Specialisation Loss: Avoidable Classical Dependence from Correctly-Stated Lemmas

norm_num closes (2 : ℤ) ≤ 4 through Classical.choice. decide and simp close the same goal without it, and norm_num closes (2 : ℤ) + 2 = 4 without it. The dependence enters through lt_or_eq_of_le : a ≤ b → a < b ∨ a = b, which is stated for a general PartialOrder where equality is not decidable and whose appeal to a classical instance is therefore correct. Nothing in that chain is a mistake.

This paper is about that class of defect: a general lemma, correct as written, invoked by a caller that already carries the stronger hypothesis the specialised form would need, and never uses it. Call it specialisation loss. It is distinct from a procedure naming a classical instance outright, and it is harder to repair, because there is no incorrect line to point at.

The claim of the paper is that specialisation loss is a cross-system phenomenon rather than a fact about one tactic. It is exhibited in Lean, where norm_num inherits classicality from an order lemma; and in Metamath's set.mm, where four separate proofs establish that a set is finite or countable and then invoke a lemma stated for an arbitrary domain — imadomg where imafi applies, fodomg where fodomfi applies, abrexdom2jm where abrexct applies, and fnrndomg where the well-orderable form does. In two of the four the required fact was proved by the same proof, hundreds of steps earlier, and discarded.

The instances in set.mm were repaired and submitted to that library, so the diagnosis is testable rather than interpretive. Dominator analysis supplies the quantity: the order-lemma cluster norm_num routes through is uniquely responsible for 2,018 Mathlib theorems, and the four set.mm repairs free 38, 29, 12 and 9 respectively — figures that deliberately are not added, for reasons §4 sets out.