Holography Ledger State Horizon Context All Ones Cut Does Not Separate Debit Cre

The all-ones blind spot

A ledger is a discrete record of events, and in Recognition Science each event is a tick that moves value between accounts. The framework models a ledger state with a list of debit and credit entries, and a legal atomic tick is one posting step that changes the state. The declaration allOnes_cut_does_not_separate_debit_credit says something specific about what an outside observer can learn from the ledger's boundary: if the boundary reading is all ones, meaning every exterior bit is set to 1, then that reading alone cannot distinguish a debit posting from a credit posting that shares the same prior state. The cut, the boundary record derived from the ledger, is blind to which side of the account moved.

This is a theorem in the framework's machine-checked library of formal theorems, proved for any positive number of accounts. It is not a statement about the real world; it is a statement about the framework's own definitions. The framework defines an exterior reading as a function that assigns 1 to every position, and the theorem shows that this reading, taken on its own, does not separate the two possible posting steps. The practical consequence is that a boundary observer who sees only the all-ones reading cannot tell whether a debit or a credit was posted. The framework's own ledger state, by contrast, does separate them: the theorem post_account_side_unique proves that a posting to a specific account on a specific side is unique, so the full ledger state carries the information the boundary reading lacks.

What the theorem does not claim is just as important. It does not say that all-ones readings are the only blind spot, nor that the boundary can never separate debit from credit. It does not say that the framework has solved the problem of identifying events from boundary data alone. The declaration is a named residual, a known limitation that the framework's own documentation flags as a trigger for further work. It is a precise negative result: the all-ones exterior reading, from totals alone, does not separate distinct posting steps that share a pre-state. That is all it establishes, and it establishes it exactly.

/--
Obstruction witness: debit and credit posts from the zero ledger are distinct
legal ticks of equal committed size. Their all-ones cuts are HEq (same aperture
count). Totals alone do not yield a separating exterior-channel enumeration
(C7/C6 escalation trigger).
-/
theorem allOnes_cut_does_not_separate_debit_credit
    (d : Nat) [NeZero d] :
    let L0 : LedgerState d := { debit := fun _ => 0, credit := fun _ => 0 }
    let k : Fin d := ⟨0, Nat.pos_of_ne_zero (NeZero.ne d)⟩
    let Ldebit := post L0 k Side.debit
    let Lcredit := post L0 k Side.credit
    Ldebit ≠ Lcredit ∧
      ledgerCommittedUnits Ldebit = ledgerCommittedUnits Lcredit ∧
      NonnegLedger (d := d) L0 ∧
      LegalAtomicTick (d := d) L0 Ldebit ∧
      LegalAtomicTick (d := d) L0 Lcredit ∧
      HEq (cutOfLedgerState Ldebit) (cutOfLedgerState Lcredit) := by
  intro L0 k Ldebit Lcredit
  have hn : NonnegLedger (d := d) L0 := ⟨fun _ => le_rfl, fun _ => le_rfl⟩
  have hunits :
      ledgerCommittedUnits Ldebit = ledgerCommittedUnits Lcredit := by
    simp [Ldebit, Lcredit, ledgerCommittedUnits_post hn]
  refine ⟨?_, hunits, hn, legalAtomicTick_of_post L0 k Side.debit,
    legalAtomicTick_of_post L0 k Side.credit, ?_⟩
  · intro heq
    have : Ldebit.debit k = Lcredit.debit k := congrArg (fun M => M.debit k) heq
    simp [Ldebit, Lcredit, post] at this
  · change HEq (mkLedgerCut (ledgerCommittedUnits Ldebit))
        (mkLedgerCut (ledgerCommittedUnits Lcredit))
    rw [hunits]

/-- Canonical exterior reading: one posted-`1` bit per committed unit. -/
def exteriorReading (n : Nat) : Fin n → ZMod 2 :=
  fun _ => 1

/-- The changed `(account, side)` of a represented post is unique. -/
theorem post_account_side_unique {d : Nat} {L : LedgerState d}
    {k₁ k₂ : Fin d} {s₁ s₂ : Side}
    (h₂ : post L k₁ s₁ = post L k₂ s₂) :
    k₁ = k₂ ∧ s₁ = s₂ := by
  classical
  cases s₁ with
  | debit =>
    cases s₂ with
    | debit =>
      refine ⟨?_, rfl⟩
      by_contra hne
      have : (post L k₁ Side.debit).debit k₁ = (post L k₂ Side.debit).debit k₁ :=
        congrArg (fun M => M.debit k₁) h₂
      simp [post, hne] at this
    | credit =>
      exfalso
      have : (post L k₁ Side.debit).credit k₂ = (post L k₂ Side.credit).credit k₂ :=
        congrArg (fun M => M.credit k₂) h₂
      simp [post] at this
  | credit =>
    cases s₂ with
    | credit =>
      refine ⟨?_, rfl⟩
      by_contra hne
      have : (post L k₁ Side.credit).credit k₁ = (post L k₂ Side.credit).credit k₁ :=
        congrArg (fun M => M.credit k₁) h₂
      simp [post, hne] at this
    | debit =>
      exfalso
      have : (post L k₁ Side.credit).debit k₂ = (post L k₂ Side.debit).debit k₂ :=
        congrArg (fun M => M.debit k₂) h₂
      simp [post] at this

What this page does not claim

The theorem does not say that all-ones readings are the only boundary readings that fail to separate debit from credit. The theorem does not say that the boundary can never separate debit from credit under any reading. The theorem does not claim to solve the problem of identifying events from boundary data alone.

Verify this page

Every tagged claim above names its theorem. To check one yourself rather than trust this page, elaborate the source module with Lean 4 and audit its axiom basis:

$ lake env lean IndisputableMonolith/Holography/LedgerStateHorizonContext.lean
expected axiom basis: [propext, Classical.choice, Quot.sound] (the Lean kernel's standard three; no RS-specific axioms)

A page whose claims cannot be reproduced this way does not ship. In production, every anchor links to the exact declaration in the public source release, and this block carries the build receipt for the page itself.

Derived articles

This page is generated by a question-recursion engine: the questions its answers raise become the next pages. The current agenda, with open targets marked red: