[Lean] Prove nonlinear dirty-commutator restoration and ordered products (no new kappa)

[bitplane]

Scoped formalization / independent verification; no new κ. The nonlinear binary-commutator induction from PR628 and PR663 now has a Lean 4.21.0 proof for an explicit typed recursive evaluator. For every finite binary tree, array width, arbitrary initial dirt, and fixed deterministic nonlinear leaf maps, a complete call restores scratch, has a target-independent increment, and has an exact reverse-word inverse. Under the separate additive-leaf premise, Lean proves the ordered factor product without assuming the factors commute.

This formalizes an existing argument rather than claiming a new commutator, call-count improvement, or precision estimate. The evaluator passes actual intermediate scratch states between children. Its completed-leaf interface assumes source restoration and target-independent increments; the proof does not establish the numerical leaf's own correctness.

The package also supplies bounded source evidence:

• 12 audited formal statements, using only standard propext and/or Quot.sound, including a concrete nonlinear dirt-dependence counterexample.
• 130 actual dispatcher traces / 206,830 instructions, covering n=1..64 and n=83 in both signs. 34 kernel-checked equalities, with no axiom dependencies, bind complete literal traces at n=1..16 and n=83 to the address compiler. Both 7,744-instruction n=83 words are included.
• 1,170 mutable source execution cases / 3,722,940 leaf calls including inverses, compared with a functional evaluator and the independent increment recurrence. Widths 1..3 and floor, bounded-square, and noncommuting integer-shear leaves are covered.
• 2,364 additional cases cover all 197 ordered binary trees through seven leaves with a separate word interpreter. Six proof/trace mutations, three disallowed-axiom inputs, and four alias/depth controls are rejected.

Reproduce with Python 3.12+ and the official Lean 4.21.0 core/Std toolchain:

python3 -B -I research/lean-nonlinear-commutator/verify.py --lean /path/to/lean-4.21.0/bin/lean

Expected: PASS_NONLINEAR_ECHO: 12 formal statements; 34 kernel trace equalities; 1170 source cases; 2364 tree cases; 13 controls; kappa unchanged.

The complete receipt matches on Python 3.14.4 and an isolated optimized Python 3.12.3 replay from a read-only standalone copy. Source drift, missing source, integer-to-boolean receipt corruption, and existing-output preservation checks pass. The verifier uses an explicit 64 MiB Lean thread stack for the expanded trace. Source-function identity uses exact extracted text, avoiding Python-version-specific AST debug serialization. Selected-record integrity and staged scope/whitespace checks pass.

Only research/lean-nonlinear-commutator/ is added. Base f567884aeb8851b6e794af1184119a3bfbe1e631; subject PR628 0768f97d06c623b8211e651543c66135796b62bf; written audit PR663 e0e546fd01b396478c68b6b6c5a16d87515983ba. Six verbatim source/notice files have SHA256 and Git-blob pins. The fresh assignment seed is 83, coincidentally the same as the previous pass: PR887 formalizes resources, while this formalizes execution semantics. Queue refresh through #894 distinguishes PR889's multi-output batching and PR893's historical evidence audit.

The universal result is about the typed evaluator. Python and raw-address correspondence is the stated bounded evidence; all-size address-compiler correctness, numerical leaf accuracy/restoration, fixed nonaliased external data, physical execution, and multiplication remain separate obligations. The unmodified PR628 phase-alias admission gap is not repaired here. No global cold replay, full regenerating suite, or hosted CI success is claimed. Selected κ remains 1661634653669567/10^18.

Credit Chafik Boukhalfa / PR628, 0xkilgore / PR663, androolloyd / PR673, and Ali Romman / PR621 with retained notices. Prepared for Gareth Davidson (@bitplane), with substantial OpenAI Codex assistance; one AI agent, no independent human review claimed. Apache-2.0.