Register the HPE post-wrapper uniqueness lemma (drawn card formal-interface-lemma)

[navinor]

Register the HPE post-wrapper uniqueness lemma (drawn card formal-interface-lemma)

One focused research package, research/hpe-post-wrapper-lemma/: one interface lemma formalized with its actual hypotheses, plus an exact source-bound instance binding. No kappa, supplier, or selected-frontier change.

Task and scope

Drawn card formal-interface-lemma (chooser seed 80692bf8777fc3a7d12b201233cd6ae2, track independent-verification, priority revision 6, scope key 636f26dec98e26b296e8), method "Formalize a missing boundary lemma identified by the selected review." Scope status: unchanged. Base commit d8e0f83f00191df62174b641e9fff055c357f641. Branch research/agent-84-hpe-post-wrapper-636f26de-80692bf8, head ae6dcf7e04de89198f8cd5321766d62bf6ee187b.

Saturation handling: census readings of this heavily drawn card are saturated (an OR-mode find_overlap.py run returned 201 possible matches on 2026-10-16T20:38Z, the first 20 all local original_card rows of prior packages on the same card). The construction reading the drawn method names is unpriced: research/hyperplane-end-lean/HyperplaneEnd/Labels.lean proves only factor_iff_pre, and no package states the post-side uniqueness or its phase-sharp form. That reading is what this PR takes.

The gap and the lemma

The hyperplane-end interface proves factor_iff_pre: with the exact factorization T_U T_E^{-1} = L (C7 (x) id) R holding for a certified pair (E, U), the executed pre wrapper must be the recipe's R. The integration review docs/research/community-hyperplane599-review.md requires both pre and post wrappers to use the pair (E, U) rather than E alone, but no post-side counterpart exists in the Lean sources or in any research package.

Lemma (post-wrapper uniqueness, phase-sharp). Assume (N) holds for (E, U) with invertible monomial wrappers L, R. For any invertible wrapper L' and scalar lambda, the identity L'^{-1} T_U T_E^{-1} R^{-1} = lambda (C7 (x) id) holds if and only if L' = lambda^{-1} L. In particular the identity at lambda = 1 (hypothesis (F)) holds exactly for the (E, U) recipe's L; a FULL recipe or any other post wrapper breaks it. Within the gate family lambda is a power of i, and the wrapper record's phase field is decisive: L' = i^{t} L satisfies the identity with lambda = i^{-t} and no other.

Proof: substitute (N) to get (L'^{-1} L - lambda I)(C7 (x) id) = 0; C7 is invertible, so L'^{-1} L = lambda I. The converse is direct. The proof uses (N), invertibility of L' and C7, and equality as linear maps with global phase included; that phase exactness is why lambda is the entire freedom. The symmetric pre-side form with lambda strictly extends factor_iff_pre and is stated but not claimed here.

Not claimed: no Lean kernel proof of the lemma (written proof plus exact Python binding only); nothing about the other conjuncts of hrec (climbs, tail shape, unit row, footprints); nothing beyond the three certified pairs; no multiplication theorem.

Evidence

verify.py reads the pinned literals of HyperplaneEnd/Exact.lean and evaluates them with an independently written exact gate semantics over Gaussian integers (the documented five gate kinds, C gates without their 1/2, denominators 2^{#C} compared exactly; no floating point; packed superposition gives all columns at once, witnesses decoded exactly).

For each of the three certified pairs pair1 to pair3:

• port controls: our adjoint, GF(2) inverse, and composition conventions reproduce the kernel literals lhsLit, rhsLit, wL, wR, and the permutation matrices are mutual inverses on all 512 basis states;
• positive fixture: L^{-1} T_U T_E^{-1} R^{-1} = C7 (x) id exactly, phase included;
• width guard: the identity fails against C8 (x) id;
• nine declared one-field wrapper mutants: three phase mutants hold at exactly their lambda form and no other; five wrong wrappers (offset, linear-Z4, live quadratic bit, matrix row swap, swapped L/R) break all four powers of i, each with an exact row and column witness; one record-dead quadratic bit is inert and correctly accepted;
• --self-test failure control: a self-consistently corrupted wrapper literal is rejected by the same pipeline.

One observed nuance is recorded in the README: the documented qv semantics reads a diagonal row Q_i only through bits above position i, so low-triangle bits are record-dead. Two wrapper records differing only there denote the same operator, which a byte-level recipe comparison would wrongly reject.

Registered replay (Python 3.12, stdlib only):

• python3.12 scripts/research_package.py --package research/hpe-post-wrapper-lemma ends with PASS_REGISTERED_RESEARCH_PACKAGE research/hpe-post-wrapper-lemma outcome=completed;
• python3.12 scripts/research_package.py --package research/hpe-post-wrapper-lemma --check-only prints PASS_PACKAGE_METADATA_AND_PINS (not a mathematical acceptance check);
• python3.12 scripts/check_research_commit.py --package research/hpe-post-wrapper-lemma prints PASS_RESEARCH_COMMIT_BYTES for commit ae6dcf7e04de89198f8cd5321766d62bf6ee187b.

Evidence status: author-checked exact arithmetic with a separately written semantics port; no independent human review and no Lean kernel check of the new lemma.

Open next questions

The package README carries the structured questions: kernel-checking factor_iff_post beside factor_iff_pre (blocked by no Lean toolchain here and frozen predecessors); extending the binding to cold E = 0 pairs and multi-gate tails (blocked by the absence of cold (N) literal pairs and of vendored emitted runs); and whether record-level wrapper comparison should be relaxed to operator equality on dead quadratic bits (shared-tool change, needs maintainer review).

Credit and attribution

Verified against current GitHub ground truth: PR 593 by Jeremy Kothe (jeremykothe2), PR 599 by DreamingOfClouds, PR 591 and PR 596 by Jeremy Kothe, PR 2706 by Riquelme Soares (hevlyo), PR 1697 by Aaron Wang (navinor). Predecessor research/hpe-prewrapper-binding stated the pre-side boundary implication and explicitly deferred its arithmetic; research/hpe-wrapper-event-binding binds emitted wrapper events to the Lean literals at record level. This PR adds the missing post-side statement, its phase-sharp form, and the deferred exact arithmetic on the certified instances.

Prepared by Aaron Wang, with help from opencode (substantial AI assistance; no model named). Discussion claim: comment 18982589. Apache-2.0.