release-plan.json

{
  "run": "1.6",
  "carriesTo": "1.7.0",
  "note": "The nine patches of the 1.4 run, planned before the first is cut. Patch digits ascend 1..9 because semver ordering requires it; their POSITION in the vortex is what assigns the work. The axis {3,6,9} is structural — build the axis before the branches — and the gateways [8,3,9,0] are where the stroke reverses polarity, so they are where the KIND of work changes rather than its amount. Targets are ratchet ceilings, so a release that misses its target fails its own gate.",
  "supersedes": "release-plan.1.4.json — the 1.4 run, all nine targets met at the 1.5.0 carry-out",
  "measuredBefore": {
    "lean_theorems": 24,
    "lean_sorry_free": 5,
    "lean_with_sorry": 19,
    "lean_checked_by_anything": 0,
    "note": "Measured on 2026-09-04, before any of this run was planned. lean/Quantum.ts holds 14 theorems and lean/QuantumAlgorithms.lean 10. Nineteen carry `sorry`. NOTHING IN THE GATE BUILDS OR CHECKS ANY OF IT. lakefile.lean pins Lean v4.8.0 and mathlib v4.8.0, the installed toolchain is 4.33.1, and there is no lean-toolchain file, so the project as committed cannot build on this machine at all. Quantum.lean's header says 'All theorems are formally proven, not assumed' in a file containing nineteen sorries -- and prose:check never saw it, because that scanner reads .md and this is .lean."
  },
  "feasibility": {
    "probe": "A mathlib-free decidable core was written and checked before the plan was, because the plan's central assumption was that this is possible at all.",
    "result": "Nine theorems about the digit space -- digital-root idempotence, invariance under adding nine, the doubling step staying in the orbit, the orbit closing after six and never repeating a step, the through-void involution and its two fixed points, and the orbit/axis/void partition -- check in 0.45 SECONDS with plain `lean`, no lake, no mathlib and no cache.",
    "cost_of_the_alternative": "`import Mathlib` in Quantum.lean means the existing files need the whole library. That is a large download and a long build, and it is the reason the decidable core is split out rather than the existing files being repaired first.",
    "what_decide_did_to_the_author": "It refuted three statements while the probe was being written. The through-void involution as first written was false. `dr n = dr (n + 9)` is false at n = 0 because subtraction truncates in the naturals, so dr 0 is 1 there. And that exposed a third fact nobody had written down: digitalRoot(0) is 9 in the TypeScript, 1 in the naturals, and undefined in the paper's equation (1), which guards itself with n >= 1. Three representations, three values at zero."
  },
  "patches": {
    "1": {
      "set": "orbit",
      "gateway": false,
      "surface": "leanUnchecked",
      "from": 24,
      "to": 24,
      "why": "A toolchain that runs, and a checker that says what it checked. lean-toolchain pinned to the installed version, a lake target that builds, and lean:check -- which compiles every .lean file and reports, per theorem, whether the kernel accepted it sorry-free. The count does not move: this patch makes the number MEASURABLE, and a surface nothing measures is a surface nobody can be held to. Modelled on uuidna's axiom witness, where the audit must cover every theorem in the ledger and a new unaudited one trips it."
    },
    "2": {
      "set": "orbit",
      "gateway": false,
      "surface": "leanUnchecked",
      "from": 24,
      "to": 24,
      "why": "The decidable core, which the feasibility probe already proved takes half a second: the digit space. Digital root, the doubling step, the orbit closing after six, the through-void involution, the orbit/axis/void partition. These are statements about ten digits, so `decide` settles them exhaustively and no mathlib is required. Nine theorems, and the header of Quantum.lean stops being false because the file it describes stops containing what it denies.",
      "amended": "Target was 24 -> 15. Corrected to 24 -> 24 on 2026-09-04, after the work landed. The premise was an arithmetic error, not a missed target: the decidable digit space is NEW material, so proving it ADDS proven theorems and converts none of the 24. It did exactly what the patch described — DigitSpace.lean now holds 19 kernel-proven theorems, up from 9 — and leanUnchecked did not move, because every one of the 24 lives in Quantum.lean or QuantumAlgorithms.lean and both import Mathlib. A surface counting what is UNCHECKED cannot be reduced by checking something that was never in it. The nine this patch claimed are re-assigned to patch 9."
    },
    "3": {
      "set": "axis",
      "gateway": true,
      "surface": "leanUnchecked",
      "from": 24,
      "to": 24,
      "why": "THE FIRST GATEWAY: polarity reverses and the work stops being proof and becomes accounting. LEAN_PROOFS in TypeScript holds twelve theorem statements AS STRINGS, and nothing compares them to the .lean files that are supposed to contain them. That is a second copy of source, which is the defect 1.4.6 spent a release recording under the name collisions. One of the two must be generated from the other, and the checker must fail when they disagree. The count does not move because this patch moves no proof; it makes the ledger and the files the same thing."
    },
    "4": {
      "set": "orbit",
      "gateway": false,
      "surface": "leanUnchecked",
      "from": 24,
      "to": 18,
      "why": "The gate algebra: Hadamard squared, the Pauli anticommutation, Pauli unitarity, and the Born-rule sum over a finite basis. All four are finite checks over 2x2 or 4x4 complex matrices with entries from a small set, so they are decidable without the analysis mathlib is needed for. Five of the twenty-four are already sorry-free and must be shown to COMPILE, which is a different claim from containing no sorry."
    },
    "5": {
      "set": "orbit",
      "gateway": false,
      "surface": "leanUnchecked",
      "from": 18,
      "to": 18,
      "why": "The mirror's fixed point, and the patch that must not move the number. Every theorem checked so far is verified AXIOM-FREE: `#print axioms` over each one, with the result committed as lean/axioms.json so an outsider can verify the receipt without a Lean toolchain -- derivation needs the toolchain, verification needs only the file. uuidna's arrangement exactly, and the reason its witness can say the trust base is the kernel alone.",
      "amended": "The patch says every theorem checked so far is verified AXIOM-FREE. Measured on 2026-09-04, that is false as a blanket claim: of the 19 proven, 13 rest on no axioms, 4 on [propext, Quot.sound] and 2 on [propext], all through list-membership decidability. None touch Classical.choice or sorryAx. So the condition landed as a DECLARED ALLOWED SET rather than as axiom-freeness: lean:check now requires each proven theorem's #print axioms to be within {propext, Quot.sound}, records the dependency set as evidence, and gives anything outside it the status rests-on-more. The target is unchanged; what it enforces is stated correctly."
    },
    "6": {
      "set": "axis",
      "gateway": false,
      "surface": "leanUnchecked",
      "from": 18,
      "to": 18,
      "why": "LaTeX. The paper is MathML for the browser; a submission wants .tex. Same generator, second backend, same figures read from the code at generation time, and paper:tex:check failing on a byte of drift the way paper:check already does. The Lean status appears in it as a column rather than a sentence: which theorems the kernel accepted, which carry sorry, and which are axioms. Nothing here proves a theorem, so the count stands still."
    },
    "7": {
      "set": "orbit",
      "gateway": false,
      "surface": "leanUnchecked",
      "from": 18,
      "to": 13,
      "why": "What is left that a finite check can reach: the repetition code detecting a single error, and the tensor product preserving normalisation for the small cases the simulator actually runs. Both are quantified over finite domains once the dimensions are fixed, and fixing the dimension honestly is the work -- a theorem about all n is not what `decide` gives."
    },
    "8": {
      "set": "orbit",
      "gateway": true,
      "surface": "leanUnchecked",
      "from": 13,
      "to": 13,
      "why": "THE SECOND GATEWAY, and the honest one. What remains -- Grover's amplification, Shor's period finding, QFT unitarity, the surface-code threshold -- is not a patch. They need real analysis and mathlib, and claiming otherwise is how nineteen sorries came to sit under a header saying all theorems are proven. Each is moved OUT of the proven set and into a stated conjecture with what would settle it, the way ASSUMPTIONS already records what no finite computation decides. The count does not fall, because moving a claim is not proving it, and this plan will not let it look like one."
    },
    "9": {
      "set": "axis",
      "gateway": true,
      "surface": "leanUnchecked",
      "from": 13,
      "to": 0,
      "why": "The last patch and the third gateway. Every remaining theorem is either checked or recorded as a conjecture with its refuter, so leanUnchecked reaches zero by the same rule 1.4.9 used for claims: bound to a proof, or named as an assumption -- never left implied. Then 1.7.0 carries the run out and every patch must still stand.",
      "amended": "Was 4 -> 0; now 13 -> 0, absorbing the nine that patch 2 could not convert. This patch already says every remaining theorem is either checked or recorded as a conjecture with its refuter, so the larger remainder does not change what it must do — only how much of it there is."
    }
  },
  "sources": {
    "leanUnchecked": {
      "from": "command",
      "command": "npm run lean:check",
      "pattern": "([0-9]+) unchecked",
      "note": "not a ratchet surface: the ratchet carries twelve and that number is load-bearing. The command exists as of 2026-09-04 and the surface reads 24 — unchanged since it was first measured, because everything proved since was added rather than converted. All 24 are in Mathlib-importing files, which is the whole difficulty of the run and is why patch 8 is the honest gateway."
    }
  },
  "refused": "Proving a theorem by weakening it until `decide` closes it. Deleting a sorry by deleting the theorem. And writing `axiom` where a proof was promised, without recording it as an axiom in the place ASSUMPTIONS already keeps them -- the difference between an assumption and a hidden one is whether anybody can find it.",
  "landedBeforeTheRunWasCut": {
    "when": "2026-09-04, during the 1.5 line",
    "patches": [
      "1",
      "2",
      "5",
      "6"
    ],
    "what": "lean:check and the ledger (1); DigitSpace.lean's decidable core, now 19 proven theorems (2); the axiom-dependency condition, as an allowed set rather than axiom-freeness (5); LaTeX beside MathML, and every Lean statement rendered in both (6).",
    "why_it_is_recorded": "A plan whose patches have already happened reads as a forecast that came true. It is not: the work was done first and the plan is being reconciled to it. Patches 1, 5 and 6 hit their targets. Patch 2 did its described work and its target was arithmetically impossible, which is a different thing and is amended as such."
  }
}