% Oai265-B.tex
% Self-contained pdfLaTeX source.
% No external bibliography, figures, data files, or shell escape required.
% Suggested build:
%   pdflatex -interaction=nonstopmode -halt-on-error Oai265-B.tex
%   pdflatex -interaction=nonstopmode -halt-on-error Oai265-B.tex
%
% Version 2 incorporates the user-supplied execution report
% "summary (30).txt" for the version-1 supplementary script.
% That execution is reported, not independently reproduced here.
% The version-2 listing adds diagnostic logging and optional tests.
% Execution of those additions is not asserted.
% No LaTeX compilation or laboratory execution is asserted.

\documentclass[11pt]{article}

\usepackage[T1]{fontenc}
\usepackage[utf8]{inputenc}
\usepackage{lmodern}
\usepackage[margin=1in]{geometry}
\usepackage{amsmath,amssymb,amsthm,mathtools}
\usepackage{array,booktabs,tabularx}
\usepackage{enumitem}
\usepackage{microtype}
\usepackage{listings}
\usepackage[hidelinks]{hyperref}

\hypersetup{
  pdftitle={Oai265-B: Reference-Preserving Quantum-Memory Certification},
  pdfsubject={Finite-sample certification with a supplied script execution report}
}

\setlength{\emergencystretch}{3em}
\setlist[enumerate]{leftmargin=*,itemsep=3pt}
\setlist[itemize]{leftmargin=*,itemsep=3pt}
\newcolumntype{Y}{>{\raggedright\arraybackslash}X}

\newtheorem{theorem}{Theorem}[section]
\newtheorem{proposition}[theorem]{Proposition}
\newtheorem{lemma}[theorem]{Lemma}
\newtheorem{corollary}[theorem]{Corollary}
\theoremstyle{definition}
\newtheorem{definition}[theorem]{Definition}
\newtheorem{assumption}[theorem]{Assumption}
\theoremstyle{remark}
\newtheorem{remark}[theorem]{Remark}

\DeclareMathOperator{\Tr}{Tr}
\DeclareMathOperator{\id}{id}
\DeclareMathOperator{\Ad}{Ad}
\DeclareMathOperator{\rank}{rank}
\DeclareMathOperator{\supp}{supp}

\newcommand{\ket}[1]{\lvert #1\rangle}
\newcommand{\bra}[1]{\langle #1\rvert}
\newcommand{\kb}[2]{\lvert #1\rangle\langle #2\rvert}
\newcommand{\norm}[1]{\left\lVert #1\right\rVert}
\newcommand{\abs}[1]{\left\lvert #1\right\rvert}
\newcommand{\dtr}{d_{\mathrm{tr}}}
\newcommand{\ddia}{d_{\diamond}}
\newcommand{\epsrec}{\varepsilon_{\mathrm{rec}}}
\newcommand{\Nchan}{\mathcal N}
\newcommand{\Dchan}{\mathcal D}
\newcommand{\Echan}{\mathcal E}
\newcommand{\Trep}[1]{\mathcal T_{#1}}
\newcommand{\sourceid}[1]{\texttt{\detokenize{#1}}}

\lstset{
  language=Python,
  basicstyle=\ttfamily\footnotesize,
  columns=fullflexible,
  keepspaces=true,
  showstringspaces=false,
  breaklines=true,
  frame=single,
  numbers=left,
  numberstyle=\tiny,
  numbersep=6pt
}

\title{\textbf{Oai265-B}\\[3pt]
Reference-Preserving Quantum-Memory Certification\\
from Measured Correlations}
\author{}
\date{Version 2 --- 12 October 2026}

\begin{document}
\maketitle

\begin{abstract}
We give a finite-sample, calibration-aware protocol for certifying a
specified deterministic quantum-memory decoder. A logical Bell input
and the three correlations \(X\otimes X\), \(Y\otimes Y\), and
\(Z\otimes Z\) produce confidence bounds
\(F_L\le F_e\le F_U\) on the normalized logical Choi overlap.
Under the stated contract, with coverage at least \(1-\alpha\), an
identified target qubit channel has half-diamond error in
\[
 \left[
 \max\{0,1-F_U-b\},
 \ \min\{1,2\sqrt{1-F_L}+b\}
 \right],
\]
where \(b\) is a separately justified half-diamond transfer allowance.
For direct certification of the implemented laboratory channel,
\(b=0\). The upper bound controls every input and untouched reference;
it does not establish decoder optimality.

We prove bounded-score Hoeffding and exact binomial procedures,
calibration-bias conversions, complete failure accounting, and
channel-confidence-region refinements. A supplied execution report
for the supplementary version-1 script records coverage of all
140 simulated datasets: 20 repetitions for each of seven channels,
with 40 shots per setting. It reports zero invalid acceptances at
error threshold \(0.1\). We show, however, that this sample count
cannot accept that threshold even on perfect data; the absence of
invalid acceptances therefore does not exercise an informative
high-accuracy acceptance regime. The reported identity-channel upper
endpoint is approximately \(0.8226864813\), correcting a numerical
interpretation in the report. Exact rational example endpoints are
archived in the manuscript. The execution is supplied evidence,
not an independent rerun. No laboratory calibration, laboratory data,
device-independent guarantee, or gravitational identification is
claimed.
\end{abstract}

\paragraph{Keywords.}
Quantum memory; reference preservation; Bell correlations;
normalized Choi state; diamond distance; finite confidence;
calibration; deterministic decoding; simulation audit.

\section{Question, contribution, and corrections}
\label{sec:introduction}

Oai265-A separated selected output entropy from reference-preserving
recovery \cite{Oai265A}. The present question is operational:
\begin{quote}
Given a specified memory, a fixed implemented decoder, complete
attempted-run records, and calibrated preparation and measurement,
what finite-confidence statement can be made about arbitrary-input
quantum recovery?
\end{quote}

Direct fidelity estimation, quantum process certification, channel
distances, and their statistical foundations are established subjects
\cite{KlieschRoth,FlammiaLiu,DaSilvaEtAl,Watrous}.
Our contribution is a self-contained protocol and error budget
assembled for this particular qubit-memory task.
The Choi conversion and diamond-norm interpretation are not claimed
as new.

The supplied Cheung manuscripts provide documentary interfaces:
En07-C distinguishes selected diagnostics from complete channels;
Hawk04-B gives dimension-explicit decoder certificates;
En02-B/C retain all decoder branches; and En01-C separates
complete-record statistics from calibration coverage
\cite{CheungEn07C,CheungHawk04B,CheungEn02B,CheungEn02C,CheungEn01C}.
Their model-specific results are comparisons, not unprovided premises
of the proofs below.

\subsection{Corrections retained from version 1}

\begin{enumerate}
\item \textbf{Pure-target trace distance is an inequality.}
For a generally mixed state \(\rho\) and rank-one projector \(P\),
\[
 1-\Tr(P\rho)\le\dtr(\rho,P)\le\sqrt{1-\Tr(P\rho)}.
\]
The upper inequality is not generally an equality.
It is an equality when both states are pure.

\item \textbf{Replacement benchmarks depend on the decoder task.}
A qubit replacement channel has optimal recovery error \(3/4\).
A specified decoder returning a fixed pure state can have error \(1\).

\item \textbf{Confidence is a repeated-experiment guarantee.}
The theorem bounds the probability of an invalid certificate.
It does not assign a posterior probability to a channel after
observing a particular dataset.

\item \textbf{The reference and tested channel must be identified.}
An uncalibrated reference operation can compensate a memory error.
Preparation, reference isolation, measurement, stationarity, and
failure accounting are part of the contract.
\end{enumerate}

\subsection{Changes in version 2}

The user-supplied report \sourceid{summary (30).txt} is incorporated as
a reported execution of the version-1 supplementary script
\cite{ExecutionReport}. This revision:
\begin{enumerate}
\item records the parameters, reported coverage counts, and exact
first-repetition certificate endpoints;
\item corrects the identity upper-endpoint approximation from
``approximately \(0.8225\)'' to approximately \(0.8226864813\);
\item proves that no dataset at the reported sample count can satisfy
the \(0.1\) acceptance threshold;
\item distinguishes allowed statistical noncoverage from numerical
bracketing errors and from failure of a coverage theorem;
\item supplies a diagnostic reporter and optional threshold and
arithmetic tests, without asserting execution of those additions.
\end{enumerate}

\section{Certification contract and complete experiment}
\label{sec:contract}

All spaces in the primary protocol are finite dimensional.
For a Hilbert space \(H\), \(\mathcal B(H)\) denotes its matrix algebra.
A channel is completely positive and trace preserving, abbreviated
CPTP.

Let \(C\cong\mathbb C^2\) be the logical input, \(R\) the accessible
memory output, and \(C'\cong C\) the returned logical output.
The identification \(C'\cong C\), including its Pauli frame, is fixed
before validation.

Let
\[
 \Nchan_t:\mathcal B(C)\longrightarrow\mathcal B(R)
\]
include the declared encoding, storage, correction, and accessible
collection operations. Let
\[
 \Dchan:\mathcal B(R)\longrightarrow\mathcal B(C')
\]
be the implemented deterministic decoder.
The tested logical channel is
\begin{equation}
 \Echan=\Dchan\Nchan_t,
 \qquad
 e(\Echan)=\ddia(\Echan,\id_C)
          =\frac12\norm{\Echan-\id_C}_{\diamond}.
 \label{eq:target}
\end{equation}
The channel ends before the destructive certification analyzer.
The analyzer is not part of the returned quantum-memory task.

We use
\[
 \dtr(\rho,\sigma)=\frac12\norm{\rho-\sigma}_1,
 \qquad
 \ddia(\Phi,\Psi)=\frac12\norm{\Phi-\Psi}_{\diamond}.
\]
For any finite untouched reference \(A\), input state \(\omega_{AC}\),
and joint output measurement, \(e(\Echan)\) bounds the trace distance,
and hence the total variation distance of outcome laws, between
\[
 (\id_A\otimes\Echan)(\omega_{AC})
 \quad\text{and}\quad
 \omega_{AC}.
\]

\begin{definition}[Predeclared certification contract]
\label{def:contract}
Before validation data are collected, specify:
\begin{enumerate}
\item input and output dimensions, basis identifications, Pauli frame,
storage duration, and calendar-time window;
\item operations included in \(\Nchan_t\), the implemented decoder,
all branches, and the output on every failure branch;
\item a fixed ancillary preparation and reset procedure sufficient
to identify a logical CPTP channel, rather than a state-dependent
system--environment assignment;
\item the reference \(Q\cong C\), its isolation or calibrated
disturbance, and any joint reference--device cross-talk allowance;
\item preparation and measurement calibration allowances and their
simultaneous coverage probability;
\item the repetition model, sample counts, setting selection,
optional-stopping rule if any, and permitted drift;
\item the complete outcome alphabet, including loss, leakage,
unavailable readout, and heralded failure;
\item the error threshold \(\varepsilon\), total risk \(\alpha\),
and exact acceptance rule.
\end{enumerate}
A decoder learned from training data is frozen before primary
validation. Conditional on the training and calibration record,
the validation contract must hold uniformly.
\end{definition}

\subsection{Optional transfer to a distinct target channel}

A separately identified target channel \(\Echan_\star\) may obey
\begin{equation}
 \ddia(\Echan_\star,\Echan)\le b.
 \label{eq:transfer}
\end{equation}
Both channels must have the same identified logical input and output.
Direct laboratory certification sets \(b=0\).

The allowance \(b\) is already in half-diamond units.
It is added outside the square root and is not multiplied by the
input dimension, as in the specified-decoder convention of
Hawk04-B \cite[\sourceid{thm:certificate}]{CheungHawk04B}.

If a modeled decoder differs from the implemented decoder, that
difference requires a converted channel allowance.
Errors already inside the tested channel must not be charged again
as calibration errors.

\subsection{Complete deterministic branch accounting}

Suppose the device produces an instrument \(\{\mathcal M_z\}_z\),
where each \(\mathcal M_z\) is completely positive and
\(\sum_z\mathcal M_z\) is trace preserving.
Let \(D_z\) be a declared CPTP output operation on branch \(z\).
Then
\begin{equation}
 \Echan(X)=\sum_z D_z\mathcal M_z(X)
 \label{eq:branchsum}
\end{equation}
is the deterministic logical channel.

\begin{lemma}[Complete branches define the tested channel]
\label{lem:branches}
Equation~\eqref{eq:branchsum} is CPTP.
For device Kraus path maps \(K_{zh}\), completeness is
\[
 \sum_{z,h}K_{zh}^\dagger K_{zh}=I_C.
\]
A successful branch alone need not be trace preserving.
\end{lemma}

\begin{proof}
Compositions and sums preserve complete positivity.
Trace preservation follows from trace preservation of every \(D_z\)
and of \(\sum_z\mathcal M_z\).
The Kraus identity is the trace-preservation condition for the
complete instrument. Selecting only some branches generally removes
terms from this identity.
\end{proof}

This is the branch discipline used in Landmark I and En02-B/C
\cite{CheungI,CheungEn02B,CheungEn02C}.
Destructive readout is an analyzer or instrument component; naming
it ``Enter'' does not make it a decoder.

\subsection{Three-setting measurement specification}

Prepare
\[
 \ket{\Phi_2}_{QC}
 =\frac{\ket{00}+\ket{11}}{\sqrt2},
 \qquad P_2=\kb{\Phi_2}{\Phi_2}.
\]
Only \(C\) enters the memory and decoder.
Ideally measure the same Pauli operator on \(Q\) and \(C'\).

Set
\[
 A_x=X\otimes X,\quad A_y=Y\otimes Y,\quad A_z=Z\otimes Z,
 \qquad (s_x,s_y,s_z)=(1,-1,1).
\]
For local outcomes \(u,v\in\{-1,1\}\), let \(Z_j=uv\), and define
the oriented pass indicator
\[
 B_j=\frac{1+s_jZ_j}{2}.
\]

\begin{center}
\begin{tabular}{@{}llll@{}}
\toprule
Setting & Local measurements & Parity & Ideal pass condition\\
\midrule
\(x\)&\(X_Q,X_{C'}\)&\(uv\)&\(u=v\)\\
\(y\)&\(Y_Q,Y_{C'}\)&\(uv\)&\(u=-v\)\\
\(z\)&\(Z_Q,Z_{C'}\)&\(uv\)&\(u=v\)\\
\bottomrule
\end{tabular}
\end{center}

For bounded-score certification, every other complete outcome receives
a predeclared score in \([-1,1]\).
Scoring unavailable readout by zero requires a proved bias allowance.
No attempted trial is deleted.

Archive the attempt identifier, time, storage duration, decoder
version, setting, local labels, flags, fallback action, and score.
Settings must not change the pre-analyzer channel.
Choosing the analyzer setting after the output has returned is one
safeguard against setting-dependent device behavior.

\section{Standard finite-dimensional conversions}
\label{sec:conversions}

The required normalization-sensitive facts are proved locally.
They are established tools
\cite{KlieschRoth,FuchsVanDeGraaf,Watrous}.

For input dimension \(d\), define
\[
 \ket{\Phi_d}=\frac1{\sqrt d}\sum_{i=0}^{d-1}\ket{i,i},
 \quad P_d=\kb{\Phi_d}{\Phi_d},
 \quad J_\Phi=(\id_d\otimes\Phi)(P_d).
\]
For a channel, \(J_\Phi\) has trace one.

\begin{lemma}[Normalized Choi conversion]
\label{lem:choi}
For channels with common input dimension \(d\) and identified outputs,
\begin{equation}
 \dtr(J_\Phi,J_\Psi)
 \le\ddia(\Phi,\Psi)
 \le\min\{1,d\,\dtr(J_\Phi,J_\Psi)\}.
 \label{eq:choi}
\end{equation}
\end{lemma}

\begin{proof}
The Bell input proves the lower bound.
Put \(\Delta=\Phi-\Psi\).
For unit vectors \(u,v\) in an arbitrary reference space tensored
with the input, write
\[
 u=(A\otimes I)\ket{\Phi_d},\qquad
 v=(B\otimes I)\ket{\Phi_d},
 \qquad
 \Tr(A^\dagger A)=\Tr(B^\dagger B)=d.
\]
Hence \(\norm A_\infty,\norm B_\infty\le\sqrt d\), and
\[
 \norm{(\id\otimes\Delta)(\kb uv)}_1
 =
 \norm{(A\otimes I)J_\Delta(B^\dagger\otimes I)}_1
 \le d\norm{J_\Delta}_1.
\]
A singular-value decomposition extends this bound to arbitrary
trace-norm-one input operators and all reference dimensions.
Divide by two and use the channel-distance cap one.
\end{proof}

This is also the normalization used in En07-C and Em05-B
\cite{CheungEn07C,CheungEm05B}.
An unnormalized Choi matrix requires different factors.

\begin{lemma}[Overlap with a pure target]
\label{lem:pure}
For a state \(\rho\), unit vector \(\phi\), and \(P=\kb\phi\phi\),
let \(F=\Tr(P\rho)\). Then
\begin{equation}
 1-F\le\dtr(\rho,P)\le\sqrt{1-F}.
 \label{eq:pure}
\end{equation}
\end{lemma}

\begin{proof}
The effect \(P\) gives the lower bound.
Write \(\rho=\sum_kp_k\kb{\psi_k}{\psi_k}\).
Diagonalization on the span of \(\phi,\psi_k\) gives
\[
 \dtr(\kb{\psi_k}{\psi_k},P)
 =\sqrt{1-\abs{\langle\phi,\psi_k\rangle}^2}.
\]
Convexity of trace norm and concavity of square root imply
\[
 \dtr(\rho,P)
 \le\sum_kp_k\sqrt{1-\abs{\langle\phi,\psi_k\rangle}^2}
 \le\sqrt{1-F}.
\]
\end{proof}

For example, \(\rho=I_4/4\) and a Bell projector \(P\) give distance
\(3/4\), not \(\sqrt{3/4}\).

\begin{proposition}[Bell-overlap recovery bounds]
\label{prop:bellbounds}
For a \(d\)-dimensional logical channel, put
\(F_e=\Tr(P_dJ_\Echan)\). Then
\begin{equation}
 1-F_e\le e(\Echan)\le\min\{1,d\sqrt{1-F_e}\}.
 \label{eq:bellbounds}
\end{equation}
Under \eqref{eq:transfer},
\begin{equation}
 \max\{0,1-F_e-b\}
 \le e(\Echan_\star)
 \le\min\{1,d\sqrt{1-F_e}+b\}.
 \label{eq:transferbounds}
\end{equation}
\end{proposition}

\begin{proof}
Combine Lemmas~\ref{lem:choi} and \ref{lem:pure}.
The reverse triangle inequality gives
\(\abs{e(\Echan_\star)-e(\Echan)}\le b\).
\end{proof}

\begin{proposition}[Three correlations give the overlap]
\label{prop:three}
For a qubit channel,
\begin{equation}
 P_2=\frac{I_4+A_x-A_y+A_z}{4},
 \qquad
 F_e=\frac{1+c_x-c_y+c_z}{4},
 \qquad c_j=\Tr(A_jJ_\Echan).
 \label{eq:three}
\end{equation}
\end{proposition}

\begin{proof}
Expand the Bell projector in the Pauli basis and trace against
\(J_\Echan\).
\end{proof}

\subsection{Implemented error versus optimal recovery}

Define
\[
 \epsrec(\Nchan)=
 \inf_{D\ {\rm CPTP}}\ddia(D\Nchan,\id_C).
\]
A fixed implemented decoder proves only
\begin{equation}
 \epsrec(\Nchan_t)\le e(\Dchan\Nchan_t).
 \label{eq:notoptimal}
\end{equation}
For a qubit, the decoder that ignores its input and prepares \(I_2/2\)
has error \(3/4\). Consequently an implemented-channel upper
certificate \(U\) gives
\[
 \epsrec(\Nchan_t)\le\min\{3/4,U\}.
\]
The \(3/4\) cap is not a cap on the original implemented decoder.

\section{A proved calibration budget}
\label{sec:calibration}

Calibration assumptions must be in units that enter the overlap or
channel bounds. Scalar entropy, energy, capacity, geometric, or
gate-resource estimates do not supply those units without a
conversion theorem.

Let \(\mathcal Z\) be the training and calibration record.
Suppose a calibration event \(G\) satisfies
\begin{equation}
 \Pr(G)\ge1-\beta.
 \label{eq:calcoverage}
\end{equation}
On \(G\), the announced bounds below hold simultaneously.
They may depend on \(\mathcal Z\), but validation concentration must
be valid conditional on that record.

\subsection{Common-state preparation and reference model}

Assume a fixed ancillary state independent of the logical-reference
input, and let the actual preparation obey
\[
 \dtr(\rho_{\rm p},P_2)\le\delta_{\rm p}.
\]
Let the reference-storage channel satisfy
\[
 \ddia(\mathcal R_Q,\id_Q)\le\delta_Q.
\]
For the actual joint pre-analyzer map \(\mathcal G\), assume
\[
 \ddia(\mathcal G,\mathcal R_Q\otimes\Echan)
 \le\delta_{\rm joint}.
\]
The last bound can charge cross-talk, but is not implied by local
reference measurements.

Set
\[
 \sigma=\mathcal G(\rho_{\rm p}),\qquad
 \delta=\min\{1,\delta_{\rm p}+\delta_Q+\delta_{\rm joint}\}.
\]
Contraction and the triangle inequality give
\begin{equation}
 \dtr(\sigma,J_\Echan)\le\delta.
 \label{eq:statecal}
\end{equation}

For each setting, let \(\{M_{j,o}\}_o\) be the actual complete POVM
and \(z_j(o)\in[-1,1]\) its predeclared score.
The score observable
\[
 B_j^{\rm obs}=\sum_o z_j(o)M_{j,o}
\]
has operator norm at most one.
Assume
\begin{equation}
 \norm{B_j^{\rm obs}-A_j}_\infty\le\mu_j,
 \qquad
 m_j=\Tr(B_j^{\rm obs}\sigma).
 \label{eq:meascal}
\end{equation}

\begin{lemma}[Common-state fidelity bias]
\label{lem:calibration}
Let
\[
 F_{\rm obs}=\frac{1+m_x-m_y+m_z}{4}.
\]
Then
\begin{equation}
 \abs{F_{\rm obs}-F_e}\le b_{\rm cal},
 \qquad
 b_{\rm cal}=\delta+\frac{\mu_x+\mu_y+\mu_z}{4}.
 \label{eq:bcal}
\end{equation}
\end{lemma}

\begin{proof}
Measurement error changes the correlation combination by at most
\(\sum_j\mu_j/4\).
The ideal combination for \(\sigma\) equals \(\Tr(P_2\sigma)\).
Because \(P_2\) is an effect, its expectation differs from
\(\Tr(P_2J_\Echan)\) by at most \(\delta\).
\end{proof}

\subsection{Setting-dependent alternative}

It is also sufficient to prove
\begin{equation}
 \abs{m_j-c_j}\le\gamma_j.
 \label{eq:componentbias}
\end{equation}
Then
\[
 b_{\rm cal}=\frac{\gamma_x+\gamma_y+\gamma_z}{4}.
\]
For separate state bounds \(\dtr(\sigma_j,J_\Echan)\le\delta_j\)
and measurement bounds \(\mu_j\), one may take
\(\gamma_j=\mu_j+2\delta_j\).
The factor two converts trace distance to trace norm.

\begin{remark}[Calibration is an input, not a reported laboratory result]
The paper proves the conversion to \(b_{\rm cal}\), not an apparatus
calibration establishing these allowances.
A reduced preparation bound alone does not identify a logical
channel when the device environment is correlated with the input.
Preparation independence or an appropriate joint bound is required.
The simulation choice \(b_{\rm cal}=0\) is a model assumption,
not evidence of perfect laboratory calibration.
\end{remark}

\begin{remark}[Frame and self-consistent tomography]
The trusted logical Pauli frame is part of the contract.
Gate-set tomography has model assumptions and gauge freedom that
must be addressed before reading a gauge-fixed estimate as an
absolute distance to the identified identity channel \cite{GST}.

This protocol is calibrated, not device-independent.
A separate Bell/CHSH specimen, such as that in En06-B, does not
certify an untraversed memory wire
\cite[\sourceid{prop:Bellinstrument}]{CheungEn06B}.
\end{remark}

\section{Finite-sample certificate from bounded complete records}
\label{sec:main}

\begin{assumption}[Conditional validation model]
\label{ass:statistics}
Conditional on \(\mathcal Z\), each setting has a predeclared positive
sample count \(n_j\).
Its scores \(Z_{j1},\ldots,Z_{jn_j}\) are independent, in \([-1,1]\),
and have common mean \(m_j\).
The same logical channel is tested in all settings.
The calibration bias and transfer bounds hold on \(G\).

Independence between settings is not required for the union bound.
No fixed-sample theorem is used after an unaccounted adaptive
stopping rule.
\end{assumption}

Choose \(\alpha_{\rm s}>0\), \(\beta\ge0\), and
\(\alpha_{\rm s}+\beta\le\alpha<1\).
Define
\begin{equation}
 \begin{split}
 \widehat c_j&=\frac1{n_j}\sum_iZ_{ji},\\
 r_j&=\sqrt{\frac2{n_j}\log\frac6{\alpha_{\rm s}}},
 \qquad R_{\rm s}=\frac{r_x+r_y+r_z}{4},\\
 \widehat F&=\frac{1+\widehat c_x-\widehat c_y+\widehat c_z}{4}.
 \end{split}
 \label{eq:statistics}
\end{equation}
Write \([u]_{[0,1]}=\max\{0,\min\{1,u\}\}\).

\begin{theorem}[Finite-confidence recovery certificate]
\label{thm:main}
Under the contract and Assumption~\ref{ass:statistics}, suppose
\(\abs{F_{\rm obs}-F_e}\le b_{\rm cal}\) on \(G\).
Set
\begin{equation}
 \begin{split}
 F_L&=[\,\widehat F-R_{\rm s}-b_{\rm cal}\,]_{[0,1]},\\
 F_U&=[\,\widehat F+R_{\rm s}+b_{\rm cal}\,]_{[0,1]},\\
 L&=\max\{0,1-F_U-b\},\\
 U&=\min\{1,2\sqrt{1-F_L}+b\}.
 \end{split}
 \label{eq:certificate}
\end{equation}
Uniformly over the channels and nuisance parameters satisfying the
contract,
\begin{equation}
 \Pr\{F_L\le F_e\le F_U,\ L\le e(\Echan_\star)\le U\}
 \ge1-\alpha_{\rm s}-\beta.
 \label{eq:coverage}
\end{equation}
For direct certification \(b=0\), the same event gives
\[
 \epsrec(\Nchan_t)\le\min\{3/4,U\}.
\]
If ``certified'' is declared only when \(U\le\varepsilon\), then
\begin{equation}
 \Pr\{\text{certified and }e(\Echan_\star)>\varepsilon\}
 \le\alpha_{\rm s}+\beta.
 \label{eq:falseaccept}
\end{equation}
\end{theorem}

\begin{proof}
Hoeffding's inequality \cite{Hoeffding} gives, conditional on
\(\mathcal Z\),
\[
 \Pr\{|\widehat c_j-m_j|>r_j\mid\mathcal Z\}
 \le2e^{-n_jr_j^2/2}=\alpha_{\rm s}/3.
\]
A union bound gives simultaneous coverage at least
\(1-\alpha_{\rm s}\).
On this event,
\[
 |\widehat F-F_{\rm obs}|\le R_{\rm s}.
\]
Intersecting with \(G\) gives
\(|\widehat F-F_e|\le R_{\rm s}+b_{\rm cal}\).
Clipping preserves coverage because \(F_e\in[0,1]\).
Proposition~\ref{prop:bellbounds} gives the error interval.
Integrate the conditional statistical failure bound and add
\(\Pr(G^c)\le\beta\).
An invalid acceptance is contained in the upper-certificate failure
event.
\end{proof}

\begin{remark}[Not a conditional probability after acceptance]
Equation~\eqref{eq:falseaccept} does not assert
\(\Pr\{e\le\varepsilon\mid\text{certified}\}\ge1-\alpha\).
That interpretation requires a different statistical construction.
\end{remark}

\subsection{Threshold and sample planning}

For \(b<\varepsilon<1\), acceptance is equivalent to
\begin{equation}
 F_L\ge1-\frac{(\varepsilon-b)^2}{4}.
 \label{eq:threshold}
\end{equation}
For \(b=0,\varepsilon=0.1\), this requires \(F_L\ge0.9975\).

For equal sample counts \(n\), an all-ideal-score dataset is certified
by the Hoeffding procedure whenever
\begin{equation}
 n\ge\frac9{8q^2}\log\frac6{\alpha_{\rm s}},
 \qquad
 q=\frac{(\varepsilon-b)^2}{4}-b_{\rm cal}>0.
 \label{eq:samples}
\end{equation}
Indeed \(R_{\rm s}\le q\) under this allowance.
If \(q\le0\), the announced calibration budget prevents this
particular certificate from succeeding even on ideal scores.

These are sufficient allowances, not optimal sample lower bounds.
Failure to certify does not show that the actual device error is large.

\section{Exact binomial alternatives}
\label{sec:binomial}

Binary pass records allow exact binomial inversion
\cite{ClopperPearson}.

For \(0<\zeta<1\), \(n\ge1\), define
\[
 \ell(n,0;\zeta)=0,\qquad u(n,n;\zeta)=1.
\]
For \(k>0\), \(\ell(n,k;\zeta)\) solves
\begin{equation}
 \sum_{i=k}^n\binom ni p^i(1-p)^{n-i}=\zeta.
 \label{eq:cpL}
\end{equation}
For \(k<n\), \(u(n,k;\zeta)\) solves
\begin{equation}
 \sum_{i=0}^k\binom ni p^i(1-p)^{n-i}=\zeta.
 \label{eq:cpU}
\end{equation}
The relevant tails are strictly monotone on \(0<p<1\), so these
solutions are unique.

\begin{lemma}[Binomial coverage]
\label{lem:binomial}
If \(K\sim\operatorname{Bin}(n,p)\), then
\[
 \Pr_p\{p<\ell(n,K;\zeta)\}\le\zeta,
 \qquad
 \Pr_p\{p>u(n,K;\zeta)\}\le\zeta.
\]
\end{lemma}

\begin{proof}
For fixed \(p\), the counts satisfying \(p<\ell(n,K;\zeta)\)
form an upper-tail event whose probability is at most \(\zeta\),
by \eqref{eq:cpL} and monotonicity.
The corresponding lower-tail argument proves the upper-endpoint
statement. The endpoint definitions cover \(k=0,n\).
\end{proof}

\begin{theorem}[Three-setting binomial certificate]
\label{thm:binomial}
Conditional on the training and calibration record, assume iid
binary indicators within each setting, with pass probability
\[
 p_j^{\rm obs}=\frac{1+s_jm_j}{2}.
\]
Set \(\zeta=\alpha_{\rm s}/6\), and
\[
 p_{j,L}=\ell(n_j,k_j;\zeta),\qquad
 p_{j,U}=u(n_j,k_j;\zeta).
\]
Define
\begin{equation}
 \begin{split}
 F_L&=\left[
 \frac{p_{x,L}+p_{y,L}+p_{z,L}-1}{2}-b_{\rm cal}
 \right]_{[0,1]},\\
 F_U&=\left[
 \frac{p_{x,U}+p_{y,U}+p_{z,U}-1}{2}+b_{\rm cal}
 \right]_{[0,1]}.
 \end{split}
 \label{eq:cpF}
\end{equation}
The recovery interval and coverage conclusions of
Theorem~\ref{thm:main} remain valid with these endpoints.
\end{theorem}

\begin{proof}
The six one-sided binomial failure probabilities sum to at most
\(\alpha_{\rm s}\), and
\[
 F_{\rm obs}=
 \frac{p_x^{\rm obs}+p_y^{\rm obs}+p_z^{\rm obs}-1}{2}.
\]
Combine the pass-probability intervals, calibration event, and
channel conversion.
\end{proof}

\subsection{All-pass sample allowance}

With \(n\) passes out of \(n\) in every setting,
\[
 p_{j,L}=\zeta^{1/n},\qquad
 F_L=\left[
 1-\frac32(1-\zeta^{1/n})-b_{\rm cal}
 \right]_{[0,1]}.
\]
For \(q\) in \eqref{eq:samples}, \(0<q<3/2\), acceptance of the
exact binomial endpoints on all-pass data requires
\begin{equation}
 n\ge
 \frac{\log(6/\alpha_{\rm s})}{-\log(1-2q/3)}.
 \label{eq:cpSamples}
\end{equation}
The integer sample allowance is the ceiling.
For small \(q\), this is of order \(q^{-1}\), compared with
the Hoeffding allowance of order \(q^{-2}\).
This comparison concerns favorable all-pass datasets.

\subsection{Uniformly randomized settings}

Alternatively choose settings independently with probability \(1/3\),
after the device output has returned.
Under a common stationary channel and measurement model, all pass
indicators are iid Bernoulli with
\[
 p=\frac{p_x^{\rm obs}+p_y^{\rm obs}+p_z^{\rm obs}}3,
 \qquad F_{\rm obs}=\frac{3p-1}{2}.
\]
A single binomial interval with \(\zeta=\alpha_{\rm s}/2\) gives
\[
 F_L=\left[\frac{3\ell(N,K;\zeta)-1}{2}-b_{\rm cal}\right]_{[0,1]},
 \qquad
 F_U=\left[\frac{3u(N,K;\zeta)-1}{2}+b_{\rm cal}\right]_{[0,1]}.
\]
The same coverage argument applies.

\begin{remark}[Bounded scores are not binary counts]
A zero score for unavailable readout is not a binary pass indicator.
It must not be inserted into a binomial formula as a retained success.

A bounded score \(z\in[-1,1]\) can be converted to a binary record
using an independent trusted coin with pass probability
\((1+s_jz)/2\). That randomization and its bias model must be
declared. The bounded-score Hoeffding procedure needs no such
conversion.
\end{remark}

\section{Loss, heralding, drift, and reference safeguards}
\label{sec:failure}

\subsection{Declared output on loss}

If the accessible output has a leakage or erasure sector, the
primary qubit protocol certifies a specified CPTP completion
\[
 S:\mathcal B(R_{\rm physical})\to\mathcal B(C').
\]
For example, retain the logical qubit on success and prepare \(I_2/2\)
on an erasure flag. The completion belongs to the implemented decoder
and is included on every attempt.

The completed qubit channel and a larger flag-retaining channel are
different tasks. Their ideal outputs and errors cannot be silently
identified.

\begin{lemma}[Missing analyzer record allowance]
\label{lem:missing}
Suppose an ideal parity \(Z_j^{\rm ideal}\in[-1,1]\) is defined on
every attempt and agrees with the observed parity whenever readout
is available. Score missing records by zero.
If their unconditional probability is at most \(q_j\), then
\[
 \left|\mathbb E Z_j^{\rm scored}-\mathbb E Z_j^{\rm ideal}\right|
 \le q_j.
\]
\end{lemma}

\begin{proof}
The pointwise score change is at most the missing-record indicator.
Take expectations.
\end{proof}

No independence between parity and missingness is required for this
worst-case bound. The \(q_j\)'s need valid upper bounds and their own
risk accounting. They contribute \(\sum_jq_j/4\) to a componentwise
fidelity-bias allowance.

Analyzer-record loss is not memory loss.
The latter needs a declared output channel.

\subsection{Heralded success is not deterministic recovery}

For
\[
 \mathcal M_{\rm s}(X)=pX,\qquad
 \mathcal M_{\rm f}(X)=(1-p)\Tr(X)\tau,
\]
conditioning on success yields identity, but the deterministic channel
is
\[
 \Echan_p=p\id+(1-p)\Trep{\tau}.
\]
Its error is positive for \(p<1\).

With input-dependent success probability, normalization of a success
branch need not even define a linear channel on all inputs.
Failure branches remain in deterministic certification, as in the
flagged interface of Em05-B \cite{CheungEm05B}.

\subsection{Certified drift}

For independent nonidentically distributed scores, Hoeffding controls
the average expectation, not an unidentified stationary channel.

If run \(i\) in setting \(j\) has
\[
 \ddia(\Echan_{ji},\Echan_0)\le\xi_{ji},
\]
the correlation changes by at most \(2\xi_{ji}\).
A valid additional fidelity allowance is
\begin{equation}
 b_{\rm drift}
 =\frac12\sum_{j=x,y,z}\frac1{n_j}\sum_i\xi_{ji}.
 \label{eq:driftbias}
\end{equation}
Use \(b_{\rm cal}+b_{\rm drift}\).
The iid binomial model must not automatically be applied to this
drifting model.

An independently justified bound
\[
 \ddia(\Echan_t,\Echan_{t_0})\le L|t-t_0|
\]
extends a point certificate by
\[
 e(\Echan_t)\le\min\{1,U_{t_0}+L|t-t_0|\}.
\]
The constant \(L\) is a separate input, not derived from the three
correlations \cite[\sourceid{prop:interval}]{CheungHawk04B}.

\begin{proposition}[Setting-dependent drift defeats naive pooling]
\label{prop:driftbad}
If the \(x,y,z\) blocks test \(\Ad_X,\Ad_Y,\Ad_Z\), respectively,
all oriented parities pass with certainty, so naive pooling gives
\(\widehat F=1\). Each channel nevertheless has error one.
\end{proposition}

\begin{proof}
Each Pauli unitary preserves the correlation in its own axis.
The observed signs are \(1,-1,1\).
Every nonidentity Pauli unitary sends a Bell state to an orthogonal
Bell state. There is no common tested channel across the blocks.
\end{proof}

\subsection{Reference compensation}

If both the memory and reference apply \(Z\),
\[
 (Z\otimes Z)\ket{\Phi_2}=\ket{\Phi_2}.
\]
The Bell test appears perfect although the memory-only channel has
error one. The uncharged reference operation violates the contract.

\subsection{Optional stopping}

Ordinary fixed-sample intervals cannot be reused after repeatedly
looking for a favorable stopping point without additional control.

For each setting and every prefix \(n\ge1\), allocate
\[
 a_{j,n}=\frac{2\alpha_{\rm s}}{\pi^2n^2}.
\]
Their sum over all prefixes and three settings is \(\alpha_{\rm s}\).
The radii
\[
 r_j(n)=\sqrt{\frac2n\log\frac{\pi^2n^2}{\alpha_{\rm s}}}
\]
therefore cover all prefixes simultaneously under the independent
stream model. This permits stopping at a data-dependent prefix;
it is not the fixed-sample formula \eqref{eq:statistics}.

\section{Adversarial benchmarks}
\label{sec:benchmarks}

\begin{proposition}[Replacement benchmark and lower-bound direction]
\label{prop:replacement}
For input dimension \(d\), every replacement channel has optimal
recovery error \(a_d=1-d^{-2}\).
If \(\ddia(\Nchan,\Trep{\omega})\le\eta\), every deterministic
decoder has error at least \(\max\{0,a_d-\eta\}\).

A qubit pure-output replacement followed by the identity decoder
has implemented error one, although its optimal recovery error is
\(3/4\).
\end{proposition}

\begin{proof}
Every decoded replacement is a replacement.
Its Bell output is \(I_d/d\otimes\tau\), with Bell overlap \(d^{-2}\),
giving the lower bound \(a_d\).

Preparing \(I_d/d\) attains it: the corresponding replacement is the
uniform average of \(d^2\) Weyl unitary channels.
Separating identity gives unhalved diamond norm at most \(2a_d\);
the Bell witness gives equality.
Contraction and the reverse triangle inequality give the approximate
lower bound.
For a fixed pure output \(\ket0\), input \(\ket1\) gives orthogonal
actual and ideal outputs.
\end{proof}

These are the benchmarks in Oai265-A and En07-B/C
\cite{Oai265A,CheungEn07B,CheungEn07C}.
Accessible-channel replacement closeness is a recovery lower bound,
not a high-accuracy upper certificate.

\begin{proposition}[Entanglement-breaking obstruction]
\label{prop:EB}
If \(\Nchan\) is entanglement breaking, every deterministic decoder
has error at least \(1-d^{-1}\), hence at least \(1/2\) for a qubit.
\end{proposition}

\begin{proof}
The decoded Bell output is separable.
Every product state has Bell overlap at most \(1/d\);
convexity extends this to separable mixtures.
The Bell-projector test proves the bound.
\end{proof}

This is the relevant obstruction for the specified commuting control
of Hawk04-B \cite[\sourceid{prop:QND}]{CheungHawk04B}, not a theorem
about every channel commuting with an arbitrary operator.

\subsection{Exact implemented-channel tests}

In the following table, the decoder is identity on the returned qubit.
Let
\[
 \mathcal Z_q=(1-q)\id+q\Ad_Z,\qquad
 U_\theta=e^{-i\theta Z/2},\qquad
 \mathcal P_p=p\id+(1-p)\Trep{I_2/2}.
\]
Amplitude damping has Kraus operators
\[
 K_0=\kb00+\sqrt{1-\gamma}\kb11,\qquad
 K_1=\sqrt\gamma\kb01,\qquad 0\le\gamma\le1.
\]

\begin{center}
\small
\begin{tabularx}{\linewidth}{@{}p{0.27\linewidth}Y
                                      p{0.18\linewidth}@{}}
\toprule
Implemented channel & Bell overlap \(F_e\) & Exact error \(e\)\\
\midrule
Identity & \(1\) & \(0\)\\[3pt]
Pure replacement \(\Trep{\kb00}\) & \(1/4\) & \(1\)\\[3pt]
Mixed replacement \(\Trep{I_2/2}\) & \(1/4\) & \(3/4\)\\[3pt]
Dephasing \(\mathcal Z_q\) & \(1-q\) & \(q\)\\[3pt]
Rotation \(\Ad_{U_\theta}\) &
\(\cos^2(\theta/2)\) & \(\abs{\sin(\theta/2)}\)\\[3pt]
Amplitude damping \(\mathcal A_\gamma\) &
\((1+\sqrt{1-\gamma})^2/4\) & \(\gamma\)\\[3pt]
Completed loss \(\mathcal P_p\) &
\((1+3p)/4\) & \(3(1-p)/4\)\\
\bottomrule
\end{tabularx}
\end{center}

\begin{proposition}[Benchmark identities]
\label{prop:bench}
The table is exact.
\end{proposition}

\begin{proof}
For Kraus operators \(K_a\),
\[
 F_e=d^{-2}\sum_a|\Tr K_a|^2.
\]
This gives the overlaps.

For Pauli channels with probabilities \(a_P,b_P\), the triangle
inequality gives
\(\ddia(\Phi,\Psi)\le\frac12\sum_P|a_P-b_P|\).
Their Bell outputs are mixtures of orthogonal Bell projectors,
giving equality. This proves the dephasing and completed-loss
errors; the replacement errors were proved above.

For a unitary rotation, a pure referenced input has output distance
\[
 \sqrt{1-|\Tr(\rho_CU_\theta)|^2}.
\]
The convex hull of the eigenvalues has minimum modulus
\(\abs{\cos(\theta/2)}\), attained by equal weights.
Convexity handles mixed inputs.
Appendix~\ref{app:AD} proves the amplitude-damping distance.
\end{proof}

The Pauli identity is also used in Em03-E
\cite[\sourceid{thm:recovery}]{CheungEm03E}.
It does not justify replacing the general square-root bound by
\(1-F_e\) for arbitrary channels.

\subsection{Additional negative controls}

\begin{enumerate}
\item Identity and \(\Trep{\rho_0}\) agree on input \(\rho_0\).
One-state agreement is not channel certification.

\item For the isometry
\[
 V\ket0=\ket{\Phi^+}_{RB},\qquad
 V\ket1=\ket{\Phi^-}_{RB},
\]
both computational-basis preparations have \(B\) marginal \(I_2/2\),
but input \(\ket+\) maps to \(\ket{00}\).
Selected residual data do not prove a constant complete complement.
Every preparation purifier must be retained for a complete-complement
claim.

\item Reference compensation and setting-dependent drift are the
out-of-contract examples in Section~\ref{sec:failure}.

\item Magic resources, an area-law record, and a PEPS bond dimension
are not measurements of \(F_e\) or converted channel allowances
\cite{CheungEn04A,Oai265A}.

\item Classical capacity is a different task. No capacity theorem
is used as a diamond-error premise.
\end{enumerate}

\section{Supplied script execution report and its interpretation}
\label{sec:execution}

\subsection{Evidence status and parameters}

The undated user-supplied file \sourceid{summary (30).txt} states that
the version-1 Appendix~B script was extracted and executed
\cite{ExecutionReport}.
We incorporate its recorded results as supplied execution evidence.
We do not assert an independent rerun, authenticate an execution
environment, or assign a run date not present in the report.

\begin{center}
\begin{tabular}{@{}ll@{}}
\toprule
Parameter & Reported value\\
\midrule
Seed & \(265\)\\
Repetitions per case & \(20\)\\
Shots per setting & \(40\)\\
Statistical risk \(\alpha_{\rm s}\) & \(1/20\)\\
One-sided tail \(\zeta=\alpha_{\rm s}/6\) & \(1/120\)\\
Calibration and transfer allowances & \(b_{\rm cal}=b=0\)\\
Binomial bisection iterations & \(32\)\\
Square-root bisection iterations & \(40\)\\
Acceptance threshold & \(\varepsilon=1/10\)\\
Cases / datasets & \(7\) / \(140\)\\
\bottomrule
\end{tabular}
\end{center}

There are \(120\) simulated binary records per dataset and \(16{,}800\)
across the reported suite.
The records are classical Bernoulli passes generated from the
benchmark correlations. They are not laboratory outcomes or a
quantum-circuit simulation.

\subsection{Reported case results}

Every setting has \(n=40\).
The tuple \((k_x,k_y,k_z)\) below contains the reported first
repetition's oriented pass counts, not raw same-sign counts for \(Y\).
``Covered'' is the report's joint check of both
\(F_L\le F_e\le F_U\) and \(L\le e\le U\).

\begin{center}
\small
\begin{tabular}{@{}lccccc@{}}
\toprule
Case & \(F_e\) & \(e\) & First pass counts &
Covered & Invalid accepts\\
\midrule
Identity & \(1\)&\(0\)&\((40,40,40)\)&\(20/20\)&\(0\)\\
Pure replacement & \(1/4\)&\(1\)&\((16,18,21)\)&\(20/20\)&\(0\)\\
Mixed replacement & \(1/4\)&\(3/4\)&\((19,19,24)\)&\(20/20\)&\(0\)\\
Dephasing & \(9/10\)&\(1/10\)&\((36,35,40)\)&\(20/20\)&\(0\)\\
Rotation & \(16/25\)&\(3/5\)&\((28,20,40)\)&\(20/20\)&\(0\)\\
Amplitude damping & \(9/16\)&\(3/4\)&\((32,34,25)\)&\(20/20\)&\(0\)\\
Completed loss & \(17/20\)&\(3/20\)&\((36,37,28)\)&\(20/20\)&\(0\)\\
\midrule
Total &&&&\(140/140\)&\(0\)\\
\bottomrule
\end{tabular}
\end{center}

These are reported outcomes, not independently reproduced results
\cite{ExecutionReport}.
The execution report supplies one detailed repetition per case and
aggregate coverage counts; it does not supply every dataset's full
record.

\subsection{Exact example endpoints}

The following fractions are transcribed from the supplied report.
Here \(L\) and \(U_{\rm rat}\) are the returned rational error
endpoints. The square-root bracketing makes \(U_{\rm rat}\) at least
the ideal mathematical upper expression, so it is conservative.

\begin{center}
\small
\renewcommand{\arraystretch}{1.65}
\begin{tabular}{@{}lcccc@{}}
\toprule
Case & \(F_L\) & \(F_U\) & \(L\) & \(U_{\rm rat}\)\\
\midrule
Identity &
\(\frac{3568244821}{4294967296}\) &
\(1\) &
\(0\) &
\(\frac{28267292255}{34359738368}\)\\

Pure replacement &
\(0\) &
\(\frac{4132899669}{8589934592}\) &
\(\frac{4457034923}{8589934592}\) &
\(1\)\\

Mixed replacement &
\(0\) &
\(\frac{150211823}{268435456}\) &
\(\frac{118223633}{268435456}\) &
\(1\)\\

Dephasing &
\(\frac{2829358859}{4294967296}\) &
\(\frac{8367722945}{8589934592}\) &
\(\frac{222211647}{8589934592}\) &
\(1\)\\

Rotation &
\(\frac{2982894065}{8589934592}\) &
\(\frac{831958049}{1073741824}\) &
\(\frac{241783775}{1073741824}\) &
\(1\)\\

Amplitude damping &
\(\frac{753268147}{2147483648}\) &
\(\frac{7214677977}{8589934592}\) &
\(\frac{1375256615}{8589934592}\) &
\(1\)\\

Completed loss &
\(\frac{4280188763}{8589934592}\) &
\(\frac{1961035205}{2147483648}\) &
\(\frac{186448443}{2147483648}\) &
\(1\)\\
\bottomrule
\end{tabular}
\end{center}

The exact fractions, rather than rounded decimal displays, define
the recorded numerical certificates \cite{ExecutionReport}.
Their illustrative decimal values are:
\[
\begin{array}{c|rrrr}
 &F_L&F_U&L&U_{\rm rat}\\ \hline
\text{identity}&0.830797&1&0&0.822686\\
\text{pure replacement}&0&0.481133&0.518867&1\\
\text{mixed replacement}&0&0.559583&0.440417&1\\
\text{dephasing}&0.658761&0.974131&0.025869&1\\
\text{rotation}&0.347255&0.774821&0.225179&1\\
\text{amplitude damping}&0.350768&0.839899&0.160101&1\\
\text{completed loss}&0.498280&0.913178&0.086822&1
\end{array}
\]
These rounded numbers are not substituted into the acceptance test.

\subsection{Identity example: corrected numerical interpretation}

For all three identity settings, the report gives the outward
Clopper--Pearson lower endpoint
\[
 p_L=\frac{1905242823}{2147483648}
 \approx0.8871978255920112.
\]
Therefore
\[
 F_L=\frac{3p_L-1}{2}
 =\frac{3568244821}{4294967296}
 \approx0.8307967383880168.
\]
The rational upper endpoint is
\begin{equation}
 U_{\rm rat}=
 \frac{28267292255}{34359738368}
 \approx0.8226864812604617.
 \label{eq:identityreported}
\end{equation}
This corrects the report's coarser interpretation
``approximately \(0.8225\)'' without changing its exact fraction.
Moreover,
\[
 4(1-F_L)=\frac{726722475}{1073741824}
 \approx0.6768130464479327>0.01.
\]
The exact acceptance test therefore fails.

For an arithmetic consistency check, the reported fractions satisfy
\[
 \left(
 \frac{28267292255}{34359738368}-2^{-39}
 \right)^2
 <
 \frac{726722475}{1073741824}
 \le
 \left(
 \frac{28267292255}{34359738368}
 \right)^2.
\]
The spacing \(2^{-39}\) is the spacing of twice a 40-step dyadic
square-root bracket. This is a check of the recorded endpoint's
algebraic role, not an independent execution of the script.

\subsection{Why zero invalid acceptances is non-informative here}

\begin{proposition}[No \(0.1\) acceptance at the reported sample count]
\label{prop:noaccept}
For \(n_j=40\), \(\alpha_{\rm s}=1/20\), and
\(b_{\rm cal}=b=0\), no dataset can be accepted at
\(\varepsilon=0.1\) by the three-setting binomial procedure.
This remains true with outward conservative numerical brackets.
\end{proposition}

\begin{proof}
The binomial lower endpoint is nondecreasing in the pass count:
the upper-tail probability decreases with \(k\), so its inverse
endpoint increases with \(k\).
Thus all-pass counts maximize \(F_L\).

For exact all-pass endpoints, let
\(p_0=120^{-1/40}\). The maximal lower fidelity is
\[
 F_L^{\max}=\frac{3p_0-1}{2}.
\]
Acceptance would require \(p_0\ge599/600\).
But Bernoulli's inequality gives
\[
 (599/600)^{40}\ge1-40/600=14/15>1/120,
\]
hence \(p_0<599/600\), excluding acceptance.
Outward lower brackets cannot increase \(F_L\), and outward upper
square-root brackets cannot decrease the error upper endpoint.
\end{proof}

Consequently the total number of acceptances is zero, not just the
number of invalid acceptances. This is a deterministic deduction
from the protocol and sample count.
The report's zero-invalid-acceptance result is consistent with this
deduction, but does not test whether the implementation correctly
accepts a genuinely informative high-accuracy dataset.

\begin{corollary}[Informative all-pass sample threshold]
\label{cor:2871}
For the same risk and allowances, exact binomial endpoints accept
all-pass data at \(\varepsilon=0.1\) precisely when
\[
 n\ge
 \left\lceil
 \frac{\log120}{-\log(599/600)}
 \right\rceil
 =2871
\]
shots per setting.
\end{corollary}

\begin{proof}
Use \eqref{eq:cpSamples} with \(q=1/400\).
The integer boundary can be checked without logarithm rounding by
\[
 120\,599^{2870}>600^{2870},
 \qquad
 120\,599^{2871}<600^{2871}.
\]
\end{proof}

This is \(8613\) attempted shots across the three settings on an
all-pass dataset. It is not a claim of laboratory execution, and
noisy datasets can require more shots or fail this certificate.
An actual outward-bracket implementation should check acceptance
on its returned \(F_L\), rather than assume acceptance solely from
the analytic integer threshold.

\subsection{Coverage and numerical conservatism}

The reported empirical coverage is \(140/140=1\).
This does not prove uniform coverage over all channels, establish
the calibration assumptions, or replace Theorem~\ref{thm:binomial}.

For perspective, if a single case's repeated datasets were independent
ideal draws with coverage probability \(p_{\rm cov}\), observing
20 covered datasets gives the one-sided 95\% exact lower confidence
endpoint
\[
 p_{{\rm cov},L}=0.05^{1/20}\approx0.8608916593.
\]
This is an illustration of Monte Carlo uncertainty, not a new
laboratory confidence statement. Seven separate cases require an
additional multiplicity allowance for simultaneous Monte Carlo
intervals. The heterogeneous suite cannot simply be treated as 140
iid observations of one channel's coverage probability.

The report's statement that any coverage miss would be a
``failure of the statistical procedure itself'' needs qualification.
Even a correct procedure can miss on an allowed tail event.
Under the model, its miscoverage probability is bounded, not zero.
Outward arithmetic prevents inward numerical approximation from
weakening the intended intervals; it does not eliminate statistical
tail events, implementation bugs, or violations of assumptions.

\subsection{Limits of the supplied execution evidence}

The supplied report includes parameters, first-repetition details,
and aggregate counts. It does not include a source hash, interpreter
version, complete 140-dataset archive, or independently authenticated
execution trace.

The version-1 listing printed aggregate results, whereas the supplied
report includes richer example details. Those details are treated as
reported diagnostic logging associated with the extraction, not as
output that the unchanged version-1 print statements alone produced.
Appendix~\ref{app:code} now supplies a reporter capable of emitting
these details without changing the Bernoulli draw order.

The original suite models ideal correlations for completed loss, but
does not simulate loss flags, readout missingness, drift, reference
disturbance, or calibration estimation. The pure and mixed replacement
cases have identical pass probabilities; their differing simulated
counts arise from different random draws, not discrimination of their
implemented errors by these three populations.

\section{A tighter channel-confidence-region route}
\label{sec:tomography}

Three correlations bound fidelity, not the entire channel.
Pure and mixed replacements have the same Bell overlap but different
implemented errors.

\subsection{Explicit qubit Choi confidence region}

Let \(\{P_k\}_{k=1}^{15}\) be the nonidentity two-qubit Pauli basis,
with \(\Tr(P_kP_\ell)=4\delta_{k\ell}\).
Informationally complete local Pauli measurements can produce
simultaneous calibrated intervals
\[
 |\Tr(P_kJ_\Echan)-\widehat a_k|\le\omega_k.
\]
Their statistical and calibration risks must be accounted for.

Define
\begin{equation}
 \mathcal C=
 \left\{
 J\succeq0:
 \Tr_{C'}J=I_Q/2,\quad
 |\Tr(P_kJ)-\widehat a_k|\le\omega_k,\ 1\le k\le15
 \right\}.
 \label{eq:region}
\end{equation}
This is a confidence region of CPTP Choi states, not a best-fit
matrix. If empty, report incompatibility or an inconclusive result;
do not silently enlarge error bars.

\begin{proposition}[Computable confidence radius]
\label{prop:radius}
On \(J_\Echan\in\mathcal C\), choose any feasible
\(\widehat J\in\mathcal C\), and let
\[
 t_k=\omega_k+|\Tr(P_k\widehat J)-\widehat a_k|.
\]
Then the corresponding channel obeys
\begin{equation}
 \ddia(\Echan,\widehat\Echan)\le\eta,
 \qquad
 \eta=\min\left\{1,\sqrt{\sum_{k=1}^{15}t_k^2}\right\},
 \qquad t_k\le2\omega_k.
 \label{eq:radius}
\end{equation}
The feasible center may depend on the data.
\end{proposition}

\begin{proof}
For \(H=J_\Echan-\widehat J\), write
\[
 H=\frac14\sum_kh_kP_k,\quad |h_k|\le t_k,\quad
 \norm H_2=\frac12\sqrt{\sum_kh_k^2}.
\]
In dimension four, \(\norm H_1\le2\norm H_2\).
Lemma~\ref{lem:choi} with \(d=2\) gives
\(\ddia(\Echan,\widehat\Echan)\le\norm H_1\).
\end{proof}

If validated bounds give
\(h_L\le\ddia(\widehat\Echan,\id)\le h_U\), then
\begin{equation}
 \max\{0,h_L-\eta-b\}
 \le e(\Echan_\star)
 \le\min\{1,h_U+\eta+b\}.
 \label{eq:tight}
\end{equation}

Minimizing or maximizing the linear Bell overlap over \(\mathcal C\)
is a semidefinite optimization.
Maximizing a convex diamond-distance function over this confidence
region is not thereby one simple SDP.

\subsection{Validated matrix upper witness}

For a Hermiticity-preserving difference \(\Delta\), let
\(K_\Delta=dJ_\Delta\), with input-reference factor first.

\begin{lemma}[Feasible upper witness]
\label{lem:dual}
If a Hermitian matrix \(Z\) and \(\nu\ge0\) satisfy
\[
 Z\succeq K_\Delta,\qquad Z\succeq-K_\Delta,\qquad
 \Tr_{\rm out}Z\preceq\nu I_{\rm in},
\]
then \(\frac12\norm\Delta_\diamond\le\nu/2\).
\end{lemma}

\begin{proof}
The first inequalities imply \(Z\succeq0\).
For a pure referenced input
\(\psi=(A\otimes I)\Phi_d\), \(\Tr(A^\dagger A)=d\), its
Hermitian output difference \(H\) obeys \(-W\preceq H\preceq W\),
where
\[
 W=\frac1d(A\otimes I)Z(A^\dagger\otimes I).
\]
Testing against the positive and negative spectral projections of
\(H\) gives
\[
 \norm H_1\le\Tr W
 =\frac1d\Tr(A^\dagger A\,\Tr_{\rm out}Z)\le\nu.
\]
For an arbitrary operator \(X\), the Hermitian block dilation
\[
 \frac12\begin{pmatrix}0&X\\X^\dagger&0\end{pmatrix}
\]
preserves its trace norm and the output trace norm under a
Hermiticity-preserving map.
Jordan decomposition reduces Hermitian inputs to states, and
convexity reduces states to pure states.
Thus the bound covers the diamond norm.
\end{proof}

SDP formulations for completely bounded norms are established
\cite{Watrous}. Positivity, trace preservation, matrix inequalities,
residuals, and numerical rounding must be validated.
A favorable optimizer objective is not itself a feasible upper witness
\cite{CheungHawk04B}.

\subsection{Training and decoder selection}

A confidence bound \(\ddia(\Nchan,\widehat\Nchan)\le\eta\) gives,
for every CPTP decoder on that event,
\[
 \ddia(\Dchan\Nchan,\id)
 \le\ddia(\Dchan\widehat\Nchan,\id)+\eta.
\]
The simplest approach designs the decoder on training data and
certifies its actual implementation on independent validation data.
Selection using the same data requires a uniform confidence argument,
not reuse of ordinary fixed-decoder intervals.

\section{Encoded memories and complete complements}
\label{sec:encoded}

\subsection{Encoding overhead remains inside the channel}

The logical protocol applies to
\[
 \text{Bell preparation}\to\text{encoding}\to
 \text{storage/noise}\to\text{syndrome extraction}\to
 \text{implemented decoding}.
\]
Its target is the composite logical CPTP map.
Physical carriers, elapsed time, workspace, classical records,
readout errors, and fallback actions are reported separately;
no operational overhead is silently removed.

Basis isometries preserve distances on their specified logical
interfaces because they preserve trace norm and admit CPTP
retractions. This does not remove physical encoding or decoding
noise. En02-B's resource results concern its declared module class,
not unrestricted decoder optimality \cite{CheungEn02B}.

\begin{corollary}[Justified memory comparison]
\label{cor:comparison}
Jointly valid bounds
\(e_{\rm encoded}\le U_{\rm encoded}<L_{\rm bare}\le e_{\rm bare}\)
imply
\[
 e_{\rm bare}-e_{\rm encoded}
 \ge L_{\rm bare}-U_{\rm encoded}>0
\]
on their joint coverage event.
\end{corollary}

\begin{proof}
Subtract the inequalities and sum their allocated failure risks.
\end{proof}

Overlapping upper bounds do not establish this ordering.

\subsection{Indirect complete-complement implication}

\begin{proposition}[Complete-complement certificate from Bell overlap]
\label{prop:complement}
For a specified complete finite isometry \(V:C\to R\otimes B\),
with \(C\) a qubit, let \(\mathcal C_B\) be its complement.
A CPTP decoder with Bell overlap \(F_e\) implies existence of
\(\tau_B\) such that
\[
 \ddia(\mathcal C_B,\Trep{\tau_B})
 \le\min\{1,2\sqrt{1-F_e}\}.
\]
A valid lower bound \(F_L\) can replace \(F_e\) in the upper expression.
\end{proposition}

\begin{proof}
Dilate the decoder and evolve the Bell input to a pure vector
\(\Psi\) on reference, decoded output, and enlarged environment.
Projection onto the target Bell vector has norm \(\sqrt{F_e}\).
For \(F_e>0\), normalize the environmental projection to \(\xi\).
The distance between \(\Psi\) and \(\Phi_2\otimes\xi\) is
\(\sqrt{1-F_e}\).
Tracing decoder systems gives
\[
 \dtr(J_{\mathcal C_B},I_Q/2\otimes\tau_B)
 \le\sqrt{1-F_e}.
\]
Lemma~\ref{lem:choi} gives the factor two.
For \(F_e=0\), the cap one suffices.
\end{proof}

This is the direct finite argument in Em03-G, consistent with
information--disturbance theory \cite{CheungEm03G,KSW}.
It does not identify the environmental registers, measure them,
or permit a selected residual to replace complete \(B\).
Every preparation purifier and discarded output in the dilation is
retained. Decoded-channel transfer alone does not identify the
complement of another physical model.

\section{Release, provenance, and nonclaims}
\label{sec:scope}

\paragraph{Mathematical release.}
The written proofs establish the calibration conversion,
Hoeffding and binomial certificates, failure and drift allowances,
analytic benchmarks, Choi confidence radius, and feasible upper
witness. Version 2 additionally proves the nonacceptance limitation
of the reported sample count.

\paragraph{Reported computational release.}
The supplied report records an execution of the version-1
supplementary script with \(140/140\) joint coverage and zero invalid
small-error acceptances \cite{ExecutionReport}.
The exact reported example endpoints are incorporated.
This is not an independently reproduced execution.
The version-2 reporter and optional tests are supplied but not
reported as executed.

\paragraph{Experimental release.}
No laboratory calibration, laboratory dataset, measured acceptance,
or encoded-memory improvement is supplied.
Simulation parameters \(b_{\rm cal}=b=0\) do not establish physical
calibration or model transfer.

\paragraph{Source policy.}
Cheung citations identify supplied versions and excerpts.
They are attribution and comparisons, not machine verification.
Oai265-A motivates the reference-sensitive test, but is not evidence
that a physical memory succeeds.

\paragraph{Attachment provenance.}
The supplied \sourceid{Canonical265.lean} concerns
complex-Hadamard moment canonicalizations in
\sourceid{OAI.MUB6.Certificate.PairSemantics}.
It is not evidence for this certificate or a lattice area law.
A numerical filename alone does not identify a catalogue family.

\paragraph{External catalogue.}
Family 265 remains an external record attributed to OpenAI, not a
verified premise here. Neither the supplied Family 276 capacity claim,
Family 283 synthesis claim, nor Family 272 key/entanglement claim
supplies this protocol's calibration or channel allowance.

\paragraph{Thermodynamic and gravitational scope.}
A channel identity does not determine heat, work, or reset cost
\cite{CheungEn07A}.
The protocol is not device-independent, not a secret-key certificate,
not gravity-generated entanglement, not spacetime emergence,
not holographic identification, and not a Page curve or island.

\paragraph{Separate analytic gates.}
The supplied XV-B version 2 exists as a technical continuation,
with its graph-specific characteristic map recorded unresolved at B1.
The older closed ``XV-B exit'' concerns admission, not nonexistence
of that paper. This memory certificate constructs no
\(Q_HR_1^{(1)}\in\mathcal E_H\), discharges no remaining XVI-N
obligation, and does not change the documentary
\sourceid{O.1} status \sourceid{NOT_CLOSED}
\cite{CheungXVB,CheungXIVJ}.
No quantum coefficient is admitted.

\paragraph{Verification declaration.}
No successful compilation of this revision, independent script rerun,
proof-assistant verification, laboratory execution, referee review,
or acceptance is asserted.
The supplied computational report and the locally written proofs
have different evidentiary roles.

\appendix

\section{Exact amplitude-damping distance}
\label{app:AD}

Let \(a=\sqrt{1-\gamma}\), \(q=1-a\), and
\(\Delta=\mathcal A_\gamma-\id\).
In input-reference/output order \(00,01,10,11\),
\[
 K_\Delta=
 \begin{pmatrix}
 0&0&0&-q\\
 0&0&0&0\\
 0&0&\gamma&0\\
 -q&0&0&-\gamma
 \end{pmatrix}.
\]
For \(\gamma>0\), set
\[
 Z=
 \begin{pmatrix}
 2q^2/\gamma&0&0&q\\
 0&0&0&0\\
 0&0&\gamma&0\\
 q&0&0&\gamma
 \end{pmatrix}.
\]
The matrix \(Z+K_\Delta\) is diagonal and nonnegative.
The nonzero off-diagonal block of \(Z-K_\Delta\) is
\[
 \begin{pmatrix}
 2q^2/\gamma&2q\\
 2q&2\gamma
 \end{pmatrix},
\]
which is positive semidefinite because its determinant is zero and
its diagonal is nonnegative. Thus \(Z\succeq\pm K_\Delta\).

Since \(q=\gamma/(1+\sqrt{1-\gamma})\le\gamma\),
\[
 \Tr_{C'}Z=\operatorname{diag}(2q^2/\gamma,2\gamma)
 \preceq2\gamma I_Q.
\]
Lemma~\ref{lem:dual} gives error at most \(\gamma\).
Input \(\kb11\) has output distance exactly \(\gamma\) from its
ideal output. Therefore
\[
 \ddia(\mathcal A_\gamma,\id)=\gamma.
\]
At \(\gamma=0\), the channel is identity.

\section{Exact-rational implementation and diagnostic reporter}
\label{app:code}

The mathematical certificate routines retain the version-1
binomial and square-root outward-bracketing construction.
The unused \sourceid{math.comb} import is removed.
The reporter adds first-repetition endpoints, acceptance counts,
and totals without consuming additional random draws.
Optional arithmetic and threshold tests are new written additions;
their execution is not asserted.

Extract this listing into a Python file.
It uses only the standard library and writes its report to standard
output. The default suite uses the supplied run's parameters.
An optional command
\sourceid{python Oai265-B.py --checks}
also runs the added checks.

The counts supplied to the certificate are complete binary attempted-run
counts. The script does not validate physical calibration, IID
assumptions, a decoder's CPTP implementation, or transfer allowances.
Its risk parameter is \(\alpha_{\rm s}\); a physical application must
also include calibration failure probability \(\beta\).

\begin{lstlisting}
from fractions import Fraction as F
from random import Random
import sys

ZERO, ONE = F(0), F(1)

def clip01(x):
    return max(ZERO, min(ONE, x))

def bin_ge(n, k, p):
    """Exact P[Bin(n,p) >= k] for rational p."""
    assert isinstance(n, int) and n >= 1
    assert isinstance(k, int)
    assert isinstance(p, F) and 0 <= p <= 1
    if k <= 0:
        return ONE
    if k > n:
        return ZERO
    if p == 0:
        return ZERO
    if p == 1:
        return ONE
    if k == n:
        return p ** n
    a, b = p.numerator, p.denominator
    c = b - a
    term = c ** n
    total = 0
    for i in range(n + 1):
        if i >= k:
            total += term
        if i < n:
            num = term * (n - i) * a
            den = (i + 1) * c
            assert num % den == 0
            term = num // den
    return F(total, b ** n)

def cp_outward(n, k, tail, steps=32):
    """Conservative lower and upper CP endpoints."""
    assert isinstance(n, int) and n >= 1
    assert isinstance(k, int) and 0 <= k <= n
    assert isinstance(tail, F) and 0 < tail < 1
    assert isinstance(steps, int) and steps >= 1

    if k == 0:
        lower = ZERO
    else:
        lo, hi = ZERO, ONE
        for _ in range(steps):
            mid = (lo + hi) / 2
            if bin_ge(n, k, mid) <= tail:
                lo = mid
            else:
                hi = mid
        lower = lo

    if k == n:
        upper = ONE
    else:
        lo, hi = ZERO, ONE
        for _ in range(steps):
            mid = (lo + hi) / 2
            cdf = ONE - bin_ge(n, k + 1, mid)
            if cdf >= tail:
                lo = mid
            else:
                hi = mid
        upper = hi
    return lower, upper

def sqrt_upper(x, steps=40):
    assert isinstance(x, F) and 0 <= x <= 1
    assert isinstance(steps, int) and steps >= 1
    if x == 0:
        return ZERO
    lo, hi = ZERO, ONE
    for _ in range(steps):
        mid = (lo + hi) / 2
        if mid * mid >= x:
            hi = mid
        else:
            lo = mid
    return hi

def certificate_details(counts, alpha_s=F(1, 20),
                        bcal=ZERO, b=ZERO, steps=32,
                        sqrt_steps=40):
    assert len(counts) == 3
    assert isinstance(alpha_s, F) and 0 < alpha_s < 1
    assert isinstance(bcal, F) and bcal >= 0
    assert isinstance(b, F) and b >= 0
    endpoints = [
        cp_outward(n, k, alpha_s / 6, steps)
        for n, k in counts
    ]
    pl = sum((v[0] for v in endpoints), ZERO)
    pu = sum((v[1] for v in endpoints), ZERO)
    fl = clip01((pl - 1) / 2 - bcal)
    fu = clip01((pu - 1) / 2 + bcal)
    elo = max(ZERO, ONE - fu - b)
    ehi = min(ONE, b + 2 * sqrt_upper(ONE - fl, sqrt_steps))
    return endpoints, (fl, fu, elo, ehi)

def certify(counts, alpha_s=F(1, 20),
            bcal=ZERO, b=ZERO, steps=32):
    """Version-1-compatible four-endpoint interface."""
    return certificate_details(
        counts, alpha_s, bcal, b, steps
    )[1]

def accepts(fl, epsilon, b=ZERO):
    """Exact test of the mathematical certificate expression."""
    assert isinstance(fl, F) and 0 <= fl <= 1
    assert isinstance(epsilon, F) and 0 <= epsilon < 1
    assert isinstance(b, F) and b >= 0
    if epsilon < b:
        return False
    return 4 * (ONE - fl) <= (epsilon - b) ** 2

def bernoulli(rng, p):
    """Rational threshold; the PRNG execution is diagnostic."""
    assert isinstance(p, F) and 0 <= p <= 1
    return int(rng.randrange(p.denominator) < p.numerator)

# name, correlations, exact Bell overlap, implemented error
CASES = [
    ("identity", (ONE, -ONE, ONE), ONE, ZERO),
    ("pure replacement", (ZERO, ZERO, ZERO), F(1,4), ONE),
    ("mixed replacement", (ZERO, ZERO, ZERO), F(1,4), F(3,4)),
    ("dephasing", (F(4,5), -F(4,5), ONE), F(9,10), F(1,10)),
    ("rotation", (F(7,25), -F(7,25), ONE), F(16,25), F(3,5)),
    ("amplitude damping", (F(1,2), -F(1,2), F(1,4)),
     F(9,16), F(3,4)),
    ("completed loss", (F(4,5), -F(4,5), F(4,5)),
     F(17,20), F(3,20)),
]

def suite(seed=265, repetitions=20, shots=40,
          alpha_s=F(1,20), epsilon=F(1,10)):
    assert repetitions >= 1 and shots >= 1
    rng = Random(seed)
    signs = (1, -1, 1)
    total_covered = 0
    total_accepted = 0
    total_invalid = 0

    print("Python:", sys.version.replace("\n", " "))
    print("seed", seed, "repetitions", repetitions,
          "shots", shots, "alpha_s", alpha_s)
    print("bcal=0 b=0; CP steps=32; sqrt steps=40")
    print("acceptance uses exact squared threshold")

    for name, correlations, fidelity, error in CASES:
        inside = 0
        accepted_count = 0
        invalid_count = 0

        for rep in range(repetitions):
            counts = []
            for s, c in zip(signs, correlations):
                p = (ONE + s * c) / 2
                k = sum(bernoulli(rng, p) for _ in range(shots))
                counts.append((shots, k))

            endpoints, result = certificate_details(
                counts, alpha_s=alpha_s
            )
            fl, fu, elo, ehi = result
            covered = (fl <= fidelity <= fu and
                       elo <= error <= ehi)
            passed = accepts(fl, epsilon)

            inside += int(covered)
            accepted_count += int(passed)
            invalid_count += int(passed and error > epsilon)

            if rep == 0:
                print("\nCASE:", name)
                print("true F_e", fidelity, "true e", error)
                print("counts", counts)
                print("CP endpoints", endpoints)
                print("F_L", fl, "F_U", fu)
                print("e lower", elo, "e upper", ehi)
                print("covered", covered, "accepted", passed)

        total_covered += inside
        total_accepted += accepted_count
        total_invalid += invalid_count
        print("coverage", inside, "/", repetitions,
              "accepted", accepted_count,
              "invalid", invalid_count)

    datasets = len(CASES) * repetitions
    print("\nTOTAL datasets", datasets,
          "covered", total_covered,
          "accepted", total_accepted,
          "invalid", total_invalid)

def optional_checks():
    """New checks; execution is not claimed in the manuscript."""
    from math import comb

    # Verify the integer recurrence against direct binomial sums.
    for n in range(1, 9):
        for p in (ZERO, F(1,7), F(1,2), F(6,7), ONE):
            for k in range(n + 2):
                direct = sum(
                    (F(comb(n, i)) * p**i * (ONE-p)**(n-i)
                     for i in range(k, n + 1)),
                    ZERO
                )
                assert bin_ge(n, k, p) == direct

    # Check the reported all-pass arithmetic.
    endpoints, result = certificate_details([(40,40)] * 3)
    assert endpoints == [(F(1905242823,2147483648), ONE)] * 3
    assert result == (
        F(3568244821,4294967296), ONE, ZERO,
        F(28267292255,34359738368)
    )
    assert not accepts(result[0], F(1,10))

    # Exact integer check of the ideal all-pass sample boundary.
    assert 120 * 599**2870 > 600**2870
    assert 120 * 599**2871 < 600**2871

    # Exercise an informative acceptance regime using outward bounds.
    below = certify([(2870,2870)] * 3)
    above = certify([(2871,2871)] * 3)
    assert not accepts(below[0], F(1,10))
    assert accepts(above[0], F(1,10))
    assert above[3] <= F(1,10)

    # Check the reported square-root bracket directly.
    u = F(28267292255,34359738368)
    x = 4 * (ONE - F(3568244821,4294967296))
    assert (u - F(1,2**39))**2 < x <= u**2

    print("Optional arithmetic/threshold checks completed.")

if __name__ == "__main__":
    if "--checks" in sys.argv[1:]:
        optional_checks()
    suite()
\end{lstlisting}

\subsection{Why the arithmetic is outward}

The lower binomial tail in \eqref{eq:cpL} is increasing in its
probability argument. The lower side of its root bracket can only
decrease the lower confidence endpoint.
The CDF in \eqref{eq:cpU} is decreasing; the upper side can only
increase the upper endpoint.
The square-root routine returns an upper bracket.

After \(32\) bisections, each root bracket has width \(2^{-32}\).
For the three-setting lower fidelity, outward endpoint loss is at
most \(3\cdot2^{-33}\) before clipping.
After \(40\) square-root bisections, the untruncated doubled
square-root upper expression has an extra numerical allowance of
at most \(2^{-39}\).
These are deterministic arithmetic bounds, distinct from statistical
confidence.

The binomial recurrence's intermediate terms are integers
\[
 \binom ni a^i(b-a)^{n-i}
\]
when \(p=a/b\). The asserted exact division advances this term to the
next one. The optional direct-sum test checks this identity over a
finite set; the identity itself holds algebraically.

The exact \sourceid{accepts} function tests the mathematical expression
using the conservative returned \(F_L\).
It need not coincide at an extremely close boundary with testing the
separately rounded-up display \sourceid{ehi}.
Both conventions are conservative if their numerical meaning is
declared. For a laboratory implementation, archive which rule is
used.

\subsection{Further execution material needed}

A future reproducibility package should include the extracted script
and source hash, interpreter version, complete per-dataset counts,
all announced allowances and risks, and stdout or an equivalent
structured archive. Additional runs should exercise:
\begin{enumerate}
\item an informative acceptance regime, including perfect data above
the required sample threshold;
\item nonzero calibration and transfer allowances;
\item bounded missing-record scores and their proved bias;
\item declared drift and explicitly out-of-contract controls;
\item coverage uncertainty across independent diagnostic replications.
\end{enumerate}
These are additional execution tasks, not results inferred from the
supplied 140-dataset report.

\section*{Conclusion}

The calibrated reference-sensitive certificate remains
\[
 \boxed{
 \begin{gathered}
 \widehat F=\frac{1+\widehat c_x-\widehat c_y+\widehat c_z}{4},\\
 F_L=[\,\widehat F-R_{\rm s}-b_{\rm cal}\,]_{[0,1]},\\
 e(\Echan_\star)\le
 \min\{1,2\sqrt{1-F_L}+b\}
 \quad\text{with coverage at least }1-\alpha.
 \end{gathered}}
\]
Calibration failure risk is included in \(\alpha\), and the transfer
allowance \(b\) remains outside the square root.

The supplied script report records coverage of \(140/140\) simulated
datasets. It supplies a useful arithmetic and model diagnostic, not
laboratory calibration or a new proof of uniform coverage.
At 40 shots per setting, no dataset can meet the reported \(0.1\)
threshold. The reported zero invalid acceptances must be read in
that nonaccepting regime.

The paper certifies a fixed implemented decoder under a stated
contract, not its optimality, and keeps written proofs, supplied
computational evidence, and prospective laboratory measurements
separate.

\begin{thebibliography}{99}

\bibitem{Oai265A}
\emph{Oai265-A: Static Area Laws, Quantum Recovery, and Gravitational
Entropy: A Separation Theorem with a Source and Attachment Audit}.
Version 1, 12 October 2026.
User-supplied manuscript \sourceid{Oai265-A.tex}.
No independent compilation or proof-assistant verification is
asserted here.

\bibitem{ExecutionReport}
\emph{Oai265-B Appendix Code Execution Report}.
Undated user-supplied file \sourceid{summary (30).txt}.
Reports execution of the version-1 supplementary script with
seed 265, 20 repetitions per case, 40 shots per setting,
\(\alpha_{\rm s}=1/20\), and \(b_{\rm cal}=b=0\).
Contains first-repetition rational endpoints and aggregate
coverage counts. The execution is not independently reproduced
in this revision.

\bibitem{KlieschRoth}
M.~Kliesch and I.~Roth.
Theory of quantum system certification---a tutorial.
\emph{PRX Quantum} \textbf{2} (2021), 010201.
arXiv:2010.05925, version 3.
\url{https://arxiv.org/abs/2010.05925}.

\bibitem{FlammiaLiu}
S.~T.~Flammia and Y.-K.~Liu.
Direct fidelity estimation from few Pauli measurements.
\emph{Physical Review Letters} \textbf{106} (2011), 230501.
arXiv:1104.4695.
\url{https://arxiv.org/abs/1104.4695}.

\bibitem{DaSilvaEtAl}
M.~P.~da Silva, O.~Landon-Cardinal, and D.~Poulin.
Practical characterization of quantum devices without tomography.
\emph{Physical Review Letters} \textbf{107} (2011), 210404.
arXiv:1104.3835.
\url{https://arxiv.org/abs/1104.3835}.

\bibitem{FuchsVanDeGraaf}
C.~A.~Fuchs and J.~van de Graaf.
\emph{Cryptographic Distinguishability Measures for Quantum Mechanical
States}.
arXiv:quant-ph/9712042.
\url{https://arxiv.org/abs/quant-ph/9712042}.

\bibitem{Watrous}
J.~Watrous.
\emph{Simpler semidefinite programs for completely bounded norms}.
arXiv:1207.5726, version 2, 2012.
\url{https://arxiv.org/abs/1207.5726}.

\bibitem{Hoeffding}
W.~Hoeffding.
Probability inequalities for sums of bounded random variables.
\emph{Journal of the American Statistical Association}
\textbf{58} (1963), 13--30.
doi:10.1080/01621459.1963.10500830.

\bibitem{ClopperPearson}
C.~J.~Clopper and E.~S.~Pearson.
The use of confidence or fiducial limits illustrated in the case of
the binomial.
\emph{Biometrika} \textbf{26} (1934), 404--413.
doi:10.1093/biomet/26.4.404.

\bibitem{GST}
E.~Nielsen, J.~K.~Gamble, K.~Rudinger, T.~Scholten,
K.~Young, and R.~Blume-Kohout.
Gate set tomography.
\emph{Quantum} \textbf{5} (2021), 557.
arXiv:2009.07301.
\url{https://arxiv.org/abs/2009.07301}.

\bibitem{KSW}
D.~Kretschmann, D.~Schlingemann, and R.~F.~Werner.
The information-disturbance tradeoff and the continuity of
Stinespring's representation.
\emph{IEEE Transactions on Information Theory}
\textbf{54} (2008), 1708--1717.
arXiv:quant-ph/0605009.
\url{https://arxiv.org/abs/quant-ph/0605009}.

\bibitem{CheungEn07C}
N.~Cheung.
\emph{En07-C}, version 1, undated manuscript.
Supplied \sourceid{En07-C.tex} excerpts:
\sourceid{lem:choi}, \sourceid{lem:constant-error},
\sourceid{prop:featureless}, \sourceid{prop:entropy},
and complete-residual scope statements.
Enter Calculus Companion.
\url{https://enter.grok.me}.
Citations identify supplied excerpts, not independent verification.

\bibitem{CheungHawk04B}
N.~Cheung.
\emph{Hawk04-B: Black-Hole Information as an Access Problem:
Enter, Quantum Recovery, and Complete Residuals}.
Version 2, undated manuscript.
Especially \sourceid{thm:certificate},
\sourceid{prop:interval}, and \sourceid{prop:QND}.
Enter Calculus Companion.
\url{https://enter.grok.me/browse/Hawk04-B}.

\bibitem{CheungEn07A}
N.~Cheung.
\emph{En07-A}, version 1, undated manuscript.
Supplied excerpts on complete channels, selected entropy,
and the distinction between channel identities and Landauer cost.
Enter Calculus Companion.
\url{https://enter.grok.me}.

\bibitem{CheungEn07B}
N.~Cheung.
\emph{En07-B}, version 1, undated manuscript.
Supplied \sourceid{En07-B.tex},
especially \sourceid{prop:featureless} and \sourceid{prop:entropy}.
Enter Calculus Companion.
\url{https://enter.grok.me}.

\bibitem{CheungEn02B}
N.~Cheung.
\emph{En02-B}, version 1, undated manuscript.
Supplied \sourceid{En02-B-v1.tex},
especially \sourceid{thm:B1}, complete branch accounting,
and the declared decoder-module resource class.
Enter Calculus Companion.
\url{https://enter.grok.me}.

\bibitem{CheungEn02C}
N.~Cheung.
\emph{En02-C}, version 1, undated manuscript.
Supplied \sourceid{En02-C-v1.tex},
reference-preserving sequential soundness and
\sourceid{lem:constant}.
Enter Calculus Companion.
\url{https://enter.grok.me}.

\bibitem{CheungEn01C}
N.~Cheung.
\emph{En01-C}, version 1, undated manuscript.
Supplied \sourceid{En01-C.tex}, \sourceid{thm:certificate}:
bounded complete-record statistics, loss-model restrictions,
and calibration failure risk.
Enter Calculus Companion.
\url{https://enter.grok.me}.

\bibitem{CheungI}
N.~Cheung.
\emph{I}, version 2, undated manuscript.
Supplied \sourceid{I.tex},
\sourceid{lem:path} and \sourceid{thm:adequacy}.
Finite path maps and circuit/instrument adequacy.
Enter Calculus Companion.
\url{https://enter.grok.me}.

\bibitem{CheungEn06B}
N.~Cheung.
\emph{En06-B}, version 1, undated manuscript.
Supplied \sourceid{En06-B.tex},
\sourceid{prop:Bellinstrument} and the separate Bell-specimen
discussion.
Enter Calculus Companion.
\url{https://enter.grok.me}.

\bibitem{CheungEm05B}
N.~Cheung.
\emph{Em05-B}, version 1, undated manuscript.
Supplied \sourceid{Em05-B-v1.tex},
\sourceid{lem:Choi} and the flagged-instrument interface.
Enter Calculus Companion.
\url{https://enter.grok.me}.

\bibitem{CheungEm03E}
N.~Cheung.
\emph{Em03-E}, version 1, undated manuscript.
Supplied \sourceid{Em03-E-v1.tex},
the Pauli-channel distance identity and
\sourceid{thm:recovery}.
Optimality is restricted to its declared channel.
Enter Calculus Companion.
\url{https://enter.grok.me}.

\bibitem{CheungEm03G}
N.~Cheung.
\emph{Em03-G}, version 1, undated manuscript.
Supplied \sourceid{Em03-G-v1.tex},
\sourceid{lem:leakageBell}.
Complete-environment consequences of decoded Bell overlap.
Enter Calculus Companion.
\url{https://enter.grok.me}.

\bibitem{CheungEn04A}
N.~Cheung.
\emph{En04-A}, version 1, undated manuscript.
Supplied \sourceid{En04-A.tex},
\sourceid{thm:certificate} and \sourceid{cor:noimplication}.
Quantum return, channel allowances, and non-Clifford-resource
non-identification.
Enter Calculus Companion.
\url{https://enter.grok.me}.

\bibitem{CheungXVB}
N.~Cheung.
\emph{Landmark XV-B: Relative Lifting and Reconstruction Descent for
the Full Joint Characteristic Target}.
Version 2, undated manuscript.
Supplied \sourceid{XV-B.tex},
technical-continuation distinction and \sourceid{thm:release}.
Enter Calculus Companion.
\url{https://enter.grok.me/browse/XV-B}.

\bibitem{CheungXIVJ}
N.~Cheung.
\emph{XIV-J}, version 1, undated manuscript.
Supplied \sourceid{XIV-J.tex},
\sourceid{thm:J2} and \sourceid{cor:noadmission}.
The characteristic-map and quantum-admission interfaces are separate
from finite-memory certification.
Enter Calculus Companion.
\url{https://enter.grok.me}.

\end{thebibliography}

\end{document}