@ceccec/millennium-solutions 0.1.1 → 9.0.6

package/src/publication/index.ts

@@ -0,0 +1,363 @@
+// THE PUBLICATION BODY — one text, rendered on the web page and deposited at Zenodo, byte for byte.
+//
+// These had drifted apart while both were being improved. The page said a theorem was proved "exhausting
+// 4 cases"; the deposition deliberately omitted that number because domainOf() reads numerals off the
+// statement and returns 4 for a proposition that walks the 24 permutations its neighbour counts. Both were
+// written carefully. They still disagreed, in public, about the same theorem — which is what happens to
+// two descriptions of one thing that are maintained in two places.
+//
+// So there is one place now. The page imports it, the Zenodo record imports it, and a gate compares them.
+//
+// THE COUNT IS PUBLISHED AS A LOWER BOUND, because that is what it is. domainOf() multiplies the numerals
+// it finds in a statement: for `List.range 9` that is exact, and for the permutations of [1,2,4,8] it
+// returns 4 while the kernel walks the 24 that perms_of_four_is_factorial decides there are. The page has
+// been printing it as an exact count, and a citable record must not. Calling it a lower bound is true of
+// both cases and costs the claim nothing.
+//
+// THE CASE COUNT IS HANDLED THE WAY THE PAPER ALREADY HANDLED IT. paper.ts has long distinguished
+// `cases > 1` — "exhausting N cases" — from a single-case declaration, which it calls "by evaluation; no
+// domain is walked". That distinction is honest and it is the deposit's own, and it was missing from my
+// deposition prose, which told every record it had walked its whole domain. 112 of 336 had not.
+import { readFileSync } from 'node:fs'
+import { createHash } from 'node:crypto'
+import { domainOf, leanSource, type LeanTheorem } from '../api/index.ts'
+import { toUuid } from '../0/index.ts'
+import { toLatex } from '../latex/index.ts'
+import { treeOf, stats } from '../quantum/tree.ts'
+
+/** THE FUNDING STATEMENT, read from .github/FUNDING.yml so the repository declares it in one place.
+ *
+ *  Zenodo's `grants` field accepts only awards registered with OpenAIRE, and its custom-award lookup is
+ *  powered by ROR — a funder must exist in one of those registries to be named. This work has no
+ *  institutional grant and no registered funder, so NO `grants` entry is emitted. Inventing one, or
+ *  attaching an unrelated funder DOI to make the record look institutionally backed, would be a false
+ *  statement in permanent metadata about who paid for the work.
+ *
+ *  What is true is stated instead, in the record's own text: independent, unfunded by any grant, supported
+ *  by direct contribution. That is a funding statement a reader can act on, and it costs nothing to be
+ *  accurate about. */
+export const FUNDING = (() => {
+  try {
+    const y = readFileSync('.github/FUNDING.yml', 'utf8')
+    const url = (y.match(/https?:\/\/[^\s"'\]]+/) ?? [])[0] ?? ''
+    return { url, statement: 'Independent research. No institutional grant and no funder registered with '
+      + 'OpenAIRE or ROR, so no award is claimed in this record'
+      + (url ? `. Development is supported by direct contribution: ${url}` : '.') }
+  } catch { return { url: '', statement: 'Independent research; no grant funding is claimed in this record.' } }
+})()
+
+/** THE CANONICAL ORIGIN, read from the site's own declaration rather than typed here.
+ *
+ *  This was hardcoded as ceccec.github.io, and that host 301-REDIRECTS to ceccec.psg.bg — which is what
+ *  .vitepress/config.ts declares, what the sitemap uses, and what every page emits as its own
+ *  <link rel="canonical">. So the JSON-LD on 653 pages and the isDocumentedBy and references relations on
+ *  338 deposition records all named a redirect instead of the resource.
+ *
+ *  A citation index following a 301 gets a redirect, not the page; a redirect can lapse or be repointed by
+ *  whoever controls the old host; and a permanent record naming a non-canonical URL cannot be corrected
+ *  once it is minted. Found by resolving a URL rather than reading it — the same lesson the concept DOI
+ *  taught, applied to this deposit's own outbound links, which I had never resolved. */
+export const SITE = (() => {
+  const cfg = readFileSync('.vitepress/config.ts', 'utf8')
+  const m = cfg.match(/^const SITE = '([^']+)'/m)
+  if (!m) throw new Error('publication: .vitepress/config.ts declares no canonical SITE to derive from')
+  return m[1].replace(/\/+$/, '')
+})()
+export const REPO = 'https://github.com/ceccec/millennium-solutions'
+/** READ FROM CITATION.cff, not typed. It was written out in two modules — this one and
+ *  scripts/zenodo-theorems.ts — which is two places for the identifier that every deposition names as
+ *  isPartOf and that the page prints. Two copies of a DOI is one drift away from a record citing a
+ *  publication that is not the one it belongs to. zenodo-gate.ts already treats CITATION.cff as the
+ *  authority and cross-checks README.md and .zenodo.json against it; this makes the code agree. */
+export const CONCEPT_DOI = (() => {
+  const m = readFileSync('CITATION.cff', 'utf8').match(/^doi:\s*"?(10\.\d{4,}\/[^\s"]+)"?/m)
+  if (!m) throw new Error('CITATION.cff states no concept DOI — every deposition needs something to be part of')
+  return m[1]
+})()
+
+const esc = (s: string) => s.replace(/&/g, '&amp;').replace(/</g, '&lt;')
+export const humanise = (n: string) => n.replace(/_/g, ' ')
+
+/** Exhaustion is a claim about a domain. A closed identity is not one, and must not be dressed as one. */
+export const walksADomain = (t: LeanTheorem): boolean => domainOf(t.statement) > 1
+
+export const claimLine = (t: LeanTheorem): string =>
+  walksADomain(t)
+    ? `<strong>decided over the whole of its finite domain by exhaustion, every case walked by the Lean 4 `
+      + `kernel.</strong> Not sampled and not argued: within that domain there is no residual uncertainty and no `
+      + `case left untested. The domain read off the statement is ${domainOf(t.statement).toLocaleString('en')} `
+      + `cases — a LOWER BOUND, not a count: where a statement generates its own domain the kernel walks more `
+      + `than the numerals name, and this one is read the same way the paper ranks by it.`
+    : `<strong>a closed identity, evaluated by the Lean 4 kernel.</strong> No domain is walked here — the `
+      + `proposition reduces, and the kernel confirms the reduction. It is checked, not exhausted, and it is `
+      + `not offered as the larger claim.`
+
+export const proofLine = (t: LeanTheorem): string =>
+  `<em>Proof.</em> <code>${t.tactic}</code>`
+  + (walksADomain(t) ? ` — exhausting its domain, of which the statement names ${domainOf(t.statement).toLocaleString('en')} cases.` : ' — by evaluation; no domain is walked.')
+  + ` Checked sorry-free; <code>#print axioms</code> reports no axiom dependency. No Mathlib, no <code>native_decide</code>. □`
+
+/** THE STATEMENT'S OWN ADDRESS, so one result is one publication no matter which repository proves it.
+ *
+ *  Five repositories in this collective deposit into the same registry. Two of them proving the same
+ *  proposition and minting two DOIs publishes one result twice, which is worse than the salami-slicing
+ *  problem because neither record knows about the other. A theorem's NAME cannot decide this — names are
+ *  local and namespaced — and neither can its key, which is an address for a ledger and differs per repo.
+ *  What is the same across repositories is the STATEMENT.
+ *
+ *  THE NORMALISATION IS THE SPECIFICATION, and it is written out because a prose description of a hash is
+ *  how my metric-face protocol came to claim something the code did not do. Another repository computes the
+ *  identical address by doing exactly this and nothing else:
+ *
+ *    1. collapse runs of Unicode whitespace to one space
+ *    2. remove a space ONLY where it does not sit between two of [A-Za-z0-9_]
+ *    3. replace `==` with `=` and `!=` with `≠`, so a Boolean decision and a proposition agree
+ *    4. toUuid of the result — RFC 9562 §5.8 uuidv8 over sha256, as src/0 defines it
+ *
+ *  VERSION 1 STRIPPED ALL WHITESPACE AND LOWERCASED, AND BOTH WERE WRONG. uuidna-49 attacked the spec at my
+ *  request and measured it: in Lean, application is by juxtaposition, so the space in `List.range 7` IS an
+ *  operator and removing it yields `list.range7` — a different identifier. On this corpus 395 of 534
+ *  statements carry such a space and 333 carry an uppercase identifier that lowercasing destroyed;
+ *  `rawBytes A` became `rawbytesa`. No false merge resulted TODAY, so it was latent — but the normalised
+ *  form stopped being a parseable statement, so nobody could recompute an address from a re-parse, and a
+ *  future `rawBytesA` would have collided with `rawBytes A` permanently. Asking for the attack before
+ *  minting 338 DOIs is the only reason this cost nothing.
+ *
+ *  IT ADDRESSES TEXT, AND TEXT IS NOT A PROPOSITION. Both directions fail, and both were measured here:
+ *
+ *    · An absence of collisions is not uniqueness. Two repositories can state one fact in genuinely
+ *      different terms and this sees nothing.
+ *    · A collision is not duplication either. `settledHere = 8` appears in merkle.lean, quantum.lean and
+ *      reversal.lean, and `Merkle.settledHere` is not `Quantum.settledHere` — same text, three different
+ *      propositions. I wrote "a collision is proof of duplication" in the first draft of this comment and
+ *      the tree refuted it within the minute.
+ *
+ *  So a collision is a CANDIDATE for review, never a verdict. Four of the six found here are genuine —
+ *  one result under two names — and two are this limitation. The distinction needs a reader. */
+export const STATEMENT_ADDRESS_SPEC =
+  'statementAddress = toUuid(collapse-runs(statement) with whitespace removed only where it is NOT between '
+  + 'two of [\\p{L}\\p{N}_] (Unicode, u flag), case preserved, then "=="→"=" and "!="→"≠")  '
+  + '[v3: v2 amended by uuidna-49, Unicode class by erpax-94]'
+
+/** THE CROSS-REPOSITORY MERGE KEY — sha256, deliberately not this deposit's own address function.
+ *
+ *  erpax-94 identified the flaw in the plan we had converged on: agreeing a NORMALISATION is not enough,
+ *  because their addresses are sha256-backed and mine are FNV-1a-backed, so two repositories can normalise
+ *  a statement identically and still never collide numerically. A shared merge key needs the same
+ *  normaliser AND the same hash, and my "zero collisions against their manifest" was computed under two
+ *  different hashes — which is not a check, it is two repositories failing to find each other.
+ *
+ *  SHA-256 IS THE RIGHT CHOICE HERE AND FNV IS THE RIGHT CHOICE FOR THE LEDGER, which is why this is a
+ *  second function rather than a change to the first. A merge key is the adversarial case: it decides
+ *  whether two parties are publishing one result, and a non-cryptographic hash gives integrity against
+ *  accident only. The ledger address cannot move — it names every entry in an append-only chain, and
+ *  rewriting it is the same objection that stopped the hexbit encoding.
+ *
+ *  So: FNV addresses this deposit's own record, sha256 addresses the question "is this the same statement
+ *  as yours". Different purposes, different guarantees, and neither pretending to be the other. */
+export const MERGE_KEY_SPEC =
+  'mergeKey = sha256(normalised statement), hex, where normalised is the STATEMENT_ADDRESS_SPEC rule: '
+  + 'collapse whitespace runs, remove a space only where it is NOT between two of [\\p{L}\\p{N}_] with the u '
+  + 'flag (Unicode letters and numbers, NOT ASCII-only), keep case, '
+  + '"=="→"=", "!="→"≠". sha256 and not this deposit\'s FNV-1a construction: a merge key decides whether two '
+  + 'parties publish one result, which is the adversarial case.'
+
+export const mergeKey = (statement: string): string =>
+  createHash('sha256').update(normalise(statement), 'utf8').digest('hex')
+
+const normalise = (statement: string): string =>
+  statement
+    .replace(/\s+/gu, ' ')
+    // Remove a space only where it is not doing work. `\s(?![A-Za-z0-9_])` drops it before a symbol;
+    // `(?<![A-Za-z0-9_.])\s` drops it after one. A space between two alphanumerics survives, because in
+    // Lean that space IS the application operator.
+    // UNICODE-AWARE, not ASCII. `[A-Za-z0-9_]` excluded every Greek and blackboard identifier, so
+    // `σ (σ l)` collapsed to `σ(σl)` and `H₁(Σ₂) = ℤ⁴ with χ` to `…ℤ⁴withχ` — the same corruption as
+    // stripping all whitespace, narrowed to non-ASCII, in a language whose identifiers are Greek more often
+    // than Latin. erpax-94 measured it against ceccec.github.io's 832 statements: the two readings disagree
+    // on 211, a quarter, where two repositories computing "the same" key get different answers.
+    //
+    // THIS IS THE THIRD TIME THIS RULE HAS BEEN WRONG IN THE MERGING DIRECTION — strip-everything (refuted
+    // by uuidna-49), then ASCII-only (refuted here) — and each was agreed by three parties before anyone ran
+    // it against real statements. The rule kept being specified in prose and adopted before measurement.
+    // Hence the fixture beside it: a repo now checks its implementation against CASES, not against a sentence.
+    //
+    // Adopted here first because it costs this corpus nothing: 0 of 533 addresses change, measured before
+    // and after. A party that can move at zero risk should move first rather than wait for consensus.
+    .replace(/\s(?![\p{L}\p{N}_])|(?<![\p{L}\p{N}_.])\s/gu, '')
+    .replace(/==/g, '=').replace(/!=/g, '≠')
+
+/** The normaliser, EXPORTED so a peer reimplementing the shared key reads the rule instead of a sentence
+ *  describing it. Sending prose cost zeropoint-node six variants and an exhaustive apostrophe check, because
+ *  "remove a space only where it is not doing lexical work" is an intent, not an algorithm. */
+export const normaliseForFixture = (statement: string): string => normalise(statement)
+
+export const statementAddress = (statement: string): string => toUuid(normalise(statement))
+
+/** THE STATEMENT AS A STANDALONE LaTeX DOCUMENT, so the deposited record is a readable publication and not
+ *  only source. A reader who downloads one of these gets the Lean the kernel checked AND the mathematics
+ *  typeset from it — and the LaTeX is generated by the same translator scripts/latex-gate round-trips
+ *  against the source, so it is the statement rather than a transcription of it.
+ *
+ *  Synthesised at upload time rather than written to disk: 338 .tex files in the tree would be 338 more
+ *  generated artefacts to keep in step, and they are derivable from the theorem in one line. */
+export const theoremTex = (t: LeanTheorem, opts: { key: string | null }): string => {
+  const l = toLatex(t.statement)
+  return `\\documentclass[11pt]{article}\n`
+    + `\\usepackage{amsmath}\n\\usepackage{amssymb}\n\\usepackage{hyperref}\n`
+    + `\\newtheorem{theorem}{Theorem}\n`
+    + `\\title{\\texttt{${t.name.replace(/_/g, '\\_')}}}\n`
+    + `\\author{Tsvetan Rouschev\\\\\\small ORCID: \\href{https://orcid.org/0009-0000-7312-9778}{0009-0000-7312-9778}}\n`
+    + `\\begin{document}\n\\maketitle\n\n`
+    + `\\begin{theorem}[\\texttt{${t.name.replace(/_/g, '\\_')}}]\n`
+    + (l ? `\\[ ${l} \\]\n` : `\\texttt{${t.statement.replace(/([&%#_$])/g, '\\$1')}}\n`)
+    + `\\end{theorem}\n\n`
+    + `\\noindent\\emph{Proof.} \\texttt{${t.tactic}} --- the Lean~4 kernel evaluated the proposition over its\n`
+    + `domain, sorry-free, with \\texttt{\\#print axioms} reporting no axiom dependency. \\hfill$\\square$\n\n`
+    + `\\section*{Source and provenance}\n`
+    + `Declared in \\texttt{src/proof/${t.file}}. Repository: \\url{${REPO}}.\n`
+    + (opts.key ? `Content-addressed record: \\url{${SITE}/theorem/${opts.key}}.\n` : '')
+    + `Part of \\url{https://doi.org/${CONCEPT_DOI}}. Recompute with \\texttt{npm run lean}.\n\n`
+    + `\\end{document}\n`
+}
+
+/** THE SAME RECORD AS STRUCTURED DATA — one theorem, one description, three renderings.
+ *
+ *  Measured before this existed: all 2425 theorem pages carried ONE identical ld+json blob describing the
+ *  repository as a software project. Every page told an indexer the same thing and nothing about the
+ *  theorem on it — structured data that cannot vary with its subject is carrying no information about that
+ *  subject, which is the failure a generic 3D scene would have been.
+ *
+ *  Built from the same values the page renders and the Zenodo record deposits, so the three cannot drift:
+ *  a reader, a search engine and a citation index are told the same thing about the same declaration.
+ *  `sameAs` is deliberately absent until a DOI is minted — a link to a record that does not exist yet is
+ *  worse than none. */
+export const structuredData = (t: LeanTheorem, opts: { novelty: string; files: string[]; key: string | null }) => ({
+  '@context': 'https://schema.org',
+  '@type': 'ScholarlyArticle',
+  headline: humanise(t.name),
+  name: t.name,
+  description: `${t.statement} — ${walksADomain(t) ? 'decided by exhaustion over its whole finite domain' : 'a closed identity, evaluated'} by the Lean 4 kernel, sorry-free and axiom-free.`,
+  ...(opts.key ? { identifier: opts.key, url: `${SITE}/theorem/${opts.key}` } : {}),
+  author: { '@type': 'Person', name: 'Tsvetan Rouschev', '@id': 'https://orcid.org/0009-0000-7312-9778' },
+  license: 'https://creativecommons.org/licenses/by-nc-nd/4.0/',
+  inLanguage: 'en',
+  isPartOf: { '@type': 'Dataset', name: 'Millennium Solutions — the ℤ/9 vortex framework', identifier: `https://doi.org/${CONCEPT_DOI}` },
+  citation: [
+    { '@type': 'CreativeWork', name: `src/proof/${t.file}`, url: `${REPO}/blob/main/src/proof/${t.file}` },
+    { '@type': 'CreativeWork', name: 'The paper — every statement typeset', url: `${SITE}/paper` },
+    { '@type': 'CreativeWork', name: 'The axiom index', url: `${SITE}/AXIOMS` },
+  ],
+  // The proof is the material; naming the files makes the claim checkable rather than merely stated.
+  material: opts.files,
+  // The cross-repository identity of this proposition — see statementAddress.
+  alternateName: statementAddress(t.statement),
+  creativeWorkStatus: opts.novelty.split('.')[0],
+  about: { '@type': 'DefinedTerm', name: t.namespace || t.file.replace('.lean', ''), inDefinedTermSet: `${SITE}/proofs` },
+})
+
+/** The canonical body. `novelty` and `files` come from the register and the import closure. */
+export const publicationHtml = (t: LeanTheorem, opts: { novelty: string; files: string[]; key: string | null }): string =>
+  `<p><strong>${humanise(t.name)}</strong> — ${claimLine(t)}</p>`
+  + `<p><strong>Statement (Lean):</strong></p><pre><code>${esc(t.statement)}</code></pre>`
+  // toLatex IS DOCUMENTED "or null when this grammar does not cover it", AND THIS CONSUMED IT AS A STRING.
+  // Every statement in the tree happened to parse, so the null branch was never taken and the crash never
+  // came — until one theorem said `(invOf d).isSome`, and the whole site build fell over on `null.replace`.
+  // A rendering layer must not be able to decide what may be proved. The grammar was widened to cover it,
+  // and this now says plainly when a statement is outside the grammar instead of failing the build: the
+  // Lean statement above is the source, and an absent LaTeX rendering of it costs the reader nothing.
+  + ((tex) => tex
+      ? `<p><strong>Statement (LaTeX):</strong></p><pre><code>${esc(tex)}</code></pre>`
+      : `<p><strong>Statement (LaTeX):</strong> not rendered — this statement uses notation the LaTeX `
+        + `grammar in <code>src/latex</code> does not cover. The Lean above is the statement; nothing is `
+        + `omitted from it.</p>`)(toLatex(t.statement))
+  + `<p>${proofLine(t)}</p>`
+  // ── THE STATEMENT'S STRUCTURE, carried by the record as well as drawn on the page ──────────────────
+  // The theorem page renders this parse tree in three dimensions. A Zenodo record cannot run a script, so
+  // it carries the same structure as figures instead — the record and the page describe one object, and
+  // the gate compares them. Derived from the parse latex-gate round-trips against the Lean source, so the
+  // shape is the proposition rather than a picture of one.
+  + (() => {
+      const tr = treeOf(t.statement)
+      if (!tr || !tr.length) return ''
+      const s2 = stats(tr)
+      return `<p><strong>Structure.</strong> The statement parses to a tree of <strong>${s2.nodes}</strong> `
+        + `nodes across <strong>${s2.depth}</strong> levels, with <strong>${s2.leaves}</strong> leaves. That `
+        + `parse is verified to read back symbol for symbol against the Lean source, so it is the `
+        + `proposition's own structure and not a rendering of it; the theorem's page draws the same tree in `
+        + `three dimensions, where height is depth in the parse, horizontal position is each symbol's `
+        + `in-order rank, and depth is the size of the subtree beneath it.</p>`
+    })()
+  + `<p><strong>What this record establishes.</strong> <strong>A dated, public, citable deposit</strong> of this `
+  + `declaration and its machine-checked proof, recomputable from the sources attached to it. That is priority, `
+  + `and the record proves it on its own. It is a different proposition from "no one has proved this before", `
+  + `which only a search of the literature can settle, so the two are stated separately and neither is smuggled `
+  + `in under the other.</p>`
+  + `<p><strong>${opts.novelty}</strong></p>`
+  + `<p><strong>Verification.</strong> The proof needs ${opts.files.length === 1 ? 'one file' : `${opts.files.length} files`}, `
+  + `all attached: <code>${opts.files.join('</code>, <code>')}</code>. Check it with `
+  + `<code>lake env lean ${opts.files.join(' ')}</code>, or clone <a href="${REPO}">${REPO}</a> and run `
+  + `<code>npm run lean</code>.`
+  + (opts.key ? ` The content-address of this declaration is recorded as <code>${opts.key}</code> at <a href="${SITE}/theorem/${opts.key}">${SITE}/theorem/${opts.key}</a>.` : '')
+  + ` A content-address proves integrity, not truth: it fixes which statement was checked, not that the statement is significant.</p>`
+  + `<p><strong>Funding.</strong> ${FUNDING.statement}</p>`
+  + `<p><strong>Scope, stated as plainly as the claim.</strong> The declaration is decided over a finite domain. `
+  + `It settles no Clay Millennium Problem, asserts no quantum speedup, and describes no physical system. `
+  + `<strong>0/7.</strong></p>`
+
+// ── the register, shared by the page and the deposition ─────────────────────────────────────────────────
+
+// Surfaced in the record itself, in bold, rather than left to a file-level table nobody reads. A deposit
+// that will not say what it claims is not being modest, it is being unreadable.
+export const NOVELTY: Record<string, string> = {
+  '0': 'Prior art: NAMED AND CREDITED. This declaration restates or builds on work with an earlier author, '
+    + 'recorded in src/proof/priorart.lean. No priority over that work is claimed here.',
+  '1': 'Novelty: UNCLASSIFIED — an open question, not a claim. No prior-art search has been performed for '
+    + 'this source file, so this record asserts priority of deposit and nothing about the literature.',
+  '2': 'Novelty: CLAIMED. A named prior-art search was performed for this source file and returned nothing; '
+    + 'the search itself is on the record in src/proof/priorart.lean.',
+}
+export const KIND: Record<string, string> = {
+  '0': 'restates named prior art, the earlier author credited',
+  '1': 'unclassified — no prior-art search has been performed, so no novelty is asserted',
+  '2': 'a named prior-art search was performed and found nothing',
+}
+/** file -> its row in the table, so a deposition quotes the ledger rather than a guess. */
+export const kinds = (): Map<string, string> =>
+  new Map([...leanSource('priorart.lean').matchAll(/\(\s*\d+,\s*(\d+),\s*(?:true|false)\)\s*--\s*(\S+\.lean)/g)]
+    .map((m) => [m[2], m[1]] as [string, string]))
+export const ownFiles = (): string[] => [...kinds()].filter(([, k]) => k === '1').map(([f]) => f)
+
+/** THE FILES A RECORD MUST CARRY FOR ITS PROOF TO CHECK — the transitive closure of its imports.
+ *
+ *  Measured before this existed: 245 of 336 depositions attached ONE file that needed others to compile.
+ *  A reader downloading `lean_relation_eight` got mechanical.lean, which opens `import Address` and cannot
+ *  be checked without address.lean and fnv.lean. For a deposit whose whole claim is that a stranger can
+ *  recompute it rather than trust it, a record carrying an unbuildable proof is the claim failing at the
+ *  one place it is tested. speed.lean is the deepest: four files behind it. */
+export const closureOf = (file: string, seen = new Set<string>()): string[] => {
+  for (const m of leanSource(file).matchAll(/^import (\w+)/gm)) {
+    const dep = m[1].toLowerCase() + '.lean'
+    if (!seen.has(dep)) { seen.add(dep); closureOf(dep, seen) }
+  }
+  return [...seen].sort()
+}
+
+/** PER-THEOREM ATTRIBUTION, read from `-- prior_art_theorem: <name> — <credit>` in a file's frontmatter.
+ *  Prior art was routed on the FILE, and a file-level row cannot say "own work except theorem 7". That is
+ *  exactly merkaba.lean: its own construction throughout, with one declaration whose third conjunct
+ *  4 + 4 - 6 = 2 is the Euler characteristic. The register now carries the exception where the exception
+ *  is, and a credited theorem says so in its own deposition instead of inheriting the file's status. */
+export const creditedIn = (file: string): Map<string, string> => {
+  const out = new Map<string, string>()
+  const lines = leanSource(file).split('\n')
+  for (let i = 0; i < lines.length; i++) {
+    const m = lines[i].match(/^--\s*prior_art_theorem:\s*(\w+)\s*[—-]\s*(.*)$/)
+    if (!m) continue
+    let credit = m[2].trim()
+    for (let j = i + 1; j < lines.length && /^--\s{2,}\S/.test(lines[j]); j++) credit += ' ' + lines[j].replace(/^--\s+/, '').trim()
+    out.set(m[1], credit)
+  }
+  return out
+}
+

package/src/quantum/field.ts

@@ -0,0 +1,73 @@
+// THE QUANTUM FIELD — the geometry of src/proof/quantum.lean, computed rather than drawn.
+//
+// Every coordinate below comes from a function the Lean file decides over. Nothing here is a layout
+// choice dressed as a result: the ring angle is the permutation's index in Lean's OWN enumeration order,
+// the height is the value the control fold returns for that ordering, and the single node every edge lands
+// on is the receipt. What the picture shows is what `quantum.lean` proves — that twenty-four orderings
+// separate into five levels when combined naively and into one when canonicalised first.
+//
+// The definitions are transcribed from the Lean, not reimplemented from its prose. `agreesWithLean()`
+// below recomputes the five numbers the kernel decided and is run by a gate, so a divergence between this
+// module and the proof tree is a failing build rather than a wrong picture.
+
+/** Every way of inserting x into a list — `Quantum.insertEverywhere`. */
+const insertEverywhere = (x: number, l: number[]): number[][] =>
+  l.length === 0 ? [[x]] : [[x, ...l], ...insertEverywhere(x, l.slice(1)).map((r) => [l[0], ...r])]
+
+/** All orderings — `Quantum.perms`. */
+export const perms = (l: number[]): number[][] =>
+  l.length === 0 ? [[]] : perms(l.slice(1)).flatMap((p) => insertEverywhere(l[0], p))
+
+/** Insertion sort, `Quantum.ins` and `Quantum.sort`. */
+const ins = (x: number, l: number[]): number[] =>
+  l.length === 0 ? [x] : x <= l[0] ? [x, ...l] : [l[0], ...ins(x, l.slice(1))]
+export const sort = (l: number[]): number[] => l.reduce((acc, x) => ins(x, acc), [] as number[])
+
+/** Canonicalise, then combine — `Quantum.receipt`. */
+export const receipt = (l: number[]): number => sort(l).reduce((a, b) => (a * 2 + b) % 9, 0)
+
+/** The same combination without canonicalising — `Quantum.naive`, kept as the control. */
+export const naive = (l: number[]): number => l.reduce((a, b) => (a * 2 + b) % 9, 0)
+
+export const ORBIT = [1, 2, 4, 8] as const
+
+export type Node = { order: number[]; index: number; naive: number; receipt: number; angle: number }
+
+/** The twenty-four orderings, each carrying the two values that place it. */
+export const field = (seed: readonly number[] = ORBIT): Node[] => {
+  const all = perms([...seed])
+  return all.map((order, index) => ({
+    order, index, naive: naive(order), receipt: receipt(order),
+    angle: (index / all.length) * Math.PI * 2,
+  }))
+}
+
+/** The distinct heights the control fold produces — the five of `the_uncanonicalised_fold_gives_many_answers`. */
+export const naiveLevels = (seed: readonly number[] = ORBIT): number[] =>
+  [...new Set(field(seed).map((n) => n.naive))].sort((a, b) => a - b)
+
+/** The collision structure of `the_receipt_is_not_injective`: two-element multisets over the digits, by receipt. */
+export const collisions = (): { receipt: number; sets: number[][] }[] => {
+  const seen = new Set<string>()
+  const pairs: number[][] = []
+  for (let a = 1; a <= 9; a++) for (let b = 1; b <= 9; b++) {
+    const s = sort([a, b]); const k = s.join(',')
+    if (!seen.has(k)) { seen.add(k); pairs.push(s) }
+  }
+  const by = new Map<number, number[][]>()
+  for (const p of pairs) { const r = receipt(p); by.set(r, [...(by.get(r) ?? []), p]) }
+  return [...by.entries()].map(([receipt, sets]) => ({ receipt, sets })).sort((x, y) => x.receipt - y.receipt)
+}
+
+/** The five figures quantum.lean decided, recomputed here. A gate compares them; see scripts/quantum-field.ts. */
+export const agreesWithLean = () => {
+  const f = field()
+  const c = collisions()
+  return {
+    perms_of_four_is_factorial: f.length,                                   // 24
+    superposition_collapses_to_one: new Set(f.map((n) => n.receipt)).size,  // 1
+    the_uncanonicalised_fold_gives_many_answers: naiveLevels().length,      // 5
+    the_receipt_is_not_injective_sets: c.reduce((n, g) => n + g.sets.length, 0), // 45
+    the_receipt_is_not_injective_receipts: c.length,                        // 9
+  }
+}

package/src/quantum/tree.ts

@@ -0,0 +1,79 @@
+// EVERY THEOREM AS A SHAPE — the parse tree of its statement, laid out in three dimensions.
+//
+// The problem with rendering 525 different kernel-accepted declarations is that a generic 3D scene is
+// decoration: it looks the same whatever it is given, so it carries no information and the picture is a lie
+// by implication. What makes this honest is that the geometry is the PARSE, already verified: latex-gate
+// checks that every statement round-trips — the tree read back symbol for symbol against its source — so a
+// tree drawn from it provably represents the proposition the kernel accepted and not an approximation of it.
+//
+// Nothing is chosen per theorem. Depth is the node's depth in the parse. Horizontal position is its in-order
+// rank among the leaves, which is where the symbol actually sits when you read the statement left to right.
+// Depth in Z is the size of the subtree under it, so a heavy conjunction stands behind a bare numeral. Two
+// theorems with the same structure get the same shape, which is the property that makes the picture worth
+// looking at: shape differences are statement differences.
+import { parse, roundTrips } from '../latex/index.ts'
+
+export type TreeNode = {
+  id: number; parent: number | null
+  label: string; kind: string
+  depth: number; order: number; weight: number
+}
+
+type Ast = Record<string, unknown>
+
+const kindOf = (n: Ast): string => String(n.t ?? 'node')
+const labelOf = (n: Ast): string => {
+  const t = kindOf(n)
+  if (t === 'bin' || t === 'un') return String(n.op ?? '?')
+  if (t === 'id' || t === 'num') return String(n.v ?? '?')
+  if (t === 'app') return 'apply'
+  if (t === 'list') return '[…]'
+  return t
+}
+const kidsOf = (n: Ast): Ast[] => {
+  const out: Ast[] = []
+  for (const k of ['l', 'r', 'f', 'a', 'e', 'body']) {
+    const v = n[k]
+    if (v && typeof v === 'object') out.push(v as Ast)
+  }
+  for (const k of ['items', 'args', 'params']) {
+    const v = n[k]
+    if (Array.isArray(v)) for (const x of v) if (x && typeof x === 'object') out.push(x as Ast)
+  }
+  return out
+}
+
+const size = (n: Ast): number => 1 + kidsOf(n).reduce((s, k) => s + size(k), 0)
+
+/** The tree of a statement, or null when it does not parse — a page shows nothing rather than a guess. */
+export const treeOf = (statement: string): TreeNode[] | null => {
+  let ast: Ast
+  try { ast = parse(statement) as unknown as Ast } catch { return null }
+  const nodes: TreeNode[] = []
+  let next = 0, leaf = 0
+  const walk = (n: Ast, parent: number | null, depth: number): number => {
+    const id = next++
+    const kids = kidsOf(n)
+    const placeholder: TreeNode = { id, parent, label: labelOf(n), kind: kindOf(n), depth, order: 0, weight: size(n) }
+    nodes.push(placeholder)
+    if (!kids.length) { placeholder.order = leaf++; return id }
+    const childOrders = kids.map((k) => walk(k, id, depth + 1))
+    // An internal node sits at the mean of its children — the position the symbol occupies when read.
+    const kidNodes = childOrders.map((c) => nodes.find((x) => x.id === c)!)
+    placeholder.order = kidNodes.reduce((s, k) => s + k.order, 0) / kidNodes.length
+    return id
+  }
+  walk(ast, null, 0)
+  return nodes
+}
+
+/** Whether this statement's rendering is backed by a verified round-trip, stated per theorem. */
+export const verified = (statement: string): boolean => {
+  try { return roundTrips(statement) } catch { return false }
+}
+
+export const stats = (t: TreeNode[]) => ({
+  nodes: t.length,
+  depth: Math.max(...t.map((n) => n.depth)) + 1,
+  leaves: t.filter((n) => !t.some((m) => m.parent === n.id)).length,
+})