\documentclass[11pt]{article} \usepackage[T1]{fontenc} \usepackage[utf8]{inputenc} \usepackage{lmodern} \usepackage[margin=1in]{geometry} \usepackage{amsmath,amssymb,amsthm,mathtools} \usepackage{array,booktabs,tabularx,longtable} \usepackage{enumitem} \usepackage{microtype} \usepackage[hidelinks]{hyperref} \hypersetup{ pdftitle={Oai280-B: Finite-Confidence Certification of Boundary Reconstruction}, pdfsubject={Five-qubit perfect code, access-restricted recovery, complete channels, and simultaneous finite-data certification} } \setlength{\emergencystretch}{3em} \setlist[enumerate]{leftmargin=*,itemsep=3pt} \setlist[itemize]{leftmargin=*,itemsep=3pt} \newcolumntype{Y}{>{\raggedright\arraybackslash}X} \newtheorem{theorem}{Theorem}[section] \newtheorem{proposition}[theorem]{Proposition} \newtheorem{lemma}[theorem]{Lemma} \newtheorem{corollary}[theorem]{Corollary} \theoremstyle{definition} \newtheorem{definition}[theorem]{Definition} \newtheorem{assumption}[theorem]{Assumption} \newtheorem{record}[theorem]{Source record} \theoremstyle{remark} \newtheorem{remark}[theorem]{Remark} \DeclareMathOperator{\Tr}{Tr} \DeclareMathOperator{\id}{id} \DeclareMathOperator{\Ad}{Ad} \DeclareMathOperator{\rank}{rank} \DeclareMathOperator{\supp}{supp} \DeclareMathOperator{\diag}{diag} \newcommand{\bbC}{\mathbb C} \newcommand{\bbR}{\mathbb R} \newcommand{\bbN}{\mathbb N} \newcommand{\B}{\mathcal B} \newcommand{\ket}[1]{\lvert #1\rangle} \newcommand{\bra}[1]{\langle #1\rvert} \newcommand{\kb}[2]{\lvert #1\rangle\langle #2\rvert} \newcommand{\norm}[1]{\left\lVert #1\right\rVert} \newcommand{\abs}[1]{\left\lvert #1\right\rvert} \newcommand{\ddia}{d_{\diamond}} \newcommand{\dtr}{d_{\mathrm{tr}}} \newcommand{\clip}[1]{[\,#1\,]_{[0,1]}} \newcommand{\sourceid}[1]{\texttt{\detokenize{#1}}} \newcommand{\CX}{\operatorname{CX}} \newcommand{\CZ}{\operatorname{CZ}} \title{\textbf{Oai280-B}\\[4pt] Finite-Confidence Certification of Boundary Reconstruction\\ in Five-Qubit Perfect-Tensor Codes} \author{Ngo Cheung} \date{Version 1 --- 12 October 2026} \begin{document} \maketitle \begin{abstract} We connect an explicit five-qubit encoding, a declared boundary access interface, and a complete deterministic decoder to a simultaneous finite-data quantum-channel certificate. The encoding is printed entrywise and realized by a fixed Clifford circuit. A syndrome calculation proves privacy of every boundary set of at most two qubits. Every set of at least three qubits admits an explicitly constructed accessible decoder; the optimal half-diamond recovery error for the smaller sets is exactly \(3/4\). The associated six-qubit state is proved perfect. For implemented channels, all failed attempts and decoder branches are retained. Conditional fixed-sample validation using three Bell correlations gives simultaneous reference-preserving error bounds, with calibration allowances in the fidelity interval and channel-transfer allowances outside the square root. We derive the certificate-specific sample requirements, an exact binomial alternative, and a linear conversion for independently established Pauli channels, including a physically randomized task. The paper also constructs a two-pentagon tensor network with an explicit normalization and accessible subsystem decoders. A finite-spectator extension of the three-correlation certificate bounds recovery of one logical factor on arbitrary referenced bulk inputs. No experimental dataset, executed simulation, successful compilation, gravitational dictionary, metric reconstruction, Page curve, or inherited characteristic quantum coefficient is claimed. \end{abstract} \paragraph{Keywords.} Quantum error correction; perfect tensor; boundary access; deterministic decoder; diamond norm; finite-confidence certificate; logical subsystem; complete failure accounting. \tableofcontents %===================================================================== \section{Scope, contributions, and dependency policy} \label{sec:scope} %===================================================================== The five-qubit perfect code is established quantum error-correction theory \cite{Laflamme,KnillLaflamme}. Perfect tensors furnish the building blocks of the holographic tensor-network codes of Pastawski, Yoshida, Harlow, and Preskill \cite{HaPPY}. Experimental five-qubit encoding and decoding are also established \cite{Gong}. We claim neither a new code nor a first implementation. The contribution here is a connected operational construction: \[ \boxed{ \text{one printed encoding} \;+\;\text{one audited access interface} \;+\;\text{one complete decoder} \;+\;\text{one validation contract}.} \] The finite statistical certificate concerns the resulting end-to-end logical channel, not a region name or a sector tag. Cheung's supplied En02-B record already identifies the ideal five-qubit access threshold and distinguishes resource-limited execution from information-theoretic recovery \cite{CheungEn02B}. Oai280-A supplies the simultaneous three-correlation certificate \cite{Oai280A}; Oai265-B and Oai290-A supply related finite-confidence and decision architectures \cite{CheungOai265B,CheungOai290A}. The results needed below are proved locally with their actual finite hypotheses. No supplied companion manuscript is a theorem premise. \subsection{What is completed} The paper supplies: \begin{enumerate} \item an entrywise \(32\times2\) encoding matrix and a gate sequence; \item exact access results for all \(32\) boundary subsets; \item matrix-defined accessible decoders for every authorized set, and a gate-level two-slot streaming decoder for a named triple; \item a complete channel and register ledger; \item simultaneous finite-data certification and its acceptance guarantee; \item certificate-specific feasibility calculations, exact binomial inversion, and justified structure-assisted conversion; \item an analytically solved flagged-erasure benchmark; \item a normalized two-pentagon network and a finite-factor subsystem certificate. \end{enumerate} No validation data were supplied. Consequently no measured reconstruction map, numerical acceptance study, or hardware result can honestly be reported. The decision table in Section~\ref{sec:reporting} is a reporting interface, not an invented dataset. \subsection{Debugging the proposed inference} The following distinctions are maintained throughout. \begin{enumerate} \item \textbf{Encoding identification and decoder performance differ.} A successful end-to-end certificate does not independently identify the physical encoder with the ideal tensor. \item \textbf{Access is an interface, not a caption.} A decoder receiving an omitted syndrome or simulator side information does not implement the declared boundary task. \item \textbf{A branch is not a complete channel.} Successful trials cannot be renormalized into the deterministic channel being certified. \item \textbf{An implemented-decoder exclusion is not an optimal-decoder exclusion.} The latter requires a bound uniform over all permitted decoders. \item \textbf{The ideal threshold is cardinality.} For one pentagon, connectedness of a subset in a drawing does not change its ideal recovery threshold. \item \textbf{Clifford circuitry does not imply Pauli noise.} A structure-assisted bound requires an independently established channel structure or a separately specified randomization task. \item \textbf{Forty shots is a procedure-specific limitation.} It is not a universal lower bound for every laboratory protocol. \item \textbf{A fixed spectator is not an arbitrary spectator.} The stronger subsystem task must be compared with a partial-trace channel on all referenced inputs. \item \textbf{The unrelated analytic programme remains unrelated.} Finite channel certification does not construct a characteristic distributional product or admit an inherited gravitational coefficient. \end{enumerate} %===================================================================== \section{Conventions and the explicit five-qubit encoding} \label{sec:encoding} %===================================================================== All Hilbert spaces in the proved operational results are finite dimensional. Channels are completely positive and trace preserving (CPTP) on full matrix spaces. Set \[ \dtr(\rho,\sigma)=\frac12\norm{\rho-\sigma}_1, \qquad \ddia(\Phi,\Psi)=\frac12\norm{\Phi-\Psi}_\diamond. \] The diamond norm includes arbitrary independent external references. Its standard finite-dimensional conventions are those of Watrous \cite{Watrous}. Let \[ C=\bbC^2,\qquad H_\partial=(\bbC^2)^{\otimes5}. \] Boundary legs are ordered \(1,2,3,4,5\), and computational basis strings are ordered lexicographically with leg \(1\) first. Addition in binary exponents is modulo two. For \(x=(x_1,\ldots,x_5)\in\{0,1\}^5\), define \[ p(x)=x_1+x_2+x_3+x_4+x_5, \qquad q(x)=x_1x_2+x_2x_3+x_3x_4+x_4x_5+x_5x_1. \] \begin{definition}[Printed encoding matrix] \label{def:V} The matrix \(V:C\to H_\partial\) is defined, for every row \(x\) and column \(i\in\{0,1\}\), by \begin{equation} V_{x,i} =\frac14(-1)^{q(x)+i}\,\mathbf1_{\{p(x)=i\}}. \label{eq:Vmatrix} \end{equation} Write \(\ket{0_L}=V\ket0\), \(\ket{1_L}=V\ket1\), and \(\mathcal V(M)=VMV^\dagger\). \end{definition} Equation~\eqref{eq:Vmatrix} specifies all \(64\) matrix entries, including zeros and phases; it is not a definition only up to logical basis or local Clifford equivalence. Let \(H\) be the Hadamard gate and \(S=\diag(1,i)\). Define \[ U_G=\CZ_{12}\CZ_{23}\CZ_{34}\CZ_{45}\CZ_{51}, \qquad U_{\mathrm{par}}=\CX_{2\to1}\CX_{3\to1} \CX_{4\to1}\CX_{5\to1}. \] Products act on vectors from right to left. \begin{proposition}[Encoding circuit and isometry] \label{prop:encoding} The gate sequence \begin{equation} U_{\mathrm{enc}} =U_GU_{\mathrm{par}} (I_1\otimes H_2\otimes H_3\otimes H_4\otimes H_5)Z_1 \label{eq:encircuit} \end{equation} satisfies \[ U_{\mathrm{enc}}(\ket i_1\ket{0000}_{2345})=V\ket i, \qquad V^\dagger V=I_2. \] It uses one \(Z\), four Hadamards, four CNOTs, and five controlled \(Z\) gates, with the displayed leg ordering. \end{proposition} \begin{proof} After \(Z_1\) and the four Hadamards, the state is \[ \frac{(-1)^i}{4} \sum_{y_2,\ldots,y_5} \ket i_1\ket{y_2y_3y_4y_5}. \] The four CNOTs change the first bit to \(x_1=i+y_2+y_3+y_4+y_5\), so the final string has parity \(i\). The five controlled \(Z\) gates multiply its amplitude by \((-1)^{q(x)}\). This gives \eqref{eq:Vmatrix}. Each column has exactly \(16\) entries of magnitude \(1/4\), hence norm one. The columns have disjoint parity supports, hence are orthogonal. This also tests \(V^\dagger V=I_2\) directly. \end{proof} The gate count is a count for the declared abstract library, not a nearest-neighbor compilation, a hardware depth, or an optimality claim. \subsection{The stabilizer convention} Use the Pauli matrices \(X,Y,Z\), with \(Y=iXZ\), and set \begin{equation} \begin{split} g_1&=XZZXI,& g_2&=IXZZX,\\ g_3&=XIXZZ,& g_4&=ZXIXZ, \end{split} \qquad \overline X=XXXXX,\quad \overline Z=ZZZZZ. \label{eq:stabilizers} \end{equation} \begin{proposition}[Exact code identification] \label{prop:stabilizers} The range of \(V\) is the simultaneous \(+1\) eigenspace of \(g_1,\ldots,g_4\). Moreover, \[ \overline XV=VX,\qquad \overline ZV=VZ. \] \end{proposition} \begin{proof} Let \[ \ket G=U_G\ket{+}^{\otimes5}, \qquad K_j=X_jZ_{j-1}Z_{j+1}, \] with cyclic indices. Conjugating \(X_j\) by \(U_G\) gives \(K_j\), so the \(K_j\) stabilize \(\ket G\). They are independent: a product of a nonempty subset has a nonzero binary \(X\)-support on precisely that subset. Direct multiplication gives \[ g_1=K_1K_4,\quad g_2=K_2K_5,\quad g_3=K_1K_3,\quad g_4=K_2K_4. \] The four corresponding binary vectors are independent. Their common \(+1\) eigenspace therefore has dimension \(2\); equivalently the stabilizer projector has trace \(32/16=2\). Writing \(Z^{\otimes5}=Z_{\mathrm{all}}\), the entrywise formula gives \[ \ket{0_L}=\frac{\ket G+Z_{\mathrm{all}}\ket G}{\sqrt2}, \qquad \ket{1_L}=-\frac{\ket G-Z_{\mathrm{all}}\ket G}{\sqrt2}. \] Every \(g_j\) commutes with \(Z_{\mathrm{all}}\), and hence stabilizes both columns. Thus their span is the whole two-dimensional stabilizer space. The parity rule gives \(\overline ZV=VZ\). Complementing every bit preserves parity up to one and satisfies \[ q(1-x)=q(x)+1 \] modulo two. Comparing the two columns in \eqref{eq:Vmatrix} therefore gives \(\overline XV=VX\). \end{proof} %===================================================================== \section{Privacy, perfectness, and exact access-dependent recovery} \label{sec:access} %===================================================================== For \(A\subseteq\{1,\ldots,5\}\), let \(\bar A\) be its complement, and order both subsets increasingly. Let \[ \Pi_A:H_\partial\longrightarrow H_A\otimes H_{\bar A} \] be the corresponding tensor permutation. Define \begin{equation} \begin{split} \mathcal N_A(M) &=\Tr_{\bar A}(\Pi_AVMV^\dagger\Pi_A^\dagger),\\ \mathcal C_A(M) &=\Tr_A(\Pi_AVMV^\dagger\Pi_A^\dagger). \end{split} \label{eq:accesschannels} \end{equation} These are two reductions of the same encoding. \subsection{A complete syndrome check} For a Pauli operator \(P\), its syndrome is the four-bit vector \(s(P)\) specified by \[ g_jP=(-1)^{s(P)_j}Pg_j. \] The single-qubit syndromes are: \begin{center} \begin{tabular}{@{}cccc@{}} \toprule Leg & \(s(X_j)\) & \(s(Z_j)\) & \(s(Y_j)\)\\ \midrule 1 & 0001 & 1010 & 1011\\ 2 & 1000 & 0101 & 1101\\ 3 & 1100 & 0010 & 1110\\ 4 & 0110 & 1001 & 1111\\ 5 & 0011 & 0100 & 0111\\ \bottomrule \end{tabular} \end{center} \begin{lemma}[Two-qubit privacy] \label{lem:privacy} For every subset \(B\) with \(|B|\le2\) and every matrix \(M\in\B(C)\), \begin{equation} \Tr_{\bar B}(\Pi_BVMV^\dagger\Pi_B^\dagger) =\Tr(M)\frac{I_B}{2^{|B|}}. \label{eq:privacy} \end{equation} The identity holds on every matrix unit and after amplification by every independent reference. \end{lemma} \begin{proof} The printed syndrome table follows by counting local Pauli anticommutations in \eqref{eq:stabilizers}. Its \(15\) entries are exactly the \(15\) nonzero four-bit vectors. A nonidentity Pauli of weight one has nonzero syndrome. A weight-two Pauli is a product of single-qubit Paulis on distinct legs. Its syndrome is the sum of two distinct entries and is therefore nonzero. If \(P\) anticommutes with some \(g_j\), then \[ V^\dagger PV=V^\dagger g_jPg_jV=-V^\dagger PV, \] so \(V^\dagger PV=0\). Expanding an arbitrary observable on \(B\) in its Pauli basis shows that the reduced channel has only its identity coefficient. Trace preservation fixes that coefficient as the right-hand side of \eqref{eq:privacy}. This is an operator identity for all \(M\), not just a statement about diagonal input states. Tensoring the channel identity with a reference proves the last assertion. \end{proof} This proves locally the ideal privacy assertion attributed to En02-B \sourceid{lem:privacy} \cite{CheungEn02B}. \subsection{The six-leg perfect state} Let \[ \ket{\Phi_2}=\frac{\ket{00}+\ket{11}}{\sqrt2}, \qquad \ket T=(I_Q\otimes V)\ket{\Phi_2}. \] \begin{proposition}[Six-leg perfectness] \label{prop:perfect} Every reduction of \(\ket T\) to three of its six qubit legs is \(I_8/8\). Consequently every reduction to at most three legs is maximally mixed. \end{proposition} \begin{proof} A triple containing \(Q\) consists of \(Q\) and two boundary legs \(B\). Lemma~\ref{lem:privacy}, applied to the Bell matrix-unit expansion, gives \[ \rho_{QB}=\frac{I_Q}{2}\otimes\frac{I_B}{4}=\frac{I_8}{8}. \] A triple not containing \(Q\) has a complementary triple containing \(Q\). Since \(\ket T\) is pure and both triple spaces have dimension eight, their reduced states have the same eigenvalues. The first calculation therefore makes the second triple maximally mixed too. Smaller reductions follow by partial trace. \end{proof} This is the finite perfect-tensor property used here. It supplies a HaPPY building block \cite{HaPPY}, not an extended gravitational geometry. \subsection{The complete-complement criterion} We restate the needed exact recovery theorem, fixing its decoder domain and its off-support completion. The principle is standard exact quantum error correction \cite{KnillLaflamme}; related complete-output formulations occur in \cite{Oai280A,CheungHawk04B,CheungEn07A,CheungEn07B}. \begin{theorem}[Exact complete-complement criterion] \label{thm:exact} Let \(W:C_d\to R\otimes B\) be a finite-dimensional isometry and let \(\mathcal N,\mathcal C\) be its two reductions. The following are equivalent: \begin{enumerate} \item a CPTP decoder \(D:\B(R)\to\B(C_d)\) satisfies \(D\mathcal N=\id_{C_d}\); \item \(\mathcal C(M)=\Tr(M)\tau_B\) for one state \(\tau_B\); \item \(\mathcal C(E_{ij})=\delta_{ij}\tau_B\) for every matrix unit. \end{enumerate} If \(r=\rank\tau_B\), then \(\dim R\ge dr\). The recovered channel preserves every independent external reference. \end{theorem} \begin{proof} The equivalence of the last two statements is linearity. For the forward direction, dilate the decoder by an isometry \(L:R\to C_d\otimes G\). Then \[ Z=(L\otimes I_B)W \] dilates the identity. Purity of its decoded marginal on a basis input gives \(Z\ket i=\ket i\ket{\chi_i}\). Recovery of \(E_{ij}\) gives \(\langle\chi_j,\chi_i\rangle=1\). All normalized \(\chi_i\) coincide. Tracing \(C_dG\) proves constancy of the complement. Conversely, diagonalize \(\tau_B=\sum_{a=1}^r\lambda_a\kb aa\), with \(\lambda_a>0\). Write \[ W\ket i=\sum_a\sqrt{\lambda_a}\ket{u_{ia}}\ket a. \] The complementary matrix-unit identities give \[ \langle u_{jb},u_{ia}\rangle=\delta_{ij}\delta_{ab}. \] Thus \(dr\) vectors in \(R\) are orthonormal. Define the isometry \(T:C_d\otimes\bbC^r\to R\) by \(T\ket{i,a}=\ket{u_{ia}}\), and let \(\tau_K=\sum_a\lambda_a\kb aa\). Then \[ \mathcal N(M)=T(M\otimes\tau_K)T^\dagger. \] For any fixed state \(\omega\) on \(C_d\), \[ D(Y)=\Tr_K(T^\dagger YT) +\Tr((I-TT^\dagger)Y)\omega \] is CP and trace preserving on all of \(R\), and recovers every matrix unit. Equality of channels remains equality after reference amplification. \end{proof} \subsection{Explicit accessible decoders} For \(|A|=m\ge3\), put \(k=5-m\) and \(K_A=(\bbC^2)^{\otimes k}\). Define vectors and a matrix using the printed \(V\): \begin{equation} \begin{split} \ket{u^A_{i,b}} &=2^{k/2}(I_A\otimes\bra b_{\bar A})\Pi_AV\ket i,\\ T_A\ket{i,b}&=\ket{u^A_{i,b}}, \qquad i\in\{0,1\},\quad b\in\{0,1\}^k. \end{split} \label{eq:TA} \end{equation} \begin{theorem}[All ideal access channels and their optimal errors] \label{thm:idealaccess} For the encoding \eqref{eq:Vmatrix}: \begin{enumerate} \item If \(m\ge3\), then \[ \mathcal C_A(M)=\Tr(M)\frac{I_{\bar A}}{2^k}, \qquad T_A^\dagger T_A=I_{C\otimes K_A}, \] and \begin{equation} \begin{split} \mathcal N_A(M)&=T_A(M\otimes I_{K_A}/2^k)T_A^\dagger,\\ D_A(Y)&=\Tr_{K_A}(T_A^\dagger YT_A) +\Tr((I_A-T_AT_A^\dagger)Y)\frac{I_2}{2} \end{split} \label{eq:DA} \end{equation} satisfies \(D_A\mathcal N_A=\id_2\). \item If \(m\le2\), then \[ \mathcal N_A(M)=\Tr(M)\frac{I_A}{2^m}, \] and \begin{equation} \inf_{D:\B(H_A)\to\B(C)\ {\rm CPTP}} \ddia(D\mathcal N_A,\id_2)=\frac34. \label{eq:negative} \end{equation} \item In the second case, the complement is nonconstant and is itself exactly recoverable. More explicitly, \[ \mathcal C_A(M) =T_{\bar A}(M\otimes I_A/2^m)T_{\bar A}^\dagger. \] \end{enumerate} Every assertion concerns the full logical qubit, including its reference entanglement. \end{theorem} \begin{proof} For \(m\ge3\), the omitted set has size \(k\le2\), so Lemma~\ref{lem:privacy} gives the complementary matrix-unit identities. Comparing their entries gives \[ \langle u^A_{j,b'},u^A_{i,b}\rangle =\delta_{ij}\delta_{b'b}. \] Expanding \(V\ket i\) in the omitted computational basis proves the first line of \eqref{eq:DA}. The second line is the complete decoder in Theorem~\ref{thm:exact}; alternatively its traces add to \(\Tr Y\), and direct substitution returns \(M\). For \(m\le2\), privacy makes the accessible channel replacement. Every subsequent decoder is therefore replacement by some state \(\omega\). On a Bell input its output is \(I_Q/2\otimes\omega\), whose Bell overlap is \(1/4\). The Bell-projector test gives error at least \(3/4\). The decoder returning \(I_2/2\) attains the bound. Indeed the completely depolarizing channel is \[ \mathcal T(M)=\Tr(M)\frac{I_2}{2} =\frac14(\id+\Ad_X+\Ad_Y+\Ad_Z)(M). \] The triangle inequality gives \(\ddia(\mathcal T,\id)\le3/4\), matching the Bell lower bound. Finally \(|\bar A|\ge3\), so the first part, with the roles interchanged, gives the displayed complement formula and its exact recovery. It cannot be constant because it recovers two distinct logical inputs. \end{proof} \subsection{The complete ideal region table} Strings such as \(124\) denote the set \(\{1,2,4\}\). All subsets are covered below. \begin{center} \small \begin{tabularx}{\linewidth}{@{}cYccc@{}} \toprule \(m\) & Regions \(A\) & Accessible channel & Complete complement & Optimal error\\ \midrule 0 & \(\varnothing\) & Replacement & Recoverable & \(3/4\)\\ 1 & \(1,2,3,4,5\) & Replacement & Recoverable & \(3/4\)\\ 2 & \(12,13,14,15,23,24,25,34,35,45\) & Replacement & Recoverable & \(3/4\)\\ 3 & \(123,124,125,134,135,145,234,235,245,345\) & Recoverable & \(I_4/4\) replacement & \(0\)\\ 4 & \(1234,1235,1245,1345,2345\) & Recoverable & \(I_2/2\) replacement & \(0\)\\ 5 & \(12345\) & Isometric & Scalar replacement & \(0\)\\ \bottomrule \end{tabularx} \end{center} Here ``recoverable'' means the constructive channel \eqref{eq:DA}; it is not just an existence label. For each triple the decoder matrix is completely specified by \eqref{eq:TA}. The corresponding omissions are: \begin{center} \begin{tabular}{@{}cc|cc|cc|cc|cc@{}} \toprule \(A\)&\(\bar A\)&\(A\)&\(\bar A\)&\(A\)&\(\bar A\)& \(A\)&\(\bar A\)&\(A\)&\(\bar A\)\\ \midrule 123&45&124&35&125&34&134&25&135&24\\ 145&23&234&15&235&14&245&13&345&12\\ \bottomrule \end{tabular} \end{center} For every triple, \(T_A\) is an \(8\times8\) unitary, and \(D_A=\Tr_{K_A}\circ\Ad_{T_A^\dagger}\). %===================================================================== \section{Accessible circuits, streaming resources, and effect traps} \label{sec:circuits} %===================================================================== \subsection{A finite circuit specification for every authorized set} Equation~\eqref{eq:TA} is also an algorithmic circuit specification; it uses no quantum access to \(\bar A\). For \(m\ge3\), complete the orthonormal family \(\{u^A_{i,b}\}\) by applying Gram--Schmidt to the computational basis in lexicographic order, omitting zero residuals. Set \(t=m-k-1\ge0\). Define a unitary \(U_A\) that sends \[ u^A_{i,b}\longmapsto \ket i\ket b\ket{0^t}, \] and sends the added basis vectors, in their construction order, to the unused computational basis vectors in lexicographic order. The decoding program is: \begin{enumerate} \item apply \(U_A\) on the \(m\) accessible qubits; \item read the last \(t\) qubits in the computational basis; \item if their string is \(0^t\), return the first qubit and discard the \(k\) syndrome qubits; \item otherwise discard all remaining data and return \(I_2/2\). \end{enumerate} For \(t=0\), the third step is unconditional. This program implements exactly \eqref{eq:DA}. The successful projector is \(T_AT_A^\dagger\); coherences between it and its orthogonal complement are removed by the complete measurement. For a fully finite gate description, one may decompose the specified matrix \(U_A\) into two-level unitaries by column elimination. When eliminating entries \(a,b\), use, if \(r=(|a|^2+|b|^2)^{1/2}>0\), \[ \frac1r \begin{pmatrix} \overline a&\overline b\\ -b&a \end{pmatrix}. \] Its product with \((a,b)^{\mathsf T}\) is \((r,0)^{\mathsf T}\). After finitely many eliminations the remaining diagonal phases complete the decomposition. Reversing the factors gives \(U_A\). Here arbitrary two-level gates on the declared accessible register are admitted. No gate acts on an omitted register. This is not an efficiency or hardware-native compilation claim. For triples the simpler specification is \[ U_A=T_A^\dagger, \] whose entries are explicitly the conjugate transpose of \eqref{eq:TA} evaluated using \eqref{eq:Vmatrix}. \subsection{A gate-level decoder for \(A=123\)} For this triple define \[ R_X=-Z_1X_2Z_3,\qquad R_Y=-X_1Y_2X_3,\qquad R_Z=-Y_1Z_2Y_3. \] \begin{lemma}[Triple channel and logical representatives] \label{lem:triple} For \(\rho=(I+r_xX+r_yY+r_zZ)/2\), \begin{equation} \mathcal N_{123}(\rho) =\frac18(I+r_xR_X+r_yR_Y+r_zR_Z). \label{eq:N123} \end{equation} The representatives satisfy \[ R_jV=V\sigma_j,\qquad R_XR_Z=-iR_Y. \] \end{lemma} \begin{proof} For \(R_Z\), multiplication by \(\overline Z\) gives \(R_Z\overline Z=g_3\), so its action on the code is logical \(Z\). For \(R_X\), \(R_X\overline X=YIYXX\). The latter is the cyclic shift by two positions of \(g_2g_3\), and is a stabilizer. Cyclic shifts preserve the code because \eqref{eq:Vmatrix} is cyclically invariant. Thus \(R_X\) acts as logical \(X\). Direct Pauli multiplication then gives the \(R_Y\) assertions. For completeness, the syndrome map on the six binary Pauli coordinates of \(123\) has rank four. For example the syndromes of \(X_1,X_2,Z_2,Z_3\) are independent. Its kernel has dimension two, and its three nonidentity elements are the unsigned versions of \(R_X,R_Y,R_Z\). Every other nonidentity Pauli on the triple compresses to zero. Also \(\mathcal N_{123}(I/2)=I_8/8\) by Proposition~\ref{prop:perfect}. Pauli expansion now gives \eqref{eq:N123}. \end{proof} Set \begin{equation} B_{12}=H_1S_1^\dagger\CX_{1\to2}H_2,\qquad R_3^{\mathrm{rot}}=H_3S_3^\dagger,\qquad C_{ts}=X_3^{1-t}Z_3^{1-s}. \label{eq:streamgates} \end{equation} \begin{proposition}[Complete two-slot streaming decoder] \label{prop:streamdecoder} Receive carriers \(1,2,3\) in that order. Retain carrier \(1\) until carrier \(2\) arrives, apply \(B_{12}\), destructively read carriers \(1,2\) as \(t,s\), then receive carrier \(3\), apply \(C_{ts}R_3^{\mathrm{rot}}\), and return it. This is a complete CPTP decoder and satisfies \[ D_{123}^{\mathrm{str}}\mathcal N_{123}=\id_2. \] Its peak is two live quantum carriers, excluding the independent validation reference and the incoming carriers before admission to the decoder apparatus. \end{proposition} \begin{proof} Conjugation gives \[ B_{12}(Z_1X_2)B_{12}^\dagger=Z_2,\qquad B_{12}(Y_1Z_2)B_{12}^\dagger=Z_1, \] and hence \[ B_{12}(X_1Y_2)B_{12}^\dagger=-Z_1Z_2. \] The third-qubit rotation maps \(Z\mapsto X\), \(Y\mapsto Z\), \(X\mapsto Y\). Thus, before the classical correction, the branch \(t,s\) has probability \(1/4\) and normalized output \[ \frac12\left( I+(-1)^{s+1}r_xX +(-1)^{t+s}r_yY +(-1)^{t+1}r_zZ \right). \] Conjugation by \(C_{ts}\) removes all three signs. Each of the four unnormalized branch maps is therefore \(\rho\mapsto\rho/4\) on the encoded input. Summing the branches returns \(\rho\). Linearity proves the equality on every matrix and every referenced input. On arbitrary physical triple inputs, the program consists of unitaries, a complete two-qubit measurement, conditional unitaries, and quantum return. It is therefore CPTP without postselection. At most carriers \(1,2\) are simultaneously live; after their consumption only carrier \(3\) is live. \end{proof} This locally verifies the decoding architecture discussed in En02-B and En02-E \cite{CheungEn02B,CheungEn02E}. Cyclic relabeling gives such a program for the five cyclic consecutive triples. The matrix decoder above covers all ten triples without asserting the same optimized resource cost. \subsection{A sharp one-slot obstruction in a specified interface} \begin{assumption}[Ordered one-slot streaming class] \label{ass:stream} Carriers arrive in order \(1,2,3\). A carrier must enter the apparatus before being operated on. At most one quantum system of qubit capacity is live in the apparatus at a time. No quantum scratch space, intermediate quantum output, preshared entangled ancilla, or access to the validation reference is available. Arbitrary classical memory and arbitrary permitted single-qubit instruments are allowed. A consumed carrier leaves only its classical history. \end{assumption} \begin{theorem}[Sharp one-slot recovery error] \label{thm:oneslot} Under Assumption~\ref{ass:stream}, \[ \inf_{\text{one-slot programs }\pi} \ddia(D_\pi\mathcal N_{123},\id_2)=\frac12. \] In particular exact recovery in this interface requires peak at least two, and Proposition~\ref{prop:streamdecoder} attains it. \end{theorem} \begin{proof} The Bell-input state is, by \eqref{eq:N123}, \[ \omega_{Q123} =\frac1{16}\left( I-X_QZ_1X_2Z_3+Y_QX_1Y_2X_3-Z_QY_1Z_2Y_3 \right). \] Before carrier \(2\) enters a one-slot apparatus, carrier \(1\) must be consumed. Each complete classical history from that carrier has a POVM effect \[ E=\frac{\Tr E}{2}(I+v_xX+v_yY+v_zZ), \qquad \norm v_2\le1. \] For a positive-probability outcome, the conditional state is \[ \omega_{Q23\mid E} =\frac18(I-v_zX_QA+v_xY_QB-v_yZ_QC), \] where \[ A=X_2Z_3,\qquad B=Y_2X_3,\qquad C=Z_2Y_3,\qquad AB=-C. \] The independent commuting operators \(A,B\) have rank-one joint projectors \[ P_{\alpha\beta}=\frac14(I+\alpha A)(I+\beta B), \qquad \alpha,\beta\in\{\pm1\}. \] Consequently \[ \omega_{Q23\mid E} =\frac14\sum_{\alpha,\beta} \frac{I-\alpha v_zX_Q+\beta v_xY_Q+ \alpha\beta v_yZ_Q}{2} \otimes P_{\alpha\beta}. \] Every first factor is a state because its Bloch vector has length at most one. The conditional state is separable across \(Q\mid23\). Subsequent decoder operations, including classical conditioning, preserve this separability. A separable two-qubit state has Bell overlap at most \(1/2\): the claim holds for pure product states by Cauchy--Schwarz and extends by convexity. The Bell-projector test therefore gives half-diamond error at least \(1/2\). For attainment, destructively measure \(Z_1,X_2,Z_3\) sequentially, report the negative product of their eigenvalues, and prepare the corresponding logical \(X\)-eigenstate. This realizes \[ \Delta_X=\frac12(\id+\Ad_X). \] Its Bell overlap is \(1/2\), and the displayed mixture gives half-diamond error at most \(1/2\). The program uses one slot, including its final state preparation. \end{proof} The theorem reproduces, with a local proof, the specifically scoped streaming separation recorded in En02-C \cite{CheungEn02C}. It is not unrestricted decoder optimality under an unspecified memory model. \subsection{The effect trap} \begin{proposition}[Logical readout is not full quantum return] \label{prop:effecttrap} On the authorized triple \(123\), logical \(Z\)-readout can be implemented by sequentially measuring \(Y_1,Z_2,Y_3\) and reporting their negative parity. Measuring and then preparing the reported logical \(Z\)-eigenstate realizes the logical rank-one L\"uders instrument. Its unconditional channel is \[ \Delta_Z=\frac12(\id+\Ad_Z), \qquad \ddia(\Delta_Z,\id_2)=\frac12. \] Thus exact logical \(Z\)-statistics, and even the corresponding rank-one selective instrument, do not certify full-code recovery. \end{proposition} \begin{proof} The measured product is \(R_Z\), so Lemma~\ref{lem:triple} gives the logical projective effects. For a rank-one projector \(P_t=\kb tt\), the measure-and-prepare map is \[ \rho\longmapsto \Tr(P_t\rho)P_t=P_t\rho P_t, \] including its action on a reference. Summing gives dephasing. Its Pauli mixture gives the upper error \(1/2\), while the Bell overlap \(1/2\) gives the matching lower bound. \end{proof} This is the finite distinction emphasized in \cite{CheungEn02B,Oai280A,CheungOai290A,CheungXVIIA}. Destructive readout retains its destructive meaning \cite{CheungI}; it is not renamed as coherent decoding. %===================================================================== \section{Access as a circuit invariant and the complete channel} \label{sec:implemented} %===================================================================== \subsection{The access contract} \begin{definition}[Admissible accessible decoder] \label{def:accesscontract} After the access cut, the decoder receives exactly its declared accessible interface. It may use: \begin{enumerate} \item quantum registers in \(A\); \item fresh local ancillas in fixed states independent of the logical input, omitted registers, and external reference; \item records generated from operations on its received interface; \item deterministic classical feedforward. \end{enumerate} It receives no omitted register, omitted-register syndrome, hidden encoding environment, input label, validation reference, or privileged simulator state. Every terminal branch has a specified logical qubit output. \end{definition} A joint inverse on all five legs is forbidden when it uses inaccessible legs. For \(A=12345\), all five legs are accessible, and a joint inverse is not an access violation. This qualification repairs an overly broad version of the prohibition. \begin{proposition}[Access factorization and its invariant] \label{prop:accessfactor} A finite decoder program satisfying Definition~\ref{def:accesscontract} defines a CPTP map \(D_A:\B(H_A)\to\B(C)\). Its extension to a complete boundary input is \[ \Psi_A=D_A\Tr_{\bar A}, \qquad \Psi_A^*(O)=D_A^*(O)\otimes I_{\bar A}. \] Equal accessible restrictions therefore give equal returned states, including when an independent reference is retained. Conversely, for a CPTP map \(\Psi:\B(H_A\otimes H_{\bar A})\to\B(C)\), the following are equivalent: \begin{enumerate} \item \(\Psi=D\Tr_{\bar A}\) for a CPTP map \(D\); \item equal \(A\)-marginals always give equal returned states; \item \(\Psi^*(\B(C))\subseteq\B(H_A)\otimes I_{\bar A}\). \end{enumerate} \end{proposition} \begin{proof} Fresh preparation, accessible gates, complete instruments, classical control, and complete branch summation compose to a CPTP map on the received interface. Induction over the program cannot introduce dependence on an unreceived input. Factorization gives the adjoint formula and snapshot determination. Conversely, let \(h=h^*\) be an adjoint output observable under statement two. If a traceless Hermitian \(M\) satisfies \(\Tr_{\bar A}M=0\), then for sufficiently small positive \(t\), the states \(I/\dim H\pm tM\) have equal \(A\)-marginals. Thus \(\Tr(hM)=0\). The Hilbert--Schmidt orthogonal complement of \(\ker\Tr_{\bar A}\) is \(\B(H_A)\otimes I_{\bar A}\), proving statement three. Complex linearity handles all output observables. Under containment write \(\Psi^*(O)=D^*(O)\otimes I\). The identity inclusion reflects matrix positivity, so \(D^*\) is unital and completely positive. Its trace dual is CPTP and gives statement one. Reference amplification follows from complete positivity and the channel identity. \end{proof} This is the finite-factor specialization of the snapshot comparison in En05-C and Oai280-A \cite{CheungEn05C,Oai280A}. No claim about a conformal net or a continuum observable limit follows. In particular, commuting payload channels alone are not the observable-limit hypotheses of En06-A \cite{CheungEn06A}. \subsection{Completing instruments and failure branches} Suppose \(\{\mathcal M_f\}_f\) is a complete instrument on the accessible interface and \(\mathcal R_f\) is a CPTP return map for outcome \(f\). The complete decoder is \begin{equation} \widetilde D_A=\sum_f\mathcal R_f\mathcal M_f. \label{eq:branchcompletion} \end{equation} For a failure branch, one may choose \(\mathcal R_f(Y)=\Tr(Y)I_2/2\). The sum is CPTP because the instrument is complete. Loss or leakage may require an enlarged input interface. For example, use \(\widehat H_j=\bbC^2\oplus H_j^{\mathrm{flag}}\). Then the partial trace and decoder in the following equations are understood on those declared enlarged spaces. An unmodeled leakage subspace cannot be silently treated as a qubit input. Every flag branch must still be completed. This is the finite complete-instrument distinction discussed in \cite{CheungVIIg,CheungEm05B,CheungEn02E}. It does not require asserting results from another physical model. \subsection{One unambiguous end-to-end channel} Let \[ \widetilde{\mathcal V}:\B(C)\to\B(H_\partial) \] be the implemented encoder channel, and let \(\mathcal E_\partial\) be the declared complete boundary process. Define \begin{equation} \begin{split} \mathcal N_{0,A} &=\Tr_{\bar A}\circ\mathcal E_\partial \circ\widetilde{\mathcal V},\\ \Lambda_{0,A} &=\widetilde D_A\circ\mathcal N_{0,A}. \end{split} \label{eq:implemented} \end{equation} Tensor permutations are understood as in \eqref{eq:accesschannels}. Thus: \[ \begin{array}{ccccccccc} C&\xrightarrow{\ \widetilde{\mathcal V}\ }& H_\partial&\xrightarrow{\ \mathcal E_\partial\ }& H_A\otimes H_{\bar A} &\xrightarrow{\ \Tr_{\bar A}\ }& H_A&\xrightarrow{\ \widetilde D_A\ }&C_{\mathrm{out}}\\ &&&&\underbrace{H_{\bar A}}_{\text{not received}}&& \underbrace{H_A}_{\text{received interface}}&& \end{array} \] The independent reference \(Q\) bypasses this entire channel and is used only in final validation. For an after-loss process \(\mathcal E_A\), the experiment is instead \[ \widetilde D_A\mathcal E_A \Tr_{\bar A}\widetilde{\mathcal V}. \] This is a different ordering. Equality requires its own theorem and is not presumed. \subsection{The register ledger} \begin{center} \small \begin{tabularx}{\linewidth}{@{}p{.18\linewidth}YYY@{}} \toprule Register & Role & Decoder access & Final accounting\\ \midrule Logical input \(C\) & Unknown input & Only through encoding & Included in channel domain\\ Reference \(Q\) & Independent validation reference & None & Jointly measured after return\\ Boundary \(A\) & Received quantum interface & Allowed & Returned or discarded by complete decoder\\ Boundary \(\bar A\) & Omitted output & Forbidden & Partial trace; included in complete residual\\ Local ancillas & Fixed independent preparation & Allowed & Every unreturned output retained in residual description\\ Decoder records & Accessible instrument outcomes & Allowed & Summed, or retained and then explicitly marginalized\\ Failure flags & Loss, leakage, rejection, or decoder failure & Only declared accessible flags & Fixed returned logical state\\ Encoder/noise environments & Dilation and preparation purifiers & Forbidden unless explicitly part of received interface & Included in complete residual\\ \bottomrule \end{tabularx} \end{center} A live-name ledger records allocation, receipt, unitary support, measurement, consumption, classical storage, and quantum return on every branch. It can certify syntactic access and resource use for a trusted implementation description; it does not prove that uncharacterized hardware follows that description. \subsection{Separate model-identification and transfer bounds} \begin{proposition}[Compositional model comparison] \label{prop:modelcomparison} Suppose the channels have common declared interfaces and \[ \ddia(\widetilde{\mathcal V},\mathcal V)\le e_V,\quad \ddia(\mathcal E_\partial,\id_\partial)\le e_E,\quad \ddia(\widetilde D_A,D_A)\le e_D. \] Then \[ \ddia(\Lambda_{0,A},D_A\mathcal N_A) \le\min\{1,e_V+e_E+e_D\}. \] For an authorized ideal region, \(D_A\mathcal N_A=\id_2\). \end{proposition} \begin{proof} Insert one intermediate composite for each component replacement. The triangle inequality and contraction of the diamond norm under CPTP pre- and postcomposition bound each replacement by its displayed allowance. \end{proof} These are separately supplied component bounds. Favorable decoder validation does not establish them. For deployment or another target channel with the same logical interfaces, independently justify \[ \ddia(\Lambda_{\star,A},\Lambda_{0,A})\le b_A. \] Direct certification uses \(\Lambda_{\star,A}=\Lambda_{0,A}\) and \(b_A=0\). A fitted simulator, a few matching marginal laws, or an ideal tensor identity is not by itself a diamond-distance transfer bound. \begin{proposition}[Robust optimal-decoder exclusions] \label{prop:robustnegative} For channels \(\mathcal N,\widetilde{\mathcal N}\) with common input and accessible output interfaces, define \[ \varepsilon_{\mathrm{rec}}(\mathcal N) =\inf_D\ddia(D\mathcal N,\id_2). \] Then \[ \abs{\varepsilon_{\mathrm{rec}}(\widetilde{\mathcal N}) -\varepsilon_{\mathrm{rec}}(\mathcal N)} \le\ddia(\widetilde{\mathcal N},\mathcal N). \] In particular, if \(|A|\le2\) and \(\ddia(\mathcal N_{0,A},\mathcal N_A)\le\eta_A\), every deterministic decoder obeys \[ \ddia(D\mathcal N_{0,A},\id_2) \ge\max\{0,3/4-\eta_A\}. \] \end{proposition} \begin{proof} For every fixed \(D\), contraction and the reverse triangle inequality bound the difference of the two errors by the channel distance. Taking the infimum gives one inequality; interchanging the channels gives the other. \end{proof} The predecoder distance in this proposition is not supplied by a certificate for one already decoded channel. %===================================================================== \section{Bell correlations and simultaneous finite-data certification} \label{sec:certificate} %===================================================================== \subsection{Choi overlap and reference-preserving conversion} For a qubit channel \(\Lambda\), set \[ P_2=\kb{\Phi_2}{\Phi_2},\qquad J_\Lambda=(\id_Q\otimes\Lambda)(P_2). \] The Pauli expansion is \[ P_2=\frac14(I+X\otimes X-Y\otimes Y+Z\otimes Z). \] Define \[ c_j(\Lambda)=\Tr((\sigma_j\otimes\sigma_j)J_\Lambda), \qquad F(\Lambda)=\Tr(P_2J_\Lambda) =\frac{1+c_x-c_y+c_z}{4}. \] \begin{lemma}[Bell-overlap bounds] \label{lem:bellbounds} For a channel with input and output dimension \(d\), normalized Bell Choi state \(J_\Lambda\), and Bell overlap \(F\), \[ 1-F\le\ddia(\Lambda,\id_d) \le\min\{1,d\sqrt{1-F}\}. \] More generally, for channels with common input dimension \(D\), \begin{equation} \ddia(\Phi,\Psi) \le\min\{1,D\,\dtr(J_\Phi,J_\Psi)\}. \label{eq:choiconversion} \end{equation} \end{lemma} \begin{proof} The Bell input and Bell-projector effect give the lower bound. For a state \(\rho\) and pure projector \(P\), \[ \dtr(\rho,P)\le\sqrt{1-\Tr(P\rho)}. \] This follows from the pure-state distance formula, convex decomposition of \(\rho\), and concavity of the square root; it is also the pure-target case of \cite{FuchsVanDeGraaf}. To prove the Choi conversion, let \(\Delta=\Phi-\Psi\). Unit referenced vectors can be written \[ u=(A\otimes I)\Phi_D,\qquad v=(B\otimes I)\Phi_D, \] where \(A,B\) map the \(D\)-dimensional reference into the actual reference space and have Hilbert--Schmidt norm \(\sqrt D\). Then \[ (\id\otimes\Delta)(\kb uv) =(A\otimes I)J_\Delta(B^\dagger\otimes I) \] has trace norm at most \(D\norm{J_\Delta}_1\). A singular-value decomposition extends this bound to every trace-norm-one referenced operator. Taking the supremum and dividing by two proves \eqref{eq:choiconversion}. The pure-target state bound gives the identity-channel result. \end{proof} \subsection{Validation contract} Let \(\mathscr A\) be a finite nonempty predeclared collection of region--decoder tasks, and let \(K=|\mathscr A|\). If multiple decoders or noise configurations for the same region are tested and selected using the validation results, they count as separate tasks in \(K\). For every \(A\in\mathscr A\), the validation procedure: \begin{enumerate} \item prepares an independent Bell pair \(QC\); \item implements exactly the declared channel \(\Lambda_{0,A}\) in \eqref{eq:implemented}; \item measures \(XX,YY,ZZ\) on \(Q,C_{\mathrm{out}}\) in separate predeclared settings; \item assigns a complete bounded score to every attempted trial. \end{enumerate} Decoder training precedes held-out validation. The same logical channel must be tested in all three settings. \begin{assumption}[Conditional fixed-sample validation] \label{ass:validation} Conditional on a declared training, selection, and calibration record \(\mathcal Z\): \begin{enumerate} \item \(n_{Aj}\ge1\) is fixed before validation scores are observed; \item scores \(Z_{Aji}\in[-1,1]\) within each pair \(A,j\) are independent and have a common mean \(m_{Aj}\); \item all three settings test the same CPTP logical channel \(\Lambda_{0,A}\); \item on a joint event \(G\), with \(\Pr(G^c)\le\beta\), \[ \abs{F_{\mathrm{obs},A}-F(\Lambda_{0,A})} \le b_{\mathrm{cal},A}, \qquad F_{\mathrm{obs},A} =\frac{1+m_{Ax}-m_{Ay}+m_{Az}}4, \] and \[ \ddia(\Lambda_{\star,A},\Lambda_{0,A})\le b_A. \] \end{enumerate} All allowances are nonnegative, and \(\alpha_{\mathrm s}+\beta<1\). \end{assumption} Independence between settings or tasks is not required for the coverage union bound. Adaptive stopping, validation-driven decoder tuning, and unaccounted channel drift are not covered by this fixed-sample contract. \begin{proposition}[A sufficient calibration budget] \label{prop:calibration} Suppose the common actual tested state \(\rho_A\) satisfies \[ \dtr(\rho_A,J_{\Lambda_{0,A}})\le\delta_A, \] and the complete score observable \(M_{Aj}\) differs from \(\sigma_j\otimes\sigma_j\) by operator norm at most \(\eta_{Aj}\). Then a sufficient allowance is \[ b_{\mathrm{cal},A} =\delta_A+\frac14\sum_j\eta_{Aj}. \] \end{proposition} \begin{proof} Let \(B_A=(I+M_{Ax}-M_{Ay}+M_{Az})/4\). Then \(\norm{B_A-P_2}\le\sum_j\eta_{Aj}/4\). The Bell projector is an effect, so its expectation changes by at most \(\delta_A\) under the state comparison. Applying both bounds gives the claim. \end{proof} The existence of a common \(\rho_A\) matters. Setting-dependent preparation changes require their own calibration comparison. Assigning zero to a failed analyzer record does not automatically make that record an ideal Pauli measurement. \subsection{The connected simultaneous theorem} Define \begin{equation} \begin{split} \widehat c_{Aj}&=\frac1{n_{Aj}}\sum_iZ_{Aji},\\ r_{Aj}&=\sqrt{\frac2{n_{Aj}}\log\frac{6K}{\alpha_{\mathrm s}}}, \qquad R_A=\frac{r_{Ax}+r_{Ay}+r_{Az}}4,\\ \widehat F_A&=\frac{1+\widehat c_{Ax} -\widehat c_{Ay}+\widehat c_{Az}}4. \end{split} \label{eq:statistics} \end{equation} Set \(\clip u=\max\{0,\min\{1,u\}\}\), and put \begin{equation} \begin{split} F_{L,A}&=\clip{\widehat F_A-R_A-b_{\mathrm{cal},A}},\\ F_{U,A}&=\clip{\widehat F_A+R_A+b_{\mathrm{cal},A}},\\ L_A&=\max\{0,1-F_{U,A}-b_A\},\\ U_A&=\min\{1,2\sqrt{1-F_{L,A}}+b_A\}. \end{split} \label{eq:intervals} \end{equation} \begin{theorem}[Simultaneous connected boundary certificate] \label{thm:main} Under Assumption~\ref{ass:validation}, with probability at least \(1-\alpha_{\mathrm s}-\beta\), simultaneously for all \(A\in\mathscr A\), \[ F_{L,A}\le F(\Lambda_{0,A})\le F_{U,A}, \qquad L_A\le\ddia(\Lambda_{\star,A},\id_2)\le U_A. \] If an acceptance requires both the declared access audit and \(U_A\le\varepsilon\), then \begin{equation} \Pr\left\{ \begin{array}{c} \text{some accepted tested reconstruction has}\\ \ddia(\Lambda_{\star,A},\id_2)>\varepsilon \end{array}\right\} \le\alpha_{\mathrm s}+\beta. \label{eq:falseaccept} \end{equation} The simultaneous event allows selection of a tested task after viewing all validation results. \end{theorem} \begin{proof} Conditional Hoeffding inequalities \cite{Hoeffding} give \[ \Pr\{|\widehat c_{Aj}-m_{Aj}|>r_{Aj}\mid\mathcal Z\} \le2e^{-n_{Aj}r_{Aj}^2/2} =\frac{\alpha_{\mathrm s}}{3K}. \] A union bound over \(3K\) pairs and integration over \(\mathcal Z\) give simultaneous statistical coverage with failure probability at most \(\alpha_{\mathrm s}\). On that event, \(\abs{\widehat F_A-F_{\mathrm{obs},A}}\le R_A\). Intersecting with \(G\) adds \(b_{\mathrm{cal},A}\). Clipping preserves coverage because the true fidelity lies in \([0,1]\). Lemma~\ref{lem:bellbounds} converts the fidelity interval to bounds on \(\Lambda_{0,A}\). The triangle and reverse triangle inequalities add the transfer allowance in channel-distance units, giving \eqref{eq:intervals}. Every invalid acceptance lies outside the simultaneous coverage event. An additional audit gate cannot enlarge that false-acceptance event. \end{proof} The probabilistic channel statement is the region--decoder specialization of the finite theorem in Oai280-A \cite{Oai280A}; related single-task forms are recorded in \cite{CheungOai265B}. The connection to the access-dependent code is supplied by Sections~\ref{sec:encoding}--\ref{sec:implemented}, not by changing the name of a label. \begin{remark}[What the theorem does not infer] The transfer allowance is outside the square root. The theorem is joint frequentist coverage, not \[ \Pr\{\text{error}\le\varepsilon\mid\text{accepted}\} \ge1-\alpha_{\mathrm s}-\beta. \] It bounds one declared implemented decoder channel. Its lower bound does not exclude every decoder. An incorrect access description can invalidate the boundary interpretation even when the logical channel itself performs well. The statistical data do not prove the access audit, CPTP interface, calibration event, or independence assumptions. \end{remark} %===================================================================== \section{Feasibility, binomial inversion, and channel structure} \label{sec:feasibility} %===================================================================== \subsection{The sample requirement comes before an experiment} \begin{proposition}[Best-case Hoeffding acceptance] \label{prop:samples} Fix \(0<\varepsilon<1\), equal counts \(n_{Aj}=n\), and zero allowances. Even the best possible scores can pass \(U_A\le\varepsilon\) only if \begin{equation} n\ge \frac{18}{\varepsilon^4}\log\frac{6K}{\alpha_{\mathrm s}}. \label{eq:hoeffsamples} \end{equation} Conversely, this inequality permits acceptance for best-case scores. With nonzero allowances, define \[ t_A=\frac{(\varepsilon-b_A)^2}{4}-b_{\mathrm{cal},A}. \] For finite best-case acceptance one needs \(\varepsilon>b_A\), \(t_A>0\), and \[ n\ge \frac{9}{8t_A^2}\log\frac{6K}{\alpha_{\mathrm s}}. \] \end{proposition} \begin{proof} For equal counts, \[ R_A=\frac34\sqrt{\frac2n\log\frac{6K}{\alpha_{\mathrm s}}}. \] Since \(\widehat F_A\le1\), its best possible lower fidelity is \(\clip{1-R_A-b_{\mathrm{cal},A}}\). For \(\varepsilon<1\), acceptance is equivalent to \[ R_A+b_{\mathrm{cal},A} \le\frac{(\varepsilon-b_A)^2}{4}, \] with the stated positive margins. Squaring and rearranging gives the second formula. With zero allowances, \(t_A=\varepsilon^2/4\), which gives \eqref{eq:hoeffsamples}. \end{proof} This is a condition for the printed certificate, not a universal sample-complexity lower bound. \begin{corollary}[Forty shots cannot pass the generic Hoeffding bound] \label{cor:forty} For \(n_x=n_y=n_z=40\), any \(K\ge1\), and \(0<\alpha_{\mathrm s}<1\), the generic Hoeffding procedure cannot accept \(\varepsilon=0.1\), even with best-case scores and zero allowances. \end{corollary} \begin{proof} Equation~\eqref{eq:hoeffsamples} would require \(40\ge180000\log(6K/\alpha_{\mathrm s})\), which is impossible because \(\log(6K/\alpha_{\mathrm s})>\log6>1\). \end{proof} \subsection{A nonideal sufficient power condition} \begin{proposition}[A conservative acceptance guarantee] \label{prop:power} For a tested task let \(\Delta_A=1-F(\Lambda_{0,A})\). Suppose \[ \Delta_A+2R_A+2b_{\mathrm{cal},A} \le\frac{(\varepsilon-b_A)^2}{4}, \qquad \varepsilon>b_A. \] Then, on the simultaneous coverage event used in Theorem~\ref{thm:main}, that task passes \(U_A\le\varepsilon\). If the condition holds for every tested task, all such channel tests pass with probability at least \(1-\alpha_{\mathrm s}-\beta\), subject to their separate audit gates. \end{proposition} \begin{proof} On the event in the proof of Theorem~\ref{thm:main}, \[ \widehat F_A\ge F(\Lambda_{0,A})-R_A-b_{\mathrm{cal},A}. \] Hence \(F_{L,A}\) is at least the clipped value of \(F(\Lambda_{0,A})-2R_A-2b_{\mathrm{cal},A}\). The assumed margin bounds the resulting infidelity by \((\varepsilon-b_A)^2/4\), giving acceptance. \end{proof} This sufficient condition exposes the fidelity and calibration floor before hardware resources are committed. It is conservative and is not an exact power calculation. \subsection{Exact binary inversion} Suppose complete oriented scores are genuinely binary: \[ T_{Ax}=Z_{Ax},\qquad T_{Ay}=-Z_{Ay},\qquad T_{Az}=Z_{Az},\qquad T_{Aj}\in\{\pm1\}. \] Let \(p_{Aj}=\Pr(T_{Aj}=-1\mid\mathcal Z)\). Then \begin{equation} 1-F_{\mathrm{obs},A} =\frac12(p_{Ax}+p_{Ay}+p_{Az}). \label{eq:failureidentity} \end{equation} For an observed failure count \(h\) out of \(n\), define the one-sided upper limit \(u(n,h;a)\) by \[ u(n,n;a)=1, \] and, for \(h3(1-3^{-1/40}). \] Bernoulli's inequality gives \(0.99^{40}>1-40(0.01)=0.6>1/3\), so \(3^{-1/40}<0.99\). Therefore \(\frac12\sum_j u_j>0.015>0.0025\), whereas generic acceptance at \(0.1\) requires inferred infidelity at most \(0.0025\). Nonzero failure counts only increase the upper binomial limits. \end{proof} \subsection{Independently established Pauli structure} \begin{lemma}[Exact Pauli conversion] \label{lem:pauli} For a qubit Pauli channel \[ \Lambda=\sum_{P\in\{I,X,Y,Z\}}\pi_P\Ad_P, \qquad \pi_P\ge0,\quad\sum_P\pi_P=1, \] one has \[ F(\Lambda)=\pi_I,\qquad \ddia(\Lambda,\id_2)=1-\pi_I=1-F(\Lambda). \] \end{lemma} \begin{proof} The four Pauli actions on a Bell state give four orthogonal Bell states. The Bell overlap is therefore \(\pi_I\), and the Bell-projector test gives error at least \(1-\pi_I\). The triangle inequality applied to the nonidentity mixture gives the matching upper bound. \end{proof} If Pauli structure is independently valid for every tested \(\Lambda_{0,A}\), use \[ L_A^{\mathrm P}=\max\{0,1-F_{U,A}-b_A\},\qquad U_A^{\mathrm P}=\min\{1,1-F_{L,A}+b_A\}. \] The same coverage theorem follows from Lemma~\ref{lem:pauli}. With zero allowances and best-case scores, the corresponding requirements are: \[ n\ge\frac{9}{8\varepsilon^2}\log\frac{6K}{\alpha_{\mathrm s}} \quad\text{for the printed Hoeffding procedure}, \] and \[ n\ge \frac{\log(3K/\alpha_{\mathrm s})} {-\log(1-2\varepsilon/3)} \quad\text{for zero-failure acceptance-only binomial inversion}. \] The latter scales as \(\frac{3}{2\varepsilon}\log(3K/\alpha_{\mathrm s})\). \begin{proposition}[Physical logical twirling defines a Pauli task] \label{prop:twirl} For any qubit channel \(\Lambda\), the channel \[ \Lambda^{\mathrm{tw}} =\frac14\sum_{P\in\{I,X,Y,Z\}} \Ad_{P^\dagger}\circ\Lambda\circ\Ad_P \] is Pauli and has \(F(\Lambda^{\mathrm{tw}})=F(\Lambda)\). It can be implemented by choosing an independent uniform Pauli before encoding, applying its inverse after complete decoding, and forgetting the random choice. \end{proposition} \begin{proof} Choose a Kraus family and expand each Kraus operator in the Pauli basis. The resulting positive process matrix has trace one. Conjugation by a Pauli multiplies each Pauli component by its commutation sign. Averaging over the four signs cancels every off-diagonal process entry and retains the nonnegative diagonal entries. Thus the average is a Pauli channel. The identity process entry is unchanged, and it equals Bell overlap. The described random program is exactly the displayed convex mixture. \end{proof} The linear certificate then concerns the physically twirled complete task, not automatically the original channel. For example, a coherent rotation \(e^{-i\theta Z/2}\) has original error \(|\sin(\theta/2)|\), whereas its twirl has error \(\sin^2(\theta/2)\). Imperfect randomization gates require their own allowance. An unimplemented mathematical twirl is not evidence that the hardware channel is Pauli. \subsection{Power calculation without fabricated simulation} For independent fresh binary trials in all three settings, a specified tuple \(p_x,p_y,p_z\) gives an exact acceptance probability: \begin{equation} \sum_{(h_x,h_y,h_z)\in\mathcal H_\varepsilon} \prod_{j=x,y,z} \binom{n_j}{h_j}p_j^{h_j}(1-p_j)^{n_j-h_j}. \label{eq:exactpower} \end{equation} Here \(\mathcal H_\varepsilon\) is the finite set of count triples whose predeclared certificate passes the intended threshold, with the actual calibration and transfer budgets included. Equation~\eqref{eq:exactpower} is an exact finite design calculation. Unlike the coverage theorem, its product expression requires independence between settings. It can be evaluated or simulated after a complete model is specified, but no such execution is reported here. A hardware go/no-go decision should require: \begin{enumerate} \item a positive calibration and transfer margin; \item feasible counts under the selected predeclared procedure; \item acceptable projected power under realistic nonideal laws; \item an executable access-audited complete decoder; \item a separately justified validation contract. \end{enumerate} Choosing between several certificates after viewing the same data requires confidence allocation covering that additional selection. %===================================================================== \section{An exactly solved flagged-erasure benchmark} \label{sec:erasure} %===================================================================== This section supplies analytic benchmark results rather than unexecuted numerical claims. Fix a declared access region \(A\) of size \(m\). Each qubit in \(A\) is independently transmitted with probability \(q\), otherwise replaced by an orthogonal erasure flag. Flags reveal the surviving subset \(S\subseteq A\), and are independent of the logical input. The inaccessible \(\bar A\) is traced out. The complete accessible channel is the direct sum \begin{equation} \mathcal N_{A,q}^{\mathrm{flag}}(M) =\bigoplus_{S\subseteq A} q^{|S|}(1-q)^{m-|S|}\mathcal N_S(M). \label{eq:flaggedaccess} \end{equation} On \(|S|\ge3\), apply the decoder from Theorem~\ref{thm:idealaccess}. On \(|S|\le2\), return \(I_2/2\). All flags and branches are accounted for. \begin{theorem}[Exact complete flagged-erasure optimum] \label{thm:erasure} Let \[ p_m(q)=\sum_{s=3}^{m}\binom msq^s(1-q)^{m-s}, \] with \(p_m(q)=0\) for \(m\le2\). The displayed complete decoder induces \[ \Lambda_{A,q}=p_m(q)\id_2+(1-p_m(q))\mathcal T, \qquad \mathcal T(M)=\Tr(M)I_2/2. \] Moreover, \begin{equation} \inf_D\ddia(D\mathcal N_{A,q}^{\mathrm{flag}},\id_2) =\ddia(\Lambda_{A,q},\id_2) =\frac34(1-p_m(q)). \label{eq:erasureoptimum} \end{equation} \end{theorem} \begin{proof} The surviving-set branch is the reduction of the same \(V\). Authorized branches return identity and the other branches return depolarization, proving the complete channel formula. For any decoder, each branch with \(|S|\le2\) has a replacement input and decoded Bell overlap \(1/4\). Any other branch has Bell overlap at most one. Even a decoder acting on the full flagged direct-sum interface therefore has Bell overlap at most \[ p_m(q)+(1-p_m(q))/4. \] The Bell-projector effect gives the lower bound \(3(1-p_m(q))/4\). The displayed channel attains it by the depolarizing Pauli decomposition. \end{proof} For the positive access sizes: \[ \begin{array}{c|c} m&p_m(q)\\ \hline 3&q^3\\ 4&4q^3(1-q)+q^4\\ 5&10q^3(1-q)^2+5q^4(1-q)+q^5 \end{array} \] At \(q=1\) this recovers the ideal access table. At \(q=0\) every channel has optimal error \(3/4\). The decoded channel is Pauli. Its three oriented failure probabilities are all \[ p_j^{\mathrm{failure}}=\frac{1-p_m(q)}2, \] and its Bell overlap is \(F=1-\frac34(1-p_m(q))\). These give explicit nonideal laws for \eqref{eq:exactpower}. They are justified for this erasure model, not transferred to an arbitrary implemented boundary process. %===================================================================== \section{Decision maps and the distinction between exclusions} \label{sec:reporting} %===================================================================== On the simultaneous event of Theorem~\ref{thm:main}, a threshold \(\varepsilon\) gives: \begin{enumerate} \item \textbf{Certified implemented reconstruction:} the access contract is independently supported and \(U_A\le\varepsilon\). \item \textbf{Excluded for this implemented channel:} \(L_A>\varepsilon\). \item \textbf{Inconclusive:} neither inequality separates the threshold. \end{enumerate} An unsupported audit or validation contract is reported as ``contract not established'', not as statistical certification. The ideal small-region error \(3/4\), its robust version in Proposition~\ref{prop:robustnegative}, and the specified streaming floor \(1/2\) are uniform decoder exclusions in their own interfaces. The finite-data \(L_A\) is ordinarily not. A release should print one row per predeclared task: \begin{center} \small \begin{tabularx}{\linewidth}{@{}p{.12\linewidth}YYYY@{}} \toprule Task & Ideal recovery & Access and resource audit & Error interval & Decision\\ \midrule \(A_1,D_1\) & From Theorem~\ref{thm:idealaccess} & Supported / unsupported & \([L_{A_1},U_{A_1}]\) & Certified / excluded / inconclusive\\ \(A_2,D_2\) & From Theorem~\ref{thm:idealaccess} & Supported / unsupported & \([L_{A_2},U_{A_2}]\) & Certified / excluded / inconclusive\\ \bottomrule \end{tabularx} \end{center} No entries are assigned numerical values here because no validation records were supplied. For all \(32\) single-block regions, \(K=32\). For the ten triples plus a specified collection of negative controls, \(K\) is the total number of tested tasks, not merely the number expected to pass. Equal-size region comparisons, connected versus disconnected subsets, controlled errors, and compiled decoder depths are legitimate descriptive comparisons when their interfaces and confidence allocation are fixed. On one ideal pentagon the threshold is cardinality. Geometry-dependent code properties in larger models require actual network calculations, not a reinterpretation of this table \cite{PastawskiPreskill}. %===================================================================== \section{A normalized two-pentagon network} \label{sec:twopentagon} %===================================================================== We now construct a genuine two-tensor network, rather than appending an unrelated register to a region label. Take two copies of the same six-leg perfect tensor. Join boundary leg \(5\) of the left tensor to boundary leg \(1\) of the right tensor. The two logical inputs are \(C_L,C_R\). The open boundary has eight qubits: \[ L_1,L_2,L_3,L_4,\ R_2,R_3,R_4,R_5. \] For four-bit strings \(a,d\) and bits \(b,c\), define \begin{equation} W_{a,d;\,b,c} =\sqrt2\sum_{e=0}^1 V_{a e,b}V_{e d,c}. \label{eq:Wpatch} \end{equation} The internal edge is contracted, not made available to the decoder. \subsection{The two-input orientation} Define \[ F_R:\bbC^2_e\otimes C_R\to H_{R_2R_3R_4R_5}, \qquad (F_R)_{d;\,e,c}=\sqrt2\,V_{e d,c}. \] Similarly define \[ (F_L)_{a;\,b,e}=\sqrt2\,V_{a e,b}. \] \begin{lemma}[Oriented perfect-tensor isometries] \label{lem:oriented} Both \(F_L,F_R\) are isometries from two qubits to four qubits. For either map, erasure of any one output qubit has constant complete complement \(I_2/2\) on the entire four-dimensional input. Consequently any three of its four output qubits recover both input qubits, including arbitrary references. \end{lemma} \begin{proof} For \(F_R\), privacy of the original boundary leg \(1\) gives \[ \sum_d\overline{V_{e d,c}}V_{e'd,c'} =\delta_{ee'}\delta_{cc'}/2, \] which proves \(F_R^\dagger F_R=I_4\). The same calculation applies to \(F_L\). The normalized Choi vector of \(F_R\) is the original six-leg perfect vector with its legs rearranged: its amplitudes are \(F_R/2=V/\sqrt2\). Its reduction to the two input-reference legs and any one output leg is \(I_8/8\) by Proposition~\ref{prop:perfect}. Expanding that identity on input matrix units gives the constant complement \(M\mapsto\Tr(M)I_2/2\). Theorem~\ref{thm:exact}, now with \(d=4\), constructs a decoder on the remaining three qubits. \end{proof} The decoder in this proof is explicit: for the omitted output bit \(f\), use the columns \[ \sqrt2(I_{\mathrm{three}}\otimes\bra f)F_R\ket{e,c}, \] with the appropriate output permutation, as in \eqref{eq:TA}. They form an \(8\times8\) unitary matrix. \begin{proposition}[Patch isometry and normalization] \label{prop:patchisometry} The matrix \(W\) in \eqref{eq:Wpatch} is an isometry \(C_L\otimes C_R\to H_L\otimes H_R\). It admits both sequential orientations: \[ \text{encode }C_L\text{ by }V,\text{ then apply }F_R \text{ to its internal output and }C_R, \] and \[ \text{encode }C_R\text{ by }V,\text{ then apply }F_L \text{ to }C_L\text{ and its internal output}. \] \end{proposition} \begin{proof} Expanding either composition gives exactly \eqref{eq:Wpatch}. Each composition is a tensor permutation and a composition of isometries, by Proposition~\ref{prop:encoding} and Lemma~\ref{lem:oriented}. Thus \(W^\dagger W=I_4\). This also fixes the factor \(\sqrt2\); an unnormalized tensor contraction would not by itself establish an encoding isometry. \end{proof} \subsection{Constructive subsystem recovery} For a boundary region \(A\) of the patch, let \[ l=|A\cap L|,\qquad r=|A\cap R|, \qquad \mathcal N_A^W(M)=\Tr_{\bar A}(WMW^\dagger). \] \begin{theorem}[Accessible patch recovery] \label{thm:patchrecovery} The following sufficient recovery statements hold on all matrices on \(C_L\otimes C_R\): \begin{enumerate} \item If \(l\ge3\), a decoder on \(A\) satisfies \[ D_A^L\mathcal N_A^W=\Tr_{C_R}. \] \item If \(r\ge3\), a decoder on \(A\) satisfies \[ D_A^R\mathcal N_A^W=\Tr_{C_L}. \] \item If \(l\ge3,r\ge2\), or \(l\ge2,r\ge3\), a decoder on \(A\) recovers the entire two-qubit input: \[ D_A^{LR}\mathcal N_A^W=\id_{C_L\otimes C_R}. \] \end{enumerate} All decoders are finite compositions of the locally constructed isometries and decoders. They preserve arbitrary reference correlations, including correlations with the spectator input. \end{theorem} \begin{proof} Use the right-to-left orientation in Proposition~\ref{prop:patchisometry}. The left block is the two-input isometry \(F_L\) on \(C_L\) and the internal edge. Any three received left outputs recover these two input registers by Lemma~\ref{lem:oriented}. Discarding the recovered edge and all other outputs returns \(C_L\). As a channel on the original two-qubit input, this is exactly \(\Tr_{C_R}\), proving item one. The opposite orientation proves item two. If three left outputs and two right outputs are received, first invert the left block on the received triple. This returns \(C_L\) and the internal edge coherently. The recovered edge and the two right outputs constitute three boundary legs of the original right five-qubit encoding. Apply the corresponding decoder from Theorem~\ref{thm:idealaccess} to recover \(C_R\). Return \(C_L,C_R\). The other cardinality pattern uses the opposite orientation. All intermediate identities are channel identities on their full input spaces, and hence remain valid on arbitrary entangled inputs and after independent reference amplification. \end{proof} These are sufficient access rules, not an exhaustive classification of the \(256\) patch regions. No converse is inferred for regions outside the displayed patterns. The two joined pentagons are a finite perfect-tensor patch. They are not an independently derived bulk metric, an AdS/CFT duality, or an entanglement-wedge identification. %===================================================================== \section{Finite-factor subsystem certification} \label{sec:subsystem} %===================================================================== Operator-algebra and subsystem recovery are established frameworks \cite{OperatorQEC,Harlow}. The following result supplies a self-contained finite-factor statistical extension needed to avoid a fixed-spectator overclaim. Let \(C=\bbC^2\), let \(S=\bbC^s\) be a spectator input, and let \[ \Phi:\B(C\otimes S)\to\B(C) \] be a complete implemented channel. The target is \[ \mathcal T_S=\Tr_S. \] Its error is \[ e_{\mathrm{sub}}(\Phi) =\ddia(\Phi,\mathcal T_S), \] which compares all referenced inputs, not just a fixed spectator preparation. Let \(Q,R\) be input references for \(C,S\). Define the normalized Choi state \[ J_\Phi=(\id_{QR}\otimes\Phi) (P_2^{QC}\otimes P_s^{RS}). \] Tensor ordering is identified so that \[ J_{\mathcal T_S}=P_2^{Q C_{\mathrm{out}}}\otimes I_R/s. \] Set \[ F_{\mathrm{sub}}(\Phi) =\Tr\bigl((P_2^{Q C_{\mathrm{out}}}\otimes I_R)J_\Phi\bigr). \] \begin{lemma}[Bell-subspace conversion] \label{lem:subsystemconversion} For every such channel, \[ 1-F_{\mathrm{sub}}(\Phi) \le e_{\mathrm{sub}}(\Phi) \le\min\{1,4s\sqrt{1-F_{\mathrm{sub}}(\Phi)}\}. \] In particular, \(F_{\mathrm{sub}}(\Phi)=1\) implies \(\Phi=\Tr_S\). \end{lemma} \begin{proof} The Choi input and effect \(M=P_2^{Q C_{\mathrm{out}}}\otimes I_R\) give the lower bound, because the target expectation is one. Write \(F=F_{\mathrm{sub}}(\Phi)\). For \(F>0\), purify \(J_\Phi\), project that purification with \(M\), and normalize. The original and projected pure states have overlap \(\sqrt F\). After tracing the purifying system, the projected state has the form \[ \sigma=P_2^{Q C_{\mathrm{out}}}\otimes\tau_R, \qquad \dtr(J_\Phi,\sigma)\le\sqrt{1-F}. \] Trace preservation of \(\Phi\) fixes the input-reference marginal, so \(J_\Phi\) has \(R\)-marginal \(I_R/s\). Contraction under partial trace therefore gives \[ \dtr(\tau_R,I_R/s)\le\sqrt{1-F}. \] The triangle inequality yields \[ \dtr(J_\Phi,J_{\mathcal T_S})\le2\sqrt{1-F}. \] The input dimension is \(2s\). Applying \eqref{eq:choiconversion} proves the upper bound. For \(F=0\), the capped upper bound is immediate. For \(F=1\), the same reasoning gives identical Choi states and hence identical channels. \end{proof} The bound is deliberately conservative. For \(s=1\), the sharper qubit identity-target factor \(2\) in Lemma~\ref{lem:bellbounds} should be used. \begin{theorem}[Three-correlation subsystem certificate] \label{thm:subsystemcertificate} For predeclared tasks \(\Phi_{0,A}:\B(C\otimes S)\to\B(C)\), define the three correlations on \(Q,C_{\mathrm{out}}\) in their normalized Choi states, ignoring \(R\). Under the conditional validation and calibration contract of Assumption~\ref{ass:validation}, with the target comparison \[ \ddia(\Phi_{\star,A},\Phi_{0,A})\le b_A, \] the same estimates \eqref{eq:statistics} give simultaneous fidelity endpoints \eqref{eq:intervals}. Replace the channel endpoints by \[ \begin{split} L_A^{\mathrm{sub}} &=\max\{0,1-F_{U,A}-b_A\},\\ U_A^{\mathrm{sub}} &=\min\{1,4s\sqrt{1-F_{L,A}}+b_A\}. \end{split} \] With probability at least \(1-\alpha_{\mathrm s}-\beta\), \[ L_A^{\mathrm{sub}} \le\ddia(\Phi_{\star,A},\Tr_S) \le U_A^{\mathrm{sub}} \] for every tested task. Acceptance by the upper endpoint has the same family-wise false-acceptance guarantee as \eqref{eq:falseaccept}. \end{theorem} \begin{proof} The effect \(P_2^{Q C_{\mathrm{out}}}\otimes I_R\) has exactly the same three-correlation expansion as \(P_2\), tensored with \(I_R\). The statistical and calibration proof of Theorem~\ref{thm:main} is unchanged. Lemma~\ref{lem:subsystemconversion} supplies the new conversion. The transfer allowance is again added outside the square root. \end{proof} The correlations may equivalently be measured using a Bell input on \(QC\) and an independent maximally mixed input \(I_S/s\); tracing \(R\) before or after the experiment gives the same laws. This does not restrict the conclusion to maximally mixed spectators: the Choi conversion proves a channel bound on all inputs, with the explicit dimension cost \(4s\). For equal counts, best-case generic subsystem acceptance with zero allowances requires \[ n\ge \frac{288s^4}{\varepsilon^4} \log\frac{6K}{\alpha_{\mathrm s}}. \] This is another certificate-specific consequence, not a universal subsystem sample lower bound. Applied to the two-pentagon patch, take \(S=C_R\), \(s=2\), and \[ \Phi_{0,A} =\widetilde D_A^L\circ\mathcal N_{0,A}^W. \] The ideal decoder in Theorem~\ref{thm:patchrecovery} has target \(\Tr_{C_R}\) exactly. Its implemented version must satisfy the same complete-access and validation obligations as the single block. \subsection{Why fixed-spectator validation is weaker} \begin{proposition}[A fixed-spectator counterexample] \label{prop:spectatortrap} There is a two-input channel \(\Phi\) such that \[ \Phi(\rho_C\otimes\kb00_S)=\rho_C \] for every referenced logical input, but \[ \ddia(\Phi,\Tr_S)=1. \] \end{proposition} \begin{proof} Apply a CNOT controlled by \(S\) and targeted on \(C\), then trace out \(S\). With \(S=\ket0\), the induced logical channel is identity. With \(S=\ket1\) and \(C=\ket0\), the actual output is \(\ket1\) whereas the target is \(\ket0\). Their trace distance is one. Channel half-diamond distance cannot exceed one, so equality follows. \end{proof} Accordingly a qubit certificate with all other bulk inputs fixed certifies only that fixed-input task. It does not establish subsystem recovery on arbitrary spectator states or correlations. \subsection{Correctability is not omitted from complementary recovery} The logical-factor statement used here is the exact channel condition \[ D_A\mathcal N_A^W=\Tr_S, \] equivalently \[ (\mathcal N_A^W)^*D_A^*(O)=O\otimes I_S \qquad(O\in\B(C)). \] It is actually proved for the named patch regions, not inferred from closure of a compressed operator space. Jones and Pollack identify a missing correctability assumption in an earlier complementary-recovery uniqueness claim \cite{JonesPollack}. Their correction is external context, not a premise of any local theorem here. Any application of such a uniqueness theorem must include correctability for the stated erasure channel, for example the algebraic Knill--Laflamme commutator condition on its compressed error products. No uniqueness theorem for all patch algebras or all boundary regions is claimed in this paper. %===================================================================== \section{Assembly and interpretation boundary} \label{sec:assembly} %===================================================================== \begin{theorem}[Oai280-B connected finite reconstruction result] \label{thm:assembly} For the printed encoding and the declared finite interfaces: \begin{enumerate} \item every ideal boundary set of at least three qubits has a constructed complete accessible decoder with zero logical error; \item every ideal boundary set of at most two qubits has optimal full-code half-diamond error \(3/4\); \item the named ordered triple has a two-slot exact decoder and a sharp one-slot error floor \(1/2\) in Assumption~\ref{ass:stream}; \item complete implemented region--decoder channels satisfying the access and validation contracts obey the simultaneous finite-data guarantee \eqref{eq:falseaccept}; \item independently justified model and transfer bounds may be composed without identifying them with statistical uncertainty; \item the two-pentagon patch is an isometry with the constructive subsystem recovery rules of Theorem~\ref{thm:patchrecovery}; \item arbitrary-referenced finite-factor subsystem recovery is certifiable under Theorem~\ref{thm:subsystemcertificate}. \end{enumerate} These conclusions are finite code and channel statements. They do not establish a gravitational duality, an entanglement wedge, a metric, Einstein dynamics, a Page curve, or an inherited characteristic quantum coefficient. \end{theorem} \begin{proof} Items one and two are Theorem~\ref{thm:idealaccess}. Item three combines Proposition~\ref{prop:streamdecoder} and Theorem~\ref{thm:oneslot}. Item four is Theorem~\ref{thm:main} applied to \eqref{eq:implemented}; its access meaning uses Proposition~\ref{prop:accessfactor}. Item five is Proposition~\ref{prop:modelcomparison} and the triangle-inequality transfer step. Items six and seven are the named patch and subsystem theorems. The proved constructions contain finite matrices, channels, register access, and statistical contracts. No map identifying these objects with gravitational observables or with the unconstructed characteristic coefficient is among their hypotheses or conclusions. \end{proof} This maintains the separation emphasized in Oai265-A, En07-A, Oai290-A, and XVII-A \cite{CheungOai265A,CheungEn07A,CheungOai290A,CheungXVIIA}. Nonimplication is not nonexistence: the paper does not prove that an additional physical interpretation is impossible. It proves the finite task that is actually specified. The Family 280 VOA--net claim recorded in Oai280-A is neither verified nor used here. A finite categorical dimension is not the qubit dimension; here the logical register is explicitly \(\bbC^2\). Family 290-02 is not instantiated on this code. No modular-band theorem or conformal-net calibration is inferred from the word ``boundary''. %===================================================================== \appendix \section{Exact verification identities and release checklist} \label{app:verification} %===================================================================== The mathematical checks needed for the ideal layer are already discharged by the proofs: \[ V^\dagger V=I_2,\qquad g_jV=V,\qquad \overline XV=VX,\qquad \overline ZV=VZ, \] \[ \mathcal N_B(E_{ij})=\delta_{ij}I_B/2^{|B|} \quad(|B|\le2), \] \[ T_A^\dagger T_A=I,\qquad D_A\mathcal N_A(E_{ij})=E_{ij} \quad(|A|\ge3), \] \[ W^\dagger W=I_4,\qquad D_A^L\mathcal N_A^W=\Tr_{C_R} \quad(|A\cap L|\ge3). \] A separately executed verification package should: \begin{enumerate} \item construct \eqref{eq:Vmatrix} independently of \eqref{eq:encircuit} and compare the exact matrices; \item test all four logical matrix units for every one of the \(32\) single-block regions; \item construct each \(T_A\) from the printed leg permutations; \item verify every decoder on its entire input space, including off-support and failure branches; \item independently check the branch Kraus operators of \eqref{eq:streamgates}; \item compare complete flagged-erasure channels with \eqref{eq:erasureoptimum}; \item check the normalization and both sequential orientations of \eqref{eq:Wpatch}; \item bind raw validation records, setting labels, attempted-trial counts, scoring rules, decoder versions, and audits to the reported intervals; \item preserve software versions, tolerances, raw outputs, and failures; \item compile the document until cross-references stabilize and inspect the resulting PDF. \end{enumerate} Floating-point agreement alone is not an exact proof or a laboratory calibration. These instructions are not execution reports. %===================================================================== \section{Documentary separation from the characteristic-map programme} \label{app:standing} %===================================================================== The additional supplied excerpts concern a different analytic programme. Their internal kernels, distributional reconstruction maps, source weights, and characteristic loci are not the finite encoding \(V\), network \(W\), or channels of this paper. The supplied records describe an internal amplitude construction at XIV-I's I2, a missing joint characteristic map at I3/J2, and technical relative-lifting interfaces in XV-B \cite{CheungXIVI,CheungXIVJ,CheungXVB}. These attributions do not verify the full analytic manuscripts. In particular, the existence of the technical XV-B manuscript is distinct from opening the downstream admission exit. The six remaining same-target obligations are retained as documentary obligations, not relabeled as finite-channel theorems: \begin{center} \small \begin{tabularx}{\linewidth}{@{}cYY@{}} \toprule Step & Required analytic object & Status in this paper\\ \midrule 1 & Full joint characteristic map on tests meeting the locus & Not constructed\\ 2 & Joint section and complete controlled remainder & Not constructed\\ 3 & Uniform transverse estimates for that joint object & Not constructed\\ 4 & Compatibility with permitted contacts and singular spectators & Not constructed\\ 5 & Complete output wavefront theorem after actual composition and pushforward & Not constructed\\ 6 & Normalized admission of the named quantum coefficient & Not asserted\\ \bottomrule \end{tabularx} \end{center} No finite statistical theorem supplies any missing distributional operation in that chain. The supplied XVI-N obstruction has its own prepared-instance and route hypotheses \cite{CheungXVIN}; it is not expanded into an obstruction for every model. The standing documentary ledger is unchanged: \[ \boxed{ \begin{gathered} \sourceid{O.1}:\ \sourceid{NOT_CLOSED},\\ \text{series Route B: not discharged here},\\ \text{XVI-N remaining obligations: not discharged here},\\ \text{XV-B downstream admission exit: not opened},\\ Q_HR_1^{(1)}\in\mathscr E_H:\ \text{not asserted}. \end{gathered}} \] A source dependency, continuation path, or proposed comparison does not become a theorem premise merely through citation. %===================================================================== \section*{Declarations} \addcontentsline{toc}{section}{Declarations} %===================================================================== \paragraph{Provenance.} Cheung manuscript citations identify the user-supplied documents or excerpts and their supplied versions. Where only excerpts or catalogue descriptions were provided, this is stated in the bibliography. No independent manuscript-registry audit or comprehensive companion-series scan is claimed. \paragraph{Mathematical scope.} The ideal code, accessible decoders, finite confidence statements, flagged-erasure benchmark, two-tensor patch, and finite-factor subsystem conversion are the explicit locally proved results. Established code and error-correction facts are not presented as new priority claims. \paragraph{Experimental scope.} No experimental data, laboratory calibration, hardware access audit, numerical simulation, acceptance-frequency study, or deployment transfer test was supplied or executed here. No empirical claim is inferred from the analytic benchmark. \paragraph{Verification scope.} No successful \sourceid{pdflatex} execution, proof-assistant checking, independently executed symbolic script, referee approval, or journal acceptance is asserted. The source is self-contained for pdfLaTeX and requires no external bibliography file. \paragraph{Physical scope.} No gravitational preparation, bulk--boundary observable dictionary, metric reconstruction, Einstein dynamics, horizon-area identity, island, Page curve, evaporation endpoint, or spacetime-emergence theorem is constructed. These are scope boundaries, not universal impossibility statements. \section*{Conclusion} \addcontentsline{toc}{section}{Conclusion} The completed connection is \[ \boxed{ \begin{gathered} V\text{ printed and proved} \;+\;A\text{ explicitly received} \;+\;\widetilde D_A\text{ complete and access-audited}\\ \;+\;\text{held-out complete validation contract}\\ \Longrightarrow\ \Pr\{\text{any false tested acceptance}\} \le\alpha_{\mathrm s}+\beta. \end{gathered}} \] The ideal single-block access threshold is exactly three qubits. The implemented-decoder certificate has its own statistical, calibration, and transfer obligations. The two-pentagon construction and the finite-spectator theorem extend the connected task without silently fixing arbitrary spectator inputs or identifying a finite access region with a gravitational wedge. %===================================================================== \begin{thebibliography}{99} \addcontentsline{toc}{section}{References} %===================================================================== \bibitem{Laflamme} R.~Laflamme, C.~Miquel, J.~P.~Paz, and W.~H.~Zurek. Perfect quantum error correcting code. \emph{Physical Review Letters} \textbf{77} (1996), 198--201. doi:10.1103/PhysRevLett.77.198. arXiv:quant-ph/9602019. \bibitem{KnillLaflamme} E.~Knill and R.~Laflamme. Theory of quantum error-correcting codes. \emph{Physical Review A} \textbf{55} (1997), 900--911. doi:10.1103/PhysRevA.55.900. arXiv:quant-ph/9604034. \bibitem{HaPPY} F.~Pastawski, B.~Yoshida, D.~Harlow, and J.~Preskill. Holographic quantum error-correcting codes: Toy models for the bulk/boundary correspondence. \emph{Journal of High Energy Physics} 06 (2015), 149. doi:10.1007/JHEP06(2015)149. arXiv:1503.06237. \bibitem{Gong} M.~Gong et al. Experimental exploration of five-qubit quantum error correcting code with superconducting qubits. \emph{National Science Review} \textbf{9} (2022), no.~1, nwab011. doi:10.1093/nsr/nwab011. arXiv:1907.04507. \bibitem{PastawskiPreskill} F.~Pastawski and J.~Preskill. Code properties from holographic geometries. \emph{Physical Review X} \textbf{7} (2017), 021022. doi:10.1103/PhysRevX.7.021022. arXiv:1612.00017. \bibitem{OperatorQEC} D.~W.~Kribs, R.~Laflamme, D.~Poulin, and M.~Lesosky. Operator quantum error correction. \emph{Quantum Information and Computation} \textbf{6} (2006), 383--399. arXiv:quant-ph/0504189. \bibitem{Harlow} D.~Harlow. The Ryu--Takayanagi formula from quantum error correction. \emph{Communications in Mathematical Physics} \textbf{354} (2017), 865--912. doi:10.1007/s00220-017-2904-z. arXiv:1607.03901. \bibitem{JonesPollack} J.~Jones and J.~Pollack. \emph{Uniqueness of Complementary Recovery in Holographic Error-Correcting Codes}. arXiv:2509.19299v1, 23 September 2025. Cited for the explicitly added correctability assumption; not used as a premise of a local recovery or uniqueness theorem. \bibitem{Watrous} J.~Watrous. \emph{The Theory of Quantum Information}. Cambridge University Press, 2018. Finite-dimensional channels, Choi matrices, references, and completely bounded trace norms. \bibitem{FuchsVanDeGraaf} C.~A.~Fuchs and J.~van de Graaf. Cryptographic distinguishability measures for quantum-mechanical states. \emph{IEEE Transactions on Information Theory} \textbf{45} (1999), 1216--1227. arXiv:quant-ph/9712042. \bibitem{Hoeffding} W.~Hoeffding. Probability inequalities for sums of bounded random variables. \emph{Journal of the American Statistical Association} \textbf{58} (1963), 13--30. doi:10.1080/01621459.1963.10500830. \bibitem{ClopperPearson} C.~J.~Clopper and E.~S.~Pearson. The use of confidence or fiducial limits illustrated in the case of the binomial. \emph{Biometrika} \textbf{26} (1934), 404--413. doi:10.1093/biomet/26.4.404. \bibitem{Oai280A} \emph{Oai280-A: Sector-Label Certificates and VOA--Net Separation: Locality, Fusion, Recovery, Extensions, and Energy}. Version 1, 12 October 2026. User-supplied complete manuscript \sourceid{Oai280-A.tex}; the supplied source file does not specify an author. Especially \sourceid{thm:exact}, \sourceid{thm:main}, \sourceid{prop:forty}, \sourceid{thm:comparison}, and the physical-identification scope boundaries. \bibitem{CheungEn02B} N.~Cheung. \emph{En02-B}, version 1. Undated supplied record and excerpts identifying \sourceid{En02-B-v1.tex}. Resource-limited holographic reconstruction; especially \sourceid{lem:privacy}, \sourceid{prop:access}, \sourceid{prop:perfect}, \sourceid{thm:B1}, \sourceid{thm:B5}, and \sourceid{prop:observable}. Enter Calculus Companion. The complete manuscript was not independently verified here. \bibitem{CheungEn02C} N.~Cheung. \emph{En02-C}, version 1. Undated user-supplied excerpts of \sourceid{En02-C-v1.tex}. Especially \sourceid{thm:C3} and its first-carrier separability argument for the declared ordered streaming interface. Enter Calculus Companion. \bibitem{CheungEn02E} N.~Cheung. \emph{En02-E}, version 2. Undated supplied excerpts of \sourceid{En02-E-v2.tex}. Complete protocols, off-support completion, and instruction accounting in the stated packet interface. Enter Calculus Companion. No packet model is imported as the boundary experiment here. \bibitem{CheungOai265B} N.~Cheung. \emph{Oai265-B}, version 2. Undated supplied excerpts of \sourceid{Oai265-B-v2.tex}. Especially \sourceid{thm:main} and the conditional validation contract. Enter Calculus Companion. Reported numerical studies are not reused as validation evidence. \bibitem{CheungOai290A} N.~Cheung. \emph{Oai290-A}, version 1. Undated supplied excerpts of \sourceid{Oai290-A.tex}. Especially \sourceid{thm:assembly}: implemented-decoder, all-decoder, effect-only, and inconclusive decisions. Enter Calculus Companion. \bibitem{CheungOai265A} N.~Cheung. \emph{Oai265-A}, version 1. Undated supplied excerpts of \sourceid{Oai265-A.tex}. Exact complete-complement recovery and separation of static records, recovery, entropy histories, and gravitational identification. Enter Calculus Companion. \bibitem{CheungHawk04B} N.~Cheung. \emph{Hawk04-B}, version 2. Undated supplied excerpts of \sourceid{Hawk04-B.tex}. Especially \sourceid{thm:exact}: a complete complement and a decoder defined on the whole received interface. Enter Calculus Companion. \bibitem{CheungEn07A} N.~Cheung. \emph{En07-A}, version 1. Undated supplied excerpts of \sourceid{En07-A.tex}. Especially \sourceid{thm:exact}, the dimension-count distinction, and the holographic-identification refusal. Enter Calculus Companion. \bibitem{CheungEn07B} N.~Cheung. \emph{En07-B}, version 1. Undated supplied excerpts of \sourceid{En07-B.tex}. Exact complete-complement criterion and the separate same-model endpoint obligations. Enter Calculus Companion. No gravitational endpoint package is instantiated here. \bibitem{CheungEn05C} N.~Cheung. \emph{En05-C}, version 1. Undated supplied excerpts of \sourceid{En05-C.tex}. Especially \sourceid{thm:comparison}: snapshot determination, UCP factorization, and adjoint containment. Enter Calculus Companion. \bibitem{CheungEn06A} N.~Cheung. \emph{En06-A}, version 1. Undated supplied excerpts of \sourceid{En06-A.tex}. Especially \sourceid{thm:algmicro} and its product-preserving observable-limit hypotheses. Enter Calculus Companion. \bibitem{CheungVIIg} N.~Cheung. \emph{VII-G}, version 1. Undated supplied excerpts of \sourceid{VII-G.tex}. Finite hybrid channel structure, complete branch sums, and classical--quantum interfaces. Enter Calculus Companion. \bibitem{CheungEm05B} N.~Cheung. \emph{Em05-B}, version 1. Undated supplied record and revision-audit excerpts of \sourceid{Em05-B-v1.tex}. Complete complements, flagged instruments, reference-preserving comparison, and the separation of verification instructions from execution reports. Enter Calculus Companion. \bibitem{CheungXVIIA} N.~Cheung. \emph{XVII-A}, version 1. Undated supplied excerpts of \sourceid{XVII-A.tex}. Especially \sourceid{thm:main} and \sourceid{rem:no-wedge}: a named finite observable reconstruction is not full subsystem recovery or an entanglement wedge. Enter Calculus Companion. \bibitem{CheungI} N.~Cheung. \emph{Landmark I}, version 2. Undated supplied excerpts of \sourceid{I.tex}. Born laws and destructive projective residuals within the specified finite strategy class. Enter Calculus Companion. No measurement-characterization theorem is a premise here. \bibitem{CheungXIVI} N.~Cheung. \emph{Landmark XIV-I}, version 1. User-supplied excerpts of \sourceid{XIV-I.tex}. Internal amplitude construction at I2 and the unresolved complete joint characteristic map at I3. Cited only for the separate documentary status ledger. \bibitem{CheungXIVJ} N.~Cheung. \emph{Landmark XIV-J}, version 1. User-supplied excerpts of \sourceid{XIV-J.tex}. Reconstruction descent, the supported-sector off-characteristic reference, the J2 boundary, and the unasserted quantum admission. Cited only for documentary separation. \bibitem{CheungXVB} N.~Cheung. \emph{XV-B}, version 2. User-supplied excerpts of \sourceid{XV-B.tex}. Relative lifting, normal-jet and extension interfaces; the inherited full characteristic map remains unconstructed at B1. Its technical existence is distinguished from opening the downstream admission exit. \bibitem{CheungXVIN} N.~Cheung. \emph{XVI-N}, version r12. User-supplied excerpts of \sourceid{XVI-N.tex}. Conditional prepared massless-instance obstruction and the separately undischarged spatially compact Route B. Cited only for the unchanged documentary boundary. \end{thebibliography} \end{document}