GBFPlus occupied cells, residual updates and honest histories
DefinitionGBFPlus_OccupancyDisclosureA configuration has cells, selected cells per insertion, positive prefix width and positive suffix width ; the full word width is , so . Words are pairs of bit-coordinate vectors over , with addition equal to XOR. Concatenation places the prefix coordinates first and suffix coordinates last. A snapshot maps each cell to either empty or an occupied word; an occupied zero remains occupied.
A row has a set of exactly distinct cells, an arbitrary prefix and an adjacent-domain identifier. An attempted insertion specifies the row, either an empty selected pivot or a request for failure, and arbitrary words for free cells. On success, previously occupied words are reused, other empty selected cells receive their free words, and the pivot receives the target word XOR the other selected words. Cells outside the selected set are unchanged. A failure request is admissible only when all selected cells are occupied and leaves the state unchanged.
An honest history starts from an empty array and consists of admissible attempts evaluated in order. The successful rows, in order, are derived from those attempts, including no failed attempts. Public recovery XORs exactly the occupied cells and returns the suffix. Its inputs are the snapshot and public configuration; it receives no row, prefix, identifier, history, secret or token. The model imposes no distribution on free words and does not model ledger access, authentication or timeout policy; those remain premises of the source's disclosure interpretation.
import Mathlib
namespace GBFPlus.OccupancyDisclosure
structure Config where
cells : ℕ
shares : ℕ
prefixBits : ℕ
suffixBits : ℕ
shares_pos : 1 ≤ shares
shares_le : shares ≤ cells
prefix_pos : 1 ≤ prefixBits
suffix_pos : 1 ≤ suffixBits
abbrev Word (C : Config) :=
(Fin C.prefixBits → ZMod 2) × (Fin C.suffixBits → ZMod 2)
abbrev Identifier (C : Config) := Fin C.suffixBits → ZMod 2
abbrev Snapshot (C : Config) := Fin C.cells → Option (Word C)
def wordBits {C : Config} (w : Word C) : Fin (C.prefixBits + C.suffixBits) → ZMod 2 :=
Fin.addCases w.1 w.2
def empty (C : Config) : Snapshot C := fun _ => none
structure Row (C : Config) where
support : Finset (Fin C.cells)
support_card : support.card = C.shares
hashPrefix : Fin C.prefixBits → ZMod 2
identifier : Identifier C
def Row.target {C : Config} (r : Row C) : Word C := (r.hashPrefix, r.identifier)
structure Attempt (C : Config) where
row : Row C
pivot : Option (Fin C.cells)
free : Fin C.cells → Word C
def admissible {C : Config} (A : Snapshot C) (e : Attempt C) : Prop :=
match e.pivot with
| none => ∀ i ∈ e.row.support, A i ≠ none
| some p => p ∈ e.row.support ∧ A p = none
instance {C : Config} (A : Snapshot C) : (e : Attempt C) → Decidable (admissible A e)
| ⟨r, none, _⟩ => inferInstanceAs (Decidable (∀ i ∈ r.support, A i ≠ none))
| ⟨r, some p, _⟩ => inferInstanceAs (Decidable (p ∈ r.support ∧ A p = none))
def fillWord {C : Config} (A : Snapshot C) (free : Fin C.cells → Word C)
(i : Fin C.cells) : Word C := (A i).getD (free i)
def insert {C : Config} (A : Snapshot C) (r : Row C) (p : Fin C.cells)
(free : Fin C.cells → Word C) : Snapshot C := fun i =>
if i ∈ r.support then
some (if i = p then r.target + ∑ j ∈ r.support.erase p, fillWord A free j
else fillWord A free i)
else A i
def step {C : Config} (A : Snapshot C) (e : Attempt C) : Snapshot C :=
match e.pivot with
| none => A
| some p => insert A e.row p e.free
def run {C : Config} (A : Snapshot C) : List (Attempt C) → Snapshot C
| [] => A
| e :: es => run (step A e) es
def Honest {C : Config} (A : Snapshot C) : List (Attempt C) → Prop
| [] => True
| e :: es => admissible A e ∧ Honest (step A e) es
def honestDecidable {C : Config} : (A : Snapshot C) → (es : List (Attempt C)) → Decidable (Honest A es)
| _, [] => isTrue trivial
| A, e :: es => @instDecidableAnd (admissible A e) (Honest (step A e) es)
inferInstance (honestDecidable (step A e) es)
instance {C : Config} (A : Snapshot C) (es : List (Attempt C)) : Decidable (Honest A es) := honestDecidable A es
def successful {C : Config} (es : List (Attempt C)) : List (Row C) :=
es.filterMap fun e => e.pivot.map fun _ => e.row
def finalSnapshot {C : Config} (es : List (Attempt C)) : Snapshot C := run (empty C) es
def occupied {C : Config} (A : Snapshot C) : Finset (Fin C.cells) :=
Finset.univ.filter fun i => (A i).isSome
def payload {C : Config} (A : Snapshot C) (i : Fin C.cells) : Word C := (A i).getD 0
def rowXor {C : Config} (A : Snapshot C) (r : Row C) : Word C :=
∑ i ∈ r.support, payload A i
def recover {C : Config} (A : Snapshot C) : Identifier C :=
(∑ i ∈ occupied A, payload A i).2
def supportUnion {C : Config} (rs : List (Row C)) : Finset (Fin C.cells) :=
rs.foldl (fun U r => U ∪ r.support) ∅
def identifierXor {C : Config} (rs : List (Row C)) : Identifier C :=
(rs.map Row.identifier).sum
end GBFPlus.OccupancyDisclosure
Read-back
What the Lean code literally says, in plain math · OpenAI Codex (exact model identifier unavailable)
Blind mathematical read-back
The declarations below are in the namespace GBFPlus.OccupancyDisclosure. In the mathematical notation used here, is the set of natural numbers strictly less than , , and is the set of all functions from to . Addition of such functions, and of pairs of such functions, is coordinatewise addition modulo two; zero denotes the corresponding all-zero function or pair. An optional value is either an absent value, written , or a present value, written ; in particular, and are distinct. Finite-set sums include each member once, list sums include each occurrence, and an empty sum is zero. Each paragraph renders one explicit declaration, with the two anonymous instance declarations identified by the propositions they decide.
Config. A configuration is a record of four natural numbers (cells), (shares), (prefixBits), and (suffixBits), together with witnesses of the four inequalities , , , and . Thus every configuration has and positive , and none of can be zero. These are all the fields and conditions in this record; no further relationship between the four numbers is imposed.
Word. For each configuration with natural parameters satisfying , , and , a word is an ordered pair in . Its first component assigns a residue modulo two to each of the prefix positions, and its second component assigns a residue modulo two to each of the suffix positions. Every such pair is a word, including the all-zero pair; there is no condition relating its two components to one another or to the cells or shares.
Identifier. For each configuration with natural parameters satisfying , , and , an identifier is any function . All -coordinate binary functions, including zero, are allowed. The type carries no additional property such as uniqueness or a relation to a prefix.
Snapshot. For each configuration with natural parameters satisfying , , and , a snapshot is any function . At each of the cells it specifies either or a present pair of binary functions of lengths and . Every assignment of these optional values is allowed, including an assignment with no present cells or with every cell present; a present zero word is distinct from an absent cell.
wordBits. For every configuration with natural parameters satisfying , , and , and every word , this function returns the binary function with when and when . Thus the first component occupies the first positions and the second component occupies the following positions. The subtraction occurs in the second case, where , so it gives an index in ; no sum of the two components is taken.
empty. For every configuration with natural parameters satisfying , , and , this is the snapshot defined by for every cell . Its domain has cells, all absent; its values are not present zero words.
Row. For each configuration with natural parameters satisfying , , and , a row is a record consisting of a finite set (support), a witness that (support_card), a function (hashPrefix), and a function (identifier). The support has exactly distinct members and is therefore nonempty. Apart from the cardinality condition, these fields are unrestricted: the two binary functions are not required to be computed from one another or from the support, and separate rows may have equal supports, equal prefixes, or equal identifiers.
Row.target. For every configuration with natural parameters satisfying , , and , and every row consisting of with , , and , its target word is exactly . The value uses the row's two binary functions and does not depend on which cells belong to its support.
Attempt. For each configuration with natural parameters satisfying , , and , an attempt is a record containing a row with , , , and ; an optional cell (pivot); and an arbitrary function (free). The pivot may be absent or may name any cell, whether or not that cell is in . The function is specified at every cell, including cells outside , and has no distributional, independence, or other restriction. The record itself has no snapshot argument and imposes no occupancy requirement.
admissible. For every configuration with natural parameters satisfying , , and , every optional-word assignment , and every attempt with row , , optional pivot, and arbitrary word function , this proposition has two cases. If the pivot is absent, it means that for every . If the pivot is , it means the conjunction and . In the latter case no condition is imposed on the other cells in , which may be present or absent. Neither case constrains , , or , and neither imposes a condition outside . Since , the universal condition in the absent-pivot case is not over an empty support; an absent-pivot attempt against the all-absent snapshot does not satisfy it.
Anonymous instance deciding admissible. For every configuration with natural parameters satisfying , , and , and every snapshot , this supplies, for each attempt with row support of cardinality , an explicit decision of its admissibility proposition: either evidence that the proposition holds or evidence that it does not. An absent pivot selects the decision of ; a present pivot selects the decision of . The row's prefix and identifier and the attempt's arbitrary word function do not enter these tests. This declares decidability for all attempts, including inadmissible ones; it does not assert that all attempts are admissible.
fillWord. For every configuration with natural parameters satisfying , , and , every snapshot where , every function , and every cell , this returns if and returns if . A present zero word returns zero rather than the fallback. No support, pivot, or admissibility condition is an argument or hypothesis.
insert. For every configuration with natural parameters satisfying , , and , let ; take any snapshot , any row with , any cell , and any function . Write if and if . The returned snapshot is defined at each by for , by for with , and by if . The sums and addition are coordinatewise modulo two, and all use the input snapshot . No assumption requires or : if , every cell of receives the nonpivot rule and the value at is unchanged; if and was already present, its value is overwritten by the displayed sum. Every cell of becomes present, even when its assigned word is zero. If , the sum is empty and the word assigned at is .
step. For every configuration with natural parameters satisfying , , and , every snapshot with , and every attempt consisting of a row with , an optional pivot, and a function , this returns unchanged if the pivot is absent. If the pivot is , define to be the present word at in , or if that cell is absent; the returned snapshot leaves cells outside unchanged, assigns at each , and, if , assigns at , with coordinatewise addition modulo two and an empty sum equal to zero. The operation requires no admissibility hypothesis and performs no admissibility test; it is defined for absent pivots when supported cells are absent and for present pivots outside the support or at already-present cells.
run. For every configuration with natural parameters satisfying , , and , every initial snapshot where , and every finite list of attempts, this returns the result of processing the list in order from its first element to its last. An attempt contains a support of size , a prefix , an identifier , an optional pivot, and a function . An absent pivot leaves the current snapshot unchanged. For a present pivot , let be the current word at when present and otherwise; the next snapshot leaves cells outside unchanged, stores at every nonpivot cell , and, if , stores at , where every stored value is marked present and all additions are coordinatewise modulo two. Processing the empty list returns the initial snapshot itself. Lists may repeat attempts, and no admissibility condition is imposed on the initial snapshot or any list entry.
Honest. For every configuration with natural parameters satisfying , , and , every initial snapshot where , and every finite list of attempts, this is the recursively defined proposition that each attempt meets its pivot condition in the snapshot reached immediately before it. For an attempt with row , , optional pivot, and word function , that condition is if the pivot is absent, and if the pivot is , using the current snapshot in place of . An absent pivot leaves that snapshot unchanged; for a present pivot , let be its current present word, or if absent, leave cells outside unchanged, store at cells of other than , and store at when , with coordinatewise addition modulo two and all newly stored values marked present. For a nonempty list, the proposition is the conjunction of the first attempt's condition and the same recursively defined proposition for the remaining list at this updated snapshot. For the empty list it is true for every initial snapshot. There is no requirement that the initial snapshot be all absent, and no restriction on the values of the word functions beyond their types.
honestDecidable. For every configuration with natural parameters satisfying , , and , this supplies a decision for every snapshot , , and every finite list of attempts, as to whether the following successive conditions hold. An attempt has row with , optional pivot, and word function ; an absent pivot requires every cell of currently present and makes no update, whereas a present pivot requires and its current cell absent. The update associated to a present pivot uses equal to the current present word or if absent, preserves cells outside , stores at each nonpivot supported cell, and, if , stores at , with coordinatewise addition modulo two and newly stored words marked present. The decision is affirmative for an empty list. For a nonempty list it combines the decision of the first pivot condition with the recursively obtained decision for the remaining list at the updated snapshot, deciding their conjunction. Its result is either evidence that all successive conditions hold or evidence that they do not; it makes no assertion that an arbitrary input list satisfies them.
Anonymous instance deciding Honest. For every configuration with natural parameters satisfying , , and , every snapshot with , and every finite list of attempts, this installs the recursively computed decision of the following property: at each attempt, with row of support size , optional pivot, and word function , an absent pivot has all supported cells currently present, while a present pivot belongs to and is currently absent. Snapshots evolve in list order by leaving them unchanged for absent pivots and, for present pivots, taking to be the current present word or the fallback , leaving cells outside unchanged, storing at each , and storing at if , where addition is coordinatewise modulo two and stored words are present. The empty list satisfies the property regardless of . The installed decision produces either evidence of this property or its negation for every input, and has no additional hypothesis beyond the specified types.
successful. For every configuration with natural parameters satisfying , , and , and every finite list of attempts, each having a row with , , , and , an optional cell pivot, and an arbitrary function , this returns the list of rows from precisely those attempts whose pivots are present. It keeps their original order and multiplicities, discards attempts with absent pivots, and discards the actual pivot values and word functions from the result. It has no snapshot argument and checks neither pivot membership in the support nor occupancy nor any successive admissibility condition. The input list may be empty, in which case the returned list is empty.
finalSnapshot. For every configuration with natural parameters satisfying , , and , and every finite list of attempts, this produces an optional-word assignment on by starting with at every cell and processing the attempts in list order. For each attempt with row , , optional pivot, and function where , an absent pivot leaves the current assignment unchanged. For a present pivot , let be the current present word at or if absent; the next assignment preserves cells outside , stores at cells of other than , and stores at if , with coordinatewise addition modulo two and all stored words marked present. The returned snapshot is the assignment after the last entry; for the empty list it is the all-absent assignment. No admissibility condition is assumed or tested, so the function also accepts lists containing pivots outside their supports or at already-present cells.
occupied. For every configuration with natural parameters satisfying , , and , and every snapshot , this is the finite set . Membership depends only on whether a word is present, so a cell containing a zero word belongs to this set. The set is empty for an all-absent snapshot and is for a snapshot with every cell present; it has no row or list argument.
payload. For every configuration with natural parameters satisfying , , and , every snapshot where , and every cell , this returns the word when and returns the all-zero word of when . Consequently an absent cell and a cell containing the zero word have the same returned payload, even though their optional snapshot values differ. There is no hypothesis that is occupied.
rowXor. For every configuration with natural parameters satisfying , , and , every snapshot with , and every row with , , , and , this returns , where is the word present at in , or the all-zero word if that cell is absent. The sum is coordinatewise modulo two and counts each supported cell once. The support is nonempty, but every summand may still be zero, including when all supported cells are absent. The row's prefix and identifier do not enter the expression, and no assertion equates this sum with .
recover. For every configuration with natural parameters satisfying , , and , and every snapshot where , this returns the suffix component of , where and is the present word at or zero if it is absent. Equivalently, the returned function is defined by , where for and each sum is modulo two. Each occupied cell is counted once; cells storing zero are included and contribute zero. If is empty, the result is the all-zero identifier. There is no input row, list of attempts, or admissibility hypothesis, and the definition asserts no relationship between this result and any prescribed identifier.
supportUnion. For every configuration with natural parameters satisfying , , and , and every finite list of rows , where each has cardinality , each , and each , this returns a finite set formed by starting with and defining for . Thus its value is . Empty lists give the empty set, repeated rows or overlapping supports do not create multiplicities, and the prefixes and identifiers are unused. Every individual support is nonempty; the union is nonempty when the list is nonempty.
identifierXor. For every configuration with natural parameters satisfying , , and , and every finite list of rows , where each has cardinality , each , and each , this returns the function defined by , with addition modulo two. Every row occurrence in the list contributes once, including repeated rows or repeated identifiers; an identifier repeated twice contributes zero from those two occurrences. The empty list returns the all-zero identifier. The row supports and prefixes do not enter this sum, and no uniqueness or disjointness hypothesis is required.
Confirmed by the mission captain (proposal self-audit).
Confirmed by the moderator at approval.