Prove the paper's counts, levelization, depth bounds, recipe lengths and Section 6 in Rocq, and revise the paper

.gitignore

@@ -15,6 +15,7 @@ rocq/*.vos
 rocq/*.glob
 rocq/.*.aux
 rocq/.lia.cache
+rocq/.nra.cache
 rocq/extract/physnet.ml
 rocq/extract/physnet.mli
 rocq/extract/hostnet.ml

README.md

@@ -597,9 +597,12 @@ and that a fixed ternary network, the ring machine of `src/twohead.py`, holds
 stored networks in its state, a ring of K banks of records and K tapes with
 heads at absolute positions, and evaluates one record per step, which `rocq/`
 proves for every window of 2^α cells, number of banks, bank and tape. `rocq/`
-also proves that the host family computes SUBLEQ at every word width, that the
-21- and 27-instruction programs do what the paper states at every word width from
-8 on, and that the H_8 it defines is the netlist of the published serialization.
+also proves that the host family computes SUBLEQ at every word width, with its
+depth and its numbers of units and edges, that the levelization of every clocked
+netlist computes its step, that a read and the branch need two ternary levels, that
+the recipes and their encoder have the stated lengths, that the 21- and
+27-instruction programs do what the paper states at every word width from 8 on, and
+that the H_8 it defines is the netlist of the published serialization.
 The host itself, compiled into 36,080 records of two inputs with records that
 load its memory, its tape device and a hand-over, and stored in the member with
 32,768 window cells, runs the 27-instruction program on a recipe for its own
@@ -607,8 +610,7 @@ records: it writes them into the next bank, copies the recipe onto the next tape
 and hands control to the copy, so that it reproduces itself, weights included, by
 the dynamics alone, and the copies accumulate until every bank holds one;
 `src/ring_run.c` runs six generations of 95,762,842,100 steps each in a ring of
-three banks. The fixed network's own weights are the transition rule and are not
-reproduced. `rocq/` defines the stored host for every word width from 8 on, the
+three banks. `rocq/` defines the stored host for every word width from 8 on, the
 records `src/twohead.py` writes among them, and proves its universal
 construction, its reproduction in every ring, the accumulation of the copies and
 the period of the state, in the machine and in the network. An organism of 143
@@ -624,6 +626,9 @@ probability of second order that the paper bounds, and completes the
 self-reproducing run under read noise at levels where the host fails within its
 first bytes. Under von Neumann's model of independent output flips the same
 redundancy works only below a threshold inversely proportional to the fan-in.
+`rocq/` proves the margin, the noise bounds, the amplification, the threshold and
+the restoration bound, on a probability space with Gaussian perturbations, and
+evaluates the numbers the paper derives from them.
 
 Every figure of the paper comes from `src/paper.py`, `src/host.py`, `src/twohead.py` and
 `src/noise.py`, with the C programs beside them, and their records are in `paper/runs/`;
@@ -1019,13 +1024,15 @@ src/                                the library; `python src/<file>.py <command>
   └── nsim.c                        the noise simulator of independent.py
 paper/                              the manuscript, and the record of every run it reports
 rocq/                               Rocq proofs: the host family H_A computes SUBLEQ for every word
-                                    width, P and P* do what the paper states at every width from 8,
-                                    the netlist of the ring machine computes its step for every
-                                    window, ring, bank and tape, the host stored as records builds
-                                    every image that fits a bank and reproduces in every ring at
-                                    every width from 8, and the organism builds every image that
-                                    fits a bank from any description of it and reproduces in every
-                                    ring, the state periodic once every bank holds a copy
+                                    width, with its depth and sizes, levelization and the depth
+                                    lower bounds, the recipe lengths, P and P* do what the paper
+                                    states at every width from 8, the netlist of the ring machine
+                                    computes its step for every window, ring, bank and tape, the
+                                    host stored as records builds every image that fits a bank and
+                                    reproduces in every ring at every width from 8, the organism
+                                    builds every image that fits a bank from any description of it
+                                    and reproduces in every ring, the state periodic once every
+                                    bank holds a copy, and the margin and noise bounds of Section 6
 tools/play.py                       the playground, and a demonstration on each machine
 llm_integration/
   ├── llm.py                        SmolLM2 with the frozen circuits: the circuit wrapper, the

paper/README.md

@@ -12,7 +12,8 @@ runs/                                 the record written by each command
 ## What each command establishes
 
 Each command is `python src/<file>.py <command>` and writes its record to `runs/`;
-`paper.py rocq` needs Rocq 9.1 and ocamlfind on the PATH.
+`paper.py rocq` needs Rocq 9.1 with the opam packages `coq-coquelicot` and
+`coq-interval`, and ocamlfind, on the PATH.
 
 | Command | Record | Establishes |
 |---|---|---|
@@ -42,7 +43,7 @@ Each command is `python src/<file>.py <command>` and writes its record to `runs/
 | `twohead.py stored` | `paper_stored_host.json` | the host compiled into records of the ring machine: one pass against the host's step and its device on random states (`stored check`), the startup, step, device and hand-over records on decision diagrams (`stored symbolic`), and six generations in C in a ring of three banks (`stored run 6`); `--width A` checks H_A in place of H_8, and `stored widths` tabulates A = 8 to 12 |
 | `noise.py host` | `paper_noise_*.json` | the margin, the profile bound in sum and product form, read noise, the deviation curve, the exact Poisson intervals of the measured rates (`host intervals`), weight error with leakage, the active-input counts of the orbit certificate |
 | `noise.py amplified` | `paper_redundant_*.json` | the amplified host N_3: one step on replicated states, the margin 3/2, exact self-reproduction in C, the run under noise, the deviation curve and its bound by layer, the failure rate of the state read by majority and the restoration bound, computed by `src/restore_bound.c` |
-| `independent.py` | `independent_*.json` | code written from the paper's definitions alone: H_A rebuilt from Construction 3.8 for A = 3 to 12, Lev(N_host) from sigma and the measurements of Section 6.1 and Appendix A with the noise simulator `src/nsim.c` |
+| `independent.py` | `independent_*.json` | code written from the paper's definitions alone: H_A rebuilt from Construction 3.7 for A = 3 to 12, Lev(N_host) from sigma and the measurements of Section 6.1 and Appendix A with the noise simulator `src/nsim.c` |
 
 Rebuild the typeset paper with any TeX installation:
 

paper/runs/paper_rocq.json

@@ -1,7 +1,7 @@
 {
  "rocq": "The Rocq Prover, version 9.1.1",
- "files": 44,
- "build_seconds": 198.9,
+ "files": 63,
+ "build_seconds": 96.0,
  "theorems": {
   "PhysSem.netlist_step": "closed",
   "PhysMain.network_orbit": "closed",
@@ -39,10 +39,99 @@
   "StoredMain.network_reproduces": "closed",
   "StoredMain.network_periodic": "closed",
   "StoredWidth.width_exists": "closed",
-  "StoredWidth.recipe_of_image": "closed"
+  "StoredWidth.recipe_of_image": "closed",
+  "StoredProp.stored_pass": "closed",
+  "Recipe.desc_spec": "closed",
+  "Recipe.describe_spec": "closed",
+  "Recipe.recipes_complete": "closed",
+  "Recipe.recipe_optimal": "closed",
+  "Recipe.describe_steps": "closed",
+  "Recipe.psteps_lower": "closed",
+  "Lev.lev_ok": "closed",
+  "Lev.lev_units": "closed",
+  "Lev.lev_widths": "closed",
+  "Lev.lev_size": "closed",
+  "HostLev.host_dmax": "closed",
+  "HostLev.host_lev_widths": "closed",
+  "HostLev.host_lev_rows": "closed",
+  "HostLev.host_lev_widths_8": "closed",
+  "HostLev.host_lev_rows_8": "closed",
+  "HostLev.host_lev_dense_8": "closed",
+  "HostLev.host_lev_widest_8": "closed",
+  "HostCount.host_units_count": "closed",
+  "HostCount.host_memory_count": "closed",
+  "HostCount.host_edges": "closed",
+  "HostCount.host_weights_biases": "closed",
+  "HostCount.host_lev_identity": "closed",
+  "HostCount.host_units_8": "closed",
+  "HostCount.host_edges_8": "closed",
+  "HostCount.host_memory_8": "closed",
+  "HostCount.host_lev_identity_8": "closed",
+  "HostCount.host_lev_nonzero_8": "closed",
+  "StoredCount.stored_records": "closed",
+  "StoredCount.alpha_bounds": "closed",
+  "StoredCount.width_least": "closed",
+  "StoredCount.generation_bounds": "closed",
+  "PhysLev.phys_dmax": "closed",
+  "PhysLev.phys_lev_depth": "closed",
+  "PhysLev.phys_lev_rows": "closed",
+  "PhysLev.phys_edges": "closed",
+  "PhysLev.phys_lev_rows_15": "closed",
+  "PhysLev.phys_lev_rows_S": "closed",
+  "Lower.read_needs_two_levels": "reals",
+  "Lower.onehot_needs_two_levels": "reals",
+  "Lower.branch_not_ternary": "closed",
+  "Margin.margin": "reals",
+  "Margin.margin_tight": "reals",
+  "Margin.mismatch_all": "reals",
+  "Margin.mismatch_run": "reals",
+  "Margin.amap_rep": "closed",
+  "Margin.amp_wrong": "reals",
+  "Margin.amp_margin": "reals",
+  "Margin.flip_ok": "closed",
+  "Erfc.gauss_square": "reals",
+  "Erfc.erfc_le_exp": "reals",
+  "Erfc.erfc_upper1": "reals",
+  "Erfc.erfc_upper3": "reals",
+  "Erfc.erfc_lower1": "reals",
+  "Choose.binom_bound": "reals",
+  "Noise.union_bound": "reals",
+  "Noise.union_gauss": "reals",
+  "Noise.profile_step": "reals",
+  "Noise.profile_le": "reals",
+  "Noise.copy_bound": "reals",
+  "Noise.union_profile": "reals",
+  "Noise.amp_union": "reals",
+  "Noise.amp_gauss": "reals",
+  "Noise.amp_profile": "reals",
+  "Noise.amp_choose": "reals",
+  "Noise.amp_choose_exp": "reals",
+  "Noise.synapse_bound": "reals",
+  "Noise.flip_bound": "reals",
+  "Noise.flip_choose": "reals",
+  "NoiseNum.p_005": "reals, primitive numbers",
+  "NoiseNum.TMp_005": "reals, primitive numbers",
+  "NoiseNum.TMp_010": "reals, primitive numbers",
+  "NoiseNum.flip_threshold": "reals, primitive numbers",
+  "NoiseNum.synapse_005": "reals, primitive numbers",
+  "NoiseNum.synapse_010": "reals, primitive numbers",
+  "NoiseNum.N3_first_order": "reals, primitive numbers",
+  "NoiseNum.generation_1": "reals, primitive numbers",
+  "NoiseNum.generation_3": "reals, primitive numbers",
+  "NoiseNum.generation_5": "reals, primitive numbers",
+  "Restore.tw_paper": "closed",
+  "Restore.far_core": "reals",
+  "Restore.wrong_far": "reals",
+  "Restore.claims": "reals",
+  "Restore.claim_stop": "reals",
+  "Restore.restoration": "reals",
+  "FlipLower.P_few": "reals",
+  "FlipLower.flip_fails": "reals",
+  "AmpHost.amp_run": "closed",
+  "AmpHost.amp_selfrep": "closed"
  },
  "extraction_identical": true,
- "lines": 13795,
+ "lines": 23368,
  "host_extraction": {
   "members": [
    {
@@ -90,6 +179,14 @@
     "bytes": 563241,
     "identical": true,
     "sha256": "8fe4d6719955e5e4c776514f3910facf60d8d6357f677f9978682e4932b1fbf8"
+   },
+   {
+    "A": 10,
+    "w": 22,
+    "records": 178112,
+    "bytes": 1313576,
+    "identical": true,
+    "sha256": "222e17b6fab50dfe3c4b97274826bc740b799e35a3cdd8a1825f2d915ad8d3a5"
    }
   ],
   "identical": true

paper/universal_construction_ternary.pdf

@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:922ef023fe09cef59891dc62bd7eab1b68b15be41216f4425959ef241ec8b9ad
-size 355574
+oid sha256:260303cc3b22bb2884fc465dccbd20e41a0e15203e3a19cf7cf069ae7d56a821
+size 367476

paper/universal_construction_ternary.tex

@@ -79,9 +79,9 @@ and its netlist is proved in Rocq to compute this machine for every number and s
 of banks and tapes. Stored in the ring as $36{,}080$ records of two inputs, the
 SUBLEQ computer decodes a description of its own records into the next bank, copies
 the description onto the next tape and hands control to the copy. The fixed network
-thus rebuilds the stored computer, weights included, in every generation; its own
-weights are the transition rule and are not reproduced. For every word width from
-$8$ on and every ring it is proved in Rocq that the stored computer builds every
+thus rebuilds the stored computer, weights included, in every generation. For every
+word width from $8$ on and every ring it is proved in Rocq that the stored computer
+builds every
 image that fits a bank from a description of it, and that, started on its own, it
 reproduces: the copies accumulate until every bank holds one, and from then on the
 whole state repeats every $K$ generations. A constructor of $143$ records with a
@@ -94,7 +94,9 @@ Replicating every unit $r$ times multiplies every margin by $r$: under noise on
 pre-activations, which does not grow with fan-in, every noise level is survived
 with $r=O(s\sqrt{\log(TM/\delta)})$. Under von Neumann's independent output flips a
 threshold appears: the same redundancy is reliable for flip probabilities below
-$1/(2ek)$, $k$ the largest fan-in, and not, for the host, above $1/(2k)$.
+$1/(2ek)$, $k$ the largest fan-in, and above $1/(2k)$ a disjunction of fan-in $k$
+fails with a probability that tends to one as $r$ grows. The margin, the noise bounds
+and the threshold are proved in Rocq.
 \end{abstract}
 
 \maketitle
@@ -144,21 +146,24 @@ perturbation of a pre-activation below one half.
 
 \subsection{Contributions}
 
+The contributions are the following, each listed with its evidence in
+Table~\ref{tab:claims}.
 \begin{enumerate}[label=(\arabic*),leftmargin=2em]
 \item \emph{Host.} A ternary threshold network executing SUBLEQ, a computer with a
 single instruction~\cite{MavaddatParhami1988}, with memory-mapped tape and output
 devices. It is the member with eight-bit words of a family $H_A$ whose step has
 depth $13$ at every word width, $17{,}598$ units for $A=8$
 (Proposition~\ref{prop:host}); that the step of $H_A$ is the step of SUBLEQ from
-every state is proved in Rocq for every $A$. A read from memory and the branch
-predicate each need two levels of ternary units (Lemma~\ref{lem:muxdepth},
+every state, its depth and its numbers of units and edges are proved in Rocq for
+every $A$. A read from memory and the branch predicate each need two levels of
+ternary units, also proved in Rocq (Lemma~\ref{lem:muxdepth},
 Remark~\ref{rem:ternarydepth}); folding the address decoders into the reads
 gives depth $11$ (Remark~\ref{rem:fold}).
 \item \emph{Universal construction.} A program of $21$ instructions that emits
 the byte string its tape describes, in a number of steps given in closed form,
 proved in Rocq for every word width $A\ge8$. Every string $f$ has a description of
 length at most $|f|+\lceil|f|/127\rceil+1$, and none shorter when $f$ has no two
-equal adjacent bytes (Section~\ref{sec:univ}).
+equal adjacent bytes, both proved in Rocq (Section~\ref{sec:univ}).
 \item \emph{Exact self-reproduction of the host.} A program of $27$
 instructions, separating construction from copying as von Neumann did, with which
 the host emits the serialization of itself, its memory and its tape, also proved in
@@ -186,6 +191,7 @@ pre-activation. Under independent Gaussian noise on the pre-activations, the
 probability that some unit fails in a step, computed from the pre-activation profile
 of the orbit, lies within the $95\%$ interval of the measured failure rate of the
 host at every noise level at which failures were observed (Section~\ref{sec:robust}).
+The margin and the bound are proved in Rocq.
 \item \emph{Fault tolerance.} Replacing every row by $r$ rows that read all
 copies of its inputs, Pierce's interwoven redundancy~\cite{Pierce1965} with
 threshold units, multiplies every margin by $r$. Under Gaussian noise of deviation
@@ -197,38 +203,39 @@ $O(s_{\mathrm w}^2K^\ast\log(TM/\delta))$, $K^\ast$ the largest number of active
 inputs of a unit (Theorem~\ref{thm:amplify},
 Corollary~\ref{cor:synapse}). Under von Neumann's model, in which every unit's
 output flips with probability $\varepsilon$, the same redundancy is reliable for
-$\varepsilon<1/(2ek^\ast)$, $k^\ast$ the largest fan-in, and a threshold of this
-order cannot be avoided (Proposition~\ref{prop:flip}). A second-order bound
-certifies the complete run of
-the threefold host where the first-order bound exceeds one
-(Proposition~\ref{prop:restore}).
+$\varepsilon<1/(2ek^\ast)$, $k^\ast$ the largest fan-in, and above $1/(2k^\ast)$ a
+disjunction of fan-in $k^\ast$ fails with a probability that tends to one as $r$
+grows (Proposition~\ref{prop:flip}). A second-order bound certifies the complete run
+of the threefold host where the first-order bound exceeds one
+(Proposition~\ref{prop:restore}). All of it is proved in Rocq.
 \end{enumerate}
 
-Table~\ref{tab:claims} lists each claim with the evidence for it.
-
 \begin{table}[ht]
 \centering\small
 \begin{tabularx}{\textwidth}{@{}>{\raggedright\arraybackslash}p{0.36\textwidth}>{\raggedright\arraybackslash}p{0.2\textwidth}>{\raggedright\arraybackslash}X@{}}
 \toprule
 Claim & Where & Evidence\\
 \midrule
+Levelization; the sizes of $\Lev(\Nhost)$ & Lem.~\ref{lem:lev}, Rem.~\ref{rem:levsizes} & Rocq\\
 The step of $H_A$ is the step of $\mathrm{SUBLEQ}_A$, every $A\ge3$ & Prop.~\ref{prop:host} & Rocq; the netlists extracted for $A=8,9,10$ equal the generator's\\
-Unit counts and depth $13$ of $H_A$ & Prop.~\ref{prop:host} & counting; rebuilt independently for $A=3$ to $12$\\
-A read and the branch need two ternary levels & Lem.~\ref{lem:muxdepth}, Rem.~\ref{rem:ternarydepth} & proof; exhaustive search on eight inputs\\
+Depth $13$, units, edges, weights and biases of $H_A$, every $A\ge3$ & Prop.~\ref{prop:host} & Rocq; rebuilt independently for $A=3$ to $12$\\
+A read and the branch need two ternary levels & Lem.~\ref{lem:muxdepth}, Rem.~\ref{rem:ternarydepth} & Rocq; exhaustive search on eight inputs\\
+Length and optimality of the recipes and of $\describe$ & Lems.~\ref{lem:complete}, \ref{lem:describe}, Prop.~\ref{prop:optimal} & Rocq; checked on $971$ MB and on $68{,}061$ boundary strings\\
 $P$ builds every string, in the stated steps, every $A\ge8$ & Thm.~\ref{thm:univ} & Rocq; $29$ recipes run on the reference and four on the netlist\\
-Length of $\describe$ & Lem.~\ref{lem:describe}, Prop.~\ref{prop:optimal} & proof; checked on $971$ MB and on $68{,}061$ boundary strings\\
 $P^\ast$ reproduces the host, in the stated steps, every $A\ge8$ & Thm.~\ref{thm:selfrep}, Prop.~\ref{prop:steps} & Rocq; three generations on three evaluators\\
-Margin $1/2$ and the profile bound & Thm.~\ref{thm:margin}, Prop.~\ref{prop:profile} & proof; measured rates of Table~\ref{tab:curve}\\
-Amplification under the three noise models & Thm.~\ref{thm:amplify}, Cor.~\ref{cor:synapse}, Prop.~\ref{prop:flip} & proof\\
-Restoration bound for $N_3$ & Prop.~\ref{prop:restore} & proof; measured rates of Table~\ref{tab:bound3}\\
-The netlist computes the ring machine; its size and weights & Thm.~\ref{thm:physnet} & Rocq; extraction equal to the generator's; random states\\
+Margin $1/2$, weight errors and the profile bound & Thm.~\ref{thm:margin}, Props.~\ref{prop:mismatch}--\ref{prop:profile} & Rocq; measured rates of Table~\ref{tab:curve}\\
+Amplification under the three noise models, and the threshold & Thm.~\ref{thm:amplify}, Cor.~\ref{cor:synapse}, Prop.~\ref{prop:flip} & Rocq\\
+Exact self-reproduction of the amplified host, every odd $r$ & Cor.~\ref{cor:amplifiedselfrep} & Rocq; $\Omega^\ast_3$ run on the evaluator in C\\
+Restoration bound for $N_3$ & Prop.~\ref{prop:restore} & Rocq; its values computed along the run; measured rates of Table~\ref{tab:bound3}\\
+The netlist computes the ring machine; its size, weights and depth & Thm.~\ref{thm:physnet} & Rocq; extraction equal to the generator's; random states\\
 A pass of the stored host, every $A\ge8$ & Prop.~\ref{prop:storedpass} & Rocq, block by block; decision diagrams of all four blocks and random states, $A=8,9,10$\\
-Construction and reproduction by the stored host: copies, period, network, every $A\ge8$ & Thms.~\ref{thm:storedconstruct}--\ref{thm:widths} & Rocq, the counts of Thm.~\ref{thm:widths} by counting; the extracted image equal to the generator's for $A=8,9$; six generations of $\mathcal S_8$ run\\
+Construction and reproduction by the stored host: copies, period, network, counts, every $A\ge8$ & Thms.~\ref{thm:storedconstruct}--\ref{thm:widths} & Rocq; the extracted image equal to the generator's for $A=8,9$; six generations of $\mathcal S_8$ run\\
+The stored host under noise & Cor.~\ref{cor:storednoise} & Rocq\\
 The organism: code, pass, construction, copies, period, network & Lem.~\ref{lem:code}, Prop.~\ref{prop:pass}, Thms.~\ref{thm:construct}, \ref{thm:organism} & Rocq; six generations run, one on the netlist\\
 \bottomrule
 \end{tabularx}
-\caption{The claims of the paper and the evidence for each: a proof checked in Rocq,
-a proof on paper, a computation recorded in the artifact.}
+\caption{The claims of the paper and the evidence for each: the proof checked in Rocq,
+and the computations and runs recorded in the artifact.}
 \label{tab:claims}
 \end{table}
 
@@ -324,7 +331,9 @@ $\depth(v)-1$, since $\depth(u)\le\depth(v)-1<\lambda(u)$. Layer $d$ holds one r
 for each state coordinate, in order: the unit assigned to it if that unit has depth
 $d$, and otherwise the copy of the assigned signal. Since $\Hv(x-1)=x$ on $\B$,
 induction on $\ell$ shows that each row of layer $\ell$ outputs the value of its
-signal of $N$.
+signal of $N$. The lemma is proved in Rocq for every clocked netlist whose units
+read earlier signals with weights $\pm1$, together with the number of rows each
+unit occupies.
 \end{proof}
 
 \begin{remark}\label{rem:levsizes}
@@ -332,7 +341,9 @@ The host $\Nhost$ of Section~\ref{sec:host} has $17{,}598$ units of maximal dept
 $13$, all contributing to a next-state value, and distinct signals for distinct
 state bits; $\Lev(\Nhost)$ adds $24{,}369$ identity units, $M=41{,}967$ rows on
 $n=2057$ state bits, and as dense matrices has maximal layer width $8210$ and
-$124{,}165{,}940$ entries, $75{,}501$ of them nonzero.
+$124{,}165{,}940$ entries, $75{,}501$ of them nonzero. These sizes are proved in
+Rocq, the rows of every layer and the identity units in closed form for every
+member of the family of Section~\ref{sec:host}.
 \end{remark}
 
 \subsection{Tape transducers}
@@ -395,8 +406,8 @@ Address & Symbol & Role & Effect \\
 \begin{definition}[Serialization]\label{def:sigma}
 Let $N$ be a clocked netlist on $n$ state bits. Number its signals with the state
 bits first, in the order fixed by the state layout, and the units after them in
-the order of $N$, which is the order in which the construction lists them; the
-serialization sorts nothing. The \emph{serialization} $\sigma(N)$ is the
+the order of $N$, which is the order in which the construction lists them. The
+\emph{serialization} $\sigma(N)$ is the
 \texttt{safetensors} encoding of four integer vectors:
 \begin{enumerate}[label=(\roman*)]
 \item the bias of each unit, in the order of $N$;
@@ -469,8 +480,7 @@ second statement follows by induction on $k$.
 The maps $\inst$ and $\Lev$ together with the device of
 Definition~\ref{def:transducer} are the \emph{instantiation map}: the network
 emits a description, and $\inst$, $\sigma^{-1}$ and $\Lev$ turn it into the next
-running network; each is linear in the data it reads or places.
-Section~\ref{sec:storedhost} removes the map: the host, held as records in the state
+running network. Section~\ref{sec:storedhost} removes the map: the host, held as records in the state
 of a fixed network, carries out the same step by the dynamics.
 
 % =============================================================================
@@ -553,7 +563,7 @@ ternary unit computes it when $n\ge3$. If $\Hv(\langle w,r\rangle+b)$ with
 $w\in\Tern^n$ did, then $r=0$ would give $b\ge0$, each unit vector $e_i$ with
 $i<n-1$ would give $w_i=-1$ and then $b=0$, and the vector of ones, whose value is
 negative, would force $w_{n-1}\ge n-1\ge2$. So the cell of Lemma~\ref{lem:branch}
-has the least ternary depth.
+has the least ternary depth. The argument is checked in Rocq for every $n\ge3$.
 \end{remark}
 
 \begin{lemma}[Address decoder and memory]\label{lem:mem}
@@ -599,7 +609,7 @@ inequalities at the two points where it is $1$ would give
 $\langle w,(1,1,1)\rangle+2b\ge0$, and at the two points where it is $0$ the
 strict opposite, a contradiction. The one-hot case is the same argument on
 $(s_0,s_1,\mu_0,\mu_1)$ at $(1,0,1,0)$, $(0,1,0,1)$ against $(1,0,0,1)$,
-$(0,1,1,0)$.
+$(0,1,1,0)$. Both statements are proved in Rocq for real weights.
 \end{proof}
 
 \begin{construction}[The host family]\label{con:host}
@@ -662,8 +672,9 @@ of the block's units.}
 \begin{proposition}[Constant-depth host]\label{prop:host}
 For every $A\ge3$ one step of the netlist $H_A$, from every state, is one step of
 $\mathrm{SUBLEQ}_A$ with the halt latch; its weights are ternary and its biases
-integers, it has depth $13$, $(8A+4)2^A+\tfrac12(A^2+39A+4)$ units and $O(A2^A)$
-edges, and for $A\ge8$, with the device of Definition~\ref{def:transducer} on its
+integers, it has depth $13$, $(8A+4)2^A+\tfrac12(A^2+39A+4)$ units and
+$(49A+4)2^{A-1}+\tfrac16(A^3+9A^2+194A+24)$ edges, and for $A\ge8$, with the device
+of Definition~\ref{def:transducer} on its
 seven top words, it realizes the transducer of Definitions~\ref{def:transducer}
 and~\ref{def:subleq}. The host $\Nhost=H_8$ has $17{,}598$ units carrying $68{,}730$
 parameters, $51{,}132$ weights of $\pm1$ and one bias per unit in $[-8,1]$; its
@@ -688,10 +699,11 @@ That one step of $H_A$ is one step of $\mathrm{SUBLEQ}_A$ with the halt latch, f
 every state and for every $A\ge3$, is proved in Rocq. The proof defines $H_A$ block
 by block in the order of Table~\ref{tab:blocks} and gives every unit its value in
 terms of the state, the carries through the recurrence of Lemma~\ref{lem:sub};
-induction over the units shows that the netlist computes these values. Extracted
-for $A=8$ to $10$,
-the definition gives the netlist that $\sigma(\Nhost)$ denotes and those of the
-generator, unit for unit.
+induction over the units shows that the netlist computes these values. The depth,
+the numbers of units, of memory units and of edges, the weights and the range
+$[-A,1]$ of the biases are proved in Rocq for every $A\ge3$ as well. Extracted for
+$A=8$ to $10$, the definition gives the netlist that $\sigma(\Nhost)$ denotes and
+those of the generator, unit for unit.
 \end{proof}
 
 \begin{remark}[Depth]\label{rem:fold}
@@ -703,7 +715,7 @@ so the step has depth $11$ for every $A$. For $A=8$ the folded netlist has
 $17{,}086$ units and $120{,}508$ edges, against $17{,}598$ and $51{,}132$, and for
 every $A$ from $3$ to $12$ one step of it agreed with $\mathrm{SUBLEQ}_A$ on
 $2^{16}$ uniformly random full states for $A\le10$ and on $2^{15}$ and $2^{14}$
-for $A=11$ and $12$. The least depth of a ternary SUBLEQ step is open.
+for $A=11$ and $12$.
 \end{remark}
 
 % =============================================================================
@@ -799,7 +811,9 @@ $R\ge1$, then
 \[
 L-2R\le F+(R+1)-2R\le F\le\frac{|f|-4}{127}<\frac{|f|}{127}\le\Bigl\lceil\frac{|f|}{127}\Bigr\rceil ,
 \]
-and the bound is strict.
+and the bound is strict. Lemmas~\ref{lem:complete} and~\ref{lem:describe} and
+Proposition~\ref{prop:optimal} are proved in Rocq, with a recipe given as its list
+of tokens.
 \end{proof}
 
 \begin{construction}[The constructor $P$]\label{con:P}
@@ -1048,7 +1062,10 @@ orbit under random perturbations, from the pre-activations the orbit visits. It
 compares the bounds with measurements of the host under noise
 (Section~\ref{sec:certified}), and it shows that replicating every unit multiplies
 the margin, which gives reliable runs under three models of noise, below a
-threshold in one of them (Section~\ref{sec:amplify}).
+threshold in one of them (Section~\ref{sec:amplify}). The theorems, propositions
+and corollaries of the section are proved in Rocq, and the values of the union
+bounds, thresholds and redundancies stated with them are evaluated in Rocq from
+proved bounds on $\erfc$ (Appendix~\ref{sec:verification}).
 
 Let $\Hv_{1/2}(z)=1$ if $z\ge -\tfrac12$ and $\Hv_{1/2}(z)=0$ otherwise; on integer
 arguments $\Hv_{1/2}$ and $\Hv$ agree. A \emph{layered integer threshold map} is
@@ -1390,11 +1407,18 @@ below a threshold.
 \begin{proposition}[Output flips]\label{prop:flip}
 Suppose that every evaluation of every row of $F^{(r)}$ outputs the complement of
 its value with probability $\varepsilon$, independently, and let $k^\ast$ be the
-largest effective fan-in of a row of $F$ and $n$ its number of state bits. Started
-from $\rho_r(x_0)$, the probability that the state of $F^{(r)}$ read by majority
-differs from $F^t(x_0)$ after one of the first $T$ steps is at most
+largest effective fan-in of a row of $F$ and $n$ its number of state bits.
+\begin{enumerate}[label=(\roman*),leftmargin=2em]
+\item Started from $\rho_r(x_0)$, the probability that the state of $F^{(r)}$ read by
+majority differs from $F^t(x_0)$ after one of the first $T$ steps is at most
 $T(M+n)(2ek^\ast\varepsilon)^{(r+1)/2}$. For $\varepsilon<1/(2ek^\ast)$ it is at
 most $\delta$ when $r+1\ge2\ln(T(M+n)/\delta)/\ln\bigl(1/(2ek^\ast\varepsilon)\bigr)$.
+\item Let a row of $F$ be the disjunction of $k$ inputs that hold $0$ on the orbit,
+and let $2k\varepsilon>1$. There is $\theta<1$, depending on $k$ and $\varepsilon$
+only, such that a row of $F^{(r)}$ that copies it, reading $kr$ input copies each
+flipped with probability $\varepsilon$, independently, computes a wrong value with
+probability at least $1-\theta^{(r-1)/2}$.
+\end{enumerate}
 \end{proposition}
 
 \begin{proof}
@@ -1409,16 +1433,30 @@ $\binom{k^\ast r}{(r+1)/2}\varepsilon^{(r+1)/2}\le(2ek^\ast\varepsilon)^{(r+1)/2
 since $\binom mj\le(em/j)^j$. While no row is wrong, the majority of the $r$ copies
 of a state bit is wrong only if at least $(r+1)/2$ of them flipped, with probability
 at most $(2e\varepsilon)^{(r+1)/2}$. The union bound over the $M$ rows and the $n$
-state bits of each of the $T$ steps gives the first statement, and taking
-logarithms gives the second.
+state bits of each of the $T$ steps gives the bound of~(i), and taking logarithms
+gives the redundancy.
+
+For~(ii), the copy has bias $-r+\tfrac{r-1}{2}=-\tfrac{r+1}{2}$ and reads its $kr$
+input copies with weight $1$, so its pre-activation is the number of flipped copies
+minus $\tfrac{r+1}{2}$, and it is wrong exactly when at least $\tfrac{r+1}{2}$ of
+them flipped. For $0<x\le1$ and $c=1-\varepsilon+\varepsilon x$, fewer than $t\ge1$
+of $m$ independent copies flip with probability at most $c^m/x^{t-1}$: by induction
+on $m$, either the first copy flips and fewer than $t-1$ of the others do, or it does
+not and fewer than $t$ do, which has probability at most
+$\varepsilon c^{m-1}/x^{t-2}+(1-\varepsilon)c^{m-1}/x^{t-1}=c^m/x^{t-1}$, the first
+term absent when $t=1$. For $r=2h+1$, $m=kr$ and $t=h+1$ this is
+$c^k(c^{2k}/x)^h\le\theta^h$ with $\theta=c^{2k}/x$. Take
+$u=(2k\varepsilon-1)/(4k\varepsilon)$, which lies in $(0,\tfrac12)$, and $x=1-u$, so
+that $c=1-\varepsilon u$. Then $c^{2k}(1+\varepsilon u)^{2k}\le1$,
+$(1+\varepsilon u)^{2k}\ge1+2k\varepsilon u$ and
+$(1+2k\varepsilon u)(1-u)=(2k\varepsilon+1)^2/(8k\varepsilon)>1$, so $\theta<1$.
 \end{proof}
 
-A threshold of this order is unavoidable for the construction. A disjunction of
-fan-in $k^\ast$ whose inputs hold $0$ on the orbit, such as a disjunction of the
-operand fetch of the host, reads on average $k^\ast r\varepsilon$ flipped copies,
-more than $r/2$ when $\varepsilon>1/(2k^\ast)$, and then fails with a probability
-that tends to one as $r$ grows. For $\Lev(\Nhost)$, $k^\ast=256$ and the threshold
-of Proposition~\ref{prop:flip} is $\varepsilon<7.2\times10^{-4}$.
+A threshold of this order is thus unavoidable for the construction. The operand
+fetch of the host has disjunctions of fan-in $k^\ast=256$, whose inputs all hold $0$
+when the fetched bit is $0$. For $\Lev(\Nhost)$ the amplification is therefore
+reliable for $\varepsilon<7.2\times10^{-4}$, and for $\varepsilon>1/512$ such a
+disjunction is wrong with a probability that tends to one as $r$ grows.
 
 Integer weights reach the same margin without copies: the layer with weights
 $rW_\ell$ and biases $rb_\ell+\tfrac{r-1}{2}$ has pre-activation $rz+\tfrac{r-1}{2}$
@@ -1483,7 +1521,12 @@ copies, which is their common value, and writes every copy, so the run of $N_r$
 from $\rho_r(x_0(m))$ visits the replications of the states $\Nhost$ visits from
 $x_0(m)$ on the same tape and emits the same bytes. The proofs of
 Theorems~\ref{thm:univ} and~\ref{thm:selfrep} use the transducer alone, so they
-hold with $N_r$ in place of $\Nhost$.
+hold with $N_r$ in place of $\Nhost$. For every odd $r$ and every $A\ge8$, with
+$\Lev(H_A)$ in place of $\Lev(\Nhost)$, it is proved in Rocq that the run of $N_r$
+from a replicated state visits the replicated states of the transducer's run with
+the same output, and that on $P^\ast$ and every recipe it reads its halt bit as $0$
+for the steps of Proposition~\ref{prop:steps} and as $1$ after them, with the output
+of Theorem~\ref{thm:selfrep}.
 \end{proof}
 
 One step of $N_3$ agreed with Definition~\ref{def:subleq} on $65{,}536$
@@ -1741,9 +1784,9 @@ Counting the units and edges of the blocks gives the sizes. The depth of a unit
 depends only on its block, the requests being decided at depth $14$ and the slot
 head lines at depth $19$. That the next state is the encoding of the next state of
 $x$, for all $\alpha\ge4$, $K\ge2$, $S,L\ge1$ and $x$, is proved in Rocq together
-with the number of units and the weights: every unit is given a value in terms of
-$x$ and fires to it on the values of the units it reads, and induction over the
-units shows that the netlist computes these values.
+with the numbers of units and edges, the weights and the depth: every unit is given
+a value in terms of $x$ and fires to it on the values of the units it reads, and
+induction over the units shows that the netlist computes these values.
 \end{proof}
 
 \begin{remark}[Corroboration]\label{rem:physcheck}
@@ -1961,12 +2004,12 @@ the records of a pass are carried to the steps of the machine.
 \end{proof}
 
 The theorems below use what Proposition~\ref{prop:storedpass} states and one more
-property of the image: every cell that a record after the startup records reads,
-other than the cells under the heads and the sink, is written earlier in the pass.
-The image $\mathcal S_{A,w}$ has this property for every $A\ge8$ and $w\ge1$, and
+property of the image: every cell read by a record after the startup records, other
+than the cells under the heads and the sink, is written earlier in the pass. The
+image $\mathcal S_{A,w}$ has this property for every $A\ge8$ and $w\ge1$, and
 $B=bG/8$ bytes, with $b=8+3\alpha$; $\mathcal S$ has $\alpha=15$, $G=36{,}080$ and
-$B=239{,}030$. The proofs apply to every image with these two properties, whatever
-netlist with the step of $H_A$ its step block compiles.
+$B=239{,}030$. The proofs apply to every image with these two properties, so the step
+block may compile any netlist that computes the step of $H_A$.
 
 \begin{theorem}[Universal construction by the dynamics]\label{thm:storedconstruct}
 Let $A\ge8$ and $w\ge1$, let $\mathcal S_{A,w}$ have $G$ records, and let $K\ge2$ and
@@ -2097,7 +2140,7 @@ of $\Theta(A^34^A)$ applications of $M^{\alpha_A}_{K,S,L}$.
 \begin{proof}
 The records of $\mathcal S_{A,w}$ grow linearly in $w$ and its window
 logarithmically, so $B$ grows quadratically in $w$ while $2^w$ grows exponentially,
-and $w_A$ exists; this is proved in Rocq. The recipe of literal tokens of
+and $w_A$ exists. The recipe of literal tokens of
 Lemma~\ref{lem:complete} has $B+\lceil B/127\rceil+1\le2B+1$ bytes, and
 $\describe$ gives no more by Lemma~\ref{lem:describe}. The startup and device
 records are counted in Construction~\ref{con:stored} and the hand-over has
@@ -2109,7 +2152,10 @@ term from the carry terms. The window holds the $A2^A+A+1$ state bits, a cell fo
 each of the $\Theta(A2^A)$ units of $H_A$ and $O(A+w_A)$ further cells, so
 $\alpha_A=A+\Theta(\log A)$; then $b=8+3\alpha_A=\Theta(A)$,
 $B=bG_A/8=\Theta(A^22^A)$, and Theorem~\ref{thm:storedrep} gives a generation of
-$\Theta(B)$ passes of $S=G_A$ steps.
+$\Theta(B)$ passes of $S=G_A$ steps. The record count, the bounds
+$A+\lfloor\log_2A\rfloor+3\le\alpha_A\le A+\lfloor\log_2A\rfloor+8$, the least $w_A$,
+which is at most $2A+10$, and the bounds $2^8A^34^A$ and $2^{13}A^34^A$ on the
+applications of a generation are proved in Rocq.
 \end{proof}
 
 For $A=8$ to $12$, $\mathcal S_A$ has $36{,}080$, $80{,}463$, $178{,}112$, $391{,}220$ and
@@ -2132,9 +2178,9 @@ $s\le0.247$.
 
 \begin{proof}
 Proposition~\ref{prop:random} and Theorem~\ref{thm:amplify}(ii) over the $T$
-applications. Each slot and each tape cell places a fixed number of units and
-identity rows, so the number of rows is affine in $S$ and $L$; it was counted on six
-members and the affine form fits all of them.
+applications, with the values evaluated in Rocq. $\Lev(N^\alpha_{K,S,L})$ has depth
+$19$ and $34\cdot2^\alpha+b+43K+24Kb+30KN+23KS+51KL-56$ rows, $N=Sb$, which is proved
+in Rocq for every $\alpha\ge4$, $K\ge2$ and $S,L\ge1$.
 \end{proof}
 
 \begin{remark}[Corroboration]\label{rem:storedcheck}
@@ -2550,28 +2596,65 @@ measurements of Section~\ref{sec:certified} and Appendix~\ref{app:measure} in C
 on the accelerator; it gives the sizes, depths and exact runs stated here, and noisy
 runs within sampling error.
 
-The Rocq development, \texttt{rocq/} in the artifact, has $44$ files and
-$13{,}795$ lines and builds with Rocq 9.1.1 in about three minutes on the machine
+The Rocq development, \texttt{rocq/} in the artifact, has $63$ files and
+$23{,}368$ lines and builds with Rocq 9.1.1 in about two minutes on the machine
 below, most of it in the kernel's evaluation of the $15{,}872$ abstract passes of
-Proposition~\ref{prop:pass} and in the device records of the stored host. It defines
-the host family $H_A$ block by block and
-proves that its step is the step of $\mathrm{SUBLEQ}_A$ for every $A\ge3$
-(Proposition~\ref{prop:host}). It defines the device of
-Definition~\ref{def:transducer} and the programs $P$ and $P^\ast$ in $2^A$ words,
-and proves Theorems~\ref{thm:univ} and~\ref{thm:selfrep} and
-Proposition~\ref{prop:steps} for every $A\ge8$ on the step of $\mathrm{SUBLEQ}_A$
-and the device. It defines the ring machine for every address width, its netlist
-block by block, the organism, the description code and the decoder, and proves
-Theorem~\ref{thm:physnet} for every $\alpha\ge4$, $K\ge2$ and $S,L\ge1$, together
-with the number of units and the weights; and it proves Lemma~\ref{lem:code},
-Proposition~\ref{prop:pass}, Theorem~\ref{thm:construct} and
-Theorem~\ref{thm:organism}, with the copies, the period and the network. It
-defines the stored host $\mathcal S_{A,w}$ of Construction~\ref{con:stored} for
-every $A\ge8$ and $w\ge1$ and proves its four blocks from every window
-(Proposition~\ref{prop:storedpass}), that every cell a pass reads after the startup
-is written earlier in the pass, Theorems~\ref{thm:storedconstruct}
-and~\ref{thm:storedrep} with the copies, the period and the network, and the
-existence of $w_A$ in Theorem~\ref{thm:widths}.
+Proposition~\ref{prop:pass} and in the device records of the stored host. It proves
+Lemma~\ref{lem:lev} for every clocked netlist. It defines the host family $H_A$
+block by block and proves that its step is the step of $\mathrm{SUBLEQ}_A$ for every
+$A\ge3$, with its depth, its numbers of units, memory units and edges, its weights
+and biases and the sizes of $\Lev(H_A)$ (Proposition~\ref{prop:host},
+Remark~\ref{rem:levsizes}), and it proves Lemma~\ref{lem:muxdepth} and
+Remark~\ref{rem:ternarydepth}. It defines the recipes, $\describe$, the device of
+Definition~\ref{def:transducer} and the programs $P$ and $P^\ast$ in $2^A$ words, and
+proves Lemmas~\ref{lem:complete} and~\ref{lem:describe},
+Proposition~\ref{prop:optimal}, Theorems~\ref{thm:univ} and~\ref{thm:selfrep} and
+Proposition~\ref{prop:steps}, the last three for every $A\ge8$ on the step of
+$\mathrm{SUBLEQ}_A$ and the device, and Corollary~\ref{cor:amplifiedselfrep} for every
+odd $r$. It defines the ring machine for every address
+width, its netlist block by block, the organism, the description code and the
+decoder, and proves Theorem~\ref{thm:physnet} for every $\alpha\ge4$, $K\ge2$ and
+$S,L\ge1$, together with the numbers of units and edges, the weights and the depth;
+and it proves Lemma~\ref{lem:code}, Proposition~\ref{prop:pass},
+Theorem~\ref{thm:construct} and Theorem~\ref{thm:organism}, with the copies, the
+period and the network. It defines the stored host $\mathcal S_{A,w}$ of
+Construction~\ref{con:stored} for every $A\ge8$ and $w\ge1$ and proves its four
+blocks from every window (Proposition~\ref{prop:storedpass}), that every cell a pass
+reads after the startup is written earlier in the pass,
+Theorems~\ref{thm:storedconstruct} and~\ref{thm:storedrep} with the copies, the
+period and the network, the counts of Theorem~\ref{thm:widths} and
+Corollary~\ref{cor:storednoise}.
+
+Section~\ref{sec:robust} is proved on a probability space given by its properties.
+A function $P$ on the events of the perturbations $(e_g)$ is monotone and
+subadditive, is $0$ on the empty event and $1$ on the sure one, multiplies on events
+that depend on disjoint sets of perturbations, and is additive and complementary on
+the events built from the threshold events $\{c\le e_g\}$; each perturbation has the
+tails $P(e_g\ge c)=Q(c/s)$ and $P(e_g\le c)=Q(-c/s)$, and in
+Proposition~\ref{prop:flip} each output flips with probability $\varepsilon$. The
+product of Gaussian measures with its outer measure is such a space.
+Corollary~\ref{cor:synapse} assumes in addition that a sum of $m$ independent
+centred Gaussians of deviation $s_{\mathrm w}$ is a centred Gaussian of deviation
+$s_{\mathrm w}\sqrt m$. In Proposition~\ref{prop:restore} the device writes every
+copy of its cells with the values of the run, as the device of $N_3$ does while the
+state read by majority is the run's. The identity
+$\bigl(\int_0^xe^{-t^2}dt\bigr)^2+\int_0^1e^{-x^2(1+t^2)}/(1+t^2)\,dt=\pi/4$ is proved
+from its derivative, which is $0$, with the integrals and derivatives of
+Coquelicot~\cite{BoldoLelayMelquiond2015}; with
+$\erfc(x)=1-\tfrac2{\sqrt\pi}\int_0^xe^{-t^2}dt$ it gives $\erfc(x)\le e^{-x^2}$ for
+$x\ge0$ and, for $x>0$,
+\[
+\frac{e^{-x^2}}{x\sqrt\pi}\Bigl(1-\frac1{2x^2}\Bigr)\le\erfc(x)
+\le\frac{e^{-x^2}}{x\sqrt\pi}\Bigl(1-\frac1{2x^2}+\frac3{4x^4}\Bigr),
+\]
+from which the union bounds, thresholds and redundancies stated in
+Sections~\ref{sec:robust} and~\ref{sec:storedhost} and in Appendix~\ref{app:measure}
+are evaluated with the interval tactic of the Interval
+library~\cite{Melquiond2008}. The
+results on real numbers rest on the classical axioms of Rocq's real numbers and on
+functional extensionality, and the evaluated values also on the specifications of
+its primitive integers and floating-point numbers; \texttt{src/paper.py rocq}
+rebuilds the development and prints the axioms of each main theorem.
 
 The file that defines the organism and its description is written by
 \texttt{src/twohead.py}. The netlist definitions, extracted to OCaml, write for $H_8$
@@ -2670,6 +2753,11 @@ V.~Beiu, J.~M.~Quintana, and M.~J.~Avedillo,
 \emph{VLSI implementations of threshold logic---a comprehensive survey},
 IEEE Trans. Neural Networks \textbf{14} (2003), no.~5, 1217--1243.
 
+\bibitem{BoldoLelayMelquiond2015}
+S.~Boldo, C.~Lelay, and G.~Melquiond,
+\emph{Coquelicot: A user-friendly library of real analysis for Coq}, Math. Comput.
+Sci. \textbf{9} (2015), no.~1, 41--62.
+
 \bibitem{Burks1970}
 A.~W.~Burks (ed.),
 \emph{Essays on Cellular Automata}, University of Illinois Press, Urbana, 1970.
@@ -2833,6 +2921,12 @@ W.~S.~McCulloch and W.~Pitts,
 \emph{A logical calculus of the ideas immanent in nervous activity}, Bull. Math.
 Biophys. \textbf{5} (1943), 115--133.
 
+\bibitem{Melquiond2008}
+G.~Melquiond,
+\emph{Proving bounds on real-valued functions with computations}, Automated
+Reasoning (IJCAR 2008), Lecture Notes in Comput. Sci. \textbf{5195}, Springer, 2008,
+2--17.
+
 \bibitem{Minsky1967}
 M.~L.~Minsky,
 \emph{Computation: Finite and Infinite Machines}, Prentice-Hall, Englewood Cliffs,

rocq/AmpHost.v

@@ -0,0 +1,320 @@
+(* Corollary 6.13: the r-fold amplification of Lev(H_A), with a device that reads the state as the majority of the
+   copies of each bit and writes every copy of the cells it writes, takes from a replicated state the steps of the host's
+   transducer, replicated; on P* and every recipe it halts after the steps of Proposition 5.3 with the output of the
+   host. *)
+From Stdlib Require Import List Bool Arith Lia.
+Import ListNotations.
+Set Warnings "-ambiguous-paths".
+From TH Require Import TwoHead Net Lev BlockLev Host HostWF HostIP HostSem HostLev Device Pstar Margin.
+Set Warnings "ambiguous-paths".
+
+(* ---- the rows of a levelized netlist read the layer before ------------------------------------------------------ *)
+Lemma mkrow_reads : forall n us nx, wfn n us -> forall l c,
+  (forall s, c = Un s -> exists k, k < length us /\ s = n + k /\ need n us nx s = true /\ dep n us s = S l) ->
+  (forall s, c = Cp s -> at_layer n us nx l s) -> reads_lt (width n us nx l) (mkrow n us nx (S l) c).
+Proof.
+  intros n us nx Hwf l c HU HC. destruct c as [s|s]; cbn [mkrow]; replace (S l - 1) with l by lia.
+  - specialize (HC s eq_refl). intros i z Hin. unfold idr in Hin. cbn [tin] in Hin. destruct Hin as [E|[]].
+    injection E as <- <-. apply pos_lt. exact HC.
+  - destruct (HU s eq_refl) as (k & Hk & -> & Hn & Hdk). replace (n + k - n) with k by lia.
+    intros i z Hin. unfold reidx in Hin. cbn [tin] in Hin. apply in_map_iff in Hin as ([p z'] & E & Hin).
+    cbn [fst snd] in E. injection E as <- <-. apply pos_lt. exact (pred_at n us nx Hwf l k p z' Hk Hn Hdk Hin).
+Qed.
+
+Lemma lev_lreads : forall n us nx, wfn n us -> Forall (fun s => s < NS n us) nx -> length nx = n -> 1 <= dmax n us ->
+  lreads n (lev n us nx).
+Proof.
+  intros n us nx Hwf Hnx Hlen Hd.
+  assert (G : forall m, m <= dmax n us - 1 ->
+    lreads (width n us nx m) (map (fun p => map (mkrow n us nx (fst p)) (snd p))
+                               (map (fun l => (l, srcs n us nx l)) (seq (S m) (dmax n us - 1 - m))
+                                ++ [(dmax n us, srcd n us nx)]))).
+  { intros m Hm. remember (dmax n us - 1 - m) as c eqn:Ec. revert m Hm Ec. induction c as [|c IH]; intros m Hm Ec.
+    - cbn [seq map app lreads fst snd]. split; [|exact I].
+      apply Forall_forall. intros u Hu. apply in_map_iff in Hu as (c & <- & Hc).
+      destruct (srcd_spec n us nx Hnx Hlen Hd c Hc) as [HU HC].
+      replace (dmax n us) with (S m) by lia. apply mkrow_reads; [exact Hwf | |].
+      + intros s E. destruct (HU s E) as (k & Hk & Es & Hn & Hdk). exists k. repeat split; try assumption. lia.
+      + intros s E. destruct (HC s E) as (Hs & Hdl & Hlam). apply copy_at; [exact Hwf | exact Hs | lia | lia].
+    - cbn [seq map app lreads fst snd]. split.
+      + apply Forall_forall. intros u Hu. apply in_map_iff in Hu as (c' & <- & Hc).
+        destruct (srcs_spec n us nx (S m) c' Hc) as [HU HC]. apply mkrow_reads; [exact Hwf | exact HU |].
+        intros s E. destruct (HC s E) as (Hs & Hdl & Hlam). apply copy_at; [exact Hwf | exact Hs | lia | lia].
+      + rewrite length_map. unfold srcs. rewrite length_map.
+        replace (length (filter (live n us nx (S m)) (seq 0 (NS n us)))) with (width n us nx (S m)) by reflexivity.
+        apply IH; lia. }
+  specialize (G 0 ltac:(lia)). unfold lev, lsrc. replace (dmax n us - 1) with (dmax n us - 1 - 0) by lia. exact G.
+Qed.
+
+(* ---- a word of bits, most significant first ---------------------------------------------------------------------- *)
+Definition bval (bs : list bool) : nat := fold_left (fun a b => 2 * a + Nat.b2n b) bs 0.
+
+Lemma bval_app : forall l b, bval (l ++ [b]) = 2 * bval l + Nat.b2n b.
+Proof. intros l b. unfold bval. rewrite fold_left_app. reflexivity. Qed.
+
+Lemma bval_bits : forall k v, bval (map (fun t => Nat.testbit v (k - 1 - t)) (seq 0 k)) = v mod 2 ^ k.
+Proof.
+  induction k as [|k IH]; intro v; [rewrite Nat.pow_0_r, Nat.mod_1_r; reflexivity|].
+  rewrite seq_S, map_app. cbn [map Nat.add]. rewrite bval_app. replace (S k - 1 - k) with 0 by lia.
+  rewrite (map_ext_in _ (fun t => Nat.testbit (Nat.div2 v) (k - 1 - t))).
+  - rewrite IH, Nat.bit0_odd. pose proof (Nat.div2_odd v) as Ev.
+    assert (Hp : 2 ^ k <> 0) by (apply Nat.pow_nonzero; lia).
+    pose proof (Nat.mod_upper_bound (Nat.div2 v) (2 ^ k) Hp) as Hm.
+    pose proof (Nat.div_mod (Nat.div2 v) (2 ^ k) Hp) as Ed.
+    apply (Nat.mod_unique v (2 ^ S k) (Nat.div2 v / 2 ^ k)); rewrite Nat.pow_succ_r'.
+    + destruct (Nat.odd v); cbn [Nat.b2n]; lia.
+    + nia.
+  - intros t Ht. apply in_seq in Ht. rewrite Nat.testbit_div2. f_equal. lia.
+Qed.
+
+Section AmpHost.
+Variable A : nat.
+Hypothesis HA : 8 <= A.
+Variable r : nat.
+Hypothesis Hr : Nat.odd r = true.
+
+Lemma HA3 : 3 <= A.
+Proof. lia. Qed.
+
+Lemma SW_big : 256 <= SW A.
+Proof. unfold SW. replace 256 with (2 ^ 8) by reflexivity. apply Nat.pow_le_mono_r; lia. Qed.
+
+(* ---- decoding a state ------------------------------------------------------------------------------------------- *)
+Definition bword (x : list bool) (o : nat) : nat := bval (map (fun t => nth (o + t) x false) (seq 0 A)).
+Definition decodeH (x : list bool) : hst :=
+  mkH (bword x 0) (nth A x false) (map (fun j => bword x (A + 1 + j * A)) (seq 0 (SW A))).
+
+Lemma bval_wbits : forall v, v < SW A -> bval (wbits A v) = v.
+Proof. intros v Hv. unfold wbits, bitof. rewrite bval_bits. apply Nat.mod_small. exact Hv. Qed.
+
+Lemma memv_lt : forall s j, hvalid A s -> j < SW A -> memv s j < SW A.
+Proof.
+  intros s j (_ & Hl & Hf) Hj. unfold memv. rewrite Forall_forall in Hf. apply Hf. apply nth_In. lia.
+Qed.
+
+Lemma decode_encode : forall s, hvalid A s -> decodeH (encodeH A s) = s.
+Proof.
+  intros s Hv. pose proof Hv as (Hp & Hl & Hf). destruct s as [p h m]. cbn [hpc hhalt hmem] in *. unfold decodeH. f_equal.
+  - unfold bword. rewrite (map_ext_in _ (bitof A p)).
+    + apply bval_wbits. exact Hp.
+    + intros t Ht. apply in_seq in Ht. cbn [Nat.add]. apply (nth_encodeH_pc A (mkH p h m) t). lia.
+  - apply (nth_encodeH_halt A (mkH p h m)).
+  - transitivity (map (fun j => nth j m 0) (seq 0 (SW A))).
+    + apply map_ext_in. intros j Hj. apply in_seq in Hj. unfold bword.
+      rewrite (map_ext_in _ (bitof A (memv (mkH p h m) j))).
+      * apply bval_wbits. exact (memv_lt (mkH p h m) j Hv ltac:(lia)).
+      * intros t Ht. apply in_seq in Ht. apply nth_encodeH_mem; [exact Hl | lia | lia].
+    + rewrite <- Hl. transitivity (map (fun b : nat => b) m); [|apply map_id].
+      symmetry. apply (map_seq_nth _ _ (fun b : nat => b) m 0).
+Qed.
+
+(* ---- the transducer keeps the state valid ---------------------------------------------------------------------- *)
+Lemma hvalid_subleq : forall s, hvalid A s -> hvalid A (subleq A s).
+Proof.
+  intros s Hv. pose proof SW_big. unfold subleq. destruct (hhalt s); [exact Hv|]. cbv zeta.
+  split; [|split].
+  - cbn [hpc]. destruct (_ || _); [apply memv_lt; [exact Hv | apply Nat.mod_upper_bound; lia] | apply Nat.mod_upper_bound; lia].
+  - cbn [hmem]. rewrite length_map, length_seq. reflexivity.
+  - cbn [hmem]. apply Forall_forall. intros v Hin. apply in_map_iff in Hin as (j & <- & Hj). apply in_seq in Hj.
+    destruct (Nat.eqb j _); [apply Nat.mod_upper_bound; lia | apply memv_lt; [exact Hv | lia]].
+Qed.
+
+Lemma memv_setm : forall s c v j, j < SW A -> memv (setm A s c v) j = if Nat.eqb j c then v else memv s j.
+Proof. intros s c v j Hj. unfold setm, memv at 1. cbn [hmem]. rewrite nth_map_seq by exact Hj. reflexivity. Qed.
+
+Lemma hvalid_setm : forall s c v, hvalid A s -> v < SW A -> hvalid A (setm A s c v).
+Proof.
+  intros s c v Hv Hvl. pose proof Hv as (Hp & _ & _). unfold setm. split; [exact Hp|]. split.
+  - cbn [hmem]. rewrite length_map, length_seq. reflexivity.
+  - cbn [hmem]. apply Forall_forall. intros x Hin. apply in_map_iff in Hin as (j & <- & Hj). apply in_seq in Hj.
+    destruct (Nat.eqb j c); [exact Hvl | apply memv_lt; [exact Hv | lia]].
+Qed.
+
+Lemma nth_byte : forall l i, Forall (fun b => b < 256) l -> nth i l 0 < 256.
+Proof.
+  intros l i H. destruct (Nat.lt_ge_cases i (length l)) as [Hi|Hi].
+  - rewrite Forall_forall in H. apply H. apply nth_In. exact Hi.
+  - rewrite nth_overflow by exact Hi. lia.
+Qed.
+
+Lemma hvalid_device : forall s d, hvalid A s -> Forall (fun b => b < 256) (dtape d) ->
+  hvalid A (fst (device A s d)) /\ dtape (snd (device A s d)) = dtape d.
+Proof.
+  intros s d Hv Ht. pose proof SW_big. split; [|reflexivity]. unfold device. cbv zeta. cbn [fst].
+  assert (Hs : forall v, v < 256 -> sext A v < SW A) by (intros v Hb; unfold sext; destruct (v <? 128); lia).
+  pose proof (Hs _ (nth_byte (dtape d) (dhead d) Ht)) as Hb.
+  repeat apply hvalid_setm; try lia.
+  destruct (Nat.eqb (memv s (crd A)) 1); [destruct (dhead d <? length (dtape d))|];
+    destruct (Nat.eqb (memv s (cwr A)) 1); repeat apply hvalid_setm; (exact Hv || lia).
+Qed.
+
+(* the device writes the request cells, the end-of-tape status and the two registers, words SW - 7 to SW - 2 *)
+Definition dword (j : nat) : bool := (SW A - 7 <=? j) && (j <? SW A - 1).
+
+Lemma device_keeps : forall s d, hpc (fst (device A s d)) = hpc s /\ hhalt (fst (device A s d)) = hhalt s
+  /\ forall j, j < SW A -> dword j = false -> memv (fst (device A s d)) j = memv s j.
+Proof.
+  intros s d. pose proof SW_big. unfold device. cbv zeta. cbn [fst].
+  destruct (Nat.eqb (memv s (crd A)) 1); [destruct (dhead d <? length (dtape d))|];
+    destruct (Nat.eqb (memv s (cwr A)) 1); (split; [reflexivity | split; [reflexivity|]]);
+    intros j Hj Hd; unfold dword in Hd; apply andb_false_iff in Hd;
+    repeat (rewrite memv_setm by exact Hj); unfold cwr, crd, crw, ceot, rin, rout;
+    repeat match goal with |- context [Nat.eqb j ?c] => destruct (Nat.eqb_spec j c) end;
+    try reflexivity; (exfalso; destruct Hd as [Hd|Hd]; [apply Nat.leb_gt in Hd | apply Nat.ltb_ge in Hd]; lia).
+Qed.
+
+(* ---- the amplified levelized host ------------------------------------------------------------------------------- *)
+Definition LH : list (list tu) := lev (nH A) (host_units A) (host_next A).
+
+Lemma host_lev_hyps : wfn (nH A) (host_units A) /\ Forall (fun s => s < NS (nH A) (host_units A)) (host_next A)
+  /\ length (host_next A) = nH A /\ 1 <= dmax (nH A) (host_units A).
+Proof.
+  split; [exact (fwfn (hblocks A) (nH A) (host_wf' A HA3))|]. split; [|split; [apply host_next_len | rewrite (host_dmax A HA3); lia]].
+  apply Forall_forall. intros s Hs. unfold host_next in Hs. apply in_map_iff in Hs as (i & <- & Hi). apply in_seq in Hi.
+  unfold NS, host_units. rewrite (length_compile _ _ (hb_shaped A HA3)). apply idx_lt_total. apply hout_valid; [exact HA3 | lia].
+Qed.
+
+Lemma lmap_LH : forall x, length x = nH A -> lmap LH x = netstep (nH A) (host_units A) (host_next A) x.
+Proof.
+  intros x Hx. destruct host_lev_hyps as (H1 & H2 & H3 & H4). exact (lev_correct _ _ _ H1 H2 H3 H4 x Hx).
+Qed.
+
+Lemma lreads_LH : lreads (nH A) LH.
+Proof. destruct host_lev_hyps as (H1 & H2 & H3 & H4). exact (lev_lreads _ _ _ H1 H2 H3 H4). Qed.
+
+(* bit k of the state lies in a word the device writes *)
+Definition dbit (k : nat) : bool := (A + 1 <=? k) && dword ((k - (A + 1)) / A).
+
+(* one step of N_r: the amplified layers, then the device on the state read by majority, which writes every copy of
+   the bits of the cells it writes and leaves the other bits as the layers left them *)
+Definition stepr (c : list bool * dev) : list bool * dev :=
+  let y := lmap (amap r (nH A) LH) (fst c) in
+  let c' := device A (decodeH (maj r (nH A) y)) (snd c) in
+  (map (fun k => if dbit (k mod nH A) then nth (k mod nH A) (encodeH A (fst c')) false else nth k y false)
+       (seq 0 (length y)), snd c').
+
+Fixpoint runr (t : nat) (c : list bool * dev) : list bool * dev :=
+  match t with O => c | S t' => stepr (runr t' c) end.
+
+Lemma maj_rep : forall x, length x = nH A -> maj r (nH A) (rep r x) = x.
+Proof.
+  intros x Hx. rewrite <- (xorv_false (rep r x)). apply maj_ok; [exact Hr | exact Hx|].
+  intros j Hj. assert (Z : forall k, ncnt k (fun _ => false) = 0) by (induction k as [|k IHk]; cbn [ncnt]; [reflexivity | rewrite IHk; reflexivity]).
+  cbv beta. rewrite Z. lia.
+Qed.
+
+(* off the cells the device writes, the state before and after the device have the same bits *)
+Lemma enc_agree : forall s1 s2, hvalid A s1 -> hvalid A s2 -> hpc s2 = hpc s1 -> hhalt s2 = hhalt s1 ->
+  (forall j, j < SW A -> dword j = false -> memv s2 j = memv s1 j) ->
+  forall k, k < nH A -> dbit k = false -> nth k (encodeH A s2) false = nth k (encodeH A s1) false.
+Proof.
+  intros s1 s2 (_ & L1 & _) (_ & L2 & _) Ep Eh Em k Hk Hd. unfold nH in Hk.
+  destruct (Nat.lt_ge_cases k A) as [Hk1|Hk1]; [rewrite !nth_encodeH_pc, Ep by exact Hk1; reflexivity|].
+  destruct (Nat.eq_dec k A) as [->|Hk2]; [rewrite !nth_encodeH_halt, Eh; reflexivity|].
+  set (j := (k - (A + 1)) / A). set (t := (k - (A + 1)) mod A).
+  assert (Ek : k = A + 1 + j * A + t) by (unfold j, t; pose proof (Nat.div_mod (k - (A + 1)) A ltac:(lia)); lia).
+  assert (Hj : j < SW A) by (unfold j; apply Nat.Div0.div_lt_upper_bound; nia).
+  assert (Ht : t < A) by (unfold t; apply Nat.mod_upper_bound; lia).
+  unfold dbit in Hd. fold j in Hd. replace (A + 1 <=? k) with true in Hd by (symmetry; apply Nat.leb_le; lia).
+  cbn [andb] in Hd. rewrite Ek, !nth_encodeH_mem by assumption. rewrite (Em j Hj Hd). reflexivity.
+Qed.
+
+(* from a replicated state, a step of N_r is the replicated step of the transducer *)
+Lemma stepr_rep : forall s d, hvalid A s -> Forall (fun b => b < 256) (dtape d) ->
+  stepr (rep r (encodeH A s), d) = (rep r (encodeH A (fst (tstep A (s, d)))), snd (tstep A (s, d))).
+Proof.
+  intros s d Hv Ht. pose proof (hvalid_subleq s Hv) as Hv'. pose proof Hv' as (_ & Hl' & _).
+  pose proof Hv as (_ & Hl & _).
+  assert (Y : lmap (amap r (nH A) LH) (rep r (encodeH A s)) = rep r (encodeH A (subleq A s))).
+  { rewrite <- (length_encodeH A s Hl) at 1.
+    rewrite amap_rep by (exact Hr || (rewrite length_encodeH by exact Hl; exact lreads_LH)).
+    rewrite lmap_LH by (apply length_encodeH; exact Hl). rewrite host_step by (exact HA3 || exact Hv). reflexivity. }
+  unfold stepr. cbn [fst snd]. rewrite Y, maj_rep by (apply length_encodeH; exact Hl'). rewrite decode_encode by exact Hv'.
+  change (device A (subleq A s) d) with (tstep A (s, d)).
+  destruct (hvalid_device (subleq A s) d Hv' Ht) as [Hvs _]. destruct (device_keeps (subleq A s) d) as (Ep & Eh & Em).
+  change (device A (subleq A s) d) with (tstep A (s, d)) in Hvs, Ep, Eh, Em.
+  set (s' := fst (tstep A (s, d))) in *. pose proof Hvs as (_ & Ls' & _).
+  f_equal. apply nth_ext with (d := false) (d' := false).
+  - rewrite length_map, length_seq, !length_rep, !length_encodeH by assumption. reflexivity.
+  - intros k Hk. rewrite length_map, length_seq, length_rep, length_encodeH in Hk by exact Hl'.
+    rewrite nth_map_seq by (rewrite length_rep, length_encodeH by exact Hl'; exact Hk).
+    rewrite (nth_rep_mod r (encodeH A s') k) by (rewrite length_encodeH by exact Ls'; exact Hk).
+    rewrite (nth_rep_mod r (encodeH A (subleq A s)) k) by (rewrite length_encodeH by exact Hl'; exact Hk).
+    rewrite !length_encodeH by assumption.
+    assert (Hkm : k mod nH A < nH A) by (apply Nat.mod_upper_bound; unfold nH; lia).
+    destruct (dbit (k mod nH A)) eqn:Db; [reflexivity|].
+    symmetry. apply (enc_agree (subleq A s) s' Hv' Hvs Ep Eh Em (k mod nH A) Hkm Db).
+Qed.
+
+Lemma trun_inv : forall t c, hvalid A (fst c) -> Forall (fun b => b < 256) (dtape (snd c)) ->
+  hvalid A (fst (trun A t c)) /\ dtape (snd (trun A t c)) = dtape (snd c).
+Proof.
+  induction t as [|t IH]; intros c Hv Ht; [split; [exact Hv | reflexivity]|]. cbn [trun].
+  destruct (hvalid_device (subleq A (fst c)) (snd c) (hvalid_subleq (fst c) Hv) Ht) as [H1 H2].
+  destruct (IH (tstep A c) H1 ltac:(unfold tstep; rewrite H2; exact Ht)) as [IH1 IH2].
+  split; [exact IH1|]. rewrite IH2. exact H2.
+Qed.
+
+(* Corollary 6.13: from a replicated state, N_r visits the replicated states of the transducer's run and emits the
+   same bytes *)
+Theorem amp_run : forall t s d, hvalid A s -> Forall (fun b => b < 256) (dtape d) ->
+  runr t (rep r (encodeH A s), d) = (rep r (encodeH A (fst (trun A t (s, d)))), snd (trun A t (s, d))).
+Proof.
+  induction t as [|t IH]; intros s d Hv Ht; [reflexivity|]. cbn [runr]. rewrite IH by assumption.
+  destruct (trun_inv t (s, d) Hv Ht) as [Hvt Htt].
+  rewrite stepr_rep by (exact Hvt || (rewrite Htt; exact Ht)).
+  rewrite <- surjective_pairing. replace (S t) with (t + 1) by lia. rewrite trun_add. reflexivity.
+Qed.
+
+(* ---- on P* ------------------------------------------------------------------------------------------------------- *)
+Lemma recipe_bytes : forall ks, Forall tok_ok ks -> Forall (fun b => b < 256) (recipe ks).
+Proof.
+  intros ks Hks. unfold recipe. apply Forall_app. split; [|apply Forall_cons; [lia | apply Forall_nil]].
+  induction ks as [|k ks IH]; [constructor|]. inversion Hks as [|? ? Hk Hks']; subst. cbn [map concat].
+  apply Forall_app. split; [|exact (IH Hks')].
+  destruct k as [bs|t b]; cbn [enc tok_ok] in *.
+  - destruct Hk as [Hl Hb]. apply Forall_cons; [lia | exact Hb].
+  - destruct Hk as [Ht Hb]. apply Forall_cons; [lia|]. apply Forall_cons; [lia | apply Forall_nil].
+Qed.
+
+Lemma prog_bounds : Forall (fun '(a, b, c) => a < SW A /\ b < SW A /\ c < SW A) (progPstar A).
+Proof.
+  pose proof SW_big. unfold progPstar, decode_loop, t2c, t1c, neg1c, crd, rin, zc, rout, cwr, onec, crw, ceot, eokc, haltc.
+  repeat (apply Forall_cons || apply Forall_nil || split); lia.
+Qed.
+
+Lemma hvalid_init : forall tau, hvalid A (fst (init A (progPstar A) tau)).
+Proof.
+  intro tau. pose proof SW_big. cbn [init fst]. split; [cbn [hpc]; lia|]. split.
+  - cbn [hmem]. unfold image. rewrite length_map, length_seq. reflexivity.
+  - cbn [hmem]. unfold image. apply Forall_forall. intros v Hin. apply in_map_iff in Hin as (j & <- & Hj). apply in_seq in Hj.
+    unfold img0. destruct (j <? 3 * length (progPstar A)).
+    + unfold word. pose proof prog_bounds as F. rewrite Forall_forall in F.
+      destruct (nth_in_or_default (j / 3) (progPstar A) (0, 0, 0)) as [Hin|Hd].
+      * destruct (nth (j / 3) (progPstar A) (0, 0, 0)) as [[a b] c] eqn:E. destruct (F _ Hin) as (Ha & Hb & Hc).
+        destruct (j mod 3) as [|[|]]; assumption.
+      * rewrite Hd. destruct (j mod 3) as [|[|]]; lia.
+    + unfold onec, neg1c, eokc. destruct (Nat.eqb j _); [lia|]. destruct (Nat.eqb j _); [lia|]. destruct (Nat.eqb j _); lia.
+Qed.
+
+(* N_r running P* on a recipe reads its halt bit as 0 for the steps of Proposition 5.3 and as 1 after them, and has
+   emitted the decoded string followed by the recipe *)
+Theorem amp_selfrep : forall ks, Forall tok_ok ks ->
+  let c0 := init A (progPstar A) (recipe ks) in
+  let N := (dsteps ks + 7 + 1 + (6 * length (recipe ks) + 2))%nat in
+  (forall t, t < N -> nth A (maj r (nH A) (fst (runr t (rep r (encodeH A (fst c0)), snd c0)))) false = false)
+  /\ nth A (maj r (nH A) (fst (runr N (rep r (encodeH A (fst c0)), snd c0)))) false = true
+  /\ dout (snd (runr N (rep r (encodeH A (fst c0)), snd c0))) = delta ks ++ recipe ks.
+Proof.
+  intros ks Hks c0 N. destruct (selfrep_run A HA ks Hks) as [H1 (H2 & H3 & _)]. fold c0 N in H1, H2, H3.
+  assert (Hv : hvalid A (fst c0)) by apply hvalid_init.
+  assert (Ht : Forall (fun b => b < 256) (dtape (snd c0))) by (cbn [c0 init snd dtape]; apply recipe_bytes; exact Hks).
+  assert (R : forall t, runr t (rep r (encodeH A (fst c0)), snd c0) = (rep r (encodeH A (fst (trun A t c0))), snd (trun A t c0))).
+  { intro t. rewrite amp_run by assumption. rewrite <- surjective_pairing. reflexivity. }
+  assert (M : forall t, nth A (maj r (nH A) (fst (runr t (rep r (encodeH A (fst c0)), snd c0)))) false = hhalt (fst (trun A t c0))).
+  { intro t. rewrite R. cbn [fst]. destruct (trun_inv t c0 Hv Ht) as [(_ & Lt & _) _].
+    rewrite maj_rep by (apply length_encodeH; exact Lt). apply nth_encodeH_halt. }
+  split; [intros t Hlt; rewrite M; exact (H1 t Hlt)|]. split; [rewrite M; exact H2|]. rewrite R. exact H3.
+Qed.
+
+End AmpHost.

rocq/Assumptions.v

@@ -1,6 +1,13 @@
-(* The assumptions of the main theorems, printed by src/paper.py rocq after the build. *)
+(* The assumptions of the main theorems, printed by src/paper.py rocq after the build.  The theorems on the netlists,
+   the machines and the programs depend on no axiom; those on real numbers on the axioms of the standard library's
+   real numbers; the numbers evaluated by the interval tactic also on the specifications of the primitive integers and
+   floating-point numbers. *)
+Set Warnings "-ambiguous-paths".
 From TH Require Import PhysSem PhysMain PhysFacts NetMain Complete Decoder Run PassLemma Main HostSem Pstar
-  StoredBoot StoredPass StoredDev StoredOk StoredRun StoredWbr StoredMain StoredWidth.
+  StoredBoot StoredPass StoredDev StoredOk StoredRun StoredWbr StoredMain StoredWidth
+  Recipe Lower Lev HostLev HostCount StoredProp StoredCount PhysLev Margin Erfc Choose Noise NoiseNum Restore FlipLower
+  AmpHost.
+Set Warnings "ambiguous-paths".
 
 Print Assumptions PhysSem.netlist_step.
 Print Assumptions PhysMain.network_orbit.
@@ -39,3 +46,92 @@ Print Assumptions StoredMain.network_reproduces.
 Print Assumptions StoredMain.network_periodic.
 Print Assumptions StoredWidth.width_exists.
 Print Assumptions StoredWidth.recipe_of_image.
+Print Assumptions StoredProp.stored_pass.
+Print Assumptions Recipe.desc_spec.
+Print Assumptions Recipe.describe_spec.
+Print Assumptions Recipe.recipes_complete.
+Print Assumptions Recipe.recipe_optimal.
+Print Assumptions Recipe.describe_steps.
+Print Assumptions Recipe.psteps_lower.
+Print Assumptions Lev.lev_ok.
+Print Assumptions Lev.lev_units.
+Print Assumptions Lev.lev_widths.
+Print Assumptions Lev.lev_size.
+Print Assumptions HostLev.host_dmax.
+Print Assumptions HostLev.host_lev_widths.
+Print Assumptions HostLev.host_lev_rows.
+Print Assumptions HostLev.host_lev_widths_8.
+Print Assumptions HostLev.host_lev_rows_8.
+Print Assumptions HostLev.host_lev_dense_8.
+Print Assumptions HostLev.host_lev_widest_8.
+Print Assumptions HostCount.host_units_count.
+Print Assumptions HostCount.host_memory_count.
+Print Assumptions HostCount.host_edges.
+Print Assumptions HostCount.host_weights_biases.
+Print Assumptions HostCount.host_lev_identity.
+Print Assumptions HostCount.host_units_8.
+Print Assumptions HostCount.host_edges_8.
+Print Assumptions HostCount.host_memory_8.
+Print Assumptions HostCount.host_lev_identity_8.
+Print Assumptions HostCount.host_lev_nonzero_8.
+Print Assumptions StoredCount.stored_records.
+Print Assumptions StoredCount.alpha_bounds.
+Print Assumptions StoredCount.width_least.
+Print Assumptions StoredCount.generation_bounds.
+Print Assumptions PhysLev.phys_dmax.
+Print Assumptions PhysLev.phys_lev_depth.
+Print Assumptions PhysLev.phys_lev_rows.
+Print Assumptions PhysLev.phys_edges.
+Print Assumptions PhysLev.phys_lev_rows_15.
+Print Assumptions PhysLev.phys_lev_rows_S.
+Print Assumptions Lower.read_needs_two_levels.
+Print Assumptions Lower.onehot_needs_two_levels.
+Print Assumptions Lower.branch_not_ternary.
+Print Assumptions Margin.margin.
+Print Assumptions Margin.margin_tight.
+Print Assumptions Margin.mismatch_all.
+Print Assumptions Margin.mismatch_run.
+Print Assumptions Margin.amap_rep.
+Print Assumptions Margin.amp_wrong.
+Print Assumptions Margin.amp_margin.
+Print Assumptions Margin.flip_ok.
+Print Assumptions Erfc.gauss_square.
+Print Assumptions Erfc.erfc_le_exp.
+Print Assumptions Erfc.erfc_upper1.
+Print Assumptions Erfc.erfc_upper3.
+Print Assumptions Erfc.erfc_lower1.
+Print Assumptions Choose.binom_bound.
+Print Assumptions Noise.union_bound.
+Print Assumptions Noise.union_gauss.
+Print Assumptions Noise.profile_step.
+Print Assumptions Noise.profile_le.
+Print Assumptions Noise.copy_bound.
+Print Assumptions Noise.union_profile.
+Print Assumptions Noise.amp_union.
+Print Assumptions Noise.amp_gauss.
+Print Assumptions Noise.amp_profile.
+Print Assumptions Noise.amp_choose.
+Print Assumptions Noise.amp_choose_exp.
+Print Assumptions Noise.synapse_bound.
+Print Assumptions Noise.flip_bound.
+Print Assumptions Noise.flip_choose.
+Print Assumptions NoiseNum.p_005.
+Print Assumptions NoiseNum.TMp_005.
+Print Assumptions NoiseNum.TMp_010.
+Print Assumptions NoiseNum.flip_threshold.
+Print Assumptions NoiseNum.synapse_005.
+Print Assumptions NoiseNum.synapse_010.
+Print Assumptions NoiseNum.N3_first_order.
+Print Assumptions NoiseNum.generation_1.
+Print Assumptions NoiseNum.generation_3.
+Print Assumptions NoiseNum.generation_5.
+Print Assumptions Restore.tw_paper.
+Print Assumptions Restore.far_core.
+Print Assumptions Restore.wrong_far.
+Print Assumptions Restore.claims.
+Print Assumptions Restore.claim_stop.
+Print Assumptions Restore.restoration.
+Print Assumptions FlipLower.P_few.
+Print Assumptions FlipLower.flip_fails.
+Print Assumptions AmpHost.amp_run.
+Print Assumptions AmpHost.amp_selfrep.

rocq/BlockLev.v

@@ -0,0 +1,564 @@
+(* The levelization of a netlist given in blocks (Lemma 2.6 applied): the depth of every signal, the last layer that
+   reads it and the width of every layer, from claims that are checked block by block. *)
+From Stdlib Require Import List Bool Arith ZArith Lia.
+Import ListNotations.
+From TH Require Import TwoHead Net Lev.
+
+(* ---- finite sums -------------------------------------------------------------------------------------------- *)
+Fixpoint nsum (k : nat) (g : nat -> nat) : nat := match k with O => 0 | S k' => nsum k' g + g k' end.
+
+Lemma nsum_ext : forall k g h, (forall i, i < k -> g i = h i) -> nsum k g = nsum k h.
+Proof. induction k as [|k IH]; intros g h H; cbn [nsum]; [reflexivity|]. rewrite (IH g h), (H k); [reflexivity | lia |]. intros i Hi. apply H. lia. Qed.
+
+Lemma nsum_const : forall k c, nsum k (fun _ => c) = k * c.
+Proof. induction k as [|k IH]; intro c; cbn [nsum]; [reflexivity|]. rewrite IH. lia. Qed.
+
+Lemma nsum_add : forall k g h, nsum k (fun i => g i + h i) = nsum k g + nsum k h.
+Proof. induction k as [|k IH]; intros g h; cbn [nsum]; [reflexivity|]. rewrite IH. lia. Qed.
+
+Lemma nsum_split : forall a b g, nsum (a + b) g = nsum a g + nsum b (fun i => g (a + i)).
+Proof.
+  intros a b g. induction b as [|b IH]; [rewrite Nat.add_0_r; cbn [nsum]; lia|].
+  replace (a + S b) with (S (a + b)) by lia. cbn [nsum]. rewrite IH. lia.
+Qed.
+
+Lemma nsum_mul : forall c s g, nsum (c * s) g = nsum c (fun j => nsum s (fun r => g (s * j + r))).
+Proof.
+  induction c as [|c IH]; intros s g; cbn [nsum]; [reflexivity|]. replace (S c * s) with (c * s + s) by lia.
+  rewrite nsum_split, IH. f_equal. apply nsum_ext. intros r Hr. f_equal. lia.
+Qed.
+
+Lemma nsum_le : forall k g h, (forall i, i < k -> g i <= h i) -> nsum k g <= nsum k h.
+Proof. induction k as [|k IH]; intros g h H; cbn [nsum]; [lia|]. pose proof (IH g h (fun i Hi => H i ltac:(lia))). pose proof (H k ltac:(lia)). lia. Qed.
+
+Lemma nsum_zero : forall k g, (forall i, i < k -> g i = 0) -> nsum k g = 0.
+Proof. intros k g H. rewrite (nsum_ext k g (fun _ => 0)) by exact H. rewrite nsum_const. lia. Qed.
+
+Lemma nsum_one : forall k g j, j < k -> (forall i, i < k -> i <> j -> g i = 0) -> nsum k g = g j.
+Proof.
+  induction k as [|k IH]; intros g j Hj H; [lia|]. cbn [nsum]. destruct (Nat.eq_dec j k) as [->|E].
+  - rewrite nsum_zero; [lia|]. intros i Hi. apply H; lia.
+  - rewrite (IH g j) by (lia || (intros i Hi Hne; apply H; lia)). rewrite (H k) by lia. lia.
+Qed.
+
+Lemma nsum_swap : forall a b (f : nat -> nat -> nat), nsum a (fun i => nsum b (f i)) = nsum b (fun j => nsum a (fun i => f i j)).
+Proof.
+  induction a as [|a IH]; intros b f; cbn [nsum].
+  - symmetry. apply nsum_zero. reflexivity.
+  - rewrite IH, <- nsum_add. reflexivity.
+Qed.
+
+Lemma nsum_eq_split : forall k a u v, a < k -> nsum k (fun j => if Nat.eqb j a then u else v) = (k - 1) * v + u.
+Proof.
+  induction k as [|k IH]; intros a u v Ha; [lia|]. cbn [nsum]. destruct (Nat.eqb_spec k a) as [<-|E].
+  - rewrite (nsum_ext k _ (fun _ => v)) by (intros i Hi; destruct (Nat.eqb_spec i k); [lia | reflexivity]).
+    rewrite nsum_const. lia.
+  - rewrite IH by lia. destruct k; [lia|]. lia.
+Qed.
+
+Lemma nsum_lt_split : forall k a u v, a <= k -> nsum k (fun j => if j <? a then u else v) = a * u + (k - a) * v.
+Proof.
+  intros k a u v Ha. replace k with (a + (k - a)) at 1 by lia. rewrite nsum_split.
+  rewrite (nsum_ext a _ (fun _ => u)) by (intros i Hi; destruct (Nat.ltb_spec i a); [reflexivity | lia]).
+  rewrite (nsum_ext (k - a) _ (fun _ => v)) by (intros i Hi; destruct (Nat.ltb_spec (a + i) a); [lia | reflexivity]).
+  rewrite !nsum_const. lia.
+Qed.
+
+Lemma nsum_succ : forall k g, nsum (S k) g = nsum k g + g k.
+Proof. reflexivity. Qed.
+
+Lemma nsum_mulc : forall k f c, nsum k (fun i => f i * c) = nsum k f * c.
+Proof. induction k as [|k IH]; intros f c; cbn [nsum]; [reflexivity|]. rewrite IH. lia. Qed.
+
+Lemma fold_nsum_seq : forall m (f : nat -> nat), fold_right Nat.add 0 (map f (seq 0 m)) = nsum m f.
+Proof.
+  assert (G : forall l c, fold_right Nat.add c l = fold_right Nat.add 0 l + c)
+    by (induction l as [|y l IHl]; intro c; cbn [fold_right]; [reflexivity | rewrite IHl; lia]).
+  induction m as [|m IH]; intro f; [reflexivity|]. rewrite seq_S, map_app, fold_right_app. cbn [map fold_right nsum].
+  rewrite G, IH. cbn [Nat.add]. lia.
+Qed.
+
+Lemma length_filter_seq : forall (f : nat -> bool) a k, length (filter f (seq a k)) = nsum k (fun i => Nat.b2n (f (a + i))).
+Proof.
+  intros f a k. revert a. induction k as [|k IH]; intro a; [reflexivity|].
+  rewrite seq_S, filter_app, length_app, IH. cbn [nsum filter]. destruct (f (a + k)); cbn [length Nat.b2n]; lia.
+Qed.
+
+Definition usu (bs : list block) (x : sref) : su := match x with SIn _ => su0 | SRef b j r => sunit bs b j r end.
+
+(* ---- the rows of a layered map by their sources ------------------------------------------------------------ *)
+Definition isUn (c : src) : bool := match c with Un _ => true | Cp _ => false end.
+Definition rowlen (us : list tu) (n : nat) (c : src) : nat := match c with Cp _ => 1 | Un s => length (tin (nth (s - n) us tu0)) end.
+
+Lemma count_Un : forall (L : list src) n m, (forall s, In (Un s) L -> n <= s < n + m) ->
+  length (filter isUn L) = nsum m (fun k => length (filter (isun (n + k)) L)).
+Proof.
+  induction L as [|c t IH]; intros n m H; cbn [filter length].
+  - symmetry. apply nsum_zero. reflexivity.
+  - rewrite (nsum_ext m _ (fun k => (if isun (n + k) c then 1 else 0) + length (filter (isun (n + k)) t)))
+      by (intros k _; cbn [filter]; destruct (isun (n + k) c); reflexivity).
+    rewrite nsum_add, <- IH by (intros s Hs; apply H; right; exact Hs).
+    destruct c as [s|s]; cbn [isUn isun].
+    + rewrite nsum_zero by reflexivity. lia.
+    + specialize (H s (or_introl eq_refl)). rewrite (nsum_one m _ (s - n)); [| lia |].
+      * replace (n + (s - n)) with s by lia. rewrite Nat.eqb_refl. cbn [length]. lia.
+      * intros k Hk E. destruct (Nat.eqb_spec s (n + k)); [lia | reflexivity].
+Qed.
+
+Lemma sum_rowlen : forall (L : list src) us n m, (forall s, In (Un s) L -> n <= s < n + m) ->
+  fold_right Nat.add 0 (map (rowlen us n) L)
+  = length (filter (fun c => negb (isUn c)) L) + nsum m (fun k => length (filter (isun (n + k)) L) * length (tin (nth k us tu0))).
+Proof.
+  induction L as [|c t IH]; intros us n m H; cbn [map fold_right filter length].
+  - rewrite nsum_zero by reflexivity. reflexivity.
+  - rewrite (nsum_ext m _ (fun k => (if isun (n + k) c then length (tin (nth k us tu0)) else 0)
+                                     + length (filter (isun (n + k)) t) * length (tin (nth k us tu0))))
+      by (intros k _; cbn [filter]; destruct (isun (n + k) c); cbn [length]; lia).
+    rewrite nsum_add, (IH us n m) by (intros s Hs; apply H; right; exact Hs).
+    destruct c as [s|s]; cbn [isUn isun negb rowlen].
+    + rewrite (nsum_zero m (fun _ => 0)) by reflexivity. cbn [length]. lia.
+    + specialize (H s (or_introl eq_refl)).
+      rewrite (nsum_one m (fun k => if Nat.eqb s (n + k) then length (tin (nth k us tu0)) else 0) (s - n)); [| lia |].
+      * replace (n + (s - n)) with s by lia. rewrite Nat.eqb_refl. lia.
+      * intros k Hk E. destruct (Nat.eqb_spec s (n + k)); [lia | reflexivity].
+Qed.
+
+Lemma fold_add : forall (l : list nat) c, fold_right Nat.add c l = fold_right Nat.add 0 l + c.
+Proof. induction l as [|a t IH]; intro c; cbn [fold_right]; [reflexivity|]. rewrite IH. lia. Qed.
+
+Lemma fold_add_app : forall (l1 l2 : list nat), fold_right Nat.add 0 (l1 ++ l2) = fold_right Nat.add 0 l1 + fold_right Nat.add 0 l2.
+Proof. intros l1 l2. rewrite fold_right_app, fold_add. lia. Qed.
+
+(* the rows of Lev(N) and their entries, by their sources *)
+Lemma lev_rowcount : forall n us nx, length (concat (lev n us nx)) = length (concat (map snd (lsrc n us nx))).
+Proof.
+  intros n us nx. unfold lev. induction (lsrc n us nx) as [|[l cs] P IH]; [reflexivity|].
+  cbn [map concat fst snd]. rewrite !length_app, length_map, IH. reflexivity.
+Qed.
+
+Lemma lev_rowlens : forall n us nx,
+  fold_right Nat.add 0 (map (fun row => length (tin row)) (concat (lev n us nx)))
+  = fold_right Nat.add 0 (map (rowlen us n) (concat (map snd (lsrc n us nx)))).
+Proof.
+  intros n us nx. unfold lev. induction (lsrc n us nx) as [|[l cs] P IH]; [reflexivity|].
+  cbn [map concat fst snd]. rewrite !map_app, !fold_add_app, IH. f_equal. f_equal. rewrite map_map.
+  apply map_ext. intros [s|s]; cbn [mkrow rowlen idr reidx tin]; [reflexivity|]. apply length_map.
+Qed.
+
+Lemma boff_S_gen : forall bs b, b < length bs -> boff bs (S b) = boff bs b + bcount (nth b bs blk0) * bsize (nth b bs blk0).
+Proof.
+  induction bs as [|blk t IH]; intros b Hb; cbn [length] in Hb; [lia|].
+  destruct b as [|b]; cbn [boff nth]; [assert (boff t 0 = 0) by (destruct t; reflexivity); lia|]. rewrite IH by lia. lia.
+Qed.
+
+Definition isref (x : sref) : bool := match x with SIn _ => false | SRef _ _ _ => true end.
+
+Section BL.
+Variable bs : list block.
+Variable n : nat.
+Variable out : nat -> sref.
+Hypothesis Hwf : wf bs n.
+Hypothesis Hout : forall i, i < n -> valid bs n (out i).
+
+Definition fus : list tu := compile n bs.
+Definition fnx : list nat := map (fun i => idx n bs (out i)) (seq 0 n).
+Definition nun : nat := boff bs (length bs).
+
+Definition cnt (b : nat) : nat := bcount (nth b bs blk0).
+Definition sz (b : nat) : nat := bsize (nth b bs blk0).
+
+(* the sum of g over the units, block by block *)
+Definition bsum (g : sref -> nat) : nat := nsum (length bs) (fun b => nsum (cnt b) (fun j => nsum (sz b) (fun r => g (SRef b j r)))).
+
+Lemma shaped_all : Forall shaped bs.
+Proof. exact (proj1 Hwf). Qed.
+
+Lemma fus_len : length fus = nun.
+Proof. unfold fus, nun. apply length_compile. exact shaped_all. Qed.
+
+Lemma fwfn : wfn n fus.
+Proof. intros k Hk. exact (wf_reads_below bs n Hwf k Hk). Qed.
+
+Lemma fnx_len : length fnx = n.
+Proof. unfold fnx. rewrite length_map, length_seq. reflexivity. Qed.
+
+Lemma boff_S : forall b, b < length bs -> boff bs (S b) = boff bs b + cnt b * sz b.
+Proof. intros b Hb. unfold cnt, sz. apply boff_S_gen. exact Hb. Qed.
+
+Lemma nsum_units : forall (g : nat -> nat), nsum nun g = bsum (fun x => match x with SRef b j r => g (boff bs b + sz b * j + r) | SIn _ => 0 end).
+Proof.
+  intro g. unfold nun, bsum.
+  assert (G : forall k, k <= length bs -> nsum (boff bs k) g
+            = nsum k (fun b => nsum (cnt b) (fun j => nsum (sz b) (fun r => g (boff bs b + sz b * j + r))))).
+  { induction k as [|k IH]; intro Hk; [destruct bs; reflexivity|].
+    rewrite boff_S by lia. cbn [nsum]. rewrite nsum_split, IH by lia. f_equal.
+    rewrite (Nat.mul_comm (cnt k) (sz k)) at 1. rewrite Nat.mul_comm, nsum_mul. apply nsum_ext. intros j Hj.
+    apply nsum_ext. intros r Hr. f_equal. lia. }
+  apply G. lia.
+Qed.
+
+Lemma nsum_bsum_swap : forall m (g : nat -> sref -> nat), nsum m (fun l => bsum (g l)) = bsum (fun x => nsum m (fun l => g l x)).
+Proof.
+  intros m g. unfold bsum. rewrite nsum_swap. apply nsum_ext. intros b _. rewrite nsum_swap. apply nsum_ext.
+  intros j _. apply nsum_swap.
+Qed.
+
+Lemma bsum_ext : forall g1 g2, (forall b j r, valid bs n (SRef b j r) -> g1 (SRef b j r) = g2 (SRef b j r)) ->
+  bsum g1 = bsum g2.
+Proof.
+  intros g1 g2 H. unfold bsum. apply nsum_ext. intros b Hb. apply nsum_ext. intros j Hj. apply nsum_ext. intros r Hr.
+  apply H. split; [exact Hb | split; [exact Hj | exact Hr]].
+Qed.
+
+(* locating a unit *)
+Lemma loc : forall k, k < nun -> exists b j r, valid bs n (SRef b j r) /\ k = boff bs b + sz b * j + r.
+Proof.
+  unfold nun, sz, valid. pose proof shaped_all as Hsh. clear -Hsh. intros k Hk. revert k Hk.
+  induction Hsh as [|blk t Hs Ht IH]; intros k Hk; cbn [boff length] in Hk; [lia|].
+  destruct (Nat.lt_ge_cases k (bcount blk * bsize blk)) as [Hl|Hg].
+  - exists 0, (k / bsize blk), (k mod bsize blk).
+    assert (bsize blk <> 0) by (intro E; rewrite E in Hl; lia).
+    cbn [nth length boff]. split; [split; [lia|]; split; [apply Nat.Div0.div_lt_upper_bound; nia | apply Nat.mod_upper_bound; exact H]|].
+    rewrite (Nat.div_mod k (bsize blk)) at 1 by exact H. lia.
+  - destruct (IH (k - bcount blk * bsize blk) ltac:(lia)) as (b & j & r & (Hb & Hj & Hr) & Hk').
+    exists (S b), j, r. cbn [nth length boff]. split; [split; [lia|]; split; assumption|]. lia.
+Qed.
+
+Lemma idx_ref : forall b j r, idx n bs (SRef b j r) = n + (boff bs b + sz b * j + r).
+Proof. intros b j r. cbn [idx]. unfold sz. lia. Qed.
+
+Lemma fus_nth : forall b j r, valid bs n (SRef b j r) ->
+  nth (boff bs b + sz b * j + r) fus tu0 = flat_unit n bs (sunit bs b j r).
+Proof. intros b j r (Hb & Hj & Hr). unfold fus, sz. apply compile_nth; [exact shaped_all | exact Hb | exact Hj | exact Hr]. Qed.
+
+Lemma unit_lt : forall b j r, valid bs n (SRef b j r) -> boff bs b + sz b * j + r < nun.
+Proof.
+  intros b j r Hv. pose proof (idx_lt_total bs n (SRef b j r) Hv) as H. rewrite idx_ref in H. unfold nun. lia.
+Qed.
+
+(* the units and the edges, block by block *)
+Lemma units_bsum : length fus = bsum (fun _ => 1).
+Proof.
+  rewrite fus_len. rewrite <- (Nat.mul_1_r nun) at 1. rewrite <- nsum_const, nsum_units.
+  apply bsum_ext. reflexivity.
+Qed.
+
+Lemma edges_bsum : nsum (length fus) (fun k => length (tin (nth k fus tu0))) = bsum (fun x => length (sin (usu bs x))).
+Proof.
+  rewrite fus_len, nsum_units. apply bsum_ext. intros b j r Hv. cbn [usu].
+  rewrite fus_nth by exact Hv. unfold flat_unit. cbn [tin]. apply length_map.
+Qed.
+
+(* the predecessors of a unit are valid signals with smaller indices *)
+Lemma pred_ok : forall b j r x z, valid bs n (SRef b j r) -> In (x, z) (sin (sunit bs b j r)) ->
+  valid bs n x /\ idx n bs x < idx n bs (SRef b j r).
+Proof.
+  intros b j r x z Hv Hin. destruct Hv as (Hb & Hj & Hr). destruct Hwf as [Hsh Hrd].
+  pose proof (Hrd b j r x z Hb Hj Hr Hin) as Hbk. destruct x as [i|b' j' r']; cbn [reads_back valid] in *.
+  - split; [exact Hbk|]. cbn [idx]. lia.
+  - destruct Hbk as [(Hb' & Hj' & Hr')|(-> & -> & Hr')].
+    + split; [split; [lia|]; split; assumption|].
+      pose proof (boff_mono bs b b' Hb' ltac:(lia)) as Hm. cbn [idx]. nia.
+    + split; [split; [lia|]; split; lia|]. cbn [idx]. lia.
+Qed.
+
+Lemma idx_inj : forall x y, valid bs n x -> valid bs n y -> idx n bs x = idx n bs y -> x = y.
+Proof.
+  assert (L : forall b j r b' j' r', valid bs n (SRef b j r) -> valid bs n (SRef b' j' r') -> b < b' ->
+            idx n bs (SRef b j r) < idx n bs (SRef b' j' r')).
+  { intros b j r b' j' r' (_ & Hj & Hr) (Hb' & _ & _) Hlt.
+    pose proof (boff_mono bs b' b Hlt ltac:(lia)) as Hm. cbn [idx]. nia. }
+  intros [i|b j r] [i'|b' j' r'] Hx Hy E; cbn [idx valid] in E, Hx, Hy.
+  - congruence.
+  - lia.
+  - lia.
+  - destruct (Nat.lt_trichotomy b b') as [Hlt|[<-|Hgt]].
+    + pose proof (L b j r b' j' r' Hx Hy Hlt). cbn [idx] in *. lia.
+    + assert (Hs : bsize (nth b bs blk0) * j + r = bsize (nth b bs blk0) * j' + r') by lia.
+      destruct Hx as (_ & _ & Hr), Hy as (_ & _ & Hr').
+      destruct (Nat.lt_trichotomy j j') as [Hj|[<-|Hj]]; [nia | | nia].
+      assert (r = r') by lia. subst. reflexivity.
+    + pose proof (L b' j' r' b j r Hy Hx Hgt). cbn [idx] in *. lia.
+Qed.
+
+(* ---- depths ----------------------------------------------------------------------------------------- *)
+Lemma dep_su : forall b j r, valid bs n (SRef b j r) ->
+  dep n fus (idx n bs (SRef b j r)) = S (maxl (map (fun p => dep n fus (idx n bs (fst p))) (sin (sunit bs b j r)))).
+Proof.
+  intros b j r Hv. rewrite idx_ref. rewrite dep_unit; [| exact fwfn | rewrite fus_len; exact (unit_lt b j r Hv)].
+  rewrite fus_nth by exact Hv. unfold flat_unit. cbn [tin]. rewrite map_map. reflexivity.
+Qed.
+
+(* the depth recursion from bounds on each unit: every predecessor lies below it, one of them just below *)
+Lemma cd_rec : forall (cd : sref -> nat) (u : su) c,
+  (forall p z, In (p, z) (sin u) -> S (cd p) <= c) -> (exists p z, In (p, z) (sin u) /\ S (cd p) = c) ->
+  c = S (maxl (map (fun p => cd (fst p)) (sin u))).
+Proof.
+  intros cd u c Hle (p0 & z0 & Hin0 & E0). apply Nat.le_antisymm.
+  - rewrite <- E0. apply le_n_S. apply maxl_ge. apply in_map_iff. exists (p0, z0). split; [reflexivity | exact Hin0].
+  - assert (maxl (map (fun p => cd (fst p)) (sin u)) <= c - 1); [|lia].
+    apply maxl_le. intros a Ha. apply in_map_iff in Ha as ([p z] & <- & Hin). specialize (Hle p z Hin). cbn [fst]. lia.
+Qed.
+
+Section Depth.
+Variable cd : sref -> nat.
+Hypothesis Hcd0 : forall i, cd (SIn i) = 0.
+Hypothesis Hcd : forall b j r, valid bs n (SRef b j r) ->
+  cd (SRef b j r) = S (maxl (map (fun p => cd (fst p)) (sin (sunit bs b j r)))).
+
+Theorem dep_cd : forall x, valid bs n x -> dep n fus (idx n bs x) = cd x.
+Proof.
+  assert (G : forall k x, idx n bs x < k -> valid bs n x -> dep n fus (idx n bs x) = cd x).
+  { induction k as [|k IH]; intros x Hk Hv; [lia|]. destruct x as [i|b j r].
+    - cbn [idx]. rewrite Hcd0. apply dep_state. exact Hv.
+    - rewrite dep_su by exact Hv. rewrite Hcd by exact Hv. f_equal. f_equal. apply map_ext_in. intros [p z] Hin.
+      cbn [fst]. destruct (pred_ok b j r p z Hv Hin) as [Hvp Hlt]. apply IH; [lia | exact Hvp]. }
+  intros x Hv. exact (G (S (idx n bs x)) x (Nat.lt_succ_diag_r _) Hv).
+Qed.
+
+Theorem dmax_cd : forall D, (forall b j r, valid bs n (SRef b j r) -> cd (SRef b j r) <= D) ->
+  (exists b j r, valid bs n (SRef b j r) /\ cd (SRef b j r) = D) -> dmax n fus = D.
+Proof.
+  intros D Hle (b0 & j0 & r0 & Hv0 & E0). apply Nat.le_antisymm.
+  - apply maxl_le. intros a Ha. apply in_map_iff in Ha as (k & <- & Hk). apply in_seq in Hk. rewrite fus_len in Hk.
+    destruct (loc k ltac:(lia)) as (b & j & r & Hv & ->). rewrite <- idx_ref, dep_cd by exact Hv. apply Hle. exact Hv.
+  - rewrite <- E0, <- (dep_cd _ Hv0), idx_ref. apply maxl_ge. apply in_map_iff. exists (boff bs b0 + sz b0 * j0 + r0).
+    split; [reflexivity|]. apply in_seq. rewrite fus_len. pose proof (unit_lt b0 j0 r0 Hv0). lia.
+Qed.
+
+End Depth.
+
+(* ---- every unit contributes to a next value ---------------------------------------------------------- *)
+Section Need.
+Hypothesis Hrd : forall b j r, valid bs n (SRef b j r) -> (exists i, i < n /\ out i = SRef b j r) \/
+  (exists b' j' r' z, valid bs n (SRef b' j' r') /\ In (SRef b j r, z) (sin (sunit bs b' j' r'))).
+
+Theorem need_all : forall b j r, valid bs n (SRef b j r) -> need n fus fnx (idx n bs (SRef b j r)) = true.
+Proof.
+  assert (G : forall k b j r, n + nun - idx n bs (SRef b j r) < k -> valid bs n (SRef b j r) ->
+            need n fus fnx (idx n bs (SRef b j r)) = true).
+  { induction k as [|k IH]; intros b j r Hk Hv; [lia|].
+    destruct (Hrd b j r Hv) as [(i & Hi & Ei)|(b' & j' & r' & z & Hvr & Hin)].
+    - apply need_nx. unfold fnx. apply in_map_iff. exists i. split; [rewrite Ei; reflexivity | apply in_seq; lia].
+    - destruct (pred_ok b' j' r' (SRef b j r) z Hvr Hin) as [_ Hlt].
+      assert (Hn' : need n fus fnx (idx n bs (SRef b' j' r')) = true).
+      { apply IH; [| exact Hvr]. pose proof (idx_lt_total bs n _ Hvr). unfold nun in *. lia. }
+      rewrite idx_ref in Hn'. apply (need_pred n fus fnx fwfn (boff bs b' + sz b' * j' + r') (idx n bs (SRef b j r)) z).
+      + rewrite fus_len. exact (unit_lt b' j' r' Hvr).
+      + exact Hn'.
+      + rewrite fus_nth by exact Hvr. unfold flat_unit. cbn [tin]. apply in_map_iff. exists (SRef b j r, z).
+        split; [reflexivity | exact Hin]. }
+  intros b j r Hv. apply (G (S (n + nun)) b j r); [lia | exact Hv].
+Qed.
+
+End Need.
+
+(* ---- the last layer that reads each signal ------------------------------------------------------------- *)
+Lemma reads_su : forall b j r x, valid bs n (SRef b j r) -> valid bs n x ->
+  reads fus (boff bs b + sz b * j + r) (idx n bs x) = true <-> exists z, In (x, z) (sin (sunit bs b j r)).
+Proof.
+  intros b j r x Hv Hx. rewrite reads_in. rewrite fus_nth by exact Hv. unfold flat_unit. cbn [tin]. split.
+  - intros (z & Hin). apply in_map_iff in Hin as ([p z'] & E & Hin). cbn [fst snd] in E. injection E as Ep <-.
+    exists z'. destruct (pred_ok b j r p z' Hv Hin) as [Hvp _]. rewrite (idx_inj p x Hvp Hx Ep) in Hin. exact Hin.
+  - intros (z & Hin). exists z. apply in_map_iff. exists (x, z). split; [reflexivity | exact Hin].
+Qed.
+
+Section Lam.
+Variable cd : sref -> nat.
+Hypothesis Hdep : forall x, valid bs n x -> dep n fus (idx n bs x) = cd x.
+Hypothesis Hneed : forall b j r, valid bs n (SRef b j r) -> need n fus fnx (idx n bs (SRef b j r)) = true.
+Variable D : nat.
+Hypothesis HD : dmax n fus = D.
+Variable cl : sref -> nat.
+Hypothesis Hup : forall b j r p z, valid bs n (SRef b j r) -> In (p, z) (sin (sunit bs b j r)) -> cd (SRef b j r) <= cl p.
+Hypothesis Hcl_out : forall i, i < n -> cl (out i) = S D.
+Hypothesis Hlow : forall x, valid bs n x -> (forall i, i < n -> out i <> x) ->
+  cl x = 0 \/ exists b j r z, valid bs n (SRef b j r) /\ In (x, z) (sin (sunit bs b j r)) /\ cd (SRef b j r) = cl x.
+
+Lemma unit_dep_le : forall k, k < nun -> dep n fus (n + k) <= D.
+Proof. intros k Hk. rewrite <- HD. apply dep_le_dmax. rewrite fus_len. exact Hk. Qed.
+
+Theorem lam_cl : forall x, valid bs n x -> lam n fus fnx (idx n bs x) = cl x.
+Proof.
+  intros x Hx. unfold lam.
+  (* the readers *)
+  assert (Hr : maxl (map (fun k => if need n fus fnx (n + k) && reads fus k (idx n bs x) then dep n fus (n + k) else 0)
+                         (seq 0 (length fus))) <= cl x).
+  { apply maxl_le. intros a Ha. apply in_map_iff in Ha as (k & <- & Hk). apply in_seq in Hk. rewrite fus_len in Hk.
+    destruct (loc k ltac:(lia)) as (b & j & r & Hv & ->).
+    destruct (need n fus fnx _ && reads fus _ (idx n bs x)) eqn:E; [|lia].
+    apply andb_true_iff in E as [_ E]. apply (reads_su b j r x Hv Hx) in E as (z & Hin).
+    rewrite <- idx_ref, Hdep by exact Hv. exact (Hup b j r x z Hv Hin). }
+  destruct (existsb (Nat.eqb (idx n bs x)) fnx) eqn:Eo.
+  - apply existsb_exists in Eo as (s & Hs & E). apply Nat.eqb_eq in E. unfold fnx in Hs.
+    apply in_map_iff in Hs as (i & Ei & Hi). apply in_seq in Hi. rewrite <- Ei in E.
+    apply (idx_inj x (out i) Hx (Hout i ltac:(lia))) in E. subst x. rewrite Hcl_out by lia. rewrite HD.
+    apply Nat.max_l. eapply Nat.le_trans; [|apply Nat.le_succ_diag_r]. apply maxl_le. intros a Ha.
+    apply in_map_iff in Ha as (k & <- & Hk). apply in_seq in Hk. rewrite fus_len in Hk.
+    destruct (_ && _); [apply unit_dep_le; lia | lia].
+  - cbn [Nat.max]. apply Nat.le_antisymm; [exact Hr|].
+    assert (Hno : forall i, i < n -> out i <> x).
+    { intros i Hi E. subst x. assert (existsb (Nat.eqb (idx n bs (out i))) fnx = true) as C.
+      { apply existsb_exists. exists (idx n bs (out i)). split; [|apply Nat.eqb_refl].
+        unfold fnx. apply in_map_iff. exists i. split; [reflexivity | apply in_seq; lia]. }
+      rewrite C in Eo. discriminate. }
+    destruct (Hlow x Hx Hno) as [Z|(b & j & r & z & Hv & Hin & E)]; [rewrite Z; lia|].
+    rewrite <- E. apply maxl_ge. apply in_map_iff. exists (boff bs b + sz b * j + r).
+    split; [|apply in_seq; rewrite fus_len; pose proof (unit_lt b j r Hv); lia].
+    rewrite <- idx_ref, Hneed by exact Hv.
+    replace (reads fus (boff bs b + sz b * j + r) (idx n bs x)) with true
+      by (symmetry; apply (reads_su b j r x Hv Hx); exists z; exact Hin).
+    cbn [andb]. apply Hdep. exact Hv.
+Qed.
+
+(* the rows of layer l: the units of depth l and the copies of the signals of smaller depth read after l *)
+Theorem live_cl : forall l x, valid bs n x ->
+  live n fus fnx l (idx n bs x) = isref x && Nat.eqb (cd x) l || Nat.ltb (cd x) l && Nat.ltb l (cl x).
+Proof.
+  intros l x Hx. unfold live, isunit. rewrite Hdep, lam_cl by exact Hx. destruct x as [i|b j r].
+  - cbn [idx isref valid] in *. destruct (Nat.leb_spec n i); [lia|]. reflexivity.
+  - rewrite Hneed by exact Hx. rewrite idx_ref. destruct (Nat.leb_spec n (n + (boff bs b + sz b * j + r))); [|lia].
+    cbn [isref andb]. rewrite andb_true_r. reflexivity.
+Qed.
+
+Theorem width_bsum : forall l, 1 <= l ->
+  width n fus fnx l = nsum n (fun i => Nat.b2n (Nat.ltb (cd (SIn i)) l && Nat.ltb l (cl (SIn i))))
+                      + bsum (fun x => Nat.b2n (Nat.eqb (cd x) l || Nat.ltb (cd x) l && Nat.ltb l (cl x))).
+Proof.
+  intros [|l] Hl; [lia|]. cbn [width]. unfold NS. rewrite fus_len, seq_app, filter_app, length_app.
+  rewrite !length_filter_seq. f_equal.
+  - apply nsum_ext. intros i Hi. cbn [Nat.add]. replace i with (idx n bs (SIn i)) at 1 by reflexivity.
+    rewrite live_cl by (cbn [valid]; exact Hi). reflexivity.
+  - rewrite nsum_units. unfold bsum. apply nsum_ext. intros b Hb. apply nsum_ext. intros j Hj. apply nsum_ext.
+    intros r Hr. assert (Hv : valid bs n (SRef b j r)) by (split; [exact Hb | split; [exact Hj | exact Hr]]).
+    replace (0 + n + (boff bs b + sz b * j + r)) with (idx n bs (SRef b j r)) by (rewrite idx_ref; lia).
+    rewrite live_cl by exact Hv. reflexivity.
+Qed.
+
+End Lam.
+
+(* ---- netlists with units that contribute to nothing ------------------------------------------------------ *)
+Section Need2.
+Variable nd : sref -> bool.
+Hypothesis Hnd_up : forall b j r, valid bs n (SRef b j r) -> nd (SRef b j r) = true ->
+  (exists i, i < n /\ out i = SRef b j r) \/
+  (exists b' j' r' z, valid bs n (SRef b' j' r') /\ nd (SRef b' j' r') = true /\ In (SRef b j r, z) (sin (sunit bs b' j' r'))).
+Hypothesis Hnd_down : forall b j r, valid bs n (SRef b j r) -> nd (SRef b j r) = false ->
+  (forall i, i < n -> out i <> SRef b j r) /\
+  forall b' j' r' z, valid bs n (SRef b' j' r') -> In (SRef b j r, z) (sin (sunit bs b' j' r')) -> nd (SRef b' j' r') = false.
+
+Theorem need_eq : forall b j r, valid bs n (SRef b j r) -> need n fus fnx (idx n bs (SRef b j r)) = nd (SRef b j r).
+Proof.
+  assert (G : forall m b j r, n + nun - idx n bs (SRef b j r) < m -> valid bs n (SRef b j r) ->
+            need n fus fnx (idx n bs (SRef b j r)) = nd (SRef b j r)).
+  { induction m as [|m IH]; intros b j r Hm Hv; [lia|]. pose proof (idx_lt_total bs n _ Hv) as Hlt.
+    destruct (nd (SRef b j r)) eqn:Hnd.
+    - destruct (Hnd_up b j r Hv Hnd) as [(i & Hi & Ei)|(b' & j' & r' & z & Hv' & Hn' & Hin)].
+      + apply need_nx. unfold fnx. apply in_map_iff. exists i. split; [rewrite Ei; reflexivity | apply in_seq; lia].
+      + destruct (pred_ok b' j' r' (SRef b j r) z Hv' Hin) as [_ Hl].
+        pose proof (idx_lt_total bs n _ Hv').
+        assert (Hn'' : need n fus fnx (idx n bs (SRef b' j' r')) = true)
+          by (rewrite (IH b' j' r'); [exact Hn' | unfold nun in *; lia | exact Hv']).
+        rewrite idx_ref in Hn''. apply (need_pred n fus fnx fwfn (boff bs b' + sz b' * j' + r') _ z).
+        * rewrite fus_len. exact (unit_lt b' j' r' Hv').
+        * exact Hn''.
+        * rewrite fus_nth by exact Hv'. unfold flat_unit. cbn [tin]. apply in_map_iff. exists (SRef b j r, z).
+          split; [reflexivity | exact Hin].
+    - destruct (need n fus fnx (idx n bs (SRef b j r))) eqn:E; [|reflexivity]. exfalso.
+      destruct (Hnd_down b j r Hv Hnd) as [Hno Hrd].
+      destruct (needf_step fus n _ _ E) as [H0|(k & z & Hk & Hk2 & Hin)].
+      + apply existsb_exists in H0 as (s & Hs & Es). apply Nat.eqb_eq in Es. unfold fnx in Hs.
+        apply in_map_iff in Hs as (i & Ei & Hi). apply in_seq in Hi. rewrite <- Ei in Es.
+        apply (Hno i ltac:(lia)). symmetry. exact (idx_inj _ _ Hv (Hout i ltac:(lia)) Es).
+      + rewrite fus_len in Hk. destruct (loc k Hk) as (b' & j' & r' & Hv' & ->).
+        rewrite fus_nth in Hin by exact Hv'. unfold flat_unit in Hin. cbn [tin] in Hin.
+        apply in_map_iff in Hin as ([p z'] & Ep & Hin). cbn [fst snd] in Ep. injection Ep as Ep _.
+        destruct (pred_ok b' j' r' p z' Hv' Hin) as [Hvp Hl].
+        rewrite (idx_inj _ _ Hvp Hv Ep) in Hin, Hl.
+        pose proof (Hrd b' j' r' z' Hv' Hin) as Hf. pose proof (idx_lt_total bs n _ Hv').
+        change (need n fus fnx (n + (boff bs b' + sz b' * j' + r')) = true) in Hk2.
+        rewrite <- idx_ref, (IH b' j' r') in Hk2; [rewrite Hf in Hk2; discriminate | unfold nun in *; lia | exact Hv']. }
+  intros b j r Hv. apply (G (S (n + nun)) b j r); [lia | exact Hv].
+Qed.
+
+End Need2.
+
+Section Lam2.
+Variable cd : sref -> nat.
+Hypothesis Hdep : forall x, valid bs n x -> dep n fus (idx n bs x) = cd x.
+Variable nd : sref -> bool.
+Hypothesis Hneed : forall b j r, valid bs n (SRef b j r) -> need n fus fnx (idx n bs (SRef b j r)) = nd (SRef b j r).
+Variable D : nat.
+Hypothesis HD : dmax n fus = D.
+Variable cl : sref -> nat.
+Hypothesis Hup : forall b j r p z, valid bs n (SRef b j r) -> nd (SRef b j r) = true ->
+  In (p, z) (sin (sunit bs b j r)) -> cd (SRef b j r) <= cl p.
+Hypothesis Hcl_out : forall i, i < n -> cl (out i) = S D.
+Hypothesis Hlow : forall x, valid bs n x -> (forall i, i < n -> out i <> x) ->
+  cl x = 0 \/ exists b j r z, valid bs n (SRef b j r) /\ nd (SRef b j r) = true /\ In (x, z) (sin (sunit bs b j r))
+                             /\ cd (SRef b j r) = cl x.
+
+Theorem lam_cl2 : forall x, valid bs n x -> lam n fus fnx (idx n bs x) = cl x.
+Proof.
+  intros x Hx. unfold lam.
+  assert (Hr : maxl (map (fun k => if need n fus fnx (n + k) && reads fus k (idx n bs x) then dep n fus (n + k) else 0)
+                         (seq 0 (length fus))) <= cl x).
+  { apply maxl_le. intros a Ha. apply in_map_iff in Ha as (k & <- & Hk). apply in_seq in Hk. rewrite fus_len in Hk.
+    destruct (loc k ltac:(lia)) as (b & j & r & Hv & ->).
+    destruct (need n fus fnx _ && reads fus _ (idx n bs x)) eqn:E; [|lia].
+    apply andb_true_iff in E as [E1 E]. apply (reads_su b j r x Hv Hx) in E as (z & Hin).
+    rewrite <- idx_ref, Hneed in E1 by exact Hv.
+    rewrite <- idx_ref, Hdep by exact Hv. exact (Hup b j r x z Hv E1 Hin). }
+  destruct (existsb (Nat.eqb (idx n bs x)) fnx) eqn:Eo.
+  - apply existsb_exists in Eo as (s & Hs & E). apply Nat.eqb_eq in E. unfold fnx in Hs.
+    apply in_map_iff in Hs as (i & Ei & Hi). apply in_seq in Hi. rewrite <- Ei in E.
+    apply (idx_inj x (out i) Hx (Hout i ltac:(lia))) in E. subst x. rewrite Hcl_out by lia. rewrite HD.
+    apply Nat.max_l. eapply Nat.le_trans; [|apply Nat.le_succ_diag_r]. apply maxl_le. intros a Ha.
+    apply in_map_iff in Ha as (k & <- & Hk). apply in_seq in Hk. rewrite fus_len in Hk.
+    destruct (_ && _); [rewrite <- HD; apply dep_le_dmax; rewrite fus_len; lia | lia].
+  - cbn [Nat.max]. apply Nat.le_antisymm; [exact Hr|].
+    assert (Hno : forall i, i < n -> out i <> x).
+    { intros i Hi E. subst x. assert (existsb (Nat.eqb (idx n bs (out i))) fnx = true) as C.
+      { apply existsb_exists. exists (idx n bs (out i)). split; [|apply Nat.eqb_refl].
+        unfold fnx. apply in_map_iff. exists i. split; [reflexivity | apply in_seq; lia]. }
+      rewrite C in Eo. discriminate. }
+    destruct (Hlow x Hx Hno) as [Z|(b & j & r & z & Hv & Hn & Hin & E)]; [rewrite Z; lia|].
+    rewrite <- E. apply maxl_ge. apply in_map_iff. exists (boff bs b + sz b * j + r).
+    split; [|apply in_seq; rewrite fus_len; pose proof (unit_lt b j r Hv); lia].
+    rewrite <- idx_ref, Hneed, Hn by exact Hv.
+    replace (reads fus (boff bs b + sz b * j + r) (idx n bs x)) with true
+      by (symmetry; apply (reads_su b j r x Hv Hx); exists z; exact Hin).
+    cbn [andb]. apply Hdep. exact Hv.
+Qed.
+
+Theorem live_cl2 : forall l x, valid bs n x ->
+  live n fus fnx l (idx n bs x) = isref x && nd x && Nat.eqb (cd x) l || Nat.ltb (cd x) l && Nat.ltb l (cl x).
+Proof.
+  intros l x Hx. unfold live, isunit. rewrite Hdep, lam_cl2 by exact Hx. destruct x as [i|b j r].
+  - cbn [idx isref valid] in *. destruct (Nat.leb_spec n i); [lia|]. reflexivity.
+  - rewrite Hneed by exact Hx. rewrite idx_ref. destruct (Nat.leb_spec n (n + (boff bs b + sz b * j + r))); [|lia].
+    cbn [isref andb]. destruct (nd (SRef b j r)), (Nat.eqb (cd (SRef b j r)) l); reflexivity.
+Qed.
+
+(* the rows of the layers 1 .. d - 1, signal by signal *)
+Theorem rows_bsum : forall m, fold_right Nat.add 0 (map (width n fus fnx) (seq 1 m))
+  = nsum n (fun i => nsum m (fun l => Nat.b2n (Nat.ltb (cd (SIn i)) (S l) && Nat.ltb (S l) (cl (SIn i)))))
+    + bsum (fun x => nsum m (fun l => Nat.b2n (nd x && Nat.eqb (cd x) (S l) || Nat.ltb (cd x) (S l) && Nat.ltb (S l) (cl x)))).
+Proof.
+  intro m. rewrite <- (seq_shift m 0), map_map.
+  rewrite (fold_nsum_seq _ (fun l => width n fus fnx (S l))).
+  rewrite (nsum_ext m _ (fun l => nsum n (fun i => Nat.b2n (Nat.ltb (cd (SIn i)) (S l) && Nat.ltb (S l) (cl (SIn i))))
+                                  + bsum (fun x => Nat.b2n (nd x && Nat.eqb (cd x) (S l) || Nat.ltb (cd x) (S l) && Nat.ltb (S l) (cl x))))).
+  - rewrite nsum_add, nsum_swap, nsum_bsum_swap. reflexivity.
+  - intros l _. cbn [width]. unfold NS. rewrite fus_len, seq_app, filter_app, length_app, !length_filter_seq. f_equal.
+    + apply nsum_ext. intros i Hi. cbn [Nat.add]. replace i with (idx n bs (SIn i)) at 1 by reflexivity.
+      rewrite live_cl2 by (cbn [valid]; exact Hi). reflexivity.
+    + rewrite nsum_units. unfold bsum. apply nsum_ext. intros b Hb. apply nsum_ext. intros j Hj. apply nsum_ext.
+      intros r Hr. assert (Hv : valid bs n (SRef b j r)) by (split; [exact Hb | split; [exact Hj | exact Hr]]).
+      replace (0 + n + (boff bs b + sz b * j + r)) with (idx n bs (SRef b j r)) by (rewrite idx_ref; lia).
+      rewrite live_cl2 by exact Hv. cbn [isref andb]. reflexivity.
+Qed.
+
+End Lam2.
+
+End BL.

rocq/Choose.v

@@ -0,0 +1,152 @@
+(* Subsets of a given size and the bound C(m, j) <= (e m / j)^j, for the union bound of Proposition 6.10. *)
+From Stdlib Require Import List Bool Arith Reals Lia Lra.
+Import ListNotations.
+
+Local Open Scope R_scope.
+
+(* ---- the j-element sublists of a list ----------------------------------------------------------------------------- *)
+Fixpoint choose {A : Type} (j : nat) (l : list A) : list (list A) :=
+  match j, l with
+  | O, _ => [[]]
+  | S _, [] => []
+  | S j', a :: t => map (cons a) (choose j' t) ++ choose (S j') t
+  end.
+
+Fixpoint binom (n k : nat) : nat :=
+  match n, k with
+  | _, O => 1
+  | O, S _ => 0
+  | S n', S k' => binom n' k' + binom n' (S k')
+  end.
+
+Lemma length_choose : forall (A : Type) (l : list A) j, length (choose j l) = binom (length l) j.
+Proof.
+  intros A l. induction l as [|a t IH]; intro j; destruct j as [|j]; try reflexivity.
+  cbn [choose length binom]. rewrite length_app, length_map, !IH. reflexivity.
+Qed.
+
+Lemma choose_incl : forall (A : Type) (l : list A) j c, In c (choose j l) -> incl c l.
+Proof.
+  intros A l. induction l as [|a t IH]; intros j c H; destruct j as [|j]; cbn [choose] in H.
+  - destruct H as [<-|[]]. intros x [].
+  - destruct H.
+  - destruct H as [<-|[]]. intros x [].
+  - apply in_app_or in H as [H|H].
+    + apply in_map_iff in H as (c' & <- & H). intros x [<-|Hx]; [left; reflexivity | right; exact (IH j c' H x Hx)].
+    + intros x Hx. right. exact (IH (S j) c H x Hx).
+Qed.
+
+Lemma choose_length : forall (A : Type) (l : list A) j c, In c (choose j l) -> length c = j.
+Proof.
+  intros A l. induction l as [|a t IH]; intros j c H; destruct j as [|j]; cbn [choose] in H.
+  - destruct H as [<-|[]]. reflexivity.
+  - destruct H.
+  - destruct H as [<-|[]]. reflexivity.
+  - apply in_app_or in H as [H|H].
+    + apply in_map_iff in H as (c' & <- & H). cbn [length]. rewrite (IH j c' H). reflexivity.
+    + exact (IH (S j) c H).
+Qed.
+
+Lemma choose_nodup : forall (A : Type) (l : list A) j c, NoDup l -> In c (choose j l) -> NoDup c.
+Proof.
+  intros A l. induction l as [|a t IH]; intros j c Hn H; destruct j as [|j]; cbn [choose] in H.
+  - destruct H as [<-|[]]. constructor.
+  - destruct H.
+  - destruct H as [<-|[]]. constructor.
+  - inversion Hn as [|? ? Ha Ht]; subst. apply in_app_or in H as [H|H].
+    + apply in_map_iff in H as (c' & <- & H). constructor; [|exact (IH j c' Ht H)].
+      intro Hin. apply Ha. exact (choose_incl _ t j c' H a Hin).
+    + exact (IH (S j) c Ht H).
+Qed.
+
+(* if at least j elements satisfy f, a j-element sublist consists of such elements *)
+Lemma choose_spec : forall (A : Type) (f : A -> bool) (l : list A) j, (j <= length (filter f l))%nat ->
+  exists c, In c (choose j l) /\ forall x, In x c -> f x = true.
+Proof.
+  intros A f l. induction l as [|a t IH]; intros j Hj.
+  - cbn [filter length] in Hj. assert (j = 0%nat) by lia. subst. exists []. split; [left; reflexivity | intros x []].
+  - destruct j as [|j]; [exists []; split; [left; reflexivity | intros x []]|].
+    cbn [choose filter] in *. destruct (f a) eqn:Fa.
+    + cbn [length] in Hj. destruct (IH j ltac:(lia)) as (c & Hc & Hf). exists (a :: c). split.
+      * apply in_or_app. left. apply in_map. exact Hc.
+      * intros x [<-|Hx]; [exact Fa | exact (Hf x Hx)].
+    + destruct (IH (S j) Hj) as (c & Hc & Hf). exists c. split; [apply in_or_app; right; exact Hc | exact Hf].
+Qed.
+
+(* ---- C(m, j) j! <= m^j and j^j <= j! e^(j-1) ------------------------------------------------------------------------ *)
+Lemma pow_step : forall m j, ((j + 1) * m ^ j + m ^ (j + 1) <= (m + 1) ^ (j + 1))%nat.
+Proof.
+  intros m j. induction j as [|j IH]; [cbn; lia|].
+  replace (S j + 1)%nat with (S (j + 1)) by lia. rewrite !Nat.pow_succ_r'. replace (j + 1)%nat with (S j) in * by lia.
+  rewrite !Nat.pow_succ_r' in *. nia.
+Qed.
+
+Lemma binom_fact : forall m j, (binom m j * fact j <= m ^ j)%nat.
+Proof.
+  induction m as [|m IH]; intro j; destruct j as [|j]; cbn [binom fact]; try (cbn; lia).
+  pose proof (IH j) as H1. pose proof (IH (S j)) as H2. cbn [fact] in H2. pose proof (pow_step m j) as P.
+  replace (S j) with (j + 1)%nat in * by lia. replace (S m) with (m + 1)%nat by lia. nia.
+Qed.
+
+Lemma exp_pow_nat : forall x n, exp x ^ n = exp (INR n * x).
+Proof.
+  intros x n. induction n as [|n IH]; [cbn [pow INR]; rewrite Rmult_0_l, exp_0; reflexivity|].
+  cbn [pow]. rewrite IH, <- exp_plus, S_INR. f_equal. ring.
+Qed.
+
+Lemma one_plus_pow : forall j, (1 <= j)%nat -> (1 + / INR j) ^ j <= exp 1.
+Proof.
+  intros j Hj. assert (HJ : 0 < INR j) by (apply lt_0_INR; lia).
+  replace (exp 1) with (exp (/ INR j) ^ j) by (rewrite exp_pow_nat; f_equal; field; lra).
+  apply pow_incr. split; [pose proof (Rinv_0_lt_compat _ HJ); lra | apply exp_ineq1_le].
+Qed.
+
+(* j^j / j! <= e^(j-1) for j >= 1 *)
+Lemma pow_fact : forall j, (1 <= j)%nat -> INR j ^ j <= INR (fact j) * exp 1 ^ (j - 1).
+Proof.
+  intros j Hj. induction j as [|j IH]; [lia|]. destruct (Nat.eq_dec j 0) as [->|Hj0]; [cbn; lra|].
+  specialize (IH ltac:(lia)). assert (HJ : 0 < INR j) by (apply lt_0_INR; lia).
+  (* (j+1)^(j+1) / (j+1)! = (j+1)^j / j! = j^j / j! (1 + 1/j)^j *)
+  assert (E : INR (S j) ^ S j = INR (S j) * (INR j ^ j * (1 + / INR j) ^ j)).
+  { rewrite <- Rpow_mult_distr. replace (INR j * (1 + / INR j)) with (INR (S j)) by (rewrite S_INR; field; lra).
+    cbn [pow]. reflexivity. }
+  rewrite E. replace (S j - 1)%nat with (S (j - 1)) by lia. cbn [fact pow]. rewrite mult_INR.
+  pose proof (one_plus_pow j ltac:(lia)) as O. pose proof (pos_INR (S j)).
+  assert (0 <= INR j ^ j) by (apply pow_le; lra). assert (0 <= (1 + / INR j) ^ j) by (apply pow_le; pose proof (Rinv_0_lt_compat _ HJ); lra).
+  assert (0 <= exp 1 ^ (j - 1)) by (apply pow_le; pose proof (exp_pos 1); lra).
+  assert (INR j ^ j * (1 + / INR j) ^ j <= INR (fact j) * exp 1 ^ (j - 1) * exp 1).
+  { apply Rmult_le_compat; assumption. }
+  apply Rmult_le_compat_l with (r := INR (S j)) in H2; [|lra]. nra.
+Qed.
+
+(* C(m, j) eps^j <= (e m eps / j)^j for j >= 1 and eps >= 0 *)
+Theorem binom_bound : forall m j eps, (1 <= j)%nat -> 0 <= eps ->
+  INR (binom m j) * eps ^ j <= (exp 1 * INR m * eps / INR j) ^ j.
+Proof.
+  intros m j eps Hj He. assert (HJ : 0 < INR j) by (apply lt_0_INR; lia).
+  pose proof (INR_fact_lt_0 j) as Hf. pose proof (exp_pos 1) as Hx.
+  assert (B : INR (binom m j) <= INR m ^ j / INR (fact j)).
+  { apply (Rmult_le_reg_r (INR (fact j))); [exact Hf|]. unfold Rdiv. rewrite Rmult_assoc, Rinv_l, Rmult_1_r by lra.
+    rewrite <- mult_INR, <- pow_INR. apply le_INR. apply binom_fact. }
+  assert (F : / INR (fact j) <= (exp 1 / INR j) ^ j).
+  { pose proof (pow_fact j Hj) as P.
+    assert (INR j ^ j <= INR (fact j) * exp 1 ^ j).
+    { eapply Rle_trans; [exact P|]. apply Rmult_le_compat_l; [lra|].
+      replace j with (S (j - 1)) at 2 by lia. cbn [pow]. assert (1 <= exp 1) by (pose proof (exp_ineq1_le 1); lra).
+      assert (0 <= exp 1 ^ (j - 1)) by (apply pow_le; lra). nra. }
+    assert (Hjj : 0 < INR j ^ j) by (apply pow_lt; lra).
+    unfold Rdiv. rewrite Rpow_mult_distr, pow_inv.
+    apply (Rmult_le_reg_r (INR (fact j) * INR j ^ j)); [apply Rmult_lt_0_compat; lra|].
+    replace (/ INR (fact j) * (INR (fact j) * INR j ^ j)) with (INR j ^ j) by (field; apply INR_fact_neq_0).
+    replace (exp 1 ^ j * / INR j ^ j * (INR (fact j) * INR j ^ j)) with (INR (fact j) * exp 1 ^ j)
+      by (field; apply pow_nonzero; apply Rgt_not_eq; exact HJ).
+    exact H. }
+  assert (Hm : 0 <= INR m ^ j) by (apply pow_le; apply pos_INR).
+  assert (He' : 0 <= eps ^ j) by (apply pow_le; exact He).
+  replace ((exp 1 * INR m * eps / INR j) ^ j) with (INR m ^ j * eps ^ j * (exp 1 / INR j) ^ j)
+    by (rewrite <- !Rpow_mult_distr; f_equal; field; lra).
+  apply Rle_trans with (INR m ^ j * eps ^ j * / INR (fact j)).
+  - replace (INR m ^ j * eps ^ j * / INR (fact j)) with (INR m ^ j / INR (fact j) * eps ^ j) by (field; lra).
+    apply Rmult_le_compat_r; [exact He' | exact B].
+  - apply Rmult_le_compat_l; [apply Rmult_le_pos; assumption | exact F].
+Qed.

rocq/Erfc.v

@@ -0,0 +1,432 @@
+(* The Gaussian tail (Section 6): erf and erfc from the integral of exp(-t^2), the Gaussian integral, and the bounds
+   erfc x <= exp(-x^2) and erfc x <= exp(-x^2)/(x sqrt pi) (1 - 1/(2x^2) + 3/(4x^4)). *)
+From Stdlib Require Import Reals Lra Lia.
+Set Warnings "-ambiguous-paths".
+From Coquelicot Require Import Coquelicot.
+Set Warnings "ambiguous-paths".
+
+Local Open Scope R_scope.
+
+(* ---- Coquelicot's lemmas, for functions from R to R --------------------------------------------------------------- *)
+Lemma dcont : forall (f : R -> R) x, ex_derive f x -> continuous f x.
+Proof. intros f x. apply (ex_derive_continuous (K := R_AbsRing) (V := R_NormedModule)). Qed.
+
+Lemma rint_cont : forall (f : R -> R) a b, (forall z, Rmin a b <= z <= Rmax a b -> continuous f z) -> ex_RInt f a b.
+Proof. intros f a b. apply (ex_RInt_continuous (V := R_CompleteNormedModule)). Qed.
+
+Lemma rint_correct : forall (f : R -> R) a b, ex_RInt f a b -> is_RInt f a b (RInt f a b).
+Proof. intros f a b. apply (RInt_correct (V := R_CompleteNormedModule)). Qed.
+
+Lemma rint_ext : forall (f g : R -> R) a b, (forall x, Rmin a b < x < Rmax a b -> f x = g x) -> RInt f a b = RInt g a b.
+Proof. intros f g a b. apply (RInt_ext (V := R_CompleteNormedModule)). Qed.
+
+Lemma rint_scal : forall (f : R -> R) a b l, ex_RInt f a b -> RInt (fun x => l * f x) a b = l * RInt f a b.
+Proof. intros f a b l H. apply (RInt_scal (V := R_CompleteNormedModule)). exact H. Qed.
+
+Lemma rint_const : forall a b c, RInt (fun _ => c) a b = (b - a) * c.
+Proof. intros a b c. apply (RInt_const (V := R_CompleteNormedModule)). Qed.
+
+Lemma rint_point : forall (f : R -> R) a, RInt f a a = 0.
+Proof. intros f a. apply (RInt_point (V := R_CompleteNormedModule)). Qed.
+
+Lemma rint_comp_lin : forall (f : R -> R) u v a b, ex_RInt f (u * a + v) (u * b + v) ->
+  RInt (fun y => u * f (u * y + v)) a b = RInt f (u * a + v) (u * b + v).
+Proof. intros f u v a b. apply (RInt_comp_lin (V := R_CompleteNormedModule)). Qed.
+
+Lemma rint_derive : forall (f df : R -> R) a b, (forall x, Rmin a b <= x <= Rmax a b -> is_derive f x (df x)) ->
+  (forall x, Rmin a b <= x <= Rmax a b -> continuous df x) -> RInt df a b = f b - f a.
+Proof.
+  intros f df a b H1 H2. apply (is_RInt_unique (V := R_CompleteNormedModule)).
+  apply (is_RInt_derive (V := R_CompleteNormedModule)); assumption.
+Qed.
+
+Lemma rint_ex_const : forall a b (c : R), ex_RInt (fun _ => c) a b.
+Proof. intros a b c. apply (ex_RInt_const (V := R_CompleteNormedModule)). Qed.
+
+(* an integral of a nonnegative function over [a, b] is nonnegative *)
+Lemma rint_nonneg : forall (f : R -> R) a b, a <= b -> ex_RInt f a b -> (forall x, a < x < b -> 0 <= f x) -> 0 <= RInt f a b.
+Proof.
+  intros f a b Hab Hf H. assert (Z : RInt (fun _ => 0) a b = 0) by (rewrite rint_const; apply Rmult_0_r).
+  rewrite <- Z. apply RInt_le; [exact Hab | apply rint_ex_const | exact Hf | exact H].
+Qed.
+
+Lemma exp_le : forall x y, x <= y -> exp x <= exp y.
+Proof.
+  intros x y H. destruct (Rle_lt_or_eq_dec x y H) as [H'|H']; [apply Rlt_le, exp_increasing; exact H' | rewrite H'; lra].
+Qed.
+
+(* ---- the integrand ------------------------------------------------------------------------------------------------ *)
+Definition gs (t : R) : R := exp (- (t * t)).
+
+Lemma gs_pos : forall t, 0 < gs t.
+Proof. intro t. apply exp_pos. Qed.
+
+Lemma gs_cont : forall t, continuous gs t.
+Proof. intro t. apply dcont. unfold gs. auto_derive. exact I. Qed.
+
+Lemma ex_RInt_gs : forall a b, ex_RInt gs a b.
+Proof. intros a b. apply rint_cont. intros z _. apply gs_cont. Qed.
+
+Definition G (x : R) : R := RInt gs 0 x.
+
+Lemma G_derive : forall x, is_derive G x (gs x).
+Proof.
+  intro x. apply (is_derive_RInt (V := R_NormedModule) gs G 0 x).
+  - apply filter_forall. intro b. apply rint_correct. apply ex_RInt_gs.
+  - apply gs_cont.
+Qed.
+
+Lemma G_nonneg : forall x, 0 <= x -> 0 <= G x.
+Proof. intros x Hx. apply rint_nonneg; [exact Hx | apply ex_RInt_gs | intros t _; pose proof (gs_pos t); lra]. Qed.
+
+Lemma G0 : G 0 = 0.
+Proof. unfold G. apply rint_point. Qed.
+
+(* ---- the auxiliary integral H x = int_0^1 exp(-x^2 (1 + t^2)) / (1 + t^2) dt ---------------------------------------- *)
+Definition hh (x t : R) : R := exp (- (x * x) * (1 + t * t)) / (1 + t * t).
+Definition H (x : R) : R := RInt (hh x) 0 1.
+
+Lemma one_t2 : forall t, 0 < 1 + t * t.
+Proof. intro t. pose proof (Rle_0_sqr t). unfold Rsqr in *. lra. Qed.
+
+Lemma hh_cont_t : forall x t, continuous (hh x) t.
+Proof. intros x t. apply dcont. unfold hh. auto_derive. pose proof (one_t2 t). lra. Qed.
+
+Lemma ex_RInt_hh : forall x a b, ex_RInt (hh x) a b.
+Proof. intros x a b. apply rint_cont. intros z _. apply hh_cont_t. Qed.
+
+Definition dhh (x t : R) : R := - (2 * x) * exp (- (x * x) * (1 + t * t)).
+
+Lemma hh_derive : forall x t, is_derive (fun u => hh u t) x (dhh x t).
+Proof.
+  intros x t. unfold hh, dhh. auto_derive; [pose proof (one_t2 t); lra|]. pose proof (one_t2 t). field. lra.
+Qed.
+
+Lemma dhh_cont : forall x t, continuity_2d_pt (fun u v => Derive (fun z => hh z v) u) x t.
+Proof.
+  intros x t. apply (continuity_2d_pt_ext (fun u v => dhh u v)).
+  - intros u v. symmetry. apply is_derive_unique. apply hh_derive.
+  - unfold dhh. apply continuity_2d_pt_mult.
+    + apply continuity_2d_pt_opp. apply continuity_2d_pt_mult; [apply continuity_2d_pt_const | apply continuity_2d_pt_id1].
+    + apply (continuity_1d_2d_pt_comp exp (fun u v => - (u * u) * (1 + v * v))).
+      * apply derivable_continuous_pt. apply derivable_pt_exp.
+      * apply continuity_2d_pt_mult.
+        -- apply continuity_2d_pt_opp. apply continuity_2d_pt_mult; apply continuity_2d_pt_id1.
+        -- apply continuity_2d_pt_plus; [apply continuity_2d_pt_const|].
+           apply continuity_2d_pt_mult; apply continuity_2d_pt_id2.
+Qed.
+
+Lemma H_derive_raw : forall x, is_derive H x (RInt (fun t => dhh x t) 0 1).
+Proof.
+  intro x. unfold H.
+  assert (E : RInt (fun t => dhh x t) 0 1 = RInt (fun t => Derive (fun u => hh u t) x) 0 1).
+  { apply rint_ext. intros t _. symmetry. apply is_derive_unique. apply hh_derive. }
+  rewrite E. apply (is_derive_RInt_param hh 0 1 x).
+  - apply filter_forall. intros y t _. exists (dhh y t). apply hh_derive.
+  - intros t _. apply dhh_cont.
+  - apply filter_forall. intro y. apply ex_RInt_hh.
+Qed.
+
+(* substituting u = x t *)
+Lemma subst_lin : forall x, RInt (fun t => x * gs (x * t)) 0 1 = G x.
+Proof.
+  intro x. unfold G. pose proof (rint_comp_lin gs x 0 0 1 (ex_RInt_gs _ _)) as E.
+  rewrite !Rmult_0_r, Rmult_1_r, !Rplus_0_r in E. rewrite <- E. apply rint_ext. intros t _. rewrite Rplus_0_r. reflexivity.
+Qed.
+
+Lemma H_derive : forall x, is_derive H x (- 2 * gs x * G x).
+Proof.
+  intro x. assert (E : @eq R (RInt (fun t => dhh x t) 0 1) (- 2 * gs x * G x)).
+  { rewrite <- subst_lin. rewrite (rint_ext (fun t => dhh x t) (fun t => (- 2 * gs x) * (x * gs (x * t)))).
+    - rewrite rint_scal; [reflexivity|]. apply rint_cont. intros z _. apply dcont. unfold gs. auto_derive. exact I.
+    - intros t _. unfold dhh, gs. replace (- (x * x) * (1 + t * t)) with (- (x * x) + - (x * t * (x * t))) by ring.
+      rewrite exp_plus. ring. }
+  rewrite <- E. apply H_derive_raw.
+Qed.
+
+Lemma H_zero : H 0 = PI / 4.
+Proof.
+  unfold H. rewrite (rint_ext (hh 0) (fun t => / (1 + t²))).
+  - rewrite (rint_derive atan (fun t => / (1 + t²)) 0 1).
+    + rewrite atan_1, atan_0. lra.
+    + intros t _. apply is_derive_atan.
+    + intros t _. apply dcont. auto_derive. unfold Rsqr. pose proof (one_t2 t). lra.
+  - intros t _. unfold hh, Rsqr. rewrite Rmult_0_l, Ropp_0, Rmult_0_l, exp_0. field. pose proof (one_t2 t). lra.
+Qed.
+
+Lemma H_nonneg : forall x, 0 <= H x.
+Proof.
+  intro x. apply rint_nonneg; [lra | apply ex_RInt_hh |]. intros t _. unfold hh.
+  pose proof (one_t2 t). pose proof (exp_pos (- (x * x) * (1 + t * t))). apply Rlt_le. apply Rdiv_lt_0_compat; lra.
+Qed.
+
+Lemma H_le : forall x, H x <= gs x * (PI / 4).
+Proof.
+  intro x. rewrite <- H_zero. unfold H. rewrite <- rint_scal by apply ex_RInt_hh.
+  apply RInt_le; [lra | apply ex_RInt_hh | apply rint_cont; intros z _; apply dcont; unfold hh; auto_derive;
+                                              pose proof (one_t2 z); lra |].
+  intros t _. unfold hh, gs. rewrite Rmult_0_l, Ropp_0, Rmult_0_l, exp_0.
+  replace (- (x * x) * (1 + t * t)) with (- (x * x) + - (x * x * (t * t))) by ring. rewrite exp_plus.
+  pose proof (one_t2 t). pose proof (exp_pos (- (x * x))).
+  assert (Hle : exp (- (x * x * (t * t))) <= 1).
+  { rewrite <- exp_0. apply exp_le. pose proof (Rle_0_sqr x) as Sx. pose proof (Rle_0_sqr t) as St. unfold Rsqr in *.
+    pose proof (Rmult_le_pos _ _ Sx St). lra. }
+  unfold Rdiv. rewrite Rmult_assoc. apply Rmult_le_compat_l; [lra|]. rewrite Rmult_1_l.
+  rewrite <- (Rmult_1_l (/ (1 + t * t))) at 2. apply Rmult_le_compat_r; [apply Rlt_le, Rinv_0_lt_compat; lra | exact Hle].
+Qed.
+
+(* ---- the Gaussian integral: G x ^ 2 + H x = pi / 4 ------------------------------------------------------------------ *)
+Definition FF (x : R) : R := G x * G x + H x.
+
+Lemma FF_derive : forall x, is_derive FF x 0.
+Proof.
+  intro x. unfold FF. replace 0 with (gs x * G x + G x * gs x + - 2 * gs x * G x) by ring.
+  apply (is_derive_plus (fun y => G y * G y) H).
+  - apply (is_derive_mult G G x (gs x) (gs x)); [apply G_derive | apply G_derive | intros; apply Rmult_comm].
+  - apply H_derive.
+Qed.
+
+Lemma FF_cont : forall x, continuity_pt FF x.
+Proof. intro x. apply continuity_pt_filterlim. apply dcont. exists 0. apply FF_derive. Qed.
+
+Theorem gauss_square : forall x, G x * G x + H x = PI / 4.
+Proof.
+  intro x. change (FF x = PI / 4). rewrite <- H_zero. replace (H 0) with (FF 0) by (unfold FF; rewrite G0; ring).
+  destruct (MVT_gen FF 0 x (fun _ => 0)) as (c & _ & E).
+  - intros y _. apply FF_derive.
+  - intros y _. apply FF_cont.
+  - lra.
+Qed.
+
+(* ---- erf and erfc -------------------------------------------------------------------------------------------------- *)
+Definition erf (x : R) : R := 2 / sqrt PI * G x.
+Definition erfc (x : R) : R := 1 - erf x.
+
+Lemma sqrtPI_pos : 0 < sqrt PI.
+Proof. apply sqrt_lt_R0. apply PI_RGT_0. Qed.
+
+Lemma erf_sq : forall x, erf x * erf x = 1 - 4 / PI * H x.
+Proof.
+  intro x. unfold erf. pose proof (gauss_square x) as E. pose proof sqrtPI_pos. pose proof PI_RGT_0.
+  replace (2 / sqrt PI * G x * (2 / sqrt PI * G x)) with (4 / (sqrt PI * sqrt PI) * (G x * G x)) by (field; lra).
+  rewrite sqrt_sqrt by lra. replace (G x * G x) with (PI / 4 - H x) by lra. field. lra.
+Qed.
+
+(* the Gaussian integral gives 0 <= erfc x <= 4 H(x) / pi <= exp(-x^2) for x >= 0 *)
+Theorem erfc_le_exp : forall x, 0 <= x -> 0 <= erfc x <= exp (- (x * x)).
+Proof.
+  intros x Hx. pose proof PI_RGT_0. pose proof sqrtPI_pos. set (z := 4 / PI * H x).
+  assert (Hz : 0 <= z <= exp (- (x * x))).
+  { unfold z. pose proof (H_nonneg x) as Hn. pose proof (H_le x) as Hl. unfold gs in *. split.
+    - apply Rmult_le_pos; [apply Rlt_le, Rdiv_lt_0_compat; lra | exact Hn].
+    - replace (exp (- (x * x))) with (4 / PI * (exp (- (x * x)) * (PI / 4))) by (field; lra).
+      apply Rmult_le_compat_l; [apply Rlt_le, Rdiv_lt_0_compat; lra | exact Hl]. }
+  assert (He : 0 <= erf x) by (unfold erf; apply Rmult_le_pos; [apply Rlt_le, Rdiv_lt_0_compat; lra | apply G_nonneg; exact Hx]).
+  pose proof (erf_sq x) as Sq. fold z in Sq.
+  assert (Hexp : exp (- (x * x)) <= 1) by (rewrite <- exp_0; apply exp_le; pose proof (Rle_0_sqr x); unfold Rsqr in *; lra).
+  unfold erfc. split; nra.
+Qed.
+
+Lemma erfc_derive : forall x, is_derive erfc x (- (2 / sqrt PI * gs x)).
+Proof.
+  intro x. unfold erfc, erf. replace (- (2 / sqrt PI * gs x)) with (minus 0 (2 / sqrt PI * gs x))
+    by (unfold minus, plus, opp; cbn; ring).
+  apply (is_derive_minus (fun _ => 1) (fun y => 2 / sqrt PI * G y)).
+  - apply (is_derive_const (K := R_AbsRing) (V := R_NormedModule)).
+  - apply is_derive_scal. apply G_derive.
+Qed.
+
+Lemma erfc_cont : forall x, continuity_pt erfc x.
+Proof. intro x. apply continuity_pt_filterlim. apply dcont. eexists. apply erfc_derive. Qed.
+
+(* ---- comparison by derivatives -------------------------------------------------------------------------------------- *)
+(* on (a, +inf) a function with nonpositive derivative that is nearly nonnegative arbitrarily far out is nonnegative *)
+Lemma decr_nonneg : forall (g dg : R -> R) a, (forall x, a < x -> is_derive g x (dg x)) -> (forall x, a < x -> dg x <= 0) ->
+  (forall x eps, a < x -> 0 < eps -> exists y, x <= y /\ - eps <= g y) -> forall x, a < x -> 0 <= g x.
+Proof.
+  intros g dg a Hd Hneg Hfar x Hx. destruct (Rle_lt_dec 0 (g x)) as [Hg|Hg]; [exact Hg|]. exfalso.
+  destruct (Hfar x (- g x / 2) Hx ltac:(lra)) as (y & Hy & Hgy).
+  destruct (Rle_lt_or_eq_dec x y Hy) as [Hxy|Hxy]; [|subst y; lra].
+  destruct (MVT_gen g x y dg) as (c & Hc & E).
+  - intros z Hz. rewrite Rmin_left, Rmax_right in Hz by lra. apply Hd. lra.
+  - intros z Hz. rewrite Rmin_left, Rmax_right in Hz by lra. apply continuity_pt_filterlim, dcont.
+    exists (dg z). apply Hd. lra.
+  - rewrite Rmin_left, Rmax_right in Hc by lra. pose proof (Hneg c ltac:(lra)). nra.
+Qed.
+
+(* exp(-y^2) falls below every eps > 0 *)
+Lemma gs_small : forall x eps, 0 < eps -> exists y, x <= y /\ 1 <= y /\ gs y <= eps.
+Proof.
+  intros x eps He. set (y := Rmax x (Rmax 1 (/ eps))). exists y.
+  assert (Hy1 : 1 <= y) by (unfold y; pose proof (Rmax_r x (Rmax 1 (/ eps))); pose proof (Rmax_l 1 (/ eps)); lra).
+  assert (Hye : / eps <= y) by (unfold y; pose proof (Rmax_r x (Rmax 1 (/ eps))); pose proof (Rmax_r 1 (/ eps)); lra).
+  split; [apply Rmax_l|]. split; [exact Hy1|]. unfold gs. rewrite exp_Ropp.
+  pose proof (exp_ineq1_le (y * y)) as E1. pose proof (exp_pos (y * y)) as E2.
+  apply (Rmult_le_reg_l (exp (y * y))); [exact E2|]. rewrite Rinv_r by lra.
+  assert (1 <= eps * y) by (apply (Rmult_le_compat_l eps) in Hye; [rewrite Rinv_r in Hye by lra; exact Hye | lra]).
+  nra.
+Qed.
+
+Definition phi (x : R) : R := exp (- (x * x)) / sqrt PI.
+
+Lemma phi_pos : forall x, 0 < phi x.
+Proof. intro x. unfold phi. apply Rdiv_lt_0_compat; [apply exp_pos | apply sqrtPI_pos]. Qed.
+
+Lemma is_derive_sub : forall (f g : R -> R) x df dg, is_derive f x df -> is_derive g x dg ->
+  is_derive (fun y => f y - g y) x (df - dg).
+Proof. intros f g x df dg Hf Hg. exact (is_derive_minus f g x df dg Hf Hg). Qed.
+
+Lemma is_derive_eq : forall (f : R -> R) (x l1 l2 : R), is_derive f x l1 -> l1 = l2 -> is_derive f x l2.
+Proof. intros f x l1 l2 H E. rewrite <- E. exact H. Qed.
+
+Lemma nz : forall x, 0 < x -> x <> 0.
+Proof. intros x H. apply Rgt_not_eq. exact H. Qed.
+
+(* ---- erfc x <= exp(-x^2) / (x sqrt pi) and the sharper bounds, for x > 0 ---------------------------------------------- *)
+Definition up1 (x : R) : R := exp (- (x * x)) / (x * sqrt PI).
+Definition up3 (x : R) : R := exp (- (x * x)) / (x * sqrt PI) * (1 - 1 / (2 * (x * x)) + 3 / (4 * (x * x * (x * x)))).
+Definition lo1 (x : R) : R := exp (- (x * x)) / (x * sqrt PI) * (1 - 1 / (2 * (x * x))).
+
+Lemma up1_derive : forall x, 0 < x -> is_derive up1 x (- (2 / sqrt PI * gs x) - phi x / (x * x)).
+Proof.
+  intros x Hx. pose proof sqrtPI_pos as Hs. unfold up1. auto_derive.
+  - apply Rmult_integral_contrapositive_currified; apply nz; assumption.
+  - unfold phi, gs. field. split; apply nz; assumption.
+Qed.
+
+Lemma up3_derive : forall x, 0 < x ->
+  is_derive up3 x (- (2 / sqrt PI * gs x) - 15 * phi x / (4 * (x * x * (x * x) * (x * x)))).
+Proof.
+  intros x Hx. pose proof sqrtPI_pos as Hs. unfold up3. auto_derive.
+  - repeat split; try (apply Rmult_integral_contrapositive_currified); try (apply Rmult_integral_contrapositive_currified);
+      try apply nz; try lra; nra.
+  - unfold phi, gs. field. split; apply nz; assumption.
+Qed.
+
+Lemma lo1_derive : forall x, 0 < x -> is_derive lo1 x (- (2 / sqrt PI * gs x) + 3 * phi x / (2 * (x * x * (x * x)))).
+Proof.
+  intros x Hx. pose proof sqrtPI_pos as Hs. unfold lo1. auto_derive.
+  - repeat split; try (apply Rmult_integral_contrapositive_currified); try apply nz; try lra; nra.
+  - unfold phi, gs. field. split; apply nz; assumption.
+Qed.
+
+Lemma up3_pos : forall x, 0 < x -> 0 < up3 x.
+Proof.
+  intros x Hx. pose proof sqrtPI_pos. unfold up3. apply Rmult_lt_0_compat.
+  - apply Rdiv_lt_0_compat; [apply exp_pos | nra].
+  - assert (0 < x * x) by nra. assert (0 < x * x * (x * x)) by nra.
+    replace (1 - 1 / (2 * (x * x)) + 3 / (4 * (x * x * (x * x))))
+      with (((2 * (x * x) - 1/2) * (2 * (x * x) - 1/2) + 11 / 4) / (4 * (x * x * (x * x)))) by (field; lra).
+    apply Rdiv_lt_0_compat; nra.
+Qed.
+
+Theorem erfc_upper1 : forall x, 0 < x -> erfc x <= up1 x.
+Proof.
+  intros x Hx. pose proof sqrtPI_pos as Hs. cut (0 <= up1 x - erfc x); [lra|].
+  apply (decr_nonneg (fun y => up1 y - erfc y) (fun y => - (phi y / (y * y))) 0); [| | | exact Hx].
+  - intros y Hy. eapply is_derive_eq; [apply is_derive_sub; [apply up1_derive; exact Hy | apply erfc_derive]|]. ring.
+  - intros y Hy. pose proof (phi_pos y) as P1. assert (P2 : 0 < y * y) by nra. pose proof (Rdiv_lt_0_compat _ _ P1 P2). lra.
+  - intros y eps Hy He. destruct (gs_small y eps He) as (z & Hz & Hz1 & Hg). exists z. split; [exact Hz|].
+    destruct (erfc_le_exp z ltac:(lra)) as [_ E].
+    assert (0 <= up1 z) by (unfold up1; apply Rlt_le, Rdiv_lt_0_compat; [apply exp_pos | nra]). unfold gs in Hg. lra.
+Qed.
+
+Theorem erfc_upper3 : forall x, 0 < x -> erfc x <= up3 x.
+Proof.
+  intros x Hx. pose proof sqrtPI_pos as Hs. cut (0 <= up3 x - erfc x); [lra|].
+  apply (decr_nonneg (fun y => up3 y - erfc y) (fun y => - (15 * phi y / (4 * (y * y * (y * y) * (y * y))))) 0);
+    [| | | exact Hx].
+  - intros y Hy. eapply is_derive_eq; [apply is_derive_sub; [apply up3_derive; exact Hy | apply erfc_derive]|]. ring.
+  - intros y Hy. pose proof (phi_pos y). assert (Y2 : 0 < y * y) by nra.
+    assert (Y4 : 0 < y * y * (y * y)) by (apply Rmult_lt_0_compat; exact Y2).
+    assert (Y6 : 0 < y * y * (y * y) * (y * y)) by (apply Rmult_lt_0_compat; [exact Y4 | exact Y2]).
+    assert (0 < 15 * phi y / (4 * (y * y * (y * y) * (y * y)))) by (apply Rdiv_lt_0_compat; nra). lra.
+  - intros y eps Hy He. destruct (gs_small y eps He) as (z & Hz & Hz1 & Hg). exists z. split; [exact Hz|].
+    destruct (erfc_le_exp z ltac:(lra)) as [_ E]. pose proof (up3_pos z ltac:(lra)). unfold gs in Hg. lra.
+Qed.
+
+Theorem erfc_lower1 : forall x, 0 < x -> lo1 x <= erfc x.
+Proof.
+  intros x Hx. pose proof sqrtPI_pos as Hs. cut (0 <= erfc x - lo1 x); [lra|].
+  apply (decr_nonneg (fun y => erfc y - lo1 y) (fun y => - (3 * phi y / (2 * (y * y * (y * y))))) 0); [| | | exact Hx].
+  - intros y Hy. eapply is_derive_eq; [apply is_derive_sub; [apply erfc_derive | apply lo1_derive; exact Hy]|]. ring.
+  - intros y Hy. pose proof (phi_pos y). assert (Y2 : 0 < y * y) by nra.
+    assert (Y4 : 0 < y * y * (y * y)) by (apply Rmult_lt_0_compat; exact Y2).
+    assert (0 < 3 * phi y / (2 * (y * y * (y * y)))) by (apply Rdiv_lt_0_compat; nra). lra.
+  - intros y eps Hy He. destruct (gs_small y (eps * sqrt PI) ltac:(nra)) as (z & Hz & Hz1 & Hg). exists z.
+    split; [exact Hz|]. destruct (erfc_le_exp z ltac:(lra)) as [E _].
+    assert (lo1 z <= eps).
+    { unfold lo1. unfold gs in Hg. pose proof (exp_pos (- (z * z))).
+      assert (0 <= 1 / (2 * (z * z))) by (apply Rlt_le, Rdiv_lt_0_compat; nra).
+      assert (exp (- (z * z)) / (z * sqrt PI) <= eps).
+      { apply (Rmult_le_reg_r (z * sqrt PI)); [nra|]. unfold Rdiv. rewrite Rmult_assoc, Rinv_l, Rmult_1_r by (apply nz; nra).
+        nra. }
+      assert (0 <= exp (- (z * z)) / (z * sqrt PI)) by (apply Rlt_le, Rdiv_lt_0_compat; nra). nra. }
+    lra.
+Qed.
+
+(* ---- monotonicity and symmetry -------------------------------------------------------------------------------------- *)
+Lemma erfc_decr : forall x y, x <= y -> erfc y <= erfc x.
+Proof.
+  intros x y Hxy. destruct (Rle_lt_or_eq_dec x y Hxy) as [H|H]; [|rewrite H; lra].
+  destruct (MVT_gen erfc x y (fun z => - (2 / sqrt PI * gs z))) as (c & _ & E).
+  - intros z _. apply erfc_derive.
+  - intros z _. apply erfc_cont.
+  - pose proof sqrtPI_pos. pose proof (gs_pos c). assert (0 < 2 / sqrt PI * gs c) by (apply Rmult_lt_0_compat; [apply Rdiv_lt_0_compat|]; lra).
+    nra.
+Qed.
+
+Lemma gs_even : forall t, gs (- t) = gs t.
+Proof. intro t. unfold gs. f_equal. ring. Qed.
+
+Lemma G_odd : forall x, G (- x) = - G x.
+Proof.
+  intro x. unfold G. pose proof (rint_comp_lin gs (-1) 0 0 x (ex_RInt_gs _ _)) as E.
+  replace (-1 * 0 + 0) with 0 in E by ring. replace (-1 * x + 0) with (- x) in E by ring. rewrite <- E.
+  rewrite (rint_ext (fun y => -1 * gs (-1 * y + 0)) (fun y => -1 * gs y)).
+  - rewrite rint_scal by apply ex_RInt_gs. ring.
+  - intros t _. replace (-1 * t + 0) with (- t) by ring. rewrite gs_even. reflexivity.
+Qed.
+
+Lemma erfc_sym : forall x, erfc (- x) = 2 - erfc x.
+Proof. intro x. unfold erfc, erf. rewrite G_odd. ring. Qed.
+
+Lemma erfc_range : forall x, 0 <= erfc x <= 2.
+Proof.
+  intro x. destruct (Rle_lt_dec 0 x) as [H|H].
+  - destruct (erfc_le_exp x H) as [E1 E2]. assert (exp (- (x * x)) <= 1) by (rewrite <- exp_0; apply exp_le; nra). lra.
+  - replace x with (- (- x)) by ring. rewrite erfc_sym. destruct (erfc_le_exp (- x) ltac:(lra)) as [E1 E2].
+    assert (exp (- (- x * - x)) <= 1) by (rewrite <- exp_0; apply exp_le; nra). lra.
+Qed.
+
+(* ---- the tail of the standard normal law: Q u = P(N(0,1) >= u) = erfc(u / sqrt 2) / 2 ------------------------------- *)
+Definition Q (u : R) : R := erfc (u / sqrt 2) / 2.
+
+Lemma sqrt2_pos : 0 < sqrt 2.
+Proof. apply sqrt_lt_R0. lra. Qed.
+
+Lemma Q_decr : forall u v, u <= v -> Q v <= Q u.
+Proof.
+  intros u v H. unfold Q. pose proof sqrt2_pos. apply Rmult_le_compat_r; [lra|]. apply erfc_decr.
+  unfold Rdiv. apply Rmult_le_compat_r; [apply Rlt_le, Rinv_0_lt_compat; lra | exact H].
+Qed.
+
+Lemma Q_sym : forall u, Q (- u) = 1 - Q u.
+Proof. intro u. unfold Q. replace (- u / sqrt 2) with (- (u / sqrt 2)) by (field; pose proof sqrt2_pos; lra). rewrite erfc_sym. field. Qed.
+
+Lemma Q_range : forall u, 0 <= Q u <= 1.
+Proof. intro u. unfold Q. pose proof (erfc_range (u / sqrt 2)). lra. Qed.
+
+(* Q u <= exp(-u^2/2) / 2 for u >= 0 *)
+Lemma Q_exp : forall u, 0 <= u -> Q u <= exp (- (u * u) / 2) / 2.
+Proof.
+  intros u Hu. unfold Q. pose proof sqrt2_pos. assert (Hx : 0 <= u / sqrt 2) by (apply Rmult_le_pos; [lra | apply Rlt_le, Rinv_0_lt_compat; lra]).
+  destruct (erfc_le_exp (u / sqrt 2) Hx) as [_ E].
+  assert (Eq : - (u / sqrt 2 * (u / sqrt 2)) = - (u * u) / 2).
+  { replace (u / sqrt 2 * (u / sqrt 2)) with (u * u / (sqrt 2 * sqrt 2)) by (field; lra). rewrite sqrt_sqrt by lra. field. }
+  rewrite Eq in E. lra.
+Qed.
+
+(* erfc in terms of Q: P(|N(0, s^2)| >= u) = 2 Q(u/s) = erfc(u / (sqrt 2 s)) *)
+Lemma erfc_Q : forall u s, 0 < s -> erfc (u / (sqrt 2 * s)) = 2 * Q (u / s).
+Proof. intros u s Hs. unfold Q. pose proof sqrt2_pos. replace (u / s / sqrt 2) with (u / (sqrt 2 * s)) by (field; lra). field. Qed.

rocq/ExtrNat.v

@@ -0,0 +1,24 @@
+(* Machine arithmetic for the functions of PeanoNat.Nat, as ExtrOcamlNatInt gives it to those of Init.Nat;
+   the values extracted stay far below 2^62. *)
+From Stdlib Require Import Arith Extraction ExtrOcamlBasic ExtrOcamlNatInt.
+
+Extract Inlined Constant PeanoNat.Nat.add => "(+)".
+Extract Inlined Constant PeanoNat.Nat.mul => "( * )".
+Extract Inlined Constant PeanoNat.Nat.sub => "(fun n m -> if n > m then n - m else 0)".
+Extract Inlined Constant PeanoNat.Nat.pred => "(fun n -> if n > 0 then n - 1 else 0)".
+Extract Inlined Constant PeanoNat.Nat.div => "(fun x y -> if y = 0 then 0 else x / y)".
+Extract Inlined Constant PeanoNat.Nat.modulo => "(fun x y -> if y = 0 then x else x mod y)".
+Extract Inlined Constant PeanoNat.Nat.div2 => "(fun n -> n / 2)".
+Extract Inlined Constant PeanoNat.Nat.even => "(fun n -> n land 1 = 0)".
+Extract Inlined Constant PeanoNat.Nat.odd => "(fun n -> n land 1 = 1)".
+Extract Inlined Constant PeanoNat.Nat.testbit => "(fun a n -> n < 62 && (a lsr n) land 1 = 1)".
+Extract Inlined Constant PeanoNat.Nat.max => "(fun n m -> if n < m then m else n)".
+Extract Inlined Constant PeanoNat.Nat.min => "(fun n m -> if n < m then n else m)".
+Extract Inlined Constant PeanoNat.Nat.eqb => "(=)".
+Extract Inlined Constant PeanoNat.Nat.leb => "(<=)".
+Extract Inlined Constant PeanoNat.Nat.ltb => "(<)".
+Extract Constant PeanoNat.Nat.pow => "(fun n m -> let rec p k = if k = 0 then 1 else n * p (k - 1) in p m)".
+Extract Constant PeanoNat.Nat.log2 =>
+  "(fun n -> let rec g k x = if x <= 1 then k else g (k + 1) (x lsr 1) in if n <= 0 then 0 else g 0 n)".
+Extract Constant PeanoNat.Nat.log2_up =>
+  "(fun a -> let rec g k x = if x = 0 then k else g (k + 1) (x lsr 1) in if a <= 1 then 0 else g 0 (a - 1))".

rocq/Extract.v

@@ -1,5 +1,5 @@
 From Stdlib Require Import Extraction ExtrOcamlBasic ExtrOcamlNatInt ExtrOcamlZInt.
-From TH Require Import Net Phys.
+From TH Require Import ExtrNat Net Phys.
 Extraction Language OCaml.
 Set Extraction Output Directory "extract".
 Extraction "physnet.ml" phys_units phys_next nst.

rocq/ExtractHost.v

@@ -1,5 +1,5 @@
 From Stdlib Require Import Extraction ExtrOcamlBasic ExtrOcamlNatInt ExtrOcamlZInt.
-From TH Require Import Net Host.
+From TH Require Import ExtrNat Net Host.
 Extraction Language OCaml.
 Set Extraction Output Directory "extract".
 Extraction "hostnet.ml" host_units host_next nH.

rocq/ExtractStored.v

@@ -1,5 +1,5 @@
 From Stdlib Require Import Extraction ExtrOcamlBasic ExtrOcamlNatInt ExtrOcamlZInt.
-From TH Require Import Stored.
+From TH Require Import ExtrNat StoredFast.
 Extraction Language OCaml.
 Set Extraction Output Directory "extract".
-Extraction "storednet.ml" stored_bits.
+Extraction "storednet.ml" stored_bits_lin.

rocq/FlipLower.v

@@ -0,0 +1,206 @@
+(* Above the threshold of Proposition 6.10 the amplification fails.  A disjunction of k inputs that hold 0, amplified
+   r = 2h + 1 times, reads k r copies of its inputs; when each copy is flipped with probability eps, independently, and
+   2 k eps > 1, it computes a wrong value with probability at least 1 - rho^h for some rho < 1 that depends on k and
+   eps only. *)
+From Stdlib Require Import List Bool Arith ZArith Reals Lia Lra.
+Import ListNotations.
+Set Warnings "-ambiguous-paths".
+From TH Require Import TwoHead Net Lev Margin Noise Restore.
+Set Warnings "ambiguous-paths".
+
+Local Open Scope R_scope.
+
+(* ---- Bernoulli's inequality and the choice of rho ------------------------------------------------------------------ *)
+Lemma pow_le_one : forall x n, 0 <= x <= 1 -> x ^ n <= 1.
+Proof. intros x n [H0 H1]. induction n as [|n IH]; cbn [pow]; [lra|]. pose proof (pow_le x n H0). nra. Qed.
+
+Lemma bernoulli : forall a n, 0 <= a -> 1 + INR n * a <= (1 + a) ^ n.
+Proof.
+  intros a n Ha. induction n as [|n IH]; [cbn; lra|]. rewrite S_INR. cbn [pow].
+  assert (0 <= INR n * a * a) by (apply Rmult_le_pos; [apply Rmult_le_pos; [apply pos_INR | exact Ha] | exact Ha]). nra.
+Qed.
+
+(* with u = (2 k eps - 1)/(4 k eps), x = 1 - u and c = 1 - eps u: c^(2k) / x < 1 *)
+Lemma rho_lt : forall k eps, (1 <= k)%nat -> 0 < eps <= 1 -> 1 < 2 * INR k * eps ->
+  let u := (2 * INR k * eps - 1) / (4 * INR k * eps) in
+  0 < u < 1/2 /\ (1 - eps * u) ^ (2 * k) / (1 - u) < 1.
+Proof.
+  intros k eps Hk [He0 He1] H u. assert (Hk' : 1 <= INR k) by (apply (le_INR 1); exact Hk).
+  assert (Hp : 1/2 < INR k * eps) by lra.
+  assert (Eu : u * (4 * (INR k * eps)) = 2 * (INR k * eps) - 1) by (unfold u; field; lra).
+  assert (Hu : 0 < u < 1/2).
+  { split.
+    - unfold u. apply Rdiv_lt_0_compat; lra.
+    - apply (Rmult_lt_reg_r (4 * (INR k * eps))); [lra|]. rewrite Eu. lra. }
+  split; [exact Hu|].
+  set (a := eps * u). assert (Ha : 0 < a < 1) by (unfold a; split; [apply Rmult_lt_0_compat; lra | nra]).
+  (* (1 - a)^(2k) (1 + a)^(2k) <= 1 and (1 + a)^(2k) >= 1 + 2 k a *)
+  assert (AB : (1 - a) ^ (2 * k) * (1 + a) ^ (2 * k) <= 1).
+  { rewrite <- Rpow_mult_distr. apply pow_le_one. split; nra. }
+  pose proof (bernoulli a (2 * k) ltac:(lra)) as Bb. rewrite mult_INR in Bb. cbn [INR] in Bb.
+  assert (HA : 0 <= (1 - a) ^ (2 * k)) by (apply pow_le; lra).
+  assert (C1 : (1 - a) ^ (2 * k) * (1 + 2 * INR k * a) <= 1) by nra.
+  assert (Hd : 1 < (1 + 2 * INR k * a) * (1 - u)).
+  { assert (E2 : 2 * INR k * a = (2 * (INR k * eps) - 1) / 2) by (unfold a; rewrite <- Eu; field).
+    rewrite E2. assert (E3 : 1 - u = (2 * (INR k * eps) + 1) / (4 * (INR k * eps))) by (unfold u; field; lra).
+    rewrite E3. apply (Rmult_lt_reg_r (8 * (INR k * eps))); [lra|].
+    replace ((1 + (2 * (INR k * eps) - 1) / 2) * ((2 * (INR k * eps) + 1) / (4 * (INR k * eps))) * (8 * (INR k * eps)))
+      with ((2 * (INR k * eps) + 1) * (2 * (INR k * eps) + 1)) by (field; lra).
+    nra. }
+  apply (Rmult_lt_reg_r (1 - u)); [lra|]. unfold Rdiv. rewrite Rmult_assoc, Rinv_l, Rmult_1_r by lra. nra.
+Qed.
+
+Section Fail.
+Variable Omega : Type.
+Variable P : (Omega -> Prop) -> R.
+Hypothesis P_mono : forall A B : Omega -> Prop, (forall w, A w -> B w) -> P A <= P B.
+Hypothesis P_or : forall A B : Omega -> Prop, P (fun w => A w \/ B w) <= P A + P B.
+Hypothesis P_empty : P (fun _ => False) = 0.
+Hypothesis P_true : P (fun _ => True) = 1.
+Variable X : nat -> Omega -> R.
+Hypothesis P_indep : forall (I J : nat -> Prop) (A B : Omega -> Prop), (forall g, I g -> J g -> False) ->
+  dep Omega X I A -> dep Omega X J B -> P (fun w => A w /\ B w) = P A * P B.
+Hypothesis P_compl : forall A, meas Omega X A -> P (fun w => ~ A w) = 1 - P A.
+(* the output of evaluation g flips when its variable is at least 1, with probability eps *)
+Variable eps : R.
+Hypothesis Hflip : forall g, P (fun w => 1 <= X g w) = eps.
+
+Lemma eps_range : 0 <= eps <= 1.
+Proof.
+  rewrite <- (Hflip 0%nat). split; [exact (P_nonneg Omega P P_mono P_empty _) | exact (P_le1 Omega P P_mono P_true _)].
+Qed.
+
+Lemma Pnone : forall A : Omega -> Prop, (forall w, ~ A w) -> P A = 0.
+Proof.
+  intros A H. apply Rle_antisym; [rewrite <- P_empty; apply P_mono; intros w Hw; exact (H w Hw)|].
+  exact (P_nonneg Omega P P_mono P_empty A).
+Qed.
+
+(* the flips among the variables gs *)
+Definition cnt (gs : list nat) (w : Omega) : nat := length (filter (fb Omega X w) gs).
+
+Lemma dep_cnt : forall gs t, dep Omega X (fun g => In g gs) (fun w => (cnt gs w < t)%nat).
+Proof.
+  intros gs t w w' H. unfold cnt. replace (filter (fb Omega X w') gs) with (filter (fb Omega X w) gs); [reflexivity|].
+  apply filter_ext_in. intros g Hg. unfold fb. rewrite (H g Hg). reflexivity.
+Qed.
+
+(* fewer than t of the |gs| variables flip with probability at most (1 - eps + eps x)^|gs| / x^(t - 1), 0 < x <= 1 *)
+Lemma P_few : forall gs t x, NoDup gs -> 0 < x <= 1 -> (1 <= t)%nat ->
+  P (fun w => (cnt gs w < t)%nat) <= (1 - eps + eps * x) ^ length gs / x ^ (t - 1).
+Proof.
+  pose proof eps_range as He. intros gs. induction gs as [|g gs IH]; intros t x Hnd Hx Ht.
+  - cbn [length pow]. eapply Rle_trans; [apply (P_le1 Omega P P_mono P_true)|].
+    assert (0 < x ^ (t - 1) <= 1) by (split; [apply pow_lt; lra | apply pow_le_one; lra]).
+    unfold Rdiv. rewrite Rmult_1_l. rewrite <- Rinv_1 at 1. apply Rinv_le_contravar; lra.
+  - inversion Hnd as [|? ? Hg Hgs]; subst. set (c := 1 - eps + eps * x).
+    assert (Hc : 1 - eps <= c <= 1) by (unfold c; split; nra).
+    (* the first variable flips and fewer than t - 1 others do, or it does not and fewer than t others do *)
+    eapply Rle_trans; [apply (P_mono _ (fun w => (1 <= X g w /\ (cnt gs w < t - 1)%nat) \/ (~ 1 <= X g w /\ (cnt gs w < t)%nat)))|].
+    { intros w Hw. unfold cnt in Hw. cbn [filter] in Hw. destruct (fb Omega X w g) eqn:E.
+      - left. split; [apply fb_iff; exact E|]. cbn [length] in Hw. unfold cnt. lia.
+      - right. split; [intro C; apply fb_iff in C; congruence | exact Hw]. }
+    eapply Rle_trans; [apply P_or|].
+    rewrite (P_indep (fun g' => g' = g) (fun g' => In g' gs) (fun w => 1 <= X g w) (fun w => (cnt gs w < t - 1)%nat)).
+    2: { intros g' -> Hin. exact (Hg Hin). }
+    2: { intros w w' H. rewrite (H g eq_refl). reflexivity. }
+    2: { apply dep_cnt. }
+    rewrite (P_indep (fun g' => g' = g) (fun g' => In g' gs) (fun w => ~ 1 <= X g w) (fun w => (cnt gs w < t)%nat)).
+    2: { intros g' -> Hin. exact (Hg Hin). }
+    2: { intros w w' H. rewrite (H g eq_refl). reflexivity. }
+    2: { apply dep_cnt. }
+    rewrite Hflip, P_compl, Hflip by apply meas_ge.
+    pose proof (IH t x Hgs Hx Ht) as B1. fold c in B1. cbn [length pow]. fold c.
+    pose proof (pow_le c (length gs) ltac:(lra)) as Hcm.
+    destruct (Nat.eq_dec t 1) as [->|Ht1].
+    + rewrite (Pnone (fun w => (cnt gs w < 1 - 1)%nat)) by (intros w Hw; lia).
+      cbn [Nat.sub pow] in B1 |- *. unfold Rdiv in *. rewrite Rinv_1, !Rmult_1_r in *. nra.
+    + pose proof (IH (t - 1)%nat x Hgs Hx ltac:(lia)) as B0. fold c in B0.
+      assert (Ex : x ^ (t - 1) = x * x ^ (t - 1 - 1)) by (replace (t - 1)%nat with (S (t - 1 - 1)) at 1 by lia; reflexivity).
+      rewrite Ex in B1 |- *. set (xp := x ^ (t - 1 - 1)) in *.
+      assert (Hxp : 0 < xp) by (apply pow_lt; lra).
+      assert (E : c * c ^ length gs / (x * xp) = eps * (c ^ length gs / xp) + (1 - eps) * (c ^ length gs / (x * xp)))
+        by (unfold c; field; lra).
+      rewrite E. apply Rplus_le_compat; apply Rmult_le_compat_l; lra.
+Qed.
+
+(* ---- a disjunction of inputs that hold 0 ---------------------------------------------------------------------------- *)
+Definition disj (js : list nat) : tu := TU (-1) (map (fun j => (j, 1%Z)) js).
+
+Lemma wsum_ones : forall ins E, (forall j z, In (j, z) ins -> z = 1%Z) ->
+  wsum ins E = Z.of_nat (length (filter (fun p => E (fst p)) ins)).
+Proof.
+  induction ins as [|[j z] t IH]; intros E H; [reflexivity|]. cbn [wsum filter fst].
+  rewrite (H j z (or_introl eq_refl)). rewrite IH by (intros j' z' Hin; exact (H j' z' (or_intror Hin))).
+  destruct (E j); cbn [length b2z]; lia.
+Qed.
+
+(* on the replicated input with the copies psi flipped, the r-fold disjunction has pre-activation the number of flipped
+   copies it reads minus (r + 1)/2 *)
+Lemma pre_disj : forall h js y psi, (forall j, In j js -> (j < length y)%nat /\ nth j y false = false) ->
+  pre (arow (2 * h + 1) (length y) (disj js)) (xorv (rep (2 * h + 1) y) psi)
+  = (Z.of_nat (length (filter (fun p => psi (fst p)) (tin (arow (2 * h + 1) (length y) (disj js))))) - Z.of_nat (h + 1))%Z.
+Proof.
+  intros h js y psi Hy. unfold pre.
+  rewrite wsum_ones.
+  2: { intros q z Hin. destruct (in_arow _ _ _ q z Hin) as (c & j & _ & Hj & _). cbn [tin disj] in Hj.
+       apply in_map_iff in Hj as (j' & E & _). injection E as _ <-. reflexivity. }
+  rewrite (filter_ext_in _ (fun p => psi (fst p))).
+  - unfold arow at 1. cbn [tb disj]. replace ((2 * h + 1 - 1) / 2)%nat with h.
+    + rewrite Nat2Z.inj_add, Nat2Z.inj_add, Nat2Z.inj_mul. cbn [Z.of_nat]. lia.
+    + replace (2 * h + 1 - 1)%nat with (h * 2)%nat by lia. rewrite Nat.div_mul by lia. reflexivity.
+  - intros [q z] Hin. cbn [fst]. destruct (in_arow _ _ _ q z Hin) as (c & j & Hc & Hj & ->). cbn [tin disj] in Hj.
+    apply in_map_iff in Hj as (j' & E & Hj'). injection E as -> _. destruct (Hy j Hj') as [Hjl Hj0].
+    rewrite nth_xorv by (rewrite length_rep; nia). rewrite nth_rep by assumption. rewrite Hj0. reflexivity.
+Qed.
+
+(* Above the threshold: a disjunction of k inputs that hold 0, amplified r = 2h + 1 times, whose kr input copies flip
+   independently with probability eps, outputs 1 with probability at least 1 - rho^h, rho < 1, when 2 k eps > 1 *)
+Theorem flip_fails : forall k, (1 <= k)%nat -> 1 < 2 * INR k * eps ->
+  exists rho, 0 <= rho < 1 /\
+  forall h js y (src : nat -> nat), length js = k -> NoDup js ->
+    (forall j, In j js -> (j < length y)%nat /\ nth j y false = false) -> (forall q q', src q = src q' -> q = q') ->
+    1 - rho ^ h <= P (fun w => Z.leb 0 (pre (arow (2 * h + 1) (length y) (disj js))
+                                           (xorv (rep (2 * h + 1) y) (fun q => fb Omega X w (src q)))) = true).
+Proof.
+  intros k Hk H. pose proof eps_range as He. assert (Hk' : 1 <= INR k) by (apply (le_INR 1); exact Hk).
+  assert (He0 : 0 < eps) by (destruct (Rle_lt_dec eps 0); [nra | assumption]).
+  destruct (rho_lt k eps Hk (conj He0 (proj2 He)) H) as [Hu Hrho].
+  set (u := (2 * INR k * eps - 1) / (4 * INR k * eps)) in *. set (x := 1 - u). set (c := 1 - eps + eps * x).
+  assert (Ec : c = 1 - eps * u) by (unfold c, x; ring). rewrite <- Ec in Hrho. fold x in Hrho.
+  assert (Hc : 0 <= c <= 1) by (rewrite Ec; split; nra).
+  assert (Hx : 0 < x <= 1) by (unfold x; lra).
+  exists (c ^ (2 * k) / x). split; [split; [apply Rmult_le_pos; [apply pow_le; lra | apply Rlt_le, Rinv_0_lt_compat; lra] | exact Hrho]|].
+  intros h js y src Hlen Hnd Hy Hsrc.
+  set (r := (2 * h + 1)%nat).
+  assert (Hrow : rowok (length y) (disj js)).
+  { split.
+    - cbn [tin disj]. rewrite map_map. cbn [fst]. rewrite map_id. exact Hnd.
+    - intros j z Hin. cbn [tin disj] in Hin. apply in_map_iff in Hin as (j' & E & Hj'). injection E as <- <-.
+      split; [exact (proj1 (Hy j' Hj')) | left; reflexivity]. }
+  destruct (arow_ok r _ _ Hrow) as [Hnd' _].
+  set (gs := map (fun p => src (fst p)) (tin (arow r (length y) (disj js)))).
+  assert (Hgs : NoDup gs).
+  { unfold gs. rewrite <- (map_map fst src). apply nodup_map_inj; [intros q q' _ _ E; exact (Hsrc q q' E) | exact Hnd']. }
+  assert (Hlg : length gs = (k * r)%nat).
+  { unfold gs. rewrite length_map, length_tin_arow. cbn [tin disj]. rewrite length_map, Hlen. lia. }
+  (* the disjunction is wrong exactly when at least h + 1 of the copies it reads flip *)
+  eapply Rle_trans; [|apply (P_mono (fun w => ~ (cnt gs w < h + 1)%nat))].
+  2: { intros w Hw. unfold r. rewrite pre_disj by exact Hy. unfold cnt, gs, r in Hw. rewrite length_filter_map in Hw.
+       cbv beta in Hw |- *. apply Z.leb_le. lia. }
+  assert (Hcomp : 1 <= P (fun w => ~ (cnt gs w < h + 1)%nat) + P (fun w => (cnt gs w < h + 1)%nat)).
+  { rewrite <- P_true. eapply Rle_trans; [|apply P_or]. apply P_mono. intros w _.
+    destruct (Nat.lt_ge_cases (cnt gs w) (h + 1)); [right | left]; lia. }
+  pose proof (P_few gs (h + 1) x Hgs Hx ltac:(lia)) as B. fold c in B. rewrite Hlg in B.
+  replace (h + 1 - 1)%nat with h in B by lia.
+  assert (Eb : c ^ (k * r) / x ^ h = c ^ k * (c ^ (2 * k) / x) ^ h).
+  { unfold r. replace (k * (2 * h + 1))%nat with (2 * k * h + k)%nat by lia. rewrite pow_add, pow_mult.
+    unfold Rdiv. rewrite Rpow_mult_distr, pow_inv. ring. }
+  rewrite Eb in B.
+  assert (Hck : c ^ k <= 1) by (apply pow_le_one; lra).
+  assert (Hr0 : 0 <= (c ^ (2 * k) / x) ^ h)
+    by (apply pow_le; apply Rmult_le_pos; [apply pow_le; lra | apply Rlt_le, Rinv_0_lt_compat; lra]).
+  assert (0 <= c ^ k) by (apply pow_le; lra). nra.
+Qed.
+
+End Fail.

rocq/Host.v

@@ -1,5 +1,5 @@
 (* The SUBLEQ host H_A as a netlist of ternary threshold units, block by block in the order of
-   the generator, for words of A bits (Construction 3.8), and the machine it computes. *)
+   the generator, for words of A bits (Construction 3.7), and the machine it computes. *)
 From Stdlib Require Import List Bool Arith ZArith Lia.
 Import ListNotations.
 From TH Require Import TwoHead Net Gates.

rocq/HostCount.v

@@ -0,0 +1,403 @@
+(* Proposition 3.8: the units, edges and biases of H_A for every A >= 3, and the identity units and nonzero entries of
+   Lev(H_A). *)
+From Stdlib Require Import List Bool Arith ZArith Lia NArith Morphisms Setoid.
+Import ListNotations.
+From TH Require Import TwoHead Net Gates Host HostWF Lev BlockLev HostLev.
+
+#[local] Instance nsum_proper : Proper (eq ==> pointwise_relation nat eq ==> eq) nsum.
+Proof. intros k k' -> f g H. apply nsum_ext. intros i _. apply H. Qed.
+
+(* ---- counting bits ---------------------------------------------------------------------------------------- *)
+(* half of the values below 2^k have bit b set *)
+Lemma count_bit : forall k b, b < k -> 2 * nsum (2 ^ k) (fun v => Nat.b2n (Nat.testbit v b)) = 2 ^ k.
+Proof.
+  induction k as [|k IH]; intros b Hb; [lia|].
+  rewrite Nat.pow_succ_r', (Nat.mul_comm 2 (2 ^ k)), nsum_mul.
+  destruct b as [|b].
+  - rewrite (nsum_ext (2 ^ k) _ (fun _ => 1)); [rewrite nsum_const; lia|].
+    intros q _. cbn [nsum]. rewrite Nat.add_0_r, Nat.testbit_even_0, Nat.testbit_odd_0. reflexivity.
+  - rewrite (nsum_ext (2 ^ k) _ (fun q => Nat.b2n (Nat.testbit q b) + Nat.b2n (Nat.testbit q b))).
+    + rewrite nsum_add. specialize (IH b ltac:(lia)). lia.
+    + intros q _. cbn [nsum]. rewrite Nat.add_0_r, Nat.testbit_even_succ', Nat.testbit_odd_succ'. lia.
+Qed.
+
+(* a cyclic shift of the indices leaves a sum unchanged *)
+Lemma nsum_shift : forall M c f, c <= M -> nsum M (fun j => f ((j + c) mod M)) = nsum M f.
+Proof.
+  intros M c f Hc. destruct (Nat.eq_dec M 0) as [->|HM]; [reflexivity|].
+  replace M with ((M - c) + c) at 1 by lia. rewrite nsum_split.
+  rewrite (nsum_ext (M - c) _ (fun j => f (c + j))) by (intros j Hj; rewrite Nat.mod_small by lia; f_equal; lia).
+  rewrite (nsum_ext c _ f).
+  - transitivity (nsum (c + (M - c)) f); [rewrite nsum_split; lia | f_equal; lia].
+  - intros i Hi. f_equal. replace (M - c + i + c) with (i + 1 * M) by lia.
+    rewrite Nat.Div0.mod_add. apply Nat.mod_small. lia.
+Qed.
+
+Section HC.
+Variable A : nat.
+Hypothesis HA : 3 <= A.
+
+Lemma SW_half : SW A = 2 * 2 ^ (A - 1).
+Proof. unfold SW. replace A with (S (A - 1)) at 1 by lia. rewrite Nat.pow_succ_r'. reflexivity. Qed.
+
+(* the decode lines of p + 3: half of the lines feed each bit *)
+Lemma Q_count : forall i, i < A ->
+  length (filter (fun j => bitof A ((j + 3) mod SW A) i) (seq 0 (SW A))) = 2 ^ (A - 1).
+Proof.
+  intros i Hi. pose proof (SW_ge A HA). rewrite length_filter_seq.
+  transitivity (nsum (SW A) (fun v => Nat.b2n (Nat.testbit v (A - 1 - i)))).
+  - rewrite <- (nsum_shift (SW A) 3 (fun v => Nat.b2n (Nat.testbit v (A - 1 - i)))) by lia.
+    apply nsum_ext. intros j _. reflexivity.
+  - pose proof (count_bit A (A - 1 - i) ltac:(lia)) as Hc. pose proof SW_half as E. unfold SW in *. lia.
+Qed.
+
+Lemma nsum_SS : nsum (A - 1) (fun i => S (S i)) = tri A + (A - 1).
+Proof.
+  unfold tri. generalize (A - 1) as k. induction k as [|k IH]; cbn [nsum]; lia.
+Qed.
+
+(* ---- the units ------------------------------------------------------------------------------------------- *)
+(* (8A + 4) 2^A + (A^2 + 39A + 4)/2 units *)
+Theorem host_units_count : 2 * length (host_units A) = (16 * A + 8) * SW A + A * A + 39 * A + 4.
+Proof.
+  change (host_units A) with (fus (hblocks A) (nH A)).
+  rewrite (units_bsum (hblocks A) (nH A) (hout A) (host_wf' A HA) (hout_valid A HA)), (bsum_host A HA).
+  rewrite (nsum_ext (A - 1) _ (fun i => S (S i))) by (intros i _; rewrite nsum_const; lia).
+  rewrite nsum_SS. pose proof (tri_eq A HA).
+  cbn [nsum nth hpre hpost bcount bsize blk_P blk_HP blk_FA blk_Q blk_F blk_PA blk_PB blk_AC blk_W blk_RX blk_RY blk_KP
+       blk_X blk_Y blk_PR blk_C blk_AX blk_NX blk_XN blk_EQ blk_R0 blk_H blk_R blk_LEQ blk_TA blk_TB blk_NP blk_HAB
+       blk_WR blk_NM].
+  rewrite !nsum_const. nia.
+Qed.
+
+(* the datapath and the memory: the blocks whose number of units grows with 2^A, with the operand fetch and the read
+   multiplexer, hold (8A + 4) 2^A + 5A of them *)
+Definition memblocks : list nat := [0; 2; 3; 4; 6; 7; 8; 10; 11; 12; 13; 14; 15; tb A + 13; tb A + 14].
+
+Theorem host_memory_count :
+  fold_right Nat.add 0 (map (fun b => bcount (nth b (hblocks A) blk0) * bsize (nth b (hblocks A) blk0)) memblocks)
+  = (8 * A + 4) * SW A + 5 * A.
+Proof.
+  unfold memblocks. cbn [map fold_right]. rewrite !nth_hb_pre by lia. rewrite !nth_hb_post by lia.
+  cbn [nth hpre hpost bcount bsize blk_P blk_FA blk_F blk_PA blk_PB blk_W blk_RX blk_RY blk_KP blk_X blk_Y blk_WR blk_NM].
+  nia.
+Qed.
+
+(* ---- the edges --------------------------------------------------------------------------------------------- *)
+Definition pe (b : nat) : nat :=
+  nsum (bcount (nth b (hpre A) blk0)) (fun j => nsum (bsize (nth b (hpre A) blk0))
+                                                      (fun r => length (sin (nth r (bshape (nth b (hpre A) blk0) j) su0)))).
+Definition qe (i : nat) : nat :=
+  nsum (bcount (nth i (hpost A) blk0)) (fun j => nsum (bsize (nth i (hpost A) blk0))
+                                                       (fun r => length (sin (nth r (bshape (nth i (hpost A) blk0) j) su0)))).
+Definition te (i : nat) : nat := nsum (S (S i)) (fun r => length (sin (nth r (bshape (blk_T A (S i)) 0) su0))).
+
+Ltac ecnt := unfold pe, qe;
+  cbn [nth hpre hpost bcount bsize bshape blk_P blk_HP blk_FA blk_Q blk_F blk_PA blk_PB blk_AC blk_W blk_RX blk_RY blk_KP
+       blk_X blk_Y blk_PR blk_C blk_AX blk_NX blk_XN blk_EQ blk_R0 blk_H blk_R blk_LEQ blk_TA blk_TB blk_NP blk_HAB
+       blk_WR blk_NM nsum sin sAND sOR lits map length app];
+  repeat setoid_rewrite length_map; repeat setoid_rewrite length_seq; rewrite ?nsum_const; try lia.
+
+Lemma pe_vals : pe 0 = SW A * A /\ pe 1 = A * 2 /\ pe 2 = A * SW A * 2 /\ pe 3 = A * SW A * 2 /\ pe 4 = A * SW A * 2
+  /\ pe 6 = 3 * A * SW A /\ pe 7 = SW A * A /\ pe 8 = SW A * A /\ pe 9 = A /\ pe 10 = SW A * 2 /\ pe 11 = A * SW A * 2
+  /\ pe 12 = A * SW A * 2 /\ pe 13 = SW A * A * 2 /\ pe 14 = A * SW A /\ pe 15 = A * SW A /\ pe 16 = (A - 1) * 2.
+Proof. repeat split; ecnt. Qed.
+
+Lemma pe5 : pe 5 = A * 2 ^ (A - 1).
+Proof.
+  unfold pe. cbn [nth hpre bcount bsize bshape blk_Q nsum sin sOR].
+  rewrite (nsum_ext A _ (fun _ => 2 ^ (A - 1))); [rewrite nsum_const; lia|].
+  intros i Hi. cbn [nth Nat.add]. rewrite !length_map. apply Q_count. lia.
+Qed.
+
+Lemma qe_vals : qe 1 = A * 2 /\ qe 2 = A * 2 /\ qe 3 = A * 2 /\ qe 4 = A /\ qe 5 = 6 /\ qe 6 = (A - 1) * 9
+  /\ qe 7 = (A - 1) * 3 /\ qe 8 = 4 /\ qe 9 = A * 3 /\ qe 10 = A * 3 /\ qe 11 = A * 3 /\ qe 12 = 9
+  /\ qe 13 = SW A * A * 2 /\ qe 14 = SW A * A * 2.
+Proof. repeat split; ecnt. Qed.
+
+Lemma qe0 : qe 0 = tri A + (A - 1).
+Proof.
+  unfold qe. cbn [nth hpost bcount bsize bshape blk_C nsum sin sOR]. rewrite <- nsum_SS.
+  apply nsum_ext. intros m _. cbn [nth map length]. rewrite !length_map, length_seq. lia.
+Qed.
+
+Lemma sum_rev : forall k, 2 * nsum k (fun j => k + 1 - j) = k * k + 3 * k.
+Proof.
+  intro k. assert (H1 : nsum k (fun j => k + 1 - j) + nsum k (fun j => j) = k * (k + 1)).
+  { rewrite <- nsum_add, <- nsum_const. apply nsum_ext. intros j Hj. lia. }
+  assert (H2 : 2 * nsum k (fun j => j) = k * (k - 1)) by (clear; induction k as [|k IH]; cbn [nsum]; nia).
+  nia.
+Qed.
+
+Lemma te_val : forall i, 2 * te i = S i * S i + 5 * S i.
+Proof.
+  intro i. unfold te. replace (S (S i)) with (1 + S i) by lia. rewrite nsum_split.
+  assert (H0 : nsum 1 (fun r => length (sin (nth r (bshape (blk_T A (S i)) 0) su0))) = S i)
+    by (cbn [nsum nth bshape blk_T sin sAND]; rewrite !length_map, length_seq; reflexivity).
+  rewrite H0. rewrite (nsum_ext (S i) _ (fun j => S i + 1 - j)).
+  - pose proof (sum_rev (S i)). lia.
+  - intros j Hj. cbn [Nat.add nth bshape blk_T]. rewrite nth_map_d with (d' := 0) by (rewrite length_seq; lia).
+    rewrite seq_nth by lia. cbn [sin sAND]. rewrite length_map, length_app, length_map, length_seq. cbn [length]. lia.
+Qed.
+
+Lemma sum_te : forall K, 6 * nsum K (fun i => S i * S i + 5 * S i) = K * (K + 1) * (2 * K + 1) + 15 * (K * (K + 1)).
+Proof. induction K as [|K IH]; cbn [nsum]; nia. Qed.
+
+(* (49A + 4) 2^(A-1) + (A^3 + 3A^2 + 2A)/6 + A^2 + 32A + 4 edges *)
+Theorem host_edges : 6 * nsum (length (host_units A)) (fun k => length (tin (nth k (host_units A) tu0)))
+  = 3 * (49 * A + 4) * SW A + A * A * A + 9 * (A * A) + 194 * A + 24.
+Proof.
+  change (host_units A) with (fus (hblocks A) (nH A)).
+  rewrite (edges_bsum (hblocks A) (nH A) (hout A) (host_wf' A HA) (hout_valid A HA)), (bsum_host A HA).
+  rewrite (nsum_ext 17 _ pe)
+    by (intros b Hb; unfold pe; apply nsum_ext; intros j _; apply nsum_ext; intros r _; cbn [usu]; unfold sunit;
+        rewrite nth_hb_pre by exact Hb; reflexivity).
+  rewrite (nsum_ext (A - 1) _ te)
+    by (intros i Hi; unfold te; apply nsum_ext; intros r _; cbn [usu]; unfold sunit;
+        replace (17 + i) with (16 + S i) by lia; rewrite nth_hb_T by lia; reflexivity).
+  rewrite (nsum_ext 15 _ qe)
+    by (intros i Hi; unfold qe; apply nsum_ext; intros j _; apply nsum_ext; intros r _; cbn [usu]; unfold sunit;
+        rewrite nth_hb_post by lia; reflexivity).
+  cbn [nsum]. rewrite pe5, qe0.
+  destruct pe_vals as (P0 & P1 & P2 & P3 & P4 & P6 & P7 & P8 & P9 & P10 & P11 & P12 & P13 & P14 & P15 & P16).
+  destruct qe_vals as (Q1 & Q2 & Q3 & Q4 & Q5 & Q6 & Q7 & Q8 & Q9 & Q10 & Q11 & Q12 & Q13 & Q14).
+  rewrite P0, P1, P2, P3, P4, P6, P7, P8, P9, P10, P11, P12, P13, P14, P15, P16.
+  rewrite Q1, Q2, Q3, Q4, Q5, Q6, Q7, Q8, Q9, Q10, Q11, Q12, Q13, Q14.
+  assert (HT : 2 * nsum (A - 1) te = nsum (A - 1) (fun i => S i * S i + 5 * S i)).
+  { generalize (A - 1) as K. induction K as [|K IH]; cbn [nsum]; [reflexivity|]. rewrite <- IH, <- te_val. lia. }
+  pose proof (sum_te (A - 1)) as HS6. pose proof (tri_eq A HA) as Htri. pose proof SW_half as Hh.
+  assert (Ea : exists a, A = S (S (S a))) by (exists (A - 3); lia). destruct Ea as [a Ea].
+  rewrite Ea in *. cbn [Nat.sub] in *. rewrite ?Nat.sub_0_r in *. nia.
+Qed.
+
+(* ---- the biases ---------------------------------------------------------------------------------------- *)
+Lemma sb_and : forall ls, (- Z.of_nat (length ls) <= sb (sAND ls) <= 0)%Z.
+Proof.
+  intro ls. cbn [sb sAND]. pose proof (npos_nneg ls). unfold npos in *. pose proof (filter_length_le _ snd ls). lia.
+Qed.
+
+Lemma sb_or : forall ls, sb (sOR ls) = (Z.of_nat (nneg ls) - 1)%Z.
+Proof. reflexivity. Qed.
+
+Lemma nneg_pos : forall (X : Type) (f : X -> sref) (l : list X), nneg (map (fun x => (f x, true)) l) = 0.
+Proof. intros X f l. unfold nneg. induction l as [|x t IH]; [reflexivity|]. cbn [map filter snd negb]. exact IH. Qed.
+
+Lemma lw_pm : forall (ls : list lit) p z, In (p, z) (map lw ls) -> z = 1%Z \/ z = (-1)%Z.
+Proof.
+  intros ls p z H. apply in_map_iff in H as ([x pol] & E & _). unfold lw in E. cbn [fst snd] in E.
+  injection E as _ <-. destruct pol; [left | right]; reflexivity.
+Qed.
+
+(* every unit is a threshold unit with weights -1 or 1 and a bias in [-A, 1] *)
+Definition gate_ok (u : su) : Prop :=
+  (forall p z, In (p, z) (sin u) -> z = 1%Z \/ z = (-1)%Z) /\ (- Z.of_nat A <= sb u <= 1)%Z.
+
+Lemma and_ok : forall ls, length ls <= A -> gate_ok (sAND ls).
+Proof.
+  intros ls H. split; [intros p z Hin; exact (lw_pm ls p z Hin)|]. pose proof (sb_and ls). lia.
+Qed.
+
+Lemma or_ok : forall ls, nneg ls <= 2 -> gate_ok (sOR ls).
+Proof. intros ls H. split; [intros p z Hin; exact (lw_pm ls p z Hin)|]. rewrite sb_or. lia. Qed.
+
+Theorem host_gate_ok : forall b j r, valid (hblocks A) (nH A) (SRef b j r) -> gate_ok (sunit (hblocks A) b j r).
+Proof.
+  intros b j r (Hb & Hj & Hr). rewrite length_hblocks in Hb by lia. unfold sunit.
+  destruct (Nat.lt_ge_cases b 17) as [Hp|Hp].
+  { rewrite nth_hb_pre in Hj, Hr |- * by exact Hp.
+    assert (Hc : b = 0 \/ b = 1 \/ b = 2 \/ b = 3 \/ b = 4 \/ b = 5 \/ b = 6 \/ b = 7 \/ b = 8 \/ b = 9
+                 \/ b = 10 \/ b = 11 \/ b = 12 \/ b = 13 \/ b = 14 \/ b = 15 \/ b = 16) by lia.
+    destruct Hc as [->|[->|[->|[->|[->|[->|[->|[->|[->|[->|[->|[->|[->|[->|[->|[->| ->]]]]]]]]]]]]]]]];
+      cbn [nth hpre bcount bsize bshape blk_P blk_HP blk_FA blk_Q blk_F blk_PA blk_PB blk_AC blk_W
+           blk_RX blk_RY blk_KP blk_X blk_Y blk_PR] in Hj, Hr |- *;
+      (destruct r as [|r]; [|lia]); cbn [nth];
+      first [ apply and_ok; unfold lits; rewrite ?length_map, ?length_seq; cbn [length]; lia
+            | apply or_ok; rewrite ?nneg_pos; unfold nneg; cbn [filter snd negb length]; lia ]. }
+  destruct (Nat.lt_ge_cases b (tb A)) as [HT|HT].
+  { unfold tb in HT. replace b with (16 + (b - 16)) in Hj, Hr |- * by lia.
+    rewrite nth_hb_T in Hj, Hr |- * by lia. cbn [bcount bsize bshape blk_T] in Hj, Hr |- *.
+    destruct r as [|r]; cbn [nth].
+    - apply and_ok. rewrite length_map, length_seq. lia.
+    - rewrite nth_map_d with (d' := 0) by (rewrite length_seq; lia). rewrite seq_nth by lia.
+      apply and_ok. rewrite length_app, length_map, length_seq. cbn [length]. lia. }
+  replace b with (tb A + (b - tb A)) in Hj, Hr |- * by lia.
+  rewrite nth_hb_post in Hj, Hr |- * by lia.
+  assert (Hi : b - tb A < 15) by (unfold tb in *; lia).
+  remember (b - tb A) as i eqn:Ei. clear Ei Hb Hp HT.
+  assert (Hc : i = 0 \/ i = 1 \/ i = 2 \/ i = 3 \/ i = 4 \/ i = 5 \/ i = 6 \/ i = 7 \/ i = 8 \/ i = 9
+               \/ i = 10 \/ i = 11 \/ i = 12 \/ i = 13 \/ i = 14) by lia.
+  destruct Hc as [->|[->|[->|[->|[->|[->|[->|[->|[->|[->|[->|[->|[->|[->| ->]]]]]]]]]]]]]];
+    cbn [nth hpost bcount bsize bshape blk_C blk_AX blk_NX blk_XN blk_EQ blk_R0 blk_H blk_R blk_LEQ
+         blk_TA blk_TB blk_NP blk_HAB blk_WR blk_NM] in Hj, Hr |- *.
+  - destruct r as [|r]; [|lia]. cbn [nth]. apply or_ok.
+    assert (E : forall x (l : list lit), nneg ((x, true) :: l) = nneg l) by reflexivity.
+    rewrite E, nneg_pos. lia.
+  - destruct r as [|r]; [|lia]. cbn [nth]. apply and_ok. cbn [length]. lia.
+  - destruct r as [|r]; [|lia]. cbn [nth]. apply and_ok. cbn [length]. lia.
+  - destruct r as [|r]; [|lia]. cbn [nth]. apply or_ok. unfold nneg. cbn [filter snd negb length]. lia.
+  - destruct r as [|r]; [|lia]. cbn [nth]. apply and_ok. rewrite length_map, length_seq. lia.
+  - assert (Hr3 : r = 0 \/ r = 1 \/ r = 2) by lia. destruct Hr3 as [->|[->| ->]]; cbn [nth];
+      first [apply and_ok; cbn [length]; lia | apply or_ok; unfold nneg; cbn [filter snd negb length]; lia].
+  - assert (Hr3 : r = 0 \/ r = 1 \/ r = 2) by lia.
+    destruct Hr3 as [->|[->| ->]]; cbn [nth map]; split; cbn [sin sb];
+      try (intros p z Hin; repeat (destruct Hin as [Hin|Hin]; [injection Hin as _ <-; auto|]); destruct Hin); lia.
+  - destruct r as [|r]; [|lia]. cbn [nth]. split; cbn [sin sb]; [|lia].
+    intros p z Hin. repeat (destruct Hin as [Hin|Hin]; [injection Hin as _ <-; auto|]). destruct Hin.
+  - destruct r as [|r]; [|lia]. cbn [nth]. split; cbn [sin sb]; [|lia].
+    intros p z Hin. repeat (destruct Hin as [Hin|Hin]; [injection Hin as _ <-; auto|]). destruct Hin.
+  - destruct r as [|r]; [|lia]. cbn [nth]. apply and_ok. cbn [length]. lia.
+  - destruct r as [|r]; [|lia]. cbn [nth]. apply and_ok. cbn [length]. lia.
+  - destruct r as [|r]; [|lia]. cbn [nth]. apply or_ok. unfold nneg. cbn [filter snd negb length]. lia.
+  - assert (Hr3 : r = 0 \/ r = 1 \/ r = 2) by lia. destruct Hr3 as [->|[->| ->]]; cbn [nth];
+      first [apply and_ok; cbn [length]; lia | apply or_ok; unfold nneg; cbn [filter snd negb length]; lia].
+  - destruct r as [|r]; [|lia]. cbn [nth]. apply and_ok. cbn [length]. lia.
+  - destruct r as [|r]; [|lia]. cbn [nth]. apply or_ok. unfold nneg. cbn [filter snd negb length]. lia.
+Qed.
+
+(* the units of the flat netlist, with their weights and biases *)
+Theorem host_weights_biases : forall k, k < length (host_units A) ->
+  (forall i z, In (i, z) (tin (nth k (host_units A) tu0)) -> z = 1%Z \/ z = (-1)%Z)
+  /\ (- Z.of_nat A <= Net.tb (nth k (host_units A) tu0) <= 1)%Z.
+Proof.
+  intros k Hk. change (host_units A) with (fus (hblocks A) (nH A)) in *.
+  rewrite (fus_len (hblocks A) (nH A) (host_wf' A HA)) in Hk.
+  destruct (loc (hblocks A) (nH A) (host_wf' A HA) k Hk) as (b & j & r & Hv & ->).
+  rewrite (fus_nth (hblocks A) (nH A) (host_wf' A HA) b j r Hv). unfold flat_unit. cbn [tin Net.tb].
+  destruct (host_gate_ok b j r Hv) as [Hw Hs]. split; [|exact Hs].
+  intros i z Hin. apply in_map_iff in Hin as ([p z'] & E & Hin). cbn [fst snd] in E. injection E as _ <-.
+  exact (Hw p z' Hin).
+Qed.
+
+(* ---- each unit occurs once in Lev(H_A) ---------------------------------------------------------------------- *)
+Lemma hout_inj : forall i i', i < nH A -> i' < nH A -> hout A i = hout A i' -> i = i'.
+Proof.
+  intros i i' Hi Hi' E. destruct (Nat.eq_dec i i') as [|Hne]; [assumption|]. exfalso. unfold hout in E.
+  destruct (Nat.ltb_spec i A), (Nat.ltb_spec i' A); try destruct (Nat.eqb_spec i A); try destruct (Nat.eqb_spec i' A);
+    try lia; injection E; intros; lia.
+Qed.
+
+Lemma depth13_out : forall x, valid (hblocks A) (nH A) x -> cdh A x = 13 -> exists i, i < nH A /\ hout A i = x.
+Proof.
+  intros x Hx H13. destruct (out_dec A HA x) as [Ho|Hno]; [exact Ho|]. exfalso.
+  destruct (host_reader A HA x Hx Hno) as (b & j & r & z & Hv & Hin & _).
+  destruct (host_unit_ok A HA b j r Hv) as [Hall _]. pose proof (proj1 (Hall x z Hin)).
+  pose proof (cdh_le13 A HA (SRef b j r)). lia.
+Qed.
+
+Definition hsrc : list src := concat (map snd (lsrc (nH A) (host_units A) (host_next A))).
+
+Lemma hsrc_range : forall s, In (Un s) hsrc -> nH A <= s < nH A + length (host_units A).
+Proof.
+  intros s Hs. unfold hsrc, lsrc in Hs. rewrite map_app, concat_app in Hs. apply in_app_or in Hs as [Hs|Hs].
+  - rewrite map_map in Hs. apply in_concat in Hs as (cs & Hcs & Hin). apply in_map_iff in Hcs as (l & <- & _).
+    cbn [snd] in Hin. destruct (srcs_spec _ _ _ l (Un s) Hin) as [HU _]. destruct (HU s eq_refl) as (k & Hk & -> & _).
+    lia.
+  - cbn [map concat snd] in Hs. rewrite app_nil_r in Hs.
+    destruct (srcd_spec (nH A) (host_units A) (host_next A)) with (c := Un s) as [HU _]; try exact Hs.
+    + apply Forall_forall. intros a Ha. unfold host_next in Ha. apply in_map_iff in Ha as (i & <- & Hi).
+      apply in_seq in Hi. unfold NS. pose proof (idx_lt_total _ _ _ (hout_valid A HA i ltac:(lia))) as H.
+      change (host_units A) with (fus (hblocks A) (nH A)). rewrite (fus_len _ _ (host_wf' A HA)). exact H.
+    + exact (host_next_len A).
+    + rewrite (host_dmax A HA). lia.
+    + destruct (HU s eq_refl) as (k & Hk & -> & _). lia.
+Qed.
+
+Lemma host_once : forall k, k < length (host_units A) -> length (filter (isun (nH A + k)) hsrc) = 1.
+Proof.
+  intros k Hk. unfold hsrc.
+  assert (Hwfn : wfn (nH A) (host_units A)) by exact (fwfn (hblocks A) (nH A) (host_wf' A HA)).
+  rewrite (lev_units (nH A) (host_units A) (host_next A) Hwfn (host_next_len A)) by (unfold NS; lia).
+  change (host_units A) with (fus (hblocks A) (nH A)) in Hk. rewrite (fus_len _ _ (host_wf' A HA)) in Hk.
+  destruct (loc (hblocks A) (nH A) (host_wf' A HA) k Hk) as (b & j & r & Hv & Ek).
+  replace (nH A + k) with (idx (nH A) (hblocks A) (SRef b j r)) by (rewrite idx_ref, Ek; reflexivity).
+  rewrite (host_need A HA b j r Hv), (host_dep A HA _ Hv), (host_dmax A HA).
+  destruct (Nat.ltb_spec (cdh A (SRef b j r)) 13) as [Hl|Hg]; [reflexivity|].
+  pose proof (cdh_le13 A HA (SRef b j r)).
+  destruct (depth13_out (SRef b j r) Hv ltac:(lia)) as (i0 & Hi0 & E0).
+  unfold host_next. rewrite length_filter_map, <- E0.
+  rewrite (filter_ext_in _ (fun i => true && Nat.eqb i i0)).
+  - rewrite filter_eqb_seq by exact Hi0. reflexivity.
+  - intros i Hi. apply in_seq in Hi. cbn [andb]. destruct (Nat.eqb_spec i i0) as [->|E]; [apply Nat.eqb_refl|].
+    apply Nat.eqb_neq. intro Ex. apply E. apply hout_inj; [lia | exact Hi0|].
+    exact (idx_inj (hblocks A) (nH A) _ _ (hout_valid A HA i ltac:(lia)) (hout_valid A HA i0 Hi0) Ex).
+Qed.
+
+(* the rows of Lev(H_A) that are not units of H_A are identity units, and the entries are the edges of H_A and one for
+   each identity unit *)
+Theorem host_lev_rows_split :
+  length (concat (lev (nH A) (host_units A) (host_next A)))
+  = length (host_units A) + length (filter (fun c => negb (isUn c)) hsrc)
+  /\ fold_right Nat.add 0 (map (fun row => length (tin row)) (concat (lev (nH A) (host_units A) (host_next A))))
+     = nsum (length (host_units A)) (fun k => length (tin (nth k (host_units A) tu0)))
+       + length (filter (fun c => negb (isUn c)) hsrc).
+Proof.
+  split.
+  - rewrite lev_rowcount. fold hsrc.
+    assert (Hs : forall L : list src, length L = length (filter isUn L) + length (filter (fun c => negb (isUn c)) L))
+      by (induction L as [|c t IH]; [reflexivity|]; cbn [filter length]; destruct (isUn c); cbn [negb length]; lia).
+    rewrite Hs, (count_Un hsrc (nH A) (length (host_units A)) hsrc_range).
+    rewrite (nsum_ext _ _ (fun _ => 1)) by (intros k Hk; apply host_once; exact Hk). rewrite nsum_const. lia.
+  - rewrite lev_rowlens. fold hsrc. rewrite (sum_rowlen hsrc (host_units A) (nH A) (length (host_units A)) hsrc_range).
+    rewrite (nsum_ext _ (fun k => length (filter (isun (nH A + k)) hsrc) * length (tin (nth k (host_units A) tu0)))
+                       (fun k => length (tin (nth k (host_units A) tu0))))
+      by (intros k Hk; rewrite host_once by exact Hk; lia).
+    lia.
+Qed.
+
+(* Lev(H_A) adds (11A + 6) 2^A + 35A + 25 identity units to the units of H_A *)
+Theorem host_lev_identity : length (filter (fun c => negb (isUn c)) hsrc) = (11 * A + 6) * SW A + 35 * A + 25.
+Proof.
+  destruct host_lev_rows_split as [H _]. rewrite length_concat in H. unfold list_sum in H.
+  pose proof (host_lev_rows A HA) as R. pose proof host_units_count as U. lia.
+Qed.
+
+End HC.
+
+(* the least and the greatest bias are attained, by the conjunction [c = 2^A - 1] and by the disjunction of the
+   negated low bits of the operands *)
+Lemma host_bias_attained : forall A, 3 <= A ->
+  (exists k, k < length (host_units A) /\ Net.tb (nth k (host_units A) tu0) = (- Z.of_nat A)%Z)
+  /\ (exists k, k < length (host_units A) /\ Net.tb (nth k (host_units A) tu0) = 1%Z).
+Proof.
+  intros A HA. pose proof (SW_ge A HA). change (host_units A) with (fus (hblocks A) (nH A)).
+  assert (Hv1 : valid (hblocks A) (nH A) (SRef 9 0 0)).
+  { split; [rewrite length_hblocks by lia; unfold tb; lia|]. rewrite nth_hb_pre by lia. cbn. lia. }
+  assert (Hv2 : valid (hblocks A) (nH A) (SRef (tb A + 5) 0 1)).
+  { split; [rewrite length_hblocks by lia; lia|]. rewrite nth_hb_post by lia. cbn. lia. }
+  split.
+  - exists (boff (hblocks A) 9 + sz (hblocks A) 9 * 0 + 0). split.
+    + rewrite (fus_len _ _ (host_wf' A HA)). exact (unit_lt _ _ 9 0 0 Hv1).
+    + rewrite (fus_nth _ _ (host_wf' A HA) 9 0 0 Hv1). unfold flat_unit, sunit. cbn [Net.tb].
+      rewrite nth_hb_pre by lia. cbn [nth hpre bshape blk_AC sb sAND]. unfold npos.
+      assert (G : forall l : list nat, length (filter snd (map (fun t => (opb A 2 t, true)) l)) = length l)
+        by (induction l as [|a t IH]; [reflexivity|]; cbn [map filter snd length]; rewrite IH; reflexivity).
+      rewrite G, length_seq. reflexivity.
+  - exists (boff (hblocks A) (tb A + 5) + sz (hblocks A) (tb A + 5) * 0 + 1). split.
+    + rewrite (fus_len _ _ (host_wf' A HA)). exact (unit_lt _ _ _ 0 1 Hv2).
+    + rewrite (fus_nth _ _ (host_wf' A HA) _ 0 1 Hv2). unfold flat_unit, sunit. cbn [Net.tb].
+      rewrite nth_hb_post by lia. reflexivity.
+Qed.
+
+(* ---- the host with eight-bit words, in binary numbers ------------------------------------------------------ *)
+Lemma host_units_8 : N.of_nat (length (host_units 8)) = 17598%N.
+Proof. pose proof (host_units_count 8 ltac:(lia)) as H. assert (SW 8 = 256) by reflexivity. lia. Qed.
+
+Lemma host_edges_8 : N.of_nat (nsum (length (host_units 8)) (fun k => length (tin (nth k (host_units 8) tu0)))) = 51132%N.
+Proof. pose proof (host_edges 8 ltac:(lia)) as H. assert (SW 8 = 256) by reflexivity. lia. Qed.
+
+Lemma host_memory_8 : N.of_nat (fold_right Nat.add 0 (map (fun b => bcount (nth b (hblocks 8) blk0)
+                                                                   * bsize (nth b (hblocks 8) blk0)) (memblocks 8)))
+                      = 17448%N.
+Proof. pose proof (host_memory_count 8 ltac:(lia)) as H. assert (SW 8 = 256) by reflexivity. lia. Qed.
+
+(* Lev(H_8): 24,369 identity units and 75,501 nonzero entries *)
+Lemma host_lev_identity_8 : N.of_nat (length (filter (fun c => negb (isUn c)) (hsrc 8))) = 24369%N.
+Proof. pose proof (host_lev_identity 8 ltac:(lia)) as H. assert (SW 8 = 256) by reflexivity. lia. Qed.
+
+Lemma host_lev_nonzero_8 :
+  N.of_nat (fold_right Nat.add 0 (map (fun row => length (tin row)) (concat (lev (nH 8) (host_units 8) (host_next 8)))))
+  = 75501%N.
+Proof.
+  destruct (host_lev_rows_split 8 ltac:(lia)) as [_ H]. rewrite H.
+  pose proof host_edges_8. pose proof host_lev_identity_8. lia.
+Qed.

rocq/HostLev.v

@@ -0,0 +1,922 @@
+(* The host levelized (Proposition 3.8 and Remark 2.7): for every A >= 3 every unit of H_A contributes to a next
+   value, the step has depth 13, and the layers of Lev(H_A) have the widths given below; the units, edges and biases
+   of H_A. *)
+From Stdlib Require Import List Bool Arith ZArith Lia.
+Import ListNotations.
+From TH Require Import TwoHead Net Gates Host HostWF Lev BlockLev.
+
+Section HL.
+Variable A : nat.
+Hypothesis HA : 3 <= A.
+
+(* ---- the depth and the last reading layer of each signal ------------------------------------------------- *)
+Definition cd_pre (b : nat) : nat :=
+  match b with 0 | 1 => 1 | 2 | 3 | 4 | 5 => 2 | 6 => 3 | 7 | 8 | 9 => 4 | 10 | 11 | 12 => 5 | 13 | 14 | 15 => 6 | _ => 7 end.
+Definition cd_T (k r : nat) : nat := if Nat.eqb r 0 then 8 else if Nat.eqb r k then 7 else 8.
+Definition cd_post (i j r : nat) : nat :=
+  match i with
+  | 0 => 9 | 1 | 2 => 7 | 3 => 8 | 4 => 9 | 5 => if r <? 2 then 7 else 8 | 6 => 10 | 7 | 8 => 11
+  | 9 | 10 => 12 | 11 => 13 | 12 => if r <? 2 then 12 else 13
+  | 13 => if Nat.eqb (j mod A) (A - 1) then 9 else 12
+  | _ => if Nat.eqb (j mod A) (A - 1) then 10 else 13
+  end.
+Definition cdh (x : sref) : nat :=
+  match x with
+  | SIn _ => 0
+  | SRef b j r => if b <? 17 then cd_pre b else if b <? tb A then cd_T (b - 16) r else cd_post (b - tb A) j r
+  end.
+
+Definition cl_pre (b j : nat) : nat :=
+  match b with
+  | 0 => if Nat.eqb j (SW A - 4) then 12 else 2
+  | 1 => 13 | 2 | 3 | 4 => 3 | 5 => 12 | 6 => if j <? 2 * A then 4 else 12 | 7 | 8 => 5 | 9 | 10 => 12
+  | 11 | 12 => 6 | 13 => if Nat.eqb (j mod A) (A - 1) then 10 else 13
+  | 14 | 15 => if Nat.eqb j (A - 1) then 8 else 10
+  | _ => 8
+  end.
+Definition cl_post (i j r : nat) : nat :=
+  match i with
+  | 0 => 10 | 1 | 2 => 8 | 3 => 9 | 4 => 11 | 5 => if r <? 2 then 8 else 9 | 6 => 11 | 7 | 8 => 12
+  | 9 | 10 => 13 | 11 => 14 | 12 => if r <? 2 then 13 else 14
+  | 13 => if Nat.eqb (j mod A) (A - 1) then 10 else 13
+  | _ => 14
+  end.
+Definition clh (x : sref) : nat :=
+  match x with
+  | SIn i => if i <? A then 1 else if Nat.eqb i A then 13 else 6
+  | SRef b j r => if b <? 17 then cl_pre b j else if b <? tb A then 9 else cl_post (b - tb A) j r
+  end.
+
+Lemma cdh_pre : forall b j r, b < 17 -> cdh (SRef b j r) = cd_pre b.
+Proof. intros b j r H. cbn [cdh]. destruct (Nat.ltb_spec b 17); [reflexivity | lia]. Qed.
+
+Lemma cdh_T : forall k r, 1 <= k -> k < A -> cdh (SRef (16 + k) 0 r) = cd_T k r.
+Proof.
+  intros k r H1 H2. cbn [cdh]. destruct (Nat.ltb_spec (16 + k) 17); [lia|].
+  destruct (Nat.ltb_spec (16 + k) (tb A)); [|unfold tb in *; lia]. f_equal. lia.
+Qed.
+
+Lemma cdh_post : forall i j r, cdh (SRef (tb A + i) j r) = cd_post i j r.
+Proof.
+  intros i j r. cbn [cdh]. destruct (Nat.ltb_spec (tb A + i) 17); [unfold tb in *; lia|].
+  destruct (Nat.ltb_spec (tb A + i) (tb A)); [lia|]. f_equal. lia.
+Qed.
+
+Lemma cdh_post_at : forall b i j r, b = tb A + i -> cdh (SRef b j r) = cd_post i j r.
+Proof. intros b i j r ->. apply cdh_post. Qed.
+
+Lemma clh_pre : forall b j r, b < 17 -> clh (SRef b j r) = cl_pre b j.
+Proof. intros b j r H. cbn [clh]. destruct (Nat.ltb_spec b 17); [reflexivity | lia]. Qed.
+
+Lemma clh_T : forall k r, 1 <= k -> k < A -> clh (SRef (16 + k) 0 r) = 9.
+Proof.
+  intros k r H1 H2. cbn [clh]. destruct (Nat.ltb_spec (16 + k) 17); [lia|].
+  destruct (Nat.ltb_spec (16 + k) (tb A)); [reflexivity | unfold tb in *; lia].
+Qed.
+
+Lemma clh_post : forall i j r, clh (SRef (tb A + i) j r) = cl_post i j r.
+Proof.
+  intros i j r. cbn [clh]. destruct (Nat.ltb_spec (tb A + i) 17); [unfold tb in *; lia|].
+  destruct (Nat.ltb_spec (tb A + i) (tb A)); [lia|]. f_equal. lia.
+Qed.
+
+Lemma clh_post_at : forall b i j r, b = tb A + i -> clh (SRef b j r) = cl_post i j r.
+Proof. intros b i j r ->. apply clh_post. Qed.
+
+Lemma SW_ge8 : 8 <= SW A.
+Proof. apply SW_ge. exact HA. Qed.
+
+(* the named signals *)
+Lemma cl_pcb : forall i, i < A -> clh (pcb i) = 1.
+Proof. intros i H. cbn [clh pcb]. destruct (Nat.ltb_spec i A); [reflexivity | lia]. Qed.
+
+Lemma cl_halt : clh (haltb A) = 13.
+Proof. cbn [clh haltb]. rewrite Nat.ltb_irrefl, Nat.eqb_refl. reflexivity. Qed.
+
+Lemma cl_mu : forall j t, clh (mu A j t) = 6.
+Proof.
+  intros j t. cbn [clh mu]. destruct (Nat.ltb_spec (A + 1 + j * A + t) A); [lia|].
+  destruct (Nat.eqb_spec (A + 1 + j * A + t) A); [lia | reflexivity].
+Qed.
+
+Lemma cd_opb : forall o t, cdh (opb A o t) = 3.
+Proof. intros o t. unfold opb. rewrite cdh_pre by lia. reflexivity. Qed.
+
+Lemma cl_opb : forall o t, t < A -> clh (opb A o t) = if o <? 2 then 4 else 12.
+Proof.
+  intros o t Ht. unfold opb. rewrite clh_pre by lia. cbn [cl_pre].
+  destruct (Nat.ltb_spec (o * A + t) (2 * A)), (Nat.ltb_spec o 2); try reflexivity; nia.
+Qed.
+
+Lemma cd_xv : forall i, cdh (xv A i) = 6.
+Proof. intro i. unfold xv. rewrite cdh_pre by lia. reflexivity. Qed.
+
+Lemma cd_yv : forall i, cdh (yv A i) = 6.
+Proof. intro i. unfold yv. rewrite cdh_pre by lia. reflexivity. Qed.
+
+Lemma cl_xv : forall i, i < A -> clh (xv A i) = if Nat.eqb i 0 then 8 else 10.
+Proof.
+  intros i Hi. unfold xv. rewrite clh_pre by lia. cbn [cl_pre].
+  destruct (Nat.eqb_spec (A - 1 - i) (A - 1)), (Nat.eqb_spec i 0); try reflexivity; lia.
+Qed.
+
+Lemma cl_yv : forall i, i < A -> clh (yv A i) = if Nat.eqb i 0 then 8 else 10.
+Proof.
+  intros i Hi. unfold yv. rewrite clh_pre by lia. cbn [cl_pre].
+  destruct (Nat.eqb_spec (A - 1 - i) (A - 1)), (Nat.eqb_spec i 0); try reflexivity; lia.
+Qed.
+
+Lemma cd_prr : forall i, cdh (prr i) = 7.
+Proof. intro i. unfold prr. rewrite cdh_pre by lia. reflexivity. Qed.
+
+Lemma cl_prr : forall i, clh (prr i) = 8.
+Proof. intro i. unfold prr. rewrite clh_pre by lia. reflexivity. Qed.
+
+Lemma cd_rbit : forall k, cdh (rbit A k) = if Nat.eqb k 0 then 8 else 11.
+Proof. intro k. unfold rbit. destruct (Nat.eqb k 0); rewrite cdh_post; reflexivity. Qed.
+
+Lemma cl_rbit : forall k, clh (rbit A k) = if Nat.eqb k 0 then 9 else 12.
+Proof. intro k. unfold rbit. destruct (Nat.eqb k 0); rewrite clh_post; reflexivity. Qed.
+
+(* membership in the predecessors of a gate *)
+Lemma in_and : forall (ls : list lit) (x : sref) (pol : bool), In (x, pol) ls ->
+  In (x, if pol then 1%Z else (-1)%Z) (sin (sAND ls)).
+Proof. intros ls x pol H. cbn [sin sAND]. exact (in_map lw ls (x, pol) H). Qed.
+
+Lemma in_or : forall (ls : list lit) (x : sref) (pol : bool), In (x, pol) ls ->
+  In (x, if pol then 1%Z else (-1)%Z) (sin (sOR ls)).
+Proof. intros ls x pol H. cbn [sin sOR]. exact (in_map lw ls (x, pol) H). Qed.
+
+Ltac ing pol := first [apply (in_and _ _ pol) | apply (in_or _ _ pol)].
+
+Lemma sin_SU : forall b l, sin (SU b l) = l.
+Proof. reflexivity. Qed.
+
+Lemma gate_in : forall (ls : list lit) (x : sref) (z : Z),
+  In (x, z) (sin (sAND ls)) \/ In (x, z) (sin (sOR ls)) -> In x (map fst ls).
+Proof. exact in_sin_lits. Qed.
+
+Lemma Q_ne : forall i, i < A -> In (SW A - 4) (filter (fun j => bitof A ((j + 3) mod SW A) i) (seq 0 (SW A))).
+Proof.
+  intros i Hi. pose proof SW_ge8. apply filter_In. split; [apply in_seq; lia|].
+  replace (SW A - 4 + 3) with (SW A - 1) by lia. rewrite Nat.mod_small by lia.
+  unfold bitof, SW. replace (2 ^ A - 1) with (Nat.ones A) by (unfold Nat.ones; rewrite Nat.shiftl_1_l; lia).
+  apply Nat.ones_spec_low. lia.
+Qed.
+
+Lemma cl_P_ge : forall j, 2 <= cl_pre 0 j.
+Proof. intro j. cbn [cl_pre]. destruct (Nat.eqb j (SW A - 4)); lia. Qed.
+
+Lemma mod_A : forall m, m mod A < A.
+Proof. intro m. apply Nat.mod_upper_bound. lia. Qed.
+
+(* every unit lies one layer above its deepest predecessor and no later than the last reader of each *)
+Definition unit_ok (b j r : nat) : Prop :=
+  (forall p z, In (p, z) (sin (sunit (hblocks A) b j r)) -> S (cdh p) <= cdh (SRef b j r) <= clh p)
+  /\ exists p z, In (p, z) (sin (sunit (hblocks A) b j r)) /\ S (cdh p) = cdh (SRef b j r).
+
+Theorem host_unit_ok : forall b j r, valid (hblocks A) (nH A) (SRef b j r) -> unit_ok b j r.
+Proof.
+  intros b j r (Hb & Hj & Hr). pose proof SW_ge8 as HS. rewrite length_hblocks in Hb by lia. unfold unit_ok, sunit.
+  destruct (Nat.lt_ge_cases b 17) as [Hp|Hp].
+  { rewrite nth_hb_pre in Hj, Hr |- * by exact Hp. rewrite cdh_pre by exact Hp.
+    assert (Hc : b = 0 \/ b = 1 \/ b = 2 \/ b = 3 \/ b = 4 \/ b = 5 \/ b = 6 \/ b = 7 \/ b = 8 \/ b = 9
+                 \/ b = 10 \/ b = 11 \/ b = 12 \/ b = 13 \/ b = 14 \/ b = 15 \/ b = 16) by lia.
+    destruct Hc as [->|[->|[->|[->|[->|[->|[->|[->|[->|[->|[->|[->|[->|[->|[->|[->| ->]]]]]]]]]]]]]]]];
+      cbn [nth hpre bcount bsize bshape blk_P blk_HP blk_FA blk_Q blk_F blk_PA blk_PB blk_AC blk_W
+           blk_RX blk_RY blk_KP blk_X blk_Y blk_PR cd_pre] in Hj, Hr |- *;
+      (destruct r as [|r]; [|lia]); cbn [nth].
+    - (* P *) split.
+      + intros p z Hin. lits_in Hin. apply in_map_iff in H as (t & <- & Ht). apply in_seq in Ht.
+        cbn [cdh pcb]. rewrite cl_pcb by lia. lia.
+      + exists (pcb 0), (if bitof A j 0 then 1%Z else (-1)%Z). split; [|reflexivity].
+        ing (bitof A j 0). unfold lits. apply (in_map (fun t => (pcb t, bitof A j t))). apply in_seq. lia.
+    - (* HP *) split.
+      + intros p z Hin. lits_in Hin. destruct H as [<-|[<-|[]]]; [cbn [cdh pcb]; rewrite cl_pcb by lia | cbn [cdh haltb]; rewrite cl_halt]; lia.
+      + exists (pcb j), 1%Z. split; [ing true; left; reflexivity | reflexivity].
+    - (* FA 0 *) split.
+      + intros p z Hin. lits_in Hin. destruct H as [<-|[<-|[]]]; [cbn [cdh mu]; rewrite cl_mu; lia|].
+        rewrite cdh_pre, clh_pre by lia. pose proof (cl_P_ge (j mod SW A)). cbn [cd_pre]. lia.
+      + exists (SRef 0 (j mod SW A) 0), 1%Z. split; [ing true; right; left; reflexivity | rewrite cdh_pre by lia; reflexivity].
+    - (* FA 1 *) split.
+      + intros p z Hin. lits_in Hin. destruct H as [<-|[<-|[]]]; [cbn [cdh mu]; rewrite cl_mu; lia|].
+        rewrite cdh_pre, clh_pre by lia. pose proof (cl_P_ge (j mod SW A)). cbn [cd_pre]. lia.
+      + exists (SRef 0 (j mod SW A) 0), 1%Z. split; [ing true; right; left; reflexivity | rewrite cdh_pre by lia; reflexivity].
+    - (* FA 2 *) split.
+      + intros p z Hin. lits_in Hin. destruct H as [<-|[<-|[]]]; [cbn [cdh mu]; rewrite cl_mu; lia|].
+        rewrite cdh_pre, clh_pre by lia. pose proof (cl_P_ge (j mod SW A)). cbn [cd_pre]. lia.
+      + exists (SRef 0 (j mod SW A) 0), 1%Z. split; [ing true; right; left; reflexivity | rewrite cdh_pre by lia; reflexivity].
+    - (* Q *) split.
+      + intros p z Hin. lits_in Hin. rewrite ?map_map in H. apply in_map_iff in H as (j' & <- & _).
+        rewrite cdh_pre, clh_pre by lia. pose proof (cl_P_ge j'). cbn [cd_pre]. lia.
+      + exists (SRef 0 (SW A - 4) 0), 1%Z. split; [|rewrite cdh_pre by lia; reflexivity].
+        ing true. apply (in_map (fun j' => (SRef 0 j' 0, true))). apply Q_ne. lia.
+    - (* F *) assert (Ho : j / A = 0 \/ j / A = 1 \/ j / A = 2) by (pose proof (div_lt j 3 A ltac:(lia) ltac:(lia)); lia).
+      split.
+      + intros p z Hin. lits_in Hin. rewrite ?map_map in H. apply in_map_iff in H as (j' & <- & _).
+        rewrite cdh_pre, clh_pre by lia. destruct Ho as [-> | [-> | ->]]; cbn [cd_pre cl_pre Nat.add]; lia.
+      + exists (SRef (2 + j / A) ((j mod A) * SW A + 0) 0), 1%Z. split.
+        * ing true. apply (in_map (fun j' => (SRef (2 + j / A) ((j mod A) * SW A + j') 0, true))). apply in_seq. lia.
+        * rewrite cdh_pre by lia. destruct Ho as [-> | [-> | ->]]; reflexivity.
+    - (* PA *) split.
+      + intros p z Hin. lits_in Hin. apply in_map_iff in H as (t & <- & Ht). apply in_seq in Ht.
+        rewrite cd_opb, cl_opb by lia. cbn. lia.
+      + exists (opb A 0 0), (if bitof A j 0 then 1%Z else (-1)%Z). split; [|rewrite cd_opb; reflexivity].
+        ing (bitof A j 0). unfold lits. apply (in_map (fun t => (opb A 0 t, bitof A j t))). apply in_seq. lia.
+    - (* PB *) split.
+      + intros p z Hin. lits_in Hin. apply in_map_iff in H as (t & <- & Ht). apply in_seq in Ht.
+        rewrite cd_opb, cl_opb by lia. cbn. lia.
+      + exists (opb A 1 0), (if bitof A j 0 then 1%Z else (-1)%Z). split; [|rewrite cd_opb; reflexivity].
+        ing (bitof A j 0). unfold lits. apply (in_map (fun t => (opb A 1 t, bitof A j t))). apply in_seq. lia.
+    - (* AC *) split.
+      + intros p z Hin. lits_in Hin. rewrite ?map_map in H. apply in_map_iff in H as (t & <- & Ht). apply in_seq in Ht.
+        rewrite cd_opb, cl_opb by lia. cbn. lia.
+      + exists (opb A 2 0), 1%Z. split; [|rewrite cd_opb; reflexivity].
+        ing true. apply (in_map (fun t => (opb A 2 t, true))). apply in_seq. lia.
+    - (* W *) split.
+      + intros p z Hin. lits_in Hin. destruct H as [<-|[<-|[]]]; [cbn [cdh haltb]; rewrite cl_halt; lia|].
+        rewrite cdh_pre, clh_pre by lia. cbn. lia.
+      + exists (SRef 8 j 0), 1%Z. split; [ing true; right; left; reflexivity | rewrite cdh_pre by lia; reflexivity].
+    - (* RX *) split.
+      + intros p z Hin. lits_in Hin. destruct H as [<-|[<-|[]]]; [cbn [cdh mu]; rewrite cl_mu; lia|].
+        rewrite cdh_pre, clh_pre by lia. cbn. lia.
+      + exists (SRef 7 (j mod SW A) 0), 1%Z. split; [ing true; right; left; reflexivity | rewrite cdh_pre by lia; reflexivity].
+    - (* RY *) split.
+      + intros p z Hin. lits_in Hin. destruct H as [<-|[<-|[]]]; [cbn [cdh mu]; rewrite cl_mu; lia|].
+        rewrite cdh_pre, clh_pre by lia. cbn. lia.
+      + exists (SRef 8 (j mod SW A) 0), 1%Z. split; [ing true; right; left; reflexivity | rewrite cdh_pre by lia; reflexivity].
+    - (* KP *) split.
+      + intros p z Hin. lits_in Hin. destruct H as [<-|[<-|[]]]; [cbn [cdh mu]; rewrite cl_mu; lia|].
+        rewrite cdh_pre, clh_pre by lia. cbn. lia.
+      + exists (SRef 10 (j / A) 0), (-1)%Z. split; [|rewrite cdh_pre by lia; reflexivity].
+        ing false. right. left. reflexivity.
+    - (* X *) split.
+      + intros p z Hin. lits_in Hin. rewrite ?map_map in H. apply in_map_iff in H as (j' & <- & _).
+        rewrite cdh_pre, clh_pre by lia. cbn. lia.
+      + exists (SRef 11 (j * SW A + 0) 0), 1%Z. split; [|rewrite cdh_pre by lia; reflexivity].
+        ing true. apply (in_map (fun j' => (SRef 11 (j * SW A + j') 0, true))). apply in_seq. lia.
+    - (* Y *) split.
+      + intros p z Hin. lits_in Hin. rewrite ?map_map in H. apply in_map_iff in H as (j' & <- & _).
+        rewrite cdh_pre, clh_pre by lia. cbn. lia.
+      + exists (SRef 12 (j * SW A + 0) 0), 1%Z. split; [|rewrite cdh_pre by lia; reflexivity].
+        ing true. apply (in_map (fun j' => (SRef 12 (j * SW A + j') 0, true))). apply in_seq. lia.
+    - (* PR *) split.
+      + intros p z Hin. lits_in Hin. destruct H as [<-|[<-|[]]];
+          [rewrite cd_xv, cl_xv by lia | rewrite cd_yv, cl_yv by lia]; destruct (Nat.eqb j 0); lia.
+      + exists (xv A j), (-1)%Z. split; [ing false; left; reflexivity | rewrite cd_xv; reflexivity]. }
+  destruct (Nat.lt_ge_cases b (tb A)) as [HT|HT].
+  { (* the carry terms into bit k = b - 16 *)
+    unfold tb in HT. replace b with (16 + (b - 16)) in Hj, Hr |- * by lia.
+    rewrite nth_hb_T in Hj, Hr |- * by lia. cbn [bcount bsize bshape blk_T] in Hj, Hr |- *.
+    assert (Hj0 : j = 0) by lia. subst j. rewrite cdh_T by lia.
+    remember (b - 16) as k eqn:Ek. assert (Hk : 1 <= k < A) by lia. destruct k as [|k]; [lia|].
+    destruct r as [|r]; cbn [nth cd_T Nat.eqb].
+    - split.
+      + intros p z Hin. lits_in Hin. rewrite ?map_map in H. apply in_map_iff in H as (i & <- & Hi). apply in_seq in Hi.
+        rewrite cd_prr, cl_prr. lia.
+      + exists (prr 0), 1%Z. split; [|rewrite cd_prr; reflexivity].
+        ing true. apply (in_map (fun i => (prr i, true))). apply in_seq. lia.
+    - rewrite nth_map_d with (d' := 0) by (rewrite length_seq; lia). rewrite seq_nth by lia. cbn [Nat.add].
+      assert (Hrk : r <= k) by lia.
+      split.
+      + intros p z Hin. lits_in Hin. rewrite ?map_app, ?map_map in H. cbn [map fst app] in H.
+        destruct H as [<-|[<-|H]].
+        * rewrite cd_yv, cl_yv by lia. destruct (Nat.eqb_spec r k), (Nat.eqb r 0); lia.
+        * rewrite cd_xv, cl_xv by lia. destruct (Nat.eqb_spec r k), (Nat.eqb r 0); lia.
+        * apply in_map_iff in H as (i & <- & Hi). apply in_seq in Hi. rewrite cd_prr, cl_prr.
+          destruct (Nat.eqb_spec r k); lia.
+      + destruct (Nat.eqb_spec r k) as [E|E].
+        * exists (yv A r), 1%Z. split; [ing true; left; reflexivity | rewrite cd_yv; reflexivity].
+        * exists (prr (S r)), 1%Z. split; [|rewrite cd_prr; reflexivity].
+          ing true. apply in_or_app. right. apply (in_map (fun i => (prr i, true))). apply in_seq. lia. }
+  replace b with (tb A + (b - tb A)) in Hj, Hr |- * by lia.
+  rewrite nth_hb_post in Hj, Hr |- * by lia. rewrite cdh_post.
+  assert (Hi : b - tb A < 15) by (unfold tb in *; lia).
+  remember (b - tb A) as i eqn:Ei. clear Ei Hb Hp HT.
+  assert (Hc : i = 0 \/ i = 1 \/ i = 2 \/ i = 3 \/ i = 4 \/ i = 5 \/ i = 6 \/ i = 7 \/ i = 8 \/ i = 9
+               \/ i = 10 \/ i = 11 \/ i = 12 \/ i = 13 \/ i = 14) by lia.
+  destruct Hc as [->|[->|[->|[->|[->|[->|[->|[->|[->|[->|[->|[->|[->|[->| ->]]]]]]]]]]]]]];
+    cbn [nth hpost bcount bsize bshape blk_C blk_AX blk_NX blk_XN blk_EQ blk_R0 blk_H blk_R blk_LEQ
+         blk_TA blk_TB blk_NP blk_HAB blk_WR blk_NM cd_post] in Hj, Hr |- *.
+  - (* C *) destruct r as [|r]; [|lia]. cbn [nth]. split.
+    + intros p z Hin. lits_in Hin. destruct H as [<-|H].
+      * rewrite (cdh_T (S j)), (clh_T (S j)) by lia. cbn [cd_T Nat.eqb]. lia.
+      * rewrite ?map_map in H. apply in_map_iff in H as (j' & <- & Hj'). apply in_seq in Hj'. cbn [fst].
+        rewrite (cdh_T (S j)), (clh_T (S j)) by lia. unfold cd_T. destruct (Nat.eqb (S j') 0), (Nat.eqb (S j') (S j)); lia.
+    + exists (SRef (16 + S j) 0 0), 1%Z. split; [ing true; left; reflexivity|].
+      rewrite (cdh_T (S j)) by lia. reflexivity.
+  - (* AX *) destruct r as [|r]; [|lia]. cbn [nth]. split.
+    + intros p z Hin. lits_in Hin. destruct H as [<-|[<-|[]]];
+        [rewrite cd_xv, cl_xv by lia | rewrite cd_yv, cl_yv by lia]; destruct (Nat.eqb j 0); lia.
+    + exists (xv A j), 1%Z. split; [ing true; left; reflexivity | rewrite cd_xv; reflexivity].
+  - (* NX *) destruct r as [|r]; [|lia]. cbn [nth]. split.
+    + intros p z Hin. lits_in Hin. destruct H as [<-|[<-|[]]];
+        [rewrite cd_xv, cl_xv by lia | rewrite cd_yv, cl_yv by lia]; destruct (Nat.eqb j 0); lia.
+    + exists (xv A j), (-1)%Z. split; [ing false; left; reflexivity | rewrite cd_xv; reflexivity].
+  - (* XN *) destruct r as [|r]; [|lia]. cbn [nth]. split.
+    + intros p z Hin. lits_in Hin. destruct H as [<-|[<-|[]]]; rewrite cdh_post, clh_post; cbn; lia.
+    + exists (SRef (tb A + 1) j 0), 1%Z. split; [ing true; left; reflexivity | rewrite cdh_post; reflexivity].
+  - (* EQ *) destruct r as [|r]; [|lia]. cbn [nth]. split.
+    + intros p z Hin. lits_in Hin. rewrite ?map_map in H. apply in_map_iff in H as (i' & <- & _).
+      rewrite cdh_post, clh_post. cbn. lia.
+    + exists (SRef (tb A + 3) 0 0), 1%Z. split; [|rewrite cdh_post; reflexivity].
+      ing true. apply (in_map (fun i' => (SRef (tb A + 3) i' 0, true))). apply in_seq. lia.
+  - (* R0 *) assert (Hj0 : j = 0) by lia. subst j. assert (Hr3 : r = 0 \/ r = 1 \/ r = 2) by lia.
+    destruct Hr3 as [->|[->| ->]]; cbn [nth Nat.ltb Nat.leb]; split.
+    + intros p z Hin. lits_in Hin. destruct H as [<-|[<-|[]]];
+        [rewrite cd_yv, cl_yv by lia | rewrite cd_xv, cl_xv by lia]; cbn; lia.
+    + exists (yv A 0), 1%Z. split; [ing true; left; reflexivity | rewrite cd_yv; reflexivity].
+    + intros p z Hin. lits_in Hin. destruct H as [<-|[<-|[]]];
+        [rewrite cd_yv, cl_yv by lia | rewrite cd_xv, cl_xv by lia]; cbn; lia.
+    + exists (yv A 0), (-1)%Z. split; [ing false; left; reflexivity | rewrite cd_yv; reflexivity].
+    + intros p z Hin. lits_in Hin. destruct H as [<-|[<-|[]]]; rewrite cdh_post, clh_post; cbn; lia.
+    + exists (SRef (tb A + 5) 0 0), 1%Z. split; [ing true; left; reflexivity | rewrite cdh_post; reflexivity].
+  - (* H *) assert (Hr3 : r = 0 \/ r = 1 \/ r = 2) by lia.
+    assert (Hpre : forall bias,
+      (forall p z, In (p, z) (sin (SU bias [(yv A (S j), 1%Z); (xv A (S j), (-1)%Z); (SRef (tb A) j 0, 1%Z)])) ->
+                   S (cdh p) <= 10 <= clh p)
+      /\ exists p z, In (p, z) (sin (SU bias [(yv A (S j), 1%Z); (xv A (S j), (-1)%Z); (SRef (tb A) j 0, 1%Z)]))
+                     /\ S (cdh p) = 10).
+    { intro bias. split.
+      - intros p z Hin. cbn [sin] in Hin. destruct Hin as [E|[E|[E|[]]]]; injection E as <- <-.
+        + rewrite cd_yv, cl_yv by lia. cbn. lia.
+        + rewrite cd_xv, cl_xv by lia. cbn. lia.
+        + rewrite <- (Nat.add_0_r (tb A)), cdh_post, clh_post. cbn. lia.
+      - exists (SRef (tb A) j 0), 1%Z. split; [cbn [sin]; right; right; left; reflexivity|].
+        rewrite <- (Nat.add_0_r (tb A)), cdh_post. reflexivity. }
+    destruct Hr3 as [->|[->| ->]]; cbn [nth map]; apply Hpre.
+  - (* R *) destruct r as [|r]; [|lia]. cbn [nth]. split.
+    + intros p z Hin. rewrite sin_SU in Hin. repeat (destruct Hin as [Hin|Hin]; [injection Hin as <- <-|]); try destruct Hin;
+        rewrite (cdh_post_at _ 6), (clh_post_at _ 6) by (unfold tb; lia); cbn; lia.
+    + exists (SRef (tb A + 6) j 0), 1%Z. split; [cbn [sin]; left; reflexivity | rewrite cdh_post; reflexivity].
+  - (* LEQ *) destruct r as [|r]; [|lia]. cbn [nth]. split.
+    + intros p z Hin. rewrite sin_SU in Hin. repeat (destruct Hin as [Hin|Hin]; [injection Hin as <- <-|]); try destruct Hin;
+        first [rewrite (cdh_post_at _ 6), (clh_post_at _ 6) by (unfold tb; lia)
+              | rewrite (cdh_post_at _ 4), (clh_post_at _ 4) by (unfold tb; lia)]; cbn; lia.
+    + exists (SRef (tb A + 6) (A - 2) 0), 1%Z. split; [cbn [sin]; left; reflexivity | rewrite cdh_post; reflexivity].
+  - (* TA *) destruct r as [|r]; [|lia]. cbn [nth]. split.
+    + intros p z Hin. lits_in Hin. destruct H as [<-|[<-|[<-|[]]]].
+      * cbn [cdh haltb]. rewrite cl_halt. lia.
+      * rewrite cdh_post, clh_post. cbn. lia.
+      * rewrite cd_opb, cl_opb by lia. cbn. lia.
+    + exists (SRef (tb A + 8) 0 0), 1%Z. split; [ing true; right; left; reflexivity | rewrite cdh_post; reflexivity].
+  - (* TB *) destruct r as [|r]; [|lia]. cbn [nth]. split.
+    + intros p z Hin. lits_in Hin. destruct H as [<-|[<-|[<-|[]]]].
+      * cbn [cdh haltb]. rewrite cl_halt. lia.
+      * rewrite cdh_post, clh_post. cbn. lia.
+      * rewrite cdh_pre, clh_pre by lia. cbn. lia.
+    + exists (SRef (tb A + 8) 0 0), (-1)%Z. split; [ing false; right; left; reflexivity | rewrite cdh_post; reflexivity].
+  - (* NP *) destruct r as [|r]; [|lia]. cbn [nth]. split.
+    + intros p z Hin. lits_in Hin. destruct H as [<-|[<-|[<-|[]]]].
+      * rewrite cdh_pre, clh_pre by lia. cbn. lia.
+      * rewrite cdh_post, clh_post. cbn. lia.
+      * rewrite cdh_post, clh_post. cbn. lia.
+    + exists (SRef (tb A + 9) j 0), 1%Z. split; [ing true; right; left; reflexivity | rewrite cdh_post; reflexivity].
+  - (* HA, HB, NH *) assert (Hj0 : j = 0) by lia. subst j. assert (Hr3 : r = 0 \/ r = 1 \/ r = 2) by lia.
+    destruct Hr3 as [->|[->| ->]]; cbn [nth Nat.ltb Nat.leb]; split.
+    + intros p z Hin. lits_in Hin. destruct H as [<-|[<-|[<-|[]]]].
+      * cbn [cdh haltb]. rewrite cl_halt. lia.
+      * rewrite cdh_post, clh_post. cbn. lia.
+      * rewrite cdh_pre, clh_pre by lia. cbn. lia.
+    + exists (SRef (tb A + 8) 0 0), 1%Z. split; [ing true; right; left; reflexivity | rewrite cdh_post; reflexivity].
+    + intros p z Hin. lits_in Hin. destruct H as [<-|[<-|[<-|[]]]].
+      * cbn [cdh haltb]. rewrite cl_halt. lia.
+      * rewrite cdh_post, clh_post. cbn. lia.
+      * rewrite cdh_pre, clh_pre by lia. cbn [cd_pre cl_pre]. rewrite Nat.eqb_refl. lia.
+    + exists (SRef (tb A + 8) 0 0), (-1)%Z. split; [ing false; right; left; reflexivity | rewrite cdh_post; reflexivity].
+    + intros p z Hin. lits_in Hin. destruct H as [<-|[<-|[<-|[]]]].
+      * cbn [cdh haltb]. rewrite cl_halt. lia.
+      * rewrite cdh_post, clh_post. cbn. lia.
+      * rewrite cdh_post, clh_post. cbn. lia.
+    + exists (SRef (tb A + 12) 0 0), 1%Z. split; [ing true; right; left; reflexivity | rewrite cdh_post; reflexivity].
+  - (* WR *) destruct r as [|r]; [|lia]. cbn [nth]. pose proof (mod_A j) as Hm. split.
+    + intros p z Hin. lits_in Hin. destruct H as [<-|[<-|[]]].
+      * rewrite cd_rbit, cl_rbit. destruct (Nat.eqb_spec (j mod A) (A - 1)), (Nat.eqb_spec (A - 1 - j mod A) 0); lia.
+      * rewrite cdh_pre, clh_pre by lia. cbn [cd_pre cl_pre]. destruct (Nat.eqb (j mod A) (A - 1)); lia.
+    + exists (rbit A (A - 1 - j mod A)), 1%Z. split; [ing true; left; reflexivity|].
+      rewrite cd_rbit. destruct (Nat.eqb_spec (j mod A) (A - 1)), (Nat.eqb_spec (A - 1 - j mod A) 0); lia.
+  - (* NM *) destruct r as [|r]; [|lia]. cbn [nth]. split.
+    + intros p z Hin. lits_in Hin. destruct H as [<-|[<-|[]]].
+      * rewrite cdh_pre, clh_pre by lia. cbn [cd_pre cl_pre]. destruct (Nat.eqb (j mod A) (A - 1)); lia.
+      * rewrite cdh_post, clh_post. cbn [cd_post cl_post]. destruct (Nat.eqb (j mod A) (A - 1)); lia.
+    + exists (SRef (tb A + 13) j 0), 1%Z. split; [ing true; right; left; reflexivity|].
+      rewrite cdh_post. cbn [cd_post]. destruct (Nat.eqb (j mod A) (A - 1)); reflexivity.
+Qed.
+
+(* ---- every signal but a next value has a reader in its last reading layer ---------------------------------- *)
+Ltac vpre := split; [rewrite length_hblocks by lia; unfold tb; lia|]; rewrite nth_hb_pre by lia;
+  cbn [nth hpre bcount bsize blk_P blk_HP blk_FA blk_Q blk_F blk_PA blk_PB blk_AC blk_W blk_RX blk_RY blk_KP blk_X
+       blk_Y blk_PR]; split; try nia.
+Ltac vpost := split; [rewrite length_hblocks by lia; unfold tb; lia|]; rewrite nth_hb_post by lia;
+  cbn [nth hpost bcount bsize blk_C blk_AX blk_NX blk_XN blk_EQ blk_R0 blk_H blk_R blk_LEQ blk_TA blk_TB blk_NP
+       blk_HAB blk_WR blk_NM]; split; try nia.
+Ltac upre := unfold sunit; rewrite nth_hb_pre by lia;
+  cbn [nth hpre bshape blk_P blk_HP blk_FA blk_Q blk_F blk_PA blk_PB blk_AC blk_W blk_RX blk_RY blk_KP blk_X blk_Y blk_PR].
+Ltac upost := unfold sunit; rewrite nth_hb_post by lia;
+  cbn [nth hpost bshape blk_C blk_AX blk_NX blk_XN blk_EQ blk_R0 blk_H blk_R blk_LEQ blk_TA blk_TB blk_NP blk_HAB
+       blk_WR blk_NM].
+
+Theorem host_reader : forall x, valid (hblocks A) (nH A) x -> (forall i, i < nH A -> hout A i <> x) ->
+  exists b j r z, valid (hblocks A) (nH A) (SRef b j r) /\ In (x, z) (sin (sunit (hblocks A) b j r))
+                  /\ cdh (SRef b j r) = clh x.
+Proof.
+  intros x Hx Hno. pose proof SW_ge8 as HS. destruct x as [i|b j r].
+  - (* the state bits *) cbn [valid] in Hx. unfold nH in Hx.
+    destruct (Nat.lt_trichotomy i A) as [Hi|[Hi|Hi]].
+    + exists 0, 0, 0, (if bitof A 0 i then 1%Z else (-1)%Z). split; [vpre|]. split.
+      * upre. ing (bitof A 0 i). unfold lits. apply (in_map (fun t => (pcb t, bitof A 0 t))). apply in_seq. lia.
+      * cbn [clh]. destruct (Nat.ltb_spec i A); [|lia]. rewrite cdh_pre by lia. reflexivity.
+    + subst i. exists (tb A + 12), 0, 2, 1%Z. split; [vpost|]. split.
+      * upost. ing true. left. reflexivity.
+      * rewrite cdh_post. cbn [clh]. rewrite Nat.ltb_irrefl, Nat.eqb_refl. reflexivity.
+    + exists 13, (i - A - 1), 0, 1%Z. split; [vpre|]. split.
+      * upre. ing true. left. unfold mu. f_equal. f_equal.
+        pose proof (Nat.div_mod (i - A - 1) A ltac:(lia)). nia.
+      * rewrite cdh_pre by lia. cbn [clh]. destruct (Nat.ltb_spec i A); [lia|]. destruct (Nat.eqb_spec i A); [lia|].
+        reflexivity.
+  - destruct Hx as (Hb & Hj & Hr). rewrite length_hblocks in Hb by lia.
+    destruct (Nat.lt_ge_cases b 17) as [Hp|Hp].
+    { rewrite nth_hb_pre in Hj, Hr by exact Hp. rewrite clh_pre by exact Hp.
+      assert (Hc : b = 0 \/ b = 1 \/ b = 2 \/ b = 3 \/ b = 4 \/ b = 5 \/ b = 6 \/ b = 7 \/ b = 8 \/ b = 9
+                   \/ b = 10 \/ b = 11 \/ b = 12 \/ b = 13 \/ b = 14 \/ b = 15 \/ b = 16) by lia.
+      destruct Hc as [->|[->|[->|[->|[->|[->|[->|[->|[->|[->|[->|[->|[->|[->|[->|[->| ->]]]]]]]]]]]]]]]];
+        cbn [nth hpre bcount bsize bshape blk_P blk_HP blk_FA blk_Q blk_F blk_PA blk_PB blk_AC blk_W
+             blk_RX blk_RY blk_KP blk_X blk_Y blk_PR cl_pre] in Hj, Hr |- *;
+        (destruct r as [|r]; [|lia]).
+      - (* P *) destruct (Nat.eqb_spec j (SW A - 4)) as [->|E].
+        + exists (tb A + 12), 0, 1, 1%Z. split; [vpost|]. split; [upost; ing true; right; right; left; reflexivity|].
+          rewrite cdh_post. reflexivity.
+        + exists 2, j, 0, 1%Z. split; [vpre|]. split; [|rewrite cdh_pre by lia; reflexivity].
+          upre. rewrite Nat.add_0_r, Nat.Div0.mod_mod, Nat.mod_small by lia. ing true. right. left. reflexivity.
+      - (* HP *) exists (tb A + 11), j, 0, 1%Z. split; [vpost|]. split; [upost; ing true; left; reflexivity|].
+        rewrite cdh_post. reflexivity.
+      - (* FA 0 *) assert (Hd : j / SW A < A) by (apply Nat.Div0.div_lt_upper_bound; nia).
+        exists 6, (0 * A + j / SW A), 0, 1%Z. split; [vpre|].
+        split; [|rewrite cdh_pre by lia; reflexivity].
+        upre. ing true. replace ((0 * A + j / SW A) / A) with 0 by (symmetry; apply Nat.div_small; lia).
+        replace ((0 * A + j / SW A) mod A) with (j / SW A) by (symmetry; apply Nat.mod_small; lia).
+        apply in_map_iff. exists (j mod SW A). split.
+        + f_equal. f_equal. pose proof (Nat.div_mod j (SW A) ltac:(lia)). lia.
+        + apply in_seq. pose proof (Nat.mod_upper_bound j (SW A) ltac:(lia)). lia.
+      - (* FA 1 *) assert (Hd : j / SW A < A) by (apply Nat.Div0.div_lt_upper_bound; nia).
+        exists 6, (1 * A + j / SW A), 0, 1%Z. split; [vpre|].
+        split; [|rewrite cdh_pre by lia; reflexivity].
+        upre. ing true.
+        replace ((1 * A + j / SW A) / A) with 1 by (apply (Nat.div_unique _ _ _ (j / SW A)); lia).
+        replace ((1 * A + j / SW A) mod A) with (j / SW A) by (apply (Nat.mod_unique _ _ 1); lia).
+        apply in_map_iff. exists (j mod SW A). split.
+        + f_equal. f_equal. pose proof (Nat.div_mod j (SW A) ltac:(lia)). lia.
+        + apply in_seq. pose proof (Nat.mod_upper_bound j (SW A) ltac:(lia)). lia.
+      - (* FA 2 *) assert (Hd : j / SW A < A) by (apply Nat.Div0.div_lt_upper_bound; nia).
+        exists 6, (2 * A + j / SW A), 0, 1%Z. split; [vpre|].
+        split; [|rewrite cdh_pre by lia; reflexivity].
+        upre. ing true.
+        replace ((2 * A + j / SW A) / A) with 2 by (apply (Nat.div_unique _ _ _ (j / SW A)); lia).
+        replace ((2 * A + j / SW A) mod A) with (j / SW A) by (apply (Nat.mod_unique _ _ 2); lia).
+        apply in_map_iff. exists (j mod SW A). split.
+        + f_equal. f_equal. pose proof (Nat.div_mod j (SW A) ltac:(lia)). lia.
+        + apply in_seq. pose proof (Nat.mod_upper_bound j (SW A) ltac:(lia)). lia.
+      - (* Q *) exists (tb A + 10), j, 0, 1%Z. split; [vpost|]. split; [upost; ing true; right; right; left; reflexivity|].
+        rewrite cdh_post. reflexivity.
+      - (* F *) destruct (Nat.ltb_spec j (2 * A)) as [Hl|Hg].
+        + destruct (Nat.lt_ge_cases j A) as [H0|H1].
+          * exists 7, 0, 0, (if bitof A 0 j then 1%Z else (-1)%Z). split; [vpre|].
+            split; [|rewrite cdh_pre by lia; reflexivity].
+            upre. ing (bitof A 0 j). unfold lits, opb. apply in_map_iff. exists j.
+            split; [f_equal; f_equal; lia | apply in_seq; lia].
+          * exists 8, 0, 0, (if bitof A 0 (j - A) then 1%Z else (-1)%Z). split; [vpre|].
+            split; [|rewrite cdh_pre by lia; reflexivity].
+            upre. ing (bitof A 0 (j - A)). unfold lits, opb. apply in_map_iff. exists (j - A).
+            split; [f_equal; f_equal; lia | apply in_seq; lia].
+        + exists (tb A + 9), (j - 2 * A), 0, 1%Z. split; [vpost; pose proof (div_lt j 3 A); lia|].
+          split; [|rewrite cdh_post; reflexivity].
+          upost. ing true. right. right. left. unfold opb. f_equal. f_equal. lia.
+      - (* PA *) exists 11, j, 0, 1%Z. split; [vpre|]. split; [|rewrite cdh_pre by lia; reflexivity].
+        upre. rewrite Nat.mod_small by lia. ing true. right. left. reflexivity.
+      - (* PB *) exists 10, j, 0, 1%Z. split; [vpre|]. split; [|rewrite cdh_pre by lia; reflexivity].
+        upre. ing true. right. left. reflexivity.
+      - (* AC *) assert (Hj0 : j = 0) by lia. subst j.
+        exists (tb A + 12), 0, 0, 1%Z. split; [vpost|]. split; [upost; ing true; right; right; left; reflexivity|].
+        rewrite cdh_post. reflexivity.
+      - (* W *) exists (tb A + 13), (j * A), 0, 1%Z. split; [vpost|]. split.
+        + upost. ing true. right. left. rewrite Nat.div_mul by lia. reflexivity.
+        + rewrite cdh_post. cbn [cd_post]. rewrite Nat.Div0.mod_mul. destruct (Nat.eqb_spec 0 (A - 1)); [lia | reflexivity].
+      - (* RX *) assert (Hd : j / SW A < A) by (apply Nat.Div0.div_lt_upper_bound; nia).
+        exists 14, (j / SW A), 0, 1%Z. split; [vpre|].
+        split; [|rewrite cdh_pre by lia; reflexivity].
+        upre. ing true. apply in_map_iff. exists (j mod SW A). split.
+        + f_equal. f_equal. pose proof (Nat.div_mod j (SW A) ltac:(lia)). lia.
+        + apply in_seq. pose proof (Nat.mod_upper_bound j (SW A) ltac:(lia)). lia.
+      - (* RY *) assert (Hd : j / SW A < A) by (apply Nat.Div0.div_lt_upper_bound; nia).
+        exists 15, (j / SW A), 0, 1%Z. split; [vpre|].
+        split; [|rewrite cdh_pre by lia; reflexivity].
+        upre. ing true. apply in_map_iff. exists (j mod SW A). split.
+        + f_equal. f_equal. pose proof (Nat.div_mod j (SW A) ltac:(lia)). lia.
+        + apply in_seq. pose proof (Nat.mod_upper_bound j (SW A) ltac:(lia)). lia.
+      - (* KP *) exists (tb A + 14), j, 0, 1%Z. split; [vpost|]. split; [upost; ing true; left; reflexivity|].
+        rewrite cdh_post. reflexivity.
+      - (* X *) destruct (Nat.eqb_spec j (A - 1)) as [->|E].
+        + exists (16 + 2), 0, 1, (-1)%Z. split.
+          * split; [rewrite length_hblocks by lia; unfold tb; lia|]. rewrite nth_hb_T by lia. cbn [bcount bsize blk_T]. lia.
+          * split; [|rewrite cdh_T by lia; reflexivity].
+            unfold sunit. rewrite nth_hb_T by lia. cbn [bshape blk_T nth seq map Nat.sub]. ing false. right. left.
+            unfold xv. f_equal. f_equal. lia.
+        + exists (tb A + 6), (A - 2 - j), 0, (-1)%Z. split; [vpost|]. split; [|rewrite cdh_post; reflexivity].
+          upost. right. left. unfold xv. f_equal. f_equal. lia.
+      - (* Y *) destruct (Nat.eqb_spec j (A - 1)) as [->|E].
+        + exists (16 + 2), 0, 1, 1%Z. split.
+          * split; [rewrite length_hblocks by lia; unfold tb; lia|]. rewrite nth_hb_T by lia. cbn [bcount bsize blk_T]. lia.
+          * split; [|rewrite cdh_T by lia; reflexivity].
+            unfold sunit. rewrite nth_hb_T by lia. cbn [bshape blk_T nth seq map Nat.sub]. ing true. left.
+            unfold yv. f_equal. f_equal. lia.
+        + exists (tb A + 6), (A - 2 - j), 0, 1%Z. split; [vpost|]. split; [|rewrite cdh_post; reflexivity].
+          upost. left. unfold yv. f_equal. f_equal. lia.
+      - (* PR *) exists (16 + (A - 1)), 0, 0, 1%Z. split.
+        + split; [rewrite length_hblocks by lia; unfold tb; lia|]. rewrite nth_hb_T by lia. cbn [bcount bsize blk_T]. lia.
+        + split; [|rewrite cdh_T by lia; reflexivity].
+          unfold sunit. rewrite nth_hb_T by lia. cbn [bshape blk_T nth]. ing true.
+          apply (in_map (fun i' => (prr i', true))). apply in_seq. lia. }
+    destruct (Nat.lt_ge_cases b (tb A)) as [HT|HT].
+    { (* the carry terms *)
+      unfold tb in HT. replace b with (16 + (b - 16)) in Hj, Hr |- * by lia.
+      rewrite nth_hb_T in Hj, Hr by lia. cbn [bcount bsize blk_T] in Hj, Hr. assert (Hj0 : j = 0) by lia. subst j.
+      rewrite clh_T by lia.
+      exists (tb A + 0), (b - 16 - 1), 0, 1%Z. split; [vpost|]. split; [|rewrite cdh_post; reflexivity].
+      upost. ing true.
+      replace (16 + S (b - 16 - 1)) with (16 + (b - 16)) by lia.
+      destruct r as [|r]; [left; reflexivity|]. right.
+      apply (in_map (fun j' => (SRef (16 + (b - 16)) 0 (S j'), true))). apply in_seq. lia. }
+    replace b with (tb A + (b - tb A)) in Hj, Hr, Hno |- * by lia.
+    rewrite nth_hb_post in Hj, Hr by lia. rewrite clh_post.
+    assert (Hi : b - tb A < 15) by (unfold tb in *; lia).
+    remember (b - tb A) as i eqn:Ei. clear Ei Hb Hp HT.
+    assert (Hc : i = 0 \/ i = 1 \/ i = 2 \/ i = 3 \/ i = 4 \/ i = 5 \/ i = 6 \/ i = 7 \/ i = 8 \/ i = 9
+                 \/ i = 10 \/ i = 11 \/ i = 12 \/ i = 13 \/ i = 14) by lia.
+    destruct Hc as [->|[->|[->|[->|[->|[->|[->|[->|[->|[->|[->|[->|[->|[->| ->]]]]]]]]]]]]]];
+      cbn [nth hpost bcount bsize blk_C blk_AX blk_NX blk_XN blk_EQ blk_R0 blk_H blk_R blk_LEQ
+           blk_TA blk_TB blk_NP blk_HAB blk_WR blk_NM cl_post] in Hj, Hr |- *;
+      try (assert (Hr0 : r = 0) by lia; subst r); try (assert (Hj0 : j = 0) by lia; subst j).
+    + (* C *) exists (tb A + 6), j, 0, 1%Z. split; [vpost|]. split; [|rewrite cdh_post; reflexivity].
+      upost. right. right. left. rewrite Nat.add_0_r. reflexivity.
+    + (* AX *) exists (tb A + 3), j, 0, 1%Z. split; [vpost|]. split; [upost; ing true; left; reflexivity|].
+      rewrite cdh_post. reflexivity.
+    + (* NX *) exists (tb A + 3), j, 0, 1%Z. split; [vpost|]. split; [upost; ing true; right; left; reflexivity|].
+      rewrite cdh_post. reflexivity.
+    + (* XN *) exists (tb A + 4), 0, 0, 1%Z. split; [vpost|]. split; [|rewrite cdh_post; reflexivity].
+      upost. ing true. apply (in_map (fun i' => (SRef (tb A + 3) i' 0, true))). apply in_seq. lia.
+    + (* EQ *) exists (tb A + 8), 0, 0, 1%Z. split; [vpost|]. split; [upost; right; right; right; left; reflexivity|].
+      rewrite cdh_post. reflexivity.
+    + (* R0 *) destruct (Nat.ltb_spec r 2) as [Hr2|Hr2].
+      * exists (tb A + 5), 0, 2, 1%Z. split; [vpost|]. split; [|rewrite cdh_post; reflexivity].
+        upost. ing true. destruct r as [|[|r]]; [left; reflexivity | right; left; reflexivity | lia].
+      * exists (tb A + 13), (A - 1), 0, 1%Z. split; [vpost|]. split.
+        -- upost. ing true. left. rewrite Nat.mod_small by lia. replace (A - 1 - (A - 1)) with 0 by lia.
+           unfold rbit. cbn [Nat.eqb]. f_equal. f_equal. lia.
+        -- rewrite cdh_post. cbn [cd_post]. rewrite Nat.mod_small by lia. rewrite Nat.eqb_refl. reflexivity.
+    + (* H *) assert (Hr3 : r = 0 \/ r = 1 \/ r = 2) by lia. destruct Hr3 as [->|[->| ->]].
+      * exists (tb A + 7), j, 0, 1%Z. split; [vpost|].
+        split; [upost; left; reflexivity | rewrite cdh_post; reflexivity].
+      * exists (tb A + 7), j, 0, (-1)%Z. split; [vpost|].
+        split; [upost; right; left; reflexivity | rewrite cdh_post; reflexivity].
+      * exists (tb A + 7), j, 0, 1%Z. split; [vpost|].
+        split; [upost; right; right; left; reflexivity | rewrite cdh_post; reflexivity].
+    + (* R *) exists (tb A + 13), (A - 2 - j), 0, 1%Z. split; [vpost|]. split.
+      * upost. ing true. left. rewrite Nat.mod_small by lia. replace (A - 1 - (A - 2 - j)) with (S j) by lia.
+        unfold rbit. cbn [Nat.eqb]. f_equal. f_equal. lia.
+      * rewrite cdh_post. cbn [cd_post]. rewrite Nat.mod_small by lia. destruct (Nat.eqb_spec (A - 2 - j) (A - 1)); [lia|].
+        reflexivity.
+    + (* LEQ *) exists (tb A + 9), 0, 0, 1%Z. split; [vpost|]. split; [upost; ing true; right; left; reflexivity|].
+      rewrite cdh_post. reflexivity.
+    + (* TA *) exists (tb A + 11), j, 0, 1%Z. split; [vpost|]. split; [upost; ing true; right; left; reflexivity|].
+      rewrite cdh_post. reflexivity.
+    + (* TB *) exists (tb A + 11), j, 0, 1%Z. split; [vpost|]. split; [upost; ing true; right; right; left; reflexivity|].
+      rewrite cdh_post. reflexivity.
+    + (* NP: a next value *) exfalso. apply (Hno j); [unfold nH; lia|]. unfold hout.
+      destruct (Nat.ltb_spec j A); [|lia]. f_equal; lia.
+    + (* HAB *) destruct (Nat.ltb_spec r 2) as [Hr2|Hr2].
+      * exists (tb A + 12), 0, 2, 1%Z. split; [vpost|]. split; [|rewrite cdh_post; reflexivity].
+        upost. ing true. destruct r as [|[|r]]; [right; left; reflexivity | right; right; left; reflexivity | lia].
+      * exfalso. apply (Hno A); [unfold nH; lia|]. unfold hout. rewrite Nat.ltb_irrefl, Nat.eqb_refl.
+        f_equal; lia.
+    + (* WR *) exists (tb A + 14), j, 0, 1%Z. split; [vpost|]. split; [upost; ing true; right; left; reflexivity|].
+      rewrite cdh_post. reflexivity.
+    + (* NM: a next value *) exfalso. apply (Hno (A + 1 + j)); [unfold nH; nia|]. unfold hout.
+      destruct (Nat.ltb_spec (A + 1 + j) A); [lia|]. destruct (Nat.eqb_spec (A + 1 + j) A); [lia|].
+      f_equal; lia.
+Qed.
+
+(* ---- depth, contribution and last readers of the levelized host --------------------------------------------- *)
+Lemma host_wf' : wf (hblocks A) (nH A).
+Proof. apply host_wf. exact HA. Qed.
+
+Lemma hout_valid : forall i, i < nH A -> valid (hblocks A) (nH A) (hout A i).
+Proof.
+  intros i Hi. pose proof SW_ge8. unfold hout. destruct (Nat.ltb_spec i A); [|destruct (Nat.eqb_spec i A)].
+  - vpost.
+  - vpost.
+  - unfold nH in Hi. vpost.
+Qed.
+
+Lemma sref_eq_dec : forall x y : sref, {x = y} + {x <> y}.
+Proof. decide equality; apply Nat.eq_dec. Qed.
+
+Lemma out_dec : forall x, {exists i, i < nH A /\ hout A i = x} + {forall i, i < nH A -> hout A i <> x}.
+Proof.
+  intro x. destruct (in_dec sref_eq_dec x (map (hout A) (seq 0 (nH A)))) as [H|H].
+  - left. apply in_map_iff in H as (i & E & Hi). apply in_seq in Hi. exists i. split; [lia | exact E].
+  - right. intros i Hi E. apply H. apply in_map_iff. exists i. split; [exact E | apply in_seq; lia].
+Qed.
+
+Lemma host_cd_rec : forall b j r, valid (hblocks A) (nH A) (SRef b j r) ->
+  cdh (SRef b j r) = S (maxl (map (fun p => cdh (fst p)) (sin (sunit (hblocks A) b j r)))).
+Proof.
+  intros b j r Hv. destruct (host_unit_ok b j r Hv) as [Hall Hex].
+  apply cd_rec; [intros p z Hin; exact (proj1 (Hall p z Hin)) | exact Hex].
+Qed.
+
+Lemma cdh0 : forall i, cdh (SIn i) = 0.
+Proof. reflexivity. Qed.
+
+Theorem host_dep : forall x, valid (hblocks A) (nH A) x -> dep (nH A) (host_units A) (idx (nH A) (hblocks A) x) = cdh x.
+Proof. exact (dep_cd (hblocks A) (nH A) host_wf' cdh cdh0 host_cd_rec). Qed.
+
+Lemma cd_pre_le : forall b, cd_pre b <= 7.
+Proof. intro b. unfold cd_pre. repeat (destruct b as [|b]; [lia|]). lia. Qed.
+
+Lemma cd_post_le : forall i j r, cd_post i j r <= 13.
+Proof.
+  intros i j r. unfold cd_post.
+  repeat (destruct i as [|i]; [repeat (destruct (_ <? _)); repeat (destruct (Nat.eqb _ _)); lia|]).
+  destruct (Nat.eqb _ _); lia.
+Qed.
+
+Lemma cdh_le13 : forall x, cdh x <= 13.
+Proof.
+  intros [i|b j r]; cbn [cdh]; [lia|]. pose proof (cd_pre_le b). pose proof (cd_post_le (b - tb A) j r).
+  destruct (b <? 17); [lia|]. destruct (b <? tb A); [unfold cd_T; destruct (Nat.eqb r 0), (Nat.eqb r (b - 16)); lia | lia].
+Qed.
+
+(* the step of H_A has depth 13 *)
+Theorem host_dmax : dmax (nH A) (host_units A) = 13.
+Proof.
+  apply (dmax_cd (hblocks A) (nH A) host_wf' cdh cdh0 host_cd_rec 13).
+  - intros b j r _. apply cdh_le13.
+  - exists (tb A + 11), 0, 0. split; [pose proof SW_ge8; vpost | rewrite cdh_post; reflexivity].
+Qed.
+
+(* every unit of H_A contributes to a next value *)
+Theorem host_need : forall b j r, valid (hblocks A) (nH A) (SRef b j r) ->
+  need (nH A) (host_units A) (host_next A) (idx (nH A) (hblocks A) (SRef b j r)) = true.
+Proof.
+  apply (need_all (hblocks A) (nH A) (hout A) host_wf'). intros b j r Hv.
+  destruct (out_dec (SRef b j r)) as [(i & Hi & E)|Hno]; [left; exists i; split; assumption|].
+  right. destruct (host_reader (SRef b j r) Hv Hno) as (b' & j' & r' & z & Hv' & Hin & _).
+  exists b', j', r', z. split; assumption.
+Qed.
+
+Lemma clh_out : forall i, i < nH A -> clh (hout A i) = 14.
+Proof.
+  intros i Hi. unfold hout. destruct (Nat.ltb_spec i A); [|destruct (Nat.eqb_spec i A)]; rewrite clh_post; reflexivity.
+Qed.
+
+(* the last layer that reads each signal *)
+Theorem host_lam : forall x, valid (hblocks A) (nH A) x ->
+  lam (nH A) (host_units A) (host_next A) (idx (nH A) (hblocks A) x) = clh x.
+Proof.
+  apply (lam_cl (hblocks A) (nH A) (hout A) host_wf' hout_valid cdh host_dep host_need 13 host_dmax clh).
+  - intros b j r p z Hv Hin. exact (proj2 (proj1 (host_unit_ok b j r Hv) p z Hin)).
+  - exact clh_out.
+  - intros x Hx Hno. right. exact (host_reader x Hx Hno).
+Qed.
+
+(* ---- the widths of the layers ------------------------------------------------------------------------- *)
+(* a unit of depth c read last at layer c' has a row in layer l if l = c or c < l < c'; a state bit if 0 < l < c' *)
+Definition occ (c c' l : nat) : nat := Nat.b2n (Nat.eqb c l || Nat.ltb c l && Nat.ltb l c').
+Definition occs (c' l : nat) : nat := Nat.b2n (Nat.ltb 0 l && Nat.ltb l c').
+Definition tri : nat := nsum (A - 1) (fun i => S i).
+
+Definition wform (l : nat) : nat :=
+  A * occs 1 l + occs 13 l + SW A * A * occs 6 l
+  + ((SW A - 1) * occ 1 2 l + occ 1 12 l) + A * occ 1 13 l + 3 * (A * SW A * occ 2 3 l) + A * occ 2 12 l
+  + (2 * A * occ 3 4 l + A * occ 3 12 l) + 2 * (SW A * occ 4 5 l) + occ 4 12 l + SW A * occ 5 12 l
+  + 2 * (A * SW A * occ 5 6 l) + (SW A * occ 6 10 l + SW A * (A - 1) * occ 6 13 l)
+  + 2 * (occ 6 8 l + (A - 1) * occ 6 10 l) + (A - 1) * occ 7 8 l
+  + (tri * occ 8 9 l + (A - 1) * occ 7 9 l)
+  + ((A - 1) * occ 9 10 l + 2 * (A * occ 7 8 l) + A * occ 8 9 l + occ 9 11 l + (2 * occ 7 8 l + occ 8 9 l)
+     + (A - 1) * (3 * occ 10 11 l) + (A - 1) * occ 11 12 l + occ 11 12 l + 2 * (A * occ 12 13 l)
+     + A * occ 13 14 l + (2 * occ 12 13 l + occ 13 14 l) + (SW A * occ 9 10 l + SW A * (A - 1) * occ 12 13 l)
+     + (SW A * occ 10 14 l + SW A * (A - 1) * occ 13 14 l)).
+
+Lemma nsum_mod_split : forall c u v, nsum (c * A) (fun j => if Nat.eqb (j mod A) (A - 1) then u else v) = c * u + c * (A - 1) * v.
+Proof.
+  intros c u v. rewrite nsum_mul.
+  rewrite (nsum_ext c _ (fun _ => (A - 1) * v + u)); [rewrite nsum_const; lia|].
+  intros q Hq. rewrite (nsum_ext A _ (fun r => if Nat.eqb r (A - 1) then u else v)).
+  - apply nsum_eq_split. lia.
+  - intros r Hr. replace ((A * q + r) mod A) with r; [reflexivity|].
+    apply (Nat.mod_unique _ _ q); lia.
+Qed.
+
+Lemma host_up : forall b j r p z, valid (hblocks A) (nH A) (SRef b j r) -> In (p, z) (sin (sunit (hblocks A) b j r)) ->
+  cdh (SRef b j r) <= clh p.
+Proof. intros b j r p z Hv Hin. exact (proj2 (proj1 (host_unit_ok b j r Hv) p z Hin)). Qed.
+
+Lemma host_low : forall x, valid (hblocks A) (nH A) x -> (forall i, i < nH A -> hout A i <> x) ->
+  clh x = 0 \/ exists b j r z, valid (hblocks A) (nH A) (SRef b j r) /\ In (x, z) (sin (sunit (hblocks A) b j r))
+                               /\ cdh (SRef b j r) = clh x.
+Proof. intros x Hx Hno. right. exact (host_reader x Hx Hno). Qed.
+
+(* the sum over the units, block by block: the 17 blocks before the carry terms, the A - 1 carry blocks, the 15 after *)
+Lemma bsum_host : forall g, bsum (hblocks A) g =
+  nsum 17 (fun b => nsum (bcount (nth b (hpre A) blk0)) (fun j => nsum (bsize (nth b (hpre A) blk0)) (fun r => g (SRef b j r))))
+  + nsum (A - 1) (fun i => nsum (S (S i)) (fun r => g (SRef (17 + i) 0 r)))
+  + nsum 15 (fun i => nsum (bcount (nth i (hpost A) blk0)) (fun j => nsum (bsize (nth i (hpost A) blk0))
+                                                                       (fun r => g (SRef (tb A + i) j r)))).
+Proof.
+  intro g. unfold bsum, cnt, sz. rewrite length_hblocks by lia. replace (tb A + 15) with (17 + (A - 1) + 15) by (unfold tb; lia).
+  rewrite !nsum_split. f_equal; [f_equal|].
+  all: apply nsum_ext; intros i Hi;
+    first [ rewrite nth_hb_pre by lia; reflexivity
+          | replace (17 + i) with (16 + S i) by lia; rewrite nth_hb_T by lia; cbn [bcount bsize blk_T nsum]; reflexivity
+          | replace (17 + (A - 1) + i) with (tb A + i) by (unfold tb; lia); rewrite nth_hb_post by lia; reflexivity ].
+Qed.
+
+(* the rows of layer l that the units of each block contribute *)
+Definition psum (l b : nat) : nat :=
+  nsum (bcount (nth b (hpre A) blk0)) (fun j => nsum (bsize (nth b (hpre A) blk0)) (fun r => occ (cd_pre b) (cl_pre b j) l)).
+Definition qsum (l i : nat) : nat :=
+  nsum (bcount (nth i (hpost A) blk0)) (fun j => nsum (bsize (nth i (hpost A) blk0))
+                                                       (fun r => occ (cd_post i j r) (cl_post i j r) l)).
+
+Ltac pq := intro l; unfold psum, qsum;
+  cbn [nth hpre hpost bcount bsize blk_P blk_HP blk_FA blk_Q blk_F blk_PA blk_PB blk_AC blk_W blk_RX blk_RY blk_KP blk_X
+       blk_Y blk_PR blk_C blk_AX blk_NX blk_XN blk_EQ blk_R0 blk_H blk_R blk_LEQ blk_TA blk_TB blk_NP blk_HAB blk_WR
+       blk_NM cd_pre cl_pre cd_post cl_post].
+Ltac pconst := rewrite !nsum_const; lia.
+
+Lemma psum0 : forall l, psum l 0 = (SW A - 1) * occ 1 2 l + occ 1 12 l.
+Proof.
+  pq. rewrite (nsum_ext (SW A) _ (fun j => if Nat.eqb j (SW A - 4) then occ 1 12 l else occ 1 2 l)).
+  - apply nsum_eq_split. pose proof SW_ge8. lia.
+  - intros j _. cbn [nsum]. destruct (Nat.eqb j (SW A - 4)); reflexivity.
+Qed.
+Lemma psum1 : forall l, psum l 1 = A * occ 1 13 l. Proof. pq. pconst. Qed.
+Lemma psum2 : forall l, psum l 2 = A * SW A * occ 2 3 l. Proof. pq. pconst. Qed.
+Lemma psum3 : forall l, psum l 3 = A * SW A * occ 2 3 l. Proof. pq. pconst. Qed.
+Lemma psum4 : forall l, psum l 4 = A * SW A * occ 2 3 l. Proof. pq. pconst. Qed.
+Lemma psum5 : forall l, psum l 5 = A * occ 2 12 l. Proof. pq. pconst. Qed.
+Lemma psum6 : forall l, psum l 6 = 2 * A * occ 3 4 l + A * occ 3 12 l.
+Proof.
+  pq. rewrite (nsum_ext (3 * A) _ (fun j => if j <? 2 * A then occ 3 4 l else occ 3 12 l)).
+  - rewrite nsum_lt_split by lia. lia.
+  - intros j _. cbn [nsum]. destruct (j <? 2 * A); reflexivity.
+Qed.
+Lemma psum7 : forall l, psum l 7 = SW A * occ 4 5 l. Proof. pq. pconst. Qed.
+Lemma psum8 : forall l, psum l 8 = SW A * occ 4 5 l. Proof. pq. pconst. Qed.
+Lemma psum9 : forall l, psum l 9 = occ 4 12 l. Proof. pq. pconst. Qed.
+Lemma psum10 : forall l, psum l 10 = SW A * occ 5 12 l. Proof. pq. pconst. Qed.
+Lemma psum11 : forall l, psum l 11 = A * SW A * occ 5 6 l. Proof. pq. pconst. Qed.
+Lemma psum12 : forall l, psum l 12 = A * SW A * occ 5 6 l. Proof. pq. pconst. Qed.
+Lemma psum13 : forall l, psum l 13 = SW A * occ 6 10 l + SW A * (A - 1) * occ 6 13 l.
+Proof.
+  pq. rewrite (nsum_ext (SW A * A) _ (fun j => if Nat.eqb (j mod A) (A - 1) then occ 6 10 l else occ 6 13 l)).
+  - apply nsum_mod_split.
+  - intros j _. cbn [nsum]. destruct (Nat.eqb (j mod A) (A - 1)); reflexivity.
+Qed.
+Lemma psum14 : forall l, psum l 14 = occ 6 8 l + (A - 1) * occ 6 10 l.
+Proof.
+  pq. rewrite (nsum_ext A _ (fun j => if Nat.eqb j (A - 1) then occ 6 8 l else occ 6 10 l)).
+  - rewrite nsum_eq_split by lia. lia.
+  - intros j _. cbn [nsum]. destruct (Nat.eqb j (A - 1)); reflexivity.
+Qed.
+Lemma psum15 : forall l, psum l 15 = occ 6 8 l + (A - 1) * occ 6 10 l.
+Proof.
+  pq. rewrite (nsum_ext A _ (fun j => if Nat.eqb j (A - 1) then occ 6 8 l else occ 6 10 l)).
+  - rewrite nsum_eq_split by lia. lia.
+  - intros j _. cbn [nsum]. destruct (Nat.eqb j (A - 1)); reflexivity.
+Qed.
+Lemma psum16 : forall l, psum l 16 = (A - 1) * occ 7 8 l. Proof. pq. pconst. Qed.
+
+Lemma qsum0 : forall l, qsum l 0 = (A - 1) * occ 9 10 l. Proof. pq. pconst. Qed.
+Lemma qsum1 : forall l, qsum l 1 = A * occ 7 8 l. Proof. pq. pconst. Qed.
+Lemma qsum2 : forall l, qsum l 2 = A * occ 7 8 l. Proof. pq. pconst. Qed.
+Lemma qsum3 : forall l, qsum l 3 = A * occ 8 9 l. Proof. pq. pconst. Qed.
+Lemma qsum4 : forall l, qsum l 4 = occ 9 11 l. Proof. pq. pconst. Qed.
+Lemma qsum5 : forall l, qsum l 5 = 2 * occ 7 8 l + occ 8 9 l. Proof. pq. cbn [nsum Nat.ltb Nat.leb]. lia. Qed.
+Lemma qsum6 : forall l, qsum l 6 = (A - 1) * (3 * occ 10 11 l). Proof. pq. pconst. Qed.
+Lemma qsum7 : forall l, qsum l 7 = (A - 1) * occ 11 12 l. Proof. pq. pconst. Qed.
+Lemma qsum8 : forall l, qsum l 8 = occ 11 12 l. Proof. pq. pconst. Qed.
+Lemma qsum9 : forall l, qsum l 9 = A * occ 12 13 l. Proof. pq. pconst. Qed.
+Lemma qsum10 : forall l, qsum l 10 = A * occ 12 13 l. Proof. pq. pconst. Qed.
+Lemma qsum11 : forall l, qsum l 11 = A * occ 13 14 l. Proof. pq. pconst. Qed.
+Lemma qsum12 : forall l, qsum l 12 = 2 * occ 12 13 l + occ 13 14 l. Proof. pq. cbn [nsum Nat.ltb Nat.leb]. lia. Qed.
+Lemma qsum13 : forall l, qsum l 13 = SW A * occ 9 10 l + SW A * (A - 1) * occ 12 13 l.
+Proof.
+  pq. rewrite (nsum_ext (SW A * A) _ (fun j => if Nat.eqb (j mod A) (A - 1) then occ 9 10 l else occ 12 13 l)).
+  - apply nsum_mod_split.
+  - intros j _. cbn [nsum]. destruct (Nat.eqb (j mod A) (A - 1)); reflexivity.
+Qed.
+Lemma qsum14 : forall l, qsum l 14 = SW A * occ 10 14 l + SW A * (A - 1) * occ 13 14 l.
+Proof.
+  pq. rewrite (nsum_ext (SW A * A) _ (fun j => if Nat.eqb (j mod A) (A - 1) then occ 10 14 l else occ 13 14 l)).
+  - apply nsum_mod_split.
+  - intros j _. cbn [nsum]. destruct (Nat.eqb (j mod A) (A - 1)); reflexivity.
+Qed.
+
+Theorem host_width : forall l, 1 <= l -> width (nH A) (host_units A) (host_next A) l = wform l.
+Proof.
+  intros l Hl. pose proof SW_ge8 as HS.
+  change (host_units A) with (fus (hblocks A) (nH A)). change (host_next A) with (fnx (hblocks A) (nH A) (hout A)).
+  rewrite (width_bsum (hblocks A) (nH A) (hout A) host_wf' hout_valid cdh host_dep host_need 13 host_dmax clh host_up
+             clh_out host_low l Hl).
+  rewrite bsum_host. unfold wform.
+  (* the state bits *)
+  assert (Hst : nsum (nH A) (fun i => Nat.b2n (Nat.ltb (cdh (SIn i)) l && Nat.ltb l (clh (SIn i))))
+                = A * occs 1 l + occs 13 l + SW A * A * occs 6 l).
+  { unfold nH. rewrite !nsum_split.
+    rewrite (nsum_ext A _ (fun _ => occs 1 l)) by (intros i Hi; cbn [cdh clh]; destruct (Nat.ltb_spec i A); [reflexivity | lia]).
+    rewrite (nsum_ext 1 _ (fun _ => occs 13 l))
+      by (intros i Hi; cbn [cdh clh]; destruct (Nat.ltb_spec (A + i) A); [lia|];
+          destruct (Nat.eqb_spec (A + i) A); [reflexivity | lia]).
+    rewrite (nsum_ext (SW A * A) _ (fun _ => occs 6 l))
+      by (intros i Hi; cbn [cdh clh]; destruct (Nat.ltb_spec (A + 1 + i) A); [lia|];
+          destruct (Nat.eqb_spec (A + 1 + i) A); [lia | reflexivity]).
+    rewrite !nsum_const. lia. }
+  rewrite Hst. clear Hst.
+  (* the carry terms *)
+  assert (HT : nsum (A - 1) (fun i => nsum (S (S i)) (fun r =>
+                 Nat.b2n (Nat.eqb (cdh (SRef (17 + i) 0 r)) l || Nat.ltb (cdh (SRef (17 + i) 0 r)) l
+                                                                 && Nat.ltb l (clh (SRef (17 + i) 0 r)))))
+               = tri * occ 8 9 l + (A - 1) * occ 7 9 l).
+  { rewrite (nsum_ext (A - 1) _ (fun i => S i * occ 8 9 l + occ 7 9 l)).
+    - assert (Hm : nsum (A - 1) (fun i => S i * occ 8 9 l) = tri * occ 8 9 l) by (unfold tri; apply nsum_mulc).
+      rewrite nsum_add, Hm, nsum_const. lia.
+    - intros i Hi. replace (17 + i) with (16 + S i) by lia.
+      rewrite (nsum_ext (S (S i)) _ (fun r => occ (cd_T (S i) r) 9 l))
+        by (intros r Hr; rewrite cdh_T, clh_T by lia; reflexivity).
+      rewrite nsum_succ.
+      rewrite (nsum_ext (S i) _ (fun _ => occ 8 9 l))
+        by (intros r Hr; unfold cd_T; destruct (Nat.eqb_spec r 0); [reflexivity|];
+            destruct (Nat.eqb_spec r (S i)); [lia | reflexivity]).
+      rewrite nsum_const. unfold cd_T. rewrite Nat.eqb_refl. cbn [Nat.eqb]. lia. }
+  rewrite HT. clear HT.
+  (* the blocks before and after the carry terms *)
+  rewrite (nsum_ext 17 _ (psum l)).
+  2: { intros b Hb. unfold psum. apply nsum_ext. intros j Hj. apply nsum_ext. intros r Hr.
+       rewrite cdh_pre, clh_pre by exact Hb. reflexivity. }
+  rewrite (nsum_ext 15 _ (qsum l)).
+  2: { intros i Hi. unfold qsum. apply nsum_ext. intros j Hj. apply nsum_ext. intros r Hr.
+       rewrite cdh_post, clh_post. reflexivity. }
+  cbn [nsum].
+  rewrite psum0, psum1, psum2, psum3, psum4, psum5, psum6, psum7, psum8, psum9, psum10, psum11, psum12, psum13,
+    psum14, psum15, psum16.
+  rewrite qsum0, qsum1, qsum2, qsum3, qsum4, qsum5, qsum6, qsum7, qsum8, qsum9, qsum10, qsum11, qsum12, qsum13, qsum14.
+  lia.
+Qed.
+
+Lemma tri_eq : 2 * tri = A * (A - 1).
+Proof.
+  unfold tri. assert (G : forall k, 2 * nsum k (fun i => S i) = k * (k + 1)) by (induction k as [|k IH]; cbn [nsum]; nia).
+  rewrite G. replace (A - 1 + 1) with A by lia. lia.
+Qed.
+
+Lemma host_next_len : length (host_next A) = nH A.
+Proof. unfold host_next. rewrite length_map, length_seq. reflexivity. Qed.
+
+(* the layers of Lev(H_A): twelve of the widths above and one of the n state bits *)
+Theorem host_lev_widths : map (@length tu) (lev (nH A) (host_units A) (host_next A)) = map wform (seq 1 12) ++ [nH A].
+Proof.
+  rewrite lev_widths by exact host_next_len. rewrite host_dmax. cbn [Nat.sub]. f_equal.
+  apply map_ext_in. intros l Hl. apply in_seq in Hl. apply host_width. lia.
+Qed.
+
+(* Lev(H_A) has (19A + 10) 2^A + (A^2 + 109A + 54)/2 rows *)
+Theorem host_lev_rows : 2 * fold_right Nat.add 0 (map (@length tu) (lev (nH A) (host_units A) (host_next A)))
+  = (38 * A + 20) * SW A + A * A + 109 * A + 54.
+Proof.
+  rewrite host_lev_widths. cbn [seq map fold_right app]. unfold wform, occ, occs.
+  cbn [Nat.eqb Nat.ltb Nat.leb Nat.b2n andb orb]. pose proof tri_eq. pose proof SW_ge8. unfold nH.
+  assert (Ea : exists a, A = S a) by (exists (A - 1); lia). destruct Ea as [a Ea]. rewrite Ea in *.
+  cbn [Nat.sub] in *. rewrite Nat.sub_0_r in *. nia.
+Qed.
+
+End HL.
+
+(* ---- the host with eight-bit words, in binary numbers ------------------------------------------------------ *)
+Definition lev_host_widths (A : nat) : list N := map N.of_nat (map (@length tu) (lev (nH A) (host_units A) (host_next A))).
+
+Lemma host_lev_widths_8 : lev_host_widths 8
+  = [2313; 8210; 2090; 2587; 6427; 2347; 2379; 2389; 2609; 2353; 2339; 3867; 2057]%N.
+Proof. unfold lev_host_widths. rewrite host_lev_widths by lia. vm_compute. reflexivity. Qed.
+
+Lemma host_lev_rows_8 : fold_right N.add 0%N (lev_host_widths 8) = 41967%N.
+Proof. rewrite host_lev_widths_8. reflexivity. Qed.
+
+(* the entries of the layers as dense matrices: each layer has as many columns as the layer before has rows *)
+Fixpoint dense (prev : N) (ws : list N) : N := match ws with [] => 0%N | w :: t => (prev * w + dense w t)%N end.
+
+Lemma host_lev_dense_8 : dense (N.of_nat (nH 8)) (lev_host_widths 8) = 124165940%N.
+Proof. rewrite host_lev_widths_8. vm_compute. reflexivity. Qed.
+
+Lemma host_lev_widest_8 : fold_right N.max 0%N (lev_host_widths 8) = 8210%N.
+Proof. rewrite host_lev_widths_8. reflexivity. Qed.

rocq/HostSem.v

@@ -1,5 +1,5 @@
 (* The host netlist computes one step of SUBLEQ on 2^A words of A bits, from every state, for
-   every A >= 3 (Proposition 3.9). *)
+   every A >= 3 (Proposition 3.8). *)
 From Stdlib Require Import List Bool Arith ZArith Lia.
 Import ListNotations.
 From TH Require Import TwoHead Net Gates PhysSem Host HostWF Adder.

rocq/Lev.v

@@ -0,0 +1,692 @@
+(* Levelization (Lemma 2.6): a clocked netlist whose units have maximal depth d >= 1 is computed by a layered map
+   of depth d.  Each unit that contributes to a next value occurs in it with its weights and bias, once if its
+   depth is less than d and once for each state bit whose next value it is if its depth is d, and every other row
+   is an identity unit. *)
+From Stdlib Require Import List Bool Arith ZArith Lia.
+Import ListNotations.
+From TH Require Import TwoHead Net.
+
+(* ---- layered maps (Definition 2.3) ----------------------------------------------------------------------- *)
+(* a layer: rows reading the outputs of the layer before by position *)
+Definition lfire (L : list tu) (y : list bool) : list bool := map (fun u => fire u (fun i => nth i y false)) L.
+Definition lmap (Ls : list (list tu)) (x : list bool) : list bool := fold_left (fun y L => lfire L y) Ls x.
+
+(* the rows of each layer read positions of the layer before, distinct ones, with weights -1 or 1 *)
+Definition rowok (w : nat) (u : tu) : Prop :=
+  NoDup (map fst (tin u)) /\ forall i z, In (i, z) (tin u) -> i < w /\ (z = 1 \/ z = -1)%Z.
+Fixpoint lwf (w : nat) (Ls : list (list tu)) : Prop :=
+  match Ls with [] => True | L :: t => Forall (rowok w) L /\ lwf (length L) t end.
+
+Lemma lmap_app : forall Ls L x, lmap (Ls ++ [L]) x = lfire L (lmap Ls x).
+Proof. intros Ls L x. unfold lmap. rewrite fold_left_app. reflexivity. Qed.
+
+(* ---- depth -------------------------------------------------------------------------------------------- *)
+Fixpoint maxl (l : list nat) : nat := match l with [] => 0 | x :: t => Nat.max x (maxl t) end.
+
+Lemma maxl_ge : forall l a, In a l -> a <= maxl l.
+Proof. induction l as [|x t IH]; intros a H; [destruct H|]. destruct H as [<-|H]; cbn [maxl]; [lia|]. specialize (IH a H). lia. Qed.
+
+Lemma maxl_le : forall l c, (forall a, In a l -> a <= c) -> maxl l <= c.
+Proof.
+  induction l as [|x t IH]; intros c H; cbn [maxl]; [lia|].
+  pose proof (H x (or_introl eq_refl)). pose proof (IH c (fun a Ha => H a (or_intror Ha))). lia.
+Qed.
+
+Lemma maxl_pos : forall l, 1 <= maxl l -> exists a, In a l /\ 1 <= a.
+Proof.
+  induction l as [|x t IH]; cbn [maxl]; intro H; [lia|].
+  destruct (Nat.le_gt_cases 1 x) as [Hx|Hx]; [exists x; split; [left; reflexivity | exact Hx]|].
+  destruct (IH ltac:(lia)) as (a & Ha & H1). exists a. split; [right; exact Ha | exact H1].
+Qed.
+
+(* the depth of a signal: 0 for a state bit, one more than its deepest predecessor for a unit *)
+Fixpoint depf (us : list tu) (m : nat) (D : nat -> nat) : nat -> nat :=
+  match us with
+  | [] => D
+  | u :: t => depf t (S m) (fun i => if Nat.eqb i m then S (maxl (map (fun p => D (fst p)) (tin u))) else D i)
+  end.
+
+Lemma depf_prefix : forall us m D i, i < m -> depf us m D i = D i.
+Proof.
+  induction us as [|u t IH]; intros m D i H; cbn [depf]; [reflexivity|].
+  rewrite IH by lia. destruct (Nat.eqb_spec i m); [lia | reflexivity].
+Qed.
+
+Lemma depf_at : forall us m D j, j < length us ->
+  (forall k, k < length us -> reads_below (nth k us tu0) (m + k)) ->
+  depf us m D (m + j) = S (maxl (map (fun p => depf us m D (fst p)) (tin (nth j us tu0)))).
+Proof.
+  induction us as [|u t IH]; intros m D j Hj Hwf; cbn [length] in Hj, Hwf; [lia|].
+  destruct j as [|j].
+  - cbn [nth depf]. rewrite Nat.add_0_r, depf_prefix by lia. rewrite Nat.eqb_refl. f_equal. f_equal.
+    apply map_ext_in. intros [i z] Hin. cbn [fst].
+    pose proof (Hwf 0 ltac:(lia) i z Hin) as Hi. cbn [nth] in Hi.
+    rewrite depf_prefix by lia. destruct (Nat.eqb_spec i m); [lia | reflexivity].
+  - cbn [nth depf]. replace (m + S j) with (S m + j) by lia. apply IH; [lia|].
+    intros k Hk i z Hin. specialize (Hwf (S k) ltac:(lia) i z Hin). lia.
+Qed.
+
+Lemma map_nth_self : forall (l : list nat) d, map (fun i => nth i l d) (seq 0 (length l)) = l.
+Proof.
+  induction l as [|a t IH]; intro d; [reflexivity|]. cbn [length seq map nth]. f_equal.
+  rewrite <- seq_shift, map_map. apply IH.
+Qed.
+
+Section Lev.
+Variable n : nat.
+Variable us : list tu.
+Variable nx : list nat.
+
+Definition NS : nat := n + length us.
+Definition wfn : Prop := forall k, k < length us -> reads_below (nth k us tu0) (n + k).
+
+Definition dep : nat -> nat := depf us n (fun _ => 0).
+Definition dmax : nat := maxl (map (fun k => dep (n + k)) (seq 0 (length us))).
+
+(* unit k reads signal s *)
+Definition reads (k s : nat) : bool := existsb (fun p => Nat.eqb (fst p) s) (tin (nth k us tu0)).
+
+Lemma reads_in : forall k s, reads k s = true <-> exists z, In (s, z) (tin (nth k us tu0)).
+Proof.
+  intros k s. unfold reads. rewrite existsb_exists. split.
+  - intros ([i z] & Hin & E). cbn [fst] in E. apply Nat.eqb_eq in E. subst i. exists z. exact Hin.
+  - intros (z & Hin). exists (s, z). split; [exact Hin | apply Nat.eqb_refl].
+Qed.
+
+Lemma dep_state : forall i, i < n -> dep i = 0.
+Proof. intros i H. unfold dep. rewrite depf_prefix by exact H. reflexivity. Qed.
+
+Lemma dep_unit : wfn -> forall k, k < length us ->
+  dep (n + k) = S (maxl (map (fun p => dep (fst p)) (tin (nth k us tu0)))).
+Proof. intros Hwf k Hk. unfold dep. apply depf_at; assumption. Qed.
+
+Lemma dep_pred : wfn -> forall k p z, k < length us -> In (p, z) (tin (nth k us tu0)) -> dep p < dep (n + k).
+Proof.
+  intros Hwf k p z Hk Hin. rewrite dep_unit by assumption. apply Nat.lt_succ_r.
+  apply maxl_ge. apply in_map_iff. exists (p, z). split; [reflexivity | exact Hin].
+Qed.
+
+Lemma dep_le_dmax : forall k, k < length us -> dep (n + k) <= dmax.
+Proof. intros k Hk. apply maxl_ge. apply in_map_iff. exists k. split; [reflexivity | apply in_seq; lia]. Qed.
+
+Lemma dep_unit_pos : wfn -> forall k, k < length us -> 1 <= dep (n + k).
+Proof. intros Hwf k Hk. rewrite dep_unit by assumption. lia. Qed.
+
+Lemma dep_zero : wfn -> forall s, s < NS -> dep s = 0 -> s < n.
+Proof.
+  intros Hwf s Hs H. destruct (Nat.lt_ge_cases s n) as [Hl|Hg]; [exact Hl|].
+  pose proof (dep_unit_pos Hwf (s - n) ltac:(unfold NS in Hs; lia)). replace (n + (s - n)) with s in H0 by lia. lia.
+Qed.
+
+Lemma dep_le : forall s, s < NS -> dep s <= dmax.
+Proof.
+  intros s Hs. destruct (Nat.lt_ge_cases s n) as [Hl|Hg]; [rewrite dep_state by exact Hl; lia|].
+  replace s with (n + (s - n)) by lia. apply dep_le_dmax. unfold NS in Hs. lia.
+Qed.
+
+(* ---- the signals some next value depends on -------------------------------------------------------- *)
+Fixpoint needf (vs : list tu) (m : nat) (S0 : nat -> bool) : nat -> bool :=
+  match vs with
+  | [] => S0
+  | u :: t => let N' := needf t (S m) S0 in
+              fun i => N' i || (N' m && existsb (fun p => Nat.eqb (fst p) i) (tin u))
+  end.
+
+Definition need : nat -> bool := needf us n (fun i => existsb (Nat.eqb i) nx).
+
+Lemma needf_seed : forall vs m S0 i, S0 i = true -> needf vs m S0 i = true.
+Proof. induction vs as [|u t IH]; intros m S0 i H; cbn [needf]; [exact H|]. rewrite IH by exact H. reflexivity. Qed.
+
+Lemma needf_closed : forall vs m S0 k p z, k < length vs ->
+  (forall j, j < length vs -> reads_below (nth j vs tu0) (m + j)) ->
+  needf vs m S0 (m + k) = true -> In (p, z) (tin (nth k vs tu0)) -> needf vs m S0 p = true.
+Proof.
+  induction vs as [|u t IH]; intros m S0 k p z Hk Hwf Hn Hin; cbn [length] in Hk; [lia|].
+  assert (Hu : forall i z', In (i, z') (tin u) -> i < m) by (intros i z' H; specialize (Hwf 0 ltac:(cbn; lia) i z' H); cbn [nth] in Hwf; lia).
+  assert (Hm : existsb (fun p0 => Nat.eqb (fst p0) (m + k)) (tin u) = true -> False).
+  { intro E. apply existsb_exists in E as ([i z'] & Hi & E). cbn [fst] in E. apply Nat.eqb_eq in E. subst i.
+    specialize (Hu _ _ Hi). lia. }
+  cbn [needf] in *. destruct k as [|k].
+  - cbn [nth] in Hin. rewrite Nat.add_0_r in Hn. apply orb_true_iff in Hn as [Hn|Hn].
+    + apply orb_true_iff. right. rewrite Hn. cbn [andb]. apply existsb_exists. exists (p, z). split; [exact Hin|].
+      apply Nat.eqb_refl.
+    + apply andb_true_iff in Hn as [Hn _]. apply orb_true_iff. right. rewrite Hn. cbn [andb].
+      apply existsb_exists. exists (p, z). split; [exact Hin | apply Nat.eqb_refl].
+  - cbn [nth] in Hin. apply orb_true_iff in Hn as [Hn|Hn].
+    + apply orb_true_iff. left. replace (m + S k) with (S m + k) in Hn by lia.
+      apply (IH (S m) S0 k p z); [lia | | exact Hn | exact Hin].
+      intros j Hj. specialize (Hwf (S j) ltac:(cbn; lia)). cbn [nth] in Hwf. replace (S m + j) with (m + S j) by lia. exact Hwf.
+    + apply andb_true_iff in Hn as [_ Hn]. exfalso. apply Hm. replace (m + k) with (m + k) by lia.
+      replace (m + S k) with (m + S k) in Hn by lia. apply existsb_exists in Hn as ([i z'] & Hi & E).
+      cbn [fst] in E. apply Nat.eqb_eq in E. subst i. specialize (Hu _ _ Hi). lia.
+Qed.
+
+Lemma needf_step : forall vs m S0 i, needf vs m S0 i = true ->
+  S0 i = true \/ exists k z, k < length vs /\ needf vs m S0 (m + k) = true /\ In (i, z) (tin (nth k vs tu0)).
+Proof.
+  induction vs as [|u t IH]; intros m S0 i H; cbn [needf] in *; [left; exact H|].
+  apply orb_true_iff in H as [H|H].
+  - destruct (IH (S m) S0 i H) as [H0|(k & z & Hk & Hn & Hin)]; [left; exact H0|].
+    right. exists (S k), z. cbn [length nth]. split; [lia|]. split; [|exact Hin].
+    replace (m + S k) with (S m + k) by lia. rewrite Hn. reflexivity.
+  - apply andb_true_iff in H as [H1 H2]. apply existsb_exists in H2 as ([i' z] & Hi & E). cbn [fst] in E.
+    apply Nat.eqb_eq in E. subst i'. right. exists 0, z. cbn [length nth]. split; [lia|]. split; [|exact Hi].
+    rewrite Nat.add_0_r, H1. reflexivity.
+Qed.
+
+(* contributing to a next value: being one, or a predecessor of a unit that contributes *)
+Inductive contrib : nat -> Prop :=
+| contrib_out : forall s, In s nx -> contrib s
+| contrib_pred : forall k s z, k < length us -> contrib (n + k) -> In (s, z) (tin (nth k us tu0)) -> contrib s.
+
+Lemma need_nx : forall s, In s nx -> need s = true.
+Proof.
+  intros s H. apply needf_seed. apply existsb_exists. exists s. split; [exact H | apply Nat.eqb_refl].
+Qed.
+
+Lemma need_pred : wfn -> forall k p z, k < length us -> need (n + k) = true -> In (p, z) (tin (nth k us tu0)) ->
+  need p = true.
+Proof. intros Hwf k p z Hk Hn Hin. exact (needf_closed us n _ k p z Hk Hwf Hn Hin). Qed.
+
+Theorem need_contrib : wfn -> forall s, need s = true <-> contrib s.
+Proof.
+  intros Hwf s. split.
+  - (* by induction on the distance to the last signal *)
+    assert (G : forall d s, NS - s <= d -> need s = true -> contrib s \/ NS <= s).
+    { induction d as [|d IH]; intros s' Hd Hn.
+      - right. lia.
+      - destruct (needf_step us n _ s' Hn) as [H0|(k & z & Hk & Hk2 & Hin)].
+        + left. apply contrib_out. apply existsb_exists in H0 as (y & Hy & E). apply Nat.eqb_eq in E. subst. exact Hy.
+        + assert (Hs : s' < n + k) by (exact (Hwf k Hk s' z Hin)).
+          destruct (IH (n + k) ltac:(unfold NS in *; lia) Hk2) as [Hc|Hc]; [|unfold NS in Hc; lia].
+          left. exact (contrib_pred k s' z Hk Hc Hin). }
+    intro Hn. destruct (Nat.lt_ge_cases s NS) as [Hl|Hg].
+    + destruct (G (NS - s) s (le_n _) Hn) as [Hc|Hc]; [exact Hc | lia].
+    + destruct (needf_step us n _ s Hn) as [H0|(k & z & Hk & _ & Hin)].
+      * apply contrib_out. apply existsb_exists in H0 as (y & Hy & E). apply Nat.eqb_eq in E. subst. exact Hy.
+      * exfalso. specialize (Hwf k Hk s z Hin). unfold NS in Hg. lia.
+  - intro Hc. induction Hc as [s Hs|k s z Hk Hc IH Hin]; [apply need_nx; exact Hs|].
+    exact (need_pred Hwf k s z Hk IH Hin).
+Qed.
+
+(* ---- the last layer that reads a signal ------------------------------------------------------------ *)
+Definition lam (s : nat) : nat :=
+  Nat.max (if existsb (Nat.eqb s) nx then S dmax else 0)
+          (maxl (map (fun k => if need (n + k) && reads k s then dep (n + k) else 0) (seq 0 (length us)))).
+
+Lemma lam_nx : forall s, In s nx -> S dmax <= lam s.
+Proof.
+  intros s H. unfold lam. replace (existsb (Nat.eqb s) nx) with true; [lia|].
+  symmetry. apply existsb_exists. exists s. split; [exact H | apply Nat.eqb_refl].
+Qed.
+
+Lemma lam_reader : forall k s z, k < length us -> need (n + k) = true -> In (s, z) (tin (nth k us tu0)) ->
+  dep (n + k) <= lam s.
+Proof.
+  intros k s z Hk Hn Hin. unfold lam. apply Nat.max_le_iff. right.
+  replace (dep (n + k)) with (if need (n + k) && reads k s then dep (n + k) else 0).
+  - apply maxl_ge. apply in_map_iff. exists k. split; [reflexivity | apply in_seq; lia].
+  - rewrite Hn. replace (reads k s) with true; [reflexivity|]. symmetry. apply reads_in. exists z. exact Hin.
+Qed.
+
+Lemma lam_need : wfn -> forall s, 1 <= lam s -> need s = true.
+Proof.
+  intros Hwf s H. unfold lam in H. destruct (existsb (Nat.eqb s) nx) eqn:E.
+  - apply existsb_exists in E as (y & Hy & E). apply Nat.eqb_eq in E. subst. apply need_nx. exact Hy.
+  - cbn [Nat.max] in H. destruct (maxl_pos _ H) as (a & Ha & H1). apply in_map_iff in Ha as (k & Ea & Hk).
+    apply in_seq in Hk. destruct (need (n + k) && reads k s) eqn:F; [|lia].
+    apply andb_true_iff in F as [F1 F2]. apply reads_in in F2 as (z & Hin).
+    exact (need_pred Hwf k s z ltac:(lia) F1 Hin).
+Qed.
+
+(* ---- the layers ----------------------------------------------------------------------------------- *)
+Definition isunit (l s : nat) : bool := (n <=? s) && (dep s =? l).
+Definition live (l s : nat) : bool := isunit l s && need s || (dep s <? l) && (l <? lam s).
+Definition pos (l s : nat) : nat := match l with O => s | _ => length (filter (live l) (seq 0 s)) end.
+
+Definition idr (p : nat) : tu := TU (-1) [(p, 1%Z)].
+Definition reidx (l : nat) (u : tu) : tu := TU (tb u) (map (fun p => (pos l (fst p), snd p)) (tin u)).
+
+(* the source of a row: a copy of a signal, or a unit *)
+Inductive src := Cp (s : nat) | Un (s : nat).
+Definition srcof (l s : nat) : src := if isunit l s then Un s else Cp s.
+Definition srcs (l : nat) : list src := map (srcof l) (filter (live l) (seq 0 NS)).
+Definition srcd : list src := map (fun i => srcof dmax (nth i nx 0)) (seq 0 n).
+Definition mkrow (l : nat) (c : src) : tu :=
+  match c with Cp s => idr (pos (l - 1) s) | Un s => reidx (l - 1) (nth (s - n) us tu0) end.
+
+(* layers 1 .. d - 1 hold the live signals, layer d one row for each state bit *)
+Definition lsrc : list (nat * list src) := map (fun l => (l, srcs l)) (seq 1 (dmax - 1)) ++ [(dmax, srcd)].
+Definition lev : list (list tu) := map (fun p => map (mkrow (fst p)) (snd p)) lsrc.
+
+(* ---- positions --------------------------------------------------------------------------------------- *)
+Lemma seq_split : forall s M, s < M -> seq 0 M = seq 0 s ++ s :: seq (S s) (M - S s).
+Proof. intros s M H. replace M with (s + S (M - S s)) at 1 by lia. rewrite seq_app. reflexivity. Qed.
+
+Lemma nth_filter_count : forall (f : nat -> bool) s M d, s < M -> f s = true ->
+  nth (length (filter f (seq 0 s))) (filter f (seq 0 M)) d = s.
+Proof.
+  intros f s M d Hs Hf. rewrite (seq_split s M Hs).
+  rewrite filter_app. cbn [filter]. rewrite Hf. rewrite app_nth2 by lia. rewrite Nat.sub_diag. reflexivity.
+Qed.
+
+Lemma count_lt : forall (f : nat -> bool) s M, s < M -> f s = true ->
+  length (filter f (seq 0 s)) < length (filter f (seq 0 M)).
+Proof.
+  intros f s M Hs Hf. rewrite (seq_split s M Hs).
+  rewrite filter_app, length_app. cbn [filter]. rewrite Hf. cbn [length]. lia.
+Qed.
+
+Lemma count_mono : forall (f : nat -> bool) a b, a <= b -> length (filter f (seq 0 a)) <= length (filter f (seq 0 b)).
+Proof.
+  intros f a b H. replace b with (a + (b - a)) by lia. rewrite seq_app, filter_app, length_app. lia.
+Qed.
+
+Lemma pos_inj : forall l s1 s2, 1 <= l -> live l s1 = true -> live l s2 = true -> pos l s1 = pos l s2 -> s1 = s2.
+Proof.
+  intros l s1 s2 Hl H1 H2 E. destruct l as [|l]; [lia|]. cbn [pos] in E.
+  destruct (Nat.lt_trichotomy s1 s2) as [Hlt|[Heq|Hgt]]; [|exact Heq|].
+  - pose proof (count_lt (live (S l)) s1 s2 Hlt H1). lia.
+  - pose proof (count_lt (live (S l)) s2 s1 Hgt H2). lia.
+Qed.
+
+(* ---- firing the rows ------------------------------------------------------------------------------ *)
+Lemma wsum_reidx : forall l ins E,
+  wsum (map (fun p => (pos l (fst p), snd p)) ins) E = wsum ins (fun i => E (pos l i)).
+Proof. intros l ins E. induction ins as [|[i z] t IH]; cbn [map wsum fst snd]; [reflexivity|]. rewrite IH. reflexivity. Qed.
+
+Lemma fire_reidx : forall l u E, fire (reidx l u) E = fire u (fun i => E (pos l i)).
+Proof. intros l u E. unfold fire, reidx. cbn [tb tin]. rewrite wsum_reidx. reflexivity. Qed.
+
+Lemma fire_idr : forall p E, fire (idr p) E = E p.
+Proof. intros p E. unfold fire, idr. cbn [tb tin wsum]. destruct (E p); reflexivity. Qed.
+
+Lemma lfire_nth : forall L y r, r < length L -> nth r (lfire L y) false = fire (nth r L tu0) (fun i => nth i y false).
+Proof.
+  intros L y r Hr. unfold lfire. rewrite (nth_indep _ false (fire tu0 (fun i => nth i y false))) by (rewrite length_map; exact Hr).
+  exact (map_nth (fun u => fire u (fun i => nth i y false)) L tu0 r).
+Qed.
+
+(* a signal has a row in layer l, l <= d - 1 *)
+Definition at_layer (l s : nat) : Prop := s < NS /\ (match l with O => s < n | _ => live l s = true end).
+
+(* the predecessors of a unit of depth l + 1 that contributes, and a signal live at l + 1 or a next value of depth
+   at most l, have rows in layer l *)
+Lemma pred_at : wfn -> forall l k p z, k < length us -> need (n + k) = true -> dep (n + k) = S l ->
+  In (p, z) (tin (nth k us tu0)) -> at_layer l p.
+Proof.
+  intros Hwf l k p z Hk Hn Hdk Hin. pose proof (dep_pred Hwf k p z Hk Hin) as Hlt.
+  assert (Hp : p < NS) by (pose proof (Hwf k Hk p z Hin); unfold NS; lia).
+  split; [exact Hp|]. destruct l as [|l].
+  - apply (dep_zero Hwf p Hp). lia.
+  - unfold live. pose proof (lam_reader k p z Hk Hn Hin) as Hlam.
+    destruct (Nat.eq_dec (dep p) (S l)) as [E|E].
+    + apply orb_true_iff. left. apply andb_true_iff. split; [|exact (need_pred Hwf k p z Hk Hn Hin)].
+      unfold isunit. apply andb_true_iff. split; [|apply Nat.eqb_eq; exact E].
+      apply Nat.leb_le. destruct (Nat.lt_ge_cases p n) as [Hl|Hg]; [rewrite dep_state in E by exact Hl; lia | exact Hg].
+    + apply orb_true_iff. right. apply andb_true_iff. split; apply Nat.ltb_lt; lia.
+Qed.
+
+Lemma copy_at : wfn -> forall l s, s < NS -> dep s <= l -> S l < lam s -> at_layer l s.
+Proof.
+  intros Hwf l s Hs Hdl Hlam. split; [exact Hs|]. destruct l as [|l].
+  - apply (dep_zero Hwf s Hs). lia.
+  - unfold live. destruct (Nat.eq_dec (dep s) (S l)) as [E|E].
+    + apply orb_true_iff. left. apply andb_true_iff. split; [|apply lam_need; [exact Hwf | lia]].
+      unfold isunit. apply andb_true_iff. split; [|apply Nat.eqb_eq; exact E].
+      apply Nat.leb_le. destruct (Nat.lt_ge_cases s n) as [Hl|Hg]; [rewrite dep_state in E by exact Hl; lia | exact Hg].
+    + apply orb_true_iff. right. apply andb_true_iff. split; apply Nat.ltb_lt; lia.
+Qed.
+
+Section Sem.
+Hypothesis Hwf : wfn.
+Hypothesis Hnx : Forall (fun s => s < NS) nx.
+Hypothesis Hlen : length nx = n.
+Hypothesis Hd : 1 <= dmax.
+
+Variable x : list bool.
+Hypothesis Hx : length x = n.
+
+Let F : nat -> bool := run us n (fun i => nth i x false).
+
+Lemma F_unit : forall k, k < length us -> F (n + k) = fire (nth k us tu0) F.
+Proof. intros k Hk. unfold F. apply run_at; [exact Hk | exact Hwf]. Qed.
+
+Lemma F_state : forall i, i < n -> F i = nth i x false.
+Proof. intros i Hi. unfold F. apply run_prefix. exact Hi. Qed.
+
+(* the outputs after the first l layers, 0 <= l <= d - 1 *)
+Definition yl (l : nat) : list bool := lmap (map (fun l' => map (mkrow l') (srcs l')) (seq 1 l)) x.
+
+(* firing a row from the outputs of the layer before *)
+Lemma fire_row : forall l (y : list bool) c,
+  (forall s, at_layer l s -> nth (pos l s) y false = F s) ->
+  (forall s, c = Un s -> exists k, k < length us /\ s = n + k /\ need s = true /\ dep s = S l) ->
+  (forall s, c = Cp s -> at_layer l s) ->
+  fire (mkrow (S l) c) (fun i => nth i y false) = F (match c with Cp s => s | Un s => s end).
+Proof.
+  intros l y c Hy HU HC. destruct c as [s|s]; cbn [mkrow]; replace (S l - 1) with l by lia.
+  - rewrite fire_idr. apply Hy. apply HC. reflexivity.
+  - destruct (HU s eq_refl) as (k & Hk & -> & Hn & Hdk). replace (n + k - n) with k by lia.
+    rewrite fire_reidx, F_unit by exact Hk. apply fire_ext. intros p z Hin. apply Hy. exact (pred_at Hwf l k p z Hk Hn Hdk Hin).
+Qed.
+
+Lemma yl_spec : forall l, l <= dmax - 1 ->
+  length (yl l) = (match l with O => n | _ => length (filter (live l) (seq 0 NS)) end)
+  /\ forall s, at_layer l s -> nth (pos l s) (yl l) false = F s.
+Proof.
+  induction l as [|l IH]; intros Hl.
+  - unfold yl. cbn. split; [exact Hx|]. intros s [Hs Hn]. symmetry. apply F_state. exact Hn.
+  - destruct (IH ltac:(lia)) as [IL IY].
+    assert (E : yl (S l) = lfire (map (mkrow (S l)) (srcs (S l))) (yl l)).
+    { unfold yl. rewrite seq_S, map_app. cbn [map]. replace (1 + l) with (S l) by lia. apply lmap_app. }
+    rewrite E. unfold lfire, srcs. rewrite !length_map. split; [reflexivity|].
+    intros s [Hs Hlv]. cbn [pos]. fold (lfire (map (mkrow (S l)) (map (srcof (S l)) (filter (live (S l)) (seq 0 NS)))) (yl l)).
+    pose proof (count_lt (live (S l)) s NS Hs Hlv) as Hc.
+    rewrite lfire_nth by (rewrite !length_map; exact Hc).
+    rewrite nth_map_d with (d' := Cp 0) by (rewrite length_map; exact Hc).
+    rewrite nth_map_d with (d' := 0) by exact Hc. rewrite nth_filter_count by assumption.
+    assert (Hfs : F s = F (match srcof (S l) s with Cp s' => s' | Un s' => s' end))
+      by (unfold srcof; destruct (isunit (S l) s); reflexivity).
+    rewrite Hfs. apply fire_row; [exact IY | |].
+    + intros s' Hs'. unfold srcof in Hs'. destruct (isunit (S l) s) eqn:Hu; [|discriminate]. injection Hs' as <-.
+      unfold isunit in Hu. apply andb_true_iff in Hu as [H1 H2]. apply Nat.leb_le in H1. apply Nat.eqb_eq in H2.
+      exists (s - n). split; [unfold NS in Hs; lia|]. split; [lia|]. split; [|exact H2].
+      unfold live in Hlv. apply orb_true_iff in Hlv as [Hlv|Hlv].
+      * apply andb_true_iff in Hlv as [_ Hlv]. exact Hlv.
+      * apply andb_true_iff in Hlv as [Hlv _]. apply Nat.ltb_lt in Hlv. lia.
+    + intros s' Hs'. unfold srcof in Hs'. destruct (isunit (S l) s) eqn:Hu; [discriminate|]. injection Hs' as <-.
+      unfold live in Hlv. rewrite Hu in Hlv. cbn [andb orb] in Hlv. apply andb_true_iff in Hlv as [H1 H2].
+      apply Nat.ltb_lt in H1, H2. apply (copy_at Hwf); [exact Hs | lia | lia].
+Qed.
+
+Theorem lev_correct : lmap lev x = netstep n us nx x.
+Proof.
+  unfold lev, lsrc. rewrite map_app. cbn [map fst snd]. rewrite lmap_app.
+  fold (yl (dmax - 1)). destruct (yl_spec (dmax - 1) (le_n _)) as [_ IY].
+  unfold netstep. fold F. unfold lfire, srcd. rewrite !map_map.
+  transitivity (map F (map (fun i => nth i nx 0) (seq 0 n))).
+  2: { f_equal. rewrite <- Hlen. apply map_nth_self. }
+  rewrite map_map. apply map_ext_in. intros i Hi. apply in_seq in Hi.
+  set (s := nth i nx 0).
+  assert (Hs : s < NS) by (rewrite Forall_forall in Hnx; apply Hnx; apply nth_In; lia).
+  assert (Hin : In s nx) by (apply nth_In; lia).
+  assert (Hfs : F s = F (match srcof dmax s with Cp s' => s' | Un s' => s' end))
+    by (unfold srcof; destruct (isunit dmax s); reflexivity).
+  rewrite Hfs. replace (mkrow dmax) with (mkrow (S (dmax - 1))) by (f_equal; lia).
+  apply fire_row; [exact IY | |].
+  - intros s' Hs'. unfold srcof in Hs'. destruct (isunit dmax s) eqn:Hu; [|discriminate]. injection Hs' as <-.
+    unfold isunit in Hu. apply andb_true_iff in Hu as [H1 H2]. apply Nat.leb_le in H1. apply Nat.eqb_eq in H2.
+    exists (s - n). split; [unfold NS in Hs; lia|]. split; [lia|]. split; [apply need_nx; exact Hin | lia].
+  - intros s' Hs'. unfold srcof in Hs'. destruct (isunit dmax s) eqn:Hu; [discriminate|]. injection Hs' as <-.
+    pose proof (lam_nx s Hin). pose proof (dep_le s Hs).
+    assert (dep s <> dmax \/ s < n) as Hne.
+    { unfold isunit in Hu. apply andb_false_iff in Hu as [Hu|Hu]; [right; apply Nat.leb_gt in Hu; exact Hu|].
+      left. apply Nat.eqb_neq in Hu. lia. }
+    apply (copy_at Hwf); [exact Hs | | lia].
+    destruct Hne as [Hne|Hne]; [lia | rewrite dep_state by exact Hne; lia].
+Qed.
+
+End Sem.
+
+(* ---- the shape of the layered map ----------------------------------------------------------------------- *)
+Lemma length_lev : 1 <= dmax -> length lev = dmax.
+Proof. intro H. unfold lev, lsrc. rewrite length_map, length_app, length_map, length_seq. cbn [length]. lia. Qed.
+
+(* the width of layer l, 0 <= l <= d - 1 *)
+Definition width (l : nat) : nat := match l with O => n | _ => length (filter (live l) (seq 0 NS)) end.
+
+Lemma pos_lt : forall l s, at_layer l s -> pos l s < width l.
+Proof.
+  intros l s [Hs Hl]. destruct l as [|l]; cbn [pos width]; [exact Hl|]. apply count_lt; assumption.
+Qed.
+
+Lemma pos_inj_at : forall l s1 s2, at_layer l s1 -> at_layer l s2 -> pos l s1 = pos l s2 -> s1 = s2.
+Proof.
+  intros l s1 s2 [_ H1] [_ H2] E. destruct l as [|l]; [exact E|]. apply (pos_inj (S l)); [lia | exact H1 | exact H2 | exact E].
+Qed.
+
+Lemma nodup_map_inj : forall (f : nat -> nat) (P : nat -> Prop) l, NoDup l -> (forall a, In a l -> P a) ->
+  (forall a b, P a -> P b -> f a = f b -> a = b) -> NoDup (map f l).
+Proof.
+  intros f P l Hnd. induction Hnd as [|a t Ha Hnd IH]; intros HP Hinj; cbn [map]; constructor.
+  - intro Hin. apply in_map_iff in Hin as (b & Eb & Hb). apply Ha.
+    rewrite (Hinj b a (HP b (or_intror Hb)) (HP a (or_introl eq_refl)) Eb) in Hb. exact Hb.
+  - apply IH; [intros b Hb; apply HP; right; exact Hb | exact Hinj].
+Qed.
+
+(* a row built from a source of layer l + 1 reads distinct positions of layer l with weights -1 or 1 *)
+Lemma mkrow_ok : wfn -> Forall (fun u => NoDup (map fst (tin u)) /\ forall i z, In (i, z) (tin u) -> z = 1%Z \/ z = (-1)%Z) us ->
+  forall l c, (forall s, c = Un s -> exists k, k < length us /\ s = n + k /\ need s = true /\ dep s = S l) ->
+  (forall s, c = Cp s -> at_layer l s) -> rowok (width l) (mkrow (S l) c).
+Proof.
+  intros Hwf Hus l c HU HC. destruct c as [s|s]; cbn [mkrow]; replace (S l - 1) with l by lia.
+  - specialize (HC s eq_refl). unfold rowok, idr. cbn [tin map fst]. split; [constructor; [intros []|constructor]|].
+    intros i z [E|[]]. injection E as <- <-. split; [apply pos_lt; exact HC | left; reflexivity].
+  - destruct (HU s eq_refl) as (k & Hk & -> & Hn & Hdk). replace (n + k - n) with k by lia.
+    rewrite Forall_forall in Hus. destruct (Hus (nth k us tu0) (nth_In _ _ Hk)) as [Hnd Hz].
+    unfold rowok, reidx. cbn [tin]. split.
+    + rewrite map_map. cbn [fst]. rewrite <- (map_map fst (pos l)).
+      apply (nodup_map_inj (pos l) (at_layer l) (map fst (tin (nth k us tu0)))); [exact Hnd | |].
+      * intros p Hp. apply in_map_iff in Hp as ([p' z] & <- & Hin). exact (pred_at Hwf l k p' z Hk Hn Hdk Hin).
+      * intros a b Ha Hb E. exact (pos_inj_at l a b Ha Hb E).
+    + intros i z Hin. apply in_map_iff in Hin as ([p z'] & E & Hin). cbn [fst snd] in E. injection E as <- <-.
+      split; [apply pos_lt; exact (pred_at Hwf l k p z' Hk Hn Hdk Hin) | exact (Hz p z' Hin)].
+Qed.
+
+Lemma srcs_spec : forall l c, In c (srcs l) ->
+  (forall s, c = Un s -> exists k, k < length us /\ s = n + k /\ need s = true /\ dep s = l)
+  /\ (forall s, c = Cp s -> s < NS /\ dep s < l < lam s).
+Proof.
+  intros l c Hc. unfold srcs in Hc. apply in_map_iff in Hc as (s & <- & Hs). apply filter_In in Hs as [Hs Hlv].
+  apply in_seq in Hs. unfold srcof. destruct (isunit l s) eqn:Hu; split; intros s' E; try discriminate; injection E as <-.
+  - unfold isunit in Hu. apply andb_true_iff in Hu as [H1 H2]. apply Nat.leb_le in H1. apply Nat.eqb_eq in H2.
+    exists (s - n). split; [unfold NS in Hs; lia|]. split; [lia|]. split; [|exact H2].
+    unfold live in Hlv. apply orb_true_iff in Hlv as [Hlv|Hlv].
+    + apply andb_true_iff in Hlv as [_ Hlv]. exact Hlv.
+    + apply andb_true_iff in Hlv as [Hlv _]. apply Nat.ltb_lt in Hlv. lia.
+  - unfold live in Hlv. rewrite Hu in Hlv. cbn [andb orb] in Hlv. apply andb_true_iff in Hlv as [H1 H2].
+    apply Nat.ltb_lt in H1, H2. split; [lia | lia].
+Qed.
+
+Lemma srcd_spec : Forall (fun s => s < NS) nx -> length nx = n -> 1 <= dmax -> forall c, In c srcd ->
+  (forall s, c = Un s -> exists k, k < length us /\ s = n + k /\ need s = true /\ dep s = dmax)
+  /\ (forall s, c = Cp s -> s < NS /\ dep s < dmax /\ S dmax <= lam s).
+Proof.
+  intros Hnx Hlen Hd c Hc. unfold srcd in Hc. apply in_map_iff in Hc as (i & <- & Hi). apply in_seq in Hi.
+  set (s := nth i nx 0). assert (Hs : s < NS) by (rewrite Forall_forall in Hnx; apply Hnx; apply nth_In; lia).
+  assert (Hin : In s nx) by (apply nth_In; lia).
+  unfold srcof. destruct (isunit dmax s) eqn:Hu; split; intros s' E; try discriminate; injection E as <-.
+  - unfold isunit in Hu. apply andb_true_iff in Hu as [H1 H2]. apply Nat.leb_le in H1. apply Nat.eqb_eq in H2.
+    exists (s - n). split; [unfold NS in Hs; lia|]. split; [lia|]. split; [apply need_nx; exact Hin | exact H2].
+  - split; [exact Hs|]. split; [|apply lam_nx; exact Hin]. pose proof (dep_le s Hs).
+    unfold isunit in Hu. apply andb_false_iff in Hu as [Hu|Hu].
+    + apply Nat.leb_gt in Hu. rewrite dep_state by exact Hu. lia.
+    + apply Nat.eqb_neq in Hu. lia.
+Qed.
+
+(* Lemma 2.6: the layered map has depth d, every row reads distinct rows of the layer before with weights -1 or 1,
+   and it computes the next state of the netlist *)
+Theorem lev_ok : wfn -> Forall (fun s => s < NS) nx -> length nx = n -> 1 <= dmax ->
+  Forall (fun u => NoDup (map fst (tin u)) /\ forall i z, In (i, z) (tin u) -> z = 1%Z \/ z = (-1)%Z) us ->
+  length lev = dmax /\ lwf n lev /\ length (last lev []) = n
+  /\ forall x, length x = n -> lmap lev x = netstep n us nx x.
+Proof.
+  intros Hwf Hnx Hlen Hd Hus. split; [apply length_lev; exact Hd|]. split; [|split].
+  - (* layer l + 1 reads layer l *)
+    assert (G : forall m, m <= dmax - 1 ->
+      lwf (width m) (map (fun p => map (mkrow (fst p)) (snd p))
+                       (map (fun l => (l, srcs l)) (seq (S m) (dmax - 1 - m)) ++ [(dmax, srcd)]))).
+    { intros m Hm. remember (dmax - 1 - m) as c eqn:Ec. revert m Hm Ec. induction c as [|c IH]; intros m Hm Ec.
+      - cbn [seq map app lwf fst snd]. split; [|exact I].
+        apply Forall_forall. intros r Hr. apply in_map_iff in Hr as (c & <- & Hc).
+        destruct (srcd_spec Hnx Hlen Hd c Hc) as [HU HC].
+        replace dmax with (S m) by lia. apply mkrow_ok; [exact Hwf | exact Hus | |].
+        + intros s E. destruct (HU s E) as (k & Hk & Es & Hn & Hdk). exists k. repeat split; try assumption. lia.
+        + intros s E. destruct (HC s E) as (Hs & Hdl & Hlam). apply copy_at; [exact Hwf | exact Hs | lia | lia].
+      - cbn [seq map app lwf fst snd]. split.
+        + apply Forall_forall. intros r Hr. apply in_map_iff in Hr as (c' & <- & Hc).
+          destruct (srcs_spec (S m) c' Hc) as [HU HC]. apply mkrow_ok; [exact Hwf | exact Hus | exact HU |].
+          intros s E. destruct (HC s E) as (Hs & Hdl & Hlam). apply copy_at; [exact Hwf | exact Hs | lia | lia].
+        + rewrite length_map. unfold srcs. rewrite length_map.
+          replace (length (filter (live (S m)) (seq 0 NS))) with (width (S m)) by reflexivity.
+          apply IH; lia. }
+    specialize (G 0 ltac:(lia)). unfold lev, lsrc. replace (dmax - 1) with (dmax - 1 - 0) by lia. exact G.
+  - unfold lev, lsrc. rewrite map_app. cbn [map fst snd]. rewrite last_last. unfold srcd. rewrite !length_map, length_seq.
+    reflexivity.
+  - intros x Hx. apply lev_correct; assumption.
+Qed.
+
+(* every row is an identity unit H(x - 1) or a unit of the netlist with its bias and weights *)
+Theorem lev_rows : forall l cs c, In (l, cs) lsrc -> In c cs ->
+  match c with
+  | Cp s => exists p, mkrow l c = idr p
+  | Un s => tb (mkrow l c) = tb (nth (s - n) us tu0) /\ map snd (tin (mkrow l c)) = map snd (tin (nth (s - n) us tu0))
+  end.
+Proof.
+  intros l cs c _ _. destruct c as [s|s]; cbn [mkrow].
+  - eexists. reflexivity.
+  - unfold reidx. cbn [tb tin]. split; [reflexivity|]. rewrite map_map. reflexivity.
+Qed.
+
+(* the occurrences of unit s among the rows *)
+Definition isun (s : nat) (c : src) : bool := match c with Un s' => Nat.eqb s' s | Cp _ => false end.
+
+Lemma length_filter_map : forall (A B : Type) (p : B -> bool) (f : A -> B) (L : list A),
+  length (filter p (map f L)) = length (filter (fun a => p (f a)) L).
+Proof. intros A B p f L. induction L as [|a t IH]; cbn [map filter]; [reflexivity|]. destruct (p (f a)); cbn [length]; lia. Qed.
+
+Lemma length_filter_filter : forall (A : Type) (p q : A -> bool) (L : list A),
+  length (filter p (filter q L)) = length (filter (fun a => q a && p a) L).
+Proof.
+  intros A p q L. induction L as [|a t IH]; [reflexivity|]. cbn [filter].
+  destruct (q a); cbn [andb filter]; [destruct (p a); cbn [length]; lia | exact IH].
+Qed.
+
+Lemma filter_eqb_seq : forall (g : nat -> bool) M s, s < M ->
+  length (filter (fun s' => g s' && Nat.eqb s' s) (seq 0 M)) = if g s then 1 else 0.
+Proof.
+  intros g M s Hs. rewrite (seq_split s M Hs), filter_app, length_app. cbn [filter]. rewrite Nat.eqb_refl, andb_true_r.
+  assert (Z : forall a k, (a > s \/ a + k <= s) -> length (filter (fun s' => g s' && Nat.eqb s' s) (seq a k)) = 0).
+  { intros a k Hak. revert a Hak. induction k as [|k IH]; intros a Hak; [reflexivity|]. cbn [seq filter].
+    destruct (Nat.eqb_spec a s); [lia|]. rewrite andb_false_r. apply IH. lia. }
+  rewrite (Z 0 s) by lia. destruct (g s); cbn [length]; rewrite (Z (S s) (M - S s)) by lia; reflexivity.
+Qed.
+
+Lemma count_srcs : forall l s, s < NS -> length (filter (isun s) (srcs l)) = if isunit l s && need s then 1 else 0.
+Proof.
+  intros l s Hs. unfold srcs. rewrite length_filter_map, length_filter_filter.
+  rewrite (filter_ext _ (fun a => (live l a && isunit l a) && Nat.eqb a s)).
+  - rewrite filter_eqb_seq by exact Hs. destruct (isunit l s) eqn:Hu.
+    + unfold live. rewrite Hu. unfold isunit in Hu. apply andb_true_iff in Hu as [_ Hu]. apply Nat.eqb_eq in Hu.
+      rewrite Hu, Nat.ltb_irrefl. destruct (need s); reflexivity.
+    + rewrite andb_false_r. reflexivity.
+  - intro a. unfold srcof. destruct (isunit l a); cbn [isun]; [rewrite andb_true_r; reflexivity|].
+    rewrite !andb_false_r. reflexivity.
+Qed.
+
+Lemma count_map_srcof : forall d s (L : list nat),
+  length (filter (fun a => isun s (srcof d a)) L) = if isunit d s then length (filter (fun a => Nat.eqb a s) L) else 0.
+Proof.
+  intros d s L. induction L as [|a t IH]; [destruct (isunit d s); reflexivity|]. cbn [filter].
+  destruct (Nat.eqb_spec a s) as [->|E].
+  - assert (Hs : isun s (srcof d s) = isunit d s)
+      by (unfold srcof; destruct (isunit d s); cbn [isun]; [apply Nat.eqb_refl | reflexivity]).
+    rewrite Hs. destruct (isunit d s) eqn:Hu.
+    + cbn [length]. rewrite IH. reflexivity.
+    + exact IH.
+  - assert (Hf : isun s (srcof d a) = false)
+      by (unfold srcof; destruct (isunit d a); cbn [isun]; [apply Nat.eqb_neq; exact E | reflexivity]).
+    rewrite Hf. exact IH.
+Qed.
+
+Lemma count_srcd : length nx = n -> forall s,
+  length (filter (isun s) srcd) = if isunit dmax s then length (filter (fun a => Nat.eqb a s) nx) else 0.
+Proof.
+  intros Hlen s. unfold srcd. rewrite <- (map_map (fun i => nth i nx 0) (srcof dmax)).
+  rewrite <- Hlen, map_nth_self, length_filter_map. apply count_map_srcof.
+Qed.
+
+Lemma length_filter_concat : forall (A : Type) (p : A -> bool) (L : list (list A)),
+  length (filter p (concat L)) = fold_right Nat.add 0 (map (fun l => length (filter p l)) L).
+Proof.
+  intros A p L. induction L as [|l t IH]; [reflexivity|]. cbn [concat map fold_right]. rewrite filter_app, length_app, IH.
+  reflexivity.
+Qed.
+
+Lemma sum_indicator : forall x a k, fold_right Nat.add 0 (map (fun l => if Nat.eqb x l then 1 else 0) (seq a k))
+  = if (a <=? x) && (x <? a + k) then 1 else 0.
+Proof.
+  intros x a k. revert a. induction k as [|k IH]; intro a.
+  - cbn [seq map fold_right]. destruct (Nat.leb_spec a x), (Nat.ltb_spec x (a + 0)); cbn [andb]; lia.
+  - cbn [seq map fold_right]. rewrite IH. destruct (Nat.eqb_spec x a) as [->|E].
+    + rewrite Nat.leb_refl. destruct (Nat.leb_spec (S a) a); [lia|]. cbn [andb]. destruct (Nat.ltb_spec a (a + S k)); lia.
+    + destruct (Nat.leb_spec (S a) x), (Nat.ltb_spec x (S a + k)), (Nat.leb_spec a x), (Nat.ltb_spec x (a + S k));
+        cbn [andb]; lia.
+Qed.
+
+Lemma sum_zero : forall (L : list nat) (f : nat -> nat), (forall l, In l L -> f l = 0) ->
+  fold_right Nat.add 0 (map f L) = 0.
+Proof.
+  intros L f H. induction L as [|a t IH]; [reflexivity|]. cbn [map fold_right].
+  rewrite (H a (or_introl eq_refl)), IH by (intros l Hl; apply H; right; exact Hl). reflexivity.
+Qed.
+
+Lemma filter_none : forall (L : list nat) s, (forall a, In a L -> a <> s) -> length (filter (fun a => Nat.eqb a s) L) = 0.
+Proof.
+  intros L s H. induction L as [|a t IH]; [reflexivity|]. cbn [filter].
+  destruct (Nat.eqb_spec a s) as [E|E]; [exfalso; exact (H a (or_introl eq_refl) E)|].
+  apply IH. intros b Hb. apply H. right. exact Hb.
+Qed.
+
+(* each unit that contributes occurs once if its depth is less than d and once for each state bit whose next value it
+   is if its depth is d; no other unit occurs *)
+Theorem lev_units : wfn -> length nx = n -> forall s, n <= s < NS ->
+  length (filter (isun s) (concat (map snd lsrc)))
+  = if need s then (if dep s <? dmax then 1 else length (filter (fun a => Nat.eqb a s) nx)) else 0.
+Proof.
+  intros Hwf Hlen s Hs. unfold lsrc. rewrite map_app, concat_app, filter_app, length_app, map_map. cbn [map snd concat].
+  rewrite app_nil_r, count_srcd by exact Hlen. rewrite length_filter_concat, map_map.
+  pose proof (dep_unit_pos Hwf (s - n) ltac:(unfold NS in Hs; lia)) as Hpos. replace (n + (s - n)) with s in Hpos by lia.
+  pose proof (dep_le s (proj2 Hs)) as Hle.
+  assert (Hu : forall l, isunit l s = Nat.eqb (dep s) l)
+    by (intro l; unfold isunit; destruct (Nat.leb_spec n s); [reflexivity | lia]).
+  rewrite Hu. destruct (need s) eqn:Hn.
+  - rewrite (map_ext_in _ (fun l => if Nat.eqb (dep s) l then 1 else 0)).
+    2: { intros l Hl. rewrite count_srcs by lia. rewrite Hu, Hn, andb_true_r. reflexivity. }
+    rewrite sum_indicator. destruct (Nat.ltb_spec (dep s) dmax) as [Hlt|Hge].
+    + replace ((1 <=? dep s) && (dep s <? 1 + (dmax - 1))) with true
+        by (symmetry; apply andb_true_iff; split; [apply Nat.leb_le | apply Nat.ltb_lt]; lia).
+      destruct (Nat.eqb_spec (dep s) dmax); [lia | reflexivity].
+    + replace ((1 <=? dep s) && (dep s <? 1 + (dmax - 1))) with false
+        by (symmetry; apply andb_false_iff; right; apply Nat.ltb_ge; lia).
+      destruct (Nat.eqb_spec (dep s) dmax); [reflexivity | lia].
+  - rewrite sum_zero by (intros l _; rewrite count_srcs by lia; rewrite Hn, andb_false_r; reflexivity).
+    destruct (Nat.eqb (dep s) dmax); [|reflexivity]. rewrite filter_none; [reflexivity|].
+    intros a Ha E. subst a. rewrite (need_nx s Ha) in Hn. discriminate.
+Qed.
+
+(* the number of rows of each layer *)
+Theorem lev_widths : length nx = n -> map (@length tu) lev = map width (seq 1 (dmax - 1)) ++ [n].
+Proof.
+  intro Hlen. unfold lev, lsrc. rewrite map_app, map_app, !map_map. cbn [map fst snd]. f_equal.
+  - apply map_ext_in. intros l Hl. apply in_seq in Hl. unfold srcs. rewrite !length_map.
+    destruct l as [|l]; [lia | reflexivity].
+  - unfold srcd. rewrite !length_map, length_seq. reflexivity.
+Qed.
+
+(* the size of the layered map: its rows are those of the layers 1 .. d - 1 and one for each state bit *)
+Theorem lev_size : length nx = n ->
+  fold_right Nat.add 0 (map (@length tu) lev) = fold_right Nat.add 0 (map width (seq 1 (dmax - 1))) + n.
+Proof.
+  intro Hlen. unfold lev, lsrc. rewrite map_app, map_app, fold_right_app, !map_map. cbn [map fold_right fst snd].
+  unfold srcd. rewrite !length_map, length_seq.
+  assert (G : forall (L : list nat) c, (forall l, In l L -> 1 <= l) ->
+            fold_right Nat.add c (map (fun l => length (map (mkrow l) (srcs l))) L) = fold_right Nat.add 0 (map width L) + c).
+  { intros L c HL. induction L as [|a t IH]; [reflexivity|]. cbn [map fold_right].
+    rewrite IH by (intros l Hl; apply HL; right; exact Hl). unfold srcs. rewrite !length_map.
+    destruct a as [|a]; [specialize (HL 0 (or_introl eq_refl)); lia|]. cbn [width]. lia. }
+  rewrite G by (intros l Hl; apply in_seq in Hl; lia). lia.
+Qed.
+
+End Lev.

rocq/Lower.v

@@ -0,0 +1,212 @@
+(* Depth lower bounds (Section 3): no threshold unit, whatever its real weights, reads a memory word or
+   computes a one-hot disjunction of conjunctions (Lemma 3.6), and no ternary unit computes the branch
+   predicate on three or more bits, which one unit with integer weights computes (Remark 3.4). *)
+From Stdlib Require Import Reals Lra ZArith Lia List Bool.
+Import ListNotations.
+
+(* ---- units with real weights ------------------------------------------------------------------------------ *)
+(* the pre-activation without bias of the unit with weights w on the inputs x_i, i in l *)
+Fixpoint rsum (w : nat -> R) (x : nat -> bool) (l : list nat) : R :=
+  match l with [] => 0%R | i :: t => ((if x i then w i else 0) + rsum w x t)%R end.
+
+Definition rfire (N : nat) (w : nat -> R) (b : R) (x : nat -> bool) : bool :=
+  if Rle_dec 0 (rsum w x (seq 0 N) + b) then true else false.
+
+(* two inputs whose ones, counted with multiplicity, are those of two others have the same summed sums *)
+Lemma rsum_swap : forall w x1 x2 x3 x4 l,
+  (forall i, (Nat.b2n (x1 i) + Nat.b2n (x2 i) = Nat.b2n (x3 i) + Nat.b2n (x4 i))%nat) ->
+  (rsum w x1 l + rsum w x2 l = rsum w x3 l + rsum w x4 l)%R.
+Proof.
+  intros w x1 x2 x3 x4 l H. induction l as [|i t IH]; cbn [rsum]; [lra|].
+  specialize (H i). destruct (x1 i), (x2 i), (x3 i), (x4 i); cbn [Nat.b2n] in H; try lia; lra.
+Qed.
+
+Lemma rfire_swap : forall N w b x1 x2 x3 x4,
+  (forall i, (Nat.b2n (x1 i) + Nat.b2n (x2 i) = Nat.b2n (x3 i) + Nat.b2n (x4 i))%nat) ->
+  rfire N w b x1 = true -> rfire N w b x2 = true -> rfire N w b x3 = false -> rfire N w b x4 = false -> False.
+Proof.
+  intros N w b x1 x2 x3 x4 H. unfold rfire. pose proof (rsum_swap w x1 x2 x3 x4 (seq 0 N) H).
+  destruct (Rle_dec 0 (rsum w x1 (seq 0 N) + b)), (Rle_dec 0 (rsum w x2 (seq 0 N) + b)),
+    (Rle_dec 0 (rsum w x3 (seq 0 N) + b)), (Rle_dec 0 (rsum w x4 (seq 0 N) + b));
+    intros; try discriminate; lra.
+Qed.
+
+(* ---- Lemma 3.6 --------------------------------------------------------------------------------------------- *)
+(* the address alpha in the inputs 0 .. A - 1, least significant first, the words mu in the inputs A .. *)
+Fixpoint bval (x : nat -> bool) (k : nat) : nat :=
+  match k with O => 0 | S k' => bval x k' + Nat.b2n (x k') * 2 ^ k' end.
+
+Definition select (A : nat) (x : nat -> bool) : bool := x (A + bval x A)%nat.
+
+Lemma bval_low : forall x k, (forall i, (1 <= i)%nat -> x i = false) -> bval x k = match k with O => O | S _ => Nat.b2n (x 0%nat) end.
+Proof.
+  intros x k H. induction k as [|k IH]; [reflexivity|]. cbn [bval]. rewrite IH.
+  destruct k as [|k]; [cbn; lia|]. rewrite (H (S k)) by lia. cbn [Nat.b2n]. lia.
+Qed.
+
+Theorem read_needs_two_levels : forall A w b, (1 <= A)%nat ->
+  ~ (forall x, rfire (A + 2 ^ A) w b x = select A x).
+Proof.
+  intros A w b HA H.
+  set (pt := fun (a m0 m1 : bool) i => (a && Nat.eqb i 0) || (m0 && Nat.eqb i A) || (m1 && Nat.eqb i (S A))).
+  assert (Hlow : forall a m0 m1 i, (1 <= i)%nat -> (i < A)%nat -> pt a m0 m1 i = false).
+  { intros a m0 m1 i H1 H2. unfold pt. destruct (Nat.eqb_spec i 0), (Nat.eqb_spec i A), (Nat.eqb_spec i (S A));
+      try lia; rewrite !andb_false_r; reflexivity. }
+  assert (Hsel : forall a m0 m1, select A (pt a m0 m1) = if a then m1 else m0).
+  { intros a m0 m1. unfold select.
+    assert (E : bval (pt a m0 m1) A = Nat.b2n a).
+    { assert (G : forall k, (k <= A)%nat -> bval (pt a m0 m1) k = match k with O => O | S _ => Nat.b2n a end).
+      { induction k as [|k IH]; intros Hk; [reflexivity|]. cbn [bval]. rewrite IH by lia.
+        destruct k as [|k].
+        - unfold pt. rewrite Nat.eqb_refl. destruct (Nat.eqb_spec 0 A), (Nat.eqb_spec 0 (S A)); try lia.
+          rewrite !andb_false_r, !orb_false_r, andb_true_r. destruct a; reflexivity.
+        - rewrite (Hlow a m0 m1 (S k)) by lia. cbn [Nat.b2n]. lia. }
+      rewrite (G A (le_n _)). destruct A; [lia | reflexivity]. }
+    rewrite E. unfold pt. destruct a; cbn [Nat.b2n].
+    - replace (A + 1)%nat with (S A) by lia. rewrite Nat.eqb_refl.
+      destruct (Nat.eqb_spec (S A) 0), (Nat.eqb_spec (S A) A); try lia. rewrite !andb_false_r, andb_true_r. reflexivity.
+    - rewrite Nat.add_0_r, Nat.eqb_refl. destruct (Nat.eqb_spec A 0), (Nat.eqb_spec A (S A)); try lia.
+      rewrite !andb_false_r, andb_true_r, orb_false_r. reflexivity. }
+  apply (rfire_swap (A + 2 ^ A) w b (pt false true false) (pt true false true) (pt false false true) (pt true true false)).
+  - intro i. unfold pt. destruct (Nat.eqb_spec i 0), (Nat.eqb_spec i A), (Nat.eqb_spec i (S A));
+      cbn [andb orb Nat.b2n]; lia.
+  - rewrite H, Hsel. reflexivity.
+  - rewrite H, Hsel. reflexivity.
+  - rewrite H, Hsel. reflexivity.
+  - rewrite H, Hsel. reflexivity.
+Qed.
+
+(* the one-hot form: the lines s in the inputs 0 .. n - 1, the bits mu in the inputs n .. 2n - 1 *)
+Definition onehot (n : nat) (x : nat -> bool) : Prop := exists j, (j < n)%nat /\ forall i, (i < n)%nat -> x i = Nat.eqb i j.
+
+Definition orsel (n : nat) (x : nat -> bool) : bool := existsb (fun j => x j && x (n + j)%nat) (seq 0 n).
+
+Theorem onehot_needs_two_levels : forall n w b, (2 <= n)%nat ->
+  ~ (forall x, onehot n x -> rfire (n + n) w b x = orsel n x).
+Proof.
+  intros n w b Hn H.
+  set (pt := fun (s m : nat) i => Nat.eqb i s || Nat.eqb i (n + m)%nat).
+  assert (Hoh : forall s m, (s < n)%nat -> onehot n (pt s m)).
+  { intros s m Hs. exists s. split; [exact Hs|]. intros i Hi. unfold pt.
+    destruct (Nat.eqb_spec i (n + m)); [lia|]. apply orb_false_r. }
+  assert (Hval : forall s m, (s < 2)%nat -> (m < 2)%nat -> orsel n (pt s m) = Nat.eqb s m).
+  { intros s m Hs Hm. unfold orsel, pt.
+    destruct (Nat.eqb_spec s m) as [<-|E].
+    - apply existsb_exists. exists s. split; [apply in_seq; lia|]. rewrite !Nat.eqb_refl, orb_true_l, orb_true_r.
+      reflexivity.
+    - apply not_true_is_false. intro Hx. apply existsb_exists in Hx as (j & Hj & Hx). apply in_seq in Hj.
+      apply andb_true_iff in Hx as [H1 H2]. apply orb_true_iff in H1, H2.
+      destruct H1 as [H1|H1], H2 as [H2|H2]; apply Nat.eqb_eq in H1, H2; lia. }
+  apply (rfire_swap (n + n) w b (pt 0 0) (pt 1 1) (pt 0 1) (pt 1 0))%nat.
+  - intro i. unfold pt. destruct (Nat.eqb_spec i 0), (Nat.eqb_spec i 1), (Nat.eqb_spec i (n + 0)),
+      (Nat.eqb_spec i (n + 1)); cbn; lia.
+  - rewrite H by (apply Hoh; lia). rewrite Hval by lia. reflexivity.
+  - rewrite H by (apply Hoh; lia). rewrite Hval by lia. reflexivity.
+  - rewrite H by (apply Hoh; lia). rewrite Hval by lia. reflexivity.
+  - rewrite H by (apply Hoh; lia). rewrite Hval by lia. reflexivity.
+Qed.
+
+(* ---- Remark 3.4 ------------------------------------------------------------------------------------------- *)
+Open Scope Z_scope.
+
+Fixpoint zsum (w : nat -> Z) (x : nat -> bool) (l : list nat) : Z :=
+  match l with [] => 0 | i :: t => (if x i then w i else 0) + zsum w x t end.
+
+Definition zfire (n : nat) (w : nat -> Z) (b : Z) (x : nat -> bool) : bool := Z.leb 0 (zsum w x (seq 0 n) + b).
+
+(* the value of r_0 .. r_(n-1) in two's complement, and the branch predicate [value <= 0] *)
+Fixpoint uval (r : nat -> bool) (k : nat) : Z :=
+  match k with O => 0 | S k' => uval r k' + Z.b2z (r k') * 2 ^ Z.of_nat k' end.
+
+Definition tval (n : nat) (r : nat -> bool) : Z := uval r (n - 1) - Z.b2z (r (n - 1)%nat) * 2 ^ Z.of_nat (n - 1).
+
+Definition branch (n : nat) (r : nat -> bool) : bool := Z.leb (tval n r) 0.
+
+(* with integer weights one unit computes it *)
+Lemma branch_one_unit : forall n r,
+  branch n r = Z.leb 0 (Z.b2z (r (n - 1)%nat) * 2 ^ Z.of_nat (n - 1) - uval r (n - 1)).
+Proof. intros n r. unfold branch, tval. apply eq_true_iff_eq. rewrite !Z.leb_le. lia. Qed.
+
+Lemma zsum_ext : forall w x x' l, (forall i, In i l -> x i = x' i) -> zsum w x l = zsum w x' l.
+Proof.
+  intros w x x' l H. induction l as [|i t IH]; cbn [zsum]; [reflexivity|].
+  rewrite (H i (or_introl eq_refl)), IH by (intros j Hj; apply H; right; exact Hj). reflexivity.
+Qed.
+
+Lemma zsum_zero : forall w l, zsum w (fun _ => false) l = 0.
+Proof. intros w l. induction l as [|i t IH]; cbn [zsum]; lia. Qed.
+
+Lemma zsum_one : forall w k l, NoDup l -> In k l -> zsum w (fun i => Nat.eqb i k) l = w k.
+Proof.
+  intros w k l Hnd. induction Hnd as [|i t Hi Hnd IH]; intros Hk; [destruct Hk|]. cbn [zsum].
+  destruct (Nat.eqb_spec i k) as [->|E].
+  - rewrite (zsum_ext w _ (fun _ => false)), zsum_zero; [lia|].
+    intros j Hj. destruct (Nat.eqb_spec j k); [subst; contradiction | reflexivity].
+  - destruct Hk as [Hk|Hk]; [contradiction|]. rewrite IH by exact Hk. lia.
+Qed.
+
+Lemma zsum_all : forall w l, zsum w (fun _ => true) l = fold_right Z.add 0 (map w l).
+Proof. intros w l. induction l as [|i t IH]; cbn [zsum map fold_right]; lia. Qed.
+
+Lemma uval_ext : forall r r' k, (forall i, (i < k)%nat -> r i = r' i) -> uval r k = uval r' k.
+Proof.
+  intros r r' k H. induction k as [|k IH]; cbn [uval]; [reflexivity|].
+  rewrite IH by (intros i Hi; apply H; lia). rewrite (H k) by lia. reflexivity.
+Qed.
+
+Lemma uval_one : forall j k, (j < k)%nat -> uval (fun i => Nat.eqb i j) k = 2 ^ Z.of_nat j.
+Proof.
+  intros j k Hjk. induction k as [|k IH]; [lia|]. cbn [uval].
+  destruct (Nat.eqb_spec k j) as [->|E].
+  - rewrite (uval_ext _ (fun _ => false)).
+    + assert (Z0 : forall m, uval (fun _ => false) m = 0) by (induction m as [|m IHm]; cbn [uval]; [reflexivity | rewrite IHm; reflexivity]).
+      rewrite Z0. cbn [Z.b2z]. lia.
+    + intros i Hi. destruct (Nat.eqb_spec i j); [lia | reflexivity].
+  - rewrite IH by lia. cbn [Z.b2z]. lia.
+Qed.
+
+Lemma uval_all : forall k, uval (fun _ => true) k = 2 ^ Z.of_nat k - 1.
+Proof.
+  induction k as [|k IH]; cbn [uval]; [reflexivity|]. rewrite IH. cbn [Z.b2z].
+  rewrite Nat2Z.inj_succ, Z.pow_succ_r by lia. lia.
+Qed.
+
+Lemma sum_ternary_lower : forall (w : nat -> Z) (l : list nat), (forall i, In i l -> w i = -1) -> fold_right Z.add 0 (map w l) = - Z.of_nat (length l).
+Proof.
+  intros w l H. induction l as [|i t IH]; cbn [map fold_right length]; [reflexivity|].
+  rewrite (H i (or_introl eq_refl)), IH by (intros j Hj; apply H; right; exact Hj). lia.
+Qed.
+
+Theorem branch_not_ternary : forall n w b, (3 <= n)%nat -> (forall i, -1 <= w i <= 1) ->
+  ~ (forall r, zfire n w b r = branch n r).
+Proof.
+  intros n w b Hn Hw H.
+  (* r = 0 has value 0, so b >= 0 *)
+  assert (Hb : 0 <= b).
+  { specialize (H (fun _ => false)). unfold zfire, branch, tval in H. rewrite zsum_zero in H.
+    assert (Z0 : forall m, uval (fun _ => false) m = 0) by (induction m as [|m IHm]; cbn [uval]; [reflexivity | rewrite IHm; reflexivity]).
+    rewrite Z0 in H. cbn [Z.b2z] in H. replace (0 - 0 * 2 ^ Z.of_nat (n - 1)) with 0 in H by lia.
+    cbn in H. apply Z.leb_le. rewrite H. reflexivity. }
+  (* each unit vector e_i, i < n - 1, has value 2^i > 0, so w_i = -1 and b = 0 *)
+  assert (He : forall i, (i < n - 1)%nat -> w i + b < 0).
+  { intros i Hi. specialize (H (fun k => Nat.eqb k i)). unfold zfire, branch, tval in H.
+    rewrite zsum_one in H by (apply seq_NoDup || (apply in_seq; lia)).
+    rewrite uval_one in H by exact Hi. destruct (Nat.eqb_spec (n - 1) i) as [E|E]; [lia|]. cbn [Z.b2z] in H.
+    assert (P : 0 < 2 ^ Z.of_nat i) by (apply Z.pow_pos_nonneg; lia).
+    replace (2 ^ Z.of_nat i - 0 * 2 ^ Z.of_nat (n - 1) <=? 0) with false in H
+      by (symmetry; apply Z.leb_gt; lia).
+    apply Z.leb_gt. exact H. }
+  assert (Hw1 : forall i, (i < n - 1)%nat -> w i = -1) by (intros i Hi; specialize (He i Hi); specialize (Hw i); lia).
+  assert (Hb0 : b = 0) by (specialize (He 0%nat ltac:(lia)); rewrite Hw1 in He by lia; lia).
+  (* the vector of ones has value -1, so w_(n-1) >= n - 1 >= 2 *)
+  specialize (H (fun _ => true)). unfold zfire, branch, tval in H.
+  rewrite zsum_all, uval_all in H. cbn [Z.b2z] in H.
+  replace (seq 0 n) with (seq 0 (n - 1) ++ [(n - 1)%nat]) in H
+    by (replace n with (S (n - 1)) at 3 by lia; rewrite seq_S; reflexivity).
+  rewrite map_app, fold_right_app in H. cbn [map fold_right] in H.
+  assert (Hs : forall (l : list Z) c, fold_right Z.add c l = fold_right Z.add 0 l + c).
+  { intros l c. induction l as [|y t IH]; cbn [fold_right]; lia. }
+  rewrite Hs, sum_ternary_lower, length_seq in H by (intros i Hi; apply in_seq in Hi; apply Hw1; lia).
+  replace (2 ^ Z.of_nat (n - 1) - 1 - 1 * 2 ^ Z.of_nat (n - 1) <=? 0) with true in H by (symmetry; apply Z.leb_le; lia).
+  apply Z.leb_le in H. specialize (Hw (n - 1)%nat). lia.
+Qed.

rocq/Margin.v

@@ -0,0 +1,781 @@
+(* Section 6, the deterministic part: an orbit of integer pre-activations survives every perturbation below one half
+   (Theorem 6.2), weight and bias errors (Proposition 6.3), and the r-fold amplification, which multiplies every margin
+   by r (Definition 6.6, Proposition 6.7, Theorem 6.8 (i)). *)
+From Stdlib Require Import List Bool Arith ZArith Reals Lia Lra.
+Import ListNotations.
+From TH Require Import TwoHead Net Lev.
+
+Local Open Scope R_scope.
+
+(* ---- thresholding at -1/2 ------------------------------------------------------------------------------------ *)
+Definition H12 (z : R) : bool := if Rle_dec (-1/2) z then true else false.
+
+(* a perturbation e fails a row of integer pre-activation z when it carries z across -1/2 *)
+Definition fails (z : Z) (e : R) : Prop :=
+  ((0 <= z)%Z /\ IZR z + e < -1/2) \/ ((z <= -1)%Z /\ -1/2 <= IZR z + e).
+
+Lemma H12_ok : forall z e, ~ fails z e -> H12 (IZR z + e) = Z.leb 0 z.
+Proof.
+  intros z e Hf. unfold H12.
+  destruct (Rle_dec (-1/2) (IZR z + e)) as [H|H]; destruct (Z.leb_spec 0 z) as [Hz|Hz]; try reflexivity.
+  - exfalso. apply Hf. right. split; [lia | exact H].
+  - exfalso. apply Hf. left. split; [exact Hz | lra].
+Qed.
+
+(* the distance of an integer pre-activation from the comparator is at least 1/2 *)
+Lemma dist_half : forall z : Z, 1/2 <= Rabs (IZR z + 1/2).
+Proof.
+  intro z. destruct (Z.le_gt_cases 0 z) as [Hz|Hz].
+  - apply IZR_le in Hz. rewrite Rabs_right by lra. lra.
+  - assert (Hz' : (z <= -1)%Z) by lia. apply IZR_le in Hz'. rewrite Rabs_left by lra. lra.
+Qed.
+
+(* a perturbation smaller than the distance from the comparator never fails *)
+Lemma no_fail : forall z e, Rabs e < Rabs (IZR z + 1/2) -> ~ fails z e.
+Proof.
+  intros z e H [[Hz Hl]|[Hz Hl]].
+  - apply IZR_le in Hz. rewrite (Rabs_right (IZR z + 1/2)) in H by lra.
+    pose proof (Rle_abs (- e)) as Ha. rewrite Rabs_Ropp in Ha. lra.
+  - apply IZR_le in Hz. rewrite (Rabs_left (IZR z + 1/2)) in H by lra. pose proof (Rle_abs e). lra.
+Qed.
+
+Lemma no_fail_half : forall z e, Rabs e < 1/2 -> ~ fails z e.
+Proof. intros z e H. apply no_fail. pose proof (dist_half z). lra. Qed.
+
+(* a perturbation of +1/2 at a row of pre-activation -1 changes its output *)
+Lemma half_tight : H12 (IZR (-1) + 1/2) <> Z.leb 0 (-1).
+Proof. unfold H12. destruct (Rle_dec (-1/2) (IZR (-1) + 1/2)) as [H|H]; [discriminate | exfalso; apply H; lra]. Qed.
+
+(* ---- perturbed layers and maps (Definition 6.1) ---------------------------------------------------------------- *)
+Definition pre (u : tu) (y : list bool) : Z := (tb u + wsum (tin u) (fun i => nth i y false))%Z.
+
+(* a layer whose row i is perturbed by e i, which may depend on the input *)
+Definition lfirep (L : list tu) (e : nat -> list bool -> R) (y : list bool) : list bool :=
+  map (fun i => H12 (IZR (pre (nth i L tu0) y) + e i y)) (seq 0 (length L)).
+
+Lemma map_seq_nth : forall (A B : Type) (f : A -> B) l d, map f l = map (fun i => f (nth i l d)) (seq 0 (length l)).
+Proof.
+  intros A B f l d. induction l as [|a t IH]; [reflexivity|]. cbn [map length seq nth]. f_equal.
+  rewrite IH, <- seq_shift, map_map. reflexivity.
+Qed.
+
+Lemma lfire_seq : forall L y, lfire L y = map (fun i => Z.leb 0 (pre (nth i L tu0) y)) (seq 0 (length L)).
+Proof. intros L y. unfold lfire. rewrite (map_seq_nth _ _ _ L tu0). reflexivity. Qed.
+
+Lemma lfirep_ok : forall L e y, (forall i, (i < length L)%nat -> ~ fails (pre (nth i L tu0) y) (e i y)) ->
+  lfirep L e y = lfire L y.
+Proof.
+  intros L e y H. rewrite lfire_seq. unfold lfirep. apply map_ext_in. intros i Hi. apply in_seq in Hi.
+  apply H12_ok. apply H. lia.
+Qed.
+
+(* the layers from l on, layer l + k perturbed by E (l + k) *)
+Fixpoint lmapp (Ls : list (list tu)) (l : nat) (E : nat -> nat -> list bool -> R) (y : list bool) : list bool :=
+  match Ls with [] => y | L :: t => lmapp t (S l) E (lfirep L (E l) y) end.
+
+(* the input of layer l on the orbit *)
+Definition lin (Ls : list (list tu)) (x : list bool) (l : nat) : list bool := lmap (firstn l Ls) x.
+
+Lemma lmapp_ok : forall Ls l E x,
+  (forall k i, (k < length Ls)%nat -> (i < length (nth k Ls []))%nat ->
+     ~ fails (pre (nth i (nth k Ls []) tu0) (lin Ls x k)) (E (l + k)%nat i (lin Ls x k))) ->
+  lmapp Ls l E x = lmap Ls x.
+Proof.
+  induction Ls as [|L t IH]; intros l E x H; [reflexivity|]. cbn [lmapp].
+  rewrite lfirep_ok.
+  - unfold lmap. cbn [fold_left]. apply (IH (S l) E (lfire L x)). intros k i Hk Hi.
+    specialize (H (S k) i ltac:(cbn [length]; lia) Hi). replace (S l + k)%nat with (l + S k)%nat by lia. exact H.
+  - intros i Hi. specialize (H 0%nat i ltac:(cbn [length]; lia) Hi). rewrite Nat.add_0_r in H. exact H.
+Qed.
+
+(* ---- trajectories ------------------------------------------------------------------------------------------------ *)
+Fixpoint trajp (Ls : list (list tu)) (E : nat -> nat -> nat -> list bool -> R) (x0 : list bool) (t : nat) : list bool :=
+  match t with O => x0 | S t' => lmapp Ls 0 (E t') (trajp Ls E x0 t') end.
+
+Definition orbit (Ls : list (list tu)) (x0 : list bool) (t : nat) : list bool := Nat.iter t (lmap Ls) x0.
+
+(* the layers read the perturbations of their own rows only *)
+Lemma lmapp_ext : forall Ls l E1 E2 y,
+  (forall k i y', (k < length Ls)%nat -> (i < length (nth k Ls []))%nat -> E1 (l + k)%nat i y' = E2 (l + k)%nat i y') ->
+  lmapp Ls l E1 y = lmapp Ls l E2 y.
+Proof.
+  induction Ls as [|L t IH]; intros l E1 E2 y H; [reflexivity|]. cbn [lmapp].
+  replace (lfirep L (E1 l) y) with (lfirep L (E2 l) y).
+  - apply IH. intros k i y' Hk Hi. replace (S l + k)%nat with (l + S k)%nat by lia. apply H; cbn [length nth]; lia || exact Hi.
+  - unfold lfirep. apply map_ext_in. intros i Hi. apply in_seq in Hi. f_equal. f_equal. symmetry.
+    rewrite <- (Nat.add_0_r l) at 1 2. apply H; cbn [length nth]; lia.
+Qed.
+
+Lemma trajp_ext : forall Ls E1 E2 x0 t,
+  (forall t' l i y, (t' < t)%nat -> (l < length Ls)%nat -> (i < length (nth l Ls []))%nat -> E1 t' l i y = E2 t' l i y) ->
+  trajp Ls E1 x0 t = trajp Ls E2 x0 t.
+Proof.
+  intros Ls E1 E2 x0 t. induction t as [|t IH]; intro H; [reflexivity|]. cbn [trajp].
+  rewrite IH by (intros t' l i y Ht' Hl Hi; apply H; lia || assumption). apply lmapp_ext.
+  intros k i y' Hk Hi. apply H; lia || assumption.
+Qed.
+
+(* row i of layer l fails at step t when its perturbation, on the input the orbit gives it, crosses -1/2 *)
+Definition rfail (Ls : list (list tu)) (E : nat -> nat -> nat -> list bool -> R) (x0 : list bool) (t l i : nat) : Prop :=
+  fails (pre (nth i (nth l Ls []) tu0) (lin Ls (orbit Ls x0 t) l)) (E t l i (lin Ls (orbit Ls x0 t) l)).
+
+(* if no row of the first T steps fails, the trajectory follows the orbit for T steps *)
+Theorem traj_ok : forall Ls E x0 T,
+  (forall t l i, (t < T)%nat -> (l < length Ls)%nat -> (i < length (nth l Ls []))%nat -> ~ rfail Ls E x0 t l i) ->
+  forall t, (t <= T)%nat -> trajp Ls E x0 t = orbit Ls x0 t.
+Proof.
+  intros Ls E x0 T H. induction t as [|t IH]; intro Ht; [reflexivity|].
+  cbn [trajp]. rewrite IH by lia. cbn [orbit Nat.iter]. apply lmapp_ok.
+  intros k i Hk Hi. exact (H t k i ltac:(lia) Hk Hi).
+Qed.
+
+(* Theorem 6.2: perturbations below 1/2 leave every orbit exact *)
+Theorem margin : forall Ls E x0 eps, eps < 1/2 -> (forall t l i y, Rabs (E t l i y) <= eps) ->
+  forall t, trajp Ls E x0 t = orbit Ls x0 t.
+Proof.
+  intros Ls E x0 eps He HE t. apply (traj_ok Ls E x0 t); [|lia].
+  intros t' l i _ _ _. apply no_fail_half. specialize (HE t' l i (lin Ls (orbit Ls x0 t') l)). lra.
+Qed.
+
+(* the constant 1/2 cannot be increased *)
+Theorem margin_tight : forall u y, pre u y = (-1)%Z -> H12 (IZR (pre u y) + 1/2) <> Z.leb 0 (pre u y).
+Proof. intros u y E. rewrite E. exact half_tight. Qed.
+
+(* ---- weight and bias errors (Proposition 6.3) ------------------------------------------------------------------- *)
+Fixpoint rsum (k : nat) (g : nat -> R) : R := match k with O => 0 | S k' => rsum k' g + g k' end.
+
+Lemma rsum_le : forall k g h, (forall j, (j < k)%nat -> g j <= h j) -> rsum k g <= rsum k h.
+Proof. induction k as [|k IH]; intros g h H; cbn [rsum]; [lra|]. pose proof (IH g h (fun j Hj => H j ltac:(lia))). pose proof (H k ltac:(lia)). lra. Qed.
+
+Lemma rsum_abs : forall k g, Rabs (rsum k g) <= rsum k (fun j => Rabs (g j)).
+Proof.
+  induction k as [|k IH]; intro g; cbn [rsum]; [rewrite Rabs_R0; lra|].
+  pose proof (Rabs_triang (rsum k g) (g k)). pose proof (IH g). lra.
+Qed.
+
+(* the number of j < k with f j *)
+Fixpoint ncnt (k : nat) (f : nat -> bool) : nat := match k with O => O | S k' => (ncnt k' f + if f k' then 1 else 0)%nat end.
+
+Definition b2r (b : bool) : R := if b then 1 else 0.
+
+Lemma rsum_cnt : forall k (p b : nat -> bool) a c,
+  rsum k (fun j => (if p j then a else c) * b2r (b j)) = INR (ncnt k (fun j => p j && b j)) * a
+                                                         + INR (ncnt k (fun j => negb (p j) && b j)) * c.
+Proof.
+  induction k as [|k IH]; intros p b a c; cbn [rsum ncnt]; [cbn [INR]; lra|]. rewrite IH, !plus_INR.
+  unfold b2r. destruct (p k), (b k); cbn [andb negb INR]; lra.
+Qed.
+
+Lemma rsum_cnt1 : forall k (p : nat -> bool) a c,
+  rsum k (fun j => if p j then a else c) = INR (ncnt k p) * a + INR (ncnt k (fun j => negb (p j))) * c.
+Proof.
+  induction k as [|k IH]; intros p a c; cbn [rsum ncnt]; [cbn [INR]; lra|]. rewrite IH, !plus_INR.
+  destruct (p k); cbn [negb INR]; lra.
+Qed.
+
+Lemma firstn_snoc : forall (A : Type) (l : list A) k d, (k < length l)%nat -> firstn (S k) l = firstn k l ++ [nth k l d].
+Proof.
+  intros A l. induction l as [|a t IH]; intros k d Hk; [cbn [length] in Hk; lia|].
+  destruct k as [|k]; [reflexivity|]. change (firstn (S (S k)) (a :: t)) with (a :: firstn (S k) t).
+  rewrite (IH k d) by (cbn [length] in Hk; lia). reflexivity.
+Qed.
+
+Lemma last_nth' : forall (A : Type) (l : list A) d, l <> [] -> last l d = nth (length l - 1) l d.
+Proof.
+  intros A l d. induction l as [|a t IH]; intro H; [contradiction|]. destruct t as [|b t]; [reflexivity|].
+  change (last (a :: b :: t) d) with (last (b :: t) d). rewrite IH by discriminate. cbn [length].
+  replace (S (S (length t)) - 1)%nat with (S (S (length t) - 1)) by lia. reflexivity.
+Qed.
+
+Section Mismatch.
+Variable Ls : list (list tu).
+Variable n : nat.
+
+(* the width of the input of layer l *)
+Definition win (l : nat) : nat := match l with O => n | S l' => length (nth l' Ls []) end.
+(* the entries row u programs: the inputs it reads with a nonzero weight *)
+Definition prog (u : tu) (j : nat) : bool := existsb (fun p => Nat.eqb (fst p) j && negb (Z.eqb (snd p) 0)) (tin u).
+Definition row (l i : nat) : tu := nth i (nth l Ls []) tu0.
+
+Lemma lin_len : forall x l, length x = n -> (l <= length Ls)%nat -> length (lin Ls x l) = win l.
+Proof.
+  intros x l Hx. induction l as [|l IH]; intro Hl; [exact Hx|].
+  unfold lin. rewrite (firstn_snoc _ Ls l []) by lia. rewrite lmap_app. unfold lfire. rewrite length_map. reflexivity.
+Qed.
+
+(* a map whose last layer has n rows keeps the orbits on n bits *)
+Lemma orbit_len : length (last Ls []) = n -> Ls <> [] -> forall x0 t, length x0 = n -> length (orbit Ls x0 t) = n.
+Proof.
+  intros Hlast Hne x0 t Hx. induction t as [|t IH]; [exact Hx|].
+  change (orbit Ls x0 (S t)) with (lmap Ls (orbit Ls x0 t)).
+  assert (E : lmap Ls (orbit Ls x0 t) = lin Ls (orbit Ls x0 t) (length Ls)) by (unfold lin; rewrite firstn_all; reflexivity).
+  rewrite E, lin_len by (exact IH || lia). rewrite <- Hlast, (last_nth' _ Ls []) by exact Hne.
+  destruct (length Ls) as [|m] eqn:Em; [destruct Ls; [contradiction | discriminate]|]. cbn [win].
+  replace (S m - 1)%nat with m by lia. reflexivity.
+Qed.
+
+(* the realized layers: row i of layer l reads input j with weight W_ij + D l i j and has bias b_i + be l i *)
+Variables (D : nat -> nat -> nat -> R) (be : nat -> nat -> R) (eps gam eta : R).
+Hypothesis HD : forall l i j, Rabs (D l i j) <= if prog (row l i) j then eps else gam.
+Hypothesis Hbe : forall l i, Rabs (be l i) <= eta.
+
+Definition rerr (t l i : nat) (y : list bool) : R := rsum (length y) (fun j => D l i j * b2r (nth j y false)) + be l i.
+
+(* the error of a realized row: at most eps per active programmed input, gam per active other input, eta in the bias *)
+Lemma rerr_bound : forall t l i y,
+  Rabs (rerr t l i y) <= eps * INR (ncnt (length y) (fun j => prog (row l i) j && nth j y false))
+                         + gam * INR (ncnt (length y) (fun j => negb (prog (row l i) j) && nth j y false)) + eta.
+Proof.
+  intros t l i y. unfold rerr. pose proof (Hbe l i).
+  pose proof (Rabs_triang (rsum (length y) (fun j => D l i j * b2r (nth j y false))) (be l i)).
+  pose proof (rsum_abs (length y) (fun j => D l i j * b2r (nth j y false))) as H1.
+  assert (H2 : rsum (length y) (fun j => Rabs (D l i j * b2r (nth j y false)))
+               <= rsum (length y) (fun j => (if prog (row l i) j then eps else gam) * b2r (nth j y false))).
+  { apply rsum_le. intros j _. rewrite Rabs_mult. unfold b2r. destruct (nth j y false).
+    - rewrite Rabs_R1, !Rmult_1_r. apply HD.
+    - rewrite Rabs_R0, !Rmult_0_r. lra. }
+  rewrite rsum_cnt in H2. lra.
+Qed.
+
+(* Proposition 6.3 (i): errors whose worst case stays below 1/2 in every row leave every orbit exact *)
+Theorem mismatch_all : length (last Ls []) = n -> Ls <> [] -> 0 <= eps -> 0 <= gam ->
+  (forall l i, (l < length Ls)%nat -> (i < length (nth l Ls []))%nat ->
+     eps * INR (ncnt (win l) (prog (row l i))) + gam * INR (ncnt (win l) (fun j => negb (prog (row l i) j))) + eta < 1/2) ->
+  forall x0, length x0 = n -> forall t, trajp Ls rerr x0 t = orbit Ls x0 t.
+Proof.
+  intros Hlast Hne He Hg H x0 Hx t. apply (traj_ok Ls rerr x0 t); [|lia]. intros t' l i _ Hl Hi. apply no_fail_half.
+  set (y := lin Ls (orbit Ls x0 t') l). pose proof (rerr_bound t' l i y) as B.
+  assert (Hy : length y = win l) by (apply lin_len; [apply orbit_len; assumption | lia]).
+  assert (C : INR (ncnt (length y) (fun j => prog (row l i) j && nth j y false)) * eps
+              + INR (ncnt (length y) (fun j => negb (prog (row l i) j) && nth j y false)) * gam
+              <= INR (ncnt (win l) (prog (row l i))) * eps + INR (ncnt (win l) (fun j => negb (prog (row l i) j))) * gam).
+  { rewrite <- rsum_cnt, <- rsum_cnt1, Hy. apply rsum_le. intros j _. unfold b2r.
+    destruct (prog (row l i) j), (nth j y false); lra. }
+  specialize (H l i Hl Hi). unfold rfail. fold y. lra.
+Qed.
+
+(* Proposition 6.3 (ii): along a run it suffices to bound the active inputs *)
+Theorem mismatch_run : forall x0 T Kst Ast,
+  (forall t l i, (t < T)%nat -> (l < length Ls)%nat -> (i < length (nth l Ls []))%nat ->
+     let y := lin Ls (orbit Ls x0 t) l in
+     (ncnt (length y) (fun j => prog (row l i) j && nth j y false) <= Kst)%nat /\
+     (ncnt (length y) (fun j => negb (prog (row l i) j) && nth j y false) <= Ast)%nat) ->
+  0 <= eps -> 0 <= gam -> eps * INR Kst + gam * INR Ast + eta < 1/2 ->
+  forall t, (t <= T)%nat -> trajp Ls rerr x0 t = orbit Ls x0 t.
+Proof.
+  intros x0 T Kst Ast HK He Hg H. apply traj_ok. intros t l i Ht Hl Hi. apply no_fail_half.
+  destruct (HK t l i Ht Hl Hi) as [K1 A1]. apply le_INR in K1, A1.
+  pose proof (rerr_bound t l i (lin Ls (orbit Ls x0 t) l)) as B.
+  pose proof (Rmult_le_compat_l eps _ _ He K1). pose proof (Rmult_le_compat_l gam _ _ Hg A1). lra.
+Qed.
+
+End Mismatch.
+
+(* ---- the r-fold amplification (Definition 6.6) ----------------------------------------------------------------- *)
+(* rho_r: copy c of the state at positions c n, ..., c n + n - 1 *)
+Definition rep (r : nat) (x : list bool) : list bool := concat (repeat x r).
+
+(* row (c, i) reads every copy of input j with the weight of row i; its bias is r b + (r - 1)/2 *)
+Definition arow (r w : nat) (u : tu) : tu :=
+  TU (Z.of_nat r * tb u + Z.of_nat ((r - 1) / 2))%Z
+     (concat (map (fun c => map (fun p => ((c * w + fst p)%nat, snd p)) (tin u)) (seq 0 r))).
+
+(* copy c of row i at c |L| + i *)
+Definition alayer (r w : nat) (L : list tu) : list tu := concat (repeat (map (arow r w) L) r).
+
+Fixpoint amap (r w : nat) (Ls : list (list tu)) : list (list tu) :=
+  match Ls with [] => [] | L :: t => alayer r w L :: amap r (length L) t end.
+
+Lemma length_rep : forall r x, length (rep r x) = (r * length x)%nat.
+Proof. intros r x. unfold rep. induction r as [|r IH]; [reflexivity|]. cbn [repeat concat]. rewrite length_app, IH. lia. Qed.
+
+Lemma nth_rep : forall r x c j, (c < r)%nat -> (j < length x)%nat -> nth (c * length x + j) (rep r x) false = nth j x false.
+Proof.
+  intros r x c j Hc Hj. unfold rep. revert c Hc. induction r as [|r IH]; intros c Hc; [lia|]. cbn [repeat concat].
+  destruct c as [|c].
+  - rewrite app_nth1 by lia. reflexivity.
+  - rewrite app_nth2 by nia. replace (S c * length x + j - length x)%nat with (c * length x + j)%nat by nia. apply IH. lia.
+Qed.
+
+Lemma wsum_app : forall a b E, wsum (a ++ b) E = (wsum a E + wsum b E)%Z.
+Proof. induction a as [|[i w] t IH]; intros b E; cbn [app wsum]; [reflexivity|]. rewrite IH. lia. Qed.
+
+Lemma wsum_shift : forall ins k E, wsum (map (fun p => ((k + fst p)%nat, snd p)) ins) E = wsum ins (fun j => E (k + j)%nat).
+Proof. induction ins as [|[i w] t IH]; intros k E; cbn [map wsum fst snd]; [reflexivity|]. rewrite IH. reflexivity. Qed.
+
+Definition reads_lt (w : nat) (u : tu) : Prop := forall j z, In (j, z) (tin u) -> (j < w)%nat.
+
+(* Proposition 6.7 (ii): on rho_r(y) the pre-activation of row (c, i) is r z + (r - 1)/2 *)
+Lemma pre_arow : forall r u y, reads_lt (length y) u ->
+  pre (arow r (length y) u) (rep r y) = (Z.of_nat r * pre u y + Z.of_nat ((r - 1) / 2))%Z.
+Proof.
+  intros r u y Hu. unfold pre, arow. cbn [tb tin].
+  assert (G : forall k, (k <= r)%nat -> wsum (concat (map (fun c => map (fun p => ((c * length y + fst p)%nat, snd p)) (tin u)) (seq 0 k)))
+                           (fun i => nth i (rep r y) false) = (Z.of_nat k * wsum (tin u) (fun i => nth i y false))%Z).
+  { induction k as [|k IH]; intro Hk; [reflexivity|]. rewrite seq_S, map_app, concat_app, wsum_app, IH by lia.
+    cbn [map concat]. rewrite app_nil_r, (wsum_shift (tin u) (k * length y)).
+    rewrite (wsum_ext (tin u) (fun j => nth (k * length y + j) (rep r y) false) (fun i => nth i y false)).
+    - rewrite Nat2Z.inj_succ. lia.
+    - intros j z Hin. apply nth_rep; [lia | exact (Hu j z Hin)]. }
+  rewrite G by lia. lia.
+Qed.
+
+Lemma count_shift : forall r y c (ins : list (nat * Z)), (c < r)%nat -> (forall j z, In (j, z) ins -> (j < length y)%nat) ->
+  length (filter (fun p => nth (fst p) (rep r y) false) (map (fun p => ((c * length y + fst p)%nat, snd p)) ins))
+  = length (filter (fun p => nth (fst p) y false) ins).
+Proof.
+  intros r y c ins Hc. induction ins as [|[j z] t IH]; intro H; [reflexivity|]. cbn [map filter fst].
+  rewrite nth_rep by (exact Hc || exact (H j z (or_introl eq_refl))).
+  assert (Ht : forall j' z', In (j', z') t -> (j' < length y)%nat) by (intros j' z' H'; exact (H j' z' (or_intror H'))).
+  destruct (nth j y false); cbn [length]; rewrite (IH Ht); reflexivity.
+Qed.
+
+(* on rho_r(y) the amplified row reads r times as many inputs holding 1 as the row reads on y *)
+Lemma count_arow : forall r u y, reads_lt (length y) u ->
+  length (filter (fun p => nth (fst p) (rep r y) false) (tin (arow r (length y) u)))
+  = (r * length (filter (fun p => nth (fst p) y false) (tin u)))%nat.
+Proof.
+  intros r u y Hu. unfold arow. cbn [tin].
+  assert (C : forall c, (c < r)%nat ->
+    length (filter (fun p => nth (fst p) (rep r y) false) (map (fun p => ((c * length y + fst p)%nat, snd p)) (tin u)))
+    = length (filter (fun p => nth (fst p) y false) (tin u))) by (intros c Hc; apply count_shift; assumption).
+  assert (G : forall k, (k <= r)%nat ->
+    length (filter (fun p => nth (fst p) (rep r y) false)
+                   (concat (map (fun c => map (fun p => ((c * length y + fst p)%nat, snd p)) (tin u)) (seq 0 k))))
+    = (k * length (filter (fun p => nth (fst p) y false) (tin u)))%nat).
+  { induction k as [|k IH]; intro Hk; [reflexivity|]. rewrite seq_S, map_app, concat_app, filter_app, length_app, IH by lia.
+    cbn [map concat Nat.add]. rewrite app_nil_r, C by lia. lia. }
+  apply G. lia.
+Qed.
+
+(* for odd r the amplified row fires exactly when the row does *)
+Lemma odd_sign : forall r z, Nat.odd r = true -> Z.leb 0 (Z.of_nat r * z + Z.of_nat ((r - 1) / 2)) = Z.leb 0 z.
+Proof.
+  intros r z Ho. apply Nat.odd_spec in Ho as (h & ->). replace ((2 * h + 1 - 1) / 2)%nat with h.
+  - destruct (Z.leb_spec 0 z), (Z.leb_spec 0 (Z.of_nat (2 * h + 1) * z + Z.of_nat h)); try reflexivity; nia.
+  - replace (2 * h + 1 - 1)%nat with (h * 2)%nat by lia. rewrite Nat.div_mul by lia. reflexivity.
+Qed.
+
+(* the distance of the amplified pre-activation from the comparator is r times that of the row, at least r/2 *)
+Lemma odd_dist : forall r z, Nat.odd r = true ->
+  Rabs (IZR (Z.of_nat r * z + Z.of_nat ((r - 1) / 2)) + 1/2) = INR r * Rabs (IZR z + 1/2).
+Proof.
+  intros r z Ho. apply Nat.odd_spec in Ho as (h & ->). replace ((2 * h + 1 - 1) / 2)%nat with h.
+  - rewrite plus_IZR, mult_IZR, <- !INR_IZR_INZ. rewrite <- (Rabs_right (INR (2 * h + 1))) at 2 by (apply Rle_ge, pos_INR).
+    rewrite <- Rabs_mult. f_equal. rewrite plus_INR, mult_INR. cbn [INR]. lra.
+  - replace (2 * h + 1 - 1)%nat with (h * 2)%nat by lia. rewrite Nat.div_mul by lia. reflexivity.
+Qed.
+
+Lemma lfire_concat_repeat : forall L r y, lfire (concat (repeat L r)) y = concat (repeat (lfire L y) r).
+Proof.
+  intros L r y. induction r as [|r IH]; [reflexivity|]. cbn [repeat concat]. unfold lfire in *. rewrite map_app, IH. reflexivity.
+Qed.
+
+(* Proposition 6.7 (i), one layer *)
+Lemma lfire_alayer : forall r L y, Nat.odd r = true -> Forall (reads_lt (length y)) L ->
+  lfire (alayer r (length y) L) (rep r y) = rep r (lfire L y).
+Proof.
+  intros r L y Ho HL. unfold alayer, rep. rewrite lfire_concat_repeat. f_equal. f_equal.
+  unfold lfire. rewrite map_map. apply map_ext_in. intros u Hu. unfold fire.
+  change (tb (arow r (length y) u) + wsum (tin (arow r (length y) u)) (fun i => nth i (concat (repeat y r)) false))%Z
+    with (pre (arow r (length y) u) (rep r y)).
+  rewrite pre_arow by (rewrite Forall_forall in HL; exact (HL u Hu)). apply odd_sign. exact Ho.
+Qed.
+
+(* the rows of each layer read only the layer before *)
+Fixpoint lreads (w : nat) (Ls : list (list tu)) : Prop :=
+  match Ls with [] => True | L :: t => Forall (reads_lt w) L /\ lreads (length L) t end.
+
+(* Proposition 6.7 (i): F^(r) o rho_r = rho_r o F *)
+Theorem amap_rep : forall r Ls x, Nat.odd r = true -> lreads (length x) Ls ->
+  lmap (amap r (length x) Ls) (rep r x) = rep r (lmap Ls x).
+Proof.
+  intros r Ls. induction Ls as [|L t IH]; intros x Ho HL; [reflexivity|]. destruct HL as [HL Ht].
+  cbn [amap]. unfold lmap. cbn [fold_left]. rewrite lfire_alayer by assumption. fold (lmap t (rep r (lfire L x))).
+  fold (lmap t (lfire L x)). replace (length L) with (length (lfire L x)) by (unfold lfire; apply length_map).
+  apply IH; [exact Ho|]. unfold lfire. rewrite length_map. exact Ht.
+Qed.
+
+(* ---- Proposition 6.7 (iii): each wrong input copy moves a pre-activation by at most one ------------------------------ *)
+Definition differs (y1 y2 : list bool) (k : nat) : bool := negb (Bool.eqb (nth k y1 false) (nth k y2 false)).
+
+Lemma wsum_diff : forall ins E1 E2, (forall j z, In (j, z) ins -> (z = 1 \/ z = -1)%Z) ->
+  (Z.abs (wsum ins E1 - wsum ins E2) <= Z.of_nat (length (filter (fun p => negb (Bool.eqb (E1 (fst p)) (E2 (fst p)))) ins)))%Z.
+Proof.
+  induction ins as [|[j z] t IH]; intros E1 E2 Hw; cbn [wsum filter fst]; [lia|].
+  specialize (IH E1 E2 (fun j' z' H => Hw j' z' (or_intror H))).
+  destruct (Hw j z (or_introl eq_refl)) as [-> | ->]; destruct (E1 j), (E2 j); cbn [Bool.eqb negb b2z length];
+    rewrite ?Nat2Z.inj_succ; lia.
+Qed.
+
+Lemma ncnt_filter : forall m P, length (filter P (seq 0 m)) = ncnt m P.
+Proof.
+  induction m as [|m IH]; intro P; [reflexivity|]. rewrite seq_S, filter_app, length_app, IH. cbn [filter ncnt Nat.add].
+  destruct (P m); cbn [length]; lia.
+Qed.
+
+Lemma filter_fst : forall (ins : list (nat * Z)) (P : nat -> bool),
+  map fst (filter (fun p => P (fst p)) ins) = filter P (map fst ins).
+Proof. induction ins as [|[j z] t IH]; intro P; [reflexivity|]. cbn [filter map fst]. destruct (P j); cbn [map fst]; rewrite IH; reflexivity. Qed.
+
+(* the positions a row reads, distinct and below m, count at most the positions below m *)
+Lemma filter_pos_le : forall (ins : list (nat * Z)) (P : nat -> bool) m,
+  NoDup (map fst ins) -> (forall j z, In (j, z) ins -> (j < m)%nat) -> (length (filter (fun p => P (fst p)) ins) <= ncnt m P)%nat.
+Proof.
+  intros ins P m Hnd Hlt. rewrite <- ncnt_filter, <- (length_map fst), filter_fst.
+  apply NoDup_incl_length; [apply NoDup_filter; exact Hnd|]. intros j Hj. apply filter_In in Hj as [Hj Pj].
+  apply filter_In. split; [|exact Pj]. apply in_map_iff in Hj as ([j' z] & <- & Hin). apply in_seq. cbn [fst].
+  pose proof (Hlt j' z Hin). lia.
+Qed.
+
+Lemma nodup_shift : forall (l : list nat) k, NoDup l -> NoDup (map (fun j => (k + j)%nat) l).
+Proof.
+  induction l as [|a t IH]; intros k H; cbn [map]; [constructor|]. inversion H as [|? ? Ha Ht]; subst.
+  constructor; [|apply IH; exact Ht]. intro Hin. apply in_map_iff in Hin as (b & E & Hb). assert (b = a) by lia. subst. contradiction.
+Qed.
+
+(* an amplified ternary row reads r w distinct positions with weights -1 or 1 *)
+Lemma arow_ok : forall r w u, rowok w u -> rowok (r * w) (arow r w u).
+Proof.
+  intros r w u [Hnd Hlt]. unfold arow. cbn [tin]. split.
+  - assert (G : forall k, NoDup (map fst (concat (map (fun c => map (fun p => ((c * w + fst p)%nat, snd p)) (tin u)) (seq 0 k))))
+                /\ forall j, In j (map fst (concat (map (fun c => map (fun p => ((c * w + fst p)%nat, snd p)) (tin u)) (seq 0 k)))) ->
+                             (j < k * w)%nat).
+    { induction k as [|k [IHn IHl]]; [split; [constructor | intros j []]|].
+      assert (Ek : map fst (map (fun p => ((k * w + fst p)%nat, snd p)) (tin u)) = map (fun j => (k * w + j)%nat) (map fst (tin u)))
+        by (rewrite !map_map; reflexivity).
+      rewrite seq_S, map_app, concat_app, map_app. cbn [map concat Nat.add]. rewrite app_nil_r, Ek. split.
+      - apply NoDup_app; [exact IHn | apply nodup_shift; exact Hnd|]. intros j H1 H2. apply IHl in H1.
+        apply in_map_iff in H2 as (j' & <- & _). lia.
+      - intros j Hj. apply in_app_or in Hj as [Hj|Hj]; [pose proof (IHl j Hj); nia|].
+        apply in_map_iff in Hj as (j' & <- & Hj'). apply in_map_iff in Hj' as ([j'' z] & <- & Hin).
+        cbn [fst]. pose proof (proj1 (Hlt j'' z Hin)). nia. }
+    exact (proj1 (G r)).
+  - intros j z Hin. apply in_concat in Hin as (l & Hl & Hin). apply in_map_iff in Hl as (c & <- & Hc). apply in_seq in Hc.
+    apply in_map_iff in Hin as ([j' z'] & E & Hin). cbn [fst snd] in E. injection E as <- <-.
+    destruct (Hlt j' z' Hin) as [Hj' Hz]. split; [nia | exact Hz].
+Qed.
+
+Lemma pre_diff : forall r w u y1 y2, rowok w u -> length y1 = (r * w)%nat ->
+  (Z.abs (pre (arow r w u) y1 - pre (arow r w u) y2) <= Z.of_nat (ncnt (r * w) (differs y1 y2)))%Z.
+Proof.
+  intros r w u y1 y2 Hu Hl. destruct (arow_ok r w u Hu) as [Hnd Hlt]. unfold pre.
+  replace (tb (arow r w u) + wsum (tin (arow r w u)) (fun i => nth i y1 false)
+           - (tb (arow r w u) + wsum (tin (arow r w u)) (fun i => nth i y2 false)))%Z
+    with (wsum (tin (arow r w u)) (fun i => nth i y1 false) - wsum (tin (arow r w u)) (fun i => nth i y2 false))%Z by lia.
+  eapply Z.le_trans; [apply wsum_diff; intros j z Hin; exact (proj2 (Hlt j z Hin))|]. apply Nat2Z.inj_le.
+  apply (filter_pos_le (tin (arow r w u)) (differs y1 y2) (r * w)); [exact Hnd | intros j z Hin; exact (proj1 (Hlt j z Hin))].
+Qed.
+
+(* Proposition 6.7 (iii): a row whose inputs carry f < r/2 wrong copies computes its value on rho_r(y) under every
+   perturbation below r/2 - f *)
+Theorem amp_wrong : forall r w u y y' (e : R), Nat.odd r = true -> rowok w u -> length y = w -> length y' = (r * w)%nat ->
+  Rabs e < INR r / 2 - INR (ncnt (r * w) (differs y' (rep r y))) ->
+  H12 (IZR (pre (arow r w u) y') + e) = Z.leb 0 (pre u y).
+Proof.
+  intros r w u y y' e Ho Hu Hy Hy' He.
+  assert (Hr : reads_lt (length y) u) by (intros j z Hin; rewrite Hy; exact (proj1 (proj2 Hu j z Hin))).
+  pose proof (pre_diff r w u y' (rep r y) Hu Hy') as D. subst w.
+  set (z0 := pre (arow r (length y) u) (rep r y)). set (d := (pre (arow r (length y) u) y' - z0)%Z).
+  replace (pre (arow r (length y) u) y') with (z0 + d)%Z by (unfold d; lia).
+  rewrite plus_IZR, Rplus_assoc. rewrite H12_ok.
+  - unfold z0. rewrite pre_arow by exact Hr. apply odd_sign. exact Ho.
+  - apply no_fail. unfold z0. rewrite pre_arow by exact Hr. rewrite odd_dist by exact Ho.
+    pose proof (dist_half (pre u y)). apply IZR_le in D. rewrite abs_IZR, <- INR_IZR_INZ in D.
+    pose proof (Rabs_triang (IZR d) e). pose proof (pos_INR (length (rep r y))).
+    assert (INR r * (1/2) <= INR r * Rabs (IZR (pre u y) + 1/2)) by (apply Rmult_le_compat_l; [apply pos_INR | exact H]).
+    change (pre (arow r (length y) u) y' - pre (arow r (length y) u) (rep r y))%Z with d in D. lra.
+Qed.
+
+(* ---- Theorem 6.8 (i): the amplified map tolerates every perturbation below r/2 ------------------------------------- *)
+Lemma length_concat_repeat : forall (A : Type) (M : list A) k, length (concat (repeat M k)) = (k * length M)%nat.
+Proof. intros A M k. induction k as [|k IH]; [reflexivity|]. cbn [repeat concat]. rewrite length_app, IH. lia. Qed.
+
+Lemma nth_concat_repeat : forall (A : Type) (M : list A) k i d, (i < k * length M)%nat ->
+  nth i (concat (repeat M k)) d = nth (i mod length M) M d.
+Proof.
+  intros A M k. induction k as [|k IH]; intros i d Hi; [lia|]. cbn [repeat concat].
+  assert (HM : length M <> 0%nat) by (intro E; rewrite E in Hi; lia).
+  destruct (Nat.lt_ge_cases i (length M)) as [H|H].
+  - rewrite app_nth1 by exact H. rewrite Nat.mod_small by exact H. reflexivity.
+  - rewrite app_nth2 by exact H. rewrite IH by nia. f_equal.
+    replace i with ((i - length M) + 1 * length M)%nat at 2 by lia. rewrite Nat.Div0.mod_add. reflexivity.
+Qed.
+
+Lemma length_alayer : forall r w L, length (alayer r w L) = (r * length L)%nat.
+Proof. intros r w L. unfold alayer. rewrite length_concat_repeat, length_map. reflexivity. Qed.
+
+Lemma nth_alayer : forall r w L i, (i < r * length L)%nat ->
+  nth i (alayer r w L) tu0 = arow r w (nth (i mod length L) L tu0).
+Proof.
+  intros r w L i Hi. assert (HL : length L <> 0%nat) by (intro E; rewrite E in Hi; lia).
+  unfold alayer. rewrite nth_concat_repeat by (rewrite length_map; exact Hi). rewrite length_map.
+  pose proof (Nat.mod_upper_bound i (length L) HL).
+  rewrite (nth_indep _ _ (arow r w tu0)) by (rewrite length_map; exact H). apply map_nth.
+Qed.
+
+Lemma firstn_amap : forall r w Ls l, firstn l (amap r w Ls) = amap r w (firstn l Ls).
+Proof.
+  intros r w Ls. revert w. induction Ls as [|L t IH]; intros w l; [rewrite !firstn_nil; reflexivity|].
+  destruct l as [|l]; [reflexivity|]. cbn [amap firstn]. rewrite IH. reflexivity.
+Qed.
+
+Lemma lreads_firstn : forall Ls w l, lreads w Ls -> lreads w (firstn l Ls).
+Proof.
+  induction Ls as [|L t IH]; intros w l H; [rewrite firstn_nil; exact I|].
+  destruct l as [|l]; [exact I|]. destruct H as [H1 H2]. cbn [firstn lreads]. split; [exact H1 | apply IH; exact H2].
+Qed.
+
+Lemma lin_amp : forall r Ls x l, Nat.odd r = true -> lreads (length x) Ls ->
+  lin (amap r (length x) Ls) (rep r x) l = rep r (lin Ls x l).
+Proof.
+  intros r Ls x l Ho H. unfold lin. rewrite firstn_amap. apply amap_rep; [exact Ho | apply lreads_firstn; exact H].
+Qed.
+
+Lemma nth_amap : forall r Ls n l, (l < length Ls)%nat -> nth l (amap r n Ls) [] = alayer r (win Ls n l) (nth l Ls []).
+Proof.
+  intros r Ls. induction Ls as [|L t IH]; intros n l Hl; [cbn [length] in Hl; lia|].
+  destruct l as [|l]; [reflexivity|]. cbn [amap nth]. rewrite IH by (cbn [length] in Hl; lia).
+  destruct l as [|l]; reflexivity.
+Qed.
+
+Lemma lin_len' : forall Ls x l, (l <= length Ls)%nat -> length (lin Ls x l) = win Ls (length x) l.
+Proof.
+  intros Ls x l. induction l as [|l IH]; intro Hl; [reflexivity|].
+  unfold lin. rewrite (firstn_snoc _ Ls l []) by lia. rewrite lmap_app. unfold lfire. rewrite length_map. reflexivity.
+Qed.
+
+Lemma lreads_nth : forall Ls w l, lreads w Ls -> (l < length Ls)%nat -> Forall (reads_lt (win Ls w l)) (nth l Ls []).
+Proof.
+  induction Ls as [|L t IH]; intros w l H Hl; [cbn [length] in Hl; lia|]. destruct H as [H1 H2].
+  destruct l as [|l]; [exact H1|]. cbn [nth]. specialize (IH (length L) l H2 ltac:(cbn [length] in Hl; lia)).
+  destruct l as [|l]; exact IH.
+Qed.
+
+Lemma length_amap : forall r w Ls, length (amap r w Ls) = length Ls.
+Proof. intros r w Ls. revert w. induction Ls as [|L t IH]; intro w; [reflexivity|]. cbn [amap length]. rewrite IH. reflexivity. Qed.
+
+Lemma length_nth_amap : forall r Ls n l, (l < length Ls)%nat ->
+  length (nth l (amap r n Ls) []) = (r * length (nth l Ls []))%nat.
+Proof. intros r Ls n l Hl. rewrite nth_amap by exact Hl. apply length_alayer. Qed.
+
+Section Amp.
+Variables (r : nat) (Ls : list (list tu)) (x0 : list bool) (n : nat).
+Hypothesis Ho : Nat.odd r = true.
+Hypothesis Hn : length x0 = n.
+Hypothesis HL : lreads n Ls.
+Hypothesis Hlast : length (last Ls []) = n.
+Hypothesis Hne : Ls <> [].
+
+Lemma orbit_len0 : forall t, length (orbit Ls x0 t) = n.
+Proof. intro t. exact (orbit_len Ls n Hlast Hne x0 t Hn). Qed.
+
+(* the amplified orbit is the replicated orbit *)
+Lemma amp_orbit : forall t, orbit (amap r n Ls) (rep r x0) t = rep r (orbit Ls x0 t).
+Proof.
+  intro t0. induction t0 as [|t0 IH]; [reflexivity|].
+  change (orbit (amap r n Ls) (rep r x0) (S t0)) with (lmap (amap r n Ls) (orbit (amap r n Ls) (rep r x0) t0)).
+  change (orbit Ls x0 (S t0)) with (lmap Ls (orbit Ls x0 t0)).
+  rewrite IH. rewrite <- (orbit_len0 t0) at 1. apply amap_rep; [exact Ho | rewrite orbit_len0; exact HL].
+Qed.
+
+(* row i of layer l of F^(r) at step t of its orbit has pre-activation r z + (r - 1)/2, z that of row i mod |L| of F *)
+Definition zrow (t l i : nat) : Z :=
+  pre (nth (i mod length (nth l Ls [])) (nth l Ls []) tu0) (lin Ls (orbit Ls x0 t) l).
+
+Lemma amp_pre : forall t l i, (l < length Ls)%nat -> (i < length (nth l (amap r n Ls) []))%nat ->
+  pre (nth i (nth l (amap r n Ls) []) tu0) (lin (amap r n Ls) (orbit (amap r n Ls) (rep r x0) t) l)
+  = (Z.of_nat r * zrow t l i + Z.of_nat ((r - 1) / 2))%Z.
+Proof.
+  intros t l i Hl Hi. rewrite amp_orbit.
+  replace (lin (amap r n Ls) (rep r (orbit Ls x0 t)) l) with (rep r (lin Ls (orbit Ls x0 t) l))
+    by (symmetry; rewrite <- (orbit_len0 t); apply lin_amp; [exact Ho | rewrite orbit_len0; exact HL]).
+  rewrite (nth_amap r Ls n l Hl) in Hi |- *. rewrite length_alayer in Hi. rewrite nth_alayer by exact Hi.
+  set (y := lin Ls (orbit Ls x0 t) l).
+  assert (Hy : length y = win Ls n l) by (unfold y; rewrite lin_len' by lia; rewrite orbit_len0; reflexivity).
+  rewrite <- Hy. apply pre_arow. pose proof (lreads_nth Ls n l HL Hl) as F.
+  rewrite Forall_forall in F. rewrite Hy. apply F. apply nth_In. apply Nat.mod_upper_bound.
+  intro E0. rewrite E0 in Hi. lia.
+Qed.
+
+(* its distance from the comparator is r times that of the row of F, at least r/2 *)
+Lemma amp_dist : forall t l i, (l < length Ls)%nat -> (i < length (nth l (amap r n Ls) []))%nat ->
+  Rabs (IZR (pre (nth i (nth l (amap r n Ls) []) tu0) (lin (amap r n Ls) (orbit (amap r n Ls) (rep r x0) t) l)) + 1/2)
+  = INR r * Rabs (IZR (zrow t l i) + 1/2).
+Proof. intros t l i Hl Hi. rewrite amp_pre by assumption. apply odd_dist. exact Ho. Qed.
+
+(* Theorem 6.8 (i): the amplified map tolerates every perturbation below r/2 *)
+Theorem amp_margin : forall E eps, eps < INR r / 2 -> (forall t l i y, Rabs (E t l i y) <= eps) ->
+  forall t, trajp (amap r n Ls) E (rep r x0) t = rep r (orbit Ls x0 t).
+Proof.
+  intros E eps He HE t. rewrite (traj_ok _ E (rep r x0) t); [apply amp_orbit | | lia].
+  intros t' l i _ Hl Hi. rewrite length_amap in Hl. unfold rfail. apply no_fail. rewrite amp_dist by assumption.
+  pose proof (dist_half (zrow t' l i)). specialize (HE t' l i (lin (amap r n Ls) (orbit (amap r n Ls) (rep r x0) t') l)).
+  assert (INR r * (1/2) <= INR r * Rabs (IZR (zrow t' l i) + 1/2)) by (apply Rmult_le_compat_l; [apply pos_INR | exact H]).
+  lra.
+Qed.
+
+End Amp.
+
+(* ---- output flips (Proposition 6.10): every evaluation outputs its value xor a flip --------------------------------- *)
+Definition xorv (x : list bool) (f : nat -> bool) : list bool := map (fun k => xorb (nth k x false) (f k)) (seq 0 (length x)).
+
+Definition lfiref (L : list tu) (f : nat -> bool) (y : list bool) : list bool :=
+  map (fun k => xorb (Z.leb 0 (pre (nth k L tu0) y)) (f k)) (seq 0 (length L)).
+
+Fixpoint lmapf (Ls : list (list tu)) (l : nat) (Fl : nat -> nat -> bool) (y : list bool) : list bool :=
+  match Ls with [] => y | L :: t => lmapf t (S l) Fl (lfiref L (Fl l) y) end.
+
+Fixpoint trajf (Ls : list (list tu)) (Fl : nat -> nat -> nat -> bool) (x0 : list bool) (t : nat) : list bool :=
+  match t with O => x0 | S t' => lmapf Ls 0 (Fl t') (trajf Ls Fl x0 t') end.
+
+(* the state of F^(r) read by majority: bit j is 1 when more than r/2 of its copies are *)
+Definition maj (r n : nat) (x : list bool) : list bool :=
+  map (fun j => Nat.ltb (r / 2) (ncnt r (fun c => nth (c * n + j) x false))) (seq 0 n).
+
+Lemma xorv_false : forall x, xorv x (fun _ => false) = x.
+Proof.
+  intro x. unfold xorv. transitivity (map (fun b : bool => b) x); [|apply map_id].
+  rewrite (map_seq_nth _ _ (fun b : bool => b) x false). apply map_ext. intro k. apply xorb_false_r.
+Qed.
+
+Lemma length_xorv : forall x f, length (xorv x f) = length x.
+Proof. intros x f. unfold xorv. rewrite length_map, length_seq. reflexivity. Qed.
+
+Lemma nth_xorv : forall x f k, (k < length x)%nat -> nth k (xorv x f) false = xorb (nth k x false) (f k).
+Proof.
+  intros x f k Hk. unfold xorv. rewrite nth_map_seq by exact Hk. reflexivity.
+Qed.
+
+Lemma nth_rep_mod : forall r x k, (k < r * length x)%nat -> nth k (rep r x) false = nth (k mod length x) x false.
+Proof. intros r x k Hk. unfold rep. apply nth_concat_repeat. exact Hk. Qed.
+
+(* a ternary row of F^(r) moves by at most one per read input that differs *)
+Lemma pre_diff_read : forall r w u y1 y2, rowok w u ->
+  (Z.abs (pre (arow r w u) y1 - pre (arow r w u) y2) <= Z.of_nat (length (filter (fun p => differs y1 y2 (fst p)) (tin (arow r w u)))))%Z.
+Proof.
+  intros r w u y1 y2 Hu. destruct (arow_ok r w u Hu) as [_ Hlt]. unfold pre.
+  replace (tb (arow r w u) + wsum (tin (arow r w u)) (fun i => nth i y1 false)
+           - (tb (arow r w u) + wsum (tin (arow r w u)) (fun i => nth i y2 false)))%Z
+    with (wsum (tin (arow r w u)) (fun i => nth i y1 false) - wsum (tin (arow r w u)) (fun i => nth i y2 false))%Z by lia.
+  apply wsum_diff. intros j z Hin. exact (proj2 (Hlt j z Hin)).
+Qed.
+
+(* one layer of F^(r) on rho_r(y) with flipped copies psi: if every row reads at most (r - 1)/2 flipped copies, every row
+   computes its value on rho_r(y), and the output is rho_r of the layer of F with the flips of this layer *)
+Lemma layer_flip : forall r w L Y psi f, Nat.odd r = true -> length Y = w -> Forall (rowok w) L ->
+  (forall i, (i < length L)%nat -> (length (filter (fun p => psi (fst p)) (tin (arow r w (nth i L tu0)))) <= r / 2)%nat) ->
+  lfiref (alayer r w L) f (xorv (rep r Y) psi) = xorv (rep r (lfire L Y)) f.
+Proof.
+  intros r w L Y psi f Ho HY HL Hc. unfold lfiref, xorv at 2. rewrite length_alayer, length_rep.
+  replace (length (lfire L Y)) with (length L) by (unfold lfire; rewrite length_map; reflexivity).
+  apply map_ext_in. intros k Hk. apply in_seq in Hk. f_equal.
+  assert (HL0 : length L <> 0%nat) by lia. pose proof (Nat.mod_upper_bound k (length L) HL0) as Hm.
+  set (u := nth (k mod length L) L tu0).
+  assert (Hu : rowok w u) by (rewrite Forall_forall in HL; apply HL; apply nth_In; exact Hm).
+  assert (Hr : reads_lt (length Y) u) by (intros j z Hin; rewrite HY; exact (proj1 (proj2 Hu j z Hin))).
+  rewrite nth_alayer by lia. fold u.
+  rewrite nth_rep_mod by (unfold lfire; rewrite length_map; lia).
+  replace (length (lfire L Y)) with (length L) by (unfold lfire; rewrite length_map; reflexivity).
+  rewrite lfire_seq, nth_map_seq by exact Hm. fold u.
+  (* the pre-activation on the flipped input differs from that on rho_r(y) by at most the flipped copies read *)
+  pose proof (pre_diff_read r w u (xorv (rep r Y) psi) (rep r Y) Hu) as D.
+  destruct (arow_ok r w u Hu) as [_ Hlt].
+  assert (Ecount : length (filter (fun p => differs (xorv (rep r Y) psi) (rep r Y) (fst p)) (tin (arow r w u)))
+                   = length (filter (fun p => psi (fst p)) (tin (arow r w u)))).
+  { f_equal. apply filter_ext_in. intros [q z] Hin. cbn [fst]. destruct (Hlt q z Hin) as [Hq _].
+    unfold differs. rewrite nth_xorv by (rewrite length_rep; lia). destruct (nth q (rep r Y) false), (psi q); reflexivity. }
+  rewrite Ecount in D. pose proof (Hc (k mod length L) Hm) as C. fold u in C.
+  rewrite <- HY in D, C |- *. rewrite pre_arow in D by exact Hr.
+  set (z := pre u Y) in *. set (h := Z.of_nat ((r - 1) / 2)) in *.
+  set (Z1 := pre (arow r (length Y) u) (xorv (rep r Y) psi)) in *.
+  rewrite <- (odd_sign r z Ho). fold h.
+  (* both sides as thresholds of integers that differ by at most (r - 1)/2 < r/2, the distance from the comparator *)
+  apply Nat.odd_spec in Ho as (hh & Er). assert (Hh : (r / 2)%nat = hh) by (rewrite Er; replace (2 * hh + 1)%nat with (1 + hh * 2)%nat by lia;
+                                                                   rewrite Nat.div_add by lia; reflexivity).
+  rewrite Hh in C. apply (Nat2Z.inj_le) in C.
+  assert (Hhh : h = Z.of_nat hh) by (unfold h; rewrite Er; f_equal; replace (2 * hh + 1 - 1)%nat with (hh * 2)%nat by lia;
+                                     rewrite Nat.div_mul by lia; reflexivity).
+  rewrite Hhh in D |- *. assert (Hr' : Z.of_nat r = (2 * Z.of_nat hh + 1)%Z) by lia.
+  rewrite Hr' in D |- *. clear Hr'. apply Z.abs_le in D.
+  destruct (Z.le_gt_cases 0 z) as [Hz|Hz];
+    destruct (Z.leb_spec 0 Z1), (Z.leb_spec 0 ((2 * Z.of_nat hh + 1) * z + Z.of_nat hh)); try reflexivity; nia.
+Qed.
+
+(* the input flips of layer k: psi for the first layer, the flips of layer k - 1 for the others *)
+Definition pin (psi : nat -> bool) (Fl : nat -> nat -> bool) (l0 k : nat) : nat -> bool :=
+  match k with O => psi | S k' => Fl (l0 + k')%nat end.
+
+Lemma map_flip : forall r Ls w Y psi Fl l0, Nat.odd r = true -> length Y = w -> lwf w Ls -> Ls <> [] ->
+  (forall k i, (k < length Ls)%nat -> (i < length (nth k Ls []))%nat ->
+     (length (filter (fun p => pin psi Fl l0 k (fst p)) (tin (arow r (win Ls w k) (nth i (nth k Ls []) tu0)))) <= r / 2)%nat) ->
+  lmapf (amap r w Ls) l0 Fl (xorv (rep r Y) psi) = xorv (rep r (lmap Ls Y)) (Fl (l0 + length Ls - 1)%nat).
+Proof.
+  intros r Ls. induction Ls as [|L t IH]; intros w Y psi Fl l0 Ho HY HL Hne Hc; [contradiction|].
+  destruct HL as [HL1 HL2]. cbn [amap lmapf].
+  rewrite layer_flip; [| exact Ho | exact HY | exact HL1 |].
+  2: { intros i Hi. exact (Hc 0%nat i ltac:(cbn [length]; lia) Hi). }
+  destruct t as [|L' t'].
+  - cbn [amap lmapf length]. replace (l0 + 1 - 1)%nat with l0 by lia. reflexivity.
+  - unfold lmap. cbn [fold_left]. fold (lmap (L' :: t') (lfire L Y)).
+    rewrite (IH (length L) (lfire L Y) (Fl l0) Fl (S l0)); [| exact Ho | unfold lfire; apply length_map | exact HL2 | discriminate |].
+    + f_equal. f_equal. cbn [length]. lia.
+    + intros k i Hk Hi. specialize (Hc (S k) i ltac:(cbn [length] in *; lia) Hi). unfold pin in *.
+      destruct k as [|k]; cbn [win] in *.
+      * rewrite Nat.add_0_r in Hc. exact Hc.
+      * replace (S l0 + k)%nat with (l0 + S k)%nat by lia. exact Hc.
+Qed.
+
+Lemma ncnt_ext : forall k f g, (forall c, (c < k)%nat -> f c = g c) -> ncnt k f = ncnt k g.
+Proof. induction k as [|k IH]; intros f g H; cbn [ncnt]; [reflexivity|]. rewrite (IH f g), (H k) by (lia || (intros; apply H; lia)). reflexivity. Qed.
+
+Lemma ncnt_le : forall k f, (ncnt k f <= k)%nat.
+Proof. induction k as [|k IH]; intro f; cbn [ncnt]; [lia|]. specialize (IH f). destruct (f k); lia. Qed.
+
+Lemma ncnt_xorb : forall k b g, ncnt k (fun c => xorb b (g c)) = if b then (k - ncnt k g)%nat else ncnt k g.
+Proof.
+  induction k as [|k IH]; intros b g; cbn [ncnt]; [destruct b; reflexivity|]. rewrite IH. pose proof (ncnt_le k g).
+  destruct b, (g k); cbn [xorb]; lia.
+Qed.
+
+(* the majority of r copies, of which at most (r - 1)/2 are flipped, is the value *)
+Lemma maj_ok : forall r n X phi, Nat.odd r = true -> length X = n ->
+  (forall j, (j < n)%nat -> (ncnt r (fun c => phi (c * n + j)%nat) <= r / 2)%nat) -> maj r n (xorv (rep r X) phi) = X.
+Proof.
+  intros r n X phi Ho HX H. unfold maj. transitivity (map (fun b : bool => b) X); [|apply map_id].
+  rewrite (map_seq_nth _ _ (fun b : bool => b) X false). rewrite HX. apply map_ext_in. intros j Hj. apply in_seq in Hj.
+  rewrite (ncnt_ext r _ (fun c => xorb (nth j X false) (phi (c * n + j)%nat))).
+  - rewrite ncnt_xorb. specialize (H j ltac:(lia)). pose proof (ncnt_le r (fun c => phi (c * n + j)%nat)).
+    apply Nat.odd_spec in Ho as (hh & ->). replace ((2 * hh + 1) / 2)%nat with hh in *
+      by (replace (2 * hh + 1)%nat with (1 + hh * 2)%nat by lia; rewrite Nat.div_add by lia; reflexivity).
+    destruct (nth j X false); [apply Nat.ltb_lt | apply Nat.ltb_ge]; lia.
+  - intros c Hc. rewrite nth_xorv by (rewrite length_rep, HX; nia). rewrite <- HX. rewrite nth_rep by lia. reflexivity.
+Qed.
+
+(* Proposition 6.10, the deterministic part: if no row of F^(r) reads (r + 1)/2 flipped copies and no state bit has
+   (r + 1)/2 flipped copies in the first T steps, the state read by majority follows the orbit *)
+Theorem flip_ok : forall r Ls x0 n Fl T, Nat.odd r = true -> length x0 = n -> lwf n Ls -> length (last Ls []) = n -> Ls <> [] ->
+  (forall t k i, (t < T)%nat -> (k < length Ls)%nat -> (i < length (nth k Ls []))%nat ->
+     (length (filter (fun p => pin (fun q => match t with O => false | S t' => Fl t' (length Ls - 1)%nat q end) (Fl t) 0 k (fst p))
+                     (tin (arow r (win Ls n k) (nth i (nth k Ls []) tu0)))) <= r / 2)%nat) ->
+  (forall t j, (t < T)%nat -> (j < n)%nat -> (ncnt r (fun c => Fl t (length Ls - 1)%nat (c * n + j)%nat) <= r / 2)%nat) ->
+  forall t, (t <= T)%nat -> maj r n (trajf (amap r n Ls) Fl (rep r x0) t) = orbit Ls x0 t.
+Proof.
+  intros r Ls x0 n Fl T Ho Hx HL Hlast Hne Hc Hs.
+  set (phi := fun t q => match t with O => false | S t' => Fl t' (length Ls - 1)%nat q end).
+  assert (Inv : forall t, (t <= T)%nat -> trajf (amap r n Ls) Fl (rep r x0) t = xorv (rep r (orbit Ls x0 t)) (phi t)).
+  { induction t as [|t IH]; intro Ht.
+    - cbn [trajf orbit Nat.iter]. unfold phi. rewrite xorv_false. reflexivity.
+    - cbn [trajf]. rewrite IH by lia.
+      rewrite <- (orbit_len Ls n Hlast Hne x0 t Hx) at 1.
+      rewrite map_flip; [| exact Ho | reflexivity | rewrite (orbit_len Ls n Hlast Hne x0 t Hx); exact HL | exact Hne |].
+      + reflexivity.
+      + intros k i Hk Hi. rewrite (orbit_len Ls n Hlast Hne x0 t Hx). exact (Hc t k i ltac:(lia) Hk Hi). }
+  intros t Ht. rewrite Inv by exact Ht. apply maj_ok; [exact Ho | apply (orbit_len Ls n Hlast Hne x0 t Hx)|].
+  intros j Hj. destruct t as [|t]; unfold phi.
+  - assert (Z : forall k, ncnt k (fun _ => false) = 0%nat) by (induction k as [|k IHk]; cbn [ncnt]; [reflexivity | rewrite IHk; reflexivity]).
+    rewrite Z. lia.
+  - exact (Hs t j ltac:(lia) Hj).
+Qed.
+
+

rocq/Noise.v

@@ -0,0 +1,957 @@
+(* Section 6, the random part.  The perturbations are random variables X g on a probability space: P is monotone,
+   subadditive, vanishes on the empty event and is 1 on the sure one, multiplies on events that depend on disjoint
+   sets of variables, and is complementary on the events built from the threshold events c <= X g; the product of
+   Gaussian laws with its outer measure is such a space.  On it: the union bound (Proposition 6.4), the profile bound
+   (Proposition 6.5), and fault tolerance by amplification (Theorem 6.8 (ii) and (iii)). *)
+From Stdlib Require Import List Bool Arith ZArith Reals Lia Lra.
+Import ListNotations.
+From TH Require Import TwoHead Net Lev Margin Erfc Choose.
+
+Local Open Scope R_scope.
+
+(* ---- finite sums and products ------------------------------------------------------------------------------------ *)
+Fixpoint rprod (k : nat) (g : nat -> R) : R := match k with O => 1 | S k' => rprod k' g * g k' end.
+
+Lemma rsum_ext : forall k g h, (forall j, (j < k)%nat -> g j = h j) -> rsum k g = rsum k h.
+Proof. induction k as [|k IH]; intros g h H; cbn [rsum]; [reflexivity|]. rewrite (IH g h), (H k); [reflexivity | lia |]. intros j Hj. apply H. lia. Qed.
+
+Lemma rprod_ext : forall k g h, (forall j, (j < k)%nat -> g j = h j) -> rprod k g = rprod k h.
+Proof. induction k as [|k IH]; intros g h H; cbn [rprod]; [reflexivity|]. rewrite (IH g h), (H k); [reflexivity | lia |]. intros j Hj. apply H. lia. Qed.
+
+Lemma rsum_const : forall k c, rsum k (fun _ => c) = INR k * c.
+Proof. induction k as [|k IH]; intro c; cbn [rsum]; [cbn [INR]; lra|]. rewrite IH, S_INR. lra. Qed.
+
+Lemma rsum_nonneg : forall k g, (forall j, (j < k)%nat -> 0 <= g j) -> 0 <= rsum k g.
+Proof. induction k as [|k IH]; intros g H; cbn [rsum]; [lra|]. pose proof (IH g (fun j Hj => H j ltac:(lia))). pose proof (H k ltac:(lia)). lra. Qed.
+
+Lemma rsum_scal : forall k g c, rsum k (fun j => c * g j) = c * rsum k g.
+Proof. induction k as [|k IH]; intros g c; cbn [rsum]; [lra|]. rewrite IH. lra. Qed.
+
+Lemma rsum_plus : forall k g h, rsum k (fun j => g j + h j) = rsum k g + rsum k h.
+Proof. induction k as [|k IH]; intros g h; cbn [rsum]; [lra|]. rewrite IH. lra. Qed.
+
+Lemma rsum_shift : forall k g, rsum (S k) g = g 0%nat + rsum k (fun j => g (S j)).
+Proof. induction k as [|k IH]; intro g; cbn [rsum] in *; [lra|]. rewrite IH. cbn [rsum]. lra. Qed.
+
+Lemma rprod_range : forall k g, (forall j, (j < k)%nat -> 0 <= g j <= 1) -> 0 <= rprod k g <= 1.
+Proof.
+  induction k as [|k IH]; intros g H; cbn [rprod]; [lra|]. destruct (IH g (fun j Hj => H j ltac:(lia))).
+  destruct (H k ltac:(lia)). split; [nra|]. nra.
+Qed.
+
+Lemma rprod_nonneg : forall k g, (forall j, (j < k)%nat -> 0 <= g j) -> 0 <= rprod k g.
+Proof.
+  induction k as [|k IH]; intros g H; cbn [rprod]; [lra|]. pose proof (IH g (fun j Hj => H j ltac:(lia))) as A.
+  pose proof (H k ltac:(lia)) as B. nra.
+Qed.
+
+Lemma rprod_mono : forall k g h, (forall j, (j < k)%nat -> 0 <= g j <= h j) -> rprod k g <= rprod k h.
+Proof.
+  induction k as [|k IH]; intros g h H; cbn [rprod]; [lra|]. pose proof (IH g h (fun j Hj => H j ltac:(lia))) as A.
+  destruct (H k ltac:(lia)) as [B1 B2].
+  pose proof (rprod_nonneg k g (fun j Hj => proj1 (H j ltac:(lia)))) as C. nra.
+Qed.
+
+(* 1 - prod (1 - q_j) <= sum q_j for 0 <= q_j <= 1 *)
+Lemma one_minus_prod : forall k a, (forall j, (j < k)%nat -> 0 <= a j <= 1) -> 1 - rprod k a <= rsum k (fun j => 1 - a j).
+Proof.
+  induction k as [|k IH]; intros a H; cbn [rprod rsum]; [lra|]. pose proof (IH a (fun j Hj => H j ltac:(lia))).
+  destruct (rprod_range k a (fun j Hj => H j ltac:(lia))). destruct (H k ltac:(lia)). nra.
+Qed.
+
+(* the sum over i < r m of f (i mod m) is r times the sum over i < m *)
+Lemma rsum_mod : forall r m f, (0 < m)%nat -> rsum (r * m) (fun i => f (i mod m)) = INR r * rsum m f.
+Proof.
+  induction r as [|r IH]; intros m f Hm; [cbn [Nat.mul rsum INR]; lra|].
+  assert (G : forall k, (k <= m)%nat -> rsum (r * m + k) (fun i => f (i mod m)) = rsum (r * m) (fun i => f (i mod m)) + rsum k f).
+  { induction k as [|k IHk]; intro Hk; [rewrite Nat.add_0_r; cbn [rsum]; lra|].
+    replace (r * m + S k)%nat with (S (r * m + k)) by lia. cbn [rsum]. rewrite IHk by lia.
+    replace ((r * m + k) mod m)%nat with k; [lra|]. symmetry. rewrite Nat.add_comm.
+    rewrite Nat.Div0.mod_add. apply Nat.mod_small. lia. }
+  replace (S r * m)%nat with (r * m + m)%nat by lia. rewrite G by lia. rewrite IH by exact Hm. rewrite S_INR. lra.
+Qed.
+
+(* ---- the probability space ------------------------------------------------------------------------------------------ *)
+Section Space.
+Variable Omega : Type.
+Variable P : (Omega -> Prop) -> R.
+Hypothesis P_mono : forall A B : Omega -> Prop, (forall w, A w -> B w) -> P A <= P B.
+Hypothesis P_or : forall A B : Omega -> Prop, P (fun w => A w \/ B w) <= P A + P B.
+Hypothesis P_empty : P (fun _ => False) = 0.
+Hypothesis P_true : P (fun _ => True) = 1.
+Variable X : nat -> Omega -> R.
+
+(* A depends only on the variables in I *)
+Definition dep (I : nat -> Prop) (A : Omega -> Prop) : Prop :=
+  forall w w', (forall g, I g -> X g w = X g w') -> (A w <-> A w').
+
+Hypothesis P_indep : forall (I J : nat -> Prop) (A B : Omega -> Prop), (forall g, I g -> J g -> False) ->
+  dep I A -> dep J B -> P (fun w => A w /\ B w) = P A * P B.
+
+(* the events built from the threshold events *)
+Inductive meas : (Omega -> Prop) -> Prop :=
+| meas_ge : forall g c, meas (fun w => c <= X g w)
+| meas_not : forall A, meas A -> meas (fun w => ~ A w)
+| meas_and : forall A B, meas A -> meas B -> meas (fun w => A w /\ B w)
+| meas_or : forall A B, meas A -> meas B -> meas (fun w => A w \/ B w)
+| meas_ext : forall A B, meas A -> (forall w, A w <-> B w) -> meas B.
+
+Hypothesis P_compl : forall A, meas A -> P (fun w => ~ A w) = 1 - P A.
+
+Lemma P_ext : forall A B : Omega -> Prop, (forall w, A w <-> B w) -> P A = P B.
+Proof. intros A B H. apply Rle_antisym; apply P_mono; intros w; apply H. Qed.
+
+Lemma P_nonneg : forall A, 0 <= P A.
+Proof. intro A. rewrite <- P_empty. apply P_mono. intros w []. Qed.
+
+Lemma P_le1 : forall A, P A <= 1.
+Proof. intro A. rewrite <- P_true. apply P_mono. intros. exact I. Qed.
+
+(* the union bound over k < n *)
+Lemma P_exists : forall n (A : nat -> Omega -> Prop), P (fun w => exists k, (k < n)%nat /\ A k w) <= rsum n (fun k => P (A k)).
+Proof.
+  induction n as [|n IH]; intro A; cbn [rsum].
+  - rewrite <- P_empty. apply P_mono. intros w (k & Hk & _). lia.
+  - eapply Rle_trans; [|apply Rplus_le_compat_r; apply IH]. eapply Rle_trans; [|apply P_or].
+    apply P_mono. intros w (k & Hk & Ha). destruct (Nat.eq_dec k n) as [->|E]; [right; exact Ha|].
+    left. exists k. split; [lia | exact Ha].
+Qed.
+
+(* independent events multiply *)
+Lemma P_forall : forall n (A : nat -> Omega -> Prop) (Ix : nat -> nat -> Prop),
+  (forall k, dep (Ix k) (A k)) -> (forall k k' g, k <> k' -> Ix k g -> Ix k' g -> False) ->
+  P (fun w => forall k, (k < n)%nat -> A k w) = rprod n (fun k => P (A k)).
+Proof.
+  induction n as [|n IH]; intros A Ix Hd Hdis; cbn [rprod].
+  - rewrite <- P_true. apply P_ext. intro w. split; [intros; exact Logic.I | intros _ k Hk; lia].
+  - rewrite (P_ext _ (fun w => (forall k, (k < n)%nat -> A k w) /\ A n w)).
+    + rewrite (P_indep (fun g => exists k, (k < n)%nat /\ Ix k g) (Ix n)).
+      * rewrite (IH A Ix Hd Hdis). reflexivity.
+      * intros g (k & Hk & Hg) Hg'. exact (Hdis k n g ltac:(lia) Hg Hg').
+      * intros w w' Hww'. split; intros H k Hk; [apply (Hd k w w') | apply (Hd k w w')];
+          try (intros g Hg; apply Hww'; exists k; split; assumption); apply H; exact Hk.
+      * apply Hd.
+    + intro w. split; [intro H; split; [intros k Hk; apply H; lia | apply H; lia]|].
+      intros [H1 H2] k Hk. destruct (Nat.eq_dec k n) as [->|E]; [exact H2 | apply H1; lia].
+Qed.
+
+Lemma meas_false : meas (fun _ => False).
+Proof. apply (meas_ext (fun w => 0 <= X 0%nat w /\ ~ 0 <= X 0%nat w)); [apply meas_and; [apply meas_ge | apply meas_not, meas_ge]|]. tauto. Qed.
+
+Lemma meas_exists : forall n (A : nat -> Omega -> Prop), (forall k, meas (A k)) -> meas (fun w => exists k, (k < n)%nat /\ A k w).
+Proof.
+  induction n as [|n IH]; intros A H.
+  - apply (meas_ext _ _ meas_false). intro w. split; [intros []|intros (k & Hk & _); lia].
+  - apply (meas_ext (fun w => (exists k, (k < n)%nat /\ A k w) \/ A n w)); [apply meas_or; [apply IH; exact H | apply H]|].
+    intro w. split.
+    + intros [(k & Hk & Ha)|Ha]; [exists k; split; [lia | exact Ha] | exists n; split; [lia | exact Ha]].
+    + intros (k & Hk & Ha). destruct (Nat.eq_dec k n) as [->|E]; [right; exact Ha | left; exists k; split; [lia | exact Ha]].
+Qed.
+
+(* ---- a finite search ------------------------------------------------------------------------------------------------- *)
+Lemma search : forall n (A : nat -> Prop), (forall k, A k \/ ~ A k) ->
+  (exists k, (k < n)%nat /\ A k) \/ (forall k, (k < n)%nat -> ~ A k).
+Proof.
+  induction n as [|n IH]; intros A Hd; [right; intros k Hk; lia|].
+  destruct (IH A Hd) as [(k & Hk & Ha)|Hn]; [left; exists k; split; [lia | exact Ha]|].
+  destruct (Hd n) as [Ha|Ha]; [left; exists n; split; [lia | exact Ha]|].
+  right. intros k Hk. destruct (Nat.eq_dec k n) as [->|E]; [exact Ha | apply Hn; lia].
+Qed.
+
+Lemma fails_dec : forall z e, fails z e \/ ~ fails z e.
+Proof.
+  intros z e. unfold fails. destruct (Z_le_dec 0 z) as [Hz|Hz].
+  - destruct (Rlt_dec (IZR z + e) (-1/2)) as [H|H]; [left; left; split; assumption|].
+    right. intros [[_ H']|[H' _]]; [contradiction | lia].
+  - destruct (Rle_dec (-1/2) (IZR z + e)) as [H|H]; [left; right; split; [lia | exact H]|].
+    right. intros [[H' _]|[_ H']]; [lia | contradiction].
+Qed.
+
+(* ---- the trajectories ------------------------------------------------------------------------------------------------- *)
+Section Traj.
+Variable Ls : list (list tu).
+Variable x0 : list bool.
+(* evaluation (t, l, i) is perturbed by the variable gid t l i *)
+Variable gid : nat -> nat -> nat -> nat.
+Hypothesis gid_inj : forall t l i t' l' i', gid t l i = gid t' l' i' -> t = t' /\ l = l' /\ i = i'.
+
+Definition EX (w : Omega) : nat -> nat -> nat -> list bool -> R := fun t l i _ => X (gid t l i) w.
+Definition traj (w : Omega) (t : nat) : list bool := trajp Ls (EX w) x0 t.
+Definition Agree (t : nat) (w : Omega) : Prop := forall t', (t' <= t)%nat -> traj w t' = orbit Ls x0 t'.
+
+Definition nl (l : nat) : nat := length (nth l Ls []).
+Definition Mr : nat := fold_right Nat.add 0%nat (map (@length tu) Ls).
+
+Lemma rsum_rows : forall c, rsum (length Ls) (fun l => INR (nl l) * c) = INR Mr * c.
+Proof.
+  intro c. unfold nl, Mr. clear gid_inj. induction Ls as [|L t IH]; [cbn [rsum length map fold_right INR]; lra|].
+  cbn [length map fold_right]. rewrite rsum_shift. cbn [nth]. rewrite IH, plus_INR. lra.
+Qed.
+
+(* the pre-activation of row i of layer l on the orbit, and the event that the perturbation of step t fails it *)
+Definition zr (t l i : nat) : Z := pre (nth i (nth l Ls []) tu0) (lin Ls (orbit Ls x0 t) l).
+Definition rf (t l i : nat) (w : Omega) : Prop := fails (zr t l i) (X (gid t l i) w).
+
+Lemma rf_dec : forall t l i w, rf t l i w \/ ~ rf t l i w.
+Proof. intros. apply fails_dec. Qed.
+
+Definition Frows (t : nat) (w : Omega) : Prop := exists l, (l < length Ls)%nat /\ exists i, (i < nl l)%nat /\ rf t l i w.
+
+Lemma Frows_dec : forall t w, Frows t w \/ ~ Frows t w.
+Proof.
+  intros t w. destruct (search (length Ls) (fun l => exists i, (i < nl l)%nat /\ rf t l i w)) as [H|H].
+  - intro l. destruct (search (nl l) (fun i => rf t l i w) (fun i => rf_dec t l i w)) as [H'|H']; [left; exact H'|].
+    right. intros (i & Hi & Hr). exact (H' i Hi Hr).
+  - left. exact H.
+  - right. intros (l & Hl & Hx). exact (H l Hl Hx).
+Qed.
+
+(* without a failing row in step t the trajectory takes the step of the orbit *)
+Lemma step_ok : forall t w, Agree t w -> ~ Frows t w -> Agree (S t) w.
+Proof.
+  intros t w Ha Hf t' Ht'. destruct (Nat.eq_dec t' (S t)) as [->|E]; [|apply Ha; lia].
+  unfold traj. cbn [trajp]. fold (traj w t). rewrite (Ha t (le_n t)). cbn [orbit Nat.iter]. fold (orbit Ls x0 t).
+  apply lmapp_ok. intros k i Hk Hi Hr. apply Hf. exists k. split; [exact Hk|]. exists i. split; [exact Hi | exact Hr].
+Qed.
+
+Lemma Agree0 : forall w, Agree 0 w.
+Proof. intros w t' Ht'. assert (t' = 0%nat) by lia. subst. reflexivity. Qed.
+
+Lemma Agree_dec : forall t w, Agree t w \/ ~ Agree t w.
+Proof.
+  intros t w. destruct (search (S t) (fun t' => traj w t' <> orbit Ls x0 t')) as [H|H].
+  - intro t'. destruct (list_eq_dec bool_dec (traj w t') (orbit Ls x0 t')) as [E|E]; [right; intro C; exact (C E) | left; exact E].
+  - right. intro Ha. destruct H as (t' & Ht' & Hn). apply Hn. apply Ha. lia.
+  - left. intros t' Ht'. destruct (list_eq_dec bool_dec (traj w t') (orbit Ls x0 t')) as [E|E]; [exact E|].
+    exfalso. apply (H t' ltac:(lia) E).
+Qed.
+
+(* a trajectory that leaves the orbit within T steps has a failing row in one of them *)
+Lemma dev_rows : forall w T, ~ Agree T w -> exists t, (t < T)%nat /\ Frows t w.
+Proof.
+  intros w T. induction T as [|T IH]; intro Hn; [exfalso; apply Hn; apply Agree0|].
+  destruct (Agree_dec T w) as [Ha|Ha].
+  - destruct (Frows_dec T w) as [Hf|Hf]; [exists T; split; [lia | exact Hf]|].
+    exfalso. apply Hn. apply step_ok; assumption.
+  - destruct (IH Ha) as (t & Ht & Hf). exists t. split; [lia | exact Hf].
+Qed.
+
+(* the union bound over the rows of the first T steps *)
+Theorem union_rows : forall T, P (fun w => ~ Agree T w) <= rsum T (fun t => rsum (length Ls) (fun l => rsum (nl l) (fun i => P (rf t l i)))).
+Proof.
+  intro T.
+  eapply Rle_trans; [apply (P_mono _ (fun w => exists t, (t < T)%nat /\ Frows t w)); intros w Hw; exact (dev_rows w T Hw)|].
+  eapply Rle_trans; [apply P_exists|]. apply rsum_le. intros t Ht.
+  eapply Rle_trans; [apply P_exists|]. apply rsum_le. intros l Hl. apply P_exists.
+Qed.
+
+(* rows at distance at least delta from the comparator fail only under perturbations of size at least delta *)
+Theorem union_bound_dist : forall T delta p,
+  (forall t l i, (l < length Ls)%nat -> (i < nl l)%nat -> delta <= Rabs (IZR (zr t l i) + 1/2)) ->
+  (forall g, P (fun w => delta <= Rabs (X g w)) <= p) ->
+  P (fun w => ~ Agree T w) <= INR T * INR Mr * p.
+Proof.
+  intros T delta p Hd Hp. eapply Rle_trans; [apply union_rows|]. rewrite Rmult_assoc, <- rsum_const. apply rsum_le. intros t Ht.
+  rewrite <- rsum_rows. apply rsum_le. intros l Hl. rewrite <- rsum_const. apply rsum_le. intros i Hi.
+  eapply Rle_trans; [|apply (Hp (gid t l i))]. apply P_mono. intros w Hr.
+  destruct (Rlt_le_dec (Rabs (X (gid t l i) w)) delta) as [Hl'|Hl']; [|exact Hl'].
+  exfalso. apply (no_fail (zr t l i) (X (gid t l i) w)); [pose proof (Hd t l i Hl Hi); lra | exact Hr].
+Qed.
+
+(* Proposition 6.4: P(leaving the orbit within T steps) <= T M p *)
+Theorem union_bound : forall T p, (forall g, P (fun w => 1/2 <= Rabs (X g w)) <= p) ->
+  P (fun w => ~ Agree T w) <= INR T * INR Mr * p.
+Proof. intros T p Hp. apply (union_bound_dist T (1/2) p); [intros; apply dist_half | exact Hp]. Qed.
+
+(* ---- the failures as events ------------------------------------------------------------------------------------------- *)
+Lemma rf_meas : forall t l i, meas (rf t l i).
+Proof.
+  intros t l i. unfold rf, fails. destruct (Z_le_dec 0 (zr t l i)) as [Hz|Hz].
+  - apply (meas_ext (fun w => ~ (-1/2 - IZR (zr t l i) <= X (gid t l i) w))); [apply meas_not, meas_ge|].
+    intro w. split.
+    + intro H. apply Rnot_le_lt in H. left. split; [exact Hz | lra].
+    + intros [[_ H]|[H _]]; [lra | lia].
+  - apply (meas_ext (fun w => -1/2 - IZR (zr t l i) <= X (gid t l i) w)); [apply meas_ge|].
+    intro w. split.
+    + intro H. right. split; [lia | lra].
+    + intros [[H _]|[_ H]]; [lia | lra].
+Qed.
+
+Lemma Frows_meas : forall t, meas (Frows t).
+Proof. intro t. apply meas_exists. intro l. apply meas_exists. intro i. apply rf_meas. Qed.
+
+Definition past (t g : nat) : Prop := exists t' l i, (t' < t)%nat /\ g = gid t' l i.
+Definition now (t g : nat) : Prop := exists l i, g = gid t l i.
+
+Lemma past_now : forall t g, past t g -> now t g -> False.
+Proof. intros t g (t' & l & i & Ht & ->) (l' & i' & E). apply gid_inj in E as (E & _ & _). lia. Qed.
+
+Lemma dep_Agree : forall t, dep (past t) (Agree t).
+Proof.
+  intros t w w' H.
+  assert (E : forall t', (t' <= t)%nat -> traj w t' = traj w' t').
+  { intros t' Ht'. unfold traj. apply trajp_ext. intros t'' l i y Ht'' Hl Hi. unfold EX. apply H.
+    exists t'', l, i. split; [lia | reflexivity]. }
+  split; intros Ha t' Ht'; [rewrite <- E | rewrite E]; try exact Ht'; apply Ha; exact Ht'.
+Qed.
+
+Lemma dep_Frows : forall t, dep (now t) (Frows t).
+Proof.
+  intros t w w' H. unfold Frows, rf.
+  split; intros (l & Hl & i & Hi & Hr); exists l; split; try exact Hl; exists i; split; try exact Hi;
+    [rewrite <- (H (gid t l i)) | rewrite (H (gid t l i))]; try exact Hr; exists l, i; reflexivity.
+Qed.
+
+(* ---- Gaussian perturbations ---------------------------------------------------------------------------------------------- *)
+Variable s : R.
+Hypothesis Hs : 0 < s.
+Hypothesis tail_ge : forall g c, P (fun w => c <= X g w) = Q (c / s).
+Hypothesis tail_le : forall g c, P (fun w => X g w <= c) = Q (- c / s).
+
+(* P(|X g| >= u) <= 2 Q(u/s) = erfc(u / (sqrt 2 s)) *)
+Lemma P_abs : forall g u, 0 <= u -> P (fun w => u <= Rabs (X g w)) <= erfc (u / (sqrt 2 * s)).
+Proof.
+  intros g u Hu. eapply Rle_trans; [apply (P_mono _ (fun w => u <= X g w \/ X g w <= - u))|].
+  - intros w H. destruct (Rle_dec 0 (X g w)) as [H0|H0]; [left; rewrite Rabs_right in H; lra|].
+    right. rewrite Rabs_left in H; lra.
+  - eapply Rle_trans; [apply P_or|]. rewrite tail_ge, tail_le, erfc_Q by exact Hs.
+    replace (- - u / s) with (u / s) by (field; lra). lra.
+Qed.
+
+Theorem union_gauss : forall T, P (fun w => ~ Agree T w) <= INR T * INR Mr * erfc (1 / (2 * sqrt 2 * s)).
+Proof.
+  intro T. apply union_bound. intro g. pose proof sqrt2_pos.
+  replace (1 / (2 * sqrt 2 * s)) with (1/2 / (sqrt 2 * s)) by (field; lra). apply P_abs. lra.
+Qed.
+
+(* the probability that the perturbation of step t fails row i of layer l: Q(d/s), d its distance from -1/2 *)
+Definition qr (t l i : nat) : R := Q (Rabs (IZR (zr t l i) + 1/2) / s).
+
+Lemma P_rf : forall t l i, P (rf t l i) <= qr t l i.
+Proof.
+  intros t l i. unfold rf, qr, fails. destruct (Z_le_dec 0 (zr t l i)) as [Hz|Hz].
+  - pose proof (IZR_le _ _ Hz) as Hz'. rewrite Rabs_right by lra.
+    eapply Rle_trans; [apply (P_mono _ (fun w => X (gid t l i) w <= -1/2 - IZR (zr t l i)))|].
+    + intros w [[_ H]|[H _]]; [lra | lia].
+    + rewrite tail_le. right. f_equal. field. lra.
+  - assert (Hz' : (zr t l i <= -1)%Z) by lia. apply IZR_le in Hz'. rewrite Rabs_left by lra.
+    eapply Rle_trans; [apply (P_mono _ (fun w => -1/2 - IZR (zr t l i) <= X (gid t l i) w))|].
+    + intros w [[H _]|[_ H]]; [lia | lra].
+    + rewrite tail_ge. right. f_equal. field. lra.
+Qed.
+
+Lemma qr_range : forall t l i, 0 <= qr t l i <= 1.
+Proof. intros. apply Q_range. Qed.
+
+(* the profile bound: its product form b' and its sum b *)
+Definition bsumq (t : nat) : R := rsum (length Ls) (fun l => rsum (nl l) (fun i => qr t l i)).
+Definition bprodq (t : nat) : R := 1 - rprod (length Ls) (fun l => rprod (nl l) (fun i => 1 - qr t l i)).
+
+(* Proposition 6.5: given agreement up to step t, step t + 1 leaves the orbit with probability at most b'(t) *)
+Theorem profile_step : forall t, P (fun w => Agree t w /\ ~ Agree (S t) w) <= P (Agree t) * bprodq t.
+Proof.
+  intro t.
+  eapply Rle_trans; [apply (P_mono _ (fun w => Agree t w /\ Frows t w))|].
+  { intros w [Ha Hn]. split; [exact Ha|]. destruct (Frows_dec t w) as [Hf|Hf]; [exact Hf|].
+    exfalso. apply Hn. apply step_ok; assumption. }
+  rewrite (P_indep (past t) (now t)); [| exact (past_now t) | apply dep_Agree | apply dep_Frows].
+  apply Rmult_le_compat_l; [apply P_nonneg|].
+  assert (E : P (Frows t) = 1 - P (fun w => ~ Frows t w)) by (rewrite P_compl by apply Frows_meas; ring).
+  rewrite E. unfold bprodq. apply Rplus_le_compat_l. apply Ropp_le_contravar.
+  rewrite (P_ext (fun w => ~ Frows t w) (fun w => forall l, (l < length Ls)%nat -> (fun l w => forall i, (i < nl l)%nat -> ~ rf t l i w) l w)).
+  2: { intro w. unfold Frows. split.
+       - intros H l Hl i Hi Hr. apply H. exists l. split; [exact Hl|]. exists i. split; assumption.
+       - intros H (l & Hl & i & Hi & Hr). exact (H l Hl i Hi Hr). }
+  rewrite (P_forall (length Ls) (fun l w => forall i, (i < nl l)%nat -> ~ rf t l i w) (fun l g => exists i, g = gid t l i)).
+  - apply rprod_mono. intros l Hl. split.
+    + apply rprod_nonneg. intros i Hi. pose proof (qr_range t l i). lra.
+    + rewrite (P_forall (nl l) (fun i w => ~ rf t l i w) (fun i g => g = gid t l i)).
+      * apply rprod_mono. intros i Hi. pose proof (qr_range t l i). split; [lra|].
+        rewrite P_compl by apply rf_meas. pose proof (P_rf t l i). lra.
+      * intros i w w' H. unfold rf. rewrite (H (gid t l i) eq_refl). reflexivity.
+      * intros i i' g Hne -> Eg. apply gid_inj in Eg as (_ & _ & Eg). contradiction.
+  - intros l w w' H. split; intros H' i Hi Hr; apply (H' i Hi); unfold rf in *.
+    + rewrite (H (gid t l i) (ex_intro _ i eq_refl)). exact Hr.
+    + rewrite <- (H (gid t l i) (ex_intro _ i eq_refl)). exact Hr.
+  - intros l l' g Hne (i & ->) (i' & Eg). apply gid_inj in Eg as (_ & Eg & _). contradiction.
+Qed.
+
+Lemma qr_le : forall t l i, qr t l i <= Q (1 / (2 * s)).
+Proof.
+  intros t l i. unfold qr. apply Q_decr. pose proof (dist_half (zr t l i)).
+  unfold Rdiv. rewrite Rmult_1_l, Rinv_mult. apply Rmult_le_compat_r; [apply Rlt_le, Rinv_0_lt_compat; lra | lra].
+Qed.
+
+(* b'(t) <= b(t) <= M p / 2, p = erfc(1/(2 sqrt 2 s)) *)
+Theorem profile_le : forall t, bprodq t <= bsumq t /\ bsumq t <= INR Mr * (erfc (1 / (2 * sqrt 2 * s)) / 2).
+Proof.
+  intro t. split.
+  - unfold bprodq, bsumq. eapply Rle_trans; [apply one_minus_prod|].
+    + intros l Hl. apply rprod_range. intros i Hi. pose proof (qr_range t l i). lra.
+    + apply rsum_le. intros l Hl. eapply Rle_trans; [apply one_minus_prod|].
+      * intros i Hi. pose proof (qr_range t l i). lra.
+      * right. apply rsum_ext. intros i Hi. ring.
+  - unfold bsumq. rewrite <- rsum_rows. apply rsum_le. intros l Hl. rewrite <- rsum_const. apply rsum_le.
+    intros i Hi. pose proof (qr_le t l i). pose proof sqrt2_pos.
+    replace (erfc (1 / (2 * sqrt 2 * s)) / 2) with (Q (1 / (2 * s))); [lra|].
+    replace (1 / (2 * sqrt 2 * s)) with ((1/2) / (sqrt 2 * s)) by (field; lra). rewrite erfc_Q by exact Hs.
+    replace (1/2 / s) with (1 / (2 * s)) by (field; lra). field.
+Qed.
+
+(* a copy stopped at its first deviation or after K steps deviates with probability at most
+   sum_{t < K} P(it runs past step t) b'(t) *)
+Lemma first_dev : forall K w, ~ Agree K w -> exists t, (t < K)%nat /\ Agree t w /\ ~ Agree (S t) w.
+Proof.
+  induction K as [|K IH]; intros w Hn; [exfalso; apply Hn; apply Agree0|].
+  destruct (Agree_dec K w) as [Ha|Ha]; [exists K; split; [lia | split; assumption]|].
+  destruct (IH w Ha) as (t & Ht & H). exists t. split; [lia | exact H].
+Qed.
+
+Theorem copy_bound : forall K, P (fun w => ~ Agree K w) <= rsum K (fun t => P (Agree t) * bprodq t).
+Proof.
+  intro K. eapply Rle_trans; [apply (P_mono _ (fun w => exists t, (t < K)%nat /\ (Agree t w /\ ~ Agree (S t) w)))|].
+  - intros w Hn. exact (first_dev K w Hn).
+  - eapply Rle_trans; [apply P_exists|]. apply rsum_le. intros t Ht. apply profile_step.
+Qed.
+
+(* the union bound summed over the profile *)
+Theorem union_profile : forall T, P (fun w => ~ Agree T w) <= rsum T bsumq.
+Proof.
+  intro T. eapply Rle_trans; [apply union_rows|]. apply rsum_le. intros t Ht. apply rsum_le. intros l Hl.
+  apply rsum_le. intros i Hi. apply P_rf.
+Qed.
+
+End Traj.
+
+(* ---- Theorem 6.8 (ii): the amplified map ---------------------------------------------------------------------------- *)
+Lemma Mr_amap : forall r n Ls, Mr (amap r n Ls) = (r * Mr Ls)%nat.
+Proof.
+  intros r n Ls. revert n. unfold Mr. induction Ls as [|L t IH]; intro n; [cbn; lia|]. cbn [amap map fold_right].
+  rewrite (IH (length L)), length_alayer. lia.
+Qed.
+
+Section AmpNoise.
+Variables (r : nat) (Ls : list (list tu)) (x0 : list bool) (n : nat).
+Variable gid : nat -> nat -> nat -> nat.
+Hypothesis gid_inj : forall t l i t' l' i', gid t l i = gid t' l' i' -> t = t' /\ l = l' /\ i = i'.
+Hypothesis Ho : Nat.odd r = true.
+Hypothesis Hn : length x0 = n.
+Hypothesis HL : lreads n Ls.
+Hypothesis Hlast : length (last Ls []) = n.
+Hypothesis Hne : Ls <> [].
+
+Lemma amp_zr : forall t l i, (l < length (amap r n Ls))%nat -> (i < nl (amap r n Ls) l)%nat ->
+  Rabs (IZR (zr (amap r n Ls) (rep r x0) t l i) + 1/2) = INR r * Rabs (IZR (zr Ls x0 t l (i mod nl Ls l)) + 1/2).
+Proof.
+  intros t l i Hl Hi. rewrite length_amap in Hl. unfold zr. apply (amp_dist r Ls x0 n Ho Hn HL Hlast Hne t l i Hl Hi).
+Qed.
+
+(* every row of F^(r) sits at distance at least r/2 from the comparator along the replicated orbit *)
+Theorem amp_union : forall T phi, (forall g, P (fun w => INR r / 2 <= Rabs (X g w)) <= phi) ->
+  P (fun w => ~ Agree (amap r n Ls) (rep r x0) gid T w) <= INR T * INR r * INR (Mr Ls) * phi.
+Proof.
+  intros T phi Hp. rewrite Rmult_assoc with (r1 := INR T), <- mult_INR, <- (Mr_amap r n Ls).
+  apply (union_bound_dist (amap r n Ls) (rep r x0) gid T (INR r / 2) phi); [|exact Hp].
+  intros t l i Hl Hi. rewrite amp_zr by assumption. pose proof (dist_half (zr Ls x0 t l (i mod nl Ls l))).
+  pose proof (pos_INR r). nra.
+Qed.
+
+Variable s : R.
+Hypothesis Hs : 0 < s.
+Hypothesis tail_ge : forall g c, P (fun w => c <= X g w) = Q (c / s).
+Hypothesis tail_le : forall g c, P (fun w => X g w <= c) = Q (- c / s).
+
+(* P(leaving rho_r of the orbit within T steps) <= T r M erfc(r / (2 sqrt 2 s)) *)
+Theorem amp_gauss : forall T, P (fun w => ~ Agree (amap r n Ls) (rep r x0) gid T w)
+  <= INR T * INR r * INR (Mr Ls) * erfc (INR r / (2 * sqrt 2 * s)).
+Proof.
+  intro T. apply amp_union. intro g. pose proof sqrt2_pos. pose proof (pos_INR r).
+  replace (INR r / (2 * sqrt 2 * s)) with (INR r / 2 / (sqrt 2 * s)) by (field; lra).
+  apply (P_abs s Hs tail_ge tail_le). lra.
+Qed.
+
+(* and at most r sum_t sum_i Q(r d_{t,i} / s) over the profile of F *)
+Theorem amp_profile : forall T, P (fun w => ~ Agree (amap r n Ls) (rep r x0) gid T w)
+  <= INR r * rsum T (fun t => rsum (length Ls) (fun l => rsum (nl Ls l) (fun i =>
+                      Q (INR r * Rabs (IZR (zr Ls x0 t l i) + 1/2) / s)))).
+Proof.
+  intro T. eapply Rle_trans; [apply (union_profile (amap r n Ls) (rep r x0) gid s Hs tail_ge tail_le)|].
+  rewrite <- rsum_scal. apply rsum_le. intros t Ht. unfold bsumq. rewrite length_amap, <- rsum_scal.
+  apply rsum_le. intros l Hl.
+  assert (Hnl : nl (amap r n Ls) l = (r * nl Ls l)%nat) by (unfold nl; apply length_nth_amap; exact Hl).
+  rewrite Hnl. destruct (Nat.eq_dec (nl Ls l) 0) as [Z|Z]; [rewrite Z, Nat.mul_0_r; cbn [rsum]; lra|].
+  set (f := fun i' => Q (INR r * Rabs (IZR (zr Ls x0 t l i') + 1/2) / s)).
+  rewrite (rsum_ext (r * nl Ls l) _ (fun i => f (i mod nl Ls l))).
+  - rewrite (rsum_mod r (nl Ls l) f) by lia. lra.
+  - intros i Hi. unfold qr, f. rewrite amp_zr; [reflexivity | rewrite length_amap; exact Hl | rewrite Hnl; exact Hi].
+Qed.
+
+End AmpNoise.
+
+(* ---- the union bound for perturbations that depend on the input ---------------------------------------------------- *)
+Section Gen.
+Variable Ls : list (list tu).
+Variable x0 : list bool.
+Variable EW : Omega -> nat -> nat -> nat -> list bool -> R.
+
+Definition trajw (w : Omega) (t : nat) : list bool := trajp Ls (EW w) x0 t.
+Definition Agreew (T : nat) (w : Omega) : Prop := forall t, (t <= T)%nat -> trajw w t = orbit Ls x0 t.
+
+Theorem union_gen : forall T, P (fun w => ~ Agreew T w)
+  <= rsum T (fun t => rsum (length Ls) (fun l => rsum (nl Ls l) (fun i => P (fun w => rfail Ls (EW w) x0 t l i)))).
+Proof.
+  intro T. eapply Rle_trans; [apply (P_mono _ (fun w => exists t, (t < T)%nat /\ exists l, (l < length Ls)%nat /\
+                                                exists i, (i < nl Ls l)%nat /\ rfail Ls (EW w) x0 t l i))|].
+  - intros w Hn.
+    destruct (search T (fun t => exists l, (l < length Ls)%nat /\ exists i, (i < nl Ls l)%nat /\ rfail Ls (EW w) x0 t l i))
+      as [H|H]; [| exact H |].
+    + intro t. destruct (search (length Ls) (fun l => exists i, (i < nl Ls l)%nat /\ rfail Ls (EW w) x0 t l i)) as [H1|H1].
+      * intro l. destruct (search (nl Ls l) (fun i => rfail Ls (EW w) x0 t l i)) as [H2|H2];
+          [intro i; apply fails_dec | left; exact H2 | right; intros (i & Hi & Hr); exact (H2 i Hi Hr)].
+      * left; exact H1.
+      * right; intros (l & Hl & Hx); exact (H1 l Hl Hx).
+    + exfalso. apply Hn. intros t Ht. apply (traj_ok Ls (EW w) x0 T); [|exact Ht].
+      intros t' l i Ht' Hl Hi Hr. apply (H t' Ht'). exists l. split; [exact Hl|]. exists i. split; [exact Hi | exact Hr].
+  - eapply Rle_trans; [apply P_exists|]. apply rsum_le. intros t Ht.
+    eapply Rle_trans; [apply P_exists|]. apply rsum_le. intros l Hl. apply P_exists.
+Qed.
+
+End Gen.
+
+(* ---- Corollary 6.9: noise on every synapse of F^(r) ------------------------------------------------------------------- *)
+Lemma length_filter_map : forall (A B : Type) (g : B -> bool) (h : A -> B) (L : list A),
+  length (filter g (map h L)) = length (filter (fun x => g (h x)) L).
+Proof. intros A B g h L. induction L as [|a t IH]; [reflexivity|]. cbn [map filter]. destruct (g (h a)); cbn [length]; rewrite IH; reflexivity. Qed.
+
+Lemma len_filter_idx : forall (A : Type) (f : A -> bool) (l : list A) d,
+  length (filter (fun k => f (nth k l d)) (seq 0 (length l))) = length (filter f l).
+Proof.
+  intros A f l d. induction l as [|a t IH]; [reflexivity|]. cbn [length seq filter nth].
+  rewrite <- seq_shift. destruct (f a); cbn [length]; rewrite length_filter_map; cbn [nth]; rewrite IH; reflexivity.
+Qed.
+
+Lemma nodup_map_inj : forall (A B : Type) (f : A -> B) (l : list A),
+  (forall x y, In x l -> In y l -> f x = f y -> x = y) -> NoDup l -> NoDup (map f l).
+Proof.
+  intros A B f l. induction l as [|a t IH]; intros Hi Hn; cbn [map]; [constructor|]. inversion Hn as [|? ? Ha Ht]; subst.
+  constructor.
+  - intro Hin. apply in_map_iff in Hin as (b & E & Hb). apply Ha. rewrite (Hi a b (or_introl eq_refl) (or_intror Hb) (eq_sym E)). exact Hb.
+  - apply IH; [intros x y Hx Hy E; apply Hi; [right; exact Hx | right; exact Hy | exact E] | exact Ht].
+Qed.
+
+Section Synapse.
+Variables (r : nat) (Ls : list (list tu)) (x0 : list bool) (n : nat).
+Hypothesis Ho : Nat.odd r = true.
+Hypothesis Hn : length x0 = n.
+Hypothesis HL : lreads n Ls.
+Hypothesis Hlast : length (last Ls []) = n.
+Hypothesis Hne : Ls <> [].
+
+(* the error of synapse k of row i of layer l of F^(r) at step t is the variable sid t l i k *)
+Variable sid : nat -> nat -> nat -> nat -> nat.
+Hypothesis sid_inj : forall t l i k t' l' i' k', sid t l i k = sid t' l' i' k' -> t = t' /\ l = l' /\ i = i' /\ k = k'.
+
+Definition arow_at (l i : nat) : tu := nth i (nth l (amap r n Ls) []) tu0.
+
+(* the inputs of the row that hold 1, by their position in its list *)
+Definition active (l i : nat) (y : list bool) : list nat :=
+  filter (fun k => nth (fst (nth k (tin (arow_at l i)) (0%nat, 0%Z))) y false) (seq 0 (length (tin (arow_at l i)))).
+
+(* the realized row reads each of its programmed inputs with weight w + e, so its error is the sum of the e at the
+   inputs that hold 1 *)
+Definition ES (w : Omega) (t l i : nat) (y : list bool) : R := fold_right Rplus 0 (map (fun k => X (sid t l i k) w) (active l i y)).
+
+Variable sw : R.
+Hypothesis Hsw : 0 < sw.
+(* a sum of m independent centred Gaussians of deviation sw is a centred Gaussian of deviation sw sqrt m *)
+Hypothesis sum_ge : forall S c, NoDup S -> (1 <= length S)%nat ->
+  P (fun w => c <= fold_right Rplus 0 (map (fun g => X g w) S)) = Q (c / (sw * sqrt (INR (length S)))).
+Hypothesis sum_le : forall S c, NoDup S -> (1 <= length S)%nat ->
+  P (fun w => fold_right Rplus 0 (map (fun g => X g w) S) <= c) = Q (- c / (sw * sqrt (INR (length S)))).
+
+Variables (T Kst : nat).
+Hypothesis HKst : (1 <= Kst)%nat.
+(* every row of F reads at most Kst inputs holding 1 along the first T steps of the orbit *)
+Hypothesis HK : forall t l i, (t < T)%nat -> (l < length Ls)%nat -> (i < nl Ls l)%nat ->
+  (length (filter (fun p => nth (fst p) (lin Ls (orbit Ls x0 t) l) false) (tin (nth i (nth l Ls []) tu0))) <= Kst)%nat.
+
+Lemma active_len : forall l i y, length (active l i y) = length (filter (fun p => nth (fst p) y false) (tin (arow_at l i))).
+Proof. intros l i y. unfold active. exact (len_filter_idx _ (fun p => nth (fst p) y false) (tin (arow_at l i)) (0%nat, 0%Z)). Qed.
+
+Lemma active_nodup : forall t l i y, NoDup (map (sid t l i) (active l i y)).
+Proof.
+  intros t l i y. apply nodup_map_inj; [|apply NoDup_filter, seq_NoDup].
+  intros k k' _ _ E. apply sid_inj in E. tauto.
+Qed.
+
+(* a sum of m >= 1 of the errors exceeds u in absolute value with probability at most erfc(u / (sqrt 2 sw sqrt m)) *)
+Lemma P_ES : forall t l i y u, 0 <= u -> (1 <= length (active l i y))%nat ->
+  P (fun w => u <= Rabs (ES w t l i y)) <= erfc (u / (sqrt 2 * (sw * sqrt (INR (length (active l i y)))))).
+Proof.
+  intros t l i y u Hu Hm. set (S := map (sid t l i) (active l i y)).
+  assert (HS : forall w, ES w t l i y = fold_right Rplus 0 (map (fun g => X g w) S)) by (intro w; unfold ES, S; rewrite map_map; reflexivity).
+  assert (Hl : length S = length (active l i y)) by (unfold S; apply length_map).
+  assert (Hsq : 0 < sqrt (INR (length S))) by (apply sqrt_lt_R0; apply lt_0_INR; lia).
+  eapply Rle_trans; [apply (P_mono _ (fun w => u <= fold_right Rplus 0 (map (fun g => X g w) S) \/
+                                                fold_right Rplus 0 (map (fun g => X g w) S) <= - u))|].
+  - intros w H. rewrite HS in H. destruct (Rle_dec 0 (fold_right Rplus 0 (map (fun g => X g w) S))) as [H0|H0];
+      [left; rewrite Rabs_right in H; lra | right; rewrite Rabs_left in H; lra].
+  - eapply Rle_trans; [apply P_or|]. rewrite sum_ge, sum_le by (apply active_nodup || lia). rewrite Hl in *.
+    set (sg := sw * sqrt (INR (length (active l i y)))).
+    assert (Hsg : 0 < sg) by (unfold sg; apply Rmult_lt_0_compat; [exact Hsw | exact Hsq]).
+    rewrite erfc_Q by exact Hsg. replace (- - u / sg) with (u / sg) by (field; lra). lra.
+Qed.
+
+Lemma ES_nil : forall w t l i y, length (active l i y) = 0%nat -> ES w t l i y = 0.
+Proof. intros w t l i y H. unfold ES. destruct (active l i y); [reflexivity | discriminate]. Qed.
+
+(* Corollary 6.9: P(leaving rho_r of the orbit within T steps) <= T r M erfc(sqrt r / (2 sqrt (2 Kst) sw)) *)
+Theorem synapse_bound : P (fun w => ~ Agreew (amap r n Ls) (rep r x0) ES T w)
+  <= INR T * INR r * INR (Mr Ls) * erfc (sqrt (INR r) / (2 * sqrt (2 * INR Kst) * sw)).
+Proof.
+  set (Bd := erfc (sqrt (INR r) / (2 * sqrt (2 * INR Kst) * sw))).
+  assert (Hr : (1 <= r)%nat) by (destruct r; [discriminate | lia]).
+  eapply Rle_trans; [apply union_gen|].
+  rewrite Rmult_assoc with (r1 := INR T), <- mult_INR, <- (Mr_amap r n Ls), Rmult_assoc, <- rsum_const.
+  apply rsum_le. intros t Ht. rewrite <- rsum_rows. rewrite length_amap. apply rsum_le. intros l Hl.
+  rewrite <- rsum_const. apply rsum_le. intros i Hi.
+  assert (Hi' : (i < length (nth l (amap r n Ls) []))%nat) by exact Hi.
+  (* the input of the row on the orbit of F^(r) is rho_r of the input of row i mod |L| on the orbit of F *)
+  set (y := lin Ls (orbit Ls x0 t) l).
+  assert (EY : lin (amap r n Ls) (orbit (amap r n Ls) (rep r x0) t) l = rep r y).
+  { rewrite (amp_orbit r Ls x0 n Ho Hn HL Hlast Hne). unfold y.
+    rewrite <- (orbit_len0 Ls x0 n Hn Hlast Hne t) at 1. apply lin_amp; [exact Ho|].
+    rewrite (orbit_len0 Ls x0 n Hn Hlast Hne). exact HL. }
+  assert (Hy : length y = win Ls n l) by (unfold y; rewrite lin_len' by lia; rewrite (orbit_len0 Ls x0 n Hn Hlast Hne); reflexivity).
+  assert (Hnl : (0 < nl Ls l)%nat) by (unfold nl; rewrite (length_nth_amap r Ls n l Hl) in Hi'; destruct (length (nth l Ls [])); lia).
+  set (u0 := nth (i mod nl Ls l) (nth l Ls []) tu0).
+  assert (Hrow : arow_at l i = arow r (length y) u0).
+  { unfold arow_at, u0. rewrite (nth_amap r Ls n l Hl). rewrite nth_alayer; [rewrite Hy; reflexivity|].
+    rewrite (length_nth_amap r Ls n l Hl) in Hi'. exact Hi'. }
+  assert (Hu0 : reads_lt (length y) u0).
+  { pose proof (lreads_nth Ls n l HL Hl) as F. rewrite Forall_forall in F. rewrite Hy. apply F. apply nth_In.
+    apply Nat.mod_upper_bound. unfold nl in *. lia. }
+  (* the number of inputs holding 1 *)
+  assert (Hm : (length (active l i (rep r y)) <= r * Kst)%nat).
+  { rewrite active_len, Hrow, count_arow by exact Hu0. apply Nat.mul_le_mono_l. apply HK; [exact Ht | exact Hl |].
+    apply Nat.mod_upper_bound. lia. }
+  (* the distance of the row from the comparator *)
+  assert (Hd : INR r / 2 <= Rabs (IZR (pre (arow_at l i) (rep r y)) + 1/2)).
+  { unfold arow_at. rewrite <- EY. rewrite (amp_dist r Ls x0 n Ho Hn HL Hlast Hne t l i Hl Hi').
+    pose proof (dist_half (zrow Ls x0 t l i)). pose proof (pos_INR r). nra. }
+  unfold rfail. fold (arow_at l i). rewrite EY.
+  destruct (Nat.eq_dec (length (active l i (rep r y))) 0) as [Z|Z].
+  - eapply Rle_trans; [apply (P_mono _ (fun _ => False))|].
+    + intros w Hf. apply (no_fail (pre (arow_at l i) (rep r y)) (ES w t l i (rep r y))); [|exact Hf].
+      rewrite ES_nil by exact Z. rewrite Rabs_R0. pose proof (pos_INR r). assert (0 < INR r) by (apply lt_0_INR; lia). lra.
+    + rewrite P_empty. unfold Bd. apply erfc_range.
+  - eapply Rle_trans; [apply (P_mono _ (fun w => INR r / 2 <= Rabs (ES w t l i (rep r y))))|].
+    + intros w Hf. destruct (Rlt_le_dec (Rabs (ES w t l i (rep r y))) (INR r / 2)) as [Hlt|Hge]; [|exact Hge].
+      exfalso. apply (no_fail (pre (arow_at l i) (rep r y)) (ES w t l i (rep r y))); [lra | exact Hf].
+    + eapply Rle_trans; [apply P_ES; [pose proof (pos_INR r); lra | lia]|]. unfold Bd. apply erfc_decr.
+      (* sqrt r / (2 sqrt (2 K) sw) <= (r/2) / (sqrt 2 sw sqrt m) as m <= r K *)
+      set (m := length (active l i (rep r y))). assert (Hm0 : (1 <= m)%nat) by lia.
+      pose proof sqrt2_pos. assert (HR : 0 < INR r) by (apply lt_0_INR; lia). assert (HK0 : 0 < INR Kst) by (apply lt_0_INR; lia).
+      assert (HM0 : 0 < INR m) by (apply lt_0_INR; lia).
+      assert (Hmr : INR m <= INR r * INR Kst) by (rewrite <- mult_INR; apply le_INR; exact Hm).
+      assert (Hsm : sqrt (INR m) <= sqrt (INR r) * sqrt (INR Kst)) by (rewrite <- sqrt_mult by lra; apply sqrt_le_1_alt; exact Hmr).
+      pose proof (sqrt_lt_R0 _ HR) as Sr. pose proof (sqrt_lt_R0 _ HK0) as Sk. pose proof (sqrt_lt_R0 _ HM0) as Sm.
+      rewrite sqrt_mult by lra. rewrite <- (sqrt_sqrt (INR r)) at 2 by lra.
+      set (a := sqrt (INR r)) in *. set (k := sqrt (INR Kst)) in *. set (mm := sqrt (INR m)) in *. set (q := sqrt 2) in *.
+      assert (Eq : a * a / 2 / (q * (sw * mm)) - a / (2 * (q * k) * sw) = a * (a * k - mm) / (2 * q * sw * mm * k)).
+      { field. repeat split; apply Rgt_not_eq; assumption. }
+      assert (0 <= a * (a * k - mm) / (2 * q * sw * mm * k)).
+      { apply Rmult_le_pos; [apply Rmult_le_pos; lra|]. apply Rlt_le, Rinv_0_lt_compat.
+        repeat apply Rmult_lt_0_compat; lra. }
+      lra.
+Qed.
+
+End Synapse.
+
+(* ---- Proposition 6.10: output flips ------------------------------------------------------------------------------------ *)
+Lemma P_exists_list : forall (T0 : Type) (cs : list T0) (A : T0 -> Omega -> Prop),
+  P (fun w => exists c, In c cs /\ A c w) <= fold_right Rplus 0 (map (fun c => P (A c)) cs).
+Proof.
+  intros T0 cs A. induction cs as [|c cs IH]; cbn [map fold_right].
+  - rewrite <- P_empty. apply P_mono. intros w (c & [] & _).
+  - eapply Rle_trans; [|apply Rplus_le_compat_l; exact IH]. eapply Rle_trans; [|apply P_or].
+    apply P_mono. intros w (c' & [<-|Hc] & Ha); [left; exact Ha | right; exists c'; split; assumption].
+Qed.
+
+Lemma P_forall_list : forall (gs : list nat) (A : nat -> Omega -> Prop), NoDup gs -> (forall g, dep (fun g' => g' = g) (A g)) ->
+  P (fun w => forall g, In g gs -> A g w) = fold_right Rmult 1 (map (fun g => P (A g)) gs).
+Proof.
+  intros gs A. induction gs as [|g gs IH]; intros Hn Hd; cbn [map fold_right].
+  - rewrite <- P_true. apply P_ext. intro w. split; [intros; exact Logic.I | intros _ g []].
+  - inversion Hn as [|? ? Hg Hgs]; subst.
+    rewrite (P_ext _ (fun w => A g w /\ (forall g', In g' gs -> A g' w))).
+    + rewrite (P_indep (fun g' => g' = g) (fun g' => In g' gs)).
+      * rewrite IH by assumption. reflexivity.
+      * intros g' -> Hin. exact (Hg Hin).
+      * apply Hd.
+      * intros w w' H. split; intros H' g' Hg'; [apply (Hd g' w w') | apply (Hd g' w w')];
+          try (intros g'' ->; apply H; exact Hg'); apply H'; exact Hg'.
+    + intro w. split; [intro H; split; [apply H; left; reflexivity | intros g' Hg'; apply H; right; exact Hg']|].
+      intros [H1 H2] g' [<-|Hg']; [exact H1 | exact (H2 g' Hg')].
+Qed.
+
+Lemma fold_mult_le : forall (gs : list nat) (f : nat -> R) eps, (forall g, 0 <= f g <= eps) ->
+  fold_right Rmult 1 (map f gs) <= eps ^ length gs.
+Proof.
+  intros gs f eps H. induction gs as [|g gs IH]; cbn [map fold_right length pow]; [lra|].
+  destruct (H g). assert (0 <= fold_right Rmult 1 (map f gs)).
+  { clear IH. induction gs as [|g' gs IH']; cbn [map fold_right]; [lra|]. destruct (H g'). nra. }
+  apply Rmult_le_compat; assumption.
+Qed.
+
+(* at least j of the independent events A g, g in gs, each of probability at most eps: probability at most C(|gs|, j) eps^j *)
+Lemma P_atleast : forall (gs : list nat) (A : nat -> Omega -> Prop) (Ab : Omega -> nat -> bool) j eps,
+  NoDup gs -> (forall g w, Ab w g = true <-> A g w) -> (forall g, dep (fun g' => g' = g) (A g)) ->
+  (forall g, P (A g) <= eps) -> 0 <= eps ->
+  P (fun w => (j <= length (filter (Ab w) gs))%nat) <= INR (binom (length gs) j) * eps ^ j.
+Proof.
+  intros gs A Ab j eps Hn HA Hd Hp He.
+  eapply Rle_trans; [apply (P_mono _ (fun w => exists c, In c (choose j gs) /\ (forall g, In g c -> A g w)))|].
+  - intros w Hw. destruct (choose_spec _ (Ab w) gs j Hw) as (c & Hc & Hf). exists c. split; [exact Hc|].
+    intros g Hg. apply HA. exact (Hf g Hg).
+  - eapply Rle_trans; [apply P_exists_list|]. rewrite <- length_choose.
+    assert (G : forall cs, (forall c, In c cs -> In c (choose j gs)) ->
+              fold_right Rplus 0 (map (fun c => P (fun w => forall g, In g c -> A g w)) cs) <= INR (length cs) * eps ^ j).
+    { induction cs as [|c cs IH]; intro Hcs; cbn [map fold_right length]; [cbn [INR]; lra|].
+      rewrite S_INR. assert (Hc : In c (choose j gs)) by (apply Hcs; left; reflexivity).
+      rewrite P_forall_list; [| exact (choose_nodup _ gs j c Hn Hc) | exact Hd].
+      pose proof (fold_mult_le c (fun g => P (A g)) eps (fun g => conj (P_nonneg (A g)) (Hp g))) as F.
+      rewrite (choose_length _ gs j c Hc) in F.
+      pose proof (IH (fun c' Hc' => Hcs c' (or_intror Hc'))). lra. }
+    apply G. tauto.
+Qed.
+
+Lemma binom_mono : forall m m' j, (m <= m')%nat -> (binom m j <= binom m' j)%nat.
+Proof.
+  intros m m' j H. induction H as [|m' H IH]; [lia|]. eapply Nat.le_trans; [exact IH|].
+  destruct j as [|j]; [destruct m'; cbn; lia|]. cbn [binom]. lia.
+Qed.
+
+Lemma length_tin_arow : forall r w u, length (tin (arow r w u)) = (r * length (tin u))%nat.
+Proof.
+  intros r w u. unfold arow. cbn [tin].
+  assert (G : forall k, length (concat (map (fun c => map (fun p => ((c * w + fst p)%nat, snd p)) (tin u)) (seq 0 k)))
+                       = (k * length (tin u))%nat).
+  { induction k as [|k IH]; [reflexivity|]. rewrite seq_S, map_app, concat_app, length_app, IH. cbn [map concat].
+    rewrite app_nil_r, length_map. lia. }
+  apply G.
+Qed.
+
+Section Flip.
+Variables (r : nat) (Ls : list (list tu)) (x0 : list bool) (n : nat).
+Hypothesis Ho : Nat.odd r = true.
+Hypothesis Hn : length x0 = n.
+Hypothesis HL : lwf n Ls.
+Hypothesis Hlast : length (last Ls []) = n.
+Hypothesis Hne : Ls <> [].
+
+(* evaluation of row q of layer l of F^(r) at step t flips when its variable fid t l q is at least 1 *)
+Variable fid : nat -> nat -> nat -> nat.
+Hypothesis fid_inj : forall t l q t' l' q', fid t l q = fid t' l' q' -> t = t' /\ l = l' /\ q = q'.
+Variable eps : R.
+Hypothesis Heps : 0 <= eps.
+Hypothesis Hflip : forall g, P (fun w => 1 <= X g w) <= eps.
+(* the largest effective fan-in of a row of F *)
+Variable kst : nat.
+Hypothesis Hk1 : (1 <= kst)%nat.
+Hypothesis Hfan : forall k i, (k < length Ls)%nat -> (i < length (nth k Ls []))%nat -> (length (tin (nth i (nth k Ls []) tu0)) <= kst)%nat.
+
+Definition fb (w : Omega) (g : nat) : bool := if Rle_dec 1 (X g w) then true else false.
+Definition Fl (w : Omega) (t l q : nat) : bool := fb w (fid t l q).
+
+Lemma fb_iff : forall g w, fb w g = true <-> 1 <= X g w.
+Proof. intros g w. unfold fb. destruct (Rle_dec 1 (X g w)); split; intro H; (discriminate || assumption || reflexivity || contradiction). Qed.
+
+Lemma dep_flip : forall g, dep (fun g' => g' = g) (fun w => 1 <= X g w).
+Proof. intros g w w' H. rewrite (H g eq_refl). reflexivity. Qed.
+
+Definition jflip : nat := (r / 2 + 1)%nat.
+Definition Bflip : R := (2 * exp 1 * INR kst * eps) ^ jflip.
+
+Lemma jflip_odd : jflip = ((r + 1) / 2)%nat.
+Proof.
+  unfold jflip. apply Nat.odd_spec in Ho as (hh & ->).
+  replace (2 * hh + 1)%nat with (1 + hh * 2)%nat by lia. rewrite Nat.div_add by lia.
+  replace (1 + hh * 2 + 1)%nat with (hh * 2 + 2)%nat by lia. replace (hh * 2 + 2)%nat with ((hh + 1) * 2)%nat by lia.
+  rewrite Nat.div_mul by lia. reflexivity.
+Qed.
+
+(* C(m, j) eps^j <= (2 e kst eps)^j when m <= r kst *)
+Lemma binom_flip : forall m, (m <= r * kst)%nat -> INR (binom m jflip) * eps ^ jflip <= Bflip.
+Proof.
+  intros m Hm. unfold Bflip. assert (Hj : (1 <= jflip)%nat) by (unfold jflip; lia).
+  eapply Rle_trans; [apply Rmult_le_compat_r; [apply pow_le; exact Heps | apply le_INR; apply (binom_mono m (r * kst) jflip Hm)]|].
+  eapply Rle_trans; [apply binom_bound; [exact Hj | exact Heps]|]. apply pow_incr. split.
+  - pose proof (exp_pos 1). pose proof (pos_INR (r * kst)). assert (0 < INR jflip) by (apply lt_0_INR; lia).
+    apply Rmult_le_pos; [|apply Rlt_le, Rinv_0_lt_compat; lra]. apply Rmult_le_pos; [nra | exact Heps].
+  - rewrite mult_INR. assert (HJ : 0 < INR jflip) by (apply lt_0_INR; lia).
+    assert (Hr2n : (r <= 2 * jflip)%nat)
+      by (unfold jflip; pose proof (Nat.div_mod r 2 ltac:(lia)); pose proof (Nat.mod_upper_bound r 2 ltac:(lia)); lia).
+    apply le_INR in Hr2n. rewrite mult_INR in Hr2n. assert (Hr2 : INR r <= 2 * INR jflip) by (cbn [INR] in Hr2n; lra).
+    pose proof (exp_pos 1). pose proof (pos_INR kst).
+    apply (Rmult_le_reg_r (INR jflip)); [exact HJ|]. unfold Rdiv. rewrite Rmult_assoc, Rinv_l, Rmult_1_r by lra.
+    assert (0 <= exp 1 * INR kst * eps) by (apply Rmult_le_pos; [nra | exact Heps]). nra.
+Qed.
+
+Lemma Bflip_nonneg : 0 <= Bflip.
+Proof. unfold Bflip. apply pow_le. pose proof (exp_pos 1). pose proof (pos_INR kst). apply Rmult_le_pos; [nra | exact Heps]. Qed.
+
+(* the flip patterns of Theorem flip_ok *)
+Definition ppat (w : Omega) (t k : nat) : nat -> bool :=
+  pin (fun q => match t with O => false | S t' => Fl w t' (length Ls - 1) q end) (Fl w t) 0 k.
+
+Definition urow (k i : nat) : tu := nth i (nth k Ls []) tu0.
+
+Definition Ebad (t k i : nat) (w : Omega) : Prop :=
+  (r / 2 < length (filter (fun p => ppat w t k (fst p)) (tin (arow r (win Ls n k) (urow k i)))))%nat.
+Definition Sbad (t j : nat) (w : Omega) : Prop := (r / 2 < ncnt r (fun c => Fl w t (length Ls - 1) (c * n + j)%nat))%nat.
+
+Lemma urow_ok : forall k i, (k < length Ls)%nat -> (i < length (nth k Ls []))%nat -> rowok (win Ls n k) (urow k i).
+Proof.
+  intros k i Hk Hi. unfold urow. clear -HL Hk Hi. revert n HL k Hk i Hi. induction Ls as [|L t IH]; intros w HL k Hk i Hi;
+    [cbn [length] in Hk; lia|]. destruct HL as [H1 H2]. destruct k as [|k].
+  - rewrite Forall_forall in H1. apply H1. apply nth_In. exact Hi.
+  - cbn [nth win length] in *. specialize (IH (length L) H2 k ltac:(lia) i Hi). destruct k; exact IH.
+Qed.
+
+(* the copies that a row of F^(r) reads are distinct flip variables *)
+Lemma P_Ebad : forall t k i, (k < length Ls)%nat -> (i < length (nth k Ls []))%nat -> P (Ebad t k i) <= Bflip.
+Proof.
+  intros t k i Hk Hi. pose proof (urow_ok k i Hk Hi) as Hu. destruct (arow_ok r _ _ Hu) as [Hnd _].
+  set (ins := tin (arow r (win Ls n k) (urow k i))).
+  assert (Hlen : (length ins <= r * kst)%nat) by (unfold ins; rewrite length_tin_arow; apply Nat.mul_le_mono_l; apply Hfan; assumption).
+  (* the source of each read position: a layer of step t, or the last layer of step t - 1 *)
+  assert (Gen : forall (src : nat -> nat), (forall q q', src q = src q' -> q = q') ->
+            (forall w, ppat w t k = fun q => fb w (src q)) -> P (Ebad t k i) <= Bflip).
+  { intros src Hsrc Hp. unfold Ebad.
+    rewrite (P_ext _ (fun w => (jflip <= length (filter (fb w) (map (fun p => src (fst p)) ins)))%nat)).
+    - eapply Rle_trans; [apply (P_atleast (map (fun p => src (fst p)) ins) (fun g w => 1 <= X g w) fb jflip eps)|].
+      + rewrite <- map_map. apply nodup_map_inj; [intros q q' _ _ E; exact (Hsrc q q' E) | exact Hnd].
+      + intros g w. apply fb_iff.
+      + exact dep_flip.
+      + exact Hflip.
+      + exact Heps.
+      + rewrite length_map. apply binom_flip. exact Hlen.
+    - intro w. rewrite length_filter_map, Hp. fold ins. unfold jflip. lia. }
+  destruct k as [|k].
+  - destruct t as [|t].
+    + eapply Rle_trans; [apply (P_mono _ (fun _ => False))|].
+      * intros w H. unfold Ebad, ppat, pin in H. cbv beta iota in H.
+        assert (Z : forall l : list (nat * Z), length (filter (fun _ => false) l) = 0%nat)
+          by (intro l; induction l as [|a l IHl]; [reflexivity | exact IHl]).
+        rewrite Z in H. lia.
+      * rewrite P_empty. apply Bflip_nonneg.
+    + apply (Gen (fid t (length Ls - 1))); [intros q q' E; apply fid_inj in E; tauto | reflexivity].
+  - apply (Gen (fid t k)); [intros q q' E; apply fid_inj in E; tauto | reflexivity].
+Qed.
+
+Lemma P_Sbad : forall t j, (j < n)%nat -> P (Sbad t j) <= Bflip.
+Proof.
+  intros t j Hj. unfold Sbad.
+  rewrite (P_ext _ (fun w => (jflip <= length (filter (fb w) (map (fun c => fid t (length Ls - 1) (c * n + j)%nat) (seq 0 r))))%nat)).
+  - eapply Rle_trans; [apply (P_atleast _ (fun g w => 1 <= X g w) fb jflip eps)|].
+    + apply nodup_map_inj; [|apply seq_NoDup]. intros c c' Hc Hc' E. apply fid_inj in E as (_ & _ & E).
+      apply in_seq in Hc, Hc'. nia.
+    + intros g w. apply fb_iff.
+    + exact dep_flip.
+    + exact Hflip.
+    + exact Heps.
+    + rewrite length_map, length_seq. apply binom_flip. nia.
+  - intro w. rewrite length_filter_map, <- ncnt_filter. unfold jflip, Fl. lia.
+Qed.
+
+(* Proposition 6.10: the state read by majority leaves the orbit within T steps with probability at most
+   T (M + n) (2 e k* eps)^((r + 1)/2) *)
+Theorem flip_bound : forall T, P (fun w => exists t, (t <= T)%nat /\ maj r n (trajf (amap r n Ls) (Fl w) (rep r x0) t) <> orbit Ls x0 t)
+  <= INR T * INR (Mr Ls + n) * (2 * exp 1 * INR kst * eps) ^ ((r + 1) / 2).
+Proof.
+  intro T. rewrite <- jflip_odd. fold Bflip.
+  eapply Rle_trans; [apply (P_mono _ (fun w => (exists t, (t < T)%nat /\ exists k, (k < length Ls)%nat /\ exists i, (i < nl Ls k)%nat /\ Ebad t k i w)
+                                              \/ (exists t, (t < T)%nat /\ exists j, (j < n)%nat /\ Sbad t j w)))|].
+  - intros w (t0 & Ht0 & Hne0).
+    destruct (search T (fun t => exists k, (k < length Ls)%nat /\ exists i, (i < nl Ls k)%nat /\ Ebad t k i w)) as [H|H].
+    + intro t. destruct (search (length Ls) (fun k => exists i, (i < nl Ls k)%nat /\ Ebad t k i w)) as [H1|H1].
+      * intro k. destruct (search (nl Ls k) (fun i => Ebad t k i w)) as [H2|H2];
+          [intro i; unfold Ebad; lia | left; exact H2 | right; intros (i & Hi & He); exact (H2 i Hi He)].
+      * left. exact H1.
+      * right. intros (k & Hk & Hx). exact (H1 k Hk Hx).
+    + left. exact H.
+    + destruct (search T (fun t => exists j, (j < n)%nat /\ Sbad t j w)) as [H'|H'].
+      * intro t. destruct (search n (fun j => Sbad t j w)) as [H2|H2];
+          [intro j; unfold Sbad; lia | left; exact H2 | right; intros (j & Hj & Hs); exact (H2 j Hj Hs)].
+      * right. exact H'.
+      * exfalso. apply Hne0. apply (flip_ok r Ls x0 n (Fl w) T Ho Hn HL Hlast Hne); [| | exact Ht0].
+        -- intros t k i Ht Hk Hi. destruct (Nat.le_gt_cases (length (filter (fun p => ppat w t k (fst p)) (tin (arow r (win Ls n k) (urow k i))))) (r / 2)) as [Hc|Hc];
+             [exact Hc|]. exfalso. apply (H t Ht). exists k. split; [exact Hk|]. exists i. split; [exact Hi | exact Hc].
+        -- intros t j Ht Hj. destruct (Nat.le_gt_cases (ncnt r (fun c => Fl w t (length Ls - 1) (c * n + j)%nat)) (r / 2)) as [Hc|Hc];
+             [exact Hc|]. exfalso. apply (H' t Ht). exists j. split; [exact Hj | exact Hc].
+  - eapply Rle_trans; [apply P_or|]. rewrite plus_INR, Rmult_plus_distr_l, Rmult_plus_distr_r. apply Rplus_le_compat.
+    + eapply Rle_trans; [apply P_exists|]. rewrite Rmult_assoc, <- rsum_const. apply rsum_le. intros t Ht.
+      eapply Rle_trans; [apply P_exists|]. rewrite <- rsum_rows. apply rsum_le. intros k Hk.
+      eapply Rle_trans; [apply P_exists|]. rewrite <- rsum_const. apply rsum_le. intros i Hi. apply P_Ebad; assumption.
+    + eapply Rle_trans; [apply P_exists|]. rewrite Rmult_assoc, <- rsum_const. apply rsum_le. intros t Ht.
+      eapply Rle_trans; [apply P_exists|]. rewrite <- rsum_const. apply rsum_le. intros j Hj. apply P_Sbad. exact Hj.
+Qed.
+
+End Flip.
+
+End Space.
+
+(* the redundancy that suffices against flips: N q^j <= delta when 0 < q < 1 and j >= ln(N/delta) / ln(1/q) *)
+Theorem flip_choose : forall N q delta j, 0 < N -> 0 < q < 1 -> 0 < delta ->
+  ln (N / delta) / ln (1 / q) <= INR j -> N * q ^ j <= delta.
+Proof.
+  intros N q delta j HN Hq Hd H. assert (Hl : 0 < ln (1 / q)) by (rewrite <- ln_1; apply ln_increasing; [lra|];
+                                                                   apply (Rmult_lt_reg_r q); [lra|]; field_simplify; lra).
+  assert (Hj : ln (N / delta) <= INR j * ln (1 / q)) by (apply (Rmult_le_reg_r (/ ln (1 / q))); [apply Rinv_0_lt_compat; lra|];
+                                                           unfold Rdiv in H; rewrite Rmult_assoc, Rinv_r by lra; lra).
+  replace (q ^ j) with (exp (- (INR j * ln (1 / q)))).
+  - assert (exp (- (INR j * ln (1 / q))) <= delta / N).
+    { replace (delta / N) with (exp (- ln (N / delta))) by (rewrite exp_Ropp, exp_ln by (apply Rdiv_lt_0_compat; lra); field; lra).
+      apply exp_le. lra. }
+    apply (Rmult_le_compat_l N) in H0; [|lra]. replace (N * (delta / N)) with delta in H0 by (field; lra). exact H0.
+  - replace (1 / q) with (/ q) by (field; lra). rewrite ln_Rinv by lra.
+    replace (- (INR j * - ln q)) with (INR j * ln q) by ring. rewrite <- exp_pow_nat, exp_ln by lra. reflexivity.
+Qed.
+
+
+(* ---- Theorem 6.8 (iii): the redundancy that suffices ---------------------------------------------------------------- *)
+(* with Gaussian perturbations, r >= 2 sqrt 2 s sqrt(ln(N/delta)) gives N erfc(r / (2 sqrt 2 s)) <= delta, N = T r M *)
+Theorem amp_choose : forall N s delta r, 0 <= N -> 0 < s -> 0 < delta -> 0 <= r ->
+  2 * sqrt 2 * s * sqrt (ln (N / delta)) <= r -> N * erfc (r / (2 * sqrt 2 * s)) <= delta.
+Proof.
+  intros N s delta r HN Hs Hd Hr H. pose proof sqrt2_pos.
+  set (x := r / (2 * sqrt 2 * s)). assert (Hx : 0 <= x) by (unfold x; apply Rmult_le_pos; [lra | apply Rlt_le, Rinv_0_lt_compat; nra]).
+  destruct (erfc_le_exp x Hx) as [E1 E2].
+  destruct (Rle_lt_dec N delta) as [Hle|Hlt].
+  - assert (exp (- (x * x)) <= 1) by (rewrite <- exp_0; apply exp_le; nra). nra.
+  - assert (Hpos : 0 < N) by lra. assert (Hq : 1 < N / delta) by (apply (Rmult_lt_reg_r delta); [lra|]; field_simplify; lra).
+    assert (Hln : 0 < ln (N / delta)) by (rewrite <- ln_1; apply ln_increasing; lra).
+    assert (Hsx : sqrt (ln (N / delta)) <= x).
+    { unfold x. apply (Rmult_le_reg_r (2 * sqrt 2 * s)); [nra|]. field_simplify; [|lra]. nra. }
+    assert (Hxx : ln (N / delta) <= x * x).
+    { pose proof (sqrt_pos (ln (N / delta))). rewrite <- (sqrt_sqrt (ln (N / delta))) by lra. nra. }
+    assert (Hexp : exp (- (x * x)) <= delta / N).
+    { replace (delta / N) with (exp (- ln (N / delta))).
+      - apply exp_le. lra.
+      - rewrite exp_Ropp, exp_ln by lra. field. lra. }
+    assert (N * erfc x <= N * (delta / N)) by (apply Rmult_le_compat_l; lra).
+    replace (N * (delta / N)) with delta in H1 by (field; lra). exact H1.
+Qed.
+
+(* with tails P(|e| >= u) <= exp(-u/lambda), r >= 2 lambda ln(N/delta) gives N exp(-(r/2)/lambda) <= delta *)
+Theorem amp_choose_exp : forall N lam delta r, 0 < N -> 0 < lam -> 0 < delta ->
+  2 * lam * ln (N / delta) <= r -> N * exp (- (r / 2) / lam) <= delta.
+Proof.
+  intros N lam delta r HN Hl Hd H.
+  assert (Hexp : exp (- (r / 2) / lam) <= delta / N).
+  { replace (delta / N) with (exp (- ln (N / delta))).
+    - apply exp_le. apply (Rmult_le_reg_r (2 * lam)); [lra|]. field_simplify; lra.
+    - rewrite exp_Ropp, exp_ln by (apply Rdiv_lt_0_compat; lra). field. lra. }
+  apply (Rmult_le_compat_l N) in Hexp; [|lra]. replace (N * (delta / N)) with delta in Hexp by (field; lra). exact Hexp.
+Qed.

rocq/NoiseNum.v

@@ -0,0 +1,126 @@
+(* The numbers of Sections 6 and 8 that follow from the bounds on erfc: the failure probability p at s = 0.05, the
+   union bounds over the self-reproducing run of the host, the threshold for output flips, the redundancy for noise on
+   every synapse, and the deviations up to which a generation of the stored host runs exactly (Corollary 8.9).
+   Each is evaluated between the bounds lo1 <= erfc <= up3 with the interval tactic. *)
+From Stdlib Require Import Reals Lra.
+From Interval Require Import Tactic.
+Set Warnings "-ambiguous-paths".
+From TH Require Import Erfc.
+Set Warnings "ambiguous-paths".
+
+Local Open Scope R_scope.
+
+Lemma erfc_between : forall x, 0 < x -> lo1 x <= erfc x <= up3 x.
+Proof. intros x Hx. split; [apply erfc_lower1 | apply erfc_upper3]; exact Hx. Qed.
+
+Ltac erfc_upper x := let H := fresh in pose proof (proj2 (erfc_between x ltac:(interval))) as H; unfold up3 in H.
+Ltac erfc_lower x := let H := fresh in pose proof (proj1 (erfc_between x ltac:(interval))) as H; unfold lo1 in H.
+
+(* ---- Section 6.1: the host, M = 41,967 rows, over the T = 1,664,939 steps of its self-reproducing run ---------------- *)
+(* p = erfc(1/(2 sqrt 2 s)) at s = 0.05 *)
+Theorem p_005 : 1.52e-23 <= erfc (1 / (2 * sqrt 2 * 0.05)) <= 1.53e-23.
+Proof.
+  erfc_lower (1 / (2 * sqrt 2 * 0.05)). erfc_upper (1 / (2 * sqrt 2 * 0.05)).
+  split; [eapply Rle_trans; [|eassumption] | eapply Rle_trans; [eassumption|]]; interval with (i_prec 80).
+Qed.
+
+(* Proposition 6.4 bounds a deviation over the run by T M p <= 1.1e-12 at s = 0.05; at s = 0.10 the bound exceeds one *)
+Theorem TMp_005 : 1664939 * 41967 * erfc (1 / (2 * sqrt 2 * 0.05)) <= 1.1e-12.
+Proof.
+  erfc_upper (1 / (2 * sqrt 2 * 0.05)).
+  eapply Rle_trans; [apply Rmult_le_compat_l; [lra | eassumption]|]. interval with (i_prec 80).
+Qed.
+
+Theorem TMp_010 : 1 < 1664939 * 41967 * erfc (1 / (2 * sqrt 2 * 0.10)).
+Proof.
+  erfc_lower (1 / (2 * sqrt 2 * 0.10)).
+  eapply Rlt_le_trans; [|apply Rmult_le_compat_l; [lra | eassumption]]. interval with (i_prec 80).
+Qed.
+
+(* Proposition 6.10 for the host, whose largest fan-in is 256: the threshold 1/(2 e 256) is below 7.2e-4 *)
+Theorem flip_threshold : 1 / (2 * exp 1 * 256) < 7.2e-4.
+Proof. interval. Qed.
+
+(* Corollary 6.9 with K* = 8: the bound falls below 1e-3 with r = 5 at s_w = 0.05 and with r = 21 at s_w = 0.10,
+   and not with r = 3 and r = 19 *)
+Theorem synapse_005 :
+  1664939 * 5 * 41967 * erfc (sqrt 5 / (2 * sqrt (2 * 8) * 0.05)) < 1e-3
+  /\ 1e-3 < 1664939 * 3 * 41967 * erfc (sqrt 3 / (2 * sqrt (2 * 8) * 0.05)).
+Proof.
+  erfc_upper (sqrt 5 / (2 * sqrt (2 * 8) * 0.05)). erfc_lower (sqrt 3 / (2 * sqrt (2 * 8) * 0.05)). split.
+  - eapply Rle_lt_trans; [apply Rmult_le_compat_l; [lra | eassumption]|]. interval with (i_prec 80).
+  - eapply Rlt_le_trans; [|apply Rmult_le_compat_l; [lra | eassumption]]. interval with (i_prec 80).
+Qed.
+
+Theorem synapse_010 :
+  1664939 * 21 * 41967 * erfc (sqrt 21 / (2 * sqrt (2 * 8) * 0.10)) < 1e-3
+  /\ 1e-3 < 1664939 * 19 * 41967 * erfc (sqrt 19 / (2 * sqrt (2 * 8) * 0.10)).
+Proof.
+  erfc_upper (sqrt 21 / (2 * sqrt (2 * 8) * 0.10)). erfc_lower (sqrt 19 / (2 * sqrt (2 * 8) * 0.10)). split.
+  - eapply Rle_lt_trans; [apply Rmult_le_compat_l; [lra | eassumption]|]. interval with (i_prec 80).
+  - eapply Rlt_le_trans; [|apply Rmult_le_compat_l; [lra | eassumption]]. interval with (i_prec 80).
+Qed.
+
+(* Theorem 6.8 (ii) for N_3 over the run: 1.54e-39, 3.19e-12, 1.34e-2 and more than 4e2 at s = 0.10, 0.15, 0.20, 0.25 *)
+Theorem N3_first_order :
+  1.53e-39 <= 1664939 * 3 * 41967 * erfc (3 / (2 * sqrt 2 * 0.10)) <= 1.55e-39
+  /\ 3.18e-12 <= 1664939 * 3 * 41967 * erfc (3 / (2 * sqrt 2 * 0.15)) <= 3.20e-12
+  /\ 1.33e-2 <= 1664939 * 3 * 41967 * erfc (3 / (2 * sqrt 2 * 0.20)) <= 1.35e-2
+  /\ 4.1e2 <= 1664939 * 3 * 41967 * erfc (3 / (2 * sqrt 2 * 0.25)) <= 4.2e2.
+Proof.
+  erfc_lower (3 / (2 * sqrt 2 * 0.10)). erfc_upper (3 / (2 * sqrt 2 * 0.10)).
+  erfc_lower (3 / (2 * sqrt 2 * 0.15)). erfc_upper (3 / (2 * sqrt 2 * 0.15)).
+  erfc_lower (3 / (2 * sqrt 2 * 0.20)). erfc_upper (3 / (2 * sqrt 2 * 0.20)).
+  erfc_lower (3 / (2 * sqrt 2 * 0.25)). erfc_upper (3 / (2 * sqrt 2 * 0.25)).
+  repeat split;
+    first [ eapply Rle_trans; [|apply Rmult_le_compat_l; [lra | eassumption]]; interval with (i_prec 80)
+          | eapply Rle_trans; [apply Rmult_le_compat_l; [lra | eassumption]|]; interval with (i_prec 80) ].
+Qed.
+
+(* ---- Corollary 8.9: a generation of the stored host, T = 95,762,842,100 applications of a network of
+   M = 470,604,761 rows, runs exactly with probability at least 0.999 for s <= 0.050, and its threefold and fivefold
+   amplifications for s <= 0.148 and s <= 0.247 -------------------------------------------------------------------------- *)
+Lemma erfc_at_most : forall r s s0, 0 < r -> 0 < s -> s <= s0 -> erfc (r / (2 * sqrt 2 * s)) <= erfc (r / (2 * sqrt 2 * s0)).
+Proof.
+  intros r s s0 Hr Hs Hle. apply erfc_decr. pose proof sqrt2_pos.
+  apply Rmult_le_compat_l; [lra|]. apply Rinv_le_contravar; [nra | nra].
+Qed.
+
+Lemma generation_1_at : 95762842100 * 470604761 * erfc (1 / (2 * sqrt 2 * 0.050)) <= 1e-3.
+Proof.
+  erfc_upper (1 / (2 * sqrt 2 * 0.050)).
+  eapply Rle_trans; [apply Rmult_le_compat_l; [lra | eassumption]|]. interval with (i_prec 100).
+Qed.
+
+Lemma generation_3_at : 95762842100 * 3 * 470604761 * erfc (3 / (2 * sqrt 2 * 0.148)) <= 1e-3.
+Proof.
+  erfc_upper (3 / (2 * sqrt 2 * 0.148)).
+  eapply Rle_trans; [apply Rmult_le_compat_l; [lra | eassumption]|]. interval with (i_prec 100).
+Qed.
+
+Lemma generation_5_at : 95762842100 * 5 * 470604761 * erfc (5 / (2 * sqrt 2 * 0.247)) <= 1e-3.
+Proof.
+  erfc_upper (5 / (2 * sqrt 2 * 0.247)).
+  eapply Rle_trans; [apply Rmult_le_compat_l; [lra | eassumption]|]. interval with (i_prec 120).
+Qed.
+
+Theorem generation_1 : forall s, 0 < s <= 0.050 ->
+  95762842100 * 470604761 * erfc (1 / (2 * sqrt 2 * s)) <= 1e-3.
+Proof.
+  intros s [Hs Hle]. eapply Rle_trans; [apply Rmult_le_compat_l; [lra | apply (erfc_at_most 1 s 0.050); lra]|].
+  exact generation_1_at.
+Qed.
+
+Theorem generation_3 : forall s, 0 < s <= 0.148 ->
+  95762842100 * 3 * 470604761 * erfc (3 / (2 * sqrt 2 * s)) <= 1e-3.
+Proof.
+  intros s [Hs Hle]. eapply Rle_trans; [apply Rmult_le_compat_l; [lra | apply (erfc_at_most 3 s 0.148); lra]|].
+  exact generation_3_at.
+Qed.
+
+Theorem generation_5 : forall s, 0 < s <= 0.247 ->
+  95762842100 * 5 * 470604761 * erfc (5 / (2 * sqrt 2 * s)) <= 1e-3.
+Proof.
+  intros s [Hs Hle]. eapply Rle_trans; [apply Rmult_le_compat_l; [lra | apply (erfc_at_most 5 s 0.247); lra]|].
+  exact generation_5_at.
+Qed.

rocq/PhysLev.v

@@ -0,0 +1,1075 @@
+(* The ring network levelized (Theorem 7.2 and Corollary 8.9): N^alpha_{K,S,L} has depth 19 and the stated number of
+   edges, every unit but the decode lines of the output addresses 0 and 1 contributes to a next value, and
+   Lev(N^alpha_{K,S,L}) has depth 19 and the number of rows given below. *)
+From Stdlib Require Import List Bool Arith ZArith Lia NArith.
+Import ListNotations.
+From TH Require Import TwoHead Net Gates Phys PhysWF PhysSem Lev BlockLev.
+
+Section PL.
+Variables al K S0 L : nat.
+Hypothesis Hal : 4 <= al.
+Hypothesis HK : 2 <= K.
+Hypothesis HS : 1 <= S0.
+Hypothesis HL : 1 <= L.
+
+Local Notation bsP := (phys_blocks al K S0 L).
+Local Notation nP := (nst al K S0 L).
+Local Notation Bw := (B al).
+Local Notation Nb := (N al S0).
+
+(* ---- the depth of each unit ---------------------------------------------------------------------------------- *)
+Definition cdp (x : sref) : nat :=
+  match x with
+  | SIn _ => 0
+  | SRef b j r =>
+      match b with
+      | 0 => 1
+      | 1 => if r <? S0 then 1 else 2
+      | 2 => if r <? K then 3 else 4
+      | 3 => if r <? L then 1 else 2
+      | 4 => if r <? Bw then 3 else 4
+      | 5 => if r <? K then (if Nat.eqb j 1 then 5 else 3) else (if Nat.eqb j 1 then 6 else 4)
+      | 6 | 7 | 8 | 13 | 14 | 18 => 5
+      | 9 | 11 => if Nat.eqb j 2 then 7 else 6
+      | 10 | 12 => 8
+      | 15 | 16 => 9
+      | 17 => 10
+      | 19 => if Nat.eqb r 0 then 5 else 6
+      | 20 => 11
+      | 21 => 12
+      | 22 => match r with 0 => 13 | 1 => 6 | _ => 14 end
+      | 23 => if r <? 2 then 15 else 16
+      | 24 => if Nat.eqb r 0 then 6 else 15
+      | 25 => match r with 0 => 7 | 3 => 17 | _ => 16 end
+      | 26 => match r with 2 => 16 | 3 => 17 | _ => 15 end
+      | 27 => match r with 2 => 16 | 3 => 19 | _ => 18 end
+      | 28 => if Nat.eqb r 3 then 17 else 16
+      | 29 => match r with 0 => 6 | 4 | 7 => 16 | _ => 15 end
+      | 30 => match r with 0 => 7 | 3 => 17 | _ => 16 end
+      | _ => if Nat.eqb r 3 then 18 else 17
+      end
+  end.
+
+(* the units that contribute to a next value: all but the decode lines of the output addresses 0 and 1 *)
+Definition ndp (x : sref) : bool :=
+  match x with SRef 8 j _ => negb (j <? 2) | _ => true end.
+
+(* ---- the last layer that reads each signal ----------------------------------------------------------------------- *)
+Definition clp (x : sref) : nat :=
+  match x with
+  | SIn i =>
+      if i <? nw al then 6
+      else if i <? nw al + K then 17
+      else if i <? nw al + K + K * bsz al S0 then
+        (let p := (i - (nw al + K)) mod bsz al S0 in if p <? Nb then 16 else if p <? Nb + S0 then 18 else 16)
+      else (let p := (i - (nw al + K + K * bsz al S0)) mod (2 * L) in if p <? L then 16 else 17)
+  | SRef b j r =>
+      match b with
+      | 0 => 20
+      | 1 => if r <? S0 then 2 else 3
+      | 2 => if r <? K then 4 else (if Nat.eqb j 4 then 6 else 5)
+      | 3 => if r <? L then 2 else 3
+      | 4 => if r <? Bw then 4 else 5
+      | 5 => if r <? K then (if Nat.eqb j 1 then 6 else 4) else (if Nat.eqb j 1 then 7 else 6)
+      | 6 | 7 => if Nat.eqb j 2 then 7 else 6
+      | 8 => if j <? 2 then 0 else if j <? 4 then 6 else 13
+      | 9 | 11 => 8
+      | 10 | 12 | 13 | 14 => 9
+      | 15 | 16 => 10
+      | 17 | 19 => 11
+      | 18 => 6
+      | 20 => 12
+      | 21 => 16
+      | 22 => if r <? 2 then 14 else (if j + 4 <=? HO then 15 else 20)
+      | 23 => if r <? 2 then 16 else 20
+      | 24 => if Nat.eqb r 0 then 7 else 16
+      | 25 => match r with 0 => 16 | 3 => 20 | _ => 17 end
+      | 26 => match r with 0 | 3 => 18 | 1 => 16 | _ => 17 end
+      | 27 => if Nat.eqb r 3 then 20 else 19
+      | 28 => if Nat.eqb r 3 then 20 else 17
+      | 29 => match r with 0 => 7 | 4 | 7 => 17 | _ => 16 end
+      | 30 => match r with 0 => 16 | 3 => 20 | _ => 17 end
+      | _ => if Nat.eqb r 3 then 20 else 18
+      end
+  end.
+
+Lemma B_ge : 20 <= Bw.
+Proof. unfold B, recw. lia. Qed.
+
+Lemma W_ge16 : 16 <= W al.
+Proof. apply W_ge. exact Hal. Qed.
+
+(* the state bits the units name *)
+Lemma cl_win : forall c, c < nw al -> clp (SIn c) = 6.
+Proof. intros c H. cbn [clp]. destruct (Nat.ltb_spec c (nw al)); [reflexivity | lia]. Qed.
+
+Lemma cl_act : forall k, clp (act al K k) = 17.
+Proof.
+  intro k. unfold act, okap. cbn [clp]. pose proof (Nat.mod_upper_bound k K ltac:(lia)).
+  destruct (Nat.ltb_spec (nw al + k mod K) (nw al)); [lia|]. destruct (Nat.ltb_spec (nw al + k mod K) (nw al + K)); [reflexivity | lia].
+Qed.
+
+Lemma cl_idl : forall k, clp (idl al K k) = 17.
+Proof.
+  intro k. unfold idl, okap. cbn [clp]. pose proof (Nat.mod_upper_bound (k + K - 1) K ltac:(lia)).
+  destruct (Nat.ltb_spec (nw al + (k + K - 1) mod K) (nw al)); [lia|].
+  destruct (Nat.ltb_spec (nw al + (k + K - 1) mod K) (nw al + K)); [reflexivity | lia].
+Qed.
+
+Lemma bank_mod : forall k q, k < K -> q < bsz al S0 ->
+  (nw al + K + k * bsz al S0 + q - (nw al + K)) mod bsz al S0 = q.
+Proof.
+  intros k q Hk Hq. replace (nw al + K + k * bsz al S0 + q - (nw al + K)) with (k * bsz al S0 + q) by lia.
+  exact (proj2 (divmod_pair k q _ Hq)).
+Qed.
+
+Lemma bank_lt : forall k q, k < K -> q < bsz al S0 -> nw al + K + k * bsz al S0 + q < nw al + K + K * bsz al S0.
+Proof. intros k q Hk Hq. assert (k * bsz al S0 + bsz al S0 <= K * bsz al S0) by nia. lia. Qed.
+
+Lemma cl_qref : forall k p, k < K -> p < Nb -> clp (qref al K S0 k p) = 16.
+Proof.
+  intros k p Hk Hp. unfold qref, obank. cbn [clp]. assert (Hq : p < bsz al S0) by (unfold bsz; lia).
+  pose proof (bank_lt k p Hk Hq).
+  destruct (Nat.ltb_spec (nw al + K + k * bsz al S0 + p) (nw al)); [lia|].
+  destruct (Nat.ltb_spec (nw al + K + k * bsz al S0 + p) (nw al + K)); [nia|].
+  destruct (Nat.ltb_spec (nw al + K + k * bsz al S0 + p) (nw al + K + K * bsz al S0)); [|lia].
+  rewrite bank_mod by assumption. destruct (Nat.ltb_spec p Nb); [reflexivity | lia].
+Qed.
+
+Lemma cl_href : forall k s, k < K -> s < S0 -> clp (href al K S0 k s) = 18.
+Proof.
+  intros k s Hk Hs. unfold href, obank. cbn [clp]. assert (Hq : Nb + s < bsz al S0) by (unfold bsz; lia).
+  replace (nw al + K + k * bsz al S0 + Nb + s) with (nw al + K + k * bsz al S0 + (Nb + s)) by lia.
+  pose proof (bank_lt k (Nb + s) Hk Hq).
+  destruct (Nat.ltb_spec (nw al + K + k * bsz al S0 + (Nb + s)) (nw al)); [lia|].
+  destruct (Nat.ltb_spec (nw al + K + k * bsz al S0 + (Nb + s)) (nw al + K)); [lia|].
+  destruct (Nat.ltb_spec (nw al + K + k * bsz al S0 + (Nb + s)) (nw al + K + K * bsz al S0)); [|lia].
+  rewrite bank_mod by assumption. destruct (Nat.ltb_spec (Nb + s) Nb); [lia|].
+  destruct (Nat.ltb_spec (Nb + s) (Nb + S0)); [reflexivity | lia].
+Qed.
+
+Lemma cl_jref : forall k j, k < K -> j < Bw -> clp (jref al K S0 k j) = 16.
+Proof.
+  intros k j Hk Hj. unfold jref, obank. cbn [clp]. assert (Hq : Nb + S0 + j < bsz al S0) by (unfold bsz; lia).
+  replace (nw al + K + k * bsz al S0 + Nb + S0 + j) with (nw al + K + k * bsz al S0 + (Nb + S0 + j)) by lia.
+  pose proof (bank_lt k (Nb + S0 + j) Hk Hq).
+  destruct (Nat.ltb_spec (nw al + K + k * bsz al S0 + (Nb + S0 + j)) (nw al)); [lia|].
+  destruct (Nat.ltb_spec (nw al + K + k * bsz al S0 + (Nb + S0 + j)) (nw al + K)); [lia|].
+  destruct (Nat.ltb_spec (nw al + K + k * bsz al S0 + (Nb + S0 + j)) (nw al + K + K * bsz al S0)); [|lia].
+  rewrite bank_mod by assumption. destruct (Nat.ltb_spec (Nb + S0 + j) Nb); [lia|].
+  destruct (Nat.ltb_spec (Nb + S0 + j) (Nb + S0)); [lia | reflexivity].
+Qed.
+
+Lemma tape_shape : forall k q, k < K -> q < 2 * L ->
+  otape al K S0 L k + q < nst al K S0 L /\ nw al + K + K * bsz al S0 <= otape al K S0 L k + q
+  /\ (otape al K S0 L k + q - (nw al + K + K * bsz al S0)) mod (2 * L) = q.
+Proof.
+  intros k q Hk Hq. unfold otape, nst. assert (k * (2 * L) + 2 * L <= K * (2 * L)) by nia.
+  split; [lia|]. split; [lia|].
+  replace (nw al + K + K * bsz al S0 + k * (2 * L) + q - (nw al + K + K * bsz al S0)) with (k * (2 * L) + q) by lia.
+  exact (proj2 (divmod_pair k q _ Hq)).
+Qed.
+
+Lemma cl_dref : forall k i, k < K -> i < L -> clp (dref al K S0 L k i) = 16.
+Proof.
+  intros k i Hk Hi. unfold dref. destruct (tape_shape k i Hk ltac:(lia)) as (_ & H2 & H3). cbn [clp].
+  destruct (Nat.ltb_spec (otape al K S0 L k + i) (nw al)); [lia|].
+  destruct (Nat.ltb_spec (otape al K S0 L k + i) (nw al + K)); [lia|].
+  destruct (Nat.ltb_spec (otape al K S0 L k + i) (nw al + K + K * bsz al S0)); [lia|].
+  rewrite H3. destruct (Nat.ltb_spec i L); [reflexivity | lia].
+Qed.
+
+Lemma cl_tref : forall k i, k < K -> i < L -> clp (tref al K S0 L k i) = 17.
+Proof.
+  intros k i Hk Hi. unfold tref. replace (otape al K S0 L k + L + i) with (otape al K S0 L k + (L + i)) by lia.
+  destruct (tape_shape k (L + i) Hk ltac:(lia)) as (_ & H2 & H3). cbn [clp].
+  destruct (Nat.ltb_spec (otape al K S0 L k + (L + i)) (nw al)); [lia|].
+  destruct (Nat.ltb_spec (otape al K S0 L k + (L + i)) (nw al + K)); [lia|].
+  destruct (Nat.ltb_spec (otape al K S0 L k + (L + i)) (nw al + K + K * bsz al S0)); [lia|].
+  rewrite H3. destruct (Nat.ltb_spec (L + i) L); [lia | reflexivity].
+Qed.
+
+Lemma cl_fld : forall x, clp (fld K x) = if Nat.eqb x 4 then 6 else 5.
+Proof. intro x. unfold fld. cbn [clp]. rewrite Nat.ltb_irrefl. reflexivity. Qed.
+
+Lemma cl_req : forall c, 4 <= c <= HO -> clp (req c) = 15.
+Proof. intros c Hc. unfold req. cbn [clp]. destruct (Nat.leb_spec (c - 4 + 4) HO); [reflexivity | lia]. Qed.
+
+(* ---- every unit lies one layer above its deepest input and no later than the last reader of each input ---------- *)
+Lemma and_in : forall (ls : list lit) x pol, In (x, pol) ls -> In (x, if pol then 1%Z else (-1)%Z) (sin (sAND ls)).
+Proof. intros ls x pol H. cbn [sin sAND]. exact (in_map lw ls (x, pol) H). Qed.
+
+Lemma or_in : forall (ls : list lit) x pol, In (x, pol) ls -> In (x, if pol then 1%Z else (-1)%Z) (sin (sOR ls)).
+Proof. intros ls x pol H. cbn [sin sOR]. exact (in_map lw ls (x, pol) H). Qed.
+
+Definition uok (b j r : nat) : Prop :=
+  (forall p z, In (p, z) (sin (sunit bsP b j r)) ->
+     S (cdp p) <= cdp (SRef b j r) /\ (ndp (SRef b j r) = true -> cdp (SRef b j r) <= clp p) /\ ndp p = true)
+  /\ (sin (sunit bsP b j r) = [] /\ cdp (SRef b j r) = 1
+      \/ exists p z, In (p, z) (sin (sunit bsP b j r)) /\ S (cdp p) = cdp (SRef b j r)).
+
+Ltac split32 b := destruct b as [|b]; [idtac | first [exfalso; lia | split32 b]].
+
+Ltac blk Hj Hr := cbn [phys_blocks nth bcount bsize bshape blk_zero blk_rec blk_fld blk_tc blk_ac blk_head blk_dec
+  blk_term blk_xs blk_pos blk_neg blk_mt blk_nt blk_pge blk_b4 blk_bge blk_vand blk_v blk_xhat blk_kap blk_bw blk_q blk_hq
+  blk_hs blk_hj blk_tw blk_d blk_t track mux3] in Hj, Hr |- *.
+
+Ltac cls := rewrite ?cl_act, ?cl_idl, ?cl_fld;
+  repeat first
+    [ rewrite cl_href by (assumption || lia)
+    | rewrite cl_qref by (assumption || lia)
+    | rewrite cl_jref by (assumption || lia)
+    | rewrite cl_dref by (assumption || lia)
+    | rewrite cl_tref by (assumption || lia)
+    | rewrite cl_win by (assumption || (unfold nw in *; lia))
+    | rewrite cl_req by (unfold HO, AR, AA, AC, RR, RA, RC, CB, CT; lia) ].
+
+Ltac ev := cbn [cdp ndp clp fld vref req zero xsref act idl href qref jref dref tref Nat.eqb negb].
+
+Ltac fin := cls; unfold ARM, CPY, HO, xsref; ev; unfold HO;
+  repeat (match goal with
+          | |- context [Nat.ltb ?a ?b] => destruct (Nat.ltb_spec a b)
+          | |- context [Nat.leb ?a ?b] => destruct (Nat.leb_spec a b)
+          | |- context [Nat.eqb ?a ?b] => destruct (Nat.eqb_spec a b)
+          end; ev);
+  repeat split; intros; first [reflexivity | lia | discriminate].
+
+Ltac lit_in := cbv beta iota delta [In]; repeat (first [left; reflexivity | right]).
+
+Ltac wit P pol := exists P, (if pol then 1%Z else (-1)%Z); split;
+  [first [apply (and_in _ _ pol) | apply (or_in _ _ pol)]; lit_in |].
+
+Ltac wmap P s := exists P, 1%Z; split;
+  [first [apply (and_in _ _ true) | apply (or_in _ _ true)]; apply in_map_iff; exists s; split; [reflexivity | apply in_seq; lia] |].
+
+Ltac preds := let p := fresh "p" in let z := fresh "z" in let Hin := fresh "Hin" in let pol := fresh "pol" in
+  let Hp := fresh "Hp" in intros p z Hin;
+  first [ destruct (in_and _ _ _ Hin) as (pol & Hp) | destruct (in_or _ _ _ Hin) as (pol & Hp) ]; in_list Hp; fin.
+
+Ltac pmap := let p := fresh "p" in let z := fresh "z" in let Hin := fresh "Hin" in let s := fresh "s" in
+  let Hs := fresh "Hs" in intros p z Hin; destruct (in_or_map _ _ _ _ Hin) as (s & Hs & ->); fin.
+
+Theorem phys_unit_ok : forall b j r, valid bsP nP (SRef b j r) -> uok b j r.
+Proof.
+  intros b j r (Hb & Hj & Hr). rewrite phys_length in Hb. unfold uok, sunit.
+  pose proof B_ge as HB. pose proof W_ge16 as HW.
+  split32 b; blk Hj Hr.
+  - (* 0: the unit that never fires *)
+    destruct r as [|r]; [|lia]. cbn [nth]. split; [intros p z Hin; destruct Hin | left; split; reflexivity].
+  - (* 1: the record bits under the slot heads *)
+    assert (Hk : j / Bw < K) by (apply Nat.Div0.div_lt_upper_bound; nia).
+    assert (Hm : j mod Bw < Bw) by (apply Nat.mod_upper_bound; lia).
+    destruct (Nat.lt_ge_cases r S0) as [R|R].
+    + rewrite nth_map_seq_app by exact R. assert (Hq : r * Bw + j mod Bw < Nb) by (unfold N; nia).
+      split; [preds | right; wit (href al K S0 (j / Bw) r) true; fin].
+    + assert (r = S0) by lia. subst r. rewrite nth_map_seq_last. split; [pmap | right; wmap (SRef 1 j 0) 0; fin].
+  - (* 2: the record of the active bank *)
+    destruct (Nat.lt_ge_cases r K) as [R|R].
+    + rewrite nth_map_seq_app by exact R. split; [preds | right; wit (SRef 1 (r * Bw + j) S0) true; fin].
+    + assert (r = K) by lia. subst r. rewrite nth_map_seq_last. split; [pmap | right; wmap (SRef 2 j 0) 0; fin].
+  - (* 3: the cells under the tape heads *)
+    destruct (Nat.lt_ge_cases r L) as [R|R].
+    + rewrite nth_map_seq_app by exact R. split; [preds | right; wit (tref al K S0 L j r) true; fin].
+    + assert (r = L) by lia. subst r. rewrite nth_map_seq_last. split; [pmap | right; wmap (SRef 3 j 0) 0; fin].
+  - (* 4: the bits under the arms *)
+    destruct (Nat.lt_ge_cases r Bw) as [R|R].
+    + rewrite nth_map_seq_app by exact R. split; [preds | right; wit (SRef 1 (j * Bw + r) S0) true; fin].
+    + assert (r = Bw) by lia. subst r. rewrite nth_map_seq_last. split; [pmap | right; wmap (SRef 4 j 0) 0; fin].
+  - (* 5: the cells under the read head, the arm and the copy head *)
+    destruct (Nat.lt_ge_cases r K) as [R|R].
+    + rewrite nth_map_seq_app by exact R. destruct j as [|[|[|j]]]; [| | |lia]; cbn [headsel].
+      * split; [preds | right; wit (SRef 3 r L) true; fin].
+      * split; [preds | right; wit (SRef 4 r Bw) true; fin].
+      * split; [preds | right; wit (SRef 3 r L) true; fin].
+    + assert (r = K) by lia. subst r. rewrite nth_map_seq_last. split; [pmap | right; wmap (SRef 5 j 0) 0; fin].
+  - (* 6: the decode lines of a0 *)
+    destruct r as [|r]; [|lia]. cbn [nth]. split.
+    + intros p z Hin. destruct (in_and_map _ _ _ _ Hin) as (t & pol & Ht & E). injection E as <- _. fin.
+    + right. exists (fld K (8 + 0)), (if bitsof al j 0 then 1%Z else (-1)%Z). split; [|fin].
+      apply (and_in _ _ (bitsof al j 0)). apply (in_map (fun t => (fld K (8 + t), bitsof al j t))). apply in_seq. lia.
+  - (* 7: the decode lines of a1 *)
+    destruct r as [|r]; [|lia]. cbn [nth]. split.
+    + intros p z Hin. destruct (in_and_map _ _ _ _ Hin) as (t & pol & Ht & E). injection E as <- _. fin.
+    + right. exists (fld K (8 + al + 0)), (if bitsof al j 0 then 1%Z else (-1)%Z). split; [|fin].
+      apply (and_in _ _ (bitsof al j 0)). apply (in_map (fun t => (fld K (8 + al + t), bitsof al j t))). apply in_seq. lia.
+  - (* 8: the decode lines of ao *)
+    destruct r as [|r]; [|lia]. cbn [nth]. split.
+    + intros p z Hin. destruct (in_and_map _ _ _ _ Hin) as (t & pol & Ht & E). injection E as <- _. fin.
+    + right. exists (fld K (8 + 2 * al + 0)), (if bitsof al j 0 then 1%Z else (-1)%Z). split; [|fin].
+      apply (and_in _ _ (bitsof al j 0)). apply (in_map (fun t => (fld K (8 + 2 * al + t), bitsof al j t))). apply in_seq. lia.
+  - (* 9: the terms of the first operand *)
+    destruct r as [|r]; [|lia]. cbn [nth]. destruct (Nat.lt_ge_cases j 4) as [J|J].
+    + destruct j as [|[|[|[|j]]]]; [| | | |lia]; cbn [cellref Nat.eqb orb];
+        split; [preds | right | preds | right | preds | right | preds | right].
+      * wit (SRef 6 0 0) true. fin.
+      * wit (SRef 6 1 0) true. fin.
+      * wit (SRef 5 1 K) true. fin.
+      * wit (SRef 6 3 0) true. fin.
+    + assert (E : cellref K j = SIn (j - 4)).
+      { unfold cellref. destruct (Nat.eqb_spec j 0); [lia|]. destruct (Nat.eqb_spec j 1); [lia|].
+        destruct (Nat.eqb_spec j 2); [lia|]. destruct (Nat.eqb_spec j 3); [lia|]. reflexivity. }
+      rewrite E. split; [preds | right; wit (SRef 6 j 0) true; fin].
+  - (* 10: the first operand *)
+    destruct r as [|r]; [|lia]. cbn [nth]. split; [pmap | right; wmap (SRef 9 2 0) 2; fin].
+  - (* 11: the terms of the second operand *)
+    destruct r as [|r]; [|lia]. cbn [nth]. destruct (Nat.lt_ge_cases j 4) as [J|J].
+    + destruct j as [|[|[|[|j]]]]; [| | | |lia]; cbn [cellref Nat.eqb orb];
+        split; [preds | right | preds | right | preds | right | preds | right].
+      * wit (SRef 7 0 0) true. fin.
+      * wit (SRef 7 1 0) true. fin.
+      * wit (SRef 5 1 K) true. fin.
+      * wit (SRef 7 3 0) true. fin.
+    + assert (E : cellref K j = SIn (j - 4)).
+      { unfold cellref. destruct (Nat.eqb_spec j 0); [lia|]. destruct (Nat.eqb_spec j 1); [lia|].
+        destruct (Nat.eqb_spec j 2); [lia|]. destruct (Nat.eqb_spec j 3); [lia|]. reflexivity. }
+      rewrite E. split; [preds | right; wit (SRef 7 j 0) true; fin].
+  - (* 12: the second operand *)
+    destruct r as [|r]; [|lia]. cbn [nth]. split; [pmap | right; wmap (SRef 11 2 0) 2; fin].
+  - (* 13 *) destruct r as [|r]; [|lia]. cbn [nth]. split; [preds | right; wit (fld K (2 * j)) false; fin].
+  - (* 14 *) destruct r as [|r]; [|lia]. cbn [nth]. split; [preds | right; wit (fld K (2 * j)) true; fin].
+  - (* 15 *) destruct r as [|r]; [|lia]. cbn [nth]. split; [preds | right; wit (xsref j) true; fin].
+  - (* 16 *) destruct r as [|r]; [|lia]. cbn [nth]. split; [preds | right; wit (xsref j) true; fin].
+  - (* 17: the comparisons of the weighted sum *)
+    destruct r as [|r]; [|lia]. cbn [nth sin]. split.
+    + intros p z Hin. in_list Hin; fin.
+    + right. exists (SRef 15 0 0), 1%Z. split; [left; reflexivity | fin].
+  - (* 18 *)
+    do 4 (destruct r as [|r]; [cbn [nth]; split; [preds | right; wit (fld K 5) true; fin] |]). lia.
+  - (* 19: the comparisons of the bias *)
+    destruct r as [|r]; [cbn [nth]; split; [preds | right; wit (fld K 4) false; fin] |].
+    destruct r as [|r]; [cbn [nth]; split; [preds | right; wit (SRef 18 0 0) true; fin] |].
+    destruct r as [|r]; [cbn [nth]; split; [preds | right; wit (SRef 18 0 1) true; fin] |].
+    destruct r as [|r]; [cbn [nth]; split; [preds | right; wit (SRef 18 0 2) true; fin] |].
+    destruct r as [|r]; [cbn [nth]; split; [preds | right; wit (SRef 18 0 3) true; fin] |]. lia.
+  - (* 20 *) destruct r as [|r]; [|lia]. cbn [nth]. split; [preds | right; wit (SRef 17 j 0) true; fin].
+  - (* 21: the value of the record *)
+    destruct r as [|r]; [|lia]. cbn [nth]. split; [pmap | right; wmap (SRef 20 0 0) 0; fin].
+  - (* 22: the window after the write *)
+    destruct r as [|r]; [cbn [nth]; split; [preds | right; wit vref true; fin] |].
+    destruct r as [|r]; [cbn [nth]; split; [preds | right; wit (SRef 8 (j + 4) 0) false; fin] |].
+    destruct r as [|r]; [cbn [nth]; split; [preds | right; wit (SRef 22 j 0) true; fin] |]. lia.
+  - (* 23: the bank index *)
+    destruct r as [|r]; [cbn [nth]; split; [preds | right; wit (req HO) true; fin] |].
+    destruct r as [|r]; [cbn [nth]; split; [preds | right; wit (req HO) false; fin] |].
+    destruct r as [|r]; [cbn [nth]; split; [preds | right; wit (SRef 23 j 0) true; fin] |]. lia.
+  - (* 24 *)
+    destruct r as [|r]; [cbn [nth]; split; [preds | right; wit (SRef 8 ARM 0) true; fin] |].
+    destruct r as [|r]; [cbn [nth]; split; [preds | right; wit (req CB) true; fin] |]. lia.
+  - (* 25: the bits of the banks *)
+    assert (Hk : j / Nb < K) by (apply Nat.Div0.div_lt_upper_bound; nia).
+    assert (Hp : j mod Nb < Nb) by (apply Nat.mod_upper_bound; unfold N; nia).
+    assert (Hs : j mod Nb / Bw < S0) by (apply Nat.Div0.div_lt_upper_bound; unfold N in *; nia).
+    assert (Hm : j mod Nb mod Bw < Bw) by (apply Nat.mod_upper_bound; lia).
+    destruct r as [|r]; [cbn [nth]; split; [preds | right; wit (SRef 24 (j / Nb) 0) true; fin] |].
+    destruct r as [|r]; [cbn [nth]; split; [preds | right; wit (SRef 24 (j / Nb) 1) false; fin] |].
+    destruct r as [|r]; [cbn [nth]; split; [preds | right; wit (SRef 24 (j / Nb) 1) false; fin] |].
+    destruct r as [|r]; [cbn [nth]; split; [preds | right; wit (SRef 25 j 1) true; fin] |]. lia.
+  - (* 26: the heads of the banks *)
+    destruct r as [|r]; [cbn [nth]; split; [preds | right; wit (req RA) true; fin] |].
+    destruct r as [|r]; [cbn [nth]; split; [preds | right; wit (req RA) false; fin] |].
+    destruct r as [|r]; [cbn [nth]; split; [preds | right; wit (SRef 26 j 1) true; fin] |].
+    destruct r as [|r]; [cbn [nth]; split; [preds | right; wit (SRef 26 j 2) true; fin] |]. lia.
+  - (* 27: the slot heads *)
+    assert (Hk : j / S0 < K) by (apply Nat.Div0.div_lt_upper_bound; nia).
+    assert (Hm1 : j mod S0 < S0) by (apply Nat.mod_upper_bound; lia).
+    assert (Hm2 : (j mod S0 + S0 - 1) mod S0 < S0) by (apply Nat.mod_upper_bound; lia).
+    destruct r as [|r]; [cbn [nth]; split; [preds | right; wit (SRef 26 (j / S0) 3) true; fin] |].
+    destruct r as [|r]; [cbn [nth]; split; [preds | right; wit (SRef 26 (j / S0) 3) false; fin] |].
+    destruct r as [|r]; [cbn [nth]; destruct (Nat.eqb (j mod S0) 0);
+                         split; [preds | right; wit (SRef 26 (j / S0) 0) true; fin | preds | right; wit (SRef 26 (j / S0) 0) true; fin] |].
+    destruct r as [|r]; [cbn [nth]; split; [preds | right; wit (SRef 27 j 0) true; fin] |]. lia.
+  - (* 28: the bit heads *)
+    assert (Hk : j / Bw < K) by (apply Nat.Div0.div_lt_upper_bound; nia).
+    assert (Hm1 : j mod Bw < Bw) by (apply Nat.mod_upper_bound; lia).
+    assert (Hm2 : (j mod Bw + Bw - 1) mod Bw < Bw) by (apply Nat.mod_upper_bound; lia).
+    destruct r as [|r]; [cbn [nth]; split; [preds | right; wit (SRef 26 (j / Bw) 1) true; fin] |].
+    destruct r as [|r]; [cbn [nth]; split; [preds | right; wit (SRef 26 (j / Bw) 0) false; fin] |].
+    destruct r as [|r]; [cbn [nth]; destruct (Nat.eqb (j mod Bw) 0);
+                         split; [preds | right; wit (SRef 26 (j / Bw) 0) true; fin | preds | right; wit (SRef 26 (j / Bw) 0) true; fin] |].
+    destruct r as [|r]; [cbn [nth]; split; [preds | right; wit (SRef 28 j 0) true; fin] |]. lia.
+  - (* 29: the moves of the tapes *)
+    destruct r as [|r]; [cbn [nth]; split; [preds | right; wit (SRef 8 CPY 0) true; fin] |].
+    destruct r as [|r]; [cbn [nth]; split; [preds | right; wit (req CT) true; fin] |].
+    destruct r as [|r]; [cbn [nth]; split; [preds | right; wit (req RR) true; fin] |].
+    destruct r as [|r]; [cbn [nth]; split; [preds | right; wit (req RC) true; fin] |].
+    destruct r as [|r]; [cbn [nth]; split; [preds | right; wit (SRef 29 j 2) true; fin] |].
+    destruct r as [|r]; [cbn [nth]; split; [preds | right; wit (req RR) false; fin] |].
+    destruct r as [|r]; [cbn [nth]; split; [preds | right; wit (req RC) false; fin] |].
+    destruct r as [|r]; [cbn [nth]; split; [preds | right; wit (SRef 29 j 5) true; fin] |]. lia.
+  - (* 30: the cells of the tapes *)
+    assert (Hk : j / L < K) by (apply Nat.Div0.div_lt_upper_bound; nia).
+    assert (Hm1 : j mod L < L) by (apply Nat.mod_upper_bound; lia).
+    destruct r as [|r]; [cbn [nth]; split; [preds | right; wit (SRef 29 (j / L) 0) true; fin] |].
+    destruct r as [|r]; [cbn [nth]; split; [preds | right; wit (SRef 29 (j / L) 1) false; fin] |].
+    destruct r as [|r]; [cbn [nth]; split; [preds | right; wit (SRef 29 (j / L) 1) false; fin] |].
+    destruct r as [|r]; [cbn [nth]; split; [preds | right; wit (SRef 30 j 1) true; fin] |]. lia.
+  - (* 31: the tape heads *)
+    assert (Hk : j / L < K) by (apply Nat.Div0.div_lt_upper_bound; nia).
+    assert (Hm1 : j mod L < L) by (apply Nat.mod_upper_bound; lia).
+    assert (Hm2 : (j mod L + L - 1) mod L < L) by (apply Nat.mod_upper_bound; lia).
+    destruct r as [|r]; [cbn [nth]; split; [preds | right; wit (SRef 29 (j / L) 7) true; fin] |].
+    destruct r as [|r]; [cbn [nth]; split; [preds | right; wit (SRef 29 (j / L) 7) false; fin] |].
+    destruct r as [|r]; [cbn [nth]; destruct (Nat.eqb (j mod L) 0);
+                         split; [preds | right; wit (SRef 29 (j / L) 4) true; fin | preds | right; wit (SRef 29 (j / L) 4) true; fin] |].
+    destruct r as [|r]; [cbn [nth]; split; [preds | right; wit (SRef 31 j 0) true; fin] |]. lia.
+Qed.
+
+(* ---- the next values -------------------------------------------------------------------------------------------- *)
+Lemma dm : forall m n, n <> 0 -> m / n * n + m mod n = m.
+Proof. intros m n H. pose proof (Nat.div_mod m n H). lia. Qed.
+
+Lemma Nb_ge : 20 <= Nb.
+Proof. unfold N. pose proof B_ge. nia. Qed.
+
+Lemma out_win : forall c, c < nw al -> out_ref al K S0 L c = if c + 4 <=? HO then zero else SRef 22 c 2.
+Proof. intros c Hc. unfold out_ref. destruct (Nat.ltb_spec c (nw al)); [reflexivity | lia]. Qed.
+
+Lemma out_kap : forall k, k < K -> out_ref al K S0 L (nw al + k) = SRef 23 k 2.
+Proof.
+  intros k Hk. unfold out_ref. destruct (Nat.ltb_spec (nw al + k) (nw al)); [lia|].
+  destruct (Nat.ltb_spec (nw al + k) (nw al + K)); [|lia]. f_equal. lia.
+Qed.
+
+Lemma out_bank : forall k q, k < K -> q < bsz al S0 ->
+  out_ref al K S0 L (nw al + K + k * bsz al S0 + q) =
+  if q <? Nb then SRef 25 (k * Nb + q) 3
+  else if q <? Nb + S0 then SRef 27 (k * S0 + (q - Nb)) 3 else SRef 28 (k * Bw + (q - Nb - S0)) 3.
+Proof.
+  intros k q Hk Hq. pose proof (bank_lt k q Hk Hq). unfold out_ref. cbv zeta.
+  destruct (Nat.ltb_spec (nw al + K + k * bsz al S0 + q) (nw al)); [lia|].
+  destruct (Nat.ltb_spec (nw al + K + k * bsz al S0 + q) (nw al + K)); [lia|].
+  destruct (Nat.ltb_spec (nw al + K + k * bsz al S0 + q) (nw al + K + K * bsz al S0)); [|lia].
+  replace (nw al + K + k * bsz al S0 + q - (nw al + K)) with (k * bsz al S0 + q) by lia.
+  destruct (divmod_pair k q _ Hq) as [-> ->]. reflexivity.
+Qed.
+
+Lemma out_tape : forall k q, k < K -> q < 2 * L ->
+  out_ref al K S0 L (otape al K S0 L k + q) = if q <? L then SRef 30 (k * L + q) 3 else SRef 31 (k * L + (q - L)) 3.
+Proof.
+  intros k q Hk Hq. destruct (tape_shape k q Hk Hq) as (H1 & H2 & _).
+  assert (E : otape al K S0 L k + q - (nw al + K + K * bsz al S0) = k * (2 * L) + q) by (unfold otape; lia).
+  unfold out_ref. cbv zeta.
+  destruct (Nat.ltb_spec (otape al K S0 L k + q) (nw al)); [lia|].
+  destruct (Nat.ltb_spec (otape al K S0 L k + q) (nw al + K)); [lia|].
+  destruct (Nat.ltb_spec (otape al K S0 L k + q) (nw al + K + K * bsz al S0)); [lia|].
+  rewrite E. destruct (divmod_pair k q _ Hq) as [-> ->]. reflexivity.
+Qed.
+
+(* every state bit is a window cell, a line of the bank index, a bit of a bank or a cell of a tape *)
+Lemma state_cases : forall i, i < nP ->
+  i < nw al
+  \/ (exists k, k < K /\ i = nw al + k)
+  \/ (exists k q, k < K /\ q < bsz al S0 /\ i = nw al + K + k * bsz al S0 + q)
+  \/ (exists k q, k < K /\ q < 2 * L /\ i = otape al K S0 L k + q).
+Proof.
+  intros i Hi. unfold nst in Hi.
+  destruct (Nat.lt_ge_cases i (nw al)) as [H|H]; [left; exact H|]. right.
+  destruct (Nat.lt_ge_cases i (nw al + K)) as [H'|H']; [left; exists (i - nw al); split; lia|]. right.
+  assert (Hz : bsz al S0 <> 0) by (unfold bsz; lia).
+  destruct (Nat.lt_ge_cases i (nw al + K + K * bsz al S0)) as [H''|H''].
+  - left. exists ((i - (nw al + K)) / bsz al S0), ((i - (nw al + K)) mod bsz al S0).
+    pose proof (dm (i - (nw al + K)) (bsz al S0) Hz).
+    split; [apply Nat.Div0.div_lt_upper_bound; nia|]. split; [apply Nat.mod_upper_bound; exact Hz|]. lia.
+  - right. exists ((i - (nw al + K + K * bsz al S0)) / (2 * L)), ((i - (nw al + K + K * bsz al S0)) mod (2 * L)).
+    pose proof (dm (i - (nw al + K + K * bsz al S0)) (2 * L) ltac:(lia)).
+    split; [apply Nat.Div0.div_lt_upper_bound; nia|]. split; [apply Nat.mod_upper_bound; lia|]. unfold otape. lia.
+Qed.
+
+Ltac bk := cbn [phys_blocks nth bcount bsize bshape blk_zero blk_rec blk_fld blk_tc blk_ac blk_head blk_dec blk_term
+  blk_xs blk_pos blk_neg blk_mt blk_nt blk_pge blk_b4 blk_bge blk_vand blk_v blk_xhat blk_kap blk_bw blk_q blk_hq blk_hs
+  blk_hj blk_tw blk_d blk_t track mux3 headsel].
+
+Ltac vld := cbn [valid]; rewrite phys_length; bk; repeat split; unfold nw in *; nia.
+
+Lemma out_valid : forall i, i < nP -> valid bsP nP (out_ref al K S0 L i).
+Proof.
+  intros i Hi. pose proof W_ge16. pose proof B_ge. pose proof Nb_ge.
+  destruct (state_cases i Hi) as [Hw|[(k & Hk & ->)|[(k & q & Hk & Hq & ->)|(k & q & Hk & Hq & ->)]]].
+  - rewrite out_win by exact Hw. destruct (_ <=? _); unfold zero; vld.
+  - rewrite out_kap by exact Hk. vld.
+  - rewrite out_bank by assumption. unfold bsz in Hq.
+    destruct (Nat.ltb_spec q Nb); [vld|]. destruct (Nat.ltb_spec q (Nb + S0)); vld.
+  - rewrite out_tape by assumption. destruct (Nat.ltb_spec q L); vld.
+Qed.
+
+(* every next value is read at layer 20, after the last *)
+Lemma cl_out : forall i, i < nP -> clp (out_ref al K S0 L i) = 20.
+Proof.
+  intros i Hi.
+  destruct (state_cases i Hi) as [Hw|[(k & Hk & ->)|[(k & q & Hk & Hq & ->)|(k & q & Hk & Hq & ->)]]].
+  - rewrite out_win by exact Hw. destruct (Nat.leb_spec (i + 4) HO); [reflexivity|]. cbn [clp].
+    destruct (Nat.leb_spec (i + 4) HO); [lia | reflexivity].
+  - rewrite out_kap by exact Hk. reflexivity.
+  - rewrite out_bank by assumption. destruct (q <? Nb); [reflexivity|]. destruct (q <? Nb + S0); reflexivity.
+  - rewrite out_tape by assumption. destruct (q <? L); reflexivity.
+Qed.
+
+Lemma nd_out : forall i, i < nP -> ndp (out_ref al K S0 L i) = true.
+Proof.
+  intros i Hi.
+  destruct (state_cases i Hi) as [Hw|[(k & Hk & ->)|[(k & q & Hk & Hq & ->)|(k & q & Hk & Hq & ->)]]].
+  - rewrite out_win by exact Hw. destruct (_ <=? _); reflexivity.
+  - rewrite out_kap by exact Hk. reflexivity.
+  - rewrite out_bank by assumption. destruct (q <? Nb); [reflexivity|]. destruct (q <? Nb + S0); reflexivity.
+  - rewrite out_tape by assumption. destruct (q <? L); reflexivity.
+Qed.
+
+(* ---- every signal but a next value has a contributing reader at its last reading layer ------------------------ *)
+Ltac rdr B J R pol := right; exists B, J, R, (if pol then 1%Z else (-1)%Z); split; [vld | split; [reflexivity | split]].
+Ltac su := unfold sunit; bk; cbn [nth].
+Ltac lin pol := first [apply (and_in _ _ pol) | apply (or_in _ _ pol)]; lit_in.
+Ltac lmap s := apply (or_in _ _ true); apply in_map_iff; exists s; split; [reflexivity | apply in_seq; lia].
+
+Theorem phys_reader : forall x, valid bsP nP x -> (forall i, i < nP -> out_ref al K S0 L i <> x) ->
+  clp x = 0 \/ exists b j r z, valid bsP nP (SRef b j r) /\ ndp (SRef b j r) = true /\ In (x, z) (sin (sunit bsP b j r))
+                               /\ cdp (SRef b j r) = clp x.
+Proof.
+  intros x Hx Hno. pose proof B_ge as HB. pose proof W_ge16 as HW. pose proof Nb_ge as HN.
+  destruct x as [i|b j r].
+  - (* the state bits *)
+    cbn [valid] in Hx.
+    destruct (state_cases i Hx) as [Hw|[(k & Hk & ->)|[(k & q & Hk & Hq & ->)|(k & q & Hk & Hq & ->)]]].
+    + rdr 22 i 1 true; [su; lin true | fin].
+    + rdr 26 k 3 true;
+        replace (SIn (nw al + k)) with (act al K k) by (unfold act, okap; rewrite Nat.mod_small by lia; reflexivity);
+        [su; lin true | fin].
+    + destruct (Nat.lt_ge_cases q Nb) as [Q1|Q1]; [|destruct (Nat.lt_ge_cases q (Nb + S0)) as [Q2|Q2]].
+      * rdr 25 (k * Nb + q) 2 true; replace (SIn (nw al + K + k * bsz al S0 + q)) with (qref al K S0 k q) by reflexivity.
+        -- su. destruct (divmod_pair k q _ Q1) as [E1 E2]. rewrite E1, E2. lin true.
+        -- fin.
+      * assert (Q : q - Nb < S0) by lia.
+        rdr 27 (k * S0 + (q - Nb)) 1 true;
+          replace (SIn (nw al + K + k * bsz al S0 + q)) with (href al K S0 k (q - Nb)) by (unfold href, obank; f_equal; lia).
+        -- su. destruct (divmod_pair k (q - Nb) S0 Q) as [E1 E2]. rewrite E1, E2. lin true.
+        -- fin.
+      * assert (Q : q - Nb - S0 < Bw) by (unfold bsz in Hq; lia).
+        rdr 28 (k * Bw + (q - Nb - S0)) 1 true;
+          replace (SIn (nw al + K + k * bsz al S0 + q)) with (jref al K S0 k (q - Nb - S0)) by (unfold jref, obank; f_equal; lia).
+        -- su. destruct (divmod_pair k (q - Nb - S0) Bw Q) as [E1 E2]. rewrite E1, E2. lin true.
+        -- fin.
+    + destruct (Nat.lt_ge_cases q L) as [Q|Q].
+      * rdr 30 (k * L + q) 2 true; replace (SIn (otape al K S0 L k + q)) with (dref al K S0 L k q) by reflexivity.
+        -- su. destruct (divmod_pair k q L Q) as [E1 E2]. rewrite E1, E2. lin true.
+        -- fin.
+      * assert (Q' : q - L < L) by lia.
+        rdr 31 (k * L + (q - L)) 1 true;
+          replace (SIn (otape al K S0 L k + q)) with (tref al K S0 L k (q - L)) by (unfold tref; f_equal; lia).
+        -- su. destruct (divmod_pair k (q - L) L Q') as [E1 E2]. rewrite E1, E2. lin true.
+        -- fin.
+  - (* the units *)
+    destruct Hx as (Hb & Hj & Hr). rewrite phys_length in Hb.
+    split32 b; blk Hj Hr.
+    + (* 0 *) exfalso. apply (Hno 0); [unfold nst, nw; lia|]. rewrite out_win by (unfold nw; lia).
+      assert (j = 0) by lia. assert (r = 0) by lia. subst. reflexivity.
+    + (* 1 *) assert (Hk : j / Bw < K) by (apply Nat.Div0.div_lt_upper_bound; nia).
+      assert (Hm : j mod Bw < Bw) by (apply Nat.mod_upper_bound; lia).
+      destruct (Nat.lt_ge_cases r S0) as [R|R].
+      * rdr 1 j S0 true; [su; rewrite nth_map_seq_last; lmap r | fin].
+      * assert (r = S0) by lia. subst r.
+        rdr 2 (j mod Bw) (j / Bw) true; [su; rewrite nth_map_seq_app by exact Hk; rewrite dm by lia; lin true | fin].
+    + (* 2 *) destruct (Nat.lt_ge_cases r K) as [R|R].
+      * rdr 2 j K true; [su; rewrite nth_map_seq_last; lmap r | fin].
+      * assert (r = K) by lia. subst r. assert (Hj' : j < 8 + 3 * al) by (unfold B, recw in Hj; lia).
+        destruct (Nat.lt_ge_cases j 8) as [J|J].
+        -- destruct j as [|[|[|[|[|[|[|[|j]]]]]]]]; [| | | | | | | | lia].
+           ++ rdr 13 0 0 false; [su; lin false | fin].
+           ++ rdr 13 0 0 true; [su; lin true | fin].
+           ++ rdr 13 1 0 false; [su; lin false | fin].
+           ++ rdr 13 1 0 true; [su; lin true | fin].
+           ++ rdr 19 0 1 false; [su; lin false | fin].
+           ++ rdr 18 0 0 true; [su; lin true | fin].
+           ++ rdr 18 0 0 true; [su; lin true | fin].
+           ++ rdr 18 0 0 true; [su; lin true | fin].
+        -- destruct (Nat.lt_ge_cases j (8 + al)) as [J1|J1]; [|destruct (Nat.lt_ge_cases j (8 + 2 * al)) as [J2|J2]].
+           ++ rdr 6 0 0 (bitsof al 0 (j - 8)); [su | fin].
+              apply (and_in _ _ (bitsof al 0 (j - 8))). apply in_map_iff. exists (j - 8).
+              split; [unfold fld; f_equal; f_equal; lia | apply in_seq; lia].
+           ++ rdr 7 0 0 (bitsof al 0 (j - 8 - al)); [su | fin].
+              apply (and_in _ _ (bitsof al 0 (j - 8 - al))). apply in_map_iff. exists (j - 8 - al).
+              split; [unfold fld; f_equal; f_equal; lia | apply in_seq; lia].
+           ++ rdr 8 2 0 (bitsof al 2 (j - 8 - 2 * al)); [su | fin].
+              apply (and_in _ _ (bitsof al 2 (j - 8 - 2 * al))). apply in_map_iff. exists (j - 8 - 2 * al).
+              split; [unfold fld; f_equal; f_equal; lia | apply in_seq; lia].
+    + (* 3 *) destruct (Nat.lt_ge_cases r L) as [R|R].
+      * rdr 3 j L true; [su; rewrite nth_map_seq_last; lmap r | fin].
+      * assert (r = L) by lia. subst r. rdr 5 0 j true; [su; rewrite nth_map_seq_app by exact Hj; cbn [headsel]; lin true | fin].
+    + (* 4 *) destruct (Nat.lt_ge_cases r Bw) as [R|R].
+      * rdr 4 j (B al) true; [su; rewrite nth_map_seq_last; lmap r | fin].
+      * assert (r = Bw) by lia. subst r. rdr 5 1 j true; [su; rewrite nth_map_seq_app by exact Hj; cbn [headsel]; lin true | fin].
+    + (* 5 *) destruct (Nat.lt_ge_cases r K) as [R|R].
+      * rdr 5 j K true; [su; rewrite nth_map_seq_last; lmap r | fin].
+      * assert (r = K) by lia. subst r. destruct j as [|[|[|j]]]; [| | | lia].
+        -- rdr 9 1 0 true; [su; lin true | fin].
+        -- rdr 9 2 0 true; [su; lin true | fin].
+        -- rdr 9 3 0 true; [su; lin true | fin].
+    + (* 6 *) destruct r as [|r]; [|lia]. rdr 9 j 0 true; [su; lin true | fin].
+    + (* 7 *) destruct r as [|r]; [|lia]. rdr 11 j 0 true; [su; lin true | fin].
+    + (* 8 *) destruct r as [|r]; [|lia].
+      destruct (Nat.lt_ge_cases j 2) as [J|J]; [left; cbn [clp]; destruct (Nat.ltb_spec j 2); [reflexivity | lia]|].
+      destruct (Nat.lt_ge_cases j 4) as [J'|J'].
+      * destruct j as [|[|[|[|j]]]]; try lia.
+        -- rdr 24 0 0 true; [su; lin true | fin].
+        -- rdr 29 0 0 true; [su; lin true | fin].
+      * rdr 22 (j - 4) 0 true; [su; replace (j - 4 + 4) with j by lia; lin true | fin].
+    + (* 9 *) destruct r as [|r]; [|lia]. rdr 10 0 0 true; [su; lmap j | fin].
+    + (* 10 *) destruct j as [|j]; [|lia]. destruct r as [|r]; [|lia]. rdr 15 0 0 true; [su; lin true | fin].
+    + (* 11 *) destruct r as [|r]; [|lia]. rdr 12 0 0 true; [su; lmap j | fin].
+    + (* 12 *) destruct j as [|j]; [|lia]. destruct r as [|r]; [|lia]. rdr 15 1 0 true; [su; lin true | fin].
+    + (* 13 *) destruct r as [|r]; [|lia]. rdr 15 j 0 true; [su; lin true | fin].
+    + (* 14 *) destruct r as [|r]; [|lia]. rdr 16 j 0 true; [su; lin true | fin].
+    + (* 15 *) destruct r as [|r]; [|lia]. right. exists 17, 0, 0, 1%Z. split; [vld|]. split; [reflexivity|].
+      split; [su; cbn [sin]; destruct j as [|[|j]]; [left; reflexivity | right; left; reflexivity | lia] | fin].
+    + (* 16 *) destruct r as [|r]; [|lia]. right. exists 17, 0, 0, (-1)%Z. split; [vld|]. split; [reflexivity|].
+      split; [su; cbn [sin]; destruct j as [|[|j]]; [right; right; left; reflexivity | right; right; right; left; reflexivity | lia]
+             | fin].
+    + (* 17 *) destruct r as [|r]; [|lia]. rdr 20 j 0 true; [su; lin true | fin].
+    + (* 18 *) destruct j as [|j]; [|lia]. destruct r as [|[|[|[|r]]]]; [| | | | lia].
+      * rdr 19 0 1 true; [su; lin true | fin].
+      * rdr 19 0 2 true; [su; lin true | fin].
+      * rdr 19 0 3 true; [su; lin true | fin].
+      * rdr 19 0 4 true; [su; lin true | fin].
+    + (* 19 *) destruct j as [|j]; [|lia]. destruct r as [|[|[|[|[|r]]]]]; [| | | | | lia].
+      * rdr 20 2 0 true; [su; lin true | fin].
+      * rdr 20 1 0 true; [su; lin true | fin].
+      * rdr 20 0 0 true; [su; lin true | fin].
+      * rdr 20 3 0 true; [su; lin true | fin].
+      * rdr 20 4 0 true; [su; lin true | fin].
+    + (* 20 *) destruct r as [|r]; [|lia]. rdr 21 0 0 true; [su; lmap j | fin].
+    + (* 21 *) destruct j as [|j]; [|lia]. destruct r as [|r]; [|lia]. rdr 25 0 1 true; [su; lin true | fin].
+    + (* 22 *) destruct r as [|[|[|r]]]; [| | | lia].
+      * rdr 22 j 2 true; [su; lin true | fin].
+      * rdr 22 j 2 true; [su; lin true | fin].
+      * destruct (Nat.leb_spec (j + 4) HO) as [Jr|Jr].
+        -- unfold HO in Jr.
+           assert (Hc : j = 0 \/ j = 1 \/ j = 2 \/ j = 3 \/ j = 4 \/ j = 5 \/ j = 6 \/ j = 7 \/ j = 8) by lia.
+           destruct Hc as [->|[->|[->|[->|[->|[->|[->|[->| ->]]]]]]]].
+           ++ rdr 29 0 5 true; [su; lin true | fin].
+           ++ rdr 26 0 1 true; [su; lin true | fin].
+           ++ rdr 29 0 6 true; [su; lin true | fin].
+           ++ rdr 29 0 2 true; [su; lin true | fin].
+           ++ rdr 26 0 0 true; [su; lin true | fin].
+           ++ rdr 29 0 3 true; [su; lin true | fin].
+           ++ rdr 24 0 1 true; [su; lin true | fin].
+           ++ rdr 29 0 1 true; [su; lin true | fin].
+           ++ rdr 23 0 0 true; [su; lin true | fin].
+        -- exfalso. apply (Hno j); [unfold nst; lia|]. rewrite out_win by assumption.
+           destruct (Nat.leb_spec (j + 4) HO); [lia | reflexivity].
+    + (* 23 *) destruct r as [|[|[|r]]]; [| | | lia].
+      * rdr 23 j 2 true; [su; lin true | fin].
+      * rdr 23 j 2 true; [su; lin true | fin].
+      * exfalso. apply (Hno (nw al + j)); [unfold nst; lia | apply out_kap; exact Hj].
+    + (* 24 *) destruct r as [|[|r]]; [| | lia].
+      * rdr 25 (j * Nb) 0 true; [su; rewrite Nat.div_mul by lia; lin true | fin].
+      * rdr 25 (j * Nb) 1 false; [su; rewrite Nat.div_mul by lia; lin false | fin].
+    + (* 25 *) assert (Hk : j / Nb < K) by (apply Nat.Div0.div_lt_upper_bound; nia).
+      assert (Hp : j mod Nb < Nb) by (apply Nat.mod_upper_bound; lia).
+      destruct r as [|[|[|[|r]]]]; [| | | | lia].
+      * rdr 25 j 1 true; [su; lin true | fin].
+      * rdr 25 j 3 true; [su; lin true | fin].
+      * rdr 25 j 3 true; [su; lin true | fin].
+      * exfalso. apply (Hno (nw al + K + j / Nb * bsz al S0 + j mod Nb)).
+        -- pose proof (bank_lt (j / Nb) (j mod Nb) Hk ltac:(unfold bsz; lia)). unfold nst. lia.
+        -- rewrite out_bank by (unfold bsz; lia). destruct (Nat.ltb_spec (j mod Nb) Nb); [|lia]. rewrite dm by lia. reflexivity.
+    + (* 26 *) destruct r as [|[|[|[|r]]]]; [| | | | lia].
+      * rdr 27 (j * S0) 1 false; [su; rewrite Nat.div_mul by lia; lin false | fin].
+      * rdr 26 j 2 true; [su; lin true | fin].
+      * rdr 26 j 3 true; [su; lin true | fin].
+      * rdr 27 (j * S0) 0 true; [su; rewrite Nat.div_mul by lia; lin true | fin].
+    + (* 27 *) assert (Hk : j / S0 < K) by (apply Nat.Div0.div_lt_upper_bound; nia).
+      assert (Hs : j mod S0 < S0) by (apply Nat.mod_upper_bound; lia).
+      destruct r as [|[|[|[|r]]]]; [| | | | lia].
+      * rdr 27 j 3 true; [su; lin true | fin].
+      * rdr 27 j 3 true; [su; lin true | fin].
+      * rdr 27 j 3 true; [su; lin true | fin].
+      * exfalso. apply (Hno (nw al + K + j / S0 * bsz al S0 + (Nb + j mod S0))).
+        -- pose proof (bank_lt (j / S0) (Nb + j mod S0) Hk ltac:(unfold bsz; lia)). unfold nst. lia.
+        -- rewrite out_bank by (unfold bsz; lia). destruct (Nat.ltb_spec (Nb + j mod S0) Nb); [lia|].
+           destruct (Nat.ltb_spec (Nb + j mod S0) (Nb + S0)); [|lia].
+           replace (Nb + j mod S0 - Nb) with (j mod S0) by lia. rewrite dm by lia. reflexivity.
+    + (* 28 *) assert (Hk : j / Bw < K) by (apply Nat.Div0.div_lt_upper_bound; nia).
+      assert (Hs : j mod Bw < Bw) by (apply Nat.mod_upper_bound; lia).
+      destruct r as [|[|[|[|r]]]]; [| | | | lia].
+      * rdr 28 j 3 true; [su; lin true | fin].
+      * rdr 28 j 3 true; [su; lin true | fin].
+      * rdr 28 j 3 true; [su; lin true | fin].
+      * exfalso. apply (Hno (nw al + K + j / Bw * bsz al S0 + (Nb + S0 + j mod Bw))).
+        -- pose proof (bank_lt (j / Bw) (Nb + S0 + j mod Bw) Hk ltac:(unfold bsz; lia)). unfold nst. lia.
+        -- rewrite out_bank by (unfold bsz; lia). destruct (Nat.ltb_spec (Nb + S0 + j mod Bw) Nb); [lia|].
+           destruct (Nat.ltb_spec (Nb + S0 + j mod Bw) (Nb + S0)); [lia|].
+           replace (Nb + S0 + j mod Bw - Nb - S0) with (j mod Bw) by lia. rewrite dm by lia. reflexivity.
+    + (* 29 *) destruct r as [|[|[|[|[|[|[|[|r]]]]]]]]; [| | | | | | | | lia].
+      * rdr 30 (j * L) 0 true; [su; rewrite Nat.div_mul by lia; lin true | fin].
+      * rdr 30 (j * L) 1 false; [su; rewrite Nat.div_mul by lia; lin false | fin].
+      * rdr 29 j 4 true; [su; lin true | fin].
+      * rdr 29 j 4 true; [su; lin true | fin].
+      * rdr 31 (j * L) 1 false; [su; rewrite Nat.div_mul by lia; lin false | fin].
+      * rdr 29 j 7 true; [su; lin true | fin].
+      * rdr 29 j 7 true; [su; lin true | fin].
+      * rdr 31 (j * L) 0 true; [su; rewrite Nat.div_mul by lia; lin true | fin].
+    + (* 30 *) assert (Hk : j / L < K) by (apply Nat.Div0.div_lt_upper_bound; nia).
+      assert (Hm : j mod L < L) by (apply Nat.mod_upper_bound; lia).
+      destruct r as [|[|[|[|r]]]]; [| | | | lia].
+      * rdr 30 j 1 true; [su; lin true | fin].
+      * rdr 30 j 3 true; [su; lin true | fin].
+      * rdr 30 j 3 true; [su; lin true | fin].
+      * exfalso. apply (Hno (otape al K S0 L (j / L) + j mod L)).
+        -- destruct (tape_shape (j / L) (j mod L) Hk ltac:(lia)) as (H1 & _). exact H1.
+        -- rewrite out_tape by lia. destruct (Nat.ltb_spec (j mod L) L); [|lia]. rewrite dm by lia. reflexivity.
+    + (* 31 *) assert (Hk : j / L < K) by (apply Nat.Div0.div_lt_upper_bound; nia).
+      assert (Hm : j mod L < L) by (apply Nat.mod_upper_bound; lia).
+      destruct r as [|[|[|[|r]]]]; [| | | | lia].
+      * rdr 31 j 3 true; [su; lin true | fin].
+      * rdr 31 j 3 true; [su; lin true | fin].
+      * rdr 31 j 3 true; [su; lin true | fin].
+      * exfalso. apply (Hno (otape al K S0 L (j / L) + (L + j mod L))).
+        -- destruct (tape_shape (j / L) (L + j mod L) Hk ltac:(lia)) as (H1 & _). exact H1.
+        -- rewrite out_tape by lia. destruct (Nat.ltb_spec (L + j mod L) L); [lia|].
+           replace (L + j mod L - L) with (j mod L) by lia. rewrite dm by lia. reflexivity.
+Qed.
+
+(* ---- depth, contribution and last readers of the levelized ring network ------------------------------------- *)
+Lemma phys_wf' : wf bsP nP.
+Proof. apply phys_wf; lia. Qed.
+
+Lemma phys_cd_rec : forall b j r, valid bsP nP (SRef b j r) ->
+  cdp (SRef b j r) = S (maxl (map (fun p => cdp (fst p)) (sin (sunit bsP b j r)))).
+Proof.
+  intros b j r Hv. destruct (phys_unit_ok b j r Hv) as [Hall [[E C]|Hex]].
+  - rewrite E. exact C.
+  - apply cd_rec; [intros p z Hin; exact (proj1 (Hall p z Hin)) | exact Hex].
+Qed.
+
+Theorem phys_dep : forall x, valid bsP nP x -> dep nP (phys_units al K S0 L) (idx nP bsP x) = cdp x.
+Proof. exact (dep_cd bsP nP phys_wf' cdp (fun i => eq_refl) phys_cd_rec). Qed.
+
+Lemma cdp_le : forall x, cdp x <= 19.
+Proof.
+  intros [i|b j r]; cbn [cdp]; [lia|].
+  repeat match goal with |- context [match ?t with _ => _ end] => destruct t end; lia.
+Qed.
+
+(* the step of N^alpha_{K,S,L} has depth 19 *)
+Theorem phys_dmax : dmax nP (phys_units al K S0 L) = 19.
+Proof.
+  apply (dmax_cd bsP nP phys_wf' cdp (fun i => eq_refl) phys_cd_rec 19).
+  - intros b j r _. apply cdp_le.
+  - exists 27, 0, 3. split; [pose proof W_ge16; vld | reflexivity].
+Qed.
+
+Lemma sref_dec : forall x y : sref, {x = y} + {x <> y}.
+Proof. decide equality; apply Nat.eq_dec. Qed.
+
+Lemma out_dec : forall x, {exists i, i < nP /\ out_ref al K S0 L i = x} + {forall i, i < nP -> out_ref al K S0 L i <> x}.
+Proof.
+  intro x. destruct (in_dec sref_dec x (map (out_ref al K S0 L) (seq 0 nP))) as [H|H].
+  - left. apply in_map_iff in H as (i & E & Hi). apply in_seq in Hi. exists i. split; [lia | exact E].
+  - right. intros i Hi E. apply H. apply in_map_iff. exists i. split; [exact E | apply in_seq; lia].
+Qed.
+
+Lemma cl_pos : forall b j r, ndp (SRef b j r) = true -> 1 <= clp (SRef b j r).
+Proof.
+  intros b j r Hn. destruct (Nat.eq_dec b 8) as [->|Hb].
+  - cbn [ndp clp] in *. destruct (Nat.ltb_spec j 2); [discriminate|]. destruct (Nat.ltb_spec j 4); lia.
+  - clear Hn. cbn [clp]. repeat match goal with |- context [match ?t with _ => _ end] => destruct t end; lia.
+Qed.
+
+(* every unit but the decode lines of the output addresses 0 and 1 contributes to a next value *)
+Theorem phys_need : forall b j r, valid bsP nP (SRef b j r) ->
+  need nP (phys_units al K S0 L) (phys_next al K S0 L) (idx nP bsP (SRef b j r)) = ndp (SRef b j r).
+Proof.
+  apply (need_eq bsP nP (out_ref al K S0 L) phys_wf' out_valid ndp).
+  - intros b j r Hv Hn. destruct (out_dec (SRef b j r)) as [(i & Hi & E)|Hno]; [left; exists i; split; assumption|].
+    right. destruct (phys_reader (SRef b j r) Hv Hno) as [Z|(b' & j' & r' & z & Hv' & Hn' & Hin & _)].
+    + pose proof (cl_pos b j r Hn). lia.
+    + exists b', j', r', z. split; [exact Hv'|]. split; [exact Hn' | exact Hin].
+  - intros b j r Hv Hn. split.
+    + intros i Hi E. pose proof (nd_out i Hi) as H. rewrite E, Hn in H. discriminate.
+    + intros b' j' r' z Hv' Hin. destruct (proj1 (phys_unit_ok b' j' r' Hv') (SRef b j r) z Hin) as (_ & _ & H).
+      rewrite Hn in H. discriminate.
+Qed.
+
+(* the last layer that reads each signal *)
+Theorem phys_lam : forall x, valid bsP nP x ->
+  lam nP (phys_units al K S0 L) (phys_next al K S0 L) (idx nP bsP x) = clp x.
+Proof.
+  apply (lam_cl2 bsP nP (out_ref al K S0 L) phys_wf' out_valid cdp phys_dep ndp phys_need 19 phys_dmax clp).
+  - intros b j r p z Hv Hn Hin. exact (proj1 (proj2 (proj1 (phys_unit_ok b j r Hv) p z Hin)) Hn).
+  - exact cl_out.
+  - exact phys_reader.
+Qed.
+
+(* ---- the rows of Lev(N^alpha_{K,S,L}) ---------------------------------------------------------------------------- *)
+Lemma phys_up : forall b j r p z, valid bsP nP (SRef b j r) -> ndp (SRef b j r) = true ->
+  In (p, z) (sin (sunit bsP b j r)) -> cdp (SRef b j r) <= clp p.
+Proof. intros b j r p z Hv Hn Hin. exact (proj1 (proj2 (proj1 (phys_unit_ok b j r Hv) p z Hin)) Hn). Qed.
+
+Lemma phys_next_len : length (phys_next al K S0 L) = nP.
+Proof. unfold phys_next. rewrite length_map, length_seq. reflexivity. Qed.
+
+Lemma nsum_add1 : forall k g, nsum (k + 1) g = nsum k g + g k.
+Proof. intros k g. rewrite Nat.add_1_r. reflexivity. Qed.
+
+Lemma cl_kap : forall k, k < K -> clp (SIn (nw al + k)) = 17.
+Proof. intros k Hk. rewrite <- (cl_act k). unfold act, okap. rewrite Nat.mod_small by exact Hk. reflexivity. Qed.
+
+Lemma cl_bank : forall k q, k < K -> q < bsz al S0 ->
+  clp (SIn (nw al + K + (bsz al S0 * k + q))) = if q <? Nb then 16 else if q <? Nb + S0 then 18 else 16.
+Proof.
+  intros k q Hk Hq. replace (nw al + K + (bsz al S0 * k + q)) with (nw al + K + k * bsz al S0 + q) by lia.
+  pose proof (bank_lt k q Hk Hq). cbn [clp].
+  destruct (Nat.ltb_spec (nw al + K + k * bsz al S0 + q) (nw al)); [lia|].
+  destruct (Nat.ltb_spec (nw al + K + k * bsz al S0 + q) (nw al + K)); [lia|].
+  destruct (Nat.ltb_spec (nw al + K + k * bsz al S0 + q) (nw al + K + K * bsz al S0)); [|lia].
+  rewrite bank_mod by assumption. reflexivity.
+Qed.
+
+Lemma cl_tape : forall k q, k < K -> q < 2 * L ->
+  clp (SIn (nw al + K + K * bsz al S0 + (2 * L * k + q))) = if q <? L then 16 else 17.
+Proof.
+  intros k q Hk Hq. replace (nw al + K + K * bsz al S0 + (2 * L * k + q)) with (otape al K S0 L k + q) by (unfold otape; lia).
+  destruct (Nat.ltb_spec q L) as [Q|Q].
+  - change (SIn (otape al K S0 L k + q)) with (dref al K S0 L k q). apply cl_dref; assumption.
+  - replace (otape al K S0 L k + q) with (otape al K S0 L k + L + (q - L)) by lia.
+    change (SIn (otape al K S0 L k + L + (q - L))) with (tref al K S0 L k (q - L)). apply cl_tref; lia.
+Qed.
+
+(* the state bits: a window cell has rows in layers 1 to 5, a line of the bank index in 1 to 16, a bank bit, a bit head
+   line and a tape cell in 1 to 15, a slot head line in 1 to 17 and a tape head line in 1 to 16 *)
+Lemma rows_state :
+  nsum nP (fun i => nsum 18 (fun l => Nat.b2n (Nat.ltb (cdp (SIn i)) (S l) && Nat.ltb (S l) (clp (SIn i)))))
+  = 5 * nw al + 16 * K + K * (15 * Nb + 17 * S0 + 15 * Bw) + K * (31 * L).
+Proof.
+  unfold nst. rewrite !nsum_split.
+  rewrite (nsum_ext (nw al) _ (fun _ => 5)) by (intros i Hi; rewrite cl_win by exact Hi; reflexivity).
+  rewrite (nsum_ext K _ (fun _ => 16)) by (intros k Hk; rewrite cl_kap by exact Hk; reflexivity).
+  rewrite !nsum_const. rewrite (nsum_mul K (bsz al S0)), (nsum_mul K (2 * L)).
+  rewrite (nsum_ext K _ (fun _ => 15 * Nb + 17 * S0 + 15 * Bw)).
+  2: { intros k Hk.
+       rewrite (nsum_ext (bsz al S0) _ (fun q => if q <? Nb then 15 else if q <? Nb + S0 then 17 else 15)).
+       - unfold bsz. rewrite !nsum_split.
+         rewrite (nsum_ext Nb _ (fun _ => 15)) by (intros q Hq; destruct (Nat.ltb_spec q Nb); [reflexivity | lia]).
+         rewrite (nsum_ext S0 _ (fun _ => 17))
+           by (intros q Hq; destruct (Nat.ltb_spec (Nb + q) Nb); [lia|];
+               destruct (Nat.ltb_spec (Nb + q) (Nb + S0)); [reflexivity | lia]).
+         rewrite (nsum_ext Bw _ (fun _ => 15))
+           by (intros q Hq; destruct (Nat.ltb_spec (Nb + S0 + q) Nb); [lia|];
+               destruct (Nat.ltb_spec (Nb + S0 + q) (Nb + S0)); [lia | reflexivity]).
+         rewrite !nsum_const. lia.
+       - intros q Hq. rewrite cl_bank by assumption. destruct (q <? Nb); [reflexivity|]. destruct (q <? Nb + S0); reflexivity. }
+  rewrite !nsum_const. rewrite (nsum_ext K _ (fun _ => 31 * L)).
+  2: { intros k Hk.
+       rewrite (nsum_ext (2 * L) _ (fun q => if q <? L then 15 else 16)).
+       - replace (2 * L) with (L + L) by lia. rewrite nsum_split.
+         rewrite (nsum_ext L _ (fun _ => 15)) by (intros q Hq; destruct (Nat.ltb_spec q L); [reflexivity | lia]).
+         rewrite nsum_const.
+         rewrite (nsum_ext L _ (fun _ => 16)) by (intros q Hq; destruct (Nat.ltb_spec (L + q) L); [lia | reflexivity]).
+         rewrite !nsum_const. lia.
+       - intros q Hq. rewrite cl_tape by assumption. destruct (q <? L); reflexivity. }
+  rewrite !nsum_const. lia.
+Qed.
+
+(* the units: the rows a unit places in layers 1 to 18, as a unit and as copies *)
+Definition rowsu (x : sref) : nat :=
+  nsum 18 (fun l => Nat.b2n (ndp x && Nat.eqb (cdp x) (S l) || Nat.ltb (cdp x) (S l) && Nat.ltb (S l) (clp x))).
+
+Definition blkrows (b : nat) : nat :=
+  match b with
+  | 0 => 18 | 1 => K * Bw * (S0 + 1) | 2 => Bw * (K + 1) + 1 | 3 => K * (L + 1) | 4 => K * (Bw + 1) | 5 => 3 * K + 5
+  | 6 | 7 => W al + 1 | 8 => 8 * nw al + 2 | 9 | 11 => 2 * W al - 1 | 10 | 12 => 1 | 13 | 14 => 8 | 15 | 16 => 2
+  | 17 => 5 | 18 => 4 | 19 => 26 | 20 => 5 | 21 => 4 | 22 => 9 * 10 + (nw al - 9) * 14 | 23 => 5 * K | 24 => 2 * K
+  | 25 => 13 * (K * Nb) | 26 => 6 * K | 27 => 5 * (K * S0) | 28 => 5 * (K * Bw) | 29 => 8 * K | 30 => 13 * (K * L)
+  | _ => 4 * (K * L)
+  end.
+
+Ltac uv := unfold rowsu; cbn [cdp clp ndp]; unfold HO;
+  repeat (match goal with
+          | |- context [Nat.ltb ?a ?b] => destruct (Nat.ltb_spec a b)
+          | |- context [Nat.leb ?a ?b] => destruct (Nat.leb_spec a b)
+          | |- context [Nat.eqb ?a ?b] => destruct (Nat.eqb_spec a b)
+          end); first [reflexivity | lia].
+
+Ltac cst v := rewrite (nsum_ext _ _ (fun _ => v)); [rewrite nsum_const; lia|]; intros ? ?.
+
+Lemma rows_blk : forall b, b < 32 -> nsum (cnt bsP b) (fun j => nsum (sz bsP b) (fun r => rowsu (SRef b j r))) = blkrows b.
+Proof.
+  intros b Hb. pose proof B_ge as HB. pose proof W_ge16 as HW. pose proof Nb_ge as HN. unfold cnt, sz.
+  split32 b; bk; cbn [blkrows].
+  - reflexivity.
+  - cst (S0 + 1). cst 1. uv.
+  - rewrite (nsum_ext _ _ (fun j => if Nat.eqb j 4 then K + 2 else K + 1)).
+    + rewrite nsum_eq_split by lia. nia.
+    + intros j Hj. rewrite nsum_add1. rewrite (nsum_ext K _ (fun _ => 1)) by (intros r Hr; uv). rewrite nsum_const.
+      assert (E : rowsu (SRef 2 j K) = if Nat.eqb j 4 then 2 else 1) by uv. rewrite E. destruct (Nat.eqb j 4); lia.
+  - cst (L + 1). cst 1. uv.
+  - cst (Bw + 1). cst 1. uv.
+  - rewrite (nsum_ext _ _ (fun j => K + (if Nat.eqb j 1 then 1 else 2))).
+    + cbn [nsum Nat.eqb]. lia.
+    + intros j Hj. rewrite nsum_add1. rewrite (nsum_ext K _ (fun _ => 1)) by (intros r Hr; uv). rewrite nsum_const.
+      assert (E : rowsu (SRef 5 j K) = if Nat.eqb j 1 then 1 else 2) by uv. rewrite E. lia.
+  - rewrite (nsum_ext _ _ (fun j => if Nat.eqb j 2 then 2 else 1)); [rewrite nsum_eq_split by lia; lia|].
+    intros j Hj. cbn [nsum]. uv.
+  - rewrite (nsum_ext _ _ (fun j => if Nat.eqb j 2 then 2 else 1)); [rewrite nsum_eq_split by lia; lia|].
+    intros j Hj. cbn [nsum]. uv.
+  - rewrite (nsum_ext _ _ (fun j => if j <? 4 then (if j <? 2 then 0 else 1) else 8)).
+    + replace (W al) with (4 + nw al) by (unfold nw; lia). rewrite nsum_split. cbn [nsum Nat.ltb Nat.leb].
+      rewrite (nsum_ext (nw al) _ (fun _ => 8)) by (intros i Hi; destruct (Nat.ltb_spec (4 + i) 4); [lia | reflexivity]).
+      rewrite nsum_const. lia.
+    + intros j Hj. cbn [nsum]. uv.
+  - rewrite (nsum_ext _ _ (fun j => if Nat.eqb j 2 then 1 else 2)); [rewrite nsum_eq_split by lia; lia|].
+    intros j Hj. cbn [nsum]. uv.
+  - reflexivity.
+  - rewrite (nsum_ext _ _ (fun j => if Nat.eqb j 2 then 1 else 2)); [rewrite nsum_eq_split by lia; lia|].
+    intros j Hj. cbn [nsum]. uv.
+  - reflexivity.
+  - reflexivity.
+  - reflexivity.
+  - reflexivity.
+  - reflexivity.
+  - reflexivity.
+  - reflexivity.
+  - reflexivity.
+  - reflexivity.
+  - reflexivity.
+  - rewrite (nsum_ext _ _ (fun c => if c <? 9 then 10 else 14)).
+    + rewrite nsum_lt_split by (unfold nw; lia). reflexivity.
+    + intros c Hc. cbn [nsum]. uv.
+  - cst 5. cbn [nsum]. uv.
+  - cst 2. cbn [nsum]. uv.
+  - cst 13. cbn [nsum]. uv.
+  - cst 6. cbn [nsum]. uv.
+  - cst 5. cbn [nsum]. uv.
+  - cst 5. cbn [nsum]. uv.
+  - cst 8. cbn [nsum]. uv.
+  - cst 13. cbn [nsum]. uv.
+  - cst 4. cbn [nsum]. uv.
+Qed.
+
+Lemma rows_units : bsum bsP rowsu + 32 = 28 * W al + Bw + 26 * K + 8 * (K * Bw) + 14 * (K * Nb) + 5 * (K * S0) + 18 * (K * L).
+Proof.
+  unfold bsum. rewrite phys_length. rewrite (nsum_ext 32 _ blkrows) by (intros b Hb; apply rows_blk; exact Hb).
+  cbn [nsum blkrows]. pose proof W_ge16. unfold nw, N. nia.
+Qed.
+
+(* Lev(N^alpha_{K,S,L}) has depth 19 and 34 W + b + 43 K + 24 K b + 30 K N + 23 K S + 51 K L - 56 rows *)
+Theorem phys_lev_depth : length (lev nP (phys_units al K S0 L) (phys_next al K S0 L)) = 19.
+Proof. rewrite length_lev by (rewrite phys_dmax; lia). exact phys_dmax. Qed.
+
+Theorem phys_lev_rows :
+  fold_right Nat.add 0 (map (@length tu) (lev nP (phys_units al K S0 L) (phys_next al K S0 L))) + 56
+  = 34 * W al + Bw + 43 * K + 24 * (K * Bw) + 30 * (K * Nb) + 23 * (K * S0) + 51 * (K * L).
+Proof.
+  rewrite lev_size by exact phys_next_len. rewrite phys_dmax. cbn [Nat.sub].
+  change (phys_units al K S0 L) with (fus bsP nP). change (phys_next al K S0 L) with (fnx bsP nP (out_ref al K S0 L)).
+  rewrite (rows_bsum bsP nP (out_ref al K S0 L) phys_wf' out_valid cdp phys_dep ndp phys_need 19 phys_dmax clp
+             phys_up cl_out phys_reader 18).
+  rewrite rows_state. pose proof rows_units as U. unfold rowsu in U. pose proof W_ge16. unfold nst, bsz, nw in *. nia.
+Qed.
+
+(* ---- the edges of N^alpha_{K,S,L} ------------------------------------------------------------------------------- *)
+Definition edgu (x : sref) : nat := length (sin (usu bsP x)).
+
+Definition blkedges (b : nat) : nat :=
+  match b with
+  | 0 => 0 | 1 => K * Bw * (3 * S0) | 2 => Bw * (3 * K) | 3 => K * (3 * L) | 4 => K * (3 * Bw) | 5 => 3 * (3 * K)
+  | 6 | 7 | 8 => W al * al | 9 | 11 => W al * 2 | 10 | 12 => W al | 13 | 14 | 15 | 16 => 4 | 17 => 20 | 18 => 10
+  | 19 => 9 | 20 => 10 | 21 => 5 | 22 => nw al * 6 | 23 => K * 6 | 24 => K * 4 | 25 => K * Nb * 11 | 26 => K * 9
+  | 27 => K * S0 * 8 + K * (2 * S0 - 1) | 28 => K * Bw * 8 + K * (2 * Bw - 1) | 29 => K * 18 | 30 => K * L * 10
+  | _ => K * L * 8 + K * (2 * L - 1)
+  end.
+
+(* the third unit of a member of a track reads one signal at the first line and two elsewhere *)
+Lemma nsum_track : forall c n, 1 <= n -> nsum (c * n) (fun m => if Nat.eqb (m mod n) 0 then 1 else 2) = c * (2 * n - 1).
+Proof.
+  intros c n Hn. rewrite nsum_mul. rewrite (nsum_ext c _ (fun _ => 2 * n - 1)); [rewrite nsum_const; lia|].
+  intros k Hk. rewrite (nsum_ext n _ (fun q => if Nat.eqb q 0 then 1 else 2)).
+  - rewrite nsum_eq_split by lia. lia.
+  - intros q Hq. replace ((n * k + q) mod n) with q; [reflexivity|]. symmetry. rewrite Nat.mul_comm.
+    exact (proj2 (divmod_pair k q n Hq)).
+Qed.
+
+Ltac ue := unfold edgu, usu, sunit; bk; cbn [nth].
+
+Lemma edges_blk : forall b, b < 32 -> nsum (cnt bsP b) (fun j => nsum (sz bsP b) (fun r => edgu (SRef b j r))) = blkedges b.
+Proof.
+  intros b Hb. pose proof B_ge as HB. pose proof W_ge16 as HW. unfold cnt, sz.
+  split32 b; bk; cbn [blkedges].
+  - reflexivity.
+  - cst (3 * S0). rewrite nsum_add1.
+    rewrite (nsum_ext S0 _ (fun _ => 2)) by (intros r Hr; ue; rewrite nth_map_seq_app by exact Hr; reflexivity).
+    rewrite nsum_const. ue. rewrite nth_map_seq_last. cbn [sin sOR]. rewrite !length_map, length_seq. lia.
+  - cst (3 * K). rewrite nsum_add1.
+    rewrite (nsum_ext K _ (fun _ => 2)) by (intros r Hr; ue; rewrite nth_map_seq_app by exact Hr; reflexivity).
+    rewrite nsum_const. ue. rewrite nth_map_seq_last. cbn [sin sOR]. rewrite !length_map, length_seq. lia.
+  - cst (3 * L). rewrite nsum_add1.
+    rewrite (nsum_ext L _ (fun _ => 2)) by (intros r Hr; ue; rewrite nth_map_seq_app by exact Hr; reflexivity).
+    rewrite nsum_const. ue. rewrite nth_map_seq_last. cbn [sin sOR]. rewrite !length_map, length_seq. lia.
+  - cst (3 * Bw). rewrite nsum_add1.
+    rewrite (nsum_ext Bw _ (fun _ => 2)) by (intros r Hr; ue; rewrite nth_map_seq_app by exact Hr; reflexivity).
+    rewrite nsum_const. ue. rewrite nth_map_seq_last. cbn [sin sOR]. rewrite !length_map, length_seq. lia.
+  - rewrite (nsum_ext _ _ (fun _ => 3 * K)); [rewrite nsum_const; lia|]. intros m Hm. rewrite nsum_add1.
+    rewrite (nsum_ext K _ (fun _ => 2))
+      by (intros r Hr; ue; rewrite nth_map_seq_app by exact Hr; destruct m as [|[|m]]; reflexivity).
+    rewrite nsum_const. ue. rewrite nth_map_seq_last. cbn [sin sOR]. rewrite !length_map, length_seq. lia.
+  - cst al. cbn [nsum]. ue. cbn [sin sAND]. rewrite !length_map, length_seq. reflexivity.
+  - cst al. cbn [nsum]. ue. cbn [sin sAND]. rewrite !length_map, length_seq. reflexivity.
+  - cst al. cbn [nsum]. ue. cbn [sin sAND]. rewrite !length_map, length_seq. reflexivity.
+  - cst 2. cbn [nsum]. ue. reflexivity.
+  - cbn [nsum]. ue. cbn [sin sOR]. rewrite !length_map, length_seq. reflexivity.
+  - cst 2. cbn [nsum]. ue. reflexivity.
+  - cbn [nsum]. ue. cbn [sin sOR]. rewrite !length_map, length_seq. reflexivity.
+  - reflexivity.
+  - reflexivity.
+  - reflexivity.
+  - reflexivity.
+  - reflexivity.
+  - reflexivity.
+  - reflexivity.
+  - reflexivity.
+  - reflexivity.
+  - cst 6. cbn [nsum]. ue. reflexivity.
+  - cst 6. cbn [nsum]. ue. reflexivity.
+  - cst 4. cbn [nsum]. ue. reflexivity.
+  - cst 11. cbn [nsum]. ue. reflexivity.
+  - cst 9. cbn [nsum]. ue. reflexivity.
+  - rewrite (nsum_ext _ _ (fun m => 8 + (if Nat.eqb (m mod S0) 0 then 1 else 2))).
+    + rewrite nsum_add, nsum_const, nsum_track by lia. lia.
+    + intros j Hj. cbn [nsum]. ue. destruct (Nat.eqb (j mod S0) 0); reflexivity.
+  - rewrite (nsum_ext _ _ (fun m => 8 + (if Nat.eqb (m mod Bw) 0 then 1 else 2))).
+    + rewrite nsum_add, nsum_const, nsum_track by lia. lia.
+    + intros j Hj. cbn [nsum]. ue. destruct (Nat.eqb (j mod Bw) 0); reflexivity.
+  - cst 18. cbn [nsum]. ue. reflexivity.
+  - cst 10. cbn [nsum]. ue. reflexivity.
+  - rewrite (nsum_ext _ _ (fun m => 8 + (if Nat.eqb (m mod L) 0 then 1 else 2))).
+    + rewrite nsum_add, nsum_const, nsum_track by lia. lia.
+    + intros j Hj. cbn [nsum]. ue. destruct (Nat.eqb (j mod L) 0); reflexivity.
+Qed.
+
+(* N^alpha_{K,S,L} has 14 K N + 10 K S + 16 K b + 23 K L + 43 K + 3 alpha W + 12 W + 46 edges *)
+Theorem phys_edges : nsum (length (phys_units al K S0 L)) (fun k => length (tin (nth k (phys_units al K S0 L) tu0)))
+  = 14 * (K * Nb) + 10 * (K * S0) + 16 * (K * Bw) + 23 * (K * L) + 43 * K + 3 * al * W al + 12 * W al + 46.
+Proof.
+  change (phys_units al K S0 L) with (fus bsP nP). rewrite (edges_bsum bsP nP (out_ref al K S0 L) phys_wf' out_valid).
+  change (bsum bsP (fun x => length (sin (usu bsP x)))) with (bsum bsP edgu).
+  unfold bsum. rewrite phys_length. rewrite (nsum_ext 32 _ blkedges) by (intros b Hb; apply edges_blk; exact Hb).
+  cbn [nsum blkedges]. pose proof W_ge16. pose proof B_ge. rewrite !Nat.mul_sub_distr_l. unfold nw, N. nia.
+Qed.
+
+End PL.
+
+(* ---- the member that holds the stored host: alpha = 15 and K = 3 ------------------------------------------------- *)
+Theorem phys_lev_rows_15 : forall S0 L, 1 <= S0 -> 1 <= L ->
+  N.of_nat (fold_right Nat.add 0 (map (@length tu) (lev (nst 15 3 S0 L) (phys_units 15 3 S0 L) (phys_next 15 3 S0 L))))
+  = (1118054 + 4839 * N.of_nat S0 + 153 * N.of_nat L)%N.
+Proof.
+  intros S0 L HS HL. pose proof (phys_lev_rows 15 3 S0 L ltac:(lia) ltac:(lia) HS HL) as E.
+  unfold N in E. replace (B 15) with 53 in E by reflexivity. replace (W 15) with (2 ^ 15) in E by reflexivity.
+  apply (f_equal N.of_nat) in E. rewrite !Nat2N.inj_add, !Nat2N.inj_mul, Nat2N.inj_pow in E.
+  change (N.of_nat 2 ^ N.of_nat 15)%N with 32768%N in E. cbn [N.of_nat Pos.of_succ_nat Pos.succ] in E. lia.
+Qed.
+
+(* the member of Theorem 8.7 that holds S: S = G + 5 = 36,085 slots and L = 8 |tau_S| + 64 = 1,927,264 cells *)
+Theorem phys_lev_rows_S :
+  N.of_nat (fold_right Nat.add 0 (map (@length tu)
+    (lev (nst 15 3 (N.to_nat 36085) (N.to_nat 1927264)) (phys_units 15 3 (N.to_nat 36085) (N.to_nat 1927264))
+         (phys_next 15 3 (N.to_nat 36085) (N.to_nat 1927264))))) = 470604761%N.
+Proof. rewrite phys_lev_rows_15 by lia. rewrite !N2Nat.id. reflexivity. Qed.

rocq/Pstar.v

@@ -1,5 +1,5 @@
 (* The constructor P and the self-reproducing program P* on SUBLEQ_A with its device, for every A >= 8:
-   Theorem 4.6, Theorem 5.2 and Proposition 5.4. *)
+   Theorem 4.6, Theorem 5.2 and Proposition 5.3. *)
 From Stdlib Require Import List Bool Arith Lia.
 Import ListNotations.
 From TH Require Import Net Host HostWF HostSem Device.
@@ -958,7 +958,7 @@ Qed.
 
 End Prog.
 
-(* ---- Theorems 4.6 and 5.2 and Proposition 5.4 for SUBLEQ_A, A >= 8 ---------------------------- *)
+(* ---- Theorems 4.6 and 5.2 and Proposition 5.3 for SUBLEQ_A, A >= 8 ---------------------------- *)
 (* The constructor P halts on every recipe after the steps of Theorem 4.6 with the decoded string as output. *)
 Theorem constructor_run : forall A, 8 <= A -> forall ks, Forall tok_ok ks ->
   Reach A (init A (progP A) (recipe ks)) (dsteps ks + 8)
@@ -968,7 +968,7 @@ Proof.
   exact (run_P A HA (tailP A) ltac:(cbn; lia) (recipe ks) eq_refl ks Hks eq_refl).
 Qed.
 
-(* P* halts on every recipe after the steps of Proposition 5.4 with the decoded string and the recipe as
+(* P* halts on every recipe after the steps of Proposition 5.3 with the decoded string and the recipe as
    output; it reads no byte at the end of the tape before it requests the rewind, and requests the rewind
    once, at the end of the tape. *)
 Theorem selfrep_run : forall A, 8 <= A -> forall ks, Forall tok_ok ks ->

rocq/Recipe.v

@@ -0,0 +1,335 @@
+(* Recipes (Section 4): the encoder describe of Lemma 4.4, as src/host.py computes it, with its decoding, its
+   length bound and the case of equality; the optimality of the bound for strings with no two equal adjacent
+   bytes (Proposition 4.3); and the completeness of the recipe language (Lemma 4.2). *)
+From Stdlib Require Import List Bool Arith Lia.
+Import ListNotations.
+From TH Require Import Net Host HostWF HostSem Device Pstar.
+
+Lemma nu_nu : forall b, b < 256 -> nu (nu b) = b.
+Proof.
+  intros b Hb. unfold nu. destruct (Nat.eq_dec b 0) as [->|E]; [reflexivity|].
+  rewrite (Nat.mod_small (256 - b)) by lia. rewrite Nat.mod_small by lia. lia.
+Qed.
+
+Lemma nu_lt : forall b, nu b < 256.
+Proof. intro b. unfold nu. apply Nat.mod_upper_bound. lia. Qed.
+
+(* ---- the encoder ------------------------------------------------------------------------------------------ *)
+(* the length of the run of bytes equal to x at the head of f *)
+Fixpoint run_len (x : nat) (f : list nat) : nat :=
+  match f with [] => 0 | y :: f' => if Nat.eqb y x then S (run_len x f') else 0 end.
+
+(* four equal bytes begin at the head of f *)
+Definition four_at (f : list nat) : bool :=
+  match f with a :: b :: c :: d :: _ => Nat.eqb b a && Nat.eqb c a && Nat.eqb d a | _ => false end.
+
+(* the bytes before the first position at which four equal bytes begin, at most cap of them *)
+Fixpoint lit_scan (cap : nat) (f : list nat) : nat :=
+  match cap with
+  | O => 0
+  | S c => match f with [] => 0 | _ :: f' => if four_at f then 0 else S (lit_scan c f') end
+  end.
+
+Fixpoint desc (fuel : nat) (f : list nat) : list token :=
+  match fuel with
+  | O => []
+  | S fu =>
+      match f with
+      | [] => []
+      | x :: _ =>
+          let l := Nat.min (run_len x f) 127 in
+          if Nat.leb 4 l then Rep (256 - l) (nu x) :: desc fu (skipn l f)
+          else let k := lit_scan 127 f in Lit (map nu (firstn k f)) :: desc fu (skipn k f)
+      end
+  end.
+
+Definition describe (f : list nat) : list token := desc (length f) f.
+
+(* the bound of Lemmas 4.2 and 4.4: |f| + ceil(|f| / 127) + 1 *)
+Definition bound (n : nat) : nat := n + (n + 126) / 127 + 1.
+
+Definition nofour (f : list nat) : Prop := forall p, four_at (skipn p f) = false.
+
+(* ---- runs and scans ------------------------------------------------------------------------------------- *)
+Lemma firstn_run : forall x f l, l <= run_len x f -> firstn l f = repeat x l.
+Proof.
+  intros x f. induction f as [|y f IH]; intros l Hl; cbn [run_len] in Hl.
+  - assert (l = 0) by lia. subst. reflexivity.
+  - destruct l as [|l]; [reflexivity|]. destruct (Nat.eqb_spec y x) as [->|E]; [|lia].
+    cbn [firstn repeat]. rewrite IH by lia. reflexivity.
+Qed.
+
+Lemma run_le : forall x f, run_len x f <= length f.
+Proof. intros x f. induction f as [|y f IH]; cbn [run_len length]; [lia|]. destruct (Nat.eqb y x); lia. Qed.
+
+Lemma four_run : forall x f, four_at (x :: f) = Nat.leb 4 (run_len x (x :: f)).
+Proof.
+  intros x [|b [|c [|d f]]]; cbn [four_at run_len]; rewrite Nat.eqb_refl; try reflexivity.
+  - destruct (Nat.eqb b x); reflexivity.
+  - destruct (Nat.eqb b x), (Nat.eqb c x); reflexivity.
+  - destruct (Nat.eqb b x), (Nat.eqb c x), (Nat.eqb d x); reflexivity.
+Qed.
+
+Lemma lit_scan_le : forall cap f, lit_scan cap f <= cap /\ lit_scan cap f <= length f.
+Proof.
+  induction cap as [|c IH]; intros f; cbn [lit_scan]; [lia|]. destruct f as [|y f']; cbn [length]; [lia|].
+  destruct (four_at (y :: f')); [lia|]. specialize (IH f'). lia.
+Qed.
+
+Lemma lit_scan_none : forall cap f p, p < lit_scan cap f -> four_at (skipn p f) = false.
+Proof.
+  induction cap as [|c IH]; intros f p Hp; cbn [lit_scan] in Hp; [lia|]. destruct f as [|y f']; [lia|].
+  destruct (four_at (y :: f')) eqn:E; [lia|]. destruct p as [|p]; [exact E|]. cbn [skipn]. apply (IH f'). lia.
+Qed.
+
+Lemma lit_scan_stop : forall cap f, lit_scan cap f = cap \/ lit_scan cap f = length f
+  \/ four_at (skipn (lit_scan cap f) f) = true.
+Proof.
+  induction cap as [|c IH]; intros f; cbn [lit_scan]; [left; reflexivity|]. destruct f as [|y f']; [right; left; reflexivity|].
+  destruct (four_at (y :: f')) eqn:E; [right; right; exact E|]. cbn [skipn length].
+  destruct (IH f') as [H|[H|H]]; [left; lia | right; left; lia | right; right; exact H].
+Qed.
+
+Lemma lit_scan_pos : forall cap f, 1 <= cap -> f <> [] -> four_at f = false -> 1 <= lit_scan cap f.
+Proof. intros [|c] [|y f] Hc Hf E; [lia | lia | contradiction Hf; reflexivity | cbn [lit_scan]; rewrite E; lia]. Qed.
+
+Lemma nofour_skipn : forall f k, nofour f -> nofour (skipn k f).
+Proof. intros f k H p. rewrite skipn_skipn. apply H. Qed.
+
+Lemma Forall_take : forall (T : Type) (P : T -> Prop) l k, Forall P l -> Forall P (firstn k l).
+Proof. intros T P l k H. rewrite <- (firstn_skipn k l) in H. apply Forall_app in H. exact (proj1 H). Qed.
+
+Lemma Forall_drop : forall (T : Type) (P : T -> Prop) l k, Forall P l -> Forall P (skipn k l).
+Proof. intros T P l k H. rewrite <- (firstn_skipn k l) in H. apply Forall_app in H. exact (proj2 H). Qed.
+
+(* ---- the recipe of a token list ---------------------------------------------------------------------------- *)
+Lemma length_recipe_cons : forall k ks, length (recipe (k :: ks)) = length (enc k) + length (recipe ks).
+Proof. intros k ks. unfold recipe. cbn [map concat]. rewrite <- app_assoc, length_app. reflexivity. Qed.
+
+Lemma delta_cons : forall k ks, delta (k :: ks) = dec k ++ delta ks.
+Proof. reflexivity. Qed.
+
+Lemma ceil_add : forall m, (127 + m + 126) / 127 = 1 + (m + 126) / 127.
+Proof. intro m. replace (127 + m + 126) with (1 * 127 + (m + 126)) by lia. rewrite Nat.div_add_l by lia. reflexivity. Qed.
+
+Lemma ceil_mono : forall a b, a <= b -> (a + 126) / 127 <= (b + 126) / 127.
+Proof. intros a b H. apply Nat.Div0.div_le_mono. lia. Qed.
+
+Lemma ceil_small : forall n, 1 <= n -> n <= 127 -> (n + 126) / 127 = 1.
+Proof. intros n H1 H2. symmetry. apply Nat.div_unique with (r := n + 126 - 127); lia. Qed.
+
+(* ---- Lemma 4.4 --------------------------------------------------------------------------------------------- *)
+Lemma desc_spec : forall fuel f, length f <= fuel -> Forall (fun x => x < 256) f ->
+  let r := length (recipe (desc fuel f)) in
+  delta (desc fuel f) = f /\ Forall tok_ok (desc fuel f) /\ r <= bound (length f)
+  /\ (four_at f = true -> r + 2 <= bound (length f))
+  /\ (nofour f -> r = bound (length f)) /\ (r = bound (length f) -> nofour f).
+Proof.
+  induction fuel as [|fu IH]; intros f Hl Hb r.
+  - assert (f = []) by (destruct f; [reflexivity | cbn in Hl; lia]). subst f. unfold r. cbn.
+    split; [reflexivity|]. split; [constructor|]. split; [lia|]. split; [discriminate|]. split; [reflexivity|].
+    intros _ p. destruct p; reflexivity.
+  - destruct f as [|x f0].
+    + unfold r. cbn.
+      split; [reflexivity|]. split; [constructor|]. split; [lia|]. split; [discriminate|]. split; [reflexivity|].
+      intros _ p. destruct p; reflexivity.
+    + assert (Hx : x < 256) by (inversion Hb; assumption).
+      unfold r. cbn [desc]. cbv zeta.
+      remember (x :: f0) as f eqn:Ef.
+      assert (Hfl : length f = S (length f0)) by (subst f; reflexivity).
+      set (l := Nat.min (run_len x f) 127).
+      assert (Hrun : run_len x f >= 1) by (subst f; cbn [run_len]; rewrite Nat.eqb_refl; lia).
+      pose proof (run_le x f) as Hrl.
+      destruct (Nat.leb_spec 4 l) as [H4|H4].
+      * (* a run of at least four: a repeat token *)
+        set (f2 := skipn l f).
+        assert (Hlf : length f = l + length f2) by (unfold f2; rewrite length_skipn; unfold l in *; lia).
+        destruct (IH f2 ltac:(lia) ltac:(unfold f2; apply Forall_drop; exact Hb)) as (D & T & B & B2 & E1 & E2).
+        cbv zeta in *. set (r2 := length (recipe (desc fu f2))) in *.
+        assert (Hdec : dec (Rep (256 - l) (nu x)) = firstn l f).
+        { cbn [dec]. rewrite nu_nu by exact Hx. replace (256 - (256 - l)) with l by (unfold l in *; lia).
+          symmetry. apply firstn_run. unfold l. lia. }
+        rewrite length_recipe_cons. cbn [enc length]. fold r2.
+        assert (Hb2 : bound (length f2) + 4 <= bound (length f)).
+        { unfold bound. rewrite Hlf. pose proof (ceil_mono (length f2) (l + length f2) ltac:(lia)). lia. }
+        refine (conj _ (conj _ (conj _ (conj _ (conj _ _))))).
+        -- rewrite delta_cons, D, Hdec. apply firstn_skipn.
+        -- constructor; [|exact T]. cbn [tok_ok]. split; [unfold l in *; lia | apply nu_lt].
+        -- lia.
+        -- intros _. lia.
+        -- intro Hn. exfalso. specialize (Hn 0). cbn [skipn] in Hn. subst f. rewrite four_run in Hn.
+           apply Nat.leb_gt in Hn. unfold l in *. lia.
+        -- intro E. lia.
+      * (* a literal token *)
+        assert (Hf4 : four_at f = false).
+        { subst f. rewrite four_run. apply Nat.leb_gt. unfold l in *. lia. }
+        set (k := lit_scan 127 f).
+        destruct (lit_scan_le 127 f) as [Hk1 Hk2]. fold k in Hk1, Hk2.
+        assert (Hk0 : 1 <= k) by (apply lit_scan_pos; [lia | subst f; discriminate | exact Hf4]).
+        set (f2 := skipn k f).
+        assert (Hlf : length f = k + length f2) by (unfold f2; rewrite length_skipn; lia).
+        destruct (IH f2 ltac:(lia) ltac:(unfold f2; apply Forall_drop; exact Hb)) as (D & T & B & B2 & E1 & E2).
+        cbv zeta in *. set (r2 := length (recipe (desc fu f2))) in *.
+        assert (Hg : Forall (fun x => x < 256) (firstn k f)) by (apply Forall_take; exact Hb).
+        rewrite length_recipe_cons. cbn [enc length]. rewrite length_map, length_firstn, Nat.min_l by lia. fold r2.
+        assert (Hnone : forall p, p < k -> four_at (skipn p f) = false) by (intros p Hp; apply (lit_scan_none 127); exact Hp).
+        assert (Hnf : nofour f2 -> nofour f).
+        { intros Hn p. destruct (Nat.lt_ge_cases p k) as [Hp|Hp]; [apply Hnone; exact Hp|].
+          replace p with ((p - k) + k) by lia. rewrite <- skipn_skipn. apply (Hn (p - k)). }
+        refine (conj _ (conj _ (conj _ (conj _ (conj _ _))))).
+        -- rewrite delta_cons, D. cbn [dec]. rewrite map_map.
+           rewrite (map_ext_in _ (fun x => x)) by (intros y Hy; rewrite Forall_forall in Hg; apply nu_nu, Hg, Hy).
+           rewrite map_id. apply firstn_skipn.
+        -- constructor; [|exact T]. cbn [tok_ok]. rewrite length_map, length_firstn, Nat.min_l by lia.
+           split; [lia|]. apply Forall_map, Forall_forall. intros y _. apply nu_lt.
+        -- destruct (lit_scan_stop 127 f) as [S1|[S1|S1]]; fold k in S1.
+           ++ assert (Hb' : bound (length f) = 128 + bound (length f2))
+                by (unfold bound; rewrite Hlf, S1, ceil_add; lia). lia.
+           ++ assert (Hf2 : length f2 = 0) by lia. rewrite Hf2 in B.
+              assert (Hc : (length f + 126) / 127 = 1) by (apply ceil_small; lia).
+              unfold bound in *. rewrite Hc. cbn in B. lia.
+           ++ destruct (Nat.eq_dec k 127) as [K7|K7].
+              ** assert (Hb' : bound (length f) = 128 + bound (length f2))
+                   by (unfold bound; rewrite Hlf, K7, ceil_add; lia). lia.
+              ** specialize (B2 S1). unfold bound in *. rewrite Hlf. pose proof (ceil_mono (length f2) (k + length f2) ltac:(lia)). lia.
+        -- intro H. rewrite Hf4 in H. discriminate.
+        -- intro Hn. assert (Hn2 : nofour f2) by (apply nofour_skipn; exact Hn).
+           specialize (E1 Hn2). destruct (lit_scan_stop 127 f) as [S1|[S1|S1]]; fold k in S1.
+           ++ assert (Hb' : bound (length f) = 128 + bound (length f2))
+                by (unfold bound; rewrite Hlf, S1, ceil_add; lia). lia.
+           ++ assert (Hf2 : length f2 = 0) by lia. rewrite Hf2 in E1.
+              assert (Hc : (length f + 126) / 127 = 1) by (apply ceil_small; lia).
+              unfold bound in *. rewrite Hc. cbn in E1. lia.
+           ++ exfalso. specialize (Hn k). rewrite S1 in Hn. discriminate.
+        -- intro E. destruct (lit_scan_stop 127 f) as [S1|[S1|S1]]; fold k in S1.
+           ++ assert (Hb' : bound (length f) = 128 + bound (length f2))
+                by (unfold bound; rewrite Hlf, S1, ceil_add; lia).
+              apply Hnf, E2. lia.
+           ++ apply Hnf. intro p. unfold f2. rewrite skipn_skipn, skipn_all2 by lia. reflexivity.
+           ++ exfalso. specialize (B2 S1). unfold bound in *. rewrite Hlf in E.
+              pose proof (ceil_mono (length f2) (k + length f2) ltac:(lia)). lia.
+Qed.
+
+Theorem describe_spec : forall f, Forall (fun x => x < 256) f ->
+  delta (describe f) = f /\ Forall tok_ok (describe f) /\ length (recipe (describe f)) <= bound (length f)
+  /\ (length (recipe (describe f)) = bound (length f) <-> nofour f).
+Proof.
+  intros f Hb. destruct (desc_spec (length f) f (le_n _) Hb) as (D & T & B & _ & E1 & E2).
+  unfold describe. refine (conj D (conj T (conj B (conj E2 E1)))).
+Qed.
+
+(* ---- the steps of P* on describe f (Theorem 8.7) ------------------------------------------------------------- *)
+(* the steps of Proposition 5.3 on the recipe of ks *)
+Definition psteps (ks : list token) : nat := dsteps ks + 7 + 1 + (6 * length (recipe ks) + 2).
+
+Lemma psteps_nil : psteps [] = 16.
+Proof. reflexivity. Qed.
+
+Lemma psteps_cons : forall k ks, psteps (k :: ks) = tsteps k + 6 * length (enc k) + psteps ks.
+Proof. intros k ks. unfold psteps. rewrite length_recipe_cons. cbn [dsteps fold_right]. fold (dsteps ks). lia. Qed.
+
+Lemma desc_steps : forall fuel f, length f <= fuel -> Forall (fun x => x < 256) f ->
+  2 * psteps (desc fuel f) <= 25 * length f + 58
+  /\ (four_at f = true -> 2 * psteps (desc fuel f) <= 25 * length f + 32)
+  /\ (nofour f -> psteps (desc fuel f) = 11 * length f + 13 * ((length f + 126) / 127) + 16).
+Proof.
+  induction fuel as [|fu IH]; intros f Hl Hb.
+  - assert (f = []) by (destruct f; [reflexivity | cbn in Hl; lia]). subst f. cbn [desc length].
+    rewrite psteps_nil. split; [lia|]. split; [discriminate|]. intros _. reflexivity.
+  - destruct f as [|x f0].
+    + cbn [desc length]. rewrite psteps_nil. split; [lia|]. split; [discriminate|]. intros _. reflexivity.
+    + assert (Hx : x < 256) by (inversion Hb; assumption).
+      cbn [desc]. cbv zeta.
+      remember (x :: f0) as f eqn:Ef.
+      set (l := Nat.min (run_len x f) 127).
+      assert (Hrun : run_len x f >= 1) by (subst f; cbn [run_len]; rewrite Nat.eqb_refl; lia).
+      pose proof (run_le x f) as Hrl.
+      destruct (Nat.leb_spec 4 l) as [H4|H4].
+      * set (f2 := skipn l f).
+        assert (Hlf : length f = l + length f2) by (unfold f2; rewrite length_skipn; unfold l in *; lia).
+        destruct (IH f2 ltac:(lia) ltac:(unfold f2; apply Forall_drop; exact Hb)) as (B & _ & _).
+        rewrite psteps_cons. cbn [tsteps enc length]. replace (256 - (256 - l)) with l by (unfold l in *; lia).
+        split; [lia|]. split; [intros _; lia|].
+        intro Hn. exfalso. specialize (Hn 0). cbn [skipn] in Hn. subst f. rewrite four_run in Hn.
+        apply Nat.leb_gt in Hn. unfold l in *. lia.
+      * assert (Hf4 : four_at f = false).
+        { subst f. rewrite four_run. apply Nat.leb_gt. unfold l in *. lia. }
+        set (k := lit_scan 127 f).
+        destruct (lit_scan_le 127 f) as [Hk1 Hk2]. fold k in Hk1, Hk2.
+        assert (Hk0 : 1 <= k) by (apply lit_scan_pos; [lia | subst f; discriminate | exact Hf4]).
+        set (f2 := skipn k f).
+        assert (Hlf : length f = k + length f2) by (unfold f2; rewrite length_skipn; lia).
+        destruct (IH f2 ltac:(lia) ltac:(unfold f2; apply Forall_drop; exact Hb)) as (B & B4 & E).
+        rewrite psteps_cons. cbn [tsteps enc length]. rewrite length_map, length_firstn, Nat.min_l by lia.
+        assert (Hd2 : length f2 = 0 -> psteps (desc fu f2) = 16).
+        { intro H0. assert (Z : f2 = []) by (apply length_zero_iff_nil; exact H0).
+          rewrite Z. destruct fu; reflexivity. }
+        split; [|split; [intro H; rewrite Hf4 in H; discriminate|]].
+        -- destruct (lit_scan_stop 127 f) as [S1|[S1|S1]]; fold k in S1.
+           ++ lia.
+           ++ rewrite Hd2 by lia. lia.
+           ++ specialize (B4 S1). lia.
+        -- intro Hn. assert (Hn2 : nofour f2) by (apply nofour_skipn; exact Hn).
+           specialize (E Hn2). destruct (lit_scan_stop 127 f) as [S1|[S1|S1]]; fold k in S1.
+           ++ rewrite E, Hlf, S1, ceil_add. lia.
+           ++ rewrite Hd2 by lia. rewrite (ceil_small (length f)) by lia. lia.
+           ++ exfalso. specialize (Hn k). rewrite S1 in Hn. discriminate.
+Qed.
+
+(* every recipe of f takes at least 4 |f| steps *)
+Lemma psteps_lower : forall ks, Forall tok_ok ks -> 4 * length (delta ks) <= psteps ks.
+Proof.
+  induction ks as [|k ks IH]; intros Hok; [cbn; lia|]. apply Forall_cons_iff in Hok as [Hk Hok].
+  rewrite psteps_cons, delta_cons, length_app. specialize (IH Hok).
+  destruct k as [bs|t b]; cbn [tsteps enc dec length] in *; [rewrite length_map | rewrite repeat_length]; lia.
+Qed.
+
+Theorem describe_steps : forall f, Forall (fun x => x < 256) f ->
+  2 * psteps (describe f) <= 25 * length f + 58
+  /\ (nofour f -> psteps (describe f) = 11 * length f + 13 * ((length f + 126) / 127) + 16).
+Proof.
+  intros f Hb. destruct (desc_steps (length f) f (le_n _) Hb) as (B & _ & E). exact (conj B E).
+Qed.
+
+(* ---- Lemma 4.2 --------------------------------------------------------------------------------------------- *)
+Corollary recipes_complete : forall f, Forall (fun x => x < 256) f ->
+  exists ks, Forall tok_ok ks /\ delta ks = f /\ length (recipe ks) <= bound (length f).
+Proof.
+  intros f Hb. destruct (describe_spec f Hb) as (D & T & B & _). exists (describe f). exact (conj T (conj D B)).
+Qed.
+
+(* ---- Proposition 4.3 --------------------------------------------------------------------------------------- *)
+Definition notwo (f : list nat) : Prop := forall p, S p < length f -> nth p f 0 <> nth (S p) f 0.
+
+Lemma notwo_app : forall a b, notwo (a ++ b) -> notwo a /\ notwo b.
+Proof.
+  intros a b H. split.
+  - intros p Hp. specialize (H p ltac:(rewrite length_app; lia)). rewrite !app_nth1 in H by lia. exact H.
+  - intros p Hp. specialize (H (length a + p) ltac:(rewrite length_app; lia)).
+    rewrite !app_nth2 in H by lia. replace (length a + p - length a) with p in H by lia.
+    replace (S (length a + p) - length a) with (S p) in H by lia. exact H.
+Qed.
+
+Lemma token_cost : forall k, tok_ok k -> notwo (dec k) ->
+  length (enc k) = length (dec k) + 1 /\ 1 <= length (dec k) <= 127.
+Proof.
+  intros [bs|t b] Hk Hn; cbn [tok_ok] in Hk; destruct Hk as [Hk1 Hk2]; cbn [dec] in Hn; cbn [enc dec length].
+  - rewrite length_map. lia.
+  - rewrite repeat_length. destruct (Nat.eq_dec (256 - t) 1) as [E|E]; [lia|].
+    exfalso. apply (Hn 0); rewrite ?repeat_length; [lia|]. rewrite !nth_repeat_lt by lia. reflexivity.
+Qed.
+
+Theorem recipe_optimal : forall ks, Forall tok_ok ks -> notwo (delta ks) ->
+  bound (length (delta ks)) <= length (recipe ks).
+Proof.
+  assert (G : forall ks, Forall tok_ok ks -> notwo (delta ks) ->
+            length (recipe ks) = length (delta ks) + length ks + 1 /\ length (delta ks) <= 127 * length ks).
+  { induction ks as [|k ks IH]; intros Hok Hn; [cbn; lia|].
+    apply Forall_cons_iff in Hok as [Hk Hok]. rewrite delta_cons in Hn. apply notwo_app in Hn as [Hn1 Hn2].
+    destruct (IH Hok Hn2) as [E1 E2]. destruct (token_cost k Hk Hn1) as [C1 C2].
+    rewrite length_recipe_cons, delta_cons, length_app, C1, E1. cbn [length]. lia. }
+  intros ks Hok Hn. destruct (G ks Hok Hn) as [E1 E2]. rewrite E1. unfold bound.
+  assert ((length (delta ks) + 126) / 127 < S (length ks)).
+  { apply Nat.Div0.div_lt_upper_bound. lia. }
+  lia.
+Qed.

rocq/Restore.v

@@ -0,0 +1,1449 @@
+(* Proposition 6.14: the restoration bound for the threefold amplification.  The rows of the layered map are unrolled
+   along a run, the first layer of each step reading the last layer of the step before through a device that writes
+   every copy of its cells with the values of the run.  Under independent Gaussian perturbations of every
+   pre-activation of the threefold amplification, the probability that the state read by majority leaves the run
+   within T steps is at most the sum of the bounds b(t) that the recursion of the proposition computes along it.
+   The probability space is that of Noise.v, with P additive on the events built from the threshold events. *)
+From Stdlib Require Import List Bool Arith ZArith Reals Lia Lra FunctionalExtensionality.
+Import ListNotations.
+Set Warnings "-ambiguous-paths".
+From TH Require Import TwoHead Net Lev Margin Erfc Noise.
+Set Warnings "ambiguous-paths".
+
+Local Open Scope R_scope.
+
+(* ---- counts and sums ------------------------------------------------------------------------------------------ *)
+Lemma ncnt_pos : forall m f, (0 < ncnt m f)%nat -> exists k, (k < m)%nat /\ f k = true.
+Proof.
+  induction m as [|m IH]; intros f H; cbn [ncnt] in H; [lia|].
+  destruct (f m) eqn:E; [exists m; split; [lia | exact E]|].
+  destruct (IH f ltac:(lia)) as (k & Hk & Hf). exists k. split; [lia | exact Hf].
+Qed.
+
+Lemma ncnt_false : forall k, ncnt k (fun _ => false) = 0%nat.
+Proof. induction k as [|k IH]; cbn [ncnt]; [reflexivity | rewrite IH; reflexivity]. Qed.
+
+Lemma ncnt_add : forall a b f, ncnt (a + b) f = (ncnt a f + ncnt b (fun k => f (a + k)%nat))%nat.
+Proof.
+  intros a b f. induction b as [|b IH]; cbn [ncnt]; [rewrite Nat.add_0_r; lia|].
+  rewrite Nat.add_succ_r. cbn [ncnt]. rewrite IH. lia.
+Qed.
+
+Lemma ncnt_point : forall m f j, (j < m)%nat -> ncnt m (fun k => f k && Nat.eqb k j) = if f j then 1%nat else 0%nat.
+Proof.
+  induction m as [|m IH]; intros f j Hj; [lia|]. cbn [ncnt].
+  destruct (Nat.eq_dec j m) as [->|E].
+  - rewrite Nat.eqb_refl, andb_true_r.
+    rewrite (ncnt_ext m _ (fun _ => false)) by (intros c Hc; destruct (Nat.eqb_spec c m); [lia | apply andb_false_r]).
+    rewrite ncnt_false. destruct (f m); reflexivity.
+  - rewrite IH by lia. destruct (Nat.eqb_spec m j); [lia|]. rewrite andb_false_r. destruct (f j); reflexivity.
+Qed.
+
+(* the positions c w + j, c < r, of one row j among r w positions *)
+Lemma ncnt_row : forall r w j D, (j < w)%nat ->
+  ncnt (r * w) (fun q => D q && Nat.eqb (q mod w) j) = ncnt r (fun c => D (c * w + j)%nat).
+Proof.
+  intros r w j D Hj. induction r as [|r IH]; [reflexivity|].
+  replace (S r * w)%nat with (r * w + w)%nat by lia. rewrite ncnt_add, IH. cbn [ncnt]. f_equal.
+  rewrite (ncnt_ext w _ (fun k => D (r * w + k)%nat && Nat.eqb k j)).
+  - exact (ncnt_point w (fun k => D (r * w + k)%nat) j Hj).
+  - intros k Hk. replace ((r * w + k) mod w)%nat with k; [reflexivity|].
+    rewrite Nat.add_comm, Nat.Div0.mod_add. symmetry. apply Nat.mod_small. exact Hk.
+Qed.
+
+Lemma ncnt_two : forall f, (2 <= ncnt 3 f)%nat -> exists c1 c2, (c1 < c2)%nat /\ (c2 < 3)%nat /\ f c1 = true /\ f c2 = true.
+Proof.
+  intros f H. cbn [ncnt] in H. destruct (f 0%nat) eqn:E0, (f 1%nat) eqn:E1, (f 2%nat) eqn:E2; cbn [Nat.add] in H;
+    try lia; solve [exists 0%nat, 1%nat; auto | exists 0%nat, 2%nat; auto | exists 1%nat, 2%nat; auto].
+Qed.
+
+Lemma ncnt_three : forall f, ncnt 3 f = 3%nat -> f 0%nat = true /\ f 1%nat = true /\ f 2%nat = true.
+Proof. intros f H. cbn [ncnt] in H. destruct (f 0%nat), (f 1%nat), (f 2%nat); cbn [Nat.add] in H; try lia; auto. Qed.
+
+Lemma rsum_add : forall a b g, rsum (a + b) g = rsum a g + rsum b (fun k => g (a + k)%nat).
+Proof.
+  intros a b g. induction b as [|b IH]; cbn [rsum]; [rewrite Nat.add_0_r; lra|].
+  rewrite Nat.add_succ_r. cbn [rsum]. rewrite IH. lra.
+Qed.
+
+Lemma rsum_blocks : forall T m g, rsum (T * m) g = rsum T (fun t => rsum m (fun l => g (t * m + l)%nat)).
+Proof.
+  induction T as [|T IH]; intros m g; [cbn; lra|]. replace (S T * m)%nat with (T * m + m)%nat by lia.
+  rewrite rsum_add, IH. cbn [rsum]. reflexivity.
+Qed.
+
+(* the first index at which a test holds *)
+Lemma first_true : forall (f : nat -> bool) a, f a = true ->
+  exists a0, (a0 <= a)%nat /\ f a0 = true /\ forall a', (a' < a0)%nat -> f a' = false.
+Proof.
+  intros f a Ha. assert (Hd : forall k, f k = true \/ ~ f k = true) by (intro k; destruct (f k); [left | right]; congruence).
+  assert (G : forall m, (exists k, (k < m)%nat /\ f k = true) ->
+            exists a0, (a0 < m)%nat /\ f a0 = true /\ forall a', (a' < a0)%nat -> f a' = false).
+  { induction m as [|m IH]; intros (k & Hk & Hf); [lia|].
+    destruct (search m (fun k => f k = true) Hd) as [H|H].
+    - destruct (IH H) as (a0 & H0 & H1 & H2). exists a0. split; [lia | split; assumption].
+    - exists m. split; [lia|]. split.
+      + destruct (Nat.eq_dec k m) as [->|E]; [exact Hf | exfalso; exact (H k ltac:(lia) Hf)].
+      + intros a' Ha'. destruct (f a') eqn:E; [exfalso; exact (H a' Ha' E) | reflexivity]. }
+  destruct (G (S a) (ex_intro _ a (conj (Nat.lt_succ_diag_r a) Ha))) as (a0 & H0 & H1 & H2).
+  exists a0. split; [lia | split; assumption].
+Qed.
+
+(* ---- the inputs that move a row toward its comparator -------------------------------------------------------- *)
+(* the weight with which a row reads position j, 0 if it does not *)
+Definition wgt (u : tu) (j : nat) : Z := fold_right (fun p a => if Nat.eqb (fst p) j then snd p else a) 0%Z (tin u).
+
+Lemma wgt_in : forall u j z, NoDup (map fst (tin u)) -> In (j, z) (tin u) -> wgt u j = z.
+Proof.
+  intros [b ins] j z. unfold wgt. cbn [tin]. induction ins as [|[j' z'] t IH]; intros Hnd Hin; [destruct Hin|].
+  cbn [fold_right fst snd]. cbn [map fst] in Hnd. inversion Hnd as [|? ? Hj Ht]; subst. destruct Hin as [E|Hin].
+  - injection E as -> ->. rewrite Nat.eqb_refl. reflexivity.
+  - destruct (Nat.eqb_spec j' j) as [->|E]; [|apply IH; assumption].
+    exfalso. apply Hj. apply in_map_iff. exists (j, z). split; [reflexivity | exact Hin].
+Qed.
+
+(* the sign of z + 1/2 for an integer z *)
+Definition sgn (z : Z) : Z := if Z.leb 0 z then 1%Z else (-1)%Z.
+
+(* an error at an input of weight wt and value y moves a row of pre-activation z toward the comparator, that is
+   wt (1 - 2 y) (z + 1/2) < 0 *)
+Definition tw (z wt : Z) (y : bool) : bool := (sgn z * wt * (1 - 2 * b2z y) <? 0)%Z.
+
+Lemma tw_paper : forall z wt y, tw z wt y = (wt * (1 - 2 * b2z y) * (2 * z + 1) <? 0)%Z.
+Proof.
+  intros z wt y. unfold tw, sgn. rewrite <- Z.mul_assoc. generalize (wt * (1 - 2 * b2z y))%Z as x. intro x.
+  destruct (Z.leb_spec 0 z) as [H|H].
+  - rewrite Z.mul_1_l. destruct (Z.ltb_spec x 0), (Z.ltb_spec (x * (2 * z + 1)) 0); try reflexivity; exfalso; nia.
+  - destruct (Z.ltb_spec (-1 * x) 0), (Z.ltb_spec (x * (2 * z + 1)) 0); try reflexivity; exfalso; nia.
+Qed.
+
+Lemma in_arow : forall r w u q z, In (q, z) (tin (arow r w u)) ->
+  exists c j, (c < r)%nat /\ In (j, z) (tin u) /\ q = (c * w + j)%nat.
+Proof.
+  intros r w u q z Hin. unfold arow in Hin. cbn [tin] in Hin. apply in_concat in Hin as (l & Hl & Hin).
+  apply in_map_iff in Hl as (c & <- & Hc). apply in_seq in Hc. apply in_map_iff in Hin as ([j z'] & E & Hj).
+  cbn [fst snd] in E. injection E as <- <-. exists c, j. split; [lia | split; [exact Hj | reflexivity]].
+Qed.
+
+(* the inputs that differ move a weighted sum by their weights; those that move it against the sign sg number at most
+   the count of the toward inputs that differ *)
+Lemma wsum_dir : forall ins E1 E2 (sg : Z), (sg = 1 \/ sg = -1)%Z -> (forall j z, In (j, z) ins -> (z = 1 \/ z = -1)%Z) ->
+  (- Z.of_nat (length (filter (fun p => negb (Bool.eqb (E1 (fst p)) (E2 (fst p)))
+                                         && (sg * snd p * (1 - 2 * b2z (E2 (fst p))) <? 0)%Z) ins))
+   <= sg * (wsum ins E1 - wsum ins E2))%Z.
+Proof.
+  intros ins E1 E2 sg Hsg. induction ins as [|[j z] t IH]; intro Hw; cbn [wsum filter fst snd]; [lia|].
+  specialize (IH (fun j' z' H => Hw j' z' (or_intror H))).
+  destruct (negb (Bool.eqb (E1 j) (E2 j)) && (sg * z * (1 - 2 * b2z (E2 j)) <? 0)%Z) eqn:Hc; cbn [length];
+    rewrite ?Nat2Z.inj_succ; destruct (Hw j z (or_introl eq_refl)) as [-> | ->]; destruct Hsg as [-> | ->];
+    destruct (E1 j), (E2 j); cbn in Hc; try discriminate; cbn [b2z]; lia.
+Qed.
+
+(* a perturbation fails a copy of the threefold amplification of row u, whose input differs from rep 3 y in at most k
+   copies of inputs that move it toward the comparator, only beyond D - k on the far side, D = 3 |z + 1/2| *)
+Definition far (z : Z) (k : nat) (e : R) : Prop :=
+  if Z.leb 0 z then e < - (3 * Rabs (IZR z + 1/2) - INR k) else 3 * Rabs (IZR z + 1/2) - INR k <= e.
+
+Lemma far_core : forall u y y' e k, rowok (length y) u ->
+  (length (filter (fun p => negb (Bool.eqb (nth (fst p) y' false) (nth (fst p) (rep 3 y) false))
+                            && tw (pre u y) (snd p) (nth (fst p) (rep 3 y) false)) (tin (arow 3 (length y) u))) <= k)%nat ->
+  H12 (IZR (pre (arow 3 (length y) u) y') + e) <> Z.leb 0 (pre u y) -> far (pre u y) k e.
+Proof.
+  intros u y y' e k Hu Hk Hw.
+  assert (Hr : reads_lt (length y) u) by (intros j z Hin; exact (proj1 (proj2 Hu j z Hin))).
+  destruct (arow_ok 3 _ _ Hu) as [_ Hlt].
+  pose proof (wsum_dir (tin (arow 3 (length y) u)) (fun i => nth i y' false) (fun i => nth i (rep 3 y) false) (sgn (pre u y))
+                ltac:(unfold sgn; destruct (Z.leb 0 (pre u y)); [left | right]; reflexivity)
+                (fun j z Hin => proj2 (Hlt j z Hin))) as D.
+  cbv beta in D. unfold tw in Hk. apply Nat2Z.inj_le in Hk.
+  pose proof (pre_arow 3 u y Hr) as Hp0.
+  replace (Z.of_nat 3 * pre u y + Z.of_nat ((3 - 1) / 2))%Z with (3 * pre u y + 1)%Z in Hp0 by reflexivity.
+  assert (Ed : (pre (arow 3 (length y) u) y' - pre (arow 3 (length y) u) (rep 3 y))%Z
+               = (wsum (tin (arow 3 (length y) u)) (fun i => nth i y' false)
+                  - wsum (tin (arow 3 (length y) u)) (fun i => nth i (rep 3 y) false))%Z) by (unfold pre; ring).
+  rewrite Hp0 in Ed.
+  set (zv := pre u y) in *. set (p' := pre (arow 3 (length y) u) y') in *. unfold far, sgn in *.
+  destruct (Z.leb_spec 0 zv) as [Hz|Hz]; unfold H12 in Hw.
+  - destruct (Rle_dec (-1/2) (IZR p' + e)) as [Hle|Hlt']; [exfalso; apply Hw; reflexivity|].
+    assert (Hp : (3 * zv + 1 - Z.of_nat k <= p')%Z) by lia.
+    apply IZR_le in Hp. rewrite minus_IZR, plus_IZR, mult_IZR, <- INR_IZR_INZ in Hp. apply IZR_le in Hz.
+    rewrite Rabs_right by lra. apply Rnot_le_lt in Hlt'. lra.
+  - destruct (Rle_dec (-1/2) (IZR p' + e)) as [Hle|Hlt']; [|exfalso; apply Hw; reflexivity].
+    assert (Hp : (p' <= 3 * zv + 1 + Z.of_nat k)%Z) by lia.
+    apply IZR_le in Hp. rewrite !plus_IZR, mult_IZR, <- INR_IZR_INZ in Hp.
+    assert (Hz' : (zv <= -1)%Z) by lia. apply IZR_le in Hz'. rewrite Rabs_left by lra. lra.
+Qed.
+
+(* ---- layers evaluated in sequence --------------------------------------------------------------------------------- *)
+Lemma lmapp_app : forall A L l0 E y, lmapp (A ++ [L]) l0 E y = lfirep L (E (l0 + length A)%nat) (lmapp A l0 E y).
+Proof.
+  induction A as [|L' A IH]; intros L l0 E y; cbn [app lmapp length]; [rewrite Nat.add_0_r; reflexivity|].
+  rewrite IH. replace (S l0 + length A)%nat with (l0 + S (length A))%nat by lia. reflexivity.
+Qed.
+
+Lemma nth_lfirep : forall L e y q, (q < length L)%nat -> nth q (lfirep L e y) false = H12 (IZR (pre (nth q L tu0) y) + e q y).
+Proof. intros L e y q Hq. unfold lfirep. rewrite nth_map_seq by exact Hq. reflexivity. Qed.
+
+Lemma length_lfirep : forall L e y, length (lfirep L e y) = length L.
+Proof. intros L e y. unfold lfirep. rewrite length_map, length_seq. reflexivity. Qed.
+
+Lemma lin_S : forall Ls x l, (l < length Ls)%nat -> lin Ls x (S l) = lfire (nth l Ls []) (lin Ls x l).
+Proof. intros Ls x l Hl. unfold lin. rewrite (firstn_snoc _ Ls l []) by exact Hl. apply lmap_app. Qed.
+
+Lemma lfirep_ext : forall L e1 e2 y, (forall q y', e1 q y' = e2 q y') -> lfirep L e1 y = lfirep L e2 y.
+Proof. intros L e1 e2 y H. unfold lfirep. apply map_ext. intro q. rewrite H. reflexivity. Qed.
+
+(* copy c of row i of a layer of m rows is c m + i *)
+Lemma cp_inj : forall c1 c2 i1 i2 m, (i1 < m)%nat -> (i2 < m)%nat -> (c1 * m + i1 = c2 * m + i2)%nat -> c1 = c2 /\ i1 = i2.
+Proof.
+  intros c1 c2 i1 i2 m H1 H2 E.
+  assert (Q1 : c1 = ((c1 * m + i1) / m)%nat) by (apply (Nat.div_unique _ _ c1 i1 H1); lia).
+  assert (Q2 : c2 = ((c2 * m + i2) / m)%nat) by (apply (Nat.div_unique _ _ c2 i2 H2); lia).
+  assert (R1 : i1 = ((c1 * m + i1) mod m)%nat) by (apply (Nat.mod_unique _ _ c1 i1 H1); lia).
+  assert (R2 : i2 = ((c2 * m + i2) mod m)%nat) by (apply (Nat.mod_unique _ _ c2 i2 H2); lia).
+  rewrite E in Q1, R1. split; congruence.
+Qed.
+
+Lemma cp_mod : forall c i m, (i < m)%nat -> ((c * m + i) mod m = i)%nat.
+Proof. intros c i m H. rewrite Nat.add_comm, Nat.Div0.mod_add. apply Nat.mod_small. exact H. Qed.
+
+Lemma cp_split : forall q m, (0 < m)%nat -> q = (q / m * m + q mod m)%nat.
+Proof. intros q m H. rewrite Nat.mul_comm. apply Nat.div_mod. lia. Qed.
+
+Lemma existsb_seq_false : forall f m, existsb f (seq 0 m) = false -> forall q, (q < m)%nat -> f q = false.
+Proof.
+  intros f m H q Hq. destruct (f q) eqn:E; [|reflexivity].
+  assert (C : existsb f (seq 0 m) = true) by (apply existsb_exists; exists q; split; [apply in_seq; lia | exact E]).
+  congruence.
+Qed.
+
+Lemma existsb_seq_true : forall f m, existsb f (seq 0 m) = true -> exists q, (q < m)%nat /\ f q = true.
+Proof. intros f m H. apply existsb_exists in H as (q & Hq & E). apply in_seq in Hq. exists q. split; [lia | exact E]. Qed.
+
+Lemma ncnt_ge1 : forall k f c, (c < k)%nat -> f c = true -> (0 < ncnt k f)%nat.
+Proof.
+  induction k as [|k IH]; intros f c Hc Hf; [lia|]. cbn [ncnt].
+  destruct (Nat.eq_dec c k) as [->|E]; [rewrite Hf; lia|]. specialize (IH f c ltac:(lia) Hf). lia.
+Qed.
+
+(* sum over j1 <> j2 of p j1 p j2 is at most the product of the sums *)
+Lemma sum_ne_le : forall m (T1 T2 : nat -> bool) (p : nat -> R), (forall j, 0 <= p j) ->
+  rsum m (fun j1 => rsum m (fun j2 => if T1 j1 && T2 j2 && negb (Nat.eqb j1 j2) then p j1 * p j2 else 0))
+  <= rsum m (fun j => if T1 j then p j else 0) * rsum m (fun j => if T2 j then p j else 0).
+Proof.
+  intros m T1 T2 p Hp. rewrite Rmult_comm, <- rsum_scal. apply rsum_le. intros j1 Hj1.
+  rewrite Rmult_comm, <- rsum_scal. apply rsum_le. intros j2 Hj2.
+  pose proof (Hp j1). pose proof (Hp j2).
+  destruct (T1 j1), (T2 j2), (Nat.eqb j1 j2); cbn [andb negb]; nra.
+Qed.
+
+Section Restore.
+(* ---- the run, unrolled layer by layer ------------------------------------------------------------------------------ *)
+Variable Omega : Type.
+Variable X : nat -> Omega -> R.
+(* the layers of the map, its n state bits, the states xs t of the run and the device cells Dv *)
+Variables (Ls : list (list tu)) (n : nat) (xs : nat -> list bool) (Dv : nat -> bool).
+Hypothesis HL : lwf n Ls.
+Hypothesis Hne : Ls <> [].
+Hypothesis Hlast : length (last Ls []) = n.
+Hypothesis Hxs : forall t, length (xs t) = n.
+(* off the device cells the run takes the step of the map *)
+Hypothesis Hstep : forall t j, (j < n)%nat -> Dv j = false -> nth j (xs (S t)) false = nth j (lmap Ls (xs t)) false.
+(* the perturbation of copy q of layer a of the unrolled run is the variable vid a q *)
+Variable vid : nat -> nat -> nat.
+
+Lemma NL_pos : (0 < length Ls)%nat.
+Proof. destruct (length Ls) eqn:E; [|lia]. apply length_zero_iff_nil in E. contradiction. Qed.
+
+(* layer a of the unrolled run is layer lyr a of step stp a *)
+Definition stp (a : nat) : nat := a / length Ls.
+Definition lyr (a : nat) : nat := a mod length Ls.
+
+Lemma lyr_lt : forall a, (lyr a < length Ls)%nat.
+Proof. intro a. apply Nat.mod_upper_bound. pose proof NL_pos. lia. Qed.
+
+Lemma a_decomp : forall a, a = (stp a * length Ls + lyr a)%nat.
+Proof. intro a. unfold stp, lyr. pose proof NL_pos. rewrite Nat.mul_comm. apply Nat.div_mod. lia. Qed.
+
+Lemma stp_lyr : forall t l, (l < length Ls)%nat -> stp (t * length Ls + l) = t /\ lyr (t * length Ls + l) = l.
+Proof.
+  intros t l Hl. unfold stp, lyr. split.
+  - symmetry. apply (Nat.div_unique _ _ t l Hl). lia.
+  - symmetry. apply (Nat.mod_unique _ _ t l Hl). lia.
+Qed.
+
+Lemma lyr_succ : forall a, (lyr (S a) = 0 /\ lyr a = length Ls - 1 /\ stp (S a) = S (stp a))%nat
+                         \/ (lyr (S a) = S (lyr a) /\ lyr (S a) <> 0 /\ stp (S a) = stp a)%nat.
+Proof.
+  intro a. pose proof (lyr_lt a) as H. pose proof (a_decomp a) as Ea. pose proof NL_pos.
+  destruct (Nat.eq_dec (S (lyr a)) (length Ls)) as [E|E].
+  - left. assert (Es : S a = (S (stp a) * length Ls + 0)%nat) by lia.
+    destruct (stp_lyr (S (stp a)) 0 NL_pos) as [E1 E2]. rewrite <- Es in E1, E2. lia.
+  - right. assert (Es : S a = (stp a * length Ls + S (lyr a))%nat) by lia.
+    destruct (stp_lyr (stp a) (S (lyr a)) ltac:(lia)) as [E1 E2]. rewrite <- Es in E1, E2. lia.
+Qed.
+
+Definition lay (a : nat) : list tu := nth (lyr a) Ls [].
+Definition nla (a : nat) : nat := length (lay a).
+Definition wia (a : nat) : nat := win Ls n (lyr a).
+(* the input and the output of layer a on the run, its row i, and the pre-activation of that row *)
+Definition exin (a : nat) : list bool := lin Ls (xs (stp a)) (lyr a).
+Definition exo (a : nat) : list bool := lfire (lay a) (exin a).
+Definition rowa (a i : nat) : tu := nth i (lay a) tu0.
+Definition zv (a i : nat) : Z := pre (rowa a i) (exin a).
+(* T(v): the inputs j of row i whose error moves it toward the comparator *)
+Definition tT (a i j : nat) : bool := tw (zv a i) (wgt (rowa a i) j) (nth j (exin a) false).
+
+(* the device writes every copy of a device cell with its value in the run *)
+Definition reset (x o : list bool) : list bool :=
+  map (fun k => if Dv (k mod n) then nth (k mod n) x false else nth k o false) (seq 0 (length o)).
+(* the perturbations of step t: copy q of layer l reads the variable vid (t L + l) q *)
+Definition Et (w : Omega) (t : nat) : nat -> nat -> list bool -> R := fun l q _ => X (vid (t * length Ls + l) q) w.
+(* the perturbed run of the threefold amplification, from the replicated initial state *)
+Fixpoint run3 (w : Omega) (t : nat) : list bool :=
+  match t with O => rep 3 (xs 0) | S t' => reset (xs (S t')) (lmapp (amap 3 n Ls) 0 (Et w t') (run3 w t')) end.
+Definition pn (w : Omega) (t l : nat) : list bool := lmapp (firstn l (amap 3 n Ls)) 0 (Et w t) (run3 w t).
+Definition inp (w : Omega) (a : nat) : list bool := pn w (stp a) (lyr a).
+Definition out (w : Omega) (a : nat) : list bool := pn w (stp a) (S (lyr a)).
+
+(* copy q of layer a is wrong, input copy q of layer a is wrong *)
+Definition wb (w : Omega) (a q : nat) : bool := negb (Bool.eqb (nth q (out w a) false) (nth (q mod nla a) (exo a) false)).
+Definition wib (w : Omega) (a q : nat) : bool := negb (Bool.eqb (nth q (inp w a) false) (nth (q mod wia a) (exin a) false)).
+(* |S_v|: the wrong copies of the inputs of row i that move it toward the comparator *)
+Definition Sc (w : Omega) (a i : nat) : nat := ncnt (3 * wia a) (fun q => wib w a q && tT a i (q mod wia a)).
+(* the wrong copies of row i, and of input j *)
+Definition ncw (w : Omega) (a i : nat) : nat := ncnt 3 (fun c => wb w a (c * nla a + i)).
+Definition nci (w : Omega) (a j : nat) : nat := ncnt 3 (fun c => wib w a (c * wia a + j)).
+
+Lemma out_eq : forall w a, out w a = lfirep (alayer 3 (wia a) (lay a)) (fun q _ => X (vid a q) w) (inp w a).
+Proof.
+  intros w a. unfold out, inp, pn. pose proof (lyr_lt a) as Hl.
+  rewrite (firstn_snoc _ (amap 3 n Ls) (lyr a) []) by (rewrite length_amap; exact Hl).
+  rewrite lmapp_app, length_firstn, length_amap, Nat.min_l by lia. rewrite nth_amap by exact Hl.
+  unfold Et. cbn [Nat.add]. rewrite <- (a_decomp a). reflexivity.
+Qed.
+
+Lemma inp_0 : forall w, inp w 0 = rep 3 (xs 0).
+Proof. intro w. unfold inp, pn, stp, lyr. rewrite Nat.Div0.div_0_l, Nat.Div0.mod_0_l. reflexivity. Qed.
+
+Lemma inp_S : forall w a, lyr (S a) <> 0%nat -> inp w (S a) = out w a.
+Proof.
+  intros w a H. destruct (lyr_succ a) as [(E & _)|(E1 & _ & E2)]; [contradiction|].
+  unfold inp, out. rewrite E1, E2. reflexivity.
+Qed.
+
+Lemma inp_B : forall w a, lyr (S a) = 0%nat -> inp w (S a) = reset (xs (S (stp a))) (out w a).
+Proof.
+  intros w a H. destruct (lyr_succ a) as [(_ & E1 & E2)|(_ & E & _)]; [|contradiction].
+  unfold inp, out. rewrite H, E2, E1. unfold pn. rewrite firstn_0. cbn [lmapp run3].
+  replace (S (length Ls - 1)) with (length Ls) by (pose proof NL_pos; lia).
+  rewrite firstn_all2 by (rewrite length_amap; lia). reflexivity.
+Qed.
+
+Lemma exin_0 : exin 0 = xs 0.
+Proof. unfold exin, stp, lyr. rewrite Nat.Div0.div_0_l, Nat.Div0.mod_0_l. reflexivity. Qed.
+
+Lemma exin_S : forall a, lyr (S a) <> 0%nat -> exin (S a) = exo a.
+Proof.
+  intros a H. destruct (lyr_succ a) as [(E & _)|(E1 & _ & E2)]; [contradiction|].
+  unfold exin, exo, lay. rewrite E1, E2. apply lin_S. apply lyr_lt.
+Qed.
+
+Lemma exin_B : forall a, lyr (S a) = 0%nat -> exin (S a) = xs (S (stp a)) /\ exo a = lmap Ls (xs (stp a)).
+Proof.
+  intros a H. destruct (lyr_succ a) as [(_ & E1 & E2)|(_ & E & _)]; [|contradiction]. split.
+  - unfold exin. rewrite H, E2. reflexivity.
+  - unfold exo, lay, exin. rewrite E1. rewrite <- lin_S by (pose proof NL_pos; lia).
+    replace (S (length Ls - 1)) with (length Ls) by (pose proof NL_pos; lia). unfold lin. rewrite firstn_all. reflexivity.
+Qed.
+
+Lemma wia_0 : wia 0 = n.
+Proof. unfold wia, lyr. rewrite Nat.Div0.mod_0_l. reflexivity. Qed.
+
+Lemma wia_S : forall a, lyr (S a) <> 0%nat -> wia (S a) = nla a.
+Proof.
+  intros a H. destruct (lyr_succ a) as [(E & _)|(E1 & _ & _)]; [contradiction|]. unfold wia, nla, lay. rewrite E1. reflexivity.
+Qed.
+
+Lemma wia_B : forall a, lyr (S a) = 0%nat -> wia (S a) = n /\ nla a = n.
+Proof.
+  intros a H. destruct (lyr_succ a) as [(_ & E1 & _)|(_ & E & _)]; [|contradiction]. split.
+  - unfold wia. rewrite H. reflexivity.
+  - unfold nla, lay. rewrite E1, <- (last_nth' _ Ls [] Hne). exact Hlast.
+Qed.
+
+Lemma len_exin : forall a, length (exin a) = wia a.
+Proof. intro a. unfold exin, wia. rewrite lin_len' by (pose proof (lyr_lt a); lia). rewrite Hxs. reflexivity. Qed.
+
+Lemma len_exo : forall a, length (exo a) = nla a.
+Proof. intro a. unfold exo, lfire. rewrite length_map. reflexivity. Qed.
+
+Lemma len_out : forall w a, length (out w a) = (3 * nla a)%nat.
+Proof. intros w a. rewrite out_eq, length_lfirep, length_alayer. reflexivity. Qed.
+
+Lemma len_reset : forall x o, length (reset x o) = length o.
+Proof. intros x o. unfold reset. rewrite length_map, length_seq. reflexivity. Qed.
+
+Lemma len_inp : forall w a, length (inp w a) = (3 * wia a)%nat.
+Proof.
+  intros w [|a].
+  - rewrite inp_0, wia_0, length_rep, Hxs. reflexivity.
+  - destruct (Nat.eq_dec (lyr (S a)) 0) as [H|H].
+    + rewrite inp_B, len_reset, len_out by exact H. destruct (wia_B a H) as [-> ->]. reflexivity.
+    + rewrite inp_S, len_out, wia_S by exact H. reflexivity.
+Qed.
+
+Lemma nth_reset : forall x o q, (q < length o)%nat ->
+  nth q (reset x o) false = if Dv (q mod n) then nth (q mod n) x false else nth q o false.
+Proof. intros x o q Hq. unfold reset. rewrite nth_map_seq by exact Hq. reflexivity. Qed.
+
+(* the inputs of step 0 are exact; inside a step the inputs of a layer are the outputs of the layer before; between
+   steps the device cells are exact and the other state bits are the outputs of the last layer *)
+Lemma wib_0 : forall w q, (q < 3 * n)%nat -> wib w 0 q = false.
+Proof.
+  intros w q Hq. unfold wib. rewrite inp_0, exin_0, wia_0. rewrite nth_rep_mod by (rewrite Hxs; exact Hq).
+  rewrite Hxs, Bool.eqb_reflx. reflexivity.
+Qed.
+
+Lemma wib_S : forall w a q, lyr (S a) <> 0%nat -> wib w (S a) q = wb w a q.
+Proof. intros w a q H. unfold wib, wb. rewrite inp_S, exin_S, wia_S by exact H. reflexivity. Qed.
+
+Lemma wib_B : forall w a q, lyr (S a) = 0%nat -> (q < 3 * n)%nat ->
+  wib w (S a) q = if Dv (q mod n) then false else wb w a q.
+Proof.
+  intros w a q H Hq. destruct (exin_B a H) as [E1 E2]. destruct (wia_B a H) as [W1 W2].
+  unfold wib, wb. rewrite inp_B by exact H. rewrite E1, W1. rewrite nth_reset by (rewrite len_out, W2; exact Hq).
+  assert (Hj : (q mod n < n)%nat) by (apply Nat.mod_upper_bound; lia).
+  destruct (Dv (q mod n)) eqn:Ed.
+  - rewrite Bool.eqb_reflx. reflexivity.
+  - rewrite E2, W2, (Hstep (stp a) (q mod n) Hj Ed). reflexivity.
+Qed.
+
+Lemma rowa_ok : forall a i, (i < nla a)%nat -> rowok (wia a) (rowa a i).
+Proof. intros a i Hi. exact (urow_ok Ls n HL (lyr a) i (lyr_lt a) Hi). Qed.
+
+Lemma exo_nth : forall a i, (i < nla a)%nat -> nth i (exo a) false = Z.leb 0 (zv a i).
+Proof. intros a i Hi. unfold exo. rewrite lfire_nth by exact Hi. reflexivity. Qed.
+
+(* a wrong copy of row i is a perturbation beyond D - |S_v| on the far side *)
+Lemma wrong_far : forall w a q, (q < 3 * nla a)%nat -> wb w a q = true ->
+  far (zv a (q mod nla a)) (Sc w a (q mod nla a)) (X (vid a q) w).
+Proof.
+  intros w a q Hq Hw. assert (Hn0 : nla a <> 0%nat) by lia.
+  set (i := (q mod nla a)%nat). assert (Hi : (i < nla a)%nat) by (apply Nat.mod_upper_bound; exact Hn0).
+  pose proof (rowa_ok a i Hi) as Hu. set (u := rowa a i) in *.
+  unfold zv. fold u. rewrite <- len_exin in Hu. apply (far_core u (exin a) (inp w a)); [exact Hu | |].
+  - rewrite len_exin in Hu |- *. destruct (arow_ok 3 _ _ Hu) as [Hnd Hlt].
+    assert (E : forall p, In p (tin (arow 3 (wia a) u)) ->
+                  (negb (Bool.eqb (nth (fst p) (inp w a) false) (nth (fst p) (rep 3 (exin a)) false))
+                   && tw (pre u (exin a)) (snd p) (nth (fst p) (rep 3 (exin a)) false))
+                  = (wib w a (fst p) && tT a i (fst p mod wia a))).
+    { intros [q' z] Hin. cbn [fst snd]. destruct (in_arow _ _ _ _ _ Hin) as (c & j & Hc & Hj & ->).
+      destruct Hu as [Hnd' Hl']. destruct (Hl' j z Hj) as [Hjw _].
+      assert (Hm : ((c * wia a + j) mod wia a = j)%nat)
+        by (rewrite Nat.add_comm, Nat.Div0.mod_add; apply Nat.mod_small; exact Hjw).
+      assert (Hr : nth (c * wia a + j) (rep 3 (exin a)) false = nth j (exin a) false).
+      { rewrite <- len_exin. apply nth_rep; [exact Hc | rewrite len_exin; exact Hjw]. }
+      unfold wib, tT. fold u. rewrite Hm, Hr, (wgt_in u j z Hnd' Hj). reflexivity. }
+    rewrite (filter_ext_in _ _ _ E). unfold Sc.
+    exact (filter_pos_le (tin (arow 3 (wia a) u)) (fun q => wib w a q && tT a i (q mod wia a)) (3 * wia a) Hnd
+             (fun j z Hin => proj1 (Hlt j z Hin))).
+  - rewrite len_exin. intro E. unfold wb in Hw. rewrite out_eq in Hw.
+    rewrite nth_lfirep in Hw by (rewrite length_alayer; exact Hq).
+    rewrite nth_alayer in Hw by exact Hq. fold (nla a) in Hw. fold i in Hw. fold (rowa a i) in Hw. fold u in Hw.
+    rewrite exo_nth in Hw by exact Hi. fold i u in Hw. unfold zv in Hw. fold u in Hw. rewrite E, Bool.eqb_reflx in Hw.
+    discriminate.
+Qed.
+
+(* ---- stops ----------------------------------------------------------------------------------------------------------- *)
+(* a layer is a stop when a wrong copy of one of its rows has |S_v| >= 2, or when it is the last layer of a step and one
+   of its rows has two wrong copies *)
+Definition stop1 (w : Omega) (a : nat) : bool :=
+  existsb (fun q => wb w a q && Nat.leb 2 (Sc w a (q mod nla a))) (seq 0 (3 * nla a)).
+Definition stop2 (w : Omega) (a : nat) : bool :=
+  Nat.eqb (lyr a) (length Ls - 1) && existsb (fun i => Nat.leb 2 (ncw w a i)) (seq 0 (nla a)).
+Definition stopb (w : Omega) (a : nat) : bool := stop1 w a || stop2 w a.
+
+(* no stop up to layer a, no stop before layer a *)
+Definition Gu (a : nat) (w : Omega) : Prop := forall a', (a' <= a)%nat -> stopb w a' = false.
+Definition Gb (a : nat) (w : Omega) : Prop := forall a', (a' < a)%nat -> stopb w a' = false.
+(* W_v: row i of layer a has a wrong copy and no layer up to a is a stop; the same for input j of layer a *)
+Definition Wv (a i : nat) (w : Omega) : Prop := (0 < ncw w a i)%nat /\ Gu a w.
+Definition Win (a j : nat) (w : Omega) : Prop := (0 < nci w a j)%nat /\ Gb a w.
+(* no layer before a is a stop, |S_v| <= 1, and row i has two wrong copies, or three *)
+Definition E2 (a i : nat) (w : Omega) : Prop := Gb a w /\ (Sc w a i <= 1)%nat /\ (2 <= ncw w a i)%nat.
+Definition E3 (a i : nat) (w : Omega) : Prop := Gb a w /\ (Sc w a i <= 1)%nat /\ ncw w a i = 3%nat.
+
+Lemma Gu_Gb : forall a w, Gu a w <-> Gb (S a) w.
+Proof. intros a w. unfold Gu, Gb. split; intros H a' Ha'; apply H; lia. Qed.
+
+(* where no stop lies, a wrong copy has |S_v| <= 1, and in the last layer of a step no row has two wrong copies *)
+Lemma nostop_Sc : forall w a q, stopb w a = false -> (q < 3 * nla a)%nat -> wb w a q = true -> (Sc w a (q mod nla a) <= 1)%nat.
+Proof.
+  intros w a q H Hq Hw. apply orb_false_iff in H as [H1 _]. pose proof (existsb_seq_false _ _ H1 q Hq) as E.
+  cbv beta in E. rewrite Hw in E. cbn [andb] in E. apply Nat.leb_gt in E. lia.
+Qed.
+
+Lemma nostop_ncw : forall w a i, stopb w a = false -> lyr a = (length Ls - 1)%nat -> (i < nla a)%nat -> (ncw w a i <= 1)%nat.
+Proof.
+  intros w a i H Hl Hi. apply orb_false_iff in H as [_ H2]. unfold stop2 in H2. rewrite Hl, Nat.eqb_refl in H2.
+  cbn [andb] in H2. pose proof (existsb_seq_false _ _ H2 i Hi) as E. cbv beta in E. apply Nat.leb_gt in E. lia.
+Qed.
+
+Lemma ncw_copy : forall w a i, (0 < ncw w a i)%nat -> exists c, (c < 3)%nat /\ wb w a (c * nla a + i) = true.
+Proof. intros w a i H. apply ncnt_pos in H as (c & Hc & E). exists c. split; assumption. Qed.
+
+(* |S_v| >= 1 gives an input j in T(v) with a wrong copy *)
+Lemma Sc_pos : forall w a i, (0 < Sc w a i)%nat -> exists j, (j < wia a)%nat /\ tT a i j = true /\ (0 < nci w a j)%nat.
+Proof.
+  intros w a i H. apply ncnt_pos in H as (q & Hq & E). apply andb_prop in E as [E1 E2].
+  assert (Hw : (0 < wia a)%nat) by lia. exists (q mod wia a). split; [apply Nat.mod_upper_bound; lia|]. split; [exact E2|].
+  apply (ncnt_ge1 3 _ (q / wia a)); [apply Nat.Div0.div_lt_upper_bound; lia|].
+  rewrite <- (cp_split q (wia a) Hw). exact E1.
+Qed.
+
+(* |S_v| >= 2: two distinct inputs in T(v) with wrong copies, or all of them copies of one input j, |S_v| its wrong
+   copies *)
+Lemma Sc_two : forall w a i, (2 <= Sc w a i)%nat ->
+  (exists j1 j2, (j1 < j2)%nat /\ (j2 < wia a)%nat /\ tT a i j1 = true /\ tT a i j2 = true /\ (0 < nci w a j1)%nat /\ (0 < nci w a j2)%nat)
+  \/ (exists j, (j < wia a)%nat /\ tT a i j = true /\ Sc w a i = nci w a j).
+Proof.
+  intros w a i H. assert (Hw : (0 < wia a)%nat) by (unfold Sc in H; destruct (wia a); [cbn in H; lia | lia]).
+  destruct (ncnt_pos (3 * wia a) (fun q => wib w a q && tT a i (q mod wia a)) ltac:(unfold Sc in H; lia)) as (q1 & Hq1 & E1).
+  set (j := (q1 mod wia a)%nat). apply andb_prop in E1 as [W1 T1].
+  assert (Hj : (j < wia a)%nat) by (apply Nat.mod_upper_bound; lia).
+  assert (N1 : (0 < nci w a j)%nat).
+  { apply (ncnt_ge1 3 _ (q1 / wia a)); [apply Nat.Div0.div_lt_upper_bound; lia|]. cbv beta. unfold j.
+    rewrite <- (cp_split q1 (wia a) Hw). exact W1. }
+  destruct (search (3 * wia a) (fun q => wib w a q && tT a i (q mod wia a) && negb (Nat.eqb (q mod wia a) j) = true))
+    as [(q2 & Hq2 & E2)|Hn].
+  - intro q. destruct (wib w a q && tT a i (q mod wia a) && negb (Nat.eqb (q mod wia a) j)); [left | right]; congruence.
+  - left. apply andb_prop in E2 as [E2 Ne]. apply andb_prop in E2 as [W2 T2]. apply negb_true_iff, Nat.eqb_neq in Ne.
+    assert (Hj2 : (q2 mod wia a < wia a)%nat) by (apply Nat.mod_upper_bound; lia).
+    assert (N2 : (0 < nci w a (q2 mod wia a))%nat).
+    { apply (ncnt_ge1 3 _ (q2 / wia a)); [apply Nat.Div0.div_lt_upper_bound; lia|]. rewrite <- (cp_split q2 (wia a) Hw). exact W2. }
+    destruct (Nat.lt_ge_cases j (q2 mod wia a)) as [L|L].
+    + exists j, (q2 mod wia a). repeat split; assumption.
+    + exists (q2 mod wia a), j. repeat split; try assumption; lia.
+  - right. exists j. split; [exact Hj|]. split; [exact T1|]. unfold Sc, nci.
+    rewrite (ncnt_ext (3 * wia a) _ (fun q => wib w a q && Nat.eqb (q mod wia a) j)).
+    + apply ncnt_row. exact Hj.
+    + intros q Hq. specialize (Hn q Hq). destruct (wib w a q) eqn:Wq; [|reflexivity]. cbn [andb] in Hn |- *.
+      destruct (Nat.eqb_spec (q mod wia a) j) as [Eq|Eq].
+      * rewrite Eq. exact T1.
+      * destruct (tT a i (q mod wia a)); [exfalso; apply Hn; reflexivity | reflexivity].
+Qed.
+
+(* ---- the probability space ---------------------------------------------------------------------------------- *)
+Variable P : (Omega -> Prop) -> R.
+Hypothesis P_mono : forall A B : Omega -> Prop, (forall w, A w -> B w) -> P A <= P B.
+Hypothesis P_or : forall A B : Omega -> Prop, P (fun w => A w \/ B w) <= P A + P B.
+Hypothesis P_empty : P (fun _ => False) = 0.
+Hypothesis P_true : P (fun _ => True) = 1.
+Hypothesis P_indep : forall (I J : nat -> Prop) (A B : Omega -> Prop), (forall g, I g -> J g -> False) ->
+  dep Omega X I A -> dep Omega X J B -> P (fun w => A w /\ B w) = P A * P B.
+(* P adds on disjoint events built from the threshold events *)
+Hypothesis P_add : forall A B, meas Omega X A -> meas Omega X B -> (forall w, A w -> B w -> False) ->
+  P (fun w => A w \/ B w) = P A + P B.
+Variable s : R.
+Hypothesis Hs : 0 < s.
+Hypothesis tail_ge : forall g c, P (fun w => c <= X g w) = Q (c / s).
+Hypothesis tail_le : forall g c, P (fun w => X g w <= c) = Q (- c / s).
+Hypothesis vid_inj : forall a q a' q', vid a q = vid a' q' -> a = a' /\ q = q'.
+
+Lemma Pex : forall m (A : nat -> Omega -> Prop), P (fun w => exists k, (k < m)%nat /\ A k w) <= rsum m (fun k => P (A k)).
+Proof. exact (P_exists Omega P P_mono P_or P_empty). Qed.
+
+Lemma Pnn : forall A, 0 <= P A.
+Proof. exact (P_nonneg Omega P P_mono P_empty). Qed.
+
+Lemma Ple1 : forall A, P A <= 1.
+Proof. exact (P_le1 Omega P P_mono P_true). Qed.
+
+Lemma Pnone : forall A : Omega -> Prop, (forall w, ~ A w) -> P A = 0.
+Proof. intros A H. apply Rle_antisym; [rewrite <- P_empty; apply P_mono; intros w Hw; exact (H w Hw) | apply Pnn]. Qed.
+
+Lemma P_or3 : forall A B C : Omega -> Prop, P (fun w => A w \/ B w \/ C w) <= P A + P B + P C.
+Proof. intros A B C. eapply Rle_trans; [apply P_or|]. pose proof (P_or B C). lra. Qed.
+
+(* the union bound over the j < m that pass a test T *)
+Lemma P_sum : forall m (T : nat -> bool) (A : nat -> Omega -> Prop) (b : nat -> R),
+  (forall j, (j < m)%nat -> T j = true -> P (A j) <= b j) ->
+  P (fun w => exists j, (j < m)%nat /\ T j = true /\ A j w) <= rsum m (fun j => if T j then b j else 0).
+Proof.
+  intros m T A b H. eapply Rle_trans; [apply (Pex m (fun j w => T j = true /\ A j w))|]. apply rsum_le. intros j Hj.
+  destruct (T j) eqn:E.
+  - eapply Rle_trans; [|apply (H j Hj E)]. apply P_mono. intros w [_ Hw]. exact Hw.
+  - right. apply Pnone. intros w [C _]. discriminate.
+Qed.
+
+(* events on distinct variables are independent *)
+Lemma P_ind2 : forall g1 g2 (A B : R -> Prop), g1 <> g2 ->
+  P (fun w => A (X g1 w) /\ B (X g2 w)) = P (fun w => A (X g1 w)) * P (fun w => B (X g2 w)).
+Proof.
+  intros g1 g2 A B Hg. apply (P_indep (fun g => g = g1) (fun g => g = g2)).
+  - intros g -> E. exact (Hg E).
+  - intros w w' H. rewrite (H g1 eq_refl). reflexivity.
+  - intros w w' H. rewrite (H g2 eq_refl). reflexivity.
+Qed.
+
+Lemma P_ind3 : forall g1 g2 g3 (A B C : R -> Prop), g1 <> g2 -> g1 <> g3 -> g2 <> g3 ->
+  P (fun w => A (X g1 w) /\ B (X g2 w) /\ C (X g3 w))
+  = P (fun w => A (X g1 w)) * P (fun w => B (X g2 w)) * P (fun w => C (X g3 w)).
+Proof.
+  intros g1 g2 g3 A B C H12 H13 H23.
+  rewrite (P_indep (fun g => g = g1) (fun g => g = g2 \/ g = g3) (fun w => A (X g1 w)) (fun w => B (X g2 w) /\ C (X g3 w))).
+  - rewrite P_ind2 by exact H23. ring.
+  - intros g -> [E|E]; [exact (H12 E) | exact (H13 E)].
+  - intros w w' H. rewrite (H g1 eq_refl). reflexivity.
+  - intros w w' H. rewrite (H g2 (or_introl eq_refl)), (H g3 (or_intror eq_refl)). reflexivity.
+Qed.
+
+(* unions over the three copies of a row, and over pairs of copies *)
+Lemma P_copies : forall (g : nat -> nat) (A : R -> Prop) p, (forall c, (c < 3)%nat -> P (fun w => A (X (g c) w)) <= p) ->
+  P (fun w => exists c, (c < 3)%nat /\ A (X (g c) w)) <= 3 * p.
+Proof.
+  intros g A p H. eapply Rle_trans; [apply (Pex 3 (fun c w => A (X (g c) w)))|].
+  cbn [rsum]. pose proof (H 0%nat ltac:(lia)). pose proof (H 1%nat ltac:(lia)). pose proof (H 2%nat ltac:(lia)). lra.
+Qed.
+
+Lemma P_copy_pairs : forall (g1 g2 : nat -> nat) (A B : R -> Prop) pA pB,
+  (forall c1 c2, (c1 < 3)%nat -> (c2 < 3)%nat -> g1 c1 <> g2 c2) ->
+  (forall c, (c < 3)%nat -> P (fun w => A (X (g1 c) w)) <= pA) -> (forall c, (c < 3)%nat -> P (fun w => B (X (g2 c) w)) <= pB) ->
+  P (fun w => exists c1, (c1 < 3)%nat /\ exists c2, (c2 < 3)%nat /\ A (X (g1 c1) w) /\ B (X (g2 c2) w)) <= 9 * pA * pB.
+Proof.
+  intros g1 g2 A B pA pB Hg HA HB.
+  eapply Rle_trans; [apply (Pex 3 (fun c1 w => exists c2, (c2 < 3)%nat /\ A (X (g1 c1) w) /\ B (X (g2 c2) w)))|].
+  assert (Hc : forall c1, (c1 < 3)%nat ->
+                 P (fun w => exists c2, (c2 < 3)%nat /\ A (X (g1 c1) w) /\ B (X (g2 c2) w)) <= 3 * (pA * pB)).
+  { intros c1 Hc1. eapply Rle_trans; [apply (Pex 3 (fun c2 w => A (X (g1 c1) w) /\ B (X (g2 c2) w)))|].
+    assert (Hp : forall c2, (c2 < 3)%nat -> P (fun w => A (X (g1 c1) w) /\ B (X (g2 c2) w)) <= pA * pB).
+    { intros c2 Hc2. rewrite P_ind2 by (apply Hg; assumption).
+      apply Rmult_le_compat; [apply Pnn | apply Pnn | apply HA; exact Hc1 | apply HB; exact Hc2]. }
+    cbn [rsum]. pose proof (Hp 0%nat ltac:(lia)). pose proof (Hp 1%nat ltac:(lia)). pose proof (Hp 2%nat ltac:(lia)). lra. }
+  cbn [rsum]. pose proof (Hc 0%nat ltac:(lia)). pose proof (Hc 1%nat ltac:(lia)). pose proof (Hc 2%nat ltac:(lia)). lra.
+Qed.
+
+Lemma P_copy_lt : forall (g : nat -> nat) (A B : R -> Prop) pA pB, (forall c1 c2, (c1 < 3)%nat -> (c2 < 3)%nat -> c1 <> c2 -> g c1 <> g c2) ->
+  (forall c, (c < 3)%nat -> P (fun w => A (X (g c) w)) <= pA) -> (forall c, (c < 3)%nat -> P (fun w => B (X (g c) w)) <= pB) ->
+  P (fun w => exists c1 c2, (c1 < c2)%nat /\ (c2 < 3)%nat /\ A (X (g c1) w) /\ B (X (g c2) w)) <= 3 * pA * pB.
+Proof.
+  intros g A B pA pB Hg HA HB.
+  eapply Rle_trans; [apply (P_mono _ (fun w => (A (X (g 0%nat) w) /\ B (X (g 1%nat) w)) \/ (A (X (g 0%nat) w) /\ B (X (g 2%nat) w))
+                                                \/ (A (X (g 1%nat) w) /\ B (X (g 2%nat) w))))|].
+  - intros w (c1 & c2 & H1 & H2 & Ha & Hb).
+    destruct c1 as [|[|c1]]; destruct c2 as [|[|[|c2]]]; try lia; auto.
+  - eapply Rle_trans; [apply P_or3|].
+    assert (Hp : forall c1 c2, (c1 < 3)%nat -> (c2 < 3)%nat -> c1 <> c2 -> P (fun w => A (X (g c1) w) /\ B (X (g c2) w)) <= pA * pB).
+    { intros c1 c2 H1 H2 H12. rewrite P_ind2 by (apply Hg; assumption).
+      apply Rmult_le_compat; [apply Pnn | apply Pnn | apply HA; exact H1 | apply HB; exact H2]. }
+    pose proof (Hp 0%nat 1%nat ltac:(lia) ltac:(lia) ltac:(lia)). pose proof (Hp 0%nat 2%nat ltac:(lia) ltac:(lia) ltac:(lia)).
+    pose proof (Hp 1%nat 2%nat ltac:(lia) ltac:(lia) ltac:(lia)). lra.
+Qed.
+
+(* ---- the perturbation that fails a copy ------------------------------------------------------------------------ *)
+(* q_k(v) = Q((D_v - k)/s) and Delta_v = q_1(v) - q_0(v) *)
+Definition qk (a i k : nat) : R := Q ((3 * Rabs (IZR (zv a i) + 1/2) - INR k) / s).
+Definition dl (a i : nat) : R := qk a i 1 - qk a i 0.
+
+Lemma qk_range : forall a i k, 0 <= qk a i k <= 1.
+Proof. intros. apply Q_range. Qed.
+
+Lemma qk_mono : forall a i k k', (k <= k')%nat -> qk a i k <= qk a i k'.
+Proof.
+  intros a i k k' H. unfold qk. apply Q_decr. apply le_INR in H. unfold Rdiv.
+  apply Rmult_le_compat_r; [apply Rlt_le, Rinv_0_lt_compat; exact Hs | lra].
+Qed.
+
+Lemma dl_nn : forall a i, 0 <= dl a i.
+Proof. intros a i. unfold dl. pose proof (qk_mono a i 0 1 ltac:(lia)). lra. Qed.
+
+Lemma far_dec : forall z k e, far z k e \/ ~ far z k e.
+Proof.
+  intros z k e. unfold far. destruct (Z.leb 0 z).
+  - destruct (Rlt_dec e (- (3 * Rabs (IZR z + 1/2) - INR k))); [left | right]; assumption.
+  - destruct (Rle_dec (3 * Rabs (IZR z + 1/2) - INR k) e); [left | right]; assumption.
+Qed.
+
+Lemma far_mono : forall z k k' e, (k <= k')%nat -> far z k e -> far z k' e.
+Proof. intros z k k' e H. apply le_INR in H. unfold far. destruct (Z.leb 0 z); lra. Qed.
+
+Lemma P_far : forall a i k g, P (fun w => far (zv a i) k (X g w)) <= qk a i k.
+Proof.
+  intros a i k g. unfold far, qk. set (D := 3 * Rabs (IZR (zv a i) + 1/2)). destruct (Z.leb 0 (zv a i)).
+  - eapply Rle_trans; [apply (P_mono _ (fun w => X g w <= - (D - INR k))); intros w H; lra|].
+    rewrite tail_le. right. f_equal. field. lra.
+  - rewrite tail_ge. right. reflexivity.
+Qed.
+
+Lemma P_band : forall g c1 c0, c1 <= c0 -> P (fun w => c1 <= X g w /\ ~ c0 <= X g w) = Q (c1 / s) - Q (c0 / s).
+Proof.
+  intros g c1 c0 H.
+  assert (E : P (fun w => c1 <= X g w) = P (fun w => c0 <= X g w) + P (fun w => c1 <= X g w /\ ~ c0 <= X g w)).
+  { rewrite <- P_add.
+    - apply (P_ext Omega P P_mono). intro w. split.
+      + intro H1. destruct (Rle_dec c0 (X g w)) as [H0|H0]; [left; exact H0 | right; split; assumption].
+      + intros [H0|[H1 _]]; [lra | exact H1].
+    - apply meas_ge.
+    - apply meas_and; [apply meas_ge | apply meas_not, meas_ge].
+    - intros w H0 [_ H1]. exact (H1 H0). }
+  rewrite !tail_ge in E. lra.
+Qed.
+
+Lemma P_far10 : forall a i g, P (fun w => far (zv a i) 1 (X g w) /\ ~ far (zv a i) 0 (X g w)) <= dl a i.
+Proof.
+  intros a i g. unfold far, dl, qk. set (D := 3 * Rabs (IZR (zv a i) + 1/2)). cbn [INR]. destruct (Z.leb 0 (zv a i)).
+  - rewrite (P_ext Omega P P_mono _ (fun w => - D <= X g w /\ ~ - (D - 1) <= X g w)).
+    + rewrite P_band by lra. replace (- D / s) with (- (D / s)) by (field; lra).
+      replace (- (D - 1) / s) with (- ((D - 1) / s)) by (field; lra). rewrite !Q_sym. replace (D - 0) with D by ring. lra.
+    + intro w. split; intros [H1 H2]; (split; [lra | intro; lra]).
+  - rewrite (P_ext Omega P P_mono _ (fun w => D - 1 <= X g w /\ ~ D <= X g w)).
+    + rewrite P_band by lra. replace (D - 0) with D by ring. lra.
+    + intro w. split; intros [H1 H2]; (split; [lra | intro; lra]).
+Qed.
+
+(* ---- what the events depend on --------------------------------------------------------------------------------- *)
+(* the variables of the layers before a, and of layer a *)
+Definition pastv (a g : nat) : Prop := exists a' q, (a' < a)%nat /\ g = vid a' q.
+Definition nowv (a g : nat) : Prop := exists q, g = vid a q.
+
+Lemma past_now : forall a g, pastv a g -> nowv a g -> False.
+Proof. intros a g (a' & q & Ha & ->) (q' & E). apply vid_inj in E as [E _]. lia. Qed.
+
+Lemma P_pn : forall a (A B : Omega -> Prop), dep Omega X (pastv a) A -> dep Omega X (nowv a) B ->
+  P (fun w => A w /\ B w) = P A * P B.
+Proof. intros a A B HA HB. apply (P_indep (pastv a) (nowv a)); [exact (past_now a) | exact HA | exact HB]. Qed.
+
+Lemma dep_now : forall a (F : (nat -> R) -> Prop), dep Omega X (nowv a) (fun w => F (fun q => X (vid a q) w)).
+Proof.
+  intros a F w w' H. replace (fun q => X (vid a q) w') with (fun q => X (vid a q) w); [reflexivity|].
+  apply functional_extensionality. intro q. apply H. exists q. reflexivity.
+Qed.
+
+Lemma dep_and : forall I (A B : Omega -> Prop), dep Omega X I A -> dep Omega X I B -> dep Omega X I (fun w => A w /\ B w).
+Proof. intros I A B HA HB w w' H. rewrite (HA w w' H), (HB w w' H). reflexivity. Qed.
+
+Lemma dep_or : forall I (A B : Omega -> Prop), dep Omega X I A -> dep Omega X I B -> dep Omega X I (fun w => A w \/ B w).
+Proof. intros I A B HA HB w w' H. rewrite (HA w w' H), (HB w w' H). reflexivity. Qed.
+
+Lemma dep_ex : forall I m (T : nat -> Prop) (A : nat -> Omega -> Prop), (forall j, dep Omega X I (A j)) ->
+  dep Omega X I (fun w => exists j, (j < m)%nat /\ T j /\ A j w).
+Proof.
+  intros I m T A HA w w' H. split; intros (j & Hj & Tj & Aj); exists j; split; [exact Hj | | exact Hj |];
+    (split; [exact Tj|]); [apply (HA j w w' H) | apply (HA j w w' H)]; exact Aj.
+Qed.
+
+Lemma dep_mono : forall I J (A : Omega -> Prop), (forall g, I g -> J g) -> dep Omega X I A -> dep Omega X J A.
+Proof. intros I J A HIJ HA w w' H. apply HA. intros g Hg. apply H. apply HIJ. exact Hg. Qed.
+
+Lemma pastv_S : forall a g, pastv a g -> pastv (S a) g.
+Proof. intros a g (a' & q & Ha & E). exists a', q. split; [lia | exact E]. Qed.
+
+(* the run up to layer a reads only the variables of layers up to a *)
+Lemma inp_ext : forall w w' a, (forall a' q, (a' < a)%nat -> X (vid a' q) w = X (vid a' q) w') -> inp w a = inp w' a.
+Proof.
+  intros w w' a. induction a as [|a IH]; intro H; [rewrite !inp_0; reflexivity|].
+  assert (Eo : out w a = out w' a).
+  { rewrite !out_eq, (IH (fun a' q Ha' => H a' q ltac:(lia))). apply lfirep_ext. intros q _. apply H. lia. }
+  destruct (Nat.eq_dec (lyr (S a)) 0) as [B|B]; [rewrite !inp_B by exact B | rewrite !inp_S by exact B]; rewrite Eo; reflexivity.
+Qed.
+
+Lemma out_ext : forall w w' a, (forall a' q, (a' <= a)%nat -> X (vid a' q) w = X (vid a' q) w') -> out w a = out w' a.
+Proof.
+  intros w w' a H. rewrite !out_eq, (inp_ext w w' a (fun a' q Ha' => H a' q ltac:(lia))). apply lfirep_ext.
+  intros q _. apply H. lia.
+Qed.
+
+Lemma stop_ext : forall w w' a, (forall a' q, (a' <= a)%nat -> X (vid a' q) w = X (vid a' q) w') -> stopb w a = stopb w' a.
+Proof.
+  intros w w' a H. unfold stopb, stop1, stop2, ncw, Sc, wb, wib.
+  rewrite (out_ext w w' a H), (inp_ext w w' a (fun a' q Ha' => H a' q ltac:(lia))). reflexivity.
+Qed.
+
+Lemma agree : forall a w w', (forall g, pastv a g -> X g w = X g w') -> forall a' q, (a' < a)%nat -> X (vid a' q) w = X (vid a' q) w'.
+Proof. intros a w w' H a' q Ha'. apply H. exists a', q. split; [exact Ha' | reflexivity]. Qed.
+
+Lemma dep_Gb : forall a, dep Omega X (pastv a) (Gb a).
+Proof.
+  intros a w w' H. pose proof (agree a w w' H) as Ag. unfold Gb.
+  assert (E : forall a', (a' < a)%nat -> stopb w a' = stopb w' a')
+    by (intros a' Ha'; apply stop_ext; intros a'' q Ha''; apply Ag; lia).
+  split; intros HG a' Ha'; [rewrite <- (E a' Ha') | rewrite (E a' Ha')]; apply HG; exact Ha'.
+Qed.
+
+Lemma dep_Win : forall a j, dep Omega X (pastv a) (Win a j).
+Proof.
+  intros a j w w' H. pose proof (agree a w w' H) as Ag. unfold Win, nci, wib.
+  rewrite (inp_ext w w' a Ag). rewrite (dep_Gb a w w' H). reflexivity.
+Qed.
+
+Lemma dep_Wv : forall a i, dep Omega X (pastv (S a)) (Wv a i).
+Proof.
+  intros a i w w' H. pose proof (agree (S a) w w' H) as Ag. unfold Wv, ncw, wb.
+  rewrite (out_ext w w' a (fun a' q Ha' => Ag a' q ltac:(lia))). rewrite !Gu_Gb, (dep_Gb (S a) w w' H). reflexivity.
+Qed.
+
+Lemma dep_E2 : forall a i, dep Omega X (pastv (S a)) (E2 a i).
+Proof.
+  intros a i w w' H. pose proof (agree (S a) w w' H) as Ag. unfold E2, ncw, Sc, wb, wib.
+  rewrite (out_ext w w' a (fun a' q Ha' => Ag a' q ltac:(lia))), (inp_ext w w' a (fun a' q Ha' => Ag a' q ltac:(lia))).
+  rewrite (dep_mono _ _ _ (pastv_S a) (dep_Gb a) w w' H). reflexivity.
+Qed.
+
+Lemma dep_E3 : forall a i, dep Omega X (pastv (S a)) (E3 a i).
+Proof.
+  intros a i w w' H. pose proof (agree (S a) w w' H) as Ag. unfold E3, ncw, Sc, wb, wib.
+  rewrite (out_ext w w' a (fun a' q Ha' => Ag a' q ltac:(lia))), (inp_ext w w' a (fun a' q Ha' => Ag a' q ltac:(lia))).
+  rewrite (dep_mono _ _ _ (pastv_S a) (dep_Gb a) w w' H). reflexivity.
+Qed.
+
+(* ---- the recursion of Proposition 6.14 ------------------------------------------------------------------------- *)
+(* X_v = sum of p over T(v) *)
+Definition Xs (a i : nat) (p : nat -> R) : R := rsum (wia a) (fun j => if tT a i j then p j else 0).
+(* the sum over T(v1) and T(v2) in K_{v1 v2} *)
+Definition Kpair (a i1 i2 : nat) (p : nat -> R) (k : nat -> nat -> R) : R :=
+  rsum (wia a) (fun j => if tT a i1 j && tT a i2 j then p j else 0)
+  + rsum (wia a) (fun j1 => rsum (wia a) (fun j2 => if tT a i1 j1 && tT a i2 j2 && negb (Nat.eqb j1 j2) then k j1 j2 else 0)).
+
+(* P and K of the inputs of layer a: zero on the state of step 0 and on the device cells of every state *)
+Fixpoint PK (a : nat) : (nat -> R) * (nat -> nat -> R) :=
+  match a with
+  | O => (fun _ => 0, fun _ _ => 0)
+  | S a' =>
+      let pv := fun i => 3 * qk a' i 0 + 3 * dl a' i * Xs a' i (fst (PK a')) in
+      let kv := fun i1 i2 => 9 * dl a' i1 * dl a' i2 * Kpair a' i1 i2 (fst (PK a')) (snd (PK a')) in
+      if Nat.eqb (lyr (S a')) 0 then (fun j => if Dv j then 0 else pv j, fun j1 j2 => if Dv j1 || Dv j2 then 0 else kv j1 j2)
+      else (pv, kv)
+  end.
+
+Definition Pin (a : nat) : nat -> R := fst (PK a).
+Definition Kin (a : nat) : nat -> nat -> R := snd (PK a).
+(* P_v, K_{v1 v2}, P^(2)_v and P^(3)_v of the rows of layer a *)
+Definition Pv (a i : nat) : R := 3 * qk a i 0 + 3 * dl a i * Xs a i (Pin a).
+Definition Kv (a i1 i2 : nat) : R := 9 * dl a i1 * dl a i2 * Kpair a i1 i2 (Pin a) (Kin a).
+Definition P2v (a i : nat) : R := 3 * qk a i 0 ^ 2 + 3 * (qk a i 1 ^ 2 - qk a i 0 ^ 2) * Xs a i (Pin a).
+Definition P3v (a i : nat) : R := qk a i 0 ^ 3 + (qk a i 1 ^ 3 - qk a i 0 ^ 3) * Xs a i (Pin a).
+(* P^(2) and P^(3) of the inputs of layer a, zero on every state *)
+Definition P2in (a j : nat) : R := if Nat.eqb (lyr a) 0 then 0 else P2v (a - 1) j.
+Definition P3in (a j : nat) : R := if Nat.eqb (lyr a) 0 then 0 else P3v (a - 1) j.
+
+(* the contribution of layer a to b(t) *)
+Definition bl (a : nat) : R :=
+  rsum (nla a) (fun i =>
+    Rmin 1 (3 * qk a i 2) * Xs a i (P2in a) + Rmin 1 (3 * qk a i 3) * Xs a i (P3in a)
+    + rsum (wia a) (fun j1 => rsum (wia a) (fun j2 =>
+        if tT a i j1 && tT a i j2 && Nat.ltb j1 j2 then Pin a j1 * Pin a j2 + Kin a j1 j2 else 0)))
+  + (if Nat.eqb (lyr a) (length Ls - 1) then rsum (nla a) (fun i => P2v a i) else 0).
+
+(* b(t): the sum over the layers of step t *)
+Definition bt (t : nat) : R := rsum (length Ls) (fun l => bl (t * length Ls + l)).
+
+Lemma Pin_S : forall a j, Pin (S a) j = if Nat.eqb (lyr (S a)) 0 then (if Dv j then 0 else Pv a j) else Pv a j.
+Proof. intros a j. unfold Pin, Pv. cbn [PK]. destruct (Nat.eqb (lyr (S a)) 0); reflexivity. Qed.
+
+Lemma Kin_S : forall a j1 j2,
+  Kin (S a) j1 j2 = if Nat.eqb (lyr (S a)) 0 then (if Dv j1 || Dv j2 then 0 else Kv a j1 j2) else Kv a j1 j2.
+Proof. intros a j1 j2. unfold Kin, Kv. cbn [PK]. destruct (Nat.eqb (lyr (S a)) 0); reflexivity. Qed.
+
+Lemma Xs_nn : forall a i p, (forall j, 0 <= p j) -> 0 <= Xs a i p.
+Proof. intros a i p H. apply rsum_nonneg. intros j _. destruct (tT a i j); [apply H | lra]. Qed.
+
+Lemma PK_nn : forall a, (forall j, 0 <= Pin a j) /\ (forall j1 j2, 0 <= Kin a j1 j2).
+Proof.
+  induction a as [|a [IP IK]]; [split; intros; unfold Pin, Kin; cbn; lra|].
+  assert (HP : forall i, 0 <= Pv a i).
+  { intro i. unfold Pv. pose proof (qk_range a i 0). pose proof (dl_nn a i). pose proof (Xs_nn a i _ IP). nra. }
+  assert (HK : forall i1 i2, 0 <= Kv a i1 i2).
+  { intros i1 i2. unfold Kv. pose proof (dl_nn a i1). pose proof (dl_nn a i2).
+    assert (0 <= Kpair a i1 i2 (Pin a) (Kin a)).
+    { unfold Kpair. apply Rplus_le_le_0_compat; apply rsum_nonneg; intros j1 _; [destruct (tT a i1 j1 && tT a i2 j1); [apply IP | lra]|].
+      apply rsum_nonneg. intros j2 _. destruct (tT a i1 j1 && tT a i2 j2 && negb (Nat.eqb j1 j2)); [apply IK | lra]. }
+    assert (0 <= 9 * dl a i1 * dl a i2) by (apply Rmult_le_pos; [apply Rmult_le_pos; lra | lra]). nra. }
+  split; [intro j; rewrite Pin_S | intros j1 j2; rewrite Kin_S];
+    destruct (Nat.eqb (lyr (S a)) 0); try destruct (Dv j); try destruct (Dv j1 || Dv j2); (lra || apply HP || apply HK).
+Qed.
+
+Lemma rsum_if_scal : forall m (T : nat -> bool) (p : nat -> R) c,
+  rsum m (fun j => if T j then p j * c else 0) = c * rsum m (fun j => if T j then p j else 0).
+Proof. intros m T p c. rewrite <- rsum_scal. apply rsum_ext. intros j _. destruct (T j); ring. Qed.
+
+(* ---- P(W_v) <= P_v ------------------------------------------------------------------------------------------------- *)
+Lemma claim_P : forall a i, (i < nla a)%nat -> (forall j, (j < wia a)%nat -> P (Win a j) <= Pin a j) -> P (Wv a i) <= Pv a i.
+Proof.
+  intros a i Hi HW. set (g := fun c => vid a (c * nla a + i)%nat).
+  eapply Rle_trans; [apply (P_mono _ (fun w => (exists c, (c < 3)%nat /\ far (zv a i) 0 (X (g c) w))
+      \/ (exists j, (j < wia a)%nat /\ tT a i j = true /\ (Win a j w /\
+            (exists c, (c < 3)%nat /\ (far (zv a i) 1 (X (g c) w) /\ ~ far (zv a i) 0 (X (g c) w)))))))|].
+  - intros w [Hn HG]. destruct (ncw_copy w a i Hn) as (c & Hc & Hwc).
+    assert (Hq : (c * nla a + i < 3 * nla a)%nat) by nia.
+    pose proof (wrong_far w a _ Hq Hwc) as Hf. pose proof (nostop_Sc w a _ (HG a (le_n a)) Hq Hwc) as HS.
+    rewrite cp_mod in Hf, HS by exact Hi.
+    destruct (far_dec (zv a i) 0 (X (g c) w)) as [F0|F0]; [left; exists c; split; assumption|].
+    right. assert (S1 : Sc w a i = 1%nat) by (destruct (Sc w a i) as [|[|k]]; [exfalso; apply F0; exact Hf | reflexivity | lia]).
+    destruct (Sc_pos w a i ltac:(lia)) as (j & Hj & Tj & Nj). exists j. split; [exact Hj|]. split; [exact Tj|]. split.
+    + split; [exact Nj|]. intros a' Ha'. apply HG. lia.
+    + exists c. split; [exact Hc|]. split; [rewrite S1 in Hf; exact Hf | exact F0].
+  - eapply Rle_trans; [apply P_or|].
+    pose proof (P_copies g (far (zv a i) 0) (qk a i 0) (fun c _ => P_far a i 0 (g c))) as B0.
+    assert (B1 : P (fun w => exists j, (j < wia a)%nat /\ tT a i j = true /\ (Win a j w /\
+                   (exists c, (c < 3)%nat /\ (far (zv a i) 1 (X (g c) w) /\ ~ far (zv a i) 0 (X (g c) w)))))
+                 <= rsum (wia a) (fun j => if tT a i j then Pin a j * (3 * dl a i) else 0)).
+    { apply P_sum. intros j Hj Tj. rewrite (P_pn a).
+      - apply Rmult_le_compat; [apply Pnn | apply Pnn | apply HW; exact Hj|].
+        exact (P_copies g (fun e => far (zv a i) 1 e /\ ~ far (zv a i) 0 e) (dl a i) (fun c _ => P_far10 a i (g c))).
+      - apply dep_Win.
+      - exact (dep_now a (fun f => exists c, (c < 3)%nat /\
+                 (far (zv a i) 1 (f (c * nla a + i)%nat) /\ ~ far (zv a i) 0 (f (c * nla a + i)%nat)))). }
+    rewrite rsum_if_scal in B1. unfold Pv, Xs. lra.
+Qed.
+
+(* ---- two and three wrong copies, and pairs of rows ---------------------------------------------------------------- *)
+Definition cpy (a i c : nat) : nat := (c * nla a + i)%nat.
+Definition F0 (z : Z) (e : R) : Prop := far z 0 e.
+Definition F10 (z : Z) (e : R) : Prop := far z 1 e /\ ~ far z 0 e.
+
+Lemma cpy_lt : forall a i c, (i < nla a)%nat -> (c < 3)%nat -> (cpy a i c < 3 * nla a)%nat.
+Proof. intros a i c Hi Hc. unfold cpy. nia. Qed.
+
+Lemma cpy_mod : forall a i c, (i < nla a)%nat -> (cpy a i c mod nla a = i)%nat.
+Proof. intros a i c Hi. apply cp_mod. exact Hi. Qed.
+
+Lemma vid_cpy : forall a i1 i2 c1 c2, (i1 < nla a)%nat -> (i2 < nla a)%nat -> (c1 <> c2 \/ i1 <> i2) ->
+  vid a (cpy a i1 c1) <> vid a (cpy a i2 c2).
+Proof.
+  intros a i1 i2 c1 c2 H1 H2 Hd E. apply vid_inj in E as [_ E]. apply cp_inj in E as [E1 E2]; [|exact H1 | exact H2].
+  destruct Hd; contradiction.
+Qed.
+
+Lemma P_or4 : forall A B C D : Omega -> Prop, P (fun w => A w \/ B w \/ C w \/ D w) <= P A + P B + P C + P D.
+Proof. intros A B C D. eapply Rle_trans; [apply P_or|]. pose proof (P_or3 B C D). lra. Qed.
+
+Lemma P_trip : forall g1 g2 g3 (A B C : R -> Prop) pa pb pc, g1 <> g2 -> g1 <> g3 -> g2 <> g3 ->
+  P (fun w => A (X g1 w)) <= pa -> P (fun w => B (X g2 w)) <= pb -> P (fun w => C (X g3 w)) <= pc ->
+  P (fun w => A (X g1 w) /\ B (X g2 w) /\ C (X g3 w)) <= pa * pb * pc.
+Proof.
+  intros g1 g2 g3 A B C pa pb pc H12 H13 H23 Ha Hb Hc. rewrite P_ind3 by assumption.
+  apply Rmult_le_compat; [apply Rmult_le_pos; apply Pnn | apply Pnn | | exact Hc].
+  apply Rmult_le_compat; [apply Pnn | apply Pnn | exact Ha | exact Hb].
+Qed.
+
+Lemma dep_ex0 : forall I m (A : nat -> Omega -> Prop), (forall j, dep Omega X I (A j)) ->
+  dep Omega X I (fun w => exists j, (j < m)%nat /\ A j w).
+Proof.
+  intros I m A HA w w' H. split; intros (j & Hj & Aj); exists j; split; [exact Hj | | exact Hj |];
+    [apply (HA j w w' H) | apply (HA j w w' H)]; exact Aj.
+Qed.
+
+(* the copies of the present layer: two of row i, then three, then one of each of two rows *)
+Definition N2 (a i : nat) (f : nat -> R) : Prop :=
+  (exists c1 c2, (c1 < c2)%nat /\ (c2 < 3)%nat /\ F10 (zv a i) (f (cpy a i c1)) /\ far (zv a i) 1 (f (cpy a i c2)))
+  \/ (exists c1 c2, (c1 < c2)%nat /\ (c2 < 3)%nat /\ F0 (zv a i) (f (cpy a i c1)) /\ F10 (zv a i) (f (cpy a i c2))).
+
+Definition N3 (a i : nat) (f : nat -> R) : Prop :=
+  (F10 (zv a i) (f (cpy a i 0)) /\ far (zv a i) 1 (f (cpy a i 1)) /\ far (zv a i) 1 (f (cpy a i 2)))
+  \/ (F0 (zv a i) (f (cpy a i 0)) /\ F10 (zv a i) (f (cpy a i 1)) /\ far (zv a i) 1 (f (cpy a i 2)))
+  \/ (F0 (zv a i) (f (cpy a i 0)) /\ F0 (zv a i) (f (cpy a i 1)) /\ F10 (zv a i) (f (cpy a i 2))).
+
+Definition Npr (a i1 i2 : nat) (A B : Z -> R -> Prop) (f : nat -> R) : Prop :=
+  exists c1, (c1 < 3)%nat /\ exists c2, (c2 < 3)%nat /\ A (zv a i1) (f (cpy a i1 c1)) /\ B (zv a i2) (f (cpy a i2 c2)).
+
+Lemma P_N2 : forall a i, (i < nla a)%nat ->
+  P (fun w => N2 a i (fun q => X (vid a q) w)) <= 3 * dl a i * qk a i 1 + 3 * qk a i 0 * dl a i.
+Proof.
+  intros a i Hi.
+  assert (Hg : forall c1 c2, (c1 < 3)%nat -> (c2 < 3)%nat -> c1 <> c2 -> vid a (cpy a i c1) <> vid a (cpy a i c2))
+    by (intros c1 c2 _ _ Hd; apply vid_cpy; [exact Hi | exact Hi | left; exact Hd]).
+  unfold N2. eapply Rle_trans; [apply P_or|]. apply Rplus_le_compat.
+  - exact (P_copy_lt (fun c => vid a (cpy a i c)) (F10 (zv a i)) (far (zv a i) 1) (dl a i) (qk a i 1) Hg
+             (fun c _ => P_far10 a i _) (fun c _ => P_far a i 1 _)).
+  - exact (P_copy_lt (fun c => vid a (cpy a i c)) (F0 (zv a i)) (F10 (zv a i)) (qk a i 0) (dl a i) Hg
+             (fun c _ => P_far a i 0 _) (fun c _ => P_far10 a i _)).
+Qed.
+
+Lemma P_N3 : forall a i, (i < nla a)%nat ->
+  P (fun w => N3 a i (fun q => X (vid a q) w))
+  <= dl a i * qk a i 1 * qk a i 1 + qk a i 0 * dl a i * qk a i 1 + qk a i 0 * qk a i 0 * dl a i.
+Proof.
+  intros a i Hi.
+  assert (Hg : forall c1 c2, c1 <> c2 -> vid a (cpy a i c1) <> vid a (cpy a i c2))
+    by (intros c1 c2 Hd; apply vid_cpy; [exact Hi | exact Hi | left; exact Hd]).
+  unfold N3. eapply Rle_trans; [apply P_or3|]. apply Rplus_le_compat; [apply Rplus_le_compat|].
+  - exact (P_trip _ _ _ (F10 (zv a i)) (far (zv a i) 1) (far (zv a i) 1) _ _ _ (Hg 0%nat 1%nat ltac:(lia))
+             (Hg 0%nat 2%nat ltac:(lia)) (Hg 1%nat 2%nat ltac:(lia)) (P_far10 a i _) (P_far a i 1 _) (P_far a i 1 _)).
+  - exact (P_trip _ _ _ (F0 (zv a i)) (F10 (zv a i)) (far (zv a i) 1) _ _ _ (Hg 0%nat 1%nat ltac:(lia))
+             (Hg 0%nat 2%nat ltac:(lia)) (Hg 1%nat 2%nat ltac:(lia)) (P_far a i 0 _) (P_far10 a i _) (P_far a i 1 _)).
+  - exact (P_trip _ _ _ (F0 (zv a i)) (F0 (zv a i)) (F10 (zv a i)) _ _ _ (Hg 0%nat 1%nat ltac:(lia))
+             (Hg 0%nat 2%nat ltac:(lia)) (Hg 1%nat 2%nat ltac:(lia)) (P_far a i 0 _) (P_far a i 0 _) (P_far10 a i _)).
+Qed.
+
+Lemma P_Npr : forall a i1 i2 (A B : Z -> R -> Prop) pA pB, (i1 < nla a)%nat -> (i2 < nla a)%nat -> i1 <> i2 ->
+  (forall g, P (fun w => A (zv a i1) (X g w)) <= pA) -> (forall g, P (fun w => B (zv a i2) (X g w)) <= pB) ->
+  P (fun w => Npr a i1 i2 A B (fun q => X (vid a q) w)) <= 9 * pA * pB.
+Proof.
+  intros a i1 i2 A B pA pB H1 H2 Hd HA HB. unfold Npr.
+  exact (P_copy_pairs (fun c => vid a (cpy a i1 c)) (fun c => vid a (cpy a i2 c)) (A (zv a i1)) (B (zv a i2)) pA pB
+           (fun c1 c2 _ _ => vid_cpy a i1 i2 c1 c2 H1 H2 (or_intror Hd)) (fun c _ => HA _) (fun c _ => HB _)).
+Qed.
+
+(* a wrong copy of row i fails beyond D - |S_v|, and in a layer without a stop |S_v| <= 1 *)
+Lemma wrong_cpy : forall w a i c, (i < nla a)%nat -> (c < 3)%nat -> wb w a (cpy a i c) = true ->
+  far (zv a i) (Sc w a i) (X (vid a (cpy a i c)) w).
+Proof.
+  intros w a i c Hi Hc Hw. pose proof (wrong_far w a _ (cpy_lt a i c Hi Hc) Hw) as Hf. rewrite cpy_mod in Hf by exact Hi.
+  exact Hf.
+Qed.
+
+Lemma wrong_Sc : forall w a i c, (i < nla a)%nat -> (c < 3)%nat -> wb w a (cpy a i c) = true -> stopb w a = false ->
+  (Sc w a i <= 1)%nat.
+Proof.
+  intros w a i c Hi Hc Hw Hst. pose proof (nostop_Sc w a _ Hst (cpy_lt a i c Hi Hc) Hw) as HS. rewrite cpy_mod in HS by exact Hi.
+  exact HS.
+Qed.
+
+(* a copy that fails without failing at threshold D has |S_v| = 1 and an input in T(v) with a wrong copy *)
+Lemma one_input : forall w a i e, (Sc w a i <= 1)%nat -> far (zv a i) (Sc w a i) e -> ~ far (zv a i) 0 e ->
+  Sc w a i = 1%nat /\ exists j, (j < wia a)%nat /\ tT a i j = true /\ (0 < nci w a j)%nat.
+Proof.
+  intros w a i e HS Hf H0. assert (S1 : Sc w a i = 1%nat) by (destruct (Sc w a i) as [|[|k]]; [contradiction | reflexivity | lia]).
+  split; [exact S1|]. apply Sc_pos. lia.
+Qed.
+
+(* ---- P^(2) and P^(3) -------------------------------------------------------------------------------------------- *)
+Lemma claim_P2 : forall a i, (i < nla a)%nat -> (forall j, (j < wia a)%nat -> P (Win a j) <= Pin a j) -> P (E2 a i) <= P2v a i.
+Proof.
+  intros a i Hi HW.
+  assert (Hg : forall c1 c2, (c1 < 3)%nat -> (c2 < 3)%nat -> c1 <> c2 -> vid a (cpy a i c1) <> vid a (cpy a i c2))
+    by (intros c1 c2 _ _ Hd; apply vid_cpy; [exact Hi | exact Hi | left; exact Hd]).
+  eapply Rle_trans; [apply (P_mono _ (fun w =>
+        (exists c1 c2, (c1 < c2)%nat /\ (c2 < 3)%nat /\ F0 (zv a i) (X (vid a (cpy a i c1)) w) /\ F0 (zv a i) (X (vid a (cpy a i c2)) w))
+     \/ (exists j, (j < wia a)%nat /\ tT a i j = true /\ (Win a j w /\ N2 a i (fun q => X (vid a q) w)))))|].
+  - intros w (HG & HS & H2). destruct (ncnt_two (fun c => wb w a (cpy a i c)) H2) as (c1 & c2 & H12 & Hc2 & W1 & W2).
+    pose proof (wrong_cpy w a i c1 Hi ltac:(lia) W1) as Hf1. pose proof (wrong_cpy w a i c2 Hi Hc2 W2) as Hf2.
+    destruct (far_dec (zv a i) 0 (X (vid a (cpy a i c1)) w)) as [A1|A1];
+    destruct (far_dec (zv a i) 0 (X (vid a (cpy a i c2)) w)) as [A2|A2].
+    + left. exists c1, c2. repeat split; assumption.
+    + right. destruct (one_input w a i _ HS Hf2 A2) as [S1 (j & Hj & Tj & Nj)]. rewrite S1 in Hf1, Hf2.
+      exists j. split; [exact Hj|]. split; [exact Tj|]. split; [split; assumption|].
+      right. exists c1, c2. repeat split; assumption.
+    + right. destruct (one_input w a i _ HS Hf1 A1) as [S1 (j & Hj & Tj & Nj)]. rewrite S1 in Hf1, Hf2.
+      exists j. split; [exact Hj|]. split; [exact Tj|]. split; [split; assumption|].
+      left. exists c1, c2. repeat split; assumption.
+    + right. destruct (one_input w a i _ HS Hf1 A1) as [S1 (j & Hj & Tj & Nj)]. rewrite S1 in Hf1, Hf2.
+      exists j. split; [exact Hj|]. split; [exact Tj|]. split; [split; assumption|].
+      left. exists c1, c2. repeat split; assumption.
+  - eapply Rle_trans; [apply P_or|].
+    replace (P2v a i) with (3 * qk a i 0 * qk a i 0
+                            + rsum (wia a) (fun j => if tT a i j then Pin a j * (3 * dl a i * qk a i 1 + 3 * qk a i 0 * dl a i) else 0))
+      by (rewrite rsum_if_scal; unfold P2v, Xs, dl; ring).
+    apply Rplus_le_compat.
+    + exact (P_copy_lt (fun c => vid a (cpy a i c)) (F0 (zv a i)) (F0 (zv a i)) (qk a i 0) (qk a i 0) Hg
+               (fun c _ => P_far a i 0 _) (fun c _ => P_far a i 0 _)).
+    + apply (P_sum (wia a) (tT a i) (fun j w => Win a j w /\ N2 a i (fun q => X (vid a q) w))).
+      intros j Hj Tj. cbv beta. rewrite (P_pn a).
+      * apply Rmult_le_compat; [apply Pnn | apply Pnn | apply HW; exact Hj | apply P_N2; exact Hi].
+      * apply dep_Win.
+      * apply (dep_now a (N2 a i)).
+Qed.
+
+Lemma claim_P3 : forall a i, (i < nla a)%nat -> (forall j, (j < wia a)%nat -> P (Win a j) <= Pin a j) -> P (E3 a i) <= P3v a i.
+Proof.
+  intros a i Hi HW.
+  assert (Hg : forall c1 c2, c1 <> c2 -> vid a (cpy a i c1) <> vid a (cpy a i c2))
+    by (intros c1 c2 Hd; apply vid_cpy; [exact Hi | exact Hi | left; exact Hd]).
+  eapply Rle_trans; [apply (P_mono _ (fun w =>
+        (F0 (zv a i) (X (vid a (cpy a i 0)) w) /\ F0 (zv a i) (X (vid a (cpy a i 1)) w) /\ F0 (zv a i) (X (vid a (cpy a i 2)) w))
+     \/ (exists j, (j < wia a)%nat /\ tT a i j = true /\ (Win a j w /\ N3 a i (fun q => X (vid a q) w)))))|].
+  - intros w (HG & HS & H3). destruct (ncnt_three (fun c => wb w a (cpy a i c)) H3) as (W0 & W1 & W2).
+    pose proof (wrong_cpy w a i 0 Hi ltac:(lia) W0) as Hf0. pose proof (wrong_cpy w a i 1 Hi ltac:(lia) W1) as Hf1.
+    pose proof (wrong_cpy w a i 2 Hi ltac:(lia) W2) as Hf2.
+    destruct (far_dec (zv a i) 0 (X (vid a (cpy a i 0)) w)) as [A0|A0].
+    + destruct (far_dec (zv a i) 0 (X (vid a (cpy a i 1)) w)) as [A1|A1].
+      * destruct (far_dec (zv a i) 0 (X (vid a (cpy a i 2)) w)) as [A2|A2].
+        -- left. repeat split; assumption.
+        -- right. destruct (one_input w a i _ HS Hf2 A2) as [S1 (j & Hj & Tj & Nj)]. rewrite S1 in Hf0, Hf1, Hf2.
+           exists j. split; [exact Hj|]. split; [exact Tj|]. split; [split; assumption|]. right. right. repeat split; assumption.
+      * right. destruct (one_input w a i _ HS Hf1 A1) as [S1 (j & Hj & Tj & Nj)]. rewrite S1 in Hf0, Hf1, Hf2.
+        exists j. split; [exact Hj|]. split; [exact Tj|]. split; [split; assumption|]. right. left. repeat split; assumption.
+    + right. destruct (one_input w a i _ HS Hf0 A0) as [S1 (j & Hj & Tj & Nj)]. rewrite S1 in Hf0, Hf1, Hf2.
+      exists j. split; [exact Hj|]. split; [exact Tj|]. split; [split; assumption|]. left. repeat split; assumption.
+  - eapply Rle_trans; [apply P_or|].
+    replace (P3v a i) with (qk a i 0 * qk a i 0 * qk a i 0
+                            + rsum (wia a) (fun j => if tT a i j then Pin a j * (dl a i * qk a i 1 * qk a i 1
+                                 + qk a i 0 * dl a i * qk a i 1 + qk a i 0 * qk a i 0 * dl a i) else 0))
+      by (rewrite rsum_if_scal; unfold P3v, Xs, dl; ring).
+    apply Rplus_le_compat.
+    + exact (P_trip _ _ _ (F0 (zv a i)) (F0 (zv a i)) (F0 (zv a i)) _ _ _ (Hg 0%nat 1%nat ltac:(lia))
+               (Hg 0%nat 2%nat ltac:(lia)) (Hg 1%nat 2%nat ltac:(lia)) (P_far a i 0 _) (P_far a i 0 _) (P_far a i 0 _)).
+    + apply (P_sum (wia a) (tT a i) (fun j w => Win a j w /\ N3 a i (fun q => X (vid a q) w))).
+      intros j Hj Tj. cbv beta. rewrite (P_pn a).
+      * apply Rmult_le_compat; [apply Pnn | apply Pnn | apply HW; exact Hj | apply P_N3; exact Hi].
+      * apply dep_Win.
+      * apply (dep_now a (N3 a i)).
+Qed.
+
+(* ---- P(W_v1 and W_v2) <= P_v1 P_v2 + K_v1v2 ----------------------------------------------------------------- *)
+Lemma claim_K : forall a i1 i2, (i1 < nla a)%nat -> (i2 < nla a)%nat -> i1 <> i2 ->
+  (forall j, (j < wia a)%nat -> P (Win a j) <= Pin a j) ->
+  (forall j1 j2, (j1 < wia a)%nat -> (j2 < wia a)%nat -> j1 <> j2 ->
+     P (fun w => Win a j1 w /\ Win a j2 w) <= Pin a j1 * Pin a j2 + Kin a j1 j2) ->
+  P (fun w => Wv a i1 w /\ Wv a i2 w) <= Pv a i1 * Pv a i2 + Kv a i1 i2.
+Proof.
+  intros a i1 i2 H1 H2 Hd HW HK.
+  eapply Rle_trans; [apply (P_mono _ (fun w =>
+        Npr a i1 i2 F0 F0 (fun q => X (vid a q) w)
+     \/ ((exists j, (j < wia a)%nat /\ tT a i1 j = true /\ Win a j w) /\ Npr a i1 i2 F10 F0 (fun q => X (vid a q) w))
+     \/ ((exists j, (j < wia a)%nat /\ tT a i2 j = true /\ Win a j w) /\ Npr a i1 i2 F0 F10 (fun q => X (vid a q) w))
+     \/ (((exists j, (j < wia a)%nat /\ (tT a i1 j && tT a i2 j) = true /\ Win a j w)
+          \/ (exists j1, (j1 < wia a)%nat /\ exists j2, (j2 < wia a)%nat
+                /\ (tT a i1 j1 && tT a i2 j2 && negb (Nat.eqb j1 j2)) = true /\ (Win a j1 w /\ Win a j2 w)))
+         /\ Npr a i1 i2 F10 F10 (fun q => X (vid a q) w))))|].
+  - intros w [[N1 G1] [N2' G2]].
+    destruct (ncw_copy w a i1 N1) as (c1 & Hc1 & W1). destruct (ncw_copy w a i2 N2') as (c2 & Hc2 & W2).
+    pose proof (wrong_cpy w a i1 c1 H1 Hc1 W1) as Hf1. pose proof (wrong_cpy w a i2 c2 H2 Hc2 W2) as Hf2.
+    pose proof (wrong_Sc w a i1 c1 H1 Hc1 W1 (G1 a (le_n a))) as HS1. pose proof (wrong_Sc w a i2 c2 H2 Hc2 W2 (G2 a (le_n a))) as HS2.
+    assert (HGb : Gb a w) by (intros a' Ha'; apply G1; lia).
+    destruct (far_dec (zv a i1) 0 (X (vid a (cpy a i1 c1)) w)) as [A1|A1];
+    destruct (far_dec (zv a i2) 0 (X (vid a (cpy a i2 c2)) w)) as [A2|A2].
+    + left. exists c1. split; [exact Hc1|]. exists c2. split; [exact Hc2|]. split; assumption.
+    + right; right; left. destruct (one_input w a i2 _ HS2 Hf2 A2) as [S2 (j & Hj & Tj & Nj)]. rewrite S2 in Hf2.
+      split; [exists j; split; [exact Hj|]; split; [exact Tj | split; assumption]|].
+      exists c1. split; [exact Hc1|]. exists c2. split; [exact Hc2|]. repeat split; assumption.
+    + right; left. destruct (one_input w a i1 _ HS1 Hf1 A1) as [S1 (j & Hj & Tj & Nj)]. rewrite S1 in Hf1.
+      split; [exists j; split; [exact Hj|]; split; [exact Tj | split; assumption]|].
+      exists c1. split; [exact Hc1|]. exists c2. split; [exact Hc2|]. repeat split; assumption.
+    + right; right; right. destruct (one_input w a i1 _ HS1 Hf1 A1) as [S1 (j1 & Hj1 & Tj1 & Nj1)].
+      destruct (one_input w a i2 _ HS2 Hf2 A2) as [S2 (j2 & Hj2 & Tj2 & Nj2)]. rewrite S1 in Hf1. rewrite S2 in Hf2. split.
+      * destruct (Nat.eq_dec j1 j2) as [<-|E].
+        -- left. exists j1. split; [exact Hj1|]. split; [rewrite Tj1, Tj2; reflexivity | split; assumption].
+        -- right. exists j1. split; [exact Hj1|]. exists j2. split; [exact Hj2|]. split.
+           ++ rewrite Tj1, Tj2. cbn [andb]. apply negb_true_iff, Nat.eqb_neq. exact E.
+           ++ split; split; assumption.
+      * exists c1. split; [exact Hc1|]. exists c2. split; [exact Hc2|]. repeat split; assumption.
+  - eapply Rle_trans; [apply P_or4|].
+    assert (B0 : P (fun w => Npr a i1 i2 F0 F0 (fun q => X (vid a q) w)) <= 9 * qk a i1 0 * qk a i2 0)
+      by (apply P_Npr; [exact H1 | exact H2 | exact Hd | intro g; exact (P_far a i1 0 g) | intro g; exact (P_far a i2 0 g)]).
+    assert (B1 : P (fun w => (exists j, (j < wia a)%nat /\ tT a i1 j = true /\ Win a j w) /\ Npr a i1 i2 F10 F0 (fun q => X (vid a q) w))
+                 <= Xs a i1 (Pin a) * (9 * dl a i1 * qk a i2 0)).
+    { rewrite (P_pn a).
+      - apply Rmult_le_compat; [apply Pnn | apply Pnn | |].
+        + unfold Xs. apply (P_sum (wia a) (tT a i1) (fun j => Win a j)). intros j Hj _. apply HW. exact Hj.
+        + apply P_Npr; [exact H1 | exact H2 | exact Hd | intro g; exact (P_far10 a i1 g) | intro g; exact (P_far a i2 0 g)].
+      - apply dep_ex. intro j. apply dep_Win.
+      - apply (dep_now a (Npr a i1 i2 F10 F0)). }
+    assert (B2 : P (fun w => (exists j, (j < wia a)%nat /\ tT a i2 j = true /\ Win a j w) /\ Npr a i1 i2 F0 F10 (fun q => X (vid a q) w))
+                 <= Xs a i2 (Pin a) * (9 * qk a i1 0 * dl a i2)).
+    { rewrite (P_pn a).
+      - apply Rmult_le_compat; [apply Pnn | apply Pnn | |].
+        + unfold Xs. apply (P_sum (wia a) (tT a i2) (fun j => Win a j)). intros j Hj _. apply HW. exact Hj.
+        + apply P_Npr; [exact H1 | exact H2 | exact Hd | intro g; exact (P_far a i1 0 g) | intro g; exact (P_far10 a i2 g)].
+      - apply dep_ex. intro j. apply dep_Win.
+      - apply (dep_now a (Npr a i1 i2 F0 F10)). }
+    set (SN := rsum (wia a) (fun j => if tT a i1 j && tT a i2 j then Pin a j else 0)).
+    set (SP := rsum (wia a) (fun j1 => rsum (wia a) (fun j2 =>
+                 if tT a i1 j1 && tT a i2 j2 && negb (Nat.eqb j1 j2) then Pin a j1 * Pin a j2 else 0))).
+    set (SK := rsum (wia a) (fun j1 => rsum (wia a) (fun j2 =>
+                 if tT a i1 j1 && tT a i2 j2 && negb (Nat.eqb j1 j2) then Kin a j1 j2 else 0))).
+    assert (B3 : P (fun w => ((exists j, (j < wia a)%nat /\ (tT a i1 j && tT a i2 j) = true /\ Win a j w)
+                    \/ (exists j1, (j1 < wia a)%nat /\ exists j2, (j2 < wia a)%nat
+                          /\ (tT a i1 j1 && tT a i2 j2 && negb (Nat.eqb j1 j2)) = true /\ (Win a j1 w /\ Win a j2 w)))
+                   /\ Npr a i1 i2 F10 F10 (fun q => X (vid a q) w))
+                 <= (SN + (SP + SK)) * (9 * dl a i1 * dl a i2)).
+    { rewrite (P_pn a).
+      - apply Rmult_le_compat; [apply Pnn | apply Pnn | |].
+        + eapply Rle_trans; [apply P_or|]. apply Rplus_le_compat.
+          * apply (P_sum (wia a) (fun j => tT a i1 j && tT a i2 j) (fun j => Win a j)). intros j Hj _. apply HW. exact Hj.
+          * replace (SP + SK) with (rsum (wia a) (fun j1 => rsum (wia a) (fun j2 =>
+                 if tT a i1 j1 && tT a i2 j2 && negb (Nat.eqb j1 j2) then Pin a j1 * Pin a j2 + Kin a j1 j2 else 0))).
+            -- eapply Rle_trans; [apply (Pex (wia a) (fun j1 w => exists j2, (j2 < wia a)%nat
+                   /\ (tT a i1 j1 && tT a i2 j2 && negb (Nat.eqb j1 j2)) = true /\ (Win a j1 w /\ Win a j2 w)))|].
+               apply rsum_le. intros j1 Hj1.
+               apply (P_sum (wia a) (fun j2 => tT a i1 j1 && tT a i2 j2 && negb (Nat.eqb j1 j2)) (fun j2 w => Win a j1 w /\ Win a j2 w)).
+               intros j2 Hj2 T. apply HK; [exact Hj1 | exact Hj2|]. apply andb_prop in T as [_ T].
+               apply negb_true_iff, Nat.eqb_neq in T. exact T.
+            -- unfold SP, SK. rewrite <- rsum_plus. apply rsum_ext. intros j1 _. rewrite <- rsum_plus. apply rsum_ext.
+               intros j2 _. destruct (tT a i1 j1 && tT a i2 j2 && negb (Nat.eqb j1 j2)); ring.
+        + apply P_Npr; [exact H1 | exact H2 | exact Hd | intro g; exact (P_far10 a i1 g) | intro g; exact (P_far10 a i2 g)].
+      - apply dep_or; [apply dep_ex; intro j; apply dep_Win|]. apply dep_ex0. intro j1. apply dep_ex. intro j2.
+        apply dep_and; apply dep_Win.
+      - apply (dep_now a (Npr a i1 i2 F10 F10)). }
+    pose proof (sum_ne_le (wia a) (tT a i1) (tT a i2) (Pin a) (proj1 (PK_nn a))) as HSP. fold SP in HSP.
+    change (rsum (wia a) (fun j => if tT a i1 j then Pin a j else 0)) with (Xs a i1 (Pin a)) in HSP.
+    change (rsum (wia a) (fun j => if tT a i2 j then Pin a j else 0)) with (Xs a i2 (Pin a)) in HSP.
+    pose proof (dl_nn a i1). pose proof (dl_nn a i2).
+    assert (HD : 0 <= 9 * dl a i1 * dl a i2) by (apply Rmult_le_pos; [apply Rmult_le_pos|]; lra).
+    pose proof (Rmult_le_compat_l _ _ _ HD HSP) as HSP'.
+    unfold Pv, Kv, Kpair. fold SN SK. nra.
+Qed.
+
+(* ---- the bounds hold layer by layer -------------------------------------------------------------------------------- *)
+Lemma lyr_0 : lyr 0 = 0%nat.
+Proof. unfold lyr. apply Nat.Div0.mod_0_l. Qed.
+
+Lemma nci_0 : forall w j, (j < n)%nat -> nci w 0 j = 0%nat.
+Proof.
+  intros w j Hj. unfold nci. rewrite wia_0. rewrite (ncnt_ext 3 _ (fun _ => false)); [apply ncnt_false|].
+  intros c Hc. apply wib_0. nia.
+Qed.
+
+Lemma nci_S : forall w a j, lyr (S a) <> 0%nat -> nci w (S a) j = ncw w a j.
+Proof. intros w a j H. unfold nci, ncw. rewrite (wia_S a H). apply ncnt_ext. intros c Hc. apply wib_S. exact H. Qed.
+
+Lemma nci_B : forall w a j, lyr (S a) = 0%nat -> (j < n)%nat -> nci w (S a) j = if Dv j then 0%nat else ncw w a j.
+Proof.
+  intros w a j H Hj. destruct (wia_B a H) as [W1 W2]. unfold nci, ncw. rewrite W1, W2. destruct (Dv j) eqn:E.
+  - rewrite (ncnt_ext 3 _ (fun _ => false)); [apply ncnt_false|]. intros c Hc.
+    rewrite wib_B by (exact H || nia). rewrite cp_mod by exact Hj. rewrite E. reflexivity.
+  - apply ncnt_ext. intros c Hc. rewrite wib_B by (exact H || nia). rewrite cp_mod by exact Hj. rewrite E. reflexivity.
+Qed.
+
+Lemma Win_S : forall w a j, lyr (S a) <> 0%nat -> (Win (S a) j w <-> Wv a j w).
+Proof. intros w a j H. unfold Win, Wv. rewrite nci_S by exact H. rewrite Gu_Gb. reflexivity. Qed.
+
+Lemma Win_B : forall w a j, lyr (S a) = 0%nat -> (j < n)%nat -> Win (S a) j w -> Dv j = false /\ Wv a j w.
+Proof.
+  intros w a j H Hj [Hn HG]. rewrite nci_B in Hn by assumption. destruct (Dv j); [lia|]. split; [reflexivity|].
+  split; [exact Hn | apply Gu_Gb; exact HG].
+Qed.
+
+Lemma Pin_N : forall a j, lyr (S a) <> 0%nat -> Pin (S a) j = Pv a j.
+Proof. intros a j H. rewrite Pin_S. destruct (Nat.eqb_spec (lyr (S a)) 0); [contradiction | reflexivity]. Qed.
+
+Lemma Pin_Bd : forall a j, lyr (S a) = 0%nat -> Dv j = true -> Pin (S a) j = 0.
+Proof. intros a j H E. rewrite Pin_S, H, E. reflexivity. Qed.
+
+Lemma Pin_Bn : forall a j, lyr (S a) = 0%nat -> Dv j = false -> Pin (S a) j = Pv a j.
+Proof. intros a j H E. rewrite Pin_S, H, E. reflexivity. Qed.
+
+Lemma Kin_N : forall a j1 j2, lyr (S a) <> 0%nat -> Kin (S a) j1 j2 = Kv a j1 j2.
+Proof. intros a j1 j2 H. rewrite Kin_S. destruct (Nat.eqb_spec (lyr (S a)) 0); [contradiction | reflexivity]. Qed.
+
+Lemma Kin_Bd : forall a j1 j2, lyr (S a) = 0%nat -> Dv j1 = true \/ Dv j2 = true -> Kin (S a) j1 j2 = 0.
+Proof. intros a j1 j2 H [E|E]; rewrite Kin_S, H, E; [reflexivity | rewrite orb_true_r; reflexivity]. Qed.
+
+Lemma Kin_Bn : forall a j1 j2, lyr (S a) = 0%nat -> Dv j1 = false -> Dv j2 = false -> Kin (S a) j1 j2 = Kv a j1 j2.
+Proof. intros a j1 j2 H E1 E2. rewrite Kin_S, H, E1, E2. reflexivity. Qed.
+
+(* P(W) <= P and P(W and W') <= P P' + K for the inputs of every layer, by induction over the layers *)
+Lemma claims : forall a, (forall j, (j < wia a)%nat -> P (Win a j) <= Pin a j) /\
+  (forall j1 j2, (j1 < wia a)%nat -> (j2 < wia a)%nat -> j1 <> j2 ->
+     P (fun w => Win a j1 w /\ Win a j2 w) <= Pin a j1 * Pin a j2 + Kin a j1 j2).
+Proof.
+  induction a as [|a [IW IK]].
+  - rewrite wia_0. assert (E : forall j w, (j < n)%nat -> ~ Win 0 j w) by (intros j w Hj [Hn _]; rewrite nci_0 in Hn by exact Hj; lia).
+    split.
+    + intros j Hj. rewrite (Pnone (Win 0 j)) by (intro w; apply E; exact Hj). unfold Pin. cbn. lra.
+    + intros j1 j2 Hj1 Hj2 _. rewrite Pnone by (intros w [W _]; exact (E j1 w Hj1 W)). unfold Pin, Kin. cbn. lra.
+  - pose proof (fun i Hi => claim_P a i Hi IW) as CP. pose proof (fun i1 i2 H1 H2 Hd => claim_K a i1 i2 H1 H2 Hd IW IK) as CK.
+    destruct (PK_nn (S a)) as [NP NK].
+    destruct (Nat.eq_dec (lyr (S a)) 0) as [B|B].
+    + destruct (wia_B a B) as [W1 W2]. rewrite W1. split.
+      * intros j Hj. destruct (Dv j) eqn:E.
+        -- rewrite (Pin_Bd a j B E). right. apply Pnone. intros w Hw. destruct (Win_B w a j B Hj Hw) as [C _]. congruence.
+        -- rewrite (Pin_Bn a j B E).
+           eapply Rle_trans; [apply P_mono; intros w Hw; exact (proj2 (Win_B w a j B Hj Hw))|]. apply CP. lia.
+      * intros j1 j2 Hj1 Hj2 Hd. pose proof (NP j1). pose proof (NP j2).
+        destruct (Dv j1) eqn:E1; [|destruct (Dv j2) eqn:E2].
+        -- rewrite Pnone by (intros w [Hw _]; destruct (Win_B w a j1 B Hj1 Hw) as [C _]; congruence).
+           rewrite (Kin_Bd a j1 j2 B (or_introl E1)). nra.
+        -- rewrite Pnone by (intros w [_ Hw]; destruct (Win_B w a j2 B Hj2 Hw) as [C _]; congruence).
+           rewrite (Kin_Bd a j1 j2 B (or_intror E2)). nra.
+        -- rewrite (Pin_Bn a j1 B E1), (Pin_Bn a j2 B E2), (Kin_Bn a j1 j2 B E1 E2).
+           eapply Rle_trans; [apply P_mono; intros w [Hw1 Hw2];
+             exact (conj (proj2 (Win_B w a j1 B Hj1 Hw1)) (proj2 (Win_B w a j2 B Hj2 Hw2)))|].
+           apply CK; [lia | lia | exact Hd].
+    + rewrite (wia_S a B). split.
+      * intros j Hj. rewrite (Pin_N a j B).
+        eapply Rle_trans; [apply P_mono; intros w Hw; exact (proj1 (Win_S w a j B) Hw)|]. apply CP. exact Hj.
+      * intros j1 j2 Hj1 Hj2 Hd. rewrite (Pin_N a j1 B), (Pin_N a j2 B), (Kin_N a j1 j2 B).
+        eapply Rle_trans; [apply P_mono; intros w [Hw1 Hw2]; exact (conj (proj1 (Win_S w a j1 B) Hw1) (proj1 (Win_S w a j2 B) Hw2))|].
+        apply CK; assumption.
+Qed.
+
+(* ---- the first stop ------------------------------------------------------------------------------------------------ *)
+(* the input j of layer a has two wrong copies, or three, and no layer before is a stop; empty on the state *)
+Definition B2 (a j : nat) (w : Omega) : Prop := lyr a <> 0%nat /\ E2 (a - 1) j w.
+Definition B3 (a j : nat) (w : Omega) : Prop := lyr a <> 0%nat /\ E3 (a - 1) j w.
+(* some copy of row i fails beyond D - k *)
+Definition N1 (a i k : nat) (f : nat -> R) : Prop := exists c, (c < 3)%nat /\ far (zv a i) k (f (cpy a i c)).
+
+Lemma P_B2 : forall a j, (j < wia a)%nat -> P (B2 a j) <= P2in a j.
+Proof.
+  intros a j Hj. unfold P2in. destruct (Nat.eqb_spec (lyr a) 0) as [B|B].
+  - right. apply Pnone. intros w [C _]. contradiction.
+  - destruct a as [|a]; [rewrite lyr_0 in B; contradiction|]. replace (S a - 1)%nat with a by lia.
+    eapply Rle_trans; [apply P_mono; intros w [_ H]; replace (S a - 1)%nat with a in H by lia; exact H|].
+    apply claim_P2; [rewrite (wia_S a B) in Hj; exact Hj | exact (proj1 (claims a))].
+Qed.
+
+Lemma P_B3 : forall a j, (j < wia a)%nat -> P (B3 a j) <= P3in a j.
+Proof.
+  intros a j Hj. unfold P3in. destruct (Nat.eqb_spec (lyr a) 0) as [B|B].
+  - right. apply Pnone. intros w [C _]. contradiction.
+  - destruct a as [|a]; [rewrite lyr_0 in B; contradiction|]. replace (S a - 1)%nat with a by lia.
+    eapply Rle_trans; [apply P_mono; intros w [_ H]; replace (S a - 1)%nat with a in H by lia; exact H|].
+    apply claim_P3; [rewrite (wia_S a B) in Hj; exact Hj | exact (proj1 (claims a))].
+Qed.
+
+Lemma dep_B2 : forall a j, dep Omega X (pastv a) (B2 a j).
+Proof.
+  intros [|a] j w w' H; unfold B2; [rewrite lyr_0; split; intros [C _]; contradiction|].
+  replace (S a - 1)%nat with a by lia. rewrite (dep_E2 a j w w' H). reflexivity.
+Qed.
+
+Lemma dep_B3 : forall a j, dep Omega X (pastv a) (B3 a j).
+Proof.
+  intros [|a] j w w' H; unfold B3; [rewrite lyr_0; split; intros [C _]; contradiction|].
+  replace (S a - 1)%nat with a by lia. rewrite (dep_E3 a j w w' H). reflexivity.
+Qed.
+
+Lemma P_N1 : forall a i k, P (fun w => N1 a i k (fun q => X (vid a q) w)) <= Rmin 1 (3 * qk a i k).
+Proof.
+  intros a i k. apply Rmin_glb; [apply Ple1|]. unfold N1.
+  exact (P_copies (fun c => vid a (cpy a i c)) (far (zv a i) k) (qk a i k) (fun c _ => P_far a i k _)).
+Qed.
+
+Lemma Rmin_nn : forall a i k, 0 <= Rmin 1 (3 * qk a i k).
+Proof. intros a i k. apply Rmin_glb; [lra|]. pose proof (qk_range a i k). lra. Qed.
+
+(* the first stop at layer a: P <= the contribution of a to b(t) *)
+Lemma claim_stop : forall a, P (fun w => stopb w a = true /\ Gb a w) <= bl a.
+Proof.
+  intro a. destruct (claims a) as [HW HK].
+  eapply Rle_trans; [apply (P_mono _ (fun w =>
+       (exists i, (i < nla a)%nat /\ exists j1, (j1 < wia a)%nat /\ exists j2, (j2 < wia a)%nat
+           /\ (tT a i j1 && tT a i j2 && Nat.ltb j1 j2) = true /\ (Win a j1 w /\ Win a j2 w))
+    \/ (exists i, (i < nla a)%nat /\ exists j, (j < wia a)%nat /\ tT a i j = true /\ (B2 a j w /\ N1 a i 2 (fun q => X (vid a q) w)))
+    \/ (exists i, (i < nla a)%nat /\ exists j, (j < wia a)%nat /\ tT a i j = true /\ (B3 a j w /\ N1 a i 3 (fun q => X (vid a q) w)))
+    \/ (lyr a = (length Ls - 1)%nat /\ exists i, (i < nla a)%nat /\ E2 a i w)))|].
+  - intros w [Hst HG]. unfold stopb in Hst. destruct (stop1 w a) eqn:S1.
+    + apply existsb_seq_true in S1 as (q & Hq & E). apply andb_prop in E as [Wq Sq]. apply Nat.leb_le in Sq.
+      assert (HN : (0 < nla a)%nat) by lia.
+      assert (Hdec : exists i c, (i < nla a)%nat /\ (c < 3)%nat /\ q = cpy a i c).
+      { exists (q mod nla a)%nat, (q / nla a)%nat. split; [apply Nat.mod_upper_bound; lia|].
+        split; [apply Nat.Div0.div_lt_upper_bound; lia|]. unfold cpy. apply cp_split. exact HN. }
+      destruct Hdec as (i & c & Hi & Hc & ->). rewrite cpy_mod in Sq by exact Hi.
+      pose proof (wrong_cpy w a i c Hi Hc Wq) as Hf.
+      destruct (Sc_two w a i Sq) as [(j1 & j2 & H12 & Hj2 & T1 & T2 & N1' & N2') | (j & Hj & Tj & ES)].
+      * left. exists i. split; [exact Hi|]. exists j1. split; [lia|]. exists j2. split; [exact Hj2|]. split.
+        -- rewrite T1, T2. cbn [andb]. apply Nat.ltb_lt. exact H12.
+        -- split; split; assumption.
+      * assert (Hj3 : (nci w a j <= 3)%nat) by apply ncnt_le.
+        destruct a as [|a].
+        -- exfalso. rewrite wia_0 in Hj. rewrite nci_0 in ES by exact Hj. lia.
+        -- destruct (Nat.eq_dec (lyr (S a)) 0) as [B|B].
+           ++ exfalso. destruct (wia_B a B) as [W1 W2]. rewrite W1 in Hj. rewrite (nci_B w a j B Hj) in ES.
+              destruct (Dv j) eqn:Ed; [lia|].
+              assert (Hs2 : stopb w a = true).
+              { unfold stopb. apply orb_true_iff. right. unfold stop2. apply andb_true_iff. split.
+                - apply Nat.eqb_eq. destruct (lyr_succ a) as [(_ & L & _)|(_ & L & _)]; [exact L | contradiction].
+                - apply existsb_exists. exists j. split; [apply in_seq; lia|]. apply Nat.leb_le. lia. }
+              rewrite (HG a (Nat.lt_succ_diag_r a)) in Hs2. discriminate.
+           ++ rewrite (nci_S w a j B) in ES, Hj3. rewrite (wia_S a B) in Hj.
+              assert (HGa : stopb w a = false) by (apply HG; lia).
+              assert (HSj : (Sc w a j <= 1)%nat).
+              { destruct (ncw_copy w a j ltac:(lia)) as (c' & Hc' & W'). exact (wrong_Sc w a j c' Hj Hc' W' HGa). }
+              assert (HGb' : Gb a w) by (intros a'' Ha''; apply HG; lia).
+              assert (Ea : (S a - 1)%nat = a) by lia.
+              destruct (Nat.eq_dec (ncw w a j) 3) as [E3'|E3'].
+              ** right; right; left. exists i. split; [exact Hi|]. exists j. split; [rewrite (wia_S a B); exact Hj|].
+                 split; [exact Tj|]. split.
+                 --- split; [exact B|]. rewrite Ea. split; [exact HGb'|]. split; [exact HSj | exact E3'].
+                 --- exists c. split; [exact Hc|]. rewrite ES, E3' in Hf. exact Hf.
+              ** right; left. exists i. split; [exact Hi|]. exists j. split; [rewrite (wia_S a B); exact Hj|].
+                 split; [exact Tj|]. split.
+                 --- split; [exact B|]. rewrite Ea. split; [exact HGb'|]. split; [exact HSj | lia].
+                 --- exists c. split; [exact Hc|]. replace (Sc w (S a) i) with 2%nat in Hf by lia. exact Hf.
+    + cbn [orb] in Hst. unfold stop2 in Hst. apply andb_prop in Hst as [L Ex]. apply Nat.eqb_eq in L.
+      apply existsb_seq_true in Ex as (i & Hi & E). apply Nat.leb_le in E.
+      right; right; right. split; [exact L|]. exists i. split; [exact Hi|]. split; [exact HG|]. split; [|exact E].
+      destruct (ncw_copy w a i ltac:(lia)) as (c & Hc & W).
+      pose proof (existsb_seq_false _ _ S1 (cpy a i c) (cpy_lt a i c Hi Hc)) as F. cbv beta in F.
+      assert (W' : wb w a (cpy a i c) = true) by exact W. rewrite W' in F. cbn [andb] in F. apply Nat.leb_gt in F.
+      rewrite cpy_mod in F by exact Hi. lia.
+  - eapply Rle_trans; [apply P_or4|]. unfold bl.
+    rewrite rsum_plus, rsum_plus.
+    assert (Bp : P (fun w => exists i, (i < nla a)%nat /\ exists j1, (j1 < wia a)%nat /\ exists j2, (j2 < wia a)%nat
+                   /\ (tT a i j1 && tT a i j2 && Nat.ltb j1 j2) = true /\ (Win a j1 w /\ Win a j2 w))
+                 <= rsum (nla a) (fun i => rsum (wia a) (fun j1 => rsum (wia a) (fun j2 =>
+                      if tT a i j1 && tT a i j2 && Nat.ltb j1 j2 then Pin a j1 * Pin a j2 + Kin a j1 j2 else 0)))).
+    { eapply Rle_trans; [apply Pex|]. apply rsum_le. intros i Hi.
+      eapply Rle_trans; [apply Pex|]. apply rsum_le. intros j1 Hj1.
+      apply (P_sum (wia a) (fun j2 => tT a i j1 && tT a i j2 && Nat.ltb j1 j2) (fun j2 w => Win a j1 w /\ Win a j2 w)).
+      intros j2 Hj2 T. apply HK; [exact Hj1 | exact Hj2|]. apply andb_prop in T as [_ T]. apply Nat.ltb_lt in T. lia. }
+    assert (Bk : forall k (Bk : nat -> Omega -> Prop) (pk : nat -> R),
+               (forall j, (j < wia a)%nat -> P (Bk j) <= pk j) -> (forall j, dep Omega X (pastv a) (Bk j)) ->
+               P (fun w => exists i, (i < nla a)%nat /\ exists j, (j < wia a)%nat /\ tT a i j = true
+                             /\ (Bk j w /\ N1 a i k (fun q => X (vid a q) w)))
+               <= rsum (nla a) (fun i => Rmin 1 (3 * qk a i k) * Xs a i pk)).
+    { intros k Bk pk HB HD. eapply Rle_trans; [apply Pex|]. apply rsum_le. intros i Hi.
+      unfold Xs. rewrite <- rsum_if_scal.
+      apply (P_sum (wia a) (tT a i) (fun j w => Bk j w /\ N1 a i k (fun q => X (vid a q) w))).
+      intros j Hj _. cbv beta. rewrite (P_pn a).
+      - apply Rmult_le_compat; [apply Pnn | apply Pnn | apply HB; exact Hj | apply P_N1].
+      - apply HD.
+      - apply (dep_now a (N1 a i k)). }
+    pose proof (Bk 2%nat (B2 a) (P2in a) (P_B2 a) (dep_B2 a)) as B2'.
+    pose proof (Bk 3%nat (B3 a) (P3in a) (P_B3 a) (dep_B3 a)) as B3'.
+    assert (B4 : P (fun w => lyr a = (length Ls - 1)%nat /\ exists i, (i < nla a)%nat /\ E2 a i w)
+                 <= (if Nat.eqb (lyr a) (length Ls - 1) then rsum (nla a) (fun i => P2v a i) else 0)).
+    { destruct (Nat.eqb_spec (lyr a) (length Ls - 1)) as [L|L].
+      - eapply Rle_trans; [apply P_mono; intros w [_ H]; exact H|]. eapply Rle_trans; [apply Pex|].
+        apply rsum_le. intros i Hi. apply claim_P2; [exact Hi | exact HW].
+      - right. apply Pnone. intros w [C _]. contradiction. }
+    lra.
+Qed.
+
+(* ---- Proposition 6.14 ------------------------------------------------------------------------------------------- *)
+Lemma out_last : forall w t, out w (t * length Ls + (length Ls - 1)) = lmapp (amap 3 n Ls) 0 (Et w t) (run3 w t).
+Proof.
+  intros w t. pose proof NL_pos. destruct (stp_lyr t (length Ls - 1) ltac:(lia)) as [E1 E2].
+  unfold out, pn. rewrite E1, E2. replace (S (length Ls - 1)) with (length Ls) by lia.
+  rewrite firstn_all2 by (rewrite length_amap; lia). reflexivity.
+Qed.
+
+Lemma exo_last : forall a, lyr a = (length Ls - 1)%nat -> exo a = lmap Ls (xs (stp a)) /\ nla a = n.
+Proof.
+  intros a L. pose proof NL_pos. split.
+  - unfold exo, lay, exin. rewrite L. rewrite <- lin_S by lia. replace (S (length Ls - 1)) with (length Ls) by lia.
+    unfold lin. rewrite firstn_all. reflexivity.
+  - unfold nla, lay. rewrite L, <- (last_nth' _ Ls [] Hne). exact Hlast.
+Qed.
+
+(* every copy is its value in the run, flipped where it is wrong *)
+Lemma out_xorv : forall w a, out w a = xorv (rep 3 (exo a)) (wb w a).
+Proof.
+  intros w a. apply nth_ext with (d := false) (d' := false).
+  - rewrite len_out, length_xorv, length_rep, len_exo. reflexivity.
+  - intros k Hk. rewrite len_out in Hk. rewrite nth_xorv by (rewrite length_rep, len_exo; exact Hk).
+    rewrite nth_rep_mod by (rewrite len_exo; exact Hk). rewrite len_exo. unfold wb.
+    destruct (nth k (out w a) false), (nth (k mod nla a) (exo a) false); reflexivity.
+Qed.
+
+(* without a stop at the last layer of a step the state read by majority is the state of the run *)
+Lemma maj_out : forall w a, lyr a = (length Ls - 1)%nat -> stopb w a = false -> maj 3 n (out w a) = lmap Ls (xs (stp a)).
+Proof.
+  intros w a L Hst. destruct (exo_last a L) as [E1 E2]. rewrite out_xorv, <- E1.
+  apply maj_ok; [reflexivity | rewrite len_exo; exact E2 |].
+  intros j Hj. pose proof (nostop_ncw w a j Hst L ltac:(lia)) as H. unfold ncw in H. rewrite E2 in H.
+  change (3 / 2)%nat with 1%nat. exact H.
+Qed.
+
+(* Proposition 6.14: the state of the threefold amplification read by majority leaves the run within T steps with
+   probability at most sum_{t < T} b(t) *)
+Theorem restoration : forall T,
+  P (fun w => exists t, (t < T)%nat /\ maj 3 n (lmapp (amap 3 n Ls) 0 (Et w t) (run3 w t)) <> lmap Ls (xs t))
+  <= rsum T bt.
+Proof.
+  intro T. pose proof NL_pos.
+  eapply Rle_trans; [apply (P_mono _ (fun w => exists a, (a < T * length Ls)%nat /\ (stopb w a = true /\ Gb a w)))|].
+  - intros w (t & Ht & Hm). set (a := (t * length Ls + (length Ls - 1))%nat).
+    destruct (stp_lyr t (length Ls - 1) ltac:(lia)) as [E1 E2]. fold a in E1, E2.
+    assert (Hst : stopb w a = true).
+    { destruct (stopb w a) eqn:Es; [reflexivity|]. exfalso. apply Hm. rewrite <- out_last. fold a.
+      rewrite <- E1. apply maj_out; assumption. }
+    destruct (first_true (stopb w) a Hst) as (a0 & Ha0 & H0 & Hb). exists a0. split; [unfold a in Ha0; nia|].
+    split; [exact H0 | exact Hb].
+  - eapply Rle_trans; [apply Pex|]. unfold bt. rewrite <- rsum_blocks. apply rsum_le. intros a _. apply claim_stop.
+Qed.
+
+End Restore.

rocq/StoredCount.v

@@ -0,0 +1,462 @@
+(* Theorem 8.8: the records of the stored host S_{A,w}, G_A = 35A 2^(A-1) - 2^(A+1) + (A^3 - A)/6 + A^2 + 29A + 14w + 91
+   + pi_A with pi_A <= 7 empty records, its window of 2^alpha_A cells with alpha_A = A + Theta(log A), and generations of
+   Theta(A^3 4^A) steps. *)
+From Stdlib Require Import List Bool Arith ZArith Lia.
+Import ListNotations.
+From TH Require Import TwoHead Net Gates Host HostWF Stored StoredWbr StoredWidth StoredStep StoredPass Lev BlockLev HostLev
+  HostCount.
+From TH Require StoredImage Recipe.
+
+Local Notation image_bytes := StoredImage.image_bytes.
+Local Notation describe := Recipe.describe.
+Local Notation psteps := Recipe.psteps.
+
+(* ---- the records of a unit ------------------------------------------------------------------------------- *)
+(* a chain of k literals, and a unit of threshold t on k literals *)
+Definition chlen (k : nat) : nat := match k with 0 => 0 | 1 => 1 | _ => k - 1 end.
+
+Fixpoint rcount (t : Z) (k : nat) : nat :=
+  if Z.leb t 0 then 1
+  else if Z.ltb (Z.of_nat k) t then 1
+  else if Z.eqb t 1 then chlen k
+  else if Z.eqb t (Z.of_nat k) then chlen k
+  else match k with O => 0 | S k' => rcount t k' + rcount (t - 1) k' + 2 end.
+
+Lemma length_chain_eq : forall g ls d acc, length (chain g ls d acc) = chlen (length ls).
+Proof.
+  intros g [|l0 [|l1 [|l2 t]]] d acc; cbn [chain length chlen]; try reflexivity.
+  rewrite length_chain_tail. lia.
+Qed.
+
+Lemma rcount_eq : forall t k, rcount t k =
+  if Z.leb t 0 then 1
+  else if Z.ltb (Z.of_nat k) t then 1
+  else if Z.eqb t 1 then chlen k
+  else if Z.eqb t (Z.of_nat k) then chlen k
+  else match k with O => 0 | S k' => rcount t k' + rcount (t - 1) k' + 2 end.
+Proof. intros t [|k]; reflexivity. Qed.
+
+Lemma length_ucomp_eq : forall xc ls t d acc lev, length (ucomp xc t ls d acc lev) = rcount t (length ls).
+Proof.
+  intros xc. induction ls as [|l0 rest IH]; intros t d acc lev; rewrite ucomp_eq, rcount_eq.
+  - destruct (Z.leb t 0); [reflexivity|]. destruct (Z.ltb _ t); [reflexivity|].
+    destruct (Z.eqb t 1); [apply length_chain_eq|]. destruct (Z.eqb t _); [apply length_chain_eq | reflexivity].
+  - destruct (Z.leb t 0); [reflexivity|]. destruct (Z.ltb _ t); [reflexivity|].
+    destruct (Z.eqb t 1); [apply length_chain_eq|]. destruct (Z.eqb t _); [apply length_chain_eq|].
+    cbn [length]. rewrite !length_app, IH, IH. cbn [length]. lia.
+Qed.
+
+Lemma length_next_tbl : forall n nu nx, length (next_tbl n nu nx) = nu.
+Proof.
+  intros n nu nx. unfold next_tbl.
+  assert (G : forall l tbl, length (fold_left (fun tbl p => setopt tbl (snd p - n) (fst p)) l tbl) = length tbl).
+  { induction l as [|p l IH]; intro tbl; cbn [fold_left]; [reflexivity|]. rewrite IH, length_setopt. reflexivity. }
+  rewrite G, repeat_length. reflexivity.
+Qed.
+
+(* the records of the step: rcount of each unit *)
+Definition srec (us : list tu) : nat := fold_right (fun U acc => rcount (tval U) (length (tin U)) + acc) 0 us.
+
+Lemma length_step_go_eq : forall A w nu us nt u, length us <= length nt ->
+  length (step_go A w nu u us nt) = srec us.
+Proof.
+  intros A w nu us. induction us as [|U us IH]; intros nt u Hl; [reflexivity|].
+  destruct nt as [|o nt]; [cbn in Hl; lia|]. cbn [step_go srec fold_right]. rewrite length_app, length_ucomp_eq, length_map.
+  rewrite IH by (cbn in Hl; lia). reflexivity.
+Qed.
+
+(* ---- the records of the units of H_A -------------------------------------------------------------------- *)
+Definition stval (u : su) : Z := (Z.of_nat (length (filter (fun p => Z.ltb (snd p) 0) (sin u))) - sb u)%Z.
+Definition rcs (u : su) : nat := rcount (stval u) (length (sin u)).
+
+Lemma tval_flat : forall n bs u, tval (flat_unit n bs u) = stval u.
+Proof.
+  intros n bs u. unfold tval, stval, flat_unit. cbn [tin Net.tb]. f_equal. f_equal.
+  rewrite length_filter_map. reflexivity.
+Qed.
+
+Lemma neg_lw : forall ls : list lit, length (filter (fun p => Z.ltb (snd p) 0) (map lw ls)) = nneg ls.
+Proof.
+  intro ls. unfold nneg. induction ls as [|[x p] t IH]; [reflexivity|]. cbn [map filter lw fst snd negb].
+  destruct p; cbn [Z.ltb Z.compare length]; [exact IH | rewrite IH; reflexivity].
+Qed.
+
+Lemma rcs_and : forall ls, 1 <= length ls -> rcs (sAND ls) = chlen (length ls).
+Proof.
+  intros ls H. unfold rcs, stval. cbn [sin sb sAND]. rewrite neg_lw, length_map, rcount_eq.
+  pose proof (npos_nneg ls). replace (Z.of_nat (nneg ls) - - Z.of_nat (npos ls))%Z with (Z.of_nat (length ls)) by lia.
+  destruct (Z.leb_spec (Z.of_nat (length ls)) 0); [lia|]. rewrite Z.ltb_irrefl.
+  destruct (Z.eqb_spec (Z.of_nat (length ls)) 1); [reflexivity|]. rewrite Z.eqb_refl. reflexivity.
+Qed.
+
+Lemma rcs_or : forall ls, 1 <= length ls -> rcs (sOR ls) = chlen (length ls).
+Proof.
+  intros ls H. unfold rcs, stval. cbn [sin sb sOR]. rewrite neg_lw, length_map, rcount_eq.
+  replace (Z.of_nat (nneg ls) - (Z.of_nat (nneg ls) - 1))%Z with 1%Z by lia. cbn [Z.leb Z.compare].
+  destruct (Z.ltb_spec (Z.of_nat (length ls)) 1); [lia|]. reflexivity.
+Qed.
+
+Lemma fold_nsum : forall (X : Type) (f : X -> nat) (l : list X) d,
+  fold_right (fun x acc => f x + acc) 0 l = nsum (length l) (fun k => f (nth k l d)).
+Proof.
+  intros X f l d.
+  assert (G : forall l' c, fold_right (fun y acc => f y + acc) c l' = fold_right (fun y acc => f y + acc) 0 l' + c)
+    by (induction l' as [|y l' IHl]; intro c; cbn [fold_right]; [reflexivity | rewrite IHl; lia]).
+  induction l as [|x t IH] using rev_ind; [reflexivity|].
+  rewrite fold_right_app. cbn [fold_right]. rewrite G, Nat.add_0_r.
+  rewrite length_app, Nat.add_1_r. cbn [nsum length]. rewrite app_nth2 by lia. rewrite Nat.sub_diag. cbn [nth].
+  rewrite IH. f_equal. apply nsum_ext. intros k Hk. rewrite app_nth1 by lia. reflexivity.
+Qed.
+
+Lemma bsum_add : forall bs g h, bsum bs (fun x => g x + h x) = bsum bs g + bsum bs h.
+Proof.
+  intros bs g h. unfold bsum. rewrite <- nsum_add. apply nsum_ext. intros b _. rewrite <- nsum_add.
+  apply nsum_ext. intros j _. apply nsum_add.
+Qed.
+
+Lemma chlen_ge2 : forall k, 2 <= k -> chlen k + 1 = k.
+Proof. intros [|[|k]] H; cbn [chlen]; lia. Qed.
+
+Lemma and_rcs : forall ls, 2 <= length ls -> rcs (sAND ls) + 1 = length (sin (sAND ls)).
+Proof. intros ls H. rewrite rcs_and by lia. cbn [sin sAND]. rewrite length_map. apply chlen_ge2. exact H. Qed.
+
+Lemma or_rcs : forall ls, 2 <= length ls -> rcs (sOR ls) + 1 = length (sin (sOR ls)).
+Proof. intros ls H. rewrite rcs_or by lia. cbn [sin sOR]. rewrite length_map. apply chlen_ge2. exact H. Qed.
+
+Section SC.
+Variable A : nat.
+Hypothesis HA : 3 <= A.
+
+(* the threshold units take more records than literals: the copy of the carry term T_{1,*}, and the units of threshold 2
+   on three and four literals *)
+Definition dlt (b r : nat) : nat :=
+  if Nat.eqb b 17 then (if Nat.eqb r 0 then 1 else 0)
+  else if Nat.eqb b (tb A + 6) then (if Nat.eqb r 1 then 2 else 0)
+  else if Nat.eqb b (tb A + 7) then 2
+  else if Nat.eqb b (tb A + 8) then 5 else 0.
+
+Lemma dlt_pre : forall b r, b < 17 -> dlt b r = 0.
+Proof.
+  intros b r H. unfold dlt, tb. destruct (Nat.eqb_spec b 17); [lia|]. destruct (Nat.eqb_spec b (16 + A + 6)); [lia|].
+  destruct (Nat.eqb_spec b (16 + A + 7)); [lia|]. destruct (Nat.eqb_spec b (16 + A + 8)); [lia | reflexivity].
+Qed.
+
+Lemma dlt_T : forall k r, 1 <= k -> k < A -> dlt (16 + k) r = if Nat.eqb k 1 then (if Nat.eqb r 0 then 1 else 0) else 0.
+Proof.
+  intros k r H1 H2. unfold dlt, tb. destruct (Nat.eqb_spec k 1) as [->|E]; [reflexivity|].
+  destruct (Nat.eqb_spec (16 + k) 17); [lia|].
+  destruct (Nat.eqb_spec (16 + k) (16 + A + 6)); [lia|]. destruct (Nat.eqb_spec (16 + k) (16 + A + 7)); [lia|].
+  destruct (Nat.eqb_spec (16 + k) (16 + A + 8)); [lia | reflexivity].
+Qed.
+
+Lemma dlt_post : forall i r, dlt (tb A + i) r = if Nat.eqb i 6 then (if Nat.eqb r 1 then 2 else 0)
+                                                 else if Nat.eqb i 7 then 2 else if Nat.eqb i 8 then 5 else 0.
+Proof.
+  intros i r. unfold dlt, tb. destruct (Nat.eqb_spec (16 + A + i) 17); [lia|].
+  destruct (Nat.eqb_spec i 6) as [->|E6]; [rewrite Nat.eqb_refl; reflexivity|].
+  destruct (Nat.eqb_spec (16 + A + i) (16 + A + 6)); [lia|].
+  destruct (Nat.eqb_spec i 7) as [->|E7]; [rewrite Nat.eqb_refl; reflexivity|].
+  destruct (Nat.eqb_spec (16 + A + i) (16 + A + 7)); [lia|].
+  destruct (Nat.eqb_spec i 8) as [->|E8]; [rewrite Nat.eqb_refl; reflexivity|].
+  destruct (Nat.eqb_spec (16 + A + i) (16 + A + 8)); [lia | reflexivity].
+Qed.
+
+Ltac len2 := cbn [length]; unfold lits; rewrite ?length_map, ?length_seq, ?length_app; cbn [length]; lia.
+
+Theorem host_rcs : forall b j r, valid (hblocks A) (nH A) (SRef b j r) ->
+  rcs (sunit (hblocks A) b j r) + 1 = length (sin (sunit (hblocks A) b j r)) + dlt b r.
+Proof.
+  intros b j r (Hb & Hj & Hr). rewrite length_hblocks in Hb by lia. unfold sunit. pose proof (SW_ge A HA) as HS.
+  destruct (Nat.lt_ge_cases b 17) as [Hp|Hp].
+  { rewrite dlt_pre, Nat.add_0_r by exact Hp. rewrite nth_hb_pre in Hj, Hr |- * by exact Hp.
+    assert (Hc : b = 0 \/ b = 1 \/ b = 2 \/ b = 3 \/ b = 4 \/ b = 5 \/ b = 6 \/ b = 7 \/ b = 8 \/ b = 9
+                 \/ b = 10 \/ b = 11 \/ b = 12 \/ b = 13 \/ b = 14 \/ b = 15 \/ b = 16) by lia.
+    destruct Hc as [->|[->|[->|[->|[->|[->|[->|[->|[->|[->|[->|[->|[->|[->|[->|[->| ->]]]]]]]]]]]]]]]];
+      cbn [nth hpre bcount bsize bshape blk_P blk_HP blk_FA blk_Q blk_F blk_PA blk_PB blk_AC blk_W
+           blk_RX blk_RY blk_KP blk_X blk_Y blk_PR] in Hj, Hr |- *;
+      (destruct r as [|r]; [|lia]); cbn [nth].
+    - apply and_rcs. len2.
+    - apply and_rcs. len2.
+    - apply and_rcs. len2.
+    - apply and_rcs. len2.
+    - apply and_rcs. len2.
+    - apply or_rcs. rewrite length_map, (Q_count A HA j Hj).
+      replace A with (S (A - 1)) in HS at 1 by lia. unfold SW in HS. rewrite Nat.pow_succ_r' in HS. lia.
+    - apply or_rcs. len2.
+    - apply and_rcs. len2.
+    - apply and_rcs. len2.
+    - apply and_rcs. len2.
+    - apply and_rcs. len2.
+    - apply and_rcs. len2.
+    - apply and_rcs. len2.
+    - apply and_rcs. len2.
+    - apply or_rcs. len2.
+    - apply or_rcs. len2.
+    - apply or_rcs. len2. }
+  destruct (Nat.lt_ge_cases b (tb A)) as [HT|HT].
+  { unfold tb in HT. replace b with (16 + (b - 16)) in Hj, Hr |- * by lia.
+    rewrite dlt_T by lia. rewrite nth_hb_T in Hj, Hr |- * by lia. cbn [bcount bsize bshape blk_T] in Hj, Hr |- *.
+    remember (b - 16) as k eqn:Ek. assert (Hk : 1 <= k < A) by lia.
+    destruct r as [|r]; cbn [nth].
+    - destruct (Nat.eqb_spec k 1) as [->|E].
+      + cbn. reflexivity.
+      + rewrite Nat.add_0_r. apply and_rcs. rewrite length_map, length_seq. lia.
+    - rewrite nth_map_d with (d' := 0) by (rewrite length_seq; lia). rewrite seq_nth by lia.
+      assert (Hz : (if Nat.eqb k 1 then (if Nat.eqb (S r) 0 then 1 else 0) else 0) = 0)
+        by (destruct (Nat.eqb k 1); reflexivity).
+      rewrite Hz, Nat.add_0_r. apply and_rcs. rewrite length_app, length_map, length_seq. cbn [length]. lia. }
+  replace b with (tb A + (b - tb A)) in Hj, Hr |- * by lia. rewrite dlt_post.
+  rewrite nth_hb_post in Hj, Hr |- * by lia.
+  assert (Hi : b - tb A < 15) by (unfold tb in *; lia).
+  remember (b - tb A) as i eqn:Ei. clear Ei Hb Hp HT.
+  assert (Hc : i = 0 \/ i = 1 \/ i = 2 \/ i = 3 \/ i = 4 \/ i = 5 \/ i = 6 \/ i = 7 \/ i = 8 \/ i = 9
+               \/ i = 10 \/ i = 11 \/ i = 12 \/ i = 13 \/ i = 14) by lia.
+  destruct Hc as [->|[->|[->|[->|[->|[->|[->|[->|[->|[->|[->|[->|[->|[->| ->]]]]]]]]]]]]]];
+    cbn [nth hpost bcount bsize bshape blk_C blk_AX blk_NX blk_XN blk_EQ blk_R0 blk_H blk_R blk_LEQ
+         blk_TA blk_TB blk_NP blk_HAB blk_WR blk_NM Nat.eqb] in Hj, Hr |- *.
+  - destruct r as [|r]; [|lia]. cbn [nth]. rewrite Nat.add_0_r. apply or_rcs. len2.
+  - destruct r as [|r]; [|lia]. cbn [nth]. rewrite Nat.add_0_r. apply and_rcs. len2.
+  - destruct r as [|r]; [|lia]. cbn [nth]. rewrite Nat.add_0_r. apply and_rcs. len2.
+  - destruct r as [|r]; [|lia]. cbn [nth]. rewrite Nat.add_0_r. apply or_rcs. len2.
+  - destruct r as [|r]; [|lia]. cbn [nth]. rewrite Nat.add_0_r. apply and_rcs. len2.
+  - rewrite Nat.add_0_r. assert (Hr3 : r = 0 \/ r = 1 \/ r = 2) by lia.
+    destruct Hr3 as [->|[->| ->]]; cbn [nth]; first [apply and_rcs | apply or_rcs]; len2.
+  - assert (Hr3 : r = 0 \/ r = 1 \/ r = 2) by lia. destruct Hr3 as [->|[->| ->]]; reflexivity.
+  - destruct r as [|r]; [|lia]. reflexivity.
+  - destruct r as [|r]; [|lia]. reflexivity.
+  - destruct r as [|r]; [|lia]. cbn [nth]. rewrite Nat.add_0_r. apply and_rcs. len2.
+  - destruct r as [|r]; [|lia]. cbn [nth]. rewrite Nat.add_0_r. apply and_rcs. len2.
+  - destruct r as [|r]; [|lia]. cbn [nth]. rewrite Nat.add_0_r. apply or_rcs. len2.
+  - rewrite Nat.add_0_r. assert (Hr3 : r = 0 \/ r = 1 \/ r = 2) by lia.
+    destruct Hr3 as [->|[->| ->]]; cbn [nth]; first [apply and_rcs | apply or_rcs]; len2.
+  - destruct r as [|r]; [|lia]. cbn [nth]. rewrite Nat.add_0_r. apply and_rcs. len2.
+  - destruct r as [|r]; [|lia]. cbn [nth]. rewrite Nat.add_0_r. apply or_rcs. len2.
+Qed.
+
+(* the records of the step of H_A: one fewer than the literals of each unit, and 4A + 2 more for the copy and the units of
+   threshold 2 *)
+Theorem host_step_records : srec (host_units A) + length (host_units A)
+  = nsum (length (host_units A)) (fun k => length (tin (nth k (host_units A) tu0))) + 4 * A + 2.
+Proof.
+  pose proof (host_wf' A HA) as Hwf. pose proof (hout_valid A HA) as Hov.
+  unfold srec. rewrite (fold_nsum _ (fun U => rcount (tval U) (length (tin U))) _ tu0).
+  change (host_units A) with (fus (hblocks A) (nH A)).
+  rewrite (edges_bsum _ _ _ Hwf Hov), (fus_len _ _ Hwf), (nsum_units _ _ _ Hwf Hov).
+  rewrite <- (fus_len _ _ Hwf), (units_bsum _ _ _ Hwf Hov).
+  rewrite (bsum_ext (hblocks A) (nH A) _ (fun x => rcs (usu (hblocks A) x)))
+    by (intros b j r Hv; rewrite (fus_nth _ _ Hwf b j r Hv), tval_flat; unfold flat_unit; cbn [tin usu];
+        rewrite length_map; reflexivity).
+  rewrite <- bsum_add.
+  rewrite (bsum_ext (hblocks A) (nH A) _ (fun x => length (sin (usu (hblocks A) x))
+                                                   + match x with SRef b _ r => dlt b r | SIn _ => 0 end))
+    by (intros b j r Hv; cbn [usu]; apply host_rcs; exact Hv).
+  rewrite bsum_add. enough (bsum (hblocks A) (fun x => match x with SRef b _ r => dlt b r | SIn _ => 0 end) = 4 * A + 2) by lia.
+  rewrite (bsum_host A HA).
+  rewrite (nsum_ext 17 _ (fun _ => 0)).
+  2: { intros b Hb. apply nsum_zero. intros j _. apply nsum_zero. intros r _. apply dlt_pre. exact Hb. }
+  rewrite (nsum_ext (A - 1) _ (fun i => if Nat.eqb i 0 then 1 else 0)).
+  2: { intros i Hi. replace (17 + i) with (16 + S i) by lia.
+       rewrite (nsum_ext (S (S i)) _ (fun r => if Nat.eqb (S i) 1 then (if Nat.eqb r 0 then 1 else 0) else 0))
+         by (intros r _; apply dlt_T; lia).
+       destruct (Nat.eqb_spec i 0) as [->|E].
+       - cbn. reflexivity.
+       - apply nsum_zero. intros r _. destruct (Nat.eqb_spec (S i) 1); [lia | reflexivity]. }
+  rewrite (nsum_ext 15 _ (fun i => if Nat.eqb i 6 then 2 * (A - 1) else if Nat.eqb i 7 then 2 * (A - 1)
+                                   else if Nat.eqb i 8 then 5 else 0)).
+  2: { intros i Hi.
+       assert (Hc : i = 0 \/ i = 1 \/ i = 2 \/ i = 3 \/ i = 4 \/ i = 5 \/ i = 6 \/ i = 7 \/ i = 8 \/ i = 9
+                    \/ i = 10 \/ i = 11 \/ i = 12 \/ i = 13 \/ i = 14) by lia.
+       destruct Hc as [->|[->|[->|[->|[->|[->|[->|[->|[->|[->|[->|[->|[->|[->| ->]]]]]]]]]]]]]];
+         cbn [nth hpost bcount bsize blk_C blk_AX blk_NX blk_XN blk_EQ blk_R0 blk_H blk_R blk_LEQ
+              blk_TA blk_TB blk_NP blk_HAB blk_WR blk_NM nsum]; rewrite ?dlt_post; cbn [Nat.eqb];
+         rewrite ?nsum_const; try lia. }
+  rewrite (nsum_one (A - 1) (fun i => if Nat.eqb i 0 then 1 else 0) 0);
+    [| lia | intros k _ Hk; destruct (Nat.eqb_spec k 0); [lia | reflexivity]].
+  rewrite nsum_zero by reflexivity. cbn [nsum Nat.eqb]. lia.
+Qed.
+
+End SC.
+
+(* ---- the device and the whole image ---------------------------------------------------------------------- *)
+Lemma length_device_eq : forall A w nu lv, 8 <= A -> 2 <= w -> length (Stored.device A w nu lv) = 11 * A + 12 * w + 75.
+Proof.
+  intros A w nu lv HA Hw. unfold Stored.device, word1. rewrite !length_app.
+  rewrite !length_chain_eq. cbn [length]. rewrite !length_map, !length_seq.
+  rewrite (length_cmk _ _ _ _ 3) by (intro; reflexivity).
+  rewrite (length_cmk _ _ _ _ 8) by (intro; reflexivity).
+  rewrite (length_cmk _ _ _ _ 4) by (intro; reflexivity).
+  rewrite (length_cmk _ _ _ _ 3) by (intro; reflexivity).
+  rewrite (length_cmk _ _ _ _ 3) by (intro; reflexivity).
+  rewrite (length_cmk _ _ _ _ 4) by (intro; reflexivity).
+  rewrite (length_cmk _ _ _ _ A) by (intro; rewrite length_map, length_seq; reflexivity).
+  rewrite ?length_map, ?length_seq. unfold gMUX. cbn [length].
+  assert (C1 : chlen (S (A - 1)) = A - 1) by (destruct (A - 1) as [|a] eqn:E; [lia | reflexivity]).
+  pose proof (chlen_ge2 w Hw). rewrite C1. lia.
+Qed.
+
+(* G_A = 35A 2^(A-1) - 2^(A+1) + (A^3 - A)/6 + A^2 + 29A + 14w + 91 + pi_A, with pi_A < 8 empty records *)
+Theorem stored_records : forall A w, 8 <= A -> 2 <= w -> exists p, p < 8 /\
+  6 * length (stored A w) + 12 * SW A = 105 * A * SW A + A * A * A + 6 * (A * A) + 173 * A + 84 * w + 546 + 6 * p.
+Proof.
+  intros A w HA Hw. rewrite (stored_split A w), !length_app, repeat_length. unfold handover. cbn [length].
+  rewrite (length_startup A w _ (length_image A)), length_device_eq by assumption.
+  rewrite length_step_go_eq by (rewrite length_next_tbl; lia).
+  match goal with |- context [padn ?a ?b] => exists (padn a b); split; [apply padn_lt|] end.
+  pose proof (host_step_records A ltac:(lia)) as R. pose proof (host_edges A ltac:(lia)) as E.
+  pose proof (host_units_count A ltac:(lia)) as U. nia.
+Qed.
+
+(* ---- growth ---------------------------------------------------------------------------------------------- *)
+Lemma sq_le : forall A, 8 <= A -> 4 * (A * A) <= SW A.
+Proof.
+  intros A HA. replace A with (8 + (A - 8)) by lia. generalize (A - 8) as k. clear.
+  induction k as [|k IH]; [cbn; lia|]. unfold SW in *. replace (8 + S k) with (S (8 + k)) by lia.
+  rewrite Nat.pow_succ_r'. nia.
+Qed.
+
+Lemma cube_le : forall A, 8 <= A -> A * A * A <= 4 * SW A.
+Proof.
+  intros A HA. replace A with (8 + (A - 8)) by lia. generalize (A - 8) as k. clear.
+  induction k as [|k IH]; [cbn; lia|]. unfold SW in *. replace (8 + S k) with (S (8 + k)) by lia.
+  rewrite Nat.pow_succ_r'. nia.
+Qed.
+
+Lemma units_le : forall A, 8 <= A -> length (host_units A) <= 9 * A * SW A.
+Proof. intros A HA. pose proof (host_units_count A ltac:(lia)). pose proof (sq_le A HA). nia. Qed.
+
+Lemma edges_le : forall A, 8 <= A -> nsum (length (host_units A)) (fun k => length (tin (nth k (host_units A) tu0))) <= 26 * A * SW A.
+Proof. intros A HA. pose proof (host_edges A ltac:(lia)). pose proof (sq_le A HA). pose proof (cube_le A HA). nia. Qed.
+
+Lemma levels_le : forall us, levels us <= fold_right (fun u acc => length (tin u) + acc) 0 us.
+Proof.
+  intro us. unfold levels.
+  assert (G : forall c, fold_left Nat.max (map (fun u => if thr_unit u then length (tin u) - 2 else 0) us) c
+                        <= c + fold_right (fun u acc => length (tin u) + acc) 0 us).
+  { induction us as [|u t IH]; intro c; cbn [map fold_left fold_right]; [lia|].
+    specialize (IH (Nat.max c (if thr_unit u then length (tin u) - 2 else 0))). destruct (thr_unit u); lia. }
+  specialize (G 0). lia.
+Qed.
+
+(* the cells of the window *)
+Lemma alS_eq : forall A w, alS A w = Nat.log2_up (ncells A w (length (host_units A)) (levels (host_units A))).
+Proof. intros A w. reflexivity. Qed.
+
+Lemma ncells_eq : forall A w nu lv, ncells A w nu lv = 24 + 4 * w + nH A + nu + 3 * lv.
+Proof. intros A w nu lv. unfold ncells, DB, nh. lia. Qed.
+
+(* alpha_A = A + Theta(log A) *)
+Theorem alpha_bounds : forall A w, 8 <= A -> w <= SW A -> A + Nat.log2 A + 3 <= alS A w <= A + Nat.log2 A + 8.
+Proof.
+  intros A w HA Hw. rewrite alS_eq, ncells_eq.
+  pose proof (units_le A HA) as U. pose proof (edges_le A HA) as E. pose proof (levels_le (host_units A)) as L.
+  rewrite (fold_nsum _ (fun u => length (tin u)) _ tu0) in L. cbv beta in L.
+  pose proof (host_units_count A ltac:(lia)) as U2.
+  pose proof (Nat.log2_spec A ltac:(lia)) as [Hl1 Hl2]. set (k := Nat.log2 A) in *.
+  assert (HS : 256 <= SW A) by (pose proof (sq_le A HA); nia).
+  set (c := 24 + 4 * w + nH A + length (host_units A) + 3 * levels (host_units A)).
+  assert (Hc0 : 0 < c) by (unfold c; lia).
+  split.
+  - replace (A + k + 3) with (S (A + k + 2)) by lia. apply Nat.le_succ_l.
+    apply (proj1 (Nat.log2_up_lt_pow2 c (A + k + 2) Hc0)).
+    replace (A + k + 2) with (k + 2 + A) by lia. rewrite !Nat.pow_add_r. unfold c, SW in *. change (2 ^ 2) with 4. nia.
+  - apply Nat.log2_up_le_pow2; [exact Hc0|].
+    replace (A + k + 8) with ((k + 1) + 7 + A) by lia.
+    rewrite (Nat.pow_add_r 2 (k + 1 + 7) A), (Nat.pow_add_r 2 (k + 1) 7). change (2 ^ 7) with 128.
+    fold (SW A). set (S := SW A) in *.
+    assert (HP : 8 * S <= A * S) by nia.
+    assert (HA2 : A <= S) by (pose proof (sq_le A HA) as Q; fold S in Q; nia).
+    assert (Hn : nH A = A + 1 + A * S) by (unfold nH, S, SW; lia).
+    assert (Hc : c <= 90 * (A * S)) by (unfold c; rewrite Hn; lia).
+    assert (Hk : (A + 1) * (128 * S) <= 2 ^ (k + 1) * (128 * S))
+      by (apply Nat.mul_le_mono_r; replace (k + 1) with (Datatypes.S k) by lia; lia).
+    lia.
+Qed.
+
+(* the image as bytes: (8 + 3 alpha) G / 8 *)
+Lemma image_bytes_len : forall A w, 8 * length (image_bytes A w) = recw (alS A w) * length (stored A w).
+Proof.
+  intros A w. unfold StoredImage.image_bytes. rewrite StoredImage.length_bytes. pose proof (StoredImage.image_whole A w) as H.
+  pose proof (Nat.div_mod_eq (recw (alS A w) * length (stored A w)) 8). lia.
+Qed.
+
+Lemma stored_le : forall A w, 8 <= A -> 2 <= w <= 2 * A + 10 -> length (stored A w) <= 18 * A * SW A.
+Proof.
+  intros A w HA Hw. destruct (stored_records A w HA ltac:(lia)) as (p & Hp & H).
+  pose proof (sq_le A HA). pose proof (cube_le A HA). nia.
+Qed.
+
+Lemma stored_ge : forall A w, 8 <= A -> 2 <= w -> 17 * A * SW A <= length (stored A w).
+Proof.
+  intros A w HA Hw. destruct (stored_records A w HA Hw) as (p & Hp & H).
+  pose proof (sq_le A HA). nia.
+Qed.
+
+Lemma bytes_le : forall A w, 8 <= A -> 2 <= w <= 2 * A + 10 -> 8 * length (image_bytes A w) <= 180 * (A * A) * SW A.
+Proof.
+  intros A w HA Hw. rewrite image_bytes_len. pose proof (stored_le A w HA Hw) as G.
+  pose proof (alpha_bounds A w HA ltac:(pose proof (sq_le A HA); nia)) as [_ Ha].
+  pose proof (Nat.log2_le_lin A ltac:(lia)). unfold recw. nia.
+Qed.
+
+(* a counter of 2A + 10 bits holds every recipe of at most 2B + 1 bytes, and there is a least such width from 20 on *)
+Lemma width_2A : forall A, 8 <= A -> 2 * length (image_bytes A (2 * A + 10)) + 1 < 2 ^ (2 * A + 10).
+Proof.
+  intros A HA. pose proof (bytes_le A (2 * A + 10) HA ltac:(lia)) as B. pose proof (sq_le A HA) as Q.
+  replace (2 * A + 10) with (A + A + 10) at 2 by lia. rewrite !Nat.pow_add_r. change (2 ^ 10) with 1024.
+  unfold SW in *. nia.
+Qed.
+
+Lemma least_from : forall (P : nat -> Prop), (forall n, {P n} + {~ P n}) ->
+  forall d a, P (a + d) -> exists m, a <= m <= a + d /\ P m /\ forall k, a <= k < m -> ~ P k.
+Proof.
+  intros P Pdec d. induction d as [|d IH]; intros a H.
+  - exists a. split; [lia|]. split; [rewrite Nat.add_0_r in H; exact H|]. intros k Hk. lia.
+  - destruct (Pdec a) as [Ha|Ha].
+    + exists a. split; [lia|]. split; [exact Ha|]. intros k Hk. lia.
+    + destruct (IH (S a)) as (m & Hm & Pm & Hl); [replace (S a + d) with (a + S d) by lia; exact H|].
+      exists m. split; [lia|]. split; [exact Pm|]. intros k Hk. destruct (Nat.eq_dec k a) as [->|E]; [exact Ha|].
+      apply Hl. lia.
+Qed.
+
+Theorem width_least : forall A, 8 <= A -> exists w, 20 <= w <= 2 * A + 10
+  /\ 2 * length (image_bytes A w) + 1 < 2 ^ w
+  /\ forall w', 20 <= w' < w -> 2 ^ w' <= 2 * length (image_bytes A w') + 1.
+Proof.
+  intros A HA.
+  destruct (least_from (fun w => 2 * length (image_bytes A w) + 1 < 2 ^ w)
+              (fun w => lt_dec _ _) (2 * A + 10 - 20) 20) as (m & Hm & Pm & Hl).
+  - replace (20 + (2 * A + 10 - 20)) with (2 * A + 10) by lia. apply width_2A. exact HA.
+  - exists m. split; [lia|]. split; [exact Pm|]. intros w' Hw'. specialize (Hl w' Hw'). lia.
+Qed.
+
+(* with banks of G_A slots a generation is P G_A steps, Theta(A^3 4^A) *)
+Theorem generation_bounds : forall A w, 8 <= A -> 20 <= w <= 2 * A + 10 ->
+  256 * (A * A * A) * (SW A * SW A) <= psteps (describe (image_bytes A w)) * length (stored A w)
+  <= 32 * 256 * (A * A * A) * (SW A * SW A).
+Proof.
+  intros A w HA Hw. pose proof (sq_le A HA) as Q.
+  destruct (Recipe.describe_spec (image_bytes A w) (StoredImage.image_bytes_lt A w)) as (D & T & _).
+  pose proof (Recipe.psteps_lower _ T) as P1. rewrite D in P1.
+  destruct (Recipe.describe_steps (image_bytes A w) (StoredImage.image_bytes_lt A w)) as [P2 _].
+  pose proof (image_bytes_len A w) as B.
+  pose proof (stored_le A w HA ltac:(lia)) as G1. pose proof (stored_ge A w HA ltac:(lia)) as G2.
+  pose proof (alpha_bounds A w HA ltac:(nia)) as [Ha1 Ha2]. pose proof (Nat.log2_le_lin A ltac:(lia)) as Hlog.
+  unfold recw in B.
+  set (P := psteps (describe (image_bytes A w))) in *. set (G := length (stored A w)) in *.
+  set (Bn := length (image_bytes A w)) in *. set (al := alS A w) in *. set (S := SW A) in *.
+  assert (HS : 256 <= S) by nia.
+  assert (HAS : 8 * 256 <= A * S) by (apply Nat.mul_le_mono; lia).
+  split.
+  - assert (L0 : 3 * A * G <= 3 * al * G) by (apply Nat.mul_le_mono_r, Nat.mul_le_mono_l; lia).
+    assert (L1 : 3 * A * G <= 8 * Bn) by lia.
+    assert (L2 : 3 * A * G * G <= 2 * P * G) by (apply Nat.mul_le_mono_r; lia).
+    assert (L3 : A * (17 * A * S * (17 * A * S)) <= A * (G * G)) by (apply Nat.mul_le_mono_l, Nat.mul_le_mono; exact G2).
+    lia.
+  - assert (U0 : (8 + 3 * al) * G <= 10 * A * G) by (apply Nat.mul_le_mono_r; lia).
+    assert (HG0 : 464 <= G) by lia.
+    assert (HG : 464 <= A * G) by (pose proof (Nat.mul_le_mono 1 A 464 G ltac:(lia) HG0); lia).
+    assert (U2 : 16 * P <= 251 * A * G) by lia.
+    assert (U3 : 16 * P * G <= 251 * A * G * G) by (apply Nat.mul_le_mono_r; exact U2).
+    assert (U4 : A * (G * G) <= A * (18 * A * S * (18 * A * S))) by (apply Nat.mul_le_mono_l, Nat.mul_le_mono; exact G1).
+    lia.
+Qed.

rocq/StoredFast.v

@@ -0,0 +1,130 @@
+(* The table of next values in one pass over the units, equal to next_tbl for the host since the units of
+   the next values come in increasing order, and the image of the stored host computed with it: the
+   definition that the extraction runs. *)
+From Stdlib Require Import List Bool Arith ZArith Lia Sorting.Sorted.
+Import ListNotations.
+From TH Require Import TwoHead Net Host HostWF HostIP Device Stored StoredStep.
+
+(* cnt entries from position u, the pairs (value, position) in increasing order of position *)
+Fixpoint tbl_merge (u cnt : nat) (ps : list (nat * nat)) : list (option nat) :=
+  match cnt with
+  | O => []
+  | S c =>
+      match ps with
+      | (i, k) :: ps' => if Nat.eqb k u then Some i :: tbl_merge (S u) c ps' else None :: tbl_merge (S u) c ps
+      | [] => None :: tbl_merge (S u) c []
+      end
+  end.
+
+Definition next_tbl_lin (n nu : nat) (nx : list nat) : list (option nat) := tbl_merge n nu (combine (seq 0 n) nx).
+
+Lemma length_tbl_merge : forall cnt u ps, length (tbl_merge u cnt ps) = cnt.
+Proof.
+  induction cnt as [|c IH]; intros u ps; [reflexivity|].
+  destruct ps as [|[i k] ps]; cbn [tbl_merge]; [cbn [length]; rewrite IH; reflexivity|].
+  destruct (Nat.eqb k u); cbn [length]; rewrite IH; reflexivity.
+Qed.
+
+Lemma nth_tbl_merge : forall cnt u ps j, StronglySorted (fun p q => snd p < snd q) ps ->
+  Forall (fun p => u <= snd p) ps -> j < cnt ->
+  nth j (tbl_merge u cnt ps) None = match find (fun p => Nat.eqb (snd p) (u + j)) ps with
+                                    | Some p => Some (fst p) | None => None end.
+Proof.
+  induction cnt as [|c IH]; intros u ps j Hs Hf Hj; [lia|].
+  destruct ps as [|[i k] ps'].
+  - cbn [tbl_merge]. destruct j as [|j]; [reflexivity|]. cbn [nth].
+    rewrite IH; [reflexivity | constructor | constructor | lia].
+  - apply StronglySorted_inv in Hs as [Hs Hall]. apply Forall_cons_iff in Hf as [Hk Hf]. cbn [snd] in Hk.
+    assert (Hgt : Forall (fun p => k < snd p) ps') by exact Hall.
+    cbn [tbl_merge]. destruct (Nat.eqb_spec k u) as [->|Ne].
+    + destruct j as [|j].
+      * cbn [nth find fst snd]. rewrite Nat.add_0_r, Nat.eqb_refl. reflexivity.
+      * cbn [nth find fst snd]. replace (Nat.eqb u (u + S j)) with false by (symmetry; apply Nat.eqb_neq; lia).
+        rewrite IH; [| exact Hs | | lia].
+        -- replace (S u + j) with (u + S j) by lia. reflexivity.
+        -- eapply Forall_impl; [|exact Hgt]. intros p Hp. cbn beta in Hp. lia.
+    + destruct j as [|j].
+      * cbn [nth find fst snd]. rewrite Nat.add_0_r. replace (Nat.eqb k u) with false by (symmetry; apply Nat.eqb_neq; exact Ne).
+        rewrite find_none_of; [reflexivity|]. intros p Hp. rewrite Forall_forall in Hgt. specialize (Hgt p Hp).
+        apply Nat.eqb_neq. lia.
+      * cbn [nth]. rewrite IH; [| constructor; [exact Hs | exact Hall] | | lia].
+        -- replace (S u + j) with (u + S j) by lia. reflexivity.
+        -- constructor; [cbn [snd]; lia|]. eapply Forall_impl; [|exact Hgt]. intros p Hp. cbn beta in Hp. lia.
+Qed.
+
+Lemma sorted_combine : forall (a l : list nat), length a = length l -> StronglySorted lt l ->
+  StronglySorted (fun p q => snd p < snd q) (combine a l).
+Proof.
+  induction a as [|x a IH]; intros [|y l] Hl Hs; cbn [combine]; try constructor;
+    apply StronglySorted_inv in Hs as [Hs Hall].
+  - apply IH; [cbn in Hl; lia | exact Hs].
+  - apply Forall_forall. intros [i k] Hp. cbn [snd]. apply in_combine_r in Hp. rewrite Forall_forall in Hall.
+    apply Hall. exact Hp.
+Qed.
+
+Lemma sorted_map_seq : forall (f : nat -> nat) m len, (forall i j, m <= i -> i < j -> j < m + len -> f i < f j) ->
+  StronglySorted lt (map f (seq m len)).
+Proof.
+  intros f m len. revert m. induction len as [|len IH]; intros m H; cbn [seq map]; constructor.
+  - apply IH. intros i j Hi Hij Hj. apply H; lia.
+  - apply Forall_map, Forall_forall. intros j Hj. apply in_seq in Hj. apply H; lia.
+Qed.
+
+Section Host.
+Variable A : nat.
+Hypothesis HA : 3 <= A.
+
+Local Notation n := (nH A).
+Local Notation us := (host_units A).
+
+(* the units of the next values come in the order of the state bits *)
+Lemma hout_mono : forall i j, i < j -> j < n -> idx n (hblocks A) (hout A i) < idx n (hblocks A) (hout A j).
+Proof.
+  intros i j Hij Hj.
+  pose proof (boff_mono (hblocks A) (tb A + 12) (tb A + 11) ltac:(lia) ltac:(rewrite len_hb; lia)) as B1.
+  pose proof (boff_mono (hblocks A) (tb A + 14) (tb A + 12) ltac:(lia) ltac:(rewrite len_hb; lia)) as B2.
+  rewrite (bcount_post A HA 11), (bsize_post A HA 11) in B1 by lia.
+  rewrite (bcount_post A HA 12), (bsize_post A HA 12) in B2 by lia.
+  cbn [nth hpost bcount bsize blk_NP blk_HAB] in B1, B2.
+  unfold hout.
+  destruct (Nat.ltb_spec i A), (Nat.ltb_spec j A); try destruct (Nat.eqb_spec i A); try destruct (Nat.eqb_spec j A);
+    cbn [idx]; rewrite ?(bsize_post A HA 11), ?(bsize_post A HA 12), ?(bsize_post A HA 14) by lia;
+    cbn [nth hpost bsize blk_NP blk_HAB blk_NM]; lia.
+Qed.
+
+Lemma host_next_sorted : StronglySorted lt (host_next A).
+Proof.
+  unfold host_next. apply sorted_map_seq. intros i j _ Hij Hj. apply hout_mono; lia.
+Qed.
+
+Theorem next_tbl_lin_eq : next_tbl_lin n (length us) (host_next A) = next_tbl n (length us) (host_next A).
+Proof.
+  apply (nth_ext _ _ None None).
+  - unfold next_tbl_lin. rewrite length_tbl_merge, (proj1 (nt_spec A HA)). reflexivity.
+  - intros u Hu. unfold next_tbl_lin in *. rewrite length_tbl_merge in Hu.
+    rewrite (proj2 (nt_spec A HA) u Hu). rewrite nth_tbl_merge; [reflexivity | | | exact Hu].
+    + apply sorted_combine; [rewrite length_seq, length_host_next; reflexivity | exact host_next_sorted].
+    + apply Forall_forall. intros p Hp. rewrite <- length_host_next in Hp.
+      destruct (in_combine_seq (host_next A) p Hp) as [H1 H2]. rewrite H2. rewrite length_host_next in H1.
+      exact (proj1 (host_next_range A HA (fst p) H1)).
+Qed.
+
+End Host.
+
+(* ---- the image of the stored host with the table in one pass ------------------------------------------ *)
+Definition stored_of_lin (A w : nat) (us : list tu) (nx m : list nat) : list rec * nat :=
+  let nu := length us in
+  let lv := levels us in
+  let al := Nat.log2_up (ncells A w nu lv) in
+  let body := startup A w m ++ step_go A w nu 0 us (next_tbl_lin (nH A) nu nx) ++ device A w nu lv in
+  (body ++ repeat EMPTY (padn al (length body)) ++ handover A w, al).
+
+Definition stored_bits_lin (A w : nat) : list bool :=
+  let sa := stored_of_lin A w (host_units A) (host_next A) (image A (progPstar A)) in
+  concat (map (enc_recA (snd sa)) (fst sa)).
+
+Theorem stored_bits_lin_eq : forall A w, 3 <= A -> stored_bits_lin A w = stored_bits A w.
+Proof.
+  intros A w HA. unfold stored_bits_lin, stored_bits, stored_of_lin, stored_of. cbv zeta.
+  rewrite (next_tbl_lin_eq A HA). reflexivity.
+Qed.

rocq/StoredImage.v

@@ -1,8 +1,8 @@
-(* The image of the stored host as a byte string, and recipes of byte strings by literal tokens (Lemma 3.2): the
+(* The image of the stored host as a byte string, and recipes of byte strings by literal tokens (Lemma 4.2): the
    records of S_{A,w} fill whole bytes, and every byte string has a recipe of at most twice its length plus one. *)
 From Stdlib Require Import List Bool Arith ZArith Lia.
 Import ListNotations.
-From TH Require Import TwoHead Net Abstract Indep Run PhysSem View Stored Host Device Pstar StoredPass.
+From TH Require Import TwoHead Net Abstract Indep Run PhysSem View Stored Host Device Pstar StoredPass Recipe.
 
 (* ---- bits and bytes --------------------------------------------------------------------------------------- *)
 Lemma nat2bits_bits2nat : forall l, nat2bits (length l) (bits2nat l) = l.
@@ -84,7 +84,7 @@ Proof. intros A w. apply bytes_lt. Qed.
 Lemma length_image_bytes : forall A w, length (image_bytes A w) <= recw (alS A w) * length (stored A w).
 Proof. intros A w. unfold image_bytes. rewrite length_bytes. apply Nat.Div0.div_le_upper_bound. lia. Qed.
 
-(* ---- recipes of literal tokens: Lemma 3.2 ------------------------------------------------------------------- *)
+(* ---- recipes of literal tokens: Lemma 4.2 ------------------------------------------------------------------- *)
 Fixpoint chunks (fuel : nat) (f : list nat) : list (list nat) :=
   match fuel with
   | O => []
@@ -116,15 +116,6 @@ Qed.
 
 Definition lits (f : list nat) : list token := map (fun c => Lit (map nu c)) (chunks (length f) f).
 
-Lemma nu_nu : forall b, b < 256 -> nu (nu b) = b.
-Proof.
-  intros b Hb. unfold nu. destruct (Nat.eq_dec b 0) as [->|E]; [reflexivity|].
-  rewrite (Nat.mod_small (256 - b)) by lia. rewrite Nat.mod_small by lia. lia.
-Qed.
-
-Lemma nu_lt : forall b, nu b < 256.
-Proof. intro b. unfold nu. apply Nat.mod_upper_bound. lia. Qed.
-
 Lemma lits_ok : forall f, Forall tok_ok (lits f).
 Proof.
   intro f. unfold lits. apply Forall_map, Forall_forall. intros c Hc. destruct (chunks_ok _ _ _ Hc) as [Hl _].

rocq/StoredProp.v

@@ -0,0 +1,332 @@
+(* Proposition 8.5 in one statement: from every state of the ring machine whose window holds a state of H_A,
+   its registers and clear requests, whatever the other cells hold, a pass of S_{A,w} loads x_0(m*_A), clears
+   the registers, the idle bank and the copy tape and returns the heads if booted is 0, carries out one step
+   of H_A and the device of Definition 8.4, and sets booted to the negation of the halt bit; at the halt it
+   returns the arm and the copy head and hands over at its G-th step, and otherwise its S steps bring the slot
+   head back to slot 0. *)
+From Stdlib Require Import List Bool Arith ZArith Lia.
+Import ListNotations.
+From TH Require Import TwoHead Net Abstract Indep Run PhysSem PhysMain View Stored WinRun WinPar ViewOps Host HostWF
+  HostSem HostIP Device Pstar StoredStep StoredBoot StoredDev StoredPass StoredOk StoredRun.
+
+(* ---- the device of Definition 8.4 on the host's state, its registers and the three heads ------------------ *)
+Record sdst := mkSD { sy : hst; scnt : nat; slim : nat; sdest : bool; srd : tape; sarm : tape; scpy : tape }.
+
+Section Dev84.
+Variables (A w Lb L : nat).
+
+(* the byte under the read head, most significant bit first *)
+Definition rbyte (R : tape) : nat := bits2nat (map (fun k => nth (adv L k (th R)) (td R) false) (seq 0 8)).
+
+Definition sdevice (x : sdst) : sdst :=
+  let y := sy x in
+  let wr := Nat.eqb (memv y (cwr A)) 1 in
+  let rd := Nat.eqb (memv y (crd A)) 1 in
+  let rw := Nat.eqb (memv y (crw A)) 1 in
+  let eot := sdest x && Nat.eqb (scnt x) (slim x) in
+  let g := rd && negb eot in
+  let c1 := if g then S (scnt x) mod 2 ^ w else scnt x in
+  let ob := nat2bits 8 (memv y (rout A)) in
+  let y1 := if wr then setm A y (rout A) 0 else y in
+  let y2 := if rd then (if eot then setm A y1 (ceot A) 1
+                        else setm A (setm A y1 (rin A) (sext A (rbyte (srd x)))) (ceot A) 0) else y1 in
+  mkSD (setm A (setm A (setm A y2 (cwr A) 0) (crd A) 0) (crw A) 0)
+       (if rw then 0 else c1) (if rw then c1 else slim x) (sdest x || rw)
+       (mkT (td (srd x)) (if rw then 0 else if g then adv L 8 (th (srd x)) else th (srd x)))
+       (if wr && negb (sdest x) then wseq Lb ob (sarm x) else sarm x)
+       (if wr && sdest x then wseq L ob (scpy x) else scpy x).
+
+(* the cells of the window that hold the state of the host and its registers *)
+Definition srel (ww : list bool) (x : sdst) : Prop :=
+  holds A w ww (sy x) /\ hvalid A (sy x) /\ scnt x < 2 ^ w /\ slim x < 2 ^ w
+  /\ (forall i, i < w -> wget ww (CNT i) = Nat.testbit (scnt x) i)
+  /\ (forall i, i < w -> wget ww (LIM w i) = Nat.testbit (slim x) i)
+  /\ wget ww (DEST w) = sdest x.
+
+(* the startup, the step of H_A and the device *)
+Definition sboot (b : bool) (x : sdst) : sdst :=
+  if b then x
+  else mkSD (x0m (image A (progPstar A))) 0 0 false (mkT (td (srd x)) 0) (mkT (repeat false Lb) 0) (mkT (repeat false L) 0).
+
+Definition sstep (x : sdst) : sdst := mkSD (subleq A (sy x)) (scnt x) (slim x) (sdest x) (srd x) (sarm x) (scpy x).
+
+Definition spass (b : bool) (x : sdst) : sdst := sdevice (sstep (sboot b x)).
+
+End Dev84.
+
+(* ---- a pass of the records on a view ----------------------------------------------------------------------- *)
+Section ViewPass.
+Variables (A w Lb L : nat).
+Hypotheses (HA : 8 <= A) (Hw : 1 <= w) (HL : 1 <= L).
+
+Local Notation W := (2 ^ alS A w).
+Local Notation m := (image A (progPstar A)).
+Local Notation nu := (length (host_units A)).
+Local Notation lvs := (levels (host_units A)).
+
+Lemma rbyte_lt : forall R, rbyte L R < 256.
+Proof.
+  intro R. unfold rbyte. pose proof (bits2nat_lt (map (fun k => nth (adv L k (th R)) (td R) false) (seq 0 8))) as H.
+  rewrite length_map, length_seq in H. exact H.
+Qed.
+
+Lemma testbit_rbyte : forall R t, t < 8 -> Nat.testbit (rbyte L R) t = nth (adv L (7 - t) (th R)) (td R) false.
+Proof.
+  intros R t Ht. unfold rbyte.
+  set (l := map (fun k => nth (adv L k (th R)) (td R) false) (seq 0 8)).
+  assert (Hl : length l = 8) by (unfold l; rewrite length_map, length_seq; reflexivity).
+  pose proof (testbit_bits2nat l (7 - t) ltac:(lia)) as E. rewrite Hl in E.
+  replace (8 - 1 - (7 - t)) with t in E by lia. rewrite E. unfold l.
+  rewrite (nth_map_seq _ (fun k => nth (adv L k (th R)) (td R) false) 8 (7 - t) false) by lia. reflexivity.
+Qed.
+
+Lemma memv_sdevice : forall x j, j < SW A ->
+  let y := sy x in
+  let rd := Nat.eqb (memv y (crd A)) 1 in
+  let eot := sdest x && Nat.eqb (scnt x) (slim x) in
+  memv (sy (sdevice A w Lb L x)) j =
+  if Nat.eqb j (cwr A) || Nat.eqb j (crd A) || Nat.eqb j (crw A) then 0
+  else if Nat.eqb j (rout A) then (if Nat.eqb (memv y (cwr A)) 1 then 0 else memv y j)
+  else if Nat.eqb j (rin A) then (if rd && negb eot then sext A (rbyte L (srd x)) else memv y j)
+  else if Nat.eqb j (ceot A) then (if rd then (if eot then 1 else 0) else memv y j)
+  else memv y j.
+Proof.
+  intros x j Hj y rd eot. pose proof (SW256 A HA) as HS. unfold sdevice. fold y rd eot. cbv zeta. cbn [sy].
+  rewrite !setm_mem by exact Hj.
+  destruct rd, eot, (Nat.eqb (memv y (cwr A)) 1); cbn [andb negb]; rewrite ?setm_mem by exact Hj;
+    unfold cwr, crd, crw, rout, rin, ceot in *;
+    repeat match goal with |- context [Nat.eqb ?a ?b] => destruct (Nat.eqb_spec a b) end;
+    cbn [orb]; try lia; reflexivity.
+Qed.
+
+Lemma sdevice_pc : forall x, hpc (sy (sdevice A w Lb L x)) = hpc (sy x) /\ hhalt (sy (sdevice A w Lb L x)) = hhalt (sy x)
+  /\ length (hmem (sy (sdevice A w Lb L x))) = SW A.
+Proof.
+  intro x. unfold sdevice. cbv zeta. cbn [sy]. split; [|split; [|apply setm_len]]; unfold setm; cbn [hpc hhalt];
+    destruct (Nat.eqb (memv (sy x) (crd A)) 1), (sdest x && Nat.eqb (scnt x) (slim x)), (Nat.eqb (memv (sy x) (cwr A)) 1);
+    reflexivity.
+Qed.
+
+Lemma sdevice_valid : forall x, hvalid A (sy x) -> hvalid A (sy (sdevice A w Lb L x)).
+Proof.
+  intros x Hv. pose proof (SW256 A HA) as HS.
+  assert (H1 : hvalid A (if Nat.eqb (memv (sy x) (cwr A)) 1 then setm A (sy x) (rout A) 0 else sy x))
+    by (destruct (Nat.eqb _ 1); [apply (setm_valid A HA); [exact Hv | lia] | exact Hv]).
+  unfold sdevice. cbv zeta. cbn [sy].
+  apply (setm_valid A HA); [|lia]. apply (setm_valid A HA); [|lia]. apply (setm_valid A HA); [|lia].
+  destruct (Nat.eqb (memv (sy x) (crd A)) 1); [|exact H1].
+  destruct (sdest x && Nat.eqb (scnt x) (slim x)); [apply (setm_valid A HA); [exact H1 | lia]|].
+  apply (setm_valid A HA); [|lia]. apply (setm_valid A HA); [exact H1|]. apply sext_lt; [exact HA | apply rbyte_lt].
+Qed.
+
+(* the startup *)
+Lemma startup_rel : forall v x, reqclear (vw v) -> length (vw v) = W -> srel A w (vw v) x ->
+  srd x = vr v -> sarm x = va v -> scpy x = vc v ->
+  let b := wget (vw v) BOOT in
+  let u := vrun Lb L (startup A w m) v in
+  reqclear (vw u) /\ length (vw u) = W /\ wget (vw u) BOOT = true /\ srel A w (vw u) (sboot A Lb L b x)
+  /\ vr u = srd (sboot A Lb L b x) /\ va u = sarm (sboot A Lb L b x) /\ vc u = scpy (sboot A Lb L b x)
+  /\ vho u = vho v.
+Proof.
+  intros v x Hq Hl Hr ER EA EC. cbv zeta. destruct (wget (vw v) BOOT) eqn:Eb.
+  - rewrite (startup_booted A w Lb L HA Hw v Hq Hl Eb). cbn [sboot].
+    exact (conj Hq (conj Hl (conj Eb (conj Hr (conj (eq_sym ER) (conj (eq_sym EA) (conj (eq_sym EC) eq_refl))))))).
+  - pose proof (startup_run A w W Lb L m ltac:(lia) (length_image A) (HWs A w HA Hw) v Hq Hl) as U. cbv zeta in U.
+    destruct U as (Q & L1 & B1 & S1 & R1 & D1 & _ & VR & VA & VC & VH). rewrite Eb in S1, R1, D1, VR, VA, VC.
+    cbn [sboot sy scnt slim sdest srd sarm scpy].
+    refine (conj Q (conj L1 (conj B1 (conj _ (conj _ (conj VA (conj VC VH))))))).
+    + unfold srel. cbn [sy scnt slim sdest].
+      refine (conj _ (conj (init_valid A HA) (conj _ (conj _ (conj _ (conj _ _)))))).
+      * intros i Hi. rewrite S1 by exact Hi. reflexivity.
+      * pose proof (Nat.pow_nonzero 2 w ltac:(lia)). lia.
+      * pose proof (Nat.pow_nonzero 2 w ltac:(lia)). lia.
+      * intros i Hi. rewrite (proj1 (R1 i Hi)), andb_false_r, Nat.bits_0. reflexivity.
+      * intros i Hi. rewrite (proj2 (R1 i Hi)), andb_false_r, Nat.bits_0. reflexivity.
+      * rewrite D1, andb_false_r. reflexivity.
+    + rewrite VR, ER. reflexivity.
+Qed.
+
+(* a pass of the records: the startup, the step of H_A, the device, the padding and the hand-over *)
+Theorem view_pass : forall v x, reqclear (vw v) -> length (vw v) = W -> srel A w (vw v) x ->
+  srd x = vr v -> sarm x = va v -> scpy x = vc v ->
+  let x' := spass A w Lb L (wget (vw v) BOOT) x in
+  let h := hhalt (sy x') in
+  let v' := vrun Lb L (stored A w) v in
+  reqclear (vw v') /\ length (vw v') = W /\ srel A w (vw v') x' /\ wget (vw v') BOOT = negb h
+  /\ vr v' = srd x' /\ va v' = (if h then mkT (td (sarm x')) 0 else sarm x')
+  /\ vc v' = (if h then mkT (td (scpy x')) 0 else scpy x') /\ vho v' = vho v || h.
+Proof.
+  intros v x Hq Hl Hr ER EA EC. cbv zeta.
+  pose proof (startup_rel v x Hq Hl Hr ER EA EC) as SU. cbv zeta in SU.
+  destruct SU as (Q1 & L1 & B1 & R1 & VR1 & VA1 & VC1 & VH1).
+  set (x1 := sboot A Lb L (wget (vw v) BOOT) x) in *.
+  set (u1 := vrun Lb L (startup A w m) v) in *.
+  unfold spass. fold x1.
+  rewrite (stored_split A w), !vrun_app. fold u1.
+  destruct R1 as (Hs1 & Hv1 & Hc1 & Hm1 & C1 & M1 & D1).
+  pose proof (SW256 A HA) as HS. pose proof (io_lt A w W HA Hw (HW A w HA Hw)) as (I1 & I2 & I3 & I4 & I5 & I6).
+  (* the step of H_A *)
+  pose proof (step_view A w Lb L HA Hw u1 (sy x1) Q1 L1 Hs1 Hv1) as SV. cbv zeta in SV.
+  destruct SV as (Q2 & L2 & S2 & U2 & VR2 & VA2 & VC2 & VH2).
+  set (u2 := vrun Lb L (step_go A w nu 0 (host_units A) (next_tbl (nH A) nu (host_next A))) u1) in *.
+  set (y := subleq A (sy x1)) in *.
+  assert (Hvy : hvalid A y) by (apply subleq_valid; assumption).
+  pose proof Hvy as (_ & Hly & _).
+  assert (C2 : forall i, i < w -> wget (vw u2) (CNT i) = Nat.testbit (scnt x1) i)
+    by (intros i Hi; rewrite U2 by (left; unfold CNT, ST; lia); apply C1, Hi).
+  assert (M2 : forall i, i < w -> wget (vw u2) (LIM w i) = Nat.testbit (slim x1) i)
+    by (intros i Hi; rewrite U2 by (left; unfold LIM, ST; lia); apply M1, Hi).
+  assert (D2 : wget (vw u2) (DEST w) = sdest x1) by (rewrite U2 by (left; unfold DEST, ST; lia); exact D1).
+  assert (B2 : wget (vw u2) BOOT = true) by (rewrite U2 by (left; unfold BOOT, ST; lia); exact B1).
+  (* what the device reads *)
+  set (wrb := Nat.eqb (memv y (cwr A)) 1). set (rdb := Nat.eqb (memv y (crd A)) 1).
+  set (rwb := Nat.eqb (memv y (crw A)) 1). set (eot := sdest x1 && Nat.eqb (scnt x1) (slim x1)).
+  assert (WR : wrv A w (vw u2) = wrb) by (apply word1v_holds; assumption).
+  assert (RD : rdv A w (vw u2) = rdb) by (apply word1v_holds; assumption).
+  assert (RW : rwv A w (vw u2) = rwb) by (apply word1v_holds; assumption).
+  assert (EQ : eqv w (vw u2) = Nat.eqb (scnt x1) (slim x1)) by (apply (regs_eq A w HA Hw); assumption).
+  assert (EO : eotv w (vw u2) = eot) by (unfold eotv, destv, eot; rewrite EQ, D2; apply andb_comm).
+  assert (G : gv A w (vw u2) = rdb && negb eot) by (unfold gv; rewrite RD, EO; reflexivity).
+  assert (CA : cav A w (vw u2) = wrb && negb (sdest x1)) by (unfold cav, destv; rewrite WR, D2; reflexivity).
+  assert (CC : ccv A w (vw u2) = wrb && sdest x1) by (unfold ccv, destv; rewrite WR, D2; reflexivity).
+  assert (CN : forall i, i < w -> cntv A w (vw u2) i = Nat.testbit (if rdb && negb eot then S (scnt x1) else scnt x1) i)
+    by (intros i Hi; rewrite (cntv_eq A w HA Hw (vw u2) (scnt x1) C2 i Hi), G; reflexivity).
+  assert (OB : outbits A w (vw u2) = nat2bits 8 (memv y (rout A))) by (apply outbits_eq; assumption).
+  (* the device *)
+  pose proof (device_run A w W Lb L HA Hw (HW A w HA Hw) u2 Q2 L2) as DV. cbv zeta in DV.
+  destruct DV as (Q3 & L3 & H3 & A3 & C3 & R3 & RO3 & RI3 & CE03 & CE3 & RQ3 & CL3 & D3 & U3).
+  set (u3 := vrun Lb L (Stored.device A w nu lvs) u2) in *.
+  rewrite (pad_run Lb L _ u3 Q3).
+  (* the hand-over *)
+  assert (HWh : 15 + 2 * w + A < W) by (pose proof (HWs A w HA Hw); unfold nH in *; nia).
+  pose proof (handover_run A w W Lb L HWh u3 Q3 L3) as HO3. cbv zeta in HO3.
+  destruct HO3 as (Q4 & L4 & U4 & R4 & A4 & C4 & H4).
+  set (u4 := vrun Lb L (handover A w) u3) in *.
+  assert (Hh3 : wget (vw u3) (ST w A) = hhalt y).
+  { rewrite U3 by (apply ST_ndevw; lia). rewrite S2 by (unfold nH; lia). apply nth_encodeH_halt. }
+  rewrite Hh3 in U4, A4, C4, H4.
+  assert (W4 : forall c, c <> BOOT -> wget (vw u4) c = wget (vw u3) c)
+    by (intros c Hc; rewrite U4, (proj2 (Nat.eqb_neq _ _) Hc); reflexivity).
+  (* the state the device leaves *)
+  pose proof (sdevice_pc (sstep A x1)) as (Dp & Dh & Dl).
+  pose proof (sdevice_valid (sstep A x1) Hvy) as Dv.
+  pose proof (fun j Hj => memv_sdevice (sstep A x1) j Hj) as Dm. cbv zeta in Dm.
+  remember (sdevice A w Lb L (sstep A x1)) as x3 eqn:Ex3.
+  assert (Fc : scnt x3 = if rwb then 0 else if rdb && negb eot then S (scnt x1) mod 2 ^ w else scnt x1)
+    by (rewrite Ex3; reflexivity).
+  assert (Fl : slim x3 = if rwb then (if rdb && negb eot then S (scnt x1) mod 2 ^ w else scnt x1) else slim x1)
+    by (rewrite Ex3; reflexivity).
+  assert (Fd : sdest x3 = sdest x1 || rwb) by (rewrite Ex3; reflexivity).
+  assert (FR : srd x3 = mkT (td (srd x1)) (if rwb then 0 else if rdb && negb eot then adv L 8 (th (srd x1)) else th (srd x1)))
+    by (rewrite Ex3; reflexivity).
+  assert (FI : sarm x3 = if wrb && negb (sdest x1) then wseq Lb (nat2bits 8 (memv y (rout A))) (sarm x1) else sarm x1)
+    by (rewrite Ex3; reflexivity).
+  assert (FC : scpy x3 = if wrb && sdest x1 then wseq L (nat2bits 8 (memv y (rout A))) (scpy x1) else scpy x1)
+    by (rewrite Ex3; reflexivity).
+  change (hhalt (sy (sstep A x1))) with (hhalt y) in Dh. change (hpc (sy (sstep A x1))) with (hpc y) in Dp.
+  rewrite Dh.
+  refine (conj Q4 (conj L4 (conj _ (conj _ (conj _ (conj _ (conj _ _))))))).
+  - (* the state of the host and the registers *)
+    refine (conj _ (conj Dv (conj _ (conj _ (conj _ (conj _ _)))))).
+    + apply (holds_of A w HA Hw); [exact Dl | | |].
+      * intros i Hi. rewrite W4 by (unfold ST, BOOT; lia). rewrite U3 by (apply ST_ndevw; lia).
+        rewrite S2 by (unfold nH; lia). rewrite nth_encodeH_pc by exact Hi. rewrite Dp. reflexivity.
+      * rewrite W4 by (unfold ST, BOOT; lia). rewrite Hh3. symmetry. exact Dh.
+      * intros j t Hj Ht. rewrite W4 by (pose proof (MB_range A w W HA Hw (HW A w HA Hw) j t Hj Ht); unfold BOOT; lia).
+        rewrite (Dm j Hj). cbn [sstep sy scnt slim sdest srd]. fold y wrb rdb eot.
+        destruct (Nat.eqb_spec j (cwr A)) as [->|N1].
+        { cbn [orb]. rewrite RQ3 by (auto; lia). rewrite Nat.bits_0. reflexivity. }
+        destruct (Nat.eqb_spec j (crd A)) as [->|N2].
+        { cbn [orb]. rewrite RQ3 by (auto; lia). rewrite Nat.bits_0. reflexivity. }
+        destruct (Nat.eqb_spec j (crw A)) as [->|N3].
+        { cbn [orb]. rewrite RQ3 by (auto; lia). rewrite Nat.bits_0. reflexivity. }
+        cbn [orb].
+        destruct (Nat.eqb_spec j (rout A)) as [->|N4].
+        { rewrite RO3 by exact Ht. rewrite (holds_MB A w HA Hw (vw u2) y (rout A) t S2 Hly I6 Ht), WR.
+          destruct wrb; cbn [negb]; [rewrite andb_false_r, Nat.bits_0 | rewrite andb_true_r]; reflexivity. }
+        destruct (Nat.eqb_spec j (rin A)) as [->|N5].
+        { rewrite RI3 by exact Ht. rewrite G, VR2, VR1.
+          destruct (rdb && negb eot) eqn:Eg.
+          - rewrite testbit_sext by (try assumption; apply rbyte_lt).
+            destruct (Nat.lt_ge_cases t 8) as [T8|T8].
+            + rewrite testbit_rbyte by lia. f_equal. f_equal. lia.
+            + rewrite testbit_rbyte by lia. replace (7 - t) with 0 by lia. reflexivity.
+          - apply (holds_MB A w HA Hw (vw u2) y (rin A) t S2 Hly I5 Ht). }
+        destruct (Nat.eqb_spec j (ceot A)) as [->|N6].
+        { destruct (Nat.eq_dec t 0) as [->|Ht0].
+          - rewrite CE03, RD, EO. destruct rdb; [destruct eot; reflexivity|].
+            apply (holds_MB A w HA Hw (vw u2) y (ceot A) 0 S2 Hly I2 Ht).
+          - rewrite CE3 by lia. rewrite RD, (holds_MB A w HA Hw (vw u2) y (ceot A) t S2 Hly I2 Ht).
+            destruct rdb; cbn [negb]; [rewrite andb_false_r | rewrite andb_true_r; reflexivity].
+            destruct eot; [|rewrite Nat.bits_0; reflexivity]. symmetry. apply testbit_lt_false.
+            apply (Nat.lt_le_trans _ (2 ^ 1)); [cbn; lia | apply Nat.pow_le_mono_r; lia]. }
+        rewrite U3 by (apply MB_ndevw; assumption). apply (holds_MB A w HA Hw); assumption.
+    + rewrite Fc. destruct rwb; [pose proof (Nat.pow_nonzero 2 w ltac:(lia)); lia|].
+      destruct (rdb && negb eot); [apply Nat.mod_upper_bound, Nat.pow_nonzero; lia | exact Hc1].
+    + rewrite Fl. destruct rwb; [|exact Hm1].
+      destruct (rdb && negb eot); [apply Nat.mod_upper_bound, Nat.pow_nonzero; lia | exact Hc1].
+    + intros i Hi. rewrite W4 by (unfold CNT, BOOT; lia). rewrite (proj1 (CL3 i Hi)), CN, RW, Fc by exact Hi.
+      destruct rwb; cbn [negb]; [rewrite andb_false_r, Nat.bits_0; reflexivity | rewrite andb_true_r].
+      destruct (rdb && negb eot); [|reflexivity]. symmetry. apply Nat.mod_pow2_bits_low. exact Hi.
+    + intros i Hi. rewrite W4 by (unfold LIM, BOOT; lia). rewrite (proj2 (CL3 i Hi)), RW, Fl.
+      destruct rwb; [|apply M2; exact Hi]. rewrite CN by exact Hi.
+      destruct (rdb && negb eot); [|reflexivity]. symmetry. apply Nat.mod_pow2_bits_low. exact Hi.
+    + rewrite W4 by (unfold DEST, BOOT; lia). rewrite D3, Fd. unfold destv. rewrite D2, RW. reflexivity.
+  - (* booted *)
+    rewrite U4, Nat.eqb_refl. rewrite U3.
+    + rewrite B2. reflexivity.
+    + unfold devw. intro H. unfold BOOT, DB, CNT, LIM, DEST, MB, ST in *.
+      destruct H as [H|[(j & Hj & [E|E])|[E|(c0 & t & _ & Ht & E)]]]; lia.
+  - (* the read tape *)
+    rewrite R4, R3, VR2, VR1, RW, G, FR. reflexivity.
+  - (* the arm *)
+    rewrite A4, A3, VA2, VA1, CA, OB, FI. reflexivity.
+  - (* the copy tape *)
+    rewrite C4, C3, VC2, VC1, CC, OB, FC. reflexivity.
+  - (* the hand-over *)
+    rewrite H4, H3, VH2, VH1. reflexivity.
+Qed.
+
+End ViewPass.
+
+(* ---- Proposition 8.5: the pass on the machine --------------------------------------------------------------- *)
+Section MachPass.
+Variables (A w K S0 L : nat).
+Hypotheses (HA : 8 <= A) (Hw : 1 <= w) (HK : 2 <= K) (HS : length (stored A w) <= S0) (HL : 1 <= L).
+
+Local Notation al := (alS A w).
+Local Notation G := (length (stored A w)).
+Local Notation Lb := (S0 * recw (alS A w)).
+
+Theorem stored_pass : forall s0 x, fits al K S0 L s0 ->
+  bq (nth (kap s0) (banks s0) bank0) = img A w S0 -> bs (nth (kap s0) (banks s0) bank0) = 0 ->
+  reqclear (win s0) -> srel A w (win s0) x -> srd x = nth (kap s0) (tapes s0) tape0 ->
+  sarm x = lin al (nth (succ_mod K (kap s0)) (banks s0) bank0) -> scpy x = nth (succ_mod K (kap s0)) (tapes s0) tape0 ->
+  let x' := spass A w Lb L (wget (win s0) BOOT) x in
+  let h := hhalt (sy x') in
+  let s := itern al K S0 L (if h then G else S0) s0 in
+  fits al K S0 L s /\ reqclear (win s) /\ srel A w (win s) x' /\ wget (win s) BOOT = negb h
+  /\ kap s = (if h then succ_mod K (kap s0) else kap s0)
+  /\ nth (kap s0) (banks s) bank0 = mkB (img A w S0) (if h then G mod S0 else 0) (bj (nth (kap s0) (banks s0) bank0))
+  /\ nth (kap s0) (tapes s) tape0 = srd x'
+  /\ lin al (nth (succ_mod K (kap s0)) (banks s) bank0) = (if h then mkT (td (sarm x')) 0 else sarm x')
+  /\ nth (succ_mod K (kap s0)) (tapes s) tape0 = (if h then mkT (td (scpy x')) 0 else scpy x')
+  /\ (forall y, y < K -> y <> kap s0 -> y <> succ_mod K (kap s0) ->
+        nth y (banks s) bank0 = nth y (banks s0) bank0 /\ nth y (tapes s) tape0 = nth y (tapes s0) tape0).
+Proof.
+  intros s0 x Hf Hb Hs Hq Hr ER EA EC x' h s.
+  assert (Hl0 : length (vw (view0 al K s0)) = 2 ^ al) by (destruct Hf as (Hl & _); exact Hl).
+  pose proof (view_pass A w Lb L HA Hw HL (view0 al K s0) x Hq Hl0 Hr ER EA EC) as VP. cbv zeta in VP.
+  fold x' h in VP. destruct VP as (Q & Ll & Rr & Bt & VR & VA & VC & VH).
+  assert (VH' : vho (vrun Lb L (stored A w) (view0 al K s0)) = h) by (rewrite VH; reflexivity).
+  pose proof (machine_pass_gen A w K S0 L HA Hw HK HS HL s0 h Hf Hb Hs Hq Q VH') as M. fold s in M.
+  destruct M as (Hfs & Hws & Hks & Has & His & Hrs & Hcs & Hos). rewrite VH' in Hks.
+  rewrite <- Hws in Q, Rr, Bt.
+  refine (conj Hfs (conj Q (conj Rr (conj Bt (conj Hks (conj _ (conj _ (conj _ (conj _ Hos))))))))).
+  - rewrite Has, Hb, Hs, Nat.add_0_l. destruct h; [reflexivity|]. rewrite Nat.Div0.mod_same. reflexivity.
+  - rewrite Hrs. exact VR.
+  - rewrite His. exact VA.
+  - rewrite Hcs. exact VC.
+Qed.
+
+End MachPass.

rocq/StoredRun.v

@@ -373,12 +373,12 @@ Proof.
 Qed.
 
 (* a pass: the records of the image, in G steps if they hand over and otherwise in S0 *)
-Lemma machine_pass : forall s0 h c o1 o2,
+Lemma machine_pass_gen : forall s0 h,
   fits al K S0 L s0 -> bq (nth (kap s0) (banks s0) bank0) = img -> bs (nth (kap s0) (banks s0) bank0) = 0 ->
-  reqclear (win s0) -> Rv A w Lb L h c o1 o2 (vrun Lb L rs (view0 al K s0)) ->
+  reqclear (win s0) -> reqclear (vw (vrun Lb L rs (view0 al K s0))) -> vho (vrun Lb L rs (view0 al K s0)) = h ->
   View.mv al K S0 L s0 (if h then G else S0) (itern al K S0 L (if h then G else S0) s0) (vrun Lb L rs (view0 al K s0)).
 Proof.
-  intros s0 h c o1 o2 Hf Hb Hs Hq HR. destruct HR as (Q & _ & Hh & _).
+  intros s0 h Hf Hb Hs Hq Q Hh.
   pose proof al4 as Hal. pose proof S0_pos as HS0.
   assert (Hq0 : reqclear (vw (view0 al K s0))) by exact Hq.
   destruct h.
@@ -404,6 +404,14 @@ Proof.
     rewrite firstn_all2 in M by (rewrite length_app, repeat_length; lia). rewrite Hfull in M. exact M.
 Qed.
 
+Lemma machine_pass : forall s0 h c o1 o2,
+  fits al K S0 L s0 -> bq (nth (kap s0) (banks s0) bank0) = img -> bs (nth (kap s0) (banks s0) bank0) = 0 ->
+  reqclear (win s0) -> Rv A w Lb L h c o1 o2 (vrun Lb L rs (view0 al K s0)) ->
+  View.mv al K S0 L s0 (if h then G else S0) (itern al K S0 L (if h then G else S0) s0) (vrun Lb L rs (view0 al K s0)).
+Proof.
+  intros s0 h c o1 o2 Hf Hb Hs Hq (Q & _ & Hh & _). exact (machine_pass_gen s0 h Hf Hb Hs Hq Q Hh).
+Qed.
+
 (* a pass that does not hand over leaves the state it started from but for the window, the idle bank and the
    copy tape, and the view it ends in is the view of the next pass *)
 Lemma bank_eta0 : forall q, bs q = 0 -> mkB (bq q) 0 (bj q) = q.

rocq/_CoqProject

@@ -25,6 +25,21 @@ Adder.v
 HostSem.v
 Device.v
 Pstar.v
+Recipe.v
+Lower.v
+Lev.v
+BlockLev.v
+HostLev.v
+HostCount.v
+PhysLev.v
+Margin.v
+Erfc.v
+Choose.v
+Noise.v
+NoiseNum.v
+Restore.v
+FlipLower.v
+AmpHost.v
 ExtractHost.v
 HostIP.v
 View.v
@@ -38,8 +53,12 @@ StoredDev.v
 StoredPass.v
 StoredOk.v
 StoredRun.v
+StoredProp.v
 StoredWbr.v
 StoredMain.v
 StoredImage.v
 StoredWidth.v
+StoredCount.v
+StoredFast.v
+ExtrNat.v
 ExtractStored.v

rocq/extract/dumpstored.ml

@@ -1,8 +1,8 @@
-(* writes the image of the stored host defined in Stored.v, extracted by ExtractStored.v, as bytes, most
-   significant bit first: dumpstored A W PATH *)
+(* writes the image of the stored host, stored_bits_lin of StoredFast.v, equal to stored_bits of Stored.v,
+   extracted by ExtractStored.v, as bytes, most significant bit first: dumpstored A W PATH *)
 let () =
   let a = int_of_string Sys.argv.(1) and w = int_of_string Sys.argv.(2) in
-  let bits = Storednet.stored_bits a w in
+  let bits = Storednet.stored_bits_lin a w in
   let oc = open_out_bin Sys.argv.(3) in
   let rec go acc k = function
     | [] -> if k > 0 then output_byte oc (acc lsl (8 - k))

src/independent.py

@@ -47,7 +47,7 @@ def build(A, fold=False):
     N = Net(n)
 
     def sel(bits, j, extra=()):
-        # the decode line [bits == j] as one conjunction of literals, Lemma 3.6
+        # the decode line [bits == j] as one conjunction of literals, Lemma 3.5
         lits = [(bits[i], bool((j >> i) & 1)) for i in range(A)] + list(extra)
         return N.AND(*lits)
 

src/netlist_eval.c

@@ -22,7 +22,7 @@
  * indices, all little-endian int32. For the host family the state is the A
  * counter bits, the halt bit and 2^A words of A bits, most significant bit
  * first, and A is recovered from n = A + 1 + A 2^A. For the amplified host of
- * Section 6.3 the state is R copies of that, copy c occupying the block
+ * Section 6.2 the state is R copies of that, copy c occupying the block
  * c n0 .. (c+1) n0 - 1, and (R, A) is recovered from n = R (A + 1 + A 2^A) with
  * the smallest R; the device reads each bit of a cell as the majority of its
  * copies and writes every copy, and rand replicates each random state and

src/noise.py

@@ -226,7 +226,7 @@ def run_leak(args) -> int:
     kmax = max(int((W != 0).sum(dim=1).max()) for W in L.W)
     r_H = describe(sigma)
     print(f"[leak] M = {M:,}, widest layer {nmax}, largest fan-in {kmax}; "
-          f"Corollary 6.3 permits eps*k + gamma*(n-k) < 1/2", flush=True)
+          f"Proposition 6.3 permits eps*k + gamma*(n-k) < 1/2", flush=True)
 
     def worst_bound(eps, gam):
         w = 0.0
@@ -519,7 +519,7 @@ def run_certify(args) -> int:
         out["leak_rows"] = rows
         n_cert = sum(r["certified_by_orbit"] for r in rows)
         n_exact = sum(r["first_deviation"] is None for r in rows)
-        print(f"    of the {len(rows)} rows of the leak table, Corollary 6.3 certifies "
+        print(f"    of the {len(rows)} rows of the leak table, Proposition 6.3 certifies "
               f"{sum(r['worst_bound'] < 0.5 for r in rows)}, the orbit certificate {n_cert}, "
               f"and {n_exact} were exact")
     if not args.short:

src/paper.py

@@ -1077,7 +1077,7 @@ def host_extraction(widths=(8, 9, 10)):
     return dict(members=members, identical=all(m['identical'] for m in members))
 
 
-def stored_extraction(widths=(8, 9)):
+def stored_extraction(widths=(8, 9, 10)):
     """The stored host of rocq/Stored.v, extracted to OCaml, against the image src/twohead.py builds."""
     import twohead
     ex = os.path.join(ROCQ, 'extract')
@@ -1153,10 +1153,35 @@ def main_rocq():
         print(out.stdout, out.stderr)
         return 1
     names = re.findall(r'^Print Assumptions (\S+)\.$', open(os.path.join(ROCQ, 'Assumptions.v')).read(), re.M)
-    lines = [l.strip() for l in out.stdout.splitlines() if l.strip()]
-    if len(lines) != len(names) or any(l != 'Closed under the global context' for l in lines):
+    # one block per theorem: closed, or the axioms it depends on, each named at the start of a line
+    blocks = []
+    for line in out.stdout.splitlines():
+        if line.startswith('Closed under the global context'):
+            blocks.append(None)
+        elif line.startswith('Axioms:'):
+            blocks.append([])
+        elif blocks and blocks[-1] is not None and re.match(r"^[A-Za-z_][\w.']* :", line):
+            blocks[-1].append(line.split(' :')[0])
+    # the theorems on real numbers use the axioms of the standard library's reals; the values evaluated by the interval
+    # tactic also the specifications of the primitive integers and floating-point numbers; all others none
+    reals = {'ClassicalDedekindReals.sig_forall_dec', 'ClassicalDedekindReals.sig_not_dec',
+             'FunctionalExtensionality.functional_extensionality_dep', 'Classical_Prop.classic'}
+    prim = ('Uint63Axioms.', 'Sint63Axioms.', 'FloatAxioms.', 'PrimInt63.', 'PrimFloat.', 'PrimArray.')
+    real_modules = ('Lower.', 'Margin.', 'Erfc.', 'Choose.', 'Noise.', 'Restore.', 'FlipLower.')
+    theorems = {}
+    if len(blocks) != len(names):
         print(out.stdout)
         return 1
+    for n, ax in zip(names, blocks):
+        if ax is None:
+            theorems[n] = 'closed'
+        elif n.startswith(real_modules) and set(ax) <= reals:
+            theorems[n] = 'reals'
+        elif n.startswith('NoiseNum.') and all(a in reals or a.startswith(prim) for a in ax):
+            theorems[n] = 'reals, primitive numbers'
+        else:
+            print(n, ax)
+            return 1
     host = host_extraction()
     stored = stored_extraction()
     images = pstar_images()
@@ -1167,7 +1192,7 @@ def main_rocq():
     files = [l for l in open(os.path.join(ROCQ, '_CoqProject')).read().split() if l.endswith('.v')]
     lines = sum(len(open(os.path.join(ROCQ, f)).read().splitlines()) for f in files)
     res = dict(rocq=version.splitlines()[0], files=len(files), lines=lines,
-               build_seconds=round(build, 1), theorems={n: 'closed' for n in names},
+               build_seconds=round(build, 1), theorems=theorems,
                host_extraction=host, stored_extraction=stored, pstar_images=images,
                extraction_identical=identical)
     rec = json.load(open(RECORD)) if os.path.exists(RECORD) else {}

src/twohead.py

@@ -891,7 +891,7 @@ def main_net():
         print(json.dumps(res, indent=1))
     elif cmd == 'lev':
         # the rows of Lev(N^alpha_{3,S,L}) for the window of the stored host, affine in S and L, and the noise
-        # a generation of the stored host survives with probability 0.999 by Proposition 5.5 and Theorem 5.9(ii)
+        # a generation of the stored host survives with probability 0.999 by Proposition 6.4 and Theorem 6.8(ii)
         t0 = time.time()
         run = json.load(open(STORED_RECORD))['run']
         alpha = (run['record_bits'] - 8) // 3
@@ -1750,7 +1750,7 @@ def census(tau):
 
 
 def passes(tau):
-    """The steps of P* on a recipe, Proposition 5.4."""
+    """The steps of P* on a recipe, Proposition 5.3."""
     lit, rep, flit, frep = census(tau)
     return 5 * flit + 4 * frep + 7 * lit + 9 * rep + 7 + 1 + 6 * len(tau) + 2