Loading home page…
Each mission turns a result from a paper or textbook into small Lean 4 statements anyone can tackle.
Campaigns group missions around a shared mathematical goal. Each one tracks a quantity, such as an upper or lower bound. Have a good candidate in mind? Ping us on Slack, Zulip, or WeChat.
Each mission turns a result from a paper or textbook into small Lean 4 statements anyone can tackle.
Campaigns group missions around a shared mathematical goal. Each one tracks a quantity, such as an upper or lower bound. Have a good candidate in mind? Ping us on Slack, Zulip, or WeChat.
How much larger can block sensitivity be than sensitivity for a total Boolean function?
For a total Boolean function , a block of coordinates is sensitive at if flipping every bit in that block changes . Let count sensitive singletons and be the maximum number of pairwise disjoint sensitive blocks. Define and .
This campaign seeks larger exponents for which there exists an infinite family of total Boolean functions , indexed by , satisfying
Here denotes a quantity tending to zero as . Higher is better. The classical exponent is , and Huang's bound gives a ceiling of .
OpenAI's construction achieves an exponent strictly greater than .
One sufficient way to establish an exponent is to find a single total Boolean function with and . Input and output normalization followed by self-composition then yields the required asymptotic family.
Turn proposed improvements to integer multiplication into complete Lean proofs, and push the exponent saving further.
Harvey and van der Hoeven established an algorithm in 2021. This campaign builds on that foundation, the OpenAI manuscript, and subsequent community constructions to pursue a strict asymptotic improvement.
For two -bit integers, the target is
A positive beats asymptotically; larger is better. Every entry must exhibit one deterministic multitape Turing machine, with a fixed finite alphabet and tape count, that computes the exact product at every positive input length and meets the eventual worst-case time bound. The tracked number measures an asymptotic exponent saving.
Classical algorithms solve 3SUM in time. In a 2026 breakthrough, Alman and Vassilevska Williams gave a deterministic algorithm, refuting the integer 3SUM hypothesis. How low can the exponent go?
Building on existing Lean formalizations, this campaign tracks upper bounds for 3SUM on polynomially bounded integers, using a word RAM with -bit words, and pursues smaller exponents.
Classical algorithms solve all-pairs shortest paths in time. In a 2026 breakthrough, Alman and Vassilevska Williams refuted the APSP conjecture with a deterministic algorithm. How low can the exponent go?
Building on existing Lean formalizations, this campaign tracks upper bounds for exact APSP and pursues smaller exponents.
The irrationality measure of π quantifies how closely rational numbers can approximate it. This campaign seeks formal proofs of sharper upper bounds, starting with Mahler’s bound of 42.
The sharp Hlawka inequality for Schatten -norms is a cousin of the triangle inequality: it relates the norms of three matrices to the norms of their pairwise sums and their total sum. For complex diagonal matrices, an exact formula for the best possible comparison constant has been proved in Lean for every real . We conjecture that the same formula holds for all .
What is the smallest cutoff for which this formula holds for every real ?
References:
Is every odd number a sum of primes? This campaign tracks formalized proofs of the smallest that suffices.
Schnirelmann (1930) showed some finite works. Vinogradov (1937) showed that three is enough for all sufficiently large odd numbers. Tao (2012) proved unconditionally. Helfgott (2013) proved that every odd number greater than is a sum of three primes, though the proof is still unrefereed. Ideally, we can formalize this statement here. Note that three is optimal: is neither prime nor + prime.
Schoolbook matrix multiplication takes operations. The exponent is the infimum of all such that two matrices can be multiplied in arithmetic operations; trivially , and is conjectured but open.
Strassen gave the first nontrivial bound, , in 1969, and introduced the laser method in 1986 to reach . Coppersmith and Winograd's 1990 bound of stood for two decades. Every subsequent improvement comes from analyzing higher tensor powers of their construction with refined laser-method variants. That line reached in 2025, and the current record is , from August 2026. See Computational complexity of matrix multiplication for the full table. Can we formalize these results and even improve on them?
Completeness of a normed or metric space is the property behind most existence theorems in analysis: limits of approximations, fixed points, integrals. Many of the spaces that matter in analysis and in the theory of distributions are not metrizable, though: the space of test functions, weak-star duals, and spaces of operators with the strong or weak operator topology. For such topological vector spaces the right replacement for sequences is nets, and the plain notion "every Cauchy net converges" turns out to be too strong. Weak-star duals of infinite-dimensional Fréchet spaces, for example, never satisfy it.
Paul Garrett's lecture notes Completeness and quasi-completeness (PDF) argue that the right general notion is quasi-completeness: every bounded Cauchy net converges. They show that it holds for Hilbert, Banach, Fréchet and LF-spaces, for their weak-star duals, and for spaces of continuous linear maps with the topology of pointwise convergence. In the notes, one stated purpose is to justify Gelfand–Pettis integrals of compactly supported continuous functions with values in such spaces, for instance distribution-valued functions.
The results are classical. Boundedness in strict inductive limits goes back to Dieudonné and Schwartz, and the incompleteness of weak duals to Grothendieck (1950). See Bourbaki, Topological Vector Spaces, III.5, and Schaefer, Topological Vector Spaces.
All vector spaces are over or and all topological vector spaces are Hausdorff. A set in a topological vector space is bounded if every neighbourhood of absorbs it. A net is a map from a directed partially ordered set. It is Cauchy if for every neighbourhood of there is with for all . is complete if every Cauchy net converges, and quasi-complete if every bounded Cauchy net converges.
A Fréchet space is a locally convex, metrizable, complete topological vector space. A locally convex space is the strict colimit of a chain of subspaces if , each is closed in , and the topology of is the finest locally convex topology inducing the given topology on every . Concretely, a balanced convex set is a neighbourhood of in as soon as every trace is a neighbourhood of in . An LF-space is a strict colimit of Fréchet spaces; is the standard example.
For topological vector spaces , write for the continuous linear maps with the topology given by the seminorms , for and a convex balanced neighbourhood of in . When is locally convex this is the topology of pointwise convergence. A set of linear maps is equicontinuous if for every neighbourhood of in there is a neighbourhood of in with for all .
Theorem 4.1.1 makes the strong-operator and weak-operator topologies on bounded operators between Hilbert spaces quasi-complete, and does the same for operators out of test-function spaces. Combined with quasi-completeness of weak-star duals of LF-spaces (Remark 5.0.3), it is what lets vector-valued integration and Cauchy–Goursat-type complex analysis be applied to families of distributions and operators. Banach–Steinhaus for LF-spaces (Theorem 3.0.1) and the Dieudonné–Schwartz description of bounded sets (Proposition 2.1.1) are among the most frequently used facts about distributions.
Mathlib has the Banach–Steinhaus theorem for Banach spaces and barrelled spaces, the topology of pointwise convergence on continuous linear maps, weak duals, and the test-function space . It has no general theory of strict inductive limits and no quasi-completeness results of this kind. This mission formalizes that layer: the results are proved on paper, not yet formalized.
The obvious argument for Theorem 4.1.1 takes pointwise limits. That gives a linear map, but continuity of the limit is the real issue: it needs equicontinuity of a merely pointwise-bounded net of operators, which is a Baire-category statement and fails for general domains. For LF domains the Baire argument does not apply directly, because an LF-space is never metrizable when the chain is strictly increasing. The argument has to pass through the steps , which needs the description of bounded and equicontinuous sets in a strict colimit. That description depends on each being closed in and uses Hahn–Banach separation.
Definitions (namespace GarrettFA, shared by any later missions on these notes):
IsQuasiComplete 𝕜 E and IsNetComplete E follow the notes literally, with nets indexed by directed partial orders. The index type is taken in the universe of E, which is no restriction because Cauchy nets correspond to Cauchy filters.IsEquicontinuousSet S encodes equicontinuity at as in §2.2.IsStrictColimit 𝕜 F is a predicate on a chain F : ℕ → Submodule 𝕜 V and the given topology on V, and IsLFSpace and IsFrechetSpace are built from it. The steps carry the subspace topology from . By the Dieudonné–Schwartz theorem this is the same as giving the steps their own topologies, so the class of spaces is the source's.IsInitTopology 𝕜 V says that the topology of is . Its existence is a separate theorem item, which rules out a vacuous predicate.Local convexity is real local convexity (LocallyConvexSpace ℝ, with IsScalarTower ℝ 𝕜), as in Mathlib's distribution theory. is Mathlib's X →Lₚₜ[𝕜] Y. Its topology is the source's -topology because is locally convex.
Two statements of the notes are corrected. Theorem 3.0.1 is stated there for arbitrary linear maps; it needs continuous ones, since a single discontinuous functional is pointwise bounded but not equicontinuous. Corollary 5.0.2 claims incompleteness of weak duals of all infinite-dimensional LF-spaces. That fails for the LF-space of Example 1.3.1, whose topology is the finest locally convex one, so its weak dual is complete. The LF statement is therefore made for LF-spaces with an infinite-dimensional step. Proposition 1.3.5 is built into the formalization, where the steps are subspaces of .
Contributions of reusable infrastructure on strict inductive limits and barrelled spaces are welcome.
The invariant subspace problem asks whether every bounded linear operator on an infinite-dimensional separable complex Hilbert space leaves some non-trivial closed subspace invariant. It is listed as a high-importance open problem in analysis in the Open Problem Garden (entry) and is widely regarded as one of the most famous open problems in functional analysis. Invariant subspaces are the infinite-dimensional replacement for eigenvectors: in finite dimensions every complex matrix has an eigenvector, and the structure theory of matrices (triangular and Jordan forms) is built from chains of invariant subspaces. Whether any such structure is available for an arbitrary bounded operator on Hilbert space is exactly what the problem asks.
The Hilbert-space question remains open.
Let be or , let be a normed space over , and let be a bounded linear operator. A linear subspace is invariant under if . It is a non-trivial closed invariant subspace if moreover is closed in the norm topology and . A closed subspace with is a non-trivial closed hyperinvariant subspace of if for every bounded operator with .
A Hilbert space is a complete complex inner product space; it is separable if it has a countable dense subset. An operator is compact if it maps bounded sets to relatively compact sets, and is normal if . In the Lean development these notions are IsInvariantSubspace, IsNontrivialClosedInvariantSubspace, HasNontrivialClosedInvariantSubspace and HasNontrivialClosedHyperinvariantSubspace (namespace InvariantSubspaceProblem), together with Mathlib's IsCompactOperator and IsStarNormal.
The source poses a yes/no question; the goal states the affirmative answer, and a formal proof of its negation equally settles the problem.
The result itself. A positive answer would give every bounded operator on Hilbert space a non-trivial piece of structure and would be the first step towards triangular-form type theorems for general operators. A negative answer would, after Enflo and Read, show that even the Hilbert-space geometry does not force invariant subspaces. Either answer resolves a question that has organised much of operator theory since the 1930s.
Formalizing it. The goal is open; no proof, formal or informal, is known. The milestones are proved results whose formal proofs would build reusable infrastructure absent from Mathlib: the Aronszajn–Smith and Lomonosov theorems (the latter through Schauder's fixed point theorem), invariant subspaces from the spectral theorem for normal operators, and the large explicit constructions of Enflo, Read and Argyros–Haydon. None of these results is formalized in Mathlib at the time of writing.
The obvious approach, taking the closed linear span of an orbit , fails exactly when every non-zero vector is cyclic, which is the situation that has to be ruled out; for separable spaces nothing prevents this a priori. Spectral methods fail because an operator can have a one-point spectrum and no eigenvectors (quasinilpotent operators). Methods that work on Hilbert space must use the inner-product structure in an essential way, since Enflo's and Read's examples show that the statement is false on some Banach spaces. Lomonosov's technique needs a non-zero compact operator in the commutant, which a general operator need not have.
Hilbert spaces are Mathlib types H with [NormedAddCommGroup H] [InnerProductSpace ℂ H] [CompleteSpace H]; separability is TopologicalSpace.SeparableSpace H and infinite dimension is ¬ FiniteDimensional ℂ H. Operators are continuous linear maps H →L[ℂ] H. Scalars are complex in the goal. Subspaces are Submodules, and closedness is required explicitly: without it the statement is trivially true in infinite dimensions (the algebraic span of an orbit is a proper invariant subspace), and a published platform statement that omits closedness should not be confused with this problem. Existential milestones quantify over spaces in Type.
Useful infrastructure includes: Schauder's fixed point theorem, Riesz theory of compact operators, the spectral theorem for normal operators, and machinery for Read's construction. Contributions of reusable lemmas, partial results (for instance further classes of operators known to have invariant subspaces), and proof sketches for the milestones are welcome.
An Euler system is a family of cohomology classes, indexed by abelian extensions of a base field, whose members are tied together by norm relations whose correction factors look like the Euler factors of an -function. Euler systems were introduced by Kolyvagin (Kolyvagin 1990), building on Thaine's work on cyclotomic fields (Thaine 1988), and they are one of the main tools for bounding Selmer groups and ideal class groups: Kolyvagin used them to prove finiteness of some Tate–Shafarevich groups, and Rubin used them for a new proof of the main conjecture of Iwasawa theory (Rubin 2000).
The simplest Euler system, and the model for all others, is the cyclotomic Euler system of cyclotomic units . Kolyvagin used it to give an elementary proof of the Gras conjecture. This mission formalizes the two defining relations of this system as stated in the Wikipedia article Euler system.
Timeline (as summarized in the source): Thaine (1988) annihilators of class groups of real abelian fields; Kolyvagin (1988, 1990) Heegner-point and general Euler systems; Kato (2004) Euler system of Beilinson elements; Rubin (2000) monograph Euler Systems; Mazur–Rubin (2004) Kolyvagin systems.
For every square-free positive integer fix a primitive -th root of unity , chosen compatibly: whenever are coprime. Put
For a prime , the Frobenius is the automorphism of with . The norm is the field norm of the extension , and a prime of lies above if it is a prime ideal of the ring of integers containing .
For square-free and a prime :
The two relations are exactly the axioms that later, more abstract Euler systems (Gauss sums, elliptic units, Heegner points, Kato's elements) are modelled on; the cyclotomic case is where the Euler-system machinery for class groups of abelian fields starts. Both relations are classical and proved; what remains is formalizing them. Mathlib provides cyclotomic fields, primitive roots of unity, field norms and rings of integers; the mission builds the relations on top of these and provides a reusable definition layer for cyclotomic units.
The norm relation requires identifying the Galois group of with — which uses the irreducibility of the -th cyclotomic polynomial over for — and then computing the norm as a product over conjugates inside , transported along the intermediate-field coercions. The congruence relation requires working in the ring of integers of a subfield of and showing that lies in every prime above . Neither is conceptually deep, but both involve substantial bookkeeping between subfields of , abstract cyclotomic extensions, and rings of integers.
All fields are subfields of : is IntermediateField.adjoin ℚ {ζ n}, and over is IntermediateField.adjoin (ℚ(ζ_n)) {ζ (n*l)}. The norm is Algebra.norm; is written as ; is any -algebra automorphism of with . Roots of unity are required to be primitive. Two deviations from the literal text of the source, both forced: the norm's base field is (the source's is a typo), and the norm relation assumes (for , ). The existence milestone rules out a vacuous reading of the compatibility hypothesis. Welcome contributions: lemmas on Galois groups of compositums of cyclotomic fields inside , and on primes above in .
In centralized labour markets such as the US National Resident Matching Program, doctors are assigned to hospital residency positions by a mechanism that produces a stable matching. There are more positions than doctors, so some hospitals end up with empty positions; these are typically rural hospitals, which are less sought after than urban ones. This raised the question of whether a different mechanism could help these hospitals (Roth 1986). The rural hospitals theorem answers this negatively, provided all preferences are strict.
Timeline.
A market has a finite set of doctors and a finite set of hospitals; hospital has positions. Every doctor strictly ranks the hospitals together with the option of staying unmatched, and every hospital strictly ranks the doctors together with the option of leaving a position empty. An assignment sends each doctor to a hospital or to nothing; is the set of doctors at . It is a matching if for every .
A matching is stable if (i) no doctor is placed at a hospital she ranks below staying unmatched, and no hospital holds a doctor it ranks below an empty position, and (ii) there is no blocking pair : a doctor who prefers to her assignment, while finds acceptable and either has an empty position or prefers to one of its current doctors.
For any two stable matchings :
The result itself. Changing the matching mechanism, as long as it outputs stable matchings, cannot give under-subscribed hospitals more doctors or different doctors, and cannot change which doctors are employed. Hence policy aimed at rural hospitals must change preferences, capacities, or abandon stability, not merely switch between stable mechanisms.
Formalizing it. The theorem is classical and proved in the cited papers; this mission asks for a machine-checked proof in Lean 4 with Mathlib, for the general many-to-one model with capacities and acceptability, together with the one-position special case.
Comparing two stable matchings one agent at a time does not work: a single doctor moving between hospitals says nothing about how many positions each hospital fills, and the statements concern every agent of the market simultaneously. Stability of both matchings has to be used at once, and Part 2 is strictly stronger than Part 1 (equal numbers of doctors at an under-filled hospital do not imply equal sets of doctors). The existence of a stable matching is not needed for these statements.
Doctors and hospitals are finite types D, H. Preferences are injective rank functions on Option H (for a doctor) and Option D (for a hospital), smaller rank meaning more preferred and none meaning unmatched or an empty position; injectivity encodes strictness. Hospital preferences over groups are responsive. Capacities are natural numbers and may be zero. An assignment is μ : D → Option H. Stability is Market.IsStable: capacity constraints, individual rationality, and no blocking pair. All statements quantify over arbitrary stable matchings, so they are not vacuous: stable matchings exist in every such market (Gale–Shapley), though existence is not part of this mission.
Contributions welcome: proofs of the milestones, an existence theorem for stable matchings in this model, and lemmas about stable matchings reusable in other matching missions.
The stable matching problem asks for a pairing between two equally sized groups in which no two participants would both rather be matched with each other than with their assigned partners. It was posed and solved by Gale and Shapley in 1962 in the context of college admissions and marriage (Gale–Shapley 1962). Their deferred acceptance algorithm underlies centralized clearinghouses such as the assignment of graduating medical students to hospital residencies, and the theory of stable allocations was recognized by the 2012 Nobel Memorial Prize in Economic Sciences awarded to Shapley and Roth.
Timeline of the results targeted here:
Fix . There are men and women, both indexed by . Each man ranks all women strictly: is the position of in 's list, position being most preferred; symmetrically each woman has . Both are bijections. A matching is a bijection from men to women. A pair blocks if and ; is stable if no pair blocks it.
The Gale–Shapley algorithm runs in rounds. A state records, for every man, how many women he has proposed to so far, and for every woman, her current provisional fiancé (if any). In each round every unengaged man proposes to the most preferred woman he has not yet proposed to, and every woman keeps the most preferred among her current fiancé and this round's suitors, rejecting the others. The Gale–Shapley outcome is the matching read off from the state after rounds.
This contains termination (all men are engaged after rounds), the fact that the final engagements form a bijection, and stability.
Existence of stable matchings is the foundation of two-sided matching theory, and the algorithmic proof is constructive. Man-optimality and woman-pessimality show that the proposing side is systematically favored, which is the reason the choice of proposing side matters in practice, as in the 1995 redesign of the residency match. The incentive results (milestones 5–8) explain why participants on the proposing side can safely report their true preferences while the receiving side cannot, and the lattice structure underlies efficient algorithms for enumerating and optimizing over stable matchings.
All results in this mission are classical and proved in the literature. The work here is formalization: a precise model of the round-based algorithm, machine-checked proofs of its correctness and optimality, and the incentive properties, which are usually argued informally.
The goal requires reasoning about an iterated state transformer rather than an abstract existence statement. The step that is usually waved away is the invariant that an unengaged man still has a woman left to propose to, which is what makes the bound and the bijectivity of the final engagements work. Man-optimality needs the invariant that no man is ever rejected by a woman who is his partner in some stable matching, which is not visible from the output alone. Group strategy-proofness is substantially harder than individual truthfulness: the known proofs go through a "blocking lemma" about matchings that are weakly preferred by all men.
Men and women are Fin n; preferences are strict total orders given as rank bijections Fin n ≃ Fin n; matchings are bijections Fin n ≃ Fin n. The algorithm is the round-based version described in the source: all unengaged men propose simultaneously in each round. The algorithm's output is fixed as the state after exactly rounds; termination within that bound is itself a milestone, so a wrong bound would make the goal false rather than vacuous. The case is included and is trivial. Incentive results compare Gale–Shapley outcomes of two instances that differ only in the lists of the deviating participants, with gains measured by the deviators' true lists.
The definitions are reusable for further missions on the same article (rural hospitals theorem, hospitals/residents problem). Contributions welcome: invariants of the algorithm, the blocking lemma, and alternative proofs of existence.
The secretary problem is the standard example of an optimal stopping problem with partial information. It is also known as the marriage problem, the sultan's dowry problem, the fussy suitor problem, the googol game and the best choice problem. It is studied in applied probability, statistics and decision theory. Its solution is often called the 37% rule: a simple rule picks the single best of applicants with probability about , whether there are 100 or 100 million applicants (Wikipedia: Secretary problem). The problem is a standard example of the exploration–exploitation dilemma.
Timeline (as recounted in the Wikipedia article's History section, following Ferguson 1989):
There is a single position and there are applicants, where is known. If seen together, the applicants can be ranked from best to worst with no ties. They are interviewed one at a time in a uniformly random order: each of the orders is equally likely. Right after each interview the applicant is either accepted, which ends the process, or rejected for good. The decision may depend only on the relative ranks of the applicants interviewed so far. The objective is to maximize the probability of selecting the best applicant of the whole group.
An order is a permutation of . The applicant interviewed at time has quality , where larger means better. The relative rank of the applicant interviewed at time is the number of applicants interviewed before time who are worse than them. A stopping rule maps the list of relative ranks observed so far to "accept" or "reject". Its success probability is the fraction of the orders on which the applicant accepted by is the overall best. A rule that never accepts anyone fails. The optimal success probability is
A candidate is an applicant who is better than every applicant interviewed before them. The cutoff rule with cutoff rejects the first applicants and then accepts the first candidate after that point.
The result. The 37% rule is the classical result of optimal stopping. It shows that a fixed fraction of the best possible success probability survives as the number of options grows without bound, and that a simple threshold policy achieves it. The structure of its solution has three parts: optimal rules may be taken to be threshold rules, there is an exact formula in terms of the records of a uniformly random permutation, and a limit turns a harmonic sum into an integral. This structure recurs throughout the best-choice literature, including the prophet-secretary and multi-choice secretary problems.
Formalizing it. The result has been proved since the late 1950s and early 1960s. The remaining work is to formalize the known proof: a model of rank-based stopping rules over uniformly random permutations, the exact success probability of cutoff rules, the optimality of cutoff rules among all rank-based rules, and the asymptotics.
The success probability of a fixed cutoff rule and the calculus limit are elementary. The central step is the optimality of cutoff rules (Milestone 3). A stopping rule may depend arbitrarily on the whole history of relative ranks, and one has to show that no such rule beats the best cutoff rule. Evaluating cutoff rules alone does not prove the goal, because is a supremum over all rank-based rules. A second, smaller difficulty is that the limit statements need control of the harmonic sums along a varying cutoff , not only along a fixed ratio.
Equiv.Perm (Fin n) with uniform weights. successProb n s is the ratio (number of winning permutations) / in .List ℕ → Bool, applied to the list of relative ranks observed so far. Through the length of the list it also knows the current time. It never sees absolute qualities. Randomized rules are not modelled. A randomized rule is a mixture of deterministic ones, so it cannot do better.optimalProb n is the real supremum of successProb n s over all such rules. The values lie in , so the supremum is the usual least upper bound.Fin n). Cutoffs are 1-based, as in the article: cutoffRule r accepts at time exactly when and the current applicant is a candidate.Real.exp (-1).All declarations live in the namespace ClassicalSecretary. Reusable contributions are welcome, in particular facts about records of uniformly random permutations (independence of relative ranks, the probability that position is a record) and a backward-induction principle for finite-horizon stopping problems.
The diffeomorphism group of a closed smooth manifold , topologized so that two diffeomorphisms are close when they and all their derivatives are uniformly close, is a basic invariant of the smooth structure of . Its set of path components is the group of isotopy classes of diffeomorphisms (the smooth mapping class group), and its higher homotopy groups classify smooth fibre bundles with fibre . For spheres, the natural comparison is with the orthogonal group of isometries of the round metric, which sits inside .
S. Smale asked how far is from . The question was settled positively in dimensions and has been studied extensively in dimensions , where surgery theory and pseudo-isotopy theory apply. Dimension is the remaining case, and it is where the least is known. The question is recorded on the Open Problem Garden (problem page) with importance "Outstanding".
Timeline.
Whether is connected is still unknown.
Write for Euclidean space with the Euclidean norm, for the closed unit ball and for the round unit sphere.
The source states that , so the homotopy type of is determined by that of .
The source asks to "determine some (any?) homotopy or homology groups of " and singles out connectivity as unknown. The goal is the yes/no question for . It can be settled either way: a proof shows that every diffeomorphism of rel boundary is isotopic to the identity, and a disproof exhibits one that is not.
The result itself. A positive answer would mean , detected by orientation alone, matching dimensions , and . A negative answer would give an exotic diffeomorphism of : one that is topologically isotopic to the identity (by the Alexander trick) but not smoothly isotopic. By the Cerf–Morlet theorem, , so the question is equivalent to a question about the homotopy of , the space controlling smoothings of PL -manifolds. The source lists the smooth -dimensional Schoenflies problem as a related problem.
Formalizing it. No part of this theory is currently formalized in Lean or Mathlib: there is no topology on diffeomorphism groups and no known homotopy equivalence involving one. The milestones are classical theorems (Smale 1959, Hatcher 1983, Kervaire–Milnor 1963, Farrell–Hsiang 1978, Watanabe 2018). Formalizing any of them is new work, independent of the open goal.
In dimensions , is computed by combining Cerf's pseudo-isotopy theorem with the -cobordism theorem. Both rely on the Whitney trick, which fails in dimension . In dimension one also cannot reduce to a lower-dimensional problem as Smale and Hatcher did. The known invariants that detect non-trivial elements of (Watanabe's configuration-space integrals) are rational and live in positive degrees, so they say nothing about . Smale's and Hatcher's arguments for rely on understanding spaces of embedded spheres in of one lower dimension; the corresponding spaces of -spheres in are not understood, so those arguments do not carry over.
All statements import the single definition file SmaleDiffS4_Basic and live in the namespace SmaleDiffS4.
DiffDisk n is the subtype of Mathlib's Diffeomorph 𝓘(ℝ, ℝⁿ) 𝓘(ℝ, ℝⁿ) ℝⁿ ℝⁿ ∞ (smooth = C^∞) of maps fixing every point of norm . Its topology is induced by the family of iterated derivatives iteratedFDeriv ℝ k f, , each with the topology of uniform convergence on . This "identity outside the open ball" model is the standard model of and is homotopy equivalent to the "identity on the boundary" and "identity near the boundary" variants.DiffSphere n is Mathlib's Diffeomorph (𝓡 n) (𝓡 n) (sphere 0 1) (sphere 0 1) ∞ on the unit sphere of . Its topology is induced by the iterated derivatives of the radial extension, restricted to the sphere and uniformly topologized.OrthGroup n is Matrix.orthogonalGroup (Fin n) ℝ with the subspace topology.ContinuousMap.HomotopyEquiv. is GenLoop (Fin 5) Y y, is ZerothHomotopy, and is HomotopyGroup (Fin i). is TensorProduct ℤ ℚ (Additive π_i), and "" is stated as -rank .A trivializing formalization is ruled out: the topology is the genuine topology rather than the discrete or indiscrete one, and the goal is not vacuous because DiffDisk 4 is nonempty (it contains the identity).
A complete development needs reusable infrastructure: the topology and topological-group structure on diffeomorphism groups, isotopy extension and fibration theorems (Cerf–Palais), restriction to a disc, and the Alexander trick. Contributions of this infrastructure as separate theorems are welcome.
A knot is a smooth simple closed curve in the -sphere . Since is the boundary of the -ball , one can ask whether bounds a smoothly embedded disc in ; if so, is called slice. Slice knots are the identity element of the smooth knot concordance group, so deciding which knots are slice is a central question of -dimensional topology. A more restrictive and more combinatorial notion is that of a ribbon knot: a knot bounding an immersed disc in whose only self-intersections are ribbon singularities (arcs of double points whose two preimages are an interior arc and an arc running across the disc from boundary to boundary). Every ribbon knot is slice: pushing the interior of a ribbon disc into removes the double points. In 1962 R. H. Fox asked for the converse ([F]). The Open Problem Garden lists this slice–ribbon problem as Outstanding (source): given a knot in which is slice, is it a ribbon knot?
Write for Euclidean -space (R4), , , and for the closed unit disc in the parameter plane (R2).
IsKnot γ). A map which is , -periodic, takes values in , is injective on , and has nowhere-vanishing velocity. The knot is the image .IsSliceDisk γ F). A map that is injective on with injective differential at every point of , maps the open disc into the open ball, maps the unit circle onto , and is transverse to along the boundary: for . A knot is slice (IsSlice γ) if it has a slice disc.IsRibbonImmersedDisk γ f, Fox's definition). A map that maps into with injective differential on , maps the unit circle injectively onto , has no triple points, has transverse double points, and whose double-point set in is a disjoint union of arcs with , each contained in the open disc and each running from the boundary circle through the open disc back to the boundary circle. A knot is ribbon (IsRibbon γ) if it bounds a ribbon disc.IsRibbonSliceDisk γ F). A slice disc on which the squared radial function is Morse in the open disc with no local maxima.IsMinimalOnDisk F). With , , , the vector is tangent to the surface at every interior point, i.e. the mean curvature vector of vanishes on the open disc.A further (non-milestone) sanity item asserts that the round unknot is a ribbon knot, which shows that the definitions are not vacuous.
A supporting (non-milestone) item isolates the maximum-principle step behind [H]: on a minimal disc, the radial function has no local maximum in the open disc.
A positive answer would make sliceness, a -dimensional property defined by the existence of an embedded disc in , equivalent to a -dimensional property that can be certified by a finite diagrammatic object (a ribbon presentation). A counterexample would exhibit a slice knot whose slice discs all need local maxima of the radial function; several proposed candidates (Gompf–Scharlemann–Thompson) are tied to the smooth -dimensional Poincaré conjecture and to Property 2R. The problem is closely related to the question of which homology -spheres bound homology -balls.
On the formal side no part of this theory is in Mathlib: there are no knots, no slice or ribbon discs, no Morse functions on surfaces and no minimal surfaces. The milestones (Fox's easy direction, the D/D equivalence, Hass's theorem) are classical theorems that have not been machine-checked; formalizing them builds the infrastructure any later attack needs.
Turning a slice disc into a ribbon disc requires removing the local maxima of the radial function on the disc. Cancelling a maximum against a saddle is possible only when the handles are in suitable position, and there is no known procedure that achieves this in general; the known positive results rely on classifying the rational homology balls bounded by branched double covers, using Donaldson's diagonalization theorem, which applies only to special families of knots.
Everything is stated in Euclidean coordinates: knots are periodic parametrisations , discs are maps whose restriction to is the disc in question. Smoothness is ; slice discs are required to be smooth up to the boundary and transverse to there (the standard notion of a properly embedded disc). The knot enters only through its image, so orientation and parametrization play no role. The problem is the smooth one; topologically locally flat slice discs are not allowed. Definitions under which the conjecture holds trivially (for example, a ribbon condition implied by the slice condition by definition) are excluded: the goal uses Fox's -dimensional ribbon discs, and the -dimensional characterisation is a separate milestone.
Contributions welcome: smooth embedded discs and their collars, Morse theory for functions on , the push-in construction, and minimal-surface tools (the maximum principle for on minimal surfaces).
Bounded-depth Frege systems are the proof systems of propositional logic in which every formula of a proof has depth bounded by a fixed constant ; the resulting system is written . They are the proof-theoretic counterpart of the circuit class and of the bounded arithmetic theories and its relatives: short -proofs of a family of tautologies correspond to proofs of the corresponding first-order statement in bounded arithmetic. Lower bounds for are among the strongest lower bounds known for any natural proof system.
A basic structural question is whether the depth hierarchy is strict in a strong sense. It is known that one extra level of depth can give an exponential speed-up, but in all known separations the tautologies themselves have depth growing with . J. Krajíček asked whether there is a single fixed depth at which tautologies witnessing the separation of from exist for every (Open Problem Garden, F_d versus F_{d+1}; [Krajíček 1995, p. 243]). The question is closely related to conservativity relations among bounded arithmetic theories.
Timeline.
Formulas. A formula is in negation normal form over variables : a literal or , a conjunction or a disjunction of any finite number of formulas. The depth of a literal is , and the depth of or is (so clauses have depth and CNFs depth ). The size is the number of symbols (literals and connectives). A tautology is a formula true under every assignment. The negation of a formula is obtained by De Morgan's laws.
The system . Lines of a proof are sequents: finite lists of formulas, read as their disjunction. The rules are: (axiom) any containing both and ; () from for every infer ; () from infer ; (weakening) from infer any containing every member of ; (cut) from and infer . An -proof of is a sequence of sequents, each following from earlier ones by a rule (lines may be reused), in which every formula has depth at most , and which contains the sequent consisting of alone. Its size is the total size of all formulas in it.
Write for a family of tautologies of depth at most with . It requires exponential -size if for some and all large every -proof of has size at least .
The goal takes the weaker of the two upper bounds allowed by the problem (quasi-polynomial); the polynomial version implies it.
A positive answer would show that the extra power of depth over depth is visible already on formulas of a fixed, small depth, in particular that the hierarchy of bounded-depth Frege systems does not collapse on (for example) CNF tautologies. Through the correspondence with bounded arithmetic it bears on conservativity of theories of increasing quantifier complexity over a fixed class of low-complexity statements. A negative answer would say that for low-depth tautologies the bounded-depth Frege hierarchy collapses up to quasi-polynomial size.
Status: the goal is open. Milestones 1–2 are standard; milestones 3–4 are published theorems that, to the best of current knowledge, have no machine-checked proofs. Formalizing them requires switching-lemma machinery that would be reusable across proof complexity.
The known lower bounds for go through switching lemmas that simplify depth- formulas under random restrictions. In the known separations of from the hard tautologies have depth growing with . Keeping the formulas at one fixed depth while ranges over all values requires a lower-bound argument whose strength depends on the depth of the proof lines alone, uniformly in ; the switching-lemma arguments used for depth-dependent separations do not directly provide this.
Formulas are the Lean inductive type FdVersusFdSucc.Formula over variables ℕ, with conjunctions and disjunctions of lists (so and [] is true and or [] is false). Depth counts literals as . is the dag-like one-sided sequent calculus described above; sequents are lists, weakening is by list inclusion. Proof size counts symbols of all formulas in all lines. Exponential lower bounds are asked only for all sufficiently large indices. The goal quantifies over : for no -proof of a depth- formula exists, so "every " cannot be meant literally. A family whose formulas have depth would satisfy the lower bound vacuously; this is excluded because the formulas must have depth at most . The size condition rules out finite families.
Contributions welcome: proofs of soundness and completeness, a formalized switching lemma, and the classical lower bounds.
Rendezvous search asks how two agents who cannot communicate should move so as to meet as quickly as possible. It was introduced as a mathematical problem by Alpern (The rendezvous search problem, SIAM J. Control Optim. 1995) and developed systematically in Alpern and Gal's monograph The Theory of Search Games and Rendezvous (Kluwer, 2003). Besides its game-theoretic interest, it is a model for coordination without prior agreement: robots or searchers that must find each other with no shared map or orientation.
The simplest non-trivial domain is the line. Even there, the version in which both agents must follow the same strategy remains open, and it is listed on the Open Problem Garden with importance "High".
Timeline:
Two players are placed on the real line at distance ; player I starts at and player II at . Each player has a private sense of "forward", fixed by an independent fair coin, so neither knows in which direction the other lies. Both move with speed at most .
A feasible path is a function with and for , describing a player's position in its own frame. A mixed strategy is a probability distribution over feasible paths, realised as a probability space and a random path whose position at each fixed time is measurable.
If player I follows with orientation and player II follows with orientation , their positions are and . The meeting time is
For strategies with independent randomisations, the expected meeting time averages over , and the four equally likely orientation pairs. The symmetric rendezvous value and the asymmetric rendezvous value are
An integer zigzag is a path that on each interval , , moves with velocity or ; denotes the infimum of over strategies supported on integer zigzags.
This is the Han–Du–Vera–Zuluaga conjecture and answers the Open Problem Garden question. A formal disproof is equally valuable.
The value measures the cost of symmetry in the most basic rendezvous problem: when roles can be pre-assigned, while the best known symmetric strategies need about . Determining exactly would settle a problem that has been open since 1995 and would calibrate numerical methods (linear and semidefinite relaxations over discretised strategies) used for related search games.
None of these results is formalized. The milestones are proved on paper; formalizing them requires a measure-theoretic treatment of mixed strategies over path space, a rigorous version of the discretisation argument, and certified numerical bounds. The goal itself is open.
The obvious approach is to optimise over finitely many turning times, but a symmetric strategy must be randomised (any deterministic symmetric strategy fails to meet with probability , when both players face the same way), so the optimisation is over probability distributions on infinite paths and the objective is a quadratic, non-convex function of the distribution. Truncating to finite horizons gives upper bounds by explicit strategies, but lower bounds require controlling all strategies, including those that delay indefinitely, and the known gap – has resisted closing.
All values live in and expectations are Lebesgue integrals of non-negative functions; a strategy that fails to meet with positive probability has value . Sample spaces range over a fixed universe, which loses no generality. Paths are required to be -Lipschitz on with , and positions at fixed times are measurable, so meeting times are random variables. The four orientation pairs are weighted equally. The infimum in ranges over all such strategies, not only over integer zigzags; the restriction appears only in . A trivializing reading (e.g. a meeting time of or an unrestricted speed) is excluded: by construction every strategy pair has expected meeting time at least .
Contributions are welcome on: measurability of hitting times for continuous processes, the discretisation argument, explicit strategies with certified expected meeting times, and certified lower-bound certificates.
A large family of random growth models, interacting particle systems and directed polymers in one space dimension share a common, non-Gaussian fluctuation theory: observables of size fluctuate on the scale (instead of the central-limit scale ), with spatial correlations on the scale . This family is the Kardar–Parisi–Zhang (KPZ) universality class, named after the 1986 physics paper of Kardar, Parisi and Zhang. The KPZ universality conjecture (Open Problem Garden, posted 2020, importance "High") asks for a central limit theorem for this class: any one-dimensional growth model with a smoothing mechanism, short-range noise and slope-dependent ("lateral") growth should exhibit KPZ fluctuations.
KPZ fluctuations have been proved only for models with exact algebraic structure, such as the corner growth model / totally asymmetric exclusion process (Johansson, 2000) and the polynuclear growth model (Prähofer–Spohn, 2002). The Open Problem Garden entry describes ballistic deposition (Vold, 1959) as a concrete growth model with the KPZ features. Corwin's survey states the prediction that its column heights fluctuate like and notes that "this prediction has not been proved" (Corwin 2012, §1.1.1). Ballistic deposition has no known exact solvability, so it tests universality itself rather than one integrable instance of it.
Timeline.
The gap between and is open; the predicted order is .
Columns are indexed by . Each column carries an independent rate-one Poisson clock: on a probability space the inter-arrival times , , are independent and -distributed, and the -th ring of column (counting from ) is at time .
Random deposition. The height of column at time is the number of rings of its clock in . Columns are independent and is Poisson with mean .
Ballistic deposition (nearest-neighbour model, flat initial surface). Write for the height of column at time , with . When the clock of column rings at time , a unit block falls in column and sticks at the first point of contact, so
and all other columns are unchanged. On the finite substrate only clocks in ring and columns outside stay at height ; the finitely many rings in are applied in time order. The height on is the monotone limit . The next-arrival height is . This is the model of Penrose (2008) with and the nearest-neighbour displacement function, and the model (1) of Sudijono (2026) with .
This is the statement "the column height fluctuates around its mean like " (Corwin 2012, §1.1.1; Sudijono 2026, §1). The constants are left unspecified because they are model-dependent.
The predicted scaling limit: converges in law to the Tracy–Widom GOE distribution for some model-dependent .
A proof of the goal would establish the KPZ exponent for a growth model without exact solvability, which is the content of the universality conjecture as opposed to its integrable special cases. For ballistic deposition only is currently known.
On the formal side, the milestones are known results with published proofs; formalizing them requires a library for continuous-time interacting particle systems on (graphical constructions, monotone couplings, finite speed of propagation), subadditive ergodic theory, and concentration inequalities for Poisson-driven processes. These pieces are reusable for first-passage percolation and other growth models. The goal itself is open.
The standard tools give the wrong exponents. Bounded-difference concentration applied to a last-passage representation fails because adding one clock ring can change future heights by an unbounded amount (Sudijono 2026, §1); martingale hitting-time arguments reach only the diffusive bound . Lower bounds of Pemantle–Peres type reach only , as in first-passage percolation, where the analogous gap is also open. The exact formulas (determinantal structure, Bethe ansatz) behind the proved instances of KPZ fluctuations are not available for ballistic deposition.
The model is encoded on a general probability space with inter-arrival times τ : ℤ → ℕ → Ω → ℝ satisfying IsPoissonClocks P τ (measurability, mutual independence over ℤ × ℕ, each law expMeasure 1). The finite-substrate process boxHeight τ L t ω sorts the rings in lexicographically by (time, column) and folds the update rule bdStep; bdHeight τ t x ω : ℕ∞ is the supremum over . Real-valued statements use bdHeightReal, which is bdHeight cast to ℝ with the value on the event ; this event is null (Milestone 2), so the convention does not affect any distributional statement. Ties between rings and non-divergent arrival times are null events and receive junk values. Variances are Mathlib's variance, which returns for non-square-integrable variables; the lower bound in the goal therefore also forces square-integrability, so the goal cannot hold vacuously. Moments in Milestone 2 are lower Lebesgue integrals in , so they are not trivialised by non-integrability.
Contributions welcome: the graphical construction and its basic properties (monotonicity in and , a.s. finiteness), the duality with seed-grown deposition, subadditivity of hitting times, and the Poisson CLT.
Structural stability asks when the qualitative behaviour of a dynamical system survives small perturbations. A diffeomorphism of a closed manifold is structurally stable if every diffeomorphism close enough to is topologically conjugate to : some homeomorphism of the manifold satisfies , so that carries orbits of onto orbits of . Systems that model physical phenomena are only known up to small errors, which is the original reason for interest in this notion (Andronov–Pontryagin, 1937).
In the 1960s Smale introduced Axiom A, a uniform-hyperbolicity condition on the nonwandering set, and showed that it yields a detailed description of the dynamics (spectral decomposition, symbolic dynamics). Palis and Smale conjectured that structural stability forces this hyperbolic structure. The conjecture appears on the Open Problem Garden as the Stability Conjecture (openproblemgarden.org/op/c_r_stability_conjecture, rated Outstanding): any structurally stable diffeomorphism is hyperbolic. The same page describes the higher-regularity case as one of the most important and difficult problems in dynamical systems.
Timeline.
For every the "only if" direction remains open.
Let be a closed manifold: a compact Hausdorff smooth manifold without boundary, of dimension . For an integer , is the set of diffeomorphisms , with the topology: is close to when, in finitely many charts and on compact sets, and its derivatives of order are uniformly close to those of .
For every closed manifold , every and every ,
The case is Mañé's theorem; the cases are open.
The result. A positive answer would give a dynamical characterization of structural stability in every regularity: together with the theorems of Robbin and Robinson (Axiom A plus strong transversality implies stability), it would show that structurally stable diffeomorphisms are exactly the hyperbolic ones with transverse stable and unstable manifolds. Every structurally stable system would then inherit Smale's spectral decomposition and its symbolic models. In the topology this picture is complete (Mañé); in higher regularity it is not known whether a structurally stable system can fail to be hyperbolic.
Formalizing it. The mission produces a common Lean vocabulary for hyperbolic sets, Axiom A, and structural and -stability of diffeomorphisms of closed manifolds, compatible with the existing topology and nonwandering-set definitions on the platform. The proved cases (Anosov, Franks, Mañé, Palis) are milestones whose formal proofs would be new contributions; the goal itself is open for .
The known proof rests on perturbation tools that work only in the topology: Franks' lemma (realizing any small change of the derivative along a periodic orbit by a -small perturbation), Pugh's closing lemma and Mañé's ergodic closing lemma. In the topology, , a perturbation that changes the derivative by a fixed amount on a small ball has large higher derivatives, so these local constructions are not -small; Gutierrez's examples on the torus show that the local perturbation schemes used for the closing lemma cannot work in the topology. Whether periodic points are even dense in for a structurally stable is a case of the closing problem, itself open.
[TopologicalSpace M] [T2Space M] [CompactSpace M], a ChartedSpace structure over EuclideanSpace ℝ (Fin n) and IsManifold (𝓡 n) ∞ M (smooth, no boundary). is ClosingLemma.Diff n M r with the weak topology ClosingLemma.crTopology r (published definition ClosingLemma_DiffeoCrTopology); on compact it coincides with the strong topology. is a natural number with ; is not covered.PughClosingLemma.nonwanderingSet (published definition PughClosingLemma_nonwandering).mfderiv and an arbitrary continuous Riemannian metric (Bundle.ContinuousRiemannianMetric on the tangent bundle); since is compact, the choice of metric only changes . Continuity of the splitting is not assumed, being a consequence of the estimates. A periodic point is hyperbolic when its finite orbit is a hyperbolic set, which is equivalent to the eigenvalue condition.A basic aim of the theory of dynamical systems is to describe the long-term behaviour of typical orbits of typical systems. In the 1960s Smale's programme hoped that hyperbolic (structurally stable) systems would be dense, so that the asymptotic behaviour of a dense set of systems would be described by finitely many hyperbolic pieces. This hope fails: there are open sets of diffeomorphisms none of which is hyperbolic. Jacob Palis proposed a replacement global picture, in which hyperbolicity is replaced by a statistical requirement: for a dense set of systems, the asymptotics of Lebesgue-almost every orbit is captured by finitely many attractors. The problem appears on the Open Problem Garden (page), rated Outstanding, with the monograph of Bonatti, Diaz and Viana as reference.
Timeline.
The conjecture is open in general.
Let be a compact, connected, boundaryless smooth manifold of dimension . For let be the space of diffeomorphisms of and the space of vector fields, both with the topology (uniform convergence of the maps and of their derivatives up to order in charts).
For a diffeomorphism and , the -limit set is the set of accumulation points of the forward orbit , ; for a flow it is the set of accumulation points of as . The basin of a set is
Following the source, is an attractor if it is invariant (, resp. for all ), transitive (some point of has a forward orbit dense in ), and has positive Lebesgue measure. A set has Lebesgue measure zero in if its image in every chart has Lebesgue measure zero in ; this notion does not depend on the smooth atlas.
For every there is a dense set such that every has finitely many attractors with
and likewise there is a dense set such that the flow of every has finitely many attractors whose basins cover Lebesgue-almost all of .
The result. A positive answer would give a dense set of systems whose statistical behaviour is completely described by finitely many invariant pieces, providing a global substitute for the failed density of hyperbolicity. It underlies Palis' companion conjectures on the existence of finitely many physical (SRB) measures and their stochastic stability.
Formalizing it. The full conjecture is open. The mission produces a reusable formal language for diffeomorphisms and vector fields of compact manifolds, density, Lebesgue-null sets on manifolds, -limit sets, basins and attractors, together with formal statements of the classical cases (circle diffeomorphisms; Peixoto's theorem on orientable surfaces).
The obvious route — perturb to a hyperbolic system and invoke the Axiom A theory — fails because hyperbolic systems are not dense in dimension for diffeomorphisms (Newhouse phenomenon, robust homoclinic tangencies and heterodimensional cycles). One must control systems near which non-hyperbolic phenomena persist on open sets, where generic systems can have infinitely many sinks, and still find dense subsets with finitely many attractors. Even in the classical cases the proofs require the full machinery of hyperbolic critical elements, stable manifolds and the Kupka–Smale theorem.
EuclideanSpace ℝ (Fin n) and a manifold structure IsManifold (𝓡 n) ∞ M; the model has no boundary, so is boundaryless.M ≃ₘ^r⟮𝓡 n, 𝓡 n⟯ M; vector fields are sections (x : M) → TangentSpace (𝓡 n) x, of class when is into the tangent bundle.omegaLimit along atTop. Transitivity means the closure of a forward orbit of a point of equals .A central question in smooth dynamics is how much of the long-term behaviour of a system is captured by its periodic orbits. Every periodic point is nonwandering (each of its neighbourhoods returns to itself under some iterate), but a nonwandering point need not be periodic. The closing lemma asks whether this gap can be removed by an arbitrarily small perturbation: given a nonwandering point of a diffeomorphism , is there a diffeomorphism , as close to as desired, for which is a periodic point?
The answer controls the generic picture of dynamics. Pugh's General Density Theorem, which rests on the closing lemma, says that for a generic diffeomorphism of a closed manifold the periodic points are dense in the nonwandering set. Results of this kind underlie the -generic theory of dynamical systems (stability conjectures, generic properties of homoclinic classes). Whether the same holds for smoother perturbations is open; the question appears on the Open Problem Garden (closing lemma for diffeomorphisms, rated Outstanding) and is Problem 10 on Smale's 1998 list of mathematical problems for the next century.
Timeline.
For general diffeomorphisms and every the problem remains open.
Let be a closed manifold: a compact Hausdorff smooth manifold without boundary, of dimension . For , is the set of diffeomorphisms of .
The topology on is defined through charts. For , smooth charts and of , a compact set with , and , the basic set
collects the diffeomorphisms whose local representative has all derivatives of order at most uniformly within of those of on . These sets generate the (weak) topology; on a closed manifold it coincides with the Whitney topology.
For a map , a point is nonwandering if every neighbourhood of satisfies for some ; the set of such points is the nonwandering set . A point is periodic for if for some .
For every closed manifold , every , every and every :
A closing lemma for would give, through the same Baire-category argument as in Pugh's work, a General Density Theorem: -generic diffeomorphisms would have periodic points dense in the nonwandering set. Much of the -generic theory would then become available in the smoother topologies used in smooth ergodic theory, where distortion estimates need at least regularity.
On the formal side, the mission produces a reusable definition of the topology on diffeomorphism groups, which Mathlib does not currently provide. The case is a theorem (Pugh 1967) without a machine-checked proof; formalizing it, and the compatibility of the two topologies, are concrete sub-goals. The case is open, so a proof of the goal would be a new mathematical result.
A perturbation that makes an almost-returning orbit close up must move the orbit by a distance comparable to how close it comes back. With control, the perturbation can be spread over many iterates, and its size stays small because derivatives are only constrained to first order. For , the norm of a bump of displacement supported on a set of diameter scales like , and spreading the perturbation along the orbit no longer keeps it small. Gutierrez's examples show that the local perturbation schemes that work for do fail in the topology, so the natural first idea of copying Pugh's argument is ruled out.
EuclideanSpace ℝ (Fin n) and a manifold structure (IsManifold (𝓡 n) ∞ M), assumed compact and Hausdorff. Because the model space has no corners, has no boundary.Diffeomorph (𝓡 n) (𝓡 n) M M r, with a natural number.ClosingLemma.crTopology r is generated by Hirsch's basic sets, using charts of the maximal atlas and Fréchet derivatives of order of the local representatives at points of . The goal quantifies over all neighbourhoods of for this topology.PughClosingLemma.nonwanderingSet, shared with the existing statements of Pugh's theorems; periodic points are Mathlib's Function.periodicPts (period at least ).Infrastructure that would help: a usable API for the topology (basic neighbourhoods, compatibility under change of charts, the Baire property of ), and local perturbation lemmas (bump-function perturbations of the identity supported in a chart, with estimates). Contributions of these as separate lemmas are welcome.
In a spatially flat Friedmann–Lemaître–Robertson–Walker (FLRW) universe the expansion is described by the Hubble parameter . A long-standing line of work treats the vacuum energy density not as a constant but as a quantity that decays as particles are created out of the vacuum in the expanding spacetime. If total energy is conserved, a time-varying vacuum density must be accompanied by particle production, and conversely the creation rate fixes how depends on .
S. Carneiro's 2012 paper (DOI 10.1142/S2010194512008173) applies this idea at both ends of cosmic history. At late times, creation of ultra-light non-relativistic dark particles gives a vacuum density , the law expected for the QCD vacuum condensate in a low-energy expanding spacetime. At early times, creation of relativistic particles gives and an inflationary solution with constant slow-roll parameter. The paper also recalls a non-singular model in which drives a transition from a de Sitter phase to a radiation phase.
Units are . All quantities are real functions of cosmological time on an open time interval :
The total density and pressure are and . The equations used are:
The slow-roll parameter is , and the matter fraction is . In the equivalent scalar-field description, is regarded as a function of a field , and the field equations are and , with the derivative with respect to .
If , and with , then on any time interval where ,
for an integration constant .
Eq. (17) is the paper's central claim that particle creation with backreaction produces inflation with constant , and so with a scale-invariant spectrum and spectral index . Eqs. (10)–(11) give the late-time decaying-vacuum law behind the paper's concordance model, and Eqs. (4)–(5) give the non-singular de Sitter-to-radiation transition. These derivations have not been machine-checked before. A formal development makes explicit the regularity assumptions and side conditions the paper leaves implicit, such as , , and the non-degeneracy condition in Eq. (10).
Most steps are short calculations, but each one hides analytic content. Deriving relations between functions from equations between derivatives (Eqs. (10), (16), (17), (23)) needs the fact that a function with zero derivative on a connected open set is constant. Eq. (5) defines implicitly, so the existence, differentiability and asymptotics of the inverse function must be established. Eq. (24) requires showing that the sign in cannot switch, even though is not assumed continuous.
Functions are maps , time derivatives are Mathlib's deriv, and differentiability is assumed at every point of the time interval . The interval is an open, preconnected subset of , because the solutions of the paper generally exist only on a half-line: for example, vanishes at a finite time. A statement assuming a global-in-time solution would be vacuous. Constants of integration are existentially quantified. The integration constant enters only through , and Lean's convention makes this the same as an arbitrary real constant. The numerical and observational parts of the paper (data fits, ) and the perturbation analysis (Eqs. (19)–(20)) are out of scope.
The cosmological constant problem is the mismatch between the vacuum energy density predicted by quantum field theory in flat space–time and the small value of the cosmological term inferred from observations (Weinberg 1989). One line of work replaces the constant by a decaying vacuum: a time-dependent cosmological term that falls as the universe expands, while the energy it loses is transferred to matter so that total energy is conserved.
S. Carneiro's essay From de Sitter to de Sitter: a non-singular inflationary universe driven by vacuum (Int. J. Mod. Phys. D 15 (2006) 2241–2247, honorable mention in the 2006 Gravity Research Foundation essay competition) derives such a law from a semi-classical argument, , and studies the cosmologies it produces. In the early-time regime it finds a universe with no initial singularity: an eternal quasi-de Sitter phase at the Planck scale, followed by a fast transition to a radiation era. In the late-time regime it finds a dust era that tends again to a de Sitter universe. The calculations in the paper are explicit closed-form computations, which makes them a good target for a complete machine-checked development.
All quantities are in Planck units, and space is flat. The expansion is described by the Hubble parameter of a scale factor . The cosmic fluid has total energy density and total pressure , where are the matter density and pressure and is the vacuum term. The Friedmann equation is and the conservation equation is
Radiation has and dust has . The relative energy densities are and , and the deceleration parameter is .
The vacuum term comes from a massless scalar field obeying . For slowly varying this has the damped radial plane-wave solution , with and given by explicit square-root formulas (Eqs. (7)–(8)), and energy density . Shifting the cutoff of the thermally regularized vacuum integral by and subtracting the flat-space value gives the vacuum term . In the mission's Lean development these objects are waveNumber, dampingRate, planeWave, vacuumTerm, dustScaleFactor and decelerationParameter, all in the namespace CarneiroDeSitter.
With radiation and , the evolution equation is (Eq. (12)). The goal asserts that it has a solution defined for all times, given implicitly by Eq. (13):
The goal is the paper's central claim: under the stated vacuum law the universe has existed for an infinite past, in a quasi-de Sitter phase with , and leaves it through a transition in which and fall towards zero, producing radiation. The milestones cover the steps the paper uses to reach it (the vacuum law, the evolution equation and its integration) and the late-time picture (the dust solution and its de Sitter limit, which the paper links to the Eddington–Dirac large-number relation ).
The results are proved by hand calculation in the paper. The same evolution equation and implicit solution reappear in Carneiro's later paper Cosmological Concordance Model with Particle Creation (2012), whose statements are also on the platform (namespace CarneiroParticleCreation); this mission formalizes the 2006 paper, its vacuum law and its late-time dust solution. Formalizing them produces a verified account of which statements are exact identities and which are approximations. Where the paper writes "", the milestones state the exact identity or asymptotic equivalence behind it.
The algebraic milestones (5, 7) are routine. The goal concerns a function known only implicitly: the solution is the inverse of on , and its existence on the whole line, its differentiability and its end behaviour all have to be established for an inverse function, not read off a formula. Milestone 6 is a uniqueness statement on all of , so it cannot be checked by substitution. Milestones 1 and 10 are improper integrals whose values involve and , and they need integrability arguments near and . Milestones 2, 3, 8 and 9 involve derivatives of complex exponentials, square roots and real powers, where Lean's conventions for and at non-positive arguments must be handled.
Real.artanh, the real power is Real.rpow, is Asymptotics.IsEquivalent, and is written as .Contributions are welcome on all milestones. The inverse-function and Bose-integral arguments can be reused outside this mission.
Noetherian schemes are the standard finiteness condition of algebraic geometry. Almost every scheme met in practice is Noetherian: affine and projective varieties over a field, schemes of finite type over , and many moduli spaces. Many basic theorems about schemes (finiteness of irreducible components, quasi-compactness of morphisms, good behaviour of coherent sheaves and their cohomology) are proved under a Noetherian hypothesis, so the notion appears in the hypotheses of a large part of the literature, starting with Hartshorne's Algebraic Geometry, Chapter II, and the Stacks Project.
This mission formalizes the foundational statements in the Wikipedia article "Noetherian scheme": the definition and its equivalent forms, the basic topological and ring-theoretic consequences, the stability of the notion under morphisms of finite type, and the standard non-examples.
A scheme is a locally ringed space that is locally isomorphic to spectra of commutative rings. For an open subset write for its ring of sections. An open subset is an open affine if for a commutative ring ; then .
NoetherianScheme.IsLocallyNoetherianScheme).NoetherianScheme.IsNoetherianScheme).A topological space is a Noetherian space if every descending chain of closed subsets stabilizes. A morphism is quasi-compact if preimages of quasi-compact opens are quasi-compact, locally of finite type if it is given locally by finitely generated algebras, and of finite type if it is both.
This combines the article's statements that a scheme is Noetherian iff it is locally Noetherian and compact, and that every open affine of a locally Noetherian scheme has a Noetherian ring of sections. It shows the definition does not depend on the chosen cover.
The goal is what makes the notion usable: it allows checking Noetherianity on any affine cover and using it on every affine open. Milestones 1–5 and 7–8 are the facts invoked whenever a Noetherian hypothesis is used. Milestones 9–10 are the source of most examples, since they show that every scheme of finite type over a field or over is Noetherian. Milestones 6, 11 and 12 show the limits of the notion: Noetherianity is not a topological property, and natural rings in number theory (adeles, rings of integers of infinite extensions) fall outside it, even in dimension one.
Mathlib already contains its own versions of several of these facts, phrased through AlgebraicGeometry.IsLocallyNoetherian and AlgebraicGeometry.IsNoetherian, which take "every open affine has Noetherian sections" as the definition. The statements here use the source's cover-based definition, so connecting the two is part of the work.
The central point of the goal is that a cover-based condition must be transferred to an arbitrary open affine , which in general is not one of the covering opens and is not covered by finitely many standard opens of a single covering affine. The obvious argument (intersect with the cover) produces opens that are not affine, or are affine in different rings, so a local-to-global argument for the property "Noetherian" on affine opens is needed. The non-examples (milestones 6, 11, 12) each require building or analysing a specific non-Noetherian ring that Mathlib does not yet study from this angle.
AlgebraicGeometry.Scheme in a fixed universe u. Open affines are X.affineOpens; rings of sections are Γ(X, U); local rings are stalks X.presheaf.stalk x.CompactSpace on the underlying space (quasi-compact, no Hausdorff condition).LocallyOfFiniteType f together with QuasiCompact f.NumberField.AdeleRing (𝓞 K) K. The field is any field of characteristic zero with IsCyclotomicExtension {n | 0 < n} ℚ K; such fields exist (for example inside an algebraic closure of ), so the hypothesis is not vacuous.IsNoetherian as the definition would make the goal close to a restatement; the definitions here deliberately follow the source.Uncertain financial returns affect funded pensions, DC saving and endowment adequacy. A single investment rate selected once and held fixed for the full projection is fundamentally different from a genuinely independent sequence of annual investment returns. The former produces expected powers of a single random variable while the latter factorises independent annual gross-return moments. These distinctions underpin the financial risk assumptions in stochastic finance models. Existing actuarial missions cover discounted deterministic cashflows but not these stochastic accumulation and contributions.
Annual gross returns equal one plus their annual net investment returns. A finite probability space has actual scenario masses with total one, so expectation and variance are weighted finite sums. The fixed-rate accumulation raises the same scenario gross factor to the investment horizon. For independent years the model explicitly constructs a product joint mass p(a)q(b) and verifies the first and second product moments. A real pension fund receives a contribution at the beginning of the year before earning its realised gross return.
The formalisation develops a connected set of actuarial identities, beginning with precise model definitions and ending with the prospective valuation result.
A finite discrete fixed-rate model begins at a sure one.
Actual joint product probability laws establish two independent annual accumulation moments.
The independent-return pension accumulation recursions reconcile first and second fund moments including contribution cross terms.
The independent-return pension accumulation recursions reconcile first and second fund moments including contribution cross terms.
As discussed in Shreve's stochastic-finance treatment, The capstones distinguish random fixed returns from actually independent annual returns without presupposing a target identity. For the latter, the true two-year joint probability law factorises the expected growth and its second moment. Under subsequent iid moment factorisation, a multi-year first and second return moment model yields an exact variance recursion. The fund valuation then derives consistent one-step mean, second-moment and variance formulae with contributions, including the cross-term from previously accumulated assets. The model is useful for genuine stochastic saving, actuarial adequacy and projected pension risk.
It is mathematically false in general that expected compound returns equal the power of the expected rate for a fixed but random interest assumption. Genuine product probability weights, not a definition of independence as the desired conclusion, support the two-year factorisation. For a regular savings fund, the contribution is invested with the previous fund, so the second moment includes a cross term twice the contribution times the prior expected fund. The variance has to be derived from the two independently defined moments with positive gross-return second-moment bounds. All signs and independence restrictions should be preserved at every step.
Fixed stochastic-rate model and independent annual returns are distinct mathematical constructs in this model. A future substantial probability model could construct fully independent n-year return families and an exact savings accumulation probability distribution, rather than stopping at the two-year product law. The present source has nontrivial results because it independently calculates both moments of an actual joint scenario distribution and reconciles the cross terms in the savings fund variance. Existing stochastic insurance claims calculations alone do not provide an investment growth scenario model. This finite product model and fund recursion are reusable for defined contribution pensions, insurance asset adequacy testing and later cashflow simulations.
For a random interest rate sampled once at issue and held fixed, the expected n-year accumulation is an expectation of a random power, not generally a power of the expected return. If annual investment returns instead vary independently, the gross growth factors are multiplied across years and their expected product factorises. This mission proves the two-year factorisation from genuine independent finite product-state probability masses, without taking independence to mean the target moment identity by definition. For regular savings, contribution timing matters because a beginning-of-period contribution earns that period's return. The second-moment recursion must therefore contain the mixed term twice the contribution times the previous expected fund. These identities provide an actuarial basis for testing pension fund accumulation and capital adequacy, but do not justify a normal or lognormal fund distribution merely from calculated means and variances.
The principal independence derivation is from an actual finite two-year product scenario model, while the general n-year variance is stated as an explicit algebraic moment-factorisation law. Deriving n-way stochastic independence under a full probability measure, lognormal approximate fund distribution and path-dependent contributions remains work for subsequent substantial probability theory. No normal approximation or lognormality is assumed from mean and variance alone. These open theorem targets are not accepted proofs.
These are original derived finite/analytic Actuarial formalisation targets rather than reproductions of a numbered textbook theorem. Exact Lean binder declarations are authoritative. The complete source uses targeted Mathlib imports and no local Lean compilation. All proof bodies remain genuinely open and do not constitute accepted results. Assumptions about negative rates, survival, policyholder independence, discounting and benefit timing must be preserved exactly.
Unit-linked life and pension policies require careful accounting for where gross premiums go, which underlying fund units are purchased and which charges are received by the insurer. The FCA's unit-linked review identifies allocation, management, surrender and other policy charges as distinct insurer cashflows. Earlier actuarial missions XLVI and LXIX already formalise simple unit funds and guarantees, but lack explicit offer/bid unit pricing and a fully reconciled insurer non-unit profit signature.
A policyholder pays a gross premium, of which an allocation percentage is invested at the offer price and the remainder is retained by the insurer. Unit-holders value their existing holdings using the bid price. Management and fixed administration charges reduce fund assets; a guaranteed minimum death benefit creates an insurer mortality risk above the unit-linked fund. The insurer's non-unit account collects charges and premium differences and separately pays expenses, commissions and mortality guarantee strain.
The formalisation develops a connected set of actuarial identities, beginning with precise model definitions and ending with the prospective valuation result.
Cancelling no more units than held retains a nonnegative unit account.
A nonnegative surrender charge cannot increase the positive fund value.
Actual unit premium allocation and bid-offer cost reconcile with the insurer's separate death guarantee obligations and complete non-unit cashflow profit account.
Actual unit premium allocation and bid-offer cost reconcile with the insurer's separate death guarantee obligations and complete non-unit cashflow profit account.
As discussed in the FCA's unit-linked review, The target reconciles every gross premium unit purchase and retained amount; it values immediate bid-offer spread costs, decomposes guaranteed death benefits into the invested fund plus net insurer amount at risk, and establishes an independent non-unit profit cashflow balance. Additional supporting theorems make the risk discount present value additive across the profit signature, with correct timing of beginning-year premium allocations and end-year fund costs. This provides an exact starting point for insurance policy profit testing and the analysis of charge sensitivity.
Bid and offer prices cannot be interchanged: a unit bought at offer is valued at bid and a positive spread produces a real cost even with unchanged market prices. A premium allocation percentage is not identical to the percentage of bid value created. Death insurance cost is the excess guaranteed benefit above the fund, rather than the total benefit, because fund assets already cover the remainder. The non-unit income and the actual expenses/commission/insurance risk must be kept separate rather than silently netted inside fund performance. The proof must impose suitable positivity on offer prices and fund values.
Bid-offer spread and non-unit profit signature are distinct mathematical constructs in this model. A future extension will include surrender probabilities, partial withdrawal, guaranteed annuity options and stochastic policyholder behaviour, together with a non-unit reserve liability under the prospective profit-testing basis. The current identities are nontrivial because they distinguish bid-valued units bought at an offer price, actual management charges, underlying expenses and the top-up death cost. Existing unit account and zeroisation missions do not include all these separate components in one coherent insurer profit signature. The explicit fund and charge functions are reusable for product pricing sensitivities, reserve testing and financial reporting.
Insurance premiums credited to unit-linked funds are converted into units at the offer price, but the policyholder's fund is valued using the bid price. A positive spread therefore creates an immediate difference even when financial markets have not moved. Management fees and policy administration charges reduce the unit fund, whereas amounts charged to policyholders generate insurer non-unit income and are not synonymous with the actual expenses incurred. A guaranteed death benefit creates mortality cost only on the positive excess above the linked fund value; it would double-count fund assets to charge the full guaranteed amount as non-unit insurer cost. The non-unit profit signature then recognises unallocated premiums, spreads and management and administration charges less commission, expenses, additional death cover and any guarantee cost. Future cashflows are discounted year by year. These identities form a precise accounting model, not a regulatory determination of fair consumer value.
The mission develops one-period unit accounting and finite annual expected profit signatures. It is not a market conduct or compliance assessment of a particular insurer. Fund return and projected mortality are explicit model inputs and do not assert a complete stochastic-policy profit distribution. Complex paid-up terms, partial surrender and non-unit reserve zeroisation have related earlier mission infrastructure and require further integration. Every Lean theorem remains open.
These are original derived finite/analytic Actuarial formalisation targets rather than reproductions of a numbered textbook theorem. Exact Lean binder declarations are authoritative. The complete source uses targeted Mathlib imports and no local Lean compilation. All proof bodies remain genuinely open and do not constitute accepted results. Assumptions about negative rates, survival, policyholder independence, discounting and benefit timing must be preserved exactly.
General-insurance reserving methods must distinguish development of claim payments from changes in their price level. The IFoA inflation reserving guidance distinguishes implicit and explicit inflation adjustments. Its earlier claims reserving report identifies inflation and average cost per claim methods alongside standard chain ladder. Earlier actuarial missions LIII and LIX cover volume chain ladder and reserve variances but not these two methods.
Incremental claims are paid in calendar years determined by accident year plus development year. A strictly positive index converts nominal claims into a constant valuation-year price level before applying development factors. The projected real future claim payment is then reinflated to its expected future calendar-year cost. Separately, an average cost per claim development triangle and a count triangle project ultimate claim frequency and mean severity.
The formalisation develops a connected set of actuarial identities, beginning with precise model definitions and ending with the prospective valuation result.
A price index remains positive for growth greater than minus one.
Sufficient projected ultimate value gives nonnegative outstanding reserve.
The inflation-adjusted chain-ladder projection and the independently developed average-cost claim reserve both reconcile nominal cashflows, real development and ultimate claims without treating the projection as an observed fact.
The inflation-adjusted chain-ladder projection and the independently developed average-cost claim reserve both reconcile nominal cashflows, real development and ultimate claims without treating the projection as an observed fact.
As discussed in the IFoA claims-reserving literature, The target establishes exact no-loss conversion between nominal and real claims, proper telescoping between incremental and cumulative triangles, the composition of real development factors, and the multiplication of projected ultimate claim numbers by projected average severity. It then reconciles both ultimate and outstanding amounts in an independent combined capstone. A payment-year inflation assumption is distinguishable from a development-year link factor, which guards against projecting historical calendar-year inflation twice.
The proof must preserve accident-year, development-year and calendar-year indexing and impose positivity on every ratio's index, claim count and growth denominator before invoking any reconstruction identity. The dollar value of a claim that has already been paid must never be reinflated as if it were a future payment. Volume development and average-cost development use different denominators and cannot be conflated in a single grossing-up factor without an additional model assumption. The capstone reconciles separately constructed projections rather than defining reserves by the desired equality.
Historical inflation adjustment and claim-development factors are distinct mathematical constructs in this model. A future extension could integrate stochastic calendar-year inflation factors, accident-year trends, and parameter-estimation uncertainty into a single insurer liability distribution. The current exact algebraic target is nontrivial because it reconstructs nominal cashflows after applying conversion and development operations to independently constructed real and count-based projections. Known chain-ladder methods do not eliminate the need to prove that the resulting factors and projected reserve components reconcile. The finite triangle definitions and their transformations are reusable for other claims reserving methods, including tail development and multiple accident years.
A loss development triangle involves three separate notions of time: accident-year origin, settlement development lag and payment calendar year. Past inflation must be removed according to the actual payment year before development is extrapolated. Only after the real-valued development has been projected should future expected payment-year inflation be reinstated, and only once. A claim volume development factor does not represent a price inflation rate. The average-cost-per-claim method separately projects ultimate claim numbers and average claim sizes, then multiplies them. This decomposition distinguishes frequency development from claim inflation and severity development. The actuarial motivation is substantial, as long-tailed insured losses can have irregular calendar-year price patterns. The mathematical statements in this source are exact projection identities, not claims that past development patterns predict future claim payments without residual risk.
This is a mathematically exact deterministic claims triangle and projected cashflow formalisation, not a claim that chain-ladder assumptions hold for a particular line of business or that the selected inflation index is statistically correct. The index rate and link factors are model inputs, and the full stochastic process/reserve estimation error remains covered only in related Mack mission LIX. Interactions of separate inflation by payment type and stochastic calendar effects are future research problems. All Lean theorem bodies are open.
These are original derived finite/analytic Actuarial formalisation targets rather than reproductions of a numbered textbook theorem. Exact Lean binder declarations are authoritative. The complete source uses targeted Mathlib imports and no local Lean compilation. All proof bodies remain genuinely open and do not constitute accepted results. Assumptions about negative rates, survival, policyholder independence, discounting and benefit timing must be preserved exactly.
The Cramér–Lundberg model describes insurer capital invested in premium revenue while discrete random claims are paid at unpredictable arrival times. The model's classical adjustment coefficient and ruin probability are treated in risk theory and in modern ruin-probability bounds. Earlier mission LXXVIII derives a candidate ruin formula satisfying a renewal equation, but does not model the actual first-passage event. This mission supplies genuine stochastic first passage and measurable ruin events with an explicit stopped exponential-moment route to a rigorous bound.
Let W_j and Y_j be random waiting times and severities on a measurable probability space. At n-th claim arrival, cumulative elapsed time is the sum of W_0 through W_{n−1}, aggregate paid claims are the corresponding sum of Y_j, and the surplus is initial capital plus premium rate c times elapsed time minus claims. Ruin means surplus strictly less than zero and is only tested at claim boundaries, where a positive continuous premium slope allows a crossing to occur. The first-hit event excludes every earlier ruin, and its union over n is ultimate ruin.
The formalisation develops a connected set of actuarial identities, beginning with precise model definitions and ending with the prospective valuation result.
Larger capital cannot create pathwise ruin.
Observation of more arrivals can only increase probability of ruin.
The actual stochastic first-passage event and stopped exponential moment condition derive a nonvacuous ultimate Lundberg capital bound.
The actual stochastic first-passage event and stopped exponential moment condition derive a nonvacuous ultimate Lundberg capital bound.
The mission establishes a real measured probability of ultimate ruin, monotonicity under capital and arrival horizon, and a disjoint partition by the first claim causing ruin. It then uses a stopped exponential loss process and an explicit moment upper bound to derive a Lundberg inequality for finite and ultimate ruin probabilities. The auxiliary stopped expectation condition is an independent martingale-style hypothesis, not an assumption of the desired probability bound. This helps distinguish authentic probability claims from an explicit exponential candidate whose equation has been verified. The risk-theory literature motivates the exponential-capital tail.
Nontrivial probability analysis is required to link a finite first-passage indicator to a stopped exponential transform. The first-hit sum cannot count multiple ruin dates on the same path, and the no-ruin terminal term must appear exactly once. Strict ruin, equality at zero and an observed negative surplus require distinct treatment. The finite-horizon inequality then uses measurability, positivity of exponential loss and a moment expectation hypothesis. Passing to ultimate ruin requires the countable union of nested ruin events and probability measure continuity, without assuming the theorem's conclusion.
Existing actuarial theory establishes the analytical principle, whereas the formal work here must prove the stated identities in Lean using the true distribution and event definitions. Some prior mission targets describe finite distributions or a candidate valuation, but they do not establish these stronger infinite-support or measured first-passage results. The boundary assumptions are part of each mathematical statement and cannot be replaced by a tautological definition. A complete proof requires independent source lemmas, explicit handling of the limiting case and verification of every transformation before concluding the capstone.
The pathwise event uses a strict negative surplus, not failure on equality at zero. The first-passage index is a disjoint union of finite-arrival failure events, and the increasing union gives ultimate ruin. A conditional moment hypothesis provides a nontrivial route to an exponential capital inequality. It is not the same assertion as the inequality on the ultimate ruin probability. The model does not claim to establish the Poisson arrival distribution or full independence of exponential severities from this conditional input. Those must be proved in a later, more elaborate stochastic source model.
The capstone proves the conditional stopped-moment Lundberg inequality for an actual measurable first-passage event, not yet the complete exponential-claims distributional identification. Independent exponential waiting times and independent claim severities supply the classical route to the stopped moment hypothesis but are not themselves constructed or verified in this graph. A future mission should derive that moment condition from fully specified iid waiting and severity distributions and prove uniqueness of the exact ruin probability. The pathwise framework is reusable for continuous-time embedding, overshoot losses, first-passage service tables and capital assessment. All Lean proof obligations remain open.
These are original derived finite/analytic Actuarial formalisation targets rather than reproductions of a numbered textbook theorem. Exact Lean binder declarations are authoritative. The complete source uses targeted Mathlib imports and no local Lean compilation. All proof bodies remain genuinely open and do not constitute accepted results. Assumptions about negative rates, survival, policyholder independence, discounting and benefit timing must be preserved exactly.
Continuous-time multi-state life insurance uses a generator of competing decrement intensities and prospective reserves for status-dependent benefits. The time-dependent state equations appear in multi-state insurance research; Promislow (2015), Chapter 19, provides actuarial fundamentals. The existing LXXVI mission constructs general conservative generator rows but only solves the stationary alive/dead reserve. This mission adds time-varying competing risks and derives a genuine contingent-payment reserve from its cashflows.
Three mutually exclusive states consist of active insurance, termination by cause one and termination by cause two. The latter are absorbing. The common exit intensity is a nonstationary force λ(t)=a+bt with cumulative hazard H(t)=at+bt²/2. A fixed proportion p of the exit force belongs to the first cause; 1−p belongs to the second. Nonnegative a, b and future dates and p in the unit interval make the transition probabilities stochastic. The model admits two distinct termination payments, one for each cause, and a separately specified maturity endowment.
The formalisation develops a connected set of actuarial identities, beginning with precise model definitions and ending with the prospective valuation result.
Generator no-exit diagonal is minus total force.
Forward cause-two flow equals complementary hazard share times active membership.
A genuinely nonstationary three-state absorbing model conserves probability and its independently integral-defined prospective liability obeys the cause-contingent Thiele equation.
A genuinely nonstationary three-state absorbing model conserves probability and its independently integral-defined prospective liability obeys the cause-contingent Thiele equation.
The prospective reserve is an independently defined sum of a terminal-survival present value and a bona fide interval integral of the time-discounted, competing-exit claim intensity. The capstone proves its terminal boundary and differentiates it to obtain a nonstationary, three-status Thiele ODE, with an explicit cause-mix death strain. The result includes complete Chapman–Kolmogorov composition and transition normalisation for two absorbing exits. Research on multi-state actuarial equations explains how these equations fit into the broader general reserve framework.
The proof must establish a nontrivial inhomogeneous probability structure, not simply define reserve cashflows by the desired ODE. The cumulative-force derivative must be combined with the exponential survival chain rule, and the transition matrix must be composed across different calendar intervals. The integral of discounted cause-specific benefits must then be differentiated with a moving lower endpoint and a valuation-date-dependent exponential factor. Several steps rely on genuine interval integral differentiation and the finite-timestamp boundary conventions; no closed-form fixed-intensity substitution is assumed.
The model imposes fixed cause allocation while the total force changes with time. It therefore admits a genuine conditional transition matrix with two absorbing states. This provides a nonstationary counterexample to treating all transition intensities as constant; forcing an arbitrary time-dependent kernel to satisfy the desired generator equation by assumption would be vacuous. The interval-integral benefit value is independently defined before differentiating it. Its terminal boundary depends on the maturity payment, and no death benefit is payable at maturity beyond the contractual endpoint. The formalisation does not assume a general matrix-exponential formula for time-dependent noncommuting generators.
The mission establishes a nonstationary three-state absorbing competing-decrement model, not an arbitrary intercommunicating time-dependent finite-state generator or a semi-Markov duration-reset model. This restriction is important because its exact transition matrix and reserve integrals can be constructed without assuming the answer. Later actuarial missions can reuse the resulting conditional survivor functions and Thiele equation as a basis for disability recovery and wider inter-state transfers. Lean statements are open research targets, not accepted formal proofs, and the mathematical identity must be obtained from the originally defined valuation.
These are original derived finite/analytic Actuarial formalisation targets rather than reproductions of a numbered textbook theorem. Exact Lean binder declarations are authoritative. The complete source uses targeted Mathlib imports and no local Lean compilation. All proof bodies remain genuinely open and do not constitute accepted results. Assumptions about negative rates, survival, policyholder independence, discounting and benefit timing must be preserved exactly.
Actual insurer mortality and withdrawal observations are censored and may differ systematically with explanatory covariates. Cox's original 1972 proportional-hazards paper treats an arbitrary baseline hazard combined with covariate-relative-risk multipliers and constructs a conditional partial likelihood. Existing actuarial missions cover lifetimes, Kaplan–Meier/Greenwood and mortality graduation, but not regression risk-set estimation.
A life with scalar covariate z and regression parameter beta has hazard λ0(t) exp(beta z). The cumulative baseline hazard determines the survival function. At each distinct observed failure time there is a finite nonempty at-risk set, including the life that died, and censoring removes deaths that are not observed without treating them as failures. This mission assumes no tied failures in its conditional likelihood graph; more general Efron and Breslow ties require a separate coherent treatment.
The formalisation develops a connected set of actuarial identities, beginning with precise model definitions and ending with the prospective valuation result.
A zero covariate reduces to baseline survival.
A censored observation must not simultaneously be a failure contribution.
Cox covariates alter baseline hazard multiplicatively, survival stays within probability bounds, and the nontrivial risk-set score is derived as the derivative of the conditional partial likelihood.
Cox covariates alter baseline hazard multiplicatively, survival stays within probability bounds, and the nontrivial risk-set score is derived as the derivative of the conditional partial likelihood.
The mission formally separates a common arbitrary baseline hazard from the relative hazard of each observed insured life. The partial likelihood uses event-specific risk sets, not a single fixed cohort denominator, and the model derives the true conditional event probabilities and analytic score from the independently defined likelihood. As in the original Cox model, the mathematical outcome provides essential foundations for credible, covariate-sensitive life contingent predictions and statistical mortality investigations.
The risk sets must remain nonempty and include observed failures when interpreting their shares as probabilities. Finite products with changing risk sets combine with a log-likelihood that is differentiated using an exponential weighted denominator. The central theorem must obtain the score from a derivative and must not define score equality as a model axiom. Positive covariate multipliers and boundary survival values are derived separately. The model does not assert a numerical maximum likelihood estimator exists without concavity or identifiability conditions.
The conditional partial likelihood is based on one observed failure at a time. Each event has its own finite risk set. A life censored before the event time is excluded from that later set, but an individual censored after the time remains exposed at that instant. Censoring patterns therefore change the risk sets, even though the baseline force drops out of the conditional event ratio. With a scalar coefficient, this model is an actuarially meaningful specialisation of the Cox regression formulation. The score derivative is substantive because its risk-weighted average contains the current coefficient in both the numerator and denominator. The numerator and denominator must each be differentiated, the denominator must remain strictly positive and the log derivative must not assume the target identity. Only after these facts have been proved can the formula for the score be justified. Extending the analysis to a score vector and information matrix would involve covariance matrices weighted by dynamic risk sets, and the nonnegativity of observed information is not a pointwise algebraic identity without proper hypotheses. Reusable consequences of this foundation include estimation with life-assurance underwriting covariates, statistical investigation of pensioner mortality, cause-specific decrements and a later treatment of time-dependent covariates. This graph deliberately treats distinct failure times rather than asserting a tied-events formula that has not yet been formally justified; Efron and Breslow corrections motivate future work, not assumptions of the current model.
The model treats a single scalar covariate and untied observed failures. It neither assumes a parametric distribution for the baseline mortality force nor confuses censored lives with observed deaths. It does not prove martingale asymptotics, proportional-hazard diagnostics, time-varying regression coefficients or Efron tied-event corrections. These are legitimate larger follow-on missions. Its theorem statements and source are unproved formal targets.
These are original derived finite/analytic Actuarial formalisation targets rather than reproductions of a numbered textbook theorem. Exact Lean binder declarations are authoritative. The complete source uses targeted Mathlib imports and no local Lean compilation. All proof bodies remain genuinely open and do not constitute accepted results. Assumptions about negative rates, survival, policyholder independence, discounting and benefit timing must be preserved exactly.
Panjer recursions allow compound claim distributions to be computed without enumerating many severity convolutions. The original Panjer paper and the Sundt–Jewell family extension establish the actuarial context. The previous LXXVII mission covers finite-support frequency distributions with zero claim amounts. Here the claim count ranges over all nonnegative integers, so correct series convergence and coefficient interchange become new formal obligations.
Let N be Poisson with claim count intensity λ≥0 or geometric with parameter q in [0,1). Independently distributed claim severities are nonnegative integer valued, with pmf f_j and possibly f_0>0. For each claim count n, the distribution f^{*n} is formed using genuine convolution; the empty portfolio assigns mass one to zero. The compound mass g_k is defined as the infinite sum of p_n times the n-fold convolution coefficient, independently of any Panjer formula.
The formalisation develops a connected set of actuarial identities, beginning with precise model definitions and ending with the prospective valuation result.
True infinite aggregate mass is nonnegative.
Compound Poisson zero mass comes from thinning.
The genuinely infinite Poisson and geometric aggregates obey their independently derived corrected Panjer laws.
The genuinely infinite Poisson and geometric aggregates obey their independently derived corrected Panjer laws.
The capstone derives both infinite frequency families' entire positive-aggregate recurrence. For Poisson frequency the kernel includes a severity-size factor λj/k; for geometric frequency it contains an essential zero-claim correction 1−qf_0. The zero aggregate mass itself is the count PGF evaluated at severity f_0, not merely the probability of having no claims. The 1981 ASTIN literature underpins these equations, while a countably supported Lean formalisation makes their analytic conditions explicit.
Unlike the finite claim count in LXXVII, an infinite frequency model requires genuine convergence before double series may be rearranged. Proving the Poisson and geometric frequency normalisations is distinct from proving convergence of the actual aggregate pmf. At a fixed amount k a finite inner convolution remains, but summation over the count n is infinite. The nontrivial step is justifying probability-generating function composition and extracting the correct severity coefficients without assuming the desired recurrence or silently truncating Poisson claims. Special cases with all claim sizes zero are included.
Existing actuarial theory establishes the analytical principle, whereas the formal work here must prove the stated identities in Lean using the true distribution and event definitions. Some prior mission targets describe finite distributions or a candidate valuation, but they do not establish these stronger infinite-support or measured first-passage results. The boundary assumptions are part of each mathematical statement and cannot be replaced by a tautological definition. A complete proof requires independent source lemmas, explicit handling of the limiting case and verification of every transformation before concluding the capstone.
The generating-function series is defined from the probability mass of each count; the count law is genuinely infinite, not a finite upper cutoff with a hidden tail. In particular, the positive Panjer recursion cannot be used to define its own aggregate coefficients: the aggregate mass must first be constructed from convolution powers and the count weights. At claim size zero, the event of positive frequency with all zero-valued claims contributes to the true aggregate zero probability. Geometric count and Poisson count require distinct coefficient functions, even though they share the same actuarial notation for the severity distribution.
This mission addresses actual infinite Poisson and geometric count laws, with arbitrary properly normalised discrete severities. It does not cover noninteger-shape negative-binomial frequency, complex-domain analytic continuation or continuous claim sizes. The formal target makes probability nonnegativity and summed severity mass explicit, and all Lean proofs remain open. The resulting count/compound transforms can be reused in later collective-risk, stop-loss and capital modelling applications. It deliberately excludes vacuous proof strategies that define the aggregate distribution as the recurrence answer.
These are original derived finite/analytic Actuarial formalisation targets rather than reproductions of a numbered textbook theorem. Exact Lean binder declarations are authoritative. The complete source uses targeted Mathlib imports and no local Lean compilation. All proof bodies remain genuinely open and do not constitute accepted results. Assumptions about negative rates, survival, policyholder independence, discounting and benefit timing must be preserved exactly.
Actuarial claim counts and average costs depend on policy exposure, customer characteristics and risk-factor selection. The foundational Nelder–Wedderburn GLM formulation derives exponential-family maximum likelihood through a predictor and link, including Poisson count and Gamma response examples. Existing actuarial missions cover finite exposures and rating relativities, but not a unified log-likelihood score, information and deviance calculation.
An exposed group contributes E positive insured person-years. The count predictor η produces expected claims μ=E exp η, so log exposure is a compulsory offset rather than a fitted regression coefficient. The model defines observed claims per exposure, the Poisson log-likelihood up to a response-only factorial constant, its scalar score, expected information and saturated deviance. A separate Gamma mean and variance model describes positive insurance severity.
The formalisation develops a connected set of actuarial identities, beginning with precise model definitions and ending with the prospective valuation result.
Nonnegative frequency and severity produce nonnegative pure premium.
Poisson log-likelihood attains a global maximum at the fitted canonical count for strictly positive observations.
A genuine positive-exposure Poisson GLM has the correct canonical offset, score and Fisher derivative, nonnegative saturated deviance and consistent severity-loaded insurance premium.
A genuine positive-exposure Poisson GLM has the correct canonical offset, score and Fisher derivative, nonnegative saturated deviance and consistent severity-loaded insurance premium.
Following Nelder–Wedderburn, the capstone derives the Poisson model's canonical offset, identifies the score as a genuine derivative of the log-likelihood, and proves that its derivative is negative Fisher information. A nonnegative deviance measures disagreement with saturated data and integrates with multiplication of expected frequency and severity to obtain the insurer's pure premium. This is the mathematical basis for estimating tariff frequency relativities and verifying model fit.
A real-valued logarithm is not automatically the log of a positive expected count: exposure positivity must be explicit. Count zero is handled with a separate non-log-deviance expression, avoiding undefined logarithmic ratios. The score and information identities must follow by differentiation rather than by an assumed GLM normal equation. It is a nontrivial analytic task: a vacuous definition of a zero score would not establish any likelihood derivative. The deviance inequality uses the logarithmic convexity inequality and requires positive expected and observed claims, while the finite exposure boundary avoids any mistaken claim of an informative zero-exposure observation.
The Poisson GLM score is the derivative of a log-likelihood rather than an arbitrary residual statistic. The exposure offset shifts the logarithm of expected claim counts, so changing exposed policy-years modifies the fitted expected count without changing the per-exposure class rate. This is a defining issue in insurance rating where two policyholders with the same expected annual frequency can have different months insured. The score derivative gives the negative Fisher information, leading to the familiar concavity of the scalar canonical log-likelihood under positive exposures. Identifying a maximum-likelihood estimate, however, also requires adequate observed data and a nondegenerate model: at zero observed claims, the MLE can be approached only as the predicted rate tends to zero, not necessarily at a finite linear predictor. The scaled deviance measures disagreement with saturated data; it is nonnegative by the logarithmic inequality when observed and fitted counts are strictly positive. The zero-count case has to be handled by a limiting convention outside the positive-count formula. This is actuarially material in sparse claim classes and high-frequency policy segments. Gamma severity uses a different conditional variance function, so its dispersion and positivity conditions are not inherited directly from the Poisson count model. This graph is a reusable foundation for multivariate tariff construction, fitted pure premiums, exposure offsets and later iterative weighted regression algorithms. Its source model follows Nelder and Wedderburn while making every claim-count positivity hypothesis explicit.
This is the scalar Poisson frequency and Gamma severity foundation, not a full numerical fitting algorithm or a general matrix-valued IRLS solver. The categorical design matrix, multivariate coefficient normal equations, dispersion estimation, residual-based diagnostics and parameter-inference asymptotics are reserved for follow-on missions. There is no assertion that positive claims always exist or that every rate model is identifiable. All Lean proof statements remain open.
These are original derived finite/analytic Actuarial formalisation targets rather than reproductions of a numbered textbook theorem. Exact Lean binder declarations are authoritative. The complete source uses targeted Mathlib imports and no local Lean compilation. All proof bodies remain genuinely open and do not constitute accepted results. Assumptions about negative rates, survival, policyholder independence, discounting and benefit timing must be preserved exactly.