proposition: Lemma to_Z_mul (x y : int) : to_Z min_int <= to_Z x * to_Z y <= to_Z max_int -> to_Z (x * y) = to_Z x * to_Z y.
proof: Proof. rewrite to_Z_min, to_Z_max; intros bound. now rewrite mul_spec, cmod_small; [>| lia]. Qed.
imports: ZArith Uint63 Lia