[{"data":1,"prerenderedAt":4},["ShallowReactive",2],{"JMzLXm7aqN":3},"# ProofNet-IR\n\nProofNet-IR is an experimental, verified proof-geometry intermediate\nrepresentation for AI-guided theorem proving in Lean 4.\n\nCurrent release: `v0.9.0` (exact occurrence-aware graph semantics,\nchecker-free reconstruction proved complete for every accepted certificate,\nand a sound worklist-first unification tier whose exact wrapper is proved\nequal to the reference checker). Pure-worklist completeness and a\nwhole-program linear bound are not claimed. See [CHANGELOG.md](CHANGELOG.md)\nand [the release audit](docs/v0.9-release-audit.md) for the precise guarantees\nand non-goals.\n\nDevelopment on `main` now continues as `v0.10.0-dev`. Lean now constructs one\nunified exact closing package with common terminal-base, complement-base,\ncomplement, and normalized-core indices, then enriches its proof-relevant seam\nreplay with an occurrence-position endpoint zipper. Unlike the older\n`CyclicSeamCursor.gap`, the zipper gap is definitionally the complete\ncomplementary arc between the fixed first and last tagged endpoint occurrences.\nEvery indexed flipped scheduler segment is proved nonempty. Consequently, an\nempty zipper gap in the initial tagged scheduler family would force exactly the\nscheduler-coordinate adjacency already excluded by the closing endpoint\nwitness, so that complete complementary arc is nonempty.\n\nStarting from the normalized closing core's empty exact gap, Lean now builds a\ncanonical endpoint replay of the fixed terminal-complement step. It always\nfirst-opens in that terminal replay by an internal case split: if the exact\nreverse-shell context is nonempty, the reverse-shell frame opens the gap first;\notherwise the generator's nonempty omitted arc opens it in the second frame.\nThe returned first-opening proposition does not itself expose a separately\nconsumable branch/origin sum or identify the anchor as the opening frame.\nAlongside that proposition, the construction separately retains\n`closing.map erase = reverseTraversal (opening.map erase)`, the omitted-right\nzero-offset backward anchor at the arc head, the forward retained-left last\noccurrence of that outer arc, and the exact base-gap equation\n`closing ++ taggedArc ++ opening`. Erasing the nonempty outer `taggedArc`\ngives a closed `EdgeWalk` at the complement base and a\n`CuspFreeTraversal`; its exact cyclic closing pair is nevertheless\n`Cusp outerLast.value anchor.value`, with\n`outerLast.value ≠ anchor.value.reverse`. The cusp is at the wraparound pair,\nnot an internal adjacency forbidden by the linear cusp-free predicate. The\nbase gap is nonempty. Endpoint replay preserves the complete old gap as a\nsublist, so the whole `taggedArc` remains an ordered sublist of the exact gap\nafter the ancestry replay reaches the initial scheduler family; in particular,\nits omitted-right head and retained-left last occurrence remain members there.\nFrom a retained sublist's exact `head?` and `getLast?`, a generic list lemma now\nextracts an ordered decomposition of the containing list. Applied here, the\ninitial exact gap has the form\n`g0 ++ anchor :: g1 ++ outerLast :: g2`, and the enclosing scheduler family\nhas a `CyclicFourPointDisplayAt firstTag lastTag anchor outerLast`. The generic\nfour-point relation permits empty intervening lists and repeated values; it is\nnot a strict scheduler-rank theorem. This generic result is linear\nordered-sublist transport, not contiguity, a fixed linear rank, crossing,\ncyclic betweenness, or a model-specific scheduler-order/proper-nesting theorem.\nFor the actual complete initial `tagSchedulerFamily`, the ambient scheduler\ncoordinates are `Nodup`, even when erased directed-edge values repeat. Lean now\nuses that fact to prove\n`[firstTag, lastTag, anchor, outerLast].Nodup`; this distinguishes the four\nexact `SchedulerOccurrence` tags, not their erased edges, edge endpoints, or\nvertices. The endpoint replay retains the same outer positioned par choice\nwhich names `anchor` and `outerLast`. Exact membership transport then lifts\nboth that outer witness and the normalized inner closing witness through\nancestry to the complete initial family. One specialized theorem returns both\npositioned witnesses, the four-point display, and the four-tag `Nodup` fact\ntogether. Its cyclic point order is\n`firstTag → lastTag → anchor → outerLast`: the inner and outer endpoint pairs\nare separated, not alternating, so this is not a crossing witness. No\nintervening interval is proved nonempty, and contiguity, fixed or modular rank,\na model-specific scheduler-order/proper-nesting contradiction, closing-par\nexclusion, progress, and pure-worklist completeness remain unproved. No\nplanarity principle is assumed for commutative MLL.\n\nA stable three-axiom/two-tensor regression now rules out one proposed way of\nclosing that gap. The current eager initializer assigns token ages in submitted\naxiom-link order, while the flat worklist reverses submitted connective order;\nthe accepted regression therefore fires a tensor joining ages 0 and 2 before\nthe intervening age-1 component. It succeeds in exactly two attempts, with no\nwaiting requeue and two successful firings. These public counters are the\nregression receipt, not a direct observation of token-class membership; the\nnoncontiguous merge follows from the fixed links and the eager-start and\nreverse-queue definitions. Thus the current flat scheduler does not preserve\ncontiguous token-age intervals or a Figure-7 top-of-stack union discipline.\n`tagSchedulerFamily.step` is the index of a selected dependency-cycle segment,\nnot a firing time or token age. Moreover, the displayed\n`firstTag → lastTag → anchor → outerLast` order consists of two separated\nendpoint pairs, which ordinary laminarity permits as siblings. Flat-worklist\ncompleteness may instead be pursued through preservation of a residual parsing\nwitness or a suitable theorem modulo an explicitly justified observation.\nGuerrini-style whole-program linearity remains a separate goal and requires a\nfaithful full `NEXTAXIOM`/token-age scheduler. General checker-accepted\nsequentialization is already complete through recursive reconstruction;\nclosing-par exclusion, correct-state progress, pure-worklist completeness,\nfallback removal, and linearity remain open.\n\nThe separate delayed-scheduler track now implements the project's operational\nlocal Figure-7 `new` pipeline over the currently proved\n`ReservationInvariant`. It pops the\ndeterministic head of the last ready bucket without discarding an exhausted\nbucket, raw-marks that occurrence at the old last `σ` boundary in both state\nviews, resolves the unique orientation-aware tensor consumer through the\ncertificate's fixed sound-and-complete `ConsumerIndex`, runs `NEXTAXIOM` from\nthe opposite tensor premise in the post-mark production state, and appends and\nreserves the returned axiom with fully threaded tags. That reservation uses\n`operationalNewEnqueue?`: the old active `σ` boundary becomes an initialized\nempty waiting cell, while the newly pushed active top remains undefined. Lean\nproves preservation of `OperationalWaitingDomain`, which says exactly that\nallocated initialized waiting cells are the inactive boundaries\n`sigma.dropLast`. The printed Figure-7 update that writes the fresh cell is\nretained separately as the display-only `newEnqueue?`; production code does\nnot call it. Choosing the old-boundary update is this project's interpretation\nof the paper's surrounding prose and its `wait`/`unify` behavior, not an\nauthor-confirmed erratum or a uniqueness result. The proof argument rules out\nindependently forged stack horizons, raw ages, and production carriers, and\ncallers cannot substitute a partial consumer table. This remains a local rule,\nnot a full scheduler theorem: `ReservationInvariant` alone records only\ntag-array size rather than tag provenance/monotonicity, and it does not\nestablish waiting-payload ownership, global queue ownership, or the\n`forward`/`unify` transfer rules. The local `wait` rule described below\nchanges one already initialized waiting payload without claiming ownership.\n`SequentialFigure7History.lean` now separately\ndefines proof-relevant reachability for exactly the empty/init/operational-new\nfragment. For every such execution, Lean proves current tags are true exactly\nat vertices touched by a recorded search, submitted axiom-link slots never\nrepeat across the whole history, and the reservation-event count equals both\n`nextAge` and `startedAxioms`. This dedicated `InitNewHistory` is intentionally\nnot a generic Figure-7 history: the now-executable non-reserving `concl` and\n`nop` rules need rule-step accounting distinct from reservation-event\ncounting, while the local `wait` transition is not yet integrated and\n`forward` and `unify` still need exact transitions. Full queue ownership,\nintegration of all rules into one reachable\nhistory, correct-state progress, pure-worklist completeness, fallback removal,\nand linearity remain open.\n\n`SequentialFigure7Rules.lean` now makes the common non-`init` prefix and the\nfirst three local rules exact. A proof-carrying generic\n`ConnectiveBelow` query fixes lookup to the certificate's canonical consumer\nindex and retains the submitted par/tensor slot, stored premise orientation,\nopposite premise, conclusion, and local link well-formedness. A separate\n`ConclusionBelow` query requires explicit conclusion membership, local\n`NodeWellFormed` ownership, and an exactly empty consumer bucket; it\ndeliberately does not identify\n`uniqueConsumer? = none` with a conclusion, because a malformed bucket with\ndistinct consumers also returns `none`. `prepare?` synchronizes\npop-before-mark with the production raw mark. `concl?` accepts only the exact\nconclusion view; `nop?` accepts only an exact par view whose mate remains raw\nunmarked after the prefix. `wait?` accepts only an exact par view whose mate\nhas raw mark `mateRawAge \u003C selectedRawAge`; it computes\n`sigmaBoundary? stack.sigma mateRawAge` and prepends the par conclusion to that\nalready initialized cell. It never substitutes a union-find representative or\nthe raw age itself for the returned boundary, and this local layer performs no\n`queuedVertices` scan. All three rules have dependent success-iff witnesses\nand preserve `ReservationInvariant`; `concl` and `nop` return the prefix state,\nwhile `wait` additionally prepends within exactly one waiting bucket using\nlist cons. Only that bucket-local prepend is O(1): tail-based ready/`sigma`\noperations, boundary lookup, and the overall transition have no O(1) or\nlinearity claim.\n`NopStep.mate_unmarked_before` proves that this post-prefix executable guard\nis the paper's pre-state `μ(u₂)=⊥` guard, because the locally well-formed mate\nis distinct from the only occurrence written by the prefix.\n`RulePrefixAt`, `ConclRule`, `NopRule`, and `WaitRule` now give a separate\nBoolean-free\ndirect state relation: they mention neither `prepare?` nor either canonical\nquery or rule executable. `WaitRule` uses a proposition-level exact\n`sigmaBoundary? = some boundary` equation, not Boolean/Option control flow,\nand states its paper guard directly through `before.core.marks`. The old\n`ConclStep`/`NopStep`/`WaitStep` records remain as\ncompatible equation-backed executable witnesses. Lean proves both executable\nsoundness and valid-guard completeness for the direct relations under\n`StructurallyWellFormed` plus the supplied `ReservationInvariant`, and proves\neach relation has a unique output (for `wait`, under structural validity and\nthe supplied invariant).\n`NopRule` states the paper-level `μ` guard\ndirectly as `before.core.marks`. Separately, the supplied invariant's\n`RealizesSigma.marks_eq` justifies identifying that\nproduction view with the delayed-stack `μ` view; neither statement identifies\nraw ages with union-find representatives.\n`NodeWellFormed` is a local ownership guard, not a replacement for\n`StructurallyWellFormed` or `check`: an eventual untrusted dispatcher must\ncarry a checked/structural certificate gate and full reachable-state\ninvariant.\nThese local rules do not establish queue ownership, a rule dispatcher,\nfull-rule reachability, progress, or a linear-time implementation; the\ncanonical consumer table is still rebuilt by this pure API unless a future\nscheduler threads it explicitly.\n\nThe next bounded implementation slice supplies only the production-core\nmutations needed by eventual `forward`/`unify`. `Certificate.queuePar?` and\n`Certificate.queueTensor?` build par/tensor components, increment their local\nconnective counter, and leave the conclusion's raw mark unchanged; under a\nprior `ComponentsFormulaConsistent` invariant and explicit `LinkWellFormed`\nhypothesis, separate theorems prove the new live components\nformula-consistent. The ready-pop rule is still responsible for assigning the\nconclusion's raw age.\nThe tensor core merges the two generic current representatives by\n`min`/`max`, with distinctness extracted from the executable guard. The\ndelayed state separately exposes `prependReadyTop?` and\n`mergeTopReadyWaiting?`. The two-level merge uses the reproducible list order\n`conclusion :: (payload ++ previousReady ++ activeReady)`, drains the previous\nwaiting bucket, resets that boundary to `undefined`, and pops one active\nlevel. Figure 7 treats the bucket contents as sets, so this list order is a\nproject-level deterministic refinement rather than a claim about source\norder. A component frontier's derivation/exchange order is also not the ready\nbucket's scheduling-list order; later correctness must use proved membership\nor permutation facts rather than defining those lists to be equal. Its\n`WellShaped` theorem takes merged `Nodup`, conclusion-bound, and\nwaiting-payload-bound facts explicitly; no primitive infers ownership by\nscanning `queuedVertices`.\n\nThese are not executable `forward`/`unify` rules. In particular, a complete\n`unify` must prove the generic tensor representatives equal the exact\nscheduler boundaries `j` and `i`, orient the update as `parent[i] := j`, and\nconstruct or activate every par component drained from `W(j)` (or justify a\nproducer-aware deferred representation). The local tensor core increments\nonly once; the complete rule must account for the additional waiting-par\nactivations. Full payload ownership, dispatcher/history integration,\nprogress, completeness, fallback removal, and whole-program linearity remain\nopen. Tail-based list operations also carry no O(1) claim.\n\nThe first separate sequential primitive is now present in\n`SequentialUnification.lean`. Lean proves exact submitted-link origin for a\nreusable source-incidence index. Exact origin alone is only the `Sound`\ncontract: it does not imply that a bucket exists or is unique, and a malformed\nself-axiom is deliberately counted twice at one endpoint. The stronger\n`StructurallyWellFormed.sourceIndex_lookup_eq_singleton` theorem now proves\nthat every in-bounds occurrence of a structurally well-formed certificate has\nexactly the singleton bucket consumed by the executable. Its bounded, globally\ntagged `NEXTAXIOM` search either fails closed or returns the exact submitted\naxiom link index and endpoints, the updated tag array, and the followed\noccurrence trace; both axiom endpoints were unmarked in the input state and\n`trace.length ≤ fuel`.\n\n`SequentialRoute.lean` now gives that trace its exact orientation. Every\nsuccessful search has a nonempty source-left chain from the requested start to\nthe endpoint actually reached, plus the other axiom endpoint. The reached\nendpoint is related by proof to the submitted axiom's stored `left`/`right`\norientation instead of being silently identified with `left`; the canonical\nstored-right regression reaches endpoint `1` along trace `[5, 1]` while the\nsubmitted axiom remains `.axiom 0 1`.\n\nThe result type is indexed by its input tags. Kernel-checked fields and\n`nextAxiomWithFuel?_tag_trace_invariants` prove that the tag carrier size is\npreserved, every input `true` tag stays `true`, the recursive trace is `Nodup`,\nand every trace occurrence plus both axiom endpoints changes from input\n`false` to output `true`. `NextAxiomResult.Touched` includes the trace and both\nendpoints, including the non-recursive axiom partner.\nThe equation-backed\n`nextAxiomWithFuel?_tagged_iff_input_or_touched` and production-wrapper\ncorollary additionally prove that every output true tag was either already\ntrue on input or belongs to that exact touched set; there are no unexplained\ntrue tags in an executable result. The execution equation is essential because\nthe public result record remains manually constructible. Two successful calls\nhave disjoint touched sets when the second call is made with exactly\n`first.tags`. Thus the global no-revisit discipline applies only to a chain\nthat strictly passes each result's tags onward; the theorem does not apply\nafter resetting or replacing the tag array.\n`nextAxiomWithFuel?_exists_of_structural_clearThrough` additionally proves\nlocal totality on the production source index when structural well-formedness,\nstate abstraction, rank-scoped untagged/unassigned freshness, and\n`formulaComplexityAt start \u003C fuel` hold. Its full-carrier-clear corollary uses\nthe exact rank budget `formulaComplexityAt start + 1`; this is an initial/local\nresult, not totality of the carrier-size `nextAxiom?` wrapper or of later\nFigure-7 `new` calls. Indeed, one success tags complexity-zero axiom endpoints,\nso this global low-rank freshness predicate cannot itself be threaded to a\nsecond call at any natural rank; the later scheduler needs a route-local\nfreshness invariant.\n\n`SequentialSchedulerState.lean` isolates the first delayed Figures 7–8 state\nlayer. `SequentialSchedulerBridge.lean` now connects its empty/initial\nreservation to the production unifier without collapsing the two state\nrepresentations. `RawTokenAge` is\nthe discovery-order age and is deliberately not a union-find representative.\n`SigmaAgePartition` makes `σ` a strictly increasing boundary list below\n`nextAge`, with boundary `0` at every positive horizon, and the executable\n`sigmaBoundary?` returns the greatest boundary not exceeding a queried raw\nage. Fixed-capacity `WaitingCell` storage distinguishes three cases that must\nnot be collapsed: an out-of-bounds array lookup, an in-bounds `undefined`\ncell (`⊥`), and `initialized []` (`∅`).\n\nThe strict local initialization guard requires an empty scheduler view: age\nhorizon, `σ`, and ready buckets are empty; every mark is absent; every\nallocated waiting cell is `undefined`; and the two endpoints are distinct and\nin bounds. Global carrier agreement and the remaining `WellShaped` obligations\nare separate preservation-theorem preconditions. `initEnqueue?` then reserves\nage `0`, records\n`[[reached, partner]]`, and leaves both endpoint marks and `W(0)` unchanged,\nso `W(0)` remains `undefined`. The literal `newEnqueue?` source-audit helper\nappends the old age horizon to `σ`, appends the ready bucket\n`[reached, partner]`, and writes `[]` to the fresh waiting cell exactly as the\nprinted Figure-7 display does. It preserves only the deliberately weak\n`WellShaped` invariant and is not the production transition.\n`operationalNewEnqueue?` instead initializes the old active `σ` boundary,\nleaves the fresh active top `undefined`, and preserves\n`OperationalWaitingDomain`: among allocated ages, a waiting cell is\ninitialized iff its age lies in `sigma.dropLast`. This one-cell update is the\nproject's interpretation of the prose-defined nonactive waiting domain and\nthe later `wait`/`unify` operations. It is not presented as an\nauthor-confirmed erratum or as the uniquely possible reconstruction of the\npaper.\n\nA successful dynamic start immediately allocates and assigns a token and\nrefines one independent Figure-5 `start` transition under the existing\nabstraction and `OrderedParents` invariants. It is not the delayed marking of\nFigures 7–8 `init`/`new`. Tests cover\nthe canonical trace/tags, an already tagged start, zero fuel, out-of-bounds and\nmarked starts, missing and non-unique malformed sources, a distinct second\nstart using threaded result tags, repeat rejection, and dynamic token\nallocation. A depth-two fixture locks the exact fuel boundary: rank fuel `2`\nfails and `rank + 1 = 3` succeeds both by theorem and execution. This is not\nyet the Figures 7–8 algorithm. `SequentialSchedulerBridge.lean` now wraps the\ndelayed and production views in `ReservationState` and provides\n`initializeReservation?` and `reserveNewAxiom?`. Each successful call runs the\nbounded tagged search, stores its search-oriented `[reached, partner]` bucket,\nreserves the submitted axiom at `result.linkIndex` as an unmarked production\ncomponent with a fresh self-parent, and threads the complete result tag array.\nThe proof-relevant\n`InitialReservationStep` and `NewReservationStep` records expose each internal\nsuccess, with `initializeReservation?_some_iff` and\n`reserveNewAxiom?_some_iff` characterizing executable success.\n\nStrict tag threading rules out replay of the same submitted axiom-link index\nacross composable wrapper calls: an initial step followed by a later step, and\ntwo later steps, return different link indices. Without a structural\nsingle-source/duplicate-link premise, this does not identify equal axiom values\nat different indices. Reset/replaced tags are outside the guarantee and can\nmake low-level `NEXTAXIOM` rediscover an old axiom; the operational wrapper\nindependently rejects endpoints already stored anywhere in the ready stack or\nwaiting payload table. Direct low-level `reserveAxiomAt?` calls remain\nreplayable because they have neither guard.\n`ReservationInvariant` bundles delayed `WellShaped`,\n`OperationalWaitingDomain`, `RealizesSigma`, production `OrderedParents`,\n`Abstractable`,\n`ComponentsFormulaConsistent`, component/parent carrier alignment,\nstarted-axiom/counter alignment, and tag-domain alignment. It holds after\ninitialization and is preserved by every successful later reservation. This is\na preservation bundle for wrapper-generated histories, not an inductive\nreachability or tag-history characterization: its tag field proves only size,\nso a reset-tag state may still satisfy the record. The waiting-domain field\ncharacterizes initialized cells, not ownership or correctness of their\n  payloads. The local `wait` rule below proves one exact initialized-cell\n  transfer, but the invariant still does not establish its global ownership;\n  `unify` remains absent.\n`SequentialSchedulerInvariant.lean` adds a stronger, still state-only\nfoundation without conflating invariance with reachability:\nthe bundle carries `StructurallyWellFormed` explicitly,\n`ComponentDomainExact` matches live raw component slots to `sigma`,\n`ReadyBucketFrontierExact` matches aligned ready buckets extensionally to\nraw-unmarked component frontiers, live frontiers and the combined\nready/waiting queue are globally `Nodup`, every queued occurrence is\nraw-unmarked, and delayed pending-premise coverage exempts only already\nconstructed ready conclusions. `Produced` records observable production as\neither a concrete raw mark or live-frontier membership;\n`ProducedPremisesMarked` requires both submitted premises of every such\npar/tensor to have concrete raw marks. Together with a future rule's\npre-prefix unmarked-premise witness, this is a necessary causal\nanti-reconstruction guard. It is not, by itself, exact internal link provenance:\nrepeated formula labels mean `FormulaConsistent` alone cannot bind every\ninternal derivation node to one certificate-link occurrence. The separate\noccurrence-provenance layer described below supplies that missing identity\nwithout changing this observable state predicate.\n`WaitingSpanExact` gives every delayed par an\nexact unique producer, raw-unmarked conclusion, and strict older/younger\nmarked-premise span; `FiredCounterExact` counts connective constructors in the\nactual live production trees. Empty state and successful initialization\nestablish the combined `SchedulerInvariant` for structurally well-formed\ncertificates, including either search orientation of the submitted axiom.\nThe synchronized `PreparedStep` now preserves every current state-only field:\nthe active ready occurrence is removed and raw-marked while its already-live\ncomponent frontier, every other ready bucket, waiting span, queue uniqueness,\npremise coverage, and counter equation are transported exactly. Exact\n`ConclStep`/`NopStep` witnesses and successful `concl?`/`nop?` calls inherit\nthat theorem because their output is `prepared.after`. This does not add\nreachability.\n`SequentialComponentProvenance.lean` now supplies the proof-only exact\noccurrence layer that formula consistency could not: every partial derivation\nconstructor records submitted link indices, exact frontier picks, and every\nowned certificate vertex. Local witnesses require duplicate-free used-link\nand owned lists; the forest predicate requires distinct live slots to be\ndisjoint. A marked owned vertex's raw age must resolve to that exact live\nslot, an unmarked owned vertex must remain on the same component frontier,\nand every concrete raw mark is conversely owned by the component at its\nrepresentative slot. This exact relation implies\n`FormulaConsistent`, initializes on a submitted axiom, and extends through the\nlocal par/tensor queue constructors when their submitted link index/lookup is\nprovided. A repeated-label regression keeps the distinction concrete:\nformula consistency accepts a forged same-label axiom frontier, while exact\noccurrence provenance rejects it because no such submitted axiom exists.\nTwo closed predicate regressions separately reject a marked owned vertex\nwhose raw age resolves to another live slot and a raw mark outside every live\ncomponent's ownership forest.\nThe forest predicate is not yet integrated into `SchedulerInvariant` or\nproved preserved by complete queue rules. Preservation through `wait`,\ncomplete `forward`/`unify`, dispatcher progress, completeness, and linearity\nremain open. A local `wait` records a promise and is not counted as an already\nconstructed connective.\n`RealizesSigma` preservation for later reservations splits old and fresh raw\nages: `sigmaBoundary?_append_fresh_old` preserves old boundaries, while the\nfresh-boundary lemma and the production old/fresh representative lemmas align\nthe appended self-parent.\n\nThe canonical two-step reservation regression makes both orientations\nconcrete: submitted `[0,1]` / ready `[1,0]`, then submitted `[2,3]` / ready\n`[3,2]`. A deliberately\narbitrary ordered parent forest with parents `#[0, 1, 0]` and\n`sigma = [0, 1]` maps raw age `2` to boundary `1` but representative `0`.\nThat state is not proved reachable by an actual `unify`/union transition; it\nonly refutes deriving `RealizesSigma` automatically from `WellShaped`,\nmarks/horizon alignment, and `OrderedParents`. This checkpoint still does not\nprove a full reachable Figure-7 state machine. The operational local `new`\ntransition\nnow composes pop-before-mark, raw-age marking, orientation-aware binary-mate\nlookup, post-mark `NEXTAXIOM`, and later reservation under a supplied\n`ReservationInvariant`; its canonical regression yields marks/sigma/ready\n`μ(0)=0`, `σ=[0,1]`, and `R=[[1],[2,3]]`, with `W(0)=∅` and the fresh\n`W(1)=⊥`. The `ReservationInvariant` supplied to this local transition does\nnot by itself express semantic ownership or global queue uniqueness. The\nstronger state-only `SchedulerInvariant` above expresses those obligations,\nbut preservation through `forward`/`unify`, later-state totality, and the exact\ntransition semantics remain open. The exact local `concl`/`nop`/`wait` rules\nare not yet integrated into a full reachable history or dispatcher. The\nseparate\n`InitNewHistory` proves exact tag history, whole-history submitted-slot\nnon-reuse, and event-counter alignment only for genuine empty/init/new\nexecutions. Correct-state progress, pure-worklist completeness, fallback\nremoval, and whole-program linearity therefore remain open.\n\nThe flat-scheduler proof route was also narrowed by counterexample. Exact\nconcrete-state confluence already fails on a derivation-generated correct\ncertificate, and structural-only confluence fails on a structurally well-formed\ncertificate. The current candidate observation is the marked occurrence\ndomain together with the occurrence-thread partition. No confluence, progress,\ncompleteness, or complexity theorem at that quotient is claimed.\n\nIndependent\ntransition refinement and the\nproduction run's bundled abstraction/forest/component/pending-frontier\ninvariant are now kernel checked. Atomic pop-and-process restores complete\nscheduler coverage once the popped index is known to be a submitted\nconnective: the removed head is reclassified, every other status is\ntransported, newly enabled consumers are enqueued, and tensor union preserves\nold shared-token classes. Reverse consumer-table provenance now proves that\ndependency fan-out enqueues only submitted connectives; waiting requeues\ncontain only submitted pars; and every real queue head is therefore a genuine\nconnective. The complete finite production run preserves a bundled\ncore/scheduler/flag/carrier/provenance invariant and full scheduler coverage.\nQueue and waiting flags are now exact in both directions, both concrete\nregistries remain duplicate-free through every finite run, and each registry\nis proved to contain at most one entry per submitted link slot. Exact\ncumulative accounting now proves that, from canonical initialization, link\nattempts plus the residual queue length equals the total number of initial,\ndependency, and waiting-requeue insertions. Structural linear ownership and\nqueue deduplication charge at most one dependency insertion to each successful\nfiring; exact firing history bounds successful firings by the submitted link\ncount; and the duplicate-free waiting registry charges at most one link\ncarrier of requeues to each tensor firing. Lean now proves the resulting\ncumulative insertion bound fits `n(n+4)+1`, and that the canonical production\nrun reaches an empty queue within that fuel. At this quiescent state every\nsubmitted but unfired connective is now kernel-classified by an explicit\nsemantic obstruction witness. Choosing an unassigned conclusion of least\nformula complexity rules out the idle-premise case: its source is a concrete\nsubmitted connective whose premises are already assigned. Thus an incomplete\nrun initially yields either a distinct-thread registered par or a same-thread\ntensor deadlock. Reference-switching acyclicity excludes the tensor branch.\nThe abstract semantics now also proves the converse active-component\ninvariant: every active retained edge stays inside one token class, every\nreachable marking is causally closed, and active-graph walks between marked\noccurrences are equivalent to union-find thread equality. Consequently the\nremaining waiting-par premises are kernel-proved to lie in different active\ngraph components, not merely to have different executable representatives.\nThe exact reference path between them is now bracketed by token-anchored,\noppositely oriented scheduler boundaries. Cutting at the first reentry\nisolates a contiguous block whose intervening edge endpoints are unassigned.\nThe selected waiting conclusion is globally minimum among unassigned formula\ncomplexities; each boundary is consequently proved either strictly above\nthat minimum or to be another exact distinct-thread waiting par. A separate\nstrong-induction theorem now proves that every unassigned occurrence reaches\na concrete registered waiting par through strict formula-complexity descent.\nApplied to the two inactive-block orientations, both frontier chases terminate\nat waiting pars without increasing rank while preserving the exact path\ndecomposition. The construction has now been generalized from that selected\nminimum obstruction to every registered waiting par: each waiting par has an\nexact outgoing path/frontier/chase dependency to another registered waiting\npar, all dependency endpoints lie in the finite formula carrier, and\niterating for one more step than the number of formula occurrences is\nkernel-proved to repeat a waiting conclusion. The repetition is also exposed\nas concrete indices `earlier \u003C later ≤ formulas.size`, with equal endpoint\nconclusions, registered-waiting evidence for every chain vertex, and the full\ndependency witness retained on every edge inside the nonempty closed segment.\nThe well-founded chase inside each dependency is no longer recorded only by\nan endpoint inequality: Lean now retains a reflexive-transitive sequence of\nexact source-connective/premise steps, and proves that these paths compose,\nnever increase formula complexity, and decrease it strictly when nontrivial.\nEach such formula-premise step is now lifted to the exact full occurrence\ngraph edge from connective conclusion to selected premise. Lean composes a\nnontrivial chase into a vertex-simple path whose edges are all traversed\nbackward and whose internal vertices are therefore cusp-free. The\nstate-indexed chase also retains that every visited formula occurrence is\nunassigned, closing a gap that an endpoint-only relation could not express.\nAt the scheduler boundary, an occurrence-exact retained-edge API preserves\nthe concrete full-graph edge and its orientation; the previous endpoint API\nremains available as a compatibility projection. A nontrivial dependency\ntail cannot immediately reverse the lifted assigned-to-unassigned frontier.\nThe all-left switching mask is now classified at that exact full-edge index,\nnot by edge value: axiom, tensor-left/tensor-right, and the sole retained\npar-left occurrence remain distinct even when parallel edges have equal\nendpoints. The lifted prefix now preserves the stored edge and orientation at\nevery list position, and the segment theorem propositionally binds its\nclassified frontier to the actual last prefix occurrence and its classified\nformula edge to the actual first tail occurrence. Structural typing excludes\nthe axiom case at a formula-descent source, while unique connective production\nidentifies the frontier producer with the first tail producer. Lean\nconsequently proves the exhaustive local turn theorem for the edges that are\nactually concatenated: a retained par frontier and the reversed first tail\nincidence share the same par color and form a genuine cusp; a tensor frontier\nand tail carry exact unique colors, and color equality would force the\nprohibited immediate reversal, so the turn is free. Every edge of the finite\n closed waiting-dependency segment now carries this occurrence-geometric\n alternative and an exact composable `fullGraph` segment from its source\n waiting conclusion to its target. Lean concatenates the selected finite\n family into a genuinely nonempty closed occurrence-aware walk in the\n certificate's complete graph. A reusable exact-occurrence\n `Graph.EdgeWalk.NoImmediateReverse` predicate now proves that every individual\n dependency segment is internally nonbacktracking: the source/prefix junction,\n retained simple prefix, classified frontier/tail junction, and all-backward\n tail are covered separately. This does not yet make the concatenated closed\n walk nonbacktracking, because an immediate reversal may still occur between\n two adjacent segments. Lean now proves that any such junction reversal forces\n the preceding dependency's formula chase to be reflexive; a nontrivial\n preceding tail and the next segment head are both backward, so they cannot be\n reverses. The reflexive alternative is occurrence-exact: the final retained\n frontier occurrence is the same stored edge used backwards as the next\n waiting par's source incidence. A generic graph theorem and a\n dependency-specific theorem now cancel exactly that pair while preserving the\n walk endpoints, all other occurrences, and the nested-waiting-par witness.\n A terminating exact-occurrence normalizer repeatedly removes internal pairs\n and rotates away a reversing last/first cyclic pair. Lean therefore reduces\n the nonempty closed dependency walk to a closed walk which is either empty or\n cyclically nonbacktracking, with every surviving occurrence drawn from the\n original obstruction. The empty alternative is real for nested out-and-back\n tree walks and is not silently discarded. The cyclic normalizer now also\n returns a proof-relevant cancellation tree: every internal deletion and every\n rotated closing deletion is retained. Lean proves from an empty trace that,\n for every directed-edge value represented in the original obstruction, the\n reverse orientation of that same stored edge also occurs in the original\n walk. This is an exact-index membership result, not yet a bijection between\n list positions. The scheduler theorem exposes both the trace and that reverse-\n membership result. It now also proves that every forward-oriented occurrence\n in the original dependency walk is retained by the all-left reference\n switching. Therefore, in the empty-normal-form branch, reverse membership\n upgrades this to retention of every original edge index. This identifies the\n empty obstruction as a fully reference-retained nested tree walk. Lean now\n transports that original nonempty closed walk into the deterministic reference\n switching, and the public\n `DeclarativelyCorrect.referenceSwitchingTree` theorem packages that graph's\n tree property. A nonempty closed tree walk may still be nested backtracking, so\n this does not yet exclude the obstruction. The empty branch now additionally\n exposes a `CyclicImmediateReverseSite` in the original traversal: either an\n exact adjacent occurrence/reverse pair or an exact reverse pair across the\n cyclic closing junction. Cyclically nonbacktracking inputs are proved fixed by\n the proof-relevant normalization, and if two individually nonbacktracking\npieces contain an internal cancellation after concatenation, that\ncancellation is proved to cross their unique junction. The scheduler proof\n now retains the complete finite dependency-segment family, its chain indices,\n and each segment's exact head/last scheduler classifications. It localizes the\n site to an adjacent or cyclic segment junction and proves that this junction\n is the same exact occurrence used both as the preceding dependency's retained\n reflexive end and as the following waiting par's stored left incidence. The\n dependency repetition is now chosen at its first repeated conclusion, so all\n earlier chain positions are injective. The retained empty-branch family is\n therefore a simple dependency cycle, not an arbitrary closed segment hiding a\n smaller repetition. Its cancellation junction crosses two distinct waiting\n pars, which rules out a singleton cycle and proves that the family contains at\n least two segments. Each dependency now retains its exact first\n marked-to-unmarked frontier together with assignment of every preceding path\n endpoint. Lean proves that every forward occurrence entering an unassigned\n vertex is exactly this frontier and that, when the target is another registered\n waiting par, the formula chase must be reflexive. The fully cancelling simple\n cycle therefore pairs every source reverse with the unique cyclic\n predecessor's exact last occurrence, and every segment ends at its reflexive\n frontier. The occurrence-indexed full-segment decomposition is now preserved\n through the finite family. Removing each exact backward source incidence and\n forward reflexive frontier yields a deterministic residual core; Lean proves\n its endpoints share one live token, chains it occurrence-exactly to the cyclic\n successor, and proves every edge of every residual core has both endpoints\n assigned before the first marked-to-unmarked boundary. Lean also proves that\n no residual core is empty: emptiness would make adjacent waiting pars consume\n the same exact premise occurrence, so structural one-parent ownership would\n identify their stored links and contradict simplicity of the dependency\n cycle. Removing the source and frontier boundaries also preserves each core's\n exact no-immediate-reverse property, and the deterministic active family\n packages these nonempty internally nonbacktracking cores. Lean composes their\n deterministic flattening into a nonempty closed full-graph walk whose last\n endpoint returns to the first core's exact source-premise base. Every core\n occurrence is retained by the reference switching, so cyclic normalization\n cannot leave a nonempty cyclically nonbacktracking residue in its tree. Lean\nproves that the core-only normal form is empty and localizes an exact reversal\nto a cyclic junction between two nonempty internally reduced cores. That\njunction is now tied to one exact dependency step and both concrete segment\ndecompositions. The adjacent segments contain the strict occurrence word\n`inner, outer, outer.reverse, inner.reverse`; their own nonbacktracking proof\nrules out a degenerate inner/outer pair. Both original detailed segment\nwitnesses remain attached at that same step, and each `core ++ frontier` is\npointwise aligned with its exact retained reference-switching prefix. Lean\nalso proves that the successor prefix begins with the inner occurrence's exact\nreverse. Lean now performs that local switching flip for every reflexive\ndependency: it replaces the backward left-par source incidence and retained\nprefix by the exact backward right-par occurrence followed by the reversed\nstrict reference suffix. Each replacement is a vertex-simple full-graph path,\navoids the exact left occurrence of its target waiting par, and the finite\nfamily composes into a nonempty closed cyclically nonbacktracking walk. Every\ninternal transition, adjacent segment junction, and last/first closing\njunction of that flipped walk is kernel-proved cusp-free. The remaining\nempty-branch obligation is therefore no longer normalization, indexing,\nreference-prefix transport, a hidden formula tail, immediate reversal, or a\nlocal cusp. It is the global repeated-vertex/nesting argument needed to turn\nthis exact cyclic witness into one forbidden switching cycle without\nre-pairing incidences incorrectly at a repeated vertex. Lean now additionally\nlocalizes the unavoidable concrete par-pair conflict to two distinct indexed\nflipped segments: the omitted right occurrence is uniquely the head of its\nsource segment, while the matching retained left occurrence cannot lie in\nthat same vertex-simple segment. Under the first-repeat prefix injectivity\nalready carried by the dependency-cycle witness, the conflict conclusion is\nalso proved distinct from the holder segment's start and reached in that\nsegment's target list. The holder occurrence is the exact retained left\nincidence and the source head is the exact omitted right incidence. Lean now\nsplits the holder segment at that conclusion into incoming and outgoing\nvertex-simple paths: the incoming path is nonempty, the retained-left\noccurrence belongs to the orientation-correct side, and the two paths meet\nonly at the conclusion. The two conflict segments are additionally ordered by\nan exact before/middle/after decomposition of the indexed family. Cutting the\ncyclic family at the shared conclusion then constructs two closed full-graph\narcs, with the first arc nonempty, the omitted-right occurrence in that first\narc, the retained-left occurrence assigned to one of the two arcs, and their\nconcatenation covering the original flipped occurrences up to the cyclic\nrotation permutation. Lean now additionally retains an exact rotation witness,\nproves the rotated concatenation cusp-free internally, and derives internal\ncusp-freedom for each arc. The retained-left orientation is now tied to the\nexact chord boundary: if it is forward, it is the incoming path's last edge,\nthe omitted-right occurrence is the first edge of the first arc, and that\nnew closing turn is kernel-proved to be a par cusp. If retained-left is\nbackward, it is the outgoing path's first edge and therefore the nonempty\nsecond arc's exact head. Lean now also classifies that backward closing turn:\nthe exact rotation boundary is cusp-free, and the reversed retained-left and\nomitted-right incidences have the same par color, so every possible last edge\nof the second arc closes cusp-free against its head. Combined with the\nalready-proved internal cusp-freedom, the second arc is cyclically\nnonbacktracking. It is nonempty and strictly shorter than the original\nflipped walk because the complementary first arc is nonempty. This still does\nnot make it a `CuspFreeCycle`: the second arc may repeat vertices, and\ncorrectness then forces some concrete par pair to survive again. Lean now\ntransports more than length through this descent: every second-arc occurrence\nretains its exact indexed flipped-scheduler segment, every forward occurrence\nremains reference-kept, and the recursive omitted-right par is located at the\nexact head of one classified segment while its retained-left mate lies in a\ndistinct classified segment. The shared par conclusion is the first segment's\nstart and a genuine internal target of the second segment. That information is\nnow packaged as a generic cyclic scheduler-subarc state. Lean rotates any such\nsubarc to its omitted-right occurrence and cuts at retained-left. A backward\nretained-left produces a strictly shorter state with the same closed-walk,\ncusp-freedom, reference-retention, scheduler-provenance, and located-par\ninvariants. Each cut additionally retains a proof-relevant cyclic-interval\ntrace: the larger traversal's exact rotation decomposition and the smaller\ncontiguous interval are recorded rather than replaced by a membership subset.\nRecursion on traversal length therefore terminates at a forward retained-left\npar-cusp arc, with its full interval-descent trace back to the original flipped\nfamily. The infinite-backward-descent concern is closed without loop erasure.\nThe terminal proof object now also retains the exact complementary cyclic\ninterval rather than merely naming an unrelated closed arc. One indexed\nterminal witness binds the positioned generator, terminal arc, complement,\nderived strict cut, closed complement walk, reverse-shell normalization, and\nthe nesting trace that consumes them. The complement is nonempty, closed,\ninternally cusp-free, and strictly shorter. Lean proves that\nany cusp at its closing junction must be the exact last/first immediate\nreversal: a nontrivial par cusp would also cusp against the terminal arc's\nretained-left boundary, contradicting the rotated traversal's internal\ncusp-freedom. Lean now strips those exact reverse shells proof-relevantly,\nretaining an exact\n`opening ++ normalized ++ reverseTraversal opening` decomposition and length\nequation. A nonempty normalized core inherits both the concrete par\nobstruction and its exact scheduler location. If that core closes cusp-free,\nthe same construction produces a strictly nested terminal forward cusp;\nwell-founded recursion records the transitive cyclic-interval descent and\nterminates. The finite empty normalized-shell alternative is now ruled out:\nits nonempty opening is immediately followed at the shell midpoint by the\nexact reverse of its last occurrence, which is a cusp and contradicts the\ninherited `CuspFreeTraversal`. The remaining geometric obligation is the\nscheduler-located nontrivial closing-par core.\nFor the\n nonempty normal form, exact\n index/orientation transport through arbitrary switching masks is now proved.\n Any par-pair-sparse cyclically nonbacktracking walk would therefore lie in one\n occurrence switching and contradict its tree property. Lean consequently\n exposes a concrete par whose two exact premise occurrences both survive; the\n all-left forward-retention invariant forces its omitted right occurrence to be\n traversed backward. Proof-net correctness and finite length now transport the\n exact cyclic scheduler state through every shorter backward witness and force\n a terminal forward par-cusp interval. Its complementary interval is exact,\n nonempty, closed, strictly shorter, internally cusp-free, and its reverse\n shells are now normalized with exact positional and length evidence. Finite\n nested descent reduces the obstruction to either an empty shell core or a\n scheduler-located nontrivial closing par cusp. In the empty branch, the\n coordinate-exact reverse chord now carries both source endpoints, complete\n retained reference-suffix walks, and the exact target-left occurrences avoided\n by the two classified segments; the global fully reflexive-cycle theorem\n exposes this outcome directly. The selected compacted suffix occurrences are\n proved to remain exact reverses. The empty shell itself is now split into two\n nonempty reference-switching walks through one midpoint, with the complete\n closing traversal kernel-proved equal to the reverse of the opening traversal.\n Lean now uses that same exact shell equation together with inherited internal\n cusp-freedom to exclude the empty branch: the midpoint is an unavoidable\noccurrence/reverse cusp. The surviving closing-par core carries exact first\nand last scheduler tags, their segment/offset lookups and flipped-segment\nclassifications, and proof that its forward last incidence is retained by\nthe reference switching. Those exact tags now share one dependent witness with\nthe same par link and normalization core; Lean proves the tagged core has the\nform `first :: middle ++ [last]`, remains closed, and its artificial closing\nseam is neither a same-segment nor a segment-boundary adjacency of the original\nscheduler. The retained state-and-interval ancestry now binds every\nbackward-search cut to its positioned par obstruction and binds every terminal\ncomplement to the same indexed forward-cusp generator, arc, derived cut, closed\nwalk, and reverse-shell trace. The terminal path no longer invokes the generic\n`CyclicIntervalCut` positional lift; only the source-fixed reverse-shell\ndecomposition is lifted. The global closing theorem now packages that exact\nterminal base, its data-indexed global ancestry, the closing outcome, and the\nendpoint split: the first three share the same\n`(base, complementBase, taggedComplement, taggedNormalized)` tuple, and the\nsplit shares that exact `taggedNormalized`. The full terminal `StepAt` frame\nremains existential inside its step wrapper rather than a global package index.\nThe structural replay now consumes that wrapper once and carries both the\nolder candidate cursor and an exact endpoint zipper through the terminal frame,\nbackward frames, reverse shells, nesting, and global ancestry. The zipper's\ngap is the complete complementary endpoint arc, not the candidate cursor gap.\nThe canonical terminal replay fixes the reverse-shell opening and closing\ncontexts and the nonempty omitted arc. Its first opening is the reverse-shell\nframe when `closing ++ opening` is nonempty and otherwise the omitted-arc\nframe. The resulting base gap is exactly\n`closing ++ taggedArc ++ opening`; it contains the omitted-right anchor and\nthe outer retained-left last occurrence. Its erased outer arc is a closed,\ninternally cusp-free walk whose exact wraparound from the outer last occurrence\nto the anchor is a nontrivial cusp. The first-opening proof is constructed by\nthe stated shell case split, but its returned proposition does not expose the\nchosen frame together with the anchor origin. The complete base gap is a\nsublist of every later ancestry gap, and the entire `taggedArc` therefore\nsurvives in its original linear order inside the initial scheduler-family gap.\nThe exact head/last lookups now decompose that gap as\n`g0 ++ anchor :: g1 ++ outerLast :: g2` and yield\n`CyclicFourPointDisplayAt firstTag lastTag anchor outerLast`. The generic\ndisplay permits empty intervals and repeated values; it proves no contiguity,\nfixed linear rank, crossing, cyclic betweenness, or model-specific\nscheduler-order/proper-nesting contradiction. In the complete initial `tagSchedulerFamily`,\nthe four exact tags are now proved `Nodup` without claiming distinct erased\nedges or vertices. The same outer positioned choice and the inner positioned\nwitness are both lifted through ancestry to that full family and returned with\nthe display. Its `firstTag → lastTag → anchor → outerLast` order separates,\nrather than crosses, the two endpoint pairs; intervals may still be empty, and\nordinary laminarity permits the pairs as siblings. The fixed accepted\nthree-axiom regression refutes a generic flat age-interval/LIFO invariant.\nFlat completeness therefore points to residual-witness preservation or\nconfluence modulo the marked-domain/occurrence-thread observation. Exact-state\nand structural-only confluence are already refuted; no theorem at the candidate\nquotient exists. The bounded/tagged `NEXTAXIOM` and dynamic-start primitive is\nkernel checked, including per-call trace/tag invariants, exact oriented routes,\ninitial/local rank-scoped totality, and touched-set disjointness for successive\ncalls that strictly thread `first.tags`. The delayed state checkpoint proves\nraw-age `σ` partitioning, the three waiting-cell states, the mark-preserving\n`init`, the display-only printed `new`, and the separate operational `new`\nthat preserves `OperationalWaitingDomain`. The production\nbridge now packages both views in `ReservationState`, supplies executable\ninitial and later reservation wrappers with typed success witnesses and\n`some_iff` characterizations, and preserves the complete\n`ReservationInvariant` bundle, including the waiting domain, across both\nstages. Complete output-tag\nthreading excludes replay of one submitted axiom-link index between composable\nwrapper calls, but resetting tags or using the low-level reservation primitive\nremains outside that result.\nThe canonical receipt is submitted/ready `[0,1]`/`[1,0]` followed by\n`[2,3]`/`[3,2]`. The newer operational local Figure-7 `new` layer additionally\nperforms\nthe synchronized pop/raw-mark prefix, fixed canonical tensor-consumer lookup,\nopposite-premise search in the marked state, and the same exact later\nreservation. Its input carries `ReservationInvariant`, which alone is not a\nreachable-scheduler certificate. The dedicated `InitNewHistory` now records\nonly genuine empty/init/new executions and proves exact tags-as-touched,\nwhole-history submitted-slot non-reuse, and reservation-count alignment.\nPreservation of ready/waiting payload ownership and global queue uniqueness\nthrough `forward`/`unify`, integration of local `concl`/`nop`/`wait` into\nfull-rule history, and a total later-state transition system remain open.\nClosing-par\nscheduler-order exclusion and correct-state progress remain open.\nPure-worklist completeness, recursive-fallback removal, and a whole-program\nlinear cost theorem remain separate open gates. See\n[the v0.10 design](docs/v0.10-design.md).\n\nv0.9 exposes\noccurrence-aware multigraph acyclicity and proves that every declarative\n`IsTree` is acyclic. Exact edge occurrences, walks, cycles, and acyclicity are\nalso proved invariant under bounded bijective vertex renaming. The converse\nforest-count theorem is now complete, yielding\n`IsTree ↔ Bounded ∧ Connected ∧ Acyclic`. A certified exhaustive cycle\ndecision procedure now decides that exact `Acyclic` semantics and yields a\nsecond tree checker proved Boolean-equal to the existing\nreachability-plus-count implementation. The new path is an exponential\nspecification oracle. A second exhaustive oracle now decides the exact colored\n`CuspAcyclic` proposition used by the generalized-Yeo splitting proof, and\nreference-checker acceptance is proved to imply its acceptance. For\nstructurally well-formed certificates, Lean now also proves that\n`CuspAcyclic` is equivalent to occurrence-aware acyclicity of every switching,\nusing exact mask-index transport even in the presence of parallel\nequal-valued edges. A new finite-forest theorem proves that a nonempty bounded\nacyclic graph with `|E| + 1 = |V|` is connected. Because every switching\nretains the same number of edge occurrences, Lean now reduces universal\nswitching connectedness to one deterministic all-left reference switching.\nThe exact compact criterion is:\n\n```text\ncheck = true ↔\n  StructurallyWellFormed ∧\n  CuspAcyclic ∧\n  ReferenceSwitchingConnected\n```\n\n`Certificate.compactCheck` executes this criterion and is proved\nBoolean-equal to `Certificate.check`. It does not enumerate switchings, but\nits current colored-cycle oracle is still exhaustive and exponential. A\nnew Guerrini-style token-unification fast path constructs a derivation while\nfiring par/forward and tensor/unify rules, then independently verifies that\nderivation. Lean proves the fast path sound. The public\n`Certificate.unificationCheck` now tries an event-driven dependency worklist,\nthen the eager scan, then the already complete checker-free sequentializer.\nIt is proved Boolean-equal to `Certificate.check` without enumerating\nswitchings. Both fast paths independently verify their generated derivation.\nPure fast-path completeness and Guerrini's linear complexity bound are still\nseparate open proof obligations. The statistics-bearing eager API carries kernel proofs\nthat eager saturation performs at most `|links|` full passes and exactly\n`passes * |links|` link-list visits, hence at most `|links|²` such visits.\nThat scoped bound does not cover frontier search, union-find traversal,\nindependent verification, or the hybrid fallback. The worklist result\nseparately carries a proof that link attempts stay within the conservative\nfuel `n(n+4)+1`; current `main` additionally proves that this fuel exhausts the\ncanonical production queue on every structurally well-formed input whose axiom\ninitialization succeeds. This is scheduler fuel sufficiency, not yet\ncorrect-net completeness.\n\nThe v0.8 release adds a proved non-factorial intrinsic canonical\nform and the separate `proofnet-canonical-key-0.2` wire. On\nstructurally well-formed certificates, equality of the new typed key is proved\nequivalent to exactly the existing `ProofNetEquivalent` relation. It does not\nchange that relation or claim arbitrary graph isomorphism.\n\nThe research hypothesis is that a model should sometimes predict proof\ngeometry before it predicts a tactic sequence. A graph certificate can factor\nout arbitrary ordering between independent inferences, expose dependency\nstructure, and support local repair. The Lean kernel remains the final source\nof trust.\n\n## Current vertical slice\n\nThe repository currently contains:\n\n- a unit-free MLL formula language with involutive De Morgan duality;\n- explicit formula occurrences and typed `axiom`, `tensor`, and `par` links;\n- executable structural well-formedness checks;\n- independent proposition-level structural semantics and an iff theorem for\n  the executable structural checker;\n- exhaustive enumeration of all par switchings;\n- an independent inductive `ChoiceSelection` relation and an iff theorem\n  proving the enumerator covers exactly all one-edge-per-par switchings;\n- a finite undirected graph checker for boundedness, connectedness, and the\n  `|E| + 1 = |V|` tree condition;\n- an occurrence-aware `Graph.Acyclic` predicate in which parallel stored\n  edges remain distinct and can form a length-two cycle; every declarative\n  tree is proved acyclic, exact cycles plus acyclicity are proved invariant\n  under bounded bijective vertex renaming, and the converse forest theorem\n  proves `IsTree ↔ Bounded ∧ Connected ∧ Acyclic`;\n- an exhaustive `Graph.isAcyclic` reference oracle proved sound and complete\n  for exact occurrence-aware cycles, plus `Graph.isTreeViaAcyclic`, proved\n  Boolean-equal to the existing `Graph.isTree`; both are deliberately\n  specification paths rather than scalability claims;\n- an exhaustive colored-cycle oracle `Certificate.isCuspAcyclic`, proved\n  sound and complete for the proposition-level `CuspAcyclic` criterion used\n  by the splitting theorem; every reference-checker-accepted certificate\n  passes it, and structural well-formedness gives the exact equivalence\n  `CuspAcyclic ↔ every occurrence-order switching is Acyclic`;\n- a finite maximal-forest proof of\n  `Bounded ∧ Acyclic ∧ |E| + 1 = |V| → Connected`, followed by the exact\n  reference reduction\n  `AllOccurrenceSwitchingsConnected ↔ ReferenceSwitchingConnected` under\n  structural well-formedness and cusp-acyclicity;\n- exact compact decomposition theorems for both declarative and executable\n  correctness, plus `Certificate.compactCheck`, a switching-free executable\n  specification checker proved Boolean-equal to `Certificate.check`. Its\n  exhaustive colored-cycle phase is not yet a scalable contraction checker;\n- a deterministic Guerrini-style unification fast path that starts axiom\n  tokens, forwards par links when premise classes agree, unifies tensor links\n  when they differ, carries partial derivations, and independently verifies\n  the final tree. Lean proves fast-path soundness. The exact\n  `Certificate.unificationCheck` API combines it with the complete\n  checker-free reconstruction fallback and is proved equal to `check`; the\n  detailed tier returns stable `UnificationErrorCode` diagnostics, while the\n  pure fast path is not yet proved complete or linear. Its\n  `unificationDerivationCandidateWithStats` result exposes proved eager-scan\n  counters without overstating them as a whole-program time bound;\n- an event-driven worklist prototype that precomputes premise consumers,\n  enqueues newly armed links, and requeues only waiting par links after tensor\n  unions. Every worklist success is independently verified and proved sound;\n  the worklist-first hybrid is proved equal to `check`, while completeness,\n  the final correctness-to-progress argument, flat-waiting-set complexity,\n  and full Figures 7–8 `NEXTAXIOM` sequentialization remain open. The current\n  production fuel is proved sufficient to empty its queue. If that quiescent\n  run is incomplete, least-complexity descent eliminates idle premises and\n  initially leaves a distinct-thread waiting par or same-thread tensor\n  deadlock. A kernel-checked active-reference connectivity invariant and\n  switching-cycle argument now exclude the tensor branch on every\n  declaratively correct input. A second causal-closure/reference-edge\n  invariant proves exact equivalence between active graph components and\n  union-find classes, strengthening the remaining submitted waiting par to\n  two marked premises with no active reference walk between them. Exact\n  occurrence-aware tree-edge exchange now also supplies a reference simple\n  path between those premises which avoids the par conclusion; an incomplete\n  run must expose an unmarked internal occurrence on that path. A generic\n  occurrence-preserving first-frontier theorem now strengthens this to an\n  exact traversed reference edge directed from a marked occurrence into an\n  unmarked occurrence while retaining an entirely active path prefix. Exact\n  active-component/thread correspondence therefore proves that the frontier\n  source carries the waiting par's left-premise token; it is not merely an\n  unrelated marked vertex. Reading the same path backward selects the last\n  inactive frontier, proves its target carries the waiting par's right token,\n  and yields one exact ordered decomposition with distinct left and right\n  boundary occurrences. Exact retained-edge/source-link lookup, completed\n  axiom initialization, and causal closure now classify the boundary as a\n  forward premise-to-conclusion occurrence of a concrete submitted par or\n  tensor. Quiescent scheduler coverage then proves these exact local\n  alternatives at both sides of the bracketed region: a par has an unassigned\n  omitted premise or remains registered on distinct tokens, while a tensor\n  has an unassigned opposite premise. A stricter suffix cut now selects the\n  first reentry into the marked region and proves that every intervening\n  traversed occurrence has two unmarked endpoints, while retaining exact\n  scheduler classifications at both boundary orientations. The subsequent\n  occurrence-aware dependency, flipped-cycle, terminal-cusp, reverse-shell,\n  and well-founded nesting arguments exclude the empty reverse-shell base by\n  its forced midpoint cusp and reduce the remaining progress proof to one\n  scheduler-located nontrivial closing-par core. Its exact endpoint tags,\n  par link, normalized core, and first-to-last tagged split now share one\n  witness, and its artificial seam is proved not to be an original scheduler\n  coordinate adjacency. Every recursive backward-chord frame is generated by\n  the same coordinate-exact positioned obstruction and retained in the search\n  trace. The terminal generator, arc, complement, derived cut, closed walk,\n  reverse-shell normalization, and nesting trace now likewise share one\n  indexed witness, without the first generic `CyclicIntervalCut` lift. The\n  terminal base, global trace, closing outcome, and normalized endpoint split\n  are now assembled into one data-indexed closing package. A private\n  proof-relevant endpoint replay consumes each stored exact frame without\n  reselection. Its occurrence-position zipper defines the complete\n  complementary arc between the tagged closing endpoints. The canonical\n  terminal replay always supplies the first opening: a nonempty reverse shell\n  opens in the first frame, while an empty shell leaves the generator's\n  nonempty omitted arc to open in the second. It retains the exact reverse\n  equation, omitted-right anchor, outer retained-left last occurrence, and\n  base gap `closing ++ taggedArc ++ opening`. The erased outer arc is a closed\n  `EdgeWalk` and `CuspFreeTraversal`, with an exact nontrivial closing cusp from\n  its retained-left last occurrence to its omitted-right head. The construction\n  proves the first-opening fact by its shell case split, while the returned\n  first-opening payload does not independently expose that branch or bind it to\n  the anchor frame. Endpoint-gap sublist transport carries the whole\n  `taggedArc` in its original linear order through ancestry into the\n  initial-family gap, including its named head and last occurrences. A generic\n  head/getLast-plus-sublist theorem gives the exact gap decomposition\n  `g0 ++ anchor :: g1 ++ outerLast :: g2` and a\n  `CyclicFourPointDisplayAt firstTag lastTag anchor outerLast`. Its intervals\n  may be empty and its values may repeat generically, so this is not a strict\n  scheduler-rank theorem and proves no contiguity, fixed linear rank, crossing,\n  cyclic betweenness, or scheduler-order/proper-nesting contradiction. On the complete initial\n  family, exact scheduler-coordinate `Nodup` distinguishes the four tags\n  without distinguishing their erased edges or vertices. Both the inner\n  positioned witness and the same outer positioned choice survive ancestry and\n  are returned with the display; the resulting\n  `firstTag → lastTag → anchor → outerLast` order is separated rather than\n  crossing. A stable accepted three-axiom regression independently shows that\n  this flat eager worklist can first merge token ages 0 and 2, so no generic\n  contiguous-age/LIFO invariant may be imported here. Ordinary laminarity also\n  permits the two displayed pairs as separated siblings. Exact-state\n  confluence and structural-only confluence are independently refuted; a\n  candidate quotient retains the marked occurrence domain and induced\n  occurrence-thread partition. Residual-witness preservation or a theorem at\n  that quotient remains the\n  scheduler-preserving route for flat completeness. The separate\n  bounded/tagged `NEXTAXIOM` primitive and the first independent delayed\n  raw-age state layer are checked. The latter proves strictly increasing `σ`\n  boundaries, distinct out-of-bounds/undefined/initialized-empty waiting\n  states, a mark-preserving `init`, the literal printed `new` display helper,\n  and a separate operational `new` preserving `OperationalWaitingDomain`.\n  `ReservationState`, `initializeReservation?`, and `reserveNewAxiom?` now\n  connect those reservations to the production carrier. Typed initial/later\n  witnesses and their `some_iff` theorems expose exact success; complete tag\n  threading excludes replay of the same submitted axiom-link index between\n  composable wrapper calls; and\n  `ReservationInvariant` is established initially and preserved later,\n  including `WellShaped`, `OperationalWaitingDomain`, `RealizesSigma`,\n  production forest/abstraction/formula consistency, and\n  carrier/counter/tag alignment. Reset tags can replay the low-level search,\n  although the operational stack guard rejects already queued endpoints;\n  direct low-level reservation remains replayable. A single shared public\n  `ConsumerIndex` now replaces the former private worklist builder and is\n  proved sound and complete; structural linear ownership gives set-level\n  singleton consumers. The operational local Figure-7 `new` rule fixes that\n  canonical\n  index, performs pop-before-mark, raw marking, orientation-aware tensor-mate\n  lookup, post-mark `NEXTAXIOM`, and operational later reservation, and carries\n  the input reservation invariant in its dependent success witness. A separate\n  proof-relevant `InitNewHistory` now characterizes exactly executed\n  empty/init/new histories and proves exact tag provenance, submitted-slot\n  `Nodup`, and reservation-count alignment. This is not a characterization of\n  the full scheduler: ready/waiting payload ownership, global queue\n  uniqueness, `forward`/`unify`, full-history integration of the local\n  `concl`/`nop`/`wait` rules, and later totality remain open. Closing-par\n  exclusion,\n  correct-state progress, pure-worklist completeness, fallback removal, and\n  whole-program linearity remain open;\n- a separate bounded/tagged `NEXTAXIOM` checkpoint with a reusable\n  source-incidence index of proved exact submitted-link origin.\n  `SourceIndex.Sound` alone is only provenance; structural well-formedness now\n  additionally proves a singleton lookup at every in-bounds occurrence,\n  including the multiplicity argument that prevents malformed self-axioms from\n  masquerading as singleton buckets. Success retains the exact axiom\n  index/endpoints, final tags, and trace, proves both endpoints were\n  input-unmarked and the trace length is fuel-bounded, preserves the tag\n  carrier and old `true` tags, and proves trace `Nodup` plus input-`false` to\n  output-`true` for every trace vertex and both endpoints. Successive touched\n  sets are disjoint only under strict `first.tags` threading, which is the\n  scope of the global no-revisit discipline; reset tags are outside the\n  theorem. Successful traces now carry exact oriented source-left routes, and\n  initial/local calls are total under rank-scoped freshness with\n  `complexity + 1` fuel. Its immediate dynamic start refines eager Figure 5\n  under `OrderedParents`; malformed source buckets still fail closed. Tests\n  additionally cover zero fuel, out-of-bounds and marked starts, missing\n  sources, a threaded distinct second start, stored-right orientation, and\n  repeat rejection, plus a depth-two exact rank/fuel boundary. A separate\n  delayed-state checkpoint now covers raw ages, `σ`, waiting-cell distinctions,\n  and exact mark-preserving initial/later reservations. The\n  `ReservationState` bridge proves both executable wrappers equivalent to typed\n  initial/later steps, preserves `RealizesSigma` and the full reservation\n  invariant across later appends, and exposes both submitted and\n  reached/partner orientations. Strictly threaded wrapper calls cannot reserve\n  the same submitted axiom-link index; reset tags or direct low-level\n  reservation can. The next layer gives the project's operational local\n  Figure-7 `new` sequencing under `ReservationInvariant`, with a fixed\n  sound-and-complete consumer index, mark-before-search dependency, and\n  preservation of the exact initialized-cell domain. The separate local\n  `wait` rule now performs an exact raw-age-to-`sigma`-boundary payload cons.\n  Reachable later-state totality, ready/waiting payload ownership,\n  `forward`/`unify`, full-history integration of the local\n  `concl`/`nop`/`wait` rules, full scheduler correctness, and a\n  whole-program cost proof remain open;\n- a Lean theorem `check_sound` connecting executable acceptance to an\n  independent inductive walk semantics;\n- kernel-checked loop erasure and a finite-vertex path bound, yielding full\n  checker soundness and completeness for that standard unbounded semantics;\n- exact soundness and completeness against an independent fuel-indexed path\n  semantics: `closureN fuel` iff a path of at most `fuel` steps is available\n  when stored edges are in bounds;\n- `check_iff_fuelDeclarativelyCorrect`, lifting both the path and switching\n  correspondences to the complete certificate checker;\n- `check_iff_declarativelyCorrect`, proving the Boolean checker decides the\n  public Boolean-free, unbounded switching specification;\n- explicit exchange/permutation plus recursive identity expansion proving\n  `|- A, A-dual` for every unit-free MLL formula;\n- a first-order arbitrary cut-free derivation-tree language with explicit\n  resource positions and exchange permutations;\n- an exact synchronization theorem proving that formula inference succeeds iff\n  occurrence-aware fragment construction succeeds with the same ordered\n  formula boundary, including exchanges between duplicate labels;\n- a kernel theorem proving that every successfully constructed fragment's\n  public certificate lookup recovers exactly that ordered formula boundary;\n  separate structural-composition and switching-composition theorems now prove\n  every such fragment declaratively correct and executable-checker accepted;\n- totality of both `desequentializeChecked?` and `elaborate?` for every rule\n  tree accepted by the independent `infer?` pass;\n- general validated desequentialization of those trees, with a checked return\n  type carrying `certificate.check = true`;\n- a deterministic broad-family derivation generator whose first 250\n  depth-two trees all produce accepted certificates;\n- a derivation-first generator for the corresponding canonical identity\n  certificate at arbitrary formula depth, with exact certificate-gated\n  reconstruction;\n- a finite formula enumerator whose depth-two one-atom corpus checks all 210\n  generated identity certificates;\n- labeled negative-certificate mutations, compile-time regression assertions,\n  and an executable smoke test.\n- an independent CI differential audit over 33,868 exhaustive graphs and\n  1,000 generated or mutated certificates.\n- versioned canonical v0.2 JSON plus a committed deterministic dataset of 250\n  positive and 750 negative checker-labeled records;\n- a native v0.2/v0.3 JSON parser with path-aware errors, a v0.2-to-v0.3\n  migration API, a checker-gated API for untrusted certificates, and a\n  deterministic 5,000-case malformed-input fuzz gate;\n- a runnable focused cut-free sequent-search baseline with eager invertible par\n  steps and exhaustive tensor resource partitions;\n- lossless bounded vertex reindexing with inverse round trips, a proved\n  equivalence relation, and whole-checker/declarative-correctness invariance.\n- a v0.3 `reindex-v1` serialized normal-form key proved invariant under that\n  relation, plus an independent 1,000-record permutation/property audit.\n- a theorem that this normal form is an in-class representative and a complete\n  invariant for structurally well-formed certificates, plus the executable\n  `Certificate.reindexEquivalent?` decision procedure.\n- a well-founded logical sequentialization theorem: every checker-accepted\n  certificate has a kernel `Derivation` whose sequent is exactly the ordered\n  list of its conclusion formulas.\n- a full well-founded sequentialization theorem: every checker-accepted\n  certificate has a concrete first-order `CutFreeDerivation`; its executable\n  desequentialization is `ProofNetEquivalent` to the input and carries the\n  same ordered formula boundary.\n- the v0.5 executable `Certificate.sequentialize` API that searches\n  checker-preserving inverse rules and returns a proof-bearing tree, exact\n  ordered input boundary, accepted desequentialization, and\n  `ProofNetEquivalent` output. `Certificate.sequentialize_complete` proves this\n  runtime search succeeds for every checker-accepted certificate; it also\n  passes all 250 broad generated regressions, the same 250 nets with every link\n  list reversed, and a dedicated repeated-boundary-label regression.\n- the v0.9 `Certificate.verifyDerivation?` API for clients that\n  already have a proposed cut-free derivation. It does not enumerate\n  switchings on the input or search vertex permutations: it performs\n  structural validation, independently infers and desequentializes the tree,\n  then uses the proved non-factorial intrinsic canonical code. A successful\n  result carries checker acceptance of the produced net and exact\n  `ProofNetEquivalent` identity with the submitted certificate.\n- the automatic v0.9 `Certificate.reconstructDerivation?` path.\n  Its structure-guided fast path recursively peels terminal par links or\n  splits terminal tensors, aligns repeated boundary occurrences by\n  vertex-number-free formula-tree/axiom profiles, and validates the completed\n  tree once with `verifyDerivation?`. A separately proved exhaustive path is\n  retained as the fallback, so failed heuristics do not weaken completeness.\n  Neither path calls the all-switchings checker. Lean proves it succeeds on\n  every reference-checker-accepted certificate and proves\n  `Certificate.reconstructsDerivation = Certificate.check` for all inputs.\n  The current fallback can still backtrack and enumerate repeated-label\n  orders, so no polynomial or linear worst-case claim is made.\n- a fail-closed `Certificate.reconstructDerivationWithinLimits` API with\n  explicit formula-occurrence, link, and conclusion ceilings. The qualified\n  default is 128/96/24 and never enters the exhaustive formula-order\n  fallback. Limit failures and heuristic misses are structured\n  `ReconstructionError` values, not claims that the certificate is logically\n  invalid. Every successful result carries the same soundness evidence and is\n  proved inside the unbounded reconstruction decision's accepted set;\n- an executable finite `proofNetCanonicalFamily` whose extensional membership\n  equality is proved equivalent to exactly `ProofNetEquivalent` on\n  structurally well-formed certificates. This is a factorial specification\n  oracle, not a compact wire key or arbitrary unlabeled-graph canonicalizer.\n- a released experimental `proofNetCanonicalFingerprint?` value that selects the\n  lexicographically least serialized member of that family. Lean proves it is\n  total and invariant under `ProofNetEquivalent`; the JSON-string API remains a\n  forward-only convenience because no `Json.compress` injectivity theorem is\n  assumed;\n- an explicitly versioned `proofNetCanonicalCode?` token key.\n  Its underlying structural encoder is proved injective, and Lean proves on\n  structurally well-formed certificates (hence on checker-accepted inputs) that\n  code equality is equivalent to exactly `ProofNetEquivalent`. It still\n  materializes the factorial family;\n- a released `proofnet-canonical-key-0.1` JSON wire wrapper with a bounded\n  parser, structured errors, schema and fixture, v0.3-to-key semantic migration,\n  and a safe matcher theorem for untrusted parsed keys. Public generation and\n  matching reject inputs above seven links before factorial materialization;\n  the exact typed key remains an unbounded specification oracle. Its 1,000-case\n  wire property corpus, 5,000-case malformed-key fuzz corpus, and measured\n  1/4/7-link benchmark pass, but larger or ordinary pairwise comparisons should\n  use `CheckedCertificate.sameProofNet?`;\n- an intrinsic canonicalizer that traverses the ordered conclusion\n  forest, follows each unique tensor/par producer in premise order, emits every\n  orientation-sensitive link exactly once, and then erases submitted vertex\n  numbers. Lean proves exact traversal coverage, exact link permutation,\n  in-class representation, and equality iff `ProofNetEquivalent` on the\n  structurally well-formed domain. The separate\n  `proofnet-canonical-key-0.2` wire removes the seven-link ceiling and has been\n  differentially checked against the factorial oracle on 1,000 deterministic\n  cases and exercised on 1,000 additional mixed derivation-generated accepted\n  nets; its direct implementation is polynomial, currently\n  `O(VL + V^2)`, and still enforces independent token/character limits;\n- a clean downstream Lake consumer pinned to the exact public `v0.7.0` tag,\n  exercising bounded-key exactness, safe matching, over-limit\n  failure, and executable sequentialization;\n- a checked pairwise identity API,\n  `CutFreeDerivation.CheckedCertificate.sameProofNet?`, proved to decide\n  exactly `ProofNetEquivalent`. Its search enforces the ordered conclusion\n  boundary and numeric-free one-hop incident-link roles while generating\n  formula-occurrence alignments; a 64-pair\n  repeated-label stress case generates one candidate instead of the\n  unconstrained label enumerator's theoretical `(64!)^2` orders. This remains\n  an exact scoped decision procedure, not a compact canonical wire key or an\n  arbitrary graph-isomorphism algorithm;\n- a conservative v0.6 LeanProp bridge with judgments\n  indexed by separate persistent and linear proposition contexts. Persistent\n  weakening/contraction and both exchanges are explicit, while no linear\n  weakening/contraction constructors exist. Conjunction, implication,\n  equality rewriting, universal instantiation, and existential witnesses are\n  interpreted into actual Lean proof terms; a kernel theorem proves that the\n  number of linear-axiom leaves equals the linear-context length. The explicit\n  exchange syntax represents exactly `List.Perm` under `Nonempty`; every such\n  persistent or linear exchange is admissible, and transporting a dependent\n  proof environment through exchange and its inverse is identity in both\n  directions. A typed normalizer recursively removes every immediate\n  persistent contraction-over-weakening redex; Lean proves the result reduced,\n  the operation idempotent and size-nonincreasing, and the linear-resource\n  count and proof interpretation preserved. This is a noncomputable\n  proof-construction API over proposition-indexed derivations, not a runtime\n  raw-schema normalizer;\n- a proposition-independent schema layer for generated atoms/conjunctions/\n  implications. Its 600-template deterministic corpus covers persistent\n  duplication/discard, linear pairing/exchange/modus ponens, and projection;\n  every packed schema has a universal theorem reconstructing a Lean proof\n  under every atom valuation. A separate unindexed checker infers exact\n  persistent/linear sequents, returns stable path-aware diagnostics, and has a\n  theorem that every erased indexed schema is accepted with its original\n  boundary. CI checks all 600 erased positives and 1,000 malformed templates\n  covering every error code. A strict `leanprop-schema-0.1` JSON contract,\n  native Lean parser, checker-gated entry point, checked fixtures, and separate\n  deterministic 5,000-case mutation-fuzz gate now cover untrusted strings. A\n  Lean-emitted 1,600-record stream has a CI-checked SHA-256 manifest. Every\n  accepted raw/wire schema is now elaborated into an indexed derivation, and\n  the checked API exposes universal Lean proof reconstruction;\n\nThe universal v0.4 theorem still returns\n`Nonempty (SequentializationResult input)` in `Prop`. The new runtime API does\nnot extract that witness by choice: it performs finite inverse-rule and\noccurrence-permutation search, permits semantically irrelevant link-list\npermutation, and rechecks its output. Its separate totality theorem is proved\nby the terminal-rule dichotomy, checker-gated candidate totality, complete\nfinite boundary alignment, and well-founded fuel induction. The path-based\ndownstream consumer executes the API and consumes that theorem, and CI\nseparately audits 188 public MLL logical-boundary theorems against the exact\naxiom set `[propext, Classical.choice, Quot.sound]`, plus 23 axiom-free,\n77 `propext`-only, and 68 `propext`/`Quot.sound` boundaries. LeanProp\nboundaries are audited separately: the proof-term interpreter,\nproposition-level permutation completeness, and the two\nexchange-admissibility theorems are axiom-free.\nResource-count, dependent-environment round trips, packed-schema soundness,\npermutation elaboration, checked-wire soundness, and six structural-\nnormalization theorems use exactly `propext`. Exact agreement between\nformula-only inference and typed elaboration, its acceptance-lifting\ncorollary, checked-wire inference, and the normalizer size bound use exactly\n`[propext, Quot.sound]`.\nThe two public graph-acyclicity transport theorems and the two new exact\nfirst-frontier/prefix-path theorems are independently locked to exactly\n`[propext, Quot.sound]` and do not add `Classical.choice`.\n\nThis remains a research prototype rather than a mature general-purpose\nlibrary. The supported unit-free, cut-free MLL reverse-sequentialization\ntheorem is now complete, but its certificate model does not include cut\nelimination, units, exponentials, additives, or quantifiers. The experimental\nLeanProp layer has quantifier proof-template nodes but no claim of proof-net\nsemantics; its wire layer intentionally covers only named atoms, ordinary\nconjunction, and implication, not typed equality/quantifier terms or broad\nmathlib expressions. The\nrepository also lacks canonicalization modulo reordered conclusions or\narbitrary graph isomorphism, long-term cross-version API stability beyond the\ndocumented compatibility contracts, optimized checking and sequentialization,\nand a Lean tactic. The API,\ndiagnostics, compatibility, performance, independent downstream, and\nlarge empirical readiness criteria are tracked separately and are not implied\nby the theorem.\n\n## Trust path\n\n```text\nuntrusted derivation tree or certificate\n        |\n        v\nvalidated desequentialization (when starting from a derivation)\n        |\n        v\nstructural well-formedness + every switching is a tree\n        |\n        v\nLean theorem: accepted -> declarative correctness\n        |\n        v\nkernel `Derivation` with the exact ordered input sequent\n        |\n        v\nLean kernel\n```\n\nThe external AI, JSON input, and future graph proposer are untrusted. Use\n`Certificate.checkedFromString` to parse and validate an external canonical\nv0.2 or reindex-normalized v0.3 certificate before exposing it to trusted code.\nSee [docs/trust-model.md](docs/trust-model.md) for the exact boundary.\n\nThe separate LeanProp wire API does not expose accepted JSON as mere syntax:\n`LeanProp.Schema.Raw.Derivation.checkedFromString` returns an indexed\nderivation, `CheckedDerivation.inferred` recovers the exact checked sequent,\nand `CheckedDerivation.sound` reconstructs its Lean proposition under every\natom valuation and matching persistent/linear proof environment.\n\n```lean\nmatch Certificate.checkedFromString input with\n| .ok checked => -- checked.accepted : checked.certificate.check = true\n    useCertificate checked.certificate\n| .error error =>\n    report error.path error.message\n```\n\n## Build\n\nPrerequisites: Git and [Elan](https://github.com/leanprover/elan). The pinned\nLean version is recorded in `lean-toolchain`.\n\n```powershell\nlake build\nlake exe proofnet_ir_tests\nlake exe proofnet_ir_consumer_index_tests\nlake exe proofnet_ir_figure7_primitives_tests\npython scripts/generate_dataset.py --check\npython scripts/audit_v03_canonical.py\nlake exe proofnet_ir_api_docs --check\npython scripts/fuzz_malformed_parser.py\nlake exe proofnet_ir_benchmark\nlake exe proofnet_ir_reconstruction_audit\nlake exe proofnet_ir_reconstruction_stress\npython scripts/focused_search.py examples/focused-sequent-v0.2.json --require-found\npython scripts/run_matched_experiment.py --check-committed\npython scripts/validate_model_publication_redaction.py\npython scripts/test_model_publication_redaction.py\npython scripts/run_model_experiment.py --check-preregistered\npython scripts/run_model_experiment_amended.py --check-amendment\npython scripts/run_model_experiment_amended.py --check-committed\n```\n\nOn Windows systems that explicitly block a generated audit executable with\napplication-control error 4551, the opt-in\n`python scripts/audit_v010_windows.py` wrapper runs the same two Lean audit\nsources through `lake env lean --run`. The byte-frozen\n`scripts/audit_v010.py` remains unchanged for preregistration verification,\nand every non-4551 failure still fails closed.\n\nExpected smoke-test output:\n\n```text\nProofNetIR: all certificate and v0.3 fixture checks passed\n```\n\n## Repository map\n\n```text\nProofNetIR/Formula.lean       MLL formulas and linear negation\nProofNetIR/Certificate.lean   occurrences, links, and structural validation\nProofNetIR/Reindex.lean       lossless bounded vertex renaming and transport\nProofNetIR/Graph.lean         finite graph closure and declarative tree property\nProofNetIR/Checker.lean       switchings, executable checker, soundness/completeness\nProofNetIR/Reconstruct.lean   supported sequent derivation reconstruction\nProofNetIR/Generate.lean      recursive derivation-first identity certificates\nProofNetIR/Mutation.lean      labeled corruptions for negative fixtures\nProofNetIR/DerivationTree.lean arbitrary cut-free trees and desequentialization\nProofNetIR/GraphComposition.lean tree-preserving par/tensor graph composition\nProofNetIR/SwitchingComposition.lean switching correctness under rule composition\nProofNetIR/StructuralComposition.lean structural correctness under rule composition\nProofNetIR/DesequentializationSoundness.lean derivation-to-certificate invariants\nProofNetIR/NetEquivalence.lean semantic equivalence and checker invariance\nProofNetIR/Sequentialization.lean general theorem contract and inverse-rule work\nProofNetIR/LocalIdentity.lean proved local invariants for exact identity pruning\nProofNetIR/ExecutableSequentialization.lean runtime inverse search and diagnostics\nProofNetIR/ProofNetIdentity.lean checked exact pairwise proof-net identity API\nProofNetIR/StructuralCode.lean injective exact-key structural token encoding\nProofNetIR/CanonicalKeyWire.lean bounded exact-key wire and safe matching\nProofNetIR/IntrinsicCanonical.lean non-factorial exact canonical representative\nProofNetIR/IntrinsicCanonicalKeyWire.lean v0.2 intrinsic-key wire and migration\nProofNetIR/Serialization.lean v0.2 fixed-number and v0.3 reindex wire formats\nProofNetIR/Parser.lean        v0.2/v0.3 parser, migration, checked-input boundary\nProofNetIR/Unification.lean   eager/worklist Figure-5 token semantics\nProofNetIR/SequentialUnification.lean bounded/tagged NEXTAXIOM and local totality\nProofNetIR/SequentialRoute.lean exact oriented successful NEXTAXIOM routes\nProofNetIR/SequentialConsumerIndex.lean shared sound/complete consumer lookup\nProofNetIR/SequentialSchedulerState.lean delayed raw-age sigma/ready/waiting state\nProofNetIR/SequentialSchedulerBridge.lean typed initial/later reservation bridge\nProofNetIR/SequentialFigure7New.lean invariant-bound operational Figure-7 new rule\nProofNetIR/SequentialFigure7History.lean proof-relevant empty/init/new history\nProofNetIR/SequentialFigure7Rules.lean generic consumer view and local concl/nop\nProofNetIR/SequentialSchedulerInvariant.lean state-only Figure-7 invariant\nProofNetIR/SequentialComponentProvenance.lean exact proof-only component identity\nProofNetIR/LeanPropNormalization.lean typed persistent structural normal form\nProofNetIRTests.lean          positive/negative compile-time and smoke fixtures\nProofNetIRConsumerIndexTests.lean orientation and fail-closed consumer tests\nProofNetIRFigure7PrimitivesTests.lean pop/raw-mark regression tests\nProofNetIRDataset.lean        deterministic 1,000-record dataset emitter\nProofNetIRParserFuzz.lean     stdin driver for native malformed-input fuzzing\nProofNetIRBenchmark.lean      checked depth-2/3/4 runtime regression budget\nProofNetIRAPIDocs.lean        generated public API manifest and reference\nProofNetIRExperimentCorpus.lean deterministic matched-task corpus emitter\nProofNetIRModelExperimentCorpus.lean held-out model-task base emitter\nProofNetIRExperimentVerify.lean Lean checker/sequentializer batch boundary\nconsumer-smoke/               independent downstream Lake dependency test\nconsumer-release-smoke/       clean consumer pinned to public v0.5.0 tag\nconsumer-v06-candidate-smoke/  clean consumer pinned to public v0.6.0 tag\nconsumer-v07-candidate-smoke/  clean consumer pinned to public v0.7.0 tag\nconsumer-v08-candidate-smoke/  clean consumer pinned to public v0.8.0 tag\nconsumer-v09-candidate-smoke/  clean consumer pinned to public v0.9.0 tag\nschemas/                      versioned external certificate contract\nexamples/                     valid and invalid JSON certificates\ndatasets/v0.2/                committed checker-labeled corpus and manifest\ndatasets/leanprop-v0.1/       Lean-emitted schema corpus manifest\nscripts/focused_search.py     focused cut-free comparison baseline\nscripts/run_matched_experiment.py matched generation/repair experiment runner\nscripts/run_model_experiment.py preregistered held-out model experiment runner\nscripts/run_model_experiment_amended.py hard-timeout protocol amendment runner\nscripts/validate_model_publication_redaction.py metadata-redaction history audit\nscripts/test_model_publication_redaction.py redaction mutation regression\nscripts/audit_v03_canonical.py independent 1,000-record reindex-key audit\nscripts/fuzz_malformed_parser.py deterministic 5,000-case parser fuzz gate\ndocs/                         architecture, literature map, roadmap, trust boundary\n```\n\n## Scientific status\n\nThe first deterministic matched experiment is complete: under a fixed\n1,000-unit per-method budget on 1,000 positive derivation-generated MLL tasks,\nfocused search solved 760, while formula-skeleton proof-net generation and\none-edit repair solved all 1,000. Lean rejected every distinct mutation and\naccepted plus executably sequentialized every distinct claimed certificate.\nThe [full report](experiments/matched-v0.1/README.md) explains why this does not\nshow that proof graphs generally outperform focused search or tactic\ngeneration: most atom labels are unique, the graph method receives the full\nformula skeleton, repair starts one edit from a valid net, and no learned model\nor ordinary Lean goal is involved.\n\nA second 180-task study is now preregistered across depths 2--4, repeated-label\nand unique-label strata, balanced positive/negative tasks, and reference repair\ndistances two/three. All 360 model calls are frozen, but the original runner's\nsoft-only wall-clock budget prevented scoring from completing in 120 minutes.\nA public amendment preserves the byte-exact original runner in Git and every\nresponse while adding process-level hard deadlines. A later transparent\npublication-only amendment replaces the machine-local GGUF path with a stable\nmodel alias; it retains every historical request hash and adds independently\nrecomputable canonical request hashes. Its history audit fixes the source\ncorpus, rejects duplicate JSON keys, and mutation-tests both semantic drift and\ncross-platform absolute-path encodings. Final results are now committed:\nfocused search 85/180, net generation 160/180, constructed distance-ordered\nrepair 180/180, model direct 117/180, and model repair 2/180. Model direct was\nonly 27/90 on positives despite 90/90 on deliberately atom-imbalanced\nnegatives. See the [final report](experiments/model-v0.2/report.md) and\n[redaction receipt](experiments/model-v0.2/publication-redaction-amendment-1.json)\nfor the exact evidence and limitations.\n\nThe broader plan is in [docs/roadmap.md](docs/roadmap.md). Source screening and\nproject rationale are recorded in [docs/literature-map.md](docs/literature-map.md).\nThe current representative workload and its explicit scalability limitation\nare recorded in [docs/performance.md](docs/performance.md). The auditable\nsource-coverage record is in\n[docs/reading-ledger.md](docs/reading-ledger.md), and the first matched\nevaluation is specified in\n[docs/experiment-protocol.md](docs/experiment-protocol.md).\nThe stricter post-v0.2 coverage and reuse assessments are in\n[docs/source-coverage-audit.md](docs/source-coverage-audit.md) and\n[docs/library-readiness-audit.md](docs/library-readiness-audit.md). The\nscoped v0.6 claims and release evidence are in\n[docs/v0.6-release-audit.md](docs/v0.6-release-audit.md), and the exact-key\nv0.7 release evidence is in\n[docs/v0.7-release-audit.md](docs/v0.7-release-audit.md), and the v0.8\nintrinsic-key release evidence is in\n[docs/v0.8-release-audit.md](docs/v0.8-release-audit.md). The\nv0.9 graph-semantics, reconstruction, unification, and release evidence is in\n[docs/v0.9-release-audit.md](docs/v0.9-release-audit.md). The\nexternal-consumer walkthrough is in [docs/tutorial.md](docs/tutorial.md), and\nthe kernel-environment-generated declaration surface is in\n[docs/api-reference.md](docs/api-reference.md). The\nrepresentation comparison that guides general sequentialization is in\n[docs/formalization-comparison.md](docs/formalization-comparison.md). Completed\npage-level source audits, including Pfenning's 168 unique pages, Manin's 389\nphysical pages, Marcolli et al.'s 75 pages, the 33-page *Geometry of\nNeuroscience* audit, and Park's 76 pages, live under\n[docs/source-pages/](docs/source-pages/geometry-of-neuroscience.md).\nWire-version stability and migration rules are in\n[docs/compatibility.md](docs/compatibility.md), and the exact v0.3 guarantees\nare in [docs/v0.3-design.md](docs/v0.3-design.md).\n\n## License\n\nMIT. See [LICENSE](LICENSE).\n",1785606384186]