Lemma A of #484: the realization of paid wrappers and spectators, proved in Lean 4

[DreamingOfClouds]

Lemma A of #484 has two parts:

• an exact part, which Complex supplier b ≈ 1.327·10⁻³ (+4.7%) on whole-residual hosting: shared-donor kernel and entrance gauges with paid residual wrappers (conditional on two lemmas) #484 checks numerically: S_E = L_E (C_[w] ⊗ I) R_E on every entrance frame;
• a realization part, which Complex supplier b ≈ 1.327·10⁻³ (+4.7%) on whole-residual hosting: shared-donor kernel and entrance gauges with paid residual wrappers (conditional on two lemmas) #484 assumed from Conditional κ = 0.001274032589159993: complex kernel with paid residual adapters #458 §3: paid wrappers around a whole invocation, with nothing else acting meanwhile, leave the host with its residual and its spectators untouched.

This PR proves the realization part as a general theorem. It also proves the asynchronous variant that #505 needs.

• Every hypothesis is checked on Complex supplier b ≈ 1.327·10⁻³ (+4.7%) on whole-residual hosting: shared-donor kernel and entrance gauges with paid residual wrappers (conditional on two lemmas) #484's emitted words.
• The owner and window hypotheses are also checked on the template from a replay of Asynchronous whole-owner replicas: kappa 0.001357701757628940 (+1.9236% over #496) #505.

The PR is stacked on #509 (→ #484 → #442). The new commits here are f71a4bb, 871b1c5 and 1c6b6ff. They touch only research/e8-lemma-a-lean/. The package reuses the Lemma G package's event semantics through a Lake path dependency.

Model and coverage

Units are physical streams (family F, cover class g ∈ O(73,2)), as in #442 §2. Sources:

• the template's cover, loop_order and route_semantics ("physical cover class d*Pi(slot)^(-1)");
• Conditional κ ≈ 1.2375517e-3: idle-axis hosting of helper residuals (+9.2% over #434) #442's idle-axis hosting: "physical stream (F, g)", "owned by stream (F, d·σ⁻¹)", and "Distinct slots of one invocation have distinct σ, so distinct physical classes for every d … sequential, exactly as the parent's banks are co-owned sequentially by different cover classes";
• Conditional κ = 0.001274032589159993: complex kernel with paid residual adapters #458 §3, only for the convention g = dσ⁻¹ and "for a fixed family, d → g is a bijection".

Lemma A is proved in #442's stream model. That the model describes the machine is inherited from #442, like the compiler.

#458 §3 states the one-helper rule as required, and rejects same-call packing into disjoint slots. Its case is the single-owner calls. The sharing calls rest on #442's model, which needs atomic invocations.

At cover class d, register r lives on the stream (F_r, d·σ_r⁻¹). The theorem needs one owner per stream. That holds whenever registers sharing a family have pairwise disjoint footprints, which covers:

• one helper per family (Conditional κ = 0.001274032589159993: complex kernel with paid residual adapters #458's case, Complex supplier b ≈ 1.327·10⁻³ (+4.7%) on whole-residual hosting: shared-donor kernel and entrance gauges with paid residual wrappers (conditional on two lemmas) #484);
• Split centres and source-basis reuse for conditional κ = 0.001120864952258278 #433's pure-bank slots and Conditional κ ≈ 1.2375517e-3: idle-axis hosting of helper residuals (+9.2% over #434) #442's hosted slots;
• Conditional kappa = 0.001274548075945587: full-nine-axis kernel normalization and same-owner spectator borrowing #471's and Conditional κ = 0.001308501945841842: kernel79 complex supplier under #471's footprint rule at nine stages, with #493's bit word (+0.38%) #500's footprint rule.

On #484's words, every call of all four words satisfies the hypotheses:

word	calls with one register per family	other calls (disjoint footprints on a shared family)	hosted blocks
headline	72/72	—	39,792
gauge80	40/72	32 (#433 slots)	38,112
kernel79	56/72	16 (#433 slots)	37,720
anchor	—	72 (#442 slots)	34,560

Every hosted block lies inside its window.

The anchor is not pinned to EXPECTED and has no wrappers. Its (O′) and windows are checked by this package's checkers alone.

What is proved (Lean 4.21.0 + Mathlib v4.21.0, the pin of formal/lean on main)

theorem LemmaA.lemmaA_streams ... (hdis : ∀ r r', r ≠ r' → fam r = fam r' → Disjoint (fp (σ r)) (fp (σ r')))
    (hrec : RecipesExact T rec es) (hw : WellLabelled es l) (hS : ∀ s, S es j s = if s = j then 1 else 0)
    (hfac : ∀ v, T (labRun es l j) ((T (l j)).symm v) = Cj.rTensor B v) :
    realizeRun ⟨streamOwner fam σ d, chart⟩ rec es y (streamOwner fam σ d j) =
      (chart j).symm (Cj.rTensor B (chart j (y (streamOwner fam σ d j))))

The theorem holds over any commutative semiring, for any modules, charts and number of stages. Suppose:

• registers sharing a family have pairwise disjoint footprints;
• the invocation is well labelled, with exact recipes;
• it gives the helper a unit row (Lemma G);
• its block factors as C ⊗ id.

The last hypothesis is read in Lemma G's extended labels, where T_{λ¹}T_{λ⁰}⁻¹ = L_E⁻¹ S_E R_E⁻¹. #484's I-helper check verifies it, and Lemma G's check_extended_labels.py (run here) verifies the reading.

Then, after the complete invocation, the helper's stream holds chart⁻¹ (C ⊗ id) chart of its own initial value. The spectators are untouched.

The other Lean results:

• Streams. streamOwner_injective(_of_disjoint): distinct routes, or disjoint footprints, give distinct streams. sweep_unique: the cover sweep visits each stream once per route.
• Realization. realize_run: with one owner per unit, the physical execution read through the charts is the local run. one_owner_needed: within the model, sharing a unit already breaks this with a single event.
• No other actor. whole_invocation, endpoint_indep, lemmaA_piece: the invocation acts on the helper's unit as a single-unit piece that no other unit reads.
• Pending blocks. pieces_commute and pieces_product: pieces on disjoint blocks of one pending child commute and multiply back to the child.
• Asynchronous whole-owner replicas: kappa 0.001357701757628940 (+1.9236% over #496) #505's variant. lemmaA_async, async_window and gather: a borrowed piece moves to its child's deadline past every commuting action, and the gathered pieces give the child. This needs three scheduling conditions:
  • the window;
  • disjoint blocks;
  • whole invocations with distinct owners.

There is no instance enumeration and no decide/native_decide. #print axioms reports only propext, Classical.choice and Quot.sound for all 24 named results. verify.py builds this package and the Lemma G package from source, scans both for sorry/axiom/native_decide, and checks every axiom report.

What is checked

hypothesis	check	result
exact factorization, extended labels	#484 adapters_gk.py and I-helper; Lemma G check_extended_labels.py	16 headline frames; helpers 122/122, 80/80 and 79/79; 0 tag violations
unit helper rows, exact recipes, well labelled	Lemma G package H1–H3	0 violations
one owner per stream; centre copies in distinct private slots; atomic calls (the template's declared loop_order)	new code/check_owners.py (3 mutants rejected)	0 violations on all four words
windows, disjoint blocks, family-group windows disjoint	new code/check_windows.py, written independently of #484's and #505's audits (2 mutants rejected)	0 violations on all four words

#505 and #512

#505. I replayed #505's own verify.py here, offline under Python 3.14.

• Every stage passes, including its independent asynchronous audit.
• Its final comparison of the emitted template's sha256 with Asynchronous whole-owner replicas: kappa 0.001357701757628940 (+1.9236% over #496) #505's EXPECTED.json fails. The audit's owner, sigma-stream, profile and κ records equal its shipped evidence.
• Asynchronous whole-owner replicas: kappa 0.001357701757628940 (+1.9236% over #496) #505's tree lacks a .gitattributes that its MANIFEST lists, so I dropped that entry from a scratch copy of the manifest.

On the emitted asynchronous template:

• check_owners.py: one register per family in 72/72 calls;
• check_windows.py: all 40,320 hosted blocks lie strictly inside their owner child's open window, with blocks disjoint.

So Variant A′'s owner and window hypotheses hold on the template emitted by replaying #505 (4ee769c) here. That template does not hash-match #505's EXPECTED.json (template_sha256 aa741871… vs 276b69e3…). The sigma-stream digest, owner, profile and κ records equal #505's shipped evidence.

Not re-checked here:

• per-replica order, which Asynchronous whole-owner replicas: kappa 0.001357701757628940 (+1.9236% over #496) #505's audit checks;
• the prefix bound and its invoice;
• (E) and (F) on Asynchronous whole-owner replicas: kappa 0.001357701757628940 (+1.9236% over #496) #505's word.

#512 (the current frontier) lists "#484 Lemma A spectator realization" as a retained condition. It reports 800 distinct physical owners per invocation and builds on #505's asynchronous machinery and #507's factory. Its invocations meet the hypotheses on that report, and its borrowing is Variant A′ under the same conditions. #512's word is not checked here; this rests on #512's own report.

Reproduce

python3 research/e8-lemma-a-lean/verify.py                                    # Lean (builds the Lemma G package too)
python3 research/e8-lemma-a-lean/verify.py --instances /abs/out/of/484/verify # plus #484's results, extended labels, owners, windows
python3 research/e8-lemma-a-lean/verify.py --no-cache --async T.json.gz       # owners and windows on an asynchronous template

Credits

• Conditional κ = 0.001274032589159993: complex kernel with paid residual adapters #458 (chafreaky): the one-helper rule, paid wrappers, spectator routing and cover-class owners; this PR formalises the family-unit case of its realization argument.
• Conditional kappa = 0.001274548075945587: full-nine-axis kernel normalization and same-owner spectator borrowing #471 (Dugongue): the complete-invocation normalisation, same-owner spectator borrowing, and the footprint rule.
• Conditional κ = 0.001308501945841842: kernel79 complex supplier under #471's footprint rule at nine stages, with #493's bit word (+0.38%) #500 (rohanarun): footprint hosting with paid wrappers.
• Asynchronous whole-owner replicas: kappa 0.001357701757628940 (+1.9236% over #496) #505 (Dugongue): asynchronous whole-owner scheduling.
• Split centres and source-basis reuse for conditional κ = 0.001120864952258278 #433 (icekylinx): the complex supplier and its pure banks.
• Conditional κ ≈ 1.2375517e-3: idle-axis hosting of helper residuals (+9.2% over #434) #442 (DaysSky): idle-axis hosting and the stream model (§2), in which Lemma A is proved.
• κ = 1.048005508028206e-3: mutable-basis Hamming packets (≈2^-9.89814; conditional; complex +4.97%) #425 (Zhihao Chen): the conjugation lemma.
• Complex supplier b ≈ 1.327·10⁻³ (+4.7%) on whole-residual hosting: shared-donor kernel and entrance gauges with paid residual wrappers (conditional on two lemmas) #484 (DreamingOfClouds): the gauge/kernel word and Lemma A.
• formal/lean on main and [Lean] Verification of selected 1320-port bijection, κ=0.000661885549259598 #487/[Lean] Verification of binary input preparation, κ=0.000661885549259598 #488 (jamesyc): the Lean conventions.

Prepared by DreamingOfClouds with Claude Opus 5.5 (Anthropic), via Claude Code.

🤖 Generated with Claude Code

[DreamingOfClouds]

Note: code/check_windows.py hard-codes #484's family layout (scope limit; claims unaffected)

Proof. The checker decodes a family id as orep, ps, port = f // 960, (f % 960) // 120, f % 120, which assumes #484's layout: 8 pending children × 120 ports = 960 families per replica. Run unchanged on #523's punctured word (published evidence/hosted/GLOBAL-TEMPLATE.json.gz: 112 ports, so 8 × 112 = 896 families per replica, live 7,168), it reports 35,543 false violations, the first being call 0,0: family 2351 is not on child 4. These are decoding errors, not real window or disjointness failures.

Fix (logic unchanged). Derive the layout from the template:

NPORT = len(t['port_restriction']['new_to_old']) if 'port_restriction' in t else 120
FPR = t['live'] // len(allreps); assert FPR == 8 * NPORT, (FPR, NPORT)
orep, ps, port = f // FPR, (f % FPR) // NPORT, f % NPORT

With this change:

• Punctured Hamming ports for conditional κ = 0.001457945761723368 #523's published template passes: 40,320 hosted blocks, 160 windows, 0 violations, 2/2 mutants rejected.
• On Asynchronous whole-owner replicas: kappa 0.001357701757628940 (+1.9236% over #496) #505's template the parameterised checker gives the same result as the stock one.

Scope. This PR's claims (#484's four words and the #505 template) all use the 960/120 layout, so they are unaffected. The fix only matters for running verify.py --async on punctured or otherwise re-ported words such as #523. For the record: with the parameterised window check, #523's word and its 784-owner allocation also pass check_owners (72/72 calls, 3/3 mutants) and the Lemma G checks of #484 and #509.

DreamingOfClouds with Claude Opus 5.5 (Anthropic), via Claude Code.

[Mister-Meeseeks]

Integrated into published main at 681e8923a0f23a19f93c7105c3a9c96149aa8362, preserving the original commits, notices and contributor credit. Thank you for the contribution.

The Lemma A stream-model proofs build in Lean 4.21.0, with 24 named axiom reports and owner/window/extended-label checks on the four freshly reconstructed words.

The scoped review and pinned execution receipts record the exact coverage and remaining assumptions. This strengthens specific interfaces and preserves useful research; it does not change the selected κ or establish the complete multiplication theorem. Local checks passed; fresh Linux CI was queued at publication.