==== TABLE OF CONTENTS ====
Entanglement-with-zero-distillable-secret-key-in-local-dimension-ten//applications.tex
Entanglement-with-zero-distillable-secret-key-in-local-dimension-ten//arithmetic.tex
Entanglement-with-zero-distillable-secret-key-in-local-dimension-ten//certificate.tex
Entanglement-with-zero-distillable-secret-key-in-local-dimension-ten//coherence.tex
Entanglement-with-zero-distillable-secret-key-in-local-dimension-ten//combinatorial.tex
Entanglement-with-zero-distillable-secret-key-in-local-dimension-ten//foundations.tex
Entanglement-with-zero-distillable-secret-key-in-local-dimension-ten//geometry.tex
Entanglement-with-zero-distillable-secret-key-in-local-dimension-ten//introduction.tex
Entanglement-with-zero-distillable-secret-key-in-local-dimension-ten//main.tex
Entanglement-with-zero-distillable-secret-key-in-local-dimension-ten//projection.tex
Entanglement-with-zero-distillable-secret-key-in-local-dimension-ten//references.tex
Entanglement-with-zero-distillable-secret-key-in-local-dimension-ten//secret-key.tex
Entanglement-with-zero-distillable-secret-key-in-local-dimension-ten//supplementary-checks.tex
Entanglement-with-zero-distillable-secret-key-in-local-dimension-ten//transcripts.tex
===========================

==== BEGIN Entanglement-with-zero-distillable-secret-key-in-local-dimension-ten//applications.tex ====
\section{The state and a trace-preserving channel}\label{sec:applications}

We now combine the two independent inputs to the main state theorem: the
operational obstruction for the represented class and the product-free Choi
range of the explicit dimension-ten pair.

\begin{proof}[Proof of Theorem~\ref{thm:main-state}]
Take $\Phi_1,\Phi_2$ from \eqref{eq:phi-pair} and put
$Z=J(\Phi_2\circ\Phi_1)$.  Theorem~\ref{thm:main-pair} proves that $Z$ is
nonzero and that its range contains no nonzero product vector.  It is
positive because $\Phi_2\circ\Phi_1$ is CP.  Thus $\lambda=\tr Z>0$, and
$\rho=Z/\lambda$ is a density operator on $\C^{10}\otimes\C^{10}$ with the
same range as $Z$.  Lemma~\ref{lem:product-range} makes $\rho$ entangled.

Both maps are PPT.  Lemma~\ref{lem:choi-transfer}, with $a=b=c=10$, gives
\[
 \rho=(\Phi_1^\sharp\otimes\Phi_2)
       \left(\frac{\Omega_{10}\Omega_{10}^*}{\lambda}\right)
       \in\mathscr C.
\]
In particular, the representing vector is
$\Omega_{10}/\sqrt{\lambda}$; normalization is by the actual Choi trace.
Theorem~\ref{thm:zero-key} now gives \eqref{eq:main-gap} for every $n\geq1$
and every protocol and ideal bit in its stated scope, including the
purification and complete public record.  The same theorem gives
$K_D(\rho)=0$.  All matrices defining $\rho$ are specified by
\eqref{eq:explicit-matrices} and \eqref{eq:phi-pair}, so the state is
explicit.
\end{proof}

The maps $\Phi_1,\Phi_2$ need not preserve trace.  The next proposition
converts any square PPT pair into a trace-preserving PPT channel, while
retaining the pair's composite Choi matrix in a local corner.  The
two-block switch follows Christandl, Müller-Hermes, and Wolf
\cite[Section IV.A]{CMHW2019}.  The enlarged-input absorbing flag follows
Filippov's trace-preserving extension
\cite[Proposition 3, Equation (15)]{Filippov2021}.

\begin{proposition}\label{prop:channel-completion}
Let $\Psi_1,\Psi_2:\Mat m\to\Mat m$ be PPT maps.  There are explicitly
defined constants $c_1,c_2>0$, a trace-preserving PPT channel
$\Theta:\Mat{2m+1}\to\Mat{2m+1}$, and a real coordinate isometry
$W_0:\C^m\to\C^{2m+1}$ such that
\begin{equation}\label{eq:choi-corner}
 (W_0^*\otimes W_0^*)J(\Theta\circ\Theta)(W_0\otimes W_0)
       =c_1c_2J(\Psi_2\circ\Psi_1).
\end{equation}
If $J(\Psi_2\circ\Psi_1)$ is nonseparable, then $\Theta\circ\Theta$ is
not entanglement breaking.
\end{proposition}

\begin{proof}
Define
\begin{equation}\label{eq:channel-effects}
 A_i=\Psi_i^\dagger(I_m),\qquad
 c_i=\frac{1}{1+\tr A_i},\qquad
 F_i=I_m-c_iA_i \quad (i=1,2).
\end{equation}
The adjoint of a CP map is CP, so $A_i\succeq0$.  Since
$A_i\preceq(\tr A_i)I_m$, we have
$F_i\succeq(1-c_i\tr A_i)I_m=c_iI_m\succ0$.
The adjoint identity, using that $A_i$ is Hermitian, gives
\[
 \tr\Psi_i(B)=\tr(A_iB),\qquad
 \tr B-c_i\tr\Psi_i(B)=\tr(F_iB)
\]
for every complex matrix $B$.  Hence $c_i\Psi_i$ is trace nonincreasing
on positive inputs, and the positive effect $F_i$ records the missing
trace.

Use the standard-coordinate decomposition
\[
 \C^{2m+1}=\C^m_0\oplus\C^m_1\oplus\C e_\star,
\]
and let $W_0,W_1$ be the real coordinate inclusions.  For
$X\in\Mat{2m+1}$ write $X_{jj}=W_j^*XW_j$,
$x_\star=e_\star^*Xe_\star$, and $P_\star=e_\star e_\star^*$.  Set
\begin{align}\label{eq:channel}
 \Theta(X)={}&c_2W_0\Psi_2(X_{11})W_0^*
             +c_1W_1\Psi_1(X_{00})W_1^* \notag\\
 &+\bigl(\tr(F_1X_{00})+\tr(F_2X_{11})+x_\star\bigr)P_\star .
\end{align}
The formula discards the off-diagonal input blocks.  The two moving
branches are CP compositions.  For the flag branches, take spectral
decompositions $F_i=\sum_r\lambda_{ir}v_{ir}v_{ir}^*$ and set
\[
 K_{ir}=\sqrt{\lambda_{ir}}\,e_\star v_{ir}^*W_{i-1}^*
       \quad(i=1,2).
\]
Then
$\tr(F_iX_{i-1,i-1})P_\star=\sum_r K_{ir}XK_{ir}^*$.
The remaining flag term is $P_\star XP_\star$.  Thus $\Theta$ is CP.
Since $c_iA_i+F_i=I_m$, for every complex $X$,
\begin{align*}
 \tr\Theta(X)
 &=\tr\bigl[(c_1A_1+F_1)X_{00}\bigr]
   +\tr\bigl[(c_2A_2+F_2)X_{11}\bigr]+x_\star\\
 &=\tr X_{00}+\tr X_{11}+x_\star=\tr X.
\end{align*}
The discarded blocks have zero trace, so $\Theta$ is trace preserving.

Because $W_0,W_1,e_\star$ have real coordinates, output transposition in
\eqref{eq:channel} replaces $\Psi_i$ by $T_m\circ\Psi_i$ in the moving
branches and fixes the flag output.  Coordinate transpose is complex-linear:
it does not conjugate the possibly complex scalar multiplying $P_\star$.
The effects $F_i$ need not be real.  Each transposed moving branch is CP by
the PPT hypothesis, and the flag branches are CP as shown above.  Therefore
$T_{2m+1}\circ\Theta$ is CP, proving that $\Theta$ is PPT.

The flag is absorbing: $\Theta(P_\star)=P_\star$.  Applying
\eqref{eq:channel} twice to an input on the first block gives, for every
$B\in\Mat m$,
\begin{align*}
 \Theta^2(W_0BW_0^*)
 ={}&c_1c_2W_0\Psi_2(\Psi_1(B))W_0^*\\
 &+\bigl(\tr(F_1B)+c_1\tr(F_2\Psi_1(B))\bigr)P_\star .
\end{align*}
Compression to that block consequently gives
\begin{equation}\label{eq:square-corner}
 W_0^*\Theta^2(W_0BW_0^*)W_0
       =c_1c_2\Psi_2(\Psi_1(B)).
\end{equation}
Expanding in the coordinate matrix units of the input turns
\eqref{eq:square-corner} into \eqref{eq:choi-corner}.  The coordinate
qualification fixes the reference factor: for general complex isometries
$W,V$ and a compatible map $\Gamma$,
\[
 J\bigl(B\mapsto V^*\Gamma(WBW^*)V\bigr)
   =(W^{\T}\otimes V^*)J(\Gamma)(\overline W\otimes V).
\]
Here $W_0$ is real, so the reference factor is exactly the one displayed in
\eqref{eq:choi-corner}.

Local compression preserves separability, since it takes a positive product
$A\otimes B$ to
$(W_0^*AW_0)\otimes(W_0^*BW_0)$.  Thus separability of $J(\Theta^2)$
would imply separability of the positive multiple
$c_1c_2J(\Psi_2\circ\Psi_1)$ in \eqref{eq:choi-corner}.  This proves the
last assertion.
\end{proof}

\begin{proof}[Proof of Theorem~\ref{thm:main-channel}]
Apply Proposition~\ref{prop:channel-completion} with $m=10$ and
$\Psi_i=\Phi_i$ from \eqref{eq:phi-pair}.  Their composite Choi matrix is
nonseparable by Theorem~\ref{thm:main-pair} and
Lemma~\ref{lem:product-range}.  Formula \eqref{eq:channel} therefore gives
the required PPT channel on $\Mat{21}$.
\end{proof}

The product-free range assertion is used for the compressed matrix $Z$.
The full channel Choi matrix has a product contribution from the absorbing
flag: since $\Theta$ annihilates off-diagonal blocks involving $e_\star$ and
$\Theta(P_\star)=P_\star$, the matrix $P_\star\otimes P_\star$ is a direct
summand of $J(\Theta^2)$.  The channel conclusion is the nonseparability of
the full Choi matrix, certified by its entangled corner.
==== END Entanglement-with-zero-distillable-secret-key-in-local-dimension-ten//applications.tex ====

==== BEGIN Entanglement-with-zero-distillable-secret-key-in-local-dimension-ten//arithmetic.tex ====
\section{Details of the dimension-ten certificate}
\label{app:arithmetic}

\subsection{Finite arithmetic}

This subsection gives the exact arithmetic support for the block identities
\eqref{eq:block-symmetry} and the finite-field data in
Section~\ref{sec:certificate}.  The Python 3 program below uses only the
standard library and integer arithmetic.  Its input matrix entries are
those of \eqref{eq:explicit-matrices}, with zero-based row indices in the
code.

The function \texttt{checksym} uses only $i<j$ and column indices $a<b$.
The cases $i=j$ and $a=b$ vanish identically, while exchanging either pair
of indices changes the sign of the same difference.  Thus these strict
loops check every equality in \eqref{eq:block-symmetry}.

The code variable \texttt{R} is the coefficient array $[D\mid H]$, and
\texttt{T} is the reduction of $N$ modulo the current prime.  The program
expands each determinant over the $4!$ permutations, collects coefficients
in the order \eqref{eq:monomial-order}, and performs Gaussian elimination
on $H$ modulo each prime.  The columns of \texttt{T} are the reductions of
the columns in \eqref{eq:N}.

For $f(z)=z^{20}+c_1z^{19}+\cdots+c_{20}$, with $c_0=1$, the program uses
the Newton identities
\[
 k c_k=-\sum_{i=0}^{k-1}c_i\tr(N^{k-i})\qquad(1\leq k\leq20).
\]
Division by $k$ is valid at each of $41,131,139$.  Repeated $p$th powers
modulo $\overline f$ then give the residues of $z^{p^k}$, and the polynomial
Euclidean algorithm gives $d_p(k)$.  All inverses are taken in the stated
prime field.  No floating-point approximation or heuristic search is
involved.

The program asserts the integer block identities and prints the modular
data.  Verification of the modular certificate includes comparing the
printed output with the recorded values below.  The operator, projective, and Galois deductions
are proved in Sections~\ref{sec:geometry} and \ref{sec:certificate}, using
the algebraic facts proved in the next subsection.  The program does not
perform a general elimination or Galois-group computation.

From the paper directory, run
\texttt{python3 verification/exact\_certificate.py} with assertions enabled,
without the \texttt{-O} or \texttt{-OO} optimization options, and with
\texttt{PYTHONOPTIMIZE} unset.

The listing uses an identical build copy of the verification source; its line numbers refer to that source file.

\lstinputlisting[firstnumber=1,caption={Exact verification of the matrix identities and modular certificate.},label={lst:certificate}]{../../verification/exact_certificate.py}

The file \texttt{verification/certificate-output.txt} records the values below; an identical build copy is used for typesetting.
Coefficients of
$\overline f$ are in leading-first order, and the gcd-degree lists are
ordered by $k=1,\ldots,20$.  The first line for each prime gives $p$ and
$\det H\bmod p$.

\lstinputlisting[language={},numbers=none,basicstyle=\ttfamily\footnotesize,caption={Recorded output of the exact verification program.},label={lst:certificate-output}]{../../verification/certificate-output.txt}

\subsection{Algebraic facts}
\label{app:certificate-algebra}

We prove the three general lemmas used in Section~\ref{sec:certificate}.
The first supplies a common zero used to prove the affine quotient nonzero;
the second accommodates rational coefficients with denominators prime to $p$;
the third converts squarefree modular factor degrees into Galois permutations.

\begin{proof}[Proof of Lemma~\ref{lem:six-bilinear}]
Let $X_0,\ldots,X_3,Y_0,\ldots,Y_3$ be indeterminates, put $u_{ij}=X_iY_j$,
and consider the finitely generated complex algebra
\[
 \mathcal R=\C[u_{ij}:0\leq i,j<4]
 \subset\C[X_0,\ldots,X_3,Y_0,\ldots,Y_3].
\]
It is a Noetherian domain.  Its closed complex points are exactly the
matrices of rank at most one.  Indeed, the identities
$u_{ij}u_{k\ell}=u_{i\ell}u_{kj}$ force the values at any point to have
rank at most one, and every such matrix is $xy^{\T}$ and defines an
evaluation of $\mathcal R$.  The maximal ideal
$\mathfrak m=(u_{ij}:0\leq i,j<4)$ corresponds to the zero matrix.

For $1\leq a,b\leq4$, put
$P_{a,b}=(u_{ij}:i\geq a\text{ or }j\geq b)$.  The quotient by $P_{a,b}$
is the domain $\C[X_iY_j:0\leq i<a,\ 0\leq j<b]$.  To justify the
identification, use the monomial basis $X^\alpha Y^\beta$ with
$|\alpha|=|\beta|$ for $\mathcal R$: a monomial containing an excluded
variable factors by an excluded generator, while the remaining monomials
stay distinct.  Hence
\[
 0=P_{4,4}\subsetneq P_{3,4}\subsetneq P_{2,4}\subsetneq P_{1,4}
 \subsetneq P_{1,3}\subsetneq P_{1,2}\subsetneq P_{1,1}
 \subsetneq\mathfrak m
\]
is a strict chain of prime ideals.  In particular,
$\operatorname{ht}\mathfrak m\geq7$.

Let $\ell_1,\ldots,\ell_6\in\mathcal R$ be the linear combinations of
the $u_{ij}$ representing the six bilinear forms, and put
$\mathfrak a=(\ell_1,\ldots,\ell_6)$.  If the only common zero on the
rank-at-most-one matrices were the zero matrix, the Hilbert
Nullstellensatz for the finite-type complex algebra $\mathcal R$ would
give $\sqrt{\mathfrak a}=\mathfrak m$.  The prime $\mathfrak m$ would
then be minimal over an ideal generated by six elements.  Krull's height
theorem bounds the height of such a prime in a Noetherian ring by six,
contradicting the chain above
\cite[Tags 00FV and 0BBZ(1)]{Stacks}.  Thus a nonzero rank-one matrix
$xy^{\T}$ annihilates all six forms.  Both factors are nonzero.
\end{proof}

\begin{proof}[Proof of Lemma~\ref{lem:monic-local-reduction}]
Normalize the valuation by $v_p(p)=1$.  In either pair its values on
nonzero elements are integers, and $R_p/pR_p=\F_p$.  For a nonzero
polynomial $a(z)=\sum_i a_i z^i$ over $\mathbb L$, put
$\nu(a)=\min_{a_i\ne0}v_p(a_i)$.  Scaling nonzero polynomials $a,b$ by
$p^{-\nu(a)}$ and $p^{-\nu(b)}$ makes their coefficients integral with
least valuation zero.  Their reductions are nonzero and have nonzero
product in the domain $\F_p[z]$.  Thus
\[
 \nu(ab)=\nu(a)+\nu(b).
\]
For monic $g,h$ one has $\nu(g),\nu(h)\leq0$, whereas the monic
$P\in R_p[z]$ has $\nu(P)=0$.  Additivity forces
$\nu(g)=\nu(h)=0$, so all coefficients of both factors are integral.
Their leading coefficients remain one after reduction, which preserves
their degrees; a monic constant factor is $1$ and retains degree zero.
Any factorization of $P$ into two positive-degree polynomials over
$\mathbb L$ can be normalized to monic factors, whose reductions would
still have positive degree.  This contradicts irreducibility of the
reduction of $P$.
\end{proof}

\begin{proof}[Proof of Lemma~\ref{lem:local-frobenius}]
Embed the coefficients of $F$ into $\mathbb Z_p$ and put
$s=\operatorname{lcm}(s_1,\ldots,s_h)$.  Choose a monic irreducible
$\overline g\in\F_p[X]$ of degree $s$ and a monic coefficient lift
$g\in\mathbb Z_p[X]$; we use the standard finite-field fact that an
irreducible polynomial of every positive degree exists.  Lemma
\ref{lem:monic-local-reduction} for $(\Q_p,\mathbb Z_p)$ shows that $g$
is irreducible over $\Q_p$.  If $\alpha$ is a root, put
\[
 E=\Q_p(\alpha),\qquad
 \mathcal O=\mathbb Z_p[\alpha]\simeq\mathbb Z_p[X]/(g).
\]
The ring $\mathcal O$ is free of rank $s$ over $\mathbb Z_p$, hence
complete and separated for the $p$-adic topology, and
$\mathcal O/p\mathcal O\simeq\F_{p^s}$.  Every element with nonzero
residue is a unit: lift an inverse modulo $p$ and correct it by a
convergent geometric series.

Every simple residue root of a polynomial in $\mathbb Z_p[z]$ lifts
uniquely to a root in $\mathcal O$.  To see this, suppose $r_n$ is a
root modulo $p^n$ whose derivative has nonzero residue.  The first-order
Taylor congruence gives a unique residue class of $c$ such that
$r_{n+1}=r_n+p^nc$ is a root modulo $p^{n+1}$.  Completeness gives a
limiting root.  If two roots have the same simple residue, the polynomial
difference factorization writes their difference times a unit as zero;
the roots therefore coincide.

Every root of $\overline F$ lies in $\F_{p^s}$ and is simple.  Lifting
them gives $\deg F$ distinct roots of $F$ in $\mathcal O$, hence all
the roots.  Finite fields are perfect, so $\overline\alpha^{\,p}$ is a
simple root of $\overline g$.  Lift it to a root $\beta\in\mathcal O$ of
$g$.  Sending $\alpha$ to $\beta$ defines a $\Q_p$-embedding $E\to E$,
because $g$ is irreducible.  This embedding is an automorphism $\sigma$,
as $E$ is finite-dimensional over $\Q_p$.

Since $\beta\in\mathcal O$, we have $\sigma(\mathcal O)\subseteq\mathcal O$.
The induced residue map fixes $\F_p$ and sends $\overline\alpha$ to
$\overline\alpha^{\,p}$, so it is Frobenius on $\F_{p^s}$.  In a
$\mathbb Z_p$-basis of $\mathcal O$, the matrix of this endomorphism
reduces to an invertible residue matrix.  Its determinant is a $p$-adic
unit, and therefore $\sigma(\mathcal O)=\mathcal O$.

If $\rho_r$ is the lifted root of $F$ with residue $r$, uniqueness of
lifting gives $\sigma(\rho_r)=\rho_{r^p}$.  Thus the permutation of the
lifted roots has exactly the Frobenius cycle lengths on their residues,
namely $s_1,\ldots,s_h$.  The subfield of $E$ generated over $\Q$ by
these roots is a rational splitting field of $F$.  The automorphism
$\sigma$ permutes its generating roots and hence preserves this subfield.
Its restriction is the required rational Galois automorphism.  A
$\Q$-isomorphism transports the statement to any chosen splitting field.
\end{proof}
==== END Entanglement-with-zero-distillable-secret-key-in-local-dimension-ten//arithmetic.tex ====

==== BEGIN Entanglement-with-zero-distillable-secret-key-in-local-dimension-ten//certificate.tex ====
\section{An integer pencil and its exact certificate}
\label{sec:certificate}

This section verifies every hypothesis of Proposition~\ref{prop:tensor-criterion}
for an explicit map $L:\Mat4\to\Mat4$.  Four integer $6$-by-$4$ matrices
$M_0,\ldots,M_3$ define $L$ and the pencil $M(x)=\sum_{i=0}^3x_iM_i$.
The maximal minors of this pencil identify all singular projective directions.
Exact reductions at three primes, together with the quotient and Galois
arguments below, control quadratic evaluations on every ten of those
directions.

\subsection{The explicit matrix pencil}

Use indices $0,1,2,3$ and define real $6$-by-$4$ matrices
\begin{equation}
\begin{aligned}
M_0&=\begin{pmatrix}
6&0&0&0\\0&6&0&0\\0&0&6&0\\0&0&0&6\\0&0&0&0\\0&0&0&0
 \end{pmatrix},&
M_1&=\begin{pmatrix}
-12&0&0&0\\0&-6&0&0\\0&0&6&0\\0&0&0&12\\-6&0&6&6\\-6&-6&6&0
 \end{pmatrix},\\[2mm]
M_2&=\begin{pmatrix}
0&6&-2&0\\6&6&0&2\\-2&0&10&0\\0&2&0&24\\0&0&0&6\\0&-6&6&-6
 \end{pmatrix},&
M_3&=\begin{pmatrix}
0&0&-4&-3\\0&-2&-3&-4\\-4&-3&11&6\\-3&-4&6&25\\6&6&0&0\\0&-6&6&6
 \end{pmatrix}.
\end{aligned}
\label{eq:explicit-matrices}
\end{equation}
For $x=(x_0,x_1,x_2,x_3)\in\C^4$, put $M(x)=\sum_{i=0}^3x_iM_i$ and define
the complex-linear map $L$ on matrix units by
\begin{equation}
 L(E_{ij})=M_i^{\T}M_j\qquad(0\leq i,j<4).
 \label{eq:L}
\end{equation}

\begin{lemma}\label{lem:pencil-ppt}
The map $L:\Mat4\to\Mat4$ in \eqref{eq:L} is PPT.  For every $x\in\C^4$,
\begin{equation}
 L(P_x)=M(x)^{\T}\overline{M(x)}=M(x)^*M(x),\qquad
 \rank L(P_x)=\rank M(x).
 \label{eq:gram-identity}
\end{equation}
Moreover, $L(P_{e_0})=36I_4$.
\end{lemma}

\begin{proof}
Direct integer multiplication gives
\begin{equation}
 M_i^{\T}M_j=M_j^{\T}M_i\qquad(0\leq i,j<4).
 \label{eq:block-symmetry}
\end{equation}
The exact checker in Appendix~\ref{app:arithmetic} verifies these
equalities.  For each row $r$, let $Q_r$ be the $4$-by-$4$ matrix whose
$i$th column is the transpose of row $r$ of $M_i$.  Comparing entries gives
$L(A)=\sum_{r=1}^6Q_rAQ_r^*$, so $L$ is CP.  Equation
\eqref{eq:block-symmetry} also makes every $M_i^{\T}M_j$ symmetric.
Therefore $T_4\circ L=L$, proving the PPT property.

For complex $x$, expansion of \eqref{eq:L} gives
\[
 L(P_x)=\sum_{i,j}x_i\overline{x_j}M_i^{\T}M_j
       =M(x)^{\T}\overline{M(x)}.
\]
Interchanging $i,j$ and using \eqref{eq:block-symmetry} gives the second
expression in \eqref{eq:gram-identity}.  Since
$v^*M(x)^*M(x)v=\norm{M(x)v}^2$, the kernel of this Gram matrix is
$\ker M(x)$, which proves the rank equality.  Finally,
$M_0^{\T}M_0=36I_4$.
\end{proof}

The positive-definite input required by the tensor criterion is now
available.  The remaining assertion concerns every complex rank-loss
direction of the pencil.

\begin{proposition}[Twenty rank-loss directions with independent quadratic evaluations]
\label{prop:twenty-directions}
The projective directions $[x]\in\mathbb P^3(\C)$ for which
$\rank M(x)<4$ consist of exactly twenty distinct points.  Each has a
unique representative $x=(1,t_1,t_2,t_3)$.  Every nonzero homogeneous
quadratic in $\C[x_0,x_1,x_2,x_3]$ vanishes on at most nine of these
representatives.
\end{proposition}

The equation $M(x)y=0$ with $x,y\ne0$ is related to the bilinear kernel
geometry studied by Hansen, Hauge, Myrheim, and Sollid for $4$-by-$4$ PPT
states whose matrix and partial transpose both have rank six
\cite[Sections 2.2 and 7]{HansenEtAl2012}.
Their generic count concerns twenty product rays $x\otimes y$.  The
quadratic condition here concerns the vectors $x\otimes x$ for this
specific pencil, and the following argument proves it from exact data.

\noindent\textit{Proof of Proposition~\ref{prop:twenty-directions}.}
The maximal-minor relations first show that the affine quotient is nonzero
and spanned by twenty monomials.  We then construct a formal multiplication
matrix.  Its irreducible characteristic polynomial, certified modulo $41$,
proves that the spanning monomials are independent and that the quotient
is a degree-twenty field.  This identifies all twenty complex directions.
Finally, reductions at $131$ and $139$ give the full symmetric Galois action,
which transports one independent set of ten quadratic evaluations to every
such set.  The three general algebraic facts used along the way are stated
at their uses; their proofs are collected in
Appendix~\ref{app:certificate-algebra}.

The checker in Appendix~\ref{app:arithmetic} supplies the integer block
identities and the finite modular data used in these stages.  It does not
enumerate the twenty complex directions or their ten-point determinants.
The quotient, projective, and Galois deductions are proved below.

\subsection{The maximal minors and a nonzero quotient}

Because $M(x)$ has four columns, the condition $\rank M(x)<4$ is equivalent
to simultaneous vanishing of its fifteen maximal minors.  For each
four-element subset $\rho\subset\{1,\ldots,6\}$, taken in lexicographic
order with its rows in increasing order, let $\Delta_\rho(x)$ be the
determinant of those rows of $M(x)$.  Put
$p_\rho(t)=\Delta_\rho(1,t_1,t_2,t_3)$ and define
\[
 I=(p_\rho)_\rho\subset\Q[t_1,t_2,t_3],\qquad
 \mathcal A=\Q[t_1,t_2,t_3]/I.
\]
These equations describe the singular directions in the chart $x_0=1$.
We have not yet proved that $I$ is proper, or that this chart contains all
the singular directions.

Order monomials first by increasing total degree $d$ and, within degree
$d$, by the exponent triples
\begin{equation}
 (a,b,d-a-b),\qquad a=0,\ldots,d,\quad b=0,\ldots,d-a,
 \label{eq:monomial-order}
\end{equation}
in the displayed nested order.  Let $v$ be the column of the twenty
monomials of degree at most three, and let $w$ be the column of the fifteen
monomials of degree four.  The coefficients of the minors define integer
matrices $D,H$ by
\begin{equation}
 (p_\rho(t))_\rho=Dv(t)+Hw(t),\qquad
 D\in\mathbb Z^{15\times20},\quad H\in\mathbb Z^{15\times15}.
 \label{eq:DH}
\end{equation}

The exact coefficient calculation in Appendix~\ref{app:arithmetic} gives
$\det H\equiv40\pmod{41}$, so $H$ is invertible over $\Q$.  Define
$C=-H^{-1}D$.  In the quotient $\mathcal A$, Equation~\eqref{eq:DH} gives
the relations $w=Cv$, expressing each degree-four monomial as a linear
combination of the twenty lower monomials.

The relations $w=Cv$ must describe a nonzero quotient before they can
be used to count its points.  We first verify this and show that the low
monomials span.  The existence argument uses the following intersection
fact for $\mathbb P^3\times\mathbb P^3$.

\begin{lemma}[Six bilinear equations]\label{lem:six-bilinear}
Any six complex bilinear forms on $\C^4\times\C^4$ have a common zero
$(x,y)$ with $x\ne0$ and $y\ne0$.
\end{lemma}

The proof is given in Appendix~\ref{app:certificate-algebra}.

Apply the lemma to the six rows of
$M(x)y$.  It gives $x,y\ne0$ with $M(x)y=0$, so all $\Delta_\rho(x)$
vanish.

The homogeneous degree-four part of $p_\rho(t)$ is
$\Delta_\rho(0,t_1,t_2,t_3)$.  Equation~\eqref{eq:DH} therefore gives
\[
 \bigl(\Delta_\rho(0,t)\bigr)_\rho=Hw(t).
\]
If a common zero had $x_0=0$, invertibility of $H$ would imply $w(t)=0$.
The entries $t_1^4,t_2^4,t_3^4$ occur in $w$, so $t=0$, contradicting
$x\ne0$.  Thus every projective common zero lies in the chart $x_0=1$.
Rescaling the zero furnished by the lemma gives an affine common zero of
the $p_\rho$, proving that $I$ is proper and $\mathcal A\ne0$.  The same
argument has excluded all points at infinity.

In $\mathcal A$, the relations $w=Cv$ show that the twenty low monomials
span.  In a monomial of total degree at least four, substitute for any
degree-four factor.  Each resulting term has strictly smaller total
degree.  Induction reduces every monomial to a linear combination of
the low monomials; this proves spanning without assuming unique
reductions.

\subsection{A formal multiplication operator}

Multiplication matrices are a standard way to encode finite polynomial
systems; see Sottile \cite[Section 2.3]{Sottile2001}.  The quotient
$\mathcal A$ is now known to be nonzero and spanned by the
twenty low monomials, but their independence remains to be proved.
Take a formal twenty-dimensional rational vector space with basis
$e_\alpha$ indexed by exponent triples $|\alpha|\leq3$, in the order
\eqref{eq:monomial-order}.  Define an endomorphism $N$ of this formal
space and its characteristic polynomial by
\begin{equation}
 Ne_\alpha=
 \begin{cases}
 e_{\alpha+(1,0,0)},&|\alpha|\leq2,\\[1mm]
 \displaystyle\sum_{|\beta|\leq3}
 C_{\alpha+(1,0,0),\beta}e_\beta,&|\alpha|=3,
 \end{cases}
 \qquad f(z)=\det(zI_{20}-N).
 \label{eq:N}
\end{equation}
The row index of $C$ in the second line is the indicated degree-four
monomial.  Let $\pi:\Q^{20}\to\mathcal A$ send $e_\alpha$ to the class of
$t^\alpha$, and let $\mu_1$ be multiplication by the class of $t_1$.
The spanning result makes $\pi$ surjective.  By the definition of $N$,
\begin{equation}
 \pi N=\mu_1\pi.
 \label{eq:intertwining}
\end{equation}
In particular, $\ker\pi$ is an $N$-invariant rational subspace.
We will use irreducibility of $f$ to show that this kernel is zero,
which will identify $N$ with multiplication by $t_1$.

For a prime $p$ with $\det H\not\equiv0\pmod p$, set
\[
 \mathbb Z_{(p)}=\{a/b:a,b\in\mathbb Z,\ p\nmid b\}.
\]
The identity $H^{-1}=\operatorname{adj}(H)/\det H$ shows that the entries
of $C,N$ and the coefficients of the monic polynomial $f$ lie in
$\mathbb Z_{(p)}$.  In particular their denominators are units at $p$,
and reduction gives
$\overline f=\det(zI_{20}-\overline N)\in\F_p[z]$.  This is a statement
of integrality at the specified prime; no global integrality of the
coefficients of $f$ is needed.

For $k\geq1$, put
\[
 d_p(k)=\deg\gcd(\overline f,z^{p^k}-z).
\]
The exact calculation in Appendix~\ref{app:arithmetic} gives the computed
columns of Table~\ref{tab:modular-certificate}.  Its output also records all twenty-one characteristic
coefficients and all twenty gcd degrees at each prime.

\begin{table}[htbp]
\centering
\caption{Computed modular data and the factor degrees deduced from them.}
\label{tab:modular-certificate}
\begin{tabular}{@{}ccll@{}}
\toprule
$p$ & $\det H\bmod p$ & \shortstack{computed\\gcd degrees} &
\shortstack{deduced\\factor degrees}\\
\midrule
41 & 40 & $d_{41}(k)=0\ (1\leq k<20),\ d_{41}(20)=20$ & $20$\\
131 & 23 & $d_{131}(1)=1,\ d_{131}(2)=3,\ d_{131}(17)=18$ & $1,2,17$\\
139 & 9 & $d_{139}(1)=1,\ d_{139}(19)=20$ & $1,19$\\
\bottomrule
\end{tabular}
\end{table}

The determinant residues justify all three local reductions.  The primes
exceed twenty, so the divisions in the Newton identities used to compute
the characteristic polynomials are valid.  Their primality follows by
trial division by the primes at most eleven.

We explain the last column of the table.  Over $\F_p$ the polynomial
$z^{p^k}-z$ is squarefree, since its derivative is $-1$.  Its irreducible
factors are precisely the monic irreducible polynomials whose degrees
divide $k$: a root of an irreducible polynomial of degree $s$ has a
Frobenius orbit of length $s$.  Hence $d_p(k)$ is the sum of the degrees of
the \emph{distinct} irreducible factors of $\overline f$ whose degrees
divide $k$.  At $p=41$, a factor of degree $s<20$ would make $d_{41}(s)$
positive, so $\overline f$ is irreducible of degree twenty.  At $p=131$,
the three displayed values force one factor of degree one, one of degree
two, and one of degree seventeen.  These degrees already sum to twenty,
so there are no further or repeated factors.  The two values at $p=139$
similarly force one factor of degree one and one of degree nineteen,
without repetition.  All three reductions are squarefree.

The following elementary reduction lemma lets us infer rational
irreducibility without assuming that $f$ has integer coefficients.
Its $p$-adic form is used in the proof of Lemma~\ref{lem:local-frobenius}
in Appendix~\ref{app:certificate-algebra}.

\begin{lemma}[Monic local reduction]\label{lem:monic-local-reduction}
Let $p$ be a prime, and let the coefficient field and its valuation ring be
one of the pairs
\[
 (\mathbb L,R_p)=(\Q,\mathbb Z_{(p)})
 \quad\text{or}\quad
 (\mathbb L,R_p)=(\Q_p,\mathbb Z_p).
\]
If a monic polynomial $P\in R_p[z]$ factors as $P=gh$ with monic
$g,h\in\mathbb L[z]$, then $g,h\in R_p[z]$, and their reductions modulo
$p$ retain their degrees, including degree zero.  Consequently, if $P$
has positive degree and irreducible reduction in $\F_p[z]$, then $P$ is
irreducible over $\mathbb L$.
\end{lemma}

The proof is given in Appendix~\ref{app:certificate-algebra}.

Applying the lemma to $f\in\mathbb Z_{(41)}[z]$ and its irreducible
reduction proves that $f$ is irreducible over $\Q$.

\subsection{The coordinate field and its twenty points}

We can now prove independence of the twenty spanning monomials.
An endomorphism
with irreducible characteristic polynomial has no nonzero proper invariant
subspace: a basis adapted to such a subspace makes the matrix block
triangular and factors its characteristic polynomial into those of the
restriction and quotient.  Since $\pi$ is surjective and
$\mathcal A\ne0$, its kernel is proper.  Irreducibility of $f$ forces
$\ker\pi=0$.  The twenty low monomials are therefore a basis of
$\mathcal A$, and $N$ is its multiplication matrix for $t_1$.

By Cayley--Hamilton the minimal polynomial of $N$ divides $f$.  It is
nonconstant, so irreducibility of $f$ makes it equal to $f$.  In a nonzero
unital algebra, a polynomial in an element vanishes exactly when the
same polynomial in its multiplication operator vanishes; the reverse
implication follows by applying the operator to $1$.  Hence the
subalgebra generated by $t_1$ is $\Q[z]/(f)$ and has dimension twenty.
It is already all of $\mathcal A$:
\begin{equation}
 \mathcal A\simeq\Q[z]/(f),\qquad z\longmapsto t_1.
 \label{eq:coordinate-field}
\end{equation}
In particular $\mathcal A$ is a field.  Write the classes of $t_2,t_3$
as $h_2(t_1),h_3(t_1)$ with $h_2,h_3\in\Q[z]$ of degree below twenty.

The irreducible polynomial $f$ is separable in characteristic zero.
Let its distinct complex roots be $\lambda_1,\ldots,\lambda_{20}$.
Extending scalars in \eqref{eq:coordinate-field} and applying the Chinese
remainder theorem gives
\begin{equation}
 \C[t_1,t_2,t_3]/I\C[t_1,t_2,t_3]
 \simeq\C[z]/(f)\simeq\prod_{j=1}^{20}\C.
 \label{eq:split-algebra}
\end{equation}
The factors are evaluations at the distinct triples
\begin{equation}
 t^{(j)}=(\lambda_j,h_2(\lambda_j),h_3(\lambda_j)).
 \label{eq:points}
\end{equation}
Conversely, any complex common zero of the $p_\rho$ defines a unital
$\C$-algebra homomorphism from the left side of
\eqref{eq:split-algebra} to $\C$, and such a homomorphism selects one
factor of the product.  Thus the triples in \eqref{eq:points} are all the
affine common zeros.  The product of fields also shows that the complex
ideal is radical, so these twenty points are reduced.  Together with the
exclusion of $x_0=0$, this identifies all complex projective singular
directions of the pencil.


\subsection{Local Frobenius and quadratic evaluations}

It remains to prove that no nonzero quadratic vanishes on ten of the
directions.  We will show that the Galois group of the splitting field
permutes the twenty roots arbitrarily.  This transports independence for
one set of ten evaluations to every set of ten.

The following is the locally integral form of the Frobenius
factorization principle, often called Dedekind's theorem.  Milne states
the monic integer case \cite[Theorem 4.28]{Milne2022}.  We give the local
rational argument needed for the coefficients of $f$.

\begin{lemma}[Locally integral Frobenius]\label{lem:local-frobenius}
Let $F\in\Q[z]$ be monic, separable, and of positive degree, with
coefficients in $\mathbb Z_{(p)}$.  If its reduction in $\F_p[z]$ is
squarefree with irreducible-factor degrees $s_1,\ldots,s_h$, then the
Galois group of its rational splitting field contains an element with
cycle lengths $s_1,\ldots,s_h$ on the roots.
\end{lemma}

The proof is given in Appendix~\ref{app:certificate-algebra}.

Let $\mathbb K\subset\C$ be a splitting field of $f$, and let
$G=\operatorname{Gal}(\mathbb K/\Q)$ act on its twenty roots.  Applying
Lemma~\ref{lem:local-frobenius} to the reductions at $131$ and $139$
gives elements of cycle types $(1,2,17)$ and $(1,19)$.  Irreducibility
of $f$ makes this action transitive.  A nineteen-cycle fixes one root and
is transitive on the other nineteen, so the stabilizer of that root is
transitive on its complement.  Transitivity conjugates this property to
every point stabilizer; hence $G$ is transitive on ordered pairs of
distinct roots, or two-transitive.  The seventeenth power of an element
of type $(1,2,17)$
is a transposition.  Two-transitivity sends its two entries to any
ordered pair, and conjugation therefore gives every transposition.  Thus
\begin{equation}
 G=S_{20}.
 \label{eq:galois-group}
\end{equation}
This is the elementary permutation criterion recorded in
Milne \cite[Lemma 4.31]{Milne2022}.  The group in
\eqref{eq:galois-group} is the splitting-field group acting on the
twenty roots.

Form the $20$-by-$10$ evaluation matrix over $\mathbb K$
\[
 \mathcal E_{j,\alpha}=(t^{(j)})^\alpha,\qquad
 1\leq j\leq20,\quad |\alpha|\leq2.
\]
Its entries lie in $\mathbb K$ by \eqref{eq:points}.  The ten column
monomials belong to the basis of $\mathcal A$ already proved above.
They remain independent after scalar extension to $\mathbb K$, where
the split algebra is $\mathbb K^{20}$ through evaluation at the
twenty triples.  Hence $\mathcal E$ has column rank ten over
$\mathbb K$, so some ten-row square submatrix has nonzero determinant.

Every $\sigma\in G$ permutes the triples in \eqref{eq:points} according
to its permutation of the roots, since $h_2,h_3$ have rational
coefficients.  In particular
$\sigma(\mathcal E_{j,\alpha})=\mathcal E_{\sigma(j),\alpha}$.
The group $S_{20}$ is transitive on ten-element subsets.  Applying a
suitable $\sigma$ to the known nonzero determinant therefore gives,
up to a row-order sign, the determinant for any prescribed ten rows.
A field automorphism preserves nonzero elements, so every such
determinant is nonzero in $\mathbb K$ and hence in $\C$.  The Galois
action has been used only on algebraic determinants; their nonvanishing
gives invertibility for arbitrary complex coefficient vectors.

Every homogeneous quadratic has a unique expression
\[
 q(x_0,x_1,x_2,x_3)=\sum_{|\alpha|\leq2}
 a_\alpha x_0^{2-|\alpha|}
 x_1^{\alpha_1}x_2^{\alpha_2}x_3^{\alpha_3}.
\]
Its dehomogenization $q(1,t)$ is nonzero exactly when $q$ is nonzero.
If it vanished at ten triples, the corresponding invertible evaluation
matrix would force every $a_\alpha=0$.  Thus it vanishes on at most
nine triples.  The identification of all common zeros above, the
exclusion of $x_0=0$, and the equivalence between vanishing of the
maximal minors and $\rank M(x)<4$ now prove
Proposition~\ref{prop:twenty-directions}.\qed

\begin{proof}[Proof of Theorem~\ref{thm:main-pair}]
Take $L$ from \eqref{eq:L}.  Lemma~\ref{lem:pencil-ppt} supplies its PPT
property, the rank identity, and the positive-definite input
$L(P_{e_0})=36I_4$.  Proposition~\ref{prop:twenty-directions} supplies
the twenty distinct directions and the quadratic bound.  Proposition
\ref{prop:tensor-criterion} therefore applies, with the explicit maps
in \eqref{eq:phi-pair} determined by the integer matrices
\eqref{eq:explicit-matrices}.

The positive test also gives an exact nonzero Choi value.  Since
$\widehat{e_0}=e_{00}$, Equations~\eqref{eq:SR} and
\eqref{eq:choi-pairing} yield
\[
 S(P_{e_{00}})=R(P_{e_{00}})=36^2I_6,\qquad
 (e_{00}\otimes e_{00})^*Z(e_{00}\otimes e_{00})
 =6\cdot36^4=10{,}077{,}696>0.
\]
Thus the constructed pair has the asserted nonzero product-free
composite Choi range, and its composite is not entanglement breaking.
\end{proof}
==== END Entanglement-with-zero-distillable-secret-key-in-local-dimension-ten//certificate.tex ====

==== BEGIN Entanglement-with-zero-distillable-secret-key-in-local-dimension-ten//coherence.tex ====
\section{A four-effect coherence bound}
\label{sec:coherence}

The first step in the operational argument is an inequality for four
arbitrary positive local matrices.  It compares the coherence between
two equal-bit branches with the weights of branches in which the two
bits differ.  The matrices need not form measurements: later they will
be densities at a fixed public transcript, where pointwise
normalization is not required.

We use the represented class $\mathscr C$ of
Definition~\ref{def:represented-class}.  Thus, if $\omega\in\mathscr C$
acts on $\C^p\otimes\C^q$, then for some positive integers $r,s$ it has
a representation
\[
 \omega=(\mathcal L\otimes\mathcal M)(\chi\chi^*),
 \qquad
 \chi\in\C^r\otimes\C^s,
\]
where $\mathcal L:\Mat{r}\to\Mat{p}$ and
$\mathcal M:\Mat{s}\to\Mat{q}$ satisfy that
$\mathcal L,\mathcal L\circ T_r,\mathcal M,\mathcal M\circ T_s$
are completely positive.  Only $\omega$ has trace one; the vector and
the rectangular maps have no normalization requirement.  We will use
that freedom to change coordinates on the input of $\mathcal L$.

\begin{lemma}[Positive block estimate]\label{lem:positive-block}
Let $H$ and $J$ be square matrices, possibly of different sizes, and
let $Z$ have the corresponding rectangular size.  If
\[
 \begin{pmatrix}H&Z\\ Z^*&J\end{pmatrix}\succeq0,
\]
then
\[
 \norm{Z}_1\le\sqrt{\tr H\,\tr J}.
\]
This estimate includes singular $H$ and $J$.
\end{lemma}

\begin{proof}
A spectral decomposition of the positive block matrix expresses it as
a finite sum of outer products of block columns $\binom{a_k}{b_k}$.
Consequently
$H=\sum_k a_ka_k^*$, $J=\sum_k b_kb_k^*$, and
$Z=\sum_k a_kb_k^*$.  Since a rank-one matrix $ab^*$ has trace norm
$\norm{a}\,\norm{b}$, the triangle inequality and Cauchy--Schwarz give
\[
 \norm{Z}_1
 \le\sum_k\norm{a_k}\,\norm{b_k}
 \le\left(\sum_k\norm{a_k}^2\right)^{1/2}
      \left(\sum_k\norm{b_k}^2\right)^{1/2}
 =\sqrt{\tr H\,\tr J}.
\]
No inverse of a diagonal block is used.
\end{proof}

\begin{lemma}[Four-effect inequality]\label{lem:coherence}
Let $\omega\in\mathscr C$ act on $\C^p\otimes\C^q$.  For arbitrary
$X_0,X_1\succeq0$ in $\Mat{p}$ and $Y_0,Y_1\succeq0$ in $\Mat{q}$, put
\[
 D_{ij}=X_i\otimes Y_j,
 \qquad p_{ij}=\tr(D_{ij}\omega),
 \qquad i,j\in\{0,1\}.
\]
Then
\begin{equation}\label{eq:coherence}
 \norm{\sqrt{D_{00}}\,\omega\sqrt{D_{11}}}_1
 \le \sqrt{p_{00}p_{01}}+\sqrt{p_{10}p_{11}}
       +2\sqrt{p_{01}p_{10}}.
\end{equation}
There is no normalization assumption on $X_0,X_1,Y_0,Y_1$.
\end{lemma}

\begin{proof}
Fix a representation of $\omega$ as above.  Pull the four matrices back
to the two input spaces by the Hilbert--Schmidt adjoints:
\[
 A_i=\mathcal L^\dagger(X_i)\in\Mat{r},
 \qquad B_j=\mathcal M^\dagger(Y_j)\in\Mat{s}.
\]
These matrices are positive.  For instance, for every $a\in\C^r$,
\[
 a^*A_i a=\tr\bigl[X_i\mathcal L(aa^*)\bigr]\ge0.
\]
We first replace the representation by one in which $A_0$ and $A_1$ commute;
the two complete-positivity conditions will then give complementary
estimates for each off-diagonal term of the input.

\paragraph{Normalization on the support.}
Set $H=A_0+A_1$, and let $\Pi$ be the orthogonal projection onto
$\ran H$.  If $a\in\ker H$, the nonnegative numbers
$a^*A_i a=\norm{\sqrt{A_i}a}^2$ sum to zero, so each $A_i$ annihilates
$\ker H$.  It follows also that $A_i=\Pi A_i\Pi$.
Define $S$ to be $H^{-1/2}$ on $\ran H$ and the identity on $\ker H$.
The matrix $S$ is positive and invertible on all of $\C^r$, including
when $H=0$.  The two positive matrices
\[
 A_i'=S^*A_iS
\]
are supported on $\Pi$ and satisfy $A_0'+A_1'=\Pi$.  Hence they commute:
$[A_0',A_1']=[A_0',\Pi-A_0']=0$.

This congruence can be made inside the representation without changing
$\omega$.  With $\Ad_S(U)=SUS^*$, replace
\[
 \mathcal L\quad\hbox{by}\quad\mathcal L'=
 \mathcal L\circ\Ad_S,
 \qquad
 \chi\quad\hbox{by}\quad\chi'=(S^{-1}\otimes I_s)\chi.
\]
The resulting output is the same, and the pullbacks of $X_i$ are $A_i'$.
The new map is CP, and its input-transpose condition follows from
\[
 \Ad_S\circ T_r=T_r\circ\Ad_{\overline S},
 \qquad
 \mathcal L'\circ T_r=(\mathcal L\circ T_r)
                         \circ\Ad_{\overline S}.
\]
Thus it remains a representation of the kind required by
Definition~\ref{def:represented-class}.  We now suppress the primes.

\paragraph{The two block estimates.}
Let $C=\mathcal L\otimes\mathcal M$.  For input vectors
$u,z\in\C^r\otimes\C^s$, define
\[
 \begin{split}
 p_{ij}(u)&=u^*(A_i\otimes B_j)u
       =\tr\bigl[D_{ij}C(uu^*)\bigr],\\
 Z(u,z)&=\sqrt{D_{00}}\,C(uz^*)\sqrt{D_{11}}.
 \end{split}
\]
Complete positivity of $C$ means that applying it entrywise to
\[
 \begin{pmatrix}uu^*&uz^*\\ zu^*&zz^*\end{pmatrix}
 =\binom{u}{z}\binom{u}{z}^*
\]
gives a positive block matrix.  Conjugate that matrix by
$\operatorname{diag}(\sqrt{D_{00}},\sqrt{D_{11}})$ and apply
Lemma~\ref{lem:positive-block}.  The result is
\begin{equation}\label{eq:direct-block-bound}
 \norm{Z(u,z)}_1\le\sqrt{p_{00}(u)p_{11}(z)}.
\end{equation}

The second estimate concerns the same $Z(u,z)$, but exchanges the two
input vectors in the diagonal weights.  In the product input basis the
\emph{global input transpose} is $T_{rs}=T_r\otimes T_s$.  The map
\[
 C\circ T_{rs}=(\mathcal L\circ T_r)\otimes
                (\mathcal M\circ T_s)
\]
is CP.  Apply the preceding block argument to this map, with the
ordered pair $(\overline z,\overline u)$ and the same two output filters.
The identities
\[
 (\overline z\,\overline u^*)^\T=uz^*,\qquad
 (\overline z\,\overline z^*)^\T=zz^*,\qquad
 (\overline u\,\overline u^*)^\T=uu^*
\]
show that the off-diagonal output is unchanged while the two diagonal
inputs are exchanged.  We obtain
\begin{equation}\label{eq:reversed-block-bound}
 \norm{Z(u,z)}_1\le\sqrt{p_{00}(z)p_{11}(u)}.
\end{equation}
It is the transpose on both input factors here that supplies this
reverse estimate.

\paragraph{Splitting the input vector.}
Choose a common orthonormal eigenbasis of the commuting $A_0,A_1$.
Let $P$ be the projection onto the basis vectors on which the
eigenvalue of $A_0$ is at least the eigenvalue of $A_1$, and set
\[
 v=(P\otimes I_s)\chi,\qquad
 w=((I_r-P)\otimes I_s)\chi.
\]
Then $\chi=v+w$.  Because $PA_i(I_r-P)=0$, the cross terms in the
quadratic forms defining $p_{ij}$ vanish.  The eigenvalue comparison
on the two subspaces, together with $B_0,B_1\succeq0$, therefore gives
\begin{equation}\label{eq:spectral-weights}
 \begin{gathered}
 p_{ij}=p_{ij}(v)+p_{ij}(w),\\
 p_{11}(v)\le p_{01}(v),\qquad
 p_{00}(w)\le p_{10}(w).
 \end{gathered}
\end{equation}
For example, $A_0-A_1$ is positive on $\ran P$, so its tensor
product with $B_1$ has nonnegative quadratic form on $v$; the second
comparison follows on $\ker P$ using $B_0$.

We can now bound the four terms in the expansion of $C(\chi\chi^*)$.
For the diagonal terms, \eqref{eq:direct-block-bound} and
\eqref{eq:spectral-weights} give
\[
 \begin{aligned}
 \norm{Z(v,v)}_1
 &\le\sqrt{p_{00}(v)p_{11}(v)}
  \le\sqrt{p_{00}p_{01}},\\
 \norm{Z(w,w)}_1
 &\le\sqrt{p_{00}(w)p_{11}(w)}
  \le\sqrt{p_{10}p_{11}}.
 \end{aligned}
\]
For $Z(v,w)$ use the reverse estimate
\eqref{eq:reversed-block-bound}; for $Z(w,v)$ use the direct estimate
\eqref{eq:direct-block-bound}.  Both right sides become the same:
\[
 \begin{aligned}
 \norm{Z(v,w)}_1&\le\sqrt{p_{00}(w)p_{11}(v)}
                       \le\sqrt{p_{10}p_{01}},\\
 \norm{Z(w,v)}_1&\le\sqrt{p_{00}(w)p_{11}(v)}
                       \le\sqrt{p_{10}p_{01}}.
 \end{aligned}
\]
Finally,
\[
 \sqrt{D_{00}}\,\omega\sqrt{D_{11}}
 =Z(v,v)+Z(v,w)+Z(w,v)+Z(w,w).
\]
The triangle inequality now yields \eqref{eq:coherence}.
\end{proof}

By Lemma~\ref{lem:tensor-closure}, the same inequality applies to
arbitrary joint positive matrices on all of Alice's and all of Bob's
copies of a state in $\mathscr C$.  Its lack of any normalization
condition is the feature that will let us apply it at each complete
public transcript.
==== END Entanglement-with-zero-distillable-secret-key-in-local-dimension-ten//coherence.tex ====

==== BEGIN Entanglement-with-zero-distillable-secret-key-in-local-dimension-ten//combinatorial.tex ====
\section{A finite combinatorial realization}\label{sec:combinatorial}

We construct data satisfying Proposition~\ref{prop:projection-criterion}.
A restricted-intersection bound gives real unit vectors such that every
sufficiently large subfamily contains an orthogonal pair.  The fiber
argument for threefold tensor products strengthens this conclusion to
eight mutually orthogonal members in every sufficiently large subfamily.
Six of these eight vectors will index the six measurements in a parity
obstruction; the remaining two receive a trivial measurement.  Tensoring
these measurements over the eight-subsets gives the projections required
by the criterion.  Because the projections are real, the resulting state
is produced by the same trace-preserving PPT channel on both halves of a
maximally entangled state.

\subsection{Vectors with forced orthogonality}

Set \(p=257\), \(k=4p=1028\), and \([k]=\{1,\ldots,k\}\).  Define
\begin{equation}\label{eq:combinatorial-base}
 \begin{gathered}
 \mathcal U=\{A\subseteq[k]: |A|=2p,\ 1\in A\},\\
 b=|\mathcal U|=\binom{1027}{513}
              =\frac12\binom{4p}{2p},\\
 s_A=\frac{1}{\sqrt k}
       \bigl(2\mathbf1_{\{h\in A\}}-1\bigr)_{h=1}^k
       \in\mathbb R^k
       \quad(A\in\mathcal U).
 \end{gathered}
\end{equation}
Each \(s_A\) is a unit vector.  Since
\(|A\mathbin{\triangle}B|=4p-2|A\cap B|\), counting agreeing and
disagreeing coordinates gives
\begin{equation}\label{eq:combinatorial-inner-product}
 s_A^{\T}s_B
 =\frac{k-2|A\mathbin{\triangle}B|}{k}
 =\frac{|A\cap B|}{p}-1.
\end{equation}
Thus two base vectors are orthogonal exactly when their sets intersect
in \(p\) elements.  Put
\begin{equation}\label{eq:combinatorial-delta}
 a_0=\sum_{j=0}^{p-1}\binom{k}{j}
     =\sum_{j=0}^{256}\binom{1028}{j},
 \qquad \delta=\frac{a_0}{b}.
\end{equation}

Frankl and R\"odl's theory of forbidden intersections also forces
orthogonal families of a prescribed size in large subsets of a sign
cube \cite[Theorem~1.11]{FR1987}.  Here the precise bound follows
from a direct polynomial argument and the fiber amplification below.

\begin{lemma}[Restricted intersections]\label{lem:restricted-intersections}
If \(\mathcal F\subseteq\mathcal U\) contains no two distinct sets
whose associated vectors are orthogonal, then
\(|\mathcal F|\leq a_0=\delta b\).
\end{lemma}

\begin{proof}
The restricted-intersection estimate belongs to the Frankl--Wilson
theory \cite{FW1981}.  The proof below uses the multilinear-polynomial
approach of Alon, Babai, and Suzuki \cite{ABS1991}.  We give the needed
specialization in full.
The integer \(257\) is prime: the primes at most \(\sqrt{257}\) are
\(2,3,5,7,11,13\), and the respective remainders are
\(1,2,2,5,4,10\).

For distinct \(A,B\in\mathcal F\), their common element \(1\) and their
equal sizes give \(1\leq|A\cap B|\leq2p-1\).
Equation~\eqref{eq:combinatorial-inner-product} excludes the value
\(p\).  Hence \(|A\cap B|\) is nonzero modulo \(p\), whereas
\(|A\cap A|=2p\) is zero modulo \(p\).  Over the field \(\F_p\), define
\[
 f_A(x_1,\ldots,x_k)
 =1-\left(\sum_{h\in A}x_h\right)^{p-1}
 \quad(A\in\mathcal F).
\]
For every nonzero \(a\in\F_p\), multiplication by \(a\) permutes the
nonzero field elements; comparing their products gives \(a^{p-1}=1\).
Therefore, on the indicator vectors of the members of \(\mathcal F\),
\[
 f_A(\mathbf1_B)=
 \begin{cases}
  1,&A=B,\\
  0,&A\ne B.
 \end{cases}
\]
Replace every positive power of each variable in every monomial by
its first power.  This preserves all evaluations on Boolean vectors
and leaves degree at most \(p-1\).  The resulting multilinear
polynomials remain linearly independent: evaluating a linear relation
at each \(\mathbf1_B\) makes every coefficient zero.  The space of
multilinear polynomials of degree at most \(p-1\) has a basis consisting
of the \(a_0\) squarefree monomials of those degrees.  Thus
\(|\mathcal F|\leq a_0\).
\end{proof}

\begin{lemma}[Fiber amplification]\label{lem:fiber-amplification}
For \(t=1,2,3\), associate to
\((A_1,\ldots,A_t)\in\mathcal U^t\) the unit vector
\(s_{A_1}\otimes\cdots\otimes s_{A_t}\).
If \(\mathcal R\subseteq\mathcal U^t\) contains no collection of
\(2^t\) distinct tuples whose associated vectors are pairwise
orthogonal, then
\[
 |\mathcal R|\leq t\delta b^t.
\]
\end{lemma}

\begin{proof}
The case \(t=1\) is Lemma~\ref{lem:restricted-intersections}.
For \(t=2\) or \(3\), write
\[
 \mathcal R_A
 =\{(A_2,\ldots,A_t):(A,A_2,\ldots,A_t)\in\mathcal R\},
 \qquad A\in\mathcal U.
\]
Let \(\mathcal G\) consist of those \(A\) for which \(\mathcal R_A\)
contains \(2^{t-1}\) tuples with pairwise orthogonal tensor vectors
in the last \(t-1\) factors.  If distinct \(A,B\in\mathcal G\) had
\(s_A\perp s_B\), choose one such collection in each fiber.
Within either lifted collection, orthogonality comes from the last
factors; between the two collections, it comes from the first factors.
The two fibers are disjoint, so this would produce \(2^t\) distinct
tuples forbidden by the hypothesis.  Thus \(\mathcal G\) has no
orthogonal base pair, and
\(|\mathcal G|\leq a_0=\delta b\) by the preceding lemma.

Each fiber in \(\mathcal G\) has at most \(b^{t-1}\) elements.
Each other fiber has at most \((t-1)\delta b^{t-1}\) elements by the
induction hypothesis.  Summing these bounds and using at most \(b\)
fibers of the latter kind gives
\[
 |\mathcal R|
 \leq (\delta b)b^{t-1}
      +b(t-1)\delta b^{t-1}
 =t\delta b^t.
\]
\end{proof}

Use triples as measurement indices, called \emph{questions}:
\begin{equation}\label{eq:combinatorial-questions}
 \begin{gathered}
 \mathcal Q=\mathcal U^3,\qquad Q=b^3,\qquad
 K=k^3=1028^3=1086373952,\\
 u_q=s_{A_1}\otimes s_{A_2}\otimes s_{A_3}\in\mathbb R^K
 \quad\bigl(q=(A_1,A_2,A_3)\bigr).
 \end{gathered}
\end{equation}
The scalar target is $3\delta<1/K$: the support bound $3\delta Q$
must be strictly below $Q/K$ for the projection criterion.
These vectors are unit vectors.  If \(q=(A_1,A_2,A_3)\) and
\(r=(B_1,B_2,B_3)\), their inner product is the rational number
\begin{equation}\label{eq:combinatorial-question-gram}
 c_{qr}=u_q^{\T}u_r
 =\prod_{h=1}^3\left(\frac{|A_h\cap B_h|}{257}-1\right).
\end{equation}
An \emph{orthogonal eight-set} will mean an eight-element subset of
\(\mathcal Q\) whose associated vectors are pairwise orthogonal.
By Lemma~\ref{lem:fiber-amplification}, with \(t=3\), every
\(\mathcal R\subseteq\mathcal Q\) containing no orthogonal eight-set
satisfies
\begin{equation}\label{eq:combinatorial-eight-bound}
 |\mathcal R|\leq\kappa,\qquad
 \kappa:=3\delta Q=3a_0b^2.
\end{equation}

The next analytic estimate is what makes this bound strict enough for
Proposition~\ref{prop:projection-criterion}.  The central coefficient
is largest among the \(4p+1\) coefficients of \((1+1)^{4p}\), so
\[
 b=\frac12\binom{4p}{2p}\geq\frac{16^p}{2(4p+1)}.
\]
The binomial coefficients increase up to the central one, and the
degree-\(p\) term in the expansion of \((1+1/3)^{4p}\) is no greater
than the full sum.  Hence
\[
 a_0\leq p\binom{4p}{p}
 \leq p(4/3)^{4p}3^p
 =p(256/27)^p
 <p\,12^p.
\]
It follows that
\begin{equation}\label{eq:combinatorial-analytic-bound}
 \delta<2p(4p+1)(3/4)^p<2^{-65}.
\end{equation}
For the last inequality, use \(2p(4p+1)=528906<2^{20}\),
\(p=3\cdot85+2\), and
\((3/4)^3=27/64<1/2\); the remaining factor \((3/4)^2\) is less
than one.  Also \(1028<2^{11}\), so
\[
 K<2^{33},\qquad
 3\delta<3\cdot2^{-65}<2^{-33}<\frac1K.
\]
Combining this with \eqref{eq:combinatorial-eight-bound} proves
\begin{equation}\label{eq:combinatorial-strict-bound}
 \kappa=3a_0b^2<\frac QK.
\end{equation}
The proof has now supplied the vector and cardinality ingredients.
We next construct measurements that turn every orthogonal eight-set
into a forbidden positive-overlap choice.

\subsection{Six parity measurements}

On \(\C^2\), let
\[
 X=\begin{pmatrix}0&1\\1&0\end{pmatrix},\qquad
 Z=\begin{pmatrix}1&0\\0&-1\end{pmatrix},\qquad
 Y=\begin{pmatrix}0&-\mathrm i\\ \mathrm i&0\end{pmatrix}.
\]
Use the Mermin--Peres square
\cite{Mermin1990,Peres1990,Peres1991}; its interpretation in the
setting of quantum magic games is discussed by Arkhipov
\cite{Arkhipov2012}.  The margins in the following array give the
products of the three observables in each row and column:
\begin{equation}\label{eq:combinatorial-parity-square}
 \renewcommand{\arraystretch}{1.25}
 \begin{array}{ccc|c}
  X\otimes I_2&I_2\otimes X&X\otimes X&+I_4\\
  I_2\otimes Z&Z\otimes I_2&Z\otimes Z&+I_4\\
  X\otimes Z&Z\otimes X&Y\otimes Y&+I_4\\\hline
  +I_4&+I_4&-I_4&
 \end{array}
\end{equation}
All nine entries are real symmetric involutions.  In particular, if
\(J=\begin{psmallmatrix}0&-1\\1&0\end{psmallmatrix}\), then
\(Y=\mathrm iJ\) and \(Y\otimes Y=-J\otimes J\), a real integral
symmetric matrix.  Order the six contexts as the three rows followed
by the three columns, each read left to right or top to bottom.  In
context \(t\), write the three observables as \((O_1,O_2,O_3)\).
The first two commute and
\begin{equation}\label{eq:combinatorial-context-signs}
 O_3=e_tO_1O_2,\qquad
 (e_1,e_2,e_3,e_4,e_5,e_6)=(1,1,1,1,1,-1).
\end{equation}
These identities follow from \(XZ=-\mathrm iY\) and
\(ZX=\mathrm iY\).  For example, the first two entries of the last
row multiply, in either order, to \(Y\otimes Y\); those of the last
column multiply, in either order, to \(-Y\otimes Y\).
Since \(O_3\) is a signed product of the first two, all three commute.

Let \(\mathcal A=\{-1,+1\}^2\).  The four outcomes of context \(t\)
are the matrices
\begin{equation}\label{eq:combinatorial-context-projections}
 h_t(\alpha,\beta)
 =\frac14(I_4+\alpha O_1)(I_4+\beta O_2),
 \qquad (\alpha,\beta)\in\mathcal A.
\end{equation}
The two factors divided by two are commuting spectral projections.
Their products are therefore self-adjoint projections.  Distinct
outcomes are orthogonal, and the four products sum to \(I_4\).
They are real symmetric with rational entries, and their ranges have
the three context eigensigns
\((\alpha,\beta,e_t\alpha\beta)\).

\begin{lemma}[Parity obstruction]\label{lem:parity-obstruction}
There is no choice of one projection from each of the six measurements
in \eqref{eq:combinatorial-context-projections} such that the trace
overlap of every two chosen projections from distinct contexts is
strictly positive.
\end{lemma}

\begin{proof}
Suppose there were such a choice.  All six selected projections would
be nonzero.  Let a selected row projection \(E\) and column projection
\(F\) assign eigensigns \(a,b\in\{-1,+1\}\) to their shared
observable \(O\).  The eigenspace identities and self-adjointness give
\[
 aEF=EOF=bEF.
\]
If \(a\ne b\), then \(EF=0\) and their overlap is zero, contrary to
the hypothesis.  Thus the row and column assignments agree at each
of the nine entries of the square.

The choice would consequently give nine consistent signs.  The
product of the three signs in context \(t\) is \(e_t\), by
\eqref{eq:combinatorial-context-signs}.  Multiplying the three row
constraints gives product \(+1\) for the nine signs; multiplying
the three column constraints gives product \(-1\).  This is a
contradiction.  The argument applies to eigenspaces in the complex
Hilbert space \(\C^4\).
\end{proof}

\subsection{Tensor assembly and consequences}

We now impose the six-context obstruction on every orthogonal eight-set
of questions.  Each such set receives its own tensor factor.  Six of its
questions use the six parity measurements on that factor, while
all other questions use the trivial measurement with one outcome $I_4$
and three zero outcomes.  Thus any positive-overlap choice containing
the eight-set violates parity on its factor.  This arrangement also
ensures the commutation needed in the projection criterion: two distinct
questions with nonzero vector inner product cannot both have nontrivial
measurements on any one factor.

For a uniform index set, include a factor carrying only trivial
measurements for every nonorthogonal eight-subset as well.  Let
\begin{equation}\label{eq:combinatorial-tensor-space}
 \begin{gathered}
 \mathcal S=\{S\subseteq\mathcal Q:|S|=8\},\qquad
 L=|\mathcal S|=\binom Q8,\\
 \mathcal H=\bigotimes_{S\in\mathcal S}\C^4\cong\C^D,\qquad
 D=4^L.
 \end{gathered}
\end{equation}
To fix all bases, order subsets of \([k]\) by their increasing lists, then order
tuples lexicographically, and order the eight-subsets by their
increasing lists in that order.  Use the corresponding order for the
tensor factors, the standard tensor-product basis in each
\(\C^4=\C^2\otimes\C^2\), and the
lexicographic order on sign pairs with \(-1<+1\).

For \(S\in\mathcal S\) and \(q\in\mathcal Q\), define a four-outcome
measurement \(h_{S,q}\) on the factor indexed by \(S\).  If \(S\)
is an orthogonal eight-set and \(q\) is its \(t\)-th element with
\(1\leq t\leq6\), set \(h_{S,q}=h_t\).  In every other case, set
\begin{equation}\label{eq:combinatorial-trivial-measurement}
 h_{S,q}(+1,+1)=I_4,\qquad
 h_{S,q}(\alpha,\beta)=0
 \quad\text{when }(\alpha,\beta)\ne(+1,+1).
\end{equation}
Thus the last two questions in an orthogonal eight-set use the
trivial measurement, as do all questions outside that set and all
questions on a nonorthogonal factor.  Every decision of whether a
factor is orthogonal is determined by the rational numbers in
\eqref{eq:combinatorial-question-gram}.

For each \(q\), retain an outcome string on every factor and define
\begin{equation}\label{eq:combinatorial-global-projections}
 \mathcal I_q=\{q\}\times\mathcal A^{\mathcal S},\qquad
 P_{q,\lambda}
   =\bigotimes_{S\in\mathcal S}h_{S,q}(\lambda_S)
   \quad\bigl(\lambda\in\mathcal A^{\mathcal S}\bigr).
\end{equation}
Order these outcome strings lexicographically using the stated factor and
sign-pair orders, and order the full labels first by question and then by
outcome string.  This is the standard basis order used for the concrete maps.
The matrices \(P_{q,\lambda}\) are real symmetric projections.  For a fixed \(q\), two
distinct strings differ in some factor, where their local projections
have zero product; hence their global projections are orthogonal.
Summing over all strings factors as
\(\bigotimes_S\sum_{\alpha,\beta}h_{S,q}(\alpha,\beta)=I_D\).
Keeping every outcome string, including those whose projection is zero,
gives a uniform label set: there are exactly \(4^L=D\) labels for every
question.  Hence
\begin{equation}\label{eq:combinatorial-label-count}
 m:=\left|\bigsqcup_{q\in\mathcal Q}\mathcal I_q\right|=QD.
\end{equation}
In particular \(m\geq D\), as required for the square embedding in
Corollary~\ref{cor:square-embedding}.

\begin{lemma}\label{lem:combinatorial-measurements}
The vectors \eqref{eq:combinatorial-questions} and measurements
\eqref{eq:combinatorial-global-projections} satisfy the two hypotheses
of Proposition~\ref{prop:projection-criterion} with
\(n=m=QD\) and \(\kappa=3a_0b^2<Q/K\).
\end{lemma}

\begin{proof}
If \(q=r\), projections with those labels belong to one projective
measurement and commute.  Suppose that \(q\ne r\) and \(c_{qr}\ne0\).
They cannot both receive nontrivial contexts on any one factor:
that would place them together in an orthogonal eight-set, forcing
\(c_{qr}=0\).  On each factor at least one of the two selected local
projections is consequently \(0\) or \(I_4\).  They commute on each
factor, so their tensor products commute.  This proves the first
hypothesis.

Now let \(J\) be a label set with strictly positive trace overlap
between every distinct pair.  Distinct labels for one question have
zero product, so \(J\) contains at most one label per question.  The
trace overlap of any two global projections factors as
\begin{equation}\label{eq:combinatorial-overlap-product}
 \tr(P_{q,\lambda}P_{r,\mu})
 =
 \prod_{S'\in\mathcal S}
 \tr\bigl(h_{S',q}(\lambda_{S'})
          h_{S',r}(\mu_{S'})\bigr).
\end{equation}
Every local factor is nonnegative by
\eqref{eq:projection-overlap}, whether or not the two local
projections commute.  Thus strict positivity of this finite product
implies strict positivity of each factor.

If the questions represented by \(J\) contained an orthogonal
eight-set \(S\), take the selected labels for its first six questions.
At the factor indexed by \(S\), equation
\eqref{eq:combinatorial-overlap-product} would give strictly positive
overlap for each pair of the six selected context projections.
Lemma~\ref{lem:parity-obstruction} forbids this.  The represented
questions therefore contain no orthogonal eight-set, and
\eqref{eq:combinatorial-eight-bound} gives \(|J|\leq\kappa\).
For completeness, the pairwise condition on a singleton is vacuous
even when its projection is zero; it still satisfies the bound
because \(a_0,b\geq1\) and \(\kappa=3a_0b^2\geq3\).  The strict inequality
\(\kappa<Q/K\) is \eqref{eq:combinatorial-strict-bound}.
\end{proof}

\begin{theorem}[Finite combinatorial construction]\label{thm:old-construction}
Set
\begin{equation}\label{eq:combinatorial-exact-data}
 \begin{gathered}
 p=257,\qquad k=1028,\qquad
 b=\binom{1027}{513},\qquad
 a_0=\sum_{j=0}^{256}\binom{1028}{j},\\
 Q=b^3,\qquad K=1086373952,\qquad
 \kappa=3a_0b^2<\frac QK,\\
 L=\binom Q8,\qquad D=4^L,\qquad m=QD.
 \end{gathered}
\end{equation}
Use the vectors in \eqref{eq:combinatorial-questions}, the \(D\)
labels per question and projections in
\eqref{eq:combinatorial-global-projections}, and the map
\(\Psi:\Mat m\to\Mat D\) in \eqref{eq:projection-map}.
Put \(\Lambda=\Psi^\dagger\) and
\(\Phi_D=\Omega_D/\sqrt D\).
\begin{enumerate}
 \item The map \(\Lambda/Q:\Mat D\to\Mat m\) is a trace-preserving
       PPT channel, and
       \begin{equation}\label{eq:combinatorial-state}
        \rho_{\mathrm{comb}}
        =\left(\frac{\Lambda}{Q}\otimes\frac{\Lambda}{Q}\right)
          (\Phi_D\Phi_D^*)
        =\frac{J(\Psi^\dagger\circ\Psi)}{Q^2D}
       \end{equation}
       is an entangled density operator on
       \(\C^m\otimes\C^m\) belonging to \(\mathscr C\).
       It has \(K_D(\rho_{\mathrm{comb}})=0\) and satisfies the uniform
       unhalved \(1/5\) gap and all operational consequences of
       Theorem~\ref{thm:zero-key} and
       Proposition~\ref{prop:operational-extensions}, with their stated
       protocol, purification, and completion hypotheses.
 \item For the real coordinate isometry \(U:\C^D\to\C^m\) onto the
       first \(D\) coordinates, the maps
       \[
        \Phi_1^{\mathrm{comb}}=\Ad_U\circ\Psi,\qquad
        \Phi_2^{\mathrm{comb}}=\Lambda\circ\Ad_{U^*}
                 =(\Phi_1^{\mathrm{comb}})^\dagger
       \]
       are PPT maps on \(\Mat m\), and
       \begin{equation}\label{eq:combinatorial-pair}
        J(\Phi_2^{\mathrm{comb}}\circ\Phi_1^{\mathrm{comb}})
          =Q^2D\,\rho_{\mathrm{comb}}
       \end{equation}
       is nonseparable over \(\C^m\otimes\C^m\).  In particular their composition is not
       entanglement breaking.
 \item Let \(\Theta_{\mathrm{comb}}\) be the channel obtained by
       applying Proposition~\ref{prop:channel-completion} to this
       square pair.  It is a trace-preserving PPT channel on
       \(\Mat{2m+1}\).  With the positive constants \(c_1,c_2\)
       and the first coordinate inclusion \(W_0\) from that
       proposition, the Choi matrix of its square has the corner
       \begin{equation}\label{eq:combinatorial-channel-corner}
        (W_0^*\otimes W_0^*)J(\Theta_{\mathrm{comb}}^2)
        (W_0\otimes W_0)
        =c_1c_2Q^2D\,\rho_{\mathrm{comb}}.
       \end{equation}
       Consequently
       \(\Theta_{\mathrm{comb}}^2
         =\Theta_{\mathrm{comb}}\circ\Theta_{\mathrm{comb}}\)
       is not entanglement breaking.
\end{enumerate}
\end{theorem}

\begin{proof}
Lemma~\ref{lem:combinatorial-measurements} verifies the hypotheses of
Proposition~\ref{prop:projection-criterion}.  Its composite
\(C=J(\Psi^\dagger\circ\Psi)\) is positive and nonseparable over
\(\C^m\otimes\C^m\), with \(\tr C=Q^2D\).  The projections are real
symmetric, so Corollary~\ref{cor:real-channel} proves
\eqref{eq:combinatorial-state}, the channel assertion, and membership
in \(\mathscr C\).  Theorem~\ref{thm:zero-key} and
Proposition~\ref{prop:operational-extensions} give the stated
operational conclusions.

Since \(m=QD\geq D\), Corollary~\ref{cor:square-embedding} applies to
the displayed coordinate isometry and gives the square PPT pair.
Its composite is \(\Psi^\dagger\circ\Psi\), and the real
identification \eqref{eq:projection-real-identification} gives
\eqref{eq:combinatorial-pair}.  Applying
Proposition~\ref{prop:channel-completion} to this pair gives the
channel on \(\Mat{2m+1}\) and its exact corner
\eqref{eq:combinatorial-channel-corner}.  The corner is nonseparable,
so that proposition also proves that the channel square is not
entanglement breaking.
\end{proof}

All these objects are given by finite exact formulas.  The normalized
sign vectors \(s_A\) have coordinates
\(\pm1/\sqrt{1028}=\pm1/(2\sqrt{257})\), which are irrational because
\(257\) is prime.  The Gram entries of the question vectors in
\eqref{eq:combinatorial-question-gram}, rather than the vector coordinates,
enter the Choi blocks.  Those Gram entries are rational; all nine local
observables are integral, and all local and global projections are
rational.  Consequently every block \(H_{ij}\), every coefficient of
\(\Psi,\Lambda,\Phi_1^{\mathrm{comb}},\Phi_2^{\mathrm{comb}}\), and
every entry of \(\rho_{\mathrm{comb}}\) is rational in the specified
bases.  The completion also has rational coefficients: its positive
scalings and flag matrices in Proposition~\ref{prop:channel-completion}
are formed from the rational square maps using traces and rational
operations.  Appendix~\ref{app:supplementary-checks} describes
supplementary exact checks of the small arithmetic and six-context
calculations.
==== END Entanglement-with-zero-distillable-secret-key-in-local-dimension-ten//combinatorial.tex ====

==== BEGIN Entanglement-with-zero-distillable-secret-key-in-local-dimension-ten//foundations.tex ====
\section{PPT maps and the represented class}\label{sec:foundations}

All matrix algebras in the constructions are finite-dimensional over
$\C$, with fixed orthonormal bases and the induced product bases.  We write
$X^*$ for conjugate transpose, $\overline X$ for entrywise conjugation, and
$T_d(X)=X^{\T}$ for the complex-linear transpose on $\Mat d$.  For a linear
map $F$, its Hilbert--Schmidt adjoint $F^\dagger$ is characterized by
$\tr(Y^*F(X))=\tr((F^\dagger(Y))^*X)$.  If $V$ is a matrix, then
$\Ad_V(X)=VXV^*$.

For $F:\Mat a\to\Mat b$ our Choi convention is
\begin{equation}\label{eq:choi-definition}
 J(F)=\sum_{i,j=1}^a E_{ij}\otimes F(E_{ij})
     =(\mathrm{id}_a\otimes F)(\Omega_a\Omega_a^*),
 \qquad \Omega_a=\sum_{i=1}^a e_i\otimes e_i.
\end{equation}
In particular, $\norm{\Omega_a}^2=a$; the vector is not normalized.  The
first tensor factor is the input reference.  This convention fixes every
dimension factor in the transfer and channel formulas below.
It is the map--operator correspondence associated with Jamiołkowski and
Choi \cite{Jamiolkowski1972,Choi1975}.

\begin{lemma}\label{lem:ppt-stability}
Let $F:\Mat a\to\Mat b$ be CP.  Then $F^\dagger$ and
$T_b\circ F\circ T_a$ are CP.  Moreover,
\[
 F\circ T_a\text{ is CP}\quad\Longleftrightarrow\quad
 T_b\circ F\text{ is CP}.
\]
If $F$ is PPT, so are $T_b\circ F$, $F\circ T_a$, its adjoint, its
simultaneous transpose $T_b\circ F\circ T_a$, and its transpose-adjoint
$F^\sharp:=T_a\circ F^\dagger\circ T_b$.  Tensor products of PPT maps
are PPT.  If $P$ and $Q$ are compatible CP maps, then $Q\circ F\circ P$
is PPT whenever $F$ is PPT.
\end{lemma}

\begin{proof}
Choose Kraus matrices $A_r\in\C^{b\times a}$ such that
$F(X)=\sum_r A_rXA_r^*$.  Then
\[
 F^\dagger(Y)=\sum_r A_r^*YA_r,
 \qquad
 (T_b\circ F\circ T_a)(X)
       =\sum_r\overline{A_r}X\overline{A_r}^{\,*},
\]
which proves both CP assertions.  Applying the simultaneous-transpose
assertion to $F\circ T_a$ or to $T_b\circ F$ proves their equivalence.
This argument works with rectangular Kraus matrices.
The operator-sum representation is standard \cite{Kraus1971,Choi1975}.

Transpose is self-adjoint for the Hilbert--Schmidt inner product.  Hence,
when $F$ is PPT,
\[
 T_a\circ F^\dagger=(F\circ T_a)^\dagger
 \quad\text{and}\quad
 F^\dagger\circ T_b=(T_b\circ F)^\dagger
\]
are CP.  This proves the PPT assertion for the adjoint, and simultaneous
transposition gives the simultaneous transpose and transpose-adjoint.
The output transpose of $T_b\circ F$ is $F$, while that of
$F\circ T_a$ is $T_b\circ F\circ T_a$; all these maps are CP.  This proves
the remaining PPT assertions.  With product bases,
$T_{b_1b_2}=T_{b_1}\otimes T_{b_2}$, so the tensor-product assertion follows
from closure of CP maps under tensor products.  Finally, for
$P:\Mat{a'}\to\Mat a$ and $Q:\Mat b\to\Mat{b'}$,
\[
 T_{b'}\circ Q\circ F\circ P
 = (T_{b'}\circ Q\circ T_b)\circ(T_b\circ F)\circ P
\]
is a composition of CP maps.  The untransposed composition is CP as well.
\end{proof}

The input- and output-transpose formulations of PPT will therefore be used
interchangeably.  No trace condition is included in this terminology.
The elementary closure facts above are also recorded, in related forms, in
\cite[Lemma 2.1]{KMP2018}.

\begin{lemma}\label{lem:choi-separable}
A linear map $F:\Mat a\to\Mat b$ is CP if and only if $J(F)\succeq0$.
For a CP map, the following are equivalent:
\begin{enumerate}
 \item $J(F)$ is separable;
 \item for every $k\geq1$ and every $W\succeq0$ in $\Mat k\otimes\Mat a$,
       $(\mathrm{id}_k\otimes F)(W)$ is separable.
\end{enumerate}
Also,
\[
 J(T_b\circ F)=(\mathrm{id}_a\otimes T_b)J(F),\qquad
 J(F\circ T_a)=(T_a\otimes\mathrm{id}_b)J(F).
\]
\end{lemma}

\begin{proof}
The forward CP implication follows from \eqref{eq:choi-definition}.
Conversely, write a positive Choi matrix as
$J(F)=\sum_r v_rv_r^*$.  There is a unique matrix
$A_r\in\C^{b\times a}$ with $v_r=(I_a\otimes A_r)\Omega_a$.
Comparison of the $(i,j)$ blocks gives
$F(E_{ij})=\sum_r A_rE_{ij}A_r^*$ and hence the Kraus representation of
$F$.  This is Choi's finite-dimensional criterion \cite{Choi1975}.

If $J(F)$ is separable, spectral decompositions of its positive factors
write it as $\sum_r a_ra_r^*\otimes b_rb_r^*$.  Comparison of blocks now
gives the measure-and-prepare formula
\[
 F(X)=\sum_r \tr\bigl[(a_ra_r^*)^{\T}X\bigr]b_rb_r^*.
\]
Put $E_r=(a_ra_r^*)^{\T}\succeq0$.  For $W\succeq0$, each partial matrix
\[
 \tr_a\bigl[(I_k\otimes E_r)W\bigr]
 =\tr_a\bigl[(I_k\otimes\sqrt{E_r})W
                         (I_k\otimes\sqrt{E_r})\bigr]
\]
is positive.  Thus $(\mathrm{id}_k\otimes F)(W)$ is a sum of positive
products with second factors $b_rb_r^*$.  The converse follows by applying
the asserted property to $W=\Omega_a\Omega_a^*$.  This proves the
entanglement-breaking characterization \cite[Theorem 4]{HSR2003} at the
level of the CP cone.  The two transpose identities follow directly by
reindexing the matrix units in \eqref{eq:choi-definition}.
\end{proof}

\begin{lemma}\label{lem:product-range}
Every nonzero separable positive matrix has a nonzero product vector in its
range.  Consequently, a nonzero positive matrix whose range contains no
nonzero product vector is nonseparable.
\end{lemma}

\begin{proof}
Refine a separable decomposition by the spectral decompositions of its
positive factors.  It then has the form $Z=\sum_r v_rv_r^*$ with product
vectors $v_r=a_r\otimes b_r$.  Since
$\ker Z=\bigcap_r v_r^\perp$, every $v_r$ lies in
$(\ker Z)^\perp=\ran Z$.  If $Z\ne0$, at least one $v_r$ is nonzero.
\end{proof}

This is the range condition we use from the range criterion
\cite{Horodecki1997}.  It is only a necessary condition for separability;
the dimension-ten construction below establishes its failure directly.

\begin{definition}\label{def:represented-class}
A density operator $\omega$ on $\C^a\otimes\C^b$ belongs to the represented
class $\mathscr C$ if there are positive integers $r,s$, a vector
$\chi\in\C^r\otimes\C^s$, and linear maps
$\mathcal L:\Mat r\to\Mat a$ and $\mathcal M:\Mat s\to\Mat b$ such that
\begin{equation}\label{eq:represented-class}
 \omega=(\mathcal L\otimes\mathcal M)(\chi\chi^*),
 \qquad
 \mathcal L,\ \mathcal L\circ T_r,\ \mathcal M,\ \mathcal M\circ T_s
 \text{ are CP}.
\end{equation}
Only $\omega$ is required to have trace one.  The vector $\chi$ may be
unnormalized, and the maps need not preserve trace.
\end{definition}

This is a representation property, with no assumed physical implementation
of the representing maps.  Lemma~\ref{lem:ppt-stability} shows that the two
maps are PPT also in the output convention.  In particular the state itself
has positive partial transpose, since, for example,
$(T_a\otimes\mathrm{id}_b)(\omega)=
 ((T_a\circ\mathcal L)\otimes\mathcal M)(\chi\chi^*)\succeq0$.
The operational proof will use the representing maps themselves, in
addition to this partial-transpose consequence.

\begin{lemma}\label{lem:tensor-closure}
The class $\mathscr C$ is closed under finite tensor products, after
grouping all first-party systems and all second-party systems.  In
particular, $\omega^{\otimes n}\in\mathscr C$ for every
$\omega\in\mathscr C$ and every $n\geq1$.
\end{lemma}

\begin{proof}
Tensor the representing vectors and the first-party maps separately from
the second-party maps, and use the canonical local permutation unitaries to
group the systems.  Tensor products of CP maps are CP, and input transpose
in the grouped product basis is the tensor product of the individual input
transposes.  Hence the four maps required in
\eqref{eq:represented-class} remain CP.  The output is the tensor product of
the original states and has trace one.  The local permutation unitaries and
their conjugates are CP pre- and post-compositions, so they do not affect
the conclusion.
\end{proof}

\begin{lemma}[Choi transfer]\label{lem:choi-transfer}
Let $F:\Mat a\to\Mat b$ and $G:\Mat b\to\Mat c$ be CP maps, and set
$F^\sharp=T_a\circ F^\dagger\circ T_b$.  Then
\begin{equation}\label{eq:choi-transfer}
 J(G\circ F)=(F^\sharp\otimes G)(\Omega_b\Omega_b^*).
\end{equation}
If $F$ and $G$ are PPT and $Z=J(G\circ F)\ne0$, then
$\lambda:=\tr Z>0$ and
\begin{equation}\label{eq:choi-transfer-normalized}
 \frac{Z}{\lambda}
 =(F^\sharp\otimes G)
 \left(\frac{\Omega_b\Omega_b^*}{\lambda}\right)\in\mathscr C
 \quad\text{on }\C^a\otimes\C^c.
\end{equation}
\end{lemma}

\begin{proof}
Let $A_r\in\C^{b\times a}$ and $B_s\in\C^{c\times b}$ be Kraus matrices
for $F$ and $G$.  Transposing the adjoint formula gives
\[
 F^\sharp(Y)=\sum_r A_r^{\T}Y\overline{A_r}
            =\sum_r A_r^{\T}Y(A_r^{\T})^*.
\]
Thus the Kraus matrices of $F^\sharp:\Mat b\to\Mat a$ are the transposes
$A_r^{\T}$.  For each pair of Kraus matrices, direct expansion in the fixed
bases gives
\[
 (A_r^{\T}\otimes B_s)\Omega_b
       =(I_a\otimes B_sA_r)\Omega_a.
\]
Summing the corresponding rank-one matrices proves
\eqref{eq:choi-transfer}.  This is the rectangular CP form of the
transpose-adjoint identity in \cite[Lemma I.1(2)]{CMHW2019}; its use for
local products of PPT maps is discussed there in Section IV.B.

Suppose now that $F$ and $G$ are PPT.  Besides complete positivity of
$F^\sharp$ and $G$, Lemma~\ref{lem:ppt-stability} gives
\[
 F^\sharp\circ T_b=T_a\circ F^\dagger=(F\circ T_a)^\dagger
       \text{ CP},
 \qquad G\circ T_b\text{ CP}.
\]
These are exactly the input-transpose conditions for the two local maps in
Definition~\ref{def:represented-class}.  Finally,
\[
 Z=\sum_{r,s}|(I_a\otimes B_sA_r)\Omega_a\rangle
                 \langle(I_a\otimes B_sA_r)\Omega_a|,
 \qquad
 \lambda=\sum_{r,s}\norm{B_sA_r}_{\mathrm F}^{\,2}.
\]
The nonzero positive matrix $Z$ has $\lambda>0$.  Taking
$\chi=\Omega_b/\sqrt\lambda$ in \eqref{eq:represented-class} proves
\eqref{eq:choi-transfer-normalized}.  Its squared norm is $b/\lambda$,
which is allowed by the definition.  No trace-preserving hypothesis or
additional factor of $b$ is used.
\end{proof}
==== END Entanglement-with-zero-distillable-secret-key-in-local-dimension-ten//foundations.tex ====

==== BEGIN Entanglement-with-zero-distillable-secret-key-in-local-dimension-ten//geometry.tex ====
\section{Tensor geometry from singular directions}
\label{sec:geometry}

We now construct the PPT pair in Theorem~\ref{thm:main-pair}.  The geometric
step uses a map on $\Mat4$ with twenty specified singular outputs.  It turns
each singular output into a product vector in the kernel of a Choi matrix
on $\C^{10}\otimes\C^{10}$.  A condition on quadratic evaluations then
excludes product vectors from the range.

For a vector $x$, write $P_x=xx^*$, without normalizing it.  A projective
direction $[x]$ is the complex line spanned by a nonzero vector $x$.

\begin{proposition}[Tensor criterion]\label{prop:tensor-criterion}
Let $L:\Mat4\to\Mat4$ be PPT.  Suppose that
$\mathcal X=\{x_1,\ldots,x_{20}\}\subset\C^4\setminus\{0\}$ represents
twenty distinct projective directions and has the following properties:
\begin{enumerate}
\item $\rank L(P_x)<4$ for every $x\in\mathcal X$, and every nonzero
homogeneous quadratic in $\C[x_0,x_1,x_2,x_3]$ vanishes on at most nine
members of $\mathcal X$;
\item $L(P_y)$ is positive definite for some $y\in\C^4$.
\end{enumerate}
Then there are PPT maps $\Phi_1,\Phi_2:\Mat{10}\to\Mat{10}$, constructed
explicitly from $L$, such that
\[
 Z=J(\Phi_2\circ\Phi_1)\ne0,\qquad
 \ran Z\cap\{u\otimes v:u,v\in\C^{10}\}=\{0\}.
\]
In particular, $\Phi_2\circ\Phi_1$ is not entanglement breaking.
\end{proposition}

Section~\ref{sec:certificate} supplies an integer construction of $L$ with
these properties.  We prove the criterion by using the symmetric square to
record quadratic monomials and the exterior square to detect rank loss.

\begin{proof}
\emph{Symmetric and exterior tensors.}
Index an orthonormal basis of $\C^{10}$ by pairs $0\leq i\leq j<4$, and an
orthonormal basis of $\C^6$ by pairs $0\leq i<j<4$, both in lexicographic
order.  Define isometries $U:\C^{10}\to\C^4\otimes\C^4$ and
$V:\C^6\to\C^4\otimes\C^4$ by
\begin{align}
 Ue_{ii}&=e_i\otimes e_i,&
 Ue_{ij}&=\frac{e_i\otimes e_j+e_j\otimes e_i}{\sqrt2}\quad(i<j),
 \notag\\
 Ve_{ij}&=\frac{e_i\otimes e_j-e_j\otimes e_i}{\sqrt2}\quad(i<j).
 \label{eq:UV}
\end{align}
Their ranges are the symmetric and antisymmetric tensor subspaces.  Put
\begin{equation}
 \widehat x=U^*(x\otimes x)
 =\sum_i x_i^2e_{ii}+\sqrt2\sum_{i<j}x_ix_je_{ij}
 \qquad(x\in\C^4).
 \label{eq:veronese}
\end{equation}
Thus $U\widehat x=x\otimes x$ and
$UP_{\widehat x}U^*=P_x\otimes P_x$.  The coordinates of $\widehat x$ are
the ten quadratic monomials with nonzero normalization factors.  Hence the
quadratic hypothesis is equivalent to the assertion that any ten vectors
among $\{\widehat x:x\in\mathcal X\}$ span $\C^{10}$: a failure to span
would give a nonzero vector $u$ with $u^*\widehat x=0$ at those ten points,
and $u^*\widehat x$ is a nonzero homogeneous quadratic.

Identify $\C^6$ with $\bigwedge^2\C^4$ by $e_{ij}=e_i\wedge e_j$, with this
basis orthonormal.  Under this identification,
\[
 V(a\wedge b)=\frac{a\otimes b-b\otimes a}{\sqrt2}.
\]
For $i<j$, let $k<l$ be the complementary indices, and let
$\epsilon_{ijkl}$ be the sign of the ordering $(i,j,k,l)$ of $(0,1,2,3)$.
Define the real signed permutation $K$ on $\C^6$ by
\begin{equation}
 Ke_{ij}=\epsilon_{ijkl}e_{kl}.
 \label{eq:complement}
\end{equation}
Explicitly,
\[
 (Ke_{01},Ke_{02},Ke_{03},Ke_{12},Ke_{13},Ke_{23})
 =(e_{23},-e_{13},e_{12},e_{03},-e_{02},e_{01}),
\]
so $K=K^*=K^{-1}$.  The conjugate operation $w\mapsto K\overline w$ is
the complementary-pair exterior dual also used by Schliemann, Loss, and
MacDonald for two fermions in a four-dimensional one-particle space
\cite[Section III, Equations (26)--(28)]{SchliemannLossMacDonald2001}.

Define $S,R:\Mat{10}\to\Mat6$ by
\begin{equation}
 S(A)=V^*(L\otimes L)(UAU^*)V,\qquad
 R(A)=K\,S(A)^{\T}K^*.
 \label{eq:SR}
\end{equation}
The embeddings and compressions are CP, so Lemma~\ref{lem:ppt-stability}
makes $S$ PPT.  The map $T_6\circ S$ is CP by this PPT property, and its
output transpose is $S$, which is CP.  Thus $T_6\circ S$ is PPT, and the
CP conjugation by $K$ makes $R$ PPT.

\emph{The composite Choi matrix.}
The rectangular maps give an endomorphism
$R^\dagger\circ S\circ T_{10}$ of $\Mat{10}$.  To express it as the
composition of two maps on that algebra, let
$E:\C^6\to\C^{10}$ be the real coordinate inclusion into the first six
positions and define
\begin{equation}
 \Phi_1(A)=E\,S(A^{\T})E^*,\qquad
 \Phi_2(B)=R^\dagger(E^*BE).
 \label{eq:phi-pair}
\end{equation}
For $\Phi_1$, Lemma~\ref{lem:ppt-stability} makes $S\circ T_{10}$ CP by
input/output transpose equivalence, and makes its output transpose
$T_6\circ S\circ T_{10}$ CP by simultaneous transposition of $S$.
Thus $S\circ T_{10}$ is PPT, and the CP embedding by $E$ preserves that
property.  The adjoint and CP-composition clauses of the same lemma make
$\Phi_2$ PPT.  The formulas determine both maps explicitly once $L$ is
given.  For example, if
$L(A)=\sum_r Q_rAQ_r^*$, the adjoints in the construction are
\begin{align*}
 L^\dagger(Y)&=\sum_r Q_r^*YQ_r,\\
 S^\dagger(Y)&=U^*(L^\dagger\otimes L^\dagger)(VYV^*)U,\\
 R^\dagger(Y)&=S^\dagger\bigl((K^*YK)^{\T}\bigr).
\end{align*}

Since $E^*E=I_6$,
$\Phi_2\circ\Phi_1=R^\dagger\circ S\circ T_{10}$.  Its Choi matrix $Z$ is
positive.  The convention \eqref{eq:choi-definition} gives, for arbitrary
matrices $a,b$ of the appropriate sizes,
\[
 \tr\bigl[(a\otimes b)J(F)\bigr]=\tr\bigl[bF(a^{\T})\bigr].
\]
For Hermitian $a,b\in\Mat{10}$, the Hilbert--Schmidt adjoint identity
therefore gives
\begin{equation}
 \tr\bigl[(a\otimes b)Z\bigr]
 =\tr\bigl[bR^\dagger(S(a))\bigr]
 =\tr\bigl[R(b)S(a)\bigr].
 \label{eq:choi-pairing}
\end{equation}
The Choi transpose has canceled the input transpose in
\eqref{eq:phi-pair}.  We will prove that the right side vanishes at
$a=b=P_{\widehat x}$ for each singular direction.  Positivity of $Z$ will
then give the kernel vector $\widehat x\otimes\widehat x$.
The positive definite output will separately show that $Z$ is nonzero.

\emph{Singular outputs and kernel products.}
For any operator $B$ on $\C^4$,
\[
 V^*(B\otimes B)V=\bigwedge\nolimits^2B.
\]
Both sides send $a\wedge b$ to $Ba\wedge Bb$.  If
$B_x=L(P_x)\succeq0$ and $W_x=\ran B_x$, it follows that
\begin{equation}
 S(P_{\widehat x})=\bigwedge\nolimits^2B_x,\qquad
 \ran S(P_{\widehat x})=\bigwedge\nolimits^2W_x.
 \label{eq:exterior-range}
\end{equation}
Indeed, in an orthonormal eigenbasis of $B_x$, the exterior eigenvalues are
$\lambda_i\lambda_j$ for $i<j$.  This proves both positivity and the range
identity.  A Hermitian matrix $D$ satisfies $D^{\T}=\overline D$, so
transposition conjugates its range.  Consequently
\begin{equation}
 \ran R(P_{\widehat x})=K\overline{\bigwedge\nolimits^2W_x}.
 \label{eq:complement-range}
\end{equation}

For exterior two-vectors $w,u$, let $[w\wedge u]_{0123}$ denote the
coefficient of $e_0\wedge e_1\wedge e_2\wedge e_3$.  With the Hermitian
inner product conjugate-linear in its first argument, the definition of $K$
gives
\begin{equation}
 \langle K\overline w,u\rangle
 =\sum_{i<j}w_{ij}\epsilon_{ijkl}u_{kl}
 =[w\wedge u]_{0123}.
 \label{eq:wedge-pairing}
\end{equation}
Here $k<l$ is complementary to $i<j$ in each term.  If
$w,u\in\bigwedge^2W$ and $\dim W<4$, then
$w\wedge u\in\bigwedge^4W=0$.  Equations
\eqref{eq:exterior-range}--\eqref{eq:wedge-pairing} show that
$S(P_{\widehat x})$ and $R(P_{\widehat x})$ have orthogonal ranges for every
$x\in\mathcal X$.  This includes $\dim W_x<2$, when both exterior ranges
are zero.  The conjugation in \eqref{eq:wedge-pairing} is essential for this
conclusion over complex subspaces.

For $x\in\mathcal X$, orthogonality of the two positive output ranges gives
\[
 (\widehat x\otimes\widehat x)^*Z(\widehat x\otimes\widehat x)
 =\tr\bigl[R(P_{\widehat x})S(P_{\widehat x})\bigr]=0.
\]
For a positive matrix, $v^*Zv=0$ implies $Zv=0$.  Hence
\begin{equation}
 \widehat x\otimes\widehat x\in\ker Z\qquad(x\in\mathcal X).
 \label{eq:kernel-vectors}
\end{equation}
For the input $y$ in the second hypothesis,
$S(P_{\widehat y})=\bigwedge^2(L(P_y))$ is positive definite, and so is
$R(P_{\widehat y})=K S(P_{\widehat y})^{\T}K^*$.  The trace of their
product is strictly positive.  Equation~\eqref{eq:choi-pairing} at
$a=b=P_{\widehat y}$ therefore proves $Z\ne0$.

\emph{Excluding product vectors from the range.}
It remains to exclude a product vector from the range.
The following zero-set argument uses the product-exclusion principle of
Bennett and coauthors \cite[Lemma~1]{Bennett1999}, in the nonorthogonal
form given by Pittenger \cite[Section~IV, Lemma~3]{Pittenger2003}, and
is related to Parthasarathy's polynomial interpolation construction
\cite[Proposition~1.3]{Parthasarathy2004}.
Suppose that a nonzero product $u\otimes v$ belongs to $\ran Z$.  Since
$Z$ is Hermitian, its range is the orthogonal complement of its kernel.
Equation~\eqref{eq:kernel-vectors} implies
\[
 p_u(x)p_v(x)=0\quad(x\in\mathcal X),\qquad
 p_u(x)=u^*\widehat x,\quad p_v(x)=v^*\widehat x.
\]
For example,
\[
 p_u(x)=\sum_i\overline{u_{ii}}x_i^2
       +\sqrt2\sum_{i<j}\overline{u_{ij}}x_ix_j.
\]
This is a homogeneous quadratic in $x$; only its fixed coefficients are
conjugated.  Its distinct monomials make it nonzero when $u\ne0$.
The same holds for $p_v$, since $v\ne0$.  Each polynomial therefore
vanishes on at most nine members of $\mathcal X$.  Their zero sets cannot
cover all twenty members, because $9+9<20$.  This contradiction proves
that $\ran Z$ contains no nonzero product vector.

By Lemma~\ref{lem:product-range}, the nonzero positive matrix $Z$ is
nonseparable.  Lemma~\ref{lem:choi-separable} then shows that the composite
is not entanglement breaking.
\end{proof}
==== END Entanglement-with-zero-distillable-secret-key-in-local-dimension-ten//geometry.tex ====

==== BEGIN Entanglement-with-zero-distillable-secret-key-in-local-dimension-ten//introduction.tex ====
\section{Introduction}

Secret-key distillation asks whether two distant laboratories can turn a
shared noisy resource into identical random bits that an eavesdropper cannot
predict.  For a bipartite quantum state $\rho_{AB}$, Alice and Bob act locally
and exchange authenticated public classical messages.  Eve holds a
purification of the input and receives the complete public transcript.  An
ideal key of length $\ell$ is uniform, agrees at the two laboratories, and is
independent of Eve: its joint state has the form
\[
 2^{-\ell}\sum_{z\in\{0,1\}^{\ell}}
 |z,z\rangle\langle z,z|\otimes\sigma_{E'}.
\]
We use the usual ideal-key security criterion
\cite{keyPrivateStates,RennerKonig05}.  The input is the only shared private
resource.  Alice and Bob may process all copies jointly in their respective
laboratories and use local auxiliaries and private randomness.
They may also begin with a public random variable, independent of the input
and its reference and recorded for Eve.  Conditional on that public
variable, the input-reference state and the two private auxiliary resources
form a product, with fixed preparation kernels for every input.

An \emph{admitted} protocol has a finite or $\mathbb N$-indexed sequence of
measurable local-instrument steps, after any supplied local aggregation.
Its histories and terminal readouts must satisfy the reference-compatibility
conditions of Definition~\ref{def:protocol}.  These include ordinary finite
protocols with finite classical records obeying the preceding resource rules,
as well as the specified countable processes.  Eve retains the initial
purification and the full public record, including speaker choices and
stopping information.  A protocol is \emph{completed on the actual input}
when both laboratories produce their prescribed outputs almost surely and
the joint output is normalized.

The distillable secret key $K_D(\rho)$ is the supremum of
$\liminf_n\ell_n/n$ over admitted completed key-output sequences on
$\rho^{\otimes n}$ whose error from an ideal key tends to zero
(Definition~\ref{def:distillable-key}).  All errors use the unhalved trace
norm $\norm{X}_1=\tr\sqrt{X^*X}$.

We construct an entangled state for which even one approximately secret bit
is uniformly out of reach.  A density operator is a positive matrix of trace
one.  It is \emph{separable} if it is a finite sum of positive product
matrices, and \emph{entangled} otherwise.

\begin{theorem}\label{thm:main-state}
There is an explicitly specified entangled density operator $\rho$ on
$\C^{10}\otimes\C^{10}$ whose range contains no nonzero product vector and
for which $K_D(\rho)=0$.  More precisely, let $n\geq1$ and let
$\tau_{K_AK_BE'}$ be the normalized output of any admitted completed bit-output protocol of
Definition~\ref{def:protocol} on $\rho^{\otimes n}$, where $E'$ retains an
initial purification and the complete public transcript.  For every state
$\sigma_{E'}$,
\begin{equation}\label{eq:main-gap}
 \left\lVert \tau_{K_AK_BE'}-
 \frac12\sum_{i=0}^1|i,i\rangle\langle i,i|\otimes\sigma_{E'}
 \right\rVert_1\geq\frac15.
\end{equation}
Thus the corresponding trace distance, with its conventional factor
$1/2$, is at least $1/10$.
\end{theorem}

There is no uniform bound on the amount of communication or the number of
steps within the admitted model.  Proposition~\ref{prop:operational-extensions}
also gives separate consequences for public conditioning on an event of
positive probability, vanishing abort probability, and trace-norm limits of
completed outputs whose Eve registers retain or allow recovery of the
purification and complete public record.

The state comes from a construction for completely positive maps.  A
complex-linear map $F:\Mat a\to\Mat b$ is \emph{completely positive} (CP)
when $\mathrm{id}_k\otimes F$ preserves positive matrices for every
$k\geq1$.  We call it \emph{PPT} when both $F$ and $T_b\circ F$ are CP,
where $T_b$ is coordinate transposition.  Write $J(F)$ for the unnormalized
input-first Choi matrix, defined in \eqref{eq:choi-definition}.  A CP map is
\emph{entanglement breaking} when applying it to one subsystem of any
positive bipartite input always gives a separable output.  Equivalently, its
Choi matrix is separable \cite[Theorem 4]{HSR2003}; this cone formulation
does not require trace preservation.

\begin{theorem}\label{thm:main-pair}
There are explicitly specified PPT maps
$\Phi_1,\Phi_2:\Mat{10}\to\Mat{10}$ for which
\[
 Z=J(\Phi_2\circ\Phi_1)
\]
is nonzero and its range contains no nonzero product vector in
$\C^{10}\otimes\C^{10}$.  In particular, the composition
$\Phi_2\circ\Phi_1$ is not entanglement breaking.
\end{theorem}

The maps are given by \eqref{eq:phi-pair}, starting from the integer matrices
in \eqref{eq:explicit-matrices}.  They may differ, and the construction does
not impose trace preservation or unitality.  The state in
Theorem~\ref{thm:main-state} is
\begin{equation}\label{eq:main-state-formula}
                    \rho=\frac{Z}{\tr Z}.
\end{equation}
The denominator is positive because $Z$ is a nonzero positive Choi matrix.
A separate construction supplies a trace-preserving example.

\begin{theorem}\label{thm:main-channel}
There is an explicitly specified trace-preserving PPT channel
$\Theta:\Mat{21}\to\Mat{21}$ whose square $\Theta\circ\Theta$ is not
entanglement breaking.
\end{theorem}

The pair in Theorem~\ref{thm:main-pair} gives a negative answer to the
unrestricted two-map PPT-composition conjecture of Christandl,
M\"uller-Hermes, and Wolf \cite[Conjecture IV.1]{CMHW2019}.  The channel in
Theorem~\ref{thm:main-channel} answers the channel question recorded in the
2012 BIRS workshop report \cite[Problem G]{BIRS2012}, already with the same
channel in both positions.  We do not claim that either dimension is
minimal.

\paragraph{Entanglement and secrecy.}
Public discussion and privacy amplification are central to the classical
theory of key agreement \cite{BennettBrassardRobert88,Maurer93,BBCM95}.
Entanglement purification provides a quantum route to secrecy: nearly pure
shared entangled pairs decouple from a purifying adversary
\cite{BBPSSW96,BDSW96,DeutschEtAl96}.  Bound entanglement showed that
entanglement need not be distillable into singlets.  In particular, PPT
entangled states have zero distillable entanglement \cite{HHH98}.  Some PPT
entangled states nevertheless have positive distillable secret key
\cite{keyBoundEntanglement}.  Their private-state description explains how
secrecy can persist in a quantum shield even when singlet distillation is
impossible \cite{keyPrivateStates}.

Separable states have zero key against a purifying Eve
\cite{CurtyLewensteinLutkenhaus04,keyBoundEntanglement}.  The converse was
posed explicitly as Problem 24, ``Secret key from all entangled states,'' in
Kr\"uger and Werner's open-problem collection: the entry is dated
15 March 2005 and lists P.~Horodecki as contact \cite{KrugerWerner05}.
The question is also discussed in the private-state literature
\cite{keyPrivateStates,HorodeckiEtAl18}.  One-way coding theorems give useful
positive-key criteria \cite{DevetakWinter05}, while Theorem~\ref{thm:main-state}
in particular rules out a positive key rate for a specific entangled state
under ordinary finite two-way protocols, whose round count may grow with
the input length.  The distinction
between secrecy needed to prepare correlations and key recoverable from
them also matters: measurements of an entangled state can yield correlations
with a positive secrecy formation cost without proving a positive
distillation rate \cite{GisinWolf00,GisinRennerWolf02,AcinGisin05}.

There are earlier quantitative obstructions near private bits.  Kim and
Sanders obtained a distance bound for PPT states under a Hermitian-block
hypothesis \cite{KimSanders10}, and Badzi\k{a}g and coauthors removed that
hypothesis \cite{BadziagEtAl14}.  Those bounds depend on the shield dimension,
which may grow with a protocol.  Our bound applies to the final classical bit
registers and Eve's complete public side information, with a constant
independent of the input length and the local memories.

Pauwels, Gisin, and Renner recently constructed a finite classical bipartite
source with positive secrecy formation cost and zero asymptotic secret-key
rate under finite-round authenticated public discussion, with the round
count allowed to grow with block length
\cite[Theorem 1 and Appendix A]{PauwelsGisinRenner2026}.
Their revised paper also proves positive two-way distillable quantum key for
the Horodecki two-qutrit states $\sigma_\alpha$ with $3<\alpha\leq5$,
including the bound-entangled range $3<\alpha\leq4$, against a purifying quantum Eve
\cite[Corollary 3 and Appendix I.7]{PauwelsGisinRenner2026}.  The state in
Theorem~\ref{thm:main-state} gives the quantum zero-key conclusion under the
local quantum protocol model above.

\paragraph{The operational obstruction.}
The first part of the proof concerns a class $\mathscr C$ of states
$\omega$ on $\C^a\otimes\C^b$ with a local representation
\[
 \omega=(\mathcal L\otimes\mathcal M)(\chi\chi^*),
 \quad
 \chi\in\C^r\otimes\C^s,\quad
 \mathcal L:\Mat r\to\Mat a,\quad
 \mathcal M:\Mat s\to\Mat b,
\]
where $\mathcal L,\mathcal L\circ T_r,\mathcal M,\mathcal M\circ T_s$
are CP.  These input-transpose conditions are equivalent to the
output-transpose PPT convention above, as Lemma~\ref{lem:ppt-stability}
shows.  The maps may be rectangular and need not preserve trace; only
the output $\omega$ has trace one.  This condition persists under tensor powers.
Relative to one common transcript measure, the four final bit branches have
positive local effect densities $X_i(t)\otimes Y_j(t)$ on the two local
input spaces of the protocol for almost every
complete transcript $t$, with the same two local pairs for all
$i,j\in\{0,1\}$.  To prove this, we run the protocol on auxiliary
product probes.  Their two local sampling tapes are conditionally independent
given the complete public record.  Informationally complete tests on
untouched references turn that independence into common product factors,
and a filter on the references transfers the factors to the actual input.

For a state in $\mathscr C$, a coherence inequality bounds the overlap
between the $00$ and $11$ branches by the probabilities of disagreement.
After integration over transcripts, let $e$ be the total probability of
different bits and let $\mathfrak f$ be the root fidelity between Eve's
unnormalized $00$ and $11$ conditional states, summed over the public
record.  We prove
\[
                  \mathfrak f\leq\sqrt{e(1-e)}+e.
\]
If the output is at trace-norm distance $\eta$ from an ideal bit, correctness
and secrecy give, respectively,
\[
                 e\leq\frac\eta2,
       \qquad \mathfrak f\geq\frac{1-\eta}{2}.
\]
For $\eta<1/5$, the right side of the first display is less than $2/5$,
whereas the second display requires more than $2/5$.  This proves the uniform
gap.  Taking the first bit of a longer ideal key is a trace-norm contraction,
so no positive asymptotic key rate is possible.

\paragraph{How the dimension-ten construction enters.}
For CP maps $F:\Mat a\to\Mat b$ and $G:\Mat b\to\Mat c$, define
$F^\sharp=T_a\circ F^\dagger\circ T_b$, where $F^\dagger$ is the
Hilbert--Schmidt adjoint.  The transpose-adjoint Choi identity is
\[
 J(G\circ F)=(F^\sharp\otimes G)(\Omega_b\Omega_b^*),
 \qquad \Omega_b=\sum_{i=1}^b e_i\otimes e_i.
\]
This identity and the local-product formulation are established machinery
\cite[Lemma I.1(2), Section IV.B]{CMHW2019}; we prove the needed rectangular
form and normalization in Lemma~\ref{lem:choi-transfer}.  When $F$ and $G$
are PPT and the Choi matrix is nonzero, division by its trace gives a state
in $\mathscr C$.  Applying this observation to
Theorem~\ref{thm:main-pair} proves that \eqref{eq:main-state-formula} belongs
to the class covered by the operational obstruction.

It remains to make this state entangled.  A nonzero separable positive
matrix has a nonzero product vector in its range, a necessary part of the
range criterion \cite{Horodecki1997}.  We exclude such vectors directly.
Start with a PPT map $L:\Mat4\to\Mat4$ and twenty projective directions
$[x]$ at which $L(xx^*)$ is singular.  No nonzero homogeneous quadratic in
four variables vanishes at ten of these directions.  The ten-dimensional
symmetric square records the quadratic monomials of $x$, and the
six-dimensional exterior square converts rank loss into a product vector
in $\ker Z$.  If $\ran Z$ contained a product vector, its two factors would
give two nonzero quadratics whose zero sets cover all twenty directions.
Each can cover at most nine, and $9+9<20$.  A separate positive definite
output of $L$ ensures that $Z$ is nonzero.

This range argument is related to unextendible product bases
\cite{Bennett1999}, nonorthogonal product exclusion by linear independence
\cite[Section IV, Lemma 3]{Pittenger2003}, and polynomial evaluation methods
\cite[Proposition 1.3]{Parthasarathy2004}.  The complementary-pair operation
on the exterior square agrees with the four-dimensional fermionic duality
of Schliemann, Loss, and MacDonald
\cite[Section III]{SchliemannLossMacDonald2001}.  Our explicit $L$ comes from
a real integer $6$-by-$4$ matrix pencil.  Its rank-losing directions solve a
bilinear system of the type appearing in the study of low-rank PPT states
on $\C^4\otimes\C^4$ \cite[Section 7]{HansenEtAl2012}.  Exact reductions at
three primes prove that the relevant degree-twenty algebra is a field with
normal-closure Galois group $S_{20}$.  This symmetry carries one nonzero
quadratic evaluation determinant to every ten-point choice.  The arithmetic
certificate and its precise computational coverage are given in
Appendix~\ref{app:arithmetic}.

\paragraph{The channel and the projection construction.}
The PPT-composition problem has important affirmative cases, including two
maps on $\Mat3$ \cite[Corollary III.1]{CMHW2019}; see also
\cite{ChenYangTang2019}.  Other cases include Gaussian channels
\cite{CMHW2019} and diagonal unitary covariant or conjugate diagonal
unitary covariant PPT maps \cite[Theorem~4.5]{SinghNechita2022}.
Asymptotic approach to the entanglement-breaking cone was proved for
iterates of unital or trace-preserving PPT maps
\cite[Theorem~3.3]{KMP2018}.  Finite entanglement-breaking index was
proved for unital PPT channels by Rahaman, Jaques, and Paulsen
\cite[Theorem~4.4]{RahamanJaquesPaulsen2018}, and for PPT channels with a
full-rank invariant state by Hanson, Rouz\'e, and Stilck Fran\c ca
\cite[Theorem~3.10]{HansonRouzeFranca2020}.
More recent results concern different scopes.  An and Lee prove that a
qutrit CP map whose Choi matrix is one-copy undistillable and a qutrit CP
map whose Choi matrix has Schmidt number at most two compose to an
entanglement-breaking map in either order \cite[Theorem~4]{AnLee2026}.
Park's preprint states eventual entanglement breaking for each CP and
completely copositive endomap, with a map-dependent number of iterations
\cite[Theorem~1.1]{Park2026}.  A failure at the second iterate is
compatible with such eventual behavior.

To obtain Theorem~\ref{thm:main-channel}, we rescale the two maps, alternate
them between two coordinate blocks, and send the missing trace to an
absorbing flag.  The switch follows Christandl, M\"uller-Hermes, and Wolf
\cite[Section IV.A]{CMHW2019}; the flag completion follows Filippov's
trace-preserving extension \cite[Proposition 3, Equation (15)]{Filippov2021}.
The Choi matrix of the square has a local corner equal to a positive multiple
of $Z$.  Local compression preserves separability, so that corner certifies
that the square is not entanglement breaking.

The final part of the paper develops a second way to retain entanglement
under two PPT maps.  A rectangular criterion starts from real unit vectors
and projective measurements, uses a block Gram matrix for positivity, and
uses commutation for the partial-transpose property.  A support argument
using zero tensor-basis diagonal entries rules out separability over the
complex field.  We realize
the criterion by a restricted-intersection construction
\cite{FW1981,ABS1991} and tensor products of the Mermin--Peres parity
measurements \cite{Mermin1990,Peres1990,Peres1991}.  Its dimensions are much
larger, but the mechanism is independent of the twenty-direction geometry.
Frankl and Rödl's forbidden-intersection theory similarly forces fixed-size
orthogonal families in large subsets of a sign cube
\cite[Theorem 1.11]{FR1987}; our eight-point estimate is proved by a direct
polynomial bound and an elementary tensor-power fiber argument.
The real construction also gives an entangled output when the same
trace-preserving rectangular PPT channel is applied to both halves of a
maximally entangled state.  This distinction between real matrices and complex
separability matters: the real-field example of Chiribella, Davidson,
Paulsen, and Rahaman has an entanglement-breaking complexification
\cite[Example 9.6]{CDPR2023}.

\paragraph{Organization.}
Section~\ref{sec:foundations} establishes the common map conventions,
represented class, and Choi transfer.  Sections~\ref{sec:coherence}--\ref{sec:secret-key}
prove the operational theorem.  Sections~\ref{sec:geometry} and
\ref{sec:certificate} construct the dimension-ten pair, and
Section~\ref{sec:applications} proves the state and channel consequences.
Sections~\ref{sec:projection} and \ref{sec:combinatorial} give the independent
projection and combinatorial method.  The appendices give the exact certificate, the general algebraic facts
used in its proof, and the supplementary finite checks of the explicit data.
==== END Entanglement-with-zero-distillable-secret-key-in-local-dimension-ten//introduction.tex ====

==== BEGIN Entanglement-with-zero-distillable-secret-key-in-local-dimension-ten//main.tex ====
\documentclass[11pt]{article}
\usepackage[T1]{fontenc}
\usepackage{lmodern}
\usepackage[margin=1in]{geometry}
\usepackage{amsmath,amssymb,amsthm,mathtools,mathrsfs}
\usepackage{microtype}
\usepackage{needspace}
\usepackage{booktabs}
\usepackage{listings}
\usepackage{xcolor}
\usepackage[colorlinks=true,linkcolor=blue!45!black,citecolor=blue!45!black,urlcolor=blue!45!black]{hyperref}
\hypersetup{pdftitle={Entanglement with zero distillable secret key in local dimension ten},pdfauthor={OpenAI},pdfsubject={Entanglement, secret-key distillation, and PPT maps}}
\numberwithin{equation}{section}
\newtheorem{theorem}{Theorem}[section]
\newtheorem{proposition}[theorem]{Proposition}
\newtheorem{lemma}[theorem]{Lemma}
\newtheorem{corollary}[theorem]{Corollary}
\theoremstyle{definition}
\newtheorem{definition}[theorem]{Definition}
\theoremstyle{remark}
\newtheorem{remark}[theorem]{Remark}
\newcommand{\Mat}[1]{M_{#1}(\mathbb C)}
\newcommand{\tr}{\operatorname{tr}}
\newcommand{\Tr}{\operatorname{tr}}
\newcommand{\ran}{\operatorname{ran}}
\newcommand{\supp}{\operatorname{supp}}
\newcommand{\Ad}{\operatorname{Ad}}
\newcommand{\rank}{\operatorname{rank}}
\newcommand{\T}{\mathsf T}
\newcommand{\F}{\mathbb F}
\newcommand{\Q}{\mathbb Q}
\newcommand{\C}{\mathbb C}
\newcommand{\norm}[1]{\left\lVert#1\right\rVert}
\newcommand{\ip}[2]{\left\langle #1,#2\right\rangle}
\setlength{\emergencystretch}{1.5em}
\lstset{language=Python,basicstyle=\ttfamily\footnotesize,columns=fullflexible,
  keepspaces=true,breaklines=true,breakatwhitespace=false,showstringspaces=false,
  frame=lines,numbers=left,numberstyle=\tiny,numbersep=7pt,xleftmargin=1.6em}
\title{Entanglement with zero distillable secret key\\
in local dimension ten}
\author{OpenAI}
\date{September 27, 2026}

\begin{document}
\maketitle

\begin{abstract}
We construct an entangled state on $\C^{10}\otimes\C^{10}$ with zero
distillable secret key for the local-instrument protocols specified here.
They allow joint processing of all copies and unlimited two-way public
communication, with the input as the only shared private resource and an
eavesdropper holding a purification and the complete public record.
The construction also disproves the unrestricted two-map PPT-composition
conjecture. A separate trace-preserving PPT channel on $\Mat{21}$ has a
square that is not entanglement breaking.
\end{abstract}

\input{sections/introduction}
\input{sections/foundations}
\input{sections/coherence}
\input{sections/transcripts}
\input{sections/secret-key}
\input{sections/geometry}
\input{sections/certificate}
\input{sections/applications}
\input{sections/projection}
\input{sections/combinatorial}

\appendix
\input{appendices/arithmetic}
\input{appendices/supplementary-checks}
\input{references}

\end{document}
==== END Entanglement-with-zero-distillable-secret-key-in-local-dimension-ten//main.tex ====

==== BEGIN Entanglement-with-zero-distillable-secret-key-in-local-dimension-ten//projection.tex ====
\section{An alternative construction from projection overlaps}\label{sec:projection}

The dimension-ten construction is complete.  Sections~\ref{sec:projection}
and \ref{sec:combinatorial} now produce another entangled member of
$\mathscr C$ in much larger finite dimensions.  The real construction has
an additional symmetry: the same trace-preserving rectangular PPT channel
acts on both halves of a maximally entangled state.  These are parallel
local actions on two subsystems, distinct from the self-composition of a
square channel in Theorem~\ref{thm:main-channel}.

The mechanism also differs from the dimension-ten range obstruction.
The input consists of real unit vectors and projective measurements.
The vectors produce a large sum of correlations, whereas
zero trace overlaps among the projections restrict the supports of the
product vectors in a hypothetical separable decomposition.  These two
bounds will conflict.  Trace Gram matrices of positive factors also occur
in completely positive semidefinite factorizations
\cite{PSVW2018}; here the zero pattern of such trace pairings supplies the
support restriction.

For self-adjoint projections \(E,F\), their trace overlap is always a
nonnegative real number:
\begin{equation}\label{eq:projection-overlap}
 \tr(EF)=\tr(FEF)=\tr\bigl((EF)^*EF\bigr)\geq0.
\end{equation}
In particular, it vanishes exactly when \(EF=0\).  This fact does not
require \(E\) and \(F\) to commute.

\begin{proposition}[Rectangular projection criterion]
\label{prop:projection-criterion}
Let \(Q,K,D\) be positive integers, let \(\mathcal Q\) be a set of
\(Q\) elements, and let \(u_q\in\mathbb R^K\), \(q\in\mathcal Q\), be
unit vectors.  Put \(c_{qr}=u_q^{\T}u_r\).  For each \(q\), let
\(\{P_i:i\in\mathcal I_q\}\) be a finite projective measurement on
\(\C^D\): its members are self-adjoint projections, they are mutually
orthogonal, and their sum is \(I_D\).  Zero projections are allowed.
Take the label sets \(\mathcal I_q\) disjoint, put
\(\mathcal I=\bigsqcup_{q\in\mathcal Q}\mathcal I_q\), and set
\(n=|\mathcal I|\).  Suppose that
\begin{enumerate}
 \item \(P_iP_j=P_jP_i\) whenever \(i\in\mathcal I_q\),
       \(j\in\mathcal I_r\), and \(c_{qr}\ne0\);
 \item there is a real number \(\kappa<Q/K\) such that every
       \(J\subseteq\mathcal I\) satisfying
       \(\tr(P_iP_j)>0\) for all distinct \(i,j\in J\) has
       \(|J|\leq\kappa\).
\end{enumerate}
After ordering \(\mathcal I\), define the complex-linear map
\(\Psi:\Mat n\to\Mat D\) on matrix units by
\begin{equation}\label{eq:projection-map}
 H_{ij}=c_{qr}P_iP_j,\qquad
 \Psi(E_{ij})=H_{ij}
 \quad(i\in\mathcal I_q,\ j\in\mathcal I_r).
\end{equation}
Then \(\Psi\) and its Hilbert--Schmidt adjoint
\(\Psi^\dagger:\Mat D\to\Mat n\) are PPT.  Moreover,
\begin{equation}\label{eq:projection-composite}
 C:=J(\Psi^\dagger\circ\Psi)
 \quad\text{is nonseparable over }\C^n\otimes\C^n,
 \qquad \tr C=Q^2D.
\end{equation}
\end{proposition}

\begin{proof}
We first prove that $\Psi$ is PPT.  To establish nonseparability, let
$B$ be the compression of $C$ to the span of the vectors
$e_i\otimes e_i$, expressed in that basis, and let
$\mathbf1=(1,\ldots,1)^\T$.  We will compare two bounds on the sum
of its entries.  The vector Gram matrix gives
\[
 \mathbf1^*B\mathbf1\geq\frac QK\tr B,
\]
whereas the zero tensor-basis diagonal entries would force a separable
decomposition of $C$ to satisfy
$\mathbf1^*B\mathbf1\leq\kappa\tr B$.
We will also have $\tr B=QD>0$, so the strict inequality $\kappa<Q/K$
will make these bounds incompatible.

\emph{The block Gram matrix and its partial transposes.}
Regard each \(u_q\) also as a vector in \(\C^K\).  For arbitrary
\(w_i\in\C^D\), self-adjointness of the projections gives
\begin{equation}\label{eq:projection-block-gram}
 \sum_{i,j\in\mathcal I}\langle w_i,H_{ij}w_j\rangle
 =
 \left\|
   \sum_{q\in\mathcal Q}\sum_{i\in\mathcal I_q}u_q\otimes P_iw_i
 \right\|^2\geq0.
\end{equation}
Thus the block matrix
\(H=[H_{ij}]_{i,j\in\mathcal I}=J(\Psi)\) is positive semidefinite.
Lemma~\ref{lem:choi-separable} implies that \(\Psi\) is CP.

Since \(c_{qr}=c_{rq}\) is real, the first hypothesis gives
\begin{equation}\label{eq:projection-block-symmetry}
 H_{ij}=H_{ji}=H_{ij}^*.
\end{equation}
Indeed, if \(c_{qr}\ne0\), the two projections commute; if
\(c_{qr}=0\), both blocks vanish and no commutation is needed.
Let \(\Gamma_1=T_n\otimes\mathrm{id}_D\) and
\(\Gamma_2=\mathrm{id}_n\otimes T_D\) denote the partial transposes
on the input and output Choi factors.  Block symmetry gives
\begin{equation}\label{eq:projection-partial-transposes}
 H^{\Gamma_1}=H,\qquad
 H^{\Gamma_2}=H^{\T}\succeq0.
\end{equation}
For the second identity, full transpose is the product of the two
partial transposes.  Full transpose preserves complex positive
semidefiniteness: from \(H=R^*R\) we get
\(H^{\T}=(\overline R)^*\overline R\).  The Choi identities in
Lemma~\ref{lem:choi-separable} now show that \(T_D\circ\Psi\) is CP.
Hence \(\Psi\) is PPT.

Lemma~\ref{lem:ppt-stability} gives complete positivity and the PPT
property for \(\Psi^\dagger\).  We will also use a more specific
identity.  Testing the defining adjoint relation on matrix units gives,
for every \(A\in\Mat D\),
\begin{equation}\label{eq:projection-adjoint}
 [\Psi^\dagger(A)]_{ij}=\tr(H_{ij}^*A).
\end{equation}
Equation~\eqref{eq:projection-block-symmetry} therefore yields
\begin{equation}\label{eq:projection-adjoint-transpose}
 T_n\circ\Psi^\dagger=\Psi^\dagger
\end{equation}
on all complex matrices, including non-Hermitian ones.

\emph{The tensor-basis diagonal and a compression.}
The composition \(\Psi^\dagger\circ\Psi\) is CP, so \(C\succeq0\).
Index its rows and columns by \(\mathcal I\times\mathcal I\).
Equation~\eqref{eq:projection-adjoint} gives the fully indexed formula
\begin{equation}\label{eq:projection-composite-entries}
 C_{(i,a),(j,b)}=\tr(H_{ab}^*H_{ij}).
\end{equation}
Since \(c_{qq}=1\) and \(P_i^2=P_i\), we have \(H_{ii}=P_i\).
The diagonal entries with indices \((i,j)\), and the entries of the
compression \(B\), are consequently
\begin{align}
 C_{(i,j),(i,j)}&=\tr(P_iP_j),
       \label{eq:projection-crossed-diagonal}\\
 B_{ij}:=C_{(i,i),(j,j)}
   &=\tr(H_{ij}^*H_{ij})
     =c_{qr}^{\,2}\tr(P_iP_j)
       \quad(i\in\mathcal I_q,\ j\in\mathcal I_r).
       \label{eq:projection-compression}
\end{align}
The last equality follows from
\(\tr(P_jP_iP_iP_j)=\tr(P_iP_j)\), by idempotence and cyclicity of
trace.  It remains valid without commutation and when \(c_{qr}=0\).

For each pair \(q,r\), completeness of the two measurements gives
\[
 \sum_{i\in\mathcal I_q}\sum_{j\in\mathcal I_r}\tr(P_iP_j)
 =\tr\!\left[
    \left(\sum_{i\in\mathcal I_q}P_i\right)
    \left(\sum_{j\in\mathcal I_r}P_j\right)
   \right]=D.
\]
Summing \eqref{eq:projection-crossed-diagonal} proves
\(\tr C=Q^2D\).  The same identity and
\eqref{eq:projection-compression} give
\begin{equation}\label{eq:projection-gram-bound}
 \tr B=QD,\qquad
 \mathbf1^*B\mathbf1
   =D\sum_{q,r\in\mathcal Q}c_{qr}^{\,2}
   \geq\frac{DQ^2}{K}.
\end{equation}
To see the inequality, set
\(M=\sum_{q\in\mathcal Q}u_qu_q^{\T}\), a positive semidefinite
\(K\)-by-\(K\) real matrix.  Then
\(\tr M=Q\) and \(\tr(M^2)=\sum_{q,r}c_{qr}^2\).
Cauchy--Schwarz applied to its \(K\) nonnegative eigenvalues yields
\(\tr(M^2)\geq(\tr M)^2/K=Q^2/K\).  Equivalently, the vector Gram
matrix has rank at most \(K\).

\emph{The support bound forced by separability.}
Suppose that \(C\) is separable over \(\C^n\otimes\C^n\).
Spectrally decomposing its local positive factors and absorbing positive
weights into the vectors gives a finite decomposition
\[
 C=\sum_\ell
   (x^{(\ell)}\otimes y^{(\ell)})
   (x^{(\ell)}\otimes y^{(\ell)})^*,
 \qquad x^{(\ell)},y^{(\ell)}\in\C^n.
\]
Whenever \(\tr(P_iP_j)=0\), the corresponding tensor-basis diagonal entry is
\[
 0=C_{(i,j),(i,j)}
   =\sum_\ell |x_i^{(\ell)}y_j^{(\ell)}|^2.
\]
Each summand is nonnegative, so \(x_i^{(\ell)}y_j^{(\ell)}=0\) for
every \(\ell\).  For one summand put \(z_i=x_i y_i\).
If distinct \(i,j\) lie in \(\supp z\), then \(x_i y_j\ne0\).
The preceding implication and \eqref{eq:projection-overlap} force
\(\tr(P_iP_j)>0\).  The second hypothesis therefore gives
\(|\supp z|\leq\kappa\).

Compressing the separable decomposition to the diagonal tensor
subspace gives \(B=\sum_\ell z^{(\ell)}(z^{(\ell)})^*\).
Complex Cauchy--Schwarz on each support now yields
\begin{equation}
 \begin{aligned}
 \mathbf1^*B\mathbf1
  &=\sum_\ell\left|\sum_i z_i^{(\ell)}\right|^2
    \leq \kappa\sum_\ell\|z^{(\ell)}\|^2
     =\kappa\tr B\\
  &<\frac{Q}{K}\tr B
     =\frac{DQ^2}{K}.
 \end{aligned}
 \label{eq:projection-separable-bound}
\end{equation}
The inequality is also valid for a zero \(z^{(\ell)}\), whose support
is empty.  The strict step uses \(\kappa<Q/K\) and
\(\tr B=QD>0\).  This contradicts
\eqref{eq:projection-gram-bound} and proves nonseparability.
\end{proof}

The complex criterion has a state interpretation
without the reality assumption.  By
\eqref{eq:projection-adjoint-transpose}, Lemma~\ref{lem:choi-transfer}
gives
\begin{equation}\label{eq:projection-complex-transfer}
 C=
 \bigl((\Psi^\dagger\circ T_D)\otimes\Psi^\dagger\bigr)
       (\Omega_D\Omega_D^*).
\end{equation}
Both local maps in this formula satisfy the input-transpose CP
conditions, as the transfer lemma asserts for the PPT pair
\(\Psi,\Psi^\dagger\).  Thus \(C/(Q^2D)\in\mathscr C\) also in the
complex case, and Theorem~\ref{thm:zero-key} and
Proposition~\ref{prop:operational-extensions} apply to it.  The two local
maps in \eqref{eq:projection-complex-transfer} may differ; the reality
assumption is what gives the same channel in
\eqref{eq:projection-real-state}.

\begin{corollary}[The same local channel for real projections]
\label{cor:real-channel}
Under the hypotheses of Proposition~\ref{prop:projection-criterion},
suppose that every \(P_i\) is real symmetric in the fixed basis of
\(\C^D\), and put \(\Lambda=\Psi^\dagger:\Mat D\to\Mat n\).
Then, on all complex inputs,
\begin{equation}\label{eq:projection-real-invariances}
 \Lambda\circ T_D=\Lambda=T_n\circ\Lambda,
 \qquad \tr\Lambda(A)=Q\,\tr A.
\end{equation}
In particular, \(\Lambda/Q\) is a trace-preserving PPT channel.
For \(\Phi_D=\Omega_D/\sqrt D\), the normalized maximally entangled
vector on \(\C^D\otimes\C^D\), one has
\begin{equation}\label{eq:projection-real-state}
 \frac{C}{Q^2D}
 =
 \left(\frac{\Lambda}{Q}\otimes\frac{\Lambda}{Q}\right)
       (\Phi_D\Phi_D^*).
\end{equation}
This is an entangled density operator on \(\C^n\otimes\C^n\) in
\(\mathscr C\).
\end{corollary}

\begin{proof}
Reality and \eqref{eq:projection-block-symmetry} give the additional
identity \(H_{ij}^{\T}=H_{ij}\).  Equation~\eqref{eq:projection-adjoint}
therefore becomes
\[
 [\Lambda(A)]_{ij}=\tr(H_{ij}A),\qquad
 [\Lambda(T_D(A))]_{ij}=\tr(H_{ij}^{\T}A)=\tr(H_{ij}A).
\]
This proves the first transpose invariance; the second is
\eqref{eq:projection-adjoint-transpose}.  Also,
\[
 \tr\Lambda(A)=\sum_i\tr(H_{ii}A)
 =\sum_{q\in\mathcal Q}\sum_{i\in\mathcal I_q}\tr(P_iA)
 =Q\,\tr A.
\]
Since \(\Lambda\) is CP and PPT by the proposition, \(\Lambda/Q\)
is a trace-preserving PPT channel with input size \(D\) and output
size \(n\).

Apply Lemma~\ref{lem:choi-transfer} to the pair \(\Psi,\Lambda\).
Its first local factor is
\[
 \Psi^\sharp=T_n\circ\Lambda\circ T_D=\Lambda
\]
by the two invariances.  Thus
\begin{equation}\label{eq:projection-real-identification}
 G:=(\Lambda\otimes\Lambda)(\Omega_D\Omega_D^*)=C.
\end{equation}
Dividing this identity by \(Q^2D\) gives
\eqref{eq:projection-real-state}.  Proposition~\ref{prop:projection-criterion}
gives \(\tr C=Q^2D>0\) and complex nonseparability.  Finally,
\(\Lambda/Q\) and \((\Lambda/Q)\circ T_D\) are CP, so
\eqref{eq:projection-real-state} is a representation of the form in
Definition~\ref{def:represented-class}.  This proves the assertion.
\end{proof}

The two channel uses in \eqref{eq:projection-real-state} act on separate
subsystems.  We next embed the rectangular maps into one matrix algebra
to obtain a composition of square PPT maps.

\begin{corollary}[Square embedding]\label{cor:square-embedding}
Under the hypotheses of Proposition~\ref{prop:projection-criterion},
suppose in addition that \(n\geq D\), and let
\(U:\C^D\to\C^n\) be the real coordinate isometry onto the first
\(D\) coordinates.  Define
\begin{equation}\label{eq:projection-square-pair}
 \Xi_1=\Ad_U\circ\Psi,\qquad
 \Xi_2=\Psi^\dagger\circ\Ad_{U^*}
       =\Xi_1^\dagger .
\end{equation}
Then \(\Xi_1,\Xi_2:\Mat n\to\Mat n\) are PPT and
\[
 \Xi_2\circ\Xi_1=\Psi^\dagger\circ\Psi.
\]
Their composition is not entanglement breaking.
\end{corollary}

\begin{proof}
Embedding and compression by \(U\) are CP.  The PPT composition
stability in Lemma~\ref{lem:ppt-stability} therefore applies to both
maps.  Directly, the reality of \(U\) also gives
\(T_n(UAU^*)=U T_D(A)U^*\), while
\eqref{eq:projection-adjoint-transpose} fixes the output transpose of
the second map.  The adjoint identity follows by reversing the two
factors, and \(U^*U=I_D\) gives the composite identity.  Its Choi
matrix is the nonseparable \(C\) of
Proposition~\ref{prop:projection-criterion}; the characterization in
Lemma~\ref{lem:choi-separable} proves the last assertion.
\end{proof}

The dimension comparison in this corollary is used only to choose
the isometry \(U\).  The rectangular criterion itself has no such
comparison.  The displayed square maps need not preserve trace or be
unital.
==== END Entanglement-with-zero-distillable-secret-key-in-local-dimension-ten//projection.tex ====

==== BEGIN Entanglement-with-zero-distillable-secret-key-in-local-dimension-ten//references.tex ====
\begin{thebibliography}{99}
\raggedright
\setlength{\itemsep}{3pt plus 1pt minus 1pt}

\bibitem{AcinGisin05}
A.~Ac\'in and N.~Gisin,
``Quantum correlations and secret bits,''
\emph{Physical Review Letters} \textbf{94}, 020501 (2005).
\href{https://doi.org/10.1103/PhysRevLett.94.020501}{doi:10.1103/PhysRevLett.94.020501}.
\href{https://arxiv.org/abs/quant-ph/0310054v3}{arXiv:quant-ph/0310054v3}.

\bibitem{ABS1991}
N.~Alon, L.~Babai, and H.~Suzuki,
``Multilinear polynomials and Frankl--Ray-Chaudhuri--Wilson type intersection theorems,''
\emph{Journal of Combinatorial Theory, Series A} \textbf{58}(2), 165--180 (1991).
\href{https://doi.org/10.1016/0097-3165(91)90058-O}{doi:10.1016/0097-3165(91)90058-O}.

\bibitem{AnLee2026}
J.~An and S.~Lee,
``Beyond the Positive Partial Transpose Squared Conjecture: The Qutrit Case,''
preprint, \href{https://arxiv.org/abs/2607.15947v1}{arXiv:2607.15947v1}
[quant-ph] (17 July 2026).

\bibitem{Arkhipov2012}
A.~Arkhipov,
``Extending and characterizing quantum magic games,''
\href{https://arxiv.org/abs/1209.3819}{arXiv:1209.3819} (2012).

\bibitem{BadziagEtAl14}
P.~Badzi\k{a}g, K.~Horodecki, M.~Horodecki, J.~Jenkinson,
and S.~J.~Szarek,
``Bound entangled states with extremal properties,''
\emph{Physical Review A} \textbf{90}, 012301 (2014).
\href{https://doi.org/10.1103/PhysRevA.90.012301}{doi:10.1103/PhysRevA.90.012301}.
\href{https://arxiv.org/abs/1309.7992v2}{arXiv:1309.7992v2}.

\bibitem{BarYossefEtAl2004}
Z.~Bar-Yossef, T.~S.~Jayram, R.~Kumar, and D.~Sivakumar,
``An information statistics approach to data stream and communication
complexity,''
\emph{Journal of Computer and System Sciences} \textbf{68}(4), 702--732 (2004).
\href{https://doi.org/10.1016/j.jcss.2003.11.006}{doi:10.1016/j.jcss.2003.11.006}.

\bibitem{BBCM95}
C.~H.~Bennett, G.~Brassard, C.~Cr\'epeau, and U.~M.~Maurer,
``Generalized privacy amplification,''
\emph{IEEE Transactions on Information Theory} \textbf{41}(6),
1915--1923 (1995).
\href{https://doi.org/10.1109/18.476316}{doi:10.1109/18.476316}.

\bibitem{BBPSSW96}
C.~H.~Bennett, G.~Brassard, S.~Popescu, B.~Schumacher,
J.~A.~Smolin, and W.~K.~Wootters,
``Purification of noisy entanglement and faithful teleportation via noisy channels,''
\emph{Physical Review Letters} \textbf{76}, 722--725 (1996).
\href{https://doi.org/10.1103/PhysRevLett.76.722}{doi:10.1103/PhysRevLett.76.722}.
\href{https://arxiv.org/abs/quant-ph/9511027}{arXiv:quant-ph/9511027}.

\bibitem{BennettBrassardRobert88}
C.~H.~Bennett, G.~Brassard, and J.-M.~Robert,
``Privacy amplification by public discussion,''
\emph{SIAM Journal on Computing} \textbf{17}(2), 210--229 (1988).
\href{https://doi.org/10.1137/0217014}{doi:10.1137/0217014}.

\bibitem{Bennett1999}
C.~H.~Bennett, D.~P.~DiVincenzo, T.~Mor, P.~W.~Shor, J.~A.~Smolin, and
B.~M.~Terhal,
``Unextendible product bases and bound entanglement,''
\emph{Physical Review Letters} \textbf{82}, 5385--5388 (1999).
\href{https://doi.org/10.1103/PhysRevLett.82.5385}{doi:10.1103/PhysRevLett.82.5385}.
The cited lemma locator refers to
\href{https://arxiv.org/abs/quant-ph/9808030v2}{arXiv:quant-ph/9808030v2}.

\bibitem{BDSW96}
C.~H.~Bennett, D.~P.~DiVincenzo, J.~A.~Smolin, and W.~K.~Wootters,
``Mixed-state entanglement and quantum error correction,''
\emph{Physical Review A} \textbf{54}, 3824--3851 (1996).
\href{https://doi.org/10.1103/PhysRevA.54.3824}{doi:10.1103/PhysRevA.54.3824}.
\href{https://arxiv.org/abs/quant-ph/9604024}{arXiv:quant-ph/9604024}.

\bibitem{ChenYangTang2019}
L.~Chen, Y.~Yang, and W.-S.~Tang,
``Positive-partial-transpose square conjecture for $n=3$,''
\emph{Physical Review A} \textbf{99}, 012337 (2019).
\href{https://doi.org/10.1103/PhysRevA.99.012337}{doi:10.1103/PhysRevA.99.012337}.

\bibitem{CDPR2023}
G.~Chiribella, K.~R.~Davidson, V.~I.~Paulsen, and M.~Rahaman,
``Positive maps and entanglement in real Hilbert spaces,''
\emph{Annales Henri Poincar\'e} \textbf{24}, 4139--4168 (2023).
\href{https://doi.org/10.1007/s00023-023-01325-x}{doi:10.1007/s00023-023-01325-x}.
\href{https://arxiv.org/abs/2207.02510v2}{arXiv:2207.02510v2}.

\bibitem{CLMOW2014}
E.~Chitambar, D.~Leung, L.~Man\v{c}inska, M.~Ozols, and A.~Winter,
``Everything you always wanted to know about LOCC (but were afraid to ask),''
\emph{Communications in Mathematical Physics} \textbf{328}(1), 303--326 (2014).
\href{https://doi.org/10.1007/s00220-014-1953-9}{doi:10.1007/s00220-014-1953-9}.
\href{https://arxiv.org/abs/1210.4583}{arXiv:1210.4583}.

\bibitem{Choi1975}
M.-D.~Choi,
``Completely positive linear maps on complex matrices,''
\emph{Linear Algebra and its Applications} \textbf{10}, 285--290 (1975).
\href{https://doi.org/10.1016/0024-3795(75)90075-0}{doi:10.1016/0024-3795(75)90075-0}.

\bibitem{CMHW2019}
M.~Christandl, A.~M\"uller-Hermes, and M.~M.~Wolf,
``When do composed maps become entanglement breaking?''
\emph{Annales Henri Poincar\'e} \textbf{20}, 2295--2322 (2019).
\href{https://doi.org/10.1007/s00023-019-00774-7}{doi:10.1007/s00023-019-00774-7}.
The cited section and theorem locators refer to
\href{https://arxiv.org/abs/1807.01266v2}{arXiv:1807.01266v2}.

\bibitem{CurtyLewensteinLutkenhaus04}
M.~Curty, M.~Lewenstein, and N.~L\"utkenhaus,
``Entanglement as a precondition for secure quantum key distribution,''
\emph{Physical Review Letters} \textbf{92}, 217903 (2004).
\href{https://doi.org/10.1103/PhysRevLett.92.217903}{doi:10.1103/PhysRevLett.92.217903}.
\href{https://arxiv.org/abs/quant-ph/0307151}{arXiv:quant-ph/0307151}.

\bibitem{DaviesLewis1970}
E.~B.~Davies and J.~T.~Lewis,
``An operational approach to quantum probability,''
\emph{Communications in Mathematical Physics} \textbf{17}, 239--260 (1970).
\href{https://doi.org/10.1007/BF01647093}{doi:10.1007/BF01647093}.

\bibitem{DeutschEtAl96}
D.~Deutsch, A.~Ekert, R.~Jozsa, C.~Macchiavello, S.~Popescu, and A.~Sanpera,
``Quantum privacy amplification and the security of quantum cryptography over noisy channels,''
\emph{Physical Review Letters} \textbf{77}, 2818--2821 (1996);
erratum \textbf{80}, 2022 (1998).
\href{https://doi.org/10.1103/PhysRevLett.77.2818}{doi:10.1103/PhysRevLett.77.2818}.
\href{https://doi.org/10.1103/PhysRevLett.80.2022}{Erratum DOI}.
\href{https://arxiv.org/abs/quant-ph/9604039}{arXiv:quant-ph/9604039}.

\bibitem{DevetakWinter05}
I.~Devetak and A.~Winter,
``Distillation of secret key and entanglement from quantum states,''
\emph{Proceedings of the Royal Society A} \textbf{461}, 207--235 (2005).
\href{https://doi.org/10.1098/rspa.2004.1372}{doi:10.1098/rspa.2004.1372}.
\href{https://arxiv.org/abs/quant-ph/0306078}{arXiv:quant-ph/0306078}.

\bibitem{Filippov2021}
S.~N.~Filippov,
``Capacity of trace decreasing quantum operations and
superadditivity of coherent information for a generalized erasure channel,''
\emph{Journal of Physics A: Mathematical and Theoretical} \textbf{54}, 255301 (2021).
\href{https://doi.org/10.1088/1751-8121/abfd61}{doi:10.1088/1751-8121/abfd61}.
The cited equation number refers to
\href{https://arxiv.org/abs/2101.05686v3}{arXiv:2101.05686v3}.

\bibitem{FR1987}
P.~Frankl and V.~R\"odl,
``Forbidden intersections,''
\emph{Transactions of the American Mathematical Society} \textbf{300}(1),
259--286 (1987).
\href{https://doi.org/10.1090/S0002-9947-1987-0871675-6}{doi:10.1090/S0002-9947-1987-0871675-6}.

\bibitem{FW1981}
P.~Frankl and R.~M.~Wilson,
``Intersection theorems with geometric consequences,''
\emph{Combinatorica} \textbf{1}(4), 357--368 (1981).
\href{https://doi.org/10.1007/BF02579457}{doi:10.1007/BF02579457}.

\bibitem{FuchsVdG1999}
C.~A.~Fuchs and J.~van~de~Graaf,
``Cryptographic distinguishability measures for quantum-mechanical states,''
\emph{IEEE Transactions on Information Theory} \textbf{45}(4), 1216--1227 (1999).
\href{https://doi.org/10.1109/18.761271}{doi:10.1109/18.761271}.
\href{https://arxiv.org/abs/quant-ph/9712042}{arXiv:quant-ph/9712042}.

\bibitem{GisinRennerWolf02}
N.~Gisin, R.~Renner, and S.~Wolf,
``Linking classical and quantum key agreement: Is there a classical analog to bound entanglement?''
\emph{Algorithmica} \textbf{34}(4), 389--412 (2002).
\href{https://doi.org/10.1007/s00453-002-0972-7}{doi:10.1007/s00453-002-0972-7}.

\bibitem{GisinWolf00}
N.~Gisin and S.~Wolf,
``Linking classical and quantum key agreement: Is there `bound information'?''
in \emph{Advances in Cryptology---CRYPTO 2000},
Lecture Notes in Computer Science \textbf{1880}, pp.~482--500 (2000).
\href{https://doi.org/10.1007/3-540-44598-6_30}{doi:10.1007/3-540-44598-6\_30}.
\href{https://arxiv.org/abs/quant-ph/0005042}{arXiv:quant-ph/0005042}.

\bibitem{HansenEtAl2012}
L.~O.~Hansen, A.~Hauge, J.~Myrheim, and P.~{\O}.~Sollid,
``Low-rank positive-partial-transpose states and their relation to product
vectors,'' \emph{Physical Review A} \textbf{85}, 022309 (2012).
\href{https://doi.org/10.1103/PhysRevA.85.022309}{doi:10.1103/PhysRevA.85.022309}.
See also \href{https://arxiv.org/abs/1104.1519v1}{arXiv:1104.1519v1}.

\bibitem{HansonRouzeFranca2020}
E.~P.~Hanson, C.~Rouz\'e, and D.~Stilck Fran\c ca,
``Eventually entanglement breaking Markovian dynamics: structure and
characteristic times,''
\emph{Annales Henri Poincar\'e} \textbf{21}, 1517--1571 (2020).
\href{https://doi.org/10.1007/s00023-020-00906-4}{doi:10.1007/s00023-020-00906-4}.

\bibitem{HorodeckiEtAl18}
K.~Horodecki, P.~\'Cwikli\'nski, A.~Rutkowski, and M.~Studzi\'nski,
``On distilling secure key from reducible private states and
(non)existence of entangled key-undistillable states,''
\emph{New Journal of Physics} \textbf{20}, 083021 (2018).
\href{https://arxiv.org/abs/1612.08938v4}{arXiv:1612.08938v4}.

\bibitem{keyBoundEntanglement}
K.~Horodecki, M.~Horodecki, P.~Horodecki, and J.~Oppenheim,
``Secure key from bound entanglement,''
\emph{Physical Review Letters} \textbf{94}, 160502 (2005).
\href{https://doi.org/10.1103/PhysRevLett.94.160502}{doi:10.1103/PhysRevLett.94.160502}.
\href{https://arxiv.org/abs/quant-ph/0309110v2}{arXiv:quant-ph/0309110v2}.

\bibitem{keyPrivateStates}
K.~Horodecki, M.~Horodecki, P.~Horodecki, and J.~Oppenheim,
``General paradigm for distilling classical key from quantum states,''
\emph{IEEE Transactions on Information Theory} \textbf{55}(4),
1898--1929 (2009).
\href{https://doi.org/10.1109/TIT.2008.2009798}{doi:10.1109/TIT.2008.2009798}.
\href{https://arxiv.org/abs/quant-ph/0506189v2}{arXiv:quant-ph/0506189v2}.

\bibitem{HHH98}
M.~Horodecki, P.~Horodecki, and R.~Horodecki,
``Mixed-state entanglement and distillation: Is there a `bound' entanglement in nature?''
\emph{Physical Review Letters} \textbf{80}, 5239--5242 (1998).
\href{https://doi.org/10.1103/PhysRevLett.80.5239}{doi:10.1103/PhysRevLett.80.5239}.
\href{https://arxiv.org/abs/quant-ph/9801069}{arXiv:quant-ph/9801069}.

\bibitem{HSR2003}
M.~Horodecki, P.~W.~Shor, and M.~B.~Ruskai,
``Entanglement breaking
channels,'' \emph{Reviews in Mathematical Physics} \textbf{15}, 629--641 (2003).
\href{https://doi.org/10.1142/S0129055X03001709}{doi:10.1142/S0129055X03001709}.
See also \href{https://arxiv.org/abs/quant-ph/0302031v2}{arXiv:quant-ph/0302031v2}.

\bibitem{Horodecki1997}
P.~Horodecki,
``Separability criterion and inseparable mixed states with
positive partial transposition,'' \emph{Physics Letters A} \textbf{232}, 333--339 (1997).
\href{https://doi.org/10.1016/S0375-9601(97)00416-7}{doi:10.1016/S0375-9601(97)00416-7}.
See also \href{https://arxiv.org/abs/quant-ph/9703004v2}{arXiv:quant-ph/9703004v2}.

\bibitem{Jamiolkowski1972}
A.~Jamio\l kowski,
``Linear transformations which preserve trace and
positive semidefiniteness of operators,'' \emph{Reports on Mathematical Physics}
\textbf{3}, 275--278 (1972).
\href{https://doi.org/10.1016/0034-4877(72)90011-0}{doi:10.1016/0034-4877(72)90011-0}.

\bibitem{Kallenberg2002}
O.~Kallenberg,
\emph{Foundations of Modern Probability}, 2nd ed.,
Probability and Its Applications, Springer, New York (2002).
\href{https://doi.org/10.1007/978-1-4757-4015-8}{doi:10.1007/978-1-4757-4015-8}.

\bibitem{KMP2018}
M.~Kennedy, N.~A.~Manor, and V.~I.~Paulsen,
``Composition of PPT maps,''
\emph{Quantum Information and Computation} \textbf{18}(5--6), 472--480 (2018).
\href{https://doi.org/10.26421/QIC18.5-6-4}{doi:10.26421/QIC18.5-6-4}.
\href{https://arxiv.org/abs/1710.08475v2}{arXiv:1710.08475v2}.
The cited theorem locator refers to the published version.

\bibitem{KimSanders10}
J.~S.~Kim and B.~C.~Sanders,
``On the geometric distance between quantum states with positive partial transposition and private states,''
\emph{Letters in Mathematical Physics} \textbf{92}(1), 67--79 (2010).
\href{https://doi.org/10.1007/s11005-010-0376-6}{doi:10.1007/s11005-010-0376-6}.
\href{https://arxiv.org/abs/0904.0295v1}{arXiv:0904.0295v1}.

\bibitem{Kraus1971}
K.~Kraus,
``General state changes in quantum theory,'' \emph{Annals of Physics}
\textbf{64}, 311--335 (1971).
\href{https://doi.org/10.1016/0003-4916(71)90108-4}{doi:10.1016/0003-4916(71)90108-4}.

\bibitem{KrugerWerner05}
O.~Kr\"uger and R.~F.~Werner (editors),
\emph{Some open problems in quantum information theory} (2005).
Problem~24, ``Secret key from all entangled states,'' p.~64.
The cited problem locator refers to
\href{https://arxiv.org/abs/quant-ph/0504166v1}{arXiv:quant-ph/0504166v1}.

\bibitem{Maurer93}
U.~M.~Maurer,
``Secret key agreement by public discussion from common information,''
\emph{IEEE Transactions on Information Theory} \textbf{39}(3),
733--742 (1993).
\href{https://doi.org/10.1109/18.256484}{doi:10.1109/18.256484}.

\bibitem{Mermin1990}
N.~D.~Mermin,
``Simple unified form for the major no-hidden-variables theorems,''
\emph{Physical Review Letters} \textbf{65}, 3373--3376 (1990).
\href{https://doi.org/10.1103/PhysRevLett.65.3373}{doi:10.1103/PhysRevLett.65.3373}.

\bibitem{Milne2022}
J.~S.~Milne,
\emph{Fields and Galois Theory}, version~5.10, September 2022.
\href{https://www.jmilne.org/math/CourseNotes/FT.pdf}{Author's text},
Theorem~4.28 and Lemma~4.31, pp.~55--56.

\bibitem{Park2026}
S.-J.~Park,
``Every PPT channel has finite entanglement breaking index,''
preprint, \href{https://arxiv.org/abs/2608.13551v2}{arXiv:2608.13551v2}
[quant-ph] (17 August 2026).

\bibitem{Parthasarathy2004}
K.~R.~Parthasarathy,
``On the maximal dimension of a completely entangled
subspace for finite level quantum systems,'' \emph{Proceedings of the Indian Academy
of Sciences (Mathematical Sciences)} \textbf{114}, 365--374 (2004).
\href{https://doi.org/10.1007/BF02829441}{doi:10.1007/BF02829441}.
See also \href{https://arxiv.org/abs/quant-ph/0405077v1}{arXiv:quant-ph/0405077v1}.

\bibitem{PauwelsGisinRenner2026}
J.~Pauwels, N.~Gisin, and R.~Renner,
``Bipartite Bound Information Exists,''
preprint, \href{https://arxiv.org/abs/2607.25838v2}{arXiv:2607.25838v2}
[quant-ph] (8 September 2026).

\bibitem{Peres1990}
A.~Peres,
``Incompatible results of quantum measurements,''
\emph{Physics Letters A} \textbf{151}, 107--108 (1990).
\href{https://doi.org/10.1016/0375-9601(90)90172-K}{doi:10.1016/0375-9601(90)90172-K}.

\bibitem{Peres1991}
A.~Peres,
``Two simple proofs of the Kochen--Specker theorem,''
\emph{Journal of Physics A: Mathematical and General}
\textbf{24}(4), L175--L178 (1991).
\href{https://doi.org/10.1088/0305-4470/24/4/003}{doi:10.1088/0305-4470/24/4/003}.

\bibitem{Pittenger2003}
A.~O.~Pittenger,
``Unextendible product bases and the construction of
inseparable states,'' \emph{Linear Algebra and its Applications} \textbf{359}, 235--248 (2003).
\href{https://doi.org/10.1016/S0024-3795(02)00423-8}{doi:10.1016/S0024-3795(02)00423-8}.
See also \href{https://arxiv.org/abs/quant-ph/0208028v1}{arXiv:quant-ph/0208028v1}.

\bibitem{PowersStormer1970}
R.~T.~Powers and E.~St{\o}rmer,
``Free states of the canonical anticommutation relations,''
\emph{Communications in Mathematical Physics} \textbf{16}, 1--33 (1970).
\href{https://doi.org/10.1007/BF01645492}{doi:10.1007/BF01645492}.

\bibitem{PSVW2018}
A.~Prakash, J.~Sikora, A.~Varvitsiotis, and Z.~Wei,
``Completely positive semidefinite rank,''
\emph{Mathematical Programming} \textbf{171}(1--2), 397--431 (2018).
\href{https://doi.org/10.1007/s10107-017-1198-4}{doi:10.1007/s10107-017-1198-4}.
\href{https://arxiv.org/abs/1604.07199}{arXiv:1604.07199}.

\bibitem{RahamanJaquesPaulsen2018}
M.~Rahaman, S.~Jaques, and V.~I.~Paulsen,
``Eventually entanglement breaking maps,''
\emph{Journal of Mathematical Physics} \textbf{59}(6), 062201 (2018).
\href{https://doi.org/10.1063/1.5024385}{doi:10.1063/1.5024385}.
The cited theorem locator refers to
\href{https://arxiv.org/abs/1801.05542v2}{arXiv:1801.05542v2}.

\bibitem{RennerKonig05}
R.~Renner and R.~K\"onig,
``Universally composable privacy amplification against quantum adversaries,''
in \emph{Theory of Cryptography---TCC 2005},
Lecture Notes in Computer Science \textbf{3378}, pp.~407--425 (2005).
\href{https://doi.org/10.1007/978-3-540-30576-7_22}{doi:10.1007/978-3-540-30576-7\_22}.
\href{https://arxiv.org/abs/quant-ph/0403133}{arXiv:quant-ph/0403133}.

\bibitem{BIRS2012}
M.~B.~Ruskai, M.~Junge, D.~Kribs, P.~Hayden, and A.~Winter (organizers),
\emph{Operator structures in quantum information theory}, Banff International
Research Station workshop report 12w5084 (2012).
\href{https://www.birs.ca/workshops/2012/12w5084/report12w5084.pdf}{Official report},
Section~3, Problem~G, p.~5.

\bibitem{SchliemannLossMacDonald2001}
J.~Schliemann, D.~Loss, and A.~H.~MacDonald,
``Double-occupancy errors, adiabaticity, and entanglement of spin qubits
in quantum dots,'' \emph{Physical Review B} \textbf{63}, 085311 (2001).
\href{https://doi.org/10.1103/PhysRevB.63.085311}{doi:10.1103/PhysRevB.63.085311}.
The cited equations refer to
\href{https://arxiv.org/abs/cond-mat/0009083v1}{arXiv:cond-mat/0009083v1}.

\bibitem{SinghNechita2022}
S.~Singh and I.~Nechita,
``The PPT$^2$ conjecture holds for all Choi-type maps,''
\emph{Annales Henri Poincar\'e} \textbf{23}, 3311--3329 (2022).
\href{https://doi.org/10.1007/s00023-022-01166-0}{doi:10.1007/s00023-022-01166-0}.
\href{https://arxiv.org/abs/2011.03809v2}{arXiv:2011.03809v2}.

\bibitem{Sottile2001}
F.~Sottile,
``From enumerative geometry to solving systems of polynomial
equations,'' in \emph{Computations in Algebraic Geometry with Macaulay 2},
Algorithms and Computation in Mathematics \textbf{8}, Springer, pp.~101--129 (2001).
\href{https://franksottile.github.io/research/pdf/M2.pdf}{Author's version},
Sections~2.2--2.3, pp.~4--6.

\bibitem{Stacks}
The Stacks Project Authors,
\emph{The Stacks project}.
\href{https://stacks.math.columbia.edu/tag/00FV}{Tag~00FV} (Hilbert
Nullstellensatz) and \href{https://stacks.math.columbia.edu/tag/0BBZ}{Tag~0BBZ}
(height theorem).

\end{thebibliography}
==== END Entanglement-with-zero-distillable-secret-key-in-local-dimension-ten//references.tex ====

==== BEGIN Entanglement-with-zero-distillable-secret-key-in-local-dimension-ten//secret-key.tex ====
\section{Separation from an ideal secret bit}
\label{sec:secret-key}

We now combine the common factors at a complete transcript with the
four-effect inequality.  A nearly correct bit has little weight in the
$01$ and $10$ branches.  A nearly uniform secret bit requires Eve's
$00$ and $11$ blocks to be close and to carry nearly half the total
weight each.  Root fidelity makes these two requirements comparable,
and the resulting estimates give a uniform numerical gap.

Throughout the paper the trace norm is unhalved:
\[
 \norm{H}_1=\tr\sqrt{H^*H}.
\]
For a classical standard Borel register with a finite-dimensional
quantum register, a state is a positive matrix-valued measure of total
trace one.  If a Hermitian difference of such measures has density
$H(t)$ with respect to a common finite dominating measure $\lambda$,
its trace norm is $\int\norm{H(t)}_1\,d\lambda(t)$.
This value is independent of the chosen dominating measure by
homogeneity.  The usual trace distance between normalized states is
one half of this norm.

We use trace-norm contraction on Hermitian differences under channels,
including classical readouts.  In finite dimensions it follows directly
from duality: the adjoint of a trace-preserving positive map is unital
and positive, so it sends each Hermitian contraction $Q$, with
$-I\preceq Q\preceq I$, to another Hermitian contraction.  Taking the
supremum of $\tr(QH)$ over such $Q$ proves contraction.  The same
argument applies to trace-class quantum registers and classical
matrix-valued measures through their bounded observables.

\begin{definition}[Distillable secret key]\label{def:distillable-key}
Let $\omega$ be a bipartite state, with Eve initially holding a
purification.  A key-distillation sequence uses an admitted protocol
of Definition~\ref{def:protocol} on each $\omega^{\otimes n}$, allowing
each party to process all its $n$ copies jointly.  The normalized
classical output at each party is a string of a fixed length
$\ell_n\in\mathbb Z_{\ge0}$ for that $n$.  Eve's output register $E'$
retains the initial purification and the complete public transcript.
For any normalized state or classical-quantum law $\sigma_{E'}$, define
the ideal length-$\ell$ key by
\[
 \gamma^{(\ell)}_\sigma
 =2^{-\ell}\sum_{z\in\{0,1\}^{\ell}}
     |z,z\rangle\langle z,z|\otimes\sigma_{E'}.
\]
The sequence is secure if there are normalized comparison laws
$\sigma_{E'}^{(n)}$ such that
\begin{equation}\label{eq:key-definition}
 \norm{\tau^{(n)}_{K_AK_BE'}-
        \gamma^{(\ell_n)}_{\sigma^{(n)}}}_1\longrightarrow0.
\end{equation}
Its asymptotic lower rate is $\liminf_{n\to\infty}\ell_n/n$.
The distillable secret key $K_D(\omega)$ is the supremum of these
rates over secure sequences, including the zero rate obtained by
producing the empty key.  A positive rate therefore requires
$\ell_n\ge1$ for all sufficiently large $n$.
\end{definition}

For positive matrices define the unnormalized root fidelity by
\[
 f(H,J)=\norm{\sqrt H\sqrt J}_1.
\]
In particular $f(cH,cJ)=c f(H,J)$ for $c\ge0$.  The next facts hold
at singular matrices as well as invertible ones.  The lower comparison
is the unnormalized form associated with the Powers--St\o rmer
inequality \cite[Lemma~4.1]{PowersStormer1970}; for normalized states
it is the lower Fuchs--van de Graaf bound
\cite[Theorem~1]{FuchsVdG1999}.  We give the short matrix proof needed
at our exact normalization.

\begin{lemma}[Root fidelity and trace norm]\label{lem:fidelity}
For arbitrary square complex matrices $A,B$ of the same size,
\begin{equation}\label{eq:polar-fidelity}
 f(A^*A,B^*B)=\norm{AB^*}_1.
\end{equation}
For positive matrices $H,J$ of the same size,
\begin{equation}\label{eq:fidelity-lower}
 f(H,J)\ge
 \frac{\tr H+\tr J-\norm{H-J}_1}{2}.
\end{equation}
Also $f(H^\T,J^\T)=f(H,J)$.
\end{lemma}

\begin{proof}
Extend the partial isometries in the polar decompositions of the square
matrices to unitaries, writing
$A=U\sqrt{A^*A}$ and $B=V\sqrt{B^*B}$.  Then
$AB^*=U\sqrt{A^*A}\sqrt{B^*B}V^*$, and unitary invariance of the trace
norm proves \eqref{eq:polar-fidelity}.  This extension is available
even when either matrix is singular.

For \eqref{eq:fidelity-lower}, put $A=\sqrt H$, $B=\sqrt J$, and
$Z=A-B$.  The matrix $Z$ is Hermitian and
$H-J=ZA+BZ$.  The spectral sign $\operatorname{sgn}(Z)$ is a Hermitian
contraction.  Trace-norm duality and cyclicity therefore give
\[
 \norm{H-J}_1
 \ge\tr[\operatorname{sgn}(Z)(H-J)]
 =\tr[|Z|(A+B)].
\]
In a unit eigenvector of $Z$ with eigenvalue $z$, positivity of $A,B$
implies
\[
 \langle A+B\rangle\ge|\langle A-B\rangle|=|z|.
\]
Summing in an eigenbasis of $Z$ shows
$\tr[|Z|(A+B)]\ge\tr Z^2$.  Finally,
\[
 \tr Z^2=\tr H+\tr J-2\tr(AB),
 \qquad 0\le\tr(AB)\le\norm{AB}_1=f(H,J).
\]
Combining these inequalities proves the lower bound.  No commutation
of $H$ and $J$ was used.  For the transpose identity, functional
calculus gives $\sqrt{H^\T}=(\sqrt H)^\T$.  The product of the two
transposed square roots is $(\sqrt J\sqrt H)^\T$; transpose and adjoint
preserve trace norm, proving $f(H^\T,J^\T)=f(H,J)$.
\end{proof}

\begin{theorem}[Uniform obstruction to a secret bit]\label{thm:zero-key}
Let $\omega\in\mathscr C$.  For every integer $n\ge1$, let an admitted
completed protocol on $\omega^{\otimes n}$ produce normalized bit
registers $K_A,K_B$, and let its output $\tau_{K_AK_BE'}$ retain in
$E'$ an initial purification held by Eve and the complete public
transcript.  The purification may be arbitrary.  For every normalized
state or classical-quantum law $\sigma_{E'}$,
\begin{equation}\label{eq:uniform-secret-bit-gap}
 \left\lVert\tau_{K_AK_BE'}-
  \frac12\sum_{i=0}^1|i,i\rangle\langle i,i|\otimes\sigma_{E'}
 \right\rVert_1\ge\frac15.
\end{equation}
Thus the conventional trace distance is at least $1/10$, and
$K_D(\omega)=0$ in Definition~\ref{def:distillable-key}.
\end{theorem}

\begin{proof}
Group all of Alice's factors and all of Bob's factors, and set
$R=\omega^{\otimes n}$.  Lemma~\ref{lem:tensor-closure} gives
$R\in\mathscr C$.  First apply the classical readout of Eve's retained
complete public transcript, leaving her initial purifying register
unchanged, and discard any extra retained registers.  On the actual output
this produces the full classical transcript together with the purification.
On any ideal bit comparison state it produces an ideal bit with a
classical-quantum comparison law.  Next,
Lemma~\ref{lem:purification-recovery} supplies a channel from the retained
purifying space to the canonical one, leaving the transcript unchanged.
It recovers the actual canonical output and again sends every ideal law
to an ideal law.  Trace-norm contraction under these Eve-side channels
therefore reduces the claim to the canonical purification
\eqref{eq:canonical-purification} and the full classical transcript $T$.

Apply Lemma~\ref{lem:transcript} to obtain a finite transcript measure
$\mu$, the positive factors $X_i(t),Y_j(t)$, and the Eve densities
$\tau_{ij}(t)$ of \eqref{eq:eve-blocks}.  Fix any normalized positive
matrix-valued comparison law $\sigma_{ET}$ on the same transcript space.

Let $\nu$ be the transcript law of $\sigma_{ET}$, namely
$\nu(S)=\tr\sigma_{ET}(S)$, and use the common finite measure
$\lambda=\mu+\nu$.  If $h=d\mu/d\lambda$, replace each actual density
by $h(t)\tau_{ij}(t)$ and both $X_i(t)$ by $h(t)X_i(t)$, leaving the
$Y_j(t)$ unchanged.  Equation~\eqref{eq:eve-blocks} then still holds,
including where $h=0$.  The ideal law has a positive density
$\sigma(t)$ with respect to $\lambda$ and
$\int\tr\sigma(t)\,d\lambda(t)=1$.  Homogeneity preserves all actual
probabilities and root-fidelity integrals in this change of measure.
We now denote $\lambda$ again by $\mu$.  This common measure keeps
singular parts of either original transcript law; there is no
assumption that the ideal and actual laws have the same support.

For these common densities set
\[
 D_{ij}(t)=X_i(t)\otimes Y_j(t),\qquad
 p_{ij}(t)=\tr\tau_{ij}(t)=\tr[D_{ij}(t)R],\qquad
 P_{ij}=\int p_{ij}(t)\,d\mu(t).
\]
All $P_{ij}$ are nonnegative and $\sum_{i,j}P_{ij}=1$.  With
$A=\sqrt{D_{00}(t)}\sqrt R$ and
$B=\sqrt{D_{11}(t)}\sqrt R$, the transpose invariance and
\eqref{eq:polar-fidelity} give
\begin{equation}\label{eq:transcript-fidelity}
 \begin{aligned}
 f(\tau_{00}(t),\tau_{11}(t))
 &=f\bigl(\sqrt R D_{00}(t)\sqrt R,
           \sqrt R D_{11}(t)\sqrt R\bigr)\\
 &=\norm{\sqrt{D_{00}(t)}R\sqrt{D_{11}(t)}}_1.
 \end{aligned}
\end{equation}
The privacy interpretation of an off-diagonal coherence norm as the
fidelity of conditional Eve states is also used in the private-state
approach \cite[Eq.~(7)]{keyBoundEntanglement}.  Here the identity is
applied to unnormalized branches at each complete transcript.  Its
proof includes singular $R$ and singular effects.

Apply Lemma~\ref{lem:coherence} at almost every $t$.  Scalar
Cauchy--Schwarz after integration gives
\begin{equation}\label{eq:integrated-coherence}
 \begin{split}
 \mathfrak f
 &:=\int f(\tau_{00}(t),\tau_{11}(t))\,d\mu(t)\\
 &\le\sqrt{P_{00}P_{01}}+\sqrt{P_{10}P_{11}}
       +2\sqrt{P_{01}P_{10}}.
 \end{split}
\end{equation}
For example, $\int\sqrt{p_{00}(t)p_{01}(t)}\,d\mu(t)$ is at most
$\sqrt{P_{00}P_{01}}$.  The factors need only be positive; no
pointwise POVM normalization was used.

We next express what small distance from the fixed ideal bit would
require of this same $\mathfrak f$.  Let $\eta$ be the unhalved
trace-norm distance after the common transcript readout, and define
\[
 \begin{split}
 e&=P_{01}+P_{10},\\
 q&=\int\norm{\tau_{00}(t)-\tau_{11}(t)}_1\,d\mu(t),\\
 a_i&=\int\norm{\tau_{ii}(t)-\tfrac12\sigma(t)}_1\,d\mu(t)
       \quad(i=0,1).
 \end{split}
\]
The unequal-bit blocks of the ideal state are zero.  Additivity of the
trace norm across the classical bit blocks, and then the triangle
inequality within the two equal-bit blocks, give
\begin{equation}\label{eq:linked-errors}
 \eta=e+a_0+a_1,\qquad q\le a_0+a_1=\eta-e.
\end{equation}
Trace conservation gives one further inequality that is needed for the
uniform constant.  The actual equal-bit blocks have total trace $1-e$,
whereas the corresponding ideal blocks have total trace one.  Thus
\[
 a_0+a_1
 \ge\left|\sum_{i=0}^1\int
       \tr\bigl(\tau_{ii}(t)-\tfrac12\sigma(t)\bigr)\,d\mu(t)\right|
 =e,
\]
and \eqref{eq:linked-errors} implies
\begin{equation}\label{eq:unequal-error-bound}
 e\le\frac\eta2.
\end{equation}

Integrating \eqref{eq:fidelity-lower} gives
\[
 \mathfrak f\ge\frac{P_{00}+P_{11}-q}{2}
 =\frac{1-e-q}{2}\ge\frac{1-\eta}{2}.
\]
On the other hand, Cauchy--Schwarz on the first two terms of
\eqref{eq:integrated-coherence} and the arithmetic--geometric mean
inequality on the last give
\[
 \begin{aligned}
 \sqrt{P_{00}P_{01}}+\sqrt{P_{10}P_{11}}
 &\le\sqrt{(P_{00}+P_{11})(P_{01}+P_{10})}
   =\sqrt{e(1-e)},\\
 2\sqrt{P_{01}P_{10}}&\le e.
 \end{aligned}
\]
The two estimates have the exact combined form
\begin{equation}\label{eq:fidelity-sandwich}
 \frac{1-\eta}{2}\le\mathfrak f\le\sqrt{e(1-e)}+e,
 \qquad e\le\frac\eta2.
\end{equation}
If $\eta<1/5$, then $e<1/10$.  On $0\le e\le1/10$ the function
$\sqrt{e(1-e)}+e$ is increasing and has value $2/5$ at $e=1/10$.
The right side of \eqref{eq:fidelity-sandwich} is therefore strictly
less than $2/5$, while its left side is strictly greater than $2/5$.
This contradiction proves \eqref{eq:uniform-secret-bit-gap},
uniformly in $n$, the represented state, the protocol, and the ideal
comparison law.

Finally suppose a secure key-distillation sequence had $\ell_n\ge1$
for infinitely many $n$.  Along those indices, the local classical channels
that retain the first bit of each string and discard the other bits,
while retaining $E'$, map $\gamma^{(\ell_n)}_{\sigma^{(n)}}$ to an ideal
bit: exactly half the uniform strings have either first bit.
Trace-norm contraction would make the resulting bit-output error tend to
zero, contradicting \eqref{eq:uniform-secret-bit-gap}.  Thus every secure
sequence has $\ell_n=0$ for all sufficiently large $n$.  In particular its
asymptotic lower rate is zero.  The empty key achieves rate zero, so
$K_D(\omega)=0$.
\end{proof}

The proof also yields the retained conditioning and limiting forms of
the obstruction.  These statements specify how normalization and
Eve's complete information are preserved.

\begin{proposition}[Conditioning, aborts, and completed-output limits]
\label{prop:operational-extensions}
Consider inputs $\omega^{\otimes n}$ with $\omega\in\mathscr C$ and
$n\ge1$, and admitted protocols whose normalized completed outputs retain
in Eve's register an arbitrary initial purification and the complete
public transcript.  The following statements extend the gap in
Theorem~\ref{thm:zero-key}; in item 2, the completed local output alphabet
may include an abort symbol.
\begin{enumerate}
\item If $A$ is a measurable event of the complete public transcript
with probability $r>0$, the normalized bit output conditioned on $A$
has distance at least $1/5$ from every ideal bit law for that accepted
output.  This holds for every $r>0$.
\item Suppose a sequence of completed protocols has a locally
available abort symbol at either party.  If the probability that at
least one party aborts tends to zero, and the normalized non-aborting
outputs approach ideal non-aborting bit laws, then replacing each
local abort by the fixed bit zero would give completed bit outputs
approaching ideal bits.  Such a sequence is impossible for inputs in
$\mathscr C$ (including any numbers of copies).
\item Let $\tau_k$ be completed normalized bit outputs to which the
gap applies, possibly on different output spaces.  Suppose their bit
registers are kept fixed and their Eve registers are embedded in a
common output space $F$, giving states $\widehat\tau_k$.  The embeddings
must preserve and permit recovery of the full initial purification and
complete public records, without coarse-graining those records.  In
particular, an Eve-side recovery channel recovers $\tau_k$ from
$\widehat\tau_k$ while leaving the bits fixed.  If
$\widehat\tau_k\to\tau$ in trace norm, then for every normalized law
$\sigma_F$,
\[
 \norm{\tau-\tfrac12\sum_{i=0}^1
       |i,i\rangle\langle i,i|\otimes\sigma_F}_1\ge\frac15.
\]
\end{enumerate}
\end{proposition}

\begin{proof}
For the first assertion, use the canonical factors from
Lemma~\ref{lem:transcript}.  Restrict their measure $\mu$ to $A$ and
replace both $X_0(t),X_1(t)$ by $X_0(t)/r,X_1(t)/r$, leaving the
$Y_j(t)$ unchanged.  Each of the four blocks in
\eqref{eq:eve-blocks} is divided by $r$, and its integral over $A$ is
the corresponding normalized accepted block.  All probabilities and
the root fidelity scale by the same factor $1/r$.  The accepted total
trace is one, so the proof of \eqref{eq:fidelity-sandwich}, including
$e\le\eta/2$, applies without change.  The recovery and common-measure
arguments cover arbitrary purifications and arbitrary ideal laws for
the accepted output.  No positive lower bound on $r$ was used.

For the second assertion, let $\delta_k$ be the probability of at
least one abort, let $\tau_k^{\mathrm{ok}}$ be the normalized
non-aborting state when $\delta_k<1$, and let $\xi_k$ be the normalized
state on the aborting part when $\delta_k>0$.  The completed state is
the sum of these two positive classical parts with weights
$1-\delta_k$ and $\delta_k$.  Let $\mathcal Q$ be the product of the
two local classical channels sending each party's own abort symbol to
zero and fixing its bit values.  It is defined on every completed
output and preserves each non-aborting ideal bit $\gamma_k$.  Since
the trace-norm distance between normalized states is at most two,
\[
 \norm{\mathcal Q(\tau_k)-\gamma_k}_1
 \le (1-\delta_k)\norm{\tau_k^{\mathrm{ok}}-\gamma_k}_1
       +2\delta_k.
\]
The right side tends to zero under the stated hypotheses.  This
contradicts Theorem~\ref{thm:zero-key} for the completed bit-output
protocol with the local replacement appended.  The replacement uses
only abort symbols actually available to the respective laboratories.

For the third assertion, denote the recovery channel for the $k$th
embedding by $\mathcal R_k$.  For any ideal bit $\gamma_\sigma$ in the
common space, applying this channel to Eve maps it to the ideal bit
$\gamma_{\mathcal R_k(\sigma)}$ on the $k$th output space and recovers
$\tau_k$ from $\widehat\tau_k$.  Contraction and the per-protocol gap
therefore give
\[
 \norm{\widehat\tau_k-\gamma_\sigma}_1
 \ge\norm{\tau_k-\gamma_{\mathcal R_k(\sigma)}}_1
 \ge\frac15.
\]
The triangle inequality now yields
\[
 \norm{\tau-\gamma_\sigma}_1
 \ge\frac15-\norm{\widehat\tau_k-\tau}_1
 \longrightarrow\frac15.
\]
Only the completed actual outputs need converge.  The embeddings must
retain and permit recovery of the full purification and public records,
so they do not coarse-grain that information.  The argument requires
no convergence on the auxiliary probe inputs and no factorization
statement for the limit itself.  In particular, it does not assume
that finite padded transcript laws converge in trace norm to a law of
an infinite transcript.
\end{proof}
==== END Entanglement-with-zero-distillable-secret-key-in-local-dimension-ten//secret-key.tex ====

==== BEGIN Entanglement-with-zero-distillable-secret-key-in-local-dimension-ten//supplementary-checks.tex ====
\section{Supplementary exact checks}\label{app:supplementary-checks}

The construction in Section~\ref{sec:combinatorial} is proved by
finite formulas and analytic inequalities.  The four accompanying
files in \texttt{verification/} preserve two exact integer checks of its
small arithmetic components.  These checks are supplementary: the
restricted-intersection argument, fiber amplification, tensor
construction, and nonseparability proof do not use their execution
as a premise.

The program \texttt{combinatorics\_exact\_checks.py} uses only the
Python standard library.  It checks primality of \(257\) by trial
division and verifies the intermediate binomial and power inequalities
used in \eqref{eq:combinatorial-analytic-bound}.  It also checks
\(3a_0K<b\) and \(3a_0b^2\geq3\).  Its recorded output
\texttt{combinatorics\_exact\_checks.json} stores the exact integers
\(a_0\) (under the key \texttt{A}) and \(b\), confirms
\(K=1086373952\), and records the stronger interval
\begin{equation}\label{eq:supplementary-delta-interval}
 2^{-194}\leq\delta<2^{-193}.
\end{equation}
The analytic proof needs only \(\delta<2^{-65}\).

The program \texttt{gadget\_exact\_check.py} represents each local
projection \(h_t(\alpha,\beta)\) by the integral matrix
\(R=4h_t(\alpha,\beta)\).  It checks the observable relations,
identities and eigensigns for all 24 projections, and measurement
completeness, and computes the 36 ordered context-pair overlap tables.
The stored integer
\(\tr(RR')\) is exactly \(16\tr(h_t h_{t'})\).  It then enumerates
all \(4^6=4096\) selections of one outcome per context and counts
zero overlaps among the 15 unordered pairs of distinct contexts.
The recorded output \texttt{gadget\_exact\_check.json} has no
selection with all overlaps positive and gives the following counts:
\[
 \begin{array}{c|rrrrr}
  \text{number of zero-overlap pairs}&1&3&5&7&9\\ \hline
  \text{number of selections}&144&1344&2016&576&16.
 \end{array}
\]
The files retain all exact matrices and overlap tables, not just
this summary.

From the paper directory the outputs can be regenerated by
\begin{verbatim}
python3 verification/combinatorics_exact_checks.py
python3 verification/gadget_exact_check.py > verification/gadget_exact_check.json
\end{verbatim}
Run these commands with Python assertions enabled: do not use
\texttt{-O} or \texttt{-OO}, and do not set \texttt{PYTHONOPTIMIZE}.
All computations in these programs use exact Python integers and no
floating-point tolerance.  They do not instantiate the enormous
global matrices or enumerate the question set; those objects are
specified and analyzed by the finite formulas in the text.
==== END Entanglement-with-zero-distillable-secret-key-in-local-dimension-ten//supplementary-checks.tex ====

==== BEGIN Entanglement-with-zero-distillable-secret-key-in-local-dimension-ten//transcripts.tex ====
\section{Complete public transcripts}
\label{sec:transcripts}

To apply the four-effect inequality to a protocol, we must obtain
$X_i(t)\otimes Y_j(t)$ at each public transcript $t$, with the same two
local pairs for all four bit values.  These matrices describe the effects
of the entire protocol on its input.  They are not the effects of just its
last measurements.  We first derive this form for finite classical records,
then prove its measurable counterpart for the admitted protocols below.
The transcript always retains every public message, public random draw,
and public stopping decision.

\subsection{The finite-record mechanism}

Let $R$ be the input state on finite-dimensional spaces $A\otimes B$.
In fixed product bases, Eve's canonical purification is
\begin{equation}\label{eq:canonical-purification}
 |\Psi_R\rangle=\sum_h\sqrt R\,|h\rangle_{AB}|h\rangle_E,
 \qquad E\cong A\otimes B.
\end{equation}
For the moment suppose there are finitely many local-instrument and public
steps, including the final readouts, every classical record is finite, and
each party produces its prescribed bit almost surely on $R$.  Use the
following resource rules: the recorded initial public variable
$C_0$ is independent of the input and reference; conditional on $C_0$, that
input-reference state and the two private auxiliary resources form a product.
The initial public law and local preparation kernels are fixed when the
input varies.  All later public-source draws use fixed input-independent
kernels of the preceding public record.  Thus the input is the only shared private resource.

Fix a complete public transcript $t$.  In Alice's laboratory, compose the
instrument branches consistent with $t$ and final bit $i$, retaining private
memory until it is no longer used and summing private outcomes locally.
This gives a CP map $\mathcal A_i^t$ on her input.  Bob obtains a CP map
$\mathcal B_j^t$ in the same way.  At this fixed public record each local
choice can depend on the preceding public messages but not on the other
party's unannounced private outcomes.  The compatible private histories
therefore sum independently within the two laboratories.  Public-source
weights are scalars fixed by $t$; absorbing their product into either local
map, the joint branch is $\mathcal A_i^t\otimes\mathcal B_j^t$.

Set $X_i(t)=(\mathcal A_i^t)^\dagger(I)$ and
$Y_j(t)=(\mathcal B_j^t)^\dagger(I)$.  These matrices are positive and the
branch effect is $D_{ij}(t)=X_i(t)\otimes Y_j(t)$.  Tracing the final
laboratory memories out of that branch leaves Eve with
\[
 \tau_{ij}(t)=\bigl(\sqrt R\,D_{ij}(t)\sqrt R\bigr)^\T.
\]
Indeed, the $(h,k)$ matrix entry on Eve's system is
$\operatorname{tr}[D_{ij}(t)\sqrt R|h\rangle\langle k|\sqrt R]
=\langle k|\sqrt R D_{ij}(t)\sqrt R|h\rangle$.
The same $X_0,X_1$ and $Y_0,Y_1$ occur in all four branches.  Private
instrument labels have been summed, not added to Eve's transcript.
No pointwise normalization is required at a fixed $t$; normalization holds
after summing all final bits and all transcripts.

For a continuous transcript, a singleton may have probability zero, and
with countably many steps an output may depend on the complete local
history.  The general statement will replace the preceding matrices by
densities with respect to a single transcript measure.  Its proof runs the
protocol on a product of two local probes, each with an untouched reference.
On that product input the local histories are independent conditional on
the complete public record.  Reference measurements recover common product
matrix densities from this scalar independence, and a fixed filter on the
references gives the blocks for $R$.

\subsection{The admitted protocol model}

The instrument formalism originates with Davies and Lewis
\cite{DaviesLewis1970}.  Chitambar, Leung, Man\v{c}inska, Ozols, and Winter
\cite{CLMOW2014} distinguish finite-round LOCC, infinite linked protocols,
and topological closure.  We specify the measurable model used here so that
both its complete-history law and any terminal readout are part of the
protocol data.  Ordinary finite protocols obtain these laws by composition;
a countable schedule requires the compatibility conditions below.

\begin{definition}[Admitted local protocols]\label{def:protocol}
Let $A$ and $B$ be finite-dimensional complex input spaces.  An admitted
protocol consists of local quantum instruments, local memories and
randomness, and authenticated two-way public classical communication.
Each party may process its whole input space jointly.  Its data and their
joint laws satisfy the following requirements.
\begin{enumerate}
\item\label{protocol:initial} \textit{Initial resources.}
Before interaction,
there is a recorded standard Borel public variable $C_0$, possibly constant,
whose law is fixed once the protocol is chosen.  It is independent of the
supplied input together with any purifying or untouched reference.
Conditional on $C_0$, the joint state or law of that input and reference
and the two initial private auxiliary resources is the product of the
input-reference state and one resource for each laboratory.  These local
resources include private ancillas and randomness and may depend on $C_0$.
The public law and these two preparation kernels are the same whenever
this protocol is run on another input.  All shared initial randomness is
included in $C_0$.
An initialization acting on a party's input is treated as a first local
operation.  Apart from this recorded public variable and the supplied
input, there is no shared resource and no preshared secret key.

\item\label{protocol:instruments} \textit{Local instruments.}
An instrument assigns completely positive operations to measurable
outcome sets, countably additively on input states.  It has measurable
outcome laws and measurable conditional local updates, and its total
operation is trace preserving.  Its classical outcome space is standard
Borel.  Local instruments may depend measurably on the local private
history and the preceding public record.

\item\label{protocol:history} \textit{Local aggregation and chronological history.}
A local subroutine completed before a later step may be aggregated into
one instrument when that aggregate is supplied as a local instrument
reproducing its retained output and reference law on arbitrary inputs with
untouched finite-dimensional references.  It includes every private record
later used and its continuing memory.  Its total is normalized, including
a nonreturn or failure tag when needed.
All public communication remains in the public schedule.  After any such
aggregation and before a separate terminal readout on a complete infinite
history, the genuine classical history, including private instrument
outcomes and public records, forms a finite sequence or a sequence indexed
by $\mathbb N$, in fixed standard Borel coordinate spaces.  Instrument-choice
tags and fixed padding for stopped histories are included in these spaces.
A local choice uses only that laboratory's preceding private history and
the preceding public record; any choice affecting the other laboratory is
communicated through a public step.

\item\label{protocol:public} \textit{Public steps and the complete record.}
The public discussion is correspondingly finite or indexed by $\mathbb N$.
Each message is produced by its sender's local process from that sender's
private history and the preceding public record.  For a later public-source
draw after the public record $T_m=t$, the recorded outcome is drawn from a
measurable probability kernel $\kappa_m(t,dc)$ depending only on that record.
On every unnormalized joint instrument law, this public update multiplies
by the scalar kernel and acts as the identity on the quantum and reference
registers.  The kernel at a given record is the same for every initial input.
A party-generated announced choice, deterministic or randomized, is that
party's message.  Public choices of speaker and public stopping decisions
use these same two rules; a choice measurable from the preceding public
record is a Dirac public kernel.  Simultaneous messages may be ordered while
retaining their dependence on the earlier record.  Every publicly observed
control or other datum is generated and recorded by one of these steps.
The standard Borel record $T$ is the encoded sequence of $C_0$ and all
these public messages, draws, speaker choices, and stopping decisions.
Private outcomes and quantum
memories remain in their own laboratories.

\item\label{protocol:reference} \textit{Reference-compatible prefix laws.}
The specified steps are one family of instruments on arbitrary positive
trace-class inputs, with their amplifications by any untouched
finite-dimensional reference.  Their unnormalized branch laws give
countably additive positive matrix-valued measures on that reference for
finite prefixes.  Integrating the next record recovers the preceding
reference measure after the current laboratory memories are traced out.

\item\label{protocol:terminal} \textit{Terminal outputs and local quantum readouts.}
A terminal classical output may be a measurable function of that
laboratory's instrument history and the received complete transcript $T$.
A decision to invoke a terminal quantum readout must be measurable in
the same local records.

For a terminal quantum readout, the protocol supplies both its incoming
local memory and the instrument applied to it.  The memory is supplied by
one fixed measurable local CP process on those histories, defined on
arbitrary inputs with any untouched finite-dimensional reference.  The
readout is a specified measurable local instrument on that memory,
selected using only that laboratory's private history and $T$.
The two laboratories refine the reference measure on the complete
history by these local operations, acting as the identity on the
reference.

Together with the preceding schedule, these refinements give one
countably additive, unnormalized instrument law on the complete history
and the terminal outcomes, for all initial inputs and finite untouched
references.  Include a tag for a missing or noninvoked readout among
each laboratory's outcomes.  Summing either laboratory's terminal
outcomes removes that local refinement.  Summing both and tracing the
output memories recovers the reference measure on the complete history
with its stated finite-prefix marginals.

After any terminal outcomes have been included, each prescribed output
status is a measurable local value in the finite output alphabet
together with a symbol $\perp$ for nonproduction.  An output already
produced is retained.  The incoming-memory and compatibility requirements
concern only memory used by a terminal readout; unused memory need not
converge.  An unspecified evolution through infinitely many quantum
operations does not by itself define a terminal readout.

\item\label{protocol:completion} \textit{Completion on a specified input.}
A \emph{completed bit-output protocol on a specified input} has a bit
in each laboratory almost surely on that input, with normalized joint
output.  Almost-sure production is required only on this actual input.
More generally a completed key-output protocol produces an output in a
specified finite classical alphabet at each party almost surely on the
actual input, again with normalized joint output.  Trace-norm limits of
completed actual outputs, with full recoverable public information, will be
treated separately in Section~\ref{sec:secret-key}.
\end{enumerate}
\end{definition}

For a finite protocol whose instruments and public steps satisfy
clauses~\ref{protocol:initial}--\ref{protocol:public},
composition of those instruments supplies the prefix laws
and any finite terminal refinement in
clauses~\ref{protocol:reference}--\ref{protocol:terminal}.  The separate
complete-history and terminal-process requirements matter when a countable
schedule or an aggregated subroutine is used.
There is no uniform bound on the amount of communication, the size of a
standard Borel message, or the number of rounds within this scope.  In
particular, a terminal classical bit can depend on an entire infinite
record.

\subsection{Common effects at a complete transcript}

\begin{lemma}[Common local factors for a complete transcript]
\label{lem:transcript}
Let $R$ be a density operator on finite-dimensional complex spaces
$A\otimes B$, and let an admitted protocol produce bits
$i,j\in\{0,1\}$ almost surely on $R$.  Give Eve the canonical
purification~\eqref{eq:canonical-purification},
and let her retain $E$ and the complete public transcript $T$ with value
$t$ in its standard Borel space $\mathsf T$.  There exist a finite
positive measure $\mu$ on $\mathsf T$ and measurable positive matrices
$X_0(t),X_1(t)$ on $A$ and $Y_0(t),Y_1(t)$ on $B$ such that the positive
matrix-valued measure of Eve in bit branch $(i,j)$ has the density
\begin{equation}\label{eq:eve-blocks}
 \tau_{ij}(t)=
 \bigl(\sqrt R\,[X_i(t)\otimes Y_j(t)]\sqrt R\bigr)^\T
 \quad\text{with respect to }\mu.
\end{equation}
The same $X_i(t)$ and $Y_j(t)$ work for all four branches outside one
$\mu$-null set, and
\[
 \sum_{i,j=0}^1\int_{\mathsf T}\tr\tau_{ij}(t)\,d\mu(t)=1.
\]
The transpose in \eqref{eq:eve-blocks} is in the product basis
identifying $E$ with $A\otimes B$.  No invertibility of $R$ is assumed.
\end{lemma}

\begin{proof}
Write $a=\dim A$ and $b=\dim B$, and attach untouched finite references
$A_0\cong A$ and $B_0\cong B$.  Run the protocol on the product of the
normalized local probes
\begin{equation}\label{eq:local-probes}
 |\Phi_a\rangle_{AA_0}\otimes|\Phi_b\rangle_{BB_0},
 \qquad
 |\Phi_a\rangle=a^{-1/2}\sum_{r=1}^{a}|r,r\rangle,
 \qquad
 |\Phi_b\rangle=b^{-1/2}\sum_{s=1}^{b}|s,s\rangle.
\end{equation}
The protocol need not produce both bits on this auxiliary input.  For
this experiment assign bit zero in a laboratory if its prescribed bit
is never produced, and retain a bit that has already been produced.
The assignment is a measurable local rule.  It does not replace the
other laboratory's output when only one output is missing.  We will
remove the contribution of these auxiliary defaults after recovering
the actual input.

The proof has three steps.  First, clauses~\ref{protocol:initial}--\ref{protocol:public}
give conditional independence of the two local sampling tapes on the
product probes, given the complete public transcript.  Next,
clauses~\ref{protocol:reference}--\ref{protocol:terminal} give positive
reference measures; informationally complete tests turn the scalar
independence into product matrix densities.  Finally, a filter on the
untouched references prepares \eqref{eq:canonical-purification}
and transfers those densities to Eve's actual blocks.

\paragraph{Conditional independence on the product probes.}
The scalar factorization has the finite private-coin rectangle property
as a classical antecedent \cite[Lemma~6.7]{BarYossefEtAl2004}.
We prove the complete-history version needed here before recovering its
matrix-valued factors.

Choose a finite informationally complete POVM on each reference.  One
explicit construction in dimension $d$ starts with the projections
onto the basis vectors and onto
\[
 (|r\rangle+|s\rangle)/\sqrt2,
 \qquad
 (|r\rangle+\mathrm i|s\rangle)/\sqrt2
 \quad (r<s).
\]
These projections span the real vector space of Hermitian matrices.  If
they are $P_1,\ldots,P_N$, the $2N$ effects
$P_k/N$ and $(I-P_k)/N$ form a POVM with the same spanning property.
Call the two resulting POVMs $(E_r)_r$ and $(G_s)_s$.  Because the
references are untouched, these tests commute with all laboratory
operations.  Their joint statistics with the transcript and final bits
can therefore be computed with the tests performed at the start.

In this tested product-probe experiment, sample $C_0$ with the same fixed
law as in the actual run.  Conditional on $C_0$, all local outcomes can be
sampled using independent local random tapes $U$ for Alice and $V$ for Bob.
The tapes may be taken as countable products of uniform variables, with
coordinates reserved for the reference tests and any terminal readouts.
They are chosen before the sampling; the local outcome histories are then
functions of these tapes and the public record.
At each local instrument, sample
its conditional outcome law using a fresh uniform variable on that
laboratory's tape and apply the stipulated conditional state update.
The tested input and private ancillas are a product across laboratories
conditional on $C_0$, and each local update changes only its own local
state.  At a public-source step, sample $\kappa_m(T_m,dc)$ using a fresh
public uniform variable independent of the private tapes and all prior
sampling variables; only the recorded
draw enters the transcript.  This step leaves the quantum registers
unchanged.  Induction over the specified finite prefixes therefore shows
that this sampling has the genuine joint finite-prefix laws.
For a standard Borel outcome space a probability kernel has such a
jointly measurable sampler: one may code the space by a Borel subset
of $[0,1]$ and use the measurable kernel-sampling theorem
\cite[Appendix~A1, Theorem~A1.2, and Lemma~3.22]{Kallenberg2002}.
The initial reference tests and each specified local terminal quantum
readout are sampled in the same way.  Their stated local compatible
refinements give the genuine tested laws on the complete histories.
A terminal classical readout is
already a measurable function of its records.  Each defaulted bit and
each reference-test result is consequently a measurable function of
that laboratory's tape and the complete public transcript.  This
sampling describes the auxiliary product input; the actual input $R$
need not have a product simulation.

Let $T_m$ consist of $C_0$ and the first $m$ subsequent public records,
and let $\mathcal F_m=\sigma(T_m)$.  At a step sent by Alice the new
record is measurable with respect to
$\sigma(U)\vee\mathcal F_m$; at a step sent by Bob the analogous
statement holds with $V$.  At a public-source step with new draw $C$,
the sampling construction gives
\[
 \mathbb P(C\in dc\mid\sigma(U,V)\vee\mathcal F_m)=\kappa_m(T_m,dc).
\]
We show by induction that $U$ and $V$ are conditionally independent
given $\mathcal F_m$.  The assertion at $m=0$ follows from the product
initial resources and independent private tapes conditional on $C_0$.

Suppose it holds at $m$ and Alice sends the next record.  For bounded
measurable functions $u$ and $v$, conditional independence gives
\[
 \mathbb E[v(V)\mid\sigma(U)\vee\mathcal F_m]
 =\mathbb E[v(V)\mid\mathcal F_m].
\]
As $\mathcal F_{m+1}\subseteq\sigma(U)\vee\mathcal F_m$, conditioning
this equality on $\mathcal F_{m+1}$ shows that
\[
 \mathbb E[v(V)\mid\mathcal F_{m+1}]
 =\mathbb E[v(V)\mid\mathcal F_m].
\]
Using the same equality inside the conditional expectation of
$u(U)v(V)$ gives
\begin{equation}\label{eq:tape-factorization}
 \mathbb E[u(U)v(V)\mid\mathcal F_{m+1}]
 =\mathbb E[u(U)\mid\mathcal F_{m+1}]
  \mathbb E[v(V)\mid\mathcal F_{m+1}].
\end{equation}
The Bob step is symmetric.

For a public-source step, let $\varphi$ be a bounded measurable function
of its new draw $C$, and write
$(\kappa_m\varphi)(T_m)=\int\varphi(c)\,\kappa_m(T_m,dc)$.  The kernel
condition and the induction hypothesis give
\[
 \mathbb E[u(U)v(V)\varphi(C)\mid\mathcal F_m]
 =(\kappa_m\varphi)(T_m)
   \mathbb E[u(U)\mid\mathcal F_m]\,
   \mathbb E[v(V)\mid\mathcal F_m].
\]
Testing against bounded $\mathcal F_m$-measurable factors times
$\varphi(C)$ and applying the monotone class theorem identifies conditional expectations on
$\mathcal F_{m+1}=\mathcal F_m\vee\sigma(C)$.  Taking $v=1$ or $u=1$
shows that the respective conditional marginal is unchanged; taking
both functions gives their product.  Thus the same factorization
\eqref{eq:tape-factorization} holds after the public-source step.
The rules for speaker and stopping records are among these sender and
public-source steps.  If two messages were simultaneous, ordering them
preserves the required measurability for the second, because it still
depends only on its original earlier record.  Fixed padding after a
public stop also preserves the claim.

Set $\mathcal F_\infty=\sigma(\bigcup_m\mathcal F_m)=\sigma(T)$, the sigma
field of the actual complete transcript.  The auxiliary sampling uniforms
for later public draws are not adjoined.  If $Z$ is bounded, then
\[
 \mathbb E[Z\mid\mathcal F_m]\longrightarrow
 \mathbb E[Z\mid\mathcal F_\infty]\quad\text{in }L^2.
\]
Indeed, these are the orthogonal projections of $Z$ onto increasing
closed subspaces of $L^2$.  Their limit is the projection onto the
closure of the union.  Indicators of finite-prefix events belong to
that union, and the monotone class theorem shows that their span is
dense in $L^2(\mathcal F_\infty)$.  The limiting projection is therefore
the indicated conditional expectation.  For bounded $u,v$, the two
conditional expectations on the right of \eqref{eq:tape-factorization}
converge in $L^2$ and remain bounded.  Cauchy--Schwarz applied to the
difference of their products gives convergence in $L^1$.  Passing to
the limit in \eqref{eq:tape-factorization} proves
\[
 \mathbb E[u(U)v(V)\mid\mathcal F_\infty]
 =\mathbb E[u(U)\mid\mathcal F_\infty]
  \mathbb E[v(V)\mid\mathcal F_\infty].
\]

The tape spaces and $\mathsf T$ are standard Borel.  They admit regular
conditional probability kernels and conditional integration of
functions depending on $t$
\cite[Theorems~6.3--6.4]{Kallenberg2002}.  Apply the last factorization
to indicators from countable generating algebras for the two tape spaces,
including the whole spaces, and discard the union of the resulting null
sets.  Their product rectangles form a $\pi$-system generating the product
sigma field.  Uniqueness of probability measures on that $\pi$-system then
yields, on a single set of full transcript measure,
\begin{equation}\label{eq:full-tape-law}
 \mathsf P_{U,V\mid T=t}
 =\mathsf P_{U\mid T=t}\otimes\mathsf P_{V\mid T=t}.
\end{equation}
In particular this law factors the conditional expectations of any
bounded measurable function of $(U,t)$ and any bounded measurable
function of $(V,t)$.  Thus the pair consisting of Alice's defaulted
bit and her reference-test result is conditionally independent of the
corresponding pair for Bob, given $t$.

\paragraph{Positive reference measures and their densities.}
Return to the experiment in which the probes are retained and the
reference tests are not performed.  We first construct its reference
matrix measure on the space of all genuine classical instrument
histories, including private histories.  The fixed initial law of $C_0$
and the specified finite-prefix instruments give a positive reference
matrix measure at every prefix.  Summing the next local outcome recovers
the preceding reference measure because the total instrument is trace
preserving.  Integrating a public-source outcome does the same because
its scalar kernel has total mass one and acts as the identity on the
quantum registers.  These measures are therefore consistent on finite
cylinders.

Here is the countable extension in finite-dimensional terms.  For a
positive reference test, its scalar finite-prefix laws are consistent
finite measures; after normalization, or by adjoining the
complementary test outcome, the countable product extension theorem
applies \cite[Theorem~6.14]{Kallenberg2002}.  It supplies a finite
scalar measure on the countable standard Borel history space.  Recover
matrix entries from finitely many rank-one reference tests by
polarization.  For an arbitrary reference vector $z$, extend also its
positive rank-one test.  On finite cylinders the resulting scalar
measure equals the quadratic form $z^*W(\,\cdot\,)z$ of the recovered
matrix measure.  Uniqueness of finite measures on cylinders extends
this equality to the entire history sigma field.  Thus
$z^*W(S)z\ge0$ for every measurable $S$ and every $z$, so $W$ is a
positive matrix-valued measure.  This argument constructs a measure
for the untouched finite references; it asks for no limiting state of
unused quantum memory.

Measurable terminal classical readouts and the local default rule now
give measurable events in the history space.  If a terminal quantum
readout is used, the incoming local process stipulated in
Definition~\ref{def:protocol}, on those same instrument histories and
with an untouched finite reference, together with its specified local
instrument gives the bit-conditioned positive reference measures.
Each instrument is selected from its own laboratory's history and $T$;
their joint refinement is obtained by the two local operations.  Include
the missing or noninvoked tag among the outcomes, so summing both local
outcomes recovers the reference measure on the complete history.  This
terminal operation is a separate extension of that history; its outcome is
included in the enlarged history before the classical readout.  This is where
clauses~\ref{protocol:reference}--\ref{protocol:terminal} supply the needed
locality, prefix compatibility, and reference stability.  Write
$\widehat W$ for the resulting positive reference measure on the enlarged
history space.  Its marginal on the preterminal history is $W$; when no
readout is used, identify $\widehat W$ with $W$ using trivial terminal tags.
The construction uses the genuine
instrument records; the tapes above were only a sampling device for
their tested scalar laws.

Let $W_{ij}(S)$ be the restriction and pushforward of $\widehat W$ to
the defaulted bit pair $(i,j)$ and transcript in a measurable set
$S\subseteq\mathsf T$.  Define the probe transcript law
\[
 \mu(S)=\sum_{i,j=0}^1\tr W_{ij}(S).
\]
It is a probability measure: the probe is normalized, the instrument
totals preserve trace, and the defaults assign a pair on every history.
For each $i,j$, positivity and $\tr W_{ij}(S)\le\mu(S)$ imply absolute
continuity of every matrix entry with respect to $\mu$.  Hence there
are entrywise Radon--Nikodym densities $W_{ij}(t)$.  Only the dominated
finite-measure case is needed here.  For completeness, if
$0\le\nu\le c\mu$, the functional $g\mapsto\int g\,d\nu$ on simple
functions is bounded in $L^2(\mu)$ by Cauchy--Schwarz.  Its Hilbert
space representing vector is a density, and indicator tests show that
the density lies between $0$ and $c$.  Apply this fact to the finitely
many polarization tests for the matrix entries.

Testing the densities on a countable dense set of reference vectors
shows that $W_{ij}(t)\succeq0$ outside one null set.  The equality
defining $\mu$ also gives
\[
 \sum_{i,j}\tr W_{ij}(t)=1\quad\text{for $\mu$-almost every }t.
\]
Put
\[
 U_i(t)=\sum_j\tr_{B_0}W_{ij}(t),
 \qquad
 V_j(t)=\sum_i\tr_{A_0}W_{ij}(t).
\]
Both local pairs are positive, and
$\sum_i\tr U_i(t)=\sum_j\tr V_j(t)=1$ almost everywhere.

The conditional scalar statistics of the reference tests are the
traces against these densities.  Their local marginals are
$\tr[E_rU_i(t)]$ and $\tr[G_sV_j(t)]$, because the other POVM sums to
the identity.  Conditional independence from
\eqref{eq:full-tape-law} therefore gives
\[
 \tr[(E_r\otimes G_s)W_{ij}(t)]
 =\tr[E_rU_i(t)]\,\tr[G_sV_j(t)]
\]
for every $i,j,r,s$, outside one null set.  The tensor products
$E_r\otimes G_s$ span the Hermitian matrices on $A_0\otimes B_0$.
Equality against that spanning family proves
\begin{equation}\label{eq:probe-product}
 W_{ij}(t)=U_i(t)\otimes V_j(t)
 \quad\text{for all }i,j\text{ and $\mu$-almost every }t.
\end{equation}
We have obtained the same two local matrix pairs for all four branches,
without conditioning on a positive-probability singleton transcript
and without making private instrument labels public.

\paragraph{Recovering the actual purification.}
Identify $A_0\otimes B_0$ with $E$ in the product basis and define
\[
 K=\sqrt{ab}\,(\sqrt R)^\T.
\]
The elementary identity
$(I\otimes S^\T)\sum_h|h,h\rangle=(S\otimes I)\sum_h|h,h\rangle$
shows that applying $I_{AB}\otimes K$ to the product probes
\eqref{eq:local-probes} gives exactly $|\Psi_R\rangle$.
This joint filter on the references is an algebraic preparation of
the input purification; the laboratories are not required to implement
it.  It need not be trace preserving or a contraction.

The same independent law of $C_0$ and the same $C_0$-conditioned local
auxiliary resources are used on the probes and on the actual input.
Consequently the filter also prepares the full initial joint law,
including $C_0$ and those resources.
On each finite cylinder of genuine histories, the reference matrix
for this filtered input is $K W(\,\cdot\,)K^*$, because the references
are untouched and the filter commutes with every local instrument.
Every public-source update also commutes with the filter: at a given
public record it multiplies both laws by the same scalar kernel and
acts as the identity on the reference.
The scalar entries on both sides are finite measures, so uniqueness
extends their equality from cylinders to the full history sigma field.
The same commutation holds for any appended terminal instrument by
clause~\ref{protocol:terminal}.  Thus the filtered law on the enlarged
history is $K\widehat W(\,\cdot\,)K^*$, and the identity holds for the
bit-conditioned measures as well.

Let $N$ be the event in this enlarged history space that at least one
prescribed local bit is missing before the default rule.  The event may
depend on private records.  On the actual input its probability is
zero by hypothesis, so positivity gives
\[
 \tr[K\widehat W(N)K^*]=0,
 \qquad K\widehat W(N)K^*=0.
\]
Every subevent of $N$ has a positive filtered matrix bounded by this
zero matrix.  It therefore also contributes zero.  Thus the local
defaults leave the actual output measure unchanged, even though they
may occur on the probes.  The argument was made on full histories
before discarding private records, so $N$ need not be public.

It follows from \eqref{eq:probe-product} that the actual Eve density
in branch $(i,j)$ is $K(U_i(t)\otimes V_j(t))K^*$.  The matrix
$(\sqrt R)^\T$ is Hermitian.  Hence direct multiplication gives
\[
 \begin{aligned}
 K(U_i\otimes V_j)K^*
 &=ab(\sqrt R)^\T(U_i\otimes V_j)(\sqrt R)^\T\\
 &=\bigl(\sqrt R\,[aU_i^\T\otimes bV_j^\T]\sqrt R\bigr)^\T.
 \end{aligned}
\]
Take $X_i(t)=aU_i(t)^\T$ and $Y_j(t)=bV_j(t)^\T$, redefining them on a
null set if necessary.  Transposition preserves positivity, so these
are measurable positive local matrices.  The filtered total trace is
one because $R$ is normalized, and \eqref{eq:eve-blocks} follows.
No inverse of $R$ appears anywhere in the construction.
\end{proof}

The canonical purification is convenient for the formula, but it does
not restrict the adversary or the ideal comparison law.  The following
observation will let the secret-bit proof use that formula for every
purifying space.

\begin{lemma}[Recovery from another purifying space]
\label{lem:purification-recovery}
Let $R$ and $|\Psi_R\rangle$ be as in Lemma~\ref{lem:transcript}, and
let $|\psi\rangle\in A\otimes B\otimes\widetilde E$ be any purification
of $R$.  There is a channel $\mathcal R$ from $\widetilde E$ to $E$
that recovers the canonical purification.  If Alice and Bob run the
same admitted protocol and Eve retains her purification and the full
transcript, $\mathcal R$ acting on the purifying register and the
identity acting on the transcript recover the canonical output of
Lemma~\ref{lem:transcript}.  Moreover this channel maps every ideal
secret-bit law with Eve in $\widetilde E T$ to an ideal secret-bit law
with Eve in $ET$.
\end{lemma}

\begin{proof}
Let $\mathcal S=\supp(R^\T)\subseteq E$.  Schmidt decomposition gives
an isometry $V:\mathcal S\to\widetilde E$ with
$|\psi\rangle=(I_{AB}\otimes V)|\Psi_R\rangle$; the canonical vector
is supported on $\mathcal S$ in its purifying factor.  Choose any
density operator $\zeta$ on $E$, and define, with the compression term
included into $E$ from $\mathcal S$,
\[
 \mathcal R(\xi)=V^*\xi V+
       \tr[(I_{\widetilde E}-VV^*)\xi]\,\zeta.
\]
Compression is CP, as is the positive trace functional followed by
preparation of $\zeta$.  Their sum preserves trace, so $\mathcal R$ is
a channel.  Its first term inverts $V$ on the actual purifying support,
and the second term vanishes there.  Local operations on $A,B$ keep
each conditional purifying state supported in $\ran V$, and public-source
steps act as the identity on that register, so recovery is
exact in every transcript and bit branch.  The same formula is valid when $\widetilde E$ is
larger than the finite purifying support, acting on trace-class inputs.

An ideal bit has the form
$\frac12\sum_{i=0}^1|i,i\rangle\langle i,i|\otimes\sigma$.
Applying $\mathcal R\otimes\mathrm{id}_T$ to its Eve factor replaces
$\sigma$ by another normalized state and leaves that form intact.
This includes ideal states with mass outside $\ran V$.  Thus
trace-norm contraction transfers any lower bound proved for the
canonical output and every canonical ideal law to the output for the
arbitrary purification and every ideal law in its larger space.
\end{proof}
==== END Entanglement-with-zero-distillable-secret-key-in-local-dimension-ten//transcripts.tex ====