@lapxo/obligations 0.4.3 → 0.4.5

package/proofs/cofailure-pairs.json

@@ -0,0 +1,26 @@
+{
+  "id":"cofailure-pairs/two-declared-observables",
+  "classification":"two descriptive measures with declared models; finite counterexamples, not a law identifying causes",
+  "oracle":{"score":"number of complete cells with Y_i=Y_j!=truth divided by declared T","reference":"Published coincidenceExcess supplies this pair rate and its independent-uniform-wrong baseline, with handed or truth-estimated error marginals. The graph uses the raw false rate, not the excess.","thetaUnit":"false-coincidence probability"},
+  "withoutTruth":{"score":"number of complete cells with Y_i=Y_j divided by T, minus sum_v q_i(v)*q_j(v)","reference":"independent-categorical@1 with fixed, normalized, handed per-origin categorical marginals over the named alphabet. No truth or estimated error marginal is read.","thetaUnit":"excess probability, in [-1,1]","absentReference":"unmeasured; never silently estimate a null from this batch","Head":"This is the candidate observable available without truth; no Head or Bound change is made, and no causal interpretation is supplied."},
+  "existingBoundary":"The published coincidenceExcess itself requires truth. Its no-truth reading stays unmeasured. This candidate is a different observable, not a relabel of that API.",
+  "frame":"T and theta are explicit and mandatory: absence is unmeasured. T counts distinct complete selected events. Missing cells are unmeasured; identical redelivery is idempotent; conflicting event/origin values refuse by name. Budget is checked before indexing rows.",
+  "graph":"An edge is score>theta. Connected components are a descriptive projection; a path of above-threshold edges does not establish a common cause or a clique.",
+  "populationRecovery":"For a handed target partition, require max score_outside < theta < min score_inside over every pair. A threshold between the two means is insufficient. The partition itself and population scores are not inferred by this rule.",
+  "finiteUncertainty":{
+    "sampling":"Optional iid-cells@1, with epsilon in (0,1], fixed frame, selected origins, epsilon and (for the non-oracle observable) null marginals fixed before observing the batch. The caller supplies these premises; the instrument does not verify them.",
+    "chain":["For each pair's Bernoulli event, Var(mean)<=1/(4T) under the declared independent cells.","Chebyshev gives P(|observed-population|>=epsilon)<=min(1,1/(4*T*epsilon^2)). Subtracting a fixed handed baseline preserves the deviation.","The existing unionBoundConfidence combines these failures for all M=m(m-1)/2 pairs; no independence between pairs is required.","Exact rational intervals score+-epsilon are clipped to their probability support. Resolve an edge only if the whole interval is strictly above or below theta. Unresolved intervals and trivial bounds stay visible.","This bounds simultaneous threshold decisions under the handed model. Causal recovery requires the separate population partition and strict gap premises."],
+    "arithmetic":"rational, no logarithmic or directed-rounding approximation; conservative Chebyshev bound, not an optimal interval",
+    "reference":"https://theory.stanford.edu/~blynn/pr/markov.html"
+  },
+  "counterexamples":[
+    {"id":"truth-relabel","claimRefuted":"the no-truth statistic identifies which coincidences are wrong","witness":"Identical response rows, truth all zero versus truth copied from a: observational output is unchanged but oracle edges differ."},
+    {"id":"shared-question","claimRefuted":"positive categorical excess proves shared error lineage","witness":"All sources answer a balanced binary question correctly. Oracle false rate is zero; a handed marginal 1/2 reference gives observed agreement 1 and excess 1/2. Conditional errors are degenerate zero, while the shared question drives unconditional agreement."},
+    {"id":"between-means","claimRefuted":"threshold between mean within and outside rates suffices","witness":"Within rates 0.8 and 0.2; outside 0.21,0.21,0,0. Theta=0.15 lies between means 0.5 and 0.105 but merges the handed groups; max outside exceeds min inside."},
+    {"id":"c-e-finite-confusion","claimRefuted":"finite exact subgroup recovery whenever shared c is comparable to private e","witness":"With c=e=1/4, the all-correct T=4 batch has probability [(3/4)^5]^4>0; it has no above-threshold oracle edges. Its confidence bound is trivial, not a certificate of no common factor."}
+  ],
+  "alreadyKnown":"Cooccurrence relative to a declared null, Chebyshev concentration and union bounds are standard. The published package already has truth-conditioned coincidenceExcess and exact unionBoundConfidence.",
+  "addsHere":"The oracle-free observable and its explicit null, pair graph with threshold units, and model-separating fixtures. No c is identified, no M/3-M/4 hypothesis changes, and no algebraic act or wire field is introduced.",
+  "publication":"new candidate module only; existing signed public exports, TARGET, receipts and derived docs remain unchanged",
+  "open":["Choice of an adequate observable-context reference for Head; this marginal null can be confounded by shared questions.","No causal subgroup identification from these statistics alone.","No iid certificate, population-margin estimate, or guarantee without the declared sampling premises."]
+}

package/proofs/coordination.json

@@ -0,0 +1,27 @@
+{
+  "id": "coordination@1",
+  "policy": "vectors/laws/policy.json",
+  "classification": "measure with declared conditional model and exact finite enumeration",
+  "statement": "For all L selected sources under a shared activation of probability f, active outputs equal one named wrong value. Otherwise source errors are jointly independent conditional on truth with rate e, uniform among n-1 wrong labels. Then U_L=f+(1-f)*((1-e)^L+e^L/(n-1)^(L-1)), and wrong unanimity W_L=f+(1-f)*e^L/(n-1)^(L-1).",
+  "hypotheses": [
+    "n>=2, L>=1, declared f and e, fixed truth for wrong-label enumeration; symmetry permits uniform truth extension.",
+    "Activation affects every selected source, no other unmodeled activation or observation channel.",
+    "Joint conditional independence is a model declaration for inactive draws, not inferred from pairwise statistics.",
+    "If n>2 and 0<e<=1, or n=2 and 0<e<1, both private unanimity terms tend to zero, giving limit f; finite values generally exceed f."
+  ],
+  "existing": "U_L is exactly the published fitUnanimityModel single-dominant-factor curve, not a new algebraic law or identification method.",
+  "adds": "Explicit equivalence of scheduled coordinated outputs and a shared-cause output distribution under this specified mixture, exact small-L enumeration, wrong-unanimity distinction and named invalid readings.",
+  "nonIdentification": "The activation schedule is itself a common variable in the joint distribution. No inference about a shared physical process, intent or causal origin follows from the same curve; c_total is a compatible model parameter, not model-free truth.",
+  "negative": [
+    "At e=0 all outputs are unanimously correct when inactive: U_L=1 for every L, so U does not identify f. W_L still equals f.",
+    "Two disjoint groups independently activated at rate f/2 do not obey the all-source single-activation curve with mass f.",
+    "Marginal error rate e without joint conditional independence does not determine private unanimity; n=2, e=1/2, identical private errors give U=1 while iid predicts 2^(1-L)."
+  ],
+  "status": "declared-model measure; finite vectors, no causal identification",
+  "unmeasured": "Missing joint-independence declaration refuses curve interpretation by name; unknown mechanism remains unmeasured.",
+  "references": [
+    "https://www.stat.berkeley.edu/~aldous/206-Exch/"
+  ],
+  "signatures": 0,
+  "admission": false
+}

package/proofs/helly-comb.json

@@ -0,0 +1,17 @@
+{
+  "id": "helly-comb@1",
+  "policy": "vectors/laws/policy.json",
+  "classification": "law by finite counterexample, Lean kernel checked",
+  "statement": "Pairwise intersection does not imply joint intersection for arbitrary finite nonconvex subsets (combs).",
+  "domain": "Finite carrier {0,1,2}; A={0,1}, B={1,2}, C={0,2}. Witnesses AB=1, AC=0, BC=2; ABC empty.",
+  "hypotheses": "No convexity/interval assumption. C has a hole. Does not refute the interval-only T38.",
+  "negative": "Reject promoting pairwise compatibility of these combs to a global witness.",
+  "existing": "Classical Helly theory needs convexity; finite intervals on a line are 2-Helly. The elementary nonconvex counterexample is not a new discovery.",
+  "adds": "Exact finite subset witness and compiled Lean certificate tied to Obligations candidate bytes; no new form or wire encoding.",
+  "references": [
+    "https://www.math.ucdavis.edu/~deloera/TEACHING/MATH114/convexitythy.pdf"
+  ],
+  "status": "finite witness checked; no generalized theorem",
+  "signatures": 0,
+  "admission": false
+}

package/proofs/lean/Obligations/Cell.lean

@@ -0,0 +1,159 @@
+import Mathlib.Order.Interval.Set.Basic
+
+/-!
+The endpoint operation of `src/lattice/forms.ts`, not a replacement algebra.
+`apiLeq` preserves its empty-interval convention. It is a preorder on raw
+endpoint pairs, not an antisymmetric order. The observable semilattice below
+identifies exactly equal interval meanings; no TypeScript representation changes.
+
+The numerical bridge is restricted to values with a total order (in the executable
+vector: finite integers). This does not assert a LinearOrder on IEEE-754 NaN.
+-/
+namespace Obligations
+
+structure Cell (α : Type*) where
+  lo : α
+  hi : α
+  deriving DecidableEq
+
+namespace Cell
+variable {α : Type*} [LinearOrder α]
+
+def meet (a b : Cell α) : Cell α := ⟨max a.lo b.lo, min a.hi b.hi⟩
+
+theorem meet_comm (a b : Cell α) : meet a b = meet b a := by
+  cases a; cases b
+  simp [meet, max_comm, min_comm]
+
+theorem meet_assoc (a b c : Cell α) : meet (meet a b) c = meet a (meet b c) := by
+  cases a; cases b; cases c
+  simp [meet, max_assoc, min_assoc]
+
+theorem meet_idem (a : Cell α) : meet a a = a := by
+  cases a
+  simp [meet]
+
+instance : Min (Cell α) := ⟨meet⟩
+
+/-- Its induced endpoint order is not the API's empty-interval preorder. -/
+def endpointSemilattice : SemilatticeInf (Cell α) :=
+  SemilatticeInf.mk' meet_comm meet_assoc meet_idem
+
+/-- Literal branch order of the existing interval `leq`. -/
+def apiLeq (a b : Cell α) : Prop :=
+  if a.hi < a.lo then True
+  else if b.hi < b.lo then False
+  else b.lo ≤ a.lo ∧ a.hi ≤ b.hi
+
+instance (a b : Cell α) : Decidable (apiLeq a b) := by
+  unfold apiLeq
+  infer_instance
+
+def meaning (a : Cell α) : Set α := Set.Icc a.lo a.hi
+
+theorem meaning_meet (a b : Cell α) :
+    meaning (meet a b) = meaning a ∩ meaning b := by
+  apply Set.ext
+  intro x
+  simp only [meaning, meet, Set.mem_Icc, Set.mem_inter_iff]
+  constructor
+  · intro h
+    exact ⟨⟨le_trans (le_max_left _ _) h.1, le_trans h.2 (min_le_left _ _)⟩,
+      ⟨le_trans (le_max_right _ _) h.1, le_trans h.2 (min_le_right _ _)⟩⟩
+  · intro h
+    exact ⟨max_le h.1.1 h.2.1, le_min h.1.2 h.2.2⟩
+
+theorem apiLeq_iff_subset (a b : Cell α) :
+    apiLeq a b ↔ meaning a ⊆ meaning b := by
+  by_cases ha : a.hi < a.lo
+  · simp [apiLeq, ha, meaning, Set.Icc_eq_empty_of_lt ha]
+  · have hab : a.lo ≤ a.hi := le_of_not_gt ha
+    by_cases hb : b.hi < b.lo
+    · simp only [apiLeq, ha, hb, if_false, if_true]
+      constructor
+      · intro h; exact False.elim h
+      · intro h
+        have hx := h (show a.lo ∈ meaning a from ⟨le_rfl, hab⟩)
+        exact (not_le_of_gt hb) (le_trans hx.1 hx.2)
+    · simpa [apiLeq, ha, hb, meaning] using
+        (Set.Icc_subset_Icc_iff hab).symm
+
+theorem meet_narrows_left (a b : Cell α) : apiLeq (meet a b) a := by
+  rw [apiLeq_iff_subset, meaning_meet]
+  exact Set.inter_subset_left
+
+theorem meet_narrows_right (a b : Cell α) : apiLeq (meet a b) b := by
+  rw [apiLeq_iff_subset, meaning_meet]
+  exact Set.inter_subset_right
+
+theorem apiLeq_refl (a : Cell α) : apiLeq a a :=
+  (apiLeq_iff_subset a a).mpr (Set.Subset.refl _)
+
+theorem apiLeq_trans {a b c : Cell α} (hab : apiLeq a b) (hbc : apiLeq b c) :
+    apiLeq a c :=
+  (apiLeq_iff_subset a c).mpr
+    (Set.Subset.trans ((apiLeq_iff_subset a b).mp hab) ((apiLeq_iff_subset b c).mp hbc))
+
+theorem mutually_narrows_iff (a b : Cell α) :
+    (apiLeq a b ∧ apiLeq b a) ↔ meaning a = meaning b := by
+  rw [apiLeq_iff_subset, apiLeq_iff_subset]
+  exact ⟨fun h => Set.Subset.antisymm h.1 h.2, fun h => ⟨h.subset, h.symm.subset⟩⟩
+
+/-- Observable interval classes, represented by their meaning, not new stored cells. -/
+def SemanticCell (α : Type*) [LinearOrder α] :=
+  {s : Set α // ∃ c : Cell α, meaning c = s}
+
+instance : Min (SemanticCell α) where
+  min a b := ⟨a.val ∩ b.val, by
+    rcases a.property with ⟨ca, hca⟩
+    rcases b.property with ⟨cb, hcb⟩
+    exact ⟨meet ca cb, by rw [meaning_meet, hca, hcb]⟩⟩
+
+instance : SemilatticeInf (SemanticCell α) :=
+  Function.Injective.semilatticeInf Subtype.val Subtype.val_injective (fun _ _ => rfl)
+
+def observe (a : Cell α) : SemanticCell α := ⟨meaning a, a, rfl⟩
+
+theorem observe_meet (a b : Cell α) :
+    observe (meet a b) = observe a ⊓ observe b :=
+  Subtype.ext (meaning_meet a b)
+
+theorem observe_order (a b : Cell α) : observe a ≤ observe b ↔ apiLeq a b :=
+  (apiLeq_iff_subset a b).symm
+
+/-- Distinct raw empty intervals are equivalent in the published API. -/
+theorem crossed_pairs_not_antisymmetric :
+    let a : Cell Int := ⟨5, 3⟩
+    let b : Cell Int := ⟨8, 6⟩
+    apiLeq a b ∧ apiLeq b a ∧ a ≠ b := by decide
+
+/-- A duplicate accumulated restriction does not change a merge result. -/
+theorem duplicate_delivery (a b : Cell α) : meet (meet a b) b = meet a b := by
+  rw [meet_assoc, meet_idem]
+
+/-- Replay order of three accumulated restrictions does not change the result. -/
+theorem reordered_delivery (a b c : Cell α) :
+    meet (meet a b) c = meet (meet c a) b := by
+  rw [meet_assoc, meet_comm b c, ← meet_assoc, meet_comm a c]
+
+def fold (seed : Cell α) (claims : List (Cell α)) : Cell α :=
+  claims.foldl meet seed
+
+/-- Any finite replay permutation agrees, under the same starting restriction. -/
+theorem permutation_invariant {xs ys : List (Cell α)} (h : xs.Perm ys)
+    (seed : Cell α) : fold seed xs = fold seed ys := by
+  induction h generalizing seed with
+  | nil => rfl
+  | cons a h ih => exact ih (meet seed a)
+  | swap a b xs =>
+    have hc : meet (meet seed b) a = meet (meet seed a) b := by
+      rw [meet_assoc, meet_comm b a, ← meet_assoc]
+    simp only [fold, List.foldl_cons, hc]
+  | trans h₁ h₂ ih₁ ih₂ => exact (ih₁ seed).trans (ih₂ seed)
+
+theorem duplicate_in_replay (seed a : Cell α) (xs : List (Cell α)) :
+    fold seed (a :: a :: xs) = fold seed (a :: xs) := by
+  simp only [fold, List.foldl_cons, duplicate_delivery]
+
+end Cell
+end Obligations

package/proofs/lean/Obligations/HellyComb.lean

@@ -0,0 +1,19 @@
+/- Finite nonconvex subsets, using only Lean's kernel and core lists.
+   No change to the interval theorem T38 or to the algebra's representation. -/
+namespace Obligations.HellyComb
+
+def a : List Nat := [0, 1]
+def b : List Nat := [1, 2]
+def c : List Nat := [0, 2]
+def inter (s t : List Nat) : List Nat := s.filter (fun x => t.contains x)
+def triple : List Nat := inter (inter a b) c
+
+theorem pairwise_nonempty :
+    inter a b = [1] ∧ inter a c = [0] ∧ inter b c = [2] := by decide
+
+theorem triple_empty : triple = [] := by decide
+
+theorem c_has_a_hole : c.contains 0 = true ∧ c.contains 2 = true ∧
+    c.contains 1 = false := by decide
+
+end Obligations.HellyComb

package/proofs/lineage-ceiling.json

@@ -0,0 +1,41 @@
+{
+  "id":"lineage/symmetric-markov-ceiling",
+  "classification":"conditional law with distinguishing finite vectors; Shannon argument cited, not Lean-formalized",
+  "source":"samples/laws/lineage-ceiling/yes.json",
+  "statement":"For finite n>=2, uniform truth X, an n-ary symmetric channel X->Z with error c in [0,1], and X->Z->Y^K->A, I(X;A)<=I(X;Z)=log2(n)-h2(c)-c*log2(n-1).",
+  "conditions":[
+    "The reports have a joint kernel conditional on Z alone; pairwise conditional independence is neither required for this bound nor a substitute for the Markov condition.",
+    "Aggregation uses reports alone, or randomness conditionally independent of X given the reports. A revealed channel-error/cause indicator, side channel or truth probe is extra input and must be included before applying DPI.",
+    "c is the declared crossover probability of this symmetric channel; neither unanimity nor a shared-cause frequency identifies it without a model.",
+    "No private p, hypothesis of M/3, or governance model M/4 is changed. The old always-wrong active cause with private p>0 is a different joint law.",
+    "Both c=0 and c=1 are permitted. c=(n-1)/n gives zero information; for binary c=1 the channel is an invertible complement and gives one bit. This quantity is not monotone over all c in [0,1]."
+  ],
+  "proofChain":[
+    {"id":"symmetric-output","argument":"Uniform X and the symmetric kernel imply uniform Z. The posterior of X given Z has masses 1-c and c/(n-1) on the other symbols, so H(X|Z)=h2(c)+c*log2(n-1), with 0 log 0=0."},
+    {"id":"data-processing","argument":"The declared Markov kernels imply I(X;Y^K|Z)=0 and I(X;A|Y^K)=0. The chain rule and nonnegative conditional mutual information give I(X;A)<=I(X;Y^K)<=I(X;Z). No independence among reports given Z is needed for this inequality.","reference":"Duchi, Proposition 2.1.9"},
+    {"id":"existing-instance","argument":"Published capacityP0 computes this expression as mutual information for single-dominant-factor@1 at private p=0, for every positive K. In that instance all reports are copies of Z, so equality is already exact; a finite-copy vector is not a new discovery."},
+    {"id":"finite-approach","classification":"experiment with declared conditional-iid model","argument":"Compose the symmetric lineage channel with the published decisionInformation table for c=0, p=e and plurality-uniform-ties@1. Exact rational joint tables give a finite sequence of gaps to capacityP0. Under the separately declared fixed-parameter iid recovery hypothesis, consistency and finite-alphabet entropy continuity imply the limit; the finite sequence does not prove the limit."}
+  ],
+  "fanoBoundary":{
+    "known":"Fano gives H(X|Z)<=h2(P[X!=Z])+P[X!=Z]*log2(n-1). For uniform X this is a lower bound on I(X;Z), not the proposed upper bound.",
+    "equalityCondition":"The symmetric channel supplies equality in the entropy expression. A marginal error probability alone does not.",
+    "negative":"A binary uniform source with P(Z=1|X=0)=0 and P(Z=0|X=1)=1/2 has error 1/4 and I=0.311278124459..., larger than 1-h2(1/4)=0.188721875540...."
+  },
+  "relationToF1":{
+    "existingLaw":"law/thm-extremal",
+    "existingVectors":["vectors/laws/f1/path-witness.json","vectors/laws/f1/finite-arithmetic.json"],
+    "object":"F1 concerns deterministic partitions U,V of one uniformly weighted N-element universe, in the maintained refinement order.",
+    "quantity":"RI_H=H(U)+H(V)-H(join)-H(meet)=I(U;V)-H(G)=I(U;V|G), where join is the common refinement (U,V) and G is their common coarsening, a deterministic function of each.",
+    "bound":"RI_H<=log2(N)-2+2/N; N=1,2 have zero maximum. This is not I(truth;aggregate); N need not equal the truth alphabet n.",
+    "jointUse":"Apply F1 only when the partition/uniform-universe hypotheses hold. Apply the lineage ceiling only to a designated X and its declared Markov channel. If both models are supplied, both bounds may be written beside their own quantities; taking their minimum as a bound on either quantity is invalid.",
+    "separators":[
+      "Uniform binary truth with noiseless Z has I(X;Z)=1 while F1 on N=2 has maximum RI_H=0.",
+      "Let X,Z be independent uniform bits (c=1/2), and R independent uniform on four symbols. The path partitions of R have RI_H=1/2. Reports can ignore Z and output those two views of R, so X->Z->reports holds and I(X;reports)=0. On the full uniform 16-atom (X,Z,R) universe F1 still applies (c_16=2.125), but RI_H=1/2 exceeds the zero lineage ceiling."
+    ],
+    "notAdded":"No proof of F1 is redone; its existing path witness and public c_n are reused."
+  },
+  "literature":[
+    {"title":"Lecture Notes on Statistics and Information Theory","author":"John Duchi","url":"https://web.stanford.edu/class/stats311/lecture-notes.pdf","sections":["2.1.3, Proposition 2.1.9: data processing","Proposition 2.3.3: Fano"],"alreadyKnown":"DPI and Fano, including the direction of the inequalities.","addsHere":"Explicit lineage-channel conditions, reuse of the already published expression, and vectors separating truth information from partition residual. No new information-theory inequality or inference without truth is claimed."}
+  ],
+  "evidenceLimits":["No general Lean proof of Shannon DPI here.","Finite vectors do not enumerate arbitrary observation kernels.","No original browser simulation is recovered or authenticated.","Activation identification, sleeper bounds and all other excluded regions remain open."]
+}

package/proofs/m0-045/Obligations045/ConsensusGrid.lean

@@ -0,0 +1,72 @@
+import Std
+set_option maxRecDepth 10000
+set_option maxHeartbeats 8000000
+namespace Obligations045
+-- Finite closed-form calculation only. This file does not assert a limit theorem.
+def binom : Nat → Nat → Nat
+  | 0, 0 => 1
+  | 0, _ + 1 => 0
+  | _ + 1, 0 => 1
+  | n + 1, k + 1 => binom n k + binom n (k + 1)
+def configs : Nat → List (List Bool)
+  | 0 => [[]]
+  | k + 1 => (configs k).flatMap (fun xs => [false :: xs, true :: xs])
+def ones (xs : List Bool) : Nat := (xs.filter id).length
+-- p=P/20, c=C/20. Below/equal/above 1/2 encoded as 2/1/0.
+def loss2 (K P C m : Nat) : Nat :=
+  let lhs := 2 * (20 * C * m + (20-C) * P * K)
+  let rhs := 400 * K
+  if lhs < rhs then 2 else if lhs == rhs then 1 else 0
+def grouped (K P C : Nat) : Nat :=
+  ((List.range (K+1)).map (fun m =>
+    binom K m * P^m * (20-P)^(K-m) * loss2 K P C m)).sum
+def enumerated (K P C : Nat) : Nat :=
+  ((configs K).map (fun xs =>
+    P^(ones xs) * (20-P)^(K-ones xs) * loss2 K P C (ones xs))).sum
+def grid : List (Nat × Nat × Nat) :=
+  ([1,2,3,4] : List Nat).flatMap (fun K =>
+    (List.range 9).flatMap (fun i =>
+      (List.range 20).map (fun j => (K,11+i,1+j))))
+theorem grid_has_720_cases : grid.length = 720 := by decide
+theorem closed_form_matches_full_configurations :
+    ∀ x ∈ grid, grouped x.1 x.2.1 x.2.2 = enumerated x.1 x.2.1 x.2.2 := by decide
+theorem grid_probability_range :
+    ∀ x ∈ grid, grouped x.1 x.2.1 x.2.2 ≤ 2*20^x.1 := by decide
+-- p=3/4, c=1/2: two distinct K have the same 1/64 floor.
+theorem inverse_alias :
+    grouped 3 15 10 * (2*20^5) = grouped 5 15 10 * (2*20^3) := by decide
+-- For p=3/4,c=9/10 and counts summing to N, compare score with 17*N/36.
+def score (counts : List Nat) (zs : List Bool) : Nat :=
+  ((counts.zip zs).map (fun x => if x.2 then x.1 else 0)).sum
+def floorNumerator (counts : List Nat) : Nat :=
+  ((configs counts.length).map (fun zs =>
+    let lhs := 36 * score counts zs
+    let rhs := 17 * counts.sum
+    let factor := if lhs < rhs then 2 else if lhs == rhs then 1 else 0
+    3^(ones zs) * factor)).sum
+-- Denominator is 2*4^3=128 in each three-lineage case.
+theorem same_effective_participation_different_floor :
+    (1*1+4*4+4*4 : Nat) = 2*2+2*2+5*5 ∧
+    floorNumerator [1,4,4] = 20 ∧ floorNumerator [2,2,5] = 32 := by decide
+-- WF population N=5, initial counts [3,1,1]; all 21 descendant count states.
+def wfNumerator : Nat :=
+  ((List.range 6).map (fun a =>
+    ((List.range (6-a)).map (fun b =>
+      binom 5 a * binom (5-a) b * 3^a *
+        floorNumerator [a,b,5-a-b])).sum)).sum
+theorem wf_transition_normalized :
+    ((List.range 6).map (fun a =>
+      ((List.range (6-a)).map (fun b =>
+        binom 5 a * binom (5-a) b * 3^a)).sum)).sum = 5^5 := by decide
+theorem wf_floor_decreases_in_expectation :
+    floorNumerator [3,1,1] = 32 ∧ wfNumerator = 92440 ∧
+    wfNumerator < floorNumerator [3,1,1] * 5^5 := by decide
+end Obligations045
+#print axioms Obligations045.grid_has_720_cases
+#print axioms Obligations045.closed_form_matches_full_configurations
+#print axioms Obligations045.grid_probability_range
+#print axioms Obligations045.inverse_alias
+
+#print axioms Obligations045.same_effective_participation_different_floor
+#print axioms Obligations045.wf_transition_normalized
+#print axioms Obligations045.wf_floor_decreases_in_expectation

package/proofs/m0-045/Obligations045/M0Coincidence.lean

@@ -0,0 +1,39 @@
+import Mathlib.Data.Real.Basic
+import Mathlib.Tactic.Ring
+namespace Obligations045.M0Coincidence
+/-- Exact expectation over independent Bernoulli(p) latent lineages.
+    The recurrence keeps both branches and their actual probabilities. -/
+def expect (p : ℝ) : List ℝ → (ℝ → ℝ) → ℝ
+  | [], f => f 0
+  | w :: ws, f => (1-p)*expect p ws f + p*expect p ws (fun x => f (w+x))
+def squares (ws : List ℝ) : ℝ := (ws.map (fun w => w^2)).sum
+
+theorem expect_quadratic (p : ℝ) (ws : List ℝ) (a b d : ℝ) :
+    expect p ws (fun x => a*x^2+b*x+d) =
+    a*(p^2*ws.sum^2+p*(1-p)*squares ws)+b*p*ws.sum+d := by
+  induction ws generalizing a b d with
+  | nil => simp [expect, squares]
+  | cons w ws ih =>
+    have hf : (fun x : ℝ => a*(w+x)^2+b*(w+x)+d) =
+        (fun x => a*x^2+(2*a*w+b)*x+(a*w^2+b*w+d)) := by
+      funext x
+      ring
+    simp only [expect, hf]
+    rw [ih, ih]
+    simp only [List.sum_cons, squares, List.map_cons]
+    ring
+
+theorem pair_coincidence (p c : ℝ) (ws : List ℝ) (hw : ws.sum = 1) :
+    expect p ws (fun x => ((1-c)*p+c*x)^2+(1-((1-c)*p+c*x))^2) =
+    p^2+(1-p)^2+2*c^2*p*(1-p)*squares ws := by
+  have hf : (fun x : ℝ => ((1-c)*p+c*x)^2+(1-((1-c)*p+c*x))^2) =
+      (fun x => (2*c^2)*x^2+(2*c*(2*(1-c)*p-1))*x+
+        (((1-c)*p)^2+(1-(1-c)*p)^2)) := by
+    funext x
+    ring
+  rw [hf, expect_quadratic, hw]
+  ring
+
+theorem triple_redundant (q : ℝ) :
+    q^3+(1-q)^3 = (3*(q^2+(1-q)^2)-1)/2 := by ring
+end Obligations045.M0Coincidence

package/proofs/m0-045/Obligations045/M0Diagonal.lean

@@ -0,0 +1,18 @@
+import Obligations045.ConsensusGrid
+set_option maxRecDepth 10000
+set_option maxHeartbeats 8000000
+namespace Obligations045.Diagonal
+/-- Finite diagonal vector only: K=1,p=3/4,c=1/3,w=[1].
+    A=false gives q=1/2, A=true gives q=5/6.
+    No general CLT or diagonal-limit theorem is declared in this file. -/
+def loss2 (b N : Nat) : Nat := if 2*b < N then 2 else if 2*b == N then 1 else 0
+def unbiasedNumerator (N : Nat) : Nat :=
+  ((List.range (N+1)).map (fun b => Obligations045.binom N b * loss2 b N)).sum
+def cases : List Nat := [1,2,3,4,5,6,7,8,9,10,11,12]
+theorem unbiased_diagonal_vector : ∀ N ∈ cases, unbiasedNumerator N = 2^N := by decide
+-- Total error numerator has denominator 8*6^N; the target floor is 1/8.
+def errorNumerator (N : Nat) : Nat :=
+  6^N+3*((List.range (N+1)).map (fun b =>
+    Obligations045.binom N b * 5^b * loss2 b N)).sum
+#eval cases.map (fun N => (N,errorNumerator N,8*6^N))
+end Obligations045.Diagonal

package/proofs/m0-045/Obligations045/M0Limit.lean

@@ -0,0 +1,134 @@
+import Mathlib.Topology.Instances.Real.Lemmas
+import Mathlib.Data.Real.Archimedean
+import Mathlib.Topology.Algebra.Order.Field
+import Mathlib.Algebra.Order.Floor.Ring
+import Mathlib.Tactic.Linarith
+import Mathlib.Tactic.Ring
+import Mathlib.Tactic.NormNum
+import Mathlib.Tactic.Positivity
+
+open scoped BigOperators
+open Filter Topology
+noncomputable section
+open Classical
+namespace Obligations045.M0
+
+/-- Declared binary M0 domain. This structure contains no limiting-probability axiom. -/
+structure Domain where
+  K : ℕ
+  K_pos : 0 < K
+  p : ℝ
+  c : ℝ
+  p_half : (1:ℝ)/2 < p
+  p_lt_one : p < 1
+  c_nonneg : 0 ≤ c
+  c_lt_one : c < 1
+  w : ℕ → ℝ
+  w_nonneg : ∀ i, 0 ≤ w i
+  weights_sum : ∑ i ∈ Finset.range K, w i = 1
+
+def cumulative (w : ℕ → ℝ) (i : ℕ) : ℝ := ∑ j ∈ Finset.range i, w j
+
+def allocation (w : ℕ → ℝ) (N i : ℕ) : ℕ :=
+  ⌊(N:ℝ) * cumulative w (i+1)⌋₊ - ⌊(N:ℝ) * cumulative w i⌋₊
+
+theorem prefix_succ (w : ℕ → ℝ) (i : ℕ) :
+    cumulative w (i+1) = cumulative w i + w i := by simp [cumulative, Finset.sum_range_succ]
+
+theorem prefix_monotone (w : ℕ → ℝ) (hw : ∀ i, 0 ≤ w i) : Monotone (cumulative w) := by
+  apply monotone_nat_of_le_succ
+  intro i
+  rw [prefix_succ]
+  exact le_add_of_nonneg_right (hw i)
+
+theorem allocation_sum (M : Domain) (N : ℕ) :
+    ∑ i ∈ Finset.range M.K, allocation M.w N i = N := by
+  let f : ℕ → ℕ := fun i => ⌊(N:ℝ) * cumulative M.w i⌋₊
+  have hf : Monotone f := fun i j hij =>
+    Nat.floor_mono (mul_le_mul_of_nonneg_left (prefix_monotone M.w M.w_nonneg hij) (by positivity))
+  change ∑ i ∈ Finset.range M.K, (f (i+1) - f i) = N
+  rw [Finset.sum_range_tsub hf]
+  simp [f, cumulative, M.weights_sum]
+
+theorem allocation_discrepancy (M : Domain) (N i : ℕ) :
+    -1 < (allocation M.w N i : ℝ) - (N:ℝ)*M.w i ∧
+    (allocation M.w N i : ℝ) - (N:ℝ)*M.w i < 1 := by
+  have hpre : 0 ≤ cumulative M.w i := Finset.sum_nonneg (fun j _ => M.w_nonneg j)
+  have hnext : 0 ≤ cumulative M.w (i+1) := Finset.sum_nonneg (fun j _ => M.w_nonneg j)
+  have hm : ⌊(N:ℝ)*cumulative M.w i⌋₊ ≤ ⌊(N:ℝ)*cumulative M.w (i+1)⌋₊ :=
+    Nat.floor_mono (mul_le_mul_of_nonneg_left (prefix_monotone M.w M.w_nonneg (Nat.le_succ i)) (by positivity))
+  have a := Nat.floor_le (mul_nonneg (Nat.cast_nonneg N) hpre)
+  have b := Nat.lt_floor_add_one ((N:ℝ)*cumulative M.w i)
+  have c := Nat.floor_le (mul_nonneg (Nat.cast_nonneg N) hnext)
+  have d := Nat.lt_floor_add_one ((N:ℝ)*cumulative M.w (i+1))
+  have hs := prefix_succ M.w i
+  simp only [allocation, Nat.cast_sub hm]
+  constructor <;> nlinarith
+
+def q (M : Domain) (a : Bool) : ℝ := (1-M.c)*M.p + if a then M.c else 0
+
+theorem q_pos (M : Domain) (a : Bool) : 0 < q M a := by
+  have hp : 0 < M.p := by linarith [M.p_half]
+  cases a <;> simp only [q, Bool.false_eq_true, ite_false, add_zero, ite_true] <;>
+    nlinarith [M.c_nonneg, M.c_lt_one]
+
+theorem q_lt_one (M : Domain) (a : Bool) : q M a < 1 := by
+  have hp : 0 < M.p := by linarith [M.p_half]
+  cases a <;> simp only [q, Bool.false_eq_true, ite_false, add_zero, ite_true] <;>
+    nlinarith [M.c_nonneg, M.c_lt_one, M.p_lt_one]
+
+def score (M : Domain) (a : Fin M.K → Bool) : ℝ :=
+  ∑ i : Fin M.K, M.w i * q M (a i)
+
+def latentMass (M : Domain) (a : Fin M.K → Bool) : ℝ :=
+  ∏ i : Fin M.K, if a i then M.p else 1-M.p
+
+def fairLoss (correct total : ℕ) : ℝ :=
+  if 2*correct < total then 1 else if 2*correct = total then 1/2 else 0
+
+/-- The exact finite conditional error, using independent binomial counts in each lineage. -/
+noncomputable def conditionalError (M : Domain) (N : ℕ) (a : Fin M.K → Bool) : ℝ :=
+  ∑ x : (i : Fin M.K) → Fin (allocation M.w N i + 1),
+    (∏ i : Fin M.K,
+      (Nat.choose (allocation M.w N i) (x i) : ℝ) *
+      q M (a i) ^ (x i : ℕ) *
+      (1-q M (a i)) ^ (allocation M.w N i - (x i : ℕ))) *
+    fairLoss (∑ i : Fin M.K, (x i : ℕ)) N
+
+noncomputable def error (M : Domain) (N : ℕ) : ℝ :=
+  ∑ a : Fin M.K → Bool, latentMass M a * conditionalError M N a
+
+noncomputable def limitingLoss (s : ℝ) : ℝ :=
+  if s < 1/2 then 1 else if s = 1/2 then 1/2 else 0
+
+noncomputable def floor (M : Domain) : ℝ :=
+  ∑ a : Fin M.K → Bool, latentMass M a * limitingLoss (score M a)
+
+/-- Explicit proof obligations, NOT assumptions hidden inside the generative model.
+    The strict branches require concentration. The equality branch requires a CLT.
+    This certificate has no constructed instance in this project. -/
+def ConditionalTailLimits (M : Domain) : Prop :=
+  (∀ a, score M a < 1/2 → Tendsto (fun N => conditionalError M N a) atTop (𝓝 1)) ∧
+  (∀ a, 1/2 < score M a → Tendsto (fun N => conditionalError M N a) atTop (𝓝 0)) ∧
+  (∀ a, score M a = 1/2 → Tendsto (fun N => conditionalError M N a) atTop (𝓝 (1/2)))
+
+/-- Kernel checked finite-mixture transfer. This is intentionally conditional;
+    it does not claim that ConditionalTailLimits follows from Domain. -/
+theorem limit_of_conditional_tail_limits (M : Domain) (h : ConditionalTailLimits M) :
+    Tendsto (error M) atTop (𝓝 (floor M)) := by
+  have hcase : ∀ a, Tendsto (fun N => conditionalError M N a) atTop
+      (𝓝 (limitingLoss (score M a))) := by
+    intro a
+    by_cases hl : score M a < 1/2
+    · rw [limitingLoss, if_pos hl]
+      exact h.1 a hl
+    · by_cases he : score M a = 1/2
+      · rw [limitingLoss, if_neg hl, if_pos he]
+        exact h.2.2 a he
+      · have hg : 1/2 < score M a := lt_of_le_of_ne (le_of_not_gt hl) (Ne.symm he)
+        rw [limitingLoss, if_neg hl, if_neg he]
+        exact h.2.1 a hg
+  unfold error floor
+  exact tendsto_finset_sum _ (fun a _ => tendsto_const_nhds.mul (hcase a))
+
+end Obligations045.M0