diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml index e85afe14dd..c6ba75a7bb 100644 --- a/.github/workflows/verify.yml +++ b/.github/workflows/verify.yml @@ -29,6 +29,28 @@ jobs: - name: Require reproducible certificates and patches run: git diff --exit-code + ranked-pair-finite: + runs-on: ubuntu-24.04 + timeout-minutes: 20 + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 + with: + python-version: '3.13' + - name: Fetch immutable PR62 construction sources + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + repository: CrocSwap/integer-mult-bounds + ref: ad0f25ff7b23cff7f08ad237c2254e6ecf74257e + path: build/ranked-pair-upstream + persist-credentials: false + - name: Independently replay words and rebuild exact CRT profiles + run: make ranked-pair-verify UPSTREAM=build/ranked-pair-upstream + - name: Require unchanged tracked artifacts + run: git diff --exit-code + formal: runs-on: ubuntu-24.04 timeout-minutes: 30 diff --git a/Makefile b/Makefile index a733e4b348..a00aa15c74 100644 --- a/Makefile +++ b/Makefile @@ -71,6 +71,36 @@ verify-certificates: python3 scripts/reuse_network.py python3 scripts/make_reuse_patch.py +# Independent verification of the pending PR62/63 rank-first construction. +# The offline check is separate from the pinned-source, C++/CRT replay. +verify-certificates: ranked-pair-check + +.PHONY: ranked-pair-check ranked-pair-verify formal-ranked-pair-verify +ranked-pair-check: + python3 research/ranked-pair-verification/verify.py + +ranked-pair-verify: ranked-pair-check + test -n "$(UPSTREAM)" + python3 research/ranked-pair-verification/audit/ranked-word-audit.py --upstream "$(UPSTREAM)" --generated build/ranked-pair + +formal-ranked-pair-verify: + python3 research/ranked-pair-verification/lean/check.py + +formal-historical-verify: formal-ranked-pair-verify + +# Later source-bound proof and finite-certificate checkpoint from PR64. +verify-certificates: machine-transfer-check + +.PHONY: machine-transfer-check formal-machine-transfer-verify +machine-transfer-check: + python3 research/machine-transfer-verification/verify.py + +LAKE_PROJECT ?= formal/lean +formal-machine-transfer-verify: + python3 research/machine-transfer-verification/verify_lean.py --lake-project "$(LAKE_PROJECT)" --output build/machine-transfer/lean + +formal-historical-verify: formal-machine-transfer-verify + verify-ternary: python3 scripts/complex_compression.py python3 scripts/make_complex_compression_patch.py diff --git a/README.md b/README.md index 9e01040cbb..371115f610 100644 --- a/README.md +++ b/README.md @@ -158,6 +158,12 @@ scoped negative results and reproducible certificates. ## Citation and license +The [independent rank-first pair verification](research/ranked-pair-verification/README.md) +records a conditional parameter refinement for the pending PR62/63 construction, +exact word/profile checks, and 45 scoped Lean theorems. Its construction matches +concurrent PR63; it does not replace the released bound or verify the full +multiplication machine. + Use [CITATION.cff](CITATION.cff), cite the individual contributions used and include the repository version or commit. [CONTRIBUTORS.md](CONTRIBUTORS.md), [NOTICE](NOTICE) and source-specific manifests preserve the dependency credits. diff --git a/research/machine-transfer-verification/README.md b/research/machine-transfer-verification/README.md new file mode 100644 index 0000000000..a8773e2920 --- /dev/null +++ b/research/machine-transfer-verification/README.md @@ -0,0 +1,137 @@ +# Formal transfer and finite-certificate checkpoint + +This package makes the completed research after the first PR64 checkpoint +reviewable and reproducible. It contains exact finite certificates, reusable +Lean proofs, concrete tape primitives and the current proof boundary. +**The full uniform fixed-tape integer multiplication theorem remains unfinished.** + +The strongest public finite candidate reproduced in this checkpoint is +[PR76](https://github.com/CrocSwap/integer-mult-bounds/pull/76), pinned at +`4b716171d4b3122d6b9db93f802751a41a209955`, with conditional +`kappa = 51738676045141 / 1000000000000000000 = 5.1738676045141e-5`. +Its supplied words, dirty-basis semantics, exact CRT profiles and assembly +arithmetic passed independent checks. Heuristic compiler regeneration was not +run for PR76. The latest **literal real-characteristic Lean instantiation** is +the earlier PR73 profile, with conditional `kappa = 5.1414646104194e-5`. +PR73's later withdrawal does not change its immutable certificate or theorem. +The PR76 result is not silently substituted into that Lean theorem. + +The completed PR69/71 combination experiment has the finite conditional +witness `kappa = 51544825802029 / 1000000000000000000` +(`5.1544825802029e-5`), above PR73 and below PR76. Both changed axes were +compiled and checked, including fresh CRT profiles and complete dirty-basis +replay. Its exact arithmetic is independently recomputed by the offline check; +there is no literal Lean profile instantiation for this experiment. + +## Review map + +| Package | Completed result | Remaining boundary | +| --- | --- | --- | +| `next-proof/analytic` | Actual real log/exp enclosures and characteristic contraction for PR64 | Supplied finite profile and physical realization | +| `next-proof/framed`, `next-proof/rows` | Typed XOR/gauge semantics and exact row-index bijections | Complete generated trace and physical routing | +| `transfer-proof/recurrence` | Floor-child depth, recurrence and uniform state-cost transfer | Named physical implementation hypotheses | +| `transfer-proof/tapes` | Literal fixed-alphabet stack push/pop, clean scratch and restored heads | Recursive scheduler composition | +| `transfer-proof/framed` | Concrete modular address-gauge algebra | Instantiation with the complete selected tables | +| `full-transfer/outerrows` | All-positive-width row supply, padding below factor two and descriptor absorption | Physical gathering and descriptor routines | +| `full-transfer/localization` | Rational table localization, eligible odd primes, unit pivots and modular transport | Concrete complete tables and setup costs | +| `full-transfer/framed` | Tensor identities and complete ambient finite schedule/profile correspondence | External finite checker, inherited local pivots; no full generated Lean trace | +| `full-transfer/latest-analytic` | Actual PR73 real characteristic and conditional state-cost specialization | Full deterministic multiplier | +| `stream-transfer/counters` | Six-state head-local binary counter; exact first completion, head return and fixed-direction amortized cost | Payload/reset/dispatcher costs and integration into routing | +| `stream-transfer/audit` | PR76 supplied-word/CRT/bridge/arithmetic validation and source pins | Compiler discovery regeneration and literal Lean specialization | +| `stream-transfer/experiments` | Bounded balanced-coarse/split-graph experiment and exact comparisons | No claim to beat PR76 or establish a global optimum | + +The counter bound is `4N + 2w` for N primitive calls in a **fixed direction**. +It does not cover arbitrary alternating increments and decrements, or include +the separate costs of payload emission, controller dispatch and counter reset. +Those costs must be included when proving a whole routing routine. + +The integrated inventory has 27 unique modules and 298 theorem/lemma audits. +It includes the 13 earlier `DirtyWrapper` declarations and 12 `FramedXor` +helpers beyond the historical selected prints. Duplicate module copies are +checked byte-for-byte and compiled once. These counts describe audit coverage, +not independent new mathematical results. Only standard Lean foundational +axioms are permitted; sources contain no proof escapes or custom axioms. + +## Reproduce from the repository root + +Python 3.11 or newer, standard library only: + +```sh +make machine-transfer-check +``` + +This validates the publication manifest, binds the PR64/68/73 literal Lean +profiles to their certificates, recomputes exact rational characteristic and +assembly inequalities for those profiles, PR76 and the completed combination, +and repeats the exact +counterexample to universal PR73-over-PR68 power dominance. It does **not** +rerun the Lean kernel, finite words, CRT profiler or compiler discovery. +It is included in `make verify-certificates` and hence `make verify`. + +With the repository's existing Lean 4.21.0 and pinned Mathlib project ready: + +```sh +make formal-machine-transfer-verify +# An already prepared compatible project can be selected explicitly: +make formal-machine-transfer-verify LAKE_PROJECT=/path/to/pinned/mathlib-project +``` + +The checker validates toolchain, dependency revision, source hashes and full +declaration coverage, then compiles all unique modules into a fresh temporary +directory and generates a kernel axiom-audit shim for each. It installs nothing +and writes reports under ignored `build/`. It also runs in the existing +historical formal CI job. Mathlib revision: +`308445d7985027f538e281e18df29ca16ede2ba3`. + +Full finite replay commands require the exact public source checkouts named in +the individual packages. For example, using a local checkout containing PR76 +at its pinned commit and unchanged checked-out files: + +```sh +P=research/machine-transfer-verification +python3 -B "$P/stream-transfer/audit/independent_pr76.py" \ + --repo /path/to/pr76-checkout --output build/pr76-independent.json +``` + +That command replays both entire dirty-state bases, checks literal scatter, +rebuilds the complete paid profile from the supplied axis profiles, and checks +the exact arithmetic. Fresh C++ CRT profiling is a distinct upstream command +documented in `stream-transfer/audit/README.txt`; its saved receipt is included. +The full ambient checks and experimental producer/replay commands have their +own explicit source requirements. Checkers do not fetch or modify tracked +upstream sources; the CRT setup creates an ignored parent archive. + +## Provenance and checkpoint handling + +`publication-manifest.json` is the authoritative hash inventory for this +publication. Leaf theorem manifests, source pins and scientific receipts are +retained. Old aggregate archive manifests, bulky GitHub API dumps, compiler +binaries and build logs are omitted. Historical checkpoint JSON/READMEs record +their status at creation, including statements that a checkpoint was then +unpublished. Their old workspace examples are historical; use the portable +commands above or pass explicit `--lake-project`, `--upstream`/`--repo` and +`--output` arguments to the leaf checkers. The standalone legacy scatter helper +is used through its path-independent library function. + +The manuscript is the completed full-transfer snapshot; current counter and +PR76 findings are documented in their package READMEs. No unfinished +`ClockReset` or integrated routing draft is included. One local source-path +metadata string in `selected-certificate.json` is normalized to the package +relative `pair-ranked-profile.json`; its mathematical fields are unchanged. +Pinned public PR68 and PR73 candidate bytes are preserved exactly. + +Credit for the public constructions and refinements remains with their authors: +Avi Eisenberg's PR62 graph; eumemic's PR57 compiler and PR69 balanced coarse +sums; Chafik Boukhalfa's PR60 priority and PR71 anchored split construction; +Rohan Arun's PR65 scheduling and PR67 costs; Dominik Scholz's PR68 controls and +PR73 parameter refinement; Alejandro Zarzuelo Urdiales's PR70 exchanges; Thomas DiFiore's PR74 node +ordering; and Dominik Scholz's PR76 composition. +All earlier data, complex-layer, matching and assembly credits and notices +remain applicable. This independent verification, formalization and bounded +combination work used substantial OpenAI Codex assistance, including separate +agent reviews. New sources follow the repository's Apache-2.0 license. + +Remaining decisive work is actual digit/row routing, complete table and ordered +child-plan instantiation, one fixed-tape recursive scheduler satisfying the +cost hypotheses, and the analytic resampling/precision/exact-recovery/setup +integration needed for the final multiplication theorem. diff --git a/research/machine-transfer-verification/audit/ranked-candidate-adversarial.json b/research/machine-transfer-verification/audit/ranked-candidate-adversarial.json new file mode 100644 index 0000000000..2971eed89e --- /dev/null +++ b/research/machine-transfer-verification/audit/ranked-candidate-adversarial.json @@ -0,0 +1,302 @@ +{ + "status": "PASS", + "axes": [ + { + "h": 23, + "v": 1771, + "R": 27918, + "word_sha256": "640696dd7cd893add9d6e12d0d587956fecf113b2eff8c29547b82e5a6f3c0ad", + "packed_sha256": "4757871d48bf471053afe4ae432e64432fb35b9b4a364c5939c63df627ebeedc", + "literal_scatter": { + "scatter_xors": 10626, + "central_outputs": 23, + "output_records": 5336, + "literal_binding": true, + "sequence_sha256": "902cb7c280eca5427f02d5b537e35a79612485c1119cfcf2f857e99a401e8fde" + }, + "transition_types": 124481, + "complete_charged_transition_types": 138003, + "transition_artifact": "outputs/audit/ranked-transitions-23.json.gz", + "transition_json_sha256": "2d97456d3dbee82b05ae276c39a1709e2fabaad093b9558af0ae4a8a695ea8eb", + "binary_profiler_input_sha256": "916f8b6ec54eacadaf55db59db03779a841a06a8647f13e8d40e07e451fa51f7", + "side_growth_singletons": 15939, + "full_basis_directions": 31460, + "full_basis_orientations": 2, + "elementary_xors": 149172, + "wrapped_xors": 621482, + "profile": [ + 0, + 343922, + 16866, + 10526, + 5756, + 4155, + 3904, + 3650, + 2861, + 2284, + 1800, + 1716, + 1263, + 1077, + 710, + 590, + 352, + 193, + 114, + 0, + 45, + 23, + 0, + 0 + ], + "mass": 642620, + "profiler_output_sha256": "d536378528a1d45c2c7a92c6173ba05542832edd2bfb4a09d24f883bb04515e2", + "original_profile_sha256": "5b480c170b6c00e8837f7ceebb75e6b53199cbf3a1dfd003c33306648bebc056", + "profile_delta": [ + 0, + 79, + -95, + -22, + -140, + -91, + -3, + -11, + -19, + 23, + 22, + 22, + 21, + 14, + 24, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0 + ], + "capped_delta": { + "1": -176, + "2": -431, + "3": -591, + "4": -729, + "5": -727, + "6": -634, + "7": -538, + "8": -431, + "9": -305, + "10": -202, + "11": -121, + "12": -62, + "13": -24, + "14": 0, + "15": 0, + "16": 0, + "17": 0, + "18": 0, + "19": 0, + "20": 0, + "21": 0, + "22": 0, + "23": 0 + }, + "concave_dominance": "strictly smaller sum n_t*t^p for every 0
assembly-specific two-margin ceiling",
+ "prior_certificate_sha256": "793d0292546f6f81a28eeddcee89a4dc59bea28283398e8caac8b1287130343d",
+ "current_certificate_sha256": "432a05ae372a33dd896ea68d9b5ac47a73f9142d07bcab4105d7ba95b46d9186",
+ "proof_of_unchanged_fields": "Reversing only that wording change reproduces the exact prior serialized-certificate SHA256.",
+ "moment_and_47_assembly_constraints": "freshly recomputed; same numerical outputs",
+ "expensive_word_checks": "not repeated; exact construction bytes and all mathematical certificate fields unchanged"
+ }
+}
diff --git a/research/machine-transfer-verification/audit/scatter_binding_audit.py b/research/machine-transfer-verification/audit/scatter_binding_audit.py
new file mode 100644
index 0000000000..6bf8404c44
--- /dev/null
+++ b/research/machine-transfer-verification/audit/scatter_binding_audit.py
@@ -0,0 +1,81 @@
+#!/usr/bin/env python3
+"""Independent literal binding of output records to the paid scatter word.
+
+This check is deliberately separate from the inherited replay. It does not
+establish all-size tape transfer, profile completeness, or an asymptotic bound.
+"""
+import gzip,hashlib,importlib.util,json,pathlib,subprocess,sys,time
+if sys.flags.optimize:
+ raise RuntimeError('Run without -O: assertions are part of this checker')
+from collections import Counter
+from itertools import combinations
+ROOT=pathlib.Path(__file__).resolve().parents[2]
+REPO=ROOT/'work/agents/repository-audit/repo'
+OUT=ROOT/'outputs/audit'
+WORK=ROOT/'work/agents/repository-audit/replay-bindings'
+PINS={
+ 'pr57':('47916b3bf2895c117f8b53ffff4732f67178a132','certificates/skip-frame-word-{h}.json.gz'),
+ 'pr58':('96c52fb81cab6e714768e00ca33ca7f004ebcac4','certificates/joint-dual-word-{h}.json.gz'),
+ 'pr60':('e7a492dd8bee4e6f574ced784a62af2ce735edc4','certificates/joint-dual-word-{h}.json.gz'),
+ 'pair_assembly':('ad0f25ff7b23cff7f08ad237c2254e6ecf74257e','research/pair-assembly/frame/frame-word-{h}.json.gz'),
+}
+def blob(pin,path):return subprocess.run(['git','-C',str(REPO),'show',f'{pin}:{path}'],check=True,capture_output=True).stdout
+
+def verify_scatter(d):
+ h,v,R=d['h'],d['v'],d['R'];triples=list(combinations(range(h),3));assert len(triples)==v
+ assert set(map(int,d['sources']))==set(range(v))
+ assert all(isinstance(s,int) and 0<=s =1,
+
+ b_k = p(1-p) integral_0^1 [
+ u*(k-1+u)^(p-2) + (1-u)*(k+u)^(p-2)
+ ] du.
+
+For k>=2 this follows by two integrations by parts, or integrating the
+second derivative against the triangular kernel on [k-1,k+1]. For k=1
+the potentially singular first summand is exactly u^(p-1), integrable
+because p>0. Perform the integrations from epsilon>0 and let epsilon
+decrease to zero: the boundary term u*f'(u)=p*u^p tends to zero, and
+f(u)=u^p also tends to zero. This proves the same identity at k=1 without
+assuming bounded f'' at zero.
+
+The prefactor p(1-p) is positive. Both summands are positive on 00. Since p-2<0, increasing k by one strictly decreases each
+positive summand for every 0b_{k+1} for every k>=1.
+Thus the hypotheses of the second telescoping identity hold for all
+power functions t^p with 0 E and later E->G. The pending-next-use map is updated on region input
+and output. h25 reverses equal-rank slot ties. h23's selected profile is
+unchanged from the pinned rank-first pair construction; h25 improves.
+Its proof explicitly credits PR64's capped-mass comparison format.
+
+For all four: read PR bodies, proof/scope documents, actual compiler
+changes, and verifier source; archived complete diffs and manifests.
+All eight supplied word/profile pairs pass strict literal scatter
+binding and exact local rank-mass checks. Only PR67's full target and
+direct full basis semantics were freshly reproduced here. PR65, PR66
+and PR68 full compiler rebuilds, CRT replay and arithmetic targets were
+NOT rerun in this incremental audit. Their numerical exponents remain
+source claims here, distinct from the verified PR67 exponent.
+
+Structural result and compatibility
+--------------------------------------
+power-dominance.txt proves a new finite comparison: PR67 has a strictly
+smaller complete power characteristic than PR64, PR65 and PR68 for all
+0 u i ^^ v i
+
+theorem vxor_assoc {ι : Type} (u v w : Vec ι) :
+ vxor (vxor u v) w = vxor u (vxor v w) := by
+ funext i
+ exact Bool.xor_assoc _ _ _
+
+theorem vxor_cancel {ι : Type} (u v : Vec ι) : vxor (vxor u v) v = u := by
+ funext i
+ simp [vxor, Bool.xor_assoc]
+
+theorem vxor_dirty_cancel {ι : Type} (z d y : Vec ι) :
+ vxor (vxor z d) (vxor d y) = vxor z y := by
+ funext i
+ simp [vxor, ← Bool.xor_assoc]
+
+def IsLinear {ι κ : Type} (f : Vec ι → Vec κ) : Prop :=
+ ∀ u v, f (vxor u v) = vxor (f u) (f v)
+
+structure Gate (ι : Type) where
+ src : ι
+ dst : ι
+ distinct : src ≠ dst
+
+def applyGate {ι : Type} [DecidableEq ι] (g : Gate ι) (u : Vec ι) : Vec ι :=
+ fun i => if i = g.dst then u i ^^ u g.src else u i
+
+theorem gate_involutive {ι : Type} [DecidableEq ι] (g : Gate ι) (u : Vec ι) :
+ applyGate g (applyGate g u) = u := by
+ funext i
+ by_cases h : i = g.dst
+ · subst i
+ simp [applyGate, g.distinct, Bool.xor_assoc]
+ · simp [applyGate, h]
+
+theorem gate_linear {ι : Type} [DecidableEq ι] (g : Gate ι) :
+ IsLinear (applyGate g) := by
+ intro u v
+ funext i
+ by_cases h : i = g.dst
+ · subst i
+ simp only [applyGate, if_true, vxor]
+ cases u g.dst <;> cases v g.dst <;> cases u g.src <;> cases v g.src <;> decide
+ · simp [applyGate, h, vxor]
+
+def run {ι : Type} [DecidableEq ι] : List (Gate ι) → Vec ι → Vec ι
+ | [], u => u
+ | g :: gs, u => run gs (applyGate g u)
+
+theorem run_append {ι : Type} [DecidableEq ι] (xs ys : List (Gate ι)) (u : Vec ι) :
+ run (xs ++ ys) u = run ys (run xs u) := by
+ induction xs generalizing u with
+ | nil => rfl
+ | cons g gs ih => exact ih (applyGate g u)
+
+theorem run_reverse_cancel {ι : Type} [DecidableEq ι] (gs : List (Gate ι))
+ (u : Vec ι) : run gs.reverse (run gs u) = u := by
+ induction gs generalizing u with
+ | nil => rfl
+ | cons g gs ih =>
+ simp only [List.reverse_cons, run_append, run, ih]
+ exact gate_involutive g u
+
+theorem run_linear {ι : Type} [DecidableEq ι] (gs : List (Gate ι)) :
+ IsLinear (run gs) := by
+ induction gs with
+ | nil => intro u v; rfl
+ | cons g gs ih =>
+ intro u v
+ simp only [run, gate_linear g u v]
+ exact ih (applyGate g u) (applyGate g v)
+
+/-- A physical role now stores a full binary payload indexed by addresses. -/
+abbrev Rows (D A : Type) := D → A → Bool
+
+def applyRowGate {D A : Type} [DecidableEq D] (g : Gate D) (u : Rows D A) : Rows D A :=
+ fun d a => if d = g.dst then u d a ^^ u g.src a else u d a
+
+def runRows {D A : Type} [DecidableEq D] : List (Gate D) → Rows D A → Rows D A
+ | [], u => u
+ | g :: gs, u => runRows gs (applyRowGate g u)
+
+/-- The same address map is applied to every role in the region. A permutation
+is a special case; commutation itself does not need bijectivity. -/
+def reindex {D A B : Type} (π : B → A) (u : Rows D A) : Rows D B :=
+ fun d a => u d (π a)
+
+theorem gate_reindex {D A B : Type} [DecidableEq D]
+ (g : Gate D) (π : B → A) (u : Rows D A) :
+ applyRowGate g (reindex π u) = reindex π (applyRowGate g u) := by
+ rfl
+
+/-- Equal-frame commutation: a common address reindexing commutes with an
+arbitrary literal XOR word, for all initial payloads including dirty rows. -/
+theorem word_reindex {D A B : Type} [DecidableEq D]
+ (word : List (Gate D)) (π : B → A) (u : Rows D A) :
+ runRows word (reindex π u) = reindex π (runRows word u) := by
+ induction word generalizing u with
+ | nil => rfl
+ | cons g gs ih =>
+ simp only [runRows, gate_reindex]
+ exact ih (applyRowGate g u)
+
+/-- The addresswise semantics of `runRows` is exactly the scalar semantics
+already used in the dirty-wrapper theorem; this closes that correspondence. -/
+theorem word_addresswise {D A : Type} [DecidableEq D]
+ (word : List (Gate D)) (u : Rows D A) (a : A) :
+ (fun d => runRows word u d a) = run word (fun d => u d a) := by
+ induction word generalizing u with
+ | nil => rfl
+ | cons g gs ih =>
+ simp only [runRows, run]
+ exact ih (applyRowGate g u)
+
+structure State (X : Type) (D Z : Type) where
+ source : X
+ scratch : Vec D
+ target : Vec Z
+
+def mix {X D Z : Type} (L : Vec D → Vec D) (s : State X D Z) : State X D Z :=
+ { s with scratch := L s.scratch }
+
+def scatter {X D Z : Type} (J : Vec D → Vec Z) (s : State X D Z) : State X D Z :=
+ { s with target := vxor s.target (J s.scratch) }
+
+def inject {X D Z : Type} (V : X → Vec D) (s : State X D Z) : State X D Z :=
+ { s with scratch := vxor s.scratch (V s.source) }
+
+/-- Literal chronological execution of L,J,L⁻¹,V,L,J,L⁻¹,V. -/
+def wrapper {X D Z : Type} (L Linv : Vec D → Vec D) (J : Vec D → Vec Z)
+ (V : X → Vec D) (s : State X D Z) : State X D Z :=
+ let s1 := mix L s
+ let s2 := scatter J s1
+ let s3 := mix Linv s2
+ let s4 := inject V s3
+ let s5 := mix L s4
+ let s6 := scatter J s5
+ let s7 := mix Linv s6
+ inject V s7
+
+/-- Abstract wrapper theorem: reversibility, linearity and the terminal identity
+are explicit local hypotheses; arbitrary dirty input is universally quantified. -/
+theorem wrapper_correct {X D Z : Type}
+ (L Linv : Vec D → Vec D) (J : Vec D → Vec Z) (V : X → Vec D)
+ (output : X → Vec Z)
+ (inverse : ∀ d, Linv (L d) = d)
+ (mixer_linear : IsLinear L)
+ (scatter_linear : IsLinear J)
+ (terminal_identity : ∀ x, J (L (V x)) = output x)
+ (x : X) (d : Vec D) (z : Vec Z) :
+ wrapper L Linv J V ⟨x, d, z⟩ = ⟨x, d, vxor z (output x)⟩ := by
+ unfold IsLinear at mixer_linear scatter_linear
+ simp only [wrapper, mix, scatter, inject]
+ simp only [inverse, vxor_cancel]
+ simp only [mixer_linear, scatter_linear,
+ terminal_identity, vxor_dirty_cancel]
+
+/-- A serialized XOR word automatically supplies both reversibility and mixer
+linearity; no separate hypotheses for those properties are required. -/
+theorem compiled_wrapper_correct {X D Z : Type} [DecidableEq D]
+ (word : List (Gate D)) (J : Vec D → Vec Z) (V : X → Vec D)
+ (output : X → Vec Z)
+ (scatter_linear : IsLinear J)
+ (terminal_identity : ∀ x, J (run word (V x)) = output x)
+ (x : X) (d : Vec D) (z : Vec Z) :
+ wrapper (run word) (run word.reverse) J V ⟨x, d, z⟩ =
+ ⟨x, d, vxor z (output x)⟩ := by
+ exact wrapper_correct (run word) (run word.reverse) J V output
+ (run_reverse_cancel word) (run_linear word) scatter_linear
+ terminal_identity x d z
+
+#print axioms vxor_assoc
+#print axioms vxor_cancel
+#print axioms vxor_dirty_cancel
+#print axioms gate_involutive
+#print axioms gate_linear
+#print axioms run_append
+#print axioms run_reverse_cancel
+#print axioms run_linear
+#print axioms gate_reindex
+#print axioms word_reindex
+#print axioms word_addresswise
+#print axioms wrapper_correct
+#print axioms compiled_wrapper_correct
+
+end DirtyWrapper
diff --git a/research/machine-transfer-verification/next-proof/framed/FramedXor.lean b/research/machine-transfer-verification/next-proof/framed/FramedXor.lean
new file mode 100644
index 0000000000..34f75a1f8c
--- /dev/null
+++ b/research/machine-transfer-verification/next-proof/framed/FramedXor.lean
@@ -0,0 +1,516 @@
+import DirtyWrapper
+
+/-!
+Address-gauge refinement of literal XOR traces.
+
+Payloads on every original role are arbitrary. A gauge maps a logical address
+to its physical location. A reframe from `old` to `new` therefore reads the
+old row at `old.forward (new.inverse physicalAddress)`; its orientation is
+part of the definition, not an assumed commutation rule. A typed XOR requires
+equality of the two current gauges. The main theorem erases reframes and proves
+that the decoded physical execution equals the literal scalar XOR word.
+
+No finite graph is instantiated here. In particular, this file does not prove
+that the repository's subspace labels give the required concrete permutations,
+that its full early/middle/late phase schedule inhabits `Trace`, or that a
+reframe has the claimed recursive-child list or fixed-tape cost.
+-/
+
+namespace FramedXor
+
+open DirtyWrapper
+
+/-- A bijection with both inverse laws, without a finiteness assumption. -/
+structure Gauge (A : Type) where
+ forward : A → A
+ inverse : A → A
+ inverse_forward : ∀ a, inverse (forward a) = a
+ forward_inverse : ∀ a, forward (inverse a) = a
+
+def Gauge.identity (A : Type) : Gauge A :=
+ ⟨id, id, fun _ => rfl, fun _ => rfl⟩
+
+abbrev Assignment (R A : Type) := R → Gauge A
+
+def decode {R A : Type} (gauges : Assignment R A) (physical : Rows R A) : Rows R A :=
+ fun r a => physical r ((gauges r).forward a)
+
+def encode {R A : Type} (gauges : Assignment R A) (logical : Rows R A) : Rows R A :=
+ fun r a => logical r ((gauges r).inverse a)
+
+theorem decode_encode {R A : Type} (gauges : Assignment R A) (logical : Rows R A) :
+ decode gauges (encode gauges logical) = logical := by
+ funext r a
+ exact congrArg (logical r) ((gauges r).inverse_forward a)
+
+theorem encode_decode {R A : Type} (gauges : Assignment R A) (physical : Rows R A) :
+ encode gauges (decode gauges physical) = physical := by
+ funext r a
+ exact congrArg (physical r) ((gauges r).forward_inverse a)
+
+def replaceGauge {R A : Type} [DecidableEq R]
+ (gauges : Assignment R A) (role : R) (new : Gauge A) : Assignment R A :=
+ fun r => if r = role then new else gauges r
+
+/-- Literal physical transport. Only the named row is permuted. -/
+def reframe {R A : Type} [DecidableEq R] (gauges : Assignment R A)
+ (role : R) (new : Gauge A) (physical : Rows R A) : Rows R A :=
+ fun r a => if r = role then
+ physical r ((gauges role).forward (new.inverse a)) else physical r a
+
+theorem decode_reframe {R A : Type} [DecidableEq R]
+ (gauges : Assignment R A) (role : R) (new : Gauge A) (physical : Rows R A) :
+ decode (replaceGauge gauges role new) (reframe gauges role new physical) =
+ decode gauges physical := by
+ funext r a
+ by_cases hr : r = role
+ · subst r
+ simp [decode, replaceGauge, reframe, new.inverse_forward]
+ · simp [decode, replaceGauge, reframe, hr]
+
+theorem reframe_composition {R A : Type} [DecidableEq R]
+ (gauges : Assignment R A) (role : R) (middle last : Gauge A) (physical : Rows R A) :
+ reframe (replaceGauge gauges role middle) role last (reframe gauges role middle physical) =
+ reframe gauges role last physical := by
+ funext r a
+ by_cases hr : r = role
+ · subst r
+ simp [reframe, replaceGauge, middle.inverse_forward]
+ · simp [reframe, hr]
+
+theorem reframe_inverse {R A : Type} [DecidableEq R]
+ (gauges : Assignment R A) (role : R) (new : Gauge A) (physical : Rows R A) :
+ reframe (replaceGauge gauges role new) role (gauges role)
+ (reframe gauges role new physical) = physical := by
+ rw [reframe_composition]
+ funext r a
+ by_cases hr : r = role
+ · subst r
+ simp [reframe, (gauges role).forward_inverse]
+ · simp [reframe, hr]
+
+theorem decode_xor {R A : Type} [DecidableEq R]
+ (gauges : Assignment R A) (gate : Gate R)
+ (common : gauges gate.dst = gauges gate.src) (physical : Rows R A) :
+ decode gauges (applyRowGate gate physical) = applyRowGate gate (decode gauges physical) := by
+ funext r a
+ by_cases hr : r = gate.dst
+ · subst r
+ simp [decode, applyRowGate, common]
+ · simp [decode, applyRowGate, hr]
+
+/-- The endpoint assignment is indexed in the type, so stale-frame XORs cannot
+be inserted without a proof of equality of the current incident gauges. -/
+inductive Step {R A : Type} [DecidableEq R] (gauges : Assignment R A) :
+ Assignment R A → Type where
+ | transport (role : R) (new : Gauge A) : Step gauges (replaceGauge gauges role new)
+ | xor (gate : Gate R) (common : gauges gate.dst = gauges gate.src) : Step gauges gauges
+
+inductive Trace {R A : Type} [DecidableEq R] : Assignment R A → Assignment R A → Type where
+ | done (gauges : Assignment R A) : Trace gauges gauges
+ | cons {first middle last : Assignment R A}
+ (step : Step first middle) (rest : Trace middle last) : Trace first last
+
+def executeStep {R A : Type} [DecidableEq R] {first last : Assignment R A} :
+ Step first last → Rows R A → Rows R A
+ | .transport role new, physical => reframe first role new physical
+ | .xor gate _, physical => applyRowGate gate physical
+
+def execute {R A : Type} [DecidableEq R] {first last : Assignment R A} :
+ Trace first last → Rows R A → Rows R A
+ | .done _, physical => physical
+ | .cons step rest, physical => execute rest (executeStep step physical)
+
+def scalarWord {R A : Type} [DecidableEq R] {first last : Assignment R A} :
+ Trace first last → List (Gate R)
+ | .done _ => []
+ | .cons (.transport _ _) rest => scalarWord rest
+ | .cons (.xor gate _) rest => gate :: scalarWord rest
+
+/-- Main refinement theorem. Reframes erase to the identity; every remaining
+literal XOR acts at one logical address, for arbitrary original dirty state. -/
+theorem decoded_execution {R A : Type} [DecidableEq R]
+ {first last : Assignment R A} (trace : Trace first last) (physical : Rows R A) :
+ decode last (execute trace physical) =
+ runRows (scalarWord trace) (decode first physical) := by
+ induction trace generalizing physical with
+ | done gauges => rfl
+ | @cons first middle last step rest ih =>
+ cases step with
+ | transport role new =>
+ simp only [execute, executeStep, scalarWord]
+ rw [ih, decode_reframe]
+ | xor gate common =>
+ simp only [execute, executeStep, scalarWord, runRows]
+ rw [ih, decode_xor first gate common]
+
+/-- Equivalent encoded form, making both endpoint gauges explicit. -/
+theorem encoded_execution {R A : Type} [DecidableEq R]
+ {first last : Assignment R A} (trace : Trace first last) (logical : Rows R A) :
+ execute trace (encode first logical) =
+ encode last (runRows (scalarWord trace) logical) := by
+ have result := decoded_execution trace (encode first logical)
+ rw [decode_encode] at result
+ have encoded := congrArg (encode last) result
+ simpa only [encode_decode] using encoded
+
+theorem physical_execution {R A : Type} [DecidableEq R]
+ {first last : Assignment R A} (trace : Trace first last) (physical : Rows R A) :
+ execute trace physical = encode last
+ (runRows (scalarWord trace) (decode first physical)) := by
+ simpa only [encode_decode] using encoded_execution trace (decode first physical)
+
+/-- `destination` maps an input role to its output role. `addressMap` is a
+PUSHFORWARD on physical addresses. Undoing the role permutation therefore
+leaves a pullback by `addressMap.inverse` on row payloads. Bijectivity of the
+role map is only needed by the outer split/merge theorem, not by this equality.
+-/
+theorem terminal_role_transport {R A : Type} [DecidableEq R]
+ {first last : Assignment R A} (trace : Trace first last)
+ (destination : R → R) (addressMap : Gauge A)
+ (scalar_roles : ∀ (logical : Rows R A) (role : R) (address : A),
+ runRows (scalarWord trace) logical (destination role) address = logical role address)
+ (terminal_frames : ∀ role address,
+ (last (destination role)).forward address = addressMap.forward ((first role).forward address))
+ (physical : Rows R A) (role : R) (address : A) :
+ execute trace physical (destination role) address =
+ physical role (addressMap.inverse address) := by
+ rw [physical_execution]
+ simp only [encode, scalar_roles, decode]
+ have frame := terminal_frames role ((last (destination role)).inverse address)
+ rw [(last (destination role)).forward_inverse] at frame
+ have pulled := congrArg addressMap.inverse frame
+ rw [addressMap.inverse_forward] at pulled
+ rw [← pulled]
+
+def identityAssignment (R A : Type) : Assignment R A := fun _ => Gauge.identity A
+
+/-- If both endpoint gauges are restored to identity, the literal physical
+payload equals the scalar-word payload, without a zero-state assumption. -/
+theorem restored_execution {R A : Type} [DecidableEq R]
+ (trace : Trace (identityAssignment R A) (identityAssignment R A)) (physical : Rows R A) :
+ execute trace physical = runRows (scalarWord trace) physical := by
+ exact decoded_execution trace physical
+
+/-- The result also agrees with the previously formalized scalar interpreter
+at every address, closing the row-word/scalar-word correspondence. -/
+theorem restored_addresswise {R A : Type} [DecidableEq R]
+ (trace : Trace (identityAssignment R A) (identityAssignment R A))
+ (physical : Rows R A) (address : A) :
+ (fun role => execute trace physical role address) =
+ run (scalarWord trace) (fun role => physical role address) := by
+ rw [restored_execution]
+ exact word_addresswise (scalarWord trace) physical address
+
+/-! Source injection and scatter are ordinary typed XORs on disjoint banks. -/
+
+inductive Bank (X D Z : Type) where
+ | source (x : X)
+ | auxiliary (d : D)
+ | target (z : Z)
+ deriving DecidableEq
+
+def injectionGate {X D Z : Type} (x : X) (d : D) : Gate (Bank X D Z) :=
+ ⟨.source x, .auxiliary d, by intro impossible; cases impossible⟩
+
+def scatterGate {X D Z : Type} (d : D) (z : Z) : Gate (Bank X D Z) :=
+ ⟨.auxiliary d, .target z, by intro impossible; cases impossible⟩
+
+theorem decoded_injection {X D Z A : Type}
+ [DecidableEq X] [DecidableEq D] [DecidableEq Z]
+ (gauges : Assignment (Bank X D Z) A) (x : X) (d : D)
+ (common : gauges (.auxiliary d) = gauges (.source x))
+ (physical : Rows (Bank X D Z) A) :
+ decode gauges (applyRowGate (injectionGate x d) physical) =
+ applyRowGate (injectionGate x d) (decode gauges physical) :=
+ decode_xor gauges (injectionGate x d) common physical
+
+theorem decoded_scatter {X D Z A : Type}
+ [DecidableEq X] [DecidableEq D] [DecidableEq Z]
+ (gauges : Assignment (Bank X D Z) A) (d : D) (z : Z)
+ (common : gauges (.target z) = gauges (.auxiliary d))
+ (physical : Rows (Bank X D Z) A) :
+ decode gauges (applyRowGate (scatterGate d z) physical) =
+ applyRowGate (scatterGate d z) (decode gauges physical) :=
+ decode_xor gauges (scatterGate d z) common physical
+
+/-- Auxiliary-to-target scatter reads commute, even when targets coincide.
+This permits center-first or target-grouped dispatch without dropping or
+deduplicating literal incidences. Mixer XORs have no such blanket permission.
+-/
+theorem scatter_gates_commute {X D Z A : Type}
+ [DecidableEq X] [DecidableEq D] [DecidableEq Z]
+ (d₁ d₂ : D) (z₁ z₂ : Z) (physical : Rows (Bank X D Z) A) :
+ applyRowGate (scatterGate d₁ z₁) (applyRowGate (scatterGate d₂ z₂) physical) =
+ applyRowGate (scatterGate d₂ z₂) (applyRowGate (scatterGate d₁ z₁) physical) := by
+ funext role address
+ cases role with
+ | source x => rfl
+ | auxiliary d => rfl
+ | target z =>
+ by_cases first : z = z₁ <;> by_cases second : z = z₂
+ · subst z₁; subst z₂
+ simp [applyRowGate, scatterGate, Bool.xor_right_comm]
+ cases physical (.auxiliary d₁) address <;> cases physical (.auxiliary d₂) address <;> decide
+ · subst z₁
+ simp [applyRowGate, scatterGate, second]
+ · subst z₂
+ simp [applyRowGate, scatterGate, first]
+ · simp [applyRowGate, scatterGate, first, second]
+
+theorem scatter_permutation {X D Z A : Type}
+ [DecidableEq X] [DecidableEq D] [DecidableEq Z]
+ (first last : List (D × Z)) (permutation : first.Perm last)
+ (physical : Rows (Bank X D Z) A) :
+ runRows (first.map (fun pair => scatterGate (X := X) pair.1 pair.2)) physical =
+ runRows (last.map (fun pair => scatterGate (X := X) pair.1 pair.2)) physical := by
+ induction permutation generalizing physical with
+ | nil => rfl
+ | cons pair _ ih =>
+ simp only [List.map_cons, runRows]
+ exact ih (applyRowGate (scatterGate pair.1 pair.2) physical)
+ | swap a b rest =>
+ simp only [List.map_cons, runRows]
+ rw [scatter_gates_commute]
+ | trans _ _ ih₁ ih₂ => exact (ih₁ physical).trans (ih₂ physical)
+
+/-! A copied-center dispatch uses a NEW blank row. `some r` denotes an
+arbitrary existing role; `none` alone is fresh and may later be discarded.
+There is no overwrite, clearing or zero assumption on any existing role. -/
+
+def allocateFresh {R A : Type} (physical : Rows R A) : Rows (Option R) A
+ | none, _ => false
+ | some r, a => physical r a
+
+def restrictOriginal {R A : Type} (physical : Rows (Option R) A) : Rows R A :=
+ fun r a => physical (some r) a
+
+def extendGauge {R A : Type} (gauges : Assignment R A) (fresh : Gauge A) :
+ Assignment (Option R) A
+ | none => fresh
+ | some r => gauges r
+
+def cloneGate {R : Type} (source : R) : Gate (Option R) :=
+ ⟨some source, none, by intro impossible; cases impossible⟩
+
+def readFreshGate {R : Type} (target : R) : Gate (Option R) :=
+ ⟨none, some target, by intro impossible; cases impossible⟩
+
+/-- First copy at the source gauge, then transport only the fresh copy, then
+read it at the target's current gauge. Existing gauges remain untouched. -/
+def copiedReadTrace {R A : Type} [DecidableEq R]
+ (gauges : Assignment R A) (gate : Gate R) :
+ Trace (extendGauge gauges (gauges gate.src))
+ (replaceGauge (extendGauge gauges (gauges gate.src)) none (gauges gate.dst)) :=
+ .cons (.xor (cloneGate gate.src) rfl)
+ (.cons (.transport none (gauges gate.dst))
+ (.cons (.xor (readFreshGate gate.dst) (by
+ simp [replaceGauge, extendGauge, readFreshGate])) (.done _)))
+
+theorem decode_allocateFresh {R A : Type}
+ (gauges : Assignment R A) (fresh : Gauge A) (physical : Rows R A) :
+ decode (extendGauge gauges fresh) (allocateFresh physical) =
+ allocateFresh (decode gauges physical) := by
+ funext r a
+ cases r <;> rfl
+
+theorem restrict_decode_transportFresh {R A : Type} [DecidableEq R]
+ (gauges : Assignment R A) (old new : Gauge A) (physical : Rows (Option R) A) :
+ restrictOriginal (decode (replaceGauge (extendGauge gauges old) none new) physical) =
+ decode gauges (restrictOriginal physical) := by
+ funext r a
+ simp [restrictOriginal, decode, replaceGauge, extendGauge]
+
+theorem fresh_scalar_read {R A : Type} [DecidableEq R]
+ (gate : Gate R) (logical : Rows R A) :
+ restrictOriginal (runRows [cloneGate gate.src, readFreshGate gate.dst]
+ (allocateFresh logical)) = applyRowGate gate logical := by
+ funext r a
+ by_cases hr : r = gate.dst
+ · subst r
+ simp [restrictOriginal, runRows, applyRowGate, cloneGate, readFreshGate, allocateFresh]
+ · simp [restrictOriginal, runRows, applyRowGate, cloneGate, readFreshGate, allocateFresh, hr]
+
+/-- A complete copy/transport/read/drop dispatch realizes the logical XOR even
+when the original source and target gauges differ. Only the fresh copy is
+transported, and every original payload may begin arbitrary and dirty. -/
+theorem copied_read_correct {R A : Type} [DecidableEq R]
+ (gauges : Assignment R A) (gate : Gate R) (physical : Rows R A) :
+ decode gauges (restrictOriginal (execute (copiedReadTrace gauges gate)
+ (allocateFresh physical))) = applyRowGate gate (decode gauges physical) := by
+ have result := congrArg restrictOriginal
+ (decoded_execution (copiedReadTrace gauges gate) (allocateFresh physical))
+ rw [restrict_decode_transportFresh, decode_allocateFresh] at result
+ simpa only [copiedReadTrace, scalarWord, fresh_scalar_read] using result
+
+/-- The fresh temporary may be dropped after its read; the source and every
+other original role keep their decoded payload. This is not a license to drop
+or reset a dirty original auxiliary row. -/
+theorem copied_read_preserves_other {R A : Type} [DecidableEq R]
+ (gauges : Assignment R A) (gate : Gate R) (physical : Rows R A)
+ (role : R) (not_target : role ≠ gate.dst) :
+ (decode gauges (restrictOriginal (execute (copiedReadTrace gauges gate)
+ (allocateFresh physical)))) role = decode gauges physical role := by
+ rw [copied_read_correct]
+ funext a
+ simp [applyRowGate, not_target]
+
+/-! The real retained-center schedule transports ONE temporary and uses it
+for every scatter read. The following fanout specialization does not charge
+or create a separate copy per destination. -/
+
+def withFresh {R A : Type} (value : A → Bool) (logical : Rows R A) : Rows (Option R) A
+ | none, a => value a
+ | some r, a => logical r a
+
+def addFixed {R A : Type} [DecidableEq R]
+ (target : R) (value : A → Bool) (logical : Rows R A) : Rows R A :=
+ fun r a => if r = target then logical r a ^^ value a else logical r a
+
+def scatterFixed {R A : Type} [DecidableEq R] : List R → (A → Bool) → Rows R A → Rows R A
+ | [], _, logical => logical
+ | target :: rest, value, logical => scatterFixed rest value (addFixed target value logical)
+
+theorem clone_blank {R A : Type} [DecidableEq R] (source : R) (logical : Rows R A) :
+ applyRowGate (cloneGate source) (allocateFresh logical) = withFresh (logical source) logical := by
+ funext r a
+ cases r <;> simp [applyRowGate, cloneGate, allocateFresh, withFresh]
+
+theorem fresh_fixed_read {R A : Type} [DecidableEq R]
+ (target : R) (value : A → Bool) (logical : Rows R A) :
+ applyRowGate (readFreshGate target) (withFresh value logical) =
+ withFresh value (addFixed target value logical) := by
+ funext r a
+ cases r with
+ | none => simp [applyRowGate, readFreshGate, withFresh]
+ | some r => simp [applyRowGate, readFreshGate, withFresh, addFixed]
+
+theorem fresh_fixed_reads {R A : Type} [DecidableEq R]
+ (targets : List R) (value : A → Bool) (logical : Rows R A) :
+ runRows (targets.map readFreshGate) (withFresh value logical) =
+ withFresh value (scatterFixed targets value logical) := by
+ induction targets generalizing logical with
+ | nil => rfl
+ | cons target rest ih =>
+ simp only [List.map_cons, runRows, fresh_fixed_read, scatterFixed]
+ exact ih (addFixed target value logical)
+
+def freshReadsTrace {R A : Type} [DecidableEq R] (gauges : Assignment (Option R) A) :
+ (targets : List R) → (∀ target ∈ targets, gauges (some target) = gauges none) → Trace gauges gauges
+ | [], _ => .done gauges
+ | target :: rest, common =>
+ .cons (.xor (readFreshGate target) (common target (by simp)))
+ (freshReadsTrace gauges rest (fun r hr => common r (by simp [hr])))
+
+theorem freshReads_word {R A : Type} [DecidableEq R] (gauges : Assignment (Option R) A)
+ (targets : List R) (common : ∀ target ∈ targets, gauges (some target) = gauges none) :
+ scalarWord (freshReadsTrace gauges targets common) = targets.map readFreshGate := by
+ induction targets with
+ | nil => rfl
+ | cons target rest ih =>
+ simp only [freshReadsTrace, scalarWord, List.map_cons]
+ rw [ih]
+
+def copiedFanoutTrace {R A : Type} [DecidableEq R]
+ (gauges : Assignment R A) (source : R) (new : Gauge A) (targets : List R)
+ (common : ∀ target ∈ targets, gauges target = new) :
+ Trace (extendGauge gauges (gauges source))
+ (replaceGauge (extendGauge gauges (gauges source)) none new) :=
+ .cons (.xor (cloneGate source) rfl)
+ (.cons (.transport none new)
+ (freshReadsTrace _ targets (by
+ intro target member
+ simpa only [replaceGauge, extendGauge, reduceCtorEq, ↓reduceIte] using common target member)))
+
+/-- A single complete blank copy, one transport and ALL its target reads have
+exactly the expected scalar fanout. Discarding that fresh row is safe; existing
+rows remain arbitrary throughout. Duplicate targets mean repeated XORs, not
+set membership, so the literal incidence multiplicity is preserved. -/
+theorem copied_fanout_correct {R A : Type} [DecidableEq R]
+ (gauges : Assignment R A) (source : R) (new : Gauge A) (targets : List R)
+ (common : ∀ target ∈ targets, gauges target = new) (physical : Rows R A) :
+ decode gauges (restrictOriginal (execute (copiedFanoutTrace gauges source new targets common)
+ (allocateFresh physical))) =
+ scatterFixed targets (decode gauges physical source) (decode gauges physical) := by
+ have result := congrArg restrictOriginal
+ (decoded_execution (copiedFanoutTrace gauges source new targets common) (allocateFresh physical))
+ rw [restrict_decode_transportFresh, decode_allocateFresh] at result
+ simpa only [copiedFanoutTrace, scalarWord, freshReads_word, runRows, clone_blank,
+ fresh_fixed_reads, restrictOriginal, withFresh] using result
+
+theorem scatterFixed_preserves_other {R A : Type} [DecidableEq R]
+ (targets : List R) (value : A → Bool) (logical : Rows R A) (role : R)
+ (not_target : role ∉ targets) : scatterFixed targets value logical role = logical role := by
+ induction targets generalizing logical with
+ | nil => rfl
+ | cons target rest ih =>
+ have different : role ≠ target := by
+ intro equal
+ apply not_target
+ simp [equal]
+ have outside : role ∉ rest := by
+ intro member
+ apply not_target
+ simp [member]
+ simp only [scatterFixed]
+ rw [ih (addFixed target value logical) outside]
+ funext a
+ simp [addFixed, different]
+
+theorem copied_fanout_preserves_other {R A : Type} [DecidableEq R]
+ (gauges : Assignment R A) (source : R) (new : Gauge A) (targets : List R)
+ (common : ∀ target ∈ targets, gauges target = new) (physical : Rows R A)
+ (role : R) (not_target : role ∉ targets) :
+ restrictOriginal (execute (copiedFanoutTrace gauges source new targets common)
+ (allocateFresh physical)) role = physical role := by
+ have decoded := congrArg (fun rows => rows role) (copied_fanout_correct gauges source new targets common physical)
+ dsimp only at decoded
+ rw [scatterFixed_preserves_other targets _ _ role not_target] at decoded
+ funext address
+ have point := congrFun decoded ((gauges role).inverse address)
+ simpa only [decode, (gauges role).forward_inverse] using point
+
+/-! Adversarial necessity of the current-gauge equality hypothesis. -/
+
+def boolFlip : Gauge Bool :=
+ ⟨Bool.not, Bool.not, by intro b; cases b <;> rfl, by intro b; cases b <;> rfl⟩
+
+def unequalGauges : Assignment Bool Bool :=
+ fun role => if role then Gauge.identity Bool else boolFlip
+
+def counterexampleRows : Rows Bool Bool := fun role address => if role then false else address
+
+def counterexampleGate : Gate Bool := ⟨false, true, by decide⟩
+
+theorem mismatched_gauge_counterexample :
+ decode unequalGauges (applyRowGate counterexampleGate counterexampleRows) true false = false ∧
+ applyRowGate counterexampleGate (decode unequalGauges counterexampleRows) true false = true := by
+ decide
+
+/-- Copying by XOR into an arbitrary dirty temporary would be incorrect. The
+fresh-row initialization used above is a necessary, explicit boundary. -/
+theorem dirty_temporary_counterexample :
+ restrictOriginal (runRows [cloneGate false, readFreshGate true]
+ (withFresh (fun (_ : Unit) => true) (fun (_ : Bool) (_ : Unit) => false))) true () = true := by
+ decide
+
+#print axioms decode_reframe
+#print axioms reframe_composition
+#print axioms reframe_inverse
+#print axioms decode_xor
+#print axioms decoded_execution
+#print axioms encoded_execution
+#print axioms terminal_role_transport
+#print axioms restored_execution
+#print axioms restored_addresswise
+#print axioms decoded_injection
+#print axioms decoded_scatter
+#print axioms scatter_permutation
+#print axioms copied_read_correct
+#print axioms copied_read_preserves_other
+#print axioms copied_fanout_correct
+#print axioms copied_fanout_preserves_other
+#print axioms mismatched_gauge_counterexample
+#print axioms dirty_temporary_counterexample
+
+end FramedXor
diff --git a/research/machine-transfer-verification/next-proof/framed/README.txt b/research/machine-transfer-verification/next-proof/framed/README.txt
new file mode 100644
index 0000000000..009d707c48
--- /dev/null
+++ b/research/machine-transfer-verification/next-proof/framed/README.txt
@@ -0,0 +1,111 @@
+TYPED ADDRESS-GAUGE REFINEMENT OF LITERAL XOR WORDS
+8 October 2026
+
+What was proved
+---------------
+FramedXor.lean is a new Lean 4.21.0 module using Std and the unchanged local
+DirtyWrapper.lean dependency. It is a general semantic refinement theorem,
+not another finite Boolean replay. Roles, addresses and initial payloads are
+universally quantified. Addresses need not be finite for these equalities.
+
+A gauge g[r] maps a logical address to its physical location. Decoding reads
+P[r,g[r].forward(a)]. Reframing a role from old to new physically reads its
+old row at old.forward(new.inverse(b)), where b is the new physical address.
+This is the payload pullback of the position pushforward new * old^{-1}.
+Both inverse laws are explicit in the Gauge structure.
+
+The typed Step constructor permits a physical XOR only when the source and
+target CURRENT gauges are equal. Trace's type records initial and final
+assignments, so an instruction cannot silently use a stale assignment.
+decoded_execution proves that the complete physical trace decodes to the
+literal XOR word obtained by erasing only reframes. encoded_execution and
+physical_execution expose both endpoint gauges; restored_execution and
+restored_addresswise cover identity endpoints and DirtyWrapper.run.
+
+Source injection and scatter have distinct source/auxiliary/target banks.
+decoded_injection and decoded_scatter are specializations of the common-gauge
+invariant. scatter_permutation proves that a literal list of auxiliary-to-
+target reads may be permuted, even if targets repeat. This justifies center-
+first dispatch at the scalar level while preserving every incidence. It does
+not allow general reordering of mixer XORs.
+
+copied_fanout_correct uses ONE newly allocated blank Option.none row, ONE
+transport to a common target gauge and an arbitrary literal list of reads.
+The fresh row is then restricted away. All Option.some original roles begin
+arbitrary; there is no clearing or overwrite of an original dirty auxiliary.
+copied_fanout_preserves_other proves exact physical preservation of every
+original role outside the target list. Allocation, copying, transport, reads
+and erasure still require the separate complete-stream and tape-cost proof.
+
+terminal_role_transport is the interface for role split/merge. destination(r)
+is the output role of input role r. Assume the scalar word has this role
+permutation and
+ g_out(destination(r)).forward(a) = sigma.forward(g_in(r).forward(a)).
+Then
+ physical_out(destination(r), b) = physical_in(r, sigma.inverse(b)).
+Thus sigma is a position pushforward; payloads use its inverse pullback.
+The equality is valid along destination's image; an outer role-permutation
+undo must separately supply its bijectivity. The parent RowInterchange proof
+is intended to instantiate the complete finite split/merge boundary.
+
+Two kernel-checked counterexamples show that unequal incident gauges invalidate
+pointwise decoded XOR semantics, and that an arbitrary dirty temporary cannot
+replace the required fresh blank copy. Neither is a counterexample to the
+actual construction; they make the necessary interfaces explicit.
+
+Verification
+------------
+The module was checked with Lean 4.21.0, commit6741444a63ee. No Mathlib, axiom
+declarations, native_decide, unsafe theorem proof, sorry or admitted result is
+used. All 18 printed main theorem axiom reports contain only propext and
+Quot.sound, except the two explicit counterexamples which require no axioms.
+The unchanged DirtyWrapper dependency has the same standard axiom boundary.
+
+Fresh reproduction, with Lean 4.21.0 installed:
+ LEAN=/path/to/lean bash check.sh /absolute/path/to/empty-build-directory
+The script recompiles both sources; it does not reuse supplied .olean files.
+build.log records the actual successful check, and proof-receipt.json binds
+the source and log hashes. Existing five Lean deliverables were not edited.
+
+Exact remaining connection to the multiplication candidate
+--------------------------------------------------------
+This closes the ABSTRACT address-gauge semantic lemma. It does not establish
+the full multiplication theorem or instantiate the selected serialized words.
+The following concrete refinement obligations remain:
+
+1. Interpret every retained rational subspace label as an actual partial-swap
+ Gauge on the complete finite q-adic address set, with valid inverse laws
+ after one common eligible runtime prime is selected. Generic Gauge is not
+ itself a proof of integrality, prime eligibility or partial-swap factorization.
+
+2. Emit a typed trace for the entire ambient two-stage circuit, not only the
+ recorded middle mixer. Early L,J,L^{-1} use D0; only the middle L uses its
+ per-role D_U path; cleanup L^{-1},V uses D1. The source and target data paths,
+ source copies, side-growth flags, endpoint corrections and complementary
+ reverse orientation must be present with their actual tensor embeddings.
+ The paper phase assignment and finite middle-incidence checks exist, but
+ no generated Lean term currently binds that full concrete trace.
+
+3. Bind each concrete copied-center fanout to the actual literal scatter list,
+ show every target still has the common D0 (or reverse D1) gauge at its read,
+ allocate only a fresh complete temporary stream, and prove the original
+ center has no intervening producer use. The new generic fanout theorem and
+ scalar scatter-permutation theorem cover semantics once these are supplied.
+
+4. Bind scalarWord of the concrete trace to the independently replayed wrapper
+ (allowing only the proved scatter permutations and explicit fresh copies).
+ Supply the all-role scalar permutation and the actual terminal gauge equation
+ to terminal_role_transport. DirtyWrapper's algebra alone does not provide
+ these concrete address/frame equalities.
+
+5. Refine each literal transport to the ordered contiguous residual blocks
+ charged by the selected profile and prove fixed-tape implementation cost,
+ whole-row divisibility, retained spectators, descriptor bounds and uniform
+ overhead. FramedXor counts no operations and proves no recurrence estimate.
+
+Reference boundary: inherited written phase/copy arguments are in baseline
+64ed4cbf872b86b81c22f104967b88d24b8e4548, notes/dag-construction.tex:94-139,
+notes/paired-construction.tex:104-113, notes/incidence-construction.tex:94-123,
+and notes/copied-centers-lemma.tex:15-76. outputs/transfer-review.txt gives the
+broader paper-level review. This module adds a genuine checked semantic lemma;
+it does not turn that limited review into complete machine verification.
diff --git a/research/machine-transfer-verification/next-proof/framed/analytic-binding-review.json b/research/machine-transfer-verification/next-proof/framed/analytic-binding-review.json
new file mode 100644
index 0000000000..4c0f8336f5
--- /dev/null
+++ b/research/machine-transfer-verification/next-proof/framed/analytic-binding-review.json
@@ -0,0 +1,64 @@
+{
+ "status": "PASS",
+ "m": 575,
+ "W": 137151806,
+ "saving": "63787735011827529/1250000000000000000000",
+ "rows": 27,
+ "rank_mass": 78860441550,
+ "deficit": 1846900,
+ "profile": {
+ "1": 1725448017,
+ "2": 83325366,
+ "3": 45690259,
+ "4": 25239096,
+ "5": 19651200,
+ "6": 18723242,
+ "7": 17106549,
+ "8": 13274680,
+ "9": 10943423,
+ "10": 8919929,
+ "11": 8639950,
+ "12": 6282197,
+ "13": 5425815,
+ "14": 4016766,
+ "15": 3351146,
+ "16": 2045758,
+ "17": 9626535,
+ "18": 919241,
+ "19": 320551,
+ "20": 300081,
+ "21": 16346100,
+ "22": 97405,
+ "23": 72402275,
+ "25": 64793806,
+ "481": 8146600,
+ "525": 64793806,
+ "529": 64211400
+ },
+ "selected_bindings": [
+ {
+ "path": "outputs/selected-certificate.json",
+ "sha256": "432a05ae372a33dd896ea68d9b5ac47a73f9142d07bcab4105d7ba95b46d9186",
+ "exact": true
+ },
+ {
+ "path": "work/pr-ranked-pair/research/ranked-pair-verification/selected-certificate.json",
+ "sha256": "2232029805c07002cc58c45c78bdae4a447b669b7635ee165dad51a859a8c5de",
+ "exact": true
+ }
+ ],
+ "profile_provenance": {
+ "path": "outputs/pair-ranked-profile.json",
+ "sha256": "b4e395509525937d9c9a4275387cd6e800549bf9e06aef291ba909d95a1103f3"
+ },
+ "literal_witnesses_equal": true,
+ "independently_rechecked_rational_inequalities": true,
+ "rational_upper": "4285993937499999999999976448039486063/4285993937500000000000000000000000000",
+ "rational_gap": "23551960513937/4285993937500000000000000000000000000",
+ "analytic_source_sha256": {
+ "AnalyticEnclosures.lean": "bbbf93a1f68b6176e71379f6c2036e4b4379f13ba7ab8d9c749ba5ce9624cb0e",
+ "SelectedProfileCertificate.lean": "0c6db6a2ed5d2da082e3005553b0981a9391f90273a0c1b9613cb66b39c54bd4",
+ "SelectedProfileReal.lean": "b8d0fc896348906e60b91729f41c30f464d0b7283bc5cd49b831182f01700714"
+ },
+ "scope": "Independent source/literal/rational audit, not a new Lean build. The real-analytic proof and its standard-axiom logs were reviewed separately. Physical graph-to-profile and machine transfer remain separate."
+}
diff --git a/research/machine-transfer-verification/next-proof/framed/check.sh b/research/machine-transfer-verification/next-proof/framed/check.sh
new file mode 100644
index 0000000000..12ef073248
--- /dev/null
+++ b/research/machine-transfer-verification/next-proof/framed/check.sh
@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+set -euo pipefail
+framed_source_dir="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+framed_build_dir="${1:?Usage: LEAN=/path/to/lean bash check.sh /absolute/build-directory}"
+framed_lean="${LEAN:-lean}"
+mkdir -p "$framed_build_dir"
+framed_build_dir="$(cd -- "$framed_build_dir" && pwd)"
+"$framed_lean" --version
+"$framed_lean" -o "$framed_build_dir/DirtyWrapper.olean" "$framed_source_dir/DirtyWrapper.lean"
+LEAN_PATH="$framed_build_dir" "$framed_lean" -o "$framed_build_dir/FramedXor.olean" "$framed_source_dir/FramedXor.lean"
diff --git a/research/machine-transfer-verification/next-proof/framed/check_analytic_binding.py b/research/machine-transfer-verification/next-proof/framed/check_analytic_binding.py
new file mode 100644
index 0000000000..7ddb3cb4e4
--- /dev/null
+++ b/research/machine-transfer-verification/next-proof/framed/check_analytic_binding.py
@@ -0,0 +1,112 @@
+#!/usr/bin/env python3
+"""Independent literal/profile and rational-witness audit; does not rerun Lean."""
+import argparse
+from fractions import Fraction as Q
+from hashlib import sha256
+import json
+from math import factorial
+from pathlib import Path
+import re
+
+
+def require(condition, message):
+ if not condition:
+ raise ValueError(message)
+
+
+def main():
+ parser = argparse.ArgumentParser(description=__doc__)
+ parser.add_argument("--analytic", required=True, type=Path)
+ parser.add_argument("--selected", required=True, type=Path, action="append")
+ parser.add_argument("--profile-source", type=Path)
+ parser.add_argument("--output", required=True, type=Path)
+ args = parser.parse_args()
+ path = args.analytic
+ source = (path / "SelectedProfileCertificate.lean").read_text()
+ witnesses = json.loads((path / "selected-witnesses.json").read_text())
+ manifest = json.loads((path / "theorem-manifest.json").read_text())
+
+ def literal(name, domain):
+ expression = re.findall(rf"^def {name} : {domain} := (.+)$", source, re.M)
+ require(len(expression) == 1, "Missing or repeated literal " + name)
+ if domain == "ℕ":
+ require(expression[0].isdigit(), "Nonliteral natural " + name)
+ return int(expression[0])
+ match = re.fullmatch(r"\((\d+) / (\d+) : ℚ\)", expression[0])
+ require(match is not None, "Nonliteral rational " + name)
+ return Q(int(match[1]), int(match[2]))
+
+ m, W = literal("m", "ℕ"), literal("W", "ℕ")
+ saving, log_two = literal("saving", "ℚ"), literal("logTwoUpper", "ℚ")
+ regions = re.findall(r"def rows : List Row := \[(.*?)\]", source, re.S)
+ require(len(regions) == 1, "Missing or repeated row list")
+ constructor = re.compile(r"⟨(\d+), (\d+), (\d+), \((\d+) / (\d+) : ℚ\), \((\d+) / (\d+) : ℚ\)⟩")
+ matches = list(constructor.finditer(regions[0]))
+ require(re.fullmatch(r"[\s,]*", constructor.sub("", regions[0])) is not None,
+ "Unparsed syntax in literal row list")
+ rows = [dict(width=int(t), multiplicity=int(n), scale=int(k),
+ logSmall=str(Q(int(ln), int(ld))), expUpper=str(Q(int(un), int(ud))))
+ for t, n, k, ln, ld, un, ud in (match.groups() for match in matches)]
+ require(len(rows) == 27 and rows == witnesses["rows"], "Literal/witness row mismatch")
+ require(m == witnesses["m"] and W == witnesses["W"] and saving == Q(witnesses["saving"])
+ and log_two == Q(witnesses["log_two_upper"]), "Literal/witness parameter mismatch")
+ profile = {str(row["width"]): row["multiplicity"] for row in rows}
+ require(len(profile) == len(rows), "Duplicate width")
+ require(0 < saving < 1 and m > 1 and W > 0, "Invalid parameters")
+ mass = sum(row["width"] * row["multiplicity"] for row in rows)
+ bindings = []
+ for certificate in args.selected:
+ data = json.loads(certificate.read_text())
+ require(data["bit"]["child_multiplicities"] == profile, "Selected multiplicity mismatch")
+ require(data["bit"]["m"] == data["finite_bridge"]["bit"]["m"] == m, "Selected m mismatch")
+ require(data["bit"]["W"] == data["finite_bridge"]["bit"]["W"] == W, "Selected W mismatch")
+ require(Q(data["bit_saving"]) == Q(data["assembly"]["parameters"]["a_bit"]) == saving,
+ "Selected saving mismatch")
+ require(data["bit"]["total_rank"] == mass and data["bit"]["deficit"] == m * W - mass,
+ "Selected mass/deficit mismatch")
+ require(data["bit"]["maxchild"] == max(row["width"] for row in rows), "Selected maxchild mismatch")
+ bindings.append(dict(path=str(certificate), sha256=sha256(certificate.read_bytes()).hexdigest(), exact=True))
+
+ def polynomial(x, terms):
+ return sum((x ** j / factorial(j) for j in range(terms)), Q())
+
+ require(log_two >= 0 and 2 <= polynomial(log_two, 24), "Log-two witness fails")
+ moment = Q()
+ for row in rows:
+ t, n, k = row["width"], row["multiplicity"], row["scale"]
+ L, U = Q(row["logSmall"]), Q(row["expUpper"])
+ ratio = Q(m, t * 2 ** k)
+ x = saving * (k * log_two + L)
+ require(0 < t < m and n > 0 and L >= 0, "Invalid literal row")
+ require(ratio <= polynomial(L, 24), "Lower-exponential log witness fails")
+ require(0 <= x <= 1, "Exponential argument domain fails")
+ require(polynomial(x, 8) + x ** 8 * 9 / (factorial(8) * 8) <= U,
+ "Upper-exponential witness fails")
+ moment += Q(n * t, m * W) * U
+ require(moment < 1 and moment == Q(witnesses["rational_moment_upper"])
+ and 1 - moment == Q(witnesses["rational_gap"]), "Rational moment/gap mismatch")
+ gap = re.findall(r"^theorem rational_gap_exact : 1 - rationalUpper = \((\d+) / (\d+) : ℚ\)", source, re.M)
+ require(len(gap) == 1 and Q(*map(int, gap[0])) == 1 - moment, "Lean gap literal mismatch")
+ source_binding = None
+ if args.profile_source:
+ digest = sha256(args.profile_source.read_bytes()).hexdigest()
+ require(digest == witnesses["source_sha256"], "Witness provenance file hash mismatch")
+ require(json.loads(args.profile_source.read_text())["bit"]["child_multiplicities"] == profile,
+ "Witness provenance profile mismatch")
+ source_binding = dict(path=str(args.profile_source), sha256=digest)
+ for name, record in manifest["files"].items():
+ require(sha256((path / name).read_bytes()).hexdigest() == record["sha256"], "Analytic source hash mismatch")
+ report = dict(status="PASS", m=m, W=W, saving=str(saving), rows=len(rows),
+ rank_mass=mass, deficit=m * W - mass, profile=profile,
+ selected_bindings=bindings, profile_provenance=source_binding,
+ literal_witnesses_equal=True, independently_rechecked_rational_inequalities=True,
+ rational_upper=str(moment), rational_gap=str(1 - moment),
+ analytic_source_sha256={name:record["sha256"] for name,record in manifest["files"].items()},
+ scope="Independent source/literal/rational audit, not a new Lean build. The real-analytic proof and its standard-axiom logs were reviewed separately. Physical graph-to-profile and machine transfer remain separate.")
+ args.output.parent.mkdir(parents=True, exist_ok=True)
+ args.output.write_text(json.dumps(report, indent=2) + "\n")
+ print("PASS: 27 literal rows, both selected certificates, all rational witnesses, exact real-power normalization reviewed")
+
+
+if __name__ == "__main__":
+ main()
diff --git a/research/machine-transfer-verification/next-proof/framed/proof-receipt.json b/research/machine-transfer-verification/next-proof/framed/proof-receipt.json
new file mode 100644
index 0000000000..253ed33d8a
--- /dev/null
+++ b/research/machine-transfer-verification/next-proof/framed/proof-receipt.json
@@ -0,0 +1,33 @@
+{
+ "status": "PASS",
+ "lean_version": "Lean (version 4.21.0, arm64-apple-darwin23.6.0, commit 6741444a63ee, Release)",
+ "theorem_axiom_reports": [
+ "'FramedXor.decode_reframe' depends on axioms: [propext, Quot.sound]",
+ "'FramedXor.reframe_composition' depends on axioms: [propext, Quot.sound]",
+ "'FramedXor.reframe_inverse' depends on axioms: [propext, Quot.sound]",
+ "'FramedXor.decode_xor' depends on axioms: [propext, Quot.sound]",
+ "'FramedXor.decoded_execution' depends on axioms: [propext, Quot.sound]",
+ "'FramedXor.encoded_execution' depends on axioms: [propext, Quot.sound]",
+ "'FramedXor.terminal_role_transport' depends on axioms: [propext, Quot.sound]",
+ "'FramedXor.restored_execution' depends on axioms: [propext, Quot.sound]",
+ "'FramedXor.restored_addresswise' depends on axioms: [propext, Quot.sound]",
+ "'FramedXor.decoded_injection' depends on axioms: [propext, Quot.sound]",
+ "'FramedXor.decoded_scatter' depends on axioms: [propext, Quot.sound]",
+ "'FramedXor.scatter_permutation' depends on axioms: [propext, Quot.sound]",
+ "'FramedXor.copied_read_correct' depends on axioms: [propext, Quot.sound]",
+ "'FramedXor.copied_read_preserves_other' depends on axioms: [propext, Quot.sound]",
+ "'FramedXor.copied_fanout_correct' depends on axioms: [propext, Quot.sound]",
+ "'FramedXor.copied_fanout_preserves_other' depends on axioms: [propext, Quot.sound]",
+ "'FramedXor.mismatched_gauge_counterexample' does not depend on any axioms",
+ "'FramedXor.dirty_temporary_counterexample' does not depend on any axioms"
+ ],
+ "files_sha256": {
+ "FramedXor.lean": "67d8385bdcdb0a553c09252bcc95d80fb8417beb8dfb6834a186c6f0b13862c9",
+ "DirtyWrapper.lean": "3ee3ee58cdb31bfa29c09c5f25b07f123b06988bdc7af8fcbc4062ba2780e30f",
+ "check.sh": "bd3445db43c1bee3d1ef2edd095f8163f28a9085aca4e59a7745e1193261ae09",
+ "build.log": "539994495f2c0dcf1d019a0943c0c8bd7e5fba1b09e8d45c4c28027b5c70cd2a",
+ "README.txt": "6103a31ecdfeef1fa5c77c74340cfedb4951664ec8fb50056891ca0e71ae1cb5"
+ },
+ "dirty_wrapper_matches_prior_deliverable": true,
+ "scope": "Generic typed address-gauge and fresh-copy semantics. No concrete selected full framed trace, physical residual cost, all-size machine recurrence or multiplication theorem is claimed."
+}
diff --git a/research/machine-transfer-verification/next-proof/rows/RowInterchange.lean b/research/machine-transfer-verification/next-proof/rows/RowInterchange.lean
new file mode 100644
index 0000000000..c96df2b119
--- /dev/null
+++ b/research/machine-transfer-verification/next-proof/rows/RowInterchange.lean
@@ -0,0 +1,158 @@
+import Mathlib.Tactic
+import FramedXor
+
+/-!
+Finite semantics of cyclic row splitting and merging.
+
+The physical row index is exactly `W * group + role`. Every role receives
+`R` complete rows, including every address and arbitrary initial payload.
+The framed-trace corollary exposes both required endpoint hypotheses:
+the scalar word permutes roles, and the terminal gauges differ by a common
+address permutation preserving the group coordinate. No machine running
+time, concrete emitted trace, or recursive child accounting is assumed proved.
+-/
+
+namespace RowInterchange
+
+def joinRow {W R : ℕ} (w : Fin W) (g : Fin R) : Fin (W * R) :=
+ ⟨W * g.val + w.val, by
+ calc W * g.val + w.val < W * g.val + W := Nat.add_lt_add_left w.isLt _
+ _ = W * (g.val + 1) := by ring
+ _ ≤ W * R := Nat.mul_le_mul_left W g.isLt⟩
+
+def roleOf {W R : ℕ} (hW : 0 < W) (r : Fin (W * R)) : Fin W :=
+ ⟨r.val % W, Nat.mod_lt _ hW⟩
+
+def groupOf {W R : ℕ} (hW : 0 < W) (r : Fin (W * R)) : Fin R :=
+ ⟨r.val / W, (Nat.div_lt_iff_lt_mul hW).2 (by simpa only [mul_comm R W] using r.isLt)⟩
+
+theorem join_split {W R : ℕ} (hW : 0 < W) (r : Fin (W * R)) :
+ joinRow (roleOf hW r) (groupOf hW r) = r := by
+ apply Fin.ext
+ exact Nat.div_add_mod r.val W
+
+theorem role_join {W R : ℕ} (hW : 0 < W) (w : Fin W) (g : Fin R) :
+ roleOf hW (joinRow w g) = w := by
+ apply Fin.ext
+ simp [roleOf, joinRow, Nat.add_mod, Nat.mod_eq_of_lt w.isLt]
+
+theorem group_join {W R : ℕ} (hW : 0 < W) (w : Fin W) (g : Fin R) :
+ groupOf hW (joinRow w g) = g := by
+ apply Fin.ext
+ change (W * g.val + w.val) / W = g.val
+ rw [Nat.mul_add_div hW]
+ simp [Nat.div_eq_of_lt w.isLt]
+
+/-- This equivalence accounts for every finite row exactly once. -/
+def rowEquiv {W R : ℕ} (hW : 0 < W) : Fin (W * R) ≃ Fin W × Fin R where
+ toFun r := (roleOf hW r, groupOf hW r)
+ invFun p := joinRow p.1 p.2
+ left_inv := join_split hW
+ right_inv p := by simp [role_join, group_join]
+
+abbrev Payload (N : ℕ) (A B : Type) := Fin N → A → B
+
+def splitRows {W R : ℕ} {A B : Type} (input : Payload (W * R) A B) :
+ Fin W → (Fin R × A) → B := fun w p => input (joinRow w p.1) p.2
+
+/-- `destination` maps each original role to its terminal physical role.
+Reading that terminal role undoes the permutation while merging. -/
+def mergeRows {W R : ℕ} {A B : Type} (hW : 0 < W)
+ (destination : Fin W ≃ Fin W) (output : Fin W → (Fin R × A) → B) :
+ Payload (W * R) A B :=
+ fun r a => output (destination (roleOf hW r)) (groupOf hW r, a)
+
+theorem merge_split {W R : ℕ} {A B : Type} (hW : 0 < W)
+ (input : Payload (W * R) A B) :
+ mergeRows hW (Equiv.refl _) (splitRows input) = input := by
+ funext r a
+ simp [mergeRows, splitRows, join_split]
+
+/-- A common address pullback on complete role rows induces exactly that
+pullback on original rows, with the original row coordinate unchanged. -/
+theorem merge_uniform {W R : ℕ} {A B : Type} (hW : 0 < W)
+ (destination : Fin W ≃ Fin W) (addressPullback : A → A)
+ (input : Payload (W * R) A B) (output : Fin W → (Fin R × A) → B)
+ (endpoint : ∀ w g a, output (destination w) (g, a) =
+ splitRows input w (g, addressPullback a)) :
+ mergeRows hW destination output = fun r a => input r (addressPullback a) := by
+ funext r a
+ simp only [mergeRows, endpoint, splitRows, join_split]
+
+/-- Lift an address gauge while leaving the complete-row group unchanged. -/
+def groupGauge {R : ℕ} {A : Type} (gauge : FramedXor.Gauge A) :
+ FramedXor.Gauge (Fin R × A) where
+ forward p := (p.1, gauge.forward p.2)
+ inverse p := (p.1, gauge.inverse p.2)
+ inverse_forward p := by simp [gauge.inverse_forward]
+ forward_inverse p := by simp [gauge.forward_inverse]
+
+/-- Composition with the literal framed interpreter. This is a semantic
+transfer theorem with explicit scalar-word and gauge-endpoint premises. -/
+theorem framed_rows {W R : ℕ} {A : Type} (hW : 0 < W)
+ {first last : FramedXor.Assignment (Fin W) (Fin R × A)}
+ (trace : FramedXor.Trace first last) (destination : Fin W ≃ Fin W)
+ (addressMap : FramedXor.Gauge A)
+ (scalar_roles : ∀ (logical : DirtyWrapper.Rows (Fin W) (Fin R × A)) role address,
+ DirtyWrapper.runRows (FramedXor.scalarWord trace) logical (destination role) address =
+ logical role address)
+ (terminal_frames : ∀ role address,
+ (last (destination role)).forward address =
+ (groupGauge addressMap).forward ((first role).forward address))
+ (input : Payload (W * R) A Bool) :
+ mergeRows hW destination (FramedXor.execute trace (splitRows input)) =
+ fun row address => input row (addressMap.inverse address) := by
+ apply merge_uniform
+ intro w g a
+ exact FramedXor.terminal_role_transport trace destination (groupGauge addressMap)
+ scalar_roles terminal_frames (splitRows input) w (g, a)
+
+/-- Outer padding contains fresh blank rows only; every original row remains
+arbitrary. Its correctness requires a row-preserving endpoint, not linearity. -/
+def padRows {N M : ℕ} {A B : Type} (blank : B) (input : Payload N A B) :
+ Payload M A B := fun r a => if h : r.val < N then input ⟨r.val, h⟩ a else blank
+
+def restrictRows {N M : ℕ} {A B : Type} (hNM : N ≤ M)
+ (input : Payload M A B) : Payload N A B :=
+ fun r a => input ⟨r.val, Nat.lt_of_lt_of_le r.isLt hNM⟩ a
+
+theorem restrict_pad {N M : ℕ} {A B : Type} (hNM : N ≤ M)
+ (blank : B) (input : Payload N A B) :
+ restrictRows hNM (padRows blank input) = input := by
+ funext r a
+ simp [restrictRows, padRows, r.isLt]
+
+theorem padding_commutes {N M : ℕ} {A B : Type} (blank : B)
+ (input : Payload N A B) (addressPullback : A → A) :
+ (fun r a => (padRows blank input : Payload M A B) r (addressPullback a)) =
+ padRows blank (fun r a => input r (addressPullback a)) := by
+ funext r a
+ simp [padRows]
+
+theorem padded_endpoint_restrict {N M : ℕ} {A B : Type} (hNM : N ≤ M)
+ (blank : B) (input : Payload N A B) (addressPullback : A → A)
+ (output : Payload M A B)
+ (endpoint : output = fun r a => (padRows blank input : Payload M A B) r (addressPullback a)) :
+ restrictRows hNM output = fun r a => input r (addressPullback a) := by
+ rw [endpoint, padding_commutes, restrict_pad]
+
+theorem padded_endpoint_blank {N M : ℕ} {A B : Type}
+ (blank : B) (input : Payload N A B) (addressPullback : A → A)
+ (output : Payload M A B)
+ (endpoint : output = fun r a => (padRows blank input : Payload M A B) r (addressPullback a))
+ (r : Fin M) (h : N ≤ r.val) (a : A) : output r a = blank := by
+ rw [endpoint]
+ simp [padRows, Nat.not_lt_of_ge h]
+
+end RowInterchange
+
+#print axioms RowInterchange.join_split
+#print axioms RowInterchange.role_join
+#print axioms RowInterchange.group_join
+#print axioms RowInterchange.merge_split
+#print axioms RowInterchange.merge_uniform
+#print axioms RowInterchange.framed_rows
+#print axioms RowInterchange.restrict_pad
+#print axioms RowInterchange.padding_commutes
+#print axioms RowInterchange.padded_endpoint_restrict
+#print axioms RowInterchange.padded_endpoint_blank
diff --git a/research/machine-transfer-verification/next-proof/rows/adversarial-review.txt b/research/machine-transfer-verification/next-proof/rows/adversarial-review.txt
new file mode 100644
index 0000000000..2c1801580e
--- /dev/null
+++ b/research/machine-transfer-verification/next-proof/rows/adversarial-review.txt
@@ -0,0 +1,23 @@
+Independent statement review — lean-foundations agent, 8 October2026
+
+No specification weakening or orientation defect was found.
+
+joinRow uses W*g+w, roleOf uses r%W, groupOf uses r/W. Both inverse
+laws apply to every finite row. The destination equivalence maps original
+role to terminal physical role; reading destination(roleOf r) during merge
+correctly undoes that role permutation.
+
+The endpoint relation is last.forward = addressMap.forward composed with
+first.forward. Its induced payload map is therefore addressMap.inverse.
+framed_rows uses exactly this pullback and groupGauge preserves the complete
+row-group coordinate. Padding assumes only a row-preserving endpoint; it
+does not assume original rows or original auxiliary data are zero.
+
+This is semantic composition with explicit typed trace, scalar_roles and
+terminal_frames premises. It does not establish those concrete premises,
+the actual tape split/merge procedure, recursive row stock, or time costs.
+
+The principal subsequently made only a simplifier-annotation change and
+reran the delivered check.py from fresh dependency oleans. Final source and
+all ten theorem audits are bound in verification.json. No proof escape or
+nonstandard axiom occurs in the successful final log.
diff --git a/research/machine-transfer-verification/next-proof/rows/check.py b/research/machine-transfer-verification/next-proof/rows/check.py
new file mode 100644
index 0000000000..c7bfc92337
--- /dev/null
+++ b/research/machine-transfer-verification/next-proof/rows/check.py
@@ -0,0 +1,71 @@
+#!/usr/bin/env python3
+"""Compile the row theorem from fresh dependency oleans in pinned Mathlib."""
+import argparse
+import hashlib
+import json
+import os
+from pathlib import Path
+import re
+import shutil
+import subprocess
+import tempfile
+
+HERE = Path(__file__).resolve().parent
+EXPECTED = {
+ "join_split", "role_join", "group_join", "merge_split", "merge_uniform",
+ "framed_rows", "restrict_pad", "padding_commutes",
+ "padded_endpoint_restrict", "padded_endpoint_blank",
+}
+
+def main():
+ parser = argparse.ArgumentParser(description=__doc__)
+ parser.add_argument("--mathlib-project", type=Path, required=True)
+ parser.add_argument("--lean-bin", type=Path, required=True)
+ args = parser.parse_args()
+ project = args.mathlib_project.resolve()
+ lean_bin = args.lean_bin.resolve()
+ sources = [HERE.parent / "framed" / n for n in ("DirtyWrapper.lean", "FramedXor.lean")]
+ sources.append(HERE / "RowInterchange.lean")
+ for source in sources:
+ if not source.is_file():
+ raise SystemExit(f"Missing source: {source}")
+ env = os.environ.copy()
+ env["PATH"] = str(lean_bin) + os.pathsep + env.get("PATH", "")
+ version = subprocess.check_output([str(lean_bin / "lean"), "--version"], text=True)
+ if not re.search(r"version 4\.21\.0(?:,|\s)", version):
+ raise SystemExit(f"Expected Lean4.21.0, received {version.strip()}")
+ logs = []
+ with tempfile.TemporaryDirectory(prefix="row-semantics-") as tmp:
+ root = Path(tmp)
+ env["LEAN_PATH"] = str(root)
+ for source in sources:
+ local = root / source.name
+ shutil.copy2(source, local)
+ result = subprocess.run(
+ [str(lean_bin / "lake"), "env", "lean", "--root=" + str(root),
+ "-o", str(local.with_suffix(".olean")), str(local)],
+ cwd=project, env=env, text=True, stdout=subprocess.PIPE, stderr=subprocess.STDOUT,
+ )
+ logs.append(f"SOURCE {source.name}\n{result.stdout}")
+ if result.returncode or re.search(r"\b(sorryAx|native_decide|Lean\.ofReduceBool)\b", result.stdout):
+ (HERE / "verification.log").write_text("\n".join(logs))
+ raise SystemExit(f"Compilation or axiom audit failed: {source.name}")
+ row_log = result.stdout
+ declarations = re.findall(r"'RowInterchange\.([^']+)' depends on axioms: \[([^\]]*)\]", row_log)
+ if {name for name, _ in declarations} != EXPECTED:
+ raise SystemExit("Unexpected or incomplete row declaration audit")
+ for name, axioms in declarations:
+ if set(filter(None, (x.strip() for x in axioms.split(',')))) - {"propext", "Quot.sound", "Classical.choice"}:
+ raise SystemExit(f"Nonstandard axiom: {name}: {axioms}")
+ (HERE / "verification.log").write_text("\n".join(logs))
+ receipt = {
+ "status": "PASS", "toolchain": version.strip(), "row_theorems_audited": len(EXPECTED),
+ "axioms": {name: [x.strip() for x in axioms.split(',') if x.strip()] for name, axioms in declarations},
+ "source_sha256": {source.name: hashlib.sha256(source.read_bytes()).hexdigest() for source in sources},
+ "scope": "Finite cyclic-row bijection; framed semantic endpoint under explicit scalar/gauge premises; zero-padding restriction. No concrete compiler trace or tape-cost theorem.",
+ }
+ (HERE / "verification.json").write_text(json.dumps(receipt, indent=2) + "\n")
+ print(json.dumps(receipt, indent=2))
+
+if __name__ == "__main__":
+ main()
diff --git a/research/machine-transfer-verification/next-proof/rows/proof-scope.txt b/research/machine-transfer-verification/next-proof/rows/proof-scope.txt
new file mode 100644
index 0000000000..aaa1cd2070
--- /dev/null
+++ b/research/machine-transfer-verification/next-proof/rows/proof-scope.txt
@@ -0,0 +1,53 @@
+FINITE CYCLIC ROW TRANSFER — Lean4.21.0
+
+RowInterchange.lean uses the new FramedXor.lean and the previously published
+DirtyWrapper.lean, plus the existing pinned Mathlib project. It introduces no
+axiom and no admitted proof. check.py rebuilds all three modules from sources
+in an empty temporary directory, then audits ten row theorem declarations.
+
+The mathematical payload has finite rows Fin(W*R), arbitrary address type A,
+and arbitrary values B. The address-aware interpreter specialization uses Bool.
+There is no assumption of blank original rows or nonempty address type.
+
+join_split, role_join, group_join:
+ The explicit row number W*g+w is inverse to (r mod W,r div W), for W>0.
+ The rowEquiv definition makes the resulting finite bijection explicit:
+ every role has exactly R complete rows, with all addresses retained.
+
+merge_split:
+ Literal split and merge are inverse on every original payload.
+
+merge_uniform:
+ If terminal role destination(w) has input role w with the same group and
+ a common address pullback, undoing destination during merge gives exactly
+ that address pullback on each original row, without changing row identity.
+
+framed_rows:
+ Applies FramedXor.terminal_role_transport to the literal typed interpreter.
+ Its scalar_roles premise states the scalar word's terminal role permutation.
+ Its terminal_frames premise states g_out(destination w)=sigma ∘ g_in(w),
+ where sigma preserves the group coordinate and acts on the address only.
+ The conclusion is pullback by sigma.inverse, not by sigma.forward.
+ Gauge bijectivity is part of Gauge; role bijectivity is part of Equiv.
+
+restrict_pad, padding_commutes, padded_endpoint_restrict,
+padded_endpoint_blank:
+ Padding adds only blank new rows. A row-preserving common address map
+ preserves these blanks, and restriction gives the desired map on every
+ original row. The original data remain arbitrary. No linearity or zero
+ original auxiliary state is assumed.
+
+Remaining application obligations:
+ - Construct the concrete word as a typed Trace with its actual gauges.
+ - Discharge its scalar role endpoint and common terminal-gauge identity.
+ - Prove every recursive invocation has the required divisible row stock.
+ - Construct and charge split/merge, frame paths, parking, routing, fresh
+ blank allocation/erase, and residual operations on one fixed-tape machine.
+ - Bind exact finite profiles to those operations and to all-size costs.
+
+These theorems close semantic layout interfaces. They do not establish any
+new exponent or an unconditional integer-multiplication algorithm.
+
+Reproduction from any cached checkout of the pinned project:
+ python3 check.py --mathlib-project /path/to/formal/lean \
+ --lean-bin /path/to/lean-4.21.0/bin
diff --git a/research/machine-transfer-verification/next-proof/rows/verification.json b/research/machine-transfer-verification/next-proof/rows/verification.json
new file mode 100644
index 0000000000..aad4d6ec7b
--- /dev/null
+++ b/research/machine-transfer-verification/next-proof/rows/verification.json
@@ -0,0 +1,50 @@
+{
+ "status": "PASS",
+ "toolchain": "Lean (version 4.21.0, arm64-apple-darwin23.6.0, commit 6741444a63ee, Release)",
+ "row_theorems_audited": 10,
+ "axioms": {
+ "join_split": [
+ "propext"
+ ],
+ "role_join": [
+ "propext"
+ ],
+ "group_join": [
+ "propext",
+ "Quot.sound"
+ ],
+ "merge_split": [
+ "propext",
+ "Quot.sound"
+ ],
+ "merge_uniform": [
+ "propext",
+ "Quot.sound"
+ ],
+ "framed_rows": [
+ "propext",
+ "Quot.sound"
+ ],
+ "restrict_pad": [
+ "propext",
+ "Quot.sound"
+ ],
+ "padding_commutes": [
+ "propext",
+ "Quot.sound"
+ ],
+ "padded_endpoint_restrict": [
+ "propext",
+ "Quot.sound"
+ ],
+ "padded_endpoint_blank": [
+ "propext"
+ ]
+ },
+ "source_sha256": {
+ "DirtyWrapper.lean": "3ee3ee58cdb31bfa29c09c5f25b07f123b06988bdc7af8fcbc4062ba2780e30f",
+ "FramedXor.lean": "67d8385bdcdb0a553c09252bcc95d80fb8417beb8dfb6834a186c6f0b13862c9",
+ "RowInterchange.lean": "9981188ca9712bb8565741659c20db35768588eb2eef5db6bd610dbf82b10a3a"
+ },
+ "scope": "Finite cyclic-row bijection; framed semantic endpoint under explicit scalar/gauge premises; zero-padding restriction. No concrete compiler trace or tape-cost theorem."
+}
diff --git a/research/machine-transfer-verification/pair-ranked-profile.json b/research/machine-transfer-verification/pair-ranked-profile.json
new file mode 100644
index 0000000000..12d98bdf22
--- /dev/null
+++ b/research/machine-transfer-verification/pair-ranked-profile.json
@@ -0,0 +1,288 @@
+{
+ "kappa": "5101691/100000000000",
+ "bit_saving": "39859/781250000",
+ "assembly": {
+ "absorption_gap": "2789682368533483055549/390644929499999960141000000000000",
+ "constraints": {
+ "K_dominates_log": "19929500097596461499902383609/390644929499999960141000000000000",
+ "K_geometry": "292988679500097616391/390644929499999960141000000000000",
+ "a_below_b": "129253/6250000000",
+ "a_positive": "39859/781250000",
+ "alpha_below_one": "781249999999609394929499999960141/781289858999999920282000000000000",
+ "alpha_below_one_fourth": "195282605749609454717999999960141/781289858999999920282000000000000",
+ "alpha_positive": "39859000390525352500000039859/781289858999999920282000000000000",
+ "artificial_boundary": "21876275488004294383812499999880423/3125159435999999681128000000000000",
+ "b_below_one_over32": "311783/10000000",
+ "beta_below_one": "19/20",
+ "beta_positive": "1/20",
+ "c_below_one": "390605070499902383609/390625000000000000000",
+ "c_positive": "19929500097616391/390625000000000000000",
+ "cell_above_band": "781249999998828105070500000039859/1562579717999999840564000000000000",
+ "compact_leaf": "6677921875039859/390625000000000000000",
+ "compact_reservations": "1/4000000000000",
+ "delta_below_one_eighth": "999999999999/8000000000000",
+ "delta_positive": "1/8000000000000",
+ "epsilon_below_one": "19929500390585141/390644929499999960141",
+ "epsilon_positive": "390624999999609375000/390644929499999960141",
+ "g1_above_kappa": "318032729803348301569/39064492949999996014100000000000",
+ "g2_above_kappa": "261/100000000000",
+ "g3_above_kappa": "2789682368533483055549/390644929499999960141000000000000",
+ "g4_above_kappa": "261/100000000000",
+ "g5_above_kappa": "4697878747353572864963/625031887199999936225600000000000",
+ "g6_above_kappa": "25051973454767864165379/3125159435999999681128000000000000",
+ "g7_above_kappa": "39060507050239911715703348301569/39064492949999996014100000000000",
+ "gamma_sublinear": "1/2000000000000",
+ "guard_width": "19929500390585141/390644929499999960141",
+ "lambda_above_internal": "39859/781250000000000000000",
+ "lambda_above_sigma": "16156625000039859/781250000000000000000",
+ "lambda_above_tau": "39859/781250000000000000000",
+ "lambda_prime_above_lambda": "39859/781250000000000000000",
+ "lambda_prime_below_one": "19929499999960141/390625000000000000000",
+ "literal_scalar_guard": "9693793493753822316795466474748",
+ "phase_boundary": "31887200234291296100000039859/625031887199999936225600000000000",
+ "phase_leaf_above_bit": "427387/25000000000",
+ "phase_local": "159436002734036198500000039859/3125159435999999681128000000000000",
+ "prime_interval_packing": "19929500390585141/390644929499999960141",
+ "q_below_internal": "39859/390625000000000000000",
+ "q_below_leaf": "6677921875039859/390625000000000000000",
+ "q_below_reservations": "1/4000000000000",
+ "q_positive": "19929499999960141/390625000000000000000",
+ "record_suffix": "19929500390585141/390644929499999960141",
+ "row_product_gap": "6548/25",
+ "short_record_fallback": "305160210533449883720338739881/305191351171874968860156250000",
+ "small_field_exposure": "1/1000000000000"
+ },
+ "finite_bridge": {
+ "bit": {
+ "W": 137151806,
+ "halving_degree": 9,
+ "m": 575,
+ "maxchild": 529,
+ "wire_bits": 28
+ },
+ "complex": {
+ "W": 537696432,
+ "halving_degree": 20,
+ "m": 784,
+ "maxchild": 756,
+ "s": 421548223824,
+ "scalar_group_upper": 4793351472,
+ "wire_bits": 30
+ },
+ "rows": {
+ "coefficient": 852,
+ "degree": 2000,
+ "degree_gap": "6548/25",
+ "suffix_slope": 8000
+ },
+ "semantic": {
+ "B": 9696565176891520488614054257040,
+ "C0": 2358858462850846165593256368932965330169899180021667007021321420800,
+ "C1": 1,
+ "E": 9696565176891520488192506033216,
+ "induction_gap": 533311084729033626873772984137200,
+ "literal_charge": 2771683137698171397039558468,
+ "strict_literal_gap": 9693793493753822316795466474748
+ }
+ },
+ "margins": {
+ "g1": "19929500390585141/390644929499999960141",
+ "g2": "39859/781250000",
+ "g3": "19929499999940211500000039859/390644929499999960141000000000000",
+ "g4": "39859/781250000",
+ "g5": "31887200234291296100000039859/625031887199999936225600000000000",
+ "g6": "159436002734036198500000039859/3125159435999999681128000000000000",
+ "g7": "390624999999609375000/390644929499999960141"
+ },
+ "minimum_margin": "19929499999940211500000039859/390644929499999960141000000000000",
+ "parameters": {
+ "C0": 2358858462850846165593256368932965330169899180021667007021321420800,
+ "C1": "1",
+ "a_bit": "39859/781250000",
+ "a_complex": "717/10000000",
+ "alpha_squared_power": "39859000390525352500000039859/781289858999999920282000000000000",
+ "beta": "1/20",
+ "c": "19929500097616391/390625000000000000000",
+ "delta": "1/8000000000000",
+ "epsilon": "390624999999609375000/390644929499999960141",
+ "h": "1/1000000000000",
+ "kappa": "5101691/100000000000",
+ "lambda_": "781210141000000039859/781250000000000000000",
+ "lambda_prime": "390605070500000039859/390625000000000000000",
+ "q": "19929499999960141/390625000000000000000",
+ "sigma": "9999283/10000000",
+ "tau": "781210141/781250000"
+ },
+ "recurrence": {
+ "internal": "781210141/781250000",
+ "leaf": "199986377/200000000",
+ "reservations": "390605070499902383609/390625000000000000000"
+ },
+ "scoped_limit": "39859/781289859"
+ },
+ "finite_bridge": {
+ "bit": {
+ "W": 137151806,
+ "halving_degree": 9,
+ "m": 575,
+ "maxchild": 529,
+ "wire_bits": 28
+ },
+ "complex": {
+ "W": 537696432,
+ "halving_degree": 20,
+ "m": 784,
+ "maxchild": 756,
+ "s": 421548223824,
+ "scalar_group_upper": 4793351472,
+ "scalar_terms": [
+ {
+ "c": 78437,
+ "copied_center_extra_groups": 56,
+ "h": 28,
+ "invocations": 3276,
+ "local_group_upper": 729892,
+ "v": 3276
+ },
+ {
+ "c": 78437,
+ "copied_center_extra_groups": 56,
+ "h": 28,
+ "invocations": 3276,
+ "local_group_upper": 729892,
+ "v": 3276
+ }
+ ],
+ "wire_bits": 30
+ },
+ "rows": {
+ "coefficient": 852,
+ "contract": "W_complex^D_complex * W_bit^D_bit; one preceding prefix and padding; all temporary copies sequential",
+ "degree": 2000,
+ "degree_gap": "6548/25",
+ "suffix_slope": 8000
+ },
+ "semantic": {
+ "B": 9696565176891520488614054257040,
+ "C0": 2358858462850846165593256368932965330169899180021667007021321420800,
+ "C1": 1,
+ "E": 9696565176891520488192506033216,
+ "induction_gap": 533311084729033626873772984137200,
+ "literal_charge": 2771683137698171397039558468,
+ "strict_literal_gap": 9693793493753822316795466474748
+ }
+ },
+ "bit": {
+ "m": 575,
+ "N": 4073300,
+ "W": 137151806,
+ "L": 2226400,
+ "total_rank": 78860441550,
+ "deficit": 1846900,
+ "maxchild": 529,
+ "child_multiplicities": {
+ "1": 1725448017,
+ "10": 8919929,
+ "11": 8639950,
+ "12": 6282197,
+ "13": 5425815,
+ "14": 4016766,
+ "15": 3351146,
+ "16": 2045758,
+ "17": 9626535,
+ "18": 919241,
+ "19": 320551,
+ "2": 83325366,
+ "20": 300081,
+ "21": 16346100,
+ "22": 97405,
+ "23": 72402275,
+ "25": 64793806,
+ "3": 45690259,
+ "4": 25239096,
+ "481": 8146600,
+ "5": 19651200,
+ "525": 64793806,
+ "529": 64211400,
+ "6": 18723242,
+ "7": 17106549,
+ "8": 13274680,
+ "9": 10943423
+ },
+ "parts": {
+ "data": {
+ "1": 73319400,
+ "17": 8146600,
+ "21": 8146600,
+ "481": 8146600
+ },
+ "data_growth_23": {
+ "1": 8146600,
+ "21": 8146600
+ },
+ "data_growth_25": {
+ "1": 8146600,
+ "23": 8146600
+ },
+ "exterior_23": {
+ "23": 64211400,
+ "529": 64211400
+ },
+ "exterior_25": {
+ "25": 64793806,
+ "525": 64793806
+ },
+ "internal_23": {
+ "1": 791020600,
+ "10": 4140000,
+ "11": 3946800,
+ "12": 2904900,
+ "13": 2477100,
+ "14": 1633000,
+ "15": 1357000,
+ "16": 809600,
+ "17": 443900,
+ "18": 262200,
+ "2": 38791800,
+ "20": 103500,
+ "21": 52900,
+ "3": 24209800,
+ "4": 13238800,
+ "5": 9556500,
+ "6": 8979200,
+ "7": 8395000,
+ "8": 6580300,
+ "9": 5253200
+ },
+ "internal_25": {
+ "1": 840741517,
+ "10": 4779929,
+ "11": 4693150,
+ "12": 3377297,
+ "13": 2948715,
+ "14": 2383766,
+ "15": 1994146,
+ "16": 1236158,
+ "17": 1036035,
+ "18": 657041,
+ "19": 320551,
+ "2": 44533566,
+ "20": 196581,
+ "22": 97405,
+ "23": 44275,
+ "3": 21480459,
+ "4": 12000296,
+ "5": 10094700,
+ "6": 9744042,
+ "7": 8711549,
+ "8": 6694380,
+ "9": 5690223
+ },
+ "paid_endpoint_copy": {
+ "1": 4073300
+ }
+ }
+ },
+ "scope": "New both-axis ranked-reclamation composition: regenerated words, full dirty replay, scatter binding, reconstructed transitions and CRT profiles checked; global transfer remains conditional.",
+ "construction_certificate": "finite-frames/pair-ranked-both.json"
+}
diff --git a/research/machine-transfer-verification/publication-lean-verification.json b/research/machine-transfer-verification/publication-lean-verification.json
new file mode 100644
index 0000000000..3ce4e903bc
--- /dev/null
+++ b/research/machine-transfer-verification/publication-lean-verification.json
@@ -0,0 +1,1648 @@
+{
+ "status": "PASS",
+ "compiler": "Lean (version 4.21.0, arm64-apple-darwin23.6.0, commit 6741444a63ee, Release)",
+ "mathlib": {
+ "url": "https://github.com/leanprover-community/mathlib4",
+ "rev": "308445d7985027f538e281e18df29ca16ede2ba3",
+ "inputRev": "v4.21.0"
+ },
+ "inventory_sha256": "a4482904567868b6d26c34abc282b0c642c49acb7a06186ae4682795cd593420",
+ "verifier_sha256": "ed960b1c2baa4be235834242cf9839388158efc99f9ebf41835bdd83bf375733",
+ "source_file_count": 29,
+ "unique_module_count": 27,
+ "unique_declaration_count": 298,
+ "additional_helper_audit_count": 12,
+ "reused_earlier_dirtywrapper_declarations": 13,
+ "compile_order": [
+ "AnalyticEnclosures",
+ "DirtyWrapper",
+ "EligibleLocalization",
+ "FloorDepth",
+ "TapeStack",
+ "TensorStageFrames",
+ "FloorRecurrence",
+ "FramedXor",
+ "LocalizedMatrixTransfer",
+ "Pr68ProfileCertificate",
+ "Pr73ProfileCertificate",
+ "RippleCounter",
+ "SelectedProfileCertificate",
+ "TapeStackPush",
+ "AddressGauges",
+ "CounterArithmetic",
+ "OuterRows",
+ "Pr68ProfileReal",
+ "Pr73ProfileReal",
+ "RowInterchange",
+ "SelectedProfileReal",
+ "DescriptorVolume",
+ "LocalizedAddressGauges",
+ "SelectedFloorTransfer",
+ "PhysicalCostTransfer",
+ "Pr68PhysicalCost",
+ "Pr73PhysicalCost"
+ ],
+ "modules": {
+ "AnalyticEnclosures": {
+ "sha256": "bbbf93a1f68b6176e71379f6c2036e4b4379f13ba7ab8d9c749ba5ce9624cb0e",
+ "paths": [
+ "next-proof/analytic/AnalyticEnclosures.lean"
+ ],
+ "declarations": {
+ "AnalyticEnclosures.expPoly_cast": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "AnalyticEnclosures.log_le_of_expPoly": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "AnalyticEnclosures.exp_le_of_expUpper": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "AnalyticEnclosures.log_scale_upper": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ]
+ },
+ "build_log_sha256": "4d074d6cb2e22ea1d0482da5f3cc3114f6d9be07f30ee8c7298462cfa036ab14",
+ "axiom_log_sha256": "4d074d6cb2e22ea1d0482da5f3cc3114f6d9be07f30ee8c7298462cfa036ab14",
+ "additional_helper_audits": []
+ },
+ "DirtyWrapper": {
+ "sha256": "3ee3ee58cdb31bfa29c09c5f25b07f123b06988bdc7af8fcbc4062ba2780e30f",
+ "paths": [
+ "next-proof/framed/DirtyWrapper.lean",
+ "transfer-proof/framed/DirtyWrapper.lean"
+ ],
+ "declarations": {
+ "DirtyWrapper.vxor_assoc": [
+ "Quot.sound"
+ ],
+ "DirtyWrapper.vxor_cancel": [
+ "Quot.sound",
+ "propext"
+ ],
+ "DirtyWrapper.vxor_dirty_cancel": [
+ "Quot.sound",
+ "propext"
+ ],
+ "DirtyWrapper.gate_involutive": [
+ "Quot.sound",
+ "propext"
+ ],
+ "DirtyWrapper.gate_linear": [
+ "Quot.sound",
+ "propext"
+ ],
+ "DirtyWrapper.run_append": [],
+ "DirtyWrapper.run_reverse_cancel": [
+ "Quot.sound",
+ "propext"
+ ],
+ "DirtyWrapper.run_linear": [
+ "Quot.sound",
+ "propext"
+ ],
+ "DirtyWrapper.gate_reindex": [],
+ "DirtyWrapper.word_reindex": [],
+ "DirtyWrapper.word_addresswise": [],
+ "DirtyWrapper.wrapper_correct": [
+ "Quot.sound",
+ "propext"
+ ],
+ "DirtyWrapper.compiled_wrapper_correct": [
+ "Quot.sound",
+ "propext"
+ ]
+ },
+ "build_log_sha256": "35ae0da5fc06db7ac705d66410ffe23638086de0cab136b886d928cf1217337a",
+ "axiom_log_sha256": "35ae0da5fc06db7ac705d66410ffe23638086de0cab136b886d928cf1217337a",
+ "additional_helper_audits": []
+ },
+ "EligibleLocalization": {
+ "sha256": "7c2525b8f30ddd26f5d9469972a8f9823c6b20805575d801c5c5755dea993c28",
+ "paths": [
+ "full-transfer/localization/EligibleLocalization.lean"
+ ],
+ "declarations": {
+ "EligibleLocalization.rationalView_integer": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "EligibleLocalization.rationalView_injective": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "EligibleLocalization.reduction_integer": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "EligibleLocalization.fraction_mul_denominator": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "EligibleLocalization.rationalView_fraction": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "EligibleLocalization.denominatorProduct_positive": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "EligibleLocalization.denominator_divides_product": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "EligibleLocalization.liftTable_exact": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "EligibleLocalization.reciprocal_numerator_divides_product": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "EligibleLocalization.eligible_prime_power": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "EligibleLocalization.exists_eligible_odd_prime": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ]
+ },
+ "build_log_sha256": "497720ac99c5947b574a83d3ca09641502fabd99745d0fd842dfedaceed7802e",
+ "axiom_log_sha256": "497720ac99c5947b574a83d3ca09641502fabd99745d0fd842dfedaceed7802e",
+ "additional_helper_audits": []
+ },
+ "FloorDepth": {
+ "sha256": "58dbb7e454c6767bb83cb8616fdc909dfc76dc5d46ca09ddaa84e45f02767e2d",
+ "paths": [
+ "transfer-proof/recurrence/FloorDepth.lean"
+ ],
+ "declarations": {
+ "FloorDepth.child_lt": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "FloorDepth.child_pos": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "FloorDepth.child_mono": [
+ "propext"
+ ],
+ "FloorDepth.depth_base": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "FloorDepth.depth_step": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "FloorDepth.depth_mono": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "FloorDepth.child_depth_drop": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "FloorDepth.row_split_exact": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "FloorDepth.child_row_stock": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ]
+ },
+ "build_log_sha256": "076491b38b93a32abe0d7e0fbf4d3229fb9f33508e3b752e21555a09c00c7e04",
+ "axiom_log_sha256": "076491b38b93a32abe0d7e0fbf4d3229fb9f33508e3b752e21555a09c00c7e04",
+ "additional_helper_audits": []
+ },
+ "TapeStack": {
+ "sha256": "e2e0d507f3d3dda8d49c808ff12e2fdc36e0dc81f00cdba84b9308e7ebfaf156",
+ "paths": [
+ "transfer-proof/tapes/TapeStack.lean"
+ ],
+ "declarations": {
+ "TapeStack.default_symbol": [],
+ "TapeStack.alphabet_card": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "TapeStack.state_card": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "TapeStack.blank_cons": [
+ "Quot.sound",
+ "propext"
+ ],
+ "TapeStack.blank_mk": [
+ "Quot.sound",
+ "propext"
+ ],
+ "TapeStack.head_local_refinement": [
+ "Quot.sound",
+ "propext"
+ ],
+ "TapeStack.run_add": [
+ "Quot.sound",
+ "propext"
+ ],
+ "TapeStack.erase_pop": [
+ "Quot.sound",
+ "propext"
+ ],
+ "TapeStack.append_bit": [
+ "Quot.sound",
+ "propext"
+ ],
+ "TapeStack.separator_return": [
+ "Quot.sound",
+ "propext"
+ ],
+ "TapeStack.enter_bits": [
+ "Quot.sound",
+ "propext"
+ ],
+ "TapeStack.pop_to_rewind": [
+ "Quot.sound",
+ "propext"
+ ],
+ "TapeStack.rewind_bit": [
+ "Quot.sound",
+ "propext"
+ ],
+ "TapeStack.rewind_separator": [
+ "Quot.sound",
+ "propext"
+ ],
+ "TapeStack.copy_park": [
+ "Quot.sound",
+ "propext"
+ ],
+ "TapeStack.copy_output": [
+ "Quot.sound",
+ "propext"
+ ],
+ "TapeStack.rewind_output": [
+ "Quot.sound",
+ "propext"
+ ],
+ "TapeStack.atEnd_cons_left": [
+ "Quot.sound",
+ "propext"
+ ],
+ "TapeStack.enter_parked": [
+ "Quot.sound",
+ "propext"
+ ],
+ "TapeStack.pop_correct": [
+ "Quot.sound",
+ "propext"
+ ],
+ "TapeStack.install_boundary": [
+ "Quot.sound",
+ "propext"
+ ],
+ "TapeStack.remove_boundary": [
+ "Quot.sound",
+ "propext"
+ ],
+ "TapeStack.remove_empty_boundary": [
+ "Quot.sound",
+ "propext"
+ ]
+ },
+ "build_log_sha256": "369af22acd574f8c293b8209eb508718a7ae2733d6698dd531dac662ef3f5cdc",
+ "axiom_log_sha256": "3e956497e1346a57d3ec0ecbdf06cd6f7441b27d26855c507d402af8745fc9c9",
+ "additional_helper_audits": []
+ },
+ "TensorStageFrames": {
+ "sha256": "799c559518b6beccd32b24f3bc2bd5f096e9adffc8a9d26e9163ecfd83dc5fba",
+ "paths": [
+ "full-transfer/framed/TensorStageFrames.lean"
+ ],
+ "declarations": {
+ "TensorStageFrames.sub_kronecker": [
+ "Quot.sound",
+ "propext"
+ ],
+ "TensorStageFrames.kronecker_sub": [
+ "Quot.sound",
+ "propext"
+ ],
+ "TensorStageFrames.first_idempotent": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "TensorStageFrames.second_multiplication": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "TensorStageFrames.second_idempotent": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "TensorStageFrames.first_absorption": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "TensorStageFrames.second_absorption": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "TensorStageFrames.first_residual": [
+ "Quot.sound",
+ "propext"
+ ],
+ "TensorStageFrames.second_residual": [
+ "Quot.sound",
+ "propext"
+ ],
+ "TensorStageFrames.second_zero": [
+ "Quot.sound",
+ "propext"
+ ],
+ "TensorStageFrames.second_one": [
+ "Quot.sound",
+ "propext"
+ ],
+ "TensorStageFrames.second_complement_formula": [
+ "Quot.sound",
+ "propext"
+ ],
+ "TensorStageFrames.source_data_front": [
+ "Quot.sound",
+ "propext"
+ ],
+ "TensorStageFrames.target_data_front": [
+ "Quot.sound",
+ "propext"
+ ],
+ "TensorStageFrames.second_source_growth": [
+ "Quot.sound",
+ "propext"
+ ],
+ "TensorStageFrames.second_target_growth": [
+ "Quot.sound",
+ "propext"
+ ],
+ "TensorStageFrames.data_target_endpoint": [
+ "Quot.sound",
+ "propext"
+ ],
+ "TensorStageFrames.first_auxiliary_exterior": [
+ "Quot.sound",
+ "propext"
+ ],
+ "TensorStageFrames.second_auxiliary_exterior": [
+ "Quot.sound",
+ "propext"
+ ],
+ "TensorStageFrames.second_auxiliary_complementary_endpoints": [
+ "Quot.sound",
+ "propext"
+ ],
+ "TensorStageFrames.paid_correction_residual": [
+ "Quot.sound",
+ "propext"
+ ]
+ },
+ "build_log_sha256": "18cff2030e15dfb98b32809f6f01d313ead0fa4f573598f6dc5a4c33a1f9feac",
+ "axiom_log_sha256": "06e74a7e7c1f3d1484032562f1178dc16225efe6b3f9c13734767cf6bdc76aee",
+ "additional_helper_audits": []
+ },
+ "FloorRecurrence": {
+ "sha256": "a2edfb9b2ac5d6d04bc93f9f7cc0ebf13254b15476fad7bfa747c5bfe2661e06",
+ "paths": [
+ "transfer-proof/recurrence/FloorRecurrence.lean"
+ ],
+ "declarations": {
+ "FloorRecurrence.floor_child_le_ratio": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "FloorRecurrence.floor_child_power": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "FloorRecurrence.one_le_width_power": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "FloorRecurrence.all_width_bound": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "FloorRecurrence.boundConstant_nonneg": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "FloorRecurrence.boundConstant_overhead": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "FloorRecurrence.boundConstant_base": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "FloorRecurrence.finite_base_all_width": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "FloorRecurrence.depth_log_bound": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ]
+ },
+ "build_log_sha256": "75726a48ff0007ca01371bd6e9fe16bf88181941903408ab747a47a9358dcac9",
+ "axiom_log_sha256": "75726a48ff0007ca01371bd6e9fe16bf88181941903408ab747a47a9358dcac9",
+ "additional_helper_audits": []
+ },
+ "FramedXor": {
+ "sha256": "67d8385bdcdb0a553c09252bcc95d80fb8417beb8dfb6834a186c6f0b13862c9",
+ "paths": [
+ "next-proof/framed/FramedXor.lean",
+ "transfer-proof/framed/FramedXor.lean"
+ ],
+ "declarations": {
+ "FramedXor.decode_encode": [
+ "Quot.sound"
+ ],
+ "FramedXor.encode_decode": [
+ "Quot.sound"
+ ],
+ "FramedXor.decode_reframe": [
+ "Quot.sound",
+ "propext"
+ ],
+ "FramedXor.reframe_composition": [
+ "Quot.sound",
+ "propext"
+ ],
+ "FramedXor.reframe_inverse": [
+ "Quot.sound",
+ "propext"
+ ],
+ "FramedXor.decode_xor": [
+ "Quot.sound",
+ "propext"
+ ],
+ "FramedXor.decoded_execution": [
+ "Quot.sound",
+ "propext"
+ ],
+ "FramedXor.encoded_execution": [
+ "Quot.sound",
+ "propext"
+ ],
+ "FramedXor.physical_execution": [
+ "Quot.sound",
+ "propext"
+ ],
+ "FramedXor.terminal_role_transport": [
+ "Quot.sound",
+ "propext"
+ ],
+ "FramedXor.restored_execution": [
+ "Quot.sound",
+ "propext"
+ ],
+ "FramedXor.restored_addresswise": [
+ "Quot.sound",
+ "propext"
+ ],
+ "FramedXor.decoded_injection": [
+ "Quot.sound",
+ "propext"
+ ],
+ "FramedXor.decoded_scatter": [
+ "Quot.sound",
+ "propext"
+ ],
+ "FramedXor.scatter_gates_commute": [
+ "Quot.sound",
+ "propext"
+ ],
+ "FramedXor.scatter_permutation": [
+ "Quot.sound",
+ "propext"
+ ],
+ "FramedXor.decode_allocateFresh": [
+ "Quot.sound"
+ ],
+ "FramedXor.restrict_decode_transportFresh": [
+ "Quot.sound",
+ "propext"
+ ],
+ "FramedXor.fresh_scalar_read": [
+ "Quot.sound",
+ "propext"
+ ],
+ "FramedXor.copied_read_correct": [
+ "Quot.sound",
+ "propext"
+ ],
+ "FramedXor.copied_read_preserves_other": [
+ "Quot.sound",
+ "propext"
+ ],
+ "FramedXor.clone_blank": [
+ "Quot.sound",
+ "propext"
+ ],
+ "FramedXor.fresh_fixed_read": [
+ "Quot.sound",
+ "propext"
+ ],
+ "FramedXor.fresh_fixed_reads": [
+ "Quot.sound",
+ "propext"
+ ],
+ "FramedXor.freshReads_word": [
+ "propext"
+ ],
+ "FramedXor.copied_fanout_correct": [
+ "Quot.sound",
+ "propext"
+ ],
+ "FramedXor.scatterFixed_preserves_other": [
+ "Quot.sound",
+ "propext"
+ ],
+ "FramedXor.copied_fanout_preserves_other": [
+ "Quot.sound",
+ "propext"
+ ],
+ "FramedXor.mismatched_gauge_counterexample": [],
+ "FramedXor.dirty_temporary_counterexample": []
+ },
+ "build_log_sha256": "2766b0fcee225dd050606c8fe29185775aa50816e171d79e1b85eca67927c9ee",
+ "axiom_log_sha256": "15368759737b54a5bd9bd467a5c7fdeeaf863b0899705706d48b5a35fbe24f49",
+ "additional_helper_audits": [
+ "FramedXor.decode_encode",
+ "FramedXor.encode_decode",
+ "FramedXor.physical_execution",
+ "FramedXor.scatter_gates_commute",
+ "FramedXor.decode_allocateFresh",
+ "FramedXor.restrict_decode_transportFresh",
+ "FramedXor.fresh_scalar_read",
+ "FramedXor.clone_blank",
+ "FramedXor.fresh_fixed_read",
+ "FramedXor.fresh_fixed_reads",
+ "FramedXor.freshReads_word",
+ "FramedXor.scatterFixed_preserves_other"
+ ]
+ },
+ "LocalizedMatrixTransfer": {
+ "sha256": "9cb7fdbc50367aace87556986e0f4838eab50f82b69ae687eb46a9fad46a7ed7",
+ "paths": [
+ "full-transfer/localization/LocalizedMatrixTransfer.lean"
+ ],
+ "declarations": {
+ "LocalizedMatrixTransfer.rational_zero_reduces": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "LocalizedMatrixTransfer.rational_lower_triangular_reduces": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "LocalizedMatrixTransfer.rational_matrix_injective": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "LocalizedMatrixTransfer.rational_equality_reduces": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "LocalizedMatrixTransfer.rational_product_reduces": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "LocalizedMatrixTransfer.rational_projector_reduces": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "LocalizedMatrixTransfer.rational_nested_reduces": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "LocalizedMatrixTransfer.reduction_complement": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "LocalizedMatrixTransfer.reduction_difference": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "LocalizedMatrixTransfer.rational_factorization_reduces": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "LocalizedMatrixTransfer.integral_pattern_reduces": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "LocalizedMatrixTransfer.reduction_kronecker": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "LocalizedMatrixTransfer.rational_inverse_reduces": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "LocalizedMatrixTransfer.rational_minor_unit_reduces": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "LocalizedMatrixTransfer.nonsingular_stored_minor_reduces": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "LocalizedMatrixTransfer.rational_scalar_unit_reduces": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "LocalizedMatrixTransfer.table_reciprocal_unit": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ]
+ },
+ "build_log_sha256": "618d049752e5f2d65598dedc1348b2c0a715003d71971b8c7bb3a14e507a584f",
+ "axiom_log_sha256": "c11b62798a49462fa8e6b38e2b9ae19fac0314cc726893b7999cb180bb183fe1",
+ "additional_helper_audits": []
+ },
+ "Pr68ProfileCertificate": {
+ "sha256": "fa3f3339486f584c5da594f30b3fe97a6950a5b4e063792fccd8f1e1af38fcf6",
+ "paths": [
+ "transfer-proof/latest-analytic/Pr68ProfileCertificate.lean"
+ ],
+ "declarations": {
+ "Pr68ProfileCertificate.logTwo_certificate": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "Pr68ProfileCertificate.rows_checked": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "Pr68ProfileCertificate.rational_upper_lt_one": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "Pr68ProfileCertificate.rational_gap_exact": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "Pr68ProfileCertificate.row_count": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "Pr68ProfileCertificate.rank_mass": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ]
+ },
+ "build_log_sha256": "209b28ca807694ed3931973ed9baf3ef7ee8c0afc8f75c2ad42c19a6b0d27b59",
+ "axiom_log_sha256": "209b28ca807694ed3931973ed9baf3ef7ee8c0afc8f75c2ad42c19a6b0d27b59",
+ "additional_helper_audits": []
+ },
+ "Pr73ProfileCertificate": {
+ "sha256": "990d6d1b6045a37eadbf937b702ef0cad916b5a3396bb70055531daac2057f72",
+ "paths": [
+ "full-transfer/latest-analytic/Pr73ProfileCertificate.lean"
+ ],
+ "declarations": {
+ "Pr73ProfileCertificate.logTwo_certificate": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "Pr73ProfileCertificate.rows_checked": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "Pr73ProfileCertificate.rational_upper_lt_one": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "Pr73ProfileCertificate.rational_gap_exact": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "Pr73ProfileCertificate.row_count": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "Pr73ProfileCertificate.rank_mass": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ]
+ },
+ "build_log_sha256": "a098daa3f8a6176fee2e397fdba77df11e20c18ac576cca42662a754089785c0",
+ "axiom_log_sha256": "a098daa3f8a6176fee2e397fdba77df11e20c18ac576cca42662a754089785c0",
+ "additional_helper_audits": []
+ },
+ "RippleCounter": {
+ "sha256": "2278a5fd158bd953f136204d92c9da0e6d9fc39fb1a74e8792e8e46aa0d2bc5a",
+ "paths": [
+ "stream-transfer/counters/RippleCounter.lean"
+ ],
+ "declarations": {
+ "RippleCounter.state_card": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "RippleCounter.run_add": [
+ "Quot.sound",
+ "propext"
+ ],
+ "RippleCounter.write_right": [
+ "Quot.sound",
+ "propext"
+ ],
+ "RippleCounter.write_left": [
+ "Quot.sound",
+ "propext"
+ ],
+ "RippleCounter.delimiter_left": [
+ "Quot.sound",
+ "propext"
+ ],
+ "RippleCounter.rewind_left": [
+ "Quot.sound",
+ "propext"
+ ],
+ "RippleCounter.rewind_origin": [
+ "Quot.sound",
+ "propext"
+ ],
+ "RippleCounter.rewind_correct": [
+ "Quot.sound",
+ "propext"
+ ],
+ "RippleCounter.carry_correct": [
+ "Quot.sound",
+ "propext"
+ ],
+ "RippleCounter.counter_correct": [
+ "Quot.sound",
+ "propext"
+ ],
+ "RippleCounter.rewind_running": [
+ "Quot.sound",
+ "propext"
+ ],
+ "RippleCounter.carry_running": [
+ "Quot.sound",
+ "propext"
+ ],
+ "RippleCounter.counter_running": [
+ "Quot.sound",
+ "propext"
+ ]
+ },
+ "build_log_sha256": "b566eeb35c642a961c502b2801fc3a7d6535889e0df732f5c73c37a0027ef34f",
+ "axiom_log_sha256": "b566eeb35c642a961c502b2801fc3a7d6535889e0df732f5c73c37a0027ef34f",
+ "additional_helper_audits": []
+ },
+ "SelectedProfileCertificate": {
+ "sha256": "0c6db6a2ed5d2da082e3005553b0981a9391f90273a0c1b9613cb66b39c54bd4",
+ "paths": [
+ "next-proof/analytic/SelectedProfileCertificate.lean"
+ ],
+ "declarations": {
+ "SelectedProfileCertificate.logTwo_certificate": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "SelectedProfileCertificate.rows_checked": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "SelectedProfileCertificate.rational_upper_lt_one": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "SelectedProfileCertificate.rational_gap_exact": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "SelectedProfileCertificate.row_count": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "SelectedProfileCertificate.rank_mass": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ]
+ },
+ "build_log_sha256": "3a18f27470c89ec75749e5b4a5becfd47c02b933203d5a77fefef7696ae9b5bc",
+ "axiom_log_sha256": "3a18f27470c89ec75749e5b4a5becfd47c02b933203d5a77fefef7696ae9b5bc",
+ "additional_helper_audits": []
+ },
+ "TapeStackPush": {
+ "sha256": "10309fb8f5c9e381f9e9ced50438d06096e6882cc75da8b59eabfd1f41fe4efb",
+ "paths": [
+ "transfer-proof/tapes/TapeStackPush.lean"
+ ],
+ "declarations": {
+ "TapeStackPush.run_add": [
+ "Quot.sound",
+ "propext"
+ ],
+ "TapeStackPush.read_bit": [
+ "Quot.sound",
+ "propext"
+ ],
+ "TapeStackPush.reading_empty": [
+ "Quot.sound",
+ "propext"
+ ],
+ "TapeStackPush.start_rewind": [
+ "Quot.sound",
+ "propext"
+ ],
+ "TapeStackPush.rewind_blank": [
+ "Quot.sound",
+ "propext"
+ ],
+ "TapeStackPush.rewind_end": [
+ "Quot.sound",
+ "propext"
+ ],
+ "TapeStackPush.append_delimiter": [
+ "Quot.sound",
+ "propext"
+ ],
+ "TapeStackPush.copy_correct": [
+ "Quot.sound",
+ "propext"
+ ],
+ "TapeStackPush.rewind_correct": [
+ "Quot.sound",
+ "propext"
+ ],
+ "TapeStackPush.push_correct": [
+ "Quot.sound",
+ "propext"
+ ],
+ "TapeStackPush.head_local_refinement": [
+ "Quot.sound",
+ "propext"
+ ],
+ "TapeStackPush.state_card": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "TapeStackPush.park_pop_round_trip": [
+ "Quot.sound",
+ "propext"
+ ]
+ },
+ "build_log_sha256": "735a373e5697dd159c4da5beb1968e901f1fa4098d79f7b0fe8723e70864614d",
+ "axiom_log_sha256": "735a373e5697dd159c4da5beb1968e901f1fa4098d79f7b0fe8723e70864614d",
+ "additional_helper_audits": []
+ },
+ "AddressGauges": {
+ "sha256": "a84351ef576b4bdaa3a9e328dfef0aef617d6ea467db49555d794a33502059d0",
+ "paths": [
+ "transfer-proof/framed/AddressGauges.lean"
+ ],
+ "declarations": {
+ "AddressGauges.shear_position_transport": [
+ "propext"
+ ],
+ "AddressGauges.shear_payload_transport": [
+ "propext"
+ ],
+ "AddressGauges.shear_endpoint_frames": [
+ "propext"
+ ],
+ "AddressGauges.shear_all_role_endpoint": [
+ "Quot.sound",
+ "propext"
+ ],
+ "AddressGauges.ordered_shear_swap": [
+ "propext"
+ ],
+ "AddressGauges.partialSwap_involution": [
+ "propext"
+ ],
+ "AddressGauges.difference_idempotent": [
+ "propext"
+ ],
+ "AddressGauges.partialSwap_nested": [
+ "propext"
+ ],
+ "AddressGauges.partialSwap_nested_reverse": [
+ "propext"
+ ],
+ "AddressGauges.complement_idempotent": [
+ "propext"
+ ],
+ "AddressGauges.complement_difference": [
+ "Quot.sound",
+ "propext"
+ ],
+ "AddressGauges.reverse_complement_residual": [
+ "Quot.sound",
+ "propext"
+ ],
+ "AddressGauges.partialSwap_complement_frame": [
+ "propext"
+ ],
+ "AddressGauges.partialSwap_complement_product": [
+ "propext"
+ ],
+ "AddressGauges.selected_partial_swap_endpoint": [
+ "Quot.sound",
+ "propext"
+ ],
+ "AddressGauges.matrix_idempotent": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "AddressGauges.matrix_absorption": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "AddressGauges.matrix_complement": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "AddressGauges.matrix_partialSwap_involution": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ]
+ },
+ "build_log_sha256": "f3a324074ba504e60997aa50d164f11246ea75a7ce0686d2f4ecd0915a15e0c1",
+ "axiom_log_sha256": "33bf59842839b0f70eef9e3bac40c56c026b23f88b6ad157a07a884e72f61f93",
+ "additional_helper_audits": []
+ },
+ "CounterArithmetic": {
+ "sha256": "00caa87ed92bd65ac6a2535a58faba438f887cc6b137c4cfb28a1df403628554",
+ "paths": [
+ "stream-transfer/counters/CounterArithmetic.lean"
+ ],
+ "declarations": {
+ "CounterArithmetic.updated_nil": [],
+ "CounterArithmetic.updated_carry": [
+ "propext"
+ ],
+ "CounterArithmetic.updated_stop": [
+ "propext"
+ ],
+ "CounterArithmetic.updated_length": [
+ "propext"
+ ],
+ "CounterArithmetic.carryLength_le_length": [
+ "Quot.sound",
+ "propext"
+ ],
+ "CounterArithmetic.potential_le_length": [
+ "Quot.sound",
+ "propext"
+ ],
+ "CounterArithmetic.potential_accounting": [
+ "Quot.sound",
+ "propext"
+ ],
+ "CounterArithmetic.amortized_step": [
+ "Quot.sound",
+ "propext"
+ ],
+ "CounterArithmetic.iterate_length": [
+ "propext"
+ ],
+ "CounterArithmetic.amortized_total": [
+ "Quot.sound",
+ "propext"
+ ],
+ "CounterArithmetic.total_steps_bound": [
+ "Quot.sound",
+ "propext"
+ ],
+ "CounterArithmetic.value_bound": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "CounterArithmetic.increment_value": [
+ "Quot.sound",
+ "propext"
+ ],
+ "CounterArithmetic.decrement_value": [
+ "Quot.sound",
+ "propext"
+ ],
+ "CounterArithmetic.decrement_underflow_iff_zero": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "CounterArithmetic.overflow_updated": [
+ "propext"
+ ],
+ "CounterArithmetic.zero_replicate_value": [
+ "propext"
+ ],
+ "CounterArithmetic.increment_overflow_iff_max": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "CounterArithmetic.decrement_positive": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "CounterArithmetic.countdown_value": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "CounterArithmetic.countdown_not_finished": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "CounterArithmetic.countdown_final_underflow": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "CounterArithmetic.complete_block_cost": [
+ "Quot.sound",
+ "propext"
+ ]
+ },
+ "build_log_sha256": "57a81af80367427a4e95eb994b18400f720371378e9b33a19d7c6e332cf13b09",
+ "axiom_log_sha256": "57a81af80367427a4e95eb994b18400f720371378e9b33a19d7c6e332cf13b09",
+ "additional_helper_audits": []
+ },
+ "OuterRows": {
+ "sha256": "d93aba86df8bd62cec2c5337319468db4772c875ae271fe09aa320c7fb990bdf",
+ "paths": [
+ "full-transfer/outerrows/OuterRows.lean"
+ ],
+ "declarations": {
+ "OuterRows.child_gap": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "OuterRows.depth_gap_bound": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "OuterRows.twice_rho_lt_width": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "OuterRows.row_range_covers_stock": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "OuterRows.rounding_bounds": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "OuterRows.rounding_dvd": [
+ "propext"
+ ],
+ "OuterRows.rounding_less_than_twice": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "OuterRows.remaining_width_positive": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "OuterRows.reduced_width_stock": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "OuterRows.existing_digit_volume": [
+ "Quot.sound",
+ "propext"
+ ],
+ "OuterRows.padded_volume_lt_twice": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "OuterRows.padded_volume_with_spectators": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "OuterRows.rho_log_bound": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "OuterRows.rho_power_bound": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "OuterRows.outer_cost_bound": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "OuterRows.selected_base_range": [
+ "Quot.sound",
+ "propext"
+ ],
+ "OuterRows.selected_outer_rows": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ]
+ },
+ "build_log_sha256": "2c4aa1ccafdbdaff6b24abc42ff198212404003fdf678cb94c3de0bacaf37498",
+ "axiom_log_sha256": "2c4aa1ccafdbdaff6b24abc42ff198212404003fdf678cb94c3de0bacaf37498",
+ "additional_helper_audits": []
+ },
+ "Pr68ProfileReal": {
+ "sha256": "0428ad7ba3f7c741288505698d3ee3958a999ccb091174da2a52c4d354398062",
+ "paths": [
+ "transfer-proof/latest-analytic/Pr68ProfileReal.lean"
+ ],
+ "declarations": {
+ "Pr68ProfileReal.row_valid": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "Pr68ProfileReal.log_two_upper": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "Pr68ProfileReal.row_log_upper": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "Pr68ProfileReal.row_exp_upper": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "Pr68ProfileReal.real_characteristic_lt_one": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "Pr68ProfileReal.power_term_identity": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "Pr68ProfileReal.actual_power_characteristic_lt_one": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ]
+ },
+ "build_log_sha256": "53c71b5370e8b904b3cfe119aac5d24a497f074a92a0676b15c7c69453661d5f",
+ "axiom_log_sha256": "53c71b5370e8b904b3cfe119aac5d24a497f074a92a0676b15c7c69453661d5f",
+ "additional_helper_audits": []
+ },
+ "Pr73ProfileReal": {
+ "sha256": "dcf4578cc0ecfe5f7da4d59097e4f7ffc5fcc987a022e36f2afdaae01ace7798",
+ "paths": [
+ "full-transfer/latest-analytic/Pr73ProfileReal.lean"
+ ],
+ "declarations": {
+ "Pr73ProfileReal.row_valid": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "Pr73ProfileReal.log_two_upper": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "Pr73ProfileReal.row_log_upper": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "Pr73ProfileReal.row_exp_upper": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "Pr73ProfileReal.real_characteristic_lt_one": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "Pr73ProfileReal.power_term_identity": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "Pr73ProfileReal.actual_power_characteristic_lt_one": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ]
+ },
+ "build_log_sha256": "7aa25469df15f0f380f960ccf72fa4b73964c983890015dad43e4a23d0ed8505",
+ "axiom_log_sha256": "7aa25469df15f0f380f960ccf72fa4b73964c983890015dad43e4a23d0ed8505",
+ "additional_helper_audits": []
+ },
+ "RowInterchange": {
+ "sha256": "9981188ca9712bb8565741659c20db35768588eb2eef5db6bd610dbf82b10a3a",
+ "paths": [
+ "next-proof/rows/RowInterchange.lean"
+ ],
+ "declarations": {
+ "RowInterchange.join_split": [
+ "propext"
+ ],
+ "RowInterchange.role_join": [
+ "propext"
+ ],
+ "RowInterchange.group_join": [
+ "Quot.sound",
+ "propext"
+ ],
+ "RowInterchange.merge_split": [
+ "Quot.sound",
+ "propext"
+ ],
+ "RowInterchange.merge_uniform": [
+ "Quot.sound",
+ "propext"
+ ],
+ "RowInterchange.framed_rows": [
+ "Quot.sound",
+ "propext"
+ ],
+ "RowInterchange.restrict_pad": [
+ "Quot.sound",
+ "propext"
+ ],
+ "RowInterchange.padding_commutes": [
+ "Quot.sound",
+ "propext"
+ ],
+ "RowInterchange.padded_endpoint_restrict": [
+ "Quot.sound",
+ "propext"
+ ],
+ "RowInterchange.padded_endpoint_blank": [
+ "propext"
+ ]
+ },
+ "build_log_sha256": "705b1cbc723c1c208cbdd31738dbf71c72a1143313efbdab8edb63c4a9510db3",
+ "axiom_log_sha256": "705b1cbc723c1c208cbdd31738dbf71c72a1143313efbdab8edb63c4a9510db3",
+ "additional_helper_audits": []
+ },
+ "SelectedProfileReal": {
+ "sha256": "b8d0fc896348906e60b91729f41c30f464d0b7283bc5cd49b831182f01700714",
+ "paths": [
+ "next-proof/analytic/SelectedProfileReal.lean"
+ ],
+ "declarations": {
+ "SelectedProfileReal.row_valid": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "SelectedProfileReal.log_two_upper": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "SelectedProfileReal.row_log_upper": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "SelectedProfileReal.row_exp_upper": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "SelectedProfileReal.real_characteristic_lt_one": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "SelectedProfileReal.power_term_identity": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "SelectedProfileReal.actual_power_characteristic_lt_one": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ]
+ },
+ "build_log_sha256": "9900019980dfd09e92acf09b12217dfb2767860a1c776cad2c97c9cc91e38eaf",
+ "axiom_log_sha256": "9900019980dfd09e92acf09b12217dfb2767860a1c776cad2c97c9cc91e38eaf",
+ "additional_helper_audits": []
+ },
+ "DescriptorVolume": {
+ "sha256": "a75920e9cc264b87b907a4c58dae0559fe2a4ae45ddd1cae1ce186edf6646e6a",
+ "paths": [
+ "full-transfer/outerrows/DescriptorVolume.lean"
+ ],
+ "declarations": {
+ "DescriptorVolume.retained_range_covers_stock": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "DescriptorVolume.row_division_volume_square": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "DescriptorVolume.log_root_le_twice_log_current": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "DescriptorVolume.descriptor_power_bound": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "DescriptorVolume.selected_descendant_volume": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ]
+ },
+ "build_log_sha256": "8e42c637a7265de43e9732dda03009198e743464a9945cbb0b308f001b64e4b1",
+ "axiom_log_sha256": "8e42c637a7265de43e9732dda03009198e743464a9945cbb0b308f001b64e4b1",
+ "additional_helper_audits": []
+ },
+ "LocalizedAddressGauges": {
+ "sha256": "916af51a79becb7e21afc3fe5f3b963c4ea724020d4a0343d848352f25f3cbc5",
+ "paths": [
+ "full-transfer/localization/LocalizedAddressGauges.lean"
+ ],
+ "declarations": {
+ "LocalizedAddressGauges.primePowerGauge_involution": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "LocalizedAddressGauges.matrixEndomorphism_sub": [
+ "Quot.sound",
+ "propext"
+ ],
+ "LocalizedAddressGauges.primePower_nested_transport": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ]
+ },
+ "build_log_sha256": "27ceb5823dffb9b9096f845825bdeafdb1c16c78ccd7dc0d3f377875f87dd24e",
+ "axiom_log_sha256": "27ceb5823dffb9b9096f845825bdeafdb1c16c78ccd7dc0d3f377875f87dd24e",
+ "additional_helper_audits": []
+ },
+ "SelectedFloorTransfer": {
+ "sha256": "d91b87850f0f2519fb08c5600d162e2fa54186223a43c7fc16cce7fb1584b17a",
+ "paths": [
+ "transfer-proof/recurrence/SelectedFloorTransfer.lean"
+ ],
+ "declarations": {
+ "SelectedFloorTransfer.maxChild_lt": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "SelectedFloorTransfer.all_widths_le_max": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "SelectedFloorTransfer.width_le_max": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "SelectedFloorTransfer.depth_below_base": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "SelectedFloorTransfer.depth_internal": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "SelectedFloorTransfer.depth_monotone": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "SelectedFloorTransfer.child_depth_drop": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "SelectedFloorTransfer.depth_logarithmic": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "SelectedFloorTransfer.exact_row_split": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "SelectedFloorTransfer.child_row_stock": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "SelectedFloorTransfer.costConstant_nonneg": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "SelectedFloorTransfer.all_width_cost_bound": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ]
+ },
+ "build_log_sha256": "6435dd0e44c587c751446df332973a817342c687bb9bc765e4cecb767219785c",
+ "axiom_log_sha256": "6435dd0e44c587c751446df332973a817342c687bb9bc765e4cecb767219785c",
+ "additional_helper_audits": []
+ },
+ "PhysicalCostTransfer": {
+ "sha256": "328d98165363dc6691b052bc0c385dbb98c04207ca366213ae3cd5a33fcc2de7",
+ "paths": [
+ "transfer-proof/recurrence/PhysicalCostTransfer.lean"
+ ],
+ "declarations": {
+ "PhysicalCostTransfer.state_all_width_bound": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "PhysicalCostTransfer.uniformConstant_nonneg": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "PhysicalCostTransfer.uniformConstant_base": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "PhysicalCostTransfer.uniformConstant_overhead": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ],
+ "PhysicalCostTransfer.selected_state_cost_bound": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ]
+ },
+ "build_log_sha256": "20494f5f49f5714d2d5324dacdff62e0c1c56b5ffa2ce72a06a7bd6468680b94",
+ "axiom_log_sha256": "20494f5f49f5714d2d5324dacdff62e0c1c56b5ffa2ce72a06a7bd6468680b94",
+ "additional_helper_audits": []
+ },
+ "Pr68PhysicalCost": {
+ "sha256": "b10a558d6ba375bfda20ed5c8095685931a3095843caad1bf300ebf0b7606740",
+ "paths": [
+ "transfer-proof/latest-analytic/Pr68PhysicalCost.lean"
+ ],
+ "declarations": {
+ "Pr68PhysicalCost.state_cost_bound": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ]
+ },
+ "build_log_sha256": "5f7eed189051ffdd1d3c4fc2ea8e714377ce17337173a0a79a4ca5b65a712965",
+ "axiom_log_sha256": "5f7eed189051ffdd1d3c4fc2ea8e714377ce17337173a0a79a4ca5b65a712965",
+ "additional_helper_audits": []
+ },
+ "Pr73PhysicalCost": {
+ "sha256": "d0d60dd375aac16207f661d49cbc2bf7cd8e4a70c53d75ebde273a1446a7ee35",
+ "paths": [
+ "full-transfer/latest-analytic/Pr73PhysicalCost.lean"
+ ],
+ "declarations": {
+ "Pr73PhysicalCost.state_cost_bound": [
+ "Classical.choice",
+ "Quot.sound",
+ "propext"
+ ]
+ },
+ "build_log_sha256": "393bbe1ba6e092f83b0a430ba7fe7c8a35a4d81ad1ab7822786fa066dc69bb26",
+ "axiom_log_sha256": "393bbe1ba6e092f83b0a430ba7fe7c8a35a4d81ad1ab7822786fa066dc69bb26",
+ "additional_helper_audits": []
+ }
+ }
+}
diff --git a/research/machine-transfer-verification/publication-manifest.json b/research/machine-transfer-verification/publication-manifest.json
new file mode 100644
index 0000000000..da05a45f69
--- /dev/null
+++ b/research/machine-transfer-verification/publication-manifest.json
@@ -0,0 +1,246 @@
+{
+ "schema_version": 1,
+ "scope": "Publication files; historical leaf receipts retain their original checkpoint scope.",
+ "files": {
+ "README.md": "01b6442171373c7c83af8b3540a5e0e5cc513b9cb1cbbe007ceafac961184c70",
+ "audit/ranked-candidate-adversarial.json": "49dbc049433da9fa52de4302581501fd2d6190e14a781d13e543d13ec4b63bd6",
+ "audit/scatter_binding_audit.py": "ab1527b30eff815badcb25a629c4f8053febce658f64d79a3bd8b892bfb066d7",
+ "finite-frames/pair-ranked-23-receipt.json": "75ad8eda4a17ff839d744fa64955140ba1d0ef72b2b9107ca4ff28601929b97b",
+ "finite-frames/pair-ranked-25-receipt.json": "56f82882e55bf5363d524a772f164cf360a9c66c59f7d44b458ff5353ea8bca7",
+ "finite-frames/pair-ranked-both.json": "e61b8d635d555c76905adb33ea4d95a3793c695554161f86202dcc5199d51ba3",
+ "finite-frames/pair-ranked-word-23.json.gz": "4757871d48bf471053afe4ae432e64432fb35b9b4a364c5939c63df627ebeedc",
+ "finite-frames/pair-ranked-word-25.json.gz": "c1ecb265e96834bbd6576cec9316d13c8164e74cca4461c631bd9b5a9590f872",
+ "finite-frames/source-word-manifest.json": "ce415beef506a51dd2f52bd9a12f9b02668bce3738b257726d637fd88d1971cd",
+ "full-transfer/README.txt": "72d976360a025199eef89acde547b30dbc8388091f9854005afc681776bd0045",
+ "full-transfer/audit/README.txt": "98a8be2c1ad9d838668b46c07da7057837105fb6726ff3a1cc27d8ab5a01747a",
+ "full-transfer/audit/check_normalized_dominance.py": "d7668ba51fea91f217fc226ce12176aad5906e8b169000108ffb9fbf69dd687e",
+ "full-transfer/audit/head-changes.json": "896f7aaaf8cd257c1ee224142521605e9b8b54b6b28d132675f682cd88e65c86",
+ "full-transfer/audit/incremental-inventory.json": "12e3a71dea35ec3bb8d05e9d9176f4dde9449a1d0f0b33aa0c9b4c1cc0c0b389",
+ "full-transfer/audit/independent_pr71_73.py": "8e1b511f29365f8291e950ae9d6f4346efe5c31d07af0ecce7a7b5760047f441",
+ "full-transfer/audit/independent_profile_assembly.py": "4a04c9fad30a8992d8f7a24f94c5d53130288db0b12ef29fc685820742499732",
+ "full-transfer/audit/normalized-dominance-control.json": "dee0fc8c704b8d0bc36e690cbe9d0e8ff1a64b80738f48b63446d11dff3b4877",
+ "full-transfer/audit/physical-recurrence-review.txt": "6b8d8cae907f684faebabe181e3a1d13ee9fd1953675c5f50180307c8ee31644",
+ "full-transfer/audit/physical-review-source-pins.json": "d23ede28d90017347316573ad28136bca1167de2e109a825a7353b4af35e6c5c",
+ "full-transfer/audit/pr71-73-independent-receipt.json": "e7c1b9d1aa3faf6d38e1149b34b6f35da66931fbce771b495d0ff666a0accc4c",
+ "full-transfer/audit/pr71-73-verification-receipt.json": "af2332dbe9ac1e9c8e1d17d38e6412007a6b7bf5ac8aded929aa7c5b956dd112",
+ "full-transfer/audit/pr71-profile-assembly.json": "e0161238a04a4a6ef16101fc90eb91acb5a4da7456bd0321a48db60c6f7e3f0d",
+ "full-transfer/audit/profile-inputs/pr71-23.bin": "30a587456abf3e4de43e86cee6927681fc5d1f4880941a488014abe9742f9010",
+ "full-transfer/audit/profile-inputs/pr71-23.bin.json": "6ca709c1e101f7c9a828d9ceb8a7f2991a2d954b84c9ae8c616deabfc1e321c8",
+ "full-transfer/audit/profile-inputs/pr71-25.bin": "213dbbc008b221b8d1ddddb29b4c880611c186de44e00d3de6bdb87c53df3ac3",
+ "full-transfer/audit/profile-inputs/pr71-25.bin.json": "4364441b6a7c444bb2c84ab5b973c81e4069d753be7f1cf5a3c836096a739f1e",
+ "full-transfer/checkpoint.json": "60523205ff1eb5b728b59562e6b05199be6b178a4fdaa7dc59e16c7b4824d4f8",
+ "full-transfer/framed/README.txt": "c266ad1edb75162f659d8c3594182dfc56688bd6c7592c321278a7008820749e",
+ "full-transfer/framed/TensorStageFrames.lean": "799c559518b6beccd32b24f3bc2bd5f096e9adffc8a9d26e9163ecfd83dc5fba",
+ "full-transfer/framed/check_lean.py": "3915e2cdbea5b76f26f077a7cfa827bd3e6ba9476de605b0d3237f9078c43012",
+ "full-transfer/framed/forward_local.py": "6d68a48280508f5bfecaf27e633322ca32f1958343d9721ec5fd8a19f2e98d69",
+ "full-transfer/framed/frontier/full-ambient-pr71-73.json": "d2c7218285664c201a087b4980ede2e4396738987ad9261aa29be6c7e733e8df",
+ "full-transfer/framed/frontier/schema-views/axis-23.json": "dffbff335d98ee3e1aceb5748661264ec3d52a42efd9d459c9b1fddc7f1b29bf",
+ "full-transfer/framed/frontier/schema-views/axis-25.json": "76d72373917f4b8dd5c75585c9ad0730d4560c3772bb1538671d19848275333a",
+ "full-transfer/framed/frontier/schema-views/source-word-manifest.json": "3d6ade9348cac19236e78cddbf1bf068c40db88af5f43036707ed0a3b9e890d4",
+ "full-transfer/framed/full_ambient.py": "3929864c20094f83caa36aa2a16b65d85e7ecaf40e3129cb14fe52fdc77d9d42",
+ "full-transfer/framed/proof-manifest.json": "762f8a8dc50c330c8535e5fb5a8e6533fdaa86f05c7f151ea75d97bf71ad5688",
+ "full-transfer/framed/rejections.json": "c4a8670618813538f725e6161b6751ce9cbb34c5b2d2bee89805c3b6b49544ea",
+ "full-transfer/framed/reverse_local.py": "d4f558044adee86ca7f69f16169b7bc183129b99d7a95066fe57e78aa446efd3",
+ "full-transfer/framed/review-receipt.json": "2a168b689f608439700bbcbc8b4ee4768ac13474c3209657c783eeaffcfdc131",
+ "full-transfer/framed/review.txt": "d2304a75df2dedf47719eda3c70d3ff6fe904709ce658ecc46e96596c1c1ecdb",
+ "full-transfer/framed/test_rejections.py": "45ff7e6ca1071b145778851f9ba8520346e86b6afe51e88bc03eb63b016f3f6f",
+ "full-transfer/framed/verification/full-ambient.json": "0b6e2bb851f85dea05fcb7d0b130b2372cb97dad346ac14f94475ecf536de33b",
+ "full-transfer/framed/verification/verification.json": "4aa595709fd47816408b6028a0b6a4e66a7ee592738420c3fecce76bca5dcd79",
+ "full-transfer/framed/verify_frontier.py": "ff1ceb7586169d16159d4add48c3550e2802ef4fbbcbaf73e1ede70e141d3d13",
+ "full-transfer/latest-analytic/Pr73PhysicalCost.lean": "d0d60dd375aac16207f661d49cbc2bf7cd8e4a70c53d75ebde273a1446a7ee35",
+ "full-transfer/latest-analytic/Pr73ProfileCertificate.lean": "990d6d1b6045a37eadbf937b702ef0cad916b5a3396bb70055531daac2057f72",
+ "full-transfer/latest-analytic/Pr73ProfileReal.lean": "dcf4578cc0ecfe5f7da4d59097e4f7ffc5fcc987a022e36f2afdaae01ace7798",
+ "full-transfer/latest-analytic/README.txt": "34a49c3f567e2bcb9b4bad720738503dd2962c4a972cf25b90fa6a418a4c66f3",
+ "full-transfer/latest-analytic/SOURCE.json": "177bb891f93a26c85226223c4fd5944cb54f42ee59c7db9df5d1f026d67bc242",
+ "full-transfer/latest-analytic/check.py": "74f850c3acfb4cb9529a64c458a6e5b37d83e1cd3b79ac9fa2856e848f65a09d",
+ "full-transfer/latest-analytic/generate_pr73.py": "1b9e3aa0db04f6fb5ac81e2908adddaa6d72203f4adb26182cadf2100377838d",
+ "full-transfer/latest-analytic/independent-review.json": "b2c9cf81852f80e659e1d1ddfb1ba3dd0a8d379413aaa51207a933e0cd228315",
+ "full-transfer/latest-analytic/independent_review.py": "abc300841eb9b5e788d0bd1c23becd3fdba523214e3049b29d066b74d4c47175",
+ "full-transfer/latest-analytic/negative-controls.json": "9927df4b253ecc3c44d2d340ea14f857d64eba15cfe1a7bfebf8f81fbadc46fd",
+ "full-transfer/latest-analytic/pr73-candidate.json": "f391f7cee5377ab148f3cecc223fd8111c3075578b1ee327610e4dd3e3468fb0",
+ "full-transfer/latest-analytic/pr73-witnesses.json": "c3929f77d7f2e9124da6ad7dcea897f8e2498bb0c56aeb24729cc2739c827eb1",
+ "full-transfer/latest-analytic/review-receipt.json": "dc565a4a36c58b0e4b6b1ec2dade0cc0dcb1cc1a135fc746d77fbd1785564c42",
+ "full-transfer/latest-analytic/review.txt": "6836901d7a2484bf8c3f23bc781ba13965729000392cc9067227b8bcfaf58ac4",
+ "full-transfer/latest-analytic/theorem-manifest.json": "c894847a9ea10658670585d9c37b39d038a5bfea4df8e31a49f2ee22d9d402d1",
+ "full-transfer/latest-analytic/verification/axiom-audit.json": "b3224e04abdd374f23d42c4cfa6d482777b67822c0863f2a4db4b0d33b150458",
+ "full-transfer/latest-analytic/verification/source-binding.json": "1d85c858a29f25f57c3d15e3b911c619b1ba5c40bf01d41183213e1eacd39dc7",
+ "full-transfer/localization/EligibleLocalization.lean": "7c2525b8f30ddd26f5d9469972a8f9823c6b20805575d801c5c5755dea993c28",
+ "full-transfer/localization/LocalizedAddressGauges.lean": "916af51a79becb7e21afc3fe5f3b963c4ea724020d4a0343d848352f25f3cbc5",
+ "full-transfer/localization/LocalizedMatrixTransfer.lean": "9cb7fdbc50367aace87556986e0f4838eab50f82b69ae687eb46a9fad46a7ed7",
+ "full-transfer/localization/README.txt": "cc4c1e68eba0fd7bc936336e53c9ac55bfe223cabd3098b6a4daddd989612397",
+ "full-transfer/localization/check.py": "af12cfe3c5020335ebc1ac7de8d80b22e838da51d45babe3f69ced7434559999",
+ "full-transfer/localization/declaration-scope-map.json": "81964f74bf277ccaeb17d4a2a0c58018ab04b6f20274f8d06333f9bd2d48809e",
+ "full-transfer/localization/negative-controls.json": "e98ac23a8da5e43505b1a532f538ae924599ceb5694bef60a2571e2bcd2efb1c",
+ "full-transfer/localization/principal-review.json": "535b255f174f315f9c9cce6ce83b2a79f356c738c459f6cf29ea0119270604e9",
+ "full-transfer/localization/theorem-manifest.json": "3b7da4613fd4586257932fbb0fa9bbeab33bedc22360b9145b83ef9d5642c4b2",
+ "full-transfer/localization/verification/axiom-audit.json": "f6c53e8bddead23a756b9c5f8c708933e57e5dad7e3266d0324e534c8ca199c2",
+ "full-transfer/outerrows/DescriptorVolume.lean": "a75920e9cc264b87b907a4c58dae0559fe2a4ae45ddd1cae1ce186edf6646e6a",
+ "full-transfer/outerrows/OuterRows.lean": "d93aba86df8bd62cec2c5337319468db4772c875ae271fe09aa320c7fb990bdf",
+ "full-transfer/outerrows/README.txt": "5be75e7f325b3f357eae55f4efd272c14a9c056f24ed306d0c488ef2b9100020",
+ "full-transfer/outerrows/check.py": "ff04c1d8ec8225be2fe77b1b4f02013aa39ca73d4df915c245a1d124f4d38d37",
+ "full-transfer/outerrows/proof-manifest.json": "b441fe368673a4946bab3a4c3d5d1cbfd2e2187544ff8645e418e4fb2ee81fa5",
+ "full-transfer/outerrows/review-source-pins.json": "121adf97b86a30cf74f59203d416586a509b8ca280f1bd6f74d7aaf980a0e81d",
+ "full-transfer/outerrows/review.txt": "36e77677d2b6b56a474a2bcbfdd7883644bb37349d617b2e64596125d690203d",
+ "full-transfer/outerrows/verification/axiom-audit.json": "8b796540f162585119c309e795e4fde83242183c5849ee716ce336069948fe91",
+ "independent_assembly.py": "3f9a7e9294c9001826f29280d913818961c03fdb22a880a0ccf6de9c5fcf81d5",
+ "independent_moment.py": "4dbc008b40794f179f38a62aad941e75f44b0a3df7b2d75c640af69da7a057e9",
+ "lean-inventory.json": "a4482904567868b6d26c34abc282b0c642c49acb7a06186ae4682795cd593420",
+ "next-proof/README.txt": "9ee9244bbb09fca155827787b528b905485a22240991271ee6d43c21f2097333",
+ "next-proof/analytic/AnalyticEnclosures.lean": "bbbf93a1f68b6176e71379f6c2036e4b4379f13ba7ab8d9c749ba5ce9624cb0e",
+ "next-proof/analytic/README.txt": "8d61feeca0b46b1cef49de4542f2e582b6dbb92d5c51a8d468474ee68439cbe9",
+ "next-proof/analytic/SelectedProfileCertificate.lean": "0c6db6a2ed5d2da082e3005553b0981a9391f90273a0c1b9613cb66b39c54bd4",
+ "next-proof/analytic/SelectedProfileReal.lean": "b8d0fc896348906e60b91729f41c30f464d0b7283bc5cd49b831182f01700714",
+ "next-proof/analytic/adversarial-review.txt": "795bbbde020331c35724f67a4075898ea7f1fcb66e81094420d0b1d022c5cc66",
+ "next-proof/analytic/check.py": "f1aab7eecd13f397c6a466995b55e42ca8164046c451bff8ff2808477794f081",
+ "next-proof/analytic/declaration-scope-map.json": "09caa2ff02f50f4949aad9995b04267db01daa33e8699d79dfb212c04499db81",
+ "next-proof/analytic/generate_selected.py": "b31b943811358b2ef8021ec92f5f3196f2f0925be2ddceb34ad1d276a9a6b660",
+ "next-proof/analytic/negative-controls.json": "a03a3e12b75fbde1317dc5b9a5ee03cea8296ad9fbf5aa01a959ebda0a02e0e8",
+ "next-proof/analytic/selected-witnesses.json": "4db2b0aaa7ce8e6d4bb61d55f24cd65e29d84d8fc8485cfe15110042b2c50059",
+ "next-proof/analytic/theorem-manifest.json": "a8593a3f13cbab2aacdeba8a867bb5142033e8ba2ef9e6024d77771736529cff",
+ "next-proof/analytic/verification/axiom-audit.json": "307674d00156a29f125def38636f5011195051e73fb3b928827524a621f51d7f",
+ "next-proof/analytic/verification/source-binding.json": "236ef825608815907720f51862a308f329b9d301745a861105b4bac7ec81d809",
+ "next-proof/audit/incremental-inventory.json": "a58f814ed67a72a50a7dcfb8c070c6122f241ae96d12812c6c081eb13a9e2aec",
+ "next-proof/audit/incremental_audit.py": "dc74164b4048b07ab29f21c714aa6277bc924314b4b66ad8f955d77ad40c78b3",
+ "next-proof/audit/power-dominance.json": "6e8bd1a25301cda265b3d70bc9ede373f640f844f9080967bc9555fbf3aa20d4",
+ "next-proof/audit/power-dominance.txt": "d53dad9473267ed2d768da65dda525c65a53189adace3dc9d69dd26d42045006",
+ "next-proof/audit/power_inputs.py": "c7dd41f253b11c65516484f9254121d19af9efaf9b6ac20d1353c233a73e0428",
+ "next-proof/audit/pr67-verification-receipt.json": "33d75d908ae8f7cd9221c30034cf108e6280b57c98d8275ce5a4aceecf3216a7",
+ "next-proof/audit/research-update.txt": "446374a2fedf1525e3f7f1d7782cce5cd880492aa263eb08c99dcae6ef87712a",
+ "next-proof/checkpoint.json": "ebab9943b5f3f7ea3cf70603e1372d57c227abae0eec5583bbbed3241f202d56",
+ "next-proof/framed/DirtyWrapper.lean": "3ee3ee58cdb31bfa29c09c5f25b07f123b06988bdc7af8fcbc4062ba2780e30f",
+ "next-proof/framed/FramedXor.lean": "67d8385bdcdb0a553c09252bcc95d80fb8417beb8dfb6834a186c6f0b13862c9",
+ "next-proof/framed/README.txt": "6103a31ecdfeef1fa5c77c74340cfedb4951664ec8fb50056891ca0e71ae1cb5",
+ "next-proof/framed/analytic-binding-review.json": "baad86e2db4ad96600e0841bb4e23c1fb04c7542d1fa60249fd596792a6b4182",
+ "next-proof/framed/check.sh": "bd3445db43c1bee3d1ef2edd095f8163f28a9085aca4e59a7745e1193261ae09",
+ "next-proof/framed/check_analytic_binding.py": "20458dd84f92e623fd2635b229c02453c01eb5b8e28c580d108b2e1f65e27b75",
+ "next-proof/framed/proof-receipt.json": "08e9bd6a0e9ef65a19b1832d455f23f5c1262fef84249335156c7efd68ec9383",
+ "next-proof/rows/RowInterchange.lean": "9981188ca9712bb8565741659c20db35768588eb2eef5db6bd610dbf82b10a3a",
+ "next-proof/rows/adversarial-review.txt": "8ef7d95cabfe18b412bd58a9944e7fc62572fe53c48234ea10e484dbeb4b23ea",
+ "next-proof/rows/check.py": "44ead55c2a1830ab95118f833c7db489ce05a52ca23ca194fbbed0074218ae84",
+ "next-proof/rows/proof-scope.txt": "df1ccb2714fed5a5327704fc5a5ee3a2920e1a65659d1646cb2ddb77319617c0",
+ "next-proof/rows/verification.json": "3486c529158cf0ee9e7f9751257cb41770c454385de5cc0adb51550e9ce49186",
+ "pair-ranked-profile.json": "b4e395509525937d9c9a4275387cd6e800549bf9e06aef291ba909d95a1103f3",
+ "publication-lean-verification.json": "2430257bf511577c9fc8469f8042f2b4f63edad8ee910f3366f76e4fd55c21e6",
+ "research-addendum.tex": "7990f8f6439f24dcc3286f52184216527e0159148cffce71c6ca54c1a4ea72d0",
+ "selected-certificate.json": "6f83bf4b77ddb0cd2275356408b88e6ec044d3b03c33d88eb09a083991b8ada0",
+ "stream-transfer/audit/README.txt": "e4de0c2d2f34e39abb2170c52fe5c25bcfc601336edddfccdb05c560e2c19f3c",
+ "stream-transfer/audit/elementary-stream-contracts.txt": "0ea073236d2c9946e03109d3b6204ddc64cc8bc1ea6a11f8406bfa6bf9ed9fc7",
+ "stream-transfer/audit/head-changes.json": "411cde1286254e9ff74e1f27e6e8357718b569e11f9a242d5305ddcb12599e33",
+ "stream-transfer/audit/incremental-inventory.json": "77ca764827a0d148cd3db990223dd9967505db701e388952f8cdac5cdfaa64b0",
+ "stream-transfer/audit/independent_pr76.py": "6bb4c00181691d649c95295c7136a90729ad1b2ab83902bf23b809fe4f396c34",
+ "stream-transfer/audit/pr76-SOURCE.json": "f5ac84887ccf5905d178a3aac48b1b9a887c78e77a9b9e2d7acc2c72bdaaa354",
+ "stream-transfer/audit/pr76-arithmetic.json": "023139f724a46cccff7fa00464ce390300a623b8157151f6a90a71f537e25374",
+ "stream-transfer/audit/pr76-independent-receipt.json": "f3b86ea815fc382dfeda2f37cb673451cbc57362c9af9284a137f07af6e2e0d1",
+ "stream-transfer/audit/pr76-validation-receipt.json": "9c3cb79595a8c5ccb79dc08ec59244a277bb86415877eae4112d79d1bc738480",
+ "stream-transfer/audit/pr76-verification-receipt.json": "f9a60b6c4685f0e2effd1c66f71a68ae24c1d19215e2bda3d291481ffa383ac4",
+ "stream-transfer/audit/publication-review-receipt.json": "1a60a908721e52297fc30e230055808828d5158d68bdc9898c4787683a66ddda",
+ "stream-transfer/audit/publication-review.txt": "ba65b4cc0bed230f54c406655293af8c6f57d72ab371b1f971ecc0b85d107690",
+ "stream-transfer/counters/CounterArithmetic.lean": "00caa87ed92bd65ac6a2535a58faba438f887cc6b137c4cfb28a1df403628554",
+ "stream-transfer/counters/README.txt": "2753dee6815820b29108b921010f941eb5af92d4067e3487c3878c0cf122f13d",
+ "stream-transfer/counters/RippleCounter.lean": "2278a5fd158bd953f136204d92c9da0e6d9fc39fb1a74e8792e8e46aa0d2bc5a",
+ "stream-transfer/counters/SOURCE.json": "20376756642e6bc7a208bbd8a941f34c3eb65254203678d6d9b5da04f586aa01",
+ "stream-transfer/counters/check.py": "f575af14b1035971a1a005a385552c23ac0b3e81784d46195c83a71f7c33b0b2",
+ "stream-transfer/counters/declaration-scope-map.json": "7cbb9326c784a12ee3092b9b69d92a460aa5b802baf1e499f4108ac1ea239b64",
+ "stream-transfer/counters/review-receipt.json": "a89ef794d050c6432ef93f71ef03eba0bf0c9ba7b40f0f058976620557d1324e",
+ "stream-transfer/counters/review.txt": "512a3f095df3e2336fcfdf436ea36d8fdd2bc802c7e043e19a7334e64b82138c",
+ "stream-transfer/counters/theorem-manifest.json": "4a5d521695b51f7976efa1565fc1104c4ec87484fab368481532bf6f8f5bd474",
+ "stream-transfer/counters/verification/axiom-audit.json": "7534e669a7ee5e98c19ccd9ac41e9f60bec3549f6b5859eca8d08e7aefe28f50",
+ "stream-transfer/experiments/README.txt": "58e519479c1e8b289e7ea5c584d19965cae9ad7d64b0e0e7283f8084b0341810",
+ "stream-transfer/experiments/arithmetic-review.txt": "76f26e68410a9bf4225c1668e8bd246de9fd48bac3c87794337fb1aa47d15d6f",
+ "stream-transfer/experiments/balanced_split.py": "48b819038b6068e225a94f59ff5c73ef102846e09c9adcbfaa77090d877d574f",
+ "stream-transfer/experiments/candidate/balanced-split-23.json": "ceb8bf34ff0ceb35b5a050570af3762f9f13b430473ce1369f525030f3f4673a",
+ "stream-transfer/experiments/candidate/balanced-split-25.json": "ee28957ba1017ae7c5d2541e3e8fc64d4ae898b42da5d744a4550239cfb09118",
+ "stream-transfer/experiments/candidate/balanced-split-word-23.json.gz": "bed6275bd4187cf748756a36256b24718fc6bb0f6569bd75899e7386168e872a",
+ "stream-transfer/experiments/candidate/balanced-split-word-25.json.gz": "97489f822d472b421bef3ef00fb80f4a8914c2e932ffb043070a15557965329b",
+ "stream-transfer/experiments/coarse-source-binding.json": "f4e3e8547d11ce5149cb8faa806f507a5827821b5bdd09c34d35181c6388e3da",
+ "stream-transfer/experiments/combined-comparison.json": "a85d6a27d9bbfdbbb79ff256ce9b6f711ceba3e968a29364e4244716cb668b6c",
+ "stream-transfer/experiments/compare_completed.py": "708e511c8a7af38facf0593223bc5ed39b0e68653688fe720df8ebfc1a811c9d",
+ "stream-transfer/experiments/compatibility.txt": "00f14de462267cdcd90645edd2638ab016872843a62f4559b88d1439eee32991",
+ "stream-transfer/experiments/file-manifest.json": "20e5d31b0ecaf7f0f7108c694d868a6691b0df51256524f173d9db31c02a9cdd",
+ "stream-transfer/experiments/pr76-frontier-reference.json": "023139f724a46cccff7fa00464ce390300a623b8157151f6a90a71f537e25374",
+ "stream-transfer/experiments/pr76-frontier-source.json": "68775a063c9a407f87134ecc40318168a341345d6bdf32cb5cc40aafdf7257d4",
+ "stream-transfer/experiments/verification/balanced-split-23.bin": "d09ff8d5dc4adc6df8698929e36405290e89f34befdeb66b4206c096ae143ce0",
+ "stream-transfer/experiments/verification/balanced-split-23.bin.json": "f4ef6a81cf9af3144790067e3e94b312bf0ac8bd15e3ca51b46fbda0e319d704",
+ "stream-transfer/experiments/verification/balanced-split-23.bin.profiles.json": "1941c4be87b21d9ba26a3f62508b42372be2d63e083e60852d0638ff607bff73",
+ "stream-transfer/experiments/verification/balanced-split-25.bin": "af9ec802a850b2de8104a8e1e8e2899dd1ce1dc45bf684ece38ab362c5b524cc",
+ "stream-transfer/experiments/verification/balanced-split-25.bin.json": "a4a1fd9ce4591f899bc8c25e6fd0771becd8d52fe9a3b782d94c34027637e165",
+ "stream-transfer/experiments/verification/balanced-split-25.bin.profiles.json": "7cec8ff92788992542ec9db2d7426792f02c1d0f8c467c78e0f9ba52a967815c",
+ "stream-transfer/experiments/verification/comparison-23.json": "6fa93b6e46e6dffc21af3bb6989424bb10075c9f043c2741f4ed909f70ce0399",
+ "stream-transfer/experiments/verification/comparison-25.json": "4b6776743f78a81980165bee4ace9dffaa461ac26c0613648c7eedc0df0f93e1",
+ "stream-transfer/experiments/verify_balanced_split.py": "38e50a4e89fe08333b190c48c446629d91674dbb1d8bf1c0d6e383855ace748d",
+ "transfer-proof/README.txt": "a88b931bda1433741994aa118f352f6d5804331096b62eedc70ac121ee08c2cd",
+ "transfer-proof/audit/README.txt": "1731583860a0ab41735cbaf43d19773828d1b5da87f776a3ca639ced483407fb",
+ "transfer-proof/audit/landscape-update.json": "ab1c65351e57ffcdf991f75facedac07cb78a3b6853cec1f00b7132ccc5f0ea2",
+ "transfer-proof/audit/pr68-independent-arithmetic.json": "ccdf3b70bdb0cac5f50887b0722bf0fde324aa104c124d99abb9be40be356d51",
+ "transfer-proof/audit/pr68-independent-word.json": "b0a3f54856ca30e11f213aeb9cdb5a930a4bfa24324318146ab32dcead0d6916",
+ "transfer-proof/audit/pr68-verification-receipt.json": "37959a6bd1b5ac3760864fb0bb7860deff77c9ab7b82b9eb3711bfa13181eba2",
+ "transfer-proof/audit/pr68-vs-pr67-power-data.json": "d33949dd5d714287d9c4978167e18c0780657f5dd5345ff6e7f5f40db891627f",
+ "transfer-proof/audit/scalar-field-review.txt": "8aa6d57661cdc011201b8695b6f9b9f8b343788005a26eaf129fe0b91b645033",
+ "transfer-proof/checkpoint.json": "c51cc5ea03ae994ce5aec52ed14b528b1a1ab85772ae1ecf50db6b3f044aa705",
+ "transfer-proof/experiments/audit-driver.patch": "6abefc064be3eaf7d7460ec40be03c50607a0945096391d9a94cd17b56e51176",
+ "transfer-proof/experiments/audit-next23-manifest.json": "997c99dccc3c12ed04e511e14c5e17872aa2d26b9c2cd7529c265c4595f91e7b",
+ "transfer-proof/experiments/audit-next23.patch": "fac7b519036fac040081dc6d1b70ee566652c59d035f00ccedf814bcce97b2ea",
+ "transfer-proof/experiments/audit-next25-manifest.json": "17c3a365edfb7e0b7b084061e2a135ca770bf52433d251e9a60d176868b6aa3d",
+ "transfer-proof/experiments/audit-next25.patch": "5c9fc0fa80a036769f9bf3d5a0907f020afae1eea0e100aa3ad4645954a3d6ae",
+ "transfer-proof/experiments/audit-order23-manifest.json": "ef29bdfcb12e55efdb70a19cc7dfd9145785b45c043ca074a48050dddb4e21da",
+ "transfer-proof/experiments/audit-order23.patch": "19bb36bc4ecb093d17aec14d60a6f2964a3030729fa2d14477bdea5818d80b1f",
+ "transfer-proof/experiments/combine_next_use.py": "9f72d69b6e3a3199d4ab108a5d731b9547824d57d78ab672a88de0e21b59a7aa",
+ "transfer-proof/experiments/next-use-comparison.json": "18e5f3569b7951c93fbff111b58822cd2002aea13b02bb34077452c743be738e",
+ "transfer-proof/experiments/variant-results.json": "542ac2a2b67d0623a58262d2a0778399a29214f512f3a4ca60154c08f613c02c",
+ "transfer-proof/experiments/verify_selected_word.py": "d09e038be6f41f98dc7c381d8ba8dddf6eb9a1ceb6d3c8e8fba311bc2f6e3742",
+ "transfer-proof/framed/AddressGauges.lean": "a84351ef576b4bdaa3a9e328dfef0aef617d6ea467db49555d794a33502059d0",
+ "transfer-proof/framed/DirtyWrapper.lean": "3ee3ee58cdb31bfa29c09c5f25b07f123b06988bdc7af8fcbc4062ba2780e30f",
+ "transfer-proof/framed/FramedXor.lean": "67d8385bdcdb0a553c09252bcc95d80fb8417beb8dfb6834a186c6f0b13862c9",
+ "transfer-proof/framed/README.txt": "e9124cc89b8fa4d7e37bbf7e5cd88245e2d6c09c0a421f44049b3c10c0da21ca",
+ "transfer-proof/framed/check_lean.py": "3915e2cdbea5b76f26f077a7cfa827bd3e6ba9476de605b0d3237f9078c43012",
+ "transfer-proof/framed/field-and-transfer-assessment.txt": "1e487ac8a3f4d3b554561401a6bffec4f4a8a978fa1797e6807056144c5e5411",
+ "transfer-proof/framed/forward-23.json": "cf540f220bfe5c29ca9aec81fdf0257fa67155cce661fd95a7ff006aad13a099",
+ "transfer-proof/framed/forward-25.json": "afcd1aae8c0ff382c85143357fe5db2d81d8d262344d0b85cadf523c4199b2e4",
+ "transfer-proof/framed/full_forward_phase.py": "bb9618f94d1729ce8e4fde691c154173651ab488fb607fa6e0fb0d4ea7f0d67c",
+ "transfer-proof/framed/inputs/ranked-23.bin": "916f8b6ec54eacadaf55db59db03779a841a06a8647f13e8d40e07e451fa51f7",
+ "transfer-proof/framed/inputs/ranked-25.bin": "ae1b7eee2024bdb89c2aba380743cd212b0ed80e7534a27c800618b3ed7a97a0",
+ "transfer-proof/framed/phase-binding.json": "daf037e409163d3289247fca52d99eaa8f48799d9ac65b2c2660ee7e3ae118db",
+ "transfer-proof/framed/phase-rejections.json": "6eb51f977b47fed626afc654b2eee2ec34745eb7b134289be3545dd12acf6fb4",
+ "transfer-proof/framed/proof-manifest.json": "86c8763c6a111e920d25155acce7f58d30388fd97aafab2da342ff256c1e3da5",
+ "transfer-proof/framed/test_phase_rejections.py": "8b92923557c006c8e50df9332a23b1e96e97a6d65bf214cfd64a1c46db9b4b4a",
+ "transfer-proof/framed/verification.json": "8240123afbd4e42beed5ad5604644d455e48aa74c4d1ed9bfb165acb6aad2b87",
+ "transfer-proof/integration-review.txt": "29ac7dee8978b4a7ed30dc0459c5a48f946d2627155ba618663545d124b046ff",
+ "transfer-proof/latest-analytic/Pr68PhysicalCost.lean": "b10a558d6ba375bfda20ed5c8095685931a3095843caad1bf300ebf0b7606740",
+ "transfer-proof/latest-analytic/Pr68ProfileCertificate.lean": "fa3f3339486f584c5da594f30b3fe97a6950a5b4e063792fccd8f1e1af38fcf6",
+ "transfer-proof/latest-analytic/Pr68ProfileReal.lean": "0428ad7ba3f7c741288505698d3ee3958a999ccb091174da2a52c4d354398062",
+ "transfer-proof/latest-analytic/README.txt": "aadcc787c6546a3828c0ad0d96ba313842b5095566cc7c3d0fa2f4d8bf561eda",
+ "transfer-proof/latest-analytic/SOURCE.json": "a5fba95fad2f165c347f1b0713741b1317e315e0fd586d1a72a1da714ce4ddeb",
+ "transfer-proof/latest-analytic/check.py": "06835dd65b29d2c212a2f686d68435f505393911b08ba53947b27210f783cc74",
+ "transfer-proof/latest-analytic/declaration-scope-map.json": "a4623cd3e78e4aa8bfa30526e16726d753908e61cf7621d63e0d9baf1d583774",
+ "transfer-proof/latest-analytic/generate_pr68.py": "2df66f3b5310ef3734394c2835d33bf6a47735c4fae952bcddaf76ecdeafdf3c",
+ "transfer-proof/latest-analytic/independent-review.json": "6dc3417f9157e8bd4db762da6b246693372b8ba2389ccc09bb1a291e2fcc3fbb",
+ "transfer-proof/latest-analytic/independent_review.py": "c3cc446d201de14e9a734ecaba6402f82c52a1534ae23d2804d5cc62065590c7",
+ "transfer-proof/latest-analytic/negative-controls.json": "4ac9674ec0c6f10fc92b929441465713f8cf5ce93fb26746a04f565a0731bc4a",
+ "transfer-proof/latest-analytic/pr68-candidate.json": "06a0f2927f419c1ea108cd9b6f1e64d3174de8ba440a71c2e433c0bfee5a4b98",
+ "transfer-proof/latest-analytic/pr68-witnesses.json": "98aa35f38efcbf97875085ddafb8fa1786c8b84f1c08121b1834b7bd92f5cc3c",
+ "transfer-proof/latest-analytic/review.txt": "4d2d1a20f33ee130ec228b00fc68289eeb3bb46db97bcac8c3d94601749f4e26",
+ "transfer-proof/latest-analytic/theorem-manifest.json": "5d5adf07c3837bbeb2a9413427a2914a18206083a388d0dea010947338d1452f",
+ "transfer-proof/latest-analytic/verification/axiom-audit.json": "a211f3ab6e8bd910d58a308d3266fffd49152f027c9dd80bc7f3544dd4cc3ae2",
+ "transfer-proof/latest-analytic/verification/source-binding.json": "b1f54e64389382e83ee49b62d1660b099abeef00e4702c595d9b3a39ac48d7b3",
+ "transfer-proof/recurrence/FloorDepth.lean": "58dbb7e454c6767bb83cb8616fdc909dfc76dc5d46ca09ddaa84e45f02767e2d",
+ "transfer-proof/recurrence/FloorRecurrence.lean": "a2edfb9b2ac5d6d04bc93f9f7cc0ebf13254b15476fad7bfa747c5bfe2661e06",
+ "transfer-proof/recurrence/PhysicalCostTransfer.lean": "328d98165363dc6691b052bc0c385dbb98c04207ca366213ae3cd5a33fcc2de7",
+ "transfer-proof/recurrence/README.txt": "d286387a80177928610b759daebf41d5a6984af8a9ba97aad8aa10e0ee729f01",
+ "transfer-proof/recurrence/SelectedFloorTransfer.lean": "d91b87850f0f2519fb08c5600d162e2fa54186223a43c7fc16cce7fb1584b17a",
+ "transfer-proof/recurrence/check.py": "78bf0a5d7c1c520bfc1248b78e87479efc863b2e9d20516e3c41ea0a552f30f4",
+ "transfer-proof/recurrence/declaration-scope-map.json": "e84b9713dfeab12554d347556f44c5f42125b04097f38ca887da54cb88dd3da3",
+ "transfer-proof/recurrence/negative-controls.json": "fc27aa3af2ab52a1a9b64444035b849dbf5121a5505331f8fa9964042653167a",
+ "transfer-proof/recurrence/theorem-manifest.json": "c115ca914534a86f7a7d2377d37a305f1715c6422c2596a8c457d8b2f7e705cb",
+ "transfer-proof/recurrence/verification/axiom-audit.json": "442da2bd2c764d404cd3cdabefbb179ff251f88a12ba5176bd8984e4a8519e25",
+ "transfer-proof/recurrence/verification/source-binding.json": "236ef825608815907720f51862a308f329b9d301745a861105b4bac7ec81d809",
+ "transfer-proof/tapes/README.txt": "6168a41f2904e5610e39decbce20fceccf084f20ce66273d8ca6c663aacb2a54",
+ "transfer-proof/tapes/TapeStack.lean": "e2e0d507f3d3dda8d49c808ff12e2fdc36e0dc81f00cdba84b9308e7ebfaf156",
+ "transfer-proof/tapes/TapeStackPush.lean": "10309fb8f5c9e381f9e9ced50438d06096e6882cc75da8b59eabfd1f41fe4efb",
+ "transfer-proof/tapes/check.py": "36caaaa63f8edea52295edcc59a234396184989d5ed3bee674eb0a917fc4d68b",
+ "transfer-proof/tapes/declaration-scope-map.json": "5aeb865b9192e8da86e7047a44dda58bcb597d27ccc9af00df91f40d01423a35",
+ "transfer-proof/tapes/review.txt": "2815b2dba8f764d681b271362689554833a144a7f1c6763aef9cf88fb2c3bbfc",
+ "transfer-proof/tapes/verification/axiom-audit.json": "072944a3f9699aeb2235bda17b845a143304ce1b91167fdce5b85f4ffa6b6dd1",
+ "verify.py": "f4276b52ed6465eca27deef4a85b6fad76ea339e3384fc6c554a369b5bcdbd1f",
+ "verify_lean.py": "ed960b1c2baa4be235834242cf9839388158efc99f9ebf41835bdd83bf375733"
+ }
+}
diff --git a/research/machine-transfer-verification/research-addendum.tex b/research/machine-transfer-verification/research-addendum.tex
new file mode 100644
index 0000000000..eb6c198400
--- /dev/null
+++ b/research/machine-transfer-verification/research-addendum.tex
@@ -0,0 +1,960 @@
+\documentclass[11pt]{article}
+\usepackage[T1]{fontenc}
+\usepackage{lmodern,amsmath,amssymb,amsthm,booktabs,longtable}
+\usepackage[margin=1in]{geometry}
+\usepackage[colorlinks=true,urlcolor=blue,linkcolor=blue]{hyperref}
+\newtheorem{theorem}{Theorem}
+\newtheorem{lemma}[theorem]{Lemma}
+\newtheorem{proposition}[theorem]{Proposition}
+\newcommand{\F}{\mathbb F_2}
+\newcommand{\Q}{\mathbb Q}
+\newcommand{\R}{\mathbb R}
+\title{Integer multiplication: independent finite-network audit,\protect\\
+formal interfaces, and conditional exponent refinements}
+\author{Autonomous research with OpenAI Codex\\Prepared for the requesting user}
+\date{8 October 2026 --- working research addendum}
+\begin{document}
+\maketitle
+\begin{abstract}
+We distinguish finite algebra, exact characteristic inequalities, formal
+interfaces, and the complete uniform multitape multiplication theorem.
+The initial community inventory contains 61 pull requests, later refreshed to 68. A fork audit finds
+an interval-strip and core-aware pair construction by Avi Eisenberg, composed
+with eumemic's joint-frame compiler, claiming a larger conditional exponent
+than the initial pull requests; that construction subsequently appeared as PR62.
+Combining its graph with descending-rank slot reclamation gives a new finite
+construction with conditional saving $5.10275840622536575\cdot10^{-5}$,
+published with verification artifacts in draft PR64. The same finite words
+also appeared independently in PR63; no exclusive novelty is claimed.
+Both words were freshly generated and independently replayed. A discrete
+concavity certificate proves the new characteristic is strictly better for
+every saving in $(0,1)$, with roles and total rank unchanged.
+New Lean developments verify literal XOR-word dirty-scratch semantics,
+a general balanced-exponent ceiling, and rounded-width scalar recurrence transfer.
+A subsequent development proves the actual real characteristic inequality
+for the selected profile, together with generic framed execution and finite
+row-layout semantics. A fresh reproduction of the updated PR68 supports the stronger
+conditional saving $5.1035127217697\cdot10^{-5}$. A later 73-PR snapshot and
+fresh reproduction of the split-pair construction with PR73's parameter
+refinement support $5.1414646104194\cdot10^{-5}$. Formal certificates
+prove both profiles' actual real characteristic inequalities and instantiate
+the uniform state-indexed cost transfer. Literal finite-control tape parking
+and restoration are also proved, with explicit linear step bounds. This document
+does not prove the complete integer multiplication theorem: the physical
+compiler and analytic transfer obligations listed below remain external.
+The accompanying ledger records which computational reproductions have
+finished; an arithmetic calculation is never used as evidence that a physical
+word has been regenerated.
+\end{abstract}
+
+\section{Sources and scope}
+The original preprint is OpenAI, \emph{Integer multiplication below
+$n\log n$}, 23 September 2026. The local source snapshot is
+\texttt{fd4aeeb2ee4fc729c18d98444fed42fd0529eeeb} of
+\href{https://github.com/openai/math}{openai/math}.
+The initial community main is
+\texttt{64ed4cbf872b86b81c22f104967b88d24b8e4548} of
+\href{https://github.com/CrocSwap/integer-mult-bounds}{CrocSwap/integer-mult-bounds}.
+The independent Hrrsmjd addendum is pinned at
+\texttt{ad514e40b9a0506890d458e2f7aba623136fbbc9}; its arithmetic
+formalization uses Lean 4.34.1 and does not formalize a Turing machine.
+
+The user-specified PR58 is pinned at
+\texttt{96c52fb81cab6e714768e00ca33ca7f004ebcac4}; its construction commit is
+\texttt{bc2f7ed4c20dc18898305ab17165c0c995cbb804}.
+PR60 is \texttt{e7a492dd8bee4e6f574ced784a62af2ce735edc4}.
+PR61 is \texttt{ff8efaeacfeb3f7cdb49d72d073de64971fb70f0}.
+The independently discovered pair-assembly fork is
+\href{https://github.com/ikeboy/integer-mult-bounds/tree/ad0f25ff7b23cff7f08ad237c2254e6ecf74257e}{ikeboy/pair-assembly},
+commit \texttt{ad0f25ff7b23cff7f08ad237c2254e6ecf74257e}.
+The final inventory snapshot also records main
+\texttt{d55bcd62ceb8f322bcf311a5a66e94c3ac7724f0}; its headline is unchanged.
+PR61 subsequently moved to
+\texttt{b66ed150045be034a90105a79616a734a879e07a} and retuned PR60.
+At the final 18:02 UTC refresh, PR61 had moved again to
+\texttt{afb7cb67d1858641315cfbf4ac768ee64a8eff3a}, retuning PR62 to
+$5.1016920170078\cdot10^{-5}$. This remains below the new construction here.
+There were still 62 PRs and 22 exposed forks at that snapshot.
+An initial source inventory is not a mathematical proof review of every line
+of every branch. The audit records review depth and reproduction separately.
+
+\begin{center}
+\begin{tabular}{lrr}
+\toprule
+Construction & Claimed $\kappa$ & Physical roles $W$\\
+\midrule
+Merged main / PR49 & $4.123863984\cdot10^{-5}$ & $177284805$\\
+PR57 & $4.669442391\cdot10^{-5}$ & $153481944$\\
+PR58 & $4.750735690\cdot10^{-5}$ & $150593466$\\
+PR60 & $4.764513337\cdot10^{-5}$ & $150167598$\\
+Pair assembly + PR57 & $5.101691\cdot10^{-5}$ & $137151806$\\
+New pair + ranked reclamation & $5.10275840622536575\cdot10^{-5}$ & $137151806$\\
+\bottomrule
+\end{tabular}
+\end{center}
+At the initial head, PR61 refines PR58 to
+$59384196136667/1250000000000000000$. Its later head refines PR60 to
+$4.76451333766568\cdot10^{-5}$, still below PR62. These exponents concern asymptotic
+savings under inherited hypotheses, not measured execution times.
+
+\section{A literal-word dirty-scratch theorem}
+Let $D$ be a set of auxiliary roles and let a binary state be an element of
+$\F^D$. A gate replaces coordinate $d$ by $d+s$, with distinct source and
+destination roles. Let $L$ be a finite chronological word of such gates.
+Each gate is linear and involutive, hence the reverse word is $L^{-1}$.
+Let $V:X\to\F^D$ be an injection rule, $J:\F^D\to\F^Z$ a linear
+scatter, and $O:X\to\F^Z$ a specified output satisfying
+\begin{equation}\label{eq:terminal} J(L(Vx))=O(x)\quad(x\in X).\end{equation}
+No linear structure on $X$ and no zero-scratch promise is needed.
+
+\begin{theorem}[Dirty-scratch wrapper]
+Starting from source $x$, target $z$, and arbitrary scratch $d$, execute
+chronologically
+\[
+ L,\ J,\ L^{-1},\ V,\ L,\ J,\ L^{-1},\ V,
+\]
+where $J$ adds the scatter to the target and $V$ adds $Vx$ to scratch.
+The result is $(x,d,z+O(x))$.
+\end{theorem}
+\begin{proof}
+The first scatter adds $JLd$. The first inverse restores $d$, and the
+injection changes it to $d+Vx$. The second scatter adds
+$JL(d+Vx)=JLd+JLVx$. The two dirty terms cancel in characteristic two.
+The last inverse restores $d+Vx$, and the last injection restores $d$.
+Equation~\eqref{eq:terminal} identifies the target increment. The source is
+read-only throughout.
+\end{proof}
+
+The new file \texttt{lean/DirtyWrapper.lean} formalizes the literal gate
+semantics, reverse-word inversion, linearity and the eight executed stages.
+The terminal identity and scatter linearity are explicit hypotheses.
+Uniform address reindexing commutes with a pointwise XOR gate, because both
+sides evaluate the same two Boolean coordinates at the same reindexed address.
+Induction extends this to a word. The Lean file also formalizes this fact.
+This proves an equal-frame semantic interface; it does not prove that every
+frame transition emitted by a particular compiler is legal or correctly charged.
+
+The inherited geometric schedule also explains why four scalar mixer sweeps
+do not require four copies of the varying-frame profile. In the notation of
+\texttt{notes/dag-construction.tex}, the early $L,J,L^{-1}$ use a common
+background $D_0$. Only the middle forward $L$ uses increasing frames
+$D_U=D_0\perp(P\otimes U)$. The final inverse uses the common background
+$D_1$; entry into $D_1$ is charged as terminal cleanup. Source injections
+and scatters retain their separately charged source/target frames, and copied
+centers use the explicit paid schedule of \texttt{notes/copied-centers-lemma.tex}.
+For the reverse orientation, reverse the word and complement these frames.
+This is a written geometric argument, not a new Lean proof of the full
+frame-changing implementation. The local equal-frame and terminal contracts
+remain necessary at every gate.
+
+\section{Rank conservation and the correct optimization objective}
+Set $h_1=23$, $h_2=25$, $m=575$, $v_h=\binom h3$, and
+$N=v_{23}v_{25}=4073300$. Assume every auxiliary physical role has a
+monotone frame path whose rank begins at zero and ends at $h$.
+Every transition is charged by its rank increase. Assume also that the $h$
+copied centers each incur the additional charged rank $h-1$.
+
+\begin{lemma}[Local rank conservation]
+With $R_h$ roles, the full local rank mass is
+$hR_h+h(h-1)$, independently of how the intermediate monotone transitions
+are grouped.
+\end{lemma}
+\begin{proof}
+For each role the successive rank differences telescope to $h$.
+Sum over roles and add the $h$ paid center contributions.
+\end{proof}
+The assertion requires the actual chronological frame path and complete
+endpoint charges; a histogram alone does not establish its hypotheses.
+
+Let $B_h=(N/v_h)R_h$, $W=2N+B_{23}+B_{25}$, and
+$L=(N/v_{23})23\cdot22+(N/v_{25})25\cdot24=2226400$.
+The retained data child list is two copies of
+$9[1]+[21]+[17]+[481]$ per source pair. It contributes $1056N$.
+The data-growth terms contribute $92N$, and paid endpoint copies contribute
+$N$. Auxiliary interior and exterior terms together contribute
+$m(B_{23}+B_{25})+L$. Consequently
+\begin{equation}\label{eq:mass}
+ s=mW-N+L,\qquad mW-s=N-L=1846900.
+\end{equation}
+Thus changes confined to this producer/compiler family preserve the deficit.
+They improve the width and child distribution, not that deficit.
+
+For child multiplicities $n_t$ define
+\[
+ F(u)=\frac{1}{mW}\sum_{0 N_0$,
+\[
+ f(n)\le C+\sum_i c_i f(\lceil r_i n\rceil)
+\]
+for a fixed $C\ge0$. Then $f(n)=O(n^p)$.
+\end{lemma}
+\begin{proof}
+Choose an integer $N\ge\max(1,N_0)$ large enough that
+$N>1/(1-\max_i r_i)$ and
+$N^p\ge2\sum_i c_i/(1-\gamma)$.
+Choose $A>0$ with $A\ge2C/(1-\gamma)$ and
+$f(n)\le An^p$ for $1\le n\le N$.
+For $n>N$ all children lie in $[1,n-1]$.
+The inequality $(x+1)^p\le x^p+1$ holds for $x\ge0$;
+for $0 0.
+\]
+Seventeen theorem declarations are axiom-audited. The binding of this
+literal profile to the concrete compiler remains a separate finite
+verification interface; no physical cost theorem follows from the real
+inequality alone.
+
+\paragraph{Framed execution and fresh copies.}
+\texttt{FramedXor.lean} models a role gauge $g_r$ as a bijection from
+logical to physical addresses. Decoding reads $P_r(g_r(a))$.
+A literal reframe from $g$ to $h$ reads the previous row at
+$g(h^{-1}(b))$; it preserves decoded payloads. A typed XOR step requires
+equal current gauges at its incident roles. Induction over the typed
+trace proves that decoded physical execution equals the scalar XOR word
+obtained by erasing reframes, for arbitrary initial original rows.
+The copy lemma allocates one explicitly blank fresh row, clones a source
+by XOR, transports that row once, and uses it for an arbitrary literal
+list of targets. Duplicate targets retain their multiplicities. Every
+original nontarget row is preserved; no dirty original row is silently
+cleared. Formal counterexamples show why both current-gauge equality and
+the fresh-blank precondition are necessary. Eighteen main declarations
+are axiom-audited, using only \texttt{propext} and \texttt{Quot.sound}.
+
+\paragraph{Finite row semantics.}
+\texttt{RowInterchange.lean} constructs the actual finite bijection
+\[
+ \{0,\ldots,WR-1\}\longleftrightarrow
+ \{0,\ldots,W-1\}\times\{0,\ldots,R-1\},\quad
+ r\longmapsto(r\bmod W,\lfloor r/W\rfloor),
+\]
+whose inverse is $(w,g)\mapsto Wg+w$. It proves the split/merge laws on
+every original payload, retaining complete address fields.
+Suppose the scalar word sends input role $w$ to output role $\rho(w)$,
+and the endpoint gauges satisfy
+$g_{\rm out,\rho(w)}=\sigma\circ g_{\rm in,w}$, with $\sigma$ preserving
+the group coordinate. Undoing $\rho$ during the merge yields the exact
+payload $P(r,\sigma^{-1}(a))$ on original row $r$.
+The inverse is essential: $\sigma$ describes a pushforward of locations.
+Padding lemmas prove that a common within-row address map preserves fresh
+blank rows and restricts to the desired map on all original rows.
+Ten theorem declarations are axiom-audited. The typed concrete trace,
+its two endpoint premises, recursive row divisibility and implementation
+costs remain application obligations.
+
+\paragraph{Refreshed finite frontier.}
+The incremental inventory includes PR65--68; the audit distinguishes source
+inspection from complete reproduction. PR67, Rohan Arun's cost-aware
+retired-slot construction at
+\texttt{b3745601e947a94316bf25c2c6263d93c06e3364}, has been freshly
+reproduced with both deterministic word rebuilds, complete independent
+binary basis replay, fixed-basis CRT checks, negative controls and exact
+assembly arithmetic. It supports the conditional certificate
+\[
+ \kappa=\frac{10206752116843}{200000000000000000}
+ =5.1033760584215\cdot10^{-5}.
+\]
+Its parameters $m,W,s$ are unchanged. It retains the original PR63
+region orders despite descending from PR65 in Git. At this earlier snapshot,
+PR68's compatible live anchors suggested a combination with its witness
+search, but a combined construction had not yet been certified here.
+PR65, PR66 and that older PR68 head received source and literal-binding
+audits; their full rebuilds were not rerun in that incremental audit.
+The later PR68 reproduction below supersedes this earlier frontier.
+
+\begin{proposition}[Power comparison by integrated capped sums]
+Let $T\ge2$ and let $d_t$ be a finitely supported signed multiplicity difference with
+$\sum_{t=1}^T td_t=0$. Put
+$C_k=\sum_t d_t\min(t,k)$ and $S_j=\sum_{k=1}^j C_k$.
+If $S_j\le0$ for $1\le j = v, "Wrong physical role count")
+ require(set(d["sources"]) == {str(i) for i in range(v)}, "Incomplete source keys")
+ require(all(type(s) is int and 0 <= s < roles for s in d["sources"].values()), "Source domain")
+ require(len(set(d["sources"].values())) == v, "Aliased source slots")
+ expected, seen, central = [], set(), 0
+ for slot, frame, common, triple in d["outputs"]:
+ require(type(slot) is int and 0 <= slot < roles and slot not in seen, "Output slot domain or alias")
+ seen.add(slot)
+ require(type(frame) is int and 0 <= frame < len(d["frames"]), "Output frame domain")
+ require(type(common) is int and 0 <= common < h, "Output common point")
+ if len(triple) == 1:
+ require(triple == [common], "Invalid retained center")
+ central += 1
+ destinations = [i for i, t in enumerate(triples) if common in t]
+ else:
+ require(len(triple) == 3 and triple == sorted(triple) and common in triple,
+ "Invalid side-output triple")
+ require(tuple(triple) in triples, "Output triple domain")
+ destinations = [triples.index(tuple(triple))]
+ expected.extend([v + i, 2 * v + slot] for i in destinations)
+ require(central == h, "Missing retained centers")
+ for target, source in d["scatter"]:
+ require(type(target) is int and type(source) is int and
+ v <= target < 2 * v and 2 * v <= source < 2 * v + roles, "Scatter domain")
+ require(d["scatter"] == expected,
+ "Serialized scatter differs from complete output-derived literal operation list")
+ return {"scatter_xors": len(expected), "central_outputs": central,
+ "output_records": len(d["outputs"]), "literal_binding": True,
+ "sequence_sha256": sha256(json.dumps(expected, separators=(",", ":")).encode()).hexdigest()}
+
+
+def main():
+ parser = argparse.ArgumentParser(description=__doc__)
+ parser.add_argument("word", type=Path)
+ args = parser.parse_args()
+ raw = args.word.read_bytes()
+ if args.word.suffix == ".gz":
+ raw = gzip.decompress(raw)
+ print(json.dumps(verify_scatter(json.loads(raw)), indent=2))
+
+
+if __name__ == "__main__":
+ main()
diff --git a/research/ranked-pair-verification/compiler-rank-order.patch b/research/ranked-pair-verification/compiler-rank-order.patch
new file mode 100644
index 0000000000..56afebdb6c
--- /dev/null
+++ b/research/ranked-pair-verification/compiler-rank-order.patch
@@ -0,0 +1,11 @@
+--- a/scripts/experiments/binary_frame_compiler.py
++++ b/scripts/experiments/binary_frame_compiler.py
+@@ -129,7 +129,7 @@
+ old,e=bb[p];row^=old;expr^=e
+ return expr
+ for s in anchors:ins(s)
+- for s in sorted(retired):
++ for s in sorted(retired,key=lambda s:(-blocks[frames[s]]['rank'],s)):
+ if not contains(blocks[frames[s]]['frame'],blocks[g]['frame']):continue
+ e=ins(s)
+ if e is None:continue
diff --git a/research/ranked-pair-verification/concave-dominance.json b/research/ranked-pair-verification/concave-dominance.json
new file mode 100644
index 0000000000..ea410852d5
--- /dev/null
+++ b/research/ranked-pair-verification/concave-dominance.json
@@ -0,0 +1,126 @@
+{
+ "status": "PASS exact integer concave dominance",
+ "axes": [
+ {
+ "signed_multiplicities": {
+ "1": 79,
+ "2": -95,
+ "3": -22,
+ "4": -140,
+ "5": -91,
+ "6": -3,
+ "7": -11,
+ "8": -19,
+ "9": 23,
+ "10": 22,
+ "11": 22,
+ "12": 21,
+ "13": 14,
+ "14": 24
+ },
+ "capped_mass_differences": [
+ 0,
+ -176,
+ -431,
+ -591,
+ -729,
+ -727,
+ -634,
+ -538,
+ -431,
+ -305,
+ -202,
+ -121,
+ -62,
+ -24,
+ 0,
+ 0,
+ 0,
+ 0,
+ 0,
+ 0,
+ 0,
+ 0,
+ 0,
+ 0
+ ],
+ "zero_rank_mass": true,
+ "strict_at_width_one": true,
+ "min_basis_identity_checked": true,
+ "f_zero_coefficient": 176,
+ "h": 23,
+ "roles": 27918,
+ "old_word": "bd0cbf73756f2e4f8d3879ec6c7a194990eb9ec40aaf3580bdded6994798d920",
+ "new_word": "640696dd7cd893add9d6e12d0d587956fecf113b2eff8c29547b82e5a6f3c0ad",
+ "source_sha256": {
+ "pair-original-23-receipt.json": "9d4b2c627c5962303c2ed364ea70f7732cfa1ff6d55cda3b8d01a71fee96f81a",
+ "pair-ranked-23-receipt.json": "75ad8eda4a17ff839d744fa64955140ba1d0ef72b2b9107ca4ff28601929b97b"
+ }
+ },
+ {
+ "signed_multiplicities": {
+ "1": -75,
+ "2": 39,
+ "3": -135,
+ "4": -119,
+ "5": -106,
+ "6": -58,
+ "7": -87,
+ "8": -1,
+ "9": 15,
+ "10": -17,
+ "11": 22,
+ "12": 47,
+ "13": 19,
+ "14": 8,
+ "15": 49,
+ "17": 10,
+ "18": -5,
+ "19": 12,
+ "20": 10
+ },
+ "capped_mass_differences": [
+ 0,
+ -372,
+ -669,
+ -1005,
+ -1206,
+ -1288,
+ -1264,
+ -1182,
+ -1013,
+ -843,
+ -688,
+ -516,
+ -366,
+ -263,
+ -179,
+ -103,
+ -76,
+ -49,
+ -32,
+ -10,
+ 0,
+ 0,
+ 0,
+ 0,
+ 0,
+ 0
+ ],
+ "zero_rank_mass": true,
+ "strict_at_width_one": true,
+ "min_basis_identity_checked": true,
+ "f_zero_coefficient": 372,
+ "h": 25,
+ "roles": 36586,
+ "old_word": "634d3cc0fa8e4f592b1924c141bc953524ea08bf683059e18d8ad0c2f26785ec",
+ "new_word": "7a827318eff45db1183d66e80d38ddbd4ce321bbc033d2effb7afa438d6b63a9",
+ "source_sha256": {
+ "pair-original-25-receipt.json": "321992d6c104c77cccaad1444e3ac57ca6868aad5e23cc531b3dc29eaec082c3",
+ "pair-ranked-25-receipt.json": "56f82882e55bf5363d524a772f164cf360a9c66c59f7d44b458ff5353ea8bca7"
+ }
+ }
+ ],
+ "consequence": "For every 0f(0)+f(2), the inequality is strict.
+"""
+from pathlib import Path
+from hashlib import sha256
+import json
+
+def require(b,message):
+ if not b:raise ValueError(message)
+
+def certify(old,new):
+ require(len(old)==len(new),'profile lengths')
+ d=[b-a for a,b in zip(old,new)]
+ require(d[0]==0,'width-zero profile changed')
+ T=len(d)-1
+ C=[sum(min(t,k)*n for t,n in enumerate(d)) for k in range(T+1)]
+ require(C[T]==0,'total rank mass changed')
+ require(all(v<=0 for v in C),'not concave dominance')
+ require(C[1]<0,'strict concavity witness absent')
+ # Expand sum C(k)*(2f(k)-f(k-1)-f(k+1)).
+ coefficients=[0]*(T+1)
+ for k in range(1,T):
+ coefficients[k]+=2*C[k]
+ coefficients[k-1]-=C[k]
+ coefficients[k+1]-=C[k]
+ require(coefficients[1:]==d[1:],'summation-by-parts coefficient identity')
+ # The only remaining term is a multiple of f(0), fixed to zero.
+ return dict(signed_multiplicities={t:n for t,n in enumerate(d) if n},
+ capped_mass_differences=C,
+ zero_rank_mass=True,strict_at_width_one=True,
+ min_basis_identity_checked=True,f_zero_coefficient=coefficients[0])
+
+def main():
+ root=Path(__file__).resolve().parent
+ rows=[]
+ for h in (23,25):
+ paths=[root/'finite-frames'/f'pair-{kind}-{h}-receipt.json' for kind in ('original','ranked')]
+ old,new=[json.loads(p.read_text()) for p in paths]
+ require(old['profile']['R']==new['profile']['R'],'roles must stay unchanged')
+ row=certify(old['profile']['blocks'],new['profile']['blocks'])
+ row.update(h=h,roles=new['profile']['R'],old_word=old['word_sha256'],new_word=new['word_sha256'],
+ source_sha256={p.name:sha256(p.read_bytes()).hexdigest() for p in paths})
+ rows.append(row)
+ out=dict(status='PASS exact integer concave dominance',axes=rows,
+ consequence='For every 0= (3, 10), "Python 3.10 or newer is required")
+ root = Path(root).resolve()
+ require(git(root, "rev-parse", "HEAD").decode().strip() == pin,
+ "Upstream HEAD must equal pinned commit " + pin)
+ tracked = git(root, "ls-tree", "-r", "--name-only", "-z", pin).decode().split("\0")
+ # Validate all tracked executable source, not merely the top-level wrapper.
+ # This covers Python imports, C++ headers and inherited source manifests.
+ changed = []
+ hashes = {}
+ for name in tracked:
+ if not name or not source_path(name):
+ continue
+ expected = git(root, "show", pin + ":" + name)
+ path = root / name
+ if not path.is_file() or path.read_bytes() != expected:
+ changed.append(name)
+ hashes[name] = sha256(expected).hexdigest()
+ require(not changed, "Dirty pinned source: " + ", ".join(changed))
+ untracked = git(root, "ls-files", "--others", "--exclude-standard", "-z").decode().split("\0")
+ extra = [name for name in untracked if name and source_path(name)]
+ require(not extra, "Untracked source can shadow pinned imports: " + ", ".join(extra))
+ return root, hashes
+
+
+def validate_upstream(root):
+ root, hashes = validate_checkout(root)
+ manifest = json.loads((PACKAGE / "finite-frames/source-word-manifest.json").read_text())
+ require(manifest["upstream_pin"] == PIN, "Manifest upstream pin mismatch")
+ for name, digest in manifest["sources"].items():
+ raw = git(root, "show", PIN + ":" + name)
+ require(sha256(raw).hexdigest() == digest, "Manifest source digest mismatch: " + name)
+ require((root / name).read_bytes() == raw, "Dirty manifest source: " + name)
+ compiler = (root / "scripts/experiments/binary_frame_compiler.py").read_text()
+ transform = manifest["compiler_transform"]
+ require(compiler.count(transform["old"]) == transform["replacements"] == 1,
+ "Compiler transform must replace one exact occurrence")
+ derived = compiler.replace(transform["old"], transform["new"])
+ require(sha256(derived.encode()).hexdigest() == transform["derived_source_sha256"],
+ "Transformed compiler digest mismatch")
+ return root, manifest, hashes, derived
+
+
+def generated_directory(path, upstream):
+ destination = Path(path).resolve()
+ require(destination != upstream and upstream not in destination.parents,
+ "Generated outputs must be outside the pinned upstream checkout")
+ destination.mkdir(parents=True, exist_ok=True)
+ return destination
diff --git a/research/ranked-pair-verification/finite-frames/source-word-manifest.json b/research/ranked-pair-verification/finite-frames/source-word-manifest.json
new file mode 100644
index 0000000000..9327559722
--- /dev/null
+++ b/research/ranked-pair-verification/finite-frames/source-word-manifest.json
@@ -0,0 +1,33 @@
+{
+ "compiler_transform": {
+ "derived_source_sha256": "6dff1742e93fe8ff60172929abacd72434bbfe9805ac4f38008bf329c9d67123",
+ "new": "sorted(retired,key=lambda s:(-blocks[frames[s]]['rank'],s))",
+ "old": "sorted(retired)",
+ "provenance": "PR60 descending current-frame-rank priority by Chafik Boukhalfa, applied to PR62 graph and unchanged PR57 compiler",
+ "replacements": 1
+ },
+ "current_pr": "https://github.com/CrocSwap/integer-mult-bounds/pull/62",
+ "scope": "Provenance/integrity manifest, not an asymptotic proof. Upstream inherited SOURCE.json pins its referenced source closure.",
+ "sources": {
+ "references/frame-compiler/pr48/SOURCE.json": "6ccc673f88d3650d75ed600b082fe2fc2866dd88a172d182a38c1d0cd27d24b3",
+ "research/pair-assembly/frame/frame_compile.py": "12e3976daed5f90bb42750553d86802a27465ea875d3fc5b24ed824492df3ee7",
+ "research/pair-assembly/pair_graph.py": "3d47e89d2649c90800a276bdd0480131def50e0bdf92c122a19494b55bf17420",
+ "scripts/experiments/binary_frame_compiler.py": "bc6910c8bbe8224285164323d3c06e9035ad3eaa55416abc2867ae0066454a0c",
+ "scripts/experiments/binary_frame_math.py": "1f96e8aafc8ae89f8eeec5d03800131d93d58e01bf8a7fca8feb03702d1740d0",
+ "scripts/experiments/binary_frame_profile_prepare.py": "8a50381cab00b33e62b3a057d199ba5e19647929135c95b0fd63fc8a8ef7c9b3",
+ "scripts/experiments/binary_frame_profiles.cpp": "8e2e391d3ee57cbb1372c68e4aa031e1b861321536eabd642ada54e12e678669",
+ "scripts/experiments/binary_frame_replay.py": "392e78e62d7685c99a5888a7da743ea6c3dcad631af4a743c91e0c09348442bc"
+ },
+ "upstream_pin": "ad0f25ff7b23cff7f08ad237c2254e6ecf74257e",
+ "upstream_repository": "https://github.com/ikeboy/integer-mult-bounds",
+ "words": {
+ "23": {
+ "gzip_sha256": "4757871d48bf471053afe4ae432e64432fb35b9b4a364c5939c63df627ebeedc",
+ "word_sha256": "640696dd7cd893add9d6e12d0d587956fecf113b2eff8c29547b82e5a6f3c0ad"
+ },
+ "25": {
+ "gzip_sha256": "c1ecb265e96834bbd6576cec9316d13c8164e74cca4461c631bd9b5a9590f872",
+ "word_sha256": "7a827318eff45db1183d66e80d38ddbd4ce321bbc033d2effb7afa438d6b63a9"
+ }
+ }
+}
diff --git a/research/ranked-pair-verification/finite-frames/test_new_words.py b/research/ranked-pair-verification/finite-frames/test_new_words.py
new file mode 100644
index 0000000000..b2b0bd3ca3
--- /dev/null
+++ b/research/ranked-pair-verification/finite-frames/test_new_words.py
@@ -0,0 +1,47 @@
+#!/usr/bin/env python3
+"""Run seven inherited PR60 tampering controls against the bundled new words.
+
+An explicit checkout at PR60's exact pin is required. These controls supplement
+complete basis replay; they do not prove checker completeness or transfer.
+"""
+import argparse
+import gzip
+import importlib.util
+import json
+from pathlib import Path
+import sys
+import unittest
+
+sys.dont_write_bytecode = True
+from pinned_upstream import PACKAGE, PR60_PIN, validate_checkout
+
+
+def main():
+ parser = argparse.ArgumentParser(description=__doc__)
+ parser.add_argument("--pr60", type=Path, required=True)
+ args = parser.parse_args()
+ upstream, _ = validate_checkout(args.pr60, PR60_PIN)
+ source = upstream / "tests/test_joint_reclaim.py"
+ spec = importlib.util.spec_from_file_location("pinned_adversarial_controls", source)
+ controls = importlib.util.module_from_spec(spec)
+ spec.loader.exec_module(controls)
+
+ class NewWordControls(controls.JointReclamationControls):
+ @classmethod
+ def setUpClass(cls):
+ cls.words = {h: json.loads(gzip.decompress(
+ (PACKAGE / f"finite-frames/pair-ranked-word-{h}.json.gz").read_bytes()))
+ for h in (23, 25)}
+
+ names = ["test_omitted_literal_xor_is_rejected", "test_self_xor_is_rejected",
+ "test_non_nested_operation_frame_is_rejected", "test_aliased_terminal_role_is_rejected",
+ "test_missing_copied_center_is_rejected", "test_omitted_transition_cannot_reduce_paid_profile",
+ "test_understated_physical_width_is_rejected"]
+ result = unittest.TextTestRunner(verbosity=2).run(
+ unittest.TestSuite(NewWordControls(name) for name in names))
+ if not result.wasSuccessful():
+ sys.exit(1)
+
+
+if __name__ == "__main__":
+ main()
diff --git a/research/ranked-pair-verification/independent_assembly.py b/research/ranked-pair-verification/independent_assembly.py
new file mode 100644
index 0000000000..068ed77718
--- /dev/null
+++ b/research/ranked-pair-verification/independent_assembly.py
@@ -0,0 +1,91 @@
+"""Independent transcription of the 47 balanced-assembly inequalities.
+
+Mathematical source: PR23/29/34/36/48 balanced assembly, retained by PR57/58.
+Credit: Zhihao Chen, RaD/hipotures, James Chang, icekylinx, Chafik Boukhalfa,
+and the community's retained notices. This is an arithmetic audit, not a
+proof of the analytic or physical assumptions that justify these constraints.
+Unlike the contributor verifier, this script imports no upstream module.
+"""
+from fractions import Fraction as Q
+from pathlib import Path
+import argparse
+import json
+from independent_moment import encode, require, moment
+
+def assemble(c, a, k, h):
+ b,beta=Q(717,10**7),Q(1,20)
+ f=c['finite_bridge']
+ require(all(f['bit'][key]==c['bit'][key] for key in ('m','W','maxchild')),
+ 'finite bridge must describe the actual bit profile')
+ for key in ('bit','complex'):
+ p=f[key];m,W,t=p['m'],p['W'],p['maxchild']
+ D=p['halving_degree']
+ require(W>0 and 0 (n : ℝ) ^ p) k := by
+ have hconc := (Real.strictConcaveOn_rpow hp hp1).2
+ have h := hconc
+ (x := (k : ℝ)) (y := (k : ℝ) + 2)
+ (a := (1 / 2 : ℝ)) (b := (1 / 2 : ℝ))
+ (by change (0 : ℝ) ≤ k; positivity)
+ (by change (0 : ℝ) ≤ (k : ℝ) + 2; positivity)
+ (by linarith) (by norm_num) (by norm_num) (by norm_num)
+ have hmid : (1 / 2 : ℝ) * (k : ℝ) + (1 / 2 : ℝ) * ((k : ℝ) + 2) = (k : ℝ) + 1 := by ring
+ simp only [smul_eq_mul] at h
+ rw [hmid] at h
+ unfold curvature slope
+ push_cast
+ have htwo : (k : ℝ) + 1 + 1 = (k : ℝ) + 2 := by ring
+ rw [htwo]
+ nlinarith
+
+/-- Capped-mass dominance strictly improves the real power characteristic for
+every exponent 0 (n : ℝ) ^ p) d T
+ · simp [Real.zero_rpow hp.ne']
+ · exact hmass
+ · exact hcap
+ · intro k hk; exact (power_curvature_pos p hp hp1 k).le
+ · rcases hstrict with ⟨k, hk, hd⟩
+ exact ⟨k, hk, power_curvature_pos p hp hp1 k, hd⟩
+
+/-- Literal new-minus-old local width multiplicities from the independently
+reconstructed h=23 ranked pair profile; their construction provenance and
+serialized-word SHA256 hashes are in outputs/concave-dominance.json. -/
+def delta23Z : ℕ → ℤ
+ | 1 => 79 | 2 => -95 | 3 => -22 | 4 => -140 | 5 => -91 | 6 => -3
+ | 7 => -11 | 8 => -19 | 9 => 23 | 10 => 22 | 11 => 22 | 12 => 21
+ | 13 => 14 | 14 => 24 | _ => 0
+
+/-- Literal new-minus-old local width multiplicities for h=25. -/
+def delta25Z : ℕ → ℤ
+ | 1 => -75 | 2 => 39 | 3 => -135 | 4 => -119 | 5 => -106 | 6 => -58
+ | 7 => -87 | 8 => -1 | 9 => 15 | 10 => -17 | 11 => 22 | 12 => 47
+ | 13 => 19 | 14 => 8 | 15 => 49 | 17 => 10 | 18 => -5 | 19 => 12
+ | 20 => 10 | _ => 0
+
+def delta23 (t : ℕ) : ℝ := delta23Z t
+def delta25 (t : ℕ) : ℝ := delta25Z t
+
+set_option maxRecDepth 10000 in
+theorem delta23_integer_certificate :
+ (∑ t ∈ Finset.range 15, delta23Z t * (t : ℤ)) = 0 ∧
+ (∀ k : Fin 13, (∑ t ∈ Finset.range 15, delta23Z t * (min t (k.val + 1) : ℕ)) ≤ 0) ∧
+ (∑ t ∈ Finset.range 15, delta23Z t * (min t 1 : ℕ)) < 0 := by decide
+
+set_option maxRecDepth 10000 in
+theorem delta25_integer_certificate :
+ (∑ t ∈ Finset.range 21, delta25Z t * (t : ℤ)) = 0 ∧
+ (∀ k : Fin 19, (∑ t ∈ Finset.range 21, delta25Z t * (min t (k.val + 1) : ℕ)) ≤ 0) ∧
+ (∑ t ∈ Finset.range 21, delta25Z t * (min t 1 : ℕ)) < 0 := by decide
+
+theorem delta23_cap_certificate : mass 13 delta23 = 0 ∧
+ (∀ k ∈ Finset.range 13, cap 13 delta23 k ≤ 0) ∧ cap 13 delta23 0 < 0 := by
+ constructor
+ · unfold mass delta23
+ exact_mod_cast delta23_integer_certificate.1
+ constructor
+ · intro k hk
+ have hc := delta23_integer_certificate.2.1 ⟨k, Finset.mem_range.mp hk⟩
+ unfold cap delta23
+ exact_mod_cast hc
+ · unfold cap delta23
+ exact_mod_cast delta23_integer_certificate.2.2
+
+theorem delta25_cap_certificate : mass 19 delta25 = 0 ∧
+ (∀ k ∈ Finset.range 19, cap 19 delta25 k ≤ 0) ∧ cap 19 delta25 0 < 0 := by
+ constructor
+ · unfold mass delta25
+ exact_mod_cast delta25_integer_certificate.1
+ constructor
+ · intro k hk
+ have hc := delta25_integer_certificate.2.1 ⟨k, Finset.mem_range.mp hk⟩
+ unfold cap delta25
+ exact_mod_cast hc
+ · unfold cap delta25
+ exact_mod_cast delta25_integer_certificate.2.2
+
+/-- The concrete h=23 ranked profile strictly improves every power moment
+0 literal ∧
+ 2 * B * (m - 756) ≥ rankMass + E ∧ C0 > 2 * B + 18 ∧ rowGap > 0 := by
+ norm_num [rankMass, W, m, E, B, C0, G, literal, rowGap, stock]
+
+theorem strictly_improves_pair_baseline : (5101691 / 100000000000 : ℝ) < kappa := by
+ norm_num [kappa]
+
+#print axioms constraint_count
+#print axioms all_constraints_positive
+#print axioms all_seven_margins
+#print axioms exact_balancing
+#print axioms semantic_envelope_arithmetic
+#print axioms strictly_improves_pair_baseline
+
+end
+end ConcreteAssembly
diff --git a/research/ranked-pair-verification/lean/DirtyWrapper.lean b/research/ranked-pair-verification/lean/DirtyWrapper.lean
new file mode 100644
index 0000000000..8c0ca1b49b
--- /dev/null
+++ b/research/ranked-pair-verification/lean/DirtyWrapper.lean
@@ -0,0 +1,205 @@
+import Std
+
+/-!
+Finite binary dirty-scratch correctness, independently formalized for this audit.
+
+`run` is a literal chronological word of XOR gates. Gate endpoints must differ.
+There is no zero-scratch assumption. The theorem `compiled_wrapper_correct`
+executes L,J,L⁻¹,V,L,J,L⁻¹,V and proves source preservation, restoration of
+every auxiliary coordinate, and target addition of the specified output.
+
+External interface: `scatter_linear` and `terminal_identity` must be supplied.
+This file does not prove that a repository compiler emits the claimed word,
+that address frames permit its gates, or that its tape cost has any bound.
+-/
+
+namespace DirtyWrapper
+
+abbrev Vec (ι : Type) := ι → Bool
+
+def vxor {ι : Type} (u v : Vec ι) : Vec ι := fun i => u i ^^ v i
+
+theorem vxor_assoc {ι : Type} (u v w : Vec ι) :
+ vxor (vxor u v) w = vxor u (vxor v w) := by
+ funext i
+ exact Bool.xor_assoc _ _ _
+
+theorem vxor_cancel {ι : Type} (u v : Vec ι) : vxor (vxor u v) v = u := by
+ funext i
+ simp [vxor, Bool.xor_assoc]
+
+theorem vxor_dirty_cancel {ι : Type} (z d y : Vec ι) :
+ vxor (vxor z d) (vxor d y) = vxor z y := by
+ funext i
+ simp [vxor, ← Bool.xor_assoc]
+
+def IsLinear {ι κ : Type} (f : Vec ι → Vec κ) : Prop :=
+ ∀ u v, f (vxor u v) = vxor (f u) (f v)
+
+structure Gate (ι : Type) where
+ src : ι
+ dst : ι
+ distinct : src ≠ dst
+
+def applyGate {ι : Type} [DecidableEq ι] (g : Gate ι) (u : Vec ι) : Vec ι :=
+ fun i => if i = g.dst then u i ^^ u g.src else u i
+
+theorem gate_involutive {ι : Type} [DecidableEq ι] (g : Gate ι) (u : Vec ι) :
+ applyGate g (applyGate g u) = u := by
+ funext i
+ by_cases h : i = g.dst
+ · subst i
+ simp [applyGate, g.distinct, Bool.xor_assoc]
+ · simp [applyGate, h]
+
+theorem gate_linear {ι : Type} [DecidableEq ι] (g : Gate ι) :
+ IsLinear (applyGate g) := by
+ intro u v
+ funext i
+ by_cases h : i = g.dst
+ · subst i
+ simp only [applyGate, if_true, vxor]
+ cases u g.dst <;> cases v g.dst <;> cases u g.src <;> cases v g.src <;> decide
+ · simp [applyGate, h, vxor]
+
+def run {ι : Type} [DecidableEq ι] : List (Gate ι) → Vec ι → Vec ι
+ | [], u => u
+ | g :: gs, u => run gs (applyGate g u)
+
+theorem run_append {ι : Type} [DecidableEq ι] (xs ys : List (Gate ι)) (u : Vec ι) :
+ run (xs ++ ys) u = run ys (run xs u) := by
+ induction xs generalizing u with
+ | nil => rfl
+ | cons g gs ih => exact ih (applyGate g u)
+
+theorem run_reverse_cancel {ι : Type} [DecidableEq ι] (gs : List (Gate ι))
+ (u : Vec ι) : run gs.reverse (run gs u) = u := by
+ induction gs generalizing u with
+ | nil => rfl
+ | cons g gs ih =>
+ simp only [List.reverse_cons, run_append, run, ih]
+ exact gate_involutive g u
+
+theorem run_linear {ι : Type} [DecidableEq ι] (gs : List (Gate ι)) :
+ IsLinear (run gs) := by
+ induction gs with
+ | nil => intro u v; rfl
+ | cons g gs ih =>
+ intro u v
+ simp only [run, gate_linear g u v]
+ exact ih (applyGate g u) (applyGate g v)
+
+/-- A physical role now stores a full binary payload indexed by addresses. -/
+abbrev Rows (D A : Type) := D → A → Bool
+
+def applyRowGate {D A : Type} [DecidableEq D] (g : Gate D) (u : Rows D A) : Rows D A :=
+ fun d a => if d = g.dst then u d a ^^ u g.src a else u d a
+
+def runRows {D A : Type} [DecidableEq D] : List (Gate D) → Rows D A → Rows D A
+ | [], u => u
+ | g :: gs, u => runRows gs (applyRowGate g u)
+
+/-- The same address map is applied to every role in the region. A permutation
+is a special case; commutation itself does not need bijectivity. -/
+def reindex {D A B : Type} (π : B → A) (u : Rows D A) : Rows D B :=
+ fun d a => u d (π a)
+
+theorem gate_reindex {D A B : Type} [DecidableEq D]
+ (g : Gate D) (π : B → A) (u : Rows D A) :
+ applyRowGate g (reindex π u) = reindex π (applyRowGate g u) := by
+ rfl
+
+/-- Equal-frame commutation: a common address reindexing commutes with an
+arbitrary literal XOR word, for all initial payloads including dirty rows. -/
+theorem word_reindex {D A B : Type} [DecidableEq D]
+ (word : List (Gate D)) (π : B → A) (u : Rows D A) :
+ runRows word (reindex π u) = reindex π (runRows word u) := by
+ induction word generalizing u with
+ | nil => rfl
+ | cons g gs ih =>
+ simp only [runRows, gate_reindex]
+ exact ih (applyRowGate g u)
+
+/-- The addresswise semantics of `runRows` is exactly the scalar semantics
+already used in the dirty-wrapper theorem; this closes that correspondence. -/
+theorem word_addresswise {D A : Type} [DecidableEq D]
+ (word : List (Gate D)) (u : Rows D A) (a : A) :
+ (fun d => runRows word u d a) = run word (fun d => u d a) := by
+ induction word generalizing u with
+ | nil => rfl
+ | cons g gs ih =>
+ simp only [runRows, run]
+ exact ih (applyRowGate g u)
+
+structure State (X : Type) (D Z : Type) where
+ source : X
+ scratch : Vec D
+ target : Vec Z
+
+def mix {X D Z : Type} (L : Vec D → Vec D) (s : State X D Z) : State X D Z :=
+ { s with scratch := L s.scratch }
+
+def scatter {X D Z : Type} (J : Vec D → Vec Z) (s : State X D Z) : State X D Z :=
+ { s with target := vxor s.target (J s.scratch) }
+
+def inject {X D Z : Type} (V : X → Vec D) (s : State X D Z) : State X D Z :=
+ { s with scratch := vxor s.scratch (V s.source) }
+
+/-- Literal chronological execution of L,J,L⁻¹,V,L,J,L⁻¹,V. -/
+def wrapper {X D Z : Type} (L Linv : Vec D → Vec D) (J : Vec D → Vec Z)
+ (V : X → Vec D) (s : State X D Z) : State X D Z :=
+ let s1 := mix L s
+ let s2 := scatter J s1
+ let s3 := mix Linv s2
+ let s4 := inject V s3
+ let s5 := mix L s4
+ let s6 := scatter J s5
+ let s7 := mix Linv s6
+ inject V s7
+
+/-- Abstract wrapper theorem: reversibility, linearity and the terminal identity
+are explicit local hypotheses; arbitrary dirty input is universally quantified. -/
+theorem wrapper_correct {X D Z : Type}
+ (L Linv : Vec D → Vec D) (J : Vec D → Vec Z) (V : X → Vec D)
+ (output : X → Vec Z)
+ (inverse : ∀ d, Linv (L d) = d)
+ (mixer_linear : IsLinear L)
+ (scatter_linear : IsLinear J)
+ (terminal_identity : ∀ x, J (L (V x)) = output x)
+ (x : X) (d : Vec D) (z : Vec Z) :
+ wrapper L Linv J V ⟨x, d, z⟩ = ⟨x, d, vxor z (output x)⟩ := by
+ unfold IsLinear at mixer_linear scatter_linear
+ simp only [wrapper, mix, scatter, inject]
+ simp only [inverse, vxor_cancel]
+ simp only [mixer_linear, scatter_linear,
+ terminal_identity, vxor_dirty_cancel]
+
+/-- A serialized XOR word automatically supplies both reversibility and mixer
+linearity; no separate hypotheses for those properties are required. -/
+theorem compiled_wrapper_correct {X D Z : Type} [DecidableEq D]
+ (word : List (Gate D)) (J : Vec D → Vec Z) (V : X → Vec D)
+ (output : X → Vec Z)
+ (scatter_linear : IsLinear J)
+ (terminal_identity : ∀ x, J (run word (V x)) = output x)
+ (x : X) (d : Vec D) (z : Vec Z) :
+ wrapper (run word) (run word.reverse) J V ⟨x, d, z⟩ =
+ ⟨x, d, vxor z (output x)⟩ := by
+ exact wrapper_correct (run word) (run word.reverse) J V output
+ (run_reverse_cancel word) (run_linear word) scatter_linear
+ terminal_identity x d z
+
+#print axioms vxor_assoc
+#print axioms vxor_cancel
+#print axioms vxor_dirty_cancel
+#print axioms gate_involutive
+#print axioms gate_linear
+#print axioms run_append
+#print axioms run_reverse_cancel
+#print axioms run_linear
+#print axioms gate_reindex
+#print axioms word_reindex
+#print axioms word_addresswise
+#print axioms wrapper_correct
+#print axioms compiled_wrapper_correct
+
+end DirtyWrapper
diff --git a/research/ranked-pair-verification/lean/README.txt b/research/ranked-pair-verification/lean/README.txt
new file mode 100644
index 0000000000..02c7fd4b11
--- /dev/null
+++ b/research/ranked-pair-verification/lean/README.txt
@@ -0,0 +1,49 @@
+Ranked-pair Lean verification
+
+Run from the repository root:
+
+ (cd formal/lean && lake exe cache get)
+ python3 research/ranked-pair-verification/lean/check.py
+
+The five files use the existing formal/lean project, pinned to Lean 4.21.0
+and Mathlib 308445d7985027f538e281e18df29ca16ede2ba3 (v4.21.0). No separate
+Lake project or toolchain is required. The checker can run from any directory;
+--lake-project PATH selects another checkout of the same pinned environment.
+
+check.py verifies the five source SHA256s, all 45 theorem declarations and
+#print axioms coverage, dependency pins, and actual compiler version. It
+recompiles every source and rejects missing, duplicate or unexpected theorem
+rows and dependencies outside propext, Classical.choice and Quot.sound.
+Logs and a fresh axiom audit go under build/ranked-pair-formal/ (ignored).
+The checked-in verified-axioms.json is the completed research audit receipt;
+theorem-manifest.json records the exact sources and expected theorem names.
+Use --check-sources-only for a quick manifest/pin check without compilation.
+
+Proof scope
+
+DirtyWrapper.lean proves arbitrary dirty-workspace restoration, literal XOR
+word inversion/linearity, and uniform address-reindexing commutation.
+RoundedRecurrence.lean proves all-width rounded recurrence bounds and the
+exact real characteristic identity, with the physical recurrence and real
+characteristic inequality as explicit hypotheses. BalancedCeiling.lean proves
+the two-margin assembly ceiling. ConcreteAssembly.lean derives and proves the
+47 rational assembly inequalities. CappedMass.lean proves finite concave
+profile comparison, checks both signed profiles, and proves strict improvement
+of their real power characteristics for every saving 0
+ intro hn
+ by_cases hsmall : n ≤ N
+ · exact base n hn hsmall
+ · have hlarge : N < n := Nat.lt_of_not_ge hsmall
+ have hrec :
+ (∑ i ∈ s, c i * f ⌈r i * n⌉₊) ≤
+ ∑ i ∈ s, c i * (A * ((r i) ^ p * (n : ℝ) ^ p + 1)) := by
+ apply Finset.sum_le_sum
+ intro i hi
+ have hchild := rounded_child_lt (r i) N n (hr i hi) (hr1 i hi) (hthreshold i hi) hlarge
+ have hbound := ih _ hchild.2 hchild.1
+ have hround := ceil_power_bound (r i) n p (hr i hi).le hp hp1
+ exact mul_le_mul_of_nonneg_left
+ (le_trans hbound (mul_le_mul_of_nonneg_left hround hA)) (hc i hi)
+ have hsum : (∑ i ∈ s, c i * (A * ((r i) ^ p * (n : ℝ) ^ p + 1))) =
+ A * γ * (n : ℝ) ^ p + A * (∑ i ∈ s, c i) := by
+ rw [hγ]
+ simp only [Finset.mul_sum, Finset.sum_mul, ← Finset.sum_add_distrib]
+ apply Finset.sum_congr rfl
+ intro i hi
+ ring
+ have hmono : (N : ℝ) ^ p ≤ (n : ℝ) ^ p :=
+ Real.rpow_le_rpow (Nat.cast_nonneg N) (by exact_mod_cast hlarge.le) hp
+ have hgap : 0 ≤ A * (1 - γ) := mul_nonneg hA (by linarith)
+ have hbudgetn : C + A * (∑ i ∈ s, c i) ≤ A * (1 - γ) * (n : ℝ) ^ p :=
+ le_trans hbudget (mul_le_mul_of_nonneg_left hmono hgap)
+ calc
+ f n ≤ C + ∑ i ∈ s, c i * f ⌈r i * n⌉₊ := recurrence n hlarge
+ _ ≤ C + ∑ i ∈ s, c i * (A * ((r i) ^ p * (n : ℝ) ^ p + 1)) :=
+ add_le_add_left hrec C
+ _ = C + (A * γ * (n : ℝ) ^ p + A * (∑ i ∈ s, c i)) := by rw [hsum]
+ _ ≤ A * (n : ℝ) ^ p := by nlinarith [hbudgetn]
+
+/-- The real-exponential characteristic used by the exact finite certificates. -/
+noncomputable def expCharacteristic {ι : Type} (s : Finset ι) (multiplicity width : ι → ℝ)
+ (m W a : ℝ) : ℝ :=
+ ∑ i ∈ s, (multiplicity i * width i / (m * W)) *
+ Real.exp (a * Real.log (m / width i))
+
+/-- One term of the rank-profile characteristic equals the corresponding
+coefficient times the child ratio raised to the recurrence exponent. -/
+theorem characteristic_term (multiplicity t m W a : ℝ)
+ (ht : 0 < t) (hm : 0 < m) (hW : 0 < W) :
+ (multiplicity / W) * (t / m) ^ (1 - a) =
+ (multiplicity * t / (m * W)) * Real.exp (a * Real.log (m / t)) := by
+ have hratio : 0 < t / m := div_pos ht hm
+ have hlog : Real.log (t / m) = -Real.log (m / t) := by
+ rw [Real.log_div ht.ne' hm.ne', Real.log_div hm.ne' ht.ne']
+ ring
+ have hpow : (t / m) ^ (1 - a) = (t / m) * Real.exp (a * Real.log (m / t)) := by
+ rw [Real.rpow_def_of_pos hratio]
+ have he : Real.log (t / m) * (1 - a) =
+ Real.log (t / m) + a * Real.log (m / t) := by rw [hlog]; ring
+ rw [he, Real.exp_add, Real.exp_log hratio]
+ rw [hpow]
+ field_simp
+ ring
+
+/-- Exact equality of the recurrence characteristic and the certified profile
+expression. This is a real identity, not a floating-point approximation. -/
+theorem characteristic_identity {ι : Type} (s : Finset ι)
+ (multiplicity width : ι → ℝ) (m W a : ℝ)
+ (hm : 0 < m) (hW : 0 < W) (ht : ∀ i ∈ s, 0 < width i) :
+ (∑ i ∈ s, (multiplicity i / W) * (width i / m) ^ (1 - a)) =
+ expCharacteristic s multiplicity width m W a := by
+ unfold expCharacteristic
+ apply Finset.sum_congr rfl
+ intro i hi
+ exact characteristic_term (multiplicity i) (width i) m W a (ht i hi) hm hW
+
+/-- Finite rank profiles transfer to a bound for every positive width, provided
+the named physical recurrence and the REAL characteristic inequality hold.
+Finite rational enclosure files are not silently promoted to this real premise.
+-/
+theorem network_all_width_bound {ι : Type} (s : Finset ι)
+ (multiplicity width : ι → ℝ) (m W a A C : ℝ) (N : ℕ) (f : ℕ → ℝ)
+ (hm : 0 < m) (hW : 0 < W) (ha : 0 ≤ a) (ha1 : a ≤ 1) (hA : 0 ≤ A)
+ (hc : ∀ i ∈ s, 0 ≤ multiplicity i)
+ (ht : ∀ i ∈ s, 0 < width i) (htm : ∀ i ∈ s, width i < m)
+ (real_characteristic : expCharacteristic s multiplicity width m W a < 1)
+ (hthreshold : ∀ i ∈ s, (width i / m) * N + 1 < N)
+ (hbudget : C + A * (∑ i ∈ s, multiplicity i / W) ≤
+ A * (1 - expCharacteristic s multiplicity width m W a) * (N : ℝ) ^ (1 - a))
+ (base : ∀ n, 0 < n → n ≤ N → f n ≤ A * (n : ℝ) ^ (1 - a))
+ (physical_recurrence : ∀ n, N < n → f n ≤ C +
+ ∑ i ∈ s, (multiplicity i / W) * f ⌈(width i / m) * n⌉₊) :
+ ∀ n, 0 < n → f n ≤ A * (n : ℝ) ^ (1 - a) := by
+ apply all_width_bound s (fun i => multiplicity i / W) (fun i => width i / m)
+ f (1 - a) A C (expCharacteristic s multiplicity width m W a) N
+ (by linarith) (by linarith) hA
+ · intro i hi; exact div_nonneg (hc i hi) hW.le
+ · intro i hi; exact div_pos (ht i hi) hm
+ · intro i hi; exact (div_lt_one hm).mpr (htm i hi)
+ · exact (characteristic_identity s multiplicity width m W a hm hW ht).symm
+ · exact real_characteristic
+ · exact hthreshold
+ · exact hbudget
+ · exact base
+ · exact physical_recurrence
+
+#print axioms ceil_power_bound
+#print axioms rounded_child_lt
+#print axioms finite_budget_of_halves
+#print axioms all_width_bound
+#print axioms characteristic_term
+#print axioms characteristic_identity
+#print axioms network_all_width_bound
+
+end RoundedRecurrence
diff --git a/research/ranked-pair-verification/lean/check.py b/research/ranked-pair-verification/lean/check.py
new file mode 100644
index 0000000000..223c106f69
--- /dev/null
+++ b/research/ranked-pair-verification/lean/check.py
@@ -0,0 +1,129 @@
+#!/usr/bin/env python3
+"""Compile the pinned ranked-pair Lean sources and audit every theorem.
+
+Run from any directory. The default project is the enclosing repository's
+formal/lean; pass --project when checking a source bundle before integration.
+The script uses only the standard library and an installed `lake` command.
+It neither installs tools nor modifies Lean sources or dependency pins.
+"""
+import argparse
+import hashlib
+import json
+import os
+from pathlib import Path
+import re
+import subprocess
+import sys
+
+
+HERE = Path(__file__).resolve().parent
+DECLARATION = re.compile(r"^(?:theorem|lemma)\s+(\w+)\s*(?=[:({])", re.M)
+AUDIT_ROW = re.compile(
+ r"^'([^']+)' (?:depends on axioms: \[([^\]]*)\]|does not depend on any axioms)", re.M
+)
+
+
+def require(condition, message):
+ if not condition:
+ raise SystemExit(message)
+
+
+def default_project():
+ for parent in HERE.parents:
+ candidate = parent / "formal" / "lean"
+ if (candidate / "lean-toolchain").is_file():
+ return candidate
+ raise SystemExit("No enclosing formal/lean project found; pass --project PATH")
+
+
+def run_lean(project, arguments):
+ env = os.environ.copy()
+ # Lake supplies the pinned project's search paths; unrelated caller paths
+ # must not override the dependency environment being checked.
+ env.pop("LEAN_PATH", None)
+ return subprocess.run(
+ ["lake", "env", "lean", *arguments], cwd=project, env=env,
+ text=True, stdout=subprocess.PIPE, stderr=subprocess.STDOUT,
+ )
+
+
+def main():
+ parser = argparse.ArgumentParser(description=__doc__)
+ parser.add_argument("--lake-project", "--project", dest="project", type=Path)
+ parser.add_argument("--output", type=Path,
+ help="audit log directory; default: repository build/ranked-pair-formal")
+ parser.add_argument("--check-sources-only", action="store_true",
+ help="verify source hashes, theorem coverage and dependency pins without compiling")
+ args = parser.parse_args()
+ project = (args.project or default_project()).resolve()
+ manifest = json.loads((HERE / "theorem-manifest.json").read_text())
+ require(manifest["schema_version"] == 1, "Unsupported theorem manifest schema")
+ require((project / "lean-toolchain").read_text().strip() == manifest["lean_toolchain"],
+ "Lean toolchain pin differs from theorem-manifest.json")
+ dependencies = json.loads((project / "lake-manifest.json").read_text())["packages"]
+ mathlib = [row for row in dependencies if row["name"] == "mathlib"]
+ require(len(mathlib) == 1, "Expected exactly one pinned Mathlib dependency")
+ require(all(mathlib[0].get(key) == value for key, value in manifest["mathlib"].items()),
+ "Mathlib dependency pin differs from theorem-manifest.json")
+ require({p.name for p in HERE.glob("*.lean")} == set(manifest["files"]),
+ "Lean source inventory differs from theorem-manifest.json")
+
+ for name, entry in manifest["files"].items():
+ path = HERE / name
+ source = path.read_text()
+ require(hashlib.sha256(path.read_bytes()).hexdigest() == entry["sha256"],
+ f"Source changed since the audited theorem manifest: {name}")
+ declared = {path.stem + "." + item for item in DECLARATION.findall(source)}
+ expected = entry["theorems"]
+ require(len(expected) == len(set(expected)) and declared == set(expected),
+ f"Theorem coverage mismatch: {name}")
+ printed = re.findall(r"^#print axioms (\S+)\s*$", source, re.M)
+ qualified = {item if "." in item else path.stem + "." + item for item in printed}
+ require(len(printed) == len(set(printed)) and qualified == declared,
+ f"Missing or duplicate #print axioms statement: {name}")
+ require(not re.search(r"\b(sorry|admit|native_decide)\b", source),
+ f"Disallowed proof escape in {name}")
+ require(not re.search(r"^\s*(axiom|constant)\s", source, re.M),
+ f"Custom axiom or constant declaration in {name}")
+
+ count = sum(len(entry["theorems"]) for entry in manifest["files"].values())
+ print(f"PASS source hashes, {count} theorem declarations and pinned Lean/Mathlib", flush=True)
+ if args.check_sources_only:
+ return
+
+ version = run_lean(project, ["--version"])
+ matched = re.search(r"Lean \(version ([0-9]+\.[0-9]+\.[0-9]+)(?:[, )])", version.stdout)
+ require(version.returncode == 0 and matched and matched[1] == manifest["lean_version"],
+ "Wrong compiler or unavailable pinned Lean environment:\n" + version.stdout)
+ output = (args.output or project.parent.parent / "build" / "ranked-pair-formal").resolve()
+ output.mkdir(parents=True, exist_ok=True)
+ allowed = set(manifest["allowed_axioms"])
+ require(allowed == {"propext", "Classical.choice", "Quot.sound"},
+ "Unexpected allowed-axiom policy in manifest")
+ report = {"toolchain": manifest["lean_toolchain"], "mathlib": manifest["mathlib"],
+ "compiler": version.stdout.strip(), "files": {}}
+ for name, entry in manifest["files"].items():
+ print(f"Checking {name} ...", flush=True)
+ result = run_lean(project, [str(HERE / name)])
+ (output / (Path(name).stem + ".log")).write_text(result.stdout)
+ rows = AUDIT_ROW.findall(result.stdout)
+ names = [name for name, _ in rows]
+ bad = [(name, axioms) for name, axioms in rows
+ if {a.strip() for a in axioms.split(",") if a.strip()} - allowed]
+ success = (result.returncode == 0 and len(names) == len(set(names))
+ and set(names) == set(entry["theorems"]) and not bad)
+ if not success:
+ print(result.stdout, file=sys.stderr)
+ raise SystemExit(f"Compilation/axiom audit failed for {name}; unexpected axioms: {bad}")
+ report["files"][name] = {
+ "sha256": entry["sha256"],
+ "theorems": {theorem: sorted(a.strip() for a in axioms.split(",") if a.strip())
+ for theorem, axioms in rows},
+ }
+ print(f"PASS {len(names)} theorem audits", flush=True)
+ (output / "axiom-audit.json").write_text(json.dumps(report, indent=2) + "\n")
+ print(f"PASS all {count} theorems; logs: {output}")
+
+
+if __name__ == "__main__":
+ main()
diff --git a/research/ranked-pair-verification/lean/declaration-scope-map.json b/research/ranked-pair-verification/lean/declaration-scope-map.json
new file mode 100644
index 0000000000..e123c70893
--- /dev/null
+++ b/research/ranked-pair-verification/lean/declaration-scope-map.json
@@ -0,0 +1,796 @@
+{
+ "entries": [
+ {
+ "declaration": "BalancedCeiling.min_margin_le",
+ "kind": "theorem",
+ "file": "BalancedCeiling.lean",
+ "line": 12,
+ "mathematical_scope": "For all a>=0 and real epsilon, min(1-epsilon,epsilon*a)<=a/(1+a).",
+ "provenance_and_boundary": "Current two-margin balanced assembly algebra independently derived in this audit; architectural necessary bound only."
+ },
+ {
+ "declaration": "BalancedCeiling.balanced_attains",
+ "kind": "theorem",
+ "file": "BalancedCeiling.lean",
+ "line": 30,
+ "mathematical_scope": "The two-margin relaxation attains a/(1+a) at epsilon=1/(1+a).",
+ "provenance_and_boundary": "Current two-margin balanced assembly algebra independently derived in this audit; architectural necessary bound only."
+ },
+ {
+ "declaration": "BalancedCeiling.strict_ceiling",
+ "kind": "theorem",
+ "file": "BalancedCeiling.lean",
+ "line": 41,
+ "mathematical_scope": "For a>=0, epsilon>=0, q<=a, kappa<1-epsilon and kappa N_0$,
+\[
+ f(n)\le C+\sum_i c_i f(\lceil r_i n\rceil)
+\]
+for a fixed $C\ge0$. Then $f(n)=O(n^p)$.
+\end{lemma}
+\begin{proof}
+Choose an integer $N\ge\max(1,N_0)$ large enough that
+$N>1/(1-\max_i r_i)$ and
+$N^p\ge2\sum_i c_i/(1-\gamma)$.
+Choose $A>0$ with $A\ge2C/(1-\gamma)$ and
+$f(n)\le An^p$ for $1\le n\le N$.
+For $n>N$ all children lie in $[1,n-1]$.
+The inequality $(x+1)^p\le x^p+1$ holds for $x\ge0$;
+for $0 =2, a finite scalar word, rational frame tables and factor tables,
+and positive integer child multiplicities n_t with 1<=t0,'complex finite bounds')
+ E=64*(W+m+G+1)**3;B=s+E;C0=32*m*B*B
+ literal=2*G*W*W+8*s+4*W+4+32*m
+ require(E>literal and 2*B*(m-p['maxchild'])>=s+E and C0>2*B+18,'semantic envelope')
+ expected=dict(E=E,B=B,C0=C0,C1=1,literal_charge=literal,
+ strict_literal_gap=E-literal,induction_gap=2*B*(m-p['maxchild'])-(s+E))
+ require(all(Q(f['semantic'][key])==value for key,value in expected.items()),'semantic binding')
+ stock=sum(f[t]['halving_degree']*f[t]['wire_bits'] for t in ('bit','complex'))
+ rowgap=f['rows']['degree']-Q(51,25)*stock
+ require(f['rows']['coefficient']==stock and Q(f['rows']['degree_gap'])==rowgap>0,'row stock')
+ require(f['rows']['suffix_slope']==4*f['rows']['degree'],'row suffix')
+ q=a*(1-2*h);c0=q+h/4;e=(1-h)/(1+q)
+ tau,sigma=1-a,1-b
+ lp=1-q;lam=(tau+lp)/2;g=e*q;r=(g+1-e)/2;delta=h/8
+ internal=tau+(1-beta)*max(sigma-tau,Q(0));leaf=sigma+beta*(1-sigma)
+ margins=dict(g1=1-e,g2=a,g3=g,g4=a,g5=min(1-e-delta,r-delta),g6=1-e-delta,g7=e)
+ checks=dict(a_positive=a,a_below_b=b-a,b_below_one_over32=Q(1,32)-b,
+ beta_positive=beta,beta_below_one=1-beta,phase_leaf_above_bit=(1-beta)*b-a,
+ q_positive=q,q_below_internal=1-internal-q,q_below_leaf=1-leaf-q,
+ c_positive=c0,c_below_one=1-c0,q_below_reservations=c0-q,
+ lambda_above_tau=lam-tau,lambda_above_sigma=lam-sigma,
+ lambda_above_internal=lam-internal,lambda_prime_above_lambda=lp-lam,
+ compact_leaf=lp-leaf,compact_reservations=lp-(1-c0),lambda_prime_below_one=q,
+ epsilon_positive=e,epsilon_below_one=1-e,guard_width=1-e,
+ K_geometry=1-e*(1+c0),K_dominates_log=e*c0,record_suffix=1-e,
+ phase_local=1-e-delta,phase_boundary=r-delta,gamma_sublinear=1-e-r,
+ cell_above_band=e-(1-r)/2,prime_interval_packing=1-e,alpha_positive=r,
+ alpha_below_one=1-r,alpha_below_one_fourth=Q(1,4)-r,delta_positive=delta,
+ delta_below_one_eighth=Q(1,8)-delta,short_record_fallback=e-a,
+ small_field_exposure=1-e-g,artificial_boundary=8-e+r-delta-g,
+ literal_scalar_guard=E-literal,row_product_gap=rowgap)
+ checks.update({name+'_above_kappa':v-k for name,v in margins.items()})
+ require(len(checks)==47 and len(margins)==7,'complete constraint names')
+ require(00,'complex finite bounds')
+ E=64*(W+m+G+1)**3;B=s+E;C0=32*m*B*B
+ literal=2*G*W*W+8*s+4*W+4+32*m
+ require(E>literal and 2*B*(m-p['maxchild'])>=s+E and C0>2*B+18,'semantic envelope')
+ expected=dict(E=E,B=B,C0=C0,C1=1,literal_charge=literal,
+ strict_literal_gap=E-literal,induction_gap=2*B*(m-p['maxchild'])-(s+E))
+ require(all(Q(f['semantic'][key])==value for key,value in expected.items()),'semantic binding')
+ stock=sum(f[t]['halving_degree']*f[t]['wire_bits'] for t in ('bit','complex'))
+ rowgap=f['rows']['degree']-Q(51,25)*stock
+ require(f['rows']['coefficient']==stock and Q(f['rows']['degree_gap'])==rowgap>0,'row stock')
+ require(f['rows']['suffix_slope']==4*f['rows']['degree'],'row suffix')
+ q=a*(1-2*h);c0=q+h/4;e=(1-h)/(1+q)
+ tau,sigma=1-a,1-b
+ lp=1-q;lam=(tau+lp)/2;g=e*q;r=(g+1-e)/2;delta=h/8
+ internal=tau+(1-beta)*max(sigma-tau,Q(0));leaf=sigma+beta*(1-sigma)
+ margins=dict(g1=1-e,g2=a,g3=g,g4=a,g5=min(1-e-delta,r-delta),g6=1-e-delta,g7=e)
+ checks=dict(a_positive=a,a_below_b=b-a,b_below_one_over32=Q(1,32)-b,
+ beta_positive=beta,beta_below_one=1-beta,phase_leaf_above_bit=(1-beta)*b-a,
+ q_positive=q,q_below_internal=1-internal-q,q_below_leaf=1-leaf-q,
+ c_positive=c0,c_below_one=1-c0,q_below_reservations=c0-q,
+ lambda_above_tau=lam-tau,lambda_above_sigma=lam-sigma,
+ lambda_above_internal=lam-internal,lambda_prime_above_lambda=lp-lam,
+ compact_leaf=lp-leaf,compact_reservations=lp-(1-c0),lambda_prime_below_one=q,
+ epsilon_positive=e,epsilon_below_one=1-e,guard_width=1-e,
+ K_geometry=1-e*(1+c0),K_dominates_log=e*c0,record_suffix=1-e,
+ phase_local=1-e-delta,phase_boundary=r-delta,gamma_sublinear=1-e-r,
+ cell_above_band=e-(1-r)/2,prime_interval_packing=1-e,alpha_positive=r,
+ alpha_below_one=1-r,alpha_below_one_fourth=Q(1,4)-r,delta_positive=delta,
+ delta_below_one_eighth=Q(1,8)-delta,short_record_fallback=e-a,
+ small_field_exposure=1-e-g,artificial_boundary=8-e+r-delta-g,
+ literal_scalar_guard=E-literal,row_product_gap=rowgap)
+ checks.update({name+'_above_kappa':v-k for name,v in margins.items()})
+ require(len(checks)==47 and len(margins)==7,'complete constraint names')
+ require(0