# ProofNet-IR public API reference

<!-- Generated by ProofNetIRAPIDocs.lean. Do not edit by hand. -->

This reference is generated from the kernel-loaded Lean environment. The curated manifest records the supported public boundary; generation fails if a listed declaration disappears or becomes unsafe. Regenerate with `lake exe proofnet_ir_api_docs` and verify drift with `lake exe proofnet_ir_api_docs --check`.

## Core certificate model

### `ProofNetIR.Formula`

Kind: inductive type.

A formula of unit-free multiplicative linear logic (MLL).

```lean
ProofNetIR.Formula : Type
```

### `ProofNetIR.Link`

Kind: inductive type.

Local proof-net links. Formula occurrences are addressed by array index.

```lean
ProofNetIR.Link : Type
```

### `ProofNetIR.Certificate`

Kind: inductive type.

A cut-free proof-net certificate over an explicit formula-occurrence array.

```lean
ProofNetIR.Certificate : Type
```

### `ProofNetIR.Certificate.StructurallyWellFormed`

Kind: definition.

A Boolean-free structural specification for proof structures. The only
equalities here are mathematical cardinality/ownership conditions.

```lean
ProofNetIR.Certificate.StructurallyWellFormed : ProofNetIR.Certificate → Prop
```

### `ProofNetIR.Certificate.DeclarativelyCorrect`

Kind: definition.

Correctness quantified over the independent switching-choice relation.

```lean
ProofNetIR.Certificate.DeclarativelyCorrect : ProofNetIR.Certificate → Prop
```

## Checking

### `ProofNetIR.Certificate.wellFormed`

Kind: definition.

Executable structural validation before the switching criterion is run.

```lean
ProofNetIR.Certificate.wellFormed : ProofNetIR.Certificate → Bool
```

### `ProofNetIR.Certificate.check`

Kind: definition.

The kernel-executable ProofNet-IR checker.

```lean
ProofNetIR.Certificate.check : ProofNetIR.Certificate → Bool
```

### `ProofNetIR.Certificate.wellFormed_iff_structurallyWellFormed`

Kind: theorem.

The executable structural guard is exact for the independent proposition-
level ownership and boundary specification.

```lean
ProofNetIR.Certificate.wellFormed_iff_structurallyWellFormed : ∀ (certificate : ProofNetIR.Certificate), certificate.wellFormed = true ↔ certificate.StructurallyWellFormed
```

### `ProofNetIR.Certificate.check_iff_declarativelyCorrect`

Kind: theorem.

The executable reference checker is sound and complete for the independent
structural plus all-switchings-tree specification.

```lean
ProofNetIR.Certificate.check_iff_declarativelyCorrect : ∀ (certificate : ProofNetIR.Certificate), certificate.check = true ↔ certificate.DeclarativelyCorrect
```

## Finite graph semantics

### `ProofNetIR.Graph.Bounded`

Kind: definition.

Every stored edge names two distinct vertices of the finite graph.

```lean
ProofNetIR.Graph.Bounded : ProofNetIR.Graph → Prop
```

### `ProofNetIR.Graph.Bounded.retainEdges`

Kind: theorem.

Retaining an aligned subset of stored edge occurrences preserves finite
endpoint bounds and looplessness.

```lean
ProofNetIR.Graph.Bounded.retainEdges : ∀ {graph : ProofNetIR.Graph},
  graph.Bounded → ∀ {mask : List Bool}, graph.edges.length = mask.length → (graph.retainEdges mask).Bounded
```

### `ProofNetIR.Graph.Connected`

Kind: definition.

Connectedness stated independently using graph walks.

```lean
ProofNetIR.Graph.Connected : ProofNetIR.Graph → Prop
```

### `ProofNetIR.Graph.EdgeSimpleCycle`

Kind: inductive type.

A nonempty closed edge-aware walk with no repeated vertex except its
identified start/end. The exact edge indices allow two parallel stored edges
to form a genuine length-two multigraph cycle.

```lean
ProofNetIR.Graph.EdgeSimpleCycle : ProofNetIR.Graph → Type
```

### `ProofNetIR.Graph.DirectedEdge.ne_reverse`

Kind: theorem.

Reversing a directed occurrence always changes its orientation.

```lean
ProofNetIR.Graph.DirectedEdge.ne_reverse : ∀ {graph : ProofNetIR.Graph} (directed : graph.DirectedEdge), directed ≠ directed.reverse
```

### `ProofNetIR.Graph.EdgeSimplePath.exists_traversed_boundary_of_start_true`

Kind: theorem.

If a Boolean region contains the start of an exact simple path but omits
one of its visited vertices, the traversal crosses a concrete stored-edge
occurrence from the accepted region into the rejected region.  The statement
retains the directed occurrence, rather than collapsing the multigraph path
to an endpoint-only adjacency fact.

```lean
ProofNetIR.Graph.EdgeSimplePath.exists_traversed_boundary_of_start_true : ∀ {graph : ProofNetIR.Graph} (path : graph.EdgeSimplePath) (predicate : ProofNetIR.Vertex → Bool),
  predicate path.start = true →
    (∃ vertex, vertex ∈ path.vertices ∧ predicate vertex = false) →
      ∃ directed, directed ∈ path.traversed ∧ predicate directed.source = true ∧ predicate directed.target = false
```

### `ProofNetIR.Graph.EdgeSimplePath.exists_traversed_first_boundary_of_start_true`

Kind: theorem.

The first Boolean-region exit along an exact simple path retains the
complete traversal split and proves that every earlier traversed occurrence
has accepted endpoints.  This strengthens the bare boundary witness with the
active prefix needed by later component arguments.

```lean
ProofNetIR.Graph.EdgeSimplePath.exists_traversed_first_boundary_of_start_true : ∀ {graph : ProofNetIR.Graph} (path : graph.EdgeSimplePath) (predicate : ProofNetIR.Vertex → Bool),
  predicate path.start = true →
    (∃ vertex, vertex ∈ path.vertices ∧ predicate vertex = false) →
      ∃ before boundary after,
        path.traversed = before ++ boundary :: after ∧
          (∀ (directed : graph.DirectedEdge),
              directed ∈ before → predicate directed.source = true ∧ predicate directed.target = true) ∧
            predicate boundary.source = true ∧ predicate boundary.target = false
```

### `ProofNetIR.Graph.EdgeSimplePath.prefixBefore`

Kind: theorem.

The traversal strictly before a selected exact edge occurrence remains a
simple path ending at that occurrence's source.

```lean
ProofNetIR.Graph.EdgeSimplePath.prefixBefore : ∀ {graph : ProofNetIR.Graph} (path : graph.EdgeSimplePath) {before after : List graph.DirectedEdge}
  {first : graph.DirectedEdge},
  path.traversed = before ++ first :: after →
    ∃ initialPath, initialPath.start = path.start ∧ initialPath.finish = first.source ∧ initialPath.traversed = before
```

### `ProofNetIR.Graph.EdgeSimplePath.suffixAfter`

Kind: theorem.

The traversal strictly after a selected exact edge occurrence remains a
simple path beginning at that occurrence's target.

```lean
ProofNetIR.Graph.EdgeSimplePath.suffixAfter : ∀ {graph : ProofNetIR.Graph} (path : graph.EdgeSimplePath) {before after : List graph.DirectedEdge}
  {first : graph.DirectedEdge},
  path.traversed = before ++ first :: after →
    ∃ suffix,
      suffix.start = first.target ∧
        suffix.finish = path.finish ∧
          suffix.traversed = after ∧ ∀ (vertex : ProofNetIR.Vertex), vertex ∈ suffix.vertices → vertex ∈ path.vertices
```

### `ProofNetIR.Graph.EdgeSimplePath.uniqueIntersection_of_traversal_split`

Kind: theorem.

If a simple path traversal is partitioned into two simple subpaths with
the same initial vertex as the first piece, the two pieces can share only the
second piece's start.  This is the incidence-safe intersection fact needed
when a repeated vertex splits a larger walk into chord intervals.

```lean
ProofNetIR.Graph.EdgeSimplePath.uniqueIntersection_of_traversal_split : ∀ {graph : ProofNetIR.Graph} (path incoming outgoing : graph.EdgeSimplePath),
  path.start = incoming.start →
    path.traversed = incoming.traversed ++ outgoing.traversed →
      ∀ (vertex : ProofNetIR.Vertex), vertex ∈ incoming.vertices → vertex ∈ outgoing.vertices → vertex = outgoing.start
```

### `ProofNetIR.Graph.EdgeSimpleCycle.eq_of_index_eq`

Kind: theorem.

Within a simple cycle, an exact occurrence index identifies the unique
directed traversal value carrying it.

```lean
ProofNetIR.Graph.EdgeSimpleCycle.eq_of_index_eq : ∀ {graph : ProofNetIR.Graph} (cycle : graph.EdgeSimpleCycle) {first second : graph.DirectedEdge},
  first ∈ cycle.traversed → second ∈ cycle.traversed → first.index = second.index → first = second
```

### `ProofNetIR.Graph.retainEdgesByMask_lookup_exists_original`

Kind: theorem.

Every compacted retained-edge occurrence comes from a kept occurrence at
an exact original index. The retained-position equation preserves occurrence
identity even when equal-valued parallel edges are present.

```lean
ProofNetIR.Graph.retainEdgesByMask_lookup_exists_original : ∀ {edges : List ProofNetIR.Edge} {mask : List Bool},
  edges.length = mask.length →
    ∀ {retainedPosition : Nat} {edge : ProofNetIR.Edge},
      (ProofNetIR.Graph.retainEdgesByMask edges mask)[retainedPosition]? = some edge →
        ∃ originalIndex,
          edges[originalIndex]? = some edge ∧
            mask[originalIndex]? = some true ∧ ProofNetIR.Graph.retainedIndex mask originalIndex = retainedPosition
```

### `ProofNetIR.Graph.DirectedEdge.inflateRetained_exists`

Kind: theorem.

Invert one directed occurrence of a retained graph back to its exact kept
occurrence in the original graph. Source, target, and orientation are
preserved, while the compacted index is related by `retainedIndex`.

```lean
ProofNetIR.Graph.DirectedEdge.inflateRetained_exists : ∀ {graph : ProofNetIR.Graph} {mask : List Bool},
  graph.edges.length = mask.length →
    ∀ (directed : (graph.retainEdges mask).DirectedEdge),
      ∃ original,
        original.source = directed.source ∧
          original.target = directed.target ∧
            ProofNetIR.Graph.retainedIndex mask original.index = directed.index ∧ mask[original.index]? = some true
```

### `ProofNetIR.Graph.DirectedEdge.inflateRetained_exists_exact`

Kind: theorem.

Fully occurrence-exact inversion of one retained directed edge.  In
addition to endpoints and compacted index, the original stored edge value and
orientation are exposed explicitly for downstream colored-incidence proofs.

```lean
ProofNetIR.Graph.DirectedEdge.inflateRetained_exists_exact : ∀ {graph : ProofNetIR.Graph} {mask : List Bool},
  graph.edges.length = mask.length →
    ∀ (directed : (graph.retainEdges mask).DirectedEdge),
      ∃ original,
        original.edge = directed.edge ∧
          original.forward = directed.forward ∧
            original.source = directed.source ∧
              original.target = directed.target ∧
                ProofNetIR.Graph.retainedIndex mask original.index = directed.index ∧ mask[original.index]? = some true
```

### `ProofNetIR.Graph.EdgeWalk.inflateRetained`

Kind: theorem.

Lift an edge-aware walk in a masked subgraph back to exact kept
occurrences of the original graph. The compacted-index sequence and target
sequence are preserved pointwise.

```lean
ProofNetIR.Graph.EdgeWalk.inflateRetained : ∀ {graph : ProofNetIR.Graph} {mask : List Bool} {start finish : ProofNetIR.Vertex}
  {traversed : List (graph.retainEdges mask).DirectedEdge},
  (graph.retainEdges mask).EdgeWalk start traversed finish →
    graph.edges.length = mask.length →
      ∃ originalTraversal,
        graph.EdgeWalk start originalTraversal finish ∧
          List.map (fun directed => ProofNetIR.Graph.retainedIndex mask directed.index) originalTraversal =
              List.map ProofNetIR.Graph.DirectedEdge.index traversed ∧
            List.map ProofNetIR.Graph.DirectedEdge.target originalTraversal =
                List.map ProofNetIR.Graph.DirectedEdge.target traversed ∧
              ∀ (directed : graph.DirectedEdge), directed ∈ originalTraversal → mask[directed.index]? = some true
```

### `ProofNetIR.Graph.EdgeWalk.inflateRetainedExact`

Kind: theorem.

Lift a retained walk while preserving the exact stored edge value and
orientation at every list position.  The older `inflateRetained` theorem is
the compact endpoint/index API; this occurrence-exact variant is intended for
proofs whose local color or cusp argument must refer to the actual first or
last edge of the lifted traversal rather than to an independently selected
parallel occurrence.

```lean
ProofNetIR.Graph.EdgeWalk.inflateRetainedExact : ∀ {graph : ProofNetIR.Graph} {mask : List Bool} {start finish : ProofNetIR.Vertex}
  {traversed : List (graph.retainEdges mask).DirectedEdge},
  (graph.retainEdges mask).EdgeWalk start traversed finish →
    graph.edges.length = mask.length →
      ∃ originalTraversal,
        graph.EdgeWalk start originalTraversal finish ∧
          List.map (fun directed => ProofNetIR.Graph.retainedIndex mask directed.index) originalTraversal =
              List.map ProofNetIR.Graph.DirectedEdge.index traversed ∧
            List.map ProofNetIR.Graph.DirectedEdge.edge originalTraversal =
                List.map ProofNetIR.Graph.DirectedEdge.edge traversed ∧
              List.map ProofNetIR.Graph.DirectedEdge.forward originalTraversal =
                  List.map ProofNetIR.Graph.DirectedEdge.forward traversed ∧
                List.map ProofNetIR.Graph.DirectedEdge.target originalTraversal =
                    List.map ProofNetIR.Graph.DirectedEdge.target traversed ∧
                  ∀ (directed : graph.DirectedEdge), directed ∈ originalTraversal → mask[directed.index]? = some true
```

### `ProofNetIR.Graph.EdgeWalk.retainEdgesExact`

Kind: theorem.

Exact transport of a kept edge-aware walk through an occurrence mask.
Besides compacted indices and targets, this variant preserves the stored-edge
value and orientation sequence pointwise, which is enough to reflect exact
reverse pairs across the mask.

```lean
ProofNetIR.Graph.EdgeWalk.retainEdgesExact : ∀ {graph : ProofNetIR.Graph} {mask : List Bool} {start finish : ProofNetIR.Vertex}
  {traversed : List graph.DirectedEdge},
  graph.EdgeWalk start traversed finish →
    graph.edges.length = mask.length →
      (∀ (directed : graph.DirectedEdge), directed ∈ traversed → mask[directed.index]? = some true) →
        ∃ retainedTraversal,
          (graph.retainEdges mask).EdgeWalk start retainedTraversal finish ∧
            List.map ProofNetIR.Graph.DirectedEdge.index retainedTraversal =
                List.map (fun directed => ProofNetIR.Graph.retainedIndex mask directed.index) traversed ∧
              List.map ProofNetIR.Graph.DirectedEdge.edge retainedTraversal =
                  List.map ProofNetIR.Graph.DirectedEdge.edge traversed ∧
                List.map ProofNetIR.Graph.DirectedEdge.forward retainedTraversal =
                    List.map ProofNetIR.Graph.DirectedEdge.forward traversed ∧
                  List.map ProofNetIR.Graph.DirectedEdge.target retainedTraversal =
                    List.map ProofNetIR.Graph.DirectedEdge.target traversed
```

### `ProofNetIR.Graph.EdgeWalk.source_mem_targets_of_closed`

Kind: theorem.

In a nonempty closed exact-occurrence walk, the source of every traversed
edge also occurs as a target somewhere in the cyclic traversal.  For an edge
leaving the chosen list base, the final edge supplies that target occurrence.

```lean
ProofNetIR.Graph.EdgeWalk.source_mem_targets_of_closed : ∀ {graph : ProofNetIR.Graph} {base : ProofNetIR.Vertex} {traversed : List graph.DirectedEdge},
  graph.EdgeWalk base traversed base →
    traversed ≠ [] →
      ∀ {directed : graph.DirectedEdge},
        directed ∈ traversed → directed.source ∈ List.map ProofNetIR.Graph.DirectedEdge.target traversed
```

### `ProofNetIR.Graph.EdgeWalk.NoImmediateReverse`

Kind: definition.

No two consecutive entries traverse the same stored edge occurrence in
opposite directions.  This is deliberately a property of the exact directed
occurrence list, not merely of its endpoint sequence.

```lean
ProofNetIR.Graph.EdgeWalk.NoImmediateReverse : {graph : ProofNetIR.Graph} → List graph.DirectedEdge → Prop
```

### `ProofNetIR.Graph.EdgeWalk.NoImmediateReverse.of_map_nodup`

Kind: theorem.

Duplicate-freedom under any reversal-invariant occurrence key excludes an
immediate reversal.  The key can be the original edge index or a retained-mask
position, so the lemma remains useful while lifting exact masked traversals.

```lean
ProofNetIR.Graph.EdgeWalk.NoImmediateReverse.of_map_nodup : ∀ {graph : ProofNetIR.Graph} {α : Type} (key : graph.DirectedEdge → α),
  (∀ (directed : graph.DirectedEdge), key directed.reverse = key directed) →
    ∀ {traversed : List graph.DirectedEdge},
      (List.map key traversed).Nodup → ProofNetIR.Graph.EdgeWalk.NoImmediateReverse traversed
```

### `ProofNetIR.Graph.EdgeWalk.NoImmediateReverse.of_constant_forward`

Kind: theorem.

A traversal whose entries all have the same orientation cannot immediately
reverse an occurrence, because reversal flips that orientation.

```lean
ProofNetIR.Graph.EdgeWalk.NoImmediateReverse.of_constant_forward : ∀ {graph : ProofNetIR.Graph} {forward : Bool} {traversed : List graph.DirectedEdge},
  (∀ (directed : graph.DirectedEdge), directed ∈ traversed → directed.forward = forward) →
    ProofNetIR.Graph.EdgeWalk.NoImmediateReverse traversed
```

### `ProofNetIR.Graph.EdgeWalk.NoImmediateReverse.append`

Kind: theorem.

Concatenating two nonbacktracking exact traversals is nonbacktracking when
their unique junction, if both sides are nonempty, is not an immediate
reversal.

```lean
ProofNetIR.Graph.EdgeWalk.NoImmediateReverse.append : ∀ {graph : ProofNetIR.Graph} {first second : List graph.DirectedEdge},
  ProofNetIR.Graph.EdgeWalk.NoImmediateReverse first →
    ProofNetIR.Graph.EdgeWalk.NoImmediateReverse second →
      (∀ (incoming outgoing : graph.DirectedEdge),
          first.getLast? = some incoming → second.head? = some outgoing → outgoing ≠ incoming.reverse) →
        ProofNetIR.Graph.EdgeWalk.NoImmediateReverse (first ++ second)
```

### `ProofNetIR.Graph.EdgeWalk.NoImmediateReverse.suffix`

Kind: theorem.

Removing any list prefix preserves exact-occurrence nonbacktracking.

```lean
ProofNetIR.Graph.EdgeWalk.NoImmediateReverse.suffix : ∀ {graph : ProofNetIR.Graph} {initial traversed : List graph.DirectedEdge},
  ProofNetIR.Graph.EdgeWalk.NoImmediateReverse (initial ++ traversed) →
    ProofNetIR.Graph.EdgeWalk.NoImmediateReverse traversed
```

### `ProofNetIR.Graph.EdgeWalk.NoImmediateReverse.of_masked_alignment`

Kind: theorem.

Pointwise compacted-index and orientation preservation reflects
nonbacktracking from an original kept traversal to its masked traversal.  The
kept-position injectivity theorem prevents two distinct parallel occurrences
from being conflated.

```lean
ProofNetIR.Graph.EdgeWalk.NoImmediateReverse.of_masked_alignment : ∀ {graph : ProofNetIR.Graph} {mask : List Bool} {original : List graph.DirectedEdge}
  {retained : List (graph.retainEdges mask).DirectedEdge},
  (∀ (directed : graph.DirectedEdge), directed ∈ original → mask[directed.index]? = some true) →
    List.map ProofNetIR.Graph.DirectedEdge.index retained =
        List.map (fun directed => ProofNetIR.Graph.retainedIndex mask directed.index) original →
      List.map ProofNetIR.Graph.DirectedEdge.forward retained =
          List.map ProofNetIR.Graph.DirectedEdge.forward original →
        ProofNetIR.Graph.EdgeWalk.NoImmediateReverse original → ProofNetIR.Graph.EdgeWalk.NoImmediateReverse retained
```

### `ProofNetIR.Graph.EdgeWalk.NoImmediateReverse.reduced_or_cancel`

Kind: theorem.

Every exact traversal is either already nonbacktracking or contains an
adjacent occurrence followed by its exact reverse.  The decomposition is by
stored occurrence, not by endpoint equality.

```lean
ProofNetIR.Graph.EdgeWalk.NoImmediateReverse.reduced_or_cancel : ∀ {graph : ProofNetIR.Graph} (traversed : List graph.DirectedEdge),
  ProofNetIR.Graph.EdgeWalk.NoImmediateReverse traversed ∨
    ∃ before incoming after, traversed = before ++ incoming :: incoming.reverse :: after
```

### `ProofNetIR.Graph.EdgeWalk.NoImmediateReverse.not_cancel`

Kind: theorem.

A traversal already known to have no immediate exact reversal cannot be
presented with an adjacent occurrence/reverse pair.

```lean
ProofNetIR.Graph.EdgeWalk.NoImmediateReverse.not_cancel : ∀ {graph : ProofNetIR.Graph} {traversed : List graph.DirectedEdge},
  ProofNetIR.Graph.EdgeWalk.NoImmediateReverse traversed →
    ∀ {before after : List graph.DirectedEdge} {incoming : graph.DirectedEdge},
      traversed = before ++ incoming :: incoming.reverse :: after → False
```

### `ProofNetIR.Graph.EdgeWalk.NoImmediateReverse.junction_reverse_of_append_cancel`

Kind: theorem.

If two individually nonbacktracking traversals concatenate to a list with
an exact adjacent cancellation, that cancellation must cross their unique
junction.  This is the list-level bridge used to localize an empty cyclic
normalization to a boundary between scheduler dependency segments.

```lean
ProofNetIR.Graph.EdgeWalk.NoImmediateReverse.junction_reverse_of_append_cancel : ∀ {graph : ProofNetIR.Graph} {first second : List graph.DirectedEdge},
  ProofNetIR.Graph.EdgeWalk.NoImmediateReverse first →
    ProofNetIR.Graph.EdgeWalk.NoImmediateReverse second →
      ∀ {before after : List graph.DirectedEdge} {incoming : graph.DirectedEdge},
        first ++ second = before ++ incoming :: incoming.reverse :: after →
          ∃ firstLast secondHead,
            first.getLast? = some firstLast ∧ second.head? = some secondHead ∧ secondHead = firstLast.reverse
```

### `ProofNetIR.Graph.EdgeWalk.NoImmediateReverse.junction_reverse_of_flatten_cancel`

Kind: theorem.

If the flattening of a finite family of nonempty, individually
nonbacktracking traversals contains an adjacent exact cancellation, then some
two adjacent family members meet in that exact reverse orientation.  The
returned family decomposition retains the precise junction rather than only
the flattened list position.

```lean
ProofNetIR.Graph.EdgeWalk.NoImmediateReverse.junction_reverse_of_flatten_cancel : ∀ {graph : ProofNetIR.Graph} {segments : List (List graph.DirectedEdge)},
  (∀ (segment : List graph.DirectedEdge), segment ∈ segments → segment ≠ []) →
    (∀ (segment : List graph.DirectedEdge), segment ∈ segments → ProofNetIR.Graph.EdgeWalk.NoImmediateReverse segment) →
      ∀ {before after : List graph.DirectedEdge} {incoming : graph.DirectedEdge},
        segments.flatten = before ++ incoming :: incoming.reverse :: after →
          ∃ familyBefore first second familyAfter firstLast secondHead,
            segments = familyBefore ++ first :: second :: familyAfter ∧
              first.getLast? = some firstLast ∧ second.head? = some secondHead ∧ secondHead = firstLast.reverse
```

### `ProofNetIR.Graph.EdgeWalk.cancelImmediateReverse`

Kind: theorem.

Cancel one adjacent traversal of an exact stored occurrence followed by
its reverse.  The endpoints and every remaining occurrence are preserved; in
particular, endpoint-equal parallel edges cannot be cancelled by this lemma.

```lean
ProofNetIR.Graph.EdgeWalk.cancelImmediateReverse : ∀ {graph : ProofNetIR.Graph} {start finish : ProofNetIR.Vertex} {before after : List graph.DirectedEdge}
  {incoming : graph.DirectedEdge},
  graph.EdgeWalk start (before ++ incoming :: incoming.reverse :: after) finish →
    graph.EdgeWalk start (before ++ after) finish
```

### `ProofNetIR.Graph.EdgeWalk.ImmediateReverseReduction`

Kind: inductive type.

One exact adjacent reverse-pair deletion.

```lean
ProofNetIR.Graph.EdgeWalk.ImmediateReverseReduction : {graph : ProofNetIR.Graph} → List graph.DirectedEdge → List graph.DirectedEdge → Prop
```

### `ProofNetIR.Graph.EdgeWalk.ImmediateReverseReduction.length_lt`

Kind: theorem.

Every exact reverse-pair deletion strictly shortens the traversal by two
entries.

```lean
ProofNetIR.Graph.EdgeWalk.ImmediateReverseReduction.length_lt : ∀ {graph : ProofNetIR.Graph} {before after : List graph.DirectedEdge},
  ProofNetIR.Graph.EdgeWalk.ImmediateReverseReduction before after → after.length < before.length
```

### `ProofNetIR.Graph.EdgeWalk.ImmediateReverseReduction.preservesWalk`

Kind: theorem.

One exact reverse-pair deletion preserves a valid walk's endpoints.

```lean
ProofNetIR.Graph.EdgeWalk.ImmediateReverseReduction.preservesWalk : ∀ {graph : ProofNetIR.Graph} {before after : List graph.DirectedEdge},
  ProofNetIR.Graph.EdgeWalk.ImmediateReverseReduction before after →
    ∀ {start finish : ProofNetIR.Vertex}, graph.EdgeWalk start before finish → graph.EdgeWalk start after finish
```

### `ProofNetIR.Graph.EdgeWalk.ImmediateReverseReduction.membership_subset`

Kind: theorem.

One deletion cannot introduce an occurrence that was absent from the
source traversal.

```lean
ProofNetIR.Graph.EdgeWalk.ImmediateReverseReduction.membership_subset : ∀ {graph : ProofNetIR.Graph} {before after : List graph.DirectedEdge},
  ProofNetIR.Graph.EdgeWalk.ImmediateReverseReduction before after →
    ∀ (directed : graph.DirectedEdge), directed ∈ after → directed ∈ before
```

### `ProofNetIR.Graph.EdgeWalk.ImmediateReverseReduction.survives_or_reverse_mem`

Kind: theorem.

For each directed-edge value in the source, either that value survives one
exact reverse-pair reduction or its exact reverse value occurs in the source.
This is a membership statement, not a multiplicity-preserving pairing.

```lean
ProofNetIR.Graph.EdgeWalk.ImmediateReverseReduction.survives_or_reverse_mem : ∀ {graph : ProofNetIR.Graph} {before after : List graph.DirectedEdge},
  ProofNetIR.Graph.EdgeWalk.ImmediateReverseReduction before after →
    ∀ (directed : graph.DirectedEdge), directed ∈ before → directed ∈ after ∨ directed.reverse ∈ before
```

### `ProofNetIR.Graph.EdgeWalk.ImmediateReverseNormalization`

Kind: inductive type.

Reflexive-transitive normalization by exact adjacent reverse-pair
deletions.  The relation records every deleted stored occurrence.

```lean
ProofNetIR.Graph.EdgeWalk.ImmediateReverseNormalization : {graph : ProofNetIR.Graph} → List graph.DirectedEdge → List graph.DirectedEdge → Prop
```

### `ProofNetIR.Graph.EdgeWalk.ImmediateReverseNormalization.preservesWalk`

Kind: theorem.

Iterated exact reverse-pair deletion preserves a valid walk's endpoints.

```lean
ProofNetIR.Graph.EdgeWalk.ImmediateReverseNormalization.preservesWalk : ∀ {graph : ProofNetIR.Graph} {before after : List graph.DirectedEdge},
  ProofNetIR.Graph.EdgeWalk.ImmediateReverseNormalization before after →
    ∀ {start finish : ProofNetIR.Vertex}, graph.EdgeWalk start before finish → graph.EdgeWalk start after finish
```

### `ProofNetIR.Graph.EdgeWalk.ImmediateReverseNormalization.membership_subset`

Kind: theorem.

Iterated deletion cannot introduce an occurrence that was absent from the
original traversal.

```lean
ProofNetIR.Graph.EdgeWalk.ImmediateReverseNormalization.membership_subset : ∀ {graph : ProofNetIR.Graph} {before after : List graph.DirectedEdge},
  ProofNetIR.Graph.EdgeWalk.ImmediateReverseNormalization before after →
    ∀ (directed : graph.DirectedEdge), directed ∈ after → directed ∈ before
```

### `ProofNetIR.Graph.EdgeWalk.ImmediateReverseNormalization.length_le`

Kind: theorem.

Iterated deletion never increases traversal length.

```lean
ProofNetIR.Graph.EdgeWalk.ImmediateReverseNormalization.length_le : ∀ {graph : ProofNetIR.Graph} {before after : List graph.DirectedEdge},
  ProofNetIR.Graph.EdgeWalk.ImmediateReverseNormalization before after → after.length ≤ before.length
```

### `ProofNetIR.Graph.EdgeWalk.ImmediateReverseNormalization.survives_or_reverse_mem`

Kind: theorem.

During iterated reduction, each original directed-edge value either
survives or has its exact reverse value in the original traversal. This is a
membership statement, not a multiplicity-preserving pairing.

```lean
ProofNetIR.Graph.EdgeWalk.ImmediateReverseNormalization.survives_or_reverse_mem : ∀ {graph : ProofNetIR.Graph} {before after : List graph.DirectedEdge},
  ProofNetIR.Graph.EdgeWalk.ImmediateReverseNormalization before after →
    ∀ (directed : graph.DirectedEdge), directed ∈ before → directed ∈ after ∨ directed.reverse ∈ before
```

### `ProofNetIR.Graph.EdgeWalk.ImmediateReverseNormalization.reverse_mem_of_normalizes_to_nil`

Kind: theorem.

If exact internal cancellation reduces a traversal to empty, the reverse
of every directed-edge value represented in the source also occurs in the
source. This theorem does not assert a bijection between list positions.

```lean
ProofNetIR.Graph.EdgeWalk.ImmediateReverseNormalization.reverse_mem_of_normalizes_to_nil : ∀ {graph : ProofNetIR.Graph} {before after : List graph.DirectedEdge},
  ProofNetIR.Graph.EdgeWalk.ImmediateReverseNormalization before after →
    after = [] → ∀ (directed : graph.DirectedEdge), directed ∈ before → directed.reverse ∈ before
```

### `ProofNetIR.Graph.EdgeWalk.ImmediateReverseNormalization.eq_of_noImmediateReverse`

Kind: theorem.

Exact internal normalization is the identity on a traversal which already
has no adjacent occurrence/reverse pair.

```lean
ProofNetIR.Graph.EdgeWalk.ImmediateReverseNormalization.eq_of_noImmediateReverse : ∀ {graph : ProofNetIR.Graph} {before after : List graph.DirectedEdge},
  ProofNetIR.Graph.EdgeWalk.ImmediateReverseNormalization before after →
    ProofNetIR.Graph.EdgeWalk.NoImmediateReverse before → after = before
```

### `ProofNetIR.Graph.EdgeWalk.normalizeImmediateReversals`

Kind: theorem.

Every finite exact-occurrence walk normalizes to a walk with the same
endpoints and no adjacent occurrence/reverse pair.  The theorem deliberately
does not claim that a nonempty input has a nonempty normal form: an out-and-
back tree walk can normalize to the empty traversal.

```lean
ProofNetIR.Graph.EdgeWalk.normalizeImmediateReversals : ∀ {graph : ProofNetIR.Graph} {start finish : ProofNetIR.Vertex} (traversed : List graph.DirectedEdge),
  graph.EdgeWalk start traversed finish →
    ∃ reduced,
      ProofNetIR.Graph.EdgeWalk.ImmediateReverseNormalization traversed reduced ∧
        graph.EdgeWalk start reduced finish ∧ ProofNetIR.Graph.EdgeWalk.NoImmediateReverse reduced
```

### `ProofNetIR.Graph.EdgeWalk.rotateFirstClosed`

Kind: theorem.

Rotate the first exact occurrence of a closed walk to the end.  The
result is closed at the old first edge's target and retains exactly the same
directed occurrences in cyclic order.

```lean
ProofNetIR.Graph.EdgeWalk.rotateFirstClosed : ∀ {graph : ProofNetIR.Graph} {base : ProofNetIR.Vertex} {first : graph.DirectedEdge} {rest : List graph.DirectedEdge},
  graph.EdgeWalk base (first :: rest) base → graph.EdgeWalk first.target (rest ++ [first]) first.target
```

### `ProofNetIR.Graph.EdgeWalk.CyclicNoImmediateReverse`

Kind: definition.

A cyclic traversal has no immediate exact-occurrence reversal either
inside its list representation or across its closing last/first junction.

```lean
ProofNetIR.Graph.EdgeWalk.CyclicNoImmediateReverse : {graph : ProofNetIR.Graph} → List graph.DirectedEdge → Prop
```

### `ProofNetIR.Graph.EdgeWalk.CyclicImmediateReverseSite`

Kind: definition.

An exact cyclic cancellation site is either an adjacent occurrence/reverse
pair inside the chosen list representation or an exact reverse pair across the
last/first closing junction.

```lean
ProofNetIR.Graph.EdgeWalk.CyclicImmediateReverseSite : {graph : ProofNetIR.Graph} → List graph.DirectedEdge → Prop
```

### `ProofNetIR.Graph.EdgeWalk.CyclicSegmentJunctionReverse`

Kind: definition.

A cyclic reverse junction in a segmented traversal is either between two
adjacent family members or between the final and initial family members.  The
singleton case is intentionally allowed in the closing alternative.

```lean
ProofNetIR.Graph.EdgeWalk.CyclicSegmentJunctionReverse : {graph : ProofNetIR.Graph} → List (List graph.DirectedEdge) → Prop
```

### `ProofNetIR.Graph.EdgeWalk.cyclicNoImmediateReverse_or_site`

Kind: theorem.

Every finite exact traversal is either cyclically nonbacktracking or
exposes an exact internal or closing cancellation site.

```lean
ProofNetIR.Graph.EdgeWalk.cyclicNoImmediateReverse_or_site : ∀ {graph : ProofNetIR.Graph} (traversed : List graph.DirectedEdge),
  ProofNetIR.Graph.EdgeWalk.CyclicNoImmediateReverse traversed ∨
    ProofNetIR.Graph.EdgeWalk.CyclicImmediateReverseSite traversed
```

### `ProofNetIR.Graph.EdgeWalk.CyclicImmediateReverseSite.segmentJunction_of_flatten`

Kind: theorem.

A cancellation site in the flattening of a nonempty family of nonempty,
individually nonbacktracking traversals localizes to an exact adjacent or
cyclic family junction.

```lean
ProofNetIR.Graph.EdgeWalk.CyclicImmediateReverseSite.segmentJunction_of_flatten : ∀ {graph : ProofNetIR.Graph} {segments : List (List graph.DirectedEdge)},
  segments ≠ [] →
    (∀ (segment : List graph.DirectedEdge), segment ∈ segments → segment ≠ []) →
      (∀ (segment : List graph.DirectedEdge),
          segment ∈ segments → ProofNetIR.Graph.EdgeWalk.NoImmediateReverse segment) →
        ProofNetIR.Graph.EdgeWalk.CyclicImmediateReverseSite segments.flatten →
          ProofNetIR.Graph.EdgeWalk.CyclicSegmentJunctionReverse segments
```

### `ProofNetIR.Graph.EdgeWalk.CyclicNoImmediateReverse.of_masked_alignment`

Kind: theorem.

Pointwise compacted-index and orientation preservation reflects cyclic
nonbacktracking from a nonempty original kept traversal to its masked
traversal, including the last/first junction.

```lean
ProofNetIR.Graph.EdgeWalk.CyclicNoImmediateReverse.of_masked_alignment : ∀ {graph : ProofNetIR.Graph} {mask : List Bool} {original : List graph.DirectedEdge}
  {retained : List (graph.retainEdges mask).DirectedEdge},
  original ≠ [] →
    (∀ (directed : graph.DirectedEdge), directed ∈ original → mask[directed.index]? = some true) →
      List.map ProofNetIR.Graph.DirectedEdge.index retained =
          List.map (fun directed => ProofNetIR.Graph.retainedIndex mask directed.index) original →
        List.map ProofNetIR.Graph.DirectedEdge.forward retained =
            List.map ProofNetIR.Graph.DirectedEdge.forward original →
          ProofNetIR.Graph.EdgeWalk.CyclicNoImmediateReverse original →
            ProofNetIR.Graph.EdgeWalk.CyclicNoImmediateReverse retained
```

### `ProofNetIR.Graph.EdgeWalk.retainEdgesCyclicNoImmediateReverse`

Kind: theorem.

Transport a nonempty closed cyclically nonbacktracking walk through an
occurrence mask when every traversed occurrence is retained.  Exact compacted
indices and orientations ensure that neither internal nor closing reverse
pairs can be hidden by masking, including in graphs with parallel equal-valued
edges.

```lean
ProofNetIR.Graph.EdgeWalk.retainEdgesCyclicNoImmediateReverse : ∀ {graph : ProofNetIR.Graph} {mask : List Bool} {base : ProofNetIR.Vertex} {traversed : List graph.DirectedEdge},
  graph.EdgeWalk base traversed base →
    graph.edges.length = mask.length →
      traversed ≠ [] →
        (∀ (directed : graph.DirectedEdge), directed ∈ traversed → mask[directed.index]? = some true) →
          ProofNetIR.Graph.EdgeWalk.CyclicNoImmediateReverse traversed →
            ∃ retainedTraversal,
              retainedTraversal ≠ [] ∧
                (graph.retainEdges mask).EdgeWalk base retainedTraversal base ∧
                  ProofNetIR.Graph.EdgeWalk.CyclicNoImmediateReverse retainedTraversal
```

### `ProofNetIR.Graph.EdgeWalk.CyclicImmediateReverseNormalization`

Kind: inductive type.

Proof-relevant cyclic normalization. `finish` records the final internal
normalization pass. `closing` records an internally normalized outer
occurrence/reverse pair, removes that cyclic pair by rotation, and retains the
nested trace for the enclosed middle traversal.

```lean
ProofNetIR.Graph.EdgeWalk.CyclicImmediateReverseNormalization : {graph : ProofNetIR.Graph} → List graph.DirectedEdge → List graph.DirectedEdge → Prop
```

### `ProofNetIR.Graph.EdgeWalk.CyclicImmediateReverseNormalization.membership_subset`

Kind: theorem.

Cyclic normalization cannot introduce an occurrence absent from its
original traversal.

```lean
ProofNetIR.Graph.EdgeWalk.CyclicImmediateReverseNormalization.membership_subset : ∀ {graph : ProofNetIR.Graph} {before after : List graph.DirectedEdge},
  ProofNetIR.Graph.EdgeWalk.CyclicImmediateReverseNormalization before after →
    ∀ (directed : graph.DirectedEdge), directed ∈ after → directed ∈ before
```

### `ProofNetIR.Graph.EdgeWalk.CyclicImmediateReverseNormalization.survives_or_reverse_mem`

Kind: theorem.

During proof-relevant cyclic normalization, each original directed-edge
value either survives or has its exact reverse value in the original
traversal. This is a membership statement, not a multiplicity-preserving
pairing.

```lean
ProofNetIR.Graph.EdgeWalk.CyclicImmediateReverseNormalization.survives_or_reverse_mem : ∀ {graph : ProofNetIR.Graph} {before after : List graph.DirectedEdge},
  ProofNetIR.Graph.EdgeWalk.CyclicImmediateReverseNormalization before after →
    ∀ (directed : graph.DirectedEdge), directed ∈ before → directed ∈ after ∨ directed.reverse ∈ before
```

### `ProofNetIR.Graph.EdgeWalk.CyclicImmediateReverseNormalization.reverse_mem_of_normalizes_to_nil`

Kind: theorem.

If cyclic normalization ends empty, the reverse of every directed-edge
value represented in the original traversal also occurs there, at the same
stored edge index. This theorem does not assert a bijection between list
positions.

```lean
ProofNetIR.Graph.EdgeWalk.CyclicImmediateReverseNormalization.reverse_mem_of_normalizes_to_nil : ∀ {graph : ProofNetIR.Graph} {before after : List graph.DirectedEdge},
  ProofNetIR.Graph.EdgeWalk.CyclicImmediateReverseNormalization before after →
    after = [] → ∀ (directed : graph.DirectedEdge), directed ∈ before → directed.reverse ∈ before
```

### `ProofNetIR.Graph.EdgeWalk.CyclicImmediateReverseNormalization.eq_of_cyclicNoImmediateReverse`

Kind: theorem.

Proof-relevant cyclic normalization is the identity on a traversal which
already has neither an internal nor a closing exact reversal.

```lean
ProofNetIR.Graph.EdgeWalk.CyclicImmediateReverseNormalization.eq_of_cyclicNoImmediateReverse : ∀ {graph : ProofNetIR.Graph} {before after : List graph.DirectedEdge},
  ProofNetIR.Graph.EdgeWalk.CyclicImmediateReverseNormalization before after →
    ProofNetIR.Graph.EdgeWalk.CyclicNoImmediateReverse before → after = before
```

### `ProofNetIR.Graph.EdgeWalk.CyclicImmediateReverseNormalization.site_of_nonempty_normalizes_to_nil`

Kind: theorem.

If a nonempty exact cyclic traversal normalizes completely to the empty
trace, the original representation already exposes a concrete internal or
closing cancellation site.  This is stronger than reverse-value membership:
it records where the first scheduler-level nesting analysis must begin.

```lean
ProofNetIR.Graph.EdgeWalk.CyclicImmediateReverseNormalization.site_of_nonempty_normalizes_to_nil : ∀ {graph : ProofNetIR.Graph} {before after : List graph.DirectedEdge},
  ProofNetIR.Graph.EdgeWalk.CyclicImmediateReverseNormalization before after →
    before ≠ [] → after = [] → ProofNetIR.Graph.EdgeWalk.CyclicImmediateReverseSite before
```

### `ProofNetIR.Graph.EdgeWalk.normalizeCyclicImmediateReversalsTraced`

Kind: theorem.

Normalize a finite closed exact-occurrence walk both internally and across
its cyclic closing junction.  The base vertex may rotate, every surviving
occurrence comes from the input, and the result is either empty or cyclically
nonbacktracking.  The empty alternative is essential: a closed tree walk can
consist entirely of nested out-and-back pairs.

```lean
ProofNetIR.Graph.EdgeWalk.normalizeCyclicImmediateReversalsTraced : ∀ {graph : ProofNetIR.Graph} {base : ProofNetIR.Vertex} (traversed : List graph.DirectedEdge),
  graph.EdgeWalk base traversed base →
    ∃ normalizedBase reduced,
      graph.EdgeWalk normalizedBase reduced normalizedBase ∧
        ProofNetIR.Graph.EdgeWalk.CyclicImmediateReverseNormalization traversed reduced ∧
          (reduced = [] ∨ ProofNetIR.Graph.EdgeWalk.CyclicNoImmediateReverse reduced)
```

### `ProofNetIR.Graph.EdgeWalk.normalizeCyclicImmediateReversals`

Kind: theorem.

Compatibility projection of the proof-relevant cyclic normalizer.

```lean
ProofNetIR.Graph.EdgeWalk.normalizeCyclicImmediateReversals : ∀ {graph : ProofNetIR.Graph} {base : ProofNetIR.Vertex} (traversed : List graph.DirectedEdge),
  graph.EdgeWalk base traversed base →
    ∃ normalizedBase reduced,
      graph.EdgeWalk normalizedBase reduced normalizedBase ∧
        (reduced = [] ∨ ProofNetIR.Graph.EdgeWalk.CyclicNoImmediateReverse reduced) ∧
          ∀ (directed : graph.DirectedEdge), directed ∈ reduced → directed ∈ traversed
```

### `ProofNetIR.Graph.EdgeSimpleCycle.inflateRetained`

Kind: theorem.

Lift an exact simple cycle in a masked subgraph back to exact kept
occurrences of the original graph. This is the converse occurrence transport
to `EdgeSimpleCycle.retainEdges`; it does not collapse parallel equal-valued
edges.

```lean
ProofNetIR.Graph.EdgeSimpleCycle.inflateRetained : ∀ {graph : ProofNetIR.Graph} {mask : List Bool} (cycle : (graph.retainEdges mask).EdgeSimpleCycle),
  graph.edges.length = mask.length →
    ∃ originalCycle,
      List.map (fun directed => ProofNetIR.Graph.retainedIndex mask directed.index) originalCycle.traversed =
          List.map ProofNetIR.Graph.DirectedEdge.index cycle.traversed ∧
        List.map ProofNetIR.Graph.DirectedEdge.target originalCycle.traversed =
            List.map ProofNetIR.Graph.DirectedEdge.target cycle.traversed ∧
          ∀ (directed : graph.DirectedEdge), directed ∈ originalCycle.traversed → mask[directed.index]? = some true
```

### `ProofNetIR.Graph.DirectedEdge.reindex`

Kind: definition.

Transport an exact oriented edge occurrence through a vertex renaming.
The stored-list index and orientation are unchanged; only the edge endpoints
are renamed.

```lean
ProofNetIR.Graph.DirectedEdge.reindex : {graph : ProofNetIR.Graph} →
  graph.DirectedEdge → (r : ProofNetIR.VertexRenaming graph.vertexCount) → (graph.reindex r).DirectedEdge
```

### `ProofNetIR.Graph.EdgeWalk.reindex`

Kind: theorem.

Exact edge-aware walks are preserved by a bounded vertex renaming.

```lean
ProofNetIR.Graph.EdgeWalk.reindex : ∀ {graph : ProofNetIR.Graph} {start finish : ProofNetIR.Vertex} {traversed : List graph.DirectedEdge},
  graph.EdgeWalk start traversed finish →
    ∀ (r : ProofNetIR.VertexRenaming graph.vertexCount),
      (graph.reindex r).EdgeWalk (r.forward start) (List.map (fun directed => directed.reindex r) traversed)
        (r.forward finish)
```

### `ProofNetIR.Graph.EdgeSimpleCycle.reindex`

Kind: definition.

Exact occurrence-aware simple cycles are preserved by a bounded vertex
renaming.

```lean
ProofNetIR.Graph.EdgeSimpleCycle.reindex : {graph : ProofNetIR.Graph} →
  graph.EdgeSimpleCycle → (r : ProofNetIR.VertexRenaming graph.vertexCount) → (graph.reindex r).EdgeSimpleCycle
```

### `ProofNetIR.Graph.Acyclic`

Kind: definition.

Occurrence-aware acyclicity for finite undirected multigraphs. Parallel
stored edges remain distinct, so two parallel occurrences can form a
length-two `EdgeSimpleCycle`.

```lean
ProofNetIR.Graph.Acyclic : ProofNetIR.Graph → Prop
```

### `ProofNetIR.Graph.acyclic_iff_not_nonempty_edgeSimpleCycle`

Kind: theorem.

The public acyclicity predicate is exactly the nonexistence of an
occurrence-aware simple cycle.

```lean
ProofNetIR.Graph.acyclic_iff_not_nonempty_edgeSimpleCycle : ∀ (graph : ProofNetIR.Graph), graph.Acyclic ↔ ¬Nonempty graph.EdgeSimpleCycle
```

### `ProofNetIR.Graph.Acyclic.reindex`

Kind: theorem.

Occurrence-aware acyclicity is preserved by a bounded vertex renaming.

```lean
ProofNetIR.Graph.Acyclic.reindex : ∀ {graph : ProofNetIR.Graph},
  graph.Acyclic → ∀ (r : ProofNetIR.VertexRenaming graph.vertexCount), (graph.reindex r).Acyclic
```

### `ProofNetIR.Graph.acyclic_reindex_iff`

Kind: theorem.

Occurrence-aware acyclicity is invariant under bounded vertex
renaming.

```lean
ProofNetIR.Graph.acyclic_reindex_iff : ∀ (graph : ProofNetIR.Graph) (r : ProofNetIR.VertexRenaming graph.vertexCount),
  (graph.reindex r).Acyclic ↔ graph.Acyclic
```

### `ProofNetIR.Graph.Acyclic.edges_add_one_le_vertexCount`

Kind: theorem.

A bounded connected occurrence-acyclic finite multigraph has at most one
fewer stored edge occurrences than vertices.

```lean
ProofNetIR.Graph.Acyclic.edges_add_one_le_vertexCount : ∀ {graph : ProofNetIR.Graph},
  graph.Acyclic → graph.Bounded → graph.Connected → graph.edges.length + 1 ≤ graph.vertexCount
```

### `ProofNetIR.Graph.isEdgeSimpleCycleTraversal`

Kind: definition.

Executable validation of one proposed exact cycle traversal. A candidate
must be nonempty, close endpoint-to-source in order, use no stored edge index
twice, and visit no source vertex twice.

```lean
ProofNetIR.Graph.isEdgeSimpleCycleTraversal : {graph : ProofNetIR.Graph} → List graph.DirectedEdge → Bool
```

### `ProofNetIR.Graph.isEdgeSimpleCycleTraversal_sound`

Kind: theorem.

Every traversal accepted by the executable validator reconstructs an exact
occurrence-aware simple cycle with the same directed-edge sequence.

```lean
ProofNetIR.Graph.isEdgeSimpleCycleTraversal_sound : ∀ {graph : ProofNetIR.Graph} {traversed : List graph.DirectedEdge},
  ProofNetIR.Graph.isEdgeSimpleCycleTraversal traversed = true → ∃ cycle, cycle.traversed = traversed
```

### `ProofNetIR.Graph.isEdgeSimpleCycleTraversal_complete`

Kind: theorem.

Every exact occurrence-aware simple cycle is accepted when its stored
directed-edge traversal is presented to the executable validator.

```lean
ProofNetIR.Graph.isEdgeSimpleCycleTraversal_complete : ∀ {graph : ProofNetIR.Graph} (cycle : graph.EdgeSimpleCycle),
  ProofNetIR.Graph.isEdgeSimpleCycleTraversal cycle.traversed = true
```

### `ProofNetIR.Graph.edgeSimpleCycleTraversalCandidates`

Kind: definition.

All exact directed-edge lists of lengths one through the number of stored
edge occurrences. This is a finite reference oracle, not a scalable cycle
enumerator.

```lean
ProofNetIR.Graph.edgeSimpleCycleTraversalCandidates : (graph : ProofNetIR.Graph) → List (List graph.DirectedEdge)
```

### `ProofNetIR.Graph.hasEdgeSimpleCycle`

Kind: definition.

Exhaustive occurrence-aware cycle detection. Its candidate family is
finite and complete, but exponential; it is intended as a certified
specification oracle for the later optimized forest checker.

```lean
ProofNetIR.Graph.hasEdgeSimpleCycle : ProofNetIR.Graph → Bool
```

### `ProofNetIR.Graph.hasEdgeSimpleCycle_eq_true_iff`

Kind: theorem.

Exhaustive cycle search returns true exactly when an
occurrence-aware simple cycle exists.

```lean
ProofNetIR.Graph.hasEdgeSimpleCycle_eq_true_iff : ∀ (graph : ProofNetIR.Graph), graph.hasEdgeSimpleCycle = true ↔ Nonempty graph.EdgeSimpleCycle
```

### `ProofNetIR.Graph.isAcyclic`

Kind: definition.

Certified exhaustive decision procedure for occurrence-aware acyclicity.
This reference implementation deliberately favors a direct completeness proof
over scalability.

```lean
ProofNetIR.Graph.isAcyclic : ProofNetIR.Graph → Bool
```

### `ProofNetIR.Graph.isAcyclic_eq_true_iff`

Kind: theorem.

The exhaustive Boolean acyclicity oracle exactly decides the public
occurrence-aware `Acyclic` proposition.

```lean
ProofNetIR.Graph.isAcyclic_eq_true_iff : ∀ (graph : ProofNetIR.Graph), graph.isAcyclic = true ↔ graph.Acyclic
```

### `ProofNetIR.Graph.isTreeViaAcyclic`

Kind: definition.

Reference tree decision through the independently specified acyclicity
oracle. It is deliberately not the production path: `isAcyclic` is
exponential.

```lean
ProofNetIR.Graph.isTreeViaAcyclic : ProofNetIR.Graph → Bool
```

### `ProofNetIR.Graph.isTreeViaAcyclic_eq_true_iff`

Kind: theorem.

The reference acyclicity-based tree decision exactly decides the public
finite-multigraph tree semantics.

```lean
ProofNetIR.Graph.isTreeViaAcyclic_eq_true_iff : ∀ (graph : ProofNetIR.Graph), graph.isTreeViaAcyclic = true ↔ graph.IsTree
```

### `ProofNetIR.Graph.isTreeViaAcyclic_eq_isTree`

Kind: theorem.

The exponential acyclicity route and the existing reachability-plus-count
tree checker return the same Boolean on every finite multigraph.

```lean
ProofNetIR.Graph.isTreeViaAcyclic_eq_isTree : ∀ (graph : ProofNetIR.Graph), graph.isTreeViaAcyclic = graph.isTree
```

### `ProofNetIR.Graph.IsTree`

Kind: definition.

Declarative tree property used by the semantic checker soundness theorem.

```lean
ProofNetIR.Graph.IsTree : ProofNetIR.Graph → Prop
```

### `ProofNetIR.Graph.isTree_iff_isTree`

Kind: theorem.

The finite executable tree checker decides the public declarative tree
property, not only an auxiliary fuel-indexed approximation.

```lean
ProofNetIR.Graph.isTree_iff_isTree : ∀ (graph : ProofNetIR.Graph), graph.isTree = true ↔ graph.IsTree
```

### `ProofNetIR.Graph.IsTree.acyclic`

Kind: theorem.

Every graph satisfying the public declarative tree contract is acyclic in
the exact stored-edge-occurrence sense.

```lean
ProofNetIR.Graph.IsTree.acyclic : ∀ {graph : ProofNetIR.Graph}, graph.IsTree → graph.Acyclic
```

### `ProofNetIR.Graph.IsTree.no_cyclicNoImmediateReverse`

Kind: theorem.

A finite tree admits no nonempty closed exact-occurrence traversal that is
nonbacktracking both internally and across its closing junction.  Choose a
traversed target of maximal rooted distance.  The incoming and cyclic-successor
occurrences must both be the unique parent-edge occurrence owned by that
maximal vertex, so the successor is the incoming occurrence's exact reverse.

```lean
ProofNetIR.Graph.IsTree.no_cyclicNoImmediateReverse : ∀ {graph : ProofNetIR.Graph},
  graph.IsTree →
    ∀ {base : ProofNetIR.Vertex} {traversed : List graph.DirectedEdge},
      traversed ≠ [] →
        graph.EdgeWalk base traversed base → ProofNetIR.Graph.EdgeWalk.CyclicNoImmediateReverse traversed → False
```

### `ProofNetIR.Graph.Acyclic.edges_nodup`

Kind: theorem.

Occurrence-aware acyclicity forbids duplicate stored edge values in a
bounded graph: distinct equal-valued occurrences would form a two-edge
multigraph cycle.

```lean
ProofNetIR.Graph.Acyclic.edges_nodup : ∀ {graph : ProofNetIR.Graph}, graph.Acyclic → graph.Bounded → graph.edges.Nodup
```

### `ProofNetIR.Graph.Acyclic.noWalk_of_addEdge`

Kind: theorem.

In a bounded occurrence-aware graph, an appended loopless edge can belong
to an acyclic extension only when its endpoints were previously disconnected.
This is the converse of `Acyclic.addEdge_of_noWalk`; the proof closes a
loop-erased old path with the exact newly appended edge occurrence.

```lean
ProofNetIR.Graph.Acyclic.noWalk_of_addEdge : ∀ {graph : ProofNetIR.Graph} {edge : ProofNetIR.Edge},
  (graph.addEdge edge).Acyclic →
    graph.Bounded →
      edge.first < graph.vertexCount →
        edge.second < graph.vertexCount → edge.first ≠ edge.second → ¬graph.Walk edge.first edge.second
```

### `ProofNetIR.Graph.IsTree.edgeExchange_walk`

Kind: theorem.

Fundamental tree-edge exchange lemma for occurrence-aware finite
multigraphs. If replacing the edge `left--common` by `right--common` leaves a
tree, then `left` and `right` were already connected before either edge was
added. This is the exact bridge used by switching arguments for par links.

```lean
ProofNetIR.Graph.IsTree.edgeExchange_walk : ∀ {base : ProofNetIR.Graph} {left right common : ProofNetIR.Vertex},
  (base.addEdge { first := left, second := common }).IsTree →
    (base.addEdge { first := right, second := common }).IsTree → base.Walk left right
```

### `ProofNetIR.Graph.connected_of_bounded_acyclic_edgeCount`

Kind: theorem.

Finite-forest converse: a nonempty bounded occurrence-acyclic multigraph
with exactly one fewer stored edge occurrence than vertices is connected. The
proof extends it to a maximal forest, proves that extension connected, and
then uses equal cardinality to transport all extension walks back.

```lean
ProofNetIR.Graph.connected_of_bounded_acyclic_edgeCount : ∀ {graph : ProofNetIR.Graph},
  graph.Bounded → 0 < graph.vertexCount → graph.Acyclic → graph.edges.length + 1 = graph.vertexCount → graph.Connected
```

### `ProofNetIR.Graph.isTree_iff_bounded_connected_acyclic`

Kind: theorem.

Standard finite-multigraph tree characterization for the exact public
semantics. Parallel stored occurrences are handled by occurrence-aware
acyclicity rather than silently collapsed to a simple graph.

```lean
ProofNetIR.Graph.isTree_iff_bounded_connected_acyclic : ∀ (graph : ProofNetIR.Graph), graph.IsTree ↔ graph.Bounded ∧ graph.Connected ∧ graph.Acyclic
```

### `ProofNetIR.Certificate.CuspAcyclic`

Kind: definition.

Proposition-level colored acyclicity used by the splitting theorem: there
is no nonempty simple cycle whose every local transition avoids a cusp.

```lean
ProofNetIR.Certificate.CuspAcyclic : ProofNetIR.Certificate → Prop
```

### `ProofNetIR.Certificate.linkFullEdgeParTargets_some_origin`

Kind: theorem.

A nonempty par-target annotation in an arbitrary link list comes from a
stored par link with that exact conclusion.

```lean
ProofNetIR.Certificate.linkFullEdgeParTargets_some_origin : ∀ {links : List ProofNetIR.Link} {index : Nat} {conclusion : ProofNetIR.Vertex},
  (ProofNetIR.Certificate.linkFullEdgeParTargets links)[index]? = some (some conclusion) →
    ∃ left right, ProofNetIR.Link.par left right conclusion ∈ links
```

### `ProofNetIR.Certificate.linkLeftRetainedEdges_lookup_origin`

Kind: theorem.

Every exact edge occurrence in the deterministic all-left reference
switching records a concrete submitted-link occurrence.  The result preserves
both the retained-edge lookup position used to select the occurrence and an
exact lookup position for its source link.  In particular, a reference par
edge can only be the stored left-premise occurrence.

```lean
ProofNetIR.Certificate.linkLeftRetainedEdges_lookup_origin : ∀ {links : List ProofNetIR.Link} {edgeIndex : Nat} {edge : ProofNetIR.Edge},
  (ProofNetIR.Certificate.linkLeftRetainedEdges links)[edgeIndex]? = some edge →
    (∃ linkIndex left right,
        links[linkIndex]? = some (ProofNetIR.Link.axiom left right) ∧ edge = { first := left, second := right }) ∨
      (∃ linkIndex left right conclusion,
          links[linkIndex]? = some (ProofNetIR.Link.tensor left right conclusion) ∧
            (edge = { first := left, second := conclusion } ∨ edge = { first := right, second := conclusion })) ∨
        ∃ linkIndex left right conclusion,
          links[linkIndex]? = some (ProofNetIR.Link.par left right conclusion) ∧
            edge = { first := left, second := conclusion }
```

### `ProofNetIR.Certificate.FullSwitchingSelection.mask_parPairSparse`

Kind: theorem.

The true entries of an occurrence-order switching mask are sparse at every
par pair: exactly one of the two emitted premise occurrences is retained.

```lean
ProofNetIR.Certificate.FullSwitchingSelection.mask_parPairSparse : ∀ {links : List ProofNetIR.Link} {selected retained : List ProofNetIR.Edge} {mask : List Bool},
  ProofNetIR.Certificate.FullSwitchingSelection links selected retained mask →
    ProofNetIR.Certificate.ParPairSparse links 0 fun index => mask[index]? = some true
```

### `ProofNetIR.Certificate.not_parPairSparse_exists`

Kind: theorem.

Failure of par-pair sparsity exposes one concrete stored par whose two
consecutive full-edge occurrence indices are both requested.

```lean
ProofNetIR.Certificate.not_parPairSparse_exists : ∀ (links : List ProofNetIR.Link) (offset : Nat) (uses : Nat → Prop),
  ¬ProofNetIR.Certificate.ParPairSparse links offset uses →
    ∃ before left right conclusion after,
      links = before ++ ProofNetIR.Link.par left right conclusion :: after ∧
        uses (offset + (ProofNetIR.Certificate.linkFullEdges before).length) ∧
          uses (offset + (ProofNetIR.Certificate.linkFullEdges before).length + 1)
```

### `ProofNetIR.Certificate.FullSwitchingSelection.kept_parTarget_index_unique`

Kind: theorem.

A legal occurrence-order switching retains at most one occurrence carrying
the same par conclusion, provided that conclusion has at most one producing
link in the stored list. This is the exact-index form needed to rule out local
cusps after lifting a masked cycle.

```lean
ProofNetIR.Certificate.FullSwitchingSelection.kept_parTarget_index_unique : ∀ {links : List ProofNetIR.Link} {selected retained : List ProofNetIR.Edge} {mask : List Bool},
  ProofNetIR.Certificate.FullSwitchingSelection links selected retained mask →
    ∀ {firstIndex secondIndex : Nat} {conclusion : ProofNetIR.Vertex},
      (List.filter (fun x => ProofNetIR.Link.produces conclusion x) links).length ≤ 1 →
        (ProofNetIR.Certificate.linkFullEdgeParTargets links)[firstIndex]? = some (some conclusion) →
          (ProofNetIR.Certificate.linkFullEdgeParTargets links)[secondIndex]? = some (some conclusion) →
            mask[firstIndex]? = some true → mask[secondIndex]? = some true → firstIndex = secondIndex
```

### `ProofNetIR.Certificate.StructurallyWellFormed.parTarget_producerCount`

Kind: theorem.

A nonempty par target at an exact full-edge occurrence is owned by exactly
one stored producer in every structurally well-formed certificate.

```lean
ProofNetIR.Certificate.StructurallyWellFormed.parTarget_producerCount : ∀ {certificate : ProofNetIR.Certificate},
  certificate.StructurallyWellFormed →
    ∀ {index : Nat} {conclusion : ProofNetIR.Vertex},
      certificate.fullEdgeParTargets[index]? = some (some conclusion) → certificate.producerCount conclusion = 1
```

### `ProofNetIR.Certificate.FullSwitchingSelection.kept_parTarget_index_unique_of_structural`

Kind: theorem.

Structural ownership discharges the producer-side premise of
`kept_parTarget_index_unique` for an actual certificate.

```lean
ProofNetIR.Certificate.FullSwitchingSelection.kept_parTarget_index_unique_of_structural : ∀ {certificate : ProofNetIR.Certificate} {selected retained : List ProofNetIR.Edge} {mask : List Bool},
  ProofNetIR.Certificate.FullSwitchingSelection certificate.links selected retained mask →
    certificate.StructurallyWellFormed →
      ∀ {firstIndex secondIndex : Nat} {conclusion : ProofNetIR.Vertex},
        certificate.fullEdgeParTargets[firstIndex]? = some (some conclusion) →
          certificate.fullEdgeParTargets[secondIndex]? = some (some conclusion) →
            mask[firstIndex]? = some true → mask[secondIndex]? = some true → firstIndex = secondIndex
```

### `ProofNetIR.Certificate.FullSwitchingSelection.no_cusp_of_kept`

Kind: theorem.

Two nontrivially consecutive occurrences retained by a legal switching
cannot form a cusp. Exact par annotations force both occurrences to have the
same index and orientation, contradicting nontriviality.

```lean
ProofNetIR.Certificate.FullSwitchingSelection.no_cusp_of_kept : ∀ {certificate : ProofNetIR.Certificate} {selected retained : List ProofNetIR.Edge} {mask : List Bool},
  ProofNetIR.Certificate.FullSwitchingSelection certificate.links selected retained mask →
    certificate.StructurallyWellFormed →
      ∀ {cycle : certificate.fullGraph.EdgeSimpleCycle},
        (∀ (directed : certificate.fullGraph.DirectedEdge),
            directed ∈ cycle.traversed → mask[directed.index]? = some true) →
          ∀ {incoming outgoing : certificate.fullGraph.DirectedEdge},
            incoming ∈ cycle.traversed →
              outgoing ∈ cycle.traversed → incoming ≠ outgoing.reverse → ¬certificate.Cusp incoming outgoing
```

### `ProofNetIR.Certificate.fullSwitchingSelection_cycle_cuspFree`

Kind: theorem.

Every exact simple cycle surviving an occurrence-order switching is
cusp-free in the unswitched full graph. This is the reverse transport lemma
complementing `DeclarativelyCorrect.cuspAcyclic`.

```lean
ProofNetIR.Certificate.fullSwitchingSelection_cycle_cuspFree : ∀ {certificate : ProofNetIR.Certificate} (cycle : certificate.fullGraph.EdgeSimpleCycle),
  certificate.StructurallyWellFormed →
    ∀ {selected retained : List ProofNetIR.Edge} {mask : List Bool},
      ProofNetIR.Certificate.FullSwitchingSelection certificate.links selected retained mask →
        (∀ (directed : certificate.fullGraph.DirectedEdge),
            directed ∈ cycle.traversed → mask[directed.index]? = some true) →
          certificate.CuspFreeCycle cycle
```

### `ProofNetIR.Certificate.CuspAcyclic.occurrenceSwitching_acyclic`

Kind: theorem.

Cusp-acyclicity rules out every cycle in every exact occurrence-order
switching. This conclusion is non-enumerative: the switching is arbitrary and
the proof transports a hypothetical cycle back to the full graph.

```lean
ProofNetIR.Certificate.CuspAcyclic.occurrenceSwitching_acyclic : ∀ {certificate : ProofNetIR.Certificate},
  certificate.CuspAcyclic →
    certificate.StructurallyWellFormed →
      ∀ {selected retained : List ProofNetIR.Edge} {mask : List Bool},
        ProofNetIR.Certificate.FullSwitchingSelection certificate.links selected retained mask →
          (certificate.fullGraph.retainEdges mask).Acyclic
```

### `ProofNetIR.Certificate.cuspAcyclic_iff_allOccurrenceSwitchingsAcyclic`

Kind: theorem.

For structurally well-formed certificates, cusp-acyclicity is exactly
ordinary occurrence-aware acyclicity of every switching. The reverse
direction covers a hypothetical cusp-free cycle by one switching; the forward
direction lifts an arbitrary switching cycle through its exact mask.

```lean
ProofNetIR.Certificate.cuspAcyclic_iff_allOccurrenceSwitchingsAcyclic : ∀ (certificate : ProofNetIR.Certificate),
  certificate.StructurallyWellFormed →
    (certificate.CuspAcyclic ↔
      ∀ (selected retained : List ProofNetIR.Edge) (mask : List Bool),
        ProofNetIR.Certificate.FullSwitchingSelection certificate.links selected retained mask →
          (certificate.fullGraph.retainEdges mask).Acyclic)
```

### `ProofNetIR.Certificate.StructurallyWellFormed.fullGraph_bounded`

Kind: theorem.

Structural well-formedness bounds every occurrence in the unswitched
full graph.

```lean
ProofNetIR.Certificate.StructurallyWellFormed.fullGraph_bounded : ∀ {certificate : ProofNetIR.Certificate}, certificate.StructurallyWellFormed → certificate.fullGraph.Bounded
```

### `ProofNetIR.Certificate.FullSwitchingSelection.retained_length_eq`

Kind: theorem.

Any two exact occurrence-order switchings of the same link list have the
same retained edge-occurrence count.

```lean
ProofNetIR.Certificate.FullSwitchingSelection.retained_length_eq : ∀ {links : List ProofNetIR.Link} {firstSelected firstRetained : List ProofNetIR.Edge} {firstMask : List Bool}
  {secondSelected secondRetained : List ProofNetIR.Edge} {secondMask : List Bool},
  ProofNetIR.Certificate.FullSwitchingSelection links firstSelected firstRetained firstMask →
    ProofNetIR.Certificate.FullSwitchingSelection links secondSelected secondRetained secondMask →
      firstRetained.length = secondRetained.length
```

### `ProofNetIR.Certificate.AllOccurrenceSwitchingsConnected`

Kind: definition.

The remaining connectivity half of switching correctness, stated over the
same occurrence-order masks used by the exact acyclicity bridge.

```lean
ProofNetIR.Certificate.AllOccurrenceSwitchingsConnected : ProofNetIR.Certificate → Prop
```

### `ProofNetIR.Certificate.referenceSwitchingMask`

Kind: definition.

Exact mask of the deterministic reference switching that chooses the left
premise of every par link.

```lean
ProofNetIR.Certificate.referenceSwitchingMask : ProofNetIR.Certificate → List Bool
```

### `ProofNetIR.Certificate.referenceSwitchingMask_parAt`

Kind: theorem.

Exact mask positions contributed by a concrete par occurrence after an
arbitrary stored-link prefix: the deterministic reference switching retains
the left premise and omits the right premise.

```lean
ProofNetIR.Certificate.referenceSwitchingMask_parAt : ∀ (certificate : ProofNetIR.Certificate) (before after : List ProofNetIR.Link)
  (left right conclusion : ProofNetIR.Vertex),
  certificate.links = before ++ ProofNetIR.Link.par left right conclusion :: after →
    certificate.referenceSwitchingMask[(ProofNetIR.Certificate.linkFullEdges before).length]? = some true ∧
      certificate.referenceSwitchingMask[(ProofNetIR.Certificate.linkFullEdges before).length + 1]? = some false
```

### `ProofNetIR.Certificate.referenceSwitchingGraph`

Kind: definition.

Deterministic occurrence-order reference switching graph.

```lean
ProofNetIR.Certificate.referenceSwitchingGraph : ProofNetIR.Certificate → ProofNetIR.Graph
```

### `ProofNetIR.Certificate.ReferenceSwitchingConnected`

Kind: definition.

Compact connectedness premise targeted by the remaining reverse bridge.

```lean
ProofNetIR.Certificate.ReferenceSwitchingConnected : ProofNetIR.Certificate → Prop
```

### `ProofNetIR.Certificate.referenceFullSwitchingSelection`

Kind: theorem.

The deterministic reference graph is backed by a lawful exact
occurrence-order switching selection.

```lean
ProofNetIR.Certificate.referenceFullSwitchingSelection : ∀ (certificate : ProofNetIR.Certificate),
  ProofNetIR.Certificate.FullSwitchingSelection certificate.links
    (ProofNetIR.Certificate.linkLeftSelectedEdges certificate.links)
    (ProofNetIR.Certificate.linkLeftRetainedEdges certificate.links) certificate.referenceSwitchingMask
```

### `ProofNetIR.Certificate.DeclarativelyCorrect.occurrenceSwitchingTree`

Kind: theorem.

Every exact occurrence-order switching of a declaratively correct
certificate is a tree.  This exposes the arbitrary-switching form directly,
without first converting the retained edge list to the value-level switching
graph.

```lean
ProofNetIR.Certificate.DeclarativelyCorrect.occurrenceSwitchingTree : ∀ {certificate : ProofNetIR.Certificate},
  certificate.DeclarativelyCorrect →
    ∀ {selected retained : List ProofNetIR.Edge} {mask : List Bool},
      ProofNetIR.Certificate.FullSwitchingSelection certificate.links selected retained mask →
        (certificate.fullGraph.retainEdges mask).IsTree
```

### `ProofNetIR.Certificate.DeclarativelyCorrect.referenceSwitchingTree`

Kind: theorem.

Every declaratively correct certificate has a tree as its deterministic
all-left reference switching.  This packages the boundedness, occurrence-aware
acyclicity, and connectedness consequences used by downstream geometric
arguments.

```lean
ProofNetIR.Certificate.DeclarativelyCorrect.referenceSwitchingTree : ∀ {certificate : ProofNetIR.Certificate}, certificate.DeclarativelyCorrect → certificate.referenceSwitchingGraph.IsTree
```

### `ProofNetIR.Certificate.DeclarativelyCorrect.no_occurrenceSwitchingKept_cyclicNoImmediateReverse`

Kind: theorem.

A correct certificate admits no nonempty closed cyclically nonbacktracking
full-graph walk whose exact occurrences are all retained by one valid
occurrence switching.

```lean
ProofNetIR.Certificate.DeclarativelyCorrect.no_occurrenceSwitchingKept_cyclicNoImmediateReverse : ∀ {certificate : ProofNetIR.Certificate},
  certificate.DeclarativelyCorrect →
    ∀ {selected retainedEdges : List ProofNetIR.Edge} {mask : List Bool},
      ProofNetIR.Certificate.FullSwitchingSelection certificate.links selected retainedEdges mask →
        ∀ {base : ProofNetIR.Vertex} {traversed : List certificate.fullGraph.DirectedEdge},
          traversed ≠ [] →
            certificate.fullGraph.EdgeWalk base traversed base →
              (∀ (directed : certificate.fullGraph.DirectedEdge),
                  directed ∈ traversed → mask[directed.index]? = some true) →
                ProofNetIR.Graph.EdgeWalk.CyclicNoImmediateReverse traversed → False
```

### `ProofNetIR.Certificate.DeclarativelyCorrect.no_parPairSparse_cyclicNoImmediateReverse`

Kind: theorem.

Par-pair sparsity is the exact combinatorial condition needed to place a
nonempty cyclically nonbacktracking full-graph walk inside one occurrence
switching.  Correctness then excludes the walk by switching-tree acyclicity.

```lean
ProofNetIR.Certificate.DeclarativelyCorrect.no_parPairSparse_cyclicNoImmediateReverse : ∀ {certificate : ProofNetIR.Certificate},
  certificate.DeclarativelyCorrect →
    ∀ {base : ProofNetIR.Vertex} {traversed : List certificate.fullGraph.DirectedEdge},
      traversed ≠ [] →
        certificate.fullGraph.EdgeWalk base traversed base →
          (ProofNetIR.Certificate.ParPairSparse certificate.links 0 fun index =>
              ∃ directed, directed ∈ traversed ∧ directed.index = index) →
            ProofNetIR.Graph.EdgeWalk.CyclicNoImmediateReverse traversed → False
```

### `ProofNetIR.Certificate.DeclarativelyCorrect.cyclicNoImmediateReverse_uses_bothParOccurrences`

Kind: theorem.

Consequently, every nonempty cyclically nonbacktracking closed walk in the
full graph of a correct certificate uses both exact premise-edge occurrences
of at least one concrete par link.  This is the precise obstruction that the
remaining scheduler-specific turn analysis must eliminate.

```lean
ProofNetIR.Certificate.DeclarativelyCorrect.cyclicNoImmediateReverse_uses_bothParOccurrences : ∀ {certificate : ProofNetIR.Certificate},
  certificate.DeclarativelyCorrect →
    ∀ {base : ProofNetIR.Vertex} {traversed : List certificate.fullGraph.DirectedEdge},
      traversed ≠ [] →
        certificate.fullGraph.EdgeWalk base traversed base →
          ProofNetIR.Graph.EdgeWalk.CyclicNoImmediateReverse traversed →
            ∃ before left right conclusion after leftOccurrence rightOccurrence,
              certificate.links = before ++ ProofNetIR.Link.par left right conclusion :: after ∧
                leftOccurrence ∈ traversed ∧
                  leftOccurrence.index = (ProofNetIR.Certificate.linkFullEdges before).length ∧
                    leftOccurrence.edge = { first := left, second := conclusion } ∧
                      certificate.referenceSwitchingMask[leftOccurrence.index]? = some true ∧
                        rightOccurrence ∈ traversed ∧
                          rightOccurrence.index = (ProofNetIR.Certificate.linkFullEdges before).length + 1 ∧
                            rightOccurrence.edge = { first := right, second := conclusion } ∧
                              certificate.referenceSwitchingMask[rightOccurrence.index]? = some false
```

### `ProofNetIR.Certificate.DeclarativelyCorrect.cyclicNoImmediateReverse_uses_backwardRightPar`

Kind: theorem.

If every forward occurrence of such a closed obstruction is retained by
the all-left reference mask, the unavoidable omitted right-par occurrence can
only be traversed backward.

```lean
ProofNetIR.Certificate.DeclarativelyCorrect.cyclicNoImmediateReverse_uses_backwardRightPar : ∀ {certificate : ProofNetIR.Certificate},
  certificate.DeclarativelyCorrect →
    ∀ {base : ProofNetIR.Vertex} {traversed : List certificate.fullGraph.DirectedEdge},
      traversed ≠ [] →
        certificate.fullGraph.EdgeWalk base traversed base →
          ProofNetIR.Graph.EdgeWalk.CyclicNoImmediateReverse traversed →
            (∀ (directed : certificate.fullGraph.DirectedEdge),
                directed ∈ traversed →
                  directed.forward = true → certificate.referenceSwitchingMask[directed.index]? = some true) →
              ∃ before left right conclusion after leftOccurrence rightOccurrence,
                certificate.links = before ++ ProofNetIR.Link.par left right conclusion :: after ∧
                  leftOccurrence ∈ traversed ∧
                    leftOccurrence.index = (ProofNetIR.Certificate.linkFullEdges before).length ∧
                      rightOccurrence ∈ traversed ∧
                        rightOccurrence.index = (ProofNetIR.Certificate.linkFullEdges before).length + 1 ∧
                          rightOccurrence.forward = false
```

### `ProofNetIR.Certificate.DeclarativelyCorrect.no_referenceKept_cyclicNoImmediateReverse`

Kind: theorem.

A correct certificate admits no nonempty closed cyclically nonbacktracking
full-graph walk whose exact edge occurrences are all retained by the
deterministic all-left reference switching.  The proof preserves occurrence
indices and orientations through the switching mask, then contradicts the
reference switching's tree property.

```lean
ProofNetIR.Certificate.DeclarativelyCorrect.no_referenceKept_cyclicNoImmediateReverse : ∀ {certificate : ProofNetIR.Certificate},
  certificate.DeclarativelyCorrect →
    ∀ {base : ProofNetIR.Vertex} {traversed : List certificate.fullGraph.DirectedEdge},
      traversed ≠ [] →
        certificate.fullGraph.EdgeWalk base traversed base →
          (∀ (directed : certificate.fullGraph.DirectedEdge),
              directed ∈ traversed → certificate.referenceSwitchingMask[directed.index]? = some true) →
            ProofNetIR.Graph.EdgeWalk.CyclicNoImmediateReverse traversed → False
```

### `ProofNetIR.Certificate.DeclarativelyCorrect.parPremises_referencePath_avoids_conclusion`

Kind: theorem.

In every correct certificate, the two premises of any submitted par are
joined in the deterministic all-left reference switching by a simple exact
path which avoids that par's conclusion.  The proof flips only the specified
par occurrence, applies occurrence-aware tree-edge exchange, and transports
the common-component path back through the reference edge permutation.

```lean
ProofNetIR.Certificate.DeclarativelyCorrect.parPremises_referencePath_avoids_conclusion : ∀ {certificate : ProofNetIR.Certificate},
  certificate.DeclarativelyCorrect →
    ∀ {left right conclusion : ProofNetIR.Vertex},
      ProofNetIR.Link.par left right conclusion ∈ certificate.links →
        ∃ path, path.start = left ∧ path.finish = right ∧ ¬conclusion ∈ path.vertices
```

### `ProofNetIR.Certificate.declarativelyCorrect_iff_structural_cuspAcyclic_allConnected`

Kind: theorem.

Declarative all-switchings correctness decomposes exactly into structural
well-formedness, colored cusp-acyclicity, and occurrence-switching
connectedness. The first two fields no longer quantify over switching trees;
only the explicit connectivity field remains for the contraction route.

```lean
ProofNetIR.Certificate.declarativelyCorrect_iff_structural_cuspAcyclic_allConnected : ∀ (certificate : ProofNetIR.Certificate),
  certificate.DeclarativelyCorrect ↔
    certificate.StructurallyWellFormed ∧ certificate.CuspAcyclic ∧ certificate.AllOccurrenceSwitchingsConnected
```

### `ProofNetIR.Certificate.check_iff_structural_cuspAcyclic_allConnected`

Kind: theorem.

Executable checker acceptance has the same exact three-part
decomposition. The only remaining all-switchings quantifier is connectedness;
acyclicity has been replaced by the single colored full-graph criterion.

```lean
ProofNetIR.Certificate.check_iff_structural_cuspAcyclic_allConnected : ∀ (certificate : ProofNetIR.Certificate),
  certificate.check = true ↔
    certificate.StructurallyWellFormed ∧ certificate.CuspAcyclic ∧ certificate.AllOccurrenceSwitchingsConnected
```

### `ProofNetIR.Certificate.allOccurrenceSwitchingsConnected_of_reference`

Kind: theorem.

The fixed reference switching suffices for the connectivity half once
colored cusp-acyclicity is known. Every switching is then acyclic, every
switching retains the same edge-occurrence count, and the finite-forest
converse transfers connectedness from the reference graph.

```lean
ProofNetIR.Certificate.allOccurrenceSwitchingsConnected_of_reference : ∀ {certificate : ProofNetIR.Certificate},
  certificate.StructurallyWellFormed →
    certificate.CuspAcyclic → certificate.ReferenceSwitchingConnected → certificate.AllOccurrenceSwitchingsConnected
```

### `ProofNetIR.Certificate.allOccurrenceSwitchingsConnected_iff_referenceSwitchingConnected`

Kind: theorem.

Under structural well-formedness and cusp-acyclicity, universal
occurrence-switching connectedness is exactly connectedness of the
deterministic all-left reference switching.

```lean
ProofNetIR.Certificate.allOccurrenceSwitchingsConnected_iff_referenceSwitchingConnected : ∀ (certificate : ProofNetIR.Certificate),
  certificate.StructurallyWellFormed →
    certificate.CuspAcyclic → (certificate.AllOccurrenceSwitchingsConnected ↔ certificate.ReferenceSwitchingConnected)
```

### `ProofNetIR.Certificate.declarativelyCorrect_iff_structural_cuspAcyclic_referenceConnected`

Kind: theorem.

Compact non-enumerative declarative correctness criterion: structural
well-formedness, colored cusp-acyclicity, and one deterministic connected
reference switching.

```lean
ProofNetIR.Certificate.declarativelyCorrect_iff_structural_cuspAcyclic_referenceConnected : ∀ (certificate : ProofNetIR.Certificate),
  certificate.DeclarativelyCorrect ↔
    certificate.StructurallyWellFormed ∧ certificate.CuspAcyclic ∧ certificate.ReferenceSwitchingConnected
```

### `ProofNetIR.Certificate.check_iff_structural_cuspAcyclic_referenceConnected`

Kind: theorem.

Exact compact correctness theorem for the executable checker. The
specification no longer quantifies over all switching graphs: only the single
deterministic reference graph remains in the connectivity field.

```lean
ProofNetIR.Certificate.check_iff_structural_cuspAcyclic_referenceConnected : ∀ (certificate : ProofNetIR.Certificate),
  certificate.check = true ↔
    certificate.StructurallyWellFormed ∧ certificate.CuspAcyclic ∧ certificate.ReferenceSwitchingConnected
```

### `ProofNetIR.Certificate.isCuspFreeTraversal`

Kind: definition.

Executable local test for a cusp-free directed-edge traversal. This is the
Boolean counterpart of `CuspFreeTraversal`; exact edge occurrences and their
orientations are retained in the input type.

```lean
ProofNetIR.Certificate.isCuspFreeTraversal : (certificate : ProofNetIR.Certificate) → List certificate.fullGraph.DirectedEdge → Bool
```

### `ProofNetIR.Certificate.isCuspFreeTraversal_eq_true_iff`

Kind: theorem.

The executable local traversal test decides the proposition-level
colored-transition contract exactly.

```lean
ProofNetIR.Certificate.isCuspFreeTraversal_eq_true_iff : ∀ (certificate : ProofNetIR.Certificate) (traversed : List certificate.fullGraph.DirectedEdge),
  certificate.isCuspFreeTraversal traversed = true ↔ certificate.CuspFreeTraversal traversed
```

### `ProofNetIR.Certificate.isCuspFreeCycleTraversal`

Kind: definition.

Executable cyclic cusp-freedom. Besides checking every internal
transition, it checks the transition from the last edge back to the first.

```lean
ProofNetIR.Certificate.isCuspFreeCycleTraversal : (certificate : ProofNetIR.Certificate) → List certificate.fullGraph.DirectedEdge → Bool
```

### `ProofNetIR.Certificate.isCuspFreeCycleTraversal_eq_true_iff`

Kind: theorem.

On a proved exact simple cycle, the executable cyclic test is equivalent
to the proposition used by the generalized-Yeo development.

```lean
ProofNetIR.Certificate.isCuspFreeCycleTraversal_eq_true_iff : ∀ (certificate : ProofNetIR.Certificate) (cycle : certificate.fullGraph.EdgeSimpleCycle),
  certificate.isCuspFreeCycleTraversal cycle.traversed = true ↔ certificate.CuspFreeCycle cycle
```

### `ProofNetIR.Certificate.hasCuspFreeEdgeSimpleCycle`

Kind: definition.

Exhaustive search for an exact simple cycle whose cyclic transitions are
all cusp-free. This is a finite specification oracle, not the intended
optimized correctness algorithm.

```lean
ProofNetIR.Certificate.hasCuspFreeEdgeSimpleCycle : ProofNetIR.Certificate → Bool
```

### `ProofNetIR.Certificate.hasCuspFreeEdgeSimpleCycle_eq_true_iff`

Kind: theorem.

Exhaustive colored-cycle search returns true exactly when the
proposition-level witness used by `CuspAcyclic` exists.

```lean
ProofNetIR.Certificate.hasCuspFreeEdgeSimpleCycle_eq_true_iff : ∀ (certificate : ProofNetIR.Certificate),
  certificate.hasCuspFreeEdgeSimpleCycle = true ↔ ∃ cycle, certificate.CuspFreeCycle cycle
```

### `ProofNetIR.Certificate.isCuspAcyclic`

Kind: definition.

Certified finite decision procedure for the colored acyclicity proposition
used by the splitting theorem. Candidate enumeration is exponential and this
definition is deliberately a differential oracle.

```lean
ProofNetIR.Certificate.isCuspAcyclic : ProofNetIR.Certificate → Bool
```

### `ProofNetIR.Certificate.isCuspAcyclic_eq_true_iff`

Kind: theorem.

The exhaustive Boolean colored-cycle oracle exactly decides
`CuspAcyclic`.

```lean
ProofNetIR.Certificate.isCuspAcyclic_eq_true_iff : ∀ (certificate : ProofNetIR.Certificate), certificate.isCuspAcyclic = true ↔ certificate.CuspAcyclic
```

### `ProofNetIR.Certificate.DeclarativelyCorrect.isCuspAcyclic`

Kind: theorem.

Every declaratively correct certificate is accepted by the independently
executable colored-cycle oracle.

```lean
ProofNetIR.Certificate.DeclarativelyCorrect.isCuspAcyclic : ∀ {certificate : ProofNetIR.Certificate}, certificate.DeclarativelyCorrect → certificate.isCuspAcyclic = true
```

### `ProofNetIR.Certificate.isCuspAcyclic_of_check`

Kind: theorem.

Checker acceptance implies acceptance by the colored-cycle oracle. This is
the first differential bridge; the converse requires the separately audited
switching-connectedness/tree argument.

```lean
ProofNetIR.Certificate.isCuspAcyclic_of_check : ∀ (certificate : ProofNetIR.Certificate), certificate.check = true → certificate.isCuspAcyclic = true
```

### `ProofNetIR.Certificate.compactCheck`

Kind: definition.

Executable compact specification checker. It replaces exponential
switching enumeration by one exhaustive colored-cycle oracle and one
deterministic reference-switching connectivity check. The colored-cycle
oracle is still exponential; a contraction implementation can refine this
same proved contract later without changing public semantics.

```lean
ProofNetIR.Certificate.compactCheck : ProofNetIR.Certificate → Bool
```

### `ProofNetIR.Certificate.referenceSwitchingGraph_connected_eq_true_iff`

Kind: theorem.

On a structurally well-formed certificate, the executable reference
connectivity bit decides the proposition-level reference condition exactly.

```lean
ProofNetIR.Certificate.referenceSwitchingGraph_connected_eq_true_iff : ∀ (certificate : ProofNetIR.Certificate),
  certificate.StructurallyWellFormed →
    (certificate.referenceSwitchingGraph.connected = true ↔ certificate.ReferenceSwitchingConnected)
```

### `ProofNetIR.Certificate.compactCheck_eq_true_iff_check`

Kind: theorem.

The compact specification checker accepts exactly the same certificates
as the original all-switchings checker.

```lean
ProofNetIR.Certificate.compactCheck_eq_true_iff_check : ∀ (certificate : ProofNetIR.Certificate), certificate.compactCheck = true ↔ certificate.check = true
```

### `ProofNetIR.Certificate.compactCheck_eq_check`

Kind: theorem.

Boolean extensional form of the certified checker equivalence.

```lean
ProofNetIR.Certificate.compactCheck_eq_check : ∀ (certificate : ProofNetIR.Certificate), certificate.compactCheck = certificate.check
```

### `ProofNetIR.Certificate.compactCheck_eq_true_iff_declarativelyCorrect`

Kind: theorem.

The compact checker also decides the independent declarative correctness
contract directly.

```lean
ProofNetIR.Certificate.compactCheck_eq_true_iff_declarativelyCorrect : ∀ (certificate : ProofNetIR.Certificate), certificate.compactCheck = true ↔ certificate.DeclarativelyCorrect
```

## First-order derivations

### `ProofNetIR.CutFreeDerivation`

Kind: inductive type.

First-order syntax for arbitrary cut-free, unit-free one-sided MLL
derivations. Tensor and par store the occurrence positions selected by the
rule; exchange stores an explicit permutation of occurrence indices.

```lean
ProofNetIR.CutFreeDerivation : Type
```

### `ProofNetIR.CutFreeDerivation.infer?`

Kind: definition.

Infer the conclusion sequent of the first-order rule tree independently of
the proof-net fragment construction.

```lean
ProofNetIR.CutFreeDerivation.infer? : ProofNetIR.CutFreeDerivation → Option (List ProofNetIR.Formula)
```

### `ProofNetIR.CutFreeDerivation.build?_exists_of_infer?`

Kind: theorem.

Formula-level validation and occurrence-aware fragment construction have
the same success domain. In particular, a first-order rule tree accepted by
`infer?` cannot later fail in `build?`, including exchanges over duplicate
formula labels.

```lean
ProofNetIR.CutFreeDerivation.build?_exists_of_infer? : ∀ {tree : ProofNetIR.CutFreeDerivation} {sequent : List ProofNetIR.Formula},
  tree.infer? = some sequent → ∃ fragment, tree.build? = some fragment
```

### `ProofNetIR.CutFreeDerivation.infer?_eq_some_iff_build?_conclusions`

Kind: theorem.

Exact synchronization of the independent formula pass and the
occurrence-aware builder.

```lean
ProofNetIR.CutFreeDerivation.infer?_eq_some_iff_build?_conclusions : ∀ {tree : ProofNetIR.CutFreeDerivation} {sequent : List ProofNetIR.Formula},
  tree.infer? = some sequent ↔ ∃ fragment, tree.build? = some fragment ∧ fragment.conclusions = sequent
```

### `ProofNetIR.CutFreeDerivation.build?_formulaConsistent`

Kind: theorem.

Every fragment produced by the occurrence-aware builder labels each
boundary root with exactly the formula stored in its boundary entry.

```lean
ProofNetIR.CutFreeDerivation.build?_formulaConsistent : ∀ {tree : ProofNetIR.CutFreeDerivation} {fragment : ProofNetIR.NetFragment},
  tree.build? = some fragment → fragment.FormulaConsistent
```

### `ProofNetIR.CutFreeDerivation.build?_structurallyWellFormed`

Kind: theorem.

Every successfully constructed occurrence-aware fragment satisfies the
full structural certificate contract: local typing, unique production,
single-parent ownership, and a duplicate-free in-bounds boundary.

```lean
ProofNetIR.CutFreeDerivation.build?_structurallyWellFormed : ∀ {tree : ProofNetIR.CutFreeDerivation} {fragment : ProofNetIR.NetFragment},
  tree.build? = some fragment → fragment.toCertificate.StructurallyWellFormed
```

### `ProofNetIR.CutFreeDerivation.build?_switchingCorrect`

Kind: theorem.

Every switching of every successfully constructed fragment is a tree.
This theorem is independent of the certificate ownership/typing proof needed
for full structural well-formedness.

```lean
ProofNetIR.CutFreeDerivation.build?_switchingCorrect : ∀ {tree : ProofNetIR.CutFreeDerivation} {fragment : ProofNetIR.NetFragment},
  tree.build? = some fragment → fragment.toCertificate.SwitchingCorrect
```

### `ProofNetIR.CutFreeDerivation.build?_declarativelyCorrect`

Kind: theorem.

A successfully built derivation fragment satisfies both independent
halves of the public proof-net semantics.

```lean
ProofNetIR.CutFreeDerivation.build?_declarativelyCorrect : ∀ {tree : ProofNetIR.CutFreeDerivation} {fragment : ProofNetIR.NetFragment},
  tree.build? = some fragment → fragment.toCertificate.DeclarativelyCorrect
```

### `ProofNetIR.CutFreeDerivation.build?_check`

Kind: theorem.

The executable checker accepts every certificate produced by a successful
derivation build. This is the end-to-end desequentialization soundness theorem
for the checker, not merely formula-boundary consistency.

```lean
ProofNetIR.CutFreeDerivation.build?_check : ∀ {tree : ProofNetIR.CutFreeDerivation} {fragment : ProofNetIR.NetFragment},
  tree.build? = some fragment → fragment.toCertificate.check = true
```

### `ProofNetIR.CutFreeDerivation.build?_conclusionFormulas?`

Kind: theorem.

Successful fragment construction exposes exactly its inferred boundary
through the public certificate formula lookup API.

```lean
ProofNetIR.CutFreeDerivation.build?_conclusionFormulas? : ∀ {tree : ProofNetIR.CutFreeDerivation} {fragment : ProofNetIR.NetFragment},
  tree.build? = some fragment → fragment.toCertificate.conclusionFormulas? = some fragment.conclusions
```

### `ProofNetIR.CutFreeDerivation.desequentialize?`

Kind: definition.

Build a proof-net certificate from a validated first-order rule tree.
Malformed resource positions or exchanges return `none`.

```lean
ProofNetIR.CutFreeDerivation.desequentialize? : ProofNetIR.CutFreeDerivation → Option ProofNetIR.Certificate
```

### `ProofNetIR.CutFreeDerivation.desequentialize?_conclusionFormulas?`

Kind: theorem.

Every successful public desequentialization result carries exactly the
formula sequent inferred by its source derivation.

```lean
ProofNetIR.CutFreeDerivation.desequentialize?_conclusionFormulas? : ∀ {tree : ProofNetIR.CutFreeDerivation} {certificate : ProofNetIR.Certificate},
  tree.desequentialize? = some certificate → certificate.conclusionFormulas? = tree.infer?
```

### `ProofNetIR.CutFreeDerivation.desequentialize?_declarativelyCorrect`

Kind: theorem.

Every successful public desequentialization result satisfies the
independent declarative proof-net contract.

```lean
ProofNetIR.CutFreeDerivation.desequentialize?_declarativelyCorrect : ∀ {tree : ProofNetIR.CutFreeDerivation} {certificate : ProofNetIR.Certificate},
  tree.desequentialize? = some certificate → certificate.DeclarativelyCorrect
```

### `ProofNetIR.CutFreeDerivation.desequentialize?_check`

Kind: theorem.

Every successful public desequentialization result is checker-accepted.

```lean
ProofNetIR.CutFreeDerivation.desequentialize?_check : ∀ {tree : ProofNetIR.CutFreeDerivation} {certificate : ProofNetIR.Certificate},
  tree.desequentialize? = some certificate → certificate.check = true
```

### `ProofNetIR.CutFreeDerivation.desequentialize?_exists_with_labels_of_infer?`

Kind: theorem.

Backward-compatible boundary-only corollary: formula-level validation is
sufficient to construct a public certificate whose lookup returns the
validated sequent. See `desequentialize?_exists_checked_of_infer?` for the
stronger checker-accepted result.

```lean
ProofNetIR.CutFreeDerivation.desequentialize?_exists_with_labels_of_infer? : ∀ {tree : ProofNetIR.CutFreeDerivation} {sequent : List ProofNetIR.Formula},
  tree.infer? = some sequent →
    ∃ certificate, tree.desequentialize? = some certificate ∧ certificate.conclusionFormulas? = some sequent
```

### `ProofNetIR.CutFreeDerivation.desequentialize?_exists_checked_of_infer?`

Kind: theorem.

Formula-level validation constructs a certificate with the requested
boundary and a kernel proof that the executable checker accepts it.

```lean
ProofNetIR.CutFreeDerivation.desequentialize?_exists_checked_of_infer? : ∀ {tree : ProofNetIR.CutFreeDerivation} {sequent : List ProofNetIR.Formula},
  tree.infer? = some sequent →
    ∃ certificate,
      tree.desequentialize? = some certificate ∧
        certificate.conclusionFormulas? = some sequent ∧ certificate.check = true
```

### `ProofNetIR.CutFreeDerivation.CheckedCertificate`

Kind: inductive type.

A certificate bundled with the kernel-checked fact that the executable
reference checker accepted it.

```lean
ProofNetIR.CutFreeDerivation.CheckedCertificate : Type
```

### `ProofNetIR.CutFreeDerivation.desequentializeChecked?`

Kind: definition.

Desequentialize and retain the result only when the reference proof-net
checker accepts it.

```lean
ProofNetIR.CutFreeDerivation.desequentializeChecked? : ProofNetIR.CutFreeDerivation → Option ProofNetIR.CutFreeDerivation.CheckedCertificate
```

### `ProofNetIR.CutFreeDerivation.desequentializeChecked?_exists_of_infer?`

Kind: theorem.

The checker-gated public desequentializer is total on formula-valid rule
trees; its returned payload retains the checker-acceptance proof.

```lean
ProofNetIR.CutFreeDerivation.desequentializeChecked?_exists_of_infer? : ∀ {tree : ProofNetIR.CutFreeDerivation} {sequent : List ProofNetIR.Formula},
  tree.infer? = some sequent → ∃ result, tree.desequentializeChecked? = some result
```

### `ProofNetIR.CutFreeDerivation.ElaboratedCertificate`

Kind: inductive type.

End-to-end checked result connecting the inferred sequent, an independent
kernel-typed derivation, the proof-net boundary labels, and checker acceptance.

```lean
ProofNetIR.CutFreeDerivation.ElaboratedCertificate : Type
```

### `ProofNetIR.CutFreeDerivation.elaborate?`

Kind: definition.

The strongest public v0.2+ entry point for first-order derivation trees.
Every returned value carries both sequent-calculus and proof-net evidence.

```lean
ProofNetIR.CutFreeDerivation.elaborate? : ProofNetIR.CutFreeDerivation → Option ProofNetIR.CutFreeDerivation.ElaboratedCertificate
```

### `ProofNetIR.CutFreeDerivation.elaborate?_exists_of_infer?`

Kind: theorem.

The strongest public elaborator is total on derivation trees accepted by
the independent formula inference pass.

```lean
ProofNetIR.CutFreeDerivation.elaborate?_exists_of_infer? : ∀ {tree : ProofNetIR.CutFreeDerivation} {sequent : List ProofNetIR.Formula},
  tree.infer? = some sequent → ∃ result, tree.elaborate? = some result
```

## Equivalence and canonical keys

### `ProofNetIR.VertexRenaming`

Kind: inductive type.

A bijective renaming of natural-number vertices that preserves exactly the
vertices below `bound`. Vertices outside the certificate remain outside, so
renaming cannot turn a malformed out-of-bounds reference into a valid one.

```lean
ProofNetIR.VertexRenaming : Nat → Type
```

### `ProofNetIR.Certificate.ReindexEquivalent`

Kind: definition.

Certificate equality modulo an explicit bounded vertex bijection. Formula
syntax, ordered tensor/par premises, link order, and conclusion order are all
preserved; only vertex names change.

```lean
ProofNetIR.Certificate.ReindexEquivalent : ProofNetIR.Certificate → ProofNetIR.Certificate → Prop
```

### `ProofNetIR.Certificate.LinkPermutationEquivalent`

Kind: inductive type.

Equality of proof-net certificates modulo the storage order of links.
Formula occurrences and the ordered conclusion boundary remain literal.

```lean
ProofNetIR.Certificate.LinkPermutationEquivalent : ProofNetIR.Certificate → ProofNetIR.Certificate → Prop
```

### `ProofNetIR.Certificate.ProofNetEquivalent`

Kind: inductive type.

The equivalence generated by bounded vertex renaming and semantically
irrelevant link-list permutation. This is the minimum relation suitable for a
general sequentialization theorem, because desequentialization emits links in
rule-tree postorder while the checker accepts any storage order.

```lean
ProofNetIR.Certificate.ProofNetEquivalent : ProofNetIR.Certificate → ProofNetIR.Certificate → Prop
```

### `ProofNetIR.Certificate.reindexEquivalent?`

Kind: definition.

Executable comparison of v0.3 certificate normal forms. Its correctness
theorem requires structural well-formedness, exactly the domain on which the
normal forms are proved to be in-class representatives.

```lean
ProofNetIR.Certificate.reindexEquivalent? : ProofNetIR.Certificate → ProofNetIR.Certificate → Bool
```

### `ProofNetIR.Certificate.reindexEquivalent?_eq_true_iff_of_check`

Kind: theorem.

On checker-accepted inputs, the Boolean comparison decides exactly the
order-preserving bounded-reindex equivalence relation.

```lean
ProofNetIR.Certificate.reindexEquivalent?_eq_true_iff_of_check : ∀ {left right : ProofNetIR.Certificate},
  left.check = true → right.check = true → (left.reindexEquivalent? right = true ↔ left.ReindexEquivalent right)
```

### `ProofNetIR.Certificate.proofNetEquivalent?`

Kind: definition.

Executable decision procedure for the proof-net identity used by general
sequentialization.  Completeness is stated below on structurally well-formed
left certificates, which includes every checker-accepted certificate.

```lean
ProofNetIR.Certificate.proofNetEquivalent? : ProofNetIR.Certificate → ProofNetIR.Certificate → Bool
```

### `ProofNetIR.Certificate.proofNetEquivalent?_eq_true_iff`

Kind: theorem.

On the library's well-formed domain, the executable Boolean agrees exactly
with the equivalence generated by bounded vertex renaming and link-list
permutation.  It does not quotient the ordered conclusion boundary.

```lean
ProofNetIR.Certificate.proofNetEquivalent?_eq_true_iff : ∀ {left right : ProofNetIR.Certificate},
  left.StructurallyWellFormed → (left.proofNetEquivalent? right = true ↔ left.ProofNetEquivalent right)
```

### `ProofNetIR.Certificate.proofNetIdentityCandidateCount`

Kind: definition.

Number of formula-compatible vertex orders that the exact proof-net
identity decision will consider after enforcing the ordered conclusion
boundary during generation.  This diagnostic exposes search pressure without
changing the exact Boolean contract.

```lean
ProofNetIR.Certificate.proofNetIdentityCandidateCount : ProofNetIR.Certificate → ProofNetIR.Certificate → Nat
```

### `ProofNetIR.CutFreeDerivation.CheckedCertificate.sameProofNet?`

Kind: definition.

Exact pairwise proof-net identity for checker-accepted certificates.

This is the supported production identity boundary.  It quotients bounded
vertex renaming and link-list storage order, while preserving ordered
conclusions, connective premise order, formula labels, and axiom orientation.
It is deliberately not arbitrary graph isomorphism.

```lean
ProofNetIR.CutFreeDerivation.CheckedCertificate.sameProofNet? : ProofNetIR.CutFreeDerivation.CheckedCertificate → ProofNetIR.CutFreeDerivation.CheckedCertificate → Bool
```

### `ProofNetIR.CutFreeDerivation.CheckedCertificate.sameProofNet?_eq_true_iff`

Kind: theorem.

The checked identity API decides exactly `ProofNetEquivalent`; callers do
not need to recover structural premises from checker acceptance themselves.

```lean
ProofNetIR.CutFreeDerivation.CheckedCertificate.sameProofNet?_eq_true_iff : ∀ {left right : ProofNetIR.CutFreeDerivation.CheckedCertificate},
  left.sameProofNet? right = true ↔ left.certificate.ProofNetEquivalent right.certificate
```

### `ProofNetIR.Certificate.proofNetCanonicalFamily`

Kind: definition.

The finite family of all v0.3 reindex-normal representatives obtained by
permuting only link storage order.  Membership is the canonical object: list
order and duplicate enumeration paths are intentionally not part of its
meaning.

For structurally well-formed certificates, extensional equality of these
finite families is proved below to be equivalent to the public
`ProofNetEquivalent` relation.  Ordered conclusions, tensor/par premise order,
formula labels, and axiom endpoint orientation remain significant.

```lean
ProofNetIR.Certificate.proofNetCanonicalFamily : ProofNetIR.Certificate → List ProofNetIR.Certificate
```

### `ProofNetIR.Certificate.proofNetEquivalent_iff_canonicalFamily`

Kind: theorem.

On the library's structurally well-formed domain, extensional equality of
the finite canonical families is a complete invariant for exactly
`ProofNetEquivalent`.

This is not arbitrary graph isomorphism: ordered conclusions, ordered
tensor/par premises, formula labels, and axiom endpoint orientation remain
part of the identity contract.

```lean
ProofNetIR.Certificate.proofNetEquivalent_iff_canonicalFamily : ∀ {left right : ProofNetIR.Certificate},
  left.StructurallyWellFormed →
    right.StructurallyWellFormed →
      (left.ProofNetEquivalent right ↔
        ∀ (candidate : ProofNetIR.Certificate),
          candidate ∈ left.proofNetCanonicalFamily ↔ candidate ∈ right.proofNetCanonicalFamily)
```

### `ProofNetIR.Certificate.proofNetEquivalent_iff_canonicalFamily_of_check`

Kind: theorem.

Checker acceptance supplies the structural premises of the complete
canonical-family theorem automatically.

```lean
ProofNetIR.Certificate.proofNetEquivalent_iff_canonicalFamily_of_check : ∀ {left right : ProofNetIR.Certificate},
  left.check = true →
    right.check = true →
      (left.ProofNetEquivalent right ↔
        ∀ (candidate : ProofNetIR.Certificate),
          candidate ∈ left.proofNetCanonicalFamily ↔ candidate ∈ right.proofNetCanonicalFamily)
```

### `ProofNetIR.Certificate.proofNetCanonicalStringCandidates`

Kind: definition.

The finite serialized image of `proofNetCanonicalFamily`.  Duplicates are
harmless because the fingerprint depends only on the least member.

```lean
ProofNetIR.Certificate.proofNetCanonicalStringCandidates : ProofNetIR.Certificate → List String
```

### `ProofNetIR.Certificate.proofNetCanonicalFingerprint?`

Kind: definition.

A compact, executable fingerprint obtained by taking the lexicographically
least v0.3 string in the complete finite canonical family.

This is currently an invariant, not a complete decision key: use
`CheckedCertificate.sameProofNet?` for exact pairwise proof-net identity.

```lean
ProofNetIR.Certificate.proofNetCanonicalFingerprint? : ProofNetIR.Certificate → Option String
```

### `ProofNetIR.Certificate.proofNetCanonicalFingerprint?_exists`

Kind: theorem.

The compact fingerprint is total, although it retains `Option` in its
executable type to expose the finite-minimum operation directly.

```lean
ProofNetIR.Certificate.proofNetCanonicalFingerprint?_exists : ∀ (certificate : ProofNetIR.Certificate), ∃ fingerprint, certificate.proofNetCanonicalFingerprint? = some fingerprint
```

### `ProofNetIR.Certificate.proofNetCanonicalFingerprint?_mem`

Kind: theorem.

Successful fingerprint selection returns an actual serialized member of
the complete finite canonical family.

```lean
ProofNetIR.Certificate.proofNetCanonicalFingerprint?_mem : ∀ (certificate : ProofNetIR.Certificate) {fingerprint : String},
  certificate.proofNetCanonicalFingerprint? = some fingerprint →
    fingerprint ∈ certificate.proofNetCanonicalStringCandidates
```

### `ProofNetIR.Certificate.ProofNetEquivalent.proofNetCanonicalFingerprint?_eq`

Kind: theorem.

`ProofNetEquivalent` certificates have exactly the same compact
fingerprint.  No converse is claimed until the serialized encoding is proved
injective on canonical-family members.

```lean
ProofNetIR.Certificate.ProofNetEquivalent.proofNetCanonicalFingerprint?_eq : ∀ {left right : ProofNetIR.Certificate},
  left.ProofNetEquivalent right → left.proofNetCanonicalFingerprint? = right.proofNetCanonicalFingerprint?
```

### `ProofNetIR.Formula.structuralCode`

Kind: definition.

Explicit structural token code for one unit-free MLL formula.

```lean
ProofNetIR.Formula.structuralCode : ProofNetIR.Formula → List String
```

### `ProofNetIR.Formula.structuralCode_injective`

Kind: theorem.

Formula structural codes reflect literal formula equality.

```lean
ProofNetIR.Formula.structuralCode_injective : Function.Injective ProofNetIR.Formula.structuralCode
```

### `ProofNetIR.Link.structuralCode`

Kind: definition.

Explicit structural token code for one local proof-net link.

```lean
ProofNetIR.Link.structuralCode : ProofNetIR.Link → List String
```

### `ProofNetIR.Link.structuralCode_injective`

Kind: theorem.

Link structural codes reflect literal link equality.

```lean
ProofNetIR.Link.structuralCode_injective : Function.Injective ProofNetIR.Link.structuralCode
```

### `ProofNetIR.Certificate.structuralCode`

Kind: definition.

Versioned, equality-reflecting token code for the literal certificate
fields.  This code does not normalize vertices or link order by itself.

```lean
ProofNetIR.Certificate.structuralCode : ProofNetIR.Certificate → List String
```

### `ProofNetIR.Certificate.structuralCode_injective`

Kind: theorem.

The versioned structural code reflects literal certificate equality.

```lean
ProofNetIR.Certificate.structuralCode_injective : Function.Injective ProofNetIR.Certificate.structuralCode
```

### `ProofNetIR.Certificate.proofNetCanonicalCodeCandidates`

Kind: definition.

Injective structural codes for every member of the complete finite
canonical family.

```lean
ProofNetIR.Certificate.proofNetCanonicalCodeCandidates : ProofNetIR.Certificate → List (List String)
```

### `ProofNetIR.Certificate.proofNetCanonicalCode?`

Kind: definition.

The lexicographically least injective structural code in the complete
canonical family.  Unlike `proofNetCanonicalFingerprint?`, this typed token
key has a reverse-completeness theorem below.

```lean
ProofNetIR.Certificate.proofNetCanonicalCode? : ProofNetIR.Certificate → Option (List String)
```

### `ProofNetIR.Certificate.proofNetCanonicalCode?_exists`

Kind: theorem.

The exact structural canonical code is total for every certificate.

```lean
ProofNetIR.Certificate.proofNetCanonicalCode?_exists : ∀ (certificate : ProofNetIR.Certificate), ∃ code, certificate.proofNetCanonicalCode? = some code
```

### `ProofNetIR.Certificate.proofNetCanonicalCode?_mem`

Kind: theorem.

A selected exact code comes from an actual canonical-family member.

```lean
ProofNetIR.Certificate.proofNetCanonicalCode?_mem : ∀ (certificate : ProofNetIR.Certificate) {code : List String},
  certificate.proofNetCanonicalCode? = some code → code ∈ certificate.proofNetCanonicalCodeCandidates
```

### `ProofNetIR.Certificate.ProofNetEquivalent.proofNetCanonicalCode?_eq`

Kind: theorem.

Generated proof-net equivalence preserves the exact structural canonical
code.

```lean
ProofNetIR.Certificate.ProofNetEquivalent.proofNetCanonicalCode?_eq : ∀ {left right : ProofNetIR.Certificate},
  left.ProofNetEquivalent right → left.proofNetCanonicalCode? = right.proofNetCanonicalCode?
```

### `ProofNetIR.Certificate.proofNetEquivalent_iff_canonicalCode`

Kind: theorem.

On structurally well-formed certificates, equality of the typed structural
canonical code is equivalent to exactly `ProofNetEquivalent`.

```lean
ProofNetIR.Certificate.proofNetEquivalent_iff_canonicalCode : ∀ {left right : ProofNetIR.Certificate},
  left.StructurallyWellFormed →
    right.StructurallyWellFormed →
      (left.ProofNetEquivalent right ↔ left.proofNetCanonicalCode? = right.proofNetCanonicalCode?)
```

### `ProofNetIR.Certificate.proofNetEquivalent_iff_canonicalCode_of_check`

Kind: theorem.

Checker acceptance supplies the structural premises for the exact typed
canonical-code theorem.

```lean
ProofNetIR.Certificate.proofNetEquivalent_iff_canonicalCode_of_check : ∀ {left right : ProofNetIR.Certificate},
  left.check = true →
    right.check = true → (left.ProofNetEquivalent right ↔ left.proofNetCanonicalCode? = right.proofNetCanonicalCode?)
```

### `ProofNetIR.CanonicalKey`

Kind: inductive type.

Opaque, equality-comparable canonical key payload.  Values produced by
`Certificate.proofNetCanonicalKey?` carry the exact `ProofNetEquivalent`
semantics; arbitrary parsed values must be matched against such a local key.

```lean
ProofNetIR.CanonicalKey : Type
```

### `ProofNetIR.Certificate.proofNetCanonicalKey?`

Kind: definition.

Exact typed canonical key for the generated `ProofNetEquivalent` relation.
The option is total by `proofNetCanonicalKey?_exists`, but its factorial
implementation makes it a specification oracle rather than the bounded public
wire generator.

```lean
ProofNetIR.Certificate.proofNetCanonicalKey? : ProofNetIR.Certificate → Option ProofNetIR.CanonicalKey
```

### `ProofNetIR.Certificate.proofNetCanonicalKey?_exists`

Kind: theorem.

Every certificate has a typed canonical key.

```lean
ProofNetIR.Certificate.proofNetCanonicalKey?_exists : ∀ (certificate : ProofNetIR.Certificate), ∃ key, certificate.proofNetCanonicalKey? = some key
```

### `ProofNetIR.Certificate.ProofNetEquivalent.proofNetCanonicalKey?_eq`

Kind: theorem.

Generated proof-net equivalence preserves the typed wire key.

```lean
ProofNetIR.Certificate.ProofNetEquivalent.proofNetCanonicalKey?_eq : ∀ {left right : ProofNetIR.Certificate},
  left.ProofNetEquivalent right → left.proofNetCanonicalKey? = right.proofNetCanonicalKey?
```

### `ProofNetIR.Certificate.proofNetEquivalent_iff_canonicalKey`

Kind: theorem.

On structurally well-formed certificates, typed wire-key equality is
equivalent to exactly `ProofNetEquivalent`.

```lean
ProofNetIR.Certificate.proofNetEquivalent_iff_canonicalKey : ∀ {left right : ProofNetIR.Certificate},
  left.StructurallyWellFormed →
    right.StructurallyWellFormed →
      (left.ProofNetEquivalent right ↔ left.proofNetCanonicalKey? = right.proofNetCanonicalKey?)
```

### `ProofNetIR.Certificate.proofNetEquivalent_iff_canonicalKey_of_check`

Kind: theorem.

Checker acceptance supplies the premises for exact typed wire-key
comparison.

```lean
ProofNetIR.Certificate.proofNetEquivalent_iff_canonicalKey_of_check : ∀ {left right : ProofNetIR.Certificate},
  left.check = true →
    right.check = true → (left.ProofNetEquivalent right ↔ left.proofNetCanonicalKey? = right.proofNetCanonicalKey?)
```

### `ProofNetIR.Certificate.proofNetEquivalent_iff_canonicalKeyWithinLimit`

Kind: theorem.

Within the public generation ceiling, equality of bounded keys is
equivalent to exactly `ProofNetEquivalent`.

```lean
ProofNetIR.Certificate.proofNetEquivalent_iff_canonicalKeyWithinLimit : ∀ {left right : ProofNetIR.Certificate},
  left.StructurallyWellFormed →
    right.StructurallyWellFormed →
      left.links.length ≤ ProofNetIR.CanonicalKey.maxGenerationLinks →
        right.links.length ≤ ProofNetIR.CanonicalKey.maxGenerationLinks →
          (left.ProofNetEquivalent right ↔
            left.proofNetCanonicalKeyWithinLimit? = right.proofNetCanonicalKeyWithinLimit?)
```

### `ProofNetIR.Certificate.proofNetEquivalent_iff_canonicalKeyWithinLimit_of_check`

Kind: theorem.

Checker acceptance supplies the structural premises for bounded exact key
comparison.

```lean
ProofNetIR.Certificate.proofNetEquivalent_iff_canonicalKeyWithinLimit_of_check : ∀ {left right : ProofNetIR.Certificate},
  left.check = true →
    right.check = true →
      left.links.length ≤ ProofNetIR.CanonicalKey.maxGenerationLinks →
        right.links.length ≤ ProofNetIR.CanonicalKey.maxGenerationLinks →
          (left.ProofNetEquivalent right ↔
            left.proofNetCanonicalKeyWithinLimit? = right.proofNetCanonicalKeyWithinLimit?)
```

### `ProofNetIR.Certificate.intrinsicTraversalVertices`

Kind: definition.

Deduplicated intrinsic occurrence order.  Deduplication only affects
malformed inputs; the structural completeness theorem establishes exact
coverage on the supported domain.

```lean
ProofNetIR.Certificate.intrinsicTraversalVertices : ProofNetIR.Certificate → List ProofNetIR.Vertex
```

### `ProofNetIR.Certificate.IntrinsicTraversalComplete`

Kind: inductive type.

The intrinsic order contains exactly every formula-array vertex once on
the structurally well-formed domain.

```lean
ProofNetIR.Certificate.IntrinsicTraversalComplete : ProofNetIR.Certificate → Prop
```

### `ProofNetIR.Certificate.StructurallyWellFormed.intrinsicTraversalComplete`

Kind: theorem.

Structural well-formedness makes the intrinsic traversal an exact
enumeration of the formula array.

```lean
ProofNetIR.Certificate.StructurallyWellFormed.intrinsicTraversalComplete : ∀ {certificate : ProofNetIR.Certificate}, certificate.StructurallyWellFormed → certificate.IntrinsicTraversalComplete
```

### `ProofNetIR.Certificate.intrinsicOrderedLinks`

Kind: definition.

Links emitted in occurrence order, once per orientation-sensitive owner.

```lean
ProofNetIR.Certificate.intrinsicOrderedLinks : ProofNetIR.Certificate → List ProofNetIR.Link
```

### `ProofNetIR.Certificate.StructurallyWellFormed.intrinsicOrderedLinks_perm`

Kind: theorem.

On structurally well-formed certificates the intrinsic owner emission is
exactly a permutation of the submitted link multiset.

```lean
ProofNetIR.Certificate.StructurallyWellFormed.intrinsicOrderedLinks_perm : ∀ {certificate : ProofNetIR.Certificate},
  certificate.StructurallyWellFormed → certificate.intrinsicOrderedLinks.Perm certificate.links
```

### `ProofNetIR.Certificate.intrinsicCanonicalize`

Kind: definition.

Non-factorial normalization.  The intrinsic order fixes link storage
before the already proved v0.3 reindex-normalizer removes submitted vertex
numbers.

```lean
ProofNetIR.Certificate.intrinsicCanonicalize : ProofNetIR.Certificate → ProofNetIR.Certificate
```

### `ProofNetIR.Certificate.ProofNetEquivalent.intrinsicCanonicalize_eq`

Kind: theorem.

The non-factorial normalization is invariant under the exact public
proof-net identity relation.

```lean
ProofNetIR.Certificate.ProofNetEquivalent.intrinsicCanonicalize_eq : ∀ {left right : ProofNetIR.Certificate},
  left.ProofNetEquivalent right → left.intrinsicCanonicalize = right.intrinsicCanonicalize
```

### `ProofNetIR.Certificate.StructurallyWellFormed.intrinsicCanonicalize_proofNetEquivalent`

Kind: theorem.

On the supported structural domain, intrinsic normalization stays inside
the input's exact `ProofNetEquivalent` class.

```lean
ProofNetIR.Certificate.StructurallyWellFormed.intrinsicCanonicalize_proofNetEquivalent : ∀ {certificate : ProofNetIR.Certificate},
  certificate.StructurallyWellFormed → certificate.ProofNetEquivalent certificate.intrinsicCanonicalize
```

### `ProofNetIR.Certificate.proofNetEquivalent_iff_intrinsicCanonicalize_eq_of_check`

Kind: theorem.

Checker acceptance supplies the structural premises of the exact
non-factorial canonical-form theorem.

```lean
ProofNetIR.Certificate.proofNetEquivalent_iff_intrinsicCanonicalize_eq_of_check : ∀ {left right : ProofNetIR.Certificate},
  left.check = true →
    right.check = true → (left.ProofNetEquivalent right ↔ left.intrinsicCanonicalize = right.intrinsicCanonicalize)
```

### `ProofNetIR.Certificate.intrinsicCanonicalCode`

Kind: definition.

Polynomially generated, injective structural token code for the intrinsic
canonical form.

```lean
ProofNetIR.Certificate.intrinsicCanonicalCode : ProofNetIR.Certificate → List String
```

### `ProofNetIR.Certificate.proofNetEquivalent_iff_intrinsicCanonicalCode_eq_of_check`

Kind: theorem.

Checker acceptance supplies the structural premises of the exact
intrinsic-code theorem.

```lean
ProofNetIR.Certificate.proofNetEquivalent_iff_intrinsicCanonicalCode_eq_of_check : ∀ {left right : ProofNetIR.Certificate},
  left.check = true →
    right.check = true → (left.ProofNetEquivalent right ↔ left.intrinsicCanonicalCode = right.intrinsicCanonicalCode)
```

### `ProofNetIR.IntrinsicCanonicalKey`

Kind: inductive type.

Opaque equality-comparable payload for the non-factorial canonical key.

```lean
ProofNetIR.IntrinsicCanonicalKey : Type
```

### `ProofNetIR.Certificate.intrinsicCanonicalKey`

Kind: definition.

Total non-factorial exact key payload.  Reverse exactness requires the
same structural premise as `intrinsicCanonicalize`.

```lean
ProofNetIR.Certificate.intrinsicCanonicalKey : ProofNetIR.Certificate → ProofNetIR.IntrinsicCanonicalKey
```

### `ProofNetIR.Certificate.proofNetEquivalent_iff_intrinsicCanonicalKey_eq_of_check`

Kind: theorem.

Checker acceptance supplies the structural premises for exact typed
intrinsic-key comparison.

```lean
ProofNetIR.Certificate.proofNetEquivalent_iff_intrinsicCanonicalKey_eq_of_check : ∀ {left right : ProofNetIR.Certificate},
  left.check = true →
    right.check = true → (left.ProofNetEquivalent right ↔ left.intrinsicCanonicalKey = right.intrinsicCanonicalKey)
```

### `ProofNetIR.Certificate.equivalenceCanonicalString`

Kind: definition.

Compact v0.3 `reindex-v1` JSON key, invariant under the documented
order-preserving bounded vertex-renaming relation.

```lean
ProofNetIR.Certificate.equivalenceCanonicalString : ProofNetIR.Certificate → String
```

## Sequentialization

### `ProofNetIR.SequentializationResult`

Kind: inductive type.

Evidence returned by the future general sequentializer. The result is
deliberately stronger than an `Option CutFreeDerivation`: it connects
first-order inference, desequentialization, ordered boundary labels, and the
semantic proof-net equivalence relation.

```lean
ProofNetIR.SequentializationResult : ProofNetIR.Certificate → Type
```

### `ProofNetIR.ExecutableSequentializationResult`

Kind: inductive type.

Runtime result for an accepted certificate.  Unlike the proposition-level
`SequentializationResult`, this value is produced by an executable search and
can be inspected by downstream programs.  It already carries the exact input
boundary, independent inference, desequentialization, output-check, and exact
proof-net-equivalence facts.

```lean
ProofNetIR.ExecutableSequentializationResult : ProofNetIR.Certificate → Type
```

### `ProofNetIR.SequentializationError`

Kind: inductive type.

Structured failure returned by the executable proof-net sequentializer.
The stage is stable enough for callers to classify failures; the message is
intended for humans.

```lean
ProofNetIR.SequentializationError : Type
```

### `ProofNetIR.Certificate.sequentialization_of_check`

Kind: theorem.

Full sequentialization for every checker-accepted unit-free cut-free MLL
certificate.  The recursion follows the proved terminal-par/splitting-tensor
dichotomy.  Each recursive premise is strictly smaller in formula occurrences,
and each inverse rule reconstructs a concrete first-order derivation together
with proof-net equivalence evidence.

```lean
ProofNetIR.Certificate.sequentialization_of_check : ∀ (certificate : ProofNetIR.Certificate),
  certificate.check = true → Nonempty (ProofNetIR.SequentializationResult certificate)
```

### `ProofNetIR.Certificate.sequentialize`

Kind: definition.

Executable certificate-to-derivation API.  Successful results are
proof-bearing values, while failures retain a stable stage and certificate
size instead of collapsing to `none`.

```lean
ProofNetIR.Certificate.sequentialize : (certificate : ProofNetIR.Certificate) →
  Except ProofNetIR.SequentializationError (ProofNetIR.ExecutableSequentializationResult certificate)
```

### `ProofNetIR.Certificate.sequentialize_complete`

Kind: theorem.

Universal success theorem for the public runtime API.  Every certificate
accepted by the reference checker evaluates to a proof-bearing executable
sequentialization result; staged errors are therefore reserved for rejected
inputs or violations of the proved implementation contract.

```lean
ProofNetIR.Certificate.sequentialize_complete : ∀ (certificate : ProofNetIR.Certificate),
  certificate.check = true → ∃ result, certificate.sequentialize = Except.ok result
```

### `ProofNetIR.DerivationVerificationResult`

Kind: inductive type.

Proof-bearing result of checking a proposed cut-free derivation against a
certificate.

Unlike `Certificate.check`, this verifier does not enumerate switching graphs.
It validates the submitted certificate structurally, independently infers and
desequentializes the derivation, and compares the two proof nets through the
proved non-factorial intrinsic canonical code.

```lean
ProofNetIR.DerivationVerificationResult : ProofNetIR.Certificate → Type
```

### `ProofNetIR.Certificate.verifyDerivation?`

Kind: definition.

Verify a proposed derivation without evaluating the exponential
all-switchings checker on the input.

The only Boolean gate on the input is `wellFormed`; proof-net identity is
decided by the polynomial intrinsic canonical code.  The acceptance proof for
the derivation-produced output is supplied by
`CutFreeDerivation.desequentialize?_check` and is erased at runtime.

```lean
ProofNetIR.Certificate.verifyDerivation? : (input : ProofNetIR.Certificate) → ProofNetIR.CutFreeDerivation → Option (ProofNetIR.DerivationVerificationResult input)
```

### `ProofNetIR.Certificate.verifyDerivation?_sound`

Kind: theorem.

Successful verification exposes the complete proof-bearing contract
without requiring clients to unfold the executable verifier.

```lean
ProofNetIR.Certificate.verifyDerivation?_sound : ∀ {input : ProofNetIR.Certificate} {tree : ProofNetIR.CutFreeDerivation}
  {result : ProofNetIR.DerivationVerificationResult input},
  input.verifyDerivation? tree = some result →
    input.StructurallyWellFormed ∧
      input.conclusionFormulas? = some result.sequent ∧
        result.tree.infer? = some result.sequent ∧
          result.tree.desequentialize? = some result.output ∧
            result.output.check = true ∧ result.output.ProofNetEquivalent input
```

### `ProofNetIR.Certificate.verifyDerivation?_complete`

Kind: theorem.

The verifier is complete for every structurally well-formed input and
proposed derivation whose desequentialization is proof-net-equivalent to that
input.

```lean
ProofNetIR.Certificate.verifyDerivation?_complete : ∀ {input output : ProofNetIR.Certificate} {tree : ProofNetIR.CutFreeDerivation} {sequent : List ProofNetIR.Formula},
  input.StructurallyWellFormed →
    input.conclusionFormulas? = some sequent →
      tree.infer? = some sequent →
        tree.desequentialize? = some output →
          output.ProofNetEquivalent input → ∃ result, input.verifyDerivation? tree = some result
```

### `ProofNetIR.Certificate.verifiesDerivation`

Kind: definition.

Boolean convenience wrapper for callers that only need acceptance.

```lean
ProofNetIR.Certificate.verifiesDerivation : ProofNetIR.Certificate → ProofNetIR.CutFreeDerivation → Bool
```

### `ProofNetIR.Certificate.verifiesDerivation_eq_true_iff`

Kind: theorem.

Boolean acceptance is exactly the existence of a proof-bearing verifier
result.

```lean
ProofNetIR.Certificate.verifiesDerivation_eq_true_iff : ∀ {input : ProofNetIR.Certificate} {tree : ProofNetIR.CutFreeDerivation},
  input.verifiesDerivation tree = true ↔ ∃ result, input.verifyDerivation? tree = some result
```

### `ProofNetIR.Certificate.reconstructDerivationWithFuel?`

Kind: definition.

Fuel-bounded inverse-rule reconstruction that never evaluates
`Certificate.check` or enumerates switching graphs.

Every returned candidate has already passed `verifyDerivation?`, so the result
contains an exact `ProofNetEquivalent` proof. Fuel bounds recursive formula
occurrence removal; the public wrapper supplies one more than the input
formula count.

```lean
ProofNetIR.Certificate.reconstructDerivationWithFuel? : Nat → (input : ProofNetIR.Certificate) → Option (ProofNetIR.DerivationVerificationResult input)
```

### `ProofNetIR.Certificate.reconstructDerivationWithFuel?_complete`

Kind: theorem.

Universal completeness of the checker-free inverse-rule search at every
fuel bound strictly above the input occurrence count. The theorem uses the
reference checker only as its mathematical premise; the executable function
itself has no checker call.

```lean
ProofNetIR.Certificate.reconstructDerivationWithFuel?_complete : ∀ (fuel : Nat) (input : ProofNetIR.Certificate),
  input.check = true →
    input.formulas.size < fuel →
      ∃ result, ProofNetIR.Certificate.reconstructDerivationWithFuel? fuel input = some result
```

### `ProofNetIR.Certificate.reconstructDerivation?`

Kind: definition.

Attempt to reconstruct and verify a cut-free derivation from a bare
certificate without calling the all-switchings checker.  A structure-guided
fast path constructs a complete tree and verifies it once; any failed
heuristic attempt falls back to the proved exhaustive reconstruction.

```lean
ProofNetIR.Certificate.reconstructDerivation? : (input : ProofNetIR.Certificate) → Option (ProofNetIR.DerivationVerificationResult input)
```

### `ProofNetIR.Certificate.reconstructDerivation?_sound`

Kind: theorem.

Soundness is carried directly by the dependent result: a successful
checker-free reconstruction has a formula-valid cut-free derivation whose
desequentialization is accepted and exactly proof-net-equivalent to the
input.

```lean
ProofNetIR.Certificate.reconstructDerivation?_sound : ∀ {input : ProofNetIR.Certificate} {result : ProofNetIR.DerivationVerificationResult input},
  input.reconstructDerivation? = some result →
    input.StructurallyWellFormed ∧
      input.conclusionFormulas? = some result.sequent ∧
        result.tree.infer? = some result.sequent ∧
          result.tree.desequentialize? = some result.output ∧
            result.output.check = true ∧ result.output.ProofNetEquivalent input
```

### `ProofNetIR.Certificate.reconstructDerivation?_accepted`

Kind: theorem.

A successful checker-free reconstruction is accepted by the reference
proof-net checker. This is a theorem about the returned proof evidence; the
runtime reconstruction function does not evaluate the reference checker.

```lean
ProofNetIR.Certificate.reconstructDerivation?_accepted : ∀ {input : ProofNetIR.Certificate} {result : ProofNetIR.DerivationVerificationResult input},
  input.reconstructDerivation? = some result → input.check = true
```

### `ProofNetIR.Certificate.reconstructDerivation?_complete`

Kind: theorem.

Every certificate accepted by the reference all-switchings semantics is
accepted by the executable checker-free reconstruction path.

```lean
ProofNetIR.Certificate.reconstructDerivation?_complete : ∀ (input : ProofNetIR.Certificate), input.check = true → ∃ result, input.reconstructDerivation? = some result
```

### `ProofNetIR.Certificate.reconstructsDerivation`

Kind: definition.

Boolean convenience wrapper for checker-free automatic reconstruction.

```lean
ProofNetIR.Certificate.reconstructsDerivation : ProofNetIR.Certificate → Bool
```

### `ProofNetIR.Certificate.reconstructsDerivation_eq_true_iff_check`

Kind: theorem.

The checker-free automatic reconstruction decision accepts exactly the
same certificates as the reference all-switchings checker.

```lean
ProofNetIR.Certificate.reconstructsDerivation_eq_true_iff_check : ∀ (input : ProofNetIR.Certificate), input.reconstructsDerivation = true ↔ input.check = true
```

### `ProofNetIR.Certificate.reconstructsDerivation_eq_check`

Kind: theorem.

Boolean equality between checker-free reconstruction and the reference
all-switchings checker.

```lean
ProofNetIR.Certificate.reconstructsDerivation_eq_check : ∀ (input : ProofNetIR.Certificate), input.reconstructsDerivation = input.check
```

### `ProofNetIR.ReconstructionLimits`

Kind: inductive type.

Explicit input-size envelope for the fail-closed reconstruction API.
These limits bound formula occurrences, stored links, and ordered conclusions
before structure-guided search begins.

```lean
ProofNetIR.ReconstructionLimits : Type
```

### `ProofNetIR.ReconstructionLimits.qualified`

Kind: definition.

CI-qualified default envelope.  The adversarial suite exercises accepted
inputs through 126 formula occurrences, 94 links, and 22 conclusions below
these ceilings.

```lean
ProofNetIR.ReconstructionLimits.qualified : ProofNetIR.ReconstructionLimits
```

### `ProofNetIR.ReconstructionError`

Kind: inductive type.

Structured failures from bounded structure-guided reconstruction.
`noCandidate` and `candidateVerificationFailed` are deliberately
inconclusive: callers must not reinterpret them as logical rejection.

```lean
ProofNetIR.ReconstructionError : Type
```

### `ProofNetIR.ReconstructionError.message`

Kind: definition.

Stable reader-facing diagnostic for bounded reconstruction failures.

```lean
ProofNetIR.ReconstructionError.message : ProofNetIR.ReconstructionError → String
```

### `ProofNetIR.Certificate.reconstructDerivationWithinLimits`

Kind: definition.

Fail-closed reconstruction within an explicit input-size envelope.

Unlike `reconstructDerivation?`, this API never enters the exhaustive
formula-order fallback.  A limit error or heuristic miss is not a logical
rejection.  Every successful result has still passed `verifyDerivation?` and
carries the same dependent proof evidence as the unbounded API.

```lean
ProofNetIR.Certificate.reconstructDerivationWithinLimits : (input : ProofNetIR.Certificate) →
  optParam ProofNetIR.ReconstructionLimits ProofNetIR.ReconstructionLimits.qualified →
    Except ProofNetIR.ReconstructionError (ProofNetIR.DerivationVerificationResult input)
```

### `ProofNetIR.Certificate.reconstructDerivationWithinLimits_sound`

Kind: theorem.

A successful bounded reconstruction carries the full public soundness
contract, independently of which limits admitted the input.

```lean
ProofNetIR.Certificate.reconstructDerivationWithinLimits_sound : ∀ {input : ProofNetIR.Certificate} {limits : ProofNetIR.ReconstructionLimits}
  {result : ProofNetIR.DerivationVerificationResult input},
  input.reconstructDerivationWithinLimits limits = Except.ok result →
    input.StructurallyWellFormed ∧
      input.conclusionFormulas? = some result.sequent ∧
        result.tree.infer? = some result.sequent ∧
          result.tree.desequentialize? = some result.output ∧
            result.output.check = true ∧ result.output.ProofNetEquivalent input
```

### `ProofNetIR.Certificate.reconstructDerivationWithinLimits_accepted`

Kind: theorem.

Bounded success implies acceptance by the exact reference semantics.

```lean
ProofNetIR.Certificate.reconstructDerivationWithinLimits_accepted : ∀ {input : ProofNetIR.Certificate} {limits : ProofNetIR.ReconstructionLimits}
  {result : ProofNetIR.DerivationVerificationResult input},
  input.reconstructDerivationWithinLimits limits = Except.ok result → input.check = true
```

### `ProofNetIR.Certificate.reconstructDerivationWithinLimits_implies_reconstructs`

Kind: theorem.

Bounded success is always inside the unbounded reconstruction decision's
accepted set.  No converse is claimed for the heuristic bounded path.

```lean
ProofNetIR.Certificate.reconstructDerivationWithinLimits_implies_reconstructs : ∀ {input : ProofNetIR.Certificate} {limits : ProofNetIR.ReconstructionLimits}
  {result : ProofNetIR.DerivationVerificationResult input},
  input.reconstructDerivationWithinLimits limits = Except.ok result → input.reconstructsDerivation = true
```

### `ProofNetIR.UnificationMarking`

Kind: inductive type.

Proof-irrelevant state for the abstract Guerrini Figure-5 rules.

Unlike the executable union-find state, `sameThread` is an arbitrary
equivalence relation on the fixed carrier `Nat`. `tokenCount` allocates the
initial segment below it; natural numbers at or above the count are already
present in the carrier but cannot occur in a stored mark. This fixed-carrier
encoding lets successive states share one relation type. The two bound fields
make every stored mark refer to a submitted formula occurrence and an
allocated token.

```lean
ProofNetIR.UnificationMarking : ProofNetIR.Certificate → Type
```

### `ProofNetIR.UnificationMarking.ext`

Kind: theorem.

Two proof-irrelevant markings are equal when their observable token count,
raw marks, and thread relation are equal. Bound and equivalence witnesses are
proof-irrelevant.

```lean
ProofNetIR.UnificationMarking.ext : ∀ {certificate : ProofNetIR.Certificate} {first second : ProofNetIR.UnificationMarking certificate},
  first.tokenCount = second.tokenCount →
    first.mark = second.mark → first.sameThread = second.sameThread → first = second
```

### `ProofNetIR.UnificationMarking.setMark`

Kind: definition.

Mark one formula occurrence, leaving every other occurrence unchanged.

```lean
ProofNetIR.UnificationMarking.setMark : (ProofNetIR.Vertex → Option Nat) → Nat → Nat → ProofNetIR.Vertex → Option Nat
```

### `ProofNetIR.UnificationMarking.FreshExtension`

Kind: definition.

In the fixed `Nat` carrier, allocating a fresh token preserves the global
thread relation. Freshness is a separate side condition: before allocation,
the newly exposed number must be unrelated to every allocated token.

```lean
ProofNetIR.UnificationMarking.FreshExtension : {certificate : ProofNetIR.Certificate} → ProofNetIR.UnificationMarking certificate → Nat → Nat → Nat → Prop
```

### `ProofNetIR.UnificationMarking.IsFreshToken`

Kind: definition.

The carrier element about to be allocated is isolated from every token
that is already allocated.

```lean
ProofNetIR.UnificationMarking.IsFreshToken : {certificate : ProofNetIR.Certificate} → ProofNetIR.UnificationMarking certificate → Nat → Prop
```

### `ProofNetIR.UnificationMarking.freshExtension_equivalence`

Kind: theorem.

Fresh-token allocation preserves an equivalence relation on the fixed
carrier. This theorem is a regression guard against accidentally defining the
extension only on the allocated initial segment.

```lean
ProofNetIR.UnificationMarking.freshExtension_equivalence : ∀ {certificate : ProofNetIR.Certificate} (state : ProofNetIR.UnificationMarking certificate) (fresh : Nat),
  Equivalence (state.FreshExtension fresh)
```

### `ProofNetIR.UnificationMarking.MergeExtension`

Kind: definition.

Merge the two old equivalence classes containing `leftToken` and
`rightToken`. This formula is the exact one-step equivalence closure because
`state.sameThread` is already an equivalence relation.

```lean
ProofNetIR.UnificationMarking.MergeExtension : {certificate : ProofNetIR.Certificate} → ProofNetIR.UnificationMarking certificate → Nat → Nat → Nat → Nat → Prop
```

### `ProofNetIR.UnificationMarking.mergeExtension_equivalence`

Kind: theorem.

Merging two equivalence classes again yields an equivalence relation.

```lean
ProofNetIR.UnificationMarking.mergeExtension_equivalence : ∀ {certificate : ProofNetIR.Certificate} (state : ProofNetIR.UnificationMarking certificate)
  (leftToken rightToken : Nat), Equivalence (state.MergeExtension leftToken rightToken)
```

### `ProofNetIR.UnificationMarking.mergeExtension_congr`

Kind: theorem.

The merged relation depends only on the two selected equivalence classes,
not on which members name those classes.

```lean
ProofNetIR.UnificationMarking.mergeExtension_congr : ∀ {certificate : ProofNetIR.Certificate} (state : ProofNetIR.UnificationMarking certificate)
  {leftToken leftToken' rightToken rightToken' : Nat},
  state.sameThread leftToken leftToken' →
    state.sameThread rightToken rightToken' →
      state.MergeExtension leftToken rightToken = state.MergeExtension leftToken' rightToken'
```

### `ProofNetIR.UnificationMarking.mergeExtension_comm`

Kind: theorem.

The two equivalence classes selected for a merge are unordered.

```lean
ProofNetIR.UnificationMarking.mergeExtension_comm : ∀ {certificate : ProofNetIR.Certificate} (state : ProofNetIR.UnificationMarking certificate)
  (leftToken rightToken : Nat), state.MergeExtension leftToken rightToken = state.MergeExtension rightToken leftToken
```

### `ProofNetIR.UnificationMarking.referencePath_active_of_allMarked`

Kind: theorem.

A path in the complete reference switching is already an active-graph
walk when every vertex it visits has been marked.  The proof retains exact
edge occurrences only after checking both endpoint marks; it does not replace
the occurrence-aware reference graph by a simple graph.

```lean
ProofNetIR.UnificationMarking.referencePath_active_of_allMarked : ∀ {certificate : ProofNetIR.Certificate} (state : ProofNetIR.UnificationMarking certificate)
  (path : certificate.referenceSwitchingGraph.EdgeSimplePath),
  (∀ (vertex : ProofNetIR.Vertex), vertex ∈ path.vertices → (state.mark vertex).isSome = true) →
    state.activeReferenceGraph.Walk path.start path.finish
```

### `ProofNetIR.UnificationMarking.referencePath_has_unmarked_of_noActiveWalk`

Kind: theorem.

If a complete-reference simple path does not induce an active walk, at
least one visited occurrence is genuinely unmarked.

```lean
ProofNetIR.UnificationMarking.referencePath_has_unmarked_of_noActiveWalk : ∀ {certificate : ProofNetIR.Certificate} (state : ProofNetIR.UnificationMarking certificate)
  (path : certificate.referenceSwitchingGraph.EdgeSimplePath),
  ¬state.activeReferenceGraph.Walk path.start path.finish →
    ∃ vertex, vertex ∈ path.vertices ∧ (state.mark vertex).isSome = false
```

### `ProofNetIR.UnificationMarking.referencePath_has_marked_to_unmarked_boundary`

Kind: theorem.

If a complete-reference path begins at a marked occurrence but fails to
induce an active walk, it crosses a concrete retained edge occurrence from a
marked source to an unmarked target.  This exposes the first geometric
frontier of the inactive region without forgetting multigraph edge identity.

```lean
ProofNetIR.UnificationMarking.referencePath_has_marked_to_unmarked_boundary : ∀ {certificate : ProofNetIR.Certificate} (state : ProofNetIR.UnificationMarking certificate)
  (path : certificate.referenceSwitchingGraph.EdgeSimplePath),
  (state.mark path.start).isSome = true →
    ¬state.activeReferenceGraph.Walk path.start path.finish →
      ∃ directed,
        directed ∈ path.traversed ∧
          (state.mark directed.source).isSome = true ∧ (state.mark directed.target).isSome = false
```

### `ProofNetIR.UnificationMarking.referencePath_has_first_marked_to_unmarked_boundary`

Kind: theorem.

The first inactive frontier on a reference path retains its exact
traversal split and an active-prefix walk.  Hence the marked boundary source
lies in the same active component as the path start, rather than merely being
marked somewhere in the switching.

```lean
ProofNetIR.UnificationMarking.referencePath_has_first_marked_to_unmarked_boundary : ∀ {certificate : ProofNetIR.Certificate} (state : ProofNetIR.UnificationMarking certificate)
  (path : certificate.referenceSwitchingGraph.EdgeSimplePath),
  (state.mark path.start).isSome = true →
    ¬state.activeReferenceGraph.Walk path.start path.finish →
      ∃ before directed after,
        path.traversed = before ++ directed :: after ∧
          (∀ (candidate : certificate.referenceSwitchingGraph.DirectedEdge),
              candidate ∈ before →
                (state.mark candidate.source).isSome = true ∧ (state.mark candidate.target).isSome = true) ∧
            (state.mark directed.source).isSome = true ∧
              (state.mark directed.target).isSome = false ∧ state.activeReferenceGraph.Walk path.start directed.source
```

### `ProofNetIR.UnificationMarking.referencePath_has_last_unmarked_to_marked_boundary`

Kind: theorem.

Reading a reference path backward selects its last inactive frontier in
the original orientation.  The returned edge goes from the unmarked middle
region into a marked target, and the suffix from that target to the original
finish is active.

```lean
ProofNetIR.UnificationMarking.referencePath_has_last_unmarked_to_marked_boundary : ∀ {certificate : ProofNetIR.Certificate} (state : ProofNetIR.UnificationMarking certificate)
  (path : certificate.referenceSwitchingGraph.EdgeSimplePath),
  (state.mark path.finish).isSome = true →
    ¬state.activeReferenceGraph.Walk path.start path.finish →
      ∃ before directed after,
        path.traversed = before ++ directed :: after ∧
          (state.mark directed.source).isSome = false ∧
            (state.mark directed.target).isSome = true ∧ state.activeReferenceGraph.Walk directed.target path.finish
```

### `ProofNetIR.UnificationMarking.referencePath_has_first_unmarked_to_marked_boundary`

Kind: theorem.

Starting from an unmarked endpoint, the first return to the marked region
retains an exact traversal split and proves that every earlier traversed
occurrence has unmarked endpoints.

```lean
ProofNetIR.UnificationMarking.referencePath_has_first_unmarked_to_marked_boundary : ∀ {certificate : ProofNetIR.Certificate} (state : ProofNetIR.UnificationMarking certificate)
  (path : certificate.referenceSwitchingGraph.EdgeSimplePath),
  (state.mark path.start).isSome = false →
    (state.mark path.finish).isSome = true →
      ∃ before directed after,
        path.traversed = before ++ directed :: after ∧
          (∀ (candidate : certificate.referenceSwitchingGraph.DirectedEdge),
              candidate ∈ before →
                (state.mark candidate.source).isSome = false ∧ (state.mark candidate.target).isSome = false) ∧
            (state.mark directed.source).isSome = false ∧ (state.mark directed.target).isSome = true
```

### `ProofNetIR.UnificationMarking.referenceDirectedEdge_origin`

Kind: theorem.

An exact directed occurrence of the all-left reference graph comes from a
concrete submitted-link occurrence.  Axiom and tensor occurrences retain all
of their edges, while a reference par occurrence can only be the stored left
premise edge.

```lean
ProofNetIR.UnificationMarking.referenceDirectedEdge_origin : ∀ (certificate : ProofNetIR.Certificate) (directed : certificate.referenceSwitchingGraph.DirectedEdge),
  (∃ linkIndex left right,
      certificate.links[linkIndex]? = some (ProofNetIR.Link.axiom left right) ∧
        directed.edge = { first := left, second := right }) ∨
    (∃ linkIndex left right conclusion,
        certificate.links[linkIndex]? = some (ProofNetIR.Link.tensor left right conclusion) ∧
          (directed.edge = { first := left, second := conclusion } ∨
            directed.edge = { first := right, second := conclusion })) ∨
      ∃ linkIndex left right conclusion,
        certificate.links[linkIndex]? = some (ProofNetIR.Link.par left right conclusion) ∧
          directed.edge = { first := left, second := conclusion }
```

### `ProofNetIR.UnificationMarking.marked_to_unmarked_referenceEdge_exact_connective_origin`

Kind: theorem.

Exact occurrence strengthening of the marked-to-unmarked frontier
classifier.  Besides the submitted-link index and endpoints, the result
retains the stored edge value and the proved forward orientation.

```lean
ProofNetIR.UnificationMarking.marked_to_unmarked_referenceEdge_exact_connective_origin : ∀ {certificate : ProofNetIR.Certificate} (state : ProofNetIR.UnificationMarking certificate),
  state.MarkingCausallyClosed →
    (∀ {linkIndex left right : Nat},
        certificate.links[linkIndex]? = some (ProofNetIR.Link.axiom left right) →
          (state.mark left).isSome = true ∧ (state.mark right).isSome = true) →
      ∀ (directed : certificate.referenceSwitchingGraph.DirectedEdge),
        (state.mark directed.source).isSome = true →
          (state.mark directed.target).isSome = false →
            (∃ linkIndex left right conclusion,
                certificate.links[linkIndex]? = some (ProofNetIR.Link.par left right conclusion) ∧
                  directed.edge = { first := left, second := conclusion } ∧
                    directed.forward = true ∧ directed.source = left ∧ directed.target = conclusion) ∨
              ∃ linkIndex left right conclusion,
                certificate.links[linkIndex]? = some (ProofNetIR.Link.tensor left right conclusion) ∧
                  directed.forward = true ∧
                    (directed.edge = { first := left, second := conclusion } ∧ directed.source = left ∨
                        directed.edge = { first := right, second := conclusion } ∧ directed.source = right) ∧
                      directed.target = conclusion
```

### `ProofNetIR.UnificationMarking.marked_to_unmarked_referenceEdge_connective_origin`

Kind: theorem.

Backward-compatible endpoint projection of the exact occurrence
classifier.

```lean
ProofNetIR.UnificationMarking.marked_to_unmarked_referenceEdge_connective_origin : ∀ {certificate : ProofNetIR.Certificate} (state : ProofNetIR.UnificationMarking certificate),
  state.MarkingCausallyClosed →
    (∀ {linkIndex left right : Nat},
        certificate.links[linkIndex]? = some (ProofNetIR.Link.axiom left right) →
          (state.mark left).isSome = true ∧ (state.mark right).isSome = true) →
      ∀ (directed : certificate.referenceSwitchingGraph.DirectedEdge),
        (state.mark directed.source).isSome = true →
          (state.mark directed.target).isSome = false →
            (∃ linkIndex left right conclusion,
                certificate.links[linkIndex]? = some (ProofNetIR.Link.par left right conclusion) ∧
                  directed.source = left ∧ directed.target = conclusion) ∨
              ∃ linkIndex left right conclusion,
                certificate.links[linkIndex]? = some (ProofNetIR.Link.tensor left right conclusion) ∧
                  (directed.source = left ∨ directed.source = right) ∧ directed.target = conclusion
```

### `ProofNetIR.UnificationRuleKind`

Kind: inductive type.

The three source-level unification rules.

```lean
ProofNetIR.UnificationRuleKind : Type
```

### `ProofNetIR.UnificationStep`

Kind: inductive type.

Independent one-step semantics for Guerrini's Figure-5 unification.

The constructors state their enabling conditions and exact state update
without mentioning the eager scan, queue, waiting set, or executable
union-find representation.

```lean
ProofNetIR.UnificationStep : (certificate : ProofNetIR.Certificate) →
  ProofNetIR.UnificationMarking certificate → ProofNetIR.UnificationMarking certificate → Prop
```

### `ProofNetIR.UnificationExecution`

Kind: inductive type.

Reflexive-transitive execution generated by the three independent
Figure-5 transitions. This relation contains no scheduler or executable
union-find implementation choices.

```lean
ProofNetIR.UnificationExecution : (certificate : ProofNetIR.Certificate) →
  ProofNetIR.UnificationMarking certificate → ProofNetIR.UnificationMarking certificate → Prop
```

### `ProofNetIR.UnificationExecution.single`

Kind: theorem.

A single independent transition is an execution.

```lean
ProofNetIR.UnificationExecution.single : ∀ {certificate : ProofNetIR.Certificate} {state next : ProofNetIR.UnificationMarking certificate},
  ProofNetIR.UnificationStep certificate state next → ProofNetIR.UnificationExecution certificate state next
```

### `ProofNetIR.UnificationExecution.trans`

Kind: theorem.

Independent executions compose transitively.

```lean
ProofNetIR.UnificationExecution.trans : ∀ {certificate : ProofNetIR.Certificate} {first second third : ProofNetIR.UnificationMarking certificate},
  ProofNetIR.UnificationExecution certificate first second →
    ProofNetIR.UnificationExecution certificate second third → ProofNetIR.UnificationExecution certificate first third
```

### `ProofNetIR.UnificationStep.link_exists`

Kind: theorem.

Every abstract transition uses a submitted link of the corresponding
Figure-5 class.

```lean
ProofNetIR.UnificationStep.link_exists : ∀ {certificate : ProofNetIR.Certificate} {state next : ProofNetIR.UnificationMarking certificate},
  ProofNetIR.UnificationStep certificate state next →
    (∃ left right, ProofNetIR.Link.axiom left right ∈ certificate.links) ∨
      (∃ left right conclusion, ProofNetIR.Link.par left right conclusion ∈ certificate.links) ∨
        ∃ left right conclusion, ProofNetIR.Link.tensor left right conclusion ∈ certificate.links
```

### `ProofNetIR.UnificationStep.marks_fired_conclusion`

Kind: theorem.

Each Figure-5 transition marks the conclusion occurrence of the link it
fires. For an axiom/start transition, both axiom conclusions are marked with
the fresh token.

```lean
ProofNetIR.UnificationStep.marks_fired_conclusion : ∀ {certificate : ProofNetIR.Certificate} {state next : ProofNetIR.UnificationMarking certificate},
  ProofNetIR.UnificationStep certificate state next →
    (∃ left right,
        ProofNetIR.Link.axiom left right ∈ certificate.links ∧
          (next.mark left).isSome = true ∧ (next.mark right).isSome = true) ∨
      (∃ left right conclusion,
          ProofNetIR.Link.par left right conclusion ∈ certificate.links ∧ (next.mark conclusion).isSome = true) ∨
        ∃ left right conclusion,
          ProofNetIR.Link.tensor left right conclusion ∈ certificate.links ∧ (next.mark conclusion).isSome = true
```

### `ProofNetIR.UnificationStep.tokenCount_mono`

Kind: theorem.

Abstract unification never retires an allocated token number. Start adds
one token; forward and unify preserve the allocation count.

```lean
ProofNetIR.UnificationStep.tokenCount_mono : ∀ {certificate : ProofNetIR.Certificate} {state next : ProofNetIR.UnificationMarking certificate},
  ProofNetIR.UnificationStep certificate state next → state.tokenCount ≤ next.tokenCount
```

### `ProofNetIR.UnificationComponent`

Kind: inductive type.

A partially parsed proof component used by the executable Guerrini-style
unification pass. `frontier` records the formula occurrences currently exposed
by `tree`, in exactly the order inferred by the derivation.

```lean
ProofNetIR.UnificationComponent : Type
```

### `ProofNetIR.UnificationComponent.FormulaConsistent`

Kind: definition.

A partial component is formula-consistent when its derivation infers
exactly the certificate labels of its exposed occurrence frontier.

```lean
ProofNetIR.UnificationComponent.FormulaConsistent : ProofNetIR.Certificate → ProofNetIR.UnificationComponent → Prop
```

### `ProofNetIR.UnificationState`

Kind: inductive type.

Runtime state for the deterministic unification pass.

`marks[v]` is the token initially assigned to `v`; `parents` represents the
current token partition; and only representative entries of `components`
contain a live parsed component. The implementation deliberately keeps this
state proof-irrelevant and validates the final derivation independently with
`Certificate.verifyDerivation?`.

```lean
ProofNetIR.UnificationState : Type
```

### `ProofNetIR.UnificationState.ComponentsFormulaConsistent`

Kind: definition.

Every stored live component denotes a formula-consistent partial
derivation. Retired `none` slots impose no obligation.

```lean
ProofNetIR.UnificationState.ComponentsFormulaConsistent : ProofNetIR.Certificate → ProofNetIR.UnificationState → Prop
```

### `ProofNetIR.UnificationState.ComponentsFormulaConsistent.push`

Kind: theorem.

Appending one formula-consistent live component preserves consistency of
every previously stored slot.

```lean
ProofNetIR.UnificationState.ComponentsFormulaConsistent.push : ∀ {certificate : ProofNetIR.Certificate} {state : ProofNetIR.UnificationState},
  ProofNetIR.UnificationState.ComponentsFormulaConsistent certificate state →
    ∀ {component : ProofNetIR.UnificationComponent},
      ProofNetIR.UnificationComponent.FormulaConsistent certificate component →
        ProofNetIR.UnificationState.ComponentsFormulaConsistent certificate
          { marks := state.marks, parents := state.parents, components := state.components.push (some component),
            startedAxioms := state.startedAxioms, firedConnectives := state.firedConnectives }
```

### `ProofNetIR.UnificationState.ComponentsFormulaConsistent.set`

Kind: theorem.

Replacing one component slot with a formula-consistent component
preserves consistency of all live slots.

```lean
ProofNetIR.UnificationState.ComponentsFormulaConsistent.set : ∀ {certificate : ProofNetIR.Certificate} {state : ProofNetIR.UnificationState},
  ProofNetIR.UnificationState.ComponentsFormulaConsistent certificate state →
    ∀ {index : Nat} {component : ProofNetIR.UnificationComponent},
      ProofNetIR.UnificationComponent.FormulaConsistent certificate component →
        ProofNetIR.UnificationState.ComponentsFormulaConsistent certificate
          { marks := state.marks, parents := state.parents,
            components := state.components.setIfInBounds index (some component), startedAxioms := state.startedAxioms,
            firedConnectives := state.firedConnectives }
```

### `ProofNetIR.UnificationState.ComponentsFormulaConsistent.clear`

Kind: theorem.

Clearing one component slot cannot introduce an inconsistent live
component.

```lean
ProofNetIR.UnificationState.ComponentsFormulaConsistent.clear : ∀ {certificate : ProofNetIR.Certificate} {state : ProofNetIR.UnificationState},
  ProofNetIR.UnificationState.ComponentsFormulaConsistent certificate state →
    ∀ (index : Nat),
      ProofNetIR.UnificationState.ComponentsFormulaConsistent certificate
        { marks := state.marks, parents := state.parents, components := state.components.setIfInBounds index none,
          startedAxioms := state.startedAxioms, firedConnectives := state.firedConnectives }
```

### `ProofNetIR.UnificationState.assignedToken?`

Kind: definition.

Raw token assigned to a formula occurrence, before representative lookup.
This is the marking field used by the independent transition semantics.

```lean
ProofNetIR.UnificationState.assignedToken? : ProofNetIR.UnificationState → ProofNetIR.Vertex → Option Nat
```

### `ProofNetIR.UnificationState.SameThread`

Kind: definition.

Two allocated tokens lie in the same executable union-find class.

```lean
ProofNetIR.UnificationState.SameThread : ProofNetIR.UnificationState → Nat → Nat → Prop
```

### `ProofNetIR.UnificationState.Abstractable`

Kind: inductive type.

Bounds required to interpret an executable state as an independent
`UnificationMarking`. Later preservation theorems will discharge this contract
for every reachable state.

```lean
ProofNetIR.UnificationState.Abstractable : ProofNetIR.Certificate → ProofNetIR.UnificationState → Prop
```

### `ProofNetIR.UnificationState.ObservationEquivalent`

Kind: inductive type.

Equality of exactly the executable fields observed by the independent
unification semantics. Parsed derivation components and work counters are
intentionally ignored.

```lean
ProofNetIR.UnificationState.ObservationEquivalent : ProofNetIR.UnificationState → ProofNetIR.UnificationState → Prop
```

### `ProofNetIR.UnificationState.IdentityParents`

Kind: definition.

During the eager axiom-start phase every allocated token is still its own
union-find parent. No connective union has fired yet.

```lean
ProofNetIR.UnificationState.IdentityParents : ProofNetIR.UnificationState → Prop
```

### `ProofNetIR.UnificationState.OrderedParents`

Kind: definition.

Every parent pointer is nonincreasing in token number. Consequently each
non-root pointer is strictly decreasing, ruling out the fuel-artifact cycles
that the bounds-only abstraction contract intentionally does not exclude.

```lean
ProofNetIR.UnificationState.OrderedParents : ProofNetIR.UnificationState → Prop
```

### `ProofNetIR.UnificationState.OrderedParents.representative_le`

Kind: theorem.

An ordered union-find forest always returns a no-larger representative.

```lean
ProofNetIR.UnificationState.OrderedParents.representative_le : ∀ {state : ProofNetIR.UnificationState}, state.OrderedParents → ∀ (token : Nat), state.representative token ≤ token
```

### `ProofNetIR.UnificationState.OrderedParents.representative_lt`

Kind: theorem.

Representatives of allocated tokens remain allocated.

```lean
ProofNetIR.UnificationState.OrderedParents.representative_lt : ∀ {state : ProofNetIR.UnificationState},
  state.OrderedParents → ∀ {token : Nat}, token < state.parents.size → state.representative token < state.parents.size
```

### `ProofNetIR.UnificationState.OrderedParents.representative_idempotent`

Kind: theorem.

Ordered-parent traversal is idempotent on every allocated token.

```lean
ProofNetIR.UnificationState.OrderedParents.representative_idempotent : ∀ {state : ProofNetIR.UnificationState},
  state.OrderedParents →
    ∀ {token : Nat},
      token < state.parents.size → state.representative (state.representative token) = state.representative token
```

### `ProofNetIR.UnificationState.OrderedParents.lookup_self_of_representative_eq`

Kind: theorem.

An allocated token that is already its own representative is stored as a
self-parent root.

```lean
ProofNetIR.UnificationState.OrderedParents.lookup_self_of_representative_eq : ∀ {state : ProofNetIR.UnificationState},
  state.OrderedParents →
    ∀ {token : Nat},
      token < state.parents.size → state.representative token = token → state.parents[token]? = some token
```

### `ProofNetIR.UnificationState.OrderedParents.representative_lookup_self`

Kind: theorem.

Every allocated representative is backed by a self-parent root entry.

```lean
ProofNetIR.UnificationState.OrderedParents.representative_lookup_self : ∀ {state : ProofNetIR.UnificationState},
  state.OrderedParents →
    ∀ {token : Nat},
      token < state.parents.size → state.parents[state.representative token]? = some (state.representative token)
```

### `ProofNetIR.UnificationState.OrderedParents.representative_eq_representative_parent`

Kind: theorem.

An allocated token and its stored parent have the same representative.

```lean
ProofNetIR.UnificationState.OrderedParents.representative_eq_representative_parent : ∀ {state : ProofNetIR.UnificationState},
  state.OrderedParents →
    ∀ {token parent : Nat},
      token < state.parents.size →
        state.parents[token]? = some parent → state.representative token = state.representative parent
```

### `ProofNetIR.UnificationState.representative_eq_of_lookup_self`

Kind: theorem.

A stored self-parent entry is returned as its own representative.

```lean
ProofNetIR.UnificationState.representative_eq_of_lookup_self : ∀ {state : ProofNetIR.UnificationState} {token : Nat},
  state.parents[token]? = some token → state.representative token = token
```

### `ProofNetIR.UnificationState.representative_eq_of_size_le`

Kind: theorem.

Unallocated carrier elements are represented by themselves.

```lean
ProofNetIR.UnificationState.representative_eq_of_size_le : ∀ (state : ProofNetIR.UnificationState) {token : Nat}, state.parents.size ≤ token → state.representative token = token
```

### `ProofNetIR.UnificationState.OrderedParents.abstractable`

Kind: theorem.

Mark-domain bounds plus an ordered parent forest suffice to construct the
full executable abstraction contract; representative range and idempotence
are consequences rather than independent assumptions.

```lean
ProofNetIR.UnificationState.OrderedParents.abstractable : ∀ {certificate : ProofNetIR.Certificate} {state : ProofNetIR.UnificationState},
  state.OrderedParents →
    state.marks.size = certificate.formulas.size →
      (∀ {vertex : ProofNetIR.Vertex} {token : Nat},
          state.assignedToken? vertex = some token → vertex < certificate.formulas.size) →
        (∀ {vertex : ProofNetIR.Vertex} {token : Nat},
            state.assignedToken? vertex = some token → token < state.parents.size) →
          ProofNetIR.UnificationState.Abstractable certificate state
```

### `ProofNetIR.UnificationState.IdentityParents.representative_eq`

Kind: theorem.

Identity-parent states return each allocated token as its own
representative.

```lean
ProofNetIR.UnificationState.IdentityParents.representative_eq : ∀ {state : ProofNetIR.UnificationState},
  state.IdentityParents → ∀ {token : Nat}, token < state.parents.size → state.representative token = token
```

### `ProofNetIR.UnificationState.IdentityParents.representative_eq_all`

Kind: theorem.

Identity-parent states return every natural-number carrier element as its
own representative, including token numbers not yet allocated.

```lean
ProofNetIR.UnificationState.IdentityParents.representative_eq_all : ∀ {state : ProofNetIR.UnificationState}, state.IdentityParents → ∀ (token : Nat), state.representative token = token
```

### `ProofNetIR.UnificationState.IdentityParents.sameThread_iff`

Kind: theorem.

In the identity-parent phase, executable thread equivalence is ordinary
token identity on the entire fixed carrier.

```lean
ProofNetIR.UnificationState.IdentityParents.sameThread_iff : ∀ {state : ProofNetIR.UnificationState},
  state.IdentityParents → ∀ (first second : Nat), state.SameThread first second ↔ first = second
```

### `ProofNetIR.UnificationState.IdentityParents.orderedParents`

Kind: theorem.

The identity-parent phase is an ordered union-find forest.

```lean
ProofNetIR.UnificationState.IdentityParents.orderedParents : ∀ {state : ProofNetIR.UnificationState}, state.IdentityParents → state.OrderedParents
```

### `ProofNetIR.UnificationState.IdentityParents.push_fresh`

Kind: theorem.

Appending the fresh self-parent preserves the identity-parent phase
invariant.

```lean
ProofNetIR.UnificationState.IdentityParents.push_fresh : ∀ {state : ProofNetIR.UnificationState},
  state.IdentityParents →
    ∀ {token : Nat},
      token < (state.parents.push state.parents.size).size →
        (state.parents.push state.parents.size)[token]? = some token
```

### `ProofNetIR.UnificationState.ObservationEquivalent.abstractable`

Kind: theorem.

Observation-equivalent states satisfy the same abstraction contract.

```lean
ProofNetIR.UnificationState.ObservationEquivalent.abstractable : ∀ {certificate : ProofNetIR.Certificate} {first second : ProofNetIR.UnificationState},
  first.ObservationEquivalent second →
    ProofNetIR.UnificationState.Abstractable certificate first →
      ProofNetIR.UnificationState.Abstractable certificate second
```

### `ProofNetIR.UnificationState.ObservationEquivalent.orderedParents`

Kind: theorem.

Observation-equivalent states either both satisfy or both violate the
ordered-parent forest invariant.

```lean
ProofNetIR.UnificationState.ObservationEquivalent.orderedParents : ∀ {first second : ProofNetIR.UnificationState},
  first.ObservationEquivalent second → first.OrderedParents → second.OrderedParents
```

### `ProofNetIR.UnificationState.ObservationEquivalent.identityParents`

Kind: theorem.

Observation-equivalent states either both have identity parent arrays or
both do not.

```lean
ProofNetIR.UnificationState.ObservationEquivalent.identityParents : ∀ {first second : ProofNetIR.UnificationState},
  first.ObservationEquivalent second → first.IdentityParents → second.IdentityParents
```

### `ProofNetIR.UnificationState.toMarking`

Kind: definition.

Forget arrays, parsed derivation components, counters, and worklist data,
retaining exactly the marking and thread partition observed by the independent
Figure-5 semantics.

```lean
ProofNetIR.UnificationState.toMarking : (state : ProofNetIR.UnificationState) →
  (certificate : ProofNetIR.Certificate) →
    ProofNetIR.UnificationState.Abstractable certificate state → ProofNetIR.UnificationMarking certificate
```

### `ProofNetIR.UnificationState.toMarking_tokenCount`

Kind: theorem.

Abstracting an executable state exposes exactly one token slot per
union-find parent entry.

```lean
ProofNetIR.UnificationState.toMarking_tokenCount : ∀ (state : ProofNetIR.UnificationState) (certificate : ProofNetIR.Certificate)
  (abstractable : ProofNetIR.UnificationState.Abstractable certificate state),
  (state.toMarking certificate abstractable).tokenCount = state.parents.size
```

### `ProofNetIR.UnificationState.toMarking_mark`

Kind: theorem.

Abstract-state marking lookup is the executable raw assigned token lookup,
before representative normalization.

```lean
ProofNetIR.UnificationState.toMarking_mark : ∀ (state : ProofNetIR.UnificationState) (certificate : ProofNetIR.Certificate)
  (abstractable : ProofNetIR.UnificationState.Abstractable certificate state) (vertex : ProofNetIR.Vertex),
  (state.toMarking certificate abstractable).mark vertex = state.assignedToken? vertex
```

### `ProofNetIR.UnificationState.toMarking_sameThread`

Kind: theorem.

Abstract thread equivalence is equality of executable union-find
representatives.

```lean
ProofNetIR.UnificationState.toMarking_sameThread : ∀ (state : ProofNetIR.UnificationState) (certificate : ProofNetIR.Certificate)
  (abstractable : ProofNetIR.UnificationState.Abstractable certificate state) (first second : Nat),
  (state.toMarking certificate abstractable).sameThread first second ↔
    state.representative first = state.representative second
```

### `ProofNetIR.UnificationState.ObservationEquivalent.toMarking_eq`

Kind: theorem.

Observation-equivalent executable states have identical independent
marking abstractions.

```lean
ProofNetIR.UnificationState.ObservationEquivalent.toMarking_eq : ∀ {certificate : ProofNetIR.Certificate} {first second : ProofNetIR.UnificationState}
  (equivalent : first.ObservationEquivalent second)
  (abstractable : ProofNetIR.UnificationState.Abstractable certificate first),
  second.toMarking certificate ⋯ = first.toMarking certificate abstractable
```

### `ProofNetIR.UnificationState.startMarking`

Kind: definition.

Apply the token-semantic part of an axiom/start firing: mark both axiom
occurrences with one fresh token and append that token as its own parent.

```lean
ProofNetIR.UnificationState.startMarking : ProofNetIR.UnificationState → ProofNetIR.Vertex → ProofNetIR.Vertex → ProofNetIR.UnificationState
```

### `ProofNetIR.UnificationState.IdentityParents.startMarking`

Kind: theorem.

The start update stays in the pre-union identity-parent phase.

```lean
ProofNetIR.UnificationState.IdentityParents.startMarking : ∀ {state : ProofNetIR.UnificationState},
  state.IdentityParents → ∀ (left right : ProofNetIR.Vertex), (state.startMarking left right).IdentityParents
```

### `ProofNetIR.UnificationState.OrderedParents.startMarking`

Kind: theorem.

Starting an axiom preserves the ordered-forest invariant.

```lean
ProofNetIR.UnificationState.OrderedParents.startMarking : ∀ {state : ProofNetIR.UnificationState},
  state.OrderedParents → ∀ (left right : ProofNetIR.Vertex), (state.startMarking left right).OrderedParents
```

### `ProofNetIR.UnificationState.Abstractable.startMarking`

Kind: theorem.

Starting an in-domain axiom in the identity-parent phase preserves the
executable abstraction contract.

```lean
ProofNetIR.UnificationState.Abstractable.startMarking : ∀ {certificate : ProofNetIR.Certificate} {state : ProofNetIR.UnificationState},
  ProofNetIR.UnificationState.Abstractable certificate state →
    state.IdentityParents →
      ∀ {left right : ProofNetIR.Vertex},
        left < certificate.formulas.size →
          right < certificate.formulas.size →
            ProofNetIR.UnificationState.Abstractable certificate (state.startMarking left right)
```

### `ProofNetIR.UnificationState.OrderedParents.startMarking_representative_eq`

Kind: theorem.

Appending the fresh self-parent leaves the representative of every carrier
token unchanged. For old allocated tokens this follows from ordered traversal;
the fresh token and all still-unallocated carrier values are self-represented
on both sides.

```lean
ProofNetIR.UnificationState.OrderedParents.startMarking_representative_eq : ∀ {state : ProofNetIR.UnificationState},
  state.OrderedParents →
    ∀ (left right : ProofNetIR.Vertex) (token : Nat),
      (state.startMarking left right).representative token = state.representative token
```

### `ProofNetIR.UnificationState.OrderedParents.startMarking_sameThread_iff`

Kind: theorem.

Starting a fresh axiom after earlier unions preserves executable thread
equivalence on the entire fixed `Nat` carrier.

```lean
ProofNetIR.UnificationState.OrderedParents.startMarking_sameThread_iff : ∀ {state : ProofNetIR.UnificationState},
  state.OrderedParents →
    ∀ (left right : ProofNetIR.Vertex) (first second : Nat),
      (state.startMarking left right).SameThread first second ↔ state.SameThread first second
```

### `ProofNetIR.UnificationState.Abstractable.startMarking_ordered`

Kind: theorem.

Starting an in-domain axiom after arbitrary ordered unions preserves the
executable abstraction contract.

```lean
ProofNetIR.UnificationState.Abstractable.startMarking_ordered : ∀ {certificate : ProofNetIR.Certificate} {state : ProofNetIR.UnificationState},
  ProofNetIR.UnificationState.Abstractable certificate state →
    state.OrderedParents →
      ∀ {left right : ProofNetIR.Vertex},
        left < certificate.formulas.size →
          right < certificate.formulas.size →
            ProofNetIR.UnificationState.Abstractable certificate (state.startMarking left right)
```

### `ProofNetIR.UnificationState.OrderedParents.toMarking_isFreshToken`

Kind: theorem.

In the fixed-carrier abstraction, the next token exposed by any ordered
parent forest is isolated from every already allocated token.

```lean
ProofNetIR.UnificationState.OrderedParents.toMarking_isFreshToken : ∀ {certificate : ProofNetIR.Certificate} {state : ProofNetIR.UnificationState},
  state.OrderedParents →
    ∀ (abstractable : ProofNetIR.UnificationState.Abstractable certificate state),
      (state.toMarking certificate abstractable).IsFreshToken (state.toMarking certificate abstractable).tokenCount
```

### `ProofNetIR.UnificationState.IdentityParents.toMarking_isFreshToken`

Kind: theorem.

In the fixed-carrier abstraction, the next token number exposed by an
identity-parent state is isolated from every allocated token.

```lean
ProofNetIR.UnificationState.IdentityParents.toMarking_isFreshToken : ∀ {certificate : ProofNetIR.Certificate} {state : ProofNetIR.UnificationState},
  state.IdentityParents →
    ∀ (abstractable : ProofNetIR.UnificationState.Abstractable certificate state),
      (state.toMarking certificate abstractable).IsFreshToken (state.toMarking certificate abstractable).tokenCount
```

### `ProofNetIR.UnificationState.startMarking_toMarking_mark_ordered`

Kind: theorem.

Forgetting a fresh axiom start after arbitrary ordered unions is exactly
the two abstract `setMark` updates.

```lean
ProofNetIR.UnificationState.startMarking_toMarking_mark_ordered : ∀ {certificate : ProofNetIR.Certificate} {state : ProofNetIR.UnificationState}
  (abstractable : ProofNetIR.UnificationState.Abstractable certificate state) (ordered : state.OrderedParents)
  {left right : ProofNetIR.Vertex} (leftBound : left < certificate.formulas.size)
  (rightBound : right < certificate.formulas.size),
  ((state.startMarking left right).toMarking certificate ⋯).mark =
    ProofNetIR.UnificationMarking.setMark
      (ProofNetIR.UnificationMarking.setMark (state.toMarking certificate abstractable).mark left state.parents.size)
      right state.parents.size
```

### `ProofNetIR.UnificationState.startMarking_toMarking_mark`

Kind: theorem.

Forgetting a concrete axiom/start marking update is exactly the two
abstract `setMark` updates with one fresh token.

```lean
ProofNetIR.UnificationState.startMarking_toMarking_mark : ∀ {certificate : ProofNetIR.Certificate} {state : ProofNetIR.UnificationState}
  (abstractable : ProofNetIR.UnificationState.Abstractable certificate state) (identity : state.IdentityParents)
  {left right : ProofNetIR.Vertex} (leftBound : left < certificate.formulas.size)
  (rightBound : right < certificate.formulas.size),
  ((state.startMarking left right).toMarking certificate ⋯).mark =
    ProofNetIR.UnificationMarking.setMark
      (ProofNetIR.UnificationMarking.setMark (state.toMarking certificate abstractable).mark left state.parents.size)
      right state.parents.size
```

### `ProofNetIR.UnificationState.startMarking_startStep_ordered`

Kind: theorem.

A fresh axiom start after arbitrary ordered unions refines one independent
Figure-5 start step.

```lean
ProofNetIR.UnificationState.startMarking_startStep_ordered : ∀ {certificate : ProofNetIR.Certificate} {state : ProofNetIR.UnificationState}
  (abstractable : ProofNetIR.UnificationState.Abstractable certificate state) (ordered : state.OrderedParents)
  {left right : ProofNetIR.Vertex},
  ProofNetIR.Link.axiom left right ∈ certificate.links →
    ∀ (leftBound : left < certificate.formulas.size) (rightBound : right < certificate.formulas.size),
      state.assignedToken? left = none →
        state.assignedToken? right = none →
          ProofNetIR.UnificationStep certificate (state.toMarking certificate abstractable)
            ((state.startMarking left right).toMarking certificate ⋯)
```

### `ProofNetIR.UnificationState.startMarking_startStep`

Kind: theorem.

The concrete token-semantic axiom update refines one independent start
step while union-find parents are still identities.

```lean
ProofNetIR.UnificationState.startMarking_startStep : ∀ {certificate : ProofNetIR.Certificate} {state : ProofNetIR.UnificationState}
  (abstractable : ProofNetIR.UnificationState.Abstractable certificate state) (identity : state.IdentityParents)
  {left right : ProofNetIR.Vertex},
  ProofNetIR.Link.axiom left right ∈ certificate.links →
    ∀ (leftBound : left < certificate.formulas.size) (rightBound : right < certificate.formulas.size),
      state.assignedToken? left = none →
        state.assignedToken? right = none →
          ProofNetIR.UnificationStep certificate (state.toMarking certificate abstractable)
            ((state.startMarking left right).toMarking certificate ⋯)
```

### `ProofNetIR.UnificationState.setParent`

Kind: definition.

Update one union-find parent pointer without changing marks, parsed
components, or work counters.

```lean
ProofNetIR.UnificationState.setParent : ProofNetIR.UnificationState → Nat → Nat → ProofNetIR.UnificationState
```

### `ProofNetIR.UnificationState.OrderedParents.setParent`

Kind: theorem.

Pointing a token to a no-larger parent preserves the ordered-forest
invariant.

```lean
ProofNetIR.UnificationState.OrderedParents.setParent : ∀ {state : ProofNetIR.UnificationState},
  state.OrderedParents → ∀ {token parent : Nat}, parent ≤ token → (state.setParent token parent).OrderedParents
```

### `ProofNetIR.UnificationState.Abstractable.setParent`

Kind: theorem.

Updating one pointer inside an ordered forest preserves the executable
abstraction contract; the ordered invariant supplies the new representative
bounds and idempotence.

```lean
ProofNetIR.UnificationState.Abstractable.setParent : ∀ {certificate : ProofNetIR.Certificate} {state : ProofNetIR.UnificationState},
  ProofNetIR.UnificationState.Abstractable certificate state →
    state.OrderedParents →
      ∀ {token parent : Nat},
        parent ≤ token → ProofNetIR.UnificationState.Abstractable certificate (state.setParent token parent)
```

### `ProofNetIR.UnificationState.OrderedParents.setParent_representative`

Kind: theorem.

Pointing one allocated root at a smaller allocated root changes exactly the
old retired class to the surviving representative.

```lean
ProofNetIR.UnificationState.OrderedParents.setParent_representative : ∀ {state : ProofNetIR.UnificationState},
  state.OrderedParents →
    ∀ {survivor retired : Nat},
      survivor < state.parents.size →
        retired < state.parents.size →
          survivor < retired →
            state.representative survivor = survivor →
              state.representative retired = retired →
                ∀ {token : Nat},
                  token < state.parents.size →
                    (state.setParent retired survivor).representative token =
                      if state.representative token = retired then survivor else state.representative token
```

### `ProofNetIR.UnificationState.OrderedParents.setParent_sameThread`

Kind: theorem.

The executable same-thread relation after a root update is exactly the
equivalence closure that merges the surviving and retired old classes.

```lean
ProofNetIR.UnificationState.OrderedParents.setParent_sameThread : ∀ {state : ProofNetIR.UnificationState},
  state.OrderedParents →
    ∀ {survivor retired : Nat},
      survivor < state.parents.size →
        retired < state.parents.size →
          survivor < retired →
            state.representative survivor = survivor →
              state.representative retired = retired →
                ∀ {first second : Nat},
                  first < state.parents.size →
                    second < state.parents.size →
                      ((state.setParent retired survivor).SameThread first second ↔
                        state.SameThread first second ∨
                          (state.SameThread first survivor ∨ state.SameThread first retired) ∧
                            (state.SameThread second survivor ∨ state.SameThread second retired))
```

### `ProofNetIR.UnificationState.OrderedParents.setParent_sameThread_all`

Kind: theorem.

The root-update characterization holds on the full fixed `Nat` carrier,
including unallocated singleton elements.

```lean
ProofNetIR.UnificationState.OrderedParents.setParent_sameThread_all : ∀ {state : ProofNetIR.UnificationState},
  state.OrderedParents →
    ∀ {survivor retired : Nat},
      survivor < state.parents.size →
        retired < state.parents.size →
          survivor < retired →
            state.representative survivor = survivor →
              state.representative retired = retired →
                ∀ (first second : Nat),
                  (state.setParent retired survivor).SameThread first second ↔
                    state.SameThread first second ∨
                      (state.SameThread first survivor ∨ state.SameThread first retired) ∧
                        (state.SameThread second survivor ∨ state.SameThread second retired)
```

### `ProofNetIR.UnificationState.markConclusion`

Kind: definition.

Mark one connective conclusion and increment the connective counter,
without changing the token partition or parsed components.

```lean
ProofNetIR.UnificationState.markConclusion : ProofNetIR.UnificationState → Nat → Nat → ProofNetIR.UnificationState
```

### `ProofNetIR.UnificationState.OrderedParents.markConclusion`

Kind: theorem.

Marking a conclusion leaves the ordered parent forest unchanged.

```lean
ProofNetIR.UnificationState.OrderedParents.markConclusion : ∀ {state : ProofNetIR.UnificationState},
  state.OrderedParents → ∀ (conclusion token : Nat), (state.markConclusion conclusion token).OrderedParents
```

### `ProofNetIR.UnificationState.Abstractable.markConclusion`

Kind: theorem.

Marking an in-domain conclusion with an allocated token preserves the
executable-to-abstract-state contract.

```lean
ProofNetIR.UnificationState.Abstractable.markConclusion : ∀ {certificate : ProofNetIR.Certificate} {state : ProofNetIR.UnificationState},
  ProofNetIR.UnificationState.Abstractable certificate state →
    ∀ {conclusion token : Nat},
      conclusion < certificate.formulas.size →
        token < state.parents.size →
          ProofNetIR.UnificationState.Abstractable certificate (state.markConclusion conclusion token)
```

### `ProofNetIR.UnificationState.mergeConclusion`

Kind: definition.

Mark one tensor conclusion and point the retired representative at the
surviving representative. Parsed components remain outside this token-semantic
update.

```lean
ProofNetIR.UnificationState.mergeConclusion : ProofNetIR.UnificationState → Nat → Nat → Nat → ProofNetIR.UnificationState
```

### `ProofNetIR.UnificationState.OrderedParents.mergeConclusion`

Kind: theorem.

The token-semantic tensor update preserves ordered parents when the chosen
representative is no larger than the retired root.

```lean
ProofNetIR.UnificationState.OrderedParents.mergeConclusion : ∀ {state : ProofNetIR.UnificationState},
  state.OrderedParents →
    ∀ (conclusion representative retired : Nat),
      representative ≤ retired → (state.mergeConclusion conclusion representative retired).OrderedParents
```

### `ProofNetIR.UnificationState.Abstractable.mergeConclusion`

Kind: theorem.

Marking a tensor conclusion and merging two ordered roots preserves the
full executable abstraction contract.

```lean
ProofNetIR.UnificationState.Abstractable.mergeConclusion : ∀ {certificate : ProofNetIR.Certificate} {state : ProofNetIR.UnificationState},
  ProofNetIR.UnificationState.Abstractable certificate state →
    state.OrderedParents →
      ∀ {conclusion representative retired : Nat},
        conclusion < certificate.formulas.size →
          representative < state.parents.size →
            representative ≤ retired →
              ProofNetIR.UnificationState.Abstractable certificate
                (state.mergeConclusion conclusion representative retired)
```

### `ProofNetIR.UnificationState.markConclusion_toMarking_mark`

Kind: theorem.

Forgetting a concrete conclusion-marking update is exactly the abstract
`setMark` update; scheduler counters and parsed components are invisible.

```lean
ProofNetIR.UnificationState.markConclusion_toMarking_mark : ∀ {certificate : ProofNetIR.Certificate} {state : ProofNetIR.UnificationState}
  (abstractable : ProofNetIR.UnificationState.Abstractable certificate state) {conclusion token : Nat}
  (conclusionBound : conclusion < certificate.formulas.size) (tokenBound : token < state.parents.size),
  ((state.markConclusion conclusion token).toMarking certificate ⋯).mark =
    ProofNetIR.UnificationMarking.setMark (state.toMarking certificate abstractable).mark conclusion token
```

### `ProofNetIR.UnificationState.mergeConclusion_toMarking_mark`

Kind: theorem.

Merging two token classes does not add any further raw marks beyond the
conclusion mark performed before the parent update.

```lean
ProofNetIR.UnificationState.mergeConclusion_toMarking_mark : ∀ {certificate : ProofNetIR.Certificate} {state : ProofNetIR.UnificationState}
  (abstractable : ProofNetIR.UnificationState.Abstractable certificate state) (ordered : state.OrderedParents)
  {conclusion representative retired : Nat} (conclusionBound : conclusion < certificate.formulas.size)
  (representativeBound : representative < state.parents.size) (representativeLe : representative ≤ retired),
  ((state.mergeConclusion conclusion representative retired).toMarking certificate ⋯).mark =
    ProofNetIR.UnificationMarking.setMark (state.toMarking certificate abstractable).mark conclusion representative
```

### `ProofNetIR.UnificationState.markConclusion_forwardStep`

Kind: theorem.

The concrete marking update refines the independent forward rule whenever
the executable guards and submitted par-link membership hold. Component
construction is deliberately outside this proof-irrelevant theorem.

```lean
ProofNetIR.UnificationState.markConclusion_forwardStep : ∀ {certificate : ProofNetIR.Certificate} {state : ProofNetIR.UnificationState}
  (abstractable : ProofNetIR.UnificationState.Abstractable certificate state)
  {left right conclusion : ProofNetIR.Vertex} {leftToken rightToken outputToken : Nat},
  ProofNetIR.Link.par left right conclusion ∈ certificate.links →
    ∀ (conclusionBound : conclusion < certificate.formulas.size),
      state.assignedToken? conclusion = none →
        state.assignedToken? left = some leftToken →
          state.assignedToken? right = some rightToken →
            state.SameThread leftToken rightToken →
              ∀ (outputTokenAllocated : outputToken < state.parents.size),
                state.SameThread outputToken leftToken →
                  ProofNetIR.UnificationStep certificate (state.toMarking certificate abstractable)
                    ((state.markConclusion conclusion outputToken).toMarking certificate ⋯)
```

### `ProofNetIR.UnificationState.forwardToken?`

Kind: definition.

Check exactly the token-level guards of a unary/par forward firing and
return the representative token to place on the conclusion.

```lean
ProofNetIR.UnificationState.forwardToken? : ProofNetIR.UnificationState → ProofNetIR.Vertex → ProofNetIR.Vertex → ProofNetIR.Vertex → Option Nat
```

### `ProofNetIR.UnificationState.forwardToken?_success`

Kind: theorem.

A successful token-level forward check exposes every executable guard and
uses the same representative for both premises.

```lean
ProofNetIR.UnificationState.forwardToken?_success : ∀ {state : ProofNetIR.UnificationState} {left right conclusion outputToken : Nat},
  state.forwardToken? left right conclusion = some outputToken →
    state.marks[conclusion]? = some none ∧
      state.tokenAt? left = some outputToken ∧ state.tokenAt? right = some outputToken
```

### `ProofNetIR.UnificationState.unifyTokens?`

Kind: definition.

Check exactly the token-level guards of a binary/tensor unify firing and
return its two distinct current representatives.

```lean
ProofNetIR.UnificationState.unifyTokens? : ProofNetIR.UnificationState → ProofNetIR.Vertex → ProofNetIR.Vertex → ProofNetIR.Vertex → Option (Nat × Nat)
```

### `ProofNetIR.UnificationState.unifyTokens?_success`

Kind: theorem.

A successful token-level unify check exposes every executable guard and
returns two distinct representatives.

```lean
ProofNetIR.UnificationState.unifyTokens?_success : ∀ {state : ProofNetIR.UnificationState} {left right conclusion leftToken rightToken : Nat},
  state.unifyTokens? left right conclusion = some (leftToken, rightToken) →
    state.marks[conclusion]? = some none ∧
      state.tokenAt? left = some leftToken ∧ state.tokenAt? right = some rightToken ∧ leftToken ≠ rightToken
```

### `ProofNetIR.UnificationState.forwardToken?_refines`

Kind: theorem.

A successful executable forward-token check, together with submitted link
membership, produces one independent forward step and a valid updated
abstraction.

```lean
ProofNetIR.UnificationState.forwardToken?_refines : ∀ {certificate : ProofNetIR.Certificate} {state : ProofNetIR.UnificationState}
  (abstractable : ProofNetIR.UnificationState.Abstractable certificate state) {left right conclusion outputToken : Nat},
  ProofNetIR.Link.par left right conclusion ∈ certificate.links →
    state.forwardToken? left right conclusion = some outputToken →
      ∃ nextAbstractable,
        ProofNetIR.UnificationStep certificate (state.toMarking certificate abstractable)
          ((state.markConclusion conclusion outputToken).toMarking certificate nextAbstractable)
```

### `ProofNetIR.UnificationState.unifyTokens?_refines`

Kind: theorem.

A successful executable tensor guard refines exactly one independent
Figure-5 unify step. The proof relates raw premise marks, their current
representatives, the ordered root update, and the full fixed-carrier thread
relation; parsed component construction remains observationally irrelevant.

```lean
ProofNetIR.UnificationState.unifyTokens?_refines : ∀ {certificate : ProofNetIR.Certificate} {state : ProofNetIR.UnificationState}
  (abstractable : ProofNetIR.UnificationState.Abstractable certificate state),
  state.OrderedParents →
    ∀ {left right conclusion leftRepresentative rightRepresentative : Nat},
      ProofNetIR.Link.tensor left right conclusion ∈ certificate.links →
        state.unifyTokens? left right conclusion = some (leftRepresentative, rightRepresentative) →
          ∃ nextAbstractable,
            ProofNetIR.UnificationStep certificate (state.toMarking certificate abstractable)
              ((state.mergeConclusion conclusion (min leftRepresentative rightRepresentative)
                    (max leftRepresentative rightRepresentative)).toMarking
                certificate nextAbstractable)
```

### `ProofNetIR.UnificationState.tokenAt?_some_witness`

Kind: theorem.

A successful representative lookup always comes from a concrete raw mark
on the queried occurrence.

```lean
ProofNetIR.UnificationState.tokenAt?_some_witness : ∀ {state : ProofNetIR.UnificationState} {vertex token : Nat},
  state.tokenAt? vertex = some token →
    ∃ rawToken, state.assignedToken? vertex = some rawToken ∧ state.representative rawToken = token
```

### `ProofNetIR.UnificationState.Abstractable.tokenAt?_sameThread_witness`

Kind: theorem.

In an abstractable state, the representative returned by `tokenAt?` lies
in the same semantic thread as its witnessed raw mark.

```lean
ProofNetIR.UnificationState.Abstractable.tokenAt?_sameThread_witness : ∀ {certificate : ProofNetIR.Certificate} {state : ProofNetIR.UnificationState},
  ProofNetIR.UnificationState.Abstractable certificate state →
    ∀ {vertex token : Nat},
      state.tokenAt? vertex = some token →
        ∃ rawToken, state.assignedToken? vertex = some rawToken ∧ state.SameThread token rawToken
```

### `ProofNetIR.UnificationState.Abstractable.tokenAt?_bound`

Kind: theorem.

Every representative yielded by a marked occurrence in an abstractable
executable state remains inside the allocated union-find token range.

```lean
ProofNetIR.UnificationState.Abstractable.tokenAt?_bound : ∀ {certificate : ProofNetIR.Certificate} {state : ProofNetIR.UnificationState},
  ProofNetIR.UnificationState.Abstractable certificate state →
    ∀ {vertex token : Nat}, state.tokenAt? vertex = some token → token < state.parents.size
```

### `ProofNetIR.UnificationState.Abstractable.tokenAt?_root`

Kind: theorem.

A token returned by `tokenAt?` is a union-find root whenever the state is
abstractable.

```lean
ProofNetIR.UnificationState.Abstractable.tokenAt?_root : ∀ {certificate : ProofNetIR.Certificate} {state : ProofNetIR.UnificationState},
  ProofNetIR.UnificationState.Abstractable certificate state →
    ∀ {vertex token : Nat}, state.tokenAt? vertex = some token → state.representative token = token
```

### `ProofNetIR.UnificationState.componentAt?`

Kind: definition.

Live parsed component for a representative token.

```lean
ProofNetIR.UnificationState.componentAt? : ProofNetIR.UnificationState → Nat → Option ProofNetIR.UnificationComponent
```

### `ProofNetIR.UnificationState.ComponentsFormulaConsistent.componentAt`

Kind: theorem.

Every component returned through the representative-indexed lookup
inherits the state's stored-component formula invariant.

```lean
ProofNetIR.UnificationState.ComponentsFormulaConsistent.componentAt : ∀ {certificate : ProofNetIR.Certificate} {state : ProofNetIR.UnificationState},
  ProofNetIR.UnificationState.ComponentsFormulaConsistent certificate state →
    ∀ {token : Nat} {component : ProofNetIR.UnificationComponent},
      state.componentAt? token = some component →
        ProofNetIR.UnificationComponent.FormulaConsistent certificate component
```

### `ProofNetIR.Certificate.FirstOccurrencePick`

Kind: definition.

Public proof wrapper for the production first-occurrence frontier picker.
The wrapper exposes exact successful selections without making the internal
recursive helper part of the callable API.

```lean
ProofNetIR.Certificate.FirstOccurrencePick : List ProofNetIR.Vertex → Nat → Nat → List ProofNetIR.Vertex → Prop
```

### `ProofNetIR.Certificate.FirstOccurrencePick.exists_of_mem`

Kind: theorem.

Every listed occurrence admits an exact public first-occurrence pick.

The recursive executable picker remains an implementation detail; this
wrapper is the stable proposition-level interface needed by scheduler proofs
that activate a finite waiting payload.

```lean
ProofNetIR.Certificate.FirstOccurrencePick.exists_of_mem : ∀ {source : List ProofNetIR.Vertex} {vertex : ProofNetIR.Vertex},
  vertex ∈ source → ∃ index remaining, ProofNetIR.Certificate.FirstOccurrencePick source vertex index remaining
```

### `ProofNetIR.Certificate.FirstOccurrencePick.positional`

Kind: theorem.

The production first-occurrence picker records the same positional
selection as the derivation-level list picker.  This exposes the exact focus
equation without making the recursive production helper public.

```lean
ProofNetIR.Certificate.FirstOccurrencePick.positional : ∀ {source remaining : List ProofNetIR.Vertex} {vertex index : Nat},
  ProofNetIR.Certificate.FirstOccurrencePick source vertex index remaining →
    ProofNetIR.CutFreeDerivation.pick? source index = some (vertex, remaining)
```

### `ProofNetIR.Certificate.FirstOccurrencePick.mem_remaining_of_ne`

Kind: theorem.

Picking one occurrence preserves every differently named occurrence in
the returned remainder.

```lean
ProofNetIR.Certificate.FirstOccurrencePick.mem_remaining_of_ne : ∀ {source remaining : List ProofNetIR.Vertex} {selected candidate index : Nat},
  ProofNetIR.Certificate.FirstOccurrencePick source selected index remaining →
    candidate ≠ selected → candidate ∈ source → candidate ∈ remaining
```

### `ProofNetIR.Certificate.FirstOccurrencePick.two_of_mem`

Kind: theorem.

Two distinct listed occurrences admit exact consecutive public picks.

```lean
ProofNetIR.Certificate.FirstOccurrencePick.two_of_mem : ∀ {source : List ProofNetIR.Vertex} {left right : ProofNetIR.Vertex},
  left ≠ right →
    left ∈ source →
      right ∈ source →
        ∃ leftIndex afterLeft rightIndex context,
          ProofNetIR.Certificate.FirstOccurrencePick source left leftIndex afterLeft ∧
            ProofNetIR.Certificate.FirstOccurrencePick afterLeft right rightIndex context
```

### `ProofNetIR.Certificate.queuePar?`

Kind: definition.

Build one delayed Figure-7 par component without assigning a raw mark to
its conclusion.

Unlike the eager `firePar?` helper, this production-core primitive only
constructs the component, exposes the conclusion on its frontier, and
increments the connective counter.  A later ready-pop transition assigns the
raw age.  Consequently this primitive does not refine a standalone Figure-5
`UnificationStep`.

```lean
ProofNetIR.Certificate.queuePar? : ProofNetIR.UnificationState →
  ProofNetIR.Vertex → ProofNetIR.Vertex → ProofNetIR.Vertex → Option ProofNetIR.UnificationState
```

### `ProofNetIR.Certificate.QueueParStep`

Kind: inductive type.

Exact proof-relevant witness for one delayed par-component queue.

```lean
ProofNetIR.Certificate.QueueParStep : ProofNetIR.UnificationState →
  ProofNetIR.UnificationState → ProofNetIR.Vertex → ProofNetIR.Vertex → ProofNetIR.Vertex → Type
```

### `ProofNetIR.Certificate.queuePar?_some_iff`

Kind: theorem.

Delayed par queuing succeeds exactly when its token, component, and two
first-occurrence frontier selections have a typed success witness.

```lean
ProofNetIR.Certificate.queuePar?_some_iff : ∀ {before after : ProofNetIR.UnificationState} {left right conclusion : ProofNetIR.Vertex},
  ProofNetIR.Certificate.queuePar? before left right conclusion = some after ↔
    Nonempty (ProofNetIR.Certificate.QueueParStep before after left right conclusion)
```

### `ProofNetIR.Certificate.queuePar?_exact`

Kind: theorem.

Exact core fields of one successful delayed par queue.  In particular,
the conclusion and every other raw mark remain unchanged.

```lean
ProofNetIR.Certificate.queuePar?_exact : ∀ {before after : ProofNetIR.UnificationState} {left right conclusion : ProofNetIR.Vertex},
  ProofNetIR.Certificate.queuePar? before left right conclusion = some after →
    ∃ outputToken component leftFocus afterLeft rightFocus context,
      before.forwardToken? left right conclusion = some outputToken ∧
        before.componentAt? outputToken = some component ∧
          ProofNetIR.Certificate.FirstOccurrencePick component.frontier left leftFocus afterLeft ∧
            ProofNetIR.Certificate.FirstOccurrencePick afterLeft right rightFocus context ∧
              after.components =
                  before.components.setIfInBounds outputToken
                    (some
                      { tree := ProofNetIR.CutFreeDerivation.par leftFocus rightFocus component.tree,
                        frontier := context ++ [conclusion] }) ∧
                after.marks = before.marks ∧
                  after.parents = before.parents ∧
                    after.startedAxioms = before.startedAxioms ∧ after.firedConnectives = before.firedConnectives + 1
```

### `ProofNetIR.Certificate.queuePar?_conclusion_unmarked`

Kind: theorem.

A delayed par queue leaves its conclusion in the exact raw-unmarked
array state required by a later ready-pop assignment.

```lean
ProofNetIR.Certificate.queuePar?_conclusion_unmarked : ∀ {before after : ProofNetIR.UnificationState} {left right conclusion : ProofNetIR.Vertex},
  ProofNetIR.Certificate.queuePar? before left right conclusion = some after → after.marks[conclusion]? = some none
```

### `ProofNetIR.Certificate.queuePar?_reservationAlignment`

Kind: theorem.

Delayed par queuing preserves the two carrier/counter alignments reused
by the reservation invariant.

```lean
ProofNetIR.Certificate.queuePar?_reservationAlignment : ∀ {before after : ProofNetIR.UnificationState} {left right conclusion : ProofNetIR.Vertex},
  before.components.size = before.parents.size →
    before.startedAxioms = before.parents.size →
      ProofNetIR.Certificate.queuePar? before left right conclusion = some after →
        after.components.size = after.parents.size ∧ after.startedAxioms = after.parents.size
```

### `ProofNetIR.Certificate.queuePar?_abstractable`

Kind: theorem.

Delayed par construction preserves the executable abstraction contract
because raw marks and the parent forest are unchanged.

```lean
ProofNetIR.Certificate.queuePar?_abstractable : ∀ {certificate : ProofNetIR.Certificate} {before after : ProofNetIR.UnificationState},
  ProofNetIR.UnificationState.Abstractable certificate before →
    ∀ {left right conclusion : ProofNetIR.Vertex},
      ProofNetIR.Certificate.queuePar? before left right conclusion = some after →
        ProofNetIR.UnificationState.Abstractable certificate after
```

### `ProofNetIR.Certificate.queuePar?_orderedParents`

Kind: theorem.

Delayed par construction preserves the ordered parent forest exactly.

```lean
ProofNetIR.Certificate.queuePar?_orderedParents : ∀ {before after : ProofNetIR.UnificationState},
  before.OrderedParents →
    ∀ {left right conclusion : ProofNetIR.Vertex},
      ProofNetIR.Certificate.queuePar? before left right conclusion = some after → after.OrderedParents
```

### `ProofNetIR.Certificate.queuePar?_componentsFormulaConsistent`

Kind: theorem.

A well-typed delayed par queue replaces its live component by the exact
formula-consistent par component while leaving all other live slots valid.

```lean
ProofNetIR.Certificate.queuePar?_componentsFormulaConsistent : ∀ {certificate : ProofNetIR.Certificate} {before after : ProofNetIR.UnificationState},
  ProofNetIR.UnificationState.ComponentsFormulaConsistent certificate before →
    ∀ {left right conclusion : ProofNetIR.Vertex},
      certificate.LinkWellFormed (ProofNetIR.Link.par left right conclusion) →
        ProofNetIR.Certificate.queuePar? before left right conclusion = some after →
          ProofNetIR.UnificationState.ComponentsFormulaConsistent certificate after
```

### `ProofNetIR.Certificate.queueTensor?`

Kind: definition.

Build and merge the two active tensor components without assigning a raw
mark to the tensor conclusion.

This is only the local tensor sub-primitive needed by a later Figure-7
`unify`: it increments the connective counter once, points the larger current
representative at the smaller one, and leaves the conclusion raw-unmarked.
The full rule must first identify those representatives with the exact
scheduler boundaries `j < i`, then drain `W(j)` and construct or activate the
waiting par components (adding their own counter contributions).

```lean
ProofNetIR.Certificate.queueTensor? : ProofNetIR.UnificationState →
  ProofNetIR.Vertex → ProofNetIR.Vertex → ProofNetIR.Vertex → Option ProofNetIR.UnificationState
```

### `ProofNetIR.Certificate.QueueTensorStep`

Kind: inductive type.

Exact proof-relevant witness for one delayed tensor-component queue.

```lean
ProofNetIR.Certificate.QueueTensorStep : ProofNetIR.UnificationState →
  ProofNetIR.UnificationState → ProofNetIR.Vertex → ProofNetIR.Vertex → ProofNetIR.Vertex → Type
```

### `ProofNetIR.Certificate.queueTensor?_some_iff`

Kind: theorem.

Delayed tensor queuing succeeds exactly when both live components and
their exact first-occurrence premise selections are available.

```lean
ProofNetIR.Certificate.queueTensor?_some_iff : ∀ {before after : ProofNetIR.UnificationState} {left right conclusion : ProofNetIR.Vertex},
  ProofNetIR.Certificate.queueTensor? before left right conclusion = some after ↔
    Nonempty (ProofNetIR.Certificate.QueueTensorStep before after left right conclusion)
```

### `ProofNetIR.Certificate.queueTensor?_exact`

Kind: theorem.

Exact core fields of one successful delayed tensor queue.  The conclusion
is not marked; only the larger representative's parent, the two component
slots, and the local connective counter change.

```lean
ProofNetIR.Certificate.queueTensor?_exact : ∀ {before after : ProofNetIR.UnificationState} {left right conclusion : ProofNetIR.Vertex},
  ProofNetIR.Certificate.queueTensor? before left right conclusion = some after →
    ∃ leftToken rightToken leftComponent rightComponent leftFocus leftContext rightFocus rightContext,
      before.unifyTokens? left right conclusion = some (leftToken, rightToken) ∧
        before.componentAt? leftToken = some leftComponent ∧
          before.componentAt? rightToken = some rightComponent ∧
            ProofNetIR.Certificate.FirstOccurrencePick leftComponent.frontier left leftFocus leftContext ∧
              ProofNetIR.Certificate.FirstOccurrencePick rightComponent.frontier right rightFocus rightContext ∧
                after.parents = before.parents.setIfInBounds (max leftToken rightToken) (min leftToken rightToken) ∧
                  after.components =
                      (before.components.setIfInBounds (min leftToken rightToken)
                            (some
                              {
                                tree :=
                                  ProofNetIR.CutFreeDerivation.tensor leftFocus rightFocus leftComponent.tree
                                    rightComponent.tree,
                                frontier := conclusion :: (leftContext ++ rightContext) })).setIfInBounds
                        (max leftToken rightToken) none ∧
                    after.marks = before.marks ∧
                      after.startedAxioms = before.startedAxioms ∧ after.firedConnectives = before.firedConnectives + 1
```

### `ProofNetIR.Certificate.queueTensor?_conclusion_unmarked`

Kind: theorem.

A delayed tensor queue likewise leaves its conclusion raw-unmarked.

```lean
ProofNetIR.Certificate.queueTensor?_conclusion_unmarked : ∀ {before after : ProofNetIR.UnificationState} {left right conclusion : ProofNetIR.Vertex},
  ProofNetIR.Certificate.queueTensor? before left right conclusion = some after → after.marks[conclusion]? = some none
```

### `ProofNetIR.Certificate.queueTensor?_representatives_distinct`

Kind: theorem.

A successful tensor queue exposes two distinct current representatives;
therefore its `set`-then-`clear` component update cannot target one slot.

```lean
ProofNetIR.Certificate.queueTensor?_representatives_distinct : ∀ {before after : ProofNetIR.UnificationState} {left right conclusion : ProofNetIR.Vertex},
  ProofNetIR.Certificate.queueTensor? before left right conclusion = some after →
    ∃ leftToken rightToken,
      before.unifyTokens? left right conclusion = some (leftToken, rightToken) ∧
        leftToken ≠ rightToken ∧ min leftToken rightToken ≠ max leftToken rightToken
```

### `ProofNetIR.Certificate.queueTensor?_reservationAlignment`

Kind: theorem.

The local tensor sub-primitive also preserves carrier size and the
started-axiom/parent alignment: it mutates one parent cell and two component
cells without resizing either array.

```lean
ProofNetIR.Certificate.queueTensor?_reservationAlignment : ∀ {before after : ProofNetIR.UnificationState} {left right conclusion : ProofNetIR.Vertex},
  before.components.size = before.parents.size →
    before.startedAxioms = before.parents.size →
      ProofNetIR.Certificate.queueTensor? before left right conclusion = some after →
        after.components.size = after.parents.size ∧ after.startedAxioms = after.parents.size
```

### `ProofNetIR.Certificate.queueTensor?_orderedParents`

Kind: theorem.

The local tensor merge preserves ordered parents by pointing the larger
current representative at the smaller one.

```lean
ProofNetIR.Certificate.queueTensor?_orderedParents : ∀ {before after : ProofNetIR.UnificationState},
  before.OrderedParents →
    ∀ {left right conclusion : ProofNetIR.Vertex},
      ProofNetIR.Certificate.queueTensor? before left right conclusion = some after → after.OrderedParents
```

### `ProofNetIR.Certificate.queueTensor?_abstractable`

Kind: theorem.

The local tensor merge preserves the executable abstraction contract
under the existing ordered-parent invariant.

```lean
ProofNetIR.Certificate.queueTensor?_abstractable : ∀ {certificate : ProofNetIR.Certificate} {before after : ProofNetIR.UnificationState},
  ProofNetIR.UnificationState.Abstractable certificate before →
    before.OrderedParents →
      ∀ {left right conclusion : ProofNetIR.Vertex},
        ProofNetIR.Certificate.queueTensor? before left right conclusion = some after →
          ProofNetIR.UnificationState.Abstractable certificate after
```

### `ProofNetIR.Certificate.queueTensor?_componentsFormulaConsistent`

Kind: theorem.

A well-typed delayed tensor queue installs the exact consistent merged
component and clears the retired slot.  This theorem covers only the local
tensor sub-primitive; it does not activate components represented by a
drained scheduler waiting bucket.

```lean
ProofNetIR.Certificate.queueTensor?_componentsFormulaConsistent : ∀ {certificate : ProofNetIR.Certificate} {before after : ProofNetIR.UnificationState},
  ProofNetIR.UnificationState.ComponentsFormulaConsistent certificate before →
    ∀ {left right conclusion : ProofNetIR.Vertex},
      certificate.LinkWellFormed (ProofNetIR.Link.tensor left right conclusion) →
        ProofNetIR.Certificate.queueTensor? before left right conclusion = some after →
          ProofNetIR.UnificationState.ComponentsFormulaConsistent certificate after
```

### `ProofNetIR.Certificate.ExactOccurrencePick`

Kind: inductive type.

One premise selection keeps both exact views needed by the two existing
executables: the production picker selects the first matching vertex, while
the derivation picker records the occurrence position stored in the runtime
tree.  Keeping both equations avoids identifying repeated formula labels.

```lean
ProofNetIR.Certificate.ExactOccurrencePick : {source remaining : List ProofNetIR.Vertex} → Nat → Nat → Prop
```

### `ProofNetIR.Certificate.ExactOccurrencePick.ofFirst`

Kind: theorem.

The stable public production-picker bridge supplies the positional half
of an exact occurrence selection.

```lean
ProofNetIR.Certificate.ExactOccurrencePick.ofFirst : ∀ {source remaining : List ProofNetIR.Vertex} {vertex index : Nat},
  ProofNetIR.Certificate.FirstOccurrencePick source vertex index remaining →
    ProofNetIR.Certificate.ExactOccurrencePick vertex index
```

### `ProofNetIR.Certificate.OccurrenceDerivation`

Kind: inductive type.

Exact occurrence-level provenance for a runtime derivation component.

`usedLinks` records submitted link positions, not link values.  `owned`
records every certificate formula vertex covered by the partial derivation:
both endpoints for an axiom and, recursively, every premise occurrence plus
the newly introduced connective conclusion.

```lean
ProofNetIR.Certificate.OccurrenceDerivation : ProofNetIR.Certificate →
  ProofNetIR.CutFreeDerivation → List ProofNetIR.Vertex → List Nat → List ProofNetIR.Vertex → Prop
```

### `ProofNetIR.Certificate.ComponentOccurrenceWitness`

Kind: inductive type.

A live component has one occurrence-exact derivation and locally linear
link/vertex accounting.  This is a proposition only; it adds no runtime data
to `UnificationComponent`.

```lean
ProofNetIR.Certificate.ComponentOccurrenceWitness : ProofNetIR.Certificate → ProofNetIR.UnificationComponent → List Nat → List Nat → Prop
```

### `ProofNetIR.Certificate.OwnedOccurrenceAccounted`

Kind: definition.

Every occurrence owned by one live raw component slot is accounted for
at that exact slot.  A marked occurrence's raw age must resolve to the slot;
an unmarked occurrence must still be exposed on the same component frontier.

```lean
ProofNetIR.Certificate.OwnedOccurrenceAccounted : ProofNetIR.UnificationState → Nat → ProofNetIR.UnificationComponent → List ProofNetIR.Vertex → Prop
```

### `ProofNetIR.Certificate.MarkedOccurrencesOwned`

Kind: definition.

Conversely, every concrete raw mark belongs to an occurrence owned by
the live component stored at its exact current representative slot.

```lean
ProofNetIR.Certificate.MarkedOccurrencesOwned : ProofNetIR.UnificationState → (Nat → List ProofNetIR.Vertex) → Prop
```

### `ProofNetIR.Certificate.ComponentForestProvenance`

Kind: definition.

Proof-only forest accounting for all live component slots.

Each live slot receives exact local provenance, and distinct live slots own
disjoint submitted links and formula vertices.  Ownership is exact in both
directions: each owned vertex is either unmarked on that same frontier or
marked into that slot's representative class, and every concrete raw mark is
owned by the component at its representative.  This predicate is independent
of the older executable `Produced` relation.

```lean
ProofNetIR.Certificate.ComponentForestProvenance : ProofNetIR.Certificate → ProofNetIR.UnificationState → Prop
```

### `ProofNetIR.Certificate.OccurrenceDerivation.usedLink_lookup`

Kind: theorem.

Every recorded link position is an exact submitted-list lookup.

```lean
ProofNetIR.Certificate.OccurrenceDerivation.usedLink_lookup : ∀ {certificate : ProofNetIR.Certificate} {tree : ProofNetIR.CutFreeDerivation} {frontier usedLinks owned : List Nat},
  certificate.OccurrenceDerivation tree frontier usedLinks owned →
    ∀ {linkIndex : Nat}, linkIndex ∈ usedLinks → ∃ link, certificate.links[linkIndex]? = some link
```

### `ProofNetIR.Certificate.OccurrenceDerivation.usedLinkIndex_lt`

Kind: theorem.

Recorded submitted positions are in bounds in the exact input link list.

```lean
ProofNetIR.Certificate.OccurrenceDerivation.usedLinkIndex_lt : ∀ {certificate : ProofNetIR.Certificate} {tree : ProofNetIR.CutFreeDerivation} {frontier usedLinks owned : List Nat},
  certificate.OccurrenceDerivation tree frontier usedLinks owned →
    ∀ {linkIndex : Nat}, linkIndex ∈ usedLinks → linkIndex < certificate.links.length
```

### `ProofNetIR.Certificate.OccurrenceDerivation.usedConnectiveConclusion_owned`

Kind: theorem.

The conclusion of every recorded submitted connective belongs to the
component's exact owned-occurrence list.

```lean
ProofNetIR.Certificate.OccurrenceDerivation.usedConnectiveConclusion_owned : ∀ {certificate : ProofNetIR.Certificate} {tree : ProofNetIR.CutFreeDerivation} {frontier usedLinks owned : List Nat},
  certificate.OccurrenceDerivation tree frontier usedLinks owned →
    ∀ {linkIndex left right conclusion : Nat},
      linkIndex ∈ usedLinks →
        certificate.links[linkIndex]? = some (ProofNetIR.Link.tensor left right conclusion) ∨
            certificate.links[linkIndex]? = some (ProofNetIR.Link.par left right conclusion) →
          conclusion ∈ owned
```

### `ProofNetIR.Certificate.OccurrenceDerivation.frontier_subset_owned`

Kind: theorem.

Every exposed frontier occurrence is owned by the same component.

```lean
ProofNetIR.Certificate.OccurrenceDerivation.frontier_subset_owned : ∀ {certificate : ProofNetIR.Certificate} {tree : ProofNetIR.CutFreeDerivation} {frontier usedLinks owned : List Nat},
  certificate.OccurrenceDerivation tree frontier usedLinks owned → ∀ (vertex : Nat), vertex ∈ frontier → vertex ∈ owned
```

### `ProofNetIR.Certificate.OccurrenceDerivation.owned_inBounds`

Kind: theorem.

Under certificate structural well-formedness, every owned formula
occurrence is an in-bounds input vertex.

```lean
ProofNetIR.Certificate.OccurrenceDerivation.owned_inBounds : ∀ {certificate : ProofNetIR.Certificate},
  certificate.StructurallyWellFormed →
    ∀ {tree : ProofNetIR.CutFreeDerivation} {frontier usedLinks owned : List Nat},
      certificate.OccurrenceDerivation tree frontier usedLinks owned →
        ∀ (vertex : Nat), vertex ∈ owned → vertex < certificate.formulas.size
```

### `ProofNetIR.Certificate.OccurrenceDerivation.formulaConsistent`

Kind: theorem.

Occurrence provenance implies the existing formula-consistency contract
without ever equating vertices merely because their formula labels agree.

```lean
ProofNetIR.Certificate.OccurrenceDerivation.formulaConsistent : ∀ {certificate : ProofNetIR.Certificate},
  certificate.StructurallyWellFormed →
    ∀ {tree : ProofNetIR.CutFreeDerivation} {frontier usedLinks owned : List Nat},
      certificate.OccurrenceDerivation tree frontier usedLinks owned →
        ProofNetIR.UnificationComponent.FormulaConsistent certificate { tree := tree, frontier := frontier }
```

### `ProofNetIR.Certificate.OccurrenceDerivation.ofQueueParStep`

Kind: theorem.

A local delayed-par queue extends occurrence provenance once the caller
supplies the exact submitted link position and lookup, the only link-identity
facts absent from `QueueParStep`.

```lean
ProofNetIR.Certificate.OccurrenceDerivation.ofQueueParStep : ∀ {certificate : ProofNetIR.Certificate} {before after : ProofNetIR.UnificationState}
  {left right conclusion : ProofNetIR.Vertex}
  (step : ProofNetIR.Certificate.QueueParStep before after left right conclusion) {usedLinks owned : List Nat},
  certificate.OccurrenceDerivation step.component.tree step.component.frontier usedLinks owned →
    ∀ (linkIndex : Nat),
      certificate.links[linkIndex]? = some (ProofNetIR.Link.par left right conclusion) →
        certificate.OccurrenceDerivation
          (ProofNetIR.CutFreeDerivation.par step.leftFocus step.rightFocus step.component.tree)
          (step.context ++ [conclusion]) (linkIndex :: usedLinks) (conclusion :: owned)
```

### `ProofNetIR.Certificate.OccurrenceDerivation.ofQueueTensorStep`

Kind: theorem.

A local delayed-tensor queue has the analogous strongest sound extension:
the queue witness supplies exact component/picker data, while the caller must
supply only the submitted tensor index and lookup.

```lean
ProofNetIR.Certificate.OccurrenceDerivation.ofQueueTensorStep : ∀ {certificate : ProofNetIR.Certificate} {before after : ProofNetIR.UnificationState}
  {left right conclusion : ProofNetIR.Vertex}
  (step : ProofNetIR.Certificate.QueueTensorStep before after left right conclusion)
  {leftUsed rightUsed leftOwned rightOwned : List Nat},
  certificate.OccurrenceDerivation step.leftComponent.tree step.leftComponent.frontier leftUsed leftOwned →
    certificate.OccurrenceDerivation step.rightComponent.tree step.rightComponent.frontier rightUsed rightOwned →
      ∀ (linkIndex : Nat),
        certificate.links[linkIndex]? = some (ProofNetIR.Link.tensor left right conclusion) →
          certificate.OccurrenceDerivation
            (ProofNetIR.CutFreeDerivation.tensor step.leftFocus step.rightFocus step.leftComponent.tree
              step.rightComponent.tree)
            (conclusion :: (step.leftContext ++ step.rightContext)) (linkIndex :: (leftUsed ++ rightUsed))
            (conclusion :: (leftOwned ++ rightOwned))
```

### `ProofNetIR.Certificate.ComponentOccurrenceWitness.axiom_of_submitted`

Kind: theorem.

Exact locally linear witness for one submitted, well-formed axiom in its
stored endpoint orientation.

```lean
ProofNetIR.Certificate.ComponentOccurrenceWitness.axiom_of_submitted : ∀ {certificate : ProofNetIR.Certificate},
  certificate.StructurallyWellFormed →
    ∀ {linkIndex left right : Nat} {name : String} {positive : Bool},
      certificate.links[linkIndex]? = some (ProofNetIR.Link.axiom left right) →
        certificate.formula? left = some (ProofNetIR.Formula.atom name positive) →
          certificate.ComponentOccurrenceWitness
            { tree := ProofNetIR.CutFreeDerivation.axiom name positive, frontier := [left, right] } [linkIndex]
            [left, right]
```

### `ProofNetIR.Certificate.reserveAxiomAt?_componentOccurrenceWitness`

Kind: theorem.

Reserving a submitted axiom installs an exact occurrence-provenance
witness at the freshly appended component slot.

```lean
ProofNetIR.Certificate.reserveAxiomAt?_componentOccurrenceWitness : ∀ {certificate : ProofNetIR.Certificate},
  certificate.StructurallyWellFormed →
    ∀ {before after : ProofNetIR.UnificationState} {linkIndex : Nat},
      certificate.reserveAxiomAt? before linkIndex = some after →
        ∃ left right name positive,
          certificate.links[linkIndex]? = some (ProofNetIR.Link.axiom left right) ∧
            after.components[before.components.size]? =
                some (some { tree := ProofNetIR.CutFreeDerivation.axiom name positive, frontier := [left, right] }) ∧
              certificate.ComponentOccurrenceWitness
                { tree := ProofNetIR.CutFreeDerivation.axiom name positive, frontier := [left, right] } [linkIndex]
                [left, right]
```

### `ProofNetIR.Certificate.ExactOccurrencePick.rejects_same_formula_alias`

Kind: theorem.

Equal formula labels do not let a different certificate vertex satisfy
an occurrence-position witness.  This is the local repeated-label rejection
gate used by later provenance-preservation proofs.

```lean
ProofNetIR.Certificate.ExactOccurrencePick.rejects_same_formula_alias : ∀ {certificate : ProofNetIR.Certificate} {head alias : ProofNetIR.Vertex} {tail remaining : List ProofNetIR.Vertex},
  head ≠ alias →
    certificate.formula? head = certificate.formula? alias → ProofNetIR.Certificate.ExactOccurrencePick alias 0 → False
```

### `ProofNetIR.UnificationScanStats`

Kind: inductive type.

Observable work counters for the eager repeated-scan implementation.

`linkVisits` counts only link-list entries inspected by saturation. It
does not count frontier search, union-find traversal, final derivation
verification, or a hybrid fallback.

```lean
ProofNetIR.UnificationScanStats : Type
```

### `ProofNetIR.UnificationCandidateResult`

Kind: inductive type.

A derivation candidate together with proof-relevant bounds for the exact
eager scan schedule that produced it.

```lean
ProofNetIR.UnificationCandidateResult : ProofNetIR.Certificate → Type
```

### `ProofNetIR.UnificationCandidateResult.linkVisitsBound`

Kind: theorem.

The eager candidate generator visits at most the square of the submitted
link count. This theorem concerns link-list visits only.

```lean
ProofNetIR.UnificationCandidateResult.linkVisitsBound : ∀ {certificate : ProofNetIR.Certificate} (result : ProofNetIR.UnificationCandidateResult certificate),
  result.stats.linkVisits ≤ certificate.links.length * certificate.links.length
```

### `ProofNetIR.UnificationVerificationResult`

Kind: inductive type.

A proof-bearing unification result retaining the exact scan statistics of
the candidate that passed independent verification.

```lean
ProofNetIR.UnificationVerificationResult : ProofNetIR.Certificate → Type
```

### `ProofNetIR.UnificationWorklistStats`

Kind: inductive type.

Observable counters for the event-driven ready/waiting worklist
prototype. No asymptotic theorem is attached to these counters yet.

```lean
ProofNetIR.UnificationWorklistStats : Type
```

### `ProofNetIR.UnificationWorklistStats.attemptBudget`

Kind: definition.

Conservative executable link-attempt budget for the current worklist.
The proof layer establishes that canonical production runs exhaust their queue
within this fuel; that scheduler theorem is not yet correct-net completeness or
a whole-program complexity theorem.

```lean
ProofNetIR.UnificationWorklistStats.attemptBudget : Nat → Nat
```

### `ProofNetIR.UnificationWorklistCandidateResult`

Kind: inductive type.

Derivation candidate produced by the event-driven ready/waiting worklist
prototype.

```lean
ProofNetIR.UnificationWorklistCandidateResult : ProofNetIR.Certificate → Type
```

### `ProofNetIR.UnificationWorklistCandidateResult.linkAttemptsWithinBudget`

Kind: theorem.

Every successful worklist candidate stays within the conservative
executable link-attempt budget. A separate internal scheduler theorem proves
canonical queue exhaustion; correct-net progress remains open.

```lean
ProofNetIR.UnificationWorklistCandidateResult.linkAttemptsWithinBudget : ∀ {certificate : ProofNetIR.Certificate} (result : ProofNetIR.UnificationWorklistCandidateResult certificate),
  result.stats.linkAttempts ≤ ProofNetIR.UnificationWorklistStats.attemptBudget certificate.links.length
```

### `ProofNetIR.UnificationWorklistVerificationResult`

Kind: inductive type.

Independently verified worklist candidate with its operational counters.

```lean
ProofNetIR.UnificationWorklistVerificationResult : ProofNetIR.Certificate → Type
```

### `ProofNetIR.UnificationErrorCode`

Kind: inductive type.

Stable failure category for deterministic unification. A fast-path failure
does not by itself prove that the submitted certificate is incorrect.

```lean
ProofNetIR.UnificationErrorCode : Type
```

### `ProofNetIR.UnificationError`

Kind: inductive type.

Structured diagnostic for the deterministic unification tier.

```lean
ProofNetIR.UnificationError : Type
```

### `ProofNetIR.UnificationError.render`

Kind: definition.

Human-readable diagnostic preserving the stable machine category.

```lean
ProofNetIR.UnificationError.render : ProofNetIR.UnificationError → String
```

### `ProofNetIR.Certificate.unificationDerivationCandidateWithStats`

Kind: definition.

Detailed deterministic Guerrini-style parsing candidate with exact scan
statistics and a proof-relevant quadratic link-visit bound.

This executable does not enumerate switchings or cycles. It starts one thread
per axiom, forwards unary/par links whose premise tokens agree, and unifies
binary/tensor links whose premise tokens differ. A candidate is returned only
when every formula occurrence is marked, every connective fired, exactly one
component remains, and its frontier is exactly the public conclusion boundary.

The returned tree is still untrusted data. `unificationReconstruct` below
independently verifies it before exposing a proof-bearing result. Errors from
this tier are inconclusive except for `malformedInput`.

```lean
ProofNetIR.Certificate.unificationDerivationCandidateWithStats : (certificate : ProofNetIR.Certificate) →
  Except ProofNetIR.UnificationError (ProofNetIR.UnificationCandidateResult certificate)
```

### `ProofNetIR.Certificate.unificationDerivationCandidate`

Kind: definition.

Compatibility projection of the derivation-only unification candidate.

```lean
ProofNetIR.Certificate.unificationDerivationCandidate : ProofNetIR.Certificate → Except ProofNetIR.UnificationError ProofNetIR.CutFreeDerivation
```

### `ProofNetIR.Certificate.unificationWorklistDerivationCandidate`

Kind: definition.

Event-driven ready/waiting worklist candidate.

This prototype keeps the Figure-5 token semantics and derivation components,
but replaces full repeated scans with dependency enqueues plus a waiting-par
set requeued after tensor unions. Its production fuel is proved sufficient to
empty the queue, but it has no universal correct-net completeness or linear
complexity theorem yet.

```lean
ProofNetIR.Certificate.unificationWorklistDerivationCandidate : (certificate : ProofNetIR.Certificate) →
  Except ProofNetIR.UnificationError (ProofNetIR.UnificationWorklistCandidateResult certificate)
```

### `ProofNetIR.Certificate.unificationDerivationCandidate?`

Kind: definition.

Option compatibility wrapper for the detailed unification candidate.

```lean
ProofNetIR.Certificate.unificationDerivationCandidate? : ProofNetIR.Certificate → Option ProofNetIR.CutFreeDerivation
```

### `ProofNetIR.Certificate.unificationReconstructWithStats`

Kind: definition.

Detailed proof-bearing deterministic unification fast path retaining scan
statistics.

```lean
ProofNetIR.Certificate.unificationReconstructWithStats : (certificate : ProofNetIR.Certificate) →
  Except ProofNetIR.UnificationError (ProofNetIR.UnificationVerificationResult certificate)
```

### `ProofNetIR.Certificate.unificationReconstruct`

Kind: definition.

Compatibility projection of the proof-bearing unification result.

```lean
ProofNetIR.Certificate.unificationReconstruct : (certificate : ProofNetIR.Certificate) →
  Except ProofNetIR.UnificationError (ProofNetIR.DerivationVerificationResult certificate)
```

### `ProofNetIR.Certificate.unificationReconstruct?`

Kind: definition.

Proof-bearing fast path for deterministic unification. The generated tree
must pass the independent derivation verifier, including formula inference,
desequentialization, and intrinsic proof-net equivalence.

```lean
ProofNetIR.Certificate.unificationReconstruct? : (certificate : ProofNetIR.Certificate) → Option (ProofNetIR.DerivationVerificationResult certificate)
```

### `ProofNetIR.Certificate.unificationWorklistReconstructWithStats`

Kind: definition.

Independently verify the event-driven worklist candidate and retain its
operational counters.

```lean
ProofNetIR.Certificate.unificationWorklistReconstructWithStats : (certificate : ProofNetIR.Certificate) →
  Except ProofNetIR.UnificationError (ProofNetIR.UnificationWorklistVerificationResult certificate)
```

### `ProofNetIR.Certificate.unificationWorklistReconstruct?`

Kind: definition.

Proof-bearing option wrapper for the event-driven worklist prototype.

```lean
ProofNetIR.Certificate.unificationWorklistReconstruct? : (certificate : ProofNetIR.Certificate) → Option (ProofNetIR.UnificationWorklistVerificationResult certificate)
```

### `ProofNetIR.Certificate.unificationWorklistFastCheck`

Kind: definition.

Boolean event-driven worklist fast path. `false` is an inconclusive miss.

```lean
ProofNetIR.Certificate.unificationWorklistFastCheck : ProofNetIR.Certificate → Bool
```

### `ProofNetIR.Certificate.unificationWorklistReconstruct?_accepted`

Kind: theorem.

Every verified event-driven worklist success is reference accepted.

```lean
ProofNetIR.Certificate.unificationWorklistReconstruct?_accepted : ∀ {certificate : ProofNetIR.Certificate} {result : ProofNetIR.UnificationWorklistVerificationResult certificate},
  certificate.unificationWorklistReconstruct? = some result → certificate.check = true
```

### `ProofNetIR.Certificate.unificationWorklistFastCheck_sound`

Kind: theorem.

Soundness of the event-driven worklist Boolean fast path.

```lean
ProofNetIR.Certificate.unificationWorklistFastCheck_sound : ∀ (certificate : ProofNetIR.Certificate), certificate.unificationWorklistFastCheck = true → certificate.check = true
```

### `ProofNetIR.Certificate.unificationWorklistCheck`

Kind: definition.

Exact worklist-first decision with the certified recursive reconstruction
fallback. This is exact but not yet a pure-worklist or linear criterion.

```lean
ProofNetIR.Certificate.unificationWorklistCheck : ProofNetIR.Certificate → Bool
```

### `ProofNetIR.Certificate.unificationWorklistCheck_eq_check`

Kind: theorem.

The worklist-first hybrid is extensionally equal to the reference checker.

```lean
ProofNetIR.Certificate.unificationWorklistCheck_eq_check : ∀ (certificate : ProofNetIR.Certificate), certificate.unificationWorklistCheck = certificate.check
```

### `ProofNetIR.Certificate.unificationWorklistCheck_eq_true_iff_check`

Kind: theorem.

Iff form of exact agreement for the worklist-first hybrid.

```lean
ProofNetIR.Certificate.unificationWorklistCheck_eq_true_iff_check : ∀ (certificate : ProofNetIR.Certificate), certificate.unificationWorklistCheck = true ↔ certificate.check = true
```

### `ProofNetIR.Certificate.unificationWorklistCheck_eq_true_iff_declarativelyCorrect`

Kind: theorem.

Proposition-level correctness interface for the worklist-first hybrid.

```lean
ProofNetIR.Certificate.unificationWorklistCheck_eq_true_iff_declarativelyCorrect : ∀ (certificate : ProofNetIR.Certificate), certificate.unificationWorklistCheck = true ↔ certificate.DeclarativelyCorrect
```

### `ProofNetIR.Certificate.unificationFastCheck`

Kind: definition.

Boolean deterministic-unification fast path. A `false` result is a
heuristic miss, not yet a mathematical rejection.

```lean
ProofNetIR.Certificate.unificationFastCheck : ProofNetIR.Certificate → Bool
```

### `ProofNetIR.Certificate.unificationReconstruct_accepted`

Kind: theorem.

A detailed unification success is reference-checker accepted.

```lean
ProofNetIR.Certificate.unificationReconstruct_accepted : ∀ {certificate : ProofNetIR.Certificate} {result : ProofNetIR.DerivationVerificationResult certificate},
  certificate.unificationReconstruct = Except.ok result → certificate.check = true
```

### `ProofNetIR.Certificate.unificationReconstruct?_sound`

Kind: theorem.

Successful deterministic unification exposes the complete proof-bearing
verification contract.

```lean
ProofNetIR.Certificate.unificationReconstruct?_sound : ∀ {certificate : ProofNetIR.Certificate} {result : ProofNetIR.DerivationVerificationResult certificate},
  certificate.unificationReconstruct? = some result →
    certificate.StructurallyWellFormed ∧
      certificate.conclusionFormulas? = some result.sequent ∧
        result.tree.infer? = some result.sequent ∧
          result.tree.desequentialize? = some result.output ∧
            result.output.check = true ∧ result.output.ProofNetEquivalent certificate
```

### `ProofNetIR.Certificate.unificationReconstruct?_accepted`

Kind: theorem.

Every successful deterministic unification result is accepted by the
reference proof-net semantics.

```lean
ProofNetIR.Certificate.unificationReconstruct?_accepted : ∀ {certificate : ProofNetIR.Certificate} {result : ProofNetIR.DerivationVerificationResult certificate},
  certificate.unificationReconstruct? = some result → certificate.check = true
```

### `ProofNetIR.Certificate.unificationFastCheck_eq_true_iff`

Kind: theorem.

Boolean fast-path success is exactly the existence of a proof-bearing
unification result.

```lean
ProofNetIR.Certificate.unificationFastCheck_eq_true_iff : ∀ {certificate : ProofNetIR.Certificate},
  certificate.unificationFastCheck = true ↔ ∃ result, certificate.unificationReconstruct? = some result
```

### `ProofNetIR.Certificate.unificationFastCheck_sound`

Kind: theorem.

Soundness of the Boolean deterministic-unification fast path.

```lean
ProofNetIR.Certificate.unificationFastCheck_sound : ∀ (certificate : ProofNetIR.Certificate), certificate.unificationFastCheck = true → certificate.check = true
```

### `ProofNetIR.Certificate.unificationCheck`

Kind: definition.

Exact switching-free decision procedure with the event-driven worklist,
then the eager deterministic scan, then the previously certified recursive
sequentializer as its completeness fallback.

The fallback is exhaustive in the worst case. Consequently this definition
does not yet constitute the linear-time algorithm from Guerrini's theorem.

```lean
ProofNetIR.Certificate.unificationCheck : ProofNetIR.Certificate → Bool
```

### `ProofNetIR.Certificate.unificationCheck_eq_check`

Kind: theorem.

The hybrid unification decision is extensionally equal to the reference
all-switchings checker.

```lean
ProofNetIR.Certificate.unificationCheck_eq_check : ∀ (certificate : ProofNetIR.Certificate), certificate.unificationCheck = certificate.check
```

### `ProofNetIR.Certificate.unificationCheck_eq_true_iff_check`

Kind: theorem.

Iff form of exact agreement between the hybrid unification decision and
the reference checker.

```lean
ProofNetIR.Certificate.unificationCheck_eq_true_iff_check : ∀ (certificate : ProofNetIR.Certificate), certificate.unificationCheck = true ↔ certificate.check = true
```

### `ProofNetIR.Certificate.unificationCheck_eq_true_iff_declarativelyCorrect`

Kind: theorem.

Proposition-level correctness interface for the hybrid unification
decision.

```lean
ProofNetIR.Certificate.unificationCheck_eq_true_iff_declarativelyCorrect : ∀ (certificate : ProofNetIR.Certificate), certificate.unificationCheck = true ↔ certificate.DeclarativelyCorrect
```

### `ProofNetIR.ExecutableSequentializationResult.kernelDerivation`

Kind: theorem.

Every successful executable result contains a kernel-typed derivation of
the exact ordered input boundary.

```lean
ProofNetIR.ExecutableSequentializationResult.kernelDerivation : ∀ {input : ProofNetIR.Certificate} (result : ProofNetIR.ExecutableSequentializationResult input),
  Nonempty (ProofNetIR.Derivation result.sequent)
```

### `ProofNetIR.ExecutableSequentializationResult.proofNetEquivalent`

Kind: theorem.

Project the proof that the reconstructed output differs from the input only
by the documented proof-net equivalence.

```lean
ProofNetIR.ExecutableSequentializationResult.proofNetEquivalent : ∀ {input : ProofNetIR.Certificate} (result : ProofNetIR.ExecutableSequentializationResult input),
  result.output.ProofNetEquivalent input
```

## Sequential unification primitives

### `ProofNetIR.SequentialUnification.SourceIncidence`

Kind: inductive type.

One exact submitted link stored in the source-incidence table.

```lean
ProofNetIR.SequentialUnification.SourceIncidence : Type
```

### `ProofNetIR.SequentialUnification.SourceIndex`

Kind: definition.

Per-occurrence source incidences.  `nextAxiomWithFuel?` accepts only a
singleton bucket and rejects zero or multiple source entries.
`StructurallyWellFormed.sourceIndex_lookup_eq_singleton` proves that every
in-bounds production bucket is a singleton on the structural theorem
domain.

```lean
ProofNetIR.SequentialUnification.SourceIndex : Type
```

### `ProofNetIR.SequentialUnification.sourceIndex`

Kind: definition.

Build the reusable occurrence-to-source table in one fold over submitted
links.  Axioms are registered at both endpoints; connectives are registered at
their conclusion.

```lean
ProofNetIR.SequentialUnification.sourceIndex : ProofNetIR.Certificate → ProofNetIR.SequentialUnification.SourceIndex
```

### `ProofNetIR.SequentialUnification.sourceIndex_size`

Kind: theorem.

Building the source table preserves the formula-occurrence carrier size.

```lean
ProofNetIR.SequentialUnification.sourceIndex_size : ∀ (certificate : ProofNetIR.Certificate),
  Array.size (ProofNetIR.SequentialUnification.sourceIndex certificate) = certificate.formulas.size
```

### `ProofNetIR.SequentialUnification.StructurallyWellFormed.sourceIndex_lookup_eq_singleton`

Kind: theorem.

Every in-bounds formula occurrence of a structurally well-formed
certificate has exactly one source-incidence entry.  In particular, the
executable singleton pattern used by `nextAxiomWithFuel?` cannot fail merely
because the input passed the structural checker.

```lean
ProofNetIR.SequentialUnification.StructurallyWellFormed.sourceIndex_lookup_eq_singleton : ∀ {certificate : ProofNetIR.Certificate},
  certificate.StructurallyWellFormed →
    ∀ {vertex : ProofNetIR.Vertex},
      vertex < certificate.formulas.size →
        ∃ source, (ProofNetIR.SequentialUnification.sourceIndex certificate)[vertex]? = some [source]
```

### `ProofNetIR.SequentialUnification.mem_sourceIndex_origin`

Kind: theorem.

Every stored source incidence names the exact submitted link at its exact
list index and is genuinely incident as an axiom endpoint or connective
conclusion.

```lean
ProofNetIR.SequentialUnification.mem_sourceIndex_origin : ∀ {certificate : ProofNetIR.Certificate} {vertex : ProofNetIR.Vertex}
  {candidate : ProofNetIR.SequentialUnification.SourceIncidence},
  candidate ∈ (ProofNetIR.SequentialUnification.sourceIndex certificate)[vertex]?.getD [] →
    certificate.links[candidate.linkIndex]? = some candidate.link ∧
      (ProofNetIR.Link.containsAxiomEndpoint vertex candidate.link = true ∨
        ProofNetIR.Link.produces vertex candidate.link = true)
```

### `ProofNetIR.SequentialUnification.SourceIndex.Sound`

Kind: definition.

Every table entry has exact submitted-link and source-incidence
provenance.  Supplying this proof separately lets the recursive executable
reuse one precomputed table without rebuilding it.

```lean
ProofNetIR.SequentialUnification.SourceIndex.Sound : ProofNetIR.Certificate → ProofNetIR.SequentialUnification.SourceIndex → Prop
```

### `ProofNetIR.SequentialUnification.sourceIndex_sound`

Kind: theorem.

The production source-incidence table is sound.

```lean
ProofNetIR.SequentialUnification.sourceIndex_sound : ∀ (certificate : ProofNetIR.Certificate),
  ProofNetIR.SequentialUnification.SourceIndex.Sound certificate
    (ProofNetIR.SequentialUnification.sourceIndex certificate)
```

### `ProofNetIR.SequentialUnification.NextAxiomResult`

Kind: inductive type.

Successful bounded `NEXTAXIOM` search.

`trace` records the vertices actually followed by the recursive search.  The
partner endpoint of the returned axiom is tagged as required by Guerrini but
is not an additional recursive trace step.

```lean
ProofNetIR.SequentialUnification.NextAxiomResult : ProofNetIR.Certificate → ProofNetIR.UnificationState → Nat → Array Bool → Type
```

### `ProofNetIR.SequentialUnification.NextAxiomResult.Touched`

Kind: definition.

A vertex touched by one successful `NEXTAXIOM` call: either a recursive
trace vertex or one of the two returned axiom endpoints.  The partner endpoint
need not occur in `trace`, so it is named explicitly here.

```lean
ProofNetIR.SequentialUnification.NextAxiomResult.Touched : {certificate : ProofNetIR.Certificate} →
  {state : ProofNetIR.UnificationState} →
    {fuel : Nat} →
      {inputTags : Array Bool} →
        ProofNetIR.SequentialUnification.NextAxiomResult certificate state fuel inputTags → ProofNetIR.Vertex → Prop
```

### `ProofNetIR.SequentialUnification.NextAxiomResult.linkIndex_ne_of_input_left_tagged`

Kind: theorem.

A later successful search cannot return the same submitted axiom-link
index when its input already tags the earlier result's left endpoint.  This is
a structural property of the two results: their marking states, fuel bounds,
and search executions may all differ.  Distinct duplicate link slots are not
identified by this theorem.

```lean
ProofNetIR.SequentialUnification.NextAxiomResult.linkIndex_ne_of_input_left_tagged : ∀ {certificate : ProofNetIR.Certificate} {firstState secondState : ProofNetIR.UnificationState}
  {firstFuel secondFuel : Nat} {firstInput secondInput : Array Bool}
  (first : ProofNetIR.SequentialUnification.NextAxiomResult certificate firstState firstFuel firstInput)
  (second : ProofNetIR.SequentialUnification.NextAxiomResult certificate secondState secondFuel secondInput),
  secondInput[first.left]? = some true → first.linkIndex ≠ second.linkIndex
```

### `ProofNetIR.SequentialUnification.NextAxiomResult.threaded_linkIndex_ne`

Kind: theorem.

Threading the complete output tag array of one successful search into the
next search prevents replay of the first submitted axiom-link index.  No
relation between the two unification states is required; distinct duplicate
link slots are outside this conclusion.

```lean
ProofNetIR.SequentialUnification.NextAxiomResult.threaded_linkIndex_ne : ∀ {certificate : ProofNetIR.Certificate} {firstState secondState : ProofNetIR.UnificationState}
  {firstFuel secondFuel : Nat} {inputTags : Array Bool}
  (first : ProofNetIR.SequentialUnification.NextAxiomResult certificate firstState firstFuel inputTags)
  (second : ProofNetIR.SequentialUnification.NextAxiomResult certificate secondState secondFuel first.tags),
  first.linkIndex ≠ second.linkIndex
```

### `ProofNetIR.SequentialUnification.NextAxiomResult.orientedEndpoints?`

Kind: definition.

Recover search-oriented axiom endpoints from a successful result.

The stored `left/right` fields retain submitted-link orientation.  The last
recursive trace vertex determines which of them was actually reached.

```lean
ProofNetIR.SequentialUnification.NextAxiomResult.orientedEndpoints? : {certificate : ProofNetIR.Certificate} →
  {state : ProofNetIR.UnificationState} →
    {fuel : Nat} →
      {inputTags : Array Bool} →
        ProofNetIR.SequentialUnification.NextAxiomResult certificate state fuel inputTags →
          Option (ProofNetIR.Vertex × ProofNetIR.Vertex)
```

### `ProofNetIR.SequentialUnification.SearchClearThrough`

Kind: definition.

Dynamic freshness through one formula-complexity rank.

This is a sufficient local precondition for the bounded `NEXTAXIOM` search,
not a reachable-state invariant for the complete Figure-7 scheduler.  It is
intentionally rank-scoped: all in-bounds occurrences no more complex than
`rank` must still be untagged and semantically unassigned.

```lean
ProofNetIR.SequentialUnification.SearchClearThrough : ProofNetIR.Certificate → ProofNetIR.UnificationState → Array Bool → Nat → Prop
```

### `ProofNetIR.SequentialUnification.nextAxiomWithFuel?`

Kind: definition.

Bounded, tagged `NEXTAXIOM`.

The search fails closed on out-of-domain, already tagged, already marked,
missing, or non-unique source buckets.  Compound producers deterministically
continue through their stored left premise.

```lean
ProofNetIR.SequentialUnification.nextAxiomWithFuel? : (certificate : ProofNetIR.Certificate) →
  (state : ProofNetIR.UnificationState) →
    (index : ProofNetIR.SequentialUnification.SourceIndex) →
      ProofNetIR.SequentialUnification.SourceIndex.Sound certificate index →
        (fuel : Nat) →
          (tags : Array Bool) →
            ProofNetIR.Vertex → Option (ProofNetIR.SequentialUnification.NextAxiomResult certificate state fuel tags)
```

### `ProofNetIR.SequentialUnification.nextAxiom?`

Kind: definition.

Production wrapper with the formula carrier as the conservative recursive
search budget.

```lean
ProofNetIR.SequentialUnification.nextAxiom? : (certificate : ProofNetIR.Certificate) →
  (state : ProofNetIR.UnificationState) →
    (index : ProofNetIR.SequentialUnification.SourceIndex) →
      ProofNetIR.SequentialUnification.SourceIndex.Sound certificate index →
        (tags : Array Bool) →
          ProofNetIR.Vertex →
            Option (ProofNetIR.SequentialUnification.NextAxiomResult certificate state certificate.formulas.size tags)
```

### `ProofNetIR.SequentialUnification.nextAxiomWithFuel?_sound`

Kind: theorem.

A successful search returns one exact submitted axiom whose two endpoint
occurrences were unmarked in the input state.

```lean
ProofNetIR.SequentialUnification.nextAxiomWithFuel?_sound : ∀ {certificate : ProofNetIR.Certificate} {state : ProofNetIR.UnificationState}
  {index : ProofNetIR.SequentialUnification.SourceIndex} {fuel : Nat} {tags : Array Bool}
  {indexSound : ProofNetIR.SequentialUnification.SourceIndex.Sound certificate index} {vertex : ProofNetIR.Vertex}
  {result : ProofNetIR.SequentialUnification.NextAxiomResult certificate state fuel tags},
  ProofNetIR.SequentialUnification.nextAxiomWithFuel? certificate state index ⋯ fuel tags vertex = some result →
    certificate.links[result.linkIndex]? = some (ProofNetIR.Link.axiom result.left result.right) ∧
      state.assignedToken? result.left = none ∧ state.assignedToken? result.right = none ∧ result.trace.length ≤ fuel
```

### `ProofNetIR.SequentialUnification.nextAxiomWithFuel?_exists_of_structural_clearThrough`

Kind: theorem.

On the production source index, structural well-formedness and
rank-scoped dynamic freshness make bounded `NEXTAXIOM` locally total whenever
the fuel strictly exceeds the starting formula complexity.

This theorem discharges the static missing/non-unique-source, malformed
orientation, out-of-bounds, and recursive-fuel failure modes for this local
call.  It does not state that an arbitrary later Figure-7 `new` call satisfies
the freshness premise.

```lean
ProofNetIR.SequentialUnification.nextAxiomWithFuel?_exists_of_structural_clearThrough : ∀ {certificate : ProofNetIR.Certificate} {state : ProofNetIR.UnificationState} {fuel : Nat} {tags : Array Bool}
  {vertex : ProofNetIR.Vertex},
  certificate.StructurallyWellFormed →
    ProofNetIR.UnificationState.Abstractable certificate state →
      vertex < certificate.formulas.size →
        ProofNetIR.SequentialUnification.SearchClearThrough certificate state tags
            (certificate.formulaComplexityAt vertex) →
          certificate.formulaComplexityAt vertex < fuel →
            ∃ result,
              ProofNetIR.SequentialUnification.nextAxiomWithFuel? certificate state
                  (ProofNetIR.SequentialUnification.sourceIndex certificate) ⋯ fuel tags vertex =
                some result
```

### `ProofNetIR.SequentialUnification.nextAxiomWithFuel?_exists_of_structural_carrierClear`

Kind: theorem.

Initial/local totality corollary.  If every formula occurrence is still
untagged and unassigned, any in-bounds start succeeds with the exact
formula-rank budget.  This is sufficient for the initial Figure-7 `init`
search; it is not the later scheduler's `new`-call invariant.

```lean
ProofNetIR.SequentialUnification.nextAxiomWithFuel?_exists_of_structural_carrierClear : ∀ {certificate : ProofNetIR.Certificate} {state : ProofNetIR.UnificationState} {tags : Array Bool}
  {vertex : ProofNetIR.Vertex},
  certificate.StructurallyWellFormed →
    ProofNetIR.UnificationState.Abstractable certificate state →
      vertex < certificate.formulas.size →
        (∀ {candidate : ProofNetIR.Vertex},
            candidate < certificate.formulas.size →
              tags[candidate]? = some false ∧ state.assignedToken? candidate = none) →
          ∃ result,
            ProofNetIR.SequentialUnification.nextAxiomWithFuel? certificate state
                (ProofNetIR.SequentialUnification.sourceIndex certificate) ⋯
                (certificate.formulaComplexityAt vertex + 1) tags vertex =
              some result
```

### `ProofNetIR.SequentialUnification.nextAxiomWithFuel?_tag_trace_invariants`

Kind: theorem.

A successful bounded search preserves the tag carrier and all input `true`
tags, never repeats a recursively visited vertex, and changes every trace
vertex and both returned axiom endpoints from input `false` to output `true`.

These guarantees are per call.  Successive-call disjointness below requires
threading the first call's output tag array into the second call.

```lean
ProofNetIR.SequentialUnification.nextAxiomWithFuel?_tag_trace_invariants : ∀ {certificate : ProofNetIR.Certificate} {state : ProofNetIR.UnificationState}
  {index : ProofNetIR.SequentialUnification.SourceIndex} {fuel : Nat} {tags : Array Bool}
  {indexSound : ProofNetIR.SequentialUnification.SourceIndex.Sound certificate index} {vertex : ProofNetIR.Vertex}
  {result : ProofNetIR.SequentialUnification.NextAxiomResult certificate state fuel tags},
  ProofNetIR.SequentialUnification.nextAxiomWithFuel? certificate state index ⋯ fuel tags vertex = some result →
    result.tags.size = tags.size ∧
      (∀ {visited : ProofNetIR.Vertex}, tags[visited]? = some true → result.tags[visited]? = some true) ∧
        result.trace.Nodup ∧
          (∀ {visited : ProofNetIR.Vertex},
              visited ∈ result.trace → tags[visited]? = some false ∧ result.tags[visited]? = some true) ∧
            (tags[result.left]? = some false ∧ result.tags[result.left]? = some true) ∧
              tags[result.right]? = some false ∧ result.tags[result.right]? = some true
```

### `ProofNetIR.SequentialUnification.nextAxiomWithFuel?_touched_tagged`

Kind: theorem.

Every touched vertex of a successful search changed from input `false` to
output `true`.  This includes the non-recursive partner endpoint.

```lean
ProofNetIR.SequentialUnification.nextAxiomWithFuel?_touched_tagged : ∀ {certificate : ProofNetIR.Certificate} {state : ProofNetIR.UnificationState}
  {index : ProofNetIR.SequentialUnification.SourceIndex} {fuel : Nat} {tags : Array Bool}
  {indexSound : ProofNetIR.SequentialUnification.SourceIndex.Sound certificate index}
  {vertex touched : ProofNetIR.Vertex}
  {result : ProofNetIR.SequentialUnification.NextAxiomResult certificate state fuel tags},
  ProofNetIR.SequentialUnification.nextAxiomWithFuel? certificate state index ⋯ fuel tags vertex = some result →
    result.Touched touched → tags[touched]? = some false ∧ result.tags[touched]? = some true
```

### `ProofNetIR.SequentialUnification.nextAxiomWithFuel?_tagged_iff_input_or_touched`

Kind: theorem.

A successful bounded search contains no unexplained true tag: every output
true tag was already true on input or was touched by this exact execution.

```lean
ProofNetIR.SequentialUnification.nextAxiomWithFuel?_tagged_iff_input_or_touched : ∀ {certificate : ProofNetIR.Certificate} {state : ProofNetIR.UnificationState}
  {index : ProofNetIR.SequentialUnification.SourceIndex} {fuel : Nat} {tags : Array Bool}
  {indexSound : ProofNetIR.SequentialUnification.SourceIndex.Sound certificate index} {start : ProofNetIR.Vertex}
  {result : ProofNetIR.SequentialUnification.NextAxiomResult certificate state fuel tags},
  ProofNetIR.SequentialUnification.nextAxiomWithFuel? certificate state index ⋯ fuel tags start = some result →
    ∀ {vertex : ProofNetIR.Vertex}, result.tags[vertex]? = some true ↔ tags[vertex]? = some true ∨ result.Touched vertex
```

### `ProofNetIR.SequentialUnification.nextAxiom?_tagged_iff_input_or_touched`

Kind: theorem.

Production-wrapper form of
`nextAxiomWithFuel?_tagged_iff_input_or_touched`.

```lean
ProofNetIR.SequentialUnification.nextAxiom?_tagged_iff_input_or_touched : ∀ {certificate : ProofNetIR.Certificate} {state : ProofNetIR.UnificationState}
  {index : ProofNetIR.SequentialUnification.SourceIndex} {tags : Array Bool}
  {indexSound : ProofNetIR.SequentialUnification.SourceIndex.Sound certificate index} {start : ProofNetIR.Vertex}
  {result : ProofNetIR.SequentialUnification.NextAxiomResult certificate state certificate.formulas.size tags},
  ProofNetIR.SequentialUnification.nextAxiom? certificate state index ⋯ tags start = some result →
    ∀ {vertex : ProofNetIR.Vertex}, result.tags[vertex]? = some true ↔ tags[vertex]? = some true ∨ result.Touched vertex
```

### `ProofNetIR.SequentialUnification.nextAxiomWithFuel?_threaded_touched_disjoint`

Kind: theorem.

Two successful calls, including calls across different marking states,
have disjoint touched sets when, and only as claimed here, the first call's
output tags are threaded into the second call.

```lean
ProofNetIR.SequentialUnification.nextAxiomWithFuel?_threaded_touched_disjoint : ∀ {certificate : ProofNetIR.Certificate} {firstState secondState : ProofNetIR.UnificationState}
  {index : ProofNetIR.SequentialUnification.SourceIndex} {firstFuel secondFuel : Nat} {tags : Array Bool}
  {indexSound : ProofNetIR.SequentialUnification.SourceIndex.Sound certificate index}
  {firstVertex secondVertex : ProofNetIR.Vertex}
  {first : ProofNetIR.SequentialUnification.NextAxiomResult certificate firstState firstFuel tags},
  ProofNetIR.SequentialUnification.nextAxiomWithFuel? certificate firstState index ⋯ firstFuel tags firstVertex =
      some first →
    ∀ {second : ProofNetIR.SequentialUnification.NextAxiomResult certificate secondState secondFuel first.tags},
      ProofNetIR.SequentialUnification.nextAxiomWithFuel? certificate secondState index ⋯ secondFuel first.tags
            secondVertex =
          some second →
        ∀ {touched : ProofNetIR.Vertex}, first.Touched touched → second.Touched touched → False
```

### `ProofNetIR.SequentialUnification.SourceLeftStep`

Kind: inductive type.

One recursive `NEXTAXIOM` step: from the conclusion of an exact submitted
tensor or par link to that link's stored left premise.

```lean
ProofNetIR.SequentialUnification.SourceLeftStep : ProofNetIR.Certificate → ProofNetIR.Vertex → ProofNetIR.Vertex → Prop
```

### `ProofNetIR.SequentialUnification.SourceLeftReachable`

Kind: inductive type.

Reflexive-transitive reachability along exact submitted source-left
steps.  Reflexivity covers a call whose starting vertex is already an axiom
endpoint.

```lean
ProofNetIR.SequentialUnification.SourceLeftReachable : ProofNetIR.Certificate → ProofNetIR.Vertex → ProofNetIR.Vertex → Prop
```

### `ProofNetIR.SequentialUnification.SourceLeftChain`

Kind: inductive type.

A list records precisely a (possibly empty-step) source-left route.

```lean
ProofNetIR.SequentialUnification.SourceLeftChain : ProofNetIR.Certificate → List ProofNetIR.Vertex → Prop
```

### `ProofNetIR.SequentialUnification.SourceLeftChain.cons_of_head`

Kind: theorem.

Prepend one exact source-left step to a nonempty recorded route.

```lean
ProofNetIR.SequentialUnification.SourceLeftChain.cons_of_head : ∀ {certificate : ProofNetIR.Certificate} {source next : ProofNetIR.Vertex} {trace : List ProofNetIR.Vertex},
  ProofNetIR.SequentialUnification.SourceLeftStep certificate source next →
    ProofNetIR.SequentialUnification.SourceLeftChain certificate trace →
      trace.head? = some next → ProofNetIR.SequentialUnification.SourceLeftChain certificate (source :: trace)
```

### `ProofNetIR.SequentialUnification.SourceLeftChain.reachable_of_head_last`

Kind: theorem.

A recorded chain with named endpoints is sound for source-left
reachability.

```lean
ProofNetIR.SequentialUnification.SourceLeftChain.reachable_of_head_last : ∀ {certificate : ProofNetIR.Certificate} {trace : List ProofNetIR.Vertex} {source target : ProofNetIR.Vertex},
  ProofNetIR.SequentialUnification.SourceLeftChain certificate trace →
    trace.head? = some source →
      trace.getLast? = some target → ProofNetIR.SequentialUnification.SourceLeftReachable certificate source target
```

### `ProofNetIR.SequentialUnification.NextAxiomRoute`

Kind: inductive type.

The oriented semantic content of a successful bounded `NEXTAXIOM` call.

`reached` is the final vertex actually visited by the recursive search;
`partner` is the other endpoint of the submitted axiom.  The disjunction in
`exactAxiom` is intentional: the submitted link keeps its own stored
orientation, independently of the search orientation.

```lean
ProofNetIR.SequentialUnification.NextAxiomRoute : {certificate : ProofNetIR.Certificate} →
  {state : ProofNetIR.UnificationState} →
    {fuel : Nat} →
      {inputTags : Array Bool} →
        ProofNetIR.Vertex →
          ProofNetIR.SequentialUnification.NextAxiomResult certificate state fuel inputTags →
            ProofNetIR.Vertex → ProofNetIR.Vertex → Prop
```

### `ProofNetIR.SequentialUnification.NextAxiomRoute.orientedEndpoints?_eq`

Kind: theorem.

An exact route proves that the executable endpoint extractor returns the
actual search orientation.

```lean
ProofNetIR.SequentialUnification.NextAxiomRoute.orientedEndpoints?_eq : ∀ {certificate : ProofNetIR.Certificate} {state : ProofNetIR.UnificationState} {fuel : Nat} {inputTags : Array Bool}
  {start reached partner : ProofNetIR.Vertex}
  {result : ProofNetIR.SequentialUnification.NextAxiomResult certificate state fuel inputTags},
  ProofNetIR.SequentialUnification.NextAxiomRoute start result reached partner →
    result.orientedEndpoints? = some (reached, partner)
```

### `ProofNetIR.SequentialUnification.nextAxiomWithFuel?_route`

Kind: theorem.

A successful bounded `NEXTAXIOM` computation determines the actual
reached axiom endpoint and the exact source-left route to it.

```lean
ProofNetIR.SequentialUnification.nextAxiomWithFuel?_route : ∀ {certificate : ProofNetIR.Certificate} {state : ProofNetIR.UnificationState}
  {index : ProofNetIR.SequentialUnification.SourceIndex} {fuel : Nat} {tags : Array Bool}
  {indexSound : ProofNetIR.SequentialUnification.SourceIndex.Sound certificate index} {start : ProofNetIR.Vertex}
  {result : ProofNetIR.SequentialUnification.NextAxiomResult certificate state fuel tags},
  ProofNetIR.SequentialUnification.nextAxiomWithFuel? certificate state index ⋯ fuel tags start = some result →
    ∃ reached partner, ProofNetIR.SequentialUnification.NextAxiomRoute start result reached partner
```

### `ProofNetIR.SequentialUnification.nextAxiom?_route`

Kind: theorem.

Production-wrapper form of `nextAxiomWithFuel?_route`.

```lean
ProofNetIR.SequentialUnification.nextAxiom?_route : ∀ {certificate : ProofNetIR.Certificate} {state : ProofNetIR.UnificationState}
  {index : ProofNetIR.SequentialUnification.SourceIndex} {tags : Array Bool}
  {indexSound : ProofNetIR.SequentialUnification.SourceIndex.Sound certificate index} {start : ProofNetIR.Vertex}
  {result : ProofNetIR.SequentialUnification.NextAxiomResult certificate state certificate.formulas.size tags},
  ProofNetIR.SequentialUnification.nextAxiom? certificate state index ⋯ tags start = some result →
    ∃ reached partner, ProofNetIR.SequentialUnification.NextAxiomRoute start result reached partner
```

### `ProofNetIR.SequentialUnification.DynamicStartResult`

Kind: inductive type.

The token-semantic result of dynamically starting the axiom found by
`NEXTAXIOM`.  Parsed-component scheduling is intentionally left to the later
`σ`/ready/waiting layer.

```lean
ProofNetIR.SequentialUnification.DynamicStartResult : ProofNetIR.Certificate → ProofNetIR.UnificationState → Nat → Array Bool → Type
```

### `ProofNetIR.SequentialUnification.dynamicStartWithFuel?`

Kind: definition.

Search for one new axiom and apply exactly the Figure-5 token marking
update.

```lean
ProofNetIR.SequentialUnification.dynamicStartWithFuel? : (certificate : ProofNetIR.Certificate) →
  (before : ProofNetIR.UnificationState) →
    (index : ProofNetIR.SequentialUnification.SourceIndex) →
      ProofNetIR.SequentialUnification.SourceIndex.Sound certificate index →
        (fuel : Nat) →
          (tags : Array Bool) →
            ProofNetIR.Vertex →
              Option (ProofNetIR.SequentialUnification.DynamicStartResult certificate before fuel tags)
```

### `ProofNetIR.SequentialUnification.DynamicStartResult.refinesStart`

Kind: theorem.

A successful dynamic start after arbitrary prior ordered unions refines
one independent Figure-5 `start` transition.

```lean
ProofNetIR.SequentialUnification.DynamicStartResult.refinesStart : ∀ {certificate : ProofNetIR.Certificate} {before : ProofNetIR.UnificationState} {fuel : Nat} {inputTags : Array Bool}
  (result : ProofNetIR.SequentialUnification.DynamicStartResult certificate before fuel inputTags)
  (abstractable : ProofNetIR.UnificationState.Abstractable certificate before),
  before.OrderedParents →
    ∃ afterAbstractable,
      ProofNetIR.UnificationStep certificate (before.toMarking certificate abstractable)
        (result.after.toMarking certificate afterAbstractable)
```

## Shared sequential consumer index

### `ProofNetIR.ConsumerIndex`

Kind: definition.

A single premise-to-submitted-link index shared by the worklist engine and
the sequential Figure-7 bridge.  Each bucket stores submitted link indices
whose connective uses the addressed formula occurrence as a premise.

```lean
ProofNetIR.ConsumerIndex : Type
```

### `ProofNetIR.ConsumerIndex.build`

Kind: definition.

Build the canonical premise-consumer table.

This is a pure builder, not a hidden cache. Callers proving a complexity bound
must thread the resulting table explicitly instead of assuming repeated calls
are constant-time. Out-of-range premises are ignored, so malformed input fails
closed.

```lean
ProofNetIR.ConsumerIndex.build : ProofNetIR.Certificate → ProofNetIR.ConsumerIndex
```

### `ProofNetIR.ConsumerIndex.bucket`

Kind: definition.

Total bucket projection. Out-of-range vertices have no consumers.

```lean
ProofNetIR.ConsumerIndex.bucket : ProofNetIR.ConsumerIndex → ProofNetIR.Vertex → List Nat
```

### `ProofNetIR.ConsumerIndex.build_size`

Kind: theorem.

The table carrier is exactly the formula-occurrence carrier.

```lean
ProofNetIR.ConsumerIndex.build_size : ∀ (certificate : ProofNetIR.Certificate),
  Array.size (ProofNetIR.ConsumerIndex.build certificate) = certificate.formulas.size
```

### `ProofNetIR.ConsumerIndex.Sound`

Kind: definition.

Every stored entry has exact submitted-link and premise provenance.

```lean
ProofNetIR.ConsumerIndex.Sound : ProofNetIR.Certificate → ProofNetIR.ConsumerIndex → Prop
```

### `ProofNetIR.ConsumerIndex.Complete`

Kind: definition.

Every submitted, in-bounds connective premise is represented.

```lean
ProofNetIR.ConsumerIndex.Complete : ProofNetIR.Certificate → ProofNetIR.ConsumerIndex → Prop
```

### `ProofNetIR.ConsumerIndex.build_origin`

Kind: theorem.

Exact origin theorem for the shared built index.

```lean
ProofNetIR.ConsumerIndex.build_origin : ∀ {certificate : ProofNetIR.Certificate} {premise candidate : Nat},
  candidate ∈ (ProofNetIR.ConsumerIndex.build certificate).bucket premise →
    ∃ link, certificate.links[candidate]? = some link ∧ link.isConnective = true ∧ premise ∈ link.premises
```

### `ProofNetIR.ConsumerIndex.build_complete`

Kind: theorem.

Exact no-missed-dependency theorem for the shared built index.

```lean
ProofNetIR.ConsumerIndex.build_complete : ∀ {certificate : ProofNetIR.Certificate} {link : ProofNetIR.Link} {linkIndex premise : Nat},
  certificate.links[linkIndex]? = some link →
    premise < certificate.formulas.size →
      premise ∈ link.premises → linkIndex ∈ (ProofNetIR.ConsumerIndex.build certificate).bucket premise
```

### `ProofNetIR.ConsumerIndex.build_sound`

Kind: theorem.

The shared index satisfies exact carrier and origin soundness.

```lean
ProofNetIR.ConsumerIndex.build_sound : ∀ (certificate : ProofNetIR.Certificate),
  ProofNetIR.ConsumerIndex.Sound certificate (ProofNetIR.ConsumerIndex.build certificate)
```

### `ProofNetIR.ConsumerIndex.build_isComplete`

Kind: theorem.

The shared index is complete for every in-bounds connective premise.

```lean
ProofNetIR.ConsumerIndex.build_isComplete : ∀ (certificate : ProofNetIR.Certificate),
  ProofNetIR.ConsumerIndex.Complete certificate (ProofNetIR.ConsumerIndex.build certificate)
```

### `ProofNetIR.ConsumerIndex.Sound.origin`

Kind: theorem.

Soundness exposes exact origin without depending on the builder.

```lean
ProofNetIR.ConsumerIndex.Sound.origin : ∀ {certificate : ProofNetIR.Certificate} {index : ProofNetIR.ConsumerIndex},
  ProofNetIR.ConsumerIndex.Sound certificate index →
    ∀ {premise candidate : Nat},
      candidate ∈ index.bucket premise →
        ∃ link, certificate.links[candidate]? = some link ∧ link.isConnective = true ∧ premise ∈ link.premises
```

### `ProofNetIR.ConsumerIndex.build_members_eq`

Kind: theorem.

Structural linear ownership makes all consumer indices in a bucket equal.
This is set-level singleton uniqueness; no list-order claim is needed.

```lean
ProofNetIR.ConsumerIndex.build_members_eq : ∀ {certificate : ProofNetIR.Certificate},
  certificate.StructurallyWellFormed →
    ∀ {premise first second : Nat},
      first ∈ (ProofNetIR.ConsumerIndex.build certificate).bucket premise →
        second ∈ (ProofNetIR.ConsumerIndex.build certificate).bucket premise → first = second
```

### `ProofNetIR.ConsumerIndex.build_singleton`

Kind: theorem.

A concrete in-bounds premise has a set-level singleton consumer bucket in
every structurally well-formed certificate.

```lean
ProofNetIR.ConsumerIndex.build_singleton : ∀ {certificate : ProofNetIR.Certificate},
  certificate.StructurallyWellFormed →
    ∀ {link : ProofNetIR.Link} {linkIndex premise : Nat},
      certificate.links[linkIndex]? = some link →
        premise < certificate.formulas.size →
          premise ∈ link.premises →
            linkIndex ∈ (ProofNetIR.ConsumerIndex.build certificate).bucket premise ∧
              ∀ {candidate : Nat},
                candidate ∈ (ProofNetIR.ConsumerIndex.build certificate).bucket premise → candidate = linkIndex
```

### `ProofNetIR.ConsumerIndex.uniqueConsumer?`

Kind: definition.

Return the unique semantic consumer of one occurrence. Repeated copies of
the same index are harmless, while two distinct candidates fail closed.

```lean
ProofNetIR.ConsumerIndex.uniqueConsumer? : ProofNetIR.ConsumerIndex → ProofNetIR.Vertex → Option Nat
```

### `ProofNetIR.ConsumerIndex.uniqueConsumer?_eq_some_iff`

Kind: theorem.

Exact semantic-singleton characterization of `uniqueConsumer?`.

```lean
ProofNetIR.ConsumerIndex.uniqueConsumer?_eq_some_iff : ∀ {index : ProofNetIR.ConsumerIndex} {vertex candidate : Nat},
  index.uniqueConsumer? vertex = some candidate ↔
    candidate ∈ index.bucket vertex ∧ ∀ {other : Nat}, other ∈ index.bucket vertex → other = candidate
```

### `ProofNetIR.ConsumerIndex.build_uniqueConsumer?_eq_some`

Kind: theorem.

On structurally well-formed input, every concrete in-bounds premise makes
the shared index's unique-consumer query succeed at its submitted index.

```lean
ProofNetIR.ConsumerIndex.build_uniqueConsumer?_eq_some : ∀ {certificate : ProofNetIR.Certificate},
  certificate.StructurallyWellFormed →
    ∀ {link : ProofNetIR.Link} {linkIndex premise : Nat},
      certificate.links[linkIndex]? = some link →
        premise < certificate.formulas.size →
          premise ∈ link.premises →
            (ProofNetIR.ConsumerIndex.build certificate).uniqueConsumer? premise = some linkIndex
```

### `ProofNetIR.TensorPremiseSide`

Kind: inductive type.

Stored orientation of the queried occurrence within a tensor link.

```lean
ProofNetIR.TensorPremiseSide : Type
```

### `ProofNetIR.TensorPremiseSide.premise`

Kind: definition.

The premise selected by this stored orientation.

```lean
ProofNetIR.TensorPremiseSide.premise : ProofNetIR.TensorPremiseSide → ProofNetIR.Vertex → ProofNetIR.Vertex → ProofNetIR.Vertex
```

### `ProofNetIR.TensorPremiseSide.mate`

Kind: definition.

The other tensor premise selected by this stored orientation.

```lean
ProofNetIR.TensorPremiseSide.mate : ProofNetIR.TensorPremiseSide → ProofNetIR.Vertex → ProofNetIR.Vertex → ProofNetIR.Vertex
```

### `ProofNetIR.TensorBelow`

Kind: inductive type.

Exact orientation-aware view of the tensor immediately consuming one
formula occurrence. This is a lookup result, not a complete Figure-7 `new`
transition.

```lean
ProofNetIR.TensorBelow : Type
```

### `ProofNetIR.TensorBelow.premise`

Kind: definition.

Stored premise addressed by the view.

```lean
ProofNetIR.TensorBelow.premise : ProofNetIR.TensorBelow → ProofNetIR.Vertex
```

### `ProofNetIR.TensorBelow.mate`

Kind: definition.

Opposite tensor premise addressed by the view.

```lean
ProofNetIR.TensorBelow.mate : ProofNetIR.TensorBelow → ProofNetIR.Vertex
```

### `ProofNetIR.TensorBelow.Valid`

Kind: definition.

Exact successful-result semantics for `tensorBelow?`.

```lean
ProofNetIR.TensorBelow.Valid : ProofNetIR.Certificate → ProofNetIR.ConsumerIndex → ProofNetIR.Vertex → ProofNetIR.TensorBelow → Prop
```

### `ProofNetIR.tensorBelow?`

Kind: definition.

Low-level tensor-mate lookup relative to an explicitly supplied table.

The lookup rejects absent or nonunique entries *in that table*, axiom/par
entries, malformed tensor links, occurrences that are not the stored left or
right premise, and self-mates. It does not prove that an arbitrary supplied
table is the certificate's complete consumer index. Production scheduler code
must use `Certificate.tensorBelow?`, which fixes the table to
`certificate.consumerIndex`.

```lean
ProofNetIR.tensorBelow? : ProofNetIR.Certificate → ProofNetIR.ConsumerIndex → ProofNetIR.Vertex → Option ProofNetIR.TensorBelow
```

### `ProofNetIR.tensorBelow?_eq_some_iff`

Kind: theorem.

Exact table-relative success characterization of the low-level query.

```lean
ProofNetIR.tensorBelow?_eq_some_iff : ∀ {certificate : ProofNetIR.Certificate} {index : ProofNetIR.ConsumerIndex} {vertex : ProofNetIR.Vertex}
  {result : ProofNetIR.TensorBelow},
  ProofNetIR.tensorBelow? certificate index vertex = some result ↔
    ProofNetIR.TensorBelow.Valid certificate index vertex result
```

### `ProofNetIR.tensorBelow?_consumer`

Kind: theorem.

Successful lookup identifies the exact semantic-singleton consumer.

```lean
ProofNetIR.tensorBelow?_consumer : ∀ {certificate : ProofNetIR.Certificate} {index : ProofNetIR.ConsumerIndex} {vertex : ProofNetIR.Vertex}
  {result : ProofNetIR.TensorBelow},
  ProofNetIR.tensorBelow? certificate index vertex = some result → index.uniqueConsumer? vertex = some result.linkIndex
```

### `ProofNetIR.tensorBelow?_link`

Kind: theorem.

Successful lookup identifies the exact submitted tensor slot.

```lean
ProofNetIR.tensorBelow?_link : ∀ {certificate : ProofNetIR.Certificate} {index : ProofNetIR.ConsumerIndex} {vertex : ProofNetIR.Vertex}
  {result : ProofNetIR.TensorBelow},
  ProofNetIR.tensorBelow? certificate index vertex = some result →
    certificate.links[result.linkIndex]? =
      some (ProofNetIR.Link.tensor result.storedLeft result.storedRight result.conclusion)
```

### `ProofNetIR.tensorBelow?_wellFormed`

Kind: theorem.

Successful lookup exposes an independently well-formed tensor.

```lean
ProofNetIR.tensorBelow?_wellFormed : ∀ {certificate : ProofNetIR.Certificate} {index : ProofNetIR.ConsumerIndex} {vertex : ProofNetIR.Vertex}
  {result : ProofNetIR.TensorBelow},
  ProofNetIR.tensorBelow? certificate index vertex = some result →
    certificate.LinkWellFormed (ProofNetIR.Link.tensor result.storedLeft result.storedRight result.conclusion)
```

### `ProofNetIR.tensorBelow?_premise`

Kind: theorem.

Successful lookup preserves the stored left/right orientation exactly.

```lean
ProofNetIR.tensorBelow?_premise : ∀ {certificate : ProofNetIR.Certificate} {index : ProofNetIR.ConsumerIndex} {vertex : ProofNetIR.Vertex}
  {result : ProofNetIR.TensorBelow},
  ProofNetIR.tensorBelow? certificate index vertex = some result → vertex = result.premise
```

### `ProofNetIR.tensorBelow?_mate_ne`

Kind: theorem.

A successful tensor-below view never returns its input as its mate.

```lean
ProofNetIR.tensorBelow?_mate_ne : ∀ {certificate : ProofNetIR.Certificate} {index : ProofNetIR.ConsumerIndex} {vertex : ProofNetIR.Vertex}
  {result : ProofNetIR.TensorBelow},
  ProofNetIR.tensorBelow? certificate index vertex = some result → result.mate ≠ vertex
```

### `ProofNetIR.Certificate.consumerIndex`

Kind: definition.

Canonical pure projection of a certificate to its consumer index.

The definition deliberately carries no memoization claim. A future
whole-program linearity layer must store and thread this value rather than
recompute it at every scheduler step.

```lean
ProofNetIR.Certificate.consumerIndex : ProofNetIR.Certificate → ProofNetIR.ConsumerIndex
```

### `ProofNetIR.Certificate.tensorBelow?`

Kind: definition.

Canonical fail-closed tensor-mate lookup.

Unlike the low-level table-relative query, this API fixes lookup to the
certificate's sound-and-complete built consumer index. It therefore cannot
accept a caller-supplied partial table that hides a second consumer.

```lean
ProofNetIR.Certificate.tensorBelow? : ProofNetIR.Certificate → ProofNetIR.Vertex → Option ProofNetIR.TensorBelow
```

### `ProofNetIR.Certificate.tensorBelow?_eq_some_iff`

Kind: theorem.

Exact success characterization of the canonical tensor-below query.

```lean
ProofNetIR.Certificate.tensorBelow?_eq_some_iff : ∀ {certificate : ProofNetIR.Certificate} {vertex : ProofNetIR.Vertex} {result : ProofNetIR.TensorBelow},
  certificate.tensorBelow? vertex = some result ↔
    ProofNetIR.TensorBelow.Valid certificate certificate.consumerIndex vertex result
```

### `ProofNetIR.Certificate.tensorBelow?_consumer`

Kind: theorem.

Canonical lookup identifies the exact built-index singleton consumer.

```lean
ProofNetIR.Certificate.tensorBelow?_consumer : ∀ {certificate : ProofNetIR.Certificate} {vertex : ProofNetIR.Vertex} {result : ProofNetIR.TensorBelow},
  certificate.tensorBelow? vertex = some result →
    certificate.consumerIndex.uniqueConsumer? vertex = some result.linkIndex
```

### `ProofNetIR.Certificate.tensorBelow?_link`

Kind: theorem.

Canonical lookup identifies the exact submitted tensor slot.

```lean
ProofNetIR.Certificate.tensorBelow?_link : ∀ {certificate : ProofNetIR.Certificate} {vertex : ProofNetIR.Vertex} {result : ProofNetIR.TensorBelow},
  certificate.tensorBelow? vertex = some result →
    certificate.links[result.linkIndex]? =
      some (ProofNetIR.Link.tensor result.storedLeft result.storedRight result.conclusion)
```

### `ProofNetIR.Certificate.tensorBelow?_wellFormed`

Kind: theorem.

Canonical lookup exposes an independently well-formed tensor.

```lean
ProofNetIR.Certificate.tensorBelow?_wellFormed : ∀ {certificate : ProofNetIR.Certificate} {vertex : ProofNetIR.Vertex} {result : ProofNetIR.TensorBelow},
  certificate.tensorBelow? vertex = some result →
    certificate.LinkWellFormed (ProofNetIR.Link.tensor result.storedLeft result.storedRight result.conclusion)
```

### `ProofNetIR.Certificate.tensorBelow?_premise`

Kind: theorem.

Canonical lookup preserves the stored left/right orientation exactly.

```lean
ProofNetIR.Certificate.tensorBelow?_premise : ∀ {certificate : ProofNetIR.Certificate} {vertex : ProofNetIR.Vertex} {result : ProofNetIR.TensorBelow},
  certificate.tensorBelow? vertex = some result → vertex = result.premise
```

### `ProofNetIR.Certificate.tensorBelow?_mate_ne`

Kind: theorem.

Canonical tensor-below lookup never returns its input as its mate.

```lean
ProofNetIR.Certificate.tensorBelow?_mate_ne : ∀ {certificate : ProofNetIR.Certificate} {vertex : ProofNetIR.Vertex} {result : ProofNetIR.TensorBelow},
  certificate.tensorBelow? vertex = some result → result.mate ≠ vertex
```

### `ProofNetIR.Certificate.worklistConsumers`

Kind: definition.

Compatibility projection for the existing worklist engine. This is an
alias of `consumerIndex`, not a second independently maintained table.

```lean
ProofNetIR.Certificate.worklistConsumers : ProofNetIR.Certificate → Array (List Nat)
```

### `ProofNetIR.Certificate.mem_worklistConsumers_of_premise`

Kind: theorem.

Every concrete in-bounds premise dependency is present in the shared
worklist-compatible consumer table.

```lean
ProofNetIR.Certificate.mem_worklistConsumers_of_premise : ∀ {certificate : ProofNetIR.Certificate} {link : ProofNetIR.Link} {linkIndex premise : Nat},
  certificate.links[linkIndex]? = some link →
    premise < certificate.formulas.size →
      premise ∈ link.premises → linkIndex ∈ certificate.worklistConsumers[premise]?.getD []
```

### `ProofNetIR.Certificate.mem_worklistConsumers_origin`

Kind: theorem.

Every entry in a worklist-compatible bucket has exact submitted-link and
premise provenance.

```lean
ProofNetIR.Certificate.mem_worklistConsumers_origin : ∀ {certificate : ProofNetIR.Certificate} {premise candidate : Nat},
  candidate ∈ certificate.worklistConsumers[premise]?.getD [] →
    ∃ link, certificate.links[candidate]? = some link ∧ link.isConnective = true ∧ premise ∈ link.premises
```

### `ProofNetIR.Certificate.mem_worklistConsumers_submitted_connective`

Kind: theorem.

Every worklist-compatible dependency names a submitted connective rather
than an axiom or an out-of-range slot.

```lean
ProofNetIR.Certificate.mem_worklistConsumers_submitted_connective : ∀ {certificate : ProofNetIR.Certificate} {premise candidate : Nat},
  candidate ∈ certificate.worklistConsumers[premise]?.getD [] →
    ∃ link, certificate.links[candidate]? = some link ∧ link.isConnective = true
```

### `ProofNetIR.Certificate.worklistConsumers_members_eq`

Kind: theorem.

Structural linear ownership makes all indices in one worklist-compatible
consumer bucket equal.

```lean
ProofNetIR.Certificate.worklistConsumers_members_eq : ∀ {certificate : ProofNetIR.Certificate},
  certificate.StructurallyWellFormed →
    ∀ {premise first second : Nat},
      first ∈ certificate.worklistConsumers[premise]?.getD [] →
        second ∈ certificate.worklistConsumers[premise]?.getD [] → first = second
```

## Delayed sequential-scheduler state

### `ProofNetIR.SequentialSchedulerState.RawTokenAge`

Kind: definition.

The discovery-order age assigned when a delayed scheduler token is
reserved.  It is intentionally not a union-find representative.

```lean
ProofNetIR.SequentialSchedulerState.RawTokenAge : Type
```

### `ProofNetIR.SequentialSchedulerState.WaitingCell`

Kind: inductive type.

One fixed-capacity waiting-table cell.  `undefined` represents `⊥`, while
`initialized []` represents the distinct initialized empty set `∅`.

```lean
ProofNetIR.SequentialSchedulerState.WaitingCell : Type
```

### `ProofNetIR.SequentialSchedulerState.WaitingCell.undefined_ne_initialized_empty`

Kind: theorem.

The paper-level `⊥` and initialized `∅` waiting states are distinct.

```lean
ProofNetIR.SequentialSchedulerState.WaitingCell.undefined_ne_initialized_empty : ProofNetIR.SequentialSchedulerState.WaitingCell.undefined ≠
  ProofNetIR.SequentialSchedulerState.WaitingCell.initialized []
```

### `ProofNetIR.SequentialSchedulerState.SigmaAgePartition`

Kind: inductive type.

`sigma` is the strictly increasing stack of boundaries of contiguous raw
token-age intervals below `nextAge`.

```lean
ProofNetIR.SequentialSchedulerState.SigmaAgePartition : ProofNetIR.SequentialSchedulerState.RawTokenAge → List ProofNetIR.SequentialSchedulerState.RawTokenAge → Prop
```

### `ProofNetIR.SequentialSchedulerState.SigmaAgePartition.empty`

Kind: theorem.

The unique partition at raw-age horizon zero.

```lean
ProofNetIR.SequentialSchedulerState.SigmaAgePartition.empty : ProofNetIR.SequentialSchedulerState.SigmaAgePartition 0 []
```

### `ProofNetIR.SequentialSchedulerState.SigmaAgePartition.reserveInitial`

Kind: theorem.

Reserving the initial raw age produces the singleton boundary stack.

```lean
ProofNetIR.SequentialSchedulerState.SigmaAgePartition.reserveInitial : ProofNetIR.SequentialSchedulerState.SigmaAgePartition 1 [0]
```

### `ProofNetIR.SequentialSchedulerState.SigmaAgePartition.appendFresh`

Kind: theorem.

Appending the current horizon reserves one new singleton interval.

```lean
ProofNetIR.SequentialSchedulerState.SigmaAgePartition.appendFresh : ∀ {nextAge : ProofNetIR.SequentialSchedulerState.RawTokenAge}
  {sigma : List ProofNetIR.SequentialSchedulerState.RawTokenAge},
  ProofNetIR.SequentialSchedulerState.SigmaAgePartition nextAge sigma →
    0 < nextAge → ProofNetIR.SequentialSchedulerState.SigmaAgePartition (nextAge + 1) (sigma ++ [nextAge])
```

### `ProofNetIR.SequentialSchedulerState.SigmaAgePartition.popActive`

Kind: theorem.

Removing the active boundary from a partition with at least two explicit
tail boundaries leaves a valid partition at the unchanged raw-age horizon.
The horizon is an allocation counter, so a `unify` pop does not decrement it.

```lean
ProofNetIR.SequentialSchedulerState.SigmaAgePartition.popActive : ∀ {nextAge : ProofNetIR.SequentialSchedulerState.RawTokenAge}
  {sigma sigmaPrefix : List ProofNetIR.SequentialSchedulerState.RawTokenAge}
  {previous active : ProofNetIR.SequentialSchedulerState.RawTokenAge},
  ProofNetIR.SequentialSchedulerState.SigmaAgePartition nextAge sigma →
    sigma = sigmaPrefix ++ [previous, active] →
      ProofNetIR.SequentialSchedulerState.SigmaAgePartition nextAge (sigmaPrefix ++ [previous])
```

### `ProofNetIR.SequentialSchedulerState.sigmaBoundary?`

Kind: definition.

Greatest partition boundary not exceeding `age`.  The definition is
executable and uses raw ages directly.

```lean
ProofNetIR.SequentialSchedulerState.sigmaBoundary? : List ProofNetIR.SequentialSchedulerState.RawTokenAge →
  ProofNetIR.SequentialSchedulerState.RawTokenAge → Option ProofNetIR.SequentialSchedulerState.RawTokenAge
```

### `ProofNetIR.SequentialSchedulerState.sigmaBoundary?_append_fresh_old`

Kind: theorem.

Appending the fresh raw-age boundary does not change any lookup strictly
below the old horizon.

```lean
ProofNetIR.SequentialSchedulerState.sigmaBoundary?_append_fresh_old : ∀ {sigma : List ProofNetIR.SequentialSchedulerState.RawTokenAge}
  {nextAge age : ProofNetIR.SequentialSchedulerState.RawTokenAge},
  age < nextAge →
    ProofNetIR.SequentialSchedulerState.sigmaBoundary? (sigma ++ [nextAge]) age =
      ProofNetIR.SequentialSchedulerState.sigmaBoundary? sigma age
```

### `ProofNetIR.SequentialSchedulerState.SigmaAgePartition.sigmaBoundary?_append_fresh_self`

Kind: theorem.

The boundary appended at the old horizon is exactly the boundary returned
for that freshly reserved raw age.

```lean
ProofNetIR.SequentialSchedulerState.SigmaAgePartition.sigmaBoundary?_append_fresh_self : ∀ {nextAge : ProofNetIR.SequentialSchedulerState.RawTokenAge}
  {sigma : List ProofNetIR.SequentialSchedulerState.RawTokenAge},
  ProofNetIR.SequentialSchedulerState.SigmaAgePartition nextAge sigma →
    ProofNetIR.SequentialSchedulerState.sigmaBoundary? (sigma ++ [nextAge]) nextAge = some nextAge
```

### `ProofNetIR.SequentialSchedulerState.SigmaAgePartition.sigmaBoundary?_eq_top`

Kind: theorem.

The active (last) boundary of a valid scheduler partition is returned
exactly when queried at its own raw age.

```lean
ProofNetIR.SequentialSchedulerState.SigmaAgePartition.sigmaBoundary?_eq_top : ∀ {nextAge : ProofNetIR.SequentialSchedulerState.RawTokenAge}
  {sigma : List ProofNetIR.SequentialSchedulerState.RawTokenAge},
  ProofNetIR.SequentialSchedulerState.SigmaAgePartition nextAge sigma →
    ∀ {active : ProofNetIR.SequentialSchedulerState.RawTokenAge},
      sigma.getLast? = some active → ProofNetIR.SequentialSchedulerState.sigmaBoundary? sigma active = some active
```

### `ProofNetIR.SequentialSchedulerState.sigmaBoundary?_mem`

Kind: theorem.

Every returned boundary comes from the supplied stack.

```lean
ProofNetIR.SequentialSchedulerState.sigmaBoundary?_mem : ∀ {sigma : List ProofNetIR.SequentialSchedulerState.RawTokenAge}
  {age boundary : ProofNetIR.SequentialSchedulerState.RawTokenAge},
  ProofNetIR.SequentialSchedulerState.sigmaBoundary? sigma age = some boundary → boundary ∈ sigma
```

### `ProofNetIR.SequentialSchedulerState.sigmaBoundary?_le`

Kind: theorem.

Every returned boundary is at most the queried raw age.

```lean
ProofNetIR.SequentialSchedulerState.sigmaBoundary?_le : ∀ {sigma : List ProofNetIR.SequentialSchedulerState.RawTokenAge}
  {age boundary : ProofNetIR.SequentialSchedulerState.RawTokenAge},
  ProofNetIR.SequentialSchedulerState.sigmaBoundary? sigma age = some boundary → boundary ≤ age
```

### `ProofNetIR.SequentialSchedulerState.sigmaBoundary?_greatest`

Kind: theorem.

On an increasing boundary stack, the executable result dominates every
other boundary that does not exceed the queried age.

```lean
ProofNetIR.SequentialSchedulerState.sigmaBoundary?_greatest : ∀ {sigma : List ProofNetIR.SequentialSchedulerState.RawTokenAge}
  {age boundary : ProofNetIR.SequentialSchedulerState.RawTokenAge},
  List.Pairwise (fun x1 x2 => x1 < x2) sigma →
    ProofNetIR.SequentialSchedulerState.sigmaBoundary? sigma age = some boundary →
      ∀ (candidate : ProofNetIR.SequentialSchedulerState.RawTokenAge),
        candidate ∈ sigma → candidate ≤ age → candidate ≤ boundary
```

### `ProofNetIR.SequentialSchedulerState.SigmaAgePartition.boundary_exists`

Kind: theorem.

A nonempty partition always yields a boundary for any raw age below its
horizon (the head boundary `0` is already eligible).

```lean
ProofNetIR.SequentialSchedulerState.SigmaAgePartition.boundary_exists : ∀ {nextAge : ProofNetIR.SequentialSchedulerState.RawTokenAge}
  {sigma : List ProofNetIR.SequentialSchedulerState.RawTokenAge},
  ProofNetIR.SequentialSchedulerState.SigmaAgePartition nextAge sigma →
    ∀ {age : ProofNetIR.SequentialSchedulerState.RawTokenAge},
      age < nextAge → ∃ boundary, ProofNetIR.SequentialSchedulerState.sigmaBoundary? sigma age = some boundary
```

### `ProofNetIR.SequentialSchedulerState.sigmaBoundary_unique_of_greatest`

Kind: theorem.

The greatest eligible boundary is mathematically unique.

```lean
ProofNetIR.SequentialSchedulerState.sigmaBoundary_unique_of_greatest : ∀ {sigma : List ProofNetIR.SequentialSchedulerState.RawTokenAge}
  {age first second : ProofNetIR.SequentialSchedulerState.RawTokenAge},
  first ∈ sigma →
    first ≤ age →
      (∀ (candidate : ProofNetIR.SequentialSchedulerState.RawTokenAge),
          candidate ∈ sigma → candidate ≤ age → candidate ≤ first) →
        second ∈ sigma →
          second ≤ age →
            (∀ (candidate : ProofNetIR.SequentialSchedulerState.RawTokenAge),
                candidate ∈ sigma → candidate ≤ age → candidate ≤ second) →
              first = second
```

### `ProofNetIR.SequentialSchedulerState.SequentialStackState`

Kind: inductive type.

Concrete Figures 7--8 bookkeeping before the transition system itself.
`waiting` is a fixed-capacity table: array lookup `none` means out of bounds,
`some undefined` means `⊥`, and `some (initialized [])` means `∅`.

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState : Type
```

### `ProofNetIR.SequentialSchedulerState.SequentialStackState.WaitingCell.vertices`

Kind: definition.

The vertices currently stored in one waiting cell.  Paper-level
`undefined` contributes no payload, while an initialized cell contributes its
complete stored list.

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState.WaitingCell.vertices : ProofNetIR.SequentialSchedulerState.WaitingCell → List ProofNetIR.Vertex
```

### `ProofNetIR.SequentialSchedulerState.SequentialStackState.waitingVertices`

Kind: definition.

All waiting payloads in raw-age order.

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState.waitingVertices : ProofNetIR.SequentialSchedulerState.SequentialStackState → List ProofNetIR.Vertex
```

### `ProofNetIR.SequentialSchedulerState.SequentialStackState.queuedVertices`

Kind: definition.

Every occurrence currently stored by either the ready stack or the waiting
table.  This is the executable domain against which later enqueue operations
must check global absence.  Semantic ownership and uniqueness remain separate
history invariants.

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState.queuedVertices : ProofNetIR.SequentialSchedulerState.SequentialStackState → List ProofNetIR.Vertex
```

### `ProofNetIR.SequentialSchedulerState.SequentialStackState.prependWaiting?`

Kind: definition.

Prepend one conclusion to an already initialized waiting bucket.

This is the exact constant-time payload update used by the local Figure-7
`wait` slice.  It fails closed on an out-of-bounds lookup and on the distinct
paper-level undefined cell `⊥`; an initialized empty bucket `∅` succeeds.
Global queue ownership is deliberately not checked by this primitive.

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState.prependWaiting? : ProofNetIR.SequentialSchedulerState.SequentialStackState →
  ProofNetIR.SequentialSchedulerState.RawTokenAge →
    ProofNetIR.Vertex → Option ProofNetIR.SequentialSchedulerState.SequentialStackState
```

### `ProofNetIR.SequentialSchedulerState.SequentialStackState.PrependWaitingStep`

Kind: inductive type.

Proof-relevant exact specification of one successful waiting prepend.

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState.PrependWaitingStep : ProofNetIR.SequentialSchedulerState.SequentialStackState →
  ProofNetIR.SequentialSchedulerState.SequentialStackState →
    ProofNetIR.SequentialSchedulerState.RawTokenAge → ProofNetIR.Vertex → Type
```

### `ProofNetIR.SequentialSchedulerState.SequentialStackState.prependWaiting?_some_iff`

Kind: theorem.

Waiting prepend succeeds exactly on an initialized in-bounds bucket.

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState.prependWaiting?_some_iff : ∀ {before after : ProofNetIR.SequentialSchedulerState.SequentialStackState}
  {boundary : ProofNetIR.SequentialSchedulerState.RawTokenAge} {conclusion : ProofNetIR.Vertex},
  before.prependWaiting? boundary conclusion = some after ↔
    Nonempty (before.PrependWaitingStep after boundary conclusion)
```

### `ProofNetIR.SequentialSchedulerState.SequentialStackState.prependWaiting?_exact`

Kind: theorem.

Exact changed and unchanged fields of a successful waiting prepend.

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState.prependWaiting?_exact : ∀ {before after : ProofNetIR.SequentialSchedulerState.SequentialStackState}
  {boundary : ProofNetIR.SequentialSchedulerState.RawTokenAge} {conclusion : ProofNetIR.Vertex},
  before.prependWaiting? boundary conclusion = some after →
    ∃ payload,
      before.waiting[boundary]? = some (ProofNetIR.SequentialSchedulerState.WaitingCell.initialized payload) ∧
        after.waiting =
            before.waiting.setIfInBounds boundary
              (ProofNetIR.SequentialSchedulerState.WaitingCell.initialized (conclusion :: payload)) ∧
          after.waiting[boundary]? =
              some (ProofNetIR.SequentialSchedulerState.WaitingCell.initialized (conclusion :: payload)) ∧
            after.marks = before.marks ∧
              after.nextAge = before.nextAge ∧ after.sigma = before.sigma ∧ after.ready = before.ready
```

### `ProofNetIR.SequentialSchedulerState.SequentialStackState.prependWaiting?_of_ne`

Kind: theorem.

A waiting prepend changes no bucket at a different raw-age index.

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState.prependWaiting?_of_ne : ∀ {before after : ProofNetIR.SequentialSchedulerState.SequentialStackState}
  {boundary other : ProofNetIR.SequentialSchedulerState.RawTokenAge} {conclusion : ProofNetIR.Vertex},
  before.prependWaiting? boundary conclusion = some after →
    other ≠ boundary → after.waiting[other]? = before.waiting[other]?
```

### `ProofNetIR.SequentialSchedulerState.SequentialStackState.prependWaiting?_wellShaped`

Kind: theorem.

Waiting prepend preserves scheduler shape; it changes only one payload
inside an already initialized fixed-capacity cell.

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState.prependWaiting?_wellShaped : ∀ {before after : ProofNetIR.SequentialSchedulerState.SequentialStackState} {carrierSize : Nat}
  {boundary : ProofNetIR.SequentialSchedulerState.RawTokenAge} {conclusion : ProofNetIR.Vertex},
  before.WellShaped carrierSize → before.prependWaiting? boundary conclusion = some after → after.WellShaped carrierSize
```

### `ProofNetIR.SequentialSchedulerState.SequentialStackState.prependWaiting?_operationalWaitingDomain`

Kind: theorem.

Waiting prepend preserves the exact initialized waiting domain.

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState.prependWaiting?_operationalWaitingDomain : ∀ {before after : ProofNetIR.SequentialSchedulerState.SequentialStackState}
  {boundary : ProofNetIR.SequentialSchedulerState.RawTokenAge} {conclusion : ProofNetIR.Vertex},
  before.OperationalWaitingDomain →
    before.prependWaiting? boundary conclusion = some after → after.OperationalWaitingDomain
```

### `ProofNetIR.SequentialSchedulerState.SequentialStackState.prependReadyTop?`

Kind: definition.

Prepend one conclusion to the current (last) ready bucket.

This local primitive deliberately performs no global queued-occurrence scan.
Its preservation theorem below therefore receives the exact local
duplicate-freedom and carrier-bound facts as proof inputs.

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState.prependReadyTop? : ProofNetIR.SequentialSchedulerState.SequentialStackState →
  ProofNetIR.Vertex → Option ProofNetIR.SequentialSchedulerState.SequentialStackState
```

### `ProofNetIR.SequentialSchedulerState.SequentialStackState.PrependReadyTopStep`

Kind: inductive type.

Proof-relevant exact specification of one successful ready-top prepend.

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState.PrependReadyTopStep : ProofNetIR.SequentialSchedulerState.SequentialStackState →
  ProofNetIR.SequentialSchedulerState.SequentialStackState → ProofNetIR.Vertex → Type
```

### `ProofNetIR.SequentialSchedulerState.SequentialStackState.prependReadyTop?_some_iff`

Kind: theorem.

Ready-top prepend succeeds exactly when the ready stack is nonempty.

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState.prependReadyTop?_some_iff : ∀ {before after : ProofNetIR.SequentialSchedulerState.SequentialStackState} {conclusion : ProofNetIR.Vertex},
  before.prependReadyTop? conclusion = some after ↔ Nonempty (before.PrependReadyTopStep after conclusion)
```

### `ProofNetIR.SequentialSchedulerState.SequentialStackState.prependReadyTop?_exact`

Kind: theorem.

Exact changed and unchanged fields of a successful ready-top prepend.

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState.prependReadyTop?_exact : ∀ {before after : ProofNetIR.SequentialSchedulerState.SequentialStackState} {conclusion : ProofNetIR.Vertex},
  before.prependReadyTop? conclusion = some after →
    ∃ readyPrefix activeReady,
      before.ready = readyPrefix ++ [activeReady] ∧
        after.ready = readyPrefix ++ [conclusion :: activeReady] ∧
          after.marks = before.marks ∧
            after.nextAge = before.nextAge ∧ after.sigma = before.sigma ∧ after.waiting = before.waiting
```

### `ProofNetIR.SequentialSchedulerState.SequentialStackState.prependReadyTop?_wellShaped`

Kind: theorem.

Ready-top prepend preserves scheduler shape from explicit local
duplicate-freedom and carrier-bound evidence.  No global queue ownership is
claimed or searched for.

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState.prependReadyTop?_wellShaped : ∀ {before after : ProofNetIR.SequentialSchedulerState.SequentialStackState} {carrierSize : Nat}
  {conclusion : ProofNetIR.Vertex},
  before.WellShaped carrierSize →
    before.prependReadyTop? conclusion = some after →
      conclusion < carrierSize →
        (∀ {activeReady : List ProofNetIR.Vertex},
            before.ready.getLast? = some activeReady → (conclusion :: activeReady).Nodup) →
          after.WellShaped carrierSize
```

### `ProofNetIR.SequentialSchedulerState.SequentialStackState.prependReadyTop?_operationalWaitingDomain`

Kind: theorem.

Ready-top prepend changes neither the boundary stack nor waiting storage,
so it preserves the operational waiting domain exactly.

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState.prependReadyTop?_operationalWaitingDomain : ∀ {before after : ProofNetIR.SequentialSchedulerState.SequentialStackState} {conclusion : ProofNetIR.Vertex},
  before.OperationalWaitingDomain → before.prependReadyTop? conclusion = some after → after.OperationalWaitingDomain
```

### `ProofNetIR.SequentialSchedulerState.SequentialStackState.mergeTopReadyWaiting?`

Kind: definition.

Merge the two top scheduler buckets at an exact previous boundary.

The deterministic list refinement is
`conclusion :: (payload ++ previousReady ++ activeReady)`: Guerrini's paper
uses sets inside its ready/waiting cells, so this list order is a project
choice fixed here for executable reproducibility.  The operation drains
`W(previousBoundary)`, makes that cell undefined because it becomes active,
and pops only the active `sigma`/ready level.  It performs no global
`queuedVertices` scan.

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState.mergeTopReadyWaiting? : ProofNetIR.SequentialSchedulerState.SequentialStackState →
  ProofNetIR.SequentialSchedulerState.RawTokenAge →
    ProofNetIR.Vertex → Option ProofNetIR.SequentialSchedulerState.SequentialStackState
```

### `ProofNetIR.SequentialSchedulerState.SequentialStackState.MergeTopReadyWaitingStep`

Kind: inductive type.

Proof-relevant exact specification of one successful two-level merge.

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState.MergeTopReadyWaitingStep : ProofNetIR.SequentialSchedulerState.SequentialStackState →
  ProofNetIR.SequentialSchedulerState.SequentialStackState →
    ProofNetIR.SequentialSchedulerState.RawTokenAge → ProofNetIR.Vertex → Type
```

### `ProofNetIR.SequentialSchedulerState.SequentialStackState.mergeTopReadyWaiting?_some_iff`

Kind: theorem.

The two-level merge succeeds exactly when both stacks expose two levels,
the requested boundary is the previous `sigma` boundary, and its waiting cell
is initialized.

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState.mergeTopReadyWaiting?_some_iff : ∀ {before after : ProofNetIR.SequentialSchedulerState.SequentialStackState}
  {previousBoundary : ProofNetIR.SequentialSchedulerState.RawTokenAge} {conclusion : ProofNetIR.Vertex},
  before.mergeTopReadyWaiting? previousBoundary conclusion = some after ↔
    Nonempty (before.MergeTopReadyWaitingStep after previousBoundary conclusion)
```

### `ProofNetIR.SequentialSchedulerState.SequentialStackState.mergeTopReadyWaiting?_exact`

Kind: theorem.

Exact changed and unchanged fields of a successful two-level merge.

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState.mergeTopReadyWaiting?_exact : ∀ {before after : ProofNetIR.SequentialSchedulerState.SequentialStackState}
  {previousBoundary : ProofNetIR.SequentialSchedulerState.RawTokenAge} {conclusion : ProofNetIR.Vertex},
  before.mergeTopReadyWaiting? previousBoundary conclusion = some after →
    ∃ sigmaPrefix activeBoundary readyPrefix previousReady activeReady payload,
      before.sigma = sigmaPrefix ++ [previousBoundary, activeBoundary] ∧
        before.ready = readyPrefix ++ [previousReady, activeReady] ∧
          before.waiting[previousBoundary]? =
              some (ProofNetIR.SequentialSchedulerState.WaitingCell.initialized payload) ∧
            after.sigma = sigmaPrefix ++ [previousBoundary] ∧
              after.ready = readyPrefix ++ [conclusion :: (payload ++ previousReady ++ activeReady)] ∧
                after.waiting =
                    before.waiting.setIfInBounds previousBoundary
                      ProofNetIR.SequentialSchedulerState.WaitingCell.undefined ∧
                  after.waiting[previousBoundary]? = some ProofNetIR.SequentialSchedulerState.WaitingCell.undefined ∧
                    after.marks = before.marks ∧ after.nextAge = before.nextAge
```

### `ProofNetIR.SequentialSchedulerState.SequentialStackState.mergeTopReadyWaiting?_wellShaped`

Kind: theorem.

The two-level merge preserves scheduler shape when its newly assembled
bucket is explicitly duplicate-free, the newly queued conclusion is
in-bounds, and every drained waiting occurrence is in-bounds.  Existing ready
bucket bounds are inherited; no ownership theorem is inferred from a runtime
scan.

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState.mergeTopReadyWaiting?_wellShaped : ∀ {before after : ProofNetIR.SequentialSchedulerState.SequentialStackState} {carrierSize : Nat}
  {previousBoundary : ProofNetIR.SequentialSchedulerState.RawTokenAge} {conclusion : ProofNetIR.Vertex},
  before.WellShaped carrierSize →
    before.mergeTopReadyWaiting? previousBoundary conclusion = some after →
      conclusion < carrierSize →
        (∀ {payload : List ProofNetIR.Vertex},
            before.waiting[previousBoundary]? =
                some (ProofNetIR.SequentialSchedulerState.WaitingCell.initialized payload) →
              ∀ (vertex : ProofNetIR.Vertex), vertex ∈ payload → vertex < carrierSize) →
          (∀ {previousReady activeReady payload : List ProofNetIR.Vertex},
              before.ready.dropLast.getLast? = some previousReady →
                before.ready.getLast? = some activeReady →
                  before.waiting[previousBoundary]? =
                      some (ProofNetIR.SequentialSchedulerState.WaitingCell.initialized payload) →
                    (conclusion :: (payload ++ previousReady ++ activeReady)).Nodup) →
            after.WellShaped carrierSize
```

### `ProofNetIR.SequentialSchedulerState.SequentialStackState.mergeTopReadyWaiting?_operationalWaitingDomain`

Kind: theorem.

Draining the previous initialized waiting bucket and making it the new
active boundary preserves the exact operational waiting domain.

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState.mergeTopReadyWaiting?_operationalWaitingDomain : ∀ {before after : ProofNetIR.SequentialSchedulerState.SequentialStackState}
  {previousBoundary : ProofNetIR.SequentialSchedulerState.RawTokenAge} {conclusion : ProofNetIR.Vertex},
  before.WellShaped before.marks.size →
    before.OperationalWaitingDomain →
      before.mergeTopReadyWaiting? previousBoundary conclusion = some after → after.OperationalWaitingDomain
```

### `ProofNetIR.SequentialSchedulerState.SequentialStackState.WaitingInitializedAt`

Kind: definition.

The waiting-table cell at `age` has been initialized, with an arbitrary
current payload.  This intentionally distinguishes initialized empty `∅` from
paper-level undefined `⊥`.

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState.WaitingInitializedAt : ProofNetIR.SequentialSchedulerState.SequentialStackState → ProofNetIR.SequentialSchedulerState.RawTokenAge → Prop
```

### `ProofNetIR.SequentialSchedulerState.SequentialStackState.OperationalWaitingDomain`

Kind: inductive type.

Operational waiting-domain alignment for the sequential scheduler.

Among allocated raw ages, initialized waiting cells are exactly the inactive
`sigma` boundaries.  The current active boundary (the last element of
`sigma`) is therefore still `⊥`; an age outside the allocated horizon is
handled separately by the executable fresh-cell guard.

This is the coherent invariant needed by `wait`/`unify`.  Guerrini's printed
Figure 7 writes `W[j ↦ ∅]` at the freshly pushed age, but the surrounding prose
defines `W` on nonactive boundaries and `unify` reads the old boundary.  The
literal printed transition is retained below for auditability, while the
production bridge uses the operational transition proved to preserve this
invariant.

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState.OperationalWaitingDomain : ProofNetIR.SequentialSchedulerState.SequentialStackState → Prop
```

### `ProofNetIR.SequentialSchedulerState.SequentialStackState.OperationalWaitingDomain.active_undefined`

Kind: theorem.

In a well-shaped operational state, the active `sigma` boundary is the
paper-level undefined waiting cell.

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState.OperationalWaitingDomain.active_undefined : ∀ {state : ProofNetIR.SequentialSchedulerState.SequentialStackState} {carrierSize : Nat},
  state.OperationalWaitingDomain →
    state.WellShaped carrierSize →
      ∀ {active : ProofNetIR.SequentialSchedulerState.RawTokenAge},
        state.sigma.getLast? = some active →
          state.waiting[active]? = some ProofNetIR.SequentialSchedulerState.WaitingCell.undefined
```

### `ProofNetIR.SequentialSchedulerState.SequentialStackState.empty`

Kind: definition.

Empty fixed-carrier scheduler storage.

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState.empty : Nat → ProofNetIR.SequentialSchedulerState.SequentialStackState
```

### `ProofNetIR.SequentialSchedulerState.SequentialStackState.WellShaped`

Kind: inductive type.

Shape and age invariants for the delayed scheduler state.  This is
deliberately only a shape layer: it does not assert cross-bucket uniqueness,
semantic readiness, constraints on initialized waiting payloads, or an exact
domain correspondence between `waiting` and `sigma`.

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState.WellShaped : ProofNetIR.SequentialSchedulerState.SequentialStackState → Nat → Prop
```

### `ProofNetIR.SequentialSchedulerState.SequentialStackState.WellShaped.waiting_lookup_exists`

Kind: theorem.

Every reserved raw age addresses an actual waiting cell.  Thus an array
lookup returning `none` is an out-of-bounds fact and cannot be confused with
the in-bounds paper state `undefined`.

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState.WellShaped.waiting_lookup_exists : ∀ {state : ProofNetIR.SequentialSchedulerState.SequentialStackState} {carrierSize : Nat},
  state.WellShaped carrierSize →
    ∀ {age : ProofNetIR.SequentialSchedulerState.RawTokenAge},
      age < state.nextAge → ∃ cell, state.waiting[age]? = some cell
```

### `ProofNetIR.SequentialSchedulerState.SequentialStackState.empty_wellShaped`

Kind: theorem.

The empty fixed-carrier state is well shaped.

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState.empty_wellShaped : ∀ (carrierSize : Nat),
  (ProofNetIR.SequentialSchedulerState.SequentialStackState.empty carrierSize).WellShaped carrierSize
```

### `ProofNetIR.SequentialSchedulerState.SequentialStackState.empty_operationalWaitingDomain`

Kind: theorem.

The empty fixed-carrier state has the exact empty operational waiting
domain.

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState.empty_operationalWaitingDomain : ∀ (carrierSize : Nat),
  (ProofNetIR.SequentialSchedulerState.SequentialStackState.empty carrierSize).OperationalWaitingDomain
```

### `ProofNetIR.SequentialSchedulerState.SequentialStackState.PopReadyMarkError`

Kind: inductive type.

Explicit failures of the Figure-7 pop-before-mark primitive.

`markOutOfBounds` is deliberately distinct from `alreadyMarked`: array lookup
`none` is a carrier error, while `some (some age)` is an in-carrier occurrence
that already has a raw mark.  An in-carrier unmarked occurrence has lookup
`some none` and is the only successful case.

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState.PopReadyMarkError : Type
```

### `ProofNetIR.SequentialSchedulerState.SequentialStackState.PopReadyMarkResult`

Kind: inductive type.

Executable output of one Figure-7 pop-before-mark action.  The selected
vertex is removed from the top (last) ready bucket, but the bucket itself is
retained even when `remainingTop = []`.

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState.PopReadyMarkResult : Type
```

### `ProofNetIR.SequentialSchedulerState.SequentialStackState.popReadyMark?`

Kind: definition.

Pop the first selected vertex from the top (last) ready bucket and mark it
with the old top raw-age boundary.

This is only the common first line of the non-`init` rules in Guerrini
Figure 7.  It does not inspect the link below the selected vertex, mutate
`sigma` or `waiting`, or run `NEXTAXIOM`.

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState.popReadyMark? : ProofNetIR.SequentialSchedulerState.SequentialStackState →
  Except ProofNetIR.SequentialSchedulerState.SequentialStackState.PopReadyMarkError
    ProofNetIR.SequentialSchedulerState.SequentialStackState.PopReadyMarkResult
```

### `ProofNetIR.SequentialSchedulerState.SequentialStackState.PopReadyMarkStep`

Kind: inductive type.

Proof-relevant exact specification of one successful pop-before-mark
action.

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState.PopReadyMarkStep : ProofNetIR.SequentialSchedulerState.SequentialStackState →
  ProofNetIR.SequentialSchedulerState.SequentialStackState.PopReadyMarkResult → Type
```

### `ProofNetIR.SequentialSchedulerState.SequentialStackState.popReadyMark?_ok_iff`

Kind: theorem.

Executable success is equivalent to the exact dependent
pop-before-mark witness.

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState.popReadyMark?_ok_iff : ∀ {state : ProofNetIR.SequentialSchedulerState.SequentialStackState}
  {result : ProofNetIR.SequentialSchedulerState.SequentialStackState.PopReadyMarkResult},
  state.popReadyMark? = Except.ok result ↔ Nonempty (state.PopReadyMarkStep result)
```

### `ProofNetIR.SequentialSchedulerState.SequentialStackState.popReadyMark?_exact`

Kind: theorem.

Exact changed and unchanged stack fields of a successful
pop-before-mark action.

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState.popReadyMark?_exact : ∀ {state : ProofNetIR.SequentialSchedulerState.SequentialStackState}
  {result : ProofNetIR.SequentialSchedulerState.SequentialStackState.PopReadyMarkResult},
  state.popReadyMark? = Except.ok result →
    state.ready.getLast? = some (result.vertex :: result.remainingTop) ∧
      state.sigma.getLast? = some result.rawAge ∧
        state.marks[result.vertex]? = some none ∧
          result.after.marks = state.marks.setIfInBounds result.vertex (some result.rawAge) ∧
            result.after.nextAge = state.nextAge ∧
              result.after.sigma = state.sigma ∧
                result.after.ready = state.ready.dropLast ++ [result.remainingTop] ∧
                  result.after.waiting = state.waiting ∧ result.after.marks[result.vertex]? = some (some result.rawAge)
```

### `ProofNetIR.SequentialSchedulerState.SequentialStackState.popReadyMark?_wellShaped`

Kind: theorem.

The common Figure-7 pop-before-mark action preserves scheduler shape.

The explicit successful-step guards supply all facts needed here: the selected
vertex is an in-bounds member of the old top bucket, and the assigned raw age
is the old top `sigma` boundary.  No semantic readiness claim is inferred.

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState.popReadyMark?_wellShaped : ∀ {state : ProofNetIR.SequentialSchedulerState.SequentialStackState}
  {result : ProofNetIR.SequentialSchedulerState.SequentialStackState.PopReadyMarkResult} {carrierSize : Nat},
  state.WellShaped carrierSize → state.popReadyMark? = Except.ok result → result.after.WellShaped carrierSize
```

### `ProofNetIR.SequentialSchedulerState.SequentialStackState.AllMarksUndefined`

Kind: definition.

Executable predicate asserting that every allocated occurrence is
unmarked.

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState.AllMarksUndefined : ProofNetIR.SequentialSchedulerState.SequentialStackState → Prop
```

### `ProofNetIR.SequentialSchedulerState.SequentialStackState.AllWaitingUndefined`

Kind: definition.

Every allocated waiting-table cell is the paper-level `⊥`.

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState.AllWaitingUndefined : ProofNetIR.SequentialSchedulerState.SequentialStackState → Prop
```

### `ProofNetIR.SequentialSchedulerState.SequentialStackState.AllMarksUndefined.lookup`

Kind: theorem.

Executable all-undefined marking implies the exact lookup fact at every
in-bounds occurrence.

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState.AllMarksUndefined.lookup : ∀ {state : ProofNetIR.SequentialSchedulerState.SequentialStackState},
  state.AllMarksUndefined → ∀ {vertex : ProofNetIR.Vertex}, vertex < state.marks.size → state.marks[vertex]? = some none
```

### `ProofNetIR.SequentialSchedulerState.SequentialStackState.AllWaitingUndefined.lookup`

Kind: theorem.

Executable all-undefined waiting storage implies the exact `⊥` lookup
fact at every in-bounds raw age.

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState.AllWaitingUndefined.lookup : ∀ {state : ProofNetIR.SequentialSchedulerState.SequentialStackState},
  state.AllWaitingUndefined →
    ∀ {age : ProofNetIR.SequentialSchedulerState.RawTokenAge},
      age < state.waiting.size → state.waiting[age]? = some ProofNetIR.SequentialSchedulerState.WaitingCell.undefined
```

### `ProofNetIR.SequentialSchedulerState.SequentialStackState.InitReady`

Kind: definition.

Local executable guard for the delayed initial reservation.  In
particular, `nextAge = 0` alone is not accepted as an empty local state: all
marks and waiting cells must be undefined, and both stacks must be empty.
Carrier agreement and the other global shape obligations remain the separate
precondition of `initEnqueue?_wellShaped`.

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState.InitReady : ProofNetIR.SequentialSchedulerState.SequentialStackState → ProofNetIR.Vertex → ProofNetIR.Vertex → Prop
```

### `ProofNetIR.SequentialSchedulerState.SequentialStackState.initEnqueue?`

Kind: definition.

Delayed Figure-7-style initialization.  It reserves raw age `0`, enqueues
the reached endpoint before its partner, and leaves both marks and `W(0)`
unchanged (`W(0)` remains `⊥`).

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState.initEnqueue? : ProofNetIR.SequentialSchedulerState.SequentialStackState →
  ProofNetIR.Vertex → ProofNetIR.Vertex → Option ProofNetIR.SequentialSchedulerState.SequentialStackState
```

### `ProofNetIR.SequentialSchedulerState.SequentialStackState.initEnqueue?_some_iff`

Kind: theorem.

Successful delayed initialization is exactly the strict initial
precondition together with the reserved state fields.

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState.initEnqueue?_some_iff : ∀ {state after : ProofNetIR.SequentialSchedulerState.SequentialStackState} {reached partner : ProofNetIR.Vertex},
  state.initEnqueue? reached partner = some after ↔
    state.InitReady reached partner ∧
      after = ProofNetIR.SequentialSchedulerState.SequentialStackState.initAfter✝ state reached partner
```

### `ProofNetIR.SequentialSchedulerState.SequentialStackState.initEnqueue?_exact`

Kind: theorem.

Exact delayed-initialization fields.

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState.initEnqueue?_exact : ∀ {state after : ProofNetIR.SequentialSchedulerState.SequentialStackState} {reached partner : ProofNetIR.Vertex},
  state.initEnqueue? reached partner = some after →
    after.marks = state.marks ∧
      after.nextAge = 1 ∧
        after.sigma = [0] ∧
          after.ready = [[reached, partner]] ∧
            after.waiting = state.waiting ∧
              after.waiting[0]? = some ProofNetIR.SequentialSchedulerState.WaitingCell.undefined
```

### `ProofNetIR.SequentialSchedulerState.SequentialStackState.initEnqueue?_endpoint_unmarked`

Kind: theorem.

Delayed initialization leaves both enqueued endpoints unmarked.

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState.initEnqueue?_endpoint_unmarked : ∀ {state after : ProofNetIR.SequentialSchedulerState.SequentialStackState} {reached partner : ProofNetIR.Vertex},
  state.initEnqueue? reached partner = some after →
    after.marks[reached]? = some none ∧ after.marks[partner]? = some none
```

### `ProofNetIR.SequentialSchedulerState.SequentialStackState.initEnqueue?_wellShaped`

Kind: theorem.

Delayed initialization preserves all shape invariants.

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState.initEnqueue?_wellShaped : ∀ {state after : ProofNetIR.SequentialSchedulerState.SequentialStackState} {carrierSize : Nat}
  {reached partner : ProofNetIR.Vertex},
  state.WellShaped carrierSize → state.initEnqueue? reached partner = some after → after.WellShaped carrierSize
```

### `ProofNetIR.SequentialSchedulerState.SequentialStackState.initEnqueue?_operationalWaitingDomain`

Kind: theorem.

Strict delayed initialization establishes the exact operational waiting
domain: the sole active boundary `0` remains `⊥`, so no allocated waiting cell
is initialized.

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState.initEnqueue?_operationalWaitingDomain : ∀ {state after : ProofNetIR.SequentialSchedulerState.SequentialStackState} {reached partner : ProofNetIR.Vertex},
  state.initEnqueue? reached partner = some after → after.OperationalWaitingDomain
```

## Printed Figure-7 new display audit

### `ProofNetIR.SequentialSchedulerState.SequentialStackState.NewReady`

Kind: definition.

Literal guard for the `new` line printed in Guerrini's Figure 7.

This display-level transition initializes the freshly pushed age.  It is
retained to make the source discrepancy auditable, but it does not preserve the
operational waiting-domain semantics required by the surrounding prose and
`unify`; production scheduler code uses `operationalNewEnqueue?` below.

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState.NewReady : ProofNetIR.SequentialSchedulerState.SequentialStackState → ProofNetIR.Vertex → ProofNetIR.Vertex → Prop
```

### `ProofNetIR.SequentialSchedulerState.SequentialStackState.newEnqueue?`

Kind: definition.

Literal transcription of the printed Figure-7 `new` waiting update.

This is not the production scheduler transition: it writes the fresh top
waiting cell, whereas the prose-defined waiting domain requires initializing
the old active boundary.  Use `operationalNewEnqueue?` for composable scheduler
work.

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState.newEnqueue? : ProofNetIR.SequentialSchedulerState.SequentialStackState →
  ProofNetIR.Vertex → ProofNetIR.Vertex → Option ProofNetIR.SequentialSchedulerState.SequentialStackState
```

### `ProofNetIR.SequentialSchedulerState.SequentialStackState.PrintedNewStep`

Kind: inductive type.

Public proof-relevant specification of the literal printed `new` display.
The output equation avoids exposing the private executable helper.

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState.PrintedNewStep : ProofNetIR.SequentialSchedulerState.SequentialStackState →
  ProofNetIR.SequentialSchedulerState.SequentialStackState → ProofNetIR.Vertex → ProofNetIR.Vertex → Type
```

### `ProofNetIR.SequentialSchedulerState.SequentialStackState.newEnqueue?_some_iff`

Kind: theorem.

The literal printed `new` display succeeds exactly under its local guard.
This theorem specifies the source-audit helper, not the production transition.

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState.newEnqueue?_some_iff : ∀ {state after : ProofNetIR.SequentialSchedulerState.SequentialStackState} {reached partner : ProofNetIR.Vertex},
  state.newEnqueue? reached partner = some after ↔ Nonempty (state.PrintedNewStep after reached partner)
```

### `ProofNetIR.SequentialSchedulerState.SequentialStackState.newEnqueue?_exact`

Kind: theorem.

Exact fields of the literal printed `new` display, including its fresh-cell
write.  That write is retained for source comparison and is not operational.

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState.newEnqueue?_exact : ∀ {state after : ProofNetIR.SequentialSchedulerState.SequentialStackState} {reached partner : ProofNetIR.Vertex},
  state.newEnqueue? reached partner = some after →
    after.marks = state.marks ∧
      after.nextAge = state.nextAge + 1 ∧
        after.sigma = state.sigma ++ [state.nextAge] ∧
          after.ready = state.ready ++ [[reached, partner]] ∧
            after.waiting =
                state.waiting.setIfInBounds state.nextAge
                  (ProofNetIR.SequentialSchedulerState.WaitingCell.initialized []) ∧
              after.waiting[state.nextAge]? = some (ProofNetIR.SequentialSchedulerState.WaitingCell.initialized [])
```

### `ProofNetIR.SequentialSchedulerState.SequentialStackState.newEnqueue?_waiting_of_ne`

Kind: theorem.

The literal printed `new` display changes no non-fresh waiting cell.

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState.newEnqueue?_waiting_of_ne : ∀ {state after : ProofNetIR.SequentialSchedulerState.SequentialStackState} {reached partner : ProofNetIR.Vertex}
  {index : ProofNetIR.SequentialSchedulerState.RawTokenAge},
  state.newEnqueue? reached partner = some after → index ≠ state.nextAge → after.waiting[index]? = state.waiting[index]?
```

### `ProofNetIR.SequentialSchedulerState.SequentialStackState.newEnqueue?_endpoint_unmarked`

Kind: theorem.

The literal printed `new` display leaves both endpoints unmarked.

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState.newEnqueue?_endpoint_unmarked : ∀ {state after : ProofNetIR.SequentialSchedulerState.SequentialStackState} {reached partner : ProofNetIR.Vertex},
  state.newEnqueue? reached partner = some after → after.marks[reached]? = some none ∧ after.marks[partner]? = some none
```

### `ProofNetIR.SequentialSchedulerState.SequentialStackState.newEnqueue?_wellShaped`

Kind: theorem.

The literal printed transition preserves the deliberately weak shape
invariant.  It does not preserve `OperationalWaitingDomain`.

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState.newEnqueue?_wellShaped : ∀ {state after : ProofNetIR.SequentialSchedulerState.SequentialStackState} {carrierSize : Nat}
  {reached partner : ProofNetIR.Vertex},
  state.WellShaped carrierSize → state.newEnqueue? reached partner = some after → after.WellShaped carrierSize
```

## Operational Figure-7 new reservation

### `ProofNetIR.SequentialSchedulerState.SequentialStackState.OperationalNewReadyAt`

Kind: definition.

Executable guard for the operationally coherent later reservation.

`active` is the old top `sigma` boundary.  It must still have an undefined
waiting cell, while the fresh raw age at `nextAge` must also be unused.  The
new endpoints are required to be globally absent from both the ready stack and
every waiting payload, so this local transition cannot introduce a duplicate
that a later `unify` would drain back into ready work.

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState.OperationalNewReadyAt : ProofNetIR.SequentialSchedulerState.SequentialStackState →
  ProofNetIR.SequentialSchedulerState.RawTokenAge → ProofNetIR.Vertex → ProofNetIR.Vertex → Prop
```

### `ProofNetIR.SequentialSchedulerState.SequentialStackState.operationalNewEnqueue?`

Kind: definition.

Operational later reservation.

The freshly allocated raw age becomes the new active top and remains `⊥`.
Instead, the old active boundary becomes inactive and is initialized to `∅`.
This is the chosen one-cell interpretation compatible with the prose
definition of `W`, the `wait` lookup, and the `unify` rule that later drains
that boundary.  No author-confirmed erratum or uniqueness theorem is claimed.

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState.operationalNewEnqueue? : ProofNetIR.SequentialSchedulerState.SequentialStackState →
  ProofNetIR.Vertex → ProofNetIR.Vertex → Option ProofNetIR.SequentialSchedulerState.SequentialStackState
```

### `ProofNetIR.SequentialSchedulerState.SequentialStackState.OperationalNewStep`

Kind: inductive type.

Public proof-relevant specification of one successful operational `new`.

The output equation is stated as an explicit record rather than exposing the
private executable helper in the public theorem signature.

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState.OperationalNewStep : ProofNetIR.SequentialSchedulerState.SequentialStackState →
  ProofNetIR.SequentialSchedulerState.SequentialStackState → ProofNetIR.Vertex → ProofNetIR.Vertex → Type
```

### `ProofNetIR.SequentialSchedulerState.SequentialStackState.operationalNewEnqueue?_some_iff`

Kind: theorem.

Executable success is equivalent to the public exact operational step.

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState.operationalNewEnqueue?_some_iff : ∀ {state after : ProofNetIR.SequentialSchedulerState.SequentialStackState} {reached partner : ProofNetIR.Vertex},
  state.operationalNewEnqueue? reached partner = some after ↔ Nonempty (state.OperationalNewStep after reached partner)
```

### `ProofNetIR.SequentialSchedulerState.SequentialStackState.operationalNewEnqueue?_exact`

Kind: theorem.

Exact fields of the operational later reservation.  The witness exposes
both the initialized old boundary and the still-undefined fresh top.

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState.operationalNewEnqueue?_exact : ∀ {state after : ProofNetIR.SequentialSchedulerState.SequentialStackState} {reached partner : ProofNetIR.Vertex},
  state.operationalNewEnqueue? reached partner = some after →
    ∃ active,
      state.sigma.getLast? = some active ∧
        active < state.nextAge ∧
          after.marks = state.marks ∧
            after.nextAge = state.nextAge + 1 ∧
              after.sigma = state.sigma ++ [state.nextAge] ∧
                after.ready = state.ready ++ [[reached, partner]] ∧
                  after.waiting =
                      state.waiting.setIfInBounds active
                        (ProofNetIR.SequentialSchedulerState.WaitingCell.initialized []) ∧
                    after.waiting[active]? = some (ProofNetIR.SequentialSchedulerState.WaitingCell.initialized []) ∧
                      after.waiting[state.nextAge]? = some ProofNetIR.SequentialSchedulerState.WaitingCell.undefined
```

### `ProofNetIR.SequentialSchedulerState.SequentialStackState.operationalNewEnqueue?_endpoint_unmarked`

Kind: theorem.

Operational `new` leaves both newly enqueued endpoints unmarked.

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState.operationalNewEnqueue?_endpoint_unmarked : ∀ {state after : ProofNetIR.SequentialSchedulerState.SequentialStackState} {reached partner : ProofNetIR.Vertex},
  state.operationalNewEnqueue? reached partner = some after →
    after.marks[reached]? = some none ∧ after.marks[partner]? = some none
```

### `ProofNetIR.SequentialSchedulerState.SequentialStackState.operationalNewEnqueue?_wellShaped`

Kind: theorem.

Operational `new` preserves the deliberately structural `WellShaped`
invariant.

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState.operationalNewEnqueue?_wellShaped : ∀ {state after : ProofNetIR.SequentialSchedulerState.SequentialStackState} {carrierSize : Nat}
  {reached partner : ProofNetIR.Vertex},
  state.WellShaped carrierSize →
    state.operationalNewEnqueue? reached partner = some after → after.WellShaped carrierSize
```

### `ProofNetIR.SequentialSchedulerState.SequentialStackState.operationalNewEnqueue?_operationalWaitingDomain`

Kind: theorem.

Operational `new` preserves the exact initialized waiting domain.

Before the push, initialized cells correspond to `sigma.dropLast`; setting the
old last boundary initializes exactly the one additional member needed for the
new inactive set `sigma`.  The fresh new top is checked to remain undefined.

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState.operationalNewEnqueue?_operationalWaitingDomain : ∀ {state after : ProofNetIR.SequentialSchedulerState.SequentialStackState} {carrierSize : Nat}
  {reached partner : ProofNetIR.Vertex},
  state.OperationalWaitingDomain →
    state.WellShaped carrierSize →
      state.operationalNewEnqueue? reached partner = some after → after.OperationalWaitingDomain
```

## Delayed scheduler / production bridge

### `ProofNetIR.Certificate.initialUnificationState`

Kind: definition.

Empty executable unification core on the certificate carrier.

This constructor is public so the delayed scheduler bridge can relate its
independent empty stack to the exact production carrier without duplicating
the production initialization record.

```lean
ProofNetIR.Certificate.initialUnificationState : ProofNetIR.Certificate → ProofNetIR.UnificationState
```

### `ProofNetIR.Certificate.UnificationComponent.axiom?`

Kind: definition.

The unique production constructor for an axiom component.

The stored submitted orientation is preserved in `frontier`.  Right-endpoint
typing is intentionally certified by `LinkWellFormed`, not silently repaired
or reoriented here.

```lean
ProofNetIR.Certificate.UnificationComponent.axiom? : ProofNetIR.Certificate → ProofNetIR.Vertex → ProofNetIR.Vertex → Option ProofNetIR.UnificationComponent
```

### `ProofNetIR.Certificate.UnificationComponent.axiom?_success`

Kind: theorem.

Exact inversion for a successful production axiom-component
construction.

```lean
ProofNetIR.Certificate.UnificationComponent.axiom?_success : ∀ {certificate : ProofNetIR.Certificate} {left right : ProofNetIR.Vertex} {component : ProofNetIR.UnificationComponent},
  ProofNetIR.Certificate.UnificationComponent.axiom? certificate left right = some component →
    ∃ name positive,
      certificate.formula? left = some (ProofNetIR.Formula.atom name positive) ∧
        component = { tree := ProofNetIR.CutFreeDerivation.axiom name positive, frontier := [left, right] }
```

### `ProofNetIR.Certificate.UnificationComponent.axiom?_formulaConsistent`

Kind: theorem.

A successfully constructed locally well-formed axiom component is
formula-consistent with the certificate.

```lean
ProofNetIR.Certificate.UnificationComponent.axiom?_formulaConsistent : ∀ {certificate : ProofNetIR.Certificate} {left right : ProofNetIR.Vertex} {component : ProofNetIR.UnificationComponent},
  certificate.LinkWellFormed (ProofNetIR.Link.axiom left right) →
    ProofNetIR.Certificate.UnificationComponent.axiom? certificate left right = some component →
      ProofNetIR.UnificationComponent.FormulaConsistent certificate component
```

### `ProofNetIR.Certificate.AxiomReservationReady`

Kind: definition.

Local precondition for reserving one submitted axiom without activating
its endpoints.

```lean
ProofNetIR.Certificate.AxiomReservationReady : ProofNetIR.Certificate → ProofNetIR.UnificationState → ProofNetIR.Vertex → ProofNetIR.Vertex → Prop
```

### `ProofNetIR.Certificate.reserveAxiomAt?`

Kind: definition.

Reserve the exact submitted axiom at `linkIndex`.

The submitted endpoint orientation is used for the live component.  Marks and
the connective counter are unchanged; the scheduler's search orientation is
kept separately in its ready bucket.

```lean
ProofNetIR.Certificate.reserveAxiomAt? : ProofNetIR.Certificate → ProofNetIR.UnificationState → Nat → Option ProofNetIR.UnificationState
```

### `ProofNetIR.Certificate.reserveAxiomAt?_exact`

Kind: theorem.

Successful reservation exposes the exact submitted axiom, constructor,
local guard, and all changed and unchanged production fields.

```lean
ProofNetIR.Certificate.reserveAxiomAt?_exact : ∀ {certificate : ProofNetIR.Certificate} {before after : ProofNetIR.UnificationState} {linkIndex : Nat},
  certificate.reserveAxiomAt? before linkIndex = some after →
    ∃ left right component,
      certificate.links[linkIndex]? = some (ProofNetIR.Link.axiom left right) ∧
        certificate.AxiomReservationReady before left right ∧
          ProofNetIR.Certificate.UnificationComponent.axiom? certificate left right = some component ∧
            component.frontier = [left, right] ∧
              after.marks = before.marks ∧
                after.parents = before.parents.push before.parents.size ∧
                  after.components = before.components.push (some component) ∧
                    after.startedAxioms = before.startedAxioms + 1 ∧ after.firedConnectives = before.firedConnectives
```

### `ProofNetIR.Certificate.reserveAxiomAt?_endpoint_unmarked`

Kind: theorem.

Reservation leaves both submitted axiom endpoints unmarked.

```lean
ProofNetIR.Certificate.reserveAxiomAt?_endpoint_unmarked : ∀ {certificate : ProofNetIR.Certificate} {before after : ProofNetIR.UnificationState} {linkIndex : Nat},
  certificate.reserveAxiomAt? before linkIndex = some after →
    ∃ left right,
      certificate.links[linkIndex]? = some (ProofNetIR.Link.axiom left right) ∧
        after.marks[left]? = some none ∧ after.marks[right]? = some none
```

### `ProofNetIR.Certificate.reserveAxiomAt?_componentsParentsAligned`

Kind: theorem.

Reservation preserves parent/component carrier alignment.

```lean
ProofNetIR.Certificate.reserveAxiomAt?_componentsParentsAligned : ∀ {certificate : ProofNetIR.Certificate} {before after : ProofNetIR.UnificationState} {linkIndex : Nat},
  certificate.reserveAxiomAt? before linkIndex = some after → after.components.size = after.parents.size
```

### `ProofNetIR.Certificate.reserveAxiomAt?_orderedParents`

Kind: theorem.

Reservation preserves the ordered union-find forest.

```lean
ProofNetIR.Certificate.reserveAxiomAt?_orderedParents : ∀ {certificate : ProofNetIR.Certificate} {before after : ProofNetIR.UnificationState} {linkIndex : Nat},
  before.OrderedParents → certificate.reserveAxiomAt? before linkIndex = some after → after.OrderedParents
```

### `ProofNetIR.Certificate.reserveAxiomAt?_abstractable`

Kind: theorem.

Reservation preserves the production abstraction contract.

```lean
ProofNetIR.Certificate.reserveAxiomAt?_abstractable : ∀ {certificate : ProofNetIR.Certificate} {before after : ProofNetIR.UnificationState} {linkIndex : Nat},
  ProofNetIR.UnificationState.Abstractable certificate before →
    before.OrderedParents →
      certificate.reserveAxiomAt? before linkIndex = some after →
        ProofNetIR.UnificationState.Abstractable certificate after
```

### `ProofNetIR.Certificate.reserveAxiomAt?_componentsFormulaConsistent`

Kind: theorem.

A formula-consistent component carrier stays consistent after reservation.

```lean
ProofNetIR.Certificate.reserveAxiomAt?_componentsFormulaConsistent : ∀ {certificate : ProofNetIR.Certificate} {before after : ProofNetIR.UnificationState} {linkIndex : Nat},
  ProofNetIR.UnificationState.ComponentsFormulaConsistent certificate before →
    certificate.reserveAxiomAt? before linkIndex = some after →
      ProofNetIR.UnificationState.ComponentsFormulaConsistent certificate after
```

### `ProofNetIR.Certificate.reserveAxiomAt?_counterAligned`

Kind: theorem.

Axiom reservations and the production token horizon advance together.

```lean
ProofNetIR.Certificate.reserveAxiomAt?_counterAligned : ∀ {certificate : ProofNetIR.Certificate} {before after : ProofNetIR.UnificationState} {linkIndex : Nat},
  before.startedAxioms = before.parents.size →
    certificate.reserveAxiomAt? before linkIndex = some after → after.startedAxioms = after.parents.size
```

### `ProofNetIR.Certificate.reserveAxiomAt?_old_representative`

Kind: theorem.

Pushing the reserved self-parent leaves every old representative
unchanged.

```lean
ProofNetIR.Certificate.reserveAxiomAt?_old_representative : ∀ {certificate : ProofNetIR.Certificate} {before after : ProofNetIR.UnificationState} {linkIndex token : Nat},
  before.OrderedParents →
    certificate.reserveAxiomAt? before linkIndex = some after → after.representative token = before.representative token
```

### `ProofNetIR.Certificate.reserveAxiomAt?_fresh_representative`

Kind: theorem.

The newly reserved token is represented by itself.

```lean
ProofNetIR.Certificate.reserveAxiomAt?_fresh_representative : ∀ {certificate : ProofNetIR.Certificate} {before after : ProofNetIR.UnificationState} {linkIndex : Nat},
  certificate.reserveAxiomAt? before linkIndex = some after →
    after.representative before.parents.size = before.parents.size
```

### `ProofNetIR.UnificationState.MarkReadyRawError`

Kind: inductive type.

Explicit failures of the production-side raw marking primitive.  As on the
independent stack, an out-of-bounds lookup is not conflated with an allocated
but already marked occurrence.

```lean
ProofNetIR.UnificationState.MarkReadyRawError : Type
```

### `ProofNetIR.UnificationState.markReadyRaw?`

Kind: definition.

Production-core update corresponding only to the common
`μ[u₁ ↦ i]` prefix of the non-`init` rules in Guerrini Figure 7.

The update writes one raw age into an explicitly unmarked occurrence.  It does
not append or union parents, mutate parsed components, advance either counter,
or invoke the eager `startMarking`/`markConclusion` operations.

```lean
ProofNetIR.UnificationState.markReadyRaw? : ProofNetIR.UnificationState →
  ProofNetIR.Vertex →
    ProofNetIR.SequentialSchedulerState.RawTokenAge →
      Except ProofNetIR.UnificationState.MarkReadyRawError ProofNetIR.UnificationState
```

### `ProofNetIR.UnificationState.MarkReadyRawStep`

Kind: inductive type.

Proof-relevant exact specification of one successful production raw-mark
update.

```lean
ProofNetIR.UnificationState.MarkReadyRawStep : ProofNetIR.UnificationState →
  ProofNetIR.UnificationState → ProofNetIR.Vertex → ProofNetIR.SequentialSchedulerState.RawTokenAge → Type
```

### `ProofNetIR.UnificationState.markReadyRaw?_ok_iff`

Kind: theorem.

Executable raw-mark success is equivalent to the exact dependent update
witness.

```lean
ProofNetIR.UnificationState.markReadyRaw?_ok_iff : ∀ {before after : ProofNetIR.UnificationState} {vertex : ProofNetIR.Vertex}
  {rawAge : ProofNetIR.SequentialSchedulerState.RawTokenAge},
  before.markReadyRaw? vertex rawAge = Except.ok after ↔ Nonempty (before.MarkReadyRawStep after vertex rawAge)
```

### `ProofNetIR.UnificationState.markReadyRaw?_markOutOfBounds_iff`

Kind: theorem.

An out-of-bounds raw-mark failure is exactly an array lookup returning
`none`; it is not the successful in-bounds unmarked lookup `some none`.

```lean
ProofNetIR.UnificationState.markReadyRaw?_markOutOfBounds_iff : ∀ {state : ProofNetIR.UnificationState} {vertex : ProofNetIR.Vertex}
  {rawAge : ProofNetIR.SequentialSchedulerState.RawTokenAge},
  state.markReadyRaw? vertex rawAge =
      Except.error (ProofNetIR.UnificationState.MarkReadyRawError.markOutOfBounds vertex) ↔
    state.marks[vertex]? = none
```

### `ProofNetIR.UnificationState.markReadyRaw?_alreadyMarked_iff`

Kind: theorem.

An already-marked failure carries the exact previous raw age.

```lean
ProofNetIR.UnificationState.markReadyRaw?_alreadyMarked_iff : ∀ {state : ProofNetIR.UnificationState} {vertex : ProofNetIR.Vertex}
  {rawAge previousRawAge : ProofNetIR.SequentialSchedulerState.RawTokenAge},
  state.markReadyRaw? vertex rawAge =
      Except.error (ProofNetIR.UnificationState.MarkReadyRawError.alreadyMarked vertex previousRawAge) ↔
    state.marks[vertex]? = some (some previousRawAge)
```

### `ProofNetIR.UnificationState.markReadyRaw?_exact`

Kind: theorem.

Exact changed and unchanged production fields of a successful raw-mark
update.

```lean
ProofNetIR.UnificationState.markReadyRaw?_exact : ∀ {before after : ProofNetIR.UnificationState} {vertex : ProofNetIR.Vertex}
  {rawAge : ProofNetIR.SequentialSchedulerState.RawTokenAge},
  before.markReadyRaw? vertex rawAge = Except.ok after →
    before.marks[vertex]? = some none ∧
      after.marks = before.marks.setIfInBounds vertex (some rawAge) ∧
        after.parents = before.parents ∧
          after.components = before.components ∧
            after.startedAxioms = before.startedAxioms ∧
              after.firedConnectives = before.firedConnectives ∧ after.marks[vertex]? = some (some rawAge)
```

### `ProofNetIR.UnificationState.markReadyRaw?_carriers`

Kind: theorem.

Raw marking changes neither the parent carrier nor the parsed-component
carrier.

```lean
ProofNetIR.UnificationState.markReadyRaw?_carriers : ∀ {before after : ProofNetIR.UnificationState} {vertex : ProofNetIR.Vertex}
  {rawAge : ProofNetIR.SequentialSchedulerState.RawTokenAge},
  before.markReadyRaw? vertex rawAge = Except.ok after →
    after.parents = before.parents ∧ after.components = before.components
```

### `ProofNetIR.UnificationState.markReadyRaw?_counters`

Kind: theorem.

Raw marking advances neither production counter.

```lean
ProofNetIR.UnificationState.markReadyRaw?_counters : ∀ {before after : ProofNetIR.UnificationState} {vertex : ProofNetIR.Vertex}
  {rawAge : ProofNetIR.SequentialSchedulerState.RawTokenAge},
  before.markReadyRaw? vertex rawAge = Except.ok after →
    after.startedAxioms = before.startedAxioms ∧ after.firedConnectives = before.firedConnectives
```

### `ProofNetIR.UnificationState.markReadyRaw?_orderedParents`

Kind: theorem.

Raw marking leaves the ordered parent forest unchanged.

```lean
ProofNetIR.UnificationState.markReadyRaw?_orderedParents : ∀ {before after : ProofNetIR.UnificationState} {vertex : ProofNetIR.Vertex}
  {rawAge : ProofNetIR.SequentialSchedulerState.RawTokenAge},
  before.OrderedParents → before.markReadyRaw? vertex rawAge = Except.ok after → after.OrderedParents
```

### `ProofNetIR.UnificationState.markReadyRaw?_abstractable`

Kind: theorem.

Raw marking preserves the executable abstraction contract when the raw age
is already allocated in the unchanged parent carrier.

```lean
ProofNetIR.UnificationState.markReadyRaw?_abstractable : ∀ {certificate : ProofNetIR.Certificate} {before after : ProofNetIR.UnificationState} {vertex : ProofNetIR.Vertex}
  {rawAge : ProofNetIR.SequentialSchedulerState.RawTokenAge},
  ProofNetIR.UnificationState.Abstractable certificate before →
    rawAge < before.parents.size →
      before.markReadyRaw? vertex rawAge = Except.ok after → ProofNetIR.UnificationState.Abstractable certificate after
```

### `ProofNetIR.UnificationState.markReadyRaw?_componentsFormulaConsistent`

Kind: theorem.

Raw marking cannot change formula consistency because the component array
is unchanged.

```lean
ProofNetIR.UnificationState.markReadyRaw?_componentsFormulaConsistent : ∀ {certificate : ProofNetIR.Certificate} {before after : ProofNetIR.UnificationState} {vertex : ProofNetIR.Vertex}
  {rawAge : ProofNetIR.SequentialSchedulerState.RawTokenAge},
  ProofNetIR.UnificationState.ComponentsFormulaConsistent certificate before →
    before.markReadyRaw? vertex rawAge = Except.ok after →
      ProofNetIR.UnificationState.ComponentsFormulaConsistent certificate after
```

### `ProofNetIR.SequentialSchedulerState.SequentialStackState.rawAgeAt?`

Kind: definition.

Raw discovery age stored at an occurrence, without representative
lookup.

```lean
ProofNetIR.SequentialSchedulerState.SequentialStackState.rawAgeAt? : ProofNetIR.SequentialSchedulerState.SequentialStackState →
  ProofNetIR.Vertex → Option ProofNetIR.SequentialSchedulerState.RawTokenAge
```

### `ProofNetIR.SequentialSchedulerBridge.ReservationState`

Kind: inductive type.

Executable state shared by the delayed scheduler reservation layer and
the production unification carrier.

The wrapper deliberately stores raw scheduler marks and production state side
by side instead of identifying raw ages with current representatives.  Search
tags are threaded independently and monotonically by `NEXTAXIOM`.

```lean
ProofNetIR.SequentialSchedulerBridge.ReservationState : Type
```

### `ProofNetIR.SequentialSchedulerBridge.ReservationState.empty`

Kind: definition.

Exact empty state before the first axiom reservation.

```lean
ProofNetIR.SequentialSchedulerBridge.ReservationState.empty : ProofNetIR.Certificate → ProofNetIR.SequentialSchedulerBridge.ReservationState
```

### `ProofNetIR.SequentialSchedulerBridge.initializeReservation?`

Kind: definition.

Search and reserve the first axiom while preserving the distinction
between search-oriented and submitted endpoint order.

```lean
ProofNetIR.SequentialSchedulerBridge.initializeReservation? : ProofNetIR.Certificate → ProofNetIR.Vertex → Option ProofNetIR.SequentialSchedulerBridge.ReservationState
```

### `ProofNetIR.SequentialSchedulerBridge.reserveNewAxiom?`

Kind: definition.

Search and reserve one later axiom.

This is a reservation-only prefix of the operational `new`: it appends the
search-oriented ready bucket, initializes the old active waiting boundary
while leaving the fresh top undefined, appends the submitted-orientation
production component, and threads the complete tag array.  It deliberately
performs no endpoint marking, waiting-list draining, unification, or
connective firing.

```lean
ProofNetIR.SequentialSchedulerBridge.reserveNewAxiom? : ProofNetIR.Certificate →
  ProofNetIR.SequentialSchedulerBridge.ReservationState →
    ProofNetIR.Vertex → Option ProofNetIR.SequentialSchedulerBridge.ReservationState
```

### `ProofNetIR.SequentialSchedulerBridge.InitialReservationStep`

Kind: inductive type.

Proof-relevant exact specification of one successful initial wrapper
call.

```lean
ProofNetIR.SequentialSchedulerBridge.InitialReservationStep : ProofNetIR.Certificate → ProofNetIR.SequentialSchedulerBridge.ReservationState → ProofNetIR.Vertex → Type
```

### `ProofNetIR.SequentialSchedulerBridge.NewReservationStep`

Kind: inductive type.

Proof-relevant exact specification of one successful later wrapper call.

```lean
ProofNetIR.SequentialSchedulerBridge.NewReservationStep : ProofNetIR.Certificate →
  ProofNetIR.SequentialSchedulerBridge.ReservationState →
    ProofNetIR.SequentialSchedulerBridge.ReservationState → ProofNetIR.Vertex → Type
```

### `ProofNetIR.SequentialSchedulerBridge.initializeReservation?_some_iff`

Kind: theorem.

Executable initial success is equivalent to an exact proof-relevant
initial reservation witness.

```lean
ProofNetIR.SequentialSchedulerBridge.initializeReservation?_some_iff : ∀ {certificate : ProofNetIR.Certificate} {after : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  {start : ProofNetIR.Vertex},
  ProofNetIR.SequentialSchedulerBridge.initializeReservation? certificate start = some after ↔
    Nonempty (ProofNetIR.SequentialSchedulerBridge.InitialReservationStep certificate after start)
```

### `ProofNetIR.SequentialSchedulerBridge.reserveNewAxiom?_some_iff`

Kind: theorem.

Executable later success is equivalent to an exact proof-relevant
reservation witness.

```lean
ProofNetIR.SequentialSchedulerBridge.reserveNewAxiom?_some_iff : ∀ {certificate : ProofNetIR.Certificate} {before after : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  {start : ProofNetIR.Vertex},
  ProofNetIR.SequentialSchedulerBridge.reserveNewAxiom? certificate before start = some after ↔
    Nonempty (ProofNetIR.SequentialSchedulerBridge.NewReservationStep certificate before after start)
```

### `ProofNetIR.SequentialSchedulerBridge.InitialReservationStep.route`

Kind: theorem.

The executable initial witness contains the exact source-left route, not
only an endpoint pair returned by an unchecked extractor.

```lean
ProofNetIR.SequentialSchedulerBridge.InitialReservationStep.route : ∀ {certificate : ProofNetIR.Certificate} {after : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  {start : ProofNetIR.Vertex}
  (step : ProofNetIR.SequentialSchedulerBridge.InitialReservationStep certificate after start),
  ProofNetIR.SequentialUnification.NextAxiomRoute start step.result step.reached step.partner
```

### `ProofNetIR.SequentialSchedulerBridge.InitialReservationStep.linkIndex_ne_next`

Kind: theorem.

Threading the initial wrapper's output tags into a later wrapper rules out
reserving the first submitted axiom-link index again.  Distinct duplicate link
slots require separate structural assumptions.

```lean
ProofNetIR.SequentialSchedulerBridge.InitialReservationStep.linkIndex_ne_next : ∀ {certificate : ProofNetIR.Certificate} {middle after : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  {firstStart secondStart : ProofNetIR.Vertex}
  (first : ProofNetIR.SequentialSchedulerBridge.InitialReservationStep certificate middle firstStart)
  (second : ProofNetIR.SequentialSchedulerBridge.NewReservationStep certificate middle after secondStart),
  first.result.linkIndex ≠ second.result.linkIndex
```

### `ProofNetIR.SequentialSchedulerBridge.NewReservationStep.route`

Kind: theorem.

Every successful later wrapper witness contains its exact source-left
route.

```lean
ProofNetIR.SequentialSchedulerBridge.NewReservationStep.route : ∀ {certificate : ProofNetIR.Certificate} {before after : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  {start : ProofNetIR.Vertex}
  (step : ProofNetIR.SequentialSchedulerBridge.NewReservationStep certificate before after start),
  ProofNetIR.SequentialUnification.NextAxiomRoute start step.result step.reached step.partner
```

### `ProofNetIR.SequentialSchedulerBridge.NewReservationStep.linkIndex_ne`

Kind: theorem.

Two composable later wrapper calls cannot reserve the same submitted
axiom-link index when the first call's complete tag output is threaded
unchanged.  Distinct duplicate link slots require separate structural
assumptions.

```lean
ProofNetIR.SequentialSchedulerBridge.NewReservationStep.linkIndex_ne : ∀ {certificate : ProofNetIR.Certificate} {before middle after : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  {firstStart secondStart : ProofNetIR.Vertex}
  (first : ProofNetIR.SequentialSchedulerBridge.NewReservationStep certificate before middle firstStart)
  (second : ProofNetIR.SequentialSchedulerBridge.NewReservationStep certificate middle after secondStart),
  first.result.linkIndex ≠ second.result.linkIndex
```

### `ProofNetIR.SequentialSchedulerBridge.RealizesSigma`

Kind: inductive type.

The narrow correspondence between delayed raw-age storage and the
production union-find carrier.

The representative equation identifies the production representative with the
executable `sigmaBoundary?` lookup value.  Interpreting that value as the left
boundary of a valid raw-age interval additionally requires the scheduler's
`SigmaAgePartition`/`WellShaped` invariant; that stronger bundle is deliberately
not part of this relation.

```lean
ProofNetIR.SequentialSchedulerBridge.RealizesSigma : ProofNetIR.SequentialSchedulerState.SequentialStackState → ProofNetIR.UnificationState → Prop
```

### `ProofNetIR.SequentialSchedulerBridge.ReservationInvariant`

Kind: inductive type.

Reservation-layer invariant currently proved for initialization and every
successful reservation-only `new` wrapper.

It combines scheduler shape, the exact initialized waiting-cell domain, the
raw-age/representative bridge, production carrier soundness, counter alignment,
and tag-domain alignment.  The waiting-domain field says which cells are
initialized, not who owns each payload or how wait/unify transfers it.  The
invariant intentionally does not assert Figure-7 liveness, payload/dependency
semantics, global queue provenance, or completeness.

```lean
ProofNetIR.SequentialSchedulerBridge.ReservationInvariant : ProofNetIR.Certificate → ProofNetIR.SequentialSchedulerBridge.ReservationState → Prop
```

### `ProofNetIR.CutFreeDerivation.connectiveCount`

Kind: definition.

Number of multiplicative connective constructors in a derivation tree.
Exchange contributes no logical connective.

```lean
ProofNetIR.CutFreeDerivation.connectiveCount : ProofNetIR.CutFreeDerivation → Nat
```

### `ProofNetIR.UnificationComponent.connectiveCount`

Kind: definition.

Number of already constructed multiplicative connectives in one live
production component.

```lean
ProofNetIR.UnificationComponent.connectiveCount : ProofNetIR.UnificationComponent → Nat
```

### `ProofNetIR.UnificationState.liveFrontierVertices`

Kind: definition.

Frontier occurrences of every live component slot, in raw component-array
order. Retired slots contribute no occurrences.

```lean
ProofNetIR.UnificationState.liveFrontierVertices : ProofNetIR.UnificationState → List ProofNetIR.Vertex
```

### `ProofNetIR.UnificationState.liveConnectiveCount`

Kind: definition.

Total number of constructed multiplicative connectives across all live
component slots.  Retired slots contribute zero.

```lean
ProofNetIR.UnificationState.liveConnectiveCount : ProofNetIR.UnificationState → Nat
```

### `ProofNetIR.SequentialSchedulerBridge.ComponentDomainExact`

Kind: definition.

Live raw component slots are exactly the current `sigma` boundaries.

The statement uses raw component-array slots rather than `componentAt?`, whose
representative lookup would make the reverse direction tautological after a
union.

```lean
ProofNetIR.SequentialSchedulerBridge.ComponentDomainExact : ProofNetIR.SequentialSchedulerBridge.ReservationState → Prop
```

### `ProofNetIR.SequentialSchedulerBridge.LiveFrontiersNodup`

Kind: definition.

No formula occurrence appears in two live production frontiers (or twice
inside one live frontier).

```lean
ProofNetIR.SequentialSchedulerBridge.LiveFrontiersNodup : ProofNetIR.SequentialSchedulerBridge.ReservationState → Prop
```

### `ProofNetIR.SequentialSchedulerBridge.ReadyBucketFrontierExact`

Kind: definition.

Every aligned ready bucket is exactly the raw-unmarked frontier of the
live component stored at its matching `sigma` boundary.

This is an extensional membership statement.  It intentionally does not
identify the deterministic list order with the set order used in the paper.

```lean
ProofNetIR.SequentialSchedulerBridge.ReadyBucketFrontierExact : ProofNetIR.SequentialSchedulerBridge.ReservationState → Prop
```

### `ProofNetIR.SequentialSchedulerBridge.QueuedVerticesNodup`

Kind: definition.

Every scheduler-queued occurrence appears exactly once across all ready
and initialized waiting payloads.

```lean
ProofNetIR.SequentialSchedulerBridge.QueuedVerticesNodup : ProofNetIR.SequentialSchedulerBridge.ReservationState → Prop
```

### `ProofNetIR.SequentialSchedulerBridge.QueuedVerticesUnmarked`

Kind: definition.

Scheduler-queued occurrences have not yet received a raw mark.

```lean
ProofNetIR.SequentialSchedulerBridge.QueuedVerticesUnmarked : ProofNetIR.SequentialSchedulerBridge.ReservationState → Prop
```

### `ProofNetIR.SequentialSchedulerBridge.Produced`

Kind: definition.

Observable production evidence in the current executable state: a raw
mark or membership in a live production-component frontier.  The second
disjunct covers constructed conclusions that remain deliberately unmarked
while queued.

This predicate does not, by itself, recover the certificate-link identity of
an internal derivation-tree node.  Exact internal occurrence provenance is a
separate obligation for the complete Figure-7 rules.

```lean
ProofNetIR.SequentialSchedulerBridge.Produced : ProofNetIR.SequentialSchedulerBridge.ReservationState → ProofNetIR.Vertex → Prop
```

### `ProofNetIR.SequentialSchedulerBridge.ProducedPremisesMarked`

Kind: definition.

Causal production discipline for submitted multiplicative links.

Whenever a submitted par or tensor conclusion has observable production
evidence, both of its submitted premises have concrete raw marks.  Combined
with the pre-prefix fact that a selected ready premise is raw-unmarked, this
supplies the contradiction needed to rule out an observably produced
conclusion before a future `forward`/`unify` firing.

This is a necessary state predicate, not a runtime scan and not yet a complete
occurrence-faithful account of internal derivation nodes.  Repeated formula
labels mean that `FormulaConsistent` alone cannot identify an internal tree
node with one exact certificate link; that provenance remains an explicit
pre-rule obligation.

```lean
ProofNetIR.SequentialSchedulerBridge.ProducedPremisesMarked : ProofNetIR.Certificate → ProofNetIR.SequentialSchedulerBridge.ReservationState → Prop
```

### `ProofNetIR.SequentialSchedulerBridge.WaitingSpanExact`

Kind: definition.

Exact semantic span carried by one delayed par conclusion.

Every waiting occurrence names its unique submitted par producer.  Its two
premises are already marked: the older raw age maps to the waiting cell's
boundary and the younger raw age maps to a strictly later boundary.  In the
combined scheduler invariant, `RealizesSigma` and premise coverage relate
those boundaries to live components; this predicate alone does not assert
frontier membership.  The disjunction retains which submitted premise is the
older one without imposing a list order on the waiting bucket.

```lean
ProofNetIR.SequentialSchedulerBridge.WaitingSpanExact : ProofNetIR.Certificate → ProofNetIR.SequentialSchedulerBridge.ReservationState → Prop
```

### `ProofNetIR.SequentialSchedulerBridge.PendingPremisesCoveredExceptReady`

Kind: definition.

Pending-premise coverage adapted to delayed conclusion marking.

A connective whose conclusion is already in a ready bucket has been
constructed even though its raw mark is deliberately still undefined. Every
other raw-unmarked connective must expose each marked premise in its live
component. Waiting conclusions are not exempt: their pars have not yet been
constructed.

```lean
ProofNetIR.SequentialSchedulerBridge.PendingPremisesCoveredExceptReady : ProofNetIR.Certificate → ProofNetIR.SequentialSchedulerBridge.ReservationState → Prop
```

### `ProofNetIR.SequentialSchedulerBridge.FiredCounterExact`

Kind: definition.

The production firing counter equals the number of logical connective
constructors actually present in live production components.

```lean
ProofNetIR.SequentialSchedulerBridge.FiredCounterExact : ProofNetIR.SequentialSchedulerBridge.ReservationState → Prop
```

### `ProofNetIR.SequentialSchedulerBridge.SchedulerInvariant`

Kind: inductive type.

Non-circular semantic invariant for the currently constructed scheduler
state.

This foundation says nothing about dispatcher progress, full-rule
reachability, token-age strategy, fallback removal, or whole-program
complexity.

```lean
ProofNetIR.SequentialSchedulerBridge.SchedulerInvariant : ProofNetIR.Certificate → ProofNetIR.SequentialSchedulerBridge.ReservationState → Prop
```

### `ProofNetIR.SequentialSchedulerBridge.empty_schedulerInvariant`

Kind: theorem.

On a structurally well-formed certificate, the exact empty state has no
produced occurrence, live component, ready work, waiting promise, or fired
connective.

```lean
ProofNetIR.SequentialSchedulerBridge.empty_schedulerInvariant : ∀ {certificate : ProofNetIR.Certificate},
  certificate.StructurallyWellFormed →
    ProofNetIR.SequentialSchedulerBridge.SchedulerInvariant certificate
      (ProofNetIR.SequentialSchedulerBridge.ReservationState.empty certificate)
```

### `ProofNetIR.SequentialSchedulerBridge.InitialReservationStep.componentDomainExact`

Kind: theorem.

A successful initial reservation establishes the exact live-component
domain.

```lean
ProofNetIR.SequentialSchedulerBridge.InitialReservationStep.componentDomainExact : ∀ {certificate : ProofNetIR.Certificate} {after : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  {start : ProofNetIR.Vertex}
  (step : ProofNetIR.SequentialSchedulerBridge.InitialReservationStep certificate after start),
  ProofNetIR.SequentialSchedulerBridge.ComponentDomainExact after
```

### `ProofNetIR.SequentialSchedulerBridge.InitialReservationStep.reached_ne_partner`

Kind: theorem.

The two search-oriented endpoints retained by a successful initial
reservation are distinct.

```lean
ProofNetIR.SequentialSchedulerBridge.InitialReservationStep.reached_ne_partner : ∀ {certificate : ProofNetIR.Certificate} {after : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  {start : ProofNetIR.Vertex}
  (step : ProofNetIR.SequentialSchedulerBridge.InitialReservationStep certificate after start),
  step.reached ≠ step.partner
```

### `ProofNetIR.SequentialSchedulerBridge.InitialReservationStep.liveFrontiersNodup`

Kind: theorem.

The sole live initial axiom frontier contains each occurrence once.

```lean
ProofNetIR.SequentialSchedulerBridge.InitialReservationStep.liveFrontiersNodup : ∀ {certificate : ProofNetIR.Certificate} {after : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  {start : ProofNetIR.Vertex}
  (step : ProofNetIR.SequentialSchedulerBridge.InitialReservationStep certificate after start),
  ProofNetIR.SequentialSchedulerBridge.LiveFrontiersNodup after
```

### `ProofNetIR.SequentialSchedulerBridge.InitialReservationStep.queuedVerticesNodup`

Kind: theorem.

The initial ready pair is globally duplicate-free; the waiting table is
still empty.

```lean
ProofNetIR.SequentialSchedulerBridge.InitialReservationStep.queuedVerticesNodup : ∀ {certificate : ProofNetIR.Certificate} {after : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  {start : ProofNetIR.Vertex}
  (step : ProofNetIR.SequentialSchedulerBridge.InitialReservationStep certificate after start),
  ProofNetIR.SequentialSchedulerBridge.QueuedVerticesNodup after
```

### `ProofNetIR.SequentialSchedulerBridge.InitialReservationStep.queuedVerticesUnmarked`

Kind: theorem.

Both search-oriented initial endpoints are raw-unmarked.

```lean
ProofNetIR.SequentialSchedulerBridge.InitialReservationStep.queuedVerticesUnmarked : ∀ {certificate : ProofNetIR.Certificate} {after : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  {start : ProofNetIR.Vertex}
  (step : ProofNetIR.SequentialSchedulerBridge.InitialReservationStep certificate after start),
  ProofNetIR.SequentialSchedulerBridge.QueuedVerticesUnmarked after
```

### `ProofNetIR.SequentialSchedulerBridge.InitialReservationStep.readyBucketFrontierExact`

Kind: theorem.

A successful initial reservation aligns its search-oriented ready pair
extensionally with the submitted-orientation axiom frontier.

```lean
ProofNetIR.SequentialSchedulerBridge.InitialReservationStep.readyBucketFrontierExact : ∀ {certificate : ProofNetIR.Certificate} {after : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  {start : ProofNetIR.Vertex}
  (step : ProofNetIR.SequentialSchedulerBridge.InitialReservationStep certificate after start),
  ProofNetIR.SequentialSchedulerBridge.ReadyBucketFrontierExact after
```

### `ProofNetIR.SequentialSchedulerBridge.InitialReservationStep.producedPremisesMarked`

Kind: theorem.

Initial production contains only the submitted axiom component.  Structural
formula ownership prevents either atomic frontier endpoint from simultaneously
being the conclusion of a submitted par or tensor, so the causal production
obligation holds before any premise has been marked.

```lean
ProofNetIR.SequentialSchedulerBridge.InitialReservationStep.producedPremisesMarked : ∀ {certificate : ProofNetIR.Certificate} {after : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  {start : ProofNetIR.Vertex},
  certificate.StructurallyWellFormed →
    ∀ (step : ProofNetIR.SequentialSchedulerBridge.InitialReservationStep certificate after start),
      ProofNetIR.SequentialSchedulerBridge.ProducedPremisesMarked certificate after
```

### `ProofNetIR.SequentialSchedulerBridge.InitialReservationStep.waitingSpanExact`

Kind: theorem.

The initial reservation has no waiting payload.

```lean
ProofNetIR.SequentialSchedulerBridge.InitialReservationStep.waitingSpanExact : ∀ {certificate : ProofNetIR.Certificate} {after : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  {start : ProofNetIR.Vertex}
  (step : ProofNetIR.SequentialSchedulerBridge.InitialReservationStep certificate after start),
  ProofNetIR.SequentialSchedulerBridge.WaitingSpanExact certificate after
```

### `ProofNetIR.SequentialSchedulerBridge.InitialReservationStep.pendingPremisesCoveredExceptReady`

Kind: theorem.

No premise is marked immediately after initial reservation, so delayed
pending-premise coverage holds independently of the certificate's later
connective structure.

```lean
ProofNetIR.SequentialSchedulerBridge.InitialReservationStep.pendingPremisesCoveredExceptReady : ∀ {certificate : ProofNetIR.Certificate} {after : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  {start : ProofNetIR.Vertex}
  (step : ProofNetIR.SequentialSchedulerBridge.InitialReservationStep certificate after start),
  ProofNetIR.SequentialSchedulerBridge.PendingPremisesCoveredExceptReady certificate after
```

### `ProofNetIR.SequentialSchedulerBridge.InitialReservationStep.firedCounterExact`

Kind: theorem.

The first reserved component is an axiom tree, so its exact live
connective count is zero.

```lean
ProofNetIR.SequentialSchedulerBridge.InitialReservationStep.firedCounterExact : ∀ {certificate : ProofNetIR.Certificate} {after : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  {start : ProofNetIR.Vertex}
  (step : ProofNetIR.SequentialSchedulerBridge.InitialReservationStep certificate after start),
  ProofNetIR.SequentialSchedulerBridge.FiredCounterExact after
```

### `ProofNetIR.SequentialSchedulerBridge.InitialReservationStep.schedulerInvariant`

Kind: theorem.

Every successful exact initial wrapper call establishes the complete
state-based scheduler foundation.

```lean
ProofNetIR.SequentialSchedulerBridge.InitialReservationStep.schedulerInvariant : ∀ {certificate : ProofNetIR.Certificate} {after : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  {start : ProofNetIR.Vertex}
  (step : ProofNetIR.SequentialSchedulerBridge.InitialReservationStep certificate after start),
  certificate.StructurallyWellFormed → ProofNetIR.SequentialSchedulerBridge.SchedulerInvariant certificate after
```

### `ProofNetIR.SequentialFigure7.PreparedStep.schedulerInvariant`

Kind: theorem.

The synchronized pop/raw-mark prefix preserves every current state-only
field of `SchedulerInvariant`.  It removes exactly the selected occurrence
from the active ready bucket and gives that already-live frontier occurrence
its active raw-age mark; components, waiting payloads, `sigma`, counters, and
tags are unchanged.

```lean
ProofNetIR.SequentialFigure7.PreparedStep.schedulerInvariant : ∀ {certificate : ProofNetIR.Certificate} {before : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  (step : ProofNetIR.SequentialFigure7.PreparedStep before),
  ProofNetIR.SequentialSchedulerBridge.SchedulerInvariant certificate before →
    ProofNetIR.SequentialSchedulerBridge.SchedulerInvariant certificate step.after
```

### `ProofNetIR.SequentialFigure7.ConclStep.schedulerInvariant`

Kind: theorem.

Exact `concl` witnesses preserve the current state-based scheduler invariant
because their output is precisely the synchronized prepared state.

```lean
ProofNetIR.SequentialFigure7.ConclStep.schedulerInvariant : ∀ {certificate : ProofNetIR.Certificate} {before after : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  (step : ProofNetIR.SequentialFigure7.ConclStep certificate before after),
  ProofNetIR.SequentialSchedulerBridge.SchedulerInvariant certificate before →
    ProofNetIR.SequentialSchedulerBridge.SchedulerInvariant certificate after
```

### `ProofNetIR.SequentialFigure7.concl?_schedulerInvariant`

Kind: theorem.

Executable `concl?` success preserves the current state-based scheduler
invariant.

```lean
ProofNetIR.SequentialFigure7.concl?_schedulerInvariant : ∀ {certificate : ProofNetIR.Certificate} {before after : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  (invariant : ProofNetIR.SequentialSchedulerBridge.SchedulerInvariant certificate before),
  ProofNetIR.SequentialFigure7.concl? certificate before ⋯ = some after →
    ProofNetIR.SequentialSchedulerBridge.SchedulerInvariant certificate after
```

### `ProofNetIR.SequentialFigure7.NopStep.schedulerInvariant`

Kind: theorem.

Exact `nop` witnesses preserve the current state-based scheduler invariant
because their output is precisely the synchronized prepared state.

```lean
ProofNetIR.SequentialFigure7.NopStep.schedulerInvariant : ∀ {certificate : ProofNetIR.Certificate} {before after : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  (step : ProofNetIR.SequentialFigure7.NopStep certificate before after),
  ProofNetIR.SequentialSchedulerBridge.SchedulerInvariant certificate before →
    ProofNetIR.SequentialSchedulerBridge.SchedulerInvariant certificate after
```

### `ProofNetIR.SequentialFigure7.nop?_schedulerInvariant`

Kind: theorem.

Executable `nop?` success preserves the current state-based scheduler
invariant.

```lean
ProofNetIR.SequentialFigure7.nop?_schedulerInvariant : ∀ {certificate : ProofNetIR.Certificate} {before after : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  (invariant : ProofNetIR.SequentialSchedulerBridge.SchedulerInvariant certificate before),
  ProofNetIR.SequentialFigure7.nop? certificate before ⋯ = some after →
    ProofNetIR.SequentialSchedulerBridge.SchedulerInvariant certificate after
```

### `ProofNetIR.SequentialSchedulerBridge.enqueueWaitingAtRawAge?`

Kind: definition.

Enqueue one conclusion at the `sigma` boundary containing a supplied raw
mate age.

The lookup is deliberately performed in the delayed raw-age partition.  It
does not call the production union-find representative and does not use the
raw age itself as a waiting-table index.  The underlying prepend fails closed
unless the resulting boundary cell is already initialized.

```lean
ProofNetIR.SequentialSchedulerBridge.enqueueWaitingAtRawAge? : ProofNetIR.SequentialSchedulerBridge.ReservationState →
  ProofNetIR.SequentialSchedulerState.RawTokenAge →
    ProofNetIR.Vertex → Option ProofNetIR.SequentialSchedulerBridge.ReservationState
```

### `ProofNetIR.SequentialSchedulerBridge.WaitDestinationStep`

Kind: inductive type.

Proof-relevant exact destination selected by one successful local waiting
enqueue.

```lean
ProofNetIR.SequentialSchedulerBridge.WaitDestinationStep : ProofNetIR.SequentialSchedulerBridge.ReservationState →
  ProofNetIR.SequentialSchedulerBridge.ReservationState →
    ProofNetIR.SequentialSchedulerState.RawTokenAge → ProofNetIR.Vertex → Type
```

### `ProofNetIR.SequentialSchedulerBridge.enqueueWaitingAtRawAge?_some_iff`

Kind: theorem.

Executable destination success is exactly the raw-boundary typed witness.

```lean
ProofNetIR.SequentialSchedulerBridge.enqueueWaitingAtRawAge?_some_iff : ∀ {before after : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  {mateRawAge : ProofNetIR.SequentialSchedulerState.RawTokenAge} {conclusion : ProofNetIR.Vertex},
  ProofNetIR.SequentialSchedulerBridge.enqueueWaitingAtRawAge? before mateRawAge conclusion = some after ↔
    Nonempty (ProofNetIR.SequentialSchedulerBridge.WaitDestinationStep before after mateRawAge conclusion)
```

### `ProofNetIR.SequentialSchedulerBridge.WaitDestinationStep.boundary_properties`

Kind: theorem.

A successful destination is a member of `sigma` and is no greater than
the mate's raw age.

```lean
ProofNetIR.SequentialSchedulerBridge.WaitDestinationStep.boundary_properties : ∀ {before after : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  {mateRawAge : ProofNetIR.SequentialSchedulerState.RawTokenAge} {conclusion : ProofNetIR.Vertex}
  (step : ProofNetIR.SequentialSchedulerBridge.WaitDestinationStep before after mateRawAge conclusion),
  step.boundary ∈ before.stack.sigma ∧ step.boundary ≤ mateRawAge
```

### `ProofNetIR.SequentialSchedulerBridge.WaitDestinationStep.exact`

Kind: theorem.

Waiting payload transfer changes no raw marks, partition, ready bucket,
production carrier, counter, or search tag.

```lean
ProofNetIR.SequentialSchedulerBridge.WaitDestinationStep.exact : ∀ {before after : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  {mateRawAge : ProofNetIR.SequentialSchedulerState.RawTokenAge} {conclusion : ProofNetIR.Vertex}
  (step : ProofNetIR.SequentialSchedulerBridge.WaitDestinationStep before after mateRawAge conclusion),
  ∃ payload,
    before.stack.waiting[step.boundary]? = some (ProofNetIR.SequentialSchedulerState.WaitingCell.initialized payload) ∧
      after.stack.waiting[step.boundary]? =
          some (ProofNetIR.SequentialSchedulerState.WaitingCell.initialized (conclusion :: payload)) ∧
        after.stack.marks = before.stack.marks ∧
          after.stack.nextAge = before.stack.nextAge ∧
            after.stack.sigma = before.stack.sigma ∧
              after.stack.ready = before.stack.ready ∧ after.core = before.core ∧ after.tags = before.tags
```

### `ProofNetIR.SequentialSchedulerBridge.WaitDestinationStep.realizesSigma`

Kind: theorem.

Waiting prepend preserves the raw-age/production bridge because marks,
the raw horizon, `sigma`, and the production core are unchanged.

```lean
ProofNetIR.SequentialSchedulerBridge.WaitDestinationStep.realizesSigma : ∀ {before after : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  {mateRawAge : ProofNetIR.SequentialSchedulerState.RawTokenAge} {conclusion : ProofNetIR.Vertex}
  (step : ProofNetIR.SequentialSchedulerBridge.WaitDestinationStep before after mateRawAge conclusion),
  ProofNetIR.SequentialSchedulerBridge.RealizesSigma before.stack before.core →
    ProofNetIR.SequentialSchedulerBridge.RealizesSigma after.stack after.core
```

### `ProofNetIR.SequentialSchedulerBridge.WaitDestinationStep.reservationInvariant`

Kind: theorem.

A typed waiting destination preserves the complete reservation invariant.
This preservation is local: it does not add a global payload-ownership claim.

```lean
ProofNetIR.SequentialSchedulerBridge.WaitDestinationStep.reservationInvariant : ∀ {certificate : ProofNetIR.Certificate} {before after : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  {mateRawAge : ProofNetIR.SequentialSchedulerState.RawTokenAge} {conclusion : ProofNetIR.Vertex}
  (step : ProofNetIR.SequentialSchedulerBridge.WaitDestinationStep before after mateRawAge conclusion),
  ProofNetIR.SequentialSchedulerBridge.ReservationInvariant certificate before →
    ProofNetIR.SequentialSchedulerBridge.ReservationInvariant certificate after
```

### `ProofNetIR.SequentialSchedulerBridge.enqueueWaitingAtRawAge?_reservationInvariant`

Kind: theorem.

Executable waiting enqueue preserves the reservation invariant.

```lean
ProofNetIR.SequentialSchedulerBridge.enqueueWaitingAtRawAge?_reservationInvariant : ∀ {certificate : ProofNetIR.Certificate} {before after : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  {mateRawAge : ProofNetIR.SequentialSchedulerState.RawTokenAge} {conclusion : ProofNetIR.Vertex},
  ProofNetIR.SequentialSchedulerBridge.ReservationInvariant certificate before →
    ProofNetIR.SequentialSchedulerBridge.enqueueWaitingAtRawAge? before mateRawAge conclusion = some after →
      ProofNetIR.SequentialSchedulerBridge.ReservationInvariant certificate after
```

### `ProofNetIR.SequentialSchedulerBridge.RealizesSigma.rawAgeAt?_eq_assignedToken?`

Kind: theorem.

A realization identifies scheduler raw-age lookup with the production
raw mark, without conflating either one with its representative.

```lean
ProofNetIR.SequentialSchedulerBridge.RealizesSigma.rawAgeAt?_eq_assignedToken? : ∀ {stack : ProofNetIR.SequentialSchedulerState.SequentialStackState} {core : ProofNetIR.UnificationState},
  ProofNetIR.SequentialSchedulerBridge.RealizesSigma stack core →
    ∀ (vertex : ProofNetIR.Vertex), stack.rawAgeAt? vertex = core.assignedToken? vertex
```

### `ProofNetIR.SequentialSchedulerBridge.initial_realizesSigma`

Kind: theorem.

The exact empty production core realizes the exact empty delayed stack.

```lean
ProofNetIR.SequentialSchedulerBridge.initial_realizesSigma : ∀ (certificate : ProofNetIR.Certificate),
  ProofNetIR.SequentialSchedulerBridge.RealizesSigma
    (ProofNetIR.SequentialSchedulerState.SequentialStackState.empty certificate.formulas.size)
    certificate.initialUnificationState
```

### `ProofNetIR.SequentialSchedulerBridge.empty_reservationInvariant`

Kind: theorem.

The exact empty wrapper state satisfies every reservation-layer
invariant, before any reservation is attempted.

```lean
ProofNetIR.SequentialSchedulerBridge.empty_reservationInvariant : ∀ (certificate : ProofNetIR.Certificate),
  ProofNetIR.SequentialSchedulerBridge.ReservationInvariant certificate
    (ProofNetIR.SequentialSchedulerBridge.ReservationState.empty certificate)
```

### `ProofNetIR.SequentialSchedulerBridge.init_reserve_carrier_realizesSigma`

Kind: theorem.

One successful delayed initial enqueue and any successful first production
reservation realize the same singleton carrier partition.

This carrier-only lemma intentionally does not relate the enqueue endpoints to
the reserved submitted link.  `init_reserve_route_exact` adds that binding.

```lean
ProofNetIR.SequentialSchedulerBridge.init_reserve_carrier_realizesSigma : ∀ {certificate : ProofNetIR.Certificate} {reached partner : ProofNetIR.Vertex}
  {stackAfter : ProofNetIR.SequentialSchedulerState.SequentialStackState} {coreAfter : ProofNetIR.UnificationState}
  {linkIndex : Nat},
  (ProofNetIR.SequentialSchedulerState.SequentialStackState.empty certificate.formulas.size).initEnqueue? reached
        partner =
      some stackAfter →
    certificate.reserveAxiomAt? certificate.initialUnificationState linkIndex = some coreAfter →
      ProofNetIR.SequentialSchedulerBridge.RealizesSigma stackAfter coreAfter
```

### `ProofNetIR.SequentialSchedulerBridge.init_reserve_route_exact`

Kind: theorem.

A single successful `NEXTAXIOM` result binds the search-oriented delayed
ready bucket and submitted-orientation production reservation to the same
exact result.

```lean
ProofNetIR.SequentialSchedulerBridge.init_reserve_route_exact : ∀ {certificate : ProofNetIR.Certificate} {fuel : Nat} {tags : Array Bool} {start reached partner : ProofNetIR.Vertex}
  {result : ProofNetIR.SequentialUnification.NextAxiomResult certificate certificate.initialUnificationState fuel tags}
  {stackAfter : ProofNetIR.SequentialSchedulerState.SequentialStackState} {coreAfter : ProofNetIR.UnificationState},
  ProofNetIR.SequentialUnification.NextAxiomRoute start result reached partner →
    (ProofNetIR.SequentialSchedulerState.SequentialStackState.empty certificate.formulas.size).initEnqueue? reached
          partner =
        some stackAfter →
      certificate.reserveAxiomAt? certificate.initialUnificationState result.linkIndex = some coreAfter →
        result.orientedEndpoints? = some (reached, partner) ∧
          ProofNetIR.SequentialSchedulerBridge.RealizesSigma stackAfter coreAfter
```

### `ProofNetIR.SequentialSchedulerBridge.init_reserve_route_fields`

Kind: theorem.

The field-level companion to `init_reserve_route_exact`.

The delayed side exposes the actual search orientation in its ready bucket,
while the production component keeps the submitted axiom orientation from the
same `NextAxiomResult.linkIndex`.  This remains a one-reservation theorem: it
does not provide replay protection or a later-state transition invariant.

```lean
ProofNetIR.SequentialSchedulerBridge.init_reserve_route_fields : ∀ {certificate : ProofNetIR.Certificate} {fuel : Nat} {tags : Array Bool} {start reached partner : ProofNetIR.Vertex}
  {result : ProofNetIR.SequentialUnification.NextAxiomResult certificate certificate.initialUnificationState fuel tags}
  {stackAfter : ProofNetIR.SequentialSchedulerState.SequentialStackState} {coreAfter : ProofNetIR.UnificationState},
  ProofNetIR.SequentialUnification.NextAxiomRoute start result reached partner →
    (ProofNetIR.SequentialSchedulerState.SequentialStackState.empty certificate.formulas.size).initEnqueue? reached
          partner =
        some stackAfter →
      certificate.reserveAxiomAt? certificate.initialUnificationState result.linkIndex = some coreAfter →
        result.orientedEndpoints? = some (reached, partner) ∧
          stackAfter.ready = [[reached, partner]] ∧
            ∃ component,
              coreAfter.components = #[some component] ∧
                component.frontier = [result.left, result.right] ∧
                  ProofNetIR.SequentialSchedulerBridge.RealizesSigma stackAfter coreAfter
```

### `ProofNetIR.SequentialSchedulerBridge.InitialReservationStep.reservationInvariant`

Kind: theorem.

A successful exact initial wrapper call establishes the complete
reservation-layer invariant.

```lean
ProofNetIR.SequentialSchedulerBridge.InitialReservationStep.reservationInvariant : ∀ {certificate : ProofNetIR.Certificate} {after : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  {start : ProofNetIR.Vertex}
  (step : ProofNetIR.SequentialSchedulerBridge.InitialReservationStep certificate after start),
  ProofNetIR.SequentialSchedulerBridge.ReservationInvariant certificate after
```

### `ProofNetIR.SequentialSchedulerBridge.new_reserve_carrier_realizesSigma`

Kind: theorem.

Appending one delayed raw-age reservation and one production component
reservation preserves the exact `sigma`/union-find correspondence.

This theorem is intentionally carrier-local.  It requires the old
`WellShaped` partition and ordered parent forest, but it does not claim that
the selected endpoints are scheduler-live or that an arbitrary production
merge preserves `RealizesSigma`.

```lean
ProofNetIR.SequentialSchedulerBridge.new_reserve_carrier_realizesSigma : ∀ {certificate : ProofNetIR.Certificate}
  {stackBefore stackAfter : ProofNetIR.SequentialSchedulerState.SequentialStackState}
  {coreBefore coreAfter : ProofNetIR.UnificationState} {reached partner : ProofNetIR.Vertex} {linkIndex : Nat},
  stackBefore.WellShaped certificate.formulas.size →
    ProofNetIR.SequentialSchedulerBridge.RealizesSigma stackBefore coreBefore →
      coreBefore.OrderedParents →
        stackBefore.operationalNewEnqueue? reached partner = some stackAfter →
          certificate.reserveAxiomAt? coreBefore linkIndex = some coreAfter →
            ProofNetIR.SequentialSchedulerBridge.RealizesSigma stackAfter coreAfter
```

### `ProofNetIR.SequentialSchedulerBridge.new_reserve_route_exact`

Kind: theorem.

The later-state companion of `init_reserve_route_exact`: one exact
`NEXTAXIOM` result controls both the search-oriented appended ready bucket and
the submitted-orientation production reservation.

```lean
ProofNetIR.SequentialSchedulerBridge.new_reserve_route_exact : ∀ {certificate : ProofNetIR.Certificate}
  {stackBefore stackAfter : ProofNetIR.SequentialSchedulerState.SequentialStackState}
  {coreBefore coreAfter : ProofNetIR.UnificationState} {fuel : Nat} {tags : Array Bool}
  {start reached partner : ProofNetIR.Vertex}
  {result : ProofNetIR.SequentialUnification.NextAxiomResult certificate coreBefore fuel tags},
  stackBefore.WellShaped certificate.formulas.size →
    ProofNetIR.SequentialSchedulerBridge.RealizesSigma stackBefore coreBefore →
      coreBefore.OrderedParents →
        ProofNetIR.SequentialUnification.NextAxiomRoute start result reached partner →
          stackBefore.operationalNewEnqueue? reached partner = some stackAfter →
            certificate.reserveAxiomAt? coreBefore result.linkIndex = some coreAfter →
              result.orientedEndpoints? = some (reached, partner) ∧
                ProofNetIR.SequentialSchedulerBridge.RealizesSigma stackAfter coreAfter
```

### `ProofNetIR.SequentialSchedulerBridge.new_reserve_route_fields`

Kind: theorem.

Field-level later reservation theorem.  The newly appended ready bucket
uses the search orientation while the newly appended production component
uses the same result's submitted orientation.

```lean
ProofNetIR.SequentialSchedulerBridge.new_reserve_route_fields : ∀ {certificate : ProofNetIR.Certificate}
  {stackBefore stackAfter : ProofNetIR.SequentialSchedulerState.SequentialStackState}
  {coreBefore coreAfter : ProofNetIR.UnificationState} {fuel : Nat} {tags : Array Bool}
  {start reached partner : ProofNetIR.Vertex}
  {result : ProofNetIR.SequentialUnification.NextAxiomResult certificate coreBefore fuel tags},
  stackBefore.WellShaped certificate.formulas.size →
    ProofNetIR.SequentialSchedulerBridge.RealizesSigma stackBefore coreBefore →
      coreBefore.OrderedParents →
        ProofNetIR.SequentialUnification.NextAxiomRoute start result reached partner →
          stackBefore.operationalNewEnqueue? reached partner = some stackAfter →
            certificate.reserveAxiomAt? coreBefore result.linkIndex = some coreAfter →
              result.orientedEndpoints? = some (reached, partner) ∧
                stackAfter.ready = stackBefore.ready ++ [[reached, partner]] ∧
                  ∃ component,
                    coreAfter.components = coreBefore.components.push (some component) ∧
                      component.frontier = [result.left, result.right] ∧
                        ProofNetIR.SequentialSchedulerBridge.RealizesSigma stackAfter coreAfter
```

### `ProofNetIR.SequentialSchedulerBridge.NewReservationStep.reservationInvariant`

Kind: theorem.

Every successful later wrapper call preserves the complete
reservation-layer invariant.

```lean
ProofNetIR.SequentialSchedulerBridge.NewReservationStep.reservationInvariant : ∀ {certificate : ProofNetIR.Certificate} {before after : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  {start : ProofNetIR.Vertex},
  ProofNetIR.SequentialSchedulerBridge.ReservationInvariant certificate before →
    ∀ (step : ProofNetIR.SequentialSchedulerBridge.NewReservationStep certificate before after start),
      ProofNetIR.SequentialSchedulerBridge.ReservationInvariant certificate after
```

### `ProofNetIR.SequentialSchedulerBridge.popReadyMark_markReadyRaw_realizesSigma`

Kind: theorem.

Synchronizing the independent pop-before-mark update with the production
raw-mark update preserves the exact raw-age/union-find bridge.

Both primitives write the same selected vertex with the same old top raw age.
Neither changes `sigma` or the parent carrier, so the representative equation
is inherited unchanged.

```lean
ProofNetIR.SequentialSchedulerBridge.popReadyMark_markReadyRaw_realizesSigma : ∀ {stackBefore : ProofNetIR.SequentialSchedulerState.SequentialStackState}
  {stackResult : ProofNetIR.SequentialSchedulerState.SequentialStackState.PopReadyMarkResult}
  {coreBefore coreAfter : ProofNetIR.UnificationState},
  ProofNetIR.SequentialSchedulerBridge.RealizesSigma stackBefore coreBefore →
    stackBefore.popReadyMark? = Except.ok stackResult →
      coreBefore.markReadyRaw? stackResult.vertex stackResult.rawAge = Except.ok coreAfter →
        ProofNetIR.SequentialSchedulerBridge.RealizesSigma stackResult.after coreAfter
```

### `ProofNetIR.SequentialSchedulerBridge.popReadyMark_markReadyRaw_reservationInvariant`

Kind: theorem.

The synchronized common prefix of every non-`init` Figure-7 rule preserves
the complete reservation-layer invariant.

This theorem still does not choose among `concl`/`nop`/`wait`/`forward`/`new`/
`unify`.  It only pops and marks the selected `u₁`, leaving tags unchanged.
The allocated-age side condition needed by the production abstraction follows
from the old top `sigma` membership and `RealizesSigma.horizon_eq`.

```lean
ProofNetIR.SequentialSchedulerBridge.popReadyMark_markReadyRaw_reservationInvariant : ∀ {certificate : ProofNetIR.Certificate} {before : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  {stackResult : ProofNetIR.SequentialSchedulerState.SequentialStackState.PopReadyMarkResult}
  {coreAfter : ProofNetIR.UnificationState},
  ProofNetIR.SequentialSchedulerBridge.ReservationInvariant certificate before →
    before.stack.popReadyMark? = Except.ok stackResult →
      before.core.markReadyRaw? stackResult.vertex stackResult.rawAge = Except.ok coreAfter →
        ProofNetIR.SequentialSchedulerBridge.ReservationInvariant certificate
          { stack := stackResult.after, core := coreAfter, tags := before.tags }
```

## Executable Figure-7 new transition

### `ProofNetIR.SequentialUnification.nextAxiomWithFuel?_startReady`

Kind: theorem.

A successful bounded `NEXTAXIOM` call passed its first dynamic guard: the
starting occurrence was in bounds and unmarked in the exact input production
state.

```lean
ProofNetIR.SequentialUnification.nextAxiomWithFuel?_startReady : ∀ {certificate : ProofNetIR.Certificate} {state : ProofNetIR.UnificationState}
  {index : ProofNetIR.SequentialUnification.SourceIndex} {fuel : Nat} {tags : Array Bool}
  {indexSound : ProofNetIR.SequentialUnification.SourceIndex.Sound certificate index} {start : ProofNetIR.Vertex}
  {result : ProofNetIR.SequentialUnification.NextAxiomResult certificate state fuel tags},
  ProofNetIR.SequentialUnification.nextAxiomWithFuel? certificate state index ⋯ fuel tags start = some result →
    state.marks[start]? = some none
```

### `ProofNetIR.SequentialUnification.nextAxiom?_startReady`

Kind: theorem.

Production-wrapper form of `nextAxiomWithFuel?_startReady`.

```lean
ProofNetIR.SequentialUnification.nextAxiom?_startReady : ∀ {certificate : ProofNetIR.Certificate} {state : ProofNetIR.UnificationState}
  {index : ProofNetIR.SequentialUnification.SourceIndex} {tags : Array Bool}
  {indexSound : ProofNetIR.SequentialUnification.SourceIndex.Sound certificate index} {start : ProofNetIR.Vertex}
  {result : ProofNetIR.SequentialUnification.NextAxiomResult certificate state certificate.formulas.size tags},
  ProofNetIR.SequentialUnification.nextAxiom? certificate state index ⋯ tags start = some result →
    state.marks[start]? = some none
```

### `ProofNetIR.SequentialFigure7.new?`

Kind: definition.

Execute the deterministic-head operational interpretation of Figure-7
`new`.

The input proof binds the executable pipeline to the synchronized
reservation-layer state: in particular the stack horizon/raw ages and the
production parent carrier cannot be forged independently.  The consumer
lookup is fixed to the certificate's sound-and-complete public
`consumerIndex`; callers cannot substitute a partial or forged table.  The
source index used by `NEXTAXIOM` remains its distinct producer/axiom-incidence
index.  Every query fails closed; no eager marking operation, waiting-list
drain, connective firing, or union is hidden in this transition.

Success is therefore the exact local operational rule over the currently
proved reservation layer.  The 1999 printed fresh-cell assignment is retained
separately by `newEnqueue?`; this transition instead initializes the old active
boundary and leaves the fresh top undefined.  It is not by itself a
reachability, progress, or no-repeated-axiom theorem.

```lean
ProofNetIR.SequentialFigure7.new? : (certificate : ProofNetIR.Certificate) →
  (before : ProofNetIR.SequentialSchedulerBridge.ReservationState) →
    ProofNetIR.SequentialSchedulerBridge.ReservationInvariant certificate before →
      Option ProofNetIR.SequentialSchedulerBridge.ReservationState
```

### `ProofNetIR.SequentialFigure7.NewStep`

Kind: inductive type.

Proof-relevant exact specification of one successful deterministic
Figure-7 `new` transition.

The type of `search` mentions `coreMarked`, so the witness records the
mathematically material ordering: `u₁` is raw-marked before `NEXTAXIOM(u₂)` is
evaluated.  `before_invariant` prevents independent stack/core/raw-age
forgeries, while the stronger full-rule reachable-scheduler invariant remains
future work.

```lean
ProofNetIR.SequentialFigure7.NewStep : ProofNetIR.Certificate →
  ProofNetIR.SequentialSchedulerBridge.ReservationState → ProofNetIR.SequentialSchedulerBridge.ReservationState → Type
```

### `ProofNetIR.SequentialFigure7.new?_some_iff`

Kind: theorem.

Executable success is equivalent to the exact dependent Figure-7 `new`
witness.

```lean
ProofNetIR.SequentialFigure7.new?_some_iff : ∀ {certificate : ProofNetIR.Certificate} {before after : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  (invariant : ProofNetIR.SequentialSchedulerBridge.ReservationInvariant certificate before),
  ProofNetIR.SequentialFigure7.new? certificate before invariant = some after ↔
    Nonempty (ProofNetIR.SequentialFigure7.NewStep certificate before after)
```

### `ProofNetIR.SequentialFigure7.NewStep.tensorValid`

Kind: theorem.

The exact tensor below the selected occurrence, including its stored
orientation and opposite premise.

```lean
ProofNetIR.SequentialFigure7.NewStep.tensorValid : ∀ {certificate : ProofNetIR.Certificate} {before after : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  (step : ProofNetIR.SequentialFigure7.NewStep certificate before after),
  ProofNetIR.TensorBelow.Valid certificate certificate.consumerIndex step.stackResult.vertex step.tensor
```

### `ProofNetIR.SequentialFigure7.NewStep.mate_unmarked`

Kind: theorem.

Figure 7's dynamic side condition `μ(u₂) = ⊥` holds in the state after
marking `u₁` and before searching from `u₂`.

```lean
ProofNetIR.SequentialFigure7.NewStep.mate_unmarked : ∀ {certificate : ProofNetIR.Certificate} {before after : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  (step : ProofNetIR.SequentialFigure7.NewStep certificate before after),
  step.coreMarked.marks[step.tensor.mate]? = some none
```

### `ProofNetIR.SequentialFigure7.NewStep.route`

Kind: theorem.

The successful search records the exact source-left route from the
opposite tensor premise to the reached endpoint of the newly reserved axiom.

```lean
ProofNetIR.SequentialFigure7.NewStep.route : ∀ {certificate : ProofNetIR.Certificate} {before after : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  (step : ProofNetIR.SequentialFigure7.NewStep certificate before after),
  ProofNetIR.SequentialUnification.NextAxiomRoute step.tensor.mate step.search step.reached step.partner
```

### `ProofNetIR.SequentialFigure7.NewStep.markedMiddle`

Kind: definition.

The common pop/raw-mark prefix packaged as the exact bridge state expected
by the existing later-reservation theorem.

```lean
ProofNetIR.SequentialFigure7.NewStep.markedMiddle : {certificate : ProofNetIR.Certificate} →
  {before after : ProofNetIR.SequentialSchedulerBridge.ReservationState} →
    ProofNetIR.SequentialFigure7.NewStep certificate before after →
      ProofNetIR.SequentialSchedulerBridge.ReservationState
```

### `ProofNetIR.SequentialFigure7.NewStep.reservationStep`

Kind: definition.

One full `new` witness contains an exact later reservation step from its
already-marked middle state.

```lean
ProofNetIR.SequentialFigure7.NewStep.reservationStep : {certificate : ProofNetIR.Certificate} →
  {before after : ProofNetIR.SequentialSchedulerBridge.ReservationState} →
    (step : ProofNetIR.SequentialFigure7.NewStep certificate before after) →
      ProofNetIR.SequentialSchedulerBridge.NewReservationStep certificate step.markedMiddle after step.tensor.mate
```

### `ProofNetIR.SequentialFigure7.NewStep.markedMiddle_reservationInvariant`

Kind: theorem.

The synchronized pop/raw-mark prefix preserves the reservation-layer
invariant.

```lean
ProofNetIR.SequentialFigure7.NewStep.markedMiddle_reservationInvariant : ∀ {certificate : ProofNetIR.Certificate} {before after : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  (step : ProofNetIR.SequentialFigure7.NewStep certificate before after),
  ProofNetIR.SequentialSchedulerBridge.ReservationInvariant certificate step.markedMiddle
```

### `ProofNetIR.SequentialFigure7.NewStep.reservationInvariant`

Kind: theorem.

Every successful deterministic Figure-7 `new` transition preserves the
complete invariant currently established for the reservation layer.

This is preservation, not progress: it assumes the executable transition
succeeds and does not yet prove that a correct reachable state must select
`new` or that `NEXTAXIOM` is total there.

```lean
ProofNetIR.SequentialFigure7.NewStep.reservationInvariant : ∀ {certificate : ProofNetIR.Certificate} {before after : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  (step : ProofNetIR.SequentialFigure7.NewStep certificate before after),
  ProofNetIR.SequentialSchedulerBridge.ReservationInvariant certificate after
```

### `ProofNetIR.SequentialFigure7.new?_reservationInvariant`

Kind: theorem.

Success of the executable composed local `new` transition preserves the
current reservation invariant.

```lean
ProofNetIR.SequentialFigure7.new?_reservationInvariant : ∀ {certificate : ProofNetIR.Certificate} {before after : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  (invariant : ProofNetIR.SequentialSchedulerBridge.ReservationInvariant certificate before),
  ProofNetIR.SequentialFigure7.new? certificate before invariant = some after →
    ProofNetIR.SequentialSchedulerBridge.ReservationInvariant certificate after
```

## Executed init/new history

### `ProofNetIR.SequentialFigure7.TagsExtend`

Kind: definition.

Pointwise monotonicity of boolean tag carriers.

```lean
ProofNetIR.SequentialFigure7.TagsExtend : Array Bool → Array Bool → Prop
```

### `ProofNetIR.SequentialFigure7.TagsExtend.refl`

Kind: theorem.

Every tag carrier pointwise extends itself.

```lean
ProofNetIR.SequentialFigure7.TagsExtend.refl : ∀ (tags : Array Bool), ProofNetIR.SequentialFigure7.TagsExtend tags tags
```

### `ProofNetIR.SequentialFigure7.TagsExtend.trans`

Kind: theorem.

Pointwise tag extension composes transitively.

```lean
ProofNetIR.SequentialFigure7.TagsExtend.trans : ∀ {first second third : Array Bool},
  ProofNetIR.SequentialFigure7.TagsExtend first second →
    ProofNetIR.SequentialFigure7.TagsExtend second third → ProofNetIR.SequentialFigure7.TagsExtend first third
```

### `ProofNetIR.SequentialFigure7.initial_output_tags_eq`

Kind: theorem.

Exact output tag projection of an initialization witness.

```lean
ProofNetIR.SequentialFigure7.initial_output_tags_eq : ∀ {certificate : ProofNetIR.Certificate} {after : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  {start : ProofNetIR.Vertex}
  (step : ProofNetIR.SequentialSchedulerBridge.InitialReservationStep certificate after start),
  after.tags = step.result.tags
```

### `ProofNetIR.SequentialFigure7.initial_tagsExtend`

Kind: theorem.

Initialization preserves every pre-existing true tag.  Its concrete input
is all false, but the theorem is useful as the uniform first history step.

```lean
ProofNetIR.SequentialFigure7.initial_tagsExtend : ∀ {certificate : ProofNetIR.Certificate} {after : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  {start : ProofNetIR.Vertex}
  (step : ProofNetIR.SequentialSchedulerBridge.InitialReservationStep certificate after start),
  ProofNetIR.SequentialFigure7.TagsExtend (ProofNetIR.SequentialSchedulerBridge.ReservationState.empty certificate).tags
    after.tags
```

### `ProofNetIR.SequentialFigure7.NewStep.output_tags_eq`

Kind: theorem.

Exact output tag projection of a complete operational `new` witness.

```lean
ProofNetIR.SequentialFigure7.NewStep.output_tags_eq : ∀ {certificate : ProofNetIR.Certificate} {before after : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  (step : ProofNetIR.SequentialFigure7.NewStep certificate before after), after.tags = step.search.tags
```

### `ProofNetIR.SequentialFigure7.NewStep.tagsExtend`

Kind: theorem.

A complete operational `new` only adds true tags.

```lean
ProofNetIR.SequentialFigure7.NewStep.tagsExtend : ∀ {certificate : ProofNetIR.Certificate} {before after : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  (step : ProofNetIR.SequentialFigure7.NewStep certificate before after),
  ProofNetIR.SequentialFigure7.TagsExtend before.tags after.tags
```

### `ProofNetIR.SequentialFigure7.InitNewHistory`

Kind: inductive type.

Proof-relevant history of exactly the implemented init/new reservation
fragment.

`empty` is the zero-event run.  `init` is intrinsically tied to the exact
empty production state by `InitialReservationStep`.  Every `later` constructor
stores a complete operational `new`, not the reservation-only helper.  This
type is intentionally not a generic Figure-7 rule history. The implemented
non-reserving `concl` and `nop` rules need separate rule-step accounting. The
local `wait` transition now exists outside this history and still needs
accounting here; `forward` and `unify` still need both transitions and
accounting.

```lean
ProofNetIR.SequentialFigure7.InitNewHistory : ProofNetIR.Certificate → ProofNetIR.SequentialSchedulerBridge.ReservationState → Type
```

### `ProofNetIR.SequentialFigure7.ReachableByImplementedInitNew`

Kind: definition.

Honest reachability for exactly the implemented init/new fragment.

```lean
ProofNetIR.SequentialFigure7.ReachableByImplementedInitNew : ProofNetIR.Certificate → ProofNetIR.SequentialSchedulerBridge.ReservationState → Prop
```

### `ProofNetIR.SequentialFigure7.InitNewHistory.Touched`

Kind: definition.

Vertices touched by any exact `NEXTAXIOM` search in the history.

```lean
ProofNetIR.SequentialFigure7.InitNewHistory.Touched : {certificate : ProofNetIR.Certificate} →
  {state : ProofNetIR.SequentialSchedulerBridge.ReservationState} →
    ProofNetIR.SequentialFigure7.InitNewHistory certificate state → ProofNetIR.Vertex → Prop
```

### `ProofNetIR.SequentialFigure7.InitNewHistory.linkIndices`

Kind: definition.

Submitted axiom-link slots, newest first.

```lean
ProofNetIR.SequentialFigure7.InitNewHistory.linkIndices : {certificate : ProofNetIR.Certificate} →
  {state : ProofNetIR.SequentialSchedulerBridge.ReservationState} →
    ProofNetIR.SequentialFigure7.InitNewHistory certificate state → List Nat
```

### `ProofNetIR.SequentialFigure7.InitNewHistory.length`

Kind: definition.

Number of exact axiom-search/reservation events.

```lean
ProofNetIR.SequentialFigure7.InitNewHistory.length : {certificate : ProofNetIR.Certificate} →
  {state : ProofNetIR.SequentialSchedulerBridge.ReservationState} →
    ProofNetIR.SequentialFigure7.InitNewHistory certificate state → Nat
```

### `ProofNetIR.SequentialFigure7.InitNewHistory.reservationInvariant`

Kind: theorem.

Every state named by an executed history satisfies the current
reservation-layer invariant.  This is a consequence of execution, not the
definition of reachability.

```lean
ProofNetIR.SequentialFigure7.InitNewHistory.reservationInvariant : ∀ {certificate : ProofNetIR.Certificate} {state : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  (history : ProofNetIR.SequentialFigure7.InitNewHistory certificate state),
  ProofNetIR.SequentialSchedulerBridge.ReservationInvariant certificate state
```

### `ProofNetIR.SequentialFigure7.InitNewHistory.tagged_iff_touched`

Kind: theorem.

Exact tag provenance for the implemented history: a current true tag
exists exactly when some recorded search touched that vertex.

```lean
ProofNetIR.SequentialFigure7.InitNewHistory.tagged_iff_touched : ∀ {certificate : ProofNetIR.Certificate} {state : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  (history : ProofNetIR.SequentialFigure7.InitNewHistory certificate state) {vertex : ProofNetIR.Vertex},
  state.tags[vertex]? = some true ↔ history.Touched vertex
```

### `ProofNetIR.SequentialFigure7.InitNewHistory.touched_disjoint_next`

Kind: theorem.

Every earlier touched vertex is unavailable to the next exact search.

```lean
ProofNetIR.SequentialFigure7.InitNewHistory.touched_disjoint_next : ∀ {certificate : ProofNetIR.Certificate} {before after : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  (history : ProofNetIR.SequentialFigure7.InitNewHistory certificate before)
  (step : ProofNetIR.SequentialFigure7.NewStep certificate before after) {vertex : ProofNetIR.Vertex},
  history.Touched vertex → step.search.Touched vertex → False
```

### `ProofNetIR.SequentialFigure7.InitNewHistory.mem_linkIndices_witness`

Kind: theorem.

Membership in the history's submitted-slot list carries an exact axiom
lookup and a touched endpoint witness.

```lean
ProofNetIR.SequentialFigure7.InitNewHistory.mem_linkIndices_witness : ∀ {certificate : ProofNetIR.Certificate} {state : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  (history : ProofNetIR.SequentialFigure7.InitNewHistory certificate state) {index : Nat},
  index ∈ history.linkIndices →
    ∃ left right, certificate.links[index]? = some (ProofNetIR.Link.axiom left right) ∧ history.Touched left
```

### `ProofNetIR.SequentialFigure7.InitNewHistory.linkIndices_nodup`

Kind: theorem.

No submitted axiom-link slot occurs twice anywhere in a genuine
implemented history.  This strengthens the adjacent replay theorem to the
whole recorded execution and still deliberately distinguishes duplicate link
slots with equal values.

```lean
ProofNetIR.SequentialFigure7.InitNewHistory.linkIndices_nodup : ∀ {certificate : ProofNetIR.Certificate} {state : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  (history : ProofNetIR.SequentialFigure7.InitNewHistory certificate state), history.linkIndices.Nodup
```

### `ProofNetIR.SequentialFigure7.InitNewHistory.length_eq_nextAge`

Kind: theorem.

Event count agrees with the raw-age allocation horizon.

```lean
ProofNetIR.SequentialFigure7.InitNewHistory.length_eq_nextAge : ∀ {certificate : ProofNetIR.Certificate} {state : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  (history : ProofNetIR.SequentialFigure7.InitNewHistory certificate state), history.length = state.stack.nextAge
```

### `ProofNetIR.SequentialFigure7.InitNewHistory.length_eq_startedAxioms`

Kind: theorem.

The same event count agrees with the production axiom counter.

```lean
ProofNetIR.SequentialFigure7.InitNewHistory.length_eq_startedAxioms : ∀ {certificate : ProofNetIR.Certificate} {state : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  (history : ProofNetIR.SequentialFigure7.InitNewHistory certificate state), history.length = state.core.startedAxioms
```

### `ProofNetIR.SequentialFigure7.reachable_empty`

Kind: theorem.

The exact empty state is reachable by the zero-event history.

```lean
ProofNetIR.SequentialFigure7.reachable_empty : ∀ (certificate : ProofNetIR.Certificate),
  ProofNetIR.SequentialFigure7.ReachableByImplementedInitNew certificate
    (ProofNetIR.SequentialSchedulerBridge.ReservationState.empty certificate)
```

### `ProofNetIR.SequentialFigure7.reachable_of_initializeReservation?_eq_some`

Kind: theorem.

Every successful executable initialization creates an exact history.

```lean
ProofNetIR.SequentialFigure7.reachable_of_initializeReservation?_eq_some : ∀ {certificate : ProofNetIR.Certificate} {after : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  {start : ProofNetIR.Vertex},
  ProofNetIR.SequentialSchedulerBridge.initializeReservation? certificate start = some after →
    ProofNetIR.SequentialFigure7.ReachableByImplementedInitNew certificate after
```

### `ProofNetIR.SequentialFigure7.ReachableByImplementedInitNew.new`

Kind: theorem.

Extending an executed history by a successful complete operational `new`
creates another executed history.

```lean
ProofNetIR.SequentialFigure7.ReachableByImplementedInitNew.new : ∀ {certificate : ProofNetIR.Certificate} {before after : ProofNetIR.SequentialSchedulerBridge.ReservationState},
  ProofNetIR.SequentialFigure7.ReachableByImplementedInitNew certificate before →
    ∀ (invariant : ProofNetIR.SequentialSchedulerBridge.ReservationInvariant certificate before),
      ProofNetIR.SequentialFigure7.new? certificate before invariant = some after →
        ProofNetIR.SequentialFigure7.ReachableByImplementedInitNew certificate after
```

## Executable Figure-7 concl, nop, and wait rules

### `ProofNetIR.SequentialConnectiveKind`

Kind: inductive type.

The submitted binary connective constructor retained by a generic
consumer-below view.

```lean
ProofNetIR.SequentialConnectiveKind : Type
```

### `ProofNetIR.SequentialConnectiveKind.asLink`

Kind: definition.

Reconstruct the exact submitted link represented by a generic view.

```lean
ProofNetIR.SequentialConnectiveKind.asLink : ProofNetIR.SequentialConnectiveKind → ProofNetIR.Vertex → ProofNetIR.Vertex → ProofNetIR.Vertex → ProofNetIR.Link
```

### `ProofNetIR.ConnectiveBelow`

Kind: inductive type.

Proof-carrying exact view of the unique submitted connective consuming one
formula occurrence.

The result retains the submitted link index, constructor, stored orientation,
local well-formedness, and the exact queried premise.  Because the canonical
consumer index is fixed in the type, callers cannot supply a partial table
that hides a competing consumer.

```lean
ProofNetIR.ConnectiveBelow : ProofNetIR.Certificate → ProofNetIR.Vertex → Type
```

### `ProofNetIR.ConnectiveBelow.premise`

Kind: definition.

Stored premise addressed by the generic connective view.

```lean
ProofNetIR.ConnectiveBelow.premise : {certificate : ProofNetIR.Certificate} →
  {vertex : ProofNetIR.Vertex} → ProofNetIR.ConnectiveBelow certificate vertex → ProofNetIR.Vertex
```

### `ProofNetIR.ConnectiveBelow.mate`

Kind: definition.

Opposite premise addressed by the generic connective view.

```lean
ProofNetIR.ConnectiveBelow.mate : {certificate : ProofNetIR.Certificate} →
  {vertex : ProofNetIR.Vertex} → ProofNetIR.ConnectiveBelow certificate vertex → ProofNetIR.Vertex
```

### `ProofNetIR.ConnectiveBelow.submittedLink`

Kind: definition.

Exact submitted link retained by the view.

```lean
ProofNetIR.ConnectiveBelow.submittedLink : {certificate : ProofNetIR.Certificate} →
  {vertex : ProofNetIR.Vertex} → ProofNetIR.ConnectiveBelow certificate vertex → ProofNetIR.Link
```

### `ProofNetIR.ConnectiveBelow.mate_ne`

Kind: theorem.

A successful generic connective view never returns its queried premise as
its mate.

```lean
ProofNetIR.ConnectiveBelow.mate_ne : ∀ {certificate : ProofNetIR.Certificate} {vertex : ProofNetIR.Vertex}
  (result : ProofNetIR.ConnectiveBelow certificate vertex), result.mate ≠ vertex
```

### `ProofNetIR.Certificate.connectiveBelow?`

Kind: definition.

Canonical generic connective-below lookup.

An empty bucket, a non-singleton bucket, an axiom slot, a malformed submitted
link, or a vertex that is not the retained stored premise all fail closed.

```lean
ProofNetIR.Certificate.connectiveBelow? : (certificate : ProofNetIR.Certificate) →
  (vertex : ProofNetIR.Vertex) → Option (ProofNetIR.ConnectiveBelow certificate vertex)
```

### `ProofNetIR.ConclusionBelow`

Kind: inductive type.

Proof-carrying locally ownership-well-formed conclusion view.

Besides declared boundary membership, this view requires the certificate's
local node-ownership condition: the occurrence is in bounds, has exactly one
source incidence/producer of the appropriate shape, and has no parent use.
The empty canonical-consumer-bucket equation is also stored directly.  In
particular,
`uniqueConsumer? = none` is not accepted as a substitute, because that query
also returns `none` for a malformed bucket containing distinct candidates.

```lean
ProofNetIR.ConclusionBelow : ProofNetIR.Certificate → ProofNetIR.Vertex → Type
```

### `ProofNetIR.ConclusionBelow.not_connective`

Kind: theorem.

A locally well-formed conclusion view and an exact connective-consumer
view cannot describe the same occurrence.

```lean
ProofNetIR.ConclusionBelow.not_connective : ∀ {certificate : ProofNetIR.Certificate} {vertex : ProofNetIR.Vertex}
  (boundary : ProofNetIR.ConclusionBelow certificate vertex) (consumer : ProofNetIR.ConnectiveBelow certificate vertex),
  False
```

### `ProofNetIR.Certificate.conclusionBelow?`

Kind: definition.

Canonical locally well-formed conclusion query with an exact empty
consumer bucket.

```lean
ProofNetIR.Certificate.conclusionBelow? : (certificate : ProofNetIR.Certificate) →
  (vertex : ProofNetIR.Vertex) → Option (ProofNetIR.ConclusionBelow certificate vertex)
```

### `ProofNetIR.SequentialFigure7.PreparedStep`

Kind: inductive type.

Proof-carrying synchronized common prefix of every non-`init` Figure-7
rule.

```lean
ProofNetIR.SequentialFigure7.PreparedStep : ProofNetIR.SequentialSchedulerBridge.ReservationState → Type
```

### `ProofNetIR.SequentialFigure7.PreparedStep.after`

Kind: definition.

Exact state after the common pop/raw-mark prefix.

```lean
ProofNetIR.SequentialFigure7.PreparedStep.after : {before : ProofNetIR.SequentialSchedulerBridge.ReservationState} →
  ProofNetIR.SequentialFigure7.PreparedStep before → ProofNetIR.SequentialSchedulerBridge.ReservationState
```

### `ProofNetIR.SequentialFigure7.PreparedStep.reservationInvariant`

Kind: theorem.

The common prefix preserves the current reservation invariant.

```lean
ProofNetIR.SequentialFigure7.PreparedStep.reservationInvariant : ∀ {certificate : ProofNetIR.Certificate} {before : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  (step : ProofNetIR.SequentialFigure7.PreparedStep before),
  ProofNetIR.SequentialSchedulerBridge.ReservationInvariant certificate before →
    ProofNetIR.SequentialSchedulerBridge.ReservationInvariant certificate step.after
```

### `ProofNetIR.SequentialFigure7.prepare?`

Kind: definition.

Execute the common pop/raw-mark prefix without selecting a later rule.

```lean
ProofNetIR.SequentialFigure7.prepare? : (before : ProofNetIR.SequentialSchedulerBridge.ReservationState) →
  Option (ProofNetIR.SequentialFigure7.PreparedStep before)
```

### `ProofNetIR.SequentialFigure7.RulePrefixAt`

Kind: definition.

Independent proposition-level meaning of the synchronized common prefix
at one selected occurrence and raw age.

This relation does not mention `prepare?`, either executable query, or either
rule executable.  It directly states the list decomposition selected by the
concrete scheduler policy and the two synchronized raw-mark updates.

```lean
ProofNetIR.SequentialFigure7.RulePrefixAt : ProofNetIR.SequentialSchedulerBridge.ReservationState →
  ProofNetIR.SequentialSchedulerBridge.ReservationState →
    ProofNetIR.Vertex → ProofNetIR.SequentialSchedulerState.RawTokenAge → Prop
```

### `ProofNetIR.SequentialFigure7.RulePrefix`

Kind: definition.

Existential form of the independent common-prefix relation.

```lean
ProofNetIR.SequentialFigure7.RulePrefix : ProofNetIR.SequentialSchedulerBridge.ReservationState → ProofNetIR.SequentialSchedulerBridge.ReservationState → Prop
```

### `ProofNetIR.SequentialFigure7.RulePrefix.ofPrepared`

Kind: theorem.

Every successful executable prefix realizes the independent direct state
relation.

```lean
ProofNetIR.SequentialFigure7.RulePrefix.ofPrepared : ∀ {before : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  (prepared : ProofNetIR.SequentialFigure7.PreparedStep before),
  ProofNetIR.SequentialFigure7.RulePrefixAt before prepared.after prepared.stackResult.vertex
    prepared.stackResult.rawAge
```

### `ProofNetIR.SequentialFigure7.RulePrefix.output_unique`

Kind: theorem.

The direct common-prefix relation has a unique output for a fixed input.

```lean
ProofNetIR.SequentialFigure7.RulePrefix.output_unique : ∀ {before first second : ProofNetIR.SequentialSchedulerBridge.ReservationState},
  ProofNetIR.SequentialFigure7.RulePrefix before first →
    ProofNetIR.SequentialFigure7.RulePrefix before second → first = second
```

### `ProofNetIR.SequentialFigure7.ConclRule`

Kind: definition.

Independent Boolean-free local Figure-7 `concl` relation for the
unit-free certificate model.  On structurally valid input, declared boundary
membership already entails that the occurrence has no consumer.

```lean
ProofNetIR.SequentialFigure7.ConclRule : ProofNetIR.Certificate →
  ProofNetIR.SequentialSchedulerBridge.ReservationState → ProofNetIR.SequentialSchedulerBridge.ReservationState → Prop
```

### `ProofNetIR.SequentialFigure7.concl?`

Kind: definition.

Execute Figure-7 `concl`: perform the common prefix only when the selected
occurrence is a locally ownership-well-formed declared conclusion with an
exactly empty consumer bucket.

```lean
ProofNetIR.SequentialFigure7.concl? : (certificate : ProofNetIR.Certificate) →
  (before : ProofNetIR.SequentialSchedulerBridge.ReservationState) →
    ProofNetIR.SequentialSchedulerBridge.ReservationInvariant certificate before →
      Option ProofNetIR.SequentialSchedulerBridge.ReservationState
```

### `ProofNetIR.SequentialFigure7.ConclStep`

Kind: inductive type.

Exact proof-relevant specification of one successful `concl` rule.

```lean
ProofNetIR.SequentialFigure7.ConclStep : ProofNetIR.Certificate →
  ProofNetIR.SequentialSchedulerBridge.ReservationState → ProofNetIR.SequentialSchedulerBridge.ReservationState → Type
```

### `ProofNetIR.SequentialFigure7.concl?_some_iff`

Kind: theorem.

Executable `concl` success is exactly the typed rule witness.

```lean
ProofNetIR.SequentialFigure7.concl?_some_iff : ∀ {certificate : ProofNetIR.Certificate} {before after : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  (invariant : ProofNetIR.SequentialSchedulerBridge.ReservationInvariant certificate before),
  ProofNetIR.SequentialFigure7.concl? certificate before invariant = some after ↔
    Nonempty (ProofNetIR.SequentialFigure7.ConclStep certificate before after)
```

### `ProofNetIR.SequentialFigure7.ConclStep.reservationInvariant`

Kind: theorem.

A successful `concl` rule changes only the synchronized common prefix.

```lean
ProofNetIR.SequentialFigure7.ConclStep.reservationInvariant : ∀ {certificate : ProofNetIR.Certificate} {before after : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  (step : ProofNetIR.SequentialFigure7.ConclStep certificate before after),
  ProofNetIR.SequentialSchedulerBridge.ReservationInvariant certificate after
```

### `ProofNetIR.SequentialFigure7.concl?_reservationInvariant`

Kind: theorem.

Success of executable `concl` preserves the current reservation
invariant.

```lean
ProofNetIR.SequentialFigure7.concl?_reservationInvariant : ∀ {certificate : ProofNetIR.Certificate} {before after : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  (invariant : ProofNetIR.SequentialSchedulerBridge.ReservationInvariant certificate before),
  ProofNetIR.SequentialFigure7.concl? certificate before invariant = some after →
    ProofNetIR.SequentialSchedulerBridge.ReservationInvariant certificate after
```

### `ProofNetIR.SequentialFigure7.ConclStep.toRule`

Kind: theorem.

The equation-backed executable witness refines the independent direct
`concl` relation.

```lean
ProofNetIR.SequentialFigure7.ConclStep.toRule : ∀ {certificate : ProofNetIR.Certificate} {before after : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  (step : ProofNetIR.SequentialFigure7.ConclStep certificate before after),
  ProofNetIR.SequentialFigure7.ConclRule certificate before after
```

### `ProofNetIR.SequentialFigure7.concl?_sound`

Kind: theorem.

Executable `concl` is sound for the independent direct relation without
assuming global certificate validity.

```lean
ProofNetIR.SequentialFigure7.concl?_sound : ∀ {certificate : ProofNetIR.Certificate} {before after : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  (invariant : ProofNetIR.SequentialSchedulerBridge.ReservationInvariant certificate before),
  ProofNetIR.SequentialFigure7.concl? certificate before invariant = some after →
    ProofNetIR.SequentialFigure7.ConclRule certificate before after
```

### `ProofNetIR.SequentialFigure7.concl?_complete_of_structural`

Kind: theorem.

On structurally valid input, the independent direct `concl` guard is
complete for the executable rule.

```lean
ProofNetIR.SequentialFigure7.concl?_complete_of_structural : ∀ {certificate : ProofNetIR.Certificate} {before after : ProofNetIR.SequentialSchedulerBridge.ReservationState},
  certificate.StructurallyWellFormed →
    ∀ (invariant : ProofNetIR.SequentialSchedulerBridge.ReservationInvariant certificate before),
      ProofNetIR.SequentialFigure7.ConclRule certificate before after →
        ProofNetIR.SequentialFigure7.concl? certificate before invariant = some after
```

### `ProofNetIR.SequentialFigure7.concl?_some_iff_rule_of_structural`

Kind: theorem.

Exact executable/declarative correspondence for `concl` under the
certificate validity needed to make the paper guard unambiguous.

```lean
ProofNetIR.SequentialFigure7.concl?_some_iff_rule_of_structural : ∀ {certificate : ProofNetIR.Certificate} {before after : ProofNetIR.SequentialSchedulerBridge.ReservationState},
  certificate.StructurallyWellFormed →
    ∀ (invariant : ProofNetIR.SequentialSchedulerBridge.ReservationInvariant certificate before),
      ProofNetIR.SequentialFigure7.concl? certificate before invariant = some after ↔
        ProofNetIR.SequentialFigure7.ConclRule certificate before after
```

### `ProofNetIR.SequentialFigure7.ConclRule.output_unique`

Kind: theorem.

The independent `concl` relation has a unique output.

```lean
ProofNetIR.SequentialFigure7.ConclRule.output_unique : ∀ {certificate : ProofNetIR.Certificate} {before first second : ProofNetIR.SequentialSchedulerBridge.ReservationState},
  ProofNetIR.SequentialFigure7.ConclRule certificate before first →
    ProofNetIR.SequentialFigure7.ConclRule certificate before second → first = second
```

### `ProofNetIR.SequentialFigure7.NopRule`

Kind: definition.

Independent Boolean-free local Figure-7 `nop` relation.  The exact
submitted par slot and its stored premise orientation are retained, while the
paper guard is stated in the pre-prefix raw mark state.

```lean
ProofNetIR.SequentialFigure7.NopRule : ProofNetIR.Certificate →
  ProofNetIR.SequentialSchedulerBridge.ReservationState → ProofNetIR.SequentialSchedulerBridge.ReservationState → Prop
```

### `ProofNetIR.SequentialFigure7.nop?`

Kind: definition.

Execute Figure-7 `nop`: perform the common prefix only when the selected
occurrence has one exact par consumer and the opposite par premise remains raw
unmarked in the post-prefix production state.

```lean
ProofNetIR.SequentialFigure7.nop? : (certificate : ProofNetIR.Certificate) →
  (before : ProofNetIR.SequentialSchedulerBridge.ReservationState) →
    ProofNetIR.SequentialSchedulerBridge.ReservationInvariant certificate before →
      Option ProofNetIR.SequentialSchedulerBridge.ReservationState
```

### `ProofNetIR.SequentialFigure7.NopStep`

Kind: inductive type.

Exact proof-relevant specification of one successful `nop` rule.

```lean
ProofNetIR.SequentialFigure7.NopStep : ProofNetIR.Certificate →
  ProofNetIR.SequentialSchedulerBridge.ReservationState → ProofNetIR.SequentialSchedulerBridge.ReservationState → Type
```

### `ProofNetIR.SequentialFigure7.nop?_some_iff`

Kind: theorem.

Executable `nop` success is exactly the typed rule witness.

```lean
ProofNetIR.SequentialFigure7.nop?_some_iff : ∀ {certificate : ProofNetIR.Certificate} {before after : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  (invariant : ProofNetIR.SequentialSchedulerBridge.ReservationInvariant certificate before),
  ProofNetIR.SequentialFigure7.nop? certificate before invariant = some after ↔
    Nonempty (ProofNetIR.SequentialFigure7.NopStep certificate before after)
```

### `ProofNetIR.SequentialFigure7.NopStep.submitted_par`

Kind: theorem.

The generic consumer retained by a `nop` witness is the exact submitted
par link.

```lean
ProofNetIR.SequentialFigure7.NopStep.submitted_par : ∀ {certificate : ProofNetIR.Certificate} {before after : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  (step : ProofNetIR.SequentialFigure7.NopStep certificate before after),
  certificate.links[step.consumer.linkIndex]? =
    some (ProofNetIR.Link.par step.consumer.storedLeft step.consumer.storedRight step.consumer.conclusion)
```

### `ProofNetIR.SequentialFigure7.NopStep.mate_unmarked_before`

Kind: theorem.

The paper's `nop` guard holds already in the pre-prefix raw marking.

The executable rule tests the post-prefix state, but the prefix changes only
the selected premise.  Local link well-formedness makes its mate distinct, so
the test is exactly Guerrini's pre-state `μ(u₂) = ⊥` guard.

```lean
ProofNetIR.SequentialFigure7.NopStep.mate_unmarked_before : ∀ {certificate : ProofNetIR.Certificate} {before after : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  (step : ProofNetIR.SequentialFigure7.NopStep certificate before after),
  before.core.marks[step.consumer.mate]? = some none
```

### `ProofNetIR.SequentialFigure7.NopStep.reservationInvariant`

Kind: theorem.

A successful `nop` rule changes only the synchronized common prefix.

```lean
ProofNetIR.SequentialFigure7.NopStep.reservationInvariant : ∀ {certificate : ProofNetIR.Certificate} {before after : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  (step : ProofNetIR.SequentialFigure7.NopStep certificate before after),
  ProofNetIR.SequentialSchedulerBridge.ReservationInvariant certificate after
```

### `ProofNetIR.SequentialFigure7.nop?_reservationInvariant`

Kind: theorem.

Success of executable `nop` preserves the current reservation invariant.

```lean
ProofNetIR.SequentialFigure7.nop?_reservationInvariant : ∀ {certificate : ProofNetIR.Certificate} {before after : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  (invariant : ProofNetIR.SequentialSchedulerBridge.ReservationInvariant certificate before),
  ProofNetIR.SequentialFigure7.nop? certificate before invariant = some after →
    ProofNetIR.SequentialSchedulerBridge.ReservationInvariant certificate after
```

### `ProofNetIR.SequentialFigure7.NopStep.toRule`

Kind: theorem.

The equation-backed executable witness refines the independent direct
`nop` relation.

```lean
ProofNetIR.SequentialFigure7.NopStep.toRule : ∀ {certificate : ProofNetIR.Certificate} {before after : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  (step : ProofNetIR.SequentialFigure7.NopStep certificate before after),
  ProofNetIR.SequentialFigure7.NopRule certificate before after
```

### `ProofNetIR.SequentialFigure7.nop?_sound`

Kind: theorem.

Executable `nop` is sound for the independent direct relation without
assuming global certificate validity.

```lean
ProofNetIR.SequentialFigure7.nop?_sound : ∀ {certificate : ProofNetIR.Certificate} {before after : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  (invariant : ProofNetIR.SequentialSchedulerBridge.ReservationInvariant certificate before),
  ProofNetIR.SequentialFigure7.nop? certificate before invariant = some after →
    ProofNetIR.SequentialFigure7.NopRule certificate before after
```

### `ProofNetIR.SequentialFigure7.nop?_complete_of_structural`

Kind: theorem.

On structurally valid input, the independent direct `nop` guard is
complete for the executable rule.

```lean
ProofNetIR.SequentialFigure7.nop?_complete_of_structural : ∀ {certificate : ProofNetIR.Certificate} {before after : ProofNetIR.SequentialSchedulerBridge.ReservationState},
  certificate.StructurallyWellFormed →
    ∀ (invariant : ProofNetIR.SequentialSchedulerBridge.ReservationInvariant certificate before),
      ProofNetIR.SequentialFigure7.NopRule certificate before after →
        ProofNetIR.SequentialFigure7.nop? certificate before invariant = some after
```

### `ProofNetIR.SequentialFigure7.nop?_some_iff_rule_of_structural`

Kind: theorem.

Exact executable/declarative correspondence for `nop` under the
certificate validity needed to make the paper guard unambiguous.

```lean
ProofNetIR.SequentialFigure7.nop?_some_iff_rule_of_structural : ∀ {certificate : ProofNetIR.Certificate} {before after : ProofNetIR.SequentialSchedulerBridge.ReservationState},
  certificate.StructurallyWellFormed →
    ∀ (invariant : ProofNetIR.SequentialSchedulerBridge.ReservationInvariant certificate before),
      ProofNetIR.SequentialFigure7.nop? certificate before invariant = some after ↔
        ProofNetIR.SequentialFigure7.NopRule certificate before after
```

### `ProofNetIR.SequentialFigure7.NopRule.output_unique`

Kind: theorem.

The independent `nop` relation has a unique output.

```lean
ProofNetIR.SequentialFigure7.NopRule.output_unique : ∀ {certificate : ProofNetIR.Certificate} {before first second : ProofNetIR.SequentialSchedulerBridge.ReservationState},
  ProofNetIR.SequentialFigure7.NopRule certificate before first →
    ProofNetIR.SequentialFigure7.NopRule certificate before second → first = second
```

### `ProofNetIR.SequentialFigure7.WaitingPrependAt`

Kind: definition.

Independent direct waiting-payload prepend relation.  Its equations expose
the initialized pre-cell and the exact O(1) cons update without referring to
the executable `Option` primitive.

```lean
ProofNetIR.SequentialFigure7.WaitingPrependAt : ProofNetIR.SequentialSchedulerBridge.ReservationState →
  ProofNetIR.SequentialSchedulerBridge.ReservationState →
    ProofNetIR.SequentialSchedulerState.RawTokenAge → ProofNetIR.Vertex → Prop
```

### `ProofNetIR.SequentialFigure7.WaitRule`

Kind: definition.

Independent Boolean-free local Figure-7 `wait` relation.

The paper guard compares the mate's raw mark with the selected raw age.  Its
destination is the exact `sigmaBoundary?` result; neither a union-find
representative nor the raw age itself is used as the waiting-table index.

```lean
ProofNetIR.SequentialFigure7.WaitRule : ProofNetIR.Certificate →
  ProofNetIR.SequentialSchedulerBridge.ReservationState → ProofNetIR.SequentialSchedulerBridge.ReservationState → Prop
```

### `ProofNetIR.SequentialFigure7.wait?`

Kind: definition.

Execute Figure-7 `wait` after the synchronized common prefix.

The mate lookup returns its stored raw age.  The strict guard compares that
raw age with the selected occurrence's raw age, then the bridge computes the
destination from `sigmaBoundary?` and prepends the connective conclusion to
the initialized boundary bucket.  There is intentionally no global
`queuedVertices` scan in this local rule.

```lean
ProofNetIR.SequentialFigure7.wait? : (certificate : ProofNetIR.Certificate) →
  (before : ProofNetIR.SequentialSchedulerBridge.ReservationState) →
    ProofNetIR.SequentialSchedulerBridge.ReservationInvariant certificate before →
      Option ProofNetIR.SequentialSchedulerBridge.ReservationState
```

### `ProofNetIR.SequentialFigure7.WaitStep`

Kind: inductive type.

Exact proof-relevant specification of one successful `wait` rule.

```lean
ProofNetIR.SequentialFigure7.WaitStep : ProofNetIR.Certificate →
  ProofNetIR.SequentialSchedulerBridge.ReservationState → ProofNetIR.SequentialSchedulerBridge.ReservationState → Type
```

### `ProofNetIR.SequentialFigure7.wait?_some_iff`

Kind: theorem.

Executable `wait` success is exactly the typed rule witness.

```lean
ProofNetIR.SequentialFigure7.wait?_some_iff : ∀ {certificate : ProofNetIR.Certificate} {before after : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  (invariant : ProofNetIR.SequentialSchedulerBridge.ReservationInvariant certificate before),
  ProofNetIR.SequentialFigure7.wait? certificate before invariant = some after ↔
    Nonempty (ProofNetIR.SequentialFigure7.WaitStep certificate before after)
```

### `ProofNetIR.SequentialFigure7.WaitStep.submitted_par`

Kind: theorem.

The generic consumer retained by a `wait` witness is the exact submitted
par link.

```lean
ProofNetIR.SequentialFigure7.WaitStep.submitted_par : ∀ {certificate : ProofNetIR.Certificate} {before after : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  (step : ProofNetIR.SequentialFigure7.WaitStep certificate before after),
  certificate.links[step.consumer.linkIndex]? =
    some (ProofNetIR.Link.par step.consumer.storedLeft step.consumer.storedRight step.consumer.conclusion)
```

### `ProofNetIR.SequentialFigure7.WaitStep.mate_marked_before`

Kind: theorem.

The mate raw age tested after the common prefix is exactly its pre-prefix
paper mark.

```lean
ProofNetIR.SequentialFigure7.WaitStep.mate_marked_before : ∀ {certificate : ProofNetIR.Certificate} {before after : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  (step : ProofNetIR.SequentialFigure7.WaitStep certificate before after),
  before.core.marks[step.consumer.mate]? = some (some step.mateRawAge)
```

### `ProofNetIR.SequentialFigure7.WaitStep.reservationInvariant`

Kind: theorem.

A successful `wait` preserves the reservation invariant by composing the
common-prefix and typed destination preservation theorems.

```lean
ProofNetIR.SequentialFigure7.WaitStep.reservationInvariant : ∀ {certificate : ProofNetIR.Certificate} {before after : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  (step : ProofNetIR.SequentialFigure7.WaitStep certificate before after),
  ProofNetIR.SequentialSchedulerBridge.ReservationInvariant certificate after
```

### `ProofNetIR.SequentialFigure7.wait?_reservationInvariant`

Kind: theorem.

Executable `wait` preserves the complete reservation invariant.

```lean
ProofNetIR.SequentialFigure7.wait?_reservationInvariant : ∀ {certificate : ProofNetIR.Certificate} {before after : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  (invariant : ProofNetIR.SequentialSchedulerBridge.ReservationInvariant certificate before),
  ProofNetIR.SequentialFigure7.wait? certificate before invariant = some after →
    ProofNetIR.SequentialSchedulerBridge.ReservationInvariant certificate after
```

### `ProofNetIR.SequentialFigure7.WaitDestinationStep.toWaitingPrependAt`

Kind: theorem.

A typed bridge destination refines the independent direct cons-update
relation.

```lean
ProofNetIR.SequentialFigure7.WaitDestinationStep.toWaitingPrependAt : ∀ {before after : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  {mateRawAge : ProofNetIR.SequentialSchedulerState.RawTokenAge} {conclusion : ProofNetIR.Vertex}
  (step : ProofNetIR.SequentialSchedulerBridge.WaitDestinationStep before after mateRawAge conclusion),
  ProofNetIR.SequentialFigure7.WaitingPrependAt before after step.boundary conclusion
```

### `ProofNetIR.SequentialFigure7.WaitStep.toRule`

Kind: theorem.

The equation-backed executable witness refines the independent direct
`wait` relation.

```lean
ProofNetIR.SequentialFigure7.WaitStep.toRule : ∀ {certificate : ProofNetIR.Certificate} {before after : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  (step : ProofNetIR.SequentialFigure7.WaitStep certificate before after),
  ProofNetIR.SequentialFigure7.WaitRule certificate before after
```

### `ProofNetIR.SequentialFigure7.wait?_sound`

Kind: theorem.

Executable `wait` is sound for the independent direct relation without a
global certificate-validity assumption.

```lean
ProofNetIR.SequentialFigure7.wait?_sound : ∀ {certificate : ProofNetIR.Certificate} {before after : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  (invariant : ProofNetIR.SequentialSchedulerBridge.ReservationInvariant certificate before),
  ProofNetIR.SequentialFigure7.wait? certificate before invariant = some after →
    ProofNetIR.SequentialFigure7.WaitRule certificate before after
```

### `ProofNetIR.SequentialFigure7.WaitingPrependAt.toExecutable`

Kind: theorem.

A direct initialized-cell cons update is complete for the executable
raw-boundary bridge.

```lean
ProofNetIR.SequentialFigure7.WaitingPrependAt.toExecutable : ∀ {before after : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  {mateRawAge boundary : ProofNetIR.SequentialSchedulerState.RawTokenAge} {conclusion : ProofNetIR.Vertex},
  ProofNetIR.SequentialSchedulerState.sigmaBoundary? before.stack.sigma mateRawAge = some boundary →
    ProofNetIR.SequentialFigure7.WaitingPrependAt before after boundary conclusion →
      ProofNetIR.SequentialSchedulerBridge.enqueueWaitingAtRawAge? before mateRawAge conclusion = some after
```

### `ProofNetIR.SequentialFigure7.wait?_complete_of_structural`

Kind: theorem.

On structurally valid input, the independent direct `wait` guard is
complete for the executable local rule.

```lean
ProofNetIR.SequentialFigure7.wait?_complete_of_structural : ∀ {certificate : ProofNetIR.Certificate} {before after : ProofNetIR.SequentialSchedulerBridge.ReservationState},
  certificate.StructurallyWellFormed →
    ∀ (invariant : ProofNetIR.SequentialSchedulerBridge.ReservationInvariant certificate before),
      ProofNetIR.SequentialFigure7.WaitRule certificate before after →
        ProofNetIR.SequentialFigure7.wait? certificate before invariant = some after
```

### `ProofNetIR.SequentialFigure7.wait?_some_iff_rule_of_structural`

Kind: theorem.

Exact executable/declarative correspondence for `wait` under the
certificate validity needed to make the par consumer unambiguous.

```lean
ProofNetIR.SequentialFigure7.wait?_some_iff_rule_of_structural : ∀ {certificate : ProofNetIR.Certificate} {before after : ProofNetIR.SequentialSchedulerBridge.ReservationState},
  certificate.StructurallyWellFormed →
    ∀ (invariant : ProofNetIR.SequentialSchedulerBridge.ReservationInvariant certificate before),
      ProofNetIR.SequentialFigure7.wait? certificate before invariant = some after ↔
        ProofNetIR.SequentialFigure7.WaitRule certificate before after
```

### `ProofNetIR.SequentialFigure7.WaitRule.output_unique_of_structural`

Kind: theorem.

Under structural certificate validity and the supplied reservation
invariant, the independent `wait` relation has one exact output.

```lean
ProofNetIR.SequentialFigure7.WaitRule.output_unique_of_structural : ∀ {certificate : ProofNetIR.Certificate} {before first second : ProofNetIR.SequentialSchedulerBridge.ReservationState},
  certificate.StructurallyWellFormed →
    ProofNetIR.SequentialSchedulerBridge.ReservationInvariant certificate before →
      ProofNetIR.SequentialFigure7.WaitRule certificate before first →
        ProofNetIR.SequentialFigure7.WaitRule certificate before second → first = second
```

### `ProofNetIR.SequentialFigure7.WaitingPrependAt.output_unique`

Kind: theorem.

The direct cons-update relation has one exact output.

```lean
ProofNetIR.SequentialFigure7.WaitingPrependAt.output_unique : ∀ {before first second : ProofNetIR.SequentialSchedulerBridge.ReservationState}
  {boundary : ProofNetIR.SequentialSchedulerState.RawTokenAge} {conclusion : ProofNetIR.Vertex},
  ProofNetIR.SequentialFigure7.WaitingPrependAt before first boundary conclusion →
    ProofNetIR.SequentialFigure7.WaitingPrependAt before second boundary conclusion → first = second
```

## Serialization and untrusted input

### `ProofNetIR.ParseError`

Kind: inductive type.

A machine-readable location and explanation for a certificate parse
failure. Paths use the familiar JSON notation `$`, `.field`, and `[index]`.

```lean
ProofNetIR.ParseError : Type
```

### `ProofNetIR.ParseResult`

Kind: definition.

Parser result with a structured JSON path and diagnostic on failure.

```lean
ProofNetIR.ParseResult : Type → Type
```

### `ProofNetIR.Certificate.canonicalString`

Kind: definition.

Compact v0.2 canonical JSON under fixed submitted occurrence numbering.

```lean
ProofNetIR.Certificate.canonicalString : ProofNetIR.Certificate → String
```

### `ProofNetIR.Certificate.fromString`

Kind: definition.

Parse canonical v0.2 or v0.3 JSON without asserting proof-net correctness.

```lean
ProofNetIR.Certificate.fromString : String → ProofNetIR.ParseResult ProofNetIR.Certificate
```

### `ProofNetIR.Certificate.checkedFromString`

Kind: definition.

Parse untrusted canonical JSON and return a certificate only after the
reference checker accepts it.

```lean
ProofNetIR.Certificate.checkedFromString : String → ProofNetIR.ParseResult ProofNetIR.CutFreeDerivation.CheckedCertificate
```

### `ProofNetIR.Certificate.migrateV02StringToV03`

Kind: definition.

Parse a v0.2 certificate and emit its deterministic v0.3
`reindex-v1` representation.

```lean
ProofNetIR.Certificate.migrateV02StringToV03 : String → ProofNetIR.ParseResult String
```

### `ProofNetIR.CanonicalKey.wireVersion`

Kind: definition.

Wire version for the first exact proof-net canonical key.

```lean
ProofNetIR.CanonicalKey.wireVersion : String
```

### `ProofNetIR.CanonicalKey.canonicalization`

Kind: definition.

Named semantic relation implemented by the key.

```lean
ProofNetIR.CanonicalKey.canonicalization : String
```

### `ProofNetIR.CanonicalKey.maxTokens`

Kind: definition.

Defensive token-count limit for untrusted key JSON.

```lean
ProofNetIR.CanonicalKey.maxTokens : Nat
```

### `ProofNetIR.CanonicalKey.maxCharacters`

Kind: definition.

Defensive aggregate character-count limit for untrusted key JSON.

```lean
ProofNetIR.CanonicalKey.maxCharacters : Nat
```

### `ProofNetIR.CanonicalKey.maxGenerationLinks`

Kind: definition.

Public factorial-generator ceiling.  Seven links means at most `7! = 5040`
link orders.  Larger inputs must use the exact pairwise identity API until a
non-factorial canonical construction is proved.

```lean
ProofNetIR.CanonicalKey.maxGenerationLinks : Nat
```

### `ProofNetIR.CanonicalKey.WireAdmissible`

Kind: definition.

The supported wire envelope is deliberately bounded even though the typed
canonical key remains total for every finite certificate.

```lean
ProofNetIR.CanonicalKey.WireAdmissible : ProofNetIR.CanonicalKey → Prop
```

### `ProofNetIR.CanonicalKey.isWireAdmissible`

Kind: definition.

Executable supported-wire predicate.

```lean
ProofNetIR.CanonicalKey.isWireAdmissible : ProofNetIR.CanonicalKey → Bool
```

### `ProofNetIR.CanonicalKey.toJson`

Kind: definition.

Deterministic JSON representation of a canonical key.

```lean
ProofNetIR.CanonicalKey.toJson : ProofNetIR.CanonicalKey → Lean.Json
```

### `ProofNetIR.CanonicalKey.toString`

Kind: definition.

Compact canonical-key JSON string.

```lean
ProofNetIR.CanonicalKey.toString : ProofNetIR.CanonicalKey → String
```

### `ProofNetIR.CanonicalKey.fromJson`

Kind: definition.

Decode the first canonical-key wire version.  This validates the envelope
and resource bounds but does not claim that arbitrary tokens came from a proof
net.

```lean
ProofNetIR.CanonicalKey.fromJson : Lean.Json → ProofNetIR.ParseResult ProofNetIR.CanonicalKey
```

### `ProofNetIR.CanonicalKey.fromString`

Kind: definition.

Parse an untrusted canonical-key string with structured diagnostics.

```lean
ProofNetIR.CanonicalKey.fromString : String → ProofNetIR.ParseResult ProofNetIR.CanonicalKey
```

### `ProofNetIR.Certificate.proofNetCanonicalKeyWithinLimit?`

Kind: definition.

Resource-qualified exact key generation.  This checks the link limit before
evaluating the factorial specification oracle.

```lean
ProofNetIR.Certificate.proofNetCanonicalKeyWithinLimit? : ProofNetIR.Certificate → Option ProofNetIR.CanonicalKey
```

### `ProofNetIR.Certificate.proofNetCanonicalKeyJson?`

Kind: definition.

Deterministic JSON wire value for the exact typed canonical key.

```lean
ProofNetIR.Certificate.proofNetCanonicalKeyJson? : ProofNetIR.Certificate → Option Lean.Json
```

### `ProofNetIR.Certificate.proofNetCanonicalKeyString?`

Kind: definition.

Deterministic JSON wire string for the exact typed canonical key.

```lean
ProofNetIR.Certificate.proofNetCanonicalKeyString? : ProofNetIR.Certificate → Option String
```

### `ProofNetIR.Certificate.matchesCanonicalKey`

Kind: definition.

Compare a bounded locally computed key with a parsed opaque key.  Inputs
above `CanonicalKey.maxGenerationLinks` return `false` before factorial
materialization.

```lean
ProofNetIR.Certificate.matchesCanonicalKey : ProofNetIR.Certificate → ProofNetIR.CanonicalKey → Bool
```

### `ProofNetIR.Certificate.proofNetEquivalent_of_matchesCanonicalKey`

Kind: theorem.

A parsed key shared by two accepted certificates is sufficient to prove
that the certificates are `ProofNetEquivalent`.

```lean
ProofNetIR.Certificate.proofNetEquivalent_of_matchesCanonicalKey : ∀ {left right : ProofNetIR.Certificate} {key : ProofNetIR.CanonicalKey},
  left.check = true →
    right.check = true →
      left.matchesCanonicalKey key = true → right.matchesCanonicalKey key = true → left.ProofNetEquivalent right
```

### `ProofNetIR.Certificate.migrateV03StringToCanonicalKey`

Kind: definition.

Parse a checker-accepted v0.3 certificate and emit the new exact
`proofnet-equivalent-v1` key.  This is a semantic migration to a separate wire
type; it does not reinterpret the input certificate bytes.

```lean
ProofNetIR.Certificate.migrateV03StringToCanonicalKey : String → ProofNetIR.ParseResult String
```

### `ProofNetIR.IntrinsicCanonicalKey.wireVersion`

Kind: definition.

Wire version for the non-factorial exact canonical key.

```lean
ProofNetIR.IntrinsicCanonicalKey.wireVersion : String
```

### `ProofNetIR.IntrinsicCanonicalKey.canonicalization`

Kind: definition.

Named semantic algorithm implemented by this key.

```lean
ProofNetIR.IntrinsicCanonicalKey.canonicalization : String
```

### `ProofNetIR.IntrinsicCanonicalKey.maxTokens`

Kind: definition.

Defensive token-count limit for untrusted intrinsic-key JSON.

```lean
ProofNetIR.IntrinsicCanonicalKey.maxTokens : Nat
```

### `ProofNetIR.IntrinsicCanonicalKey.maxCharacters`

Kind: definition.

Defensive aggregate character-count limit for untrusted intrinsic-key
JSON.

```lean
ProofNetIR.IntrinsicCanonicalKey.maxCharacters : Nat
```

### `ProofNetIR.IntrinsicCanonicalKey.WireAdmissible`

Kind: definition.

The supported intrinsic-key wire envelope.  The limit is independent of
the number of links and is checked after polynomial key generation.

```lean
ProofNetIR.IntrinsicCanonicalKey.WireAdmissible : ProofNetIR.IntrinsicCanonicalKey → Prop
```

### `ProofNetIR.IntrinsicCanonicalKey.isWireAdmissible`

Kind: definition.

Executable supported-wire predicate.

```lean
ProofNetIR.IntrinsicCanonicalKey.isWireAdmissible : ProofNetIR.IntrinsicCanonicalKey → Bool
```

### `ProofNetIR.IntrinsicCanonicalKey.toJson`

Kind: definition.

Deterministic JSON representation of an intrinsic canonical key.

```lean
ProofNetIR.IntrinsicCanonicalKey.toJson : ProofNetIR.IntrinsicCanonicalKey → Lean.Json
```

### `ProofNetIR.IntrinsicCanonicalKey.toString`

Kind: definition.

Compact intrinsic canonical-key JSON string.

```lean
ProofNetIR.IntrinsicCanonicalKey.toString : ProofNetIR.IntrinsicCanonicalKey → String
```

### `ProofNetIR.IntrinsicCanonicalKey.fromJson`

Kind: definition.

Decode the intrinsic-key envelope and enforce resource bounds.  Parsing
does not assert that arbitrary tokens came from a proof net.

```lean
ProofNetIR.IntrinsicCanonicalKey.fromJson : Lean.Json → ProofNetIR.ParseResult ProofNetIR.IntrinsicCanonicalKey
```

### `ProofNetIR.IntrinsicCanonicalKey.fromString`

Kind: definition.

Parse an untrusted intrinsic canonical-key string with structured
diagnostics.

```lean
ProofNetIR.IntrinsicCanonicalKey.fromString : String → ProofNetIR.ParseResult ProofNetIR.IntrinsicCanonicalKey
```

### `ProofNetIR.Certificate.intrinsicCanonicalKeyJson?`

Kind: definition.

Wire generation is available for every structurally valid certificate and
has no link-count ceiling.  The independent token/character envelope still
fails closed.

```lean
ProofNetIR.Certificate.intrinsicCanonicalKeyJson? : ProofNetIR.Certificate → Option Lean.Json
```

### `ProofNetIR.Certificate.intrinsicCanonicalKeyString?`

Kind: definition.

Deterministic intrinsic canonical-key wire string, when the structurally
valid certificate fits the independent wire envelope.

```lean
ProofNetIR.Certificate.intrinsicCanonicalKeyString? : ProofNetIR.Certificate → Option String
```

### `ProofNetIR.Certificate.matchesIntrinsicCanonicalKey`

Kind: definition.

Safe comparison of an untrusted parsed key with a locally generated
structurally validated key.

```lean
ProofNetIR.Certificate.matchesIntrinsicCanonicalKey : ProofNetIR.Certificate → ProofNetIR.IntrinsicCanonicalKey → Bool
```

### `ProofNetIR.Certificate.proofNetEquivalent_of_matchesIntrinsicCanonicalKey`

Kind: theorem.

Two structurally validated local certificates matching the same
wire-admissible key are proof-net equivalent.

```lean
ProofNetIR.Certificate.proofNetEquivalent_of_matchesIntrinsicCanonicalKey : ∀ {left right : ProofNetIR.Certificate} {key : ProofNetIR.IntrinsicCanonicalKey},
  left.matchesIntrinsicCanonicalKey key = true →
    right.matchesIntrinsicCanonicalKey key = true → left.ProofNetEquivalent right
```

### `ProofNetIR.Certificate.migrateV03StringToIntrinsicCanonicalKey`

Kind: definition.

Semantic migration from a checker-accepted v0.3 certificate.  A bare v0.1
canonical key cannot be migrated without its source certificate because the
new deterministic representative need not be the old factorial minimum.

```lean
ProofNetIR.Certificate.migrateV03StringToIntrinsicCanonicalKey : String → ProofNetIR.ParseResult String
```

## Persistent and linear LeanProp bridge

### `ProofNetIR.LeanProp.Assumptions`

Kind: inductive type.

Heterogeneous proof values matching a proposition context exactly.

```lean
ProofNetIR.LeanProp.Assumptions : List Prop → Type
```

### `ProofNetIR.LeanProp.Assumptions.split_append`

Kind: theorem.

Splitting an appended proof environment recovers the two inputs.

```lean
ProofNetIR.LeanProp.Assumptions.split_append : ∀ {left right : List Prop} (leftValues : ProofNetIR.LeanProp.Assumptions left)
  (rightValues : ProofNetIR.LeanProp.Assumptions right),
  ProofNetIR.LeanProp.Assumptions.split left right (leftValues.append rightValues) = (leftValues, rightValues)
```

### `ProofNetIR.LeanProp.Assumptions.permute_symm`

Kind: theorem.

Executing an exchange and its explicit inverse restores the original
heterogeneous proof environment.

```lean
ProofNetIR.LeanProp.Assumptions.permute_symm : ∀ {left right : List Prop} (permutation : ProofNetIR.LeanProp.ContextPermutation left right)
  (values : ProofNetIR.LeanProp.Assumptions left),
  ProofNetIR.LeanProp.Assumptions.permute permutation.symm
      (ProofNetIR.LeanProp.Assumptions.permute permutation values) =
    values
```

### `ProofNetIR.LeanProp.Assumptions.permute_symm_right`

Kind: theorem.

The opposite round trip also restores the proof environment. Together
with `permute_symm`, exchange is an explicit environment isomorphism.

```lean
ProofNetIR.LeanProp.Assumptions.permute_symm_right : ∀ {left right : List Prop} (permutation : ProofNetIR.LeanProp.ContextPermutation left right)
  (values : ProofNetIR.LeanProp.Assumptions right),
  ProofNetIR.LeanProp.Assumptions.permute permutation
      (ProofNetIR.LeanProp.Assumptions.permute permutation.symm values) =
    values
```

### `ProofNetIR.LeanProp.ContextPermutation`

Kind: inductive type.

Proof-relevant permutation syntax. `List.Perm` lives in `Prop` and cannot
be eliminated into the heterogeneous `Assumptions` type; this Type-valued
witness records exactly the same exchange steps as executable data.

```lean
ProofNetIR.LeanProp.ContextPermutation : List Prop → List Prop → Type
```

### `ProofNetIR.LeanProp.ContextPermutation.toListPerm`

Kind: theorem.

Forget proof-relevant permutation data to the proposition-level relation.

```lean
ProofNetIR.LeanProp.ContextPermutation.toListPerm : ∀ {left right : List Prop} (a : ProofNetIR.LeanProp.ContextPermutation left right), left.Perm right
```

### `ProofNetIR.LeanProp.ContextPermutation.symm_symm`

Kind: theorem.

Reversing a proof-relevant permutation twice recovers the same witness.

```lean
ProofNetIR.LeanProp.ContextPermutation.symm_symm : ∀ {left right : List Prop} (permutation : ProofNetIR.LeanProp.ContextPermutation left right),
  permutation.symm.symm = permutation
```

### `ProofNetIR.LeanProp.ContextPermutation.nonempty_iff_listPerm`

Kind: theorem.

The proof-relevant exchange syntax represents exactly `List.Perm`, after
forgetting the computational witness behind `Nonempty`. The `Nonempty` wrapper
is essential: proposition-level `List.Perm` evidence cannot be eliminated
directly into the Type-valued permutation syntax.

```lean
ProofNetIR.LeanProp.ContextPermutation.nonempty_iff_listPerm : ∀ {left right : List Prop}, Nonempty (ProofNetIR.LeanProp.ContextPermutation left right) ↔ left.Perm right
```

### `ProofNetIR.LeanProp.Derivation`

Kind: inductive type.

A proof template indexed by an explicit persistent context, an exact-use
linear context, and a Lean proposition. Binary rules concatenate both input
contexts. Reusing a persistent assumption therefore produces two copies that
must be discharged by `persistentContract`; discarding one must pass through
`persistentWeaken`. No rule weakens or contracts the linear context.

```lean
ProofNetIR.LeanProp.Derivation : List Prop → List Prop → Prop → Type (u + 1)
```

### `ProofNetIR.LeanProp.Derivation.persistentExchange_nonempty_of_listPerm`

Kind: theorem.

Every proposition-level persistent-context permutation is admissible.
The result remains in `Nonempty` because `List.Perm` is proposition-valued,
whereas an explicit derivation is Type-valued computational data.

```lean
ProofNetIR.LeanProp.Derivation.persistentExchange_nonempty_of_listPerm : ∀ {source target linear : List Prop} {goal : Prop},
  source.Perm target →
    ∀ (derivation : ProofNetIR.LeanProp.Derivation source linear goal),
      Nonempty (ProofNetIR.LeanProp.Derivation target linear goal)
```

### `ProofNetIR.LeanProp.Derivation.linearExchange_nonempty_of_listPerm`

Kind: theorem.

Every proposition-level linear-context permutation is admissible, while
preserving the exact multiset of linear occurrences.

```lean
ProofNetIR.LeanProp.Derivation.linearExchange_nonempty_of_listPerm : ∀ {persistent source target : List Prop} {goal : Prop},
  source.Perm target →
    ∀ (derivation : ProofNetIR.LeanProp.Derivation persistent source goal),
      Nonempty (ProofNetIR.LeanProp.Derivation persistent target goal)
```

### `ProofNetIR.LeanProp.Derivation.linearAxiomCount`

Kind: definition.

Number of linear-axiom leaves in a proof template. Persistent structural
rules do not alter this count, while binary rules add the disjoint branches.

```lean
ProofNetIR.LeanProp.Derivation.linearAxiomCount : {persistent linear : List Prop} → {goal : Prop} → ProofNetIR.LeanProp.Derivation persistent linear goal → Nat
```

### `ProofNetIR.LeanProp.Derivation.linearAxiomCount_eq_length`

Kind: theorem.

Every linear context occurrence is represented by exactly one linear
axiom leaf. This is the bridge's syntactic exact-use invariant.

```lean
ProofNetIR.LeanProp.Derivation.linearAxiomCount_eq_length : ∀ {persistent linear : List Prop} {goal : Prop} (derivation : ProofNetIR.LeanProp.Derivation persistent linear goal),
  derivation.linearAxiomCount = linear.length
```

### `ProofNetIR.LeanProp.Derivation.toProof`

Kind: theorem.

Interpret a resource-explicit derivation as an actual Lean proof term.
The function is total and checked by the Lean kernel. Its recursion is also the
soundness proof for every public proof-template constructor.

```lean
ProofNetIR.LeanProp.Derivation.toProof : ∀ {persistent linear : List Prop} {goal : Prop} (derivation : ProofNetIR.LeanProp.Derivation persistent linear goal)
  (a : ProofNetIR.LeanProp.Assumptions persistent) (a : ProofNetIR.LeanProp.Assumptions linear), goal
```

### `ProofNetIR.LeanProp.Derivation.close`

Kind: theorem.

A closed bridge derivation reconstructs a closed Lean theorem.

```lean
ProofNetIR.LeanProp.Derivation.close : ∀ {goal : Prop} (derivation : ProofNetIR.LeanProp.Derivation [] [] goal), goal
```

### `ProofNetIR.LeanProp.Derivation.persistentStructuralSize`

Kind: definition.

Count persistent weakening and contraction nodes. Exchange and logical
rules do not contribute to this normalization measure.

```lean
ProofNetIR.LeanProp.Derivation.persistentStructuralSize : {persistent linear : List Prop} → {goal : Prop} → ProofNetIR.LeanProp.Derivation persistent linear goal → Nat
```

### `ProofNetIR.LeanProp.Derivation.PersistentStructurallyReduced`

Kind: definition.

A derivation contains no contraction whose immediate premise is a
persistent weakening, and all of its subderivations have the same property.

```lean
ProofNetIR.LeanProp.Derivation.PersistentStructurallyReduced : {persistent linear : List Prop} → {goal : Prop} → ProofNetIR.LeanProp.Derivation persistent linear goal → Prop
```

### `ProofNetIR.LeanProp.Derivation.normalizePersistentStructural`

Kind: definition.

Recursively cancel every immediate persistent contraction/weakening pair.
The dependent result type makes preservation of persistent context, linear
context, and goal part of the normalizer's kernel-checked type.

```lean
ProofNetIR.LeanProp.Derivation.normalizePersistentStructural : {persistent linear : List Prop} →
  {goal : Prop} →
    ProofNetIR.LeanProp.Derivation persistent linear goal → ProofNetIR.LeanProp.Derivation persistent linear goal
```

### `ProofNetIR.LeanProp.Derivation.normalizePersistentStructural_reduced`

Kind: theorem.

Normalization removes every persistent contraction/weakening redex,
including redexes nested below logical and exchange rules.

```lean
ProofNetIR.LeanProp.Derivation.normalizePersistentStructural_reduced : ∀ {persistent linear : List Prop} {goal : Prop} (derivation : ProofNetIR.LeanProp.Derivation persistent linear goal),
  derivation.normalizePersistentStructural.PersistentStructurallyReduced
```

### `ProofNetIR.LeanProp.Derivation.normalizePersistentStructural_eq_self_of_reduced`

Kind: theorem.

A reduced derivation is a fixed point of persistent structural
normalization.

```lean
ProofNetIR.LeanProp.Derivation.normalizePersistentStructural_eq_self_of_reduced : ∀ {persistent linear : List Prop} {goal : Prop} (derivation : ProofNetIR.LeanProp.Derivation persistent linear goal),
  derivation.PersistentStructurallyReduced → derivation.normalizePersistentStructural = derivation
```

### `ProofNetIR.LeanProp.Derivation.normalizePersistentStructural_idempotent`

Kind: theorem.

Persistent structural normalization is idempotent on every derivation.

```lean
ProofNetIR.LeanProp.Derivation.normalizePersistentStructural_idempotent : ∀ {persistent linear : List Prop} {goal : Prop} (derivation : ProofNetIR.LeanProp.Derivation persistent linear goal),
  derivation.normalizePersistentStructural.normalizePersistentStructural = derivation.normalizePersistentStructural
```

### `ProofNetIR.LeanProp.Derivation.normalizePersistentStructural_size_le`

Kind: theorem.

Persistent structural normalization never increases the number of
weakening/contraction nodes.

```lean
ProofNetIR.LeanProp.Derivation.normalizePersistentStructural_size_le : ∀ {persistent linear : List Prop} {goal : Prop} (derivation : ProofNetIR.LeanProp.Derivation persistent linear goal),
  derivation.normalizePersistentStructural.persistentStructuralSize ≤ derivation.persistentStructuralSize
```

### `ProofNetIR.LeanProp.Derivation.normalizePersistentStructural_contract_weaken`

Kind: theorem.

The typed normalizer cancels the persistent contraction/weakening
redex after recursively normalizing its premise.

```lean
ProofNetIR.LeanProp.Derivation.normalizePersistentStructural_contract_weaken : ∀ {persistent linear : List Prop} {shared goal : Prop}
  (derivation : ProofNetIR.LeanProp.Derivation (shared :: persistent) linear goal),
  derivation.persistentWeaken.persistentContract.normalizePersistentStructural =
    derivation.normalizePersistentStructural
```

### `ProofNetIR.LeanProp.Derivation.normalizePersistentStructural_linearAxiomCount`

Kind: theorem.

Typed normalization preserves the exact linear-resource count.

```lean
ProofNetIR.LeanProp.Derivation.normalizePersistentStructural_linearAxiomCount : ∀ {persistent linear : List Prop} {goal : Prop} (derivation : ProofNetIR.LeanProp.Derivation persistent linear goal),
  derivation.normalizePersistentStructural.linearAxiomCount = derivation.linearAxiomCount
```

### `ProofNetIR.LeanProp.Derivation.normalizePersistentStructural_toProof`

Kind: theorem.

Interpreting a normalized derivation yields the same proof proposition.
The theorem is pointwise so it does not require function extensionality.

```lean
ProofNetIR.LeanProp.Derivation.normalizePersistentStructural_toProof : ∀ {persistent linear : List Prop} {goal : Prop} (derivation : ProofNetIR.LeanProp.Derivation persistent linear goal)
  (persistentValues : ProofNetIR.LeanProp.Assumptions persistent)
  (linearValues : ProofNetIR.LeanProp.Assumptions linear), ⋯ = ⋯
```

### `ProofNetIR.LeanProp.Schema.Formula`

Kind: inductive type.

Serializable proposition syntax for the first schema version.

```lean
ProofNetIR.LeanProp.Schema.Formula : Type
```

### `ProofNetIR.LeanProp.Schema.Formula.evaluate`

Kind: definition.

Interpret schema atoms under an arbitrary Lean proposition valuation.

```lean
ProofNetIR.LeanProp.Schema.Formula.evaluate : (String → Prop) → ProofNetIR.LeanProp.Schema.Formula → Prop
```

### `ProofNetIR.LeanProp.Schema.Derivation`

Kind: inductive type.

Resource-explicit derivations over first-order proposition codes. The
indices make malformed rule applications unrepresentable after checking.

```lean
ProofNetIR.LeanProp.Schema.Derivation : List ProofNetIR.LeanProp.Schema.Formula →
  List ProofNetIR.LeanProp.Schema.Formula → ProofNetIR.LeanProp.Schema.Formula → Type
```

### `ProofNetIR.LeanProp.Schema.Derivation.instantiate`

Kind: definition.

Instantiate a first-order schema as a typed LeanProp derivation under any
atom valuation. This is the conservative bridge from generated data to the
kernel-interpreted calculus.

```lean
ProofNetIR.LeanProp.Schema.Derivation.instantiate : (valuation : String → Prop) →
  {persistent linear : List ProofNetIR.LeanProp.Schema.Formula} →
    {goal : ProofNetIR.LeanProp.Schema.Formula} →
      ProofNetIR.LeanProp.Schema.Derivation persistent linear goal →
        ProofNetIR.LeanProp.Derivation (List.map (ProofNetIR.LeanProp.Schema.Formula.evaluate valuation) persistent)
          (List.map (ProofNetIR.LeanProp.Schema.Formula.evaluate valuation) linear)
          (ProofNetIR.LeanProp.Schema.Formula.evaluate valuation goal)
```

### `ProofNetIR.LeanProp.Schema.PackedDerivation`

Kind: inductive type.

An existentially packed, named schema derivation for generated corpora.

```lean
ProofNetIR.LeanProp.Schema.PackedDerivation : Type
```

### `ProofNetIR.LeanProp.Schema.PackedDerivation.sound`

Kind: theorem.

Every packed schema reconstructs a Lean proof for every valuation and
matching pair of proof environments.

```lean
ProofNetIR.LeanProp.Schema.PackedDerivation.sound : ∀ (packed : ProofNetIR.LeanProp.Schema.PackedDerivation) (valuation : String → Prop)
  (persistentValues :
    ProofNetIR.LeanProp.Assumptions
      (List.map (ProofNetIR.LeanProp.Schema.Formula.evaluate valuation) packed.persistent))
  (linearValues :
    ProofNetIR.LeanProp.Assumptions (List.map (ProofNetIR.LeanProp.Schema.Formula.evaluate valuation) packed.linear)),
  ProofNetIR.LeanProp.Schema.Formula.evaluate valuation packed.goal
```

### `ProofNetIR.LeanProp.Schema.Raw.Permutation`

Kind: inductive type.

Unindexed exchange syntax accepted at the untrusted schema boundary.

```lean
ProofNetIR.LeanProp.Schema.Raw.Permutation : Type
```

### `ProofNetIR.LeanProp.Schema.Raw.Permutation.boundary?`

Kind: definition.

Infer the source and target context of unindexed exchange data.

```lean
ProofNetIR.LeanProp.Schema.Raw.Permutation.boundary? : ProofNetIR.LeanProp.Schema.Raw.Permutation →
  Option (List ProofNetIR.LeanProp.Schema.Formula × List ProofNetIR.LeanProp.Schema.Formula)
```

### `ProofNetIR.LeanProp.Schema.Raw.Permutation.boundary?_ofIndexed`

Kind: theorem.

Erasing an indexed exchange preserves its exact source/target boundary.

```lean
ProofNetIR.LeanProp.Schema.Raw.Permutation.boundary?_ofIndexed : ∀ {source target : List ProofNetIR.LeanProp.Schema.Formula}
  (permutation : ProofNetIR.LeanProp.Schema.ContextPermutation source target),
  (ProofNetIR.LeanProp.Schema.Raw.Permutation.ofIndexed permutation).boundary? = some (source, target)
```

### `ProofNetIR.LeanProp.Schema.Raw.ElaboratedPermutation`

Kind: inductive type.

An unindexed exchange elaborated into proof-relevant indexed data.

```lean
ProofNetIR.LeanProp.Schema.Raw.ElaboratedPermutation : Type
```

### `ProofNetIR.LeanProp.Schema.Raw.Permutation.elaborate?`

Kind: definition.

Elaborate raw exchange syntax, rejecting incompatible transitive steps.

```lean
ProofNetIR.LeanProp.Schema.Raw.Permutation.elaborate? : ProofNetIR.LeanProp.Schema.Raw.Permutation → Option ProofNetIR.LeanProp.Schema.Raw.ElaboratedPermutation
```

### `ProofNetIR.LeanProp.Schema.Raw.Permutation.boundary?_eq_elaborate?`

Kind: theorem.

Exchange elaboration succeeds on exactly the same source/target boundary
as the raw boundary checker.

```lean
ProofNetIR.LeanProp.Schema.Raw.Permutation.boundary?_eq_elaborate? : ∀ (permutation : ProofNetIR.LeanProp.Schema.Raw.Permutation),
  permutation.boundary? = ProofNetIR.LeanProp.Schema.Raw.Permutation.elaboratedBoundary✝ permutation.elaborate?
```

### `ProofNetIR.LeanProp.Schema.Raw.Derivation`

Kind: inductive type.

First-order, unindexed proof-template syntax for untrusted input.

```lean
ProofNetIR.LeanProp.Schema.Raw.Derivation : Type
```

### `ProofNetIR.LeanProp.Schema.Raw.Sequent`

Kind: inductive type.

A checker-inferred schema sequent.

```lean
ProofNetIR.LeanProp.Schema.Raw.Sequent : Type
```

### `ProofNetIR.LeanProp.Schema.Raw.ErrorCode`

Kind: inductive type.

Stable categories for untrusted-template diagnostics.

```lean
ProofNetIR.LeanProp.Schema.Raw.ErrorCode : Type
```

### `ProofNetIR.LeanProp.Schema.Raw.Error`

Kind: inductive type.

Path-aware checker failure. Child zero/one selects premise branches.

```lean
ProofNetIR.LeanProp.Schema.Raw.Error : Type
```

### `ProofNetIR.LeanProp.Schema.Raw.Error.render`

Kind: definition.

Human-readable diagnostic retaining the stable error code and path.

```lean
ProofNetIR.LeanProp.Schema.Raw.Error.render : ProofNetIR.LeanProp.Schema.Raw.Error → String
```

### `ProofNetIR.LeanProp.Schema.Raw.Derivation.infer?`

Kind: definition.

Public raw-template inference boundary.

```lean
ProofNetIR.LeanProp.Schema.Raw.Derivation.infer? : ProofNetIR.LeanProp.Schema.Raw.Derivation →
  Except ProofNetIR.LeanProp.Schema.Raw.Error ProofNetIR.LeanProp.Schema.Raw.Sequent
```

### `ProofNetIR.LeanProp.Schema.Raw.Derivation.ofIndexed`

Kind: definition.

Erase an indexed schema derivation to untrusted syntax.

```lean
ProofNetIR.LeanProp.Schema.Raw.Derivation.ofIndexed : {persistent linear : List ProofNetIR.LeanProp.Schema.Formula} →
  {goal : ProofNetIR.LeanProp.Schema.Formula} →
    ProofNetIR.LeanProp.Schema.Derivation persistent linear goal → ProofNetIR.LeanProp.Schema.Raw.Derivation
```

### `ProofNetIR.LeanProp.Schema.Raw.Derivation.infer?_ofIndexed`

Kind: theorem.

Exact public inference theorem for erased indexed derivations.

```lean
ProofNetIR.LeanProp.Schema.Raw.Derivation.infer?_ofIndexed : ∀ {persistent linear : List ProofNetIR.LeanProp.Schema.Formula} {goal : ProofNetIR.LeanProp.Schema.Formula}
  (derivation : ProofNetIR.LeanProp.Schema.Derivation persistent linear goal),
  (ProofNetIR.LeanProp.Schema.Raw.Derivation.ofIndexed derivation).infer? =
    Except.ok { persistent := persistent, linear := linear, goal := goal }
```

### `ProofNetIR.LeanProp.Schema.Raw.ElaboratedDerivation`

Kind: inductive type.

A raw proof template elaborated into an indexed schema derivation.

```lean
ProofNetIR.LeanProp.Schema.Raw.ElaboratedDerivation : Type
```

### `ProofNetIR.LeanProp.Schema.Raw.ElaboratedDerivation.sequent`

Kind: definition.

Forget the indexed witness while retaining its exact inferred boundary.

```lean
ProofNetIR.LeanProp.Schema.Raw.ElaboratedDerivation.sequent : ProofNetIR.LeanProp.Schema.Raw.ElaboratedDerivation → ProofNetIR.LeanProp.Schema.Raw.Sequent
```

### `ProofNetIR.LeanProp.Schema.Raw.ElaboratedDerivation.toPacked`

Kind: definition.

Package an elaborated derivation for valuation-independent soundness.

```lean
ProofNetIR.LeanProp.Schema.Raw.ElaboratedDerivation.toPacked : String → ProofNetIR.LeanProp.Schema.Raw.ElaboratedDerivation → ProofNetIR.LeanProp.Schema.PackedDerivation
```

### `ProofNetIR.LeanProp.Schema.Raw.Derivation.elaborate?`

Kind: definition.

Public executable raw-to-indexed elaboration boundary.

```lean
ProofNetIR.LeanProp.Schema.Raw.Derivation.elaborate? : ProofNetIR.LeanProp.Schema.Raw.Derivation →
  Except ProofNetIR.LeanProp.Schema.Raw.Error ProofNetIR.LeanProp.Schema.Raw.ElaboratedDerivation
```

### `ProofNetIR.LeanProp.Schema.Raw.Derivation.inferAt_eq_elaborateAt`

Kind: theorem.

Elaboration and inference have exactly the same success/failure result and
diagnostics after forgetting the indexed witness.

```lean
ProofNetIR.LeanProp.Schema.Raw.Derivation.inferAt_eq_elaborateAt : ∀ (derivation : ProofNetIR.LeanProp.Schema.Raw.Derivation) (path : List Nat),
  ProofNetIR.LeanProp.Schema.Raw.Derivation.inferAt path derivation =
    ProofNetIR.LeanProp.Schema.Raw.Derivation.sequentResult
      (ProofNetIR.LeanProp.Schema.Raw.Derivation.elaborateAt path derivation)
```

### `ProofNetIR.LeanProp.Schema.Raw.Derivation.elaborate?_complete`

Kind: theorem.

Every checker-accepted raw schema has an executable indexed elaboration
with exactly the inferred boundary.

```lean
ProofNetIR.LeanProp.Schema.Raw.Derivation.elaborate?_complete : ∀ {derivation : ProofNetIR.LeanProp.Schema.Raw.Derivation} {sequent : ProofNetIR.LeanProp.Schema.Raw.Sequent},
  derivation.infer? = Except.ok sequent →
    ∃ elaborated, derivation.elaborate? = Except.ok elaborated ∧ elaborated.sequent = sequent
```

### `ProofNetIR.LeanProp.Schema.Raw.InputError`

Kind: inductive type.

Structured failures at either the JSON boundary or the schema checker.

```lean
ProofNetIR.LeanProp.Schema.Raw.InputError : Type
```

### `ProofNetIR.LeanProp.Schema.Raw.InputError.render`

Kind: definition.

Render a wire error without discarding checker categories or child paths.

```lean
ProofNetIR.LeanProp.Schema.Raw.InputError.render : ProofNetIR.LeanProp.Schema.Raw.InputError → String
```

### `ProofNetIR.LeanProp.Schema.Raw.CheckedDerivation`

Kind: inductive type.

A raw schema accompanied by the indexed derivation built by the checker.

```lean
ProofNetIR.LeanProp.Schema.Raw.CheckedDerivation : Type
```

### `ProofNetIR.LeanProp.Schema.Raw.CheckedDerivation.sequent`

Kind: definition.

The exact persistent, linear, and goal boundary reconstructed by checking.

```lean
ProofNetIR.LeanProp.Schema.Raw.CheckedDerivation.sequent : ProofNetIR.LeanProp.Schema.Raw.CheckedDerivation → ProofNetIR.LeanProp.Schema.Raw.Sequent
```

### `ProofNetIR.LeanProp.Schema.Raw.CheckedDerivation.toPacked`

Kind: definition.

Package checked external input for valuation-independent soundness.

```lean
ProofNetIR.LeanProp.Schema.Raw.CheckedDerivation.toPacked : String → ProofNetIR.LeanProp.Schema.Raw.CheckedDerivation → ProofNetIR.LeanProp.Schema.PackedDerivation
```

### `ProofNetIR.LeanProp.Schema.Raw.CheckedDerivation.inferred`

Kind: theorem.

The independent formula-only checker returns the same accepted boundary.

```lean
ProofNetIR.LeanProp.Schema.Raw.CheckedDerivation.inferred : ∀ (checked : ProofNetIR.LeanProp.Schema.Raw.CheckedDerivation), checked.derivation.infer? = Except.ok checked.sequent
```

### `ProofNetIR.LeanProp.Schema.Raw.CheckedDerivation.sound`

Kind: theorem.

Every checked external schema reconstructs a Lean proof for every valuation
and matching persistent/linear proof environment.

```lean
ProofNetIR.LeanProp.Schema.Raw.CheckedDerivation.sound : ∀ (checked : ProofNetIR.LeanProp.Schema.Raw.CheckedDerivation) (valuation : String → Prop)
  (persistentValues :
    ProofNetIR.LeanProp.Assumptions
      (List.map (ProofNetIR.LeanProp.Schema.Formula.evaluate valuation) checked.elaborated.persistent))
  (linearValues :
    ProofNetIR.LeanProp.Assumptions
      (List.map (ProofNetIR.LeanProp.Schema.Formula.evaluate valuation) checked.elaborated.linear)),
  ProofNetIR.LeanProp.Schema.Formula.evaluate valuation checked.elaborated.goal
```

### `ProofNetIR.LeanProp.Schema.Raw.FormulaWire.toJson`

Kind: definition.

Deterministic JSON representation of a first-order schema formula.

```lean
ProofNetIR.LeanProp.Schema.Raw.FormulaWire.toJson : ProofNetIR.LeanProp.Schema.Formula → Lean.Json
```

### `ProofNetIR.LeanProp.Schema.Raw.FormulaWire.fromJsonAt`

Kind: definition.

Parse a formula at a supplied JSON path.

```lean
ProofNetIR.LeanProp.Schema.Raw.FormulaWire.fromJsonAt : String → Lean.Json → ProofNetIR.LeanProp.Schema.Raw.InputResult ProofNetIR.LeanProp.Schema.Formula
```

### `ProofNetIR.LeanProp.Schema.Raw.Permutation.toJson`

Kind: definition.

Deterministic JSON representation of raw exchange data.

```lean
ProofNetIR.LeanProp.Schema.Raw.Permutation.toJson : ProofNetIR.LeanProp.Schema.Raw.Permutation → Lean.Json
```

### `ProofNetIR.LeanProp.Schema.Raw.Permutation.fromJsonAt`

Kind: definition.

Parse raw exchange data at a supplied JSON path.

```lean
ProofNetIR.LeanProp.Schema.Raw.Permutation.fromJsonAt : String → Lean.Json → ProofNetIR.LeanProp.Schema.Raw.InputResult ProofNetIR.LeanProp.Schema.Raw.Permutation
```

### `ProofNetIR.LeanProp.Schema.Raw.Derivation.toJson`

Kind: definition.

Deterministic JSON representation of an unindexed proof schema.

```lean
ProofNetIR.LeanProp.Schema.Raw.Derivation.toJson : ProofNetIR.LeanProp.Schema.Raw.Derivation → Lean.Json
```

### `ProofNetIR.LeanProp.Schema.Raw.Derivation.fromJsonAt`

Kind: definition.

Parse a raw proof schema at a supplied JSON path.

```lean
ProofNetIR.LeanProp.Schema.Raw.Derivation.fromJsonAt : String → Lean.Json → ProofNetIR.LeanProp.Schema.Raw.InputResult ProofNetIR.LeanProp.Schema.Raw.Derivation
```

### `ProofNetIR.LeanProp.Schema.Raw.Derivation.canonicalJson`

Kind: definition.

Versioned deterministic JSON value for an unindexed LeanProp schema.

```lean
ProofNetIR.LeanProp.Schema.Raw.Derivation.canonicalJson : ProofNetIR.LeanProp.Schema.Raw.Derivation → Lean.Json
```

### `ProofNetIR.LeanProp.Schema.Raw.Derivation.canonicalString`

Kind: definition.

Compact canonical LeanProp schema JSON.

```lean
ProofNetIR.LeanProp.Schema.Raw.Derivation.canonicalString : ProofNetIR.LeanProp.Schema.Raw.Derivation → String
```

### `ProofNetIR.LeanProp.Schema.Raw.Derivation.fromJson`

Kind: definition.

Decode the first LeanProp schema wire version without asserting that its
rule applications are valid.

```lean
ProofNetIR.LeanProp.Schema.Raw.Derivation.fromJson : Lean.Json → ProofNetIR.LeanProp.Schema.Raw.InputResult ProofNetIR.LeanProp.Schema.Raw.Derivation
```

### `ProofNetIR.LeanProp.Schema.Raw.Derivation.fromString`

Kind: definition.

Parse versioned schema JSON into untrusted raw syntax.

```lean
ProofNetIR.LeanProp.Schema.Raw.Derivation.fromString : String → ProofNetIR.LeanProp.Schema.Raw.InputResult ProofNetIR.LeanProp.Schema.Raw.Derivation
```

### `ProofNetIR.LeanProp.Schema.Raw.Derivation.check`

Kind: definition.

Check parsed raw syntax and retain its kernel-typed indexed derivation.

```lean
ProofNetIR.LeanProp.Schema.Raw.Derivation.check : ProofNetIR.LeanProp.Schema.Raw.Derivation →
  ProofNetIR.LeanProp.Schema.Raw.InputResult ProofNetIR.LeanProp.Schema.Raw.CheckedDerivation
```

### `ProofNetIR.LeanProp.Schema.Raw.Derivation.checkedFromJson`

Kind: definition.

Decode JSON and expose a schema only after resource-aware inference
succeeds.

```lean
ProofNetIR.LeanProp.Schema.Raw.Derivation.checkedFromJson : Lean.Json → ProofNetIR.LeanProp.Schema.Raw.InputResult ProofNetIR.LeanProp.Schema.Raw.CheckedDerivation
```

### `ProofNetIR.LeanProp.Schema.Raw.Derivation.checkedFromString`

Kind: definition.

Safe entry point for untrusted LeanProp schema strings.

```lean
ProofNetIR.LeanProp.Schema.Raw.Derivation.checkedFromString : String → ProofNetIR.LeanProp.Schema.Raw.InputResult ProofNetIR.LeanProp.Schema.Raw.CheckedDerivation
```

### `ProofNetIR.LeanProp.Schema.Corpus.generated`

Kind: definition.

Six rule strata per index, with disjoint atom names across indices.

```lean
ProofNetIR.LeanProp.Schema.Corpus.generated : Nat → List ProofNetIR.LeanProp.Schema.PackedDerivation
```