Theorem: Exact optimal recovery

Over all deterministic CPTP decoders with access to both full cells,

The explicit decoder $\mathcal{D}$ attains both values.

At prefixes zero and one, the corresponding optimal recovery error is $3/4$, and the maximal Bell-test fidelity is $1/4$.

Proof. The decoded channel (eq:decoded) has Pauli probabilities

Lemma lem:Pauli gives error $1-{\lambda }_I$; its Bell-test fidelity is ${\lambda }_I$.

For optimality, the orthogonal successful and failed ciphertext sectors have probabilities $p$ and $1-p$, independent of the message. The key and count labels give independent classical conditioning, not an additional message channel.

On a successful sector, undoing the known Pauli leaves

For any subsequent decoder, Bell overlap from the identity term is at most one. The dephased Bell state is separable across reference and output; local decoding preserves separability. A separable two-qubit state has Bell overlap at most $1/2$. Therefore every successful-sector decoder has overlap at most $(1+\eta )/2$.

A failed sector is input-independent. Every decoded constant qubit channel has Bell overlap $1/4$. Consequently every decoder has

Testing the Bell projector gives worst-case recovery error at least $1-F_e\ge 1-{\lambda }_I$, proving optimality.

At the earlier prefixes, (eq:N1) and the empty output are replacement channels. Every decoder again has Bell overlap $1/4$, giving error at least $3/4$. Preparing $I_2/2$ attains $3/4$ by Lemma lem:Pauli.