[Lean] Derive #540's pending ranges from the PR442 schedule (stacked on #540; no new kappa)

[Mister-Meeseeks]

Stacked on #540 (base branch stack/pr540-base = #540 head acc19170). Once #540 lands, this PR retargets to main. It adds one directory, research/lean-pending-derivation/. No #540 file is changed, so #540's hashed manifests and receipts stay valid.

What it closes

#540's PhysicalSourceConnection.pendingTag supplies the pending ranges [15,22) and [1,29) by hand. Its README notes that "neither Lean nor the source-extraction check binds these ranges to the source schedule". #1228 derived them in Python. This PR does the derivation in Lean 4.21 and proves it equal to #540's actual definition.

Theorems

All are proved by decide, using only propext and Quot.sound (some use no axioms).

• PendingDerivation.idle_ranks_and_nesting: for all 10 idle events, levels nest and the derived pending size equals the scheduled rank.
• pending_child1 / pending_child2: [15..21] and [1..28].
• hosted_windows: for all 16 tags, stage 2 is in the child's window, the host pair is not pair 0, and offset+width ≤ |pending|.
• target_derived: every extracted targetMask is exactly the [offset, offset+width) slice of the derived pending axes. This also checks the extractor's hard-coded bases.
• PendingBinding.pendingTag_derived and pending_eq_derived: [Lean] Verify one literal PR442 invocation against the multi-host contract #540's pendingTag and pending equal the derived masks.
• PendingBinding.selected_invocation_completion_derived: [Lean] Verify one literal PR442 invocation against the multi-host contract #540's completion theorem, restated with the derived mask.

Definitions: L₋₁ = {0}, L_ℓ = [0,8) ∪ E₁ ∪ … ∪ E_ℓ (E_s = exterior axes of the stage-s route), pending = L_target \ L_source, and windows follow PR442's last-touch rule. The schedule and blocks are a Python-extracted literal (generate_pending_schedule.py --check, byte-exact against #540's pinned inputs). This is the same trust boundary as #540's other literals.

Six mutation controls each fail because decide refutes the mutated statement:

• L₋₁ empty;
• L₋₁ set to the whole local block;
• exterior blocks off by one stage;
• the first two blocks swapped;
• child 1 advanced before the selected call;
• child 1 claimed on the previous block.

Not covered

• The level model is a definition. Its agreement with the PR386 frames (L₋₁ = span(q) in the B_port ⊕ I₅₆ chart) is not proved. It is constrained only by ranks, nesting and the extracted target masks.
• Ascending axis order within a child is the offset convention shared with [Lean] Verify one literal PR442 invocation against the multi-host contract #540's extractor.
• Only one invocation is covered. No cost, all-size or κ claim.

Reproduce

cd research/lean-multi-host-source && lake exe cache get <the five Mathlib modules in BUILD.md>
lake build PhysicalSourceConnection     # 3m24s measured on Apple silicon with the Mathlib cache
cd ../.. && python3 research/lean-pending-derivation/verify.py   # ~17 s, prints PASS_PR540_PENDING_RANGES_DERIVED_IN_LEAN

verify.py runs the generator check, compiles the three modules against #540's build through lake env, audits the axioms of all seven theorems and runs the controls.

Credit: the Lean formalization, ownership literals and gap identification are cheesegrader's #540. Construction and hosting are from #434/#442, and the bit geometry is from PR386. The Python predecessor is #1228. Prepared by Douglas Colkitt with substantial Claude (Anthropic) assistance. Apache-2.0.

🤖 Generated with Claude Code

[Mister-Meeseeks]

100-PR batch review at 448690c3b7e5c2b5975b760075b162fe0a8cfb03.

This remains open after scoped triage. Next review step: Lean contribution needs pinned dependency preparation, full module build, source binding and axiom/mutation checks. Python extraction alone is not formal acceptance; keep separate from selected theorem claims.

This is a specific continuation point, not a rejection or a request to redo already recorded checks. Completed local evidence is retained separately from outstanding whole-head obligations.

Batch review, attribution and evidence. Thank you for the contribution.