proofs
Proveddrift-lawdecodesamplingheadline-theorem

Norm-tiered exact decode, end-to-end: keys with ‖k‖ ≤ κ drift by at most ‖q_t − q_s‖κ, the exceptional-set envelope samples the current row exactly, expected draws ≤ e^{2‖q_t−q_s‖κ}

For all J∈Type⁡\htmlData{mx=1}{J \in \htmlData{mx=0}{\operatorname{Type}}}, d∈N\htmlData{mx=1}{d \in \htmlData{mx=0}{\mathbb{N}}}, k:J→Fin⁡ d→R\htmlData{mx=7}{k : \htmlData{mx=0}{J} \mathrel{\htmlData{mx=6}{\to}} \htmlData{mx=3}{\htmlData{mx=1}{\operatorname{Fin}}\,\htmlData{mx=2}{d}} \mathrel{\htmlData{mx=5}{\to}} \htmlData{mx=4}{\mathbb{R}}}, qs,qt:Fin⁡ d→R\htmlData{mx=5}{\mathit{qs}, \mathit{qt} : \htmlData{mx=2}{\htmlData{mx=0}{\operatorname{Fin}}\,\htmlData{mx=1}{d}} \mathrel{\htmlData{mx=4}{\to}} \htmlData{mx=3}{\mathbb{R}}}, O∈Finset⁡ J\htmlData{mx=3}{O \in \htmlData{mx=2}{\htmlData{mx=0}{\operatorname{Finset}}\,\htmlData{mx=1}{J}}}, κ,δ∈R\htmlData{mx=1}{\kappa, \delta \in \htmlData{mx=0}{\mathbb{R}}}, s,t:J→R\htmlData{mx=3}{s, t : \htmlData{mx=0}{J} \mathrel{\htmlData{mx=2}{\to}} \htmlData{mx=1}{\mathbb{R}}}, m:J→R\htmlData{mx=3}{m : \htmlData{mx=0}{J} \mathrel{\htmlData{mx=2}{\to}} \htmlData{mx=1}{\mathbb{R}}} and M,Zt,p∈R\htmlData{mx=1}{M, \mathit{Zt}, p \in \htmlData{mx=0}{\mathbb{R}}}, if 0≤κ0 \mathrel{\htmlData{mx=1}{\leq}} \htmlData{mx=0}{\kappa}, ∀j, j∉O  ⟹  ∑ik(j,i)2≤κ2\htmlData{mx=13}{\forall j,\ \htmlData{mx=0}{j} \mathrel{\htmlData{mx=2}{\notin}} \htmlData{mx=1}{O} \mathrel{\htmlData{mx=12}{\implies}} \htmlData{mx=8}{\sum_{i} \htmlData{mx=7}{\htmlData{mx=6}{\htmlData{mx=3}{k}(\htmlData{mx=4}{j}, \htmlData{mx=5}{i})}^{2}}} \mathrel{\htmlData{mx=11}{\leq}} \htmlData{mx=10}{\htmlData{mx=9}{\kappa}^{2}}}, δ=∑i(qt(i)−qs(i))2\htmlData{mx=0}{\delta} \mathrel{\htmlData{mx=11}{=}} \htmlData{mx=10}{\sqrt{\htmlData{mx=9}{\sum_{i} \htmlData{mx=8}{(\htmlData{mx=7}{\htmlData{mx=3}{\htmlData{mx=1}{\mathit{qt}}(\htmlData{mx=2}{i})} - \htmlData{mx=6}{\htmlData{mx=4}{\mathit{qs}}(\htmlData{mx=5}{i})}})^{2}}}}}, ∀j, s(j)=∑iqs(i)⋅k(j,i)\htmlData{mx=13}{\forall j,\ \htmlData{mx=2}{\htmlData{mx=0}{s}(\htmlData{mx=1}{j})} \mathrel{\htmlData{mx=12}{=}} \htmlData{mx=11}{\sum_{i} \htmlData{mx=10}{\htmlData{mx=5}{\htmlData{mx=3}{\mathit{qs}}(\htmlData{mx=4}{i})} \cdot \htmlData{mx=9}{\htmlData{mx=6}{k}(\htmlData{mx=7}{j}, \htmlData{mx=8}{i})}}}}, ∀j, t(j)=∑iqt(i)⋅k(j,i)\htmlData{mx=13}{\forall j,\ \htmlData{mx=2}{\htmlData{mx=0}{t}(\htmlData{mx=1}{j})} \mathrel{\htmlData{mx=12}{=}} \htmlData{mx=11}{\sum_{i} \htmlData{mx=10}{\htmlData{mx=5}{\htmlData{mx=3}{\mathit{qt}}(\htmlData{mx=4}{i})} \cdot \htmlData{mx=9}{\htmlData{mx=6}{k}(\htmlData{mx=7}{j}, \htmlData{mx=8}{i})}}}}, ∀j, m(j)={et(j)if j∈Oeδ⋅κ⋅es(j)otherwise\htmlData{mx=21}{\forall j,\ \htmlData{mx=2}{\htmlData{mx=0}{m}(\htmlData{mx=1}{j})} \mathrel{\htmlData{mx=20}{=}} \htmlData{mx=19}{\begin{cases} \htmlData{mx=6}{e^{\htmlData{mx=5}{\htmlData{mx=3}{t}(\htmlData{mx=4}{j})}}} & \text{if } \htmlData{mx=7}{j} \mathrel{\htmlData{mx=9}{\in}} \htmlData{mx=8}{O} \\ \htmlData{mx=18}{\htmlData{mx=13}{e^{\htmlData{mx=12}{\htmlData{mx=10}{\delta} \cdot \htmlData{mx=11}{\kappa}}}} \cdot \htmlData{mx=17}{e^{\htmlData{mx=16}{\htmlData{mx=14}{s}(\htmlData{mx=15}{j})}}}} & \text{otherwise} \end{cases}}}, M=∑jm(j)\htmlData{mx=0}{M} \mathrel{\htmlData{mx=5}{=}} \htmlData{mx=4}{\sum_{j} \htmlData{mx=3}{\htmlData{mx=1}{m}(\htmlData{mx=2}{j})}}, Zt=∑jet(j)\htmlData{mx=0}{\mathit{Zt}} \mathrel{\htmlData{mx=6}{=}} \htmlData{mx=5}{\sum_{j} \htmlData{mx=4}{e^{\htmlData{mx=3}{\htmlData{mx=1}{t}(\htmlData{mx=2}{j})}}}} and p=∑jm(j)M⋅(et(j)m(j))\htmlData{mx=0}{p} \mathrel{\htmlData{mx=16}{=}} \htmlData{mx=15}{\sum_{j} \htmlData{mx=14}{\htmlData{mx=5}{\frac{\htmlData{mx=3}{\htmlData{mx=1}{m}(\htmlData{mx=2}{j})}}{\htmlData{mx=4}{M}}} \cdot \left(\htmlData{mx=13}{\frac{\htmlData{mx=9}{e^{\htmlData{mx=8}{\htmlData{mx=6}{t}(\htmlData{mx=7}{j})}}}}{\htmlData{mx=12}{\htmlData{mx=10}{m}(\htmlData{mx=11}{j})}}}\right)}} (given Fintype⁡ J\htmlData{mx=2}{\htmlData{mx=0}{\operatorname{Fintype}}\,\htmlData{mx=1}{J}}, Nonempty⁡ J\htmlData{mx=2}{\htmlData{mx=0}{\operatorname{Nonempty}}\,\htmlData{mx=1}{J}} and DecidableEq⁡ J\htmlData{mx=2}{\htmlData{mx=0}{\operatorname{DecidableEq}}\,\htmlData{mx=1}{J}}), then

(∀j, j∉O  ⟹  ∣t(j)−s(j)∣≤δ⋅κ)∧(∀j, 0<m(j)∧et(j)≤m(j))∧p=ZtM∧(∀j, m(j)M⋅(et(j)m(j))p=et(j)Zt)∧(∑n∈N(n+1)⋅p⋅(1−p)n=MZt)∧MZt≤e2δ⋅κ\begin{aligned} & (\htmlData{mx=17}{\forall j,\ \htmlData{mx=1}{j} \mathrel{\htmlData{mx=3}{\notin}} \htmlData{mx=2}{O} \mathrel{\htmlData{mx=16}{\implies}} \htmlData{mx=11}{\left\lvert \htmlData{mx=10}{\htmlData{mx=6}{\htmlData{mx=4}{t}(\htmlData{mx=5}{j})} - \htmlData{mx=9}{\htmlData{mx=7}{s}(\htmlData{mx=8}{j})}} \right\rvert} \mathrel{\htmlData{mx=15}{\leq}} \htmlData{mx=14}{\htmlData{mx=12}{\delta} \cdot \htmlData{mx=13}{\kappa}}}) \\ & \htmlData{mx=0}{\land} (\htmlData{mx=31}{\forall j,\ 0 \mathrel{\htmlData{mx=21}{<}} \htmlData{mx=20}{\htmlData{mx=18}{m}(\htmlData{mx=19}{j})} \mathbin{\htmlData{mx=30}{\land}} \htmlData{mx=25}{e^{\htmlData{mx=24}{\htmlData{mx=22}{t}(\htmlData{mx=23}{j})}}} \mathrel{\htmlData{mx=29}{\leq}} \htmlData{mx=28}{\htmlData{mx=26}{m}(\htmlData{mx=27}{j})}}) \\ & \htmlData{mx=0}{\land} \htmlData{mx=32}{p} \mathrel{\htmlData{mx=36}{=}} \htmlData{mx=35}{\frac{\htmlData{mx=33}{\mathit{Zt}}}{\htmlData{mx=34}{M}}} \\ & \htmlData{mx=0}{\land} \left(\htmlData{mx=60}{\forall j,\ \htmlData{mx=52}{\frac{\htmlData{mx=50}{\htmlData{mx=41}{\frac{\htmlData{mx=39}{\htmlData{mx=37}{m}(\htmlData{mx=38}{j})}}{\htmlData{mx=40}{M}}} \cdot \left(\htmlData{mx=49}{\frac{\htmlData{mx=45}{e^{\htmlData{mx=44}{\htmlData{mx=42}{t}(\htmlData{mx=43}{j})}}}}{\htmlData{mx=48}{\htmlData{mx=46}{m}(\htmlData{mx=47}{j})}}}\right)}}{\htmlData{mx=51}{p}}} \mathrel{\htmlData{mx=59}{=}} \htmlData{mx=58}{\frac{\htmlData{mx=56}{e^{\htmlData{mx=55}{\htmlData{mx=53}{t}(\htmlData{mx=54}{j})}}}}{\htmlData{mx=57}{\mathit{Zt}}}}}\right) \\ & \htmlData{mx=0}{\land} \left(\htmlData{mx=72}{\sum_{n \in \htmlData{mx=61}{\mathbb{N}}} \htmlData{mx=71}{\htmlData{mx=66}{(\htmlData{mx=64}{\htmlData{mx=63}{\htmlData{mx=62}{n}} + 1}) \cdot \htmlData{mx=65}{p}} \cdot \htmlData{mx=70}{(\htmlData{mx=68}{1 - \htmlData{mx=67}{p}})^{\htmlData{mx=69}{n}}}}} \mathrel{\htmlData{mx=76}{=}} \htmlData{mx=75}{\frac{\htmlData{mx=73}{M}}{\htmlData{mx=74}{\mathit{Zt}}}}\right) \\ & \htmlData{mx=0}{\land} \htmlData{mx=79}{\frac{\htmlData{mx=77}{M}}{\htmlData{mx=78}{\mathit{Zt}}}} \mathrel{\htmlData{mx=85}{\leq}} \htmlData{mx=84}{e^{\htmlData{mx=83}{\htmlData{mx=81}{2\htmlData{mx=80}{\delta}} \cdot \htmlData{mx=82}{\kappa}}}} \end{aligned}
What the notation means · or point at any symbol
Type
Type: a definition from the library, not special notation. Its name is its meaning; open it in Lean to see how it is defined. (Type)
Fintype
Fintype: a definition from the library, not special notation. Its name is its meaning; open it in Lean to see how it is defined. (Fintype)
f(x)Function application
Fintype applied to J. Lean writes f x; papers write f(x). (Fintype J)
Nonempty
Nonempty: a definition from the library, not special notation. Its name is its meaning; open it in Lean to see how it is defined. (Nonempty)
DecidableEq
DecidableEq: a definition from the library, not special notation. Its name is its meaning; open it in Lean to see how it is defined. (DecidableEq)
NNatural numbers
The natural numbers 0, 1, 2, …. In Lean they start at 0. (ℕ)
x : TVariables
qs, qt range over Fin d → ℝ: the statement must hold for every choice. ((qs qt : Fin d → ℝ))
Finset
Finset: a definition from the library, not special notation. Its name is its meaning; open it in Lean to see how it is defined. (Finset)
x ∈ TVariables
κ, δ range over real numbers: the statement must hold for every choice. ((κ δ : ℝ))
≤At most
0 is less than or equal to κ. (0 ≤ κ)
∀For all
The statement after the comma holds for every j. (∀ j, j ∉ O → ∑ i, k j i ^ 2 ≤ κ ^ 2)
=Equality
δ and √(∑ i, (qt(i) − qs(i))^2) are the same. (δ = Real.sqrt (∑ i, (qt i - qs i) ^ 2))
Fin
Fin: a definition from the library, not special notation. Its name is its meaning; open it in Lean to see how it is defined. (Fin)
⟹Implies
If Fin(d), then ℝ. (Between types, A → B is the type of functions from A to B.) (Fin d → ℝ)
√Square root
The non-negative number whose square is ∑ i, (qt(i) − qs(i))^2. (Real.sqrt (∑ i, (qt i - qs i) ^ 2))
∉Not an element of
j is not a member of O. (j ∉ O)
a/bDivision
m(j) divided by M. In Lean, dividing by 0 gives 0. (m j / M)
{ a if c; b otherwiseCases (if … then … else)
exp(t(j)) when j ∈ O, and exp(δ · κ) · exp(s(j)) otherwise. (if j ∈ O then Real.exp (t j) else Real.…)
RReal numbers
The real numbers: every point on the number line. (ℝ)
∑Summation
Add up k(j, i)^2 for every i. (∑ i, k j i ^ 2)
∈Element of
j is a member of O. (j ∈ O)
|x|Absolute value
The size of t(j) − s(j) without its sign. (|t j - s j|)
·Multiplication
qs(i) times k(j, i). (qs i * k j i)
aᵇPower
k(j, i) raised to the power 2. (k j i ^ 2)
-Subtraction
qt(i) minus qs(i). On ℕ, Lean's subtraction stops at 0: 2 − 5 = 0. (qt i - qs i)
eˣExponential function
e raised to the power t(j), where e ≈ 2.718. (Real.exp (t j))
<Less than
0 is strictly smaller than m(j). (0 < m j)
∧And
Both hold: 0 < m(j), and exp(t(j)) ≤ m(j). (0 < m j ∧ Real.exp (t j) ≤ m j)
∑'Infinite sum
Add up (n + 1) · p · (1 − p)^n for every n in ℕ. (∑' n : ℕ, ((n : ℝ) + 1) * p * (1 - p) ^…)
(x : T)As real numbers
n read as an element of real numbers. Mathematicians leave this implicit; Lean needs it to know which kind of number is meant. ((n : ℝ))
+Addition
n plus 1. ((n : ℝ) + 1)

A complete, executable exact decode sampler with a query-oblivious exceptional set. Keys whose norm exceeds κ form the exceptional set O and are scored exactly; for every other key Cauchy–Schwarz certifies |t_j − s_j| ≤ δκ with δ = ‖q_t − q_s‖. The envelope m = e^{t} on O and e^{δκ}e^{s} off O dominates e^{t}; rejection from m/M accepts with probability Z_t/M, accepted keys follow the current row exactly, the expected draws per accepted sample are M/Z_t (geometric series), and M/Z_t ≤ e^{2δκ}. This answers the external review's objection that finding the exceptional set was unmodelled: here it depends on key norms only and is maintained under append. Costs not modelled: tree updates for the |O| exceptional paths and the refresh when δκ exceeds the drift budget. First-principles reformulation, 2026-10-05.

How it was proved

Proved
5 October 2026
By
Ajax, with the agent “Baguette math & proofs (Claude Code, 2026-10-03)”
Checked by
Lean's kernel (Lean 4.33.1, with Mathlib); the proof is signed and replays offline
Axioms
Classical.choice, Quot.sound, propext
Proof
79 lines of Lean
Sign in to see the proofThe proof, its signed report and its history.

More proved statements