Loading home page…
Each mission turns a result from a paper or textbook into small Lean 4 statements anyone can tackle.
Campaigns group missions around a shared mathematical goal. Each one tracks a quantity, such as an upper or lower bound. Have a good candidate in mind? Ping us on Slack, Zulip, or WeChat.
Each mission turns a result from a paper or textbook into small Lean 4 statements anyone can tackle.
Campaigns group missions around a shared mathematical goal. Each one tracks a quantity, such as an upper or lower bound. Have a good candidate in mind? Ping us on Slack, Zulip, or WeChat.
Classical algorithms solve all-pairs shortest paths in time. In a 2026 breakthrough, Alman and Vassilevska Williams refuted the APSP conjecture with a deterministic algorithm. How low can the exponent go?
Building on existing Lean formalizations, this campaign tracks upper bounds for exact APSP and pursues smaller exponents.
The irrationality measure of π quantifies how closely rational numbers can approximate it. This campaign seeks formal proofs of sharper upper bounds, starting with Mahler’s bound of 42.
The sharp Hlawka inequality for Schatten -norms is a cousin of the triangle inequality: it relates the norms of three matrices to the norms of their pairwise sums and their total sum. For complex diagonal matrices, an exact formula for the best possible comparison constant has been proved in Lean for every real . We conjecture that the same formula holds for all .
What is the smallest cutoff for which this formula holds for every real ?
References:
Is every odd number a sum of primes? This campaign tracks formalized proofs of the smallest that suffices.
Schnirelmann (1930) showed some finite works. Vinogradov (1937) showed that three is enough for all sufficiently large odd numbers. Tao (2012) proved unconditionally. Helfgott (2013) proved that every odd number greater than is a sum of three primes, though the proof is still unrefereed. Ideally, we can formalize this statement here. Note that three is optimal: is neither prime nor + prime.
Schoolbook matrix multiplication takes operations. The exponent is the infimum of all such that two matrices can be multiplied in arithmetic operations; trivially , and is conjectured but open.
Strassen gave the first nontrivial bound, , in 1969, and introduced the laser method in 1986 to reach . Coppersmith and Winograd's 1990 bound of stood for two decades. Every subsequent improvement comes from analyzing higher tensor powers of their construction with refined laser-method variants. That line reached in 2025, and the current record is , from August 2026. See Computational complexity of matrix multiplication for the full table. Can we formalize these results and even improve on them?
Online decision-making problems — multi-armed bandits, contextual bandits, structured bandits, and episodic reinforcement learning — look superficially different but share a common shape: a learner repeatedly acts, observes feedback, and is scored by regret against the best action in hindsight. Foster, Kakade, Qian and Rakhlin's Foundations of Reinforcement Learning and Interactive Decision Making (Foster & Rakhlin, arXiv:2312.16730v1) develops a unifying account of this shape and asks a sharper question than "does this specific algorithm work?": for a given class of possible environments, what is the best regret any algorithm can achieve? The Decision-Estimation Coefficient (DEC), introduced by Foster, Kakade, Qian and Rakhlin (2021, "The Statistical Complexity of Interactive Decision Making") and refined by Foster, Golowich, Qian, Rakhlin and Sekhari (2023), was proposed as the answer: a single real-valued complexity measure of a model class that simultaneously (i) drives a generic optimal-up-to-constants algorithm (Estimation-to-Decisions, E2D), and (ii) lower-bounds the regret of every algorithm. Item (ii) is what turns the DEC from "a complexity measure that happens to work for the algorithms we know" into a genuine characterization of statistical difficulty, in the same sense that minimax rates characterize the difficulty of estimation problems in classical statistics. This mission formalizes that lower bound.
Chapter 6 of the book (pp. 93–128) introduces Decision Making with Structured Observations (DMSO), a protocol general enough to subsume the contextual-bandit, structured-bandit and episodic tabular-RL protocols of earlier chapters. Over rounds, the learner selects a decision from a decision space ; nature draws a reward-observation pair from a fixed, unknown model , where a model maps each decision to a distribution over a reward space and an observation space . The learner has access to a model class containing (realizability). For , write for the mean reward function and for the optimal decision; regret is , exactly as in the bandit chapters, now for the general model class.
Because observations, not just mean rewards, now carry information, the DEC needs a way to measure distance between the full conditional distributions and , not just between scalars and . The chapter uses the squared Hellinger distance , one of a family of Csiszár -divergences that also includes total variation () and Kullback-Leibler () divergence. For a reference model and scale , the general Decision-Estimation Coefficient is the min-max game value
and . This mission's Lean development (FoundationsRL.GeneralDM)
formalizes discrete versions of , , for a finite outcome type, the DMSO
regret, and this DEC.
The goal is Proposition 28 (DEC Lower Bound), p. 105:
Here is the constrained DEC (§6.5.1), a variant of the offset DEC above that hard-constrains the information gain rather than subtracting it — a technical refinement needed to make the lower-bound direction go through — and the "localization condition" is a genuine hypothesis of the proposition, not a footnote. Unlike almost every other target in this series of missions, the statement quantifies over every algorithm rather than naming one: it is a genuine impossibility result. Two supporting divergence facts are included as milestones because the DEC's information-theoretic argument rests on them: Lemma 19 () and Lemma 20 (a bounded-likelihood-ratio refinement bounding in terms of ). The chapter's own matching upper bound, Proposition 26 (the E2D regret bound for the general DMSO protocol, the direct analogue of Chapter 4's Proposition 13), is included as a milestone to give the reader the matching pair the chapter presents together. Finally, Corollary 1 restates the lower bound in terms of the localized offset DEC (combining Proposition 28 with Proposition 27), included as a milestone showing the lower bound's reach beyond the constrained DEC alone.
Proposition 28 is what makes the DEC a genuine characterization of the statistical complexity of interactive decision making, rather than merely a sufficient condition for a particular algorithm family to succeed. Combined with the (uncited, technically deeper) matching upper bound for the constrained DEC — Proposition 29, stated but not proved in the book — it shows that for any finite model class, the constrained DEC is necessary and sufficient for low regret up to a factor in the localization radius: no complexity measure that is substantially different from the DEC can characterize the same problems. This is the general decision-making analogue of how minimax rates pin down statistical estimation, now for interactive protocols with adaptive feedback.
Formalizing the lower bound is new work: no result of this shape exists on the Prove2Me platform
(searches for "decision-estimation", "general divergence", "constrained DEC" and "Hellinger" — the
last of which surfaces two related-but-distinct affinity/Le Cam bounds from a different mission on
bandit lower bounds — return no faithful prior art; see MODERATION_NOTES.md). The formal
statement is the boxed proposition; the book gives a self-contained but simplified proof (two
named simplifying assumptions, §6.5.3) and cites Foster, Golowich, Qian, Rakhlin & Sekhari (2023)
for the unrestricted argument. This mission's Lean items are draft statements (:= by sorry), not
proofs; formalizing the proof itself — a two-point adaptive testing argument using the chain rule
for KL divergence and a change-of-measure step — is the open contribution this mission proposes.
The obvious first attempt is to try to prove the lower bound by exhibiting one fixed pair of hard models , as in classical two-point minimax lower bounds (Le Cam's method, Fano's inequality). This fails here because the decision-making protocol is interactive and adaptive: the algorithm's queries depend on what it has observed, so a model pair chosen obliviously (before seeing the algorithm) cannot in general be made indistinguishable to every algorithm — an adaptive algorithm can be constructed that distinguishes any two fixed models quickly by querying where they differ. The book's proof instead selects the "hard" alternative model as a function of the algorithm's own strategy (via the constrained DEC's arg max, Eq. (6.36)), so that the pair is hard specifically for the algorithm under consideration, then uses the chain rule for KL divergence plus the change-of-measure identity between the algorithm's induced distributions under and to conclude that the algorithm's realized decisions must look similar under both models — hence it cannot get low regret on both simultaneously. Every step of this argument depends on the exact game structure of the constrained DEC, not just its numerical value; a formalization that leaves as an unconstrained real parameter (rather than the actual - game with its information-gain constraint) would make the lower bound's conclusion vacuous, since the hypothesis would no longer track any actual property of .
The decision space and the outcome (reward, observation) alphabet are both taken as
finite types (Fintype); a model is a conditional probability
vector, and a reward-extraction map recovers the mean reward
. hellingerSq, totalVariationDiscrete,
klDivDiscrete specialize the book's general dominating-measure divergence formula (Eq. (6.5)) to
the counting measure on this finite type; klDivDiscrete returns an ENNReal so its
case (when is not absolutely continuous w.r.t. ) is represented honestly. The DEC, the
constrained DEC and the localized subclass are literal sInf-of-sSup/sSup-of-sSup
transcriptions of the book's min-max games — the same convention this series uses for the
Chapter-4 DEC — not opaque free real numbers, which rules out the trivializing formalization named
above.
Three deviations from this series' usual convention of pinning every constant to the value the
book's own proof derives are deliberate and disclosed. First, the numerical constant in
is explicitly called "not important" by the authors themselves
(footnote a, p. 105); it is existentially quantified (∃ c > 0) rather than pinned to a numeral.
Second — added at moderation, round 2, 2026-09-19, after the constant was found to be pinned
incorrectly — the lower bound's own multiplicative constant is also existentially quantified
(∃ c' > 0) rather than pinned to 1/20. The book's printed proof (§6.5.3, pp. 107–110) derives
1/20 (p. 110, not p. 109 as an earlier draft of this mission stated) only under two named
simplifying assumptions the theorem's hypotheses do not carry (p. 107, "Simplifications": a
class-wide bounded-curvature hypothesis, Eq. (6.34); and a bound on the unaugmented
rather than the officially-defined,
augmented this mission's decC implements). Since
augmenting either supremum's domain can only raise its value, the printed proof's bound on the
narrower, unaugmented quantity does not license a pinned 1/20 against the fully general decC
this theorem states; the book itself attributes the proof of the general statement to an external
reference (Foster, Golowich, Qian, Rakhlin & Sekhari 2023) not in this document. The existential
c' matches the book's own unpinned for Proposition 28 as printed on pp. 105–106.
Third, "any algorithm" and are formalized, as throughout
this series, without a full stochastic-process/history model: regret is a deterministic quantity
evaluated at a fixed realized decision-distribution sequence , rather than an expectation over an adaptive, history-dependent algorithm's own
randomness. Formalizing the fully adaptive, measure-theoretic version of "any algorithm" — with an
explicit filtration and expectation over the induced process law — is future work a solver
could add; the current statement is faithful to the book's deterministic-per-realization content
but not to its full generality over randomized, history-dependent strategies. The DMSO protocol
(Def_FoundationsRL_GeneralDM_Protocol) and the DEC (Def_FoundationsRL_GeneralDM_DEC) are
restated locally rather than imported from Chapter 4's mission (FoundationsRL.Structured), since
draft items cannot import another chunk's drafts; contributions extending either mission to reuse
the other's substrate once both are published are welcome.
A multistage stochastic program's exact deterministic equivalent grows exponentially with the number of periods, even when each period's random data takes only a handful of values (Chapter 9's concern was the growth in the number of realizations; Chapter 10 adds growth in the number of periods). One remedy, generalizing Chapter 8's single-period Jensen bound, is to replace the exact per-period random data by a coarser, aggregated version — conditional expectations over a partition of the history space at each stage — and solve the resulting smaller deterministic equivalent instead. This is only useful if the aggregated problem's optimal value is provably a bound (here, a lower bound) on the exact problem's, and Birge & Louveaux's Chapter 10, §10.1, Theorem 1 is exactly the statement that makes this legitimate, together with a genuinely necessary extra condition the book states explicitly two paragraphs before the theorem: "if not [i.e. if the extra condition fails], then the conditional expectation form ... may not actually achieve a bound." This mission formalizes that theorem.
The book's exact multistage stochastic linear program (Eq. 1.1, p. 418) is
min c¹x¹ + E_Ω[c²x² + ⋯ + cᴴxᴴ]
s.t. W¹x¹ = h¹, Tᵗ⁻¹xᵗ⁻¹ + Wᵗxᵗ = hᵗ (t=2,…,H, a.s.), xᵗ ≥ 0 a.s., xᵗ nonanticipative (Σᵗ-measurable),
over the exact event space Ω = Ω₁ × ⋯ × Ω_H. Given a consistent nested partition of each
Ωᵗ = Ω₁ × ⋯ × Ωₜ into finitely many blocks Sᵗ₁, …, Sᵗ_νₜ, and aggregated data (h̄ᵗᵢ, T̄ᵗᵢ) = E^{Sᵗᵢ}[(hᵗ,Tᵗ)] (the conditional expectation of the true random data over block i), the
aggregated problem (Eq. 1.2, p. 419) replaces the exact recursion by a finite tree of blocks, one
decision per block, linked to its parent block's decision. Both (1.1) and (1.2) are, structurally,
the same kind of object — a finite-tree deterministic-equivalent recourse LP — differing only in
which tree and which node data they use; this mission formalizes that shared shape once
(Tree, Instance, Feasible, obj) and instantiates it twice.
Formalized as: a shared Tree H structure (a finite node type, per-node stage, anc, and a
root), the same representation Chunk 06's Multistage.Tree uses for the exact scenario tree of
its own (different) chapter, restated here rather than imported (a draft cannot import another
chunk's draft). An Instance H n m T bundles a tree's node-varying LP data
(c, W, Tmat, h, p); Feasible/obj give its feasible set and objective. The exact
problem (1.1) is Instance H n m TFine for a fine/exact tree TFine; the aggregated problem
(1.2) is Instance H n m TCoarse for a coarser tree TCoarse, connected to TFine by an
aggregation map agg : TFine.Node → TCoarse.Node.
agg respects the tree structure (root, stage, ancestor);
W, c agree between the fine and coarse instances (up to agg);
coarse.h, coarse.Tmat are the p-weighted conditional expectations of fine.h, fine.Tmat over
each aggregation fiber;
∀ coarse nodes i,i' at the same stage sharing a "current-period outcome",
coarse.h i = coarse.h i' ∧ coarse.Tmat i = coarse.Tmat i'
⟹ zCoarse ≤ zFine
This is the mission's only formalization target: BRIEF.md records that no separately numbered
lemma precedes Theorem 1's proof in this section to serve as an independent milestone (the proof
is a direct LP-duality argument against the theorem's own hypotheses), and that Chapter 8's
Theorem 1 — the two-period case this theorem generalizes — is a cross-chapter dependency
belonging to Chunk 08's own mission, not a milestone here. milestones.yaml is accordingly empty;
see STATUS.md for the explicit accounting of what else in this chapter was considered and left
out (Theorem 3, the aggregation error bound of §10.2, an unrelated and substantially heavier
result).
Theorem 1 is what licenses every aggregation-based approximation scheme the rest of the book's
multistage material builds on: it says precisely when replacing a multistage recourse problem's
random data by within-period conditional expectations preserves a valid lower bound, and precisely
identifies the condition (aggregated nodes sharing a current-period outcome must carry identical
aggregated data) whose failure breaks the bound — a condition the book states is not decorative
("if not, then the conditional expectation form ... may not actually achieve a bound," p. 418).
Formalizing it gives Prove2Me a first structural result connecting Chapter 8's single-period Jensen
bound (Chunk 08) to genuinely multistage approximation, using the same finite-scenario-tree
deterministic-equivalent representation Chunk 06 uses for the exact nested Benders decomposition
— the two missions' shared representation choice (documented in both STATUS.md files) means a
future mission relating them formally (e.g. instantiating Chunk 06's exact tree as this mission's
TFine) has a compatible object to work with, even though neither imports the other's draft.
The theorem's proof (p. 419-420) is a direct LP weak-duality argument: given an optimal dual
solution to the aggregated problem, the book constructs a dual-feasible solution to the exact
problem attaining the same value, using precisely the "common outcome ⟹ equal aggregated data"
hypothesis to make the constructed dual solution well-defined across the exact tree's finer
structure. This is a real argument, not a citation, but it is left as sorry: formalizing the
proof would need the multistage LP duality machinery (the "multistage version of Theorem 3.13" the
book's own proof invokes, itself left as Exercise 1) that no chunk of this series has built. The
value of this mission is the faithful statement of the bound and its exact hypotheses.
(ωt−1,ωt) ∈ Stj if and only if there exist some (ω̂t−1,ωt) ∈ Stj" —
S^t_j appears on both sides of the "if and only if," where the sentence's own subject ("S^t_i
and S^t_j that have a common outcome") requires the left side to range over S^t_i. Confirmed
against a direct render of PDF page 436 (uv run --with pymupdf python), not assumed from OCR:
the PDF's own typesetting has this repetition, not an artefact of text extraction. This
formalization reads the corrected clause as "S^t_i and S^t_j project onto the same set of
period-t outcomes" and states it via an explicit label type Θ and curOutcome : TCoarse.Node → Θ, since the aggregated tree alone does not carry a literal per-period outcome
space to project onto (see Setting above — Tree records only history-node structure, not the
underlying product space Ω = Ω₁ × ⋯ × Ω_H).W, c shared exactly, not aggregated, matching the book's explicit assumption that the
recourse matrix and per-stage cost are deterministic and identical across (1.1) and (1.2)
("Wt known and not random," "ct = ct," p. 418) — formalized as direct equality hypotheses
(hW_agree, hc_agree) rather than folding W/c into the conditional-expectation machinery
that h/Tmat go through.zFine/zCoarse are hypothesis-characterized, not sInf-defined, avoiding the real
infimum's junk value 0 on an unbounded-below or empty feasible set
(reference/FAITHFULNESS_TRAPS.md trap 5) — neither tree-LP's feasible set is shown bounded or
nonempty by the hypotheses alone.p·h/p·Tmat, not h/Tmat
alone, matching the book's own E^{Sti}[·] = (h̄ti,T̄ti) read as "the fiber-sum of p·(h,T)
equals p_i·(h̄ti,T̄ti)" — the standard definition of a conditional expectation against counting
measure on a finite partition. Instance's own hp_pos (every node's probability is strictly
positive) rules out the degenerate case a bare unweighted equation would need to guard
separately (a coarse node of probability 0, which cannot occur, is what the read-back of this
theorem flags as the one case where the weighted equation would not pin down h_coarse/
Tmat_coarse themselves — moot here since hp_pos excludes it).coarse.h/coarse.Tmat
be arbitrary constants unrelated to fine.h/fine.Tmat (dropping the conditional-expectation
defining equations) would still typecheck a "lower bound" conclusion but assert nothing about
aggregation — exactly the risk BRIEF.md flags: "a formalization that treats (h̄ti,T̄ti) as
arbitrary constants rather than as conditional expectations over a partition of the scenario
space at time t loses the theorem's actual content." Both hCoarse_h/hCoarse_T (the
defining equations) and hCommonOutcome (the theorem's own extra hypothesis) are load-bearing
and present.Two-stage stochastic programs with recourse — choose a first-stage decision now, observe a random outcome , then choose a second-stage recourse decision to repair whatever left infeasible or suboptimal — are the workhorse model of the field, used for capacity planning, inventory and financial portfolio problems since the 1950s (Dantzig 1955; Beale 1955). When ranges over a finite set of scenarios, the recourse function that averages the second-stage cost over scenarios is piecewise linear and convex in , so the overall problem is itself a large linear program — but one whose constraint matrix has a scenario for every column block and can be far too large to hand to a general-purpose LP solver directly. Van Slyke and Wets' L-shaped method (1969), the subject of this mission, is the algorithm that made two-stage recourse problems with finite scenario sets practically solvable: it is Benders decomposition specialized to this block structure, alternating between a small master program over (and a scalar approximating the recourse cost) and, at each candidate , a batch of second-stage linear programs that either certify 's second-stage feasibility or supply a linear underestimate — a cut — of around . Birge & Louveaux's Introduction to Stochastic Programming (2nd ed., Springer 2011), Chapter 5 §5.1, gives the algorithm and proves its two central guarantees: a shortcut feasibility test for a special case (Theorem 1) and the algorithm's finite convergence in general (Theorem 2), which is this mission's goal.
A two-stage recourse instance consists of a first-stage feasible region for , and, for each of finite scenarios (occurring with probability ), second-stage data defining the recourse subproblem
where the recourse matrix is fixed — the same across every scenario, the case this chapter treats. is the set of for which every scenario's subproblem is feasible, and the two-stage problem is
A basis of the recourse subproblem is an injective choice of of 's columns (where is 's row count); each basis determines a simplex multiplier , and when attains the true optimum of , LP duality gives — the mechanism that turns a batch of second-stage LP solves into linear cuts on .
The L-shaped algorithm proceeds in three steps, repeated until neither applies:
Formalized as: starting from the empty cut set, there is a finite-length run of the algorithm's Step-1/2/3 transition relation, of length bounded by the total number of distinct feasibility- and optimality-cut witnesses available, ending at a state admitting no further step — at which point either the master program has become infeasible (certifying ) or its optimum is second-stage feasible, passes every fresh Step-3 test, and is optimal for the two-stage problem.
A shortcut avoiding separate feasibility LPs at Step 2: under these structural assumptions on , checking feasibility at the single componentwise-worst right-hand side certifies feasibility at every scenario simultaneously.
Van Slyke and Wets' method (and Benders decomposition more generally, of which it is the recourse-problem specialization) underlies essentially every large-scale two-stage stochastic program solved in practice, and its finite-convergence guarantee — not merely that an optimum exists, but that this specific cutting-plane procedure reaches it in finitely many outer iterations — is what makes the method a decision procedure rather than a heuristic. The proof's content is an explicit finiteness argument (the number of distinct simplex bases of the recourse subproblem and the feasibility-test LP is finite, so the algorithm cannot generate infinitely many distinct cuts before either exhausting the feasible region or converging), not a general compactness or fixed-point argument; formalizing it means formalizing the cutting-plane mechanism itself as a transition system and proving termination combinatorially, over the finite type of available bases, rather than proving only that some optimal exists.
The natural shortcut — state only "an optimal exists, or " — is not Theorem 2's actual content and is not what this mission targets: that weaker claim would already follow from being a nonempty polyhedron (or empty), with no reference to the algorithm at all, and would not require the finiteness-of-bases argument the book's proof turns on. The genuine difficulty is representing Steps 1-3 faithfully as a relation on accumulating cut sets, and pinning the termination bound to the actual combinatorial object the book cites (the finite set of bases of the two LPs the algorithm solves at each iteration) rather than to a numeral or an abstract compactness bound. A second, quieter difficulty is Step 1's own optimum: once optimality cuts exist, the master program optimizes jointly, but before the first one it optimizes alone; conflating the two (e.g. always requiring to be part of the optimum) does not match Step 1 as the book states it.
First-stage and second-stage vectors are Fin n1 → ℝ / Fin n2 → ℝ; the finite scenario set is
Fin K with probability vector p. A basis is {b : Fin m2 → Fin n2 // Function.Injective b} (m2 = the recourse matrix's row count), matching "an injective choice of columns of
"; its finiteness is definitional, from Fin m2 → Fin n2 being finite. Simplex multipliers use
Matrix.inv, whose junk value 0 on a singular matrix is never reachable in a proof because
multipliers are only ever used through an IsOptimalAt/IsFeasBasisOptimalAt hypothesis that
pins the basis to one genuinely attaining the LP's true optimum. The recourse value
is EReal-valued (reusing this series' Instance/QVal convention from Chunk 03), so an
optimality-cut witness's claimed value is compared to it by an explicit EReal cast, never by
EReal arithmetic. The algorithm's state is a pair of finite sets of witnesses recorded so far
(Finset (Fin K × FeasBasis n2 m2) × Finset (Fin K → Basis n2 m2)); Step is an inductive
relation with one constructor per Step-2 and Step-3 branch, each requiring its witness not already
recorded, and the goal states a bounded-length Step-path from the empty state to a state
admitting no further Step. This mission does not restate Chapter 3's polyhedrality fact
about as a separate lemma: the finiteness fact it is invoked for is already exposed directly
and structurally by the finite Fintype bound on the number of bases, so no additional axiom
stands in for it (see MODERATION_NOTES.md). Lemmas 3-9 and Theorem 10 of §5.2 (Regularized
Decomposition, a different algorithm) are out of scope. The trivializing formalization this
mission rules out is exactly the one named under Difficulty above: a bare existence-of-optimal-or-
infeasible- statement with no reference to Steps 1-3 or to a finite bound on the number of
iterations — such a statement would be true of any nonempty polyhedron and would not be Theorem 2.
Von Neumann introduced amenable groups in 1929 to explain the Hausdorff–Banach–Tarski paradox, and showed that the class of amenable groups contains all finite and all abelian groups and is closed under four processes: (I) subgroups, (II) quotients, (III) extensions and (IV) directed unions. Day named the smallest class with these properties , the elementary amenable groups. For fifty years these were the only amenable groups anyone could exhibit, and von Neumann's question whether every non-amenable group contains a free subgroup on two generators — whether equals the class of groups without such a subgroup — was open. (It was answered in the negative by Ol'shanskii in 1980, the year of this paper, by different methods.)
Ching Chou's Elementary amenable groups (Illinois J. Math. 24 (1980) 396–407, doi:10.1215/ijm/1256047608) gives the structure theory of that everything later relies on. Its central result is that the class can be built from finite and abelian groups by extensions and directed unions alone — subgroups and quotients add nothing (Proposition 2.2). From that description three things follow: periodic elementary amenable groups are locally finite, so the periodic non-locally-finite groups of Golod and Novikov–Adjan show (Theorem 2.3); a finitely generated simple elementary amenable group is finite (Corollary 2.4); and Wolf's conjecture holds in : a finitely generated elementary amenable group is almost nilpotent or has exponential growth (Theorem 3.2, extending Milnor and Wolf's theorem for solvable groups). A final section introduces a packing property (P) of groups and proves it for every elementary amenable group (Proposition 4.2) and every residually elementary amenable group (Corollary 4.7).
On this platform the definition of is already published
(the bundle Chou_ElementaryAmenable, from the mission
Cannon–Floyd–Parry: Thompson's group F and the simplicity of its commutator subgroup),
together with the theorem that Thompson's group is not elementary amenable
(Theorem 4.10) and, from Brin and Squier, that has no free subgroup on two
generators (CannonFloydParry.no_free_subgroup_of_rank_two). This mission formalizes
Chou's paper on top of that definition.
The class and its constructible core. Chou.ElementaryAmenable G is an inductive
predicate on groups: finite groups and abelian groups are in the class, and the class is closed
under isomorphism, subgroups, quotients, extensions and directed unions of subgroups; each rule
is a constructor of the published bundle Chou_ElementaryAmenable, where it is stated precisely. Chou builds the hierarchy
by transfinite recursion, applying only extensions and directed unions to the finite and
abelian groups, and proves that is closed under subgroups and
quotients, hence equals . The union is realised here without
ordinals, as the inductive predicate Chou.Constructible, whose constructors are of_finite,
of_commGroup, of_mulEquiv, extension and directedUnion; Chou's transfinite induction
over becomes structural induction over a derivation, with the same case analysis.
Periodic and locally finite groups. A group is periodic if every element has finite order
(Mathlib's IsMulTorsion) and locally finite if every finitely generated subgroup is finite
(Chou.IsLocallyFinite). Day's class is Chou.NoFreeSubgroupOfRankTwo: no homomorphism
from the free group on two generators into is injective.
Growth. For a finite generating set of , Chou.wordBall S n is the set of products
of at most factors, each in or with inverse in . has exponential growth if for
some finite generating set the ball of radius has at least elements for some
and all ; it is exponentially bounded if for some finite generating set and every
the balls are eventually smaller than . Chou works with for products of exactly
elements of a finite generating set ; for symmetric and containing the identity the
two agree, and Wolf's observation that the growth type is independent of the generating set is
one of the milestones. "Almost nilpotent" is Mathlib's Group.IsVirtuallyNilpotent: a
nilpotent subgroup of finite index. A free subsemigroup on two generators means two elements
such that distinct positive words in are distinct in
(Chou.HasFreeSubsemigroupOfRankTwo).
Packings. A pair of subsets is a packing of if is a
bijection (Chou.IsPacking), and has property (P) if every finite
subset lies in a finite for which some is a packing (Chou.HasPackingProperty).
is residually elementary amenable if every survives in some elementary amenable
quotient (Chou.ResiduallyElementaryAmenable).
The goal is Chou's description of the class, Proposition 2.2 (b) (p. 397): “ is the smallest
class of groups which contains all finite groups and all abelian groups and is closed under
processes (III) and (IV).” It is stated as the equivalence ElementaryAmenable G ↔ Constructible G.
The milestones follow the paper's order.
Section 2. Proposition 2.1 in two halves — the constructible groups are closed under subgroups and under quotients — which is the whole proof of the goal. Theorem 2.3: periodic elementary amenable groups are locally finite; and its consequence that is nonempty. Corollary 2.4: finitely generated simple elementary amenable groups are finite.
Section 3. Lemma 3.1 (an extension of almost nilpotent by almost nilpotent is almost nilpotent or of exponential growth), Theorem 3.2 and Rosenblatt's sharpening Theorem 3.2′, together with the facts Chou uses on the way: a finite-by-nilpotent group is almost nilpotent; a free subsemigroup forces exponential growth; Wolf's independence of the generating set; and Milnor's existence of the growth rate, in the form "exponentially bounded means not of exponential growth".
Section 4. Property (P) for finite groups, for , for finitely generated abelian groups; Lemma 4.1 (directed unions and extensions preserve (P)); Proposition 4.2 (every elementary amenable group has (P)); Lemma 4.6 (a) and Corollary 4.7 (residually elementary amenable groups have (P)); and the free groups.
Chou's Section 3 rests on results the paper cites rather than proves, none of which is in Mathlib. They are stated here as milestones in their own right, so that the dependence is visible and each is a well-defined target: the Milnor–Wolf theorem (a finitely generated solvable group that is exponentially bounded is almost nilpotent); M. Hall's theorem that a finitely generated group has finitely many subgroups of each finite index; that finitely generated nilpotent groups are finitely presented and that a group with a finitely presented subgroup of finite index is finitely presented; Milnor's Lemmas 1–2 in the form Chou states on p. 400 (in a finitely generated exponentially bounded group, a normal subgroup with finitely presented quotient is finitely generated); and Rosenblatt's variant of Lemma 3.1. Section 4 needs one more: free groups are residually finite. Lemma 3.1 and Theorems 3.2, 3.2′ can be closed only once these are; every other milestone is provable from Mathlib and the published library.
Two remarks on Theorem 2.3. Chou's witness for is a periodic group that is not locally finite (Golod; Novikov–Adjan), whose existence is not formalized. The platform already holds a different witness: Thompson's group is not elementary amenable (Cannon–Floyd–Parry, Theorem 4.10) and has no free subgroup on two generators (Brin–Squier); both are published and proved, and the milestone is proved from them. The inclusion itself is von Neumann's theorem that amenable groups contain no free subgroup of rank two, which passes through the definition of amenability and is not part of this mission.
The ordinal-indexed hierarchy and the remark that it stabilises at some (Proposition 2.2 (a)) are replaced by the inductive predicate. Chou's two examples of finitely generated groups in that are not almost solvable (p. 402), the Golod–Shafarevich discussion, and Lemma 4.6 (b) (ordinal-indexed normal series) are omitted. Propositions 4.3–4.5 on almost convergent sets, and Milnor's remark that exponentially bounded groups are amenable, need invariant means on ; amenability itself is the subject of Garrido I.
Given independent random variables , when does converge? Not absolutely — that question is settled by and is usually too strong. The interesting question is when the partial sums converge for almost every outcome, and here independence buys something that holds for no general sequence: convergence is not a delicate matter of cancellation but is decided, once and for all, by three numerical series.
Chapter 2 of Rick Durrett's Probability: Theory and Examples (Version 5, 2019) reaches this in section 2.5. Kolmogorov's three-series theorem fixes a truncation level , replaces each by , and asserts that converges almost surely if and only if
Three deterministic conditions on the distributions decide an almost-sure question about paths, and the answer does not depend on which is chosen. Through Kronecker's lemma this is also the route to the strong law of large numbers, which is how the chapter uses it.
Let be independent real random variables on a probability space, with partial sums . Say that converges almost surely when for almost every the sequence has a real limit; following Durrett, " converges" means exists, not that it converges absolutely.
Three tools from the same section support the theorem. Kolmogorov's maximal inequality strengthens Chebyshev from to the maximum of the whole path,
for independent, centred, square-integrable summands. From it comes the convergence criterion: if and then converges almost surely. Kronecker's lemma is the deterministic bridge to averages: if and converges then . And the Hewitt–Savage 0-1 law says that for an i.i.d. sequence every permutable event — one unchanged by rearranging finitely many coordinates — has probability or .
Both directions are asserted, as Durrett states the theorem. The truncation level is arbitrary and fixed in the statement; that the three conditions hold for one exactly when they hold for every is a consequence, not an assumption.
Kolmogorov's maximal inequality (2.5.5); the convergence criterion under summable variances (2.5.6); Kronecker's lemma (2.5.9); and the Hewitt–Savage 0-1 law (2.5.4).
The result itself. The three-series theorem is the complete answer to a question that has no complete answer without independence, and the shape of the answer is the interesting part: a pathwise, almost-sure property is equivalent to three conditions each computable from the marginal distributions alone. Each of the three does a separate job — the first says and its truncation differ only finitely often, so Borel–Cantelli lets them be exchanged; the second controls the drift of the truncated sums; the third controls their fluctuation. The theorem is also the standard route to the strong law: applying it to and then Kronecker's lemma gives , which is why section 2.5 sits where it does.
Formalizing it. Mathlib has the strong law of large numbers (strong_law_ae), both
Borel–Cantelli lemmas, and Kolmogorov's 0-1 law for the tail σ-field. It has none of the
following: Kolmogorov's maximal inequality, the almost-sure convergence criterion for random
series with summable variances, Kronecker's lemma, the Hewitt–Savage 0-1 law, or the three-series
theorem. The mission therefore contributes the whole of section 2.5, and the pieces are reusable
well beyond it — the maximal inequality and Kronecker's lemma in particular are standard tools with
no probabilistic content in the second case at all.
The maximal inequality is the step where the argument stops being routine. Chebyshev bounds and no more; controlling the maximum over the whole path needs the first passage decomposition and the observation that is measurable with respect to the first variables while is independent of them, so the cross terms vanish. That is a stopping-time argument in disguise, and it is what makes the whole section work.
The sufficiency half of the goal is then assembly: the third series and the convergence criterion give convergent, the second adds the means back, and the first plus Borel–Cantelli replaces by . Necessity is the harder direction, and Durrett does not prove it in Chapter 2 at all — he defers it to Example 3.4.12, where it follows from the Lindeberg–Feller central limit theorem. A solver attacking the goal should expect the reverse implication to need machinery from outside this section.
The Hewitt–Savage law has a difficulty of its own kind: the natural statement is about a σ-field of events on a sequence space, and the proof approximates a permutable event by cylinder events and then applies the permutation that swaps the first coordinates with the next .
Random variables are measurable real-valued functions on a probability space and independence is
Mathlib's iIndepFun. Variance is Mathlib's variance, and square-integrability is stated as
membership in where the maximal inequality and the convergence criterion need it. The
three-series theorem itself assumes no integrability: the truncated variables are bounded, so
their means and variances exist automatically, which is exactly why the truncation is there.
" converges" is formalized as convergence of the sequence of partial sums to a real
limit, not as Summable, which in Mathlib means unconditional and hence absolute convergence for
real series. This distinction is not pedantic here: condition (ii) of the theorem is convergence of
in Durrett's sense and would be a strictly stronger condition if read as
summability. Conditions (i) and (iii) are series of non-negative terms, where the two notions
agree, and are stated as Summable.
Almost-sure convergence of is "for almost every there exists a real with " — the limit is not asserted to be measurable in , and does not need to be for the statement to say what it should.
For the Hewitt–Savage law the sequence space is the countable product carrying
the infinite product of copies of one law, which is Mathlib's Measure.infinitePi, and a
permutable event is a measurable set invariant under every finitely supported permutation of the
coordinates. That is Durrett's exchangeable σ-field stated directly rather than constructed as a
σ-field object.
Contributions welcome beyond the listed items: the converse direction via Lindeberg–Feller (Example 3.4.12); the derivation of the strong law from the three-series theorem and Kronecker's lemma; the Marcinkiewicz–Zygmund law (2.5.12); and the rates of convergence of section 2.5.1.
Many hard combinatorial optimization problems — finding the maximum cut of a graph, deciding the ground state of an Ising spin system, bounding the correlation of a physical system — can be written as maximizing a bilinear form over sign vectors . Exhaustive search over sign patterns is intractable, so practitioners relax the problem: replace each sign by a unit vector in a higher-dimensional space and optimize the resulting inner products instead. This relaxation, a semidefinite program, is convex and solvable in polynomial time. The question is how much is lost in the relaxation — whether its optimal value can be far from the true, combinatorial optimum.
Grothendieck's inequality, proved by Alexander Grothendieck in 1953 in the context of Banach space theory (Résumé de la théorie métrique des produits tensoriels topologiques, Bol. Soc. Mat. São Paulo 8 (1953), 1–79), answers this for a broad class of such relaxations: replacing signs by unit vectors in an arbitrary Hilbert space changes the optimal value by at most an absolute, dimension-free constant factor. The inequality has since become a standard tool across combinatorial optimization, Banach space geometry, and (via the Goemans-Williamson algorithm for maximum cut, Section 3.6 of the source) approximation algorithms; see U. Haagerup, The Grothendieck inequality for bilinear forms on -algebras, Adv. Math. 56 (1985) for the tightest known constant, and Alon–Naor, Approximating the cut-norm via Grothendieck's inequality, SIAM J. Comput. 35 (2006), for the algorithmic connection this mission's Theorem 3.5.6 sets up.
Fix positive integers . Consider a real matrix . Say is normalized if for every choice of numbers ,
This says , viewed as a bilinear form on , has sup-norm at most . Now let be any real Hilbert space — a real vector space equipped with an inner product complete in the induced norm — and consider vectors and , each of unit norm . Replacing the scalar product by the inner product in the same bilinear form gives , a real number depending on the choice of and of the unit vectors. The question is how large this can be, uniformly over every such choice.
for every real Hilbert space and unit vectors , where is a constant depending on neither , its dimensions, nor . This mission's goal formalizes the book's own first-pass bound (Section 3.5), proved by a Gaussian truncation argument; it does not fix a numeral for , only that some absolute constant works, matching the shape of the true statement rather than a specific numeral that a sharper argument (the book's own Section 3.7 gives ) would immediately obsolete. See Formalization scope below for why this is the goal, not the sharper bound.
The result itself. Grothendieck's inequality is the single fact that makes semidefinite relaxation a provably good algorithmic strategy rather than a heuristic: whatever the true, hard-to-compute combinatorial optimum of a -valued bilinear optimization is, the tractable Hilbert-space relaxation cannot overshoot it by more than the constant . Milestone Theorem 3.5.6 makes this concrete for positive-semidefinite matrices, showing the semidefinite relaxation SDP of the integer program INT satisfies INT SDP INT — the guarantee underlying the Goemans-Williamson 0.878-approximation algorithm for maximum cut (Theorem 3.6.5 of the source, out of scope for this mission; see Formalization scope).
Formalizing it. The inequality and its two chapter milestones are proved but not previously
formalized on this platform (checked by concept search for "Grothendieck", "semidefinite",
"positive-semidefinite", and "max-cut" — no hits beyond the unrelated Grothendieck-Teichmüller
group). What remains after this mission is the sharper argument of Section 3.7
(the "kernel trick"), a separate, heavier development building on positive-definite kernels,
and full proofs of every milestone below (currently open sorry goals).
The statement of Grothendieck's inequality contains no randomness, yet every known elementary proof is probabilistic; this is itself a striking feature of the result. The obvious approach — bound directly by exploiting the normalization hypothesis on — fails because the normalization hypothesis only controls against sign vectors, and there is no way to project an arbitrary unit vector in a Hilbert space onto without losing information. The book's proof instead represents each unit vector via a scalar Gaussian random variable for a single Gaussian vector , recovering the inner products in expectation (Exercise 3.3.5); but these Gaussian variables are unbounded, so the normalization hypothesis (which bounds against bounded inputs) cannot be applied to them directly. The core technical step is a truncation argument: splitting each Gaussian variable into a bounded part and a small--norm unbounded remainder, applying the hypothesis to the bounded parts, and bounding the remainder terms by treating them as elements of the Hilbert space and invoking the very inequality being proved (Theorem 3.5.1 itself, applied with ) as a self-referential bootstrap — this is why the proof fixes as the smallest valid constant before starting, rather than building it up from scratch.
The goal and both milestones work with the real matrix and real inner product space directly;
H is required to be a complete real inner product space (NormedAddCommGroup,
InnerProductSpace ℝ, CompleteSpace), matching the book's "any Hilbert space." No
dimension bound on is imposed — the inequality's content is exactly that does not grow
with .
This mission does not formalize the sharper bound of Section 3.7, nor Theorem 3.6.5 (the 0.878-approximation guarantee for maximum cut via randomized rounding): the latter's statement quantifies over "the result of a randomized rounding of the solution of the semidefinite program," which would drag a specific algorithm into the audited statement rather than keeping it a self-contained mathematical claim (the statement/proof-separation trap this series' triage rubric flags). Grothendieck's identity (Lemma 3.6.6), the key fact behind that rounding step, is included on its own as a milestone, stated with an explicit, named random sign variable rather than an opaque "rounding procedure."
A trivializing formalization would state the goal with allowed to depend on , , ,
or — every such bound is easy (e.g. ) and carries none of the
theorem's content; the Lean statement rules this out by quantifying before every other
object. and (Theorem 3.5.6) are defined from scratch in this
chunk's namespace, using Matrix.PosSemidef from Mathlib for the positive-semidefiniteness
hypothesis (which bundles the real-symmetric condition); Mathlib has no ready-made SDP-value
construction to reuse. The sub-gaussian (Orlicz ) norm used by Theorem 3.1.1 is reused,
unchanged, from the 01-concentration mission in this series (HighDimProb.Concentration.SubgaussianNorm)
rather than redefined.
Any dataset of points can be described exactly by embedding it in for large enough — but a large is expensive: nearest-neighbor search, clustering, and streaming algorithms all scale with the ambient dimension, not with . The question that opens this mission is whether the dimension can be cut down while leaving the data's geometry — the pairwise distances between points — essentially untouched.
Johnson and Lindenstrauss answered this in 1984, while studying extensions of Lipschitz maps into Hilbert space (W. Johnson, J. Lindenstrauss, Extensions of Lipschitz mappings into a Hilbert space, Contemp. Math. 26 (1984), 189–206): points in any Euclidean space, of any dimension , can be mapped by a single linear map into a space of dimension only , distorting every pairwise distance by at most a factor of . The map does not depend on the data beyond its cardinality — a single random object works simultaneously for the whole point set with high probability. This is now one of the standard tools of randomized dimension reduction, cited across nearest-neighbor search, streaming linear algebra, compressed sensing, and machine learning pipelines that need to shrink feature dimension before a downstream algorithm runs.
Fix a probability space . A random orthogonal projection of rank in is a map , continuous and linear for each , such that almost surely is idempotent (), self-adjoint, and has range of dimension — i.e. is the orthogonal projection onto some -dimensional subspace . It is uniformly distributed in the Grassmannian (written ) when its law is rotation invariant: for every orthogonal transformation of , the conjugated map has the same law as . Conjugating a projection by is exactly the projection onto the image of its range under , so this says the law of the random subspace is invariant under the full orthogonal group — the operational definition Vershynin himself uses for a "uniformly distributed" random subspace, since no coordinate-free formula for such a subspace's law is given directly.
A companion notion drives the proof: a random vector is uniform on the Euclidean sphere of radius , , when it lies on that sphere almost surely and its law is likewise rotation invariant. And a real random variable is sub-gaussian with sub-gaussian () norm , the standard non-asymptotic measure of how light-tailed 's distribution is (a bounded or Gaussian random variable has finite norm; the tail probability then decays at least as fast as ).
for every finite , every , and every random orthogonal projection of rank uniformly distributed in . The universal quantifier over pairs sits inside the single probability event — this is the union-bound content that makes the statement a genuine simultaneous guarantee for the whole point set, not a restatement of the single-vector lemma below for one fixed pair. Both constants are the book's own unnamed absolute constants, never depending on , , , or ; this is the weakest stable form of the claim (no numeral is hard-coded for or ), matching the book's own statement exactly.
The lemma gives a universal, data-oblivious dimension-reduction guarantee: the target dimension depends only on the number of points and the desired distortion, never on the ambient dimension or on the geometry of the specific point set. This is what makes it usable as a black-box preprocessing step ahead of an algorithm whose cost scales with — the projection is drawn once, without looking at the data, and works with high probability for every pairwise distance simultaneously. The bound is also known to be essentially optimal in : Alon (Problems and results in extremal combinatorics, Discrete Math. 273 (2003)) showed a lower bound of on the target dimension, so the dependence cannot be removed.
The theorem itself has been proved for decades and admits several proof strategies (this book's route through Lipschitz concentration on the sphere; the original volume/measure-concentration argument; later "sparse" or structured variants of the projection for faster computation). This mission formalizes the classical dense-Gaussian-projection proof route as Vershynin presents it, building the sphere-concentration engine (Theorem 5.1.4) and the single-vector projection lemma (Lemma 5.3.2) that the union-bound argument for the goal rests on. No machine-checked formal proof of this chain is known to exist on the platform prior to this mission (see Formalization scope below); what is contributed is the statement infrastructure — the goal and its two direct supporting lemmas, stated with explicit, unpinned absolute constants — for solvers to close.
The natural first idea — bound the distortion of a single fixed vector under a random projection, then take a union bound over the pairwise differences — is exactly the strategy Lemma 5.3.2 and the goal use, but it does not by itself explain why the single-vector concentration bound (Lemma 5.3.2(b)) holds with the stated sub-gaussian-type tail. That bound is not elementary: it reduces to a uniform concentration statement for an arbitrary Lipschitz function of a uniformly random point on a high-dimensional sphere (Theorem 5.1.4), since , viewed as a function of a rotated copy of , is a -Lipschitz function on the sphere. Proving that every Lipschitz function concentrates — not just linear ones, for which sub-gaussianity was already established in Chapter 3 — needs a genuinely different tool: comparing the sub-level sets of an arbitrary Lipschitz function to spherical caps via an isoperimetric inequality on the sphere. This geometric input is what makes the concentration phenomenon behind Johnson-Lindenstrauss a dimension-free fact rather than a special property of coordinate projections.
is a Finset of points in EuclideanSpace ℝ (Fin n), matching "a set of points"; is
read off as X.card. The random subspace is represented throughout by the
orthogonal projection onto it (IsUniformProjection), following the book's own statements,
which are phrased in terms of rather than ; the scaled map of the goal is
written Real.sqrt (n/m) • P ω applied to x - y, using linearity of to realize
. Both "uniform on the sphere" and "uniform in the Grassmannian" are defined
operationally by rotation invariance of the underlying law, since Mathlib has no ready-made
normalized surface measure on a general-radius Euclidean sphere or Haar-measure construction on
the Grassmannian/orthogonal group to build a canonical uniform object from; rotation invariance
uniquely determines the corresponding measure among those supported on the relevant set, so the
operational and constructive definitions coincide extensionally. Every "absolute constant" in the
book ( in Theorem 5.3.1's sample-complexity hypothesis, in every failure-probability bound,
and the sub-gaussian constant of Theorem 5.1.4) is existentially quantified ahead of the
dimension, sample size, and every other object, and pinned to no numeral — a formalization that
hard-coded a specific numeral for any of these would be invalidated by the next sharper constant
in the literature and would not match what the book actually proves.
A trivializing formalization is one that states the conclusion for a single fixed pair rather than universally over all pairs inside one event; that would collapse the union-bound content that makes this a dimension-reduction statement for a whole point set (with points), rather than a restatement of the single-vector Lemma 5.3.2(b). This mission's goal statement is built to rule that out explicitly (see Formalization targets above).
Reusable infrastructure: subgaussianNorm (the Orlicz norm, restated per Vershynin
Definition 2.5.6) and the rotation-invariance idiom for "uniformly distributed" random geometric
objects are of independent interest to any later chapter needing sub-gaussian random vectors or
random subspaces/projections (e.g. Chapters 4, 6, 7, 9, 11 of this same book series). Solvers'
contributions are welcome on: the isoperimetric inequality on the sphere and its use to prove
Theorem 5.1.4 (the mission's hardest open leaf); the coordinate-projection computation underlying
Lemma 5.3.2(a); and the concentration-plus-union-bound argument closing the goal from the three
supporting lemmas.
Existence of equilibrium is the first question any model of strategic interaction must answer, and the classical answer — Nash's theorem via Kakutani's fixed point theorem — asks for a convex, compact strategy space and continuous payoffs. Many of the models economists actually use do not have that: a firm's technology set can be discrete or irregular, and a payoff need only be upper semicontinuous, not continuous. Topkis [1979] showed that when a game's structure is instead order-theoretic — each player's strategies form a lattice, and the players' incentives reinforce each other in a precise sense — an equilibrium exists without any convexity or continuity assumption at all, and the proof method delivers something Kakutani's theorem cannot: a greatest and a least equilibrium point, with the whole equilibrium set forming a complete lattice. Zhou [1994] later showed the completeness of the equilibrium lattice in full generality; this mission formalizes the resulting theorem (Topkis's Theorem 4.2.1) together with its parametric extension (Theorem 4.2.2, established independently by Milgrom and Roberts [1990a] and Sobel [1988]), which shows how the greatest and least equilibria move as a parameter of the game — its technology, its cost structure — changes. This machinery underlies monotone comparative statics for games throughout economics: oligopoly models with strategic complements, coordination games, and search and matching models with increasing returns.
A noncooperative game consists of a finite player set , a set of feasible joint strategies (allowing the set of strategies feasible for one player to depend on the others' choices, so need not be a product set), and a payoff function for each player . Write for the strategies of every player but , for the section of at — player 's feasible strategies given the others' choice — and for player 's best-response set. The best joint response correspondence is . A feasible is an equilibrium point if for every player and every feasible deviation — no player can unilaterally improve.
A lattice is a partially ordered set in which every pair of elements has a join
and a meet . A function is supermodular on a subset if for all in it, and has increasing
differences in two of its arguments if is
monotone whenever . A game is a supermodular game
if is a sublattice, is supermodular in for every fixed
and every , and has increasing differences in for every — jointly, the conditions under which each player's own
strategy components are complements and complementary to the other players' strategies
(Theorem 2.6.1 of chunk 01-lattices/02-monotonicity's book).
If is a supermodular game, is nonempty and compact, and each is upper semicontinuous in on for every and every , then
is nonempty, has a greatest and a least element, and, under the order it inherits from , is itself a nonempty complete lattice.
Let be a partially ordered set and, for each , a supermodular game with nonempty, compact, and increasing in ; suppose each is upper semicontinuous in and has increasing differences in . Then for every there exist a greatest and a least equilibrium point of game , and both are increasing functions of on — the equilibrium set moves monotonically as the parameter increases.
Two supporting results are formalized as milestones because Theorem 4.2.1's own proof uses them directly: Lemma 4.2.1 (equilibrium points are exactly the fixed points of the best joint response correspondence) and Lemma 4.2.2, parts (b) and (f) (the best joint response set is a nonempty compact sublattice for every feasible , and the correspondence is increasing in ).
The result itself. Theorem 4.2.1 is the lattice-theoretic alternative to
Nash/Kakutani existence: it needs no convexity of and no continuity of
(upper semicontinuity suffices), and in exchange it delivers a greatest and a least
equilibrium — with an explicit order-theoretic characterization via Theorem 2.5.1 of
chunk 01-lattices — and the guarantee that the entire equilibrium set is a complete
lattice, not merely nonempty. Theorem 4.2.2 gives this existence result teeth for
applied comparative statics: it says that if a firm's cost structure, a market's demand
parameter, or any other feature of the game increases (in the sense of the induced set
order on and increasing differences in the payoffs), the extremal equilibria
increase too — the qualitative content behind results such as "more competition leads
to lower prices" in supermodular oligopoly models.
Formalizing it. The platform's existing Nash-equilibrium theorem
(AGT.nash_existence, Theorem 1.8 of Algorithmic Game Theory) is a Brouwer/Kakutani
argument for finite games with mixed strategies: it needs finiteness of every player's
strategy set (so that mixed strategies form a compact convex simplex) and gives no
lattice structure on the equilibrium set at all. Theorem 4.2.1 is a different
technique entirely — it needs no finiteness, no mixing, and no convexity, and its
conclusion (a complete lattice of equilibria) is exactly the content Brouwer/Kakutani
cannot give. This mission is therefore not a restatement of Nash's theorem in different
notation, but a second, independent existence technique with a strictly different
structural payoff, formalized here for the first time on the platform. It builds
directly on chunk 01-lattices's Theorem 2.5.1 (Zhou's fixed point theorem for
increasing correspondences) and chunk 02-monotonicity's supermodularity/increasing
differences definitions, both formalized earlier in this series.
The natural first idea for existence — "the best joint response correspondence has a fixed point by some general fixed-point theorem for correspondences" — needs the correspondence to be convex-valued and upper hemicontinuous for a Kakutani argument, neither of which supermodularity or upper semicontinuity alone supply: a best-response set under only upper semicontinuity can be a disconnected, non-convex set (e.g. the maximizers of a supermodular but non-quasiconcave function). The actual route goes through order instead of topology: Lemma 4.2.2 shows the best joint response set is a compact sublattice (hence subcomplete, by Theorem 2.3.1) and that the correspondence is increasing under the induced set order, which is exactly the hypothesis Theorem 2.5.1's non-constructive supremum/infimum construction needs — no convexity anywhere. A second subtlety, which the mission is careful not to elide: the equilibrium set of a supermodular game need be neither compact nor a sublattice of when there are more than one player (Topkis's Examples 4.2.1 and 4.2.2 exhibit both failures); only the weaker claim — a complete lattice under the inherited order — is true in general, and that is what Theorem 2.5.1(b) supplies.
A joint strategy is represented as a dependent function ∀ i, Fin (m i) → ℝ over a
finite player type ι, with a player's own strategy accessed and overwritten via
Function.update, so that is never reified as a separate object — every
statement about or membership in substitutes y for
x's own i-th coordinate directly. IsSupermodularGame reuses chunk
02-monotonicity's SupermodularOn and IncreasingDifferencesOn verbatim, applied to
each player's own payoff, rather than restating the supermodularity/increasing-
differences conditions from scratch — a formalization that inlined a weaker,
ad hoc notion here (e.g. supermodularity of the joint payoff vector rather than each
player's own payoff in their own strategy) would trivialize the connection to chunk
02-monotonicity's theorems that the book's own proof relies on. Theorem 4.2.1's
"nonempty complete lattice" conclusion is formalized, as in chunk 01-lattices, via
IsLUB/IsGLB on the subtype of equilibrium points — never as membership of the
ambient supremum/infimum in the equilibrium set, which the book's own
Examples 4.2.1–4.2.2 refute; a solution that instead proved the equilibrium set compact
or a sublattice of would be proving a strictly stronger and false claim.
Only parts (b) and (f) of Lemma 4.2.2 are formalized, since those are the only two of
its eight parts the proof of Theorem 4.2.1 uses; a complete development still needs
chunk 01-lattices's Theorem 2.3.1 (subcomplete iff compact) and Theorem 2.5.1/2.5.2,
and chunk 02-monotonicity's Theorem 2.8.1 and Corollary 2.7.1, none of which are
restated here.
A recurring question in economics and operations research is: when a decision problem depends on a parameter, does the optimal decision move monotonically as the parameter changes? A firm's optimal input mix as a price rises, a consumer's optimal consumption bundle as income grows, a Cournot firm's optimal output as a rival's output changes — in each case one wants "more of the parameter implies (weakly) more of the optimum" without assuming convexity, differentiability, or a unique optimizer. The classical tool for such comparative statics questions is the implicit function theorem, which needs smoothness and a nondegenerate Hessian and breaks down the moment the optimum is not unique or the objective is not differentiable. Topkis [1978] showed that a purely order-theoretic condition — supermodularity of the objective jointly in the decision variable and the parameter — is sufficient on its own, with no smoothness, uniqueness, or convexity assumed at all, and Milgrom and Roberts [1990a, 1994] later showed this lattice-theoretic approach subsumes and strengthens the classical monotone-comparative-statics results in economics. This mission formalizes the two central results this book calls "Topkis's theorem" (Theorem 2.8.1 and Theorem 2.8.2), together with the structural fact about maximizers of a supermodular function (Theorem 2.7.1) that both rest on, and the strengthening to strictly ordered optimal selections (Theorem 2.8.4).
Let be a lattice: a partially ordered set in which every pair
has a join and a meet . A real-valued function
is supermodular on if
for all ; this is
the same relativized notion (SupermodularOn) used, with , throughout chunk I of
this series.
Now let also be a partially ordered set (the parameter set), and let be a real-valued function of the pair . has increasing differences in if, for every in , the map is monotone (order-preserving) in ; equivalently, the marginal gain from raising is itself increasing in . Replacing "monotone" with "strictly monotone" gives strictly increasing differences. To compare the resulting sets of optimizers rather than single points, this mission reuses the induced set ordering from chunk I: for , holds when and for all , .
Let and be lattices, let be a sublattice of the product lattice , and let be the section of at . If is supermodular on (jointly in the pair ), then
is increasing in , with respect to , on .
With increasing in (with respect to ), supermodular in for each fixed , and having increasing differences in on , the same conclusion — increasing in — holds. Theorem 2.8.2's joint-supermodularity hypothesis on a sublattice of automatically forces both of Theorem 2.8.1's hypotheses, so 2.8.1 is the logically weaker, more elementary statement from which 2.8.2's proof proceeds.
Under the hypotheses of Theorem 2.8.1 but with strictly increasing differences, every individual optimal solution at a larger parameter value dominates every individual optimal solution at a smaller one: , , and together force — a genuinely stronger conclusion than alone gives.
A supporting result is formalized as a milestone because both goals' proofs use it directly: Theorem 2.7.1, that is a sublattice of whenever is supermodular on — the structural fact that makes it meaningful to compare optimal-solution sets with in the first place.
The result itself. Theorem 2.8.2 is the book's own headline theorem, cited throughout the rest of the monograph: it underlies the assortative-matching existence theorem (Chapter 3), monotone optimal policies in Markov decision processes (Chapter 3), and equilibrium comparative statics in supermodular games (Chapter 4) — each a later mission in this series. Its distinguishing feature relative to the implicit function theorem is that it needs no differentiability, no uniqueness of the optimizer, and no interiority: it applies equally to discrete decision problems (integer programming, combinatorial selection) and continuous ones.
Formalizing it. Nothing in Mathlib currently states a parametric monotone-comparative-
statics result of this shape: the closest neighboring material (order-preserving maps,
MonotoneOn, lattice structures) supplies only the vocabulary, not the theorem. This
mission is the first formalization of Topkis's theorem on this platform and introduces
the increasing-differences vocabulary (IncreasingDifferencesOn,
StrictlyIncreasingDifferencesOn) that later missions in this series (matching, MDPs,
supermodular games) reuse directly.
The natural first idea — differentiate in , set the gradient to zero, and use the implicit function theorem on the resulting first-order condition — fails immediately because nothing here is assumed differentiable, and need not be a single point. The correct argument instead compares two arbitrary elements , directly through the supermodularity inequality applied to the pair against (a chain of inequalities Topkis calls "Lemma 2.8.1"), using increasing differences only to move the parameter from to inside that chain — at no point is a derivative, a selection function, or an interior point used. A second subtlety is that "increasing" in the conclusion is with respect to the induced set order , not a claim that some selection is monotone: proving the stronger, pointwise-ordered conclusion (Theorem 2.8.4) genuinely needs the strict form of increasing differences, not merely increasing differences plus an extra hypothesis.
and are kept as abstract Lattice/PartialOrder types throughout, matching the
book's own generality — Theorem 2.8.1's and 2.8.2's /
corollary via second partial derivatives (discussed in the book's prose immediately after
Theorem 2.8.2, p. 77) is not itself a numbered theorem and is not formalized here.
Supermodularity, increasing differences, and strictly increasing differences are each
formalized as a single relativized definition (SupermodularOn f S,
IncreasingDifferencesOn f S, StrictlyIncreasingDifferencesOn f S) so the same
declaration expresses both "supermodular on the whole lattice " (used by Theorem 2.7.1
and Theorem 2.8.1's per- hypothesis) and "jointly supermodular on a sublattice of
" (Theorem 2.8.2) — a formalization that instead only ever supermodularized
for fixed would collapse Theorem 2.8.2's genuinely joint hypothesis into
a restatement of Theorem 2.8.1, which is exactly the trivialization this mission's chunk
brief warns against. is written out as the set
of that dominate every other element of under , and every
conclusion is stated only for pairs at which both argmax sets are assumed
nonempty — matching the book's own restriction to , since holds
vacuously whenever either side is empty. This mission depends on chunk I's
InducedSetOrder; it introduces no reusable infrastructure beyond its own three
definitions, which later missions in the series (matching, MDPs, supermodular games) are
expected to import directly rather than redefine.
This mission formalizes §4 of Cannon, Floyd and Parry's Introductory notes on Richard Thompson's groups, together with the definition of Thompson's group from their §1. The goal is their Theorem 4.5: the commutator subgroup is simple.
In the 1960s Richard Thompson defined three groups, now written , and , whose properties have kept them in use ever since as a source of examples at the edge of what groups can do. is the smallest of the three and the least understood. It is finitely presented (§3 of the source) and torsion-free, it has no free subgroup of rank two, and whether it is amenable — whether it carries a finitely additive left-invariant probability measure defined on all its subsets — is open. Cannon, Floyd and Parry record (§4, p. 227) that Geoghegan raised the question and conjectured in 1979 both that contains no non-Abelian free subgroup and that is not amenable.
That question is what makes worth pinning down precisely. Write for the class of
amenable discrete groups, for the elementary amenable ones, and for the groups with
no free subgroup of rank two. That was noted by
Day and follows from
von Neumann; whether it is strict is the von
Neumann–Day problem. It is: Olshanskii proved in a 1984 ICM address and
Gromov gave an independent proof — but by
examples that are not finitely presented. Brin and Squier proved in 1985 that , and
is not elementary amenable (Theorem 4.10 of the source, CannonFloydParry.not_elementaryAmenable_F). So
is a finitely presented group in if it is amenable and in
if it is not — a question with no other finitely presented candidate.
Call a real number dyadic if it has the form with and .
Thompson's group , as §1 of the source defines it, is the set of piecewise linear homeomorphisms of the closed unit interval onto itself that are differentiable except at finitely many dyadic rationals, and whose derivatives, where they exist, are powers of . Since those derivatives are positive, every element preserves orientation, so the elements of are increasing. Composition of two such maps is again one, and so is the inverse of one, so is a group.
The formalization calls such a map piecewise linear over the dyadics, and defines as the subgroup generated by those maps — so that closure under composition and inverses is a theorem rather than part of the construction, as the source has it. What the model fixes rather than derives is under Formalization scope below.
Two particular elements generate it. Write
An element of is trivial near if it fixes every point of some interval , and trivial near if it fixes every point of some . The support of is the set of points of that moves. The commutator convention throughout is , and denotes the commutator subgroup.
This is the capstone of §4: it says the commutator subgroup has no normal subgroup other than itself and the trivial one. It is the goal because the rest of the section feeds it — both halves of Theorem 4.1, Theorem 4.3, and both supporting lemmas below are consumed by its proof.
So has no interesting proper quotients at all. With the first part of Theorem 4.1 this forces every nontrivial normal subgroup of to contain .
That the piecewise-linear maps are already closed under composition and inverses, so that consists of exactly those maps; a transitivity lemma on dyadic partitions of ; the fact that the subgroup of elements supported in a dyadic interval of dyadic length is isomorphic to itself; triviality of the center; that contains no non-Abelian free group; and that admits a total order invariant under multiplication on both sides.
What the results give. Theorem 4.1 identifies concretely — a subgroup defined by a global algebraic condition turns out to be cut out by local behavior at the two endpoints — and computes the abelianization, making the pair of endpoint slopes a complete invariant of modulo commutators. Theorem 4.3 and the simplicity of together determine the whole normal subgroup lattice: every normal subgroup of is trivial or contains . That lattice is the input to the elementary-amenability argument.
What formalizing adds. All of these are proved in the source; none is in Mathlib, which has no piecewise-linear homeomorphism API and no Thompson group. Four of the milestones are proved as part of this proposal: that the piecewise-linear maps form a subgroup, that elements of permute the dyadic rationals, that embeds in the group Brin and Squier work with, and the absence of a free subgroup of rank two, which follows from the already-formalized Brin–Squier theorem via that embedding. The rest are open. The piecewise-linear machinery built along the way — local affineness, dyadic-breakpoint bookkeeping, extension by the identity — is reusable for , for , and for the wider family of piecewise-linear homeomorphism groups.
The obvious approach to the goal is to argue that a normal subgroup of containing a nontrivial element must be everything, by conjugating that element around. It fails on its own: an element of is pinned down only by being trivial near the two endpoints, and one still has to manufacture — inside , not merely inside — an element carrying a prescribed pair of neighborhoods into those. That construction is what the dyadic-partition transitivity lemma supplies, and it is where the combinatorics of dyadic subdivision enters.
The second difficulty was that the source proves §4 using the tree-diagram normal form of §2.
That section is now formalized in its own mission, Cannon–Floyd–Parry §2: tree diagrams and the
normal form (mission ffd1e4ea-9f9a-4cb6-8419-78e70f2545e8), all of whose milestones are proved.
Corollary 2.6 — milestone 5 here, the same theorem object — is closed from there, and Theorem
2.5 (represents_word_exponents) and the normal form (existsUnique_normalForm) are available to
a solver attacking Theorem 4.3, so the source's argument can now be followed. A solution file
imports only definitions, so whatever it uses from §2 must be reproved inline; the §2 solutions
are public and written to be reused that way. The piecewise-linear route — dyadic-partition
transitivity, Lemma 4.4 and Theorem 4.1 — remains an alternative, and is what Theorem 4.5's own
argument uses.
The unit interval is as a subtype, and an element of is an order isomorphism of it, so orientation preservation is built into the representation rather than derived — faithful to the source's set, but assuming one sentence CFP prove. Piecewise linearity is stated as: there is a finite set of dyadic reals such that the map is affine, with slope a power of two, on every closed interval whose interior misses . Intercepts are not required to be dyadic — that is derived by induction along the breakpoints, not part of the definition.
The definition is not vacuous: and of Example 1.1 are constructed explicitly, and that is not the trivial group is one of the milestones below — so no statement here is satisfied by the trivial group. In particular the goal, which asserts simplicity and therefore nontriviality, is not trivially false.
A companion definition places the same data on the real line, each element extended by the identity outside ; that line realisation is what the bridge statement connects to Brin and Squier's group.
Before any geometry of surfaces can be done, one has to say what a surface is, in a way that supports calculus: a subset of that is locally the smooth, non-degenerate image of an open piece of the plane. Every statement in the later theory — the first and second fundamental forms, the Gauss map, curvature, geodesics — is written in local coordinates, and is therefore meaningful only once one knows that the answer does not depend on the coordinates chosen. That independence is the content of the change-of-parameters theorem, which is what makes "differentiable function on a surface" and "geometric quantity of a surface" well-defined notions.
The reference for this mission is Manfredo P. do Carmo, Differential Geometry of Curves and Surfaces, 2nd edition (Dover, 2016), §2-2 "Regular Surfaces; Inverse Images of Regular Values" (pp. 54–71) and §2-3 "Change of Parameters; Differentiable Functions on Surfaces" (pp. 72–85): Definition 1 (p. 54), Propositions 1–4 of §2-2 (pp. 59, 61, 63, 65) and Proposition 1 of §2-3 (p. 74).
This is the fourth mission of a series formalizing do Carmo's book, sharing the namespace
DoCarmoDG with the others.
A subset is a regular surface when every has an open neighbourhood such that is the image of a map , defined on an open set , satisfying the three conditions of do Carmo's Definition 1:
Such an is a parametrization, or system of local coordinates, and is a coordinate neighbourhood.
Given a differentiable on an open set , a value is a regular value of when is surjective — equivalently, nonzero — at every with (do Carmo Definition 2, §2-2).
If and are two parametrizations of a regular surface with , then
is a diffeomorphism: is differentiable, bijective, and is differentiable.
The graph of a differentiable function of two variables is a regular surface (Proposition 1); the inverse image of a regular value is a regular surface (Proposition 2); a regular surface is locally the graph of a differentiable function of one of the three coordinate pairs (Proposition 3); and an injective map satisfying conditions 1 and 3 whose image lies in a regular surface automatically has a continuous inverse (Proposition 4).
Proposition 2 is the practical criterion: it is what shows in one line that spheres, ellipsoids, tori and the level sets of generic polynomials are regular surfaces, and it is applied throughout the book. Proposition 3 is the structural statement that a regular surface is locally a graph, which is the form in which most local computations are carried out; Proposition 4 removes the awkward homeomorphism clause from the verification of examples. The change-of-parameters theorem is what allows every subsequent definition — differentiable function on a surface, tangent plane, first fundamental form, curvature — to be given in coordinates and then shown to be independent of them, and it is also the reason a regular surface carries a smooth structure at all.
Mathlib has smooth manifolds, the implicit and inverse function theorems, and ContDiffOn, but it
does not contain do Carmo's concrete definition of a regular surface as a subset of
or these four propositions about it. Establishing them is what allows the rest of this series to
work with patches while knowing that the objects so defined are coordinate-independent.
Everything here rests on the inverse function theorem, but each proposition needs it in a slightly different form. Proposition 2 requires completing to a local diffeomorphism and reading off the level set — with the complication that which partial derivative is nonzero varies from point to point, so the coordinate that is solved for is not fixed in advance. Proposition 3 needs the same case distinction on which Jacobian minor of is nonzero, and this is exactly why the conclusion is a disjunction over the three coordinate pairs. Proposition 4 is where the homeomorphism condition is shown to be redundant, and the argument goes through the local factorization .
The change-of-parameters theorem is not a direct application of the inverse function theorem to : the map is defined only on a subset of the plane and is, a priori, merely continuous. One first extends to a local diffeomorphism of a neighbourhood in and then composes; the continuity of (condition 2 of Definition 1) is what makes the domain of open, and it cannot be dispensed with.
A surface is a set S : Set (EuclideanSpace ℝ (Fin 3)), and a parametrization is a map
x : ℝ × ℝ → EuclideanSpace ℝ (Fin 3) together with an open U : Set (ℝ × ℝ). Smoothness is
ContDiffOn ℝ (⊤ : ℕ∞), matching do Carmo's "differentiable" for ; regularity is
injectivity of the Fréchet derivative at each point of U, which is do Carmo's condition 3; and
the homeomorphism condition is stated as injectivity on U together with the existence of a
continuous left inverse on the image, which is the content of "the inverse is continuous". The
neighbourhood clause of Definition 1 is x '' U = V ∩ S for an open V containing the point.
Graphs are formalized as three separate sets, one for each of , and
, so that Proposition 3 can state its disjunction faithfully; in that statement the
neighbourhood is an open set W of and the claim is W ∩ S = W ∩ graph.
The goal states the diffeomorphism property of explicitly — two maps, mutually inverse on the
relevant domains, both ContDiffOn, together with the openness of those domains — rather than
through a bundled structure, so that no library convention is assumed. There is no trivializing
reading: the domains are those forced by the two parametrizations, and in the degenerate case
where the images do not overlap the statement reduces to a true but empty claim about the empty
set, while the substance is in the overlapping case.
The local theory of curves describes what happens near one point; the global theory asks what a curve must satisfy because it closes up. Two classical statements make the difference visible. The isoperimetric inequality says that among all simple closed plane curves of a given length, the circle encloses the largest area — a question already settled in intent by the Greeks, but given a satisfactory proof only in the nineteenth century, and the short proof reproduced by do Carmo is E. Schmidt's from 1939. The four-vertex theorem says that the curvature of a simple closed convex curve has at least four critical points, so no convex oval has the curvature profile of a curve that just rises and falls once.
The reference for this mission is Manfredo P. do Carmo, Differential Geometry of Curves and Surfaces, 2nd edition (Dover, 2016), §1-7, "Global Properties of Plane Curves" (pp. 31–46): the area formula, equation (1) on p. 33; the isoperimetric inequality, Theorem 1 on p. 34; the theorem of turning tangents on p. 37; the lemma, equation (5) on p. 38; and the four-vertex theorem, Theorem 2 on p. 37.
This is the third mission of a series formalizing do Carmo's book, and shares the namespace
DoCarmoDG with the earlier ones.
A closed plane curve of length is a regular map whose derivatives of all orders agree at the two endpoints; equivalently, and as used here, a smooth -periodic map . It is parametrized by arc length when for all , in which case is its length. It is simple when it has no self-intersection: for distinct .
Write for rotation by , . For a curve parametrized by arc length the signed curvature is
which is do Carmo's convention of §1-5, Remark 1: the normal is chosen so that has the orientation of the natural basis, and then . A vertex is a parameter with . The curve is convex when, for every parameter , the whole trace lies in one of the two closed half-planes bounded by the tangent line at .
An angle function for is a smooth with ; the rotation index is . The area bounded by a positively oriented simple closed curve is given by do Carmo's equation (1),
The three equivalent forms of the area formula (1); the existence of a smooth angle function; the identity ; the theorem of turning tangents (the rotation index of a simple closed curve is ); the isoperimetric inequality with equality exactly for circles; and do Carmo's lemma (5), , which drives the proof of the goal.
The isoperimetric inequality is the ancestor of a large family of geometric inequalities, and its sharp case characterizes the circle — the first instance of the pattern "extremal configuration is the round one" that recurs throughout geometry. The four-vertex theorem is a genuinely global statement with no local counterpart: locally, the curvature of a convex arc may be strictly monotone, and it is only the requirement that the curve close up convexly that forces four critical points. Its converse, for strictly positive curvature, was proved by H. Gluck in 1971; do Carmo notes that the theorem also holds for simple closed curves that are not convex, by a harder argument.
Mathlib contains integration, the winding number of a loop in the complex plane and the Jordan curve theorem, but it does not contain the signed curvature of a plane curve, the theorem of turning tangents in this form, the isoperimetric inequality for curves with its equality case, or the four-vertex theorem. What this mission adds is that vocabulary and machine-checked proofs of the four classical statements.
Each target fails for a different reason under the naive approach.
For the area formula, the identification of with the area of the interior is exactly the Jordan-curve input that do Carmo declares he is assuming; the formalization avoids that dependency by defining the bounded area through the integral, so a solver has to prove only the integration-by-parts identities among the three forms of (1).
For the theorem of turning tangents, the difficulty is that a smooth lift of the tangent indicatrix must be produced and then shown to increase by exactly over one period — a degree-theoretic statement about a loop in the circle, where simplicity of the curve is what excludes the values .
For the isoperimetric inequality, Schmidt's proof compares the curve with a circle tangent to two parallel supporting lines and uses the arithmetic–geometric mean inequality; the equality discussion, which is where the characterization of the circle lives, is the delicate part.
For the four-vertex theorem, the obvious argument — "curvature on a compact interval attains a maximum and a minimum, so there are two vertices" — gives only two, and the whole content is the step from two to four. The lemma (5) supplies the contradiction: if changed sign only at the maximum and the minimum, a suitable line through those two points would make the integrand of (5) of one sign and not identically zero.
Curves are smooth maps ℝ → EuclideanSpace ℝ (Fin 2), closedness being -periodicity with
, which is do Carmo's condition that the curve and all its derivatives agree at the
endpoints. Unit speed is imposed globally, so the parameter is arc length and is the length.
Simplicity is injectivity on the half-open period . Convexity is stated per parameter: for
each the trace lies in one closed half-plane of the tangent line at , the choice of side
being allowed to depend on , as in the book's phrasing.
The area is defined by do Carmo's integral (1) rather than as the measure of the interior of the curve, so no Jordan curve theorem is presupposed; consequently the isoperimetric statement is formulated with the absolute value , which makes it independent of the curve's orientation and equal to the enclosed area for a positively oriented simple curve. The equality case asserts that the trace lies on a circle of positive radius.
"At least four vertices" is formalized as the existence of four pairwise distinct parameters in at which vanishes, which rules out the degenerate reading in which one vertex is counted several times.
Until 1827 the curvature of a surface in space was understood as a statement about how the surface sits inside : it was computed from the way the unit normal turns, that is, from the second fundamental form. Gauss's Disquisitiones generales circa superficies curvas showed that one particular combination of those extrinsic quantities — the product of the principal curvatures — can be recomputed from measurements made entirely inside the surface, using only lengths of curves drawn on it. This is the Theorema Egregium, and it is the reason the subject splits into extrinsic and intrinsic geometry; the latter is what becomes Riemannian geometry.
The reference for this mission is Manfredo P. do Carmo, Differential Geometry of Curves and Surfaces, 2nd edition (Dover, 2016), §4-3, "The Gauss Theorem and the Equations of Compatibility" (pp. 235–240). The theorem is stated on page 237 and derived from the Gauss formula, equation (5) of that section; the Mainardi–Codazzi equations (6) and (6a) on page 238 complete the list of compatibility equations.
This is the second mission of a series formalizing do Carmo's book; it shares the namespace
DoCarmoDG with the first, on the local theory of curves.
A regular parametrized patch is a map , defined and smooth on an open set with coordinates , whose partial derivatives satisfy at every point of ; the last condition says that is injective, so spans a -dimensional tangent plane at each point and
is a unit normal field along the patch.
The first fundamental form is the restriction of the ambient inner product to the tangent plane; in the parametrization it is recorded by the three functions
and . The second fundamental form is recorded by
and the Gaussian curvature is
The three second derivatives decompose in the basis ; the tangential coefficients are the Christoffel symbols of the patch, and the normal coefficients are , , , which is do Carmo's system (1) of §4-3:
Two patches over the same parameter domain are isometric when their first fundamental forms coincide, , , at every point: lengths of curves, angles and areas computed in the parameter domain then agree, and a local isometry between the two surfaces is obtained by matching parameters.
The Gaussian curvature of a regular patch is determined by its first fundamental form alone, although its definition uses the second fundamental form, i.e. the position of the surface in space.
The existence and uniqueness of the Christoffel symbols; the linear system (2) expressing them through and their first derivatives; the Gauss formula (5),
the Mainardi–Codazzi equations (6) and (6a); the closed formula for in an orthogonal parametrization (Exercise 1, p. 240); the invariance of under a change of parameters; and, as a corollary, that no neighbourhood of a point of the unit sphere is isometric to a piece of a plane (Exercise 4, p. 240).
The theorem is what makes intrinsic geometry possible: a quantity defined through the embedding turns out to be computable from the metric, so it survives every isometric deformation. Concrete consequences include the impossibility of a distortion-free map of the sphere — the reason every cartographic projection distorts lengths — and the equality of the Gaussian curvatures of the catenoid and the helicoid at corresponding points, which do Carmo notes immediately after the theorem. In the structure of the book, the Gauss formula is also the identity that makes the global Gauss–Bonnet theorem of §4-5 a statement about intrinsic data.
Mathlib has inner product spaces, iterated derivatives and the smooth manifold library, but it does not contain the first and second fundamental forms of a parametrized surface, the Christoffel symbols of a patch, the Gaussian curvature in this sense, or the compatibility equations. This mission produces that vocabulary together with machine-checked proofs of the classical identities. The mathematics is Gauss's, from 1827; what is open is the formalization.
The proof is a computation, but not a short one: one differentiates the system (1), uses , re-expands every second derivative through (1) again, and equates coefficients in the basis . Formally, the cost sits in three places: justifying the interchange of the mixed partial derivatives; establishing that the coefficient functions obtained pointwise from linear algebra are differentiable in the parameters; and carrying out the coefficient comparison in a basis that is not orthonormal, where one must use that rather than take inner products with an orthonormal frame.
The naive route to the Theorema Egregium — "solve the system (2) for the , then quote the Gauss formula" — is the right one, but the first step must actually be carried out: the system (2) determines the symbols only because each of its three blocks has determinant , and that is where the regularity hypothesis is used.
A patch is a curried map x : ℝ → ℝ → EuclideanSpace ℝ (Fin 3), so that the partial derivatives
and are ordinary one-variable derivatives, and the domain is an open set
U : Set (ℝ × ℝ); smoothness is ContDiffOn ℝ (⊤ : ℕ∞) of the uncurried map on U, matching
do Carmo's use of "differentiable" for . Regularity is stated as
on U, with the vector product defined componentwise. All quantities
(, , , , , , , ) are total functions of the parameters, taking junk
values off U; every statement restricts to points of U.
Christoffel symbols are not defined by a formula: a statement that mentions them quantifies over
functions assumed to satisfy do Carmo's decomposition (1) on U, and a separate
milestone asserts that such functions exist and are unique on U. The symmetry
is built into the notation, as in the book.
Isometry is formalized as equality of , , over a common parameter domain rather than as a map between surfaces; together with the milestone on invariance under change of parameters, this recovers do Carmo's statement that is invariant under local isometries. The formalization deliberately keeps the surface concrete (a patch, not an abstract manifold), which is what makes the compatibility equations expressible as identities between explicit derivatives.
This mission's definition file builds on the vector-product definition introduced in mission I of this series (Fundamental Theorem of the Local Theory of Curves), so mission I must be submitted first: its definitions have to be published before the definition file of this mission can compile.
There is no vacuous reading: the hypotheses are satisfiable — every regular patch, for instance a graph or a surface of revolution, satisfies them — and the conclusion compares two curvature functions pointwise.
The differential geometry of curves in is the entry point of every course and every textbook in the subject, and it is the first place where a geometric object is shown to be completely determined by a small list of numerical invariants. A space curve traced out by a particle moving at unit speed bends (curvature) and twists (torsion); the assertion that these two scalar functions determine the curve completely, up to a motion of space, is the prototype of every later "fundamental theorem" of the subject — for surfaces (Bonnet), for Riemannian metrics, and for submanifolds in general.
The reference for this mission is Manfredo P. do Carmo, Differential Geometry of Curves and Surfaces, 2nd edition (Dover, 2016), Chapter 1, Sections 1-4 and 1-5. The statement targeted here is the one printed on page 19 under the heading Fundamental Theorem of the Local Theory of Curves; the uniqueness half is proved on pages 20–22, and the existence half is deferred by do Carmo to the appendix of Chapter 4, where it is obtained from the existence and uniqueness theorem for linear systems of ordinary differential equations.
This is the first mission of a series formalizing do Carmo's book. The series shares one Lean
namespace, DoCarmoDG, so that later missions on regular surfaces, the Gauss map, and
Gauss–Bonnet build on the vocabulary fixed here.
Let be an open interval and let be a smooth map. The curve is parametrized by arc length if for every ; the parameter is then the arc length measured along the curve.
For such a curve one sets
The vector is the unit tangent and the scalar is the curvature at . Differentiating gives , so is orthogonal to . At a point where one defines the normal vector and the binormal vector
where is the vector product of (do Carmo §1-4). The triple is a positively oriented orthonormal basis, the Frenet trihedron. Since has constant length and is orthogonal to , the derivative is a multiple of , and the torsion is defined by
This is do Carmo's sign convention; many authors write for the same quantity, and the mission is committed to do Carmo's. With these conventions the Frenet formulas read
A rigid motion of is a map where is an orthogonal linear map with positive determinant and (do Carmo §1-5, Exercise 6).
Given smooth functions with :
The two halves are also stated separately as milestones, since they are proved by entirely different means: uniqueness by a Gronwall-free energy argument on the Frenet trihedron, existence by solving a linear ODE system.
The orthonormality of the Frenet trihedron, the Frenet formulas themselves, the characterization of straight lines by and of plane curves by , the closed formula , and the invariance of arc length, curvature and torsion under rigid motions.
The theorem is the model case of a classification result: a geometric object modulo a symmetry group is faithfully encoded by a complete set of local invariants. Downstream it is what licenses the standard practice of "prescribing curvature and torsion" — constructing curves with specified geometric behaviour, computing with the Frenet apparatus rather than with the curve itself, and recognizing that any identity among , and their derivatives is a genuine statement about the curve and not about its parametrization. In do Carmo's own development the local canonical form (§1-6) and the global results of §1-7 both rest on the Frenet apparatus fixed here.
Mathlib contains the analytic ingredients — the Picard–Lindelöf theorem, existence and uniqueness for linear ODE systems, orthonormal bases and the orthogonal group of a real inner product space — but it does not contain the Frenet trihedron of a space curve, the torsion of a space curve, or this theorem. What this mission produces is therefore a reusable formal vocabulary for the local theory of space curves, plus machine-checked proofs of the classical statements about it. The mathematics is completely classical and has been known since Frenet (1847) and Serret (1851); what is open here is the formalization, not the mathematics.
The uniqueness half is a short argument on paper — the function has vanishing derivative by the Frenet formulas — but formally it requires first establishing that the Frenet frame is differentiable and satisfies those formulas, which needs and the smoothness of away from its zeros, and then a connectedness argument on the interval.
The existence half cannot be done by exhibiting a formula: the curve is produced by solving the linear system for the frame , checking that the solution stays orthogonal (this is where the skew-symmetry of enters), and then integrating the first row. Recovering that the resulting curve has exactly the prescribed curvature and torsion, as computed by the definitions rather than as postulated by the ODE, is the step where most of the formal work sits.
The obvious shortcut — defining torsion by the closed formula — is not taken here: the definition is the book's, , and the closed formula is a milestone to be proved.
Curves are total functions ℝ → EuclideanSpace ℝ (Fin 3) that are assumed smooth only on the
open interval Set.Ioo a b; smoothness is ContDiffOn ℝ (⊤ : ℕ∞), matching do Carmo's use of
"differentiable" to mean . Because the interval is open, the ordinary deriv agrees
with the derivative along the interval at every interior point, and all derivatives in the
statements are plain iterated deriv. Curvature, normal, binormal and torsion are defined
exactly as above; at points where the normal vector takes the junk value , so every
statement that mentions , or carries the hypothesis explicitly.
The vector product is defined componentwise on EuclideanSpace ℝ (Fin 3), and a rigid motion is
a LinearIsometryEquiv of EuclideanSpace ℝ (Fin 3) with positive determinant followed by a
translation.
Degenerate intervals are not excluded: if the interval is empty and the statements hold vacuously, which is why the goal is not formulated as a statement about a single point but as a statement about all of — no hypothesis is vacuous for , and the existence clause is a genuine construction.
Contributions welcome: the Frenet apparatus and the ODE construction are the reusable parts, and both are prerequisites for the later missions of this series.
The spectral gap of a quantum many-body Hamiltonian is the difference between the energy of its ground state and the energy of its first excited state, in the limit of infinitely many particles. Whether a given microscopic interaction produces a gapped or a gapless system decides much of the macroscopic physics: gapped systems have exponentially decaying correlations and well-defined quantum phases, gapless systems sit at critical points and can display algebraically decaying correlations. Several long-standing questions — the Haldane conjecture for antiferromagnetic spin chains, the existence of gapped topological spin liquids, and the Yang–Mills mass gap — are instances of the question "given the interaction, is the system gapped?".
Cubitt, Pérez-García and Wolf proved that this question, posed for families of two-dimensional translationally invariant nearest-neighbour spin models, admits no algorithmic answer: the spectral gap problem is undecidable (Nature 528, 207–211 (2015); full version: Forum of Mathematics, Pi 10:e14 (2022), also arXiv:1502.04573).
Timeline of the ingredients the proof rests on: Turing's undecidability of the halting problem (1936); Berger's undecidability of the domino problem (1966) and Robinson's aperiodic tile set (Inventiones 12, 177–209 (1971)); Feynman's and Kitaev's circuit-to-Hamiltonian constructions, which turn a computation into a ground state; Gottesman and Irani's translationally invariant one-dimensional Hamiltonians encoding computation (FOCS 2009); and Bitansky–Vadhan-style quantum Turing machine engineering from Bernstein and Vazirani (SIAM J. Comput. 26, 1411–1473 (1997)). The 2015 result was later sharpened to one-dimensional chains by Bausch, Cubitt, Lucia and Pérez-García (PRX 10, 031038 (2020)).
Fix a local dimension and, for each side length , the square lattice with open boundary conditions. Each site carries a copy of , so the state space of the lattice has the standard product basis indexed by assignments of a level in to each site. A model is specified by three Hermitian matrices: an on-site term of size , and two interactions of size acting on horizontally and vertically adjacent pairs. The Hamiltonian of the finite lattice is
the same three matrices being used at every edge and every site, which is what translational invariance means here. The quantity is the local interaction strength.
Write for the eigenvalues and for the finite-size gap. The family is
These two conditions are not negations of each other; the construction guarantees that every instance falls into one of them. The ground state energy density is .
For a fixed universal machine and every , one explicit family of interactions, built from fixed integer-valued matrices , a diagonal projector , a rational that may be taken arbitrarily small, and an algebraic ,
with the rational whose binary expansion after the point is the binary expansion of reversed, satisfies: the local interaction strength is at most ; if the machine halts on input the family is gapped with gap at least ; and if it does not halt the family is gapless. Since halting is undecidable, no algorithm decides gappedness, even with the promise that exactly one of the two alternatives holds and even at fixed local dimension .
The milestone list follows the numbering of the full version: Lemma 8 and Theorem 9 (reduction of halting to ground state energy and to arbitrary low-energy properties), Corollary 7 (the same undecidability for unconstrained local dimension, with rational interactions), Proposition 53 and Corollary 54 (the diverging ground state energy and its promise version), and Theorem 5 (undecidability of the ground state energy density).
The result rules out a general algorithm — and therefore any complete general method — for deciding gappedness from the interaction matrices, however much computing power is available; the property genuinely depends on arbitrarily large system sizes. It also implies, via the standard link between undecidability and independence, that there are concrete finite-dimensional models whose gap is independent of the axioms of any consistent recursively axiomatized formal system (Corollary 4 of the source), and it transfers to other low-energy properties such as the existence of algebraically decaying ground-state correlations.
The theorem is proved; none of it is formalized. This mission produces the machine-checked version. The reusable infrastructure it forces into existence is substantial on its own: a formal model of translationally invariant lattice Hamiltonians and their thermodynamic-limit spectral behaviour, the tiling layer, and computational-history-state Hamiltonians. Each milestone is a self-contained statement that can be attacked without the others.
The obvious approach — encode a halting computation as an energy penalty — gives the ground state energy of a finite lattice, not a property of the limit; this is exactly what Lemma 8 achieves, and it is not enough, because a gap is a statement about the sequence of spectra as and is insensitive to any single lattice size. The construction must make the halting information visible at all sufficiently large sizes at once while a fixed finite local dimension carries every instance . That forces three separate difficulties: an aperiodic (Robinson) tiling to create squares of every size inside one translationally invariant model; a quantum phase-estimation Turing machine whose transition amplitudes encode in a single phase , so that the instance index does not inflate the local dimension; and a history-state Hamiltonian whose low-energy spectrum can be controlled well enough that a positive energy density in the halting case turns into a genuine spectral gap, and a vanishing one into a dense spectrum above the ground state.
The development commits to the following conventions, all of which are visible in the definition items of this mission.
Degenerate readings are excluded: a zero local dimension satisfies none of the statements, since a non-degenerate ground state requires a one-dimensional eigenspace and the gapless condition requires a non-empty spectrum; and every existential statement fixes the matrices before quantifying over all instances and all lattice sizes .
Contributions are welcome at any milestone, and also on the infrastructure the milestones need — Wang tilings and the Robinson tile set, Gottesman–Irani history-state Hamiltonians, and quantum Turing machines in the Bernstein–Vazirani sense — which are needed for Theorem 6 and Lemma 47 of the source and are not yet part of this mission's item list.
Quantizing a Yang–Mills theory by the Faddeev–Popov procedure requires a gauge condition that picks one representative from each gauge orbit. In the Landau gauge the condition is . Gribov showed in 1978 that this condition is not ideal: a gauge orbit can meet the surface more than once, so gauge-equivalent configurations — Gribov copies — are still being integrated over (V. N. Gribov, Quantization of non-Abelian gauge theories, Nucl. Phys. B139 (1978) 1). Infinitesimally, a copy of a transverse field corresponds to a zero mode of the Faddeev–Popov operator , which is Hermitian on transverse configurations.
Gribov's proposed remedy is to restrict the functional integral to the Gribov region , the set of transverse configurations at which is positive definite. The interest of is not only that it removes infinitesimal copies: the fact that it is a bounded region of field space is the geometric input of Gribov's confinement scenario, because restricting the integration to a bounded region deforms the gluon propagator in the infrared and produces a mass scale. Whether the restriction to is the physically correct prescription is still debated; the geometric properties of themselves are not — they are consequences of the algebraic structure of , and they are what this mission formalizes.
Timeline of the properties at issue, as recorded in §2.2.1 (pp. 188–189) of the review by N. Vandersickel and D. Zwanziger, The Gribov problem and QCD dynamics, Phys. Rep. 520 (2012) 175–251 (doi:10.1016/j.physrep.2012.07.003):
Fix a real vector space of gauge-field configurations (in the physical situation, the transverse fields ) and a finite index set on which the Faddeev–Popov operator acts (colour index times a finite basis of fluctuation modes ). The formalization works with the algebraic structure that the Faddeev–Popov operator has, and nothing else:
where
The Gribov region is
This is Eq. (2.52) of the review, with positivity as in Eq. (2.54). The boundary is the first Gribov horizon, where the lowest non-trivial eigenvalue of vanishes.
The last two clauses are stated under the assumption that is injective, i.e. that distinct configurations give distinct field-dependent parts; without it contains the whole kernel of as a linear subspace and no boundedness statement can hold.
These are Eq. (2.53) and Eq. (2.58) of the review; they are the two ingredients from which convexity and directional boundedness follow.
What the result gives: is the region to which Gribov's improved gauge fixing restricts the functional integral, and every subsequent construction in this line of work — the no-pole condition, the horizon function and the local Gribov–Zwanziger action — presupposes that the restriction is to a bounded convex region containing the perturbative point . Convexity is what makes the horizon condition a single well-posed constraint; boundedness in every direction is the property from which the infrared suppression of the gluon propagator, and hence Gribov's mass scale, is read off. Without boundedness there is no geometric mechanism for a mass gap in this scenario.
Status honesty: these statements are proved mathematics, not open problems; the arguments in §2.2.1 of the review are short. What is missing is a machine-checked account. No formalization of the Gribov region in Lean is known to the drafter of this proposal; the platform's existing Gribov material concerns Singer's topological obstruction to continuous gauge fixing, which is a different theorem about a different object.
The statements are elementary once the correct hypotheses are isolated, and the mission is calibrated accordingly: it is a faithfulness exercise rather than a depth exercise. The two places where a naive attempt fails are worth naming. First, directional boundedness does not follow from positivity alone: it needs the tracelessness of , which is what forces a direction with ; a positive semidefinite perturbation would give a region unbounded along that ray. Second, "bounded in every direction" does not imply "bounded" for a general set, and the implication used here rests on convexity together with injectivity of — the argument goes through a limit of rescaled configurations and a closure of the positivity condition, not through a uniform bound extracted directly from the ray statement.
The mission commits to a finite-dimensional linear-algebra model of the Faddeev–Popov operator, packaged as a structure carrying: the matrix together with a proof that it is positive definite; the linear map together with proofs that each is symmetric and traceless. Configurations live in an arbitrary real vector space , which carries a norm and finite-dimensionality only in the two statements where boundedness is asserted. Positive definiteness is Mathlib's notion for real matrices, which includes symmetry; the region is the set of configurations where it holds strictly, so is the open region and the horizon is not part of it.
This is a model, not the field-theoretic object: it replaces the operator acting on transverse fields by its finite-dimensional algebraic shadow, and the reviewer should audit it as such. The properties targeted here are exactly those whose proofs in §2.2.1 use only linearity in , symmetry, tracelessness, and positivity of ; results that genuinely need the infinite-dimensional setting — that every gauge orbit passes inside , and that still contains copies on its boundary — are deliberately out of scope, since they cannot be stated in this model.
The model is not vacuous: an instance exists already for , , and , with injective, so none of the statements is satisfied vacuously. Nor is any target trivially true: is a proper nonempty subset of in that instance.
Infrastructure needed: Mathlib's positive-definiteness API for matrices, the spectral theorem for real symmetric matrices (for the traceless lemma), and basic convexity and boundedness in finite-dimensional normed spaces. The traceless lemma — a nonzero symmetric traceless matrix has a direction of negative quadratic form — is reusable well beyond this mission. Contributions extending the model towards the infinite-dimensional setting, or supplying the explicit ellipsoidal bound of Dell'Antonio–Zwanziger in place of plain boundedness, are welcome.
The Riemann hypothesis asserts that all nontrivial zeros of the Riemann zeta function lie on the critical line. A classical way to measure how far the hypothesis is from failing runs through a one-parameter deformation of the Riemann function by the backward heat flow. De Bruijn (1950) introduced a family of entire functions , , with essentially the function, and showed that has only real zeros for . Newman (1976) proved that there is a finite constant , now called the de Bruijn–Newman constant, such that has only real zeros precisely when . The Riemann hypothesis is exactly the statement , and Newman conjectured the complementary bound — in his phrase, that if the Riemann hypothesis is true, then it is only barely so.
Timeline of lower bounds on , all obtained before 2018 by exhibiting Lehmer pairs, that is, pairs of adjacent zeros of that are unusually close together: (Newman 1976), (Csordas–Norfolk–Varga 1988), (te Riele 1991), (Norfolk–Ruttan–Varga 1992), (Csordas–Ruttan–Varga 1991), (Csordas–Smith–Varga 1994), (Csordas–Odlyzko–Smith–Varga 1993), (Odlyzko 2000), (Saouter–Gourdon–Demichel 2011). Rodgers and Tao closed the gap in 2020 by proving . In the other direction, de Bruijn's bound was sharpened to by Ki–Kim–Lee (2009) and to by the Polymath 15 project (2019).
For a real number put
a function that decays super-exponentially as and satisfies . For each define the entire function
Each is even and satisfies ; the function is , so the Riemann hypothesis says exactly that every zero of is real. Write
By Pólya and Newman, is the ray with .
When the zeros of are real, simple, symmetric about the origin and avoid the origin, so they can be listed as , indexed by the nonzero integers, with and . The classical locations are defined for by with
extended by ; they are the positions the zeros would occupy if the Riemann–von Mangoldt counting formula were exact. Throughout, .
The goal is stated in both forms simultaneously, so that it does not depend on any convention for the infimum of a set that might be empty or unbounded below.
The milestone list follows the architecture of Rodgers–Tao, which is a proof by contradiction: every milestone is stated under the standing hypothesis of that paper, in the time ranges the paper uses (, then , then ). In order: an upper bound for near the real axis (Lemma 4); Riemann–von Mangoldt type counting formulae for the zeros of (Theorem 9); the resulting macroscopic description of the zeros (Corollary 10); the equations of motion (Theorem 11); a quantitative lower bound on gaps between zeros (Proposition 13); a bound on the time-integrated renormalized energy (Theorem 17); and a bound on that energy at time (Proposition 26). The last of these says that at time zero the zeros are, on average, locally in the equilibrium configuration of an arithmetic progression, which contradicts known results on the local distribution of zeros of .
settles Newman's conjecture, and together with the Riemann hypothesis it would force . Unconditionally, it says that the zeros of are not in local equilibrium: infinitely often, gaps between consecutive zeros deviate from the mean spacing, which is what makes the pair correlation phenomenology of Montgomery and of Conrey–Ghosh–Goldston–Gonek–Heath-Brown incompatible with . Any proof of the Riemann hypothesis must therefore be compatible with the hypothesis being tight in this sense.
The theorem has a complete published proof (Rodgers–Tao, Forum of Mathematics, Pi, 2020); it is not an open problem. What is missing is a machine-checked proof. To the extent the material has been formalized at all, the underlying objects — the function, the heat flow , the counting function for zeros, the zero dynamics, the renormalized energies — are not available in Mathlib, so the mission produces reusable analytic infrastructure: bounds for a Fourier–Laplace type integral by the saddle point method, a Riemann–von Mangoldt counting argument via the argument principle, and a gradient-flow monotonicity framework for an infinite particle system with logarithmic interaction.
The obvious route to is the one used for every previous lower bound: exhibit Lehmer pairs of ever higher quality, since if were very negative the zeros of would repel each other and unusually close pairs of zeta zeros could not exist. Producing an infinite sequence of Lehmer pairs of arbitrarily high quality is possible under the GUE hypothesis, but the known unconditional upper bounds for small gaps between zeta zeros are too weak, even assuming the Riemann hypothesis. The proof instead upgrades repulsion to relaxation to local equilibrium: it must control the zeros of uniformly for at length scales as fine as , with only the weaker counting formulae available for negative (an error term rather than ), and must make sense of a Hamiltonian and an energy that are given by divergent series, which requires truncation, renormalization, and careful control of all the resulting boundary terms.
The Lean development commits to the following conventions. is a tsum over the positive integers and is the Bochner integral over of ; no convergence or entireness statement is built into the definition. is sInf of the set of admissible times, and the goal theorem also states the quantifier form "every admissible is nonnegative", so it cannot be satisfied by a junk value of the infimum. The zero families and the classical locations are not defined by choice functions: they enter the milestones as universally quantified functions subject to explicit predicates saying exactly which sequences they are, so a milestone asserts something about every valid enumeration. Asymptotic notation is unfolded: becomes an explicit existential constant, an explicit – statement, and a principal value sum a limit of symmetric partial sums. Where a statement asserts the value of a time integral, absolute integrability is part of the conclusion, so the statement cannot be satisfied by the convention that a non-integrable function has integral zero.
One degeneracy is inherent to the source and is stated here explicitly: since the paper argues by contradiction, each milestone carries the hypothesis (directly, or through a time range such as ). Once the goal theorem is proved, those hypotheses are unsatisfiable and the milestones become vacuously true. They are the intended attack path on the goal, not independent targets, and a solver who derives one of them from the goal theorem contributes nothing.
Contributions welcome: the analytic estimates for (Lemma 4) and the counting formulae (Theorem 9) are independent of the dynamical part and are the natural entry points; Mathlib-level infrastructure on the argument principle, the saddle point method, and Stirling asymptotics for in vertical strips is reusable well beyond this mission.
When money is off the table and the Gibbard–Satterthwaite theorem (Mission III of this series) blocks general strategyproof choice, restricted preference domains reopen the door. The two great examples both come from allocation: Shapley–Scarf's housing market (1974), where Gale's Top Trading Cycle algorithm finds the unique core allocation and Roth (1982) showed the mechanism is strategy-proof; and the Gale–Shapley marriage market (1962), where deferred acceptance produces a stable matching, the men-optimal one, which Dubins–Freedman (1981) and Roth (1982) showed cannot be manipulated by any man. This machinery runs the US medical residency match and school choice systems worldwide, and the 2012 Nobel memorial prize to Roth and Shapley cites exactly the results of this mission. Chapter 10 (Schummer–Vohra, "Mechanism Design without Money") of Nisan–Roughgarden–Tardos–Vazirani (eds.), Algorithmic Game Theory (Cambridge, 2007) is the source text; its single-peaked §10.2 is left to a possible later mission, since it needs its own preference-domain machinery.
Marriage market (§10.4): finite sets of men and of women, each agent holding a strict preference ordering over the opposite side (the preference-profile vocabulary of Mission III; reads " strictly prefers to "). Following the book's dummy-partner convention, and a matching is a bijection . A pair blocks if each prefers the other to their assigned partner; is stable if no pair blocks it. A stable is male-optimal if every man weakly prefers it to every stable alternative. A coalition dominates if it can rematch within itself with every member strictly better off; the core is the set of undominated matchings.
Housing market (§10.3): a finite set of agents, agent owning house , each with a strict preference over all houses; an allocation is a permutation of . A coalition blocks an allocation if it can redistribute the houses its members own so that all are weakly and someone strictly better off.
Any mechanism selecting the male-optimal stable matching is strategy-proof for the men: no man can misreport his ordering and obtain a wife he truly prefers.
Every marriage market has a stable matching.
Some stable matching is weakly best for every man simultaneously. This man-by-man form is Gale–Shapley's optimal assignment (1962, Theorem 2); the book's Theorem 10.11 phrases male-optimality as the absence of a stable alternative making every man weakly and some man strictly better off, which is equivalent for finite strict markets — the equivalence being a (short) theorem, the attribution follows Gale–Shapley.
A matching is stable iff it is in the core of the matching game.
The core of the housing market is a single allocation, and the mechanism selecting it is strategy-proof.
These are the foundational theorems of market design — the branch of mechanism design with the strongest record of deployed systems — and none of them exists in Lean. The mission also settles a methodological point for the series: algorithm-defined objects (deferred acceptance, top trading cycles) enter through the properties that characterize their outputs — male-optimality, core membership — so the theorems are statements about all mechanisms with the given property, and any construction of the algorithm proves the existence milestones. The matching vocabulary (bijections as matchings, blocking, stability, domination) is reusable for the college-admissions and roommates variants beyond this mission.
Existence (10.10) is the real formalization work: whether by formalizing deferred acceptance and its termination or by another route (e.g. Adachi's fixed-point formulation, which the book sketches as Theorem 10.14 via Tarski), the solver must build the proposal machinery. Male-optimality (10.11) rides on the same construction with the "no man is ever rejected by an achievable wife" invariant. The core equivalence (10.12) is deliberately light — a transposition embeds a blocking pair as a two-agent coalition. Housing uniqueness (10.6) needs the cycle-peeling induction of TTC. The two strategyproofness results are the subtle ones: both known proof routes (Dubins–Freedman's combinatorial argument, or Roth's via the blocking lemma) require careful bookkeeping of which coalitions can improve under a misreport, and the mechanism is pinned only by its defining property, so proofs must use optimality/core facts rather than algorithm internals.
Preferences are strict total orders as in Mission III (IsPrefProfile), oriented "first argument preferred". Matchings are Equivs; the book's convention enters the existence statements as the hypothesis Nonempty (M ≃ W) and nothing else about cardinalities is assumed. Domination and house-blocking quantify a rematching Equiv together with the improving coalition, coalitions being sets closed under the rematching — single-agent and pair coalitions are special cases, so no separate pair-blocking clause is needed in the core theorems. Mechanisms in the strategyproofness results are arbitrary functions constrained only by their defining property (male-optimal selection; core selection), quantified before the misreport — nothing may be chosen with hindsight. Both sides keep finiteness only where used: the core equivalence (10.12) holds for arbitrary types and carries no Fintype.
Mission III of this series ends at an impossibility: without money, incentive compatibility over three or more alternatives means dictatorship. This mission formalizes the classical escape route — quasilinear utilities and payments — and the exact price of it. Vickrey (1961) discovered that a second-price auction makes truth-telling dominant; Clarke (1971) and Groves (1973) generalized the idea to arbitrary social choice: welfare-maximizing rules can always be made truthful by the right payments. The converse program — which choice rules are implementable at all — runs through Rochet (1987) and Myerson (1981) to Saks–Yu (2005): weak monotonicity characterizes implementability on convex domains, and on single-parameter domains the characterization is complete and elementary — monotone rules with critical-value payments. Chapter 9, §§9.3 and 9.5 of Nisan–Roughgarden–Tardos–Vazirani (eds.), Algorithmic Game Theory (Cambridge, 2007), written by Nisan, is the source text.
A set of alternatives and a finite set of players. Player holds a private valuation from a publicly known domain ; utilities are quasilinear: choosing and charging gives utility . A (direct revelation) mechanism is a social choice function from valuation profiles to together with payment functions (Definition 9.14). The mechanism is incentive compatible if no unilateral misreport from the domain ever beats the truth (Definition 9.15).
A VCG mechanism (Definition 9.16) has maximizing social welfare and payments of the Groves form ; the Clarke pivot rule takes . A rule is weakly monotone (Definition 9.28) if a unilateral change of valuation that moves the outcome from to satisfies . A single-parameter domain (Definition 9.33) is given by a win set per player and bids : the valuation is on and elsewhere.
A normalized mechanism (losers pay 0) on a single-parameter domain is incentive compatible iff the rule is monotone and every winning bid pays the critical value — the threshold below which the bid loses.
Every VCG mechanism is incentive compatible.
With Clarke pivot payments, a welfare-maximizing rule makes no positive transfers, and is individually rational when valuations are nonnegative.
Necessity: incentive compatibility forces WMON, on any domain. Sufficiency: on convex domains, WMON rules admit implementing payments (Saks–Yu).
These are the working theorems of every later mechanism-design mission: the approximation mechanisms of Chapter 12, the profit-maximization results of Chapter 13, and the sponsored-search analysis of Chapter 28 all argue through Theorem 9.36's monotonicity-plus-critical-value normal form, and VCG is the benchmark they approximate. Formalizing the cluster produces the platform's quasilinear-mechanism vocabulary — domains, truthfulness, Groves payments, weak monotonicity, single-parameter settings — on top of the social-choice layer of Mission III.
The capstone and Theorem 9.17 are textbook results with complete proofs in the source; the Saks–Yu half of Theorem 9.29 is stated but not proved in the book ("quite involved"), so that milestone carries a genuinely hard formalization with a published paper proof. None have prior Lean formalizations.
Theorem 9.17 is a three-line inequality chase once the Groves form is unfolded — a deliberate warm-up. Lemma 9.20 adds the attained maximum over a finite alternative set. The necessity half of 9.29 is a two-application argument; the sufficiency half is the hard point of the mission: the known proofs walk two-cycle inequalities into a path-integral construction of payments on a convex domain, and nothing of the kind exists in Mathlib. For the capstone, the delicate part is the critical value: the book defines it as a supremum that "is undefined" when the player always wins, and the honest formal rendering — a constant payment c that is a least upper bound of the losing bids whenever losing bids exist — makes the case split explicit; the equivalence proof must thread monotonicity, the threshold structure of the winning set, and normalization through both directions.
Valuations are functions A → ℝ; domains are sets V i : Set (A → ℝ); mechanisms are total functions with every property quantified only over profiles from the domain, so behavior on invalid inputs carries no content. The Groves term hᵢ is a function of the full profile constrained to be invariant under changes of coordinate i — the standard rendering of "depends only on ". The Clarke payment uses a Finset.sup' over a finite nonempty A, so no junk supremum arises. In the single-parameter setting the valuation induced by a bid is Set.indicator, bids live in Set.Icc t0 t1 with t0 ≤ t1, and the critical value is characterized by IsLUB guarded by nonemptiness of the losing set — the book's "undefined" caveat made precise without a junk sSup. Weak monotonicity's sufficiency half carries Convex ℝ (V i) and finite A (the Saks–Yu setting); the necessity half deliberately carries no hypotheses beyond incentive compatibility itself.
Chapter 6 of Walter Rudin's Principles of Mathematical Analysis (3rd edition, McGraw-Hill, 1976) constructs the Riemann–Stieltjes integral : the Riemann integral with the increments of the variable replaced by the increments of a monotonically increasing integrator . Taking recovers the ordinary Riemann integral; taking a step function turns integrals into sums, so series and integrals become special cases of one construction. This is the reason Rudin develops the theory in this generality: it unifies Chapter 3's series with the integral, and it is the natural setting for the Fourier coefficients of Chapter 8.
The chapter's capstone is the fundamental theorem of calculus (Theorem 6.21): an integrable function which is the derivative of some integrates to .
This mission is the sixth in a series formalizing Rudin Chapters 1–11; it uses the uniform continuity of Mission IV and the mean value theorem of Mission V.
A partition of is a finite set of points , with increments for a monotonically increasing . For a bounded real put , , and
The upper and lower integrals are and ; is integrable with respect to , written , when they agree, and the common value is . refines when every division point of is one of . Writing for with gives the Riemann integral .
The fundamental theorem is what makes the integral computable: it reduces integration to antidifferentiation and so links Chapters 5 and 6. Theorem 6.20 is its companion — it says the integral of a continuous function is an antiderivative — and together they show the two operations are mutually inverse to the extent that the hypotheses allow. Theorem 6.17 explains when a Stieltjes integral collapses to a Riemann integral with the density , and it is the computational tool for integrators that are differentiable; the step-function case at the other extreme (Rudin's 6.15–6.16) is what turns sums into integrals.
Mathlib has no Riemann–Stieltjes integral: it has the Bochner integral, the interval integral, and a Lebesgue–Stieltjes measure, but the upper-and-lower-sum construction of Chapter 6 is absent. This mission therefore builds the object from Rudin's definitions and develops its basic theory; that development is reusable beyond this mission — Chapter 7's interchange theorem (7.16) and Chapter 8's Fourier coefficients are stated with respect to it.
Two obstacles are specific to formalizing this chapter. First, the upper and lower integrals are an infimum and a supremum over the set of all partitions, which is not a lattice-friendly index; every comparison between partitions goes through the common refinement, and Theorem 6.4 is the workhorse that makes such comparisons possible. Second, the fundamental theorem is proved by choosing a partition on which and applying the mean value theorem on each subinterval, so the proof requires selecting an intermediate point per subinterval — a finite choice that is easy on paper and must be organized explicitly in Lean.
The integrator is only assumed monotone, so it may be discontinuous, and the theory must not assume otherwise: Theorem 6.9 needs continuity of precisely because it is not available in general.
Conventions fixed by this mission:
[a, b] is Rudin.Partition a b: the number n of subintervals together with
a monotone placement function x with x 0 = a and x n = b. Rudin allows
, and so does this structure.Rudin.upperSum, Rudin.lowerSum, Rudin.upperIntegral, Rudin.lowerIntegral,
Rudin.RSIntegrable, Rudin.RSIntegral follow Definitions 6.1–6.2 literally, with sSup and
sInf over the images .sSup/sInf on ℝ return 0 on unbounded sets, every statement carries Rudin's
boundedness hypothesis for explicitly; likewise monotonicity of is assumed as
MonotoneOn α (Set.Icc a b) rather than built into a type.Rudin.RiemannIntegrable and Rudin.RiemannIntegral are the case , in
which the goal theorem and Theorems 6.20–6.22 are stated, matching Rudin.HasDerivAt, so F' = f is stated pointwise on [a, b] with the value f x
supplied, as in Rudin's hypothesis.The goal is not vacuous, and not a restatement of a library lemma: the integral in it is the one defined in this mission, so a solution must connect the upper/lower sum construction to differentiation rather than quoting Mathlib's interval integral.
Infinite-horizon dynamic programming is the mathematical core of Markov decision processes and reinforcement learning: Bellman equations, value iteration, policy iteration, and their guarantees. Chapter 7 of Bertsekas, Dynamic Programming and Optimal Control, Vol. I (3rd ed., 2005) develops the finite-state theory in its cleanest generality — stochastic shortest path (SSP) problems first (Prop. 7.2.1–7.2.2), with discounted problems (Prop. 7.3.1) and average-cost problems (Prop. 7.4.1–7.4.2) derived from the SSP analysis. These propositions are cited throughout the MDP/RL literature as the base case of the theory; none of them exists in Mathlib.
States plus an implicit cost-free absorbing termination state ; finite nonempty control sets ; costs ; sub-stochastic transitions , , the deficit being the termination probability (BertsekasSSPModel). Operators
(BertsekasSSPPolicyOp, BertsekasSSPBellmanOp), -stage costs by backward recursion with policy shift (BertsekasSSPNCost), and the survival mass (BertsekasSSPSurvival). Assumption 7.2.1: for some , every admissible policy has survival mass from every state after stages. The discounted setting reuses the same model with stochastic rows and (BertsekasDiscounted*); the average-cost setting adds a designated state with the avoidance probability of Assumption 7.4.1 (BertsekasSSPAvoidProb).
Under Assumption 7.2.1, there is a vector with
and a stationary policy attaining — BertsekasDP.ssp_main_theorem (goal, Prop. 7.2.1(a),(b)). Milestones: 7.2.1(c) policy evaluation, 7.2.1(d) optimality iff greediness, 7.2.2 policy iteration, 7.3.1 the full discounted counterpart, 7.4.1 the average-cost Bellman equation, 7.4.2 average-cost policy iteration.
These are the convergence guarantees behind value iteration and policy iteration — the two algorithms at the root of dynamic programming practice and of RL analyses (Q-learning's target operator is exactly ). The SSP form is the strongest of the three: the discounted theory is its special case (termination with probability per stage) and the average-cost theory reduces to it through cycles at the recurrent state. Formalized, the chapter yields a reusable finite-MDP theory: monotone operators, -stage contractions, and the machinery for later Vol. II material. All results are proved in the book; the formalization is new.
is not a one-stage contraction in the sup-norm under Assumption 7.2.1 — only an -stage contraction, uniformly over the finitely many -stage policy prefixes; extracting the uniform contraction factor (via finiteness of the policy space) is the crux of the whole chapter. The limit of -stage costs for nonstationary policies must be established, not assumed (tail-sum estimate ). For the average-cost results the associated-SSP construction (stop on reaching ) must be built inside the proof. The liminf phrasing of average-cost optimality is deliberate: for arbitrary nonstationary policies the Cesàro limit need not exist.
Finite states Fin n, finite control type, constraint sets as Finsets with attained minima; no termination state in the carrier — termination is the sub-stochastic deficit, exactly as the book treats it computationally. Policies are sequences of stage policies (Markov); costs of nonstationary policies via the shift recursion. Convergence is Tendsto in the product topology (equivalently sup-norm, finite). Average cost uses real liminf and division with the term junk-valued at 0 (irrelevant at infinity). The discounted theorem packages parts (a)–(e) in one statement mirroring Prop. 7.3.1.
Invertible modules over a commutative semiring are Zariski-locally free, so local semirings have trivial Picard group. The source asks whether the ring-theoretic semilocal conclusion survives without subtraction: must every invertible module over a semiring with finitely many maximal ideals be free? If not, is the conclusion at least true for finite semirings?
This mission turns CUHK-Shenzhen AI Math Problem 19, Picard groups of semi-local or finite semirings, into an auditable Lean campaign. The objective is not merely to transcribe notation: it is to expose the mathematical model, the capstone, and a smaller attack surface as separate artifacts that other formalizers can inspect and reuse.
The main theorem asserts freeness for every invertible module over a commutative semiring with finite maximal spectrum. A separate milestone states the finite-semiring fallback. Both are positive formulations; a concrete counterexample to either resolves that target negatively and should motivate a corrected classification.
Solving this target would settle the precise finite or analytic core represented by the Lean statement and would create reusable infrastructure in semirings, Picard groups, invertible modules, finite semirings. Even a rigorous disproof is valuable: several entries in this collection deliberately ask whether an attractive extrapolation is true, and Lean forces a counterexample to satisfy every side condition. The mission therefore treats theorem proving and model criticism as equally legitimate research outcomes.
Ring proofs use subtraction-sensitive k-ideal properties and decompositions into local factors that can fail for semirings. Finite indecomposable semirings need not be local and may have positive Krull dimension. Invertible modules are projective with strong duality, but familiar rank and determinant arguments may not survive additive noncancellation.
Formalize the known local-freeness proof from the evaluation isomorphism and study patching over finitely many principal opens. Identify exactly where partitions of unity require k-ideals. For finite semirings, enumerate idempotent matrices representing projective modules, impose the invertibility constraints, and seek either a reduction to principal rank-one modules or a minimal counterexample. Product decompositions and faithful-action lemmas should be reusable.
The Lean targets use Mathlib's commutative semiring, maximal spectrum, module, invertible-module, and free-module notions. 'Semilocal' is encoded only as finiteness of MaximalSpectrum; no unproved decomposition theorem is assumed. The finite fallback assumes the underlying semiring type is finite but does not assume the module itself finite separately. Cardinality-only variants from the source are not the capstone.
The natural-language source remains authoritative for motivation, while the Lean declaration is authoritative for what Prove2Me will verify. The mission description calls out restrictions where the current formal target is a finite-dimensional core, a fixed interpretation of informal terminology, or one sharpened subquestion from a broader classification problem. Those restrictions should not be silently generalized in a proof claim.
Resolve the finite-semiring statement, computationally or structurally, while developing the local-to-semilocal patching lemmas needed by the main theorem.
The capstone is marked as the mission's main item and is never duplicated as a milestone. Definitions precede theorem statements in the proposal order. A milestone is considered complete only when its own exact statement is proved; proving a nearby theorem with stronger-looking prose but mismatched quantifiers, signs, supports, dimensions, or asymptotic constants does not complete it.
The CUHK-Shenzhen AI Math Problems page added this problem on June 24, 2026. At the drafting date, August 31, 2026, the status and target corrections described above were checked against the source page and the cited primary material.
A contribution may prove the displayed theorem or refute it by constructing data satisfying every Lean hypothesis while negating the conclusion. Informal changes of model do not count: any proposed correction must be submitted as a separately reviewed statement with an explanation of which source ambiguity or false implication it repairs. Definitions must remain computational or mathematically constrained; fields that simply assume the desired conclusion are not acceptable. Every proof must compile against the mission's pinned Mathlib revision, use no sorry, and expose a top-level theorem solution when submitted to Prove2Me.
The main theorem is intentionally separated from a smaller milestone. Contributors should preserve that dependency order, publish reusable lemmas rather than monolithic tactics, and report whether a lemma is analytic, algebraic, combinatorial, or infrastructure-only. Numerical evidence, external computer algebra, and exhaustive search are welcome for discovery, but a final certificate must be replayable by Lean. If an external result is invoked, its hypotheses must be represented in the formal statement or proved in the dependency tree.
The files were built locally with Lean 4.30.0 and Mathlib revision c5ea00351c28e24afc9f0f84379aa41082b1188f, the supported Prove2Me environment at drafting time. The mission definition file is ordered before all theorem files, and each theorem imports exactly that public definition module or Mathlib. Independent blind read-backs accompany the draft items so reviewers can compare what the Lean code literally says with this mathematical description. Human confirmation remains required before the public proposal can be submitted for moderation.
Linear approximation is only one instance of distance minimization. Feasible sets in optimization are typically convex rather than subspaces, so a useful certificate must compare a target point with an entire convex set and must allow an affine offset. Chapter 5 of Luenberger's Optimization by Vector Space Methods builds this certificate through geometric forms of the Hahn--Banach theorem, supporting hyperplanes, and separation of convex sets. The resulting minimum-distance theorem expresses the distance from a point to a convex set as an optimal gap measured by a norm-bounded continuous linear functional (Luenberger, §§5.12--5.13, pp. 130--137).
This mission advances the series from subspace annihilators to affine separation. It formalizes the Minkowski gauge used by the chapter, three progressively stronger separation statements, and a capstone distance-duality certificate. These results are standard infrastructure for constrained optimization: they turn a geometric exclusion or distance into a scalar inequality that can later become a multiplier or a dual bound.
Let be a real normed space and a nonempty convex set. Convexity is represented by Convex ℝ K, and topological interior, closure, and infimum distance use Mathlib's interior, closure, and Metric.infDist. A continuous affine separator is described by a continuous linear functional and a scalar level . The inequality for all places in one closed half-space.
When a convex set contains zero in its interior, its Minkowski gauge is the functional gauge K. The source characterizes it by nonnegativity, positive homogeneity, subadditivity, continuity, and the level sets
These properties are bundled into the first milestone, following Lemma 1 of §5.12 (pp. 131--132).
For two convex sets , Eidelheit separation means finding nonzero and with for and . The source assumes that has nonempty interior and that its interior does not meet . The Lean statement records the nonemptiness of explicitly, since otherwise nonzero separation is not forced.
Formalize the six gauge properties above. Then, for a convex with nonempty interior and an affine subspace disjoint from that interior, produce and such that
This is Mazur's geometric Hahn--Banach theorem as stated in §5.12, Theorem 1 (p. 133).
For , formalize a nonzero functional satisfying for all . Next formalize Eidelheit separation:
These are Theorems 2 and 3 of §5.12 (pp. 133--134).
Let have positive distance from . Produce and a real upper-bound level with , on , and
Every other feasible pair must satisfy . If realizes the distance, require to align with . This is the finite real certificate form of §5.13, Theorem 1 (pp. 136--137).
The capstone is an exact strong-duality statement for distance to a convex set. A feasible pair yields a certified lower bound on the distance, and the distinguished pair reaches the primal value. Unlike a nearest-point characterization, it remains meaningful when is not closed and no minimizing point exists. The conditional alignment clause identifies the equality case when attainment is available.
Formalizing the chapter's progression creates more than one isolated equality. The gauge package links convex geometry to sublinear analysis; Mazur separation handles affine constraints; the supporting-hyperplane and Eidelheit statements provide reusable interfaces for later multiplier rules. The results are known and proved in the 1969 text; the mission's contribution is a coherent machine-checked Lean layer that preserves the source hypotheses and can support later chapters on duality and optimization.
A direct reuse of subspace distance duality is insufficient because a general convex set is neither closed under subtraction nor described by an annihilator. An affine level is unavoidable. The common shorthand introduces a second problem: need not be bounded, so a real-valued supremum is not available for an arbitrary functional. The capstone therefore quantifies over a real upper bound and asserts its optimality through a universal inequality; this records the same finite support value without imposing boundedness absent from the source.
Topological hypotheses also differ across the milestones. Separation uses nonempty interior, whereas the final distance theorem only assumes convexity, nonemptiness, and positive distance. Replacing positive distance by mere exclusion would be invalid for a nonclosed set. Similarly, requiring closure or compactness would make formalization easier but would lose the theorem's intended infinite-dimensional scope.
The mission is restricted to real normed spaces. Sets use Set X; affine varieties use AffineSubspace ℝ X; separators use ContinuousLinearMap. The gauge is Mathlib's existing gauge, so no competing definition is introduced. The bundled gauge milestone deliberately includes both level-set identities as well as continuity, positive homogeneity for positive real scalars, subadditivity, and nonnegativity.
The Eidelheit theorem includes K₂.Nonempty, an assumption used implicitly by the source's separating conclusion. The capstone includes K.Nonempty and 0 < Metric.infDist x₁ K; it does not assume closedness, boundedness, compactness, or attainment. Its pair represents a finite support level, and the universal comparison over all feasible rules out a weakened statement in which an arbitrarily loose upper bound could trivialize existence. The optional nearest-point clause uses the exact equality and fixes the sign of alignment. Contributions may add reusable lemmas on gauges, interiors, affine subspaces, or support bounds, but the public results should remain independent of finite-dimensionality and completeness.
Many convex programs impose inequalities valued in a vector space: componentwise inequalities, positive-semidefinite constraints, and families of ordered resource constraints are all instances of one cone order. Chapter 8 of David G. Luenberger's Optimization by Vector Space Methods develops a global theory for this setting. A perturbation of the constraint produces a convex value function, continuous linear functionals positive on the ordering cone become Lagrange multipliers, and a strict-feasibility condition yields an attained dual optimum. This mission formalizes the progression in §§8.2–8.6, culminating in the book's Lagrange Duality Theorem.
Let and be real normed spaces, let be a nonempty convex set, and let be a convex cone. The cone induces the relation
A continuous linear functional is dual-positive when for every . A map is cone-convex on when its value at a convex combination is below the corresponding convex combination of its values in this cone order. The primal program is
where is real-valued and convex on .
For a multiplier , the Lagrangian and its possibly infinite dual value are
The perturbed primal value replaces the zero right-hand side by . Lean represents and in EReal, so infeasible perturbations have value and objectives unbounded below can have value without arbitrary defaults.
Assume has nonempty interior, the primal value is finite, and there is a strictly feasible point with
Prove that a dual-positive exists and attains
If attains the primal infimum, also prove complementarity and that minimizes over .
Five source milestones delimit the reusable theory. A closed convex cone is recovered from all dual-positive inequalities (§8.2, Proposition 1). The finite-height epigraph of the extended perturbation value is convex, and that value is antitone in the cone order (§8.3, Propositions 1–2). A Lagrangian saddle point is sufficient for primal feasibility and optimality when the cone is closed (§8.4, Theorem 2). Finally, multipliers for two perturbed right-hand sides bound the change in optimal objective value from both sides (§8.5, Theorem 1). The root then states §8.6, Theorem 1 rather than duplicating the equivalent multiplier theorem from §8.3.
The capstone provides both equality of optimal values and an attained multiplier. It applies to a single vector inequality, so finite systems of scalar inequalities and matrix-cone constraints fit the same statement once their ordering cones are supplied. Complementarity and Lagrangian minimization turn a primal optimizer and multiplier into a certificate. The sensitivity milestone additionally gives quantitative information about how the optimum changes when the constraint right-hand side moves.
Formalization produces a reusable cone-order layer independent of coordinate choices. coneLE, dualPositive, and ConeConvexOn can support later Kuhn–Tucker, vector optimization, and conic programming developments. The EReal value functions preserve infeasibility and unboundedness, two cases that a real-valued sInf encoding would collapse. This is a formalization mission for a classical theorem, not a claim that the underlying duality result is open.
The theorem's strict-feasibility condition is load-bearing. Feasibility cannot replace interior feasibility, and nonempty interior of alone does not supply a Slater point. Equality constraints also cannot be converted into pairs of inequalities while retaining strict feasibility; Luenberger explicitly warns about this after the theorem.
The cone assumptions differ across milestones. The main strong-duality theorem does not require to be closed or pointed, whereas the bipolar and saddle-sufficiency statements require closedness. Using Mathlib's stronger ProperCone everywhere would silently add both topological and order hypotheses and shrink the theorem. Another tempting simplification is to make both value functions real. That loses the empty feasible set and unbounded dual subproblem, precisely the boundary cases used when comparing perturbations. The saddle inequalities must also have the correct orientation: the multiplier coordinate is maximized and the primal coordinate is minimized.
The mission uses ConvexCone ℝ Z with a custom induced relation; it deliberately does not assume a lattice order on . Multipliers are continuous linear maps . The root assumes a real finite optimum through IsGLB and a real witness , while lagrangeDualValue and perturbationValue retain EReal codomains. The strict condition is written as membership of in interior P, exactly matching .
No finite-dimensionality, reflexivity, completeness, closedness, or pointedness is added to the root. Closedness appears only where the source uses cone separation to recover primal feasibility. The sensitivity item assumes the two candidate points are feasible, their multipliers are dual-positive and complementary, and each point minimizes its shifted Lagrangian; these hypotheses spell out “solutions and corresponding multipliers” without relying on informal terminology.
Contributions may formalize cone separation, perturbation-value geometry, saddle certificates, or strong duality. Finite-dimensional orthant and positive-semidefinite specializations are useful corollaries but do not replace the general goal. Local multiplier rules, equality constraints, differentiable Kuhn–Tucker conditions, and Chapter 9's local theory remain outside this mission.
AI generated, I think it's correct
The matrix-multiplication exponent measures the asymptotic arithmetic cost of multiplying square matrices. A bound means that, over the field under consideration, matrices can be multiplied in field operations for every . Matrix multiplication is a central benchmark in algebraic complexity and a basic subroutine in linear algebra, graph algorithms, and symbolic computation.
The Coppersmith--Winograd tensor and the laser method produced the strongest bounds on for several decades. The 1990 tensor-square analysis gave . Later analyses of larger powers improved the numerical bound, but they organized their recursion through values assigned independently to constituent tensors. Duan, Wu, and Zhou identified a loss in that organization: several fine constituents that can coexist inside one coarse block may be counted as though they had to be selected independently. Their asymmetric-hashing framework partially compensates for this combination loss. The paper's full second-power specialization improves the best bound obtainable from the square of the Coppersmith--Winograd tensor to ; see Section 6.3 and its parameter Table 2 in Duan--Wu--Zhou.
This mission isolates that second-power result. It is smaller than the paper's record-setting eighth-power calculation, but it contains the genuinely new asymmetric-hashing and hole-repair mechanisms in their first complete form. It therefore provides a focused bridge from the existing formalization of the classical square analysis to later combination-loss methods.
For a field , the matrix-multiplication tensor
encodes multiplication of an matrix by a matrix. A restriction applies one linear map to each tensor leg, while a degeneration permits polynomial families of such maps and takes their first nonzero coefficient. A degeneration from the diagonal tensor gives a border-rank upper bound of .
The Coppersmith--Winograd tensor with parameter is
It has border rank at most . Its coordinate partition has six supported types, and the square has fifteen coarse constituent types with . A large tensor power contains many blocks with prescribed joint and marginal type distributions. The laser method retains blocks whose variables are disjoint and interprets their direct sum through Schönhage's asymptotic sum inequality.
Duan--Wu--Zhou refine this organization by also retaining a split distribution for the fine indices inside each coarse constituent. Coarse - and -blocks are made unique, while compatible coarse triples may initially share a -block. The resulting partially damaged constituent tensors are described as broken copies of a standard-form tensor. The formal target uses , the full Section 6 construction, and the paper's released second-power parameters.
For every field ,
The source reports the stronger numerical endpoint , so the displayed rational inequality has strict slack. The Lean declaration has exactly the same field quantification and uses exactly the same matMulExp definition as the existing Coppersmith--Winograd mission; only the theorem name and rational endpoint change.
The mission first isolates the available-block shuffling interface extracted from Definitions 5.3--5.5 and Claims 5.8--5.10, then formalizes the finite covering core of the Hole Lemma 5.6. The subsequent tensor realization by zeroing and identification, the multiple-copy Corollary 5.11, the compatibility-rate identity of Lemma 6.7, the probabilistic part of Claim 6.8, and the global restricted-splitting value inequality in Equation (25) remain visible structural leaves rather than being hidden inside scalar assumptions. The numerical milestone instantiates Equation (25) with the exact data of Section 6.3 and Table 2 and checks a strict value surplus at . The structural proof must also make explicit the conversion from the paper's six-symmetrized value to a direct HasTauValueAtLeast witness for the mode-symmetric CW square. The final bridge applies the existing tau-value/rank machinery and transfers the Strassen-preorder exponent bound to matMulExp.
The mathematical result gives the first improvement over the classical Coppersmith--Winograd number while continuing to use only the tensor square. It separates improvement of the tensor analysis from improvement obtained merely by moving to a much higher tensor power. The same standard-form and restricted-splitting language is then reused by the paper's higher-power algorithm, which reports .
For formalization, the mission adds reusable infrastructure for nested tensor partitions. Existing CW-square work records coarse support types and actual matrix-multiplication restrictions. This mission extends that layer with fine split distributions, compatibility between levels, broken-block bookkeeping, and repair of holes without replacing tensor statements by unverified scalar values. Those definitions are prerequisites for later asymmetric-hashing, complete-split, and more-asymmetry analyses.
The bound is known mathematically and was published at FOCS 2023. The open work is a machine-checked reconstruction. The underlying CW tensor, border-rank certificate, canonical tensor-square grading, Salem--Spencer sets, direct-sum tau-value notion, asymptotic sum inequality, and exponent equivalence already exist on Prove2Me. The new frontier is the cross-level combination-loss analysis and its exact numerical specialization.
The central difficulty is that coarse and fine decompositions cannot be optimized independently. Two coarse triples may share a -block, and a fine -block can be useful for one triple, compatible with several, or removed by a collision. Counting all locally valuable fine constituents therefore does not certify a direct sum. Conversely, requiring every coarse -block to be unique discards precisely the combinations that produce the improvement.
The Hole Lemma must also preserve the actual tensor. A broken copy lacks some fine variable blocks; combining several such copies is useful only when a degeneration covers every required block with controlled loss and does not duplicate monomials. On the numerical side, the same-marginal maximum-entropy term and restricted-splitting values must be bounded with certified real inequalities. Floating-point output from MATLAB is evidence for a witness, not a Lean proof.
The mission uses the existing TensorObj, MMObj, restriction, degeneration, asymptotic-rank, HasTauValueAtLeast, matMulExp_strassen, and matMulExp declarations in environment 777aaa61dcd2a1258d2b4962dbe983ede4d23b2e. Top-level results quantify over an arbitrary field. Finite supports and block indices are represented by finite types; probability and split distributions are nonnegative real functions of total mass one; entropy and numerical optimization live in the reals.
The formalization is restricted to for the capstone, although generic definitions and source lemmas may quantify over levels and finite index types. A valid proof must connect scalar rate inequalities to witnessed restrictions or degenerations yielding direct sums of concrete matrix-multiplication tensors. A constant-valued surrogate for the restricted-splitting value, a hypothesis that already assumes the desired exponent bound, or a certificate definition containing its own conclusion is outside scope.
Contributions are welcome for standard-form tensor encodings, finite permutation arguments, hole repair, type and split counting, entropy maximization certificates, certified logarithm and power inequalities, and the final tau-value/rank assembly. Statements should identify the corresponding definition, lemma, claim, equation, or table in the source.