Validate the one-file simp_to_model refactor through an exact upstream bridge, version-paired dependencies, a focused real-module build, a full-project receipt, and a separate downstream theorem consumer.

No Progress

The exact Iris PR proof compiled through the real 22-job HeapInstances closure under the exact Lean PR compiler with lockstep Qq/Batteries revisions. A separate checker then verified both public signatures, tactic presence, removal of bespoke helpers, absence of proof escapes, and downstream usability. A prior immutable run records a successful 259-job full Iris build under the source-identical v4.32 bridge backport. The patch is candidate-ready but remains externally blocked on the upstream Lean bridge.

Research-policy redirect

Candidate is a prior-art replication/control or lacks a proceed decision; it cannot be promoted as novelty. · Attempt evidence did not validate; durable progress is withheld.

Strategy and discriminator

upstream model bridge plus native tactic replay

Register Const.mergeWith with simp_to_model upstream, replace Iris's implementation-specific fold proof with the direct tactic proof, and compile the actual downstream theorem under hash-pinned toolchain/dependency tuples.

Hypothesis: Exact Iris PR #532 at 8db3e7794c1c59b7e5ebf1dcba6dffd351c9ff2d elaborates under exact Lean PR #14526 when Qq and Batteries are advanced together to their contemporaneous v4.33.0-rc1 revisions.

Test: Build the 22-job Iris.Std.HeapInstances import closure, then run a separately written consumer/signature/proof-safety checker; reject the tuple on any nonzero result.

Rationale

The proof claim is supported by Lean kernel elaboration rather than model agreement. The project-wide build and independent consumer are separate executions with hash-recorded inputs. The exact current-head focused replay closes the previous version-mismatch uncertainty without treating the still-queued full current-head job as evidence.

Claims requiring scrutiny

At Iris head 8db3e7794c1c59b7e5ebf1dcba6dffd351c9ff2d, Iris.Std.HeapInstances builds successfully under Lean head d3718f8f8f71799c4d39d1c7253a3d668cfc2e42 with Qq ee41917ae11d38479fb8fb24745f7ca4bf0a784d and Batteries 0a7a0cdc42f531e02361cb303b8cbf0e7d334f82.
The two public getElem?_mergeWith' theorem headers are identical to the comparison base.
The patch removes pairMerge and insertOrMerge, contains the intended simp_to_model [Const.mergeWith, Const.get?] invocation, and contains no axiom, sorry, or admit.
The patch is one file with 10 additions and 122 deletions.
A pinned native source-backport run completed all 259 default Iris build jobs.

Evidence and scope

.proof-experiments/20260808-004340-465497: return code 0; Build completed successfully (22 jobs), ending with Iris.Std.HeapInstances.
.proof-experiments/20260808-004909-9f5e7f: return code 0; passed=true and all six independent checks true.
git diff 8f501a717b7a219acf35ad36b44daa72692435b5..8db3e7794c1c59b7e5ebf1dcba6dffd351c9ff2d: 10 additions, 122 deletions, patch SHA-256 15fa4584....
lab-runs/lab-iris-lean-127-simp-to-model-f1a2d4a9fb37/segment-000001/20260723-213901-f25245/stdout.txt: Build completed successfully (259 jobs).

Computational experiments

.proof-experiments/20260808-004340-465497 — exact-head focused build passed 22/22 jobs in 96.111 seconds.
.proof-experiments/20260808-004909-9f5e7f — independent consumer and structural checker passed in 82.412 seconds.
.proof-experiments/20260808-004849-564336 — negative control exposed invalid relative LEAN_PATH handling; no proof conclusion drawn.
lab-runs/lab-iris-lean-127-simp-to-model-f1a2d4a9fb37/segment-000001/20260723-213901-f25245 — native patched Lean and 259-job Iris build passed; its low-address-space checker failed and was rerun separately.
lab-runs/lab-iris-lean-127-simp-to-model-bb249324e41e/segment-000001/20260723-214424-2b670e — separately provisioned independent checker passed.

Independent checker

artifacts/checkers/check_issue_127-64f09591b9c929ff0bb34b223f63dd97b64c85c258750beed6fdfb106b50c1fe.py plus artifacts/checkers/Issue127-87262ce69826ad821528f4ca8b56e1d9115aaf757b7478c0f6ddb46a2daeba56.lean; the exact-head run at .proof-experiments/20260808-004909-9f5e7f reports passed=true.

Contribution gate

candidate_eligible

No structured gate reasons were recorded in this legacy attempt; see the adjudication ledger.

Original model outcome: no_progress
Public classification: no_progress

Cross-domain transfers tested

Release engineering dependency pairing -> Qq and Batteries must move together with the Lean compiler -> the historical Alias failure disappeared and the real HeapInstances target passed.
Deterministic build scheduling -> explicit per-package -j1 should eliminate thread-resource races missed by environment-only limits -> the same 22-job closure passed.
Consumer-driven API testing -> importing the public theorem from a distinct Lean file should detect signature or namespace regressions -> both TreeMap and ExtTreeMap examples compiled.

Established facts

The exact PR HeapInstances module compiles under the stated Lean/Qq/Batteries tuple.
.proof-experiments/20260808-004340-465497/experiment.json and stdout.txt · Iris.Std.HeapInstances and its 22-job import closure only. · computed
Both public theorem headers are preserved and consumable.
.proof-experiments/20260808-004909-9f5e7f/stdout.txt · Base 8f501a7 versus Iris head 8db3e77. · computed
The patch uses simp_to_model, removes the bespoke helpers, and adds no proof escape.
.proof-experiments/20260808-004909-9f5e7f/stdout.txt · Patched HeapInstances source SHA-256 0054ee13.... · computed
The pinned source-backport tuple completed the full 259-job Iris build.
lab-runs/lab-iris-lean-127-simp-to-model-f1a2d4a9fb37/segment-000001/20260723-213901-f25245/stdout.txt · Pinned Lean v4.32 source with the source-identical mergeWith bridge and final Iris patch. · computed

Ruled out in this epoch

Use stock Lean v4.32 simp_to_model without a mergeWith registration.
Stock v4.32 runtime and the saved mergeWith model goal. · The tactic leaves the mergeWith model obligation unchanged. · .proof-experiments/20260723-063823-7333d5 · A released Lean version containing the accepted mergeWith registration.
Treat the Iris-local private fold lemma as resolution of issue #127.
The prior Const.get?_foldl_merge implementation-specific fallback. · It retains the implementation dependency that issue #127 explicitly seeks to remove. · findings/epoch-003-native-stage1-discriminator.md · Explicit maintainer confirmation that the robustness requirement is waived.
Run Lean PR #14526 with Iris's v4.32 Qq/Batteries pins.
Exact Lean PR compiler with v4.32 dependency revisions. · Compilation fails in Batteries.Tactic.Alias before reaching HeapInstances. · .proof-experiments/20260723-224801-85dba4 · A source-compatible backport or a lockstep dependency update.
Use relative LEAN_PATH entries with check_issue_127.py.
Checker invocations that change working directory to the Iris package. · Relative paths resolve from the new directory and make the Iris module unavailable. · .proof-experiments/20260808-004849-564336 · Normalize all entries to absolute paths before invoking the checker.

Open leads

Review the queued exact-head full Iris build and checker.
It is the only remaining computational integration check and can strengthen, but is not needed to reinterpret, the completed focused candidate. · Inspect the immutable completion record for lab-iris-lean-127-simp-to-model-4dcf02e4e00c; do not resubmit while it remains queued. · high · open
Complete upstream Lean review and release pairing.
Iris PR #532 is externally blocked on the Std registration in Lean PR #14526. · After upstream changes, rerun the 22-job focused command against the reviewed commit before rebasing the downstream PR. · high · open

Continuation checkpoint

Objective: Bind the queued exact-head full-build result and shepherd the two open PRs through human review.

First action: Inspect records/labs for a completion record whose ID begins lab-iris-lean-127-simp-to-model-4dcf02e4e00c, then verify its content-addressed stdout and checker JSON.

Stop condition: Stop computational work when the full build and checker are green, or redirect immediately if the first exact failure is in HeapInstances rather than an unrelated dependency.

Next moves

Review lab job lab-iris-lean-127-simp-to-model-4dcf02e4e00c only after an immutable completion record appears.
If green, bind its record and content-addressed outputs into a validation receipt.
Track Lean PR #14526 review/merge, then rebase Iris PR #532 onto the released compatible toolchain and dependency pins.
Do not claim acceptance until Iris CI and maintainer review are green.

Citations

Tool disclosure

Sol principal: this Codex session, identified by the campaign as GPT-5.6 Sol. Terra reconnaissance: one gpt-5.6-terra source-discriminator memo was treated as an advisory lead and independently audited. Deterministic tools used: Lean 4.34.0-pre at d3718f8..., Lake 5, prior native Lean v4.32 source build, Python 3.12 run_experiment/checker scripts, Bash, Git, SHA-256, jq, curl, and GitHub's public API. No theorem claim relies on model agreement.

Duration: 1615.0s
Review state: evidence invalid or incomplete; not durable progress
Attempt ID: iris-lean-127-simp-to-model-20260808-005734-10fe34

Human review ledger

No human review recorded.