{
  "artifact": "essential_bits",
  "subject": "the COMPOSED forall-(T,n) essentiality theorem: a zero-leak AND full-reuse pooled-KV policy over T tenants x n cache blocks needs >= 2^(T*n) states = >= T*n BITS -- one machine-checked theorem, general in T and n, stated in bits via Nat.log2, instantiated at the KV-cache setting",
  "lean_file": "serving_limits/formal/lean/EssentialBits.lean",
  "lean_toolchain": "leanprover/lean4:v4.31.0",
  "n_theorems": 22,
  "lean_theorems": [
    "EssentialBits.le_log2_of_pow_le",
    "EssentialBits.authMatrix_ext",
    "EssentialBits.uncurryGrid_injective",
    "EssentialBits.denseWorld_injective",
    "EssentialBits.kv_pool_state_floor",
    "EssentialBits.kv_pool_states_pos",
    "EssentialBits.kv_pool_bits_floor",
    "EssentialBits.kv_pool_bytes_floor",
    "EssentialBits.no_policy_below_floor",
    "EssentialBits.tag_table_attains",
    "EssentialBits.kv_pool_theta",
    "EssentialBits.kv_cache_pool_bits_floor",
    "EssentialBits.kv_cache_witness_64x1024",
    "EssentialBits.base_digits_unique",
    "EssentialBits.digitWorld_injective",
    "EssentialBits.single_owner_state_floor",
    "EssentialBits.single_owner_bits_floor",
    "EssentialBits.single_owner_below_dense_strict",
    "EssentialBits.single_owner_store_cannot_serve_dense",
    "EssentialBits.separation_witness_4x4",
    "EssentialBits.zero_leak_alone_is_free",
    "EssentialBits.full_reuse_alone_is_free"
  ],
  "allowed_axioms": [
    "Quot.sound",
    "propext"
  ],
  "what_this_closes": {
    "gap_1_composition": "IsolationBound.spec_forces_injective and IsolationBound.essential_state_count were NEVER COMPOSED; the only discharge of the matrix-extensionality hypothesis was mem4_ext, a `decide` over Fin 4 x Fin 2, i.e. T*n = 2. EssentialBits.kv_pool_state_floor composes them forall T,n.",
    "gap_2_no_logarithm": "nothing in the estate took a log: every 'T*n bits' was docstring prose over a 2^k <= s. EssentialBits.kv_pool_bits_floor states T*n <= Nat.log2 s.",
    "gap_3_no_kv_cache": "nothing in the formalism mentioned KV caches. EssentialBits.kv_cache_pool_bits_floor names the setting: T tenants x n pooled prefix blocks in a shared paged cache.",
    "gap_4_shipping_model": "StructuredIsolation had the SAME un-composed gap. EssentialBits.single_owner_state_floor / single_owner_bits_floor compose it (n*log2 T), and single_owner_store_cannot_serve_dense proves a store sized for single-owner rights CANNOT serve the dense spec -- which is exactly when the T*n floor binds."
  },
  "does_not_prove": [
    "NECESSARY, not sufficient: this bounds STATE. It says nothing about timing channels, content channels, or probabilistic/approximate isolators.",
    "BOTH spec hypotheses are load-bearing and are foiled IN THIS FILE. Zero-leak ALONE is provably 0 bits (zero_leak_alone_is_free / IsolationBound.deny_all_starves): deny everything, never leak, starve. Full-reuse ALONE is 0 bits (full_reuse_alone_is_free). Any citation that drops either hypothesis cites a bound these foils refute.",
    "T*n is the DENSE rights model -- every (tenant, block) right independent. It binds when a block may be authorized to an arbitrary SUBSET of tenants (group / shared-read ACLs). Under single-owner rights the tight floor is T^n states = n*log2(T) bits, exponentially smaller.",
    "The pigeonhole is CLASSICAL. What is mechanized here is the COMPOSITION and the BIT-COUNT, not new mathematics.",
    "Nat.log2 is the FLOOR log. 'T*n bits' means T*n <= floor(log2 s), i.e. the state index cannot be narrower than T*n bits."
  ],
  "no_speedup_claimed": true,
  "build_cmd": "cd serving_limits/formal/lean && lake build EssentialBits",
  "build_returncode": 0,
  "axiom_cmd": "cd serving_limits/formal/lean && lake env lean --stdin <<< 'import EssentialBits' + '#print axioms EssentialBits.<T>' for every theorem",
  "axiom_stdout": "'EssentialBits.le_log2_of_pow_le' depends on axioms: [propext, Quot.sound]\n'EssentialBits.authMatrix_ext' depends on axioms: [Quot.sound]\n'EssentialBits.uncurryGrid_injective' depends on axioms: [propext, Quot.sound]\n'EssentialBits.denseWorld_injective' depends on axioms: [propext, Quot.sound]\n'EssentialBits.kv_pool_state_floor' depends on axioms: [propext, Quot.sound]\n'EssentialBits.kv_pool_states_pos' depends on axioms: [propext, Quot.sound]\n'EssentialBits.kv_pool_bits_floor' depends on axioms: [propext, Quot.sound]\n'EssentialBits.kv_pool_bytes_floor' depends on axioms: [propext, Quot.sound]\n'EssentialBits.no_policy_below_floor' depends on axioms: [propext, Quot.sound]\n'EssentialBits.tag_table_attains' does not depend on any axioms\n'EssentialBits.kv_pool_theta' depends on axioms: [propext, Quot.sound]\n'EssentialBits.kv_cache_pool_bits_floor' depends on axioms: [propext, Quot.sound]\n'EssentialBits.kv_cache_witness_64x1024' does not depend on any axioms\n'EssentialBits.base_digits_unique' depends on axioms: [propext, Quot.sound]\n'EssentialBits.digitWorld_injective' depends on axioms: [propext, Quot.sound]\n'EssentialBits.single_owner_state_floor' depends on axioms: [propext, Quot.sound]\n'EssentialBits.single_owner_bits_floor' depends on axioms: [propext, Quot.sound]\n'EssentialBits.single_owner_below_dense_strict' depends on axioms: [propext, Quot.sound]\n'EssentialBits.single_owner_store_cannot_serve_dense' depends on axioms: [propext, Quot.sound]\n'EssentialBits.separation_witness_4x4' does not depend on any axioms\n'EssentialBits.zero_leak_alone_is_free' depends on axioms: [propext]\n'EssentialBits.full_reuse_alone_is_free' depends on axioms: [propext]\n",
  "n_axiom_lines_printed": 22,
  "disallowed_axiom_lines": [],
  "load_bearing_missing": [],
  "sorry_axiom_nativedecide_declarations": [],
  "certified": false
}