 +4293,16 @@ No core proof group remains within the selected milestone. Sections 26.4 and `modeq_neg_one_of_sq_eq_one` (`x² ≡ 1`, `x ≢ 1` mod prime ⇒ `x ≡ −1`). `not_witness_of_prime` (a prime has no witness) and `witness_not_prime` (a witness certifies compositeness) follow. - - Deferred: the Miller-Rabin error bound, and the random-witness analysis. + - **Miller-Rabin error bound (Rabin–Monier)**: the good subgroup + `goodUnits` = `{x : x^(2^(ν(n)−1)·t) ∈ {±1}}`, with `liar_mem_goodSet` + showing every strong liar lies in it. Counting `|S(n)|` via the cyclicity + of prime-power unit groups and the CRT (`card_pow_eq_one_crt`, + `mTorsion_eq_prod`), `goodUnits_card_le` bounds `|S(n)| ≤ (n−1)/4` by the + three-case analysis: prime power (`n = p^e`), semiprime (`n = p·q`, with + the `s < r` / `s = r` sub-cases and the key lemma that `d_p | t ∧ d_q | t` + forces `p = q`), and `≥ 3` prime factors. Hence `strongLiars_card_le`: + **at most `(n−1)/4` of the bases are strong liars for odd composite `n`** + (Theorem 31.38). Deferred: the random-witness analysis. ### Section 31.9 - Integer Factorization From 777bc522822b5f7f218d4b54b1fc99d98d4b5870 Mon Sep 17 00:00:00 2001 From: TankTechnology <2541826291@qq.com> Date: Thu, 6 Aug 2026 12:05:57 +0800 Subject: [PATCH 23/24] docs(ch31): align theorem references with CLRS 4th edition MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The project base is now the CLRS 4th edition, which renumbered several results in Chapter 31. Verified against the 4th-edition text: - Miller-Rabin error bound: Theorem 31.38 -> Theorem 31.39 (the witnesses >= (n-1)/2 theorem; (n-1)/4 is its Rabin-Monier sharpening). - Fermat's little theorem: Theorem 31.30 -> Theorem 31.31; Euler's theorem is Theorem 31.30. - Modular-linear solvability: Theorem 31.11 -> Corollary 31.21; the distinct-solutions count is Corollary 31.22. - Euclid recursion: Lemma 31.2 -> Theorem 31.9 (GCD recursion theorem). - Fixed the handoff doc title typo ("Theorem 31.8" -> 31.39). - Noted that the 4th edition removed Section 31.9 (integer factorization); the POLLARD-RHO file is retained pending the repo-wide migration. The §31.1-31.3 references (mod_add, exists_mul_inverse_mod, mul_left_cancel_mod, gcd_is_linear_combination) remain on their legacy numbers pending the repo-wide 4th-edition migration. Co-Authored-By: Claude --- CLRSLean/Chapter_31.lean | 14 ++++++++++---- .../Chapter_31/Section_31_8_Primality_Testing.lean | 13 ++++++++----- docs/ch31-error-bound-handoff.md | 4 ++-- docs/clrs-proof-progress.csv | 2 +- docs/proof-map.md | 12 +++++++----- 5 files changed, 28 insertions(+), 17 deletions(-) diff --git a/CLRSLean/Chapter_31.lean b/CLRSLean/Chapter_31.lean index 16cd2ca..100b0e6 100644 --- a/CLRSLean/Chapter_31.lean +++ b/CLRSLean/Chapter_31.lean @@ -30,7 +30,8 @@ primality test, and the Pollard's-rho factorization heuristic. ### 31.2 Greatest Common Divisor -* {lit}`CLRS.Chapter31.euclid_recursion` (Lemma 31.2), +* {lit}`CLRS.Chapter31.euclid_recursion` (Theorem 31.9, the GCD recursion + theorem), {lit}`CLRS.Chapter31.euclid` + {lit}`CLRS.Chapter31.euclid_eq_gcd`, {lit}`CLRS.Chapter31.gcd_is_linear_combination` (Lemma 31.3, Bezout), {lit}`CLRS.Chapter31.gcd_is_smallest_positive_linear_combination` @@ -50,7 +51,7 @@ primality test, and the Pollard's-rho factorization heuristic. * {lit}`CLRS.Chapter31.mod_add` / `mod_mul` (Theorem 31.5), {lit}`CLRS.Chapter31.exists_mul_inverse_mod` (Theorem 31.6), {lit}`CLRS.Chapter31.mul_left_cancel_mod` (Theorem 31.9), and - {lit}`CLRS.Chapter31.modular_linear_solvable` (Theorem 31.11). + {lit}`CLRS.Chapter31.modular_linear_solvable` (Corollary 31.21). ### 31.4 Solving Modular Linear Equations @@ -67,7 +68,7 @@ primality test, and the Pollard's-rho factorization heuristic. ### 31.6 Powers of an Element * {lit}`CLRS.Chapter31.modularExponentiation` + `modularExponentiation_spec`, - {lit}`CLRS.Chapter31.fermat_little_theorem` (Theorem 31.30), and + {lit}`CLRS.Chapter31.fermat_little_theorem` (Theorem 31.31), and {lit}`CLRS.Chapter31.euler_theorem`. ### 31.7 The RSA Public-Key Cryptosystem @@ -100,10 +101,15 @@ primality test, and the Pollard's-rho factorization heuristic. {lit}`CLRS.Chapter31.goodUnits_card_le` proves `|S(n)| ≤ (n−1)/4` (three cases: prime power, semiprime, and ≥3 prime factors), giving {lit}`CLRS.Chapter31.strongLiars_card_le` — **at most `(n−1)/4` of the - bases are strong liars** (Theorem 31.38). + bases are strong liars** (Theorem 31.39, sharpened to `(n−1)/4` by + Rabin–Monier). ### 31.9 Integer Factorization +> ⚠️ **CLRS 4th edition removed this section** (integer factorization is no +> longer in the main text of Chapter 31). The POLLARD-RHO formalization is +> retained for reference; a repo-wide migration will decide its fate. + * {lit}`CLRS.Chapter31.rhoStep` and {lit}`CLRS.Chapter31.rho_collision_factor` (Pollard's rho). * **POLLARD-RHO**: {lit}`CLRS.Chapter31.RhoState` (tortoise-and-hare state), diff --git a/CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean b/CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean index b2a4cc3..d1c04ed 100644 --- a/CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean +++ b/CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean @@ -48,7 +48,8 @@ Main results: under the power map); and {lit}`liar_mem_goodSet` shows **every strong liar lies in `S(n)`** via the order-of-element parity lemma {lit}`two_pow_succ_dvd_orderOf` applied modulo each prime divisor. -- **The Miller-Rabin error bound (Theorem 31.38; Rabin–Monier)**: counting +- **The Miller-Rabin error bound (Theorem 31.39, sharpened to `(n−1)/4` by + Rabin–Monier)**: counting `|S(n)|` via the cyclicity of prime-power unit groups and the CRT, then bounding `|S(n)| ≤ (n−1)/4` by the three-case Rabin–Monier analysis. Theorems {lit}`goodUnits_card_le` (the subgroup bound, split into prime @@ -402,8 +403,9 @@ theorem strongPseudoprime_pow {n a : ℕ} (h : strongPseudoprime n a) : /-! ## Error bound: the good subgroup `S(n)` (Rabin–Monier) -The Miller-Rabin error bound (Theorem 31.38; sharpened by Rabin and Monier) -states that for odd composite `n`, at most `(n−1)/4` of the bases are strong +The Miller-Rabin error bound (Theorem 31.39; sharpened to `(n−1)/4` by Rabin +and Monier) states that for odd composite `n`, at most `(n−1)/4` of the bases +are strong liars. The proof embeds the liars into a subgroup `S(n)` of the units modulo `n` and bounds `|S(n)|`. This section develops the infrastructure: the units of `ZMod n`, the cyclicity of prime-power unit groups (from Mathlib), the @@ -1963,8 +1965,9 @@ theorem goodUnits_card_le {n : ℕ} [NeZero n] (hn1 : 1 < n) (hn_odd : Odd n) · exact goodUnits_card_le_of_ge_three (n := n) hn1 hn_odd h3 /-- -**The Miller-Rabin error bound (Theorem 31.38; Rabin–Monier).** For odd -composite `n`, at most `(n−1)/4` of the bases in `(Z/nZ)ˣ` are strong liars. +**The Miller-Rabin error bound (Theorem 31.39; sharpened to `(n−1)/4` by +Rabin–Monier).** For odd composite `n`, at most `(n−1)/4` of the bases in +`(Z/nZ)ˣ` are strong liars. Every strong liar lies in the good subgroup `S(n)` (`liar_mem_goodSet`), and `|S(n)| ≤ (n−1)/4` (`goodUnits_card_le`). -/ diff --git a/docs/ch31-error-bound-handoff.md b/docs/ch31-error-bound-handoff.md index 5e287ef..be6f785 100644 --- a/docs/ch31-error-bound-handoff.md +++ b/docs/ch31-error-bound-handoff.md @@ -1,4 +1,4 @@ -# ch31 Error-Bound Handoff — Miller-Rabin (Theorem 31.8) +# ch31 Error-Bound Handoff — Miller-Rabin (Theorem 31.39) This document hands off the state and the verified roadmap for the **last remaining hard theorem in Chapter 31**: the Miller-Rabin error bound (Rabin- @@ -41,7 +41,7 @@ documented as informal in CLRS and intentionally left unformalized). > 2 ≤ 8/4). Rationale: φ(n)/4 fails exactly when the "good subgroup" > index is 3, which happens only for `n = 3²` (see Milestone 4 notes). > Since `φ(n) ≤ n−1`, bounding by `(n−1)/4` is the right, exception-free -> target and is strictly stronger than CLRS Theorem 31.38 (witnesses ≥ (n−1)/2). +> target and is strictly stronger than CLRS Theorem 31.39 (witnesses ≥ (n−1)/2). ### ⚠️ Verified negative result (do NOT waste time on this) diff --git a/docs/clrs-proof-progress.csv b/docs/clrs-proof-progress.csv index f001479..b872a41 100644 --- a/docs/clrs-proof-progress.csv +++ b/docs/clrs-proof-progress.csv @@ -29,7 +29,7 @@ chapter_no,chapter_title,repo_status,represented_sections,tracked_key_theorems,p 28,Matrix Operations,main-proof-complete,28.1;28.2;28.3,9,9,0,"Sections 28.1 (LUP decomposition and solving, Theorems 28.1-28.2, Lemmas 28.1-28.2), 28.2 (inversion), and 28.3 (SPD, Cholesky, least squares) are complete. Section 28.1 proves the LUP decomposition, the constructive forward/back substitution lemmas with LUP-SOLVE, uniqueness of solutions, the determinant-via-LUP corollary, and the CLRS running-time bounds (LUP-SOLVE Theta(n^2), LUP/inversion/Cholesky Theta(n^3)). Section 28.3 proves the Cholesky decomposition (Theorem 28.3) and its uniqueness, and the least-squares minimization theorem (Theorem 28.4).",exists_lup_decomposition (Theorem 28.1); forwardSubst_spec (Lemma 28.1); backSubst_spec (Lemma 28.2); lupSolve_correct (LUP-SOLVE); inv_eq_lup (Theorem 28.2); cholesky_decomposition (Theorem 28.3); cholesky_unique; normal_equations_minimizes (Theorem 28.4); det_eq_sign_mul_det_of_lup (Corollary to Thm 28.1),None,CLRSLean/Chapter_28.lean; CLRSLean/Chapter_28/Section_28_1_Linear_Equations.lean; CLRSLean/Chapter_28/Section_28_2_Inverting_Matrices.lean; CLRSLean/Chapter_28/Section_28_3_Symmetric_Positive_Definite.lean,"Sections 28.1-28.3 are complete: LUP decomposition and solving (Theorems 28.1-28.2, Lemmas 28.1-28.2, Algorithm LUP-SOLVE), the det-via-LUP corollary, matrix inversion, the Cholesky decomposition (Theorem 28.3) with uniqueness, least-squares approximation (Theorem 28.4), and the CLRS running-time cost bounds." 29,Linear Programming,main-proof-complete,29.1;29.2;29.3;29.4;29.5,17,17,0,"The Chapter 29 main text is complete at the finite real-matrix and pure-functional tableau layer: all textbook formulations, terminating initialized SIMPLEX, strong duality, and complementary slackness are kernel-checked",isFeasible_iff_exists_slackExtension; shortest-path LP lower-bound and attained-optimum theorems; maximum-flow LP equivalence; minimum-cost-flow LP equivalence; multicommodity-flow LP equivalence; dictionary/basic-solution and exact PIVOT semantics; deterministic Bland selectors and three-way simplexStep; optimal and unbounded exit correctness; bland_no_repeated_basis; simplexRun_basisCount_not_exhausted and simplex_optimal_or_unbounded; weak_duality (Theorem 29.8); terminal dictionary dual certificate; phase-I feasibility criterion; initializedSimplex_complete; strongDuality (Theorem 29.9); complementarySlackness_iff_optimal (Theorem 29.10),"Mutable tableau storage, floating-point numerical analysis, RAM constants, exercises, and chapter-end problems are optional refinements",CLRSLean/Chapter_29.lean; CLRSLean/Chapter_29/Section_29_1_Standard_And_Slack_Forms.lean; CLRSLean/Chapter_29/Section_29_2_Formulating_Problems_As_Linear_Programs.lean; CLRSLean/Chapter_29/Section_29_3_The_Simplex_Algorithm.lean; CLRSLean/Chapter_29/Section_29_4_Duality.lean; CLRSLean/Chapter_29/Section_29_5_The_Initial_Basic_Feasible_Solution.lean; Tests/Chapter_29_Interface.lean; Tests/Chapter_29_Formulations_Interface.lean; Tests/Chapter_29_Simplex_Interface.lean; Tests/Chapter_29_Initialization_Interface.lean; Tests/Chapter_29_Closure.lean; docs/proof-audits/chapter-29-closure-2026-08-05.md,The phase-I cleanup uses an equivalent fixed-dimension lock x₀ ≤ 0 together with x₀ ≥ 0 instead of physically deleting the artificial variable; this preserves exactly the original feasible assignments and supports the complete general strong-duality proof. 30,Polynomials and the FFT,not-started,None,0,0,1,Not represented,No tracked theorem names yet,Whole chapter theorem inventory and formalization pending,CLRSLean file tree,No Chapter_30 module exists. -31,Number-Theoretic Algorithms,selected-section-complete,31.1;31.2;31.3;31.4;31.5;31.6;31.7;31.8;31.9,29,29,0,"Sections 31.1-31.9 (number-theoretic algorithms) are complete: divisibility and the division theorem; the gcd, Euclid and extended-Euclid; modular arithmetic; linear congruences; the Chinese remainder theorem; powers of an element (Fermat and Euler); RSA; primality testing; and Pollard-s-rho factorization.",division_theorem (Theorem 31.1); euclid_recursion (Lemma 31.2); gcd_is_linear_combination (Lemma 31.3); gcd_is_smallest_positive_linear_combination (Theorem 31.2); exists_mul_inverse_mod (Theorem 31.6); modular_linear_solvable (Theorem 31.11); linear_congruence_solutions (Theorem 31.10); chinese_remainder (Theorem 31.27); chinese_remainder_general (Theorem 31.27); fermat_little_theorem (Theorem 31.30); euler_theorem; rsa_correct (Theorem 31.36); rsa_correct_general (Theorem 31.36); fermat_test (Theorem 31.31); rho_collision_factor; fib_le_of_euclidDivisions (Lemma 31.10); euclidDivisions_lt (Theorem 31.11); euclidDivisions_le_two_log (Corollary 31.12); isCarmichael; isCarmichael_561; strongPseudoprime_of_prime; witness_not_prime; pollardRho_sound; goodUnits_card_le; strongLiars_card_le,the Pollard-s-rho birthday-paradox probabilistic analysis (see chapter guide),CLRSLean/Chapter_31.lean; CLRSLean/Chapter_31/Section_31_1_Elementary_Number_Theory.lean; CLRSLean/Chapter_31/Section_31_2_Greatest_Common_Divisor.lean; CLRSLean/Chapter_31/Section_31_3_Modular_Arithmetic.lean; CLRSLean/Chapter_31/Section_31_4_Solving_Modular_Linear_Equations.lean; CLRSLean/Chapter_31/Section_31_5_Chinese_Remainder_Theorem.lean; CLRSLean/Chapter_31/Section_31_6_Powers_Of_An_Element.lean; CLRSLean/Chapter_31/Section_31_7_RSA.lean; CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean; CLRSLean/Chapter_31/Section_31_9_Integer_Factorization.lean,"Sections 31.1-31.9 fully proved, including the Lamé running-time analysis of EUCLID (Lemmas 31.10 and Theorem 31.11, Corollary 31.12), Carmichael numbers (isCarmichael, 561), and Miller-Rabin correctness (strongPseudoprime_of_prime: a prime passes every base; witness_not_prime: a witness certifies compositeness); the Pollard-s-rho birthday-paradox probabilistic analysis is deferred." +31,Number-Theoretic Algorithms,selected-section-complete,31.1;31.2;31.3;31.4;31.5;31.6;31.7;31.8;31.9,29,29,0,"Sections 31.1-31.9 (number-theoretic algorithms) are complete: divisibility and the division theorem; the gcd, Euclid and extended-Euclid; modular arithmetic; linear congruences; the Chinese remainder theorem; powers of an element (Fermat and Euler); RSA; primality testing; and Pollard-s-rho factorization.",division_theorem (Theorem 31.1); euclid_recursion (Theorem 31.9); gcd_is_linear_combination (Lemma 31.3); gcd_is_smallest_positive_linear_combination (Theorem 31.2); exists_mul_inverse_mod (Theorem 31.6); modular_linear_solvable (Corollary 31.21); linear_congruence_solutions (Corollary 31.22); chinese_remainder (Theorem 31.27); chinese_remainder_general (Theorem 31.27); fermat_little_theorem (Theorem 31.31); euler_theorem (Theorem 31.30); rsa_correct (Theorem 31.36); rsa_correct_general (Theorem 31.36); fermat_test (Theorem 31.31); rho_collision_factor; fib_le_of_euclidDivisions (Lemma 31.10); euclidDivisions_lt (Theorem 31.11); euclidDivisions_le_two_log (Corollary 31.12); isCarmichael; isCarmichael_561; strongPseudoprime_of_prime; witness_not_prime; pollardRho_sound; goodUnits_card_le; strongLiars_card_le,the Pollard-s-rho birthday-paradox probabilistic analysis (see chapter guide),CLRSLean/Chapter_31.lean; CLRSLean/Chapter_31/Section_31_1_Elementary_Number_Theory.lean; CLRSLean/Chapter_31/Section_31_2_Greatest_Common_Divisor.lean; CLRSLean/Chapter_31/Section_31_3_Modular_Arithmetic.lean; CLRSLean/Chapter_31/Section_31_4_Solving_Modular_Linear_Equations.lean; CLRSLean/Chapter_31/Section_31_5_Chinese_Remainder_Theorem.lean; CLRSLean/Chapter_31/Section_31_6_Powers_Of_An_Element.lean; CLRSLean/Chapter_31/Section_31_7_RSA.lean; CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean; CLRSLean/Chapter_31/Section_31_9_Integer_Factorization.lean,"Sections 31.1-31.9 fully proved, including the Lamé running-time analysis of EUCLID (Lemmas 31.10 and Theorem 31.11, Corollary 31.12), Carmichael numbers (isCarmichael, 561), and Miller-Rabin correctness (strongPseudoprime_of_prime: a prime passes every base; witness_not_prime: a witness certifies compositeness); the Pollard-s-rho birthday-paradox probabilistic analysis is deferred." 32,String Matching,selected-section-complete,32.1,19,19,0,Section 32.1 fully proved,String model (14 lemmas); naiveMatcher soundness/completeness (5 theorems),Rabin-Karp hash proofs; finite-automaton construction; KMP prefix-function correctness,CLRSLean/Chapter_32.lean; CLRSLean/Chapter_32/Section_32_1_String_Model.lean; CLRSLean/Chapter_32/Section_32_1_String_Model/Naive_Matcher.lean,All 19 theorems are kernel-checked. Sections 32.2-32.4 deferred. Original formalization by caiwei2026 (PR #85). 33,Computational Geometry,partial,33.1,7,7,1,Section 33.1 definitions plus cross-product algebra and orientation specification are represented,Six cross-product algebra theorems; orientation_spec,Prove segmentIntersect soundness and completeness against an independent geometric-intersection specification including shared-endpoint cases; Sections 33.2-33.4 remain unrepresented,CLRSLean/Chapter_33.lean; CLRSLean/Chapter_33/Section_33_1_Line_Segment_Properties.lean,All 7 tracked theorems are kernel-checked but segmentIntersect bboxIntersect and sharesEndpoint currently have definitions without correctness theorems. 34,NP-Completeness,not-started,None,0,0,1,Not represented,No tracked theorem names yet,Whole chapter theorem inventory and formalization pending,CLRSLean file tree,No Chapter_34 module exists. diff --git a/docs/proof-map.md b/docs/proof-map.md index 3cc506f..d3f2ea5 100644 --- a/docs/proof-map.md +++ b/docs/proof-map.md @@ -4181,7 +4181,8 @@ No core proof group remains within the selected milestone. Sections 26.4 and - Lean source: `CLRSLean/Chapter_31/Section_31_2_Greatest_Common_Divisor.lean` - Status: `selected-section-complete` - Proved: - - `euclid_recursion` / `gcd_zero_left` / `gcd_zero_right` (CLRS Lemma 31.2): + - `euclid_recursion` / `gcd_zero_left` / `gcd_zero_right` (CLRS Theorem 31.9, + the GCD recursion theorem): the Euclid recursion `gcd(a, b) = gcd(b mod a, a)` and the base cases. - `euclid` + `euclid_eq_gcd` + `euclid_terminates`: the EUCLID algorithm is a total, well-founded function and returns `Nat.gcd a b` (via @@ -4223,7 +4224,7 @@ No core proof group remains within the selected milestone. Sections 26.4 and multiplicative inverse modulo `n`, via `ZMod` units. - `mul_left_cancel_mod` (CLRS Theorem 31.9): cancellation in `Z_n` when `gcd(c,n)=1`. - - `modular_linear_solvable` (CLRS Theorem 31.11): `a·x ≡ b (mod n)` is + - `modular_linear_solvable` (CLRS Corollary 31.21): `a·x ≡ b (mod n)` is solvable iff `gcd(a,n) ∣ b`, via the `ZMod` quotient hom and Bezout. ### Section 31.4 - Solving Modular Linear Equations @@ -4253,9 +4254,9 @@ No core proof group remains within the selected milestone. Sections 26.4 and - Proved: - `modularExponentiation` + `modularExponentiation_spec` (CLRS MODULAR-EXPONENTIATION). - - `fermat_little_theorem` (CLRS Theorem 31.30): prime `p` gives + - `fermat_little_theorem` (CLRS Theorem 31.31): prime `p` gives `a^p ≡ a (mod p)`, via `ZMod.pow_card`. - - `euler_theorem`: `gcd(a,n)=1` gives `a^φ(n) ≡ 1 (mod n)`. + - `euler_theorem` (CLRS Theorem 31.30): `gcd(a,n)=1` gives `a^φ(n) ≡ 1 (mod n)`. ### Section 31.7 - The RSA Public-Key Cryptosystem @@ -4302,7 +4303,8 @@ No core proof group remains within the selected milestone. Sections 26.4 and the `s < r` / `s = r` sub-cases and the key lemma that `d_p | t ∧ d_q | t` forces `p = q`), and `≥ 3` prime factors. Hence `strongLiars_card_le`: **at most `(n−1)/4` of the bases are strong liars for odd composite `n`** - (Theorem 31.38). Deferred: the random-witness analysis. + (Theorem 31.39, sharpened to `(n−1)/4` by Rabin–Monier). Deferred: the + random-witness analysis. ### Section 31.9 - Integer Factorization From 092ff8d0954d91e6ad63ed40e2a5b0da49fb45b6 Mon Sep 17 00:00:00 2001 From: TankTechnology <2541826291@qq.com> Date: Thu, 6 Aug 2026 13:15:37 +0800 Subject: [PATCH 24/24] feat(ch31): track the Miller-Rabin error bound in the 4th-ed ledger Add goodUnits_card_le and strongLiars_card_le to the chapter 31 row of the fourth-edition progress ledger (tracked/proved 15 -> 17), since the merged error-bound work is now in the source. Regenerate Progress.lean and the README progress table; update the snapshot test's expected total (1,326 -> 1,328). Co-Authored-By: Claude --- CLRSLean/Progress.lean | 6 +-- README.md | 6 +-- docs/clrs-proof-progress.csv | 72 +++++++++++++++--------------- scripts/test_check_progress_csv.py | 2 +- 4 files changed, 43 insertions(+), 43 deletions(-) diff --git a/CLRSLean/Progress.lean b/CLRSLean/Progress.lean index 358db9f..a9f87a5 100644 --- a/CLRSLean/Progress.lean +++ b/CLRSLean/Progress.lean @@ -16,8 +16,8 @@ least six months; removal is possible only in 2.0 or later. * Fourth-edition chapters tracked: 35. * Chapters represented in Lean: 30. -* Tracked reader-facing theorem entries: 1,326. -* Proved tracked theorem entries: 1,326. +* Tracked reader-facing theorem entries: 1,328. +* Proved tracked theorem entries: 1,328. * Online/supplementary theorem entries: 467. * Remaining edition-coverage units: 31. @@ -76,7 +76,7 @@ Ch Chapter Status 28 28. Matrix Operations main-proof-complete 28.1;28.2;28.3 9 0 29 29. Linear Programming partial (edition coverage) 29.1;29.2;29.3 10 3 30 30. Polynomials and the FFT main-proof-complete 30.1;30.2;30.3 34 0 -31 31. Number-Theoretic Algorithms selected-section-complete 31.1;31.2;31.3;31.4;31.5;31. 15 0 +31 31. Number-Theoretic Algorithms selected-section-complete 31.1;31.2;31.3;31.4;31.5;31. 17 0 32 32. String Matching partial (edition coverage) 32.1 19 4 33 33. Machine-Learning Algorithms not-started not represented 0 1 34 34. NP-Completeness not-started not represented 0 1 diff --git a/README.md b/README.md index 140d831..af01a2f 100644 --- a/README.md +++ b/README.md @@ -11,7 +11,7 @@ definitions, theorem interfaces, and proofs. > **Fourth-edition snapshot.** > 30 of 35 chapters have canonical represented content. -> 1,326 / 1,326 selected source-inventory entries are proved and mapped into the fourth-edition ledger. +> 1,328 / 1,328 selected source-inventory entries are proved and mapped into the fourth-edition ledger. > This selected inventory is not a claim of complete fourth-edition section coverage. > 467 additional entries remain available through the > machine-readable online-material catalog. They are disjoint from the canonical chapter counts; @@ -85,13 +85,13 @@ selected. Edition-level gaps determine the status and **Edition gaps** column. | 28 | Matrix Operations | 🟢 complete | 9 / 9 | — | | 29 | Linear Programming | 🟠 partial coverage | 10 / 10 | Section 29.1: general-form normalization and canonical… | | 30 | Polynomials and the FFT | 🟢 complete | 34 / 34 | — | -| 31 | Number-Theoretic Algorithms | 🟡 sections | 15 / 15 | — | +| 31 | Number-Theoretic Algorithms | 🟡 sections | 17 / 17 | — | | 32 | String Matching | 🟠 partial coverage | 19 / 19 | Section 32.2 (The Rabin–Karp algorithm): not-started;… | | 33 | Machine-Learning Algorithms | ⬜ not started | 0 / 0 | Whole fourth-edition chapter theorem inventory and… | | 34 | NP-Completeness | ⬜ not started | 0 / 0 | Whole fourth-edition chapter theorem inventory and… | | 35 | Approximation Algorithms | ⬜ not started | 0 / 0 | Whole fourth-edition chapter theorem inventory and… | -**Total: 1326 of 1326 selected theorem entries have kernel-checked proofs across 30 represented fourth-edition chapters** (no `sorry`/`admit`/project axiom on `main`). This does not by itself claim complete fourth-edition coverage. +**Total: 1328 of 1328 selected theorem entries have kernel-checked proofs across 30 represented fourth-edition chapters** (no `sorry`/`admit`/project axiom on `main`). This does not by itself claim complete fourth-edition coverage. Status legend: 🟢 `complete` / `correctness` (advertised theorem stack sealed) · diff --git a/docs/clrs-proof-progress.csv b/docs/clrs-proof-progress.csv index 20fb693..be7cc2b 100644 --- a/docs/clrs-proof-progress.csv +++ b/docs/clrs-proof-progress.csv @@ -1,36 +1,36 @@ -chapter_no,chapter_title,repo_status,represented_sections,tracked_key_theorems,proved_tracked_theorems,edition_gap_units,completion_read,proved_key_theorem_groups,remaining_edition_gaps,evidence_source,notes -1,The Role of Algorithms in Computing,expository,Chapter_01,0,0,0,The fourth-edition facade reuses 0 proved tracked theorem entries from legacy Chapter 1 across represented Sections Chapter_01,Project conventions and reader contract,None,CLRSLean/FourthEdition/Chapter_01.lean; CLRSLean/Chapter_01.lean,Canonical fourth-edition Chapter 1 currently reuses its legacy source through a compatibility facade. Legacy source note: No formal theorem target. -2,Getting Started,main-proof-complete,2.1;2.2;2.3,7,7,0,The fourth-edition facade reuses 7 proved tracked theorem entries from legacy Chapter 2 across represented Sections 2.1;2.2;2.3,Insertion sort sortedness and permutation; insertion-sort quadratic comparison bound; merge-sort sortedness/permutation; power-of-two closed form; exact-power Theta(n log n) via the Master Theorem; all-input Theta(n log n) (theta_n_log_n_all_inputs) via the Chapter 4.6 floor/ceiling sandwich bridge,None,CLRSLean/FourthEdition/Chapter_02.lean; CLRSLean/Chapter_02.lean; CLRSLean/Status.lean,Canonical fourth-edition Chapter 2 currently reuses its legacy source through a compatibility facade. Legacy source note: Current main section interfaces are stable; the arbitrary-size floor/ceiling merge-sort recurrence now has the all-input Theta(n log n) bound. Non-blocking scope note: Optional strengthening: full RAM semantics; exercises. -3,Characterizing Running Times,partial,3.1;3.2;3.3,47,47,1,Sections 3.1 and 3.3 are represented through the compatibility facade; Section 3.2 retains one exact formal-interface gap,CLRS asymptotic notation wrappers; polynomial/exponential/log/factorial/harmonic/floor-ceiling growth facts; complete comparison hierarchy 1 < log(log n) < log n < n < n^a < 2^n < n! with log_b base-change facts; Fibonacci-number growth via Binet closed form Theta(phi^n) and closest-integer bound; iterated logarithm lg* (definition tower recurrence monotonicity and o(log n) slow growth),Section 3.2: shared-threshold two-sided Θ witness and expected o/ω algebra/duality wrappers,CLRSLean/FourthEdition/Chapter_03.lean; CLRSLean/Chapter_03.lean; CLRSLean/Status.lean,All 47 selected entries are proved. The chapter remains partial because proved/tracked inventory completion does not include the missing Section 3.2 formal-interface wrappers. -4,Divide-and-Conquer,partial,4.1;4.2;4.3;4.4;4.5;4.6,82,82,3,The fourth-edition facade maps 82 proved tracked theorem groups after excluding moved material to the online ledger; the edition map records exact represented sections and gaps,Strassen 2x2 block algebra; recursive Strassen algorithm with correctness and padding; Strassen Theta(n^(log2 7)) runtime via Master case 1; substitution templates; recursion-tree expansions; exact-power Master cases; floor/ceiling all-input transfer and discrete Master wrappers; real-log case-1 bridge; real-log-log case-2 bridge; case-3 regularity bridge from tailDominatedScale to the forcing function; master_case2_polylog_forcing; master_case2_polylog_forcing_all_input,Section 4.1 (Multiplying square matrices): partial; Section 4.6 (Proof of the continuous master theorem): partial; Section 4.7 (Akra–Bazzi recurrences): not-started,CLRSLean/FourthEdition/Chapter_04.lean; CLRSLean/Chapter_04.lean; CLRSLean/Chapter_04/Section_04_2_Strassen_Algorithm.lean; Tests/Chapter_04_Interface.lean; CLRSLean/Status.lean; docs/chapters/chapter-04.md; docs/proof-map.md,"The canonical fourth-edition ledger excludes 14 maximum-subarray groups recorded in the online-material ledger. Canonical fourth-edition Chapter 4 currently reuses its legacy source through a compatibility facade. Legacy source note: The maximum-subarray metric counts recursive frames scan transitions and constant-size candidate choices; its scan counters are proved from the costed scan executions; it excludes explicit split-tree construction integer arithmetic List allocation/copying garbage collection and RAM semantics. The polylog case-2 Master extension proves polynomial normalized forcing c*j^k <= forcing <= C*j^k gives T(b^i) = Theta((i+1)^(k+1)*a^i), with the all-input wrapper master_case2_polylog_forcing_all_input." -5,Probabilistic Analysis and Randomized Algorithms,selected-section-complete,5.1;5.2;5.3;5.4,25,25,0,The fourth-edition facade reuses 25 proved tracked theorem entries from legacy Chapter 5 across represented Sections 5.1;5.2;5.3;5.4,Hiring problem finite rank-symmetry probability; harmonic expectation; logarithmic asymptotic expected-hires theorem; hat-check expected fixed points equal 1 via indicators and permutation symmetry; RANDOMIZE-IN-PLACE uniform permutation (Lemma 5.5) via choice-vector bijection; birthday-paradox expected collisions k(k-1)/(2n); balls-and-bins expected occupancy k/n; longest-streak tail bound n/2^t; expected-longest-streak upper bound expectedLongestStreak_le (E[L] <= log2 n + 2) via the tail-sum identity expectedLongestStreak_eq_tailSum; expected-longest-streak lower bound expectedLongestStreak_lowerBound (E[L] >= log2 n / 8 for n >= 16) via the block-partition exact count prob_noFullHeadBlock = (1 - 2^-k)^m and the layer-cake lower bound expectedLongestStreak_ge_mul_tail; executable on-line threshold strategy with exact some/none contracts and finite success-probability definition; on-line hiring success-probability closed form probHireBest_eq = (k/n)(H_{n-1} - H_{k-1}) via the per-position probability probBestAt and the harmonic-difference sum sum_recip_Icc_eq_harmonic_sub; on-line hiring 1/e asymptotic probHireBest_asymptotic: the success probability for the threshold floor(n/e) tends to 1/e via floor asymptotics and the Euler-Mascheroni harmonic difference,None,CLRSLean/FourthEdition/Chapter_05.lean; CLRSLean/Chapter_05.lean; CLRSLean/Chapter_05/Section_05_4_Probabilistic_Analysis.lean; CLRSLean/Chapter_05/Section_05_4_Probabilistic_Analysis/OnlineHiring.lean; Tests/Chapter_05_Interface.lean; CLRSLean/Status.lean,"Canonical fourth-edition Chapter 5 currently reuses its legacy source through a compatibility facade. Legacy source note: Uses finite discrete uniform probability over rank symmetry uniform permutations product-uniform sample spaces and independent-swap-choice sample spaces; the expected longest streak is now Θ(log n): E[L] ≤ log2 n + 2 and E[L] ≥ log2 n / 8 for n ≥ 16, and the on-line hiring success closed form (k/n)(H_{n-1} - H_{k-1}) with its 1/e asymptotic for the threshold floor(n/e) are proved." -6,Heapsort,main-proof-complete,6.1;6.2;6.3;6.4;6.5,78,78,0,The fourth-edition facade reuses 78 proved tracked theorem entries from legacy Chapter 6 across represented Sections 6.1;6.2;6.3;6.4;6.5,Indexed heap predicates; MAX-HEAPIFY repair; BUILD-MAX-HEAP; in-place heapsort invariant and correctness; costed heapify/build/heapsort erasure and coarse O(n)/O(n^2)/O(n^2) envelopes; priority-queue operation state theorems,None,CLRSLean/FourthEdition/Chapter_06.lean; CLRSLean/Chapter_06.lean; CLRSLean/Chapter_06/Section_06_4_Heapsort/CostedExecution.lean; Tests/Chapter_06_Interface.lean; CLRSLean/Status.lean,"Canonical fourth-edition Chapter 6 currently reuses its legacy source through a compatibility facade. Legacy source note: The unit control-step metric counts heapify frames and nontrivial extraction transitions; build orchestration, guards, List operations, allocation, and calls are not charged. Non-blocking scope note: tight textbook O(log n)/O(n)/O(n log n) costs and imperative RAM/List-operation semantics are optional refinements." -7,Quicksort,partial,7.1;7.2;7.3;7.4,30,30,1,The fourth-edition facade reuses 30 proved tracked theorem entries from legacy Chapter 7 across represented Sections 7.1;7.2;7.3;7.4; the edition map records explicit remaining gaps,Partition correctness; scan-state partition loop; mutable-Array PARTITION refinement (partitionOnArray); quicksort sortedness/permutation; quadratic comparison bound; randomized-quicksort expected-comparison named closed form and harmonic bounds; random-permutation first-choice symmetry; pairwise comparison probability compared_prob = 2/(j-i+1); sum_compared_prob_eq_expectedComparisons bridge; expectedComparisons_isBigTheta_nlogn,Section 7.4 (Analysis of quicksort): partial,CLRSLean/FourthEdition/Chapter_07.lean; CLRSLean/Chapter_07.lean; CLRSLean/Chapter_07/Section_07_1_Description_Of_Quicksort.lean; CLRSLean/Chapter_07/Section_07_2_Performance_Of_Quicksort.lean; CLRSLean/Chapter_07/Section_07_3_Randomized_Quicksort.lean,Canonical fourth-edition Chapter 7 currently reuses its legacy source through a compatibility facade. Legacy source note: The bridge between the random-permutation probability model and the algebraic closed form is proved via sum_compared_prob_eq_expectedComparisons; the Theta(n log n) asymptotic follows from expectedComparisons_isBigTheta_nlogn. -8,Sorting in Linear Time,main-proof-complete-for-correctness,8.1;8.2;8.3;8.4,36,36,0,The fourth-edition facade reuses 36 proved tracked theorem entries from legacy Chapter 8 across represented Sections 8.1;8.2;8.3;8.4,Comparison decision-tree model over Fin n; run_injective_of_correctSort; factorial_le_leafCount_of_correctSort (n! leaf lower bound); leafCount_le_two_pow_height; height_le_logb_factorial (log2(n!) <= height); factorial_sq_ge_pow_self ((n!)^2 >= n^n); logb_factorial_ge_half_mul_logb; comparisonSort_worstCase_lowerBound (worst-case comparisons >= (n/2)(log2 n - 1)); stable counting sort; count-table refinement; mutable output-array counting sort with linear work bound; abstract and natural-key radix sort; deterministic bucket-sort correctness; finite-uniform bucket collision and second moment; textbookBucketSortCost; fintypeExpect_textbookBucketSortCost_eq_expectedBucketSortCost; expectedTextbookBucketSortCost_isBigO,None,CLRSLean/FourthEdition/Chapter_08.lean; CLRSLean/Chapter_08.lean; CLRSLean/Chapter_08/Section_08_1_Lower_Bound_For_Sorting.lean; CLRSLean/Chapter_08/Section_08_2_Counting_Sort.lean; CLRSLean/Chapter_08/Section_08_2_Counting_Sort/CountTables.lean; CLRSLean/Chapter_08/Section_08_2_Counting_Sort/MutableOutputArray.lean; CLRSLean/Chapter_08/Section_08_3_Radix_Sort.lean; CLRSLean/Chapter_08/Section_08_4_Bucket_Sort.lean; CLRSLean/Status.lean; Tests/Chapter_08_Interface.lean,Canonical fourth-edition Chapter 8 currently reuses its legacy source through a compatibility facade. Legacy source note: The decision-tree lower bound is proved for the model over Fin n distinct elements; the CLRS unit-cost random variable has linear expectation; executable cost refinement and RAM accounting do not block the mathematical correctness milestone. Non-blocking scope note: a single-pass executable bucket builder costed per-bucket sorter and execution-cost refinement are optional implementation layers; RAM-level bookkeeping of individual comparisons is out of scope. -9,Medians and Order Statistics,main-proof-complete,9.1;9.2;9.3,72,72,0,The fourth-edition facade reuses 72 proved tracked theorem entries from legacy Chapter 9 across represented Sections 9.1;9.2;9.3,Pairwise simultaneous minimum/maximum correctness; CLRS 3 floor(n/2) comparison bound; rank certificates; specification select; quickselect; pivot-parametric SELECT totality and correctness; five-element median certificate; grouped split counts; recursive median-of-medians pivot membership totality correctness and branch bound; linear recurrence induction; schedule-driven fresh-rank path cost erasure and rank correctness; pointwise actual-continuation-to-larger-side coupling; nested conditional-uniform RANDOMIZED-SELECT expectation; concrete-to-majorizer bridge; expected partition-work bound E[C] <= 4*c*n; end-to-end recursive median-of-medians comparison bound including nested pivot work <= 100n,None,CLRSLean/FourthEdition/Chapter_09.lean; CLRSLean/Chapter_09.lean; CLRSLean/Chapter_09/Section_09_1_Minimum_And_Maximum.lean; CLRSLean/Chapter_09/Section_09_2_Select_By_Rank.lean; CLRSLean/Chapter_09/Section_09_3_Deterministic_Select.lean; CLRSLean/Chapter_09/Section_09_3_Deterministic_Select/Randomized_Select.lean; Tests/Chapter_09_Interface.lean; Tests/Chapter_09_Closure.lean; CLRSLean/Status.lean,Canonical fourth-edition Chapter 9 currently reuses its legacy source through a compatibility facade. Legacy source note: No unfinished proof markers in the represented modules; randomized cost charges c*currentLength only and excludes RNG selectByRank specification sorting list primitives allocation and RAM work -10,Elementary Data Structures,partial,10.1;10.2;10.3,12,12,1,The fourth-edition facade reuses 12 proved tracked theorem entries from legacy Chapter 10 across represented Sections 10.1;10.2;10.3; the edition map records explicit remaining gaps,Stack pop/push theorem; queue enqueue/dequeue theorems; linked-list search and delete facts; rooted-tree rose/LCRS forest round-trip isomorphism and Equiv bijection; single-tree round trip; preorder and node-count structure preservation,Section 10.1 (Simple array-based data structures): partial,CLRSLean/FourthEdition/Chapter_10.lean; CLRSLean/Chapter_10.lean; CLRSLean/Chapter_10/Section_10_4_Rooted_Trees.lean; CLRSLean/Status.lean,Canonical fourth-edition Chapter 10 currently reuses its legacy source through a compatibility facade. Legacy source note: Current model intentionally avoids imperative memory; the represented functional interfaces are complete. -11,Hash Tables,partial,11.1;11.2;11.3;11.4,48,48,1,The fourth-edition facade maps 48 proved tracked theorem groups after excluding moved material to the online ledger; the edition map records exact represented sections and gaps,Direct-address insert/search/delete; deterministic chained hash insert/delete/search facts; finite-uniform singleton bucket probability; uniform-average additivity and nonnegativity; expected chain length equals load factor; unsuccessful-search cost equals one plus load factor and is at least one; finite insert increases total chain length load factor expected chain length and unsuccessful-search cost; SUHA true-expectation chain length and unsuccessful-search cost; SUHA pairwise collision probability equals one over m; SUHA successful-search cost equals one plus (n-1)/(2m); universal random hash-function expected collision and search-cost bounds; division and multiplication method range bounds; concrete prime-field affine universal family satisfying IsUniversal with instantiated collision and search-cost bounds; open-addressing functional model correctness; linear/quadratic/double hashing probe schemes; uniform-hashing tail probability bounds; expected unsuccessful/insertion/successful probe bounds,Section 11.5 (Practical considerations): not-started,CLRSLean/FourthEdition/Chapter_11.lean; CLRSLean/Chapter_11.lean; CLRSLean/Chapter_11/Section_11_2_Chained_Hash_Tables.lean; CLRSLean/Chapter_11/Section_11_3_Hash_Functions.lean; CLRSLean/Chapter_11/Section_11_4_Open_Addressing.lean; CLRSLean/Status.lean,The canonical fourth-edition ledger excludes 3 perfect-hashing groups recorded in the online-material ledger. Canonical fourth-edition Chapter 11 currently reuses its legacy source through a compatibility facade. Legacy source note: Chapter 11 proves SUHA successful and unsuccessful search costs universal hashing collision and search-cost bounds an affine universal family open-addressing expected-probe bounds and two-level perfect hashing; only low-level operational accounting remains. -12,Binary Search Trees,main-proof-complete-for-correctness,12.1;12.2;12.3,40,40,0,The fourth-edition facade reuses 40 proved tracked theorem entries from legacy Chapter 12 across represented Sections 12.1;12.2;12.3,Search; min/max; insertion; complete successor/predecessor specifications; functional delete membership and ordering; search and neighbor queries after updates; faithful zipper reconstruction; iterative search equivalence; transplant ordering preservation; deletion-via-transplant equivalence; parent-ascent successor/predecessor equivalence; imperative pointer-heap node/store model; heap-to-tree abstraction faithfulness; pointer frame rules; in-place TRANSPLANT refinement; pointer TREE-INSERT leaf-attachment refinement,None,CLRSLean/FourthEdition/Chapter_12.lean; CLRSLean/Chapter_12.lean; CLRSLean/Chapter_12/Section_12_1_Binary_Search_Trees.lean; CLRSLean/Status.lean; Tests/Chapter_12_Interface.lean,Canonical fourth-edition Chapter 12 currently reuses its legacy source through a compatibility facade. Legacy source note: The represented mathematical and refinement interfaces are complete; lower-level pointer deletion and RAM accounting do not block the correctness milestone. Non-blocking scope note: pointer-level in-place delete and explicit RAM costs are optional low-level refinements. -13,Red-Black Trees,partial,13.1;13.2;13.3;13.4,39,39,3,The color/black-height and functional key-set/shape layers are proved; three fourth-edition sections still lack the complete ordered-search-tree and cost/refinement stack,Rotation membership; repaint membership; no-red-red; black-height; local red-black shape preservation; insertion-fixup certificates; executable insert and redBlackShape_insert; height_log_bound (Lemma 13.1); executable baldL/baldR/splitMin/join/del/delete; inTree_delete_iff; local delete-fixup membership and shape certificates; deficit-absorbing rebalancer certificates baldL_shape and baldR_shape; splitMin_invariant; del_invariant; redBlackShape_delete,Section 13.2: BST/inorder rotation preservation and cost refinement; Section 13.3: BST-preserving insertion plus CLRS fixup/cost bridge; Section 13.4: BST-preserving deletion plus composed fixup/cost bridge,CLRSLean/FourthEdition/Chapter_13.lean; CLRSLean/Chapter_13.lean; CLRSLean/Chapter_13/Section_13_1_Red_Black_Trees.lean; CLRSLean/Status.lean,redBlackShape_delete and exact delete membership are proved; RedBlackShape does not include the separate BST ordering invariant so insertion/deletion correctness is not yet a complete red-black search-tree theorem. -14,Dynamic Programming,partial,14.1;14.2;14.3;14.4;14.5,76,76,5,All 76 selected example-level optimality and pure-function entries are proved; the fourth-edition algorithm/table/cost and generic-DP obligations remain explicitly separated,Bellman rod-cutting recurrence and bottom-up value; mutable-Array bottom-up rod-cutting refinement; matrix-chain lower bound pure optimum split reconstruction and correctness; LCS recurrence pure length/reconstruction and correctness; optimal-BST recurrence evaluator and existential optimal-plan correctness,Section 14.1: cut reconstruction memoization and costs; Section 14.2: tabulated MATRIX-CHAIN-ORDER and costs; Section 14.3: generic DP/memoization interface; Section 14.4: tabulated Θ(mn) LCS; Section 14.5: public executable OBST tables and costs,CLRSLean/FourthEdition/Chapter_14.lean; CLRSLean/Chapter_15.lean; CLRSLean/Chapter_15/Section_15_1_Rod_Cutting.lean; CLRSLean/Chapter_15/Section_15_2_Matrix_Chain_Multiplication.lean; CLRSLean/Chapter_15/Section_15_4_Longest_Common_Subsequence.lean; CLRSLean/Chapter_15/Section_15_5_Optimal_Binary_Search_Trees.lean; CLRSLean/Status.lean,The represented examples have strong mathematical correctness results but do not yet constitute the tabulated/memoized fourth-edition algorithms and generic Elements-of-DP interface. -15,Greedy Algorithms,partial,15.1;15.2;15.3,23,23,1,The fourth-edition facade maps 23 proved tracked theorem groups after excluding moved material to the online ledger; the edition map records exact represented sections and gaps,Activity-selection greedy optimality; Huffman V2 frequency-table optimality and minimum-cost wrappers; GreedyProblem meta-theorem and gsolve_optimal (CLRS §16.2 greedy-choice property and optimal substructure),Section 15.4 (Offline caching): not-started,CLRSLean/FourthEdition/Chapter_15.lean; CLRSLean/Chapter_16.lean; CLRSLean/Chapter_16/Section_16_2_Greedy_Meta.lean; CLRSLean/Status.lean,The canonical fourth-edition ledger excludes 9 matroid and task-scheduling groups recorded in the online-material ledger. Canonical fourth-edition Chapter 15 currently reuses legacy Chapter 16 through a compatibility facade. Legacy source note: The represented Sections 16.1-16.5 cover the core chapter theorem groups; exercises remain an optional second track. -16,Amortized Analysis,selected-section-complete,16.1;16.2;16.3;16.4,66,66,0,The fourth-edition facade reuses 66 proved tracked theorem entries from legacy Chapter 17 across represented Sections 16.1;16.2;16.3;16.4,Aggregate/accounting/potential telescoping; MULTIPOP; executable binary-counter one-step and multi-step trace bounds; dynamic-table potential nonnegativity; concrete amortized-cost unfoldings and transition/capacity wrappers,None,CLRSLean/FourthEdition/Chapter_16.lean; CLRSLean/Chapter_17.lean; CLRSLean/Chapter_17/Section_17_1_Amortized_Framework.lean; CLRSLean/Chapter_17/Section_17_1_Amortized_Framework/Section_17_2_Stack_And_Counter.lean; CLRSLean/Chapter_17/Section_17_4_Dynamic_Tables.lean; Tests/Chapter_17_Interface.lean,Canonical fourth-edition Chapter 16 currently reuses legacy Chapter 17 through a compatibility facade. Legacy source note: No sorry/admit/axiom in Chapter_17; the size-level represented theorem stack is complete. Non-blocking scope note: mutable-array copying allocator constants and sharper RAM models are optional refinements. -17,Augmenting Data Structures,partial,17.1;17.2;17.3,77,77,3,The selected size/generic-augmentation/static-interval results are proved but all three fourth-edition sections retain named integration or complexity obligations,Size augmentation invariant; size recomputation; key preservation; size/rank-preserving local rotations; augmented rank-select correctness; generic rotation-invariant augmentation theorem (CLRS 14.1); interval overlap semantics and search specification; OSRBTree wellSized_insert and wellSized_delete with toRB refinement; generic AugmentedRBTree executable insertion and deletion with wellAugmented_insert and wellAugmented_delete for any augmentation; repaintRoot/rootBlack/baldL/baldR/splitMin/join/del/delete pipeline preserving WellAugmented; deletion refinement erasure toRB_delete with toRB_baldL/toRB_baldR/toRB_splitMin/toRB_join/toRB_del commutations; size and max-high instances recovered,Section 17.1: OS-RANK combined invariants and logarithmic bounds; Section 17.2: augmentation-cost theorem; Section 17.3: interval-specific dynamic/static bridge combined invariants and logarithmic bounds,CLRSLean/FourthEdition/Chapter_17.lean; CLRSLean/Chapter_14.lean; CLRSLean/Chapter_14/Section_14_1_Order_Statistic_Trees.lean; CLRSLean/Chapter_14/Section_14_3_Interval_Trees.lean; CLRSLean/Status.lean,The generic AugmentedRBTree preserves cached fields but the interval-search tree and dynamic augmented red-black tree are separate representations; no theorem combines interval updates with search correctness. -18,B-Trees,main-proof-complete-for-correctness,18.1;18.2;18.3,134,134,0,The fourth-edition facade reuses 134 proved tracked theorem entries from legacy Chapter 18 across represented Sections 18.1;18.2;18.3,Search and minimum-key facts; exact totalKeys node accounting; non-root augmented power lower bound; root empty-or augmented lower bound; structural minKeys wrappers; universal wellFormed_height_log_bound; split-child and non-full insertion invariants; abstract update membership specifications; top-level full-root insertion exact add-one List.Perm semantics WellFormed and conditional-height preservation membership and specification-search compatibility executable-search correctness and absent-key WellFormedUnique preservation; NodeWF DeleteReady KeysSubset and RootDeleteResult contracts; merge and rotation repair packets; exact parent reassembly; composedDelete structural preservation; raw and normalized Multiset.erase semantics under structural assumptions; different-key membership without uniqueness; raw uniqueness preservation from NodeWF and UniqueKeys; normalized deleted-key absence full membership characterization WellFormedUnique preservation and specification membership-oracle compatibility,None,CLRSLean/FourthEdition/Chapter_18.lean; CLRSLean/Chapter_18.lean; CLRSLean/Chapter_18/Section_18_1_B_Tree_Model/HeightBound.lean; CLRSLean/Chapter_18/Section_18_2_B_Tree_Insertion.lean; CLRSLean/Chapter_18/Section_18_3_B_Tree_Deletion/KeyMultiset.lean; CLRSLean/Chapter_18/Section_18_3_B_Tree_Deletion/ExactReassembly.lean; CLRSLean/Chapter_18/Section_18_3_B_Tree_Deletion/Exact.lean; CLRSLean/Chapter_18/Section_18_3_B_Tree_Deletion/WellFormed.lean; Tests/Chapter_18_Search_Interface.lean; Tests/Chapter_18_Height_Interface.lean; Tests/Chapter_18_Insertion_Interface.lean; Tests/Chapter_18_KeyMultiset_Interface.lean; Tests/Chapter_18_Deletion_Reassembly_Interface.lean; Tests/Chapter_18_Deletion_Exact_Interface.lean; Tests/Chapter_18_Deletion_Root_Exact_Interface.lean; Tests/Chapter_18_Interface.lean; Tests/Chapter_18_Deletion_Interface.lean; Tests/Chapter_18_Root_Occupancy.lean,Canonical fourth-edition Chapter 18 currently reuses its legacy source through a compatibility facade. Legacy source note: The flat insert remains the specification layer and the transient empty parent used by splitRoot is not claimed WellFormed; no executable and specification tree-shape equality is claimed; the structural count uses List key slots without a uniqueness premise; the legal empty root is explicit; disk-page layout pointer mutation page I/O counts and RAM semantics remain optional low-level refinements. -19,Data Structures for Disjoint Sets,main-proof-complete,19.1;19.2;19.3;19.4,84,84,0,The fourth-edition facade reuses 84 proved tracked theorem entries from legacy Chapter 21 across represented Sections 19.1;19.2;19.3;19.4,Partition equivalence and exact merge semantics; operation-trace monotonicity; singleton linked lists; weighted-union exact refinement; representative invariant; per-rewrite size doubling; per-element log2 and aggregate n log2 n rewrite bounds; singleton Batteries forests; path-compressing find partition preservation and representative correctness; union-by-rank exact merge refinement; Boolean equivalence-query correctness; exact parent-edge traversal counter; conserved root-mass budget through find/link/union; costed execution erasure and abstract run refinement; per-find and per-union log2 bounds; whole-run m * (2 log2 n + 3) intermediate bound; inverse-Ackermann definition and minimality; Ackermann level/index node potential; path-compression potential monotonicity; equal-rank link pair bound and global link increase at most two; released/boundary/unpleasant path classification; per-find and per-union inverse-Ackermann amortized bounds; whole-run 9 * (m+n) * alpha(n) bound; 18 * m * alpha(n) corollary when n <= m; Chapter 23 union-find connectivity and cycle-test bridge,None,CLRSLean/FourthEdition/Chapter_19.lean; CLRSLean/Chapter_21.lean; CLRSLean/Chapter_21/Section_21_1_Disjoint_Set_Operations.lean; CLRSLean/Chapter_21/Section_21_2_Linked_List_Representation.lean; CLRSLean/Chapter_21/Section_21_3_Disjoint_Set_Forests.lean; CLRSLean/Chapter_21/Section_21_4_Analysis.lean; CLRSLean/Chapter_21/Section_21_4_Analysis/CostedExecution.lean; CLRSLean/Chapter_21/Section_21_4_Analysis/InverseAckermann.lean; CLRSLean/Chapter_23/Section_23_2_Kruskal_And_Prim/S1_UnionFindBridge.lean; Tests/Chapter_21_Interface.lean; Tests/Chapter_23_UnionFind_Interface.lean; docs/proof-audits/chapter-21-closure-2026-07-10.md,Canonical fourth-edition Chapter 19 currently reuses legacy Chapter 21 through a compatibility facade. Legacy source note: No sorry/admit/axiom in the represented chapter; the concrete cost model counts actual parent traversals plus constant operation overhead and proves the advertised inverse-Ackermann bound. Non-blocking scope note: No remaining core Chapter 21 group; lower-level mutable-array/RAM constants and a stateful Chapter 23 Kruskal scan are separate refinements. -20,Elementary Graph Algorithms,main-proof-complete-for-correctness,20.1;20.2;20.3;20.4;20.5,47,47,0,The fourth-edition facade reuses 47 proved tracked theorem entries from legacy Chapter 22 across represented Sections 20.1;20.2;20.3;20.4;20.5,"Finite directed graph with adjacency function; walk/path/cycle definitions; reachability; reflexivity/transitivity/adjacency lemmas; connected components; undirected graph symmetry; fuelled BFS soundness and completeness; BFS closure and termination measure; exact-edge ReachableIn and IsShortestDistance; labelled BFSState with distance and parent; bfsState projection to the reachability BFS; FIFO distance invariant; bfsState_distance_eq_some_iff; bfsState parent edge, unit-level, root-path, coverage, and acyclicity facts; bfsState_isBFSPredecessorTree; bfsState_correct; functional DFS with colors, discovery/finish times, and parents; global DFS color/timestamp invariants; finite white reachability; dfsVisit_blackens_iff_whiteReachable; ParenthesisInvariant; dfs_parenthesis; dfs_parenthesis_cases; dfs_intervals_not_cross; discovery-state and timestamp bridges; ancestor reachability; dfs_parent_discovery_lt; intervalNestedInside_dfs_implies_ancestor; intervalNestedInside_dfs_iff_ancestor; IsDFSTreeEdge; IsDFSBackEdge; IsDFSForwardEdge; IsDFSCrossEdge; dfs_edge_classification_unique; dfs_tree_or_forward_edge_iff_timestamps; dfs_back_edge_iff_timestamps; dfs_cross_edge_iff_timestamps; maximum-finish and first-discovery facts; SCC finish-time ordering; DAG predicate; indegree; Kahn topological sort correctness; isDAG_no_dfs_back_edge; dfs_finish_time_decreases_on_dag_edge; DFS finish-time order permutation and pairwise sorting; dfsTopologicalSort_isTopologicalOrder; transpose graph; strong connectivity and SCC predicates; collecting DFS; Kosaraju order properties; Kosaraju component strong connectivity and maximality; pairwise disjointness; coverage; unique membership; kosarajuComponents_isSCCPartition",None,CLRSLean/FourthEdition/Chapter_20.lean; CLRSLean/Chapter_22.lean; CLRSLean/Chapter_22/Section_22_1_Representing_Graphs.lean; CLRSLean/Chapter_22/Section_22_2_BFS.lean; CLRSLean/Chapter_22/Section_22_3_DFS.lean; CLRSLean/Chapter_22/Section_22_3_DFS/S1_WhitePath.lean; CLRSLean/Chapter_22/Section_22_3_DFS/S2_Intervals.lean; CLRSLean/Chapter_22/Section_22_3_DFS/S3_Bridge.lean; CLRSLean/Chapter_22/Section_22_3_DFS/S4_SCC.lean; CLRSLean/Chapter_22/Section_22_3_DFS/S5_EdgeClassification.lean; CLRSLean/Chapter_22/Section_22_4_Topological_Sort.lean; CLRSLean/Chapter_22/Section_22_5_Strongly_Connected_Components.lean; CLRSLean/Chapter_22/Section_22_5_Strongly_Connected_Components/MergeSortCongr.lean; CLRSLean/Status.lean; Tests/Chapter_22_Interface.lean; Tests/Chapter_22_Closure.lean; docs/proof-audits/chapter-22-closure-2026-07-10.md,"Canonical fourth-edition Chapter 20 currently reuses legacy Chapter 22 through a compatibility facade. Legacy source note: DFS parenthesis, parent-forest ancestor/interval characterization, and unique edge classification are fully proved through dfs_parenthesis, intervalNestedInside_dfs_iff_ancestor, and dfs_edge_classification_unique; Kosaraju correctness is fully proved through scc_finish_time_order, scc_finish_order, kosarajuComponent_scc_core, and kosarajuComponents_isSCCPartition; Chapter 22 main functional correctness is formally sealed by the 2026-07-10 closure audit; explicit work and RAM-cost refinements remain Non-blocking scope note: No remaining core correctness group; explicit work and RAM-cost refinements." -21,Minimum Spanning Trees,main-proof-complete-for-correctness,21.1;21.2,52,52,0,The fourth-edition facade reuses 52 proved tracked theorem entries from legacy Chapter 23 across represented Sections 21.1;21.2,Finite edge-labelled graph and spanning-tree specification; safe-edge and cut-property theorem; canonical unique tree path and automatic exchange; complete sorted Kruskal MST theorem; real Chapter 21 costed union-find threaded through every Kruskal edge; connectivity invariant and mathematical-selection refinement; inverse-Ackermann scan bound and complete O(E log E) work composition; Prim key parent decrease-key and extract-min queue; concrete frontier provider; executable run refinement to PrimTrace; binary-heap O(E log V) operation-count theorem; complete Prim MST theorem,None,CLRSLean/FourthEdition/Chapter_21.lean; CLRSLean/Chapter_23.lean; CLRSLean/Chapter_23/Section_23_1_Growing_Minimum_Spanning_Trees.lean; CLRSLean/Chapter_23/Section_23_2_Kruskal_And_Prim.lean; CLRSLean/Chapter_23/Section_23_2_Kruskal_And_Prim/S1_UnionFindBridge.lean; CLRSLean/Chapter_23/Section_23_2_Kruskal_And_Prim/S2_StatefulKruskal.lean; CLRSLean/Chapter_23/Section_23_2_Kruskal_And_Prim/S3_ExecutablePrim.lean; CLRSLean/Status.lean; Tests/Chapter_23_Interface.lean; Tests/Chapter_23_Closure.lean; Tests/Chapter_23_UnionFind_Interface.lean; Tests/Chapter_23_Implementation_Interface.lean; docs/proof-audits/chapter-23-closure-2026-07-11.md,Canonical fourth-edition Chapter 21 currently reuses legacy Chapter 23 through a compatibility facade. Legacy source note: The correctness boundary remains sealed and now has proved executable semantic and algorithm-level cost refinements. Non-blocking scope note: No remaining core mathematical or functional algorithm group; concrete Batteries binary-heap array refinement and mutable/RAM write semantics remain separate low-level refinements. -22,Single-Source Shortest Paths,selected-section-complete,22.1;22.2;22.3;22.4;22.5,27,27,0,The fourth-edition facade reuses 27 proved tracked theorem entries from legacy Chapter 24 across represented Sections 22.1;22.2;22.3;22.4;22.5,Finite weighted directed-graph model; walks and walk weights; Bellman-Ford relaxation correctness and O(VE) work; DAG-SHORTEST-PATHS correctness and O(V+E) work; nonnegative-weight Dijkstra greedy invariant and O(E log V) abstract work; DijkstraState dijkstraInit dijkstraInit_invariant dijkstraStep DijkstraInvariant dijkstraStep_invariant dijkstraLoop dijkstraLoop_invariant dijkstraLoop_finish dijkstraLoop_correct; difference-constraint feasibility iff no negative cycle; shortestDist distance function; noPath_iff_top; shortestDist_le_walkWeight; IsWalkFrom.append_edge; shortestDist_triangleInequality,None,CLRSLean/FourthEdition/Chapter_22.lean; CLRSLean/Chapter_24.lean; CLRSLean/Chapter_24/Section_24_1_Bellman_Ford.lean; CLRSLean/Chapter_24/Section_24_2_SSSP_In_DAGs.lean; CLRSLean/Chapter_24/Section_24_3_Dijkstra.lean; CLRSLean/Chapter_24/Section_24_4_Difference_Constraints.lean,"Canonical fourth-edition Chapter 22 currently reuses legacy Chapter 24 through a compatibility facade. Legacy source note: Section 24.5 now formalizes the shortest-path distance function and the CLRS Lemmas 24.11-24.13 (triangle inequality, upper-bound, no-path); the subpath and convergence lemmas remain optional. Non-blocking scope note: Optional: subpath property, convergence/path-relaxation, and predecessor-subgraph lemmas." -23,All-Pairs Shortest Paths,main-proof-complete-for-correctness,23.1;23.2;23.3,24,24,0,The fourth-edition facade reuses 24 proved tracked theorem entries from legacy Chapter 25 across represented Sections 23.1;23.2;23.3,FASTER-APSP stabilization and shortest-distance correctness; Floyd-Warshall shortest-distance correctness; predecessor reconstruction walk validity and weight equality; negative-cycle detection; transitiveClosure_iff_exists_walk; Johnson augmented-graph no-negative-cycle preservation potential triangle inequality reweighting nonnegativity and johnsonDist_isShortestDist; johnsonPotential_finite; the general triangle inequality isShortestDist_edge_ineq; johnsonReweightedNonneg; and Theorem 25.6 johnsonAllPairsDist_correct (end-to-end Johnson correctness),None,CLRSLean/FourthEdition/Chapter_23.lean; CLRSLean/Chapter_25.lean; CLRSLean/Chapter_25/Section_25_1_All_Pairs_Model.lean; CLRSLean/Chapter_25/Section_25_2_Floyd_Warshall.lean; CLRSLean/Chapter_25/Section_25_3_Johnsons_Algorithm.lean,Canonical fourth-edition Chapter 23 currently reuses legacy Chapter 25 through a compatibility facade. Legacy source note: Sections 25.1-25.3 prove the advertised correctness stack including reconstruction weight equality transitive closure and end-to-end Johnson correctness. Non-blocking scope note: No remaining core correctness group; a tighter explicit O(n³ log n) repeated-squaring work theorem and lower-level RAM accounting are optional refinements. -24,Maximum Flow,main-proof-complete,24.1;24.2;24.3,18,18,0,The fourth-edition facade reuses 18 proved tracked theorem entries from legacy Chapter 26 across represented Sections 24.1;24.2;24.3,"FlowNetwork model and feasible Flow; flow value and Lemma 26.5 net-flow-across-cut identity; residual network and augmenting-path predicates; generic maximality from no augmenting path; easy MFMC direction cut-capacity-implies-maximal; residual path-length and shortest-distance helpers ResidualPathLength IsShortestDist isShortestDist_self IsShortestDist.unique isShortestDist_triangle ShortestAugmentingPath IsShortestDist.exists_predecessor ShortestAugmentingPath.shortest_prefix ShortestAugmentingPath.exists_shortestDist_le_augment and Lemma 26.7 shortest_path_nondec; the explicit shortest-path construction via back and shortestFlow.ResidualPath with exists_shortest_augmenting_path; the Edmonds-Karp loop ekStep ekIter with shortestAugmentingPath_iff_hasAugmentingPath exists_noAugmentingPath_ekIter and edmondsKarp_maximal; the critical-edge analysis isCritical exists_critical_edge shortest_edge_dist critical_dist_increase and critical_dist_increase_rev (Lemma 26.8), the timeline ekSeq ekPath criticalAt with distAt_mono exists_recovery_step criticalAt_growth and criticalAt_growth_strict, and the counting theorems critical_count_bound and augmentation_count_bound giving the O(VE²) bound; the executable BFS residualBFS with residualBFS_distanceInvariant residualBFS_queue_empty bfsState_distance_eq_some_iff bfsParentResidualPath bfs_shortestAugmenting and ekStep_shortest_path_bfs; BipartiteGraph Matching and unit-capacity toFlowNetwork; matchingFlowFunSummand and feasibility of matchingFlowFun; matchingToFlow and unconditional matchingToFlow_value; Flow.IsIntegral and integral bounds/conservation on L-R pairs; matchingOfIntegralFlow and matchingOfIntegralFlow_size; integral maximum flow via zeroFlow augmentOnce iterAugment bottleneck_ge_one IsIntegral_augment exists_noAugmentingPath_iter; and Theorem 26.12 maxMatching_eq_maxFlow_value",None,CLRSLean/FourthEdition/Chapter_24.lean; CLRSLean/Chapter_26.lean; CLRSLean/Chapter_26/Section_26_1_Flow_Networks.lean; CLRSLean/Chapter_26/Section_26_2_Edmonds_Karp.lean; CLRSLean/Chapter_26/Section_26_2_Edmonds_Karp/Ford_Fulkerson_Augmentation.lean; CLRSLean/Chapter_26/Section_26_2_Edmonds_Karp/S1_ShortestAugmentingPath.lean; CLRSLean/Chapter_26/Section_26_2_Edmonds_Karp/S2_EK_Loop.lean; CLRSLean/Chapter_26/Section_26_2_Edmonds_Karp/S3_WorkAnalysis.lean; CLRSLean/Chapter_26/Section_26_3_Bipartite_Matching.lean; CLRSLean/Chapter_26/Section_26_6_MaxFlow_MinCut.lean; Tests/Chapter_26_Interface.lean; Tests/Chapter_26_Augmentation_Interface.lean; Tests/Chapter_26_Edmonds_Karp_Interface.lean,"Canonical fourth-edition Chapter 24 currently reuses legacy Chapter 26 through a compatibility facade. Legacy source note: Section 26.2 is complete: Lemma 26.7, the Edmonds-Karp loop (edmondsKarp_maximal), the O(VE²) counting argument (critical_count_bound, augmentation_count_bound), and the executable residual BFS (residualBFS, bfs_shortestAugmenting); 26.3 is fully proved including Theorem 26.12; 26.6 is a legacy source-module identifier for Theorem 26.6 rather than a textbook section; Sections 26.4 and 26.5 are deferred outside the current selected milestone." -25,Matchings in Bipartite Graphs,not-started,None,0,0,1,Not represented in the canonical fourth-edition chapter tree,No canonical tracked theorem names yet,Whole fourth-edition chapter theorem inventory and formalization pending,CLRSLean/FourthEdition/Chapter_25.lean,No canonical theorem-bearing source is promoted; the fourth-edition guide records the not-started boundary. -26,Parallel Algorithms,main-proof-complete,26.1;26.2;26.3,95,95,0,The fourth-edition facade reuses 95 proved tracked theorem entries from legacy Chapter 27 across represented Sections 26.1;26.2;26.3,Forward-edge computation DAG with DP longest-path span and span-le-work; explicit residual work and span; computed ready sets and greedy max-busy steps; executing all ready nodes strictly decreases a nonempty residual critical path; completed chained DAG execution with telescoping work and span budgets; T_p <= T_1 / p + T_inf for completed explicit greedy DAG schedules; spawn/sync tree unit-overhead model with span-le-work; balanced parallel-loop exact work and span; Costed value/work/span execution layer; depth-indexed executable P-ADD with pAdd_value and pAdd_correct; race-free executable P-MATMUL with pMatMul_value and pMatMul_correct; pAdd_work_eq; pAdd_span_eq; pMatMul_work_eq; pMatMul_span_eq; pAddWork_allInput_bigTheta; pAddSpan_allInput_bigTheta; pMatMulExecWork_allInput_bigTheta; pMatMulExecSpan_allInput_bigTheta; idealized pMatMulWork/pMatMulSpan recurrence with work Theta(n^3) and span Theta(log n) pow2 closed forms plus all-input upper bounds; executable P-MERGE with pMerge_correct; pMerge_value_sorted; pMerge_value_perm; pMerge_value_length; pMerge_childSizes_add_one; pMerge_childSize_le_threeQuarters; pMerge_work_step_eq; pMerge_span_step_eq; pMerge_work_step_le; pMerge_span_step_le; pMerge_work_lower; pMerge_work_upper; pMerge_span_upper; evenKeys; oddKeys; pMerge_interleaved_span_lower; pMergeSort; pMergeSort_correct; pMergeSort_value_sorted; pMergeSort_value_perm; pMergeSort_value_length; pMergeSort_work_lower; pMergeSort_work_upper; pMergeSort_span_upper; pMergeSort_worstFamily_span_lower; P-MERGE work Theta(n) and span Theta(log^2 n) pow2 closed forms; P-MERGE-SORT work Theta(n log n) and span Theta(log^3 n) pow2 closed forms; parallel Strassen work Theta(n^(log2 7)) and span Theta(log n) pow2 closed forms; pMergeWork_monotone; pMergeSpan_monotone; pMergeSortWork_monotone; pMergeSortSpan_monotone; strassenWork_monotone; strassenSpan_monotone; pMergeWork_power_sandwich; pMergeSpan_power_sandwich; pMergeSortWork_power_sandwich; pMergeSortSpan_power_sandwich; strassenWork_power_sandwich; strassenSpan_power_sandwich; pMergeWork_allInput_bigTheta; pMergeSpan_allInput_bigTheta; pMergeSortWork_allInput_bigTheta; pMergeSortSpan_allInput_bigTheta; strassenWork_allInput_bigTheta; strassenSpan_allInput_bigTheta,None,CLRSLean/FourthEdition/Chapter_26.lean; CLRSLean/Chapter_27.lean; CLRSLean/Chapter_27/Section_27_1_Multithreading_Model.lean; CLRSLean/Chapter_27/Section_27_2_4_Algorithms.lean; CLRSLean/Chapter_27/Section_27_2_4_Algorithms/ParallelStrassen.lean; Tests/Chapter_27_Interface.lean; Tests/Chapter_27_Scheduler_Interface.lean; Tests/Chapter_27_Matrix_Interface.lean; Tests/Chapter_27_ParallelMerge_Interface.lean; Tests/Chapter_27_Closure.lean; CLRSLean/Status.lean,Canonical fourth-edition Chapter 26 currently reuses legacy Chapter 27 through a compatibility facade. Legacy source note: No sorry/admit/axiom occurs in Chapter_27. The Chapter 27 main-text acceptance boundary ends at Section 27.3 and is sealed by Tests/Chapter_27_Closure.lean. The legacy Section_27_2_4_Algorithms path is retained solely for import compatibility; its parallel Strassen recurrence API is a separate named extension. Mutable-array and RAM refinements exercises and chapter-end problems remain outside the advertised scope. -27,Online Algorithms,not-started,None,0,0,1,Not represented in the canonical fourth-edition chapter tree,No canonical tracked theorem names yet,Whole fourth-edition chapter theorem inventory and formalization pending,CLRSLean/FourthEdition/Chapter_27.lean,No canonical theorem-bearing source is promoted; the fourth-edition guide records the not-started boundary. -28,Matrix Operations,main-proof-complete,28.1;28.2;28.3,9,9,0,The fourth-edition facade reuses 9 proved tracked theorem entries from legacy Chapter 28 across represented Sections 28.1;28.2;28.3,exists_lup_decomposition (Theorem 28.1); forwardSubst_spec (Lemma 28.1); backSubst_spec (Lemma 28.2); lupSolve_correct (LUP-SOLVE); inv_eq_lup (Theorem 28.2); cholesky_decomposition (Theorem 28.3); cholesky_unique; normal_equations_minimizes (Theorem 28.4); det_eq_sign_mul_det_of_lup (Corollary to Thm 28.1),None,CLRSLean/FourthEdition/Chapter_28.lean; CLRSLean/Chapter_28.lean; CLRSLean/Chapter_28/Section_28_1_Linear_Equations.lean; CLRSLean/Chapter_28/Section_28_2_Inverting_Matrices.lean; CLRSLean/Chapter_28/Section_28_3_Symmetric_Positive_Definite.lean,"Canonical fourth-edition Chapter 28 currently reuses its legacy source through a compatibility facade. Legacy source note: Sections 28.1-28.3 are complete: LUP decomposition and solving (Theorems 28.1-28.2, Lemmas 28.1-28.2, Algorithm LUP-SOLVE), the det-via-LUP corollary, matrix inversion, the Cholesky decomposition (Theorem 28.3) with uniqueness, least-squares approximation (Theorem 28.4), and the CLRS running-time cost bounds." -29,Linear Programming,partial,29.1;29.2;29.3,10,10,3,All 10 selected fourth-edition-facing groups are proved; the remaining work is normalization/encoding and declaration ownership rather than holes in those selected theorems,isFeasible_iff_exists_slackExtension; shortest-path LP lower-bound and attained-optimum theorems; maximum-flow LP equivalence; minimum-cost-flow LP equivalence; multicommodity-flow LP equivalence; weak_duality (Theorem 29.8); terminal dictionary dual certificate; strongDuality (Theorem 29.9); complementarySlackness_iff_optimal (Theorem 29.10),Section 29.1: general-form normalization and canonical algorithm wrapper; Section 29.2: finite StandardLP encodings and preservation bridges; Section 29.3: canonical ownership for strong duality and complementary slackness,CLRSLean/FourthEdition/Chapter_29.lean; CLRSLean/Chapter_29.lean; CLRSLean/Chapter_29/Section_29_1_Standard_And_Slack_Forms.lean; CLRSLean/Chapter_29/Section_29_2_Formulating_Problems_As_Linear_Programs.lean; CLRSLean/Chapter_29/Section_29_4_Duality.lean; Tests/Chapter_29_Interface.lean; Tests/Chapter_29_Formulations_Interface.lean,The current facade imports the whole legacy chapter while detailed SIMPLEX/initialization modules are also cataloged as online material; the canonical/online declaration boundary must be separated before Chapter 29 can be complete. -30,Polynomials and the FFT,main-proof-complete,30.1;30.2;30.3,34,34,0,The fourth-edition facade maps 34 proved tracked theorem groups after excluding moved material to the online ledger; the edition map records exact represented sections and gaps,Coefficient-vector polynomial round trips and capacity; Horner correctness and exact 2n work; distinct-node interpolation existence uniqueness and round trip; point-value addition and multiplication; exact linear vector-operation work; explicit schoolbook correctness capacity and exact 2mn work; primitive-root reductions and orthogonality; generic positive-exponent DFT evaluation and linearity; sign-explicit Mathlib complex DFT compatibility; both Fourier inverse directions and injectivity; cyclic convolution theorem; inverse pointwise multiplication; no-wrap polynomial coefficient bridge; radix-2 indexing and even/odd split; successively generated twiddle and butterfly executions; recursive FFT execution erasure and equality with DFT; recursive inverse agreement and both round trips; exact execution-field FFT work; power-of-two padding and all-input Theta(n log n) work; generic FFT multiplication execution and erasure; generic FFT multiplication correctness under minimal fit; automatic positive sizing capacity and primitive complex root; unconditional complex FFT multiplication correctness; exact execution-field multiplication composition; bounded-input multiplication and all-input Theta(n log n) work; layered-network evaluation; exact butterfly count; exact butterfly depth; exact primitive gate count; exact primitive depth,None,CLRSLean/FourthEdition/Chapter_30.lean; CLRSLean/Chapter_30.lean; CLRSLean/Chapter_30/Section_30_1_Representing_Polynomials.lean; CLRSLean/Chapter_30/Section_30_2_DFT_And_FFT.lean; CLRSLean/Chapter_30/Section_30_2_DFT_And_FFT/RecursiveFFT/Definitions.lean; CLRSLean/Chapter_30/Section_30_2_DFT_And_FFT/RecursiveFFT/Correctness.lean; CLRSLean/Chapter_30/Section_30_2_DFT_And_FFT/RecursiveFFT/Costs.lean; CLRSLean/Chapter_30/Section_30_2_DFT_And_FFT/PolynomialMultiplication.lean; CLRSLean/Chapter_30/Section_30_3_Efficient_FFT_Implementations.lean; CLRSLean/Chapter_30/Section_30_3_Efficient_FFT_Implementations/ParallelFFT.lean; Tests/Chapter_30_Interface.lean; Tests/Chapter_30_DFT_Interface.lean; Tests/Chapter_30_RecursiveFFT_Interface.lean; Tests/Chapter_30_PolynomialMultiplication_Interface.lean; Tests/Chapter_30_Milestone1_Closure.lean; Tests/Chapter_30_ParallelFFT_Interface.lean; Tests/Chapter_30_Milestone2_Closure.lean; CLRSLean/Status.lean; docs/proof-map.md,"The canonical fourth-edition ledger excludes 12 bit-reversal and iterative-FFT groups recorded in the online-material ledger; the FFT-circuit groups remain canonical. Canonical fourth-edition Chapter 30 currently reuses its legacy source through a compatibility facade. Legacy source note: Exact generic ring and characteristic-zero field arithmetic over fixed and power-of-two vectors; execution arithmetic is 2*k*2^k and total charged work is 2^k + 2*k*2^k; circuit butterflies are k*2^(k-1), primitive gates are 3*k*2^(k-1), butterfly depth is k, and primitive depth is 2*k; excluded implementation and numerical layers do not reopen the proved boundary. Non-blocking scope note: No remaining main-text group within the reviewed boundary; mutable and in-place arrays, RAM/cache/hardware costs, floating-point error, concrete scheduling, NTT/code generation, exercises, and Problems 30-1 through 30-6 are excluded." -31,Number-Theoretic Algorithms,selected-section-complete,31.1;31.2;31.3;31.4;31.5;31.6;31.7;31.8,15,15,0,The fourth-edition facade maps 15 proved tracked theorem groups after excluding moved material to the online ledger; the edition map records exact represented sections and gaps,division_theorem (Theorem 31.1); euclid_recursion (Lemma 31.2); gcd_is_linear_combination (Lemma 31.3); gcd_is_smallest_positive_linear_combination (Theorem 31.2); exists_mul_inverse_mod (Theorem 31.6); modular_linear_solvable (Theorem 31.11); chinese_remainder (Theorem 31.27); fermat_little_theorem (Theorem 31.30); euler_theorem; rsa_correct (Theorem 31.36); fermat_test (Theorem 31.31),None,CLRSLean/FourthEdition/Chapter_31.lean; CLRSLean/Chapter_31.lean; CLRSLean/Chapter_31/Section_31_1_Elementary_Number_Theory.lean; CLRSLean/Chapter_31/Section_31_2_Greatest_Common_Divisor.lean; CLRSLean/Chapter_31/Section_31_3_Modular_Arithmetic.lean; CLRSLean/Chapter_31/Section_31_4_Solving_Modular_Linear_Equations.lean; CLRSLean/Chapter_31/Section_31_5_Chinese_Remainder_Theorem.lean; CLRSLean/Chapter_31/Section_31_6_Powers_Of_An_Element.lean; CLRSLean/Chapter_31/Section_31_7_RSA.lean; CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean,"The canonical fourth-edition ledger excludes 1 integer-factorization group recorded in the online-material ledger. Canonical fourth-edition Chapter 31 currently reuses its legacy source through a compatibility facade. Legacy source note: Sections 31.1-31.9 fully proved; running-time and probabilistic analyses deferred. Non-blocking scope note: Running-time analyses, the general CRT, Miller-Rabin, and the full Pollard-s-rho probabilistic analysis (see chapter guide)." -32,String Matching,partial,32.1,19,19,4,The fourth-edition facade reuses 19 proved tracked theorem entries from legacy Chapter 32 across represented Sections 32.1; the edition map records explicit remaining gaps,String model (14 lemmas); naiveMatcher soundness/completeness (5 theorems),Section 32.2 (The Rabin–Karp algorithm): not-started; Section 32.3 (String matching with finite automata): not-started; Section 32.4 (The Knuth–Morris–Pratt algorithm): not-started; Section 32.5 (Suffix arrays): not-started,CLRSLean/FourthEdition/Chapter_32.lean; CLRSLean/Chapter_32.lean; CLRSLean/Chapter_32/Section_32_1_String_Model.lean; CLRSLean/Chapter_32/Section_32_1_String_Model/Naive_Matcher.lean,Canonical fourth-edition Chapter 32 currently reuses its legacy source through a compatibility facade. Legacy source note: All 19 theorems are kernel-checked. Sections 32.2-32.4 deferred. Original formalization by caiwei2026 (PR #85). -33,Machine-Learning Algorithms,not-started,None,0,0,1,Not represented in the canonical fourth-edition chapter tree,No canonical tracked theorem names yet,Whole fourth-edition chapter theorem inventory and formalization pending,CLRSLean/FourthEdition/Chapter_33.lean,No canonical theorem-bearing source is promoted; the fourth-edition guide records the not-started boundary. -34,NP-Completeness,not-started,None,0,0,1,Not represented in the canonical fourth-edition chapter tree,No canonical tracked theorem names yet,Whole fourth-edition chapter theorem inventory and formalization pending,CLRSLean/FourthEdition/Chapter_34.lean,No canonical theorem-bearing source is promoted; the fourth-edition guide records the not-started boundary. -35,Approximation Algorithms,not-started,None,0,0,1,Not represented in the canonical fourth-edition chapter tree,No canonical tracked theorem names yet,Whole fourth-edition chapter theorem inventory and formalization pending,CLRSLean/FourthEdition/Chapter_35.lean,No canonical theorem-bearing source is promoted; the fourth-edition guide records the not-started boundary. +chapter_no,chapter_title,repo_status,represented_sections,tracked_key_theorems,proved_tracked_theorems,edition_gap_units,completion_read,proved_key_theorem_groups,remaining_edition_gaps,evidence_source,notes +1,The Role of Algorithms in Computing,expository,Chapter_01,0,0,0,The fourth-edition facade reuses 0 proved tracked theorem entries from legacy Chapter 1 across represented Sections Chapter_01,Project conventions and reader contract,None,CLRSLean/FourthEdition/Chapter_01.lean; CLRSLean/Chapter_01.lean,Canonical fourth-edition Chapter 1 currently reuses its legacy source through a compatibility facade. Legacy source note: No formal theorem target. +2,Getting Started,main-proof-complete,2.1;2.2;2.3,7,7,0,The fourth-edition facade reuses 7 proved tracked theorem entries from legacy Chapter 2 across represented Sections 2.1;2.2;2.3,Insertion sort sortedness and permutation; insertion-sort quadratic comparison bound; merge-sort sortedness/permutation; power-of-two closed form; exact-power Theta(n log n) via the Master Theorem; all-input Theta(n log n) (theta_n_log_n_all_inputs) via the Chapter 4.6 floor/ceiling sandwich bridge,None,CLRSLean/FourthEdition/Chapter_02.lean; CLRSLean/Chapter_02.lean; CLRSLean/Status.lean,Canonical fourth-edition Chapter 2 currently reuses its legacy source through a compatibility facade. Legacy source note: Current main section interfaces are stable; the arbitrary-size floor/ceiling merge-sort recurrence now has the all-input Theta(n log n) bound. Non-blocking scope note: Optional strengthening: full RAM semantics; exercises. +3,Characterizing Running Times,partial,3.1;3.2;3.3,47,47,1,Sections 3.1 and 3.3 are represented through the compatibility facade; Section 3.2 retains one exact formal-interface gap,CLRS asymptotic notation wrappers; polynomial/exponential/log/factorial/harmonic/floor-ceiling growth facts; complete comparison hierarchy 1 < log(log n) < log n < n < n^a < 2^n < n! with log_b base-change facts; Fibonacci-number growth via Binet closed form Theta(phi^n) and closest-integer bound; iterated logarithm lg* (definition tower recurrence monotonicity and o(log n) slow growth),Section 3.2: shared-threshold two-sided Θ witness and expected o/ω algebra/duality wrappers,CLRSLean/FourthEdition/Chapter_03.lean; CLRSLean/Chapter_03.lean; CLRSLean/Status.lean,All 47 selected entries are proved. The chapter remains partial because proved/tracked inventory completion does not include the missing Section 3.2 formal-interface wrappers. +4,Divide-and-Conquer,partial,4.1;4.2;4.3;4.4;4.5;4.6,82,82,3,The fourth-edition facade maps 82 proved tracked theorem groups after excluding moved material to the online ledger; the edition map records exact represented sections and gaps,Strassen 2x2 block algebra; recursive Strassen algorithm with correctness and padding; Strassen Theta(n^(log2 7)) runtime via Master case 1; substitution templates; recursion-tree expansions; exact-power Master cases; floor/ceiling all-input transfer and discrete Master wrappers; real-log case-1 bridge; real-log-log case-2 bridge; case-3 regularity bridge from tailDominatedScale to the forcing function; master_case2_polylog_forcing; master_case2_polylog_forcing_all_input,Section 4.1 (Multiplying square matrices): partial; Section 4.6 (Proof of the continuous master theorem): partial; Section 4.7 (Akra–Bazzi recurrences): not-started,CLRSLean/FourthEdition/Chapter_04.lean; CLRSLean/Chapter_04.lean; CLRSLean/Chapter_04/Section_04_2_Strassen_Algorithm.lean; Tests/Chapter_04_Interface.lean; CLRSLean/Status.lean; docs/chapters/chapter-04.md; docs/proof-map.md,"The canonical fourth-edition ledger excludes 14 maximum-subarray groups recorded in the online-material ledger. Canonical fourth-edition Chapter 4 currently reuses its legacy source through a compatibility facade. Legacy source note: The maximum-subarray metric counts recursive frames scan transitions and constant-size candidate choices; its scan counters are proved from the costed scan executions; it excludes explicit split-tree construction integer arithmetic List allocation/copying garbage collection and RAM semantics. The polylog case-2 Master extension proves polynomial normalized forcing c*j^k <= forcing <= C*j^k gives T(b^i) = Theta((i+1)^(k+1)*a^i), with the all-input wrapper master_case2_polylog_forcing_all_input." +5,Probabilistic Analysis and Randomized Algorithms,selected-section-complete,5.1;5.2;5.3;5.4,25,25,0,The fourth-edition facade reuses 25 proved tracked theorem entries from legacy Chapter 5 across represented Sections 5.1;5.2;5.3;5.4,Hiring problem finite rank-symmetry probability; harmonic expectation; logarithmic asymptotic expected-hires theorem; hat-check expected fixed points equal 1 via indicators and permutation symmetry; RANDOMIZE-IN-PLACE uniform permutation (Lemma 5.5) via choice-vector bijection; birthday-paradox expected collisions k(k-1)/(2n); balls-and-bins expected occupancy k/n; longest-streak tail bound n/2^t; expected-longest-streak upper bound expectedLongestStreak_le (E[L] <= log2 n + 2) via the tail-sum identity expectedLongestStreak_eq_tailSum; expected-longest-streak lower bound expectedLongestStreak_lowerBound (E[L] >= log2 n / 8 for n >= 16) via the block-partition exact count prob_noFullHeadBlock = (1 - 2^-k)^m and the layer-cake lower bound expectedLongestStreak_ge_mul_tail; executable on-line threshold strategy with exact some/none contracts and finite success-probability definition; on-line hiring success-probability closed form probHireBest_eq = (k/n)(H_{n-1} - H_{k-1}) via the per-position probability probBestAt and the harmonic-difference sum sum_recip_Icc_eq_harmonic_sub; on-line hiring 1/e asymptotic probHireBest_asymptotic: the success probability for the threshold floor(n/e) tends to 1/e via floor asymptotics and the Euler-Mascheroni harmonic difference,None,CLRSLean/FourthEdition/Chapter_05.lean; CLRSLean/Chapter_05.lean; CLRSLean/Chapter_05/Section_05_4_Probabilistic_Analysis.lean; CLRSLean/Chapter_05/Section_05_4_Probabilistic_Analysis/OnlineHiring.lean; Tests/Chapter_05_Interface.lean; CLRSLean/Status.lean,"Canonical fourth-edition Chapter 5 currently reuses its legacy source through a compatibility facade. Legacy source note: Uses finite discrete uniform probability over rank symmetry uniform permutations product-uniform sample spaces and independent-swap-choice sample spaces; the expected longest streak is now Θ(log n): E[L] ≤ log2 n + 2 and E[L] ≥ log2 n / 8 for n ≥ 16, and the on-line hiring success closed form (k/n)(H_{n-1} - H_{k-1}) with its 1/e asymptotic for the threshold floor(n/e) are proved." +6,Heapsort,main-proof-complete,6.1;6.2;6.3;6.4;6.5,78,78,0,The fourth-edition facade reuses 78 proved tracked theorem entries from legacy Chapter 6 across represented Sections 6.1;6.2;6.3;6.4;6.5,Indexed heap predicates; MAX-HEAPIFY repair; BUILD-MAX-HEAP; in-place heapsort invariant and correctness; costed heapify/build/heapsort erasure and coarse O(n)/O(n^2)/O(n^2) envelopes; priority-queue operation state theorems,None,CLRSLean/FourthEdition/Chapter_06.lean; CLRSLean/Chapter_06.lean; CLRSLean/Chapter_06/Section_06_4_Heapsort/CostedExecution.lean; Tests/Chapter_06_Interface.lean; CLRSLean/Status.lean,"Canonical fourth-edition Chapter 6 currently reuses its legacy source through a compatibility facade. Legacy source note: The unit control-step metric counts heapify frames and nontrivial extraction transitions; build orchestration, guards, List operations, allocation, and calls are not charged. Non-blocking scope note: tight textbook O(log n)/O(n)/O(n log n) costs and imperative RAM/List-operation semantics are optional refinements." +7,Quicksort,partial,7.1;7.2;7.3;7.4,30,30,1,The fourth-edition facade reuses 30 proved tracked theorem entries from legacy Chapter 7 across represented Sections 7.1;7.2;7.3;7.4; the edition map records explicit remaining gaps,Partition correctness; scan-state partition loop; mutable-Array PARTITION refinement (partitionOnArray); quicksort sortedness/permutation; quadratic comparison bound; randomized-quicksort expected-comparison named closed form and harmonic bounds; random-permutation first-choice symmetry; pairwise comparison probability compared_prob = 2/(j-i+1); sum_compared_prob_eq_expectedComparisons bridge; expectedComparisons_isBigTheta_nlogn,Section 7.4 (Analysis of quicksort): partial,CLRSLean/FourthEdition/Chapter_07.lean; CLRSLean/Chapter_07.lean; CLRSLean/Chapter_07/Section_07_1_Description_Of_Quicksort.lean; CLRSLean/Chapter_07/Section_07_2_Performance_Of_Quicksort.lean; CLRSLean/Chapter_07/Section_07_3_Randomized_Quicksort.lean,Canonical fourth-edition Chapter 7 currently reuses its legacy source through a compatibility facade. Legacy source note: The bridge between the random-permutation probability model and the algebraic closed form is proved via sum_compared_prob_eq_expectedComparisons; the Theta(n log n) asymptotic follows from expectedComparisons_isBigTheta_nlogn. +8,Sorting in Linear Time,main-proof-complete-for-correctness,8.1;8.2;8.3;8.4,36,36,0,The fourth-edition facade reuses 36 proved tracked theorem entries from legacy Chapter 8 across represented Sections 8.1;8.2;8.3;8.4,Comparison decision-tree model over Fin n; run_injective_of_correctSort; factorial_le_leafCount_of_correctSort (n! leaf lower bound); leafCount_le_two_pow_height; height_le_logb_factorial (log2(n!) <= height); factorial_sq_ge_pow_self ((n!)^2 >= n^n); logb_factorial_ge_half_mul_logb; comparisonSort_worstCase_lowerBound (worst-case comparisons >= (n/2)(log2 n - 1)); stable counting sort; count-table refinement; mutable output-array counting sort with linear work bound; abstract and natural-key radix sort; deterministic bucket-sort correctness; finite-uniform bucket collision and second moment; textbookBucketSortCost; fintypeExpect_textbookBucketSortCost_eq_expectedBucketSortCost; expectedTextbookBucketSortCost_isBigO,None,CLRSLean/FourthEdition/Chapter_08.lean; CLRSLean/Chapter_08.lean; CLRSLean/Chapter_08/Section_08_1_Lower_Bound_For_Sorting.lean; CLRSLean/Chapter_08/Section_08_2_Counting_Sort.lean; CLRSLean/Chapter_08/Section_08_2_Counting_Sort/CountTables.lean; CLRSLean/Chapter_08/Section_08_2_Counting_Sort/MutableOutputArray.lean; CLRSLean/Chapter_08/Section_08_3_Radix_Sort.lean; CLRSLean/Chapter_08/Section_08_4_Bucket_Sort.lean; CLRSLean/Status.lean; Tests/Chapter_08_Interface.lean,Canonical fourth-edition Chapter 8 currently reuses its legacy source through a compatibility facade. Legacy source note: The decision-tree lower bound is proved for the model over Fin n distinct elements; the CLRS unit-cost random variable has linear expectation; executable cost refinement and RAM accounting do not block the mathematical correctness milestone. Non-blocking scope note: a single-pass executable bucket builder costed per-bucket sorter and execution-cost refinement are optional implementation layers; RAM-level bookkeeping of individual comparisons is out of scope. +9,Medians and Order Statistics,main-proof-complete,9.1;9.2;9.3,72,72,0,The fourth-edition facade reuses 72 proved tracked theorem entries from legacy Chapter 9 across represented Sections 9.1;9.2;9.3,Pairwise simultaneous minimum/maximum correctness; CLRS 3 floor(n/2) comparison bound; rank certificates; specification select; quickselect; pivot-parametric SELECT totality and correctness; five-element median certificate; grouped split counts; recursive median-of-medians pivot membership totality correctness and branch bound; linear recurrence induction; schedule-driven fresh-rank path cost erasure and rank correctness; pointwise actual-continuation-to-larger-side coupling; nested conditional-uniform RANDOMIZED-SELECT expectation; concrete-to-majorizer bridge; expected partition-work bound E[C] <= 4*c*n; end-to-end recursive median-of-medians comparison bound including nested pivot work <= 100n,None,CLRSLean/FourthEdition/Chapter_09.lean; CLRSLean/Chapter_09.lean; CLRSLean/Chapter_09/Section_09_1_Minimum_And_Maximum.lean; CLRSLean/Chapter_09/Section_09_2_Select_By_Rank.lean; CLRSLean/Chapter_09/Section_09_3_Deterministic_Select.lean; CLRSLean/Chapter_09/Section_09_3_Deterministic_Select/Randomized_Select.lean; Tests/Chapter_09_Interface.lean; Tests/Chapter_09_Closure.lean; CLRSLean/Status.lean,Canonical fourth-edition Chapter 9 currently reuses its legacy source through a compatibility facade. Legacy source note: No unfinished proof markers in the represented modules; randomized cost charges c*currentLength only and excludes RNG selectByRank specification sorting list primitives allocation and RAM work +10,Elementary Data Structures,partial,10.1;10.2;10.3,12,12,1,The fourth-edition facade reuses 12 proved tracked theorem entries from legacy Chapter 10 across represented Sections 10.1;10.2;10.3; the edition map records explicit remaining gaps,Stack pop/push theorem; queue enqueue/dequeue theorems; linked-list search and delete facts; rooted-tree rose/LCRS forest round-trip isomorphism and Equiv bijection; single-tree round trip; preorder and node-count structure preservation,Section 10.1 (Simple array-based data structures): partial,CLRSLean/FourthEdition/Chapter_10.lean; CLRSLean/Chapter_10.lean; CLRSLean/Chapter_10/Section_10_4_Rooted_Trees.lean; CLRSLean/Status.lean,Canonical fourth-edition Chapter 10 currently reuses its legacy source through a compatibility facade. Legacy source note: Current model intentionally avoids imperative memory; the represented functional interfaces are complete. +11,Hash Tables,partial,11.1;11.2;11.3;11.4,48,48,1,The fourth-edition facade maps 48 proved tracked theorem groups after excluding moved material to the online ledger; the edition map records exact represented sections and gaps,Direct-address insert/search/delete; deterministic chained hash insert/delete/search facts; finite-uniform singleton bucket probability; uniform-average additivity and nonnegativity; expected chain length equals load factor; unsuccessful-search cost equals one plus load factor and is at least one; finite insert increases total chain length load factor expected chain length and unsuccessful-search cost; SUHA true-expectation chain length and unsuccessful-search cost; SUHA pairwise collision probability equals one over m; SUHA successful-search cost equals one plus (n-1)/(2m); universal random hash-function expected collision and search-cost bounds; division and multiplication method range bounds; concrete prime-field affine universal family satisfying IsUniversal with instantiated collision and search-cost bounds; open-addressing functional model correctness; linear/quadratic/double hashing probe schemes; uniform-hashing tail probability bounds; expected unsuccessful/insertion/successful probe bounds,Section 11.5 (Practical considerations): not-started,CLRSLean/FourthEdition/Chapter_11.lean; CLRSLean/Chapter_11.lean; CLRSLean/Chapter_11/Section_11_2_Chained_Hash_Tables.lean; CLRSLean/Chapter_11/Section_11_3_Hash_Functions.lean; CLRSLean/Chapter_11/Section_11_4_Open_Addressing.lean; CLRSLean/Status.lean,The canonical fourth-edition ledger excludes 3 perfect-hashing groups recorded in the online-material ledger. Canonical fourth-edition Chapter 11 currently reuses its legacy source through a compatibility facade. Legacy source note: Chapter 11 proves SUHA successful and unsuccessful search costs universal hashing collision and search-cost bounds an affine universal family open-addressing expected-probe bounds and two-level perfect hashing; only low-level operational accounting remains. +12,Binary Search Trees,main-proof-complete-for-correctness,12.1;12.2;12.3,40,40,0,The fourth-edition facade reuses 40 proved tracked theorem entries from legacy Chapter 12 across represented Sections 12.1;12.2;12.3,Search; min/max; insertion; complete successor/predecessor specifications; functional delete membership and ordering; search and neighbor queries after updates; faithful zipper reconstruction; iterative search equivalence; transplant ordering preservation; deletion-via-transplant equivalence; parent-ascent successor/predecessor equivalence; imperative pointer-heap node/store model; heap-to-tree abstraction faithfulness; pointer frame rules; in-place TRANSPLANT refinement; pointer TREE-INSERT leaf-attachment refinement,None,CLRSLean/FourthEdition/Chapter_12.lean; CLRSLean/Chapter_12.lean; CLRSLean/Chapter_12/Section_12_1_Binary_Search_Trees.lean; CLRSLean/Status.lean; Tests/Chapter_12_Interface.lean,Canonical fourth-edition Chapter 12 currently reuses its legacy source through a compatibility facade. Legacy source note: The represented mathematical and refinement interfaces are complete; lower-level pointer deletion and RAM accounting do not block the correctness milestone. Non-blocking scope note: pointer-level in-place delete and explicit RAM costs are optional low-level refinements. +13,Red-Black Trees,partial,13.1;13.2;13.3;13.4,39,39,3,The color/black-height and functional key-set/shape layers are proved; three fourth-edition sections still lack the complete ordered-search-tree and cost/refinement stack,Rotation membership; repaint membership; no-red-red; black-height; local red-black shape preservation; insertion-fixup certificates; executable insert and redBlackShape_insert; height_log_bound (Lemma 13.1); executable baldL/baldR/splitMin/join/del/delete; inTree_delete_iff; local delete-fixup membership and shape certificates; deficit-absorbing rebalancer certificates baldL_shape and baldR_shape; splitMin_invariant; del_invariant; redBlackShape_delete,Section 13.2: BST/inorder rotation preservation and cost refinement; Section 13.3: BST-preserving insertion plus CLRS fixup/cost bridge; Section 13.4: BST-preserving deletion plus composed fixup/cost bridge,CLRSLean/FourthEdition/Chapter_13.lean; CLRSLean/Chapter_13.lean; CLRSLean/Chapter_13/Section_13_1_Red_Black_Trees.lean; CLRSLean/Status.lean,redBlackShape_delete and exact delete membership are proved; RedBlackShape does not include the separate BST ordering invariant so insertion/deletion correctness is not yet a complete red-black search-tree theorem. +14,Dynamic Programming,partial,14.1;14.2;14.3;14.4;14.5,76,76,5,All 76 selected example-level optimality and pure-function entries are proved; the fourth-edition algorithm/table/cost and generic-DP obligations remain explicitly separated,Bellman rod-cutting recurrence and bottom-up value; mutable-Array bottom-up rod-cutting refinement; matrix-chain lower bound pure optimum split reconstruction and correctness; LCS recurrence pure length/reconstruction and correctness; optimal-BST recurrence evaluator and existential optimal-plan correctness,Section 14.1: cut reconstruction memoization and costs; Section 14.2: tabulated MATRIX-CHAIN-ORDER and costs; Section 14.3: generic DP/memoization interface; Section 14.4: tabulated Θ(mn) LCS; Section 14.5: public executable OBST tables and costs,CLRSLean/FourthEdition/Chapter_14.lean; CLRSLean/Chapter_15.lean; CLRSLean/Chapter_15/Section_15_1_Rod_Cutting.lean; CLRSLean/Chapter_15/Section_15_2_Matrix_Chain_Multiplication.lean; CLRSLean/Chapter_15/Section_15_4_Longest_Common_Subsequence.lean; CLRSLean/Chapter_15/Section_15_5_Optimal_Binary_Search_Trees.lean; CLRSLean/Status.lean,The represented examples have strong mathematical correctness results but do not yet constitute the tabulated/memoized fourth-edition algorithms and generic Elements-of-DP interface. +15,Greedy Algorithms,partial,15.1;15.2;15.3,23,23,1,The fourth-edition facade maps 23 proved tracked theorem groups after excluding moved material to the online ledger; the edition map records exact represented sections and gaps,Activity-selection greedy optimality; Huffman V2 frequency-table optimality and minimum-cost wrappers; GreedyProblem meta-theorem and gsolve_optimal (CLRS §16.2 greedy-choice property and optimal substructure),Section 15.4 (Offline caching): not-started,CLRSLean/FourthEdition/Chapter_15.lean; CLRSLean/Chapter_16.lean; CLRSLean/Chapter_16/Section_16_2_Greedy_Meta.lean; CLRSLean/Status.lean,The canonical fourth-edition ledger excludes 9 matroid and task-scheduling groups recorded in the online-material ledger. Canonical fourth-edition Chapter 15 currently reuses legacy Chapter 16 through a compatibility facade. Legacy source note: The represented Sections 16.1-16.5 cover the core chapter theorem groups; exercises remain an optional second track. +16,Amortized Analysis,selected-section-complete,16.1;16.2;16.3;16.4,66,66,0,The fourth-edition facade reuses 66 proved tracked theorem entries from legacy Chapter 17 across represented Sections 16.1;16.2;16.3;16.4,Aggregate/accounting/potential telescoping; MULTIPOP; executable binary-counter one-step and multi-step trace bounds; dynamic-table potential nonnegativity; concrete amortized-cost unfoldings and transition/capacity wrappers,None,CLRSLean/FourthEdition/Chapter_16.lean; CLRSLean/Chapter_17.lean; CLRSLean/Chapter_17/Section_17_1_Amortized_Framework.lean; CLRSLean/Chapter_17/Section_17_1_Amortized_Framework/Section_17_2_Stack_And_Counter.lean; CLRSLean/Chapter_17/Section_17_4_Dynamic_Tables.lean; Tests/Chapter_17_Interface.lean,Canonical fourth-edition Chapter 16 currently reuses legacy Chapter 17 through a compatibility facade. Legacy source note: No sorry/admit/axiom in Chapter_17; the size-level represented theorem stack is complete. Non-blocking scope note: mutable-array copying allocator constants and sharper RAM models are optional refinements. +17,Augmenting Data Structures,partial,17.1;17.2;17.3,77,77,3,The selected size/generic-augmentation/static-interval results are proved but all three fourth-edition sections retain named integration or complexity obligations,Size augmentation invariant; size recomputation; key preservation; size/rank-preserving local rotations; augmented rank-select correctness; generic rotation-invariant augmentation theorem (CLRS 14.1); interval overlap semantics and search specification; OSRBTree wellSized_insert and wellSized_delete with toRB refinement; generic AugmentedRBTree executable insertion and deletion with wellAugmented_insert and wellAugmented_delete for any augmentation; repaintRoot/rootBlack/baldL/baldR/splitMin/join/del/delete pipeline preserving WellAugmented; deletion refinement erasure toRB_delete with toRB_baldL/toRB_baldR/toRB_splitMin/toRB_join/toRB_del commutations; size and max-high instances recovered,Section 17.1: OS-RANK combined invariants and logarithmic bounds; Section 17.2: augmentation-cost theorem; Section 17.3: interval-specific dynamic/static bridge combined invariants and logarithmic bounds,CLRSLean/FourthEdition/Chapter_17.lean; CLRSLean/Chapter_14.lean; CLRSLean/Chapter_14/Section_14_1_Order_Statistic_Trees.lean; CLRSLean/Chapter_14/Section_14_3_Interval_Trees.lean; CLRSLean/Status.lean,The generic AugmentedRBTree preserves cached fields but the interval-search tree and dynamic augmented red-black tree are separate representations; no theorem combines interval updates with search correctness. +18,B-Trees,main-proof-complete-for-correctness,18.1;18.2;18.3,134,134,0,The fourth-edition facade reuses 134 proved tracked theorem entries from legacy Chapter 18 across represented Sections 18.1;18.2;18.3,Search and minimum-key facts; exact totalKeys node accounting; non-root augmented power lower bound; root empty-or augmented lower bound; structural minKeys wrappers; universal wellFormed_height_log_bound; split-child and non-full insertion invariants; abstract update membership specifications; top-level full-root insertion exact add-one List.Perm semantics WellFormed and conditional-height preservation membership and specification-search compatibility executable-search correctness and absent-key WellFormedUnique preservation; NodeWF DeleteReady KeysSubset and RootDeleteResult contracts; merge and rotation repair packets; exact parent reassembly; composedDelete structural preservation; raw and normalized Multiset.erase semantics under structural assumptions; different-key membership without uniqueness; raw uniqueness preservation from NodeWF and UniqueKeys; normalized deleted-key absence full membership characterization WellFormedUnique preservation and specification membership-oracle compatibility,None,CLRSLean/FourthEdition/Chapter_18.lean; CLRSLean/Chapter_18.lean; CLRSLean/Chapter_18/Section_18_1_B_Tree_Model/HeightBound.lean; CLRSLean/Chapter_18/Section_18_2_B_Tree_Insertion.lean; CLRSLean/Chapter_18/Section_18_3_B_Tree_Deletion/KeyMultiset.lean; CLRSLean/Chapter_18/Section_18_3_B_Tree_Deletion/ExactReassembly.lean; CLRSLean/Chapter_18/Section_18_3_B_Tree_Deletion/Exact.lean; CLRSLean/Chapter_18/Section_18_3_B_Tree_Deletion/WellFormed.lean; Tests/Chapter_18_Search_Interface.lean; Tests/Chapter_18_Height_Interface.lean; Tests/Chapter_18_Insertion_Interface.lean; Tests/Chapter_18_KeyMultiset_Interface.lean; Tests/Chapter_18_Deletion_Reassembly_Interface.lean; Tests/Chapter_18_Deletion_Exact_Interface.lean; Tests/Chapter_18_Deletion_Root_Exact_Interface.lean; Tests/Chapter_18_Interface.lean; Tests/Chapter_18_Deletion_Interface.lean; Tests/Chapter_18_Root_Occupancy.lean,Canonical fourth-edition Chapter 18 currently reuses its legacy source through a compatibility facade. Legacy source note: The flat insert remains the specification layer and the transient empty parent used by splitRoot is not claimed WellFormed; no executable and specification tree-shape equality is claimed; the structural count uses List key slots without a uniqueness premise; the legal empty root is explicit; disk-page layout pointer mutation page I/O counts and RAM semantics remain optional low-level refinements. +19,Data Structures for Disjoint Sets,main-proof-complete,19.1;19.2;19.3;19.4,84,84,0,The fourth-edition facade reuses 84 proved tracked theorem entries from legacy Chapter 21 across represented Sections 19.1;19.2;19.3;19.4,Partition equivalence and exact merge semantics; operation-trace monotonicity; singleton linked lists; weighted-union exact refinement; representative invariant; per-rewrite size doubling; per-element log2 and aggregate n log2 n rewrite bounds; singleton Batteries forests; path-compressing find partition preservation and representative correctness; union-by-rank exact merge refinement; Boolean equivalence-query correctness; exact parent-edge traversal counter; conserved root-mass budget through find/link/union; costed execution erasure and abstract run refinement; per-find and per-union log2 bounds; whole-run m * (2 log2 n + 3) intermediate bound; inverse-Ackermann definition and minimality; Ackermann level/index node potential; path-compression potential monotonicity; equal-rank link pair bound and global link increase at most two; released/boundary/unpleasant path classification; per-find and per-union inverse-Ackermann amortized bounds; whole-run 9 * (m+n) * alpha(n) bound; 18 * m * alpha(n) corollary when n <= m; Chapter 23 union-find connectivity and cycle-test bridge,None,CLRSLean/FourthEdition/Chapter_19.lean; CLRSLean/Chapter_21.lean; CLRSLean/Chapter_21/Section_21_1_Disjoint_Set_Operations.lean; CLRSLean/Chapter_21/Section_21_2_Linked_List_Representation.lean; CLRSLean/Chapter_21/Section_21_3_Disjoint_Set_Forests.lean; CLRSLean/Chapter_21/Section_21_4_Analysis.lean; CLRSLean/Chapter_21/Section_21_4_Analysis/CostedExecution.lean; CLRSLean/Chapter_21/Section_21_4_Analysis/InverseAckermann.lean; CLRSLean/Chapter_23/Section_23_2_Kruskal_And_Prim/S1_UnionFindBridge.lean; Tests/Chapter_21_Interface.lean; Tests/Chapter_23_UnionFind_Interface.lean; docs/proof-audits/chapter-21-closure-2026-07-10.md,Canonical fourth-edition Chapter 19 currently reuses legacy Chapter 21 through a compatibility facade. Legacy source note: No sorry/admit/axiom in the represented chapter; the concrete cost model counts actual parent traversals plus constant operation overhead and proves the advertised inverse-Ackermann bound. Non-blocking scope note: No remaining core Chapter 21 group; lower-level mutable-array/RAM constants and a stateful Chapter 23 Kruskal scan are separate refinements. +20,Elementary Graph Algorithms,main-proof-complete-for-correctness,20.1;20.2;20.3;20.4;20.5,47,47,0,The fourth-edition facade reuses 47 proved tracked theorem entries from legacy Chapter 22 across represented Sections 20.1;20.2;20.3;20.4;20.5,"Finite directed graph with adjacency function; walk/path/cycle definitions; reachability; reflexivity/transitivity/adjacency lemmas; connected components; undirected graph symmetry; fuelled BFS soundness and completeness; BFS closure and termination measure; exact-edge ReachableIn and IsShortestDistance; labelled BFSState with distance and parent; bfsState projection to the reachability BFS; FIFO distance invariant; bfsState_distance_eq_some_iff; bfsState parent edge, unit-level, root-path, coverage, and acyclicity facts; bfsState_isBFSPredecessorTree; bfsState_correct; functional DFS with colors, discovery/finish times, and parents; global DFS color/timestamp invariants; finite white reachability; dfsVisit_blackens_iff_whiteReachable; ParenthesisInvariant; dfs_parenthesis; dfs_parenthesis_cases; dfs_intervals_not_cross; discovery-state and timestamp bridges; ancestor reachability; dfs_parent_discovery_lt; intervalNestedInside_dfs_implies_ancestor; intervalNestedInside_dfs_iff_ancestor; IsDFSTreeEdge; IsDFSBackEdge; IsDFSForwardEdge; IsDFSCrossEdge; dfs_edge_classification_unique; dfs_tree_or_forward_edge_iff_timestamps; dfs_back_edge_iff_timestamps; dfs_cross_edge_iff_timestamps; maximum-finish and first-discovery facts; SCC finish-time ordering; DAG predicate; indegree; Kahn topological sort correctness; isDAG_no_dfs_back_edge; dfs_finish_time_decreases_on_dag_edge; DFS finish-time order permutation and pairwise sorting; dfsTopologicalSort_isTopologicalOrder; transpose graph; strong connectivity and SCC predicates; collecting DFS; Kosaraju order properties; Kosaraju component strong connectivity and maximality; pairwise disjointness; coverage; unique membership; kosarajuComponents_isSCCPartition",None,CLRSLean/FourthEdition/Chapter_20.lean; CLRSLean/Chapter_22.lean; CLRSLean/Chapter_22/Section_22_1_Representing_Graphs.lean; CLRSLean/Chapter_22/Section_22_2_BFS.lean; CLRSLean/Chapter_22/Section_22_3_DFS.lean; CLRSLean/Chapter_22/Section_22_3_DFS/S1_WhitePath.lean; CLRSLean/Chapter_22/Section_22_3_DFS/S2_Intervals.lean; CLRSLean/Chapter_22/Section_22_3_DFS/S3_Bridge.lean; CLRSLean/Chapter_22/Section_22_3_DFS/S4_SCC.lean; CLRSLean/Chapter_22/Section_22_3_DFS/S5_EdgeClassification.lean; CLRSLean/Chapter_22/Section_22_4_Topological_Sort.lean; CLRSLean/Chapter_22/Section_22_5_Strongly_Connected_Components.lean; CLRSLean/Chapter_22/Section_22_5_Strongly_Connected_Components/MergeSortCongr.lean; CLRSLean/Status.lean; Tests/Chapter_22_Interface.lean; Tests/Chapter_22_Closure.lean; docs/proof-audits/chapter-22-closure-2026-07-10.md,"Canonical fourth-edition Chapter 20 currently reuses legacy Chapter 22 through a compatibility facade. Legacy source note: DFS parenthesis, parent-forest ancestor/interval characterization, and unique edge classification are fully proved through dfs_parenthesis, intervalNestedInside_dfs_iff_ancestor, and dfs_edge_classification_unique; Kosaraju correctness is fully proved through scc_finish_time_order, scc_finish_order, kosarajuComponent_scc_core, and kosarajuComponents_isSCCPartition; Chapter 22 main functional correctness is formally sealed by the 2026-07-10 closure audit; explicit work and RAM-cost refinements remain Non-blocking scope note: No remaining core correctness group; explicit work and RAM-cost refinements." +21,Minimum Spanning Trees,main-proof-complete-for-correctness,21.1;21.2,52,52,0,The fourth-edition facade reuses 52 proved tracked theorem entries from legacy Chapter 23 across represented Sections 21.1;21.2,Finite edge-labelled graph and spanning-tree specification; safe-edge and cut-property theorem; canonical unique tree path and automatic exchange; complete sorted Kruskal MST theorem; real Chapter 21 costed union-find threaded through every Kruskal edge; connectivity invariant and mathematical-selection refinement; inverse-Ackermann scan bound and complete O(E log E) work composition; Prim key parent decrease-key and extract-min queue; concrete frontier provider; executable run refinement to PrimTrace; binary-heap O(E log V) operation-count theorem; complete Prim MST theorem,None,CLRSLean/FourthEdition/Chapter_21.lean; CLRSLean/Chapter_23.lean; CLRSLean/Chapter_23/Section_23_1_Growing_Minimum_Spanning_Trees.lean; CLRSLean/Chapter_23/Section_23_2_Kruskal_And_Prim.lean; CLRSLean/Chapter_23/Section_23_2_Kruskal_And_Prim/S1_UnionFindBridge.lean; CLRSLean/Chapter_23/Section_23_2_Kruskal_And_Prim/S2_StatefulKruskal.lean; CLRSLean/Chapter_23/Section_23_2_Kruskal_And_Prim/S3_ExecutablePrim.lean; CLRSLean/Status.lean; Tests/Chapter_23_Interface.lean; Tests/Chapter_23_Closure.lean; Tests/Chapter_23_UnionFind_Interface.lean; Tests/Chapter_23_Implementation_Interface.lean; docs/proof-audits/chapter-23-closure-2026-07-11.md,Canonical fourth-edition Chapter 21 currently reuses legacy Chapter 23 through a compatibility facade. Legacy source note: The correctness boundary remains sealed and now has proved executable semantic and algorithm-level cost refinements. Non-blocking scope note: No remaining core mathematical or functional algorithm group; concrete Batteries binary-heap array refinement and mutable/RAM write semantics remain separate low-level refinements. +22,Single-Source Shortest Paths,selected-section-complete,22.1;22.2;22.3;22.4;22.5,27,27,0,The fourth-edition facade reuses 27 proved tracked theorem entries from legacy Chapter 24 across represented Sections 22.1;22.2;22.3;22.4;22.5,Finite weighted directed-graph model; walks and walk weights; Bellman-Ford relaxation correctness and O(VE) work; DAG-SHORTEST-PATHS correctness and O(V+E) work; nonnegative-weight Dijkstra greedy invariant and O(E log V) abstract work; DijkstraState dijkstraInit dijkstraInit_invariant dijkstraStep DijkstraInvariant dijkstraStep_invariant dijkstraLoop dijkstraLoop_invariant dijkstraLoop_finish dijkstraLoop_correct; difference-constraint feasibility iff no negative cycle; shortestDist distance function; noPath_iff_top; shortestDist_le_walkWeight; IsWalkFrom.append_edge; shortestDist_triangleInequality,None,CLRSLean/FourthEdition/Chapter_22.lean; CLRSLean/Chapter_24.lean; CLRSLean/Chapter_24/Section_24_1_Bellman_Ford.lean; CLRSLean/Chapter_24/Section_24_2_SSSP_In_DAGs.lean; CLRSLean/Chapter_24/Section_24_3_Dijkstra.lean; CLRSLean/Chapter_24/Section_24_4_Difference_Constraints.lean,"Canonical fourth-edition Chapter 22 currently reuses legacy Chapter 24 through a compatibility facade. Legacy source note: Section 24.5 now formalizes the shortest-path distance function and the CLRS Lemmas 24.11-24.13 (triangle inequality, upper-bound, no-path); the subpath and convergence lemmas remain optional. Non-blocking scope note: Optional: subpath property, convergence/path-relaxation, and predecessor-subgraph lemmas." +23,All-Pairs Shortest Paths,main-proof-complete-for-correctness,23.1;23.2;23.3,24,24,0,The fourth-edition facade reuses 24 proved tracked theorem entries from legacy Chapter 25 across represented Sections 23.1;23.2;23.3,FASTER-APSP stabilization and shortest-distance correctness; Floyd-Warshall shortest-distance correctness; predecessor reconstruction walk validity and weight equality; negative-cycle detection; transitiveClosure_iff_exists_walk; Johnson augmented-graph no-negative-cycle preservation potential triangle inequality reweighting nonnegativity and johnsonDist_isShortestDist; johnsonPotential_finite; the general triangle inequality isShortestDist_edge_ineq; johnsonReweightedNonneg; and Theorem 25.6 johnsonAllPairsDist_correct (end-to-end Johnson correctness),None,CLRSLean/FourthEdition/Chapter_23.lean; CLRSLean/Chapter_25.lean; CLRSLean/Chapter_25/Section_25_1_All_Pairs_Model.lean; CLRSLean/Chapter_25/Section_25_2_Floyd_Warshall.lean; CLRSLean/Chapter_25/Section_25_3_Johnsons_Algorithm.lean,Canonical fourth-edition Chapter 23 currently reuses legacy Chapter 25 through a compatibility facade. Legacy source note: Sections 25.1-25.3 prove the advertised correctness stack including reconstruction weight equality transitive closure and end-to-end Johnson correctness. Non-blocking scope note: No remaining core correctness group; a tighter explicit O(n³ log n) repeated-squaring work theorem and lower-level RAM accounting are optional refinements. +24,Maximum Flow,main-proof-complete,24.1;24.2;24.3,18,18,0,The fourth-edition facade reuses 18 proved tracked theorem entries from legacy Chapter 26 across represented Sections 24.1;24.2;24.3,"FlowNetwork model and feasible Flow; flow value and Lemma 26.5 net-flow-across-cut identity; residual network and augmenting-path predicates; generic maximality from no augmenting path; easy MFMC direction cut-capacity-implies-maximal; residual path-length and shortest-distance helpers ResidualPathLength IsShortestDist isShortestDist_self IsShortestDist.unique isShortestDist_triangle ShortestAugmentingPath IsShortestDist.exists_predecessor ShortestAugmentingPath.shortest_prefix ShortestAugmentingPath.exists_shortestDist_le_augment and Lemma 26.7 shortest_path_nondec; the explicit shortest-path construction via back and shortestFlow.ResidualPath with exists_shortest_augmenting_path; the Edmonds-Karp loop ekStep ekIter with shortestAugmentingPath_iff_hasAugmentingPath exists_noAugmentingPath_ekIter and edmondsKarp_maximal; the critical-edge analysis isCritical exists_critical_edge shortest_edge_dist critical_dist_increase and critical_dist_increase_rev (Lemma 26.8), the timeline ekSeq ekPath criticalAt with distAt_mono exists_recovery_step criticalAt_growth and criticalAt_growth_strict, and the counting theorems critical_count_bound and augmentation_count_bound giving the O(VE²) bound; the executable BFS residualBFS with residualBFS_distanceInvariant residualBFS_queue_empty bfsState_distance_eq_some_iff bfsParentResidualPath bfs_shortestAugmenting and ekStep_shortest_path_bfs; BipartiteGraph Matching and unit-capacity toFlowNetwork; matchingFlowFunSummand and feasibility of matchingFlowFun; matchingToFlow and unconditional matchingToFlow_value; Flow.IsIntegral and integral bounds/conservation on L-R pairs; matchingOfIntegralFlow and matchingOfIntegralFlow_size; integral maximum flow via zeroFlow augmentOnce iterAugment bottleneck_ge_one IsIntegral_augment exists_noAugmentingPath_iter; and Theorem 26.12 maxMatching_eq_maxFlow_value",None,CLRSLean/FourthEdition/Chapter_24.lean; CLRSLean/Chapter_26.lean; CLRSLean/Chapter_26/Section_26_1_Flow_Networks.lean; CLRSLean/Chapter_26/Section_26_2_Edmonds_Karp.lean; CLRSLean/Chapter_26/Section_26_2_Edmonds_Karp/Ford_Fulkerson_Augmentation.lean; CLRSLean/Chapter_26/Section_26_2_Edmonds_Karp/S1_ShortestAugmentingPath.lean; CLRSLean/Chapter_26/Section_26_2_Edmonds_Karp/S2_EK_Loop.lean; CLRSLean/Chapter_26/Section_26_2_Edmonds_Karp/S3_WorkAnalysis.lean; CLRSLean/Chapter_26/Section_26_3_Bipartite_Matching.lean; CLRSLean/Chapter_26/Section_26_6_MaxFlow_MinCut.lean; Tests/Chapter_26_Interface.lean; Tests/Chapter_26_Augmentation_Interface.lean; Tests/Chapter_26_Edmonds_Karp_Interface.lean,"Canonical fourth-edition Chapter 24 currently reuses legacy Chapter 26 through a compatibility facade. Legacy source note: Section 26.2 is complete: Lemma 26.7, the Edmonds-Karp loop (edmondsKarp_maximal), the O(VE²) counting argument (critical_count_bound, augmentation_count_bound), and the executable residual BFS (residualBFS, bfs_shortestAugmenting); 26.3 is fully proved including Theorem 26.12; 26.6 is a legacy source-module identifier for Theorem 26.6 rather than a textbook section; Sections 26.4 and 26.5 are deferred outside the current selected milestone." +25,Matchings in Bipartite Graphs,not-started,None,0,0,1,Not represented in the canonical fourth-edition chapter tree,No canonical tracked theorem names yet,Whole fourth-edition chapter theorem inventory and formalization pending,CLRSLean/FourthEdition/Chapter_25.lean,No canonical theorem-bearing source is promoted; the fourth-edition guide records the not-started boundary. +26,Parallel Algorithms,main-proof-complete,26.1;26.2;26.3,95,95,0,The fourth-edition facade reuses 95 proved tracked theorem entries from legacy Chapter 27 across represented Sections 26.1;26.2;26.3,Forward-edge computation DAG with DP longest-path span and span-le-work; explicit residual work and span; computed ready sets and greedy max-busy steps; executing all ready nodes strictly decreases a nonempty residual critical path; completed chained DAG execution with telescoping work and span budgets; T_p <= T_1 / p + T_inf for completed explicit greedy DAG schedules; spawn/sync tree unit-overhead model with span-le-work; balanced parallel-loop exact work and span; Costed value/work/span execution layer; depth-indexed executable P-ADD with pAdd_value and pAdd_correct; race-free executable P-MATMUL with pMatMul_value and pMatMul_correct; pAdd_work_eq; pAdd_span_eq; pMatMul_work_eq; pMatMul_span_eq; pAddWork_allInput_bigTheta; pAddSpan_allInput_bigTheta; pMatMulExecWork_allInput_bigTheta; pMatMulExecSpan_allInput_bigTheta; idealized pMatMulWork/pMatMulSpan recurrence with work Theta(n^3) and span Theta(log n) pow2 closed forms plus all-input upper bounds; executable P-MERGE with pMerge_correct; pMerge_value_sorted; pMerge_value_perm; pMerge_value_length; pMerge_childSizes_add_one; pMerge_childSize_le_threeQuarters; pMerge_work_step_eq; pMerge_span_step_eq; pMerge_work_step_le; pMerge_span_step_le; pMerge_work_lower; pMerge_work_upper; pMerge_span_upper; evenKeys; oddKeys; pMerge_interleaved_span_lower; pMergeSort; pMergeSort_correct; pMergeSort_value_sorted; pMergeSort_value_perm; pMergeSort_value_length; pMergeSort_work_lower; pMergeSort_work_upper; pMergeSort_span_upper; pMergeSort_worstFamily_span_lower; P-MERGE work Theta(n) and span Theta(log^2 n) pow2 closed forms; P-MERGE-SORT work Theta(n log n) and span Theta(log^3 n) pow2 closed forms; parallel Strassen work Theta(n^(log2 7)) and span Theta(log n) pow2 closed forms; pMergeWork_monotone; pMergeSpan_monotone; pMergeSortWork_monotone; pMergeSortSpan_monotone; strassenWork_monotone; strassenSpan_monotone; pMergeWork_power_sandwich; pMergeSpan_power_sandwich; pMergeSortWork_power_sandwich; pMergeSortSpan_power_sandwich; strassenWork_power_sandwich; strassenSpan_power_sandwich; pMergeWork_allInput_bigTheta; pMergeSpan_allInput_bigTheta; pMergeSortWork_allInput_bigTheta; pMergeSortSpan_allInput_bigTheta; strassenWork_allInput_bigTheta; strassenSpan_allInput_bigTheta,None,CLRSLean/FourthEdition/Chapter_26.lean; CLRSLean/Chapter_27.lean; CLRSLean/Chapter_27/Section_27_1_Multithreading_Model.lean; CLRSLean/Chapter_27/Section_27_2_4_Algorithms.lean; CLRSLean/Chapter_27/Section_27_2_4_Algorithms/ParallelStrassen.lean; Tests/Chapter_27_Interface.lean; Tests/Chapter_27_Scheduler_Interface.lean; Tests/Chapter_27_Matrix_Interface.lean; Tests/Chapter_27_ParallelMerge_Interface.lean; Tests/Chapter_27_Closure.lean; CLRSLean/Status.lean,Canonical fourth-edition Chapter 26 currently reuses legacy Chapter 27 through a compatibility facade. Legacy source note: No sorry/admit/axiom occurs in Chapter_27. The Chapter 27 main-text acceptance boundary ends at Section 27.3 and is sealed by Tests/Chapter_27_Closure.lean. The legacy Section_27_2_4_Algorithms path is retained solely for import compatibility; its parallel Strassen recurrence API is a separate named extension. Mutable-array and RAM refinements exercises and chapter-end problems remain outside the advertised scope. +27,Online Algorithms,not-started,None,0,0,1,Not represented in the canonical fourth-edition chapter tree,No canonical tracked theorem names yet,Whole fourth-edition chapter theorem inventory and formalization pending,CLRSLean/FourthEdition/Chapter_27.lean,No canonical theorem-bearing source is promoted; the fourth-edition guide records the not-started boundary. +28,Matrix Operations,main-proof-complete,28.1;28.2;28.3,9,9,0,The fourth-edition facade reuses 9 proved tracked theorem entries from legacy Chapter 28 across represented Sections 28.1;28.2;28.3,exists_lup_decomposition (Theorem 28.1); forwardSubst_spec (Lemma 28.1); backSubst_spec (Lemma 28.2); lupSolve_correct (LUP-SOLVE); inv_eq_lup (Theorem 28.2); cholesky_decomposition (Theorem 28.3); cholesky_unique; normal_equations_minimizes (Theorem 28.4); det_eq_sign_mul_det_of_lup (Corollary to Thm 28.1),None,CLRSLean/FourthEdition/Chapter_28.lean; CLRSLean/Chapter_28.lean; CLRSLean/Chapter_28/Section_28_1_Linear_Equations.lean; CLRSLean/Chapter_28/Section_28_2_Inverting_Matrices.lean; CLRSLean/Chapter_28/Section_28_3_Symmetric_Positive_Definite.lean,"Canonical fourth-edition Chapter 28 currently reuses its legacy source through a compatibility facade. Legacy source note: Sections 28.1-28.3 are complete: LUP decomposition and solving (Theorems 28.1-28.2, Lemmas 28.1-28.2, Algorithm LUP-SOLVE), the det-via-LUP corollary, matrix inversion, the Cholesky decomposition (Theorem 28.3) with uniqueness, least-squares approximation (Theorem 28.4), and the CLRS running-time cost bounds." +29,Linear Programming,partial,29.1;29.2;29.3,10,10,3,All 10 selected fourth-edition-facing groups are proved; the remaining work is normalization/encoding and declaration ownership rather than holes in those selected theorems,isFeasible_iff_exists_slackExtension; shortest-path LP lower-bound and attained-optimum theorems; maximum-flow LP equivalence; minimum-cost-flow LP equivalence; multicommodity-flow LP equivalence; weak_duality (Theorem 29.8); terminal dictionary dual certificate; strongDuality (Theorem 29.9); complementarySlackness_iff_optimal (Theorem 29.10),Section 29.1: general-form normalization and canonical algorithm wrapper; Section 29.2: finite StandardLP encodings and preservation bridges; Section 29.3: canonical ownership for strong duality and complementary slackness,CLRSLean/FourthEdition/Chapter_29.lean; CLRSLean/Chapter_29.lean; CLRSLean/Chapter_29/Section_29_1_Standard_And_Slack_Forms.lean; CLRSLean/Chapter_29/Section_29_2_Formulating_Problems_As_Linear_Programs.lean; CLRSLean/Chapter_29/Section_29_4_Duality.lean; Tests/Chapter_29_Interface.lean; Tests/Chapter_29_Formulations_Interface.lean,The current facade imports the whole legacy chapter while detailed SIMPLEX/initialization modules are also cataloged as online material; the canonical/online declaration boundary must be separated before Chapter 29 can be complete. +30,Polynomials and the FFT,main-proof-complete,30.1;30.2;30.3,34,34,0,The fourth-edition facade maps 34 proved tracked theorem groups after excluding moved material to the online ledger; the edition map records exact represented sections and gaps,Coefficient-vector polynomial round trips and capacity; Horner correctness and exact 2n work; distinct-node interpolation existence uniqueness and round trip; point-value addition and multiplication; exact linear vector-operation work; explicit schoolbook correctness capacity and exact 2mn work; primitive-root reductions and orthogonality; generic positive-exponent DFT evaluation and linearity; sign-explicit Mathlib complex DFT compatibility; both Fourier inverse directions and injectivity; cyclic convolution theorem; inverse pointwise multiplication; no-wrap polynomial coefficient bridge; radix-2 indexing and even/odd split; successively generated twiddle and butterfly executions; recursive FFT execution erasure and equality with DFT; recursive inverse agreement and both round trips; exact execution-field FFT work; power-of-two padding and all-input Theta(n log n) work; generic FFT multiplication execution and erasure; generic FFT multiplication correctness under minimal fit; automatic positive sizing capacity and primitive complex root; unconditional complex FFT multiplication correctness; exact execution-field multiplication composition; bounded-input multiplication and all-input Theta(n log n) work; layered-network evaluation; exact butterfly count; exact butterfly depth; exact primitive gate count; exact primitive depth,None,CLRSLean/FourthEdition/Chapter_30.lean; CLRSLean/Chapter_30.lean; CLRSLean/Chapter_30/Section_30_1_Representing_Polynomials.lean; CLRSLean/Chapter_30/Section_30_2_DFT_And_FFT.lean; CLRSLean/Chapter_30/Section_30_2_DFT_And_FFT/RecursiveFFT/Definitions.lean; CLRSLean/Chapter_30/Section_30_2_DFT_And_FFT/RecursiveFFT/Correctness.lean; CLRSLean/Chapter_30/Section_30_2_DFT_And_FFT/RecursiveFFT/Costs.lean; CLRSLean/Chapter_30/Section_30_2_DFT_And_FFT/PolynomialMultiplication.lean; CLRSLean/Chapter_30/Section_30_3_Efficient_FFT_Implementations.lean; CLRSLean/Chapter_30/Section_30_3_Efficient_FFT_Implementations/ParallelFFT.lean; Tests/Chapter_30_Interface.lean; Tests/Chapter_30_DFT_Interface.lean; Tests/Chapter_30_RecursiveFFT_Interface.lean; Tests/Chapter_30_PolynomialMultiplication_Interface.lean; Tests/Chapter_30_Milestone1_Closure.lean; Tests/Chapter_30_ParallelFFT_Interface.lean; Tests/Chapter_30_Milestone2_Closure.lean; CLRSLean/Status.lean; docs/proof-map.md,"The canonical fourth-edition ledger excludes 12 bit-reversal and iterative-FFT groups recorded in the online-material ledger; the FFT-circuit groups remain canonical. Canonical fourth-edition Chapter 30 currently reuses its legacy source through a compatibility facade. Legacy source note: Exact generic ring and characteristic-zero field arithmetic over fixed and power-of-two vectors; execution arithmetic is 2*k*2^k and total charged work is 2^k + 2*k*2^k; circuit butterflies are k*2^(k-1), primitive gates are 3*k*2^(k-1), butterfly depth is k, and primitive depth is 2*k; excluded implementation and numerical layers do not reopen the proved boundary. Non-blocking scope note: No remaining main-text group within the reviewed boundary; mutable and in-place arrays, RAM/cache/hardware costs, floating-point error, concrete scheduling, NTT/code generation, exercises, and Problems 30-1 through 30-6 are excluded." +31,Number-Theoretic Algorithms,selected-section-complete,31.1;31.2;31.3;31.4;31.5;31.6;31.7;31.8,17,17,0,The fourth-edition facade maps 17 proved tracked theorem groups after excluding moved material to the online ledger; the edition map records exact represented sections and gaps,division_theorem (Theorem 31.1); euclid_recursion (Lemma 31.2); gcd_is_linear_combination (Lemma 31.3); gcd_is_smallest_positive_linear_combination (Theorem 31.2); exists_mul_inverse_mod (Theorem 31.6); modular_linear_solvable (Theorem 31.11); chinese_remainder (Theorem 31.27); fermat_little_theorem (Theorem 31.30); euler_theorem; rsa_correct (Theorem 31.36); fermat_test (Theorem 31.31); goodUnits_card_le; strongLiars_card_le,None,CLRSLean/FourthEdition/Chapter_31.lean; CLRSLean/Chapter_31.lean; CLRSLean/Chapter_31/Section_31_1_Elementary_Number_Theory.lean; CLRSLean/Chapter_31/Section_31_2_Greatest_Common_Divisor.lean; CLRSLean/Chapter_31/Section_31_3_Modular_Arithmetic.lean; CLRSLean/Chapter_31/Section_31_4_Solving_Modular_Linear_Equations.lean; CLRSLean/Chapter_31/Section_31_5_Chinese_Remainder_Theorem.lean; CLRSLean/Chapter_31/Section_31_6_Powers_Of_An_Element.lean; CLRSLean/Chapter_31/Section_31_7_RSA.lean; CLRSLean/Chapter_31/Section_31_8_Primality_Testing.lean,"The canonical fourth-edition ledger excludes 1 integer-factorization group recorded in the online-material ledger. Canonical fourth-edition Chapter 31 currently reuses its legacy source through a compatibility facade. Legacy source note: Sections 31.1-31.9 fully proved; running-time and probabilistic analyses deferred. Non-blocking scope note: Running-time analyses, the general CRT, and the full Pollard-s-rho probabilistic analysis (see chapter guide)." +32,String Matching,partial,32.1,19,19,4,The fourth-edition facade reuses 19 proved tracked theorem entries from legacy Chapter 32 across represented Sections 32.1; the edition map records explicit remaining gaps,String model (14 lemmas); naiveMatcher soundness/completeness (5 theorems),Section 32.2 (The Rabin–Karp algorithm): not-started; Section 32.3 (String matching with finite automata): not-started; Section 32.4 (The Knuth–Morris–Pratt algorithm): not-started; Section 32.5 (Suffix arrays): not-started,CLRSLean/FourthEdition/Chapter_32.lean; CLRSLean/Chapter_32.lean; CLRSLean/Chapter_32/Section_32_1_String_Model.lean; CLRSLean/Chapter_32/Section_32_1_String_Model/Naive_Matcher.lean,Canonical fourth-edition Chapter 32 currently reuses its legacy source through a compatibility facade. Legacy source note: All 19 theorems are kernel-checked. Sections 32.2-32.4 deferred. Original formalization by caiwei2026 (PR #85). +33,Machine-Learning Algorithms,not-started,None,0,0,1,Not represented in the canonical fourth-edition chapter tree,No canonical tracked theorem names yet,Whole fourth-edition chapter theorem inventory and formalization pending,CLRSLean/FourthEdition/Chapter_33.lean,No canonical theorem-bearing source is promoted; the fourth-edition guide records the not-started boundary. +34,NP-Completeness,not-started,None,0,0,1,Not represented in the canonical fourth-edition chapter tree,No canonical tracked theorem names yet,Whole fourth-edition chapter theorem inventory and formalization pending,CLRSLean/FourthEdition/Chapter_34.lean,No canonical theorem-bearing source is promoted; the fourth-edition guide records the not-started boundary. +35,Approximation Algorithms,not-started,None,0,0,1,Not represented in the canonical fourth-edition chapter tree,No canonical tracked theorem names yet,Whole fourth-edition chapter theorem inventory and formalization pending,CLRSLean/FourthEdition/Chapter_35.lean,No canonical theorem-bearing source is promoted; the fourth-edition guide records the not-started boundary. diff --git a/scripts/test_check_progress_csv.py b/scripts/test_check_progress_csv.py index ecfa011..47e196e 100644 --- a/scripts/test_check_progress_csv.py +++ b/scripts/test_check_progress_csv.py @@ -104,7 +104,7 @@ def test_renders_fourth_edition_snapshot_from_csv(self) -> None: self.assertIn("## Fourth-Edition Snapshot", dashboard) self.assertIn("canonical CLRS fourth-edition chapter ledger", dashboard) - self.assertIn("1,326", dashboard) + self.assertIn("1,328", dashboard) self.assertIn("selected proof inventory", normalized) self.assertIn("does not by itself mean that every fourth-edition section obligation is covered", normalized) self.assertIn("partial (edition coverage)", dashboard)