Planned local formalization

Smoothed Picard HMC and the proxy warm start

Producer: low-accuracy transport control, then an implementable proxy warm start.

Common setting and conventions

\[d\ge1,\quad V\in C^2(\mathbb R^d),\quad 0<\alpha I\preceq\nabla^2V(x)\preceq\beta I,\quad \kappa=\beta/\alpha,\quad \pi(dx)=Z^{-1}e^{-V(x)}dx\]

The Hessian inequalities hold at every point; alpha and beta are positive real numbers. Separate Hessian-to-chord and Gibbs-integrability proofs support the compiled normalized PBPS augmentation certificate: positive Gibbs integral, probability and exact product-volume joint density. Consult linked cells for independent-review and admission states. Conditional kernels, the sampling process and its guarantees remain separate.
TV(P,Q) means sup over measurable events of |P(A)-Q(A)|. For probability laws with densities it is half their L1 distance.
R_2(P||Q)=log integral (dP/dQ)^2 dQ when P is absolutely continuous with respect to Q, and infinity otherwise. The PBPS paper writes D_2 and calls the target mu; here the common target is pi.
Expected oracle queries are not worst-case runtime. Reference-point preparation, proximal access and gradient-only reductions must be charged under the particular theorem's model.

RED · source theorem known · local proof open

Low-accuracy W2 guarantee

Source: 2609.06906v1. SPHMC Theorem 1.1; Algorithm 3.2; Section 4.5; Appendix D

Statement

Given a reference point with small gradient, the source algorithm outputs a probability law satisfying the displayed normalized Wasserstein error. This theorem counts gradient and proximal queries; gradient-only implementation is a separate reduction.

The common C2 strong-convexity/smoothness setting.
0 < epsilon <= 1; a supplied x_ref satisfies ||grad V(x_ref)|| <= sqrt(alpha d).
Use the source algorithm and its parameter choices, not an arbitrary Picard or HMC discretization.

\[\sqrt\alpha W_2(\widehat\pi,\pi)\le\varepsilon,\qquad \mathbb E Q_{\nabla,\mathrm{prox}}=O\!\left[\left(\kappa^2+\kappa^{7/6}d^{1/6}\varepsilon^{-1/3}\right)\log^4\frac{e\kappa d}{\varepsilon}\right]\]

Lean statement — not formalized yet

A future declaration must bind the probability laws, normalization, regularity, source algorithm and oracle model explicitly. The formula is a source theorem contract, not Lean code.

No corresponding ASTIS declaration is asserted. Search locations below are candidates, not established dependencies or copied library proofs.

Proof architecture and calculations

This is a source-linked proof route, not a complete reconstruction of all cited lemmas. The dependencies below remain separate formalization tasks.

Smooth the density
\[e^{-V_\eta}=e^{-V}*\mathcal N(0,\eta I),\qquad \nabla V_\eta(y)=\mathbb E[\nabla V(X)\mid X+\sqrt\eta G=y]\]
This is not the Gaussian average of V. Differentiation under the integral and a specified conditional-law version justify the score identity. The implementable score estimator has bias as well as variance; it is not assumed exactly unbiased.
Source: 2609.06906v1. Section 3.1, (3.1)–(3.2); Section 4.1
Integrate the smoothed Hamiltonian equation
\[X_t=X_0+tP_0-\int_0^t(t-s)\nabla V_\eta(X_s)\,ds\]
Picard iteration approximates the trajectory, while Chebyshev–Lobatto quadrature approximates its integrals. Smoothing regularity, quadrature remainder and stochastic score error are separate inputs to the local-error estimate.
Source: 2609.06906v1. Sections 3.2, 4.2–4.4; Appendix B
Budget all three errors
\[W_2(\widehat\pi,\pi)\le W_2(\widehat\pi,\pi_\eta)+W_2(\pi_\eta,\pi)\]
The first term includes iteration and numerical errors; the second is the smoothing bias. Finite second moments and the exact-kernel contraction must be supplied before using this triangle inequality.
Source: 2609.06906v1. Section 4.5; Appendix C.3

Lean proof — not formalized yet

Formalization will first match the named technology interfaces, then assemble this source theorem. No placeholder proof or source-cited wrapper has been added.

No corresponding ASTIS declaration is asserted. Search locations below are candidates, not established dependencies or copied library proofs.

Strict boundary

No Wq, Renyi warmness, exact stationarity of a discretization, or cost-free proximal oracle follows from this W2 statement.

RED · source theorem known · local proof open

An implementable law near a Renyi-warm proxy

Source: 2609.06906v1. SPHMC Theorem 1.2; Theorem 7.1(ii); Sections 5–6

Statement

For every allowed delta the algorithm produces the actual law below. A second, existential comparison law is close in TV and has bounded order-2 Renyi divergence. The comparison law need not be directly sampled.

The common setting and the same reference-point bound as Theorem 1.1.
0 < delta < 1/2.
The recursive generator uses higher-moment smoothed sampling and terminal RGO implementation; this is not a general W2-to-Renyi implication.

\[\exists\widehat\pi_\delta^\dagger:\quad \operatorname{TV}(\widehat\pi_\delta,\widehat\pi_\delta^\dagger)\le\delta,\quad R_2(\widehat\pi_\delta^\dagger\Vert\pi)\le1,\qquad \mathbb E Q_\nabla=O\!\left(\kappa^{7/6}d^{1/6}\log^9\frac{e\kappa d}{\delta}\right)\]

Lean statement — not formalized yet

A future declaration must bind the probability laws, normalization, regularity, source algorithm and oracle model explicitly. The formula is a source theorem contract, not Lean code.

No corresponding ASTIS declaration is asserted. Search locations below are candidates, not established dependencies or copied library proofs.

Proof architecture and calculations

This is a source-linked proof route, not a complete reconstruction of all cited lemmas. The dependencies below remain separate formalization tasks.

Turn a moment bound into a nearby bounded-displacement coupling
\[W_p(P,Q)\le r\quad\Longrightarrow\quad\exists P^\dagger:\ \operatorname{TV}(P,P^\dagger)\le\delta,\quad W_\infty(P^\dagger,Q)\le r\delta^{-1/p}\]
For p >= 2 and finite p-moments, replace a coupled sample by its partner on the event where displacement exceeds r delta^(-1/p). Markov's inequality bounds that event; measurability and coupling attainment must be justified.
Source: 2609.06906v1. Lemma 6.2
Regularize both laws before measuring divergence
\[R_q(P^\dagger*\gamma_\tau\Vert Q*\gamma_\tau)\le\frac{qW_p(P,Q)^2}{2\tau\delta^{2/p}},\qquad q>1,\quad\tau>0\]
A Gaussian reverse-transport bound applies after convolution. Recursive conditional/RGO updates then recover the desired unsmoothed target; deleting that recursion would change the theorem.
Source: 2609.06906v1. Lemma 6.3(ii); Theorems 6.1 and 6.5
Track the moving conditional target and oracle bill
\[(A^+)^{-1}=A^{-1}+a^{-1},\qquad u^+=A^+(u/A+y/a)\]
Completing the square closes the RGO family under another RGO. The recursive stages and outer proximal sampler improve conditioning; the kappa-squared setup term from Theorem 1.1 is not silently discarded.
Source: 2609.06906v1. Lemma 6.4; Sections 6.3–6.4 and 7.1

Lean proof — not formalized yet

Formalization will first match the named technology interfaces, then assemble this source theorem. No placeholder proof or source-cited wrapper has been added.

No corresponding ASTIS declaration is asserted. Search locations below are candidates, not established dependencies or copied library proofs.

Strict boundary

Only the proxy has the displayed Renyi certificate. Genuine Renyi warmness of the actual output requires the stronger W_psi2 input in the separate source theorem.

Expand reusable prerequisites and next packets →

Supporting Hessian-to-strong-convexity implication

Fan Chen, Sinho Chewi, Jianfeng Lu and Matthew S. Zhang provide the C² potential and Hessian-sandwich setting in the two cited v1 papers. The supporting implication and line-restriction exposition are ASTIS's mathematical expansion, not copied prose, a source correction or either full sampler theorem.

arXiv:2609.06906v1; shared assumption in arXiv:2609.06905v1 · Introduction equation (1.1) in both companion papers; lower-Hessian analytic prerequisite only · faithful paraphrase

Complete source statement (ASTIS restatement)

Both companion papers work with a C² Euclidean potential V and constants 0<α≤β such that αI≼∇²V(x)≼βI at every x. The supporting lower-curvature implication selected here is: if D²V(x)[v,v]≥α‖v‖² for all points x and directions v, then V(ax+by)≤aV(x)+bV(y)−αab‖x−y‖²/2 for every x,y and a,b≥0 with a+b=1. The upper Hessian bound is unnecessary for this implication. ASTIS proves the supporting implication more generally on any real normed space for any real α, retaining genuine everywhere C² regularity.

The primary setting is V∈C²(R^d), 0<α≤β, and αI≼∇²V(x)≼βI for every x.
The selected supporting implication only uses genuine C² regularity and D²V(x)[v,v]≥α‖v‖² for every x,v. In Euclidean coordinates this is the quadratic-form meaning of the lower matrix inequality.
All lines lie in the full state space. The target chord weights are nonnegative real numbers summing to one.
The normed-space/arbitrary-real-modulus generalization is confined to the analytic implication; normalization consumers separately require positive modulus, finite dimension and canonical volume.

primary Hessian setting

\[V\in C^2(\mathbb R^d),\quad0<\alpha\le\beta,\quad\alpha I\preceq\nabla^2V(x)\preceq\beta I\quad(\forall x).\]

selected lower-curvature consequence

\[D^2V(x)[v,v]\ge\alpha\|v\|^2\quad\Longrightarrow\quad V(ax+by)\le aV(x)+bV(y)-\frac\alpha2ab\|x-y\|^2,\quad a,b\ge0,\ a+b=1.\]

Read the formalized proofs

Each statement and proof below has its own closed Lean disclosure. ASTIS parents, Mathlib calls and external mathematical sources are distinguished in each proof.

ASTIS mathematical exposition

From a genuine Hessian lower bound to strong convexity

AutoSamplingTheory.TechnicalLemmas.Analysis.HessianStrongConvexity.strongConvexOn_univ_of_fderiv2_lower · theorem · Teaching coverage

Statement

Let E be a real normed space, let V:E→R be twice continuously Fréchet differentiable everywhere, and let α be any real number. Suppose D²V(x)[v,v]≥α‖v‖² for every x,v∈E. Then V is α-strongly convex on the whole space in the chord convention below. No finite dimension, completeness, inner product, positive α, upper Hessian bound, measure or normalizer is an additional hypothesis.

\[D^2V(x)[v,v]\ge\alpha\|v\|^2\quad(\forall x,v\in E)\quad\Longrightarrow\quad V(ax+by)\le aV(x)+bV(y)-\frac\alpha2ab\|x-y\|^2\quad(a,b\ge0,\ a+b=1).\]

All objects and hypotheses

ContDiff ℝ 2 V is a genuine C² witness. D²V(x)[v,v] means (fderiv ℝ (fderiv ℝ V) x v) v; the regularity hypothesis ensures these totalized operators represent actual derivatives.
The Hessian lower bound holds at every point and in every direction, not almost everywhere or only along algorithmic iterates.
The papers use Euclidean spaces and 0<α≤β with an upper Hessian bound βI. This supporting implication only needs their lower bound, and remains valid on arbitrary real normed spaces for any real α.
The domain is the whole vector space, so every affine line used in the proof is admissible. No boundary extension or differentiability-within-set convention is hidden.

Mathematical proof

1. Restrict to a line and compensate its curvature

Fix x,y∈E and set v=y−x and c=α‖v‖². Restrict V to the line ℓ(t)=x+tv, then subtract the scalar quadratic ct²/2. The norm of v is a fixed number: the proof never differentiates the norm on E, which is why no inner product or smooth norm is needed.

\[\ell(t)=x+tv,\qquad c=\alpha\|v\|^2,\qquad q(t)=V(\ell(t))-\frac c2t^2.\]

Corresponding Lean step

The proof defines v, c and q locally after opening the StrongConvexOn chord goal. hV.differentiable gives differentiability of V; hV.fderiv_right at order one gives differentiability of its actual first derivative. hline is the derivative witness for the affine line.

2. Calculate two genuine scalar derivatives

The chain rule differentiates V along the constant direction v. Applying the chain rule to DV and then evaluating at the fixed vector v gives the second derivative. The assumed diagonal Hessian inequality therefore makes the compensated second derivative nonnegative.

\[q'(t)=DV(\ell(t))[v]-ct,\qquad q''(t)=D^2V(\ell(t))[v,v]-c\ge0.\]

Corresponding Lean step

hq' and hq'' are HasDerivAt proofs, obtained from HasFDerivAt.comp_hasDerivAt, HasDerivAt.clm_apply and the scalar polynomial rules. Explicit reflexivity conversions reconcile definitionally equal scalar instances; they add no mathematical premise. hH supplies the final nonnegativity.

3. Use one-dimensional convexity

A scalar function with the displayed genuine first and second derivatives and nonnegative second derivative is convex. Continuity of q follows from its first derivative witness. Applying its chord inequality at 0 and 1 with weights a,b≥0 and a+b=1 controls q(b).

\[q(b)\le aq(0)+bq(1)=aV(x)+b\left(V(y)-\frac c2\right).\]

Corresponding Lean step

convexOn_of_hasDerivWithinAt2_nonneg is applied on Set.univ. Each whole-line HasDerivAt witness supplies the required HasDerivWithinAt witness. hconv.2 then yields hchord at the endpoints 0 and 1.

4. Recover the exact strong-convexity constant

Since x+b(y−x)=ax+by and ‖y−x‖=‖x−y‖, rearrange the scalar chord inequality and use b(1−b)=ab. This is algebra, not multiplication of an inequality by α, so it is valid even when α is zero or negative.

\[V(ax+by)\le aV(x)+bV(y)-\frac c2(b-b^2)=aV(x)+bV(y)-\frac\alpha2ab\|x-y\|^2.\]

Corresponding Lean step

hxy and hend identify the line points with the desired chord and endpoint; norm_sub_rev identifies the two displacement norms. Substituting a=1−b and polynomial arithmetic gives the defining StrongConvexOn inequality with exactly α/2.

Lean statement · strongConvexOn_univ_of_fderiv2_lower

The public theorem quantifies over any real normed E, V:E→ℝ and α:ℝ. Its two hypotheses are ContDiff ℝ 2 V and the everywhere, every-direction nested-fderiv diagonal lower bound. The conclusion is Mathlib StrongConvexOn Set.univ α V. There is no assumed gradient or Hessian field with a separate unproved identification.

Braces mark parameters Lean can infer; square brackets request structures such as a measurable space or probability measure. Named hypotheses are mathematical premises, not facts established by this declaration. Section parameters are described in the mathematical hypotheses above; the module link retains their exact source context.

theorem strongConvexOn_univ_of_fderiv2_lower
    {E : Type*} [NormedAddCommGroup E] [NormedSpace ℝ E]
    {V : E → ℝ} {α : ℝ}
    (hV : ContDiff ℝ 2 V)
    (hH : ∀ x v : E, α * ‖v‖ ^ 2 ≤ (fderiv ℝ (fderiv ℝ V) x v) v) :
    StrongConvexOn (Set.univ : Set E) α V

Exact module and namespace context

Lean proof · strongConvexOn_univ_of_fderiv2_lower

This declaration is a new mathematical adapter built from Mathlib calculus and one-dimensional convexity. It calls no ASTIS production theorem. In the focused tests, its positive-α finite-dimensional Borel inner-product specialization feeds the existing ASTIS StrongConvexGibbsIntegrability theorem. The tests derive Integrable and a strictly positive canonical-volume Gibbs integral, then an actual IsProbabilityMeasure for volume.tilted(-V), which supplies the probability input of the existing quadratic_tilt_tilt RGO consumer. The tests assume neither StrongConvexOn nor integrability. Separate tests cover α=0 and zero dimension.

theorem strongConvexOn_univ_of_fderiv2_lower
    {E : Type*} [NormedAddCommGroup E] [NormedSpace ℝ E]
    {V : E → ℝ} {α : ℝ}
    (hV : ContDiff ℝ 2 V)
    (hH : ∀ x v : E, α * ‖v‖ ^ 2 ≤ (fderiv ℝ (fderiv ℝ V) x v) v) :
    StrongConvexOn (Set.univ : Set E) α V := by
  have hVd : Differentiable ℝ V := hV.differentiable (by norm_num)
  have hVdd : Differentiable ℝ (fderiv ℝ V) :=
    (hV.fderiv_right (m := 1) (by norm_num)).differentiable_one
  refine ⟨convex_univ, ?_⟩
  intro x _ y _ a b ha hb hab
  let v : E := y - x
  let c : ℝ := α * ‖v‖ ^ 2
  let q : ℝ → ℝ := fun t => V (x + t • v) - c / 2 * t ^ 2
  let q' : ℝ → ℝ := fun t => fderiv ℝ V (x + t • v) v - c * t
  let q'' : ℝ → ℝ := fun t =>
    (fderiv ℝ (fderiv ℝ V) (x + t • v) v) v - c
  have hline (t : ℝ) : HasDerivAt (fun s : ℝ => x + s • v) v t := by
    simpa using ((hasDerivAt_id t).smul_const v).const_add x
  have hq' (t : ℝ) : HasDerivAt q (q' t) t := by
    have hquadratic : HasDerivAt (fun s : ℝ => c / 2 * s ^ 2) (c * t) t := by
      convert ((hasDerivAt_id t).pow 2).const_mul (c / 2) using 1 <;>
        first | rfl | (norm_num [id_eq]; ring)
    convert ((hVd _).hasFDerivAt.comp_hasDerivAt t (hline t)).sub hquadratic
      using 1 <;> rfl
  have hq'' (t : ℝ) : HasDerivAt q' (q'' t) t := by
    have hfirst := ((hVdd _).hasFDerivAt.comp_hasDerivAt t (hline t)).clm_apply
      (hasDerivAt_const t v)
    convert hfirst.sub ((hasDerivAt_id t).const_mul c) using 1 <;>
      first | rfl | simp [q'', ContinuousLinearMap.map_zero]
  have hconv : ConvexOn ℝ Set.univ q :=
    convexOn_of_hasDerivWithinAt2_nonneg convex_univ
      (fun t _ => (hq' t).continuousAt.continuousWithinAt)
      (fun t _ => (hq' t).hasDerivWithinAt)
      (fun t _ => (hq'' t).hasDerivWithinAt)
      (fun t _ => sub_nonneg.mpr (hH (x + t • v) v))
  have hchord := hconv.2 (x := 0) (Set.mem_univ _) (y := 1) (Set.mem_univ _)
    ha hb hab
  have hxy : x + b • v = a • x + b • y := by
    dsimp only [v]
    rw [show a = 1 - b by linarith]
    module
  have hend : x + v = y := by simp [v]
  simp only [q, smul_eq_mul, mul_zero, mul_one, zero_add, zero_smul, add_zero,
    one_pow, one_smul] at hchord
  norm_num only [zero_pow, mul_zero, sub_zero] at hchord
  rw [hxy, hend] at hchord
  have hnorm : ‖v‖ ^ 2 = ‖x - y‖ ^ 2 := by
    dsimp only [v]
    rw [norm_sub_rev]
  change V (a • x + b • y) ≤ a * V x + b * V y - a * b * (α / 2 * ‖x - y‖ ^ 2)
  dsimp only [c] at hchord
  rw [hnorm] at hchord
  rw [show a = 1 - b by linarith] at hchord ⊢
  nlinarith

end AutoSamplingTheory.TechnicalLemmas.Analysis.HessianStrongConvexity

Exact module and namespace context

Source assumptions versus formal assumptions

Source	Actual Lean	Difference kind	Why it matters
V is everywhere C²	ContDiff ℝ 2 V	same	This supplies actual first and second Fréchet derivatives, rather than relying on totalized derivative notation alone.
αI≼∇²V(x) pointwise	∀ x v, α*‖v‖² ≤ (fderiv ℝ (fderiv ℝ V) x v) v	same	For a C² Euclidean potential this is the defining quadratic-form meaning of the Hessian lower bound. No separate field is assumed to be the Hessian.
Euclidean finite-dimensional state space	Any real normed space, including zero dimension	generalization	The proof differentiates only a scalar line and its scalar quadratic compensation, not the squared norm on the ambient space. No inner product, completeness or finite dimension is used.
0<α≤β and the additional upper Hessian bound βI	Arbitrary α:ℝ; no β or upper Hessian bound	generalization	Only the lower bound controls the compensated second derivative. The concluding algebra works for any α. This does not remove positivity or smoothness conditions from either source sampling theorem.
Strong convexity in the C² Hessian convention	StrongConvexOn Set.univ α V, with chord correction αab‖x−y‖²/2	source-implicit	The selected analytic expansion proves the conversion to the exact chord normalization. It does not assume StrongConvexOn or change α to a weaker constant.

One analytic prerequisite shared by both papers. No upper-Hessian theorem, entire Gibbs/RGO initialization, invariance, discrepancy or query-cost guarantee is proved by this declaration.

Encoder–denoiser: accepted · equivalent-after-elaboration

Detected semantic differences

domains: The analytic theorem is explicitly generalized from the source's Euclidean space to arbitrary real normed spaces, including zero dimension and spaces not assumed complete. — The generalization is stated in the extraction and lesson and justified by restriction to real affine lines. No derivative of the ambient norm, volume construction or inner-product identity is required.
assumptions: The source's 0<α≤β and upper Hessian bound are reduced to the lower derivative bound with arbitrary real α for this supporting implication only. — The proof needs only q''≥0 after subtracting c=α‖v‖². The α=0 and zero-dimensional arbitrary-α tests compile. Negative α is allowed in the chord convention but does not establish ordinary convexity or finite Gibbs normalization; source consumers retain their own positivity requirements.
scopes: The implication is an attributed ASTIS mathematical expansion of the source Hessian assumptions, not an additional theorem claimed to appear in either paper. — Both primary Introduction (1.1) statements supply the C² Hessian-sandwich setting. The extraction, attribution and role prerequisite transparently identify the new supporting hessian-to-chord proof and no larger source conclusion.
conclusion: Gibbs integrability, positive normalization, probability and RGO closure are verified downstream test consumers rather than additional production conclusions of this declaration. — Those tests add positive α and finite-dimensional Borel inner-product structure, then use separate compiled ASTIS theorems. No such measure-theoretic hypothesis or conclusion occurs in the Hessian adapter itself, and no sampler or process result is inferred.

A generalization is not a source correction. Proposed missing conditions require separate independent repair review. No proposed repair silently changes the original theorem.

Scope and omitted-condition boundaries

This is the supporting analytic meaning of the lower-Hessian part of the papers' C² potential assumptions, not either complete sampling theorem.
The production theorem does not prove an upper-Hessian smoothness bound, a condition-number update, Gibbs integrability, a minimizer, an invariant kernel, output error or query complexity. Its tests exercise normalization and RGO consumers under their own required positive-modulus and finite-dimensional measure hypotheses.
For a C² Euclidean potential, the source matrix inequality αI≼∇²V(x) means exactly the displayed diagonal quadratic-form lower bound. This declaration uses the canonical second Fréchet derivative, not an arbitrary field labelled Hessian, and does not introduce a coordinate-matrix representation API.
The extension to any real normed space and arbitrary α concerns this analytic implication only. It is not an infinite-dimensional probability normalization or nonpositive-curvature sampling result.

Source and reuse

ASTIS parents called

Mathlib API called (external library)

ContDiff.differentiable
ContDiff.fderiv_right
ContDiff.differentiable_one
HasFDerivAt.comp_hasDerivAt
HasDerivAt.clm_apply
HasDerivAt.pow
HasDerivAt.const_mul
HasDerivAt.sub
convexOn_of_hasDerivWithinAt2_nonneg
norm_sub_rev

Mathematical sources

Chen, Chewi, Lu and Zhang, Smoothed Picard Hamiltonian Monte Carlo v1, Introduction (1.1) — The C² Euclidean potential and pointwise Hessian sandwich supply the source setting. The line-restriction proof is ASTIS's expanded supporting argument, not quoted source prose or full sampler formalization.
Chen, Chewi, Lu and Zhang, Proximal Bouncy Particle Sampler v1, Introduction (1.1) — The same C² lower-Hessian assumption supplies a second consumer of this canonical shared analytic adapter.

ASTIS prose is not a quotation or a source-equivalence certificate. Definitions and aliases are explained as constructions, not counted as new mathematical proofs.

Which proof edges are actually covered?

TODO — not closed by these contributions Derive the exact α-strong-convexity chord inequality from the genuine C² lower Hessian bound
TODO — not closed by these contributions Combine source-potential specializations with the separate Gibbs, oracle and sampling-theorem obligations

A common Markov kernel cannot amplify total-variation error

Fan Chen, Sinho Chewi, Jianfeng Lu and Matthew S. Zhang. ASTIS expands the selected standard data-processing step; no author endorsement or full theorem formalization is implied.

arXiv:2609.06906v1 · Section 7.2, proof of Theorem 1.3: data-processing display after constructing the actual and proxy input laws · faithful paraphrase

Complete source statement (ASTIS restatement)

SPHMC v1 Section 7.2, proof of Theorem 1.3, passes the actual/proxy input TV error through the same proximal BPS Markov kernel. ASTIS expands only this data-processing step: on any two measurable spaces, if probability input laws μ and ν satisfy |μ(S)−ν(S)|≤δ for every measurable input event S, then for every Markov kernel K and every measurable output event T, |(μK)(T)−(νK)(T)|≤δ. In the paper the selected inputs are the implementable law and its comparison law, δ=ε/2, and K is K_{ε/2,1}. The generic measurable-space formulation and arbitrary real δ are an explicit generalization; the premise on the empty event implies δ≥0. This is an attributed faithful paraphrase with ASTIS's standard proof expansion, not copied prose. The construction of the paper's actual kernel, proxy warmness, its separate mixing error and actual-input expected query costs are not supplied by this declaration.

K(x,·) is a probability measure for every x, and x↦K(x,T) is measurable for each measurable T. IsMarkovKernel records the first property and Kernel records the second; merely specifying transition probabilities without measurable dependence would not suffice.
Both input measures have total mass one. Every event probability is finite, so Measure.real is an ordinary real probability, not a misleading conversion of infinity.
The discrepancy premise is uniform over all measurable input events; a bound on one event, or only pointwise convergence of densities, is not the same hypothesis.
The same K is applied to both inputs. Comparing distinct kernels requires an additional approximation-error estimate.

selected data-processing step

\[\operatorname{TV}(\widehat\pi_{\varepsilon/2}K_{\varepsilon/2,1},\widehat\pi^{\dagger}_{\varepsilon/2}K_{\varepsilon/2,1})\le\varepsilon/2.\]

generic eventwise formulation

\[\sup_{T\in\mathcal B}|(\mu K)(T)-(\nu K)(T)|\le\delta,\qquad (\rho K)(T)=\int_A K(x,T)\,\rho(dx).\]

Read the formalized proofs

Each statement and proof below has its own closed Lean disclosure. ASTIS parents, Mathlib calls and external mathematical sources are distinguished in each proof.

ASTIS mathematical exposition

A common Markov kernel cannot amplify total-variation error

AutoSamplingTheory.TechnicalLemmas.Probability.KernelTotalVariation.abs_real_comp_sub_le · theorem · Teaching coverage

Statement

Let A and B be measurable spaces, μ and ν probability measures on A, and K a Markov kernel from A to B. Let δ be real. If |μ(S)−ν(S)|≤δ for every measurable S⊆A, then |(μK)(T)−(νK)(T)|≤δ for every measurable T⊆B. No density, topology or coupling is required. The input assumption on the empty event already implies δ≥0.

\[\sup_{T\in\mathcal B}|(\mu K)(T)-(\nu K)(T)|\le\delta,\qquad (\rho K)(T)=\int_A K(x,T)\,\rho(dx).\]

All objects and hypotheses

K(x,·) is a probability measure for every x, and x↦K(x,T) is measurable for each measurable T. IsMarkovKernel records the first property and Kernel records the second; merely specifying transition probabilities without measurable dependence would not suffice.
Both input measures have total mass one. Every event probability is finite, so Measure.real is an ordinary real probability, not a misleading conversion of infinity.
The discrepancy premise is uniform over all measurable input events; a bound on one event, or only pointwise convergence of densities, is not the same hypothesis.
The same K is applied to both inputs. Comparing distinct kernels requires an additional approximation-error estimate.

Mathematical proof

1. Replace the output event by a bounded observable

Fix a measurable output event T and put f(x)=K(x,T). Kernel measurability makes f measurable and each transition law being a probability gives 0≤f≤1. Since each input measure is finite, f is strongly measurable and integrable for both inputs. Evaluating the composed law is therefore a genuine integral.

\[0\le f(x)\le1,\qquad(\rho K)(T)=\int_A f\,d\rho,\quad\rho\in\{\mu,\nu\}.\]

Corresponding Lean step

The local hf, hf0 and hf1 establish measurability and the bounds. hfi uses integrable_const and Integrable.mono'. happly unfolds Measure.bind, applies Measure.bind_apply, and converts the nonnegative integral with integral_toReal; finite event masses discharge the conversion condition.

2. Express a bounded observable by its level events

For each u, the event {x:u≤f(x)} is measurable. Integrate these event probabilities over (0,1]. This layercake identity follows because for each fixed x the set of levels u in (0,1] with u≤f(x) has length f(x). It remains valid at f=0 and f=1 and for atoms; no continuous distribution is assumed.

\[f(x)=\int_{(0,1]}\mathbf1_{\{u\le f(x)\}}\,du,\qquad\int_A f\,d\rho=\int_{(0,1]}\rho\{x:u\le f(x)\}\,du.\]

Corresponding Lean step

hlayer applies Integrable.integral_eq_integral_Ioc_meas_le using hfi and the everywhere bounds promoted to almost-everywhere bounds. This reuses Mathlib's layercake theorem rather than reproving Tonelli.

3. Justify subtraction of the two level integrals

As u increases, each level set shrinks, hence its measure is an antitone measurable function of u. These real probabilities lie in [0,1]. The interval has finite measure, so both level functions are integrable there. This explicit witness licenses subtracting their integrals.

\[0\le\rho\{f\ge u\}\le1,\qquad \int f\,d\mu-\int f\,d\nu=\int_{(0,1]}[\mu\{f\ge u\}-\nu\{f\ge u\}]\,du.\]

Corresponding Lean step

htail uses Antitone.measurable, finite-measure bounded integrability and measureReal_mono. integral_sub receives both htail witnesses. A totalized integral subtraction without those witnesses would not justify the mathematical equality.

4. Apply the event bound and preserve the exact constant

Apply the input hypothesis to every measurable level event. The absolute integrand is bounded by δ. The norm-of-integral estimate multiplies this bound by the measure of (0,1], which is exactly one. Thus no factor two is lost; this is the event-supremum convention for probability total variation.

\[|(\mu K)(T)-(\nu K)(T)|\le\int_{(0,1]}|\mu\{f\ge u\}-\nu\{f\ge u\}|\,du\le\delta\,|(0,1]|=\delta.\]

Corresponding Lean step

measurableSet_le measurable_const hf supplies each measurable event. norm_integral_le_of_norm_le_const and the interval-volume simplification close the bound; no integral-contraction hypothesis is smuggled into the inputs.

Lean statement · abs_real_comp_sub_le

Measure.real turns finite event mass into a real number. Lean writes K ∘ₘ μ for the input law μ passed through K (often written μK on paper). The theorem quantifies over arbitrary measurable spaces and uses actual Kernel and IsMarkovKernel data. There is no separate δ≥0 premise because the event bound already forces it.

theorem abs_real_comp_sub_le
    {A B : Type*} [MeasurableSpace A] [MeasurableSpace B]
    (μ ν : Measure A) [IsProbabilityMeasure μ] [IsProbabilityMeasure ν]
    (K : Kernel A B) [IsMarkovKernel K]
    {δ : ℝ}
    (hδ : ∀ s, MeasurableSet s → |μ.real s - ν.real s| ≤ δ) :
    ∀ t, MeasurableSet t →
      |(K ∘ₘ μ).real t - (K ∘ₘ ν).real t| ≤ δ

Exact module and namespace context

Lean proof · abs_real_comp_sub_le

The only production declaration is this contraction theorem; hf, hfi, happly, htail and hlayer are local proof terms. The focused tests exercise the declaration at zero discrepancy and compose it with a separately assumed proxy-output estimate using the triangle inequality. They also check that the empty-event premise forces nonnegative δ. No wrapper is counted as a new leaf.

theorem abs_real_comp_sub_le
    {A B : Type*} [MeasurableSpace A] [MeasurableSpace B]
    (μ ν : Measure A) [IsProbabilityMeasure μ] [IsProbabilityMeasure ν]
    (K : Kernel A B) [IsMarkovKernel K]
    {δ : ℝ}
    (hδ : ∀ s, MeasurableSet s → |μ.real s - ν.real s| ≤ δ) :
    ∀ t, MeasurableSet t →
      |(K ∘ₘ μ).real t - (K ∘ₘ ν).real t| ≤ δ := by
  intro t ht
  let f : A → ℝ := fun x => (K x).real t
  have hf : Measurable f := (K.measurable_coe ht).ennreal_toReal
  have hf0 (x : A) : 0 ≤ f x := measureReal_nonneg
  have hf1 (x : A) : f x ≤ 1 := measureReal_le_one
  have hfi (ρ : Measure A) [IsProbabilityMeasure ρ] :
      Integrable f ρ := by
    apply (integrable_const (1 : ℝ)).mono' hf.aestronglyMeasurable
    exact Filter.Eventually.of_forall fun x => by
      simpa only [Real.norm_eq_abs, abs_of_nonneg (hf0 x)] using hf1 x
  have happly (ρ : Measure A) [IsProbabilityMeasure ρ] :
      (K ∘ₘ ρ).real t = ∫ x, f x ∂ρ := by
    change (Measure.bind ρ K t).toReal = ∫ x, (K x t).toReal ∂ρ
    rw [Measure.bind_apply ht K.aemeasurable]
    exact (integral_toReal (K.measurable_coe ht).aemeasurable
      (Filter.Eventually.of_forall fun x => measure_lt_top (K x) t)).symm
  have htail (ρ : Measure A) [IsProbabilityMeasure ρ] :
      IntegrableOn (fun u : ℝ => ρ.real {x | u ≤ f x}) (Ioc 0 1) := by
    apply Measure.integrableOn_of_bounded
      (M := ρ.real univ) measure_Ioc_lt_top.ne
    · apply
        (Measurable.ennreal_toReal (Antitone.measurable ?_)).aestronglyMeasurable
      exact fun _ _ huv => measure_mono (fun _ hx => huv.trans hx)
    · exact Filter.Eventually.of_forall fun u => by
        simp only [Real.norm_eq_abs, abs_of_nonneg measureReal_nonneg]
        exact measureReal_mono (subset_univ _)
  have hlayer (ρ : Measure A) [IsProbabilityMeasure ρ] :
      (∫ x, f x ∂ρ) =
        ∫ u in Ioc (0 : ℝ) 1, ρ.real {x | u ≤ f x} :=
    (hfi ρ).integral_eq_integral_Ioc_meas_le
      (Filter.Eventually.of_forall hf0)
      (Filter.Eventually.of_forall hf1)
  rw [happly μ, happly ν, hlayer μ, hlayer ν,
    ← integral_sub (htail μ) (htail ν)]
  simpa [Real.norm_eq_abs, measureReal_def] using
    (norm_integral_le_of_norm_le_const
      (μ := volume.restrict (Ioc (0 : ℝ) 1))
      (f := fun u => μ.real {x | u ≤ f x} - ν.real {x | u ≤ f x})
      (C := δ)
      (Filter.Eventually.of_forall fun u => by
        simpa only [Real.norm_eq_abs] using
          hδ {x | u ≤ f x} (measurableSet_le measurable_const hf)))

end AutoSamplingTheory.TechnicalLemmas.Probability.KernelTotalVariation

Exact module and namespace context

Source assumptions versus formal assumptions

Source	Actual Lean	Difference kind	Why it matters
Probability input laws and the proximal BPS Markov kernel	Probability μ,ν on A and a common Kernel A B with IsMarkovKernel	generalization	Arbitrary measurable spaces and any Markov kernel suffice for the selected standard step; constructing the source-specific kernel remains separate.
Input TV bound ε/2	Uniform event bound with δ:ℝ	generalization	Set δ=ε/2. The premise on the empty event supplies δ≥0, so omitting a separate sign assumption does not change the source specialization.
By data processing	Measurability, bounded input integrability, integrable layer functions and kernel evaluation proved in the body	source-implicit	These are the mathematical justifications of the displayed step, derived from actual kernel/probability data, not added input restrictions.
Probability total variation	Uniform absolute real-event difference	same	This is the event-supremum convention, equivalent to half the L1 density difference when densities exist; densities are not assumed.

This proves the standard data-processing edge used in SPHMC Section 7.2, not construction of the proximal BPS kernel or the implementable/proxy laws. A separate estimate TV(νK,π)≤ε gives TV(μK,π)≤δ+ε by triangle. The focused consumer test makes that estimate explicit; it does not establish mixing. TV proximity alone does not control an unbounded expected query count. Actual-input cost, event-rate bounds and algorithm termination remain independent open obligations. The MCMC E6 perturbed-kernel route is an intended additional consumer for its TV-specialized stability step, not an already compiled general perturbation theorem.

Encoder–denoiser: accepted · equivalent-after-elaboration

Detected semantic differences

domains: The generic two-measurable-space formulation extends the concrete source application. — The source restatement explicitly discloses this extension, and the supplied proof uses only measurable events and finite probability masses.
constant_dependencies: Arbitrary real δ replaces the particular ε/2 allowance. — The empty-event premise rules out negative δ; no extra sign hypothesis or loss of constant is required. This does not relax the parameter requirements of the actual sampling algorithm.

A generalization is not a source correction. Proposed missing conditions require separate independent repair review. No proposed repair silently changes the original theorem.

Scope and omitted-condition boundaries

This proves the standard data-processing edge used in SPHMC Section 7.2, not construction of the proximal BPS kernel or the implementable/proxy laws.
A separate estimate TV(νK,π)≤ε gives TV(μK,π)≤δ+ε by triangle. The focused consumer test makes that estimate explicit; it does not establish mixing.
TV proximity alone does not control an unbounded expected query count. Actual-input cost, event-rate bounds and algorithm termination remain independent open obligations.
The MCMC E6 perturbed-kernel route is an intended additional consumer for its TV-specialized stability step, not an already compiled general perturbation theorem.

Source and reuse

ASTIS parents called

Mathlib API called (external library)

Kernel.measurable_coe
Measure.bind_apply
integral_toReal
Integrable.integral_eq_integral_Ioc_meas_le
Antitone.measurable
Measure.integrableOn_of_bounded
integral_sub
norm_integral_le_of_norm_le_const

Mathematical sources

Chen, Chewi, Lu and Zhang, SPHMC v1, Section 7.2, proof of Theorem 1.3 — Only the data-processing step for actual/proxy inputs. This four-step proof is ASTIS's standard mathematical expansion, not quoted paper prose.
Kalle Kytölä and Mathlib contributors, Apache-2.0 — The local bounded tail-integrability pattern is adapted from this module; public Layercake and kernel APIs do the mathematical work. No external code is marked ASTIS-owned merely by citation.

ASTIS prose is not a quotation or a source-equivalence certificate. Definitions and aliases are explained as constructions, not counted as new mathematical proofs.

Which proof edges are actually covered?

Local proof component; source adapter/review separate Transfer the input eventwise discrepancy through the same actual Markov kernel with factor one
TODO — not closed by these contributions Construct the source algorithm kernel and actual/proxy laws and establish the separate proxy mixing bound
TODO — not closed by these contributions Establish the source expected query cost under the actual input law, not by unbounded-cost TV transfer

Curvature and actual gradient smoothness of the RGO potential

Fan Chen, Sinho Chewi, Jianfeng Lu and Matthew S. Zhang state the SPHMC RGO-potential curvature/smoothness clause and the related PBPS potential and Hessian sandwich in the cited v1 papers. This is ASTIS's attributed paraphrase and expanded analytic proof, not copied prose, a source correction or either complete sampling theorem.

arXiv:2609.06906v1; related potential in arXiv:2609.06905v1 · Section 6.2.2, Lemma 6.4, strong-convexity/smoothness clause; PBPS Proposition 2.1(i), (2.9)-(2.10), as prerequisite/consequence support only · faithful paraphrase

Complete source statement (ASTIS restatement)

In SPHMC Section 6.2.2 let U∈C²(R^d) satisfy κ⁻¹I≼∇²U(x)≼I everywhere. For A∈(0,∞] and u∈R^d put U_A,u(x)=U(x)+‖x−u‖²/(2A). Lemma 6.4's selected clause states that U_A,u is α_A-strongly convex and β_A-smooth, where α_A=κ⁻¹+A⁻¹ and β_A=1+A⁻¹; smoothness here means actual gradient Lipschitz continuity. Zero precision A⁻¹=0 retains A=∞. ASTIS proves this clause for general nonnegative m,L,r on a complete real inner-product space, with U+r‖x−u‖²/2 and constants m+r,L+r. PBPS (2.9)-(2.10) uses the same quadratic potential with constants α,β,η⁻¹ and states its Hessian sandwich; the present public two-conclusion theorem is prerequisite/consequence support for that use, not a formalization of the entire PBPS statement.

SPHMC's potential is genuinely C² on Euclidean space and satisfies its pointwise lower and upper Hessian bounds with the source condition parameter κ≥1.
The regularization centre is arbitrary and A is positive or infinite. Precision r=A⁻¹ is nonnegative; r=0 represents infinite variance, not a legal zero finite variance.
The generalized Lean hypothesis is m‖v‖²≤D²U(x)[v,v]≤L‖v‖² for every x,v, with m,L,r nonnegative, together with ContDiff ℝ 2 U.
The deterministic theorem is on the whole complete real inner-product space. It uses neither an assumed derivative field nor any measure or normalization premise.

source regularization

\[U_{A,u}(x)=U(x)+\frac{\|x-u\|^2}{2A},\qquad\alpha_A=\kappa^{-1}+A^{-1},\qquad\beta_A=1+A^{-1}.\]

exact curvature and smoothness

\[U_{A,u}(ax+by)\le aU_{A,u}(x)+bU_{A,u}(y)-\frac{\alpha_A}{2}ab\|x-y\|^2,\quad\|\nabla U_{A,u}(x)-\nabla U_{A,u}(y)\|\le\beta_A\|x-y\|,\quad a,b\ge0,\ a+b=1.\]

Read the formalized proofs

Each statement and proof below has its own closed Lean disclosure. ASTIS parents, Mathlib calls and external mathematical sources are distinguished in each proof.

ASTIS mathematical exposition

Quadratic regularization shifts actual curvature and gradient smoothness

AutoSamplingTheory.TechnicalLemmas.Analysis.QuadraticRegularization.strongConvexOn_and_lipschitzWith_gradient_add_quadratic · theorem · Teaching coverage

Statement

Let E be a complete real inner-product space and U:E→R be everywhere twice continuously Fréchet differentiable. Let m,L,r be nonnegative real constants. Suppose m‖v‖²≤D²U(x)[v,v]≤L‖v‖² for every x,v∈E. For every centre u∈E, the actual potential W(x)=U(x)+r‖x−u‖²/2 is (m+r)-strongly convex on E and its actual gradient is (L+r)-Lipschitz on E. The constants are exact, including r=0. No gradient field, Hessian field or operator-norm bound is supplied as an assumption.

\[W(x)=U(x)+\frac r2\|x-u\|^2,\qquad W(ax+by)\le aW(x)+bW(y)-\frac{m+r}{2}ab\|x-y\|^2,\qquad\|\nabla W(x)-\nabla W(y)\|\le(L+r)\|x-y\|,\quad a,b\ge0,\ a+b=1.\]

All objects and hypotheses

E is any complete real inner-product space, including zero dimension; no finite-dimensional or nontrivial-space assumption occurs in the theorem.
ContDiff ℝ 2 U witnesses genuine C² regularity. D²U(x)[v,v] is (fderiv ℝ (fderiv ℝ U) x v) v. Totalized derivative notation alone would not establish that these are actual derivatives.
The lower and upper inequalities hold at every point and in every direction on the whole space. The nonnegative types m,L,r:ℝ≥0 encode their signs. In particular, nonnegative lower curvature is used to control the absolute Rayleigh quotient.
In SPHMC Lemma 6.4 use m=κ⁻¹, L=1 and r=A⁻¹. A=∞ is represented by r=0, not by declaring a zero finite variance admissible. PBPS uses the same regularized potential with m=α, L=β and r=η⁻¹, under its source-positive parameters.
No measure, normalizer, measurability or integrability is needed for the production conclusion. Focused probability consumers separately add finite dimension, a Borel measurable structure, canonical volume and positive source curvature.

Mathematical proof

1. Differentiate the actual quadratic potential

The squared norm is smooth on a real inner-product space. Differentiate the shifted quadratic twice: its first derivative evaluates r⟨x−u,v⟩, and its second derivative evaluates r⟨v,w⟩. Thus W is genuinely C² and its diagonal Hessian is the diagonal Hessian of U plus r‖v‖². The original sandwich shifts by exactly r on both sides.

\[DW(x)[v]=DU(x)[v]+r\langle x-u,v\rangle,\qquad D^2W(x)[v,w]=D^2U(x)[v,w]+r\langle v,w\rangle,\qquad(m+r)\|v\|^2\le D^2W(x)[v,v]\le(L+r)\|v\|^2.\]

Corresponding Lean step

ContDiff.norm_sq proves hW. HasFDerivAt.norm_sq and the sum/chain rules give hq, hWfd and hWdd; hbounds evaluates the derivative on the diagonal. The local J packages v↦innerSL ℝ v as a continuous real-linear map, proving additivity and scalar compatibility because the generic innerSL API is conjugate-linear. This is an implementation adapter, not an assumed Hessian.

2. Turn the shifted lower bound into the exact chord inequality

Apply the shared Hessian-to-strong-convexity theorem to W and the shifted lower bound. Its scalar-line argument yields the chord correction (m+r)ab‖x−y‖²/2 without losing a factor. This is the first public conclusion.

\[D^2W(x)[v,v]\ge(m+r)\|v\|^2\quad\Longrightarrow\quad W(ax+by)\le aW(x)+bW(y)-\frac{m+r}{2}ab\|x-y\|^2.\]

Corresponding Lean step

HessianStrongConvexity.strongConvexOn_univ_of_fderiv2_lower receives hW and the lower half of hbounds, returning StrongConvexOn Set.univ with precisely the coerced NNReal sum m+r.

3. Identify the genuine derivative of the gradient and its symmetry

Completeness supplies inverse Riesz representation. Apply it to the first derivative of W to obtain Mathlib's actual gradient, then differentiate this fixed continuous linear transformation. The resulting operator Tₓ=D(∇W)(x) represents the genuine Hessian: ⟨Tₓv,w⟩=D²W(x)[v,w]. The C² symmetry theorem makes Tₓ symmetric; no matrix representation or finite-dimensional eigenbasis is introduced.

\[T_x=D(\nabla W)(x),\qquad\langle T_xv,w\rangle=D^2W(x)[v,w]=D^2W(x)[w,v]=\langle v,T_xw\rangle.\]

Corresponding Lean step

R packages (InnerProductSpace.toDual ℝ E).symm as a continuous real-linear map. T is R.comp applied to fderiv ℝ (fderiv ℝ W) x. hTd is a HasFDerivAt witness for gradient W, hinner uses InnerProductSpace.toDual_symm_apply, and hsym uses ContDiffAt.isSymmSndFDerivAt.

4. Bound the operator norm from the diagonal sandwich

For a symmetric operator the operator norm equals the supremum of the absolute Rayleigh quotient. The shifted lower bound and m+r≥0 make the Hessian diagonal nonnegative. For v≠0 the shifted upper bound therefore gives quotient at most L+r. At v=0 the totalized quotient is zero, so this case also satisfies the bound and does not require E to contain a nonzero vector.

\[\|T_x\|=\sup_v\left|\frac{\langle T_xv,v\rangle}{\|v\|^2}\right|\le L+r.\]

Corresponding Lean step

ContinuousLinearMap.norm_eq_iSup_rayleighQuotient and ciSup_le reduce hnorm to each quotient. hbounds supplies nonnegativity and the upper estimate. The proof handles v=0 explicitly; otherwise norm_pos_iff and div_le_iff₀ justify division.

5. Use the whole-space mean-value bound

The actual gradient is differentiable everywhere and its derivative has norm at most L+r at every point. The whole-space mean-value theorem gives global (L+r)-Lipschitz continuity, which is the precise smoothness sense returned here.

Corresponding Lean step

lipschitzWith_of_nnnorm_fderiv_le uses differentiability from hTd and rewrites the derivative by (hTd x).fderiv before applying hnorm. The public LipschitzWith conclusion is about gradient W itself, not a separately declared gradient or Hessian norm.

Lean statement · strongConvexOn_and_lipschitzWith_gradient_add_quadratic

The theorem quantifies over E with NormedAddCommGroup, InnerProductSpace ℝ and CompleteSpace; U:E→ℝ; m,L,r:ℝ≥0; and u:E. Its only mathematical input hypotheses are ContDiff ℝ 2 U and the everywhere/every-direction nested-fderiv sandwich. Its let-bound W is the actual quadratic regularization. The two conclusions are StrongConvexOn Set.univ (↑(m+r)) W and LipschitzWith (L+r) (gradient W).

theorem strongConvexOn_and_lipschitzWith_gradient_add_quadratic
    {E : Type*} [NormedAddCommGroup E] [InnerProductSpace ℝ E] [CompleteSpace E]
    {U : E → ℝ} {m L r : ℝ≥0}
    (hU : ContDiff ℝ 2 U)
    (hH : ∀ x v : E,
      (m : ℝ) * ‖v‖ ^ 2 ≤ (fderiv ℝ (fderiv ℝ U) x v) v ∧
      (fderiv ℝ (fderiv ℝ U) x v) v ≤ (L : ℝ) * ‖v‖ ^ 2)
    (u : E) :
    let W := fun x => U x + (r : ℝ) / 2 * ‖x - u‖ ^ 2
    StrongConvexOn Set.univ ((m + r : ℝ≥0) : ℝ) W ∧
      LipschitzWith (L + r) (gradient W)

Exact module and namespace context

Lean proof · strongConvexOn_and_lipschitzWith_gradient_add_quadratic

One shared production theorem contains the quadratic-shift, Riesz and norm estimates as local proof terms, not public wrapper siblings. The focused tests instantiate the source constants κ⁻¹, 1, A⁻¹; separately retain r=0 and zero dimension. Under source-positive curvature and the finite-dimensional Borel canonical-volume assumptions, they use the derived strong convexity with StrongConvexGibbsIntegrability to return integrability, strictly positive Gibbs normalizer and actual probability. That derived probability feeds quadratic_tilt_tilt, with positive A⁻¹ used for the additional normalized Gaussian reweighting. Neither integrability nor probability is assumed.

theorem strongConvexOn_and_lipschitzWith_gradient_add_quadratic
    {E : Type*} [NormedAddCommGroup E] [InnerProductSpace ℝ E] [CompleteSpace E]
    {U : E → ℝ} {m L r : ℝ≥0}
    (hU : ContDiff ℝ 2 U)
    (hH : ∀ x v : E,
      (m : ℝ) * ‖v‖ ^ 2 ≤ (fderiv ℝ (fderiv ℝ U) x v) v ∧
      (fderiv ℝ (fderiv ℝ U) x v) v ≤ (L : ℝ) * ‖v‖ ^ 2)
    (u : E) :
    let W := fun x => U x + (r : ℝ) / 2 * ‖x - u‖ ^ 2
    StrongConvexOn Set.univ ((m + r : ℝ≥0) : ℝ) W ∧
      LipschitzWith (L + r) (gradient W) := by
  let W := fun x => U x + (r : ℝ) / 2 * ‖x - u‖ ^ 2
  have hUd : Differentiable ℝ U := hU.differentiable (by norm_num)
  have hUdd : Differentiable ℝ (fderiv ℝ U) :=
    (hU.fderiv_right (m := 1) (by norm_num)).differentiable_one
  have hn : ContDiff ℝ 2 (fun x : E => ‖x - u‖ ^ 2) :=
    (contDiff_id.sub contDiff_const).norm_sq (𝕜 := ℝ)
  have hW : ContDiff ℝ 2 W := hU.add (contDiff_const.mul hn)
  have hq (x : E) : HasFDerivAt (fun z => (r : ℝ) / 2 * ‖z - u‖ ^ 2)
      ((r : ℝ) • innerSL ℝ (x - u)) x := by
    convert (((hasFDerivAt_id x).sub_const u).norm_sq).const_mul ((r : ℝ) / 2)
      using 1 <;> first | rfl | (ext v; simp; ring)
  have hWfd (x : E) : fderiv ℝ W x =
      fderiv ℝ U x + (r : ℝ) • innerSL ℝ (x - u) :=
    ((hUd x).hasFDerivAt.add (hq x)).fderiv
  let J : E →L[ℝ] (E →L[ℝ] ℝ) :=
    { toFun := fun v => innerSL ℝ v
      map_add' := by intros; ext; simp
      map_smul' := by intros; ext; simp
      cont := (innerSL ℝ (E := E)).continuous }
  have hWdd (x : E) : HasFDerivAt (fderiv ℝ W)
      (fderiv ℝ (fderiv ℝ U) x + (r : ℝ) • J) x := by
    rw [show fderiv ℝ W = (fun z => fderiv ℝ U z +
      (r : ℝ) • innerSL ℝ (z - u)) from funext hWfd]
    convert (hUdd x).hasFDerivAt.add
      ((J.hasFDerivAt.comp x ((hasFDerivAt_id x).sub_const u)).const_smul
        (r : ℝ)) using 1 <;> rfl
  have hbounds (x v : E) :
      ((m + r : ℝ≥0) : ℝ) * ‖v‖ ^ 2 ≤ (fderiv ℝ (fderiv ℝ W) x v) v ∧
      (fderiv ℝ (fderiv ℝ W) x v) v ≤ ((L + r : ℝ≥0) : ℝ) * ‖v‖ ^ 2 := by
    rw [(hWdd x).fderiv]
    change ((m : ℝ) + r) * ‖v‖ ^ 2 ≤
        (fderiv ℝ (fderiv ℝ U) x v) v + (r : ℝ) * inner ℝ v v ∧
      (fderiv ℝ (fderiv ℝ U) x v) v + (r : ℝ) * inner ℝ v v ≤
        ((L : ℝ) + r) * ‖v‖ ^ 2
    rw [real_inner_self_eq_norm_sq]
    constructor <;> nlinarith [(hH x v).1, (hH x v).2]
  refine ⟨HessianStrongConvexity.strongConvexOn_univ_of_fderiv2_lower hW
    (fun x v => (hbounds x v).1), ?_⟩
  let R : (E →L[ℝ] ℝ) →L[ℝ] E :=
    { toFun := (toDual ℝ E).symm
      map_add' := (toDual ℝ E).symm.map_add
      map_smul' := by intros; simp
      cont := (toDual ℝ E).symm.continuous }
  let T (x : E) : E →L[ℝ] E := R.comp (fderiv ℝ (fderiv ℝ W) x)
  have hTd (x : E) : HasFDerivAt (gradient W) (T x) x := by
    exact R.hasFDerivAt.comp x
      (((hW.fderiv_right (m := 1) (by norm_num)).differentiable_one x).hasFDerivAt)
  have hinner (x v w : E) : inner ℝ (T x v) w =
      (fderiv ℝ (fderiv ℝ W) x v) w := by
    exact toDual_symm_apply
  have hsym (x : E) : (T x).IsSymmetric := by
    intro v w
    change inner ℝ (T x v) w = inner ℝ v (T x w)
    calc
      _ = (fderiv ℝ (fderiv ℝ W) x v) w := hinner x v w
      _ = (fderiv ℝ (fderiv ℝ W) x w) v :=
        hW.contDiffAt.isSymmSndFDerivAt (by norm_num) v w
      _ = inner ℝ (T x w) v := (hinner x w v).symm
      _ = inner ℝ v (T x w) := real_inner_comm _ _
  have hnorm (x : E) : ‖T x‖ ≤ ((L + r : ℝ≥0) : ℝ) := by
    rw [(T x).norm_eq_iSup_rayleighQuotient (hsym x)]
    apply ciSup_le
    intro v
    change |inner ℝ (T x v) v / ‖v‖ ^ 2| ≤ ((L + r : ℝ≥0) : ℝ)
    rw [hinner]
    have hnonneg : 0 ≤ (fderiv ℝ (fderiv ℝ W) x v) v :=
      (mul_nonneg (NNReal.coe_nonneg _) (sq_nonneg _)).trans (hbounds x v).1
    rw [abs_of_nonneg (div_nonneg hnonneg (sq_nonneg _))]
    by_cases hv : v = 0
    · simp [hv]
      positivity
    · exact (div_le_iff₀ (sq_pos_of_pos (norm_pos_iff.mpr hv))).2 (hbounds x v).2
  apply lipschitzWith_of_nnnorm_fderiv_le (fun x => (hTd x).differentiableAt)
  intro x
  rw [(hTd x).fderiv]
  exact hnorm x

end AutoSamplingTheory.TechnicalLemmas.Analysis.QuadraticRegularization

Exact module and namespace context

Source assumptions versus formal assumptions

Source	Actual Lean	Difference kind	Why it matters
U∈C²(R^d)	ContDiff ℝ 2 U	same	The proof obtains actual first and second Fréchet derivatives from genuine C² regularity; merely totalized nested fderiv notation would be insufficient.
κ⁻¹I≼∇²U(x)≼I at every x	∀ x v, ↑m‖v‖²≤(fderiv ℝ (fderiv ℝ U) x v) v ∧ (fderiv ℝ (fderiv ℝ U) x v) v≤↑L‖v‖²	generalization	The quadratic-form Hessian meaning is retained exactly. m=κ⁻¹,L=1 recovers SPHMC; any nonnegative m,L are allowed. No unrelated field or operator-norm bound is assumed.
Euclidean finite-dimensional state space	Complete real inner-product space, including zero dimension	generalization	Riesz representation and the symmetric-operator Rayleigh norm formula work on complete real inner-product spaces; no finite-dimensional spectral theorem is used. Euclidean spaces satisfy completeness automatically. This does not generalize probability normalization to infinite dimension.
A∈(0,∞], quadratic coefficient 1/(2A)	r:ℝ≥0, quadratic coefficient ↑r/2	same	Set r=A⁻¹ for finite positive A and r=0 for A=∞. Zero precision is explicitly tested and must not be confused with a zero finite variance.
α_A-strong convexity and β_A-smoothness, α_A=κ⁻¹+A⁻¹, β_A=1+A⁻¹	StrongConvexOn Set.univ (↑(m+r)) W ∧ LipschitzWith (L+r) (gradient W)	same	The exact source specialization retains the chord correction α_A/2 and actual gradient Lipschitz constant β_A. Smoothness is derived, not replaced by a declared Hessian norm bound.
Positive lower source curvature	Nonnegative m and r are sufficient for this deterministic theorem	generalization	The lower sandwich is needed for nonnegative Rayleigh quotients. Strict positivity is not needed for strong convexity with possibly zero modulus or for gradient Lipschitz continuity; focused Gibbs tests restore source-positive curvature and finite-dimensional canonical-volume hypotheses.

Exactly the SPHMC Lemma 6.4 strong-convexity/smoothness clause, generalized as recorded. PBPS is a related prerequisite/consequence consumer, not a second direct source-proof binding. Neither normalized-law closure, condition-number recurrence, conditional-law identification, Poincaré, covariance, sampler guarantees nor costs are proved by this declaration.

Encoder–denoiser: accepted · equivalent-after-elaboration

Detected semantic differences

domains: Complete real inner-product spaces, including infinite dimension and the zero space, generalize the source Euclidean domain. — The selected extraction and full lesson disclose this extension. The actual Riesz/Rayleigh/mean-value proof uses no finite-dimensional spectral basis or nonzero-vector existence.
assumptions: The deterministic theorem allows nonnegative m,L,r, including degenerate zero curvature, beyond the papers' positive source-curvature regime. — Signs are explicit in NNReal. The absolute Rayleigh bound uses nonnegative lower curvature; m+r=0 yields convexity, not strict strong convexity or a Gibbs normalization claim. Positive source specializations remain valid.
scopes: Direct SPHMC curvature/smoothness credit and PBPS analytic support are intentionally different; neither extends to the remainder of the source results. — Public output is the two-conclusion theorem, not local hbounds or PBPS (2.10) as a public declaration. Normalized Gibbs/RGO tests are derived consumers, not additional production conclusions or a proof of the full SPHMC lemma.

A generalization is not a source correction. Proposed missing conditions require separate independent repair review. No proposed repair silently changes the original theorem.

Scope and omitted-condition boundaries

Direct source coverage is SPHMC Lemma 6.4's strong-convexity and smoothness clause for the actual regularized potential. Its normalized-oracle closure and condition-number recurrence (6.1) are not proved by this declaration.
PBPS (2.9) supplies a second potential consumer and (2.10) supplies its Hessian sandwich. This theorem gives an analytic consequence useful downstream, including smoothness for that potential; it does not return the Hessian sandwich as a public conclusion and is not direct formalization of all of (2.10) or Proposition 2.1.
Conditional-law identification, Poincaré or covariance bounds, invariant kernels, sampler accuracy, condition-number algebra and query costs are not proved by this declaration.
The complete-inner-product-space and nonnegative-parameter extensions concern only deterministic curvature/smoothness. They do not establish infinite-dimensional Gibbs normalization or remove positive-curvature conditions from the source sampling results.

Source and reuse

ASTIS parents called

AutoSamplingTheory.TechnicalLemmas.Analysis.HessianStrongConvexity.strongConvexOn_univ_of_fderiv2_lower

Mathlib API called (external library)

ContDiff.norm_sq
ContDiff.differentiable
ContDiff.fderiv_right
ContDiff.differentiable_one
HasFDerivAt.norm_sq
HasFDerivAt.comp
HasFDerivAt.const_mul
HasFDerivAt.const_smul
HasFDerivAt.add
HasFDerivAt.fderiv
InnerProductSpace.toDual_symm_apply
ContDiffAt.isSymmSndFDerivAt
ContinuousLinearMap.norm_eq_iSup_rayleighQuotient
lipschitzWith_of_nnnorm_fderiv_le

Mathematical sources

Chen, Chewi, Lu and Zhang, Smoothed Picard Hamiltonian Monte Carlo v1, Section 6.2.2, Lemma 6.4 — Direct curvature/smoothness clause for U_A,u with constants κ⁻¹+A⁻¹ and 1+A⁻¹, including A=∞ through zero precision. The five-step proof is ASTIS's mathematical expansion, not quoted prose or the full lemma.
Chen, Chewi, Lu and Zhang, Proximal Bouncy Particle Sampler v1, Proposition 2.1(i), (2.9)-(2.10), and Section 4.1 — Prerequisite/consequence support: the same actual regularized potential has shifted curvature and actual gradient Lipschitz continuity. The public theorem does not return (2.10)'s Hessian sandwich or identify the conditional law, Poincaré or covariance bounds.

ASTIS prose is not a quotation or a source-equivalence certificate. Definitions and aliases are explained as constructions, not counted as new mathematical proofs.

Which proof edges are actually covered?

Local proof component; source adapter/review separate Derive the exact shifted strong-convexity chord inequality for the actual RGO potential
Local proof component; source adapter/review separate Derive actual global gradient Lipschitz continuity with the exact shifted smoothness constant
TODO — not closed by these contributions Keep the separate normalized-oracle closure and source condition-number recurrence obligations distinct from the curvature clause

A measurable random-center RGO with actual joint recovery

Fan Chen, Sinho Chewi, Jianfeng Lu and Matthew S. Zhang; ASTIS expanded joint-kernel semantics, no author endorsement implied.

arXiv:2609.06906v1 · Lemma 6.4 (6.1) and Theorem 6.5 ideal random-center recursion · faithful paraphrase

Complete source statement (ASTIS restatement)

Let mu be a probability measure on a finite-dimensional real inner-product Borel space, b>=0 and a>0. There exist Markov kernels T,H from E to E and B from E times E to E times E, chosen before every probability center law nu. For every u, T(u) is mu tilted by -b*norm(x-u)^2/2 and H(u) is its actual Gaussian smoothing at standard deviation sqrt(a). For every u,y, B(u,y) retains u and draws x from T(u) tilted by -norm(x-y)^2/(2a); equivalently it draws from mu with precision b+a^-1 and center (b+a^-1)^-1*(b*u+a^-1*y). For every probability nu, B composed with the actual joint measure nu compProd H equals nu compProd T.

Finite-dimensional real inner-product Borel space, including dimension zero; arbitrary probability base mu.
Fixed b>=0 and a>0. No density, curvature, moments or extra normalizability premise.
All three kernels precede the universally quantified probability center law. Fiber formulas hold for every u,y.
The input conditional observation kernel is exactly H. Arbitrary center laws do not mean arbitrary center-observation joint laws.
This explicitly generalizes the source Gibbs/Euclidean setting and exposes its needed ideal joint semantics.

Actual retained-center joint recovery

\[B\circ_m(\nu\otimes_m H)=\nu\otimes_m T,\qquad B(u,y)=(x\mapsto(u,x))_\#\left[T(u).\mathrm{tilted}\left(-\frac{\|x-y\|^2}{2a}\right)\right].\]

Read the formalized proofs

Each statement and proof below has its own closed Lean disclosure. ASTIS parents, Mathlib calls and external mathematical sources are distinguished in each proof.

ASTIS mathematical exposition

A measurable random-center RGO with actual joint recovery

AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.AdaptiveCenterRGO.adaptive_center_recovery · theorem · Teaching coverage

Statement

\[B\circ_m(\nu\otimes_m H)=\nu\otimes_m T,\qquad B(u,y)=(x\mapsto(u,x))_\#\left[T(u).\mathrm{tilted}\left(-\frac{\|x-y\|^2}{2a}\right)\right].\]

All objects and hypotheses

Finite-dimensional real inner-product Borel space, including dimension zero; arbitrary probability base mu.
Fixed b>=0 and a>0. No density, curvature, moments or extra normalizability premise.
All three kernels precede the universally quantified probability center law. Fiber formulas hold for every u,y.
The input conditional observation kernel is exactly H. Arbitrary center laws do not mean arbitrary center-observation joint laws.
This explicitly generalizes the source Gibbs/Euclidean setting and exposes its needed ideal joint semantics.

Mathematical proof

1. Construct the measurable family of target laws

For positive b, use the existing Gaussian conditional kernel at inverse precision. For b=0 use the constant probability kernel. Thus the normalized target family is a globally measurable Markov kernel.

\[T(u)=\mu.\mathrm{tilted}(-b\|x-u\|^2/2).\]

Corresponding Lean step

Local precisionKernel and targetKernel; GaussianConditionalKernel.exists_tilted_isCondKernel; Kernel.const.

2. Construct one global backward kernel

The updated precision is positive. Compose its conditional kernel with the measurable weighted-center map. Quadratic tilt closure identifies its fiber with the backward tilt of T(u), for every center and observation.

\[q=b+a^{-1}>0,\quad c(u,y)=q^{-1}(bu+a^{-1}y),\quad K(u,y)=\mu.\mathrm{tilted}(-q\|x-c(u,y)\|^2/2).\]

Corresponding Lean step

Local globalKernels; Kernel.comap; RGOClosure.quadratic_tilt_tilt.

3. Add actual independent Gaussian noise and retain the center

The forward kernel is a kernel product followed by addition. The backward joint kernel is the product of the deterministic center and K. These constructions prove measurability and probability, rather than assume a measurable pointwise selection.

\[H(u)=\operatorname{Law}(X+\sqrt a Z),\quad B(u,y)=(x\mapsto(u,x))_\#K(u,y).\]

Corresponding Lean step

Kernel.prod; Kernel.map; Kernel.IsMarkovKernel.map; Measure.dirac_prod.

4. Identify recovery for each existing global section

The pointwise RGO theorem identifies the already constructed K section and proves its recovery from H(u). Its existential kernel is used only within this equality proof.

\[K(u,\cdot)\circ_m H(u)=T(u).\]

Corresponding Lean step

Local hrec; RGOBackward.rgo_backward_recovery; kernel extensionality.

5. Integrate recovery without discarding the center

For an arbitrary measurable joint event take its measurable section at u. The bind and compProd formulas turn joint output mass into an iterated integral. Section recovery replaces its inner integral by T(u), giving the original joint target measure.

\[\int\!\int B(u,y)(S)\,H(u)(dy)\,\nu(du)=\int T(u)(S_u)\,\nu(du).\]

Corresponding Lean step

Measure.bind_apply; Measure.lintegral_compProd; Measure.compProd_apply; Measure.map_apply; lintegral_congr.

Lean statement · adaptive_center_recovery

Global measurable center-dependent target, Gaussian forward and center-retaining backward kernels with exact joint recovery.

theorem adaptive_center_recovery (μ : Measure E) [IsProbabilityMeasure μ] (b a : ℝ)
    (hb : 0 ≤ b) (ha : 0 < a) :
    ∃ (T H : Kernel E E) (B : Kernel (E × E) (E × E)),
      IsMarkovKernel T ∧ IsMarkovKernel H ∧ IsMarkovKernel B ∧
      (∀ u, T u = μ.tilted (fun x => -(b/2)*‖x-u‖^2)) ∧
      (∀ u, H u = GaussianSmoothing.gaussianSmoothing (T u) (Real.sqrt a)) ∧
      (∀ u y, B (u,y) = Measure.map (Prod.mk u)
        ((T u).tilted (fun x => -‖x-y‖^2/(2*a)))) ∧
      (∀ u y, B (u,y) = Measure.map (Prod.mk u)
        (μ.tilted (fun x => -((b+a⁻¹)/2)*
          ‖x-(b+a⁻¹)⁻¹ • (b • u+a⁻¹ • y)‖^2))) ∧
      ∀ (ν : Measure E), IsProbabilityMeasure ν → B ∘ₘ (ν ⊗ₘ H) = ν ⊗ₘ T

Exact module and namespace context

Lean proof · adaptive_center_recovery

Construct global kernels by conditional kernels, measurable comap/product/map, then integrate existing section recovery over measurable joint-event sections.

theorem adaptive_center_recovery (μ : Measure E) [IsProbabilityMeasure μ] (b a : ℝ)
    (hb : 0 ≤ b) (ha : 0 < a) :
    ∃ (T H : Kernel E E) (B : Kernel (E × E) (E × E)),
      IsMarkovKernel T ∧ IsMarkovKernel H ∧ IsMarkovKernel B ∧
      (∀ u, T u = μ.tilted (fun x => -(b/2)*‖x-u‖^2)) ∧
      (∀ u, H u = GaussianSmoothing.gaussianSmoothing (T u) (Real.sqrt a)) ∧
      (∀ u y, B (u,y) = Measure.map (Prod.mk u)
        ((T u).tilted (fun x => -‖x-y‖^2/(2*a)))) ∧
      (∀ u y, B (u,y) = Measure.map (Prod.mk u)
        (μ.tilted (fun x => -((b+a⁻¹)/2)*
          ‖x-(b+a⁻¹)⁻¹ • (b • u+a⁻¹ • y)‖^2))) ∧
      ∀ (ν : Measure E), IsProbabilityMeasure ν → B ∘ₘ (ν ⊗ₘ H) = ν ⊗ₘ T := by
  have precisionKernel (μ : Measure E) [IsProbabilityMeasure μ] (q : ℝ) (hq : 0 < q) :
      ∃ T : Kernel E E, IsMarkovKernel T ∧
        ∀ u, T u = μ.tilted (fun x => -(q/2)*‖x-u‖^2) := by
    obtain ⟨T,hT,hfiber,_⟩ := GaussianConditionalKernel.exists_tilted_isCondKernel μ (inv_pos.mpr hq)
    refine ⟨T,hT,?_⟩
    intro u
    rw [hfiber]
    congr 1
    funext x
    field_simp
  
  have targetKernel (μ : Measure E) [IsProbabilityMeasure μ] (b : ℝ) (hb : 0 ≤ b) :
      ∃ T : Kernel E E, IsMarkovKernel T ∧
        ∀ u, T u = μ.tilted (fun x => -(b/2)*‖x-u‖^2) := by
    by_cases hb0 : b = 0
    · subst b
      refine ⟨Kernel.const E μ,inferInstance,?_⟩
      intro u
      simp
    · exact precisionKernel μ b (lt_of_le_of_ne hb (Ne.symm hb0))
  
  have globalKernels (μ : Measure E) [IsProbabilityMeasure μ] (b a : ℝ)
      (hb : 0 ≤ b) (ha : 0 < a) :
      ∃ (T H : Kernel E E) (K : Kernel (E × E) E) (B : Kernel (E × E) (E × E)),
        IsMarkovKernel T ∧ IsMarkovKernel H ∧ IsMarkovKernel K ∧ IsMarkovKernel B ∧
        (∀ u, T u = μ.tilted (fun x => -(b/2)*‖x-u‖^2)) ∧
        (∀ u, H u = GaussianSmoothing.gaussianSmoothing (T u) (Real.sqrt a)) ∧
        (∀ u y, K (u,y) = (T u).tilted (fun x => -‖x-y‖^2/(2*a))) ∧
        (∀ u y, K (u,y) = μ.tilted (fun x => -((b+a⁻¹)/2)*
          ‖x-(b+a⁻¹)⁻¹ • (b • u+a⁻¹ • y)‖^2)) ∧
        ∀ u y, B (u,y) = Measure.map (Prod.mk u) (K (u,y)) := by
    obtain ⟨T,hT,hTf⟩ := targetKernel μ b hb
    let := hT
    obtain ⟨R,hR,hRf⟩ := precisionKernel μ (b+a⁻¹) (add_pos_of_nonneg_of_pos hb (inv_pos.mpr ha))
    let := hR
    let c : E × E → E := fun p => (b+a⁻¹)⁻¹ • (b • p.1+a⁻¹ • p.2)
    have hc : Measurable c := by fun_prop
    let K := R.comap c hc
    have hK : IsMarkovKernel K := inferInstance
    let H := (T ×ₖ Kernel.const E (GaussianSmoothing.scaledStdGaussian (E := E) (Real.sqrt a))).map
      (fun p : E × E => p.1+p.2)
    have hH : IsMarkovKernel H := by
      dsimp only [H]
      exact Kernel.IsMarkovKernel.map _ (by fun_prop)
    let B := (Kernel.deterministic (Prod.fst : E × E → E) measurable_fst) ×ₖ K
    have hB : IsMarkovKernel B := inferInstance
    have hKf (u y : E) : K (u,y) = μ.tilted (fun x => -((b+a⁻¹)/2)*
        ‖x-(b+a⁻¹)⁻¹ • (b • u+a⁻¹ • y)‖^2) := hRf (c (u,y))
    refine ⟨T,H,K,B,hT,hH,hK,hB,hTf,?_,?_,hKf,?_⟩
    · intro u
      dsimp only [H]
      rw [Kernel.map_apply _ (by fun_prop), Kernel.prod_apply]
      rfl
    · intro u y
      rw [hKf,hTf]
      have heq : (fun x : E => -‖x-y‖^2/(2*a)) = (fun x => -(a⁻¹/2)*‖x-y‖^2) := by
        funext x
        field_simp
      rw [heq]
      exact (RGOClosure.quadratic_tilt_tilt μ hb (inv_pos.mpr ha) u y).symm
    · intro u y
      dsimp only [B]
      rw [Kernel.prod_apply, Kernel.deterministic_apply, Measure.dirac_prod]
  
  obtain ⟨T,H,K,B,hT,hH,hK,hB,hTf,hHf,hKf,hKupdated,hBf⟩ := globalKernels μ b a hb ha
  let := hT
  let := hH
  let := hK
  let := hB
  have hrec (u : E) : (K.comap (Prod.mk u) measurable_prodMk_left) ∘ₘ H u = T u := by
    obtain ⟨_,R,hR,hRf,_,hrecover,_⟩ := RGOBackward.rgo_backward_recovery μ b a hb ha u
    have heq : K.comap (Prod.mk u) measurable_prodMk_left = R := by
      ext y : 1
      change K (u,y) = R y
      rw [hKf,hTf,hRf]
    rw [heq,hHf,hTf]
    exact hrecover
  refine ⟨T,H,B,hT,hH,hB,hTf,hHf,?_,?_,?_⟩
  · intro u y
    rw [hBf,hKf]
  · intro u y
    rw [hBf,hKupdated]
  · intro ν hν
    let := hν
    ext s hs
    rw [Measure.bind_apply hs B.aemeasurable, Measure.lintegral_compProd (B.measurable_coe hs),
      Measure.compProd_apply hs]
    apply lintegral_congr
    intro u
    have hs' := hs.preimage (measurable_prodMk_left (x := u))
    have heq := congrArg (fun m : Measure E => m ((Prod.mk u) ⁻¹' s)) (hrec u)
    rw [Measure.bind_apply hs' (K.comap (Prod.mk u) measurable_prodMk_left).aemeasurable] at heq
    rw [← heq]
    apply lintegral_congr
    intro y
    rw [hBf,Measure.map_apply measurable_prodMk_left hs]
    rfl

end AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.AdaptiveCenterRGO

Exact module and namespace context

Source assumptions versus formal assumptions

Source	Actual Lean	Difference kind	Why it matters
Theorem 6.5 uses a concrete Gibbs target and a center depending on the current observation.	Arbitrary probability base on finite-dimensional real inner-product Borel E, including dimension zero.	generalization	Density, curvature and moment hypotheses are unnecessary for this exact ideal-kernel identity; concrete source specialization remains separate.
Lemma 6.4 (6.1) gives the updated quadratic target.	Every (u,y) fiber uses precision b+a^-1 and center (b+a^-1)^-1(bu+a^-1*y), with b>=0,a>0.	same	The normalized tilt identity is proved everywhere; b=0 is handled without inverting zero.
The ideal stage requires a center-dependent backward kernel.	Construct global measurable T,H,B before every probability center law; B retains the original center.	source-implicit	Expanded source-needed joint semantics. Pointwise RGO choices prove sections of an already constructed kernel and do not assert measurable choice.
Ideal forward/backward recovery underlies the recursive construction.	Actual B composed with nu compProd H equals nu compProd T for all probability nu.	source-implicit	Full joint measure equality, not merely output marginal recovery; input conditional observation kernel must be H.
The full theorem analyzes approximate recursive samplers and expected query cost.	Fixed base,precision,variance exact ideal joint recovery only.	API-limitation	No joint selection over all parameters/history, arbitrary correlated inputs, measurable proxies, approximate recursion, errors or costs.

Fixed probability base, precision and variance. Actual ideal joint input only. No joint selection over base/precision/variance/history parameters, arbitrary correlated input, approximate recursion, measurable proxies, error or query cost guarantee.

Encoder–denoiser: accepted · domain-mismatch

Detected semantic differences

domains: General probability base and finite-dimensional formulation generalize concrete Gibbs. — Public assumptions omit potential, curvature, density and positive-dimension requirements; generalization disclosed.
constant_dependencies: Normalized update exposed as everypoint fibers of the same global kernel. — a>0 gives positive updated precision; b0 explicit constant-target branch. No unspecified constants.
quantifiers: Global measurable kernels precede all center laws and B retains center. — Existential kernels precede nu. Types establish state/center measurability, not joint selection across mu,b,a.
conclusion: Ideal recovery expanded to actual retained-center joint measure equality; no center-output independence asserted. — Measurable event sections and pointwise recovery prove full retained-center law, not only sample marginal.
scopes: Fixed-parameter exact semantics do not establish approximate recursion or costs. — No approximate kernel, measurable proxy, error accumulation or cost conclusion.

A generalization is not a source correction. Proposed missing conditions require separate independent repair review. No proposed repair silently changes the original theorem.

Scope and omitted-condition boundaries

Fixed probability base, precision and variance. Actual ideal joint input only. No joint selection over base/precision/variance/history parameters, arbitrary correlated input, approximate recursion, measurable proxies, error or query cost guarantee.

Source and reuse

ASTIS parents called

Mathlib API called (external library)

ProbabilityTheory.Kernel.comap
ProbabilityTheory.Kernel.prod
ProbabilityTheory.Kernel.map
MeasureTheory.Measure.bind_apply
MeasureTheory.Measure.lintegral_compProd
MeasureTheory.Measure.compProd_apply

Mathematical sources

SPHMC v1 Lemma 6.4 (6.1) and Theorem 6.5 ideal recursion — Expanded probability semantics of the ideal center-dependent backward step, not a verbatim source theorem.

ASTIS prose is not a quotation or a source-equivalence certificate. Definitions and aliases are explained as constructions, not counted as new mathematical proofs.

Which proof edges are actually covered?

TODO — not closed by these contributions Globally measurable ideal center-dependent RGO and actual joint recovery

Actual adaptive backward-kernel KL error propagation

Fan Chen, Sinho Chewi, Jianfeng Lu and Matthew S. Zhang; ASTIS expanded joint-kernel semantics, no author endorsement implied.

arXiv:2609.06906v1 · Theorem 6.5 A1 actual recursive KL propagation · faithful paraphrase

Complete source statement (ASTIS restatement)

Let mu be a probability measure on a finite-dimensional real inner-product Borel space E,b>=0,a>0. Construct Markov kernels T,H:E to E and B:E times E to E times E. Every T(u) is mu tilted by -b*norm(x-u)^2/2, and H(u) is its actual Gaussian smoothing at standard-deviation sqrt(a). Every B(u,y) retains u and draws from T(u) tilted by -norm(x-y)^2/(2a), equivalently from mu tilted at precision b+a^-1 and center (b+a^-1)^-1*(b*u+a^-1*y). For every probability center law nu, B composed with nu compProd H equals nu compProd T. The same T,H,B satisfy for every probability center law nu, every probability input law P on E times E and every Markov kernel L on E times E: s to actual ENNReal KL(L(s),B(s)) is measurable, and actual KL(L composed with P,nu compProd T) is at most KL(P,nu compProd H) plus the nonnegative integral of KL(L(s),B(s)) against P. All KL terms and the integral may be infinite.

Finite-dimensional real inner-product Borel space including dimension zero; arbitrary probability base mu; b>=0,a>0.
T,H,B are constructed before every center law nu, input P and approximate Markov L; fiber formulas are everywhere.
P is any actual probability joint input law. Its divergence from the ideal nu compProd H is explicitly charged.
L is an actual measurable Markov kernel. It need not retain the center; relative conditional KL may then be infinite.
No AC, finite KL, LLR integrability or separately assumed fiber-KL measurability. General probability-base joint semantics explicitly extend the source setting.

Actual input and conditional KL output bound

\[\mathrm{KL}(L\circ_m P\|\nu\otimes_m T)\le\mathrm{KL}(P\|\nu\otimes_m H)+\int\mathrm{KL}(L(s)\|B(s))\,P(ds).\]

Read the formalized proofs

Each statement and proof below has its own closed Lean disclosure. ASTIS parents, Mathlib calls and external mathematical sources are distinguished in each proof.

ASTIS mathematical exposition

Actual adaptive backward-kernel KL error propagation

AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.AdaptiveKLError.adaptive_center_kl_error · theorem · Teaching coverage

Statement

\[\mathrm{KL}(L\circ_m P\|\nu\otimes_m T)\le\mathrm{KL}(P\|\nu\otimes_m H)+\int\mathrm{KL}(L(s)\|B(s))\,P(ds).\]

All objects and hypotheses

Finite-dimensional real inner-product Borel space including dimension zero; arbitrary probability base mu; b>=0,a>0.
T,H,B are constructed before every center law nu, input P and approximate Markov L; fiber formulas are everywhere.
P is any actual probability joint input law. Its divergence from the ideal nu compProd H is explicitly charged.
L is an actual measurable Markov kernel. It need not retain the center; relative conditional KL may then be infinite.
No AC, finite KL, LLR integrability or separately assumed fiber-KL measurability. General probability-base joint semantics explicitly extend the source setting.

Mathematical proof

1. Construct the same ideal joint target and backward kernel

Use the proved measurable random-center recovery theorem. It supplies actual T,H,B, both normalized backward fibers and recovery for every center law. None of these conclusions is introduced as an extra assumption.

\[B\circ_m(\nu\otimes_m H)=\nu\otimes_m T.\]

Corresponding Lean step

AdaptiveCenterRGO.adaptive_center_recovery; retain all fibers and hrec.

2. Prove that actual conditional KL is measurable

Kernel Radon-Nikodym derivatives are jointly measurable and agree fiberwise almost everywhere with measure RN derivatives. Express KL on the measurable AC set using the nonnegative klFun integral and set it to infinity on the complement. Kernel integration and measurable case distinction prove the desired measurable function.

\[\mathrm{KL}(L_s\|K_s)=\begin{cases}\int\operatorname{klFun}(dL_s/dK_s)\,dK_s,&L_s\ll K_s,\\+\infty,&\text{otherwise}.\end{cases}\]

Corresponding Lean step

Local measurable_fiber_kl; Kernel.measurable_rnDeriv; measurableSet_absolutelyContinuous; klDiv_eq_lintegral_klFun.

3. Identify the joint RN derivative and conditional entropy integral

When the joint law is absolutely continuous, its fibers are almost everywhere absolutely continuous. The actual compProd-withDensity identity identifies its RN derivative with the kernel RN derivative. Tonelli for the nonnegative klFun gives the integral formula, even if that integral is infinite.

\[\mathrm{KL}(P\otimes_m L\|P\otimes_m K)=\int\mathrm{KL}(L_s\|K_s)\,P(ds).\]

Corresponding Lean step

Local conditional_kl_integral AC branch; kernel_of_compProd; compProd_withDensity; rnDeriv_withDensity; lintegral_compProd.

4. Prove the non-AC and infinite branches

If the joint law is not absolutely continuous, its KL is infinite. If the fiber-KL integral were finite, fiber KL would be finite almost everywhere, hence fiber AC almost everywhere, implying joint AC and a contradiction. Thus the same exact formula holds without an AC or finite-integral premise.

\[P\otimes_m L\not\ll P\otimes_m K\quad\Longrightarrow\quad\int\mathrm{KL}(L_s\|K_s)\,P(ds)=+\infty.\]

Corresponding Lean step

Local conditional_kl_integral non-AC branch; ae_lt_top; klDiv_ne_top_iff; AbsolutelyContinuous.compProd_right.

5. Use the actual joint chain rule and output projection

The chain rule separates input divergence from conditional joint divergence. The proved integral identity gives the latter under P. Projecting to the output can only decrease KL. The integration weight is the actual input P, not the ideal input Q.

\[\mathrm{KL}(L P\|K Q)\le\mathrm{KL}(P\otimes_m L\|Q\otimes_m K)=\mathrm{KL}(P\|Q)+\int\mathrm{KL}(L_s\|K_s)\,P(ds).\]

Corresponding Lean step

Local composed_kl_bound; klDiv_compProd_eq_add; conditional_kl_integral; klDiv_map_le; snd_compProd.

6. Substitute actual ideal recovery

Take Q=nu compProd H and K=B from the single earlier construction. Its actual recovery identifies BQ with nu compProd T. The general bound now gives the claimed error for the supplied actual input and approximate kernel; no algorithmic accuracy is inferred.

\[Q=\nu\otimes_m H,\quad BQ=\nu\otimes_m T.\]

Corresponding Lean step

composed_kl_bound P (ν ⊗ₘ H) L B; rewrite hrec ν hν.

Lean statement · adaptive_center_kl_error

Construct ideal random-center kernels and prove measurable actual conditional KL plus an extended-valued output error bound for every actual probability input and Markov approximation.

theorem adaptive_center_kl_error {E : Type*} [NormedAddCommGroup E] [InnerProductSpace ℝ E]
    [FiniteDimensional ℝ E] [MeasurableSpace E] [BorelSpace E]
    (μ : Measure E) [IsProbabilityMeasure μ] (b a : ℝ) (hb : 0 ≤ b) (ha : 0 < a) :
    ∃ (T H : Kernel E E) (B : Kernel (E × E) (E × E)),
      IsMarkovKernel T ∧ IsMarkovKernel H ∧ IsMarkovKernel B ∧
      (∀ u, T u = μ.tilted (fun x => -(b/2)*‖x-u‖^2)) ∧
      (∀ u, H u = GaussianSmoothing.gaussianSmoothing (T u) (Real.sqrt a)) ∧
      (∀ u y, B (u,y) = Measure.map (Prod.mk u)
        ((T u).tilted (fun x => -‖x-y‖^2/(2*a)))) ∧
      (∀ u y, B (u,y) = Measure.map (Prod.mk u)
        (μ.tilted (fun x => -((b+a⁻¹)/2)*
          ‖x-(b+a⁻¹)⁻¹ • (b • u+a⁻¹ • y)‖^2))) ∧
      (∀ (ν : Measure E), IsProbabilityMeasure ν → B ∘ₘ (ν ⊗ₘ H) = ν ⊗ₘ T) ∧
      ∀ (ν : Measure E), IsProbabilityMeasure ν →
        ∀ (P : Measure (E × E)), IsProbabilityMeasure P →
        ∀ (L : Kernel (E × E) (E × E)), IsMarkovKernel L →
          Measurable (fun s => klDiv (L s) (B s)) ∧
          klDiv (L ∘ₘ P) (ν ⊗ₘ T) ≤ klDiv P (ν ⊗ₘ H) + ∫⁻ s, klDiv (L s) (B s) ∂P

Exact module and namespace context

Lean proof · adaptive_center_kl_error

Measurable kernel RN, nonnegative KL integrals, both AC branches, joint chain rule, output projection and actual ideal recovery.

theorem adaptive_center_kl_error {E : Type*} [NormedAddCommGroup E] [InnerProductSpace ℝ E]
    [FiniteDimensional ℝ E] [MeasurableSpace E] [BorelSpace E]
    (μ : Measure E) [IsProbabilityMeasure μ] (b a : ℝ) (hb : 0 ≤ b) (ha : 0 < a) :
    ∃ (T H : Kernel E E) (B : Kernel (E × E) (E × E)),
      IsMarkovKernel T ∧ IsMarkovKernel H ∧ IsMarkovKernel B ∧
      (∀ u, T u = μ.tilted (fun x => -(b/2)*‖x-u‖^2)) ∧
      (∀ u, H u = GaussianSmoothing.gaussianSmoothing (T u) (Real.sqrt a)) ∧
      (∀ u y, B (u,y) = Measure.map (Prod.mk u)
        ((T u).tilted (fun x => -‖x-y‖^2/(2*a)))) ∧
      (∀ u y, B (u,y) = Measure.map (Prod.mk u)
        (μ.tilted (fun x => -((b+a⁻¹)/2)*
          ‖x-(b+a⁻¹)⁻¹ • (b • u+a⁻¹ • y)‖^2))) ∧
      (∀ (ν : Measure E), IsProbabilityMeasure ν → B ∘ₘ (ν ⊗ₘ H) = ν ⊗ₘ T) ∧
      ∀ (ν : Measure E), IsProbabilityMeasure ν →
        ∀ (P : Measure (E × E)), IsProbabilityMeasure P →
        ∀ (L : Kernel (E × E) (E × E)), IsMarkovKernel L →
          Measurable (fun s => klDiv (L s) (B s)) ∧
          klDiv (L ∘ₘ P) (ν ⊗ₘ T) ≤ klDiv P (ν ⊗ₘ H) + ∫⁻ s, klDiv (L s) (B s) ∂P := by
  have measurable_fiber_kl (L K : Kernel (E × E) (E × E)) [IsMarkovKernel L] [IsMarkovKernel K] :
      Measurable (fun x => klDiv (L x) (K x)) := by
    classical
    have hf : Measurable (fun p : (E × E) × (E × E) =>
        ENNReal.ofReal (klFun ((Kernel.rnDeriv L K p.1 p.2).toReal))) := by
      exact ENNReal.measurable_ofReal.comp
        (continuous_klFun.measurable.comp (Kernel.measurable_rnDeriv L K).ennreal_toReal)
    have heq (x : (E × E)) : klDiv (L x) (K x) =
        if L x ≪ K x then ∫⁻ y, ENNReal.ofReal (klFun ((Kernel.rnDeriv L K x y).toReal)) ∂K x
        else ∞ := by
      rw [klDiv_eq_lintegral_klFun]
      split_ifs
      · apply lintegral_congr_ae
        filter_upwards [Kernel.rnDeriv_eq_rnDeriv_measure (κ := L) (η := K) (a := x)] with y hy
        rw [hy]
      · rfl
    simp_rw [heq]
    exact Measurable.ite (Kernel.measurableSet_absolutelyContinuous L K)
      hf.lintegral_kernel_prod_right' measurable_const


  have conditional_kl_integral (μ : Measure (E × E)) [IsProbabilityMeasure μ]
      (L K : Kernel (E × E) (E × E)) [IsMarkovKernel L] [IsMarkovKernel K] :
      klDiv (μ ⊗ₘ L) (μ ⊗ₘ K) = ∫⁻ x, klDiv (L x) (K x) ∂μ := by
    classical
    by_cases hac : μ ⊗ₘ L ≪ μ ⊗ₘ K
    · have hfiber := hac.kernel_of_compProd
      have hwd : (μ ⊗ₘ K).withDensity (fun p => Kernel.rnDeriv L K p.1 p.2) = μ ⊗ₘ L := by
        rw [← Measure.compProd_withDensity (Kernel.measurable_rnDeriv L K)]
        apply Measure.compProd_congr
        filter_upwards [hfiber] with x hx
        exact Kernel.withDensity_rnDeriv_eq hx
      have hrn : (μ ⊗ₘ L).rnDeriv (μ ⊗ₘ K) =ᵐ[μ ⊗ₘ K]
          (fun p => Kernel.rnDeriv L K p.1 p.2) := by
        rw [← hwd]
        exact Measure.rnDeriv_withDensity _ (Kernel.measurable_rnDeriv L K)
      rw [klDiv_eq_lintegral_klFun_of_ac hac]
      calc
        _ = ∫⁻ p, ENNReal.ofReal (klFun ((Kernel.rnDeriv L K p.1 p.2).toReal)) ∂(μ ⊗ₘ K) := by
          apply lintegral_congr_ae
          filter_upwards [hrn] with p hp
          rw [hp]
        _ = ∫⁻ x, ∫⁻ y, ENNReal.ofReal (klFun ((Kernel.rnDeriv L K x y).toReal)) ∂K x ∂μ := by
          apply Measure.lintegral_compProd
          exact ENNReal.measurable_ofReal.comp
            (continuous_klFun.measurable.comp (Kernel.measurable_rnDeriv L K).ennreal_toReal)
        _ = _ := by
          apply lintegral_congr_ae
          filter_upwards [hfiber] with x hx
          rw [klDiv_eq_lintegral_klFun_of_ac hx]
          apply lintegral_congr_ae
          filter_upwards [Kernel.rnDeriv_eq_rnDeriv_measure (κ := L) (η := K) (a := x)] with y hy
          rw [hy]
    · rw [klDiv_of_not_ac hac]
      symm
      by_contra hfinite
      have hf := ae_lt_top (measurable_fiber_kl L K) hfinite
      apply hac
      apply Measure.AbsolutelyContinuous.compProd_right
      filter_upwards [hf] with x hx
      exact (klDiv_ne_top_iff.mp hx.ne).1


  have composed_kl_bound (P Q : Measure (E × E)) [IsProbabilityMeasure P] [IsProbabilityMeasure Q]
      (L K : Kernel (E × E) (E × E)) [IsMarkovKernel L] [IsMarkovKernel K] :
      klDiv (L ∘ₘ P) (K ∘ₘ Q) ≤ klDiv P Q + ∫⁻ x, klDiv (L x) (K x) ∂P := by
    calc
      klDiv (L ∘ₘ P) (K ∘ₘ Q) = klDiv (P ⊗ₘ L).snd (Q ⊗ₘ K).snd := by
        rw [Measure.snd_compProd, Measure.snd_compProd]
      _ ≤ klDiv (P ⊗ₘ L) (Q ⊗ₘ K) := klDiv_map_le _ _ measurable_snd
      _ = _ := by rw [klDiv_compProd_eq_add, conditional_kl_integral]


  obtain ⟨T,H,B,hT,hH,hB,hTf,hHf,hBf,hUpd,hrec⟩ :=
    AdaptiveCenterRGO.adaptive_center_recovery μ b a hb ha
  let := hT
  let := hH
  let := hB
  refine ⟨T,H,B,hT,hH,hB,hTf,hHf,hBf,hUpd,hrec,?_⟩
  intro ν hν P hP L hL
  let := hν
  let := hP
  let := hL
  refine ⟨measurable_fiber_kl L B,?_⟩
  have h := composed_kl_bound P (ν ⊗ₘ H) L B
  rw [hrec ν hν] at h
  exact h


end AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.AdaptiveKLError

Exact module and namespace context

Source assumptions versus formal assumptions

Source	Actual Lean	Difference kind	Why it matters
Theorem6.5 A1 propagates recursive sampler errors for concrete Euclidean Gibbs targets.	Arbitrary probability base on finite-dimensional inner-product Borel space, fixed b>=0,a>0.	generalization	Expanded joint-kernel entropy calculus does not need density, curvature or moments.
The proof applies a chain rule and data processing to approximate backward kernels.	Actual ENNReal KL and measurable fiber KL, with conditional integral formula proved including non-AC and infinite cases.	source-implicit	No conditional entropy formula, AC, finite KL or LLR integrability is assumed.
Recursive error is averaged over the approximate forward input.	Bound charges KL(P,nu compProd H) plus integral KL(L(s),B(s)) against actual P.	same	The integration weight is P, not the ideal forward law; divergence direction is actual output relative to ideal target.
Ideal RGO recovery supplies the comparison target.	Construct one T,H,B before all nu,P,L with everywhere fibers and full retained-center joint recovery.	source-implicit	Existing proved construction supplies recovery; it is not an extra premise. Arbitrary L need not preserve center and may have infinite conditional KL.
The full recursive algorithm requires implementable kernels, quantitative bounds and query costs.	An error inequality for any supplied actual Markov approximation.	API-limitation	No concrete recursive L, history-uniform accuracy, A2 proxy selection, Wp sampler guarantee, terminal or cost result.

Fixed probability base, precision and variance. The supplied actual approximate Markov kernel need not retain the center or satisfy a finite error bound. Its conditional KL is charged under the actual input law. No concrete recursive program, uniform history accuracy, measurable proxy, Wp sampler guarantee, terminal implementation or expected query cost is proved.

Encoder–denoiser: accepted · domain-mismatch

Detected semantic differences

domains: General probability base abstracts source Gibbs. — No potential, curvature, density or positive-dimension premise.
assumptions: Non-AC and infinite-KL cases without finite-error hypotheses. — Both AC branches proved; L need not retain center and P need not have first marginal nu. Terms may be infinite.
conclusion: Conditional error integrated against actual P; input mismatch separately charged. — Actual P-weighted integral from proved conditional identity, chain rule and output projection.
quantifiers: One ideal family precedes all nu,P,L and supplies full joint recovery. — Existential witness precedes comparison inputs; no all-parameter/history joint selection.
scopes: Arbitrary Markov approximation is not a constructed accurate recursive sampler. — No numerical accuracy, concrete recursive kernel, termination or costs inferred.

A generalization is not a source correction. Proposed missing conditions require separate independent repair review. No proposed repair silently changes the original theorem.

Scope and omitted-condition boundaries

Fixed probability base, precision and variance. The supplied actual approximate Markov kernel need not retain the center or satisfy a finite error bound. Its conditional KL is charged under the actual input law. No concrete recursive program, uniform history accuracy, measurable proxy, Wp sampler guarantee, terminal implementation or expected query cost is proved.

Source and reuse

ASTIS parents called

AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.AdaptiveCenterRGO.adaptive_center_recovery

Mathlib API called (external library)

ProbabilityTheory.Kernel.measurable_rnDeriv
ProbabilityTheory.Kernel.measurableSet_absolutelyContinuous
MeasureTheory.Measure.compProd_withDensity
InformationTheory.klDiv_eq_lintegral_klFun
InformationTheory.klDiv_compProd_eq_add
InformationTheory.klDiv_map_le

Mathematical sources

SPHMC v1 Theorem 6.5 A1 recursive error propagation — Expanded actual joint-kernel entropy calculus used by the backward induction; not a completed recursive sampler.

ASTIS prose is not a quotation or a source-equivalence certificate. Definitions and aliases are explained as constructions, not counted as new mathematical proofs.

Which proof edges are actually covered?

TODO — not closed by these contributions Actual measurable conditional KL integral and adaptive output error

Actual approximate initialization gradient moments

ASTIS expanded mathematical proof component for Fan Chen, Sinho Chewi, Jianfeng Lu and Matthew S. Zhang, Smoothed Picard Hamiltonian Monte Carlo. Explicit constants and integrability are derived here; source differences and remaining algorithmic consumers are disclosed.

arXiv:2609.06906v1 · Section6.3 Reference point construction: approximate and regularized initial-gradient moments · faithful paraphrase

Complete source statement (ASTIS restatement)

Seven conclusions: norm(grad U)^2 is integrable under nu; its nu expectation is at most M; for every y,z, grad F_yz(y)=grad U(y)-sqrt(tau)/(eta+tau)*z; the squared norm of this actual regularized gradient is integrable under nu.prod(G); its joint expectation equals the nu gradient-square expectation plus tau*d/(eta+tau)^2; hence it is at most M+tau*d/(eta+tau)^2; and if beta=1 and eta<=1/4 it is at most 5*(d+r^2+tau*d/(eta+tau)^2).

E is a complete finite-dimensional real inner-product space with its Borel sigma-algebra and canonical Lebesgue volume; d=finrank(E), including dimension zero. U:E->R is C2.
alpha,beta are nonnegative reals with 0<alpha<=beta. The genuine Hessian at every x obeys alpha*norm(v)^2<=D2U(x)[v,v]<=beta*norm(v)^2 for every vector v. Thus this public theorem does not include beta=0.
eta>=0, tau>0 and r>=0. Define pi=volume.tilted(-U), rho_eta=gaussianSmoothing(pi,sqrt eta), and G=stdGaussian(E). Smoothing is the actual independent additive pushforward, not a supplied approximate law.
nu is an actual probability measure satisfying W2(nu,rho_eta)^2<=ENNReal.ofReal(r^2), where W2 is Samplinglib's actual infimum of quadratic coupling costs. This W2 guarantee is an input, not a conclusion about an implemented sampler.
Set M=4*beta*d+4*beta^2*eta*d+2*beta^2*r^2. For each fixed y,z define F_yz(x)=U(x)+norm(x-(y+sqrt(tau)*z))^2/(2*(eta+tau)); differentiate in x and then evaluate at x=y. The same pair (y,z) defines both the starting point and its random center.

Actual input and same-pair regularized gradient moments

\[\mathbb E_\nu\|\nabla U\|^2\le M=4\beta d+4\beta^2\eta d+2\beta^2r^2,\qquad \mathbb E_{\nu\otimes G}\|\nabla F_{Y,Z}(Y)\|^2=\mathbb E_\nu\|\nabla U\|^2+\frac{\tau d}{(\eta+\tau)^2}.\]

Read the formalized proofs

Each statement and proof below has its own closed Lean disclosure. ASTIS parents, Mathlib calls and external mathematical sources are distinguished in each proof.

ASTIS mathematical exposition

Actual approximate initialization gradient moments

AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.ApproximateInitialGradientMoment.approximate_initial_gradient_moment · theorem · Teaching coverage

Statement

\[\mathbb E_\nu\|\nabla U\|^2\le M=4\beta d+4\beta^2\eta d+2\beta^2r^2,\qquad \mathbb E_{\nu\otimes G}\|\nabla F_{Y,Z}(Y)\|^2=\mathbb E_\nu\|\nabla U\|^2+\frac{\tau d}{(\eta+\tau)^2}.\]

All objects and hypotheses

E is a complete finite-dimensional real inner-product space with its Borel sigma-algebra and canonical Lebesgue volume; d=finrank(E), including dimension zero. U:E->R is C2.
alpha,beta are nonnegative reals with 0<alpha<=beta. The genuine Hessian at every x obeys alpha*norm(v)^2<=D2U(x)[v,v]<=beta*norm(v)^2 for every vector v. Thus this public theorem does not include beta=0.
eta>=0, tau>0 and r>=0. Define pi=volume.tilted(-U), rho_eta=gaussianSmoothing(pi,sqrt eta), and G=stdGaussian(E). Smoothing is the actual independent additive pushforward, not a supplied approximate law.
nu is an actual probability measure satisfying W2(nu,rho_eta)^2<=ENNReal.ofReal(r^2), where W2 is Samplinglib's actual infimum of quadratic coupling costs. This W2 guarantee is an input, not a conclusion about an implemented sampler.
Set M=4*beta*d+4*beta^2*eta*d+2*beta^2*r^2. For each fixed y,z define F_yz(x)=U(x)+norm(x-(y+sqrt(tau)*z))^2/(2*(eta+tau)); differentiate in x and then evaluate at x=y. The same pair (y,z) defines both the starting point and its random center.

Mathematical proof

1. Establish the actual Gibbs and Gaussian moments

Apply the previously proved Gibbs gradient-moment theorem to the genuine Hessian bounds. It proves probability normalization, gradient-square L1 and the beta*d bound for pi. Zero quadratic precision in QuadraticRegularization gives beta-Lipschitz continuity of the actual gradient. For the standard Gaussian, MemLp2 gives norm-square L1; its zero mean and covariance identity give unit directional second moments. Establish each directional L1 before summing over an orthonormal basis and applying Parseval, obtaining E norm(Z)^2=d even for the empty basis.

\[\mathbb E_\pi\|\nabla U\|^2\le\beta d,\qquad \operatorname{Lip}(\nabla U)\le\beta,\qquad \mathbb E_G\|Z\|^2=d.\]

Corresponding Lean step

gaussian_square; approximate_initial_gradient_moment: hG,hbase,hLip; GibbsGradientMoment.gibbs_gradient_moment; QuadraticRegularization.strongConvexOn_and_lipschitzWith_gradient_add_quadratic

2. Integrate the true smoothing pushforward

Expand gaussianSmoothing through addNoise and scaledStdGaussian. Product-map and map-composition equalities identify the measure as the law of X+sigma*Z for independent X~pi and Z~G. For any beta-Lipschitz vector function g, the quadratic triangle inequality gives the displayed domination. Its right side is integrable under the product law. Transfer this L1 statement through the actual pushforward, then integrate and put sigma=sqrt(eta). This is not simultaneous-smoothing contraction used as a displacement bound.

\[\|g(x+\sigma z)\|^2\le2\|g(x)\|^2+2\beta^2\sigma^2\|z\|^2,\qquad \mathbb E_{\rho_\eta}\|\nabla U\|^2\le2\beta d+2\beta^2\eta d.\]

Corresponding Lean step

lipschitz_square_bound; smoothing_square; MeasureTheory.Measure.map_prod_map; MeasureTheory.Measure.map_map; MeasureTheory.integrable_map_measure

3. Derive actual target integrability from a finite-cost coupling

Let gamma couple the target first marginal nu to the known-moment second marginal rho_eta. A finite ENNReal quadratic cost yields actual real displacement-square integrability; it is not a marginal state-moment assumption. Pull the known gradient square back through the second projection. The displayed Lipschitz bound then supplies first-coordinate gradient-square L1, which descends through the first marginal map to nu. Only after these L1 facts are established are the real integrals compared.

\[\|g(x)\|^2\le2\|g(y)\|^2+2\beta^2\|x-y\|^2,\quad \int\|x-y\|^2\,d\gamma\le s\ \Longrightarrow\ \mathbb E_\nu\|g\|^2\le2\mathbb E_{\rho_\eta}\|g\|^2+2\beta^2s.\]

Corresponding Lean step

coupling_square; CouplingQuadraticIntegrability.measurePreserving_fst_of_isCoupling; CouplingQuadraticIntegrability.measurePreserving_snd_of_isCoupling; MeasureTheory.integrable_toReal_of_lintegral_ne_top

4. Eliminate strict near-optimal transport budgets

The squared Wasserstein distance is the actual infimum of coupling costs. For each s>r^2 select a genuine coupling with cost below s. First take s=r^2+1 to establish target L1 once. For arbitrary epsilon>0 take s=r^2+epsilon/(2*beta^2+1); the preceding integral bound is at most the desired bound plus epsilon. Order closure removes epsilon. This works at r=0 without an optimizer and avoids division by beta. Combine with the actual smoothed moment to obtain M.

\[s=r^2+\frac{\varepsilon}{2\beta^2+1}\quad\Longrightarrow\quad \mathbb E_\nu\|\nabla U\|^2\le 4\beta d+4\beta^2\eta d+2\beta^2r^2.\]

Corresponding Lean step

wasserstein_square; Transport.exists_isCoupling_lintegral_lt_of_transportCost_lt; WassersteinSpace.wassersteinDistance_sq; approximate_initial_gradient_moment: hSm,hW,hbound

5. Differentiate the actual random-center potential

Since eta+tau>0, differentiate the quadratic penalty with y,z held fixed, and add the genuine derivative of U. At x=y the displacement from y+sqrt(tau)*z is -sqrt(tau)*z. This proves the actual gradient identity, rather than defining the desired gradient by a formula. The same Y occurs in the initial point and in the center.

\[\nabla F_{y,z}(x)=\nabla U(x)+\frac{x-y-\sqrt\tau z}{\eta+\tau},\qquad \nabla F_{y,z}(y)=\nabla U(y)-\frac{\sqrt\tau}{\eta+\tau}z.\]

Corresponding Lean step

regularized_gradient; approximate_initial_gradient_moment: hA,hgrad; HasGradientAt.gradient; HasFDerivAt.norm_sq

6. Prove cross-term integrability before using independence

For a continuous g with its now-proved square L1 under nu, finite probability mass gives vector L1. The standard Gaussian is also vector L1. The inner-product norm bound and Integrable.op_fst_snd establish absolute integrability of the cross term under the actual product measure. Fubini and the Gaussian strong-dual mean-zero identity then show its integral is zero. Each squared term is integrable, so the square expansion both proves joint L1 and permits termwise integration.

\[\langle g(Y),Z\rangle\in L^1(\nu\otimes G),\quad \mathbb E\langle g(Y),Z\rangle=0,\quad \mathbb E\|g(Y)-cZ\|^2=\mathbb E_\nu\|g\|^2+c^2d.\]

Corresponding Lean step

gaussian_perturbation_square; MeasureTheory.Integrable.op_fst_snd; MeasureTheory.integral_prod; ProbabilityTheory.integral_strongDual_stdGaussian

7. Combine the exact expectation and derive the source-scale constant

Substitute c=sqrt(tau)/(eta+tau) into the exact product expectation and use tau>0 to replace sqrt(tau)^2 by tau. Combining with M yields the joint bound. When beta=1 and eta<=1/4, M<=5d+2r^2; nonnegativity of dimension, r^2 and the noise term yields the displayed sufficient constant5. The paper uses a generic constant C. This fixed-call estimate does not yet integrate the random-center GD stopping cost or propagate moments through random histories.

\[\mathbb E\|\nabla F_{Y,Z}(Y)\|^2\le M+\frac{\tau d}{(\eta+\tau)^2}\le5\left(d+r^2+\frac{\tau d}{(\eta+\tau)^2}\right)\quad(\beta=1,\ \eta\le1/4).\]

Corresponding Lean step

approximate_initial_gradient_moment: hnoise,hEq,hd,hn,hηd

Lean statement · approximate_initial_gradient_moment

Seven actual-law conclusions: nu gradient-square L1/bound, same-pair regularized gradient identity, joint L1/exact expectation/bound and derived constant5 specialization.

theorem approximate_initial_gradient_moment {U : E → ℝ} {α β : ℝ≥0}
    (hα : 0 < α) (hαβ : α ≤ β) (hU : ContDiff ℝ 2 U)
    (hH : ∀ x v : E, (α : ℝ)*‖v‖^2 ≤ fderiv ℝ (fderiv ℝ U) x v v ∧
      fderiv ℝ (fderiv ℝ U) x v v ≤ (β : ℝ)*‖v‖^2)
    {η τ r : ℝ} (hη : 0 ≤ η) (hτ : 0 < τ) (_hr : 0 ≤ r)
    (ν : Measure E) [IsProbabilityMeasure ν]
    (hw : TechnicalLemmas.Measure.WassersteinSpace.wassersteinDistance ν
      (TechnicalLemmas.Measure.GaussianSmoothing.gaussianSmoothing
        ((volume : Measure E).tilted (fun x => -U x)) (Real.sqrt η)) ^ 2 ≤ ENNReal.ofReal (r^2)) :
    let d : ℝ := Module.finrank ℝ E
    let M := 4*(β : ℝ)*d + 4*(β : ℝ)^2*η*d + 2*(β : ℝ)^2*r^2
    let F := fun y z x : E => U x + ‖x-(y+Real.sqrt τ • z)‖^2/(2*(η+τ))
    Integrable (fun y => ‖gradient U y‖^2) ν ∧
      (∫ y, ‖gradient U y‖^2 ∂ν) ≤ M ∧
      (∀ y z, gradient (F y z) y = gradient U y - (Real.sqrt τ/(η+τ)) • z) ∧
      Integrable (fun p : E × E => ‖gradient (F p.1 p.2) p.1‖^2) (ν.prod (stdGaussian E)) ∧
      (∫ p : E × E, ‖gradient (F p.1 p.2) p.1‖^2 ∂ν.prod (stdGaussian E)) =
        (∫ y, ‖gradient U y‖^2 ∂ν) + τ*d/(η+τ)^2 ∧
      (∫ p : E × E, ‖gradient (F p.1 p.2) p.1‖^2 ∂ν.prod (stdGaussian E)) ≤ M + τ*d/(η+τ)^2 ∧
      (β=1 → η≤1/4 → (∫ p : E × E, ‖gradient (F p.1 p.2) p.1‖^2 ∂ν.prod (stdGaussian E)) ≤
        5*(d+r^2+τ*d/(η+τ)^2))

Exact module and namespace context

Lean proof · approximate_initial_gradient_moment

Actual Gibbs and Gaussian moments, actual smoothing pushforward, finite-cost coupling L1 and strict-budget elimination, true quadratic differentiation, absolutely integrable Gaussian cancellation and explicit arithmetic.

theorem approximate_initial_gradient_moment {U : E → ℝ} {α β : ℝ≥0}
    (hα : 0 < α) (hαβ : α ≤ β) (hU : ContDiff ℝ 2 U)
    (hH : ∀ x v : E, (α : ℝ)*‖v‖^2 ≤ fderiv ℝ (fderiv ℝ U) x v v ∧
      fderiv ℝ (fderiv ℝ U) x v v ≤ (β : ℝ)*‖v‖^2)
    {η τ r : ℝ} (hη : 0 ≤ η) (hτ : 0 < τ) (_hr : 0 ≤ r)
    (ν : Measure E) [IsProbabilityMeasure ν]
    (hw : TechnicalLemmas.Measure.WassersteinSpace.wassersteinDistance ν
      (TechnicalLemmas.Measure.GaussianSmoothing.gaussianSmoothing
        ((volume : Measure E).tilted (fun x => -U x)) (Real.sqrt η)) ^ 2 ≤ ENNReal.ofReal (r^2)) :
    let d : ℝ := Module.finrank ℝ E
    let M := 4*(β : ℝ)*d + 4*(β : ℝ)^2*η*d + 2*(β : ℝ)^2*r^2
    let F := fun y z x : E => U x + ‖x-(y+Real.sqrt τ • z)‖^2/(2*(η+τ))
    Integrable (fun y => ‖gradient U y‖^2) ν ∧
      (∫ y, ‖gradient U y‖^2 ∂ν) ≤ M ∧
      (∀ y z, gradient (F y z) y = gradient U y - (Real.sqrt τ/(η+τ)) • z) ∧
      Integrable (fun p : E × E => ‖gradient (F p.1 p.2) p.1‖^2) (ν.prod (stdGaussian E)) ∧
      (∫ p : E × E, ‖gradient (F p.1 p.2) p.1‖^2 ∂ν.prod (stdGaussian E)) =
        (∫ y, ‖gradient U y‖^2 ∂ν) + τ*d/(η+τ)^2 ∧
      (∫ p : E × E, ‖gradient (F p.1 p.2) p.1‖^2 ∂ν.prod (stdGaussian E)) ≤ M + τ*d/(η+τ)^2 ∧
      (β=1 → η≤1/4 → (∫ p : E × E, ‖gradient (F p.1 p.2) p.1‖^2 ∂ν.prod (stdGaussian E)) ≤
        5*(d+r^2+τ*d/(η+τ)^2)) := by
  let d : ℝ := Module.finrank ℝ E
  let μ := (volume : Measure E).tilted (fun x => -U x)
  let ρ := TechnicalLemmas.Measure.GaussianSmoothing.gaussianSmoothing μ (Real.sqrt η)
  let M := 4*(β : ℝ)*d + 4*(β : ℝ)^2*η*d + 2*(β : ℝ)^2*r^2
  let F := fun y z x : E => U x + ‖x-(y+Real.sqrt τ • z)‖^2/(2*(η+τ))
  have hG := TechnicalLemmas.Analysis.GibbsGradientMoment.gibbs_gradient_moment hα hαβ hU hH
  have : IsProbabilityMeasure μ := hG.1
  have hbase := TechnicalLemmas.Analysis.QuadraticRegularization.strongConvexOn_and_lipschitzWith_gradient_add_quadratic
    (r := 0) hU hH (0 : E)
  have hLip : LipschitzWith β (gradient U) := by simpa using hbase.2
  have hSm := smoothing_square hLip hG.2.1 (Real.sqrt η)
  have hW := wasserstein_square hLip hSm.1 hw
  have hbound : (∫ y, ‖gradient U y‖^2 ∂ν) ≤ M := by
    have h1 := hG.2.2.2.2
    have h2 := hSm.2
    have h3 := hW.2
    rw [Real.sq_sqrt hη] at h2
    dsimp [M, d, μ, ρ] at *
    linarith
  have hA : 0 < η+τ := add_pos_of_nonneg_of_pos hη hτ
  have hgrad (y z : E) : gradient (F y z) y =
      gradient U y - (Real.sqrt τ/(η+τ)) • z := by
    rw [regularized_gradient hU hA]
    have he : y-(y+Real.sqrt τ • z) = -(Real.sqrt τ • z) := by abel
    rw [he]
    simp only [smul_neg, smul_smul, sub_eq_add_neg, div_eq_mul_inv, mul_comm]
  have hP := gaussian_perturbation_square hLip.continuous hW.1 (Real.sqrt τ/(η+τ))
  have hnoise : (Real.sqrt τ/(η+τ))^2 * d = τ*d/(η+τ)^2 := by
    rw [div_pow, Real.sq_sqrt hτ.le]
    ring
  have hEq : (∫ p : E × E, ‖gradient (F p.1 p.2) p.1‖^2 ∂ν.prod (stdGaussian E)) =
      (∫ y, ‖gradient U y‖^2 ∂ν) + τ*d/(η+τ)^2 := by
    simp_rw [hgrad]
    exact hP.2.trans (by rw [show (Module.finrank ℝ E : ℝ)=d from rfl, hnoise])
  refine ⟨hW.1, hbound, hgrad, ?_, hEq, ?_, ?_⟩
  · change Integrable (fun p : E × E => ‖gradient (F p.1 p.2) p.1‖^2) (ν.prod (stdGaussian E))
    simpa only [hgrad] using hP.1
  · rw [hEq]
    change (∫ y, ‖gradient U y‖^2 ∂ν) + τ*d/(η+τ)^2 ≤ M + τ*d/(η+τ)^2
    linarith
  · intro hβ hηsmall
    rw [hEq]
    have hd : 0 ≤ d := Nat.cast_nonneg _
    have hn : 0 ≤ τ*d/(η+τ)^2 := div_nonneg (mul_nonneg hτ.le hd) (sq_nonneg _)
    have hηd : 4*η*d ≤ d := by nlinarith [mul_le_mul_of_nonneg_right hηsmall hd]
    simp only [M, hβ, NNReal.coe_one, one_pow, mul_one] at hbound
    nlinarith [sq_nonneg r]


end AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.ApproximateInitialGradientMoment

Exact module and namespace context

Source assumptions versus formal assumptions

Source	Actual Lean	Difference kind	Why it matters
Normalized 1-smooth strongly convex potential in the reference construction.	General Hessian bounds 0<alpha<=beta, with beta=1 specialization.	generalization	The proof derives explicit general-beta constants; beta=0 is not included publicly.
Euclidean positive-dimensional recursive setting with positive smoothing time.	Coordinate-free finite-dimensional Borel space, including dimension zero and eta=0; tau>0 remains.	generalization	Empty Gaussian basis and zero smoothing are handled explicitly; regularization denominator stays positive.
The two moment displays use a generic constant C.	Explicit M=4betad+4beta^2etad+2beta^2r^2 and sufficient constant5.	source-implicit	These constants are derived here, not attributed as printed source values.
The approximate call provides a Wasserstein error, specialized using kappa_U and epsilon_j.	Actual coupling-defined W2(nu,rho_eta)^2<=ofReal(r^2) is supplied; r>=0 retained.	same	Substitution r^2=kappa_U*epsilon_j^2 is available; the sampler guarantee and its adapter are not proved by this theorem.
Integrability and independent Gaussian cross-term cancellation are implicit in the moment calculation.	Actual output and joint-gradient L1 proved before exact expectation identities.	source-implicit	No optimizer, state-second-moment, target-gradient-moment or cross-integrability premise is added.
Reference-center initialization is one component of the full reference-cost argument.	Fixed-parameter same-pair joint moment only; no joint-program or history conclusion.	same	Joint GD stopping/counting, conditional histories, cumulative costs and both complete papers remain separate.

Fixed-call actual input moments only. The W2 hypothesis remains supplied; no smoothed sampler implementation or A2/A3-to-input adapter is proved. In the normalized source call one may substitute r^2=kappa_U*eps_j^2. General beta, coordinate-free finite dimension, dimension zero and eta=0 are explicit extensions. Public r>=0 and tau>0 remain; beta=0 is excluded by curvature. M and constant5 are derived sufficient constants, whereas the source writes a generic C. No state-second-moment, optimizer, target gradient-moment or cross-term-integrability premise is added. Public conclusions do not separately assert a joint parameter kernel or program measurability. Random-history conditioning, jointly measurable GD stopping/counting at the same random center, accumulated expected query cost and both main results remain separate.

Encoder–denoiser: accepted · domain-mismatch

Detected semantic differences

domains: General beta explicitly specializes to normalized beta1. — Independent formal reviewer accepted: General beta explicitly specializes to normalized beta1.
domains: Coordinate-free,dimension zero and eta0 extensions; tau>0 and alpha<=beta retained. — Independent formal reviewer accepted: Coordinate-free,dimension zero and eta0 extensions; tau>0 and alpha<=beta retained.
constant_dependencies: Explicit M and5 are sufficient constants derived here,not source printed constants. — Independent formal reviewer accepted: Explicit M and5 are sufficient constants derived here,not source printed constants.
assumptions: Actual W2 squared budget is supplied,not a sampler guarantee;r>=0 retained. — Independent formal reviewer accepted: Actual W2 squared budget is supplied,not a sampler guarantee;r>=0 retained.
conclusion: Actual L1 and integrable Gaussian cross cancellation precede expectations. — Independent formal reviewer accepted: Actual L1 and integrable Gaussian cross cancellation precede expectations.
scopes: Fixed-call moment component only; no history,joint GD or cost closure. — Independent formal reviewer accepted: Fixed-call moment component only; no history,joint GD or cost closure.

A generalization is not a source correction. Proposed missing conditions require separate independent repair review. No proposed repair silently changes the original theorem.

Scope and omitted-condition boundaries

Fixed-call actual input moments only. The W2 hypothesis remains supplied; no smoothed sampler implementation or A2/A3-to-input adapter is proved. In the normalized source call one may substitute r^2=kappa_U*eps_j^2. General beta, coordinate-free finite dimension, dimension zero and eta=0 are explicit extensions. Public r>=0 and tau>0 remain; beta=0 is excluded by curvature. M and constant5 are derived sufficient constants, whereas the source writes a generic C. No state-second-moment, optimizer, target gradient-moment or cross-term-integrability premise is added. Public conclusions do not separately assert a joint parameter kernel or program measurability. Random-history conditioning, jointly measurable GD stopping/counting at the same random center, accumulated expected query cost and both main results remain separate.

Source and reuse

ASTIS parents called

Mathlib API called (external library)

ProbabilityTheory.IsGaussian.memLp_two_id
ProbabilityTheory.covarianceBilin_stdGaussian
ProbabilityTheory.integral_id_stdGaussian
MeasureTheory.Measure.map_prod_map
MeasureTheory.Measure.map_map
MeasureTheory.integrable_map_measure
MeasureTheory.integrable_toReal_of_lintegral_ne_top
MeasureTheory.Integrable.op_fst_snd
MeasureTheory.integral_prod
ProbabilityTheory.integral_strongDual_stdGaussian

Mathematical sources

SPHMC Section6.3 reference-point initial gradient moments — Fixed-call moment component; supplied Wasserstein input, random histories and total cost remain separate.

ASTIS prose is not a quotation or a source-equivalence certificate. Definitions and aliases are explained as constructions, not counted as new mathematical proofs.

Which proof edges are actually covered?

Local proof component; source adapter/review separate Actual approximate and regularized initialization gradient moments

Actual clipped-gradient Poisson retry program

ASTIS mathematical restatement and exposition of the actual clipped gradient-path program, a dependency used by Fan Chen, Sinho Chewi, Jianfeng Lu and Matthew S. Zhang, Smoothed Picard Hamiltonian Monte Carlo.

arXiv:2602.01338v1 · Appendix D.1 Eq18 and clipping mean comparison; consumed by SPHMC A.4(2), actual Poisson mechanism A.1 Lemma A.2 · faithful paraphrase

Complete source statement (ASTIS restatement)

The actual nu and q are probability measures. W and Wc are jointly measurable in (x,r,z), and m is measurable. For every x, W(x,.) and Wc(x,.) and the excess max(abs(W(x,.))-B,0) are nu-integrable; abs(m(x))<=B and abs(m(x)-(<g,x>-f(x)+C))<=integral max(abs(W(x,a))-B,0) dnu(a). The function exp(m) is q-integrable and exp(-B)<=Z<=exp(B). The first-success output is measurable and its actual rho-pushforward equals q.tilted(m). The never-success event has rho-measure zero. With p_acc=Lambda(accepted), p_acc=ofReal(exp(-B)*Z)>=ofReal(exp(-2B)); the extended-nonnegative expectation of Q is p_acc^(-1)*ofReal(2B), and is at most ofReal(2B*exp(2B)).

E is a finite-dimensional real inner-product space with Borel sigma-algebra and explicit second countability. f:E->R is differentiable everywhere and its actual gradient is globally beta-Lipschitz. Fix eta>0, beta>=0, B>0 and x0,x_plus in E. No convexity, positive dimension, center residual or small-step condition is needed for this selected clipped-program result.
Set g=grad f(x_plus), h=x0-eta*g, P=(z->sqrt(eta) z)_*stdGaussian(E), U=Lebesgue restricted to (0,1], nu=U product P, and q=(z->h+sqrt(eta) z)_*stdGaussian(E). Before choosing x define C=integral f(h+z) dP(z)-<g,h>. The parent mean theorem proves integrability underlying this C.
For x in E, r in R and z in E, theta=pi*r/2, gamma=h+sin(theta)(x-h)+cos(theta)z, v=(pi/2)(cos(theta)(x-h)-sin(theta)z), W(x,(r,z))=<v,g-grad f(gamma)>. Define Wc=min(B,max(-B,W)), m(x)=integral Wc(x,a) dnu(a), and Z=integral exp(m(x)) dq(x).
An attempt is p=(x,N,(a_stream,u)), with law Lambda=q product [Poisson(2B) product (nu^N product Uniform[0,1])]; nu^N denotes the infinite iid auxiliary sequence indexed by natural numbers. All these factors are independent. Accept p when u<=product over i<N of (B+Wc(x,a_i))/(2B). The auxiliary time r inside a_i and acceptance uniform u are distinct random inputs.
Let rho=Lambda^N be the infinite iid sequence of attempts. Output the proposal of the first accepted attempt, using the least natural index; if no attempt succeeds return x0. Define Q(omega)=sum over n>=0 of N_n times the indicator that every i<n failed. This counts all estimator calls in the successful batch as well as failed batches.

Actual clipped law, mean error and full-batch count

\[\widehat q=q.\mathrm{tilted}(m),\quad e^{-B}\le Z\le e^B,\quad |m(x)-(\langle g,x\rangle-f(x)+C)|\le\mathbb E_\nu(|W_x|-B)_+,\quad\mathbb E_\rho Q=\frac{2B}{e^{-B}Z}\le2Be^{2B}.\]

Read the formalized proofs

Each statement and proof below has its own closed Lean disclosure. ASTIS parents, Mathlib calls and external mathematical sources are distinguished in each proof.

ASTIS mathematical exposition

Actual clipped-gradient Poisson retry program

AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.ClippedGradientProgram.clipped_gradient_program · theorem · Teaching coverage

Statement

\[\widehat q=q.\mathrm{tilted}(m),\quad e^{-B}\le Z\le e^B,\quad |m(x)-(\langle g,x\rangle-f(x)+C)|\le\mathbb E_\nu(|W_x|-B)_+,\quad\mathbb E_\rho Q=\frac{2B}{e^{-B}Z}\le2Be^{2B}.\]

All objects and hypotheses

E is a finite-dimensional real inner-product space with Borel sigma-algebra and explicit second countability. f:E->R is differentiable everywhere and its actual gradient is globally beta-Lipschitz. Fix eta>0, beta>=0, B>0 and x0,x_plus in E. No convexity, positive dimension, center residual or small-step condition is needed for this selected clipped-program result.
Set g=grad f(x_plus), h=x0-eta*g, P=(z->sqrt(eta) z)_*stdGaussian(E), U=Lebesgue restricted to (0,1], nu=U product P, and q=(z->h+sqrt(eta) z)_*stdGaussian(E). Before choosing x define C=integral f(h+z) dP(z)-<g,h>. The parent mean theorem proves integrability underlying this C.
For x in E, r in R and z in E, theta=pi*r/2, gamma=h+sin(theta)(x-h)+cos(theta)z, v=(pi/2)(cos(theta)(x-h)-sin(theta)z), W(x,(r,z))=<v,g-grad f(gamma)>. Define Wc=min(B,max(-B,W)), m(x)=integral Wc(x,a) dnu(a), and Z=integral exp(m(x)) dq(x).
An attempt is p=(x,N,(a_stream,u)), with law Lambda=q product [Poisson(2B) product (nu^N product Uniform[0,1])]; nu^N denotes the infinite iid auxiliary sequence indexed by natural numbers. All these factors are independent. Accept p when u<=product over i<N of (B+Wc(x,a_i))/(2B). The auxiliary time r inside a_i and acceptance uniform u are distinct random inputs.
Let rho=Lambda^N be the infinite iid sequence of attempts. Output the proposal of the first accepted attempt, using the least natural index; if no attempt succeeds return x0. Define Q(omega)=sum over n>=0 of N_n times the indicator that every i<n failed. This counts all estimator calls in the successful batch as well as failed batches.

Mathematical proof

1. Use the source center and actual independent inputs

Substitute h=x0-eta grad f(x_plus) in the already proved path-mean theorem. Its constant C is fixed before every x. Continuity of the actual gradient and the explicit sine/cosine path proves measurability jointly in x and both auxiliary variables. Clipping is a continuous min/max operation. The scaled and translated Gaussian pushforwards and uniform-time product are genuine probability laws.

\[h=x_0-\eta\nabla f(x_+),\qquad q=\mathcal N(h,\eta I),\qquad\nu=U\otimes\mathcal N(0,\eta I).\]

Corresponding Lean step

actual_clipped_input; GradientArcMean.gradient_arc_mean; MeasureTheory.Measure.isProbabilityMeasure_map

2. Prove the exact clipping loss before integrating

Split a real estimator value into the three regions below -B, within [-B,B], and above B. The resulting identities give both the everywhere bound on the clipped value and the exact positive-excess loss. These are pointwise real inequalities, independent of any probability approximation.

\[|\operatorname{clip}_{[-B,B]}(t)|\le B,\qquad|\operatorname{clip}_{[-B,B]}(t)-t|=(|t|-B)_+.\]

Corresponding Lean step

clip_bounds; clip_error

3. Control the actual mean by an integrable excess

Bound the measurable clipped estimator by the integrable constant B. The parent gives actual unclipped L1. Hence their difference and its absolute value are integrable, and the exact clipping identity proves excess integrability. Only then subtract their integrals and apply the absolute-integral inequality. Integrating -B<=Wc<=B proves the mean bound. Substituting the parent identity retains the same C.

\[|m(x)-\mathbb E_\nu W_x|\le\mathbb E_\nu|W_x^c-W_x|=\mathbb E_\nu(|W_x|-B)_+,\qquad |m(x)|\le B.\]

Corresponding Lean step

clipped_mean; actual_clipped_input; MeasureTheory.integral_sub; MeasureTheory.abs_integral_le_integral_abs; MeasureTheory.integral_mono

4. Normalize the clipped law with proved bounds

Measurable parameter integration makes m measurable. Its bound implies exp(-B)<=exp(m(x))<=exp(B). The upper constant is integrable under actual probability q, so exp(m) is integrable. Integrating the two pointwise bounds establishes a strictly positive finite Z. This argument normalizes only the clipped target; it uses no unproved exponential-integrability assumption for the ideal potential.

\[0<e^{-B}\le Z=\int e^{m(x)}q(dx)\le e^B<\infty.\]

Corresponding Lean step

clipped_normalizer; MeasureTheory.StronglyMeasurable.integral_prod_right'; MeasureTheory.Integrable.mono'; MeasureTheory.integral_mono

5. Identify the same actual first-success program

Instantiate the established Poisson rejection theorem with the constant proposal kernel q and the actual clipped W. Expand the attempt, acceptance, first-output and cost definitions and check definitional equality with the parent program. Each attempt draws independent proposal, Poisson count, auxiliary stream and acceptance uniform. The first-success output uses the least accepted index and the explicit null-event default x0. The inherited law identifies the actual pushforward as the clipped exponential tilt, rather than merely constructing an abstract comparison law.

\[\rho=\Lambda^{\mathbb N},\quad\rho\circ\mathrm{out}^{-1}=q.\mathrm{tilted}(m),\quad\rho(\text{no accepted attempt})=0.\]

Corresponding Lean step

actual_retry; PoissonRejection.poisson_rejection_output; attempts; accepted; output

6. Compute acceptance using the finite clipped normalizer

The actual parent program gives acceptance mass as the integral of exp(m-B). Its integrability follows from that of exp(m). Nonnegativity justifies converting the real integral to the extended-nonnegative integral; constant factor extraction then gives exp(-B)Z. The same-program lower acceptance bound is exp(-2B).

\[p_{\rm acc}=\int e^{m(x)-B}q(dx)=e^{-B}Z\ge e^{-2B}.\]

Corresponding Lean step

actual_retry; MeasureTheory.ofReal_integral_eq_lintegral_ofReal; MeasureTheory.integral_div; Real.exp_neg

7. Charge the successful batch under the actual input law

At index n, charge its full Poisson count whenever all earlier attempts failed; current acceptance is not assumed independent of that count. The parent theorem already proves the resulting stopped-sum expectation for these iid attempts. Substitute the actual acceptance mass. The bound uses its positive lower bound and remains attached to rho throughout. This is an estimator-call count; translating it into complete oracle accounting and a uniform constant bound requires later work.

\[Q=\sum_{n\ge0}N_n\mathbf1\{\text{all }i<n\text{ failed}\},\qquad\mathbb E_\rho Q=p_{\rm acc}^{-1}(2B)\le2Be^{2B}.\]

Corresponding Lean step

queryCount; actual_retry; PoissonRejection.poisson_rejection_output; clipped_gradient_program

Lean statement · clipped_gradient_program

Actual clipped-input measurability and L1, common-C mean loss, positive finite clipped normalization, exact first-success law and full-batch expected count.

theorem clipped_gradient_program (f : E → ℝ) (hf : Differentiable ℝ f)
    (eta beta B : ℝ) (heta : 0 < eta) (hbeta : 0 ≤ beta) (hB : 0 < B)
    (hlip : LipschitzWith ⟨beta,hbeta⟩ (gradient f)) (x0 xp : E) :
    let h := x0 - eta • gradient f xp
    let P := (stdGaussian E).map (fun z => Real.sqrt eta • z)
    let U := volume.restrict (Set.Ioc (0 : ℝ) 1)
    let ν := U.prod P
    let q := (stdGaussian E).map (fun z => h + Real.sqrt eta • z)
    let C := (∫ z, f (h+z) ∂P) - inner ℝ (gradient f xp) h
    let W := estimator f h xp
    let Wc := fun p => clip B (W p)
    let m := fun x => ∫ z, Wc (x,z) ∂ν
    let Z := ∫ x, Real.exp (m x) ∂q
    let Λ := attempts q ν B hB
    let ρ := Measure.infinitePi (fun _ : ℕ => Λ)
    IsProbabilityMeasure ν ∧ IsProbabilityMeasure q ∧
      Measurable W ∧ Measurable Wc ∧ Measurable m ∧
      (∀ x, Integrable (fun z => W (x,z)) ν ∧
        Integrable (fun z => Wc (x,z)) ν ∧
        Integrable (fun z => max (|W (x,z)|-B) 0) ν ∧ |m x| ≤ B ∧
        |m x - (inner ℝ (gradient f xp) x - f x + C)| ≤
          ∫ z, max (|W (x,z)|-B) 0 ∂ν) ∧
      Integrable (fun x => Real.exp (m x)) q ∧
      Real.exp (-B) ≤ Z ∧ Z ≤ Real.exp B ∧
      Measurable (output Wc B x0) ∧ ρ.map (output Wc B x0) = q.tilted m ∧
      ρ {ω | ∀ n, ω n ∉ accepted Wc B} = 0 ∧
      Λ (accepted Wc B) = ENNReal.ofReal (Real.exp (-B)*Z) ∧
      ENNReal.ofReal (Real.exp (-2*B)) ≤ Λ (accepted Wc B) ∧
      (∫⁻ ω, queryCount Wc B ω ∂ρ) =
        (ENNReal.ofReal (Real.exp (-B)*Z))⁻¹ * ENNReal.ofReal (2*B) ∧
      (∫⁻ ω, queryCount Wc B ω ∂ρ) ≤ ENNReal.ofReal (2*B*Real.exp (2*B))

Exact module and namespace context

Lean proof · clipped_gradient_program

Pointwise clipping identities, actual parent mean, integrable domination, measurable integration, normalization bounds, and definitional reuse of the true iid rejection program.

theorem clipped_gradient_program (f : E → ℝ) (hf : Differentiable ℝ f)
    (eta beta B : ℝ) (heta : 0 < eta) (hbeta : 0 ≤ beta) (hB : 0 < B)
    (hlip : LipschitzWith ⟨beta,hbeta⟩ (gradient f)) (x0 xp : E) :
    let h := x0 - eta • gradient f xp
    let P := (stdGaussian E).map (fun z => Real.sqrt eta • z)
    let U := volume.restrict (Set.Ioc (0 : ℝ) 1)
    let ν := U.prod P
    let q := (stdGaussian E).map (fun z => h + Real.sqrt eta • z)
    let C := (∫ z, f (h+z) ∂P) - inner ℝ (gradient f xp) h
    let W := estimator f h xp
    let Wc := fun p => clip B (W p)
    let m := fun x => ∫ z, Wc (x,z) ∂ν
    let Z := ∫ x, Real.exp (m x) ∂q
    let Λ := attempts q ν B hB
    let ρ := Measure.infinitePi (fun _ : ℕ => Λ)
    IsProbabilityMeasure ν ∧ IsProbabilityMeasure q ∧
      Measurable W ∧ Measurable Wc ∧ Measurable m ∧
      (∀ x, Integrable (fun z => W (x,z)) ν ∧
        Integrable (fun z => Wc (x,z)) ν ∧
        Integrable (fun z => max (|W (x,z)|-B) 0) ν ∧ |m x| ≤ B ∧
        |m x - (inner ℝ (gradient f xp) x - f x + C)| ≤
          ∫ z, max (|W (x,z)|-B) 0 ∂ν) ∧
      Integrable (fun x => Real.exp (m x)) q ∧
      Real.exp (-B) ≤ Z ∧ Z ≤ Real.exp B ∧
      Measurable (output Wc B x0) ∧ ρ.map (output Wc B x0) = q.tilted m ∧
      ρ {ω | ∀ n, ω n ∉ accepted Wc B} = 0 ∧
      Λ (accepted Wc B) = ENNReal.ofReal (Real.exp (-B)*Z) ∧
      ENNReal.ofReal (Real.exp (-2*B)) ≤ Λ (accepted Wc B) ∧
      (∫⁻ ω, queryCount Wc B ω ∂ρ) =
        (ENNReal.ofReal (Real.exp (-B)*Z))⁻¹ * ENNReal.ofReal (2*B) ∧
      (∫⁻ ω, queryCount Wc B ω ∂ρ) ≤ ENNReal.ofReal (2*B*Real.exp (2*B)) := by
  dsimp only
  let h := x0 - eta • gradient f xp
  let P := (stdGaussian E).map (fun z => Real.sqrt eta • z)
  let ν := (volume.restrict (Set.Ioc (0 : ℝ) 1)).prod P
  let q := (stdGaussian E).map (fun z => h + Real.sqrt eta • z)
  let W := estimator f h xp
  let Wc := fun p => clip B (W p)
  obtain ⟨hν, hw, hc, hm, hx⟩ := actual_clipped_input f hf eta beta B heta hbeta hB hlip x0 xp
  let : IsProbabilityMeasure ν := hν
  have hq : Measurable (fun z : E => h + Real.sqrt eta • z) := by fun_prop
  let : IsProbabilityMeasure q := Measure.isProbabilityMeasure_map hq.aemeasurable
  obtain ⟨hi, hzlow, hzup⟩ := clipped_normalizer q _ hm B (fun x => (hx x).2.2.2.1)
  have hr := actual_retry q ν Wc hc B hB (fun x z => clip_bounds B (W (x,z)) hB.le) x0
  exact ⟨hν, inferInstance, hw, hc, hm, hx, hi, hzlow, hzup, hr⟩

end AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.ClippedGradientProgram

Exact module and namespace context

Source assumptions versus formal assumptions

Source	Actual Lean	Difference kind	Why it matters
Euclidean smooth setting with positive dimension.	Finite-dimensional real inner-product Borel space including zero dimension; explicit second countability.	generalization	All operations and Gaussian laws are coordinate-free. No division by dimension occurs; second countability is automatic here.
Smoothness coefficient is conventionally positive.	beta>=0 and differentiable f with the actual beta-Lipschitz gradient.	generalization	The beta0 case satisfies the same proof; no division by beta is used.
Clipping is part of an accuracy theorem with step, residual and parameter conditions.	eta>0 and B>0 suffice for this fixed actual clipped law, mean error and 2Bexp(2B) estimator-count bound.	generalization	These selected construction results do not need the additional conditions used to make excess small or obtain the source uniform constant cost. Those conclusions are not asserted.
Auxiliary time and acceptance uniform are separately sampled on [0,1].	Auxiliary time uses Ioc(0,1); acceptance uniform uses Icc(0,1); they are independent factors.	source-implicit	Lebesgue endpoints have zero mass. The variables remain distinct, and the acceptance product reads only the first Poisson-many auxiliary coordinates.
The clipped expectation determines a normalized output law, and the unclipped mean identifies the log weight up to a constant.	Joint measurability including x, all needed auxiliary L1, measurable m, same C, integrable exp(m), and positive finite clipped Z are proved.	source-implicit	No assumed mean or integrability replaces the actual estimator. Clipping yields its own normalization and does not establish ideal Gibbs normalization.
Repeat the actual independent attempts until success.	First accepted index via Nat.find; default x0 on the never-hit event with probability zero.	source-implicit	The explicit default makes the output total; exact parent definitions preserve the same almost-sure algorithm and actual law.
Full-batch Poisson estimation is used for the gradient implementation.	Cost is the complete estimator-call count, including the successful batch, under the actual iid law.	same	The proved selected counter is not yet a full gradient-oracle accounting model. Cached reference-gradient preparation and accuracy-dependent uniform constants remain separate.
D.1 construction supports the terminal normalized approximation in SPHMC A.4(2).	Fixed eta,beta,B,x0,x_plus; actual clipped tilt and mean error only, no global adaptive-parameter kernel or ideal/Renyi theorem.	same	This is the selected actual-program proof edge; the remaining downstream conditions are retained rather than claimed from this result.

This is a fixed-parameter actual clipped program, including its true-input estimator count. Coordinate-free spaces, zero dimension and beta=0 are disclosed extensions. The output law is the normalized clipped tilt; the ideal Gibbs/RGO law, positive finite ideal normalization, normalized Renyi accuracy, adaptive eta/x0/x_plus kernel and initialization remain separate. Potential L1 for C is supplied by the parent proof, not separately returned as a public conjunct here. No separate RN bound is asserted. Cost counts complete batches of estimator calls, including success; reference-gradient preparation, full gradient-oracle accounting and random-number cost are not proved. An arbitrary B>0 bound 2B exp(2B) is not a uniform constant-cost theorem; source parameter and accuracy conditions are still required. Neither companion paper is complete.

Encoder–denoiser: accepted · domain-mismatch

Detected semantic differences

domains: Coordinate-free/zero-dimensional extension valid; second countability automatic. — Independent formal reviewer accepted this disclosed difference: Coordinate-free/zero-dimensional extension valid; second countability automatic.
assumptions: Beta0 uses same proof without division. — Independent formal reviewer accepted this disclosed difference: Beta0 uses same proof without division.
assumptions: Residual/small-step assumptions not needed for selected construction; downstream accuracy/uniform-cost remain unclaimed. — Independent formal reviewer accepted this disclosed difference: Residual/small-step assumptions not needed for selected construction; downstream accuracy/uniform-cost remain unclaimed.
objects: Ioc/Icc differ by null endpoint; auxiliary time and acceptance uniform distinct independent coordinates, only first N auxiliaries read. — Independent formal reviewer accepted this disclosed difference: Ioc/Icc differ by null endpoint; auxiliary time and acceptance uniform distinct independent coordinates, only first N auxiliaries read.
conclusion: Actual L1/measurability justify same-C comparison and clipped normalization; potential L1 supporting C is parent result, not extra public conjunct. — Independent formal reviewer accepted this disclosed difference: Actual L1/measurability justify same-C comparison and clipped normalization; potential L1 supporting C is parent result, not extra public conjunct.
objects: Nat.find is first success; x0 default totalizes null never-hit branch. — Independent formal reviewer accepted this disclosed difference: Nat.find is first success; x0 default totalizes null never-hit branch.
scopes: Actual full-batch estimator counter, not separate gradient-oracle/wall-clock model. — Independent formal reviewer accepted this disclosed difference: Actual full-batch estimator counter, not separate gradient-oracle/wall-clock model.
scopes: Fixed-parameter clipped law/residual inequality only; ideal-target and global adaptive-kernel obligations retained. — Independent formal reviewer accepted this disclosed difference: Fixed-parameter clipped law/residual inequality only; ideal-target and global adaptive-kernel obligations retained.

A generalization is not a source correction. Proposed missing conditions require separate independent repair review. No proposed repair silently changes the original theorem.

Scope and omitted-condition boundaries

This is a fixed-parameter actual clipped program, including its true-input estimator count. Coordinate-free spaces, zero dimension and beta=0 are disclosed extensions. The output law is the normalized clipped tilt; the ideal Gibbs/RGO law, positive finite ideal normalization, normalized Renyi accuracy, adaptive eta/x0/x_plus kernel and initialization remain separate. Potential L1 for C is supplied by the parent proof, not separately returned as a public conjunct here. No separate RN bound is asserted. Cost counts complete batches of estimator calls, including success; reference-gradient preparation, full gradient-oracle accounting and random-number cost are not proved. An arbitrary B>0 bound 2B exp(2B) is not a uniform constant-cost theorem; source parameter and accuracy conditions are still required. Neither companion paper is complete.

Source and reuse

ASTIS parents called

Mathlib API called (external library)

MeasureTheory.Measure.isProbabilityMeasure_map
MeasureTheory.integral_sub
MeasureTheory.abs_integral_le_integral_abs
MeasureTheory.integral_mono
MeasureTheory.StronglyMeasurable.integral_prod_right'
MeasureTheory.ofReal_integral_eq_lintegral_ofReal
MeasureTheory.integral_div

Mathematical sources

Appendix D.1 Eq. (18) and clipping comparison — Actual clipped gradient estimator output and mean truncation step.
SPHMC Appendices A.4(2) and A.1 Lemma A.2 — Terminal gradient approximation and the bounded Poisson rejection mechanism; full accuracy and oracle cost separate.
Algorithm 1 — Actual full-batch Poisson rejection mechanism reused through its proved parent.

ASTIS prose is not a quotation or a source-equivalence certificate. Definitions and aliases are explained as constructions, not counted as new mathematical proofs.

Which proof edges are actually covered?

Local proof component; source adapter/review separate Actual clipped estimator input, normalized retry output and true-input mean/cost bounds

Actual clipped-output exponential mean-error bounds

ASTIS mathematical restatement and exposition of the clipping moment argument used by Fan Chen, Sinho Chewi, Jianfeng Lu and Matthew S. Zhang, Smoothed Picard Hamiltonian Monte Carlo.

arXiv:2602.01338v1 · Appendix D.1 Claim2/Eq18 and Lemma B.12; consumed by SPHMC Appendix A.4(2) · faithful paraphrase

Complete source statement (ASTIS restatement)

m, mB and V are measurable. For every x, V(x)>=0 and abs(m(x)-mB(x))<=V(x). The function J(x)=exp(2*ell*V(x))-1 is integrable under q and qhat, with respective integrals at most 2*exp(-K) and 2*exp(2*B-K). The function exp(2*ell*abs(m(x)-mB(x)))-1 is qhat-integrable and its integral is at most 2*exp(2*B-K).

E is a finite-dimensional real inner-product Borel space, d=finrank(E)>0. The actual potential f is differentiable everywhere and its actual gradient is globally beta-Lipschitz. eta,beta,B>0 and ell>=2.
Set g=grad f(x_plus), h=x0-eta*g. Assume norm(h-x_plus)<=sqrt(d*eta) and 64*beta^2*(ell*d/B+ell^2)<=1/eta^2. These residual and step assumptions are retained exactly.
Let P=(z->sqrt(eta) z)_*stdGaussian(E), U=volume restricted to (0,1], nu=U product P and q=(z->h+sqrt(eta) z)_*stdGaussian(E). For s=(r,z), theta=pi*r/2, gamma=h+sin(theta)(x-h)+cos(theta)z and v=(pi/2)(cos(theta)(x-h)-sin(theta)z), define W(x,s)=<v,g-grad f(gamma)>.
Define m(x)=integral W(x,s) dnu(s), mB(x)=integral min(B,max(-B,W(x,s))) dnu(s), V(x)=integral max(abs(W(x,s))-B,0) dnu(s), qhat=q.tilted(mB), and K=min(B^2/(40*beta^2*d*eta^2),B/(8*beta*eta)). All functions and measures are actual definitions, not abstract witnesses.

Actual clipped-output moment

\[\mathbb E_q[e^{2\ell V}-1]\le 2e^{-K},\qquad \mathbb E_{\widehat q}[e^{2\ell V}-1]\le 2e^{2B-K},\qquad \mathbb E_{\widehat q}[e^{2\ell|m-m_B|}-1]\le 2e^{2B-K}.\]

Read the formalized proofs

Each statement and proof below has its own closed Lean disclosure. ASTIS parents, Mathlib calls and external mathematical sources are distinguished in each proof.

ASTIS mathematical exposition

Actual clipped-output exponential mean-error bounds

AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.ClippedMeanExponential.clipped_mean_exponential · theorem · Teaching coverage

Statement

\[\mathbb E_q[e^{2\ell V}-1]\le 2e^{-K},\qquad \mathbb E_{\widehat q}[e^{2\ell V}-1]\le 2e^{2B-K},\qquad \mathbb E_{\widehat q}[e^{2\ell|m-m_B|}-1]\le 2e^{2B-K}.\]

All objects and hypotheses

E is a finite-dimensional real inner-product Borel space, d=finrank(E)>0. The actual potential f is differentiable everywhere and its actual gradient is globally beta-Lipschitz. eta,beta,B>0 and ell>=2.
Set g=grad f(x_plus), h=x0-eta*g. Assume norm(h-x_plus)<=sqrt(d*eta) and 64*beta^2*(ell*d/B+ell^2)<=1/eta^2. These residual and step assumptions are retained exactly.
Let P=(z->sqrt(eta) z)_*stdGaussian(E), U=volume restricted to (0,1], nu=U product P and q=(z->h+sqrt(eta) z)_*stdGaussian(E). For s=(r,z), theta=pi*r/2, gamma=h+sin(theta)(x-h)+cos(theta)z and v=(pi/2)(cos(theta)(x-h)-sin(theta)z), define W(x,s)=<v,g-grad f(gamma)>.
Define m(x)=integral W(x,s) dnu(s), mB(x)=integral min(B,max(-B,W(x,s))) dnu(s), V(x)=integral max(abs(W(x,s))-B,0) dnu(s), qhat=q.tilted(mB), and K=min(B^2/(40*beta^2*d*eta^2),B/(8*beta*eta)). All functions and measures are actual definitions, not abstract witnesses.

Mathematical proof

1. Use the actual fixed-time clipping estimate

For each real time r, the parent theorem applies to the actual independent proposal and auxiliary Gaussians. It proves integrability of the nonnegative exponential excess and its uniform bound. Joint measurability follows from the actual Lipschitz gradient and the explicit trigonometric estimator. Integrability of the section integrals follows by domination with the constant bound, so the product integrability criterion proves genuine joint L1 before any use of Fubini.

\[H(r,x,z)=e^{2\ell(|W(x,r,z)|-B)_+}-1\ge0,\quad \int H(r,x,z)\,d(q\otimes P)\le2e^{-K}.\]

Corresponding Lean step

product_bound; actual_time_product; AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.SmoothGradientArcClipping.smooth_gradient_arc_clipping

2. Reorder the independent inputs with a measure-preserving map

Compose the measurable product associator, the swap of the proposal and time coordinates, and the inverse associator. This gives the actual map (x,(r,z)) to (r,(x,z)). Its measure-preserving property transfers joint integrability and the integral exactly, without replacing any marginal distribution or introducing a new independence assumption.

\[T_*(q\otimes(U\otimes P))=U\otimes(q\otimes P),\qquad T(x,(r,z))=(r,(x,z)).\]

Corresponding Lean step

swap_time_preserving; swap_time_integrable; MeasureTheory.Measure.measurePreserving_swap

3. Apply conditional Jensen only after establishing integrability

The program parent proves integrability of the truncation excess for every fixed x. Genuine joint exponential L1 supplies exponential section integrability for q-almost every x. Apply convexity of the exponential on those sections. Measurability of V follows from the measurable parameter integral. The resulting nonnegative Jensen bound dominates J by an integrable section integral, proving outer L1 before integrating the inequality.

\[e^{2\ell V(x)}-1\le\int\!\left(e^{2\ell(|W(x,s)|-B)_+}-1\right)d\nu(s)\quad(q\text{-a.e. }x).\]

Corresponding Lean step

exponential_mean_bound; integrated_exponential_mean; actual_proposal_bound; convexOn_exp.map_integral_le

4. Identify the actual means and the pointwise truncation error

GradientArcMean identifies the untruncated mean with the actual affine potential expression using a single constant chosen independently of x. ClippedGradientProgram proves the corresponding error estimate and measurability for the actual clipped mean. Substituting the common mean identity gives the pointwise bound for every x. Nonnegativity of V comes from its nonnegative integrand.

\[m(x)=\langle g,x\rangle-f(x)+C,\qquad 0\le V(x),\qquad |m(x)-m_B(x)|\le V(x).\]

Corresponding Lean step

AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.GradientArcMean.gradient_arc_mean; AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.ClippedGradientProgram.clipped_gradient_program

5. Bound the actual clipped density using its positive normalizer

The program parent gives abs(mB)<=B and ZB>=exp(-B)>0. Thus the actual clipped density w=exp(mB)/ZB is nonnegative, measurable and at most exp(2B). Dominate w*J by exp(2B)*J to prove weighted integrability first. The withDensity equivalence then gives J integrability under qhat, and integration of the density bound yields the clipped-output estimate. No closeness metric is used to transport this unbounded function.

\[Z_B=\int e^{m_B}\,dq\ge e^{-B}>0,\qquad 0\le\frac{e^{m_B(x)}}{Z_B}\le e^{2B},\qquad \int J\,d\widehat q\le e^{2B}\int J\,dq.\]

Corresponding Lean step

clipped_density_transfer; MeasureTheory.integrable_withDensity_iff_integrable_smul'; MeasureTheory.integral_withDensity_eq_integral_toReal_smul

6. Dominate the true mean error under the clipped output law

Since ell>=2, monotonicity of the exponential and the pointwise mean-error bound dominate the nonnegative true-error exponential by J. Its measurability and this domination prove its integrability under the actual clipped output law. Integrating gives the same bound, retaining the prefactor 2. Normalized comparison with the ideal law is a subsequent theorem obligation.

\[0\le e^{2\ell|m-m_B|}-1\le e^{2\ell V}-1,\qquad \int(e^{2\ell|m-m_B|}-1)\,d\widehat q\le2e^{2B-K}.\]

Corresponding Lean step

clipped_mean_exponential; MeasureTheory.Integrable.mono'; MeasureTheory.integral_mono

Lean statement · clipped_mean_exponential

Three measurable actual means/excess functions, pointwise nonnegative excess and mean-error bound, three outer exponential L1 statements and three explicit integral bounds.

theorem clipped_mean_exponential (f : E → ℝ) (hf : Differentiable ℝ f)
    (eta beta B ell : ℝ) (heta : 0 < eta) (hbeta : 0 < beta) (hB : 0 < B)
    (hell : 2 ≤ ell) (hd : 0 < (Module.finrank ℝ E : ℝ))
    (hlip : LipschitzWith ⟨beta,hbeta.le⟩ (gradient f)) (x0 xp : E)
    (hcenter : ‖(x0-eta • gradient f xp)-xp‖ ≤ Real.sqrt ((Module.finrank ℝ E : ℝ)*eta))
    (hstep : 64*beta^2*(ell*(Module.finrank ℝ E : ℝ)/B+ell^2) ≤ 1/eta^2) :
    let h := x0-eta • gradient f xp
    let q := (stdGaussian E).map (fun z => h+Real.sqrt eta • z)
    let P := (stdGaussian E).map (fun z => Real.sqrt eta • z)
    let nu := (volume.restrict (Set.Ioc (0 : ℝ) 1)).prod P
    let m := fun x => ∫ a, estimator f h xp (x,a) ∂nu
    let mB := fun x => ∫ a, min B (max (-B) (estimator f h xp (x,a))) ∂nu
    let V := fun x => ∫ a, max (|estimator f h xp (x,a)|-B) 0 ∂nu
    let qhat := q.tilted mB
    let K := min (B^2/(40*beta^2*(Module.finrank ℝ E : ℝ)*eta^2)) (B/(8*beta*eta))
    Measurable m ∧ Measurable mB ∧ Measurable V ∧
      (∀ x, 0 ≤ V x ∧ |m x-mB x| ≤ V x) ∧
      Integrable (fun x => Real.exp (2*ell*V x)-1) q ∧
      (∫ x, Real.exp (2*ell*V x)-1 ∂q) ≤ 2*Real.exp (-K) ∧
      Integrable (fun x => Real.exp (2*ell*V x)-1) qhat ∧
      (∫ x, Real.exp (2*ell*V x)-1 ∂qhat) ≤ 2*Real.exp (2*B-K) ∧
      Integrable (fun x => Real.exp (2*ell*|m x-mB x|)-1) qhat ∧
      (∫ x, Real.exp (2*ell*|m x-mB x|)-1 ∂qhat) ≤ 2*Real.exp (2*B-K)

Exact module and namespace context

Lean proof · clipped_mean_exponential

Actual product L1, measure-preserving reordering, conditional Jensen, actual mean identity, positive clipped normalizer and density domination.

theorem clipped_mean_exponential (f : E → ℝ) (hf : Differentiable ℝ f)
    (eta beta B ell : ℝ) (heta : 0 < eta) (hbeta : 0 < beta) (hB : 0 < B)
    (hell : 2 ≤ ell) (hd : 0 < (Module.finrank ℝ E : ℝ))
    (hlip : LipschitzWith ⟨beta,hbeta.le⟩ (gradient f)) (x0 xp : E)
    (hcenter : ‖(x0-eta • gradient f xp)-xp‖ ≤ Real.sqrt ((Module.finrank ℝ E : ℝ)*eta))
    (hstep : 64*beta^2*(ell*(Module.finrank ℝ E : ℝ)/B+ell^2) ≤ 1/eta^2) :
    let h := x0-eta • gradient f xp
    let q := (stdGaussian E).map (fun z => h+Real.sqrt eta • z)
    let P := (stdGaussian E).map (fun z => Real.sqrt eta • z)
    let nu := (volume.restrict (Set.Ioc (0 : ℝ) 1)).prod P
    let m := fun x => ∫ a, estimator f h xp (x,a) ∂nu
    let mB := fun x => ∫ a, min B (max (-B) (estimator f h xp (x,a))) ∂nu
    let V := fun x => ∫ a, max (|estimator f h xp (x,a)|-B) 0 ∂nu
    let qhat := q.tilted mB
    let K := min (B^2/(40*beta^2*(Module.finrank ℝ E : ℝ)*eta^2)) (B/(8*beta*eta))
    Measurable m ∧ Measurable mB ∧ Measurable V ∧
      (∀ x, 0 ≤ V x ∧ |m x-mB x| ≤ V x) ∧
      Integrable (fun x => Real.exp (2*ell*V x)-1) q ∧
      (∫ x, Real.exp (2*ell*V x)-1 ∂q) ≤ 2*Real.exp (-K) ∧
      Integrable (fun x => Real.exp (2*ell*V x)-1) qhat ∧
      (∫ x, Real.exp (2*ell*V x)-1 ∂qhat) ≤ 2*Real.exp (2*B-K) ∧
      Integrable (fun x => Real.exp (2*ell*|m x-mB x|)-1) qhat ∧
      (∫ x, Real.exp (2*ell*|m x-mB x|)-1 ∂qhat) ≤ 2*Real.exp (2*B-K) := by
  let h := x0-eta • gradient f xp
  let q := (stdGaussian E).map (fun z => h+Real.sqrt eta • z)
  let P := (stdGaussian E).map (fun z => Real.sqrt eta • z)
  let nu := (volume.restrict (Set.Ioc (0 : ℝ) 1)).prod P
  let m := fun x => ∫ a, estimator f h xp (x,a) ∂nu
  let mB := fun x => ∫ a, min B (max (-B) (estimator f h xp (x,a))) ∂nu
  let V := fun x => ∫ a, max (|estimator f h xp (x,a)|-B) 0 ∂nu
  let K := min (B^2/(40*beta^2*(Module.finrank ℝ E : ℝ)*eta^2)) (B/(8*beta*eta))
  have hp := AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.ClippedGradientProgram.clipped_gradient_program
    f hf eta beta B heta hbeta.le hB hlip x0 xp
  have hmB : Measurable mB := hp.2.2.2.2.1
  have hx := hp.2.2.2.2.2.1
  have hmean := AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.GradientArcMean.gradient_arc_mean
    f hf eta beta heta hbeta.le hlip h xp
  let C := (∫ z, f (h+z) ∂P)-inner ℝ (gradient f xp) h
  have hme (x : E) : m x = inner ℝ (gradient f xp) x-f x+C :=
    (hmean.2.2.2 x).2.2.2
  have hm : Measurable m := by
    have heq : m = fun x => inner ℝ (gradient f xp) x-f x+C := funext hme
    rw [heq]
    exact ((by fun_prop : Measurable (fun x => inner ℝ (gradient f xp) x)).sub
      hf.continuous.measurable).add_const C
  have herr (x : E) : |m x-mB x| ≤ V x := by
    rw [abs_sub_comm, hme]
    exact (hx x).2.2.2.2
  have hv := actual_proposal_bound f hf eta beta B ell heta hbeta hB hell hd hlip x0 xp hcenter hstep
  have hV : Measurable V := hv.1
  have he : 0 ≤ 2*ell := by linarith
  have hJpos (x : E) : 0 ≤ Real.exp (2*ell*V x)-1 :=
    sub_nonneg.mpr (Real.one_le_exp_iff.mpr (mul_nonneg he (hv.2.1 x)))
  have ht := clipped_density_transfer q mB (fun x => Real.exp (2*ell*V x)-1)
    hmB (by fun_prop) hJpos hv.2.2.1 B (fun x => (abs_le.mp ((hx x).2.2.2.1)).2)
      hp.2.2.2.2.2.2.2.1
  have hbound : (∫ x, Real.exp (2*ell*V x)-1 ∂q.tilted mB) ≤ 2*Real.exp (2*B-K) := by
    calc
      _ ≤ Real.exp (2*B)*(2*Real.exp (-K)) :=
        ht.2.trans (mul_le_mul_of_nonneg_left hv.2.2.2 (Real.exp_nonneg _))
      _ = _ := by
        rw [← mul_assoc, mul_comm (Real.exp (2*B)) 2, mul_assoc, ← Real.exp_add]
        congr 2
  have hpoint (x : E) : Real.exp (2*ell*|m x-mB x|)-1 ≤ Real.exp (2*ell*V x)-1 := by
    exact sub_le_sub_right (Real.exp_le_exp.mpr (mul_le_mul_of_nonneg_left (herr x) he)) 1
  have hEpos (x : E) : 0 ≤ Real.exp (2*ell*|m x-mB x|)-1 :=
    sub_nonneg.mpr (Real.one_le_exp_iff.mpr (mul_nonneg he (abs_nonneg _)))
  have hEi : Integrable (fun x => Real.exp (2*ell*|m x-mB x|)-1) (q.tilted mB) := by
    apply ht.1.mono' (by fun_prop)
    exact Filter.Eventually.of_forall (fun x => by
      simpa only [Real.norm_eq_abs, abs_of_nonneg (hEpos x)] using hpoint x)
  exact ⟨hm, hmB, hV, fun x => ⟨hv.2.1 x, herr x⟩, hv.2.2.1, hv.2.2.2,
    ht.1, hbound, hEi, (integral_mono hEi ht.1 hpoint).trans hbound⟩

end AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.ClippedMeanExponential

Exact module and namespace context

Source assumptions versus formal assumptions

Source	Actual Lean	Difference kind	Why it matters
Euclidean smooth sampling in positive dimension.	Finite-dimensional real inner-product Borel space with strictly positive finrank.	generalization	Coordinate-free Gaussian and gradient interfaces retain the positive dimension assumption.
Positive smoothness, clipping and step parameters with Claim2 residual and step conditions.	eta,beta,B,d>0,ell>=2, residual bound and the displayed 64-condition are retained.	same	This packet does not extend to beta=0 or zero dimension.
Uniform auxiliary time on [0,1].	Restricted volume on (0,1], independently multiplied with the actual Gaussian.	source-implicit	Endpoint differences have zero Lebesgue mass.
Appendix D.1 Claim2 and Eq18 use exponential clipping control under the implemented clipped law.	Three explicit L1 statements and nonlogarithmic moment bounds, retaining factor 2 and constants 40 and 8.	same	This is the moment dependency, not the entire normalized Renyi claim; no earlier logarithmic simplification is reused.
Conditional Jensen and changes of integration order are used in the moment argument.	Joint L1 precedes Fubini; exponential section L1 is obtained q-almost everywhere; the actual mean-error bound is pointwise for every x.	source-implicit	These distinct integrability and quantifier obligations are proved.
SPHMC Appendix A.4(2) consumes a terminal approximate RGO.	qhat is the clipped tilt previously identified with actual program output; ideal comparison, full implementation accuracy and cost remain separate.	same	No full paper or full algorithm completion is asserted.

This proves three exponential-minus-one integrability statements and their explicit bounds under the actual proposal and actual clipped tilt. ClippedGradientProgram already identifies qhat with the actual program output; this theorem does not repeat its pushforward equality. It does not assert normalized Radon-Nikodym power identities, a Renyi divergence bound, an ideal-target equality, a joint adaptive kernel, initialization or query cost. The factor 2 is retained and no logarithmic estimate is claimed. Neither full companion paper is complete.

Encoder–denoiser: accepted · domain-mismatch

Detected semantic differences

domains: Coordinate-free domain preserves positive dimension. — Independent formal reviewer accepted: Coordinate-free domain preserves positive dimension.
assumptions: All positive parameters,ell>=2,residual and64-condition retained. — Independent formal reviewer accepted: All positive parameters,ell>=2,residual and64-condition retained.
objects: Ioc/Icc differ by null endpoint. — Independent formal reviewer accepted: Ioc/Icc differ by null endpoint.
conclusion: Selected nonlog moment preserves2,40,8; no complete normalized comparison. — Independent formal reviewer accepted: Selected nonlog moment preserves2,40,8; no complete normalized comparison.
quantifiers: Joint L1,a.e.exponential sections and pointwise mean error distinguished/proved. — Independent formal reviewer accepted: Joint L1,a.e.exponential sections and pointwise mean error distinguished/proved.
scopes: Actual clipped-output moment prerequisite only,not ideal/fullalgorithm. — Independent formal reviewer accepted: Actual clipped-output moment prerequisite only,not ideal/fullalgorithm.

A generalization is not a source correction. Proposed missing conditions require separate independent repair review. No proposed repair silently changes the original theorem.

Scope and omitted-condition boundaries

This proves three exponential-minus-one integrability statements and their explicit bounds under the actual proposal and actual clipped tilt. ClippedGradientProgram already identifies qhat with the actual program output; this theorem does not repeat its pushforward equality. It does not assert normalized Radon-Nikodym power identities, a Renyi divergence bound, an ideal-target equality, a joint adaptive kernel, initialization or query cost. The factor 2 is retained and no logarithmic estimate is claimed. Neither full companion paper is complete.

Source and reuse

ASTIS parents called

Mathlib API called (external library)

convexOn_exp.map_integral_le
MeasureTheory.integrable_prod_iff
MeasureTheory.integrable_withDensity_iff_integrable_smul'
MeasureTheory.integral_mono

Mathematical sources

Appendix D.1 Claim2, Eq18 and Lemma B.12 — Actual exponential clipping moment needed for normalized comparison.
SPHMC Appendix A.4(2) — Terminal sampler consumer; full accuracy and costs remain separate.

ASTIS prose is not a quotation or a source-equivalence certificate. Definitions and aliases are explained as constructions, not counted as new mathematical proofs.

Which proof edges are actually covered?

Local proof component; source adapter/review separate Actual proposal and clipped-output exponential mean-error integrability and bounds

Actual clipped and ideal RGO bidirectional RN moments

ASTIS mathematical restatement of the D.1/B.12 normalized comparison in Fan Chen, Sinho Chewi, Constantinos Daskalakis and Alexander Rakhlin, High-accuracy sampling for diffusion models and log-concave distributions, used by Fan Chen, Sinho Chewi, Jianfeng Lu and Matthew S. Zhang, Smoothed Picard Hamiltonian Monte Carlo.

arXiv:2602.01338v1 · D.1 Eq18 smooth s=1 and B.12 Eq17, consumed by SPHMC A.4(2); printed B.7/section1.3 order discrepancy disclosed · faithful paraphrase

Complete source statement (ASTIS restatement)

pi and qhat are probability measures and are mutually absolutely continuous. The real functions ((d pi/d qhat).toReal)^ell and ((d qhat/d pi).toReal)^ell are integrable under qhat and pi respectively. Each of their real integrals minus one is at most 2*exp(2*B-K). Each corresponding ENNReal RN ell-power lintegral is at most ofReal(1+2*exp(2*B-K)).

E is a finite-dimensional real inner-product Borel space with d=finrank(E)>0. f:E->R is differentiable everywhere and its actual gradient is globally beta-Lipschitz. eta,beta,B>0 and ell>=2. No convexity assumption is used for this selected smooth s=1 dependency.
For x0,x_plus in E, set h=x0-eta grad f(x_plus). Assume norm(h-x_plus)<=sqrt(d*eta) and 64*beta^2*(ell*d/B+ell^2)<=1/eta^2. In particular beta*eta<1 will be proved, not added as an input.
Let P=(z->sqrt(eta) z)_*stdGaussian(E), nu=(Lebesgue restricted to (0,1]) product P, and q=(z->h+sqrt(eta) z)_*stdGaussian(E). For theta=pi*r/2 define W(x,r,z)=< (pi/2)(cos(theta)(x-h)-sin(theta)z), grad f(x_plus)-grad f(h+sin(theta)(x-h)+cos(theta)z) >. Let mB(x)=integral min(B,max(-B,W(x,r,z))) dnu(r,z). The estimator, independent input and clipping inside the expectation are actual definitions.
Define qhat=q.tilted(mB). First set G=(z->x0+sqrt(eta) z)_*stdGaussian(E), then pi=G.tilted(-f). Define K=min(B^2/(40*beta^2*d*eta^2),B/(8*beta*eta)). An exponential tilt uses its actual exponential integral as normalizer. Each RN power below is integrated under its denominator measure.

Actual bidirectional RN moments

\[\int\!\left(\frac{d\pi}{d\widehat\pi}\right)^\ell d\widehat\pi\le 1+2e^{2B-K},\qquad \int\!\left(\frac{d\widehat\pi}{d\pi}\right)^\ell d\pi\le 1+2e^{2B-K},\qquad \widehat\pi=\widehat q.\]

Read the formalized proofs

Each statement and proof below has its own closed Lean disclosure. ASTIS parents, Mathlib calls and external mathematical sources are distinguished in each proof.

ASTIS mathematical exposition

Actual clipped and ideal RGO bidirectional RN moments

AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.ClippedRenyiComparison.clipped_renyi_comparison · theorem · Teaching coverage

Statement

\[\int\!\left(\frac{d\pi}{d\widehat\pi}\right)^\ell d\widehat\pi\le 1+2e^{2B-K},\qquad \int\!\left(\frac{d\widehat\pi}{d\pi}\right)^\ell d\pi\le 1+2e^{2B-K},\qquad \widehat\pi=\widehat q.\]

All objects and hypotheses

E is a finite-dimensional real inner-product Borel space with d=finrank(E)>0. f:E->R is differentiable everywhere and its actual gradient is globally beta-Lipschitz. eta,beta,B>0 and ell>=2. No convexity assumption is used for this selected smooth s=1 dependency.
For x0,x_plus in E, set h=x0-eta grad f(x_plus). Assume norm(h-x_plus)<=sqrt(d*eta) and 64*beta^2*(ell*d/B+ell^2)<=1/eta^2. In particular beta*eta<1 will be proved, not added as an input.
Let P=(z->sqrt(eta) z)_*stdGaussian(E), nu=(Lebesgue restricted to (0,1]) product P, and q=(z->h+sqrt(eta) z)_*stdGaussian(E). For theta=pi*r/2 define W(x,r,z)=< (pi/2)(cos(theta)(x-h)-sin(theta)z), grad f(x_plus)-grad f(h+sin(theta)(x-h)+cos(theta)z) >. Let mB(x)=integral min(B,max(-B,W(x,r,z))) dnu(r,z). The estimator, independent input and clipping inside the expectation are actual definitions.
Define qhat=q.tilted(mB). First set G=(z->x0+sqrt(eta) z)_*stdGaussian(E), then pi=G.tilted(-f). Define K=min(B^2/(40*beta^2*d*eta^2),B/(8*beta*eta)). An exponential tilt uses its actual exponential integral as normalizer. Each RN power below is integrated under its denominator measure.

Mathematical proof

1. Identify the actual ideal law from the existing source parameters

The positive source step condition bounds 64 beta^2 ell^2 eta^2 by one; ell>=2 therefore implies beta eta<1. Invoke IdealRGOIdentification with this derived fact. Set m to the actual untruncated auxiliary mean, D=m-mB, and mu=qhat. The actual clipped exponential weight is integrable and normalizes to a probability by ClippedGradientProgram. The tilt-composition identity and mB+D=m give the actual ideal law, not an assumed target equality.

\[\mu=\widehat\pi=q.\mathrm{tilted}(m_B),\quad D=m-m_B,\quad \mu.\mathrm{tilted}(D)=q.\mathrm{tilted}(m)=\pi.\]

Corresponding Lean step

step_implies_ideal; estimator; clipped_renyi_comparison; AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.IdealRGOIdentification.ideal_rgo_identification; AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.ClippedGradientProgram.clipped_gradient_program; MeasureTheory.tilted_tilted

2. Obtain genuine integrability for every exponential used later

The actual ClippedMeanExponential theorem supplies the mu-integrable exponential-minus-one error. Add the integrable constant one to obtain the full envelope. For every coefficient a with abs(a)<=2ell, pointwise domination gives integrability of exp(aD). The same envelope controls exp(c abs(D)) for 0<=c<=2ell. Since abs(D)<=abs(D)+1<=exp(abs(D)), it also proves D itself integrable. No later Jensen application or density calculation relies on a totalized integral of an unproved integrable function.

\[H=\mathbb E_\mu e^{2\ell|D|},\qquad H-1\le\varepsilon:=2e^{2B-K},\qquad e^{aD}\le e^{2\ell|D|}\quad(|a|\le2\ell).\]

Corresponding Lean step

exponential_domination; integrable_of_exponential_abs; integral_exp_le_abs; AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.ClippedMeanExponential.clipped_mean_exponential

3. Identify both actual derivatives on their correct measures

Let Z be the actual integral of exp(D) under the probability mu. Established L1 and strict pointwise positivity give Z>0. The tilted law is a probability and is mutually absolutely continuous with mu. Use the actual tilted RN formulas. The reverse formula is initially obtained mu-almost everywhere; transfer it to the tilted law using absolute continuity before integrating there.

\[Z=\mathbb E_\mu e^D>0,\qquad \frac{d\pi}{d\mu}=\frac{e^D}{Z}\ (\mu\text{-a.e.}),\qquad \frac{d\mu}{d\pi}=Ze^{-D}\ (\pi\text{-a.e.}).\]

Corresponding Lean step

tilt_density_pair; MeasureTheory.toReal_rnDeriv_tilted_left; MeasureTheory.toReal_rnDeriv_tilted_right; MeasureTheory.tilted_absolutelyContinuous; MeasureTheory.absolutelyContinuous_tilted; MeasureTheory.isProbabilityMeasure_tilted

4. Establish weighted L1 before the normalized power identities

Raise the positive density formulas to ell. The forward power under mu is an integrable scalar multiple of exp(ell D). For the reverse power under pi, use the tilted integrability equivalence: its exponential factor has weighted integrand exp(D) exp(-ell D)=exp(-(ell-1)D), already known integrable under mu. Only then compute the integral and combine the powers of the positive Z.

\[I_{\pi\|\mu}=Z^{-\ell}\mathbb E_\mu e^{\ell D},\qquad I_{\mu\|\pi}=Z^{\ell-1}\mathbb E_\mu e^{-(\ell-1)D}.\]

Corresponding Lean step

forward_density_power; reverse_density_power; MeasureTheory.integrable_tilted_iff; MeasureTheory.integral_exp_tilted; Real.div_rpow; Real.mul_rpow

5. Control the positive normalizer power

Put a=ell-1>=1. Convexity of the a-th power and the two supplied integrability conditions give Z^a<=E exp(aD). Bound both this expectation and E exp(-aD) by E exp(a abs(D)). A second Jensen application, now for the square, bounds the product by E exp(2a abs(D)), which is at most H. The a>=1 step is why this proof uses the actual ell>=2 consumer rather than claiming the entire printed ell>1 range.

\[I_{\mu\|\pi}\le\left(\mathbb E_\mu e^{(\ell-1)|D|}\right)^2\le\mathbb E_\mu e^{2(\ell-1)|D|}\le H.\]

Corresponding Lean step

power_mean_exponential; exponential_mean_square; normalized_moments; convexOn_rpow; ConvexOn.map_integral_le

6. Control the inverse normalizer by two exponential Jensen inequalities

Because D and exp(D) are integrable, exponential Jensen gives exp(E D)<=Z. The negative ell-th power reverses this inequality. Apply exponential Jensen again to -ell D, whose integrability and exponential integrability were already proved. This yields Z^(-ell)<=E exp(-ell D). Dominate both signed exponential moments by E exp(ell abs(D)); square Jensen gives the same H bound. This is a complete alternative to the Cauchy-Schwarz step, preserving the source constant.

\[Z^{-\ell}\le e^{-\ell\mathbb E_\mu D}\le\mathbb E_\mu e^{-\ell D},\qquad I_{\pi\|\mu}\le\left(\mathbb E_\mu e^{\ell|D|}\right)^2\le H.\]

Corresponding Lean step

exponential_mean; inverse_normalizer_power; normalized_moments; Real.rpow_le_rpow_of_nonpos; convexOn_exp

7. Transfer real powers to ENNReal and instantiate the actual consumer

Both real RN-power integrals are now finite and at most H. Subtract one and consume the parent bound H-1<=epsilon. To obtain the ENNReal lintegrals, use RN derivatives being finite almost everywhere under their denominator measures; then ofReal commutes with the nonnegative power. This excludes a false conversion through toReal(infinity). The actual ideal-law equality from the first step instantiates all generic statements with pi and qhat and returns the ten asserted conclusions.

\[\operatorname{ofReal}\!\left(\int (\operatorname{toReal}r)^\ell\,d\nu\right)=\int r^\ell\,d\nu,\qquad I_{\pi\|\widehat\pi}-1,\ I_{\widehat\pi\|\pi}-1\le2e^{2B-K}.\]

Corresponding Lean step

rn_power_lintegral; tilt_power_bounds; clipped_renyi_comparison; MeasureTheory.Measure.rnDeriv_ne_top; MeasureTheory.ofReal_integral_eq_lintegral_ofReal; ENNReal.ofReal_rpow_of_nonneg

Lean statement · clipped_renyi_comparison

Two actual probabilities,two absolute continuities,two real RN-power L1,two real-integral-minus-one bounds and two ENNReal bounds.

theorem clipped_renyi_comparison (f : E → ℝ) (hf : Differentiable ℝ f)
    (eta beta B ell : ℝ) (heta : 0 < eta) (hbeta : 0 < beta) (hB : 0 < B)
    (hell : 2 ≤ ell) (hd : 0 < (Module.finrank ℝ E : ℝ))
    (hlip : LipschitzWith ⟨beta,hbeta.le⟩ (gradient f)) (x0 xp : E)
    (hcenter : ‖(x0-eta • gradient f xp)-xp‖ ≤ Real.sqrt ((Module.finrank ℝ E : ℝ)*eta))
    (hstep : 64*beta^2*(ell*(Module.finrank ℝ E : ℝ)/B+ell^2) ≤ 1/eta^2) :
    let h := x0-eta • gradient f xp
    let q := (stdGaussian E).map (fun z => h+Real.sqrt eta • z)
    let P := (stdGaussian E).map (fun z => Real.sqrt eta • z)
    let nu := (volume.restrict (Set.Ioc (0 : ℝ) 1)).prod P
    let mB := fun x => ∫ a, min B (max (-B) (estimator f h xp (x,a))) ∂nu
    let qhat := q.tilted mB
    let pi := ((stdGaussian E).map (fun z => x0+Real.sqrt eta • z)).tilted (fun x => -f x)
    let K := min (B^2/(40*beta^2*(Module.finrank ℝ E : ℝ)*eta^2)) (B/(8*beta*eta))
    IsProbabilityMeasure pi ∧ IsProbabilityMeasure qhat ∧ pi ≪ qhat ∧ qhat ≪ pi ∧
    Integrable (fun x => (pi.rnDeriv qhat x).toReal ^ ell) qhat ∧
    Integrable (fun x => (qhat.rnDeriv pi x).toReal ^ ell) pi ∧
    (∫ x, (pi.rnDeriv qhat x).toReal ^ ell ∂qhat) - 1 ≤ 2 * Real.exp (2*B-K) ∧
    (∫ x, (qhat.rnDeriv pi x).toReal ^ ell ∂pi) - 1 ≤ 2 * Real.exp (2*B-K) ∧
    (∫⁻ x, (pi.rnDeriv qhat x) ^ ell ∂qhat) ≤ ENNReal.ofReal (1+2*Real.exp (2*B-K)) ∧
    (∫⁻ x, (qhat.rnDeriv pi x) ^ ell ∂pi) ≤ ENNReal.ofReal (1+2*Real.exp (2*B-K))

Exact module and namespace context

Lean proof · clipped_renyi_comparison

Actual ideal identification,derived normalization,exponential domination,Jensen,weighted RN algebra,a.e. measure transfer and finite RN conversion.

theorem clipped_renyi_comparison (f : E → ℝ) (hf : Differentiable ℝ f)
    (eta beta B ell : ℝ) (heta : 0 < eta) (hbeta : 0 < beta) (hB : 0 < B)
    (hell : 2 ≤ ell) (hd : 0 < (Module.finrank ℝ E : ℝ))
    (hlip : LipschitzWith ⟨beta,hbeta.le⟩ (gradient f)) (x0 xp : E)
    (hcenter : ‖(x0-eta • gradient f xp)-xp‖ ≤ Real.sqrt ((Module.finrank ℝ E : ℝ)*eta))
    (hstep : 64*beta^2*(ell*(Module.finrank ℝ E : ℝ)/B+ell^2) ≤ 1/eta^2) :
    let h := x0-eta • gradient f xp
    let q := (stdGaussian E).map (fun z => h+Real.sqrt eta • z)
    let P := (stdGaussian E).map (fun z => Real.sqrt eta • z)
    let nu := (volume.restrict (Set.Ioc (0 : ℝ) 1)).prod P
    let mB := fun x => ∫ a, min B (max (-B) (estimator f h xp (x,a))) ∂nu
    let qhat := q.tilted mB
    let pi := ((stdGaussian E).map (fun z => x0+Real.sqrt eta • z)).tilted (fun x => -f x)
    let K := min (B^2/(40*beta^2*(Module.finrank ℝ E : ℝ)*eta^2)) (B/(8*beta*eta))
    IsProbabilityMeasure pi ∧ IsProbabilityMeasure qhat ∧ pi ≪ qhat ∧ qhat ≪ pi ∧
    Integrable (fun x => (pi.rnDeriv qhat x).toReal ^ ell) qhat ∧
    Integrable (fun x => (qhat.rnDeriv pi x).toReal ^ ell) pi ∧
    (∫ x, (pi.rnDeriv qhat x).toReal ^ ell ∂qhat) - 1 ≤ 2 * Real.exp (2*B-K) ∧
    (∫ x, (qhat.rnDeriv pi x).toReal ^ ell ∂pi) - 1 ≤ 2 * Real.exp (2*B-K) ∧
    (∫⁻ x, (pi.rnDeriv qhat x) ^ ell ∂qhat) ≤ ENNReal.ofReal (1+2*Real.exp (2*B-K)) ∧
    (∫⁻ x, (qhat.rnDeriv pi x) ^ ell ∂pi) ≤ ENNReal.ofReal (1+2*Real.exp (2*B-K)) := by
  let h := x0-eta • gradient f xp
  let q := (stdGaussian E).map (fun z => h+Real.sqrt eta • z)
  let P := (stdGaussian E).map (fun z => Real.sqrt eta • z)
  let nu := (volume.restrict (Set.Ioc (0 : ℝ) 1)).prod P
  let m := fun x => ∫ a, estimator f h xp (x,a) ∂nu
  let mB := fun x => ∫ a, min B (max (-B) (estimator f h xp (x,a))) ∂nu
  let qhat := q.tilted mB
  let pi := ((stdGaussian E).map (fun z => x0+Real.sqrt eta • z)).tilted (fun x => -f x)
  let D := fun x => m x-mB x
  let K := min (B^2/(40*beta^2*(Module.finrank ℝ E : ℝ)*eta^2)) (B/(8*beta*eta))
  have hc := AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.ClippedMeanExponential.clipped_mean_exponential
    f hf eta beta B ell heta hbeta hB hell hd hlip x0 xp hcenter hstep
  have hp := AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.ClippedGradientProgram.clipped_gradient_program
    f hf eta beta B heta hbeta.le hB hlip x0 xp
  have hi := AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.IdealRGOIdentification.ideal_rgo_identification
    f hf ⟨beta,hbeta.le⟩ hlip eta heta
    (step_implies_ideal eta beta B ell (Module.finrank ℝ E : ℝ) heta hbeta hB hell hd hstep) x0 xp
  have hmq : IsProbabilityMeasure q := hp.2.1
  have hmb : Integrable (fun x => Real.exp (mB x)) q := hp.2.2.2.2.2.2.1
  have hmqhat : IsProbabilityMeasure qhat := isProbabilityMeasure_tilted hmb
  have hD : Measurable D := hc.1.sub hc.2.1
  have hJ : Integrable (fun x => Real.exp (2*ell*|D x|)-1) qhat := hc.2.2.2.2.2.2.2.2.1
  have hb : (∫ x, Real.exp (2*ell*|D x|)-1 ∂qhat) ≤ 2*Real.exp (2*B-K) :=
    hc.2.2.2.2.2.2.2.2.2
  have heq : qhat.tilted D = pi := by
    change (q.tilted mB).tilted D = pi
    rw [tilted_tilted hmb]
    have hsum : mB+D=m := by funext x; dsimp [D]; ring
    rw [hsum]
    exact hi.2.2.2.2.2.2.1
  have ht := tilt_power_bounds qhat D hD ell hell hJ
  rw [heq] at ht
  rcases ht with ⟨hpi,hpq,hqp,hfi,hri,hfb,hrb,hfen,hren⟩
  refine ⟨hpi,hmqhat,hpq,hqp,hfi,hri,hfb.trans hb,hrb.trans hb,?_,?_⟩
  · exact hfen.trans (ENNReal.ofReal_le_ofReal (by linarith))
  · exact hren.trans (ENNReal.ofReal_le_ofReal (by linarith))

end AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.ClippedRenyiComparison

Exact module and namespace context

Source assumptions versus formal assumptions

Source	Actual Lean	Difference kind	Why it matters
The source uses positive-dimensional Euclidean space.	Finite-dimensional real inner-product Borel space with positive finrank.	generalization	Coordinate-free Gaussian and gradient interfaces preserve the dimension restriction.
D.1 uses Assumption3.2 with Holder gradient; the selected smooth case has s=1.	Actual beta-Lipschitz gradient, differentiability,positive beta,eta,B,d,ell>=2 and the displayed residual/64-step restriction.	same	This selects the smooth s=1 consumer, not the entire Holder theorem. D.1 itself does not assume convexity; downstream SPHMC convexity is not a missing hypothesis here.
B.12/D.1 proof uses denominator-measure ell-powers, whereas B.7 and section1.3 contain inconsistent measure subscripts or powers.	Both actual denominator-measure ell-power integrals are written explicitly.	source-implicit	The contract follows B.12 proof and D.1 actual use. Internal evidence suggests local printed definition errors; this is not an author-confirmed erratum or a claim of literal B.7 implementation.
B.12 is printed for ell>1, while D.1 uses ell>=2.	The selected actual consumer retains ell>=2.	same	The printed intermediate positive-power Jensen step can fail for1<ell<2. This is a proof-step gap, not a counterexample to its final theorem. The present packet neither claims that full range nor repairs it.
Auxiliary uniform time is sampled on [0,1].	Restricted Lebesgue volume on (0,1] is independently multiplied with the actual Gaussian.	source-implicit	Endpoint differences are null; the actual estimator and independent input are retained.
Normalized comparison uses the actual ideal and implemented clipped laws.	beta*eta<1,positive normalizers,both probabilities,mutual absolute continuity,weighted L1 and both RN a.e. formulas are proved before use.	source-implicit	No extra ideal normalization or target equality is assumed. RN a.e. finiteness justifies the real/ENNReal conversion.
D.1 Eq18 feeds the terminal approximate RGO in SPHMC A.4(2).	Two real moment-minus-one bounds and two ENNReal moment bounds with factor2,constants40/8 and actual distributions.	same	This completes the selected normalized moment comparison, not logarithmic Renyi API,parameter selection,initialization,adaptivekernel,cost or fullpaper.

The ten public conclusions are two probability statements, two absolute-continuity statements, two real RN-power L1 statements, two real-integral-minus-one bounds and two ENNReal bounds. Positive normalizers, error L1 and explicit RN formulas are proved internally, not additional returned conjuncts. ClippedGradientProgram already identifies qhat with the actual program output; its map equality is not repeated. This follows the explicit denominator-measure ell-powers in B.12/D.1. B.7 and section1.3 have inconsistent printed definitions; this is disclosed rather than silently called a literal implementation of those lines. The intermediate B.12 proof gap for 1<ell<2 is outside this ell>=2 consumer and is not repaired here. No logarithmic Renyi API, accuracy parameter selection, initialization, parameterized kernel, query-cost result or complete companion paper is asserted.

Encoder–denoiser: accepted · domain-mismatch

Detected semantic differences

domains: Positive-dimensional coordinate-free extension disclosed. — Independent formal reviewer accepted: Positive-dimensional coordinate-free extension disclosed.
assumptions: Selected smooth s=1 regime; D1 requires no convexity. — Independent formal reviewer accepted: Selected smooth s=1 regime; D1 requires no convexity.
objects: Denominator-measure powers follow B12 identities; inconsistent B7 definition disclosed, not author-confirmed erratum. — Independent formal reviewer accepted: Denominator-measure powers follow B12 identities; inconsistent B7 definition disclosed, not author-confirmed erratum.
assumptions: ell>=2 selected consumer; B12 intermediate gap below2 disclosed, not final-theorem counterexample or repair. — Independent formal reviewer accepted: ell>=2 selected consumer; B12 intermediate gap below2 disclosed, not final-theorem counterexample or repair.
objects: Ioc/Icc uniform endpoints differ by null set; actual independent product. — Independent formal reviewer accepted: Ioc/Icc uniform endpoints differ by null set; actual independent product.
assumptions: Normalization, AC and weighted L1 proved internally before use, not extra public conjuncts. — Independent formal reviewer accepted: Normalization, AC and weighted L1 proved internally before use, not extra public conjuncts.
scopes: Explicit moment comparison dependency, not complete parameterized terminal routine. — Independent formal reviewer accepted: Explicit moment comparison dependency, not complete parameterized terminal routine.

A generalization is not a source correction. Proposed missing conditions require separate independent repair review. No proposed repair silently changes the original theorem.

Scope and omitted-condition boundaries

The ten public conclusions are two probability statements, two absolute-continuity statements, two real RN-power L1 statements, two real-integral-minus-one bounds and two ENNReal bounds. Positive normalizers, error L1 and explicit RN formulas are proved internally, not additional returned conjuncts. ClippedGradientProgram already identifies qhat with the actual program output; its map equality is not repeated. This follows the explicit denominator-measure ell-powers in B.12/D.1. B.7 and section1.3 have inconsistent printed definitions; this is disclosed rather than silently called a literal implementation of those lines. The intermediate B.12 proof gap for 1<ell<2 is outside this ell>=2 consumer and is not repaired here. No logarithmic Renyi API, accuracy parameter selection, initialization, parameterized kernel, query-cost result or complete companion paper is asserted.

Source and reuse

ASTIS parents called

Mathlib API called (external library)

MeasureTheory.tilted_tilted
MeasureTheory.integrable_tilted_iff
MeasureTheory.toReal_rnDeriv_tilted_right
ConvexOn.map_integral_le
MeasureTheory.Measure.rnDeriv_ne_top

Mathematical sources

D.1 Eq18 and B.12 Eq17 — Smooth actual normalized RN-power comparison; printed definition and proof-range differences disclosed.
SPHMC Appendix A.4(2) — Terminal sampler consumer; remaining algorithmic obligations separate.

ASTIS prose is not a quotation or a source-equivalence certificate. Definitions and aliases are explained as constructions, not counted as new mathematical proofs.

Which proof edges are actually covered?

Local proof component; source adapter/review separate Actual clipped and ideal normalized bidirectional RN moments

Actual finite-output KL with terminal residual discharged

ASTIS expanded actual finite-output component for Fan Chen,Sinho Chewi,Jianfeng Lu and Matthew S. Zhang, Smoothed Picard Hamiltonian Monte Carlo. Not a verbatim printed theorem or the numerical stage budget.

arXiv:2609.06906v1 · Section6.3,A1 conditional KL recursion and terminal stage;q=2 · faithful paraphrase

Complete source statement (ASTIS restatement)

muV is a probability measure. There exist Markov kernels Lt:S->E,P:S->S,TG:S->E and H:S->E such that P_s=dirac_s when B^(-1)<=b_s and otherwise P_s is the law of U(s,(X,Z)) under M_s times standardGaussian; the actual terminal stream output law (rho_s).map O_s equals Lt_s; TG_s=muV.tilted(x->-(b_s/2)*norm(x-u_s)^2); and H_s=G(TG_s,sqrt(v_s)). Define Q_s=G(M_s,sqrt(tau_s/(1+b_s))) and e(s)=0 when B^(-1)<=b_s,otherwise KL(Q_s||H_s). Then e is measurable,and for every natural m,KL((Lt composed P^(J+m))(s0)||TG_s0)<=sum(j<J,the nonnegative integral of e under(P^j)(s0))+Delta^2/(J+1). The final real term is embedded in the extended nonnegative reals.

E is a positive-dimensional finite-dimensional real inner-product Borel space; d=dim_R E. The nonnegative real kappa satisfies kappa>=1. V:E->R is C2 and kappa^(-1)*norm(w)^2<=D2V(x)[w,w]<=norm(w)^2 for every x,w. This is the normalized beta=1 setting.
The full state S=NNReal x E x E x Nat x (Nat->E) is written s=(b,u,xref,k,history). eta:S->R is measurable,0<eta_s<=c,0<c<1/4,0<Delta<=1/2. The initial state s0 is arbitrary and M:S->E is any actual Markov kernel. No initial-history origin,reference admissibility,stage approximation or moment guarantee is assumed.
Write K(r)=(1+r)/(kappa^(-1)+r),tau_s=K(b_s) if K(b_s)>=2 and c otherwise,L=2+log(K(b_s0)*d*2/Delta),B=(1/1024)/(sqrt(d*L)+L),J=ceil(8*log(exp(1)*K(b_s0)/B)),eps=Delta/sqrt(J+1). Real inverses and square roots use their total Lean definitions; the proof establishes the required positive denominators.
For p=(s,(x,z)),set v_s=(eta_s+tau_s)/(1+b_s),bp_s=b_s+toNNReal(v_s^(-1)),obs(p)=x+sqrt(tau_s/(1+b_s))*z,center(p)=bp_s^(-1)*(b_s*u_s+v_s^(-1)*obs(p)),F_p(w)=V(w)+bp_s/2*norm(w-center(p))^2 and D_p(w)=w-(1+bp_s)^(-1)*grad F_p(w). N_p is the least n with norm(grad F_p(D_p^n(x)))^2<=(kappa^(-1)+bp_s)*d,or0 if no such n exists. U(p)=(bp_s,center(p),D_p^N_p(x),k+1,prepend(obs(p),history)). The actual reference starts at the pre-noise x.
For the terminal program,bb_s=max(b_s,B^(-1)),A_s=bb_s^(-1),TF_s(w)=V(w)+bb_s/2*norm(w-u_s)^2 and TD_s(w)=w-(1+bb_s)^(-1)*grad TF_s(w). TN_s is the least n with norm(grad TF_s(TD_s^n(xref_s)))^2<=d*bb_s,or0 if none exists. Put xp_s=TD_s^TN_s(xref_s),g_s=grad V(xp_s),h_s=u_s-A_s*g_s.
For an auxiliary draw a=(t,z) and terminal candidate x,let theta=pi*t/2 and Z=sqrt(A_s)*z. Define W_s(x,a)=clip[-1,1](inner((pi/2)*(cos(theta)*(x-h_s)-sin(theta)*Z),g_s-grad V(h_s+sin(theta)*(x-h_s)+cos(theta)*Z))). The auxiliary law nu is volume restricted to(0,1] times standardGaussian; the proposal q_s is the law of h_s+sqrt(A_s)*Z0 for standardGaussian Z0.
One terminal attempt independently draws X~q_s,N~Poisson(2),an infinite iid nu sequence a_i,and U~Uniform[0,1]. It accepts when U<=product(i<N,(1+W_s(X,a_i))/2),with empty product1. rho_s is the law of an infinite iid sequence of such attempts. O_s returns X from the first accepted attempt,or the zero vector if no attempt accepts. This is the actual terminal stream program,with its full independent-product law.
Let muV=volume.tilted(-V),using canonical volume. Gaussian smoothing G(mu,sigma) is the law of X+sigma*Z under mu times standardGaussian. Tilt is the total normalized exponential reweighting operation; probability is proved,not implicit. Kernel composition Lt composed P first draws a state from P then an output from Lt. KL and nonnegative integrals take extended nonnegative values,possibly infinity.

Actual finite output with explicit observation error

\[\operatorname{KL}((L_t\circ P^{J+m})(s_0)\Vert T_{s_0})\le\sum_{j=0}^{J-1}\int e(s)\,P^j(s_0,ds)+\frac{\Delta^2}{J+1},\qquad m\in\mathbb N.\]

Read the formalized proofs

Each statement and proof below has its own closed Lean disclosure. ASTIS parents, Mathlib calls and external mathematical sources are distinguished in each proof.

ASTIS mathematical exposition

Actual finite-output KL with terminal residual discharged

AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.EnhancedFiniteOutputKL.finite_output_kl · theorem · Teaching coverage

Statement

\[\operatorname{KL}((L_t\circ P^{J+m})(s_0)\Vert T_{s_0})\le\sum_{j=0}^{J-1}\int e(s)\,P^j(s_0,ds)+\frac{\Delta^2}{J+1},\qquad m\in\mathbb N.\]

All objects and hypotheses

E is a positive-dimensional finite-dimensional real inner-product Borel space; d=dim_R E. The nonnegative real kappa satisfies kappa>=1. V:E->R is C2 and kappa^(-1)*norm(w)^2<=D2V(x)[w,w]<=norm(w)^2 for every x,w. This is the normalized beta=1 setting.
The full state S=NNReal x E x E x Nat x (Nat->E) is written s=(b,u,xref,k,history). eta:S->R is measurable,0<eta_s<=c,0<c<1/4,0<Delta<=1/2. The initial state s0 is arbitrary and M:S->E is any actual Markov kernel. No initial-history origin,reference admissibility,stage approximation or moment guarantee is assumed.
Write K(r)=(1+r)/(kappa^(-1)+r),tau_s=K(b_s) if K(b_s)>=2 and c otherwise,L=2+log(K(b_s0)*d*2/Delta),B=(1/1024)/(sqrt(d*L)+L),J=ceil(8*log(exp(1)*K(b_s0)/B)),eps=Delta/sqrt(J+1). Real inverses and square roots use their total Lean definitions; the proof establishes the required positive denominators.
For p=(s,(x,z)),set v_s=(eta_s+tau_s)/(1+b_s),bp_s=b_s+toNNReal(v_s^(-1)),obs(p)=x+sqrt(tau_s/(1+b_s))*z,center(p)=bp_s^(-1)*(b_s*u_s+v_s^(-1)*obs(p)),F_p(w)=V(w)+bp_s/2*norm(w-center(p))^2 and D_p(w)=w-(1+bp_s)^(-1)*grad F_p(w). N_p is the least n with norm(grad F_p(D_p^n(x)))^2<=(kappa^(-1)+bp_s)*d,or0 if no such n exists. U(p)=(bp_s,center(p),D_p^N_p(x),k+1,prepend(obs(p),history)). The actual reference starts at the pre-noise x.
For the terminal program,bb_s=max(b_s,B^(-1)),A_s=bb_s^(-1),TF_s(w)=V(w)+bb_s/2*norm(w-u_s)^2 and TD_s(w)=w-(1+bb_s)^(-1)*grad TF_s(w). TN_s is the least n with norm(grad TF_s(TD_s^n(xref_s)))^2<=d*bb_s,or0 if none exists. Put xp_s=TD_s^TN_s(xref_s),g_s=grad V(xp_s),h_s=u_s-A_s*g_s.
For an auxiliary draw a=(t,z) and terminal candidate x,let theta=pi*t/2 and Z=sqrt(A_s)*z. Define W_s(x,a)=clip[-1,1](inner((pi/2)*(cos(theta)*(x-h_s)-sin(theta)*Z),g_s-grad V(h_s+sin(theta)*(x-h_s)+cos(theta)*Z))). The auxiliary law nu is volume restricted to(0,1] times standardGaussian; the proposal q_s is the law of h_s+sqrt(A_s)*Z0 for standardGaussian Z0.
One terminal attempt independently draws X~q_s,N~Poisson(2),an infinite iid nu sequence a_i,and U~Uniform[0,1]. It accepts when U<=product(i<N,(1+W_s(X,a_i))/2),with empty product1. rho_s is the law of an infinite iid sequence of such attempts. O_s returns X from the first accepted attempt,or the zero vector if no attempt accepts. This is the actual terminal stream program,with its full independent-product law.
Let muV=volume.tilted(-V),using canonical volume. Gaussian smoothing G(mu,sigma) is the law of X+sigma*Z under mu times standardGaussian. Tilt is the total normalized exponential reweighting operation; probability is proved,not implicit. Kernel composition Lt composed P first draws a state from P then an output from Lt. KL and nonnegative integrals take extended nonnegative values,possibly infinity.

Mathematical proof

1. Use the actual full-state program

Instantiate EnhancedTerminalExecution at q=2. It supplies actual Lt and P,the complete retained-reference transition,the terminal retry law,terminal support at J,and exact output stability at J+m. The firstIndex,scaledCached,Attempt,attemptLaw,accepted and output definitions preserve the concrete parent program,including both fallback branches.

\[(\rho_s).\operatorname{map}(O_s)=L_t(s).\]

Corresponding Lean step

firstIndex,scaledCached,Attempt,attemptLaw,accepted,output; finite_output_kl: ht,Lt,P,hPs,hmass,hstable,hacc

2. Construct the same Gibbs targets and identify transitions

Set alpha=kappa inverse and beta=1;the source Hessian and dimension assumptions provide the exact parent inputs. Tau is measurable and positive. EnhancedKLOneStep produces actual Gibbs probability,TG,H,Pprime and the one-step interface. Convert threshold toNNReal(B inverse) to the real comparison. On both branches,compare the entire update law to prove Pprime=P;no witness or projection equality is assumed.

\[P^{\prime}=P,\qquad T_s=\mu_V.\mathrm{tilted}(-b_s\|\cdot-u_s\|^2/2).\]

Corresponding Lean step

finite_output_kl: hk0,ha0,ha1,hHm,hτm,hτ0,hs,hstop,hPeq,heq,he,hstep

3. Prove sufficient terminal precision

K(b0)>=1,d>=1 and Delta<=1/2 give K(b0)*d*2/Delta>=1. Hence L>=2 and B lies strictly between0 and1. Every state in the actual terminal support has b>=B inverse>1,which supplies the strict beta/b<1 needed by the existing Gaussian-density identification.

\[L\ge2,\quad 0<B<1,\quad b\ge B^{-1}>1.\]

Corresponding Lean step

terminal_precision_large; finite_output_kl: hd1,hBlarge,hb1,hb0,hbstep

4. Identify the actual terminal target

Actual Gibbs probability rules out a zero tilted measure. Since nonintegrable exp(-V) would make the tilt zero,it proves exponential integrability before tilted_tilted is used. Combine the two quadratic exponents and use the actual normalized-density equalities of IdealRGOIdentification. On terminal support bb=b,so the nested target TG is exactly tpi. Gradient Lipschitzness follows from the genuine Hessian through zero quadratic regularization.

\[T_s=\mathcal N(u_s,b_s^{-1}I).\mathrm{tilted}(-V)=\pi_s\quad(b_s\ge B^{-1}).\]

Corresponding Lean step

actual_terminal_target: hI,hi,heq,hvol,hf; finite_output_kl: hlip,heqt,hbs

5. Turn the correct RN second moment into KL

For probability mu absolutely continuous with respect to nu,set r=dmu/dnu. The RN API gives integrability of r and integral r=1. Given square integrability,expand(r-1)^2 and obtain integral(r-1)^2=integral r^2-1. For r>=0,log r<=r-1 gives klFun(r)<=(r-1)^2;the r=0 case is explicit. The nonnegative KL formula and a justified real-to-nonnegative integral conversion give KL(mu||nu)<=eps^2. Apply this to mu=Lt_s and nu=tpi_s,using the parent dLt/dtpi moment,not the reverse moment.

\[\operatorname{KL}(\mu\Vert\nu)\le\int(r-1)^2\,d\nu=\int r^2\,d\nu-1\le\varepsilon^2.\]

Corresponding Lean step

klFun_le_square; kl_le_second_moment: hr,hmass,h2,hlin,hpoly,hsq,hint; finite_output_kl: hterminal,hac,hI,hbound

6. Accumulate along actual kernel powers

Induct the all-ENNReal recurrence with nonnegative kernel integration. At zero steps,the Dirac integral is the terminal residual. The induction shifts each prior observation integral from P^j to P^(j+1) using composition. Instantiate the remaining-output kernel with Lt composed P^n;its Markov property and exact composition associativity yield the finite enhanced-state bound. No finite observation error is required.

\[\operatorname{KL}((L_t\circ P^n)_s\Vert T_s)\le\sum_{j<n}\int e\,dP^j_s+\int\operatorname{KL}(L_t(t)\Vert T_t)\,P^n_s(dt).\]

Corresponding Lean step

kernel_error_sum: hp,hi,hei,hti; composed_error_sum; finite_output_kl: hf

7. Discharge the residual on actual terminal support

The parent proves(P^J)(s0)(D)=1 for D={b>=B inverse}. Measurability of the precision coordinate and the probability measure complement identity give almost-everywhere membership. Only there apply the terminal target equality and KL bound. Nonnegative integral monotonicity and mass one then bound the residual by eps squared.

\[P^J(s_0,D)=1\Longrightarrow\int\operatorname{KL}(L_t(s)\Vert T_s)\,P^J(s_0,ds)\le\varepsilon_J^2.\]

Corresponding Lean step

finite_output_kl: hPJ,hD,hbMeas,hm,hresidual

8. Keep the exact precision and cap output

The positive denominator gives eps squared=Delta squared/(J+1) by the square-root identity. Use the parent actual cap output law to reduce Lt composed P^(J+m) to Lt composed P^J. Add the bounded terminal residual to the unchanged first-J observation sum. This is an actual finite-output inequality;the separate stage budget is still needed before deducing a numerical final error.

\[\varepsilon_J^2=\frac{\Delta^2}{J+1},\qquad (L_t\circ P^{J+m})(s_0)=(L_t\circ P^J)(s_0).\]

Corresponding Lean step

finite_output_kl: hepssq,hstable,hf

Lean statement · finite_output_kl

Actual terminal stream,full retained-state transition,Gibbs targets and finite output KL at J+m.

theorem finite_output_kl {V : E → ℝ} (κ : ℝ≥0) (hκ : 1 ≤ κ)
    (hV : ContDiff ℝ 2 V)
    (hH : ∀ x w : E, (κ:ℝ)⁻¹*‖w‖^2 ≤ fderiv ℝ (fderiv ℝ V) x w w ∧
      fderiv ℝ (fderiv ℝ V) x w w ≤ ‖w‖^2)
    (hd : 0 < Module.finrank ℝ E)
    (η : S → ℝ) (hηm : Measurable η) (c Δ : ℝ)
    (hc : 0 < c) (hc1 : c < 1/4) (hη : ∀ s, 0 < η s ∧ η s ≤ c)
    (hΔ : 0 < Δ) (hΔ1 : Δ ≤ 1/2)
    (s0 : S) (M : Kernel S E) [IsMarkovKernel M] :
    let d : ℝ := Module.finrank ℝ E
    let K := fun r : ℝ => (1+r)/((κ:ℝ)⁻¹+r)
    let τ := fun s : S => if 2 ≤ K s.1 then K s.1 else c
    let L := (2:ℝ)+Real.log (K s0.1*d*(2:ℝ)/Δ)
    let B := (1/1024)/(Real.sqrt (d*L)+L)
    let J := Nat.ceil (8*Real.log (Real.exp 1*K s0.1/B))
    let _eps := Δ/Real.sqrt ((J:ℝ)+1)
    let v := fun s : S => (η s+τ s)/(1+s.1)
    let bp := fun s : S => s.1+Real.toNNReal (v s)⁻¹
    let obs := fun p : S × (E × E) => p.2.1+Real.sqrt (τ p.1/(1+p.1.1)) • p.2.2
    let center := fun p : S × (E × E) => (bp p.1:ℝ)⁻¹ •
      ((p.1.1:ℝ) • p.1.2.1+(v p.1)⁻¹ • obs p)
    let F := fun p x => V x+(bp p.1:ℝ)/2*‖x-center p‖^2
    let T := fun p x => x-(1+(bp p.1:ℝ))⁻¹ • gradient (F p) x
    let Qn := fun n p => ‖gradient (F p) ((T p)^[n] p.2.1)‖^2
    let N := firstIndex Qn (fun p => ((κ:ℝ)⁻¹+bp p.1)*d)
    let update := fun p : S × (E × E) =>
      (bp p.1,center p,(T p)^[N p] p.2.1,p.1.2.2.2.1+1,
        fun n => Nat.casesOn n (obs p) p.1.2.2.2.2)
    let bb := fun s : S => max (s.1:ℝ) B⁻¹
    let TF := fun s x => V x+bb s/2*‖x-s.2.1‖^2
    let TT := fun s x => x-(1+bb s)⁻¹ • gradient (TF s) x
    let TQn := fun n s => ‖gradient (TF s) ((TT s)^[n] (s.2.2.1))‖^2
    let TN := firstIndex TQn (fun s => d*bb s)
    let txp := fun s => (TT s)^[TN s] (s.2.2.1)
    let TA := fun s => (bb s)⁻¹
    let tg := fun s => gradient V (txp s)
    let th := fun s => s.2.1-TA s • tg s
    let tnu := (volume.restrict (Ioc (0 : ℝ) 1)).prod (stdGaussian E)
    let tW := fun s (p : E × (ℝ × E)) => min 1 (max (-1) (scaledCached V TA th tg ((s,p.1),p.2)))
    let tproposal := fun s => (stdGaussian E).map (fun z => th s+Real.sqrt (TA s) • z)
    let trho := fun s => Measure.infinitePi (fun _ : ℕ => attemptLaw (tproposal s) tnu 1 (by norm_num))
    let _tpi := fun s => ((stdGaussian E).map (fun z => s.2.1+Real.sqrt (TA s) • z)).tilted (fun x => -V x)
    let μV := (volume : Measure E).tilted (fun x => -V x)
    IsProbabilityMeasure μV ∧
    ∃ (Lt : Kernel S E) (P : Kernel S S) (TG H : Kernel S E),
      IsMarkovKernel Lt ∧ IsMarkovKernel P ∧ IsMarkovKernel TG ∧ IsMarkovKernel H ∧
      (∀ s, P s=if B⁻¹ ≤ (s.1:ℝ) then Measure.dirac s else
        ((M s).prod (stdGaussian E)).map (fun z => update (s,z))) ∧
      (∀ s, (trho s).map (output (tW s) 1 0)=Lt s) ∧
      (∀ s, TG s=μV.tilted (fun x => -((s.1:ℝ)/2)*‖x-s.2.1‖^2)) ∧
      (∀ s, H s=AutoSamplingTheory.TechnicalLemmas.Measure.GaussianSmoothing.gaussianSmoothing
        (TG s) (Real.sqrt (v s))) ∧
      let Q := fun s => AutoSamplingTheory.TechnicalLemmas.Measure.GaussianSmoothing.gaussianSmoothing
        (M s) (Real.sqrt (τ s/(1+s.1)))
      let e := fun s => if B⁻¹ ≤ (s.1:ℝ) then 0 else klDiv (Q s) (H s)
      Measurable e ∧ ∀ m : ℕ,
        klDiv ((Lt ∘ₖ (P^(J+m))) s0) (TG s0) ≤
          (∑ j ∈ Finset.range J, ∫⁻ s, e s ∂(P^j) s0)+
          ENNReal.ofReal (Δ^2/((J:ℝ)+1))

Exact module and namespace context

Lean proof · finite_output_kl

Same actual P,derived target identity and RN-moment terminal KL,finite actual-chain accumulation and support/cap reduction.

theorem finite_output_kl {V : E → ℝ} (κ : ℝ≥0) (hκ : 1 ≤ κ)
    (hV : ContDiff ℝ 2 V)
    (hH : ∀ x w : E, (κ:ℝ)⁻¹*‖w‖^2 ≤ fderiv ℝ (fderiv ℝ V) x w w ∧
      fderiv ℝ (fderiv ℝ V) x w w ≤ ‖w‖^2)
    (hd : 0 < Module.finrank ℝ E)
    (η : S → ℝ) (hηm : Measurable η) (c Δ : ℝ)
    (hc : 0 < c) (hc1 : c < 1/4) (hη : ∀ s, 0 < η s ∧ η s ≤ c)
    (hΔ : 0 < Δ) (hΔ1 : Δ ≤ 1/2)
    (s0 : S) (M : Kernel S E) [IsMarkovKernel M] :
    let d : ℝ := Module.finrank ℝ E
    let K := fun r : ℝ => (1+r)/((κ:ℝ)⁻¹+r)
    let τ := fun s : S => if 2 ≤ K s.1 then K s.1 else c
    let L := (2:ℝ)+Real.log (K s0.1*d*(2:ℝ)/Δ)
    let B := (1/1024)/(Real.sqrt (d*L)+L)
    let J := Nat.ceil (8*Real.log (Real.exp 1*K s0.1/B))
    let _eps := Δ/Real.sqrt ((J:ℝ)+1)
    let v := fun s : S => (η s+τ s)/(1+s.1)
    let bp := fun s : S => s.1+Real.toNNReal (v s)⁻¹
    let obs := fun p : S × (E × E) => p.2.1+Real.sqrt (τ p.1/(1+p.1.1)) • p.2.2
    let center := fun p : S × (E × E) => (bp p.1:ℝ)⁻¹ •
      ((p.1.1:ℝ) • p.1.2.1+(v p.1)⁻¹ • obs p)
    let F := fun p x => V x+(bp p.1:ℝ)/2*‖x-center p‖^2
    let T := fun p x => x-(1+(bp p.1:ℝ))⁻¹ • gradient (F p) x
    let Qn := fun n p => ‖gradient (F p) ((T p)^[n] p.2.1)‖^2
    let N := firstIndex Qn (fun p => ((κ:ℝ)⁻¹+bp p.1)*d)
    let update := fun p : S × (E × E) =>
      (bp p.1,center p,(T p)^[N p] p.2.1,p.1.2.2.2.1+1,
        fun n => Nat.casesOn n (obs p) p.1.2.2.2.2)
    let bb := fun s : S => max (s.1:ℝ) B⁻¹
    let TF := fun s x => V x+bb s/2*‖x-s.2.1‖^2
    let TT := fun s x => x-(1+bb s)⁻¹ • gradient (TF s) x
    let TQn := fun n s => ‖gradient (TF s) ((TT s)^[n] (s.2.2.1))‖^2
    let TN := firstIndex TQn (fun s => d*bb s)
    let txp := fun s => (TT s)^[TN s] (s.2.2.1)
    let TA := fun s => (bb s)⁻¹
    let tg := fun s => gradient V (txp s)
    let th := fun s => s.2.1-TA s • tg s
    let tnu := (volume.restrict (Ioc (0 : ℝ) 1)).prod (stdGaussian E)
    let tW := fun s (p : E × (ℝ × E)) => min 1 (max (-1) (scaledCached V TA th tg ((s,p.1),p.2)))
    let tproposal := fun s => (stdGaussian E).map (fun z => th s+Real.sqrt (TA s) • z)
    let trho := fun s => Measure.infinitePi (fun _ : ℕ => attemptLaw (tproposal s) tnu 1 (by norm_num))
    let _tpi := fun s => ((stdGaussian E).map (fun z => s.2.1+Real.sqrt (TA s) • z)).tilted (fun x => -V x)
    let μV := (volume : Measure E).tilted (fun x => -V x)
    IsProbabilityMeasure μV ∧
    ∃ (Lt : Kernel S E) (P : Kernel S S) (TG H : Kernel S E),
      IsMarkovKernel Lt ∧ IsMarkovKernel P ∧ IsMarkovKernel TG ∧ IsMarkovKernel H ∧
      (∀ s, P s=if B⁻¹ ≤ (s.1:ℝ) then Measure.dirac s else
        ((M s).prod (stdGaussian E)).map (fun z => update (s,z))) ∧
      (∀ s, (trho s).map (output (tW s) 1 0)=Lt s) ∧
      (∀ s, TG s=μV.tilted (fun x => -((s.1:ℝ)/2)*‖x-s.2.1‖^2)) ∧
      (∀ s, H s=AutoSamplingTheory.TechnicalLemmas.Measure.GaussianSmoothing.gaussianSmoothing
        (TG s) (Real.sqrt (v s))) ∧
      let Q := fun s => AutoSamplingTheory.TechnicalLemmas.Measure.GaussianSmoothing.gaussianSmoothing
        (M s) (Real.sqrt (τ s/(1+s.1)))
      let e := fun s => if B⁻¹ ≤ (s.1:ℝ) then 0 else klDiv (Q s) (H s)
      Measurable e ∧ ∀ m : ℕ,
        klDiv ((Lt ∘ₖ (P^(J+m))) s0) (TG s0) ≤
          (∑ j ∈ Finset.range J, ∫⁻ s, e s ∂(P^j) s0)+
          ENNReal.ofReal (Δ^2/((J:ℝ)+1)) := by
  classical
  intro d K τ L B J eps v bp obs center F T Qn N update bb TF TT TQn TN txp TA tg th tnu tW tproposal trho tpi μV
  have ht := AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.EnhancedTerminalExecution.enhanced_terminal_execution
    κ hκ hV hH hd η hηm c 2 Δ hc hc1 hη (by norm_num) hΔ hΔ1 s0 M
  obtain ⟨hB,heps,heps1,hbb,hn,hxp,hres,Lt,P,hLt,hP,hPs,hmass,hstable,hacc⟩ := ht
  let := hLt
  let := hP
  have hk0 : (0:ℝ≥0) < κ := lt_of_lt_of_le (by norm_num) hκ
  have ha0 : (0:ℝ≥0) < κ⁻¹ := inv_pos.2 hk0
  have ha1 : κ⁻¹ ≤ (1:ℝ≥0) := (inv_le_one₀ hk0).2 hκ
  have hHm : ∀ x w : E, ((κ⁻¹:ℝ≥0):ℝ)*‖w‖^2 ≤ fderiv ℝ (fderiv ℝ V) x w w ∧
      fderiv ℝ (fderiv ℝ V) x w w ≤ ((1:ℝ≥0):ℝ)*‖w‖^2 := by simpa using hH
  have hdR : 0 < (Module.finrank ℝ E:ℝ) := by exact_mod_cast hd
  have hτm : Measurable τ := by
    have hKm : Measurable (fun s : S => K s.1) := by dsimp [K]; fun_prop
    exact Measurable.ite (measurableSet_le measurable_const hKm) hKm measurable_const
  have hτ0 (s : S) : 0 < τ s := by
    dsimp only [τ]
    split_ifs with h
    · linarith
    · exact hc
  have hs := AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.EnhancedKLOneStep.one_step_kl_error
    ha0 ha1 hV hHm hdR η τ hηm hτm (fun s => (hη s).1) hτ0 M (Real.toNNReal B⁻¹)
  obtain ⟨hμ,TG,H,P',hTG,hHG,hP',hTGf,hHf,hPsf,he',hsteps⟩ := hs
  let := hμ
  let := hTG
  let := hHG
  let := hP'
  have hstop (s : S) : Real.toNNReal B⁻¹ ≤ s.1 ↔ B⁻¹ ≤ (s.1:ℝ) := by
    change ((Real.toNNReal B⁻¹:ℝ≥0):ℝ) ≤ (s.1:ℝ) ↔ B⁻¹ ≤ (s.1:ℝ)
    rw [Real.coe_toNNReal _ (inv_pos.2 hB).le]
  have hPeq : P'=P := by
    apply Kernel.ext
    intro s
    have hx := hPsf s
    simp only [NNReal.coe_one,NNReal.coe_inv] at hx
    have hy : P s=if B⁻¹ ≤ (s.1:ℝ) then Measure.dirac s else
        ((M s).prod (stdGaussian E)).map (fun z => update (s,z)) := hPs s
    by_cases hs : B⁻¹ ≤ (s.1:ℝ)
    · have hs' := (hstop s).2 hs
      simp only [if_pos hs'] at hx
      simp only [if_pos hs] at hy
      exact hx.trans hy.symm
    · have hs' : ¬Real.toNNReal B⁻¹ ≤ s.1 := fun h => hs ((hstop s).1 h)
      simp only [if_neg hs'] at hx
      simp only [if_neg hs] at hy
      exact hx.trans hy.symm
  subst P'
  refine ⟨hμ,Lt,P,TG,H,hLt,hP,hTG,hHG,hPs,?_,hTGf,?_,?_⟩
  · intro s
    exact (hacc s).1.2.1
  · intro s
    simpa only [NNReal.coe_one] using hHf s
  intro Q e
  have heq : (fun s : S => if Real.toNNReal B⁻¹ ≤ s.1 then 0 else
      klDiv (AutoSamplingTheory.TechnicalLemmas.Measure.GaussianSmoothing.gaussianSmoothing
        (M s) (Real.sqrt (τ s/(1+s.1)))) (H s)) = e := by
    funext s
    by_cases hs : B⁻¹ ≤ (s.1:ℝ)
    · have hs' := (hstop s).2 hs
      simp only [if_pos hs',e,if_pos hs]
    · have hs' : ¬Real.toNNReal B⁻¹ ≤ s.1 := fun h => hs ((hstop s).1 h)
      simp only [if_neg hs',e,Q,if_neg hs]
  have he : Measurable e := by
    simp only [NNReal.coe_one] at he'
    rw [heq] at he'
    exact he'
  have hstep : ∀ R : Kernel S E, IsMarkovKernel R →
      Measurable (fun s => klDiv (R s) (TG s)) ∧
      ∀ s, klDiv ((R ∘ₖ P) s) (TG s) ≤ e s+∫⁻ t, klDiv (R t) (TG t) ∂P s := by
    intro R hR
    let := hR
    have hh := hsteps R
    simp only [NNReal.coe_one] at hh
    refine ⟨hh.1,fun s => ?_⟩
    have hh' := hh.2 s
    have heqs := congrFun heq s
    rw [heqs] at hh'
    exact hh' 
  refine ⟨he,?_⟩
  have hd1 : 1 ≤ d := by
    have hn1 : 1 ≤ Module.finrank ℝ E := hd
    dsimp only [d]
    exact_mod_cast hn1
  have hBlarge : 1 < B⁻¹ := (terminal_precision_large κ s0.1 hκ d Δ hd1 hΔ hΔ1).2
  have hlip : LipschitzWith (1:ℝ≥0) (gradient V) := by
    have hh := (AutoSamplingTheory.TechnicalLemmas.Analysis.QuadraticRegularization.strongConvexOn_and_lipschitzWith_gradient_add_quadratic
      (r:=0) hV hHm (0:E)).2
    simpa using hh
  have hterminal (s : S) (hs : B⁻¹ ≤ (s.1:ℝ)) : klDiv (Lt s) (TG s) ≤ ENNReal.ofReal (eps^2) := by
    have hb1 : 1 < (s.1:ℝ) := lt_of_lt_of_le hBlarge hs
    have hb0 : 0 < (s.1:ℝ) := lt_trans zero_lt_one hb1
    have hbstep : ((1:ℝ≥0):ℝ)*(s.1:ℝ)⁻¹ < 1 := by
      simpa using (inv_lt_one₀ hb0).2 hb1
    have heqt : TG s=tpi s := by
      rw [hTGf]
      have hh := actual_terminal_target V (hV.differentiable (by norm_num)) 1 hlip
        (s.1:ℝ) hb0 hbstep s.2.1
      have hbs : bb s=(s.1:ℝ) := hbb s hs
      dsimp only [tpi,TA]
      rw [hbs]
      simpa only [neg_div] using hh
    obtain ⟨_,hpi,_,hac,_,hI,_,_,_,hbound,_,_⟩ := hacc s
    let := hpi
    rw [heqt]
    apply kl_le_second_moment (Lt s) (tpi s) hac eps
    · simpa only [Real.rpow_two] using hI
    · simpa only [Real.rpow_two] using hbound
  have hPJ : IsMarkovKernel (P^J) := by
    induction J with
    | zero => change IsMarkovKernel Kernel.id; infer_instance
    | succ n ih =>
      let := ih
      rw [pow_succ]
      change IsMarkovKernel ((P^n) ∘ₖ P)
      infer_instance
  let := hPJ
  have hD : ∀ᵐ s ∂(P^J) s0, B⁻¹ ≤ (s.1:ℝ) := by
    rw [ae_iff]
    have hbMeas : Measurable (fun s : S => (s.1:ℝ)) := by fun_prop
    have hm : MeasurableSet {s : S | B⁻¹ ≤ (s.1:ℝ)} := measurableSet_le measurable_const hbMeas
    change (P^J) s0 {s : S | B⁻¹ ≤ (s.1:ℝ)}ᶜ=0
    rw [measure_compl hm (measure_ne_top _ _), hmass, measure_univ, tsub_self]
  have hresidual : (∫⁻ s, klDiv (Lt s) (TG s) ∂(P^J) s0) ≤ ENNReal.ofReal (eps^2) := by
    calc
      _ ≤ ∫⁻ _s, ENNReal.ofReal (eps^2) ∂(P^J) s0 :=
        lintegral_mono_ae (hD.mono fun s hs => hterminal s hs)
      _ = _ := by rw [lintegral_const, measure_univ, mul_one]
  have hepssq : eps^2=Δ^2/((J:ℝ)+1) := by
    dsimp only [eps]
    rw [div_pow, Real.sq_sqrt (by positivity)]
  intro m
  rw [hstable m]
  have hf := composed_error_sum P TG Lt e he hstep J s0
  exact hf.trans (add_le_add le_rfl (by simpa only [hepssq] using hresidual))

end AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.EnhancedFiniteOutputKL

Exact module and namespace context

Source assumptions versus formal assumptions

Source	Actual Lean	Difference kind	Why it matters
Source(1.1) explicitly assumes a C2 potential on Euclidean R^d with genuine Hessian bounds.	Positive finite-dimensional inner-product Borel space and genuine C2 Hessian bounds.	generalization	C2 agrees with the source. The coordinate-free finite-dimensional inner-product Borel formulation generalizes its Euclidean presentation;positive dimension is explicit.
Source accuracy routes include different Renyi orders.	Normalized beta=1,kappa>=1 and the A1 q=2 finite-output consumer.	API-limitation	No arbitrary-order A4 result or unnormalized adapter is implied.
Source M satisfies stage accuracy requirements.	M is arbitrary Markov;actual observation errors are retained,including infinity.	API-limitation	The numerical(6.5)stage budget and final Delta^2 do not follow yet.
Source execution produces admissible references and histories.	Initial full state is arbitrary.	generalization	No history-origin or initialization cost is inferred.
Source terminal Gibbs target uses its actual positive precision.	Nested volume Gibbs tilt equals Gaussian tilt only on actual terminal support;integrability is derived.	source-implicit	No assumed normalizer or target identity;outside-support extension is explicit.
Source recursion starts from terminal accuracy.	Actual dLt/dTG second moment and probability mass derive the terminal KL residual.	mathematically-necessary	Correct RN direction and L1 conditions precede integral conversion.
Source full algorithm analysis also provides stage/global costs.	Actual output law and finite error sum only;parent support/cap/first-hit/cost facts are not all public conjuncts.	API-limitation	No numerical stage accuracy,total cost or full paper completion claim.

Actual q=2 finite output for the Section6.3 A1 recursion and terminal base case. Genuine C2 Hessian bounds and normalized beta=1,kappa>=1 are explicit. Arbitrary actual M has no stage accuracy or cost guarantee;observation KL and its sum may be infinite. Arbitrary initial reference/history need not be a legally produced history. The actual terminal output pushforward and full P law are returned. Terminal support,cap law equality,first-hit criteria,output measurability and costs are consumed parent facts,not all separately returned conjuncts. Capped bb is a terminal-program extension outside support;TG=tpi is used only on terminal support. The exact residual is Delta^2/(J+1). No numerical(6.5)stage budget,final Delta^2 accuracy,initialization/total cost,actual M construction or complete main result is claimed.

Encoder–denoiser: accepted · domain-mismatch

Detected semantic differences

domains: Coordinate-free domain generalizes;C2 explicitly matches source1.1. — Independent formal source reviewer accepted: Coordinate-free domain generalizes;C2 explicitly matches source1.1.
scopes: q=2 and normalized setting supply A1 selected consumer. — Independent formal source reviewer accepted: q=2 and normalized setting supply A1 selected consumer.
assumptions: Arbitrary M retains actual errors,possiblyinfinite. — Independent formal source reviewer accepted: Arbitrary M retains actual errors,possiblyinfinite.
assumptions: Arbitrary initial state carries no history-origin or initializationguarantee. — Independent formal source reviewer accepted: Arbitrary initial state carries no history-origin or initializationguarantee.
objects: Actual terminal target/normalization derived onlyonterminalsupport. — Independent formal source reviewer accepted: Actual terminal target/normalization derived onlyonterminalsupport.
conclusion: Correct RN direction and L1 arguments precede integralalgebra. — Independent formal source reviewer accepted: Correct RN direction and L1 arguments precede integralalgebra.
scopes: Output component distinctfrom full numericalaccuracy/totalcost. — Independent formal source reviewer accepted: Output component distinctfrom full numericalaccuracy/totalcost.

A generalization is not a source correction. Proposed missing conditions require separate independent repair review. No proposed repair silently changes the original theorem.

Scope and omitted-condition boundaries

Actual q=2 finite output for the Section6.3 A1 recursion and terminal base case. Genuine C2 Hessian bounds and normalized beta=1,kappa>=1 are explicit. Arbitrary actual M has no stage accuracy or cost guarantee;observation KL and its sum may be infinite. Arbitrary initial reference/history need not be a legally produced history. The actual terminal output pushforward and full P law are returned. Terminal support,cap law equality,first-hit criteria,output measurability and costs are consumed parent facts,not all separately returned conjuncts. Capped bb is a terminal-program extension outside support;TG=tpi is used only on terminal support. The exact residual is Delta^2/(J+1). No numerical(6.5)stage budget,final Delta^2 accuracy,initialization/total cost,actual M construction or complete main result is claimed.

Source and reuse

ASTIS parents called

Mathlib API called (external library)

InformationTheory.klDiv_eq_lintegral_klFun_of_ac
MeasureTheory.Measure.integral_toReal_rnDeriv
MeasureTheory.Measure.integrableOn_toReal_rnDeriv
MeasureTheory.tilted_tilted
MeasureTheory.tilted_of_not_integrable
MeasureTheory.ofReal_integral_eq_lintegral_ofReal
ProbabilityTheory.Kernel.lintegral_comp

Mathematical sources

SPHMC Section6.3 A1 recursion and terminal stage — Actual q=2 finite output for the Section6.3 A1 recursion and terminal base case. Genuine C2 Hessian bounds and normalized beta=1,kappa>=1 are explicit. Arbitrary actual M has no stage accuracy or cost guarantee;observation KL and its sum may be infinite. Arbitrary initial reference/history need not be a legally produced history. The actual terminal output pushforward and full P law are returned. Terminal support,cap law equality,first-hit criteria,output measurability and costs are consumed parent facts,not all separately returned conjuncts. Capped bb is a terminal-program extension outside support;TG=tpi is used only on terminal support. The exact residual is Delta^2/(J+1). No numerical(6.5)stage budget,final Delta^2 accuracy,initialization/total cost,actual M construction or complete main result is claimed.

ASTIS prose is not a quotation or a source-equivalence certificate. Definitions and aliases are explained as constructions, not counted as new mathematical proofs.

Which proof edges are actually covered?

Local proof component; source adapter/review separate Actual finite-output KL with terminal residual discharged

Actual Gibbs enhanced-state one-step KL recurrence

ASTIS expanded actual KL recurrence component for Fan Chen,Sinho Chewi,Jianfeng Lu and Matthew S. Zhang, Smoothed Picard Hamiltonian Monte Carlo. Not the numerical stage budget or full main theorem.

arXiv:2609.06906v1 · Algorithm3.3,Section6.3 conditional output KL argument after(6.5) · faithful paraphrase

Complete source statement (ASTIS restatement)

muV is a probability measure. There exist Markov kernels T,H:S->E and P:S->S, chosen before every remaining-output kernel R, such that for every state s, T_s=muV.tilted(x->-b/2*norm(x-u)^2), H_s=G(T_s,sqrt(v_s)), and P_s=dirac_s when threshold<=b, otherwise P_s is the pushforward of M_s product standardGaussian by U(s,·). Put Q_s=G(M_s,sqrt(tau_s/(beta+b))) and e(s)=0 when threshold<=b, otherwise KL(Q_s||H_s). Then e is measurable. For every actual Markov kernel R:S->E, the function s->KL(R_s||T_s) is measurable and, for every s, KL((R composed with P)_s||T_s)<=e(s)+the nonnegative integral of KL(R_t||T_t) under P_s.

E is a finite-dimensional real inner-product Borel space with positive dimension d. V:E->R is C2 and its genuine Hessian satisfies alpha*norm(w)^2<=D2V(x)[w,w]<=beta*norm(w)^2 for every x,w. The nonnegative parameters satisfy0<alpha<=beta.
The full state is S=NNReal x E x E x Nat x (Nat->E), written s=(b,u,xref,k,history). eta,tau:S->R are measurable and strictly positive at every state. M:S->E is an actual Markov kernel, and threshold is any nonnegative real. M,eta,tau may depend on all coordinates. No source schedule,reference admissibility,history origin,approximation or moment premise is imposed.
Set v_s=(eta_s+tau_s)/(beta+b), bp_s=b+toNNReal(v_s^(-1)), obs(s,(x,z))=x+sqrt(tau_s/(beta+b))*z and center(s,(x,z))=bp_s^(-1)*(b*u+v_s^(-1)*obs). For p=(s,(x,z)), define F_p(w)=V(w)+bp_s/2*norm(w-center(p))^2 and D_p(w)=w-(beta+bp_s)^(-1)*grad F_p(w). N_p is the least n with norm(grad F_p(D_p^n(x)))^2<=(alpha+bp_s)*d, or0 if none exists. U(p)=(bp_s,center(p),D_p^N_p(x),k+1,prepend(obs(p),history)). The actual reference is initialized at the pre-noise x.
Define the actual Gibbs base muV=volume.tilted(-V), using canonical volume. Gaussian smoothing G(mu,sigma) is the law of X+sigma*Z under mu product standardGaussian. All KL values and all displayed integrals are extended nonnegative reals, including infinity. R composed with P first draws the retained state from P and then the output from R.

Actual one-step KL propagation

\[\operatorname{KL}((R\circ P)_s\Vert T_s)\le e(s)+\int\operatorname{KL}(R_t\Vert T_t)\,P_s(dt),\qquad e(s)=\begin{cases}\operatorname{KL}(Q_s\Vert H_s),&b_s<b_*,\\0,&b_s\ge b_*.\end{cases}\]

Read the formalized proofs

Each statement and proof below has its own closed Lean disclosure. ASTIS parents, Mathlib calls and external mathematical sources are distinguished in each proof.

ASTIS mathematical exposition

Actual Gibbs enhanced-state one-step KL recurrence

AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.EnhancedKLOneStep.one_step_kl_error · theorem · Teaching coverage

Statement

\[\operatorname{KL}((R\circ P)_s\Vert T_s)\le e(s)+\int\operatorname{KL}(R_t\Vert T_t)\,P_s(dt),\qquad e(s)=\begin{cases}\operatorname{KL}(Q_s\Vert H_s),&b_s<b_*,\\0,&b_s\ge b_*.\end{cases}\]

All objects and hypotheses

E is a finite-dimensional real inner-product Borel space with positive dimension d. V:E->R is C2 and its genuine Hessian satisfies alpha*norm(w)^2<=D2V(x)[w,w]<=beta*norm(w)^2 for every x,w. The nonnegative parameters satisfy0<alpha<=beta.
The full state is S=NNReal x E x E x Nat x (Nat->E), written s=(b,u,xref,k,history). eta,tau:S->R are measurable and strictly positive at every state. M:S->E is an actual Markov kernel, and threshold is any nonnegative real. M,eta,tau may depend on all coordinates. No source schedule,reference admissibility,history origin,approximation or moment premise is imposed.
Set v_s=(eta_s+tau_s)/(beta+b), bp_s=b+toNNReal(v_s^(-1)), obs(s,(x,z))=x+sqrt(tau_s/(beta+b))*z and center(s,(x,z))=bp_s^(-1)*(b*u+v_s^(-1)*obs). For p=(s,(x,z)), define F_p(w)=V(w)+bp_s/2*norm(w-center(p))^2 and D_p(w)=w-(beta+bp_s)^(-1)*grad F_p(w). N_p is the least n with norm(grad F_p(D_p^n(x)))^2<=(alpha+bp_s)*d, or0 if none exists. U(p)=(bp_s,center(p),D_p^N_p(x),k+1,prepend(obs(p),history)). The actual reference is initialized at the pre-noise x.
Define the actual Gibbs base muV=volume.tilted(-V), using canonical volume. Gaussian smoothing G(mu,sigma) is the law of X+sigma*Z under mu product standardGaussian. All KL values and all displayed integrals are extended nonnegative reals, including infinity. R composed with P first draws the retained state from P and then the output from R.

Mathematical proof

1. Construct the real Gibbs target

GibbsGradientMoment proves that muV=volume.tilted(-V) is a probability under the actual Hessian assumptions. Apply the generic measurable-state StateDependentRGO construction with b(s),v(s),u(s). This produces Markov T,H and a retained-input posterior B. The public targets remain nested tilts of this actual Gibbs base; no unrelated probability base or unproved normalizer is supplied.

\[\mu_V=\mathrm{volume.tilted}(-V),\quad T_s=\mu_V.\mathrm{tilted}(-b_s\|\cdot-u_s\|^2/2).\]

Corresponding Lean step

actual_gibbs_posterior: hμ,T,H,B,hTf,hHf

2. Derive the ideal posterior recovery

Project B to its second output coordinate to obtain K. Measurable pushforward composition yields the exact posterior precision b+1/v and center (b+1/v)^(-1)(bu+y/v). Instantiate the existing joint recovery with a Dirac input state and evaluate measurable second-coordinate events. The resulting pointwise recovery is H_s K_s=T_s. It is a theorem in the proof,not an input to the public statement.

\[\int K(s,y)\,H_s(dy)=T_s.\]

Corresponding Lean step

actual_gibbs_posterior: K,hKf,he,hei,hm

3. Keep the actual reference and distinguish the two noises

Positivity gives v>0 and bp=b+1/v without truncation. ObservationConditionalKernel supplies the genuine pre-noise initialized first-hit update and its actual absorbed P. Its joint J has observation marginal Q=G(M,sqrt(tau/(beta+b))). Ideal H instead uses sqrt(v)=sqrt((eta+tau)/(beta+b)). ReferenceCarryingKernel supplies the actual joint update measurability used in the projection calculation.

\[Q_s=G(M_s,\sqrt{\tau_s/(\beta+b_s)}),\quad H_s=G(T_s,\sqrt{(\eta_s+\tau_s)/(\beta+b_s)}).\]

Corresponding Lean step

firstIndex; one_step_kl_error: hβ,hv,hvm,hbp,J,hQ,href,hu,ho,hJs',hPs'

4. Prove KL measurability including singular fibers

Express fiber KL by the nonnegative klFun integral of the measurable kernel Radon-Nikodym derivative on the measurable absolute-continuity set,and infinity outside it. Kernel integral measurability proves the fiber KL function measurable. A measurable branch on b>=threshold gives e; the same argument works for every remaining-output R against T.

\[x\mapsto\operatorname{KL}(L_x\Vert K_x)\quad\text{is measurable,including }+\infty.\]

Corresponding Lean step

measurable_fiber_kl: hf,heq; one_step_kl_error: heq,he,hmR

5. Establish the all-ENNReal conditional chain calculation

For two kernels with the same probability base,the joint KL equals the integral of conditional KL. In the AC case,construct the joint density from the kernel derivative and use its almost-everywhere RN identity. In the non-AC case,a finite conditional integral would imply AE fiber AC and then joint AC,a contradiction. Projecting the joint laws and using the KL compProd chain identity gives the composed-output bound without a finite-KL premise.

\[\operatorname{KL}(L\mu\Vert K\nu)\le\operatorname{KL}(\mu\Vert\nu)+\int\operatorname{KL}(L_x\Vert K_x)\,\mu(dx).\]

Corresponding Lean step

conditional_kl_integral: hac,hfiber,hwd,hrn,hfinite; composed_kl_bound

6. Average over the actual conditional reference

Let C=J.condKernel. Its precision/center support implies T_t=K(s,y) for actual-Q-almost every y and C(s,y)-almost every t. Apply the preceding chain bound with equal bases C(s,y) and a constant target kernel. The base KL is zero and the constant kernel integrates to K(s,y),giving the mixture bound. This does not make the reference a deterministic function of y,and no C-support claim under H is needed.

\[\operatorname{KL}(R C_{s,y}\Vert K(s,y))\le\int\operatorname{KL}(R_t\Vert T_t)\,C(s,y,dt)\quad(Q_s\text{-a.e. }y).\]

Corresponding Lean step

mixture_kl_bound: K,hc,hconst; one_step_kl_error: halign; conditional_step: hm

7. Chain observation error and fold into actual execution

On the active branch,projecting the same joint update proves P_s=J.snd_s. Disintegration therefore rewrites every nonnegative P_s integral as the actualQ/conditionalC iterated integral. Define the remaining observation kernel by composing R with C. Chain it against the ideal posterior K using Q versus H; ideal recovery identifies the comparator T_s. The mixture bound and nonnegative integration fold the conditional residual into the actual P_s integral.

\[\operatorname{KL}((R\circ P)_s\Vert T_s)\le\operatorname{KL}(Q_s\Vert H_s)+\int\operatorname{KL}(R_t\Vert T_t)\,P_s(dt).\]

Corresponding Lean step

conditional_step: C,LR,KR,hdecomp,hout,hc,hm; one_step_kl_error: hPJ,hc

8. Handle absorption without erasing terminal error

When b>=threshold,P_s is Dirac and e(s)=0. Both composed output and residual integral reduce to the same KL(R_s||T_s),so the inequality is reflexive. Combining this with the active calculation proves the statement for every state and every actual Markov R. No observation-error bound,finite-depth sum or terminal accuracy is inferred from the identity.

\[b_s\ge b_*:\quad\operatorname{KL}(R_s\Vert T_s)\le0+\operatorname{KL}(R_s\Vert T_s).\]

Corresponding Lean step

one_step_kl_error: hs,Measure.dirac_bind,lintegral_dirac'

Lean statement · one_step_kl_error

Actual Gibbs target,ideal observation and absorbed retained-state transition with measurable all-ENNReal one-step KL error.

theorem one_step_kl_error {V : E → ℝ} {α β : ℝ≥0}
    (hα : 0 < α) (hαβ : α ≤ β) (hV : ContDiff ℝ 2 V)
    (hHess : ∀ x w : E, (α:ℝ)*‖w‖^2 ≤ fderiv ℝ (fderiv ℝ V) x w w ∧
      fderiv ℝ (fderiv ℝ V) x w w ≤ (β:ℝ)*‖w‖^2)
    (hd : 0 < (Module.finrank ℝ E : ℝ))
    (η τ : RefState E → ℝ) (hη : Measurable η) (hτ : Measurable τ)
    (hη0 : ∀ s, 0 < η s) (hτ0 : ∀ s, 0 < τ s)
    (M : Kernel (RefState E) E) [IsMarkovKernel M] (threshold : ℝ≥0) :
    let d : ℝ := Module.finrank ℝ E
    let v := fun s : RefState E => (η s+τ s)/((β:ℝ)+s.1)
    let bp := fun s : RefState E => s.1+Real.toNNReal (v s)⁻¹
    let obs := fun p : RefState E × (E × E) => p.2.1+Real.sqrt (τ p.1/((β:ℝ)+p.1.1)) • p.2.2
    let center := fun p : RefState E × (E × E) => (bp p.1:ℝ)⁻¹ •
      ((p.1.1:ℝ) • p.1.2.1+(v p.1)⁻¹ • obs p)
    let F := fun p x => V x+(bp p.1:ℝ)/2*‖x-center p‖^2
    let T := fun p x => x-((β:ℝ)+bp p.1)⁻¹ • gradient (F p) x
    let q := fun n p => ‖gradient (F p) ((T p)^[n] p.2.1)‖^2
    let N := firstIndex q (fun p => ((α:ℝ)+bp p.1)*d)
    let out := fun p => (T p)^[N p] p.2.1
    let update := fun p : RefState E × (E × E) =>
      (bp p.1,center p,out p,p.1.2.2.2.1+1,fun n => Nat.casesOn n (obs p) p.1.2.2.2.2)
    let μ := (volume : Measure E).tilted (fun x => -V x)
    IsProbabilityMeasure μ ∧
    ∃ (T H : Kernel (RefState E) E) (P : Kernel (RefState E) (RefState E)),
      ∃ hT : IsMarkovKernel T, ∃ hH : IsMarkovKernel H, ∃ hP : IsMarkovKernel P,
      letI := hT
      letI := hH
      letI := hP
      (∀ s, T s=μ.tilted (fun x => -((s.1:ℝ)/2)*‖x-s.2.1‖^2)) ∧
      (∀ s, H s=AutoSamplingTheory.TechnicalLemmas.Measure.GaussianSmoothing.gaussianSmoothing
        (T s) (Real.sqrt (v s))) ∧
      (∀ s, P s=if threshold ≤ s.1 then Measure.dirac s else
        ((M s).prod (stdGaussian E)).map (fun z => update (s,z))) ∧
      let Q := fun s => AutoSamplingTheory.TechnicalLemmas.Measure.GaussianSmoothing.gaussianSmoothing
        (M s) (Real.sqrt (τ s/((β:ℝ)+s.1)))
      let e := fun s => if threshold ≤ s.1 then 0 else klDiv (Q s) (H s)
      Measurable e ∧ ∀ (R : Kernel (RefState E) E) [IsMarkovKernel R],
        Measurable (fun s => klDiv (R s) (T s)) ∧ ∀ s,
        klDiv ((R ∘ₖ P) s) (T s) ≤ e s+∫⁻ t, klDiv (R t) (T t) ∂P s

Exact module and namespace context

Lean proof · one_step_kl_error

Real Gibbs posterior recovery,actual conditional-reference alignment,KL mixture/chain and active/stopped execution branches.

theorem one_step_kl_error {V : E → ℝ} {α β : ℝ≥0}
    (hα : 0 < α) (hαβ : α ≤ β) (hV : ContDiff ℝ 2 V)
    (hHess : ∀ x w : E, (α:ℝ)*‖w‖^2 ≤ fderiv ℝ (fderiv ℝ V) x w w ∧
      fderiv ℝ (fderiv ℝ V) x w w ≤ (β:ℝ)*‖w‖^2)
    (hd : 0 < (Module.finrank ℝ E : ℝ))
    (η τ : RefState E → ℝ) (hη : Measurable η) (hτ : Measurable τ)
    (hη0 : ∀ s, 0 < η s) (hτ0 : ∀ s, 0 < τ s)
    (M : Kernel (RefState E) E) [IsMarkovKernel M] (threshold : ℝ≥0) :
    let d : ℝ := Module.finrank ℝ E
    let v := fun s : RefState E => (η s+τ s)/((β:ℝ)+s.1)
    let bp := fun s : RefState E => s.1+Real.toNNReal (v s)⁻¹
    let obs := fun p : RefState E × (E × E) => p.2.1+Real.sqrt (τ p.1/((β:ℝ)+p.1.1)) • p.2.2
    let center := fun p : RefState E × (E × E) => (bp p.1:ℝ)⁻¹ •
      ((p.1.1:ℝ) • p.1.2.1+(v p.1)⁻¹ • obs p)
    let F := fun p x => V x+(bp p.1:ℝ)/2*‖x-center p‖^2
    let T := fun p x => x-((β:ℝ)+bp p.1)⁻¹ • gradient (F p) x
    let q := fun n p => ‖gradient (F p) ((T p)^[n] p.2.1)‖^2
    let N := firstIndex q (fun p => ((α:ℝ)+bp p.1)*d)
    let out := fun p => (T p)^[N p] p.2.1
    let update := fun p : RefState E × (E × E) =>
      (bp p.1,center p,out p,p.1.2.2.2.1+1,fun n => Nat.casesOn n (obs p) p.1.2.2.2.2)
    let μ := (volume : Measure E).tilted (fun x => -V x)
    IsProbabilityMeasure μ ∧
    ∃ (T H : Kernel (RefState E) E) (P : Kernel (RefState E) (RefState E)),
      ∃ hT : IsMarkovKernel T, ∃ hH : IsMarkovKernel H, ∃ hP : IsMarkovKernel P,
      letI := hT
      letI := hH
      letI := hP
      (∀ s, T s=μ.tilted (fun x => -((s.1:ℝ)/2)*‖x-s.2.1‖^2)) ∧
      (∀ s, H s=AutoSamplingTheory.TechnicalLemmas.Measure.GaussianSmoothing.gaussianSmoothing
        (T s) (Real.sqrt (v s))) ∧
      (∀ s, P s=if threshold ≤ s.1 then Measure.dirac s else
        ((M s).prod (stdGaussian E)).map (fun z => update (s,z))) ∧
      let Q := fun s => AutoSamplingTheory.TechnicalLemmas.Measure.GaussianSmoothing.gaussianSmoothing
        (M s) (Real.sqrt (τ s/((β:ℝ)+s.1)))
      let e := fun s => if threshold ≤ s.1 then 0 else klDiv (Q s) (H s)
      Measurable e ∧ ∀ (R : Kernel (RefState E) E) [IsMarkovKernel R],
        Measurable (fun s => klDiv (R s) (T s)) ∧ ∀ s,
        klDiv ((R ∘ₖ P) s) (T s) ≤ e s+∫⁻ t, klDiv (R t) (T t) ∂P s := by
  classical
  intro d v bp obs center F Tstep q N out update μ
  have hβ : 0 < (β:ℝ) := lt_of_lt_of_le (show 0 < (α:ℝ) from hα)
    (show (α:ℝ) ≤ β from hαβ)
  have hv (s : RefState E) : 0 < v s :=
    div_pos (add_pos (hη0 s) (hτ0 s)) (add_pos_of_pos_of_nonneg hβ s.1.coe_nonneg)
  have hvm : Measurable v := by dsimp [v]; fun_prop
  have hbp (s : RefState E) : (bp s:ℝ)=(s.1:ℝ)+(v s)⁻¹ := by
    simp only [bp,NNReal.coe_add,Real.coe_toNNReal _ (inv_pos.mpr (hv s)).le]
  obtain ⟨hμ,T,H,K,hT,hH,hK,hTf,hHf,hKf,hrec⟩ :=
    actual_gibbs_posterior hα hαβ hV hHess (fun s : RefState E => (s.1:ℝ)) v
      (fun s => s.2.1) (by fun_prop) hvm (by fun_prop) (fun s => s.1.coe_nonneg) hv
  let := hμ
  let := hT
  let := hH
  let := hK
  obtain ⟨J,hJ,hJs,hQ,hdis,hsupp,hfact,P,hP,hPs,hactive⟩ :=
    AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.ObservationConditionalKernel.observation_conditional_kernel
      hα hαβ hV hHess hd η τ hη hτ hη0 hτ0 M threshold
  let := hJ
  let := hP
  have href := AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.ReferenceCarryingKernel.reference_carrying_kernel
    hα hαβ hV hHess hd η τ hη hτ hη0 hτ0 M threshold
  have hu : Measurable update := href.2.2.2.1
  have ho : Measurable obs := by dsimp [obs]; fun_prop
  have hJs' (s : RefState E) : J s=((M s).prod (stdGaussian E)).map
      (fun z => (obs (s,z),update (s,z))) := hJs s
  have hPs' (s : RefState E) : P s=if threshold ≤ s.1 then Measure.dirac s else
      ((M s).prod (stdGaussian E)).map (fun z => update (s,z)) := hPs s
  have halign (s : RefState E) : ∀ᵐ y ∂J.fst s, ∀ᵐ t ∂J.condKernel (s,y), T t=K (s,y) := by
    filter_upwards [hsupp s] with y hy
    filter_upwards [hy] with t ht
    rw [hTf,hKf,ht.1,ht.2,hbp]
  refine ⟨hμ,T,H,P,hT,hH,hP,hTf,hHf,hPs',?_⟩
  intro Q e
  have heq : e=(fun s => if threshold ≤ s.1 then 0 else klDiv (J.fst s) (H s)) := by
    funext s
    simp only [e,Q,hQ]
  have he : Measurable e := by
    rw [heq]
    exact Measurable.ite (measurableSet_le measurable_const (by fun_prop))
      measurable_const (measurable_fiber_kl J.fst H)
  refine ⟨he,fun R hR => ?_⟩
  let := hR
  have hmR := measurable_fiber_kl R T
  refine ⟨hmR,fun s => ?_⟩
  by_cases hs : threshold ≤ s.1
  · simp only [e,Kernel.comp_apply,hPs',if_pos hs,
      Measure.dirac_bind R.measurable,lintegral_dirac' s hmR,zero_add,le_refl]
  · have hPJ : P s=J.snd s := by
      have hf : Measurable (fun z : E × E => (obs (s,z),update (s,z))) :=
        (ho.prodMk hu).comp (measurable_const.prodMk measurable_id)
      rw [hPs',if_neg hs,Kernel.snd_apply,hJs',Measure.map_map measurable_snd hf]
      rfl
    have hc := conditional_step J P T H K R s hPJ (hrec s) (halign s)
    simpa only [e,Q,if_neg hs,hQ] using hc

end AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.EnhancedKLOneStep

Exact module and namespace context

Source assumptions versus formal assumptions

Source	Actual Lean	Difference kind	Why it matters
Source(1.1) explicitly assumes a C2 potential on Euclidean R^d with genuine Hessian bounds.	Positive finite-dimensional inner-product Borel space and genuine C2 Hessian bounds.	generalization	C2 agrees with the source. The coordinate-free finite-dimensional inner-product Borel presentation generalizes Euclidean coordinates;positive dimension and curvature inequalities remain explicit.
Source legal schedules,reference and produced history.	Arbitrary positive measurable eta,tau,threshold and full initial state.	generalization	No source schedule,admissibility or history-origin result is borrowed.
Source sampler and remaining recursive call have accuracy guarantees.	M and R are arbitrary actual Markov kernels;observation KL may be infinite.	API-limitation	This proves the recurrence structure,not the A1 or(6.5)numerical budget.
Source target has a Gibbs potential and a quadratic RGO update.	Actual muV=volume.tilted(-V) and nested quadratic tilt,with probability and recovery derived.	source-implicit	No arbitrary unidentified base;combined volume density/normalizer is not an extra public conclusion.
Source conditions on actual observation and full history.	Conditional reference target alignment only under actualQ thenC AE.	mathematically-necessary	No transfer to idealH null sets or deterministic observation-only reference.
Finite error estimates arise after source accuracy inputs.	All-ENNReal recurrence including non-AC and infinite KL,with measurability proved.	generalization	No hidden finite-KL,AC or L1 premise;later numerical bounds are separate.
Source analysis accumulates errors and bounds final accuracy/cost.	One actual enhanced-state KL step,including the unchanged absorbed residual.	API-limitation	Internal J,C,K/recovery are not returned;finite-depth,terminal accuracy,M construction and costs remain.

Actual enhanced-state one-step KL recurrence for the Section6.3 conditional output argument, not the numerical(6.5) observation budget or full Theorem6.5. C2 genuine Hessian bounds agree with source(1.1); positive finite dimension and0<alpha<=beta are explicit. Arbitrary measurable positive steps,state,threshold and actual M,R provide no source schedule,admissibility,accuracy or moments; e may be infinite. T is the nested actual volume-Gibbs tilt, without an extra combined density/normalizer formula. Posterior recovery,conditional target alignment and active projection are proved internally,not public premises. Internal J,C,K and standalone recovery are not returned conjuncts. Conditional support is used only under actualQ,not transferred to idealH. The stopped branch retains remaining-output KL. Numerical stage precision,finite-depth accumulation,terminal accuracy,actual M construction and all query costs remain separate; neither paper is complete.

Encoder–denoiser: accepted · domain-mismatch

Detected semantic differences

domains: C2 and genuine Hessian match source1.1;coordinate-free domain generalization. — Independent reviewer confirms source1.1 C2 and corrected reader/header;no Lean proposition repair.
assumptions: Arbitrary parameters,threshold,state carry no source schedule/admissibility. — Independent formal source reviewer accepted: Arbitrary parameters,threshold,state carry no source schedule/admissibility.
assumptions: Arbitrary M/R permit infinite observation error. — Independent formal source reviewer accepted: Arbitrary M/R permit infinite observation error.
objects: Actual Gibbs base and recovery proved,no arbitrary probability base substitution. — Independent formal source reviewer accepted: Actual Gibbs base and recovery proved,no arbitrary probability base substitution.
quantifiers: Alignment restricted to actual-Q/C nested AE. — Independent formal source reviewer accepted: Alignment restricted to actual-Q/C nested AE.
conclusion: All-ENNReal and measurability enhancement. — Independent formal source reviewer accepted: All-ENNReal and measurability enhancement.
scopes: One-step scope and absorbed residual explicitly retained. — Independent formal source reviewer accepted: One-step scope and absorbed residual explicitly retained.

A generalization is not a source correction. Proposed missing conditions require separate independent repair review. No proposed repair silently changes the original theorem.

Scope and omitted-condition boundaries

Actual enhanced-state one-step KL recurrence for the Section6.3 conditional output argument, not the numerical(6.5) observation budget or full Theorem6.5. C2 genuine Hessian bounds agree with source(1.1); positive finite dimension and0<alpha<=beta are explicit. Arbitrary measurable positive steps,state,threshold and actual M,R provide no source schedule,admissibility,accuracy or moments; e may be infinite. T is the nested actual volume-Gibbs tilt, without an extra combined density/normalizer formula. Posterior recovery,conditional target alignment and active projection are proved internally,not public premises. Internal J,C,K and standalone recovery are not returned conjuncts. Conditional support is used only under actualQ,not transferred to idealH. The stopped branch retains remaining-output KL. Numerical stage precision,finite-depth accumulation,terminal accuracy,actual M construction and all query costs remain separate; neither paper is complete.

Source and reuse

ASTIS parents called

Mathlib API called (external library)

InformationTheory.klDiv_compProd_eq_add
InformationTheory.klDiv_map_le
ProbabilityTheory.Kernel.rnDeriv_eq_rnDeriv_measure
ProbabilityTheory.Kernel.lintegral_compProd
MeasureTheory.Measure.dirac_compProd_apply
MeasureTheory.lintegral_map

Mathematical sources

SPHMC Section6.3 conditional output after(6.5) — Actual enhanced-state one-step KL recurrence for the Section6.3 conditional output argument, not the numerical(6.5) observation budget or full Theorem6.5. C2 genuine Hessian bounds agree with source(1.1); positive finite dimension and0<alpha<=beta are explicit. Arbitrary measurable positive steps,state,threshold and actual M,R provide no source schedule,admissibility,accuracy or moments; e may be infinite. T is the nested actual volume-Gibbs tilt, without an extra combined density/normalizer formula. Posterior recovery,conditional target alignment and active projection are proved internally,not public premises. Internal J,C,K and standalone recovery are not returned conjuncts. Conditional support is used only under actualQ,not transferred to idealH. The stopped branch retains remaining-output KL. Numerical stage precision,finite-depth accumulation,terminal accuracy,actual M construction and all query costs remain separate; neither paper is complete.

ASTIS prose is not a quotation or a source-equivalence certificate. Definitions and aliases are explained as constructions, not counted as new mathematical proofs.

Which proof edges are actually covered?

Local proof component; source adapter/review separate Actual Gibbs enhanced-state one-step KL recurrence

Actual enhanced-state termination and terminal FORS execution

ASTIS expanded execution component for Fan Chen, Sinho Chewi, Jianfeng Lu and Matthew S. Zhang, Smoothed Picard Hamiltonian Monte Carlo. Actual kernel-power execution and terminal fiber guarantees, not a full main result.

arXiv:2609.06906v1 · Algorithm3.3,Section6.3 (6.4) and terminal stage · faithful paraphrase

Complete source statement (ASTIS restatement)

B>0 and0<eps<=1/2. On D={s:b>=1/B}, bbar(s)=b. TN and txp are measurable; the true terminal gradient threshold is attained, every earlier iterate fails it, and norm(th-txp)<=sqrt(d*A). There exist Markov kernels Lt:S->E and P:S->S. P(s) is dirac(s) on D and otherwise the pushforward of M(s) product standardGaussian by update(s,·). (P^J)(s0)(D)=1, and for every natural m, (Lt composed with P^(J+m))(s0)=(Lt composed with P^J)(s0). For every state s, output_s is measurable, trho_s mapped by output_s equals this same Lt(s), never-success has trho_s measure zero, and the nonnegative integral of1+queryCount is at most1+2*exp(2). tpi_s is a probability mutually absolutely continuous with Lt(s); both RN q-powers are integrable under their respective denominator laws, with strictly positive integrals at most1+eps^2, and their logarithms divided by q-1 are at most eps^2.

E is a finite-dimensional real inner-product Borel space with positive dimension d. V:E->R is fixed and C2, with genuine Hessian between kappa^(-1)*norm(w)^2 and norm(w)^2, where kappa is a nonnegative real with kappa>=1. The baseline smoothness is one.
The full state space is S=NNReal x E x E x Nat x (Nat->E), with s=(b,u,xref,k,history). Fix any initial state s0. M is an actual Markov kernel S->E. eta:S->R is measurable and satisfies0<eta(s)<=c with0<c<1/4. M and eta may depend on all state coordinates. Fix q>=2 and0<Delta<=1/2. Delta is the current recursive-call accuracy; no source accuracy, moment, reference-admissibility or history-validity premise is imposed on M or s0.
Define K(r)=(1+r)/(1/kappa+r), tau(s)=K(b) if K(b)>=2 and c otherwise, v(s)=(eta(s)+tau(s))/(1+b). Put L=q+log(K(b0)*d*q/Delta), B=(1/1024)/(sqrt(d*L)+L), J=ceil(8*log(exp(1)*K(b0)/B)), and eps=Delta/sqrt(J+1). These parameters remain fixed after choosing s0. The numerical8 and1/1024 are local sufficient constants, not quoted source constants.
For z=(x,zeta), obs(s,z)=x+sqrt(tau(s)/(1+b))*zeta, bplus=b+toNNReal(1/v(s)) and uplus=bplus^(-1)*(b*u+v(s)^(-1)*obs). Define F(s,z)(w)=V(w)+bplus/2*norm(w-uplus)^2 and T(s,z)(w)=w-(1+bplus)^(-1)*grad F(s,z)(w). N(s,z) is the least n whose true gradient square at T^n(x) is at most(1/kappa+bplus)*d, with fallback zero if no index exists. update(s,z)=(bplus,uplus,T^N(x),k+1,prepend(obs,history)). The pre-noise sample x initializes this actual inner first hit.
For the terminal extension put bbar(s)=max(b,B^(-1)), A(s)=1/bbar(s), TF_s(w)=V(w)+bbar(s)/2*norm(w-u)^2, TT_s(w)=w-(1+bbar(s))^(-1)*grad TF_s(w). TN(s) is the least n with norm(grad TF_s(TT_s^n(xref)))^2<=d*bbar(s), with fallback zero. Set txp=TT^TN(xref), tg=grad V(txp), th=u-A*tg. This terminal threshold is distinct from the inner threshold.
Let nu be Lebesgue measure restricted to(0,1] product standardGaussian. The proposal tproposal_s is the law of th+sqrt(A)*Z. For p=(x,(t,Z)), put zeta=sqrt(A)*Z and w=inner((pi/2)*(cos(pi*t/2)*(x-th)-sin(pi*t/2)*zeta),tg-grad V(th+sin(pi*t/2)*(x-th)+cos(pi*t/2)*zeta)). tW_s(p)=min(1,max(-1,w)). Each attempt consists of a proposal, an independent Poisson(2) batch size, an independent infinite nu sequence and an independent acceptance uniform on[0,1]. It accepts iff that uniform is at most the product over i:Fin batchSize of(1+tW_s(proposal,aux_i))/2.
trho_s is the infinite independent attempt law. output_s is the proposal at the first accepting attempt, or zero if there is no success. queryCount is the sum of every batch size whose earlier attempts all failed, including the successful batch. The sampling-only charged count is1+queryCount. tpi_s is the Gaussian law u+sqrt(A)*Z exponentially tilted by -V. Kernel multiplication/powers use the actual full-state transition; Lt composed with P^n is the resulting output law.

Actual finite execution with source terminal precision

\[\varepsilon=\frac{\Delta}{\sqrt{J+1}},\quad P^J(s_0,D)=1,\quad (L_t\circ P^{J+m})(s_0)=(L_t\circ P^J)(s_0).\]

Read the formalized proofs

Each statement and proof below has its own closed Lean disclosure. ASTIS parents, Mathlib calls and external mathematical sources are distinguished in each proof.

ASTIS mathematical exposition

Actual enhanced-state termination and terminal FORS execution

AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.EnhancedTerminalExecution.enhanced_terminal_execution · theorem · Teaching coverage

Statement

\[\varepsilon=\frac{\Delta}{\sqrt{J+1}},\quad P^J(s_0,D)=1,\quad (L_t\circ P^{J+m})(s_0)=(L_t\circ P^J)(s_0).\]

All objects and hypotheses

E is a finite-dimensional real inner-product Borel space with positive dimension d. V:E->R is fixed and C2, with genuine Hessian between kappa^(-1)*norm(w)^2 and norm(w)^2, where kappa is a nonnegative real with kappa>=1. The baseline smoothness is one.
The full state space is S=NNReal x E x E x Nat x (Nat->E), with s=(b,u,xref,k,history). Fix any initial state s0. M is an actual Markov kernel S->E. eta:S->R is measurable and satisfies0<eta(s)<=c with0<c<1/4. M and eta may depend on all state coordinates. Fix q>=2 and0<Delta<=1/2. Delta is the current recursive-call accuracy; no source accuracy, moment, reference-admissibility or history-validity premise is imposed on M or s0.
Define K(r)=(1+r)/(1/kappa+r), tau(s)=K(b) if K(b)>=2 and c otherwise, v(s)=(eta(s)+tau(s))/(1+b). Put L=q+log(K(b0)*d*q/Delta), B=(1/1024)/(sqrt(d*L)+L), J=ceil(8*log(exp(1)*K(b0)/B)), and eps=Delta/sqrt(J+1). These parameters remain fixed after choosing s0. The numerical8 and1/1024 are local sufficient constants, not quoted source constants.
For z=(x,zeta), obs(s,z)=x+sqrt(tau(s)/(1+b))*zeta, bplus=b+toNNReal(1/v(s)) and uplus=bplus^(-1)*(b*u+v(s)^(-1)*obs). Define F(s,z)(w)=V(w)+bplus/2*norm(w-uplus)^2 and T(s,z)(w)=w-(1+bplus)^(-1)*grad F(s,z)(w). N(s,z) is the least n whose true gradient square at T^n(x) is at most(1/kappa+bplus)*d, with fallback zero if no index exists. update(s,z)=(bplus,uplus,T^N(x),k+1,prepend(obs,history)). The pre-noise sample x initializes this actual inner first hit.
For the terminal extension put bbar(s)=max(b,B^(-1)), A(s)=1/bbar(s), TF_s(w)=V(w)+bbar(s)/2*norm(w-u)^2, TT_s(w)=w-(1+bbar(s))^(-1)*grad TF_s(w). TN(s) is the least n with norm(grad TF_s(TT_s^n(xref)))^2<=d*bbar(s), with fallback zero. Set txp=TT^TN(xref), tg=grad V(txp), th=u-A*tg. This terminal threshold is distinct from the inner threshold.
Let nu be Lebesgue measure restricted to(0,1] product standardGaussian. The proposal tproposal_s is the law of th+sqrt(A)*Z. For p=(x,(t,Z)), put zeta=sqrt(A)*Z and w=inner((pi/2)*(cos(pi*t/2)*(x-th)-sin(pi*t/2)*zeta),tg-grad V(th+sin(pi*t/2)*(x-th)+cos(pi*t/2)*zeta)). tW_s(p)=min(1,max(-1,w)). Each attempt consists of a proposal, an independent Poisson(2) batch size, an independent infinite nu sequence and an independent acceptance uniform on[0,1]. It accepts iff that uniform is at most the product over i:Fin batchSize of(1+tW_s(proposal,aux_i))/2.
trho_s is the infinite independent attempt law. output_s is the proposal at the first accepting attempt, or zero if there is no success. queryCount is the sum of every batch size whose earlier attempts all failed, including the successful batch. The sampling-only charged count is1+queryCount. tpi_s is the Gaussian law u+sqrt(A)*Z exponentially tilted by -V. Kernel multiplication/powers use the actual full-state transition; Lt composed with P^n is the resulting output law.

Mathematical proof

1. Fix the source terminal precision

With L>=2, the depth bound at C=8 and gamma=1/1024 gives J<=64L because log1024<=10. Thus J+1<=65L. Monotonicity of log, log65<=7 and log L<=L-1 imply log(J+1)<=4L. Since K(b0)*d*q>=1, q+log(1/Delta)<=L. Therefore H=q+log(1/eps)<=3L for the actual eps=Delta/sqrt(J+1). Positivity and eps<=1/2 follow from sqrt(J+1)>=1.

\[H=q+\log(1/\varepsilon)\le L+\tfrac12\log(J+1)\le3L.\]

Corresponding Lean step

Precision.compatible: hs0,hs1,heps0,heps1,hlog1024,hj64,hj65,hjlog,hbase,hH,hH3

2. Derive the sufficient terminal threshold

The bound H<=3L yields sqrt(dH)<=3sqrt(dL), a sufficient loose bound. Hence64(sqrt(dH)+H)<=192(sqrt(dL)+L)<=1024(sqrt(dL)+L)=1/B. Actual LogarithmicDepth supplies L>=2 and the depth upper bound; compatibility is proved rather than assumed. Its constant eta=c invocation obtains scalar bounds only, while stopping of the actual state-dependent schedule is proved separately below.

\[64(\sqrt{dH}+H)\le1024(\sqrt{dL}+L)=B^{-1}.\]

Corresponding Lean step

Precision.compatible: hs; Actual.execution: hdepth,hK0,hdc,hprec,hthreshold

3. Construct the real reference-carrying transition

The piecewise tau is measurable and positive. Apply ReferenceCarryingKernel with alpha=1/kappa,beta=1 and threshold1/B. Its actual inner first hit starts at the pre-noise sample, updates the precision and center using the noisy observation, and retains the new reference,count and history. The update is jointly measurable; its sampling law is M_s times fresh Gaussian. The new precision is b+1/v; no projected-state Markov claim is used.

\[P_s=\begin{cases}\delta_s,&s\in D,\\(\mathrm{update}_s)_\#(M_s\otimes\gamma_E),&s\notin D.\end{cases}\]

Corresponding Lean step

Actual.firstIndex; Actual.execution: htm,ht0,href,hum,hPs,Q,hstep

4. Compare each absorbed path with its scalar schedule

For an arbitrary observation sequence define the full absorbed path x_n. Choose the scalar schedule eta_n=eta(x_n); it obeys the same bounds even though it depends on the retained reference/history. Induction shows that either x_n is already terminal or its precision equals the unabsorbed scalar recurrence r_n. Once terminal, the path stays fixed. Applying LogarithmicDepth to this particular schedule forces terminal membership at J.

\[x_n\in D\quad\text{or}\quad b(x_n)=r_n;\qquad x_J\in D.\]

Corresponding Lean step

Paths.termination: statePath,statePath_shift,absorbed_precision_path,pathwise_log_depth

5. Turn pathwise termination into actual probability-one support

Represent the absorbing kernel as the pushforward of Q_s=M_s times Gaussian by the absorbed update G_s. Induct on the remaining path length: the endpoint lies inD for every continuation, so the inner kernel probability is one at each first observation. Kernel composition and the pushforward nonnegative-integral formula integrate this constant one. This proves the endpoint mass without inventing a trajectory measure.

\[(P^J)(s_0,D)=\int 1\,dQ_{s_0}=1.\]

Corresponding Lean step

Paths.termination: path_endpoint_mass,hPmap,hmass; Actual.execution: hQ,hpath,hPf

6. Prove stability under extra finite caps

For s inD, P_s is dirac(s), so induction gives (Lt composed with P^n)(s)=Lt(s). The probability-one terminal support means the state after J belongs toD almost everywhere. Split P^(J+m) into powers, use associativity and bind congruence, and replace the remaining output law on this full-measure set. This works for each Markov Lt; the final theorem instantiates the actual one constructed below.

\[(L_t\circ P^{J+m})(s_0)=\int_D L_t(s)\,P^J(s_0,ds)=(L_t\circ P^J)(s_0).\]

Corresponding Lean step

Paths.termination: finite_output_stability,hstop,hp; Actual.execution

7. Extend terminal parameters measurably and construct the terminal reference

bbar=max(b,1/B) is measurable and positive and meets the derived terminal64 condition everywhere. OnD it equals b, so all terminal parameters agree with the genuine ones there. Apply TerminalFORSKernel to bbar, the actual center and retained reference. It proves measurable TN/txp, least terminal threshold attainment and the center residual; no terminal reference is supplied freely.

\[\bar b_s=\max(b_s,B^{-1}),\quad s\in D\Rightarrow\bar b_s=b_s,\quad\|t h_s-t x_{p,s}\|\le\sqrt{d/\bar b_s}.\]

Corresponding Lean step

firstIndex; terminal_extension: hbb,hbb0,hbstep,ht,hn,hx,hres

8. Use the actual same terminal retry program

The scaled cached arc estimator, Poisson attempts and first-success output are the concrete definitions used by TerminalFORSKernel. Its kernel Lt has exactly that output pushforward and zero never-success probability. The count includes every attempted full batch, including the successful batch, and one cached gradient charge. The bound1+2exp2 excludes terminal GD and all earlier stage work.

\[(\mathrm{output}_s)_\#\rho_s=L_t(s),\quad\rho_s(\text{never success})=0,\quad\int^-(1+C_s)d\rho_s\le1+2e^2.\]

Corresponding Lean step

scaledCached; Attempt; attemptLaw; accepted; output; queryCount; terminal_extension: hprog

9. Retain both denominator laws in terminal accuracy

For each state, the same terminal theorem makes tpi a probability and gives mutual absolute continuity. The q-power of d tpi/d Lt is integrated under Lt; the reverse derivative is integrated under tpi. Both integrals are finite,positive,at most1+eps^2, with normalized log bounds eps^2. OnD these are the actual terminal targets. No mixture or recursive accuracy conclusion follows merely from these fiber bounds.

\[0<\int(d\pi_s/dL_t(s))^q\,dL_t(s)\le1+\varepsilon^2\quad\text{and reverse}.\]

Corresponding Lean step

terminal_extension: hpi,hab,hba,hI1,hI2,hp1,hp2,hu1,hu2,hlog1,hlog2

10. Close the concrete execution consumer

First derive the terminal parameter certificate, construct Lt at precisely those parameters, then instantiate the actual enhanced-state execution with this Lt. The resulting P uses the original M and retained-state update; its support and cap-stability conclusions concern the same constructed terminal program. Initial admissibility, M approximation guarantees, final mixed-output accuracy and cumulative query costs remain separate proof obligations.

\[\nu_{\rm out}=(L_t\circ P^J)(s_0),\qquad\varepsilon^2=\Delta^2/(J+1).\]

Corresponding Lean step

enhanced_terminal_execution: hfirst,hbound,ht,hactual,hacc

Lean statement · enhanced_terminal_execution

Actual retained-state transition, derived terminal parameters, probability-one terminal support and constructed FORS output law with fiber guarantees.

theorem enhanced_terminal_execution {V : E → ℝ} (κ : ℝ≥0) (hκ : 1 ≤ κ)
    (hV : ContDiff ℝ 2 V)
    (hH : ∀ x w : E, (κ:ℝ)⁻¹*‖w‖^2 ≤ fderiv ℝ (fderiv ℝ V) x w w ∧
      fderiv ℝ (fderiv ℝ V) x w w ≤ ‖w‖^2)
    (hd : 0 < Module.finrank ℝ E)
    (η : S → ℝ) (hηm : Measurable η) (c q Δ : ℝ)
    (hc : 0 < c) (hc1 : c < 1/4) (hη : ∀ s, 0 < η s ∧ η s ≤ c)
    (hq : 2 ≤ q) (hΔ : 0 < Δ) (hΔ1 : Δ ≤ 1/2)
    (s0 : S) (M : Kernel S E) [IsMarkovKernel M] :
    let d : ℝ := Module.finrank ℝ E
    let K := fun r : ℝ => (1+r)/((κ:ℝ)⁻¹+r)
    let τ := fun s : S => if 2 ≤ K s.1 then K s.1 else c
    let L := q+Real.log (K s0.1*d*q/Δ)
    let B := (1/1024)/(Real.sqrt (d*L)+L)
    let J := Nat.ceil (8*Real.log (Real.exp 1*K s0.1/B))
    let eps := Δ/Real.sqrt ((J:ℝ)+1)
    let v := fun s : S => (η s+τ s)/(1+s.1)
    let bp := fun s : S => s.1+Real.toNNReal (v s)⁻¹
    let obs := fun p : S × (E × E) => p.2.1+Real.sqrt (τ p.1/(1+p.1.1)) • p.2.2
    let center := fun p : S × (E × E) => (bp p.1:ℝ)⁻¹ •
      ((p.1.1:ℝ) • p.1.2.1+(v p.1)⁻¹ • obs p)
    let F := fun p x => V x+(bp p.1:ℝ)/2*‖x-center p‖^2
    let T := fun p x => x-(1+(bp p.1:ℝ))⁻¹ • gradient (F p) x
    let Qn := fun n p => ‖gradient (F p) ((T p)^[n] p.2.1)‖^2
    let N := firstIndex Qn (fun p => ((κ:ℝ)⁻¹+bp p.1)*d)
    let update := fun p : S × (E × E) =>
      (bp p.1,center p,(T p)^[N p] p.2.1,p.1.2.2.2.1+1,
        fun n => Nat.casesOn n (obs p) p.1.2.2.2.2)
    let bb := fun s : S => max (s.1:ℝ) B⁻¹
    let TF := fun s x => V x+bb s/2*‖x-s.2.1‖^2
    let TT := fun s x => x-(1+bb s)⁻¹ • gradient (TF s) x
    let TQn := fun n s => ‖gradient (TF s) ((TT s)^[n] (s.2.2.1))‖^2
    let TN := firstIndex TQn (fun s => d*bb s)
    let txp := fun s => (TT s)^[TN s] (s.2.2.1)
    let TA := fun s => (bb s)⁻¹
    let tg := fun s => gradient V (txp s)
    let th := fun s => s.2.1-TA s • tg s
    let tnu := (volume.restrict (Ioc (0 : ℝ) 1)).prod (stdGaussian E)
    let tW := fun s (p : E × (ℝ × E)) => min 1 (max (-1) (scaledCached V TA th tg ((s,p.1),p.2)))
    let tproposal := fun s => (stdGaussian E).map (fun z => th s+Real.sqrt (TA s) • z)
    let trho := fun s => Measure.infinitePi (fun _ : ℕ => attemptLaw (tproposal s) tnu 1 (by norm_num))
    let tpi := fun s => ((stdGaussian E).map (fun z => s.2.1+Real.sqrt (TA s) • z)).tilted (fun x => -V x)
    0 < B ∧ 0 < eps ∧ eps ≤ 1/2 ∧
    (∀ s : S, B⁻¹ ≤ (s.1:ℝ) → bb s=(s.1:ℝ)) ∧
    Measurable TN ∧ Measurable txp ∧
    (∀ s, TQn (TN s) s ≤ d*bb s ∧ (∀ j < TN s, d*bb s < TQn j s) ∧
      ‖th s-txp s‖ ≤ Real.sqrt (d*TA s)) ∧
    ∃ (Lt : Kernel S E) (P : Kernel S S), IsMarkovKernel Lt ∧ IsMarkovKernel P ∧
      (∀ s, P s=if B⁻¹ ≤ (s.1:ℝ) then Measure.dirac s else
        ((M s).prod (stdGaussian E)).map (fun z => update (s,z))) ∧
      (P^J) s0 {s | B⁻¹ ≤ (s.1:ℝ)}=1 ∧
      (∀ m, (Lt ∘ₖ (P^(J+m))) s0=(Lt ∘ₖ (P^J)) s0) ∧
      ∀ s,
      (Measurable (output (tW s) 1 0) ∧ (trho s).map (output (tW s) 1 0)=Lt s ∧
        trho s {ω | ∀ n, ω n ∉ accepted (tW s) 1}=0 ∧
        (∫⁻ ω, 1+queryCount (tW s) 1 ω ∂trho s) ≤ ENNReal.ofReal (1+2*Real.exp 2)) ∧
      IsProbabilityMeasure (tpi s) ∧ tpi s ≪ Lt s ∧ Lt s ≪ tpi s ∧
      Integrable (fun x => ((tpi s).rnDeriv (Lt s) x).toReal^q) (Lt s) ∧
      Integrable (fun x => ((Lt s).rnDeriv (tpi s) x).toReal^q) (tpi s) ∧
      0 < (∫ x, ((tpi s).rnDeriv (Lt s) x).toReal^q ∂Lt s) ∧
      0 < (∫ x, ((Lt s).rnDeriv (tpi s) x).toReal^q ∂tpi s) ∧
      (∫ x, ((tpi s).rnDeriv (Lt s) x).toReal^q ∂Lt s) ≤ 1+eps^2 ∧
      (∫ x, ((Lt s).rnDeriv (tpi s) x).toReal^q ∂tpi s) ≤ 1+eps^2 ∧
      Real.log (∫ x, ((tpi s).rnDeriv (Lt s) x).toReal^q ∂Lt s)/(q-1) ≤ eps^2 ∧
      Real.log (∫ x, ((Lt s).rnDeriv (tpi s) x).toReal^q ∂tpi s)/(q-1) ≤ eps^2

Exact module and namespace context

Lean proof · enhanced_terminal_execution

Source precision bound, full-state absorbed path comparison, kernel support induction, actual terminal construction and finite cap stability.

theorem enhanced_terminal_execution {V : E → ℝ} (κ : ℝ≥0) (hκ : 1 ≤ κ)
    (hV : ContDiff ℝ 2 V)
    (hH : ∀ x w : E, (κ:ℝ)⁻¹*‖w‖^2 ≤ fderiv ℝ (fderiv ℝ V) x w w ∧
      fderiv ℝ (fderiv ℝ V) x w w ≤ ‖w‖^2)
    (hd : 0 < Module.finrank ℝ E)
    (η : S → ℝ) (hηm : Measurable η) (c q Δ : ℝ)
    (hc : 0 < c) (hc1 : c < 1/4) (hη : ∀ s, 0 < η s ∧ η s ≤ c)
    (hq : 2 ≤ q) (hΔ : 0 < Δ) (hΔ1 : Δ ≤ 1/2)
    (s0 : S) (M : Kernel S E) [IsMarkovKernel M] :
    let d : ℝ := Module.finrank ℝ E
    let K := fun r : ℝ => (1+r)/((κ:ℝ)⁻¹+r)
    let τ := fun s : S => if 2 ≤ K s.1 then K s.1 else c
    let L := q+Real.log (K s0.1*d*q/Δ)
    let B := (1/1024)/(Real.sqrt (d*L)+L)
    let J := Nat.ceil (8*Real.log (Real.exp 1*K s0.1/B))
    let eps := Δ/Real.sqrt ((J:ℝ)+1)
    let v := fun s : S => (η s+τ s)/(1+s.1)
    let bp := fun s : S => s.1+Real.toNNReal (v s)⁻¹
    let obs := fun p : S × (E × E) => p.2.1+Real.sqrt (τ p.1/(1+p.1.1)) • p.2.2
    let center := fun p : S × (E × E) => (bp p.1:ℝ)⁻¹ •
      ((p.1.1:ℝ) • p.1.2.1+(v p.1)⁻¹ • obs p)
    let F := fun p x => V x+(bp p.1:ℝ)/2*‖x-center p‖^2
    let T := fun p x => x-(1+(bp p.1:ℝ))⁻¹ • gradient (F p) x
    let Qn := fun n p => ‖gradient (F p) ((T p)^[n] p.2.1)‖^2
    let N := firstIndex Qn (fun p => ((κ:ℝ)⁻¹+bp p.1)*d)
    let update := fun p : S × (E × E) =>
      (bp p.1,center p,(T p)^[N p] p.2.1,p.1.2.2.2.1+1,
        fun n => Nat.casesOn n (obs p) p.1.2.2.2.2)
    let bb := fun s : S => max (s.1:ℝ) B⁻¹
    let TF := fun s x => V x+bb s/2*‖x-s.2.1‖^2
    let TT := fun s x => x-(1+bb s)⁻¹ • gradient (TF s) x
    let TQn := fun n s => ‖gradient (TF s) ((TT s)^[n] (s.2.2.1))‖^2
    let TN := firstIndex TQn (fun s => d*bb s)
    let txp := fun s => (TT s)^[TN s] (s.2.2.1)
    let TA := fun s => (bb s)⁻¹
    let tg := fun s => gradient V (txp s)
    let th := fun s => s.2.1-TA s • tg s
    let tnu := (volume.restrict (Ioc (0 : ℝ) 1)).prod (stdGaussian E)
    let tW := fun s (p : E × (ℝ × E)) => min 1 (max (-1) (scaledCached V TA th tg ((s,p.1),p.2)))
    let tproposal := fun s => (stdGaussian E).map (fun z => th s+Real.sqrt (TA s) • z)
    let trho := fun s => Measure.infinitePi (fun _ : ℕ => attemptLaw (tproposal s) tnu 1 (by norm_num))
    let tpi := fun s => ((stdGaussian E).map (fun z => s.2.1+Real.sqrt (TA s) • z)).tilted (fun x => -V x)
    0 < B ∧ 0 < eps ∧ eps ≤ 1/2 ∧
    (∀ s : S, B⁻¹ ≤ (s.1:ℝ) → bb s=(s.1:ℝ)) ∧
    Measurable TN ∧ Measurable txp ∧
    (∀ s, TQn (TN s) s ≤ d*bb s ∧ (∀ j < TN s, d*bb s < TQn j s) ∧
      ‖th s-txp s‖ ≤ Real.sqrt (d*TA s)) ∧
    ∃ (Lt : Kernel S E) (P : Kernel S S), IsMarkovKernel Lt ∧ IsMarkovKernel P ∧
      (∀ s, P s=if B⁻¹ ≤ (s.1:ℝ) then Measure.dirac s else
        ((M s).prod (stdGaussian E)).map (fun z => update (s,z))) ∧
      (P^J) s0 {s | B⁻¹ ≤ (s.1:ℝ)}=1 ∧
      (∀ m, (Lt ∘ₖ (P^(J+m))) s0=(Lt ∘ₖ (P^J)) s0) ∧
      ∀ s,
      (Measurable (output (tW s) 1 0) ∧ (trho s).map (output (tW s) 1 0)=Lt s ∧
        trho s {ω | ∀ n, ω n ∉ accepted (tW s) 1}=0 ∧
        (∫⁻ ω, 1+queryCount (tW s) 1 ω ∂trho s) ≤ ENNReal.ofReal (1+2*Real.exp 2)) ∧
      IsProbabilityMeasure (tpi s) ∧ tpi s ≪ Lt s ∧ Lt s ≪ tpi s ∧
      Integrable (fun x => ((tpi s).rnDeriv (Lt s) x).toReal^q) (Lt s) ∧
      Integrable (fun x => ((Lt s).rnDeriv (tpi s) x).toReal^q) (tpi s) ∧
      0 < (∫ x, ((tpi s).rnDeriv (Lt s) x).toReal^q ∂Lt s) ∧
      0 < (∫ x, ((Lt s).rnDeriv (tpi s) x).toReal^q ∂tpi s) ∧
      (∫ x, ((tpi s).rnDeriv (Lt s) x).toReal^q ∂Lt s) ≤ 1+eps^2 ∧
      (∫ x, ((Lt s).rnDeriv (tpi s) x).toReal^q ∂tpi s) ≤ 1+eps^2 ∧
      Real.log (∫ x, ((tpi s).rnDeriv (Lt s) x).toReal^q ∂Lt s)/(q-1) ≤ eps^2 ∧
      Real.log (∫ x, ((Lt s).rnDeriv (tpi s) x).toReal^q ∂tpi s)/(q-1) ≤ eps^2 := by
  classical
  intro d K τ L B J eps v bp obs center F T Qn N update bb TF TT TQn TN txp TA tg th tnu tW tproposal trho tpi
  let L0 : Kernel S E := Kernel.const _ (stdGaussian E)
  have hL0 : IsMarkovKernel L0 := by dsimp [L0]; infer_instance
  have hfirst := AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.EnhancedTerminalExecution.Actual.execution κ hκ hV hH hd η hηm c q Δ hc hc1 hη hq hΔ hΔ1 s0 M L0
  obtain ⟨hB,heps,heps1,hstep,_⟩ := hfirst
  have hκ0 : (0:ℝ≥0) < κ := lt_of_lt_of_le (by norm_num) hκ
  have hαβ : κ⁻¹ ≤ (1:ℝ≥0) := (inv_le_one₀ hκ0).2 hκ
  have hHm : ∀ x w : E, ((κ⁻¹:ℝ≥0):ℝ)*‖w‖^2 ≤ fderiv ℝ (fderiv ℝ V) x w w ∧
      fderiv ℝ (fderiv ℝ V) x w w ≤ ((1:ℝ≥0):ℝ)*‖w‖^2 := by simpa using hH
  have hbound : 64*((1:ℝ≥0):ℝ)*(Real.sqrt (d*(q+Real.log (1/eps)))+(q+Real.log (1/eps))) ≤ B⁻¹ := by
    simpa only [NNReal.coe_one,mul_one] using hstep
  have ht := terminal_extension hV hHm hαβ (by norm_num)
    (show 0 < (Module.finrank ℝ E:ℝ) by exact_mod_cast hd)
    (fun s : S => (s.1:ℝ)) (fun s : S => s.2.1) (fun s : S => s.2.2.1)
    (by fun_prop) (by fun_prop) (by fun_prop) B⁻¹ q eps (inv_pos.2 hB) hq heps heps1 hbound
  obtain ⟨heq,hn,hx,hres,Lt,hLt,hacc⟩ := ht
  let := hLt
  have hactual := AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.EnhancedTerminalExecution.Actual.execution κ hκ hV hH hd η hηm c q Δ hc hc1 hη hq hΔ hΔ1 s0 M Lt
  obtain ⟨_,_,_,_,P,hP,hPs,hmass,hstable⟩ := hactual
  exact ⟨hB,heps,heps1,heq,hn,hx,hres,Lt,P,hLt,hP,hPs,hmass,hstable,hacc⟩
end AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.EnhancedTerminalExecution

Exact module and namespace context

Source assumptions versus formal assumptions

Source	Actual Lean	Difference kind	Why it matters
Source uses normalized smooth strongly convex Euclidean potentials.	Coordinate-free positive finite dimension, C2 and genuine Hessian bounds1/kappa and1.	API-limitation	The differential API requires stronger regularity; normalization is retained.
Source fixed small threshold and large depth constants.	C=8,gamma=1/1024 and terminal64 compatibility are explicitly proved sufficient.	source-implicit	These numbers are not source quotations.
Section6.3 uses ell=q and terminal Delta/sqrt(J+1).	Exactly these parameters, with q>=2 and0<Delta<=1/2.	same	Delta is the current recursive-call precision; A1 instantiatesq=2.
Source M implements a particular smoothed sampler with approximation guarantees.	M is any actual full-state Markov kernel.	API-limitation	Execution and termination need no accuracy; source approximation and mixed-output accuracy are not concluded.
Source execution carries an admissible reference and produced history.	Arbitrary initial reference,count and history; actual first-hit updates are retained.	generalization	No initial admissibility or prehistory-origin claim, and hence no borrowed source cost/accuracy.
Terminal sampler is called only inside the terminal domain.	Measurable extension bbar=max(b,1/B), equal to b onD; P^J has full mass inD.	source-implicit	Outside-domain target and initialization differ; no arbitrary-extension comparison theorem is returned.
Source describes recursive execution.	Actual full-state kernel powers and stability for all finite caps afterJ.	source-implicit	No projected autonomous Markov assumption, separate R_n recursive interface or trajectory measure is returned.
Source main results provide accuracy and query complexity.	Terminal fiber RN and sampling-only expected count; no whole-output accuracy or cumulative costs.	API-limitation	GD initialization, stage totals, high-probability cost and global integrability remain open; TV does not transfer unbounded cost.

Actual full-state kernel-power execution and terminal fiber guarantees, not Theorem6.5 or either complete paper. C2 genuine Hessian bounds strengthen source regularity; baseline beta=1,positive dimension,kappa>=1. Source ell=q and eps=Delta/sqrt(J+1) are used; A1 requiresq=2. Local8,1/1024 and terminal64 are sufficient constants. M is an arbitrary actual Markov kernel with no accuracy/moment guarantee; initial reference,count,history are arbitrary. bbar=max(b,1/B) changes outside-domain target/initialization and equals b only onD; no comparison theorem for arbitrary extensions is returned. The theorem gives kernel powers and cap stability, not a separate recursive R_n interface or trajectory measure. Terminal RN/cost are fiberwise, not final mixed-output accuracy or whole-execution cost. Sampling count excludes GD initialization, stage queries and cache discounts; no source high-probability count, global cost integrability or TV cost transfer.

Encoder–denoiser: accepted · domain-mismatch

Detected semantic differences

assumptions: C2/Hessian regularity and coordinate-domain difference disclosed. — Independent formal reviewer accepted: C2/Hessian regularity and coordinate-domain difference disclosed.
constant_dependencies: Numericalconstants are proved sufficient,not sourcequoted. — Independent formal reviewer accepted: Numericalconstants are proved sufficient,not sourcequoted.
constant_dependencies: Source terminalorder and epsilon match exactly. — Independent formal reviewer accepted: Source terminalorder and epsilon match exactly.
assumptions: ArbitraryactualM supports execution only,no sourceaccuracy borrowed. — Independent formal reviewer accepted: ArbitraryactualM supports execution only,no sourceaccuracy borrowed.
domains: Arbitrary initialreference/count/history carries no sourceguarantee. — Independent formal reviewer accepted: Arbitrary initialreference/count/history carries no sourceguarantee.
domains: Maxextension restoresactualparams onlyonD;outside target differs. — Independent formal reviewer accepted: Maxextension restoresactualparams onlyonD;outside target differs.
scopes: Kernelpowers not projectedMarkovness,independentrecursiveinterface or trajectorytheorem. — Independent formal reviewer accepted: Kernelpowers not projectedMarkovness,independentrecursiveinterface or trajectorytheorem.
conclusion: Terminalfiberaccuracy/samplingcost not globalerror/totalcost. — Independent formal reviewer accepted: Terminalfiberaccuracy/samplingcost not globalerror/totalcost.

A generalization is not a source correction. Proposed missing conditions require separate independent repair review. No proposed repair silently changes the original theorem.

Scope and omitted-condition boundaries

Actual full-state kernel-power execution and terminal fiber guarantees, not Theorem6.5 or either complete paper. C2 genuine Hessian bounds strengthen source regularity; baseline beta=1,positive dimension,kappa>=1. Source ell=q and eps=Delta/sqrt(J+1) are used; A1 requiresq=2. Local8,1/1024 and terminal64 are sufficient constants. M is an arbitrary actual Markov kernel with no accuracy/moment guarantee; initial reference,count,history are arbitrary. bbar=max(b,1/B) changes outside-domain target/initialization and equals b only onD; no comparison theorem for arbitrary extensions is returned. The theorem gives kernel powers and cap stability, not a separate recursive R_n interface or trajectory measure. Terminal RN/cost are fiberwise, not final mixed-output accuracy or whole-execution cost. Sampling count excludes GD initialization, stage queries and cache discounts; no source high-probability count, global cost integrability or TV cost transfer.

Source and reuse

ASTIS parents called

Mathlib API called (external library)

Real.log_le_log
Real.log_pow
Real.sqrt_le_sqrt
ProbabilityTheory.Kernel.comp_apply
MeasureTheory.lintegral_map
MeasureTheory.Measure.bind_congr_right
MeasureTheory.mem_ae_iff_prob_eq_one

Mathematical sources

SPHMC Algorithm3.3 and Section6.3 — Actual full-state kernel-power execution and terminal fiber guarantees, not Theorem6.5 or either complete paper. C2 genuine Hessian bounds strengthen source regularity; baseline beta=1,positive dimension,kappa>=1. Source ell=q and eps=Delta/sqrt(J+1) are used; A1 requiresq=2. Local8,1/1024 and terminal64 are sufficient constants. M is an arbitrary actual Markov kernel with no accuracy/moment guarantee; initial reference,count,history are arbitrary. bbar=max(b,1/B) changes outside-domain target/initialization and equals b only onD; no comparison theorem for arbitrary extensions is returned. The theorem gives kernel powers and cap stability, not a separate recursive R_n interface or trajectory measure. Terminal RN/cost are fiberwise, not final mixed-output accuracy or whole-execution cost. Sampling count excludes GD initialization, stage queries and cache discounts; no source high-probability count, global cost integrability or TV cost transfer.

ASTIS prose is not a quotation or a source-equivalence certificate. Definitions and aliases are explained as constructions, not counted as new mathematical proofs.

Which proof edges are actually covered?

Local proof component; source adapter/review separate Actual enhanced-state termination and terminal FORS execution

Actual finite recursive RGO KL error accumulation

Fan Chen, Sinho Chewi, Jianfeng Lu and Matthew S. Zhang; ASTIS expanded actual finite recursive error semantics, no author endorsement implied.

arXiv:2609.06906v1 · Theorem6.5 A1 finite recursive error transfer and equation(6.5) · faithful paraphrase

Complete source statement (ASTIS restatement)

Let E be a finite-dimensional real inner-product space with its Borel measurable structure, and mu any probability measure. States are s=(b,u,k,h) in NNReal times E times Nat times E^Nat. Let a(s)>0 be measurable and theta a fixed nonnegative precision threshold. Define F(s,y) by b_new=b+1/a(s), u_new=(b*u+y/a(s))/(b+1/a(s)), count k+1 and history with y prepended. There exist Markov kernels T,H, constructed before all actual kernels, with T(s) the normalized tilt of mu by -b*norm(x-u)^2/2 and H(s) its Gaussian smoothing with standard deviation sqrt(a(s)). For every Markov observation kernel Q and terminal kernel L there exist Markov P and R_n: P(s)=dirac s if theta<=b and otherwise the pushforward of Q(s) under F(s,.); R_0=L; R_(n+1)(s)=L(s) if stopped and otherwise the bind of Q(s) with y mapped to R_n(F(s,y)). Define e(s)=0 if stopped and KL(Q(s)||H(s)) otherwise, and t(s)=KL(L(s)||T(s)). Both e and t are measurable. For every n and initial s, KL(R_n(s)||T(s)) is at most the sum over j<n of the integral of e under P^j(s), plus the integral of t under P^n(s).

E is finite-dimensional over the reals with its Borel measurable structure; zero dimension is permitted. mu is a probability measure.
a is measurable and strictly positive at every state. theta is fixed and nonnegative. Initial precision can be zero or already stopped.
Q and L are measurable Markov kernels on the complete precision-center-count-history state. No probability density or moment assumption is added.
T,H are constructed before arbitrary Q,L. F, P and all R_n have their displayed actual program semantics.
No finite KL, absolute continuity, assumed error measurability, common observation-error budget or terminal-error bound is a premise.

Actual finite recursive KL budget

\[\operatorname{KL}(R_n(s)\Vert T(s))\le\sum_{j=0}^{n-1}\int e(x)\,P^j(s)(dx)+\int t(x)\,P^n(s)(dx).\]

Read the formalized proofs

Each statement and proof below has its own closed Lean disclosure. ASTIS parents, Mathlib calls and external mathematical sources are distinguished in each proof.

ASTIS mathematical exposition

Actual finite recursive RGO KL error accumulation

AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.FiniteRGOKLError.finite_rgo_kl_error · theorem · Teaching coverage

Statement

\[\operatorname{KL}(R_n(s)\Vert T(s))\le\sum_{j=0}^{n-1}\int e(x)\,P^j(s)(dx)+\int t(x)\,P^n(s)(dx).\]

All objects and hypotheses

E is finite-dimensional over the reals with its Borel measurable structure; zero dimension is permitted. mu is a probability measure.
a is measurable and strictly positive at every state. theta is fixed and nonnegative. Initial precision can be zero or already stopped.
Q and L are measurable Markov kernels on the complete precision-center-count-history state. No probability density or moment assumption is added.
T,H are constructed before arbitrary Q,L. F, P and all R_n have their displayed actual program semantics.
No finite KL, absolute continuity, assumed error measurability, common observation-error budget or terminal-error bound is a premise.

Mathematical proof

1. Prove measurable fiber KL, including singular fibers

Use the jointly measurable kernel Radon-Nikodym derivative and the nonnegative KL integrand z log z+1-z. Fiber KL equals its integral where absolute continuity holds and infinity elsewhere. The absolute-continuity set is measurable; kernel integration and a measurable case split establish fiber KL measurability without a finite-divergence premise.

\[s\mapsto\operatorname{KL}(L(s)\Vert K(s))\quad\text{is measurable}.\]

Corresponding Lean step

Local measurable_fiber_kl; Kernel.measurable_rnDeriv, Kernel.measurableSet_absolutelyContinuous, klDiv_eq_lintegral_klFun.

2. Derive the conditional KL identity in extended reals

If the two joint measures with common first marginal are absolutely continuous, identify the joint density with the fiber kernel density and use nonnegative Fubini integration. If they are not, the joint KL is infinite. Were the integral of fiber KL finite, fiber KL would be finite almost everywhere, hence the fiber laws absolutely continuous almost everywhere; this would imply joint absolute continuity, a contradiction.

\[\operatorname{KL}(\nu\otimes L\Vert\nu\otimes K)=\int\operatorname{KL}(L(x)\Vert K(x))\,\nu(dx).\]

Corresponding Lean step

Local conditional_kl_integral; compProd_withDensity, rnDeriv_withDensity, lintegral_compProd and AbsolutelyContinuous.compProd_right.

3. Obtain the one-step output comparison

Apply data processing to the output projection of the two joint laws. Then apply the KL chain rule and the conditional identity. The conditional output error is integrated against the first actual input law, not the ideal law. The calculation involves no subtraction and remains valid when either term is infinite.

\[\operatorname{KL}(L\nu\Vert K\xi)\le\operatorname{KL}(\nu\Vert\xi)+\int\operatorname{KL}(L(x)\Vert K(x))\,\nu(dx).\]

Corresponding Lean step

Local composed_kl_bound; klDiv_map_le, klDiv_compProd_eq_add and conditional_kl_integral.

4. Construct the actual program and derive ideal consistency

Invoke FiniteRGOProgram for the explicit update and threshold. Before choosing Q,L, also instantiate the same construction with Q=H,L=T. Its exact ideal recovery at depth one and its actual recursion show that binding H(s) with T(F(s,y)) equals T(s) on continuing states. This consistency is proved from the parent construction, not included as an assumption.

\[\int T(F(s,y))\,H(s)(dy)=T(s)\qquad(b(s)<\theta).\]

Corresponding Lean step

FiniteRGOProgram.finite_rgo_program; hprog H T, hRIrec 0, hRIideal and hRIzero; main hcons.

5. Establish the recurrence under the actual transition

On a continuing state, apply the one-step output comparison to Q(s), H(s) and the output kernels pulled back through F(s,.). Replace the ideal bind with T(s). Push the conditional error integral through F to express it under actual P(s). On a stopped state P(s) is a point mass and every R_n(s)=L(s), so the same inequality holds with e(s)=0 and the terminal error unchanged.

\[f_{n+1}(s)\le e(s)+\int f_n(x)\,P(s)(dx),\quad f_n(s)=\operatorname{KL}(R_n(s)\Vert T(s)).\]

Corresponding Lean step

Main stopped and continuing branches; Kernel.comap, actual hrec/hstop/hPf, hcons and lintegral_map.

6. Expand the recurrence into actual visited-law errors

Start with f_0=t. Induct on the finite cap, substitute the prior bound under P, and distribute the integral over the finite nonnegative sum. Kernel composition converts the nested j-step integral into the (j+1)-step actual law. Reindexing gives precisely the displayed sum plus the terminal residual. The zero-depth identity uses the point-mass kernel, so no terminal term is lost at n=0.

\[f_n(s)\le\sum_{j<n}(P^j e)(s)+(P^n t)(s).\]

Corresponding Lean step

Local kernel_error_sum; lintegral_mono, lintegral_finsetSum, Kernel.lintegral_comp, pow_succ and Finset.sum_range_succ'.

Lean statement · finite_rgo_kl_error

Actual finite recursive RGO KL is bounded by actual state-law observation errors and the terminal residual.

theorem finite_rgo_kl_error (μ : Measure E) [IsProbabilityMeasure μ]
    (a : PS → ℝ) (ha : Measurable a) (ha0 : ∀ s, 0 < a s) (threshold : ℝ≥0) :
    let F : PS × E → PS := fun p =>
      (⟨(p.1.1 : ℝ)+(a p.1)⁻¹, add_nonneg p.1.1.coe_nonneg (le_of_lt (inv_pos.mpr (ha0 p.1)))⟩,
       ((p.1.1 : ℝ)+(a p.1)⁻¹)⁻¹ • ((p.1.1 : ℝ) • p.1.2.1+(a p.1)⁻¹ • p.2),
       p.1.2.2.1+1, fun n => Nat.casesOn n p.2 p.1.2.2.2)
    ∃ (T H : Kernel PS E), IsMarkovKernel T ∧ IsMarkovKernel H ∧
      (∀ s, T s = μ.tilted (fun x => -((s.1 : ℝ)/2)*‖x-s.2.1‖^2)) ∧
      (∀ s, H s = GaussianSmoothing.gaussianSmoothing (T s) (Real.sqrt (a s))) ∧
      ∀ (Q L : Kernel PS E), IsMarkovKernel Q → IsMarkovKernel L →
      ∃ (P : Kernel PS PS) (R : ℕ → Kernel PS E), IsMarkovKernel P ∧
        (∀ n, IsMarkovKernel (R n)) ∧
        (∀ s, P s = if threshold ≤ s.1 then Measure.dirac s else (Q s).map (fun y => F (s,y))) ∧
        R 0 = L ∧
        (∀ n s, R (n+1) s = if threshold ≤ s.1 then L s else
          (Q s).bind (fun y => R n (F (s,y)))) ∧
        let e : PS → ℝ≥0∞ := fun s => if threshold ≤ s.1 then 0 else klDiv (Q s) (H s)
        let t : PS → ℝ≥0∞ := fun s => klDiv (L s) (T s)
        Measurable e ∧ Measurable t ∧
        ∀ n s, klDiv (R n s) (T s) ≤
          (∑ j ∈ Finset.range n, ∫⁻ x, e x ∂(P^j) s) + ∫⁻ x, t x ∂(P^n) s

Exact module and namespace context

Lean proof · finite_rgo_kl_error

Measurable fiber KL, extended-real conditional KL, output projection, derived ideal consistency and finite actual-kernel recurrence expansion.

theorem finite_rgo_kl_error (μ : Measure E) [IsProbabilityMeasure μ]
    (a : PS → ℝ) (ha : Measurable a) (ha0 : ∀ s, 0 < a s) (threshold : ℝ≥0) :
    let F : PS × E → PS := fun p =>
      (⟨(p.1.1 : ℝ)+(a p.1)⁻¹, add_nonneg p.1.1.coe_nonneg (le_of_lt (inv_pos.mpr (ha0 p.1)))⟩,
       ((p.1.1 : ℝ)+(a p.1)⁻¹)⁻¹ • ((p.1.1 : ℝ) • p.1.2.1+(a p.1)⁻¹ • p.2),
       p.1.2.2.1+1, fun n => Nat.casesOn n p.2 p.1.2.2.2)
    ∃ (T H : Kernel PS E), IsMarkovKernel T ∧ IsMarkovKernel H ∧
      (∀ s, T s = μ.tilted (fun x => -((s.1 : ℝ)/2)*‖x-s.2.1‖^2)) ∧
      (∀ s, H s = GaussianSmoothing.gaussianSmoothing (T s) (Real.sqrt (a s))) ∧
      ∀ (Q L : Kernel PS E), IsMarkovKernel Q → IsMarkovKernel L →
      ∃ (P : Kernel PS PS) (R : ℕ → Kernel PS E), IsMarkovKernel P ∧
        (∀ n, IsMarkovKernel (R n)) ∧
        (∀ s, P s = if threshold ≤ s.1 then Measure.dirac s else (Q s).map (fun y => F (s,y))) ∧
        R 0 = L ∧
        (∀ n s, R (n+1) s = if threshold ≤ s.1 then L s else
          (Q s).bind (fun y => R n (F (s,y)))) ∧
        let e : PS → ℝ≥0∞ := fun s => if threshold ≤ s.1 then 0 else klDiv (Q s) (H s)
        let t : PS → ℝ≥0∞ := fun s => klDiv (L s) (T s)
        Measurable e ∧ Measurable t ∧
        ∀ n s, klDiv (R n s) (T s) ≤
          (∑ j ∈ Finset.range n, ∫⁻ x, e x ∂(P^j) s) + ∫⁻ x, t x ∂(P^n) s := by
  classical
  have measurable_fiber_kl {A B : Type u} [MeasurableSpace A] [MeasurableSpace B] [MeasurableSpace.CountableOrCountablyGenerated A B] (L K : Kernel A B) [IsMarkovKernel L] [IsMarkovKernel K] :
      Measurable (fun x => klDiv (L x) (K x)) := by
    classical
    have hf : Measurable (fun p : A × B =>
        ENNReal.ofReal (klFun ((Kernel.rnDeriv L K p.1 p.2).toReal))) := by
      exact ENNReal.measurable_ofReal.comp
        (continuous_klFun.measurable.comp (Kernel.measurable_rnDeriv L K).ennreal_toReal)
    have heq (x : A) : klDiv (L x) (K x) =
        if L x ≪ K x then ∫⁻ y, ENNReal.ofReal (klFun ((Kernel.rnDeriv L K x y).toReal)) ∂K x
        else ∞ := by
      rw [klDiv_eq_lintegral_klFun]
      split_ifs
      · apply lintegral_congr_ae
        filter_upwards [Kernel.rnDeriv_eq_rnDeriv_measure (κ := L) (η := K) (a := x)] with y hy
        rw [hy]
      · rfl
    simp_rw [heq]
    exact Measurable.ite (Kernel.measurableSet_absolutelyContinuous L K)
      hf.lintegral_kernel_prod_right' measurable_const
  have conditional_kl_integral {A B : Type u} [MeasurableSpace A] [MeasurableSpace B] [MeasurableSpace.CountableOrCountablyGenerated A B] (μ : Measure A) [IsProbabilityMeasure μ]
      (L K : Kernel A B) [IsMarkovKernel L] [IsMarkovKernel K] :
      klDiv (μ ⊗ₘ L) (μ ⊗ₘ K) = ∫⁻ x, klDiv (L x) (K x) ∂μ := by
    classical
    by_cases hac : μ ⊗ₘ L ≪ μ ⊗ₘ K
    · have hfiber := hac.kernel_of_compProd
      have hwd : (μ ⊗ₘ K).withDensity (fun p => Kernel.rnDeriv L K p.1 p.2) = μ ⊗ₘ L := by
        rw [← Measure.compProd_withDensity (Kernel.measurable_rnDeriv L K)]
        apply Measure.compProd_congr
        filter_upwards [hfiber] with x hx
        exact Kernel.withDensity_rnDeriv_eq hx
      have hrn : (μ ⊗ₘ L).rnDeriv (μ ⊗ₘ K) =ᵐ[μ ⊗ₘ K]
          (fun p => Kernel.rnDeriv L K p.1 p.2) := by
        rw [← hwd]
        exact Measure.rnDeriv_withDensity _ (Kernel.measurable_rnDeriv L K)
      rw [klDiv_eq_lintegral_klFun_of_ac hac]
      calc
        _ = ∫⁻ p, ENNReal.ofReal (klFun ((Kernel.rnDeriv L K p.1 p.2).toReal)) ∂(μ ⊗ₘ K) := by
          apply lintegral_congr_ae
          filter_upwards [hrn] with p hp
          rw [hp]
        _ = ∫⁻ x, ∫⁻ y, ENNReal.ofReal (klFun ((Kernel.rnDeriv L K x y).toReal)) ∂K x ∂μ := by
          apply Measure.lintegral_compProd
          exact ENNReal.measurable_ofReal.comp
            (continuous_klFun.measurable.comp (Kernel.measurable_rnDeriv L K).ennreal_toReal)
        _ = _ := by
          apply lintegral_congr_ae
          filter_upwards [hfiber] with x hx
          rw [klDiv_eq_lintegral_klFun_of_ac hx]
          apply lintegral_congr_ae
          filter_upwards [Kernel.rnDeriv_eq_rnDeriv_measure (κ := L) (η := K) (a := x)] with y hy
          rw [hy]
    · rw [klDiv_of_not_ac hac]
      symm
      by_contra hfinite
      have hf := ae_lt_top (measurable_fiber_kl L K) hfinite
      apply hac
      apply Measure.AbsolutelyContinuous.compProd_right
      filter_upwards [hf] with x hx
      exact (klDiv_ne_top_iff.mp hx.ne).1
  have composed_kl_bound {A B : Type u} [MeasurableSpace A] [MeasurableSpace B] [MeasurableSpace.CountableOrCountablyGenerated A B] (P Q : Measure A) [IsProbabilityMeasure P] [IsProbabilityMeasure Q]
      (L K : Kernel A B) [IsMarkovKernel L] [IsMarkovKernel K] :
      klDiv (L ∘ₘ P) (K ∘ₘ Q) ≤ klDiv P Q + ∫⁻ x, klDiv (L x) (K x) ∂P := by
    calc
      klDiv (L ∘ₘ P) (K ∘ₘ Q) = klDiv (P ⊗ₘ L).snd (Q ⊗ₘ K).snd := by
        rw [Measure.snd_compProd, Measure.snd_compProd]
      _ ≤ klDiv (P ⊗ₘ L) (Q ⊗ₘ K) := klDiv_map_le _ _ measurable_snd
      _ = _ := by rw [klDiv_compProd_eq_add, conditional_kl_integral]
  have kernel_error_sum {A : Type u} [MeasurableSpace A] (P : Kernel A A) [IsMarkovKernel P]
      (e t : A → ℝ≥0∞) (he : Measurable e) (ht : Measurable t)
      (f : ℕ → A → ℝ≥0∞) (hzero : ∀ s, f 0 s ≤ t s)
      (hstep : ∀ n s, f (n+1) s ≤ e s + ∫⁻ x, f n x ∂P s) :
      ∀ n s, f n s ≤ (∑ j ∈ Finset.range n, ∫⁻ x, e x ∂(P^j) s) + ∫⁻ x, t x ∂(P^n) s := by
    have hp (n : ℕ) : IsMarkovKernel (P^n) := by
      induction n with
      | zero => change IsMarkovKernel Kernel.id; infer_instance
      | succ n ih =>
        let := ih
        rw [pow_succ]
        change IsMarkovKernel ((P^n) ∘ₖ P)
        infer_instance
    let := hp
    have hi (n : ℕ) : Measurable (fun s => ∫⁻ x, e x ∂(P^n) s) := he.lintegral_kernel
    intro n
    induction n with
    | zero =>
      intro s
      simp only [Finset.range_zero,Finset.sum_empty,zero_add,pow_zero]
      change f 0 s ≤ ∫⁻ x, t x ∂Measure.dirac s
      simpa only [lintegral_dirac' s ht] using hzero s
    | succ n ih =>
      intro s
      calc
        f (n+1) s ≤ e s + ∫⁻ x, f n x ∂P s := hstep n s
        _ ≤ e s + ∫⁻ x, (∑ j ∈ Finset.range n, ∫⁻ y, e y ∂(P^j) x) +
            ∫⁻ y, t y ∂(P^n) x ∂P s := add_le_add le_rfl (lintegral_mono ih)
        _ = _ := by
          rw [lintegral_add_left (Finset.measurable_sum _ (fun j _ => hi j))]
          rw [lintegral_finsetSum _ (fun j _ => hi j)]
          have hei (j : ℕ) : (∫⁻ x, ∫⁻ y, e y ∂(P^j) x ∂P s) = ∫⁻ y, e y ∂(P^(j+1)) s := by
            rw [pow_succ]
            exact (Kernel.lintegral_comp (P^j) P s he).symm
          have hti : (∫⁻ x, ∫⁻ y, t y ∂(P^n) x ∂P s) = ∫⁻ y, t y ∂(P^(n+1)) s := by
            rw [pow_succ]
            exact (Kernel.lintegral_comp (P^n) P s ht).symm
          simp_rw [hei]
          rw [hti,Finset.sum_range_succ']
          simp only [pow_zero]
          rw [show (1 : Kernel A A) s = Measure.dirac s from rfl,lintegral_dirac' s he]
          change e s + ((∑ j ∈ Finset.range n, ∫⁻ x, e x ∂(P^(j+1)) s) + _) =
            ((∑ j ∈ Finset.range n, ∫⁻ x, e x ∂(P^(j+1)) s) + e s) + _
          ac_rfl
  intro F
  have hF : Measurable F := by
    apply Measurable.prodMk
    · exact Measurable.subtype_mk (by fun_prop)
    · apply Measurable.prodMk
      · fun_prop
      · apply Measurable.prodMk
        · fun_prop
        · apply measurable_pi_lambda
          intro n
          cases n <;> fun_prop
  obtain ⟨T,H,hT,hH,hTf,hHf,hprog⟩ :=
    AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.FiniteRGOProgram.finite_rgo_program μ a ha ha0 threshold
  let := hT
  let := hH
  obtain ⟨PI,RI,hPI,hRI,hPIf,hRIzero,hRIrec,hRIstop,hRIpath,hRIideal⟩ := hprog H T hH hT
  have hcons (s : PS) (hs : ¬threshold ≤ s.1) :
      (H s).bind (fun y => T (F (s,y))) = T s := by
    have hh := hRIrec 0 s
    rw [hRIideal rfl rfl 1,hRIzero,if_neg hs] at hh
    exact hh.symm
  refine ⟨T,H,hT,hH,hTf,hHf,?_⟩
  intro Q L hQ hL
  let := hQ
  let := hL
  obtain ⟨P,R,hP,hR,hPf,hzero,hrec,hstop,hpath,hideal⟩ := hprog Q L hQ hL
  let := hP
  refine ⟨P,R,hP,hR,hPf,hzero,hrec,?_⟩
  intro e t
  have he : Measurable e := Measurable.ite
    (measurableSet_le measurable_const measurable_fst) measurable_const (measurable_fiber_kl Q H)
  have ht : Measurable t := measurable_fiber_kl L T
  refine ⟨he,ht,?_⟩
  apply kernel_error_sum P e t he ht (fun n s => klDiv (R n s) (T s))
  · intro s
    rw [hzero]
  · intro n s
    let := hR n
    by_cases hs : threshold ≤ s.1
    · rw [hstop (n+1) s hs,show e s = 0 from if_pos hs,hPf,if_pos hs,
        lintegral_dirac' s (measurable_fiber_kl (R n) T),hstop n s hs,zero_add]
    · have hFs : Measurable (fun y : E => F (s,y)) := hF.comp measurable_prodMk_left
      let LR : Kernel E E := (R n).comap (fun y => F (s,y)) hFs
      let KT : Kernel E E := T.comap (fun y => F (s,y)) hFs
      have hLR : IsMarkovKernel LR := by dsimp [LR]; infer_instance
      have hKT : IsMarkovKernel KT := by dsimp [KT]; infer_instance
      let := hLR
      let := hKT
      have hc := composed_kl_bound (Q s) (H s) LR KT
      change klDiv ((Q s).bind (fun y => R n (F (s,y)))) ((H s).bind (fun y => T (F (s,y)))) ≤
        klDiv (Q s) (H s) + ∫⁻ y, klDiv (R n (F (s,y))) (T (F (s,y))) ∂Q s at hc
      rw [hcons s hs] at hc
      rw [hrec,if_neg hs,show e s = klDiv (Q s) (H s) from if_neg hs,hPf,if_neg hs,
        lintegral_map (measurable_fiber_kl (R n) T) hFs]
      exact hc


end AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.FiniteRGOKLError

Exact module and namespace context

Source assumptions versus formal assumptions

Source	Actual Lean	Difference kind	Why it matters
The paper uses a Euclidean Gibbs target.	Any probability base on a finite real Hilbert Borel space.	generalization	The error-transfer dependency uses the actual ideal posterior construction and needs neither density nor moments.
The recursive update uses its selected two-noise variance.	Any measurable positive state-dependent variance a with the same explicit precision-center-history update.	generalization	The actual source heat choice must later instantiate a; it is not yet the concrete sampler.
The recursive execution stops at a fixed terminal level.	Any fixed nonnegative precision threshold and every finite cap n.	API-limitation	The residual at cap n is retained even when a continuing state is capped. No adequate depth is claimed here.
A1 uses sampler Wasserstein accuracy, equation(6.5), and terminal FORS accuracy.	Exact actual-state integrals of observation KL and terminal KL for arbitrary Markov Q,L.	API-limitation	This proves their propagation without assuming a KL conclusion. Source numerical accuracy and actual algorithm identification remain separate.
Conditional distributions and their errors are used in the recursive proof.	Q,L are measurable Markov kernels; fiber KL and stopped error functions are proved measurable, with values in ENNReal.	source-implicit	This makes measurable kernel semantics explicit and includes singular or infinite-error fibers without extra finiteness assumptions.

This proves the error-transfer dependency for the actual finite recursive program. Arbitrary supplied Markov Q and L are not identified with the paper smoothed sampler or FORS. No stage accuracy, adequate stopping cap, initialization validity, or expected query-cost bound is asserted. The terminal residual is retained, including on stopped states. All KL values and budgets are extended nonnegative reals. The source A1 Wasserstein accuracy and equation (6.5) still need an actual observation-kernel instantiation.

Encoder–denoiser: accepted · domain-mismatch

Detected semantic differences

domains: Probability and Hilbert generalization. — Ideal posterior derives from parent without density or moments.
assumptions: Any positive measurable variance. — Source two-noise choice remains a later instance; update retained.
scopes: Every finite cap retains residual. — R_0=L and P^n terminal integral present; no threshold hitting.
scopes: Actual error integrals do not prove source numerical accuracy. — Q,L arbitrary; A1 Wasserstein, eq6.5 and FORS guarantees remain.
assumptions: Measurable semantics and singular extended-real cases explicit. — Local fiber KL and conditional KL proofs and stopped split.

A generalization is not a source correction. Proposed missing conditions require separate independent repair review. No proposed repair silently changes the original theorem.

Scope and omitted-condition boundaries

This proves the error-transfer dependency for the actual finite recursive program. Arbitrary supplied Markov Q and L are not identified with the paper smoothed sampler or FORS. No stage accuracy, adequate stopping cap, initialization validity, or expected query-cost bound is asserted. The terminal residual is retained, including on stopped states. All KL values and budgets are extended nonnegative reals. The source A1 Wasserstein accuracy and equation (6.5) still need an actual observation-kernel instantiation.

Source and reuse

ASTIS parents called

AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.FiniteRGOProgram.finite_rgo_program

Mathlib API called (external library)

ProbabilityTheory.Kernel.measurable_rnDeriv
InformationTheory.klDiv_compProd_eq_add
InformationTheory.klDiv_map_le
MeasureTheory.lintegral_finsetSum
ProbabilityTheory.Kernel.lintegral_comp

Mathematical sources

SPHMC v1 Theorem 6.5 A1 recursive error argument and equation (6.5) — Finite recursive error transfer; numerical stage budgets and concrete sampler guarantees remain separate.

ASTIS prose is not a quotation or a source-equivalence certificate. Definitions and aliases are explained as constructions, not counted as new mathematical proofs.

Which proof edges are actually covered?

TODO — not closed by these contributions Actual finite recursive KL error accumulation

Finite threshold-absorbed RGO execution, terminal marginal and ideal recovery

Fan Chen, Sinho Chewi, Jianfeng Lu and Matthew S. Zhang; ASTIS expanded finite execution semantics, no author endorsement implied.

arXiv:2609.06906v1 · Algorithm3.3 capped recursive execution and Theorem6.5 ideal comparison · faithful paraphrase

Complete source statement (ASTIS restatement)

Let E be a finite-dimensional real inner-product Borel space, mu a probability measure, and S the state space of tuples (b,u,k,h) with nonnegative precision b, center u, natural count k and padded E-valued sequence h. Fix measurable a:S to R, positive at every state, and a nonnegative threshold B. Define F(s,y) by b_new=b+1/a(s), u_new=(b*u+y/a(s))/b_new, k_new=k+1 and h_new=(y,h(0),h(1),...). There exist Markov target and observation kernels T,H, before every choice of Markov Q,L, with T(s) the mu tilt by -b*norm(x-u)^2/2 and H(s) its actual Gaussian smoothing at standard deviation sqrt(a(s)). For each Q,L there are a Markov transition P and Markov output kernels R_n. P(s) is the point mass at s if B<=b and the F(s,.) pushforward of Q(s) otherwise. R_0=L; R_(n+1)(s) is L(s) if B<=b and the Q(s) integral of R_n(F(s,y)) otherwise. At stopped states every R_n(s)=L(s). The actual finite path kernel started at s, advanced by P for n transitions, projected to its final state and followed by L equals R_n. If Q=H and L=T, every R_n=T.

E has its Borel measurable structure and is finite-dimensional over the reals; mu is any probability measure, with no density or moment assumption.
S is the product of nonnegative real precision, E, natural count and the countable product E^N. The update is explicit; no history validity is inferred for arbitrary starting count/sequence.
a is measurable and strictly positive at every state, including stopped states. Source maps such as a=(eta+tau)/beta_A remain to be instantiated.
B is nonnegative. The paper uses the positive inverse terminal variance; B=0 is a valid immediate-stop generalization.
Q and L are arbitrary Markov kernels. The same globally constructed T,H precede them, and the constructed P is used for every finite depth.
At a finite cap the remaining call is represented by L even if the threshold was not reached. Exact ideal recovery uses both Q=H and L=T; no approximation or runtime bound follows.

Actual recursion and ideal finite-depth recovery

\[R_{n+1}(s)=\begin{cases}L(s),&B\le b(s),\\\int R_n(F(s,y))\,Q(s)(dy),&b(s)<B,\end{cases}\qquad Q=H,\ L=T\ \Longrightarrow\ R_n=T.\]

Read the formalized proofs

Each statement and proof below has its own closed Lean disclosure. ASTIS parents, Mathlib calls and external mathematical sources are distinguished in each proof.

ASTIS mathematical exposition

Finite threshold-absorbed RGO execution, terminal marginal and ideal recovery

AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.FiniteRGOProgram.finite_rgo_program · theorem · Teaching coverage

Statement

\[R_{n+1}(s)=\begin{cases}L(s),&B\le b(s),\\\int R_n(F(s,y))\,Q(s)(dy),&b(s)<B,\end{cases}\qquad Q=H,\ L=T\ \Longrightarrow\ R_n=T.\]

All objects and hypotheses

E has its Borel measurable structure and is finite-dimensional over the reals; mu is any probability measure, with no density or moment assumption.
S is the product of nonnegative real precision, E, natural count and the countable product E^N. The update is explicit; no history validity is inferred for arbitrary starting count/sequence.
a is measurable and strictly positive at every state, including stopped states. Source maps such as a=(eta+tau)/beta_A remain to be instantiated.
B is nonnegative. The paper uses the positive inverse terminal variance; B=0 is a valid immediate-stop generalization.
Q and L are arbitrary Markov kernels. The same globally constructed T,H precede them, and the constructed P is used for every finite depth.
At a finite cap the remaining call is represented by L even if the threshold was not reached. Exact ideal recovery uses both Q=H and L=T; no approximation or runtime bound follows.

Mathematical proof

1. Make the parameter and history update measurable

The nonnegative new precision is b+1/a(s), positive because a(s)>0. Inversion, scalar multiplication and addition make the weighted center measurable. Incrementing the count is measurable. Each coordinate of the prepended sequence is either the new observation or a coordinate of the old sequence, so the entire countable-product update F is measurable.

\[F((b,u,k,h),y)=\left(b+a(s)^{-1},\frac{bu+a(s)^{-1}y}{b+a(s)^{-1}},k+1,(y,h_0,h_1,\ldots)\right).\]

Corresponding Lean step

Local measurable_program_update; Measurable.prodMk, Measurable.subtype_mk, measurable_pi_lambda and coordinate cases.

2. Derive ideal posterior consistency from the actual updated target

Apply StateDependentRGO to the current precision and center maps. Its globally measurable T,H and retained-state posterior use exactly the updated quadratic parameters. Consequently the posterior at (s,y), after discarding its retained s coordinate, equals T(F(s,y)). Evaluate the proved joint recovery at the point mass state law and integrate event sections. This yields T composed with the ideal state transition C_H equals T; this identity is proved rather than assumed.

\[C_H(s)=F(s,\cdot)_\#H(s),\qquad \int T(F(s,y))\,H(s)(dy)=T(s).\]

Corresponding Lean step

Local ideal_state_transition; StateDependentRGO.state_dependent_recovery, Measure.bind_apply, Measure.lintegral_compProd and lintegral_map.

3. Construct the actual stopped transition and recursive outputs

The terminal set D={s:B<=b(s)} is measurable. Push Q(s) through F(s,.) to obtain the continuing transition C_Q. Use the identity kernel on D and C_Q outside D. Both branches are Markov. Define R_n=L composed with P^n. Kernel composition preserves the Markov property. The identity branch gives R_n(s)=L(s) at stopped states by induction. On the continuing branch, the pushforward integral gives exactly the recursive call under Q(s).

\[P(s)=\begin{cases}\delta_s,&s\in D,\\F(s,\cdot)_\#Q(s),&s\notin D,\end{cases}\qquad R_n=L\circ_k P^n.\]

Corresponding Lean step

Local absorbing_program and main hCQf; Kernel.piecewise, Kernel.map, Kernel.comp_assoc, Measure.dirac_bind, Measure.bind_apply, lintegral_map.

4. Identify the endpoint of the actual finite state path

For a path through time k, the next-state kernel is P evaluated at its last coordinate. Mathlib partialTraj constructs the finite trajectory kernel from these measurable Markov kernels. Induction using the successor decomposition shows that its final-coordinate marginal is P^n after reading the initial coordinate. Composing with the singleton initial path at s removes that coordinate adapter. Following the final state by L therefore gives the same R_n as recursive evaluation.

\[\kappa_k(h)=P(h_k),\qquad (\operatorname{last}_n)_\#\operatorname{Path}_{0:n}(s)=P^n(s),\qquad L\circ_k\operatorname{EndPath}_n=R_n.\]

Corresponding Lean step

Local endpoint_path; Kernel.partialTraj, partialTraj_succ_eq_comp, map_partialTraj_succ_self, comp_deterministic_eq_comap and deterministic_comp_deterministic.

5. Preserve ideal recovery through absorption and every finite cap

In the ideal case C_Q=C_H. The continuing branch preserves T by the already proved posterior consistency, and the stopped identity branch preserves T trivially. Thus T composed with the same absorbed transition P equals T. Induction on kernel powers gives T composed with P^n equals T for every n, including zero. Substituting the ideal terminal kernel L=T in the previously constructed R_n proves the claimed recovery.

\[T\circ_k P=T\quad\Longrightarrow\quad T\circ_k P^n=T\quad\Longrightarrow\quad R_n=T\ \ (Q=H,\ L=T).\]

Corresponding Lean step

Local absorbing_invariant; actual hTC from ideal_state_transition, kernel extensionality, pow_succ and Kernel.comp_assoc.

Lean statement · finite_rgo_program

Actual finite threshold-absorbed recursive kernel and finite path endpoint, with ideal recovery derived from the explicit quadratic update.

theorem finite_rgo_program (μ : Measure E) [IsProbabilityMeasure μ]
    (a : ProgramState E → ℝ) (ha : Measurable a) (ha0 : ∀ s, 0 < a s)
    (threshold : ℝ≥0) :
    let F : ProgramState E × E → ProgramState E := fun p =>
      (⟨(p.1.1 : ℝ)+(a p.1)⁻¹, add_nonneg p.1.1.coe_nonneg (le_of_lt (inv_pos.mpr (ha0 p.1)))⟩,
       ((p.1.1 : ℝ)+(a p.1)⁻¹)⁻¹ • ((p.1.1 : ℝ) • p.1.2.1+(a p.1)⁻¹ • p.2),
       p.1.2.2.1+1, fun n => Nat.casesOn n p.2 p.1.2.2.2)
    ∃ (T H : Kernel (ProgramState E) E), IsMarkovKernel T ∧ IsMarkovKernel H ∧
      (∀ s, T s = μ.tilted (fun x => -((s.1 : ℝ)/2)*‖x-s.2.1‖^2)) ∧
      (∀ s, H s = GaussianSmoothing.gaussianSmoothing (T s) (Real.sqrt (a s))) ∧
      ∀ (Q L : Kernel (ProgramState E) E), IsMarkovKernel Q → IsMarkovKernel L →
      ∃ (P : Kernel (ProgramState E) (ProgramState E)) (R : ℕ → Kernel (ProgramState E) E),
        IsMarkovKernel P ∧ (∀ n, IsMarkovKernel (R n)) ∧
        (∀ s, P s = if threshold ≤ s.1 then Measure.dirac s else (Q s).map (fun y => F (s,y))) ∧
        R 0 = L ∧
        (∀ n s, R (n+1) s = if threshold ≤ s.1 then L s else
          (Q s).bind (fun y => R n (F (s,y)))) ∧
        (∀ n s, threshold ≤ s.1 → R n s = L s) ∧
        (∀ n : ℕ,
          let κ : (k : ℕ) → Kernel (Π _ : Iic k, ProgramState E) (ProgramState E) := fun k =>
            P.comap (fun h => h ⟨k, mem_Iic.mpr le_rfl⟩) (by fun_prop)
          L ∘ₖ (((Kernel.partialTraj (X := fun _ => ProgramState E) κ 0 n).map
            (fun h => h ⟨n, mem_Iic.mpr le_rfl⟩)).comap
            (fun (s : ProgramState E) (_ : Iic 0) => s) (by fun_prop)) = R n) ∧
        (Q = H → L = T → ∀ n, R n = T)

Exact module and namespace context

Lean proof · finite_rgo_program

Prove update measurability, derive posterior consistency, construct absorbed transition powers, identify finite trajectory endpoint and induct on ideal invariance.

theorem finite_rgo_program (μ : Measure E) [IsProbabilityMeasure μ]
    (a : ProgramState E → ℝ) (ha : Measurable a) (ha0 : ∀ s, 0 < a s)
    (threshold : ℝ≥0) :
    let F : ProgramState E × E → ProgramState E := fun p =>
      (⟨(p.1.1 : ℝ)+(a p.1)⁻¹, add_nonneg p.1.1.coe_nonneg (le_of_lt (inv_pos.mpr (ha0 p.1)))⟩,
       ((p.1.1 : ℝ)+(a p.1)⁻¹)⁻¹ • ((p.1.1 : ℝ) • p.1.2.1+(a p.1)⁻¹ • p.2),
       p.1.2.2.1+1, fun n => Nat.casesOn n p.2 p.1.2.2.2)
    ∃ (T H : Kernel (ProgramState E) E), IsMarkovKernel T ∧ IsMarkovKernel H ∧
      (∀ s, T s = μ.tilted (fun x => -((s.1 : ℝ)/2)*‖x-s.2.1‖^2)) ∧
      (∀ s, H s = GaussianSmoothing.gaussianSmoothing (T s) (Real.sqrt (a s))) ∧
      ∀ (Q L : Kernel (ProgramState E) E), IsMarkovKernel Q → IsMarkovKernel L →
      ∃ (P : Kernel (ProgramState E) (ProgramState E)) (R : ℕ → Kernel (ProgramState E) E),
        IsMarkovKernel P ∧ (∀ n, IsMarkovKernel (R n)) ∧
        (∀ s, P s = if threshold ≤ s.1 then Measure.dirac s else (Q s).map (fun y => F (s,y))) ∧
        R 0 = L ∧
        (∀ n s, R (n+1) s = if threshold ≤ s.1 then L s else
          (Q s).bind (fun y => R n (F (s,y)))) ∧
        (∀ n s, threshold ≤ s.1 → R n s = L s) ∧
        (∀ n : ℕ,
          let κ : (k : ℕ) → Kernel (Π _ : Iic k, ProgramState E) (ProgramState E) := fun k =>
            P.comap (fun h => h ⟨k, mem_Iic.mpr le_rfl⟩) (by fun_prop)
          L ∘ₖ (((Kernel.partialTraj (X := fun _ => ProgramState E) κ 0 n).map
            (fun h => h ⟨n, mem_Iic.mpr le_rfl⟩)).comap
            (fun (s : ProgramState E) (_ : Iic 0) => s) (by fun_prop)) = R n) ∧
        (Q = H → L = T → ∀ n, R n = T) := by
  classical
  have endpoint_path (C : Kernel (ProgramState E) (ProgramState E)) [IsMarkovKernel C] (n : ℕ) :
      let κ : (k : ℕ) → Kernel (Π _ : Iic k, (ProgramState E)) (ProgramState E) := fun k =>
        C.comap (fun h => h ⟨k, mem_Iic.mpr le_rfl⟩) (by fun_prop)
      ((Kernel.partialTraj (X := fun _ => (ProgramState E)) κ 0 n).map (fun h => h ⟨n, mem_Iic.mpr le_rfl⟩)).comap
        (fun (s : (ProgramState E)) (_ : Iic 0) => s) (by fun_prop) = C ^ n := by
    intro κ
    have hκ : ∀ k, IsMarkovKernel (κ k) := fun k => by dsimp [κ]; infer_instance
    let := hκ
    have hm (n : ℕ) : (Kernel.partialTraj (X := fun _ => (ProgramState E)) κ 0 n).map (fun h => h ⟨n, mem_Iic.mpr le_rfl⟩) =
        (C ^ n) ∘ₖ Kernel.deterministic (fun h : Π _ : Iic 0, (ProgramState E) => h ⟨0, mem_Iic.mpr le_rfl⟩)
          (by fun_prop) := by
      induction n with
      | zero =>
        rw [Kernel.partialTraj_self, Kernel.id_map (by fun_prop), pow_zero]
        exact (Kernel.id_comp _).symm
      | succ n ih =>
        rw [Kernel.partialTraj_succ_eq_comp (Nat.zero_le n), Kernel.map_comp,
          Kernel.map_partialTraj_succ_self]
        change (C.comap _ _) ∘ₖ Kernel.partialTraj (X := fun _ => (ProgramState E)) κ 0 n = _
        rw [← Kernel.comp_map, ih, ← Kernel.comp_assoc, _root_.pow_succ']
        rfl
    rw [hm, ← Kernel.comp_deterministic_eq_comap, Kernel.comp_assoc,
      Kernel.deterministic_comp_deterministic]
    change (C ^ n) ∘ₖ Kernel.id = C ^ n
    exact Kernel.comp_id _
  have measurable_program_update (a : ProgramState E → ℝ) (ha : Measurable a)
      (ha0 : ∀ s, 0 < a s) :
      let F : ProgramState E × E → ProgramState E := fun p =>
        (⟨(p.1.1 : ℝ)+(a p.1)⁻¹, add_nonneg p.1.1.coe_nonneg (le_of_lt (inv_pos.mpr (ha0 p.1)))⟩,
         ((p.1.1 : ℝ)+(a p.1)⁻¹)⁻¹ • ((p.1.1 : ℝ) • p.1.2.1+(a p.1)⁻¹ • p.2),
         p.1.2.2.1+1, fun n => Nat.casesOn n p.2 p.1.2.2.2)
      Measurable F := by
    intro F
    apply Measurable.prodMk
    · exact Measurable.subtype_mk (by fun_prop)
    · apply Measurable.prodMk
      · fun_prop
      · apply Measurable.prodMk
        · fun_prop
        · apply measurable_pi_lambda
          intro n
          cases n <;> fun_prop
  have absorbing_program (D : Set (ProgramState E)) [DecidablePred (· ∈ D)] (hD : MeasurableSet D)
      (C : Kernel (ProgramState E) (ProgramState E)) [IsMarkovKernel C] (L : Kernel (ProgramState E) E) [IsMarkovKernel L] :
      let P : Kernel (ProgramState E) (ProgramState E) := Kernel.piecewise hD Kernel.id C
      let R : ℕ → Kernel (ProgramState E) E := fun n => L ∘ₖ (P ^ n)
      (∀ n, IsMarkovKernel (R n)) ∧ R 0 = L ∧
        (∀ n s, s ∈ D → R n s = L s) ∧
        (∀ n s, R (n+1) s = if s ∈ D then L s else (C s).bind (R n)) := by
    classical
    intro P R
    have hP : IsMarkovKernel P := by dsimp [P]; infer_instance
    let := hP
    have hp (n : ℕ) : IsMarkovKernel (P ^ n) := by
      induction n with
      | zero => change IsMarkovKernel Kernel.id; infer_instance
      | succ n ih =>
        let := ih
        rw [pow_succ]
        change IsMarkovKernel ((P ^ n) ∘ₖ P)
        infer_instance
    have hR (n : ℕ) : IsMarkovKernel (R n) := by
      let := hp n
      dsimp [R]
      infer_instance
    have hz : R 0 = L := by
      change L ∘ₖ Kernel.id = L
      exact Kernel.comp_id L
    have hstep (n : ℕ) : R (n+1) = (R n) ∘ₖ P := by
      dsimp only [R]
      rw [pow_succ]
      exact (Kernel.comp_assoc L (P ^ n) P).symm
    have hstop (n : ℕ) (s : (ProgramState E)) (hs : s ∈ D) : R n s = L s := by
      induction n with
      | zero => rw [hz]
      | succ n ih =>
        rw [hstep, Kernel.comp_apply]
        have hPs : P s = Measure.dirac s := by
          dsimp only [P]
          rw [Kernel.piecewise_apply, if_pos hs, Kernel.id_apply]
        rw [hPs, Measure.dirac_bind (R n).measurable]
        exact ih
    refine ⟨hR,hz,hstop,?_⟩
    intro n s
    by_cases hs : s ∈ D
    · rw [if_pos hs]
      exact hstop (n+1) s hs
    · rw [if_neg hs, hstep, Kernel.comp_apply]
      have hPs : P s = C s := by
        dsimp only [P]
        rw [Kernel.piecewise_apply, if_neg hs]
      rw [hPs]
  have ideal_state_transition (μ : Measure E) [IsProbabilityMeasure μ]
      (a : ProgramState E → ℝ) (ha : Measurable a) (ha0 : ∀ s, 0 < a s) :
      let F : ProgramState E × E → ProgramState E := fun p =>
        (⟨(p.1.1 : ℝ)+(a p.1)⁻¹, add_nonneg p.1.1.coe_nonneg (le_of_lt (inv_pos.mpr (ha0 p.1)))⟩,
         ((p.1.1 : ℝ)+(a p.1)⁻¹)⁻¹ • ((p.1.1 : ℝ) • p.1.2.1+(a p.1)⁻¹ • p.2),
         p.1.2.2.1+1, fun n => Nat.casesOn n p.2 p.1.2.2.2)
      ∃ (T H : Kernel (ProgramState E) E) (C : Kernel (ProgramState E) (ProgramState E)),
        IsMarkovKernel T ∧ IsMarkovKernel H ∧ IsMarkovKernel C ∧
        (∀ s, T s = μ.tilted (fun x => -((s.1 : ℝ)/2)*‖x-s.2.1‖^2)) ∧
        (∀ s, H s = GaussianSmoothing.gaussianSmoothing (T s) (Real.sqrt (a s))) ∧
        (∀ s, C s = (H s).map (fun y => F (s,y))) ∧ T ∘ₖ C = T := by
    intro F
    have hF : Measurable F := measurable_program_update a ha ha0
    obtain ⟨T,H,B,hT,hH,hB,hTf,hHf,hBpost,hBupd,hrec⟩ :=
      StateDependentRGO.state_dependent_recovery μ (fun s : ProgramState E => (s.1 : ℝ)) a
        (fun s => s.2.1) (by fun_prop) ha (by fun_prop) (fun s => s.1.coe_nonneg) ha0
    let := hT
    let := hH
    let := hB
    let C := (Kernel.id ×ₖ H).map F
    have hC : IsMarkovKernel C := Kernel.IsMarkovKernel.map _ hF
    let := hC
    have hCf (s : ProgramState E) : C s = (H s).map (fun y => F (s,y)) := by
      dsimp only [C]
      rw [Kernel.map_apply _ hF, Kernel.prod_apply, Kernel.id_apply, Measure.dirac_prod,
        Measure.map_map hF (by fun_prop)]
      rfl
    have hBf (s : ProgramState E) (y : E) : B (s,y) =
        (T (F (s,y))).map (Prod.mk s) := by
      rw [hBupd,hTf]
      rfl
    refine ⟨T,H,C,hT,hH,hC,hTf,hHf,hCf,?_⟩
    ext s t ht
    have hst : MeasurableSet (Prod.snd ⁻¹' t : Set (ProgramState E × E)) := ht.preimage measurable_snd
    have heq := congrArg (fun m : Measure (ProgramState E × E) => m (Prod.snd ⁻¹' t))
      (hrec (Measure.dirac s) inferInstance)
    rw [Measure.bind_apply hst B.aemeasurable, Measure.lintegral_compProd (B.measurable_coe hst),
      Measure.compProd_apply hst] at heq
    simp only [lintegral_dirac] at heq
    rw [Kernel.comp_apply' _ _ _ ht, hCf, lintegral_map (T.measurable_coe ht)
      (show Measurable (fun y : E => F (s,y)) from hF.comp measurable_prodMk_left)]
    convert heq using 1
    · apply lintegral_congr
      intro y
      rw [hBf,Measure.map_apply (by fun_prop) hst]
      rfl
    · rfl
  have absorbing_invariant (D : Set (ProgramState E)) [DecidablePred (· ∈ D)]
      (hD : MeasurableSet D) (C : Kernel (ProgramState E) (ProgramState E)) [IsMarkovKernel C]
      (T : Kernel (ProgramState E) E) [IsMarkovKernel T] (hTC : T ∘ₖ C = T) :
      let P : Kernel (ProgramState E) (ProgramState E) := Kernel.piecewise hD Kernel.id C
      ∀ n : ℕ, T ∘ₖ (P ^ n) = T := by
    intro P
    have hP : IsMarkovKernel P := by dsimp [P]; infer_instance
    let := hP
    have hTP : T ∘ₖ P = T := by
      ext s t ht
      rw [Kernel.comp_apply]
      by_cases hs : s ∈ D
      · have hPs : P s = Measure.dirac s := by
          dsimp only [P]
          rw [Kernel.piecewise_apply, if_pos hs, Kernel.id_apply]
        rw [hPs, Measure.dirac_bind T.measurable]
      · have hPs : P s = C s := by
          dsimp only [P]
          rw [Kernel.piecewise_apply, if_neg hs]
        rw [hPs]
        exact congrArg (fun K : Kernel (ProgramState E) E => K s t) hTC
    intro n
    induction n with
    | zero => exact Kernel.comp_id T
    | succ n ih =>
      rw [pow_succ]
      change T ∘ₖ ((P ^ n) ∘ₖ P) = T
      rw [← Kernel.comp_assoc, ih, hTP]
  intro F
  have hF : Measurable F := measurable_program_update a ha ha0
  obtain ⟨T,H,C,hT,hH,hC,hTf,hHf,hCf,hTC⟩ := ideal_state_transition μ a ha ha0
  let := hT
  let := hH
  let := hC
  refine ⟨T,H,hT,hH,hTf,hHf,?_⟩
  intro Q L hQ hL
  let := hQ
  let := hL
  let D : Set (ProgramState E) := {s | threshold ≤ s.1}
  have hD : MeasurableSet D := measurableSet_le measurable_const measurable_fst
  let CQ := (Kernel.id ×ₖ Q).map F
  have hCQ : IsMarkovKernel CQ := Kernel.IsMarkovKernel.map _ hF
  let := hCQ
  have hCQf (s : ProgramState E) : CQ s = (Q s).map (fun y => F (s,y)) := by
    dsimp only [CQ]
    rw [Kernel.map_apply _ hF, Kernel.prod_apply, Kernel.id_apply, Measure.dirac_prod,
      Measure.map_map hF (by fun_prop)]
    rfl
  let P := Kernel.piecewise hD Kernel.id CQ
  let R : ℕ → Kernel (ProgramState E) E := fun n => L ∘ₖ (P ^ n)
  have hP : IsMarkovKernel P := by dsimp [P]; infer_instance
  let := hP
  obtain ⟨hR,hzero,hstop,hstep⟩ := absorbing_program D hD CQ L
  refine ⟨P,R,hP,hR,?_,hzero,?_,hstop,?_,?_⟩
  · intro s
    dsimp only [P]
    rw [Kernel.piecewise_apply, Kernel.id_apply, hCQf]
    rfl
  · intro n s
    change (L ∘ₖ (P ^ (n+1))) s = _
    rw [hstep]
    by_cases hs : threshold ≤ s.1
    · rw [if_pos (show s ∈ D from hs), if_pos hs]
    · rw [if_neg (show s ∉ D from hs), if_neg hs, hCQf]
      apply Measure.ext
      intro t ht
      rw [Measure.bind_apply ht (R n).aemeasurable,
        Measure.bind_apply ht (show AEMeasurable (fun y : E => R n (F (s,y))) (Q s) from ((R n).measurable.comp (hF.comp measurable_prodMk_left)).aemeasurable)]
      exact lintegral_map ((R n).measurable_coe ht)
        (show Measurable (fun y : E => F (s,y)) from hF.comp measurable_prodMk_left)
  · intro n κ
    rw [endpoint_path P n]
  · intro hQeq hLeq n
    have hCQeq : CQ = C := by
      ext s t ht
      rw [hCQf, hQeq, hCf]
    change L ∘ₖ (P ^ n) = T
    rw [hLeq]
    exact absorbing_invariant D hD CQ T (by rw [hCQeq]; exact hTC) n


end AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.FiniteRGOProgram

Exact module and namespace context

Source assumptions versus formal assumptions

Source	Actual Lean	Difference kind	Why it matters
Algorithm3.3 uses a Euclidean Gibbs target.	Any probability base on a finite-dimensional real inner-product Borel space.	generalization	The exact posterior execution law requires no density or moment hypothesis; concrete Gibbs identification remains separate.
The recursion updates precision and center, with call-dependent smoothing parameters.	Explicit precision, center, count and padded-history update with measurable a(s)>0 everywhere.	source-implicit	This supplies measurable state semantics. Concrete source a=(eta+tau)/beta_A and valid initialization still require instantiation; no fixed schedule is imposed.
Termination uses the positive inverse terminal variance.	Nonnegative threshold, with identity state transition on terminal states.	generalization	Zero threshold immediately stops. The source instance uses a positive threshold. State self-loops represent absorption and do not assert extra oracle calls.
Algorithm3.3 uses a smoothed sampler, recurses and terminates with FORS.	Arbitrary Markov observation and terminal kernels Q,L; a finite cap with L used at the cap.	API-limitation	The actual finite recursive and path endpoint semantics are proved, but identification of Q,L, adequate cap, FORS, accuracy and expected costs are not supplied.
Ideal posterior consistency supports the stagewise correctness argument.	Construct actual ideal T,H before Q,L and derive R_n=T for Q=H,L=T at every finite depth.	source-implicit	Recovery is proved from StateDependentRGO and the explicit update. Ideal L=T is an oracle comparison, not an implemented terminal sampler.

Finite capped state execution with a supplied terminal kernel even when the cap is reached before the threshold. No claim that the cap reaches the source stopping depth, that arbitrary initial count/history is valid, or that the state path is a query execution record. Concrete smoothed sampler and FORS, source parameter selection, approximation errors and expected query costs remain separate. Ideal terminal L=T is an oracle comparison.

Encoder–denoiser: accepted · domain-mismatch

Detected semantic differences

domains: General probability and finite Hilbert base disclosed. — No potential, density, moments or positive dimension. Both generalizations explicitly disclosed.
assumptions: Measurable current-state variance and padded history; concrete parameters and valid initialization remain. — Actual hTC is derived from StateDependentRGO and F; recovery, threshold-hitting and history validity are not assumed.
domains: Zero threshold immediate-stop extension; source positive threshold retained. — No potential, density, moments or positive dimension. Both generalizations explicitly disclosed.
scopes: Supplied Q,L and cap do not identify actual sampler/FORS or prove cap adequacy, errors or costs. — Cap before threshold still calls L. Module and publication preserve limitations; state path is not a query record.
conclusion: Same actual T,H yield ideal finite recovery; L=T is an oracle comparison. — absorbing_program proves recursion and absorption; endpoint_path includes singleton adapter; absorbing_invariant consumes proved hTC.

A generalization is not a source correction. Proposed missing conditions require separate independent repair review. No proposed repair silently changes the original theorem.

Scope and omitted-condition boundaries

Finite capped state execution with a supplied terminal kernel even when the cap is reached before the threshold. No claim that the cap reaches the source stopping depth, that arbitrary initial count/history is valid, or that the state path is a query execution record. Concrete smoothed sampler and FORS, source parameter selection, approximation errors and expected query costs remain separate. Ideal terminal L=T is an oracle comparison.

Source and reuse

ASTIS parents called

AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.StateDependentRGO.state_dependent_recovery

Mathlib API called (external library)

ProbabilityTheory.Kernel.partialTraj
ProbabilityTheory.Kernel.partialTraj_succ_eq_comp
ProbabilityTheory.Kernel.map_partialTraj_succ_self
ProbabilityTheory.Kernel.piecewise
ProbabilityTheory.Kernel.comp_assoc
MeasureTheory.Measure.bind_apply
MeasureTheory.lintegral_map

Mathematical sources

SPHMC v1 Algorithm 3.3 and Theorem 6.5 — Finite capped execution and ideal comparison, before concrete sampler, stopping-depth, accuracy and cost identification.

ASTIS prose is not a quotation or a source-equivalence certificate. Definitions and aliases are explained as constructions, not counted as new mathematical proofs.

Which proof edges are actually covered?

TODO — not closed by these contributions Finite threshold-absorbed execution, actual path endpoint and ideal recovery

Actual Gaussian gradient-arc joint law and calculus

ASTIS mathematical restatement and proof exposition of the cited gradient-arc construction; used as a dependency of Fan Chen, Sinho Chewi, Jianfeng Lu and Matthew S. Zhang, Smoothed Picard Hamiltonian Monte Carlo. No author endorsement is implied.

arXiv:2602.01338v1 · Appendix D.1 gradient arc and joint Gaussian law preceding Claim 1; consumed by SPHMC Appendix A.4(2) · faithful paraphrase

Complete source statement (ASTIS restatement)

The square of sqrt(eta) is eta. The map (h,r,x,z) to (gamma_r,v_r) is jointly measurable. For every real r its pushforward of the displayed input product law is N(h,eta I) product N(0,(pi/2)^2 eta I); in particular the position and velocity are independent. For every deterministic input pair, gamma has derivative v at every real r. Its positions at 0 and 1 are h+z and x; its velocities are (pi/2)(x-h) and -(pi/2)z.

E is a finite-dimensional real inner product space with its Borel measurable structure; second countability is explicitly available. Zero dimension is allowed.
eta>0 and h in E. The input is the actual independent product law of X=h+sqrt(eta)G1 and Z=sqrt(eta)G2, where G1,G2 are standard Gaussian.
For r in the real line set theta=pi*r/2, gamma_r=h+sin(theta)(X-h)+cos(theta)Z and v_r=(pi/2)(cos(theta)(X-h)-sin(theta)Z). Source consumption only requires r in [0,1].

Actual joint Gaussian law and derivative

\[(\gamma_r,v_r)_\#\bigl(N(h,\eta I)\otimes N(0,\eta I)\bigr)=N(h,\eta I)\otimes N(0,\tfrac{\pi^2}{4}\eta I),\qquad \frac{d}{dr}\gamma_r=v_r.\]

Read the formalized proofs

Each statement and proof below has its own closed Lean disclosure. ASTIS parents, Mathlib calls and external mathematical sources are distinguished in each proof.

ASTIS mathematical exposition

Actual Gaussian gradient-arc joint law and calculus

AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.GaussianArcLaw.gaussian_arc_law · theorem · Teaching coverage

Statement

\[(\gamma_r,v_r)_\#\bigl(N(h,\eta I)\otimes N(0,\eta I)\bigr)=N(h,\eta I)\otimes N(0,\tfrac{\pi^2}{4}\eta I),\qquad \frac{d}{dr}\gamma_r=v_r.\]

All objects and hypotheses

E is a finite-dimensional real inner product space with its Borel measurable structure; second countability is explicitly available. Zero dimension is allowed.
eta>0 and h in E. The input is the actual independent product law of X=h+sqrt(eta)G1 and Z=sqrt(eta)G2, where G1,G2 are standard Gaussian.
For r in the real line set theta=pi*r/2, gamma_r=h+sin(theta)(X-h)+cos(theta)Z and v_r=(pi/2)(cos(theta)(X-h)-sin(theta)Z). Source consumption only requires r in [0,1].

Mathematical proof

1. Start with actual independent standard Gaussian coordinates

Swap the two coordinates of the identical product measure; the law is unchanged. The existing centered Gaussian rotation theorem applies because every continuous linear functional has mean zero under the standard Gaussian.

\[R_\theta(z,x)=(\cos\theta\,z+\sin\theta\,x,-\sin\theta\,z+\cos\theta\,x).\]

Corresponding Lean step

Measure.prod_swap; IsGaussian.map_rotation_eq_self_of_forall_strongDual_eq_zero; integral_strongDual_stdGaussian

2. Transport the rotation to the actual input scales and center

Express the input as the product pushforward of h+sigma G1 and sigma G2. Compose the arc map with that input map. Scalar distributivity shows it equals the invariant rotation followed by the output map (u,w) to (h+sigma u,(pi/2)sigma w). Product-map and map-composition identities prove the entire joint product law, not merely two marginals.

\[\sigma=\sqrt\eta,\qquad (u,w)\longmapsto(h+\sigma u,\tfrac\pi2\sigma w).\]

Corresponding Lean step

affine_arc_law; Measure.map_prod_map; Measure.map_map

3. Prove joint measurability of the path and velocity

Coordinates, addition, subtraction, real scalar multiplication and sine/cosine are continuous. Their displayed compositions are jointly measurable in the center, time and both input vectors. This establishes deterministic parameter measurability without asserting a parameterized Gaussian-kernel theorem.

\[(h,r,x,z)\longmapsto(\gamma_r(x,z),v_r(x,z)).\]

Corresponding Lean step

arc_joint_measurable; fun_prop

4. Differentiate the actual path

The derivative of pi*r/2 is pi/2. The sine and cosine chain rules, scalar-vector multiplication and addition give the displayed velocity; the cosine derivative contributes the negative sine sign. The proof holds at every real time.

\[\gamma_r^{\prime}=\tfrac\pi2\left(\cos(\tfrac\pi2r)(x-h)-\sin(\tfrac\pi2r)z\right).\]

Corresponding Lean step

arc_derivative; HasDerivAt.sin; HasDerivAt.cos; HasDerivAt.smul_const

5. Evaluate all endpoints and restore the source variance

At zero and pi/2, exact sine and cosine values give the four endpoint identities. The initial position includes the auxiliary Gaussian sample. Finally eta>0 justifies sqrt(eta)^2=eta and specializes the general affine law to the source variance.

\[\gamma_0=h+z,\quad\gamma_1=x,\quad v_0=\tfrac\pi2(x-h),\quad v_1=-\tfrac\pi2z.\]

Corresponding Lean step

arc_endpoints; Real.sq_sqrt; gaussian_arc_law

Lean statement · gaussian_arc_law

Actual product pushforward, joint measurability, pointwise path derivative and four endpoints at the source variance scale.

theorem gaussian_arc_law (eta : ℝ) (heta : 0 < eta) (h : E) :
    (Real.sqrt eta) ^ 2 = eta ∧
    Measurable (fun q : (E × ℝ) × (E × E) =>
      (arc q.1.1 q.1.2 q.2, velocity q.1.1 q.1.2 q.2)) ∧
    (∀ r : ℝ,
      (((stdGaussian E).map (fun x => h + Real.sqrt eta • x)).prod
        ((stdGaussian E).map (fun z => Real.sqrt eta • z))).map
        (fun p => (arc h r p, velocity h r p)) =
      ((stdGaussian E).map (fun x => h + Real.sqrt eta • x)).prod
        ((stdGaussian E).map (fun z => ((Real.pi / 2) * Real.sqrt eta) • z))) ∧
    (∀ (p : E × E) (r : ℝ), HasDerivAt (fun t => arc h t p) (velocity h r p) r) ∧
    (∀ p : E × E, arc h 0 p = h + p.2 ∧ arc h 1 p = p.1 ∧
      velocity h 0 p = (Real.pi / 2) • (p.1 - h) ∧
      velocity h 1 p = -(Real.pi / 2) • p.2)

Exact module and namespace context

Lean proof · gaussian_arc_law

Centered Gaussian rotation invariance, actual affine pushforwards, elementary continuous-map measurability and trigonometric differentiation.

theorem gaussian_arc_law (eta : ℝ) (heta : 0 < eta) (h : E) :
    (Real.sqrt eta) ^ 2 = eta ∧
    Measurable (fun q : (E × ℝ) × (E × E) =>
      (arc q.1.1 q.1.2 q.2, velocity q.1.1 q.1.2 q.2)) ∧
    (∀ r : ℝ,
      (((stdGaussian E).map (fun x => h + Real.sqrt eta • x)).prod
        ((stdGaussian E).map (fun z => Real.sqrt eta • z))).map
        (fun p => (arc h r p, velocity h r p)) =
      ((stdGaussian E).map (fun x => h + Real.sqrt eta • x)).prod
        ((stdGaussian E).map (fun z => ((Real.pi / 2) * Real.sqrt eta) • z))) ∧
    (∀ (p : E × E) (r : ℝ), HasDerivAt (fun t => arc h t p) (velocity h r p) r) ∧
    (∀ p : E × E, arc h 0 p = h + p.2 ∧ arc h 1 p = p.1 ∧
      velocity h 0 p = (Real.pi / 2) • (p.1 - h) ∧
      velocity h 1 p = -(Real.pi / 2) • p.2) := by
  refine ⟨Real.sq_sqrt heta.le, arc_joint_measurable, ?_, ?_, arc_endpoints h⟩
  · intro r
    exact affine_arc_law h (Real.sqrt eta) (Real.pi / 2 * r)
  · intro p r
    exact arc_derivative h p.1 p.2 r


end
end AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.GaussianArcLaw

Exact module and namespace context

Source assumptions versus formal assumptions

Source	Actual Lean	Difference kind	Why it matters
Euclidean position and Gaussian auxiliary with common variance eta, eta>0.	Finite-dimensional real inner product space with Borel structure and explicit second countability; eta>0, actual affine standard-Gaussian product.	generalization	Basis-independent presentation includes zero dimension; no new source geometric restriction.
The interpolation parameter belongs to [0,1].	Joint law and derivative hold for all real times; endpoints 0 and 1 are proved.	generalization	The trigonometric identities and rotation invariance apply for every real angle.
The estimator uses h=x0-eta grad f(x_plus).	Arbitrary fixed center h; joint deterministic map measurable also in h.	generalization	The joint Gaussian law does not need the subsequent gradient assumptions. Actual estimator substitution and moment analysis remain separate.
Joint Gaussian position and velocity are independent with respective covariance eta I and (pi/2)^2 eta I.	Actual full product pushforward equality at standard deviations sqrt eta and (pi/2)sqrt eta.	same	The whole product law, rather than just marginal Gaussian laws, supplies independence.
The gradient estimator is followed by exponential-moment and clipping analysis.	Only Gaussian arc law, derivative, endpoints and deterministic joint measurability are proved.	API-limitation	A prerequisite boundary is explicit; no Claim 1 moment bound, measure-family measurability or full terminal sampler completion is asserted.

This is the actual Gaussian path prerequisite, not an exponential-moment or clipping theorem. The gradient-estimator consumer must separately substitute h=x0-eta grad f(x_plus), establish gradient and reference-point conditions, and prove moment, clipping and target-error bounds. No measurability of the eta-indexed measure family or full terminal sampler is asserted. The external printed Claim 1 log-moment discrepancy is a separate possible-source-error, not silently repaired by this result.

Encoder–denoiser: accepted · domain-mismatch

Detected semantic differences

domains: Basis-independent domain includes zero dimension. — Independent formal reviewer accepted this disclosed delta.
quantifiers: All-real-time law and derivative extend source interval. — Independent formal reviewer accepted this disclosed delta.
assumptions: Arbitrary center is valid; gradient substitution remains separate. — Independent formal reviewer accepted this disclosed delta.
conclusion: Actual product law preserves exact scales and independence. — Independent formal reviewer accepted this disclosed delta.
scopes: No moment, clipping, accuracy or complete sampler assertion. — Independent formal reviewer accepted this disclosed delta.

A generalization is not a source correction. Proposed missing conditions require separate independent repair review. No proposed repair silently changes the original theorem.

Scope and omitted-condition boundaries

This is the actual Gaussian path prerequisite, not an exponential-moment or clipping theorem. The gradient-estimator consumer must separately substitute h=x0-eta grad f(x_plus), establish gradient and reference-point conditions, and prove moment, clipping and target-error bounds. No measurability of the eta-indexed measure family or full terminal sampler is asserted. The external printed Claim 1 log-moment discrepancy is a separate possible-source-error, not silently repaired by this result.

Source and reuse

ASTIS parents called

Mathlib API called (external library)

ProbabilityTheory.IsGaussian.map_rotation_eq_self_of_forall_strongDual_eq_zero
ProbabilityTheory.integral_strongDual_stdGaussian
MeasureTheory.Measure.prod_swap
MeasureTheory.Measure.map_prod_map
MeasureTheory.Measure.map_map
Real.sq_sqrt

Mathematical sources

Appendix D.1 gradient arc and Claim 1 — Actual independent position and velocity law used before exponential-moment analysis.
SPHMC Appendix A.1 and A.4(2) — Terminal gradient-estimator consumer of the external arc construction.

ASTIS prose is not a quotation or a source-equivalence certificate. Definitions and aliases are explained as constructions, not counted as new mathematical proofs.

Which proof edges are actually covered?

TODO — not closed by these contributions Actual independent position and velocity law required before gradient-estimator moment analysis

Gaussian KL reverse transport from the actual quadratic transport budget

Fan Chen, Sinho Chewi, Jianfeng Lu and Matthew S. Zhang; ASTIS expanded proof, no author endorsement implied.

arXiv:2609.06906v1 · Lemma6.3(i), actual quadratic-budget Gaussian KL reverse transport · faithful paraphrase

Complete source statement (ASTIS restatement)

Let P,Q be probability measures on a finite-dimensional real inner-product Borel space E, including dimension zero. Let r>=0 and tau>0. Suppose the actual infimum over couplings gamma of the extended nonnegative integral of ofReal(norm(x-y)^2) is at most ofReal(r^2). Then the actual extended-nonnegative InformationTheory.klDiv of GaussianSmoothing P sqrt(tau) relative to GaussianSmoothing Q sqrt(tau) is at most ofReal(r^2/(2tau)). GaussianSmoothing is the product-noise addition pushforward with centered identity-covariance standard Gaussian, scaled by sqrt(tau). No marginal second moments, optimizer, Gaussian KL formula or target LLR integrability are assumed.

Finite-dimensional real inner-product Borel E, including zero dimension; P,Q probability measures.
r>=0 and tau>0. Zero radius is included; nonnegative radius is retained for its geometric meaning although the algebra uses only r^2.
The actual extended nonnegative infimum quadratic displacement transportCost(P,Q)<=ofReal(r^2) is the input; no optimizer or supplied coupling premise.
Source Lemma6.3(i) uses Euclidean marginal P2 membership and W2. The proved raw-cost formulation and finite-dimensional inner-product domain are explicit generalizations; finite displacement cost does not imply marginal moments.
InformationTheory.klDiv is the actual ENNReal divergence, with absolute continuity and LLR integrability proved before using its real integral formula. No exponential displacement moment is required.

Actual Gaussian KL reverse transport

\[\inf_{\gamma\in\Pi(P,Q)}\int\|x-y\|^2\,d\gamma\le r^2\quad\Longrightarrow\quad\operatorname{KL}(H_\tau P\|H_\tau Q)\le\frac{r^2}{2\tau}.\]

Read the formalized proofs

Each statement and proof below has its own closed Lean disclosure. ASTIS parents, Mathlib calls and external mathematical sources are distinguished in each proof.

ASTIS mathematical exposition

Gaussian KL reverse transport from the actual quadratic transport budget

AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.GaussianKL.gaussian_kl_reverse_transport · theorem · Teaching coverage

Statement

\[\inf_{\gamma\in\Pi(P,Q)}\int\|x-y\|^2\,d\gamma\le r^2\quad\Longrightarrow\quad\operatorname{KL}(H_\tau P\|H_\tau Q)\le\frac{r^2}{2\tau}.\]

All objects and hypotheses

Finite-dimensional real inner-product Borel E, including zero dimension; P,Q probability measures.
r>=0 and tau>0. Zero radius is included; nonnegative radius is retained for its geometric meaning although the algebra uses only r^2.
The actual extended nonnegative infimum quadratic displacement transportCost(P,Q)<=ofReal(r^2) is the input; no optimizer or supplied coupling premise.
Source Lemma6.3(i) uses Euclidean marginal P2 membership and W2. The proved raw-cost formulation and finite-dimensional inner-product domain are explicit generalizations; finite displacement cost does not imply marginal moments.
InformationTheory.klDiv is the actual ENNReal divergence, with absolute continuity and LLR integrability proved before using its real integral formula. No exponential displacement moment is required.

Mathematical proof

1. Attain the genuine quadratic transport cost

Apply the existing optimal-coupling theorem to the continuous nonnegative cost norm(x-y)^2. Its actual optimum equals the infimum in the hypothesis. The finite budget yields integrability of the squared displacement and the real expectation bound; no individual marginal moment is inferred.

\[\exists\gamma\in\Pi(P,Q):\quad\int\|x-y\|^2d\gamma=\inf_{\rho\in\Pi(P,Q)}\int\|x-y\|^2d\rho\le r^2.\]

Corresponding Lean step

OptimalContinuousCost.exists_optimal_coupling; hfinite, hI and hbudget convert only the finite nonnegative integral.

2. Identify the joint Gaussian likelihood as a measure equality

On the actual product gamma times standard Gaussian, retain c=(x,y) and map the noise to x+sqrt(tau)Z or y+sqrt(tau)Z, defining joint probability laws A,B. Nonnegative integral extensionality and the known fixed-center Gaussian likelihood give A=B.withDensity L. The likelihood is jointly measurable; no fiber a.e. identity is promoted to a pointwise joint identity.

\[L(c,z)=\exp\left(\frac{\langle x-y,z-y\rangle}{\tau}-\frac{\|x-y\|^2}{2\tau}\right),\qquad A=L\,B.\]

Corresponding Lean step

jointLikelihood expands the product integral and applies translated_gaussian_likelihood for each retained c.

3. Use the likelihood under the correct joint law

The withDensity equality gives A absolutely continuous with respect to B and RN=L B-a.e. Transfer that equality to A-a.e. using absolute continuity. Under A, z=x+sqrt(tau)Z, so the log likelihood has a positive quadratic term and a centered inner-product term.

\[\log L(c,x+\sqrt\tau Z)=\frac{\|x-y\|^2}{2\tau}+\frac{\langle x-y,Z\rangle}{\sqrt\tau}.\]

Corresponding Lean step

hrn then hac.ae_eq yields hlog; llrAlgebra proves the exact A-parameterized identity.

4. Prove absolute integrability before taking expectations

The bound norm(d)<=1+norm(d)^2 gives displacement integrability. Product integrability of the inner product follows from abs(inner(d,Z))<=norm(d)norm(Z) and the Gaussian first moment. Fubini and the continuous linear inner-product functional then give zero expectation, using the actual product measure and Gaussian zero mean.

\[\mathbb E_{\gamma\otimes G}|\langle x-y,Z\rangle|<\infty,\qquad\mathbb E_{\gamma\otimes G}\langle x-y,Z\rangle=0.\]

Corresponding Lean step

crossMoment uses Integrable.op_fst_snd, integral_prod, continuous-linear-map integral interchange and integral_id_stdGaussian.

5. Calculate the actual joint KL divergence

Both terms of the pulled-back LLR are integrable. Transfer integrability through the measurable map and the A-a.e. LLR identity. Apply the actual klDiv formula; the probability mass corrections cancel, leaving the quadratic displacement expectation divided by 2tau.

\[\operatorname{KL}(A\|B)=\frac1{2\tau}\int\|x-y\|^2d\gamma.\]

Corresponding Lean step

jointKL proves Integrable(llr A B) A before klDiv_of_ac_of_integrable; all real integral manipulations are justified.

6. Identify both actual output marginals

Project each retained-parameter joint law to its output coordinate. Composition of pushforwards and the product-map identity show that the marginals are the existing GaussianSmoothing operators applied to the actual coupling marginals P,Q.

\[(\operatorname{snd})_\#A=H_\tau P,\qquad(\operatorname{snd})_\#B=H_\tau Q.\]

Corresponding Lean step

gaussianMarginal uses Measure.map_prod_map and Measure.map_map; hAP,hBQ use hcouple.1 and hcouple.2.

7. Apply KL data processing and the finite budget

Apply the existing actual KL data-processing inequality to the same output projection for A and B. Substitute the exact joint KL and actual marginal identities, then divide the proved budget by positive 2tau and use ENNReal.ofReal monotonicity.

\[\operatorname{KL}(H_\tau P\|H_\tau Q)\le\operatorname{KL}(A\|B)\le\frac{r^2}{2\tau}.\]

Corresponding Lean step

InformationTheory.klDiv_map_le followed by hj, hAP, hBQ and hbudget. No totalized-toReal shortcut, Renyi limit, or TV-to-cost transfer.

Lean statement · gaussian_kl_reverse_transport

Actual ENNReal KL of Gaussian smoothing is bounded by r^2/(2tau) from the true quadratic transport budget.

theorem gaussian_kl_reverse_transport {E : Type*} [NormedAddCommGroup E] [InnerProductSpace ℝ E]
    [FiniteDimensional ℝ E] [MeasurableSpace E] [BorelSpace E]
    (P Q : Measure E) [IsProbabilityMeasure P] [IsProbabilityMeasure Q]
    (r τ : ℝ) (_hr : 0 ≤ r) (hτ : 0 < τ)
    (hcost : Transport.transportCost (fun z : E × E => ENNReal.ofReal (‖z.1-z.2‖^2)) P Q ≤
      ENNReal.ofReal (r^2)) :
    InformationTheory.klDiv (GaussianSmoothing.gaussianSmoothing P (Real.sqrt τ))
      (GaussianSmoothing.gaussianSmoothing Q (Real.sqrt τ)) ≤ ENNReal.ofReal (r^2/(2*τ))

Exact module and namespace context

Lean proof · gaussian_kl_reverse_transport

Actual optimal coupling, joint Gaussian likelihood and integrable LLR formula, followed by exact marginal identification and KL data processing.

theorem gaussian_kl_reverse_transport {E : Type*} [NormedAddCommGroup E] [InnerProductSpace ℝ E]
    [FiniteDimensional ℝ E] [MeasurableSpace E] [BorelSpace E]
    (P Q : Measure E) [IsProbabilityMeasure P] [IsProbabilityMeasure Q]
    (r τ : ℝ) (_hr : 0 ≤ r) (hτ : 0 < τ)
    (hcost : Transport.transportCost (fun z : E × E => ENNReal.ofReal (‖z.1-z.2‖^2)) P Q ≤
      ENNReal.ofReal (r^2)) :
    InformationTheory.klDiv (GaussianSmoothing.gaussianSmoothing P (Real.sqrt τ))
      (GaussianSmoothing.gaussianSmoothing Q (Real.sqrt τ)) ≤ ENNReal.ofReal (r^2/(2*τ)) := by
  have crossMoment (γ : Measure (E × E)) [IsProbabilityMeasure γ]
      (h2 : Integrable (fun c : E × E => ‖c.1-c.2‖^2) γ) :
      Integrable (fun z : (E × E) × E => inner ℝ (z.1.1-z.1.2) z.2)
        (γ.prod (stdGaussian E)) ∧
      (∫ z : (E × E) × E, inner ℝ (z.1.1-z.1.2) z.2 ∂γ.prod (stdGaussian E)) = 0 := by
    have hd : Integrable (fun c : E × E => c.1-c.2) γ := by
      apply Integrable.mono' ((integrable_const (1 : ℝ)).add h2) (by fun_prop)
      filter_upwards [] with c
      change ‖c.1-c.2‖ ≤ 1 + ‖c.1-c.2‖^2
      have hn := norm_nonneg (c.1-c.2)
      nlinarith [sq_nonneg (‖c.1-c.2‖-1)]
    have hz : Integrable (fun z : E => z) (stdGaussian E) := IsGaussian.integrable_id
    have hi : Integrable (fun z : (E × E) × E => inner ℝ (z.1.1-z.1.2) z.2)
        (γ.prod (stdGaussian E)) :=
      hd.op_fst_snd (by fun_prop) ⟨1, by intro x y; simpa using abs_real_inner_le_norm x y⟩ hz
    refine ⟨hi, ?_⟩
    rw [integral_prod _ hi]
    have hm (c : E × E) : (∫ z : E, inner ℝ (c.1-c.2) z ∂stdGaussian E) = 0 := by
      change (∫ z : E, (innerSL ℝ (c.1-c.2)) z ∂stdGaussian E) = 0
      rw [(innerSL ℝ (c.1-c.2)).integral_comp_comm hz]
      simp [integral_id_stdGaussian]
    simp_rw [hm]
    simp
  have jointLikelihood (γ : Measure (E × E)) [IsProbabilityMeasure γ]
      (a b : E × E → E) (ha : Measurable a) (hb : Measurable b)
      (τ : ℝ) (hτ : 0 < τ) :
      let A := (γ.prod (stdGaussian E)).map (fun w => (w.1,a w.1+Real.sqrt τ • w.2))
      let B := (γ.prod (stdGaussian E)).map (fun w => (w.1,b w.1+Real.sqrt τ • w.2))
      let L := fun w : (E × E) × E => ENNReal.ofReal (Real.exp
        (inner ℝ (a w.1-b w.1) (w.2-b w.1)/τ-‖a w.1-b w.1‖^2/(2*τ)))
      Measurable L ∧ A = B.withDensity L := by
    dsimp only
    let L := fun w : (E × E) × E => ENNReal.ofReal (Real.exp
      (inner ℝ (a w.1-b w.1) (w.2-b w.1)/τ-‖a w.1-b w.1‖^2/(2*τ)))
    have hL : Measurable L := by unfold L; fun_prop
    refine ⟨hL, ?_⟩
    apply Measure.ext_of_lintegral
    intro f hf
    rw [lintegral_map hf (by fun_prop),lintegral_prod _ (by fun_prop),
      lintegral_withDensity_eq_lintegral_mul _ hL hf,
      lintegral_map (hL.mul hf) (by fun_prop),lintegral_prod _ (by fun_prop)]
    apply lintegral_congr
    intro c
    change (∫⁻ z, f (c,a c+Real.sqrt τ • z) ∂stdGaussian E) =
      ∫⁻ z, L (c,b c+Real.sqrt τ • z) * f (c,b c+Real.sqrt τ • z) ∂stdGaussian E
    have hf' : Measurable (fun z : E => f (c,z)) := hf.comp (measurable_const.prodMk measurable_id)
    have hLc : Measurable (fun z : E => L (c,z)) := hL.comp (measurable_const.prodMk measurable_id)
    have hlaw := (GaussianLikelihood.translated_gaussian_likelihood (a c) (b c) τ hτ).2.1
    dsimp only at hlaw
    calc
      _ = ∫⁻ z, f (c,z) ∂(stdGaussian E).map (fun z => a c+Real.sqrt τ • z) :=
        (lintegral_map hf' (by fun_prop)).symm
      _ = ∫⁻ z, L (c,z)*f (c,z) ∂(stdGaussian E).map (fun z => b c+Real.sqrt τ • z) := by
        rw [hlaw,lintegral_withDensity_eq_lintegral_mul _ (by fun_prop) hf']
        rfl
      _ = _ := lintegral_map (show Measurable (fun z => L (c,z)*f (c,z)) from hLc.mul hf') (by fun_prop)
  have llrAlgebra (x y z : E) (τ : ℝ) (hτ : 0 < τ) :
      inner ℝ (x-y) (x+Real.sqrt τ • z-y)/τ-‖x-y‖^2/(2*τ) =
        ‖x-y‖^2/(2*τ)+inner ℝ (x-y) z/Real.sqrt τ := by
    have hs : Real.sqrt τ ≠ 0 := (Real.sqrt_pos.mpr hτ).ne'
    rw [show x+Real.sqrt τ • z-y = (x-y)+Real.sqrt τ • z by abel,
      inner_add_right,real_inner_smul_right,real_inner_self_eq_norm_sq]
    have ht : τ = (Real.sqrt τ)^2 := (Real.sq_sqrt hτ.le).symm
    rw [ht]
    rw [Real.sqrt_sq (Real.sqrt_nonneg τ)]
    field_simp
    ring
  have jointKL (γ : Measure (E × E)) [IsProbabilityMeasure γ]
      (h2 : Integrable (fun c : E × E => ‖c.1-c.2‖^2) γ)
      (τ : ℝ) (hτ : 0 < τ) :
      let A := (γ.prod (stdGaussian E)).map (fun w => (w.1,w.1.1+Real.sqrt τ • w.2))
      let B := (γ.prod (stdGaussian E)).map (fun w => (w.1,w.1.2+Real.sqrt τ • w.2))
      InformationTheory.klDiv A B = ENNReal.ofReal ((∫ c, ‖c.1-c.2‖^2 ∂γ)/(2*τ)) := by
    let F := fun w : (E × E) × E => (w.1,w.1.1+Real.sqrt τ • w.2)
    let G := fun w : (E × E) × E => (w.1,w.1.2+Real.sqrt τ • w.2)
    let A := (γ.prod (stdGaussian E)).map F
    let B := (γ.prod (stdGaussian E)).map G
    let ℓ := fun w : (E × E) × E => inner ℝ (w.1.1-w.1.2) (w.2-w.1.2)/τ-‖w.1.1-w.1.2‖^2/(2*τ)
    let L := fun w => ENNReal.ofReal (Real.exp (ℓ w))
    have hF : Measurable F := by unfold F; fun_prop
    have hG : Measurable G := by unfold G; fun_prop
    have hℓ : Measurable ℓ := by unfold ℓ; fun_prop
    have hL : Measurable L := by unfold L; fun_prop
    have hA : IsProbabilityMeasure A := Measure.isProbabilityMeasure_map hF.aemeasurable
    have hB : IsProbabilityMeasure B := Measure.isProbabilityMeasure_map hG.aemeasurable
    let := hA
    let := hB
    have hab : A = B.withDensity L :=
      (jointLikelihood γ Prod.fst Prod.snd measurable_fst measurable_snd τ hτ).2
    have hac : A ≪ B := by rw [hab]; exact withDensity_absolutelyContinuous _ _
    have hrn : A.rnDeriv B =ᵐ[B] L := by rw [hab]; exact Measure.rnDeriv_withDensity _ hL
    have hlog : llr A B =ᵐ[A] ℓ := by
      filter_upwards [hac.ae_eq hrn] with w hw
      simp only [llr,hw,L,ENNReal.toReal_ofReal (Real.exp_pos _).le,Real.log_exp]
    have hpull : (fun w => ℓ (F w)) = fun w : (E × E) × E =>
        ‖w.1.1-w.1.2‖^2/(2*τ)+inner ℝ (w.1.1-w.1.2) w.2/Real.sqrt τ := by
      funext w
      exact llrAlgebra w.1.1 w.1.2 w.2 τ hτ
    obtain ⟨hc,hcz⟩ := crossMoment γ h2
    have hip : Integrable (fun w => ℓ (F w)) (γ.prod (stdGaussian E)) := by
      rw [hpull]
      exact ((h2.comp_fst (stdGaussian E)).div_const _).add (hc.div_const _)
    have hiℓ : Integrable ℓ A := (integrable_map_measure hℓ.aestronglyMeasurable hF.aemeasurable).mpr hip
    have hillr : Integrable (llr A B) A := hiℓ.congr hlog.symm
    have hfstint : (∫ w : (E × E) × E, ‖w.1.1-w.1.2‖^2 ∂γ.prod (stdGaussian E)) =
        ∫ c : E × E, ‖c.1-c.2‖^2 ∂γ := by
      simpa using (integral_fun_fst (μ := γ) (ν := stdGaussian E) (fun c : E × E => ‖c.1-c.2‖^2))
    have hint : (∫ w, ℓ w ∂A) = (∫ c, ‖c.1-c.2‖^2 ∂γ)/(2*τ) := by
      rw [show A = (γ.prod (stdGaussian E)).map F from rfl,
        integral_map hF.aemeasurable hℓ.aestronglyMeasurable]
      change (∫ w, (fun w => ℓ (F w)) w ∂γ.prod (stdGaussian E)) = _
      rw [hpull,integral_add ((h2.comp_fst _).div_const _) (hc.div_const _),
        integral_div,integral_div,hcz]
      rw [hfstint]
      simp
    change InformationTheory.klDiv A B = _
    rw [InformationTheory.klDiv_of_ac_of_integrable hac hillr,integral_congr_ae hlog,hint]
    simp
  have gaussianMarginal (γ : Measure (E × E)) [IsProbabilityMeasure γ]
      (a : E × E → E) (ha : Measurable a) (τ : ℝ) :
      ((γ.prod (stdGaussian E)).map (fun w => (w.1,a w.1+Real.sqrt τ • w.2))).map Prod.snd =
        GaussianSmoothing.gaussianSmoothing (γ.map a) (Real.sqrt τ) := by
    have hprob : IsProbabilityMeasure (γ.map a) := Measure.isProbabilityMeasure_map ha.aemeasurable
    let := hprob
    have smoothing_law (μ : Measure E) [IsProbabilityMeasure μ] :
        GaussianSmoothing.gaussianSmoothing μ (Real.sqrt τ) =
          (μ.prod (stdGaussian E)).map (fun p => p.1+Real.sqrt τ • p.2) := by
      unfold GaussianSmoothing.gaussianSmoothing CommonNoiseContraction.addNoise
        GaussianSmoothing.scaledStdGaussian
      have hp := Measure.map_prod_map μ (stdGaussian E) measurable_id
        (by fun_prop : Measurable (fun z : E => Real.sqrt τ • z))
      simp only [Measure.map_id] at hp
      rw [hp,Measure.map_map (by fun_prop) (by fun_prop)]
      rfl
    rw [smoothing_law,Measure.map_map measurable_snd (by fun_prop)]
    have hp := Measure.map_prod_map γ (stdGaussian E) ha measurable_id
    simp only [Measure.map_id] at hp
    rw [hp,Measure.map_map (by fun_prop) (by fun_prop)]
    rfl
  have hn (z : E × E) : 0 ≤ ‖z.1-z.2‖^2 := sq_nonneg _
  let c : E × E → ℝ≥0 := fun z => ⟨‖z.1-z.2‖^2,hn z⟩
  have hf : Continuous (fun z : E × E => ‖z.1-z.2‖^2) := by fun_prop
  have hc : Continuous c := hf.subtype_mk _
  obtain ⟨γ,hprob,hcouple,hopt⟩ := OptimalContinuousCost.exists_optimal_coupling P Q c hc
  let : IsProbabilityMeasure γ := hprob
  have heq : (fun z => (c z : ℝ≥0∞)) = (fun z : E × E => ENNReal.ofReal (‖z.1-z.2‖^2)) := by
    funext z
    exact (ENNReal.ofReal_eq_coe_nnreal (hn z)).symm
  rw [heq] at hopt
  have hfinite : (∫⁻ z, ENNReal.ofReal (‖z.1-z.2‖^2) ∂γ) ≠ ∞ :=
    ne_of_lt (lt_of_le_of_lt (hopt.le.trans hcost) ENNReal.ofReal_lt_top)
  have hnon : 0 ≤ᵐ[γ] (fun z : E × E => ‖z.1-z.2‖^2) := Filter.Eventually.of_forall hn
  have hI := (lintegral_ofReal_ne_top_iff_integrable hf.aestronglyMeasurable hnon).mp hfinite
  have hbudget : (∫ z, ‖z.1-z.2‖^2 ∂γ) ≤ r^2 := by
    rw [integral_eq_lintegral_of_nonneg_ae hnon hf.aestronglyMeasurable]
    have hh := ENNReal.toReal_mono ENNReal.ofReal_ne_top (hopt.le.trans hcost)
    simpa [ENNReal.toReal_ofReal (sq_nonneg r)] using hh
  let A := (γ.prod (stdGaussian E)).map (fun w => (w.1,w.1.1+Real.sqrt τ • w.2))
  let B := (γ.prod (stdGaussian E)).map (fun w => (w.1,w.1.2+Real.sqrt τ • w.2))
  have hA : IsProbabilityMeasure A := Measure.isProbabilityMeasure_map (by fun_prop)
  have hB : IsProbabilityMeasure B := Measure.isProbabilityMeasure_map (by fun_prop)
  let := hA
  let := hB
  have hfst : γ.map Prod.fst = P := hcouple.1
  have hsnd : γ.map Prod.snd = Q := hcouple.2
  have hAP : A.map Prod.snd = GaussianSmoothing.gaussianSmoothing P (Real.sqrt τ) := by
    have hh := gaussianMarginal γ Prod.fst measurable_fst τ
    rw [hfst] at hh
    exact hh
  have hBQ : B.map Prod.snd = GaussianSmoothing.gaussianSmoothing Q (Real.sqrt τ) := by
    have hh := gaussianMarginal γ Prod.snd measurable_snd τ
    rw [hsnd] at hh
    exact hh
  have hd := InformationTheory.klDiv_map_le A B measurable_snd
  have hj : InformationTheory.klDiv A B = ENNReal.ofReal ((∫ c, ‖c.1-c.2‖^2 ∂γ)/(2*τ)) :=
    jointKL γ hI τ hτ
  rw [hAP,hBQ,hj] at hd
  exact hd.trans (ENNReal.ofReal_le_ofReal (div_le_div_of_nonneg_right hbudget (by positivity)))

end AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.GaussianKL

Exact module and namespace context

Source assumptions versus formal assumptions

Source	Actual Lean	Difference kind	Why it matters
Lemma6.3(i) states Gaussian KL reverse transport for Euclidean P2 probabilities using W2.	Finite-dimensional real inner-product Borel probabilities including zero dimension, with actual infimum quadratic-cost budget and no marginal moments.	generalization	The proof uses only finite coupling displacement moment, which does not imply marginal second moments; full W2 API identification remains separate.
Positive heat time with exact coefficient 1/(2tau).	tau>0,nonnegative radius r and actual ENNReal KL <=ofReal(r^2/(2tau)).	same	Actual noise scale sqrt(tau), forward KL direction and exact joint LLR formula preserve normalization.
The standard Gaussian regularization inequality is invoked in the A1 stage of Theorem6.5.	Expanded optimal coupling, joint likelihood, proved LLR integrability, exact output marginals and KL data processing.	source-implicit	No Gaussian KL contract, optimizer, target integrability or exponential displacement moment is assumed.
Full recursive sampling main results also require actual conditional kernels and costs.	This actual probability-measure Gaussian KL prerequisite only.	API-limitation	Recursive kernels, full Wasserstein API, sampler error and query-cost statements are not claimed.

Actual ENNReal KL Gaussian reverse transport from a genuine quadratic transport-cost budget. Explicit generalization of Euclidean marginal-P2/W2 presentation; no marginal moments inferred. Full W2 API identification, recursive kernels, sampler errors and query costs remain separate.

Encoder–denoiser: accepted · domain-mismatch

Detected semantic differences

domains: Explicit finite-dimensional generalization includes zero dimension. — No positive dimension or division by dimension.
assumptions: Raw displacement-cost budget generalizes marginal P2; no marginal moment inference. — Optimum and displacement integrability derived; marginal moments neither used nor concluded.
conclusion: Radius r^2 budget, not a full W2 metric API identity. — Disclosed radius budget; actual divergence, not totalized toReal. Full W2 identity separate.
scopes: Joint likelihood and KL projection elaborate the source short joint-convexity argument without Gaussian KL or exponential-moment premises. — Recursive kernels, sampler errors and query costs excluded.

A generalization is not a source correction. Proposed missing conditions require separate independent repair review. No proposed repair silently changes the original theorem.

Scope and omitted-condition boundaries

Actual ENNReal KL Gaussian reverse transport from a genuine quadratic transport-cost budget. Explicit generalization of Euclidean marginal-P2/W2 presentation; no marginal moments inferred. Full W2 API identification, recursive kernels, sampler errors and query costs remain separate.

Source and reuse

ASTIS parents called

Mathlib API called (external library)

InformationTheory.klDiv_map_le
InformationTheory.klDiv_of_ac_of_integrable
MeasureTheory.Integrable.op_fst_snd
ProbabilityTheory.integral_id_stdGaussian

Mathematical sources

Chen, Chewi, Lu and Zhang, SPHMC v1 Lemma6.3(i) — Expanded actual-budget Gaussian regularization inequality used by Theorem6.5 A1; not a proof of the full recursive algorithm.

ASTIS prose is not a quotation or a source-equivalence certificate. Definitions and aliases are explained as constructions, not counted as new mathematical proofs.

Which proof edges are actually covered?

TODO — not closed by these contributions Actual ENNReal Gaussian KL bound from the true quadratic transport infimum

Power perspective from Holder with infinite moments allowed

Fan Chen, Sinho Chewi, Jianfeng Lu and Matthew S. Zhang; ASTIS expanded ingredient proof, no author endorsement implied.

arXiv:2609.06906v1 · Lemma6.3(ii) expanded Holder perspective · faithful paraphrase

Complete source statement (ASTIS restatement)

Let mu be any measure on a measurable space and a,b be almost-everywhere measurable extended nonnegative functions. Suppose b is positive and finite almost everywhere and its integral B is positive and finite. For real q>1, the qth power of integral a divided by B^(q-1) is at most the integral of a^q/b^(q-1). Neither the numerator integral nor the right-hand integral is assumed finite.

Any measurable space and measure mu; no probability or sigma-finiteness assumption is required for this scalar inequality.
a,b are ENNReal-valued and a.e. measurable. The denominator b is nonzero and finite mu-a.e.
The integral of b is nonzero and finite, and real q>1.
The integral of a and of a^q/b^(q-1) may be infinite. This general measure inequality is an expanded ingredient, not a printed paper theorem.

Integral perspective

\[\frac{(\int a\,d\mu)^q}{(\int b\,d\mu)^{q-1}}\le\int\frac{a^q}{b^{q-1}}\,d\mu,\qquad q>1,\quad 0<\int b\,d\mu<\infty.\]

Read the formalized proofs

Each statement and proof below has its own closed Lean disclosure. ASTIS parents, Mathlib calls and external mathematical sources are distinguished in each proof.

ASTIS mathematical exposition

Power perspective from Holder with infinite moments allowed

AutoSamplingTheory.TechnicalLemmas.Measure.PowerPerspective.lintegral_perspective_le · theorem · Teaching coverage

Statement

\[\frac{(\int a\,d\mu)^q}{(\int b\,d\mu)^{q-1}}\le\int\frac{a^q}{b^{q-1}}\,d\mu,\qquad q>1,\quad 0<\int b\,d\mu<\infty.\]

All objects and hypotheses

Any measurable space and measure mu; no probability or sigma-finiteness assumption is required for this scalar inequality.
a,b are ENNReal-valued and a.e. measurable. The denominator b is nonzero and finite mu-a.e.
The integral of b is nonzero and finite, and real q>1.
The integral of a and of a^q/b^(q-1) may be infinite. This general measure inequality is an expanded ingredient, not a printed paper theorem.

Mathematical proof

1. Reconstruct the numerator pointwise

Set F=a^q/b^(q-1), alpha=1/q and beta=1-1/q. Positive finite b permits cancellation of b^beta, while a may be zero or infinite. Therefore F^alpha b^beta=a almost everywhere.

\[F^{1/q}b^{1-1/q}=\frac{a}{b^{1-1/q}}b^{1-1/q}=a.\]

Corresponding Lean step

ENNReal.div_rpow_of_nonneg, rpow_mul and div_mul_cancel with explicit nonzero/finite denominator.

2. Apply nonnegative integral Holder

The exponents alpha,beta are nonnegative and sum to one. Extended nonnegative Holder gives A<=C^(1/q) B^beta for A=integral a and C=integral F. This theorem does not require either A or C finite.

\[A\le C^{1/q}B^{1-1/q}.\]

Corresponding Lean step

ENNReal.lintegral_mul_norm_pow_le and lintegral_congr_ae use the reconstruction, retaining infinite branches.

3. Raise the inequality to q

Since q>0, raising both sides preserves order. Real-power multiplication identities hold in ENNReal for these nonnegative powers and give A^q<=C B^(q-1).

\[A^q\le C B^{q-1}.\]

Corresponding Lean step

ENNReal.rpow_le_rpow, mul_rpow_of_nonneg and rpow_mul; exact scalar exponent identities.

4. Divide by the positive finite denominator integral

B is positive and finite, so B^(q-1) is nonzero and finite. The extended-real division equivalence gives the claimed perspective inequality without converting an infinite quantity to a real number.

\[\frac{A^q}{B^{q-1}}\le C.\]

Corresponding Lean step

ENNReal.div_le_iff, rpow_pos and rpow_ne_top_of_nonneg.

Lean statement · lintegral_perspective_le

The extended nonnegative integral power-perspective inequality with only positive finite denominator conditions.

theorem lintegral_perspective_le {X : Type*} [MeasurableSpace X] (μ : Measure X)
    (a b : X → ℝ≥0∞) (ha : AEMeasurable a μ) (hb : AEMeasurable b μ)
    (hbpos : ∀ᵐ x ∂μ, b x ≠ 0 ∧ b x ≠ ⊤)
    (hB0 : (∫⁻ x, b x ∂μ) ≠ 0) (hBtop : (∫⁻ x, b x ∂μ) ≠ ⊤)
    (q : ℝ) (hq : 1 < q) :
    (∫⁻ x, a x ∂μ)^q / (∫⁻ x, b x ∂μ)^(q-1) ≤
      ∫⁻ x, a x^q / b x^(q-1) ∂μ

Exact module and namespace context

Lean proof · lintegral_perspective_le

Direct Holder, pointwise reconstruction and exact power/division algebra; no assumed perspective or moment inequality.

theorem lintegral_perspective_le {X : Type*} [MeasurableSpace X] (μ : Measure X)
    (a b : X → ℝ≥0∞) (ha : AEMeasurable a μ) (hb : AEMeasurable b μ)
    (hbpos : ∀ᵐ x ∂μ, b x ≠ 0 ∧ b x ≠ ⊤)
    (hB0 : (∫⁻ x, b x ∂μ) ≠ 0) (hBtop : (∫⁻ x, b x ∂μ) ≠ ⊤)
    (q : ℝ) (hq : 1 < q) :
    (∫⁻ x, a x ∂μ)^q / (∫⁻ x, b x ∂μ)^(q-1) ≤
      ∫⁻ x, a x^q / b x^(q-1) ∂μ := by
  have hq0 : 0 < q := by linarith
  have hi : 0 ≤ 1/q := by positivity
  have hj : 0 ≤ 1-1/q := by rw [sub_nonneg,div_le_one hq0]; linarith
  have he1 : q*(1/q) = 1 := by field_simp
  have he2 : (q-1)*(1/q) = 1-1/q := by field_simp
  have he3 : (1-1/q)*q = q-1 := by field_simp
  have hrec : (fun x => (a x^q / b x^(q-1))^(1/q) * b x^(1-1/q)) =ᵐ[μ] a := by
    filter_upwards [hbpos] with x hx
    rw [ENNReal.div_rpow_of_nonneg _ _ hi, ← ENNReal.rpow_mul,
      ← ENNReal.rpow_mul,he1,he2,ENNReal.rpow_one]
    exact ENNReal.div_mul_cancel
      (ne_of_gt (ENNReal.rpow_pos (pos_iff_ne_zero.mpr hx.1) hx.2))
      (ENNReal.rpow_ne_top_of_nonneg hj hx.2)
  have h := ENNReal.lintegral_mul_norm_pow_le
    ((ha.pow_const q).div (hb.pow_const (q-1))) hb hi hj (by ring : 1/q+(1-1/q)=1)
  change (∫⁻ x, (a x^q / b x^(q-1))^(1/q) * b x^(1-1/q) ∂μ) ≤
    (∫⁻ x, a x^q / b x^(q-1) ∂μ)^(1/q) * (∫⁻ x, b x ∂μ)^(1-1/q) at h
  rw [lintegral_congr_ae hrec] at h
  have hh := ENNReal.rpow_le_rpow h hq0.le
  rw [ENNReal.mul_rpow_of_nonneg _ _ hq0.le, ← ENNReal.rpow_mul,
    ← ENNReal.rpow_mul,he3,mul_comm (1/q) q,he1,ENNReal.rpow_one] at hh
  exact (ENNReal.div_le_iff
    (ne_of_gt (ENNReal.rpow_pos (pos_iff_ne_zero.mpr hB0) hBtop))
    (ENNReal.rpow_ne_top_of_nonneg (by linarith) hBtop)).mpr hh

end AutoSamplingTheory.TechnicalLemmas.Measure.PowerPerspective

Exact module and namespace context

Source assumptions versus formal assumptions

Source	Actual Lean	Difference kind	Why it matters
SPHMC Lemma6.3(ii) invokes Gaussian reverse transport on Euclidean probability measures with marginal Pp membership.	Arbitrary measurable space and measure for the scalar Holder perspective.	generalization	Explicit expanded ingredient with independently proved denominator conditions; finite displacement does not imply marginal moments.
The full lemma first chooses one truncation proxy, then applies the Winfinity Gaussian reverse-transport bound for all q>1.	Scalar integral perspective only.	API-limitation	No truncation composition, complete Wasserstein/Renyi API, warmness recursion or sampler cost is claimed.
Positive heat time, q>1 and coefficient q/(2tau).	Real q>1; in the consumer tau>0,t>=0 and exact q(q-1)t^2/(2tau) moment and qt^2/(2tau) logarithm bounds.	same	Covariance tau I comes from sqrt(tau) noise. RN direction and denominator law agree.
Mixture density, Holder and finite-moment details omitted in the invoked standard reverse-transport step.	Positive finite denominator conditions explicit in shared leaf; all Gaussian mixture densities, actual laws, integrability and log positivity proved in consumer.	source-implicit	No assumed mixture inequality or Gaussian density/moment contract replaces the proof.

Expanded bounded-displacement Gaussian mixture ingredient of SPHMC Lemma6.3(ii). The actual coupling is supplied; choosing a single truncation proxy before all q remains separate. No marginal moment conclusion, complete Wasserstein/Renyi API, proxy-warmness, sampler or query-cost theorem.

Encoder–denoiser: accepted · domain-mismatch

Detected semantic differences

domains: Explicit generalization beyond Euclidean probability application. — Only MeasurableSpace X and Measure X domain data.
scopes: Selected expanded prerequisite, not equivalence with complete printed Lemma6.3(ii). — Documentation and publication explicitly keep Gaussian application and truncation separate.

A generalization is not a source correction. Proposed missing conditions require separate independent repair review. No proposed repair silently changes the original theorem.

Scope and omitted-condition boundaries

Expanded bounded-displacement Gaussian mixture ingredient of SPHMC Lemma6.3(ii). The actual coupling is supplied; choosing a single truncation proxy before all q remains separate. No marginal moment conclusion, complete Wasserstein/Renyi API, proxy-warmness, sampler or query-cost theorem.

Source and reuse

ASTIS parents called

Mathlib API called (external library)

ENNReal.lintegral_mul_norm_pow_le
ENNReal.div_le_iff
ENNReal.rpow_mul

Mathematical sources

Chen, Chewi, Lu and Zhang, SPHMC v1 Lemma6.3(ii) — Expanded proof of the bounded-displacement Gaussian reverse-transport ingredient; original truncation composition separate.

ASTIS prose is not a quotation or a source-equivalence certificate. Definitions and aliases are explained as constructions, not counted as new mathematical proofs.

Which proof edges are actually covered?

TODO — not closed by these contributions Extended nonnegative Holder perspective with potentially infinite numerator and right side

Actual Gaussian mixture reverse transport from a bounded coupling

Fan Chen, Sinho Chewi, Jianfeng Lu and Matthew S. Zhang; ASTIS expanded ingredient proof, no author endorsement implied.

arXiv:2609.06906v1 · Lemma6.3(ii) bounded-displacement Gaussian mixture ingredient · faithful paraphrase

Complete source statement (ASTIS restatement)

Let P,Q be probability measures on a finite-dimensional real inner-product Borel space E and gamma an actual coupling of P,Q. Suppose tau>0, real q>1, t>=0 and norm(x-y)<=t gamma-a.e. Set Hmu=GaussianSmoothing.gaussianSmoothing mu (sqrt tau), the existing law of independent additive Gaussian noise. Then HP is absolutely continuous with respect to HQ. Its actual ENNReal RN qth-power integral is bounded by ofReal exp(q(q-1)t^2/(2tau)); the real RN qth power is integrable, its integral has the same exponential upper bound, and its logarithm divided by q-1 is at most q t^2/(2tau).

Finite-dimensional real inner-product Borel E, including zero dimension; P,Q are probability measures.
gamma has the actual P,Q marginals. Its probability property is derived from the coupling and P, not separately assumed.
tau>0, real q>1, t>=0, and norm(x-y)<=t gamma-a.e.; t=0 is allowed.
No density identity, reverse-transport inequality, moment integrability or marginal p-moment assumption is supplied. Dropping source marginal Pp membership for this bounded ingredient is an explicit valid generalization.
The source uses this ingredient after choosing a truncation proxy. That choice, its all-q quantifier, full Wasserstein/Renyi API and warm-start recursion are separate.

Actual Gaussian mixture RN bound

\[H_\tau P\ll H_\tau Q,\qquad\int\!\left(\frac{dH_\tau P}{dH_\tau Q}\right)^q dH_\tau Q\le e^{q(q-1)t^2/(2\tau)},\qquad\frac{\log\int(dH_\tau P/dH_\tau Q)^q\,dH_\tau Q}{q-1}\le\frac{qt^2}{2\tau}.\]

Read the formalized proofs

Each statement and proof below has its own closed Lean disclosure. ASTIS parents, Mathlib calls and external mathematical sources are distinguished in each proof.

ASTIS mathematical exposition

Actual Gaussian mixture reverse transport from a bounded coupling

AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.GaussianMixture.bounded_displacement_reverse_transport · theorem · Teaching coverage

Statement

\[H_\tau P\ll H_\tau Q,\qquad\int\!\left(\frac{dH_\tau P}{dH_\tau Q}\right)^q dH_\tau Q\le e^{q(q-1)t^2/(2\tau)},\qquad\frac{\log\int(dH_\tau P/dH_\tau Q)^q\,dH_\tau Q}{q-1}\le\frac{qt^2}{2\tau}.\]

All objects and hypotheses

Finite-dimensional real inner-product Borel E, including zero dimension; P,Q are probability measures.
gamma has the actual P,Q marginals. Its probability property is derived from the coupling and P, not separately assumed.
tau>0, real q>1, t>=0, and norm(x-y)<=t gamma-a.e.; t=0 is allowed.
No density identity, reverse-transport inequality, moment integrability or marginal p-moment assumption is supplied. Dropping source marginal Pp membership for this bounded ingredient is an explicit valid generalization.
The source uses this ingredient after choosing a truncation proxy. That choice, its all-q quantifier, full Wasserstein/Renyi API and warm-start recursion are separate.

Mathematical proof

1. Identify actual Gaussian and mixture densities

Translate the existing scaled standard-Gaussian volume density to each center. For an arbitrary probability mu, test both candidate measures against every measurable ENNReal function. The product-map integral and Tonelli show that independent Gaussian addition equals volume.withDensity of the actual mixture density.

\[g_\tau(x,z)=C_\tau e^{-\|z-x\|^2/(2\tau)},\qquad H_\tau\mu(dz)=\left(\int g_\tau(x,z)\,d\mu(x)\right)dz.\]

Corresponding Lean step

Local gd_law and mix_density use IsotropicGaussianDensity, translation invariance, Measure.ext_of_lintegral, lintegral_map and Tonelli. Local smoothing_law identifies the existing GaussianSmoothing API.

2. Prove the mixture densities positive and finite

Every Gaussian density lies strictly between zero and the finite constant C_tau. Its average under a probability therefore is finite. If this average were zero, the density would vanish almost everywhere, contradicting its strict positivity and the nonzero probability measure.

\[0<g_\tau(x,z)\le C_\tau,\qquad 0<\int g_\tau(x,z)\,d\mu(x)\le C_\tau<\infty.\]

Corresponding Lean step

Local gd_bounds and mix_bounds derive the conditions for division and RN identification; no marginal moments are used.

3. Identify the actual RN power integral

For measurable densities a,b with b positive and finite, withDensity multiplication proves volume.withDensity a=(volume.withDensity b).withDensity(a/b). Thus the actual RN derivative is a/b almost everywhere under the denominator law. Exact nonnegative power algebra turns its qth-power integral into the volume integral of a^q/b^(q-1).

\[\int\left(\frac{d(a\,dz)}{d(b\,dz)}\right)^q b\,dz=\int\frac{a^q}{b^{q-1}}\,dz.\]

Corresponding Lean step

Local density_power derives absolute continuity and the integral identity from withDensity_mul and Measure.rnDeriv_withDensity. The direction and reference measure are preserved.

4. Reuse the exact single-Gaussian moment

Apply the previous actual Gaussian RN power-moment theorem at each fixed pair of centers. Its proven integrability identifies the ENNReal integral after finite RN conversion. Combined with the density identity, this gives the exact fiber integral; no a.e. equality is promoted to a joint pointwise statement.

\[\int\frac{g_\tau(x,z)^q}{g_\tau(y,z)^{q-1}}\,dz=e^{q(q-1)\|x-y\|^2/(2\tau)}.\]

Corresponding Lean step

Local gd_power_moment calls GaussianPowerMoment.gaussian_power_moment, density_power and ofReal_integral_eq_lintegral_ofReal.

5. Apply Holder and Tonelli over the actual coupling

For each z, the coupling marginals express the smoothed densities as averages of g_tau(x,z) and g_tau(y,z). Apply the shared perspective inequality, then exchange nonnegative integrals by Tonelli and substitute the fixed-center formula. Intermediate integrals may be infinite.

\[\int\frac{(\int g_x\,d\gamma)^q}{(\int g_y\,d\gamma)^{q-1}}\,dz\le\int e^{q(q-1)\|x-y\|^2/(2\tau)}\,d\gamma.\]

Corresponding Lean step

Local mixture_power_bound calls PowerPerspective.lintegral_perspective_le; joint measurability and probability/volume sigma-finiteness justify Tonelli.

6. Use bounded displacement to establish finite moments

The nonnegative coefficient q(q-1)/(2tau) and a.e. displacement bound make the last integrand at most exp(q(q-1)t^2/(2tau)). Since gamma is a probability, this proves a finite ENNReal bound. Only now derive integrability of the real RN power and its real integral bound.

\[\int e^{q(q-1)\|x-y\|^2/(2\tau)}\,d\gamma\le e^{q(q-1)t^2/(2\tau)}<\infty.\]

Corresponding Lean step

Local bounded_mix derives gamma marginal mixture identities, integrable_toReal_of_lintegral_ne_top and integral_toReal; rnDeriv_lt_top justifies finite conversion.

7. Prove positivity before taking the logarithm

Both mixture densities are positive, so the smoothed laws are mutually absolutely continuous. Reverse absolute continuity gives positivity of the forward RN derivative under HQ; its qth-power integral is positive. Log monotonicity and division by q-1>0 give the exact normalized bound. Neither t nor the dimension is divided by.

\[0<\int(dH_\tau P/dH_\tau Q)^q\,dH_\tau Q,\qquad\frac{q(q-1)t^2}{2\tau(q-1)}=\frac{qt^2}{2\tau}.\]

Corresponding Lean step

Measure.rnDeriv_pos', lintegral_eq_zero_iff, ENNReal.toReal_pos, Real.log_le_log and exact cancellation. The final public statement uses GaussianSmoothing directly.

Lean statement · bounded_displacement_reverse_transport

Actual GaussianSmoothing absolute continuity, ENNReal power bound, real-power integrability and integral bound, and normalized logarithm bound.

theorem bounded_displacement_reverse_transport {E : Type*} [NormedAddCommGroup E] [InnerProductSpace ℝ E]
    [FiniteDimensional ℝ E] [MeasurableSpace E] [BorelSpace E]
    (P Q : Measure E) [IsProbabilityMeasure P] [IsProbabilityMeasure Q]
    (γ : Measure (E × E))
    (hγ : Transport.IsCoupling γ P Q)
    (τ q t : ℝ) (hτ : 0 < τ) (hq : 1 < q) (ht : 0 ≤ t)
    (hdisp : ∀ᵐ c ∂γ, ‖c.1-c.2‖ ≤ t) :
    let H := fun μ : Measure E => GaussianSmoothing.gaussianSmoothing μ (Real.sqrt τ)
    H P ≪ H Q ∧
      (∫⁻ z, ((H P).rnDeriv (H Q) z)^q ∂H Q) ≤ ENNReal.ofReal (Real.exp (q*(q-1)*t^2/(2*τ))) ∧
      Integrable (fun z => ((H P).rnDeriv (H Q) z).toReal^q) (H Q) ∧
      (∫ z, ((H P).rnDeriv (H Q) z).toReal^q ∂H Q) ≤ Real.exp (q*(q-1)*t^2/(2*τ)) ∧
      Real.log (∫ z, ((H P).rnDeriv (H Q) z).toReal^q ∂H Q)/(q-1) ≤ q*t^2/(2*τ)

Exact module and namespace context

Lean proof · bounded_displacement_reverse_transport

All Gaussian-density, mixture, RN, fiber, finite-moment and logarithm helpers are local; the shared perspective and previous GaussianPowerMoment are actual proof consumers.

theorem bounded_displacement_reverse_transport {E : Type*} [NormedAddCommGroup E] [InnerProductSpace ℝ E]
    [FiniteDimensional ℝ E] [MeasurableSpace E] [BorelSpace E]
    (P Q : Measure E) [IsProbabilityMeasure P] [IsProbabilityMeasure Q]
    (γ : Measure (E × E))
    (hγ : Transport.IsCoupling γ P Q)
    (τ q t : ℝ) (hτ : 0 < τ) (hq : 1 < q) (ht : 0 ≤ t)
    (hdisp : ∀ᵐ c ∂γ, ‖c.1-c.2‖ ≤ t) :
    let H := fun μ : Measure E => GaussianSmoothing.gaussianSmoothing μ (Real.sqrt τ)
    H P ≪ H Q ∧
      (∫⁻ z, ((H P).rnDeriv (H Q) z)^q ∂H Q) ≤ ENNReal.ofReal (Real.exp (q*(q-1)*t^2/(2*τ))) ∧
      Integrable (fun z => ((H P).rnDeriv (H Q) z).toReal^q) (H Q) ∧
      (∫ z, ((H P).rnDeriv (H Q) z).toReal^q ∂H Q) ≤ Real.exp (q*(q-1)*t^2/(2*τ)) ∧
      Real.log (∫ z, ((H P).rnDeriv (H Q) z).toReal^q ∂H Q)/(q-1) ≤ q*t^2/(2*τ) := by
  let gd := fun (τ : ℝ) (a z : E) => ENNReal.ofReal
    (((Real.sqrt (2*Real.pi*τ))⁻¹)^Module.finrank ℝ E * Real.exp (-‖z-a‖^2/(2*τ)))
  have gd_law (a : E) (τ : ℝ) (hτ : 0 < τ) :
      (stdGaussian E).map (fun z => a+Real.sqrt τ • z) =
        (volume : Measure E).withDensity (gd τ a) := by
    have hmap : (stdGaussian E).map (fun z => a + Real.sqrt τ • z) =
        ((stdGaussian E).map (fun z : E => Real.sqrt τ • z)).map (MeasurableEquiv.addLeft a) := by
      rw [Measure.map_map (by fun_prop) (by fun_prop)]
      rfl
    rw [hmap,IsotropicGaussianDensity.map_sqrt_smul_stdGaussian_eq_withDensity τ hτ,
      RadonNikodym.measurableEquiv_map_withDensity (MeasurableEquiv.addLeft a) _ (by fun_prop)]
    have hvol : (volume : Measure E).map (MeasurableEquiv.addLeft a) = volume :=
      Measure.IsAddLeftInvariant.map_add_left_eq_self a
    rw [hvol]
    congr 1
    funext z
    simp [gd,MeasurableEquiv.addLeft,sub_eq_add_neg,add_comm]
  have mix_density (μ : Measure E) [IsProbabilityMeasure μ] (τ : ℝ) (hτ : 0 < τ) :
      (μ.prod (stdGaussian E)).map (fun p => p.1+Real.sqrt τ • p.2) =
        (volume : Measure E).withDensity (fun z => ∫⁻ a, gd τ a z ∂μ) := by
    have hg : Measurable (fun p : E × E => gd τ p.1 p.2) := by unfold gd; fun_prop
    have hmix : Measurable (fun z => ∫⁻ a, gd τ a z ∂μ) := hg.lintegral_prod_left'
    apply Measure.ext_of_lintegral
    intro f hf
    rw [lintegral_map hf (by fun_prop),lintegral_prod _ (by fun_prop),
      lintegral_withDensity_eq_lintegral_mul _ hmix hf]
    calc
      (∫⁻ a, ∫⁻ z, f (a+Real.sqrt τ • z) ∂stdGaussian E ∂μ) =
          ∫⁻ a, ∫⁻ z, gd τ a z * f z ∂volume ∂μ := by
        apply lintegral_congr
        intro a
        rw [← lintegral_map hf (by fun_prop),gd_law a τ hτ,
          lintegral_withDensity_eq_lintegral_mul _ (by unfold gd; fun_prop) hf]
        rfl
      _ = ∫⁻ z, ∫⁻ a, gd τ a z * f z ∂μ ∂volume :=
        lintegral_lintegral_swap (hg.mul (hf.comp measurable_snd)).aemeasurable
      _ = ∫⁻ z, (∫⁻ a, gd τ a z ∂μ) * f z ∂volume := by
        apply lintegral_congr
        intro z
        exact lintegral_mul_const _ (by unfold gd; fun_prop)
  have gd_bounds (τ : ℝ) (hτ : 0 < τ) (a z : E) :
      0 < gd τ a z ∧ gd τ a z ≤ ENNReal.ofReal
        (((Real.sqrt (2*Real.pi*τ))⁻¹)^Module.finrank ℝ E) := by
    have hC : 0 < ((Real.sqrt (2*Real.pi*τ))⁻¹)^Module.finrank ℝ E := by positivity
    constructor
    · unfold gd
      exact ENNReal.ofReal_pos.mpr (mul_pos hC (Real.exp_pos _))
    · unfold gd
      apply ENNReal.ofReal_le_ofReal
      have he : Real.exp (-‖z-a‖^2/(2*τ)) ≤ 1 := by
        apply Real.exp_le_one_iff.mpr
        exact div_nonpos_of_nonpos_of_nonneg (neg_nonpos.mpr (sq_nonneg _)) (by positivity)
      simpa using mul_le_mul_of_nonneg_left he hC.le
  have mix_bounds (μ : Measure E) [IsProbabilityMeasure μ] (τ : ℝ) (hτ : 0 < τ)
      (z : E) : 0 < (∫⁻ a, gd τ a z ∂μ) ∧ (∫⁻ a, gd τ a z ∂μ) ≠ ⊤ := by
    constructor
    · apply pos_iff_ne_zero.mpr
      intro h
      have hz := (lintegral_eq_zero_iff (by unfold gd; fun_prop)).mp h
      have hf : ∀ᵐ a ∂μ, False := by
        filter_upwards [hz] with a ha
        exact (ne_of_gt (gd_bounds τ hτ a z).1) ha
      have hm : μ = 0 := by simpa using hf
      exact IsProbabilityMeasure.ne_zero μ hm
    · apply ne_top_of_le_ne_top (ENNReal.ofReal_ne_top (r :=
        ((Real.sqrt (2*Real.pi*τ))⁻¹)^Module.finrank ℝ E))
      calc
        (∫⁻ a, gd τ a z ∂μ) ≤ ∫⁻ _ : E, ENNReal.ofReal
            (((Real.sqrt (2*Real.pi*τ))⁻¹)^Module.finrank ℝ E) ∂μ :=
          lintegral_mono (fun a => (gd_bounds τ hτ a z).2)
        _ = _ := by simp
  have density_power (μ : Measure E)
      (f g : E → ℝ≥0∞) (hf : Measurable f) (hg : Measurable g)
      [SigmaFinite (μ.withDensity g)] (hgpos : ∀ x, g x ≠ 0 ∧ g x ≠ ⊤)
      (q : ℝ) (hq : 1 < q) :
      μ.withDensity f ≪ μ.withDensity g ∧
        (∫⁻ x, ((μ.withDensity f).rnDeriv (μ.withDensity g) x)^q ∂μ.withDensity g) =
          ∫⁻ x, f x^q / g x^(q-1) ∂μ := by
    have heq : μ.withDensity f = (μ.withDensity g).withDensity (fun x => f x/g x) := by
      rw [← withDensity_mul μ (g := fun x => f x/g x) hg (hf.div hg)]
      congr 1
      funext x
      exact (mul_comm _ _).trans (ENNReal.div_mul_cancel (hgpos x).1 (hgpos x).2) |>.symm
    constructor
    · rw [heq]
      exact withDensity_absolutelyContinuous _ _
    · have hrn : (μ.withDensity f).rnDeriv (μ.withDensity g) =ᵐ[μ.withDensity g]
          (fun x => f x/g x) := by
        rw [heq]
        exact Measure.rnDeriv_withDensity _ (hf.div hg)
      have hpow : (fun x => ((μ.withDensity f).rnDeriv (μ.withDensity g) x)^q) =ᵐ[μ.withDensity g]
          (fun x => (f x/g x)^q) := hrn.fun_comp (fun x : ℝ≥0∞ => x^q)
      rw [lintegral_congr_ae hpow,
        lintegral_withDensity_eq_lintegral_mul _ hg
          (show Measurable (fun x => (f x/g x)^q) from (hf.div hg).pow_const q)]
      apply lintegral_congr
      intro x
      change g x * (f x/g x)^q = f x^q / g x^(q-1)
      rw [ENNReal.div_rpow_of_nonneg _ _ (by linarith),div_eq_mul_inv,mul_left_comm]
      congr 1
      calc
        g x * (g x^q)⁻¹ = g x^(1 : ℝ) * g x^(-q) := by
          rw [ENNReal.rpow_one,ENNReal.rpow_neg]
        _ = g x^(1-q) := by
          rw [← ENNReal.rpow_add _ _ (hgpos x).1 (hgpos x).2]
          rfl
        _ = (g x^(q-1))⁻¹ := by
          rw [← ENNReal.rpow_neg]
          congr 1
          ring
  have gd_power_moment (x y : E) (τ q : ℝ) (hτ : 0 < τ) (hq : 1 < q) :
      (∫⁻ z, gd τ x z^q / gd τ y z^(q-1) ∂volume) =
        ENNReal.ofReal (Real.exp (q*(q-1)*‖x-y‖^2/(2*τ))) := by
    let : IsProbabilityMeasure ((volume : Measure E).withDensity (gd τ y)) := by
      rw [← gd_law y τ hτ]
      exact Measure.isProbabilityMeasure_map (by fun_prop)
    have hd := (density_power (volume : Measure E) (gd τ x) (gd τ y)
      (by unfold gd; fun_prop) (by unfold gd; fun_prop)
      (fun z => ⟨ne_of_gt (gd_bounds τ hτ y z).1,ENNReal.ofReal_ne_top⟩) q hq).2
    rw [← gd_law x τ hτ,← gd_law y τ hτ] at hd
    obtain ⟨_,_,_,hrn,hI,hm,_⟩ :=
      AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.GaussianPowerMoment.gaussian_power_moment x y τ q hτ hq
    have hi := ofReal_integral_eq_lintegral_ofReal hI
      (Filter.Eventually.of_forall (fun z => Real.rpow_nonneg ENNReal.toReal_nonneg q))
    rw [hm] at hi
    rw [← hd]
    refine (lintegral_congr_ae ?_).trans hi.symm
    filter_upwards [hrn] with z hz
    rw [← ENNReal.ofReal_rpow_of_nonneg ENNReal.toReal_nonneg (by linarith),
      ENNReal.ofReal_toReal (by rw [hz]; exact ENNReal.ofReal_ne_top)]
  have mixture_power_bound (γ : Measure (E × E)) [IsProbabilityMeasure γ]
      (τ q t : ℝ) (hτ : 0 < τ) (hq : 1 < q) (ht : 0 ≤ t)
      (hdisp : ∀ᵐ c ∂γ, ‖c.1-c.2‖ ≤ t) :
      (∫⁻ z : E, (∫⁻ c, gd τ c.1 z ∂γ)^q /
        (∫⁻ c, gd τ c.2 z ∂γ)^(q-1) ∂volume) ≤
        ENNReal.ofReal (Real.exp (q*(q-1)*t^2/(2*τ))) := by
    have hb : ∀ z : E, 0 < (∫⁻ c, gd τ c.2 z ∂γ) ∧
        (∫⁻ c, gd τ c.2 z ∂γ) ≠ ⊤ := by
      intro z
      let : IsProbabilityMeasure (γ.map Prod.snd) := Measure.isProbabilityMeasure_map (by fun_prop)
      have h := mix_bounds (γ.map Prod.snd) τ hτ z
      rw [lintegral_map (by unfold gd; fun_prop) measurable_snd] at h
      exact h
    calc
      _ ≤ ∫⁻ z : E, ∫⁻ c, gd τ c.1 z^q / gd τ c.2 z^(q-1) ∂γ ∂volume := by
        apply lintegral_mono
        intro z
        exact PowerPerspective.lintegral_perspective_le γ (fun c => gd τ c.1 z) (fun c => gd τ c.2 z)
          (by unfold gd; fun_prop) (by unfold gd; fun_prop)
          (Filter.Eventually.of_forall (fun c => ⟨ne_of_gt (gd_bounds τ hτ c.2 z).1,ENNReal.ofReal_ne_top⟩))
          (ne_of_gt (hb z).1) (hb z).2 q hq
      _ = ∫⁻ c, ∫⁻ z : E, gd τ c.1 z^q / gd τ c.2 z^(q-1) ∂volume ∂γ := by
        apply lintegral_lintegral_swap
        unfold gd
        fun_prop
      _ = ∫⁻ c, ENNReal.ofReal (Real.exp (q*(q-1)*‖c.1-c.2‖^2/(2*τ))) ∂γ := by
        apply lintegral_congr
        intro c
        exact gd_power_moment c.1 c.2 τ q hτ hq
      _ ≤ ∫⁻ _ : E × E, ENNReal.ofReal (Real.exp (q*(q-1)*t^2/(2*τ))) ∂γ := by
        apply lintegral_mono_ae
        filter_upwards [hdisp] with c hc
        apply ENNReal.ofReal_le_ofReal
        apply Real.exp_le_exp.mpr
        apply div_le_div_of_nonneg_right _ (by positivity)
        apply mul_le_mul_of_nonneg_left _ (by positivity)
        have hn := norm_nonneg (c.1-c.2)
        nlinarith
      _ = _ := by simp
  have bounded_mix (P Q : Measure E) [IsProbabilityMeasure P] [IsProbabilityMeasure Q]
      (γ : Measure (E × E)) [IsProbabilityMeasure γ]
      (hγ : Transport.IsCoupling γ P Q)
      (τ q t : ℝ) (hτ : 0 < τ) (hq : 1 < q) (ht : 0 ≤ t)
      (hdisp : ∀ᵐ c ∂γ, ‖c.1-c.2‖ ≤ t) :
      let H := fun μ : Measure E => (μ.prod (stdGaussian E)).map (fun p => p.1+Real.sqrt τ • p.2)
      H P ≪ H Q ∧
        (∫⁻ z, ((H P).rnDeriv (H Q) z)^q ∂H Q) ≤ ENNReal.ofReal (Real.exp (q*(q-1)*t^2/(2*τ))) ∧
        Integrable (fun z => ((H P).rnDeriv (H Q) z).toReal^q) (H Q) ∧
        (∫ z, ((H P).rnDeriv (H Q) z).toReal^q ∂H Q) ≤ Real.exp (q*(q-1)*t^2/(2*τ)) ∧
        Real.log (∫ z, ((H P).rnDeriv (H Q) z).toReal^q ∂H Q)/(q-1) ≤ q*t^2/(2*τ) := by
    let H := fun μ : Measure E => (μ.prod (stdGaussian E)).map (fun p => p.1+Real.sqrt τ • p.2)
    let a := fun z => ∫⁻ x, gd τ x z ∂P
    let b := fun z => ∫⁻ x, gd τ x z ∂Q
    have ha : Measurable a := by
      exact (show Measurable (fun p : E × E => gd τ p.1 p.2) by unfold gd; fun_prop).lintegral_prod_left'
    have hb : Measurable b := by
      exact (show Measurable (fun p : E × E => gd τ p.1 p.2) by unfold gd; fun_prop).lintegral_prod_left'
    have hA : H P = (volume : Measure E).withDensity a := mix_density P τ hτ
    have hB : H Q = (volume : Measure E).withDensity b := mix_density Q τ hτ
    let : IsProbabilityMeasure (H P) := Measure.isProbabilityMeasure_map (by fun_prop)
    let : IsProbabilityMeasure (H Q) := Measure.isProbabilityMeasure_map (by fun_prop)
    let : IsProbabilityMeasure ((volume : Measure E).withDensity a) := hA ▸ inferInstance
    let : IsProbabilityMeasure ((volume : Measure E).withDensity b) := hB ▸ inferInstance
    have hap : ∀ z, a z ≠ 0 ∧ a z ≠ ⊤ := fun z =>
      ⟨ne_of_gt (mix_bounds P τ hτ z).1,(mix_bounds P τ hτ z).2⟩
    have hbp : ∀ z, b z ≠ 0 ∧ b z ≠ ⊤ := fun z =>
      ⟨ne_of_gt (mix_bounds Q τ hτ z).1,(mix_bounds Q τ hτ z).2⟩
    obtain ⟨hac,hd⟩ := density_power (volume : Measure E) a b ha hb hbp q hq
    have hback := (density_power (volume : Measure E) b a hb ha hap q hq).1
    rw [← hA,← hB] at hac hd hback
    have hbound : (∫⁻ z, ((H P).rnDeriv (H Q) z)^q ∂H Q) ≤
        ENNReal.ofReal (Real.exp (q*(q-1)*t^2/(2*τ))) := by
      rw [hd]
      have hp : ∀ z, a z = ∫⁻ c, gd τ c.1 z ∂γ := by
        intro z
        dsimp only [a]
        rw [← hγ.1]
        exact lintegral_map (by unfold gd; fun_prop) measurable_fst
      have hq' : ∀ z, b z = ∫⁻ c, gd τ c.2 z ∂γ := by
        intro z
        dsimp only [b]
        rw [← hγ.2]
        exact lintegral_map (by unfold gd; fun_prop) measurable_snd
      simp_rw [hp,hq']
      exact mixture_power_bound γ τ q t hτ hq ht hdisp
    have hfin : (∫⁻ z, ((H P).rnDeriv (H Q) z)^q ∂H Q) ≠ ⊤ :=
      ne_top_of_le_ne_top ENNReal.ofReal_ne_top hbound
    have hm : Measurable (fun z => ((H P).rnDeriv (H Q) z)^q) :=
      (Measure.measurable_rnDeriv _ _).pow_const q
    have hI : Integrable (fun z => ((H P).rnDeriv (H Q) z).toReal^q) (H Q) := by
      simpa only [ENNReal.toReal_rpow] using integrable_toReal_of_lintegral_ne_top hm.aemeasurable hfin
    have hre : (∫ z, ((H P).rnDeriv (H Q) z).toReal^q ∂H Q) =
        (∫⁻ z, ((H P).rnDeriv (H Q) z)^q ∂H Q).toReal := by
      simp_rw [ENNReal.toReal_rpow]
      apply integral_toReal hm.aemeasurable
      filter_upwards [Measure.rnDeriv_lt_top (H P) (H Q)] with z hz
      exact ENNReal.rpow_lt_top_of_nonneg (by linarith) hz.ne
    have hrb : (∫ z, ((H P).rnDeriv (H Q) z).toReal^q ∂H Q) ≤
        Real.exp (q*(q-1)*t^2/(2*τ)) := by
      rw [hre]
      simpa only [ENNReal.toReal_ofReal (Real.exp_pos _).le] using
        ENNReal.toReal_mono ENNReal.ofReal_ne_top hbound
    have hp0 : (∫⁻ z, ((H P).rnDeriv (H Q) z)^q ∂H Q) ≠ 0 := by
      intro hz
      have he := (lintegral_eq_zero_iff hm).mp hz
      have hpos := Measure.rnDeriv_pos' hback
      have hf : ∀ᵐ z ∂H Q, False := by
        filter_upwards [he,hpos] with z he hp
        exact (ne_of_gt (ENNReal.rpow_pos_of_nonneg hp (by linarith))) he
      exact IsProbabilityMeasure.ne_zero (H Q) (by simpa using hf)
    have hipos : 0 < (∫ z, ((H P).rnDeriv (H Q) z).toReal^q ∂H Q) := by
      rw [hre]
      exact ENNReal.toReal_pos hp0 hfin
    refine ⟨hac,hbound,hI,hrb,?_⟩
    have hl := Real.log_le_log hipos hrb
    rw [Real.log_exp] at hl
    have hh := div_le_div_of_nonneg_right hl (show 0 ≤ q-1 by linarith)
    have he : (q*(q-1)*t^2/(2*τ))/(q-1) = q*t^2/(2*τ) := by
      have hn : q-1 ≠ 0 := by linarith
      field_simp
    exact hh.trans_eq he
  have smoothing_law (μ : Measure E) [IsProbabilityMeasure μ] (τ : ℝ) :
      GaussianSmoothing.gaussianSmoothing μ (Real.sqrt τ) =
        (μ.prod (stdGaussian E)).map (fun p => p.1+Real.sqrt τ • p.2) := by
    unfold GaussianSmoothing.gaussianSmoothing CommonNoiseContraction.addNoise
      GaussianSmoothing.scaledStdGaussian
    have hp := Measure.map_prod_map μ (stdGaussian E) measurable_id
      (by fun_prop : Measurable (fun z : E => Real.sqrt τ • z))
    simp only [Measure.map_id] at hp
    rw [hp,Measure.map_map (by fun_prop) (by fun_prop)]
    rfl
  let : IsProbabilityMeasure γ := Transport.isProbabilityMeasure_of_isCoupling_left hγ
  have h := bounded_mix P Q γ hγ τ q t hτ hq ht hdisp
  dsimp only
  simpa only [smoothing_law] using h

end AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.GaussianMixture

Exact module and namespace context

Source assumptions versus formal assumptions

Source	Actual Lean	Difference kind	Why it matters
SPHMC Lemma6.3(ii) invokes Gaussian reverse transport on Euclidean probability measures with marginal Pp membership.	Finite-dimensional real inner-product Borel E, including zero dimension; probabilities and an actual bounded-displacement coupling, without marginal moment requirements.	generalization	Explicit expanded ingredient with independently proved denominator conditions; finite displacement does not imply marginal moments.
The full lemma first chooses one truncation proxy, then applies the Winfinity Gaussian reverse-transport bound for all q>1.	Actual GaussianSmoothing RN moment and normalized logarithm under a supplied bounded coupling.	API-limitation	No truncation composition, complete Wasserstein/Renyi API, warmness recursion or sampler cost is claimed.
Positive heat time, q>1 and coefficient q/(2tau).	Real q>1; in the consumer tau>0,t>=0 and exact q(q-1)t^2/(2tau) moment and qt^2/(2tau) logarithm bounds.	same	Covariance tau I comes from sqrt(tau) noise. RN direction and denominator law agree.
Mixture density, Holder and finite-moment details omitted in the invoked standard reverse-transport step.	Positive finite denominator conditions explicit in shared leaf; all Gaussian mixture densities, actual laws, integrability and log positivity proved in consumer.	source-implicit	No assumed mixture inequality or Gaussian density/moment contract replaces the proof.

Encoder–denoiser: accepted · domain-mismatch

Detected semantic differences

domains: Explicit generalization beyond Euclidean probability application. — No positive dimension; normalization has natural-number dimensional power.
scopes: Selected expanded prerequisite, not equivalence with complete printed Lemma6.3(ii). — Binding excludes truncation, full APIs, warmness recursion and sampler costs.
assumptions: Marginal Pp membership unnecessary for bounded coupling ingredient; no marginal moments established. — Coupling probability derived; density/integrability/log positivity proved internally.
objects: Decoder normalization limitation independently resolved from actual stdGaussian construction and scaled density proof. — smoothing_law binds product-map law; actual stdGaussian and IsotropicGaussianDensity resolve normalization beyond limited decoder context.

A generalization is not a source correction. Proposed missing conditions require separate independent repair review. No proposed repair silently changes the original theorem.

Scope and omitted-condition boundaries

Expanded bounded-displacement Gaussian mixture ingredient of SPHMC Lemma6.3(ii). The actual coupling is supplied; choosing a single truncation proxy before all q remains separate. No marginal moment conclusion, complete Wasserstein/Renyi API, proxy-warmness, sampler or query-cost theorem.

Source and reuse

ASTIS parents called

Mathlib API called (external library)

MeasureTheory.Measure.rnDeriv_withDensity
MeasureTheory.lintegral_lintegral_swap
MeasureTheory.integrable_toReal_of_lintegral_ne_top
MeasureTheory.Measure.rnDeriv_pos'

Mathematical sources

Chen, Chewi, Lu and Zhang, SPHMC v1 Lemma6.3(ii) — Expanded proof of the bounded-displacement Gaussian reverse-transport ingredient; original truncation composition separate.

ASTIS prose is not a quotation or a source-equivalence certificate. Definitions and aliases are explained as constructions, not counted as new mathematical proofs.

Which proof edges are actually covered?

TODO — not closed by these contributions Actual smoothed law absolute continuity and finite ENNReal RN power bound
TODO — not closed by these contributions Real RN power integrability and exponential integral bound
TODO — not closed by these contributions Positive actual moment and exact normalized logarithm upper bound

The actual translated Gaussian likelihood and RN derivative

Fan Chen, Sinho Chewi, Jianfeng Lu and Matthew S. Zhang; ASTIS expanded prerequisite proof, no author endorsement implied.

arXiv:2609.06906v1 · Lemma6.3(ii) Gaussian likelihood prerequisite · faithful paraphrase

Complete source statement (ASTIS restatement)

SPHMC Lemma6.3(ii) uses the heat-flow bound R_q(Pdag*gamma_tau || Q*gamma_tau)<=q Winfinity(Pdag,Q)^2/(2tau). The selected expanded Gaussian prerequisite, not the full mixture inequality, is the actual likelihood between equal-covariance translates: for G_a=Law(a+sqrt(tau)Z), tau>0, L(z)=exp(inner(x-y,z-y)/tau-norm(x-y)^2/(2tau)) satisfies G_x=G_y.withDensity(ofReal L), absolute continuity and a.e. RN identification under G_y. Measurability and the measure identity are proved rather than assumed.

Finite-dimensional real inner-product space with its Borel measurable structure, including dimension zero.
Tau>0 and arbitrary centers x,y. The covariance is tau I, not sqrt(tau) I.
Both Gaussian laws are actual scaled/translated standard Gaussian pushforwards, not arbitrary laws assumed to have a density ratio.
The source states reverse transport on Euclidean probabilities. This coordinate-free Gaussian ingredient is an explicit expanded prerequisite, not the mixture theorem.

Actual likelihood

\[G_a=\operatorname{Law}(a+\sqrt\tau Z),\quad L(z)=\exp\!\left(\frac{\langle x-y,z-y\rangle}{\tau}-\frac{\|x-y\|^2}{2\tau}\right),\quad \frac{dG_x}{dG_y}=L\quad G_y\text{-a.e.}\]

Read the formalized proofs

Each statement and proof below has its own closed Lean disclosure. ASTIS parents, Mathlib calls and external mathematical sources are distinguished in each proof.

ASTIS mathematical exposition

The actual translated Gaussian likelihood and RN derivative

AutoSamplingTheory.TechnicalLemmas.Measure.GaussianLikelihood.translated_gaussian_likelihood · theorem · Teaching coverage

Statement

Let E be a finite-dimensional real inner-product Borel space, x,y in E and tau>0. Define G_a as the pushforward of standard Gaussian by z to a+sqrt(tau)z, and L(z)=exp(inner(x-y,z-y)/tau-norm(x-y)^2/(2tau)). Then L is measurable, G_x=G_y.withDensity(ofReal L), G_x is absolutely continuous with respect to G_y, and its RN derivative equals ofReal L almost everywhere under G_y.

\[G_a=\operatorname{Law}(a+\sqrt\tau Z),\quad L(z)=\exp\!\left(\frac{\langle x-y,z-y\rangle}{\tau}-\frac{\|x-y\|^2}{2\tau}\right),\quad \frac{dG_x}{dG_y}=L\quad G_y\text{-a.e.}\]

All objects and hypotheses

Finite-dimensional real inner-product space with its Borel measurable structure, including dimension zero.
Tau>0 and arbitrary centers x,y. The covariance is tau I, not sqrt(tau) I.
Both Gaussian laws are actual scaled/translated standard Gaussian pushforwards, not arbitrary laws assumed to have a density ratio.
The source states reverse transport on Euclidean probabilities. This coordinate-free Gaussian ingredient is an explicit expanded prerequisite, not the mixture theorem.

Mathematical proof

1. Translate the existing actual Gaussian density

Apply the existing canonical-volume density theorem for sqrt(tau)Z. Push that measure through the measurable equivalence z to a+z. Translation preserves Haar volume and the inverse map is z-a, giving the normalized density centered at a.

\[G_a(dz)=C_\tau e^{-\|z-a\|^2/(2\tau)}\,dz,\qquad C_\tau=(\sqrt{2\pi\tau})^{-\dim E}.\]

Corresponding Lean step

Local translated_density uses map_map, IsotropicGaussianDensity, measurableEquiv_map_withDensity and map_add_left_eq_self.

2. Prove actual multiplication of densities

The norm identity norm(z-x)^2=norm(z-y)^2-2 inner(x-y,z-y)+norm(x-y)^2 shows the x-density equals the y-density times L. Measurability permits withDensity multiplication, proving equality of the actual measures.

\[C_\tau e^{-\|z-x\|^2/(2\tau)}=C_\tau e^{-\|z-y\|^2/(2\tau)}L(z).\]

Corresponding Lean step

norm_sub_sq_real and real_inner_comm establish the exponent identity; withDensity_mul identifies actual measures, not merely exponent expressions.

3. Identify absolute continuity and the RN version

The explicit density is measurable and finite everywhere. Actual withDensity equality gives absolute continuity. G_y is a probability, so the standard RN identification theorem applies and yields the equality almost everywhere in the correct direction.

\[G_x\ll G_y,\qquad (G_x).\operatorname{rnDeriv}(G_y)=L\quad G_y\text{-a.e.}\]

Corresponding Lean step

withDensity_absolutelyContinuous and Measure.rnDeriv_withDensity after deriving the probability instance for G_y.

Lean statement · translated_gaussian_likelihood

Measurability, actual withDensity equality, absolute continuity and RN a.e. equality for the explicitly defined Gaussian laws.

theorem translated_gaussian_likelihood {E : Type*} [NormedAddCommGroup E] [InnerProductSpace ℝ E]
    [FiniteDimensional ℝ E] [MeasurableSpace E] [BorelSpace E]
    (x y : E) (τ : ℝ) (hτ : 0 < τ) :
    let G := fun a : E => (stdGaussian E).map (fun z => a + Real.sqrt τ • z)
    let L := fun z : E => Real.exp (inner ℝ (x-y) (z-y) / τ - ‖x-y‖ ^ 2 / (2*τ))
    Measurable L ∧ G x = (G y).withDensity (fun z => ENNReal.ofReal (L z)) ∧
      G x ≪ G y ∧ (G x).rnDeriv (G y) =ᵐ[G y] (fun z => ENNReal.ofReal (L z))

Exact module and namespace context

Lean proof · translated_gaussian_likelihood

The actual translated density helper is local; the public proof derives the likelihood equality and genuine RN identity.

theorem translated_gaussian_likelihood {E : Type*} [NormedAddCommGroup E] [InnerProductSpace ℝ E]
    [FiniteDimensional ℝ E] [MeasurableSpace E] [BorelSpace E]
    (x y : E) (τ : ℝ) (hτ : 0 < τ) :
    let G := fun a : E => (stdGaussian E).map (fun z => a + Real.sqrt τ • z)
    let L := fun z : E => Real.exp (inner ℝ (x-y) (z-y) / τ - ‖x-y‖ ^ 2 / (2*τ))
    Measurable L ∧ G x = (G y).withDensity (fun z => ENNReal.ofReal (L z)) ∧
      G x ≪ G y ∧ (G x).rnDeriv (G y) =ᵐ[G y] (fun z => ENNReal.ofReal (L z)) := by
  have translated_density
      (a : E) (τ : ℝ) (hτ : 0 < τ) :
      (stdGaussian E).map (fun z => a + Real.sqrt τ • z) =
        (volume : Measure E).withDensity (fun z => ENNReal.ofReal
          (((Real.sqrt (2 * Real.pi * τ))⁻¹) ^ Module.finrank ℝ E *
            Real.exp (-‖z-a‖ ^ 2 / (2 * τ)))) := by
    have hmap : (stdGaussian E).map (fun z => a + Real.sqrt τ • z) =
        ((stdGaussian E).map (fun z : E => Real.sqrt τ • z)).map (MeasurableEquiv.addLeft a) := by
      rw [Measure.map_map (by fun_prop) (by fun_prop)]
      rfl
    rw [hmap,IsotropicGaussianDensity.map_sqrt_smul_stdGaussian_eq_withDensity τ hτ,
      RadonNikodym.measurableEquiv_map_withDensity (MeasurableEquiv.addLeft a) _ (by fun_prop)]
    have hvol : (volume : Measure E).map (MeasurableEquiv.addLeft a) = volume :=
      Measure.IsAddLeftInvariant.map_add_left_eq_self a
    rw [hvol]
    congr 1
    funext z
    simp [MeasurableEquiv.addLeft,sub_eq_add_neg,add_comm]
  let G := fun a : E => (stdGaussian E).map (fun z => a + Real.sqrt τ • z)
  let L := fun z : E => Real.exp (inner ℝ (x-y) (z-y) / τ - ‖x-y‖ ^ 2 / (2*τ))
  have hL : Measurable L := by fun_prop
  have heq : G x = (G y).withDensity (fun z => ENNReal.ofReal (L z)) := by
    dsimp only [G]
    rw [translated_density x τ hτ,translated_density y τ hτ,
      ← withDensity_mul _ (by fun_prop) (by fun_prop)]
    congr 1
    funext z
    change ENNReal.ofReal (_ * Real.exp _) = ENNReal.ofReal (_ * Real.exp _) * ENNReal.ofReal (L z)
    rw [← ENNReal.ofReal_mul (by positivity)]
    congr 1
    dsimp only [L]
    simp only [mul_assoc]
    rw [← Real.exp_add]
    congr 2
    have hnorm : ‖z-x‖ ^ 2 = ‖z-y‖ ^ 2 - 2 * inner ℝ (x-y) (z-y) + ‖x-y‖ ^ 2 := by
      have hz : z-x = (z-y)-(x-y) := by abel
      rw [hz,norm_sub_sq_real,real_inner_comm]
    rw [hnorm]
    field_simp
    ring
  let : IsProbabilityMeasure (G y) := Measure.isProbabilityMeasure_map (by fun_prop)
  refine ⟨hL,heq,?_,?_⟩
  · change G x ≪ G y
    rw [heq]
    exact withDensity_absolutelyContinuous _ _
  · change (G x).rnDeriv (G y) =ᵐ[G y] (fun z => ENNReal.ofReal (L z))
    rw [heq]
    exact Measure.rnDeriv_withDensity _ (by fun_prop)

end AutoSamplingTheory.TechnicalLemmas.Measure.GaussianLikelihood

Exact module and namespace context

Source assumptions versus formal assumptions

Source	Actual Lean	Difference kind	Why it matters
Euclidean probabilities and Gaussian heat kernel.	Finite-dimensional real inner-product Borel spaces, including zero dimension.	generalization	Explicit coordinate-free finite-dimensional extension.
Lemma6.3(ii) invokes reverse transport for mixed Gaussian laws.	Actual equal-covariance Gaussian likelihood	API-limitation	Expanded Gaussian prerequisite; mixing/data-processing, general reverse transport and full divergence API remain separate.
Gaussian heat covariance tau I with positive heat time; q>1 for Renyi.	Actual law of a+sqrt(tau)Z, tau>0; real q>1 in power consumer.	same	The covariance, derivative direction and source coefficient are retained.
Gaussian likelihood and high-order integrability implicit in the standard Gaussian ingredient.	Actual volume-density multiplication, RN identity and integrability derived from existing Gaussian facts.	source-implicit	No supplied likelihood, finite moment or nonzero-displacement premise.

Actual equal-covariance Gaussian likelihood/RN and power-moment prerequisite only. No mixture/data-processing inequality, general reverse transport, proxy-warmness, sampler error or query-cost guarantee. The explicit normalized log-moment is not a new packaged divergence API.

Encoder–denoiser: accepted · domain-mismatch

Detected semantic differences

domains: Coordinate-free finite-dimensional and zero-dimensional extension. — Positive dimension omitted; extension explicitly disclosed.
scopes: Expanded Gaussian prerequisite, not the full mixed reverse-transport assertion in Lemma6.3(ii). — Source contract and binding retain independent mixture/data-processing boundary.

A generalization is not a source correction. Proposed missing conditions require separate independent repair review. No proposed repair silently changes the original theorem.

Scope and omitted-condition boundaries

Actual equal-covariance Gaussian likelihood/RN and power-moment prerequisite only. No mixture/data-processing inequality, general reverse transport, proxy-warmness, sampler error or query-cost guarantee. The explicit normalized log-moment is not a new packaged divergence API.

Source and reuse

ASTIS parents called

Mathlib API called (external library)

MeasureTheory.Measure.rnDeriv_withDensity
MeasureTheory.withDensity_mul

Mathematical sources

Chen, Chewi, Lu and Zhang, SPHMC v1 Lemma6.3(ii) — Expanded actual Gaussian ingredient of the stated Winfinity reverse-transport inequality; mixture step separate.

ASTIS prose is not a quotation or a source-equivalence certificate. Definitions and aliases are explained as constructions, not counted as new mathematical proofs.

Which proof edges are actually covered?

TODO — not closed by these contributions Actual Gaussian withDensity equality, absolute continuity and RN identification

Exact integrable Gaussian RN power moment and normalized logarithm

Fan Chen, Sinho Chewi, Jianfeng Lu and Matthew S. Zhang; ASTIS expanded prerequisite proof, no author endorsement implied.

arXiv:2609.06906v1 · Lemma6.3(ii) exact Gaussian power-moment prerequisite · faithful paraphrase

Complete source statement (ASTIS restatement)

The same SPHMC Lemma6.3(ii) reverse-transport ingredient is expanded at Gaussian centers x,y: for tau>0 and real q>1, the actual RN derivative dG_x/dG_y has an integrable qth power, with integral exp(q(q-1)norm(x-y)^2/(2tau)). Its normalized log-moment equals q norm(x-y)^2/(2tau), giving the precise single-Gaussian coefficient needed before the independent mixture argument. This is not the full reverse-transport theorem or a claim that the expanded proof is printed in the source.

Same actual translated/scaled Gaussian laws, finite-dimensional real inner-product Borel E including dimension zero, tau>0 and arbitrary x,y.
Real q>1, not just natural q. No nonzero displacement or positive dimension is assumed.
No likelihood, Gaussian moment formula or integrability hypothesis is supplied. The RN toReal use is justified by equality to a finite explicit density a.e.
The raw normalized log-moment is the equal-covariance Gaussian quantity needed for the source argument; mixing over a coupling and data processing remain separate.

Exact RN moment

\[\int\left(\frac{dG_x}{dG_y}\right)^q dG_y=\exp\!\left(\frac{q(q-1)\|x-y\|^2}{2\tau}\right),\qquad\frac{1}{q-1}\log\int\left(\frac{dG_x}{dG_y}\right)^q dG_y=\frac{q\|x-y\|^2}{2\tau}.\]

Read the formalized proofs

Each statement and proof below has its own closed Lean disclosure. ASTIS parents, Mathlib calls and external mathematical sources are distinguished in each proof.

ASTIS mathematical exposition

Exact integrable Gaussian RN power moment and normalized logarithm

AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.GaussianPowerMoment.gaussian_power_moment · theorem · Teaching coverage

Statement

For the same actual G_x,G_y on a finite-dimensional real inner-product Borel space, tau>0 and real q>1, retain the measurable likelihood L, actual withDensity equality, absolute continuity and RN identity. The qth power of the real-valued RN derivative is integrable under G_y, its integral is exp(q(q-1)norm(x-y)^2/(2tau)), and the logarithm of this integral divided by q-1 equals q norm(x-y)^2/(2tau).

\[\int\left(\frac{dG_x}{dG_y}\right)^q dG_y=\exp\!\left(\frac{q(q-1)\|x-y\|^2}{2\tau}\right),\qquad\frac{1}{q-1}\log\int\left(\frac{dG_x}{dG_y}\right)^q dG_y=\frac{q\|x-y\|^2}{2\tau}.\]

All objects and hypotheses

Same actual translated/scaled Gaussian laws, finite-dimensional real inner-product Borel E including dimension zero, tau>0 and arbitrary x,y.
Real q>1, not just natural q. No nonzero displacement or positive dimension is assumed.
No likelihood, Gaussian moment formula or integrability hypothesis is supplied. The RN toReal use is justified by equality to a finite explicit density a.e.
The raw normalized log-moment is the equal-covariance Gaussian quantity needed for the source argument; mixing over a coupling and data processing remain separate.

Mathematical proof

1. Obtain a genuine one-dimensional projection law

For h=x-y, the continuous linear functional ell(z)=inner(h,z) sends standard Gaussian to a real Gaussian of mean zero and variance norm(h)^2. The existing one-dimensional exponential integrability and MGF theorem yield both an integrability fact and the exact integral.

\[\langle h,Z\rangle\sim\mathsf N(0,\|h\|^2),\qquad\mathbb E e^{a\langle h,Z\rangle}=e^{a^2\|h\|^2/2}.\]

Corresponding Lean step

Local linear_exp uses IsGaussian.map_eq_gaussianReal, integral_strongDual_stdGaussian, variance_dual_stdGaussian, integrable_exp_mul_gaussianReal and mgf_gaussianReal.

2. Pull the actual likelihood power back to standard Gaussian

Set s=sqrt(tau), a=q/s and b=-q norm(h)^2/(2tau). Under the actual map z=y+sZ, real exponentiation gives L(z)^q=exp(b) exp(a inner(h,Z)). The map is measurable and the projected exponential is integrable, so the actual pushed-forward power is integrable.

\[L(y+\sqrt\tau Z)^q=e^{-q\|h\|^2/(2\tau)}e^{(q/\sqrt\tau)\langle h,Z\rangle}.\]

Corresponding Lean step

Real.exp_mul, inner_smul_right, s^2=tau and integrable_map_measure establish the exact pullback and integrability.

3. Compute the exact power moment

Use integral_map, take out exp(b), and substitute the one-dimensional MGF. The exponent b+a^2 norm(h)^2/2 simplifies to q(q-1)norm(h)^2/(2tau). Strictly positive tau justifies all reciprocal square-root operations.

\[b+\frac{a^2\|h\|^2}{2}=\frac{q(q-1)\|h\|^2}{2\tau}.\]

Corresponding Lean step

Local power_moment returns integrability and equality together, with no assumed moment budget.

4. Transfer the result to the genuine RN derivative

Apply the shared likelihood theorem to the same x,y,tau. Its a.e. RN equality and finite exponential density identify the qth powers after toReal. Transfer integrability and the integral by a.e. congruence.

\[\left((G_x).\operatorname{rnDeriv}(G_y)\right)_{\mathbb R}^{q}=L^q\quad G_y\text{-a.e.}\]

Corresponding Lean step

ENNReal.toReal_ofReal, Integrable.congr and integral_congr_ae use the actual RN equality, avoiding any inference from totalized infinite values.

5. Take the normalized logarithm without changing constants

The exact integral is a positive exponential. Its logarithm equals the computed exponent; q>1 makes q-1 nonzero, yielding the exact Gaussian reverse-transport coefficient. Zero displacement or dimension gives moment one and logarithm zero.

\[\frac{q(q-1)\|h\|^2}{2\tau(q-1)}=\frac{q\|h\|^2}{2\tau}.\]

Corresponding Lean step

Real.log_exp and positive-order cancellation. No marginal mixture or sampler assertion is returned.

Lean statement · gaussian_power_moment

Actual RN power integrability, exact integral and normalized log-moment, together with the same genuine Gaussian likelihood certificate.

theorem gaussian_power_moment {E : Type*} [NormedAddCommGroup E] [InnerProductSpace ℝ E]
    [FiniteDimensional ℝ E] [MeasurableSpace E] [BorelSpace E]
    (x y : E) (τ q : ℝ) (hτ : 0 < τ) (hq : 1 < q) :
    let G := fun a : E => (stdGaussian E).map (fun z => a + Real.sqrt τ • z)
    let L := fun z : E => Real.exp (inner ℝ (x-y) (z-y) / τ - ‖x-y‖ ^ 2 / (2*τ))
    Measurable L ∧ G x = (G y).withDensity (fun z => ENNReal.ofReal (L z)) ∧
      G x ≪ G y ∧ (G x).rnDeriv (G y) =ᵐ[G y] (fun z => ENNReal.ofReal (L z)) ∧
      Integrable (fun z => ((G x).rnDeriv (G y) z).toReal ^ q) (G y) ∧
      (∫ z, ((G x).rnDeriv (G y) z).toReal ^ q ∂G y) =
        Real.exp (q*(q-1)*‖x-y‖^2/(2*τ)) ∧
      Real.log (∫ z, ((G x).rnDeriv (G y) z).toReal ^ q ∂G y) / (q-1) =
        q*‖x-y‖^2/(2*τ)

Exact module and namespace context

Lean proof · gaussian_power_moment

The one-dimensional projection/MGF and actual power integration helpers are local; the shared public likelihood theorem provides the RN identification.

theorem gaussian_power_moment {E : Type*} [NormedAddCommGroup E] [InnerProductSpace ℝ E]
    [FiniteDimensional ℝ E] [MeasurableSpace E] [BorelSpace E]
    (x y : E) (τ q : ℝ) (hτ : 0 < τ) (hq : 1 < q) :
    let G := fun a : E => (stdGaussian E).map (fun z => a + Real.sqrt τ • z)
    let L := fun z : E => Real.exp (inner ℝ (x-y) (z-y) / τ - ‖x-y‖ ^ 2 / (2*τ))
    Measurable L ∧ G x = (G y).withDensity (fun z => ENNReal.ofReal (L z)) ∧
      G x ≪ G y ∧ (G x).rnDeriv (G y) =ᵐ[G y] (fun z => ENNReal.ofReal (L z)) ∧
      Integrable (fun z => ((G x).rnDeriv (G y) z).toReal ^ q) (G y) ∧
      (∫ z, ((G x).rnDeriv (G y) z).toReal ^ q ∂G y) =
        Real.exp (q*(q-1)*‖x-y‖^2/(2*τ)) ∧
      Real.log (∫ z, ((G x).rnDeriv (G y) z).toReal ^ q ∂G y) / (q-1) =
        q*‖x-y‖^2/(2*τ) := by
  have linear_exp
      (h : E) (a : ℝ) :
      Integrable (fun z : E => Real.exp (a * inner ℝ h z)) (stdGaussian E) ∧
      (∫ z : E, Real.exp (a * inner ℝ h z) ∂stdGaussian E) =
        Real.exp (a^2 * ‖h‖^2 / 2) := by
    let l : StrongDual ℝ E := innerSL ℝ h
    have hmap : (stdGaussian E).map l = gaussianReal 0 (‖h‖^2).toNNReal := by
      rw [IsGaussian.map_eq_gaussianReal l,integral_strongDual_stdGaussian,
        variance_dual_stdGaussian]
      simp only [l,innerSL_apply_norm]
    have hI := integrable_exp_mul_gaussianReal (μ := 0) (v := (‖h‖^2).toNNReal) a
    rw [← hmap] at hI
    have hI' := (integrable_map_measure (by fun_prop) (by fun_prop : AEMeasurable l (stdGaussian E))).mp hI
    refine ⟨hI',?_⟩
    have hm := mgf_gaussianReal hmap a
    simpa [mgf,l,Real.toNNReal_of_nonneg (sq_nonneg ‖h‖),mul_comm] using hm
  have power_moment
      (x y : E) (τ q : ℝ) (hτ : 0 < τ) (hq : 1 < q) :
      let G := (stdGaussian E).map (fun z => y + Real.sqrt τ • z)
      let L := fun z : E => Real.exp (inner ℝ (x-y) (z-y) / τ - ‖x-y‖ ^ 2 / (2*τ))
      Integrable (fun z => L z ^ q) G ∧
        (∫ z, L z ^ q ∂G) = Real.exp (q*(q-1)*‖x-y‖^2/(2*τ)) := by
    let G := (stdGaussian E).map (fun z => y + Real.sqrt τ • z)
    let L := fun z : E => Real.exp (inner ℝ (x-y) (z-y) / τ - ‖x-y‖ ^ 2 / (2*τ))
    let s := Real.sqrt τ
    have hs : 0 < s := Real.sqrt_pos.mpr hτ
    have hs2 : s^2 = τ := Real.sq_sqrt hτ.le
    let a := q / s
    let b := -q * ‖x-y‖^2 / (2*τ)
    have hq0 : 0 ≤ q := by linarith
    have hfunc : (fun z : E => L (y + Real.sqrt τ • z)^q) =
        (fun z => Real.exp b * Real.exp (a * inner ℝ (x-y) z)) := by
      funext z
      dsimp only [L]
      rw [← Real.exp_mul,← Real.exp_add]
      congr 1
      simp only [add_sub_cancel_left,inner_smul_right]
      change (s * inner ℝ (x-y) z / τ - ‖x-y‖^2/(2*τ))*q = b + a * inner ℝ (x-y) z
      dsimp only [a,b]
      rw [← hs2]
      field_simp
      ring
    obtain ⟨hI,hm⟩ := linear_exp (x-y) a
    have hpull : Integrable (fun z : E => L (y + Real.sqrt τ • z)^q) (stdGaussian E) := by
      rw [hfunc]
      exact hI.const_mul _
    have hLG : Integrable (fun z : E => L z ^ q) G :=
      (integrable_map_measure (by fun_prop) (by fun_prop)).mpr hpull
    refine ⟨hLG,?_⟩
    change (∫ z, L z ^ q ∂G) = _
    dsimp only [G]
    rw [integral_map (by fun_prop) (by fun_prop)]
    change (∫ z : E, L (y + Real.sqrt τ • z)^q ∂stdGaussian E) = _
    rw [hfunc,integral_const_mul,hm,← Real.exp_add]
    congr 1
    dsimp only [a,b]
    rw [← hs2]
    field_simp
    ring
  let G := fun a : E => (stdGaussian E).map (fun z => a + Real.sqrt τ • z)
  let L := fun z : E => Real.exp (inner ℝ (x-y) (z-y) / τ - ‖x-y‖ ^ 2 / (2*τ))
  obtain ⟨hL,heq,hAC,hRN⟩ := GaussianLikelihood.translated_gaussian_likelihood x y τ hτ
  change (G x).rnDeriv (G y) =ᵐ[G y] (fun z => ENNReal.ofReal (L z)) at hRN
  obtain ⟨hI,hm⟩ := power_moment x y τ q hτ hq
  have hpow : (fun z => ((G x).rnDeriv (G y) z).toReal ^ q) =ᵐ[G y] (fun z => L z ^ q) := by
    filter_upwards [hRN] with z hz
    rw [hz,ENNReal.toReal_ofReal (Real.exp_nonneg _)]
  have hIRN : Integrable (fun z => ((G x).rnDeriv (G y) z).toReal ^ q) (G y) := hI.congr hpow.symm
  have hval : (∫ z, ((G x).rnDeriv (G y) z).toReal ^ q ∂G y) =
      Real.exp (q*(q-1)*‖x-y‖^2/(2*τ)) := (integral_congr_ae hpow).trans hm
  refine ⟨hL,heq,hAC,hRN,hIRN,hval,?_⟩
  change Real.log (∫ z, ((G x).rnDeriv (G y) z).toReal ^ q ∂G y) / (q-1) = _
  rw [hval,Real.log_exp]
  have hq1 : q-1 ≠ 0 := by linarith
  field_simp

end AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.GaussianPowerMoment

Exact module and namespace context

Source assumptions versus formal assumptions

Source	Actual Lean	Difference kind	Why it matters
Euclidean probabilities and Gaussian heat kernel.	Finite-dimensional real inner-product Borel spaces, including zero dimension.	generalization	Explicit coordinate-free finite-dimensional extension.
Lemma6.3(ii) invokes reverse transport for mixed Gaussian laws.	Actual Gaussian RN power integral and normalized log-moment	API-limitation	Expanded Gaussian prerequisite; mixing/data-processing, general reverse transport and full divergence API remain separate.
Gaussian heat covariance tau I with positive heat time; q>1 for Renyi.	Actual law of a+sqrt(tau)Z, tau>0; real q>1 in power consumer.	same	The covariance, derivative direction and source coefficient are retained.
Gaussian likelihood and high-order integrability implicit in the standard Gaussian ingredient.	Actual volume-density multiplication, RN identity and integrability derived from existing Gaussian facts.	source-implicit	No supplied likelihood, finite moment or nonzero-displacement premise.

Encoder–denoiser: accepted · domain-mismatch

Detected semantic differences

domains: Coordinate-free finite-dimensional and zero-dimensional extension. — No positive dimension; degenerate scalar Gaussian projection handled by existing APIs.
scopes: Expanded Gaussian prerequisite, not the full mixed reverse-transport assertion in Lemma6.3(ii). — No mixture/data-processing or packaged divergence identification returned.
conclusion: Explicit normalized log integral, not a newly proved full divergence API. — Finite explicit RN density a.e. justifies toReal; integrability/integral transfer by a.e. congruence.

A generalization is not a source correction. Proposed missing conditions require separate independent repair review. No proposed repair silently changes the original theorem.

Scope and omitted-condition boundaries

Actual equal-covariance Gaussian likelihood/RN and power-moment prerequisite only. No mixture/data-processing inequality, general reverse transport, proxy-warmness, sampler error or query-cost guarantee. The explicit normalized log-moment is not a new packaged divergence API.

Source and reuse

ASTIS parents called

AutoSamplingTheory.TechnicalLemmas.Measure.GaussianLikelihood.translated_gaussian_likelihood

Mathlib API called (external library)

ProbabilityTheory.IsGaussian.map_eq_gaussianReal
ProbabilityTheory.mgf_gaussianReal
ProbabilityTheory.integrable_exp_mul_gaussianReal

Mathematical sources

Chen, Chewi, Lu and Zhang, SPHMC v1 Lemma6.3(ii) — Expanded actual Gaussian ingredient of the stated Winfinity reverse-transport inequality; mixture step separate.

ASTIS prose is not a quotation or a source-equivalence certificate. Definitions and aliases are explained as constructions, not counted as new mathematical proofs.

Which proof edges are actually covered?

TODO — not closed by these contributions Actual RN qth-power integrability and exact moment
TODO — not closed by these contributions Exact normalized log-moment q norm(x-y)^2/(2tau)

Actual Gaussian observation and finite recursive A1 budget

Fan Chen, Sinho Chewi, Jianfeng Lu and Matthew S. Zhang; ASTIS expanded actual Gaussian observation and finite accuracy budget, no author endorsement implied.

arXiv:2609.06906v1 · Theorem6.5 A1 actual Gaussian observation and equation(6.5) budget · faithful paraphrase

Complete source statement (ASTIS restatement)

Let E be a finite-dimensional real inner-product Borel space and mu a probability measure. Set S=NNReal times E times Nat times E^Nat. Let beta,kappa,tau:S to R be positive measurable functions and eta:S to R nonnegative measurable. Fix a nonnegative precision threshold theta, natural budget J and Delta>=0. Define a(s)=(eta(s)+tau(s))/beta(s). There exist Markov T,H with T(s) the normalized quadratic tilt of mu at precision b and center u, and H(s) its Gaussian smoothing with standard deviation sqrt(a(s)). These are chosen before arbitrary Markov smoothed-output M and terminal L. Suppose that on every continuing state, squared W2 from M(s) to T(s) smoothed at time eta(s)/beta(s) is at most ofReal(kappa(s)*[2*tau(s)*Delta^2/(kappa(s)*(J+1))]/beta(s)). Then there exist F,Q,P and Markov output kernels R_n. F updates precision to b+1/a(s), center to (b*u+y/a(s))/(b+1/a(s)), increments the count and prepends y to history. Q(s) is M(s) with an independent Gaussian of variance tau(s)/beta(s) added. P(s)=dirac s if theta<=b and otherwise the F(s,.) pushforward of Q(s). R_0=L, and R_(n+1)(s)=L(s) if stopped, otherwise the bind of Q(s) with R_n(F(s,y)). On every continuing state KL(Q(s)||H(s))<=ofReal(Delta^2/(J+1)). For all n,s, KL(R_n(s)||T(s)) is at most n*ofReal(Delta^2/(J+1)) plus integral KL(L(x)||T(x)) under P^n(s). All bounds are in extended nonnegative reals.

Finite-dimensional real Hilbert Borel E, including zero dimension; mu probability.
beta,kappa,tau are measurable and strictly positive everywhere; eta is measurable and nonnegative. Delta>=0, J natural, theta nonnegative and fixed.
M,L are measurable Markov kernels on the complete state. Ideal T,H are fixed before their selection.
Only continuing states require the displayed squared-W2 accuracy with epsilon(s)^2=2*tau(s)*Delta^2/(kappa(s)*(J+1)). No observation KL bound is assumed.
No stopping bound, terminal accuracy, finite terminal KL, marginal moment or cost-transfer premise is added.

Actual Gaussian finite error budget

\[\operatorname{KL}(Q(s)\Vert H(s))\le\frac{\Delta^2}{J+1}\quad(b(s)<\theta),\qquad\operatorname{KL}(R_n(s)\Vert T(s))\le\frac{n\Delta^2}{J+1}+\int\operatorname{KL}(L(x)\Vert T(x))\,P^n(s)(dx).\]

Read the formalized proofs

Each statement and proof below has its own closed Lean disclosure. ASTIS parents, Mathlib calls and external mathematical sources are distinguished in each proof.

ASTIS mathematical exposition

Actual Gaussian observation and finite recursive A1 budget

AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.GaussianRGOErrorBudget.gaussian_rgo_error_budget · theorem · Teaching coverage

Statement

\[\operatorname{KL}(Q(s)\Vert H(s))\le\frac{\Delta^2}{J+1}\quad(b(s)<\theta),\qquad\operatorname{KL}(R_n(s)\Vert T(s))\le\frac{n\Delta^2}{J+1}+\int\operatorname{KL}(L(x)\Vert T(x))\,P^n(s)(dx).\]

All objects and hypotheses

Finite-dimensional real Hilbert Borel E, including zero dimension; mu probability.
beta,kappa,tau are measurable and strictly positive everywhere; eta is measurable and nonnegative. Delta>=0, J natural, theta nonnegative and fixed.
M,L are measurable Markov kernels on the complete state. Ideal T,H are fixed before their selection.
Only continuing states require the displayed squared-W2 accuracy with epsilon(s)^2=2*tau(s)*Delta^2/(kappa(s)*(J+1)). No observation KL bound is assumed.
No stopping bound, terminal accuracy, finite terminal KL, marginal moment or cost-transfer premise is added.

Mathematical proof

1. Construct a measurable actual Gaussian observation kernel

Form the independent product of a deterministic state-retaining kernel and a standard Gaussian kernel, then scale the noise by sqrt(tau(s)/beta(s)). Its fiber is the centered Gaussian at that variance. Take its product with M and push forward by addition. Product and map preserve Markov probability; measurability of the state-dependent scale supplies a single measurable Q, not separately selected fiber measures.

\[Q(s)=\mathcal L(X+\sqrt{\tau(s)/\beta(s)}Z),\quad X\sim M(s),\quad Z\sim N(0,I)\ \text{independent}.\]

Corresponding Lean step

Local gaussian_kernel; deterministic/constant kernel product, Kernel.map_apply and scaledStdGaussian.

2. Identify the ideal two-noise law

At a fixed state, apply TwoNoiseRGO with times eta/beta and tau/beta to its actual quadratic tilt. The resulting Gaussian semigroup identifies sequential ideal smoothing with the total time (eta+tau)/beta, which equals the H fiber constructed for the finite program. Positivity of beta,tau ensures the added time is strictly positive even when eta=0.

\[H_{\tau/\beta}(H_{\eta/\beta}T(s))=H_{(\eta+\tau)/\beta}T(s)=H(s).\]

Corresponding Lean step

Local gaussian_stage; TwoNoiseRGO.two_noise_rgo semigroup component, hsem and add_div.

3. Derive the exact per-stage KL allocation from W2

Use the genuine squared-W2 equals quadratic transport-cost identity and set the radius to the square root of the stated nonnegative source budget. GaussianKL compares the actually smoothed laws with denominator twice the added time tau/beta. Substituting equation (6.5) cancels kappa,beta,tau exactly. This needs no separate moment premises and assumes no KL conclusion.

\[\frac{\kappa[2\tau\Delta^2/(\kappa(J+1))]/\beta}{2\tau/\beta}=\frac{\Delta^2}{J+1}.\]

Corresponding Lean step

Local gaussian_stage; wassersteinDistance_sq, Real.sq_sqrt, GaussianKL.gaussian_kl_reverse_transport and field_simp.

4. Instantiate the actual finite recursive program

Use a=(eta+tau)/beta in FiniteRGOKLError. Its ideal target and observation kernels are chosen before M,L. Construct Q as above and instantiate the parent program with this same Q and L, retaining the explicit F, absorbing P and output recursion. The continuing-state W2 premise gives the derived observation-KL bound; stopped states require no W2 guarantee.

\[P(s)=\begin{cases}\delta_s,&\theta\le b(s),\\F(s,\cdot)_\#Q(s),&b(s)<\theta.\end{cases}\]

Corresponding Lean step

FiniteRGOKLError.finite_rgo_kl_error, gaussian_kernel, hlocal and actual hprog Q L.

5. Integrate the stage bound under actual visited laws

Set observation error to zero on stopped states. It is everywhere bounded by Delta^2/(J+1). Each P^j(s) is a probability measure, so its integral of this error is bounded by the same constant. Sum the n terms and retain the parent terminal integral exactly. The result is valid for any finite n, without claiming threshold arrival at J.

\[\sum_{j<n}\int e(x)\,P^j(s)(dx)\le n\frac{\Delta^2}{J+1}.\]

Corresponding Lean step

Main hp, herror and hbound; lintegral_mono, probability normalization and Finset.sum_le_sum.

Lean statement · gaussian_rgo_error_budget

Actual two-noise observation and finite recursive KL budget derived from the source-scaled squared-W2 premise.

theorem gaussian_rgo_error_budget (μ : Measure E) [IsProbabilityMeasure μ]
    (β κ η τ : PS → ℝ) (hβm : Measurable β) (_hκm : Measurable κ)
    (hηm : Measurable η) (hτm : Measurable τ)
    (hβ : ∀ s, 0 < β s) (hκ : ∀ s, 0 < κ s) (hη : ∀ s, 0 ≤ η s) (hτ : ∀ s, 0 < τ s)
    (threshold : ℝ≥0) (J : ℕ) (Δ : ℝ) (_hΔ : 0 ≤ Δ) :
    let a := fun s => (η s+τ s)/β s
    ∃ (T H : Kernel PS E), IsMarkovKernel T ∧ IsMarkovKernel H ∧
      (∀ s, T s = μ.tilted (fun x => -((s.1:ℝ)/2)*‖x-s.2.1‖^2)) ∧
      (∀ s, H s = GaussianSmoothing.gaussianSmoothing (T s) (Real.sqrt (a s))) ∧
      ∀ (M L : Kernel PS E), IsMarkovKernel M → IsMarkovKernel L →
      (∀ s, ¬threshold ≤ s.1 → WassersteinSpace.wassersteinDistance (M s)
        (GaussianSmoothing.gaussianSmoothing (T s) (Real.sqrt (η s/β s)))^2 ≤
        ENNReal.ofReal (κ s*(2*τ s*Δ^2/(κ s*((J:ℝ)+1)))/β s)) →
      ∃ (F : PS × E → PS) (Q : Kernel PS E) (P : Kernel PS PS) (R : ℕ → Kernel PS E),
        (∀ s y, ((F (s,y)).1:ℝ) = (s.1:ℝ)+(a s)⁻¹ ∧
          (F (s,y)).2 = (((s.1:ℝ)+(a s)⁻¹)⁻¹ • ((s.1:ℝ) • s.2.1+(a s)⁻¹ • y),
            s.2.2.1+1,fun n => Nat.casesOn n y s.2.2.2)) ∧
        IsMarkovKernel Q ∧ IsMarkovKernel P ∧ (∀ n, IsMarkovKernel (R n)) ∧
        (∀ s, Q s = GaussianSmoothing.gaussianSmoothing (M s) (Real.sqrt (τ s/β s))) ∧
        (∀ s, P s = if threshold ≤ s.1 then Measure.dirac s else (Q s).map (fun y => F (s,y))) ∧
        R 0 = L ∧
        (∀ n s, R (n+1) s = if threshold ≤ s.1 then L s else (Q s).bind (fun y => R n (F (s,y)))) ∧
        (∀ s, ¬threshold ≤ s.1 → klDiv (Q s) (H s) ≤ ENNReal.ofReal (Δ^2/((J:ℝ)+1))) ∧
        ∀ n s, klDiv (R n s) (T s) ≤
          (n:ℝ≥0∞)*ENNReal.ofReal (Δ^2/((J:ℝ)+1)) + ∫⁻ x, klDiv (L x) (T x) ∂(P^n) s

Exact module and namespace context

Lean proof · gaussian_rgo_error_budget

Measurable noise kernel, ideal Gaussian semigroup, source constant cancellation and actual finite-program occupation integral bound.

theorem gaussian_rgo_error_budget (μ : Measure E) [IsProbabilityMeasure μ]
    (β κ η τ : PS → ℝ) (hβm : Measurable β) (_hκm : Measurable κ)
    (hηm : Measurable η) (hτm : Measurable τ)
    (hβ : ∀ s, 0 < β s) (hκ : ∀ s, 0 < κ s) (hη : ∀ s, 0 ≤ η s) (hτ : ∀ s, 0 < τ s)
    (threshold : ℝ≥0) (J : ℕ) (Δ : ℝ) (_hΔ : 0 ≤ Δ) :
    let a := fun s => (η s+τ s)/β s
    ∃ (T H : Kernel PS E), IsMarkovKernel T ∧ IsMarkovKernel H ∧
      (∀ s, T s = μ.tilted (fun x => -((s.1:ℝ)/2)*‖x-s.2.1‖^2)) ∧
      (∀ s, H s = GaussianSmoothing.gaussianSmoothing (T s) (Real.sqrt (a s))) ∧
      ∀ (M L : Kernel PS E), IsMarkovKernel M → IsMarkovKernel L →
      (∀ s, ¬threshold ≤ s.1 → WassersteinSpace.wassersteinDistance (M s)
        (GaussianSmoothing.gaussianSmoothing (T s) (Real.sqrt (η s/β s)))^2 ≤
        ENNReal.ofReal (κ s*(2*τ s*Δ^2/(κ s*((J:ℝ)+1)))/β s)) →
      ∃ (F : PS × E → PS) (Q : Kernel PS E) (P : Kernel PS PS) (R : ℕ → Kernel PS E),
        (∀ s y, ((F (s,y)).1:ℝ) = (s.1:ℝ)+(a s)⁻¹ ∧
          (F (s,y)).2 = (((s.1:ℝ)+(a s)⁻¹)⁻¹ • ((s.1:ℝ) • s.2.1+(a s)⁻¹ • y),
            s.2.2.1+1,fun n => Nat.casesOn n y s.2.2.2)) ∧
        IsMarkovKernel Q ∧ IsMarkovKernel P ∧ (∀ n, IsMarkovKernel (R n)) ∧
        (∀ s, Q s = GaussianSmoothing.gaussianSmoothing (M s) (Real.sqrt (τ s/β s))) ∧
        (∀ s, P s = if threshold ≤ s.1 then Measure.dirac s else (Q s).map (fun y => F (s,y))) ∧
        R 0 = L ∧
        (∀ n s, R (n+1) s = if threshold ≤ s.1 then L s else (Q s).bind (fun y => R n (F (s,y)))) ∧
        (∀ s, ¬threshold ≤ s.1 → klDiv (Q s) (H s) ≤ ENNReal.ofReal (Δ^2/((J:ℝ)+1))) ∧
        ∀ n s, klDiv (R n s) (T s) ≤
          (n:ℝ≥0∞)*ENNReal.ofReal (Δ^2/((J:ℝ)+1)) + ∫⁻ x, klDiv (L x) (T x) ∂(P^n) s := by
  classical
  have gaussian_kernel {S : Type u} [MeasurableSpace S] (M : Kernel S E) [IsMarkovKernel M]
      (v : S → ℝ) (hv : Measurable v) :
      ∃ Q : Kernel S E, IsMarkovKernel Q ∧
        ∀ s, Q s = GaussianSmoothing.gaussianSmoothing (M s) (Real.sqrt (v s)) := by
    let N : Kernel S E :=
      ((Kernel.deterministic (id : S → S) measurable_id) ×ₖ Kernel.const S (stdGaussian E)).map
        (fun p : S × E => Real.sqrt (v p.1) • p.2)
    have hN : IsMarkovKernel N := by
      dsimp only [N]
      exact Kernel.IsMarkovKernel.map _ (by fun_prop)
    let := hN
    have hNf (s : S) : N s = GaussianSmoothing.scaledStdGaussian (E := E) (Real.sqrt (v s)) := by
      dsimp only [N]
      rw [Kernel.map_apply _ (by fun_prop), Kernel.prod_apply, Kernel.deterministic_apply,
        Kernel.const_apply, Measure.dirac_prod, Measure.map_map (by fun_prop) (by fun_prop)]
      rfl
    let Q := (M ×ₖ N).map (fun p : E × E => p.1+p.2)
    have hQ : IsMarkovKernel Q := by
      dsimp only [Q]
      exact Kernel.IsMarkovKernel.map _ (by fun_prop)
    refine ⟨Q,hQ,?_⟩
    intro s
    dsimp only [Q]
    rw [Kernel.map_apply _ (by fun_prop), Kernel.prod_apply, hNf]
    rfl
  have gaussian_stage (μ ν : Measure E) [IsProbabilityMeasure μ] [IsProbabilityMeasure ν]
      (b : ℝ) (hb : 0 ≤ b) (u : E) (β κ η τ Δ : ℝ)
      (hβ : 0 < β) (hκ : 0 < κ) (hη : 0 ≤ η) (hτ : 0 < τ) (J : ℕ)
      (hW : WassersteinSpace.wassersteinDistance ν
        (GaussianSmoothing.gaussianSmoothing (μ.tilted (fun x => -(b/2)*‖x-u‖^2)) (Real.sqrt (η/β))) ^ 2 ≤
        ENNReal.ofReal (κ * (2*τ*Δ^2/(κ*((J:ℝ)+1))) / β)) :
      klDiv (GaussianSmoothing.gaussianSmoothing ν (Real.sqrt (τ/β)))
        (GaussianSmoothing.gaussianSmoothing (μ.tilted (fun x => -(b/2)*‖x-u‖^2))
          (Real.sqrt ((η+τ)/β))) ≤ ENNReal.ofReal (Δ^2/((J:ℝ)+1)) := by
    have hj : 0 < (J:ℝ)+1 := by positivity
    have heta : 0 ≤ η/β := div_nonneg hη hβ.le
    have htau : 0 < τ/β := div_pos hτ hβ
    obtain ⟨hρ,hsem,K,hK,hKf,hrec,herr⟩ :=
      AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.TwoNoiseRGO.two_noise_rgo μ b (η/β) (τ/β) hb heta htau u
    let ρ := μ.tilted (fun x => -(b/2)*‖x-u‖^2)
    let := hρ
    have hsm : IsProbabilityMeasure (GaussianSmoothing.gaussianSmoothing ρ (Real.sqrt (η/β))) := by
      unfold GaussianSmoothing.gaussianSmoothing CommonNoiseContraction.addNoise
      exact Measure.isProbabilityMeasure_map (by fun_prop)
    let := hsm
    let r := Real.sqrt (κ * (2*τ*Δ^2/(κ*((J:ℝ)+1))) / β)
    have hrad : 0 ≤ κ * (2*τ*Δ^2/(κ*((J:ℝ)+1))) / β := by positivity
    have hr2 : r^2 = κ * (2*τ*Δ^2/(κ*((J:ℝ)+1))) / β := Real.sq_sqrt hrad
    have hcost : Transport.transportCost (fun z : E × E => ENNReal.ofReal (‖z.1-z.2‖^2)) ν
        (GaussianSmoothing.gaussianSmoothing ρ (Real.sqrt (η/β))) ≤ ENNReal.ofReal (r^2) := by
      rw [hr2]
      rw [WassersteinSpace.wassersteinDistance_sq] at hW
      exact hW
    have hg := AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.GaussianKL.gaussian_kl_reverse_transport ν
      (GaussianSmoothing.gaussianSmoothing ρ (Real.sqrt (η/β))) r (τ/β)
      (Real.sqrt_nonneg _) htau hcost
    have hscale : r^2/(2*(τ/β)) = Δ^2/((J:ℝ)+1) := by
      rw [hr2]
      field_simp
    rw [hscale,hsem,← add_div] at hg
    exact hg
  intro a
  have ha : Measurable a := (hηm.add hτm).div hβm
  have ha0 : ∀ s, 0 < a s := fun s => div_pos (add_pos_of_nonneg_of_pos (hη s) (hτ s)) (hβ s)
  let F : PS × E → PS := fun p =>
    (⟨(p.1.1:ℝ)+(a p.1)⁻¹,add_nonneg p.1.1.coe_nonneg (le_of_lt (inv_pos.mpr (ha0 p.1)))⟩,
     ((p.1.1:ℝ)+(a p.1)⁻¹)⁻¹ • ((p.1.1:ℝ) • p.1.2.1+(a p.1)⁻¹ • p.2),
     p.1.2.2.1+1,fun n => Nat.casesOn n p.2 p.1.2.2.2)
  obtain ⟨T,H,hT,hH,hTf,hHf,hprog⟩ :=
    AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.FiniteRGOKLError.finite_rgo_kl_error μ a ha ha0 threshold
  let := hT
  let := hH
  refine ⟨T,H,hT,hH,hTf,hHf,?_⟩
  intro M L hM hL hW
  let := hM
  let := hL
  obtain ⟨Q,hQ,hQf⟩ := gaussian_kernel M (fun s => τ s/β s) (hτm.div hβm)
  let := hQ
  have hlocal (s : PS) (hs : ¬threshold ≤ s.1) :
      klDiv (Q s) (H s) ≤ ENNReal.ofReal (Δ^2/((J:ℝ)+1)) := by
    rw [hQf,hHf,hTf]
    apply gaussian_stage μ (M s) (s.1:ℝ) s.1.coe_nonneg s.2.1 (β s) (κ s) (η s) (τ s) Δ
      (hβ s) (hκ s) (hη s) (hτ s) J
    simpa only [hTf] using hW s hs
  obtain ⟨P,R,hP,hR,hPf,hzero,hrec,he,ht,hbound⟩ := hprog Q L hQ hL
  let := hP
  refine ⟨F,Q,P,R,?_,hQ,hP,hR,hQf,hPf,hzero,hrec,hlocal,?_⟩
  · intro s y
    exact ⟨rfl,rfl⟩
  · have hp (n : ℕ) : IsMarkovKernel (P^n) := by
      induction n with
      | zero => change IsMarkovKernel Kernel.id; infer_instance
      | succ n ih =>
        let := ih
        rw [pow_succ]
        change IsMarkovKernel ((P^n) ∘ₖ P)
        infer_instance
    let := hp
    have herror (x : PS) : (if threshold ≤ x.1 then 0 else klDiv (Q x) (H x)) ≤
        ENNReal.ofReal (Δ^2/((J:ℝ)+1)) := by
      split_ifs with hs
      · positivity
      · exact hlocal x hs
    intro n s
    apply (hbound n s).trans
    apply add_le_add _ le_rfl
    calc
      _ ≤ ∑ j ∈ Finset.range n, ENNReal.ofReal (Δ^2/((J:ℝ)+1)) := by
        apply Finset.sum_le_sum
        intro j hj
        exact (lintegral_mono herror).trans_eq (by simp)
      _ = _ := by simp

end AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.GaussianRGOErrorBudget

Exact module and namespace context

Source assumptions versus formal assumptions

Source	Actual Lean	Difference kind	Why it matters
Euclidean Gibbs targets with source curvature parameters.	Any probability base on finite real Hilbert Borel E and positive measurable algebraic beta,kappa,tau.	generalization	No claim yet identifies beta,kappa with source curvature or tau with the selected heat branch; no density or marginal moment premise is added.
A1 returns a smoothed sampler with source-scaled Wasserstein accuracy.	A supplied Markov M satisfies the squared-W2 premise at continuing states; actual Q is constructed by adding independent Gaussian variance tau/beta.	API-limitation	This proves actual observation and recursive error transfer from the A1 interface, not concrete Picard implementation or its accuracy theorem.
Positive smoothing and precision and source logarithmic depth.	eta>=0, Delta>=0 and arbitrary natural J,n.	generalization	Zero parameters are valid for this algebraic transfer. J is only a budget parameter; for n>J no total-Delta guarantee follows.
Actual source equation(6.5) precision selection.	The same squared accuracy expression is substituted in the W2 premise; kappa measurability retained as an unused explicit input.	API-limitation	The cancellation is proved with added-noise denominator 2tau/beta; no implemented measurable precision selector is claimed.
Full recursion reaches a terminal FORS call and bounds its error and expected cost.	Actual finite program with terminal residual integral unchanged.	API-limitation	Same-program stopping support, FORS accuracy, initialized history and actual-input expected costs remain separate.

M is a supplied Markov kernel satisfying the displayed squared-W2 guarantee; its implementation and A1 correctness are not proved here. beta,kappa,tau are positive measurable algebraic functions, not yet identified with source curvature and heat choices. kappa measurability is an unused input condition, not a proved precision-selection implementation. eta may be zero, Delta is nonnegative, J may be zero, and n is unrestricted. J is a budget parameter: for n>J this bound does not establish total error below Delta^2. No stopping support, FORS accuracy, initialization validity, expected query cost or marginal P2 conclusion is asserted; the terminal residual remains.

Encoder–denoiser: accepted · domain-mismatch

Detected semantic differences

domains: General probability bases and algebraic parameters. — No curvature ratio identification claimed.
assumptions: M accuracy supplied but actual Q and KL derived. — hW, gaussian_kernel and hlocal; not Picard implementation.
domains: Zero eta,Delta,J and all n permitted. — Added time and J+1 positive; n>J not totalDelta guarantee.
constant_dependencies: Source squared precision algebraically substituted. — Exact hscale and unused kappa measurability disclosed; no selector implementation.
scopes: Terminal residual, stopping alignment and cost remain. — Terminal integral under actual P^n unchanged.

A generalization is not a source correction. Proposed missing conditions require separate independent repair review. No proposed repair silently changes the original theorem.

Scope and omitted-condition boundaries

M is a supplied Markov kernel satisfying the displayed squared-W2 guarantee; its implementation and A1 correctness are not proved here. beta,kappa,tau are positive measurable algebraic functions, not yet identified with source curvature and heat choices. kappa measurability is an unused input condition, not a proved precision-selection implementation. eta may be zero, Delta is nonnegative, J may be zero, and n is unrestricted. J is a budget parameter: for n>J this bound does not establish total error below Delta^2. No stopping support, FORS accuracy, initialization validity, expected query cost or marginal P2 conclusion is asserted; the terminal residual remains.

Source and reuse

ASTIS parents called

Mathlib API called (external library)

ProbabilityTheory.Kernel.map_apply
MeasureTheory.Measure.dirac_prod
WassersteinSpace.wassersteinDistance_sq
MeasureTheory.lintegral_mono
Finset.sum_le_sum

Mathematical sources

SPHMC v1 Theorem 6.5 A1 and equation (6.5) — Actual added-noise kernel and numerical error transfer from supplied A1 accuracy; no concrete sampler or terminal-cost result.

ASTIS prose is not a quotation or a source-equivalence certificate. Definitions and aliases are explained as constructions, not counted as new mathematical proofs.

Which proof edges are actually covered?

TODO — not closed by these contributions Actual source Gaussian accuracy budget through finite recursion

Actual Gibbs gradient second moment

ASTIS expanded mathematical proof component for Fan Chen, Sinho Chewi, Jianfeng Lu and Matthew S. Zhang, Smoothed Picard Hamiltonian Monte Carlo. Explicit integrability, normalization and domain extensions are disclosed; the full initialization/history and summed-cost argument is not asserted.

arXiv:2609.06906v1 · Section6.3 reference-point construction: ideal Gibbs gradient-moment proof component · faithful paraphrase

Complete source statement (ASTIS restatement)

The actual measure mu is a probability measure. Both norm(grad U)^2 and H are integrable under mu. Their expectations are equal, and the expected squared gradient is at most beta*finrank(E). These are five public conclusions; bare exponential integrability, weighted linear integrability and directional integration by parts are proved internally.

E is a complete finite-dimensional real inner-product space with its Borel sigma-algebra and canonical Lebesgue volume. Dimension zero is included. U:E->R is twice continuously differentiable.
The nonnegative real parameters alpha,beta satisfy 0<alpha and alpha<=beta. At every x,v the genuine Hessian obeys alpha*norm(v)^2<=D2U(x)[v,v]<=beta*norm(v)^2. The alpha<=beta assumption remains in the public statement, despite its unused binder name.
Define mu=volume.tilted(-U), the actual normalized exponential Gibbs measure. For the standard orthonormal basis (e_i), define H(x)=sum_i D2U(x)[e_i,e_i]. No minimizer, normalizing constant, weighted integrability or moment bound is supplied as an assumption.

Actual ideal-law gradient moment

\[\mu=(\mathrm{vol}).\mathrm{tilted}(-U),\qquad H(x)=\sum_i D^2U(x)[e_i,e_i],\qquad \mathbb E_\mu\|\nabla U\|^2=\mathbb E_\mu H\le\beta\dim E.\]

Read the formalized proofs

Each statement and proof below has its own closed Lean disclosure. ASTIS parents, Mathlib calls and external mathematical sources are distinguished in each proof.

ASTIS mathematical exposition

Actual Gibbs gradient second moment

AutoSamplingTheory.TechnicalLemmas.Analysis.GibbsGradientMoment.gibbs_gradient_moment · theorem · Teaching coverage

Statement

\[\mu=(\mathrm{vol}).\mathrm{tilted}(-U),\qquad H(x)=\sum_i D^2U(x)[e_i,e_i],\qquad \mathbb E_\mu\|\nabla U\|^2=\mathbb E_\mu H\le\beta\dim E.\]

All objects and hypotheses

E is a complete finite-dimensional real inner-product space with its Borel sigma-algebra and canonical Lebesgue volume. Dimension zero is included. U:E->R is twice continuously differentiable.
The nonnegative real parameters alpha,beta satisfy 0<alpha and alpha<=beta. At every x,v the genuine Hessian obeys alpha*norm(v)^2<=D2U(x)[v,v]<=beta*norm(v)^2. The alpha<=beta assumption remains in the public statement, despite its unused binder name.
Define mu=volume.tilted(-U), the actual normalized exponential Gibbs measure. For the standard orthonormal basis (e_i), define H(x)=sum_i D2U(x)[e_i,e_i]. No minimizer, normalizing constant, weighted integrability or moment bound is supplied as an assumption.

Mathematical proof

1. Obtain actual curvature, gradient growth and a Gaussian envelope

Instantiate QuadraticRegularization at zero regularization precision to obtain strong convexity and Lipschitz continuity of the actual gradient. Thus norm(grad U(x))<=G+beta*norm(x), with G=norm(grad U(0)). The first-order strong-convexity inequality at zero and Young inequality give U(x)>=b+a*norm(x)^2, where a=alpha/4>0 and b=U(0)-G^2/alpha. No minimizer is chosen. The existing Gibbs-integrability theorem supplies integrability of exp(-U).

\[\|\nabla U(x)\|\le G+\beta\|x\|,\quad U(x)\ge b+a\|x\|^2,\quad a=\alpha/4,\quad b=U(0)-G^2/\alpha.\]

Corresponding Lean step

weighted_gradient; QuadraticRegularization.strongConvexOn_and_lipschitzWith_gradient_add_quadratic; StrongConvexFirstOrder.firstOrder_lower_bound_of_strongConvexOn; StrongConvexGibbsIntegrability.integrable_exp_neg_of_strongConvexOn

2. Prove weighted square and first-power integrability

The inequality t<=exp(t), with t=a*r^2/2, absorbs r^2 into a Gaussian with half the exponent. For a continuous scalar q with norm(q(x))<=A+B*norm(x) and exp(w(x))<=C*exp(-a*norm(x)^2), expand the square and use this absorption to obtain the displayed integrable majorant. Apply it to q=norm(grad U), w=-U. Then norm(grad U)<=1+norm(grad U)^2 gives the weighted first-power L1 bound. Each domination is against a genuinely integrable Gaussian, not merely a bounded function.

\[r^2e^{-ar^2}\le\frac2a e^{-ar^2/2},\qquad e^{w(x)}q(x)^2\le C\left(2A^2+\frac{4B^2}{a}\right)e^{-a\|x\|^2/2}.\]

Corresponding Lean step

absorb_quadratic; weighted_square; weighted_gradient; Integrability.integrable_exp_neg_mul_norm_sq; MeasureTheory.Integrable.mono'

3. Apply full-space integration by parts only after all three L1 checks

Fix a unit basis direction v and put f=exp(-U), q=DU[v]. C2 gives q in C1 and its actual directional derivative D2U[v,v]; the derivative of f is -f*q. The three products needed by the Haar-volume IBP theorem are -f*q^2, f*D2U[v,v], and f*q. Weighted gradient-square and gradient-norm integrability bound the first and third; 0<=D2U[v,v]<=beta and bare weight integrability bound the second. Only then apply the full-space IBP identity. There is no assumed vanishing boundary term, cutoff or third derivative.

\[D_vf=-fq,\quad D_vq=D^2U[v,v],\qquad \int fD^2U[v,v]= -\int (D_vf)q=\int fq^2.\]

Corresponding Lean step

directional_ibp; MeasureTheory.integral_mul_fderiv_eq_neg_fderiv_mul_of_integrable

4. Sum the directional identities and identify the actual gradient square

The standard orthonormal basis has finitely many vectors. Each weighted directional square and Hessian diagonal term is integrable, so their sums may pass through the integral. Parseval identifies the sum of squared genuine directional derivatives with the squared norm of the actual gradient. This proves the unnormalized weighted identity and integrability of the weighted Hessian diagonal sum, including the empty basis in dimension zero.

\[\sum_i(DU[e_i])^2=\|\nabla U\|^2,\qquad \int e^{-U}\|\nabla U\|^2=\int e^{-U}\sum_iD^2U[e_i,e_i].\]

Corresponding Lean step

gibbs_gradient_moment: hdir, hHi, hparseval, heq; OrthonormalBasis.sum_sq_norm_inner_left; MeasureTheory.integral_finsetSum

5. Normalize the actual exponential measure and transfer L1

Canonical volume is nonzero, also in dimension zero. The positive integrable exponential therefore has a positive finite normalizer, as used by isProbabilityMeasure_tilted. The tilted-integrability equivalence converts the two proved weighted L1 statements into actual Gibbs L1 statements. integral_tilted rewrites both expectations with the same normalizing denominator; their equality follows from the already proved weighted identity. No undefined-integral fallback or supplied probability assumption is used.

\[Z=\int e^{-U}>0,\qquad \mathbb E_\mu g=\frac{\int e^{-U}g}{Z},\qquad \|\nabla U\|^2,H\in L^1(\mu).\]

Corresponding Lean step

gibbs_gradient_moment: hgμ, hHμ, htilt, heqμ; MeasureTheory.isProbabilityMeasure_tilted; MeasureTheory.integrable_tilted_iff; MeasureTheory.integral_tilted

6. Use the Hessian upper bound under the same Gibbs law

Every basis vector has unit norm, so each Hessian diagonal entry is at most beta. Their sum is at most beta times finrank(E). Integrate this inequality under the actual probability measure and use the moment identity. The result concerns the ideal Gibbs law; the actual approximate initialization law still needs its own moment-transfer proof before supplying a reference-descent cost bound.

\[H(x)\le\beta\dim E\quad\Longrightarrow\quad \mathbb E_\mu\|\nabla U\|^2=\mathbb E_\mu H\le\beta\dim E.\]

Corresponding Lean step

gibbs_gradient_moment: hdiag, hbound; MeasureTheory.integral_mono; MeasureTheory.probReal_univ

Lean statement · gibbs_gradient_moment

Actual normalized Gibbs probability, gradient-square and Hessian-diagonal-sum L1, expectation identity and beta*finrank bound.

theorem gibbs_gradient_moment [CompleteSpace E] {U : E → ℝ} {α β : ℝ≥0}
    (hα : 0 < α) (_hαβ : α ≤ β) (hU : ContDiff ℝ 2 U)
    (hH : ∀ x v : E, (α : ℝ)*‖v‖^2 ≤ fderiv ℝ (fderiv ℝ U) x v v ∧
      fderiv ℝ (fderiv ℝ U) x v v ≤ (β : ℝ)*‖v‖^2) :
    let μ := (volume : Measure E).tilted (fun x => -U x)
    let H := fun x => ∑ i, fderiv ℝ (fderiv ℝ U) x
      ((stdOrthonormalBasis ℝ E) i) ((stdOrthonormalBasis ℝ E) i)
    IsProbabilityMeasure μ ∧ Integrable (fun x => ‖gradient U x‖^2) μ ∧
      Integrable H μ ∧ (∫ x, ‖gradient U x‖^2 ∂μ) = (∫ x, H x ∂μ) ∧
      (∫ x, ‖gradient U x‖^2 ∂μ) ≤ (β : ℝ)*Module.finrank ℝ E

Exact module and namespace context

Lean proof · gibbs_gradient_moment

Derive noncompact weighted integrability from curvature, apply directional Haar IBP, sum via Parseval, normalize the actual exponential measure and integrate the Hessian bound.

theorem gibbs_gradient_moment [CompleteSpace E] {U : E → ℝ} {α β : ℝ≥0}
    (hα : 0 < α) (_hαβ : α ≤ β) (hU : ContDiff ℝ 2 U)
    (hH : ∀ x v : E, (α : ℝ)*‖v‖^2 ≤ fderiv ℝ (fderiv ℝ U) x v v ∧
      fderiv ℝ (fderiv ℝ U) x v v ≤ (β : ℝ)*‖v‖^2) :
    let μ := (volume : Measure E).tilted (fun x => -U x)
    let H := fun x => ∑ i, fderiv ℝ (fderiv ℝ U) x
      ((stdOrthonormalBasis ℝ E) i) ((stdOrthonormalBasis ℝ E) i)
    IsProbabilityMeasure μ ∧ Integrable (fun x => ‖gradient U x‖^2) μ ∧
      Integrable H μ ∧ (∫ x, ‖gradient U x‖^2 ∂μ) = (∫ x, H x ∂μ) ∧
      (∫ x, ‖gradient U x‖^2 ∂μ) ≤ (β : ℝ)*Module.finrank ℝ E := by
  classical
  let μ := (volume : Measure E).tilted (fun x => -U x)
  let b := stdOrthonormalBasis ℝ E
  let H := fun x => ∑ i, fderiv ℝ (fderiv ℝ U) x (b i) (b i)
  have hw := weighted_gradient hα hU hH
  have hunit (i) : ‖b i‖ = 1 := b.orthonormal.norm_eq_one i
  have hdiag (x : E) (i) : 0 ≤ fderiv ℝ (fderiv ℝ U) x (b i) (b i) ∧
      fderiv ℝ (fderiv ℝ U) x (b i) (b i) ≤ β := by
    have hh := hH x (b i)
    rw [hunit,one_pow,mul_one,mul_one] at hh
    exact ⟨(NNReal.coe_nonneg α).trans hh.1,hh.2⟩
  have hdir (i) := directional_ibp hU (b i) (hunit i) (fun x => hdiag x i)
    hw.1 hw.2.1 hw.2.2
  have hHi : Integrable (fun x => Real.exp (-U x)*H x) (volume : Measure E) := by
    have hi := integrable_finsetSum Finset.univ (fun i _ => (hdir i).2.1)
    simpa only [H,Finset.mul_sum] using hi
  have hparseval (x : E) : (∑ i, (fderiv ℝ U x (b i))^2) = ‖gradient U x‖^2 := by
    simpa only [inner_gradient_left,Real.norm_eq_abs,sq_abs] using
      b.sum_sq_norm_inner_left (gradient U x)
  have heq : (∫ x, Real.exp (-U x)*‖gradient U x‖^2) = ∫ x, Real.exp (-U x)*H x := by
    calc
      (∫ x, Real.exp (-U x)*‖gradient U x‖^2) =
          ∫ x, ∑ i, Real.exp (-U x)*(fderiv ℝ U x (b i))^2 := by
        simp only [← Finset.mul_sum,hparseval]
      _ = ∑ i, ∫ x, Real.exp (-U x)*(fderiv ℝ U x (b i))^2 :=
        integral_finsetSum _ (fun i _ => (hdir i).1)
      _ = ∑ i, ∫ x, Real.exp (-U x)*fderiv ℝ (fderiv ℝ U) x (b i) (b i) := by
        apply Finset.sum_congr rfl
        intro i _
        exact (hdir i).2.2
      _ = ∫ x, ∑ i, Real.exp (-U x)*fderiv ℝ (fderiv ℝ U) x (b i) (b i) :=
        (integral_finsetSum _ (fun i _ => (hdir i).2.1)).symm
      _ = ∫ x, Real.exp (-U x)*H x := by simp only [H,Finset.mul_sum]
  have : IsProbabilityMeasure μ := isProbabilityMeasure_tilted hw.1
  have hgμ : Integrable (fun x => ‖gradient U x‖^2) μ := by
    apply (integrable_tilted_iff hw.1 _).2
    simpa only [smul_eq_mul] using hw.2.1
  have hHμ : Integrable H μ := by
    apply (integrable_tilted_iff hw.1 _).2
    simpa only [smul_eq_mul] using hHi
  have htilt (g : E → ℝ) : (∫ x, g x ∂μ) =
      (∫ x, Real.exp (-U x)*g x)/(∫ x, Real.exp (-U x)) := by
    rw [integral_tilted]
    simp only [smul_eq_mul]
    rw [← integral_div]
    apply integral_congr_ae
    filter_upwards with x
    ring
  have heqμ : (∫ x, ‖gradient U x‖^2 ∂μ) = ∫ x, H x ∂μ := by
    rw [htilt,htilt,heq]
  refine ⟨inferInstance,hgμ,hHμ,heqμ,?_⟩
  change (∫ x, ‖gradient U x‖^2 ∂μ) ≤ (β : ℝ)*Module.finrank ℝ E
  rw [heqμ]
  have hbound (x : E) : H x ≤ (β : ℝ)*Module.finrank ℝ E := by
    calc
      H x ≤ ∑ _i : Fin (Module.finrank ℝ E), (β : ℝ) :=
        Finset.sum_le_sum (fun i _ => (hdiag x i).2)
      _ = (β : ℝ)*Module.finrank ℝ E := by simp [mul_comm]
  simpa only [integral_const,probReal_univ,one_smul] using
    integral_mono hHμ (integrable_const ((β : ℝ)*Module.finrank ℝ E)) hbound

end AutoSamplingTheory.TechnicalLemmas.Analysis.GibbsGradientMoment

Exact module and namespace context

Source assumptions versus formal assumptions

Source	Actual Lean	Difference kind	Why it matters
The paper uses Euclidean space of positive dimension.	Complete finite-dimensional real inner-product Borel space, including dimension zero.	generalization	Coordinate-free and zero-dimensional extensions are explicit; the actual proof handles the empty basis and canonical nonzero volume.
Section6.3 uses a normalized smoothness bound for its recursive potential.	Actual Hessian upper bound beta with 0<alpha<=beta.	generalization	The explicit beta*finrank bound specializes to beta=1. The alpha<=beta hypothesis is retained, not silently removed.
The ideal Gibbs gradient moment is used in the initial-gradient estimate.	Actual tilted probability, both Gibbs L1 statements, and a moment identity preceding the bound.	source-implicit	Weighted noncompact integrability and normalization are proved before IBP and expectation; they are not added as hypotheses.
The Hessian trace interpretation underlies the standard gradient-moment calculation.	Actual standard-orthonormal-basis Hessian diagonal sum H.	source-implicit	No independent abstract trace/Laplacian or basis-invariance API theorem is claimed.
The Gibbs moment is one input to the larger reference-initialization estimate.	Ideal Gibbs moment component only.	same	Approximate/smoothed output moments, Gaussian perturbations, conditional histories and summed gradient cost remain separate.

This is the ideal Gibbs gradient-moment component used in SPHMC Section6.3. The coordinate-free finite-dimensional formulation includes dimension zero. The general beta bound specializes to the source normalized beta=1 setting. The alpha<=beta hypothesis is retained. H is the genuine Hessian diagonal sum in the standard orthonormal basis; no separate abstract trace/Laplacian API or basis-independence theorem is asserted. All weighted L1 and normalization prerequisites are proved from actual curvature. The Gaussian domination constants may depend on alpha,beta,U(0),grad U(0), but the final expectation bound is beta*finrank(E). Approximate or smoothed output moments, random-history conditioning, Gaussian perturbation, and summed reference-query cost remain separate obligations. This does not complete either paper.

Encoder–denoiser: accepted · domain-mismatch

Detected semantic differences

domains: Coordinate-free and zero-dimensional extensions explicit and proved. — Independent reviewer accepted: Coordinate-free and zero-dimensional extensions explicit and proved.
assumptions: General beta specializes to normalized beta1; alpha<=beta retained. — Independent reviewer accepted: General beta specializes to normalized beta1; alpha<=beta retained.
conclusion: Normalization, noncompact L1 and moment identity proved rather than assumed. — Independent reviewer accepted: Normalization, noncompact L1 and moment identity proved rather than assumed.
objects: H is explicit standard-basis diagonal sum; no separate trace/Laplacian/basis-invariance API theorem. — Independent reviewer accepted: H is explicit standard-basis diagonal sum; no separate trace/Laplacian/basis-invariance API theorem.
scopes: Only ideal-law input to larger initialization and cost argument. — Independent reviewer accepted: Only ideal-law input to larger initialization and cost argument.

A generalization is not a source correction. Proposed missing conditions require separate independent repair review. No proposed repair silently changes the original theorem.

Scope and omitted-condition boundaries

This is the ideal Gibbs gradient-moment component used in SPHMC Section6.3. The coordinate-free finite-dimensional formulation includes dimension zero. The general beta bound specializes to the source normalized beta=1 setting. The alpha<=beta hypothesis is retained. H is the genuine Hessian diagonal sum in the standard orthonormal basis; no separate abstract trace/Laplacian API or basis-independence theorem is asserted. All weighted L1 and normalization prerequisites are proved from actual curvature. The Gaussian domination constants may depend on alpha,beta,U(0),grad U(0), but the final expectation bound is beta*finrank(E). Approximate or smoothed output moments, random-history conditioning, Gaussian perturbation, and summed reference-query cost remain separate obligations. This does not complete either paper.

Source and reuse

ASTIS parents called

Mathlib API called (external library)

MeasureTheory.integral_mul_fderiv_eq_neg_fderiv_mul_of_integrable
OrthonormalBasis.sum_sq_norm_inner_left
MeasureTheory.integrable_finsetSum
MeasureTheory.integral_finsetSum
MeasureTheory.isProbabilityMeasure_tilted
MeasureTheory.integrable_tilted_iff
MeasureTheory.integral_tilted
MeasureTheory.integral_mono

Mathematical sources

SPHMC Section6.3 ideal Gibbs gradient moment — Ideal-law moment input to reference-point initialization; actual history and total cost remain separate.

ASTIS prose is not a quotation or a source-equivalence certificate. Definitions and aliases are explained as constructions, not counted as new mathematical proofs.

Which proof edges are actually covered?

Local proof component; source adapter/review separate Actual normalized ideal Gibbs gradient second moment

Actual Gibbs position moment about a stationary point

ASTIS original proof of the position-moment component needed by Fan Chen,Sinho Chewi,Jianfeng Lu and Matthew S. Zhang,Smoothed Picard Hamiltonian Monte Carlo;not a verbatim theorem or the complete Lemma4.2.

arXiv:2609.06906v1 · Lemma4.2,equation(4.6) final standardized-potential position moment; source C2/Hessian setting(1.1) · faithful paraphrase

Complete source statement (ASTIS restatement)

The actual mu is a probability measure. The function exp(-U) is integrable against volume and its integral Z is strictly positive. Both norm(x-p)^2 and inner(x-p,gradient U(x)) are integrable against mu. Their actual integrals satisfy integral inner(x-p,gradient U(x)) dmu=d and integral norm(x-p)^2 dmu<=d/alpha.

E is a finite-dimensional real inner-product Borel space,with its complete metric structure; d=dim_R E may be zero. Volume is its canonical Lebesgue measure.
alpha and beta are nonnegative real numbers,0<alpha and alpha<=beta. U:E->R is twice continuously Frechet differentiable. For every x,v,alpha*norm(v)^2<=D2U(x)[v,v]<=beta*norm(v)^2. The derivatives and gradient are genuine derivatives of U.
p is any supplied point of E satisfying gradient U(p)=0. Existence of a stationary point is not concluded by this theorem. Set Z=integral exp(-U(x)) dx and mu=volume.tilted(-U); the tilt is the actual normalized exponential measure,not an arbitrary probability law.
All displayed real integrals are Bochner integrals. Integrability is proved explicitly; no moment bound or vanishing boundary term is supplied.

Actual normalized Gibbs position moment

\[\mu(dx)=Z^{-1}e^{-U(x)}dx,\qquad\int\langle x-p,\nabla U(x)\rangle\,d\mu=d,\qquad\int\|x-p\|^2\,d\mu\le d/\alpha.\]

Read the formalized proofs

Each statement and proof below has its own closed Lean disclosure. ASTIS parents, Mathlib calls and external mathematical sources are distinguished in each proof.

ASTIS mathematical exposition

Actual Gibbs position moment about a stationary point

AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.GibbsPositionMoment.gibbs_position_moment · theorem · Teaching coverage

Statement

\[\mu(dx)=Z^{-1}e^{-U(x)}dx,\qquad\int\langle x-p,\nabla U(x)\rangle\,d\mu=d,\qquad\int\|x-p\|^2\,d\mu\le d/\alpha.\]

All objects and hypotheses

E is a finite-dimensional real inner-product Borel space,with its complete metric structure; d=dim_R E may be zero. Volume is its canonical Lebesgue measure.
alpha and beta are nonnegative real numbers,0<alpha and alpha<=beta. U:E->R is twice continuously Frechet differentiable. For every x,v,alpha*norm(v)^2<=D2U(x)[v,v]<=beta*norm(v)^2. The derivatives and gradient are genuine derivatives of U.
p is any supplied point of E satisfying gradient U(p)=0. Existence of a stationary point is not concluded by this theorem. Set Z=integral exp(-U(x)) dx and mu=volume.tilted(-U); the tilt is the actual normalized exponential measure,not an arbitrary probability law.
All displayed real integrals are Bochner integrals. Integrability is proved explicitly; no moment bound or vanishing boundary term is supplied.

Mathematical proof

1. Obtain actual Gibbs normalization and gradient integrability

Use QuadraticRegularization at zero added precision to derive strong convexity from the genuine Hessian. StrongConvexGibbsIntegrability gives exponential-weight L1. The previously compiled GibbsGradientMoment theorem supplies probability and gradient-square L1 under this same normalized tilt. Its numerical gradient bound is not the final position bound.

\[e^{-U}\in L^1(dx),\qquad\|\nabla U\|^2\in L^1(\mu).\]

Corresponding Lean step

stationary_position_integrability: hdata,hg,hprob,hgrad,hweight

2. Derive pointwise coercivity from the actual stationary point

Strong convexity gives strong monotonicity of the genuine gradient. Substitute gradient U(p)=0 and use Cauchy-Schwarz. Treat x=p separately before cancelling the positive displacement norm; divide only by alpha>0.

\[\alpha\|x-p\|^2\le\langle x-p,\nabla U(x)\rangle,\qquad\|x-p\|\le\|\nabla U(x)\|/\alpha.\]

Corresponding Lean step

stationary_position_integrability: hcoercive,hbound,hz,hn

3. Prove position and pairing integrability

Dominate position square by gradient square divided by alpha squared. Probability and the bound t<=1+t^2 give position-norm L1. Cauchy-Schwarz and Young give L1 for the position-gradient pairing. These estimates establish integrability only; they do not replace the source sharp constant with beta/alpha squared.

\[\|x-p\|^2\le\alpha^{-2}\|\nabla U(x)\|^2,\qquad|\langle x-p,\nabla U(x)\rangle|\le\|x-p\|^2+\|\nabla U(x)\|^2.\]

Corresponding Lean step

stationary_position_integrability: hpos,hlin,hpair

4. Justify every full-space coordinate IBP input

For a unit vector v,set f=exp(-U),q(x)=inner(x-p,v),a(x)=D_vU(x). Position and gradient L1/L2 bounds dominate q and qa under the actual tilt. The tilted-integrability equivalence transfers them to volume using the already proved exponential L1. Differentiate the actual functions: D_vq=1 and D_vf=-fa. Thus fq,f D_vq,and (D_vf)q are all integrable before invoking full-space IBP.

\[D_vq=1,\quad D_vf=-fa,\quad fq,\ fD_vq,\ (D_vf)q\in L^1(dx).\]

Corresponding Lean step

coordinate_position_ibp: hqder,hfder,hqbound,habound,hqμ,hqaμ,hfq,hfqa,hf'q,hfq'

5. Evaluate each coordinate and sum the finite basis

The justified IBP identity gives integral f*q*a=integral f=Z for every unit basis vector. Sum the finite orthonormal basis and use its inner-product expansion. Every coordinate term is integrable,so finite sums commute with the integral. In dimension zero the sum is empty and yields zero.

\[\int e^{-U}\langle x-p,v\rangle D_vU\,dx=Z,\qquad\int e^{-U}\langle x-p,\nabla U\rangle\,dx=dZ.\]

Corresponding Lean step

coordinate_position_ibp: hid; gibbs_position_moment: b,hdir,hparseval,heq

6. Normalize the actual exponential tilt

The exponential integral is strictly positive by integral_exp_pos and finite by the established integrability. Apply the actual integral_tilted formula and factor out this same normalizer. Cancelling Z in dZ/Z proves the position-gradient identity under mu.

\[0<Z<\infty,\qquad\int\langle x-p,\nabla U(x)\rangle\,d\mu=dZ/Z=d.\]

Corresponding Lean step

gibbs_position_moment: hZ,htilt,hid

7. Integrate coercivity to obtain the sharp position moment

Both position square and the pairing are integrable. Integrate the pointwise strong-convexity inequality,substitute the exact pairing moment d,and divide by positive alpha. The upper curvature beta was used for the integrability route but does not enter this final constant.

\[\alpha\int\|x-p\|^2d\mu\le d\quad\Longrightarrow\quad\int\|x-p\|^2d\mu\le d/\alpha.\]

Corresponding Lean step

gibbs_position_moment: hi,integral_const_mul,le_div_iff₀

Lean statement · gibbs_position_moment

Actual Gibbs normalization,L1,position-gradient=d and position-square<=d/alpha with genuine Hessian and stationary-point assumptions.

theorem gibbs_position_moment {U : E → ℝ} {α β : ℝ≥0}
    (hα : 0 < α) (hαβ : α ≤ β) (hU : ContDiff ℝ 2 U)
    (hH : ∀ x v : E, (α : ℝ)*‖v‖^2 ≤ fderiv ℝ (fderiv ℝ U) x v v ∧
      fderiv ℝ (fderiv ℝ U) x v v ≤ (β : ℝ)*‖v‖^2)
    (p : E) (hp : gradient U p = 0) :
    let μ := (volume : Measure E).tilted (fun x => -U x)
    IsProbabilityMeasure μ ∧
    Integrable (fun x => Real.exp (-U x)) (volume : Measure E) ∧
    0 < (∫ x, Real.exp (-U x)) ∧
    Integrable (fun x => ‖x-p‖^2) μ ∧
    Integrable (fun x => inner ℝ (x-p) (gradient U x)) μ ∧
    (∫ x, inner ℝ (x-p) (gradient U x) ∂μ) = Module.finrank ℝ E ∧
    (∫ x, ‖x-p‖^2 ∂μ) ≤ (Module.finrank ℝ E : ℝ)/(α : ℝ)

Exact module and namespace context

Lean proof · gibbs_position_moment

Actual gradient L1 implies position L1;full-space coordinate IBP and finite basis sum;positive normalizer and actual tilt;integrate coercivity.

theorem gibbs_position_moment {U : E → ℝ} {α β : ℝ≥0}
    (hα : 0 < α) (hαβ : α ≤ β) (hU : ContDiff ℝ 2 U)
    (hH : ∀ x v : E, (α : ℝ)*‖v‖^2 ≤ fderiv ℝ (fderiv ℝ U) x v v ∧
      fderiv ℝ (fderiv ℝ U) x v v ≤ (β : ℝ)*‖v‖^2)
    (p : E) (hp : gradient U p = 0) :
    let μ := (volume : Measure E).tilted (fun x => -U x)
    IsProbabilityMeasure μ ∧
    Integrable (fun x => Real.exp (-U x)) (volume : Measure E) ∧
    0 < (∫ x, Real.exp (-U x)) ∧
    Integrable (fun x => ‖x-p‖^2) μ ∧
    Integrable (fun x => inner ℝ (x-p) (gradient U x)) μ ∧
    (∫ x, inner ℝ (x-p) (gradient U x) ∂μ) = Module.finrank ℝ E ∧
    (∫ x, ‖x-p‖^2 ∂μ) ≤ (Module.finrank ℝ E : ℝ)/(α : ℝ) := by
  classical
  let μ := (volume : Measure E).tilted (fun x => -U x)
  let b := stdOrthonormalBasis ℝ E
  rcases stationary_position_integrability hα hαβ hU hH p hp with
    ⟨hprob,hw,hpos,hlin,hpair,hcoerce⟩
  have hgrad := (GibbsGradientMoment.gibbs_gradient_moment hα hαβ hU hH).2.1
  have hdir (i) := coordinate_position_ibp hU p (b i) (b.orthonormal.norm_eq_one i)
    hw hpos hlin hgrad
  have hparseval (x : E) :
      (∑ i, inner ℝ (x-p) (b i)*fderiv ℝ U x (b i)) = inner ℝ (x-p) (gradient U x) := by
    simpa [inner_gradient_right] using b.sum_inner_mul_inner (x-p) (gradient U x)
  have heq : (∫ x, Real.exp (-U x)*inner ℝ (x-p) (gradient U x)) =
      (Module.finrank ℝ E : ℝ)*(∫ x, Real.exp (-U x)) := by
    calc
      (∫ x, Real.exp (-U x)*inner ℝ (x-p) (gradient U x)) =
          ∫ x, ∑ i, Real.exp (-U x)*inner ℝ (x-p) (b i)*fderiv ℝ U x (b i) := by
        apply integral_congr_ae
        filter_upwards with x
        rw [← hparseval x,Finset.mul_sum]
        simp only [mul_assoc]
      _ = ∑ i, ∫ x, Real.exp (-U x)*inner ℝ (x-p) (b i)*fderiv ℝ U x (b i) :=
        integral_finsetSum _ (fun i _ => (hdir i).1)
      _ = ∑ _i : Fin (Module.finrank ℝ E), ∫ x, Real.exp (-U x) := by
        apply Finset.sum_congr rfl
        intro i _
        exact (hdir i).2
      _ = (Module.finrank ℝ E : ℝ)*(∫ x, Real.exp (-U x)) := by simp
  have hZ : 0 < (∫ x, Real.exp (-U x)) := integral_exp_pos hw
  have htilt (g : E → ℝ) : (∫ x, g x ∂μ) =
      (∫ x, Real.exp (-U x)*g x)/(∫ x, Real.exp (-U x)) := by
    rw [integral_tilted]
    simp only [smul_eq_mul]
    rw [← integral_div]
    apply integral_congr_ae
    filter_upwards with x
    ring
  have hid : (∫ x, inner ℝ (x-p) (gradient U x) ∂μ) = Module.finrank ℝ E := by
    rw [htilt,heq]
    exact mul_div_cancel_right₀ _ hZ.ne'
  refine ⟨hprob,hw,hZ,hpos,hpair,hid,?_⟩
  have hi := integral_mono (hpos.const_mul (α : ℝ)) hpair hcoerce
  rw [integral_const_mul] at hi
  change (∫ x, inner ℝ (x-p) (gradient U x) ∂μ) = Module.finrank ℝ E at hid
  rw [hid] at hi
  apply (le_div_iff₀ (show (0 : ℝ) < α from hα)).2
  nlinarith [hi]


end AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.GibbsPositionMoment

Exact module and namespace context

Source assumptions versus formal assumptions

Source	Actual Lean	Difference kind	Why it matters
Source uses Euclidean positive dimension.	Finite-dimensional real inner-product Borel space including dimension zero.	generalization	The empty-basis case is proved;no infinite-dimensional statement.
Source standardized potential has lower curvature1 and upper curvature1+eta.	Genuine C2 Hessian bounds0<alpha<=beta with arbitrary finite beta.	generalization	Source consumer satisfies this contract;the proof is not advertised as a weakest-hypothesis theorem.
The source potential is centered at its stationary point zero.	An arbitrary actual stationary point p is explicitly supplied.	generalization	Stationarity is not assumed of an unrelated reference point and existence is not claimed;the source zero-point cancellation remains a separate adapter.
Source (4.6) uses the standardized actual RGO law.	The measure here is actual volume.tilted(-U).	API-limitation	The affine RGO identification is still required;it needs the proximal equation and measure transport.
Source needs the bound E norm(u)^2<=d.	The theorem proves the exact pairing moment d and position bound d/alpha.	generalization	At alpha=1 the numerical source constant1 is preserved;beta does not enter the final bound.
Full-space integrals and IBP underlie the source moment step.	Exponential L1,positive normalizer,position/pairing L1 and coordinate IBP are proved.	source-implicit	No integrability,boundary disappearance or moment identity is a supplied closure assumption.
Lemma4.2 also needs Gaussian transport-Fisher and actual score bias.	Only the actual Gibbs position-moment component is proved.	API-limitation	No full bias theorem,Picard accuracy,initialization or expected query cost is claimed.

Actual normalized volume.tilted(-U),genuine C2 lower/upper Hessian bounds and an explicitly supplied actual stationary point p. The proof establishes normalization,L1,exact position-gradient moment and sharp dimension/curvature bound. General p,positive alpha,finite beta,coordinate-free and zero-dimensional spaces are disclosed extensions. It is not a weakest-hypothesis strong-log-concavity theorem. The source consumer has standardized potential norm(u)^2/2+rho_y(u),p=0,alpha=1,beta=1+eta;stationarity follows from cancellation of the defining linear term. Identification with the affine image of the actual RGO needs the proximal equation and a separate measure-transport proof. No Gaussian transport-Fisher,smoothed-score identity,estimator bias,Picard accuracy,initialization or query-cost theorem is asserted.

Encoder–denoiser: accepted · domain-mismatch

Detected semantic differences

domains: Coordinate-free and zero-dimensional extension. — Independent formal source reviewer accepted: Coordinate-free and zero-dimensional extension.
assumptions: General lower and upper curvature contract. — Independent formal source reviewer accepted: General lower and upper curvature contract.
quantifiers: General actual stationary point is supplied. — Independent formal source reviewer accepted: General actual stationary point is supplied.
objects: Actual tilt versus remaining affine RGO identification. — Independent formal source reviewer accepted: Actual tilt versus remaining affine RGO identification.
conclusion: Exact pairing identity and sharp d/alpha extension. — Independent formal source reviewer accepted: Exact pairing identity and sharp d/alpha extension.
assumptions: Explicit L1,normalization and IBP justification. — Independent formal source reviewer accepted: Explicit L1,normalization and IBP justification.
scopes: Position-moment component,not full bias theorem. — Independent formal source reviewer accepted: Position-moment component,not full bias theorem.

A generalization is not a source correction. Proposed missing conditions require separate independent repair review. No proposed repair silently changes the original theorem.

Scope and omitted-condition boundaries

Actual normalized volume.tilted(-U),genuine C2 lower/upper Hessian bounds and an explicitly supplied actual stationary point p. The proof establishes normalization,L1,exact position-gradient moment and sharp dimension/curvature bound. General p,positive alpha,finite beta,coordinate-free and zero-dimensional spaces are disclosed extensions. It is not a weakest-hypothesis strong-log-concavity theorem. The source consumer has standardized potential norm(u)^2/2+rho_y(u),p=0,alpha=1,beta=1+eta;stationarity follows from cancellation of the defining linear term. Identification with the affine image of the actual RGO needs the proximal equation and a separate measure-transport proof. No Gaussian transport-Fisher,smoothed-score identity,estimator bias,Picard accuracy,initialization or query-cost theorem is asserted.

Source and reuse

ASTIS parents called

Mathlib API called (external library)

MeasureTheory.integrable_tilted_iff
MeasureTheory.integral_mul_fderiv_eq_neg_fderiv_mul_of_integrable
OrthonormalBasis.sum_inner_mul_inner
MeasureTheory.integral_finsetSum
MeasureTheory.integral_exp_pos
MeasureTheory.integral_tilted
MeasureTheory.integral_mono

Mathematical sources

SPHMC Lemma4.2,(4.6) position moment — Actual normalized volume.tilted(-U),genuine C2 lower/upper Hessian bounds and an explicitly supplied actual stationary point p. The proof establishes normalization,L1,exact position-gradient moment and sharp dimension/curvature bound. General p,positive alpha,finite beta,coordinate-free and zero-dimensional spaces are disclosed extensions. It is not a weakest-hypothesis strong-log-concavity theorem. The source consumer has standardized potential norm(u)^2/2+rho_y(u),p=0,alpha=1,beta=1+eta;stationarity follows from cancellation of the defining linear term. Identification with the affine image of the actual RGO needs the proximal equation and a separate measure-transport proof. No Gaussian transport-Fisher,smoothed-score identity,estimator bias,Picard accuracy,initialization or query-cost theorem is asserted.

ASTIS prose is not a quotation or a source-equivalence certificate. Definitions and aliases are explained as constructions, not counted as new mathematical proofs.

Which proof edges are actually covered?

Local proof component; source adapter/review separate Actual Gibbs position moment about a stationary point

Actual unclipped gradient-arc mean

ASTIS mathematical restatement and exposition of the actual unclipped gradient-path mean, a dependency used by Fan Chen, Sinho Chewi, Jianfeng Lu and Matthew S. Zhang, Smoothed Picard Hamiltonian Monte Carlo.

arXiv:2602.01338v1 · Appendix D.1 actual unclipped mean before Eq18; consumed by SPHMC Appendix A.4(2) · faithful paraphrase

Complete source statement (ASTIS restatement)

The square of sqrt(eta) equals eta, U is a probability measure, and f(h+Z) is integrable under P. Define the finite constant C=integral f(h+z) dP(z)-<grad f(x_plus),h> before choosing x. For every x, W_x is jointly measurable and integrable under U product P, its integral is <grad f(x_plus),x>-f(x)+C, and for every z its time integral from 0 to 1 equals <grad f(x_plus),x-(h+z)>-f(x)+f(h+z).

E is a finite-dimensional real inner-product space with its Borel measurable structure; second countability is explicit and automatic for this domain. The real-valued potential f is differentiable everywhere and its actual gradient is globally beta-Lipschitz.
eta>0, beta>=0 and h,x_plus are arbitrary points. No positive dimension, convexity, center residual or clipping step restriction is assumed.
P is the pushforward of stdGaussian E by z -> sqrt(eta) z, hence the actual auxiliary N(0,eta I). U is Lebesgue measure restricted to (0,1], which is the same uniform probability law as on [0,1].
For each x,z and real r, theta=pi*r/2, gamma=h+sin(theta)(x-h)+cos(theta)z, v=(pi/2)(cos(theta)(x-h)-sin(theta)z), and W_x(r,z)=<v,grad f(x_plus)-grad f(gamma)>.

Actual auxiliary-input mean

\[\mathbb E_{(r,Z)\sim U\otimes P}W_x(r,Z)=\langle\nabla f(x_+),x\rangle-f(x)+C,\qquad C=\mathbb E_P f(h+Z)-\langle\nabla f(x_+),h\rangle.\]

Read the formalized proofs

Each statement and proof below has its own closed Lean disclosure. ASTIS parents, Mathlib calls and external mathematical sources are distinguished in each proof.

ASTIS mathematical exposition

Actual unclipped gradient-arc mean

AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.GradientArcMean.gradient_arc_mean · theorem · Teaching coverage

Statement

\[\mathbb E_{(r,Z)\sim U\otimes P}W_x(r,Z)=\langle\nabla f(x_+),x\rangle-f(x)+C,\qquad C=\mathbb E_P f(h+Z)-\langle\nabla f(x_+),h\rangle.\]

All objects and hypotheses

E is a finite-dimensional real inner-product space with its Borel measurable structure; second countability is explicit and automatic for this domain. The real-valued potential f is differentiable everywhere and its actual gradient is globally beta-Lipschitz.
eta>0, beta>=0 and h,x_plus are arbitrary points. No positive dimension, convexity, center residual or clipping step restriction is assumed.
P is the pushforward of stdGaussian E by z -> sqrt(eta) z, hence the actual auxiliary N(0,eta I). U is Lebesgue measure restricted to (0,1], which is the same uniform probability law as on [0,1].
For each x,z and real r, theta=pi*r/2, gamma=h+sin(theta)(x-h)+cos(theta)z, v=(pi/2)(cos(theta)(x-h)-sin(theta)z), and W_x(r,z)=<v,grad f(x_plus)-grad f(gamma)>.

Mathematical proof

1. Use the actual auxiliary input and uniform time

The noise is the pushforward of the centered identity-covariance Gaussian by sqrt(eta) scaling. Positive eta gives the exact variance identity. Lebesgue measure on (0,1] has total mass one. The choice of one open endpoint changes no probability mass and agrees with the interval-integral convention used below.

\[(\sqrt\eta)^2=\eta,\qquad U=\mathrm{Leb}|_{(0,1]},\qquad U(\mathbb R)=1.\]

Corresponding Lean step

gradient_arc_mean; Real.sq_sqrt

2. Integrate the actual path derivative

Extract the public derivative and endpoints from GaussianArcLaw. Its auxiliary scale value 1 is used only to obtain these deterministic facts, never to replace the actual noise law. Apply the true gradient chain rule to r -> <grad f(x_plus),gamma_r>-f(gamma_r). The Lipschitz gradient and continuous path imply that its derivative W is continuous, so FTC applies. The path starts at h+z and ends at x.

\[\int_0^1 W_x(r,z)\,dr=\langle\nabla f(x_+),x-(h+z)\rangle-f(x)+f(h+z).\]

Corresponding Lean step

path_integral; GaussianArcLaw.gaussian_arc_law; DifferentiableAt.hasGradientAt; HasFDerivAt.comp_hasDerivAt; intervalIntegral.integral_eq_sub_of_hasDerivAt

3. Prove potential integrability from quadratic growth

Along the straight line h+t z, the gradient norm is at most norm(grad f(h))+beta norm(z) for t in [0,1]. The segment derivative bound yields the displayed quadratic growth estimate; no convexity is required. Gaussian second moments persist under actual scalar pushforward, so the constant, linear norm and squared norm terms are integrable. Measurable domination proves f(h+Z) integrable before defining its expectation.

\[|f(h+z)|\le |f(h)|+\|\nabla f(h)\|\,\|z\|+\beta\|z\|^2.\]

Corresponding Lean step

potential_growth; potential_integrable; norm_image_sub_le_of_norm_deriv_le_segment_01'; ProbabilityTheory.IsGaussian.memLp_two_id; MeasureTheory.integrable_map_measure

4. Bound the same estimator uniformly in time

Let A=norm(x-h) and D=norm(x_plus-h). Sine and cosine are bounded by one in absolute value, so the speed norm is at most (pi/2)(A+norm(z)) and the arc distance from x_plus is at most D+A+norm(z). Apply the actual gradient Lipschitz inequality and the inner-product norm inequality. This bound holds for every real time; it supplies one majorant for the whole uniform-time integral.

\[|W_x(r,z)|\le\frac\pi2\,\beta(A+\|z\|)(D+A+\|z\|).\]

Corresponding Lean step

estimator_bound; norm_inner_le_norm; LipschitzWith.norm_sub_le

5. Establish joint integrability before Fubini

Expand the majorant as a constant plus a linear norm term plus a squared norm term. The actual mapped Gaussian has finite second moment, making this polynomial integrable. Its lift to the product with the finite uniform-time measure is integrable. Gradient continuity makes the explicit W jointly measurable; domination then proves W integrable under the product. The proof does not infer joint integrability merely from fixed-time sections.

\[W_x\in L^1(U\otimes P).\]

Corresponding Lean step

estimator_integrable; MeasureTheory.memLp_map_measure_iff; MeasureTheory.MemLp.integrable_sq; MeasureTheory.Integrable.comp_snd; MeasureTheory.Integrable.mono'

6. Identify one finite constant for every x

Use Fubini only after the preceding joint-integrability result, then replace each time integral by the FTC identity. The actual auxiliary mean is zero, proved by the Gaussian map integral and scalar linearity. The linear, constant and potential terms are individually integrable, so their integrals can be separated. The remaining C depends on f,h,x_plus,eta and is defined before the universal quantifier over x.

\[\mathbb E_P\langle\nabla f(x_+),x-(h+Z)\rangle=\langle\nabla f(x_+),x-h\rangle,\qquad \mathbb E_P Z=0.\]

Corresponding Lean step

auxiliary_mean; MeasureTheory.integral_prod_symm; intervalIntegral.integral_of_le; ProbabilityTheory.integral_id_stdGaussian; integral_inner; gradient_arc_mean

Lean statement · gradient_arc_mean

Actual Gaussian/uniform input integrability, path integral and a common finite constant identifying the mean for every fixed output point.

theorem gradient_arc_mean (f : E → ℝ) (hf : Differentiable ℝ f)
    (eta beta : ℝ) (heta : 0 < eta) (hbeta : 0 ≤ beta)
    (hlip : LipschitzWith ⟨beta,hbeta⟩ (gradient f)) (h xp : E) :
    let P := (stdGaussian E).map (fun z => Real.sqrt eta • z)
    let U := volume.restrict (Set.Ioc (0 : ℝ) 1)
    let C := (∫ z, f (h+z) ∂P) - inner ℝ (gradient f xp) h
    (Real.sqrt eta)^2 = eta ∧ IsProbabilityMeasure U ∧
      Integrable (fun z => f (h+z)) P ∧
      ∀ x : E, Measurable (fun q : ℝ × E => estimator f h xp x q.2 q.1) ∧
        Integrable (fun q : ℝ × E => estimator f h xp x q.2 q.1) (U.prod P) ∧
        (∀ z : E, (∫ r in (0 : ℝ)..1, estimator f h xp x z r) =
          inner ℝ (gradient f xp) (x-(h+z)) - f x + f (h+z)) ∧
        (∫ q : ℝ × E, estimator f h xp x q.2 q.1 ∂(U.prod P)) =
          inner ℝ (gradient f xp) x - f x + C

Exact module and namespace context

Lean proof · gradient_arc_mean

Actual arc calculus, quadratic potential growth, true Gaussian moments, joint polynomial domination, Fubini and zero auxiliary mean.

theorem gradient_arc_mean (f : E → ℝ) (hf : Differentiable ℝ f)
    (eta beta : ℝ) (heta : 0 < eta) (hbeta : 0 ≤ beta)
    (hlip : LipschitzWith ⟨beta,hbeta⟩ (gradient f)) (h xp : E) :
    let P := (stdGaussian E).map (fun z => Real.sqrt eta • z)
    let U := volume.restrict (Set.Ioc (0 : ℝ) 1)
    let C := (∫ z, f (h+z) ∂P) - inner ℝ (gradient f xp) h
    (Real.sqrt eta)^2 = eta ∧ IsProbabilityMeasure U ∧
      Integrable (fun z => f (h+z)) P ∧
      ∀ x : E, Measurable (fun q : ℝ × E => estimator f h xp x q.2 q.1) ∧
        Integrable (fun q : ℝ × E => estimator f h xp x q.2 q.1) (U.prod P) ∧
        (∀ z : E, (∫ r in (0 : ℝ)..1, estimator f h xp x z r) =
          inner ℝ (gradient f xp) (x-(h+z)) - f x + f (h+z)) ∧
        (∫ q : ℝ × E, estimator f h xp x q.2 q.1 ∂(U.prod P)) =
          inner ℝ (gradient f xp) x - f x + C := by
  dsimp only
  refine ⟨Real.sq_sqrt heta.le, ⟨by simp⟩,
    potential_integrable f hf ⟨beta,hbeta⟩ hlip h (Real.sqrt eta), ?_⟩
  intro x
  have hg := hlip.continuous
  have hm : Measurable (fun q : ℝ × E => estimator f h xp x q.2 q.1) := by
    unfold estimator arc velocity
    fun_prop
  exact ⟨hm, estimator_integrable f ⟨beta,hbeta⟩ hlip h xp x (Real.sqrt eta) _,
    fun z => path_integral f hf ⟨beta,hbeta⟩ hlip h xp x z,
    auxiliary_mean f hf ⟨beta,hbeta⟩ hlip h xp x (Real.sqrt eta)⟩

end AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.GradientArcMean

Exact module and namespace context

Source assumptions versus formal assumptions

Source	Actual Lean	Difference kind	Why it matters
Euclidean smooth setting with positive dimension.	Coordinate-free finite-dimensional real inner-product Borel space, including zero dimension; explicit second countability.	generalization	Finite-dimensional normed spaces are second countable. The proof never divides by dimension; the zero-dimensional estimator vanishes.
Smooth setting ordinarily uses a positive smoothness constant.	beta>=0 with the actual beta-Lipschitz gradient and differentiable f.	generalization	The beta=0 proof is valid; no division by beta or convexity hypothesis enters the identity.
The reference center is h=x0-eta grad f(x_plus).	Arbitrary h,x_plus; the same C is fixed before every x.	generalization	The mean identity needs only the arc and true gradient. The specific center substitution remains necessary for the subsequent target-density consumer.
Uniform random time on [0,1].	Lebesgue measure restricted to (0,1], with total mass one proved.	source-implicit	Lebesgue singletons have zero mass, so these are the same uniform distribution; the interval-integral bridge retains both endpoint values.
The mean of the actual estimator identifies the log weight up to a constant.	Same estimator and independent Gaussian/uniform input; potential integrability, joint measurability, joint integrability, path FTC and common-C mean all proved.	source-implicit	No assumed integrability or mean. Fubini follows actual product integrability; Gaussian zero mean is proved from the actual map.
Mean identification is used before Eq18 and the terminal normalized approximation.	Each fixed x has the auxiliary-input mean; no additional random-x or joint parameter-kernel statement.	same	Selected proof edge only. Center substitution, positive finite Gibbs normalization, clipped law, Renyi accuracy, initialization and cost remain separate.

This proves the actual unclipped estimator mean for each fixed x, including genuine Gaussian/uniform joint integrability. Coordinate-free spaces, zero dimension, beta=0 and arbitrary h are disclosed extensions. It does not assert joint parameter measurability in x,h,x_plus or an additional random-x integral. The source center h=x0-eta grad f(x_plus), completion of the Gaussian square, positive finite target normalization, clipped output law, Renyi comparison, initialization and actual query costs remain separate. L1 integrability of f(h+Z) does not imply exponential Gibbs integrability. Neither full companion paper is complete.

Encoder–denoiser: accepted · domain-mismatch

Detected semantic differences

domains: Coordinate-free and zero-dimensional cases; second countability automatic. — Independent formal reviewer accepted this disclosed difference.
assumptions: Beta zero valid without division; zero-Lipschitz gradient makes W vanish. — Independent formal reviewer accepted this disclosed difference.
quantifiers: Arbitrary center; common C independent of x; source substitution deferred. — Independent formal reviewer accepted this disclosed difference.
objects: Uniform Ioc equals source Icc after removing a null singleton; FTC endpoints retained. — Independent formal reviewer accepted this disclosed difference.
conclusion: Potential and joint estimator integrability, measurability, FTC and actual zero mean explicitly supplied. — Independent formal reviewer accepted this disclosed difference.
scopes: Selected fixed-x mean dependency only; no extra random-x or normalized sampler conclusion. — Independent formal reviewer accepted this disclosed difference.

A generalization is not a source correction. Proposed missing conditions require separate independent repair review. No proposed repair silently changes the original theorem.

Scope and omitted-condition boundaries

This proves the actual unclipped estimator mean for each fixed x, including genuine Gaussian/uniform joint integrability. Coordinate-free spaces, zero dimension, beta=0 and arbitrary h are disclosed extensions. It does not assert joint parameter measurability in x,h,x_plus or an additional random-x integral. The source center h=x0-eta grad f(x_plus), completion of the Gaussian square, positive finite target normalization, clipped output law, Renyi comparison, initialization and actual query costs remain separate. L1 integrability of f(h+Z) does not imply exponential Gibbs integrability. Neither full companion paper is complete.

Source and reuse

ASTIS parents called

AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.GaussianArcLaw.gaussian_arc_law

Mathlib API called (external library)

DifferentiableAt.hasGradientAt
HasFDerivAt.comp_hasDerivAt
intervalIntegral.integral_eq_sub_of_hasDerivAt
norm_image_sub_le_of_norm_deriv_le_segment_01'
ProbabilityTheory.IsGaussian.memLp_two_id
MeasureTheory.memLp_map_measure_iff
MeasureTheory.integrable_map_measure
MeasureTheory.Integrable.comp_snd
MeasureTheory.integral_prod_symm
ProbabilityTheory.integral_id_stdGaussian
integral_inner

Mathematical sources

Appendix D.1 before Eq. (18) — Actual gradient-path estimator mean identifying the unnormalized log weight.
SPHMC Appendix A.4(2) — Terminal gradient-only approximation consumer; its full accuracy and cost remain separate.

ASTIS prose is not a quotation or a source-equivalence certificate. Definitions and aliases are explained as constructions, not counted as new mathematical proofs.

Which proof edges are actually covered?

Local proof component; source adapter/review separate Actual unclipped path mean and auxiliary-input integrability before target comparison

Actual ideal RGO identification and normalization

ASTIS mathematical restatement and exposition of the ideal target construction used by Fan Chen, Sinho Chewi, Jianfeng Lu and Matthew S. Zhang, Smoothed Picard Hamiltonian Monte Carlo.

arXiv:2602.01338v1 · Appendix D.1 Eq18 ideal target identification; consumed by SPHMC Appendix A.4(2) · faithful paraphrase

Complete source statement (ASTIS restatement)

exp(-f) is G-integrable with strictly positive real integral; exp(m) is q-integrable with strictly positive real integral; exp(-V) is canonical-volume-integrable with strictly positive real integral. The actual q.tilted(m) equals G.tilted(-f) and also equals volume.withDensity(x -> ofReal(exp(-V(x))/integral exp(-V) dvolume)).

E is a finite-dimensional real inner-product space with its Borel sigma-algebra and canonical volume. f:E->R is differentiable everywhere and its actual gradient is globally beta-Lipschitz, with beta>=0. Fix eta>0 satisfying beta*eta<1 and arbitrary x0,x_plus in E. No convexity or second differentiability is assumed.
Set g=grad f(x_plus), h=x0-eta*g, P=(z->sqrt(eta) z)_*stdGaussian(E), U=volume restricted to (0,1], nu=U product P, G=(z->x0+sqrt(eta) z)_*stdGaussian(E), and q=(z->h+sqrt(eta) z)_*stdGaussian(E). Thus time and auxiliary Gaussian inputs are independent.
For s=(r,z), theta=pi*r/2, gamma=h+sin(theta)(x-h)+cos(theta)z and v=(pi/2)(cos(theta)(x-h)-sin(theta)z). The actual untruncated estimator is W(x,s)=<v,g-grad f(gamma)>. Define m(x)=integral W(x,s) dnu(s) and V(x)=f(x)+norm(x-x0)^2/(2eta). These are definitions of actual functions and laws, not assumptions about their means or integrability.

Actual ideal RGO law

\[q.\mathrm{tilted}(m)=G.\mathrm{tilted}(-f)=\frac{e^{-V(x)}}{\int_Ee^{-V(y)}\,dy}\,dx,\qquad V(x)=f(x)+\frac{\|x-x_0\|^2}{2\eta}.\]

Read the formalized proofs

Each statement and proof below has its own closed Lean disclosure. ASTIS parents, Mathlib calls and external mathematical sources are distinguished in each proof.

ASTIS mathematical exposition

Actual ideal RGO identification and normalization

AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.IdealRGOIdentification.ideal_rgo_identification · theorem · Teaching coverage

Statement

\[q.\mathrm{tilted}(m)=G.\mathrm{tilted}(-f)=\frac{e^{-V(x)}}{\int_Ee^{-V(y)}\,dy}\,dx,\qquad V(x)=f(x)+\frac{\|x-x_0\|^2}{2\eta}.\]

All objects and hypotheses

E is a finite-dimensional real inner-product space with its Borel sigma-algebra and canonical volume. f:E->R is differentiable everywhere and its actual gradient is globally beta-Lipschitz, with beta>=0. Fix eta>0 satisfying beta*eta<1 and arbitrary x0,x_plus in E. No convexity or second differentiability is assumed.
Set g=grad f(x_plus), h=x0-eta*g, P=(z->sqrt(eta) z)_*stdGaussian(E), U=volume restricted to (0,1], nu=U product P, G=(z->x0+sqrt(eta) z)_*stdGaussian(E), and q=(z->h+sqrt(eta) z)_*stdGaussian(E). Thus time and auxiliary Gaussian inputs are independent.
For s=(r,z), theta=pi*r/2, gamma=h+sin(theta)(x-h)+cos(theta)z and v=(pi/2)(cos(theta)(x-h)-sin(theta)z). The actual untruncated estimator is W(x,s)=<v,g-grad f(gamma)>. Define m(x)=integral W(x,s) dnu(s) and V(x)=f(x)+norm(x-x0)^2/(2eta). These are definitions of actual functions and laws, not assumptions about their means or integrability.

Mathematical proof

1. Obtain the sharp lower Taylor estimate from first derivatives

For fixed u, consider H(t)=f(x0+t u)-t<grad f(x0),u>+(beta/2)t^2 norm(u)^2 on [0,1]. Differentiate the actual potential along this path. The Lipschitz gradient bound and Cauchy-Schwarz make H prime nonnegative. Monotonicity therefore gives H(1)>=H(0). This retains the precise beta/2 coefficient without a Hessian or convexity assumption.

\[f(x_0+u)\ge f(x_0)+\langle\nabla f(x_0),u\rangle-\frac\beta2\|u\|^2.\]

Corresponding Lean step

smooth_lower; monotoneOn_of_deriv_nonneg

2. Prove a coercive envelope and actual volume integrability

Set k=1/eta-beta>0. Adding the proximal quadratic to the lower Taylor bound gives a quadratic with coefficient k/2. Young inequality absorbs the linear gradient term, leaving coefficient k/4. Exponentiation bounds the actual weight by an integrable translated Gaussian envelope. Continuity supplies measurability. The actual canonical volume is nonzero, so the integral of this everywhere positive integrable exponential is strictly positive.

\[V(x_0+u)\ge f(x_0)-\frac{\|\nabla f(x_0)\|^2}{k}+\frac{k}{4}\|u\|^2,\qquad k=\eta^{-1}-\beta>0.\]

Corresponding Lean step

regularized_lower; ideal_volume_integrable; AutoSamplingTheory.TechnicalLemmas.Analysis.Integrability.integrable_exp_neg_add_mul_norm_sub_sq; MeasureTheory.integral_exp_pos

3. Normalize under the actual Gaussian input

Reuse the public scaled Gaussian density and prove the translation adapter by pushforward composition and volume translation invariance. Multiplying this density by exp(-f) gives c_eta exp(-V), where c_eta is the strictly positive Gaussian normalization constant. The withDensity integrability equivalence transfers the established volume L1 to the actual Gaussian G. Its probability property and integrability imply a strictly positive real integral. Applying the same density identity to the tilt gives the explicit normalized volume law.

\[G(dx)=c_\eta e^{-\|x-x_0\|^2/(2\eta)}dx,\qquad c_\eta=(\sqrt{2\pi\eta})^{-\dim E}>0.\]

Corresponding Lean step

translated_density; ideal_gaussian_integrable; ideal_volume_law; AutoSamplingTheory.TechnicalLemmas.Measure.IsotropicGaussianDensity.map_sqrt_smul_stdGaussian_eq_withDensity

4. Use the actual gradient-arc mean with one common constant

Instantiate the proved GradientArcMean result at h=x0-eta grad f(x_plus). It already establishes the auxiliary integrability needed for its Fubini argument. Expanding the local estimator verifies that it is exactly the same sine/cosine arc and gradient difference. Its potential expectation defines C before x is chosen, and gives the actual mean identity for every x. No affine mean formula is assumed in place of the random estimator.

\[m(x)=\langle g,x\rangle-f(x)+C,\qquad C=\mathbb E_{Z\sim P}f(h+Z)-\langle g,h\rangle.\]

Corresponding Lean step

estimator; actual_mean_tilt; AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.GradientArcMean.gradient_arc_mean

5. Cancel the actual translated Gaussian likelihood

The public Gaussian likelihood theorem gives q=G.withDensity(L) in the correct direction. Substituting h-x0=-eta g yields log L=-<g,x-x0>-eta norm(g)^2/2. Multiplication by the actual exponential mean leaves A exp(-f), where A is positive and independent of x. This uses the actual proposal measure, not an abstract density selected to satisfy the conclusion.

\[L(x)e^{m(x)}=A e^{-f(x)},\qquad A=e^{C+\langle g,x_0\rangle-\eta\|g\|^2/2}>0.\]

Corresponding Lean step

affine_gaussian_tilt; AutoSamplingTheory.TechnicalLemmas.Measure.GaussianLikelihood.translated_gaussian_likelihood

6. Transfer integrability before cancelling normalizers

The weighted integrability equivalence and the previous product identity prove exp(m) is q-integrable. Integration gives Z_q=A Z_G, hence Z_q>0. Only then expand the definition of exponential tilt and compose the two withDensity operations. The same positive A cancels in numerator and denominator. Combine this law equality with the established normalized volume identity and all three positive integrability statements.

\[Z_q=\int e^m\,dq=A\int e^{-f}\,dG=A Z_G>0,\qquad \frac{L e^m}{Z_q}=\frac{e^{-f}}{Z_G}.\]

Corresponding Lean step

tilt_change_density; ideal_rgo_identification; MeasureTheory.integrable_withDensity_iff_integrable_smul'; MeasureTheory.integral_withDensity_eq_integral_toReal_smul; MeasureTheory.withDensity_mul

Lean statement · ideal_rgo_identification

Three actual exponential L1 and positive real integral pairs, plus shifted-Gaussian/ideal Gaussian and normalized-volume measure identities.

theorem ideal_rgo_identification (f : E → ℝ) (hf : Differentiable ℝ f)
    (beta : NNReal) (hlip : LipschitzWith beta (gradient f))
    (eta : ℝ) (heta : 0 < eta) (hstep : (beta : ℝ)*eta < 1) (x0 xp : E) :
    let h := x0-eta • gradient f xp
    let P := (stdGaussian E).map (fun z => Real.sqrt eta • z)
    let nu := (volume.restrict (Set.Ioc (0 : ℝ) 1)).prod P
    let G := (stdGaussian E).map (fun z => x0 + Real.sqrt eta • z)
    let q := (stdGaussian E).map (fun z => h + Real.sqrt eta • z)
    let m := fun x => ∫ s, estimator f h xp x s ∂nu
    let V := fun x => f x + ‖x-x0‖^2/(2*eta)
    Integrable (fun x => Real.exp (-f x)) G ∧
      0 < ∫ x, Real.exp (-f x) ∂G ∧
      Integrable (fun x => Real.exp (m x)) q ∧
      0 < ∫ x, Real.exp (m x) ∂q ∧
      Integrable (fun x => Real.exp (-V x)) volume ∧
      0 < ∫ x, Real.exp (-V x) ∂volume ∧
      q.tilted m = G.tilted (fun x => -f x) ∧
      q.tilted m = (volume : Measure E).withDensity (fun x => ENNReal.ofReal
        (Real.exp (-V x) / ∫ y, Real.exp (-V y) ∂volume))

Exact module and namespace context

Lean proof · ideal_rgo_identification

Sharp first-derivative Taylor bound, Gaussian envelope, actual density transfer, actual parent mean, positive likelihood factor and normalizer cancellation.

theorem ideal_rgo_identification (f : E → ℝ) (hf : Differentiable ℝ f)
    (beta : NNReal) (hlip : LipschitzWith beta (gradient f))
    (eta : ℝ) (heta : 0 < eta) (hstep : (beta : ℝ)*eta < 1) (x0 xp : E) :
    let h := x0-eta • gradient f xp
    let P := (stdGaussian E).map (fun z => Real.sqrt eta • z)
    let nu := (volume.restrict (Set.Ioc (0 : ℝ) 1)).prod P
    let G := (stdGaussian E).map (fun z => x0 + Real.sqrt eta • z)
    let q := (stdGaussian E).map (fun z => h + Real.sqrt eta • z)
    let m := fun x => ∫ s, estimator f h xp x s ∂nu
    let V := fun x => f x + ‖x-x0‖^2/(2*eta)
    Integrable (fun x => Real.exp (-f x)) G ∧
      0 < ∫ x, Real.exp (-f x) ∂G ∧
      Integrable (fun x => Real.exp (m x)) q ∧
      0 < ∫ x, Real.exp (m x) ∂q ∧
      Integrable (fun x => Real.exp (-V x)) volume ∧
      0 < ∫ x, Real.exp (-V x) ∂volume ∧
      q.tilted m = G.tilted (fun x => -f x) ∧
      q.tilted m = (volume : Measure E).withDensity (fun x => ENNReal.ofReal
        (Real.exp (-V x) / ∫ y, Real.exp (-V y) ∂volume)) := by
  have hg := ideal_gaussian_integrable f hf beta hlip eta heta hstep x0
  have hm := actual_mean_tilt f hf beta hlip eta heta hstep x0 xp
  have hv := ideal_volume_integrable f hf beta hlip eta heta hstep x0
  exact ⟨hg.1, hg.2, hm.1, hm.2.1, hv.1, hv.2, hm.2.2,
    hm.2.2.trans (ideal_volume_law f hf beta hlip eta heta hstep x0)⟩

end AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.IdealRGOIdentification

Exact module and namespace context

Source assumptions versus formal assumptions

Source	Actual Lean	Difference kind	Why it matters
Euclidean smooth setting in positive dimension.	Finite-dimensional real inner-product Borel space with canonical volume, including dimension zero.	generalization	Coordinate-free Gaussian and inner-product results apply, without division by dimension.
The smoothness constant is conventionally positive.	beta is a nonnegative real parameter (NNReal); beta=0 is allowed.	generalization	No division by beta is used.
Claim2 uses a stronger small-step condition together with ell>=2 for clipping accuracy.	eta>0 and beta*eta<1 suffice for this ideal target identification and normalization.	generalization	The source smooth Claim2 range implies betaeta<=1/(8ell)<=1/16. The ideal-only contract does not assert the clipping accuracy conclusion. Strict inequality matters: a negative quadratic can make V constant at betaeta=1 in positive dimension.
A reference-point residual bound is used for downstream clipping control.	x_plus is arbitrary for ideal mean identification.	generalization	The likelihood cancels the affine gradient term for every reference point; the residual condition is retained for later clipping estimates.
Uniform time is sampled on [0,1].	U is volume restricted to Ioc(0,1), independently multiplied by the actual auxiliary Gaussian.	source-implicit	The endpoints are Lebesgue-null. The true path and auxiliary product are retained.
The ideal RGO is the normalized density proportional to exp(-V).	All three required exponential weights are proved integrable with strictly positive real normalizers before identifying the measures.	source-implicit	No assumed integrability or mean identity replaces the actual Gaussian/gradient definitions; no totalized zero denominator supplies a fake equality.
SPHMC A.4(2) uses the ideal construction in a terminal approximate implementation.	Fixed-parameter ideal target identification only; no clipped Renyi, joint adaptive kernel, initialization or cost theorem.	same	This is the selected dependency, not the complete implementation or full paper theorem.

This identifies the actual unclipped-mean ideal RGO and proves its positive finite normalization. beta*eta<1 is sufficient and contains the source Claim2 small-step range, not equivalent to all its conditions. Arbitrary reference x_plus, beta0, zero dimension and coordinate-free spaces are disclosed extensions. The public theorem has eight conclusions: three L1 statements, three positive real integrals and two measure equalities. Probability of the resulting law follows, but no separate IsProbabilityMeasure conjunct or joint adaptive-parameter kernel is returned. Clipped-vs-ideal Renyi accuracy, initialization, implementation and query costs remain separate. Neither full companion paper is complete.

Encoder–denoiser: accepted · domain-mismatch

Detected semantic differences

domains: Coordinate-free canonical volume and zero dimension supported. — Independent formal reviewer accepted: Coordinate-free canonical volume and zero dimension supported.
assumptions: NNReal beta includes zero; no division by beta. — Independent formal reviewer accepted: NNReal beta includes zero; no division by beta.
assumptions: betaeta<1 sufficient broader range; strictness matters for negative quadratic at equality in positive dimension. — Independent formal reviewer accepted: betaeta<1 sufficient broader range; strictness matters for negative quadratic at equality in positive dimension.
quantifiers: Arbitrary xp preserves source center; ideal likelihood identity needs no residual bound. — Independent formal reviewer accepted: Arbitrary xp preserves source center; ideal likelihood identity needs no residual bound.
objects: Ioc uniform differs by null endpoints; true independent product retained. — Independent formal reviewer accepted: Ioc uniform differs by null endpoints; true independent product retained.
conclusion: Exponential L1/positive integrals proved before measure identity, no zero-denominator fallback. — Independent formal reviewer accepted: Exponential L1/positive integrals proved before measure identity, no zero-denominator fallback.
scopes: Selected ideal dependency only; terminal approximate implementation remains separate. — Independent formal reviewer accepted: Selected ideal dependency only; terminal approximate implementation remains separate.

A generalization is not a source correction. Proposed missing conditions require separate independent repair review. No proposed repair silently changes the original theorem.

Scope and omitted-condition boundaries

This identifies the actual unclipped-mean ideal RGO and proves its positive finite normalization. beta*eta<1 is sufficient and contains the source Claim2 small-step range, not equivalent to all its conditions. Arbitrary reference x_plus, beta0, zero dimension and coordinate-free spaces are disclosed extensions. The public theorem has eight conclusions: three L1 statements, three positive real integrals and two measure equalities. Probability of the resulting law follows, but no separate IsProbabilityMeasure conjunct or joint adaptive-parameter kernel is returned. Clipped-vs-ideal Renyi accuracy, initialization, implementation and query costs remain separate. Neither full companion paper is complete.

Source and reuse

ASTIS parents called

Mathlib API called (external library)

monotoneOn_of_deriv_nonneg
MeasureTheory.integral_exp_pos
MeasureTheory.integrable_withDensity_iff_integrable_smul'
MeasureTheory.integral_withDensity_eq_integral_toReal_smul
MeasureTheory.withDensity_mul

Mathematical sources

Appendix D.1 Eq. (18) and ideal target — Unclipped gradient-arc mean and ideal normalized target.
SPHMC Appendix A.4(2) — Consumer of the ideal target construction; terminal approximation remains separate.

ASTIS prose is not a quotation or a source-equivalence certificate. Definitions and aliases are explained as constructions, not counted as new mathematical proofs.

Which proof edges are actually covered?

Local proof component; source adapter/review separate Actual unclipped-mean target identification with positive finite normalization

Actual joint inner reference stopping and expected count

ASTIS expanded proof component for Fan Chen, Sinho Chewi, Jianfeng Lu and Matthew S. Zhang, Smoothed Picard Hamiltonian Monte Carlo. The exact inner rule is retained; the explicit sufficient cost bound and remaining source consumers are disclosed.

arXiv:2609.06906v1 · Section6.3 Reference point construction: actual inner stopping and expected count · faithful paraphrase

Complete source statement (ASTIS restatement)

The actual inner stopping index N and output out are jointly measurable in the pair. For every pair the output satisfies gradient-square<=a*d, residual norm= A*norm(grad F_p(out))<=A*sqrt(a*d), every earlier index strictly fails the threshold, and N+1<=2+k*log(1+A*norm(grad F_p(y))^2/d). Under the actual nu.prod(stdGaussian(E)), N+1 is integrable and its expectation is at most 2+k*log(1+A*(M+tau*d/A^2)/d).

E is a complete finite-dimensional real inner-product space with its Borel measurable structure and canonical volume. Its real dimension d is strictly positive. U:E->R is C2.
alpha,beta are nonnegative reals with 0<alpha<=beta. The genuine Hessian obeys alpha*norm(v)^2<=D2U(x)[v,v]<=beta*norm(v)^2 for every x,v.
eta>=0,tau>0,r>=0. The actual probability nu satisfies W2(nu,rho_eta)^2<=ofReal(r^2), where pi=volume.tilted(-U) and rho_eta is the law of X+sqrt(eta)*Z for independent X~pi,Z~stdGaussian(E). W2 is the actual infimum of quadratic coupling costs.
Set A=eta+tau,a=alpha+1/A,c=beta+1/A,k=c/a,M=4*beta*d+4*beta^2*eta*d+2*beta^2*r^2. For p=(y,z), set u(p)=y+sqrt(tau)*z and F_p(x)=U(x)+norm(x-u(p))^2/(2*A).
Use T_p(x)=x-c^(-1)*grad F_p(x), start at y, and define N(p) as the least n with norm(grad F_p(T_p^n(y)))^2<=a*d if one exists, otherwise zero. Define out(p)=T_p^N(p)(y). The finite-hit proof makes the default branch unreachable for every pair.

Actual inner rule and sufficient expected count

\[N=\min\{n:\|\nabla F_{Y,Z}(T_{Y,Z}^{n}(Y))\|^2\le ad\},\qquad \mathbb E_{\nu\otimes G}(N+1)\le2+k\log\!\left(1+\frac{A}{d}\left(M+\frac{\tau d}{A^2}\right)\right).\]

Read the formalized proofs

Each statement and proof below has its own closed Lean disclosure. ASTIS parents, Mathlib calls and external mathematical sources are distinguished in each proof.

ASTIS mathematical exposition

Actual joint inner reference stopping and expected count

AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.JointReferenceGradientDescent.joint_reference_gradient_descent · theorem · Teaching coverage

Statement

\[N=\min\{n:\|\nabla F_{Y,Z}(T_{Y,Z}^{n}(Y))\|^2\le ad\},\qquad \mathbb E_{\nu\otimes G}(N+1)\le2+k\log\!\left(1+\frac{A}{d}\left(M+\frac{\tau d}{A^2}\right)\right).\]

All objects and hypotheses

E is a complete finite-dimensional real inner-product space with its Borel measurable structure and canonical volume. Its real dimension d is strictly positive. U:E->R is C2.
alpha,beta are nonnegative reals with 0<alpha<=beta. The genuine Hessian obeys alpha*norm(v)^2<=D2U(x)[v,v]<=beta*norm(v)^2 for every x,v.
eta>=0,tau>0,r>=0. The actual probability nu satisfies W2(nu,rho_eta)^2<=ofReal(r^2), where pi=volume.tilted(-U) and rho_eta is the law of X+sqrt(eta)*Z for independent X~pi,Z~stdGaussian(E). W2 is the actual infimum of quadratic coupling costs.
Set A=eta+tau,a=alpha+1/A,c=beta+1/A,k=c/a,M=4*beta*d+4*beta^2*eta*d+2*beta^2*r^2. For p=(y,z), set u(p)=y+sqrt(tau)*z and F_p(x)=U(x)+norm(x-u(p))^2/(2*A).
Use T_p(x)=x-c^(-1)*grad F_p(x), start at y, and define N(p) as the least n with norm(grad F_p(T_p^n(y)))^2<=a*d if one exists, otherwise zero. Define out(p)=T_p^N(p)(y). The finite-hit proof makes the default branch unreachable for every pair.

Mathematical proof

1. Identify the actual regularized gradient and positive parameters

A=eta+tau is positive. The inherited genuine quadratic differentiation gives grad F_p(x)=grad U(x)+(x-u(p))/A. Thus c and a are positive and the gradient descent step is well defined. F is the actual regularized potential, not an abstract gradient field with an assumed moment.

\[\nabla F_p(x)=\nabla U(x)+A^{-1}(x-u(p)),\qquad a>0,\quad c>0.\]

Corresponding Lean step

actual_joint_program: H,hg; joint_reference_gradient_descent: hA,ha,hc,hgrad; TerminalReferenceGradientDescent.terminal_reference_gradient_descent

2. Prove joint continuity of each actual finite iterate

The center map p=(y,z) maps continuously to y+sqrt(tau)*z. Starting from the first projection, induct on the number of actual updates. Continuity of grad U and the algebraic update prove continuity of the whole pair-to-iterate map. Fixed-center continuity alone would not justify this conclusion.

\[x_0(p)=p_1,\qquad x_{n+1}(p)=x_n(p)-c^{-1}\bigl(\nabla U(x_n(p))+A^{-1}(x_n(p)-u(p))\bigr).\]

Corresponding Lean step

joint_iterates; actual_joint_program: hu,hgU,hTeq,hi; Function.iterate_succ_apply'

3. Use the strict terminal index only as a finite witness

The public terminal theorem gives a finite index hitting d/A and its pointwise count bound. Since d/A<=a*d, that point also witnesses existence for the actual inner predicate. jointIndex takes the least index of this inner predicate; Nat.find minimality makes it no larger than the witness and proves strict failure at every earlier index. The two stopping indices and outputs are not identified.

\[\frac dA\le ad,\qquad N_{\rm inner}\le N_{\rm terminal},\qquad N_{\rm inner}+1\le2+k\log\!\left(1+\frac{A\|\nabla F_p(y)\|^2}{d}\right).\]

Corresponding Lean step

jointIndex; joint_stop: ht,hn,hle; actual_joint_program: hs,hw; Nat.find_spec; Nat.find_min; Nat.find_min'

4. Obtain measurability of the first index and stopped output

For each n, the actual gradient formula and joint iterate continuity make the inner stopping event measurable. The finite witness eliminates the default no-hit branch everywhere. Apply measurable_find to the index and Measurable.find to the stopped family of iterates. This proves measurability for the same pair that sets both center and starting point.

\[\{p:\|\nabla F_p(x_n(p))\|^2\le ad\}\text{ is measurable},\qquad p\mapsto N(p),\ p\mapsto x_{N(p)}(p)\text{ are measurable}.\]

Corresponding Lean step

actual_joint_program: hp; joint_stop: hNm,hOm; measurable_find; Measurable.find

5. Derive the actual inner residual bound

Rearrange the genuine gradient identity to express u-A*grad U(x)-x as -A*grad F_p(x). Taking norms gives the exact residual identity. At the actual stopped point, the inner threshold bounds the gradient norm by sqrt(a*d), hence the residual by A*sqrt(a*d). The terminal bound sqrt(d*A) is not asserted for this different output.

\[\|u-A\nabla U(\mathrm{out})-\mathrm{out}\|=A\|\nabla F_p(\mathrm{out})\|\le A\sqrt{ad}.\]

Corresponding Lean step

joint_reference_gradient_descent: hres,hP; Real.le_sqrt_of_sq_le

6. Consume the moment of the same random potential and initial state

An explicit function equality identifies F_p with the potential used by ApproximateInitialGradientMoment. That theorem derives joint gradient-square integrability and the displayed moment from the actual W2 input. Its pair law is exactly nu.prod(G), with y both the initial point and part of u(p). No unconditional fixed-center expected-cost clause is used and no target moment is assumed.

\[g(p)=\|\nabla F_p(p_1)\|^2\in L^1(\nu\otimes G),\qquad \mathbb E g\le M+\frac{\tau d}{A^2}.\]

Corresponding Lean step

joint_reference_gradient_descent: hMom,hFeq,hgi,hM,hgm; ApproximateInitialGradientMoment.approximate_initial_gradient_moment

7. Establish logarithm and count integrability before expectation

For nonnegative g and s=d/A>0, log(1+g/s) lies between zero and g/s, so it is integrable. At the upper mean m=M+tau*d/A^2, the logarithmic tangent bounds it by log(1+m/s)+(g-m)/(s+m). Integrate this inequality using the proved moment bound. The pointwise count estimate then gives N+1 integrability and the stated expected bound. N=0 still costs one gradient check; random histories and cumulative sampler costs require further proofs.

\[\log(1+g/s)\le\log(1+m/s)+\frac{g-m}{s+m},\qquad \mathbb E(N+1)\le2+k\log(1+m/s).\]

Corresponding Lean step

expected_count: hli,htangent,hlog,hci; joint_reference_gradient_descent: hE,ratio

Lean statement · joint_reference_gradient_descent

Actual same-pair first-hit index and output, measurability, inner residual and first-hit/count properties, actual count L1 and expected bound.

theorem joint_reference_gradient_descent [FiniteDimensional ℝ E]
    [MeasurableSpace E] [BorelSpace E] {U : E → ℝ} {α β : ℝ≥0}
    (hα : 0 < α) (hαβ : α ≤ β) (hU : ContDiff ℝ 2 U)
    (hH : ∀ x v : E, (α:ℝ)*‖v‖^2 ≤ fderiv ℝ (fderiv ℝ U) x v v ∧
      fderiv ℝ (fderiv ℝ U) x v v ≤ (β:ℝ)*‖v‖^2)
    {η τ r : ℝ} (hη : 0 ≤ η) (hτ : 0 < τ) (hr : 0 ≤ r)
    (hd : 0 < (Module.finrank ℝ E : ℝ))
    (ν : Measure E) [IsProbabilityMeasure ν]
    (hw : TechnicalLemmas.Measure.WassersteinSpace.wassersteinDistance ν
      (TechnicalLemmas.Measure.GaussianSmoothing.gaussianSmoothing
        ((volume : Measure E).tilted (fun x => -U x)) (Real.sqrt η)) ^ 2 ≤ ENNReal.ofReal (r^2)) :
    let d : ℝ := Module.finrank ℝ E
    let A := η+τ
    let a := (α:ℝ)+A⁻¹
    let c := (β:ℝ)+A⁻¹
    let k := c/a
    let M := 4*(β:ℝ)*d+4*(β:ℝ)^2*η*d+2*(β:ℝ)^2*r^2
    let u := fun p : E × E => p.1+Real.sqrt τ • p.2
    let F := fun p x => U x+A⁻¹/2*‖x-u p‖^2
    let T := fun p x => x-c⁻¹ • gradient (F p) x
    let N := jointIndex T (fun p x => ‖gradient (F p) x‖^2) (a*d)
    let out := fun p => (T p)^[N p] p.1
    Measurable N ∧ Measurable out ∧
      (∀ p, ‖gradient (F p) (out p)‖^2 ≤ a*d ∧
        ‖u p-A • gradient U (out p)-out p‖ = A*‖gradient (F p) (out p)‖ ∧
        ‖u p-A • gradient U (out p)-out p‖ ≤ A*Real.sqrt (a*d) ∧
        (∀ j < N p, a*d < ‖gradient (F p) ((T p)^[j] p.1)‖^2) ∧
        (N p:ℝ)+1 ≤ k*Real.log (1+A*‖gradient (F p) p.1‖^2/d)+2) ∧
      Integrable (fun p => (N p:ℝ)+1) (ν.prod (stdGaussian E)) ∧
      (∫ p, (N p:ℝ)+1 ∂ν.prod (stdGaussian E)) ≤
        2+k*Real.log (1+A*(M+τ*d/A^2)/d)

Exact module and namespace context

Lean proof · joint_reference_gradient_descent

Joint iteration continuity, strict terminal witness for actual inner first hitting, measurable choice, genuine residual identity, same-potential moment consumption and integrable logarithmic tangent.

theorem joint_reference_gradient_descent [FiniteDimensional ℝ E]
    [MeasurableSpace E] [BorelSpace E] {U : E → ℝ} {α β : ℝ≥0}
    (hα : 0 < α) (hαβ : α ≤ β) (hU : ContDiff ℝ 2 U)
    (hH : ∀ x v : E, (α:ℝ)*‖v‖^2 ≤ fderiv ℝ (fderiv ℝ U) x v v ∧
      fderiv ℝ (fderiv ℝ U) x v v ≤ (β:ℝ)*‖v‖^2)
    {η τ r : ℝ} (hη : 0 ≤ η) (hτ : 0 < τ) (hr : 0 ≤ r)
    (hd : 0 < (Module.finrank ℝ E : ℝ))
    (ν : Measure E) [IsProbabilityMeasure ν]
    (hw : TechnicalLemmas.Measure.WassersteinSpace.wassersteinDistance ν
      (TechnicalLemmas.Measure.GaussianSmoothing.gaussianSmoothing
        ((volume : Measure E).tilted (fun x => -U x)) (Real.sqrt η)) ^ 2 ≤ ENNReal.ofReal (r^2)) :
    let d : ℝ := Module.finrank ℝ E
    let A := η+τ
    let a := (α:ℝ)+A⁻¹
    let c := (β:ℝ)+A⁻¹
    let k := c/a
    let M := 4*(β:ℝ)*d+4*(β:ℝ)^2*η*d+2*(β:ℝ)^2*r^2
    let u := fun p : E × E => p.1+Real.sqrt τ • p.2
    let F := fun p x => U x+A⁻¹/2*‖x-u p‖^2
    let T := fun p x => x-c⁻¹ • gradient (F p) x
    let N := jointIndex T (fun p x => ‖gradient (F p) x‖^2) (a*d)
    let out := fun p => (T p)^[N p] p.1
    Measurable N ∧ Measurable out ∧
      (∀ p, ‖gradient (F p) (out p)‖^2 ≤ a*d ∧
        ‖u p-A • gradient U (out p)-out p‖ = A*‖gradient (F p) (out p)‖ ∧
        ‖u p-A • gradient U (out p)-out p‖ ≤ A*Real.sqrt (a*d) ∧
        (∀ j < N p, a*d < ‖gradient (F p) ((T p)^[j] p.1)‖^2) ∧
        (N p:ℝ)+1 ≤ k*Real.log (1+A*‖gradient (F p) p.1‖^2/d)+2) ∧
      Integrable (fun p => (N p:ℝ)+1) (ν.prod (stdGaussian E)) ∧
      (∫ p, (N p:ℝ)+1 ∂ν.prod (stdGaussian E)) ≤
        2+k*Real.log (1+A*(M+τ*d/A^2)/d) := by
  let d : ℝ := Module.finrank ℝ E
  let A := η+τ
  let a := (α:ℝ)+A⁻¹
  let c := (β:ℝ)+A⁻¹
  let k := c/a
  let M := 4*(β:ℝ)*d+4*(β:ℝ)^2*η*d+2*(β:ℝ)^2*r^2
  let u := fun p : E × E => p.1+Real.sqrt τ • p.2
  let F := fun p x => U x+A⁻¹/2*‖x-u p‖^2
  let T := fun p x => x-c⁻¹ • gradient (F p) x
  let N := jointIndex T (fun p x => ‖gradient (F p) x‖^2) (a*d)
  let out := fun p => (T p)^[N p] p.1
  have hA : 0 < A := add_pos_of_nonneg_of_pos hη hτ
  have ha : 0 < a := add_pos_of_nonneg_of_pos α.coe_nonneg (inv_pos.mpr hA)
  have hc : 0 < c := add_pos_of_nonneg_of_pos β.coe_nonneg (inv_pos.mpr hA)
  have hP := actual_joint_program (τ:=τ) hU hH hαβ hA hd rfl
  have hgrad (p : E × E) (x : E) :
      gradient (F p) x=gradient U x+A⁻¹ • (x-u p) :=
    (TerminalReferenceGradientDescent.terminal_reference_gradient_descent
      hU hH hαβ hA hd rfl (u p)).2.2.2.1 x
  have hres (p : E × E) (x : E) :
      ‖u p-A • gradient U x-x‖=A*‖gradient (F p) x‖ := by
    have he : u p-A • gradient U x-x=-(A • gradient (F p) x) := by
      rw [hgrad,smul_add,smul_smul,mul_inv_cancel₀ hA.ne',one_smul]
      abel
    rw [he,norm_neg,norm_smul,Real.norm_eq_abs,abs_of_pos hA]
  have hMom := ApproximateInitialGradientMoment.approximate_initial_gradient_moment
    hα hαβ hU hH hη hτ hr ν hw
  have hFeq (y z : E) :
      (fun x => U x+‖x-(y+Real.sqrt τ • z)‖^2/(2*(η+τ)))=F (y,z) := by
    funext x
    dsimp [F,u,A]
    simp only [div_eq_mul_inv,mul_inv_rev]
    ring
  have hgi : Integrable (fun p : E × E => ‖gradient (F p) p.1‖^2)
      (ν.prod (stdGaussian E)) := by
    simpa only [hFeq] using hMom.2.2.2.1
  have hM : (∫ p : E × E, ‖gradient (F p) p.1‖^2 ∂ν.prod (stdGaussian E)) ≤
      M+τ*d/A^2 := by
    simpa only [hFeq] using hMom.2.2.2.2.2.1
  have hgm : Measurable (fun p : E × E => ‖gradient (F p) p.1‖^2) := by
    simp_rw [hgrad]
    have hgU := TechnicalLemmas.Analysis.Calculus.Gradient.continuous_gradient_of_contDiff_one
      (hU.of_le (by norm_num))
    exact ((hgU.comp continuous_fst).add
      ((continuous_fst.sub (continuous_fst.add (continuous_snd.const_smul _))).const_smul _)).norm.pow 2 |>.measurable
  have ratio (z : ℝ) : z/(d/A)=A*z/d := by field_simp
  have hE := expected_count (ν.prod (stdGaussian E))
    (fun p => ‖gradient (F p) p.1‖^2) N (k:=k) (s:=d/A)
    (div_pos hc ha) (div_pos hd hA)
    hgm hgi (fun p => sq_nonneg _) hP.1 hM (fun p => by
      simpa only [ratio] using (hP.2.2 p).2.2)
  refine ⟨hP.1,hP.2.1,fun p => ?_,hE.1,?_⟩
  · have hp := hP.2.2 p
    refine ⟨hp.1,hres p _,?_,hp.2.1,hp.2.2⟩
    rw [hres]
    exact mul_le_mul_of_nonneg_left (Real.le_sqrt_of_sq_le hp.1) hA.le
  · simpa only [ratio] using hE.2

end AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.JointReferenceGradientDescent

Exact module and namespace context

Source assumptions versus formal assumptions

Source	Actual Lean	Difference kind	Why it matters
The inner reference construction stops at gradient-square<=a*d.	The actual first-hit predicate is a*d; terminal d/A is only a witness and upper count.	same	No algorithm substitution or equality of the different stopping outputs is used.
The source gives asymptotic per-call reference cost.	Explicit sufficient count bound using the stricter terminal witness and derived M.	source-implicit	The log formula is a derived upper bound, not a printed exact count formula or a completed all-stage complexity.
Normalized beta=1 and positive-dimensional Euclidean recursive setting.	General beta and coordinate-free finite dimension with d>0; eta=0 allowed,tau>0 retained.	generalization	No dimension-zero claim here; curvature excludes beta=0. The beta=1 source setting is included.
The approximate input has an upstream Wasserstein error guarantee.	The actual W2 budget is supplied; r=0 allowed.	same	This result consumes the input guarantee rather than establishing the upstream sampler precision.
Reference gradient queries are counted in the complexity argument.	N+1 counts all visited-point gradient checks, including the final success.	source-implicit	A mathematical evaluation count with reuse for updates; no evaluator trace or cross-sampler cache deduction.
The per-call reference construction participates in a recursive sampler.	Joint index/output measurability and actual pair-law expectation at fixed parameters.	same	Conditional histories, joint kernels over all parameters and cumulative costs remain open.

Actual inner threshold a*d is preserved; terminal d/A supplies only a finite witness and upper count, never an identical stopping time or output. The logarithmic formula is a derived sufficient bound. General beta, coordinate-free finite dimension and eta=0 extend the source; this theorem requires d>0,tau>0,0<alpha<=beta and allows r=0. The input W2 guarantee remains supplied. N+1 counts one base-gradient evaluation per visited point including the initial/final check, reused for the update; no evaluator trace or cross-sampler cache saving is proved. The theorem proves joint measurability in (Y,Z) at fixed parameters, not a kernel jointly in all parameters, conditional-history propagation, a stage sum or either complete main result.

Encoder–denoiser: accepted · domain-mismatch

Detected semantic differences

conclusion: Actual ad algorithm retained; auxiliary d/A witness only. — Independent formal reviewer accepted: Actual ad algorithm retained; auxiliary d/A witness only.
constant_dependencies: Explicit looser logarithmic bound is derived,not source exact count. — Independent formal reviewer accepted: Explicit looser logarithmic bound is derived,not source exact count.
domains: General beta,coordinate-free and eta0 extensions justify domain-mismatch;d>0 retained. — Independent formal reviewer accepted: General beta,coordinate-free and eta0 extensions justify domain-mismatch;d>0 retained.
assumptions: Actual W2 input supplied,not an upstream sampler guarantee. — Independent formal reviewer accepted: Actual W2 input supplied,not an upstream sampler guarantee.
scopes: N+1 is visited-point mathematical count; gradient-query interpretation needs one base gradient per point reused between check/update,no evaluator trace. — Independent formal reviewer accepted: N+1 is visited-point mathematical count; gradient-query interpretation needs one base gradient per point reused between check/update,no evaluator trace.
scopes: Fixed-call joint program only; recursive history and global cost remain open. — Independent formal reviewer accepted: Fixed-call joint program only; recursive history and global cost remain open.

A generalization is not a source correction. Proposed missing conditions require separate independent repair review. No proposed repair silently changes the original theorem.

Scope and omitted-condition boundaries

Actual inner threshold a*d is preserved; terminal d/A supplies only a finite witness and upper count, never an identical stopping time or output. The logarithmic formula is a derived sufficient bound. General beta, coordinate-free finite dimension and eta=0 extend the source; this theorem requires d>0,tau>0,0<alpha<=beta and allows r=0. The input W2 guarantee remains supplied. N+1 counts one base-gradient evaluation per visited point including the initial/final check, reused for the update; no evaluator trace or cross-sampler cache saving is proved. The theorem proves joint measurability in (Y,Z) at fixed parameters, not a kernel jointly in all parameters, conditional-history propagation, a stage sum or either complete main result.

Source and reuse

ASTIS parents called

Mathlib API called (external library)

Function.iterate_succ_apply'
measurable_find
Measurable.find
Nat.find_spec
Nat.find_min
Nat.find_min'
Real.le_sqrt_of_sq_le
Real.log_le_sub_one_of_pos
MeasureTheory.integral_mono

Mathematical sources

SPHMC Section6.3 inner reference-point construction — Actual fixed-call inner rule and sufficient expected count; history and total sampler cost remain separate.

ASTIS prose is not a quotation or a source-equivalence certificate. Definitions and aliases are explained as constructions, not counted as new mathematical proofs.

Which proof edges are actually covered?

Local proof component; source adapter/review separate Actual joint inner reference stopping and expected count

Prescribed logarithmic terminal depth with explicit constants

Fan Chen, Sinho Chewi, Jianfeng Lu and Matthew S. Zhang; ASTIS expanded proof, no author endorsement implied.

arXiv:2609.06906v1 · Theorem6.5 definition of Lq, equation(6.4), terminal-stage parameter argument; schedule(6.2) · faithful paraphrase

Complete source statement (ASTIS restatement)

For every parameter and sequence satisfying the stated assumptions, the actual recursive schedule has L≥2, 0<B≤1, J>0, 0<1/r_J≤B and J≤(3C+(C/2)log(1/γ))L. This is an explicit sufficient-constant refinement of the deterministic parameter argument in equation (6.4). The paper leaves its sufficiently large and small universal constants unspecified; C≥8 is a sufficient witness for this parameter argument alone, not a certified value for all later sampling obligations.

Real κ≥1, r₀≥0, 0<c<1/4 and an arbitrary real sequence with 0<ηⱼ≤c for every natural j. Zero initial precision represents infinite regularization.
Positive natural dimension d, real q≥2, 0<Δ≤1/2, 0<γ≤1 and real C≥8. The schedule constant c and terminal constant γ are distinct.
Define K(r)=(1+r)/(κ⁻¹+r), τ(r)=K(r) when K(r)≥2 and c otherwise, a(r,h)=(h+τ(r))/(1+r), and rⱼ₊₁=rⱼ+1/a(rⱼ,ηⱼ). All later quantities use this actual recursion.
Let K₀=K(r₀), L=q+log(K₀dq/Δ), B=γ/(sqrt(dL)+L), and J=ceil(C log(eK₀/B)). No contraction, terminal threshold or depth bound is assumed.

prescribed depth and terminal threshold

\[\begin{gathered}L=q+\log\frac{K_0dq}{\Delta},\quad B=\frac{\gamma}{\sqrt{dL}+L},\quad J=\left\lceil C\log\frac{eK_0}{B}\right\rceil,\\L\ge2,\quad0<B\le1,\quad J>0,\quad0<r_J^{-1}\le B,\\J\le\left(3C+\frac C2\log\frac1\gamma\right)L.\end{gathered}\]

Read the formalized proofs

Each statement and proof below has its own closed Lean disclosure. ASTIS parents, Mathlib calls and external mathematical sources are distinguished in each proof.

ASTIS mathematical exposition

Prescribed logarithmic terminal depth with explicit constants

AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.LogarithmicDepth.terminal_depth · theorem · Teaching coverage

Statement

All objects and hypotheses

Real κ≥1, r₀≥0, 0<c<1/4 and an arbitrary real sequence with 0<ηⱼ≤c for every natural j. Zero initial precision represents infinite regularization.
Positive natural dimension d, real q≥2, 0<Δ≤1/2, 0<γ≤1 and real C≥8. The schedule constant c and terminal constant γ are distinct.
Define K(r)=(1+r)/(κ⁻¹+r), τ(r)=K(r) when K(r)≥2 and c otherwise, a(r,h)=(h+τ(r))/(1+r), and rⱼ₊₁=rⱼ+1/a(rⱼ,ηⱼ). All later quantities use this actual recursion.
Let K₀=K(r₀), L=q+log(K₀dq/Δ), B=γ/(sqrt(dL)+L), and J=ceil(C log(eK₀/B)). No contraction, terminal threshold or depth bound is assumed.

Mathematical proof

1. Establish the logarithmic domain

Since K₀,d≥1, q≥2 and Δ≤1/2, expand the logarithm of K₀dq/Δ. Its component signs yield L≥2, log K₀≤L and log d≤L. The denominator sqrt(dL)+L is positive and at least two, so 0<B≤1.

\[L\ge2,\quad\log K_0\le L,\quad\log d\le L,\quad0<B\le1.\]

Corresponding Lean step

Local source_log_domain proves the three bounds; the final proof establishes the threshold signs.

2. Budget the two geometric phases

Set M=ceil(5 log K₀), P=ceil(2 log(1/B)). The inequality log x≤x−1 gives log(4/5)≤−1/5 and log(1/2)≤−1/2. Thus (4/5)^M K₀≤1<2. Ceiling bounds and C≥8 give M+1+P≤J, retaining the first guaranteed finite step.

\[M+1+P<5\log K_0+2\log(1/B)+3\le C(1+\log K_0+\log(1/B))\le J.\]

Corresponding Lean step

Local depth_indices proves the entry certificate and exact natural index budget.

3. Consume the actual recursive certificate

Set N=J−(M+1) only after proving M+1≤J. Then M+1+N=J and N≥P. With ρ=2c/(1+2c)≤1/2, the logarithmic estimate gives ρ^N≤B. The existing actual-schedule theorem therefore yields positive A_J=r_J⁻¹≤2cρ^N≤B, including r₀=0.

\[0<A_J\le2c\rho^{J-(M+1)}\le B.\]

Corresponding Lean step

remaining_contraction controls the tail; actual_terminal calls RecursiveDepth.parameter_control and rewrites the precise natural index identity.

4. Bound the threshold denominator

Write D=sqrt(dL)+L. Split 2=(4/3)(3/2) to obtain log 2≤5/6≤7/8. Apply log x≤x−1 to L/2 to get log L≤L/2. Since sqrt L≤L and sqrt d≥1, D≤2 sqrt d L, so log D≤7/8+L.

\[\log D\le\log2+\tfrac12\log d+\log L\le\tfrac78+L.\]

Corresponding Lean step

Local denominator_log proves the square-root product comparison and all positive-domain logarithm identities.

5. Absorb the ceiling slack with explicit constants

Put G=log(1/γ)≥0. Expanding log(eK₀/B) and using the denominator estimate gives J<C(1+2L+7/8+G)+1. Since C≥8 and L≥2, 15C/8+1≤2C≤CL and CG≤(C/2)GL. This yields the displayed upper bound with its separate coefficient.

\[J\le(3C+(C/2)G)L,\qquad G=\log(1/\gamma)\ge0.\]

Corresponding Lean step

Local depth_upper uses Nat.ceil_lt_add_one after establishing nonnegativity of its argument.

Lean statement · terminal_depth

Eight local definitions expose the exact schedule and L, B, J. All parameters are universally quantified; positive natural dimension is explicit.

theorem terminal_depth {κ c r₀ q Δ γ C : ℝ} {d : ℕ} {η : ℕ → ℝ}
    (hκ : 1 ≤ κ) (hc : 0 < c) (hc1 : c < 1/4) (hr₀ : 0 ≤ r₀)
    (hη : ∀ n, 0 < η n ∧ η n ≤ c) (hd : 0 < d) (hq : 2 ≤ q)
    (hΔ : 0 < Δ) (hΔ1 : Δ ≤ 1/2) (hγ : 0 < γ) (hγ1 : γ ≤ 1) (hC : 8 ≤ C) :
    let K := fun r : ℝ => (1+r)/(κ⁻¹+r)
    let τ := fun r : ℝ => if 2 ≤ K r then K r else c
    let a := fun r h : ℝ => (h+τ r)/(1+r)
    let step := fun r h : ℝ => r+(a r h)⁻¹
    let r : ℕ → ℝ := Nat.rec r₀ (fun j r => step r (η j))
    let L := q+Real.log (K r₀*d*q/Δ)
    let B := γ/(Real.sqrt (d*L)+L)
    let J := Nat.ceil (C*Real.log (Real.exp 1*K r₀/B))
    2 ≤ L ∧ (0 < B ∧ B ≤ 1) ∧ 0 < J ∧ 0 < (r J)⁻¹ ∧ (r J)⁻¹ ≤ B ∧
      (J:ℝ) ≤ (3*C+(C/2)*Real.log (1/γ))*L

Exact module and namespace context

Lean proof · terminal_depth

Six local helper proofs feed one public theorem. The existing recursive certificate is an actual proof dependency. The consumer test uses the terminal precision to obtain an integrable, normalized Gibbs target in its actual finite dimension; it does not implement FORS.

theorem terminal_depth {κ c r₀ q Δ γ C : ℝ} {d : ℕ} {η : ℕ → ℝ}
    (hκ : 1 ≤ κ) (hc : 0 < c) (hc1 : c < 1/4) (hr₀ : 0 ≤ r₀)
    (hη : ∀ n, 0 < η n ∧ η n ≤ c) (hd : 0 < d) (hq : 2 ≤ q)
    (hΔ : 0 < Δ) (hΔ1 : Δ ≤ 1/2) (hγ : 0 < γ) (hγ1 : γ ≤ 1) (hC : 8 ≤ C) :
    let K := fun r : ℝ => (1+r)/(κ⁻¹+r)
    let τ := fun r : ℝ => if 2 ≤ K r then K r else c
    let a := fun r h : ℝ => (h+τ r)/(1+r)
    let step := fun r h : ℝ => r+(a r h)⁻¹
    let r : ℕ → ℝ := Nat.rec r₀ (fun j r => step r (η j))
    let L := q+Real.log (K r₀*d*q/Δ)
    let B := γ/(Real.sqrt (d*L)+L)
    let J := Nat.ceil (C*Real.log (Real.exp 1*K r₀/B))
    2 ≤ L ∧ (0 < B ∧ B ≤ 1) ∧ 0 < J ∧ 0 < (r J)⁻¹ ∧ (r J)⁻¹ ≤ B ∧
      (J:ℝ) ≤ (3*C+(C/2)*Real.log (1/γ))*L := by
  have depth_indices {K B C : ℝ} (hK : 1 ≤ K) (hB : 0 < B) (hB1 : B ≤ 1)
      (hC : 8 ≤ C) :
      let M := Nat.ceil (5 * Real.log K)
      let P := Nat.ceil (2 * Real.log (1 / B))
      let J := Nat.ceil (C * Real.log (Real.exp 1 * K / B))
      (4 / 5 : ℝ)^M * K < 2 ∧ M + 1 + P ≤ J ∧
        (1 / 2 : ℝ)^P ≤ B := by
    dsimp only
    have hKpos : 0 < K := by linarith
    have hL : 0 ≤ Real.log K := Real.log_nonneg hK
    have hH : 0 ≤ Real.log (1 / B) := Real.log_nonneg ((one_le_div hB).2 hB1)
    have hlog : Real.log (Real.exp 1 * K / B) =
        1 + Real.log K + Real.log (1 / B) := by
      rw [Real.log_div (mul_pos (Real.exp_pos _) hKpos).ne' hB.ne',
        Real.log_mul (Real.exp_pos _).ne' hKpos.ne', Real.log_exp]
      simp [sub_eq_add_neg]
    have hM := Nat.le_ceil (5 * Real.log K)
    have hP := Nat.le_ceil (2 * Real.log (1 / B))
    have hMupper := Nat.ceil_lt_add_one (mul_nonneg (by norm_num : (0:ℝ) ≤ 5) hL)
    have hPupper := Nat.ceil_lt_add_one (mul_nonneg (by norm_num : (0:ℝ) ≤ 2) hH)
    have hfour : Real.log (4 / 5 : ℝ) ≤ -(1 / 5) := by
      have := Real.log_le_sub_one_of_pos (by norm_num : (0:ℝ) < 4/5)
      linarith
    have hhalf : Real.log (1 / 2 : ℝ) ≤ -(1 / 2) := by
      have := Real.log_le_sub_one_of_pos (by norm_num : (0:ℝ) < 1/2)
      linarith
    have hentry : (4 / 5 : ℝ)^⌈5 * Real.log K⌉₊ * K ≤ 1 := by
      apply (Real.log_le_log_iff (mul_pos (pow_pos (by norm_num) _) hKpos) zero_lt_one).1
      rw [Real.log_mul (pow_pos (by norm_num : (0:ℝ)<4/5) _).ne' hKpos.ne',
        Real.log_pow, Real.log_one]
      nlinarith [mul_le_mul_of_nonneg_left hfour
        (Nat.cast_nonneg (⌈5 * Real.log K⌉₊) : (0:ℝ) ≤ _)]
    refine ⟨lt_of_le_of_lt hentry (by norm_num), ?_, ?_⟩
    · have hJ := Nat.le_ceil (C * Real.log (Real.exp 1 * K / B))
      rw [hlog] at hJ
      have hlarge : 8 * (1 + Real.log K + Real.log (1 / B)) ≤
          C * (1 + Real.log K + Real.log (1 / B)) :=
        mul_le_mul_of_nonneg_right hC (by linarith)
      have : ((⌈5 * Real.log K⌉₊ + 1 + ⌈2 * Real.log (1 / B)⌉₊ : ℕ) : ℝ) ≤
          (⌈C * Real.log (Real.exp 1 * K / B)⌉₊ : ℝ) := by
        rw [hlog]
        push_cast
        linarith
      exact_mod_cast this
    · apply (Real.log_le_log_iff (pow_pos (by norm_num) _) hB).1
      rw [Real.log_pow]
      have hneg : Real.log (1 / B) = -Real.log B := by simp
      have hPbound : -2 * Real.log B ≤ (⌈2 * Real.log (1 / B)⌉₊ : ℝ) := by
        calc
          -2 * Real.log B = 2 * Real.log (1 / B) := by rw [hneg]; ring
          _ ≤ _ := hP
      nlinarith [mul_le_mul_of_nonneg_left hhalf
        (Nat.cast_nonneg (⌈2 * Real.log (1 / B)⌉₊) : (0:ℝ) ≤ _)]

  -- The remaining index budget gives the needed variance contraction directly.

  have remaining_contraction {K B C c : ℝ} (hK : 1 ≤ K) (hB : 0 < B) (hB1 : B ≤ 1)
      (hC : 8 ≤ C) (hc : 0 < c) (hc1 : c < 1/4) :
      let M := Nat.ceil (5 * Real.log K)
      let J := Nat.ceil (C * Real.log (Real.exp 1 * K / B))
      M + 1 ≤ J ∧ 2*c*(2*c/(1+2*c))^(J-(M+1)) ≤ B := by
    dsimp only
    obtain ⟨_, hidx, _⟩ := depth_indices hK hB hB1 hC

    have hm : ⌈5 * Real.log K⌉₊ + 1 ≤ ⌈C * Real.log (Real.exp 1 * K / B)⌉₊ := by omega
    refine ⟨hm, ?_⟩
    let N := ⌈C * Real.log (Real.exp 1 * K / B)⌉₊ - (⌈5 * Real.log K⌉₊ + 1)
    have hpN : ⌈2 * Real.log (1 / B)⌉₊ ≤ N := by dsimp [N]; omega
    have hn : 2 * Real.log (1 / B) ≤ (N : ℝ) :=
      (Nat.le_ceil _).trans (by exact_mod_cast hpN)
    have hrpos : 0 < 2*c/(1+2*c) := div_pos (by linarith) (by linarith)
    have hrhalf : 2*c/(1+2*c) ≤ 1/2 := (div_le_iff₀ (by linarith)).2 (by nlinarith)
    have hlog : Real.log (2*c/(1+2*c)) ≤ -(1/2) := by
      have h := Real.log_le_sub_one_of_pos hrpos
      linarith
    have hpow : (2*c/(1+2*c))^N ≤ B := by
      apply (Real.log_le_log_iff (pow_pos hrpos _) hB).1
      rw [Real.log_pow]
      have hneg : Real.log (1 / B) = -Real.log B := by simp
      rw [hneg] at hn
      nlinarith [mul_le_mul_of_nonneg_left hlog (Nat.cast_nonneg N : (0:ℝ) ≤ _)]
    calc
      2*c*(2*c/(1+2*c))^N ≤ 1*(2*c/(1+2*c))^N :=
        mul_le_mul_of_nonneg_right (by linarith) (pow_nonneg hrpos.le _)
      _ ≤ B := by simpa using hpow

  have denominator_log {d L : ℝ} (hd : 1 ≤ d) (hL : 2 ≤ L)
      (hld : Real.log d ≤ L) :
      Real.log (Real.sqrt (d*L) + L) ≤ 7/8 + L := by
    have hd0 : 0 < d := by linarith
    have hL0 : 0 < L := by linarith
    have htwo : Real.log 2 ≤ (7/8:ℝ) := by
      have h₁ := Real.log_le_sub_one_of_pos (by norm_num : (0:ℝ)<4/3)
      have h₂ := Real.log_le_sub_one_of_pos (by norm_num : (0:ℝ)<3/2)
      have heq : Real.log (2:ℝ) = Real.log (4/3) + Real.log (3/2) := by
        rw [← Real.log_mul (by norm_num : (4/3:ℝ)≠0) (by norm_num : (3/2:ℝ)≠0)]
        norm_num
      linarith
    have hlogL : Real.log L ≤ L/2 := by
      have h := Real.log_le_sub_one_of_pos (div_pos hL0 (by norm_num : (0:ℝ)<2))
      rw [Real.log_div hL0.ne' (by norm_num : (2:ℝ)≠0)] at h
      linarith
    have hsL : Real.sqrt L ≤ L := Real.sqrt_le_self_iff.2 (Or.inr (by linarith))
    have hsd : 1 ≤ Real.sqrt d := by
      have := Real.sqrt_le_sqrt hd
      simpa using this
    have hbound : Real.sqrt (d*L) + L ≤ 2*Real.sqrt d*L := by
      rw [Real.sqrt_mul hd0.le]
      nlinarith [mul_le_mul_of_nonneg_left hsL (Real.sqrt_nonneg d),
        mul_le_mul_of_nonneg_right hsd hL0.le]
    have hp : 0 < Real.sqrt (d*L)+L := add_pos_of_nonneg_of_pos (Real.sqrt_nonneg _) hL0
    have hsd0 : 0 < Real.sqrt d := by linarith
    have hlog := Real.log_le_log hp hbound
    rw [Real.log_mul (mul_pos (by norm_num : (0:ℝ)<2) hsd0).ne' hL0.ne',
      Real.log_mul (by norm_num : (2:ℝ)≠0) hsd0.ne', Real.log_sqrt hd0.le] at hlog
    linarith

  have depth_upper {K d L γ C : ℝ} (hK : 1 ≤ K) (hd : 1 ≤ d)
      (hL : 2 ≤ L) (hlogK : Real.log K ≤ L) (hlogd : Real.log d ≤ L)
      (hγ : 0 < γ) (hγ1 : γ ≤ 1) (hC : 8 ≤ C) :
      let B := γ / (Real.sqrt (d*L)+L)
      (Nat.ceil (C * Real.log (Real.exp 1 * K / B)) : ℝ) ≤
        (3*C+(C/2)*Real.log (1/γ))*L := by
    let D := Real.sqrt (d*L)+L
    have hD : 0 < D := by dsimp [D]; positivity
    have hD2 : 2 ≤ D := by dsimp [D]; linarith [Real.sqrt_nonneg (d*L)]
    have hK0 : 0 < K := by linarith
    have hC0 : 0 ≤ C := by linarith
    have hB : 0 < γ/D := div_pos hγ hD
    have hB1 : γ/D ≤ 1 := (div_le_one hD).2 (by linarith)
    have hG : 0 ≤ Real.log (1/γ) := Real.log_nonneg ((one_le_div hγ).2 hγ1)
    have hlogD : Real.log D ≤ 7/8+L := denominator_log hd hL hlogd
    have heq : Real.log (Real.exp 1*K/(γ/D)) =
        1 + Real.log K + Real.log D + Real.log (1/γ) := by
      rw [Real.log_div (mul_pos (Real.exp_pos _) hK0).ne' hB.ne',
        Real.log_mul (Real.exp_pos _).ne' hK0.ne', Real.log_exp,
        Real.log_div hγ.ne' hD.ne']
      simp only [one_div, Real.log_inv]
      ring
    have hx : 0 ≤ C * Real.log (Real.exp 1*K/(γ/D)) := by
      apply mul_nonneg hC0
      rw [Real.log_div (mul_pos (Real.exp_pos _) hK0).ne' hB.ne',
        Real.log_mul (Real.exp_pos _).ne' hK0.ne', Real.log_exp]
      have := Real.log_nonneg hK
      have := Real.log_nonpos hB.le hB1
      linarith
    have hceil := Nat.ceil_lt_add_one hx
    rw [heq] at hceil
    have hxupper : C*(1+Real.log K+Real.log D+Real.log (1/γ)) ≤
        C*(1+L+(7/8+L)+Real.log (1/γ)) :=
      mul_le_mul_of_nonneg_left (by linarith) hC0
    have hCG : 0 ≤ C*Real.log (1/γ) := mul_nonneg hC0 hG
    have hscale := mul_le_mul_of_nonneg_left hL hCG
    have hscaleC := mul_le_mul_of_nonneg_left hL hC0
    change (Nat.ceil (C * Real.log (Real.exp 1*K/(γ/D))) : ℝ) ≤ _
    rw [heq]
    nlinarith

  have source_log_domain {K q Δ : ℝ} {d : ℕ} (hK : 1 ≤ K)
      (hd : 0 < d) (hq : 2 ≤ q) (hΔ : 0 < Δ) (hΔ1 : Δ ≤ 1/2) :
      let L := q + Real.log (K*d*q/Δ)
      2 ≤ L ∧ Real.log K ≤ L ∧ Real.log (d:ℝ) ≤ L := by
    have hK0 : 0 < K := by linarith
    have hd1 : (1:ℝ) ≤ d := by exact_mod_cast hd
    have hd0 : (0:ℝ) < d := by linarith
    have hq0 : 0 < q := by linarith
    have hq1 : 1 ≤ q := by linarith
    have hΔone : Δ ≤ 1 := by linarith
    have heq : Real.log (K*d*q/Δ) =
        Real.log K + Real.log (d:ℝ) + Real.log q - Real.log Δ := by
      rw [Real.log_div (mul_pos (mul_pos hK0 hd0) hq0).ne' hΔ.ne',
        Real.log_mul (mul_pos hK0 hd0).ne' hq0.ne', Real.log_mul hK0.ne' hd0.ne']
    have := Real.log_nonneg hK
    have := Real.log_nonneg hd1
    have := Real.log_nonneg hq1
    have := Real.log_nonpos hΔ.le hΔone
    dsimp only
    rw [heq]
    constructor
    · linarith
    constructor <;> linarith

  have actual_terminal {κ c r₀ B C : ℝ} {η : ℕ → ℝ}
      (hκ : 1 ≤ κ) (hc : 0 < c) (hc1 : c < 1/4) (hr₀ : 0 ≤ r₀)
      (hη : ∀ n, 0 < η n ∧ η n ≤ c)
      (hB : 0 < B) (hB1 : B ≤ 1) (hC : 8 ≤ C) :
      let K := fun r : ℝ => (1+r)/(κ⁻¹+r)
      let τ := fun r : ℝ => if 2 ≤ K r then K r else c
      let a := fun r h : ℝ => (h+τ r)/(1+r)
      let step := fun r h : ℝ => r+(a r h)⁻¹
      let r : ℕ → ℝ := Nat.rec r₀ (fun j r => step r (η j))
      let J := Nat.ceil (C*Real.log (Real.exp 1*K r₀/B))
      0 < J ∧ 0 < (r J)⁻¹ ∧ (r J)⁻¹ ≤ B := by
    dsimp only
    let K := fun r : ℝ => (1+r)/(κ⁻¹+r)
    let τ := fun r : ℝ => if 2 ≤ K r then K r else c
    let a := fun r h : ℝ => (h+τ r)/(1+r)
    let step := fun r h : ℝ => r+(a r h)⁻¹
    let r : ℕ → ℝ := Nat.rec r₀ (fun j r => step r (η j))
    let M := Nat.ceil (5*Real.log (K r₀))
    let J := Nat.ceil (C*Real.log (Real.exp 1*K r₀/B))
    have hκ0 : 0 < κ := by linarith
    have hK : 1 ≤ K r₀ := by
      apply (one_le_div (add_pos_of_pos_of_nonneg (inv_pos.mpr hκ0) hr₀)).2
      have := (inv_le_one₀ hκ0).2 hκ
      linarith
    have hentry : (4/5:ℝ)^M*K r₀ < 2 := (depth_indices hK hB hB1 hC).1
    obtain ⟨hm, hbound⟩ := remaining_contraction hK hB hB1 hC hc hc1
    change M+1 ≤ J at hm
    have hid : M+1+(J-(M+1)) = J := Nat.add_sub_of_le hm
    have hcontrol :=
      AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.RecursiveDepth.parameter_control
        hκ hc hc1 hr₀ hη
    have hterminal : 0 < (r (M+1+(J-(M+1))))⁻¹ ∧
        (r (M+1+(J-(M+1))))⁻¹ ≤ 2*c*(2*c/(1+2*c))^(J-(M+1)) :=
      hcontrol.2.2.2.1 M (J-(M+1)) hentry
    rw [hid] at hterminal
    change 0 < J ∧ 0 < (r J)⁻¹ ∧ (r J)⁻¹ ≤ B
    exact ⟨by omega, hterminal.1, hterminal.2.trans hbound⟩

  dsimp only
  let K := fun r : ℝ => (1+r)/(κ⁻¹+r)
  let L := q+Real.log (K r₀*d*q/Δ)
  let B := γ/(Real.sqrt (d*L)+L)
  have hκ0 : 0 < κ := by linarith
  have hK : 1 ≤ K r₀ := by
    apply (one_le_div (add_pos_of_pos_of_nonneg (inv_pos.mpr hκ0) hr₀)).2
    have := (inv_le_one₀ hκ0).2 hκ
    linarith
  obtain ⟨hL, hlogK, hlogd⟩ := source_log_domain hK hd hq hΔ hΔ1
  change 2 ≤ L at hL
  have hD : 0 < Real.sqrt (d*L)+L := by positivity
  have hB : 0 < B := div_pos hγ hD
  have hB1 : B ≤ 1 := (div_le_one hD).2 (by linarith [Real.sqrt_nonneg ((d:ℝ)*L)])
  obtain ⟨hJ, hpos, hterm⟩ := actual_terminal hκ hc hc1 hr₀ hη hB hB1 hC
  have hd1 : (1:ℝ) ≤ d := by exact_mod_cast hd
  exact ⟨hL, ⟨hB, hB1⟩, hJ, hpos, hterm,
    depth_upper hK hd1 hL hlogK hlogd hγ hγ1 hC⟩

end AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.LogarithmicDepth

Exact module and namespace context

Source assumptions versus formal assumptions

Source	Actual Lean	Difference kind	Why it matters
The paper chooses sufficiently small and large universal constants in (6.4), and reuses generic C in its depth upper bound.	0<γ≤1 and C≥8; upper coefficient 3C+(C/2)log(1/γ).	source-implicit	Provides sufficient numerical witnesses for the parameter clause and exposes dependence on the fixed terminal constant. It does not claim identical numerical C on both sides or sufficiency for other proof clauses.
κ≥1, positive dimension, q≥2, 0<Δ≤1/2 and the schedule(6.2) with c₀<1/4.	Same domain, natural d>0 and arbitrary admissible η sequence; c denotes c₀ and γ denotes terminal c.	same	The theorem keeps the two small constants separate and permits zero initial precision.
Terminal-stage argument uses the recursive RGO parameter schedule.	Only deterministic actual parameters; terminal Gibbs law checked in a separate consumer.	same	This binding isolates a proof obligation, with stochastic semantics and FORS accuracy/cost expressly remaining outside its conclusion.

Deterministic parameter clause of (6.4) and the terminal precision threshold only. No FORS algorithm, stochastic-kernel or adaptive measurability theorem, divergence guarantee, reference-point construction, expected query cost, or full-paper closure. The explicit final depth coefficient differs from C and depends on gamma; a universal coefficient requires gamma fixed universally.

Encoder–denoiser: accepted · equivalent-after-elaboration

Detected semantic differences

domains: The extended-positive initial variance is encoded by nonnegative real precision. Positivity after the first finite step is explicit. — Embedded actual_terminal and the J>0, r_J⁻¹>0 conclusion; source (6.1).
constant_dependencies: C≥8, γ≤1 and the displayed upper coefficient are proved sufficient constants for this deterministic edge, not the paper's verbatim quantified claim. — Candidate statement, lesson statement, candidate_assumptions and lesson source scope all disclose this. For fixed universal γ and C the coefficient is universal; allowing γ to vary requires retaining its logarithmic dependence.
scopes: Acceptance covers the parameter proof-edge only. It does not certify Theorem 6.5's full sampler, error propagation, terminal algorithm or cost. — Binding supports exactly three scalar obligations; source terminal-stage work after A_J≤underline A remains outside this declaration.

A generalization is not a source correction. Proposed missing conditions require separate independent repair review. No proposed repair silently changes the original theorem.

Scope and omitted-condition boundaries

Deterministic parameter clause of (6.4) and the terminal precision threshold only. No FORS algorithm, stochastic-kernel or adaptive measurability theorem, divergence guarantee, reference-point construction, expected query cost, or full-paper closure. The explicit final depth coefficient differs from C and depends on gamma; a universal coefficient requires gamma fixed universally.

Source and reuse

ASTIS parents called

AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.RecursiveDepth.parameter_control

Mathlib API called (external library)

Real.log_le_sub_one_of_pos
Real.log_pow
Real.log_le_log_iff
Real.log_sqrt
Real.sqrt_mul
Nat.le_ceil
Nat.ceil_lt_add_one

Mathematical sources

Chen, Chewi, Lu and Zhang, SPHMC v1, Theorem 6.5 (6.4) — Expanded deterministic parameter argument; explicit constants are ASTIS sufficient witnesses.

ASTIS prose is not a quotation or a source-equivalence certificate. Definitions and aliases are explained as constructions, not counted as new mathematical proofs.

Which proof edges are actually covered?

Local proof component; source adapter/review separate Source L and positive terminal threshold
Local proof component; source adapter/review separate Actual recursion attains threshold at prescribed depth
Local proof component; source adapter/review separate Explicit logarithmic depth upper bound

Actual normalized reference and returned sampling precision

ASTIS expanded proof component for Fan Chen,Sinho Chewi,Jianfeng Lu and Matthew S.Zhang,Smoothed Picard Hamiltonian Monte Carlo. Fixed-call normalization,not a complete sampler theorem.

arXiv:2609.06906v1 · Sections6.1 and6.3: actual reference and next-call coordinate normalization · faithful paraphrase

Complete source statement (ASTIS restatement)

N and p->S(out(p)) are measurable. For every p, the actual output satisfies norm(grad F_p(out))^2<=a*d and every earlier iterate strictly fails that threshold. The scaled reference satisfies norm(grad G_p(S(out)))^2<=d/k. G_p is C2 with genuine Hessian bounds [a/c,1]. Both exponential Gibbs weights are integrable with strictly positive integrals, and both tilted laws are probability measures. S#pi_p=pibar_p and grad G_p(S(x))=c^(-1/2)*grad F_p(x). For every next variance t>=0, R#H(pibar_p,sqrt(t))=H(pi_p,sqrt(t/c)). For every actual probability nubar and t,B>=0, a supplied W2(nubar,H(pibar_p,sqrt(t)))^2<=ofReal(B) implies W2(R#nubar,H(pi_p,sqrt(t/c)))^2<=ofReal(B/c).

E is a complete finite-dimensional real inner-product space with its Borel measurable structure and canonical volume; d=dim(E)>0. U is C2 and its genuine Hessian lies between alpha*norm(v)^2 and beta*norm(v)^2 for every x,v, with 0<alpha<=beta.
eta>=0,tau>0,r>=0. The actual probability nu satisfies W2(nu,law(X+sqrt(eta)*Z))^2<=ofReal(r^2), where X has the normalized Gibbs law volume.tilted(-U) and Z is an independent standard Gaussian. This is the outer input to the existing actual reference construction.
A=eta+tau,a=alpha+1/A,c=beta+1/A,k=c/a. For p=(y,z), u(p)=y+sqrt(tau)*z and F_p(x)=U(x)+norm(x-u(p))^2/(2*A). Here a is a curvature lower bound, not an RGO variance.
T_p(x)=x-c^(-1)*grad F_p(x). N(p) is the least n with norm(grad F_p(T_p^n(y)))^2<=a*d if such an n exists, otherwise zero; out(p)=T_p^N(p)(y). The inherited finite-hit proof eliminates the default branch.
S(x)=sqrt(c)*x,R(x)=x/sqrt(c),G_p(x)=F_p(R(x)). pi_p=volume.tilted(-F_p) and pibar_p=volume.tilted(-G_p). Write H(mu,sigma)=law(X+sigma*Z) for independent X~mu,Z~stdGaussian(E). W2 squared is the extended nonnegative infimum of quadratic coupling costs.

Actual normalized reference,laws and returned precision

\[\|\nabla G_p(S\,\mathrm{out}(p))\|^2\le d/k,\quad S_\#\pi_p=\bar\pi_p,\quad R_\#H(\bar\pi_p,\sqrt t)=H(\pi_p,\sqrt{t/c}),\quad W_2^2\le B/c.\]

Read the formalized proofs

Each statement and proof below has its own closed Lean disclosure. ASTIS parents, Mathlib calls and external mathematical sources are distinguished in each proof.

ASTIS mathematical exposition

Actual normalized reference and returned sampling precision

AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.NormalizedReferenceCall.normalized_reference_call · theorem · Teaching coverage

Statement

\[\|\nabla G_p(S\,\mathrm{out}(p))\|^2\le d/k,\quad S_\#\pi_p=\bar\pi_p,\quad R_\#H(\bar\pi_p,\sqrt t)=H(\pi_p,\sqrt{t/c}),\quad W_2^2\le B/c.\]

All objects and hypotheses

E is a complete finite-dimensional real inner-product space with its Borel measurable structure and canonical volume; d=dim(E)>0. U is C2 and its genuine Hessian lies between alpha*norm(v)^2 and beta*norm(v)^2 for every x,v, with 0<alpha<=beta.
eta>=0,tau>0,r>=0. The actual probability nu satisfies W2(nu,law(X+sqrt(eta)*Z))^2<=ofReal(r^2), where X has the normalized Gibbs law volume.tilted(-U) and Z is an independent standard Gaussian. This is the outer input to the existing actual reference construction.
A=eta+tau,a=alpha+1/A,c=beta+1/A,k=c/a. For p=(y,z), u(p)=y+sqrt(tau)*z and F_p(x)=U(x)+norm(x-u(p))^2/(2*A). Here a is a curvature lower bound, not an RGO variance.
T_p(x)=x-c^(-1)*grad F_p(x). N(p) is the least n with norm(grad F_p(T_p^n(y)))^2<=a*d if such an n exists, otherwise zero; out(p)=T_p^N(p)(y). The inherited finite-hit proof eliminates the default branch.
S(x)=sqrt(c)*x,R(x)=x/sqrt(c),G_p(x)=F_p(R(x)). pi_p=volume.tilted(-F_p) and pibar_p=volume.tilted(-G_p). Write H(mu,sigma)=law(X+sigma*Z) for independent X~mu,Z~stdGaussian(E). W2 squared is the extended nonnegative infimum of quadratic coupling costs.

Mathematical proof

1. Retain the actual first-hit program and pair dependence

The parent JointReferenceGradientDescent theorem is applied to the same U,eta,tau and actual outer input law. actualIndex is definitionally the same first ad-hit program. Thus N and out are measurable, the stopped gradient satisfies the threshold, and every earlier iterate fails it. Continuous S preserves output measurability. No supplied reference point replaces the program.

\[N(p)=\min\{n:\|\nabla F_p(T_p^n(p_1))\|^2\le ad\},\qquad p\mapsto S(\mathrm{out}(p))\text{ is measurable}.\]

Corresponding Lean step

actualIndex; normalized_reference_call: hP,hNm,hom,hp,hearly

2. Differentiate the actual regularized potential

Differentiate the quadratic norm term twice. Its first derivative is A^(-1) inner(x-u,.) and its second derivative is A^(-1) inner(.,.). Adding these genuine derivatives to those of U shifts both Hessian bounds by A^(-1); no independent Hessian field is assumed.

\[D^2F_p(x)[v,v]=D^2U(x)[v,v]+A^{-1}\|v\|^2,\qquad a\|v\|^2\le D^2F_p(x)[v,v]\le c\|v\|^2.\]

Corresponding Lean step

regularized_hessian: hq,hfd,hdd; normalized_reference_call: hreg,hFH

3. Apply the chain rule and certify the scaled reference

For any real scalar s, differentiating F(s*x) gives s times its gradient and s^2 times its Hessian quadratic form. Set s=1/sqrt(c), using c>0. The actual stopped threshold ad becomes ad/c=d/k. The same chain rule gives normalized curvature [a/c,1].

\[\nabla G_p(Sx)=c^{-1/2}\nabla F_p(x),\quad D^2G_p(x)[v,v]=c^{-1}D^2F_p(Rx)[v,v],\quad ad/c=d/k.\]

Corresponding Lean step

differential_scaling; normalized_laws: hD,hGH; normalized_reference_call: hi,hb

4. Prove both Gibbs normalizations before identifying probability laws

Positive Hessian lower bounds imply strong convexity of F and G. StrongConvexGibbsIntegrability supplies integrability of their actual exponential weights without a minimizer assumption. Positive exponential integrals then give nonzero finite normalizers and actual probability tilted measures.

\[0<Z_F=\int e^{-F(x)}\,dx<\infty,\qquad 0<Z_G=\int e^{-G(x)}\,dx<\infty.\]

Corresponding Lean step

normalized_laws: hI,hIG; HessianStrongConvexity.strongConvexOn_univ_of_fderiv2_lower; integral_exp_pos; isProbabilityMeasure_tilted

5. Cancel the same volume Jacobian in numerator and denominator

For s=sqrt(c)>0, the volume substitution has J=abs((s^d)^(-1))>0. On each measurable B it gives I_F(S^(-1)B)=J*I_G(B), and also Z_F=J*Z_G. The tilted setwise formula cancels J, proving S#pi_F=pi_G. The private identity also supports total-integral degenerate inputs; the actual public consumer separately proves true positive normalization.

\[(S_\#\pi_F)(B)=\frac{J\int_B e^{-G(x)}dx}{JZ_G}=\pi_G(B),\qquad J=c^{-d/2}.\]

Corresponding Lean step

scaled_gibbs: hJ,hZ,hI; Measure.integral_comp_smul; tilted_apply_eq_ofReal_integral'

6. Transform the actual independent Gaussian product law

Expand H(mu,sigma) as the pushforward of mu.prod(stdGaussian) by (x,z)->x+sigma*z. Product-map and map-composition identities show R(SX+sqrt(t)Z)=X+sqrt(t/c)Z. The next t is distinct from the current eta and tau; t=0 is included.

\[R_\#H(S_\#\pi,\sqrt t)=H(\pi,c^{-1/2}\sqrt t)=H(\pi,\sqrt{t/c}).\]

Corresponding Lean step

scaled_smoothing: law,hp; normalized_laws: hsm; Measure.map_prod_map; Measure.map_map; Real.sqrt_div

7. Push each coupling and take the cost infimum

For any coupling gamma, map the pair by (x,y)->(s*x,s*y). Its two marginals are exactly the scaled marginals, and its quadratic cost is s^2 times the original cost. Since ofReal(s^2) is positive and finite for nonzero s, it commutes with both indexed infima defining transport cost, even for infinite cost or an empty coupling set. No optimal coupling or separate second-moment assumption is used.

\[\int\|sx-sy\|^2d\gamma=s^2\int\|x-y\|^2d\gamma,\quad W_2^2(s_\#\mu,s_\#\nu)\le s^2W_2^2(\mu,\nu).\]

Corresponding Lean step

scaled_wasserstein: hcouple,hcost; ENNReal.mul_iInf_of_ne; Transport.transportCost_le_lintegral_of_isCoupling

8. Propagate the supplied next-call precision

Apply the coupling bound with s=1/sqrt(c), substitute the proved smoothing-law identity, and use the nonnegative supplied budget B. This yields actual returned squared precision B/c. The source choice B=k*epsilon^2 therefore returns epsilon^2/a. This step consumes the normalized sampler guarantee; constructing that sampler and propagating conditional histories and total costs remain separate.

\[W_2^2(\bar\nu,H(\bar\pi,\sqrt t))\le B\Longrightarrow W_2^2(R_\#\bar\nu,H(\pi,\sqrt{t/c}))\le B/c;\quad \frac{k\varepsilon^2}{c}=\frac{\varepsilon^2}{a}.\]

Corresponding Lean step

normalized_laws: hprec; normalized_reference_call: hprec

Lean statement · normalized_reference_call

Actual first-hit reference normalization,genuine Hessian,positive Gibbs laws,Gaussian variance and returned Wasserstein precision.

theorem normalized_reference_call [FiniteDimensional ℝ E]
    [MeasurableSpace E] [BorelSpace E] {U : E → ℝ} {α β : ℝ≥0}
    (hα : 0 < α) (hαβ : α ≤ β) (hU : ContDiff ℝ 2 U)
    (hH : ∀ x v : E, (α:ℝ)*‖v‖^2 ≤ fderiv ℝ (fderiv ℝ U) x v v ∧
      fderiv ℝ (fderiv ℝ U) x v v ≤ (β:ℝ)*‖v‖^2)
    {η τ r : ℝ} (hη : 0 ≤ η) (hτ : 0 < τ) (hr : 0 ≤ r)
    (hd : 0 < (Module.finrank ℝ E : ℝ))
    (ν : Measure E) [IsProbabilityMeasure ν]
    (hw : TechnicalLemmas.Measure.WassersteinSpace.wassersteinDistance ν
      (TechnicalLemmas.Measure.GaussianSmoothing.gaussianSmoothing
        ((volume : Measure E).tilted (fun x => -U x)) (Real.sqrt η)) ^ 2 ≤ ENNReal.ofReal (r^2)) :
    let d : ℝ := Module.finrank ℝ E
    let A := η+τ
    let a := (α:ℝ)+A⁻¹
    let c := (β:ℝ)+A⁻¹
    let k := c/a
    let u := fun p : E × E => p.1+Real.sqrt τ • p.2
    let F := fun p x => U x+A⁻¹/2*‖x-u p‖^2
    let T := fun p x => x-c⁻¹ • gradient (F p) x
    let N := actualIndex T (fun p x => ‖gradient (F p) x‖^2) (a*d)
    let out := fun p => (T p)^[N p] p.1
    let S := fun x : E => Real.sqrt c • x
    let R := fun x : E => (Real.sqrt c)⁻¹ • x
    let G := fun p x => F p (R x)
    let π := fun p => (volume : Measure E).tilted (fun x => -F p x)
    let πbar := fun p => (volume : Measure E).tilted (fun x => -G p x)
    Measurable N ∧ Measurable (fun p => S (out p)) ∧
    (∀ p, ‖gradient (F p) (out p)‖^2 ≤ a*d ∧
      (∀ j < N p, a*d < ‖gradient (F p) ((T p)^[j] p.1)‖^2) ∧
      ‖gradient (G p) (S (out p))‖^2 ≤ d/k ∧
      ContDiff ℝ 2 (G p) ∧
      (∀ x v, (a/c)*‖v‖^2 ≤ fderiv ℝ (fderiv ℝ (G p)) x v v ∧
        fderiv ℝ (fderiv ℝ (G p)) x v v ≤ ‖v‖^2) ∧
      Integrable (fun x => Real.exp (-F p x)) (volume : Measure E) ∧
      0 < ∫ x : E, Real.exp (-F p x) ∧ IsProbabilityMeasure (π p) ∧
      Integrable (fun x => Real.exp (-G p x)) (volume : Measure E) ∧
      0 < ∫ x : E, Real.exp (-G p x) ∧ IsProbabilityMeasure (πbar p) ∧
      (π p).map S = πbar p ∧
      (∀ x, gradient (G p) (S x) = (Real.sqrt c)⁻¹ • gradient (F p) x) ∧
      (∀ t : ℝ, 0 ≤ t →
        (TechnicalLemmas.Measure.GaussianSmoothing.gaussianSmoothing (πbar p) (Real.sqrt t)).map R =
          TechnicalLemmas.Measure.GaussianSmoothing.gaussianSmoothing (π p) (Real.sqrt (t/c))) ∧
      (∀ (νbar : Measure E) (t B : ℝ), IsProbabilityMeasure νbar → 0 ≤ t → 0 ≤ B →
        TechnicalLemmas.Measure.WassersteinSpace.wassersteinDistance νbar
          (TechnicalLemmas.Measure.GaussianSmoothing.gaussianSmoothing (πbar p) (Real.sqrt t)) ^ 2 ≤
            ENNReal.ofReal B →
        TechnicalLemmas.Measure.WassersteinSpace.wassersteinDistance (νbar.map R)
          (TechnicalLemmas.Measure.GaussianSmoothing.gaussianSmoothing (π p) (Real.sqrt (t/c))) ^ 2 ≤
            ENNReal.ofReal (B/c)))

Exact module and namespace context

Lean proof · normalized_reference_call

Chain rules,actual first-hit parent,positive strong-convex Gibbs normalization,Haar substitution,product maps,and arbitrary-coupling infimum scaling.

theorem normalized_reference_call [FiniteDimensional ℝ E]
    [MeasurableSpace E] [BorelSpace E] {U : E → ℝ} {α β : ℝ≥0}
    (hα : 0 < α) (hαβ : α ≤ β) (hU : ContDiff ℝ 2 U)
    (hH : ∀ x v : E, (α:ℝ)*‖v‖^2 ≤ fderiv ℝ (fderiv ℝ U) x v v ∧
      fderiv ℝ (fderiv ℝ U) x v v ≤ (β:ℝ)*‖v‖^2)
    {η τ r : ℝ} (hη : 0 ≤ η) (hτ : 0 < τ) (hr : 0 ≤ r)
    (hd : 0 < (Module.finrank ℝ E : ℝ))
    (ν : Measure E) [IsProbabilityMeasure ν]
    (hw : TechnicalLemmas.Measure.WassersteinSpace.wassersteinDistance ν
      (TechnicalLemmas.Measure.GaussianSmoothing.gaussianSmoothing
        ((volume : Measure E).tilted (fun x => -U x)) (Real.sqrt η)) ^ 2 ≤ ENNReal.ofReal (r^2)) :
    let d : ℝ := Module.finrank ℝ E
    let A := η+τ
    let a := (α:ℝ)+A⁻¹
    let c := (β:ℝ)+A⁻¹
    let k := c/a
    let u := fun p : E × E => p.1+Real.sqrt τ • p.2
    let F := fun p x => U x+A⁻¹/2*‖x-u p‖^2
    let T := fun p x => x-c⁻¹ • gradient (F p) x
    let N := actualIndex T (fun p x => ‖gradient (F p) x‖^2) (a*d)
    let out := fun p => (T p)^[N p] p.1
    let S := fun x : E => Real.sqrt c • x
    let R := fun x : E => (Real.sqrt c)⁻¹ • x
    let G := fun p x => F p (R x)
    let π := fun p => (volume : Measure E).tilted (fun x => -F p x)
    let πbar := fun p => (volume : Measure E).tilted (fun x => -G p x)
    Measurable N ∧ Measurable (fun p => S (out p)) ∧
    (∀ p, ‖gradient (F p) (out p)‖^2 ≤ a*d ∧
      (∀ j < N p, a*d < ‖gradient (F p) ((T p)^[j] p.1)‖^2) ∧
      ‖gradient (G p) (S (out p))‖^2 ≤ d/k ∧
      ContDiff ℝ 2 (G p) ∧
      (∀ x v, (a/c)*‖v‖^2 ≤ fderiv ℝ (fderiv ℝ (G p)) x v v ∧
        fderiv ℝ (fderiv ℝ (G p)) x v v ≤ ‖v‖^2) ∧
      Integrable (fun x => Real.exp (-F p x)) (volume : Measure E) ∧
      0 < ∫ x : E, Real.exp (-F p x) ∧ IsProbabilityMeasure (π p) ∧
      Integrable (fun x => Real.exp (-G p x)) (volume : Measure E) ∧
      0 < ∫ x : E, Real.exp (-G p x) ∧ IsProbabilityMeasure (πbar p) ∧
      (π p).map S = πbar p ∧
      (∀ x, gradient (G p) (S x) = (Real.sqrt c)⁻¹ • gradient (F p) x) ∧
      (∀ t : ℝ, 0 ≤ t →
        (TechnicalLemmas.Measure.GaussianSmoothing.gaussianSmoothing (πbar p) (Real.sqrt t)).map R =
          TechnicalLemmas.Measure.GaussianSmoothing.gaussianSmoothing (π p) (Real.sqrt (t/c))) ∧
      (∀ (νbar : Measure E) (t B : ℝ), IsProbabilityMeasure νbar → 0 ≤ t → 0 ≤ B →
        TechnicalLemmas.Measure.WassersteinSpace.wassersteinDistance νbar
          (TechnicalLemmas.Measure.GaussianSmoothing.gaussianSmoothing (πbar p) (Real.sqrt t)) ^ 2 ≤
            ENNReal.ofReal B →
        TechnicalLemmas.Measure.WassersteinSpace.wassersteinDistance (νbar.map R)
          (TechnicalLemmas.Measure.GaussianSmoothing.gaussianSmoothing (π p) (Real.sqrt (t/c))) ^ 2 ≤
            ENNReal.ofReal (B/c))) := by
  let d : ℝ := Module.finrank ℝ E
  let A := η+τ
  let a := (α:ℝ)+A⁻¹
  let c := (β:ℝ)+A⁻¹
  let k := c/a
  let u := fun p : E × E => p.1+Real.sqrt τ • p.2
  let F := fun p x => U x+A⁻¹/2*‖x-u p‖^2
  let T := fun p x => x-c⁻¹ • gradient (F p) x
  let N := actualIndex T (fun p x => ‖gradient (F p) x‖^2) (a*d)
  let out := fun p => (T p)^[N p] p.1
  let S := fun x : E => Real.sqrt c • x
  let R := fun x : E => (Real.sqrt c)⁻¹ • x
  let G := fun p x => F p (R x)
  have hA : 0 < A := add_pos_of_nonneg_of_pos hη hτ
  have ha : 0 < a := add_pos_of_nonneg_of_pos α.coe_nonneg (inv_pos.mpr hA)
  have hc : 0 < c := add_pos_of_nonneg_of_pos β.coe_nonneg (inv_pos.mpr hA)
  have hs : 0 < Real.sqrt c := Real.sqrt_pos.mpr hc
  have hi : (Real.sqrt c)⁻¹^2=c⁻¹ := by rw [inv_pow,Real.sq_sqrt hc.le]
  have hP := JointReferenceGradientDescent.joint_reference_gradient_descent
    hα hαβ hU hH hη hτ hr hd ν hw
  have hNm : Measurable N := hP.1
  have hom : Measurable out := hP.2.1
  refine ⟨hNm,(by fun_prop : Measurable S).comp hom,fun p => ?_⟩
  have hreg := regularized_hessian hU A⁻¹ (u p)
  have hFH (x v : E) : a*‖v‖^2 ≤ fderiv ℝ (fderiv ℝ (F p)) x v v ∧
      fderiv ℝ (fderiv ℝ (F p)) x v v ≤ c*‖v‖^2 := by
    rw [hreg.2]
    dsimp [a,c]
    constructor <;> nlinarith [(hH x v).1,(hH x v).2]
  obtain ⟨hG,hGH,hI,hZ,hprob,hIG,hZG,hprobG,hmap,hgrad,hsm,hprec⟩ :=
    normalized_laws ha hc hreg.1 hFH
  have hp : ‖gradient (F p) (out p)‖^2 ≤ a*d := (hP.2.2.1 p).1
  have hearly : ∀ j < N p, a*d < ‖gradient (F p) ((T p)^[j] p.1)‖^2 :=
    (hP.2.2.1 p).2.2.2.1
  refine ⟨hp,hearly,?_,hG,hGH,hI,hZ,hprob,hIG,hZG,hprobG,hmap,hgrad,hsm,
    fun νbar t B _ ht _ hbudget => hprec νbar t B ht hbudget⟩
  rw [hgrad,norm_smul,Real.norm_eq_abs,mul_pow,sq_abs,hi]
  have hb := mul_le_mul_of_nonneg_left hp (inv_pos.mpr hc).le
  calc
    c⁻¹*‖gradient (F p) (out p)‖^2 ≤ c⁻¹*(a*d) := hb
    _ = d/k := by dsimp [k]; field_simp

end AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.NormalizedReferenceCall

Exact module and namespace context

Source assumptions versus formal assumptions

Source	Actual Lean	Difference kind	Why it matters
Normalize F(x/sqrt(c)) and divide the resulting output by sqrt(c).	True differential,normalized Gibbs,smoothing and quadratic transport calculations.	source-implicit	The source convention is expanded into actual law equalities and the required one-sided cost inequality.
The reference is built by the inner gradient stopping rule.	The same actual first ad-hit,with measurable scaled output and d/k bound.	same	The terminal reference is not substituted and no admissible point is supplied as an assumption.
Normalized beta=1,Euclidean positive-parameter setting.	General beta,coordinate-free,d>0,tau>0; eta,t,r,B may vanish.	generalization	Positive curvature remains required; neither dimension zero nor beta zero is included.
Upstream and next sampler precision guarantees participate in the recursive call.	Distinct outer W2 input and next normalized output budget B>=0.	same	The theorem constructs neither supplied sampler guarantee. B=k*epsilon^2 yields epsilon^2/a with a the regularized curvature.
Implicit normalizing constants and change of variables.	Both weights L1,strictly positive normalizers,actual probability laws and Jacobian cancellation proved.	source-implicit	Private total-integral conventions are not used to weaken actual Gibbs normalization.
This normalization is used within a recursive sampler.	Fixed-pair potential and law identities with joint reference measurability.	same	All-parameter kernels,measurable sampler selection,history and cumulative costs remain separate.

Fixed-call normalization of the actual first ad-hit reference and actual sampling laws. General beta, coordinate-free finite dimension and eta=0,t=0,r=0,B=0 extend the source; d>0,tau>0,0<alpha<=beta remain required. The outer W2 input and next normalized output precision are distinct supplied guarantees. No sampler achieving the next budget, all-parameter kernel, measurable sampler selection, conditional history or stage costs are proved. The public transport conclusion is the needed inequality, not a full isometry theorem. For source B=k*epsilon^2, B/c=epsilon^2/a; a here denotes regularized curvature. Returned probability is a standard measurable-pushforward consequence, not an extra public conjunct. Both main results remain incomplete.

Encoder–denoiser: accepted · domain-mismatch

Detected semantic differences

objects: Coordinate convention expanded into actual law calculations. — Independent formal reviewer accepted: Coordinate convention expanded into actual law calculations.
conclusion: Actual ad first-hit retained. — Independent formal reviewer accepted: Actual ad first-hit retained.
domains: General beta,coordinate-free and zero boundaries disclosed; supports domain-mismatch. — Independent formal reviewer accepted: General beta,coordinate-free and zero boundaries disclosed; supports domain-mismatch.
assumptions: Two distinct supplied precision guarantees. — Independent formal reviewer accepted: Two distinct supplied precision guarantees.
conclusion: Positive normalization and change-of-variable details proved. — Independent formal reviewer accepted: Positive normalization and change-of-variable details proved.
scopes: Fixed pair and recursive global boundary disclosed. — Independent formal reviewer accepted: Fixed pair and recursive global boundary disclosed.

A generalization is not a source correction. Proposed missing conditions require separate independent repair review. No proposed repair silently changes the original theorem.

Scope and omitted-condition boundaries

Fixed-call normalization of the actual first ad-hit reference and actual sampling laws. General beta, coordinate-free finite dimension and eta=0,t=0,r=0,B=0 extend the source; d>0,tau>0,0<alpha<=beta remain required. The outer W2 input and next normalized output precision are distinct supplied guarantees. No sampler achieving the next budget, all-parameter kernel, measurable sampler selection, conditional history or stage costs are proved. The public transport conclusion is the needed inequality, not a full isometry theorem. For source B=k*epsilon^2, B/c=epsilon^2/a; a here denotes regularized curvature. Returned probability is a standard measurable-pushforward consequence, not an extra public conjunct. Both main results remain incomplete.

Source and reuse

ASTIS parents called

Mathlib API called (external library)

MeasureTheory.Measure.integral_comp_smul
MeasureTheory.tilted_apply_eq_ofReal_integral'
MeasureTheory.Measure.map_prod_map
MeasureTheory.Measure.map_map
ENNReal.mul_iInf_of_ne

Mathematical sources

SPHMC Sections6.1 and6.3 normalization convention and next call — Fixed-call normalization of the actual first ad-hit reference and actual sampling laws. General beta, coordinate-free finite dimension and eta=0,t=0,r=0,B=0 extend the source; d>0,tau>0,0<alpha<=beta remain required. The outer W2 input and next normalized output precision are distinct supplied guarantees. No sampler achieving the next budget, all-parameter kernel, measurable sampler selection, conditional history or stage costs are proved. The public transport conclusion is the needed inequality, not a full isometry theorem. For source B=k*epsilon^2, B/c=epsilon^2/a; a here denotes regularized curvature. Returned probability is a standard measurable-pushforward consequence, not an extra public conjunct. Both main results remain incomplete.

ASTIS prose is not a quotation or a source-equivalence certificate. Definitions and aliases are explained as constructions, not counted as new mathematical proofs.

Which proof edges are actually covered?

Local proof component; source adapter/review separate Actual normalized reference and returned sampling precision

Actual observation-conditioned retained-state execution

ASTIS expanded conditional execution component for Fan Chen,Sinho Chewi,Jianfeng Lu and Matthew S. Zhang, Smoothed Picard Hamiltonian Monte Carlo. Not the complete error theorem.

arXiv:2609.06906v1 · Algorithm3.3,Section6.3 after(6.5) · faithful paraphrase

Complete source statement (ASTIS restatement)

There exist a Markov joint kernel J:S->(E x S) and a Markov absorbed transition P:S->S. For every s, J_s is the pushforward of M_s product gamma_E by (x,z) -> (obs(s,(x,z)),U(s,(x,z))). Its first marginal is exactly G(M_s,sqrt(tau_s/(beta+b))). The kernel identity J.fst compProd J.condKernel=J holds. For each s, for J.fst_s-almost every y, for J.condKernel(s,y)-almost every t, t.precision=bp_s and t.center=bp_s^(-1)*(b*u+v_s^(-1)*y). For every actual Markov R:S->E, every s and every measurable A, the nonnegative integral of R(U(s,(x,z)),A) under M_s product gamma_E equals the iterated nonnegative integral of R(t,A) first under J.condKernel(s,y), then under J.fst_s. P_s is dirac_s when threshold<=b and the pushforward by U otherwise. If b<threshold, (R composed with P)(s,A) equals the same conditional iterated integral.

E is a finite-dimensional real inner-product Borel space of positive dimension d. V:E->R is C2 and its genuine Hessian satisfies alpha*norm(w)^2 <= D2V(x)[w,w] <= beta*norm(w)^2 for all x,w. The nonnegative reals alpha,beta satisfy0<alpha<=beta.
The full state is S=NNReal x E x E x Nat x (Nat->E), written s=(b,u,xref,k,history). M:S->E is an actual Markov kernel. eta,tau:S->R are measurable and strictly positive at every state; they may depend on all coordinates. Fix any nonnegative precision threshold. No source schedule,initial-reference admissibility,history origin,accuracy or moment assumption is imposed.
Put v_s=(eta_s+tau_s)/(beta+b), bp_s=b+toNNReal(v_s^(-1)), and obs(s,(x,z))=x+sqrt(tau_s/(beta+b))*z. The next center is center(s,(x,z))=bp_s^(-1)*(b*u+v_s^(-1)*obs(s,(x,z))). The observation variance tau_s/(beta+b) is distinct from the RGO update variance v_s.
Define F_p(w)=V(w)+bp_s/2*norm(w-center(p))^2 and T_p(w)=w-(beta+bp_s)^(-1)*grad F_p(w), where p=(s,(x,z)). N_p is the least n with norm(grad F_p(T_p^n(x)))^2 <= (alpha+bp_s)*d, or zero if none exists. The actual update is U(p)=(bp_s,center(p),T_p^N_p(x),k+1,prepend(obs(p),history)). It uses the pre-noise sample x to initialize GD, and retains the full reference and history.
gamma_E denotes standard Gaussian measure. Gaussian smoothing G(mu,sigma) is the pushforward of mu product the law of sigma*Z under addition. J.fst denotes the observation marginal of a joint kernel J:S->(E x S). J.condKernel is the parameterized Markov conditional state kernel (s,y)->S supplied by standard-Borel disintegration. R composed with P means first draw a state from P and then an output from R.

Actual conditional execution

\[J_s=(\mathrm{obs}_s,U_s)_\#(M_s\otimes\gamma_E)=Q_s\otimes C_s,\qquad (R\circ P)(s,A)=\int\!\int R(t,A)\,C(s,y,dt)\,Q_s(dy)\quad(b_s< b_*).\]

Read the formalized proofs

Each statement and proof below has its own closed Lean disclosure. ASTIS parents, Mathlib calls and external mathematical sources are distinguished in each proof.

ASTIS mathematical exposition

Actual observation-conditioned retained-state execution

AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.ObservationConditionalKernel.observation_conditional_kernel · theorem · Teaching coverage

Statement

\[J_s=(\mathrm{obs}_s,U_s)_\#(M_s\otimes\gamma_E)=Q_s\otimes C_s,\qquad (R\circ P)(s,A)=\int\!\int R(t,A)\,C(s,y,dt)\,Q_s(dy)\quad(b_s< b_*).\]

All objects and hypotheses

E is a finite-dimensional real inner-product Borel space of positive dimension d. V:E->R is C2 and its genuine Hessian satisfies alpha*norm(w)^2 <= D2V(x)[w,w] <= beta*norm(w)^2 for all x,w. The nonnegative reals alpha,beta satisfy0<alpha<=beta.
The full state is S=NNReal x E x E x Nat x (Nat->E), written s=(b,u,xref,k,history). M:S->E is an actual Markov kernel. eta,tau:S->R are measurable and strictly positive at every state; they may depend on all coordinates. Fix any nonnegative precision threshold. No source schedule,initial-reference admissibility,history origin,accuracy or moment assumption is imposed.
Put v_s=(eta_s+tau_s)/(beta+b), bp_s=b+toNNReal(v_s^(-1)), and obs(s,(x,z))=x+sqrt(tau_s/(beta+b))*z. The next center is center(s,(x,z))=bp_s^(-1)*(b*u+v_s^(-1)*obs(s,(x,z))). The observation variance tau_s/(beta+b) is distinct from the RGO update variance v_s.
Define F_p(w)=V(w)+bp_s/2*norm(w-center(p))^2 and T_p(w)=w-(beta+bp_s)^(-1)*grad F_p(w), where p=(s,(x,z)). N_p is the least n with norm(grad F_p(T_p^n(x)))^2 <= (alpha+bp_s)*d, or zero if none exists. The actual update is U(p)=(bp_s,center(p),T_p^N_p(x),k+1,prepend(obs(p),history)). It uses the pre-noise sample x to initialize GD, and retains the full reference and history.
gamma_E denotes standard Gaussian measure. Gaussian smoothing G(mu,sigma) is the pushforward of mu product the law of sigma*Z under addition. J.fst denotes the observation marginal of a joint kernel J:S->(E x S). J.condKernel is the parameterized Markov conditional state kernel (s,y)->S supplied by standard-Borel disintegration. R composed with P means first draw a state from P and then an output from R.

Mathematical proof

1. Keep the exact pre-noise reference update

Apply ReferenceCarryingKernel under the genuine Hessian assumptions. Its measurable update contains the true first inner GD hit from x, the precision-weighted center, and the complete reference/count/history. The private firstIndex definition is definitionally the same fallback/least-hit function as the parent. No reference is supplied as a free observation-only function.

\[U(s,x,z)=(b^+,u^+,T_{s,x,z}^{N_{s,x,z}}x,k+1,\mathrm{prepend}(y,h)).\]

Corresponding Lean step

firstIndex; actual_joint: href,hu

2. Build one joint observation and updated-state law

Set Q=M times the constant standard Gaussian kernel. Pair the input state with this draw using the identity kernel, then push forward by the measurable pair (obs,update). Both coordinates therefore refer to the same x,z. The product and measurable-map kernel instances prove the resulting J is Markov.

\[J_s=(\mathrm{obs}_s,U_s)_\#(M_s\otimes\gamma_E).\]

Corresponding Lean step

joint: Q,f,hf,J,hJs

3. Identify the actual observation marginal

Project the joint pushforward onto its first coordinate. Composition of measurable maps removes update while preserving the actual observation x+sigma_s*z. The product pushforward identity moves Gaussian scaling into its noise marginal, giving the existing GaussianSmoothing definition exactly. No Wasserstein or KL assumption is used.

\[Q_s=(J_s)_{\rm fst}=G(M_s,\sqrt{\tau_s/(\beta+b_s)}).\]

Corresponding Lean step

joint: hfs,hp,Kernel.fst_apply,Measure.map_map,Measure.map_prod_map

4. Disintegrate jointly in state and observation

The full state has a standard Borel structure and is nonempty, and the finite-dimensional observation space is countably generated. The finite Markov J therefore has a parameterized Markov conditional kernel on (s,y). Mathlib disintegrate gives a kernel identity, not separate nonmeasurable choices of a conditional measure for each s.

\[Q\otimes_{\rm k}J.\mathrm{condKernel}=J.\]

Corresponding Lean step

joint: Kernel.disintegrate J J.condKernel

5. Recover deterministic precision and center only almost everywhere

Under the actual joint pushforward the next precision and center equal their source formulas for every original x,z. Their equality event is measurable. Transfer its full measure through the map, rewrite J by its disintegration, and apply the kernel AE Fubini direction. This gives the nested AE statement; conditional versions on null observation fibers are not constrained.

\[Q_s\text{-a.e. }y,\ C(s,y)\text{-a.e. }t:\quad b_t=b_s^+,\quad u_t=(b_s^+)^{-1}(b_su_s+v_s^{-1}y).\]

Corresponding Lean step

actual_conditional: hf,hm,Kernel.ae_ae_of_ae_compProd,ae_map_iff

6. Factor any actual remaining output

For measurable A the function (y,t)->R(t,A) is measurable and nonnegative. Integrate it against the disintegration and then rewrite the same J as the actual joint pushforward. The nonnegative compProd/map formulas yield the equality without a finite moment or integrability premise. R may depend on the retained reference and history.

\[\int R(U_s(x,z),A)\,d(M_s\otimes\gamma_E)=\int\!\int R(t,A)\,dC(s,y)\,dQ_s(y).\]

Corresponding Lean step

actual_conditional: hr,hi,Kernel.lintegral_compProd,lintegral_map

7. Connect the absorbed execution on its active branch

Take the actual P constructed by ReferenceCarryingKernel. At b<threshold its law is precisely the update pushforward. The kernel composition integral and the measurable map formula reduce (R composed with P)(s,A) to the preceding equality. At terminal states P is a self-loop, so no such identification with hypothetical continuing J is asserted.

\[b_s<b_*\Rightarrow (R\circ P)(s,A)=\int\!\int R(t,A)\,dC(s,y)\,dQ_s(y).\]

Corresponding Lean step

observation_conditional_kernel: href,hu,P,hPs,hum,hfactor

Lean statement · observation_conditional_kernel

Actual joint observation and retained-state law, Gaussian marginal, conditional support and active execution factorization.

theorem observation_conditional_kernel {V : E → ℝ} {α β : ℝ≥0}
    (hα : 0 < α) (hαβ : α ≤ β) (hV : ContDiff ℝ 2 V)
    (hH : ∀ x w : E, (α:ℝ)*‖w‖^2 ≤ fderiv ℝ (fderiv ℝ V) x w w ∧
      fderiv ℝ (fderiv ℝ V) x w w ≤ (β:ℝ)*‖w‖^2)
    (hd : 0 < (Module.finrank ℝ E : ℝ))
    (η τ : RefState E → ℝ) (hη : Measurable η) (hτ : Measurable τ)
    (hη0 : ∀ s, 0 < η s) (hτ0 : ∀ s, 0 < τ s)
    (M : Kernel (RefState E) E) [IsMarkovKernel M] (threshold : ℝ≥0) :
    let d : ℝ := Module.finrank ℝ E
    let v := fun s : RefState E => (η s+τ s)/((β:ℝ)+s.1)
    let bp := fun s : RefState E => s.1+Real.toNNReal (v s)⁻¹
    let obs := fun p : RefState E × (E × E) => p.2.1+Real.sqrt (τ p.1/((β:ℝ)+p.1.1)) • p.2.2
    let center := fun p : RefState E × (E × E) => (bp p.1:ℝ)⁻¹ •
      ((p.1.1:ℝ) • p.1.2.1+(v p.1)⁻¹ • obs p)
    let F := fun p x => V x+(bp p.1:ℝ)/2*‖x-center p‖^2
    let T := fun p x => x-((β:ℝ)+bp p.1)⁻¹ • gradient (F p) x
    let q := fun n p => ‖gradient (F p) ((T p)^[n] p.2.1)‖^2
    let N := firstIndex q (fun p => ((α:ℝ)+bp p.1)*d)
    let out := fun p => (T p)^[N p] p.2.1
    let update := fun p : RefState E × (E × E) =>
      (bp p.1,center p,out p,p.1.2.2.2.1+1,fun n => Nat.casesOn n (obs p) p.1.2.2.2.2)
    ∃ J : Kernel (RefState E) (E × RefState E), ∃ hJ : IsMarkovKernel J,
      letI := hJ
      (∀ s, J s = ((M s).prod (stdGaussian E)).map
        (fun z => (obs (s,z),update (s,z)))) ∧
      (∀ s, J.fst s =
        AutoSamplingTheory.TechnicalLemmas.Measure.GaussianSmoothing.gaussianSmoothing
          (M s) (Real.sqrt (τ s/((β:ℝ)+s.1)))) ∧
      J.fst ⊗ₖ J.condKernel = J ∧
      (∀ s, ∀ᵐ y ∂J.fst s, ∀ᵐ t ∂J.condKernel (s,y),
        t.1=bp s ∧ t.2.1=(bp s:ℝ)⁻¹ • ((s.1:ℝ) • s.2.1+(v s)⁻¹ • y)) ∧
      (∀ (R : Kernel (RefState E) E) [IsMarkovKernel R] (s : RefState E)
        (A : Set E), MeasurableSet A →
        (∫⁻ z, R (update (s,z)) A ∂(M s).prod (stdGaussian E)) =
        ∫⁻ y, ∫⁻ t, R t A ∂J.condKernel (s,y) ∂J.fst s) ∧
      ∃ P : Kernel (RefState E) (RefState E), ∃ hP : IsMarkovKernel P,
        letI := hP
        (∀ s, P s=if threshold ≤ s.1 then Measure.dirac s else
          ((M s).prod (stdGaussian E)).map (fun z => update (s,z))) ∧
        ∀ (R : Kernel (RefState E) E) [IsMarkovKernel R] (s : RefState E),
          s.1 < threshold → ∀ A : Set E, MeasurableSet A →
          (R ∘ₖ P) s A = ∫⁻ y, ∫⁻ t, R t A ∂J.condKernel (s,y) ∂J.fst s

Exact module and namespace context

Lean proof · observation_conditional_kernel

Measurable product pushforward, parameterized disintegration, AE conditional support and nonnegative integration on the actual active branch.

theorem observation_conditional_kernel {V : E → ℝ} {α β : ℝ≥0}
    (hα : 0 < α) (hαβ : α ≤ β) (hV : ContDiff ℝ 2 V)
    (hH : ∀ x w : E, (α:ℝ)*‖w‖^2 ≤ fderiv ℝ (fderiv ℝ V) x w w ∧
      fderiv ℝ (fderiv ℝ V) x w w ≤ (β:ℝ)*‖w‖^2)
    (hd : 0 < (Module.finrank ℝ E : ℝ))
    (η τ : RefState E → ℝ) (hη : Measurable η) (hτ : Measurable τ)
    (hη0 : ∀ s, 0 < η s) (hτ0 : ∀ s, 0 < τ s)
    (M : Kernel (RefState E) E) [IsMarkovKernel M] (threshold : ℝ≥0) :
    let d : ℝ := Module.finrank ℝ E
    let v := fun s : RefState E => (η s+τ s)/((β:ℝ)+s.1)
    let bp := fun s : RefState E => s.1+Real.toNNReal (v s)⁻¹
    let obs := fun p : RefState E × (E × E) => p.2.1+Real.sqrt (τ p.1/((β:ℝ)+p.1.1)) • p.2.2
    let center := fun p : RefState E × (E × E) => (bp p.1:ℝ)⁻¹ •
      ((p.1.1:ℝ) • p.1.2.1+(v p.1)⁻¹ • obs p)
    let F := fun p x => V x+(bp p.1:ℝ)/2*‖x-center p‖^2
    let T := fun p x => x-((β:ℝ)+bp p.1)⁻¹ • gradient (F p) x
    let q := fun n p => ‖gradient (F p) ((T p)^[n] p.2.1)‖^2
    let N := firstIndex q (fun p => ((α:ℝ)+bp p.1)*d)
    let out := fun p => (T p)^[N p] p.2.1
    let update := fun p : RefState E × (E × E) =>
      (bp p.1,center p,out p,p.1.2.2.2.1+1,fun n => Nat.casesOn n (obs p) p.1.2.2.2.2)
    ∃ J : Kernel (RefState E) (E × RefState E), ∃ hJ : IsMarkovKernel J,
      letI := hJ
      (∀ s, J s = ((M s).prod (stdGaussian E)).map
        (fun z => (obs (s,z),update (s,z)))) ∧
      (∀ s, J.fst s =
        AutoSamplingTheory.TechnicalLemmas.Measure.GaussianSmoothing.gaussianSmoothing
          (M s) (Real.sqrt (τ s/((β:ℝ)+s.1)))) ∧
      J.fst ⊗ₖ J.condKernel = J ∧
      (∀ s, ∀ᵐ y ∂J.fst s, ∀ᵐ t ∂J.condKernel (s,y),
        t.1=bp s ∧ t.2.1=(bp s:ℝ)⁻¹ • ((s.1:ℝ) • s.2.1+(v s)⁻¹ • y)) ∧
      (∀ (R : Kernel (RefState E) E) [IsMarkovKernel R] (s : RefState E)
        (A : Set E), MeasurableSet A →
        (∫⁻ z, R (update (s,z)) A ∂(M s).prod (stdGaussian E)) =
        ∫⁻ y, ∫⁻ t, R t A ∂J.condKernel (s,y) ∂J.fst s) ∧
      ∃ P : Kernel (RefState E) (RefState E), ∃ hP : IsMarkovKernel P,
        letI := hP
        (∀ s, P s=if threshold ≤ s.1 then Measure.dirac s else
          ((M s).prod (stdGaussian E)).map (fun z => update (s,z))) ∧
        ∀ (R : Kernel (RefState E) E) [IsMarkovKernel R] (s : RefState E),
          s.1 < threshold → ∀ A : Set E, MeasurableSet A →
          (R ∘ₖ P) s A = ∫⁻ y, ∫⁻ t, R t A ∂J.condKernel (s,y) ∂J.fst s := by
  classical
  intro d v bp obs center F T q N out update
  obtain ⟨J,hJ,hJs,hJfst,hdis,hsupp,hfactor⟩ :=
    actual_conditional hα hαβ hV hH hd η τ hη hτ hη0 hτ0 M threshold
  let := hJ
  have href := AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.ReferenceCarryingKernel.reference_carrying_kernel
    hα hαβ hV hH hd η τ hη hτ hη0 hτ0 M threshold
  have hu : Measurable update := href.2.2.2.1
  obtain ⟨P,hP,hPs,hproj⟩ := href.2.2.2.2.2
  let := hP
  refine ⟨J,hJ,hJs,hJfst,hdis,hsupp,hfactor,P,hP,hPs,?_⟩
  intro R hR s hs A hA
  rw [Kernel.comp_apply' R P s hA,hPs s,if_neg (not_le.mpr hs)]
  change (∫⁻ t, R t A ∂(((M s).prod (stdGaussian E)).map
    (fun z => update (s,z)))) = _
  have hum : Measurable (fun z : E × E => update (s,z)) :=
    hu.comp (measurable_const.prodMk measurable_id)
  rw [lintegral_map (R.measurable_coe hA) hum]
  exact hfactor R s A hA

end AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.ObservationConditionalKernel

Exact module and namespace context

Source assumptions versus formal assumptions

Source	Actual Lean	Difference kind	Why it matters
Source has smooth strongly convex Euclidean potentials.	Positive finite-dimensional inner-product Borel E and genuine C2 Hessian bounds alpha,beta.	API-limitation	The actual GD differential API uses stronger regularity; conditional measure construction itself does not require curvature.
Algorithm3.3 specifies step schedules and produced reference/history.	Arbitrary measurable positive eta,tau and arbitrary full initial state.	generalization	Only actual transition semantics are proved; no source schedule,depth,admissibility or cost is borrowed.
Source M implements an approximate sampler and the remaining call has an accuracy target.	M and R are arbitrary actual Markov kernels.	API-limitation	No approximation accuracy or KL recurrence is concluded.
Source conditions on observation and complete recursive history.	Parameterized joint observation/fullupdatedstate disintegration retains the pre-noise initialized reference.	source-implicit	This supplies measurable conditional semantics without reconstructing a reference from observation alone.
Source terminal branch stops or calls the terminal sampler.	J always describes hypothetical continuing update; actual absorbed P composition is identified only for b<threshold.	source-implicit	No equality with the continuing update on terminal states is claimed; threshold0 has no active states.
Source conditional formulas are interpreted as conditional laws.	Precision and center support hold under nested AE quantifiers.	mathematically-necessary	Conditional versions need not satisfy those formulas on null observation fibers.
Source main results provide output accuracy and query complexity.	Exact joint law and active-branch output factorization only.	API-limitation	Ideal posterior,KL recurrence,final accuracy and all costs remain separate obligations.

Actual observation-conditioned retained-state execution component, not KL propagation or either complete paper. C2 genuine Hessian bounds strengthen source regularity; positive finite dimension and0<alpha<=beta are explicit. Eta,tau and M may depend on all state coordinates. M and R are arbitrary actual Markov kernels with no approximation/moment guarantees, and initial reference/count/history are arbitrary. J describes hypothetical unabsorbed update on all states; its output factorization identifies actual absorbed P only on b<threshold. Threshold0 makes this active interface empty. Precision/center support is doubly almost everywhere, not for all conditional fibers. The reference is not reconstructed from y; its law is retained in the joint pushforward. No ideal posterior,source schedule,depth,initial admissibility,final accuracy,KL recurrence,cost or TV-to-unbounded-cost conclusion.

Encoder–denoiser: accepted · domain-mismatch

Detected semantic differences

assumptions: Stronger regularity and coordinate domain disclosed. — Independent formal source reviewer accepted: Stronger regularity and coordinate domain disclosed.
domains: Arbitrary measurable positive parameters and initial state do not borrow source schedule/admissibility. — Independent formal source reviewer accepted: Arbitrary measurable positive parameters and initial state do not borrow source schedule/admissibility.
assumptions: Arbitrary actual M,R carry no accuracy or moment guarantee. — Independent formal source reviewer accepted: Arbitrary actual M,R carry no accuracy or moment guarantee.
objects: Parameterized conditional semantics preserve real reference randomness. — Independent formal source reviewer accepted: Parameterized conditional semantics preserve real reference randomness.
scopes: Hypothetical continuing J differs from stopped P;threshold0 active interface empty. — Independent formal source reviewer accepted: Hypothetical continuing J differs from stopped P;threshold0 active interface empty.
quantifiers: Conditional support remains nested AE,not every observation version. — Independent formal source reviewer accepted: Conditional support remains nested AE,not every observation version.
conclusion: No ideal posterior,KL recurrence,final error or cost claim. — Independent formal source reviewer accepted: No ideal posterior,KL recurrence,final error or cost claim.

A generalization is not a source correction. Proposed missing conditions require separate independent repair review. No proposed repair silently changes the original theorem.

Scope and omitted-condition boundaries

Actual observation-conditioned retained-state execution component, not KL propagation or either complete paper. C2 genuine Hessian bounds strengthen source regularity; positive finite dimension and0<alpha<=beta are explicit. Eta,tau and M may depend on all state coordinates. M and R are arbitrary actual Markov kernels with no approximation/moment guarantees, and initial reference/count/history are arbitrary. J describes hypothetical unabsorbed update on all states; its output factorization identifies actual absorbed P only on b<threshold. Threshold0 makes this active interface empty. Precision/center support is doubly almost everywhere, not for all conditional fibers. The reference is not reconstructed from y; its law is retained in the joint pushforward. No ideal posterior,source schedule,depth,initial admissibility,final accuracy,KL recurrence,cost or TV-to-unbounded-cost conclusion.

Source and reuse

ASTIS parents called

Mathlib API called (external library)

ProbabilityTheory.Kernel.disintegrate
ProbabilityTheory.Kernel.condKernel
ProbabilityTheory.Kernel.ae_ae_of_ae_compProd
ProbabilityTheory.Kernel.lintegral_compProd
MeasureTheory.Measure.map_prod_map
MeasureTheory.lintegral_map

Mathematical sources

SPHMC Algorithm3.3 and Section6.3 after(6.5) — Actual observation-conditioned retained-state execution component, not KL propagation or either complete paper. C2 genuine Hessian bounds strengthen source regularity; positive finite dimension and0<alpha<=beta are explicit. Eta,tau and M may depend on all state coordinates. M and R are arbitrary actual Markov kernels with no approximation/moment guarantees, and initial reference/count/history are arbitrary. J describes hypothetical unabsorbed update on all states; its output factorization identifies actual absorbed P only on b<threshold. Threshold0 makes this active interface empty. Precision/center support is doubly almost everywhere, not for all conditional fibers. The reference is not reconstructed from y; its law is retained in the joint pushforward. No ideal posterior,source schedule,depth,initial admissibility,final accuracy,KL recurrence,cost or TV-to-unbounded-cost conclusion.

ASTIS prose is not a quotation or a source-equivalence certificate. Definitions and aliases are explained as constructions, not counted as new mathematical proofs.

Which proof edges are actually covered?

Local proof component; source adapter/review separate Actual observation-conditioned retained-state execution

Actual Poisson rejection query tails with explicit constants

Fan Chen, Sinho Chewi, Jianfeng Lu and Matthew S. Zhang are the source authors. The exact expanded supporting tail inequality and proof below are an independent ASTIS derivation, not a quotation of the printed external tail formula or author endorsement.

arXiv:2609.06906v1 · Appendix A.1 and Theorem A.4(2); independently derived bounded-program query-tail prerequisite · faithful paraphrase

Complete source statement (ASTIS restatement)

Under the displayed measurable bounded-estimator experiment, the actual full-batch query count satisfies P(C>2B(e-1)m+L)<=delta and P(C>K(B)L)<=delta, where K(B)=2B(e-1)(exp(2B)+1/log(2))+1. Acceptance probability is derived from the actual parent program and is not an extra hypothesis. The first inequality retains the integer ceiling; the second is an explicit single-log bound for fixed B. Both hold for every B>0, including arbitrarily small B, and every 0<delta<1.

S, X and A are arbitrary measurable spaces. Q:S->X is a Markov kernel and nu is a fixed probability law on A.
B>0 is fixed across parameters. W:((S times X) times A)->Real is jointly measurable and |W((s,x),z)|<=B for every s,x,z.
A default x0:X is supplied for the parent output construction; the cost bound does not depend on its value.
At each parameter s an attempt independently draws x~Q(s), N~Poisson(2B), an infinite iid auxiliary sequence z~nu^ℕ, of which only the first N entries are read, and U~Uniform[0,1]. It accepts when U<=product_{i<N}(B+W((s,x),z_i))/(2B). Whole attempts are iid.
C is the extended nonnegative sum of N_n over all attempts n whose preceding attempts failed, including the first successful batch. On never-success it is the sum over every batch.
For every parameter s and failure tolerance 0<delta<1, set L=log(2/delta) and m=ceil(exp(2B)L).

Actual full-batch tail and explicit single-log constant

\[L=\log(2/\delta),\quad m=\lceil e^{2B}L\rceil,\quad K(B)=2B(e-1)(e^{2B}+1/\log2)+1,\qquad \mathbb P(C>2B(e-1)m+L)\le\delta,\quad\mathbb P(C>K(B)L)\le\delta.\]

Read the formalized proofs

Each statement and proof below has its own closed Lean disclosure. ASTIS parents, Mathlib calls and external mathematical sources are distinguished in each proof.

ASTIS mathematical exposition

Actual Poisson rejection query tails with explicit constants

AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.PoissonQueryTail.poisson_query_tail · theorem · Teaching coverage

Statement

\[L=\log(2/\delta),\quad m=\lceil e^{2B}L\rceil,\quad K(B)=2B(e-1)(e^{2B}+1/\log2)+1,\qquad \mathbb P(C>2B(e-1)m+L)\le\delta,\quad\mathbb P(C>K(B)L)\le\delta.\]

All objects and hypotheses

S, X and A are arbitrary measurable spaces. Q:S->X is a Markov kernel and nu is a fixed probability law on A.
B>0 is fixed across parameters. W:((S times X) times A)->Real is jointly measurable and |W((s,x),z)|<=B for every s,x,z.
A default x0:X is supplied for the parent output construction; the cost bound does not depend on its value.
At each parameter s an attempt independently draws x~Q(s), N~Poisson(2B), an infinite iid auxiliary sequence z~nu^ℕ, of which only the first N entries are read, and U~Uniform[0,1]. It accepts when U<=product_{i<N}(B+W((s,x),z_i))/(2B). Whole attempts are iid.
C is the extended nonnegative sum of N_n over all attempts n whose preceding attempts failed, including the first successful batch. On never-success it is the sum over every batch.
For every parameter s and failure tolerance 0<delta<1, set L=log(2/delta) and m=ceil(exp(2B)L).

Mathematical proof

1. Use the same actual program and its proved acceptance probability

The existing production theorem supplies p_s>=exp(-2B) for the actual acceptance event under the actual four-coordinate attempt law. Definitional equality aligns both definitions. Mapping the attempt to its N coordinate gives Poisson(2B); measurability follows from product coordinates and finite products on each discrete N stratum.

\[p_s=\Lambda_s(E_s)\ge e^{-2B},\qquad (N)_\#\Lambda_s=\operatorname{Poisson}(2B).\]

Corresponding Lean step

poisson_rejection_output; actual_attempt_count_law; measurable_accepted

2. Compare the stopped cost to a deterministic prefix on each path

If any attempt j<m succeeds, every charged term at index n>=m vanishes because the earlier-success predicate is false. Therefore C is at most S_m=sum_{n<m}N_n on this event. A large stopped cost thus requires either all m attempts to fail or a large fixed-prefix sum. This comparison uses no stopping-time/count independence.

\[\{C>t\}\subseteq\{\text{all }i<m\text{ fail}\}\cup\{S_m>t\},\qquad S_m=\sum_{i<m}N_i.\]

Corresponding Lean step

totalCost_le_prefix; cost_tail_subset

3. Integrate the actual Poisson exponential moment

First prove integrability of exp(N) using the convergent exponential series weighted by the Poisson mass. The true count law then gives E exp(N)=exp(2B(e-1)). The finite-coordinate pushforward of the iid stream is the finite product measure, so product integration gives E exp(S_m)=exp(2Bm(e-1)).

\[\mathbb E e^N=e^{2B(e-1)},\qquad\mathbb E e^{S_m}=e^{2Bm(e-1)}.\]

Corresponding Lean step

poisson_exponential_integrable; poisson_exponential_moment; fixed_prefix_exponential_moment

4. Apply exponential Markov to the fixed prefix

Exponentiation sends S_m>2Bm(e-1)+L into an event where exp(S_m) exceeds the corresponding positive threshold. Markov and the exact exponential moment cancel the Poisson contribution, leaving exp(-L). All conversions to extended nonnegative integrals have integrability or positivity witnesses.

\[\mathbb P(S_m>2Bm(e-1)+L)\le e^{-L}.\]

Corresponding Lean step

fixed_prefix_chernoff; fixed_prefix_chernoff_shift

5. Budget the probability of all preceding failures

The actual iid cylinder law gives failure probability (1-p_s)^m. For a=exp(-2B), the inequality 1-p_s<=exp(-a) follows from p_s>=a and 1-a<=exp(-a). The ceiling choice ensures a*m>=L. The failure term is therefore at most exp(-L). Probability finiteness is established before taking real parts.

\[(1-p_s)^m\le e^{-e^{-2B}m}\le e^{-L},\qquad e^{-2B}\lceil e^{2B}L\rceil\ge L.\]

Corresponding Lean step

failure_power_exponential_bound; poisson_tail_budget

6. Combine both events at the requested failure tolerance

The union bound gives at most 2exp(-L). With L=log(2/delta), this equals delta. The nonnegative total cost is left as its full infinite sum, so the bound covers all paths, including any never-success path; it is not a theorem only about attempt counts.

\[\mathbb P(C>2B(e-1)m+L)\le 2e^{-L}=\delta.\]

Corresponding Lean step

full_batch_cost_tail; full_batch_cost_tail_of_budget; delta_log_budget; full_batch_cost_delta_tail

7. Expose the single-log coefficient and its dependence on B

Because 0<delta<1, L>=log(2)>0. Thus m<=exp(2B)L+1<=(exp(2B)+1/log(2))L. The resulting larger threshold K(B)L has a smaller exceedance event. K depends on B: converting this to a universal terminal gradient-cost statement still needs a uniform B bound and the concrete per-estimator gradient cost.

\[m\le(e^{2B}+1/\log2)L,\qquad2B(e-1)m+L\le K(B)L.\]

Corresponding Lean step

ceil_threshold_le_single_log; measure_mono

Lean statement · poisson_query_tail

Two explicit high-probability bounds for the same actual full-batch Poisson rejection cost.

theorem poisson_query_tail {S X A : Type*}
    [MeasurableSpace S] [MeasurableSpace X] [MeasurableSpace A]
    (Q : Kernel S X) [IsMarkovKernel Q] (ν : Measure A) [IsProbabilityMeasure ν]
    (W : (S × X) × A → ℝ) (hW : Measurable W)
    (B : ℝ) (hB : 0 < B) (hb : ∀ s x z, |W ((s,x),z)| ≤ B) (x₀ : X)
    (s : S) (δ : ℝ) (hδ : 0 < δ) (hδ1 : δ < 1) :
    let Λ := attemptLaw (Q s) ν (⟨2 * B, by positivity⟩ : ℝ≥0)
    let E := accepted (fun p : X × A => W ((s,p.1),p.2)) B
    let ρ := Measure.infinitePi (fun _ : ℕ => Λ)
    let C := totalCost E (fun p => (p.2.1 : ℝ≥0∞))
    let L := Real.log (2 / δ)
    let m := ⌈Real.exp (2 * B) * L⌉₊
    ρ {ω | ENNReal.ofReal (2 * B * (Real.exp 1 - 1) * m + L) < C ω} ≤ ENNReal.ofReal δ ∧
    ρ {ω | ENNReal.ofReal
      ((2 * B * (Real.exp 1 - 1) * (Real.exp (2 * B) + 1 / Real.log 2) + 1) * L) < C ω}
        ≤ ENNReal.ofReal δ

Exact module and namespace context

Lean proof · poisson_query_tail

Actual parent acceptance bound, coordinate law, pathwise prefix truncation, Poisson exponential series, iid product moment, exponential Markov, failure budget and ceiling comparison.

theorem poisson_query_tail {S X A : Type*}
    [MeasurableSpace S] [MeasurableSpace X] [MeasurableSpace A]
    (Q : Kernel S X) [IsMarkovKernel Q] (ν : Measure A) [IsProbabilityMeasure ν]
    (W : (S × X) × A → ℝ) (hW : Measurable W)
    (B : ℝ) (hB : 0 < B) (hb : ∀ s x z, |W ((s,x),z)| ≤ B) (x₀ : X)
    (s : S) (δ : ℝ) (hδ : 0 < δ) (hδ1 : δ < 1) :
    let Λ := attemptLaw (Q s) ν (⟨2 * B, by positivity⟩ : ℝ≥0)
    let E := accepted (fun p : X × A => W ((s,p.1),p.2)) B
    let ρ := Measure.infinitePi (fun _ : ℕ => Λ)
    let C := totalCost E (fun p => (p.2.1 : ℝ≥0∞))
    let L := Real.log (2 / δ)
    let m := ⌈Real.exp (2 * B) * L⌉₊
    ρ {ω | ENNReal.ofReal (2 * B * (Real.exp 1 - 1) * m + L) < C ω} ≤ ENNReal.ofReal δ ∧
    ρ {ω | ENNReal.ofReal
      ((2 * B * (Real.exp 1 - 1) * (Real.exp (2 * B) + 1 / Real.log 2) + 1) * L) < C ω}
        ≤ ENNReal.ofReal δ := by
  dsimp only
  let r : ℝ≥0 := ⟨2 * B, by positivity⟩
  let Λ := attemptLaw (Q s) ν r
  let E := accepted (fun p : X × A => W ((s,p.1),p.2)) B
  have hE : MeasurableSet E := measurable_accepted _ (hW.comp (by fun_prop)) B
  have hlaw : Λ.map (fun p => p.2.1) = poissonMeasure r :=
    actual_attempt_count_law (Q s) ν r
  obtain ⟨R, hR, hs⟩ :=
    AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.PoissonRejection.poisson_rejection_output
      Q ν W hW B hB hb x₀
  obtain ⟨_, _, _, _, _, _, _, _, haccept, _, _⟩ := hs s
  change ENNReal.ofReal (Real.exp (-2 * B)) ≤ Λ E at haccept
  have ht := full_batch_cost_delta_tail Λ E hE
    (fun p => p.2.1) (by fun_prop) B hB hlaw haccept δ hδ hδ1
  refine ⟨ht, ?_⟩
  have hlog : Real.log 2 ≤ Real.log (2 / δ) := by
    apply Real.log_le_log (by norm_num)
    apply (le_div_iff₀ hδ).2
    linarith
  have hc := ceil_threshold_le_single_log B (Real.log (2 / δ)) hB.le hlog
  refine (measure_mono (fun ω hω => ?_)).trans ht
  exact lt_of_le_of_lt (ENNReal.ofReal_le_ofReal hc) hω


end AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.PoissonQueryTail

Exact module and namespace context

Source assumptions versus formal assumptions

Source	Actual Lean	Difference kind	Why it matters
The FORS rejection mechanism uses a proposal, Poisson batch and independent auxiliary draws.	Same four-coordinate attempt law and first-success full-batch cost as the existing production theorem; Markov parameter family and fixed auxiliary law are explicit.	generalization	The parameterized measurable presentation supports repeated source calls without substituting an abstract cost variable.
The bounded mechanism uses B>0 and estimator values in [-B,B].	One B>0 and jointly measurable W bounded everywhere by B for all parameters; no B>=1 assumption.	same	The tail proof retains arbitrarily small positive B.
The algorithm repeatedly draws whole Poisson batches until acceptance.	C sums every reached full batch, including success; its infinite-sum definition also covers never-success paths.	source-implicit	The proof uses a pathwise comparison and true iid-prefix law, never current count/acceptance independence.
SPHMC A.4(2) requires a single-log high-probability query bound with a universal constant in its stated regime.	For 0<delta<1, the exact ceiling threshold and explicit K(B)log(2/delta) tail are proved for estimator calls.	API-limitation	Uniform B and concrete per-estimator gradient cost remain necessary source adapters; this is a prerequisite rather than A.4 completion.
External arXiv:2608.05022v1 Theorem2.3 prints 3B exp(2B) log(2/delta) for unrestricted B>0.	The new supporting bound is 2B(e-1)ceil(exp(2B)L)+L, and K(B)L, where L=log(2/delta).	unresolved	The independent small-B audit identified a possible-source-error in the printed threshold. This separate valid derivation neither asserts that formula nor silently edits or formally repairs it.
The complete terminal routine includes clipping, target approximation, reference construction and query accounting.	Those remaining obligations and both paper main results are not claimed. A default x0 is supplied solely for the existing actual-output theorem.	API-limitation	The cost bound is about the actual bounded rejection program and is independent of x0; no TV-to-unbounded-cost transfer occurs.

Counts full-batch estimator evaluations, including the successful batch, not automatically gradient queries or wall-clock time. A universal terminal-state constant requires uniform control of B and a separate cost account for each estimator call and other work. Actual clipped gradient estimators, target log-weight identification, Renyi error, reference points and initialization remain separate. This independently derived supporting inequality does not assert or silently repair the unrestricted printed 3B exp(2B) log(2/delta) threshold in external Theorem 2.3.

Encoder–denoiser: accepted · domain-mismatch

Detected semantic differences

domains: Explicit measurable parameter-family generalization. — Independent reviewer accepted publication delta 1.
assumptions: Fixed B>0 and everywhere bounded W, including small B. — Independent reviewer accepted publication delta 2.
objects: Cost includes successful full batch and all never-success paths. — Independent reviewer accepted publication delta 3.
constant_dependencies: K(B) is not automatically a universal gradient-cost constant. — Independent reviewer accepted publication delta 4.
conclusion: New thresholds do not silently repair the external possible-source-error. — Independent reviewer accepted publication delta 5.
scopes: Clipping, target, Renyi, initialization and gradient accounting remain separate. — Independent reviewer accepted publication delta 6.

A generalization is not a source correction. Proposed missing conditions require separate independent repair review. No proposed repair silently changes the original theorem.

Scope and omitted-condition boundaries

Counts full-batch estimator evaluations, including the successful batch, not automatically gradient queries or wall-clock time. A universal terminal-state constant requires uniform control of B and a separate cost account for each estimator call and other work. Actual clipped gradient estimators, target log-weight identification, Renyi error, reference points and initialization remain separate. This independently derived supporting inequality does not assert or silently repair the unrestricted printed 3B exp(2B) log(2/delta) threshold in external Theorem 2.3.

Source and reuse

ASTIS parents called

AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.PoissonRejection.poisson_rejection_output

Mathlib API called (external library)

MeasureTheory.Measure.infinitePi
ProbabilityTheory.poissonMeasure
MeasureTheory.meas_ge_le_lintegral_div
MeasureTheory.integral_fintype_prod_eq_pow
Nat.le_ceil
Nat.ceil_lt_add_one

Mathematical sources

SPHMC v1 Appendix A.1 and Theorem A.4(2) — Bounded rejection mechanism and the terminal routine consumer requiring a single-log cost tail; the present supporting bound is an independent ASTIS derivation.
Poisson rejection Algorithm 1 and Theorem 2.3 — Actual full Poisson batches. The unrestricted printed tail formula is not asserted here; its small-B discrepancy remains explicit.

ASTIS prose is not a quotation or a source-equivalence certificate. Definitions and aliases are explained as constructions, not counted as new mathematical proofs.

Which proof edges are actually covered?

TODO — not closed by these contributions Actual bounded Poisson estimator-count tail needed before terminal gradient-cost accounting

Actual bounded Poisson rejection output and full-batch cost

Fan Chen, Sinho Chewi, Jianfeng Lu and Matthew S. Zhang; ASTIS expanded bounded mechanism with explicit parameterization, default output and full-batch cost proof. No author endorsement implied.

arXiv:2609.06906v1 · Appendix A.1 Lemma A.2; bounded Poisson rejection mechanism and explicit actual retry costs · faithful paraphrase

Complete source statement (ASTIS restatement)

Let Q be a Markov proposal kernel from a measurable parameter space S to a measurable space X, let nu be a fixed probability measure on auxiliary space A, and let W((s,x),z) be jointly measurable with |W|<=B for a fixed B>0. Fix a default x0. An attempt independently draws x from Q(s), N from Poisson(2B), an infinite iid nu sequence z, and U uniform on [0,1], and accepts when U is at most the product over i<N of (B+W((s,x),z_i))/(2B). Let Lambda_s be this actual product law, E_s its acceptance event, and p_s=Lambda_s(E_s). On an iid sequence of whole attempts, return the proposal at the first success, using x0 only on never-success, and charge N for every attempt whose predecessors all failed. There is a measurable Markov kernel R whose fiber is both the actual output law and Q(s) exponentially tilted by w(s,x)=integral W((s,x),z) nu(dz). Conditional acceptance is exp(w-B), the projected accepted submeasure is exp(w-B)Q(s), and p_s is its total mass with p_s>=exp(-2B). Never-success has measure zero; the first n attempts all fail with probability (1-p_s)^n. The expected total full-batch charge equals 2B/p_s and is at most 2B exp(2B).

S, X and A are arbitrary measurable spaces; Q:S->X is a Markov kernel.
nu is a fixed probability measure on A, and B is a fixed real number with B>0.
W:((S times X) times A)->Real is jointly measurable and satisfies |W((s,x),z)|<=B for every s,x,z.
A fixed x0 in X defines the output on the never-success event.
Each attempt draws independently from the displayed proposal/Poisson/infinite auxiliary/uniform product. Each retry is an independent whole attempt. Cost is the full N estimator calls for every attempt reached.

Actual bounded rejection output and full-batch cost

\[R(s)=Q(s)^{w(s,\cdot)}=\mathcal L(\mathrm{out}_s),\quad p_s=\int e^{w(s,x)-B}Q(s)(dx)\ge e^{-2B},\quad\mathbb E C_s=\frac{2B}{p_s}\le2B e^{2B}.\]

Read the formalized proofs

Each statement and proof below has its own closed Lean disclosure. ASTIS parents, Mathlib calls and external mathematical sources are distinguished in each proof.

ASTIS mathematical exposition

Actual bounded Poisson rejection output and full-batch cost

AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.PoissonRejection.poisson_rejection_output · theorem · Teaching coverage

Statement

\[R(s)=Q(s)^{w(s,\cdot)}=\mathcal L(\mathrm{out}_s),\quad p_s=\int e^{w(s,x)-B}Q(s)(dx)\ge e^{-2B},\quad\mathbb E C_s=\frac{2B}{p_s}\le2B e^{2B}.\]

All objects and hypotheses

S, X and A are arbitrary measurable spaces; Q:S->X is a Markov kernel.
nu is a fixed probability measure on A, and B is a fixed real number with B>0.
W:((S times X) times A)->Real is jointly measurable and satisfies |W((s,x),z)|<=B for every s,x,z.
A fixed x0 in X defines the output on the never-success event.
Each attempt draws independently from the displayed proposal/Poisson/infinite auxiliary/uniform product. Each retry is an independent whole attempt. Cost is the full N estimator calls for every attempt reached.

Mathematical proof

1. Build the actual independent attempt

Use the product of the proposal law, Poisson law, auxiliary infinite product and unit-interval Lebesgue restriction. Infinite-product finite-coordinate pushforward identifies the first N auxiliary draws with the finite product law. Variable N is measurable by countable discrete stratification. The empty product at N=0 is one, so that branch accepts and makes zero estimator calls.

\[\Lambda_s=Q(s)\otimes\operatorname{Poisson}(2B)\otimes\nu^{\mathbb N}\otimes\operatorname{Unif}[0,1].\]

Corresponding Lean step

attemptLaw; iid_prefix_law; measurable_accepted

2. Compute conditional acceptance from the event

Every factor lies in [0,1], so integrating the actual event U<=product gives the product itself. Finite product integration gives t^n, where t=(B+w)/(2B). The Poisson generating series then gives exp(2B(t-1))=exp(w-B). Bounded measurability supplies the integrability needed for the real-to-nonnegative-integral conversions.

\[\mathbb P(E_s\mid x)=\sum_{n\ge0}\mathbb P(N=n)\left(\frac{B+w(s,x)}{2B}\right)^n=e^{w(s,x)-B}.\]

Corresponding Lean step

finite_uniform_acceptance; poisson_power_integral; actual_poisson_acceptance

3. Identify the accepted submeasure and its mass

For every measurable proposal event, restrict the whole attempt law to acceptance and project to the proposal. Fubini and conditional acceptance give the exact weighted submeasure. Since -B<=w<=B, its density lies between exp(-2B) and one. Thus its mass p is strictly positive and finite; positivity is derived, not assumed.

\[(\pi_X)_*(\Lambda_s|_{E_s})=e^{w(s,\cdot)-B}Q(s),\qquad e^{-2B}\le p_s=\int e^{w(s,x)-B}Q(s)(dx)\le1.\]

Corresponding Lean step

actual_accepted_proposal; bounded_estimator_mean; bounded_acceptance_mass; ha; hp

4. Prove real retries terminate and normalize the output

A failure prefix followed by an attempt in any measurable set F is an actual finite cylinder, with mass q^n Lambda(F), q=1-p. Taking F inside acceptance gives disjoint first-success events. Never-success is contained in every failure prefix and has mass zero because q^n tends to zero. The total firstOutput is measurable using measurable existence, Nat.find, and its explicit default branch. Summing the first-success events gives the normalized accepted proposal law.

\[\mathbb P(\text{first }n\text{ fail})=(1-p_s)^n,\qquad\mathcal L(\mathrm{out}_s)=p_s^{-1}(\pi_X)_*(\Lambda_s|_{E_s}).\]

Corresponding Lean step

first_hit_submeasure; never_hit_null; measurable_firstOutput; firstOutput_law

5. Construct a common Markov kernel and identify the target

Parameter integration makes w jointly measurable, and kernel integration makes p measurable. Construct Q.withDensity with the actual normalized density and verify unit mass in every fiber. This is a common measurable kernel, not merely separate fiberwise existence. Boundedness establishes exponential integrability, allowing the constant exp(-B) to cancel in the real normalization and identify the result with Q(s).tilted(w).

\[R(s,dx)=\frac{e^{w(s,x)-B}}{p_s}Q(s)(dx)=\frac{e^{w(s,x)}}{\int e^{w(s,y)}Q(s)(dy)}Q(s)(dx).\]

Corresponding Lean step

normalized_density_kernel; bounded_estimator_output_kernel; normalized_exp_tilt; hReq

6. Charge every full attempt, including the successful one

Define total charge as the sum of N_n multiplied by the indicator that all earlier attempts failed. The current count may correlate with current acceptance. The finite-cylinder identity instead gives the current attempt law restricted only by preceding failure as q^n Lambda. Tonelli therefore yields E C=(sum q^n) E N. The actual Poisson expectation is proved from its mass series, including rate zero, and product integration gives E N=2B for the full attempt law.

\[C=\sum_{n\ge0}\mathbf1_{\{\text{attempts }i<n\text{ fail}\}}N_n,\qquad\mathbb E C=\frac{\mathbb E N}{p_s}=\frac{2B}{p_s}.\]

Corresponding Lean step

surviving_current_law; totalCost; expected_totalCost; poisson_nat_mean; attempt_count_mean

7. Derive the explicit finite expected cost

Invert the proved positive acceptance lower bound and multiply by the nonnegative per-attempt mean. This is a direct expectation calculation for the actual attempt stream and does not transfer unbounded costs through a distributional approximation.

\[\mathbb E C=2B/p_s\le2B e^{2B}.\]

Corresponding Lean step

hbound; hcost; ENNReal.inv_le_inv

Lean statement · poisson_rejection_output

Actual bounded Poisson rejection output, conditional and accepted laws, stopping, parameterized Markov kernel and full-batch expected cost.

theorem poisson_rejection_output {S X A : Type*}
    [MeasurableSpace S] [MeasurableSpace X] [MeasurableSpace A]
    (Q : Kernel S X) [IsMarkovKernel Q] (ν : Measure A) [IsProbabilityMeasure ν]
    (W : (S × X) × A → ℝ) (hW : Measurable W)
    (B : ℝ) (hB : 0 < B) (hb : ∀ s x z, |W ((s,x),z)| ≤ B) (x₀ : X) :
    let Λ := fun s => attemptLaw (Q s) ν (⟨2 * B, by positivity⟩ : ℝ≥0)
    let E := fun s => accepted (fun p : X × A => W ((s,p.1),p.2)) B
    let ρ := fun s => Measure.infinitePi (fun _ : ℕ => Λ s)
    let out := fun s => firstOutput (E s) Prod.fst x₀
    ∃ R : Kernel S X, IsMarkovKernel R ∧ ∀ s,
      Measurable (out s) ∧ (ρ s).map (out s) = R s ∧
      R s = (Q s).tilted (fun x => ∫ z, W ((s,x),z) ∂ν) ∧
      (∀ x, ((poissonMeasure (⟨2 * B, by positivity⟩ : ℝ≥0)).prod
        ((Measure.infinitePi (fun _ : ℕ => ν)).prod unitUniform))
        {p : ℕ × ((ℕ → A) × ℝ) |
          p.2.2 ≤ ∏ i : Fin p.1, (B + W ((s,x),p.2.1 i.val)) / (2 * B)} =
        ENNReal.ofReal (Real.exp ((∫ z, W ((s,x),z) ∂ν) - B))) ∧
      ((Λ s).restrict (E s)).map Prod.fst = (Q s).withDensity
        (fun x => ENNReal.ofReal (Real.exp ((∫ z, W ((s,x),z) ∂ν) - B))) ∧
      Λ s (E s) = (∫⁻ x, ENNReal.ofReal (Real.exp ((∫ z, W ((s,x),z) ∂ν) - B)) ∂Q s) ∧
      ρ s {ω | ∀ n, ω n ∉ E s} = 0 ∧
      (∀ n, ρ s {ω | ∀ i < n, ω i ∉ E s} = (1 - Λ s (E s))^n) ∧
      ENNReal.ofReal (Real.exp (-2 * B)) ≤ Λ s (E s) ∧
      (∫⁻ ω, totalCost (E s) (fun p => (p.2.1 : ℝ≥0∞)) ω ∂ρ s) =
        (Λ s (E s))⁻¹ * ENNReal.ofReal (2 * B) ∧
      (∫⁻ ω, totalCost (E s) (fun p => (p.2.1 : ℝ≥0∞)) ω ∂ρ s) ≤
        ENNReal.ofReal (2 * B * Real.exp (2 * B))

Exact module and namespace context

Lean proof · poisson_rejection_output

Actual product attempts; finite-prefix and uniform acceptance integration; Poisson generating series; first-hit cylinders and countable output decomposition; normalized density kernel; actual nonnegative accumulated cost.

theorem poisson_rejection_output {S X A : Type*}
    [MeasurableSpace S] [MeasurableSpace X] [MeasurableSpace A]
    (Q : Kernel S X) [IsMarkovKernel Q] (ν : Measure A) [IsProbabilityMeasure ν]
    (W : (S × X) × A → ℝ) (hW : Measurable W)
    (B : ℝ) (hB : 0 < B) (hb : ∀ s x z, |W ((s,x),z)| ≤ B) (x₀ : X) :
    let Λ := fun s => attemptLaw (Q s) ν (⟨2 * B, by positivity⟩ : ℝ≥0)
    let E := fun s => accepted (fun p : X × A => W ((s,p.1),p.2)) B
    let ρ := fun s => Measure.infinitePi (fun _ : ℕ => Λ s)
    let out := fun s => firstOutput (E s) Prod.fst x₀
    ∃ R : Kernel S X, IsMarkovKernel R ∧ ∀ s,
      Measurable (out s) ∧ (ρ s).map (out s) = R s ∧
      R s = (Q s).tilted (fun x => ∫ z, W ((s,x),z) ∂ν) ∧
      (∀ x, ((poissonMeasure (⟨2 * B, by positivity⟩ : ℝ≥0)).prod
        ((Measure.infinitePi (fun _ : ℕ => ν)).prod unitUniform))
        {p : ℕ × ((ℕ → A) × ℝ) |
          p.2.2 ≤ ∏ i : Fin p.1, (B + W ((s,x),p.2.1 i.val)) / (2 * B)} =
        ENNReal.ofReal (Real.exp ((∫ z, W ((s,x),z) ∂ν) - B))) ∧
      ((Λ s).restrict (E s)).map Prod.fst = (Q s).withDensity
        (fun x => ENNReal.ofReal (Real.exp ((∫ z, W ((s,x),z) ∂ν) - B))) ∧
      Λ s (E s) = (∫⁻ x, ENNReal.ofReal (Real.exp ((∫ z, W ((s,x),z) ∂ν) - B)) ∂Q s) ∧
      ρ s {ω | ∀ n, ω n ∉ E s} = 0 ∧
      (∀ n, ρ s {ω | ∀ i < n, ω i ∉ E s} = (1 - Λ s (E s))^n) ∧
      ENNReal.ofReal (Real.exp (-2 * B)) ≤ Λ s (E s) ∧
      (∫⁻ ω, totalCost (E s) (fun p => (p.2.1 : ℝ≥0∞)) ω ∂ρ s) =
        (Λ s (E s))⁻¹ * ENNReal.ofReal (2 * B) ∧
      (∫⁻ ω, totalCost (E s) (fun p => (p.2.1 : ℝ≥0∞)) ω ∂ρ s) ≤
        ENNReal.ofReal (2 * B * Real.exp (2 * B)) := by
  dsimp only
  let r : ℝ≥0 := ⟨2 * B, by positivity⟩
  let Λ := fun s => attemptLaw (Q s) ν r
  let E := fun s => accepted (fun p : X × A => W ((s,p.1),p.2)) B
  obtain ⟨R, hR, hReq⟩ := bounded_estimator_output_kernel Q ν W hW B hb
  refine ⟨R, hR, ?_⟩
  intro s
  have hWs : Measurable (fun p : X × A => W ((s,p.1),p.2)) := hW.comp (by fun_prop)
  have hE : MeasurableSet (E s) := measurable_accepted _ hWs B
  have ha := actual_accepted_proposal (Q s) ν _ hWs B hB (hb s)
  change ((Λ s).restrict (E s)).map Prod.fst =
    (Q s).withDensity (fun x => ENNReal.ofReal (Real.exp ((∫ z, W ((s,x),z) ∂ν) - B))) at ha
  have hp : Λ s (E s) =
      ∫⁻ x, ENNReal.ofReal (Real.exp ((∫ z, W ((s,x),z) ∂ν) - B)) ∂Q s := by
    have ht := congrArg (fun μ : Measure X => μ Set.univ) ha
    simpa [Measure.map_apply measurable_fst MeasurableSet.univ,
      withDensity_apply, Λ, E, attemptLaw, accepted, r] using ht
  have hbound := bounded_acceptance_mass (Q s)
    (fun x => ∫ z, W ((s,x),z) ∂ν) B (fun x =>
      (bounded_estimator_mean ν _ (hW.comp (by fun_prop)) B (hb s x)).2)
  have hpos : 0 < Λ s (E s) := by
    rw [hp]
    exact lt_of_lt_of_le (ENNReal.ofReal_pos.mpr (Real.exp_pos _)) hbound.1
  have hcost : (∫⁻ ω, totalCost (E s)
      (fun p => (p.2.1 : ℝ≥0∞)) ω ∂Measure.infinitePi (fun _ : ℕ => Λ s)) =
      (Λ s (E s))⁻¹ * ENNReal.ofReal (2 * B) := by
    rw [expected_totalCost (Λ s) (E s) hE _ (by fun_prop),
      attempt_count_mean]
    congr 1
    exact (ENNReal.ofReal_coe_nnreal (p := r)).symm
  refine ⟨measurable_firstOutput _ hE _ measurable_fst x₀, ?_, ?_, ?_, ha, hp,
    never_hit_null (Λ s) (E s) hE hpos, ?_, ?_, hcost, ?_⟩
  · rw [firstOutput_law (Λ s) (E s) hE hpos _ measurable_fst x₀,
      ha, hp, hReq s]
  · rw [hReq s]
    apply normalized_exp_tilt
    · exact hWs.stronglyMeasurable.integral_prod_right'.measurable
    · intro x
      exact (bounded_estimator_mean ν _
        (hW.comp (by fun_prop)) B (hb s x)).2.2
  · intro x
    exact actual_poisson_acceptance ν _ (hW.comp (by fun_prop)) B hB (hb s x)
  · intro n
    rw [failure_prefix_probability (Λ s) (E s) hE n,
      prob_compl_eq_one_sub hE]
  · rw [hp]
    exact hbound.1
  · rw [hcost]
    calc
      _ ≤ (ENNReal.ofReal (Real.exp (-2 * B)))⁻¹ * ENNReal.ofReal (2 * B) :=
        mul_le_mul' (ENNReal.inv_le_inv.mpr (by rw [hp]; exact hbound.1)) le_rfl
      _ = _ := by
        rw [← ENNReal.ofReal_inv_of_pos (Real.exp_pos _),
          ← ENNReal.ofReal_mul (by positivity), ← Real.exp_neg]
        congr 1
        ring_nf

end AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.PoissonRejection

Exact module and namespace context

Source assumptions versus formal assumptions

Source	Actual Lean	Difference kind	Why it matters
The bounded mechanism is stated for a proposal distribution and auxiliary estimator.	A measurable Markov family Q(s) and jointly measurable W((s,x),z), on arbitrary measurable spaces with fixed auxiliary probability law.	generalization	A common parameterized output kernel is proved; parameterization is not attributed as an additional explicit statement of Lemma A.2.
B>0 bounds every estimator realization between -B and B.	Fixed B>0 and \|W\|<=B everywhere.	same	These hypotheses establish factor probabilities and uniform positive acceptance; no clipping step is silently substituted.
Poisson(2B) independent auxiliary samples and a product acceptance probability.	Actual independent proposal, Poisson count, infinite iid auxiliary law, and unit-interval uniform law; only the first N auxiliary coordinates are read.	same	Finite-prefix pushforward and uniform acceptance integration prove the correspondence, including N=0.
Repeat attempts until acceptance.	Actual iid whole-attempt stream and measurable total first-success output with default x0; never-success has measure zero and failure prefixes have probability (1-p)^n.	mathematically-necessary	Explicit default makes a total function; a proved null event removes its effect on the output distribution.
Output density is proportional to exp(mean W) relative to Q, with acceptance at least exp(-2B).	Conditional acceptance, accepted submeasure, exact p and lower bound are public, and the actual output law equals Q.tilted(mean W).	same	Exponential integrability and positive normalization are proved, including the common measurable Markov kernel.
The mechanism repeatedly draws a full Poisson batch of estimators.	Expected full-batch estimator-call count, including the successful batch, equals 2B/p and is at most 2B exp(2B).	source-implicit	The exact expectation is an expanded proof from the actual experiment, not a gradient-cost or shortcircuit-cost claim. Current N is not assumed independent of current acceptance.
Full FORS accuracy and the paper main results require concrete clipped gradient estimators and target/error/initialization conditions.	Those subsequent estimator, clipping, target-identification, Renyi, initialization and gradient-cost obligations are not claimed by this bounded mechanism.	API-limitation	The result is a concrete prerequisite for FORS, not completion of the terminal sampler or either paper main theorem.

Fixed B>0 and a fixed auxiliary probability law are explicit. W is jointly measurable and bounded everywhere by B. Cost counts full-batch auxiliary estimator calls, including the successful attempt; it is not automatically a gradient-query cost or the cost of an early-shortcircuit implementation. No clipping theorem, gradient-arc estimator, target log-weight identification, Renyi accuracy, initialization or complete FORS guarantee is established. The common output kernel is measurable in s and each output function is measurable in its attempt stream; joint measurability of the entire parameterized random-stream construction is not an additional public conclusion.

Encoder–denoiser: accepted · domain-mismatch

Detected semantic differences

domains: Common measurable Markov family extends the fixed-proposal presentation; fixed auxiliary representation explicit. — Independent reviewer accepted corresponding publication delta 1.
assumptions: Fixed positive B and everywhere bounded W preserve the mechanism. — Independent reviewer accepted corresponding publication delta 2.
objects: Infinite iid randomness supplies exactly the finite auxiliary prefix. — Independent reviewer accepted corresponding publication delta 3.
quantifiers: Explicit default totalizes output on a proved null event. — Independent reviewer accepted corresponding publication delta 4.
conclusion: All conditional, accepted, mass and output identities are exported. — Independent reviewer accepted corresponding publication delta 5.
constant_dependencies: Expected full-batch cost is derived, not a short-circuit or gradient theorem. — Independent reviewer accepted corresponding publication delta 6.
scopes: Concrete FORS estimator, clipping, target, accuracy and gradient-cost consumers remain separate. — Independent reviewer accepted corresponding publication delta 7.

A generalization is not a source correction. Proposed missing conditions require separate independent repair review. No proposed repair silently changes the original theorem.

Scope and omitted-condition boundaries

Fixed B>0 and a fixed auxiliary probability law are explicit. W is jointly measurable and bounded everywhere by B. Cost counts full-batch auxiliary estimator calls, including the successful attempt; it is not automatically a gradient-query cost or the cost of an early-shortcircuit implementation. No clipping theorem, gradient-arc estimator, target log-weight identification, Renyi accuracy, initialization or complete FORS guarantee is established. The common output kernel is measurable in s and each output function is measurable in its attempt stream; joint measurability of the entire parameterized random-stream construction is not an additional public conclusion.

Source and reuse

ASTIS parents called

Mathlib API called (external library)

MeasureTheory.Measure.infinitePi
MeasureTheory.Measure.map_infinitePi_infinitePi_of_inj
ProbabilityTheory.poissonMeasure
ProbabilityTheory.integral_poissonMeasure
MeasureTheory.integral_fintype_prod_eq_pow
ProbabilityTheory.Kernel.withDensity
MeasureTheory.Measure.tilted
MeasureTheory.lintegral_tsum

Mathematical sources

SPHMC v1 Appendix A.1, Lemma A.2 — The bounded Poisson acceptance mechanism underlying FORS.
Poisson rejection mechanism, Algorithm 1 — Independent auxiliary draws and repeated acceptance; the present theorem assumes already bounded W.

ASTIS prose is not a quotation or a source-equivalence certificate. Definitions and aliases are explained as constructions, not counted as new mathematical proofs.

Which proof edges are actually covered?

TODO — not closed by these contributions Concrete bounded Poisson acceptance, actual retry output kernel and estimator-call expectation

Actual proximal estimator: stability in both inputs

Samplinglib exposition of Fan Chen, Sinho Chewi, Jianfeng Lu and Matthew S. Zhang's input-stability estimates; an explicitly restricted constructed-oracle proof component, not the full lemma.

arXiv:2609.06906v1 · Lemma 4.2 equations (4.4)-(4.5); definition (3.2), normalized C2/Hessian setting (1.1) · faithful paraphrase

Complete source statement (ASTIS restatement)

There exists a measurable map p:E→E with p(y)+eta∇V(p(y))=y. For every y,z it satisfies F_y(p(y))+((kappa^-1+eta^-1)/2)||z-p(y)||² <= F_y(z), and F_y(z)<=F_y(p(y)) iff z=p(y). The map p is 1-Lipschitz. For the actual estimator ĝ_eta(y;G)=∇V(p(y)+sqrt(eta)G), the position-input difference is at most ||y-y'|| and the noise-input difference is at most sqrt(eta)||G-G'||.

E is a finite-dimensional complete real inner-product space with its Borel sigma algebra; dimension zero is allowed.
V:E→R is genuinely twice continuously Frechet differentiable; kappa is a nonnegative real with kappa>=1. For every x,v, kappa^-1 ||v||^2 <= D²V(x)[v,v] <= ||v||^2 (normalized beta=1).
Fix 0<eta<=1/2. Set F_y(x)=V(x)+||x-y||²/(2 eta). All y,y',G,G' are arbitrary deterministic vectors. No Gaussian-law or integrability hypothesis is used for these pointwise inequalities.

Pointwise input stability

\[\widehat g_\eta(y;G)=\nabla V(p(y)+\sqrt\eta G),\quad\|\widehat g_\eta(y;G)-\widehat g_\eta(y';G)\|\le\|y-y'\|,\quad\|\widehat g_\eta(y;G)-\widehat g_\eta(y;G')\|\le\sqrt\eta\|G-G'\|.\]

Read the formalized proofs

Each statement and proof below has its own closed Lean disclosure. ASTIS parents, Mathlib calls and external mathematical sources are distinguished in each proof.

ASTIS mathematical exposition

Actual proximal estimator: stability in both inputs

AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.ProximalEstimatorLipschitz.proximal_estimator_lipschitz · theorem · Teaching coverage

Statement

\[\widehat g_\eta(y;G)=\nabla V(p(y)+\sqrt\eta G),\quad\|\widehat g_\eta(y;G)-\widehat g_\eta(y';G)\|\le\|y-y'\|,\quad\|\widehat g_\eta(y;G)-\widehat g_\eta(y;G')\|\le\sqrt\eta\|G-G'\|.\]

All objects and hypotheses

E is a finite-dimensional complete real inner-product space with its Borel sigma algebra; dimension zero is allowed.
V:E→R is genuinely twice continuously Frechet differentiable; kappa is a nonnegative real with kappa>=1. For every x,v, kappa^-1 ||v||^2 <= D²V(x)[v,v] <= ||v||^2 (normalized beta=1).
Fix 0<eta<=1/2. Set F_y(x)=V(x)+||x-y||²/(2 eta). All y,y',G,G' are arbitrary deterministic vectors. No Gaussian-law or integrability hypothesis is used for these pointwise inequalities.

Mathematical proof

1. Construct the same exact proximal oracle

Specialize the existing parameterized theorem to identity centers and constant eta. Retain the actual optimality equation, measurability and quantitative unique-minimum certificate; do not choose a new arbitrary function called a proximal map. The parent constructs it as a limit of contracting iterations. Its Gaussian moments are not new results here.

\[p(y)+\eta\nabla V(p(y))=y,\qquad F_y(z)\ge F_y(p(y))+\tfrac{\kappa^{-1}+\eta^{-1}}2\|z-p(y)\|^2.\]

Corresponding Lean step

obtain p,hp,heq,hmin from ProximalGaussianEstimator.proximal_gaussian_estimator

2. Turn genuine Hessian bounds into gradient controls

Apply the existing quadratic-regularization result with zero added precision. This produces strong convexity and 1-Lipschitz gradient from the actual C2 Hessian. Apply the existing two-point first-order bound to this genuine gradient. Its nonnegative lower bound gives monotonicity.

\[\|\nabla V(a)-\nabla V(b)\|\le\|a-b\|,\qquad\langle\nabla V(a)-\nabla V(b),a-b\rangle\ge\kappa^{-1}\|a-b\|^2\ge0.\]

Corresponding Lean step

hH',hreg,hLip,hsc,hmono; DifferentiableAt.hasGradientAt

3. Subtract optimality and pair with the displacement

Let d=p(y)-p(y') and e=∇V(p(y))-∇V(p(y')). Subtract the actual equations. Pair with d. Nonnegative eta and gradient monotonicity make the added term nonnegative. This is the substantive new resolvent step, not a supplied nonexpansiveness assumption.

\[y-y'=d+\eta e,\qquad\langle y-y',d\rangle=\|d\|^2+\eta\langle e,d\rangle\ge\|d\|^2.\]

Corresponding Lean step

private nonexpansive_of_monotone_optimality: hsub,hpair

4. Apply Cauchy-Schwarz and cancel only when permitted

Cauchy-Schwarz bounds the pairing by ||y-y'|| ||d||. If d=0 the required inequality is immediate. Otherwise ||d||>0 and cancellation gives the result. This step covers zero-dimensional spaces too. The private argument only needs eta>=0; the public construction has a narrower range.

\[\|d\|^2\le\|y-y'\|\|d\|\quad\Longrightarrow\quad\|p(y)-p(y')\|\le\|y-y'\|.\]

Corresponding Lean step

hbound,hzero,hpos; LipschitzWith.of_dist_le_mul; hpLip

5. Hold the noise fixed and compare centers

Use the 1-Lipschitz genuine gradient. The common translated noise cancels from its two arguments; then apply nonexpansiveness of p. Every G is allowed, so this pathwise inequality can later be used under shared random noise.

\[\|\widehat g_\eta(y;G)-\widehat g_\eta(y';G)\|\le\|(p(y)+\sqrt\eta G)-(p(y')+\sqrt\eta G)\|=\|p(y)-p(y')\|\le\|y-y'\|.\]

Corresponding Lean step

first final branch: hLip.dist_le_mul,hpLip.dist_le_mul,add_sub_add_right_eq_sub

6. Hold the center fixed and compare noise inputs

Again apply the gradient Lipschitz bound. The common proximal point cancels, scalar multiplication distributes over subtraction, and sqrt(eta) is nonnegative. No expectation, Gaussian concentration, integrability or smoothed-score identity is needed or established.

\[\|\widehat g_\eta(y;G)-\widehat g_\eta(y;G')\|\le\|\sqrt\eta(G-G')\|=\sqrt\eta\|G-G'\|.\]

Corresponding Lean step

second final branch: hLip.dist_le_mul,smul_sub,norm_smul,Real.sqrt_nonneg

Lean statement · proximal_estimator_lipschitz

The code below supplies the full constructed map, exact optimality/minimum certificate, and both pointwise bounds with all typeclasses explicit.

theorem proximal_estimator_lipschitz
    {E : Type*} [NormedAddCommGroup E] [InnerProductSpace ℝ E]
    [CompleteSpace E] [FiniteDimensional ℝ E] [MeasurableSpace E] [BorelSpace E]
    {V : E → ℝ} {κ : ℝ≥0} (hκ : 1 ≤ κ) (hV : ContDiff ℝ 2 V)
    (hH : ∀ x v : E, (κ : ℝ)⁻¹ * ‖v‖ ^ 2 ≤ (fderiv ℝ (fderiv ℝ V) x v) v ∧
      (fderiv ℝ (fderiv ℝ V) x v) v ≤ ‖v‖ ^ 2)
    {eta : ℝ} (hpos : 0 < eta) (hsmall : eta ≤ 1 / 2) :
    let F := fun y x => V x + eta⁻¹ / 2 * ‖x - y‖ ^ 2
    ∃ p : E → E, Measurable p ∧
      (∀ y, p y + eta • gradient V (p y) = y) ∧
      (∀ y z, F y (p y) + ((κ : ℝ)⁻¹ + eta⁻¹) / 2 * ‖z - p y‖ ^ 2 ≤ F y z ∧
        (F y z ≤ F y (p y) ↔ z = p y)) ∧
      LipschitzWith 1 p ∧
      (∀ y y' G, ‖gradient V (p y + Real.sqrt eta • G) -
        gradient V (p y' + Real.sqrt eta • G)‖ ≤ ‖y - y'‖) ∧
      (∀ y G G', ‖gradient V (p y + Real.sqrt eta • G) -
        gradient V (p y + Real.sqrt eta • G')‖ ≤ Real.sqrt eta * ‖G - G'‖)

Exact module and namespace context

Lean proof · proximal_estimator_lipschitz

Existing proximal construction and genuine Hessian APIs; monotone optimality pairing; Cauchy-Schwarz with a zero case; two translation and scalar norm estimates.

theorem proximal_estimator_lipschitz
    {E : Type*} [NormedAddCommGroup E] [InnerProductSpace ℝ E]
    [CompleteSpace E] [FiniteDimensional ℝ E] [MeasurableSpace E] [BorelSpace E]
    {V : E → ℝ} {κ : ℝ≥0} (hκ : 1 ≤ κ) (hV : ContDiff ℝ 2 V)
    (hH : ∀ x v : E, (κ : ℝ)⁻¹ * ‖v‖ ^ 2 ≤ (fderiv ℝ (fderiv ℝ V) x v) v ∧
      (fderiv ℝ (fderiv ℝ V) x v) v ≤ ‖v‖ ^ 2)
    {eta : ℝ} (hpos : 0 < eta) (hsmall : eta ≤ 1 / 2) :
    let F := fun y x => V x + eta⁻¹ / 2 * ‖x - y‖ ^ 2
    ∃ p : E → E, Measurable p ∧
      (∀ y, p y + eta • gradient V (p y) = y) ∧
      (∀ y z, F y (p y) + ((κ : ℝ)⁻¹ + eta⁻¹) / 2 * ‖z - p y‖ ^ 2 ≤ F y z ∧
        (F y z ≤ F y (p y) ↔ z = p y)) ∧
      LipschitzWith 1 p ∧
      (∀ y y' G, ‖gradient V (p y + Real.sqrt eta • G) -
        gradient V (p y' + Real.sqrt eta • G)‖ ≤ ‖y - y'‖) ∧
      (∀ y G G', ‖gradient V (p y + Real.sqrt eta • G) -
        gradient V (p y + Real.sqrt eta • G')‖ ≤ Real.sqrt eta * ‖G - G'‖) := by
  obtain ⟨p, hp, heq, hmin, _⟩ :=
    ProximalGaussianEstimator.proximal_gaussian_estimator hκ hV hH
      (eta := fun _ : E => eta) (y := id) measurable_const measurable_id
      (fun _ => hpos) (fun _ => hsmall)
  have hH' : ∀ x v : E, ((κ⁻¹ : ℝ≥0) : ℝ) * ‖v‖ ^ 2 ≤
      (fderiv ℝ (fderiv ℝ V) x v) v ∧
      (fderiv ℝ (fderiv ℝ V) x v) v ≤ (1 : ℝ≥0) * ‖v‖ ^ 2 := by
    simpa only [NNReal.coe_inv, NNReal.coe_one, one_mul] using hH
  have hreg :=
    AutoSamplingTheory.TechnicalLemmas.Analysis.QuadraticRegularization.strongConvexOn_and_lipschitzWith_gradient_add_quadratic
      (r := 0) hV hH' (0 : E)
  have hLip : LipschitzWith 1 (gradient V) := by simpa using hreg.2
  have hsc : StrongConvexOn Set.univ ((κ : ℝ)⁻¹) V := by simpa using hreg.1
  have hmono (x y : E) : 0 ≤ inner ℝ (gradient V x - gradient V y) (x - y) := by
    have hb :=
      AutoSamplingTheory.TechnicalLemmas.Analysis.StrongConvexFirstOrder.gradient_inner_lower_bound_of_strongConvexOn hsc
          (fun z _ => (hV.differentiable (by norm_num) z).hasGradientAt)
          (x := y) (y := x) (Set.mem_univ _) (Set.mem_univ _)
    exact (mul_nonneg (inv_nonneg.mpr (NNReal.coe_nonneg κ)) (sq_nonneg _)).trans hb
  have hpLip := nonexpansive_of_monotone_optimality hpos.le hmono heq
  refine ⟨p, hp, heq, hmin, hpLip, ?_, ?_⟩
  · intro y y' G
    have hg := hLip.dist_le_mul (p y + Real.sqrt eta • G) (p y' + Real.sqrt eta • G)
    have hy := hpLip.dist_le_mul y y'
    simp only [NNReal.coe_one, one_mul, dist_eq_norm, add_sub_add_right_eq_sub] at hg hy
    exact hg.trans hy
  · intro y G G'
    have hg := hLip.dist_le_mul (p y + Real.sqrt eta • G) (p y + Real.sqrt eta • G')
    simpa only [NNReal.coe_one, one_mul, dist_eq_norm, add_sub_add_left_eq_sub,
      ← smul_sub, norm_smul, Real.norm_eq_abs, abs_of_nonneg (Real.sqrt_nonneg eta)] using hg

end AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.ProximalEstimatorLipschitz

Exact module and namespace context

Source assumptions versus formal assumptions

Source	Actual Lean	Difference kind	Why it matters
Source uses R^d.	E is a finite-dimensional complete real inner-product space with its Borel sigma algebra; dimension zero is allowed.	generalization	Coordinate-free finite-dimensional argument includes the zero-dimensional case, not an infinite-dimensional claim.
Normalized C2 potential with Hessian between kappa^-1 and1, kappa>=1.	V:E→R is genuinely twice continuously Frechet differentiable; kappa is a nonnegative real with kappa>=1. For every x,v, kappa^-1 \|\|v\|\|^2 <= D²V(x)[v,v] <= \|\|v\|\|^2 (normalized beta=1).	same	ContDiff guarantees genuine derivatives; totalized gradient values are not substituted for differentiability.
The two pointwise estimates are not limited by a eta<=1/2 threshold.	0<eta<=1/2.	API-limitation	Inherited from the existing actual measurable constructor, not necessary for the private nonexpansiveness argument and not a source correction.
p(y) is the actual proximal minimizer.	Constructed measurable p with genuine optimality equation and quantitative unique-minimum certificate.	source-implicit	Existence, measurability and identification are reused from the same parent rather than supplied as assumptions.
Bounds hold for all y,y',G,G'.	All inputs are arbitrary deterministic E vectors.	same	Gaussianity, integrability and expectation are irrelevant to these two pathwise assertions.
Lemma 4.2 additionally includes bias and centered exponential moments.	Only the two deterministic input-stability edges.	API-limitation	No full-lemma, score bias, concentration, Picard or paper completion is claimed.

Partial coverage of (4.4)-(4.5) for 0<eta<=1/2, inherited from the existing constructor, not a necessary mathematical threshold or a source repair. Finite-dimensional real inner-product spaces, including dimension zero, are a coordinate-free extension. No estimator bias, centered exponential moment, smoothed score, Picard accuracy, initialization or query-cost conclusion.

Encoder–denoiser: accepted · lean-strengthened-assumptions

Detected semantic differences

assumptions: The formal theorem only establishes the selected estimates for 0<eta<=1/2. The upper bound is a constructor restriction, not a necessary threshold for the displayed deterministic argument and not a correction to the source. — Public hsmall is supplied to ProximalGaussianEstimator.proximal_gaussian_estimator. The private monotone-optimality argument accepts eta>=0. The module header and lesson already disclose the restriction.
domains: Euclidean coordinates are replaced by finite-dimensional real inner-product spaces, explicitly allowing dimension zero. — Public typeclasses and lesson assumptions disclose this extension; the private proof's hzero branch covers the degenerate displacement case.
conclusion: The formal conclusion retains measurable existence and a quantitative unique-minimum certificate in addition to the selected source bounds. — The existential tuple returns hp, heq, hmin and hpLip before the two estimator bounds. The lesson explains their role in identifying the exact proximal oracle.
scopes: Acceptance must not be recorded as complete Lemma 4.2 coverage or as coverage of unrestricted positive eta. — The publication binding is a proof-edge supporting position-input and noise-input only, and the lesson explicitly identifies partial coverage.

A generalization is not a source correction. Proposed missing conditions require separate independent repair review. No proposed repair silently changes the original theorem.

Scope and omitted-condition boundaries

Partial coverage of (4.4)-(4.5) for 0<eta<=1/2, inherited from the existing constructor, not a necessary mathematical threshold or a source repair. Finite-dimensional real inner-product spaces, including dimension zero, are a coordinate-free extension. No estimator bias, centered exponential moment, smoothed score, Picard accuracy, initialization or query-cost conclusion.

Source and reuse

ASTIS parents called

Mathlib API called (external library)

LipschitzWith.of_dist_le_mul
LipschitzWith.dist_le_mul
real_inner_le_norm
real_inner_self_eq_norm_sq
DifferentiableAt.hasGradientAt
norm_smul
Real.sqrt_nonneg

Mathematical sources

SPHMC Lemma 4.2, equations (4.4)-(4.5) — Partial coverage of (4.4)-(4.5) for 0<eta<=1/2, inherited from the existing constructor, not a necessary mathematical threshold or a source repair. Finite-dimensional real inner-product spaces, including dimension zero, are a coordinate-free extension. No estimator bias, centered exponential moment, smoothed score, Picard accuracy, initialization or query-cost conclusion.

ASTIS prose is not a quotation or a source-equivalence certificate. Definitions and aliases are explained as constructions, not counted as new mathematical proofs.

Which proof edges are actually covered?

Local proof component; source adapter/review separate Nonexpansive actual position input
Local proof component; source adapter/review separate sqrt eta-Lipschitz actual noise input

Actual proximal Gaussian estimator and its fiberwise moments

ASTIS mathematical construction and expanded measurability/moment component for Fan Chen,Sinho Chewi,Jianfeng Lu and Matthew S. Zhang,Smoothed Picard Hamiltonian Monte Carlo;not a verbatim printed theorem or full algorithm guarantee.

arXiv:2609.06906v1 · Equation(3.2),Algorithm3.1 estimator evaluations; normalized source(1.1) and Section2 · faithful paraphrase

Complete source statement (ASTIS restatement)

There exists a measurable p:S->E such that p_s+eta_s*gradient V(p_s)=y_s. For all s,z,F_s(p_s)+(kappa^(-1)+eta_s^(-1))*norm(z-p_s)^2/2<=F_s(z),and F_s(z)<=F_s(p_s) if and only if z=p_s. Set G(s,z)=gradient V(p_s+sqrt(eta_s)*z). G is jointly measurable. There exists a Markov kernel K:S->E whose fiber is exactly StandardGaussian(E).map(z->G(s,z)). For every s,both G(s,.) and G(s,.)-gradient V(p_s) belong to L2(StandardGaussian(E)); the integral of norm(G(s,z)-gradient V(p_s))^2 is at most eta_s*d,and the integral of norm(G(s,z))^2 is at most 2*norm(gradient V(p_s))^2+2*eta_s*d. Finally norm(w)^2 is integrable under the actual K_s,and its K_s integral satisfies that same total second-moment bound.

E is a finite-dimensional real inner-product Borel space with its complete metric structure; d=dim_R E may be zero. S is any measurable space,with no topology,standard Borel hypothesis or probability law required.
The nonnegative real kappa satisfies kappa>=1. V:E->R is C2 and kappa^(-1)*norm(v)^2<=D2V(x)[v,v]<=norm(v)^2 for every x,v. The normalization is beta=1. Kappa>=1 remains an explicit hypothesis although the proof does not use that inequality.
eta:S->R and y:S->E are measurable,with 0<eta_s<=1/2 for every s. No uniform positive lower bound on eta is assumed. Define F_s(x)=V(x)+norm(x-y_s)^2/(2 eta_s).
gradient V is the genuine real inner-product gradient,defined through the Frechet derivative. StandardGaussian(E) has zero mean and identity covariance; in zero dimension it is the Dirac law at zero. All displayed real integrals are Bochner integrals and all asserted L2 properties are with respect to this actual Gaussian law or the specified kernel fiber.

Actual estimator and proximal-point deviation moment

\[G_s(z)=\nabla V(p_s+\sqrt{\eta_s}z),\quad K_s=(G_s)_\#\gamma,\quad\int\|G_s-\nabla V(p_s)\|^2d\gamma\le\eta_s d.\]

Read the formalized proofs

Each statement and proof below has its own closed Lean disclosure. ASTIS parents, Mathlib calls and external mathematical sources are distinguished in each proof.

ASTIS mathematical exposition

Actual proximal Gaussian estimator and its fiberwise moments

AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.ProximalGaussianEstimator.proximal_gaussian_estimator · theorem · Teaching coverage

Statement

\[G_s(z)=\nabla V(p_s+\sqrt{\eta_s}z),\quad K_s=(G_s)_\#\gamma,\quad\int\|G_s-\nabla V(p_s)\|^2d\gamma\le\eta_s d.\]

All objects and hypotheses

E is a finite-dimensional real inner-product Borel space with its complete metric structure; d=dim_R E may be zero. S is any measurable space,with no topology,standard Borel hypothesis or probability law required.
The nonnegative real kappa satisfies kappa>=1. V:E->R is C2 and kappa^(-1)*norm(v)^2<=D2V(x)[v,v]<=norm(v)^2 for every x,v. The normalization is beta=1. Kappa>=1 remains an explicit hypothesis although the proof does not use that inequality.
eta:S->R and y:S->E are measurable,with 0<eta_s<=1/2 for every s. No uniform positive lower bound on eta is assumed. Define F_s(x)=V(x)+norm(x-y_s)^2/(2 eta_s).
gradient V is the genuine real inner-product gradient,defined through the Frechet derivative. StandardGaussian(E) has zero mean and identity covariance; in zero dimension it is the Dirac law at zero. All displayed real integrals are Bochner integrals and all asserted L2 properties are with respect to this actual Gaussian law or the specified kernel fiber.

Mathematical proof

1. Derive actual gradient Lipschitzness

Use the genuine source Hessian bounds in QuadraticRegularization with zero added precision. This proves the real gradient is 1-Lipschitz; no abstract replacement gradient or supplied Lipschitz premise enters the public theorem.

\[\|\nabla V(x)-\nabla V(z)\|\le\|x-z\|.\]

Corresponding Lean step

actual_proximal_minimizer: hLip; proximal_gaussian_estimator: hHprime,hLip

2. Construct one measurable proximal point

For every parameter define f_s(x)=y_s-eta_s*gradient V(x). Its Lipschitz constant is at most1/2. Banach contraction constructs p_s. Iterates from the common zero vector are measurable in s by induction; pointwise convergence and the measurable-limit theorem prove the measurability of this same p. The fixed point equation is then rearranged.

\[f_s^{\,n}(0)\longrightarrow p_s,\qquad p_s+\eta_s\nabla V(p_s)=y_s.\]

Corresponding Lean step

parameterized_contraction_point: f,hc,p,hit,hp,heq

3. Identify the true regularized gradient

Differentiate the squared norm after translation and add the genuine derivative of V. The proximal equation and eta_s nonzero give gradient F_s(p_s)=0. This uses the actual potential F_s,not a supplied stationary-point certificate.

\[\nabla F_s(x)=\nabla V(x)+\eta_s^{-1}(x-y_s),\qquad\nabla F_s(p_s)=0.\]

Corresponding Lean step

actual_proximal_minimizer: hd,hq,hFd,hg,hz

4. Prove global quadratic growth and unique minimality

QuadraticRegularization gives curvature m+eta_s inverse,where m=kappa inverse. StrongConvexFirstOrder at the actual stationary point gives the global quadratic lower bound. Its coefficient is strictly positive because eta_s>0,even for the internal helper m=0. If any point has no larger objective value,the squared displacement must vanish. This supplies unique argmin,not merely fixed-point uniqueness.

\[F_s(z)\ge F_s(p_s)+\frac{\kappa^{-1}+\eta_s^{-1}}2\|z-p_s\|^2.\]

Corresponding Lean step

actual_proximal_minimizer: hsc,hbound,ha,hnonpos,hn

5. Establish the actual Gaussian square moment

The Gaussian L2 identity gives norm-square integrability. In a finite orthonormal basis,the covariance identity and zero mean give unit second moment in each coordinate. Parseval and a justified finite integral sum yield total moment d,including the empty sum in zero dimension. This adapts the private gaussian_square proof in ApproximateInitialGradientMoment without claiming a public theorem call.

\[\int\|z\|^2\,d\gamma(z)=d.\]

Corresponding Lean step

gaussian_square: hi,b,hdir,hL1

6. Prove integrability before comparing estimator moments

For fixed p and positive eta,the genuine Lipschitz estimate bounds the squared deviation from gradient V(p) by eta*norm(z)^2. This integrable Gaussian majorant proves square L1 before integration. The triangle inequality gives total square at most2*norm(gradient V(p))^2+2*eta*norm(z)^2;its own integrable majorant then proves the total bound. This is not a variance or smoothed-score bias assertion.

\[\|G_s(z)-\nabla V(p_s)\|^2\le\eta_s\|z\|^2,\quad\|G_s(z)\|^2\le2\|\nabla V(p_s)\|^2+2\eta_s\|z\|^2.\]

Corresponding Lean step

actual_gaussian_gradient_moments: hG,hb,hs,hdom,hi,hint,ht,hdom2,hi2

7. Construct the actual parameter kernel

Joint measurability follows by composing the continuous gradient with measurable p,eta and the noise coordinate. Form the product of the identity kernel on S and the constant standard Gaussian kernel,then map by this actual G. The Markov map theorem gives probability fibers. Dirac-product and pushforward composition identify each fiber exactly with the Gaussian estimator law.

\[K=(\mathrm{id}\times\mathrm{const}(\gamma)).\mathrm{map}(G),\qquad K_s=(G_s)_\#\gamma.\]

Corresponding Lean step

proximal_gaussian_estimator: G,hG,K,hK,hKs

8. Transfer the proved moments to the actual output law

Apply the fixed-parameter moment proof to the same actual gradient and proximal point. Joint measurability restricts to measurable Gaussian fibers and deviations. The L2 characterization turns the square-integrability results into both MemLp conclusions. The exact fiber identity,integrable-map theorem and integral-map theorem transfer norm-square L1 and its bound to K_s. No integration over a state distribution is taken.

\[\int\|w\|^2K_s(dw)=\int\|G_s(z)\|^2d\gamma(z)\le2\|\nabla V(p_s)\|^2+2\eta_s d.\]

Corresponding Lean step

proximal_gaussian_estimator: hm,hGs,hdev,hiK,hintK

Lean statement · proximal_gaussian_estimator

Same measurable exact proximal point,quantitative unique argmin,actual Gaussian estimator and Markov kernel,fiberwise L2 and second moments.

theorem proximal_gaussian_estimator
    {E S : Type*} [NormedAddCommGroup E] [InnerProductSpace ℝ E]
    [CompleteSpace E] [FiniteDimensional ℝ E] [MeasurableSpace E] [BorelSpace E]
    [MeasurableSpace S] {V : E → ℝ} {κ : ℝ≥0} (_hκ : 1 ≤ κ)
    (hV : ContDiff ℝ 2 V)
    (hH : ∀ x v : E, (κ:ℝ)⁻¹*‖v‖^2 ≤ (fderiv ℝ (fderiv ℝ V) x v) v ∧
      (fderiv ℝ (fderiv ℝ V) x v) v ≤ ‖v‖^2)
    {eta : S → ℝ} {y : S → E} (heta : Measurable eta) (hy : Measurable y)
    (hpos : ∀ s, 0 < eta s) (hsmall : ∀ s, eta s ≤ 1/2) :
    let F := fun s x => V x + (eta s)⁻¹/2*‖x-y s‖^2
    ∃ p : S → E, Measurable p ∧
      (∀ s, p s + eta s • gradient V (p s) = y s) ∧
      (∀ s z, F s (p s) + ((κ:ℝ)⁻¹+(eta s)⁻¹)/2*‖z-p s‖^2 ≤ F s z ∧
        (F s z ≤ F s (p s) ↔ z=p s)) ∧
      let G := fun q : S × E => gradient V (p q.1+Real.sqrt (eta q.1) • q.2)
      Measurable G ∧ ∃ K : Kernel S E, IsMarkovKernel K ∧
        (∀ s, K s = (stdGaussian E).map (fun z => G (s,z))) ∧
        ∀ s, MemLp (fun z => G (s,z)) 2 (stdGaussian E) ∧
          MemLp (fun z => G (s,z)-gradient V (p s)) 2 (stdGaussian E) ∧
          (∫ z, ‖G (s,z)-gradient V (p s)‖^2 ∂stdGaussian E) ≤ eta s*Module.finrank ℝ E ∧
          (∫ z, ‖G (s,z)‖^2 ∂stdGaussian E) ≤ 2*‖gradient V (p s)‖^2+2*eta s*Module.finrank ℝ E ∧
          Integrable (fun w : E => ‖w‖^2) (K s) ∧
          (∫ w : E, ‖w‖^2 ∂K s) ≤ 2*‖gradient V (p s)‖^2+2*eta s*Module.finrank ℝ E

Exact module and namespace context

Lean proof · proximal_gaussian_estimator

Uniform contraction and measurable limit;true regularized gradient and strong convexity;Gaussian moments and integrable domination;actual kernel pushforward and integral transfer.

theorem proximal_gaussian_estimator
    {E S : Type*} [NormedAddCommGroup E] [InnerProductSpace ℝ E]
    [CompleteSpace E] [FiniteDimensional ℝ E] [MeasurableSpace E] [BorelSpace E]
    [MeasurableSpace S] {V : E → ℝ} {κ : ℝ≥0} (_hκ : 1 ≤ κ)
    (hV : ContDiff ℝ 2 V)
    (hH : ∀ x v : E, (κ:ℝ)⁻¹*‖v‖^2 ≤ (fderiv ℝ (fderiv ℝ V) x v) v ∧
      (fderiv ℝ (fderiv ℝ V) x v) v ≤ ‖v‖^2)
    {eta : S → ℝ} {y : S → E} (heta : Measurable eta) (hy : Measurable y)
    (hpos : ∀ s, 0 < eta s) (hsmall : ∀ s, eta s ≤ 1/2) :
    let F := fun s x => V x + (eta s)⁻¹/2*‖x-y s‖^2
    ∃ p : S → E, Measurable p ∧
      (∀ s, p s + eta s • gradient V (p s) = y s) ∧
      (∀ s z, F s (p s) + ((κ:ℝ)⁻¹+(eta s)⁻¹)/2*‖z-p s‖^2 ≤ F s z ∧
        (F s z ≤ F s (p s) ↔ z=p s)) ∧
      let G := fun q : S × E => gradient V (p q.1+Real.sqrt (eta q.1) • q.2)
      Measurable G ∧ ∃ K : Kernel S E, IsMarkovKernel K ∧
        (∀ s, K s = (stdGaussian E).map (fun z => G (s,z))) ∧
        ∀ s, MemLp (fun z => G (s,z)) 2 (stdGaussian E) ∧
          MemLp (fun z => G (s,z)-gradient V (p s)) 2 (stdGaussian E) ∧
          (∫ z, ‖G (s,z)-gradient V (p s)‖^2 ∂stdGaussian E) ≤ eta s*Module.finrank ℝ E ∧
          (∫ z, ‖G (s,z)‖^2 ∂stdGaussian E) ≤ 2*‖gradient V (p s)‖^2+2*eta s*Module.finrank ℝ E ∧
          Integrable (fun w : E => ‖w‖^2) (K s) ∧
          (∫ w : E, ‖w‖^2 ∂K s) ≤ 2*‖gradient V (p s)‖^2+2*eta s*Module.finrank ℝ E := by
  let F := fun s x => V x + (eta s)⁻¹/2*‖x-y s‖^2
  have hH' : ∀ x v : E, ((κ⁻¹:ℝ≥0):ℝ)*‖v‖^2 ≤ (fderiv ℝ (fderiv ℝ V) x v) v ∧
      (fderiv ℝ (fderiv ℝ V) x v) v ≤ (1:ℝ≥0)*‖v‖^2 := by
    simpa only [NNReal.coe_inv,NNReal.coe_one,one_mul] using hH
  obtain ⟨p,hp,heq,hmin⟩ := actual_proximal_minimizer hV hH' heta hy hpos hsmall
  have hLip : LipschitzWith 1 (gradient V) := by
    have hb := AutoSamplingTheory.TechnicalLemmas.Analysis.QuadraticRegularization.strongConvexOn_and_lipschitzWith_gradient_add_quadratic (r := 0) hV hH' (0:E)
    simpa using hb.2
  refine ⟨p,hp,heq,?_,?_⟩
  · simpa only [NNReal.coe_inv] using hmin
  let G := fun q : S × E => gradient V (p q.1+Real.sqrt (eta q.1) • q.2)
  have hG : Measurable G := hLip.continuous.measurable.comp
    ((hp.comp measurable_fst).add ((heta.comp measurable_fst).sqrt.smul measurable_snd))
  let K := (Kernel.id ×ₖ Kernel.const S (stdGaussian E)).map G
  have hK : IsMarkovKernel K := Kernel.IsMarkovKernel.map _ hG
  have hKs (s : S) : K s = (stdGaussian E).map (fun z => G (s,z)) := by
    dsimp only [K]
    rw [Kernel.map_apply _ hG,Kernel.prod_apply,Kernel.id_apply,Kernel.const_apply,
      Measure.dirac_prod,Measure.map_map hG (by fun_prop)]
    rfl
  refine ⟨hG,K,hK,hKs,fun s => ?_⟩
  have hm := actual_gaussian_gradient_moments hLip (p s) (hpos s)
  change Integrable (fun z => ‖G (s,z)-gradient V (p s)‖^2) (stdGaussian E) ∧
    (∫ z, ‖G (s,z)-gradient V (p s)‖^2 ∂stdGaussian E) ≤ eta s*Module.finrank ℝ E ∧
    Integrable (fun z => ‖G (s,z)‖^2) (stdGaussian E) ∧
    (∫ z, ‖G (s,z)‖^2 ∂stdGaussian E) ≤ 2*‖gradient V (p s)‖^2+2*eta s*Module.finrank ℝ E at hm
  have hGs : Measurable (fun z => G (s,z)) := hG.comp (measurable_const.prodMk measurable_id)
  have hdev : Measurable (fun z => G (s,z)-gradient V (p s)) := hGs.sub measurable_const
  have hiK : Integrable (fun w : E => ‖w‖^2) (K s) := by
    rw [hKs]
    exact (integrable_map_measure (by fun_prop) hGs.aemeasurable).2 hm.2.2.1
  have hintK : (∫ w : E, ‖w‖^2 ∂K s) = ∫ z, ‖G (s,z)‖^2 ∂stdGaussian E := by
    rw [hKs]
    exact integral_map hGs.aemeasurable (by fun_prop)
  refine ⟨(memLp_two_iff_integrable_sq_norm hGs.aestronglyMeasurable).2 hm.2.2.1,
    (memLp_two_iff_integrable_sq_norm hdev.aestronglyMeasurable).2 hm.1,
    hm.2.1,hm.2.2.2,hiK,?_⟩
  rw [hintK]
  exact hm.2.2.2



end

end AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.ProximalGaussianEstimator

Exact module and namespace context

Source assumptions versus formal assumptions

Source	Actual Lean	Difference kind	Why it matters
Source is Euclidean with positive dimension and explicit C2/Hessian bounds.	Coordinate-free finite-dimensional real inner-product Borel space,including zero dimension; same genuine C2/Hessian bounds.	generalization	Zero dimension and coordinate-free presentation are extensions;C2 agrees with source(1.1).
Source estimator is evaluated at algorithmic random centers and step sizes.	Any measurable S and measurable eta,y;no topology or probability law on S.	generalization	The parameterized theorem can consume actual random centers without assuming a measurable proximal selection; no topology or probability law on S is needed.
Equation(3.2) uses the exact proximal oracle.	The constructed point satisfies the actual proximal equation and unique global minimum.	same	This identifies the same exact oracle mathematically; a finite gradient evaluator is not supplied.
The paper normalizes beta=1 and kappa>=1 in this analysis.	Both remain explicit hypotheses;the kappa>=1 binder is unused in the proof.	same	An unused proof hypothesis is still part of the public theorem and is not silently removed.
Later estimator analysis controls error relative to the actual smoothed score.	Deviation second moment is centered at gradient V(p),not the estimator mean or smoothed score.	API-limitation	Neither variance about the estimator mean nor Lemma4.2 score bias is claimed.
Full algorithms use random states and charge oracle implementation costs.	Only fiberwise L2 and moments of the exact oracle;no state-law integral or gradient evaluator trace.	API-limitation	Global state moments,Picard output accuracy,initialization and total costs remain separate.
The proximal estimator formula is meaningful for positive smoothing parameters;the algorithm selects small parameters.	The public construction assumes0<eta_s<=1/2.	API-limitation	The bound1/2 is a sufficient contraction condition of this construction,not a claimed optimal source threshold. An algorithm consumer must establish this bound for its actual parameters;the theorem does not cover every positive eta.

Actual exact proximal Gaussian gradient estimator from source(3.2), with normalized beta=1,kappa>=1,C2 and genuine Hessian bounds. Arbitrary measurable parameter spaces and zero-dimensional finite inner-product Borel spaces are explicit extensions. Step sizes are measurable and in(0,1/2],without a uniform positive lower bound. The same constructed measurable proximal point supplies the true gradient estimator and exact Markov pushforward. Squared deviation is about gradient V(p),not estimator variance about its mean or error relative to the smoothed score. All L2 and moment conclusions are fiberwise; no arbitrary state-law integrability is inferred. No finite gradient evaluator trace or query count,score bias,Picard updates,stage W2 accuracy,initialization/total cost or full main result is claimed.

Encoder–denoiser: accepted · domain-mismatch

Detected semantic differences

domains: Coordinate-free and zero-dimensional domain extension. — Independent formal source reviewer accepted: Coordinate-free and zero-dimensional domain extension.
domains: Arbitrary measurable parameter space extension. — Independent formal source reviewer accepted: Arbitrary measurable parameter space extension.
objects: Same exact proximal oracle,not a finite gradient evaluator. — Independent formal source reviewer accepted: Same exact proximal oracle,not a finite gradient evaluator.
assumptions: Beta1 and kappa>=1 retained,including unused public inequality. — Independent formal source reviewer accepted: Beta1 and kappa>=1 retained,including unused public inequality.
conclusion: Deviation center is not estimator mean or smoothed score. — Independent formal source reviewer accepted: Deviation center is not estimator mean or smoothed score.
scopes: Fiber moments and exact-oracle boundary exclude global state moments and costs. — Independent formal source reviewer accepted: Fiber moments and exact-oracle boundary exclude global state moments and costs.
assumptions: Eta<=1/2 sufficient domain,not an optimal existence threshold. — Independent formal source reviewer accepted: Eta<=1/2 sufficient domain,not an optimal existence threshold.

A generalization is not a source correction. Proposed missing conditions require separate independent repair review. No proposed repair silently changes the original theorem.

Scope and omitted-condition boundaries

Actual exact proximal Gaussian gradient estimator from source(3.2), with normalized beta=1,kappa>=1,C2 and genuine Hessian bounds. Arbitrary measurable parameter spaces and zero-dimensional finite inner-product Borel spaces are explicit extensions. Step sizes are measurable and in(0,1/2],without a uniform positive lower bound. The same constructed measurable proximal point supplies the true gradient estimator and exact Markov pushforward. Squared deviation is about gradient V(p),not estimator variance about its mean or error relative to the smoothed score. All L2 and moment conclusions are fiberwise; no arbitrary state-law integrability is inferred. No finite gradient evaluator trace or query count,score bias,Picard updates,stage W2 accuracy,initialization/total cost or full main result is claimed.

Source and reuse

ASTIS parents called

Mathlib API called (external library)

ContractingWith.fixedPoint
ContractingWith.tendsto_iterate_fixedPoint
measurable_of_tendsto_metrizable
ProbabilityTheory.covarianceBilin_stdGaussian
MeasureTheory.memLp_two_iff_integrable_sq_norm
ProbabilityTheory.Kernel.IsMarkovKernel.map
MeasureTheory.integrable_map_measure
MeasureTheory.integral_map

Mathematical sources

SPHMC(3.2) and Algorithm3.1 — Actual exact proximal Gaussian gradient estimator from source(3.2), with normalized beta=1,kappa>=1,C2 and genuine Hessian bounds. Arbitrary measurable parameter spaces and zero-dimensional finite inner-product Borel spaces are explicit extensions. Step sizes are measurable and in(0,1/2],without a uniform positive lower bound. The same constructed measurable proximal point supplies the true gradient estimator and exact Markov pushforward. Squared deviation is about gradient V(p),not estimator variance about its mean or error relative to the smoothed score. All L2 and moment conclusions are fiberwise; no arbitrary state-law integrability is inferred. No finite gradient evaluator trace or query count,score bias,Picard updates,stage W2 accuracy,initialization/total cost or full main result is claimed.

ASTIS prose is not a quotation or a source-equivalence certificate. Definitions and aliases are explained as constructions, not counted as new mathematical proofs.

Which proof edges are actually covered?

Local proof component; source adapter/review separate Actual proximal Gaussian estimator and its fiberwise moments

One truncation proxy for every Gaussian time and order

Fan Chen, Sinho Chewi, Jianfeng Lu and Matthew S. Zhang; ASTIS expanded proof, no author endorsement implied.

arXiv:2609.06906v1 · Lemmas6.2 and6.3(ii), actual-budget proxy composition · faithful paraphrase

Complete source statement (ASTIS restatement)

Let P,Q be probability measures on a finite-dimensional real inner-product Borel space. Let real p>=2,r>=0 and 0<delta<1. Suppose the actual infimum over couplings of the pth displacement integral is at most ofReal(r^p). There exist one probability proxy Pdag and one probability coupling Gamma of Pdag,Q such that every measurable event B satisfies |P.real B-Pdag.real B|<=delta and norm(x-y)<=r delta^(-1/p) Gamma-a.e. For this same Pdag and Gamma, every tau>0 and real q>1 satisfy: Htau Pdag is absolutely continuous with respect to Htau Q; its actual ENNReal RN qth-power integral is at most ofReal exp(q(q-1)r^2/(2tau delta^(2/p))); the real RN qth power is integrable under Htau Q, its integral has the same exponential bound, and its logarithm divided by q-1 is at most q r^2/(2tau delta^(2/p)). Htau is the existing actual GaussianSmoothing operator with scale sqrt(tau).

Finite-dimensional real inner-product Borel E, including zero dimension; P,Q probability measures.
Real p>=2 inherited from the source Lemma6.2 proof route. Lemma6.3(ii) does not independently restate this range; the formal statement makes it explicit.
r>=0 and0<delta<1, including zero radius. The genuine infimum p-displacement transportCost(P,Q)<=ofReal(r^p) is the input, not a supplied optimal coupling or proxy.
Finite marginal p-moments are not assumed or concluded; this raw-budget theorem is an explicit generalization of the source Pp presentation. Its relation to a full Wp metric API remains separate.
The same proxy and coupling precede all tau>0,q>1. Their independence from tau is justified by the actual truncation construction, strengthening the source fixed-time presentation.

Uniform actual proxy bound

\[\exists P^\dagger,\Gamma\in\Pi(P^\dagger,Q):\quad\sup_B|P(B)-P^\dagger(B)|\le\delta,\qquad\forall\tau>0,\ q>1,\quad\frac{\log\int(dH_\tau P^\dagger/dH_\tau Q)^q\,dH_\tau Q}{q-1}\le\frac{qr^2}{2\tau\delta^{2/p}}.\]

Read the formalized proofs

Each statement and proof below has its own closed Lean disclosure. ASTIS parents, Mathlib calls and external mathematical sources are distinguished in each proof.

ASTIS mathematical exposition

One truncation proxy for every Gaussian time and order

AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.ProxyReverseTransport.proxy_reverse_transport · theorem · Teaching coverage

Statement

All objects and hypotheses

Finite-dimensional real inner-product Borel E, including zero dimension; P,Q probability measures.
Real p>=2 inherited from the source Lemma6.2 proof route. Lemma6.3(ii) does not independently restate this range; the formal statement makes it explicit.
r>=0 and0<delta<1, including zero radius. The genuine infimum p-displacement transportCost(P,Q)<=ofReal(r^p) is the input, not a supplied optimal coupling or proxy.
Finite marginal p-moments are not assumed or concluded; this raw-budget theorem is an explicit generalization of the source Pp presentation. Its relation to a full Wp metric API remains separate.
The same proxy and coupling precede all tau>0,q>1. Their independence from tau is justified by the actual truncation construction, strengthening the source fixed-time presentation.

Mathematical proof

1. Use the true transport budget to construct a truncation

Call the existing truncation theorem once. It attains the actual infimum cost, constructs T(x,y)=x inside the radius r delta^(-1/p) and y outside, and supplies the actual probability, marginal, TV and displacement conclusions. No optimizer or finite coupling moment is added as a premise.

\[t=r\delta^{-1/p},\qquad T(x,y)=\begin{cases}x,&\|x-y\|\le t,\\y,&\|x-y\|>t.\end{cases}\]

Corresponding Lean step

One call to Truncation.truncated_proxy with the actual hcost, p>=2 and delta/r conditions.

2. Fix both witnesses before choosing any heat time or order

Set Pdag=gamma.map T and Gamma=gamma.map((x,y) to (T(x,y),y)). These are probability measures, Gamma has actual Pdag,Q marginals, and the eventwise TV and a.e. displacement bounds already hold. Introduce tau and q only after supplying these existential witnesses.

\[P^\dagger=T_\#\gamma,\quad\Gamma=(T,\operatorname{snd})_\#\gamma,\quad\exists P^\dagger,\Gamma\ \forall\tau>0\ \forall q>1.\]

Corresponding Lean step

The refine witness tuple is completed before intro tau hTau q hq; hTV compares P with that same Pdag.

3. Apply actual Gaussian mixture reverse transport

For arbitrary tau>0,q>1, the threshold t is nonnegative. Apply the admitted GaussianMixture theorem to the fixed Gamma and Pdag,Q. This provides actual absolute continuity, finite ENNReal RN power bound, real-power integrability, exponential moment bound and normalized logarithm.

\[\int(dH_\tau P^\dagger/dH_\tau Q)^q\,dH_\tau Q\le e^{q(q-1)t^2/(2\tau)}.\]

Corresponding Lean step

GaussianMixture.bounded_displacement_reverse_transport consumes the actual fixed coupling, with its probability facts already available.

4. Normalize the exact truncation radius

Since delta>0, real-power multiplication and negation give (delta^(-1/p))^2=(delta^(2/p))^(-1). Multiplying by r^2 gives t^2=r^2/delta^(2/p), valid also for r=0.

\[(r\delta^{-1/p})^2=\frac{r^2}{\delta^{2/p}}.\]

Corresponding Lean step

Real.rpow_natCast, rpow_mul and rpow_neg, followed by exact multiplication/division algebra. No division by r.

5. Retain the full joint guarantee with exact constants

Substitute the same radius identity into both the exponential and normalized logarithm bounds. Keep all five smoothing conclusions alongside the previously fixed probability, coupling and TV/displacement facts. No use of TV to transport an unbounded cost is involved.

\[\frac{q(q-1)t^2}{2\tau}=\frac{q(q-1)r^2}{2\tau\delta^{2/p}},\qquad\frac{qt^2}{2\tau}=\frac{qr^2}{2\tau\delta^{2/p}}.\]

Corresponding Lean step

hc1 and hc2 rewrite the entire conjunction from the actual mixture theorem; no new divergence or sampler-cost assumption.

Lean statement · proxy_reverse_transport

There exist a single actual proxy and coupling with eventwise TV/displacement and all-time/all-order Gaussian RN moment/log bounds.

theorem proxy_reverse_transport {E : Type*} [NormedAddCommGroup E] [InnerProductSpace ℝ E]
    [FiniteDimensional ℝ E] [MeasurableSpace E] [BorelSpace E]
    (P Q : Measure E) [IsProbabilityMeasure P] [IsProbabilityMeasure Q]
    (p r δ : ℝ) (hp : 2 ≤ p) (hr : 0 ≤ r) (hδ : 0 < δ) (hδ1 : δ < 1)
    (hcost : Transport.transportCost (fun z : E × E => ENNReal.ofReal (‖z.1-z.2‖^p)) P Q ≤ ENNReal.ofReal (r^p)) :
    ∃ Pdag : Measure E, ∃ Γ : Measure (E × E),
      IsProbabilityMeasure Pdag ∧ IsProbabilityMeasure Γ ∧ Transport.IsCoupling Γ Pdag Q ∧
      (∀ B, MeasurableSet B → |P.real B-Pdag.real B| ≤ δ) ∧
      (∀ᵐ z ∂Γ, ‖z.1-z.2‖ ≤ r*δ^(-1/p)) ∧
      ∀ τ : ℝ, 0 < τ → ∀ q : ℝ, 1 < q →
        let H := fun μ : Measure E => GaussianSmoothing.gaussianSmoothing μ (Real.sqrt τ)
        H Pdag ≪ H Q ∧
          (∫⁻ z, ((H Pdag).rnDeriv (H Q) z)^q ∂H Q) ≤
            ENNReal.ofReal (Real.exp (q*(q-1)*r^2/(2*τ*δ^(2/p)))) ∧
          Integrable (fun z => ((H Pdag).rnDeriv (H Q) z).toReal^q) (H Q) ∧
          (∫ z, ((H Pdag).rnDeriv (H Q) z).toReal^q ∂H Q) ≤
            Real.exp (q*(q-1)*r^2/(2*τ*δ^(2/p))) ∧
          Real.log (∫ z, ((H Pdag).rnDeriv (H Q) z).toReal^q ∂H Q)/(q-1) ≤
            q*r^2/(2*τ*δ^(2/p))

Exact module and namespace context

Lean proof · proxy_reverse_transport

One actual truncation witness followed by actual Gaussian mixture reverse transport and exact positive-base exponent normalization.

theorem proxy_reverse_transport {E : Type*} [NormedAddCommGroup E] [InnerProductSpace ℝ E]
    [FiniteDimensional ℝ E] [MeasurableSpace E] [BorelSpace E]
    (P Q : Measure E) [IsProbabilityMeasure P] [IsProbabilityMeasure Q]
    (p r δ : ℝ) (hp : 2 ≤ p) (hr : 0 ≤ r) (hδ : 0 < δ) (hδ1 : δ < 1)
    (hcost : Transport.transportCost (fun z : E × E => ENNReal.ofReal (‖z.1-z.2‖^p)) P Q ≤ ENNReal.ofReal (r^p)) :
    ∃ Pdag : Measure E, ∃ Γ : Measure (E × E),
      IsProbabilityMeasure Pdag ∧ IsProbabilityMeasure Γ ∧ Transport.IsCoupling Γ Pdag Q ∧
      (∀ B, MeasurableSet B → |P.real B-Pdag.real B| ≤ δ) ∧
      (∀ᵐ z ∂Γ, ‖z.1-z.2‖ ≤ r*δ^(-1/p)) ∧
      ∀ τ : ℝ, 0 < τ → ∀ q : ℝ, 1 < q →
        let H := fun μ : Measure E => GaussianSmoothing.gaussianSmoothing μ (Real.sqrt τ)
        H Pdag ≪ H Q ∧
          (∫⁻ z, ((H Pdag).rnDeriv (H Q) z)^q ∂H Q) ≤
            ENNReal.ofReal (Real.exp (q*(q-1)*r^2/(2*τ*δ^(2/p)))) ∧
          Integrable (fun z => ((H Pdag).rnDeriv (H Q) z).toReal^q) (H Q) ∧
          (∫ z, ((H Pdag).rnDeriv (H Q) z).toReal^q ∂H Q) ≤
            Real.exp (q*(q-1)*r^2/(2*τ*δ^(2/p))) ∧
          Real.log (∫ z, ((H Pdag).rnDeriv (H Q) z).toReal^q ∂H Q)/(q-1) ≤
            q*r^2/(2*τ*δ^(2/p)) := by
  obtain ⟨γ,hγ,hcouple,hopt,hT,hPdag,hΓ,hΓcouple,hdisp,hTV⟩ :=
    Truncation.truncated_proxy P Q p r δ hp hr hδ hδ1 hcost
  let T := fun z : E × E => if ‖z.1-z.2‖ ≤ r*δ^(-1/p) then z.1 else z.2
  refine ⟨γ.map T,γ.map (fun z => (T z,z.2)),hPdag,hΓ,hΓcouple,hTV,hdisp,?_⟩
  intro τ hτ q hq
  let : IsProbabilityMeasure (γ.map T) := hPdag
  have ht : 0 ≤ r*δ^(-1/p) := mul_nonneg hr (Real.rpow_nonneg hδ.le _)
  have h := GaussianMixture.bounded_displacement_reverse_transport
    (γ.map T) Q (γ.map (fun z => (T z,z.2))) hΓcouple τ q (r*δ^(-1/p)) hτ hq ht hdisp
  have he : (r*δ^(-1/p))^2 = r^2 / δ^(2/p) := by
    rw [mul_pow]
    have hd : (δ^(-1/p))^2 = (δ^(2/p))⁻¹ := by
      rw [← Real.rpow_natCast,← Real.rpow_mul hδ.le]
      change δ^((-1/p)*(2 : ℝ)) = (δ^(2/p))⁻¹
      have hex : (-1/p)*(2 : ℝ) = -(2/p) := by ring
      rw [hex,Real.rpow_neg hδ.le]
    rw [hd]
    exact (div_eq_mul_inv _ _).symm
  have hc1 : q*(q-1)*(r*δ^(-1/p))^2/(2*τ) = q*(q-1)*r^2/(2*τ*δ^(2/p)) := by
    rw [he]
    ring
  have hc2 : q*(r*δ^(-1/p))^2/(2*τ) = q*r^2/(2*τ*δ^(2/p)) := by
    rw [he]
    ring
  dsimp only at h ⊢
  simpa only [hc1,hc2] using h

end AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.ProxyReverseTransport

Exact module and namespace context

Source assumptions versus formal assumptions

Source	Actual Lean	Difference kind	Why it matters
Lemma6.3(ii) uses P,Q in Pp and invokes Lemma6.2, which assumes p>=2; the former does not separately restate that range.	Explicit p>=2 and actual infimum displacement-cost budget, without marginal p-moment assumptions.	generalization	Retains the invoked proof route; finite coupling cost does not imply marginal moments. Full Wp API identification is separate.
The source states the bound at fixed heat time and uniformly over q>1.	One actual proxy and coupling precede every tau>0 and q>1.	generalization	The actual truncation construction is independent of both parameters.
Euclidean probability measures, TV proxy, and Renyi reverse-transport bound.	Finite-dimensional real inner-product Borel spaces including zero dimension; eventwise TV and actual RN integral/log certificate.	API-limitation	Explicit budget-form generalization; full Wasserstein/Renyi metric interfaces, recursive warmness and sampler costs are not claimed.
Exact q r^2/(2 tau delta^(2/p)) normalized logarithm bound.	Same coefficient, RN direction, denominator law, plus proved real-power integrability and finite ENNReal bound.	same	Actual truncation and Gaussian mixture theorems with exact positive-base exponent algebra.

Actual infimum p-cost budget and eventwise TV/RN-log certificate for the Lemma6.2 to6.3(ii) route. One proxy is fixed before all tau,q. Full Wp/Renyi API identification, marginal moment conclusions, recursive warmness and actual sampler/error/query-cost results remain separate.

Encoder–denoiser: accepted · domain-mismatch

Detected semantic differences

domains: Explicit finite-dimensional generalization including zero dimension. — No positive-dimension requirement or division by dimension.
assumptions: Raw displacement budget drops marginal Pp; finite cost does not imply marginal moments. — Disclosed budget generalization; truncation obtains optimizer; no marginal moments inferred.
assumptions: p>=2 inherited from Lemma6.2, not restated in Lemma6.3(ii). — Disclosed budget generalization; truncation obtains optimizer; no marginal moments inferred.
quantifiers: Uniform positive heat times supported by same truncation. — One truncation and existential tuple before intro tau,q; construction independent of both.
scopes: Budget/RN-log certificate does not establish full Wasserstein/Renyi APIs. — Full metric/divergence APIs, recursive warmness and sampler/error/cost remain separate.

A generalization is not a source correction. Proposed missing conditions require separate independent repair review. No proposed repair silently changes the original theorem.

Scope and omitted-condition boundaries

Actual infimum p-cost budget and eventwise TV/RN-log certificate for the Lemma6.2 to6.3(ii) route. One proxy is fixed before all tau,q. Full Wp/Renyi API identification, marginal moment conclusions, recursive warmness and actual sampler/error/query-cost results remain separate.

Source and reuse

ASTIS parents called

Mathlib API called (external library)

Real.rpow_mul
Real.rpow_neg
MeasureTheory.Measure.map

Mathematical sources

Chen, Chewi, Lu and Zhang, SPHMC v1 Lemmas6.2 and6.3(ii) — Actual-budget composition of truncation and Gaussian reverse transport. The p>=2 condition comes from invoked Lemma6.2; Lemma6.3(ii) does not separately repeat it.

ASTIS prose is not a quotation or a source-equivalence certificate. Definitions and aliases are explained as constructions, not counted as new mathematical proofs.

Which proof edges are actually covered?

TODO — not closed by these contributions One actual probability proxy and coupling with eventwise TV and bounded displacement
TODO — not closed by these contributions Same proxy has actual RN power/integrability/log bounds for every positive time and order greater than one

Actual recursive schedule: persistent good conditioning and a terminal parameter bound

Fan Chen, Sinho Chewi, Jianfeng Lu and Matthew S. Zhang. ASTIS expanded parameter proof; no author endorsement implied.

arXiv:2609.06906v1 · Lemma6.4 (6.1), schedule(6.2), Lemma6.6 and the terminal-stage argument following(6.4) · faithful paraphrase

Complete source statement (ASTIS restatement)

For the normalized recursive RGO schedule assume κ≥1, r₀≥0, 0<c<1/4 and 0<ηⱼ≤c for every j. Define K(r)=(1+r)/(κ⁻¹+r), τ(r)=K(r) for K(r)≥2 and τ(r)=c otherwise, a(r,h)=(h+τ(r))/(1+r), and rⱼ₊₁=rⱼ+1/a(rⱼ,ηⱼ). All rⱼ are nonnegative and every rⱼ₊₁ is positive. K(rⱼ) is nonincreasing, so a stage below two stays below two at every later stage. If (4/5)^M K(r₀)<2, then for every N≥0, 0<1/r_(M+1+N)≤2c[2c/(1+2c)]^N. For every B>0, some J>0 satisfies 0<1/rⱼ≤B. These are the parameter consequences of Lemma6.4, the schedule and Lemma6.6 used in the terminal-stage argument; they do not claim the full recursive sampling theorem or its prescribed logarithmic constants.

κ≥1, r₀≥0, 0<c<1/4, and every real ηⱼ satisfies 0<ηⱼ≤c. κ≥1 retains the original α≤β condition after normalization.
K(r)=(1+r)/(κ⁻¹+r); τ(r)=K(r) if K(r)≥2 and c otherwise; a(r,h)=(h+τ(r))/(1+r); the sequence starts at r₀ and adds 1/a(rⱼ,ηⱼ) at each step. These are definitions, not supplied contraction hypotheses.
All quantities in this theorem are deterministic real parameters and natural stage indices. η may be any admissible sequence; the result can be applied to a realized sequence but constructs no measurable random sequence.
Zero initial precision represents infinite initial regularization. Only strictly positive successor precisions are interpreted as finite reciprocal variance. The parameter is not Gibbs covariance.

actual parameter schedule and terminal certificate

\[\begin{gathered}K(r)=\frac{1+r}{\kappa^{-1}+r},\quad \tau(r)=\begin{cases}K(r)&K(r)\ge2,\\c&K(r)<2,\end{cases}\\r_{j+1}=r_j+\frac{1+r_j}{\eta_j+\tau(r_j)},\quad\rho=\frac{2c}{1+2c},\\(4/5)^M K(r_0)<2\Longrightarrow 0<r_{M+1+N}^{-1}\le2c\rho^N.\end{gathered}\]

Read the formalized proofs

Each statement and proof below has its own closed Lean disclosure. ASTIS parents, Mathlib calls and external mathematical sources are distinguished in each proof.

ASTIS mathematical exposition

Actual recursive schedule: persistent good conditioning and a terminal parameter bound

AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.RecursiveDepth.parameter_control · theorem · Teaching coverage

Statement

All objects and hypotheses

κ≥1, r₀≥0, 0<c<1/4, and every real ηⱼ satisfies 0<ηⱼ≤c. κ≥1 retains the original α≤β condition after normalization.
K(r)=(1+r)/(κ⁻¹+r); τ(r)=K(r) if K(r)≥2 and c otherwise; a(r,h)=(h+τ(r))/(1+r); the sequence starts at r₀ and adds 1/a(rⱼ,ηⱼ) at each step. These are definitions, not supplied contraction hypotheses.
All quantities in this theorem are deterministic real parameters and natural stage indices. η may be any admissible sequence; the result can be applied to a realized sequence but constructs no measurable random sequence.
Zero initial precision represents infinite initial regularization. Only strictly positive successor precisions are interpreted as finite reciprocal variance. The parameter is not Gibbs covariance.

Mathematical proof

1. Positive precision and decreasing condition number

Set b=κ⁻¹. Then 0<b≤1. Every heat duration is positive; hence a>0 and r⁺>r≥0. The first successor has finite positive inverse even if r₀=0. For s≥r≥0, positive-denominator cross multiplication shows K(s)≤K(r), because the relevant residual is (s−r)(1−b)≥0. Induction gives nonnegative precisions and a nonincreasing condition sequence.

\[0<b\le1,\quad r^+>r\ge0,\qquad (s-r)(1-b)\ge0\Longrightarrow K(s)\le K(r).\]

Corresponding Lean step

Local condition_bounds, condition_antitone and precision_nonneg establish signs; condition_sequence_antitone uses antitone_nat_of_succ_le. All helper facts are internal proof steps of the one published theorem.

2. Identify the actual large-branch update

For t=η+τ>0, substitute the precision update into K and clear positive denominators. In the branch K≥2, τ=K, so the existing large-branch scalar theorem bounds the actual next K by 4K/5. No contraction is assumed.

\[K\left(r+\frac{1+r}{t}\right)=K(r)\frac{t+1}{t+K(r)},\qquad K\ge2\Longrightarrow K^+\le\frac45K.\]

Corresponding Lean step

Local ratio_update verifies the rational identity. large_branch_contraction selects the actual if-branch and calls RecursiveCondition.contraction_bounds with 0<η≤c<1/4.

3. Reach and preserve the good regime

If the condition at stage M were at least two, monotonicity would force every earlier stage to remain in the large branch. The preceding contraction and the existing geometric-sequence lemma would contradict the strict certificate. The condition then remains below two for all later indices, so every later heat duration equals c.

\[K_M\ge2\Longrightarrow K_M\le(4/5)^M K_0<2;\qquad n\ge M\Longrightarrow K_n<2.\]

Corresponding Lean step

enters_well_conditioned uses le_geom under the contradiction hypothesis; well_conditioned_persists applies the proved antitone relation. Equality K=2 is kept in the large branch.

4. Start with one genuinely finite parameter

Apply the existing small-branch variance bound at stage M. It yields a positive A_(M+1)≤2c, including when M=0 and r₀=0. The guaranteed finite starting stage for this geometric certificate is M+1; earlier stages may also have finite parameters.

\[0<A_{M+1}=r_{M+1}^{-1}\le2c.\]

Corresponding Lean step

well_branch_variance unfolds the actual c branch and calls RecursiveVariance.variance_update_bounds. The consumer test checks κ=1, r₀=0, η=c=1/8 and arbitrary subsequent N.

5. Propagate the exact geometric bound

Every later precision is positive, so the guarded reciprocal contraction is applicable. Inducting N times after the first finite stage gives A_(M+1+N)≤2cρ^N. Every such reciprocal is positive.

\[A_{j+1}\le\rho A_j,\quad 0<\rho<1\quad\Longrightarrow\quad0<A_{M+1+N}\le2c\rho^N.\]

Corresponding Lean step

The local finite_depth proof uses successor positivity before each reciprocal comparison; its index conversion identifies M+1+(N+1) with (M+1+N)+1.

6. Reach an arbitrary positive threshold

Since K₀≥1 and ρ<1, geometric powers provide M with (4/5)^M<2/K₀ and N with ρ^N<B/(2c). The preceding bound at J=M+1+N proves the threshold statement. This is an explicit geometric certificate and existential termination, not the source logarithmic-depth complexity bound.

\[J=M+1+N>0,\qquad0<A_J\le2c\rho^N<B.\]

Corresponding Lean step

exists_pow_lt_of_lt_one supplies both natural indices. The final local exists_terminal fact is combined with positivity, monotonicity, persistence and finite_depth in parameter_control.

Lean statement · parameter_control

Five local let-definitions expose the exact source schedule and Nat.rec evolution. The conclusion bundles positive precisions, antitone condition numbers, persistent strict good conditioning, the M+1+N geometric bound, and existence of a positive terminal stage.

theorem parameter_control {κ c r₀ : ℝ} {η : ℕ → ℝ}
    (hκ : 1 ≤ κ) (hc : 0 < c) (hc_upper : c < 1 / 4) (hr₀ : 0 ≤ r₀)
    (hη : ∀ n, 0 < η n ∧ η n ≤ c) :
    let K := fun r : ℝ => (1 + r) / (κ⁻¹ + r)
    let τ := fun r : ℝ => if 2 ≤ K r then K r else c
    let a := fun r h : ℝ => (h + τ r) / (1 + r)
    let step := fun r h : ℝ => r + (a r h)⁻¹
    let r : ℕ → ℝ := Nat.rec r₀ (fun j r => step r (η j))
    (∀ n, 0 ≤ r n ∧ 0 < r (n + 1)) ∧
      Antitone (fun n => K (r n)) ∧
      (∀ m n, m ≤ n → K (r m) < 2 → K (r n) < 2) ∧
      (∀ M N, (4 / 5 : ℝ)^M * K r₀ < 2 →
        0 < (r (M + 1 + N))⁻¹ ∧
        (r (M + 1 + N))⁻¹ ≤ 2 * c * (2 * c / (1 + 2 * c))^N) ∧
      (∀ B : ℝ, 0 < B → ∃ J : ℕ,
        0 < J ∧ 0 < (r J)⁻¹ ∧ (r J)⁻¹ ≤ B)

Exact module and namespace context

Lean proof · parameter_control

The former helper calculations are local have proofs, not extra public theorem claims. The two existing scalar contraction theorems and Mathlib geometric-power facts are actual proof dependencies. A separate Gibbs consumer uses the same parameters with RGOCalculus.rgo_calculus; this proves next-target probability only.

theorem parameter_control {κ c r₀ : ℝ} {η : ℕ → ℝ}
    (hκ : 1 ≤ κ) (hc : 0 < c) (hc_upper : c < 1 / 4) (hr₀ : 0 ≤ r₀)
    (hη : ∀ n, 0 < η n ∧ η n ≤ c) :
    let K := fun r : ℝ => (1 + r) / (κ⁻¹ + r)
    let τ := fun r : ℝ => if 2 ≤ K r then K r else c
    let a := fun r h : ℝ => (h + τ r) / (1 + r)
    let step := fun r h : ℝ => r + (a r h)⁻¹
    let r : ℕ → ℝ := Nat.rec r₀ (fun j r => step r (η j))
    (∀ n, 0 ≤ r n ∧ 0 < r (n + 1)) ∧
      Antitone (fun n => K (r n)) ∧
      (∀ m n, m ≤ n → K (r m) < 2 → K (r n) < 2) ∧
      (∀ M N, (4 / 5 : ℝ)^M * K r₀ < 2 →
        0 < (r (M + 1 + N))⁻¹ ∧
        (r (M + 1 + N))⁻¹ ≤ 2 * c * (2 * c / (1 + 2 * c))^N) ∧
      (∀ B : ℝ, 0 < B → ∃ J : ℕ,
        0 < J ∧ 0 < (r J)⁻¹ ∧ (r J)⁻¹ ≤ B) := by
  let condition (κ r : ℝ) : ℝ := (1 + r) / (κ⁻¹ + r)
  let heat (κ c r : ℝ) : ℝ := if 2 ≤ condition κ r then condition κ r else c
  let stepVariance (κ c r h : ℝ) : ℝ := (h + heat κ c r) / (1 + r)
  let nextPrecision (κ c r h : ℝ) : ℝ := r + (stepVariance κ c r h)⁻¹
  let precision (κ c r₀ : ℝ) (η : ℕ → ℝ) : ℕ → ℝ :=
    Nat.rec r₀ (fun j r => nextPrecision κ c r (η j))
  have condition_bounds {κ r : ℝ} (hκ : 1 ≤ κ) (hr : 0 ≤ r) :
      1 ≤ condition κ r := by
    have hkpos : 0 < κ := lt_of_lt_of_le zero_lt_one hκ
    have hbpos : 0 < κ⁻¹ := inv_pos.mpr hkpos
    have hble : κ⁻¹ ≤ 1 := (inv_le_one₀ hkpos).2 hκ
    unfold condition
    apply (one_le_div (add_pos_of_pos_of_nonneg hbpos hr)).2
    linarith

  have condition_antitone {κ r s : ℝ} (hκ : 1 ≤ κ)
      (hr : 0 ≤ r) (hrs : r ≤ s) : condition κ s ≤ condition κ r := by
    have hkpos : 0 < κ := lt_of_lt_of_le zero_lt_one hκ
    have hbpos : 0 < κ⁻¹ := inv_pos.mpr hkpos
    have hble : κ⁻¹ ≤ 1 := (inv_le_one₀ hkpos).2 hκ
    unfold condition
    apply (div_le_div_iff₀ (add_pos_of_pos_of_nonneg hbpos (hr.trans hrs))
      (add_pos_of_pos_of_nonneg hbpos hr)).2
    nlinarith [mul_nonneg (sub_nonneg.mpr hrs) (sub_nonneg.mpr hble)]

  have stepVariance_pos {κ c r h : ℝ} (_hκ : 1 ≤ κ)
      (hc : 0 < c) (hr : 0 ≤ r) (hh : 0 < h) :
      0 < stepVariance κ c r h := by
    have hheat : 0 < heat κ c r := by
      unfold heat
      split_ifs with hk
      · linarith
      · exact hc
    exact div_pos (add_pos hh hheat) (by linarith)

  have nextPrecision_gt {κ c r h : ℝ} (hκ : 1 ≤ κ)
      (hc : 0 < c) (hr : 0 ≤ r) (hh : 0 < h) :
      r < nextPrecision κ c r h := by
    exact lt_add_of_pos_right r (inv_pos.mpr (stepVariance_pos hκ hc hr hh))

  have precision_nonneg {κ c r₀ : ℝ} {η : ℕ → ℝ}
      (hκ : 1 ≤ κ) (hc : 0 < c) (hr₀ : 0 ≤ r₀) (hη : ∀ n, 0 < η n)
      (n : ℕ) : 0 ≤ precision κ c r₀ η n := by
    induction n with
    | zero => exact hr₀
    | succ n ih =>
      exact ih.trans (nextPrecision_gt hκ hc ih (hη n)).le

  have precision_succ_pos {κ c r₀ : ℝ} {η : ℕ → ℝ}
      (hκ : 1 ≤ κ) (hc : 0 < c) (hr₀ : 0 ≤ r₀) (hη : ∀ n, 0 < η n)
      (n : ℕ) : 0 < precision κ c r₀ η (n + 1) := by
    have hr := precision_nonneg hκ hc hr₀ hη n
    exact lt_of_le_of_lt hr (nextPrecision_gt hκ hc hr (hη n))

  have condition_sequence_antitone {κ c r₀ : ℝ} {η : ℕ → ℝ}
      (hκ : 1 ≤ κ) (hc : 0 < c) (hr₀ : 0 ≤ r₀) (hη : ∀ n, 0 < η n) :
      Antitone (fun n => condition κ (precision κ c r₀ η n)) := by
    apply antitone_nat_of_succ_le
    intro n
    have hr := precision_nonneg hκ hc hr₀ hη n
    exact condition_antitone hκ hr (nextPrecision_gt hκ hc hr (hη n)).le

  have well_conditioned_persists {κ c r₀ : ℝ} {η : ℕ → ℝ}
      (hκ : 1 ≤ κ) (hc : 0 < c) (hr₀ : 0 ≤ r₀) (hη : ∀ n, 0 < η n)
      {m n : ℕ} (hmn : m ≤ n) (hm : condition κ (precision κ c r₀ η m) < 2) :
      condition κ (precision κ c r₀ η n) < 2 :=
    lt_of_le_of_lt (condition_sequence_antitone hκ hc hr₀ hη hmn) hm

  have ratio_update {b r t : ℝ} (hb : 0 < b) (hr : 0 ≤ r)
      (ht : 0 < t) :
      (1 + (r + (t / (1 + r))⁻¹)) / (b + (r + (t / (1 + r))⁻¹)) =
        ((1 + r) / (b + r)) * (t + 1) / (t + (1 + r) / (b + r)) := by
    have hB : 0 < 1 + r := by linarith
    have hD : 0 < b + r := add_pos_of_pos_of_nonneg hb hr
    have hnext : 0 < b + (r + (t / (1 + r))⁻¹) := by positivity
    have hden : 0 < t + (1 + r) / (b + r) := by positivity
    rw [inv_div]
    field_simp
    ring

  have large_branch_contraction {κ c r h : ℝ}
      (hκ : 1 ≤ κ) (hr : 0 ≤ r) (hh : 0 < h) (hhc : h ≤ c)
      (hc : c < 1 / 4) (hk : 2 ≤ condition κ r) :
      condition κ (nextPrecision κ c r h) ≤ (4 / 5) * condition κ r := by
    have hkpos : 0 < κ := lt_of_lt_of_le zero_lt_one hκ
    have ht : 0 < h + condition κ r := by linarith
    have heq := ratio_update (inv_pos.mpr hkpos) hr ht
    have hb := (RecursiveCondition.contraction_bounds hk hh (lt_of_le_of_lt hhc hc)).2
    unfold nextPrecision stepVariance heat
    rw [if_pos hk]
    unfold condition at *
    rw [heq]
    convert hb using 1
    congr 1 <;> ring

  have enters_well_conditioned {κ c r₀ : ℝ} {η : ℕ → ℝ}
      (hκ : 1 ≤ κ) (hc : 0 < c) (hc_upper : c < 1 / 4) (hr₀ : 0 ≤ r₀)
      (hη : ∀ n, 0 < η n ∧ η n ≤ c) (M : ℕ)
      (hM : (4 / 5 : ℝ) ^ M * condition κ r₀ < 2) :
      condition κ (precision κ c r₀ η M) < 2 := by
    by_contra hnot
    have hlarge : 2 ≤ condition κ (precision κ c r₀ η M) := le_of_not_gt hnot
    have hanti := condition_sequence_antitone hκ hc hr₀ (fun n => (hη n).1)
    have hbound := le_geom (u := fun n => condition κ (precision κ c r₀ η n))
      (c := (4 / 5 : ℝ)) (by norm_num) M (by
        intro n hn
        have hnlarge := hlarge.trans (hanti (Nat.le_of_lt hn))
        exact large_branch_contraction hκ
          (precision_nonneg hκ hc hr₀ (fun j => (hη j).1) n)
          (hη n).1 (hη n).2 hc_upper hnlarge)
    have : condition κ (precision κ c r₀ η M) < 2 := lt_of_le_of_lt hbound hM
    exact (not_lt_of_ge hlarge) this

  have well_branch_variance {κ c r h : ℝ} (hr : 0 ≤ r)
      (hh : 0 < h) (hhc : h ≤ c) (hk : condition κ r < 2) :
      0 < (nextPrecision κ c r h)⁻¹ ∧
        (nextPrecision κ c r h)⁻¹ ≤ 2 * c ∧
        (0 < r → (nextPrecision κ c r h)⁻¹ ≤ (2 * c / (1 + 2 * c)) * r⁻¹) := by
    rcases RecursiveVariance.variance_update_bounds hr hh hhc with
      ⟨_, hpos, hbound, _, _, hcontract⟩
    unfold nextPrecision stepVariance heat
    rw [if_neg (not_le_of_gt hk)]
    exact ⟨hpos, hbound, hcontract⟩

  have finite_depth {κ c r₀ : ℝ} {η : ℕ → ℝ}
      (hκ : 1 ≤ κ) (hc : 0 < c) (hc_upper : c < 1 / 4) (hr₀ : 0 ≤ r₀)
      (hη : ∀ n, 0 < η n ∧ η n ≤ c) (M N : ℕ)
      (hM : (4 / 5 : ℝ) ^ M * condition κ r₀ < 2) :
      0 < (precision κ c r₀ η (M + 1 + N))⁻¹ ∧
        (precision κ c r₀ η (M + 1 + N))⁻¹ ≤
          2 * c * (2 * c / (1 + 2 * c)) ^ N := by
    have hm := enters_well_conditioned hκ hc hc_upper hr₀ hη M hM
    have hn (n : ℕ) := precision_nonneg hκ hc hr₀ (fun j => (hη j).1) n
    have hp (n : ℕ) := precision_succ_pos hκ hc hr₀ (fun j => (hη j).1) n
    have hw (n : ℕ) (hmn : M ≤ n) :=
      well_conditioned_persists hκ hc hr₀ (fun j => (hη j).1) hmn hm
    have hstep (n : ℕ) (hmn : M ≤ n) :=
      well_branch_variance (hn n) (hη n).1 (hη n).2 (hw n hmn)
    have hrho : 0 ≤ 2 * c / (1 + 2 * c) := by positivity
    have hbase : (precision κ c r₀ η (M + 1))⁻¹ ≤ 2 * c :=
      (hstep M le_rfl).2.1
    constructor
    · apply inv_pos.mpr
      simpa only [Nat.add_assoc, Nat.add_comm 1 N] using hp (M + N)
    · induction N with
      | zero => simpa using hbase
      | succ N ih =>
        have hs := (hstep (M + 1 + N) (by omega)).2.2
          (by simpa only [Nat.add_assoc, Nat.add_comm 1 N] using hp (M + N))
        change (precision κ c r₀ η ((M + 1 + N) + 1))⁻¹ ≤
          (2 * c / (1 + 2 * c)) * (precision κ c r₀ η (M + 1 + N))⁻¹ at hs
        calc
          (precision κ c r₀ η (M + 1 + (N + 1)))⁻¹
              ≤ (2 * c / (1 + 2 * c)) * (precision κ c r₀ η (M + 1 + N))⁻¹ :=
            by simpa only [Nat.add_assoc] using hs
          _ ≤ (2 * c / (1 + 2 * c)) * (2 * c * (2 * c / (1 + 2 * c)) ^ N) :=
            mul_le_mul_of_nonneg_left ih hrho
          _ = 2 * c * (2 * c / (1 + 2 * c)) ^ (N + 1) := by rw [pow_succ]; ring

  have exists_terminal {κ c r₀ B : ℝ} {η : ℕ → ℝ}
      (hκ : 1 ≤ κ) (hc : 0 < c) (hc_upper : c < 1 / 4) (hr₀ : 0 ≤ r₀)
      (hη : ∀ n, 0 < η n ∧ η n ≤ c) (hB : 0 < B) :
      ∃ J : ℕ, 0 < J ∧ 0 < (precision κ c r₀ η J)⁻¹ ∧
        (precision κ c r₀ η J)⁻¹ ≤ B := by
    have hK : 0 < condition κ r₀ := lt_of_lt_of_le zero_lt_one (condition_bounds hκ hr₀)
    obtain ⟨M, hM⟩ := exists_pow_lt_of_lt_one (div_pos (by norm_num : (0 : ℝ) < 2) hK)
      (by norm_num : (4 / 5 : ℝ) < 1)
    have hM' : (4 / 5 : ℝ) ^ M * condition κ r₀ < 2 := (lt_div_iff₀ hK).mp hM
    have htwo : 0 < 2 * c := by positivity
    have hrho : 2 * c / (1 + 2 * c) < 1 :=
      (div_lt_one (by positivity)).2 (by linarith)
    obtain ⟨N, hN⟩ := exists_pow_lt_of_lt_one (div_pos hB htwo) hrho
    have hN' : 2 * c * (2 * c / (1 + 2 * c)) ^ N < B := by
      simpa only [mul_comm] using (lt_div_iff₀ htwo).mp hN
    have hf := finite_depth hκ hc hc_upper hr₀ hη M N hM'
    exact ⟨M + 1 + N, by omega, hf.1, hf.2.trans hN'.le⟩

  exact ⟨fun n => ⟨precision_nonneg hκ hc hr₀ (fun j => (hη j).1) n,
      precision_succ_pos hκ hc hr₀ (fun j => (hη j).1) n⟩,
    condition_sequence_antitone hκ hc hr₀ (fun j => (hη j).1),
    fun m n hmn hm => well_conditioned_persists hκ hc hr₀
      (fun j => (hη j).1) hmn hm,
    fun M N hM => finite_depth hκ hc hc_upper hr₀ hη M N hM,
    fun B hB => exists_terminal hκ hc hc_upper hr₀ hη hB⟩

end AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.RecursiveDepth

Exact module and namespace context

Source assumptions versus formal assumptions

Source	Actual Lean	Difference kind	Why it matters
Normalized α≤β gives κ≥1; A₀∈(0,∞]; 0<ηⱼ≤c<1/4.	κ≥1, r₀≥0, 0<c<1/4 and ∀j,0<ηⱼ≤c.	same	Zero precision keeps initial infinite regularization. The source parameter range is not enlarged.
The terminal-stage argument uses Lemma6.6 and the schedule to reach its prescribed small parameter.	A pathwise Nat.rec schedule with a strict geometric certificate and J=M+1+N; arbitrary positive threshold is eventually reached.	source-implicit	Persistence and the first finite step are supplied explicitly. The logarithmic J and its universal constants are still unproved and excluded from this binding.
Recursive targets are Gibbs laws with random centers.	Only scalar parameters and arbitrary admissible smoothing sequences; Gibbs probability is checked separately with the identical update.	same	This binding isolates the deterministic parameter obligation. It asserts neither adaptive measurability nor a recursive stochastic sampler.

Only deterministic parameter evolution defined by the source schedule. No stochastic kernel or adaptive-history measurability, FORS correctness/work, recursive distributional errors, actual-input expected query cost, or complete paper. The geometric depth certificate and existence of a finite threshold-hitting stage do not establish the specified logarithmic J and universal constants in equation(6.4).

Encoder–denoiser: accepted · equivalent-after-elaboration

A generalization is not a source correction. Proposed missing conditions require separate independent repair review. No proposed repair silently changes the original theorem.

Scope and omitted-condition boundaries

Only deterministic parameter evolution defined by the source schedule. No stochastic kernel or adaptive-history measurability, FORS correctness/work, recursive distributional errors, actual-input expected query cost, or complete paper. The geometric depth certificate and existence of a finite threshold-hitting stage do not establish the specified logarithmic J and universal constants in equation(6.4).

Source and reuse

ASTIS parents called

Mathlib API called (external library)

div_le_div_iff₀
antitone_nat_of_succ_le
le_geom
exists_pow_lt_of_lt_one

Mathematical sources

Chen, Chewi, Lu and Zhang, SPHMC v1, §6.2.2–6.3 — Source parameter schedule and geometric progress; expanded ASTIS proof, not a verbatim paper proof.

ASTIS prose is not a quotation or a source-equivalence certificate. Definitions and aliases are explained as constructions, not counted as new mathematical proofs.

Which proof edges are actually covered?

TODO — not closed by these contributions Positive successor precision and decreasing actual condition numbers
TODO — not closed by these contributions Reach the good branch by a strict geometric certificate and stay there
TODO — not closed by these contributions Positive finite parameter at M+1+N, geometric bound and finite threshold attainment

Well-conditioned RGO update: finite variance and contraction

Fan Chen, Sinho Chewi, Jianfeng Lu and Matthew S. Zhang. ASTIS restatement, expanded mathematical proof and Lean formalization; no author endorsement implied.

arXiv:2609.06906v1 · Section 6.3, Lemma 6.6(ii), equations (6.1)–(6.2) · faithful paraphrase

Complete source statement (ASTIS restatement)

At a recursive stage let 0<η≤c₀<1/4. The well-conditioned branch κ_A<2 selects τ=c₀ and a=(η+c₀)/(1+A⁻¹), with A∈(0,∞]. The update (A⁺)⁻¹=A⁻¹+a⁻¹ has A⁺≤2c₀. For a finite previous A, it also satisfies A⁺≤ρ₀A, where ρ₀=2c₀/(1+2c₀)<1. These are the one-step parameter claims of Lemma 6.6(ii), not the later multi-stage algorithm theorem. ASTIS uses r=A⁻¹≥0 and proves A⁺>0 even at r=0. This selected scalar formula does not require c₀<1/4; that generalization is disclosed separately.

r≥0 is precision. A previous finite regularization variance equals 1/r only when r>0; r=0 models A=∞ without using Lean's real inverse of zero as infinity.
0<h≤c implies c>0. The source restriction c<1/4 is not needed for this selected scalar branch.
The well-conditioned branch has already selected τ=c. This theorem does not test its condition number, prove branch persistence or implement a recursive sampler.
All quantities here are real scalar parameters, not random variables or the covariance of the Gibbs distribution. No measure-theoretic hypothesis is needed for the scalar inequalities.

one-step parameter bound

\[\begin{gathered}a=\frac{h+c}{1+r},\quad r^+=r+a^{-1},\quad A^+=(r^+)^{-1},\quad \rho=\frac{2c}{1+2c},\\0<r^+,\quad0<A^+\le2c,\quad0<\rho<1,\quad r>0\Longrightarrow A^+\le\rho r^{-1}.\end{gathered}\]

Read the formalized proofs

Each statement and proof below has its own closed Lean disclosure. ASTIS parents, Mathlib calls and external mathematical sources are distinguished in each proof.

ASTIS mathematical exposition

Well-conditioned RGO update: finite variance and contraction

AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.RecursiveVariance.variance_update_bounds · theorem · Teaching coverage

Statement

For real r,h,c assume r≥0 and 0<h≤c. Define a=(h+c)/(1+r), the updated precision r⁺=r+a⁻¹, the updated regularization variance A⁺=(r⁺)⁻¹, and ρ=2c/(1+2c). Then r⁺>0, 0<A⁺≤2c and 0<ρ<1. Whenever r>0, A⁺≤ρ/r. No previous real variance is assigned to r=0: it represents the source's infinite initial parameter.

All objects and hypotheses

r≥0 is precision. A previous finite regularization variance equals 1/r only when r>0; r=0 models A=∞ without using Lean's real inverse of zero as infinity.
0<h≤c implies c>0. The source restriction c<1/4 is not needed for this selected scalar branch.
The well-conditioned branch has already selected τ=c. This theorem does not test its condition number, prove branch persistence or implement a recursive sampler.
All quantities here are real scalar parameters, not random variables or the covariance of the Gibbs distribution. No measure-theoretic hypothesis is needed for the scalar inequalities.

Mathematical proof

1. Establish positivity before using reciprocals

Put t=h+c and β=1+r. The assumptions give 0<t≤2c and β≥1. Thus a=t/β is positive, and adding its positive inverse to nonnegative precision produces r⁺>0. Its inverse is consequently a genuine finite positive parameter.

\[0<t=h+c\le2c,\quad\beta=1+r\ge1,\quad a=t/\beta>0,\quad r^+=r+1/a>0.\]

Corresponding Lean step

hc, ht, ht_upper and hbeta establish these inequalities. div_pos, inv_pos and add_pos_of_nonneg_of_pos justify every inverse; positivity closes elementary sign obligations.

2. Write the updated variance in a uniform form

Substitute a and clear the positive denominator t. The expression D=1+r+rt is at least one, so the formula also holds at r=0. At that boundary it yields A⁺=t=h+c, handling the source's infinite initial variance without finite-A division.

\[D=1+r+rt\ge1,\qquad A^+=\frac1{r+(1+r)/t}=\frac{t}{1+r+rt}=\frac tD.\]

Corresponding Lean step

hD proves denominator positivity. hformula uses inv_div and field_simp, then add_comm, to verify the identity. The focused zero-precision test checks a=Aplus=h+c, positivity and the bound.

3. Bound the first finite parameter

Since D≥1 and t>0, division by D cannot increase t. Combining this with the schedule bound proves A⁺≤2c even when the previous parameter was infinite.

\[A^+=t/D\le t\le2c.\]

Corresponding Lean step

hbound first applies le_trans and div_le_iff₀ hD. nlinarith checks the polynomial inequality using nonnegative products, with no extra analytic premise.

4. Prove a guarded finite-parameter contraction

Both D and 1+2c are positive. After multiplying by them, the desired bound rA⁺≤ρ reduces to the nonnegative residual 2c+r(2c−t). Also 2c is positive and strictly below 1+2c, so 0<ρ<1. Only when r>0 may we divide the scaled inequality by r to compare with the previous finite variance.

\[\begin{aligned}2cD-rt(1+2c)&=2c+r(2c-t)\ge0,\\rA^+&\le\frac{2c}{1+2c}=\rho\in(0,1),\\r>0&\Longrightarrow A^+\le\rho/r.\end{aligned}\]

Corresponding Lean step

hscaled uses div_le_div_iff₀ and the nonnegativity of r(2c−t). div_lt_one proves ρ<1. The final implication explicitly introduces hrpos before le_div_iff₀ is used; real 0⁻¹ never becomes a previous variance.

Lean statement · variance_update_bounds

The let-bindings preserve the update without adding wrapper definitions. All parameters are real, and three explicit inequalities suffice. The strict r>0 hypothesis is confined to the final implication; the finite updated bound covers r=0 too.

theorem variance_update_bounds {r h c : ℝ} (hr : 0 ≤ r) (hh : 0 < h)
    (hhc : h ≤ c) :
    let a := (h + c) / (1 + r)
    let rp := r + a⁻¹
    let Aplus := rp⁻¹
    let rho := 2 * c / (1 + 2 * c)
    0 < rp ∧ 0 < Aplus ∧ Aplus ≤ 2 * c ∧
      0 < rho ∧ rho < 1 ∧ (0 < r → Aplus ≤ rho * r⁻¹)

Exact module and namespace context

Lean proof · variance_update_bounds

Only Mathlib ordered-field facts and arithmetic tactics are imported. The production proof has no ASTIS dependency. A separate consumer test uses the same a,r⁺ and center in RGOCalculus.rgo_calculus, deriving an actual normalized updated Gibbs probability together with these inequalities, with no normalizer or probability premise.

theorem variance_update_bounds {r h c : ℝ} (hr : 0 ≤ r) (hh : 0 < h)
    (hhc : h ≤ c) :
    let a := (h + c) / (1 + r)
    let rp := r + a⁻¹
    let Aplus := rp⁻¹
    let rho := 2 * c / (1 + 2 * c)
    0 < rp ∧ 0 < Aplus ∧ Aplus ≤ 2 * c ∧
      0 < rho ∧ rho < 1 ∧ (0 < r → Aplus ≤ rho * r⁻¹) := by
  have hc : 0 < c := lt_of_lt_of_le hh hhc
  have ht : 0 < h + c := add_pos hh hc
  have ht_upper : h + c ≤ 2 * c := by linarith
  have hbeta : 0 < 1 + r := by positivity
  have ha : 0 < (h + c) / (1 + r) := div_pos ht hbeta
  have hrp : 0 < r + ((h + c) / (1 + r))⁻¹ :=
    add_pos_of_nonneg_of_pos hr (inv_pos.mpr ha)
  have hD : 0 < 1 + r + r * (h + c) := by positivity
  have hformula :
      (r + ((h + c) / (1 + r))⁻¹)⁻¹ =
        (h + c) / (1 + r + r * (h + c)) := by
    rw [inv_div]
    field_simp
    exact add_comm _ _
  have hbound : (h + c) / (1 + r + r * (h + c)) ≤ 2 * c := by
    apply le_trans _ ht_upper
    apply (div_le_iff₀ hD).2
    nlinarith [mul_nonneg hr ht.le, mul_nonneg ht.le (mul_nonneg hr ht.le)]
  have hrhoden : 0 < 1 + 2 * c := by positivity
  have hscaled : r * ((h + c) / (1 + r + r * (h + c))) ≤
      2 * c / (1 + 2 * c) := by
    rw [← mul_div_assoc]
    apply (div_le_div_iff₀ hD hrhoden).2
    nlinarith [mul_nonneg hr (sub_nonneg.mpr ht_upper)]
  refine ⟨hrp, inv_pos.mpr hrp, ?_, div_pos (by positivity) hrhoden, ?_, ?_⟩
  · simpa only [hformula] using hbound
  · exact (div_lt_one hrhoden).2 (by linarith)
  · intro hrpos
    rw [hformula, ← div_eq_mul_inv]
    apply (le_div_iff₀ hrpos).2
    simpa only [mul_comm] using hscaled

end AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.RecursiveVariance

Exact module and namespace context

Source assumptions versus formal assumptions

Source	Actual Lean	Difference kind	Why it matters
A∈(0,∞] and reciprocal update (6.1)	r≥0; updated precision positive; comparison with r⁻¹ guarded by r>0	source-implicit	Zero precision retains the infinite initial case. A⁺=h+c there; no totalized real inverse of zero represents infinity.
0<η≤c₀<1/4	0<h≤c, with c>0 derived	generalization	The upper restriction c<1/4 is unused in this scalar branch and is not needed for 0<ρ<1.
κ_A<2 selects τ=c₀	Already selected a=(h+c)/(1+r)	same	No condition-number test, branch persistence or full recursive process is claimed.

Only the deterministic well-conditioned parameter step of Lemma6.6(ii). The source condition-number test selects tau=c; it is not asserted by this lemma. c<1/4 is unnecessary for this scalar branch and explicitly generalized away. r^-1 represents a previous finite variance only under r>0. No finite-stage termination, implemented recursion, probability error, mixing or query cost. One-step regularization-parameter control is not a covariance estimate, a termination theorem, an error guarantee or an expected query-cost estimate.

Encoder–denoiser: accepted · domain-mismatch

Detected semantic differences

domains: The restriction c<1/4 is removed. — This is a disclosed, valid generalization of the scalar inequality, not equivalence of unrestricted parameter domains or permission to enlarge the algorithm's admissible schedule.
scopes: The formal result handles an already selected single update rather than the stage-selection machinery. — The source restatement, lesson and binding consistently restrict their claim to this component.
conclusion: Initial infinity is represented by zero precision, with a guarded finite-previous-variance comparison. — The unconditional updated bound remains valid at r=0; no real inverse of zero is interpreted as infinity.

A generalization is not a source correction. Proposed missing conditions require separate independent repair review. No proposed repair silently changes the original theorem.

Scope and omitted-condition boundaries

Only the deterministic well-conditioned parameter step of Lemma6.6(ii). The source condition-number test selects tau=c; it is not asserted by this lemma. c<1/4 is unnecessary for this scalar branch and explicitly generalized away. r^-1 represents a previous finite variance only under r>0. No finite-stage termination, implemented recursion, probability error, mixing or query cost.
One-step regularization-parameter control is not a covariance estimate, a termination theorem, an error guarantee or an expected query-cost estimate.

Source and reuse

ASTIS parents called

Mathlib API called (external library)

inv_div
div_pos
inv_pos
div_le_iff₀
div_le_div_iff₀
div_lt_one
le_div_iff₀

Mathematical sources

Fan Chen, Sinho Chewi, Jianfeng Lu and Matthew S. Zhang, SPHMC v1, §6.3, Lemma 6.6(ii), (6.1)–(6.2) — ASTIS mathematical restatement and expanded scalar derivation; no verbatim paper proof reproduced.
Mathlib contributors, Apache-2.0 — Reused ordered-field inequalities, not counted as newly formalized ASTIS leaves.

ASTIS prose is not a quotation or a source-equivalence certificate. Definitions and aliases are explained as constructions, not counted as new mathematical proofs.

Which proof edges are actually covered?

Local proof component; source adapter/review separate Positive finite updated parameter bounded by twice the schedule constant, including initial infinity
Local proof component; source adapter/review separate Exact contraction factor for a positive previous precision

Actual reference count under the recursive state law

ASTIS expanded proof component for Fan Chen, Sinho Chewi, Jianfeng Lu and Matthew S. Zhang, Smoothed Picard Hamiltonian Monte Carlo. Actual one-step reference cost with disclosed domain extensions, not a complete sampling theorem.

arXiv:2609.06906v1 · Algorithm3.3 and Section6.3: actual reference-point gradient query cost · faithful paraphrase

Complete source statement (ASTIS restatement)

The actual reference count C is jointly measurable and nonnegative. Measurability of epsilon implies measurability of B. For every state, C(s,.) is integrable under K(s) and its integral is at most B(s). For every SFinite state measure mu, the extended nonnegative integral of ofReal(C) under mu compProd K is at most the extended integral of ofReal(B) under mu. If B is mu-integrable, C is integrable under mu compProd K and its real integral is at most the real integral of B. Absorbed states have exactly zero count; the active count is the same actual N+1 used in the enhanced reference update.

E is a finite-dimensional real inner-product Borel space with d=dim(E)>0. V is C2 and its genuine Hessian satisfies alpha*norm(w)^2<=D2V(x)[w,w]<=beta*norm(w)^2, with 0<alpha<=beta.
The retained state s=(b,u,xref,k,h) belongs to NNReal x E x E x Nat x (Nat->E). eta,tau are measurable strictly positive functions of the full state. epsilon is any real-valued function; no sign or measurability is assumed globally. M is an actual Markov kernel to original-coordinate points. theta is a supplied nonnegative precision cutoff.
Set beta_s=beta+b, a_s=alpha+b, kappa_s=beta_s/a_s, v=(eta+tau)/beta_s and V_s(w)=V(w)+b/2*norm(w-u)^2. Only at active states b<theta assume W2(M(s),H_(eta/beta_s) pi_(V_s))^2<=ofReal(kappa_s*epsilon(s)^2/beta_s), where pi_(V_s) is the volume tilt by -V_s and H_t adds independent Gaussian variance t. This is the current-call accuracy input, not a supplied moment or cost bound.
For p=(s,(x,z)), set y=x+sqrt(tau/beta_s)*z, bplus=b+toNNReal(1/v), uplus=(bplus)^(-1)*(b*u+v^(-1)*y), F_p(w)=V(w)+bplus/2*norm(w-uplus)^2 and T_p(w)=w-(beta+bplus)^(-1)*grad F_p(w). N(p) is the least n with norm(grad F_p(T_p^n(x)))^2<=(alpha+bplus)*d, or zero if no such n exists. The reused parent proves finite attainment; this is its same actual program from the pre-noise x.
Define C(p)=0 if theta<=b, otherwise N(p)+1. Set kappa_plus=(beta+bplus)/(alpha+bplus) and B(s)=0 if theta<=b, otherwise 2+kappa_plus*log(1+4*(eta+tau)*(1+eta)+2*(eta+tau)*kappa_s*epsilon(s)^2/d+tau/(eta+tau)). K(s)=M(s) product G, with G the standard Gaussian probability.
For integration, mu is any SFinite measure on the full state and mu compProd K is the actual kernel composition-product integration measure. The real global bound additionally assumes Integrable B mu. A probability state law gives an expectation interpretation; the theorem does not establish that an arbitrary mu was generated by the recursive algorithm.

Actual absorbed and active reference count

\[C(s,x,z)=\begin{cases}0,&\theta\le b,\\N(s,x,z)+1,&b<\theta,\end{cases}\quad \int C(s,z)\,K(s,dz)\le B(s).\]

Read the formalized proofs

Each statement and proof below has its own closed Lean disclosure. ASTIS parents, Mathlib calls and external mathematical sources are distinguished in each proof.

ASTIS mathematical exposition

Actual reference count under the recursive state law

AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.ReferenceCarryingCost.reference_carrying_cost · theorem · Teaching coverage

Statement

\[C(s,x,z)=\begin{cases}0,&\theta\le b,\\N(s,x,z)+1,&b<\theta,\end{cases}\quad \int C(s,z)\,K(s,dz)\le B(s).\]

All objects and hypotheses

E is a finite-dimensional real inner-product Borel space with d=dim(E)>0. V is C2 and its genuine Hessian satisfies alpha*norm(w)^2<=D2V(x)[w,w]<=beta*norm(w)^2, with 0<alpha<=beta.
The retained state s=(b,u,xref,k,h) belongs to NNReal x E x E x Nat x (Nat->E). eta,tau are measurable strictly positive functions of the full state. epsilon is any real-valued function; no sign or measurability is assumed globally. M is an actual Markov kernel to original-coordinate points. theta is a supplied nonnegative precision cutoff.
Set beta_s=beta+b, a_s=alpha+b, kappa_s=beta_s/a_s, v=(eta+tau)/beta_s and V_s(w)=V(w)+b/2*norm(w-u)^2. Only at active states b<theta assume W2(M(s),H_(eta/beta_s) pi_(V_s))^2<=ofReal(kappa_s*epsilon(s)^2/beta_s), where pi_(V_s) is the volume tilt by -V_s and H_t adds independent Gaussian variance t. This is the current-call accuracy input, not a supplied moment or cost bound.
For p=(s,(x,z)), set y=x+sqrt(tau/beta_s)*z, bplus=b+toNNReal(1/v), uplus=(bplus)^(-1)*(b*u+v^(-1)*y), F_p(w)=V(w)+bplus/2*norm(w-uplus)^2 and T_p(w)=w-(beta+bplus)^(-1)*grad F_p(w). N(p) is the least n with norm(grad F_p(T_p^n(x)))^2<=(alpha+bplus)*d, or zero if no such n exists. The reused parent proves finite attainment; this is its same actual program from the pre-noise x.
Define C(p)=0 if theta<=b, otherwise N(p)+1. Set kappa_plus=(beta+bplus)/(alpha+bplus) and B(s)=0 if theta<=b, otherwise 2+kappa_plus*log(1+4*(eta+tau)*(1+eta)+2*(eta+tau)*kappa_s*epsilon(s)^2/d+tau/(eta+tau)). K(s)=M(s) product G, with G the standard Gaussian probability.
For integration, mu is any SFinite measure on the full state and mu compProd K is the actual kernel composition-product integration measure. The real global bound additionally assumes Integrable B mu. A probability state law gives an expectation interpretation; the theorem does not establish that an arbitrary mu was generated by the recursive algorithm.

Mathematical proof

1. Derive the true current curvature

Differentiate the actual quadratic regularizer twice. Its first derivative is b times the inner-product functional of w-u, and its second derivative adds b*norm(v)^2. Thus V_s is C2 with genuine Hessian interval [alpha+b,beta+b], supplying the exact hypotheses of the existing joint-reference theorem.

\[D^2V_s(w)[v,v]=D^2V(w)[v,v]+b\|v\|^2.\]

Corresponding Lean step

regularized_hessian; statewise_cost: hreg,hHs

2. Put the source precision into original coordinates

At an active state use smoothing eta/beta_s and fresh-noise variance tau/beta_s. The radius r=sqrt(kappa_s*epsilon^2/beta_s) is real and nonnegative. Its square is exactly the source squared precision budget, including epsilon=0. The parent derives the initial gradient moment and logarithmic count integrability from this W2 input; those are not extra assumptions.

\[r_s^2=\frac{\kappa_s\varepsilon_s^2}{\beta_s},\qquad \mathbb E\|\nabla V_s(X)\|^2\le\beta_s(4d+4\eta_s d+2\kappa_s\varepsilon_s^2).\]

Corresponding Lean step

statewise_cost: hb,ha,hn,H; JointReferenceGradientDescent.joint_reference_gradient_descent

3. Simplify the derived logarithmic bound

The joint-reference result integrates the actual first-hit count under M(s) product G. Its initial random-center gradient moment includes tau*d/(beta_s*v^2). Substituting v=(eta+tau)/beta_s into the complete moment expression produces the displayed explicit logarithm. No independence between the stopping index and initial gradient is assumed.

\[\mathbb E[N_s+1]\le2+\kappa_s^+\log\!\left(1+4(\eta_s+\tau_s)(1+\eta_s)+\frac{2(\eta_s+\tau_s)\kappa_s\varepsilon_s^2}{d}+\frac{\tau_s}{\eta_s+\tau_s}\right).\]

Corresponding Lean step

statewise_cost: hi,he,heq; firstIndex

4. Identify the same first hit in the enhanced state

The source potential W=V_s+norm(.-y)^2/(2v) and completed-square F differ by a spatial constant. The parent proves equality of genuine gradients and every iterate from x. Together with bplus=b+1/v this makes the threshold predicates identical for every n. Unfold the actual least-hit definition to identify Ns=N, including the definition of its fallback; the finite-hit parent ensures the fallback is not hiding failure.

\[\nabla W=\nabla F,\quad T_W^n(x)=T_F^n(x),\quad q_n^{W}=q_n^{F},\quad N_W=N_F.\]

Corresponding Lean step

reference_carrying_cost: R,hbp,hc,ha,hq,hN; ReferenceCarryingKernel.reference_carrying_kernel

5. Charge only the active branch

The existing N is jointly measurable in full state, output and noise. The measurable cutoff partitions the domain. Its absorbed branch has count zero, while the active branch charges N+1. Cast the natural count to reals and combine the two branches. Transfer the statewise bound through the proved equality of indices; the zero branch is directly integrable.

\[C=\mathbf1_{\{b<\theta\}}(N+1)\ge0,\qquad C(s,\cdot)\in L^1(K(s)).\]

Corresponding Lean step

reference_carrying_cost: hNm,hCm,hC0,K,hK,hKs,hp

6. Separate measurable budgets from integrable budgets

If epsilon is measurable, every term in B is measurable: projections, positive scales, scalar arithmetic, square, logarithm and the cutoff partition. This proves the conditional measurable-budget conclusion. It does not bound the size of B along a state law and cannot imply global L1 by itself.

\[\varepsilon\text{ measurable}\Longrightarrow B\text{ measurable}.\]

Corresponding Lean step

reference_carrying_cost: hBm; Measurable.ite

7. Integrate the actual nonnegative cost first

For each state, nonnegative count integrability identifies its nonnegative extended integral with ofReal of its real integral. Apply the actual compProd iterated-integral formula and monotonicity to the proved statewise bound. This remains a general nonnegative integral inequality if B has not been shown measurable.

\[\int^-\!\operatorname{ofReal}(C)\,d(\mu\otimes_K)\le\int^-\!\operatorname{ofReal}(B)\,d\mu.\]

Corresponding Lean step

integrate_actual_cost: hE,hE0,first branch; Measure.lintegral_compProd; ofReal_integral_eq_lintegral_ofReal

8. Obtain the real global bound only after L1

Now assume B is mu-integrable. The measurable nonnegative conditional count integral is bounded by B, so it is integrable. Nonnegativity identifies the conditional norm integral with that count integral. The compProd integrability criterion proves global C integrability, after which the real iterated-integral formula and integral monotonicity yield the bound. For a probability mu this is an expected reference cost; for arbitrary SFinite mu it is an integral bound.

\[B\in L^1(\mu)\Longrightarrow C\in L^1(\mu\otimes_K),\qquad \int C\,d(\mu\otimes_K)\le\int B\,d\mu.\]

Corresponding Lean step

integrate_actual_cost: hEi,heq,hCi; Measure.integrable_compProd_iff; Measure.integral_compProd

Lean statement · reference_carrying_cost

Actual absorbed/active reference count, conditional budget measurability, statewise L1 and explicit cost, and compProd extended/conditional real integral bounds.

theorem reference_carrying_cost [FiniteDimensional ℝ E] [MeasurableSpace E] [BorelSpace E]
    {V : E → ℝ} {α β : ℝ≥0} (hα : 0 < α) (hαβ : α ≤ β)
    (hV : ContDiff ℝ 2 V)
    (hH : ∀ x w : E, (α:ℝ)*‖w‖^2 ≤ fderiv ℝ (fderiv ℝ V) x w w ∧
      fderiv ℝ (fderiv ℝ V) x w w ≤ (β:ℝ)*‖w‖^2)
    (hd : 0 < (Module.finrank ℝ E : ℝ))
    (η τ ε : RefState E → ℝ) (hη : Measurable η) (hτ : Measurable τ)
    (hη0 : ∀ s, 0 < η s) (hτ0 : ∀ s, 0 < τ s)
    (M : Kernel (RefState E) E) [IsMarkovKernel M] (threshold : ℝ≥0)
    (hw : ∀ s : RefState E, s.1 < threshold →
      AutoSamplingTheory.TechnicalLemmas.Measure.WassersteinSpace.wassersteinDistance (M s)
        (AutoSamplingTheory.TechnicalLemmas.Measure.GaussianSmoothing.gaussianSmoothing
          ((volume : Measure E).tilted (fun x => -(V x+(s.1:ℝ)/2*‖x-s.2.1‖^2)))
          (Real.sqrt (η s/((β:ℝ)+s.1)))) ^ 2 ≤
        ENNReal.ofReal ((((β:ℝ)+s.1)/((α:ℝ)+s.1))*(ε s)^2/((β:ℝ)+s.1))) :
    let d : ℝ := Module.finrank ℝ E
    let bs := fun s : RefState E => (β:ℝ)+s.1
    let a := fun s : RefState E => (α:ℝ)+s.1
    let v := fun s => (η s+τ s)/bs s
    let bp := fun s : RefState E => s.1+Real.toNNReal (v s)⁻¹
    let obs := fun p : RefState E × (E × E) => p.2.1+Real.sqrt (τ p.1/bs p.1) • p.2.2
    let center := fun p : RefState E × (E × E) => (bp p.1:ℝ)⁻¹ •
      ((p.1.1:ℝ) • p.1.2.1+(v p.1)⁻¹ • obs p)
    let F := fun p x => V x+(bp p.1:ℝ)/2*‖x-center p‖^2
    let T := fun p x => x-((β:ℝ)+bp p.1)⁻¹ • gradient (F p) x
    let q := fun n p => ‖gradient (F p) ((T p)^[n] p.2.1)‖^2
    let N := firstIndex q (fun p => ((α:ℝ)+bp p.1)*d)
    let C := fun p : RefState E × (E × E) => if threshold ≤ p.1.1 then 0 else (N p:ℝ)+1
    let B := fun s : RefState E => if threshold ≤ s.1 then 0 else
      2+(((β:ℝ)+bp s)/((α:ℝ)+bp s))*Real.log
        (1+4*(η s+τ s)*(1+η s)+2*(η s+τ s)*(bs s/a s)*(ε s)^2/d+τ s/(η s+τ s))
    let K := M ×ₖ Kernel.const (RefState E) (stdGaussian E)
    Measurable C ∧ (Measurable ε → Measurable B) ∧ (∀ p, 0 ≤ C p) ∧
      (∀ s, Integrable (fun z => C (s,z)) (K s) ∧ (∫ z, C (s,z) ∂K s) ≤ B s) ∧
      (∀ (μ : Measure (RefState E)) [SFinite μ],
        (∫⁻ p, ENNReal.ofReal (C p) ∂μ.compProd K) ≤ ∫⁻ s, ENNReal.ofReal (B s) ∂μ ∧
          (Integrable B μ → Integrable C (μ.compProd K) ∧
            (∫ p, C p ∂μ.compProd K) ≤ ∫ s, B s ∂μ))

Exact module and namespace context

Lean proof · reference_carrying_cost

Genuine current Hessian, original-coordinate W2 input, existing actual first-hit count, source/completed-square index identity, measurable zero-cost branch and actual kernel integral calculus.

theorem reference_carrying_cost [FiniteDimensional ℝ E] [MeasurableSpace E] [BorelSpace E]
    {V : E → ℝ} {α β : ℝ≥0} (hα : 0 < α) (hαβ : α ≤ β)
    (hV : ContDiff ℝ 2 V)
    (hH : ∀ x w : E, (α:ℝ)*‖w‖^2 ≤ fderiv ℝ (fderiv ℝ V) x w w ∧
      fderiv ℝ (fderiv ℝ V) x w w ≤ (β:ℝ)*‖w‖^2)
    (hd : 0 < (Module.finrank ℝ E : ℝ))
    (η τ ε : RefState E → ℝ) (hη : Measurable η) (hτ : Measurable τ)
    (hη0 : ∀ s, 0 < η s) (hτ0 : ∀ s, 0 < τ s)
    (M : Kernel (RefState E) E) [IsMarkovKernel M] (threshold : ℝ≥0)
    (hw : ∀ s : RefState E, s.1 < threshold →
      AutoSamplingTheory.TechnicalLemmas.Measure.WassersteinSpace.wassersteinDistance (M s)
        (AutoSamplingTheory.TechnicalLemmas.Measure.GaussianSmoothing.gaussianSmoothing
          ((volume : Measure E).tilted (fun x => -(V x+(s.1:ℝ)/2*‖x-s.2.1‖^2)))
          (Real.sqrt (η s/((β:ℝ)+s.1)))) ^ 2 ≤
        ENNReal.ofReal ((((β:ℝ)+s.1)/((α:ℝ)+s.1))*(ε s)^2/((β:ℝ)+s.1))) :
    let d : ℝ := Module.finrank ℝ E
    let bs := fun s : RefState E => (β:ℝ)+s.1
    let a := fun s : RefState E => (α:ℝ)+s.1
    let v := fun s => (η s+τ s)/bs s
    let bp := fun s : RefState E => s.1+Real.toNNReal (v s)⁻¹
    let obs := fun p : RefState E × (E × E) => p.2.1+Real.sqrt (τ p.1/bs p.1) • p.2.2
    let center := fun p : RefState E × (E × E) => (bp p.1:ℝ)⁻¹ •
      ((p.1.1:ℝ) • p.1.2.1+(v p.1)⁻¹ • obs p)
    let F := fun p x => V x+(bp p.1:ℝ)/2*‖x-center p‖^2
    let T := fun p x => x-((β:ℝ)+bp p.1)⁻¹ • gradient (F p) x
    let q := fun n p => ‖gradient (F p) ((T p)^[n] p.2.1)‖^2
    let N := firstIndex q (fun p => ((α:ℝ)+bp p.1)*d)
    let C := fun p : RefState E × (E × E) => if threshold ≤ p.1.1 then 0 else (N p:ℝ)+1
    let B := fun s : RefState E => if threshold ≤ s.1 then 0 else
      2+(((β:ℝ)+bp s)/((α:ℝ)+bp s))*Real.log
        (1+4*(η s+τ s)*(1+η s)+2*(η s+τ s)*(bs s/a s)*(ε s)^2/d+τ s/(η s+τ s))
    let K := M ×ₖ Kernel.const (RefState E) (stdGaussian E)
    Measurable C ∧ (Measurable ε → Measurable B) ∧ (∀ p, 0 ≤ C p) ∧
      (∀ s, Integrable (fun z => C (s,z)) (K s) ∧ (∫ z, C (s,z) ∂K s) ≤ B s) ∧
      (∀ (μ : Measure (RefState E)) [SFinite μ],
        (∫⁻ p, ENNReal.ofReal (C p) ∂μ.compProd K) ≤ ∫⁻ s, ENNReal.ofReal (B s) ∂μ ∧
          (Integrable B μ → Integrable C (μ.compProd K) ∧
            (∫ p, C p ∂μ.compProd K) ≤ ∫ s, B s ∂μ)) := by
  classical
  intro d bs a v bp obs center F T q N C B K
  have R := AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.ReferenceCarryingKernel.reference_carrying_kernel
    hα hαβ hV hH hd η τ hη hτ hη0 hτ0 M threshold
  have hbp (s : RefState E) : (bp s:ℝ)=(s.1:ℝ)+(v s)⁻¹ := (R.1 s).2
  have hNm : Measurable N := R.2.1
  have hCm : Measurable C := by
    apply Measurable.ite (measurableSet_le measurable_const (by fun_prop)) measurable_const
    exact (measurable_from_nat.comp hNm).add measurable_const
  have hC0 (p : RefState E × (E × E)) : 0 ≤ C p := by dsimp [C]; split_ifs <;> positivity
  have hBm (hε : Measurable ε) : Measurable B := by
    dsimp [B,bp,v,bs,a]
    apply Measurable.ite (measurableSet_le measurable_const (by fun_prop)) measurable_const
    fun_prop
  have hK : IsMarkovKernel K := by dsimp [K]; infer_instance
  have hKs (s : RefState E) : K s=(M s).prod (stdGaussian E) := by
    simp only [K,Kernel.prod_apply,Kernel.const_apply]
  have hp (s : RefState E) : Integrable (fun z => C (s,z)) (K s) ∧
      (∫ z, C (s,z) ∂K s) ≤ B s := by
    by_cases hs : threshold ≤ s.1
    · simp only [C,B,if_pos hs,integrable_const,integral_const,smul_zero,le_refl,and_self]
    · have Hs := statewise_cost hα hαβ hV hH hd s.1 s.2.1 (η s) (τ s) (ε s)
        (hη0 s) (hτ0 s) (M s) (hw s (lt_of_not_ge hs))
      let W := fun z : E × E => fun x => V x+(s.1:ℝ)/2*‖x-s.2.1‖^2+
        (v s)⁻¹/2*‖x-(z.1+Real.sqrt (τ s/bs s) • z.2)‖^2
      let Ts := fun z x => x-(bs s+(v s)⁻¹)⁻¹ • gradient (W z) x
      let qs := fun n z => ‖gradient (W z) ((Ts z)^[n] z.1)‖^2
      let Ns := firstIndex qs (fun _ => (a s+(v s)⁻¹)*d)
      have hc : bs s+(v s)⁻¹=(β:ℝ)+bp s := by rw [hbp]; dsimp [bs]; ring
      have ha : a s+(v s)⁻¹=(α:ℝ)+bp s := by rw [hbp]; dsimp [a]; ring
      have hq (n : ℕ) (z : E × E) : qs n z=q n (s,z) := by
        have hz := R.2.2.2.2.1 (s,z)
        have ht := hz.2.2.2.2.2.1 n
        have hg := hz.2.2.2.2.1
        change (fun x => x-((β:ℝ)+bp s)⁻¹ • gradient (W z) x)^[n] z.1 =
          (T (s,z))^[n] z.1 at ht
        dsimp only [qs,Ts]
        rw [hc,ht]
        exact congrArg (fun w : E => ‖w‖^2) (hg _)
      have hN (z : E × E) : Ns z=N (s,z) := by
        dsimp only [Ns,N,firstIndex]
        simp only [hq,ha]
      change Integrable (fun z => (Ns z:ℝ)+1) ((M s).prod (stdGaussian E)) ∧
        (∫ z, (Ns z:ℝ)+1 ∂(M s).prod (stdGaussian E)) ≤
          2+((bs s+(v s)⁻¹)/(a s+(v s)⁻¹))*Real.log _ at Hs
      simp_rw [hN] at Hs
      simpa only [C,B,if_neg hs,hKs,hc,ha] using Hs
  exact ⟨hCm,hBm,hC0,hp,fun μ => integrate_actual_cost K C B hCm hC0
    (fun s => (hp s).1) (fun s => (hp s).2) μ⟩

end AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.ReferenceCarryingCost

Exact module and namespace context

Source assumptions versus formal assumptions

Source	Actual Lean	Difference kind	Why it matters
Source normalized Euclidean curvature setting.	General beta and coordinate-free positive dimension; b=0 allowed.	generalization	True regularized curvature is proved, not assumed.
Source current call satisfies A1.	Original-coordinate squared W2 budget required only at active states.	source-implicit	No current sampler, moment or desired count guarantee is manufactured.
Source uses positive precision parameters.	Arbitrary real epsilon function; conditional measurable epsilon implies measurable B.	generalization	Only epsilon squared is used; global integrability remains a separate condition.
Source expects cost under the execution state law.	Any SFinite mu gives an integral bound; probability mu gives expectation.	generalization	Execution provenance and globalL1 without integrable B are not claimed.
Reference GD has gradient-query cost.	Active N+1 visited checks, zero when absorbed.	source-implicit	One per-point base-gradient evaluation with check/update reuse; no evaluator or cross-call cache accounting.
Recursive algorithm includes sampler and final calls.	Same actual reference index and auxiliary compProd count, not next-state marginal or total algorithm cost.	source-implicit	Absorbed auxiliaries are zero-cost integration representation; no sampler cost, FORS or stage sum.

One-step actual reference GD cost, excluding M sampling queries, terminal FORS, cross-call cache discounts and evaluator traces. N+1 counts visited gradient checks under one evaluation per point with check/update reuse. Only active states require the supplied original-coordinate A1 W2 guarantee; no sampler achieving it is constructed. General beta, coordinate-free positive dimension, arbitrary retained states, arbitrary real epsilon and SFinite state measures are disclosed extensions. Without measurable epsilon the upper extended integral uses Mathlib general nonnegative-integral conventions, not automatically a measurable random budget. Measurable B is distinct from integrable B; global L1 requires the latter. At absorbed states the auxiliary product integration representation has zero cost and does not assert actual random draws. compProd is not the next-state marginal, and this theorem does not publicly return P. Valid execution state laws, source parameter schedule, stopping depth, accumulated costs, history invariants, full composition and both main results remain open.

Encoder–denoiser: accepted · domain-mismatch

Detected semantic differences

domains: General beta,coordinate-free,b0. — Independent formal reviewer accepted: General beta,coordinate-free,b0.
assumptions: Active original-coordinate W2 source input. — Independent formal reviewer accepted: Active original-coordinate W2 source input.
assumptions: Arbitrary real epsilon and conditional budget measurability. — Independent formal reviewer accepted: Arbitrary real epsilon and conditional budget measurability.
domains: SFinite integral generalizes probability expectation. — Independent formal reviewer accepted: SFinite integral generalizes probability expectation.
conclusion: Active visited-point count and absorbed zero,with explicit execution convention. — Independent formal reviewer accepted: Active visited-point count and absorbed zero,with explicit execution convention.
scopes: Single-step auxiliary integral,not full recursivecost. — Independent formal reviewer accepted: Single-step auxiliary integral,not full recursivecost.

A generalization is not a source correction. Proposed missing conditions require separate independent repair review. No proposed repair silently changes the original theorem.

Scope and omitted-condition boundaries

One-step actual reference GD cost, excluding M sampling queries, terminal FORS, cross-call cache discounts and evaluator traces. N+1 counts visited gradient checks under one evaluation per point with check/update reuse. Only active states require the supplied original-coordinate A1 W2 guarantee; no sampler achieving it is constructed. General beta, coordinate-free positive dimension, arbitrary retained states, arbitrary real epsilon and SFinite state measures are disclosed extensions. Without measurable epsilon the upper extended integral uses Mathlib general nonnegative-integral conventions, not automatically a measurable random budget. Measurable B is distinct from integrable B; global L1 requires the latter. At absorbed states the auxiliary product integration representation has zero cost and does not assert actual random draws. compProd is not the next-state marginal, and this theorem does not publicly return P. Valid execution state laws, source parameter schedule, stopping depth, accumulated costs, history invariants, full composition and both main results remain open.

Source and reuse

ASTIS parents called

Mathlib API called (external library)

Measurable.ite
MeasureTheory.Measure.lintegral_compProd
MeasureTheory.Measure.integrable_compProd_iff
MeasureTheory.Measure.integral_compProd
MeasureTheory.ofReal_integral_eq_lintegral_ofReal

Mathematical sources

SPHMC Algorithm3.3 and Section6.3 reference query cost — One-step actual reference GD cost, excluding M sampling queries, terminal FORS, cross-call cache discounts and evaluator traces. N+1 counts visited gradient checks under one evaluation per point with check/update reuse. Only active states require the supplied original-coordinate A1 W2 guarantee; no sampler achieving it is constructed. General beta, coordinate-free positive dimension, arbitrary retained states, arbitrary real epsilon and SFinite state measures are disclosed extensions. Without measurable epsilon the upper extended integral uses Mathlib general nonnegative-integral conventions, not automatically a measurable random budget. Measurable B is distinct from integrable B; global L1 requires the latter. At absorbed states the auxiliary product integration representation has zero cost and does not assert actual random draws. compProd is not the next-state marginal, and this theorem does not publicly return P. Valid execution state laws, source parameter schedule, stopping depth, accumulated costs, history invariants, full composition and both main results remain open.

ASTIS prose is not a quotation or a source-equivalence certificate. Definitions and aliases are explained as constructions, not counted as new mathematical proofs.

Which proof edges are actually covered?

Local proof component; source adapter/review separate Actual reference count under the recursive state law

Actual reference-carrying recursive Markov transition

ASTIS expanded proof component for Fan Chen,Sinho Chewi,Jianfeng Lu and Matthew S.Zhang,Smoothed Picard Hamiltonian Monte Carlo. Actual single-step program semantics,not a full sampling theorem.

arXiv:2609.06906v1 · Algorithm3.3 and Section6.3: actual reference-carrying recursive state transition · faithful paraphrase

Complete source statement (ASTIS restatement)

For every state,v>0 and bplus=b+1/v. N,out and update are jointly measurable. For every state/sample/noise triple,the actual stopped gradient-square is at most (alpha+bplus)*d and every earlier iterate strictly exceeds it; grad F_p(w)=grad V(w)+bplus*(w-uplus). The true source potential satisfies W_p(w)=F_p(w)+b*v^(-1)/(2*(b+v^(-1)))*norm(u-y)^2,so their gradients and all GD iterates from x with step1/(beta+bplus) coincide. The scaled reference sqrt(beta+bplus)*out has gradient-square at most d/((beta+bplus)/(alpha+bplus)) for F_p(./sqrt(beta+bplus)). There exists an actual Markov state transition P with P(s)=dirac(s) when theta<=b,and otherwise P(s)=update(s,.)#(M(s) x G). Its single-step reference-deleted marginal is dirac(project(s)) in the first branch and oldUpdate(s,.)#(M(s) x G) in the second.

E is a finite-dimensional real inner-product space with its Borel structure and d=dim(E)>0. V:E->R is C2; 0<alpha<=beta and alpha*norm(w)^2<=D2V(x)[w,w]<=beta*norm(w)^2 for every x,w.
The complete retained state is s=(b,u,xref,k,h) in NNReal x E x E x Nat x (Nat->E). The precision b is nonnegative; u and xref are original-coordinate points; k is a count and h a padded most-recent-first observation history. No admissibility or valid-history invariant is assumed for the old state.
eta,tau are measurable positive real functions of the complete retained state. M is an actual Markov kernel from that state to E, interpreted as the current sampler output in ORIGINAL coordinates BEFORE the fresh noise; no sampler accuracy or moment property is assumed. The supplied threshold theta is a nonnegative precision threshold.
For s and fresh pair (x,z), v(s)=(eta(s)+tau(s))/(beta+b), bplus=b+toNNReal(1/v(s)), y=x+sqrt(tau(s)/(beta+b))*z and uplus=(bplus)^(-1)*(b*u+v(s)^(-1)*y). The theorem proves v>0 and the real equality bplus=b+1/v, so toNNReal does not truncate.
F_p(w)=V(w)+bplus/2*norm(w-uplus)^2 and W_p(w)=V(w)+b/2*norm(w-u)^2+1/(2v)*norm(w-y)^2 for p=(s,(x,z)). Let T_p(w)=w-(beta+bplus)^(-1)*grad F_p(w), q_n(p)=norm(grad F_p(T_p^n(x)))^2. N(p) is the least n with q_n(p)<=(alpha+bplus)*d if one exists,otherwise zero. out(p)=T_p^N(p)(x),starting at the pre-noise x.
update(p)=(bplus,uplus,out(p),k+1,hplus), where hplus(0)=y and hplus(n+1)=h(n). project(s)=(b,u,k,h) removes only the reference. oldUpdate(p)=(bplus,uplus,k+1,hplus). G denotes the standard Gaussian probability on E; the product M(s) x G means the new noise is independent conditional on the complete state.

Actual enhanced transition and first-hit reference

\[P(s)=\begin{cases}\delta_s,&\theta\le b,\\ \mathrm{update}(s,\cdot)_\#(M(s)\otimes G),&b<\theta,\end{cases}\qquad \|\nabla F_p(\mathrm{out}(p))\|^2\le(\alpha+b^+)d.\]

Read the formalized proofs

Each statement and proof below has its own closed Lean disclosure. ASTIS parents, Mathlib calls and external mathematical sources are distinguished in each proof.

ASTIS mathematical exposition

Actual reference-carrying recursive Markov transition

AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.ReferenceCarryingKernel.reference_carrying_kernel · theorem · Teaching coverage

Statement

\[P(s)=\begin{cases}\delta_s,&\theta\le b,\\ \mathrm{update}(s,\cdot)_\#(M(s)\otimes G),&b<\theta,\end{cases}\qquad \|\nabla F_p(\mathrm{out}(p))\|^2\le(\alpha+b^+)d.\]

All objects and hypotheses

E is a finite-dimensional real inner-product space with its Borel structure and d=dim(E)>0. V:E->R is C2; 0<alpha<=beta and alpha*norm(w)^2<=D2V(x)[w,w]<=beta*norm(w)^2 for every x,w.
The complete retained state is s=(b,u,xref,k,h) in NNReal x E x E x Nat x (Nat->E). The precision b is nonnegative; u and xref are original-coordinate points; k is a count and h a padded most-recent-first observation history. No admissibility or valid-history invariant is assumed for the old state.
eta,tau are measurable positive real functions of the complete retained state. M is an actual Markov kernel from that state to E, interpreted as the current sampler output in ORIGINAL coordinates BEFORE the fresh noise; no sampler accuracy or moment property is assumed. The supplied threshold theta is a nonnegative precision threshold.
For s and fresh pair (x,z), v(s)=(eta(s)+tau(s))/(beta+b), bplus=b+toNNReal(1/v(s)), y=x+sqrt(tau(s)/(beta+b))*z and uplus=(bplus)^(-1)*(b*u+v(s)^(-1)*y). The theorem proves v>0 and the real equality bplus=b+1/v, so toNNReal does not truncate.
F_p(w)=V(w)+bplus/2*norm(w-uplus)^2 and W_p(w)=V(w)+b/2*norm(w-u)^2+1/(2v)*norm(w-y)^2 for p=(s,(x,z)). Let T_p(w)=w-(beta+bplus)^(-1)*grad F_p(w), q_n(p)=norm(grad F_p(T_p^n(x)))^2. N(p) is the least n with q_n(p)<=(alpha+bplus)*d if one exists,otherwise zero. out(p)=T_p^N(p)(x),starting at the pre-noise x.
update(p)=(bplus,uplus,out(p),k+1,hplus), where hplus(0)=y and hplus(n+1)=h(n). project(s)=(b,u,k,h) removes only the reference. oldUpdate(p)=(bplus,uplus,k+1,hplus). G denotes the standard Gaussian probability on E; the product M(s) x G means the new noise is independent conditional on the complete state.

Mathematical proof

1. Keep coordinates,positive scales and the actual state update explicit

The state carries the old original-coordinate reference even though it may be arbitrary. M(s) is already in original coordinates. The fresh independent noise forms y,while the GD initial point remains x. Positive beta+b and eta+tau imply v>0; the real coercion of bplus is exactly b+1/v,so the nonnegative-real representation does not alter the precision.

\[v=\frac{\eta+\tau}{\beta+b}>0,\quad y=x+\sqrt{\frac\tau{\beta+b}}z,\quad b^+=b+v^{-1},\quad u^+=(b^+)^{-1}(bu+v^{-1}y).\]

Corresponding Lean step

reference_carrying_kernel: hbeta,hv,hbp,hbp0,hvm,hbpm,hobsm,hcm

2. Prove every finite iterate jointly measurable

For any measurable state space,precision b(s),center u(s),initial state and step may all vary measurably. The true base gradient is continuous by C2. Induct on iterations of the explicit genuine regularized gradient; measurable addition,scalar multiplication and composition prove the full state-to-iterate map measurable.

\[x_{n+1}(s)=x_n(s)-\gamma(s)\bigl(\nabla V(x_n(s))+b(s)(x_n(s)-u(s))\bigr).\]

Corresponding Lean step

state_iterates; variable_reference: hgrad,hgV,hTeq,hm,hq,hevent

3. Use the strict terminal witness for the actual first inner hit

At positive bplus,the parent terminal theorem with A=1/bplus gives a finite point hitting d*bplus. Since d*bplus<=(alpha+bplus)*d,this is an existence witness for the actual inner rule. firstIndex takes the least actual hit; measurable_find and Measurable.find give the index and stopped output. Minimality gives strict failure before N. No W2 or moment premise is used,and no equality with the terminal stopping output is claimed.

\[db^+\le(\alpha+b^+)d,\quad N=\min\{n:q_n\le(\alpha+b^+)d\},\quad q_j>(\alpha+b^+)d\ (j<N).\]

Corresponding Lean step

firstIndex; stopped_family; variable_reference: ht,hs; TerminalReferenceGradientDescent.terminal_reference_gradient_descent

4. Match the source quadratic update by a genuine constant identity

Complete the square in the two true quadratic terms. The difference C depends on state and observation but not on the iteration position. Frechet derivatives ignore this additive constant,so the gradients agree and hence every finite GD iterate is identical. The start remains the same pre-noise x.

\[W_p(w)=F_p(w)+C_p,\quad C_p=\frac{b v^{-1}}{2(b+v^{-1})}\|u-y\|^2,\quad \nabla W_p=\nabla F_p.\]

Corresponding Lean step

quadratic_source_alignment: he,hg,hh; reference_carrying_kernel: hsrc; fderiv_add_const

5. Certify the next normalized reference without changing stored coordinates

The actual reference stored by update is out in original coordinates. Apply the chain rule to F(./sqrt(cplus)),where cplus=beta+bplus. The scaled gradient is cplus^(-1/2) times the original gradient. The proved first-hit threshold therefore gives d/((beta+bplus)/(alpha+bplus)) for the scaled reference.

\[\left\|\nabla\bigl[F_p(\cdot/\sqrt{c^+})\bigr](\sqrt{c^+}\,\mathrm{out})\right\|^2\le\frac{(\alpha+b^+)d}{c^+}=\frac{d}{c^+/(\alpha+b^+)}.\]

Corresponding Lean step

scaled_reference_bound; reference_carrying_kernel: hFd,hp

6. Carry the true reference and observation history together

Combine the measurable precision,center and stopped-reference maps with count increment. For each history coordinate,use the two cases n=0 and n+1 to prove measurability of prepending y. This yields a measurable full update,not just a measurable center with an untracked reference.

\[\mathrm{update}(s,x,z)=(b^+,u^+,\mathrm{out},k+1,h^+),\quad h^+(0)=y,\quad h^+(n+1)=h(n).\]

Corresponding Lean step

reference_carrying_kernel: hNm,hom,hum; measurable_pi_lambda

7. Construct the actual Markov transition and absorbing branch

Take Q=M times the constant standard-Gaussian kernel. Retain the starting state through id times Q and push through the measurable update. Each operation preserves Markov normalization. The measurable set theta<=b selects the identity kernel; its complement uses the constructed continuation kernel. Expanding the kernel map gives the displayed statewise measure formula.

\[Q=M\times G,\quad C=(\mathrm{id}\times Q).\mathrm{map}(\mathrm{update}),\quad P=\mathbf1_{\{\theta\le b\}}\mathrm{id}+\mathbf1_{\{b<\theta\}}C.\]

Corresponding Lean step

reference_carrying_kernel: Q,hQ,C,hC,hCs,D,hD,P,hP,hPs; Kernel.map_apply; Kernel.prod_apply; Kernel.piecewise_apply

8. Project only the one-step marginal

Map each P(s) by project. A stopped dirac stays the projected dirac. Otherwise map-composition removes the reference coordinate from the actual full update,leaving precisely oldUpdate. The identity is at each enhanced state; M,eta,tau may still depend on its reference. No projected-chain Markovness,history invariant or source stopping-depth claim follows.

\[\mathrm{project}_\#P(s)=\begin{cases}\delta_{\mathrm{project}(s)},&\theta\le b,\\ \mathrm{oldUpdate}(s,\cdot)_\#(M(s)\otimes G),&b<\theta.\end{cases}\]

Corresponding Lean step

reference_carrying_kernel: hproj,final projection cases; Measure.map_dirac'; Measure.map_map

Lean statement · reference_carrying_kernel

Actual variable-state first-hit reference,source quadratic trajectory identity,normalized admissibility,enhanced Markov transition and one-step projected marginal.

theorem reference_carrying_kernel {V : E → ℝ} {α β : ℝ≥0}
    (hα : 0 < α) (hαβ : α ≤ β) (hV : ContDiff ℝ 2 V)
    (hH : ∀ x w : E, (α:ℝ)*‖w‖^2 ≤ fderiv ℝ (fderiv ℝ V) x w w ∧
      fderiv ℝ (fderiv ℝ V) x w w ≤ (β:ℝ)*‖w‖^2)
    (hd : 0 < (Module.finrank ℝ E : ℝ))
    (η τ : RefState E → ℝ) (hη : Measurable η) (hτ : Measurable τ)
    (hη0 : ∀ s, 0 < η s) (hτ0 : ∀ s, 0 < τ s)
    (M : Kernel (RefState E) E) [IsMarkovKernel M] (threshold : ℝ≥0) :
    let d : ℝ := Module.finrank ℝ E
    let v := fun s : RefState E => (η s+τ s)/((β:ℝ)+s.1)
    let bp := fun s : RefState E => s.1+Real.toNNReal (v s)⁻¹
    let obs := fun p : RefState E × (E × E) => p.2.1+Real.sqrt (τ p.1/((β:ℝ)+p.1.1)) • p.2.2
    let center := fun p : RefState E × (E × E) => (bp p.1:ℝ)⁻¹ •
      ((p.1.1:ℝ) • p.1.2.1+(v p.1)⁻¹ • obs p)
    let F := fun p x => V x+(bp p.1:ℝ)/2*‖x-center p‖^2
    let W := fun p x => V x+(p.1.1:ℝ)/2*‖x-p.1.2.1‖^2+(v p.1)⁻¹/2*‖x-obs p‖^2
    let T := fun p x => x-((β:ℝ)+bp p.1)⁻¹ • gradient (F p) x
    let q := fun n p => ‖gradient (F p) ((T p)^[n] p.2.1)‖^2
    let N := firstIndex q (fun p => ((α:ℝ)+bp p.1)*d)
    let out := fun p => (T p)^[N p] p.2.1
    let update := fun p : RefState E × (E × E) =>
      (bp p.1,center p,out p,p.1.2.2.2.1+1,fun n => Nat.casesOn n (obs p) p.1.2.2.2.2)
    let project := fun s : RefState E => (s.1,s.2.1,s.2.2.2.1,s.2.2.2.2)
    let oldUpdate := fun p : RefState E × (E × E) =>
      (bp p.1,center p,p.1.2.2.2.1+1,fun n => Nat.casesOn n (obs p) p.1.2.2.2.2)
    (∀ s, 0 < v s ∧ (bp s:ℝ)=(s.1:ℝ)+(v s)⁻¹) ∧
    Measurable N ∧ Measurable out ∧ Measurable update ∧
    (∀ p, q (N p) p ≤ ((α:ℝ)+bp p.1)*d ∧
      (∀ j < N p, ((α:ℝ)+bp p.1)*d < q j p) ∧
      (∀ x, gradient (F p) x=gradient V x+(bp p.1:ℝ) • (x-center p)) ∧
      (∀ x, W p x=F p x+
        (p.1.1:ℝ)*(v p.1)⁻¹/(2*((p.1.1:ℝ)+(v p.1)⁻¹))*‖p.1.2.1-obs p‖^2) ∧
      (∀ x, gradient (W p) x=gradient (F p) x) ∧
      (∀ n, (fun x => x-((β:ℝ)+bp p.1)⁻¹ • gradient (W p) x)^[n] p.2.1 =
        (T p)^[n] p.2.1) ∧
      ‖gradient (fun x => F p ((Real.sqrt ((β:ℝ)+bp p.1))⁻¹ • x))
          (Real.sqrt ((β:ℝ)+bp p.1) • out p)‖^2 ≤
        d/(((β:ℝ)+bp p.1)/((α:ℝ)+bp p.1))) ∧
    ∃ P : Kernel (RefState E) (RefState E), IsMarkovKernel P ∧
      (∀ s, P s=if threshold ≤ s.1 then Measure.dirac s else
        ((M s).prod (stdGaussian E)).map (fun z => update (s,z))) ∧
      (∀ s, (P s).map project=if threshold ≤ s.1 then Measure.dirac (project s) else
        ((M s).prod (stdGaussian E)).map (fun z => oldUpdate (s,z)))

Exact module and namespace context

Lean proof · reference_carrying_kernel

Measurable iteration and least hitting,strict terminal witness,quadratic completion and genuine derivatives,chain rule,product-kernel pushforward and measurable absorption.

theorem reference_carrying_kernel {V : E → ℝ} {α β : ℝ≥0}
    (hα : 0 < α) (hαβ : α ≤ β) (hV : ContDiff ℝ 2 V)
    (hH : ∀ x w : E, (α:ℝ)*‖w‖^2 ≤ fderiv ℝ (fderiv ℝ V) x w w ∧
      fderiv ℝ (fderiv ℝ V) x w w ≤ (β:ℝ)*‖w‖^2)
    (hd : 0 < (Module.finrank ℝ E : ℝ))
    (η τ : RefState E → ℝ) (hη : Measurable η) (hτ : Measurable τ)
    (hη0 : ∀ s, 0 < η s) (hτ0 : ∀ s, 0 < τ s)
    (M : Kernel (RefState E) E) [IsMarkovKernel M] (threshold : ℝ≥0) :
    let d : ℝ := Module.finrank ℝ E
    let v := fun s : RefState E => (η s+τ s)/((β:ℝ)+s.1)
    let bp := fun s : RefState E => s.1+Real.toNNReal (v s)⁻¹
    let obs := fun p : RefState E × (E × E) => p.2.1+Real.sqrt (τ p.1/((β:ℝ)+p.1.1)) • p.2.2
    let center := fun p : RefState E × (E × E) => (bp p.1:ℝ)⁻¹ •
      ((p.1.1:ℝ) • p.1.2.1+(v p.1)⁻¹ • obs p)
    let F := fun p x => V x+(bp p.1:ℝ)/2*‖x-center p‖^2
    let W := fun p x => V x+(p.1.1:ℝ)/2*‖x-p.1.2.1‖^2+(v p.1)⁻¹/2*‖x-obs p‖^2
    let T := fun p x => x-((β:ℝ)+bp p.1)⁻¹ • gradient (F p) x
    let q := fun n p => ‖gradient (F p) ((T p)^[n] p.2.1)‖^2
    let N := firstIndex q (fun p => ((α:ℝ)+bp p.1)*d)
    let out := fun p => (T p)^[N p] p.2.1
    let update := fun p : RefState E × (E × E) =>
      (bp p.1,center p,out p,p.1.2.2.2.1+1,fun n => Nat.casesOn n (obs p) p.1.2.2.2.2)
    let project := fun s : RefState E => (s.1,s.2.1,s.2.2.2.1,s.2.2.2.2)
    let oldUpdate := fun p : RefState E × (E × E) =>
      (bp p.1,center p,p.1.2.2.2.1+1,fun n => Nat.casesOn n (obs p) p.1.2.2.2.2)
    (∀ s, 0 < v s ∧ (bp s:ℝ)=(s.1:ℝ)+(v s)⁻¹) ∧
    Measurable N ∧ Measurable out ∧ Measurable update ∧
    (∀ p, q (N p) p ≤ ((α:ℝ)+bp p.1)*d ∧
      (∀ j < N p, ((α:ℝ)+bp p.1)*d < q j p) ∧
      (∀ x, gradient (F p) x=gradient V x+(bp p.1:ℝ) • (x-center p)) ∧
      (∀ x, W p x=F p x+
        (p.1.1:ℝ)*(v p.1)⁻¹/(2*((p.1.1:ℝ)+(v p.1)⁻¹))*‖p.1.2.1-obs p‖^2) ∧
      (∀ x, gradient (W p) x=gradient (F p) x) ∧
      (∀ n, (fun x => x-((β:ℝ)+bp p.1)⁻¹ • gradient (W p) x)^[n] p.2.1 =
        (T p)^[n] p.2.1) ∧
      ‖gradient (fun x => F p ((Real.sqrt ((β:ℝ)+bp p.1))⁻¹ • x))
          (Real.sqrt ((β:ℝ)+bp p.1) • out p)‖^2 ≤
        d/(((β:ℝ)+bp p.1)/((α:ℝ)+bp p.1))) ∧
    ∃ P : Kernel (RefState E) (RefState E), IsMarkovKernel P ∧
      (∀ s, P s=if threshold ≤ s.1 then Measure.dirac s else
        ((M s).prod (stdGaussian E)).map (fun z => update (s,z))) ∧
      (∀ s, (P s).map project=if threshold ≤ s.1 then Measure.dirac (project s) else
        ((M s).prod (stdGaussian E)).map (fun z => oldUpdate (s,z))) := by
  classical
  intro d v bp obs center F W T q N out update project oldUpdate
  have hβ : 0 < (β:ℝ) := lt_of_lt_of_le (show 0 < (α:ℝ) from hα) (show (α:ℝ) ≤ β from hαβ)
  have hv (s : RefState E) : 0 < v s :=
    div_pos (add_pos (hη0 s) (hτ0 s)) (add_pos_of_pos_of_nonneg hβ s.1.coe_nonneg)
  have hbp (s : RefState E) : (bp s:ℝ)=(s.1:ℝ)+(v s)⁻¹ := by
    simp only [bp,NNReal.coe_add,Real.coe_toNNReal _ (inv_pos.mpr (hv s)).le]
  have hbp0 (s : RefState E) : 0 < (bp s:ℝ) := by
    rw [hbp]
    exact add_pos_of_nonneg_of_pos s.1.coe_nonneg (inv_pos.mpr (hv s))
  have hvm : Measurable v := by dsimp [v]; fun_prop
  have hbpm : Measurable bp := by dsimp [bp]; fun_prop
  have hobsm : Measurable obs := by dsimp [obs]; fun_prop
  have hcm : Measurable center := by dsimp [center]; fun_prop
  have hbpm' : Measurable (fun p : RefState E × (E × E) => (bp p.1:ℝ)) := by fun_prop
  have href := variable_reference hV hH hαβ hd hbpm' (fun p => hbp0 p.1) hcm
    (by fun_prop : Measurable (fun p : RefState E × (E × E) => p.2.1))
  have hNm : Measurable N := href.1
  have hom : Measurable out := href.2.1
  have hum : Measurable update := by
    dsimp [update]
    apply Measurable.prodMk (by fun_prop)
    apply Measurable.prodMk hcm
    apply Measurable.prodMk hom
    apply Measurable.prodMk (by fun_prop)
    apply measurable_pi_lambda
    intro n
    cases n <;> fun_prop
  have hproj : Measurable project := by dsimp [project]; fun_prop
  refine ⟨fun s => ⟨hv s,hbp s⟩,hNm,hom,hum,?_,?_⟩
  · intro p
    have hp := href.2.2.2 p
    have hs := quadratic_source_alignment V p.1.1.coe_nonneg (inv_pos.mpr (hv p.1)) p.1.2.1 (obs p)
    have hsrc :
        (∀ x, W p x=F p x+(p.1.1:ℝ)*(v p.1)⁻¹/(2*((p.1.1:ℝ)+(v p.1)⁻¹))*‖p.1.2.1-obs p‖^2) ∧
        (∀ x, gradient (W p) x=gradient (F p) x) ∧
        ∀ (h : ℝ) (n : ℕ) (x : E),
          (fun z => z-h • gradient (W p) z)^[n] x=(fun z => z-h • gradient (F p) z)^[n] x := by
      simpa only [F,W,center,hbp] using hs
    refine ⟨hp.1,hp.2,href.2.2.1 p,hsrc.1,hsrc.2.1,fun n => hsrc.2.2 _ n _,?_⟩
    have hFd : Differentiable ℝ (F p) :=
      (hV.add (contDiff_const.mul ((contDiff_id.sub contDiff_const).norm_sq (𝕜:=ℝ)))).differentiable
        (by norm_num)
    exact scaled_reference_bound hFd (add_pos_of_pos_of_nonneg hβ (bp p.1).coe_nonneg) hp.1
  · let Q : Kernel (RefState E) (E × E) := M ×ₖ Kernel.const _ (stdGaussian E)
    have hQ : IsMarkovKernel Q := by dsimp [Q]; infer_instance
    let C := (Kernel.id ×ₖ Q).map update
    have hC : IsMarkovKernel C := Kernel.IsMarkovKernel.map _ hum
    have hCs (s : RefState E) : C s=((M s).prod (stdGaussian E)).map (fun z => update (s,z)) := by
      dsimp only [C]
      rw [Kernel.map_apply _ hum,Kernel.prod_apply,Kernel.id_apply,Measure.dirac_prod,
        Measure.map_map hum (by fun_prop)]
      simp only [Q,Kernel.prod_apply,Kernel.const_apply]
      rfl
    let D : Set (RefState E) := {s | threshold ≤ s.1}
    have hD : MeasurableSet D := measurableSet_le measurable_const (by fun_prop)
    let P := Kernel.piecewise hD Kernel.id C
    have hP : IsMarkovKernel P := by dsimp [P]; infer_instance
    have hPs (s : RefState E) : P s=if threshold ≤ s.1 then Measure.dirac s else
        ((M s).prod (stdGaussian E)).map (fun z => update (s,z)) := by
      simp only [P,Kernel.piecewise_apply,D,mem_ofPred_eq,Kernel.id_apply,hCs]
    refine ⟨P,hP,hPs,fun s => ?_⟩
    rw [hPs]
    by_cases hs : threshold ≤ s.1
    · rw [if_pos hs,if_pos hs,Measure.map_dirac' hproj]
    · have hm : Measurable (fun z : E × E => update (s,z)) := hum.comp measurable_prodMk_left
      rw [if_neg hs,if_neg hs,Measure.map_map hproj hm]
      rfl

end AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.ReferenceCarryingKernel

Exact module and namespace context

Source assumptions versus formal assumptions

Source	Actual Lean	Difference kind	Why it matters
Source current sampler output is followed by fresh Gaussian noise.	Actual M is in original coordinates; GD starts before fresh noise.	same	Original coordinate convention is explicit; M is Markov but no accuracy premise is supplied.
Source next reference uses the inner gradient threshold.	Actual first(alpha+bplus)*d hit; strictterminal witness only.	same	No supplied reference or substitution of terminal stopping output.
Normalized Euclidean recursive setting.	General beta,coordinate-free d>0,alpha/eta/taupositive,b0allowed.	generalization	Domain extension is explicit and zero dimension excluded.
Source precision stopping condition uses an actual cutoff.	Supplied nonnegative theta; positive precision-threshold interpretation,theta0 immediateabsorption.	source-implicit	Exact source cutoff and finite reachability are not proved; selfloop is not FORS or finaloutput.
References and histories arise along a valid source execution.	Arbitrary previous reference,count and history admitted.	generalization	New reference is proved admissible; initial history invariants are not assumed or concluded.
Recursive state tracks actual source updates.	Explicit Markov enhanced transition and single-step projection only.	source-implicit	Dependence on deleted reference blocks automatic projected-chain Markovness; no accuracy or costs.

Actual single-step enhanced Markov program,not a sampler-accuracy or cost theorem. M outputs and stored reference are in original coordinates. theta is supplied: positive theta corresponds to A<=Abar iff b>=1/Abar; exact source threshold and finite reachability remain open. theta=0 immediately absorbs. Terminal self-loop neither runs FORS nor returns a final sample. Old reference admissibility and valid initial history are not required. General beta and coordinate-free positive dimension extend the normalized source; alpha,eta,tau are positive,b may be zero. Since M,eta,tau can depend on the deleted reference,one-step projection does not imply that the whole projected process is Markov. No conditional precision,query count,tail,full Gibbs normalization or either main result is concluded.

Encoder–denoiser: accepted · domain-mismatch

Detected semantic differences

objects: Original-coordinate output and pre-noise GD initial point. — Independent source reviewer accepted disclosed difference: Original-coordinate output and pre-noise GD initial point.
conclusion: Actual inner first-hit and stricter finite witness. — Independent source reviewer accepted disclosed difference: Actual inner first-hit and stricter finite witness.
domains: General beta,coordinate-free space,b=0. — Independent source reviewer accepted disclosed difference: General beta,coordinate-free space,b=0.
assumptions: Supplied nonnegative cutoff and zero immediate absorption. — Independent source reviewer accepted disclosed difference: Supplied nonnegative cutoff and zero immediate absorption.
domains: Arbitrary old reference and history. — Independent source reviewer accepted disclosed difference: Arbitrary old reference and history.
scopes: Enhanced Markov kernel and single-step projection. — Independent source reviewer accepted disclosed difference: Enhanced Markov kernel and single-step projection.

A generalization is not a source correction. Proposed missing conditions require separate independent repair review. No proposed repair silently changes the original theorem.

Scope and omitted-condition boundaries

Actual single-step enhanced Markov program,not a sampler-accuracy or cost theorem. M outputs and stored reference are in original coordinates. theta is supplied: positive theta corresponds to A<=Abar iff b>=1/Abar; exact source threshold and finite reachability remain open. theta=0 immediately absorbs. Terminal self-loop neither runs FORS nor returns a final sample. Old reference admissibility and valid initial history are not required. General beta and coordinate-free positive dimension extend the normalized source; alpha,eta,tau are positive,b may be zero. Since M,eta,tau can depend on the deleted reference,one-step projection does not imply that the whole projected process is Markov. No conditional precision,query count,tail,full Gibbs normalization or either main result is concluded.

Source and reuse

ASTIS parents called

Mathlib API called (external library)

measurable_find
Measurable.find
fderiv_add_const
ProbabilityTheory.Kernel.map_apply
ProbabilityTheory.Kernel.prod_apply
ProbabilityTheory.Kernel.piecewise_apply
MeasureTheory.Measure.map_map

Mathematical sources

SPHMC Algorithm3.3 and Section6.3 actual next reference — Actual single-step enhanced Markov program,not a sampler-accuracy or cost theorem. M outputs and stored reference are in original coordinates. theta is supplied: positive theta corresponds to A<=Abar iff b>=1/Abar; exact source threshold and finite reachability remain open. theta=0 immediately absorbs. Terminal self-loop neither runs FORS nor returns a final sample. Old reference admissibility and valid initial history are not required. General beta and coordinate-free positive dimension extend the normalized source; alpha,eta,tau are positive,b may be zero. Since M,eta,tau can depend on the deleted reference,one-step projection does not imply that the whole projected process is Markov. No conditional precision,query count,tail,full Gibbs normalization or either main result is concluded.

ASTIS prose is not a quotation or a source-equivalence certificate. Definitions and aliases are explained as constructions, not counted as new mathematical proofs.

Which proof edges are actually covered?

Local proof component; source adapter/review separate Actual reference-carrying recursive Markov transition

One actual RGO backward kernel: precision update, recovery and KL control

Fan Chen, Sinho Chewi, Jianfeng Lu and Matthew S. Zhang; ASTIS expanded proof, no author endorsement implied.

arXiv:2609.06906v1 · Section3.4, Lemma6.4 equation(6.1), Theorem6.5 exact RGO backward step · faithful paraphrase

Complete source statement (ASTIS restatement)

Let mu be a probability measure on a finite-dimensional real inner-product Borel space, b>=0, a>0 and u a point. Define rho as mu tilted by -b*norm(x-u)^2/2. Then rho is a probability measure and there exists one Markov kernel K, chosen before every input law and radius, with K(y)=rho.tilted(-norm(x-y)^2/(2a)) at every y, equivalently mu tilted with precision b+a^-1 and center (b+a^-1)^-1 times (b*u+a^-1*y). The actual composition K with GaussianSmoothing rho sqrt(a) equals rho. For all probability nu and r>=0 with actual infimum quadratic displacement cost from nu to rho at most ofReal(r^2), the actual KL of K composed with GaussianSmoothing nu sqrt(a) relative to rho is at most ofReal(r^2/(2a)).

Finite-dimensional real inner-product Borel space, including dimension zero; mu is a probability measure.
b>=0, a>0 and arbitrary u. Precision b=0 retains the source A=infinity case.
The kernel is selected before all probability inputs nu and radii r>=0. The budget is transportCost(nu,rho), in that direction.
General probability base abstracts the source Gibbs presentation; no concrete potential identification is included.
Actual raw infimum cost is used, without inferring marginal P2 membership or claiming full W2 API correspondence.

Actual backward recovery and KL input guarantee

\[K_aH_a\rho=\rho,\qquad \inf_{\gamma\in\Pi(\nu,\rho)}\int\|x-y\|^2d\gamma\le r^2\ \Longrightarrow\ \operatorname{KL}(K_aH_a\nu\|\rho)\le\frac{r^2}{2a}.\]

Read the formalized proofs

Each statement and proof below has its own closed Lean disclosure. ASTIS parents, Mathlib calls and external mathematical sources are distinguished in each proof.

ASTIS mathematical exposition

One actual RGO backward kernel: precision update, recovery and KL control

AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.RGOBackward.rgo_backward_recovery · theorem · Teaching coverage

Statement

\[K_aH_a\rho=\rho,\qquad \inf_{\gamma\in\Pi(\nu,\rho)}\int\|x-y\|^2d\gamma\le r^2\ \Longrightarrow\ \operatorname{KL}(K_aH_a\nu\|\rho)\le\frac{r^2}{2a}.\]

All objects and hypotheses

Finite-dimensional real inner-product Borel space, including dimension zero; mu is a probability measure.
b>=0, a>0 and arbitrary u. Precision b=0 retains the source A=infinity case.
The kernel is selected before all probability inputs nu and radii r>=0. The budget is transportCost(nu,rho), in that direction.
General probability base abstracts the source Gibbs presentation; no concrete potential identification is included.
Actual raw infimum cost is used, without inferring marginal P2 membership or claiming full W2 API correspondence.

Mathematical proof

1. Normalize the initial quadratic tilt

The exponential weight is positive and at most one. Its integrability under the probability base proves that the normalized tilted law rho is a probability, including zero precision.

\[0<e^{-b\|x-u\|^2/2}\le1,\qquad \rho=\frac{e^{-b\|x-u\|^2/2}\mu}{\int e^{-b\|x-u\|^2/2}d\mu}.\]

Corresponding Lean step

hi and isProbabilityMeasure_tilted derive hρ; no normalizer premise.

2. Construct the same measurable backward kernel

Apply the existing actual Gaussian conditional-kernel construction to rho. It supplies a Markov kernel with a normalized fiber at every y, and disintegrates the swapped joint law of (X,X+sqrt(a)Z).

\[J=\mathcal L(X,X+\sqrt a Z),\quad K(y,dx)\propto e^{-\|x-y\|^2/(2a)}\rho(dx).\]

Corresponding Lean step

GaussianConditionalKernel.exists_tilted_isCondKernel provides hK, hfiber and hcond.

3. Identify actual forward and backward marginals

The first marginal of J is rho. Product-map composition identifies its second marginal with the existing GaussianSmoothing operator. These are actual pushforward equalities, not assumed stochastic semantics.

\[J_1=\rho,\qquad J_2=H_a\rho.\]

Corresponding Lean step

hfst uses fst_map_prodMk and fst_prod; hsnd uses snd_map_prodMk, map_prod_map and map_map.

4. Recover the target by disintegration

Take the second marginal of the disintegration identity for the swapped joint law. That second marginal is the original target, while its first marginal is the noisy law. This proves exact recovery for the constructed kernel.

\[(H_a\rho)\otimes K=\operatorname{swap}_\#J\quad\Longrightarrow\quad K H_a\rho=\rho.\]

Corresponding Lean step

congrArg Measure.snd hcond.disintegrate; snd_compProd, fst_map_swap and snd_map_swap.

5. Identify every normalized source precision update

Write the backward precision as a^-1 and apply normalized quadratic tilt composition to the same kernel fiber. The summed precision is positive, so the updated center is valid even when b=0.

\[b^+=b+a^{-1},\quad u^+(y)=(b+a^{-1})^{-1}(bu+a^{-1}y),\quad K(y)=\mu.\mathrm{tilted}(-b^+\|x-u^+(y)\|^2/2).\]

Corresponding Lean step

hfiber, exact denominator algebra and RGOClosure.quadratic_tilt_tilt with inv_pos.mpr ha.

6. Propagate the actual input KL budget

For any admissible input, derive probability of the smoothed measures, apply KL contraction through the same Markov kernel, substitute exact recovery, and invoke the already proved Gaussian KL reverse-transport bound.

\[\operatorname{KL}(K H_a\nu\|\rho)\le\operatorname{KL}(H_a\nu\|H_a\rho)\le r^2/(2a).\]

Corresponding Lean step

InformationTheory.klDiv_comp_right_le and GaussianKL.gaussian_kl_reverse_transport; no approximate kernel or unbounded-cost transfer.

Lean statement · rgo_backward_recovery

One actual Markov kernel has every-point normalized precision update, exact recovery, and all quadratic-budget KL guarantees.

theorem rgo_backward_recovery {E : Type*} [NormedAddCommGroup E] [InnerProductSpace ℝ E]
    [FiniteDimensional ℝ E] [MeasurableSpace E] [BorelSpace E]
    (μ : Measure E) [IsProbabilityMeasure μ] (b a : ℝ) (hb : 0 ≤ b) (ha : 0 < a) (u : E) :
    let ρ := μ.tilted (fun x => -(b/2)*‖x-u‖^2)
    IsProbabilityMeasure ρ ∧ ∃ K : Kernel E E, IsMarkovKernel K ∧
      (∀ y, K y = ρ.tilted (fun x => -‖x-y‖^2/(2*a))) ∧
      (∀ y, K y = μ.tilted (fun x => -((b+a⁻¹)/2)*
        ‖x-(b+a⁻¹)⁻¹ • (b • u+a⁻¹ • y)‖^2)) ∧
      K ∘ₘ GaussianSmoothing.gaussianSmoothing ρ (Real.sqrt a) = ρ ∧
      ∀ (ν : Measure E), IsProbabilityMeasure ν → ∀ r : ℝ, 0 ≤ r →
        Transport.transportCost (fun z : E × E => ENNReal.ofReal (‖z.1-z.2‖^2)) ν ρ ≤
          ENNReal.ofReal (r^2) →
        InformationTheory.klDiv (K ∘ₘ GaussianSmoothing.gaussianSmoothing ν (Real.sqrt a)) ρ ≤
          ENNReal.ofReal (r^2/(2*a))

Exact module and namespace context

Lean proof · rgo_backward_recovery

Actual Gaussian disintegration and marginal identities, normalized tilt composition, then same-kernel KL data processing.

theorem rgo_backward_recovery {E : Type*} [NormedAddCommGroup E] [InnerProductSpace ℝ E]
    [FiniteDimensional ℝ E] [MeasurableSpace E] [BorelSpace E]
    (μ : Measure E) [IsProbabilityMeasure μ] (b a : ℝ) (hb : 0 ≤ b) (ha : 0 < a) (u : E) :
    let ρ := μ.tilted (fun x => -(b/2)*‖x-u‖^2)
    IsProbabilityMeasure ρ ∧ ∃ K : Kernel E E, IsMarkovKernel K ∧
      (∀ y, K y = ρ.tilted (fun x => -‖x-y‖^2/(2*a))) ∧
      (∀ y, K y = μ.tilted (fun x => -((b+a⁻¹)/2)*
        ‖x-(b+a⁻¹)⁻¹ • (b • u+a⁻¹ • y)‖^2)) ∧
      K ∘ₘ GaussianSmoothing.gaussianSmoothing ρ (Real.sqrt a) = ρ ∧
      ∀ (ν : Measure E), IsProbabilityMeasure ν → ∀ r : ℝ, 0 ≤ r →
        Transport.transportCost (fun z : E × E => ENNReal.ofReal (‖z.1-z.2‖^2)) ν ρ ≤
          ENNReal.ofReal (r^2) →
        InformationTheory.klDiv (K ∘ₘ GaussianSmoothing.gaussianSmoothing ν (Real.sqrt a)) ρ ≤
          ENNReal.ofReal (r^2/(2*a)) := by
  have backward_core (μ : Measure E) [IsProbabilityMeasure μ] (a : ℝ) (ha : 0 < a) :
      ∃ K : Kernel E E, IsMarkovKernel K ∧
        (∀ y, K y = μ.tilted (fun x => -‖x-y‖^2/(2*a))) ∧
        K ∘ₘ GaussianSmoothing.gaussianSmoothing μ (Real.sqrt a) = μ := by
    obtain ⟨K, hK, hfiber, hcond⟩ := GaussianConditionalKernel.exists_tilted_isCondKernel μ ha
    let := hK
    let J := Measure.map (fun p : E × E => (p.1, p.1 + Real.sqrt a • p.2))
      (μ.prod (stdGaussian E))
    have hfst : J.fst = μ := by
      dsimp [J]
      rw [Measure.fst_map_prodMk (by fun_prop)]
      exact Measure.fst_prod
    have hsnd : J.snd = GaussianSmoothing.gaussianSmoothing μ (Real.sqrt a) := by
      dsimp [J]
      rw [Measure.snd_map_prodMk measurable_fst]
      unfold GaussianSmoothing.gaussianSmoothing CommonNoiseContraction.addNoise
        GaussianSmoothing.scaledStdGaussian
      have hp := Measure.map_prod_map μ (stdGaussian E) measurable_id
        (show Measurable (fun z : E => Real.sqrt a • z) by fun_prop)
      rw [Measure.map_id] at hp
      rw [hp, Measure.map_map (by fun_prop) (by fun_prop)]
      rfl
    have : IsProbabilityMeasure J := Measure.isProbabilityMeasure_map (by fun_prop)
    have hd : (J.map Prod.swap).fst ⊗ₘ K = J.map Prod.swap := hcond.disintegrate
    have heq := congrArg Measure.snd hd
    rw [Measure.snd_compProd, Measure.fst_map_swap, Measure.snd_map_swap, hfst, hsnd] at heq
    exact ⟨K, hK, hfiber, heq⟩
  dsimp only
  let ρ := μ.tilted (fun x => -(b/2)*‖x-u‖^2)
  have hi : Integrable (fun x => Real.exp (-(b/2)*‖x-u‖^2)) μ := by
    refine (integrable_const (1 : ℝ)).mono' (by fun_prop) ?_
    filter_upwards [] with x
    rw [Real.norm_eq_abs, abs_of_pos (Real.exp_pos _)]
    apply Real.exp_le_one_iff.mpr
    exact mul_nonpos_of_nonpos_of_nonneg (neg_nonpos.mpr (by positivity)) (sq_nonneg _)
  have hρ : IsProbabilityMeasure ρ := isProbabilityMeasure_tilted hi
  let := hρ
  obtain ⟨K, hK, hfiber, hrecover⟩ := backward_core ρ a ha
  let := hK
  refine ⟨hρ, K, hK, hfiber, ?_, hrecover, ?_⟩
  · intro y
    rw [hfiber]
    have halg : (fun x : E => -‖x-y‖^2/(2*a)) = (fun x => -(a⁻¹/2)*‖x-y‖^2) := by
      funext x
      field_simp
    rw [halg]
    exact RGOClosure.quadratic_tilt_tilt μ hb (inv_pos.mpr ha) u y
  · intro ν hν r hr hcost
    let := hν
    have hkl := GaussianKL.gaussian_kl_reverse_transport ν ρ r a hr ha hcost
    have hsmooth (η : Measure E) [IsProbabilityMeasure η] :
        IsProbabilityMeasure (GaussianSmoothing.gaussianSmoothing η (Real.sqrt a)) := by
      unfold GaussianSmoothing.gaussianSmoothing CommonNoiseContraction.addNoise
      exact Measure.isProbabilityMeasure_map (by fun_prop)
    let := hsmooth ν
    let := hsmooth ρ
    have hdata := InformationTheory.klDiv_comp_right_le
      (GaussianSmoothing.gaussianSmoothing ν (Real.sqrt a))
      (GaussianSmoothing.gaussianSmoothing ρ (Real.sqrt a)) K
    rw [hrecover] at hdata
    exact hdata.trans hkl
end AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.RGOBackward

Exact module and namespace context

Source assumptions versus formal assumptions

Source	Actual Lean	Difference kind	Why it matters
Source RGO is defined for Gibbs potentials with the stated regularity and curvature assumptions.	An arbitrary probability base, followed by a normalized nonnegative quadratic-precision tilt.	generalization	The normalized kernel and parameter-update identity need only a probability base. Concrete Gibbs-potential identification and curvature guarantees are not asserted.
Equation(6.1) uses A inverse plus a inverse and its precision-weighted center, including A=infinity.	b>=0,a>0; updated precision b+a^-1 and center (b+a^-1)^-1(bu+a^-1*y), every y for the same Markov kernel.	same	Zero b retains infinite A and positive a ensures positive updated precision.
Theorem6.5 exact R_j=P_j K_j and Gaussian regularization are used within a recursive sampling proof.	Actual backward disintegration, noisy marginal identification, exact recovery and same-kernel KL guarantee for all admissible inputs.	source-implicit	No target recovery or conditional law premise is added; existing every-point measurable construction is consumed.
Gaussian KL input control is presented with Euclidean marginal P2 membership and W2.	Finite-dimensional inner-product Borel spaces including zero dimension and an actual infimum quadratic transport-cost budget.	generalization	No marginal moments are inferred; full W2 correspondence remains separate.
The full algorithm uses approximate recursive kernels, actual stage parameters, error accumulation and query costs.	Exact backward kernel consumer only, selected before all input laws and budgets.	API-limitation	No approximate sampler construction, measurable proxy selection, convolution-time identification or expected-cost result follows from this packet.

General probability-base abstraction of the source regularized Gibbs target and actual raw quadratic transport budget. The same measurable exact kernel has every-point precision-update fibers and target recovery. No concrete Gibbs-potential identification, marginal moment inference, approximate recursive sampler, measurable proxy selection, convolution time identification or expected query cost is asserted.

Encoder–denoiser: accepted · domain-mismatch

Detected semantic differences

domains: General probability base abstracts concrete Gibbs potential. — No potential, density, curvature or positive-dimension premise; abstraction disclosed.
assumptions: Raw quadratic budget neither requires nor establishes marginal P2. — Positive bounded weights prove normalization; proved kernel supplies measurability; no marginal moment inference.
quantifiers: K measurable in y and fixed before nu,r; no jointly measurable parameter selection. — Same K in both fibers, recovery and KL; no joint measurable selection across target parameters.
scopes: Exact backward kernel only, not approximate recursive sampler or costs. — No concrete Gibbs identification, approximate recursion, parameter-joint selection or full algorithm guarantee.

A generalization is not a source correction. Proposed missing conditions require separate independent repair review. No proposed repair silently changes the original theorem.

Scope and omitted-condition boundaries

General probability-base abstraction of the source regularized Gibbs target and actual raw quadratic transport budget. The same measurable exact kernel has every-point precision-update fibers and target recovery. No concrete Gibbs-potential identification, marginal moment inference, approximate recursive sampler, measurable proxy selection, convolution time identification or expected query cost is asserted.

Source and reuse

ASTIS parents called

Mathlib API called (external library)

MeasureTheory.Measure.snd_compProd
MeasureTheory.Measure.IsCondKernel.disintegrate
InformationTheory.klDiv_comp_right_le
MeasureTheory.isProbabilityMeasure_tilted

Mathematical sources

Chen, Chewi, Lu and Zhang, SPHMC v1 Lemma6.4 and Theorem6.5 — Exact backward RGO semantics and its input KL guarantee; approximate recursive sampler remains separate.

ASTIS prose is not a quotation or a source-equivalence certificate. Definitions and aliases are explained as constructions, not counted as new mathematical proofs.

Which proof edges are actually covered?

TODO — not closed by these contributions Same actual backward kernel: every-point precision update, exact recovery and input KL guarantee

RGO calculus: curvature, normalized target and condition-number update

Fan Chen, Sinho Chewi, Jianfeng Lu and Matthew S. Zhang. ASTIS restatement, expanded mathematical proof and Lean formalization; no author endorsement implied.

arXiv:2609.06906v1 · Section6.2.2, Lemma6.4 and equation(6.1) · faithful paraphrase

Complete source statement (ASTIS restatement)

For a C² potential U on Euclidean space satisfying κ⁻¹I≤D²U≤I, use the positive condition-number convention κ>0. For A∈(0,∞] define U_A,u=U+||·−u||²/(2A). It is α_A=κ⁻¹+A⁻¹ strongly convex and β_A=1+A⁻¹ smooth; let K_A=β_A/α_A. For a>0 the normalized Gibbs law R^(U_A,u)_a,y equals R^U_A+,u+, where (A+)⁻¹=A⁻¹+a⁻¹ and u+=A+(u/A+y/a). Its condition-number bounds satisfy K_A+=(aβ_A+1)K_A/(aβ_A+K_A). ASTIS expands the omitted calculation by proving integrability, strictly positive normalization and actual probability laws, and uses precision r=A⁻¹ to include infinity. This is a mathematical restatement, not a quotation. The formal space is any finite-dimensional real inner-product Borel space, including zero dimension. No recursive algorithm, error or cost bound is included.

The derivatives are genuine derivatives of the C² potential; the Hessian is not a separately supplied field. The quadratic-form bounds hold everywhere.
κ>0 is the positive condition-number convention of the source. The ratio β/α uses the supplied bounds, not necessarily optimal constants. In dimension zero it need not be at least one.
r is a nonnegative real precision, represented by NNReal. Its zero value means A=∞, not a zero variance. The second variance a is strictly positive.
All laws are normalized relative to canonical Euclidean volume. No minimizer, moment estimate, integrability or kernel identity is supplied as a hidden premise.

source normalized RGO and condition update

\[\begin{gathered}W=U+\tfrac r2\|\cdot-u\|^2,\quad r^+=r+a^{-1},\quad w=(r^+)^{-1}(ru+a^{-1}y),\\R^{W}_{a,y}=R^{U}_{(r^+)^{-1},w},\qquad K^+=\frac{\beta+a^{-1}}{\alpha+a^{-1}}=\frac{(a\beta+1)K}{a\beta+K}.\end{gathered}\]

Read the formalized proofs

Each statement and proof below has its own closed Lean disclosure. ASTIS parents, Mathlib calls and external mathematical sources are distinguished in each proof.

ASTIS mathematical exposition

RGO calculus: curvature, normalized target and condition-number update

AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.RGOCalculus.rgo_calculus · theorem · Teaching coverage

Statement

Let E be a finite-dimensional real inner-product space with its Borel sigma algebra. Let U:E→R be C² with κ⁻¹||v||²≤D²U(x)[v,v]≤||v||² at every x,v, where κ>0. Given nonnegative precision r, positive variance a and centers u,y, put W=U+r||·−u||²/2, α=κ⁻¹+r, β=1+r, K=β/α, r+=r+a⁻¹ and w=(r+)⁻¹(ru+a⁻¹y). Then W is α-strongly convex and its gradient is β-Lipschitz; its exponential weight is integrable with positive integral. Both the normalized law of W and that of the updated potential are probabilities. The normalized law after adding ||·−y||²/(2a) is precisely that updated law, and the supplied condition-number bounds obey the displayed identity.

All objects and hypotheses

The derivatives are genuine derivatives of the C² potential; the Hessian is not a separately supplied field. The quadratic-form bounds hold everywhere.
κ>0 is the positive condition-number convention of the source. The ratio β/α uses the supplied bounds, not necessarily optimal constants. In dimension zero it need not be at least one.
r is a nonnegative real precision, represented by NNReal. Its zero value means A=∞, not a zero variance. The second variance a is strictly positive.
All laws are normalized relative to canonical Euclidean volume. No minimizer, moment estimate, integrability or kernel identity is supplied as a hidden premise.

Mathematical proof

1. Shift both curvature bounds by the precision

The quadratic term has Hessian rI, so its addition changes the lower bound to α and upper bound to β. The existing analytic theorem turns the lower bound into strong convexity and uses Hessian symmetry and the operator norm bound to prove actual gradient Lipschitz continuity. The C² premise rules out treating a totalized derivative as an arbitrary field.

\[D^2W=D^2U+rI,\qquad \alpha I\preceq D^2W\preceq\beta I,\qquad\|\nabla W(x)-\nabla W(z)\|\le\beta\|x-z\|.\]

Corresponding Lean step

hreg directly reuses QuadraticRegularization. Its NNReal constants are m=κ⁻¹, L=1 and t=r. This is an integration call, not another proof of the Hessian or Rayleigh argument.

2. Prove normalization before manipulating Gibbs laws

For any nonnegative precision t, the regularized potential is differentiable and has strictly positive strong-convexity modulus κ⁻¹+t. The existing Gaussian-envelope proof gives integrability without a supplied minimizer. Strict positivity of the exponential and nonzero canonical volume make its integral positive. Apply this at t=0, t=r and t=r+1/a.

\[Z_{t,z}=\int_Ee^{-U(x)-t\|x-z\|^2/2}\,dx,\qquad0<Z_{t,z}<\infty.\]

Corresponding Lean step

hI reuses StrongConvexGibbsIntegrability after hreg; hIU and hIW specialize it. integral_exp_pos and isProbabilityMeasure_tilted certify positivity and mass one. Integrable plus a positive real integral prevents the totalized tilted API from returning zero.

3. Complete the square, retaining its constant

Write s=1/a. The two quadratic penalties combine into one centered at w, plus a constant independent of x. It is the normalized laws that agree: their unnormalized integrals differ by exp(−c). Reuse the existing normalized quadratic-tilt theorem, which already proves and cancels this constant with positive normalizers.

\[\frac r2\|x-u\|^2+\frac s2\|x-y\|^2=\frac{r+s}{2}\|x-w\|^2+c,\qquad c=\frac{rs}{2(r+s)}\|u-y\|^2.\]

Corresponding Lean step

RGOClosure.quadratic_tilt_tilt supplies the completed-square law identity for the probability base volume.tilted(−U). No new square-completion lemma or duplicate RGO definition is introduced.

4. Translate the tilt identity to the paper's potential laws

Nested tilting adds exponents, provided the first exponential is integrable. This was proved above. Identify the quadratic tilt of the Gibbs base with the volume-normalized regularized potential, and perform the same identification after the second tilt. The output is equality of actual probability measures, not a proportionality assertion.

\[\bigl(dx\,\mathrm{tilted}(-U)\bigr)\,\mathrm{tilted}(-q_r)=dx\,\mathrm{tilted}(-(U+q_r)),\qquad q_r(x)=\tfrac r2\|x-u\|^2.\]

Corresponding Lean step

htilt applies Mathlib tilted_tilted using hIU. The final hcomp rewrite uses hIW for the second volume tilt. The separately returned updated probability certificate excludes equality of two zero fallback measures.

5. Derive the recursive condition-number identity

The updated constants are α+1/a and β+1/a. Multiply numerator and denominator by a, then multiply both by K=β/α; the denominator becomes (aα+1)K=aβ+K. All canceled factors are strictly positive: α, β, a and aβ+K. This ratio is the bridge to the already proved scalar contraction of ill-conditioned recursive stages; it does not execute those stages.

\[\frac{\beta+a^{-1}}{\alpha+a^{-1}}=\frac{a\beta+1}{a\alpha+1}=\frac{(a\beta+1)(\beta/\alpha)}{a\beta+\beta/\alpha}.\]

Corresponding Lean step

hα, hβ and hden justify denominator nonvanishing; field_simp checks the remaining field identity. The focused test feeds this actual curvature ratio into RecursiveCondition.contraction_bounds at a=(h+K)/β, proving K/2≤K+≤4K/5 for K≥2 and 0<h<1/4. This tests the scalar consumer, not implementation of the sampler.

Lean statement · rgo_calculus

Let-bindings retain the paper's W, α, β, K, updated precision and center without adding global wrapper definitions. NNReal packages the nonnegative precision and Lipschitz constant; κ and a remain positive real numbers. The conclusion returns analytic properties, normalization certificates, an exact measure equality and the source ratio identity.

theorem rgo_calculus {U : E → ℝ} {κ a : ℝ} (hκ : 0 < κ)
    (hU : ContDiff ℝ 2 U)
    (hH : ∀ x v : E, κ⁻¹ * ‖v‖ ^ 2 ≤ (fderiv ℝ (fderiv ℝ U) x v) v ∧
      (fderiv ℝ (fderiv ℝ U) x v) v ≤ ‖v‖ ^ 2)
    (r : ℝ≥0) (ha : 0 < a) (u y : E) :
    let W := fun x => U x + (r : ℝ) / 2 * ‖x - u‖ ^ 2
    let α := κ⁻¹ + (r : ℝ)
    let β : ℝ≥0 := 1 + r
    let K := (β : ℝ) / α
    let rp := (r : ℝ) + a⁻¹
    let w := rp⁻¹ • ((r : ℝ) • u + a⁻¹ • y)
    StrongConvexOn Set.univ α W ∧
      LipschitzWith β (gradient W) ∧
      Integrable (fun x => Real.exp (-W x)) (volume : Measure E) ∧
      0 < ∫ x, Real.exp (-W x) ∂(volume : Measure E) ∧
      IsProbabilityMeasure ((volume : Measure E).tilted (fun x => -W x)) ∧
      IsProbabilityMeasure ((volume : Measure E).tilted
        (fun x => -(U x + rp / 2 * ‖x - w‖ ^ 2))) ∧
      (volume : Measure E).tilted (fun x => -(W x + a⁻¹ / 2 * ‖x - y‖ ^ 2)) =
        volume.tilted (fun x => -(U x + rp / 2 * ‖x - w‖ ^ 2)) ∧
      ((β : ℝ) + a⁻¹) / (α + a⁻¹) = (a * (β : ℝ) + 1) * K /
        (a * (β : ℝ) + K)

Exact module and namespace context

Lean proof · rgo_calculus

The integration follows three existing ASTIS parents and Mathlib's normalized-tilt composition. General local hreg/hI helpers are reused at every precision; no minimum, moment or normalizer is postulated.

theorem rgo_calculus {U : E → ℝ} {κ a : ℝ} (hκ : 0 < κ)
    (hU : ContDiff ℝ 2 U)
    (hH : ∀ x v : E, κ⁻¹ * ‖v‖ ^ 2 ≤ (fderiv ℝ (fderiv ℝ U) x v) v ∧
      (fderiv ℝ (fderiv ℝ U) x v) v ≤ ‖v‖ ^ 2)
    (r : ℝ≥0) (ha : 0 < a) (u y : E) :
    let W := fun x => U x + (r : ℝ) / 2 * ‖x - u‖ ^ 2
    let α := κ⁻¹ + (r : ℝ)
    let β : ℝ≥0 := 1 + r
    let K := (β : ℝ) / α
    let rp := (r : ℝ) + a⁻¹
    let w := rp⁻¹ • ((r : ℝ) • u + a⁻¹ • y)
    StrongConvexOn Set.univ α W ∧
      LipschitzWith β (gradient W) ∧
      Integrable (fun x => Real.exp (-W x)) (volume : Measure E) ∧
      0 < ∫ x, Real.exp (-W x) ∂(volume : Measure E) ∧
      IsProbabilityMeasure ((volume : Measure E).tilted (fun x => -W x)) ∧
      IsProbabilityMeasure ((volume : Measure E).tilted
        (fun x => -(U x + rp / 2 * ‖x - w‖ ^ 2))) ∧
      (volume : Measure E).tilted (fun x => -(W x + a⁻¹ / 2 * ‖x - y‖ ^ 2)) =
        volume.tilted (fun x => -(U x + rp / 2 * ‖x - w‖ ^ 2)) ∧
      ((β : ℝ) + a⁻¹) / (α + a⁻¹) = (a * (β : ℝ) + 1) * K /
        (a * (β : ℝ) + K) := by
  let W := fun x => U x + (r : ℝ) / 2 * ‖x - u‖ ^ 2
  let m : ℝ≥0 := ⟨κ⁻¹, (inv_pos.mpr hκ).le⟩
  have hbounds : ∀ x v : E,
      (m : ℝ) * ‖v‖ ^ 2 ≤ (fderiv ℝ (fderiv ℝ U) x v) v ∧
      (fderiv ℝ (fderiv ℝ U) x v) v ≤ (1 : ℝ≥0) * ‖v‖ ^ 2 := by
    intro x v
    exact ⟨(hH x v).1, by simpa using (hH x v).2⟩
  have hreg (t : ℝ≥0) (z : E) :=
    TechnicalLemmas.Analysis.QuadraticRegularization.strongConvexOn_and_lipschitzWith_gradient_add_quadratic
      hU hbounds (r := t) z
  have hI (t : ℝ≥0) (z : E) :
      Integrable (fun x => Real.exp (-(U x + (t : ℝ) / 2 * ‖x - z‖ ^ 2)))
        (volume : Measure E) := by
    apply TechnicalLemmas.Analysis.StrongConvexGibbsIntegrability.integrable_exp_neg_of_strongConvexOn
      (m := ((m + t : ℝ≥0) : ℝ))
    · exact add_pos_of_pos_of_nonneg (inv_pos.mpr hκ) t.coe_nonneg
    · exact (hU.add (contDiff_const.mul
        ((contDiff_id.sub contDiff_const).norm_sq (𝕜 := ℝ)))).differentiable
        (by norm_num)
    · exact (hreg t z).1
  have hIU : Integrable (fun x => Real.exp (-U x)) (volume : Measure E) := by
    simpa only [NNReal.coe_zero, zero_div, zero_mul, add_zero] using hI 0 u
  have hIW : Integrable (fun x => Real.exp (-W x)) (volume : Measure E) := hI r u
  have : IsProbabilityMeasure ((volume : Measure E).tilted (fun x => -U x)) :=
    isProbabilityMeasure_tilted hIU
  have htilt (t : ℝ) (z : E) :
      ((volume : Measure E).tilted (fun x => -U x)).tilted
          (fun x => -(t / 2) * ‖x - z‖ ^ 2) =
        volume.tilted (fun x => -(U x + t / 2 * ‖x - z‖ ^ 2)) := by
    rw [tilted_tilted hIU]
    congr 1
    funext x
    simp only [Pi.add_apply]
    ring
  refine ⟨(hreg r u).1, (hreg r u).2, hIW, integral_exp_pos hIW,
    isProbabilityMeasure_tilted hIW, ?_, ?_, ?_⟩
  · have hIplus := hI (r + ⟨a⁻¹, (inv_pos.mpr ha).le⟩)
      (((r : ℝ) + a⁻¹)⁻¹ • ((r : ℝ) • u + a⁻¹ • y))
    exact isProbabilityMeasure_tilted hIplus
  · have hcomp := RGOClosure.quadratic_tilt_tilt
      ((volume : Measure E).tilted (fun x => -U x)) r.coe_nonneg (inv_pos.mpr ha) u y
    rw [htilt, htilt, tilted_tilted hIW] at hcomp
    convert hcomp using 1
    congr 1
    funext x
    simp only [Pi.add_apply, W]
    ring
  · have hα : 0 < κ⁻¹ + (r : ℝ) :=
      add_pos_of_pos_of_nonneg (inv_pos.mpr hκ) r.coe_nonneg
    have hβ : 0 < (1 : ℝ) + r := by positivity
    have hnext : 0 < κ⁻¹ + (r : ℝ) + a⁻¹ := add_pos hα (inv_pos.mpr ha)
    have hden : 0 < a * (1 + (r : ℝ)) + (1 + r) / (κ⁻¹ + r) :=
      add_pos (mul_pos ha hβ) (div_pos hβ hα)
    simp only [NNReal.coe_add, NNReal.coe_one]
    field_simp [hκ.ne', ha.ne', hα.ne', hnext.ne', hden.ne']

end AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.RGOCalculus

Exact module and namespace context

Source assumptions versus formal assumptions

Source	Actual Lean	Difference kind	Why it matters
U∈C²(Rd), source positive condition number	C² on finite-dimensional real inner-product Borel E; κ>0	generalization	Coordinates and positive dimension are not required. Explicit κ positivity retains the source convention; no claim K≥1 in dimension zero.
A∈(0,∞], a>0	r:NNReal, a>0, r+=r+a⁻¹	same	Precision r=A⁻¹ retains A=∞ at r=0 and keeps the second variance strictly positive.
RGO law proportional to exp(−U_A,u)	Integrable Gibbs weight, positive normalizer and probability from the existing curvature parents	source-implicit	These are derived, not added assumptions. They justify normalized-law composition and prevent totalized zero measures.
β_A-smooth potential and κ_A=β_A/α_A	LipschitzWith β_A (gradient W); exact ratio of supplied bounds	same	C² supplies genuine gradients. The ratio is not asserted to be the optimal condition number.

Source-level RGO potential calculus only. No implementable sampler, recursive accuracy, reference-point cost, invariance, mixing or actual-input expected query cost. κ>0 is the positive condition-number convention; r=0 retains A=infinity. Finite-dimensional real inner-product spaces, including dimension zero, generalize Euclidean coordinates. A=∞ is represented through its zero precision. The theorem does not claim a zero-variance Gaussian law. The updated potentials differ by an additive constant before normalization. No equality of unnormalized densities or partition functions is asserted. The constants are valid curvature/smoothness bounds. No optimal-condition-number, covariance or transport estimate follows from this packet alone.

Encoder–denoiser: accepted · equivalent-after-elaboration

Detected semantic differences

domains: Coordinate-free finite-dimensional spaces and zero dimension are included. — The extension is explicitly disclosed; canonical volume and the actual inner-product norm remain fixed. No positive-dimensional spectral argument is required.
assumptions: The positive condition-number convention and genuine normalization requirements are made explicit. — κ>0 is consistent with the source convention. Integrability and positive normalizers are derived from positive strong convexity, rather than added as premises.

A generalization is not a source correction. Proposed missing conditions require separate independent repair review. No proposed repair silently changes the original theorem.

Scope and omitted-condition boundaries

Source-level RGO potential calculus only. No implementable sampler, recursive accuracy, reference-point cost, invariance, mixing or actual-input expected query cost. κ>0 is the positive condition-number convention; r=0 retains A=infinity. Finite-dimensional real inner-product spaces, including dimension zero, generalize Euclidean coordinates.
A=∞ is represented through its zero precision. The theorem does not claim a zero-variance Gaussian law.
The updated potentials differ by an additive constant before normalization. No equality of unnormalized densities or partition functions is asserted.
The constants are valid curvature/smoothness bounds. No optimal-condition-number, covariance or transport estimate follows from this packet alone.

Source and reuse

ASTIS parents called

Mathlib API called (external library)

tilted_tilted
integral_exp_pos
isProbabilityMeasure_tilted
ContDiff.norm_sq
ContDiff.differentiable

Mathematical sources

Fan Chen, Sinho Chewi, Jianfeng Lu and Matthew S. Zhang, SPHMC v1, §6.2.2, Lemma6.4 and (6.1) — ASTIS mathematical restatement and expanded proof of the omitted calculus; no paper prose reproduced.
Mathlib contributors, Apache-2.0 — Existing normalized measure APIs; imported code is not counted as a new ASTIS leaf.

ASTIS prose is not a quotation or a source-equivalence certificate. Definitions and aliases are explained as constructions, not counted as new mathematical proofs.

Which proof edges are actually covered?

Local proof component; source adapter/review separate Genuine curvature/smoothness with integrable, positive normalized Gibbs laws
Local proof component; source adapter/review separate Exact source potential-law identity and condition-number update

Lemma 6.4: RGO calculus and normalized-law closure

Fan Chen, Sinho Chewi, Jianfeng Lu and Matthew S. Zhang. ASTIS restatement and expanded calculation, not copied original prose; no endorsement implied.

arXiv:2609.06906v1 · Section 6.2.2, Lemma 6.4, equation (6.1) · faithful paraphrase

Complete source statement (ASTIS restatement)

Let U be a twice continuously differentiable potential on Euclidean space satisfying κ⁻¹ I ≤ ∇²U ≤ I. For A in (0,infinity] and centre u, put U_A,u(x)=U(x)+‖x−u‖²/(2A). Its strong-convexity and smoothness parameters are α_A=κ⁻¹+A⁻¹ and β_A=1+A⁻¹, with ratio κ_A=β_A/α_A. For a>0 and centre y, the RGO for U_A,u with variance a equals the RGO for U with precision A⁻¹+a⁻¹ and precision-weighted centre. The new condition-number ratio is given in (6.1). The current proof binding covers only the normalized-law calculation, not every clause of this lemma.

U is C² on R^d with κ⁻¹ I ≤ Hessian(U) ≤ I and positive κ, as in the source's normalized curvature convention.
A∈(0,infinity], a>0, and u,y∈R^d; A⁻¹=0 when A=infinity.
RGO denotes the normalized probability law with density proportional to exp(−U(x)−‖x−u‖²/(2A)). Its relation to a pre-existing probability base is an explicit pending adapter, not an assumed equality of the target laws.

RGO potential and curvature

\[U_{A,u}(x)=U(x)+\frac{\|x-u\|^2}{2A},\quad \alpha_A=\kappa^{-1}+A^{-1},\quad \beta_A=1+A^{-1},\quad \kappa_A=\beta_A/\alpha_A.\]

(6.1), normalized law and updated parameters

\[R^{U_{A,u}}_{a,y}=R^U_{A^+,u^+},\quad (A^+)^{-1}=A^{-1}+a^{-1},\quad u^+=A^+(u/A+y/a),\quad \kappa_{A^+}=\frac{a\beta_A+1}{a\beta_A+\kappa_A}\,\kappa_A.\]

Read the formalized proofs

Each statement and proof below has its own closed Lean disclosure. ASTIS parents, Mathlib calls and external mathematical sources are distinguished in each proof.

ASTIS mathematical exposition

An RGO of an RGO has an explicit normalized target law

AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.RGOClosure.quadratic_tilt_tilt · theorem · Teaching coverage

Statement

Let E be a real inner-product space with its Borel measurable sets, and let μ be any probability measure on E. For u,y in E, r≥0 and s>0, normalized reweighting first by exp(−r‖x−u‖²/2) and then by exp(−s‖x−y‖²/2) is exactly one normalized reweighting with precision r+s and centre w=(r+s)⁻¹(ru+sy). No moment or density assumption on μ is needed.

\[T_{s,y}(T_{r,u}\mu)=T_{r+s,w}\mu,\quad w=\frac{ru+sy}{r+s},\quad \frac{dT_{r,u}\mu}{d\mu}(x)=\frac{e^{-r\|x-u\|^2/2}}{Z_{r,u}},\quad Z_{r,u}=\int e^{-r\|x-u\|^2/2}\,d\mu(x).\]

All objects and hypotheses

μ is a probability measure, not an unnormalized Lebesgue density. This is an explicit base-law contract, not a proof that the paper's Gibbs potential is normalizable.
E carries the Borel sigma-algebra of its norm topology and a real inner product. Finite dimension is unnecessary for this algebraic probability-law identity; the source uses Euclidean space.
The precisions satisfy r≥0 and s>0, so r+s>0. Source A=infinity is represented by r=0; for finite source parameters r=A⁻¹ and s=a⁻¹.
No derivatives, a.e. choices of conditional distributions, generator domains, moments, boundary decay or sampling-error premises occur in this selected measure calculation.

Mathematical proof

1. Show each normalized reweighting is a genuine probability law

For every nonnegative precision t and every centre v, the exponential weight is continuous, hence measurable. It is positive and bounded above by one. Since the base measure is a probability, the weight is integrable and its integral is strictly positive. Thus normalization uses a finite positive number, not Lean's fallback value for a nonintegrable expression.

\[0<e^{-t\|x-v\|^2/2}\le1,\qquad 0<Z_{t,v}=\int e^{-t\|x-v\|^2/2}\,d\mu\le1.\]

Corresponding Lean step

The internal hint proves Integrable from integrable_const 1 and Integrable.mono'. hcont explicitly composes continuous norm, square, multiplication and exponential; hcont.aestronglyMeasurable supplies the measurable representative. Real.exp_le_one_iff checks the bound. Mathlib tilted_tilted and isProbabilityMeasure_tilted use integral_exp_pos for the nonzero normalization.

2. Complete the square with the exact additive constant

Expand each squared norm as an inner product and collect coefficients of x. The weighted centre makes the linear terms agree. The remaining difference is independent of x. Positivity of r+s justifies division, including r=0.

\[\frac r2\|x-u\|^2+\frac s2\|x-y\|^2=\frac{r+s}{2}\|x-w\|^2+C,\qquad C=\frac{rs}{2(r+s)}\|u-y\|^2.\]

Corresponding Lean step

hsq is the pointwise identity between the sum of two log-weights and the combined log-weight plus c=−C. Inner-product bilinearity expands the squares; field_simp and ring verify the real polynomial identity.

3. Cancel normalization rather than assuming proportional laws are equal

The normalizer of the second tilt is the integral of its weight under the first normalized law. Multiplying the two normalized densities cancels the first normalizer. Completing the square contributes the same positive factor exp(−C) to numerator and denominator, which cancels as well.

\[\frac{e^{-r\|x-u\|^2/2}}{Z_{r,u}}\,\frac{e^{-s\|x-y\|^2/2}}{\int e^{-s\|z-y\|^2/2}\,dT_{r,u}\mu(z)}=\frac{e^{-C}e^{-(r+s)\|x-w\|^2/2}}{e^{-C}Z_{r+s,w}}=\frac{e^{-(r+s)\|x-w\|^2/2}}{Z_{r+s,w}}.\]

Corresponding Lean step

The first tilted_tilted combines normalized exponential tilts. hsq rewrites their sum. A second tilted_tilted presents the additive constant as a constant tilt; tilted_const removes it because the combined law has already been proved a probability.

Lean statement · quadratic_tilt_tilt

Measure.tilted μ f is Mathlib's actual normalized exponential-density measure. The theorem compares measures, not informal density proportionality. IsProbabilityMeasure μ is a typeclass assumption. u,y and the two precision inequalities are explicit inputs; no integrability hypothesis is hidden in the signature.

theorem quadratic_tilt_tilt (μ : Measure E) [IsProbabilityMeasure μ]
    {r s : ℝ} (hr : 0 ≤ r) (hs : 0 < s) (u y : E) :
    (μ.tilted (fun x => -(r / 2) * ‖x - u‖ ^ 2)).tilted
        (fun x => -(s / 2) * ‖x - y‖ ^ 2) =
      μ.tilted (fun x => -((r + s) / 2) *
        ‖x - (r + s)⁻¹ • (r • u + s • y)‖ ^ 2)

Exact module and namespace context

Lean proof · quadratic_tilt_tilt

ASTIS authors the quadratic completion and connects it to Mathlib's existing normalization theorem. The source law's Gibbs representation is deliberately not encoded as an assumption equating the two target laws. All weights used in the proof are integrable by direct domination; Mathlib handles their exact normalizer cancellation.

theorem quadratic_tilt_tilt (μ : Measure E) [IsProbabilityMeasure μ]
    {r s : ℝ} (hr : 0 ≤ r) (hs : 0 < s) (u y : E) :
    (μ.tilted (fun x => -(r / 2) * ‖x - u‖ ^ 2)).tilted
        (fun x => -(s / 2) * ‖x - y‖ ^ 2) =
      μ.tilted (fun x => -((r + s) / 2) *
        ‖x - (r + s)⁻¹ • (r • u + s • y)‖ ^ 2) := by
  have hint : ∀ (t : ℝ), 0 ≤ t → ∀ (v : E),
      Integrable (fun x => Real.exp (-(t / 2) * ‖x - v‖ ^ 2)) μ := by
    intro t ht v
    have hcont : Continuous (fun x : E => Real.exp (-(t / 2) * ‖x - v‖ ^ 2)) :=
      Real.continuous_exp.comp (continuous_const.mul ((continuous_id.sub continuous_const).norm.pow 2))
    refine (integrable_const (1 : ℝ)).mono' hcont.aestronglyMeasurable ?_
    filter_upwards with x
    rw [Real.norm_eq_abs, abs_of_pos (Real.exp_pos _)]
    apply Real.exp_le_one_iff.mpr
    exact mul_nonpos_of_nonpos_of_nonneg (neg_nonpos.mpr (by positivity)) (sq_nonneg _)
  have hrs : 0 < r + s := add_pos_of_nonneg_of_pos hr hs
  let w : E := (r + s)⁻¹ • (r • u + s • y)
  let c : ℝ := -(r * s / (2 * (r + s))) * ‖u - y‖ ^ 2
  have hsq : (fun x => -(r / 2) * ‖x - u‖ ^ 2) +
      (fun x => -(s / 2) * ‖x - y‖ ^ 2) =
      (fun x => -((r + s) / 2) * ‖x - w‖ ^ 2) + (fun _ => c) := by
    funext x
    simp only [Pi.add_apply, w, c, ← real_inner_self_eq_norm_sq,
      inner_sub_left, inner_sub_right, inner_add_left, inner_add_right,
      real_inner_smul_left, real_inner_smul_right]
    rw [real_inner_comm y u, real_inner_comm u x, real_inner_comm y x]
    field_simp
    ring
  have : IsProbabilityMeasure
      (μ.tilted (fun x => -((r + s) / 2) * ‖x - w‖ ^ 2)) :=
    isProbabilityMeasure_tilted (hint (r + s) hrs.le w)
  rw [tilted_tilted (hint r hr u), hsq,
    ← tilted_tilted (hint (r + s) hrs.le w), tilted_const]

end AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.RGOClosure

Exact module and namespace context

Source assumptions versus formal assumptions

Source	Actual Lean	Difference kind	Why it matters
Euclidean Gibbs probability base with a C² potential and Hessian bounds	Arbitrary probability measure on a Borel real inner-product space	generalization	Completing the square and exact normalized reweighting do not use density, finite dimension or derivatives. This wider calculus statement does not transfer the source's algorithm or curvature guarantees to arbitrary laws.
A∈(0,infinity] and a>0	r≥0 and s>0, interpreted as r=A⁻¹ and s=a⁻¹	same	The precision convention includes infinite first variance as r=0 and keeps total precision strictly positive. No division by zero occurs.
The RGO proportional-density notation suppresses normalization details	Actual Measure.tilted equality; integrability and positive finite normalization proved internally	source-implicit	Bounded positive measurable weights over a probability base justify normalization and its cancellation without additional integrability assumptions.
RGO built directly from the unnormalized potential U	A supplied probability base μ	unresolved	The source adapter identifying μ and its tilts with the specific Lebesgue densities remains a separately named obligation; this proof does not assume that adapter as its conclusion.

The normalized-law calculation on a probability base only; the Gibbs-density adapter, curvature conclusions and recursive sampling guarantee remain open.

Encoder–denoiser: accepted · equivalent-after-elaboration

Detected semantic differences

domains: The compiled measure identity generalizes the paper's Euclidean Gibbs setting to arbitrary Borel real inner-product spaces and arbitrary probability measures. — This extension is explicit in source.original_text and the lesson. The proof uses inner-product algebra, continuity and finite probability mass, not finite dimension or potential regularity.
objects: Instantiation with the source Gibbs density remains an unproved adapter, not a hidden assumed equality. — The module contains no potential U or Lebesgue-density identification. The publication context separately lists gibbs-base-identification and explicitly says probability of the supplied μ does not prove normalizability of the paper's potential.
assumptions: The decoder describes general API totalization without explicitly deriving that the fallback is unreachable here. — The missing explanatory derivation is valid from the reconstructed assumptions: continuous weights in (0,1] have positive finite integral under each probability base. The candidate proof and lesson supply this argument; no mathematical assumption or conclusion is missing.
scopes: Curvature, condition-number updates, sampler implementation and costs are not proved by this declaration. — These omissions are intentional and visible in the full publication context, obligation map and lesson. They are not blocking for the explicitly selected normalized-measure component, but must remain excluded from completion claims.

A generalization is not a source correction. Proposed missing conditions require separate independent repair review. No proposed repair silently changes the original theorem.

Scope and omitted-condition boundaries

This proves only Lemma 6.4's normalized RGO-family calculation at the probability-base level. Identifying μ with the density proportional to exp(−U), and relating the first tilted law to U_A,u, remain explicit source adapters.
The strong-convexity and smoothness parameters, their condition-number recurrence, actual recursive sampler, output discrepancy and expected query cost are separate obligations.
The generic Borel inner-product-space and arbitrary-probability formulation is a disclosed generality of the calculation; it does not claim that the source sampler works in infinite-dimensional spaces or for singular target laws.
The r=0 test exercises A=infinity, and the equal-positive-precision test checks the midpoint update.

Source and reuse

ASTIS parents called

Mathlib API called (external library)

MeasureTheory.Measure.tilted: existing normalized exponential reweighting.
MeasureTheory.tilted_tilted and tilted_const: composition and cancellation of constant normalized tilts.
MeasureTheory.isProbabilityMeasure_tilted and integral_exp_pos: probability and strictly positive normalizer from integrability and nonzero mass.
MeasureTheory.Integrable.mono': integrability under an integrable envelope; Borel measurability from continuity.
real_inner_self_eq_norm_sq, inner_sub_left/right, inner_add_left/right, real_inner_smul_left/right: completion of the square.

Mathematical sources

Chen, Chewi, Lu and Zhang, Smoothed Picard Hamiltonian Monte Carlo v1 — Section 6.2.2, Lemma 6.4 normalized-law clause and (6.1). ASTIS's original expanded proof of the omitted calculation, not quoted paper prose.

ASTIS prose is not a quotation or a source-equivalence certificate. Definitions and aliases are explained as constructions, not counted as new mathematical proofs.

Which proof edges are actually covered?

Local proof component; source adapter/review separate Actual equality of successive normalized quadratic tilts, including all normalizers and A=infinity
TODO — not closed by these contributions Identify the probability-base tilts with the source Lebesgue Gibbs densities for U and U_A,u
TODO — not closed by these contributions Prove the Hessian/strong-convexity/smoothness updates and the resulting condition-number formula

Actual smooth gradient-arc clipping excess

ASTIS mathematical restatement and exposition of the actual smooth gradient-estimator clipping bound, used as a dependency of Fan Chen, Sinho Chewi, Jianfeng Lu and Matthew S. Zhang, Smoothed Picard Hamiltonian Monte Carlo. The prior proof-supported factor2 moment is used without silently repairing the differing printed Claim1 log formula.

arXiv:2602.01338v1 · Appendix D.1 Claim2, smooth s=1; consumed by SPHMC Appendix A.4(2) · faithful paraphrase

Complete source statement (ASTIS restatement)

W_r and F_r are measurable, F_r is integrable under the actual input law mu, and its integral is at most 2 exp(-min(B^2/(40 beta^2 d eta^2),B/(8 beta eta))).

E is a finite-dimensional real inner product space with its Borel measurable structure and positive real dimension d=finrank(E). The real-valued function f is differentiable everywhere, and its actual gradient is beta-Lipschitz.
eta,beta,B>0, ell>=2, and 64 beta^2(ell*d/B+ell^2)<=1/eta^2. All denominators in the conclusion are strictly positive.
h,x_plus in E satisfy norm(h-x_plus)<=sqrt(d eta). The independent input law is mu=N(h,eta I) product N(0,eta I), represented by the affine pushforwards of standard Gaussian.
For a fixed real r, theta=pi*r/2, gamma_r(x,z)=h+sin(theta)(x-h)+cos(theta)z, v_r(x,z)=(pi/2)(cos(theta)(x-h)-sin(theta)z), W_r=<v_r,grad f(x_plus)-grad f(gamma_r)>, tau_B(w)=max(abs(w)-B,0), and F_r=exp(2ell*tau_B(W_r))-1.

Actual clipping-excess moment

\[\mathbb E_\mu\!\left[e^{2\ell\tau_B(W_r)}-1\right]\le2\exp\!\left[-\min\!\left\{\frac{B^2}{40\beta^2d\eta^2},\frac{B}{8\beta\eta}\right\}\right],\quad\tau_B(w)=(|w|-B)_+.\]

Read the formalized proofs

Each statement and proof below has its own closed Lean disclosure. ASTIS parents, Mathlib calls and external mathematical sources are distinguished in each proof.

ASTIS mathematical exposition

Actual smooth gradient-arc clipping excess

AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.SmoothGradientArcClipping.smooth_gradient_arc_clipping · theorem · Teaching coverage

Statement

W_r and F_r are measurable, F_r is integrable under the actual input law mu, and its integral is at most 2 exp(-min(B^2/(40 beta^2 d eta^2),B/(8 beta eta))).

\[\mathbb E_\mu\!\left[e^{2\ell\tau_B(W_r)}-1\right]\le2\exp\!\left[-\min\!\left\{\frac{B^2}{40\beta^2d\eta^2},\frac{B}{8\beta\eta}\right\}\right],\quad\tau_B(w)=(|w|-B)_+.\]

All objects and hypotheses

E is a finite-dimensional real inner product space with its Borel measurable structure and positive real dimension d=finrank(E). The real-valued function f is differentiable everywhere, and its actual gradient is beta-Lipschitz.
eta,beta,B>0, ell>=2, and 64 beta^2(ell*d/B+ell^2)<=1/eta^2. All denominators in the conclusion are strictly positive.
h,x_plus in E satisfy norm(h-x_plus)<=sqrt(d eta). The independent input law is mu=N(h,eta I) product N(0,eta I), represented by the affine pushforwards of standard Gaussian.
For a fixed real r, theta=pi*r/2, gamma_r(x,z)=h+sin(theta)(x-h)+cos(theta)z, v_r(x,z)=(pi/2)(cos(theta)(x-h)-sin(theta)z), W_r=<v_r,grad f(x_plus)-grad f(gamma_r)>, tau_B(w)=max(abs(w)-B,0), and F_r=exp(2ell*tau_B(W_r))-1.

Mathematical proof

1. Choose a parameter that lies in both required ranges

Let A=beta^2 d eta^2 and choose lambda as the minimum below. Multiply the step-size inequality by the positive eta^2. Its two nonnegative terms imply 8 beta eta ell<=1 and 64 beta^2 ell d eta^2<=B. These give 2ell below each cap, hence below their minimum. The first cap also ensures the previously proved moment theorem applies.

\[\lambda=\min\!\left\{\frac1{4\beta\eta},\frac B{20A}\right\}\ge2\ell,\qquad12\beta^2\eta^2\lambda^2\le1.\]

Corresponding Lean step

clipping_parameter_lower; clipping_parameter_bounds

2. Dominate the clipping excess pointwise

If abs(w)<=B, the excess is zero. Otherwise tau_B(w)=abs(w)-B>=0; since 2ell<=lambda, increasing the exponent and dropping the subtractive one gives the displayed bound. The left side is nonnegative because ell and tau_B are nonnegative.

\[0\le e^{2\ell\tau_B(w)}-1\le e^{-\lambda B}e^{\lambda|w|}.\]

Corresponding Lean step

clipping_exp_domination

3. Apply the moment theorem to the same actual estimator

The gradient is continuous by its Lipschitz hypothesis, so the explicit arc formula makes W_r measurable. Invoke the actual smooth gradient-arc moment theorem with the chosen lambda. Its source center condition is exactly the present one; definitional equality identifies the same velocity, gradient difference and original independent Gaussian product input. No new independence or exponential-integrability premise is assumed.

\[\mathbb E_\mu e^{\lambda|W_r|}\le2e^{10A\lambda^2},\qquad e^{\lambda|W_r|}\in L^1(\mu).\]

Corresponding Lean step

smooth_gradient_arc_clipping; SmoothGradientArcMoment.smooth_gradient_arc_moment

4. Establish integrability before comparing expectations

The right-hand side of the pointwise inequality is an integrable constant multiple of the proved moment integrand. Measurability and nonnegative domination establish integrability of F_r first. Integral monotonicity and the constant-multiple identity then yield the exponential bound.

\[\mathbb E_\mu F_r\le e^{-\lambda B}\mathbb E_\mu e^{\lambda|W_r|}\le2e^{10A\lambda^2-B\lambda}.\]

Corresponding Lean step

clipping_integral_domination; Integrable.mono'; integral_mono; integral_const_mul

5. Recover the two explicit source scales

The second cap implies 20A lambda<=B. Multiplying by nonnegative lambda gives 10A lambda^2-B lambda<=-B lambda/2. Multiplication by positive B/2 commutes with the minimum; cancellation of the strictly positive denominators gives precisely the two scales. Exponential monotonicity finishes the claim.

\[10A\lambda^2-B\lambda\le-\frac{B\lambda}{2}=-\min\!\left\{\frac{B^2}{40A},\frac B{8\beta\eta}\right\}.\]

Corresponding Lean step

clipping_parameter_bounds; mul_min_of_nonneg; min_div_div_right; Real.exp_le_exp

Lean statement · smooth_gradient_arc_clipping

Actual fixed-time gradient clipping-excess measurability, integrability and explicit source two-scale exponential bound.

theorem smooth_gradient_arc_clipping (f : E → ℝ) (hf : Differentiable ℝ f)
    (eta beta B ell : ℝ) (heta : 0 < eta) (hbeta : 0 < beta) (hB : 0 < B)
    (hell : 2 ≤ ell) (hd : 0 < (Module.finrank ℝ E : ℝ))
    (hlip : LipschitzWith ⟨beta,hbeta.le⟩ (gradient f)) (h xp : E) (r : ℝ)
    (hcenter : ‖h-xp‖ ≤ Real.sqrt ((Module.finrank ℝ E : ℝ)*eta))
    (hstep : 64*beta^2*(ell*(Module.finrank ℝ E : ℝ)/B+ell^2) ≤ 1/eta^2) :
    let mu := ((stdGaussian E).map (fun z : E => h+Real.sqrt eta • z)).prod
      ((stdGaussian E).map (fun z : E => Real.sqrt eta • z))
    let W := fun p : E × E => inner ℝ (clipVelocity h r p)
      (gradient f xp-gradient f (clipArc h r p))
    let F := fun p : E × E => Real.exp (2*ell*max (|W p|-B) 0)-1
    Measurable W ∧ Measurable F ∧ Integrable F mu ∧
    (∫ p, F p ∂mu) ≤ 2*Real.exp (-min
      (B^2/(40*beta^2*(Module.finrank ℝ E : ℝ)*eta^2)) (B/(8*beta*eta)))

Exact module and namespace context

Lean proof · smooth_gradient_arc_clipping

Source parameter caps, pointwise nonnegative domination, actual parent MGF, integrable comparison and exact minimum algebra.

theorem smooth_gradient_arc_clipping (f : E → ℝ) (hf : Differentiable ℝ f)
    (eta beta B ell : ℝ) (heta : 0 < eta) (hbeta : 0 < beta) (hB : 0 < B)
    (hell : 2 ≤ ell) (hd : 0 < (Module.finrank ℝ E : ℝ))
    (hlip : LipschitzWith ⟨beta,hbeta.le⟩ (gradient f)) (h xp : E) (r : ℝ)
    (hcenter : ‖h-xp‖ ≤ Real.sqrt ((Module.finrank ℝ E : ℝ)*eta))
    (hstep : 64*beta^2*(ell*(Module.finrank ℝ E : ℝ)/B+ell^2) ≤ 1/eta^2) :
    let mu := ((stdGaussian E).map (fun z : E => h+Real.sqrt eta • z)).prod
      ((stdGaussian E).map (fun z : E => Real.sqrt eta • z))
    let W := fun p : E × E => inner ℝ (clipVelocity h r p)
      (gradient f xp-gradient f (clipArc h r p))
    let F := fun p : E × E => Real.exp (2*ell*max (|W p|-B) 0)-1
    Measurable W ∧ Measurable F ∧ Integrable F mu ∧
    (∫ p, F p ∂mu) ≤ 2*Real.exp (-min
      (B^2/(40*beta^2*(Module.finrank ℝ E : ℝ)*eta^2)) (B/(8*beta*eta))) := by
  let d := (Module.finrank ℝ E : ℝ)
  let lam := min (1/(4*beta*eta)) (B/(20*beta^2*d*eta^2))
  let mu := ((stdGaussian E).map (fun z : E => h+Real.sqrt eta • z)).prod
      ((stdGaussian E).map (fun z : E => Real.sqrt eta • z))
  let W := fun p : E × E => inner ℝ (clipVelocity h r p)
      (gradient f xp-gradient f (clipArc h r p))
  have hell0 : 0 ≤ ell := by linarith
  obtain ⟨hl,hll,hrange,he⟩ := clipping_parameter_bounds eta beta B ell d heta hbeta hB hell0 hd hstep
  change 0 ≤ lam at hl
  change 2*ell ≤ lam at hll
  change 12*beta^2*eta^2*lam^2 ≤ 1 at hrange
  have hW : Measurable W := by
    have hg := hlip.continuous.measurable
    dsimp [W,clipVelocity,clipArc]
    fun_prop
  obtain ⟨_,_,hi,hv,_⟩ :=
    AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.SmoothGradientArcMoment.smooth_gradient_arc_moment
      f hf eta beta lam heta hbeta.le hl hlip h xp r hcenter hrange
  change Integrable (fun p => Real.exp (lam*|W p|)) mu at hi
  change (∫ p, Real.exp (lam*|W p|) ∂mu) ≤ 2*Real.exp (10*d*eta^2*lam^2*beta^2) at hv
  obtain ⟨hI,hv'⟩ := clipping_integral_domination mu W hW B ell lam hell0 hll hi
  refine ⟨hW, ?_, hI, hv'.trans ?_⟩
  · change Measurable (fun p => Real.exp (2*ell*max (|W p|-B) 0)-1)
    fun_prop
  · calc
      _ ≤ Real.exp (-lam*B)*(2*Real.exp (10*d*eta^2*lam^2*beta^2)) :=
        mul_le_mul_of_nonneg_left hv (Real.exp_nonneg _)
      _ = 2*Real.exp (10*d*eta^2*lam^2*beta^2-B*lam) := by
        rw [← mul_assoc, mul_comm (Real.exp (-lam*B)) 2, mul_assoc, ← Real.exp_add]
        congr 2
        ring
      _ ≤ _ := by
        apply mul_le_mul_of_nonneg_left _ (by norm_num : (0 : ℝ) ≤ 2)
        exact Real.exp_le_exp.mpr he


end
end AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.SmoothGradientArcClipping

Exact module and namespace context

Source assumptions versus formal assumptions

Source	Actual Lean	Difference kind	Why it matters
Smooth s=1 Euclidean case with positive dimension and beta.	Finite-dimensional real inner-product Borel space with positive finrank and beta.	generalization	Basis-independent domain retains the source positive-denominator conditions; zero-dimensional and zero-beta cases are not asserted.
For each r in [0,1].	For each real r.	generalization	The actual parent arc moment holds for all real angles. No random-time integration conclusion is added.
Source center h=x0-eta grad f(x_plus) with residual at most sqrt(d eta).	Arbitrary h,x_plus satisfying exactly this residual bound.	generalization	Only the distance bound enters the moment. Center/reference construction remains a later consumer.
Positive eta,beta,B,d; ell>=2 in the surrounding theorem; 1/eta^2>=64 beta^2(ell*d/B+ell^2).	Exactly these inequalities, with d=finrank(E), differentiable f and its actual beta-Lipschitz gradient.	same	No assumed MGF or integrability premise; source parameter range proves the needed moment and clipping comparisons.
Expectation of exp(2ell tau_B(W))-1 bounded by2 exp(-min(B²/(40 beta² d eta²),B/(8 beta eta))).	Same actual input, clipping excess max(abs(W)-B,0) and constants; W and excess integrand measurable, integrand integrable.	source-implicit	All analytic obligations for the actual expectation are proved explicitly before comparison.
Claim2 feeds Eq18 and normalized terminal approximation, later using B=Theta(1).	Fixed-time clipping-excess moment for arbitrary B>0 under the displayed step condition.	same	This is the selected proof edge only. Joint time measurability, target mean, target law, Renyi accuracy and cost remain separate; arbitrary B does not assert uniform cost.

This is the fixed-r smooth Claim 2 clipping-excess moment for the actual estimator. The finite-dimensional inner-product domain and all-real r are disclosed extensions; positive dimension and beta are retained. Constructing h=x0-eta grad f(x_plus), joint time measurability and averaging over random uniform time, unclipped mean identification, the clipped target law, normalized Renyi accuracy, initialization and actual query costs remain separate. Arbitrary B>0 does not imply a uniform constant-cost statement; later source use sets B=Theta(1). The parent factor2 moment is used, without silently repairing printed Claim 1.

Encoder–denoiser: accepted · domain-mismatch

Detected semantic differences

domains: Positive-dimensional coordinate-free domain; positivity preserved. — Independent formal source review accepted this disclosed difference.
quantifiers: All-real r supported by parent; random-time averaging not asserted. — Independent formal source review accepted this disclosed difference.
quantifiers: Arbitrary residual-controlled center; source center construction deferred. — Independent formal source review accepted this disclosed difference.
assumptions: Positive parameters, ell and step retained without assumed MGF or integrability. — Independent formal source review accepted this disclosed difference.
conclusion: Actual measurability and integrability proved; bound unchanged. — Independent formal source review accepted this disclosed difference.
scopes: Selected Claim2 only; arbitrary B does not imply uniform constant cost. — Independent formal source review accepted this disclosed difference.

A generalization is not a source correction. Proposed missing conditions require separate independent repair review. No proposed repair silently changes the original theorem.

Scope and omitted-condition boundaries

This is the fixed-r smooth Claim 2 clipping-excess moment for the actual estimator. The finite-dimensional inner-product domain and all-real r are disclosed extensions; positive dimension and beta are retained. Constructing h=x0-eta grad f(x_plus), joint time measurability and averaging over random uniform time, unclipped mean identification, the clipped target law, normalized Renyi accuracy, initialization and actual query costs remain separate. Arbitrary B>0 does not imply a uniform constant-cost statement; later source use sets B=Theta(1). The parent factor2 moment is used, without silently repairing printed Claim 1.

Source and reuse

ASTIS parents called

AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.SmoothGradientArcMoment.smooth_gradient_arc_moment

Mathlib API called (external library)

MeasureTheory.Integrable.mono'
MeasureTheory.integral_mono
MeasureTheory.integral_const_mul
mul_min_of_nonneg
min_div_div_right
Real.exp_le_exp

Mathematical sources

Appendix D.1 Claim 2, smooth s=1 — Explicit clipping-excess exponential bound for the actual gradient estimator.
SPHMC Appendix A.4(2) — Terminal gradient-estimator approximation consumer.

ASTIS prose is not a quotation or a source-equivalence certificate. Definitions and aliases are explained as constructions, not counted as new mathematical proofs.

Which proof edges are actually covered?

Local proof component; source adapter/review separate Actual smooth clipping-excess moment before normalized target comparison

Actual smooth gradient-arc exponential moment

ASTIS source-proof-supported mathematical restatement and exposition, preserving the factor2 used in the proof and subsequent Claim 2. This is a dependency of Fan Chen, Sinho Chewi, Jianfeng Lu and Matthew S. Zhang, Smoothed Picard Hamiltonian Monte Carlo. It is not the differing printed logarithmic Claim 1 formula or an author-endorsed repair.

arXiv:2602.01338v1 · Appendix D.1 Claim 1 proof and Claim 2, smooth s=1 moment; consumed by SPHMC Appendix A.4(2) · faithful paraphrase

Complete source statement (ASTIS restatement)

The vector gradient f(x) is the actual gradient of f at every x. For each displayed real r, F_r is measurable and integrable under the actual input law mu, its integral is at most 2 exp(10 d eta^2 lambda^2 beta^2), and the logarithm of its integral is at most log 2+10 d eta^2 lambda^2 beta^2.

E is a finite-dimensional real inner product space with its Borel measurable structure, and d=finrank(E). Zero dimension is allowed. The real-valued function f is differentiable everywhere and its actual gradient is beta-Lipschitz, where beta>=0.
eta>0, lambda>=0, 12 beta^2 eta^2 lambda^2<=1, and h,x_plus in E satisfy norm(h-x_plus)<=sqrt(d eta).
The actual independent input law is mu=N(h,eta I) product N(0,eta I), explicitly the product of the pushforwards of standard Gaussian by z->h+sqrt(eta)z and z->sqrt(eta)z.
For each real r set theta=pi*r/2, gamma_r(x,z)=h+sin(theta)(x-h)+cos(theta)z, v_r(x,z)=(pi/2)(cos(theta)(x-h)-sin(theta)z), W_r=<v_r,grad f(x_plus)-grad f(gamma_r)> and F_r=exp(lambda abs(W_r)).

Actual estimator exponential moment and log bound

\[\mathbb E_\mu e^{\lambda|W_r|}\le2e^{10d\eta^2\lambda^2\beta^2},\qquad\log\mathbb E_\mu e^{\lambda|W_r|}\le\log2+10d\eta^2\lambda^2\beta^2.\]

Read the formalized proofs

Each statement and proof below has its own closed Lean disclosure. ASTIS parents, Mathlib calls and external mathematical sources are distinguished in each proof.

ASTIS mathematical exposition

Actual smooth gradient-arc exponential moment

AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.SmoothGradientArcMoment.smooth_gradient_arc_moment · theorem · Teaching coverage

Statement

\[\mathbb E_\mu e^{\lambda|W_r|}\le2e^{10d\eta^2\lambda^2\beta^2},\qquad\log\mathbb E_\mu e^{\lambda|W_r|}\le\log2+10d\eta^2\lambda^2\beta^2.\]

All objects and hypotheses

E is a finite-dimensional real inner product space with its Borel measurable structure, and d=finrank(E). Zero dimension is allowed. The real-valued function f is differentiable everywhere and its actual gradient is beta-Lipschitz, where beta>=0.
eta>0, lambda>=0, 12 beta^2 eta^2 lambda^2<=1, and h,x_plus in E satisfy norm(h-x_plus)<=sqrt(d eta).
The actual independent input law is mu=N(h,eta I) product N(0,eta I), explicitly the product of the pushforwards of standard Gaussian by z->h+sqrt(eta)z and z->sqrt(eta)z.
For each real r set theta=pi*r/2, gamma_r(x,z)=h+sin(theta)(x-h)+cos(theta)z, v_r(x,z)=(pi/2)(cos(theta)(x-h)-sin(theta)z), W_r=<v_r,grad f(x_plus)-grad f(gamma_r)> and F_r=exp(lambda abs(W_r)).

Mathematical proof

1. Establish finite quadratic Gaussian moments

Combine the standard one-dimensional Gaussian density with exp(t x^2). For t<1/2 the remaining Gaussian exponent is strictly negative, proving integrability before evaluating the integral. Expand the finite-dimensional standard Gaussian in an orthonormal basis; the squared norm is the sum of squared independent coordinates. Product integrability and Fubini give the exact power. On 0<=t<=1/4, a scalar logarithmic inequality bounds each factor by exp(2t). Scaling by sqrt(eta) supplies the nonstandard variance.

\[\mathbb E e^{t\|G\|^2}=(1-2t)^{-d/2}\le e^{2dt}\quad(0\le t\le1/4).\]

Corresponding Lean step

quadratic_integrable; quadratic_integral; quadratic_stdGaussian; quadratic_stdGaussian_bound; scaled_quadratic_bound

2. Integrate the independent velocity with both signs

For any fixed vector g and real a, the linear projection of a standard Gaussian has variance norm(g)^2. Add its positive and negative exponential moments to dominate exp(a abs(<g,G>)). Establish product integrability by dominating the integral of the fiber norm with an integrable position moment, then apply Fubini.

\[\mathbb E e^{a|\langle g,G\rangle|}\le\mathbb E e^{a\langle g,G\rangle}+\mathbb E e^{-a\langle g,G\rangle}=2e^{a^2\|g\|^2/2}.\]

Corresponding Lean step

linear_exp; linear_abs_exp; gaussian_product_abs_moment

3. Use the actual gradient and control the position moment

Differentiability identifies gradient f as the true gradient; its Lipschitz hypothesis implies norm(grad f(x_plus)-grad f(x))<=beta norm(x-x_plus). For c>=0 and x=h+Z, the squared triangle bound splits the reference-point contribution and the centered Gaussian contribution. This yields an integrable exponential majorant, not an assumed moment of the gradient.

\[\mathbb E e^{c\|\nabla f(x_+)-\nabla f(h+Z)\|^2}\le e^{2c\beta^2\|h-x_+\|^2+4dc\beta^2\eta},\quad 2c\beta^2\eta\le\tfrac14.\]

Corresponding Lean step

positional_moment; true_gradient_product_moment; DifferentiableAt.hasGradientAt

4. Check the source parameter range and constants

Put a=lambda(pi/2)sqrt(eta) and c=a^2/2. Since pi^2<=12, a^2<=3 eta lambda^2. The source range guarantees a^2 beta^2 eta<=1/4, exactly the quadratic moment condition. The center-distance assumption bounds the reference contribution. The two contributions sum to at most 9 d eta^2 lambda^2 beta^2, which is at most the displayed source constant 10.

\[a^2\beta^2\|h-x_+\|^2+2da^2\beta^2\eta\le9d\eta^2\lambda^2\beta^2\le10d\eta^2\lambda^2\beta^2.\]

Corresponding Lean step

source_constants; field_product_moment

5. Return to the actual arc estimator input law

First push the independent centered position and standard velocity through (z,y)->(h+z,(pi/2)sqrt(eta)y). The nonnegative velocity scale and inner-product symmetry identify the pulled-back integrand exactly. Then invoke GaussianArcLaw: the actual arc position and velocity jointly have this product law under the original independent input. Pull back both integrability and the integral equality; no surrogate random variable or unproved independence is substituted.

\[(\gamma_r,v_r)_\#\mu=N(h,\eta I)\otimes N(0,\tfrac{\pi^2}{4}\eta I).\]

Corresponding Lean step

gradient_output_moment; actual_gradient_arc_moment; GaussianArcLaw.gaussian_arc_law; integrable_map_measure; integral_map

6. Take logarithms only after proving positivity

The Gaussian pushforwards and their product are probability measures. Since lambda>=0, F_r>=1 pointwise; its established integrability therefore gives integral F_r>=1. Monotonicity of log applies to this positive integral, and log(2 exp(K))=log2+K. Measurability follows from the continuous gradient and the explicit arc maps.

\[1\le\mathbb E_\mu F_r\le2e^K\quad\Longrightarrow\quad\log\mathbb E_\mu F_r\le\log2+K.\]

Corresponding Lean step

smooth_gradient_arc_moment; Measure.isProbabilityMeasure_map; integral_mono; Real.log_le_log; Real.log_mul

Lean statement · smooth_gradient_arc_moment

The actual Gaussian-input gradient estimator is measurable and exponentially integrable, with explicit factor2 MGF and log2 bounds under the source range and center condition.

theorem smooth_gradient_arc_moment (f : E → ℝ) (hf : Differentiable ℝ f)
    (eta beta lam : ℝ) (heta : 0 < eta) (hbeta : 0 ≤ beta) (hlam : 0 ≤ lam)
    (hlip : LipschitzWith ⟨beta,hbeta⟩ (gradient f)) (h xp : E) (r : ℝ)
    (hcenter : ‖h-xp‖ ≤ Real.sqrt ((Module.finrank ℝ E : ℝ)*eta))
    (hrange : 12*beta^2*eta^2*lam^2 ≤ 1) :
    let mu := ((stdGaussian E).map (fun z : E => h + Real.sqrt eta • z)).prod
      ((stdGaussian E).map (fun z : E => Real.sqrt eta • z))
    let F := fun p : E × E => Real.exp (lam*|inner ℝ (momentVelocity h r p)
      (gradient f xp - gradient f (momentArc h r p))|)
    (∀ x, HasGradientAt f (gradient f x) x) ∧
    Measurable F ∧ Integrable F mu ∧
    (∫ p, F p ∂mu) ≤ 2*Real.exp (10*(Module.finrank ℝ E : ℝ)*eta^2*lam^2*beta^2) ∧
    Real.log (∫ p, F p ∂mu) ≤ Real.log 2 +
      10*(Module.finrank ℝ E : ℝ)*eta^2*lam^2*beta^2

Exact module and namespace context

Lean proof · smooth_gradient_arc_moment

Finite Gaussian quadratic moments, signed linear Gaussian moments, true-gradient Lipschitz domination, actual arc joint pushforward, and positivity before logarithms.

theorem smooth_gradient_arc_moment (f : E → ℝ) (hf : Differentiable ℝ f)
    (eta beta lam : ℝ) (heta : 0 < eta) (hbeta : 0 ≤ beta) (hlam : 0 ≤ lam)
    (hlip : LipschitzWith ⟨beta,hbeta⟩ (gradient f)) (h xp : E) (r : ℝ)
    (hcenter : ‖h-xp‖ ≤ Real.sqrt ((Module.finrank ℝ E : ℝ)*eta))
    (hrange : 12*beta^2*eta^2*lam^2 ≤ 1) :
    let mu := ((stdGaussian E).map (fun z : E => h + Real.sqrt eta • z)).prod
      ((stdGaussian E).map (fun z : E => Real.sqrt eta • z))
    let F := fun p : E × E => Real.exp (lam*|inner ℝ (momentVelocity h r p)
      (gradient f xp - gradient f (momentArc h r p))|)
    (∀ x, HasGradientAt f (gradient f x) x) ∧
    Measurable F ∧ Integrable F mu ∧
    (∫ p, F p ∂mu) ≤ 2*Real.exp (10*(Module.finrank ℝ E : ℝ)*eta^2*lam^2*beta^2) ∧
    Real.log (∫ p, F p ∂mu) ≤ Real.log 2 +
      10*(Module.finrank ℝ E : ℝ)*eta^2*lam^2*beta^2 := by
  have hc : ‖h-xp‖^2 ≤ (Module.finrank ℝ E : ℝ)*eta := by
    have hs := sq_le_sq₀ (norm_nonneg (h-xp)) (Real.sqrt_nonneg _) |>.mpr hcenter
    rwa [Real.sq_sqrt (by positivity)] at hs
  obtain ⟨hi,hv⟩ := actual_gradient_arc_moment f hf eta beta lam heta hbeta hlip h xp r hc hrange
  dsimp only
  refine ⟨fun x => (hf x).hasGradientAt, ?_, hi, hv, ?_⟩
  · have hg := hlip.continuous.measurable
    dsimp [momentArc,momentVelocity]
    fun_prop
  · have : IsProbabilityMeasure ((stdGaussian E).map (fun z : E => h+Real.sqrt eta • z)) :=
      Measure.isProbabilityMeasure_map (by fun_prop)
    have : IsProbabilityMeasure ((stdGaussian E).map (fun z : E => Real.sqrt eta • z)) :=
      Measure.isProbabilityMeasure_map (by fun_prop)
    have hlo : (1 : ℝ) ≤ ∫ p : E × E, Real.exp (lam*|inner ℝ (momentVelocity h r p)
        (gradient f xp-gradient f (momentArc h r p))|) ∂
        (((stdGaussian E).map (fun z : E => h+Real.sqrt eta • z)).prod
          ((stdGaussian E).map (fun z : E => Real.sqrt eta • z))) := by
      have hb := integral_mono (integrable_const (1 : ℝ)) hi
        (fun p => Real.one_le_exp (mul_nonneg hlam (abs_nonneg _)))
      simpa using hb
    have hh := Real.log_le_log (lt_of_lt_of_le zero_lt_one hlo) hv
    simpa only [Real.log_mul (by norm_num : (2 : ℝ) ≠ 0) (Real.exp_ne_zero _),
      Real.log_exp] using hh




end
end AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.SmoothGradientArcMoment

Exact module and namespace context

Source assumptions versus formal assumptions

Source	Actual Lean	Difference kind	Why it matters
Smooth case s=1 in positive Euclidean dimension with beta>0.	Finite-dimensional real inner product space, including dimension zero, and beta>=0.	generalization	The basis-independent argument and empty Gaussian product remain valid; beta=0 makes the true gradient constant. No division by beta is used.
Interpolation time lies in [0,1].	Every real r.	generalization	The actual joint Gaussian arc law holds at every real angle.
h=x0-eta grad f(x_plus) with norm(h-x_plus)<=sqrt(d eta).	Arbitrary h,x_plus subject to the same norm bound.	generalization	The moment proof only uses this bound. Constructing the actual source center remains a later consumer.
Smooth differentiable potential with beta-Lipschitz gradient, eta>0, lambda>=0 and the smooth moment range.	Differentiable real f, LipschitzWith beta on its actual gradient, eta>0, lambda>=0 and 12 beta^2 eta^2 lambda^2<=1.	same	The source smooth range is expressed without division, so the valid zero-beta extension is visible.
The Claim 1 proof and Claim 2 use a factor2 exponential moment; printed Claim 1 logarithmic formula lacks log2.	Integral exp(lambda abs(W))<=2 exp(10 d eta^2 lambda^2 beta^2), with log2 retained in the logarithmic form.	same	The attributed source is the proof-supported factor2 contract, not the differing printed log statement. That separate possible-source-error is preserved and no repair is silently adopted.
Expectations of the actual Gaussian arc gradient estimator.	Actual product of affine standard-Gaussian pushforwards; measurability and integrability are conclusions, and HasGradientAt identifies the gradient.	source-implicit	These analytic obligations justify the source integration and log steps; they are proved rather than added as moment assumptions.

This is the smooth s=1 source-proof-supported estimator moment, preserving the factor2 used by Claim 2. It is not a silent repair or proof of printed Claim 1 without log2. beta=0, d=0 and all real r are disclosed extensions. The actual center construction h=x0-eta grad f(x_plus), clipping, target log-weight mean identification, normalized Renyi error, initialization and terminal query cost remain separate. No full SPHMC or PBPS main result is asserted.

Encoder–denoiser: accepted · domain-mismatch

Detected semantic differences

domains: Zero dimension and beta0 valid without division; constant gradient yields zero estimator. — Independent formal reviewer accepted this disclosed delta.
quantifiers: All-real time follows from parent law. — Independent formal reviewer accepted this disclosed delta.
assumptions: Arbitrary center satisfies exact source distance condition; construction separate. — Independent formal reviewer accepted this disclosed delta.
assumptions: Actual differentiability, gradient Lipschitzness and smooth polynomial range match selected nonnegative-lambda contract. — Independent formal reviewer accepted this disclosed delta.
conclusion: Factor2/log2 matches cited proof-supported contract, not differing printed Claim1. — Independent formal reviewer accepted this disclosed delta.
objects: Actual input, gradient identity, measurability and integrability are proved. — Independent formal reviewer accepted this disclosed delta.

A generalization is not a source correction. Proposed missing conditions require separate independent repair review. No proposed repair silently changes the original theorem.

Scope and omitted-condition boundaries

This is the smooth s=1 source-proof-supported estimator moment, preserving the factor2 used by Claim 2. It is not a silent repair or proof of printed Claim 1 without log2. beta=0, d=0 and all real r are disclosed extensions. The actual center construction h=x0-eta grad f(x_plus), clipping, target log-weight mean identification, normalized Renyi error, initialization and terminal query cost remain separate. No full SPHMC or PBPS main result is asserted.

Source and reuse

ASTIS parents called

AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.GaussianArcLaw.gaussian_arc_law

Mathlib API called (external library)

ProbabilityTheory.mgf_gaussianReal
ProbabilityTheory.integrable_exp_mul_gaussianReal
MeasureTheory.integrable_map_measure
MeasureTheory.integral_map
MeasureTheory.integral_fintype_prod_eq_pow
MeasureTheory.Integrable.fintype_prod
Real.log_le_log

Mathematical sources

D.1 Claim 1 proof and Claim 2, smooth case — Factor-2 exponential moment from the proof, with the corresponding log2 term retained.
SPHMC Appendix A.1 and A.4(2) — Terminal gradient-estimator approximation consumer.

ASTIS prose is not a quotation or a source-equivalence certificate. Definitions and aliases are explained as constructions, not counted as new mathematical proofs.

Which proof edges are actually covered?

Local proof component; source adapter/review separate Actual smooth gradient estimator moment required for clipping and target approximation

Joint posterior recovery with measurable state-dependent RGO parameters

Fan Chen, Sinho Chewi, Jianfeng Lu and Matthew S. Zhang; ASTIS expanded state-dependent joint-kernel semantics, no author endorsement implied.

arXiv:2609.06906v1 · Algorithm3.3 parameter update and Theorem6.5 ideal state-dependent stage · faithful paraphrase

Complete source statement (ASTIS restatement)

Let E be a finite-dimensional real inner-product Borel space, S any measurable space, and mu a probability measure on E. Let b,a:S to R and u:S to E be measurable, with b(s)>=0 and a(s)>0 everywhere. There exist Markov kernels T,H:S to E and B:S times E to S times E, chosen before every probability state law nu. Every T(s) is the normalized mu tilt by -b(s)*norm(x-u(s))^2/2; H(s) is its actual Gaussian smoothing at standard deviation sqrt(a(s)). Every B(s,y) retains s and draws x from the actual backward tilt of T(s) by -norm(x-y)^2/(2a(s)). Equivalently, it uses the original mu tilt with precision b(s)+1/a(s) and center (b(s)*u(s)+y/a(s))/(b(s)+1/a(s)). For every probability nu, B composed with nu compProd H equals nu compProd T.

E is a finite-dimensional real inner-product space with its Borel measurable structure, including dimension zero; mu is an arbitrary probability measure.
S has only a measurable-space structure. No topology, standard Borel condition, or moment condition on the state law is needed.
b,a,u are measurable on S, with b nonnegative and a strictly positive at every state. No fixed or deterministic schedule is imposed.
All global kernels precede the universally quantified probability state law. Both posterior formulas hold at every state and observation.
Recovery assumes the actual ideal input nu compProd H. State may encode past history and its parameters are fixed conditional on the current call input. This does not assume one predetermined schedule for all calls or construct the actual approximate sampler.

Actual retained-state joint recovery

\[B\circ_m(\nu\otimes_m H)=\nu\otimes_m T,\qquad T(s)=\mu.\mathrm{tilted}\!\left(-\frac{b(s)}2\|x-u(s)\|^2\right).\]

Read the formalized proofs

Each statement and proof below has its own closed Lean disclosure. ASTIS parents, Mathlib calls and external mathematical sources are distinguished in each proof.

ASTIS mathematical exposition

Joint posterior recovery with measurable state-dependent RGO parameters

AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.StateDependentRGO.state_dependent_recovery · theorem · Teaching coverage

Statement

\[B\circ_m(\nu\otimes_m H)=\nu\otimes_m T,\qquad T(s)=\mu.\mathrm{tilted}\!\left(-\frac{b(s)}2\|x-u(s)\|^2\right).\]

All objects and hypotheses

E is a finite-dimensional real inner-product space with its Borel measurable structure, including dimension zero; mu is an arbitrary probability measure.
S has only a measurable-space structure. No topology, standard Borel condition, or moment condition on the state law is needed.
b,a,u are measurable on S, with b nonnegative and a strictly positive at every state. No fixed or deterministic schedule is imposed.
All global kernels precede the universally quantified probability state law. Both posterior formulas hold at every state and observation.
Recovery assumes the actual ideal input nu compProd H. State may encode past history and its parameters are fixed conditional on the current call input. This does not assume one predetermined schedule for all calls or construct the actual approximate sampler.

Mathematical proof

1. Normalize a jointly measurable quadratic weight

On the parameter space of nonnegative precision and center, the quadratic exponential weight is jointly measurable, strictly positive and at most one. Its integral against the probability base is therefore finite and strictly positive. The parameter integral is measurable. Divide by this integral to construct one global Markov kernel through withDensity, including zero precision.

\[w_{q,v}(x)=e^{-q\|x-v\|^2/2},\quad 0<Z(q,v)=\int w_{q,v}\,d\mu\le1,\quad R(q,v)=\frac{w_{q,v}}{Z(q,v)}\mu.\]

Corresponding Lean step

Local universalTilt: integrable_const domination, integral_exp_pos, StronglyMeasurable.integral_prod_right, Kernel.withDensity, isProbabilityMeasure_tilted.

2. Use measurable current and updated parameters

Compose the same global parameter kernel with the current-state map to obtain T and with the updated state-observation map to obtain K. The new precision is positive and the weighted center is measurable. This proves joint measurability; separate existential kernels for each parameter would not suffice.

\[q^+(s)=b(s)+a(s)^{-1}>0,\quad c(s,y)=q^+(s)^{-1}\bigl(b(s)u(s)+a(s)^{-1}y\bigr),\quad K(s,y)=R(q^+(s),c(s,y)).\]

Corresponding Lean step

Measurable.subtype_mk, Measurable.prodMk, Kernel.comap; local t,q,c,r and hKupdated.

3. Construct the state-dependent Gaussian observation

Retain the input state and draw an independent standard Gaussian. Map this pair to sqrt(a(s)) times the Gaussian to form N. The product of T and N followed by addition defines H. Product and pushforward formulas establish the exact smoothing fiber and Markov property.

\[N(s)=\operatorname{Law}(\sqrt{a(s)}G),\qquad H(s)=\operatorname{Law}(X+\sqrt{a(s)}G),\quad X\sim T(s),\ G\sim\mathsf N(0,I)\text{ independently}.\]

Corresponding Lean step

Kernel.deterministic, Kernel.const, Kernel.prod, Kernel.map, Kernel.IsMarkovKernel.map; Measure.dirac_prod and Measure.map_map.

4. Identify the actual posterior and retain the state

Quadratic tilt closure identifies K with the backward tilt of T for every state and observation. Pair K with the deterministic state coordinate to form B. The already constructed section K(s,.) is identified with the existing pointwise recovery theorem; no measurable choice over pointwise witnesses is used.

\[K(s,y)=T(s).\mathrm{tilted}\!\left(-\frac{\|x-y\|^2}{2a(s)}\right),\quad B(s,y)=(x\mapsto(s,x))_\#K(s,y),\quad K(s,\cdot)\circ_mH(s)=T(s).\]

Corresponding Lean step

RGOClosure.quadratic_tilt_tilt, RGOBackward.rgo_backward_recovery; local hKf,hBf,hrec and kernel extensionality.

5. Recover the complete joint state-target law

For each measurable event in S times E, take its measurable section at a fixed state. The bind and compProd identities give the output event mass as an iterated nonnegative integral. Section recovery replaces the inner integral by T(s) of the section, yielding nu compProd T. No state coordinate or dependence is discarded.

\[\int_S\!\int_E B(s,y)(A)\,H(s)(dy)\,\nu(ds)=\int_S T(s)(A_s)\,\nu(ds).\]

Corresponding Lean step

Measure.bind_apply, Measure.lintegral_compProd, Measure.compProd_apply, Measure.map_apply, lintegral_congr.

Lean statement · state_dependent_recovery

Globally measurable state-dependent RGO target, Gaussian observation and retained-state posterior with actual joint recovery.

theorem state_dependent_recovery (μ : Measure E) [IsProbabilityMeasure μ]
    (b a : S → ℝ) (u : S → E) (hb : Measurable b) (ha : Measurable a)
    (hu : Measurable u) (hb0 : ∀ s, 0 ≤ b s) (ha0 : ∀ s, 0 < a s) :
    ∃ (T H : Kernel S E) (B : Kernel (S × E) (S × E)),
      IsMarkovKernel T ∧ IsMarkovKernel H ∧ IsMarkovKernel B ∧
      (∀ s, T s = μ.tilted (fun x => -(b s/2)*‖x-u s‖^2)) ∧
      (∀ s, H s = GaussianSmoothing.gaussianSmoothing (T s) (Real.sqrt (a s))) ∧
      (∀ s y, B (s,y) = Measure.map (Prod.mk s)
        ((T s).tilted (fun x => -‖x-y‖^2/(2*a s)))) ∧
      (∀ s y, B (s,y) = Measure.map (Prod.mk s)
        (μ.tilted (fun x => -((b s+(a s)⁻¹)/2)*
          ‖x-(b s+(a s)⁻¹)⁻¹ • (b s • u s+(a s)⁻¹ • y)‖^2))) ∧
      ∀ (ν : Measure S), IsProbabilityMeasure ν → B ∘ₘ (ν ⊗ₘ H) = ν ⊗ₘ T

Exact module and namespace context

Lean proof · state_dependent_recovery

Construct a normalized parameter kernel, comap along measurable current and updated states, construct actual variable Gaussian noise, identify posterior fibers and integrate section recovery.

theorem state_dependent_recovery (μ : Measure E) [IsProbabilityMeasure μ]
    (b a : S → ℝ) (u : S → E) (hb : Measurable b) (ha : Measurable a)
    (hu : Measurable u) (hb0 : ∀ s, 0 ≤ b s) (ha0 : ∀ s, 0 < a s) :
    ∃ (T H : Kernel S E) (B : Kernel (S × E) (S × E)),
      IsMarkovKernel T ∧ IsMarkovKernel H ∧ IsMarkovKernel B ∧
      (∀ s, T s = μ.tilted (fun x => -(b s/2)*‖x-u s‖^2)) ∧
      (∀ s, H s = GaussianSmoothing.gaussianSmoothing (T s) (Real.sqrt (a s))) ∧
      (∀ s y, B (s,y) = Measure.map (Prod.mk s)
        ((T s).tilted (fun x => -‖x-y‖^2/(2*a s)))) ∧
      (∀ s y, B (s,y) = Measure.map (Prod.mk s)
        (μ.tilted (fun x => -((b s+(a s)⁻¹)/2)*
          ‖x-(b s+(a s)⁻¹)⁻¹ • (b s • u s+(a s)⁻¹ • y)‖^2))) ∧
      ∀ (ν : Measure S), IsProbabilityMeasure ν → B ∘ₘ (ν ⊗ₘ H) = ν ⊗ₘ T := by
  have universalTilt : ∃ R : Kernel (ℝ≥0 × E) E, IsMarkovKernel R ∧
      ∀ s, R s = μ.tilted (fun x => -((s.1 : ℝ)/2)*‖x-s.2‖^2) := by
    let w : (ℝ≥0 × E) → E → ℝ := fun s x => Real.exp (-((s.1 : ℝ) / 2) * ‖x-s.2‖^2)
    have hw : Measurable (Function.uncurry w) := by
      dsimp [w, Function.uncurry]
      fun_prop
    have hI (s : (ℝ≥0 × E)) : Integrable (w s) μ := by
      refine (integrable_const (1 : ℝ)).mono' (by fun_prop) ?_
      filter_upwards with x
      rw [Real.norm_eq_abs, abs_of_pos (Real.exp_pos _)]
      exact Real.exp_le_one_iff.mpr (mul_nonpos_of_nonpos_of_nonneg
        (neg_nonpos.mpr (div_nonneg s.1.coe_nonneg (by positivity))) (sq_nonneg _))
    let Z : (ℝ≥0 × E) → ℝ := fun s => ∫ x, w s x ∂μ
    have hZpos (s : (ℝ≥0 × E)) : 0 < Z s := integral_exp_pos (hI s)
    have hZ : Measurable Z := hw.stronglyMeasurable.integral_prod_right.measurable
    let d : (ℝ≥0 × E) → E → ℝ≥0∞ := fun s x => ENNReal.ofReal (w s x / Z s)
    have hd : Measurable (Function.uncurry d) :=
      (hw.div (hZ.comp measurable_fst)).ennreal_ofReal
    let T : Kernel (ℝ≥0 × E) E := (Kernel.const (ℝ≥0 × E) μ).withDensity d
    have hf (s : (ℝ≥0 × E)) : T s = μ.tilted (fun x => -((s.1 : ℝ) / 2) * ‖x-s.2‖^2) := by
      rw [show T = (Kernel.const (ℝ≥0 × E) μ).withDensity d from rfl,
        Kernel.withDensity_apply _ hd]
      rfl
    refine ⟨T, ⟨fun s => ?_⟩, hf⟩
    rw [hf]
    exact isProbabilityMeasure_tilted (hI s)
  obtain ⟨R,hR,hRf⟩ := universalTilt
  let := hR
  let t : S → ℝ≥0 × E := fun s => (⟨b s, hb0 s⟩, u s)
  have ht : Measurable t := (hb.subtype_mk).prodMk hu
  let T := R.comap t ht
  have hT : IsMarkovKernel T := inferInstance
  have hTf (s : S) : T s = μ.tilted (fun x => -(b s/2)*‖x-u s‖^2) := hRf (t s)
  let := hT
  let q : S × E → ℝ := fun p => b p.1 + (a p.1)⁻¹
  let c : S × E → E := fun p => (b p.1+(a p.1)⁻¹)⁻¹ •
    (b p.1 • u p.1+(a p.1)⁻¹ • p.2)
  have hq : Measurable q := by dsimp [q]; fun_prop
  have hc : Measurable c := by dsimp [c]; fun_prop
  have hq0 (p : S × E) : 0 ≤ q p :=
    le_of_lt (add_pos_of_nonneg_of_pos (hb0 p.1) (inv_pos.mpr (ha0 p.1)))
  let r : S × E → ℝ≥0 × E := fun p => (⟨q p, hq0 p⟩, c p)
  have hr : Measurable r := (hq.subtype_mk).prodMk hc
  let K := R.comap r hr
  have hK : IsMarkovKernel K := inferInstance
  have hKupdated (p : S × E) : K p = μ.tilted (fun x => -(q p/2)*‖x-c p‖^2) := hRf (r p)
  let := hK
  let N : Kernel S E :=
    ((Kernel.deterministic (id : S → S) measurable_id) ×ₖ Kernel.const S (stdGaussian E)).map
      (fun p : S × E => Real.sqrt (a p.1) • p.2)
  have hN : IsMarkovKernel N := by
    dsimp only [N]
    exact Kernel.IsMarkovKernel.map _ (by fun_prop)
  let := hN
  have hNf (s : S) : N s = GaussianSmoothing.scaledStdGaussian (E := E) (Real.sqrt (a s)) := by
    dsimp only [N]
    rw [Kernel.map_apply _ (by fun_prop), Kernel.prod_apply, Kernel.deterministic_apply,
      Kernel.const_apply, Measure.dirac_prod, Measure.map_map (by fun_prop) (by fun_prop)]
    rfl
  let H := (T ×ₖ N).map (fun p : E × E => p.1+p.2)
  have hH : IsMarkovKernel H := by
    dsimp only [H]
    exact Kernel.IsMarkovKernel.map _ (by fun_prop)
  let := hH
  have hHf (s : S) : H s = GaussianSmoothing.gaussianSmoothing (T s) (Real.sqrt (a s)) := by
    dsimp only [H]
    rw [Kernel.map_apply _ (by fun_prop), Kernel.prod_apply, hNf]
    rfl
  have hKf (s : S) (y : E) : K (s,y) =
      (T s).tilted (fun x => -‖x-y‖^2/(2*a s)) := by
    rw [hKupdated,hTf]
    have heq : (fun x : E => -‖x-y‖^2/(2*a s)) =
        (fun x => -((a s)⁻¹/2)*‖x-y‖^2) := by
      funext x
      field_simp
    rw [heq]
    exact (RGOClosure.quadratic_tilt_tilt μ (hb0 s) (inv_pos.mpr (ha0 s)) (u s) y).symm
  let B := (Kernel.deterministic (Prod.fst : S × E → S) measurable_fst) ×ₖ K
  have hB : IsMarkovKernel B := inferInstance
  let := hB
  have hBf (s : S) (y : E) : B (s,y) = Measure.map (Prod.mk s) (K (s,y)) := by
    dsimp only [B]
    rw [Kernel.prod_apply, Kernel.deterministic_apply, Measure.dirac_prod]
  have hrec (s : S) : (K.comap (Prod.mk s) measurable_prodMk_left) ∘ₘ H s = T s := by
    obtain ⟨_,R,hR,hRf,_,hrecover,_⟩ :=
      RGOBackward.rgo_backward_recovery μ (b s) (a s) (hb0 s) (ha0 s) (u s)
    have heq : K.comap (Prod.mk s) measurable_prodMk_left = R := by
      ext y : 1
      change K (s,y) = R y
      rw [hKf,hTf,hRf]
    rw [heq,hHf,hTf]
    exact hrecover
  refine ⟨T,H,B,hT,hH,hB,hTf,hHf,?_,?_,?_⟩
  · intro s y
    rw [hBf,hKf]
  · intro s y
    rw [hBf,hKupdated]
  · intro ν hν
    let := hν
    ext t ht
    rw [Measure.bind_apply ht B.aemeasurable, Measure.lintegral_compProd (B.measurable_coe ht),
      Measure.compProd_apply ht]
    apply lintegral_congr
    intro s
    have ht' := ht.preimage (measurable_prodMk_left (x := s))
    have heq := congrArg (fun m : Measure E => m ((Prod.mk s) ⁻¹' t)) (hrec s)
    rw [Measure.bind_apply ht' (K.comap (Prod.mk s) measurable_prodMk_left).aemeasurable] at heq
    rw [← heq]
    apply lintegral_congr
    intro y
    rw [hBf,Measure.map_apply measurable_prodMk_left ht]
    rfl

end AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.StateDependentRGO

Exact module and namespace context

Source assumptions versus formal assumptions

Source	Actual Lean	Difference kind	Why it matters
Algorithm3.3 uses a Euclidean Gibbs base target.	Arbitrary probability base mu on finite-dimensional real inner-product Borel E, including dimension zero.	generalization	Exact quadratic posterior recovery does not need a potential, curvature, density or moments; concrete Gibbs identification remains separate.
The current recursive target has center u and precision 1/A; new variance is (eta+tau)/beta_A.	Measurable b,a,u on arbitrary measurable S, with b>=0 and a>0 everywhere.	source-implicit	State can encode current history. Parameters are not assumed constant; actual source parameter maps and report/output semantics must still be instantiated.
The RGO closure updates inverse variance and center.	Both everywhere posterior formulas use b(s)+1/a(s) and weighted center (b(s)u(s)+y/a(s))/(b(s)+1/a(s)).	same	The normalized tilt composition is proved, including b(s)=0, without assuming posterior normalization.
The ideal Gaussian observation and posterior stage underpin recursive correctness.	Construct globally measurable T,H,B before every state distribution; B retains s and B composed with nu compProd H equals nu compProd T.	source-implicit	Joint normalized parameter kernel, state-dependent Gaussian law and full joint recovery are proved rather than assumed or selected pointwise.
The interface selects eta for each fixed call input and supplies a sample; the full algorithm recurses, terminates with FORS and has discrepancy/cost guarantees.	Exact ideal nu compProd H input for measurable current-state parameters, fixed conditional on the call input.	API-limitation	Actual output sampler kernels, recursion and stopping, terminal implementation, accuracy and expected costs remain open. This is a required kernel semantics edge, not full Algorithm3.3.

Fixed probability base, arbitrary measurable state space and measurable current-state parameters. Exact ideal joint observation law only. The source interface selects a smoothing level for each fixed call input; this theorem does not construct its actual output sampler, recursive stopping, FORS, numerical accuracy or expected query costs.

Encoder–denoiser: accepted · domain-mismatch

Detected semantic differences

domains: General probability base and finite-dimensional Hilbert setting; no moments inferred. — No Gibbs density, topology or standard Borel structure on S; integration uses event sections rather than state disintegration.
assumptions: Measurable state maps abstract actual source parameters; their concrete instantiation remains. — hI domination, hZpos positive normalizer, hZ/hd measurability and proved RGO section recovery.
conclusion: Everywhere normalized posterior includes b=0; a=0 excluded. — Arbitrary measurable events and sections, bind and compProd integrals retain the state coordinate.
quantifiers: Complete retained-state recovery for every state law is an explicit ideal-stage elaboration. — Fixed-state witness only identifies an already constructed global section.
scopes: Eta selected per fixed call input; random runtime report extension is not asserted to be a required paper gap. Full sampler remains open. — Binding is prerequisite; documentation excludes complete algorithm and numerical/cost guarantees.

A generalization is not a source correction. Proposed missing conditions require separate independent repair review. No proposed repair silently changes the original theorem.

Scope and omitted-condition boundaries

Fixed probability base, arbitrary measurable state space and measurable current-state parameters. Exact ideal joint observation law only. The source interface selects a smoothing level for each fixed call input; this theorem does not construct its actual output sampler, recursive stopping, FORS, numerical accuracy or expected query costs.

Source and reuse

ASTIS parents called

Mathlib API called (external library)

MeasureTheory.integral_exp_pos
MeasureTheory.isProbabilityMeasure_tilted
ProbabilityTheory.Kernel.withDensity
ProbabilityTheory.Kernel.comap
ProbabilityTheory.Kernel.prod
ProbabilityTheory.Kernel.map
MeasureTheory.Measure.lintegral_compProd
MeasureTheory.Measure.bind_apply

Mathematical sources

SPHMC v1 Algorithm 3.3 and Theorem 6.5 — Expanded ideal stage semantics with measurable state-dependent parameters; not the full recursive algorithm.

ASTIS prose is not a quotation or a source-equivalence certificate. Definitions and aliases are explained as constructions, not counted as new mathematical proofs.

Which proof edges are actually covered?

TODO — not closed by these contributions Measurable state-dependent ideal posterior update and full joint recovery

Actual stopped Gaussian RGO output correctness under sampler interfaces

Fan Chen, Sinho Chewi, Jianfeng Lu and Matthew S. Zhang; ASTIS expanded stopped Gaussian output correctness under supplied sampler interfaces, no author endorsement implied.

arXiv:2609.06906v1 · Theorem6.5 equations(6.2)-(6.5), same-program stopping and output error · faithful paraphrase

Complete source statement (ASTIS restatement)

Let E be a finite-dimensional real inner-product Borel space of positive real dimension d, and mu a probability measure. States s=(b,u,k,h) belong to NNReal times E times Nat times E^Nat. Let eta be measurable with 0<eta(s)<=c at every state. Assume kappa>=1, 0<c<1/4, 0<Delta<=1/2, 0<gamma<=1 and C>=8. Fix s0. Define K(r)=(1+r)/(1/kappa+r), tau(r)=K(r) if K(r)>=2 and c otherwise, a(s)=(eta(s)+tau(b))/(1+b), ell=2+log(K(b0)*d*2/Delta), B=gamma/(sqrt(d*ell)+ell), J=ceil(C*log(e*K(b0)/B)), and D={s:1/B<=b}. There exist Markov T,H with T(s) the normalized quadratic tilt of mu at precision b and center u, and H(s) its Gaussian smoothing at standard deviation sqrt(a(s)). After T,H are fixed, take any Markov M,L such that at each s outside D, squared W2(M(s),GaussianSmoothing(T(s),sqrt(eta(s)/(1+b))))<=ofReal(K(b)*[2*tau(b)*Delta^2/(K(b)*(J+1))]/(1+b)). There exist F,Q,P,R: F updates precision to b+1/a(s), center to (b*u+y/a(s))/(b+1/a(s)), count to k+1 and prepends y to history; Q(s) is M(s) with independent Gaussian variance tau(b)/(1+b) added; P(s)=dirac s on D and otherwise the F(s,.) pushforward of Q(s). Q,P and all R_n are Markov and R_n=L composed with P^n. B>0, P^J(s0)(D)=1, and R_(J+m)(s0)=R_J(s0) for all m. Without terminal accuracy assumptions, KL(R_J(s0)||T(s0))<=J*ofReal(Delta^2/(J+1))+integral over D of KL(L(x)||T(x)) under P^J(s0). If KL(L(s)||T(s))<=ofReal(Delta^2/(J+1)) holds for every s in D, then KL(R_(J+m)(s0)||T(s0))<=ofReal(Delta^2) for every natural m.

E has its Borel structure and actual dimension d=finrank_R(E)>0; mu is any probability measure.
kappa>=1,0<c<1/4,0<Delta<=1/2,0<gamma<=1,C>=8; eta is measurable and in (0,c] at every state.
q=2 is fixed. B and J are computed once from the fixed initial state s0 and used throughout execution.
M,L are Markov kernels. Only states outside D require the displayed source-scaled squared-W2 premise for M.
Terminal KL is unrestricted for the residual inequality. Only the final total-error implication assumes its bound on D; no condition is imposed outside D.

Actual stopped Gaussian output error

\[(P^J(s_0))(D)=1,\quad R_{J+m}(s_0)=R_J(s_0),\qquad\operatorname{KL}(R_J(s_0)\Vert T(s_0))\le\frac{J\Delta^2}{J+1}+\int_D\operatorname{KL}(L(x)\Vert T(x))\,P^J(s_0)(dx).\]

Read the formalized proofs

Each statement and proof below has its own closed Lean disclosure. ASTIS parents, Mathlib calls and external mathematical sources are distinguished in each proof.

ASTIS mathematical exposition

Actual stopped Gaussian RGO output correctness under sampler interfaces

AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.StoppedGaussianRGOError.stopped_gaussian_rgo_error · theorem · Teaching coverage

Statement

\[(P^J(s_0))(D)=1,\quad R_{J+m}(s_0)=R_J(s_0),\qquad\operatorname{KL}(R_J(s_0)\Vert T(s_0))\le\frac{J\Delta^2}{J+1}+\int_D\operatorname{KL}(L(x)\Vert T(x))\,P^J(s_0)(dx).\]

All objects and hypotheses

E has its Borel structure and actual dimension d=finrank_R(E)>0; mu is any probability measure.
kappa>=1,0<c<1/4,0<Delta<=1/2,0<gamma<=1,C>=8; eta is measurable and in (0,c] at every state.
q=2 is fixed. B and J are computed once from the fixed initial state s0 and used throughout execution.
M,L are Markov kernels. Only states outside D require the displayed source-scaled squared-W2 premise for M.
Terminal KL is unrestricted for the residual inequality. Only the final total-error implication assumes its bound on D; no condition is imposed outside D.

Mathematical proof

1. Fix source parameters and the terminal threshold

Compose the precision coordinate with the rational conditioning function K; positivity follows from kappa>=1 and nonnegative precision. Its branch tau is measurable and positive. Apply LogarithmicDepth with the auxiliary constant sequence c and q=2 to obtain B>0, so 1/B defines a nonnegative threshold. This preliminary call does not establish termination of the actual path.

\[\beta(s)=1+b(s),\quad\kappa(s)=K(b(s)),\quad B>0,\quad D=\{s:B^{-1}\le b(s)\}.\]

Corresponding Lean step

hKm,hKpos,htm,htpos; auxiliary LogarithmicDepth.terminal_depth and threshold theta.

2. Construct the actual source-accuracy program

Instantiate GaussianRGOErrorBudget with beta(s)=1+b and kappa(s)=K(b), not the baseline kappa. Its T,H precede the actual M,L. From the continuing-state W2 premise, obtain the actual added-noise Q and the explicit update F, absorbed transition P and recursive outputs R. Retain its finite-depth error bound and terminal residual.

\[Q(s)=H_{\tau(b)/(1+b)}M(s),\qquad R_{n+1}(s)=L(s)\ \text{on }D,\quad R_{n+1}(s)=\int R_n(F(s,y))\,Q(s)(dy)\ \text{off }D.\]

Corresponding Lean step

GaussianRGOErrorBudget.gaussian_rgo_error_budget and hprog M L.

3. Prove that the stopping theorem uses the same transition

Call StoppedRGODepth with the actual Q and the same L and initial parameters. It returns another update and transition. Prove the two updates equal using the real precision coordinate and every remaining coordinate. Their transition fibers then agree because their Q and fixed threshold agree. This transfers the stopping theorem to the actual error program, rather than assuming existential witnesses coincide.

\[F=F^{\prime},\qquad P=P^{\prime}.\]

Corresponding Lean step

StoppedRGODepth.stopped_rgo_depth; hFeq via Prod.ext and Subtype.ext; hPeq via kernel extensionality and threshold coercion.

4. Align output kernels and transfer cap stability

Recover measurability of the actual F from its explicit coordinate formula. For the recursive outputs, prove R_(n+1)=R_n composed with P by splitting stopped and continuing states and using pushforward integration. Induction gives R_n=L composed with P^n. The stopping theorem gives the same formula for its outputs, hence the two output families agree, and stability beyond J transfers to the actual family.

\[R_n=L\circ_kP^n=R_n^{\prime},\qquad R_{J+m}(s_0)=R_J(s_0).\]

Corresponding Lean step

hFexact,hFm; local recursive_output_powers; hRp,hReq and hstable'.

5. Restrict the residual to the actual terminal set

The transferred stopping theorem states that the actual law P^J(s0) gives D mass one. Convert this to almost-everywhere terminal membership, hence restriction to D leaves that measure unchanged. Apply the Gaussian budget at exactly J and rewrite its residual as the integral over D. This step needs no terminal KL bound and includes infinite residual.

\[P^J(s_0)|_D=P^J(s_0),\qquad\operatorname{KL}(R_J(s_0)\Vert T(s_0))\le Jc_*+\int_D\operatorname{KL}(L(x)\Vert T(x))\,P^J(s_0)(dx),\quad c_*=\Delta^2/(J+1).\]

Corresponding Lean step

hmass; mem_ae_iff_prob_eq_one, restrict_eq_self_of_ae_mem and hbound J s0.

6. Use terminal-only accuracy and then output stability

Assume the terminal KL interface only on D. The actual J-step law is almost surely in D, so nonnegative integral monotonicity bounds its residual by one allocation. Add the J observation allocations and use (J+1)*Delta^2/(J+1)=Delta^2. Finally transfer that J-depth bound to every J+m via the already proved equality of output laws. Applying the general linear budget at J+m would not establish this conclusion.

\[Jc_*+c_*=(J+1)c_*=\Delta^2,\qquad\operatorname{KL}(R_{J+m}(s_0)\Vert T(s_0))\le\Delta^2.\]

Corresponding Lean step

hterminal,lintegral_mono_ae,probability normalization,ENNReal.ofReal arithmetic and hstable'.

Lean statement · stopped_gaussian_rgo_error

Actual stopped Gaussian RGO output correctness under supplied A1 and terminal KL interfaces.

theorem stopped_gaussian_rgo_error (μ : Measure E) [IsProbabilityMeasure μ]
    (η : PS → ℝ) (hηm : Measurable η) (κ c Δ γ C : ℝ)
    (hκ : 1 ≤ κ) (hc : 0 < c) (hc1 : c < 1/4)
    (hη : ∀ s, 0 < η s ∧ η s ≤ c) (hd : 0 < Module.finrank ℝ E)
    (hΔ : 0 < Δ) (hΔ1 : Δ ≤ 1/2) (hγ : 0 < γ) (hγ1 : γ ≤ 1) (hC : 8 ≤ C) (s0 : PS) :
    let K := fun r : ℝ => (1+r)/(κ⁻¹+r)
    let τ := fun r : ℝ => if 2 ≤ K r then K r else c
    let a := fun s : PS => (η s+τ s.1)/(1+s.1)
    let ell := 2+Real.log (K s0.1*Module.finrank ℝ E*2/Δ)
    let B := γ/(Real.sqrt (Module.finrank ℝ E*ell)+ell)
    let J := Nat.ceil (C*Real.log (Real.exp 1*K s0.1/B))
    let D : Set PS := {s | B⁻¹ ≤ (s.1:ℝ)}
    ∃ T H : Kernel PS E, IsMarkovKernel T ∧ IsMarkovKernel H ∧
      (∀ s, T s = μ.tilted (fun x => -((s.1:ℝ)/2)*‖x-s.2.1‖^2)) ∧
      (∀ s, H s = GaussianSmoothing.gaussianSmoothing (T s) (Real.sqrt (a s))) ∧
      ∀ M L : Kernel PS E, IsMarkovKernel M → IsMarkovKernel L →
      (∀ s, s ∉ D → WassersteinSpace.wassersteinDistance (M s)
        (GaussianSmoothing.gaussianSmoothing (T s) (Real.sqrt (η s/(1+s.1))))^2 ≤
        ENNReal.ofReal (K s.1*(2*τ s.1*Δ^2/(K s.1*((J:ℝ)+1)))/(1+s.1))) →
      ∃ (F : PS × E → PS) (Q : Kernel PS E) (P : Kernel PS PS) (R : ℕ → Kernel PS E),
        (∀ s y, ((F (s,y)).1:ℝ) = (s.1:ℝ)+(a s)⁻¹ ∧
          (F (s,y)).2 = (((s.1:ℝ)+(a s)⁻¹)⁻¹ • ((s.1:ℝ) • s.2.1+(a s)⁻¹ • y),
            s.2.2.1+1,fun n => Nat.casesOn n y s.2.2.2)) ∧
        IsMarkovKernel Q ∧ IsMarkovKernel P ∧ (∀ n, IsMarkovKernel (R n)) ∧
        (∀ s, Q s = GaussianSmoothing.gaussianSmoothing (M s) (Real.sqrt (τ s.1/(1+s.1)))) ∧
        (∀ s, P s = if s ∈ D then Measure.dirac s else (Q s).map (fun y => F (s,y))) ∧
        (∀ n, R n = L ∘ₖ (P^n)) ∧
        0 < B ∧ (P^J) s0 D = 1 ∧
        (∀ m, R (J+m) s0 = R J s0) ∧
        klDiv (R J s0) (T s0) ≤ (J:ℝ≥0∞)*ENNReal.ofReal (Δ^2/((J:ℝ)+1)) +
          ∫⁻ x in D, klDiv (L x) (T x) ∂(P^J) s0 ∧
        ((∀ s ∈ D, klDiv (L s) (T s) ≤ ENNReal.ofReal (Δ^2/((J:ℝ)+1))) →
          ∀ m, klDiv (R (J+m) s0) (T s0) ≤ ENNReal.ofReal (Δ^2))

Exact module and namespace context

Lean proof · stopped_gaussian_rgo_error

Source schedule, actual Gaussian program, explicit witness equality, recursive powers, terminal support restriction and J-budget plus cap stability.

theorem stopped_gaussian_rgo_error (μ : Measure E) [IsProbabilityMeasure μ]
    (η : PS → ℝ) (hηm : Measurable η) (κ c Δ γ C : ℝ)
    (hκ : 1 ≤ κ) (hc : 0 < c) (hc1 : c < 1/4)
    (hη : ∀ s, 0 < η s ∧ η s ≤ c) (hd : 0 < Module.finrank ℝ E)
    (hΔ : 0 < Δ) (hΔ1 : Δ ≤ 1/2) (hγ : 0 < γ) (hγ1 : γ ≤ 1) (hC : 8 ≤ C) (s0 : PS) :
    let K := fun r : ℝ => (1+r)/(κ⁻¹+r)
    let τ := fun r : ℝ => if 2 ≤ K r then K r else c
    let a := fun s : PS => (η s+τ s.1)/(1+s.1)
    let ell := 2+Real.log (K s0.1*Module.finrank ℝ E*2/Δ)
    let B := γ/(Real.sqrt (Module.finrank ℝ E*ell)+ell)
    let J := Nat.ceil (C*Real.log (Real.exp 1*K s0.1/B))
    let D : Set PS := {s | B⁻¹ ≤ (s.1:ℝ)}
    ∃ T H : Kernel PS E, IsMarkovKernel T ∧ IsMarkovKernel H ∧
      (∀ s, T s = μ.tilted (fun x => -((s.1:ℝ)/2)*‖x-s.2.1‖^2)) ∧
      (∀ s, H s = GaussianSmoothing.gaussianSmoothing (T s) (Real.sqrt (a s))) ∧
      ∀ M L : Kernel PS E, IsMarkovKernel M → IsMarkovKernel L →
      (∀ s, s ∉ D → WassersteinSpace.wassersteinDistance (M s)
        (GaussianSmoothing.gaussianSmoothing (T s) (Real.sqrt (η s/(1+s.1))))^2 ≤
        ENNReal.ofReal (K s.1*(2*τ s.1*Δ^2/(K s.1*((J:ℝ)+1)))/(1+s.1))) →
      ∃ (F : PS × E → PS) (Q : Kernel PS E) (P : Kernel PS PS) (R : ℕ → Kernel PS E),
        (∀ s y, ((F (s,y)).1:ℝ) = (s.1:ℝ)+(a s)⁻¹ ∧
          (F (s,y)).2 = (((s.1:ℝ)+(a s)⁻¹)⁻¹ • ((s.1:ℝ) • s.2.1+(a s)⁻¹ • y),
            s.2.2.1+1,fun n => Nat.casesOn n y s.2.2.2)) ∧
        IsMarkovKernel Q ∧ IsMarkovKernel P ∧ (∀ n, IsMarkovKernel (R n)) ∧
        (∀ s, Q s = GaussianSmoothing.gaussianSmoothing (M s) (Real.sqrt (τ s.1/(1+s.1)))) ∧
        (∀ s, P s = if s ∈ D then Measure.dirac s else (Q s).map (fun y => F (s,y))) ∧
        (∀ n, R n = L ∘ₖ (P^n)) ∧
        0 < B ∧ (P^J) s0 D = 1 ∧
        (∀ m, R (J+m) s0 = R J s0) ∧
        klDiv (R J s0) (T s0) ≤ (J:ℝ≥0∞)*ENNReal.ofReal (Δ^2/((J:ℝ)+1)) +
          ∫⁻ x in D, klDiv (L x) (T x) ∂(P^J) s0 ∧
        ((∀ s ∈ D, klDiv (L s) (T s) ≤ ENNReal.ofReal (Δ^2/((J:ℝ)+1))) →
          ∀ m, klDiv (R (J+m) s0) (T s0) ≤ ENNReal.ofReal (Δ^2)) := by
  classical
  have recursive_output_powers (Q L : Kernel (PS) E) [IsMarkovKernel Q] [IsMarkovKernel L]
      (F : (PS) × E → (PS)) (hF : Measurable F) (D : Set (PS)) [DecidablePred (· ∈ D)]
      (P : Kernel (PS) (PS)) (R : ℕ → Kernel (PS) E)
      (hPf : ∀ s, P s = if s ∈ D then Measure.dirac s else (Q s).map (fun y => F (s,y)))
      (hzero : R 0 = L)
      (hrec : ∀ n s, R (n+1) s = if s ∈ D then L s else (Q s).bind (fun y => R n (F (s,y)))) :
      ∀ n, R n = L ∘ₖ (P^n) := by
    have hstop (n : ℕ) (s : (PS)) (hs : s ∈ D) : R n s = L s := by
      cases n with
      | zero => rw [hzero]
      | succ n => rw [hrec,if_pos hs]
    have hRstep (n : ℕ) : R (n+1) = R n ∘ₖ P := by
      ext s t ht
      rw [Kernel.comp_apply,hPf,hrec]
      by_cases hs : s ∈ D
      · rw [if_pos hs,if_pos hs,Measure.dirac_bind (R n).measurable,hstop n s hs]
      · rw [if_neg hs,if_neg hs]
        rw [Measure.bind_apply ht (show AEMeasurable (fun y : E => R n (F (s,y))) (Q s)
            from ((R n).measurable.comp (hF.comp measurable_prodMk_left)).aemeasurable),
          Measure.bind_apply ht (R n).aemeasurable]
        exact (lintegral_map ((R n).measurable_coe ht)
          (show Measurable (fun y : E => F (s,y)) from hF.comp measurable_prodMk_left)).symm
    intro n
    induction n with
    | zero =>
      change R 0 = L ∘ₖ Kernel.id
      rw [Kernel.comp_id,hzero]
    | succ n ih =>
      rw [hRstep,ih,pow_succ]
      exact Kernel.comp_assoc L (P^n) P
  intro K τ a ell B J D
  have hb : Measurable (fun s : PS => (s.1:ℝ)) := by fun_prop
  have hKm : Measurable (fun s : PS => K s.1) := by dsimp [K]; fun_prop
  have hKpos (s : PS) : 0 < K s.1 := by
    exact div_pos (by positivity) (add_pos_of_pos_of_nonneg
      (inv_pos.mpr (lt_of_lt_of_le zero_lt_one hκ)) s.1.coe_nonneg)
  have htm : Measurable (fun s : PS => τ s.1) :=
    Measurable.ite (measurableSet_le measurable_const hKm) hKm measurable_const
  have htpos (s : PS) : 0 < τ s.1 := by
    dsimp [τ]
    split_ifs with hs
    · linarith
    · exact hc
  have hdepth := AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.LogarithmicDepth.terminal_depth
    (r₀ := (s0.1:ℝ)) (η := fun _ => c) hκ hc hc1 s0.1.coe_nonneg
    (fun _ => ⟨hc,le_rfl⟩) hd (show (2:ℝ) ≤ 2 from le_rfl) hΔ hΔ1 hγ hγ1 hC
  change 2 ≤ ell ∧ (0 < B ∧ B ≤ 1) ∧ 0 < J ∧ _ ∧ _ ∧ _ at hdepth
  have hB := hdepth.2.1.1
  let θ : ℝ≥0 := ⟨B⁻¹,(inv_pos.mpr hB).le⟩
  obtain ⟨T,H,hT,hH,hTf,hHf,hprog⟩ :=
    AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.GaussianRGOErrorBudget.gaussian_rgo_error_budget μ
      (fun s : PS => 1+s.1) (fun s : PS => K s.1) η (fun s : PS => τ s.1)
      (by fun_prop) hKm hηm htm (fun s => by positivity) hKpos (fun s => (hη s).1.le) htpos θ J Δ hΔ.le
  let := hT
  let := hH
  refine ⟨T,H,hT,hH,hTf,hHf,?_⟩
  intro M L hM hL hW
  let := hM
  let := hL
  obtain ⟨F,Q,P,R,hFf,hQ,hP,hR,hQf,hPf,hzero,hrec,hlocal,hbound⟩ := hprog M L hM hL hW
  let := hQ
  let := hP
  obtain ⟨F',P',R',hFf',hP',hR',hPf',hRp',hB',hmass,hstable,hJbound⟩ :=
    AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.StoppedRGODepth.stopped_rgo_depth μ η hηm κ c 2 Δ γ C
      hκ hc hc1 hη hd le_rfl hΔ hΔ1 hγ hγ1 hC s0 Q L
  have hFeq : F = F' := by
    funext p
    apply Prod.ext
    · apply Subtype.ext
      exact (hFf p.1 p.2).1.trans (hFf' p.1 p.2).1.symm
    · exact (hFf p.1 p.2).2.trans (hFf' p.1 p.2).2.symm
  subst F'
  have hPeq : P = P' := by
    ext s t ht
    rw [hPf,hPf']
    rfl
  subst P'
  have ha0 (s : PS) : 0 < a s := div_pos (add_pos (hη s).1 (htpos s)) (by positivity)
  have hFexact : F = fun p =>
      (⟨(p.1.1:ℝ)+(a p.1)⁻¹,add_nonneg p.1.1.coe_nonneg (inv_pos.mpr (ha0 p.1)).le⟩,
        ((p.1.1:ℝ)+(a p.1)⁻¹)⁻¹ • ((p.1.1:ℝ) • p.1.2.1+(a p.1)⁻¹ • p.2),
        p.1.2.2.1+1,fun n => Nat.casesOn n p.2 p.1.2.2.2) := by
    funext p
    apply Prod.ext
    · exact Subtype.ext (hFf p.1 p.2).1
    · exact (hFf p.1 p.2).2
  have ha : Measurable a := (hηm.add htm).div (by fun_prop)
  have hFm : Measurable F := by
    rw [hFexact]
    apply Measurable.prodMk
    · exact Measurable.subtype_mk (by fun_prop)
    · apply Measurable.prodMk
      · fun_prop
      · apply Measurable.prodMk
        · fun_prop
        · apply measurable_pi_lambda
          intro n
          cases n <;> fun_prop
  have hRp : ∀ n, R n = L ∘ₖ (P^n) := recursive_output_powers Q L F hFm D P R hPf hzero hrec
  have hReq (n : ℕ) : R n = R' n := (hRp n).trans (hRp' n).symm
  have hstable' (m : ℕ) : R (J+m) s0 = R J s0 := by rw [hReq,hReq]; exact hstable m
  have hp (n : ℕ) : IsMarkovKernel (P^n) := by
    induction n with
    | zero => change IsMarkovKernel Kernel.id; infer_instance
    | succ n ih =>
      let := ih
      rw [pow_succ]
      change IsMarkovKernel ((P^n) ∘ₖ P)
      infer_instance
  let := hp J
  have hDm : MeasurableSet D := measurableSet_le measurable_const hb
  have hae : ∀ᵐ x ∂(P^J) s0, x ∈ D := (mem_ae_iff_prob_eq_one hDm).2 hmass
  have hrestrict : ((P^J) s0).restrict D = (P^J) s0 := Measure.restrict_eq_self_of_ae_mem hae
  refine ⟨F,Q,P,R,hFf,hQ,hP,hR,hQf,hPf,hRp,hB,hmass,hstable',?_,?_⟩
  · rw [hrestrict]
    exact hbound J s0
  · intro hterminal m
    rw [hstable']
    apply (hbound J s0).trans
    have htbound : (∫⁻ x, klDiv (L x) (T x) ∂(P^J) s0) ≤ ENNReal.ofReal (Δ^2/((J:ℝ)+1)) := by
      calc
        _ ≤ ∫⁻ x, ENNReal.ofReal (Δ^2/((J:ℝ)+1)) ∂(P^J) s0 := by
          apply lintegral_mono_ae
          filter_upwards [hae] with x hx
          exact hterminal x hx
        _ = _ := by simp
    calc
      _ ≤ (J:ℝ≥0∞)*ENNReal.ofReal (Δ^2/((J:ℝ)+1)) + ENNReal.ofReal (Δ^2/((J:ℝ)+1)) := add_le_add le_rfl htbound
      _ = ENNReal.ofReal (Δ^2) := by
        rw [← add_one_mul]
        rw [← ENNReal.ofReal_natCast,← ENNReal.ofReal_one,← ENNReal.ofReal_add (by positivity) (by positivity),
          ← ENNReal.ofReal_mul (by positivity)]
        congr 1
        field_simp

end AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.StoppedGaussianRGOError

Exact module and namespace context

Source assumptions versus formal assumptions

Source	Actual Lean	Difference kind	Why it matters
Euclidean Gibbs targets with source curvature bounds.	Any probability base on a finite real Hilbert Borel space of positive dimension; scalar schedule normalized to baseline smoothness one.	generalization	No source curvature properties of arbitrary mu or general smoothness rescaling are established.
Source small constants and logarithmic recursion depth.	q=2, C>=8, 0<c<1/4, 0<gamma<=1; B and J fixed from s0.	API-limitation	These prove the stopping/error interface; gamma range alone is not FORS sufficiency. The auxiliary constant-c depth invocation only proves B positivity.
A1 is implemented by the paper sampler.	Supplied Markov M satisfies source-scaled squared-W2 accuracy only outside the terminal set; actual Gaussian Q is constructed.	API-limitation	Concrete Picard HMC implementation and proof of A1 remain independent obligations.
The same recursive algorithm stops and returns an accurate sample.	Constructed F,P,R are explicitly identified with the stopped program; terminal support and cap stability are proved at the fixed initial state.	same	Witness equality is proved for all update coordinates, transition fibers and recursive output powers; never assumed.
FORS supplies terminal accuracy.	An unconditional residual inequality holds; the final total-error conclusion assumes KL accuracy only on the terminal set.	API-limitation	The terminal sampler is supplied, and no condition outside the terminal set is added. FORS accuracy and actual implementation remain open.
Full main result includes valid initialization and actual expected query costs.	No initialization, reference-point, history-validity or query-cost assertion.	API-limitation	TV proximity is not used to transfer unbounded costs; actual-input cost remains a separate proof boundary.

M is supplied with the displayed A1 squared-W2 guarantee. The final Delta^2 conclusion additionally assumes terminal KL only on the fixed terminal set. Neither condition is a proof that Picard HMC or FORS implements the interface. The source scalar formulas use baseline smoothness one; no curvature properties of arbitrary mu are established. C>=8 is a proved sufficient depth constant, and gamma in (0,1] is a depth condition, not FORS sufficiency. Initial reference points, history validity and query costs remain open. Threshold and J are fixed using s0; cap stability is a fiber identity at s0. The auxiliary constant-c depth call only proves B>0; actual termination uses StoppedRGODepth. An explicit upper bound on J and measurability of F are not separate public conclusions here.

Encoder–denoiser: accepted · domain-mismatch

Detected semantic differences

domains: General probability base replaces source Gibbs curvature domain. — First delta and absent curvature hypotheses.
constant_dependencies: Explicit sufficient constants, q=2 and initial fixed depth. — Second delta; auxiliary depth only positivity.
assumptions: A1 is supplied while actual added Gaussian Q is constructed. — Third delta and hprog M L hM hL hW.
objects: Actual stopping and error witnesses are explicitly identified. — Fourth delta; hFeq,hPeq,hRp,hReq.
assumptions: FORS terminal accuracy remains an interface after unrestricted residual. — Fifth delta and final implication.
scopes: Initialization, reference points, valid history and actual cost remain open. — Sixth delta and header.

A generalization is not a source correction. Proposed missing conditions require separate independent repair review. No proposed repair silently changes the original theorem.

Scope and omitted-condition boundaries

M is supplied with the displayed A1 squared-W2 guarantee. The final Delta^2 conclusion additionally assumes terminal KL only on the fixed terminal set. Neither condition is a proof that Picard HMC or FORS implements the interface. The source scalar formulas use baseline smoothness one; no curvature properties of arbitrary mu are established. C>=8 is a proved sufficient depth constant, and gamma in (0,1] is a depth condition, not FORS sufficiency. Initial reference points, history validity and query costs remain open. Threshold and J are fixed using s0; cap stability is a fiber identity at s0. The auxiliary constant-c depth call only proves B>0; actual termination uses StoppedRGODepth. An explicit upper bound on J and measurability of F are not separate public conclusions here.

Source and reuse

ASTIS parents called

Mathlib API called (external library)

MeasureTheory.Measure.bind_apply
MeasureTheory.lintegral_map
ProbabilityTheory.Kernel.comp_assoc
MeasureTheory.mem_ae_iff_prob_eq_one
MeasureTheory.Measure.restrict_eq_self_of_ae_mem
MeasureTheory.lintegral_mono_ae

Mathematical sources

SPHMC v1 Theorem 6.5 A1 and equations (6.2)-(6.5) — Same-program stopping and error budget under supplied A1 and terminal KL interfaces.

ASTIS prose is not a quotation or a source-equivalence certificate. Definitions and aliases are explained as constructions, not counted as new mathematical proofs.

Which proof edges are actually covered?

TODO — not closed by these contributions Same actual Gaussian program stopping support and terminal-only error budget

Actual RGO stopping depth and stability beyond the finite cap

Fan Chen, Sinho Chewi, Jianfeng Lu and Matthew S. Zhang; ASTIS expanded absorbed execution and stopping semantics, no author endorsement implied.

arXiv:2609.06906v1 · Algorithm3.3 fixed terminal level and Theorem6.5 equations(6.2)-(6.4) · faithful paraphrase

Complete source statement (ASTIS restatement)

Let E be a finite-dimensional real inner-product Borel space of dimension d=finrank_R(E)>0 and mu a probability measure. Use states s=(b,u,k,h) in NNReal times E times Nat times E^Nat. Fix kappa>=1, 0<c<1/4, q>=2, 0<Delta<=1/2, 0<gamma<=1 and C>=8. Let eta be measurable on the full state and satisfy 0<eta(s)<=c everywhere. Fix initial s0 and arbitrary Markov observation and terminal kernels Q,Lterm. Define K(r)=(1+r)/(1/kappa+r), tau(r)=K(r) when K(r)>=2 and c otherwise, and a(s)=(eta(s)+tau(b))/(1+b). Compute ell=q+log(K(b0)*d*q/Delta), B=gamma/(sqrt(d*ell)+ell) and J=ceil(C*log(e*K(b0)/B)) once from s0. There exist an update F, a Markov state kernel P and Markov output kernels R_n. F adds 1/a(s) to precision, updates the center to (b*u+y/a(s))/(b+1/a(s)), increments the count and prepends y to history. P(s)=dirac s when 1/B<=b and is the F(s,.) pushforward of Q(s) otherwise. For all n, R_n=Lterm composed with P^n. B is positive, P^J(s0) assigns mass one to the terminal set {s:1/B<=b(s)}, and for every m, R_(J+m)(s0)=R_J(s0). Finally J<=(3*C+(C/2)*log(1/gamma))*ell.

E is finite-dimensional over the reals with its Borel measurable structure, and d=finrank_R(E)>0. mu is any probability measure; no density or moment assumption is added.
kappa>=1, 0<c<1/4, q>=2, 0<Delta<=1/2, 0<gamma<=1 and C>=8 are explicit scalar conditions.
eta is measurable and lies in (0,c] at every state. It may depend on precision, center, count and full padded history; there is no common predetermined sequence across all paths.
s0 is fixed before the terminal variance B, its inverse precision threshold and J are computed. These remain fixed throughout the entire execution.
Q and Lterm are arbitrary Markov kernels. The actual absorbed update and all finite output kernels are constructed using FiniteRGOProgram.
Source formulas correspond to baseline smoothness one. Initial precision may be zero or already beyond the threshold. Arbitrary starting count/history is not asserted to be a valid record of previous calls.

Actual stopping and output stability

\[(P^J(s_0))(D)=1,\quad D=\{s:B^{-1}\le b(s)\},\qquad R_{J+m}(s_0)=R_J(s_0),\quad J\le\left(3C+\frac C2\log\frac1\gamma\right)\ell.\]

Read the formalized proofs

Each statement and proof below has its own closed Lean disclosure. ASTIS parents, Mathlib calls and external mathematical sources are distinguished in each proof.

ASTIS mathematical exposition

Actual RGO stopping depth and stability beyond the finite cap

AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.StoppedRGODepth.stopped_rgo_depth · theorem · Teaching coverage

Statement

\[(P^J(s_0))(D)=1,\quad D=\{s:B^{-1}\le b(s)\},\qquad R_{J+m}(s_0)=R_J(s_0),\quad J\le\left(3C+\frac C2\log\frac1\gamma\right)\ell.\]

All objects and hypotheses

E is finite-dimensional over the reals with its Borel measurable structure, and d=finrank_R(E)>0. mu is any probability measure; no density or moment assumption is added.
kappa>=1, 0<c<1/4, q>=2, 0<Delta<=1/2, 0<gamma<=1 and C>=8 are explicit scalar conditions.
eta is measurable and lies in (0,c] at every state. It may depend on precision, center, count and full padded history; there is no common predetermined sequence across all paths.
s0 is fixed before the terminal variance B, its inverse precision threshold and J are computed. These remain fixed throughout the entire execution.
Q and Lterm are arbitrary Markov kernels. The actual absorbed update and all finite output kernels are constructed using FiniteRGOProgram.
Source formulas correspond to baseline smoothness one. Initial precision may be zero or already beyond the threshold. Arbitrary starting count/history is not asserted to be a valid record of previous calls.

Mathematical proof

1. Construct the positive measurable source variance

K composed with the precision coordinate is measurable, as is its comparison with two. The piecewise heat duration is measurable and positive: on its first branch it is at least two, and on the other it is c>0. The positive eta and denominator 1+b give a positive measurable a. A call to LogarithmicDepth with the auxiliary constant sequence c extracts B>0 and the explicit J bound, which depend only on the initial parameters. This auxiliary call is not used to replace the actual history-dependent schedule.

\[a(s)=\frac{\eta(s)+\tau(b(s))}{1+b(s)}>0,\qquad B=\frac{\gamma}{\sqrt{d\ell}+\ell},\quad J=\left\lceil C\log\frac{eK(b_0)}B\right\rceil.\]

Corresponding Lean step

Local source_variance; Measurable.ite; first LogarithmicDepth.terminal_depth invocation with constant c only for threshold positivity and the initial-data depth bound.

2. Instantiate the same explicit absorbed finite program

Invoke FiniteRGOProgram with a and the fixed nonnegative threshold 1/B. Its actual update F changes precision, center, count and history. It supplies P and all R_n with the stopped and continuing recursion. Define G(s,y)=s at terminal states and F(s,y) elsewhere. P(s) is also the G(s,.) pushforward of Q(s): on the stopped branch a probability measure pushed through a constant map is dirac s. This representation does not add actual calls after stopping.

\[G(s,y)=\begin{cases}s,&B^{-1}\le b(s),\\F(s,y),&b(s)<B^{-1},\end{cases}\qquad P(s)=G(s,\cdot)_\#Q(s).\]

Corresponding Lean step

FiniteRGOProgram.finite_rgo_program; measurable product update, Measurable.ite, hPmap and Measure.map_const.

3. Prove every observation path reaches the threshold

For an arbitrary observation sequence, follow the actual absorbed state path x_n. Define eta_n=eta(x_n), which satisfies the same positive upper bound on every path. Compare its precision with the unabsorbed scalar recursion driven by this particular sequence. Induction proves that x_n has already stopped or its precision equals that recursion. Apply LogarithmicDepth to eta_n. At J the auxiliary inverse precision is at most B, so either branch of the invariant implies that x_J is terminal. This is a pathwise use of a universally quantified sequence theorem, not a common schedule assumption.

\[B^{-1}\le b(x_n)\ \text{or}\ b(x_n)=r_n,\qquad r_{n+1}=r_n+\left(\frac{\eta(x_n)+\tau(r_n)}{1+r_n}\right)^{-1},\qquad B^{-1}\le b(x_J).\]

Corresponding Lean step

Local absorbed_precision_path and pathwise_log_depth; second LogarithmicDepth.terminal_depth invocation uses the actual path eta(x_n).

4. Transfer the pathwise conclusion to the actual law

For any depth n, if every observation sequence from a state has endpoint in a measurable set D, prove that P^n assigns D mass one. The zero-depth case is a point mass. For the successor, express P as the pushforward under G and integrate the n-step event mass. Each possible first observation leaves a shorter path whose every continuation ends in D, so the induction hypothesis makes the integrand one. Apply this result to the pathwise J bound and the measurable terminal set.

\[\bigl[\forall(y_0,y_1,\ldots),\ x_n\in D\bigr]\Longrightarrow(P^n(s))(D)=1,\qquad (P^J(s_0))(D)=1.\]

Corresponding Lean step

Local statePath_shift and path_endpoint_mass; Kernel.comp_apply, lintegral_map and probability normalization.

5. Identify recursive outputs with transition powers

Use the actual finite-program recursion to show R_(n+1)=R_n composed with P. At stopped states, the point-mass transition and the already proved stopped output R_n(s)=Lterm(s) give the equality. On continuing states, pushforward integration gives precisely the same recursive bind. Induction starting from R_0=Lterm yields R_n=Lterm composed with P^n.

\[R_{n+1}=R_n\circ_k P,\qquad R_0=L_{\rm term},\qquad R_n=L_{\rm term}\circ_k P^n.\]

Corresponding Lean step

Main hRstep and hRp; actual hrec/hstop from FiniteRGOProgram, Measure.dirac_bind, Measure.bind_apply, lintegral_map and Kernel.comp_assoc.

6. Remove every larger finite cap at the fixed initial state

Split J+m transitions into the first J and the remaining m. The J-step law is concentrated on terminal states, and on those states R_m equals Lterm. Their equality holds almost everywhere under that actual law, so binding with R_m or Lterm gives the same measure. This proves R_(J+m)(s0)=R_J(s0) for every m. It eliminates premature cap use for this execution without identifying the terminal sampler or its query cost.

\[R_{J+m}(s_0)=\int R_m(s)\,(P^J(s_0))(ds)=\int L_{\rm term}(s)\,(P^J(s_0))(ds)=R_J(s_0).\]

Corresponding Lean step

Local finite_output_stability; mem_ae_iff_prob_eq_one, Measure.bind_congr_right, pow_add and Kernel.comp_assoc.

Lean statement · stopped_rgo_depth

Actual source-shaped absorbed state program reaches its fixed initial-state terminal threshold at the explicit logarithmic depth and has stable output for every larger finite cap.

theorem stopped_rgo_depth (μ : Measure E) [IsProbabilityMeasure μ]
    (η : PS → ℝ) (hηm : Measurable η) (κ c q Δ γ C : ℝ)
    (hκ : 1 ≤ κ) (hc : 0 < c) (hc1 : c < 1/4)
    (hη : ∀ s, 0 < η s ∧ η s ≤ c) (hd : 0 < Module.finrank ℝ E) (hq : 2 ≤ q)
    (hΔ : 0 < Δ) (hΔ1 : Δ ≤ 1/2) (hγ : 0 < γ) (hγ1 : γ ≤ 1) (hC : 8 ≤ C)
    (s0 : PS) (Q Lterm : Kernel PS E) [IsMarkovKernel Q] [IsMarkovKernel Lterm] :
    let K := fun r : ℝ => (1+r)/(κ⁻¹+r)
    let τ := fun r : ℝ => if 2 ≤ K r then K r else c
    let a := fun s : PS => (η s+τ s.1)/(1+s.1)
    let L := q+Real.log (K s0.1*Module.finrank ℝ E*q/Δ)
    let B := γ/(Real.sqrt (Module.finrank ℝ E*L)+L)
    let J := Nat.ceil (C*Real.log (Real.exp 1*K s0.1/B))
    ∃ (F : PS × E → PS) (P : Kernel PS PS) (R : ℕ → Kernel PS E),
      (∀ s y, ((F (s,y)).1 : ℝ) = (s.1 : ℝ)+(a s)⁻¹ ∧
        (F (s,y)).2 =
         (((s.1 : ℝ)+(a s)⁻¹)⁻¹ • ((s.1 : ℝ) • s.2.1+(a s)⁻¹ • y),
          s.2.2.1+1,fun n => Nat.casesOn n y s.2.2.2)) ∧
      IsMarkovKernel P ∧ (∀ n, IsMarkovKernel (R n)) ∧
      (∀ s, P s = if B⁻¹ ≤ (s.1 : ℝ) then Measure.dirac s else
        (Q s).map (fun y => F (s,y))) ∧
      (∀ n, R n = Lterm ∘ₖ (P^n)) ∧
      0 < B ∧ (P^J) s0 {s | B⁻¹ ≤ (s.1 : ℝ)} = 1 ∧
      (∀ m, R (J+m) s0 = R J s0) ∧
      (J : ℝ) ≤ (3*C+(C/2)*Real.log (1/γ))*L

Exact module and namespace context

Lean proof · stopped_rgo_depth

Measurable positive source variance, actual finite-program construction, pathwise depth, kernel-support induction and terminal almost-everywhere output identity.

theorem stopped_rgo_depth (μ : Measure E) [IsProbabilityMeasure μ]
    (η : PS → ℝ) (hηm : Measurable η) (κ c q Δ γ C : ℝ)
    (hκ : 1 ≤ κ) (hc : 0 < c) (hc1 : c < 1/4)
    (hη : ∀ s, 0 < η s ∧ η s ≤ c) (hd : 0 < Module.finrank ℝ E) (hq : 2 ≤ q)
    (hΔ : 0 < Δ) (hΔ1 : Δ ≤ 1/2) (hγ : 0 < γ) (hγ1 : γ ≤ 1) (hC : 8 ≤ C)
    (s0 : PS) (Q Lterm : Kernel PS E) [IsMarkovKernel Q] [IsMarkovKernel Lterm] :
    let K := fun r : ℝ => (1+r)/(κ⁻¹+r)
    let τ := fun r : ℝ => if 2 ≤ K r then K r else c
    let a := fun s : PS => (η s+τ s.1)/(1+s.1)
    let L := q+Real.log (K s0.1*Module.finrank ℝ E*q/Δ)
    let B := γ/(Real.sqrt (Module.finrank ℝ E*L)+L)
    let J := Nat.ceil (C*Real.log (Real.exp 1*K s0.1/B))
    ∃ (F : PS × E → PS) (P : Kernel PS PS) (R : ℕ → Kernel PS E),
      (∀ s y, ((F (s,y)).1 : ℝ) = (s.1 : ℝ)+(a s)⁻¹ ∧
        (F (s,y)).2 =
         (((s.1 : ℝ)+(a s)⁻¹)⁻¹ • ((s.1 : ℝ) • s.2.1+(a s)⁻¹ • y),
          s.2.2.1+1,fun n => Nat.casesOn n y s.2.2.2)) ∧
      IsMarkovKernel P ∧ (∀ n, IsMarkovKernel (R n)) ∧
      (∀ s, P s = if B⁻¹ ≤ (s.1 : ℝ) then Measure.dirac s else
        (Q s).map (fun y => F (s,y))) ∧
      (∀ n, R n = Lterm ∘ₖ (P^n)) ∧
      0 < B ∧ (P^J) s0 {s | B⁻¹ ≤ (s.1 : ℝ)} = 1 ∧
      (∀ m, R (J+m) s0 = R J s0) ∧
      (J : ℝ) ≤ (3*C+(C/2)*Real.log (1/γ))*L := by
  classical
  let statePath (G : PS × E → PS) (s : PS) (ys : ℕ → E) : ℕ → PS :=
    Nat.rec s (fun n x => G (x,ys n))
  have statePath_shift (G : (PS) × E → (PS)) (n : ℕ) (s : (PS)) (ys : ℕ → E) :
      statePath G s ys (n+1) = statePath G (G (s,ys 0)) (fun k => ys (k+1)) n := by
    induction n with
    | zero => rfl
    | succ n ih =>
      change G (statePath G s ys (n+1),ys (n+1)) =
        G (statePath G (G (s,ys 0)) (fun k => ys (k+1)) n,ys (n+1))
      rw [ih]
  have path_endpoint_mass (G : (PS) × E → (PS)) (hG : Measurable G)
      (Q : Kernel (PS) E) [IsMarkovKernel Q] (P : Kernel (PS) (PS)) [IsMarkovKernel P]
      (hP : ∀ s, P s = (Q s).map (fun y => G (s,y)))
      (D : Set (PS)) (hD : MeasurableSet D) (n : ℕ) (s : (PS))
      (hpaths : ∀ ys : ℕ → E, statePath G s ys n ∈ D) [Nonempty E] :
      (P^n) s D = 1 := by
    have hp (k : ℕ) : IsMarkovKernel (P^k) := by
      induction k with
      | zero => change IsMarkovKernel Kernel.id; infer_instance
      | succ k ih =>
        let := ih
        rw [pow_succ]
        change IsMarkovKernel ((P^k) ∘ₖ P)
        infer_instance
    induction n generalizing s with
    | zero =>
      classical
      have hs := hpaths (fun _ => Classical.choice inferInstance)
      change Measure.dirac s D = 1
      exact Measure.dirac_apply_of_mem hs
    | succ n ih =>
      let := hp n
      rw [pow_succ]
      change ((P^n) ∘ₖ P) s D = 1
      rw [Kernel.comp_apply' _ _ _ hD,hP,
        lintegral_map ((P^n).measurable_coe hD)
          (show Measurable (fun y : E => G (s,y)) from hG.comp measurable_prodMk_left)]
      have hall (y : E) : (P^n) (G (s,y)) D = 1 := by
        apply ih
        intro ys
        have hh := hpaths (fun k => Nat.casesOn k y ys)
        rw [statePath_shift] at hh
        exact hh
      simp_rw [hall]
      simp
  have absorbed_precision_path (b : (PS) → ℝ) (η : (PS) → ℝ) (τ : ℝ → ℝ)
      (F : (PS) × E → (PS)) (threshold : ℝ)
      (hF : ∀ s y, b (F (s,y)) = b s + ((η s + τ (b s))/(1+b s))⁻¹)
      (s0 : (PS)) (ys : ℕ → E) :
      let G : (PS) × E → (PS) := fun p => if threshold ≤ b p.1 then p.1 else F p
      let x := statePath G s0 ys
      let r : ℕ → ℝ := Nat.rec (b s0) (fun n r => r + ((η (x n)+τ r)/(1+r))⁻¹)
      ∀ n, threshold ≤ b (x n) ∨ b (x n) = r n := by
    classical
    intro G x r n
    induction n with
    | zero => exact Or.inr rfl
    | succ n ih =>
      have hx : x (n+1) = G (x n,ys n) := rfl
      by_cases hs : threshold ≤ b (x n)
      · left
        rw [hx,show G (x n,ys n) = x n from if_pos hs]
        exact hs
      · right
        have heq := ih.resolve_left hs
        rw [hx,show G (x n,ys n) = F (x n,ys n) from if_neg hs,hF]
        change b (x n) + ((η (x n)+τ (b (x n)))/(1+b (x n)))⁻¹ =
          r n + ((η (x n)+τ (r n))/(1+r n))⁻¹
        rw [heq]
  have pathwise_log_depth (b : (PS) → ℝ) (η : (PS) → ℝ) (F : (PS) × E → (PS))
      (κ c q Δ γ C : ℝ) (d : ℕ) (s0 : (PS))
      (hκ : 1 ≤ κ) (hc : 0 < c) (hc1 : c < 1/4) (hb0 : 0 ≤ b s0)
      (hη : ∀ s, 0 < η s ∧ η s ≤ c) (hd : 0 < d) (hq : 2 ≤ q)
      (hΔ : 0 < Δ) (hΔ1 : Δ ≤ 1/2) (hγ : 0 < γ) (hγ1 : γ ≤ 1) (hC : 8 ≤ C) :
      let K := fun r : ℝ => (1+r)/(κ⁻¹+r)
      let τ := fun r : ℝ => if 2 ≤ K r then K r else c
      let L := q+Real.log (K (b s0)*d*q/Δ)
      let B := γ/(Real.sqrt (d*L)+L)
      let J := Nat.ceil (C*Real.log (Real.exp 1*K (b s0)/B))
      (∀ s y, b (F (s,y)) = b s + ((η s+τ (b s))/(1+b s))⁻¹) →
      ∀ ys : ℕ → E,
        let G : (PS) × E → (PS) := fun p => if B⁻¹ ≤ b p.1 then p.1 else F p
        B⁻¹ ≤ b (statePath G s0 ys J) := by
    classical
    intro K τ L B J hF ys G
    let x := statePath G s0 ys
    let r : ℕ → ℝ := Nat.rec (b s0) (fun n r => r + ((η (x n)+τ r)/(1+r))⁻¹)
    have hh := AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.LogarithmicDepth.terminal_depth
      (η := fun n => η (x n)) hκ hc hc1 hb0 (fun n => hη (x n)) hd hq hΔ hΔ1 hγ hγ1 hC
    change 2 ≤ L ∧ (0 < B ∧ B ≤ 1) ∧ 0 < J ∧ 0 < (r J)⁻¹ ∧ (r J)⁻¹ ≤ B ∧ _ at hh
    obtain ⟨hL,hB,hJ,hrpos,hrB,hJbound⟩ := hh
    have hr : 0 < r J := inv_pos.mp hrpos
    have hbJ : B⁻¹ ≤ r J := by
      rw [inv_eq_one_div]
      apply (div_le_iff₀ hB.1).2
      have hm : 1 ≤ B * r J := (div_le_iff₀ hr).1 (by simpa [one_div] using hrB)
      simpa [mul_comm] using hm
    have hinv := absorbed_precision_path b η τ F B⁻¹ hF s0 ys J
    change B⁻¹ ≤ b (x J) ∨ b (x J) = r J at hinv
    rcases hinv with h | h
    · exact h
    · change B⁻¹ ≤ b (x J)
      rw [h]
      exact hbJ
  have source_variance (b : (PS) → ℝ) (hb : Measurable b) (hb0 : ∀ s, 0 ≤ b s)
      (η : (PS) → ℝ) (hη : Measurable η) (hη0 : ∀ s, 0 < η s) (κ c : ℝ) (hc : 0 < c) :
      let K := fun s => (1+b s)/(κ⁻¹+b s)
      let τ := fun s => if 2 ≤ K s then K s else c
      let a := fun s => (η s+τ s)/(1+b s)
      Measurable a ∧ ∀ s, 0 < a s := by
    intro K τ a
    have hK : Measurable K := by dsimp [K]; fun_prop
    have hτ : Measurable τ := Measurable.ite
      (measurableSet_le measurable_const hK) hK measurable_const
    refine ⟨(hη.add hτ).div (measurable_const.add hb),?_⟩
    intro s
    have ht : 0 < τ s := by
      dsimp only [τ]
      split_ifs with h
      · linarith
      · exact hc
    exact div_pos (add_pos (hη0 s) ht) (by linarith [hb0 s])
  have finite_output_stability (P : Kernel (PS) (PS)) [IsMarkovKernel P]
      (L : Kernel (PS) E) [IsMarkovKernel L] (R : ℕ → Kernel (PS) E)
      (hR : ∀ n, R n = L ∘ₖ (P^n)) (D : Set (PS)) (hD : MeasurableSet D)
      (hstop : ∀ n s, s ∈ D → R n s = L s) (J : ℕ) (s : (PS))
      (hmass : (P^J) s D = 1) : ∀ m, R (J+m) s = R J s := by
    have hp (k : ℕ) : IsMarkovKernel (P^k) := by
      induction k with
      | zero => change IsMarkovKernel Kernel.id; infer_instance
      | succ k ih =>
        let := ih
        rw [pow_succ]
        change IsMarkovKernel ((P^k) ∘ₖ P)
        infer_instance
    let := hp J
    have hae : ∀ᵐ t ∂((P^J) s), t ∈ D := (mem_ae_iff_prob_eq_one hD).2 hmass
    intro m
    let := hp m
    rw [hR (J+m),Nat.add_comm J m,pow_add]
    change (L ∘ₖ ((P^m) ∘ₖ (P^J))) s = R J s
    rw [← Kernel.comp_assoc,← hR m,hR J,Kernel.comp_apply,Kernel.comp_apply]
    apply Measure.bind_congr_right
    filter_upwards [hae] with t ht
    exact hstop m t ht
  intro K τ a L B J
  have hb : Measurable (fun s : PS => (s.1 : ℝ)) := by fun_prop
  have hva := source_variance (fun s : PS => (s.1 : ℝ)) hb (fun s => s.1.coe_nonneg)
    η hηm (fun s => (hη s).1) κ c hc
  change Measurable a ∧ (∀ s, 0 < a s) at hva
  obtain ⟨ha,ha0⟩ := hva
  have hdepth := AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.LogarithmicDepth.terminal_depth
    (r₀ := (s0.1 : ℝ)) (η := fun _ => c) hκ hc hc1 s0.1.coe_nonneg
    (fun _ => ⟨hc,le_rfl⟩) hd hq hΔ hΔ1 hγ hγ1 hC
  change 2 ≤ L ∧ (0 < B ∧ B ≤ 1) ∧ 0 < J ∧ _ ∧ _ ∧
    (J : ℝ) ≤ (3*C+(C/2)*Real.log (1/γ))*L at hdepth
  have hB := hdepth.2.1.1
  have hJB := hdepth.2.2.2.2.2
  let threshold : ℝ≥0 := ⟨B⁻¹,le_of_lt (inv_pos.mpr hB)⟩
  let F : PS × E → PS := fun p =>
      (⟨(p.1.1 : ℝ)+(a p.1)⁻¹, add_nonneg p.1.1.coe_nonneg (le_of_lt (inv_pos.mpr (ha0 p.1)))⟩,
       ((p.1.1 : ℝ)+(a p.1)⁻¹)⁻¹ • ((p.1.1 : ℝ) • p.1.2.1+(a p.1)⁻¹ • p.2),
       p.1.2.2.1+1, fun n => Nat.casesOn n p.2 p.1.2.2.2)
  have hF : Measurable F := by
    apply Measurable.prodMk
    · exact Measurable.subtype_mk (by fun_prop)
    · apply Measurable.prodMk
      · fun_prop
      · apply Measurable.prodMk
        · fun_prop
        · apply measurable_pi_lambda
          intro n
          cases n <;> fun_prop
  obtain ⟨T,H,hT,hH,hTf,hHf,hprog⟩ :=
    AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.FiniteRGOProgram.finite_rgo_program μ a ha ha0 threshold
  obtain ⟨P,R,hP,hR,hPf,hzero,hrec,hstop,hpath,hideal⟩ := hprog Q Lterm inferInstance inferInstance
  let := hP
  let D : Set PS := {s | B⁻¹ ≤ (s.1 : ℝ)}
  have hD : MeasurableSet D := measurableSet_le measurable_const hb
  let G : PS × E → PS := fun p => if B⁻¹ ≤ (p.1.1 : ℝ) then p.1 else F p
  have hG : Measurable G := Measurable.ite
    (measurableSet_le measurable_const (hb.comp measurable_fst)) measurable_fst hF
  have hcompare (s : PS) : (threshold ≤ s.1) ↔ B⁻¹ ≤ (s.1 : ℝ) := Iff.rfl
  have hPf' (s : PS) : P s = if B⁻¹ ≤ (s.1 : ℝ) then Measure.dirac s else
      (Q s).map (fun y => F (s,y)) := by
    rw [hPf]
    rfl
  have hPmap (s : PS) : P s = (Q s).map (fun y => G (s,y)) := by
    rw [hPf']
    by_cases hs : B⁻¹ ≤ (s.1 : ℝ)
    · simp only [if_pos hs,G]
      simp [Measure.map_const]
    · simp only [if_neg hs,G]
  have hmass : (P^J) s0 D = 1 := by
    apply path_endpoint_mass G hG Q P hPmap D hD J s0
    intro ys
    exact pathwise_log_depth (fun s : PS => (s.1 : ℝ)) η F κ c q Δ γ C
      (Module.finrank ℝ E) s0 hκ hc hc1 s0.1.coe_nonneg hη hd hq hΔ hΔ1 hγ hγ1 hC
      (fun _ _ => rfl) ys
  have hRstep (n : ℕ) : R (n+1) = R n ∘ₖ P := by
    ext s t ht
    rw [Kernel.comp_apply,hPf,hrec]
    by_cases hs : threshold ≤ s.1
    · rw [if_pos hs,if_pos hs,Measure.dirac_bind (R n).measurable,hstop n s hs]
    · rw [if_neg hs,if_neg hs]
      change ((Q s).bind (fun y => R n (F (s,y)))) t =
        (((Q s).map (fun y => F (s,y))).bind (R n)) t
      rw [Measure.bind_apply ht (show AEMeasurable (fun y : E => R n (F (s,y))) (Q s)
          from ((R n).measurable.comp (hF.comp measurable_prodMk_left)).aemeasurable),
        Measure.bind_apply ht (R n).aemeasurable]
      exact (lintegral_map ((R n).measurable_coe ht)
        (show Measurable (fun y : E => F (s,y)) from hF.comp measurable_prodMk_left)).symm
  have hRp (n : ℕ) : R n = Lterm ∘ₖ (P^n) := by
    induction n with
    | zero =>
      change R 0 = Lterm ∘ₖ Kernel.id
      rw [Kernel.comp_id,hzero]
    | succ n ih =>
      rw [hRstep,ih,pow_succ]
      exact Kernel.comp_assoc Lterm (P^n) P
  refine ⟨F,P,R,fun _ _ => ⟨rfl,rfl⟩,hP,hR,hPf',hRp,hB,hmass,?_,hJB⟩
  exact finite_output_stability P Lterm R hRp D hD
    (fun n s hs => hstop n s ((hcompare s).2 hs)) J s0 hmass


end AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.StoppedRGODepth

Exact module and namespace context

Source assumptions versus formal assumptions

Source	Actual Lean	Difference kind	Why it matters
The paper uses a Euclidean Gibbs target.	Any probability base on a positive-dimensional finite real Hilbert Borel space.	generalization	The actual state transition bound does not need a potential, density or moments. d is the real finrank and strictly positive.
Normalized recursive variance is (eta+tau)/beta_A, with condition number determined by the current regularization.	a(s)=(eta(s)+tau(b))/(1+b), K(b)=(1+b)/(kappa^-1+b).	API-limitation	These are the source scalar formulas after baseline smoothness is normalized to one. A general beta needs its scaling adapter; arbitrary Q is not identified as the concrete sampler.
A terminal level is fixed for the recursive execution; equation(6.4) selects a logarithmic stage bound.	Compute B and J from s0 once, then construct the fixed-threshold P and all R.	same	The result is at that initial state. It does not claim all initial states share a threshold or one uniform J.
Sufficiently small and large universal constants select the terminal level and depth.	0<c<1/4,0<gamma<=1,C>=8; J<=(3C+(C/2)log(1/gamma))*ell.	source-implicit	The sufficient depth constant and threshold-dependent coefficient come from the already proved LogarithmicDepth; C>=8 is not quoted as a source-prescribed value.
The smoothing level is selected for each call and bounded by c.	Measurable eta on the full current state with 0<eta(s)<=c; actual absorbed paths induce their own eta sequences.	source-implicit	There is no common fixed schedule. The constant sequence call only extracts initial-parameter threshold positivity and J bound; termination uses actual path eta.
Full recursive sampler has FORS, approximation guarantees and query costs.	Any Markov Q,Lterm yield terminal support mass one by J and unchanged output at every larger cap.	API-limitation	This is an actual stage-transition bound and cap-removal prerequisite. It does not identify either concrete sampler, prove history validity or bound errors/gradient queries.

The terminal threshold and stage bound are computed from the initial state and then fixed. The scalar source formulas use smoothness normalized to one; a general smoothness parameter needs the source scaling adapter. The actual dimension is positive. C>=8 is a proved sufficient constant, not a source-prescribed numerical value. Arbitrary observation and terminal Markov kernels do not identify the concrete smoothed sampler or FORS. Stage transitions are not gradient queries. No initialization validity, approximation error or expected query-cost result is asserted, and no uniform kernel equality across all initial states is claimed.

Encoder–denoiser: accepted · domain-mismatch

Detected semantic differences

domains: General probability/Hilbert setting with actual positive finrank. — No density, curvature or moments. mu supports parent-program reuse and does not constrain the supplied Q,Lterm in the conclusion.
constant_dependencies: Normalized smoothness-one variance formulas; general scaling adapter remains. — Baseline smoothness one disclosed. C>=8 is a proved sufficient choice; upper coefficient retains (C/2)log(1/gamma).
quantifiers: Threshold and J are computed from s0 once and fixed. — Every P fiber uses the fixed B; no whole-kernel output equality at a globally uniform J.
constant_dependencies: Explicit sufficient depth constants and gamma coefficient are not full FORS constant guarantees. — Baseline smoothness one disclosed. C>=8 is a proved sufficient choice; upper coefficient retains (C/2)log(1/gamma).
assumptions: Pathwise eta(x_n) varies with history; constant-c invocation only establishes initial-data B positivity/J bound. — No stopping, favorable support, accuracy or common schedule is assumed. The gamma range is for depth only, not asserted sufficient for FORS.
scopes: Arbitrary supplied kernels receive stage-depth and cap-stability, without concrete sampler, errors or costs. — Concrete sampler, history validity, errors and query counts remain excluded. Stage transitions are not gradient queries.

A generalization is not a source correction. Proposed missing conditions require separate independent repair review. No proposed repair silently changes the original theorem.

Scope and omitted-condition boundaries

The terminal threshold and stage bound are computed from the initial state and then fixed. The scalar source formulas use smoothness normalized to one; a general smoothness parameter needs the source scaling adapter. The actual dimension is positive. C>=8 is a proved sufficient constant, not a source-prescribed numerical value. Arbitrary observation and terminal Markov kernels do not identify the concrete smoothed sampler or FORS. Stage transitions are not gradient queries. No initialization validity, approximation error or expected query-cost result is asserted, and no uniform kernel equality across all initial states is claimed.

Source and reuse

ASTIS parents called

Mathlib API called (external library)

Measurable.ite
MeasureTheory.Measure.map_const
ProbabilityTheory.Kernel.comp_assoc
MeasureTheory.Measure.bind_apply
MeasureTheory.lintegral_map
MeasureTheory.mem_ae_iff_prob_eq_one
MeasureTheory.Measure.bind_congr_right

Mathematical sources

SPHMC v1 Algorithm 3.3 and Theorem 6.5, equations (6.2)-(6.4) — Actual absorbed state execution with source-shaped variance and fixed initial-state terminal level; not error or gradient-query complexity.

ASTIS prose is not a quotation or a source-equivalence certificate. Definitions and aliases are explained as constructions, not counted as new mathematical proofs.

Which proof edges are actually covered?

TODO — not closed by these contributions Actual terminal support by source depth and stability beyond the cap

Actual terminal reference, FORS kernel and source program

ASTIS expanded proof component for Fan Chen, Sinho Chewi, Jianfeng Lu and Matthew S. Zhang, Smoothed Picard Hamiltonian Monte Carlo. Parameterized local terminal program with disclosed restrictions and omitted guarantees, not full A4(2) or a complete paper.

arXiv:2609.06906v1 · Algorithm3.3,Section6.3 terminal reference and TheoremA.4(2) · faithful paraphrase

Complete source statement (ASTIS restatement)

N and xp are measurable, the actual terminal gradient threshold holds and every earlier iterate fails it, and norm(h-xp)<=sqrt(d*A). There exists a single Markov kernel R on the whole state space whose fiber is the measurable first-success program output law; never-hit has rho_s measure zero and the actual sampling-stage integral of1+queryCount is at most1+2*exp(2). Each pi_s is a probability, pi_s and R(s) are mutually absolutely continuous, both RN ell-powers are integrable under their respective denominator laws with strictly positive integrals at most1+eps^2, and both log-integral/(ell-1) bounds are at most eps^2. Phi_s pushes rho_s to the original retry law, preserves acceptance and full-batch counts on every stream, and makes old default-u output equal to new default-zero output almost everywhere.

E is a finite-dimensional real inner-product Borel space with d=dim(E)>0; S is any measurable state space. V:E->R is fixed and C2. Its genuine Hessian lies between alpha*norm(v)^2 and beta*norm(v)^2, with nonnegative alpha<=beta and beta>0.
The functions b:S->R and u,initial:S->E are measurable and b(s)>0. The fixed parameters ell,eps satisfy ell>=2 and0<eps<=1/2. Every state satisfies 64*beta*(sqrt(d*(ell+log(1/eps)))+ell+log(1/eps))<=b(s). No execution reachability of this terminal domain is assumed or concluded.
Set A(s)=1/b(s), F_s(x)=V(x)+b(s)/2*norm(x-u(s))^2 and T_s(x)=x-(beta+b(s))^(-1)*grad F_s(x). N(s) is the least n with norm(grad F_s(T_s^n(initial(s))))^2<=d*b(s), with fallback zero if no n exists. Set xp(s)=T_s^N(s)(initial(s)), g(s)=grad V(xp(s)) and h(s)=u(s)-A(s)*g(s). Finite attainment and the reference residual are proved, not additional hypotheses.
Let nu0 be Lebesgue restricted to Ioc(0,1) product standardGaussian, and q_s the law of h(s)+sqrt(A(s))*Z. For z=(t,zeta), the cached arc estimator is inner((pi/2)*(cos(pi*t/2)*(x-h)-sin(pi*t/2)*zeta),g-grad V(h+sin(pi*t/2)*(x-h)+cos(pi*t/2)*zeta)). W_s uses zeta=sqrt(A(s))*Z and clips this scalar to[-1,1]. The arc time uniform is distinct from the acceptance uniform on Icc(0,1).
An attempt p=(x,n,(zseq,v)) has law q_s product Poisson(2) product (infinitePi nu0 product uniformIcc(0,1)). It accepts iff v<=product over i:Fin n of(1+W_s(x,zseq(i)))/2. rho_s is the infinite product of independent attempts. output_s is the proposal at the first accepting attempt, or0 if none. queryCount sums each batch size when all earlier attempts failed, including the successful batch. The charged sampling-stage count is1+queryCount.
The target pi_s is the Gaussian law u(s)+sqrt(A(s))*Z tilted by -V. The original auxiliary law nua_s uses Gaussian variance A(s) instead of the standard Gaussian. Wa_s clips the same cached estimator without scaling inside. The stream map Phi_s scales each auxiliary Gaussian coordinate and preserves every proposal, batch size, arc time and acceptance uniform. The old program default is u(s).

Actual terminal program law, cost and accuracy

\[\rho_s\circ\mathrm{output}_s^{-1}=R_s,\qquad \int^- (1+C_s)\,d\rho_s\le1+2e^2,\qquad \int\!\left(\frac{d\pi_s}{dR_s}\right)^\ell dR_s\le1+\varepsilon^2.\]

Read the formalized proofs

Each statement and proof below has its own closed Lean disclosure. ASTIS parents, Mathlib calls and external mathematical sources are distinguished in each proof.

ASTIS mathematical exposition

Actual terminal reference, FORS kernel and source program

AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.TerminalFORSKernel.terminal_fors_kernel · theorem · Teaching coverage

Statement

\[\rho_s\circ\mathrm{output}_s^{-1}=R_s,\qquad \int^- (1+C_s)\,d\rho_s\le1+2e^2,\qquad \int\!\left(\frac{d\pi_s}{dR_s}\right)^\ell dR_s\le1+\varepsilon^2.\]

All objects and hypotheses

E is a finite-dimensional real inner-product Borel space with d=dim(E)>0; S is any measurable state space. V:E->R is fixed and C2. Its genuine Hessian lies between alpha*norm(v)^2 and beta*norm(v)^2, with nonnegative alpha<=beta and beta>0.
The functions b:S->R and u,initial:S->E are measurable and b(s)>0. The fixed parameters ell,eps satisfy ell>=2 and0<eps<=1/2. Every state satisfies 64*beta*(sqrt(d*(ell+log(1/eps)))+ell+log(1/eps))<=b(s). No execution reachability of this terminal domain is assumed or concluded.
Set A(s)=1/b(s), F_s(x)=V(x)+b(s)/2*norm(x-u(s))^2 and T_s(x)=x-(beta+b(s))^(-1)*grad F_s(x). N(s) is the least n with norm(grad F_s(T_s^n(initial(s))))^2<=d*b(s), with fallback zero if no n exists. Set xp(s)=T_s^N(s)(initial(s)), g(s)=grad V(xp(s)) and h(s)=u(s)-A(s)*g(s). Finite attainment and the reference residual are proved, not additional hypotheses.
Let nu0 be Lebesgue restricted to Ioc(0,1) product standardGaussian, and q_s the law of h(s)+sqrt(A(s))*Z. For z=(t,zeta), the cached arc estimator is inner((pi/2)*(cos(pi*t/2)*(x-h)-sin(pi*t/2)*zeta),g-grad V(h+sin(pi*t/2)*(x-h)+cos(pi*t/2)*zeta)). W_s uses zeta=sqrt(A(s))*Z and clips this scalar to[-1,1]. The arc time uniform is distinct from the acceptance uniform on Icc(0,1).
An attempt p=(x,n,(zseq,v)) has law q_s product Poisson(2) product (infinitePi nu0 product uniformIcc(0,1)). It accepts iff v<=product over i:Fin n of(1+W_s(x,zseq(i)))/2. rho_s is the infinite product of independent attempts. output_s is the proposal at the first accepting attempt, or0 if none. queryCount sums each batch size when all earlier attempts failed, including the successful batch. The charged sampling-stage count is1+queryCount.
The target pi_s is the Gaussian law u(s)+sqrt(A(s))*Z tilted by -V. The original auxiliary law nua_s uses Gaussian variance A(s) instead of the standard Gaussian. Wa_s clips the same cached estimator without scaling inside. The stream map Phi_s scales each auxiliary Gaussian coordinate and preserves every proposal, batch size, arc time and acceptance uniform. The old program default is u(s).

Mathematical proof

1. Construct the actual terminal first hit

Differentiate the genuine regularized potential and write its GD iterates using grad V and b(s)*(x-u(s)). Induction gives joint measurability of each iterate. The old terminal-GD theorem supplies a finite witness at the same threshold d*b. Measurable least-index selection then gives N and xp, the threshold, and strict failure of every earlier index. It does not replace this index by the inner-stage threshold.

\[N_s=\min\{n:\|\nabla F_s(T_s^n x_{\rm init,s})\|^2\le db_s\}.\]

Corresponding Lean step

state_iterates; firstIndex; stopped_family; variable_reference

2. Derive the reference residual and base smoothness

The genuine gradient identity yields h-xp=-A*grad F_s(xp). Squaring the norm and using the terminal stopping bound gives the source residual sqrt(d*A). Applying the quadratic-regularization theorem with zero added precision derives Lipschitz continuity of grad V directly from its genuine Hessian bounds.

\[\|h_s-xp_s\|=A_s\|\nabla F_s(xp_s)\|\le\sqrt{dA_s}.\]

Corresponding Lean step

variable_reference: he,hstop,hid; terminal_fors_kernel: href,hlip

3. Build the parameterized Gaussian proposal

Retain the state with a product kernel and push it through(s,z)->h(s)+sqrt(A(s))*z. Joint measurability proves this is one Markov proposal kernel Q, not an unrelated family of pointwise laws. The constructed g and h are measurable because xp and grad V are measurable.

\[Q_s=\mathcal L(h_s+\sqrt{A_s}Z),\qquad g_s=\nabla V(xp_s).\]

Corresponding Lean step

gaussian_proposal; terminal_fors_kernel: hxp,hVm,hAm,hgm,hhm

4. Construct the actual rejection output kernel

Use the fixed auxiliary law nu0. Scale the Gaussian coordinate inside both arc position and velocity, then clip the estimator to[-1,1]. The public Poisson program theorem constructs one Markov R and gives measurability of each actual output function, its exact pushforward law, and the null never-hit event under the same attempt stream.

\[\rho_s=\Lambda_s^{\otimes\mathbb N},\quad (\mathrm{output}_s)_\#\rho_s=R_s,\quad\rho_s(\text{never hit})=0.\]

Corresponding Lean step

scaledCached; measurable_scaledCached; Attempt; attemptLaw; accepted; output; actual_kernel_program: hW,hb,hRs

5. Charge the complete sampled batches

queryCount includes batch n whenever all earlier batches failed, so the successful batch is charged in full. The Poisson parent bounds this actual nonnegative integral by2exp2. The retry law is a probability, so adding the one cached gradient gives1+2exp2. Finding xp is separate and its last gradient check is not silently discounted.

\[C_s(\omega)=\sum_{n\ge0}N_n\mathbf1\{\text{all earlier attempts fail}\},\quad\int^-(1+C_s)d\rho_s\le1+2e^2.\]

Corresponding Lean step

queryCount; actual_kernel_program: hc0,hc', probability instances,lintegral_add_left

6. Identify the original scaled auxiliary law

The map(t,z)->(t,sqrt(A)*z) pushes nu0 to the source auxiliary law nua. Pushforward integration shows the clipped scaled estimator mean is exactly the old clipped cached-estimator mean. This identifies the very same R(s) with the old terminal theorem output tilt.

\[(t,z)\mapsto(t,\sqrt{A_s}z),\quad (f_s)_\#\nu_0=\nu_{A_s},\quad\int W_s\,d\nu_0=\int W_s^{a}\,d\nu_{A_s}.\]

Corresponding Lean step

cachedEstimator; auxiliary_scale; scaled_mean; terminal_fors_kernel: hr

7. Apply accuracy to that same output law

Supply the derived reference residual, genuine gradient Lipschitz bound, positive A and explicit terminal threshold to TerminalSamplerAccuracyCost. Replace its qhat by the identified R(s). Both directions retain their own denominator measure: d pi/d R is integrated under R and d R/d pi under pi. This yields probability, mutual AC, integrability, positive moments, moment bounds and the two normalized logarithmic bounds.

\[0<\int\!\left(\frac{d\pi_s}{dR_s}\right)^\ell dR_s\le1+\varepsilon^2,\quad\frac{\log\int(d\pi_s/dR_s)^\ell dR_s}{\ell-1}\le\varepsilon^2\quad\text{and reverse}.\]

Corresponding Lean step

terminal_fors_kernel: ht,hr,hpi,hpq,hqp,hfi,hri,hfp,hrp,hfb,hrb,hfl,hrl

8. Push forward the whole retry stream

First map every auxiliary sequence coordinate, then the attempt product, then every independent retry coordinate. Mathlib infinitePi_map_pi and product pushforwards prove the full law identity. Proposal points, Poisson batch sizes and acceptance uniforms are unchanged; no independence between the current batch size and its acceptance event is used.

\[(\Phi_s)_\#\rho_s=\rho_s^{a}.\]

Corresponding Lean step

Stream.Attempt; Stream.attemptLaw; Stream.attemptMap; Stream.stream_law; source_correspondence: hl

9. Preserve the actual acceptance and count

The same Fin N acceptance product is evaluated after auxiliary scaling, including the empty product at N=0. Therefore every accepted event and the first successful index agree. The sum over all batches satisfying prior failure has exactly the same summands, proving pointwise equality of full-batch counts.

\[\Phi_s(\omega)_n\in E_s^a\iff\omega_n\in E_s,\qquad C_s^a(\Phi_s\omega)=C_s(\omega).\]

Corresponding Lean step

Stream.accepted; Stream.output; Stream.queryCount; Stream.stream_program; source_correspondence

10. Handle defaults only on the null failure event

With the same fallback, outputs coincide pointwise. The old source default is u(s), while the parameterized program uses0. On a stream with a successful attempt neither default is used. The proved never-hit null event therefore supplies almost-everywhere equality, not equality on every stream. The explicit output-function alignment also checks the B=1 and simplified stream definitions.

\[\mathrm{output}^{a}_{s,u_s}\circ\Phi_s=\mathrm{output}_{s,0}\quad\rho_s\text{-a.e.}\]

Corresponding Lean step

Stream.stream_output_ae; output_eq_stream; source_correspondence; terminal_fors_kernel: hc

Lean statement · terminal_fors_kernel

Actual measurable reference, single terminal Markov kernel, concrete program law/cost, two-way RN accuracy and full source retry-stream correspondence.

theorem terminal_fors_kernel {V : E → ℝ} {α β : ℝ≥0}
    (hV : ContDiff ℝ 2 V)
    (hH : ∀ x v : E, (α:ℝ)*‖v‖^2 ≤ fderiv ℝ (fderiv ℝ V) x v v ∧
      fderiv ℝ (fderiv ℝ V) x v v ≤ (β:ℝ)*‖v‖^2)
    (hαβ : α ≤ β) (hβ : 0 < (β:ℝ)) (hd : 0 < (Module.finrank ℝ E : ℝ))
    {b : S → ℝ} {u initial : S → E} (hb : Measurable b)
    (hb0 : ∀ s, 0 < b s) (hu : Measurable u) (hi : Measurable initial)
    (ell eps : ℝ) (hell : 2 ≤ ell) (heps : 0 < eps) (heps1 : eps ≤ 1/2)
    (hstep : ∀ s, 64*(β:ℝ)*(Real.sqrt ((Module.finrank ℝ E:ℝ)*(ell+Real.log (1/eps)))+
      (ell+Real.log (1/eps))) ≤ b s) :
    let d : ℝ := Module.finrank ℝ E
    let F := fun s x => V x+b s/2*‖x-u s‖^2
    let T := fun s x => x-((β:ℝ)+b s)⁻¹ • gradient (F s) x
    let Qn := fun n s => ‖gradient (F s) ((T s)^[n] (initial s))‖^2
    let N := firstIndex Qn (fun s => d*b s)
    let xp := fun s => (T s)^[N s] (initial s)
    let A := fun s => (b s)⁻¹
    let g := fun s => gradient V (xp s)
    let h := fun s => u s-A s • g s
    let ν := (volume.restrict (Ioc (0 : ℝ) 1)).prod (stdGaussian E)
    let W := fun s (p : E × (ℝ × E)) => min 1 (max (-1) (scaledCached V A h g ((s,p.1),p.2)))
    let q := fun s => (stdGaussian E).map (fun z => h s+Real.sqrt (A s) • z)
    let ρ := fun s => Measure.infinitePi (fun _ : ℕ => attemptLaw (q s) ν 1 (by norm_num))
    let π := fun s => ((stdGaussian E).map (fun z => u s+Real.sqrt (A s) • z)).tilted (fun x => -V x)
    let νa := fun s => (volume.restrict (Ioc (0 : ℝ) 1)).prod ((stdGaussian E).map (fun z => Real.sqrt (A s) • z))
    let Wa := fun s (p : E × (ℝ × E)) => min 1 (max (-1) (cachedEstimator V (h s) (g s) p))
    let ρa := fun s => Measure.infinitePi (fun _ : ℕ => attemptLaw (q s) (νa s) 1 (by norm_num))
    let Φ := fun s (ω : ℕ → Attempt E (ℝ × E)) n =>
      Stream.attemptMap (fun p : ℝ × E => (p.1,Real.sqrt (A s) • p.2)) (ω n)
    Measurable N ∧ Measurable xp ∧
    (∀ s, Qn (N s) s ≤ d*b s ∧ (∀ j < N s, d*b s < Qn j s) ∧
      ‖h s-xp s‖ ≤ Real.sqrt (d*A s)) ∧
    ∃ R : Kernel S E, IsMarkovKernel R ∧ ∀ s,
      (Measurable (output (W s) 1 0) ∧ (ρ s).map (output (W s) 1 0)=R s ∧
        ρ s {ω | ∀ n, ω n ∉ accepted (W s) 1}=0 ∧
        (∫⁻ ω, 1+queryCount (W s) 1 ω ∂ρ s) ≤ ENNReal.ofReal (1+2*Real.exp 2)) ∧
      IsProbabilityMeasure (π s) ∧ π s ≪ R s ∧ R s ≪ π s ∧
      Integrable (fun x => ((π s).rnDeriv (R s) x).toReal^ell) (R s) ∧
      Integrable (fun x => ((R s).rnDeriv (π s) x).toReal^ell) (π s) ∧
      0 < (∫ x, ((π s).rnDeriv (R s) x).toReal^ell ∂R s) ∧
      0 < (∫ x, ((R s).rnDeriv (π s) x).toReal^ell ∂π s) ∧
      (∫ x, ((π s).rnDeriv (R s) x).toReal^ell ∂R s) ≤ 1+eps^2 ∧
      (∫ x, ((R s).rnDeriv (π s) x).toReal^ell ∂π s) ≤ 1+eps^2 ∧
      Real.log (∫ x, ((π s).rnDeriv (R s) x).toReal^ell ∂R s)/(ell-1) ≤ eps^2 ∧
      Real.log (∫ x, ((R s).rnDeriv (π s) x).toReal^ell ∂π s)/(ell-1) ≤ eps^2 ∧
      (ρ s).map (Φ s)=ρa s ∧
      (∀ ω n, Φ s ω n ∈ accepted (Wa s) 1 ↔ ω n ∈ accepted (W s) 1) ∧
      (∀ ω, queryCount (Wa s) 1 (Φ s ω)=queryCount (W s) 1 ω) ∧
      (fun ω => output (Wa s) 1 (u s) (Φ s ω)) =ᵐ[ρ s] output (W s) 1 0

Exact module and namespace context

Lean proof · terminal_fors_kernel

Genuine terminal firsthit and residual; fixed auxiliary Markov program; true-law cached cost; scaled mean identity; source RN comparison; full infinite-product reparameterization and AE defaults.

theorem terminal_fors_kernel {V : E → ℝ} {α β : ℝ≥0}
    (hV : ContDiff ℝ 2 V)
    (hH : ∀ x v : E, (α:ℝ)*‖v‖^2 ≤ fderiv ℝ (fderiv ℝ V) x v v ∧
      fderiv ℝ (fderiv ℝ V) x v v ≤ (β:ℝ)*‖v‖^2)
    (hαβ : α ≤ β) (hβ : 0 < (β:ℝ)) (hd : 0 < (Module.finrank ℝ E : ℝ))
    {b : S → ℝ} {u initial : S → E} (hb : Measurable b)
    (hb0 : ∀ s, 0 < b s) (hu : Measurable u) (hi : Measurable initial)
    (ell eps : ℝ) (hell : 2 ≤ ell) (heps : 0 < eps) (heps1 : eps ≤ 1/2)
    (hstep : ∀ s, 64*(β:ℝ)*(Real.sqrt ((Module.finrank ℝ E:ℝ)*(ell+Real.log (1/eps)))+
      (ell+Real.log (1/eps))) ≤ b s) :
    let d : ℝ := Module.finrank ℝ E
    let F := fun s x => V x+b s/2*‖x-u s‖^2
    let T := fun s x => x-((β:ℝ)+b s)⁻¹ • gradient (F s) x
    let Qn := fun n s => ‖gradient (F s) ((T s)^[n] (initial s))‖^2
    let N := firstIndex Qn (fun s => d*b s)
    let xp := fun s => (T s)^[N s] (initial s)
    let A := fun s => (b s)⁻¹
    let g := fun s => gradient V (xp s)
    let h := fun s => u s-A s • g s
    let ν := (volume.restrict (Ioc (0 : ℝ) 1)).prod (stdGaussian E)
    let W := fun s (p : E × (ℝ × E)) => min 1 (max (-1) (scaledCached V A h g ((s,p.1),p.2)))
    let q := fun s => (stdGaussian E).map (fun z => h s+Real.sqrt (A s) • z)
    let ρ := fun s => Measure.infinitePi (fun _ : ℕ => attemptLaw (q s) ν 1 (by norm_num))
    let π := fun s => ((stdGaussian E).map (fun z => u s+Real.sqrt (A s) • z)).tilted (fun x => -V x)
    let νa := fun s => (volume.restrict (Ioc (0 : ℝ) 1)).prod ((stdGaussian E).map (fun z => Real.sqrt (A s) • z))
    let Wa := fun s (p : E × (ℝ × E)) => min 1 (max (-1) (cachedEstimator V (h s) (g s) p))
    let ρa := fun s => Measure.infinitePi (fun _ : ℕ => attemptLaw (q s) (νa s) 1 (by norm_num))
    let Φ := fun s (ω : ℕ → Attempt E (ℝ × E)) n =>
      Stream.attemptMap (fun p : ℝ × E => (p.1,Real.sqrt (A s) • p.2)) (ω n)
    Measurable N ∧ Measurable xp ∧
    (∀ s, Qn (N s) s ≤ d*b s ∧ (∀ j < N s, d*b s < Qn j s) ∧
      ‖h s-xp s‖ ≤ Real.sqrt (d*A s)) ∧
    ∃ R : Kernel S E, IsMarkovKernel R ∧ ∀ s,
      (Measurable (output (W s) 1 0) ∧ (ρ s).map (output (W s) 1 0)=R s ∧
        ρ s {ω | ∀ n, ω n ∉ accepted (W s) 1}=0 ∧
        (∫⁻ ω, 1+queryCount (W s) 1 ω ∂ρ s) ≤ ENNReal.ofReal (1+2*Real.exp 2)) ∧
      IsProbabilityMeasure (π s) ∧ π s ≪ R s ∧ R s ≪ π s ∧
      Integrable (fun x => ((π s).rnDeriv (R s) x).toReal^ell) (R s) ∧
      Integrable (fun x => ((R s).rnDeriv (π s) x).toReal^ell) (π s) ∧
      0 < (∫ x, ((π s).rnDeriv (R s) x).toReal^ell ∂R s) ∧
      0 < (∫ x, ((R s).rnDeriv (π s) x).toReal^ell ∂π s) ∧
      (∫ x, ((π s).rnDeriv (R s) x).toReal^ell ∂R s) ≤ 1+eps^2 ∧
      (∫ x, ((R s).rnDeriv (π s) x).toReal^ell ∂π s) ≤ 1+eps^2 ∧
      Real.log (∫ x, ((π s).rnDeriv (R s) x).toReal^ell ∂R s)/(ell-1) ≤ eps^2 ∧
      Real.log (∫ x, ((R s).rnDeriv (π s) x).toReal^ell ∂π s)/(ell-1) ≤ eps^2 ∧
      (ρ s).map (Φ s)=ρa s ∧
      (∀ ω n, Φ s ω n ∈ accepted (Wa s) 1 ↔ ω n ∈ accepted (W s) 1) ∧
      (∀ ω, queryCount (Wa s) 1 (Φ s ω)=queryCount (W s) 1 ω) ∧
      (fun ω => output (Wa s) 1 (u s) (Φ s ω)) =ᵐ[ρ s] output (W s) 1 0 := by
  let d : ℝ := Module.finrank ℝ E
  let F := fun s x => V x+b s/2*‖x-u s‖^2
  let T := fun s x => x-((β:ℝ)+b s)⁻¹ • gradient (F s) x
  let Qn := fun n s => ‖gradient (F s) ((T s)^[n] (initial s))‖^2
  let N := firstIndex Qn (fun s => d*b s)
  let xp := fun s => (T s)^[N s] (initial s)
  let A := fun s => (b s)⁻¹
  let g := fun s => gradient V (xp s)
  let h := fun s => u s-A s • g s
  let ν := (volume.restrict (Ioc (0 : ℝ) 1)).prod (stdGaussian E)
  let W := fun s (p : E × (ℝ × E)) => min 1 (max (-1) (scaledCached V A h g ((s,p.1),p.2)))
  let q := fun s => (stdGaussian E).map (fun z => h s+Real.sqrt (A s) • z)
  let ρ := fun s => Measure.infinitePi (fun _ : ℕ => attemptLaw (q s) ν 1 (by norm_num))
  let π := fun s => ((stdGaussian E).map (fun z => u s+Real.sqrt (A s) • z)).tilted (fun x => -V x)
  let νa := fun s => (volume.restrict (Ioc (0 : ℝ) 1)).prod ((stdGaussian E).map (fun z => Real.sqrt (A s) • z))
  let Wa := fun s (p : E × (ℝ × E)) => min 1 (max (-1) (cachedEstimator V (h s) (g s) p))
  let ρa := fun s => Measure.infinitePi (fun _ : ℕ => attemptLaw (q s) (νa s) 1 (by norm_num))
  let Φ := fun s (ω : ℕ → Attempt E (ℝ × E)) n =>
    Stream.attemptMap (fun p : ℝ × E => (p.1,Real.sqrt (A s) • p.2)) (ω n)
  have href := variable_reference hV hH hαβ hd hb hb0 hu hi
  have hxp : Measurable xp := href.2.1
  have hVm : Measurable (gradient V) :=
    (TechnicalLemmas.Analysis.Calculus.Gradient.continuous_gradient_of_contDiff_one
      (hV.of_le (by norm_num))).measurable
  have hAm : Measurable A := hb.inv
  have hgm : Measurable g := hVm.comp hxp
  have hhm : Measurable h := hu.sub (hAm.smul hgm)
  have hlip : LipschitzWith β (gradient V) := by
    have hh := (TechnicalLemmas.Analysis.QuadraticRegularization.strongConvexOn_and_lipschitzWith_gradient_add_quadratic
      (r:=0) hV hH (0 : E)).2
    simpa using hh
  obtain ⟨R,hR,hRs⟩ := actual_kernel_program hVm hAm hhm hgm
  refine ⟨href.1,hxp,href.2.2.2,R,hR,fun s => ?_⟩
  have hs := hRs s
  refine ⟨⟨hs.1,hs.2.1,hs.2.2.2.1,hs.2.2.2.2⟩,?_⟩
  have hcenter : ‖(u s-A s • gradient V (xp s))-xp s‖ ≤ Real.sqrt (d*A s) :=
    (href.2.2.2 s).2.2
  have ht := TerminalSamplerAccuracyCost.terminal_sampler_accuracy_cost V
    (hV.differentiable (by norm_num)) (A s) (β:ℝ) ell eps
    (inv_pos.mpr (hb0 s)) hβ hell heps heps1 hd hlip (u s) (xp s) hcenter
    (by simpa only [A,one_div,inv_inv] using hstep s)
  have hr := hs.2.2.1
  change R s = (q s).tilted (fun x => ∫ z,
    min 1 (max (-1) (scaledCached V A h g ((s,x),z))) ∂ν) at hr
  dsimp only [ν] at hr
  simp_rw [scaled_mean hVm A h g s] at hr
  rw [hr]
  rcases ht with ⟨_,_,_,_,_,hpi,hpq,hqp,hfi,hri,hfp,hrp,hfb,hrb,hfl,hrl,_,_⟩
  have hc := source_correspondence V (A s) (h s) (g s) (u s)
  refine ⟨hpi,hpq,hqp,hfi,hri,hfp,hrp,hfb,hrb,hfl,hrl,hc.1,hc.2.1,hc.2.2.1,?_⟩
  exact hc.2.2.2 hs.2.2.2.1

end AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.TerminalFORSKernel

Exact module and namespace context

Source assumptions versus formal assumptions

Source	Actual Lean	Difference kind	Why it matters
A4(2) assumes convex smooth potential.	C2 and genuine nonnegative Hessian bounds; alpha may0.	API-limitation	Stronger regularity is required by this actual-reference construction; alpha0 is convex, not a nonconvex extension.
Section6.3 uses normalized Euclidean coordinates; A4(2) already allows general beta.	Coordinate-free positive finite dimension, with beta>0.	generalization	The extension is coordinate-free; general beta is already allowed by A4(2). No zero-dimensional or beta0 claim.
Source fixed terminal call.	One Markov kernel over arbitrary measurable states, with fixedV/ell/eps and measurable b,u,initial.	generalization	State-varying potentials/errors or joint stream-output measurability are not returned.
Recursive execution invokes terminal stage on an admissible domain.	Every state satisfies b>0 and the explicit sufficient64 condition.	source-implicit	No reachability proof or behavior outside this terminal domain.
Theorem A4(2) uses Renyi order q>=2.	ell>=2 matches the source order condition.	same	The upstream B12 proof for1<ell<2 is not used. The explicit0<eps<=1/2 range also matches A4(2).
Source asymptotic constants and query guarantees.	Explicit sufficient64 threshold, two-way RN refinements and expected1+2exp2; high-probability bound omitted.	API-limitation	This component is not the complete A4(2) guarantee.
Source algorithm needs an initialized reference and cached gradient.	Actual reference constructed; sampler count excludes its GD cost and does not discount the last check.	source-implicit	No free reference hypothesis, but initialization-cost integration and total query accounting remain separate.
Statewise source program uses a default center on never-hit.	Parameterized program uses0; equality with old defaultu is onlyAE.	source-implicit	The actual never-hit null event proves this equality; no all-stream default equivalence.

Parameterized local terminal FORS component with an actual generated reference, not full A4(2) or either paper. V,alpha,beta,ell,eps are fixed; b,u,initial vary and all states meet the sufficient terminal condition. C2/genuine Hessian hypotheses strengthen the source convex-smooth regularity; alpha=0 remains convex, not nonconvex. Positive dimension and beta are required. ell>=2 matches A4(2); the upstream B12 proof for1<ell<2 is not used. Numeric64 and explicit RN/expected constants are proved sufficient refinements, not verbatim source constants. The source high-probability query bound is not returned. The1+2exp2 count excludes reference GD initialization and any cache discount between its last check and the sampler. No joint stream-output measurability, target-family kernel, evaluator trace, terminal-domain reachability, history propagation, stage sum, initialization-cost integral or full composition is claimed.

Encoder–denoiser: accepted · domain-mismatch

Detected semantic differences

assumptions: C2/genuine Hessian strengthens convexsmooth; alpha0 is convex. — Independent formal reviewer accepted: C2/genuine Hessian strengthens convexsmooth; alpha0 is convex.
domains: Coordinate-free only; A4 already allows generalbeta. — Independent formal reviewer accepted: Coordinate-free only; A4 already allows generalbeta.
quantifiers: Fixed potential/order/error with measurable parameter family. — Independent formal reviewer accepted: Fixed potential/order/error with measurable parameter family.
scopes: Allstates legalterminaldomain,no reachability. — Independent formal reviewer accepted: Allstates legalterminaldomain,no reachability.
assumptions: ell>=2 and0<eps<=1/2 matchA4; upstreamB12 interval1<ell<2 not used. — Independent formal reviewer accepted: ell>=2 and0<eps<=1/2 matchA4; upstreamB12 interval1<ell<2 not used.
conclusion: Explicit sufficient constants and RN refinements; source highprob bound omitted. — Independent formal reviewer accepted: Explicit sufficient constants and RN refinements; source highprob bound omitted.
conclusion: Actual reference constructed; sampler cost excludes GD and cache discount. — Independent formal reviewer accepted: Actual reference constructed; sampler cost excludes GD and cache discount.
scopes: Defaultu vs0 equality onlyAE,not allstreams. — Independent formal reviewer accepted: Defaultu vs0 equality onlyAE,not allstreams.

A generalization is not a source correction. Proposed missing conditions require separate independent repair review. No proposed repair silently changes the original theorem.

Scope and omitted-condition boundaries

Parameterized local terminal FORS component with an actual generated reference, not full A4(2) or either paper. V,alpha,beta,ell,eps are fixed; b,u,initial vary and all states meet the sufficient terminal condition. C2/genuine Hessian hypotheses strengthen the source convex-smooth regularity; alpha=0 remains convex, not nonconvex. Positive dimension and beta are required. ell>=2 matches A4(2); the upstream B12 proof for1<ell<2 is not used. Numeric64 and explicit RN/expected constants are proved sufficient refinements, not verbatim source constants. The source high-probability query bound is not returned. The1+2exp2 count excludes reference GD initialization and any cache discount between its last check and the sampler. No joint stream-output measurability, target-family kernel, evaluator trace, terminal-domain reachability, history propagation, stage sum, initialization-cost integral or full composition is claimed.

Source and reuse

ASTIS parents called

Mathlib API called (external library)

MeasureTheory.measurable_find
MeasureTheory.Measurable.find
MeasureTheory.Measure.map_prod_map
MeasureTheory.Measure.infinitePi_map_pi
MeasureTheory.integral_map
MeasureTheory.lintegral_add_left

Mathematical sources

SPHMC Section6.3 terminal reference — Parameterized local terminal FORS component with an actual generated reference, not full A4(2) or either paper. V,alpha,beta,ell,eps are fixed; b,u,initial vary and all states meet the sufficient terminal condition. C2/genuine Hessian hypotheses strengthen the source convex-smooth regularity; alpha=0 remains convex, not nonconvex. Positive dimension and beta are required. ell>=2 matches A4(2); the upstream B12 proof for1<ell<2 is not used. Numeric64 and explicit RN/expected constants are proved sufficient refinements, not verbatim source constants. The source high-probability query bound is not returned. The1+2exp2 count excludes reference GD initialization and any cache discount between its last check and the sampler. No joint stream-output measurability, target-family kernel, evaluator trace, terminal-domain reachability, history propagation, stage sum, initialization-cost integral or full composition is claimed.
SPHMC TheoremA.4(2) terminal sampler — Parameterized local terminal FORS component with an actual generated reference, not full A4(2) or either paper. V,alpha,beta,ell,eps are fixed; b,u,initial vary and all states meet the sufficient terminal condition. C2/genuine Hessian hypotheses strengthen the source convex-smooth regularity; alpha=0 remains convex, not nonconvex. Positive dimension and beta are required. ell>=2 matches A4(2); the upstream B12 proof for1<ell<2 is not used. Numeric64 and explicit RN/expected constants are proved sufficient refinements, not verbatim source constants. The source high-probability query bound is not returned. The1+2exp2 count excludes reference GD initialization and any cache discount between its last check and the sampler. No joint stream-output measurability, target-family kernel, evaluator trace, terminal-domain reachability, history propagation, stage sum, initialization-cost integral or full composition is claimed.

ASTIS prose is not a quotation or a source-equivalence certificate. Definitions and aliases are explained as constructions, not counted as new mathematical proofs.

Which proof edges are actually covered?

Local proof component; source adapter/review separate Actual terminal reference, FORS kernel and source program

Actual terminal reference by gradient descent

ASTIS expanded mathematical proof component for Fan Chen, Sinho Chewi, Jianfeng Lu and Matthew S. Zhang, Smoothed Picard Hamiltonian Monte Carlo. Explicit local constants, a stronger same-algorithm proof and domain extensions are disclosed below; the full random-history and summed-cost claim is not asserted.

arXiv:2609.06906v1 · Section6.3 Reference point construction and Terminal stage: actual GD and local moment-to-query-cost component · faithful paraphrase

Complete source statement (ASTIS restatement)

The derived a,c are positive and k>=1. The exact gradient is grad F(x)=grad U(x)+(x-u)/A. Both N and x_plus are measurable. For every v, the output satisfies norm(grad F(x_plus(v)))^2<=d/A and the exact center-residual identity norm(u-A*grad U(x_plus(v))-x_plus(v))=A*norm(grad F(x_plus(v)))<=sqrt(d*A). All j<N(v) strictly fail the stopping test. N(v)<=ceil(k*log(1+A*norm(grad F(v))^2/d)), and N(v)+1<=k*log(1+A*norm(grad F(v))^2/d)+2. Under the additional starting-law moment hypotheses, N+1 is genuinely integrable and its expectation is at most 2+k*log(1+A*M/d).

E is a complete finite-dimensional real inner-product space with its Borel sigma-algebra. The real parameter d is strictly positive and equals finrank(E). U:E->R is C2. Nonnegative real numbers m,b satisfy m<=b, and the genuine Hessian obeys m*norm(v)^2 <= D2U(x)[v,v] <= b*norm(v)^2 at every x,v.
Fix a finite real A>0 and u in E. Define F(x)=U(x)+norm(x-u)^2/(2A), a=m+1/A, c=b+1/A and k=c/a. Define the actual gradient-descent map T(x)=x-(1/c)*grad F(x). All gradients are the actual derivatives of these functions.
For every starting point v, N(v) is the least natural n with norm(grad F(T^n(v)))^2<=d/A if such an n exists, and zero otherwise. Let x_plus(v)=T^N(v)(v). The proof establishes finite attainment for every v, so the fallback branch never occurs. The specified query count is N(v)+1: evaluate grad U once at each visited point, form the quadratic-gradient term algebraically, check the threshold and reuse this gradient for an update when required. The final successful check is charged.
Only the expected-cost clause additionally takes an arbitrary probability starting law mu and a real M with actual norm(grad F(v))^2 integrable under mu and integral at most M. M need not be separately assumed nonnegative: the proof derives it. These are explicit inputs, not established properties of the recursive sampler history.

Actual stopped reference

\[N(v)=\min\{n\ge0:\|\nabla F(T^nv)\|^2\le d/A\},\quad x_+(v)=T^{N(v)}v,\quad \|u-A\nabla U(x_+)-x_+\|\le\sqrt{dA}.\]

Conditional starting-law query cost

\[\|\nabla F\|^2\in L^1(\mu),\quad \mathbb E_\mu\|\nabla F\|^2\le M\quad\Longrightarrow\quad N+1\in L^1(\mu),\quad \mathbb E_\mu(N+1)\le2+k\log(1+AM/d).\]

Read the formalized proofs

Each statement and proof below has its own closed Lean disclosure. ASTIS parents, Mathlib calls and external mathematical sources are distinguished in each proof.

ASTIS mathematical exposition

Actual terminal reference by gradient descent

AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.TerminalReferenceGradientDescent.terminal_reference_gradient_descent · theorem · Teaching coverage

Statement

\[N(v)=\min\{n\ge0:\|\nabla F(T^nv)\|^2\le d/A\},\quad x_+(v)=T^{N(v)}v,\quad \|u-A\nabla U(x_+)-x_+\|\le\sqrt{dA}.\]

All objects and hypotheses

E is a complete finite-dimensional real inner-product space with its Borel sigma-algebra. The real parameter d is strictly positive and equals finrank(E). U:E->R is C2. Nonnegative real numbers m,b satisfy m<=b, and the genuine Hessian obeys m*norm(v)^2 <= D2U(x)[v,v] <= b*norm(v)^2 at every x,v.
Fix a finite real A>0 and u in E. Define F(x)=U(x)+norm(x-u)^2/(2A), a=m+1/A, c=b+1/A and k=c/a. Define the actual gradient-descent map T(x)=x-(1/c)*grad F(x). All gradients are the actual derivatives of these functions.
For every starting point v, N(v) is the least natural n with norm(grad F(T^n(v)))^2<=d/A if such an n exists, and zero otherwise. Let x_plus(v)=T^N(v)(v). The proof establishes finite attainment for every v, so the fallback branch never occurs. The specified query count is N(v)+1: evaluate grad U once at each visited point, form the quadratic-gradient term algebraically, check the threshold and reuse this gradient for an update when required. The final successful check is charged.
Only the expected-cost clause additionally takes an arbitrary probability starting law mu and a real M with actual norm(grad F(v))^2 integrable under mu and integral at most M. M need not be separately assumed nonnegative: the proof derives it. These are explicit inputs, not established properties of the recursive sampler history.

Mathematical proof

1. Derive the actual regularized gradient and curvature

The quadratic term has derivative A^{-1}<x-u, .>. Adding it to the derivative of U gives the exact gradient formula. Reuse QuadraticRegularization for strong convexity and gradient Lipschitz continuity. To obtain the quadratic upper model, apply the Hessian-to-strong-convexity theorem to -U with modulus -b, then the first-order lower bound and reverse its signs. Add the exact quadratic expansion. Since A>0 and 0<=m<=b, a,c>0 and k>=1. No model inequality or gradient field is supplied as an assumption.

\[\nabla F(x)=\nabla U(x)+A^{-1}(x-u),\quad a=m+A^{-1},\quad c=b+A^{-1},\quad F(y)\le F(x)+\langle\nabla F(x),y-x\rangle+\tfrac c2\|y-x\|^2.\]

Corresponding Lean step

quadratic_upper; regularized_data; AutoSamplingTheory.TechnicalLemmas.Analysis.QuadraticRegularization.strongConvexOn_and_lipschitzWith_gradient_add_quadratic; AutoSamplingTheory.TechnicalLemmas.Analysis.HessianStrongConvexity.strongConvexOn_univ_of_fderiv2_lower; AutoSamplingTheory.TechnicalLemmas.Analysis.StrongConvexFirstOrder.firstOrder_lower_bound_of_strongConvexOn

2. Control gradients through adjacent actual iterates

Apply the existing one-step contraction to x and T(x). Their distance is c^{-1} times the norm of grad F(x); the next distance is c^{-1} times the norm of grad F(T(x)). Cancel the positive step and iterate this inequality. Bound sqrt(1-a/c) by exp(-a/(2c)), then square the resulting norm bound. This uses the source gradient-descent map and needs no supplied minimizer. It is a stronger local proof than the source display with an extra k prefactor, rather than a literal replay of that display.

\[\|\nabla F(Tx)\|\le\sqrt{1-a/c}\,\|\nabla F(x)\|,\qquad \|\nabla F(T^nv)\|^2\le e^{-n/k}\|\nabla F(v)\|^2.\]

Corresponding Lean step

gradient_decay; AutoSamplingTheory.TechnicalLemmas.Analysis.GradientDescentContraction.gradient_step_contraction; Real.add_one_le_exp

3. Give a finite stopping certificate including degenerate gradients

Put s=d/A>0 and z=norm(grad F(v))^2>=0. The natural ceiling n=ceil(k log(1+z/s)) satisfies n>=k log(1+z/s). Therefore exp(-n/k)z<=z/(1+z/s)<=s. This constructs a finite successful index before Nat.find is used. The argument covers z=0 and k=1 without taking log(1-1/k). The ceiling bound and ceil(t)<t+1 for t>=0 later give the extra two units in the real count bound.

\[n=\lceil k\log(1+z/s)\rceil,\qquad e^{-n/k}z\le\frac{z}{1+z/s}\le s,\qquad N(v)+1\le k\log(1+A\|\nabla F(v)\|^2/d)+2.\]

Corresponding Lean step

stopping_certificate; stopped_program; Nat.le_ceil; Nat.ceil_lt_add_one

4. Prove the first-hit index and stopped output are measurable

The C1 gradient is continuous, hence T and each finite iterate are continuous. Each event where the nth gradient square is at most s is Borel measurable. The finite-attainment certificate identifies N with Nat.find of this event family. measurable_find proves N measurable, and Measurable.find proves measurability of v mapped to T^N(v)(v). Nat.find_spec gives success and Nat.find_min gives strict failure for every earlier index. Pointwise termination is not used as a substitute for measurability.

\[\{N=n\}=\{\|\nabla F(T^nv)\|^2\le s\}\cap\bigcap_{j<n}\{\|\nabla F(T^jv)\|^2>s\},\quad N,x_+\text{ measurable}.\]

Corresponding Lean step

firstIndex; stopped_program; AutoSamplingTheory.TechnicalLemmas.Analysis.Calculus.Gradient.continuous_gradient_of_contDiff_one; measurable_find; Measurable.find; Nat.find_spec; Nat.find_min

5. Convert the stopping test into the required terminal residual

At every x, the exact gradient formula gives u-A grad U(x)-x=-A grad F(x). Because A>0, its norm is A times norm(grad F(x)). At the stopped point, multiply the proved gradient-square threshold by A squared; the result is at most dA. Taking the nonnegative square root yields the center residual used by the terminal sampler. This proves the residual of the constructed point rather than receiving it as input.

Corresponding Lean step

terminal_reference_gradient_descent; regularized_data; Real.le_sqrt_of_sq_le

6. Establish integrability before the expected-count bound

For g(v)=norm(grad F(v))^2, the given nonnegative integrable g and Eg<=M imply M>=0. First use 0<=log(1+g/s)<=g/s to prove logarithmic integrability. The log-ratio inequality gives the displayed tangent bound; both sides are integrable before integrating. Its remainder has nonpositive expectation by Eg<=M. Finally, measurability and the pointwise count bound imply N+1 is integrable, and integral monotonicity gives the expected count. This is a direct logarithmic tangent proof, not a call to a Jensen API or a presumption of cost integrability.

\[\log(1+g/s)\le\log(1+M/s)+\frac{g-M}{s+M},\qquad N+1\in L^1(\mu),\qquad \mathbb E_\mu(N+1)\le2+k\log(1+AM/d).\]

Corresponding Lean step

expected_count; Real.log_le_sub_one_of_pos; MeasureTheory.Integrable.mono'; MeasureTheory.integral_mono; MeasureTheory.integral_add

7. Assemble the actual fixed-parameter reference and counting contract

Instantiate the stopping and expectation lemmas with the genuine F, its proved a,c and threshold d/A. The pointwise conclusions hold for every starting point; the expected-cost clause is then quantified over any probability starting law satisfying the actual gradient moment hypotheses. At an initially successful point N=0 and one gradient check is charged. Each visit needs one U-gradient evaluation because the regularization term is algebraic, and the computed gradient is reused for the next update. The final gradient is charged; no unproved saving is deducted when later combining this construction with a sampler.

\[T(x)=x-c^{-1}\nabla F(x),\qquad Q_{\nabla U}(v)=N(v)+1,\qquad \mathbb E_\mu Q_{\nabla U}\le2+\frac{b+A^{-1}}{m+A^{-1}}\log\!\left(1+\frac{AM}{d}\right).\]

Corresponding Lean step

terminal_reference_gradient_descent; stopped_program; expected_count; regularized_data

Lean statement · terminal_reference_gradient_descent

Actual regularized gradient, positive curvature constants, measurable first-hit index/output, terminal residual, strict earlier failure, ceiling/count bounds and conditional initial-law L1/expected count.

theorem terminal_reference_gradient_descent [FiniteDimensional ℝ E]
    [MeasurableSpace E] [BorelSpace E] {U : E → ℝ} {m b : ℝ≥0}
    (hU : ContDiff ℝ 2 U)
    (hH : ∀ x v : E, (m:ℝ)*‖v‖^2 ≤ (fderiv ℝ (fderiv ℝ U) x v) v ∧
      (fderiv ℝ (fderiv ℝ U) x v) v ≤ (b:ℝ)*‖v‖^2)
    (hmb : m ≤ b) {A d : ℝ} (hA : 0 < A) (hd : 0 < d)
    (_hdim : d = Module.finrank ℝ E) (u : E) :
    let F := fun x => U x+A⁻¹/2*‖x-u‖^2
    let a := (m:ℝ)+A⁻¹
    let c := (b:ℝ)+A⁻¹
    let k := c/a
    let T := fun x => x-c⁻¹ • gradient F x
    let N := firstIndex T F (d/A)
    let xp := fun v => T^[N v] v
    0 < a ∧ 0 < c ∧ 1 ≤ k ∧
    (∀ x, gradient F x=gradient U x+A⁻¹ • (x-u)) ∧
    Measurable N ∧ Measurable xp ∧
    (∀ v, ‖gradient F (xp v)‖^2 ≤ d/A ∧
      ‖u-A • gradient U (xp v)-xp v‖=A*‖gradient F (xp v)‖ ∧
      ‖u-A • gradient U (xp v)-xp v‖ ≤ Real.sqrt (d*A) ∧
      (∀ j < N v, d/A < ‖gradient F (T^[j] v)‖^2) ∧
      N v ≤ Nat.ceil (k*Real.log (1+A*‖gradient F v‖^2/d)) ∧
      (N v:ℝ)+1 ≤ k*Real.log (1+A*‖gradient F v‖^2/d)+2) ∧
    (∀ (μ : Measure E), IsProbabilityMeasure μ → ∀ M : ℝ,
      Integrable (fun v => ‖gradient F v‖^2) μ →
      (∫ v, ‖gradient F v‖^2 ∂μ) ≤ M →
      Integrable (fun v => (N v:ℝ)+1) μ ∧
      (∫ v, (N v:ℝ)+1 ∂μ) ≤ 2+k*Real.log (1+A*M/d))

Exact module and namespace context

Lean proof · terminal_reference_gradient_descent

Derive regularized curvature and gradient, contract adjacent actual iterates, construct a finite ceiling certificate, prove measurable first hit, convert its residual and integrate a logarithmic tangent bound.

theorem terminal_reference_gradient_descent [FiniteDimensional ℝ E]
    [MeasurableSpace E] [BorelSpace E] {U : E → ℝ} {m b : ℝ≥0}
    (hU : ContDiff ℝ 2 U)
    (hH : ∀ x v : E, (m:ℝ)*‖v‖^2 ≤ (fderiv ℝ (fderiv ℝ U) x v) v ∧
      (fderiv ℝ (fderiv ℝ U) x v) v ≤ (b:ℝ)*‖v‖^2)
    (hmb : m ≤ b) {A d : ℝ} (hA : 0 < A) (hd : 0 < d)
    (_hdim : d = Module.finrank ℝ E) (u : E) :
    let F := fun x => U x+A⁻¹/2*‖x-u‖^2
    let a := (m:ℝ)+A⁻¹
    let c := (b:ℝ)+A⁻¹
    let k := c/a
    let T := fun x => x-c⁻¹ • gradient F x
    let N := firstIndex T F (d/A)
    let xp := fun v => T^[N v] v
    0 < a ∧ 0 < c ∧ 1 ≤ k ∧
    (∀ x, gradient F x=gradient U x+A⁻¹ • (x-u)) ∧
    Measurable N ∧ Measurable xp ∧
    (∀ v, ‖gradient F (xp v)‖^2 ≤ d/A ∧
      ‖u-A • gradient U (xp v)-xp v‖=A*‖gradient F (xp v)‖ ∧
      ‖u-A • gradient U (xp v)-xp v‖ ≤ Real.sqrt (d*A) ∧
      (∀ j < N v, d/A < ‖gradient F (T^[j] v)‖^2) ∧
      N v ≤ Nat.ceil (k*Real.log (1+A*‖gradient F v‖^2/d)) ∧
      (N v:ℝ)+1 ≤ k*Real.log (1+A*‖gradient F v‖^2/d)+2) ∧
    (∀ (μ : Measure E), IsProbabilityMeasure μ → ∀ M : ℝ,
      Integrable (fun v => ‖gradient F v‖^2) μ →
      (∫ v, ‖gradient F v‖^2 ∂μ) ≤ M →
      Integrable (fun v => (N v:ℝ)+1) μ ∧
      (∫ v, (N v:ℝ)+1 ∂μ) ≤ 2+k*Real.log (1+A*M/d)) := by
  let r : ℝ≥0 := ⟨A⁻¹,inv_nonneg.mpr hA.le⟩
  let F := fun x => U x+A⁻¹/2*‖x-u‖^2
  let a := (m:ℝ)+A⁻¹
  let c := (b:ℝ)+A⁻¹
  let k := c/a
  let T := fun x => x-c⁻¹ • gradient F x
  let N := firstIndex T F (d/A)
  let xp := fun v => T^[N v] v
  have ha : 0 < a := add_pos_of_nonneg_of_pos m.coe_nonneg (inv_pos.mpr hA)
  have hc : 0 < c := add_pos_of_nonneg_of_pos b.coe_nonneg (inv_pos.mpr hA)
  have hk : 1 ≤ k := by
    apply (le_div_iff₀ ha).mpr
    have hmb' : (m:ℝ) ≤ b := hmb
    dsimp [a,c]
    linarith
  have hdata := regularized_data (r:=r) hU hH u
  have hF : ContDiff ℝ 2 F := hdata.1
  have hsc : StrongConvexOn univ a F := hdata.2.1
  have hg (x : E) : gradient F x=gradient U x+A⁻¹ • (x-u) := hdata.2.2.2.1 x
  have hu : ∀ x y, F y ≤ F x+inner ℝ (gradient F x) (y-x)+c/2*‖y-x‖^2 :=
    hdata.2.2.2.2
  have hp := stopped_program (hF.of_le (by norm_num)) ha hc
    (div_pos hd hA) hsc hu
  have ratio (z : ℝ) : z/(d/A)=A*z/d := by field_simp
  have hres (x : E) : ‖u-A • gradient U x-x‖=A*‖gradient F x‖ := by
    have he : u-A • gradient U x-x=-(A • gradient F x) := by
      rw [hg,smul_add,smul_smul,mul_inv_cancel₀ hA.ne',one_smul]
      abel
    rw [he,norm_neg,norm_smul,Real.norm_eq_abs,abs_of_pos hA]
  refine ⟨ha,hc,hk,hg,hp.1,hp.2.1,?_,?_⟩
  · intro v
    have hv := hp.2.2 v
    have hstop : ‖gradient F (xp v)‖^2 ≤ d/A := hv.1
    have hr : ‖u-A • gradient U (xp v)-xp v‖ ≤ Real.sqrt (d*A) := by
      apply Real.le_sqrt_of_sq_le
      rw [hres,mul_pow]
      have hh := mul_le_mul_of_nonneg_left hstop (sq_nonneg A)
      have he : A^2*(d/A)=d*A := by field_simp
      rw [he] at hh
      exact hh
    refine ⟨hstop,hres _,hr,hv.2.1,?_,?_⟩
    · simpa only [ratio] using hv.2.2.1
    · simpa only [ratio] using hv.2.2.2
  · intro μ hμ M hgi hM
    let : IsProbabilityMeasure μ := hμ
    have hgm : Measurable (fun v => ‖gradient F v‖^2) :=
      ((TechnicalLemmas.Analysis.Calculus.Gradient.continuous_gradient_of_contDiff_one
        (hF.of_le (by norm_num))).norm.pow 2).measurable
    have he := expected_count μ (fun v => ‖gradient F v‖^2) N (div_pos hc ha)
      (div_pos hd hA) hgm hgi (fun v => sq_nonneg _) hp.1 hM (fun v => (hp.2.2 v).2.2.2)
    simpa only [ratio] using he







end AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.TerminalReferenceGradientDescent

Exact module and namespace context

Source assumptions versus formal assumptions

Source	Actual Lean	Difference kind	Why it matters
Section6.3 is stated in Euclidean space.	Complete finite-dimensional real inner-product Borel space with d=finrank(E)>0.	generalization	Coordinate-free extension; the dimension equality is still a public assumption despite its unused binder name.
The recursive application has a strongly convex smooth base potential.	Actual C2 Hessian bounds with 0<=m<=b, allowing m=b=0.	generalization	Positive finite quadratic precision still gives a,c>0 and all proofs remain valid; this is a base-potential extension, not an omitted convexity assumption.
The terminal stage has finite positive A and positive dimension; the overall recursive interface also discusses infinite initial A0.	Finite real A>0 and d>0.	same	This is the terminal preparation component, not an implementation of the infinite initial regularization parameter.
The displayed source GD estimate has an extra condition-number prefactor and only universal cost constants.	The same step1/c GD has exp(-n/k) gradient-square decay, an explicit natural-ceiling certificate and expectation constant2.	source-implicit	Adjacent-iterate contraction gives a stronger local proof without changing the algorithm; explicit constants are derived and not attributed as printed source constants.
First attainment and using a random starting point are implicit in the optimization routine.	Actual Nat.find, measurable N and stopped output, strict failure at all earlier indices, genuine log/count L1.	source-implicit	Finite attainment precedes the choice; no default integral values or unproved stopping measurability are used.
The source counts gradient queries for reference preparation.	N+1 evaluates the base gradient once per visited point, reusing it for the update and charging the final check.	source-implicit	The exact regularized gradient makes its quadratic contribution algebraic. This cost model is not a verified evaluator/compiler trace.
Section6.3 derives stage-specific initial gradient moments and then sums reference costs.	The local expected-cost component accepts actual initial gradient-square L1 and Eg<=M for an arbitrary probability starting law.	source-implicit	This exposes the input to the descent-cost argument; it does not prove the random-history moment or total Ckappa0Lq claim.
The constructed reference feeds the terminal sampling call inside the recursion.	The actual stopped point satisfies the terminal residual for fixed A,u.	same	The combined joint probability program, random-parameter kernel and cross-module cache saving remain separate obligations; no full-paper closure follows.

This constructs an actual fixed-parameter terminal reference point and its specified gradient-query count. It does not assume a minimizer, successful stopping or the desired residual. The same source GD is analyzed using a stronger adjacent-iterate rate without the source display's extra condition-number prefactor. The finite-dimensional coordinate-free formulation and nonnegative base Hessian modulus extend the source setting; positive finite A and positive dimension remain explicit. The dimension equality stays in the public contract even though the underlying threshold proof does not use its numeric value. N+1 is a mathematical count model, not a compiler/evaluator trace. The expectation clause requires the actual starting gradient-square moment; the recursive-history moment, retained-reference invariant and summed stage cost C*kappa0*Lq remain unproved here. Parameters A,u are fixed for the measurable map: no jointly measurable random-parameter kernel is claimed. The output has the residual needed by the terminal sampler, but a combined sampling program and cross-module cache saving have not been proved. No TV transport of unbounded costs or complete-paper result is asserted.

Encoder–denoiser: accepted · domain-mismatch

Detected semantic differences

domains: Coordinate-free extension; dimension equality remains genuine assumption. — Independent reviewer accepted: Coordinate-free extension; dimension equality remains genuine assumption.
assumptions: Nonnegative base curvature; positive regularization preserves a,c>0. — Independent reviewer accepted: Nonnegative base curvature; positive regularization preserves a,c>0.
domains: Finite positive A and d in selected terminal component; infinite initial parameter excluded. — Independent reviewer accepted: Finite positive A and d in selected terminal component; infinite initial parameter excluded.
constant_dependencies: Stronger same-algorithm estimate and explicit sufficient constants disclosed. — Independent reviewer accepted: Stronger same-algorithm estimate and explicit sufficient constants disclosed.
quantifiers: Finite attainment, first-hit minimality, measurability and count L1 proved. — Independent reviewer accepted: Finite attainment, first-hit minimality, measurability and count L1 proved.
objects: One base gradient per visited point with reuse, including final check; no evaluator/compiler theorem. — Independent reviewer accepted: One base gradient per visited point with reuse, including final check; no evaluator/compiler theorem.
scopes: Actual initial gradient moment explicit local input; no history-moment or total stage-cost completion. — Independent reviewer accepted: Actual initial gradient moment explicit local input; no history-moment or total stage-cost completion.
scopes: Residual is terminal consumer interface; joint sampling and cache sharing separate. — Independent reviewer accepted: Residual is terminal consumer interface; joint sampling and cache sharing separate.

A generalization is not a source correction. Proposed missing conditions require separate independent repair review. No proposed repair silently changes the original theorem.

Scope and omitted-condition boundaries

This constructs an actual fixed-parameter terminal reference point and its specified gradient-query count. It does not assume a minimizer, successful stopping or the desired residual. The same source GD is analyzed using a stronger adjacent-iterate rate without the source display's extra condition-number prefactor. The finite-dimensional coordinate-free formulation and nonnegative base Hessian modulus extend the source setting; positive finite A and positive dimension remain explicit. The dimension equality stays in the public contract even though the underlying threshold proof does not use its numeric value. N+1 is a mathematical count model, not a compiler/evaluator trace. The expectation clause requires the actual starting gradient-square moment; the recursive-history moment, retained-reference invariant and summed stage cost C*kappa0*Lq remain unproved here. Parameters A,u are fixed for the measurable map: no jointly measurable random-parameter kernel is claimed. The output has the residual needed by the terminal sampler, but a combined sampling program and cross-module cache saving have not been proved. No TV transport of unbounded costs or complete-paper result is asserted.

Source and reuse

ASTIS parents called

Mathlib API called (external library)

Nat.le_ceil
Nat.ceil_lt_add_one
measurable_find
Measurable.find
Nat.find_spec
Nat.find_min
Real.log_le_sub_one_of_pos
MeasureTheory.Integrable.mono'
MeasureTheory.integral_mono

Mathematical sources

SPHMC section6.3 terminal reference construction — Actual gradient-descent preparation and the local moment-to-query-cost proof component; history and stage summation remain separate.

ASTIS prose is not a quotation or a source-equivalence certificate. Definitions and aliases are explained as constructions, not counted as new mathematical proofs.

Which proof edges are actually covered?

Local proof component; source adapter/review separate Actual terminal reference construction and local conditional-moment query cost

Actual terminal sampler accuracy and cached gradient costs

ASTIS expanded mathematical restatement of the fixed-call terminal sampler in Fan Chen, Sinho Chewi, Jianfeng Lu and Matthew S. Zhang, Smoothed Picard Hamiltonian Monte Carlo; smooth sampling dependency from Fan Chen, Sinho Chewi, Constantinos Daskalakis and Alexander Rakhlin, High-accuracy sampling for diffusion models and log-concave distributions. Explicit scope differences below apply.

arXiv:2609.06906v1 · Theorem A.4(2), through smooth arXiv:2602.01338v1 D.1/B.12 and actual local Poisson query tail · faithful paraphrase

Complete source statement (ASTIS restatement)

The output map is measurable and its rho-pushforward equals qhat; the never-accepted event has rho-measure zero. rho,qhat,pi are probability measures, and pi and qhat are mutually absolutely continuous. Both actual real RN ell-power functions are integrable under their denominator measures, and both integrals are strictly positive and at most 1+eps^2. Each explicit logarithmic RN moment divided by ell-1 is at most eps^2. The actual cached gradient count has expected value at most 1+2*exp(2). For every 0<p<=1/2, rho{G_cost>K_G*log(2/p)}<=p, where K_G=2*(exp(1)-1)*(exp(2)+1/log(2))+1+1/log(2). The cost expectation and tail are stated in extended nonnegative reals.

E is a finite-dimensional real inner-product Borel space with d=finrank(E)>0. f:E->R is differentiable everywhere and its actual gradient is globally beta-Lipschitz. eta,beta>0, ell>=2 and 0<eps<=1/2. Convexity is not used in this fixed smooth dependency.
Given x0 and supplied x_plus, cache g=grad f(x_plus) and set h=x0-eta*g. Assume norm(h-x_plus)<=sqrt(d*eta). Let L=ell+log(1/eps), and assume 64*beta*(sqrt(d*L)+L)<=1/eta. The reference-point construction and its cost are outside this fixed-call input contract.
Let P=(z->sqrt(eta)*z)_*stdGaussian(E), nu=Lebesgue restricted to (0,1] product P, and q=(z->h+sqrt(eta)*z)_*stdGaussian(E). For theta=pi*r/2 define W0(x,r,z)=<(pi/2)*(cos(theta)*(x-h)-sin(theta)*z),g-grad f(h+sin(theta)*(x-h)+cos(theta)*z)>. Set W=min(1,max(-1,W0)), m(x)=integral W(x,a) dnu(a), and qhat=q.tilted(m). First form G=(z->x0+sqrt(eta)*z)_*stdGaussian(E), then pi=G.tilted(-f). The mean m describes a law; the algorithm does not calculate that integral.
One attempt is (x,N,a,u), with independent laws q,Poisson(2),nu^Nat and uniform[0,1]. Accept when u<=product over i<N of (1+W(x,a_i))/2. The full attempt sequence has iid law rho. Output the x-coordinate of the least accepted index, or x0 if no index is accepted. C(omega) sums each batch size N_n whenever all earlier attempts failed, including the successful batch. The specified cached gradient count is G_cost=1+C: one initial evaluation of g and one new gradient evaluation in each W0 call. Random-number generation is not counted as a gradient query.

Actual output accuracy

\[I_{\pi\|\widehat\pi}=\int\left(\frac{d\pi}{d\widehat\pi}\right)^\ell d\widehat\pi,\quad I_{\widehat\pi\|\pi}=\int\left(\frac{d\widehat\pi}{d\pi}\right)^\ell d\pi,\quad 0<I_{\cdot\|\cdot}\le1+\varepsilon^2,\quad \frac{\log I_{\cdot\|\cdot}}{\ell-1}\le\varepsilon^2,\quad \widehat\pi=\widehat q.\]

Actual cached gradient costs

\[\mathbb E_\rho(1+C)\le1+2e^2,\quad \rho\{1+C>K_G\log(2/p)\}\le p,\quad K_G=2(e-1)(e^2+1/\log2)+1+1/\log2.\]

Read the formalized proofs

Each statement and proof below has its own closed Lean disclosure. ASTIS parents, Mathlib calls and external mathematical sources are distinguished in each proof.

ASTIS mathematical exposition

Actual terminal sampler accuracy and cached gradient costs

AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.TerminalSamplerAccuracyCost.terminal_sampler_accuracy_cost · theorem · Teaching coverage

Statement

All objects and hypotheses

E is a finite-dimensional real inner-product Borel space with d=finrank(E)>0. f:E->R is differentiable everywhere and its actual gradient is globally beta-Lipschitz. eta,beta>0, ell>=2 and 0<eps<=1/2. Convexity is not used in this fixed smooth dependency.
Given x0 and supplied x_plus, cache g=grad f(x_plus) and set h=x0-eta*g. Assume norm(h-x_plus)<=sqrt(d*eta). Let L=ell+log(1/eps), and assume 64*beta*(sqrt(d*L)+L)<=1/eta. The reference-point construction and its cost are outside this fixed-call input contract.
Let P=(z->sqrt(eta)*z)_*stdGaussian(E), nu=Lebesgue restricted to (0,1] product P, and q=(z->h+sqrt(eta)*z)_*stdGaussian(E). For theta=pi*r/2 define W0(x,r,z)=<(pi/2)*(cos(theta)*(x-h)-sin(theta)*z),g-grad f(h+sin(theta)*(x-h)+cos(theta)*z)>. Set W=min(1,max(-1,W0)), m(x)=integral W(x,a) dnu(a), and qhat=q.tilted(m). First form G=(z->x0+sqrt(eta)*z)_*stdGaussian(E), then pi=G.tilted(-f). The mean m describes a law; the algorithm does not calculate that integral.
One attempt is (x,N,a,u), with independent laws q,Poisson(2),nu^Nat and uniform[0,1]. Accept when u<=product over i<N of (1+W(x,a_i))/2. The full attempt sequence has iid law rho. Output the x-coordinate of the least accepted index, or x0 if no index is accepted. C(omega) sums each batch size N_n whenever all earlier attempts failed, including the successful batch. The specified cached gradient count is G_cost=1+C: one initial evaluation of g and one new gradient evaluation in each W0 call. Random-number generation is not counted as a gradient query.

Mathematical proof

1. Convert the explicit source step condition to the parent parameter bounds

Let a=beta*eta and L=ell+log(1/eps). Positivity of eps and eps<=1/2 give L>=ell>=2. Multiply the inverse-step inequality by positive eta to obtain 64a(sqrt(dL)+L)<=1. Squaring and dropping only nonnegative cross terms gives 4096a^2(dL+L^2)<=1. Since ell<=L, this implies the existing 64-step condition at B=1. Its two separate terms also bound the two positive denominators defining K; no inequality is squared or divided before its sign is established.

\[64\beta^2(\ell d+\ell^2)\le\eta^{-2},\qquad K=\min\!\left\{\frac1{40\beta^2d\eta^2},\frac1{8\beta\eta}\right\}\ge8L.\]

Corresponding Lean step

scaled_parameters; parameter_bounds; Real.sq_sqrt

2. Turn the actual exponential comparison into the requested accuracy

The parent comparison has error 2 exp(2-K) at B=1. Write t=log eps<=0, so log(1/eps)=-t. The preceding K bound, ell>=2 and log2<=1 imply log2+2-K<=2t. Exponentiation and exp(log eps)=eps prove the desired eps-squared bound, retaining the factor2. Consume the actual ClippedRenyiComparison theorem, whose laws are the clipped output tilt and the Gaussian pushforward followed by the potential tilt.

\[2e^{2-K}=e^{\log2+2-K}\le e^{2\log\varepsilon}=\varepsilon^2,\qquad I_{\pi\|\widehat\pi},I_{\widehat\pi\|\pi}\le1+\varepsilon^2.\]

Corresponding Lean step

accuracy_error; terminal_sampler_accuracy_cost; AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.ClippedRenyiComparison.clipped_renyi_comparison; Real.exp_log

3. Prove strict positivity before taking logarithms

For I(mu||nu), the actual reverse absolute continuity nu<<mu gives positivity of dmu/dnu nu-almost everywhere. Its nu-almost-everywhere finiteness is checked separately before conversion to real values. Every real power of a positive real is positive. Thus the support of the integrable RN-power function has the full probability mass of nu, proving I>0. Repeat with the two actual laws exchanged; no conclusion relies on toReal(infinity) or a totalized nonintegrable integral.

\[0<\frac{d\mu}{d\nu}<\infty\quad\nu\text{-a.e.},\qquad \nu\!\left(\operatorname{supp}((\operatorname{toReal}(d\mu/d\nu))^\ell)\right)=1,\qquad I_{\mu\|\nu}>0.\]

Corresponding Lean step

rn_moment_positive; MeasureTheory.Measure.rnDeriv_pos'; MeasureTheory.Measure.rnDeriv_ne_top; ENNReal.toReal_pos; MeasureTheory.integral_pos_iff_support_of_nonneg_ae

4. Obtain the explicit logarithmic RN-moment bound

For each positive actual moment I, apply log I<=I-1 and the previous moment upper bound. Since ell-1>=1 and eps^2>=0, division by the positive denominator yields log I/(ell-1)<=eps^2. The proof neither assumes a moment lower bound of one nor uses log at zero. These are the usual explicit expressions on this actual mutually absolutely continuous probability pair; a separate named divergence API is not claimed.

\[\log I\le I-1\le\varepsilon^2\le(\ell-1)\varepsilon^2,\qquad \frac{\log I}{\ell-1}\le\varepsilon^2.\]

Corresponding Lean step

logarithmic_accuracy; Real.log_le_sub_one_of_pos; terminal_sampler_accuracy_cost

5. Identify the actual cached-gradient probability program

Cache g once and use it both in the proposal center and in the actual arc estimator. Each attempt samples the proposal, Poisson count, independent auxiliary sequence and independent acceptance uniform. The product acceptance test uses only the first N auxiliary samples. The output is the first accepted proposal with a defined fallback. Match these concrete definitions with ClippedGradientProgram; its output measurability, exact pushforward and null never-accepted event transfer by definition equality. Product probability laws establish that the actual attempt sequence rho is a probability. No integral of m is performed by this algorithm.

\[\Lambda=q\otimes\operatorname{Poisson}(2)\otimes\nu^{\mathbb N}\otimes U_{[0,1]},\quad \rho=\Lambda^{\mathbb N},\quad \rho\circ\operatorname{out}^{-1}=q.\mathrm{tilted}(m)=\widehat\pi.\]

Corresponding Lean step

cachedEstimator; Attempt; attemptLaw; accepted; output; actual_program; AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.ClippedGradientProgram.clipped_gradient_program

6. Charge the cached gradient and every consumed batch

The full-batch estimator cost includes the successful batch: a batch is charged precisely when all earlier attempts failed. Each estimator call uses the already cached g and one new gradient evaluation at its arc point. Under this stated execution convention G_cost=1+C. Apply the parent actual full-batch expected-cost bound at B=1. Nonnegative integration adds the initial unit charge using rho being a probability; there is no transport of an unbounded cost from a nearby law.

\[C(\omega)=\sum_{n\ge0}N_n\mathbf1\{\text{all }i<n\text{ failed}\},\quad G_{\rm cost}=1+C,\quad \mathbb E_\rho G_{\rm cost}\le1+2e^2.\]

Corresponding Lean step

queryCount; cached_expected_cost; actual_program; MeasureTheory.lintegral_add_left

7. Reuse the same-program tail and absorb the initial charge

Instantiate PoissonQueryTail with a constant proposal kernel at the fixed input and the same clipped estimator. Its attempt law, acceptance event and total cost are definitionally the ones above. This gives the estimator tail with K1=2(e-1)(e^2+1/log2)+1. Since log(2/p)>=log2>0, the extra initial unit is bounded by log(2/p)/log2. A pointwise event inclusion transfers the tail to G_cost with K_G=K1+1/log2. This does not assume independence between stopping time and batch size, and does not inherit the unchecked external tail-constant substitution.

\[\rho\{C>K_1\log(2/p)\}\le p,\quad \{1+C>(K_1+1/\log2)\log(2/p)\}\subseteq\{C>K_1\log(2/p)\}.\]

Corresponding Lean step

cached_cost_tail; actual_program; AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.PoissonQueryTail.poisson_query_tail; ProbabilityTheory.Kernel.const

8. Return the actual fixed-call accuracy and cost contract

Assemble the actual output-law equality and probability/termination results with both RN-power integrability statements, strict moment positivity, two moment bounds, two logarithmic bounds, expected cached gradient cost and the universally quantified p-tail. These are eighteen public conjuncts. The internal K and step inequalities are proof dependencies, not extra public conclusions. The supplied-reference, positive-parameter and fixed-call scope stays explicit for the later recursive consumer.

\[\rho\{\text{never accepts}\}=0,\quad \frac{\log I_{\pi\|\widehat\pi}}{\ell-1},\frac{\log I_{\widehat\pi\|\pi}}{\ell-1}\le\varepsilon^2,\quad \rho\{G_{\rm cost}>K_G\log(2/p)\}\le p.\]

Corresponding Lean step

terminal_sampler_accuracy_cost; actual_program; logarithmic_accuracy

Lean statement · terminal_sampler_accuracy_cost

Eighteen actual output, probability, termination, RN L1/positivity/moment/log accuracy, expected cached gradient and universal p-tail conclusions.

theorem terminal_sampler_accuracy_cost (f : E → ℝ) (hf : Differentiable ℝ f)
    (eta beta ell eps : ℝ) (heta : 0 < eta) (hb : 0 < beta)
    (he : 2 ≤ ell) (hep : 0 < eps) (heps : eps ≤ 1/2)
    (hd : 0 < (Module.finrank ℝ E : ℝ))
    (hlip : LipschitzWith ⟨beta,hb.le⟩ (gradient f)) (x0 xp : E)
    (hcenter : ‖(x0-eta • gradient f xp)-xp‖ ≤ Real.sqrt ((Module.finrank ℝ E : ℝ)*eta))
    (hstep : 64*beta*(Real.sqrt ((Module.finrank ℝ E : ℝ)*(ell+Real.log (1/eps)))+
      (ell+Real.log (1/eps))) ≤ 1/eta) :
    let g := gradient f xp
    let h := x0-eta • g
    let P := (stdGaussian E).map (fun z => Real.sqrt eta • z)
    let nu := (volume.restrict (Set.Ioc (0 : ℝ) 1)).prod P
    let q := (stdGaussian E).map (fun z => h+Real.sqrt eta • z)
    let W := fun p => min 1 (max (-1) (cachedEstimator f h g p))
    let m := fun x => ∫ z, W (x,z) ∂nu
    let rho := Measure.infinitePi (fun _ : ℕ => attemptLaw q nu 1 (by norm_num))
    let qhat := q.tilted m
    let pi := ((stdGaussian E).map (fun z => x0+Real.sqrt eta • z)).tilted (fun x => -f x)
    Measurable (output W 1 x0) ∧ rho.map (output W 1 x0) = qhat ∧
      rho {omega | ∀ n, omega n ∉ accepted W 1} = 0 ∧
      IsProbabilityMeasure rho ∧ IsProbabilityMeasure qhat ∧ IsProbabilityMeasure pi ∧
      pi ≪ qhat ∧ qhat ≪ pi ∧
      Integrable (fun x => (pi.rnDeriv qhat x).toReal^ell) qhat ∧
      Integrable (fun x => (qhat.rnDeriv pi x).toReal^ell) pi ∧
      0 < (∫ x, (pi.rnDeriv qhat x).toReal^ell ∂qhat) ∧
      0 < (∫ x, (qhat.rnDeriv pi x).toReal^ell ∂pi) ∧
      (∫ x, (pi.rnDeriv qhat x).toReal^ell ∂qhat) ≤ 1+eps^2 ∧
      (∫ x, (qhat.rnDeriv pi x).toReal^ell ∂pi) ≤ 1+eps^2 ∧
      Real.log (∫ x, (pi.rnDeriv qhat x).toReal^ell ∂qhat)/(ell-1) ≤ eps^2 ∧
      Real.log (∫ x, (qhat.rnDeriv pi x).toReal^ell ∂pi)/(ell-1) ≤ eps^2 ∧
      (∫⁻ omega, 1+queryCount W 1 omega ∂rho) ≤ ENNReal.ofReal (1+2*Real.exp 2) ∧
      ∀ p : ℝ, 0 < p → p ≤ 1/2 →
        rho {omega | ENNReal.ofReal
          ((2*(Real.exp 1-1)*(Real.exp 2+1/Real.log 2)+1+1/Real.log 2)*
            Real.log (2/p)) < 1+queryCount W 1 omega} ≤ ENNReal.ofReal p

Exact module and namespace context

Lean proof · terminal_sampler_accuracy_cost

Explicit parameter algebra, actual RN positivity before log, identical first-success probability program, actual cached count, and independently proved same-program Poisson tail.

theorem terminal_sampler_accuracy_cost (f : E → ℝ) (hf : Differentiable ℝ f)
    (eta beta ell eps : ℝ) (heta : 0 < eta) (hb : 0 < beta)
    (he : 2 ≤ ell) (hep : 0 < eps) (heps : eps ≤ 1/2)
    (hd : 0 < (Module.finrank ℝ E : ℝ))
    (hlip : LipschitzWith ⟨beta,hb.le⟩ (gradient f)) (x0 xp : E)
    (hcenter : ‖(x0-eta • gradient f xp)-xp‖ ≤ Real.sqrt ((Module.finrank ℝ E : ℝ)*eta))
    (hstep : 64*beta*(Real.sqrt ((Module.finrank ℝ E : ℝ)*(ell+Real.log (1/eps)))+
      (ell+Real.log (1/eps))) ≤ 1/eta) :
    let g := gradient f xp
    let h := x0-eta • g
    let P := (stdGaussian E).map (fun z => Real.sqrt eta • z)
    let nu := (volume.restrict (Set.Ioc (0 : ℝ) 1)).prod P
    let q := (stdGaussian E).map (fun z => h+Real.sqrt eta • z)
    let W := fun p => min 1 (max (-1) (cachedEstimator f h g p))
    let m := fun x => ∫ z, W (x,z) ∂nu
    let rho := Measure.infinitePi (fun _ : ℕ => attemptLaw q nu 1 (by norm_num))
    let qhat := q.tilted m
    let pi := ((stdGaussian E).map (fun z => x0+Real.sqrt eta • z)).tilted (fun x => -f x)
    Measurable (output W 1 x0) ∧ rho.map (output W 1 x0) = qhat ∧
      rho {omega | ∀ n, omega n ∉ accepted W 1} = 0 ∧
      IsProbabilityMeasure rho ∧ IsProbabilityMeasure qhat ∧ IsProbabilityMeasure pi ∧
      pi ≪ qhat ∧ qhat ≪ pi ∧
      Integrable (fun x => (pi.rnDeriv qhat x).toReal^ell) qhat ∧
      Integrable (fun x => (qhat.rnDeriv pi x).toReal^ell) pi ∧
      0 < (∫ x, (pi.rnDeriv qhat x).toReal^ell ∂qhat) ∧
      0 < (∫ x, (qhat.rnDeriv pi x).toReal^ell ∂pi) ∧
      (∫ x, (pi.rnDeriv qhat x).toReal^ell ∂qhat) ≤ 1+eps^2 ∧
      (∫ x, (qhat.rnDeriv pi x).toReal^ell ∂pi) ≤ 1+eps^2 ∧
      Real.log (∫ x, (pi.rnDeriv qhat x).toReal^ell ∂qhat)/(ell-1) ≤ eps^2 ∧
      Real.log (∫ x, (qhat.rnDeriv pi x).toReal^ell ∂pi)/(ell-1) ≤ eps^2 ∧
      (∫⁻ omega, 1+queryCount W 1 omega ∂rho) ≤ ENNReal.ofReal (1+2*Real.exp 2) ∧
      ∀ p : ℝ, 0 < p → p ≤ 1/2 →
        rho {omega | ENNReal.ofReal
          ((2*(Real.exp 1-1)*(Real.exp 2+1/Real.log 2)+1+1/Real.log 2)*
            Real.log (2/p)) < 1+queryCount W 1 omega} ≤ ENNReal.ofReal p := by
  let g := gradient f xp
  let h := x0-eta • g
  let P := (stdGaussian E).map (fun z => Real.sqrt eta • z)
  let nu := (volume.restrict (Set.Ioc (0 : ℝ) 1)).prod P
  let q := (stdGaussian E).map (fun z => h+Real.sqrt eta • z)
  let W := fun p => min 1 (max (-1) (cachedEstimator f h g p))
  let m := fun x => ∫ z, W (x,z) ∂nu
  let rho := Measure.infinitePi (fun _ : ℕ => attemptLaw q nu 1 (by norm_num))
  let qhat := q.tilted m
  let pi := ((stdGaussian E).map (fun z => x0+Real.sqrt eta • z)).tilted (fun x => -f x)
  let K := min (1/(40*beta^2*(Module.finrank ℝ E : ℝ)*eta^2)) (1/(8*beta*eta))
  obtain ⟨hs,hK⟩ := parameter_bounds eta beta _ ell eps heta hb hd he hep heps hstep
  have herr := accuracy_error ell eps K he hep heps hK
  have hc := AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.ClippedRenyiComparison.clipped_renyi_comparison
    f hf eta beta 1 ell heta hb (by norm_num) he hd hlip x0 xp hcenter
    (by simpa only [div_one] using hs)
  rcases hc with ⟨hpi,hqh,hpq,hqp,hfi,hri,hfb,hrb,_,_⟩
  have : IsProbabilityMeasure pi := hpi
  have : IsProbabilityMeasure qhat := hqh
  have hfi' : Integrable (fun x => (pi.rnDeriv qhat x).toReal^ell) qhat := hfi
  have hri' : Integrable (fun x => (qhat.rnDeriv pi x).toReal^ell) pi := hri
  have hfb' : (∫ x, (pi.rnDeriv qhat x).toReal^ell ∂qhat)-1 ≤ 2*Real.exp (2-K) := by
    change (∫ x, (pi.rnDeriv qhat x).toReal^ell ∂qhat)-1 ≤
      2*Real.exp (2*1-min (1^2/(40*beta^2*(Module.finrank ℝ E : ℝ)*eta^2)) (1/(8*beta*eta))) at hfb
    simpa only [one_pow,mul_one] using hfb
  have hrb' : (∫ x, (qhat.rnDeriv pi x).toReal^ell ∂pi)-1 ≤ 2*Real.exp (2-K) := by
    change (∫ x, (qhat.rnDeriv pi x).toReal^ell ∂pi)-1 ≤
      2*Real.exp (2*1-min (1^2/(40*beta^2*(Module.finrank ℝ E : ℝ)*eta^2)) (1/(8*beta*eta))) at hrb
    simpa only [one_pow,mul_one] using hrb
  have hfbound : (∫ x, (pi.rnDeriv qhat x).toReal^ell ∂qhat) ≤ 1+eps^2 := by linarith
  have hrbound : (∫ x, (qhat.rnDeriv pi x).toReal^ell ∂pi) ≤ 1+eps^2 := by linarith
  obtain ⟨hfp,hfl⟩ := logarithmic_accuracy pi qhat hqp ell eps he hfi' hfbound
  obtain ⟨hrp,hrl⟩ := logarithmic_accuracy qhat pi hpq ell eps he hri' hrbound
  obtain ⟨hprob,ho,hlaw,hnever,hcost,htail⟩ := actual_program f hf eta beta heta hb hlip x0 xp
  exact ⟨ho,hlaw,hnever,hprob,hqh,hpi,hpq,hqp,hfi',hri',hfp,hrp,hfbound,hrbound,hfl,hrl,hcost,htail⟩

end AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.TerminalSamplerAccuracyCost

Exact module and namespace context

Source assumptions versus formal assumptions

Source	Actual Lean	Difference kind	Why it matters
A.4(2) is stated in Euclidean space.	Finite-dimensional real inner-product Borel space.	generalization	Coordinate-free formulation; positive dimension remains explicit.
The terminal application is described for smooth convex potentials.	No convexity; actual differentiability and Lipschitz gradient are assumed.	generalization	The D.1 smooth fixed-call proof does not use convexity; this broadens the fixed-call conclusion beyond the A.4 application context.
The paper statement does not isolate beta=0 or zero-dimensional cases.	beta>0 and d>0 are explicit.	API-limitation	This packet uses the positive-denominator parent bounds. Degenerate branches remain unproved here; no claim of equivalence to every source domain.
A.4(2) uses a universal step constant and O(1)/O(log(2/p)) costs.	Explicit inverse-step constant64, B=1, expected cost1+2exp2 and displayed K_G.	source-implicit	The numerical implications and constants are proved; the actual cached count includes the initial gradient and successful full batch.
B.12/D.1 uses denominator-measure powers; B.7/section1.3 definitions have inconsistent printed subscripts/powers.	Two explicit denominator-measure RN ell-power logarithmic expressions with true L1 and positive integrals.	source-implicit	Follows the actual B.12/D.1 use; no author-confirmed erratum or complete named Renyi API is claimed. ell>=2 does not claim to repair B.12 below2.
D.1 samples a uniform auxiliary time and queries a stochastic gradient estimator.	Actual Ioc uniform time product, cached g, one new gradient per estimator, full-batch C and cost1+C.	source-implicit	Null endpoints preserve the uniform law. The specified probability-program count is not a compiler/evaluator or hardware-trace certificate.
D.1 cites a rejection-query tail proof whose last constant substitution is not directly justified.	Instantiate the independently proved local PoissonQueryTail on the identical law/event/cost and absorb the cached unit.	source-implicit	No stopping/batch-size independence is assumed, and no claim repairs the entire external printed theorem.
A.4(2) receives a reference point satisfying the stated residual bound and feeds larger algorithms.	Supplied xp and its single cached gradient evaluation; actual fixed-input program, both accuracy directions, expected/tail cost.	same	Finding xp, joint parameter kernel and outer recursion are not asserted; no full-paper or composition completion follows.

Eighteen public conjuncts bind the actual first-success probability program to both accuracy directions and the specified cached gradient count. This is a probability program with an explicit cost random variable, not a formally verified compiler, evaluator or hardware trace. The supplied reference point is not constructed and finding it is not charged; its one cached gradient evaluation is charged. Positive beta and dimension are retained; zero-beta/zero-dimensional cases remain separate. The explicit logarithmic RN expressions are proved, but no complete named Renyi API is asserted. The chosen denominator-measure powers follow B.12/D.1 despite inconsistent printed B.7/section1.3 notation. The below-order-two B.12 intermediate proof gap and the external tail proof final constant substitution are not silently imported or claimed repaired. The tail uses the independently proved local PoissonQueryTail on the same actual law/event/cost. No joint input-parameter kernel, outer recursion, initialization construction, PBPS composition or complete paper result is asserted; no unbounded cost is transferred by TV or Renyi closeness.

Encoder–denoiser: accepted · domain-mismatch

Detected semantic differences

domains: Coordinate-free finite-dimensional positive-dimensional formulation. — Independent reviewer accepted: Coordinate-free finite-dimensional positive-dimensional formulation.
assumptions: Relative toA4 convexsetting;D1 convexitynotinvented. — Independent reviewer accepted: Relative toA4 convexsetting;D1 convexitynotinvented.
domains: Positivebeta/dimensionexplicit;degeneratebranchesoutside. — Independent reviewer accepted: Positivebeta/dimensionexplicit;degeneratebranchesoutside.
constant_dependencies: Explicit sufficientconstantsandcachedcountderived,notattributedasprintednumbers. — Independent reviewer accepted: Explicit sufficientconstantsandcachedcountderived,notattributedasprintednumbers.
objects: Actual denominatorpowersfollowB12/D1;printednotationdisclosed,noerratum/below2repairclaim. — Independent reviewer accepted: Actual denominatorpowersfollowB12/D1;printednotationdisclosed,noerratum/below2repairclaim.
objects: Nulluniformendpointdifference;cachedcallingconvention/fullbatchcountnotcompilerorhardwareverification. — Independent reviewer accepted: Nulluniformendpointdifference;cachedcallingconvention/fullbatchcountnotcompilerorhardwareverification.
scopes: Local provedtailinstead of unjustifiedexternalsubstitution;notentireexternalthmrepair. — Independent reviewer accepted: Local provedtailinstead of unjustifiedexternalsubstitution;notentireexternalthmrepair.
scopes: xp supplied;cachedgradientcharged,findingxpexcluded;recursionseparate. — Independent reviewer accepted: xp supplied;cachedgradientcharged,findingxpexcluded;recursionseparate.

A generalization is not a source correction. Proposed missing conditions require separate independent repair review. No proposed repair silently changes the original theorem.

Scope and omitted-condition boundaries

Eighteen public conjuncts bind the actual first-success probability program to both accuracy directions and the specified cached gradient count. This is a probability program with an explicit cost random variable, not a formally verified compiler, evaluator or hardware trace. The supplied reference point is not constructed and finding it is not charged; its one cached gradient evaluation is charged. Positive beta and dimension are retained; zero-beta/zero-dimensional cases remain separate. The explicit logarithmic RN expressions are proved, but no complete named Renyi API is asserted. The chosen denominator-measure powers follow B.12/D.1 despite inconsistent printed B.7/section1.3 notation. The below-order-two B.12 intermediate proof gap and the external tail proof final constant substitution are not silently imported or claimed repaired. The tail uses the independently proved local PoissonQueryTail on the same actual law/event/cost. No joint input-parameter kernel, outer recursion, initialization construction, PBPS composition or complete paper result is asserted; no unbounded cost is transferred by TV or Renyi closeness.

Source and reuse

ASTIS parents called

Mathlib API called (external library)

MeasureTheory.Measure.rnDeriv_pos'
MeasureTheory.Measure.rnDeriv_ne_top
MeasureTheory.integral_pos_iff_support_of_nonneg_ae
Real.log_le_sub_one_of_pos
MeasureTheory.lintegral_add_left

Mathematical sources

SPHMC Theorem A.4(2) — Fixed-call terminal sampler accuracy and gradient cost; supplied reference.
Smooth D.1, B.12 and Appendix C — Actual smooth estimator and normalized comparison; source discrepancies disclosed.

ASTIS prose is not a quotation or a source-equivalence certificate. Definitions and aliases are explained as constructions, not counted as new mathematical proofs.

Which proof edges are actually covered?

Local proof component; source adapter/review separate Actual terminal output accuracy and cached gradient expected/tail costs

A continuous transport cost attains its infimum

Fan Chen, Sinho Chewi, Jianfeng Lu and Matthew S. Zhang; ASTIS expanded proof, no author endorsement implied.

arXiv:2609.06906v1 · Lemma6.2 optimal coupling prerequisite · faithful paraphrase

Complete source statement (ASTIS restatement)

SPHMC Lemma6.2 chooses an optimal coupling for the pth displacement cost. The expanded ASTIS prerequisite proves the required existence in a generic form: probabilities on complete second-countable metric Borel spaces and a continuous finite nonnegative cost admit a true minimizing coupling, with the minimum allowed to be infinite. No finite-moment or optimizer assumption is made.

E,F are complete second-countable metric spaces with their Borel sigma algebras.
P,Q are probability measures and c:E times F to nonnegative reals is continuous.
This is a generic expanded prerequisite to the optimal coupling chosen in Lemma6.2, not an additional hypothesis of that lemma.

Optimal cost

\[\exists\gamma\in\Pi(P,Q),\qquad\int c\,d\gamma=\inf_{\rho\in\Pi(P,Q)}\int c\,d\rho.\]

Read the formalized proofs

Each statement and proof below has its own closed Lean disclosure. ASTIS parents, Mathlib calls and external mathematical sources are distinguished in each proof.

ASTIS mathematical exposition

A continuous transport cost attains its infimum

AutoSamplingTheory.TechnicalLemmas.Measure.OptimalContinuousCost.exists_optimal_coupling · theorem · Teaching coverage

Statement

For probability measures P,Q on complete second-countable metric Borel spaces E,F and any continuous nonnegative real cost c on E times F, there is an actual probability coupling gamma whose extended nonnegative integral of c equals the infimum over all couplings. The value may be infinite; neither a moment bound nor an optimizer is assumed.

\[\exists\gamma\in\Pi(P,Q),\qquad\int c\,d\gamma=\inf_{\rho\in\Pi(P,Q)}\int c\,d\rho.\]

All objects and hypotheses

E,F are complete second-countable metric spaces with their Borel sigma algebras.
P,Q are probability measures and c:E times F to nonnegative reals is continuous.
This is a generic expanded prerequisite to the optimal coupling chosen in Lemma6.2, not an additional hypothesis of that lemma.

Mathematical proof

1. Use a genuine nonempty coupling space

Package P and Q as probability measures. Their product is a coupling, so the space of probability couplings is nonempty.

\[P\otimes Q\in\Pi(P,Q).\]

Corresponding Lean step

Transport.isCoupling_prod and isProbabilityCoupling_iff_isCoupling_toMeasure.

2. Apply existing weak compactness and lower semicontinuity

The existing ASTIS compactness theorem makes the coupling space compact in the weak topology. Its continuous-cost lower semicontinuity theorem applies to the extended integral, without a bounded cost or finite moment restriction.

\[\Pi(P,Q)\text{ compact},\qquad\gamma\mapsto\int c\,d\gamma\text{ lower semicontinuous}.\]

Corresponding Lean step

isCompact_probabilityCouplingSet and lowerSemicontinuous_lintegral_continuous_nnreal.

3. Take the compact minimum

A lower-semicontinuous function into the ordered extended nonnegative reals attains a minimum on a nonempty compact set. Recover an actual raw measure gamma and its two marginals.

\[\int c\,d\gamma\le\int c\,d\rho\quad(\rho\in\Pi(P,Q)).\]

Corresponding Lean step

LowerSemicontinuousOn.exists_isMinOn supplies gamma and hmin.

4. Identify the original infimum over raw couplings

Every raw coupling is a probability because its first marginal is P. It therefore belongs to the compact probability-coupling set, so minimality gives the lower bound against every element in the transportCost infimum. Membership gives the reverse inequality.

\[\int c\,d\gamma=\operatorname{transportCost}(c,P,Q).\]

Corresponding Lean step

transportCost_eq_sInf, le_sInf and transportCost_le_lintegral_of_isCoupling.

Lean statement · exists_optimal_coupling

A genuine probability coupling attaining the extended integral infimum for a continuous NNReal cost.

theorem exists_optimal_coupling {E F : Type*}
    [MetricSpace E] [CompleteSpace E] [SecondCountableTopology E]
    [MeasurableSpace E] [BorelSpace E]
    [MetricSpace F] [CompleteSpace F] [SecondCountableTopology F]
    [MeasurableSpace F] [BorelSpace F]
    (μ : Measure E) (ν : Measure F) [IsProbabilityMeasure μ] [IsProbabilityMeasure ν]
    (c : E × F → ℝ≥0) (hc : Continuous c) :
    ∃ γ : Measure (E × F), IsProbabilityMeasure γ ∧ Transport.IsCoupling γ μ ν ∧
      (∫⁻ z, (c z : ℝ≥0∞) ∂γ) = Transport.transportCost (fun z => (c z : ℝ≥0∞)) μ ν

Exact module and namespace context

Lean proof · exists_optimal_coupling

Compact minimum with explicit conversion between probability couplings and raw measure couplings.

theorem exists_optimal_coupling {E F : Type*}
    [MetricSpace E] [CompleteSpace E] [SecondCountableTopology E]
    [MeasurableSpace E] [BorelSpace E]
    [MetricSpace F] [CompleteSpace F] [SecondCountableTopology F]
    [MeasurableSpace F] [BorelSpace F]
    (μ : Measure E) (ν : Measure F) [IsProbabilityMeasure μ] [IsProbabilityMeasure ν]
    (c : E × F → ℝ≥0) (hc : Continuous c) :
    ∃ γ : Measure (E × F), IsProbabilityMeasure γ ∧ Transport.IsCoupling γ μ ν ∧
      (∫⁻ z, (c z : ℝ≥0∞) ∂γ) = Transport.transportCost (fun z => (c z : ℝ≥0∞)) μ ν := by
  let P : ProbabilityMeasure E := ⟨μ,inferInstance⟩
  let Q : ProbabilityMeasure F := ⟨ν,inferInstance⟩
  have hn : (probabilityCouplingSet P Q).Nonempty := by
    refine ⟨⟨μ.prod ν,inferInstance⟩, ?_⟩
    exact isProbabilityCoupling_iff_isCoupling_toMeasure.mpr (Transport.isCoupling_prod μ ν)
  have hcompact := isCompact_probabilityCouplingSet P Q
  have hlsc := ContinuousCostWeakLowerSemicontinuity.lowerSemicontinuous_lintegral_continuous_nnreal c hc
  obtain ⟨γ,hγ,hmin⟩ := LowerSemicontinuousOn.exists_isMinOn hn hcompact (hlsc.lowerSemicontinuousOn _)
  have hγ' : Transport.IsCoupling (γ : Measure (E × F)) μ ν :=
    isProbabilityCoupling_iff_isCoupling_toMeasure.mp hγ
  refine ⟨γ,inferInstance,hγ',le_antisymm ?_ ?_⟩
  · rw [Transport.transportCost_eq_sInf]
    apply le_sInf
    rintro r ⟨ρ,hρ,rfl⟩
    let : IsProbabilityMeasure ρ := Transport.isProbabilityMeasure_of_isCoupling_left hρ
    let R : ProbabilityMeasure (E × F) := ⟨ρ,inferInstance⟩
    have hR : IsProbabilityCoupling R P Q := isProbabilityCoupling_iff_isCoupling_toMeasure.mpr hρ
    exact hmin hR
  · exact Transport.transportCost_le_lintegral_of_isCoupling _ μ ν γ hγ'

end AutoSamplingTheory.TechnicalLemmas.Measure.OptimalContinuousCost

Exact module and namespace context

Source assumptions versus formal assumptions

Source	Actual Lean	Difference kind	Why it matters
Lemma6.2 invokes an optimal coupling for Euclidean p-distance cost.	Continuous nonnegative costs on complete second-countable metric Borel spaces, minimum possibly infinite.	generalization	Expanded optimizer prerequisite with one actual paper consumer; no assertion this generic statement is printed in the source.

Actual infimum p-cost and bounded-displacement coupling certificate for Lemma6.2; no full Wp/Winfinity metric API, Gaussian reverse transport, Renyi/proxy-warmness, sampler construction, error/cost propagation or full-paper conclusion.

Encoder–denoiser: accepted · domain-mismatch

Detected semantic differences

domains: Generic two-space metric setting extends Euclidean source. — No vector structure or finite dimension; explicit generic expanded prerequisite.
objects: Arbitrary continuous nonnegative costs and potentially infinite optimum extend finite p-distance application. — Arbitrary continuous NNReal cost; actual p-distance consumer is truncated_proxy.

A generalization is not a source correction. Proposed missing conditions require separate independent repair review. No proposed repair silently changes the original theorem.

Scope and omitted-condition boundaries

Actual infimum p-cost and bounded-displacement coupling certificate for Lemma6.2; no full Wp/Winfinity metric API, Gaussian reverse transport, Renyi/proxy-warmness, sampler construction, error/cost propagation or full-paper conclusion.

Source and reuse

ASTIS parents called

Mathlib API called (external library)

LowerSemicontinuousOn.exists_isMinOn

Mathematical sources

Chen, Chewi, Lu and Zhang, SPHMC v1 Lemma 6.2 — Optimal-coupling existence expanded and actual truncation construction.

ASTIS prose is not a quotation or a source-equivalence certificate. Definitions and aliases are explained as constructions, not counted as new mathematical proofs.

Which proof edges are actually covered?

TODO — not closed by these contributions Actual optimal coupling with no optimizer premise

The actual SPHMC truncation proxy from an infimum p-cost budget

Fan Chen, Sinho Chewi, Jianfeng Lu and Matthew S. Zhang; ASTIS expanded proof, no author endorsement implied.

arXiv:2609.06906v1 · Lemma6.2 statement and proof · faithful paraphrase

Complete source statement (ASTIS restatement)

SPHMC v1 Lemma6.2: probabilities P,Q with Wp(P,Q)<=r, real p>=2 and 0<delta<1 admit a proxy Pdag with TV(P,Pdag)<=delta and Winfinity(Pdag,Q)<=r delta^(-1/p). Its proof chooses an optimal coupling and replaces its first coordinate by the second when distance exceeds the threshold. The selected Lean contract expands this as actual infimum p-cost<=r^p, r>=0, and proves a measurable explicit proxy plus a true bounded-displacement coupling and uniform measurable-event TV inequalities. This records the cost/coupling content without a complete Wp/Winfinity metric API. Complete second-countable normed Borel additive groups explicitly generalize the Euclidean source domain; the zero-radius case is included.

P,Q are probability measures, p is real with p>=2, r>=0 and 0<delta<1.
The input budget is the true infimum p-cost<=r^p, not the cost of an assumed coupling.
Complete second-countable normed Borel additive groups explicitly generalize the source Euclidean domain.
No separate marginal moment, finite coupling moment or optimal-coupling assumption is added. The output is a real coupling certificate, without introducing full Wasserstein metric APIs.

Truncated proxy

\[t=r\delta^{-1/p},\quad T(x,y)=\begin{cases}x&\|x-y\|\le t,\\y&\|x-y\|>t,\end{cases}\quad\sup_B|P(B)-P^\dagger(B)|\le\delta,\quad\Gamma\{\|a-b\|\le t\}=1.\]

Read the formalized proofs

Each statement and proof below has its own closed Lean disclosure. ASTIS parents, Mathlib calls and external mathematical sources are distinguished in each proof.

ASTIS mathematical exposition

The actual SPHMC truncation proxy from an infimum p-cost budget

AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.Truncation.truncated_proxy · theorem · Teaching coverage

Statement

Let P,Q be probabilities on a complete second-countable normed Borel additive group, p>=2, r>=0 and 0<delta<1. If the infimum over couplings of the integral of norm(x-y)^p is at most r^p, there exists an actual optimal probability coupling gamma. Set t=r delta^(-1/p) and T(x,y)=x when norm(x-y)<=t, otherwise y. Then T is measurable, Pdag=gamma.map(T) is a probability, and Gamma=gamma.map((T(x,y),y)) is a probability coupling of Pdag,Q concentrated on norm(a-b)<=t. Every measurable event B satisfies abs(P(B)-Pdag(B))<=delta.

\[t=r\delta^{-1/p},\quad T(x,y)=\begin{cases}x&\|x-y\|\le t,\\y&\|x-y\|>t,\end{cases}\quad\sup_B|P(B)-P^\dagger(B)|\le\delta,\quad\Gamma\{\|a-b\|\le t\}=1.\]

All objects and hypotheses

P,Q are probability measures, p is real with p>=2, r>=0 and 0<delta<1.
The input budget is the true infimum p-cost<=r^p, not the cost of an assumed coupling.
Complete second-countable normed Borel additive groups explicitly generalize the source Euclidean domain.
No separate marginal moment, finite coupling moment or optimal-coupling assumption is added. The output is a real coupling certificate, without introducing full Wasserstein metric APIs.

Mathematical proof

1. Produce an optimal coupling and derive integrability

Apply the shared optimizer to the continuous nonnegative cost norm(x-y)^p. Its exact optimum is bounded by r^p, hence finite. Nonnegativity and measurability then yield actual Bochner integrability and the real moment budget.

\[\int\|x-y\|^p\,d\gamma=\inf_{\rho\in\Pi(P,Q)}\int\|x-y\|^p\,d\rho\le r^p.\]

Corresponding Lean step

exists_optimal_coupling, lintegral_ofReal_ne_top_iff_integrable, integral_eq_lintegral_of_nonneg_ae and ENNReal.toReal_mono.

2. Build the measurable truncation and its two actual marginals

The good event norm(x-y)<=t is measurable, so the piecewise projection T is measurable. Push forward gamma by T and by (T,y). Composition of measurable maps gives the first marginal Pdag and second marginal Q.

\[P^\dagger=T_\#\gamma,\qquad\Gamma=(T,\operatorname{snd})_\#\gamma\in\Pi(P^\dagger,Q).\]

Corresponding Lean step

Local truncation_coupling proves Measurable.ite, map probabilities and both map_map marginal identities.

3. Prove bounded displacement and eventwise total variation

On the good event the new first coordinate is x and has distance at most t from y; on the bad event it equals y. For any event B, each of its x and T preimages lies in the other preimage union the bad event, giving both signed probability inequalities.

\[\|T(x,y)-y\|\le t,\qquad|P(B)-P^\dagger(B)|\le\gamma\{\|x-y\|>t\}.\]

Corresponding Lean step

ae_map_iff transfers the pointwise bound; measureReal_mono and measureReal_union_le prove both sides of abs_le.

4. Handle zero radius without division

If r=0, the nonnegative integrable p-cost has integral zero. It is zero almost everywhere, and p>=2 implies norm(x-y)=0 almost everywhere. Thus the bad event at threshold zero has probability zero.

\[r=0\Longrightarrow\|x-y\|^p=0\ \gamma\text{-a.e.}\Longrightarrow\gamma\{\|x-y\|>0\}=0.\]

Corresponding Lean step

integral_eq_zero_iff_of_nonneg_ae, Real.rpow_eq_zero_iff_of_nonneg and measure_eq_zero_iff_ae_notMem.

5. Apply Markov with the exact positive-radius power

For r>0, t>0 and t^p=r^p/delta. Monotonicity of the real pth power embeds the bad event in the p-cost threshold event. Markov and the derived moment budget show bad probability<=delta.

\[\gamma\{\|x-y\|>t\}\le\frac{\int\|x-y\|^p\,d\gamma}{t^p}\le\delta,\qquad t^p=r^p/\delta.\]

Corresponding Lean step

mul_meas_ge_le_integral_of_nonneg, Real.rpow_le_rpow, Real.mul_rpow, Real.rpow_mul and positive cancellation.

6. Return the same coupling and proxy

Retain the actual optimizer, its optimality equality, the explicit T, both probability witnesses, coupling marginals, almost-everywhere bound and the uniform event inequality. The source Lemma6.3(ii) reverse-transport argument remains a later consumer.

\[\sup_B|P(B)-P^\dagger(B)|\le\delta,\qquad\|a-b\|\le r\delta^{-1/p}\quad\Gamma\text{-a.e.}\]

Corresponding Lean step

The final tuple combines hopt with the local moment_proxy certificate and rewrites the original gamma marginals to P,Q.

Lean statement · truncated_proxy

An actual optimal coupling and an explicit pushforward proxy with eventwise TV and bounded-displacement coupling guarantees at the exact radius.

theorem truncated_proxy {E : Type*} [NormedAddCommGroup E] [CompleteSpace E]
    [SecondCountableTopology E] [MeasurableSpace E] [BorelSpace E]
    (P Q : Measure E) [IsProbabilityMeasure P] [IsProbabilityMeasure Q]
    (p r δ : ℝ) (hp : 2 ≤ p) (hr : 0 ≤ r) (hδ : 0 < δ) (hδ1 : δ < 1)
    (hcost : Transport.transportCost (fun z : E × E => ENNReal.ofReal (‖z.1-z.2‖ ^ p)) P Q ≤ ENNReal.ofReal (r ^ p)) :
    ∃ γ : Measure (E × E), IsProbabilityMeasure γ ∧ Transport.IsCoupling γ P Q ∧
      (∫⁻ z, ENNReal.ofReal (‖z.1-z.2‖ ^ p) ∂γ) =
        Transport.transportCost (fun z => ENNReal.ofReal (‖z.1-z.2‖ ^ p)) P Q ∧
      let t := r * δ ^ (-1 / p)
      let T := fun z : E × E => if ‖z.1-z.2‖ ≤ t then z.1 else z.2
      Measurable T ∧ IsProbabilityMeasure (γ.map T) ∧
        IsProbabilityMeasure (γ.map (fun z => (T z,z.2))) ∧
        Transport.IsCoupling (γ.map (fun z => (T z,z.2))) (γ.map T) Q ∧
        (∀ᵐ z ∂(γ.map (fun z => (T z,z.2))), ‖z.1-z.2‖ ≤ t) ∧
        ∀ B, MeasurableSet B → |P.real B - (γ.map T).real B| ≤ δ

Exact module and namespace context

Lean proof · truncated_proxy

All measurable truncation and moment-tail helpers are local in the substantive public theorem; optimizer is the shared public dependency.

theorem truncated_proxy {E : Type*} [NormedAddCommGroup E] [CompleteSpace E]
    [SecondCountableTopology E] [MeasurableSpace E] [BorelSpace E]
    (P Q : Measure E) [IsProbabilityMeasure P] [IsProbabilityMeasure Q]
    (p r δ : ℝ) (hp : 2 ≤ p) (hr : 0 ≤ r) (hδ : 0 < δ) (hδ1 : δ < 1)
    (hcost : Transport.transportCost (fun z : E × E => ENNReal.ofReal (‖z.1-z.2‖ ^ p)) P Q ≤ ENNReal.ofReal (r ^ p)) :
    ∃ γ : Measure (E × E), IsProbabilityMeasure γ ∧ Transport.IsCoupling γ P Q ∧
      (∫⁻ z, ENNReal.ofReal (‖z.1-z.2‖ ^ p) ∂γ) =
        Transport.transportCost (fun z => ENNReal.ofReal (‖z.1-z.2‖ ^ p)) P Q ∧
      let t := r * δ ^ (-1 / p)
      let T := fun z : E × E => if ‖z.1-z.2‖ ≤ t then z.1 else z.2
      Measurable T ∧ IsProbabilityMeasure (γ.map T) ∧
        IsProbabilityMeasure (γ.map (fun z => (T z,z.2))) ∧
        Transport.IsCoupling (γ.map (fun z => (T z,z.2))) (γ.map T) Q ∧
        (∀ᵐ z ∂(γ.map (fun z => (T z,z.2))), ‖z.1-z.2‖ ≤ t) ∧
        ∀ B, MeasurableSet B → |P.real B - (γ.map T).real B| ≤ δ := by
  have truncation_coupling
      (γ : Measure (E × E)) [IsProbabilityMeasure γ] (t : ℝ) (ht : 0 ≤ t) :
      let T := fun z : E × E => if ‖z.1-z.2‖ ≤ t then z.1 else z.2
      Measurable T ∧ IsProbabilityMeasure (γ.map T) ∧
        IsProbabilityMeasure (γ.map (fun z => (T z,z.2))) ∧
        Transport.IsCoupling (γ.map (fun z => (T z,z.2))) (γ.map T) γ.snd ∧
        (∀ᵐ z ∂(γ.map (fun z => (T z,z.2))), ‖z.1-z.2‖ ≤ t) ∧
        ∀ B, MeasurableSet B → |γ.fst.real B - (γ.map T).real B| ≤ γ.real {z | t < ‖z.1-z.2‖} := by
    classical
    dsimp only
    let T := fun z : E × E => if ‖z.1-z.2‖ ≤ t then z.1 else z.2
    have hT : Measurable T :=
      Measurable.ite (measurableSet_le (measurable_fst.sub measurable_snd).norm measurable_const)
        measurable_fst measurable_snd
    have hp : Measurable (fun z : E × E => (T z,z.2)) := hT.prodMk measurable_snd
    have hbound (z : E × E) : ‖T z-z.2‖ ≤ t := by
      dsimp only [T]
      split_ifs with hz
      · exact hz
      · simpa using ht
    refine ⟨hT,γ.isProbabilityMeasure_map hT.aemeasurable,
      γ.isProbabilityMeasure_map hp.aemeasurable,?_,?_,?_⟩
    · constructor
      · rw [Measure.fst,Measure.map_map measurable_fst hp]
        rfl
      · rw [Measure.snd,Measure.map_map measurable_snd hp]
        rfl
    · exact (ae_map_iff hp.aemeasurable (measurableSet_le
        (measurable_fst.sub measurable_snd).norm measurable_const)).2 (Filter.Eventually.of_forall hbound)
    · intro B hB
      have hm1 : γ.fst.real B = γ.real (Prod.fst ⁻¹' B) := by
        rw [Measure.fst,measureReal_def,Measure.map_apply measurable_fst hB]
        rfl
      have hm2 : (γ.map T).real B = γ.real (T ⁻¹' B) := by
        rw [measureReal_def,Measure.map_apply hT hB]
        rfl
      rw [hm1,hm2]
      have hsub1 : Prod.fst ⁻¹' B ⊆ T ⁻¹' B ∪ {z | t < ‖z.1-z.2‖} := by
        intro z hz
        by_cases hg : ‖z.1-z.2‖ ≤ t
        · exact Or.inl (by simpa [T,hg] using hz)
        · exact Or.inr (lt_of_not_ge hg)
      have hsub2 : T ⁻¹' B ⊆ Prod.fst ⁻¹' B ∪ {z | t < ‖z.1-z.2‖} := by
        intro z hz
        by_cases hg : ‖z.1-z.2‖ ≤ t
        · exact Or.inl (by simpa [T,hg] using hz)
        · exact Or.inr (lt_of_not_ge hg)
      have h1 := (measureReal_mono (μ := γ) hsub1).trans (measureReal_union_le _ _)
      have h2 := (measureReal_mono (μ := γ) hsub2).trans (measureReal_union_le _ _)
      exact abs_le.mpr ⟨by linarith, by linarith⟩
  
  have moment_tail
      (γ : Measure (E × E)) [IsProbabilityMeasure γ] (p t : ℝ) (hp : 2 ≤ p) (ht : 0 < t)
      (hI : Integrable (fun z : E × E => ‖z.1-z.2‖ ^ p) γ) :
      γ.real {z | t < ‖z.1-z.2‖} ≤ (∫ z, ‖z.1-z.2‖ ^ p ∂γ) / t ^ p := by
    have hnon : 0 ≤ᵐ[γ] (fun z : E × E => ‖z.1-z.2‖ ^ p) :=
      Filter.Eventually.of_forall fun z => Real.rpow_nonneg (norm_nonneg _) _
    have hm := mul_meas_ge_le_integral_of_nonneg hnon hI (t ^ p)
    have hs : {z : E × E | t < ‖z.1-z.2‖} ⊆ {z | t ^ p ≤ ‖z.1-z.2‖ ^ p} := by
      intro z hz
      exact Real.rpow_le_rpow ht.le (le_of_lt hz) (by linarith)
    have hmeasure := measureReal_mono (μ := γ) hs
    have htpos : 0 < t ^ p := Real.rpow_pos_of_pos ht p
    apply (le_div_iff₀ htpos).2
    nlinarith
  
  have moment_proxy
      (γ : Measure (E × E)) [IsProbabilityMeasure γ] (p r δ : ℝ)
      (hp : 2 ≤ p) (hr : 0 ≤ r) (hδ : 0 < δ) (hδ1 : δ < 1)
      (hI : Integrable (fun z : E × E => ‖z.1-z.2‖ ^ p) γ)
      (hbudget : (∫ z, ‖z.1-z.2‖ ^ p ∂γ) ≤ r ^ p) :
      let t := r * δ ^ (-1 / p)
      let T := fun z : E × E => if ‖z.1-z.2‖ ≤ t then z.1 else z.2
      Measurable T ∧ IsProbabilityMeasure (γ.map T) ∧
        IsProbabilityMeasure (γ.map (fun z => (T z,z.2))) ∧
        Transport.IsCoupling (γ.map (fun z => (T z,z.2))) (γ.map T) γ.snd ∧
        (∀ᵐ z ∂(γ.map (fun z => (T z,z.2))), ‖z.1-z.2‖ ≤ t) ∧
        ∀ B, MeasurableSet B → |γ.fst.real B - (γ.map T).real B| ≤ δ := by
    let t := r * δ ^ (-1 / p)
    have ht : 0 ≤ t := mul_nonneg hr (Real.rpow_nonneg hδ.le _)
    obtain ⟨hT,hP,hΓ,hcouple,hbound,hTV⟩ := truncation_coupling γ t ht
    refine ⟨hT,hP,hΓ,hcouple,hbound,?_⟩
    have htail : γ.real {z | t < ‖z.1-z.2‖} ≤ δ := by
      by_cases hr0 : r = 0
      · have hp0 : p ≠ 0 := by linarith
        have hz : (∫ z, ‖z.1-z.2‖ ^ p ∂γ) = 0 := by
          have hnon : 0 ≤ (∫ z : E × E, ‖z.1-z.2‖ ^ p ∂γ) :=
            integral_nonneg (fun z => Real.rpow_nonneg (norm_nonneg (z.1-z.2)) p)
          have hupper : (∫ z : E × E, ‖z.1-z.2‖ ^ p ∂γ) ≤ 0 := by
            simpa [hr0,Real.zero_rpow hp0] using hbudget
          exact le_antisymm hupper hnon
        have hae := (integral_eq_zero_iff_of_nonneg_ae
          (Filter.Eventually.of_forall (fun z : E × E => Real.rpow_nonneg (norm_nonneg (z.1-z.2)) p)) hI).mp hz
        have hb : γ {z : E × E | 0 < ‖z.1-z.2‖} = 0 := by
          apply measure_eq_zero_iff_ae_notMem.mpr
          filter_upwards [hae] with z hz
          have hn : ‖z.1-z.2‖ = 0 := (Real.rpow_eq_zero_iff_of_nonneg (norm_nonneg _)).mp hz |>.1
          simp [hn]
        have ht0 : t = 0 := by simp [t,hr0]
        rw [ht0,measureReal_def,hb,ENNReal.toReal_zero]
        exact hδ.le
      · have hrpos : 0 < r := lt_of_le_of_ne hr (Ne.symm hr0)
        have htpos : 0 < t := mul_pos hrpos (Real.rpow_pos_of_pos hδ _)
        have hp0 : p ≠ 0 := by linarith
        have htp : t ^ p = r ^ p / δ := by
          dsimp only [t]
          rw [Real.mul_rpow hr (Real.rpow_nonneg hδ.le _), ← Real.rpow_mul hδ.le]
          have hpow : (-1 / p) * p = -1 := by field_simp
          rw [hpow,Real.rpow_neg_one]
          rfl
        have hm := moment_tail γ p t hp htpos hI
        have htpPos : 0 < t ^ p := Real.rpow_pos_of_pos htpos p
        have hmul := (le_div_iff₀ htpPos).mp hm
        have hcancel : δ * t ^ p = r ^ p := by rw [htp]; field_simp
        have hle : γ.real {z | t < ‖z.1-z.2‖} * t ^ p ≤ δ * t ^ p := by nlinarith
        exact (mul_le_mul_iff_left₀ htpPos).mp hle
    intro B hB
    exact (hTV B hB).trans htail
  have hn (z : E × E) : 0 ≤ ‖z.1-z.2‖ ^ p := Real.rpow_nonneg (norm_nonneg _) _
  let c : E × E → ℝ≥0 := fun z => ⟨‖z.1-z.2‖ ^ p, hn z⟩
  have hf : Continuous (fun z : E × E => ‖z.1-z.2‖ ^ p) :=
    (Real.continuous_rpow_const (by linarith : 0 ≤ p)).comp (continuous_fst.sub continuous_snd).norm
  have hc : Continuous c := hf.subtype_mk _
  obtain ⟨γ,hprob,hcouple,hopt⟩ := OptimalContinuousCost.exists_optimal_coupling P Q c hc
  let : IsProbabilityMeasure γ := hprob
  have heq : (fun z => (c z : ℝ≥0∞)) = (fun z : E × E => ENNReal.ofReal (‖z.1-z.2‖ ^ p)) := by
    funext z
    exact (ENNReal.ofReal_eq_coe_nnreal (hn z)).symm
  rw [heq] at hopt
  have hfinite : (∫⁻ z, ENNReal.ofReal (‖z.1-z.2‖ ^ p) ∂γ) ≠ ∞ :=
    ne_of_lt (lt_of_le_of_lt (hopt.le.trans hcost) ENNReal.ofReal_lt_top)
  have hnon : 0 ≤ᵐ[γ] (fun z : E × E => ‖z.1-z.2‖ ^ p) := Filter.Eventually.of_forall hn
  have hI := (lintegral_ofReal_ne_top_iff_integrable hf.aestronglyMeasurable hnon).mp hfinite
  have hbudget : (∫ z, ‖z.1-z.2‖ ^ p ∂γ) ≤ r ^ p := by
    rw [integral_eq_lintegral_of_nonneg_ae hnon hf.aestronglyMeasurable]
    have hh := ENNReal.toReal_mono ENNReal.ofReal_ne_top (hopt.le.trans hcost)
    simpa [ENNReal.toReal_ofReal (Real.rpow_nonneg hr p)] using hh
  refine ⟨γ,hprob,hcouple,hopt,?_⟩
  have hproxy := moment_proxy γ p r δ hp hr hδ hδ1 hI hbudget
  rw [hcouple.1,hcouple.2] at hproxy
  exact hproxy


end AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.Truncation

Exact module and namespace context

Source assumptions versus formal assumptions

Source	Actual Lean	Difference kind	Why it matters
Euclidean probabilities.	Complete second-countable normed Borel additive groups, including the zero space.	generalization	Explicit domain extension; proof uses no finite dimension or scalar structure.
Wp(P,Q)<=r and Winfinity(Pdag,Q)<=r delta^(-1/p).	True infimum p-cost<=r^p and an actual coupling with a.e. bounded displacement.	API-limitation	Exact cost and coupling certificates; full Wp/Winfinity metric API is not introduced or claimed.
Proof chooses an optimal coupling and applies Markov.	Optimizer and its finite moment are proved from the actual infimum budget; r=0 handled separately.	source-implicit	No extra coupling or finite marginal moment assumption.
Real p>=2, 0<delta<1, nonnegative error budget r.	Same real restrictions and exact radius r delta^(-1/p).	same	No weakening of the displayed exponent or constants.

Encoder–denoiser: accepted · domain-mismatch

Detected semantic differences

domains: Complete second-countable normed additive groups extend Euclidean source. — No scalar or finite-dimensional structure used; disclosed domain extension.
conclusion: Exact cost/coupling/event certificates, not full Wp/Winfinity APIs. — Both marginals, a.e. bound and signed event inequalities proved; no full Winfinity declaration.
scopes: Finite displacement p-cost does not imply finite marginal p-moments; later Lemma6.3(ii) Pp premises must be established separately. — Metric API, Gaussian reverse transport, Renyi warmness and sampler error/cost outside result.

A generalization is not a source correction. Proposed missing conditions require separate independent repair review. No proposed repair silently changes the original theorem.

Scope and omitted-condition boundaries

Actual infimum p-cost and bounded-displacement coupling certificate for Lemma6.2; no full Wp/Winfinity metric API, Gaussian reverse transport, Renyi/proxy-warmness, sampler construction, error/cost propagation or full-paper conclusion.

Source and reuse

ASTIS parents called

AutoSamplingTheory.TechnicalLemmas.Measure.OptimalContinuousCost.exists_optimal_coupling

Mathlib API called (external library)

mul_meas_ge_le_integral_of_nonneg
integral_eq_zero_iff_of_nonneg_ae

Mathematical sources

Chen, Chewi, Lu and Zhang, SPHMC v1 Lemma 6.2 — Optimal-coupling existence expanded and actual truncation construction.

ASTIS prose is not a quotation or a source-equivalence certificate. Definitions and aliases are explained as constructions, not counted as new mathematical proofs.

Which proof edges are actually covered?

TODO — not closed by these contributions Explicit measurable proxy probability and true coupling marginals
TODO — not closed by these contributions Uniform eventwise TV and exact a.e. displacement bounds, including r=0

An actual two-noise RGO stage with the added-time KL denominator

Fan Chen, Sinho Chewi, Jianfeng Lu and Matthew S. Zhang; ASTIS expanded proof, no author endorsement implied.

arXiv:2609.06906v1 · Theorem6.5 two-noise stage and Lemma6.3(i) Gaussian KL input control · faithful paraphrase

Complete source statement (ASTIS restatement)

Let mu be a probability measure on a finite-dimensional real inner-product Borel space, b>=0, eta>=0, tau>0 and u a point. Put rho=mu.tilted(-b*norm(x-u)^2/2). Then rho is probability and H_tau(H_eta rho)=H_(eta+tau)rho as actual measures, where H_s is GaussianSmoothing at standard deviation sqrt(s). There exists one Markov kernel K, selected before all proposal laws nu and radii r, with every-point fiber rho.tilted(-norm(x-y)^2/(2*(eta+tau))), and K composed with H_tau(H_eta rho)=rho. For every probability nu and r>=0 with actual extended-nonnegative WassersteinSpace.wassersteinDistance(nu,H_eta rho)<=ofReal(r), the actual ENNReal KL(K composed with H_tau nu,rho)<=ofReal(r^2/(2*tau)).

Finite-dimensional real inner-product Borel space including zero dimension; mu probability; b>=0 and arbitrary u.
eta>=0 and tau>0, so total eta+tau>0. Zero existing smoothing time is allowed.
The kernel may depend on mu,b,eta,tau,u but is chosen before nu,r. No joint measurable choice across these parameters is asserted.
The proposal input is the actual ENNReal W2(nu,H_eta rho)<=ofReal(r), r>=0. Its exact square identity gives the internal quadratic coupling budget; no toReal fallback, optimizer or marginal moments are supplied.
General probability base and absence of marginal P2 assumptions explicitly generalize the source Gibbs/P2 setting. This packet uses the existing actual W2 interface; concrete normalized source times and full recursion remain separate.

Actual two-noise stage with W2 input and added-time KL control

\[W_2(\nu,H_\eta\rho)\le r,\quad K_{\eta+\tau}H_\tau H_\eta\rho=\rho\quad\Longrightarrow\quad \operatorname{KL}(K_{\eta+\tau}H_\tau\nu\|\rho)\le\frac{r^2}{2\tau}.\]

Read the formalized proofs

Each statement and proof below has its own closed Lean disclosure. ASTIS parents, Mathlib calls and external mathematical sources are distinguished in each proof.

ASTIS mathematical exposition

An actual two-noise RGO stage with the added-time KL denominator

AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.TwoNoiseRGO.two_noise_rgo · theorem · Teaching coverage

Statement

\[W_2(\nu,H_\eta\rho)\le r,\quad K_{\eta+\tau}H_\tau H_\eta\rho=\rho\quad\Longrightarrow\quad \operatorname{KL}(K_{\eta+\tau}H_\tau\nu\|\rho)\le\frac{r^2}{2\tau}.\]

All objects and hypotheses

Finite-dimensional real inner-product Borel space including zero dimension; mu probability; b>=0 and arbitrary u.
eta>=0 and tau>0, so total eta+tau>0. Zero existing smoothing time is allowed.
The kernel may depend on mu,b,eta,tau,u but is chosen before nu,r. No joint measurable choice across these parameters is asserted.
The proposal input is the actual ENNReal W2(nu,H_eta rho)<=ofReal(r), r>=0. Its exact square identity gives the internal quadratic coupling budget; no toReal fallback, optimizer or marginal moments are supplied.
General probability base and absence of marginal P2 assumptions explicitly generalize the source Gibbs/P2 setting. This packet uses the existing actual W2 interface; concrete normalized source times and full recursion remain separate.

Mathematical proof

1. Compute the actual scaled Gaussian characteristic function

The existing standard Gaussian characteristic function and the map-under-scaling formula give the exact exponent. Nonnegative time justifies replacing sqrt(s)^2 by s, also at zero.

\[\widehat G_{\sqrt s}(t)=\exp(-s\|t\|^2/2),\qquad s\ge0.\]

Corresponding Lean step

Local hc uses charFun_map_smul, charFun_stdGaussian and Real.sq_sqrt.

2. Prove the measure semigroup by characteristic-function uniqueness

The existing smoothing is definitionally the convolution of the input with its scaled Gaussian law. Its measures are probabilities. The convolution characteristic function is a product, so the two Gaussian exponents add. Uniqueness yields equality of the actual smoothed measures; no noise-composition premise is assumed.

\[\widehat{H_\tau H_\eta P}(t)=\widehat P(t)e^{-\eta\|t\|^2/2}e^{-\tau\|t\|^2/2}=\widehat{H_{\eta+\tau}P}(t).\]

Corresponding Lean step

Local heat_semigroup uses actual convolution, charFun_conv and Measure.ext_of_charFun.

3. Choose the exact backward kernel at total time

Apply the existing RGO backward theorem at positive eta+tau to the actual regularized target. It proves target probability, supplies one Markov kernel with every-point normalized fiber and recovers rho from H_(eta+tau)rho.

\[K(y)=\rho.\mathrm{tilted}(-\|x-y\|^2/(2(\eta+\tau))),\quad K H_{\eta+\tau}\rho=\rho.\]

Corresponding Lean step

RGOBackward.rgo_backward_recovery at eta+tau; retain hρ,hK,hfiber,hrecover.

4. Identify the actual two-noise target recovery

Substitute the proved semigroup equality into recovery. The two random noise additions followed by the selected backward kernel now have exactly the target output law.

\[K H_\tau(H_\eta\rho)=K H_{\eta+\tau}\rho=\rho.\]

Corresponding Lean step

hsem and hrec use actual measure equality, not a symbolic time convention.

5. Apply input error control only at the added time

Introduce nu,r after choosing K. Square the actual ENNReal W2 bound and use its existing exact square identity to derive the quadratic budget. GaussianKL compares nu to the already smoothed target H_eta rho using only added noise tau. Same-kernel data processing and exact recovery transfer that bound to the actual output. Total variance cannot replace tau in the denominator.

\[\operatorname{KL}(K H_\tau\nu\|\rho)\le\operatorname{KL}(H_\tau\nu\|H_\tau H_\eta\rho)\le r^2/(2\tau).\]

Corresponding Lean step

WassersteinSpace.wassersteinDistance_sq and ENNReal.ofReal_pow derive hcost; InformationTheory.klDiv_comp_right_le, hrec and GaussianKL at added tau.

Lean statement · two_noise_rgo

Actual Gaussian semigroup, one total-time backward kernel, exact two-noise recovery and added-time input KL guarantee.

theorem two_noise_rgo {E : Type*} [NormedAddCommGroup E] [InnerProductSpace ℝ E]
    [FiniteDimensional ℝ E] [MeasurableSpace E] [BorelSpace E]
    (μ : Measure E) [IsProbabilityMeasure μ] (b η τ : ℝ)
    (hb : 0 ≤ b) (hη : 0 ≤ η) (hτ : 0 < τ) (u : E) :
    let ρ := μ.tilted (fun x => -(b/2)*‖x-u‖^2)
    IsProbabilityMeasure ρ ∧
      GaussianSmoothing.gaussianSmoothing (GaussianSmoothing.gaussianSmoothing ρ (Real.sqrt η))
        (Real.sqrt τ) = GaussianSmoothing.gaussianSmoothing ρ (Real.sqrt (η+τ)) ∧
      ∃ K : Kernel E E, IsMarkovKernel K ∧
        (∀ y, K y = ρ.tilted (fun x => -‖x-y‖^2/(2*(η+τ)))) ∧
        K ∘ₘ GaussianSmoothing.gaussianSmoothing
          (GaussianSmoothing.gaussianSmoothing ρ (Real.sqrt η)) (Real.sqrt τ) = ρ ∧
        ∀ (ν : Measure E), IsProbabilityMeasure ν → ∀ r : ℝ, 0 ≤ r →
          WassersteinSpace.wassersteinDistance ν
            (GaussianSmoothing.gaussianSmoothing ρ (Real.sqrt η)) ≤ ENNReal.ofReal r →
          InformationTheory.klDiv (K ∘ₘ GaussianSmoothing.gaussianSmoothing ν (Real.sqrt τ)) ρ ≤
            ENNReal.ofReal (r^2/(2*τ))

Exact module and namespace context

Lean proof · two_noise_rgo

Characteristic functions identify actual smoothing composition, then the total-time RGO recovery and added-time Gaussian KL yield the output bound.

theorem two_noise_rgo {E : Type*} [NormedAddCommGroup E] [InnerProductSpace ℝ E]
    [FiniteDimensional ℝ E] [MeasurableSpace E] [BorelSpace E]
    (μ : Measure E) [IsProbabilityMeasure μ] (b η τ : ℝ)
    (hb : 0 ≤ b) (hη : 0 ≤ η) (hτ : 0 < τ) (u : E) :
    let ρ := μ.tilted (fun x => -(b/2)*‖x-u‖^2)
    IsProbabilityMeasure ρ ∧
      GaussianSmoothing.gaussianSmoothing (GaussianSmoothing.gaussianSmoothing ρ (Real.sqrt η))
        (Real.sqrt τ) = GaussianSmoothing.gaussianSmoothing ρ (Real.sqrt (η+τ)) ∧
      ∃ K : Kernel E E, IsMarkovKernel K ∧
        (∀ y, K y = ρ.tilted (fun x => -‖x-y‖^2/(2*(η+τ)))) ∧
        K ∘ₘ GaussianSmoothing.gaussianSmoothing
          (GaussianSmoothing.gaussianSmoothing ρ (Real.sqrt η)) (Real.sqrt τ) = ρ ∧
        ∀ (ν : Measure E), IsProbabilityMeasure ν → ∀ r : ℝ, 0 ≤ r →
          WassersteinSpace.wassersteinDistance ν
            (GaussianSmoothing.gaussianSmoothing ρ (Real.sqrt η)) ≤ ENNReal.ofReal r →
          InformationTheory.klDiv (K ∘ₘ GaussianSmoothing.gaussianSmoothing ν (Real.sqrt τ)) ρ ≤
            ENNReal.ofReal (r^2/(2*τ)) := by
  have heat_semigroup (μ : Measure E) [IsProbabilityMeasure μ] (η τ : ℝ) (hη : 0 ≤ η) (hτ : 0 ≤ τ) :
      GaussianSmoothing.gaussianSmoothing (GaussianSmoothing.gaussianSmoothing μ (Real.sqrt η))
        (Real.sqrt τ) = GaussianSmoothing.gaussianSmoothing μ (Real.sqrt (η+τ)) := by
    have hc (a : ℝ) (ha : 0 ≤ a) (t : E) :
        charFun (GaussianSmoothing.scaledStdGaussian (E := E) (Real.sqrt a)) t =
          Complex.exp (-(a : ℂ) * (‖t‖ : ℂ)^2 / 2) := by
      unfold GaussianSmoothing.scaledStdGaussian
      rw [charFun_map_smul, charFun_stdGaussian]
      simp only [norm_smul, Real.norm_eq_abs, abs_of_nonneg (Real.sqrt_nonneg a),
        Complex.ofReal_mul, mul_pow]
      rw [← Complex.ofReal_pow, Real.sq_sqrt ha]
      congr 1
      ring
    have hs (ν : Measure E) [IsProbabilityMeasure ν] (s : ℝ) :
        IsProbabilityMeasure (GaussianSmoothing.gaussianSmoothing ν s) := by
      unfold GaussianSmoothing.gaussianSmoothing CommonNoiseContraction.addNoise
      exact Measure.isProbabilityMeasure_map (by fun_prop)
    let := hs μ (Real.sqrt η)
    let := hs (GaussianSmoothing.gaussianSmoothing μ (Real.sqrt η)) (Real.sqrt τ)
    let := hs μ (Real.sqrt (η+τ))
    apply Measure.ext_of_charFun
    funext t
    change charFun ((μ ∗ GaussianSmoothing.scaledStdGaussian (Real.sqrt η)) ∗
        GaussianSmoothing.scaledStdGaussian (Real.sqrt τ)) t =
      charFun (μ ∗ GaussianSmoothing.scaledStdGaussian (Real.sqrt (η+τ))) t
    rw [charFun_conv, charFun_conv, charFun_conv, hc η hη, hc τ hτ, hc (η+τ) (add_nonneg hη hτ)]
    rw [mul_assoc, ← Complex.exp_add]
    congr 2
    push_cast
    ring
  dsimp only
  let ρ := μ.tilted (fun x => -(b/2)*‖x-u‖^2)
  obtain ⟨hρ,K,hK,hfiber,_,hrecover,_⟩ :=
    RGOBackward.rgo_backward_recovery μ b (η+τ) hb (add_pos_of_nonneg_of_pos hη hτ) u
  let := hρ
  let := hK
  have hs (ν : Measure E) [IsProbabilityMeasure ν] (s : ℝ) :
      IsProbabilityMeasure (GaussianSmoothing.gaussianSmoothing ν s) := by
    unfold GaussianSmoothing.gaussianSmoothing CommonNoiseContraction.addNoise
    exact Measure.isProbabilityMeasure_map (by fun_prop)
  have hsem := heat_semigroup ρ η τ hη hτ.le
  have hrec : K ∘ₘ GaussianSmoothing.gaussianSmoothing
      (GaussianSmoothing.gaussianSmoothing ρ (Real.sqrt η)) (Real.sqrt τ) = ρ := by
    rw [hsem]
    exact hrecover
  refine ⟨hρ,hsem,K,hK,hfiber,hrec,?_⟩
  intro ν hν r hr hW
  have hcost : Transport.transportCost (fun z : E × E => ENNReal.ofReal (‖z.1-z.2‖^2)) ν
      (GaussianSmoothing.gaussianSmoothing ρ (Real.sqrt η)) ≤ ENNReal.ofReal (r^2) := by
    have hh := pow_le_pow_left₀ (by positivity) hW 2
    rw [WassersteinSpace.wassersteinDistance_sq, ← ENNReal.ofReal_pow hr] at hh
    exact hh
  let := hν
  let := hs ρ (Real.sqrt η)
  let := hs ν (Real.sqrt τ)
  let := hs (GaussianSmoothing.gaussianSmoothing ρ (Real.sqrt η)) (Real.sqrt τ)
  have hk := InformationTheory.klDiv_comp_right_le
    (GaussianSmoothing.gaussianSmoothing ν (Real.sqrt τ))
    (GaussianSmoothing.gaussianSmoothing (GaussianSmoothing.gaussianSmoothing ρ (Real.sqrt η))
      (Real.sqrt τ)) K
  rw [hrec] at hk
  exact hk.trans (GaussianKL.gaussian_kl_reverse_transport ν
    (GaussianSmoothing.gaussianSmoothing ρ (Real.sqrt η)) r τ hr hτ hcost)
end AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.TwoNoiseRGO

Exact module and namespace context

Source assumptions versus formal assumptions

Source	Actual Lean	Difference kind	Why it matters
Theorem6.5 uses a regularized Gibbs target and a proposal close to its already-smoothed law in W2.	General probability base quadratically tilted; actual Samplinglib ENNReal W2(nu,H_eta rho)<=ofReal(r).	generalization	The existing exact square identity derives the quadratic budget; finite transport distance does not imply individual marginal P2 membership. Concrete Gibbs potential assumptions are abstracted explicitly.
Stage times are normalized by beta_A and compose before the exact backward RGO.	eta>=0,tau>0, actual H_tau(H_eta rho)=H_(eta+tau)rho; K at total eta+tau.	source-implicit	Characteristic functions prove actual Gaussian convolution; concrete normalized stage substitutions remain separate.
Gaussian regularization compares the proposal with an already-smoothed target using newly added noise.	Actual KL(K composed with H_tau nu,rho)<=ofReal(r^2/(2*tau)), input against H_eta rho.	same	Denominator uses only added tau, not total eta+tau. KL direction and one fixedK are exact.
The kernel is fixed by the target and stage, independently of the approximate input law.	One K after mu,b,eta,tau,u and before every nu,r, with every-y normalized fiber and actual two-noise recovery.	same	No joint measurable parameter/history selection is asserted.
Full recursive algorithm uses approximate kernels, error accumulation and expected query costs.	Fixed-target exact two-noise stage only.	API-limitation	Concrete source times, adaptive/history kernels, measurable proxies, approximate sampler, accumulated errors and costs remain separate.

The input is Samplinglib actual extended-nonnegative W2, defined as the square root of the quadratic coupling infimum; its proved square identity supplies the internal cost budget. Finite W2 does not establish marginal P2 membership. General probability-base target and fixed-stage formulation explicitly generalize source Gibbs/P2. Joint parameter/history kernels, concrete source-time substitutions, approximate recursion, measurable proxies, accumulated errors and costs remain separate. The local semigroup helper is not a separately public Gaussian-law API.

Encoder–denoiser: accepted · domain-mismatch

Detected semantic differences

domains: General probability-base/finite-dimensional formulation abstracts concrete Gibbs. — No concrete potential, curvature or positive-dimension premise.
assumptions: No individual P2 assumption; eta0 allowed, finite W2 does not imply marginal moments. — Zeroexistingnoise allowed; hcost derived from squaredactualW2, no optimizer or P2inference.
objects: Actual W2 input is implemented and is not a deferred correspondence gap. — Actual two-noise law and existing W2 square identity; no symbolic/toReal replacement.
scopes: Fixed stage does not assert concrete beta-normalized time substitution or history-dependent approximate sampling. — Concrete source times, adaptive/historykernels, approximate recursion anderrors/costs excluded.
scopes: General semigroup remains localhelper, not separately public Gaussian-law API. — Concrete source times, adaptive/historykernels, approximate recursion anderrors/costs excluded.

A generalization is not a source correction. Proposed missing conditions require separate independent repair review. No proposed repair silently changes the original theorem.

Scope and omitted-condition boundaries

The input is Samplinglib actual extended-nonnegative W2, defined as the square root of the quadratic coupling infimum; its proved square identity supplies the internal cost budget. Finite W2 does not establish marginal P2 membership. General probability-base target and fixed-stage formulation explicitly generalize source Gibbs/P2. Joint parameter/history kernels, concrete source-time substitutions, approximate recursion, measurable proxies, accumulated errors and costs remain separate. The local semigroup helper is not a separately public Gaussian-law API.

Source and reuse

ASTIS parents called

Mathlib API called (external library)

ProbabilityTheory.charFun_stdGaussian
MeasureTheory.charFun_map_smul
MeasureTheory.charFun_conv
MeasureTheory.Measure.ext_of_charFun
InformationTheory.klDiv_comp_right_le

Mathematical sources

Chen, Chewi, Lu and Zhang, SPHMC v1 Theorem6.5 and Lemma6.3(i) — Fixed-stage smoothed proposal, additional Gaussian noise and exact backward sampling; not full approximate recursion.

ASTIS prose is not a quotation or a source-equivalence certificate. Definitions and aliases are explained as constructions, not counted as new mathematical proofs.

Which proof edges are actually covered?

TODO — not closed by these contributions Actual W2-input two-noise backward stage with added-time KL denominator

Lemma 6.6(i): progress of the ill-conditioned recursive stages

Fan Chen, Sinho Chewi, Jianfeng Lu and Matthew S. Zhang. ASTIS mathematical restatement, not original prose; no endorsement implied.

arXiv:2609.06906v1 · §6.3, Lemma 6.6(i), (6.3), from (6.1)–(6.2) · faithful paraphrase

Complete source statement (ASTIS restatement)

In the recursive RGO scheme let c0 be in (0,1/4), with 0<eta_j≤c0 at each stage. If the current ratio kappa_j of specified curvature bounds is at least 2, the next ratio is between one half and four fifths of the current ratio.

The recursive parameters follow (6.1): kappa_next=kappa*(a*beta_A+1)/(a*beta_A+kappa), with beta_A>0.
The ill-conditioned branch of (6.2) sets tau=kappa, a=(eta+tau)/beta_A; kappa≥2 and 0<eta≤c0<1/4.
The ratio comes from the RGO curvature parameters in Lemma 6.4; it is not an independently assumed mixing rate.

(6.3)

\[\frac12\kappa_j\le\kappa_{j+1}\le\frac45\kappa_j.\]

substitution of (6.1)–(6.2)

\[\kappa_{j+1}=\frac{\kappa_j(\kappa_j+\eta_j+1)}{2\kappa_j+\eta_j}.\]

Read the formalized proofs

Each statement and proof below has its own closed Lean disclosure. ASTIS parents, Mathlib calls and external mathematical sources are distinguished in each proof.

ASTIS mathematical exposition

Why an ill-conditioned recursive stage makes geometric progress

AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.RecursiveCondition.contraction_bounds · theorem · Teaching coverage

Statement

For any real numbers k and h with k at least 2 and h strictly between 0 and 1/4, the displayed rational update lies between k/2 and four fifths of k.

\[k_+=\frac{k(k+h+1)}{2k+h},\qquad \frac{k}{2}\le k_+\le\frac45 k.\]

All objects and hypotheses

k,h are real scalars; 2 ≤ k and 0 < h < 1/4.
In the paper application k is the ratio of the specified curvature bounds, h is the smoothing parameter, and tau=k. It is not necessarily the optimal condition number of the target.
The source assumes 0<h≤c0<1/4. For this uniform single-stage calculation, eliminating the unused cutoff gives exactly 0<h<1/4; conversely any such h admits c0=h. No zero-smoothing or closed-endpoint extension is asserted.
This calculation does not involve a measure, derivative or random variable. The recurrence-to-RGO identification is a separate obligation.

Mathematical proof

1. Check division is legitimate

The denominator is positive. Thus multiplying either inequality by it preserves its direction; Lean's exceptional value for division by zero is irrelevant.

\[D=2k+h\ge4>0.\]

Corresponding Lean step

hden proves strict positivity; le_div_iff₀ and div_le_iff₀ remove the denominator only after this proof.

2. Prove the lower bound

Subtract half the previous value. The numerator is nonnegative because both k and h are nonnegative.

\[k_+-\frac{k}{2}=\frac{k(h+2)}{2D}\ge0.\]

Corresponding Lean step

The first branch uses mul_nonneg hk_nonneg hh.le, then nlinarith checks the cleared-denominator polynomial inequality.

3. Prove the uniform contraction

The deficit from four fifths has a positive margin throughout the parameter range. This checks the paper's constants without an unspecified further reduction of c0.

\[\frac45k-k_+=\frac{k(3k-h-5)}{5D},\qquad 3k-h-5\ge6-\frac14-5=\frac34>0.\]

Corresponding Lean step

hmargin proves 0 ≤ 3*k-h-5 by linarith. Its product with k is nonnegative; nlinarith closes the upper bound.

Lean statement · contraction_bounds

The parameters in braces are implicit real numbers; hk, hh and hh_upper are explicit hypotheses. The conjunction returns both inequalities. No typeclass or unproved sampler property is hidden in the statement.

theorem contraction_bounds {k h : ℝ} (hk : 2 ≤ k) (hh : 0 < h)
    (hh_upper : h < 1 / 4) :
    k / 2 ≤ k * (k + h + 1) / (2 * k + h) ∧
      k * (k + h + 1) / (2 * k + h) ≤ (4 / 5) * k

Exact module and namespace context

Lean proof · contraction_bounds

constructor separates the two inequalities. Positivity licenses cross-multiplication; mul_nonneg supplies the needed products; linarith and nlinarith generate checked ordered-field proofs. ASTIS authors this source-specific recurrence estimate; Mathlib supplies real arithmetic and the proof-producing tactics.

theorem contraction_bounds {k h : ℝ} (hk : 2 ≤ k) (hh : 0 < h)
    (hh_upper : h < 1 / 4) :
    k / 2 ≤ k * (k + h + 1) / (2 * k + h) ∧
      k * (k + h + 1) / (2 * k + h) ≤ (4 / 5) * k := by
  have hk_nonneg : 0 ≤ k := by linarith
  have hden : 0 < 2 * k + h := by linarith
  constructor
  · apply (le_div_iff₀ hden).2
    nlinarith [mul_nonneg hk_nonneg hh.le]
  · apply (div_le_iff₀ hden).2
    have hmargin : 0 ≤ 3 * k - h - 5 := by linarith
    nlinarith [mul_nonneg hk_nonneg hmargin]

end AutoSamplingTheory.ExampleCases.SmoothedPicardHMC.RecursiveCondition

Exact module and namespace context

Source assumptions versus formal assumptions

Source	Actual Lean	Difference kind	Why it matters
0<eta≤c0<1/4	0<h<1/4	same	For the uniform single-stage scalar assertion c0 occurs only in the hypotheses. The source implies this range; conversely an admissible c0 exists, for example c0=h. This eliminates a redundant cutoff without adding endpoints.
kappa_j is the ratio from the actual RGO parameter recurrence	k is a real scalar at least 2, with the rational update written explicitly	unresolved	This leaf proves the arithmetic proof step. The actual RGO construction and curvature-to-recurrence identification remain a separate red edge.

Scalar proof component, not the RGO parameter construction or the complete sampling theorem.

Encoder–denoiser: accepted · equivalent-after-elaboration

A generalization is not a source correction. Proposed missing conditions require separate independent repair review. No proposed repair silently changes the original theorem.

Scope and omitted-condition boundaries

Only Lemma 6.6(i)'s scalar calculation is covered. Lemma 6.4's normalized RGO closure and curvature formulas remain separate.
The well-conditioned phase, finite termination, sampling-error propagation and actual expected query count are not conclusions.
The first test checks k=2,h=1/8; the second derives this interface from the paper's strict c0 range. An earlier unneeded endpoint generalization was removed after independent source review; its artifacts are retained.

Source and reuse

ASTIS parents called

Mathlib API called (external library)

le_div_iff₀ and div_le_iff₀: ordered-field division with a strictly positive denominator.
mul_nonneg: nonnegative products; Mathlib linarith/nlinarith: kernel-checked polynomial arithmetic.

Mathematical sources

Chen, Chewi, Lu and Zhang, Smoothed Picard Hamiltonian Monte Carlo v1 — Lemma 6.6(i), (6.3), after substituting (6.1) and (6.2). ASTIS exposition, not quoted prose.

ASTIS prose is not a quotation or a source-equivalence certificate. Definitions and aliases are explained as constructions, not counted as new mathematical proofs.

Which proof edges are actually covered?

Local proof component; source adapter/review separate Positive-denominator rational calculation with the source constants
TODO — not closed by these contributions Actual recursive RGO curvature ratios satisfy (6.1)–(6.2), including A=infinity

Supporting Gibbs normalization theorem without an assumed minimizer

Fan Chen, Sinho Chewi, Jianfeng Lu and Matthew S. Zhang supply the source target and RGO setting. The displayed supporting theorem and detailed proof are ASTIS's explicit mathematical expansion, not a quotation, source correction, or claim of full Lemma 6.4 formalization.

arXiv:2609.06906v1; shared target-normalization consumer in arXiv:2609.06905v1 Section 2.1 · SPHMC Section 6.2.2, RGO potential and normalized-density definition before Lemma 6.4; supporting normalizability argument only · faithful paraphrase

Complete source statement (ASTIS restatement)

Supporting normalization theorem: on a finite-dimensional real inner-product Borel space, a differentiable potential V that is m-strongly convex on the whole space for m>0 has a volume-integrable Gibbs weight exp(−V). In the paper, normalized laws are specified by densities proportional to exp(−U_A,u), where U_A,u=U+‖·−u‖²/(2A), U is C² with positive Hessian lower bound, and A∈(0,infinity]. Establishing StrongConvexOn from those Hessian bounds and identifying the particular source potential are separate source adapters, not premises silently replaced by this prerequisite.

Selected supporting theorem: V is differentiable, m>0, and V((1−t)x+ty)≤(1−t)V(x)+tV(y)−m t(1−t)‖x−y‖²/2 for all x,y and 0≤t≤1.
The integration space is finite-dimensional real inner-product space with its Borel sigma-algebra and canonical volume.
No minimizer, stationary point, gradient field, tail envelope or finite normalizer is an additional hypothesis.
The source's C²/Hessian potential conditions and RGO parameters remain attached to its own statements. The Hessian-to-StrongConvexOn adapter is not proved by this prerequisite.

strong-convexity convention

\[V((1-t)x+ty)\le(1-t)V(x)+tV(y)-\frac m2t(1-t)\|x-y\|^2,\qquad 0\le t\le1.\]

normalization prerequisite and derived envelope

\[\int_Ee^{-V(x)}\,dx<\infty,\qquad V(x)\ge\frac m4\|x\|^2+V(0)-\frac{\|\nabla V(0)\|^2}{m}.\]

Read the formalized proofs

Each statement and proof below has its own closed Lean disclosure. ASTIS parents, Mathlib calls and external mathematical sources are distinguished in each proof.

ASTIS mathematical exposition

Normalize a strongly convex Gibbs target without assuming its minimizer

AutoSamplingTheory.TechnicalLemmas.Analysis.StrongConvexGibbsIntegrability.integrable_exp_neg_of_strongConvexOn · theorem · Teaching coverage

Statement

Let E be a finite-dimensional real inner-product space equipped with its Borel sigma-algebra and canonical volume. Let V:E→R be differentiable and m-strongly convex on the whole space, where m>0. Then exp(−V) is integrable with respect to volume. A minimizer, a gradient witness, a tail bound and a normalizing constant are not additional inputs.

\[m>0,\quad V\text{ differentiable and }m\text{-strongly convex}\quad\Longrightarrow\quad\int_E e^{-V(x)}\,dx<\infty.\]

All objects and hypotheses

Strong convexity uses the chord convention V((1−t)x+ty)≤(1−t)V(x)+tV(y)−m t(1−t)‖x−y‖²/2 for every x,y and t∈[0,1].
Differentiability is genuine everywhere differentiability, not a formula using a possibly totalized gradient alone. It supplies both continuity and the actual gradient at zero.
The space has finite real dimension. Canonical volume is the Lebesgue normalization attached to the inner product, not an arbitrary measure or infinite-dimensional formal volume.
Strict positivity of m gives a decaying Gaussian envelope. Convexity with m=0 does not suffice: the constant potential on the real line has infinite normalizer.
The two papers state Hessian lower bounds for C² potentials. Their conversion to this StrongConvexOn hypothesis remains an explicit separate adapter; this supporting theorem does not silently replace those source assumptions.

Mathematical proof

1. Use a fixed point rather than assume a minimizer

Set g=∇V(0). Since V is differentiable, this is its actual gradient. The compiled first-order strong-convexity inequality applied at zero controls V everywhere, regardless of whether zero is a critical point or an admissible algorithmic reference point.

\[V(x)\ge V(0)+\langle g,x\rangle+\frac m2\|x\|^2,\qquad g=\nabla V(0).\]

Corresponding Lean step

Each (hV z).hasGradientAt supplies the genuine gradient required by StrongConvexFirstOrder.firstOrder_lower_bound_of_strongConvexOn. The proof specializes its x input to zero and y input to the point being bounded. No global gradient field is assumed.

2. Absorb the linear term into the quadratic growth

Cauchy–Schwarz controls the potentially negative inner product. Young's inequality with parameter m/2 then spends half of the quadratic growth to absorb the linear term. The remaining coefficient m/4 is strictly positive.

\[\langle g,x\rangle\ge-\|g\|\,\|x\|,\qquad \|g\|\,\|x\|\le\frac m4\|x\|^2+\frac{\|g\|^2}{m},\qquad V(x)\ge\frac m4\|x\|^2+b,\quad b=V(0)-\frac{\|g\|^2}{m}.\]

Corresponding Lean step

abs_real_inner_le_norm supplies the lower inner-product bound; two_mul_le_add_mul_sq with ε=m/2 supplies Young's inequality. nlinarith combines these with hfirst. The code writes b as V 0−(m/2)⁻¹/2*‖g‖², equal to the displayed value because m>0.

3. Dominate the Gibbs weight by the compiled Gaussian envelope

Negation reverses the lower potential bound and the exponential is increasing. The resulting Gaussian envelope is already known to be volume-integrable in finite dimension. Continuity of V makes exp(−V) strongly measurable, so pointwise domination proves integrability.

\[0<e^{-V(x)}\le e^{-b}e^{-(m/4)\|x\|^2},\qquad \int_Ee^{-b}e^{-(m/4)\|x\|^2}\,dx=e^{-b}\left(\frac{4\pi}{m}\right)^{\dim(E)/2}<\infty.\]

Corresponding Lean step

Integrability.integrable_exp_neg_add_mul_norm_sq supplies integrability of the envelope; its exact integral is explanatory and is not reproved here. The explicit composition Real.continuous_exp.comp hV.continuous.neg supplies measurability. Integrable.mono' and Real.exp_le_exp conclude the proof.

Lean statement · integrable_exp_neg_of_strongConvexOn

The three explicit hypotheses are positive real modulus, everywhere differentiability, and Mathlib StrongConvexOn univ m V. Finite-dimensional Borel inner-product structure appears as typeclasses. Finite dimension supplies completeness used by the actual-gradient API. The conclusion is Bochner Integrable for a nonnegative real function, which includes measurable and finite-integral content.

theorem integrable_exp_neg_of_strongConvexOn {V : E → ℝ} {m : ℝ}
    (hm : 0 < m) (hV : Differentiable ℝ V)
    (hsc : StrongConvexOn Set.univ m V) :
    Integrable (fun x => Real.exp (-V x)) (volume : Measure E)

Exact module and namespace context

Lean proof · integrable_exp_neg_of_strongConvexOn

This is a new join of two existing ASTIS mathematical parents, not a restatement of an assumed normalizer. The first-order bound and Gaussian tail theorem are owned compiled ASTIS results; Mathlib supplies the gradient bridge, Cauchy–Schwarz, Young's inequality and integral domination. Tests then use Mathlib integral_exp_pos and isProbabilityMeasure_tilted to obtain a positive normalizer and a probability measure, and feed that actual Gibbs probability into the previously compiled RGO closure.

theorem integrable_exp_neg_of_strongConvexOn {V : E → ℝ} {m : ℝ}
    (hm : 0 < m) (hV : Differentiable ℝ V)
    (hsc : StrongConvexOn Set.univ m V) :
    Integrable (fun x => Real.exp (-V x)) (volume : Measure E) := by
  let g : E := gradient V 0
  let b : ℝ := V 0 - (m / 2)⁻¹ / 2 * ‖g‖ ^ 2
  have hquad : ∀ x : E, m / 4 * ‖x‖ ^ 2 + b ≤ V x := by
    intro x
    have hfirst : V 0 + inner ℝ g x + m / 2 * ‖x‖ ^ 2 ≤ V x := by
      simpa only [g, sub_zero] using
        StrongConvexFirstOrder.firstOrder_lower_bound_of_strongConvexOn hsc
          (fun z _ => (hV z).hasGradientAt) (x := 0) (y := x)
          (Set.mem_univ _) (Set.mem_univ _)
    have hinner := (abs_le.mp (abs_real_inner_le_norm g x)).1
    have hyoung := two_mul_le_add_mul_sq (a := ‖x‖) (b := ‖g‖)
      (show 0 < m / 2 by positivity)
    dsimp only [b]
    nlinarith
  have hbound := Integrability.integrable_exp_neg_add_mul_norm_sq
    (E := E) (a := m / 4) (b := b) (by positivity)
  refine hbound.mono' ((Real.continuous_exp.comp hV.continuous.neg).aestronglyMeasurable) ?_
  filter_upwards with x
  rw [Real.norm_eq_abs, abs_of_pos (Real.exp_pos _)]
  exact Real.exp_le_exp.mpr (neg_le_neg (hquad x))

end AutoSamplingTheory.TechnicalLemmas.Analysis.StrongConvexGibbsIntegrability

Exact module and namespace context

Source assumptions versus formal assumptions

Source	Actual Lean	Difference kind	Why it matters
The displayed supporting lemma uses differentiability and positive m-strong convexity	Differentiable ℝ V and StrongConvexOn Set.univ m V, with 0<m	same	Mathlib's chord inequality uses exactly the m/2 normalization displayed in the supporting statement.
Euclidean finite-dimensional state and Lebesgue normalization	Any finite-dimensional real inner-product Borel space with canonical volume	generalization	The coordinate-free version retains the same finite-dimensional Gaussian envelope and canonical volume. It does not propose an infinite-dimensional sampling extension.
Gibbs normalizability is implicit in proportional-density notation	Integrability is proved from first-order growth and an existing Gaussian envelope; the actual gradient comes from differentiability	source-implicit	Neither minimizer existence nor finite normalizer is added as a premise. Strictly positive mass and the probability law then follow from existing Mathlib APIs, exercised in the focused test.
The paper imposes C² Hessian lower bounds on U and adds the quadratic RGO potential	The supporting lemma takes StrongConvexOn for V rather than a Hessian field	unresolved	A source application still must prove the Hessian-to-StrongConvexOn and particular-potential adapters. This binding is a prerequisite and cannot count as closure of those source obligations.

A genuine normalization prerequisite, not full source Gibbs initialization, Hessian/curvature equivalence, complete Lemma 6.4 or sampling formalization.

Encoder–denoiser: accepted · equivalent-after-elaboration

Detected semantic differences

assumptions: The formal prerequisite takes differentiability and StrongConvexOn, while the papers give C² potentials with Hessian lower bounds. — The selected supporting theorem states its own chord hypothesis explicitly. The separate source-hessian-adapter obligation must still derive it for the source potential; this prerequisite does not silently prove or replace that adapter.
domains: The supporting theorem is stated on arbitrary finite-dimensional real inner-product Borel spaces, including the degenerate zero-dimensional space. — This is an explicit coordinate-free generalization of the source's Euclidean setting, with the same canonical volume normalization. The one-point case is valid, and no infinite-dimensional volume is being assumed.
conclusion: The production result establishes integrability; positive normalization and construction of an abstract Gibbs probability are exercised as consumers rather than packaged as additional production conclusions. — The focused tests use integral_exp_pos and isProbabilityMeasure_tilted on the new integrability theorem, then invoke normalized quadratic RGO closure. All these tests independently compile without a supplied minimizer or integral bound.
scopes: This is an explicitly attributed supporting mathematical expansion, not a verbatim theorem from either paper or complete Gibbs/RGO/source-sampler assimilation. — The pinned publication binding is role prerequisite and supports only gibbs-weight-integrability. Particular-source potential and density identification remain source-gibbs-identification; no sampling or process completion is inferred.

A generalization is not a source correction. Proposed missing conditions require separate independent repair review. No proposed repair silently changes the original theorem.

Scope and omitted-condition boundaries

The m/4 coefficient is only an integrability envelope. It neither weakens the original strong-convexity claim nor substitutes for the source's curvature or complexity constants.
The finite offset b depends on V(0), ∇V(0) and m. This is an existence-of-finite-mass argument, not a uniform normalization or sampling-cost bound.
Hessian lower bound → StrongConvexOn is still open in the current paper route. No global minimizer is assumed or constructed, and no algorithmic reference point is certified.
The statement supports Gibbs initialization for both companion papers but does not itself prove either source's initialization theorem, RGO implementation, invariant law, mixing rate, output error or expected query cost.

Source and reuse

ASTIS parents called

Mathlib API called (external library)

DifferentiableAt.hasGradientAt
abs_real_inner_le_norm
two_mul_le_add_mul_sq
MeasureTheory.Integrable.mono'
Real.continuous_exp
Real.exp_le_exp

Mathematical sources

Chen, Chewi, Lu and Zhang, Smoothed Picard Hamiltonian Monte Carlo v1 — Normalization prerequisite for the Gibbs and RGO densities defined before Lemma 6.4. ASTIS expanded first-order/Young/Gaussian-envelope proof, not copied prose or the whole lemma.
Chen, Chewi, Lu and Zhang, Proximal Bouncy Particle Sampler v1 — The strongly convex Gibbs target also requires this finite-normalizer input. Its Hessian and probability-density adapter remain separately explicit.

ASTIS prose is not a quotation or a source-equivalence certificate. Definitions and aliases are explained as constructions, not counted as new mathematical proofs.

Which proof edges are actually covered?

TODO — not closed by these contributions Derive Gibbs-weight integrability from differentiable positive strong convexity without a supplied minimizer
TODO — not closed by these contributions Derive StrongConvexOn for the actual source potential from its C² Hessian lower bound
TODO — not closed by these contributions Instantiate normalized source Gibbs/RGO laws and their exact density representation

Common setting and conventions

Low-accuracy W2 guarantee

Statement

Proof architecture and calculations

Smooth the density

Integrate the smoothed Hamiltonian equation

Budget all three errors

Strict boundary

An implementable law near a Renyi-warm proxy

Statement

Proof architecture and calculations

Turn a moment bound into a nearby bounded-displacement coupling

Regularize both laws before measuring divergence

Track the moving conditional target and oracle bill

Strict boundary

Supporting Hessian-to-strong-convexity implication

Complete source statement (ASTIS restatement)

primary Hessian setting

selected lower-curvature consequence

Read the formalized proofs

From a genuine Hessian lower bound to strong convexity

Statement

All objects and hypotheses

Mathematical proof

1. Restrict to a line and compensate its curvature

2. Calculate two genuine scalar derivatives

3. Use one-dimensional convexity

4. Recover the exact strong-convexity constant

Source assumptions versus formal assumptions

Detected semantic differences

Scope and omitted-condition boundaries

Source and reuse

ASTIS parents called

Mathlib API called (external library)

Mathematical sources

Which proof edges are actually covered?

A common Markov kernel cannot amplify total-variation error

Complete source statement (ASTIS restatement)

selected data-processing step

generic eventwise formulation

Read the formalized proofs

A common Markov kernel cannot amplify total-variation error

Statement

All objects and hypotheses

Mathematical proof

1. Replace the output event by a bounded observable

2. Express a bounded observable by its level events

3. Justify subtraction of the two level integrals

4. Apply the event bound and preserve the exact constant

Source assumptions versus formal assumptions

Detected semantic differences

Scope and omitted-condition boundaries

Source and reuse

ASTIS parents called

Mathlib API called (external library)

Mathematical sources

Which proof edges are actually covered?

Curvature and actual gradient smoothness of the RGO potential

Complete source statement (ASTIS restatement)

source regularization

exact curvature and smoothness

Read the formalized proofs

Quadratic regularization shifts actual curvature and gradient smoothness

Statement

All objects and hypotheses

Mathematical proof

1. Differentiate the actual quadratic potential

2. Turn the shifted lower bound into the exact chord inequality

3. Identify the genuine derivative of the gradient and its symmetry

4. Bound the operator norm from the diagonal sandwich

5. Use the whole-space mean-value bound

Source assumptions versus formal assumptions

Detected semantic differences

Scope and omitted-condition boundaries

Source and reuse

ASTIS parents called

Mathlib API called (external library)

Mathematical sources

Which proof edges are actually covered?

A measurable random-center RGO with actual joint recovery