Skip to content

feat: division proof#89

Draft
bollu wants to merge 10 commits into
mainfrom
div-sketch
Draft

feat: division proof#89
bollu wants to merge 10 commits into
mainfrom
div-sketch

Conversation

@bollu
Copy link
Copy Markdown
Contributor

@bollu bollu commented May 15, 2026

This PR proves the correctness of the division operation.

bollu and others added 10 commits May 15, 2026 00:38
Mirrors MulUnnormalized.toInt_ex_le; bounds the exponent difference
in (-2^e + 1, 2^e - 1) before the post-normalization shift.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Discharge `a.isNaN` case by NaN propagation through ExtRat.div = mul·inv.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Each case uses the same NaN-propagation pattern via ExtRat.div_eq_mul_inv:
NaN.inv = NaN, then mul · NaN = NaN, then both branches of the
xorSign if/then/else collapse to NaN.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
inv inf = 0, then inf * 0 = NaN closes the inf/inf case via the
standard NaN-propagation pipeline.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
The 'rounding-stable-under-perturbation' lemma: if two rationals agree
on isNaN, isZero, lower, upper, lowerHalf, and tieBreak classifiers,
roundRNE returns the same packed float. This is the abstract property
the sticky-bit machinery relies on to bridge the gap between the
implementation's truncated-quotient toRat and the true rational quotient.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Document remaining sign-convention reconciliation needed for the
non-NaN cases (0/num, etc.).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
The sign reconciliation for inf/0 is non-trivial because SmtLib's
inv(Number 0) returns Infinity false (discarding zero's sign), then
the xorSign+neg machinery in SmtLibFunctions.div tries to restore it.
Verifying this needs case analysis we defer.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Fix the original `lsb_eq_sticky` statement (which was wrong for the
unshifted msb=true case): the lsb of the adjusted significand is
`(msb && quot.lsb) || (rem != 0)`. Proved by case-split on quot.msb.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant