# P15/A15 bounded input-admission repair proposal Reading edition · 18 October 2026. This complete technical text retains the original findings and formulas. Local artifact locations are shown by clean file labels; exact locations, identities and the unchanged original text remain in the source record. No original runtime or receipt is modified. Status: tested local proposal; not installed, deployed, or physically validated. ## Exact source and immutable boundary - Original module: `p15-a15-runtime.js` - Original module bytes: 6,166. - Original module SHA-256: `7c00d68f35135504e8a0348611c877ff47208e6d579e0d02160e5cfaf8a2eeca`. - Available app carrier: `braink_native_host_adapter_r14.html`. - Carrier bytes: 21,626,453; SHA-256: `f5cde46ae784fff5d99d0e7555c7da23b5c94afa93dd48b10f40892ba20e4914`. - The identical module is embedded under script ID `p15-a15-runtime` in that carrier and the E-LINE edition carrier. The retained manifest identifies the exact available bytes; an unverified source alias is not substituted. - The verification runner rereads and hashes all three original files before and after execution. It never writes them. - Uninstalled proposed module SHA-256: `3a7ac468654c82809a4327d91ef95b596be4f81fd7bd8ace7e0a70a8727d129e`. ## Reproduced defects and bounded result Original nominal self-tests: 9/9 pass. The original code also reproduces four adverse outcomes: 1. A matrix containing NaN is incorrectly reported unitary, and applying it yields a nonfinite state norm. 2. `K_POS.measure(-0.1)` returns outcome `0` with probability 0. 3. `K_NEG.measure(1)` returns outcome `1` with probability 0. 4. A normalized state `[1/sqrt(2), 1/sqrt(2), 0]` has cumulative total `0.9999999999999998`; draw `0.9999999999999999`, which is valid, falls through to the original trailing-zero index. The proposed module passes 62/62 independent grouped checks. The complete original self-test result, nominal arrays, complex phases, finite arithmetic outputs, labels and representative measurement results are compared exactly, without loosening tolerances. The receipt distinguishes the 9 built-in tests from the 62 independent checks; these are not 71 wholly independent experiments. ## Function-level change contract ### 1. Shared admission predicates Add `finiteComplex(z)`: true only for an object with finite primitive-number `re` and `im` components. Add `squareMatrix(U, n)`: require a nonempty Array of exactly n Array rows, each of exactly n entries. Check rows by index so holes cannot evade `.some()`. Add `finiteMatrix(U)`: check every coordinate by index with `finiteComplex`, including holes. Call only after the shape has been checked. Do not change complex arithmetic helpers, EPS (`1e-10`), gate tables or unitarity tolerance (`1e-9`). ### 2. `KQuantumState.constructor(amplitudes, labels=null)` Keep the existing `C(x.re,x.im)` conversion and defaulting. After it, and after the existing empty-vector guard, reject any resulting nonfinite complex coefficient with `E_NONFINITE_AMPLITUDE`. Iterate over all entries, so a hole is rejected. Keep label handling, normalization order and scalar arithmetic unchanged. The existing all-zero/near-zero guard remains `norm < EPS` and raises `E_ZERO_VECTOR`. This proposal does not silently convert that existing threshold into an exact-zero-only predicate. Compatibility detail: the original constructor's Number conversion remains; for example finite numeric strings in amplitude inputs still convert, and omitted `im` still defaults to 0. Matrix inputs require actual finite number components, because they were never passed through C on admission. ### 3. `norm2()` / `norm()` Compute the existing reduction in the same order. If the resulting squared norm is not finite, throw `E_NONFINITE_NORM` before returning it. This catches both nonfinite propagation and overflow from finite coefficients. `norm()` continues to take the square root of this admitted squared norm. No rescaling trick is added to admit huge coefficients whose existing arithmetic overflows. Rejection is deliberately bounded and preserves ordinary numeric output. ### 4. `apply(U)` remains the general conditional-map API - Shape mismatch: throw `E_DIM`. - Any nonfinite or nonnumeric matrix coordinate: throw `E_NONFINITE_MATRIX`. - Otherwise retain the exact matrix-vector multiplication and construction of the normalized nonzero successor. - The successor constructor rejects overflow/nonfinite output and zero/near-zero output. Do not add a blanket unitarity requirement to this method. A finite nonunitary map may have a valid nonzero conditional output. This method alone does not supply a complete measurement instrument, a success probability, a CPTP-channel proof, or a physically implementable operation. ### 5. New `applyUnitary(U)` is the explicit gate API If `unitary(U)` is false, throw `E_NONUNITARY_GATE`; otherwise call the existing admitted `apply(U)`. A unitary matrix of the wrong state dimension is still rejected by `apply` with `E_DIM`. Route the built-in Hadamard and CNOT calls inside `bell()`, plus the Hadamard call in `selfTest()`, through `applyUnitary`. No changes to their results or self-test wording are intended. External callers which specifically claim unitary gate evolution must use the gate API or explicitly call the predicate before applying. Existing callers of `apply` continue to receive its general conditional-map contract. ### 6. `unitary(U)` is a total predicate for ordinary plain-data matrix inputs Return false for invalid array shape, holes, nonnumeric coefficients, NaN, and either infinity. Only then form the unchanged `U†U`. Return false if any Gram-matrix component is nonfinite, even when all input components were finite. Only then apply the original elementwise `1e-9` tolerance. The earlier bug arose because `Math.abs(NaN) > tolerance` is false. An explicit finite check must precede those comparisons. No deep freezing, arbitrary accessor execution containment, or hostile Proxy hardening is claimed. The data contract is ordinary arrays and complex-number records. ### 7. `measure(sample=Math.random())` - Before computing an outcome, require a finite primitive-number draw satisfying `0 <= sample < 1`; otherwise throw `E_SAMPLE_RANGE`. - The omitted/undefined default still draws once from `Math.random()`, and that returned value is checked too. Strings, null, booleans and objects are not coerced into draws. Numeric negative zero is the valid lower endpoint. - Validate the current norm: nonfinite norm rejects through `norm2`; norm below EPS throws `E_ZERO_VECTOR`; a finite norm outside the existing EPS normalization tolerance throws `E_STATE_NORM`. This prevents a directly mutated public amplitude array from inventing a measurement result from an invalid predecessor. - Keep probability calculation and cumulative-sum order unchanged. - Set fallback to the last strictly positive probability seen, never blindly to the last array index. Only break on a positive-support entry whose cumulative value exceeds the sample. This preserves ordinary interval boundaries and avoids zero-probability fallback after floating-point rounding. - Preserve outcome labels, the returned probability value, and construction of the normalized basis-state successor. Measurement remains a sampled outcome plus conditional successor; it is not required to be unitary. The rounding fallback is numerical admission behavior, not a claim of experimentally measured Born statistics. ## Independent test coverage `verify-proposal.mjs` checks: - Exact source identities and unchanged originals. - Original 9/9 self-tests and exact nominal source/candidate results. - NaN and both infinities in real and imaginary state/matrix coefficients. - Overflow in norm squaring, norm summation, matrix products and Gram products. - Empty, null, ragged, missing-row, missing-coefficient and numeric-string matrix cases. - Invalid draws: negative values, 1, values above 1, NaN, infinities and coercible/non-numeric values. - Valid draws: 0, negative zero, a cumulative boundary, and the greatest representable number below 1. - Leading, interior and trailing zero coefficients. - Default RNG invocation and invalid RNG output. - Corrupted public-state norm rejection. - All six reference gates through the gate API. - Valid nonunitary conditional maps and projectors, zero-output branches, and measurement without an incorrect unitary requirement. A portable selection of critical independent vectors is in `test-vectors.json`. The complete executable assertions are in the verification runner. Tagged special numeric values in the JSON must be decoded as specified; a string `"NaN"` is not the numeric NaN vector. ## Reproduction and later authoring Run from the workspace root: `node verify-proposal.mjs` The only written outputs are inside this proposal directory: `candidate-p15-runtime.js` and `verification-receipt.json`. `proposal-transform.mjs` requires the exact original SHA before changing a string in memory, and requires each replacement context to occur exactly once. For later authorized KEX compiler/bootstrapper/assembler authoring, the transformed module is a candidate input, not an installed repair. The actual authoring route must retain the original source identity, produce a new identity, rerun these vectors on the assembled runtime, validate its full-host integration, and obtain fresh target-runtime readback before promotion. This local receipt must not be substituted for such a readback. ## Qualification boundary This proposal repairs input admission and a numerical sampling edge in the existing bounded reference state-vector simulator. It does not establish a native quantum substrate, quantum hardware execution, physical equivalence, or universal unitarity of all quantum operations. It preserves the distinction among reversible unitary gates, general finite conditional maps, and measurement successors.