Finishing Oltean's Completeness Proof in Lean 4 for Hybrid Logic $L(\forall)$

Abstract: We present a machine-checked completeness theorem, in Lean 4, for the hybrid logic $L(\forall)$: propositional modal logic with nominals, the satisfaction-style binder $\forall$, and the box modality. (Machine-checked completeness for basic hybrid logic, without binders, was pioneered by Asta Halkjær From in Isabelle/HOL.) We build on Alex Oltean's 2023 Lean 4 formalization, which mechanized the syntax, semantics, Hilbert-style proof system, and soundness following Blackburn's Hybrid Completeness (1998), but left completeness unfinished. Finishing it requires manufacturing fresh names at two structurally different points, and our central finding is that they call for two different tools. (1) The root witnessed maximal consistent set, built by an extended Lindenbaum construction, needs at each step a nominal fresh for the whole set; the right tool is structural freshness: extend the language so an infinite supply of nominals is reserved by construction. We survey the design space (Oltean's odd/even encoding inside $\mathbb{N}$, the disjoint-sum $N \oplus \mathbb{N}$ parameterization suggested by Bud Mishra, and From's synthetic-completeness frameworks) and explain the encoding we adopt. (2) The witnessed $\Diamond$-successor of a maximal consistent set cannot be obtained this way: its canonical box-reduct provably mentions every nominal, so no reserved name is fresh. Here the right tool is one Oltean chose but left incomplete: an existence-lemma Henkin construction drawing each witness from the predecessor's witnessedness through a fresh state variable; we complete it with a data-carrying witness accumulator and a compactness argument. The theorem $Γ\models \varphi \to Γ\vdash \varphi$ is fully formalized: the development is sorry-free, and #print axioms reports only propext, Classical.choice, and Quot.sound. We port the development to Lean v4.30.0 / mathlib v4.30.0.

• The paper delivers the first machine-checked completeness proof for hybrid logic L(∀) in Lean 4, bridging gaps in previous formalizations.
• It refactors Oltean’s unfinished Lean development by resolving issues with Henkin witnesses and ensuring nominal freshness through structural recursion.
• The work introduces novel representation techniques, such as odd/even encoding, to achieve tractable and conservative proof assistant mechanization.

Formalization and Completion of Hybrid Logic $L(\forall)$ Completeness in Lean 4

Introduction and Main Accomplishments

The paper "Finishing Oltean's Completeness Proof in Lean 4 for Hybrid Logic $L(\forall)$" (2606.19761) delivers the first fully formalized, machine-checked completeness theorem for the binding hybrid logic $L(\forall)$ in Lean 4. The logic $L(\forall)$ augments standard propositional modal logic with nominals, a satisfaction-oriented universal binder (quantifying over state variables), and the modal box operator. This formalization completes and repairs the substantial but unfinished Lean 4 development by Oltean (2023), addressing the formalization challenges around Henkin witnesses, nominal freshness, and language expansion that stymied the original effort.

The notable contributions include:

1. Porting and Refactoring: The entire codebase, previously written for a 2023 Lean nightly, is refactored for Lean 4.30.0 and mathlib v4.30.0, absorbing extensive API churn and making extensive use of structural recursion and representation-invariant refactoring.
2. Technical Closure: The completion of witnessed Lindenbaum and existence-lemma (witnessed successor) constructions closes all critical 'sorry' or incomplete proof obligations in Oltean's proof architecture, rendering the development sorry-free modulo propext, Classical.choice, and Quot.sound.
3. Design and Documentation of Freshness Mechanisms: A comprehensive analysis of the design space for encoding nominal freshness is given. Key representation choices—structural even/odd distinction for nominals, as opposed to dynamic name search or abstract fresh operators—are shown to be pivotal for mechanization efficacy, not just mathematical correctness.
4. Canonical Model Construction: The existence and truth lemmas for canonical models in $L(\forall)$ are fully formalized, and all subtle issues about binders and witnesses (not present in non-binding hybrid logics) are settled within Lean.

Structure of the Proof and Formalization Approach

Logic and Proof System Features

• Hybrid Signature: The logic is formulated over countable sets of propositional symbols, state variables, and nominals— each nominal interpreted as true at a unique world.
• Formulas: Extend modal logic with nominals (naming states), satisfaction operators, the universal binder $\forall x\varphi$, and modalities.
• Semantics: Kripke frame semantics with explicit state assignment for variables and nominals; binders interpreted via variant assignments.
• Syntactic System: A Hilbert-style system with full support for binder, modal, hybrid, and classical rules, including relevant Barcan-type and satisfaction axioms.

Completeness Argument Outline

• Lindenbaum Construction: Extend any consistent set to a maximal consistent set (MCS) using countable enumerations over formulas and Henkin-style language expansion.
• Witnessing for Existential Binders: For every existential $\,\exists x. \varphi\,\in\,$MCS, a corresponding nominal $i$ is needed such that $(\exists x. \varphi) \rightarrow \varphi[i/x]$ is in the MCS—tightening the canonical model for the binder.
• Freshness Problem: In dependent type theory (Lean, Coq), infinite global "fresh" supplies are nontrivial: dynamically searching for unused names is prohibitively complex for infinite objects in the type-theoretic setting.

Structural Freshness Resolution

The central insight—credited to Mishra and found tacit in Oltean and From's works—is to guarantee freshness structurally:

• Disjoint Sum Parameterization: Formulas are parameterized by a nominal type, and for the Henkin expansion, a disjoint-sum $N + N$ is constructed; all witnesses are taken from the second summand, trivially ensuring disjointness from the base language.
• Odd/Even Encoding: Implemented as mapping nominals $L(\forall)$0 to $L(\forall)$1, reserving all even-numbered nominals for witnesses, eliminating the need for dynamic search.
• Abstract Name Supply: More general frameworks (as in From's Isabelle/HOL synthetic completeness) implement abstract 'fresh' operators, but these are not adopted in this Lean formalization.

A pivotal empirical finding is that not only was the foundational idea correct, but the encoding method (using sorted, deduplicated lists versus direct structural recursion) crucially determines tractability of downstream homomorphism and preservation lemmas in proof assistants.

Implementation Solutions

• Witnessed-ness Construction: A recast existing-lemma pipeline constructs witnessed MCSs for binder logic, using variable-based (not nominal-based) stepwise Henkin witnesses for modal and binder successors where no disjoint nominal supply suffices.
• Data-Carrying Accumulator: For induction in successor constructions, witness lists are carried as actual data, not just existential proofs, enabling compactness arguments and preserving stepwise structure.
• Conservativity and Theorem Preservation: The model construction explicitly proves that language expansion by totalization (renaming nominals structurally) is conservative for syntactic entailment, using robust elimination of "alien" nominals.

Numerical/Technical Results

• Development Size: ~7,200 lines of Lean 4 code, organized into 17 interdependent modules, fully sorry/admit-free (apart from foundational axioms) as verified by the Lean kernel.
• Proof Graph Resolution: All architectural nodes—witnessed Lindenbaum, existence lemma, language extension conservativity, canonical model, truth lemma—pass Lean elaboration with no open proof obligations.

Contradictory and Bold Claims

The paper provides a strong refutation of the idea that the primary mechanization challenge lay with the mathematical novelty of $L(\forall)$2. Instead, it asserts:

"The recurring lesson of this development is that the mathematical ideas were settled—the difficulty lived almost entirely in representation choices..."

and

"...finishing the proof was largely a matter of choosing the representation, not grinding against it."

Crucially, the paper demonstrates that for the modal/binding hybrid logic completeness arguments, at least in non-abstract settings, the choice of explicit list manipulation in substitutions vs. structural recursion can make or break the tractability of a Lean formalization.

Implications and Future Work

Practical

• Reusability: The structural freshness and existence-lemma logic is largely logic-generic and thus provides a base for further mechanizations of completeness in Lean for a wide class of modal, temporal, and hybrid logics with binders.
• Proof Assistant Methodology: The findings emphasize the necessity of aligning proofs with representation-invariant recursion and structural properties rather than "natural" but mechanically brittle encodings for formal verification.

Theoretical

• Completeness Metatheory: The formalization closes the gap for binding hybrid logics, allowing further exploration of finite/compactness refinements (e.g., finite nominal supplies and strong completeness variants) and connections to frameworks such as Matching Logic.
• Framework Generalization: The techniques may support polyadic, many-sorted, and more expressive description logics in the Lean ecosystem, paralleling synthetic or abstract completeness work elsewhere (as in From's Isabelle/HOL generalization).

Potential Future Directions

• Finite Nominal Analysis: Characterize the boundaries at which finite nominal reserves suffice for completeness, strengthening compactness-based metatheorems.
• Additional Binders: Extend and verify the approach for hybrid logics with further binder constructs—particularly those arising in description logic and matching logic contexts.
• Lean Completeness Library: Abstract and package the language-extension and witnessed Lindenbaum machinery as reusable Lean libraries to facilitate completeness mechanizations for a broader class of logics.

Conclusion

The paper decisively completes the machine-checked proof of the completeness theorem for $L(\forall)$3 hybrid logic within Lean 4, resolving technical encoding and mechanization issues left open by previous efforts. The clearest outcome is a methodological one: effective proof assistant formalizations for contemporary modal or hybrid systems require both classical logical insight and vigilant attention to data representation and recursive encoding invariants. The techniques here set a precedence for future formal metatheory of logics with hybrid and binding constructions in type-theoretic proof assistants.