\documentclass[11pt]{article}

\usepackage[margin=1in]{geometry}
\usepackage[T1]{fontenc}
\usepackage{lmodern}
\usepackage{amsmath,amssymb,amsthm,mathtools}
\usepackage{array,booktabs,longtable}
\usepackage{enumitem}
\usepackage{xcolor}
\usepackage{hyperref}
\usepackage{microtype}

\hypersetup{
  colorlinks=true,
  linkcolor=blue,
  citecolor=blue,
  urlcolor=blue,
  pdftitle={Oai280-C: Operational Certification of Logical-Algebra Recovery}
}

\newtheorem{theorem}{Theorem}[section]
\newtheorem{proposition}[theorem]{Proposition}
\newtheorem{lemma}[theorem]{Lemma}
\newtheorem{corollary}[theorem]{Corollary}
\theoremstyle{definition}
\newtheorem{definition}[theorem]{Definition}
\newtheorem{example}[theorem]{Example}
\newtheorem{contract}[theorem]{Contract}
\theoremstyle{remark}
\newtheorem{remark}[theorem]{Remark}

\newcommand{\B}{\mathcal B}
\newcommand{\D}{\mathcal D}
\newcommand{\id}{\operatorname{id}}
\newcommand{\Tr}{\operatorname{Tr}}
\newcommand{\rank}{\operatorname{rank}}
\newcommand{\supp}{\operatorname{supp}}
\newcommand{\ran}{\operatorname{ran}}
\newcommand{\diag}{\operatorname{diag}}
\newcommand{\C}{\mathbb C}
\newcommand{\I}{I}
\newcommand{\N}{\mathcal N}
\newcommand{\R}{\mathcal R}
\newcommand{\T}{\mathcal T}
\newcommand{\M}{\mathcal M}
\newcommand{\E}{\mathcal E}
\newcommand{\V}{\mathcal V}
\newcommand{\dd}{d_{\diamond}}
\newcommand{\norm}[1]{\left\lVert #1\right\rVert}
\newcommand{\ket}[1]{\lvert #1\rangle}
\newcommand{\bra}[1]{\langle #1\rvert}
\newcommand{\proj}[1]{\ket{#1}\bra{#1}}
\newcommand{\ceil}[1]{\left\lceil #1\right\rceil}

\title{\textbf{Oai280-C}\\[4pt]
Operational Certification of Logical-Algebra Recovery\\[4pt]
\large Access-restricted decoders, connected perfect-tensor benchmarks,
and simultaneous reference-preserving confidence bounds}
\author{}
\date{}

\begin{document}
\maketitle

\begin{abstract}
We give a finite-dimensional certification framework for a specified
decoder acting on a declared accessible interface. The target may be
a logical code, a subsystem, or a finite direct-sum algebra. Error is
half-diamond distance, so the claim includes preservation of correlations
with independent references. We prove the required task separations,
the full-code constant-complement criterion, a programme-to-channel
theorem with explicit resource ledgers, and dimension-correct
Choi-to-channel bounds. A five-qubit stabilizer tensor supplies a
fully specified connected two-cell encoding. Its normalization,
subsystem decoders, hybrid-algebra decoder, and several optimal access
errors are proved locally. For a three-share regression task we also
prove decoder uniqueness, a minimal coherent environment dimension,
an exact streaming peak of two qubits, and a four-message lower bound
in a specified one-way model. General mixed-target tomography and a
qubit Bell-correlation procedure give simultaneous finite-confidence
intervals for complete implemented channels. Calibration, access
assumptions, transfer allowances, and all-decoder obstructions are
kept separate. Explicit noise examples and shot-count calculations
identify both useful certificates and certificate-specific limitations.
No gravitational dictionary, continuum geometry, or device-independent
certification is asserted.
\end{abstract}

\tableofcontents

\section{Introduction and scope}

An operational recovery statement has more content than an operator
identity or an existence theorem. It specifies what information is to
be returned, what interface is accessible, which decoder is implemented,
what happens on every branch, and how the resulting error is bounded.

Operator-algebra quantum error correction already provides the
appropriate mathematical language for quantum, classical, and hybrid
targets \cite{BenyKempfKribs,BenyKempfKribsPRA}. Approximate recovery
has corresponding worst-case entanglement-fidelity formulations and
constructive recovery results \cite{BenyOreshkov}. Perfect-tensor
networks provide finite bulk-to-boundary code models
\cite{PastawskiEtAl}. The present contribution is an explicit
certification interface connecting a supplied finite code to a
specified apparatus. It does not replace those theories.

The internal source notes supplied for this manuscript attribute related
interfaces to N.~Cheung's manuscripts En02-B/C, En05-C, Oai265-B,
Oai290-A, Em05-B, XVII-A, and Oai280-A/B
\cite{CheungEn02B,CheungEn02C,CheungEn05C,CheungOai265B,
CheungOai290A,CheungEm05B,CheungXVIIA,CheungOai280AB}.
Their full texts and publication metadata were not supplied.
Accordingly, these citations identify provenance and intended
comparisons, not independently checked published theorems.
Every mathematical result used below is proved here or attributed
to an identified external article. Appendix~\ref{app:provenance}
records this distinction.

\paragraph{Main outcome.}
For finitely many predeclared tasks we construct intervals
\[
 [L_j,U_j]
\]
such that, under the printed access, preparation, measurement, and
sampling hypotheses,
\[
 \Pr\!\left\{
   \exists j:
   \operatorname{Accept}(j)
   \ \text{and}\
   \dd(\Lambda_{\star,j},\T_j)>\varepsilon_j
 \right\}
 \leq \alpha_{\mathrm s}+\beta.
\]
Here $\Lambda_{\star,j}$ is the channel actually claimed, $\T_j$ is
the declared target, $\alpha_{\mathrm s}$ is the validation failure
budget, and $\beta$ covers separately justified calibration or
transfer assumptions. This is a statement about complete channels,
not selected successful branches.

\section{Tasks, references, and claim contracts}
\label{sec:tasks}

All Hilbert spaces are finite dimensional. A channel is a completely
positive trace-preserving linear map between full matrix algebras.
We use Schr\"odinger-picture channels and Hilbert--Schmidt adjoints.

For channels with the same input and output spaces define
\begin{equation}
 \dd(\Phi,\Psi)=\frac12\norm{\Phi-\Psi}_{\diamond}.
 \label{eq:halfd}
\end{equation}
For channel differences, the diamond norm can be evaluated on states
with an ancillary reference of dimension equal to the input dimension.
Thus $\dd$ includes arbitrary input-reference correlations. Its range
is $[0,1]$. We use the normalized Choi convention throughout; see
Section~\ref{sec:choi}. These conventions agree with the channel-distance
discussion in \cite{WallmanFlammia}.

\begin{definition}[Information targets]
Let $H$ be the input space.
\begin{enumerate}[label=(\roman*)]
 \item A named effect $0\leq F\leq I_H$ defines the binary readout
 channel
 \[
   \mathcal M_F(\rho)
   =\Tr(F\rho)\proj{1}
     +\Tr((I_H-F)\rho)\proj{0}.
 \]
 \item Full-code recovery has target $\id_H$.
 \item If $H=C_L\otimes S$, subsystem recovery has target
 \[
   \T_L=\Tr_S:\B(C_L\otimes S)\longrightarrow\B(C_L).
 \]
 \item If
 \[
   H=\bigoplus_{\alpha}(C_\alpha\otimes S_\alpha),
   \qquad
   \M=\bigoplus_\alpha
      \bigl(\B(C_\alpha)\otimes I_{S_\alpha}\bigr),
 \]
 set $K=\bigoplus_\alpha C_\alpha$. The algebra-restriction target is
 \begin{equation}
   \R_{\M}(\rho)
   =
   \bigoplus_\alpha
   \Tr_{S_\alpha}(P_\alpha\rho P_\alpha).
   \label{eq:algebra-target}
 \end{equation}
\end{enumerate}
\end{definition}

The direct-sum output in \eqref{eq:algebra-target} is embedded in
$\B(K)$. It contains the sector label and the quantum state within
each sector. It does not retain cross-sector coherences.

\begin{proposition}[Algebra target and Heisenberg inclusion]
The map $\R_\M$ is CPTP. Its adjoint, restricted to block-diagonal
output operators, is
\[
 \R_\M^\dagger\!\left(\bigoplus_\alpha X_\alpha\right)
 =
 \bigoplus_\alpha(X_\alpha\otimes I_{S_\alpha}).
\]
Consequently $\ran\R_\M^\dagger=\M$.
\end{proposition}

\begin{proof}
Fix orthonormal bases $\{\ket{k}_\alpha\}$ of $S_\alpha$.
Kraus operators are
\[
 A_{\alpha k}
 =
 \iota_\alpha
 (I_{C_\alpha}\otimes\bra{k}_\alpha)P_\alpha,
\]
where $\iota_\alpha:C_\alpha\to K$ is the output inclusion.
Their adjoint products sum to $I_H$. The adjoint formula follows
by taking traces. Off-diagonal output blocks have zero adjoint image.
\end{proof}

\begin{contract}[Operational claim specification]
\label{con:main}
A claim consists of the following frozen data.
\begin{enumerate}[label=\arabic*.]
 \item Input space $H$, output space $K$, and target $\T$.
 \item An encoding and noise model, together with an accessible
 channel $\N_A:\B(H)\to\B(Q_A)$.
 \item A decoder programme on $Q_A$ and fresh, initially uncorrelated
 ancillas only.
 \item A complete tested channel $\Lambda_{0,A}$, including
 unsuccessful outcomes, abort replacements, and discarded flags.
 \item A claimed channel $\Lambda_{\star,A}$, and, if different,
 a justified allowance
 \[
   \dd(\Lambda_{\star,A},\Lambda_{0,A})\leq b_A.
 \]
 \item A register-access audit, gate/instrument library, arrival
 schedule, live-register budget, storage ledger, and classical
 communication convention.
 \item Validation preparations, measurements, shot counts, statistical
 allocations, calibration allowances, and the threshold
 $\varepsilon_A$.
 \item Required negative controls: effect versus coherent recovery,
 fixed versus arbitrary spectator, successful branch versus complete
 channel, and unrestricted versus resource-restricted decoding.
\end{enumerate}
The external validation reference is never a decoder input.
\end{contract}

A useful physical form is
\begin{equation}
 \Lambda_{0,A}
 =
 \widetilde D_A\circ\Tr_{\bar A}
 \circ\E_{\partial}\circ\widetilde\V.
 \label{eq:tested-channel}
\end{equation}
All maps in this expression belong to the same declared experiment.
An ideal code identity alone does not establish
\eqref{eq:tested-channel} for an apparatus.

\subsection{Two mandatory task separations}

\begin{proposition}[Classical-record obstruction]
\label{prop:EB}
Suppose the only input carrying information to the decoder is a finite
classical record, and all other decoder inputs are fixed and independent
of the logical system and its reference. Then the resulting logical
channel is measure-and-prepare:
\[
 \Gamma(\rho)=\sum_m\Tr(F_m\rho)\sigma_m.
\]
It is entanglement-breaking. For a $d$-dimensional identity target,
$d\geq2$,
\[
 \dd(\Gamma,\id_d)\geq 1-\frac1d.
\]
\end{proposition}

\begin{proof}
The record probabilities form a POVM $\{F_m\}$; conditional decoder
outputs are states $\sigma_m$. For any reference $R$,
\[
 (\Gamma\otimes\id_R)(\rho)
 =
 \sum_m \sigma_m\otimes
 \Tr_H((F_m\otimes I_R)\rho),
\]
which is separable.

Let $\Phi_d$ be the maximally entangled state. A product state
$\sigma\otimes\tau$ has overlap
$\Tr(\sigma\tau^{\mathsf T})/d\leq1/d$ with $\Phi_d$.
By convexity the same bound holds for separable states.
Measuring $\{\Phi_d,I-\Phi_d\}$ therefore gives trace distance
at least $1-1/d$ from $\Phi_d$. This is a permissible diamond-norm
input.
\end{proof}

\begin{proposition}[An exact effect does not certify a qubit]
\label{prop:effect}
Let
\[
 \Delta_Z(\rho)=\frac12(\rho+Z\rho Z).
\]
The effect $F=\proj{0}$ is preserved exactly, while
\[
 \dd(\Delta_Z,\id_2)=\frac12.
\]
\end{proposition}

\begin{proof}
$\Delta_Z^\dagger(F)=F$. The upper bound follows from
$\Delta_Z-\id_2=(\operatorname{Ad}_Z-\id_2)/2$ and the fact that
two channels have half-diamond distance at most one.
On $\proj{+}$, the output is $I_2/2$, at trace distance $1/2$
from $\proj{+}$.
\end{proof}

These are the locally proved hard gates corresponding to the
classical-record and effect-target separations described in the
supplied Cheung source notes
\cite{CheungIEn06A,CheungOai290A,CheungXVIIA}.

\section{Recovery criteria and snapshot determination}
\label{sec:criteria}

\subsection{The constant-complement criterion is a full-code statement}

\begin{theorem}[Full-code recovery and a constant complement]
\label{thm:complement}
Let $\N:\B(H)\to\B(Q)$ be CPTP, with Kraus operators $E_i:H\to Q$.
The following are equivalent:
\begin{enumerate}[label=(\roman*)]
 \item A CPTP map $D:\B(Q)\to\B(H)$ satisfies $D\N=\id_H$.
 \item Every product $E_j^\dagger E_i$ is a scalar multiple of $I_H$.
 \item A complementary channel of $\N$ has the form
 \[
   \widehat\N(\rho)=\Tr(\rho)\omega
 \]
 for a fixed state $\omega$.
\end{enumerate}
\end{theorem}

\begin{proof}
The standard Kraus complementary channel has entries
\[
 [\widehat\N(\rho)]_{ij}
 =\Tr(E_i\rho E_j^\dagger).
\]
Hence (ii) and (iii) are equivalent, with the scalar matrix positive
and of trace one.

For (i)$\Rightarrow$(ii), let $K_a$ be Kraus operators of $D$.
The Kraus operators $K_aE_i$ represent the identity channel.
Its Choi matrix has rank one, so every $K_aE_i=c_{ai}I_H$.
Trace preservation of $D$ gives
\[
 E_j^\dagger E_i
 =
 \sum_a E_j^\dagger K_a^\dagger K_aE_i
 =
 \sum_a\overline{c_{aj}}c_{ai}I_H.
\]

For (ii)$\Rightarrow$(i), change the Kraus basis to diagonalize the
positive scalar matrix. Remove zero Kraus operators and write
\[
 E_i=\sqrt{\lambda_i}\,W_i,\qquad
 W_i^\dagger W_j=\delta_{ij}I_H,\qquad
 \sum_i\lambda_i=1.
\]
The ranges of the isometries $W_i$ are orthogonal. With
$\Pi=\sum_iW_iW_i^\dagger$, define
\[
 D(\sigma)
 =
 \sum_iW_i^\dagger\sigma W_i
 +\Tr((I_Q-\Pi)\sigma)\tau
\]
for an arbitrary fixed state $\tau$ on $H$.
This map is CPTP and $D\N=\id_H$.
\end{proof}

\begin{example}[Why the criterion is wrong for a subsystem]
Let $\N=\Tr_S$ on $C_L\otimes S$. The identity decoder on $C_L$
recovers the subsystem exactly. A complementary channel returns
$\Tr_{C_L}\rho$, which is not constant when $\dim S>1$.
Thus subsystem recovery does not require a left inverse on the
whole bulk.
\end{example}

This elementary example prevents an inappropriate full-code premise
from entering an algebra or subsystem claim. It is consistent with
the subsystem and algebra scope of
\cite{BenyKempfKribs,BenyKempfKribsPRA} and the full-code interface
reported in \cite{CheungVIIG,CheungEm05B}.

\subsection{Linear determination is not a physical decoder}

\begin{theorem}[Snapshot determination and adjoint containment]
\label{thm:snapshot}
For CPTP maps $\N:\B(H)\to\B(Q)$ and
$\T:\B(H)\to\B(K)$, the following are equivalent:
\begin{enumerate}[label=(\roman*)]
 \item For all states $\rho,\sigma$,
 $\N(\rho)=\N(\sigma)$ implies $\T(\rho)=\T(\sigma)$.
 \item $\ker\N\subseteq\ker\T$ as complex linear subspaces.
 \item $\ran\T^\dagger\subseteq\ran\N^\dagger$.
 \item There is a linear map $L$ on $\ran\N$ such that
 $\T=L\N$.
\end{enumerate}
No positivity or complete positivity of $L$ follows.
\end{theorem}

\begin{proof}
Let $X=X^\dagger\in\ker\N$. Trace preservation gives $\Tr X=0$.
For sufficiently small $t>0$, both
$I_H/\dim H+tX$ and $I_H/\dim H-tX$ are states.
Condition (i) implies $\T(X)=0$. Decomposing a general kernel
element into Hermitian and anti-Hermitian parts proves (ii).
The converse is immediate. Finite-dimensional orthogonal-complement
duality proves (ii)$\Leftrightarrow$(iii).
For (ii)$\Rightarrow$(iv), set $L(\N(X))=\T(X)$; the kernel inclusion
makes this well defined. The remaining implication is immediate.
\end{proof}

\begin{example}[Informational completeness without recovery]
For $0<t<1$, the qubit depolarizing channel
\[
 \N_t(\rho)=t\rho+(1-t)I_2\Tr(\rho)/2
\]
is invertible as a linear map. It therefore determines every input
snapshot. Nevertheless, no CPTP left inverse exists: the trace
distance between the two computational-basis outputs is $t$, whereas
their input trace distance is one, and channels cannot increase
trace distance.
\end{example}

Theorem~\ref{thm:snapshot} is the local finite-dimensional comparison
suggested by the En05-C source notes \cite{CheungEn05C}. It is
deliberately not promoted to a CPTP-decoder theorem.

\section{A fully specified five-qubit tensor}
\label{sec:block}

The five-qubit code is a standard exact quantum error-correcting code
\cite{LaflammeEtAl}. We specify its phases and normalization rather
than importing a decoder convention.

Number physical qubits $1,\ldots,5$ and set
\begin{align*}
 g_1&=XZZXI,&
 g_2&=IXZZX,\\
 g_3&=XIXZZ,&
 g_4&=ZXIXZ.
\end{align*}
Tensor-product symbols are omitted in Pauli strings.
Let $G=\langle g_1,g_2,g_3,g_4\rangle$ and
\[
 P=\frac1{16}\sum_{g\in G}g,\qquad
 \overline X=XXXXX,\qquad
 \overline Z=ZZZZZ.
\]
Define
\begin{equation}
 \ket{\overline0}=4P\ket{00000},\qquad
 \ket{\overline1}=\overline X\ket{\overline0},\qquad
 V\ket{b}=\ket{\overline b}.
 \label{eq:encoder}
\end{equation}

\begin{lemma}[Stabilizer audit]
\label{lem:stabilizer}
The generators commute and are independent. The projector $P$ has
rank two. Up to signs, the fifteen nonidentity elements of $G$ are
the cyclic rotations of
\[
 XZZXI,\qquad XYIYX,\qquad IZYYZ.
\]
In particular every nonidentity element has weight four.
The vectors in \eqref{eq:encoder} are orthonormal.
\end{lemma}

\begin{proof}
Two Pauli strings commute when the number of positions at which their
nonidentity factors anticommute is even. This verifies pairwise
commutation. Multiplication of the four generators gives the fifteen
strings listed by the three cyclic orbits; they are distinct and
none is the identity. Thus the group has sixteen elements and the
generators are independent. Since every nonidentity Pauli is
traceless, $\Tr P=32/16=2$.

None of the fifteen strings contains only $I$ and $Z$. Hence
$\bra{00000}P\ket{00000}=1/16$, proving the normalization of
$\ket{\overline0}$. Both $\overline X$ and $\overline Z$ commute
with $G$, and they anticommute with each other.
The vector $\ket{\overline0}$ has $\overline Z$ eigenvalue $+1$;
$\ket{\overline1}$ has eigenvalue $-1$ and the same norm.
\end{proof}

For clarity, the syndrome of a Pauli is the four-bit string recording
its anticommutation with $(g_1,g_2,g_3,g_4)$.

\begin{center}
\begin{tabular}{c|ccc}
\toprule
Position & $X$ & $Z$ & $Y$\\
\midrule
1 & 0001 & 1010 & 1011\\
2 & 1000 & 0101 & 1101\\
3 & 1100 & 0010 & 1110\\
4 & 0110 & 1001 & 1111\\
5 & 0011 & 0100 & 0111\\
\bottomrule
\end{tabular}
\end{center}

\begin{lemma}[Two-share privacy]
\label{lem:privacy}
For every set $E$ of at most two physical qubits,
\begin{equation}
 \Tr_{\bar E}(V\rho V^\dagger)
 =
 \Tr(\rho)\frac{I_E}{2^{|E|}}.
 \label{eq:privacy}
\end{equation}
This identity holds on all operators, not only states.
\end{lemma}

\begin{proof}
The syndrome table contains each nonzero four-bit string exactly once.
A nonidentity Pauli of weight one has nonzero syndrome. A weight-two
Pauli has the sum of two distinct one-site syndromes, again nonzero.
Such a Pauli $Q$ anticommutes with a stabilizer generator, implying
$V^\dagger QV=0$. Expanding operators on $E$ in its Pauli basis proves
\eqref{eq:privacy}.
\end{proof}

\subsection{Explicit triple decoders and optimal access errors}

Let $B$ be a physical triple, $E=\bar B$, and fix computational bases
and ascending register order. Define the square matrix
\begin{equation}
 U_B\ket{l,e}
 =
 2(I_B\otimes\bra{e}_E)V\ket{l},
 \qquad l\in\{0,1\},\quad e\in\{0,1\}^2.
 \label{eq:UB}
\end{equation}
Thus every entry of $U_B$ is fixed by \eqref{eq:encoder}.

\begin{theorem}[Ideal five-qubit access table]
\label{thm:block}
The matrix $U_B$ is unitary and
\begin{equation}
 \N_B^V(\rho):=\Tr_E(V\rho V^\dagger)
 =
 U_B(\rho\otimes I_4/4)U_B^\dagger.
 \label{eq:block-channel}
\end{equation}
Consequently
\[
 D_B(\sigma)=\Tr_{\C^4}(U_B^\dagger\sigma U_B)
\]
recovers the qubit exactly, including every external reference.

For an arbitrary accessible set $A$,
\[
 \inf_D\dd(D\N_A^V,\id_2)
 =
 \begin{cases}
  3/4,& |A|\leq2,\\
  0,& |A|\geq3.
 \end{cases}
\]
The infimum is over all CPTP decoders on the declared accessible set.
\end{theorem}

\begin{proof}
Privacy on $E$ gives
\[
 V^\dagger(I_B\otimes\ket{e}\bra{f}_E)V
 =\delta_{ef}I_2/4.
\]
The eight columns in \eqref{eq:UB} are therefore orthonormal.
Summing the four environment components proves
\eqref{eq:block-channel}, first on matrix units and hence on all
operators. Tensoring this equality with a reference proves the
reference statement. For larger access, discard to a triple.

For $|A|\leq2$, every decoder output is a replacement state $\tau$.
On a Bell input, $\tau\otimes I_2/2$ has Bell overlap $1/4$.
The Bell-projector measurement gives error at least $3/4$.
The replacement $I_2/2$ attains this value because
\[
 \operatorname{Dep}_2
 =\frac14\bigl(
   \id_2+\operatorname{Ad}_X+
   \operatorname{Ad}_Y+\operatorname{Ad}_Z
 \bigr),
\]
so its half-diamond distance from $\id_2$ is at most $3/4$.
\end{proof}

\begin{theorem}[Uniqueness and coherent environment]
\label{thm:unique}
For a triple $B$, every CPTP map satisfying $D\N_B^V=\id_2$
equals $D_B$ on the whole matrix algebra $\B((\C^2)^{\otimes3})$.
Its Choi rank is four. Every pure-environment Stinespring
implementation therefore requires environment dimension at least
four, and a coherent output-plus-environment realization needs at
least three qubits in total.
\end{theorem}

\begin{proof}
Let $K_a$ be Kraus operators of $D$. Kraus operators of $D\N_B^V$
are
\[
 \frac12K_aU_B(I_2\otimes\ket{e}),\qquad e=0,\ldots,3.
\]
Because the identity channel has Choi rank one, each is scalar
times $I_2$. Thus
\[
 K_aU_B=I_2\otimes\bra{v_a}
\]
for suitable vectors $v_a$. Trace preservation gives
$\sum_a\proj{v_a}=I_4$, whence
$D=\Tr_{\C^4}\circ\operatorname{Ad}_{U_B^\dagger}$.

The four Kraus operators
$(I_2\otimes\bra{e})U_B^\dagger$ are linearly independent, so the
Choi rank is four. A Stinespring environment dimension bounds the
number of linearly independent Kraus operators. The lower bound is
attained by applying $U_B^\dagger$ and retaining the two-qubit
environment.
\end{proof}

The coherent bound is not a lower bound on all measurement-assisted
live-register implementations. That distinction will matter below.

\subsection{The six-leg perfect state}

Define
\begin{equation}
 \ket{T}
 =
 \frac1{\sqrt2}\sum_{l=0}^1
 \ket{l}_R V\ket{l},
 \qquad
 T_{l,x_1,\ldots,x_5}
 =
 \frac1{\sqrt2}V_{x_1,\ldots,x_5;l}.
 \label{eq:perfect}
\end{equation}

\begin{proposition}[Perfect-tensor property]
\label{prop:perfect}
Every reduction of $\proj{T}$ to at most three of its six qubits is
maximally mixed. Thus every balanced three-input/three-output
reshaping of $\sqrt8\,T$ is unitary.
\end{proposition}

\begin{proof}
A triple containing $R$ contains at most two physical qubits.
Equation~\eqref{eq:privacy} applied to the Bell construction makes
this reduction maximally mixed. A triple containing only physical
qubits is a reduction of $VV^\dagger/2=P/2$. By
Lemma~\ref{lem:stabilizer}, no nonidentity stabilizer is supported
on three qubits, so this reduction is $I_8/8$.
Smaller reductions follow by tracing. The balanced reshaping
statement is precisely the matrix form of a maximally mixed
three-qubit reduction.
\end{proof}

This is the finite perfect-tensor ingredient used in
\cite{PastawskiEtAl}. It is not an experimental certification result.

\section{One connected two-cell encoding}
\label{sec:patch}

Use two copies of the same tensor. Each cell has one bulk input,
four exterior physical legs, and one joining leg. Denote the left
bulk by $L$, the right bulk by $S$, the exterior legs by
\[
 a_1,\ldots,a_4,\qquad c_1,\ldots,c_4,
\]
and the joining legs by $e,e'$.

Reshape the block encoder into
\begin{equation}
 F_{a;l,e}=\sqrt2\,V_{a,e;l},
 \qquad
 F:\C^2_L\otimes\C^2_e\longrightarrow(\C^2)^{\otimes4}_a.
 \label{eq:F}
\end{equation}
Use the same convention for the right cell. Define
\begin{equation}
 W
 =
 (F_L\otimes F_R)
 \bigl(I_{LS}\otimes\ket{\Phi_2}_{ee'}\bigr).
 \label{eq:W}
\end{equation}
In components,
\begin{equation}
 W_{a,c;l,s}
 =
 \sqrt2\sum_{e=0}^1 V_{a,e;l}V_{c,e;s}
 =
 2\sqrt2\sum_{e=0}^1T_{l,a,e}T_{s,c,e}.
 \label{eq:W-components}
\end{equation}

\begin{proposition}[Normalization and physical implementation]
\label{prop:W}
Both $F$ and $W$ are isometries.
If
\[
 C=(\bra{\Phi_2}_{ee'})(V_L\otimes V_R),
\]
then $W=2C$ and $C^\dagger C=I_{LS}/4$.
Equation~\eqref{eq:W} is a deterministic isometric implementation:
prepare one Bell pair and apply the two isometries $F$.
It does not postselect a Bell outcome.
\end{proposition}

\begin{proof}
Single-leg privacy gives
\[
 \sum_a \overline{V_{a,e;l}}V_{a,f;m}
 =\delta_{ef}\delta_{lm}/2,
\]
so $F^\dagger F=I_4$. Equation~\eqref{eq:W} now immediately gives
$W^\dagger W=I_4$. Direct contraction with the normalized Bell bra
gives $C_{a,c;l,s}=2^{-1/2}\sum_eV_{a,e;l}V_{c,e;s}$, proving
$W=2C$ and the claimed success operator.
\end{proof}

The factor $2\sqrt2$ in \eqref{eq:W-components} is essential:
contracting normalized perfect states without auditing the scale
would not produce the stated isometry.

\subsection{Triple patch decoders}

For a left exterior triple $K\subseteq\{a_1,\ldots,a_4\}$, let $b$
be the remaining exterior leg. Define
\begin{equation}
 U_K\ket{l,e,h}
 =
 \sum_{a_K}2V_{a_K,h,e;l}\ket{a_K}.
 \label{eq:UK}
\end{equation}
The order in the coefficient is the declared exterior order, with
$b=h$ and the joining leg last.

\begin{lemma}[Patch channel identity]
\label{lem:patchidentity}
The matrix $U_K$ is unitary and
\[
 \Tr_b(F\rho F^\dagger)
 =
 U_K(\rho\otimes I_h/2)U_K^\dagger
\]
for every operator $\rho$ on $L\otimes e$.
Equivalently,
\[
 F=(U_K\otimes I_b)
      (I_{Le}\otimes\ket{\Phi_2}_{hb}).
\]
\end{lemma}

\begin{proof}
Equation~\eqref{eq:UK} is the balanced reshaping
$\sqrt8\,T$ from Proposition~\ref{prop:perfect}, hence is unitary.
The second formula follows directly from
$F_{a_K,b;l,e}=\sqrt2 V_{a_K,b,e;l}$.
Tracing $b$ proves the channel identity.
\end{proof}

\begin{theorem}[Connected subsystem and full-bulk recovery]
\label{thm:patch}
Let
\[
 \N_A^W(\rho)=\Tr_{\bar A}(W\rho W^\dagger).
\]
If $A$ contains a left exterior triple $K$, then
\[
 D_K(\sigma)=\Tr_{e,h}(U_K^\dagger\sigma U_K)
\]
satisfies
\begin{equation}
 D_K\N_K^W=\Tr_S.
 \label{eq:subsystemexact}
\end{equation}
The equality holds for arbitrary $LS$ inputs, including spectator
correlations and arbitrary external references.

If $A$ contains a triple on each side, applying both inverse
unitaries and discarding their joining and auxiliary registers
recovers the entire two-qubit bulk exactly.
\end{theorem}

\begin{proof}
Trace the entire right exterior output in \eqref{eq:W}.
Because $F_R$ is isometric, this is equivalent to tracing $S,e'$.
The left joining register is then $I_e/2$, independent of the
remaining state on $L$ and its reference. Applying
Lemma~\ref{lem:patchidentity} gives
\[
 \N_K^W(\rho)
 =
 U_K\bigl(\Tr_S(\rho)\otimes I_e/2\otimes I_h/2\bigr)U_K^\dagger.
\]
This is an operator identity and proves
\eqref{eq:subsystemexact}.

For two triples, the two inverse unitaries return
\[
 \rho_{LS}\otimes\Phi_{ee'}\otimes I_{h_L}/2\otimes I_{h_R}/2.
\]
Tracing the indicated registers returns $\rho_{LS}$.
All steps commute with adjoining an untouched reference.
\end{proof}

For all four exterior legs of a cell one may instead use the complete
decoder
\[
 D_4(\sigma)
 =
 \Tr_e(F^\dagger\sigma F)
 +\Tr((I-FF^\dagger)\sigma)I_L/2.
\]
The second term completes the channel outside the isometry range.

\subsection{A nontrivial hybrid algebra on the same bulk}

On $L\otimes S$ choose sectors according to the computational basis
of $S$:
\[
 \M_{\mathrm{hyb}}
 =
 \B(L)\otimes\diag(S).
\]
Each sector contains one logical qubit. The restriction target is
\begin{equation}
 \T_{\mathrm{hyb}}(\rho)
 =
 \bigoplus_{s=0}^1
 (I_L\otimes\bra{s})\rho(I_L\otimes\ket{s}).
 \label{eq:hyb}
\end{equation}
Identify its output with $L\otimes S_{\mathrm{cl}}$.

\begin{corollary}[Same-model hybrid decoder]
A triple on each side supports exact recovery of
$\T_{\mathrm{hyb}}$: use the full-bulk decoder of
Theorem~\ref{thm:patch} and then dephase the returned $S$ register.
The target preserves sector labels and within-sector quantum
information, but not coherence between $s=0$ and $s=1$.
\end{corollary}

\begin{proof}
The full-bulk decoder returns $\rho$. Dephasing $S$ produces
\eqref{eq:hyb}.
\end{proof}

\subsection{Optimal errors for selected access classes}

\begin{lemma}[Small-access privacy of the connected encoding]
\label{lem:patchprivacy}
If $|A|\leq2$ among the eight exterior legs, then
\[
 \N_A^W(\rho)=\Tr(\rho)I_A/2^{|A|}.
\]
If only left exterior legs are accessible, their channel is
\[
 \N_A^W=\N_A^V\Tr_S.
\]
\end{lemma}

\begin{proof}
The second identity follows from the right trace used in the proof
of Theorem~\ref{thm:patch} and
\[
 F(\rho_L\otimes I_e/2)F^\dagger
 =\Tr_e(V\rho_LV^\dagger).
\]
For two accessible legs on one side, block privacy proves the result.

For one leg on each side, first observe that
$F^\dagger QF=0$ for every nonidentity one-site exterior Pauli $Q$.
Indeed, the reduction of $\proj{T}$ to its bulk leg, joining leg,
and that exterior leg is maximally mixed; expanding its matrix
elements gives this identity. Expectations of nonidentity Pauli
operators supported on the selected two legs therefore vanish in
\eqref{eq:W}. Their Pauli expansion proves the stated replacement
channel.
\end{proof}

\begin{theorem}[Selected operational access map]
\label{thm:accessmap}
For the ideal encoding $W$, the optimal unrestricted half-diamond
errors for the following declared targets and access classes are:
\[
\begin{array}{c|ccc}
\text{Access}&\Tr_S&\id_{LS}&\T_{\mathrm{hyb}}\\ \hline
|A|\leq2&3/4&15/16&7/8\\
\text{three or four left legs, no right leg}&0&3/4&1/2\\
\text{at least three legs on each side}&0&0&0.
\end{array}
\]
No value is asserted here for an unlisted mixed access pattern.
\end{theorem}

\begin{proof}
For $|A|\leq2$, the channel is constant.
The subsystem optimum is $3/4$ by the qubit replacement argument;
the upper bound is unchanged by composing with $\Tr_S$.
For full two-qubit recovery, a maximally entangled four-dimensional
input has overlap $1/16$ with every replacement Choi state.
The replacement $I_4/4$ attains error $15/16$, by the sixteen-term
two-qubit Pauli expansion of $\operatorname{Dep}_4$.

For the hybrid target, identify the output with $L\otimes S$ and
write $\T_{\mathrm{hyb}}=\id_L\otimes\Delta_{Z,S}$.
Its normalized Choi state is supported on
\[
 P_{\mathrm{hyb}}
 =
 \Phi_{L L'}\otimes
 \sum_{s=0}^1\proj{s}_{S}\otimes\proj{s}_{S'}.
\]
It has support probability one. A replacement Choi state
$\tau\otimes I_4/4$ has support probability $1/8$, because
$\Tr_{L'S'}P_{\mathrm{hyb}}=I_{LS}/2$.
Thus the error is at least $7/8$.
For the upper bound, $\T_{\mathrm{hyb}}$ is the equal mixture of
$\id_{LS}$ and $\operatorname{Ad}_{I_L\otimes Z_S}$, whereas
$\operatorname{Dep}_4$ is the equal mixture of all sixteen Pauli
conjugations. Their difference is $7/8$ times a difference of two
channels, so its half-diamond norm is at most $7/8$.

For left-only triple or four-leg access, $L$ is returned exactly
and no information about $S$ is available.
Replacing $S$ by $I_2/2$ gives full-bulk error $3/4$; a Bell input
on $S$ gives the matching lower bound.
For the hybrid target, returning a fair sector label gives error
$1/2$. The lower bound follows by using the two orthogonal sector
inputs with the same logical state: they have identical accessible
outputs, so a single decoder cannot be closer than $1/2$ to both
orthogonal target outputs. The two-triple case is
Theorem~\ref{thm:patch}.
\end{proof}

\section{Resource-restricted programmes}
\label{sec:programmes}

\subsection{Legal programmes and accounting conventions}

\begin{definition}[Legal finite programme]
A programme is a finite acyclic decision tree. Each node applies a
declared operation to named live registers:
\begin{enumerate}[label=(\roman*)]
 \item a unitary from a frozen finite library;
 \item preparation of a fixed fresh ancilla, initially independent
 of the input, source, and validation reference;
 \item a finite-outcome CP instrument whose outcome sum is TP;
 \item explicit discard, classical update, or an allowed input arrival.
\end{enumerate}
Every terminal branch returns a state on the same declared output
space. An abort has an explicit replacement output. No operation
acts on omitted source registers or the external validation reference.
No primitive hides an undeclared quantum memory.
\end{definition}

For this manuscript a sufficient frozen library contains:
the explicitly defined $U_B^\dagger$ and $U_K^\dagger$ matrices,
unitary extensions of $F$, single-qubit Clifford operations,
Bell preparation, the two-qubit measurement used below, ordinary
projective measurements, and explicit discards. A unitary extension
of $F$ is fixed by completing its four columns with Gram--Schmidt
in computational-basis order. Thus the finite library is determined
by printed matrices, not by an unspecified synthesis oracle.

\begin{definition}[Ledgers]
The decoder live-register peak is the maximum, over branches and
times, of the number of decoder-held qubits. It includes fresh
ancillas and returned output registers. Unarrived source registers
are listed separately in a source-storage ledger; they cannot be
operated on before arrival.

The storage ledger records every register's holding interval and
location. The classical ledger records outcome alphabets and messages.
A total experiment-storage claim must include both decoder storage
and parked source storage. A decoder peak is not, by itself, a bound
on total physical storage.
\end{definition}

\begin{theorem}[Programme-to-channel and ledger theorem]
\label{thm:programme}
Every legal finite programme induces a CPTP map on its declared
accessible input. Its action on reference-entangled inputs is the
same map tensored with the reference identity. Register counting
along every branch bounds its declared peak and storage costs.
\end{theorem}

\begin{proof}
Associate a CP map with each branch prefix by composing its operation
maps, tensoring fresh states, and tracing explicit discards. For an
instrument, summing the children yields the parent's trace-preserving
continuation. Induction from the leaves to the root shows that the
sum of complete branch maps is CP and TP. Replacing an abort by a
fixed state is a TP continuation of that abort branch.

Every operation has support only on declared registers. Tensoring
with an untouched reference commutes with all compositions and
branch sums, proving the reference statement.
The live-set update at each node is specified by arrivals,
preparations, operations, and discards. Its cardinality and holding
intervals therefore give the stated pathwise bounds.
\end{proof}

This proves the programme interface described in
\cite{CheungEn02B,CheungEn02C}; no apparatus-level conformity is
deduced from it.

\subsection{A sharp streaming and communication benchmark}

We now restrict access to the regression triple $B=\{1,2,3\}$ of the
five-qubit encoding. This is a precisely scoped resource theorem,
not a claim about every access set of the connected encoding.

Multiplying the full logical Paulis by stabilizers gives
\begin{equation}
 X_B=-Z_1X_2Z_3,\qquad
 Z_B=-Y_1Z_2Y_3.
 \label{eq:triplePaulis}
\end{equation}
They satisfy
$X_BV=VX$ and $Z_BV=VZ$. Consequently
\[
 U_B^\dagger X_BU_B=X\otimes I_4,\qquad
 U_B^\dagger Z_BU_B=Z\otimes I_4.
\]

Set
\[
 P_{12}=Z_1X_2,\qquad Q_{12}=Y_1Z_2.
\]
These are commuting independent Pauli operators. Their common
eigenprojectors are
\[
 \Pi_{pq}=\frac14(I+pP_{12})(I+qQ_{12}),
 \qquad p,q\in\{+1,-1\}.
\]
Each projector has rank one. Choose a one-qubit unitary $R_{pq}$ by
\begin{equation}
 R_{pq}^\dagger X R_{pq}=-pZ,\qquad
 R_{pq}^\dagger Z R_{pq}=-qY.
 \label{eq:R}
\end{equation}
These two anticommuting axes specify a unitary up to global phase.

\begin{theorem}[Exact peak two on the declared triple]
\label{thm:stream}
Consider streaming programmes with access exactly to $\{1,2,3\}$,
arbitrary arrival order, no additional source-correlated quantum
resource, and no undeclared quantum memory.
The following programme recovers exactly with decoder peak two:
\begin{enumerate}
 \item hold qubits $1,2$ and measure $\{\Pi_{pq}\}$;
 \item retain $(p,q)$ classically and discard qubits $1,2$;
 \item receive qubit $3$ and apply $R_{pq}$.
\end{enumerate}
No legal exact programme in this streaming model has peak one.
\end{theorem}

\begin{proof}
The adjoint of the printed programme sends
\[
 X\longmapsto -P_{12}\otimes Z_3=X_B,\qquad
 Z\longmapsto -Q_{12}\otimes Y_3=Z_B.
\]
It sends $Y=iXZ$ to the corresponding logical $Y$ representative,
since $R_{pq}^\dagger YR_{pq}=pqX$.
Together with the identity these operators span the output algebra.
The programme therefore equals $D_B$, proving exact recovery.
Its live peak is two.

For the lower bound, suppose an exact peak-one programme exists.
Before another input qubit can arrive, the first input qubit must
have been discarded, leaving only a finite classical record.
Operations on that first qubit define a POVM $\{E_m\}$.

By Theorem~\ref{thm:unique}, the complete decoder is $D_B$.
Every Kraus operator of $D_B$ has the form
$(I_2\otimes\bra{v})U_B^\dagger$.
For a refinement according to the first record $m$, the corresponding
effect is therefore in the commutant of $X_B$ and $Z_B$.
But that effect is $E_m\otimes I$ on the three inputs.
At every individual site the local factors of $X_B$ and $Z_B$
anticommute. Hence $E_m$ commutes with two independent Pauli axes
and must equal $p_mI_2$.

After discarding the first qubit, record $m$ and the other two qubits
are thus described by $p_m$ times the two-share reduced channel.
Lemma~\ref{lem:privacy} makes that channel constant.
No continuation can recover the logical qubit, a contradiction.
\end{proof}

\begin{theorem}[Four messages in a one-way model]
\label{thm:messages}
Suppose a sender holds qubits $1,2$, a receiver holds qubit $3$,
and only a finite classical message is sent from sender to receiver.
There is no extra shared resource. Exact recovery requires at least
four possible messages, hence at least two bits in a fixed-length
message model. Four messages suffice.
\end{theorem}

\begin{proof}
The preceding programme proves sufficiency. For necessity, let the
sender's POVM be $\{E_m\}$ and the receiver's conditional channel
be $T_m$. Exactness and Theorem~\ref{thm:unique} imply, on all
three-qubit operators,
\[
 D(\proj{\psi_{pq}}\otimes\rho)
 =R_{pq}\rho R_{pq}^\dagger,
\]
where $\proj{\psi_{pq}}=\Pi_{pq}$. Therefore
\[
 \sum_m \Tr(E_m\Pi_{pq})T_m
 =\operatorname{Ad}_{R_{pq}}.
\]
A unitary channel has rank-one Choi matrix, so a convex decomposition
of it into channels contains only that same channel with positive
weight. Any message having positive probability for sector $(p,q)$
must therefore implement $\operatorname{Ad}_{R_{pq}}$.
The four conjugation channels are distinct by \eqref{eq:R}.
Their message supports are disjoint, so there must be at least
four messages.
\end{proof}

\begin{remark}[Scope of the lower bounds]
Theorems~\ref{thm:unique}--\ref{thm:messages} concern different resource
classes: a coherent Stinespring realization, a specified streaming
triple, and a specified one-way architecture.
They do not assert a universal lower bound for arbitrary larger
access sets, pre-shared entanglement, hidden quantum storage, or a
different source-arrival convention.
\end{remark}

\subsection{Observable readout at peak one}

Measuring the three single-site factors of
$Z_B=-Y_1Z_2Y_3$ sequentially and returning their signed parity
gives exact logical $Z$ readout at peak one. Similarly,
$X_B=-Z_1X_2Z_3$ gives exact logical $X$ readout.

These are quantum-to-classical channels. They do not constitute the
coherent decoder in Theorem~\ref{thm:stream}. Proposition~\ref{prop:EB}
makes the distinction quantitative.

\subsection{A decomposition-specific tree comparison}

\begin{proposition}[Balanced recursive modules]
\label{prop:tree}
Concatenate the five-qubit encoder to depth $h$ and retain three
designated children at every node. Within the module class in which
each child is fully decoded before being consumed by its parent,
the depth-first measurement-assisted schedule has peak $h+1$,
for $h\geq1$. This is optimal in that module class.

The explicitly non-adaptive schedule that receives and holds all
$3^h$ selected leaves before any decoding has peak $3^h$.
\end{proposition}

\begin{proof}
At height one, Theorem~\ref{thm:stream} gives peak two.
At a parent, decode the first child and retain its one-qubit output.
Decode the second child while holding that output, measure the two
outputs using the parent two-qubit measurement, and discard them.
Decode the third child and apply the parent feedforward.
If the child peak is $p_{h-1}$, the parent peak is $p_{h-1}+1$.
Thus $p_h=h+1$.

In the declared module class, two completed child outputs are needed
for the parent measurement. One must be held while a second child
is decoded. This gives the same recurrence as a lower bound.
The non-adaptive peak follows from its stipulated initial holding
of all selected leaves; later decoding need not exceed that count.
\end{proof}

This is an architectural comparison, not a global scheduling theorem
over every possible instrument decomposition.

\section{Complete branches and approximation budgets}
\label{sec:approx}

\begin{proposition}[Successful-branch trap]
\label{prop:branchtrap}
Consider the complete qubit channel
\[
 \Gamma_\eta
 =\eta\id_2+(1-\eta)\operatorname{Dep}_2,
 \qquad 0\leq\eta\leq1.
\]
A success flag may identify the identity branch with conditional
Bell fidelity one. If the returned output discards that flag, then
\[
 \dd(\Gamma_\eta,\id_2)=\frac34(1-\eta).
\]
\end{proposition}

\begin{proof}
The complete channel difference is
$(1-\eta)(\operatorname{Dep}_2-\id_2)$.
Theorem~\ref{thm:block} gives the stated norm.
\end{proof}

If the flag is retained, the target must specify its ideal output
law and the channel distance must be recomputed on that larger output
space. Conditional success normalization can also be nonlinear when
success depends on the input; it is not then a channel replacement
for the complete instrument.

\begin{proposition}[Recovery, implementation, and model triangle]
\label{prop:triangle}
Let $\N_{\mathrm{mod}}$ and $\N_{\mathrm{act}}$ have the same
accessible output space, and let $D$ and $\widetilde D$ have the same
input and output spaces. If
\[
 \dd(D\N_{\mathrm{mod}},\T)\leq\varepsilon_{\mathrm{rec}},\quad
 \dd(\widetilde D,D)\leq\varepsilon_{\mathrm{impl}},\quad
 \dd(\N_{\mathrm{act}},\N_{\mathrm{mod}})
 \leq\varepsilon_{\mathrm{mod}},
\]
then
\[
 \dd(\widetilde D\N_{\mathrm{act}},\T)
 \leq
 \min\{1,\varepsilon_{\mathrm{rec}}
          +\varepsilon_{\mathrm{impl}}
          +\varepsilon_{\mathrm{mod}}\}.
\]
\end{proposition}

\begin{proof}
Insert $D\N_{\mathrm{mod}}$ and
$\widetilde D\N_{\mathrm{mod}}$ and use the triangle inequality.
Pre- and post-composition by channels contract diamond distance.
\end{proof}

This is the local version of the approximation accounting described
in \cite{CheungEn02B,CheungEn02C}. A transfer allowance is a different
statement: it compares the tested complete channel with the channel
claimed elsewhere. It does not calibrate state preparation or
measurement.

\section{Dimension-correct channel conversion}
\label{sec:choi}

Let $d=\dim H$, $k=\dim K$, and use
\[
 \ket{\Phi_d}=\frac1{\sqrt d}\sum_{i=1}^d\ket{i}\ket{i}.
\]
For a linear map $\Lambda:\B(H)\to\B(K)$ define
\[
 J(\Lambda)
 =
 (\Lambda\otimes\id_H)(\Phi_d).
\]

\begin{lemma}[Normalized Choi bounds]
\label{lem:choi}
For channels $\Lambda,\T$ with input dimension $d$,
\begin{equation}
 \frac12\norm{J(\Lambda)-J(\T)}_1
 \leq \dd(\Lambda,\T)
 \leq
 \min\left\{1,\frac d2\norm{J(\Lambda)-J(\T)}_1\right\}.
 \label{eq:choibound}
\end{equation}
The output dimension need not equal the input dimension.
\end{lemma}

\begin{proof}
The lower bound uses $\Phi_d$ as a permissible input.
For the upper bound, every pure state on $H\otimes H$ can be written
as $(I_H\otimes M)\ket{\Phi_d}$ with
$\Tr(M^\dagger M)=d$, and hence $\norm{M}_\infty\leq\sqrt d$.
For $\Delta=\Lambda-\T$ its output is
\[
 (I_K\otimes M)J(\Delta)(I_K\otimes M^\dagger).
\]
The trace norm is at most $d\norm{J(\Delta)}_1$.
Convexity handles mixed inputs; Schmidt decomposition reduces a
larger reference to dimension $d$. Taking the channel-discrimination
supremum gives the result.
\end{proof}

These inequalities are consistent with the normalized-Choi convention
in Lemma~7 of \cite{WallmanFlammia}; completely bounded norm
formulations are also discussed in \cite{Watrous}.

\begin{corollary}[Identity-target overlap conversion]
\label{cor:pure}
If $\Lambda:\B(\C^d)\to\B(\C^d)$ and
$f=\Tr(\Phi_dJ(\Lambda))$, then
\begin{equation}
 1-f\leq\dd(\Lambda,\id_d)
 \leq\min\{1,d\sqrt{1-f}\}.
 \label{eq:pureconversion}
\end{equation}
\end{corollary}

\begin{proof}
The Bell-projector measurement proves the lower bound.
For completeness, the pure-state trace-distance inequality
\[
 \frac12\norm{\sigma-\proj{\psi}}_1
 \leq \sqrt{1-\bra{\psi}\sigma\ket{\psi}}
\]
follows by purifying $\sigma$ with overlap
$\sqrt{\bra{\psi}\sigma\ket{\psi}}$ with a purification of
$\proj{\psi}$, evaluating the trace distance of the two pure
states, and tracing the purifier.
Apply this inequality to $J(\Lambda)$ and use
Lemma~\ref{lem:choi}.
\end{proof}

\subsection{Mixed subsystem and algebra Choi targets}

For $H=C_L\otimes S$, with dimensions $\ell,s$ and $d=\ell s$,
\begin{equation}
 J(\Tr_S)
 =
 \Phi_{\ell,L L'}\otimes I_{S'}/s.
 \label{eq:subchoi}
\end{equation}
The reference includes both $L'$ and $S'$. Testing only $L'$ with
a fixed spectator prepares a different, weaker task.

For the algebra target, with $c_\alpha=\dim C_\alpha$ and
$s_\alpha=\dim S_\alpha$,
\begin{equation}
 J(\R_\M)
 =
 \bigoplus_\alpha
 \frac{c_\alpha s_\alpha}{d}
 \left(
   \Phi_{c_\alpha}\otimes\frac{I_{S'_\alpha}}{s_\alpha}
 \right),
 \label{eq:algchoi}
\end{equation}
where each block pairs its output sector with the matching input
reference sector. Equations~\eqref{eq:subchoi} and
\eqref{eq:algchoi} follow by expanding the normalized maximally
entangled input in matrix units.

A single overlap with these mixed states does not permit the
pure-target proof of Corollary~\ref{cor:pure}. The general trace-norm
certificate below avoids that mistake.

\begin{proposition}[When subsystem certification reduces to a qubit]
\label{prop:spectatorblind}
If an independently established structural identity gives
\[
 \Lambda=\Gamma\Tr_S,
\]
then
\[
 \dd(\Lambda,\Tr_S)=\dd(\Gamma,\id_{C_L}).
\]
Without that identity, tests with one fixed spectator do not establish
the equality.
\end{proposition}

\begin{proof}
Composition by $\Tr_S$ gives the upper bound.
For the lower bound, embed an arbitrary $C_L$ input with a fixed
state of $S$, retaining its reference.
\end{proof}

\section{Finite-confidence certification}
\label{sec:statistics}

\subsection{Validation assumptions}

The following assumptions are part of the claim, not consequences
of favorable frequencies.

\begin{contract}[Validation hypotheses]
\label{con:validation}
Conditionally on frozen pilot and calibration information:
\begin{enumerate}[label=(V\arabic*)]
 \item The decoder and target are fixed before held-out validation.
 \item Each setting is applied to independent repetitions of one
 fixed complete channel $\Lambda_0$.
 \item Validation inputs are independent of the apparatus'
 fresh ancillas and hidden systems. The reference is untouched
 by the decoder.
 \item Each measurement has a declared bounded outcome range and
 a calibrated relation between its mean and the ideal Choi
 expectation.
 \item Shot counts and confidence allocations are fixed; no
 unaccounted optional stopping or data-dependent setting removal
 is used.
 \item Every branch belongs to the tested channel. Abort and loss
 trials are not silently deleted.
 \item An access audit supports the declared interface.
 \item Calibration and transfer statements hold jointly except
 on an event of probability at most $\beta$.
\end{enumerate}
A drifted, memory-dependent, or preparation-dependent apparatus is
not covered unless a separate theorem supplies an appropriate
sampling model.
\end{contract}

\subsection{A general certificate for mixed targets}

Put $D=kd$, the dimension of the output-reference space.
Choose an orthonormal Hermitian basis
$\{G_\nu\}_{\nu=1}^{D^2}$ satisfying
$\norm{G_\nu}_\infty\leq1$.
For example, use the diagonal matrix units and, for $i<j$,
\[
 \frac{\ket{i}\bra{j}+\ket{j}\bra{i}}{\sqrt2},
 \qquad
 \frac{-i\ket{i}\bra{j}+i\ket{j}\bra{i}}{\sqrt2}.
\]
Measure the spectral observable $G_\nu$ on fresh Choi outputs.
Let $\widehat\theta_\nu$ be the mean of $n_\nu$ outcomes in
$[-1,1]$. Allocate $\delta_\nu>0$ and set
\begin{equation}
 t_\nu=\sqrt{\frac{2}{n_\nu}\log\frac{2}{\delta_\nu}}.
 \label{eq:hoeffding-radius}
\end{equation}
Suppose calibration supplies
\[
 \left|\mathbb E\widehat\theta_\nu
       -\Tr(G_\nu J(\Lambda_0))\right|\leq\gamma_\nu
\]
on the good calibration event. Define
\begin{align}
 \widehat J&=\sum_\nu\widehat\theta_\nu G_\nu,\\
 r&=\sqrt D
       \left(\sum_\nu(t_\nu+\gamma_\nu)^2\right)^{1/2},\\
 a&=\norm{\widehat J-J(\T)}_1.
\end{align}
No positivity projection of $\widehat J$ is required.

\begin{theorem}[General mixed-target interval]
\label{thm:tomography}
If $\dd(\Lambda_\star,\Lambda_0)\leq b$ on the good calibration
and transfer event, set
\begin{equation}
 L=\max\{0,(a-r)/2-b\},\qquad
 U=\min\{1,d(a+r)/2+b\}.
 \label{eq:generalinterval}
\end{equation}
Then
\[
 \Pr\!\left\{
   \dd(\Lambda_\star,\T)\notin[L,U]
 \right\}
 \leq \sum_\nu\delta_\nu+\beta.
\]
The result applies to subsystem and algebra targets
\eqref{eq:subchoi}--\eqref{eq:algchoi}.
\end{theorem}

\begin{proof}
For independent outcomes in $[-1,1]$, Hoeffding's inequality
\cite{Hoeffding} gives
\[
 \Pr\left\{
 |\widehat\theta_\nu-\mathbb E\widehat\theta_\nu|>t_\nu
 \right\}\leq\delta_\nu.
\]
The union bound and calibration imply, simultaneously,
\[
 |\widehat\theta_\nu-\Tr(G_\nu J(\Lambda_0))|
 \leq t_\nu+\gamma_\nu.
\]
Orthonormality gives the squared Hilbert--Schmidt norm as the sum
of squared coefficient errors. The inequality
$\norm{X}_1\leq\sqrt D\norm{X}_2$ therefore gives
$\norm{\widehat J-J(\Lambda_0)}_1\leq r$.

The trace-norm triangle inequality bounds the true Choi discrepancy
between $\max\{0,a-r\}$ and $a+r$.
Lemma~\ref{lem:choi} and the transfer triangle give
\eqref{eq:generalinterval}. Union with the calibration/transfer
failure event proves the claim.
\end{proof}

For qubit systems, product Pauli observables give a local-measurement
implementation. If $P$ ranges over nonidentity Paulis on the $D$-
dimensional output-reference space, measure its $\pm1$ outcomes,
set
\[
 \widehat J=\frac1D
 \left(I+\sum_{P\ne I}\widehat\theta_P P\right),
\]
and replace $r$ by
\[
 r=\left(\sum_{P\ne I}(t_P+\gamma_P)^2\right)^{1/2}.
\]
Pauli orthogonality proves this sharper normalization directly.
This remains full tomography; no scalability advantage is claimed.

\subsection{What a calibration allowance means}

\begin{proposition}[One sufficient calibration calculation]
\label{prop:calibration}
Suppose the prepared input-reference state is at trace distance at
most $p$ from $\Phi_d$, and a bounded measurement's implemented
mean observable differs from $G_\nu$ in operator norm by at most
$m_\nu$. Then
\[
 \gamma_\nu=2p+m_\nu
\]
is a valid coefficient allowance.
\end{proposition}

\begin{proof}
Channels contract trace distance, so the actual output-reference
state is within trace distance $p$ of $J(\Lambda_0)$.
The expectation difference for an observable of operator norm at
most one is bounded by the trace norm, hence by $2p$.
The measurement-observable discrepancy contributes at most
$m_\nu$.
\end{proof}

The bounds $p,m_\nu$ require independent support. They cannot be
inferred merely by inserting a desired value of $b$.

\subsection{The three-correlation qubit identity certificate}

For a complete qubit channel define
\[
 c_x=\Tr((X\otimes X)J(\Lambda_0)),\quad
 c_y=\Tr((Y\otimes Y)J(\Lambda_0)),\quad
 c_z=\Tr((Z\otimes Z)J(\Lambda_0)).
\]
Since
\[
 \Phi_2=\frac14(I+X\otimes X-Y\otimes Y+Z\otimes Z),
\]
its Bell overlap is
\[
 f=\frac{1+c_x-c_y+c_z}{4}.
\]
With independent bounded-outcome estimates and allocations
$\delta_i$, let
\[
 \widehat f=\frac{1+\widehat c_x-\widehat c_y+\widehat c_z}{4},
 \qquad
 \zeta=\frac14\sum_{i=x,y,z}(t_i+\gamma_i),
\]
and clip the overlap endpoints to $[0,1]$:
\[
 f_L=\max\{0,\min\{1,\widehat f-\zeta\}\},\quad
 f_U=\max\{0,\min\{1,\widehat f+\zeta\}\}.
\]

\begin{corollary}[Bell-correlation interval]
\label{cor:bell}
For the qubit identity target,
\begin{equation}
 L=\max\{0,1-f_U-b\},\qquad
 U=\min\{1,2\sqrt{1-f_L}+b\}
 \label{eq:bellinterval}
\end{equation}
has failure probability at most
$\delta_x+\delta_y+\delta_z+\beta$.
\end{corollary}

\begin{proof}
The overlap interval follows from the coefficient intervals.
Apply Corollary~\ref{cor:pure} with $d=2$ and the transfer triangle.
\end{proof}

The factor two is the input-dimension factor. It must not be carried
unchanged to a four-dimensional bulk identity or a mixed subsystem
target. This explicitly implements the dimension correction called
for in the supplied En02-C and Oai290-A notes
\cite{CheungEn02C,CheungOai290A}.

\subsection{Simultaneous decisions}

\begin{definition}[Specified-decoder decision]
For a threshold $\varepsilon_j$:
\begin{itemize}
 \item \emph{certified}: the access and validation contracts are
 supported and $U_j\leq\varepsilon_j$;
 \item \emph{excluded for this decoder}: the contracts are supported
 and $L_j>\varepsilon_j$;
 \item \emph{inconclusive}: otherwise.
\end{itemize}
An unsupported access contract is never certified.
\end{definition}

\begin{theorem}[Simultaneous coverage and acceptance]
\label{thm:simultaneous}
Consider finitely many frozen tasks. For every validation setting
allocate a failure probability, with total at most
$\alpha_{\mathrm s}$. Suppose all required calibration and transfer
statements hold jointly except with probability $\beta$.
Then all intervals from Theorem~\ref{thm:tomography} or
Corollary~\ref{cor:bell} cover their respective errors simultaneously
except with probability at most $\alpha_{\mathrm s}+\beta$.
In particular,
\[
 \Pr\!\left\{
 \exists j:\operatorname{Accept}(j),\
 \dd(\Lambda_{\star,j},\T_j)>\varepsilon_j
 \right\}
 \leq\alpha_{\mathrm s}+\beta.
\]
The same event controls false specified-decoder exclusions.
\end{theorem}

\begin{proof}
Condition on the frozen information.
Each setting's concentration bound remains valid by
Contract~\ref{con:validation}. Union over every setting in every
task and then over the calibration/transfer failure event.
On the complementary event every true error lies in its interval.
The decision implications follow immediately.
No independence between different tasks is required.
\end{proof}

The distinction between complete validation and selected records,
and between specified-decoder and optimal-decoder decisions, follows
the roles reported in
\cite{CheungOai265B,CheungOai290A}; the coverage theorem is proved
locally here.

\begin{proposition}[Uniform decoder-class obstruction]
\label{prop:optimal}
Let $\mathfrak D_A$ be a declared decoder class for the actual
accessible channel, and define
\[
 e_A^{\mathrm{opt}}
 =\inf_{D\in\mathfrak D_A}\dd(D\N_A,\T_A).
\]
If a separately proved bound is uniform over the class,
$e_A^{\mathrm{opt}}\geq g_A$, then $g_A>\varepsilon_A$ excludes
every allowed decoder. A certified candidate $D\in\mathfrak D_A$
with upper bound $U_D$ gives
\[
 g_A\leq e_A^{\mathrm{opt}}\leq U_D
\]
on the coverage event.
A lower bound for one tested decoder does not provide a lower bound
for $e_A^{\mathrm{opt}}$.
\end{proposition}

\begin{proof}
The first statement is the definition of a uniform lower bound.
The second follows by evaluating the infimum at the candidate.
\end{proof}

An ideal privacy obstruction cannot silently be transferred to an
arbitrary noisy accessible channel: a global boundary operation may
move previously omitted information into the accessible region.
Uniform bounds must concern the actual channel or a justified model
relation preserving the obstruction.

\section{Approximate-recovery examples on the declared models}
\label{sec:noise}

The approximate-recovery literature supplies results in worst-case
entanglement fidelity \cite{BenyOreshkov}. We do not identify that
metric with half-diamond distance or import a ``twice optimal''
constant into a different metric. Instead, the following examples
have locally computed half-diamond errors.

\subsection{Logical Pauli and coherent errors}

Insert a logical error before the ideal encoder, either $V$ or $W$,
and use its printed ideal decoder.

\begin{proposition}[Logical Pauli noise]
\label{prop:pauli}
For
\[
 \Gamma(\rho)=p_I\rho+p_XX\rho X+p_YY\rho Y+p_ZZ\rho Z,
 \qquad \sum_Pp_P=1,
\]
\[
 \dd(\Gamma,\id_2)=1-p_I.
\]
For spectator-blind insertion before $W$, the left subsystem
decoder has the same error.
\end{proposition}

\begin{proof}
The triangle inequality gives the upper bound $1-p_I$.
The Choi state is a Bell-diagonal mixture with Bell overlap $p_I$,
so the Bell-projector measurement gives the matching lower bound.
The subsystem statement is Proposition~\ref{prop:spectatorblind}.
\end{proof}

\begin{proposition}[A coherent logical rotation]
For $|\theta|\leq\pi$ and
$U_\theta=\exp(-i\theta Z/2)$,
\[
 \dd(\operatorname{Ad}_{U_\theta},\id_2)
 =|\sin(\theta/2)|.
\]
This is the error of the specified uncorrected ideal decoder, not
an optimal-decoder claim when $\theta$ is known.
\end{proposition}

\begin{proof}
For a pure input with any reference, the overlap with its rotated
version is $\Tr(\rho_LU_\theta)$.
The numerical range of $U_\theta$ is the line segment joining its
two eigenvalues, whose minimum modulus is $\cos(\theta/2)$.
The pure-state trace-distance formula gives the upper bound.
The input $\ket{+}$ attains it. Convexity handles mixed inputs.
\end{proof}

A known inverse rotation can remove this logical error. Reporting the
uncorrected decoder's error as an information-theoretic obstruction
would therefore be incorrect.

\subsection{An exactly optimal flagged-loss recovery}

On a recoverable triple define the accessible erasure channel
\begin{equation}
 \N_p(\rho)
 =
 (1-p)U_B(\rho\otimes I_4/4)U_B^\dagger
 \ \oplus\ p\Tr(\rho)\proj{\mathrm{er}},
 \qquad 0\leq p\leq1.
 \label{eq:erasure}
\end{equation}
The erasure flag is an orthogonal classical sector. Decode the
non-erased sector by $D_B$ and return $I_2/2$ in the erasure sector.

\begin{theorem}[Optimal flagged-loss candidate]
\label{thm:erasure}
For the channel \eqref{eq:erasure}, the printed complete decoder has
error $3p/4$ and is optimal among all CPTP decoders.
\end{theorem}

\begin{proof}
Its returned channel is
$(1-p)\id_2+p\operatorname{Dep}_2$, with error $3p/4$.
For any decoder, on a Bell input the non-erased contribution has
Bell overlap at most one, while the erasure contribution has
overlap exactly $1/4$ after any replacement output.
The total overlap is at most $1-3p/4$.
The Bell-projector measurement therefore gives error at least
$3p/4$.
\end{proof}

Thus the comparison includes an independently specified approximate
candidate with a proved optimality statement, rather than an
unverified numerical ``near-optimal'' label.

\subsection{Spectator-dependent error}

\begin{proposition}[Fixed-spectator trap in the connected model]
\label{prop:spectatortrap}
Let
\[
 C_Z
 =
 I_L\otimes\proj{0}_S+Z_L\otimes\proj{1}_S
\]
act before $W$. The printed left subsystem decoder then implements
\[
 \Lambda(\rho)=\Tr_S(C_Z\rho C_Z^\dagger).
\]
It is exact for every logical state with spectator $\proj{0}$, but
\[
 \dd(\Lambda,\Tr_S)=1.
\]
\end{proposition}

\begin{proof}
The channel identity follows from Theorem~\ref{thm:patch}.
The $s=0$ statement is immediate.
For input $\proj{+}_L\otimes\proj{1}_S$, the actual and target
outputs are $\proj{-}$ and $\proj{+}$, which are orthogonal.
The channel distance is therefore at least one, hence equals one.
\end{proof}

This counterexample uses the same connected encoder and decoder
as the positive subsystem claim. It cannot be dismissed by fixing
the spectator during validation.

\subsection{Approximation comparison ledger}

\begin{center}
\small
\begin{tabular}{p{0.30\linewidth}p{0.24\linewidth}p{0.34\linewidth}}
\toprule
Declared channel/model & Specified error & Status\\
\midrule
Ideal five-qubit triple & $0$ &
Unique complete decoder; resource restrictions stated separately\\
Logical Pauli insertion & $1-p_I$ &
Exact error for the printed decoder\\
Logical coherent rotation & $|\sin(\theta/2)|$ &
Specified decoder only; known inverse can improve it\\
Flagged triple erasure & $3p/4$ &
Optimal over all CPTP decoders\\
Controlled spectator phase before $W$ & $1$ &
Fixed spectator $0$ would conceal the failure\\
Successful branch with replacement failure & $3(1-\eta)/4$ &
Complete returned channel, with flag discarded\\
\bottomrule
\end{tabular}
\end{center}

\section{Feasibility and certificate-specific shot limitations}
\label{sec:feasibility}

The calculations in this section are prospective design calculations.
They are not experimental data.

\subsection{Why forty shots cannot pass this Hoeffding certificate}

\begin{proposition}[A forty-shot limitation]
\label{prop:forty}
Use Corollary~\ref{cor:bell} with no calibration or transfer allowance.
If each of the three settings has at most forty shots and each
two-sided allocation satisfies $0<\delta_i\leq1$, then no data set
can certify a threshold $\varepsilon=0.1$.
The statement also covers forty shots in total.
\end{proposition}

\begin{proof}
Each radius satisfies
\[
 t_i\geq\sqrt{2\log2/40}.
\]
Since the measured correlations lie in $[-1,1]$,
$\widehat f\leq1$ and
\[
 1-f_L\geq
 \min\left\{1,\frac34\sqrt{2\log2/40}\right\}.
\]
Therefore the best possible upper certificate is at least
\[
 \min\left\{
 1,\,
 2\sqrt{\frac34\sqrt{2\log2/40}}
 \right\}>0.74.
\]
It cannot be at most $0.1$.
\end{proof}

This is a limitation of a specified sufficient procedure, not a
universal lower bound on all recovery experiments or all confidence
methods. It gives a local proof of the limitation reported for
Oai280-A/B \cite{CheungOai280AB}.

For one task with equal shot counts $n$ and allocations
$\delta_i=\alpha_{\mathrm s}/3$, the best possible correlations give
\[
 U_{\mathrm{best}}
 =
 \min\left\{
 1,\,
 \sqrt{3\sqrt{\frac2n\log\frac6{\alpha_{\mathrm s}}}}
 \right\}.
\]
Thus passing even in that ideal-data case requires
\begin{equation}
 n\geq
 \frac{18}{\varepsilon^4}\log\frac6{\alpha_{\mathrm s}}.
 \label{eq:hoeffding-shots}
\end{equation}

\subsection{Exact binomial alternatives}

Exact binomial confidence inversion is a different valid procedure
\cite{ClopperPearson}. For a Bernoulli error probability $q$, with
$x$ errors in $n$ trials, define its one-sided upper endpoint $q_U$
by
\[
 \sum_{r=0}^{x}\binom nr q_U^r(1-q_U)^{n-r}=\delta
\]
when $x<n$, and set $q_U=1$ when $x=n$.

\begin{lemma}[Coverage of the one-sided binomial endpoint]
The endpoint above satisfies
$\Pr_q\{q>q_U(X)\}\leq\delta$.
For zero observed errors,
\[
 q_U=1-\delta^{1/n}.
\]
\end{lemma}

\begin{proof}
For fixed $q$, the endpoint is monotone in $x$.
The event $q>q_U(X)$ is a lower-tail event whose probability is at
most $\delta$ by the defining tail equation and discreteness.
At $x=0$, the equation is $(1-q_U)^n=\delta$.
\end{proof}

For the local correlation measurements, orient their outcomes as
$X\otimes X$, $-Y\otimes Y$, and $Z\otimes Z$, and let $q_i$
be the respective wrong-outcome probabilities. Then
\[
 f=1-\frac12(q_x+q_y+q_z).
\]
Allocating $\delta_i=\alpha_{\mathrm s}/3$ and using the three
one-sided endpoints gives
\[
 U_{\mathrm{bin}}
 =
 \min\left\{1,\,
 2\sqrt{\frac12\sum_iq_{U,i}}
 \right\}.
\]
When no wrong outcome is seen and all settings have $n$ shots,
passing threshold $\varepsilon$ requires
\begin{equation}
 n\geq
 \frac{\log(\alpha_{\mathrm s}/3)}
      {\log(1-\varepsilon^2/6)}.
 \label{eq:local-binomial}
\end{equation}

If a joint Bell-projector measurement is independently available
and calibrated, it directly measures $f$.
With no failures in $n$ shots, its one-sided lower endpoint is
$f_L=\alpha_{\mathrm s}^{1/n}$.
The corresponding requirement is
\begin{equation}
 n\geq
 \frac{\log\alpha_{\mathrm s}}
      {\log(1-\varepsilon^2/4)}.
 \label{eq:bell-binomial}
\end{equation}
This uses a different measurement architecture, which must be
listed in the validation contract.

For $\varepsilon=0.1$, $\alpha_{\mathrm s}=0.01$, and zero calibration
and transfer allowance:
\[
\begin{array}{l|r|l}
\text{Procedure}&\text{Required shots}&\text{Ideal-data condition}\\ \hline
\text{Three local settings, Hoeffding}
 &\text{about }1.15\times10^6\text{ per setting}
 &\text{all favorable outcomes}\\
\text{Three local settings, exact binomial}
 &3420\text{ per setting}
 &\text{no wrong outcomes}\\
\text{Joint Bell projector, exact binomial}
 &1840\text{ total}
 &\text{no Bell failures}.
\end{array}
\]
These counts illustrate the procedure dependence of the forty-shot
result. Nonzero preparation, measurement, transfer, or physical
error changes the required counts.

\subsection{Power under a declared noise model}

For three independent binomial settings with true error probabilities
$q_i$, fixed $n_i$, and a predeclared acceptance rule, its acceptance
probability is exactly
\[
 \sum_{x_x=0}^{n_x}\sum_{x_y=0}^{n_y}\sum_{x_z=0}^{n_z}
 \mathbf 1\{U(x_x,x_y,x_z)\leq\varepsilon\}
 \prod_i
 \binom{n_i}{x_i}q_i^{x_i}(1-q_i)^{n_i-x_i}.
\]
This expression is a reproducible prospective power calculation.
A go/no-go design may require this probability to exceed a stated
value, for example $0.9$, under a stated design channel.
It does not prove that the apparatus has that channel.

Under an independently supported Pauli-channel hypothesis,
Proposition~\ref{prop:pauli} gives the stronger conversion
$\dd=1-f$. That may greatly improve shot requirements.
The hypothesis cannot be manufactured from a favorable identity
overlap alone.

\subsection{What randomized benchmarking does and does not supply}

Randomized benchmarking estimates partial gate-noise characteristics
under its printed assumptions. Wallman and Flammia analyze the
variance due to sampling random sequences and explicitly separate
that variance from finite repetitions of each sequence
\cite{WallmanFlammia}. Their asymptotic variance formulas contain
remainder terms; dropping such terms does not create an exact
finite-sample theorem for this manuscript.

Our certificates sample complete decoder outputs directly. We do
not import randomized-benchmarking sequence counts as decoder
validation counts, do not infer the access audit from benchmarking,
and do not replace mixed-target Choi testing with an average gate
infidelity. Benchmarking can support a separate engineering ledger
only when the assumptions and metric conversion are justified.

\section{Operational maps and interpretation}
\label{sec:interpretation}

A reported map should contain, for each tested task:
\begin{center}
\small
\begin{tabular}{p{0.12\linewidth}p{0.15\linewidth}
p{0.14\linewidth}p{0.14\linewidth}p{0.13\linewidth}p{0.16\linewidth}}
\toprule
Access & Target & Ideal benchmark & Audit/resources &
Interval & Decision\\
\midrule
Declared registers &
Effect, code, subsystem, or algebra &
Theorem and model &
Supported contract and scoped budgets &
$[L,U]$ &
Certified, specified-decoder excluded, or inconclusive\\
\bottomrule
\end{tabular}
\end{center}

An all-decoder exclusion is a separate annotation supported by
Proposition~\ref{prop:optimal}, not by failure of a sufficient
certificate. With unsupported transfer or calibration assumptions,
the result is inconclusive rather than certified.

\paragraph{Geometry-dependent access.}
The connected model in Section~\ref{sec:patch} is a finite two-cell
perfect-tensor code. Its graph specifies contractions and accessible
legs. We do not identify its regions with continuum entanglement
wedges. A comparison is called geometry-dependent only when changing
the graph or contraction pattern is shown to change the channel,
the attainable recovery, or a resource-constrained recovery class.

\paragraph{Unconstructed gravitational obligations.}
This paper does not construct a gravitational dictionary, establish
a semiclassical regime, identify a continuum boundary algebra, or
derive a metric from its recovery map. The source notes report
additional same-model endpoint obligations in En07-B but do not
supply their full statements \cite{CheungEn07B}. No such obligation
is treated as proved or as a premise here.

\paragraph{Other recovery problems.}
The internal identifiers OpenAI~280, 283, 290, and 365 are described
in the supplied notes as involving, respectively, conformal-net
extensions, unitary synthesis, bicentralizer questions, and
geometric inverse recovery. None is used to infer a decoder,
an implementation certificate, a radiation history, or a
gravitational metric. Coincidence of the word ``recovery'' is not
an interface theorem.

\section{Conclusion}

A recovery claim is operational only after its information target,
accessible interface, complete decoder, reference convention, and
validation assumptions have been fixed. We supplied those interfaces
and proved them locally on a connected finite encoding.

The resulting statements are stronger than exact named-observable
readout and narrower than unrestricted gravitational reconstruction.
They certify a specified implemented channel, distinguish failure
of a certificate from a genuine obstruction, and permit separately
proved resource and all-decoder bounds. The subsystem and algebra
targets remain valid on correlated inputs. The confidence bounds
retain the input-dimension factor, include calibration explicitly,
and never silently discard unsuccessful branches.

The minimum outcome is therefore achieved: a finite logical
subsystem and hybrid algebra, constructive access-restricted
programmes, and simultaneous reference-preserving certificates
for their complete channels. Larger networks, tighter mixed-target
estimators, and apparatus-specific audits may be added without
changing the logical separation between code theory, implementation,
certification, and gravitational interpretation.

\appendix

\section{Exact specification and reproduction checklist}
\label{app:reproduce}

The following finite procedure reproduces the ideal model without
external code data.

\begin{enumerate}
 \item Form the four $32\times32$ Pauli matrices $g_i$.
 \item Compute
 \[
   P=\prod_{i=1}^4(I+g_i)/2.
 \]
 \item Set the two columns of $V$ by \eqref{eq:encoder}.
 \item For each triple $B$, assemble $U_B$ using \eqref{eq:UB}.
 Check $U_B^\dagger U_B=I_8$.
 \item Assemble $T=V/\sqrt2$ and $F=\sqrt2\,V$ with their printed
 index orientations.
 \item Assemble $W$ using \eqref{eq:W-components}.
 Check $W^\dagger W=I_4$.
 \item For each exterior triple $K$, assemble $U_K$ using
 \eqref{eq:UK}.
 \item Verify channel identities on every input matrix unit:
 four units for a qubit task and sixteen for the two-qubit bulk.
 \item Build a decoder programme with all registers, arrivals,
 discards, instruments, and terminal replacements listed.
 \item Freeze validation settings and failure allocations before
 collecting held-out shots.
 \item Retain every trial record, including failures.
 \item Compute the appropriate interval and apply the three-way
 decision rule.
\end{enumerate}

Because $V$ has real entries fixed by a finite Pauli projector, all
ideal identities above admit exact algebraic checking. Numerical
checks are useful regression tests, but the proofs in the main text,
not floating-point agreement, establish the identities.

\section{Debugging summary}
\label{app:debug}

The completed framework includes the following corrections to
potentially stronger but unjustified claims.

\begin{enumerate}
 \item Reference preservation is built into the error metric, rather
 than inferred from unentangled test states.
 \item The constant-complement criterion is restricted to full-code
 recovery.
 \item Snapshot determination and adjoint containment imply linear
 factorization, not a CPTP inverse.
 \item The joined normalized tensors require the explicit factor
 $2\sqrt2$ in \eqref{eq:W-components}.
 \item The connected encoder is implemented deterministically through
 \eqref{eq:W}; Bell postselection is not silently normalized away.
 \item A coherent environment lower bound is not a universal live-memory
 lower bound.
 \item Streaming and communication lower bounds are scoped to their
 stated input access and resource architectures.
 \item Decoder workspace and source storage are accounted for separately.
 \item Failure branches are included in the tested channel.
 \item The identity Choi-overlap conversion has factor $d$.
 Mixed algebra and subsystem targets use a separate trace-norm
 certificate.
 \item Calibration allowances and tested-to-claimed channel transfer
 allowances have different meanings.
 \item The forty-shot limitation is procedure-specific.
 \item A specified decoder's lower bound does not exclude every decoder.
 \item Ideal privacy obstructions are not automatically valid after
 arbitrary global boundary noise.
 \item No finite recovery map is silently identified with an
 entanglement wedge or a metric.
\end{enumerate}

\section{Source provenance and manuscript identifiers}
\label{app:provenance}

The bibliography separates identified published articles from internal
Cheung manuscript identifiers. For the latter, the supplied document
\emph{Oai280-C ref.txt} reports thematic roles and theorem labels.
It does not supply the full manuscripts, exact titles, dates, venues,
or persistent identifiers. The entries below therefore do not invent
those details.

\begin{center}
\small
\begin{tabular}{p{0.24\linewidth}p{0.39\linewidth}p{0.25\linewidth}}
\toprule
Supplied identifier & Reported role & Local replacement\\
\midrule
En02-B/C &
Task split, ideal access, legal programmes, resource and
approximation ledgers &
Sections~\ref{sec:tasks}, \ref{sec:block}, \ref{sec:programmes},
\ref{sec:approx}\\
En05-C &
Snapshot determination and adjoint containment &
Theorem~\ref{thm:snapshot}\\
I / En06-A &
Classical-record entanglement-breaking gate &
Proposition~\ref{prop:EB}\\
VII-G / Em05-B &
Full-code complement and complete instruments &
Theorem~\ref{thm:complement};
Theorem~\ref{thm:programme}\\
Oai265-B &
Complete validation and finite-confidence accounting &
Contracts~\ref{con:main} and \ref{con:validation};
Theorem~\ref{thm:simultaneous}\\
Oai290-A &
Specified versus optimal decoder; three-way decision &
Proposition~\ref{prop:effect};
Section~\ref{sec:statistics}\\
XVII-A &
Typed operator/channel target and no-wedge warning &
Sections~\ref{sec:tasks}, \ref{sec:interpretation}\\
Oai280-A/B &
Effect, spectator, and small-shot controls; patch benchmarks &
Sections~\ref{sec:block}, \ref{sec:patch},
\ref{sec:noise}, \ref{sec:feasibility}\\
En07-B &
Additional same-model endpoint obligations &
Not invoked or discharged\\
\bottomrule
\end{tabular}
\end{center}

The local results need not coincide with every stronger statement
reported in the notes, because different resource conventions can
change a theorem. In particular, the streaming lower bound in this
paper is explicitly the three-share model of
Theorem~\ref{thm:stream}. Verification of any different manuscript
claim requires its full definitions.

\begin{thebibliography}{99}

\bibitem{BenyKempfKribs}
C.~B\'eny, A.~Kempf, and D.~W.~Kribs,
``Generalization of quantum error correction via the Heisenberg
picture,''
\emph{Physical Review Letters} \textbf{98}, 100502 (2007).
\href{https://doi.org/10.1103/PhysRevLett.98.100502}
{doi:10.1103/PhysRevLett.98.100502}.
arXiv:quant-ph/0608071.

\bibitem{BenyKempfKribsPRA}
C.~B\'eny, A.~Kempf, and D.~W.~Kribs,
``Quantum error correction of observables,''
\emph{Physical Review A} \textbf{76}, 042303 (2007).
\href{https://doi.org/10.1103/PhysRevA.76.042303}
{doi:10.1103/PhysRevA.76.042303}.

\bibitem{BenyOreshkov}
C.~B\'eny and O.~Oreshkov,
``General conditions for approximate quantum error correction
and near-optimal recovery channels,''
\emph{Physical Review Letters} \textbf{104}, 120501 (2010).
\href{https://doi.org/10.1103/PhysRevLett.104.120501}
{doi:10.1103/PhysRevLett.104.120501}.
arXiv:0907.5391.

\bibitem{PastawskiEtAl}
F.~Pastawski, B.~Yoshida, D.~Harlow, and J.~Preskill,
``Holographic quantum error-correcting codes:
Toy models for the bulk/boundary correspondence,''
\emph{Journal of High Energy Physics} \textbf{2015}(06), 149 (2015).
\href{https://doi.org/10.1007/JHEP06(2015)149}
{doi:10.1007/JHEP06(2015)149}.
arXiv:1503.06237.

\bibitem{LaflammeEtAl}
R.~Laflamme, C.~Miquel, J.~P.~Paz, and W.~H.~Zurek,
``Perfect quantum error correction code,''
\emph{Physical Review Letters} \textbf{77}, 198--201 (1996).
\href{https://doi.org/10.1103/PhysRevLett.77.198}
{doi:10.1103/PhysRevLett.77.198}.
arXiv:quant-ph/9602019.

\bibitem{WallmanFlammia}
J.~J.~Wallman and S.~T.~Flammia,
``Randomized benchmarking with confidence,''
arXiv:1404.6025v4 (2015).
The supplied version is used for its normalized Choi convention,
diamond-distance bounds, and finite-sampling qualifications.
\href{https://arxiv.org/abs/1404.6025}
{arXiv:1404.6025}.

\bibitem{Watrous}
J.~Watrous,
``Simpler semidefinite programs for completely bounded norms,''
arXiv:1207.5726.
\href{https://arxiv.org/abs/1207.5726}
{arXiv:1207.5726}.

\bibitem{Hoeffding}
W.~Hoeffding,
``Probability inequalities for sums of bounded random variables,''
\emph{Journal of the American Statistical Association}
\textbf{58}(301), 13--30 (1963).
\href{https://doi.org/10.1080/01621459.1963.10500830}
{doi:10.1080/01621459.1963.10500830}.

\bibitem{ClopperPearson}
C.~J.~Clopper and E.~S.~Pearson,
``The use of confidence or fiducial limits illustrated in the
case of the binomial,''
\emph{Biometrika} \textbf{26}(4), 404--413 (1934).
\href{https://doi.org/10.1093/biomet/26.4.404}
{doi:10.1093/biomet/26.4.404}.

\bibitem{CheungEn02B}
N.~Cheung, internal manuscript identifier \emph{En02-B}.
Attribution and theorem-role descriptions supplied in
\emph{Oai280-C ref.txt}; full text and publication metadata
not supplied. Cited for provenance only.

\bibitem{CheungEn02C}
N.~Cheung, internal manuscript identifier \emph{En02-C}.
Attribution and theorem-role descriptions supplied in
\emph{Oai280-C ref.txt}; full text and publication metadata
not supplied. Cited for provenance only.

\bibitem{CheungEn05C}
N.~Cheung, internal manuscript identifier \emph{En05-C}.
The supplied notes associate this identifier with snapshot
determination and adjoint containment. Full text and publication
metadata not supplied.

\bibitem{CheungIEn06A}
N.~Cheung, internal manuscript identifiers \emph{I} and
\emph{En06-A}. The supplied notes associate them with
classical-record and entanglement-breaking obstructions.
Full texts and publication metadata not supplied.

\bibitem{CheungVIIG}
N.~Cheung, internal manuscript identifier \emph{VII-G}.
The supplied notes associate it with the full-code
constant-complement criterion and spectator conventions.
Full text and publication metadata not supplied.

\bibitem{CheungOai265B}
N.~Cheung, internal manuscript identifier \emph{Oai265-B}.
The supplied notes associate it with complete validation contracts,
branch accounting, and finite-confidence certification.
Full text and publication metadata not supplied.

\bibitem{CheungOai290A}
N.~Cheung, internal manuscript identifier \emph{Oai290-A}.
The supplied notes associate it with effect/channel separation,
specified-decoder certification, and three-way decisions.
Full text and publication metadata not supplied.

\bibitem{CheungEm05B}
N.~Cheung, internal manuscript identifier \emph{Em05-B}.
The supplied notes associate it with complete instruments,
failure branches, complementary leakage, and full-code recovery.
Full text and publication metadata not supplied.

\bibitem{CheungXVIIA}
N.~Cheung, internal manuscript identifier \emph{XVII-A}.
The supplied notes associate it with typed operator and channel
targets and the separation from entanglement-wedge claims.
Full text and publication metadata not supplied.

\bibitem{CheungOai280AB}
N.~Cheung, internal manuscript identifiers \emph{Oai280-A}
and \emph{Oai280-B}. The supplied notes associate them with
finite access, patch recovery, task counterexamples, and
certificate-specific shot limitations.
Full texts and publication metadata not supplied.

\bibitem{CheungEn07B}
N.~Cheung, internal manuscript identifier \emph{En07-B}.
The supplied notes report additional same-model endpoint
obligations. Their full statements, full text, and publication
metadata were not supplied; they are not premises of this paper.

\end{thebibliography}

\end{document}