The Axiom You Can't See — A Machine-Checked Trust Boundary, and the False One It Caught

MachLib runs on axioms. The last post showed Mathlib's ℝ models each one, by hand. This post makes that an always-on invariant: enumerate the axioms from the kernel, decide 'witnessed' by typechecking an interpretation — never by name — and diff both directions so it fails loud. The teeth were real: the audit rejected an axiom that was actually false, an open-interval Rolle a name-matching check…