[Lean] Verify one literal PR442 invocation against the multi-host contract

[cheesegrader]

Plain-language guide with diagrams: EXPLAINER.md

This is a finite-instance formalization: Lean certificates for one literal PR442 R747 invocation (stage 2, replica 0, pair 0, forward, at 4e16d001d505d4f21dd2bcfc44591f9be4c279bd), plus a multi-host generalization of the hosting contract.

What is checked

• Task A generalizes the hosting contract to multiple hosts and recovers the single-host theorems.
• Task B connects the invocation's 19,002-instruction word to that contract. It gives Lean certificates for scalar endpoints, concrete ownership of all 987 roles, coordinate identities and COPY/ERASE guards. These hold for arbitrary dirty Boolean helpers and one explicitly clean, restored private temporary.

Merged #516 already proves abstract realization for arbitrary global state under hypotheses. This contribution checks selected concrete invocation obligations in Lean; it is not the first arbitrary-state theorem. The overlap review covers #509/#516 and draft #528.

Main declarations: MultiHosting.multi_hosting, MultiHosting.SingleHost.whole_hosting_recovered, MultiHosting.SingleHost.physical_whole_hosting_recovered, and in SourceInvocation: actualContract, selected_call_completion, selected_native_completion, selected_native_realization, selected_temporary_restoration.

Lean 4.21 port

The package now builds on Lean 4.21.0 (6741444a63eec253a7eae7a83f1beb3de015023d) with the project's Mathlib pin 308445d7985027f538e281e18df29ca16ede2ba3. All 1,388 theorem statements are unchanged from the earlier 4.33 version. The data certificates were split into smaller modules so they build with default settings: no raised stack, extra compiler flags or environment overrides. The axiom audits (931 Task B and 21 Task A declarations) show only propext, Quot.sound and Classical.choice.

Fresh clean build: 16 min 01 s. Full make formal-pr442-verify: 17 min 23 s.

CI timing has not been observed on GitHub Actions yet (the workflows are awaiting approval). The projection is 34 min 54 s against the job's 45-minute limit. It assumes 1.5× slower compute, 3 minutes of setup and a 20% margin, and that the Mathlib cache download works. If Mathlib must be built from source, the projection is 50.6 min, over the limit.

Reproduce after the pinned dependency setup (see research/lean-external-review/BUILD.md):

make formal-pr442-verify

Independent faithfulness check (run separately, not part of this branch)

Under Lean 4.21.0, the package's definitions were evaluated on the embedded word and compared with the semantics of PR434's own checker (bit_global.py):

• All 19,002 entries match.
• The symbolic row contents, frame labels and guard verdicts match at all 97 chunk checkpoints.
• 4,096 random dirty-input trials match.
• All 7 deliberately broken variants are rejected.

The package inputs match the hashes published in PR434's GLOBAL.json and PR442's EXPECTED.json. The pending ranges 15..21 and 1..28 re-derive from PR434's port routes and PR442's hosting windows. This is testing, not proof. I can add the test scripts as a commit if useful.

Scope limits

• One complete invocation; cross-invocation disjointness is not exercised.

• Pending ranges 15..21 and 1..28 are hand-supplied in Lean. Lean checks target-mask containment but does not bind them to the source schedule (the external check above re-derives them).

• The proofs assume explicit input embeddings, an invertible chart and 2 ≠ 0. Data extraction is externally checked Python, and original-bank outputs remain auxiliary state.

• This does not cover a full sweep, later scheduling, global-allocation equivalence, costs, all-size compilation, analytic transfer or a κ result. PR448's gain remains unestablished. PR493 → PR472 → PR442 is provenance only.

• Nine unchanged archived third-party snapshots are excluded from the build and audits; their bytes remain hashed.

Exact upstream base: db0e57bc7f36b5ac0fc844ad7ce1396165ee6647.

Original construction and predecessor credits remain in the source notices. Prepared with substantial OpenAI Codex assistance and independently checked with Claude (Anthropic). The human participant initiated and coordinated the effort and does not claim independent derivation or personal checking of the mathematics. Agent reviews are not human audits.

🤖 Generated with [Claude Code]

[Mister-Meeseeks]

Thank you @cheesegrader. This contribution is now retained on main in the scoped 100-PR review and contributor credits.

Contribution: Lean multi-host contract and one literal PR442 invocation.

Review and limits: Finite-instance scalar endpoints, coordinate/ownership guards and private temporary restoration. This is not the first abstract arbitrary-state theorem, a whole multiplier proof or validation of PR448's split gain.

The complete original source, notices and relevant execution evidence are retained through the pinned source archive. The review distinguishes fresh local runs, source-bound historical Linux CI and prior exact-head review; it does not claim 100 fresh full mathematical audits. Closing this historical PR as reconciled. This preserves parallel and cumulative credit without replacing the selected frontier or promoting priced research targets to completed constructions.

Reviewed head: acc1917034d10f464271ab115fda314fd4eee7a3. Publication: 64039f1bd3b6a523b96083fd858ad040a75e3030.