% An exposition-friendly rewrite of the original paper.
% Target audience: an intelligent high school student willing to work through
% density-matrix linear algebra for the first time.

\documentclass[11pt]{article}
\usepackage[T1]{fontenc}
\usepackage{lmodern}
\usepackage[margin=1in]{geometry}
\usepackage{amsmath,amssymb,amsthm,mathtools,mathrsfs}
\usepackage{microtype}
\usepackage{booktabs}
\usepackage{xcolor}
\usepackage[colorlinks=true,linkcolor=blue!45!black,citecolor=blue!45!black,urlcolor=blue!45!black]{hyperref}
\hypersetup{pdftitle={Entanglement with zero distillable secret key in local dimension ten},pdfauthor={OpenAI}}
\numberwithin{equation}{section}
\newtheorem{theorem}{Theorem}[section]
\newtheorem{proposition}[theorem]{Proposition}
\newtheorem{lemma}[theorem]{Lemma}
\newtheorem{corollary}[theorem]{Corollary}
\theoremstyle{definition}
\newtheorem{definition}[theorem]{Definition}
\newcommand{\Mat}[1]{M_{#1}(\mathbb C)}
\newcommand{\tr}{\operatorname{tr}}
\newcommand{\ran}{\operatorname{ran}}
\newcommand{\rank}{\operatorname{rank}}
\newcommand{\Ad}{\operatorname{Ad}}
\newcommand{\T}{\mathsf T}
\newcommand{\F}{\mathbb F}
\newcommand{\Q}{\mathbb Q}
\newcommand{\C}{\mathbb C}
\newcommand{\norm}[1]{\left\lVert#1\right\rVert}
\newcommand{\ip}[2]{\left\langle#1,#2\right\rangle}

\title{Entanglement with zero distillable secret key\\ in local dimension ten}
\author{OpenAI}
\date{September 27, 2026}

\begin{document}
\maketitle

\begin{abstract}
We construct an entangled density operator \(\rho\) on \(\C^{10}\otimes\C^{10}\)
whose range contains no nonzero product vector and whose distillable
secret key is zero. More precisely: for every integer \(n\ge1\) and every
admitted protocol on \(\rho^{\otimes n}\), the unhalved trace-norm distance
from any completed bit output to an ideal secret bit (with arbitrary
eavesdropper state) is at least \(1/5\). The construction disproves the
unrestricted two-map PPT-composition conjecture of Christandl,
M\"uller-Hermes, and Wolf. A separate trace-preserving PPT channel on
\(\Mat{21}\) has a square that is not entanglement breaking.
\end{abstract}

\section*{Preface for younger readers}

This paper proves a surprising theorem and then does some frighteningly
careful arithmetic. The theorem says: there is a specific entangled
quantum state from which no protocol can squeeze out even one secret
bit. The arithmetic makes the state explicit, so no one has to take the
existence on faith.

The following paragraphs are an on-ramp. Every formal object below has a
plain-language counterpart in this preface. If the notation later starts
to groan, come back here.

\paragraph{Quantum states.} A quantum system of dimension \(d\) is modeled
by the unit sphere in \(\C^d\) up to global phase. A qubit is \(d=2\).
If \(\{e_0,e_1\}\) is the standard basis of \(\C^2\), the vector
\((e_0+e_1)/\sqrt2\) is a superposition: measuring in that basis gives
\(0\) or \(1\) with equal probability.

When the state is not known---because someone flipped a coin and
prepared \(|e_0\rangle\) or \(|e_1\rangle\) so that we only know a
probability---the right object is a \emph{density operator}. This is a
positive semidefinite matrix \(\rho\) with \(\tr\rho=1\). If the state
is pure, prepared from a known unit vector \(|\psi\rangle\), then
\(\rho=|\psi\rangle\langle\psi|\). Measuring an observable \(A\) yields
expectation \(\tr(A\rho)\). Density operators are the universal currency
of quantum statistics: two preparations lead to the same state precisely
when they assign the same matrix \(\rho\).

\paragraph{Bipartite states.} Suppose two distant laboratories Alice and
Bob share a quantum system that lives on a tensor product
\(\C^a\otimes\C^b\). The joint density operator \(\rho\) records the
statistics of all joint measurements one could perform there.

A state is \emph{separable} if it can be written as a finite sum
\[
\rho=\sum_{r} p_r\; |\psi_r\rangle\langle\psi_r|_A
                  \otimes |\phi_r\rangle\langle\phi_r|_B,
\]
with \(p_r\ge0\) and \(\sum_r p_r=1\). In English: some classical random
variable chooses a label \(r\), and each laboratory prepares a state
depending only on \(r\). Separable states therefore carry only classical
correlations.

A state is \emph{entangled} if it is not separable. Entanglement is the extra
correlation that lets Bell-inequality experiments beat any classical
model of the same statistics. It is not the same as classical randomness
shared through a hidden variable.

\paragraph{Secret-key distillation.} Alice and Bob share a state \(\rho\).
They can perform any sequence of local quantum operations (measurements,
unitaries, ancillas) and exchange classical messages over an
authenticated public channel. Question: can they produce identical secret
random bits?

The adversary is an eavesdropper Eve. The most pessimistic and most
natural model is: Eve started with a \emph{purification} of \(\rho\), a pure
state \(|\Psi\rangle\langle\Psi|\) on \(\C^a\otimes\C^b\otimes\C^E\)
whose restriction to \(\C^a\otimes\C^b\) is \(\rho\). She also sees the
full public transcript. An \emph{ideal secret bit} is one for which the joint
state of Alice, Bob, and Eve has the form
\[
\gamma = \frac12\sum_{z\in\{0,1\}} |z,z\rangle\langle z,z| \otimes \sigma,
\]
for some eavesdropper state \(\sigma\). That is: half the time Alice and
Bob hold \(0\otimes0\) and Eve holds \(\sigma\); half the time
\(1\otimes1\) and Eve holds \(\sigma\). Eve sees the bit but, because
the state is identical in both branches, learns nothing new from Alice
and Bob's announcement.

The output of a real protocol \(\tau\) is compared to \(\gamma\) by the
unnormalized trace norm \(\norm{\tau-\gamma}_1\). This is twice the
traditional "trace distance" and has the advantage that
\(0\le\norm{\tau-\gamma}_1\le2\). If it is close to zero, Eve learns
essentially nothing.

The \emph{distillable secret key} \(K_D(\rho)\) is the supremum over secure
protocols of the asymptotic rate of bits produced per copy of \(\rho\),
in the limit of many copies. Ordinary entropic protocols (privacy
amplification) show that some states have \(K_D>0\).

\paragraph{The question.} Every separable \(\rho\) has \(K_D=0\):
Eve's purification is a summation over product states, so she already
knows everything about each branch and no announcement can surprise her.

The converse is \emph{a priori} not obvious. If \(\rho\) is entangled, does it
have \(K_D>0\)? By the mid-2000s this was a standard open problem. It
appears as Problem 24 in Kr\"uger and Werner's 2005 collection, in the
form: "Secret key from all entangled states?", attributed to
P.~Horodecki. The intuition was: entanglement is a resource; surely
\emph{some} useful amount of it must survive public discussion.

\paragraph{What this paper proves.} It does not. There is a specific
entangled \(\rho\) on \(\C^{10}\otimes\C^{10}\) with \(K_D(\rho)=0\). In
fact we prove the sharper statement: any completed protocol on any number
of copies that outputs one bit must be at unhalved trace-norm distance at
least \(1/5\) from every ideal bit. The conventional trace distance
(the one with a factor \(1/2\)) is therefore at least \(1/10\), uniformly
in the number of copies, the number of rounds of public discussion, and
the eavesdropper's initial purification.

The construction is not magical. It comes from a completely positive map
whose Choi matrix---an ordinary matrix built from the map---has a very
special feature: all its "product" directions, which separability would
force into its range, are visibly absent from that range. If a protocol
could extract key, a finite combinatorial estimate of how much coherence
can coexist with that pattern would have to break. It does not. The rest
of the paper makes the state explicit: a specific \(6\times4\) integer
matrix pencil, twenty specific singular directions, an exact modular
certificate at primes \(41\), \(131\), \(139\), an irreducible
degree-twenty polynomial, and Galois group \(S_{20}\).

The paper has one technical core (the operational obstruction, via a
four-effect coherence inequality) and two independent realizations
(the twenty-direction integer pencil of Section~\ref{sec:certificate},
and the projection--combinatorial construction of
Sections~\ref{sec:projection}--\ref{sec:combinatorial}). Both provide
independently certified entangled members of the operational class. The
second is enormous in dimension but conceptually simple; the first is
small but certified by exact finite arithmetic.

\section{What we prove, and why it is surprising}
\label{sec:intro}

Fix two finite-dimensional complex Hilbert spaces \(\C^a\) and \(\C^b\).
A \emph{density operator} \(\rho\) on \(\C^a\otimes\C^b\) is a positive
semidefinite matrix of trace one. It is \emph{separable} if it is a
finite convex combination of positive product matrices, and
\emph{entangled} otherwise.

We consider two-party protocols with one-dimensional quantum
instruments, private ancillas, private randomness, and authenticated
two-way classical communication. The input is the only shared private
resource. An eavesdropper Eve starts with a purification of the input and
sees the complete public transcript. \emph{Distillable secret key}
\(K_D(\rho)\) is defined as the supremum of bits-per-copy rates that
these protocols can extract, with zero asymptotically vanishing error.
Section~\ref{sec:transcript} gives the precise operational model.

The sentence we are trying to falsify has been current since
2005~\cite{KrugerWerner05}:

\begin{quote}
Every entangled state has positive distillable secret key.
\end{quote}

The paper produces an explicit counterexample.

\begin{theorem}[Entangled state with zero secret key]
\label{thm:main-state}
There is an explicitly specified entangled density operator \(\rho\) on
\(\C^{10}\otimes\C^{10}\) whose range contains no nonzero product vector
and for which \(K_D(\rho)=0\). More precisely: for every integer \(n\ge1\)
and every admitted protocol on \(\rho^{\otimes n}\) that produces a
completed bit output \(\tau_{K_AK_BE'}\) with \(E'\) retaining an initial
purification and the full public transcript, we have, for every
eavesdropper state \(\sigma_{E'}\),
\begin{equation}\label{eq:main-gap}
\norm{
\tau_{K_AK_BE'}-\frac12\sum_{i=0}^1 |i,i\rangle\langle i,i|\otimes\sigma_{E'}
}_1\ge\frac15.
\end{equation}
Thus the traditional trace distance to an ideal bit is at least \(1/10\).
\end{theorem}

The bound \(1/5\) is uniform in \(n\), in the number of rounds, in the
protocol itself, and in the eavesdropper's purification. Proposition~%
\ref{prop:operational-extensions} presents three natural extensions:
conditioning on a positive-probability transcript event, vanishing abort
probabilities, and trace-norm limits of completed actual outputs whose
Eve registers retain the full information.

The state is derived from maps. A linear map \(F:\Mat a\to\Mat b\) is
\emph{completely positive} (CP) if \(\mathrm{id}_k\otimes F\) is
positive for every \(k\ge1\). It is \emph{PPT} if both \(F\) and
\(T_b\circ F\) are CP, where \(T_d(X)=X^{\T}\) is the (complex-linear)
transpose on \(\Mat d\). A CP map \(F\) is \emph{entanglement breaking}
(EB) if applying it to one subsystem of any positive bipartite input
always outputs a separable state. Equivalently, its
Choi matrix is separable~\cite{HSR2003}. Our second main result is a
counterexample to composition.

\begin{theorem}[Two PPT maps whose composition is not EB]
\label{thm:main-pair}
There are explicitly specified PPT maps
\(\Phi_1,\Phi_2:\Mat{10}\to\Mat{10}\) such that \(Z=J(\Phi_2\circ\Phi_1)\)
is nonzero and its range contains no nonzero product vector. Hence
\(\Phi_2\circ\Phi_1\) is not entanglement breaking.
\end{theorem}

The maps \(\Phi_1,\Phi_2\) come from a \(6\times4\) real integer matrix
pencil \(M(x)=x_0M_0+x_1M_1+x_2M_2+x_3M_3\). Section~%
\ref{sec:certificate} constructs them; Section~\ref{sec:geometry}
proves the tensor-criterion that turns them into Theorem~%
\ref{thm:main-pair}. Theorem~\ref{thm:main-state} is then the
corresponding statement for the density operator
\(\rho=Z/\tr Z\).

A trace-preserving channel version of the same phenomenon is stated next.

\begin{theorem}[Trace-preserving PPT channel whose square is not EB]
\label{thm:main-channel}
There is an explicitly specified trace-preserving PPT channel
\(\Theta:\Mat{21}\to\Mat{21}\) whose square \(\Theta\circ\Theta\) is not
entanglement breaking.
\end{theorem}

The dimension \(21\) is \(2\cdot10+1\): the pair from Theorem~%
\ref{thm:main-pair} is embedded, rescaled, and completed by an absorbing
flag, following Christandl--M\"uller-Hermes--Wolf~\cite{CMHW2019} and
Filippov~\cite{Filippov2021}. Section~\ref{sec:applications} presents the
details.

\paragraph{Why this is surprising.} For two decades, evidence pointed the
other way. Horodecki, Horodecki, Horodecki, and Oppenheim~\cite{%
keyBoundEntanglement} proved that \emph{some} PPT entangled (bound)
states have positive secret-key cost, via the private-state paradigm of
Refs.~\cite{keyBoundEntanglement,keyPrivateStates}. Devetak and Winter~%
\cite{DevetakWinter05} gave one-way positive-key criteria. On the collapse
side, An and Lee~\cite{AnLee2026} proved that a qutrit CP map with an
undistillable Choi matrix composes with a low-Schmidt Choi matrix into an
EB map in both orders; Park~\cite{Park2026} recently proved finite EB
index for every PPT channel. A failure at the second iterate is
consistent with eventual EB. Meanwhile the CMHW paper~\cite{CMHW2019}
proved \(\mathrm{PPT}^2\) composition in several important cases (all maps on
\(\Mat 3\); Gaussian channels; diagonal unitary covariant and conjugate
diagonal unitary covariant PPT maps). Our example violates the general
statement but not any of those specific affirmative classes.

\paragraph{Organisation.} Section~\ref{sec:foundations} establishes map
conventions, the \emph{represented class} \(\mathscr C\), and the Choi
transfer identity. Sections~\ref{sec:coherence}--\ref{sec:secret-key}
prove the operational theorem: the coherence inequality, the transcript
lemma, and the \(1/5\) gap. Section~\ref{sec:geometry} constructs the
dimension-ten pair from a tensor criterion; Section~\ref{sec:certificate}
supplies the exact integer certificate; Section~\ref{sec:applications}
derives the state and channel statements.
Sections~\ref{sec:projection}--\ref{sec:combinatorial} give an
independent construction from projections and the Mermin--Peres square.
The appendices collect exact arithmetic and supplementary checks.

\section{Foundations: maps, PPT, and the represented class}
\label{sec:foundations}

All matrix algebras are finite-dimensional over \(\C\), with fixed
orthonormal bases and product bases. We write \(X^*\) for conjugate
transpose, \(\overline X\) for entrywise conjugation,
\(T_d(X)=X^{\T}\) for the complex-linear transpose on \(\Mat d\). For a
linear map \(F\), its Hilbert--Schmidt adjoint \(F^\dagger\) satisfies
\(\tr(Y^*F(X))=\tr((F^\dagger(Y))^*X)\). If \(V\) is a matrix, we write
\(\Ad_V(X)=VXV^*\).

Our Choi matrix convention is
\begin{equation}\label{eq:choi-definition}
J(F)=\sum_{i,j=1}^a E_{ij}\otimes F(E_{ij})
 =(\mathrm{id}_a\otimes F)(\Omega_a\Omega_a^*),
 \qquad \Omega_a=\sum_{i=1}^a e_i\otimes e_i.
\end{equation}
So \(\norm{\Omega_a}^2=a\), and the first tensor factor is the input
reference. This fixes every dimensional factor in the transfer formula
and in every channel corollary. It is the map--operator correspondence
of Jamio\l{}kowski and Choi~\cite{Jamiolkowski1972,Choi1975}.

\begin{lemma}[PPT stability]
\label{lem:ppt-stability}
Let \(F:\Mat a\to\Mat b\) be CP. Then \(F^\dagger\) and
\(T_b\circ F\circ T_a\) are CP. Moreover
\[
F\circ T_a\ \text{is CP}\iff T_b\circ F\ \text{is CP}.
\]
If \(F\) is PPT, so are \(T_b\circ F\), \(F\circ T_a\), its adjoint,
\(T_b\circ F\circ T_a\), and \(F^\sharp:=T_a\circ F^\dagger\circ T_b\).
Tensor products of PPT maps are PPT. If \(P:\Mat{a'}\to\Mat a\) and
\(Q:\Mat b\to\Mat{b'}\) are CP, then \(Q\circ F\circ P\) is PPT whenever
\(F\) is PPT.
\end{lemma}

\begin{proof}
Write \(F(X)=\sum_r A_r X A_r^*\) with Kraus matrices
\(A_r\in\C^{b\times a}\). Then
\(F^\dagger(Y)=\sum_r A_r^*YA_r\) and
\((T_b\circ F\circ T_a)(X)=\sum_r \overline{A_r}X\overline{A_r}^{\,*}\),
which proves both CP assertions. Applying the simultaneous-transpose
statement to \(F\circ T_a\) or \(T_b\circ F\) gives the equivalence.
These arguments all work with rectangular Kraus matrices.

Transpose is Hilbert--Schmidt self-adjoint, so when \(F\) is PPT the
identities \(T_a\circ F^\dagger=(F\circ T_a)^\dagger\) and
\(F^\dagger\circ T_b=(T_b\circ F)^\dagger\) are CP. That proves PPT for
the adjoint; simultaneous transposition gives the simultaneous
transpose and the transpose-adjoint. The output transpose of
\(T_b\circ F\) is \(F\), and of \(F\circ T_a\) is
\(T_b\circ F\circ T_a\): both CP by hypothesis. Finally
\(T_{b'}\circ Q\circ F\circ P
=(T_{b'}\circ Q\circ T_b)\circ(T_b\circ F)\circ P\) is a composition of
CP maps; the untransposed composite \(Q\circ F\circ P\) is CP too.
Products follow from \(T_{b_1b_2}=T_{b_1}\otimes T_{b_2}\).
\end{proof}

\begin{lemma}[Choi characterization of CP and of EB]
\label{lem:choi-separable}
A linear map \(F:\Mat a\to\Mat b\) is CP iff \(J(F)\succeq0\). For a CP
map, the following are equivalent:
\begin{enumerate}
\item \(J(F)\) is separable;
\item for every \(k\ge1\) and \(W\succeq0\) in \(\Mat k\otimes\Mat a\),
      \((\mathrm{id}_k\otimes F)(W)\) is separable.
\end{enumerate}
Also \(J(T_b\circ F)=(\mathrm{id}_a\otimes T_b)J(F)\) and
\(J(F\circ T_a)=(T_a\otimes\mathrm{id}_b)J(F)\).
\end{lemma}

\begin{proof}
The forward CP implication is immediate from \eqref{eq:choi-definition}.
Conversely, write \(J(F)=\sum_r v_rv_r^*\); each \(v_r\) has a unique
\(A_r\in\C^{b\times a}\) with \(v_r=(I_a\otimes A_r)\Omega_a\). Comparing
the \((i,j)\) block gives \(F(E_{ij})=\sum_r A_rE_{ij}A_r^*\), hence the
Kraus representation. This is Choi's criterion~\cite{Choi1975}.

If \(J(F)\) is separable, spectral decompositions of its positive
factors express it as \(\sum_r a_ra_r^*\otimes b_rb_r^*\), and blockwise
comparison gives the measure-and-prepare formula
\(F(X)=\sum_r\tr[(a_ra_r^*)^{\T}X]\,b_rb_r^*\). With
\(E_r=(a_ra_r^*)^{\T}\succeq0\), for \(W\succeq0\)
\[
\tr_a[(I_k\otimes E_r)W]
=\tr_a[(I_k\otimes\sqrt{E_r})W(I_k\otimes\sqrt{E_r})]\succeq0.
\]
Therefore \((\mathrm{id}_k\otimes F)(W)\) is a sum of positive products
with second factor \(b_rb_r^*\). The converse follows by testing
\(W=\Omega_a\Omega_a^*\). The two transpose identities are immediate
from reindexing matrix units. This is entanglement breaking in the cone
sense~\cite[Theorem 4]{HSR2003}.
\end{proof}

\begin{lemma}[Nonseparability from range]
\label{lem:product-range}
Every nonzero separable positive matrix has a nonzero product vector in
its range. Consequently, a nonzero positive matrix whose range contains
no nonzero product vector is nonseparable.
\end{lemma}

\begin{proof}
Refine a separable decomposition by spectral decompositions of its
positive factors. It becomes \(Z=\sum_r v_rv_r^*\) with each \(v_r\)
a product vector \(a_r\otimes b_r\). Since
\(\ker Z=\bigcap_r v_r^\perp\), every \(v_r\) lies in
\((\ker Z)^\perp=\ran Z\). If \(Z\ne0\), at least one \(v_r\) is
nonzero. This is the range criterion of Horodecki~\cite{Horodecki1997}.
\end{proof}

\begin{definition}[The represented class \(\mathscr C\)]
\label{def:represented-class}
A density operator \(\omega\) on \(\C^a\otimes\C^b\) belongs to
\(\mathscr C\) if there exist positive integers \(r,s\), a vector
\(\chi\in\C^r\otimes\C^s\), and linear maps
\(\mathcal L:\Mat r\to\Mat a\), \(\mathcal M:\Mat s\to\Mat b\) such
that
\begin{equation}\label{eq:represented-class}
\omega=(\mathcal L\otimes\mathcal M)(\chi\chi^*),
\qquad
\mathcal L,\ \mathcal L\circ T_r,\ \mathcal M,\ \mathcal M\circ T_s
\text{ are CP}.
\end{equation}
Only \(\omega\) is normalized. The vector \(\chi\) may be unnormalized
and the maps may not preserve trace.
\end{definition}

This is a representation property, not a physical claim. Lemma~%
\ref{lem:ppt-stability} shows that \(\mathcal L,\mathcal M\) are also
PPT in the output-transpose convention. In particular \(\omega\) itself
has positive partial transpose, since
\((T_a\otimes\mathrm{id}_b)(\omega)
=((T_a\circ\mathcal L)\otimes\mathcal M)(\chi\chi^*)\succeq0\).

\begin{lemma}[Closure under tensor products]
\label{lem:tensor-closure}
\(\mathscr C\) is closed under finite tensor products (after grouping
all first-party systems and all second-party systems). In particular
\(\omega^{\otimes n}\in\mathscr C\) for every \(\omega\in\mathscr C\)
and \(n\ge1\).
\end{lemma}

\begin{proof}
Tensor the representing vectors and local maps separately. Tensor
products of CP maps are CP and input transpose in the grouped product
basis is the tensor product of the individual input transposes. The
required four CP conditions are preserved. The output is
\(\omega^{\otimes n}\) (trace one). Local permutation unitaries and
their conjugates are CP pre- and post-compositions and preserve
everything.
\end{proof}

\begin{lemma}[Choi transfer]
\label{lem:choi-transfer}
Let \(F:\Mat a\to\Mat b\) and \(G:\Mat b\to\Mat c\) be CP maps and set
\(F^\sharp=T_a\circ F^\dagger\circ T_b\). Then
\begin{equation}\label{eq:choi-transfer}
J(G\circ F)=(F^\sharp\otimes G)(\Omega_b\Omega_b^*).
\end{equation}
If \(F,G\) are PPT and \(Z:=J(G\circ F)\ne0\), then \(\lambda:=\tr Z>0\)
and
\begin{equation}\label{eq:choi-transfer-normalized}
\frac{Z}{\lambda}=(F^\sharp\otimes G)
\left(\frac{\Omega_b\Omega_b^*}{\lambda}\right)\in\mathscr C
\end{equation}
on \(\C^a\otimes\C^c\).
\end{lemma}

\begin{proof}
If \(A_r\) and \(B_s\) are Kraus matrices for \(F\) and \(G\), then
\(F^\sharp(Y)=\sum_r A_r^{\T}Y\overline{A_r}=\sum_r A_r^{\T}Y(A_r^{\T})^*\),
so the Kraus matrices of \(F^\sharp\) are the transposes \(A_r^{\T}\).
For each pair, direct expansion gives
\((A_r^{\T}\otimes B_s)\Omega_b=(I_a\otimes B_sA_r)\Omega_a\).
Summing the corresponding rank-one outer products gives
\eqref{eq:choi-transfer}.

Now suppose \(F,G\) are PPT. Besides \(F^\sharp\) and \(G\) CP, Lemma~%
\ref{lem:ppt-stability} gives \(F^\sharp\circ T_b=T_a\circ F^\dagger
=(F\circ T_a)^\dagger\) CP and \(G\circ T_b\) CP, which are exactly
the input-transpose conditions in \eqref{eq:represented-class}. Finally
\(Z=\sum_{r,s}|(I_a\otimes B_sA_r)\Omega_a\rangle\langle(I_a\otimes B_sA_r)\Omega_a|\)
and \(\lambda=\sum_{r,s}\norm{B_sA_r}_F^2\). Since \(Z\ne0\),
\(\lambda>0\), and \(\chi=\Omega_b/\sqrt\lambda\) proves
\eqref{eq:choi-transfer-normalized}. Its squared norm is \(b/\lambda\),
which is allowed.
\end{proof}

\section{A four-effect coherence inequality}
\label{sec:coherence}

The first step of the operational obstruction is a purely algebraic
inequality about any state in \(\mathscr C\) and four arbitrary positive
local matrices. It compares the "coherence" between two equal-bit
branches with the weights of branches in which the bits disagree. No
pointwise normalization is assumed: later the matrices will be densities
at a fixed public transcript, where pointwise normalization is not
required.

\begin{lemma}[Positive block estimate]
\label{lem:positive-block}
Let \(H\) and \(J\) be square matrices of possibly different sizes and
\(Z\) have corresponding rectangular size. If
\(\begin{pmatrix}H&Z\\ Z^*&J\end{pmatrix}\succeq0\), then
\(\norm{Z}_1\le\sqrt{\tr H\,\tr J}\). This holds also for singular
\(H,J\).
\end{lemma}

\begin{proof}
Spectral decomposition of the positive block matrix writes it as a finite
sum of outer products of block columns \(\binom{a_k}{b_k}\). So
\(H=\sum_k a_ka_k^*\), \(J=\sum_k b_kb_k^*\), \(Z=\sum_k a_kb_k^*\).
Since a rank-one \(ab^*\) has trace norm \(\norm{a}\norm{b}\), triangle
and C-S give
\(\norm{Z}_1\le\sum_k\norm{a_k}\norm{b_k}
\le(\sum_k\norm{a_k}^2)^{1/2}(\sum_k\norm{b_k}^2)^{1/2}
=\sqrt{\tr H\,\tr J}\).
\end{proof}

\begin{lemma}[Four-effect inequality]
\label{lem:coherence}
Let \(\omega\in\mathscr C\) act on \(\C^p\otimes\C^q\). For arbitrary
\(X_0,X_1\succeq0\) in \(\Mat p\) and \(Y_0,Y_1\succeq0\) in \(\Mat q\),
put \(D_{ij}=X_i\otimes Y_j\) and \(p_{ij}=\tr(D_{ij}\omega)\), with
\(i,j\in\{0,1\}\). Then
\begin{equation}\label{eq:coherence}
\norm{\sqrt{D_{00}}\,\omega\sqrt{D_{11}}}_1
\le\sqrt{p_{00}p_{01}}+\sqrt{p_{10}p_{11}}+2\sqrt{p_{01}p_{10}}.
\end{equation}
No normalization is assumed.
\end{lemma}

\begin{proof}[Strategy]
Represent \(\omega=(\mathcal L\otimes\mathcal M)(\chi\chi^*)\) with
\(\mathcal L,\mathcal M\) input-transpose CP. Pull the \(X_i,Y_j\) back
by adjoints to positive matrices on the input spaces. A congruence
regularizes the two pullback pairs so they commute with sum equal to a
projection. Then a direct block bound and a \emph{reverse} block bound (via
the input transpose) sandwich the off-diagonal term. Splitting the input
vector according to which of the two commuting effects is larger, the
off-diagonal contributions obey a spectral weighting that gives the four
terms on the RHS.
\end{proof}

\begin{proof}
Fix a representation
\(\omega=(\mathcal L\otimes\mathcal M)(\chi\chi^*)\) with
\(\mathcal L\circ T_r\), \(\mathcal M\circ T_s\) CP. Pull back:
\(A_i=\mathcal L^\dagger(X_i)\in\Mat r\),
\(B_j=\mathcal M^\dagger(Y_j)\in\Mat s\). These are positive.

\paragraph{Normalization on the support.}
Let \(H=A_0+A_1\) and \(\Pi\) be the orthogonal projection onto
\(\ran H\). If \(a\in\ker H\), then \(a^*A_i a=\norm{\sqrt{A_i}a}^2\)
sums to zero over \(i\), so \(A_i\) kills \(\ker H\) and
\(A_i=\Pi A_i\Pi\). Let \(S\) be \(H^{-1/2}\) on \(\ran H\) and the
identity on \(\ker H\). Then the \(A_i'=S^*A_iS\) are positive, supported
on \(\Pi\), and satisfy \(A_0'+A_1'=\Pi\), so they commute.

This congruence is achievable inside the representation without changing
\(\omega\): with \(\Ad_S(U)=SUS^*\), replace
\(\mathcal L\) by \(\mathcal L\circ\Ad_S\) and \(\chi\) by
\((S^{-1}\otimes I_s)\chi\). The output \(\omega\) is unchanged, the
pullbacks become \(A_i'\), the map is still CP, and
\(\mathcal L'\circ T_r=(\mathcal L\circ T_r)\circ\Ad_{\overline S}\) is
CP. Suppress the primes.

\paragraph{Two block estimates.}
Let \(C=\mathcal L\otimes\mathcal M\). For vectors
\(u,z\in\C^r\otimes\C^s\) put
\(p_{ij}(u)=u^*(A_i\otimes B_j)u\) and
\(Z(u,z)=\sqrt{D_{00}}\,C(uz^*)\sqrt{D_{11}}\). CP of \(C\) applied to
the rank-one \(\binom{u}{z}\binom{u}{z}^*\) gives a positive block.
Conjugating by \(\operatorname{diag}(\sqrt{D_{00}},\sqrt{D_{11}})\) and
applying Lemma~\ref{lem:positive-block} yields
\begin{equation}\label{eq:direct-block-bound}
\norm{Z(u,z)}_1\le\sqrt{p_{00}(u)p_{11}(z)}.
\end{equation}

For the reverse estimate, the \emph{global input transpose}
\(T_{rs}=T_r\otimes T_s\) makes \(C\circ T_{rs}\) CP. Apply the same
block argument to this map on the ordered pair \((\overline z,\overline u)\)
and the same output filters. Since
\((\overline z\,\overline u^*)^\T=uz^*\),
\((\overline z\,\overline z^*)^\T=zz^*\), and
\((\overline u\,\overline u^*)^\T=uu^*\), the off-diagonal output is
unchanged but the two diagonal weights swap:
\begin{equation}\label{eq:reversed-block-bound}
\norm{Z(u,z)}_1\le\sqrt{p_{00}(z)p_{11}(u)}.
\end{equation}
It is the transpose on \emph{both} input factors that supplies this reverse
estimate.

\paragraph{Splitting the input vector.}
Choose a common eigenbasis of the commuting \(A_0,A_1\). Let \(P\) project
onto the eigenvectors where the \(A_0\)-eigenvalue is at least the
\(A_1\)-eigenvalue, and set \(v=(P\otimes I_s)\chi\),
\(w=((I_r-P)\otimes I_s)\chi\). Since \(PA_i(I_r-P)=0\), cross terms in
the \(p_{ij}\) vanish:
\begin{equation}\label{eq:spectral-weights}
p_{ij}=p_{ij}(v)+p_{ij}(w),\quad
p_{11}(v)\le p_{01}(v),\quad p_{00}(w)\le p_{10}(w).
\end{equation}
The first comparison follows because \(A_0-A_1\succeq0\) on \(\ran P\),
so its tensor with \(B_1\) has nonnegative quadratic form on \(v\); the
second follows similarly on \(\ker P\) with \(B_0\).

\paragraph{Assembling four terms.}
Diagonal terms: \eqref{eq:direct-block-bound} with \eqref{eq:spectral-weights}
gives
\[
\norm{Z(v,v)}_1\le\sqrt{p_{00}(v)p_{11}(v)}\le\sqrt{p_{00}p_{01}},
\qquad
\norm{Z(w,w)}_1\le\sqrt{p_{00}(w)p_{11}(w)}\le\sqrt{p_{10}p_{11}}.
\]
Off-diagonal: \(Z(v,w)\) is bounded by \eqref{eq:reversed-block-bound} and
\(Z(w,v)\) by \eqref{eq:direct-block-bound}, and both right sides become
\(\sqrt{p_{10}p_{01}}\). Finally
\(\sqrt{D_{00}}\omega\sqrt{D_{11}}
=Z(v,v)+Z(v,w)+Z(w,v)+Z(w,w)\), so the triangle inequality gives
\eqref{eq:coherence}.
\end{proof}

By Lemma~\ref{lem:tensor-closure} this applies to arbitrary joint
positive matrices on all of Alice's and all of Bob's copies of a state in
\(\mathscr C\). Its lack of normalization is exactly what lets us apply it
at each complete public transcript.

\section{Complete public transcripts}
\label{sec:transcript}

At each public transcript, a protocol induces \emph{the same two pairs} of
positive local matrices on Alice's and Bob's input spaces, for all four
possible bit values. These matrices are not just the final measurements;
they are the aggregated effects of the whole protocol on its input. This
section proves that this factorization holds at measurable transcripts
of the admitted protocol model, using a probe experiment that turns
classical independence conditional on the transcript into matrix-valued
product structure.

\subsection{Finite-record case}

Let \(R\) be the input state on \(\C^a\otimes\C^b\).
In fixed product bases, Eve's canonical purification is
\begin{equation}\label{eq:canonical-purification}
|\Psi_R\rangle=\sum_h \sqrt R\,|h\rangle_{AB}|h\rangle_E,
\qquad E\cong A\otimes B.
\end{equation}
Suppose the protocol is finite (only finitely many steps, all classical
records finite) and produces bits \(i,j\in\{0,1\}\) almost surely on
\(R\). At a fixed complete transcript \(t\), Alice's instrument branches
consistent with \(t\) and final bit \(i\) compose into a CP map
\(\mathcal A_i^t\) on her input; Bob's into \(\mathcal B_j^t\) on his.
Because the compatible private histories sum independently inside each
laboratory (the other party's unannounced outcomes cannot affect what a
laboratory does), the joint branch is
\(\mathcal A_i^t\otimes\mathcal B_j^t\). Public-source weights are
scalars fixed by \(t\); absorb the product into either local map.

Set \(X_i(t)=(\mathcal A_i^t)^\dagger(I)\) and
\(Y_j(t)=(\mathcal B_j^t)^\dagger(I)\). These are positive matrices, and
the effect at branch \((i,j)\) is \(D_{ij}(t)=X_i(t)\otimes Y_j(t)\).
Tracing out the private memories leaves Eve with the density
\[
\tau_{ij}(t)=(\sqrt R\,D_{ij}(t)\sqrt R)^\T,
\]
where the transpose is in the product basis identifying \(E\) with
\(A\otimes B\). The same \(X_0,X_1\) and \(Y_0,Y_1\) work for all four
branches. Private instrument labels are summed, not transmitted to Eve.
No pointwise normalization is required at a fixed \(t\).

\subsection{Admitted protocol model}

The general statement replaces the preceding matrices by densities with
respect to a single transcript measure, and covers continuous transcript
spaces and infinite public schedules. The proof runs the protocol on a
product of two local probes with untouched references, uses conditional
independence of the two local histories given the transcript, and then
transfers to the actual input via a filter on the references.

\begin{definition}[Admitted local protocols]
\label{def:protocol}
\(A,B\) are finite-dimensional complex input spaces. An admitted protocol
consists of local quantum instruments, local memories and randomness, and
authenticated two-way public classical communication. Data and joint
laws satisfy:
\begin{enumerate}
\item\label{protocol:initial}
\emph{Initial resources.} A recorded standard Borel public variable
\(C_0\), possibly constant, with a law fixed once the protocol is chosen.
It is independent of the input plus any purifying or untouched reference.
Conditional on \(C_0\), the joint state of input-reference and the two
initial private auxiliaries factors position by position: input-reference
state times one local resource per laboratory. Shared initial randomness
is included in \(C_0\). No preshared secret key.
\item\label{protocol:instruments}
\emph{Local instruments.} Each instrument assigns CP operations to
measurable outcome sets, countably additively on states, with measurable
outcome laws and measurable conditional local updates, and total
operation trace-preserving. Outcome space is standard Borel. Instruments
may depend measurably on local private history and preceding public
record.
\item\label{protocol:history}
\emph{Local aggregation and chronological history.} A local subroutine
completed before a later public step may be aggregated into one
instrument that retains its continuing memory. Public communication stays
in the public schedule. Genuine classical history, including private
outcomes and public records, is a finite sequence or an
\(\mathbb N\)-indexed sequence in standard Borel coordinate spaces. Local
choices use only that laboratory's preceding private history and the
preceding public record; anything affecting the other party is
communicated through a public step.
\item\label{protocol:public}
\emph{Public steps and the complete record.} Public discussion is
correspondingly finite or \(\mathbb N\)-indexed. Each message is
produced by its sender's local process from that sender's private
history and the preceding public record. A later public-source draw
uses a measurable probability kernel \(\kappa_m(t,dc)\) depending only on
the preceding public record and identical for every input; the draw
multiplies by the scalar kernel and acts as the identity on quantum
registers. Public choices of speaker and stopping decisions use these
same two rules. \(T\) records \(C_0\), all public messages, draws, speaker
choices, and stopping decisions. Private outcomes and quantum memories
stay home.
\item\label{protocol:reference}
\emph{Reference-compatible prefix laws.} The specified instruments act
on arbitrary positive trace-class inputs. Unnormalized branch laws give
countably additive positive matrix-valued measures on any untouched
finite-dimensional reference for finite prefixes. Integrating the next
record recovers the preceding reference measure after tracing out the
current laboratory memories.
\item\label{protocol:terminal}
\emph{Terminal outputs.} A terminal classical output may be a measurable
function of that laboratory's instrument history and received \(T\). A
terminal quantum readout is supplied with its incoming memory (via one
fixed measurable local CP process on those histories) and a selected
local instrument on that memory, selected using only that laboratory's
private history and \(T\). Together with the schedule, these give one
countably additive unnormalized instrument law on the complete history
and terminal outcomes for all inputs and finite untouched references.
Each terminal readout includes a tag for missing or non-invoked. Summing
either laboratory's terminal outcomes removes that local refinement;
summing both and tracing memory recovers the reference measure on the
complete history.
\item\label{protocol:completion}
\emph{Completion on a specified input.} A completed bit-output protocol
on a specified input has a bit in each laboratory almost surely on that
input, with normalized joint output. More generally a completed
key-output protocol produces a bit in a specified finite classical
alphabet per party.
\end{enumerate}
\end{definition}

For finite protocols of the specified type, composing the given
instruments supplies prefix laws and any finite terminal refinement.
The separate complete-history and terminal-process requirements matter
for countable schedules and for aggregated subroutines. No uniform bound
on communication, message size, or round count is imposed. A terminal
classical bit can depend on an entire infinite record.

\subsection{Common factors at a complete transcript}

\begin{lemma}[Common local factors at a transcript]
\label{lem:transcript}
Let \(R\) be a density operator on \(A\otimes B\), and let an admitted
protocol produce bits \(i,j\in\{0,1\}\) almost surely on \(R\). Give Eve
the canonical purification~\eqref{eq:canonical-purification} and let her
retain \(E\) and the complete transcript \(T\) with values in a standard
Borel space. Then there exist a finite positive measure \(\mu\) on the
transcript space and measurable positive matrices \(X_0(t),X_1(t)\in\Mat a\)
encoding Alice's side and \(Y_0(t),Y_1(t)\in\Mat b\) encoding Bob's side,
such that the positive matrix-valued measure of Eve in branch \((i,j)\)
has density
\begin{equation}\label{eq:eve-blocks}
\tau_{ij}(t)=(\sqrt R\,[X_i(t)\otimes Y_j(t)]\sqrt R)^\T
\quad\text{with respect to }\mu,
\end{equation}
the same \(X_i,Y_j\) work for all four branches outside one
\(\mu\)-null set, and
\(\sum_{i,j}\int\tr\tau_{ij}(t)\,d\mu(t)=1\).
\end{lemma}

\begin{proof}[Strategy]
Run the protocol on a product of normalized maximally entangled local
probes with untouched references. On this input the local sampling tapes
are conditionally independent given the transcript. Informationally
complete POVM tests on the untouched references turn the scalar
independence into matrix product structure. A filter on the references
prepares the canonical purification and pushes the product structure
through to the actual input.
\end{proof}

\begin{proof}
Set \(a=\dim A\), \(b=\dim B\), and attach untouched references
\(A_0\cong A\) and \(B_0\cong B\). Run the protocol on the product of the
normalized local probes
\begin{equation}\label{eq:local-probes}
|\Phi_a\rangle_{AA_0}\otimes|\Phi_b\rangle_{BB_0},
\quad
|\Phi_a\rangle=a^{-1/2}\sum_{r=1}^a |r,r\rangle,\quad
|\Phi_b\rangle=b^{-1/2}\sum_{s=1}^b |s,s\rangle.
\end{equation}
Assign bit zero in a laboratory if its prescribed bit is never produced,
retaining bits already produced. This is a measurable local default rule;
we remove its contribution after recovering the actual input.

\paragraph{Conditional independence of local tapes.}
Take a finite informationally complete POVM on each reference (basis
projections, and \((|r\rangle+|s\rangle)/\sqrt2\) and
\((|r\rangle+i|s\rangle)/\sqrt2\) rank-one projections, normalized into
a POVM). These tests commute with all laboratory operations because the
references are untouched.

In this tested product-probe experiment, sample \(C_0\) with its fixed
law, then conditional on \(C_0\) simulate the whole run using independent
local random tapes \(U\) (Alice) and \(V\) (Bob), plus fresh public
uniform random variables for public-source draws.
At each local instrument, sample the conditional outcome law from a fresh
uniform variable on the appropriate tape, and apply the stipulated
conditional update. Only the recorded public-source draw enters the
transcript. Induction over finite prefixes gives the genuine joint
finite-prefix laws. Standard-Borel kernel sampling is standard
\cite[App.~A1, Thm.~A1.2, Lemma 3.22]{Kallenberg2002}.

Each defaulted bit and each reference POVM outcome is a measurable
function of one local tape and \(T\). Let \(\mathcal F_m=\sigma(T_m)\).
A step sent by Alice makes the new record measurable with respect to
\(\sigma(U)\vee\mathcal F_m\); Bob's symmetric. A public-source step
has the sampling kernel as its regular conditional law. Induction shows
\(U\perp V\mid\mathcal F_m\) for every \(m\), and passing to
\(\mathcal F_\infty=\sigma(T)\) in \(L^1\) gives
\(\mathbb E[u(U)v(V)\mid T]=\mathbb E[u(U)\mid T]\mathbb E[v(V)\mid T]\).

Using regular conditional probability kernels on the standard Borel
tape and transcript spaces~\cite[Thm.~6.3--6.4]{Kallenberg2002} and
testing against countable generating algebras, we get
\(\mathsf P_{U,V\mid T=t}=\mathsf P_{U\mid T=t}\otimes\mathsf P_{V\mid T=t}\)
on a single full-measure set of \(t\). Alice's defaulted bit + reference
POVM outcome is conditionally independent of Bob's, given \(t\).

\paragraph{Reference densities and product structure.}
Return to the run without performing the reference POVM on the probes.
The fixed initial law and specified finite-prefix instruments give a
positive matrix-valued reference measure at every prefix; summing the
next local outcome recovers it, as does integrating a public-source
outcome. Countable extension in finite dimension
\cite[Thm.~6.14]{Kallenberg2002} constructs the complete-history positive
matrix-valued reference measure. Let \(W\) denote the resulting reference
measure on the history space; when a terminal quantum readout is used,
its instrument refines this to \(\widehat W\), agreeing on the preterminal
history.

Push \(\widehat W\) forward to the defaulted-bit pair plus transcript.
Call the transport measures \(W_{ij}\). The probe transcript law
\(\mu(S)=\sum_{i,j}\tr W_{ij}(S)\) is a probability measure. Squeeze and
Radon--Nikodym give matrix-entry densities \(W_{ij}(t)\) with
\(\sum_{i,j}\tr W_{ij}(t)=1\) for \(\mu\)-a.e. \(t\), positivity
a.e., and
\[
U_i(t)=\sum_j\tr_{B_0}W_{ij}(t),\quad
V_j(t)=\sum_i\tr_{A_0}W_{ij}(t),\quad
\sum_i\tr U_i(t)=\sum_j\tr V_j(t)=1.
\]
The conditional POVM statistics and their factorized form give
\[
\tr[(E_r\otimes G_s)W_{ij}(t)]=\tr[E_rU_i(t)]\tr[G_sV_j(t)]
\]
almost everywhere.
Since \(E_r\otimes G_s\) span the Hermitian matrices on
\(A_0\otimes B_0\), we conclude
\begin{equation}\label{eq:probe-product}
W_{ij}(t)=U_i(t)\otimes V_j(t)\quad\text{for all }(i,j)
\text{ and }\mu\text{-a.e. }t.
\end{equation}

\paragraph{Recovering the actual purification.}
Identify \(A_0\otimes B_0\) with \(E\) in the product basis and set
\(K=\sqrt{ab}\,(\sqrt R)^\T\). The elementary identity
\((I\otimes S^\T)\sum_h|h,h\rangle=(S\otimes I)\sum_h|h,h\rangle\)
shows that \(I_{AB}\otimes K\) maps the product probes
\eqref{eq:local-probes} to \(|\Psi_R\rangle\) exactly. The same initial
law and local auxiliaries are used on probes and actual input. On each
finite cylinder of histories the reference matrix for the filtered input
is \(K W(\,\cdot\,)K^*\) because the filter on the untouched references
commutes with every local instrument. Every public-source update also
commutes. Uniqueness of finite measures on cylinders extends this to the
full history sigma field; the same commutation holds for any appended
terminal instrument by clause~\ref{protocol:terminal}.

Let \(N\) be the event that some prescribed bit is missing before the
default rule. On the actual input \(R\), clause~\ref{protocol:completion}
gives \(\tr[K\widehat W(N)K^*]=0\), so \(K\widehat W(N)K^*=0\), so
default bit tags correspond to zero filtered measure on the actual
input. Therefore
\[
\tau_{ij}(t)=K(U_i(t)\otimes V_j(t))K^*\quad\text{at }\mu\text{-a.e. }t.
\]
Expanding,
\(K(U_i\otimes V_j)K^*=ab(\sqrt R)^\T(U_i\otimes V_j)(\sqrt R)^\T
=(\sqrt R(aU_i^\T\otimes bV_j^\T)\sqrt R)^\T\).
Take \(X_i(t)=aU_i(t)^\T\) and \(Y_j(t)=bV_j(t)^\T\), adjusting on a
null set if necessary. Transposition preserves positivity, giving
\eqref{eq:eve-blocks}. No inverse of \(R\) appears.
\end{proof}

\begin{lemma}[Recovery from another purifying space]
\label{lem:purification-recovery}
Let \(R\) and \(|\Psi_R\rangle\) be as in Lemma~\ref{lem:transcript}, and
let \(|\psi\rangle\in A\otimes B\otimes\widetilde E\) be any
purification. There is a channel
\(\mathcal R:\mathcal T(\widetilde E)\to\mathcal T(E)\) mapping
\(|\psi\rangle\) to \(|\Psi_R\rangle\). If Alice and Bob run the same
admitted protocol and Eve retains her purification and full transcript,
\(\mathcal R\otimes\mathrm{id}_T\) recovers the canonical output of
Lemma~\ref{lem:transcript}. Moreover \(\mathcal R\) maps every ideal
secret-bit law with Eve in \(\widetilde ET\) to one with Eve in \(ET\).
\end{lemma}

\begin{proof}
Let \(\mathcal S=\supp(R^\T)\subseteq E\). Schmidt decomposition gives
an isometry \(V:\mathcal S\to\widetilde E\) with
\(|\psi\rangle=(I_{AB}\otimes V)|\Psi_R\rangle\).
Choose any density \(\zeta\) on \(E\) and set
\[
\mathcal R(\xi)=V^*\xi V+\tr[(I_{\widetilde E}-VV^*)\xi]\,\zeta.
\]
Compression is CP; the second term is a positive trace functional times a
fixed state. Trace is preserved, so \(\mathcal R\) is a channel. Its
first term inverts \(V\) on the actual purifying support; the second
vanishes there. Local operations keep each conditional purifying state
on \(\ran V\); public-source steps and identity on register \(T\) do not
disturb this. Recovery is exact in every transcript and bit branch, and
the formula extends to trace-class inputs on larger \(\widetilde E\).

An ideal bit has form
\(\frac12\sum_{i}|i,i\rangle\langle i,i|\otimes\sigma\); conjugating by
\(\mathcal R\otimes\mathrm{id}_T\) replaces \(\sigma\) by a normalized
state and keeps the form. Trace-norm contraction transfers any lower
bound from the canonical to the general case.
\end{proof}

\section{Separation from an ideal secret bit}
\label{sec:secret-key}

The coherence inequality applies at each transcript. Take
\(\mathcal S\) = the trace-norm distance from the actual transcript joint
state to the ideal secret-bit transcript joint state. Two forces compete:
correctness forces little mass in unequal-bit branches, and secrecy
forces the equal-bit branches to have matching Eve densities of at least
half mass each. A Cauchy--Schwarz calculation turns these into incompatible
requirements. Below \(\eta < 1/5\) they cannot both hold.

Throughout, the trace norm is unhalved:
\(\norm{H}_1=\tr\sqrt{H^*H}\). A classical-quantum state is a positive
matrix-valued measure of total trace one. If a Hermitian difference of
such measures has density \(H(t)\) with respect to a common finite
dominating measure \(\lambda\), then
\(\norm{H}_1=\int\norm{H(t)}_1\,d\lambda(t)\), independent of the
dominating measure by homogeneity.

\begin{definition}[Distillable secret key]
\label{def:distillable-key}
Let \(\omega\) be a bipartite state, with Eve initially holding a
purification. A key-distillation sequence uses an admitted protocol of
Definition~\ref{def:protocol} on each \(\omega^{\otimes n}\), allowing
each party to process all its \(n\) copies jointly. The normalized
classical output at each party is a string of fixed length \(\ell_n\).
Eve's register \(E'\) retains the initial purification and the complete
public transcript. For any normalized state or classical-quantum law
\(\sigma_{E'}\), the ideal length-\(\ell\) key is
\[
\gamma^{(\ell)}_\sigma=2^{-\ell}\sum_{z\in\{0,1\}^\ell}
|z,z\rangle\langle z,z|\otimes\sigma_{E'}.
\]
The sequence is secure if there are normalized comparison laws
\(\sigma_{E'}^{(n)}\) with
\(\norm{\tau^{(n)}_{K_AK_BE'}-\gamma^{(\ell_n)}_{\sigma^{(n)}}}_1\to0\).
Its asymptotic lower rate is \(\liminf_n \ell_n/n\). The distillable
secret key \(K_D(\omega)\) is the supremum of these rates over secure
sequences (empty key achieves rate zero).
\end{definition}

\begin{lemma}[Root fidelity and trace norm]
\label{lem:fidelity}
For square complex matrices \(A,B\) of the same size,
\begin{equation}\label{eq:polar-fidelity}
f(A^*A,B^*B):=\norm{\sqrt{A^*A}\sqrt{B^*B}}_1=\norm{AB^*}_1.
\end{equation}
For positive matrices \(H,J\) of the same size,
\begin{equation}\label{eq:fidelity-lower}
f(H,J)\ge\frac{\tr H+\tr J-\norm{H-J}_1}{2}.
\end{equation}
Also \(f(H^\T,J^\T)=f(H,J)\).
\end{lemma}

\begin{proof}
Extend the partial isometries in the polar decompositions \(A=U\sqrt{A^*A}\)
and \(B=V\sqrt{B^*B}\) to unitaries. Then
\(AB^*=U\sqrt{A^*A}\sqrt{B^*B}V^*\); unitary invariance of the trace
norm gives \eqref{eq:polar-fidelity} (valid also for singular \(A,B\)).

For \eqref{eq:fidelity-lower}, put \(Z=\sqrt H-\sqrt J\). Then
\(H-J=Z\sqrt H+\sqrt J Z\). The spectral sign
\(\operatorname{sgn}(Z)\) is a Hermitian contraction, so trace-norm
duality and cyclicity give
\(\norm{H-J}_1\ge\tr[\operatorname{sgn}(Z)(H-J)]=\tr[|Z|(\sqrt H+\sqrt J)]\ge \tr Z^2\),
where the last inequality uses
\(\langle\sqrt H+\sqrt J\rangle\ge|\langle\sqrt H-\sqrt J\rangle|
=|z|\) in an eigenvector of \(Z\). Finally
\(\tr Z^2=\tr H+\tr J-2\tr(\sqrt H\sqrt J)\) and
\(0\le\tr(\sqrt H\sqrt J)\le\norm{\sqrt H\sqrt J}_1=f(H,J)\).
The transpose identity follows from functional calculus.
\end{proof}

\begin{theorem}[Uniform obstruction to a secret bit]
\label{thm:zero-key}
Let \(\omega\in\mathscr C\). For every integer \(n\ge1\), let an
admitted completed protocol on \(\omega^{\otimes n}\) produce normalized
bit registers \(K_A,K_B\), and let its output \(\tau_{K_AK_BE'}\)
retain in \(E'\) an initial purification held by Eve and the complete
public transcript. For every normalized \(\sigma_{E'}\),
\begin{equation}\label{eq:uniform-secret-bit-gap}
\norm{\tau_{K_AK_BE'}-\tfrac12\sum_{i=0}^1
|i,i\rangle\langle i,i|\otimes\sigma_{E'}}_1\ge\frac15.
\end{equation}
Thus the traditional trace distance is at least \(1/10\), and
\(K_D(\omega)=0\) in Definition~\ref{def:distillable-key}.
\end{theorem}

\begin{proof}
Group Alice's and Bob's factors, and set \(R=\omega^{\otimes n}\). Lemma~%
\ref{lem:tensor-closure} gives \(R\in\mathscr C\). Apply Eve's classical
readout of the transcript and Lemma~\ref{lem:purification-recovery};
trace-norm contraction reduces the claim to the canonical purification and
the full transcript \(T\).

Apply Lemma~\ref{lem:transcript}: there exist \(\mu\), positive
\(X_i(t),Y_j(t)\), and Eve densities \(\tau_{ij}(t)\) of
\eqref{eq:eve-blocks}. Fix any normalized positive matrix-valued
comparison law \(\sigma_{ET}\). Let \(\nu(S)=\tr\sigma_{ET}(S)\), use
\(\lambda=\mu+\nu\), and replace each actual density and both \(X_i(t)\)
by their product with \(h=d\mu/d\lambda\), leaving \(Y_j(t)\)
unchanged. Equation~\eqref{eq:eve-blocks} and all probabilities are
preserved. The ideal law has positive density \(\sigma(t)\) with
\(\int\tr\sigma(t)\,d\lambda(t)=1\). Now rename \(\lambda\) as \(\mu\).
This common measure keeps singular parts of either law; no support
assumption.

For these common densities set
\(D_{ij}(t)=X_i(t)\otimes Y_j(t)\),
\(p_{ij}(t)=\tr\tau_{ij}(t)=\tr[D_{ij}(t)R]\),
\(P_{ij}=\int p_{ij}(t)\,d\mu(t)\). All \(P_{ij}\ge0\) and
\(\sum_{i,j}P_{ij}=1\). With \(A=\sqrt{D_{00}}\sqrt R\) and
\(B=\sqrt{D_{11}}\sqrt R\), transpose invariance and
\eqref{eq:polar-fidelity} give
\begin{equation}\label{eq:transcript-fidelity}
f(\tau_{00}(t),\tau_{11}(t))
=\norm{\sqrt{D_{00}(t)}R\sqrt{D_{11}(t)}}_1.
\end{equation}

Apply Lemma~\ref{lem:coherence} a.e. and scalar Cauchy--Schwarz after
integration:
\begin{equation}\label{eq:integrated-coherence}
\mathfrak f:=\int f(\tau_{00}(t),\tau_{11}(t))\,d\mu(t)
\le\sqrt{P_{00}P_{01}}+\sqrt{P_{10}P_{11}}+2\sqrt{P_{01}P_{10}}.
\end{equation}
No pointwise POVM normalization was used.

Let \(\eta\) be the unhalved trace-norm distance to the ideal bit after
the common transcript readout, and define
\(e=P_{01}+P_{10}\),
\(q=\int\norm{\tau_{00}-\tau_{11}}_1d\mu\),
\(a_i=\int\norm{\tau_{ii}-\tfrac12\sigma(t)}_1d\mu\).
The unequal-bit blocks of the ideal state are zero. Additivity of trace
norm across bit blocks, then triangle within equal-bit blocks, gives
\begin{equation}\label{eq:linked-errors}
\eta=e+a_0+a_1,\qquad q\le a_0+a_1=\eta-e.
\end{equation}
Trace conservation gives:
since actual equal-bit branches have total trace \(1-e\) while ideal
have total trace one,
\(a_0+a_1\ge|e|\), hence by \eqref{eq:linked-errors},
\begin{equation}\label{eq:unequal-error-bound}
e\le\eta/2.
\end{equation}

Integration of \eqref{eq:fidelity-lower} gives
\(\mathfrak f\ge(P_{00}+P_{11}-q)/2=(1-e-q)/2\ge(1-\eta)/2\). On the
other side, Cauchy--Schwarz on the first two terms and AM-GM on the
last give
\(\sqrt{P_{00}P_{01}}+\sqrt{P_{10}P_{11}}\le\sqrt{e(1-e)}\) and
\(2\sqrt{P_{01}P_{10}}\le e\), so
\begin{equation}\label{eq:fidelity-sandwich}
\frac{1-\eta}{2}\le\mathfrak f\le\sqrt{e(1-e)}+e,\qquad e\le\frac\eta2.
\end{equation}
If \(\eta<1/5\), then \(e<1/10\), and on \(0\le e\le1/10\) the function
\(\sqrt{e(1-e)}+e\) is increasing with value \(2/5\) at \(e=1/10\).
The right side is strictly below \(2/5\), while the left is strictly
above. This proves \eqref{eq:uniform-secret-bit-gap}.

Finally, if a secure sequence had \(\ell_n\ge1\) for infinitely many
\(n\), the local classical channels retaining only the first bit would
map each \(\gamma^{(\ell_n)}_{\sigma^{(n)}}\) to an ideal bit; trace-norm
contraction would give completed bit outputs approaching an ideal bit,
contradicting the gap. Thus every secure sequence has \(\ell_n=0\) for
all sufficiently large \(n\), and \(K_D(\omega)=0\).
\end{proof}

\begin{proposition}[Conditioning, aborts, completed-output limits]
\label{prop:operational-extensions}
Consider inputs \(\omega^{\otimes n}\) with \(\omega\in\mathscr C\) and
\(n\ge1\), and admitted protocols whose normalized completed outputs
retain an arbitrary initial purification and the full transcript.
\begin{enumerate}
\item If \(A\) is a measurable transcript event with probability
      \(r>0\), the normalized bit output conditioned on \(A\) has
      distance at least \(1/5\) from every ideal bit law for the
      accepted output. The bound is uniform in \(r>0\).
\item Suppose a sequence of completed protocols has a local abort symbol
      available. If the probability that at least one party aborts
      tends to zero, and the normalized non-aborting outputs approach
      ideal non-aborting bit laws, then replacing each abort by the
      fixed bit \(0\) gives completed bit outputs approaching ideal
      bits. Such a sequence is impossible for inputs in \(\mathscr C\).
\item Let \(\tau_k\) be completed normalized bit outputs to which the
      gap applies, possibly on different output spaces. Suppose their
      bit registers are kept fixed and their Eve registers embedded in
      a common \(F\) with embeddings \(\mathcal R_k\). If
      \(\widehat\tau_k\to\tau\) in trace norm, then
      \(\norm{\tau-\tfrac12\sum_i|i,i\rangle\langle i,i|\otimes\sigma_F}_1
      \ge 1/5\) for every normalized \(\sigma_F\).
\end{enumerate}
\end{proposition}

\begin{proof}
(1) Restrict the canonical factors of Lemma~\ref{lem:transcript} to
\(A\), and replace both \(X_i(t)\) by \(X_i(t)/r\), leaving \(Y_j(t)\)
unchanged. All four blocks are divided by \(r\), and every probability
and root fidelity scale by the same factor. The proof of
\eqref{eq:fidelity-sandwich} applies without change. No lower bound on
\(r\) is used.

(2) Let \(\delta_k\) be the probability of at least one abort,
\(\tau_k^{\mathrm{ok}}\) the normalized non-aborting state (when
\(\delta_k<1\)), \(\xi_k\) the normalized aborting part. Product local
channels \(\mathcal Q\) sending each party's own abort symbol to \(0\)
fix the ideal bit \(\gamma_k\) and give
\(\norm{\mathcal Q(\tau_k)-\gamma_k}_1
\le(1-\delta_k)\norm{\tau_k^{\mathrm{ok}}-\gamma_k}_1+2\delta_k\to0\),
contradicting Theorem~\ref{thm:zero-key} applied to the completed protocol
with the local replacement appended.

(3) Recovery channel \(\mathcal R_k\) transfers ideal bits:
\(\mathcal R_k:\sigma\mapsto\sigma_{\mathcal R_k}\). Contraction and the
per-protocol gap give
\(\norm{\widehat\tau_k-\gamma_\sigma}_1\ge\norm{\tau_k-\gamma_{\mathcal R_k(\sigma)}}_1\ge1/5\).
Then
\(\norm{\tau-\gamma_\sigma}_1\ge 1/5-\norm{\widehat\tau_k-\tau}_1\to 1/5\).
No convergence on auxiliary probes and no factorization of \(\tau\) is
used.
\end{proof}

\section{Tensor geometry from singular directions}
\label{sec:geometry}

We now construct the dimension-ten pair. The argument has one geometric
step: a map \(L:\Mat 4\to\Mat 4\) with twenty specific projective
directions at which \(L(xx^*)\) is singular. The symmetric square of
\(\C^4\) records the quadratic monomials of \(x\); the exterior square
\(\bigwedge^2\C^4\) converts rank loss of \(L(xx^*)\) into a product
vector in the kernel of a \(6\times6\) intermediate Choi matrix.
Two products in the kernel is all we need: the composite Choi matrix
\(Z\) is then positive with each \(\hat x\otimes\hat x\) in its kernel.
Any product vector would have to be inside the kernel; two nonzero
quadratics whose zero sets together cover all twenty directions cannot
both vanish on nine of them (because \(9+9<20\)).

For a vector \(x\), write \(P_x=xx^*\), with no normalization. A
projective direction \([x]\) is the complex line through \(x\ne0\).

\begin{proposition}[Tensor criterion]
\label{prop:tensor-criterion}
Let \(L:\Mat 4\to\Mat 4\) be PPT. Suppose
\(\mathcal X=\{x_1,\ldots,x_{20}\}\subset\C^4\setminus\{0\}\) represents
twenty distinct projective directions with:
\begin{enumerate}
\item \(\rank L(P_x)<4\) for every \(x\in\mathcal X\), and every nonzero
      homogeneous quadratic in \(\C[x_0,x_1,x_2,x_3]\) vanishes on at
      most nine members of \(\mathcal X\);
\item \(L(P_y)\) is positive definite for some \(y\in\C^4\).
\end{enumerate}
Then there are explicitly constructed PPT maps
\(\Phi_1,\Phi_2:\Mat{10}\to\Mat{10}\) with
\(Z=J(\Phi_2\circ\Phi_1)\ne0\) and
\(\ran Z\cap\{u\otimes v\}=\{0\}\). In particular \(\Phi_2\circ\Phi_1\)
is not entanglement breaking.
\end{proposition}

Section~\ref{sec:certificate} constructs the input \(L\). The proof below
is the mechanism of the tensor criterion.

\begin{proof}
\emph{Symmetric and exterior tensors.}
Index an orthonormal basis of \(\C^{10}\) by pairs \(i\le j<4\), and of
\(\C^6\) by \(i<j<4\). Define
\begin{align}
U e_{ii}&=e_i\otimes e_i,&
U e_{ij}&=\frac{e_i\otimes e_j+e_j\otimes e_i}{\sqrt2}\quad(i<j),
\notag\\
V e_{ij}&=\frac{e_i\otimes e_j-e_j\otimes e_i}{\sqrt2}\quad(i<j).
\label{eq:UV}
\end{align}
Their ranges are the symmetric and antisymmetric tensor subspaces. Put
\begin{equation}
\hat x=U^*(x\otimes x)
=\sum_i x_i^2\;e_{ii}+\sqrt2\sum_{i<j}x_ix_j\;e_{ij}.
\label{eq:veronese}
\end{equation}
Then \(U\hat x=x\otimes x\) and \(UP_{\hat x}U^*=P_x\otimes P_x\).
The coordinates of \(\hat x\) are the ten quadratic monomials of \(x\).
A nonzero \(u\in\C^{10}\) with \(u^*\hat x=0\) at ten distinct points is
a nonzero homogeneous quadratic vanishing there, which the hypothesis
forbids. So any ten \(\hat x\)'s are independent; equivalently the ten
\(\hat x\)'s span \(\C^{10}\) for any ten of the \(x\in\mathcal X\).

Identify \(\C^6=\bigwedge^2\C^4\) with \(e_{ij}=e_i\wedge e_j\) and this
basis orthonormal. Then \(V(a\wedge b)=(a\otimes b-b\otimes a)/\sqrt2\).
For \(i<j\) let \(k<l\) be complements and \(\epsilon_{ijkl}\) be the
sign of the ordering \((i,j,k,l)\) of \((0,1,2,3)\). Define the real
signed permutation \(K\) of \(\C^6\) by \(K e_{ij}=\epsilon_{ijkl}e_{kl}\);
explicitly
\[
(Ke_{01},Ke_{02},Ke_{03},Ke_{12},Ke_{13},Ke_{23})
=(e_{23},-e_{13},e_{12},e_{03},-e_{02},e_{01}),
\]
so \(K=K^*=K^{-1}\). The conjugation \(w\mapsto K\overline w\) is the
complementary-pair exterior dual used by Schliemann, Loss, and
MacDonald~\cite{SchliemannLossMacDonald2001}.

Define \(S,R:\Mat{10}\to\Mat 6\) by
\begin{equation}
S(A)=V^*(L\otimes L)(UAU^*)V,\qquad
R(A)=K\,S(A)^\T\,K^*. \label{eq:SR}
\end{equation}
Embeddings and compressions are CP; \(L\) PPT gives \(L\otimes L\) PPT;
Lemma~\ref{lem:ppt-stability} makes \(S\) PPT. Input-transpose CP of
\(S\) plus simultaneous transpose gives \(T_6\circ S\) PPT, so \(R\)
is PPT.

\emph{The composite Choi matrix.}
The rectangular maps give an endomorphism
\(R^\dagger\circ S\circ T_{10}\) of \(\Mat{10}\). To express it as a
composition of two endomorphisms, let \(E:\C^6\to\C^{10}\) be the real
coordinate inclusion into the first six positions and define
\begin{equation}
\Phi_1(A)=E\,S(A^\T)\,E^*,\qquad
\Phi_2(B)=R^\dagger(E^* B E). \label{eq:phi-pair}
\end{equation}
The stability lemma gives \(\Phi_1,\Phi_2\) PPT. Since \(E^*E=I_6\),
\(\Phi_2\circ\Phi_1=R^\dagger\circ S\circ T_{10}\) with Choi matrix
\(Z=J(\Phi_2\circ\Phi_1)\ge0\).

\emph{Singular outputs and kernel products.}
The Choi pairing gives, for arbitrary \(a,b\) of compatible sizes,
\(\tr[(a\otimes b)J(F)]=\tr[bF(a^\T)]\). For Hermitian
\(a,b\in\Mat{10}\),
\begin{equation}
\tr[(a\otimes b)Z]=\tr[bR^\dagger(S(a))]=\tr[R(b)S(a)].
\label{eq:choi-pairing}
\end{equation}
For a Hermitian \(B\) on \(\C^4\),
\(V^*(B\otimes B)V=\bigwedge^2B\). If \(B_x=L(P_x)\succeq0\) and
\(W_x=\ran B_x\), then
\(S(P_{\hat x})=\bigwedge^2 B_x\) with range
\(\bigwedge^2 W_x\). Transposition conjugates a range, so
\(\ran R(P_{\hat x})=K\overline{\bigwedge^2 W_x}\).

For exterior two-vectors \(w,u\), with Hermitian inner product
conjugate-linear in the first argument, the definition of \(K\) gives
\begin{equation}
\langle K\overline w,u\rangle
=[w\wedge u]_{0123}, \label{eq:wedge-pairing}
\end{equation}
the coefficient of \(e_0\wedge e_1\wedge e_2\wedge e_3\). If
\(w,u\in\bigwedge^2 W\) and \(\dim W<4\), then this wedge vanishes; so
\(S(P_{\hat x})\) and \(R(P_{\hat x})\) have orthogonal ranges for every
\(x\in\mathcal X\) (including \(\dim W_x<2\), when both are zero).
Hence
\[
(\hat x\otimes\hat x)^*Z(\hat x\otimes\hat x)
=\tr[R(P_{\hat x})S(P_{\hat x})]=0
\]
for \(x\in\mathcal X\). Positive \(Z\) with \(v^*Zv=0\) implies
\(Zv=0\), so
\begin{equation}\label{eq:kernel-vectors}
\hat x\otimes\hat x\in\ker Z\qquad(x\in\mathcal X).
\end{equation}

For the second hypothesis' input \(y\), \(S(P_{\hat y})=\bigwedge^2L(P_y)\)
is positive definite, as is \(R(P_{\hat y})=KS(P_{\hat y})^\T K^*\), so
\(\tr[R(P_{\hat y})S(P_{\hat y})]>0\), giving \(Z\ne0\) by
\eqref{eq:choi-pairing}.

\emph{Excluding product vectors from the range.}
Suppose \(u\otimes v\in\ran Z\) is nonzero. Since \(Z\) is Hermitian,
\(\ran Z\perp\ker Z\), so \eqref{eq:kernel-vectors} gives
\(p_u(x)p_v(x)=0\) at every \(x\in\mathcal X\), where
\(p_u(x)=u^*\hat x\), \(p_v(x)=v^*\hat x\). Each is a homogeneous
quadratic in \(x\); nonzero \(u,v\) mean nonzero \(p_u,p_v\). Each
vanishes on at most nine of \(\mathcal X\). Two zero sets cover at most
\(9+9<20\) points, contradiction. So no nonzero product vector is in
\(\ran Z\). By Lemma~\ref{lem:product-range} \(Z\) is nonseparable;
Lemma~\ref{lem:choi-separable} gives \(Z\) not EB.
\end{proof}

\section{An integer pencil and its exact certificate}
\label{sec:certificate}

We now supply \(L:\Mat 4\to\Mat 4\) satisfying Proposition~%
\ref{prop:tensor-criterion}. Everything is explicit and integer.
The twenty singular directions \([x]\) of a \(6\times 4\) integer pencil
\(M(x)=x_0M_0+x_1M_1+x_2M_2+x_3M_3\) are certified by exact modular
arithmetic at three primes. The ranks and the quadratic-evaluation bound
are obtained by a single algebraic computation (the algebra generated by
the maximal minors of the pencil) whose quotient is proved to be a
degree-twenty field with Galois group \(S_{20}\).

\subsection{The pencil and \(L\)}

Use indices \(0,1,2,3\) and define real \(6\times 4\) matrices
\begin{equation}
\begin{aligned}
M_0&=\begin{pmatrix}
6&0&0&0\\0&6&0&0\\0&0&6&0\\0&0&0&6\\0&0&0&0\\0&0&0&0
\end{pmatrix},&
M_1&=\begin{pmatrix}
-12&0&0&0\\0&-6&0&0\\0&0&6&0\\0&0&0&12\\-6&0&6&6\\-6&-6&6&0
\end{pmatrix},\\[2mm]
M_2&=\begin{pmatrix}
0&6&-2&0\\6&6&0&2\\-2&0&10&0\\0&2&0&24\\0&0&0&6\\0&-6&6&-6
\end{pmatrix},&
M_3&=\begin{pmatrix}
0&0&-4&-3\\0&-2&-3&-4\\-4&-3&11&6\\-3&-4&6&25\\6&6&0&0\\0&-6&6&6
\end{pmatrix}.
\end{aligned}
\label{eq:explicit-matrices}
\end{equation}
For \(x\in\C^4\), \(M(x)=\sum_i x_iM_i\); then \(L\) is defined on
matrix units by
\begin{equation}
L(E_{ij})=M_i^{\T}M_j\qquad(0\le i,j<4).
\label{eq:L}
\end{equation}

\begin{lemma}[The pencil is PPT]
\label{lem:pencil-ppt}
\(L\) is PPT. For every \(x\in\C^4\),
\begin{equation}
L(P_x)=M(x)^{\T}\overline{M(x)}=M(x)^*M(x),\qquad
\rank L(P_x)=\rank M(x).
\label{eq:gram-identity}
\end{equation}
Moreover \(L(P_{e_0})=36I_4\).
\end{lemma}

\begin{proof}
Direct integer multiplication gives
\(M_i^{\T}M_j=M_j^{\T}M_i\) for all \(i,j\)
(block symmetry). For each row \(r\), let \(Q_r\) be the \(4\times4\)
matrix with \(i\)-th column equal to row \(r\) of \(M_i^{\T}\); then
\(L(A)=\sum_{r=1}^6 Q_rAQ_r^*\), so \(L\) is CP. Block symmetry also
makes every \(M_i^{\T}M_j\) symmetric, so \(T_4\circ L=L\), giving PPT.

For complex \(x\):
\(L(P_x)=\sum_{i,j}x_i\overline{x_j}M_i^{\T}M_j
=M(x)^{\T}\overline{M(x)}\), and interchanging \(i,j\) with block
symmetry gives \(M(x)^*M(x)\). Since
\(v^*M(x)^*M(x)v=\norm{M(x)v}^2\), \(\ker L(P_x)=\ker M(x)\), giving
the rank identity. Finally \(M_0^{\T}M_0=36I_4\).
\end{proof}

\begin{proposition}[Twenty directions]
\label{prop:twenty-directions}
The projective directions \([x]\in\mathbb P^3(\C)\) with
\(\rank M(x)<4\) consist of exactly twenty distinct points, each with
unique representative \(x=(1,t_1,t_2,t_3)\). Every nonzero homogeneous
quadratic in \(\C[x_0,x_1,x_2,x_3]\) vanishes on at most nine of them.
\end{proposition}

The equation \(M(x)y=0\) with \(x,y\ne0\) relates to bilinear kernel
geometry of \(4\times4\) PPT states whose matrix and partial transpose
both have rank six~\cite[Sect.~2.2,7]{HansenEtAl2012}. The twenty
\emph{product rays} \(x\otimes y\) there are different from the twenty
\(x\otimes x\) here; the specific pencil matters.

\begin{proof}[Proof of Proposition~\ref{prop:twenty-directions}]
The maximal \(4\times4\) minors of \(M(x)\) vanish exactly on
\(\rank M(x)<4\). We chain three pieces:
\begin{enumerate}
\item[A] The maximal-minor ideal defines a nonzero affine quotient
spanned by the twenty monomials of degree \(\le3\), so the direction set
is contained in the affine chart \(x_0=1\). (Lemma~%
\ref{lem:six-bilinear} supplies a nonzero simultaneous vanishing point of
the six rows of \(M(x)y\) for some \(x\ne0,y\ne0\).)
\item[B] A \(20\times20\) multiplication operator \(N\) on that span
encodes the quotient. Its characteristic polynomial \(f(z)=\det(zI_{20}-N)\)
is monic with coefficients in \(\Z_{(p)}\) for each of the primes
\(p=41,131,139\). Exact modular computation gives: \(\det H\equiv40\) mod \(41\),
\(23\) mod \(131\), \(9\) mod \(139\); \(f\) irreducible mod 41 (so
over \(\Q\)); factor degrees \(1,2,17\) mod 131; \(1,19\) mod 139. The
local Frobenius lemma then gives Galois elements of cycle types
\((1,2,17)\) and \((1,19)\). Irreducibility makes the Galois group
transitive; a transposition (seventeenth power of \((1,2,17)\)) plus
transitivity on ordered pairs gives \(S_{20}\).
\item[C] With \(S_{20}\) acting, the evaluation matrix
\(\mathcal E_{j,\alpha}=(t^{(j)})^\alpha\) for \(|\alpha|\le2\) has
rank ten over \(\C\). Any nonzero quadratic's dehomogenization
\(q(1,t)\) is nonzero exactly when \(q\) is nonzero; if it vanished on
ten of the twenty triples, the rank-ten evaluation matrix would force
\(q=0\). So no nonzero quadratic vanishes on ten of the twenty.
\end{enumerate}
\end{proof}

\subsection{Six-bilinear, monic-reduction, local-Frobenius}

The three algebraic facts plugged into the proof above are stated here.

\begin{lemma}[Six bilinear equations]
\label{lem:six-bilinear}
Any six complex bilinear forms on \(\C^4\times\C^4\) have a common zero
\((x,y)\) with \(x\ne0\), \(y\ne0\).
\end{lemma}

\begin{proof}
Let \(u_{ij}\) denote \(X_iY_j\) in the polynomial ring
\(\mathcal R=\C[u_{ij}]\cong\C[X_iY_j]\subset\C[X,Y]\) (a Noetherian
domain). Its closed points are exactly rank \(\le1\) matrices with the
relations \(u_{ij}u_{k\ell}=u_{i\ell}u_{kj}\).
For \(P_{a,b}=(u_{ij}:i\ge a\text{ or }j\ge b)\), \(P_{a,b}\) is prime
and the chain
\(0=P_{4,4}\subset P_{3,4}\subset P_{2,4}\subset P_{1,4}
\subset P_{1,3}\subset P_{1,2}\subset P_{1,1}\subset\mathfrak m\)
is strict, so \(\operatorname{ht}\mathfrak m\ge7\).
Let \(\ell_1,\ldots,\ell_6\) be the six forms and
\(\mathfrak a=(\ell_1,\ldots,\ell_6)\). If the only common zero on
rank-one matrices were zero, the Nullstellensatz would give
\(\sqrt{\mathfrak a}=\mathfrak m\), making \(\mathfrak m\) minimal over
a six-generator ideal. Krull's height theorem would give
\(\operatorname{ht}\mathfrak m\le6\), contradiction. So some nonzero
rank-one \(xy^{\T}\) annihilates all six forms.
\end{proof}

\begin{lemma}[Monic local reduction]
\label{lem:monic-local-reduction}
Let \(p\) be prime and \((L,R_p)\) be one of \((\Q,\Z_{(p)})\) or
\((\Q_p,\Z_p)\). If a monic \(P\in R_p[z]\) factors as \(P=gh\) with
monic \(g,h\in L[z]\), then \(g,h\in R_p[z]\), their reductions mod \(p\)
retain degree. Consequently, if \(P\) has positive degree and irreducible
reduction in \(\F_p[z]\), then \(P\) is irreducible over \(L\).
\end{lemma}

\begin{proof}
Normalize \(v_p(p)=1\). For \(a=\sum_i a_iz^i\ne0\), set
\(\nu(a)=\min_{a_i\ne0}v_p(a_i)\). Scaling by \(p^{-\nu}\) makes
coefficients integral with least valuation zero; reductions are nonzero
and multiply in the domain \(\F_p[z]\), so
\(\nu(ab)=\nu(a)+\nu(b)\). Monic \(g,h\) have \(\nu\le0\); monic
\(P\in R_p[z]\) has \(\nu(P)=0\). Additivity forces
\(\nu(g)=\nu(h)=0\), so both have integral coefficients. Their leading
coefficients remain one, so degrees are preserved; a monic constant is
\(1\) and has degree zero. A nontrivial factorization over \(L\) would
factor \(P\) over \(\F_p[z]\) nontrivially, contradiction.
\end{proof}

\begin{lemma}[Locally integral Frobenius]
\label{lem:local-frobenius}
Let \(F\in\Q[z]\) be monic, separable, of positive degree, with
coefficients in \(\Z_{(p)}\). If its reduction modulo \(p\) is
squarefree with irreducible factor degrees \(s_1,\ldots,s_h\), then the
Galois group of its rational splitting field contains an element of
cycle type \((s_1,\ldots,s_h)\).
\end{lemma}

\begin{proof}
Embed coefficients in \(\Z_p\), put \(s=\operatorname{lcm}(s_1,\ldots,s_h)\)
and choose a monic irreducible \(\overline g\in\F_p[X]\) of degree \(s\).
Lift to monic \(g\in\Z_p[X]\); Lemma~\ref{lem:monic-local-reduction}
gives \(g\) irreducible over \(\Q_p\). Let
\(\mathcal O=\Z_p[\alpha]\cong\Z_p[X]/(g)\) where \(\alpha\) is a root;
\(\mathcal O\) is a free rank-\(s\) \(\Z_p\)-module with
\(\mathcal O/p\mathcal O\simeq\F_{p^s}\), and every element with nonzero
residue is a unit.
Hensel-style lifting: every simple residue root of a \(\Z_p[z]\)
polynomial lifts uniquely to a root in \(\mathcal O\).
Since \(\overline F\) is squarefree with roots in \(\F_{p^s}\), we get
\(\deg F\) distinct roots in \(\mathcal O\). Finite fields are perfect,
so \(\overline\alpha^p\) is a simple root of \(\overline g\) and lifts to
some \(\beta\in\mathcal O\). Sending \(\alpha\mapsto\beta\) gives a
\(\Q_p\)-embedding \(E\to E\) with \(E=\Q_p(\alpha)\); call it \(\sigma\).
Finiteness makes it an automorphism, and \(\sigma(\mathcal O)=\mathcal O\)
because the residue action is a permutation. If \(\rho_r\) is the lifted
root of \(F\) with residue \(r\), uniqueness gives
\(\sigma(\rho_r)=\rho_{r^p}\). So \(\sigma\)'s permutation of lifted
roots has cycle lengths \(s_1,\ldots,s_h\), exactly the Frobenius cycle
lengths on their residues. The rational splitting subfield is preserved,
giving the required rational Galois element.
\end{proof}

\subsection{The multiplication operator and \(f(z)\)}

Let \(\mathcal A=\Q[t_1,t_2,t_3]/I\), \(I\) generated by the fifteen
maximal minors \(p_\rho(t)=\Delta_\rho(1,t)\). Monomial order:
first by total degree, then lexicographically. Let \(v\) be the twenty
monomials of degree \(\le3\), \(w\) the fifteen of degree four, with
coefficients \(D\in\Z^{15\times20}\), \(H\in\Z^{15\times15}\):
\((p_\rho(t))_\rho=Dv(t)+Hw(t)\).

Exact coefficients yield \(\det H\equiv40\not\equiv0\pmod{41}\), so
\(H\) is invertible. Define \(C=-H^{-1}D\); in \(\mathcal A\), \(w=Cv\)
expresses degree-four monomials as combinations of degree \(\le3\)
monomials. Multiplication by \(t_1\) is the formal \(20\times20\) matrix
\(N\) on the spanned \(v\):
\[
Ne_\alpha=e_{\alpha+(1,0,0)}\ (\text{for }|\alpha|\le2),\quad
Ne_\alpha=\textstyle\sum_{|\beta|\le3}C_{\alpha+(1,0,0),\beta}e_\beta
\ (\text{for }|\alpha|=3).
\]
Put \(f(z)=\det(zI_{20}-N)\). Then \(f\) has coefficients in
\(\Z_{(p)}\) for \(p=41,131,139\); Newton's identities compute the
twenty-one characteristic coefficients and the modular gcd degrees
\(d_p(k)=\deg\gcd(\overline f,z^{p^k}-z)\) without leaving those rings.

Exact modular data (see Section~\ref{app:arithmetic} for recorded values):
\begin{center}
\begin{tabular}{ccll}
\toprule
\(p\) & \(\det H\bmod p\) & computed gcd degrees & deduced factor degrees\\
\midrule
41 & 40 & \(0\) for \(1\le k<20\), \(20\) at \(k=20\) & \(20\)\\
131 & 23 & \(1,3,18\) at \(k=1,2,17\) & \(1,2,17\)\\
139 & 9 & \(1,20\) at \(k=1,19\) & \(1,19\)\\
\bottomrule
\end{tabular}
\end{center}
Since \(p>20\), divisions in Newton's identities are valid.
Irreducibility mod 41 + Lemma~\ref{lem:monic-local-reduction} gives
\(f\) irreducible over \(\Q\). Applying Lemma~%
\ref{lem:local-frobenius} at \(p=131,139\) gives Galois elements of
cycle types \((1,2,17)\) and \((1,19)\). Irreducibility gives
transitivity; a transposition from the 17th power of \((1,2,17)\) plus
2-transitivity (from the 19-cycle with stabilizer transitive on the other
19) gives every transposition, hence \(S_{20}\).

\subsection{The affine quotient is a field}

The \(w=Cv\) relations force \(\mathcal A\) to be spanned by the twenty
low monomials. Independence follows from \(f\) irreducible: if
\(\pi:\Q^{20}\to\mathcal A\) with \(e_\alpha\mapsto t^\alpha\), then
\(\pi N=\mu_1\pi\) where \(\mu_1\) is multiplication by \(t_1\).
Irreducibility makes \(N\) have no proper invariant subspace, so
\(\ker\pi=0\). The twenty low monomials are a \(\Q\)-basis of
\(\mathcal A\), and \(N\) is multiplication by \(t_1\). Since the minimal
polynomial of \(N\) equals \(f\), the subalgebra generated by \(t_1\) is
already all of \(\mathcal A\):
\begin{equation}
\mathcal A\simeq\Q[z]/(f),\qquad z\mapsto t_1. \label{eq:coordinate-field}
\end{equation}
In particular \(\mathcal A\) is a field, and there are
\(h_2,h_3\in\Q[z]\) of degree below twenty with \(t_2=h_2(t_1)\),
\(t_3=h_3(t_1)\).

Separability (char 0) gives twenty distinct complex roots
\(\lambda_1,\ldots,\lambda_{20}\). Extending scalars:
\begin{equation}
\C[t_1,t_2,t_3]/I\C[t_1,t_2,t_3]\simeq\C[z]/(f)
\simeq\prod_{j=1}^{20}\C, \label{eq:split-algebra}
\end{equation}
by CRT. The common zeros are exactly
\(t^{(j)}=(\lambda_j,h_2(\lambda_j),h_3(\lambda_j))\), all distinct and
reduced.

\subsection{Quadratic evaluations via Galois}

Let \(\mathbb K\subset\C\) be a splitting field of \(f\),
\(G=\operatorname{Gal}(\mathbb K/\Q)\). The evaluation matrix
\(\mathcal E_{j,\alpha}=(t^{(j)})^\alpha\) for
\(1\le j\le20\), \(|\alpha|\le2\) has column rank ten over
\(\mathbb K\). Under the \(S_{20}\) action, \(\sigma\in G\) permutes
triples and preserves all \(h_2,h_3\) rational structure; so
\(\sigma\mathcal E_{j,\alpha}=\mathcal E_{\sigma(j),\alpha}\).
\(S_{20}\) transitive on ten-element subsets transports the nonzero
determinant of one \(10\times10\) submatrix to every \(10\times10\)
submatrix. Hence \(\mathcal E\) has column rank ten over \(\mathbb K\)
and over \(\C\).

A nonzero homogeneous quadratic \(q\) dehomogenizes to a nonzero
\(q(1,t)\); if it vanished at ten triples, the invertible evaluation
matrix would force \(q=0\). So \(q\) vanishes on at most nine.

\subsection*{Putting it together}

Combine Lemmas~\ref{lem:pencil-ppt} and~%
\ref{prop:twenty-directions}: Proposition~\ref{prop:tensor-criterion}
applies with \(m=10\), giving the \(20\)-direction pair
\(\Phi_1,\Phi_2\). The composed Choi matrix
\(Z=J(\Phi_2\circ\Phi_1)\ne0\) has no nonzero product in its range, so
\(\Phi_2\circ\Phi_1\) is not EB. The state \(\rho=Z/\tr Z\) is
entangled. This proves Theorems~\ref{thm:main-pair}
and~\ref{thm:main-state}. The exact-arithmetic realisation is in
Section~\ref{app:arithmetic}.

\section{Applications: state, pair, and channel}
\label{sec:applications}

We now connect the dimension-ten pair to the operational theorem, and
produce the trace-preserving channel on \(\Mat{21}\).

\begin{proof}[Proof of Theorem~\ref{thm:main-state}]
Let \(\Phi_1,\Phi_2\) be from \eqref{eq:phi-pair},
\(Z=J(\Phi_2\circ\Phi_1)\). Theorem~\ref{thm:main-pair} gives \(Z\ne0\),
\(\ran Z\) product-free, \(Z\ge0\). So \(\lambda=\tr Z>0\) and
\(\rho=Z/\lambda\) has the same range, hence is entangled
(Lemma~\ref{lem:product-range}). Both \(\Phi_1,\Phi_2\) are PPT.
Lemma~\ref{lem:choi-transfer} with \(a=b=c=10\) gives
\[
\rho=(\Phi_1^\sharp\otimes\Phi_2)
\left(\frac{\Omega_{10}\Omega_{10}^*}{\lambda}\right)
\in\mathscr C.
\]
Theorem~\ref{thm:zero-key} and Proposition~%
\ref{prop:operational-extensions} give \eqref{eq:main-gap} and
\(K_D(\rho)=0\). All matrices defining \(\rho\) are explicit by
\eqref{eq:explicit-matrices} and \eqref{eq:phi-pair}.
\end{proof}

\subsection{Trace-preserving PPT channel on \(\Mat{21}\)}

We want \(\Theta:\Mat{21}\to\Mat{21}\) a trace-preserving PPT channel
whose square is not EB. The pair \((\Phi_1,\Phi_2)\) need not be trace
preserving. The next proposition switches two coordinating blocks and
uses an absorbing flag, following Christandl--M\"uller-Hermes--Wolf~%
\cite[Sec.~IV.A]{CMHW2019} and Filippov~%
\cite[Prop.~3,~Eq.~(15)]{Filippov2021}.

\begin{proposition}[Channel completion]
\label{prop:channel-completion}
Let \(\Psi_1,\Psi_2:\Mat m\to\Mat m\) be PPT maps. There are explicit
\(c_1,c_2>0\), a trace-preserving PPT channel
\(\Theta:\Mat{2m+1}\to\Mat{2m+1}\), and a real coordinate isometry
\(W_0:\C^m\to\C^{2m+1}\) such that
\begin{equation}
(W_0^*\otimes W_0^*)J(\Theta\circ\Theta)(W_0\otimes W_0)
=c_1c_2J(\Psi_2\circ\Psi_1). \label{eq:choi-corner}
\end{equation}
If \(J(\Psi_2\circ\Psi_1)\) is nonseparable, \(\Theta\circ\Theta\) is
not EB.
\end{proposition}

\begin{proof}
Set
\(A_i=\Psi_i^\dagger(I_m)\), \(c_i=1/(1+\tr A_i)\),
\(F_i=I_m-c_iA_i\). Adjoints of CP maps are CP, so \(A_i\succeq0\).
Since \(A_i\preceq(\tr A_i)I_m\), we get
\(F_i\succeq(1-c_i\tr A_i)I_m=c_iI_m>0\). The adjoint identity gives
\(\tr\Psi_i(B)=\tr(A_iB)\), whose complement wrt \(c_i\) is
\(\tr(F_iB)\).

Decompose \(\C^{2m+1}=\C^m_0\oplus\C^m_1\oplus\C e_\star\); \(W_0,W_1\)
are the two coordinate inclusions. For \(X\in\Mat{2m+1}\) write
\(X_{jj}=W_j^*XW_j\), \(x_\star=e_\star^*Xe_\star\),
\(P_\star=e_\star e_\star^*\). Set
\begin{align}\label{eq:channel}
\Theta(X)&=c_2W_0\Psi_2(X_{11})W_0^*
+c_1W_1\Psi_1(X_{00})W_1^*\notag\\
&+\bigl(\tr(F_1X_{00})+\tr(F_2X_{11})+x_\star\bigr)P_\star.
\end{align}
The moving branches are CP compositions; the flag branches use
\(F_i=\sum_r\lambda_{ir}v_{ir}v_{ir}^*\) and
\(K_{ir}=\sqrt{\lambda_{ir}}e_\star v_{ir}^*W_{i-1}^*\), whose
\(\sum_r K_{ir}XK_{ir}^*=\tr(F_iX_{i-1,i-1})P_\star\) is CP.
Trace preservation: \(c_iA_i+F_i=I_m\) gives
\(\tr\Theta(X)=\tr X_{00}+\tr X_{11}+x_\star=\tr X\).

PPT: because \(W_0,W_1,e_\star\) are real, output transposition sends
\(\Psi_i\) to \(T_m\circ\Psi_i\) in the moving branches and fixes the
flag. The effects \(F_i\) may be complex; coordinate transpose does not
conjugate the scalar multiplying \(P_\star\). Each transposed moving
branch is CP by hypothesis, and the flag is CP; so
\(T_{2m+1}\circ\Theta\) is CP.

Flag absorbing: \(\Theta(P_\star)=P_\star\). Applying \eqref{eq:channel}
twice to \(W_0BW_0^*\), for \(B\in\Mat m\),
\[
\Theta^2(W_0BW_0^*)
=c_1c_2W_0\Psi_2(\Psi_1(B))W_0^*
+\bigl(\tr(F_1B)+c_1\tr(F_2\Psi_1(B))\bigr)P_\star.
\]
Compression:
\(W_0^*\Theta^2(W_0BW_0^*)W_0=c_1c_2\Psi_2(\Psi_1(B))\). Coordinate
matrix units give \eqref{eq:choi-corner}. If the compressed positive
multiple were separable, then because compression takes
\(A\otimes B\mapsto(W_0^*AW_0)\otimes(W_0^*BW_0)\) on products,
\(J(\Psi_2\circ\Psi_1)\) would be separable. Contradiction if it is not.
\end{proof}

\begin{proof}[Proof of Theorem~\ref{thm:main-channel}]
Apply Proposition~\ref{prop:channel-completion} with \(m=10\),
\(\Psi_i=\Phi_i\). The composed Choi matrix \(J(\Phi_2\circ\Phi_1)\) is
nonseparable (Theorem~\ref{thm:main-pair}). Formula \eqref{eq:channel}
produces a trace-preserving PPT channel on \(\Mat{21}\); its square's
Choi matrix has the nonseparable corner \eqref{eq:choi-corner}, hence is
not EB.
\end{proof}

For the exact positive evaluation used in Theorem~\ref{thm:main-pair},
Theorem~\ref{thm:main-pair}'s argument shows
\[
S(P_{e_{00}})=R(P_{e_{00}})=36^2I_6,\quad
(e_{00}\otimes e_{00})^*Z(e_{00}\otimes e_{00})
=6\cdot36^4=10{,}077{,}696>0.
\]

\section{An alternative construction from projection overlaps}
\label{sec:projection}

The dimension-ten construction is done. This section builds another
entangled member of \(\mathscr C\), in much larger dimension, by a
different mechanism. Real unit vectors and projective measurements
produce a large sum of correlations. Zero trace overlaps among the
projections restrict the supports of product vectors in any hypothetical
separable decomposition. These two constraints force a contradiction.

Two preliminaries. First, for self-adjoint projections \(E,F\),
\begin{equation}\label{eq:projection-overlap}
\tr(EF)=\tr(FEF)=\tr((EF)^*EF)\ge0.
\end{equation}
So \(\tr(EF)=0\) iff \(EF=0\). No commutation required.

Second, each block of a Choi matrix can be tested by pairing against
matrix units. This will be the identity we test against in Section~%
\ref{sec:projection}'s proof.

\begin{proposition}[Rectangular projection criterion]
\label{prop:projection-criterion}
Let \(Q,K,D\) be positive integers, \(\mathcal Q\) a set of size \(Q\).
Take unit vectors \(u_q\in\mathbb R^K\) for \(q\in\mathcal Q\), with
\(c_{qr}=u_q^{\T}u_r\). For each \(q\), \(\{P_i:i\in\mathcal I_q\}\) is
a finite projective measurement on \(\C^D\); zero projections allowed.
Take the \(\mathcal I_q\) disjoint, \(\mathcal I=\bigsqcup_q\mathcal I_q\),
\(n=|\mathcal I|\). Suppose:
\begin{enumerate}
\item \(P_iP_j=P_jP_i\) whenever \(c_{qr}\ne0\);
\item there is a real \(\kappa<Q/K\) such that every
      \(J\subseteq\mathcal I\) with \(\tr(P_iP_j)>0\) for all distinct
      \(i,j\in J\) has \(|J|\le\kappa\).
\end{enumerate}
Define \(\Psi:\Mat n\to\Mat D\) on matrix units by
\begin{equation}\label{eq:projection-map}
H_{ij}=c_{qr}P_iP_j,\quad \Psi(E_{ij})=H_{ij}
\quad(i\in\mathcal I_q,\ j\in\mathcal I_r).
\end{equation}
Then \(\Psi,\Psi^\dagger\) are PPT, and
\begin{equation}\label{eq:projection-composite}
C:=J(\Psi^\dagger\circ\Psi)\text{ is nonseparable over }\C^n\otimes\C^n,
\qquad \tr C=Q^2D.
\end{equation}
\end{proposition}

\begin{proof}[Strategy]
The block matrix \(H=J(\Psi)\succeq0\) since it is a sum of rank-one
Psd block columns \(u_q\otimes P_iw_i\). Block symmetry plus reality
gives PPT. Then compress \(C\) to the diagonal tensor subspace; a
vector-Gram bound gives \(\mathbf1^*B\mathbf1\ge(D/K)\tr B\). A separable
decomposition would give the reverse bound \(\le\kappa\tr B\), and
\(\kappa<Q/K\) closes the contradiction.
\end{proof}

\begin{proof}
Regard \(u_q\) as a vector in \(\C^K\). For \(w_i\in\C^D\),
\begin{equation}\label{eq:projection-block-gram}
\sum_{i,j}\langle w_i,H_{ij}w_j\rangle
=\norm{\sum_{q}\sum_{i\in\mathcal I_q}u_q\otimes P_iw_i}^2\ge0.
\end{equation}
So \(H\succeq0\); Lemma~\ref{lem:choi-separable} gives \(\Psi\) CP.

Block symmetry: since \(c_{qr}=c_{rq}\) is real and hypothesis 1 makes
\(P_i,P_j\) commute when \(c_{qr}\ne0\), \(H_{ij}=H_{ji}=H_{ij}^*\).
The two partial transposes:
\begin{equation}\label{eq:projection-partial-transposes}
H^{\Gamma_1}=H,\qquad H^{\Gamma_2}=H^{\T}\succeq0,
\end{equation}
where \(H^{\T}\succeq0\) because \(H=R^*R\Rightarrow H^{\T}=(\bar R)^*\bar R\).
Lemma~\ref{lem:choi-separable} then gives \(T_D\circ\Psi\) CP; so
\(\Psi\) is PPT.

Also \(\Psi^\dagger\) is PPT and CP (Lemma~\ref{lem:ppt-stability}).
Explicit form:
\begin{equation}\label{eq:projection-adjoint}
[\Psi^\dagger(A)]_{ij}=\tr(H_{ij}^*A);
\end{equation}
block symmetry gives \(T_n\circ\Psi^\dagger=\Psi^\dagger\).

\paragraph{Compression to diagonal.}
\(C=\Psi^\dagger\circ\Psi\succeq0\). Its fully indexed entries:
\begin{equation}\label{eq:projection-composite-entries}
C_{(i,a),(j,b)}=\tr(H_{ab}^*H_{ij}).
\end{equation}
Since \(c_{qq}=1\), \(P_i^2=P_i\), we get \(H_{ii}=P_i\). The diagonal
entries and the compression \(B\) to
\(\mathrm{span}\{e_i\otimes e_i\}\) compute as
\begin{align}
C_{(i,j),(i,j)}&=\tr(P_iP_j),\label{eq:projection-crossed-diagonal}\\
B_{ij}:=C_{(i,i),(j,j)}&=c_{qr}^2\tr(P_iP_j).\label{eq:projection-compression}
\end{align}
Completeness of each measurement gives
\(\sum_{i\in\mathcal I_q}\sum_{j\in\mathcal I_r}\tr(P_iP_j)=D\). Summing
over \(q,r\): \(\tr C=Q^2D\). Also \(\tr B=QD\), and
\begin{equation}\label{eq:projection-gram-bound}
\mathbf1^*B\mathbf1=D\sum_{q,r}c_{qr}^2\ge\frac{D Q^2}{K}.
\end{equation}
Indeed \(M=\sum_q u_qu_q^{\T}\) has \(\tr M=Q\) and
\(\tr(M^2)=\sum_{q,r}c_{qr}^2\); Cauchy--Schwarz on its \(K\) eigenvalues
gives \(\tr M^2\ge Q^2/K\).

\paragraph{Separability bound.}
Suppose \(C\) separable over \(\C^n\otimes\C^n\). Spectral decomposition
of local factors yields \(C=\sum_\ell(x^{(\ell)}\otimes y^{(\ell)})(\cdots)^*\).
Whenever \(\tr(P_iP_j)=0\), the diagonal entry
\(0=C_{(i,j),(i,j)}=\sum_\ell|x_i^{(\ell)}y_j^{(\ell)}|^2\) forces each
term zero, so for one \(z_i=x_iy_i\), \(\supp z\) has no pair with
\(\tr(P_iP_j)=0\). Thus \(|\supp z|\le\kappa\).

Compressing to the diagonal subspace gives \(B=\sum_\ell z^{(\ell)}(z^{(\ell)})^*\).
Complex Cauchy--Schwarz on supports:
\begin{equation}
\mathbf1^*B\mathbf1=\sum_\ell|\sum_i z_i^{(\ell)}|^2
\le\kappa\sum_\ell\norm{z^{(\ell)}}^2=\kappa\tr B
<\frac QK\tr B=\frac{DQ^2}{K},
\label{eq:projection-separable-bound}
\end{equation}
contradicting \eqref{eq:projection-gram-bound}. Hence \(C\)
nonseparable.
\end{proof}

\begin{corollary}[Same local channel for real projections]
\label{cor:real-channel}
Under the hypotheses of Proposition~\ref{prop:projection-criterion},
suppose every \(P_i\) is real symmetric. Put \(\Lambda=\Psi^\dagger\).
Then
\begin{equation}\label{eq:projection-real-invariances}
\Lambda\circ T_D=\Lambda=T_n\circ\Lambda,
\qquad \tr\Lambda(A)=Q\,\tr A.
\end{equation}
So \(\Lambda/Q:\Mat D\to\Mat n\) is a trace-preserving PPT channel.
With \(\Phi_D=\Omega_D/\sqrt D\) the normalized maximally entangled
vector,
\begin{equation}\label{eq:projection-real-state}
\frac{C}{Q^2D}=
\left(\frac{\Lambda}{Q}\otimes\frac{\Lambda}{Q}\right)(\Phi_D\Phi_D^*)
\end{equation}
is an entangled density operator in \(\mathscr C\).
\end{corollary}

\begin{proof}
Reality + block symmetry gives \(H_{ij}^{\T}=H_{ij}\). Equation~%
\eqref{eq:projection-adjoint} gives both transpose invariances. Trace:
\(\tr\Lambda(A)=\sum_i\tr(H_{ii}A)=Q\tr A\). So \(\Lambda/Q\) is a
trace-preserving PPT channel. Lemma~\ref{lem:choi-transfer} with
\(\Psi,\Lambda\) gives \(\Psi^\sharp=T_n\circ\Lambda\circ T_D=\Lambda\)
by invariances, so
\(G:=(\Lambda\otimes\Lambda)(\Omega_D\Omega_D^*)=C\). Divide by
\(Q^2D\). Nonseparability and trace \(Q^2D\) give the claim.
\end{proof}

\begin{corollary}[Square embedding]
\label{cor:square-embedding}
Under Proposition~\ref{prop:projection-criterion}'s hypotheses with
\(n\ge D\), let \(U:\C^D\to\C^n\) be the real coordinate isometry onto
the first \(D\) coordinates. With
\begin{equation}\label{eq:projection-square-pair}
\Xi_1=\Ad_U\circ\Psi,\qquad
\Xi_2=\Psi^\dagger\circ\Ad_{U^*}=\Xi_1^\dagger,
\end{equation}
the maps \(\Xi_1,\Xi_2:\Mat n\to\Mat n\) are PPT and
\(\Xi_2\circ\Xi_1=\Psi^\dagger\circ\Psi\). Their composition is not EB.
\end{corollary}

\begin{proof}
Embedding and compression by \(U\) are CP; the composite is
\(\Psi^\dagger\circ\Psi\) with Choi \(C\) nonseparable. The pair inherits
PPT from \S\ref{sec:projection}'s invariances; the composite Choi matrix
is the nonseparable \(C\). Lemma~\ref{lem:choi-separable} gives non-EB.
\end{proof}

\section{A finite combinatorial realization}
\label{sec:combinatorial}

The projection criterion needs unit vectors and projective measurements
satisfying its two hypotheses. This section constructs them, using
three ingredients: a restricted-intersection bound on sign vectors that
forces orthogonal pairs in large sets; a fiber amplification that
upgrades to eight orthogonal in every large subset of triples; and a
tensor product of Mermin--Peres parity measurements that turns any
orthogonal eight-set into a forbidden positive-overlap choice.

\subsection{Vectors with forced orthogonality}

Set \(p=257\), \(k=4p=1028\), \([k]=\{1,\ldots,k\}\). Define
\begin{equation}\label{eq:combinatorial-base}
\mathcal U=\{A\subseteq[k]:|A|=2p,\ 1\in A\},\quad
b=|\mathcal U|=\binom{1027}{513}=\frac12\binom{4p}{2p},
\end{equation}
and \(s_A=k^{-1/2}(2\mathbf1_{\{h\in A\}}-1)_{h=1}^k\in\mathbb R^k\).
Each \(s_A\) is a unit vector; by counting agreeing entries,
\begin{equation}\label{eq:combinatorial-inner-product}
s_A^{\T}s_B=\frac{k-2|A\triangle B| }{k}
=\frac{|A\cap B|}{p}-1.
\end{equation}
So \(s_A\perp s_B\) iff \(|A\cap B|=p\).

Put \(a_0=\sum_{j=0}^{p-1}\binom{k}{j}=\sum_{j=0}^{256}\binom{1028}{j}\)
and \(\delta=a_0/b\). Frankl--R\"odl~\cite[Thm.~1.11]{FR1987} forces
orthogonal families in subsets, but here we get a precise bound by
elementary multilinear methods.

\begin{lemma}[Restricted intersections]
\label{lem:restricted-intersections}
If \(\mathcal F\subseteq\mathcal U\) has no two distinct sets with
orthogonal associated vectors, then \(|\mathcal F|\le a_0=\delta b\).
\end{lemma}

\begin{proof}
For distinct \(A,B\in\mathcal F\), common element \(1\) and equal sizes
give \(1\le|A\cap B|\le2p-1\); orthogonality is excluded, so
\(|A\cap B|\ne p\) and \(|A\cap B|\not\equiv0\pmod p\); also
\(|A\cap A|=2p\equiv0\pmod p\). Over \(\F_p\) define
\(f_A(x)=\prod_{h\in A}(1-x_h^{p-1})=1-(\sum_{h\in A}x_h)^{p-1}\)
in the identity \(a^{p-1}=1\) for \(a\in\F_p^\times\). On indicators:
\(f_A(\mathbf1_B)=\delta_{AB}\).
Replace every positive power \(x_h^{d}\to x_h\) for \(d>1\); evaluations
on Boolean vectors are unchanged and degrees drop to \(\le p-1\).
Independence follows by evaluating any linear relation at each
\(\mathbf1_B\). The multilinear polynomials of degree \(\le p-1\) have
basis \(\{x^\alpha:|\alpha|\le p-1\}\), size \(a_0\). So
\(|\mathcal F|\le a_0\).
\end{proof}

\begin{lemma}[Fiber amplification]
\label{lem:fiber-amplification}
For \(t=1,2,3\), to \((A_1,\ldots,A_t)\in\mathcal U^t\) associate the
unit tensor \(s_{A_1}\otimes\cdots\otimes s_{A_t}\). If
\(\mathcal R\subseteq\mathcal U^t\) contains no collection of \(2^t\)
distinct tuples whose associated tensors are pairwise orthogonal, then
\(|\mathcal R|\le t\delta b^t\).
\end{lemma}

\begin{proof}
\(t=1\) is Lemma~\ref{lem:restricted-intersections}. For
\(t=2,3\), set
\(\mathcal R_A=\{(A_2,\ldots,A_t):(A,A_2,\ldots,A_t)\in\mathcal R\}\).
Let \(\mathcal G\) be those \(A\) for which \(\mathcal R_A\) contains
\(2^{t-1}\) pairwise orthogonal tuples. Two \(A,B\in\mathcal G\) with
\(s_A\perp s_B\) and disjoint fibers would produce \(2^t\) forbidden
tuples; so \(\mathcal G\) has no orthogonal pair, forcing
\(|\mathcal G|\le a_0=\delta b\). Fibers in \(\mathcal G\) have
\(\le b^{t-1}\) elements; other fibers have \(\le(t-1)\delta b^{t-1}\).
Summing gives
\[
|\mathcal R|\le(\delta b)b^{t-1}+b(t-1)\delta b^{t-1}=t\delta b^t.
\]
\end{proof}

Set questions:
\begin{equation}\label{eq:combinatorial-questions}
\mathcal Q=\mathcal U^3,\quad Q=b^3,\quad K=k^3=1028^3=1{,}086{,}373{,}952,
\end{equation}
\(u_q=s_{A_1}\otimes s_{A_2}\otimes s_{A_3}\) for
\(q=(A_1,A_2,A_3)\). An orthogonal eight-set is \(S\subseteq\mathcal Q\)
of size eight with pairwise orthogonal \(u_q\)'s. Lemma~%
\ref{lem:fiber-amplification} at \(t=3\) gives
\begin{equation}\label{eq:combinatorial-eight-bound}
|\mathcal R|\le\kappa:=3\delta Q=3a_0b^2
\end{equation}
for any \(\mathcal R\subseteq\mathcal Q\) with no orthogonal eight-set.

The analytic bound: central binomial
\(b=\frac12\binom{4p}{2p}\ge 16^p/(2(4p+1))\), and
\(a_0\le p\binom{4p}{p}\le p(4/3)^{4p}3^p < p\,12^p\). So
\(\delta < 2p(4p+1)(3/4)^p<2^{-65}\). With \(2p(4p+1)<2^{20}\),
\(p\le85\cdot3+2\), \((3/4)^3<1/2\):
\(3\delta<2^{-33}<1/K\), giving
\begin{equation}\label{eq:combinatorial-strict-bound}
\kappa=3a_0b^2<\frac QK.
\end{equation}

\subsection{Six parity measurements (Mermin--Peres)}

On \(\C^2\):
\(X=\begin{pmatrix}0&1\\1&0\end{pmatrix}\),
\(Z=\begin{pmatrix}1&0\\0&-1\end{pmatrix}\),
\(Y=\begin{pmatrix}0&-i\\i&0\end{pmatrix}\).
The Mermin--Peres square~\cite{Mermin1990,Peres1990,Peres1991}:
\begin{equation}\label{eq:combinatorial-parity-square}
\begin{array}{ccc|c}
X\otimes I_2&I_2\otimes X&X\otimes X&+I_4\\
I_2\otimes Z&Z\otimes I_2&Z\otimes Z&+I_4\\
X\otimes Z&Z\otimes X&Y\otimes Y&+I_4\\\hline
+I_4&+I_4&-I_4&
\end{array}
\end{equation}
Each entry is a real symmetric involution. Order the six contexts as
the three rows and then three columns. In context \(t\), the three
observables \((O_1,O_2,O_3)\) satisfy \(O_1O_2=O_2O_1\), \(O_1,O_2,O_3\)
commute, and
\(O_3=e_tO_1O_2\) with
\((e_1,\ldots,e_6)=(1,1,1,1,1,-1)\). Signs from \(XZ=-iY\) and \(ZX=iY\).

For \((\alpha,\beta)\in\{-1,+1\}^2\), set
\begin{equation}\label{eq:combinatorial-context-projections}
h_t(\alpha,\beta)=\frac14(I_4+\alpha O_1)(I_4+\beta O_2).
\end{equation}
These are self-adjoint projections with sums \(I_4\), ranges carrying
eigensigns \((\alpha,\beta,e_t\alpha\beta)\).

\begin{lemma}[Parity obstruction]
\label{lem:parity-obstruction}
There is no choice, one projection from each of the six measurements in
\eqref{eq:combinatorial-context-projections}, such that every pair of
chosen projections from distinct contexts has strictly positive
overlap.
\end{lemma}

\begin{proof}
If \(E\) (row) and \(F\) (column) both select an eigensign \(a,b\)
for their shared \(O\), then \(aEF=EOF=bEF\); positive overlap forces
\(a=b\). So a hypothetical positive-overlap choice assigns nine
consistent signs to the square. The product over each row's three
signs is \(e_t\): \(+1\) for rows; the column constraint \(-1\) at the
last column contradicts the row product \(+1\).
\end{proof}

\subsection{Assembling the tensor product}

For each 8-subset \(S\subseteq\mathcal Q\), a separate \(\C^4\) factor.
On an orthogonal eight-set, the six smallest-index elements receive the
six parity measurements; the remaining two get a trivial one-outcome
measurement with the other outcomes zero. Nonorthogonal \(S\) and all
non-membership questions get trivial measurements.

\begin{equation}\label{eq:combinatorial-tensor-space}
\mathcal S=\{S\subseteq\mathcal Q:|S|=8\},\quad
L=|\mathcal S|=\binom Q8,\quad
\mathcal H=\bigotimes_{S\in\mathcal S}\C^4\cong\C^D,\quad D=4^L.
\end{equation}
For each \(q\in\mathcal Q\) and outcome string
\(\lambda\in\{-1,+1\}^{2\times\mathcal S}\),
\begin{equation}\label{eq:combinatorial-global-projections}
\mathcal I_q=\{q\}\times\mathcal A^{\mathcal S},\quad
P_{q,\lambda}=\bigotimes_{S\in\mathcal S}h_{S,q}(\lambda_S).
\end{equation}
where \(h_{S,q}\) is the measurement above (or trivial). These are real
symmetric projections summing to \(I_D\) for each fixed \(q\).
Keeping every outcome string gives exactly \(D=4^L\) labels per
question, so \(n=|\bigsqcup_q\mathcal I_q|=QD\).

\begin{lemma}\label{lem:combinatorial-measurements}
The \(u_q\) and \(P_{q,\lambda}\) satisfy Proposition~%
\ref{prop:projection-criterion}'s two hypotheses with \(n=m=QD\) and
\(\kappa=3a_0b^2<Q/K\).
\end{lemma}

\begin{proof}
Hypothesis 1: if \(q=r\) then projections are in one POVM and commute.
If \(q\ne r\) with \(c_{qr}\ne0\) and both nontrivial on one factor,
they would be together in an orthogonal eight-set forcing
\(c_{qr}=0\). Contradiction. So on each factor at least one selected
projection is trivial or zero, and they commute.

Hypothesis 2: labels per question differ only on one factor and have
zero product; labels for one question are one per question. The trace
overlap factors over the tensor factors. If the questions represented
by a positive-overlap label set contained an orthogonal eight-set \(S\),
the six selected projections would violate Lemma~%
\ref{lem:parity-obstruction} on factor \(S\). So
\(|J|\le\kappa\). The strict inequality is \eqref{eq:combinatorial-strict-bound}.
\end{proof}

\begin{theorem}[Combinatorial construction]
\label{thm:old-construction}
Take the explicit data:
\(p=257\), \(k=1028\), \(b=\binom{1027}{513}\),
\(a_0=\sum_{j=0}^{256}\binom{1028}{j}\), \(Q=b^3\),
\(K=1086373952\), \(\kappa=3a_0b^2<Q/K\), \(L=\binom Q8\),
\(D=4^L\), \(m=QD\). Let \(\Psi\) be
from \eqref{eq:projection-map}, \(\Lambda=\Psi^\dagger\),
\(\Phi_D=\Omega_D/\sqrt D\). Then:
\begin{enumerate}
\item \(\Lambda/Q\) is a trace-preserving PPT channel, and
\begin{equation}\label{eq:combinatorial-state}
\rho_{\mathrm{comb}}
=(\Lambda/Q\otimes\Lambda/Q)(\Phi_D\Phi_D^*)
=\frac{J(\Psi^\dagger\circ\Psi)}{Q^2 D}
\end{equation}
is an entangled density operator on \(\C^m\otimes\C^m\) in
\(\mathscr C\), with \(K_D(\rho_{\mathrm{comb}})=0\) and the uniform
unhalved \(1/5\) gap.
\item For \(U:\C^D\to\C^m\) the first-coordinate isometry,
\(\Phi_1^{\mathrm{comb}}=\Ad_U\circ\Psi\),
\(\Phi_2^{\mathrm{comb}}=\Lambda\circ\Ad_{U^*}\) are PPT with
\(J(\Phi_2^{\mathrm{comb}}\circ\Phi_1^{\mathrm{comb}})=Q^2D\rho_{\mathrm{comb}}\)
nonseparable, so the composition is not EB.
\item The channel completion \(\Theta_{\mathrm{comb}}\) of
Proposition~\ref{prop:channel-completion} applied to this pair is a
trace-preserving PPT channel on \(\Mat{2m+1}\) whose square has the
nonseparable corner
\((W_0^*\otimes W_0^*)J(\Theta_{\mathrm{comb}}^2)(W_0\otimes W_0)
=c_1c_2Q^2D\,\rho_{\mathrm{comb}}\).
\end{enumerate}
\end{theorem}

\begin{proof}
Lemma~\ref{lem:combinatorial-measurements} verifies the projection
criterion. Its composite \(C=J(\Psi^\dagger\circ\Psi)\) is positive and
nonseparable, \(\tr C=Q^2D\). Real symmetric projections give
Corollary~\ref{cor:real-channel}; then Theorem~\ref{thm:zero-key} gives
the operational conclusions. Corollary~\ref{cor:square-embedding} gives
the square PPT pair, and Proposition~\ref{prop:channel-completion} gives
the channel.
\end{proof}

All quantities are given by finite exact formulas. The \(s_A\) have
irrational coordinates, but the Gram entries of question vectors
\(c_{qr}\) are rational; observables and projections are integral; so
every block \(H_{ij},\Psi,\Lambda,\Phi_1^{\mathrm{comb}},\Phi_2^{\mathrm{comb}}\),
and \(\rho_{\mathrm{comb}}\) entry is rational. The channel completion
in Proposition~\ref{prop:channel-completion} has rational coefficients.
Appendix~\ref{app:supplementary-checks} records the exact integer checks.


\appendix

\section{Exact arithmetic for the dimension-ten certificate}
\label{app:arithmetic}

Everything in Section~\ref{sec:certificate} that can be reduced to exact
finite arithmetic is verified by a single Python~3 program using only
the standard library and integer arithmetic. Its inputs are the matrices
\(M_0,\ldots,M_3\) of \eqref{eq:explicit-matrices}. Its outputs are:
\begin{enumerate}
\item an assertion of the block-symmetry identity
      \(M_i^{\T}M_j=M_j^{\T}M_i\) for all \(0\le i,j<4\);
\item the integer matrices \(D\in\Z^{15\times20}\) and
      \(H\in\Z^{15\times15}\) in the decomposition
      \((p_\rho(t))_\rho=Dv(t)+Hw(t)\), where the
      monomial order is total degree first, then lexicographic;
\item for each of \(p=41,131,139\): the residue of \(\det H\); the
      twenty-one characteristic coefficients of the \(\F_p\)-reduction
      of \(f(z)=\det(zI_{20}-N)\); and the gcd degrees
      \(d_p(k)=\deg\gcd(\overline f, z^{p^k}-z)\) for \(k=1,\ldots,20\).
\end{enumerate}
The program runs with assertions enabled (no \texttt{-O}, no
\texttt{-OO}, \texttt{PYTHONOPTIMIZE} unset). From the paper directory:
\begin{verbatim}
python3 verification/exact_certificate.py
\end{verbatim}
The recorded output is \texttt{verification/certificate-output.txt};
an identical build copy supplies the typeset listing.

\paragraph{Details of the computation.}
The function \texttt{checksym} verifies block symmetry using only
\(i<j\) and column indices \(a<b\). The cases \(i=j\) and \(a=b\)
vanish identically (equal matrix entries), while swapping either also
leaves the same value; so strict loops cover every equality. The array
\texttt{R} is \([D\mid H]\); \texttt{T} is the reduction of \(N\)
modulo the current prime. The program expands each determinant over the
\(4!=24\) permutations, collects coefficients in that order, and performs Gaussian elimination on \(H\)
modulo each prime.

For \(f(z)=z^{20}+c_1z^{19}+\cdots+c_{20}\), Newton's identities
\(k c_k=-\sum_{i=0}^{k-1}c_i\tr(N^{k-i})\) determine \(c_k\) from the
traces \(\tr(N^{k-i})\). Division by \(k\) is valid at each of
\(41,131,139\) because \(p>20\). Repeated \(p\)-th powers of \(z\) mod
\(\overline f\) compute the residues of \(z^{p^k}\), and the polynomial
Euclidean algorithm gives \(d_p(k)\). All inverses are in the stated
prime field.

No floating-point approximation, no heuristic search, no general
elimination, and no Galois-group computation is performed. In
particular:
\begin{itemize}
\item The irreducibility of \(f\) over \(\Q\) follows from the irreducible
      reduction modulo 41 together with Lemma~\ref{lem:monic-local-reduction}.
\item The Galois cycle types \((1,2,17)\) and \((1,19)\) follow from
      Lemma~\ref{lem:local-frobenius} at \(p=131,139\).
\item \(G=S_{20}\) follows from the transposition plus \(2\)-transitivity
      argument of Section~\ref{sec:certificate}.
\end{itemize}
The exact gcd degrees recorded are:
\[
\begin{array}{c|c}
p & (d_p(1),\ldots,d_p(20))\\ \hline
41  & 0,\ldots,0,\ 20 \quad(\text{only } d_{41}(20)=20\ne0)\\
131 & 1,\,3,\,0,\,0,\ldots,0,\ 18 \quad(\text{at } k=1,2,17)\\
139 & 1,\,0,\ldots,0,\ 20 \quad(\text{at } k=1,19)
\end{array}
\]
and the residues of \(\det H\) are \(40, 23, 9\) modulo \(41,131,139\),
respectively, each nonzero.

\section{Supplementary finite checks}
\label{app:supplementary-checks}

The combinatorial construction of Section~\ref{sec:combinatorial} is
proved by finite formulas and analytic inequalities. Two small
programs verify its exact integer components. Neither is a premise of
the proof.

\paragraph{Combinatorics.}
\texttt{verification/combinatorics\_exact\_checks.py} uses only the
Python standard library. It checks:
(1) primality of \(257\) by trial division by the primes up to
     \(\sqrt{257}\), namely \(2,3,5,7,11,13\);
(2) the intermediate binomial and power inequalities used to derive
     \(\delta<2^{-65}\);
(3) \(3a_0K<b\) and \(3a_0b^2\ge3\).
Its recorded output \texttt{combinatorics\_exact\_checks.json} stores
the exact integers \(a_0\) (under key \texttt{A}) and \(b\), confirms
\(K=1086373952\), and records the stronger interval
\begin{equation}\label{eq:supplementary-delta-interval}
2^{-194}\le\delta<2^{-193}.
\end{equation}
The analytic proof requires only \(\delta<2^{-65}\).

\paragraph{Parity gadget.}
\texttt{verification/gadget\_exact\_check.py} represents each local
projection \(h_t(\alpha,\beta)\) by the integral matrix
\(R=4h_t(\alpha,\beta)\). It checks observable relations, all operator
identities, eigensigns for all \(24\) projections, and measurement
completeness. It computes the \(36\) ordered context-pair overlap
tables; the stored integer \(\tr(RR')\) is exactly \(16\tr(h_th_{t'})\).
It then enumerates all \(4^6=4096\) selections of one outcome per
context, counts zero overlaps among the \(15\) unordered pairs of
distinct contexts, and produces:
\[
\begin{array}{c|rrrrr}
\#\text{ of zero-overlap pairs} & 1 & 3 & 5 & 7 & 9\\ \hline
\#\text{ of selections} & 144 & 1344 & 2016 & 576 & 16
\end{array}
\]
The recorded output \texttt{gadget\_exact\_check.json} has no selection
with all overlaps strictly positive.

\paragraph{Running.}
Regenerate both outputs with
\begin{verbatim}
python3 verification/combinatorics_exact_checks.py
python3 verification/gadget_exact_check.py > verification/gadget_exact_check.json
\end{verbatim}
Assertions enabled, \texttt{-O}/\texttt{-OO} forbidden,
\texttt{PYTHONOPTIMIZE} unset. All computations use exact Python
integers, no floating-point tolerance. The programs do not instantiate
the enormous global matrices or enumerate the question set; those
objects are specified and analyzed by the finite formulas in the text.

\begin{thebibliography}{99}

\bibitem{AnLee2026}
J.~An and S.~Lee, ``Beyond the Positive Partial Transpose Squared
Conjecture: The Qutrit Case,'' arXiv:2607.15947 [quant-ph] (2026).

\bibitem{Choi1975}
M.-D.~Choi, ``Completely positive linear maps on complex matrices,''
\emph{Linear Algebra Appl.} \textbf{10} (1975), 285--290.

\bibitem{CMHW2019}
M.~Christandl, A.~M\"uller-Hermes, and M.~M.~Wolf,
``When do composed maps become entanglement breaking?''
\emph{Ann.\ Henri Poincar\'e} \textbf{20} (2019), 2295--2322.

\bibitem{DevetakWinter05}
I.~Devetak and A.~Winter, ``Distillation of secret key and entanglement
from quantum states,'' \emph{Proc.\ Roy.\ Soc.\ A} \textbf{461} (2005),
207--235.

\bibitem{Filippov2021}
S.~N.~Filippov, ``Capacity of trace decreasing quantum operations
and superadditivity of coherent information for a generalized erasure
channel,'' \emph{J.\ Phys.\ A} \textbf{54} (2021), 255301.

\bibitem{FR1987}
P.~Frankl and V.~R\"odl, ``Forbidden intersections,''
\emph{Trans.\ Amer.\ Math.\ Soc.} \textbf{300} (1987), 259--286.

\bibitem{HansenEtAl2012}
L.~O.~Hansen, A.~Hauge, J.~Myrheim, and P.~{\O}.~Sollid,
``Low-rank positive-partial-transpose states and their relation to
product vectors,'' \emph{Phys.\ Rev.\ A} \textbf{85} (2012), 022309.

\bibitem{Horodecki1997}
P.~Horodecki, ``Separability criterion and inseparable mixed states
with positive partial transposition,'' \emph{Phys.\ Lett.\ A} \textbf{232}
(1997), 333--339.

\bibitem{HSR2003}
M.~Horodecki, P.~W.~Shor, and M.~B.~Ruskai,
``Entanglement breaking channels,'' \emph{Rev.\ Math.\ Phys.} \textbf{15}
(2003), 629--641.

\bibitem{Jamiolkowski1972}
A.~Jamio\l{}kowski, ``Linear transformations which preserve trace and
positive semidefiniteness of operators,''
\emph{Rep.\ Math.\ Phys.} \textbf{3} (1972), 275--278.

\bibitem{Kallenberg2002}
O.~Kallenberg, \emph{Foundations of Modern Probability}, 2nd ed.,
Springer, New York (2002).

\bibitem{keyBoundEntanglement}
K.~Horodecki, M.~Horodecki, P.~Horodecki, and J.~Oppenheim,
``Secure key from bound entanglement,''
\emph{Phys.\ Rev.\ Lett.} \textbf{94} (2005), 160502.

\bibitem{keyPrivateStates}
K.~Horodecki, M.~Horodecki, P.~Horodecki, and J.~Oppenheim,
``General paradigm for distilling classical key from quantum states,''
\emph{IEEE Trans.\ Inf.\ Theory} \textbf{55} (2009), 1898--1929.

\bibitem{KrugerWerner05}
O.~Kr\"uger and R.~F.~Werner (editors),
\emph{Some open problems in quantum information theory} (2005),
Problem~24, ``Secret key from all entangled states?'' (P.~Horodecki).

\bibitem{Mermin1990}
N.~D.~Mermin, ``Simple unified form for the major no-hidden-variables
theorems,'' \emph{Phys.\ Rev.\ Lett.} \textbf{65} (1990), 3373--3376.

\bibitem{Park2026}
S.-J.~Park, ``Every PPT channel has finite entanglement breaking
index,'' arXiv:2608.13551 [quant-ph] (2026).

\bibitem{Peres1990}
A.~Peres, ``Incompatible results of quantum measurements,''
\emph{Phys.\ Lett.\ A} \textbf{151} (1990), 107--108.

\bibitem{Peres1991}
A.~Peres, ``Two simple proofs of the Kochen--Specker theorem,''
\emph{J.\ Phys.\ A} \textbf{24} (1991), L175--L178.

\bibitem{SchliemannLossMacDonald2001}
J.~Schliemann, D.~Loss, and A.~H.~MacDonald, ``Double-occupancy
errors, adiabaticity, and entanglement of spin qubits in quantum dots,''
\emph{Phys.\ Rev.\ B} \textbf{63} (2001), 085311.

\end{thebibliography}

\end{document}