Hidden-Assumption Audits

A theorem is stated with four hypotheses. Which of them does the proof actually use?

The question matters in both directions. A hypothesis the proof does not use is a needless restriction. One the proof quietly relies on without stating it is a hole. Reading the proof is one way to find out. A mechanical test is another, and it catches cases a reader misses.

This chapter gives a repeatable test for which premises a conclusion really depends on, and a catalogue of the related audits the engine already runs. It builds on assumptions (Chapter 2), solvers (Chapter 10) and the cross-system ladder (Chapter 15).

The deletion audit

For a claim “$H_1 \land \dots \land H_n \implies G$”, drop one hypothesis $H_i$ and ask Z3 for a model of (the other hypotheses) $\land \lnot G$.

• sat: the model is a concrete case where everything except $H_i$ holds and $G$ fails. $H_i$ is load-bearing, and the model shows why.
• unsat: either $H_i$ is redundant (it follows from the others), or the claim is vacuous without it.

Here is the audit, executed on claims from earlier chapters.

The algebraic Lorentz claim

(Chapter 20)

Two findings that a reader of the Lean statement might miss. First, the physical side condition $\lvert v\rvert<1$ is a consequence of the algebraic hypothesis, so the algebraic theorem carries it silently. Second, the algebraic theorem covers $\gamma<0$ (a boost combined with a time reversal), which the physical claim, with $\gamma = 1/\sqrt{1-v^2} > 0$, never mentions. Chapter 26 returns to this.

The Pythagorean coordinate claim

(Chapter 25)

The model Z3 returned has $B=C$: a degenerate triple, and a legitimate counterexample to the unconditioned claim. It is a useful accident. Chapter 25 records that the modern theorem permits degenerate point triples, and here the solver found one first. The P6 witness $(0,0)$, $(1,0)$, $(1,1)$ is not degenerate; it was chosen on purpose.

Timelike order

(Chapter 22)

Hypotheses: $\gamma>0$, $\gamma^2(1-v^2)=1$, $t>0$, $t^2>x^2$. Goal: $\gamma(t-vx)>0$.

Every hypothesis here is load-bearing. The $t>0$ row deserves a pause. For a past-directed timelike separation the order is also preserved, but the goal $\gamma(t-vx)>0$ asks for a positive result: the claim as written says “future”. The audit caught the direction hypothesis without anyone asking.

What the deletion audit cannot see

• What a hypothesis means. Z3 encodes the square root as a relation with $s>0$; Lean uses a total function with junk values (Chapter 11). Deleting $\lvert v\rvert<1$ from the bridge makes the claim vacuous in Z3 (no $s$ exists for $\lvert v\rvert\ge1$) and false in Lean ($\gamma=0$). The audit is only as meaningful as the encoding.
• Hypotheses that were never written down. If a claim silently assumes inertial frames or Einstein synchronization (Chapter 17), there is no $H_i$ to delete. The audit works only on stated hypotheses.
• Whether the whole set is consistent. Each $H_i$ can be load-bearing while the full set is inconsistent, in which case the claim is vacuously true (Candidate C in Chapter 27). Run a satisfiability check on the full set of hypotheses as well.

The audits the engine already runs

Each is narrow. Together they cover many ways a hidden assumption can fail, and by design none of them proves that a claim means what its author meant.

What this establishes

A hidden-assumption audit finds where a conclusion’s support actually lies. It can turn “this theorem needs $\lvert v\rvert<1$” into “it needs nothing beyond the gamma relation, and $\lvert v\rvert<1$ comes free”, a mathematical fact a physicist may find clarifying.

The results here are illustrative only. The underlying theorems are kernel-accepted (Chapter 20 and Chapter 25) or Lean-checked as illustration (Chapter 22); the deletion audit itself has no claim contract. Each unsat and sat reading can be checked by hand. For example, $\gamma^2(1-v^2)=1$ and $\gamma^2\ge0$ give $1-v^2 = 1/\gamma^2 > 0$. No review is recorded.

The audit is also relative to the tool. Because Z3 encodes the square root as a relation and Lean as a total function with junk values, the same “delete $\lvert v\rvert<1$” test returns different verdicts.

Try it yourself

uv run python content/examples/math/part4/part4_assumption_deletion_demo.py

(Download the script.)

Boundary check. Executed on 2026-11-09 with Z3 5.3.1, using ch05_10_18_22_24_checks.py: add $v=0$ as an extra hypothesis to the algebraic claim. With $v=0$, the negated interval equality is unsat once the gamma relation is present, so the relation stays load-bearing at the boundary. Without it the audit returns sat. The solver’s model is $\gamma=0$, $t=-1$, $x=0$, and $\gamma=2$, $t=1$, $x=0$ is also a valid model with the hypothesis dropped.

Exercise. Check the last row of the timelike-order table by hand. With $\gamma=2$, what must $v^2$ be, and why does $t=1$, $x=-2$ make $\gamma(t-vx)$ negative for $v<0$? (Answer: $\gamma^2(1-v^2)=1$ gives $v^2 = 3/4$, so $v = -\sqrt3/2 \approx -0.87$; then $t - vx = 1 - \sqrt3 < 0$.)

Open questions.

1. Is deletion the right granularity? Weakening a hypothesis (replacing $<$ with $\le$) is a finer probe that this audit does not run.
2. Should the engine run this audit automatically on every claim and record the result as evidence, or is it a reader’s tool? An automated version would need a claim contract of its own.
3. How should the engine report a hypothesis that is redundant under one encoding and load-bearing under another?

Sources

No external literature is cited. In the repository: docs/methodology/evidence-policy.md, formalization rules 1 and 2 (record all quantifiers and side conditions; track assumptions introduced to make a theorem tractable).