Introduction
Quantum error correction is essential for protecting quantum information against noise and enabling reliable and scalable quantum computation. Of particular importance are transversal gates, which implement logical operations through physical gates that each act on at most one qubit per code block, preventing a single gate fault from spreading within a block [1 ] . However, the Eastin-Knill theorem rules out a universal transversal gate set on a fixed code that detects arbitrary single-qubit errors [2 ] . Nevertheless, transversal non-Clifford gates remain valuable for universal fault-tolerant computation through magic-state distillation [3 , 4 ] , code switching, and gauge fixing [5 , 6 ] . A further goal is to apply these logical gates selectively to individual logical qubits [7 ] . This property, known as addressability, allows a prescribed gate to act on any chosen logical qubit while leaving the others unchanged [8 , 9 ] . In addition, asymptotically good code families combine bounded data-qubit overhead per logical qubit with a minimum distance that grows linearly with the blocklength [10 , 11 , 12 ] . This motivates studying codes that support addressable transversal non-Clifford gates while maintaining a nonvanishing encoding rate and relative distance.
Algebraic-geometric (AG) codes already support combining positive asymptotic rate and relative distance with non-Clifford transversal operations. He et al. constructed asymptotically good codes with addressable transversal CCZ gates [13 ] . For single-qubit phase gates Z ( h ) = diag ( 1 , e 2 π i / 2 h ) Z(h)=\operatorname{diag}(1,e^{2\pi i/2^{h}}) Z ( h ) = diag ( 1 , e 2 π i / 2 h ) in the Clifford hierarchy, San-
Table 1. Common asymptotic lower bounds on encoding rate and relative distance for codes supporting fully addressable transversal T T T gates implemented by physical T T T powers. Values are rounded; parameter calculations are given in Sec. S5 of the Supplemental Material (SM).
José obtained asymptotically good CSS codes with addressable level-h h h rotations for every fixed h ≥ 3 h \ge3 h ≥ 3 by lowering a level-( h + 1 ) (h+1) ( h + 1 ) construction [14 ] , whereas Lin, Wu, and Cheng achieved fully addressable transversal T T T gates on asymptotically good CSS codes directly through generalized divisibility [9 ] . Meiburg gave both CSS constructions with fully addressable transversal T T T and a modular-clock construction for single-qubit gates of arbitrary fixed finite projective order [15 ] . However, as shown in Table I, although these constructions give asymptotically good codes, the simultaneous rate and relative-distance guarantees remain unrealistically small, limiting their practical applicability. This motivates a natural question: Can these parameters be improved to practically meaningful values, such as a few percent, while supporting fully addressable transversal phase gates?
In this work, we construct quantum codes with fully addressable transversal phase gates and substantially improved rate and relative distance. Our approach uses an encoding over the cyclic ring R h = Z / 2 h Z \mathcal{R}_{h}=\mathbb{Z}/2^{h}\mathbb{Z} R h = Z / 2 h Z beyond the binary CSS framework, representing each ring coordinate by h h h physical qubits. Columns of the inverse encoding matrix recover the binary logical labels as linear functions of these coordinates. Expanding the coordinates into binary digits turns these functions into physical single-qubit phase gates with independently prescribed logical actions. This separates addressability from the joint design of rate and distance, replacing the higher-order overlap and divisibility conditions of the previous CSS constructions with a linear coordinate identity.
For the polynomial-time construction, we start with nested AG codes over F 256 \mathbb{F}_{256} F 256 [16 , 17 , 18 ] . A binary basis expansion gives blocks of eight bits. Completing a basis adapted to the nested codes and lifting it to R h \mathcal{R}_h R h yields an invertible encoding matrix while retaining the relevant primal and dual block distances. Uniform superpositions over the resulting ring-code cosets define the outer quantum code. We then encode each eight-register block into ten registers. A coherent uniform offset and a linear check detect single-register errors, while a compensating phase on the offset register preserves the prescribed logical action. This doubles the certified physical-qubit distance lower bound at a 25% increase in blocklength, with the number of logical qubits unchanged.
For the T T T gate, a deterministic polynomial-time construction gives a common asymptotic lower bound of approximately 2.57% on both quantities. A counting argument over encoding matrices and quadratic phases gives an exponential-time construction with exact verification, increasing this guarantee to approximately 7.34%. For every fixed hierarchy level h ≥ 3 h \ge3 h ≥ 3 , both constructions give common rate and relative-distance guarantees that scale as 1 / h 1/h 1/ h . This mild dependence on h h h is particularly favorable at higher hierarchy levels, where the explicit guarantees of previous constructions deteriorate rapidly [14 , 15 ] . We also derive a universal upper bound on the common asymptotic rate–distance coefficient for codes supporting fully addressable transversal Z ( h ) Z(h) Z ( h ) powers. The bound follows by reducing the addressing matrix modulo two and applying classical rate–distance bounds to the resulting binary code. Within our cyclic encoding framework, the stronger upper bound scales as 1 / h 1/h 1/ h and is approximately 1.28 times the lower bound achieved by our exponential-time construction. In addition, we construct codes with 48 and 90 physical qubits supporting fully addressable transversal T T T gates as well as their encoding circuits, providing concrete examples of our framework.
The remainder of the paper is organized as follows. Section II introduces the encoding and its classical ingredients. Section III proves the polynomial-time construction and the existence result with exact exponential-time generation. Section IV derives upper bounds on the simultaneously achievable rate and relative distance, and Sec. V illustrates the framework with two finite codes. Technical lemmas, construction algorithms, counting details, and exact certification criteria appear in SM.
Preliminaries and cyclic encoding
Here we introduce the code parameters and addressability condition, review the required properties of AG codes, and present the cyclic encoding together with its transversal logical phase action.
Code parameters and addressability
A binary quantum code ( ( N , 2 K , D ) ) 2 ((N,2^{K},D))_{2} (( N , 2 K , D ) ) 2 encodes K K K logical qubits into N N N physical qubits and detects every operator supported on fewer than D D D qubits. Let E E E be an encoding isometry for the code. The code detects an operator O O O if E † O E = λ O I 2 K E^{\dagger}OE=\lambda_{O}I_{2^{K}} E † O E = λ O I 2 K for some λ O ∈ C \lambda_{O}\in\mathbb{C} λ O ∈ C [19 ] . The code’s rate and relative distance are R = K / N R=K/N R = K / N and d = D / N d=D/N d = D / N . For a code family with N i → ∞ N_i\to\infty N i → ∞ , let
R ∞ : = lim inf i K i / N i , d ∞ : = lim inf i D i / N i , R_{\infty}:=\liminf_{i} K_i/N_i,\qquad d_{\infty}:=\liminf_{i} D_i/N_i, R ∞ := i lim inf K i / N i , d ∞ := i lim inf D i / N i ,
and define η : = min { R ∞ , d ∞ } \eta:=\min\{R_{\infty},d_{\infty}\} η := min { R ∞ , d ∞ } . In this work, all logarithms are base two, and each asymptotic statement fixes h h h .
For an integer h ≥ 1 h\geq1 h ≥ 1 , set
ν : = 2 h , R h : = Z / ν Z , Z ( h ) : = diag ( 1 , e 2 π i / ν ) . \nu:=2^{h},\qquad\mathcal{R}_{h}:=\mathbb{Z}/\nu\mathbb{Z},\qquad Z(h):=\operatorname{diag}(1,e^{2\pi i/\nu}). ν := 2 h , R h := Z / ν Z , Z ( h ) := diag ( 1 , e 2 π i / ν ) .
The levels h = 1 , 2 , 3 h=1,2,3 h = 1 , 2 , 3 give the gates Z Z Z , S S S and T T T . Full addressability means that there exist one encoding isometry E E E and one matrix F ∈ R h K × N F\in\mathcal{R}_{h}^{K\times N} F ∈ R h K × N satisfying
( ⨂ j = 1 N Z ( h ) ( c F ) j ) E = E ( ⨂ ℓ = 1 K Z ( h ) c ℓ ) ( c ∈ R h K ) . (1) \left(\bigotimes_{j=1}^{N}Z(h)^{(cF)_{j}}\right)E
=
E\left(\bigotimes_{\ell=1}^{K}Z(h)^{c_{\ell}}\right)
\qquad(c\in\mathcal{R}_{h}^{K}). \tag*{(1)} ( j = 1 ⨂ N Z ( h ) ( c F ) j ) E = E ( ℓ = 1 ⨂ K Z ( h ) c ℓ ) ( c ∈ R h K ) . (1)
Thus, the vector c c c independently chooses each logical phase power, with zero selecting an idle qubit. This identity gives the desired logical action exactly, on a fixed encoding for the chosen level h h h .
Nested algebraic-geometric codes
We use nested one-point evaluation codes. Let X / F q X/\mathbb{F}_{q} X / F q be a smooth projective curve of genus g g g , let P ∞ P_{\infty} P ∞ be a rational point, and let D D D be a sum of n n n other distinct rational points. The Riemann–Roch space L ( a P ∞ ) L(aP_{\infty}) L ( a P ∞ ) consists of functions whose only allowed pole is at P ∞ P_{\infty} P ∞ , of order at most a a a . Evaluating these functions at the points in the support of D D D gives the algebraic-geometric (AG) code C L ( D , a P ∞ ) C_{L}(D,aP_{\infty}) C L ( D , a P ∞ ) . The following standard consequence of Riemann–Roch gives the parameters needed below [20 ] .
Lemma 1 (Ref. [20 ] ). If 2 g − 2 < a < n 2g-2<a<n 2 g − 2 < a < n , then C = C L ( D , a P ∞ ) C=C_{L}(D,aP_{\infty}) C = C L ( D , a P ∞ ) satisfies dim C = a + 1 − g \dim C=a+1-g dim C = a + 1 − g , and the distances of code C C C and C ⊥ C^{\perp} C ⊥ are at least n − a n-a n − a and a + 2 − 2 g a+2-2g a + 2 − 2 g . Moreover, a 0 < a 1 a_{0}<a_{1} a 0 < a 1 gives C L ( D , a 0 P ∞ ) ⊆ C L ( D , a 1 P ∞ ) C_{L}(D,a_{0}P_{\infty})\subseteq C_{L}(D,a_{1}P_{\infty}) C L ( D , a 0 P ∞ ) ⊆ C L ( D , a 1 P ∞ ) .
The Garcia–Stichtenoth tower over F 256 \mathbb{F}_{256} F 256 provides a sequence of curves with n i → ∞ n_i\to\infty n i → ∞ and g i / n i → 1 / 15 g_i/n_i\to1/15 g i / n i → 1/15 [16 , 17 ] . With suitable choices of divisor degree, Lemma 1 therefore yields AG code families with positive asymptotic rate and relative minimum distance. Its evaluation matrices can be constructed deterministically in polynomial time [18 ] . Thus, these AG code families are asymptotically good and can be constructed deterministically and efficiently.
Encoding and logical addressability
Each element y j ∈ R h y_j\in\mathcal{R}_h y j ∈ R h has a binary expansion y j = ∑ b = 0 h − 1 2 b y j , b y_j=\sum_{b=0}^{h-1}2^{b}y_{j,b} y j = ∑ b = 0 h − 1 2 b y j , b . We write dig ( y j ) = ( y j , 0 , … , y j , h − 1 ) \operatorname{dig}(y_j)=(y_{j,0},\ldots,y_{j,h-1}) dig ( y j ) = ( y j , 0 , … , y j , h − 1 ) . Each ring coordinate is represented by a register of h h h physical qubits. Hence, M M M ring coordinates occupy N = h M N=hM N = h M physical qubits. Arithmetic on ring coordinates is modulo 2 h 2^{h} 2 h .
Choose an invertible M × M M\times M M × M matrix B B B over R h \mathcal{R}_{h} R h . Let G G G be its first r r r rows and L L L its next K K K rows, with r + K ≤ M r+K\leq M r + K ≤ M . Let R h r : = { ( v 1 , … , v r ) : v j ∈ R h for 1 ≤ j ≤ r } \mathcal{R}_{h}^{r}:=\{(v_{1},\ldots,v_{r}):v_{j}\in\mathcal{R}_{h}\text{ for }1\leq j\leq r\} R h r := {( v 1 , … , v r ) : v j ∈ R h for 1 ≤ j ≤ r } . Given a symmetric M × M M\times M M × M ring matrix A A A , define a map E : C 2 K → C 2 N E:\mathbb{C}^{2^{K}}\to\mathbb{C}^{2^{N}} E : C 2 K → C 2 N such that
E ∣ x ⟩ = ν − r / 2 ∑ v ∈ R h r e π i A y T / ν ∣ dig ( y ) ⟩ , (2) E|x\rangle=\nu^{-r/2}\sum_{v\in\mathcal{R}_{h}^{r}}e^{\pi i A y^{T}/\nu}|\operatorname{dig}(y)\rangle, \tag*{(2)} E ∣ x ⟩ = ν − r /2 v ∈ R h r ∑ e π i A y T / ν ∣ dig ( y )⟩ , (2)
for every x ∈ { 0 , 1 } K x\in\{0,1\}^{K} x ∈ { 0 , 1 } K and y = v G + x L ∈ R h M y=vG+xL\in\mathcal{R}_{h}^{M} y = v G + xL ∈ R h M , where in the quadratic phase, we use integer representatives in { 0 , … , ν − 1 } \{0,\ldots,\nu-1\} { 0 , … , ν − 1 } for all entries of A A A and y y y . The AG construction uses A = 0 A=0 A = 0 in Sec. III, while the exponential-time construction searches over symmetric A A A and invertible B B B with exact verification of the required distance bound. For each 1 ≤ ℓ ≤ K 1\leq\ell\leq K 1 ≤ ℓ ≤ K , let z ℓ T z_{\ell}^{T} z ℓ T be column r + ℓ r+\ell r + ℓ of B − 1 B^{-1} B − 1 .
Lemma 2. Equation (2) defines an encoding isometry E E E . The code defined by E E E admits fully addressable transversal Z ( h ) Z(h) Z ( h ) gates, with addressing matrix F ∈ R h K × h M F\in\mathcal{R}_{h}^{K\times hM} F ∈ R h K × h M given by
F ℓ , ( j , b ) = 2 b z ℓ , j ( m o d ν ) , (3) F_{\ell,(j,b)}=2^{b}z_{\ell,j}\pmod{\nu}, \tag*{(3)} F ℓ , ( j , b ) = 2 b z ℓ , j ( mod ν ) , (3) where 1 ≤ j ≤ M 1\leq j\leq M 1 ≤ j ≤ M and 0 ≤ b < h 0\leq b<h 0 ≤ b < h .
Proof. Invertibility of B B B makes the map ( v , x ) ↦ v G + x L (v,x)\mapsto vG+xL ( v , x ) ↦ v G + xL injective. The encoded states in Eq. (2) corresponding to distinct binary labels x x x therefore have disjoint supports, and each state contains ν r \nu^{r} ν r terms of magnitude ν − r / 2 \nu^{-r/2} ν − r /2 . The encoded states are thus orthonormal, so E E E is an isometry.
Since y = ( v , x , 0 ) B y=(v,x,0)B y = ( v , x , 0 ) B and z ℓ T z_{\ell}^{T} z ℓ T is column r + ℓ r+\ell r + ℓ of B − 1 B^{-1} B − 1 , we have
∑ j = 1 M z ℓ , j y j = z ℓ T y ≡ x ℓ ( m o d ν ) . \sum_{j=1}^{M}z_{\ell,j}y_{j}=z_{\ell}^{T}y\equiv x_{\ell}\pmod{\nu}. j = 1 ∑ M z ℓ , j y j = z ℓ T y ≡ x ℓ ( mod ν ) .
Substituting y j = ∑ b = 0 h − 1 2 b y j , b y_{j}=\sum_{b=0}^{h-1}2^{b}y_{j,b} y j = ∑ b = 0 h − 1 2 b y j , b gives
x ℓ ≡ ∑ j = 1 M ∑ b = 0 h − 1 ( 2 b z ℓ , j ) y j , b ( m o d ν ) . x_{\ell}\equiv\sum_{j=1}^{M}\sum_{b=0}^{h-1}(2^{b}z_{\ell,j})y_{j,b}\pmod{\nu}. x ℓ ≡ j = 1 ∑ M b = 0 ∑ h − 1 ( 2 b z ℓ , j ) y j , b ( mod ν ) .
The coefficient of each physical bit therefore gives the addressing entry F ℓ , ( j , b ) = 2 b z ℓ , j ( m o d ν ) F_{\ell,(j,b)}=2^{b}z_{\ell,j}\pmod{\nu} F ℓ , ( j , b ) = 2 b z ℓ , j ( mod ν ) . Indeed, applying Z ( h ) F ℓ , ( j , b ) Z(h)^{F_{\ell,(j,b)}} Z ( h ) F ℓ , ( j , b ) to physical qubit ( j , b ) (j,b) ( j , b ) contributes the phase e 2 π i F ℓ , ( j , b ) y j , b / ν e^{2\pi i F_{\ell,(j,b)}y_{j,b}/\nu} e 2 π i F ℓ , ( j , b ) y j , b / ν . Their product is e 2 π i x ℓ / ν e^{2\pi i x_\ell/\nu} e 2 π i x ℓ / ν on every term of E ∣ x ⟩ E|x\rangle E ∣ x ⟩ , implementing Z ( h ) Z(h) Z ( h ) on logical qubit ℓ \ell ℓ and the identity on the others. Combining the rows with coefficients c ℓ c_\ell c ℓ gives Eq. (1) .
The vectors z ℓ z_\ell z ℓ , and hence the addressing matrix F F F , depend only on B − 1 B^{-1} B − 1 . For fixed B B B , the same F F F therefore implements the prescribed logical phase operations for every symmetric matrix A A A . The choice of A A A changes the relative phases within the encoded states, providing additional freedom to obtain distance guarantees while preserving logical addressability.
Once B B B and A A A are specified, the encoding admits a polynomial-size circuit. Indeed, for fixed h h h , modular elimination implements the linear map w ↦ w B w\mapsto wB w ↦ w B using O h ( M 2 ) O_h(M^2) O h ( M 2 ) elementary gates [21 Sec. IV] [22 ] . The uniform superposition requires h r = O h ( M ) hr=O_h(M) h r = O h ( M ) Hadamard gates, and binary expansion decomposes the quadratic phase in Eq. (2) into O h ( M 2 ) O_h(M^2) O h ( M 2 ) diagonal gates acting on one or two qubits.
Asymptotically Good Code Constructions
This section gives two constructions of quantum codes with fully addressable Z ( h ) Z(h) Z ( h ) gates as well as positive asymptotic rate and relative distance for each fixed h ≥ 3 h\ge3 h ≥ 3 . The first combines nested AG codes with an inner code and can be implemented deterministically in polynomial time (Theorem 1). The second uses random encoding matrices and quadratic phases to obtain a larger common lower bound on rate and relative distance, with exact exponential-time generation (Theorem 2 ). Figure 1 shows the shared phase mechanism and two approaches to obtaining distance.
Figure 1. Overview of quantum code constructions with fully addressable transversal Z ( h ) Z(h) Z ( h ) gates. Columns of B − 1 \mathrm{B}^{-1} B − 1 determine physical phase powers for independently prescribed logical Z ( h ) Z(h) Z ( h ) operations; at fixed B \mathrm{B} B these powers are independent of A \mathrm{A} A . (a) Nested AG codes over F 256 \mathbb{F}_{256} F 256 undergo binary expansion and an adapted-basis ring lift with A = 0 \mathrm{A}=0 A = 0 . The 8-to-10 inner encoding adds the orange registers and preserves the logical phase action. (b) Counting guarantees a pair ( B , A ) (\mathrm{B},\mathrm{A}) ( B , A ) passing the exact Weyl rejection tests at the stated parameters. Each ring symbol represents a register of h h h qubits.
Polynomial-time algebraic-geometric construction
Our construction concatenates an outer quantum code with an inner code. The outer code is constructed from nested one-point AG codes over F 256 \mathbb{F}_{256} F 256 , with each field coordinate represented by eight ring registers, as detailed in the proof of Theorem 1 and in Sec. S2.1 of SM.
The inner encoding acts on each eight-register block by introducing a uniformly superposed common offset and two additional registers that store the offset and a modular linear check. The resulting ten-register code detects every error supported on a single output register and allows the outer logical phase operations to remain transversal. Each ring register is represented by h h h physical qubits; we write ∣ s ⟩ |s\rangle ∣ s ⟩ as shorthand for ∣ dig ( s ) ⟩ |\operatorname{dig}(s)\rangle ∣ dig ( s )⟩ , where s ∈ R h s\in\mathcal{R}_h s ∈ R h .
We now define this inner encoding and prove these two properties. Its extension to arbitrary even block sizes and the full concatenation argument appear in § 3.2.2 of SM.
Set ϵ a = 1 \epsilon_a=1 ϵ a = 1 for 1 ≤ a ≤ 4 1\le a\le4 1 ≤ a ≤ 4 and ϵ a = − 1 \epsilon_a=-1 ϵ a = − 1 for 5 ≤ a ≤ 8 5\le a\le8 5 ≤ a ≤ 8 , so ∑ a ϵ a = 0 \sum_a\epsilon_a=0 ∑ a ϵ a = 0 . For u ∈ R h 8 u\in\mathcal{R}_h^8 u ∈ R h 8 , define the inner encoding as
J 8 ∣ u ⟩ = ν − 1 / 2 ∑ t ∈ R h ∣ u 1 + t , … , u 8 + t ⟩ J_8|u\rangle=\nu^{-1/2}\sum_{t\in\mathcal{R}_h}|u_1+t,\ldots,u_8+t\rangle J 8 ∣ u ⟩ = ν − 1/2 t ∈ R h ∑ ∣ u 1 + t , … , u 8 + t ⟩
⊗ ∣ t ⟩ ⊗ ∣ t − ∑ a = 1 8 ϵ a u a ∣ . (4) \otimes|t\rangle\otimes\left|t-\sum_{a=1}^{8}\epsilon_a u_a\right|. \tag*{(4)} ⊗ ∣ t ⟩ ⊗ t − a = 1 ∑ 8 ϵ a u a . (4)
The inner code defined by J 8 J_8 J 8 detects errors supported on any single output register, as the following lemma shows.
Lemma 3. The map J 8 J_8 J 8 is an isometry, and the code it defines detects every operator supported on a single output register.
Proof. The ninth output register takes the value t t t , and subtracting t t t from the first eight registers recovers u u u . Distinct inputs therefore have disjoint supports, and each encoded state contains ν \nu ν distinct terms of amplitude ν − 1 / 2 \nu^{-1/2} ν − 1/2 , proving isometry. Every output word w w w satisfies
∑ a = 1 8 ϵ a w a − w 9 + w 10 = 0. \sum_{a=1}^{8}\epsilon_a w_a-w_9+w_{10}=0. a = 1 ∑ 8 ϵ a w a − w 9 + w 10 = 0.
The single-register Weyl operators Q a , b Q_{a,b} Q a , b , defined by Q a , b ∣ s ⟩ = e 2 π i b s / ν ∣ s + a ⟩ Q_{a,b}|s\rangle=e^{2\pi i b s/\nu}|s+a\rangle Q a , b ∣ s ⟩ = e 2 π ib s / ν ∣ s + a ⟩ for a , b ∈ R h a,b\in\mathcal{R}_h a , b ∈ R h , combine a shift by a a a with a phase factor e 2 π i b s / ν e^{2\pi i b s/\nu} e 2 π ib s / ν . They form a basis for all operators on one register [21 ] . If a ≠ 0 a\ne0 a = 0 , the operator shifts on coordinate a a a every output word by a a a . For every shifted word, the left side of the above identity equals ± a ≠ 0 \pm a\ne0 ± a = 0 . All basis words in all encoded states satisfy the identity, so the code space is mapped into its orthogonal complement. If a = 0 a=0 a = 0 and b ≠ 0 b\ne0 b = 0 , write the affected output coordinate as t + f ( u ) t+f(u) t + f ( u ) . The phase operator Q Q Q multiplies each term by e 2 π i b ( t + f ( u ) ) / ν e^{2\pi i b(t+f(u))/\nu} e 2 π ib ( t + f ( u )) / ν . Because the superposition is uniform, the inner product with the original encoded state is the average of these phase factors, and it vanishes:
⟨ u ∣ J 8 † Q J 8 ∣ u ⟩ = ν − 1 e 2 π i b f ( u ) / ν ∑ t ∈ R h e 2 π i b t / ν = 0. \langle u|J_8^\dagger QJ_8|u\rangle
=\nu^{-1}e^{2\pi i b f(u)/\nu}\sum_{t\in\mathcal{R}_h}e^{2\pi i bt/\nu}
=0. ⟨ u ∣ J 8 † Q J 8 ∣ u ⟩ = ν − 1 e 2 π ib f ( u ) / ν t ∈ R h ∑ e 2 π ib t / ν = 0.
Inner products with other encoded basis states also vanish, since phase operators preserve the disjoint supports of distinct inputs. Thus J 8 † Q J 8 = 0 J_8^\dagger QJ_8=0 J 8 † Q J 8 = 0 for every nonidentity Weyl operator Q Q Q on one register. By linearity, J 8 † O J 8 J_8^\dagger OJ_8 J 8 † O J 8 is a scalar multiple of the identity for every single-register operator O O O , which proves detection.
For a ring register, write Z ν ( b ) ∣ s ⟩ = e 2 π i b s / ν ∣ s ⟩ Z_\nu(b)|s\rangle=e^{2\pi i bs/\nu}|s\rangle Z ν ( b ) ∣ s ⟩ = e 2 π ib s / ν ∣ s ⟩ ; in binary digits, Z ν ( b ) = ⨂ j = 0 h − 1 Z ( j ) 2 j b Z_\nu(b)=\bigotimes_{j=0}^{h-1}Z^{(j)2^jb} Z ν ( b ) = ⨂ j = 0 h − 1 Z ( j ) 2 j b . The next identity transfers a product of these phase operators through the inner encoding.
Lemma 4. For z ∈ R h 8 z \in\mathbb{R}_h^8 z ∈ R h 8 , set z ~ = ( z 1 , … , z 8 , − ∑ a = 1 8 z a , 0 ) \tilde{z}=(z_1,\ldots,z_8,-\sum_{a=1}^8 z_a,0) z ~ = ( z 1 , … , z 8 , − ∑ a = 1 8 z a , 0 ) . Then
( ⨂ j = 1 10 Z ν ( z ~ j ) ) J 8 = J 8 ( ⨂ a = 1 8 Z ν ( z a ) ) . (5) \left(\bigotimes_{j=1}^{10} Z_\nu(\tilde{z}_j)\right)J_8=J_8\left(\bigotimes_{a=1}^{8} Z_\nu(z_a)\right). \tag*{(5)} ( j = 1 ⨂ 10 Z ν ( z ~ j ) ) J 8 = J 8 ( a = 1 ⨂ 8 Z ν ( z a ) ) . (5)
Proof. For each summand of Eq. (4) , the phase exponent is
z ~ w T = ∑ a = 1 8 z a ( u a + t ) − ( ∑ a = 1 8 z a ) t = ∑ a = 1 8 z a u a ( m o d ν ) . \begin{aligned}
\tilde{z}w^{\mathsf{T}}=\sum_{a=1}^{8}z_a(u_a+t)-\left(\sum_{a=1}^{8}z_a\right)t \\
&=\sum_{a=1}^{8}z_au_a\pmod{\nu}.
\end{aligned} z ~ w T = a = 1 ∑ 8 z a ( u a + t ) − ( a = 1 ∑ 8 z a ) t = a = 1 ∑ 8 z a u a ( mod ν ) .
It is independent of t t t and equals the phase exponent on the input state, proving the identity.
Combining these properties with the AG distance bounds gives the following family.
Theorem 1. For each fixed h ≥ 3 h \ge3 h ≥ 3 , a deterministic polynomial-time algorithm constructs fully addressable Z ( h ) Z(h) Z ( h ) codes with
lim i K i N i = 52 675 h , lim inf i D i N i ≥ 52 675 h . (6) \lim_i\frac{K_i}{N_i}=\frac{52}{675h},\qquad\liminf_i\frac{D_i}{N_i}\ge\frac{52}{675h}. \tag*{(6)} i lim N i K i = 675 h 52 , i lim inf N i D i ≥ 675 h 52 . (6)
Proof. Fix h ≥ 3 h \ge3 h ≥ 3 . We first construct the outer encoding, then use J 8 J_8 J 8 to obtain a binary code with the required distance and addressability, and finally choose the AG parameters. On a curve over F 256 \mathbb{F}_{256} F 256 with n n n evaluation points and genus g g g , choose 2 g − 2 < a 0 < a 1 < n 2g-2<a_0<a_1<n 2 g − 2 < a 0 < a 1 < n and set A b = C L ( D , a b P ∞ ) A_b=C_L(D,a_bP_\infty) A b = C L ( D , a b P ∞ ) for b = 0 , 1 b=0,1 b = 0 , 1 . Lemma 1 gives nested codes with
dim A b = a b + 1 − g , \dim A_b=a_b+1-g, dim A b = a b + 1 − g ,
d ( A 1 ) ≥ n − a 1 , d ( A 0 ⊥ ) ≥ a 0 + 2 − 2 g . d(A_1)\ge n-a_1,\qquad d(A_0^\perp)\ge a_0+2-2g. d ( A 1 ) ≥ n − a 1 , d ( A 0 ⊥ ) ≥ a 0 + 2 − 2 g .
The dimension difference determines the number of logical qubits, and the two distance bounds control shifts and phases.
Expand each field coordinate in a fixed binary basis to obtain B 0 ⊂ B 1 ⊆ F 2 8 n B_0\subset B_1\subseteq\mathbb{F}_2^{8n} B 0 ⊂ B 1 ⊆ F 2 8 n . Group the eight coordinates of each field symbol into one block. Extend a basis of B 0 B_0 B 0 to a basis of B 1 B_1 B 1 and then to a basis of F 2 8 n \mathbb{F}_2^{8n} F 2 8 n . Arrange these basis vectors as rows of a matrix and lift its zero–one entries to R h R_h R h . The resulting matrix B o u t B_{\mathrm{out}} B out has odd determinant and is therefore invertible. Let G G G contain its first r o u t r_{\mathrm{out}} r out rows and L L L its next K K K rows, where
r o u t = 8 ( a 0 + 1 − g ) , K = 8 ( a 1 − a 0 ) . r_{\mathrm{out}}=8(a_0+1-g),\qquad K=8(a_1-a_0). r out = 8 ( a 0 + 1 − g ) , K = 8 ( a 1 − a 0 ) .
Setting A = 0 A=0 A = 0 in Eq. (2) defines the outer encoding
E o u t ∣ x ⟩ = ν − r o u t / 2 ∑ v ∈ R h r o u t ∣ v G + x L ⟩ , x ∈ { 0 , 1 } K . (7) E_{\mathrm{out}}|x\rangle=\nu^{-r_{\mathrm{out}}/2}\sum_{v\in R_h^{r_{\mathrm{out}}}}|vG+xL\rangle,\qquad x\in\{0,1\}^{K}. \tag*{(7)} E out ∣ x ⟩ = ν − r out /2 v ∈ R h r out ∑ ∣ v G + xL ⟩ , x ∈ { 0 , 1 } K . (7)
By Lemma 2, it is an isometry with fully addressable logical Z ( h ) Z(h) Z ( h ) gates.
Binary expansion preserves nonzero field-coordinate blocks, and expanding A 0 ⊥ A_0^\perp A 0 ⊥ in the trace-dual basis gives [23 ] . Thus every nonzero word of B 1 B_1 B 1 has at least n − a 1 n-a_1 n − a 1 nonzero blocks, while every nonzero word of B 0 ⊥ B_0^\perp B 0 ⊥ has at least a 0 + 2 − 2 g a_0+2-2g a 0 + 2 − 2 g nonzero blocks.
For any nonzero ring codeword, write c = 2 k α ( G ) c=2^k\alpha^{(G)} c = 2 k α ( G ) with 0 ≤ k < h 0\le k<h 0 ≤ k < h and α m o d 2 ≠ 0 \alpha\bmod2\ne0 α mod 2 = 0 . Row independence modulo two ensures that b = α ( G ) m o d 2 b=\alpha^{(G)}\bmod2 b = α ( G ) mod 2 is a nonzero word of B 1 B_1 B 1 . Whenever b j = 1 b_j=1 b j = 1 , the coordinate c j c_j c j is 2 k 2^k 2 k times an odd element and hence nonzero modulo 2 h 2^h 2 h . Thus every nonzero block of b b b remains nonzero in c c c , giving at least n − a 1 n-a_1 n − a 1 nonzero blocks.
Similarly, for a nonzero ring vector z z z satisfying G z T = 0 Gz^{\mathsf{T}}=0 G z T = 0 , write z = 2 k z ′ z=2^kz' z = 2 k z ′ with 0 ≤ k < h 0\le k<h 0 ≤ k < h and at least one odd entry in z ′ z' z ′ . Then G z ′ T ≡ 0 ( m o d 2 h − k ) Gz'^{\mathsf{T}}\equiv0\pmod{2^{h-k}} G z ′ T ≡ 0 ( mod 2 h − k ) , so z ′ m o d 2 z'\bmod2 z ′ mod 2 is a nonzero word of B 0 ⊥ B_0^\perp B 0 ⊥ whose support is contained in that of z z z . Thus z z z has at least a 0 + 2 − 2 g a_0+2-2g a 0 + 2 − 2 g nonzero blocks. The full distance-preservation result is proved in Sec. S2.1 of SM.
Set
d ∗ = min { n − a 1 , a 0 + 2 − 2 g } . d_*=\min\{n-a_1,a_0+2-2g\}. d ∗ = min { n − a 1 , a 0 + 2 − 2 g } .
A nonzero shift on fewer than d ∗ d_* d ∗ blocks cannot connect outer-code basis states. A nonidentity pure phase error on those blocks has the form Q β = ⨂ j = 1 8 n Z ν ( β j ) Q_\beta=\bigotimes_{j=1}^{8n}Z_\nu(\beta_j) Q β = ⨂ j = 1 8 n Z ν ( β j ) , with 0 ≠ β ∈ R h 8 n 0\ne\beta\in R_h^{8n} 0 = β ∈ R h 8 n . It leaves each basis label unchanged and multiplies its amplitude by e 2 π i ( v G + x L ) β T / ν e^{2\pi i(vG+xL)\beta^{\mathsf{T}}/\nu} e 2 π i ( v G + xL ) β T / ν . The dual distance bound implies G β T ≠ 0 G\beta^{\mathsf{T}}\ne0 G β T = 0 , so averaging this phase factor over all v v v in R h r o u t R_h^{r_{\mathrm{out}}} R h r out gives zero. Consequently, E o u t † Q E o u t = 0 E_{\mathrm{out}}^\dagger QE_{\mathrm{out}}=0 E out † Q E out = 0 for every nonidentity Weyl operator Q Q Q supported on fewer than d ∗ d_* d ∗ blocks. Expanding any operator Q Q Q on those blocks in the Weyl basis, only its identity term contributes to E o u t † Q E o u t E_{\mathrm{out}}^\dagger QE_{\mathrm{out}} E out † Q E out , so the result is a scalar multiple of the logical identity. Thus the outer code detects every error supported on fewer than d ∗ d_* d ∗ blocks of eight ring registers.
Next apply J 8 J_8 J 8 to each of the n n n outer blocks, and represent each output register by its h h h binary digits. This gives an encoding E E E into N = 10 h n N=10hn N = 10 hn physical qubits, with the same K K K logical qubits. To prove the distance bound, consider any physical Pauli operator P P P of weight w < 2 d ∗ w<2d_* w < 2 d ∗ . Write P = ⨂ p = 1 n P p P=\bigotimes_{p=1}^{n}P_p P = ⨂ p = 1 n P p , where P p P_p P p acts on the 10 h 10h 10 h physical qubits in block p p p . If P p P_p P p acts nontrivially on at most one qubit, its support lies within one output ring register. Lemma 3 therefore implies that J 8 † P p J 8 J_8^\dagger P_pJ_8 J 8 † P p J 8 is a scalar multiple of the identity. Thus only blocks containing at least two affected qubits can contribute nonscalar factors. There are at most ⌊ w / 2 ⌋ < d ∗ \lfloor w/2\rfloor<d_* ⌊ w /2 ⌋ < d ∗ such blocks. The outer detection result then implies that E † P E E^\dagger PE E † P E is a scalar multiple of the logical identity. By linearity, every Pauli error on fewer than 2 d ∗ 2d_* 2 d ∗ physical qubits is detectable. Hence
N = 10 h n , K = 8 ( a 1 − a 0 ) , N=10hn,\qquad K=8(a_1-a_0), N = 10 hn , K = 8 ( a 1 − a 0 ) ,
D ≥ 2 min { n − a 1 , a 0 + 2 − 2 g } . (8) D\ge2\min\{n-a_1,a_0+2-2g\}. \tag*{(8)} D ≥ 2 min { n − a 1 , a 0 + 2 − 2 g } . (8)
To retain addressability after concatenation, let z ~ ℓ T \tilde{z}_{\ell}^{\mathsf{T}} z ~ ℓ T be column r o u t + ℓ r_{\mathrm{out}}+\ell r out + ℓ of B o u t − 1 B_{\mathrm{out}}^{-1} B out − 1 and partition z ℓ z_{\ell} z ℓ into eight-coordinate blocks z ℓ , p z_{\ell,p} z ℓ , p . Extend each block to z ~ ℓ , p \tilde{z}_{\ell,p} z ~ ℓ , p using Lemma 4. By Eq. (5) , the corresponding phase operators implement the same outer logical action after concatenation. Expanding each output register into binary digits gives the physical addressing matrix F F F with entries
F ℓ , ( p , j , b ) = 2 b z ~ ℓ , p , j ( m o d ν ) , 1 ≤ p ≤ n , 1 ≤ j ≤ 10 , 0 ≤ b < h . F_{\ell,(p,j,b)} = 2^{b}\tilde{z}_{\ell,p,j}\pmod{\nu},
\qquad1 \le p \le n,\quad1 \le j \le10,\quad0 \le b < h. F ℓ , ( p , j , b ) = 2 b z ~ ℓ , p , j ( mod ν ) , 1 ≤ p ≤ n , 1 ≤ j ≤ 10 , 0 ≤ b < h .
For each logical qubit ℓ \ell ℓ , this row implements Z ( h ) Z(h) Z ( h ) on that qubit and the identity on the others. Taking linear combinations of the rows proves Eq. (1) for every logical exponent vector on this fixed encoding.
Finally, take the Garcia–Stichtenoth tower over F 256 \mathbb{F}_{256} F 256 , with n i → ∞ n_i \to\infty n i → ∞ and g i / n i → 1 / 15 g_i/n_i \to1/15 g i / n i → 1/15 [16 , 17 ] . For degree fractions a b , i / n i → β b a_{b,i}/n_i \to\beta_b a b , i / n i → β b satisfying 2 / 15 < β 0 < β 1 < 1 2/15 < \beta_0 < \beta_1 < 1 2/15 < β 0 < β 1 < 1 , Eq. (8) gives
R ∞ = 4 5 h ( β 1 − β 0 ) , d ∞ ≥ 1 5 h min { 1 − β 1 , β 0 − 2 / 15 } . (9) R_{\infty} = \frac{4}{5h}(\beta_1-\beta_0),
\qquad
d_{\infty} \ge\frac{1}{5h}\min\{1-\beta_1,\beta_0-2/15\}. \tag*{(9)} R ∞ = 5 h 4 ( β 1 − β 0 ) , d ∞ ≥ 5 h 1 min { 1 − β 1 , β 0 − 2/15 } . (9)
Balancing the rate and the two distance terms gives
4 ( β 1 − β 0 ) = 1 − β 1 = β 0 − 2 / 15 , 4(\beta_1-\beta_0)=1-\beta_1=\beta_0-2/15, 4 ( β 1 − β 0 ) = 1 − β 1 = β 0 − 2/15 ,
so choose β 0 = 70 / 135 \beta_0=70/135 β 0 = 70/135 and β 1 = 83 / 135 \beta_1=83/135 β 1 = 83/135 , and set
a 0 , i = ⌊ 70 n i / 135 ⌋ , a 1 , i = ⌊ 83 n i / 135 ⌋ . a_{0,i}=\lfloor70n_i/135\rfloor,\qquad a_{1,i}=\lfloor83n_i/135\rfloor. a 0 , i = ⌊ 70 n i /135 ⌋ , a 1 , i = ⌊ 83 n i /135 ⌋ .
These degrees satisfy 2 g i − 2 < a 0 , i < a 1 , i < n i 2g_i-2<a_{0,i}<a_{1,i}<n_i 2 g i − 2 < a 0 , i < a 1 , i < n i for all sufficiently large i i i . Rounding changes each normalized degree by less than 1 / n i 1/n_i 1/ n i , so Eq. (9) yields Eq. (6) . □
For fixed h h h , the evaluation matrices are constructed deterministically in polynomial time [18 ] . Binary expansion, basis completion, ring-matrix inversion and the inner encodings also take polynomial time in N i N_i N i . The comparison of fixed square binary fields and the explicit construction steps are given in § 3.2.3 and S2.4 of SM, respectively.
The same proof gives a rate–distance tradeoff. For 0 < τ d < 13 / 30 0<\tau_d<13/30 0 < τ d < 13/30 , choose β 0 = 2 / 15 + τ d \beta_0=2/15+\tau_d β 0 = 2/15 + τ d and β 1 = 1 − τ d \beta_1=1-\tau_d β 1 = 1 − τ d in Eq. (9) . Then
R ∞ = 4 5 h ( 13 15 − 2 τ d ) , d ∞ ≥ τ d 5 h . (10) R_{\infty}=\frac{4}{5h}\left(\frac{13}{15}-2\tau_d\right),
\qquad
d_{\infty}\ge\frac{\tau_d}{5h}. \tag*{(10)} R ∞ = 5 h 4 ( 15 13 − 2 τ d ) , d ∞ ≥ 5 h τ d . (10)
Increasing τ d \tau_d τ d improves the lower bound on the relative distance while reducing the rate. The balanced choice is τ d = 52 / 135 \tau_d=52/135 τ d = 52/135 ; for T = Z ( 3 ) T=Z(3) T = Z ( 3 ) it gives rate 52 / 2025 52/2025 52/2025 , corresponding asymptotically to 2025 / 52 ≃ 38.94 2025/52\simeq38.94 2025/52 ≃ 38.94 physical data qubits per logical qubit.
Existence with exact exponential-time generation
The second construction uses a random quadratic phase to obtain codes that detect low-weight errors. Fix h ≥ 3 h\ge3 h ≥ 3 , set ν = 2 h \nu=2^h ν = 2 h , and take 1 ≤ K < M 1\le K<M 1 ≤ K < M , 1 ≤ d ≤ M 1\le d\le M 1 ≤ d ≤ M , and r = M − K r=M-K r = M − K . Choose B B B uniformly among invertible M × M M\times M M × M matrices over R h \mathcal{R}_h R h , and choose A A A independently and uniformly among symmetric matrices. Write
B = ( G L ) , B=\begin{pmatrix}G\\L\end{pmatrix}, B = ( G L ) ,
with G G G having r r r rows. The encoding E E E is given by Eq. (2) , with N = h M N=hM N = h M .
For a , b ∈ R h M a,b\in\mathcal{R}_h^M a , b ∈ R h M , the Weyl operators W ( a , b ) = ⨂ j = 1 M X ν ( a j ) Z ν ( b j ) W(a,b)=\bigotimes_{j=1}^{M}X_{\nu}(a_j)Z_{\nu}(b_j) W ( a , b ) = ⨂ j = 1 M X ν ( a j ) Z ν ( b j ) form an orthogonal basis for all errors [21 ] , where X ν ( a j ) ∣ y j ⟩ = ∣ y j + a j ⟩ X_{\nu}(a_j)|y_j\rangle=|y_j+a_j\rangle X ν ( a j ) ∣ y j ⟩ = ∣ y j + a j ⟩ and Z ν ( b j ) ∣ y j ⟩ = e 2 π i b j y j / ν ∣ y j ⟩ Z_{\nu}(b_j)|y_j\rangle=e^{2\pi i b_jy_j/\nu}|y_j\rangle Z ν ( b j ) ∣ y j ⟩ = e 2 π i b j y j / ν ∣ y j ⟩ for y j ∈ R h y_j\in\mathcal{R}_h y j ∈ R h . Every operator P P P therefore has the Weyl expansion
P = 2 − N ∑ a , b Tr ( W ( a , b ) † P ) W ( a , b ) . P=2^{-N}\sum_{a,b}\operatorname{Tr}(W(a,b)^{\dagger}P)W(a,b). P = 2 − N a , b ∑ Tr ( W ( a , b ) † P ) W ( a , b ) .
We first characterize when a Weyl operator has a nonzero matrix element between encoded basis states.
Lemma 5. For x , x ′ ∈ { 0 , 1 } K x,x'\in\{0,1\}^{K} x , x ′ ∈ { 0 , 1 } K , the matrix element ⟨ x ′ ∣ E † W ( a , b ) E ∣ x ⟩ \langle x'|E^{\dagger}W(a,b)E|x\rangle ⟨ x ′ ∣ E † W ( a , b ) E ∣ x ⟩ is nonzero if and only if
G ( b − a A ) T = 0 , ( a B − 1 ) r + 1 : M = x ′ − x (11) G(b-aA)^{\mathsf{T}}=0,\qquad(aB^{-1})_{r+1:M}=x'-x \tag*{(11)} G ( b − a A ) T = 0 , ( a B − 1 ) r + 1 : M = x ′ − x (11) over R h \mathcal{R}_h R h .
The proof is given in § 4.1 of SM.
To identify the Weyl terms that must be tested, we assign each a cost that lower-bounds the weight of any qubit Pauli whose Weyl expansion contains that pair. Thus all terms arising from Pauli errors of weight below d d d are included among the pairs of cost below d d d . We choose the cost according to the additive order of the pair. A pair ( a , b ) (a,b) ( a , b ) has exact order 2 s 2^s 2 s if 2 s ( a , b ) = 0 2^s(a,b)=0 2 s ( a , b ) = 0 and 2 s − 1 ( a , b ) ≠ 0 2^{s-1}(a,b)\ne0 2 s − 1 ( a , b ) = 0 over R h \mathcal{R}_h R h . We assign each pair a total cost:
For exact order two, write ( a , b ) = 2 h − 1 ( α , β ) (a,b)=2^{h-1}(\alpha,\beta) ( a , b ) = 2 h − 1 ( α , β ) with α , β ∈ { 0 , 1 } M \alpha,\beta\in\{0,1\}^{M} α , β ∈ { 0 , 1 } M . The total cost is wt ( α ) + wt ( β ) \operatorname{wt}(\alpha)+\operatorname{wt}(\beta) wt ( α ) + wt ( β ) .
For exact order four, each local pair satisfies 4 ( a j , b j ) = 0 4(a_j,b_j)=0 4 ( a j , b j ) = 0 . Assign local cost zero to ( 0 , 0 ) (0,0) ( 0 , 0 ) . Assign local cost one to a nonzero local pair if its Weyl
operator appears with a nonzero coefficient in the Weyl expansion of a single-qubit Pauli on that register. Assign local cost two to all remaining nonzero local pairs. The total cost is the sum of these local costs.
(3) For exact order 2 s 2^s 2 s with 3 ≤ s ≤ h 3 \le s \le h 3 ≤ s ≤ h , the total cost is the number of registers with ( a j , b j ) ≠ ( 0 , 0 ) (a_j,b_j) \ne(0,0) ( a j , b j ) = ( 0 , 0 ) .
For a pair of exact order two, every entry of the logical shift ( a B − 1 ) r + 1 : M (a\mathbf{B}^{-1})_{r+1:M} ( a B − 1 ) r + 1 : M is zero or 2 h − 1 2^{h-1} 2 h − 1 . Since h ≥ 3 h \ge3 h ≥ 3 , this vector can equal a difference of binary labels x ′ − x x^\prime-x x ′ − x only if it is zero, in which case x ′ = x x^\prime=x x ′ = x .
We now define a sufficient test for the distance bound D ≥ d D \ge d D ≥ d . Among nonzero Weyl pairs of total cost below d d d , an exact-order-two pair triggers rejection if both G ( b − a A ) T = 0 G(b-aA)^{\mathsf T}=0 G ( b − a A ) T = 0 and ( a B − 1 ) r + 1 : M = 0 (aB^{-1})_{r+1:M}=0 ( a B − 1 ) r + 1 : M = 0 hold. A pair of higher order triggers rejection if G ( b − a A ) T = 0 G(b-aA)^{\mathsf T}=0 G ( b − a A ) T = 0 . Let reject denote the event that at least one such pair triggers rejection. When this event occurs, we discard the candidate matrix pair ( B , A ) (B,A) ( B , A ) .
Passing this test guarantees D ≥ d D \ge d D ≥ d , as shown in the proof of Theorem 2 . To establish existence, we bound Pr ( r e j e c t ) \Pr(\mathrm{reject}) Pr ( reject ) using the following counting functions and estimates for each exact order:
B ( n , d ) = ∑ w = 1 d − 1 ( n w ) , B(n,d)=\sum_{w=1}^{d-1}\binom{n}{w}, B ( n , d ) = w = 1 ∑ d − 1 ( w n ) ,
W h ( M , d ) = ∑ w = 1 d − 1 z w [ 1 + c h z + ( 15 − c h ) z 2 ] M , (12) W_h(M,d)=\sum_{w=1}^{d-1}z^w\left[1+c_hz+(15-c_h)z^2\right]^M, \tag*{(12)} W h ( M , d ) = w = 1 ∑ d − 1 z w [ 1 + c h z + ( 15 − c h ) z 2 ] M , (12)
V s ( M , d ) = ∑ w = 1 d − 1 ( 4 s − 1 ) w ( M w ) , V_s(M,d)=\sum_{w=1}^{d-1}(4^s-1)^w\binom{M}{w}, V s ( M , d ) = w = 1 ∑ d − 1 ( 4 s − 1 ) w ( w M ) ,
where c 3 = 10 c_3=10 c 3 = 10 and c h = 6 c_h=6 c h = 6 for h ≥ 4 h \ge4 h ≥ 4 .
Lemma 6 (Order-two errors). Among exact-order-two pairs of cost below d d d , the α ≠ 0 \alpha\ne0 α = 0 branch contains at most B ( 2 M , d ) B(2M,d) B ( 2 M , d ) pairs, each with rejection probability at most 2 − M 2^{-M} 2 − M . The α = 0 \alpha=0 α = 0 branch contains at most B ( M , d ) B(M,d) B ( M , d ) pairs, each with rejection probability at most 2 − r 2^{-r} 2 − r . Every order-two Weyl term in the expansion of a qubit Pauli of weight below d d d has cost below d d d .
The proof is given in Sec. S3.2 of SM.
Lemma 7 (Order-four errors). Among local pairs satisfying 4 ( a j , b j ) = 0 4(a_j,b_j)=0 4 ( a j , b j ) = 0 , exactly c h c_h c h have cost one. At most W h ( M , d ) W_h(M,d) W h ( M , d ) pairs of exact order four have total cost below d d d ; each has rejection probability at most 2 − 2 r 2^{-2r} 2 − 2 r . Every order-four Weyl term in the expansion of a qubit Pauli of weight below d d d has cost below d d d .
The proof is given in Sec. S3.3 of SM. The local costs lower-bound the Pauli weight needed to produce a Weyl term.
Lemma 8 (Higher-order errors). For 3 ≤ s ≤ h 3 \le s \le h 3 ≤ s ≤ h , at most V s ( M , d ) V_s(M,d) V s ( M , d ) pairs of exact order 2 s 2^s 2 s have total cost below d d d ; each has rejection probability at most 2 − s r 2^{-sr} 2 − sr . Every order-2 s 2^s 2 s Weyl term in the expansion of a qubit Pauli of weight below d d d has cost below d d d .
The proof is given in Sec. S3.4 of SM. Combining these bounds by the union bound gives Pr ( r e j e c t ) ≤ Φ h ( M , K , d ) \Pr(\mathrm{reject}) \le\Phi_h(M,K,d) Pr ( reject ) ≤ Φ h ( M , K , d ) , where
Φ h ( M , K , d ) = 2 − M B ( 2 M , d ) + 2 − r B ( M , d ) + 2 − 2 r W h ( M , d ) + ∑ s = 3 h 2 − s r V s ( M , d ) . (13) \Phi_h(M,K,d)=2^{-M}B(2M,d)
+2^{-r}B(M,d)+2^{-2r}W_h(M,d)
+\sum_{s=3}^{h}2^{-sr}V_s(M,d). \tag*{(13)} Φ h ( M , K , d ) = 2 − M B ( 2 M , d ) + 2 − r B ( M , d ) + 2 − 2 r W h ( M , d ) + s = 3 ∑ h 2 − sr V s ( M , d ) . (13)
The entropy estimate below uses the threshold t ⋆ = 2 H 2 − 1 ( 1 / 2 ) t_\star=2H_2^{-1}(1/2) t ⋆ = 2 H 2 − 1 ( 1/2 ) , where
H 2 ( t ) = − t log 2 t − ( 1 − t ) log 2 ( 1 − t ) H_2(t)=-t\log_2 t-(1-t)\log_2(1-t) H 2 ( t ) = − t log 2 t − ( 1 − t ) log 2 ( 1 − t )
is the binary entropy and the inverse is taken on [ 0 , 1 / 2 ] [0,1/2] [ 0 , 1/2 ] . Combining the rejection bounds above with the standard entropy estimate for binary Hamming balls [24 ] yields the following lemma.
Lemma 9. Fix h ≥ 3 h \ge3 h ≥ 3 and 0 < t < t ⋆ 0<t<t_\star 0 < t < t ⋆ . There exist constants c > 0 c>0 c > 0 and M 0 M_0 M 0 , depending only on h , t h,t h , t , such that, for every M ≥ M 0 M \ge M_0 M ≥ M 0 and K = d = ⌈ t M ⌉ K=d=\lceil tM\rceil K = d = ⌈ tM ⌉ .
Pr ( r e j e c t ) ≤ Φ h ( M , K , d ) ≤ 2 − c M . (14) \Pr(\mathrm{reject})\le\Phi_h(M,K,d)\le2^{-cM}. \tag*{(14)} Pr ( reject ) ≤ Φ h ( M , K , d ) ≤ 2 − c M . (14)
The proof is given in Sec. S3.5 of SM. The preceding bounds yield the following computable code family.
Theorem 2. For each fixed h ≥ 3 h \ge3 h ≥ 3 , a computable quantum code family admitting fully addressable Z ( h ) \mathbb{Z}(h) Z ( h ) gates satisfies
lim i K i N i = t ⋆ h , lim inf i D i N i ≥ t ⋆ h . (15) \lim_i\frac{K_i}{N_i}=\frac{t_\star}{h},\qquad
\liminf_i\frac{D_i}{N_i}\ge\frac{t_\star}{h}. \tag*{(15)} i lim N i K i = h t ⋆ , i lim inf N i D i ≥ h t ⋆ . (15)
The defining matrices B i \mathbf{B}_i B i and A i \mathbf{A}_i A i admit deterministic generation in 2 O h ( N i 2 ) 2^{O^h(N_i^2)} 2 O h ( N i 2 ) time or randomized generation with exact verification in expected 2 O h ( N i ) 2^{O^h(N_i)} 2 O h ( N i ) time, using polynomial working space.
Proof. Fix h ≥ 3 h \ge3 h ≥ 3 and write N = h M N=hM N = h M and r = M − K r=M-K r = M − K . Lemma 2 gives an isometric, fully addressable encoding for every admissible matrix pair ( B , A ) (B,A) ( B , A ) . It therefore remains to select pairs with the required distance.
Let P P P be a nonidentity qubit Pauli of weight below d d d . The identity coefficient in its Weyl expansion is 2 − N Tr P = 0 2^{-N}\operatorname{Tr}P=0 2 − N Tr P = 0 . By Lemmas 6–8, every nonidentity Weyl term appearing in this expansion has cost below d d d and is therefore checked by the rejection test. If no rejection occurs, Lemma 5 gives E W ( a , b ) E = 0 \mathbb{E}^W(a,b)E=0 E W ( a , b ) E = 0 for each such term. By linearity, E † P E = 0 E^\dagger P E=0 E † P E = 0 . Since this holds for every nonidentity Pauli of weight below d d d , the code has D ≥ d D \ge d D ≥ d . The union bound and the counting lemmas give Pr ( r e j e c t ) ≤ Φ h ( M , K , d ) \Pr(\mathrm{reject})\le\Phi_h(M,K,d) Pr ( reject ) ≤ Φ h ( M , K , d ) .
For i ≥ 3 i \ge3 i ≥ 3 , choose t i t_i t i as the largest integer multiple of 2 − i 2^{-i} 2 − i in ( 0 , 1 / 2 ) (0,1/2) ( 0 , 1/2 ) satisfying 2 H 2 ( t i / 2 ) < 1 2H_2(t_i/2)<1 2 H 2 ( t i /2 ) < 1 . This gives a sequence ( t i ) (t_i) ( t i ) converging to t ⋆ t_\star t ⋆ , with 0 < t i < t ⋆ 0 < t_i < t_\star 0 < t i < t ⋆ . For each i i i , choose the smallest integer M i ≥ 2 i M_i \ge2^i M i ≥ 2 i such that
K i = d i = ⌈ t i M i ⌉ , Φ h ( M i , K i , d i ) < 1 2 . K_i=d_i=\lceil t_iM_i\rceil,\qquad\Phi_h(M_i,K_i,d_i)<\frac{1}{2}. K i = d i = ⌈ t i M i ⌉ , Φ h ( M i , K i , d i ) < 2 1 .
Lemma 9 guarantees that such an integer exists and can be found by testing successive lengths. At every selected length, some matrix pair triggers no rejection and therefore defines a code with D i ≥ d i D_i\ge d_i D i ≥ d i . With N i = h M i N_i=hM_i N i = h M i ,
K i N i = d i N i = t i h + O ( M i − 1 ) , \frac{K_i}{N_i}=\frac{d_i}{N_i}=\frac{t_i}{h}+O(M_i^{-1}), N i K i = N i d i = h t i + O ( M i − 1 ) ,
which implies Eq. (15) .
These parameter choices are effective. For rational t i t_i t i , clearing denominators and exponentiating reduces the entropy condition to an exact integer comparison. The finite sums defining Φ h \Phi_h Φ h can also be evaluated exactly using rational arithmetic. Since 2 i ≤ M i 2^i\le M_i 2 i ≤ M i , the required numbers have polynomial bit length, and the parameter search takes polynomial time and space in N i N_i N i .
For each candidate matrix pair, enumerate the 2 2 h M i 2^{2hM_i} 2 2 h M i Weyl pairs and check the rejection conditions for every nonzero pair of cost below d i d_i d i . Computing the order and cost of a pair, then checking these conditions, takes polynomial time and space. Processing the pairs one at a time therefore gives exact verification in 2 O h ( N i ) 2^{O_h(N_i)} 2 O h ( N i ) time and polynomial working space. There are 2 O h ( M i 2 ) 2^{O_h(M_i^2)} 2 O h ( M i 2 ) candidate matrix pairs, so exhaustive search takes 2 O h ( N i 2 ) 2^{O_h(N_i^2)} 2 O h ( N i 2 ) time with the same space bound.
Uniform admissible matrix pairs can be sampled in polynomial expected time: a uniformly sampled ring matrix is invertible with probability greater than 1 / 4 1/4 1/4 , as determined by its reduction modulo 2. Since Pr ( r e j e c t ) ≤ Φ h ( M i , K i , d i ) < 1 / 2 \Pr(\mathrm{reject})\le\Phi_h(M_i,K_i,d_i)<1/2 Pr ( reject ) ≤ Φ h ( M i , K i , d i ) < 1/2 , each uniformly sampled admissible matrix pair triggers no rejection with probability greater than 1 / 2 1/2 1/2 . Independent repetition therefore requires fewer than two admissible matrix pairs on average, giving expected time 2 O h ( N i ) 2^{O_h(N_i)} 2 O h ( N i ) with exact verification and polynomial working space.
For T = Z ( 3 ) T=Z(3) T = Z ( 3 ) , the asymptotic rate is 0.0733519 … 0.0733519\ldots 0.0733519 … , and the asymptotic relative distance is at least this value. This corresponds to approximately 13.63 physical data qubits per logical qubit. Exact generation selects the matrices; the resulting encoder has the polynomial circuit size established in Sec. II.
The AG construction also applies to h = 1 , 2 h=1,2 h = 1 , 2 . For S S S , the counting construction gives H 2 − 1 ( 1 / 2 ) H_2^{-1}(1/2) H 2 − 1 ( 1/2 ) . For Z Z Z , the order-two count instead gives the root β ⋆ \beta_\star β ⋆ of β + H 2 ( β ) + β log 2 3 = 1 \beta+H_2(\beta)+\beta\log_2 3=1 β + H 2 ( β ) + β log 2 3 = 1 , approximately 0.15 (§ 4.1.5 of SM).
Upper bounds from addressability
The addressing matrix F F F in Eq. (1) imposes a classical distance constraint. Set B F = F m o d 2 B_F=F\bmod2 B F = F mod 2 , and let s F s_F s F be the number of nonzero columns of B F B_F B F .
Lemma 10. Let an ( ( N , 2 K , D ) ) 2 ((N,2^K,D))_2 (( N , 2 K , D ) ) 2 quantum code satisfy Eq. (1) with h ≥ 1 h\ge1 h ≥ 1 , and K ≥ 1 K\ge1 K ≥ 1 . Removing the zero columns of B F B_F B F gives a generator matrix for a binary linear [ s F , K , ≥ D ] [s_F,K,\ge D] [ s F , K , ≥ D ] code.
Proof. Substitute c = 2 h − 1 v c=2^{h-1}v c = 2 h − 1 v for v ∈ F 2 K v\in\mathbb{F}_2^K v ∈ F 2 K in Eq. (1) . Since Z ( h ) 2 h − 1 = Z Z(h)^{2^{h-1}}=Z Z ( h ) 2 h − 1 = Z ,
Z v B F E = E Z v . Z^{vB_F}E=EZ^v. Z v B F E = E Z v . For v ≠ 0 v\ne0 v = 0 , the logical Pauli Z v Z^v Z v is nonscalar. Therefore v B F ≠ 0 vB_F\ne0 v B F = 0 , proving rank K K K , and quantum distance requires wt ( v B F ) ≥ D \operatorname{wt}(vB_F)\ge D wt ( v B F ) ≥ D . Removing zero columns preserves these weights.
Therefore, the parameters of the quantum code must satisfy the following limits,
2 K ≤ A 2 ( s F , D ) , K + D − 1 ≤ s F , (16) 2^K\le A_2(s_F,D),\qquad K+D-1\le s_F, \tag*{(16)} 2 K ≤ A 2 ( s F , D ) , K + D − 1 ≤ s F , (16)
where A 2 ( s F , d ) A_2(s_F,d) A 2 ( s F , d ) is the largest possible number of binary codewords of length s F s_F s F and minimum distance at least d d d . The second inequality is the classical Singleton bound [24 ] , obtained by puncturing D − 1 D-1 D − 1 coordinates of the classical code.
Theorem 3. Consider a family of binary quantum codes with parameters ( ( N i , 2 K i , D i ) ) 2 ((N_i,2^{K_i},D_i))_2 (( N i , 2 K i , D i ) ) 2 and N i → ∞ N_i\to\infty N i → ∞ . Suppose for a fixed integer h ≥ 1 h\ge1 h ≥ 1 , each code admits fully addressable transversal powers of Z ( h ) = diag ( 1 , e i 2 π / 2 h ) Z(h)=\operatorname{diag}(1,e^{i2\pi/2^h}) Z ( h ) = diag ( 1 , e i 2 π / 2 h ) , with addressing matrix F i F_i F i . Let η \eta η be the family’s common asymptotic coefficient of rate and relative distance. Then η ≤ c u p \eta\le c_{\mathrm{up}} η ≤ c up , where c u p = 282652727463 / 10 12 c_{\mathrm{up}}=282652727463/10^{12} c up = 282652727463/1 0 12 . If each addressing matrix F i F_i F i has the form specified in Lemma 2, then η ≤ c u p / h \eta\le c_{\mathrm{up}}/h η ≤ c up / h .
Proof. For binary codes of relative distance at least t ∈ ( 0 , 1 / 2 ) t\in(0,1/2) t ∈ ( 0 , 1/2 ) , the asymptotic rate is at most U ( t ) U(t) U ( t ) [25 Corollary 23] . The function U U U is continuous, and Sec. S4 of SM proves U ( c u p ) < c u p U(c_{\mathrm{up}})<c_{\mathrm{up}} U ( c up ) < c up . Pad the parity code of Lemma 10 with zero columns to length N N N . By continuity, choose 0 < t < c u p 0<t<c_{\mathrm{up}} 0 < t < c up such that U ( t ) < t U(t)<t U ( t ) < t . If η > c u p \eta>c_{\mathrm{up}} η > c up , these classical codes eventually have rate and relative distance greater than t t t . The rate bound then gives t < U ( t ) < t t<U(t)<t t < U ( t ) < t , a contradiction. Hence η ≤ c u p \eta\le c_{\mathrm{up}} η ≤ c up .
Under the additional condition on the addressing matrices, the factor 2 b 2^b 2 b makes every column with b ≥ 1 b\ge1 b ≥ 1 zero modulo 2. Only the column with b = 0 b=0 b = 0 in each of the M M M registers can remain nonzero, so s F ≤ M s_F\le M s F ≤ M . Pad the resulting classical code with zeros to length M = N / h M=N/h M = N / h . Its rate is K / M = h K / N K/M=hK/N K / M = h K / N , and its relative distance is at least D / M = h D / N D/M=hD/N D / M = h D / N . The same argument gives h η ≤ c u p h\eta\le c_{\mathrm{up}} h η ≤ c up and hence η ≤ c u p / h \eta\le c_{\mathrm{up}}/h η ≤ c up / h .
Every code family admitting fully addressable logical Z ( h ) Z(h) Z ( h ) gates satisfies η ≤ c u p \eta\le c_{\mathrm{up}} η ≤ c up . Both constructions in this paper also satisfy Eq. (3) , so they obey the stronger bound η ≤ c u p / h \eta\le c_{\mathrm{up}}/h η ≤ c up / h . Table II compares the achievable lower bounds on η \eta η from both constructions with the universal upper bound and the stronger bound under Eq. (3) , including their values for $T=Z(3)`.
Table II. Values of η \eta η achieved by the two constructions and theoretical upper bounds for codes admitting fully addressable logical Z ( h ) Z(h) Z ( h ) gates at any fixed h ≥ 3 h\ge3 h ≥ 3 . Here η = min { R ∞ , d ∞ } \eta=\min\{R_{\infty},d_{\infty}\} η = min { R ∞ , d ∞ } is the minimum of the asymptotic rate and relative distance. Numerical values are rounded to the displayed precision.
Finite codes and encoding circuits
We obtain two finite quantum codes with fully addressable transversal logical T T T gates: Q 48 = ( ( 48 , 16 , 5 ) ) 2 Q_{48} = ((48, 16, 5))_2 Q 48 = (( 48 , 16 , 5 ) ) 2 and Q 90 = ( ( 90 , 256 , 7 ) ) 2 Q_{90} = ((90, 256, 7))_2 Q 90 = (( 90 , 256 , 7 ) ) 2 . They encode 4 and 8 logical qubits into 48 and 90 physical qubits, respectively. We find their defining matrices by sampling candidates from the construction in § 2 B at h = 3 h = 3 h = 3 and applying its exact rejection tests. For each code, checking every nonzero Weyl pair of cost below the claimed distance certifies detection of every Pauli error of lower weight. An explicit nontrivial logical Pauli of matching weight gives the upper bound, so the distances are exactly 5 and 7. A code of distance D D D corrects arbitrary errors on up to t = ⌊ ( D − 1 ) / 2 ⌋ t = \lfloor(D - 1)/2\rfloor t = ⌊( D − 1 ) /2 ⌋ qubits under ideal recovery [19 ] . Thus, the two codes correct arbitrary errors on up to 2 and 3 qubits, respectively. The rejection tests and logical witnesses are given in § 4.4.2 of SM; complete matrices and machine-readable certificates are available from the authors upon reasonable request.
By Eq. (1) with h = 3 h = 3 h = 3 , each logical T T T gate is implemented by a transversal layer of physical single-qubit phase gates. For Q 48 Q_{48} Q 48 , the individual T T T gates on logical qubits 1, 2, 3, 4 have physical gate weights 33, 29, 30, and 36, respectively. Here the weight counts the number of nonidentity gates in the transversal layer.
An ancilla-free encoding circuit for Q 48 Q_{48} Q 48 uses 466 two-qubit controlled-phase gates, 24 two-qubit SWAP gates, 12 three-qubit multiplications x ↦ u x m o d 8 x \mapsto ux \bmod8 x ↦ ux mod 8 with odd u u u , and 202 six-qubit weighted additions ( x , y ) ↦ ( x , y + c x m o d 8 ) (x, y) \mapsto(x, y + cx \bmod8) ( x , y ) ↦ ( x , y + c x mod 8 ) . Scheduling these operations on disjoint qubits in parallel gives a multi-qubit gate depth of 228, assuming all-to-all connectivity and unit duration for each listed operation. Single-qubit gates are excluded from this depth count. Further circuit details are given in § 4.4.3 of SM.
Discussion
Independent phase control can coexist with a nonvanishing density of protected logical qubits. The cyclic encoding makes the mechanism explicit: inverse-matrix columns select logical phases, while classical code distances or quadratic phase counting provide error detection. This separation produces quantitative guarantees for general quantum subspaces and connects their addressability to classical coding bounds.
The two constructions offer different parameter and construction-cost tradeoffs. Algebraic-geometric evaluation matrices give a uniform polynomial-time family. Random quadratic phases, coupled with exact verification, give a larger common rate–distance coefficient. The parity-code converse places both within a common framework and identifies how the physical digit structure limits the simultaneous rate and distance.
A natural next step is to combine these selectors with efficient decoding, low-weight error checks, and scalable syndrome extraction. For physical implementations, the simple transversal phase layer should be assessed together with encoding, recovery, connectivity, and a specified noise model. The explicit finite encoders provide concrete starting points for such studies. On the coding side, tighter error counting, improved inner encodings, and other physical addressing structures offer routes to narrowing the remaining gap between construction guarantees and converse bounds.
Acknowledgments
OpenAI’s GPT models were used to assist in developing proofs and searching for optimal code parameters. The authors take full responsibility for the results and proofs presented in this work. B.W. and T.L. acknowledge support from the National Natural Science Foundation of China (Grant No. 12405014).
Data availability
The data supporting the findings of this study are available from the authors upon reasonable request.
References
[22 ] The subscript h h h indicates that the hidden constant may depend on the fixed phase level h h h .
Supplemental Material
Supplemental Material for:
Substantially Improved Rate and Distance for Addressable Transversal Phase Gates
This Supplemental Material provides the proofs and construction details supporting the main text. Section S1 establishes addressability and derives error-compression identities for the encoding. Sections S2 and S3 develop the polynomial-time AG construction and the counting proof with exact exponential-time generation, respectively. Section S4 derives universal rate–distance upper bounds from addressability and stronger bounds for cyclic-digit encodings. Section S5 compares the parameter guarantees of prior constructions. Section S6 verifies the addressable logical gates and exact distances of the finite examples and describes an ancilla-free encoder for the 48-qubit code.
Encoding and logical phase gates
A binary quantum code ( ( N , 2 K , D ) ) 2 ((N,2^K,D))_2 (( N , 2 K , D ) ) 2 encodes K K K logical qubits into N N N physical qubits and has distance D D D . Its rate and relative distance are R = K / N R=K/N R = K / N and d = D / N d=D/N d = D / N .
A code projector P P P detects an operator O O O when P O P POP P O P is a scalar multiple of P P P . Equivalently, for an encoding isometry E E E with P = E E † P=EE^\dagger P = E E † , the compression E † O E E^\dagger O E E † O E must be a scalar multiple of the logical identity [19 ] . The distance is the minimum Pauli weight for which this fails. For N i → ∞ N_i\to\infty N i → ∞ , write
R ∞ = lim inf i K i / N i , d ∞ = lim inf i D i / N i , η = min { R ∞ , d ∞ } . R_\infty=\liminf_i K_i/N_i,\qquad d_\infty=\liminf_i D_i/N_i,\qquad\eta=\min\{R_\infty,d_\infty\}. R ∞ = i lim inf K i / N i , d ∞ = i lim inf D i / N i , η = min { R ∞ , d ∞ } .
Lower asymptotic targets R 0 , d 0 R_0,d_0 R 0 , d 0 mean R ∞ ≥ R 0 R_\infty\ge R_0 R ∞ ≥ R 0 and d ∞ ≥ d 0 d_\infty\ge d_0 d ∞ ≥ d 0 .
For an integer h ≥ 1 h\ge1 h ≥ 1 , the physical phase gate is
Z ( h ) = diag ( 1 , e 2 π i / 2 h ) . Z(h)=\operatorname{diag}(1,e^{2\pi i/2^h}). Z ( h ) = diag ( 1 , e 2 π i / 2 h ) .
Set
ν = 2 h , R h = Z / ν Z . \nu=2^h,\qquad\mathcal{R}_h=\mathbb{Z}/\nu\mathbb{Z}. ν = 2 h , R h = Z / ν Z .
The phase level h h h is fixed in every asymptotic family. Throughout, log \log log denotes the base-two logarithm and ln \ln ln the natural logarithm. Vectors are row vectors. We use addressability on a fixed encoding, as in Ref. [9 Definition 1.1] .
Definition S1 (Full addressability). An encoding isometry E : ( C 2 ) ⊗ K → ( C 2 ) ⊗ N E:(\mathbb{C}^2)^{\otimes K}\to(\mathbb{C}^2)^{\otimes N} E : ( C 2 ) ⊗ K → ( C 2 ) ⊗ N is fully addressable at level h h h if there is F ∈ R h K × N F\in\mathcal{R}_h^{K\times N} F ∈ R h K × N such that
( ⨂ j = 1 N Z ( h ) ( c F ) j ) E = E ( ⨂ ℓ = 1 K Z ( h ) c ℓ ) for every c ∈ R h K . (17) \left(\bigotimes_{j=1}^{N} Z(h)^{(cF)_j}\right)E
=
E\left(\bigotimes_{\ell=1}^{K} Z(h)^{c_\ell}\right)
\quad\text{for every }c\in\mathcal{R}_h^K. \tag*{(17)} ( j = 1 ⨂ N Z ( h ) ( c F ) j ) E = E ( ℓ = 1 ⨂ K Z ( h ) c ℓ ) for every c ∈ R h K . (17)
Physical powers, including inverse powers, are allowed. The encoding is fixed for every logical exponent vector c c c .
For y ∈ R h y\in\mathcal{R}_h y ∈ R h , its digit representation is dig ( y ) = ( y 0 , … , y h − 1 ) \operatorname{dig}(y)=(y_0,\ldots,y_{h-1}) dig ( y ) = ( y 0 , … , y h − 1 ) , where y = ∑ t = 0 h − 1 2 t y t y=\sum_{t=0}^{h-1}2^t y_t y = ∑ t = 0 h − 1 2 t y t and y t ∈ { 0 , 1 } y_t\in\{0,1\} y t ∈ { 0 , 1 } ; this convention is applied coordinatewise. Each ring coordinate is represented by a register of h h h physical qubits. We also use dig \operatorname{dig} dig for the linear isometry ∣ y ⟩ ↦ ∣ dig ( y ) ⟩ = ∣ y 0 , … , y h − 1 ⟩ |y\rangle\mapsto|\operatorname{dig}(y)\rangle=|y_0,\ldots,y_{h-1}\rangle ∣ y ⟩ ↦ ∣ dig ( y )⟩ = ∣ y 0 , … , y h − 1 ⟩ , applied independently to every ring register. We identify each ring register with its h h h -qubit digit representation and use the same notation for states and operators. On one such register define
X ν ( a ) ∣ y ⟩ = ∣ y + a ⟩ , Z ν ( b ) ∣ y ⟩ = e 2 π i b y / ν ∣ y ⟩ . X_\nu(a)|y\rangle=|y+a\rangle,\qquad Z_\nu(b)|y\rangle=e^{2\pi iby/\nu}|y\rangle. X ν ( a ) ∣ y ⟩ = ∣ y + a ⟩ , Z ν ( b ) ∣ y ⟩ = e 2 π ib y / ν ∣ y ⟩ .
For M M M ring registers and a , b ∈ R h M a,b\in\mathcal{R}_h^M a , b ∈ R h M , define W ( a , b ) = ⨂ j = 1 M X ν ( a j ) Z ν ( b j ) W(a,b)=\bigotimes_{j=1}^{M}X_\nu(a_j)Z_\nu(b_j) W ( a , b ) = ⨂ j = 1 M X ν ( a j ) Z ν ( b j ) . These operators form an orthogonal operator basis, including for composite ν \nu ν : Tr ( W ( a , b ) † W ( a ′ , b ′ ) ) = ν M 1 ( a , b ) = ( a ′ , b ′ ) \operatorname{Tr}(W(a,b)^\dagger W(a',b'))=\nu^M\mathbf{1}_{(a,b)=(a',b')} Tr ( W ( a , b ) † W ( a ′ , b ′ )) = ν M 1 ( a , b ) = ( a ′ , b ′ ) . This follows by first taking the trace of the shift, which vanishes unless a = a ′ a=a' a = a ′ , and then summing the remaining cyclic character. Every operator O O O therefore has the Weyl expansion
O = ν − M ∑ a , b Tr ( W ( a , b ) † O ) W ( a , b ) . (18) O=\nu^{-M}\sum_{a,b}\operatorname{Tr}(W(a,b)^\dagger O)W(a,b). \tag*{(18)} O = ν − M a , b ∑ Tr ( W ( a , b ) † O ) W ( a , b ) . (18)
The number of registers on which W ( a , b ) W(a,b) W ( a , b ) acts nontrivially is wts ( a , b ) = ∣ supp ( a ) ∪ supp ( b ) ∣ \operatorname{wts}(a,b)=|\operatorname{supp}(a)\cup\operatorname{supp}(b)| wts ( a , b ) = ∣ supp ( a ) ∪ supp ( b ) ∣ .
The following encoding will be used in both constructions. Choose B ∈ G L M ( R h ) B \in\mathrm{GL}_{M}(\mathcal{R}_{h}) B ∈ GL M ( R h ) , integers r r r , K K K with r + K ≤ M r+K \le M r + K ≤ M , and a symmetric matrix A A A over R h \mathcal{R}_{h} R h . Let G G G and L L L comprise the first r r r and next K K K rows of B B B . Put τ = e π i / ν \tau= e^{\pi i/\nu} τ = e π i / ν and define
E B , A ∣ x ⟩ = ν − r / 2 ∑ v ∈ R h r τ y A y T ∣ dig ( y ) ⟩ , y = v G + x L , x ∈ { 0 , 1 } K , (19) E_{B,A}|x\rangle= \nu^{-r/2} \sum_{v\in\mathcal{R}_{h}^{r}} \tau^{yAy^{\mathsf{T}}}|\operatorname{dig}(y)\rangle,\qquad y=vG+xL,\quad x\in\{0,1\}^{K}, \tag*{(19)} E B , A ∣ x ⟩ = ν − r /2 v ∈ R h r ∑ τ y A y T ∣ dig ( y )⟩ , y = v G + xL , x ∈ { 0 , 1 } K , (19)
where in the quadratic phase, we use integer representatives in { 0 , … , ν − 1 } \{0,\ldots,\nu-1\} { 0 , … , ν − 1 } for all entries of A A A and y y y . The output length is N = h M N=hM N = h M .
Lemma S1. Eq. (19) defines an isometry, and its addressing matrix is
F ℓ , ( j , t ) = 2 t ( B − 1 ) j , r + ℓ ( m o d ν ) , 1 ≤ ℓ ≤ K , 1 ≤ j ≤ M , 0 ≤ t < h . (20) F_{\ell,(j,t)} = 2^{t}(B^{-1})_{j,r+\ell}\pmod{\nu},\qquad1\le\ell\le K,\quad1\le j\le M,\quad0\le t<h. \tag*{(20)} F ℓ , ( j , t ) = 2 t ( B − 1 ) j , r + ℓ ( mod ν ) , 1 ≤ ℓ ≤ K , 1 ≤ j ≤ M , 0 ≤ t < h . (20) Let C 1 C_{1} C 1 be the row span of the first r + K r+K r + K rows of B B B over R h \mathcal{R}_{h} R h . For a , b ∈ R h M a,b\in\mathcal{R}_{h}^{M} a , b ∈ R h M and x , x ′ ∈ { 0 , 1 } K x,x'\in\{0,1\}^{K} x , x ′ ∈ { 0 , 1 } K , the matrix element ⟨ x ′ ∣ E B , A † W ( a , b ) E B , A ∣ x ⟩ \langle x'|E_{B,A}^{\dagger}W(a,b)E_{B,A}|x\rangle ⟨ x ′ ∣ E B , A † W ( a , b ) E B , A ∣ x ⟩ is nonzero if and only if
a ∈ C 1 , G ( b − a A ) T = 0 , x ′ − x = ( a B − 1 ) r + 1 : r + K over R h . (21) a\in C_{1},\qquad G(b-aA)^{\mathsf{T}}=0,\qquad x'-x=(aB^{-1})_{r+1:r+K}\quad\text{over }\mathcal{R}_{h}. \tag*{(21)} a ∈ C 1 , G ( b − a A ) T = 0 , x ′ − x = ( a B − 1 ) r + 1 : r + K over R h . (21) Proof. The first r + K r+K r + K rows of an invertible ring matrix are a free family. Consequently v ↦ v G + x L v\mapsto vG+xL v ↦ v G + xL is injective, and two retained binary labels give disjoint cosets. Each coset has ν r \nu^{r} ν r elements, and each amplitude has modulus ν − r / 2 \nu^{-r/2} ν − r /2 , proving orthonormality. If Q A ∣ y ⟩ = τ y A y T ∣ y ⟩ Q_{A}|y\rangle=\tau^{yAy^{\mathsf{T}}}|y\rangle Q A ∣ y ⟩ = τ y A y T ∣ y ⟩ , direct calculation gives
Q A † W ( a , b ) Q A = τ − a A a T W ( a , b − a A ) . (22) Q_{A}^{\dagger}W(a,b)Q_{A}=\tau^{-aAa^{\mathsf{T}}}W(a,b-aA). \tag*{(22)} Q A † W ( a , b ) Q A = τ − a A a T W ( a , b − a A ) . (22) Write γ = b − a A \gamma=b-aA γ = b − a A and q = a B − 1 q=aB^{-1} q = a B − 1 . Equality of supports requires q r + K + 1 : M = 0 q_{r+K+1:M}=0 q r + K + 1 : M = 0 and q r + 1 : r + K = x ′ − x q_{r+1:r+K}=x'-x q r + 1 : r + K = x ′ − x . Subject to these conditions, the remaining matrix element is
⟨ x ′ ∣ E B , A † W ( a , b ) E B , A ∣ x ⟩ = τ − a A a T e 2 π i γ ( x L ) T / ν ν − r ∑ v ∈ R h r e 2 π i γ ( v G ) T / ν . (23) \langle x'|E_{B,A}^{\dagger}W(a,b)E_{B,A}|x\rangle
=\tau^{-aAa^{\mathsf{T}}}e^{2\pi i\gamma(xL)^{\mathsf{T}}/\nu}
\nu^{-r}\sum_{v\in\mathcal{R}_{h}^{r}}e^{2\pi i\gamma(vG)^{\mathsf{T}}/\nu}. \tag*{(23)} ⟨ x ′ ∣ E B , A † W ( a , b ) E B , A ∣ x ⟩ = τ − a A a T e 2 π iγ ( xL ) T / ν ν − r v ∈ R h r ∑ e 2 π iγ ( v G ) T / ν . (23) The normalized character sum equals one if G γ T = 0 G\gamma^{\mathsf{T}}=0 G γ T = 0 and zero otherwise: a nonzero coefficient in any coordinate produces a vanishing geometric sum over that coordinate. This proves Eq. (21) over the cyclic ring.
Let z ℓ z_{\ell} z ℓ be row r + ℓ r+\ell r + ℓ of B − T B^{-\mathsf{T}} B − T . Then G z ℓ T = 0 Gz_{\ell}^{\mathsf{T}}=0 G z ℓ T = 0 and L z ℓ T = e ℓ T Lz_{\ell}^{\mathsf{T}}=e_{\ell}^{\mathsf{T}} L z ℓ T = e ℓ T . Consequently ⨂ j Z ν ( z ℓ , j ) \bigotimes_{j}Z_{\nu}(z_{\ell,j}) ⨂ j Z ν ( z ℓ , j ) has phase e 2 π i x ℓ / ν e^{2\pi ix_{\ell}/\nu} e 2 π i x ℓ / ν on every term of the encoded state. Finally,
Z ν ( a ) = ⨂ t = 0 h − 1 Z ( h ) 2 t a (24) Z_{\nu}(a)=\bigotimes_{t=0}^{h-1}Z(h)^{2^{t}a} \tag*{(24)} Z ν ( a ) = t = 0 ⨂ h − 1 Z ( h ) 2 t a (24) under the digit representation. This proves Eq. (20) and Eq. (17) ; the quadratic phase commutes with these gates.
The cyclic-digit class consists of the encodings in Eq. (19) with the addressing form in Eq. (20) . The upper bound for this class will use only that form, and therefore also applies to other encodings admitting such a matrix. The matrices compactly specify the encoding and its gates. For fixed h h h , reversible modular elimination implements y ↦ y B y\mapsto yB y ↦ y B with O ( M 2 ) O(M^{2}) O ( M 2 ) fixed-size arithmetic gates [21 Secs. III–IV] . The diagonal Q A Q_{A} Q A uses O ( M 2 ) O(M^{2}) O ( M 2 ) gates, each acting on at most two h h h -qubit registers. Hence an encoder of polynomial size is available once the matrices have been selected; the cost of selecting them is treated separately.
Polynomial-time algebraic-geometric construction
We give the ring-lifting and outer-code arguments used in § 2 A of the main text, then extend its inner encoding from eight registers to any positive even number m m m . This extension allows the comparison of fixed square binary fields. We finish with explicit tower parameters and the deterministic construction algorithm.
Ring lifting and the outer code
For a fixed partition of coordinates into blocks, block weight counts the blocks containing a nonzero coordinate. Write d b l ( C ) d_{\mathrm{bl}}(C) d bl ( C ) for the minimum nonzero block weight of a nonzero linear code C C C .
Lemma S2. Let B 2 ∈ G L M ( F 2 ) \mathbf{B}_2 \in\mathrm{GL}_M(\mathbb{F}_2) B 2 ∈ GL M ( F 2 ) and lift its zero-one entries to B ∈ G L M ( R h ) \mathbf{B} \in\mathrm{GL}_M(\mathcal{R}_h) B ∈ GL M ( R h ) . For 1 ≤ s < M 1 \leq s < M 1 ≤ s < M , let B s B_s B s and C s C_s C s be the binary and ring row spans of the first s s s rows. Then d b l ( C s ) = d b l ( B s ) d_{\mathrm{bl}}(C_s)=d_{\mathrm{bl}}(B_s) d bl ( C s ) = d bl ( B s ) , d b l ( C s ⊥ ) = d b l ( B s ⊥ ) d_{\mathrm{bl}}(C_s^\perp)=d_{\mathrm{bl}}(B_s^\perp) d bl ( C s ⊥ ) = d bl ( B s ⊥ ) , where the ring dual is C s ⊥ = { z ∈ R h M : c z T = 0 for every c ∈ C s } C_s^\perp=\{z\in\mathcal{R}_h^M:cz^{\mathsf T}=0\text{ for every }c\in C_s\} C s ⊥ = { z ∈ R h M : c z T = 0 for every c ∈ C s } , with the dot product computed modulo 2 h 2^h 2 h .
Proof. Since B m o d 2 \mathbf{B}\bmod2 B mod 2 is invertible, det B \det\mathbf{B} det B is odd and hence a unit in R h \mathcal{R}_h R h . Thus B \mathbf{B} B is invertible over R h \mathcal{R}_h R h .
Let G G G consist of the first s s s rows of B \mathbf{B} B , and write G 2 = G m o d 2 G_2=G\bmod2 G 2 = G mod 2 . These matrices generate C s C_s C s and B s B_s B s , respectively.
Take any nonzero codeword c ∈ C s c\in C_s c ∈ C s and write c = u G c=uG c = u G . Factor the largest common power of two from the coefficients: u = 2 k u ′ u=2^k u' u = 2 k u ′ , where 0 ≤ k < h 0\leq k<h 0 ≤ k < h and at least one entry of u ′ u' u ′ is odd. Set
w = u ′ G , b = w m o d 2 = ( u ′ m o d 2 ) G 2 . w=u'G,\qquad b=w\bmod2=(u'\bmod2)G_2. w = u ′ G , b = w mod 2 = ( u ′ mod 2 ) G 2 .
The rows of G 2 G_2 G 2 are linearly independent, so b b b is a nonzero codeword of B s B_s B s . Whenever b j = 1 b_j=1 b j = 1 , the coordinate w j w_j w j is odd, and therefore c j = 2 k w j c_j=2^k w_j c j = 2 k w j is nonzero modulo 2 h 2^h 2 h . Thus every nonzero block of b b b is also nonzero in c c c , giving
wt b l ( c ) ≥ wt b l ( b ) ≥ d b l ( B s ) . \operatorname{wt}_{\mathrm{bl}}(c)\geq\operatorname{wt}_{\mathrm{bl}}(b)\geq d_{\mathrm{bl}}(B_s). wt bl ( c ) ≥ wt bl ( b ) ≥ d bl ( B s ) .
Since this holds for every nonzero c ∈ C s c\in C_s c ∈ C s , d b l ( C s ) ≥ d b l ( B s ) d_{\mathrm{bl}}(C_s)\geq d_{\mathrm{bl}}(B_s) d bl ( C s ) ≥ d bl ( B s ) .
For the reverse inequality, choose a nonzero codeword b = α G 2 b=\alpha G_2 b = α G 2 of minimum block weight in B s B_s B s . Regard the entries of α \alpha α as 0 or 1 in R h \mathcal{R}_h R h and set
c ∗ = 2 h − 1 α G ∈ C s . c_* = 2^{h-1}\alpha G\in C_s. c ∗ = 2 h − 1 α G ∈ C s .
Because α G m o d 2 = b \alpha G\bmod2=b α G mod 2 = b , multiplication by 2 h − 1 2^{h-1} 2 h − 1 gives
( c ∗ ) j = { 0 , b j = 0 , 2 h − 1 , b j = 1. (c_*)_j=
\begin{cases}
0, & b_j=0,\\
2^{h-1}, & b_j=1.
\end{cases} ( c ∗ ) j = { 0 , 2 h − 1 , b j = 0 , b j = 1.
Hence c ∗ c_* c ∗ is nonzero and has exactly the same nonzero blocks as b b b . Consequently,
d b l ( C s ) ≤ wt b l ( c ∗ ) = d b l ( B s ) , d_{\mathrm{bl}}(C_s)\leq\operatorname{wt}_{\mathrm{bl}}(c_*)=d_{\mathrm{bl}}(B_s), d bl ( C s ) ≤ wt bl ( c ∗ ) = d bl ( B s ) ,
which proves the first equality.
For the dual codes, let H H H consist of the last M − s M-s M − s rows of B − T \mathbf{B}^{-\mathsf T} B − T . The identity B ( B − T ) T = I \mathbf{B}(\mathbf{B}^{-\mathsf T})^{\mathsf T}=I B ( B − T ) T = I shows that these rows form a basis of C s ⊥ C_s^\perp C s ⊥ . Moreover,
B − T m o d 2 = ( B m o d 2 ) − T , \mathbf{B}^{-\mathsf T}\bmod2=(\mathbf{B}\bmod2)^{-\mathsf T}, B − T mod 2 = ( B mod 2 ) − T ,
so the rows of H m o d 2 H\bmod2 H mod 2 form a basis of B s ⊥ B_s^\perp B s ⊥ . The preceding argument uses only the linear independence of the reduced rows, and therefore also applies to H H H . It gives d b l ( C s ⊥ ) = d b l ( B s ⊥ ) d_{\mathrm{bl}}(C_s^\perp)=d_{\mathrm{bl}}(B_s^\perp) d bl ( C s ⊥ ) = d bl ( B s ⊥ ) .
Let X / F 2 m X/\mathbb{F}_{2^m} X / F 2 m have genus g g g , a rational point P ∞ P_{\infty} P ∞ , and n n n other rational points with sum D \mathcal{D} D . For 2 g − 2 < a 0 < a 1 < n 2g-2<a_0<a_1<n 2 g − 2 < a 0 < a 1 < n , set
A b = C L ( D , a b P ∞ ) , b = 0 , 1. \mathcal{A}_b=\mathcal{C}_L(\mathcal{D},a_bP_{\infty}),\qquad b=0,1. A b = C L ( D , a b P ∞ ) , b = 0 , 1.
Expand them in a fixed binary basis to obtain B 0 ⊂ B 1 B_0\subset B_1 B 0 ⊂ B 1 , keeping the m m m coordinates of each field symbol in one block. Lift a complete basis adapted to B 0 ⊂ B 1 B_0\subset B_1 B 0 ⊂ B 1 to B o u t ∈ GL m n ( R h ) B_{\mathrm{out}}\in\operatorname{GL}_{mn}(\mathcal{R}_h) B out ∈ GL mn ( R h ) . Its first r o u t = m ( a 0 + 1 − g ) r_{\mathrm{out}}=m(a_0+1-g) r out = m ( a 0 + 1 − g ) rows form G G G , and its next K = m ( a 1 − a 0 ) K=m(a_1-a_0) K = m ( a 1 − a 0 ) rows form L L L . These dimensions follow from Riemann–Roch [20 ] .
Lemma S3. For G G G and L L L defined above, the encoding
E o u t ∣ x ⟩ = ν − r o u t / 2 ∑ v ∈ R h r o u t ∣ v G + x L ⟩ , x ∈ { 0 , 1 } K , (25) E_{\mathrm{out}}|x\rangle=\nu^{-r_{\mathrm{out}}/2}\sum_{v\in\mathcal{R}_h^{r_{\mathrm{out}}}}|vG+xL\rangle,\qquad x\in\{0,1\}^{K}, \tag*{(25)} E out ∣ x ⟩ = ν − r out /2 v ∈ R h r out ∑ ∣ v G + xL ⟩ , x ∈ { 0 , 1 } K , (25) detects every operator acting on fewer than
d ∗ = min { n − a 1 , a 0 + 2 − 2 g } (26) d_*=\min\{n-a_1,a_0+2-2g\} \tag*{(26)} d ∗ = min { n − a 1 , a 0 + 2 − 2 g } (26) blocks, where each block consists of the m m m ring registers associated with one field coordinate.
Proof. The rows of G G G and L L L belong to a basis of R h m n \mathcal{R}_h^{mn} R h mn , so distinct coefficient pairs ( v , x ) (v,x) ( v , x ) give distinct computational-basis states. The normalization in (25) therefore makes E o u t E_{\mathrm{out}} E out an isometry. If d ∗ = 1 d_*=1 d ∗ = 1 , the assertion concerns only scalar multiples of the identity and is immediate. Assume henceforth that d ∗ ≥ 2 d_*\ge2 d ∗ ≥ 2 .
We first obtain the two classical distance bounds needed for the proof. Let θ 1 , … , θ m \theta_1,\ldots,\theta_m θ 1 , … , θ m be the basis used to expand the field symbols, and let θ 1 ∗ , … , θ m ∗ \theta_1^*,\ldots,\theta_m^* θ 1 ∗ , … , θ m ∗ be its trace-dual basis [23 Chap. 2] : Tr ( θ j θ ℓ ∗ ) = δ j ℓ \operatorname{Tr}(\theta_j\theta_\ell^*)=\delta_{j\ell} Tr ( θ j θ ℓ ∗ ) = δ j ℓ , where Tr \operatorname{Tr} Tr is the field trace to F 2 \mathbb{F}_2 F 2 . For ξ = ∑ j ξ j θ j \xi=\sum_j\xi_j\theta_j ξ = ∑ j ξ j θ j and ζ = ∑ j ζ j θ j ∗ \zeta=\sum_j\zeta_j\theta_j^* ζ = ∑ j ζ j θ j ∗ , this gives
Tr ( ξ ζ ) = ∑ j ξ j ζ j . \operatorname{Tr}(\xi\zeta)=\sum_j\xi_j\zeta_j. Tr ( ξ ζ ) = j ∑ ξ j ζ j .
Applying this identity coordinatewise shows that expanding A 0 ⊥ \mathcal{A}_0^\perp A 0 ⊥ in the trace-dual basis gives binary vectors orthogonal to B 0 B_0 B 0 . The resulting binary code and B 0 ⊥ B_0^\perp B 0 ⊥ both have dimension m n − r o u t mn-r_{\mathrm{out}} mn − r out , so they are equal. In either basis, a field symbol is zero exactly when its binary block is zero. The standard AG distance bounds [20 Chap. 2] thus imply
d b l ( B 1 ) ≥ n − a 1 , d b l ( B 0 ⊥ ) ≥ a 0 + 2 − 2 g . d_{\mathrm{bl}}(B_1)\ge n-a_1,\qquad d_{\mathrm{bl}}(B_0^\perp)\ge a_0+2-2g. d bl ( B 1 ) ≥ n − a 1 , d bl ( B 0 ⊥ ) ≥ a 0 + 2 − 2 g .
By Lemma S2, every nonzero ring linear combination of the rows of G G G and L L L has at least n − a 1 n-a_1 n − a 1 nonzero blocks. Likewise, every nonzero ring vector b b b satisfying G b T = 0 Gb^{\mathsf{T}}=0 G b T = 0 has at least a 0 + 2 − 2 g a_0+2-2g a 0 + 2 − 2 g nonzero blocks.
Now consider a nonidentity Weyl operator W ( a , b ) W(a,b) W ( a , b ) acting on fewer than d ∗ d_* d ∗ blocks. Both a a a and b b b have block weight less than d ∗ d_* d ∗ .
If a ≠ 0 a\ne0 a = 0 , a nonzero matrix element between encoded basis states would require
v G + x L + a = v ′ G + x ′ L vG+xL+a=v'G+x'L v G + xL + a = v ′ G + x ′ L
for some v , v ′ , x , x ′ v,v',x,x' v , v ′ , x , x ′ . Equivalently,
a = ( v ′ − v ) G + ( x ′ − x ) L . a=(v'-v)G+(x'-x)L. a = ( v ′ − v ) G + ( x ′ − x ) L .
This would make a a a a nonzero ring linear combination of the rows of G G G and L L L with fewer than n − a 1 n-a_1 n − a 1 nonzero blocks, contradicting the distance bound. Hence
E o u t † W ( a , b ) E o u t = 0. E_{\mathrm{out}}^{\dagger}W(a,b)E_{\mathrm{out}}=0. E out † W ( a , b ) E out = 0.
If a = 0 a=0 a = 0 , then b ≠ 0 b\ne0 b = 0 . The second distance bound implies G b T ≠ 0 G b^{\mathsf T}\ne0 G b T = 0 . The operator W ( 0 , b ) W(0,b) W ( 0 , b ) is diagonal, and distinct encoded basis states have disjoint computational-basis supports, so all off-diagonal matrix elements vanish. Eq. (23) with A = 0 A=0 A = 0 and a = 0 a=0 a = 0 gives the diagonal matrix elements
⟨ x ∣ E o u t † W ( 0 , b ) E o u t ∣ x ⟩ = e 2 π i ( x L ) b T / ν ν r o u t ∑ v ∈ R h r o u t e 2 π i v G b T / ν . \langle x|E_{\mathrm{out}}^\dagger W(0,b)E_{\mathrm{out}}|x\rangle=\frac{e^{2\pi i(xL)b^{\mathsf T}/\nu}}{\nu^{r_{\mathrm{out}}}}\sum_{v\in\mathbb{R}_{h}^{r_{\mathrm{out}}}}e^{2\pi i vG b^{\mathsf T}/\nu}. ⟨ x ∣ E out † W ( 0 , b ) E out ∣ x ⟩ = ν r out e 2 π i ( xL ) b T / ν v ∈ R h r out ∑ e 2 π i v G b T / ν .
Since G b T G b^{\mathsf T} G b T has a nonzero coordinate, summing over the corresponding coordinate of v v v gives a vanishing geometric sum. Thus E o u t † W ( 0 , b ) E o u t = 0 E_{\mathrm{out}}^\dagger W(0,b)E_{\mathrm{out}}=0 E out † W ( 0 , b ) E out = 0 as well.
By Eq. (18) , every operator O O O on fewer than d ∗ d_* d ∗ blocks is a linear combination of Weyl operators on those same blocks. All nonidentity terms vanish between encoded states, while the identity term gives E o u t † E o u t = I E_{\mathrm{out}}^\dagger E_{\mathrm{out}}=I E out † E out = I . Consequently,
E o u t † O E o u t = λ O I , E_{\mathrm{out}}^\dagger O E_{\mathrm{out}}=\lambda_O I, E out † O E out = λ O I ,
which is precisely the error-detection condition. □ \square □
Inner encoding and concatenation
The outer bound of Lemma S3 counts affected field-coordinate blocks. We now encode each block to detect single-register errors while preserving the phase operations used for addressability.
For positive even m m m , set ϵ a = 1 \epsilon_a=1 ϵ a = 1 for a ≤ m / 2 a\le m/2 a ≤ m /2 and ϵ a = − 1 \epsilon_a=-1 ϵ a = − 1 otherwise. Thus ∑ a ϵ a = 0 \sum_a\epsilon_a=0 ∑ a ϵ a = 0 . For u ∈ R h m u\in\mathbb{R}_h^m u ∈ R h m , define
J m ∣ u ⟩ = ν − 1 / 2 ∑ t ∈ R h ∣ u 1 + t , … , u m + t , t , t − ∑ a = 1 m ϵ a u a ⟩ . (27) J_m|u\rangle=\nu^{-1/2}\sum_{t\in\mathbb{R}_h}|u_1+t,\ldots,u_m+t,t,t-\sum_{a=1}^{m}\epsilon_a u_a\rangle. \tag*{(27)} J m ∣ u ⟩ = ν − 1/2 t ∈ R h ∑ ∣ u 1 + t , … , u m + t , t , t − a = 1 ∑ m ϵ a u a ⟩ . (27)
All arithmetic is modulo ν \nu ν . This maps m m m ring registers to m + 2 m+2 m + 2 registers and reduces to the inner encoding of § 2 A of the main text at m = 8 m=8 m = 8 .
Lemma S4. The map J m J_m J m is an isometry with distance two, measured in ring registers. For z ∈ R h m z\in\mathbb{R}_h^m z ∈ R h m , put z ~ = ( z 1 , … , z m , − ∑ a z a , 0 ) \widetilde{z}=(z_1,\ldots,z_m,-\sum_a z_a,0) z = ( z 1 , … , z m , − ∑ a z a , 0 ) . Then
( ⨂ j = 1 m + 2 Z ν ( z ~ j ) ) J m = J m ( ⨂ a = 1 m Z ν ( z a ) ) . (28) \left(\bigotimes_{j=1}^{m+2}Z_\nu(\widetilde{z}_j)\right)J_m=J_m\left(\bigotimes_{a=1}^{m}Z_\nu(z_a)\right). \tag*{(28)} ( j = 1 ⨂ m + 2 Z ν ( z j ) ) J m = J m ( a = 1 ⨂ m Z ν ( z a ) ) . (28)
Proof. For fixed u u u and t t t , write the computational-basis label in Eq. (27) as
w = w ( u , t ) = ( w 1 , … , w m + 2 ) = ( u 1 + t , … , u m + t , t , t − ∑ a = 1 m ϵ a u a ) . w=w(u,t)=(w_1,\ldots,w_{m+2})=\left(u_1+t,\ldots,u_m+t,t,t-\sum_{a=1}^{m}\epsilon_a u_a\right). w = w ( u , t ) = ( w 1 , … , w m + 2 ) = ( u 1 + t , … , u m + t , t , t − a = 1 ∑ m ϵ a u a ) .
Its ( m + 1 ) (m+1) ( m + 1 ) st coordinate determines t t t , and then u a = w a − t u_a=w_a-t u a = w a − t recovers each input coordinate. Thus distinct pairs ( u , t ) (u,t) ( u , t ) give distinct basis states. Each encoded state contains ν \nu ν such states with amplitude ν − 1 / 2 \nu^{-1/2} ν − 1/2 , so the encoded basis states are orthonormal and J m J_m J m is an isometry.
We next prove detection of every single-register error. Since ∑ a ϵ a = 0 \sum_a\epsilon_a=0 ∑ a ϵ a = 0 , every basis label appearing in an encoded state satisfies
∑ a = 1 m ϵ a w a − w m + 1 + w m + 2 = 0 ( m o d ν ) . \sum_{a=1}^{m}\epsilon_a w_a-w_{m+1}+w_{m+2}=0\pmod{\nu}. a = 1 ∑ m ϵ a w a − w m + 1 + w m + 2 = 0 ( mod ν ) .
Consider a nonidentity Weyl operator Q Q Q acting on one output register, with shift parameter a a a and phase parameter b b b .
If a ≠ 0 a \ne0 a = 0 , the shift changes exactly one coordinate of w w w . Every coefficient in the displayed constraint is 1 or − 1 -1 − 1 , so its left-hand side changes by a a a or − a -a − a , which is nonzero modulo ν \nu ν . The shifted basis labels therefore cannot occur in any encoded state. Consequently,
J m † Q J m = 0. J_m^\dagger Q J_m = 0. J m † Q J m = 0.
If a = 0 a = 0 a = 0 , then b ≠ 0 b \ne0 b = 0 and Q Q Q is a phase operator on some register j j j . Distinct encoded basis states have disjoint supports, so all off-diagonal matrix elements vanish. For the diagonal elements, every output coordinate satisfies w j ( u , t ) = w j ( u , 0 ) + t w_j(u,t) = w_j(u,0) + t w j ( u , t ) = w j ( u , 0 ) + t , giving
⟨ u ∣ J m † Q J m ∣ u ⟩ = e 2 π i b w j ( u , 0 ) / ν ν ∑ t = 0 ν − 1 e 2 π i b t / ν = 0. \langle u|J_m^\dagger Q J_m|u\rangle= \frac{e^{2\pi i b w_j(u,0)/\nu}}{\nu}\sum_{t=0}^{\nu-1}e^{2\pi i b t/\nu}=0. ⟨ u ∣ J m † Q J m ∣ u ⟩ = ν e 2 π ib w j ( u , 0 ) / ν t = 0 ∑ ν − 1 e 2 π ib t / ν = 0.
The last equality follows because b ≠ 0 b \ne0 b = 0 modulo ν \nu ν . Hence J m † Q J m = 0 J_m^\dagger Q J_m = 0 J m † Q J m = 0 for every nonidentity single-register Weyl operator. Since these Weyl operators together with the identity span all single-register operators, every such operator O O O satisfies
J m † O J m = λ O I . J_m^\dagger O J_m = \lambda_O I. J m † O J m = λ O I .
Thus the register distance is at least two.
To prove Eq. (28) , evaluate the physical phase exponent on each basis label:
z ~ w ( u , t ) T = ∑ a = 1 m z a ( u a + t ) − ( ∑ a = 1 m z a ) t = ∑ a = 1 m z a u a . \begin{aligned}
\widetilde{z}w(u,t)^{\mathsf T}
= \sum_{a=1}^{m} z_a(u_a+t)-\left(\sum_{a=1}^{m}z_a\right)t \\
&= \sum_{a=1}^{m}z_a u_a.
\end{aligned} z w ( u , t ) T = a = 1 ∑ m z a ( u a + t ) − ( a = 1 ∑ m z a ) t = a = 1 ∑ m z a u a .
This exponent is independent of t t t . Every term in J m ∣ u ⟩ J_m|u\rangle J m ∣ u ⟩ therefore acquires the same phase, equal to the action of ⨂ a = 1 m Z ν ( z a ) \bigotimes_{a=1}^{m} Z_\nu(z_a) ⨂ a = 1 m Z ν ( z a ) on ∣ u ⟩ |u\rangle ∣ u ⟩ . This proves the claimed identity.
Finally, choose z = ( 1 , 0 , … , 0 ) z=(1,0,\ldots,0) z = ( 1 , 0 , … , 0 ) . The corresponding physical operator applies Z ν ( 1 ) Z_\nu(1) Z ν ( 1 ) to output register 1 and Z ν ( − 1 ) Z_\nu(-1) Z ν ( − 1 ) to output register m + 1 m+1 m + 1 , acting trivially elsewhere. By Eq. (28) , its action on the encoded inputs is Z ν ( 1 ) Z_\nu(1) Z ν ( 1 ) on the first input register. This two-register operator has a nonscalar logical action and therefore fails the error-detection condition. A code of register distance at least three would detect every two-register operator, so the distance is at most two. Together with single-register error detection, this proves that the register distance is exactly two.
Apply J m J_m J m to every outer block and use dig \operatorname{dig} dig to express its output registers as qubits. For a Pauli error, Lemma S4 implies that any inner block with nonscalar compression contains at least two affected qubits. Lemma S3 then gives the physical-qubit distance bound, while Eq. (28) preserves the logical phase operations.
Lemma S5. For even m m m , the binary quantum code defined by E = dig ∘ J m ⊗ n ∘ E o u t E=\operatorname{dig}\circ J_m^{\otimes n}\circ E_{\mathrm{out}} E = dig ∘ J m ⊗ n ∘ E out has full addressability in cyclic-digit form and parameters
N = h ( m + 2 ) n , K = m ( a 1 − a 0 ) , D ≥ 2 min { n − a 1 , a 0 + 2 − 2 g } . (29) N=h(m+2)n,\qquad K=m(a_1-a_0),\qquad D\ge2\min\{n-a_1,a_0+2-2g\}. \tag*{(29)} N = h ( m + 2 ) n , K = m ( a 1 − a 0 ) , D ≥ 2 min { n − a 1 , a 0 + 2 − 2 g } . (29)
Proof. Each stage of the encoding is an isometry. The inner encoding replaces each block of m m m ring registers by m + 2 m+2 m + 2 registers, each represented by h h h physical qubits. Thus N = h ( m + 2 ) n N=h(m+2)n N = h ( m + 2 ) n , while the number of logical qubits remains K = m ( a 1 − a 0 ) K=m(a_1-a_0) K = m ( a 1 − a 0 ) .
Let d ∗ d_{*} d ∗ be defined in Eq. (26) , and consider a physical Pauli operator Q Q Q of weight w < 2 d ∗ w < 2d_{*} w < 2 d ∗ . Group its action by inner blocks. Within any block containing at most one affected physical qubit, the error acts on at most one ring register. Lemma S4 therefore gives a scalar multiple of the identity under J m † ( ⋅ ) J m J_m^{\dagger}(\cdot)J_m J m † ( ⋅ ) J m . A nonscalar action can remain only in blocks containing at least two affected physical qubits, of which there are at most ⌊ w / 2 ⌋ < d ∗ \lfloor w/2 \rfloor< d_{*} ⌊ w /2 ⌋ < d ∗ . Lemma S3 detects every operator on these remaining blocks, so
E † Q E = λ Q I . E^{\dagger}QE = \lambda_Q I. E † QE = λ Q I .
Thus every physical Pauli operator of weight below 2 d ∗ 2d_{*} 2 d ∗ is detected, proving D ≥ 2 d ∗ D \ge2d_{*} D ≥ 2 d ∗ .
For addressability, let z ℓ T z_{\ell}^{\mathsf{T}} z ℓ T be column r o u t + ℓ r_{\mathrm{out}}+\ell r out + ℓ of B o u t − 1 B_{\mathrm{out}}^{-1} B out − 1 . The selector construction in Lemma S1 gives
( v G + x L ) z ℓ T = x ℓ , (vG+xL)z_{\ell}^{\mathsf{T}}=x_{\ell}, ( v G + xL ) z ℓ T = x ℓ ,
so the register phases with exponents z ℓ z_{\ell} z ℓ implement Z ( h ) Z(h) Z ( h ) on logical qubit ℓ \ell ℓ .
Partition z ℓ z_{\ell} z ℓ into blocks z ℓ , p ∈ R h m z_{\ell,p}\in\mathcal{R}_{h}^{m} z ℓ , p ∈ R h m and set
z ~ ℓ , p = ( z ℓ , p , − ∑ j = 1 m z ℓ , p , j , 0 ) . \widetilde{z}_{\ell,p}=\left(z_{\ell,p},-\sum_{j=1}^{m}z_{\ell,p,j},0\right). z ℓ , p = ( z ℓ , p , − j = 1 ∑ m z ℓ , p , j , 0 ) .
Eq. (28) preserves this logical action through the inner encoding. The digit-phase identity in Eq. (24) then gives the physical addressing matrix
F ℓ , ( p , j , b ) = 2 b z ~ ℓ , p , j ( m o d ν ) , (30) F_{\ell,(p,j,b)}=2^{b}\widetilde{z}_{\ell,p,j}\pmod{\nu}, \tag*{(30)} F ℓ , ( p , j , b ) = 2 b z ℓ , p , j ( mod ν ) , (30)
where 1 ≤ ℓ ≤ K 1\le\ell\le K 1 ≤ ℓ ≤ K , 1 ≤ p ≤ n 1\le p\le n 1 ≤ p ≤ n , 1 ≤ j ≤ m + 2 1\le j\le m+2 1 ≤ j ≤ m + 2 , 0 ≤ b < h 0\le b<h 0 ≤ b < h . For any c ∈ R h K c\in\mathcal{R}_{h}^{K} c ∈ R h K , combining these phase operations with exponents c ℓ c_{\ell} c ℓ gives physical exponents c F cF c F and logical exponents c c c , proving Eq. (17) .
Finally, introduce an auxiliary input v ∈ R h v\in\mathcal{R}_{h} v ∈ R h and consider the ring-linear map
( u 1 , … , u m , t , v ) ⟼ ( u 1 + t , … , u m + t , t , t − ∑ a = 1 m ϵ a u a + v ) . (31) (u_{1},\ldots,u_{m},t,v)\longmapsto\left(u_{1}+t,\ldots,u_{m}+t,t,t-\sum_{a=1}^{m}\epsilon_{a}u_{a}+v\right). \tag*{(31)} ( u 1 , … , u m , t , v ) ⟼ ( u 1 + t , … , u m + t , t , t − a = 1 ∑ m ϵ a u a + v ) . (31)
Output coordinate m + 1 m+1 m + 1 determines t t t , after which u u u and v v v are uniquely recovered. Thus Eq. (31) defines a unitary permutation of the computational basis. Preparing the two auxiliary registers in a uniform superposition and ∣ 0 ⟩ \lvert0\rangle ∣ 0 ⟩ , respectively, gives
∣ u ⟩ ⊗ ( ν − 1 / 2 ∑ t ∈ R h ∣ t ⟩ ) ⊗ ∣ 0 ⟩ \lvert u\rangle\otimes\left(\nu^{-1/2}\sum_{t\in\mathcal{R}_{h}}\lvert t\rangle\right)\otimes\lvert0\rangle ∣ u ⟩ ⊗ ( ν − 1/2 t ∈ R h ∑ ∣ t ⟩ ) ⊗ ∣ 0 ⟩
⟼ ν − 1 / 2 ∑ t ∈ R h ∣ u 1 + t , … , u m + t , t , t − ∑ a = 1 m ϵ a u a ⟩ = J m ∣ u ⟩ , \begin{aligned}
\longmapsto\nu^{-1/2}\sum_{t\in\mathcal{R}_{h}}\left\lvert u_{1}+t,\ldots,u_{m}+t,t,t-\sum_{a=1}^{m}\epsilon_{a}u_{a}\right\rangle\\
&=J_m\lvert u\rangle,
\end{aligned} ⟼ ν − 1/2 t ∈ R h ∑ u 1 + t , … , u m + t , t , t − a = 1 ∑ m ϵ a u a ⟩ = J m ∣ u ⟩ ,
where the last equality is the definition in Eq. (27) . By linearity, the same implementation applies to any input state. Composing these maps with B o u t B_{\mathrm{out}} B out and ordering the inputs as uniform, binary logical, and zero inputs gives Eq. (19) with
A = 0 , M = ( m + 2 ) n , r = r o u t + n , A=0,\qquad M=(m+2)n,\qquad r=r_{\mathrm{out}}+n, A = 0 , M = ( m + 2 ) n , r = r out + n ,
and K K K logical qubits.
Tower parameters and rate–distance bounds
Fix h ≥ 3 h \ge3 h ≥ 3 . We use the finite parameters in Eq. (29) to choose the AG degrees and derive the asymptotic guarantees. For a fixed positive even m m m , consider curves over F 2 m \mathbb{F}_{2^m} F 2 m with n i → ∞ n_i \to\infty n i → ∞ evaluation points and g i / n i → κ g_i/n_i \to\kappa g i / n i → κ . Choose constants 2 κ < β 0 < β 1 < 1 2\kappa< \beta_0 < \beta_1 < 1 2 κ < β 0 < β 1 < 1 and set a b , i = ⌊ β b n i ⌋ a_{b,i} = \lfloor\beta_b n_i \rfloor a b , i = ⌊ β b n i ⌋ for b = 0 , 1 b = 0,1 b = 0 , 1 . These degrees satisfy 2 g i − 2 < a 0 , i < a 1 , i < n i 2g_i - 2 < a_{0,i} < a_{1,i} < n_i 2 g i − 2 < a 0 , i < a 1 , i < n i for all sufficiently large i i i . Since rounding changes each normalized degree by less than 1 / n i 1/n_i 1/ n i , Eq. (29) gives
lim i K i N i = m ( β 1 − β 0 ) h ( m + 2 ) , lim inf i D i N i ≥ 2 min { 1 − β 1 , β 0 − 2 κ } h ( m + 2 ) . (32) \lim_{i} \frac{K_i}{N_i} = \frac{m(\beta_1-\beta_0)}{h(m+2)},
\qquad
\liminf_{i} \frac{D_i}{N_i} \ge\frac{2\min\{1-\beta_1,\beta_0-2\kappa\}}{h(m+2)}. \tag*{(32)} i lim N i K i = h ( m + 2 ) m ( β 1 − β 0 ) , i lim inf N i D i ≥ h ( m + 2 ) 2 min { 1 − β 1 , β 0 − 2 κ } . (32)
For the family constructed in § 2 A of the main text, take m = 8 m=8 m = 8 and the Garcia–Stichtenoth tower over F 256 \mathbb{F}_{256} F 256 [16 , 17 ] :
F 1 = F 256 ( x 1 ) , F i + 1 = F i ( x i + 1 ) , x i + 1 16 + x i + 1 = x i 16 x i 15 + 1 . F_1=\mathbb{F}_{256}(x_1), \qquad F_{i+1}=F_i(x_{i+1}), \qquad x_{i+1}^{16}+x_{i+1}=\frac{x_i^{16}}{x_i^{15}+1}. F 1 = F 256 ( x 1 ) , F i + 1 = F i ( x i + 1 ) , x i + 1 16 + x i + 1 = x i 15 + 1 x i 16 .
At level i ≥ 1 i \ge1 i ≥ 1 , the rational places above x 1 = α ∈ F 256 ∖ F 16 x_1=\alpha\in\mathbb{F}_{256}\setminus\mathbb{F}_{16} x 1 = α ∈ F 256 ∖ F 16 provide n i = 240 ⋅ 16 i − 1 n_i=240\cdot16^{i-1} n i = 240 ⋅ 1 6 i − 1 evaluation points. The unique pole P ∞ , i P_{\infty,i} P ∞ , i of x 1 x_1 x 1 is rational and lies outside this set. The genus is [16 , 17 ]
g i = { ( 16 i / 2 − 1 ) 2 , i even , ( 16 ( i + 1 ) / 2 − 1 ) ( 16 ( i − 1 ) / 2 − 1 ) , i odd . g_i =
\begin{cases}
(16^{i/2}-1)^2, & i\ \text{even},\\
(16^{(i+1)/2}-1)(16^{(i-1)/2}-1), & i\ \text{odd}.
\end{cases} g i = { ( 1 6 i /2 − 1 ) 2 , ( 1 6 ( i + 1 ) /2 − 1 ) ( 1 6 ( i − 1 ) /2 − 1 ) , i even , i odd .
Hence g i ≤ 16 i = n i / 15 g_i \le16^i=n_i/15 g i ≤ 1 6 i = n i /15 and g i / n i → 1 / 15 g_i/n_i \to1/15 g i / n i → 1/15 .
At m = 8 m=8 m = 8 and κ = 1 / 15 \kappa=1/15 κ = 1/15 , balancing the rate and the two distance terms in Eq. (32) requires
4 ( β 1 − β 0 ) = 1 − β 1 = β 0 − 2 / 15. 4(\beta_1-\beta_0)=1-\beta_1=\beta_0-2/15. 4 ( β 1 − β 0 ) = 1 − β 1 = β 0 − 2/15.
Solving gives β 0 = 70 / 135 \beta_0=70/135 β 0 = 70/135 and β 1 = 83 / 135 \beta_1=83/135 β 1 = 83/135 , so choose
a 0 , i = ⌊ 70 n i 135 ⌋ , a 1 , i = ⌊ 83 n i 135 ⌋ . (33) a_{0,i}=\left\lfloor\frac{70n_i}{135}\right\rfloor,\qquad
a_{1,i}=\left\lfloor\frac{83n_i}{135}\right\rfloor. \tag*{(33)} a 0 , i = ⌊ 135 70 n i ⌋ , a 1 , i = ⌊ 135 83 n i ⌋ . (33)
The genus bound and rounding give
a 1 , i − a 0 , i ≥ 13 n i 135 − 1 , a_{1,i}-a_{0,i}\ge\frac{13n_i}{135}-1, a 1 , i − a 0 , i ≥ 135 13 n i − 1 ,
n i − a 1 , i ≥ 52 n i 135 , n_i-a_{1,i}\ge\frac{52n_i}{135}, n i − a 1 , i ≥ 135 52 n i ,
a 0 , i + 2 − 2 g i ≥ 52 n i 135 + 1. a_{0,i}+2-2g_i\ge\frac{52n_i}{135}+1. a 0 , i + 2 − 2 g i ≥ 135 52 n i + 1.
Since n i ≥ 240 n_i\ge240 n i ≥ 240 , these inequalities also imply 2 g i − 2 < a 0 , i < a 1 , i < n i 2g_i-2<a_{0,i}<a_{1,i}<n_i 2 g i − 2 < a 0 , i < a 1 , i < n i for every i ≥ 1 i\ge1 i ≥ 1 . Substituting into Eq. (29) , with N i = 10 h n i N_i=10hn_i N i = 10 h n i , yields the finite-length guarantees
K i N i ≥ 52 675 h − 4 5 h n i , D i N i ≥ 52 675 h . \frac{K_i}{N_i}\ge\frac{52}{675h}-\frac{4}{5hn_i},
\qquad
\frac{D_i}{N_i}\ge\frac{52}{675h}. N i K i ≥ 675 h 52 − 5 h n i 4 , N i D i ≥ 675 h 52 .
Moreover, ( a 1 , i − a 0 , i ) / n i → 13 / 135 (a_{1,i}-a_{0,i})/n_i\to13/135 ( a 1 , i − a 0 , i ) / n i → 13/135 , so
lim i K i N i = 52 675 h , lim inf i D i N i ≥ 52 675 h . \lim_i\frac{K_i}{N_i}=\frac{52}{675h},
\qquad
\liminf_i\frac{D_i}{N_i}\ge\frac{52}{675h}. i lim N i K i = 675 h 52 , i lim inf N i D i ≥ 675 h 52 .
as stated in § 2 A of the main text. The encoding and addressing matrices are generated by the polynomial-time procedure in Sec. S2.4.
To obtain the rate–distance tradeoff, keep the same tower and choose
β 0 = 2 15 + τ d , β 1 = 1 − τ d , 0 < τ d < 13 30 . \beta_0 = \frac{2}{15}+\tau_d,\qquad\beta_1 = 1-\tau_d,\qquad0<\tau_d<\frac{13}{30}. β 0 = 15 2 + τ d , β 1 = 1 − τ d , 0 < τ d < 30 13 .
The two distance terms are then equal, and Eq. (32) becomes
R ∞ = 4 5 h ( 13 15 − 2 τ d ) , d ∞ ≥ τ d 5 h . R_\infty=\frac{4}{5h}\left(\frac{13}{15}-2\tau_d\right),\qquad d_\infty\geq\frac{\tau_d}{5h}. R ∞ = 5 h 4 ( 15 13 − 2 τ d ) , d ∞ ≥ 5 h τ d .
Thus a positive target pair ( R 0 , d 0 ) (R_0,d_0) ( R 0 , d 0 ) is attainable whenever
5 4 h R 0 + 10 h d 0 < 13 15 . (34) \frac{5}{4}hR_0+10hd_0<\frac{13}{15}. \tag*{(34)} 4 5 h R 0 + 10 h d 0 < 15 13 . (34)
Indeed, this condition makes the interval
5 h d 0 < τ d < 13 30 − 5 h 8 R 0 5hd_0<\tau_d<\frac{13}{30}-\frac{5h}{8}R_0 5 h d 0 < τ d < 30 13 − 8 5 h R 0
nonempty. Choosing a rational τ d \tau_d τ d in this interval and rounding the degrees as above makes both asymptotic guarantees strictly exceed their targets. The balanced choice is τ d = 52 / 135 \tau_d=52/135 τ d = 52/135 ; at h = 3 h=3 h = 3 its common guarantee is 52 / 2025 52/2025 52/2025 .
Finally, we compare the common guarantees supplied by Eq. (32) for fixed square binary fields. For a fixed genus ratio κ \kappa κ , both bounds can reach a coefficient η > 0 \eta>0 η > 0 only if
β 1 − β 0 ≥ h ( m + 2 ) m η , 1 − β 1 ≥ h ( m + 2 ) 2 η , β 0 − 2 κ ≥ h ( m + 2 ) 2 η . \beta_1-\beta_0\geq\frac{h(m+2)}{m}\eta,\qquad1-\beta_1\geq\frac{h(m+2)}{2}\eta,\qquad\beta_0-2\kappa\geq\frac{h(m+2)}{2}\eta. β 1 − β 0 ≥ m h ( m + 2 ) η , 1 − β 1 ≥ 2 h ( m + 2 ) η , β 0 − 2 κ ≥ 2 h ( m + 2 ) η .
The left sides sum to 1 − 2 κ 1-2\kappa 1 − 2 κ , so the largest common guarantee from these bounds is
η A G , m = m ( 1 − 2 κ ) h ( m + 1 ) ( m + 2 ) , 2 κ < 1. (35) \eta_{\mathrm{AG},m}=\frac{m(1-2\kappa)}{h(m+1)(m+2)},\qquad2\kappa<1. \tag*{(35)} η AG , m = h ( m + 1 ) ( m + 2 ) m ( 1 − 2 κ ) , 2 κ < 1. (35)
It is attained by taking β 0 = 2 κ + τ d \beta_0=2\kappa+\tau_d β 0 = 2 κ + τ d and β 1 = 1 − τ d \beta_1=1-\tau_d β 1 = 1 − τ d , where τ d = m ( 1 − 2 κ ) / ( 2 ( m + 1 ) ) \tau_d=m(1-2\kappa)/(2(m+1)) τ d = m ( 1 − 2 κ ) / ( 2 ( m + 1 )) ; all three inequalities then hold with equality.
The Drinfeld–Vlăduţ bound [26 ] gives κ ≥ ( 2 m / 2 − 1 ) − 1 \kappa\geq(2^{m/2}-1)^{-1} κ ≥ ( 2 m /2 − 1 ) − 1 . For m = 4 , 6 , 8 m=4,6,8 m = 4 , 6 , 8 , the resulting upper bounds on h η A G , m h\eta_{\mathrm{AG},m} h η AG , m are 2 / 45 2/45 2/45 , 15 / 196 15/196 15/196 , and 52 / 675 52/675 52/675 , respectively; m = 2 m=2 m = 2 cannot satisfy 2 κ < 1 2\kappa<1 2 κ < 1 . For every even m ≥ 10 m\geq10 m ≥ 10 ,
h η A G , m < m ( m + 1 ) ( m + 2 ) ≤ 5 66 < 52 675 . h\eta_{\mathrm{AG},m}<\frac{m}{(m+1)(m+2)}\leq\frac{5}{66}<\frac{52}{675}. h η AG , m < ( m + 1 ) ( m + 2 ) m ≤ 66 5 < 675 52 .
The F 256 \mathbb{F}_{256} F 256 tower attains κ = 1 / 15 \kappa=1/15 κ = 1/15 and therefore gives the largest common guarantee obtained from Eq. (32) with the inner encodings J m J_m J m over fixed square binary fields.
Polynomial-time generation
For the balanced family, the input is a fixed phase level h h h and a tower level i i i . The output is an encoding matrix, its addressing matrix F F F , and the certified parameters in Eq. (29) at m = 8 m=8 m = 8 .
Construct the F 256 \mathbb{F}_{256} F 256 tower curve, its n i n_i n i evaluation places and P ∞ , i P_{\infty,i} P ∞ , i , and choose the degrees in Eq. (33) .
Lift the basis to B o u t \mathrm{B}_{\mathrm{out}} B out over R h \mathcal{R}_h R h as in Lemma S2. Its first r o u t = 8 ( a 0 , i + 1 − g i ) r_{\mathrm{out}} = 8(a_{0,i} + 1 - g_i) r out = 8 ( a 0 , i + 1 − g i ) rows and next K i = 8 ( a 1 , i − a 0 , i ) K_i = 8(a_{1,i} - a_{0,i}) K i = 8 ( a 1 , i − a 0 , i ) rows define G G G and L L L . Compute the required columns of B o u t − 1 \mathrm{B}_{\mathrm{out}}^{-1} B out − 1 .
For each block, use the invertible ring-linear transformation defined in Eq. (31) with m = 8 m = 8 m = 8 . Extend the outer transformation defined by B o u t \mathrm{B}_{\mathrm{out}} B out by the identity on the auxiliary registers, and then apply these block transformations. Compute F F F using Eq. (30) .
The resulting cyclic encoding has A = 0 A = 0 A = 0 , M i = 10 n i M_i = 10n_i M i = 10 n i , r i = r o u t + n i r_i = r_{\mathrm{out}} + n_i r i = r out + n i , and N i = 10 h n i N_i = 10hn_i N i = 10 h n i . The deterministic algorithm of Shum et al. [18 ] computes the evaluation matrices in O ( n i 3 ( log n i ) 3 ) O(n_i^3(\log n_i)^3) O ( n i 3 ( log n i ) 3 ) field operations for this fixed field. Binary expansion, basis completion, ring-matrix inversion and composition are polynomial in n i n_i n i for fixed h h h . These operations therefore generate the encoding and addressing matrices deterministically in polynomial time in N i N_i N i . For each inner block, initialize two auxiliary registers in ∣ 0 ⟩ \lvert0 \rangle ∣ 0 ⟩ . Apply Hadamards to the h h h qubits of the first register to prepare the uniform t t t input. Then implement Eq. (31) with m = 8 m = 8 m = 8 by modular additions. Modular elimination and the inner linear maps also give an O h ( N i 2 ) O_h(N_i^2) O h ( N i 2 ) -size encoding circuit.
Counting proof and certified exponential construction
We prove existence by showing that a random encoding has positive probability of satisfying a sufficient condition for distance at least d d d . We derive this condition from the action of Weyl errors, and then use counting and entropy estimates to obtain the asymptotic rate and distance guarantees. The same condition provides exact verification for the exponential-time construction.
Throughout this section, 1 ≤ K < M 1 \le K < M 1 ≤ K < M , 1 ≤ d ≤ M 1 \le d \le M 1 ≤ d ≤ M , r = M − K r = M - K r = M − K , and ν = 2 h \nu= 2^h ν = 2 h . Choose B \mathrm{B} B uniformly from G L M ( R h ) \mathrm{GL}_M(\mathcal{R}_h) GL M ( R h ) and A A A independently and uniformly among symmetric matrices. Use these matrices in the encoding of Eq. (19) . The first r r r and last K K K rows of B \mathrm{B} B are G G G and L L L . A nonzero Weyl pair ( a , b ) (a,b) ( a , b ) has exact order 2 s 2^s 2 s if 2 s ( a , b ) = 0 2^s(a,b) = 0 2 s ( a , b ) = 0 but 2 s − 1 ( a , b ) ≠ 0 2^{s-1}(a,b) \ne0 2 s − 1 ( a , b ) = 0 . Equivalently, all coordinates are divisible by 2 h − s 2^{h-s} 2 h − s , and at least one resulting quotient is odd. We use the counting functions
B ( n , d ) = ∑ w = 1 d − 1 ( n w ) , B(n,d) = \sum_{w=1}^{d-1} \binom{n}{w}, B ( n , d ) = w = 1 ∑ d − 1 ( w n ) ,
V s ( M , d ) = ∑ w = 1 d − 1 ( 4 s − 1 ) w ( M w ) , V_s(M,d) = \sum_{w=1}^{d-1} (4^s - 1)^w \binom{M}{w}, V s ( M , d ) = w = 1 ∑ d − 1 ( 4 s − 1 ) w ( w M ) ,
W h ( M , d ) = ∑ w = 1 d − 1 [ z w ] ( 1 + c h z + ( 15 − c h ) z 2 ) M , c h = { 10 , h = 2 , 3 , 6 , h ≥ 4. (36) W_h(M,d) = \sum_{w=1}^{d-1} [z^w](1 + c_h z + (15-c_h)z^2)^M,\qquad c_h =
\begin{cases}
10, & h = 2,3,\\
6, & h \ge4.
\end{cases} \tag*{(36)} W h ( M , d ) = w = 1 ∑ d − 1 [ z w ] ( 1 + c h z + ( 15 − c h ) z 2 ) M , c h = { 10 , 6 , h = 2 , 3 , h ≥ 4. (36)
The last function is used for h ≥ 2 h \ge2 h ≥ 2 ; empty sums are zero.
Compression and a common probability bound
Here we derive the rejection test and a probability bound for each fixed Weyl pair. We start by applying Lemma S1 with r + K = M r + K = M r + K = M to determine when a Weyl operator has a nonzero matrix element between encoded states.
Lemma S6. For x , x ′ ∈ { 0 , 1 } K x,x' \in\{0,1\}^{K} x , x ′ ∈ { 0 , 1 } K , the matrix element ⟨ x ′ ∣ E † W ( a , b ) E ∣ x ⟩ \langle x'|E^{\dagger}W(a,b)E|x\rangle ⟨ x ′ ∣ E † W ( a , b ) E ∣ x ⟩ is nonzero if and only if
G ( b − a A ) T = 0 , ( a B − 1 ) r + 1 : M = x ′ − x . G(b-aA)^{\mathsf{T}}=0,\qquad(aB^{-1})_{r+1:M}=x'-x. G ( b − a A ) T = 0 , ( a B − 1 ) r + 1 : M = x ′ − x . Proof. Apply Lemma S1 with r + K = M r+K=M r + K = M . Since B is invertible, its rows span R h M \mathbb{R}^{M}_{h} R h M , so C 1 = R h M C_{1}=\mathbb{R}^{M}_{h} C 1 = R h M and the condition a ∈ C 1 a\in C_{1} a ∈ C 1 is automatic. The remaining two conditions are exactly those stated here.
For h ≥ 2 h\geq2 h ≥ 2 , reject a candidate matrix pair if some nonzero Weyl pair of cost below d d d satisfies G ( b − a A ) T = 0 G(b-aA)^{\mathsf{T}}=0 G ( b − a A ) T = 0 and, at exact order two, also satisfies ( a B − 1 ) r + 1 : M = 0 (aB^{-1})_{r+1:M}=0 ( a B − 1 ) r + 1 : M = 0 . The costs add over registers and are summarized in Table S1 , together with the counting and probability bounds proved below. Let reject denote the event that at least one such pair exists. At exact order two, the logical shift has entries in { 0 , 2 h − 1 } \{0,2^{h-1}\} { 0 , 2 h − 1 } and can equal a difference of binary labels only when it vanishes. For pairs of exact order at least four, we omit the logical-shift condition to simplify the sufficient test for D ≥ d D\geq d D ≥ d . Thus Lemma S6 implies that no rejection gives E † W ( a , b ) E = 0 E^{\dagger}W(a,b)E=0 E † W ( a , b ) E = 0 for every tested pair. Algorithm S1 implements this test.
Table S1. Costs and bounds for nonzero Weyl pairs of cost below d d d , for h ≥ 2 h\geq2 h ≥ 2 . The last column bounds the probability that a fixed pair triggers rejection. The bounds are proved in Lemmas S8–S10.
At exact order two, the cost equals the physical Pauli weight of W ( a , b ) W(a,b) W ( a , b ) . At higher orders, the cost is a lower bound on the weight of any qubit Pauli whose Weyl expansion contains the pair with a nonzero coefficient.
For order two, ( a , b ) = 2 h − 1 ( α , β ) (a,b)=2^{h-1}(\alpha,\beta) ( a , b ) = 2 h − 1 ( α , β ) with α , β ∈ F 2 M \alpha,\beta\in\mathbb{F}_{2}^{M} α , β ∈ F 2 M . For order four, write each local pair as ( a j , b j ) = 2 h − 2 ( α j , β j ) (a_j,b_j)=2^{h-2}(\alpha_j,\beta_j) ( a j , b j ) = 2 h − 2 ( α j , β j ) with α j , β j ∈ Z / 4 Z \alpha_j,\beta_j\in\mathbb{Z}/4\mathbb{Z} α j , β j ∈ Z /4 Z . Its cost is zero for ( 0 , 0 ) (0,0) ( 0 , 0 ) , one for labels in the set defined by Eq. (37) , and two otherwise.
The following estimate supplies the probability bound for each exact order.
Lemma S7. For a fixed Weyl pair ( a , b ) (a,b) ( a , b ) of exact order 2 s 2^s 2 s , 1 ≤ s ≤ h 1\leq s\leq h 1 ≤ s ≤ h ,
Pr [ G ( b − a A ) T = 0 ] ≤ 2 − s r . \Pr\left[G(b-aA)^{\mathsf{T}}=0\right]\leq2^{-sr}. Pr [ G ( b − a A ) T = 0 ] ≤ 2 − sr . Proof. Divide ( a , b ) (a,b) ( a , b ) by 2 h − s 2^{h-s} 2 h − s and reduce all matrices modulo 2 s 2^s 2 s . The reductions of B and A remain independent and uniform among invertible and symmetric matrices, respectively. Write the reduced pair as ( a ′ , b ′ ) (a',b') ( a ′ , b ′ ) ; at least one of its coordinates is odd.
Suppose a j ′ a'_j a j ′ is odd, hence invertible modulo 2 s 2^s 2 s . For any target vector w w w , choose the symmetric submatrix ( A k ℓ ) k , ℓ ≠ j (A_{k\ell})_{k,\ell\ne j} ( A k ℓ ) k , ℓ = j arbitrarily. For each ℓ ≠ j \ell\ne j ℓ = j , the equation
a j ′ A j ℓ = w ℓ − ∑ k ≠ j a k ′ A k ℓ a'_jA_{j\ell}=w_\ell-\sum_{k\ne j}a'_kA_{k\ell} a j ′ A j ℓ = w ℓ − k = j ∑ a k ′ A k ℓ uniquely determines A j ℓ = A ℓ j A_{j\ell}=A_{\ell j} A j ℓ = A ℓ j . The remaining equation ( a ′ A ) j = w j (a'A)_j=w_j ( a ′ A ) j = w j then uniquely determines A j j A_{jj} A j j . Thus exactly 2 s M ( M − 1 ) / 2 2^{sM(M-1)/2} 2 s M ( M − 1 ) /2 symmetric matrices satisfy a ′ A = w a'A=w a ′ A = w for each w w w , so a ′ A a'A a ′ A is uniformly distributed. Since A is independent of B, the vector γ = b ′ − a ′ A \gamma=b'-a'A γ = b ′ − a ′ A remains uniform for every fixed B.
Invertibility of B implies that B γ T B\gamma^{\mathsf{T}} B γ T is also uniform. The condition G γ T = 0 G\gamma^{\mathsf{T}}=0 G γ T = 0 fixes its first r r r coordinates to zero and leaves its last K K K coordinates arbitrary. Therefore
Pr [ G γ T = 0 ∣ B ] = 2 s K 2 s M = 2 − s r . \Pr\left[G\gamma^{\mathsf{T}}=0\mid B\right]=\frac{2^{sK}}{2^{sM}}=2^{-sr}. Pr [ G γ T = 0 ∣ B ] = 2 s M 2 sK = 2 − sr .
Otherwise, all coordinates of a ′ a' a ′ are even, while b ′ b' b ′ has an odd coordinate. For each fixed A A A , the vector γ = b ′ − a ′ A \gamma= b' - a'A γ = b ′ − a ′ A therefore has an odd coordinate.
For uniformly chosen invertible B B B , the vector B γ T B\gamma^{\mathsf{T}} B γ T is uniform among all vectors with at least one odd coordinate. Indeed, invertible row operations can transform any such vector into the first coordinate vector. Thus any two such outputs are related by an invertible matrix, and left multiplication by this matrix gives a bijection between the corresponding choices of B B B .
There are 2 s M − 2 ( s − 1 ) M 2^{sM} - 2^{(s-1)M} 2 s M − 2 ( s − 1 ) M possible outputs, excluding those whose coordinates are all even. The condition G γ T = 0 G\gamma^{\mathsf{T}} = 0 G γ T = 0 requires the first r r r coordinates to vanish, leaving K K K coordinates with at least one odd entry. Hence
Pr [ G γ T = 0 ∣ A ] = 2 s K − 2 ( s − 1 ) K 2 s M − 2 ( s − 1 ) M = 2 − s r 1 − 2 − K 1 − 2 − M < 2 − s r . \Pr[G\gamma^{\mathsf{T}} = 0 \mid A] = \frac{2^{sK} - 2^{(s-1)K}}{2^{sM} - 2^{(s-1)M}} = 2^{-sr}\frac{1 - 2^{-K}}{1 - 2^{-M}} < 2^{-sr}. Pr [ G γ T = 0 ∣ A ] = 2 s M − 2 ( s − 1 ) M 2 sK − 2 ( s − 1 ) K = 2 − sr 1 − 2 − M 1 − 2 − K < 2 − sr .
where the last inequality uses K < M K < M K < M .
This proves the bound in both cases.
Order-two errors
We now count Weyl errors of exact order two with weight below d d d and bound their rejection probabilities. The following lemma bounds the number of order-two Weyl errors of cost below d d d and their rejection probabilities, separately for α ≠ 0 \alpha\ne0 α = 0 and α = 0 \alpha= 0 α = 0 , where a = 2 h − 1 α a = 2^{h-1}\alpha a = 2 h − 1 α with α ∈ { 0 , 1 } M \alpha\in\{0,1\}^{M} α ∈ { 0 , 1 } M .
Lemma S8. For h ≥ 2 h \ge2 h ≥ 2 , write each Weyl pair of exact order two as ( a , b ) = 2 h − 1 ( α , β ) (a,b) = 2^{h-1}(\alpha,\beta) ( a , b ) = 2 h − 1 ( α , β ) with α , β ∈ { 0 , 1 } M \alpha,\beta\in\{0,1\}^{M} α , β ∈ { 0 , 1 } M . Among pairs with error weight wt ( α ) + wt ( β ) < d \operatorname{wt}(\alpha) + \operatorname{wt}(\beta) < d wt ( α ) + wt ( β ) < d , the cases α ≠ 0 \alpha\ne0 α = 0 and α = 0 \alpha= 0 α = 0 contain at most B ( 2 M , d ) B(2M,d) B ( 2 M , d ) and B ( M , d ) B(M,d) B ( M , d ) pairs, with rejection probabilities per pair at most 2 − M 2^{-M} 2 − M and 2 − r 2^{-r} 2 − r , respectively.
Proof. The operators X ν ( 2 h − 1 ) X_\nu(2^{h-1}) X ν ( 2 h − 1 ) and Z ν ( 2 h − 1 ) Z_\nu(2^{h-1}) Z ν ( 2 h − 1 ) act as X X X on the highest digit and Z Z Z on the lowest, respectively. These digits are distinct for h ≥ 2 h \ge2 h ≥ 2 , so W ( a , b ) W(a,b) W ( a , b ) is itself a qubit Pauli of weight wt ( α ) + wt ( β ) \operatorname{wt}(\alpha) + \operatorname{wt}(\beta) wt ( α ) + wt ( β ) . Pauli orthogonality implies that an order-two Weyl term appearing in a qubit Pauli P P P has cost wt ( P ) \operatorname{wt}(P) wt ( P ) . Thus every such term is tested when wt ( P ) < d \operatorname{wt}(P) < d wt ( P ) < d . Counting binary vectors of weight below d d d in 2 M 2M 2 M coordinates gives B ( 2 M , d ) B(2M,d) B ( 2 M , d ) ; when α = 0 \alpha= 0 α = 0 , only M M M coordinates remain, giving B ( M , d ) B(M,d) B ( M , d ) .
For α ≠ 0 \alpha\ne0 α = 0 , write B ‾ = B m o d 2 \overline{B} = B \bmod2 B = B mod 2 and q = α B ‾ − 1 q = \alpha\overline{B}^{-1} q = α B − 1 . At exact order two, Lemma S6 implies that nonzero compression requires ( a B ‾ − 1 ) r + 1 : M = 0 (a\overline{B}^{-1})_{r+1:M} = 0 ( a B − 1 ) r + 1 : M = 0 . Since a = 2 h − 1 α a = 2^{h-1}\alpha a = 2 h − 1 α , this condition is equivalent to q r + 1 : M = 0 q_{r+1:M} = 0 q r + 1 : M = 0 . Uniformity of B ‾ \overline{B} B among invertible binary matrices makes q q q uniform on F 2 M ∖ { 0 } \mathbb{F}_2^M \setminus\{0\} F 2 M ∖ { 0 } . Exactly 2 r − 1 2^r - 1 2 r − 1 of these vectors have their last K K K coordinates zero. Hence
Pr [ ( a B ‾ − 1 ) r + 1 : M = 0 ] = 2 r − 1 2 M − 1 < 2 − K . \Pr[(a\overline{B}^{-1})_{r+1:M} = 0] = \frac{2^r - 1}{2^M - 1} < 2^{-K}. Pr [( a B − 1 ) r + 1 : M = 0 ] = 2 M − 1 2 r − 1 < 2 − K .
For every fixed B B B , the proof of Lemma S7, with s = 1 s = 1 s = 1 and α ≠ 0 \alpha\ne0 α = 0 , gives
Pr [ G ( b − a A ) T = 0 ∣ B ] = 2 − r . \Pr[G(b-aA)^{\mathsf{T}} = 0 \mid B] = 2^{-r}. Pr [ G ( b − a A ) T = 0 ∣ B ] = 2 − r .
Since the shift condition depends only on $B,
Pr [ G ( b − a A ) T = 0 , ( a B ‾ − 1 ) r + 1 : M = 0 ] = 2 − r 2 r − 1 2 M − 1 < 2 − M . \begin{aligned}
\Pr[G(b-aA)^{\mathsf{T}} = 0,\ (a\overline{B}^{-1})_{r+1:M} = 0] \\
&= 2^{-r}\frac{2^r - 1}{2^M - 1} < 2^{-M}.
\end{aligned} Pr [ G ( b − a A ) T = 0 , ( a B − 1 ) r + 1 : M = 0 ] = 2 − r 2 M − 1 2 r − 1 < 2 − M .
For α = 0 \alpha= 0 α = 0 , we have a = 0 a = 0 a = 0 , so rejection requires only G b T = 0 Gb^{\mathsf{T}} = 0 G b T = 0 . Lemma S7 bounds this probability by 2 − r 2^{-r} 2 − r .
Order-four errors
We next bound the number of order-four Weyl terms that can appear in qubit Pauli errors of weight below d d d . The following lemma derives this bound from single-qubit expansions and bounds each term’s rejection probability using Lemma S7.
Lemma S9. For h ≥ 2 h \ge2 h ≥ 2 , there is a set of at most W h ( M , d ) W_h(M,d) W h ( M , d ) Weyl pairs of exact order four containing every such pair with a nonzero coefficient in the Weyl expansion of a qubit Pauli of weight below d d d . Each pair in this set triggers rejection with probability at most 2 − 2 r 2^{-2r} 2 − 2 r .
Proof. Write a local Weyl pair as ( a , b ) = 2 h − 2 ( α , β ) (a,b)=2^{h-2}(\alpha,\beta) ( a , b ) = 2 h − 2 ( α , β ) , with α , β ∈ Z 4 \alpha,\beta\in\mathbb{Z}_4 α , β ∈ Z 4 . Let A h A_h A h be the set of nonzero labels ( α , β ) (\alpha,\beta) ( α , β ) that occur with nonzero coefficient in a single-qubit Pauli expansion. For a Pauli P j P_j P j acting on digit j j j , where 0 ≤ j < h 0 \le j < h 0 ≤ j < h , Eq. (18) with M = 1 M=1 M = 1 gives the coefficient
1 ν Tr ( W ( a , b ) † P j ) = 1 ν ∑ y = 0 ν − 1 e − 2 π i β y / 4 ⟨ y + a ∣ P j ∣ y ⟩ . \frac{1}{\nu}\operatorname{Tr}\left(W(a,b)^\dagger P_j\right)=\frac{1}{\nu}\sum_{y=0}^{\nu-1}e^{-2\pi i\beta y/4}\langle y+a|P_j|y\rangle. ν 1 Tr ( W ( a , b ) † P j ) = ν 1 y = 0 ∑ ν − 1 e − 2 π i β y /4 ⟨ y + a ∣ P j ∣ y ⟩ .
We evaluate it using y = ∑ ℓ = 0 h − 1 2 ℓ y ℓ y=\sum_{\ell=0}^{h-1}2^\ell y_\ell y = ∑ ℓ = 0 h − 1 2 ℓ y ℓ , with y ℓ ∈ { 0 , 1 } y_\ell\in\{0,1\} y ℓ ∈ { 0 , 1 } .
For Z j Z_j Z j , a nonzero coefficient requires α = 0 \alpha=0 α = 0 . Since Z j ∣ y ⟩ = ( − 1 ) y j ∣ y ⟩ Z_j|y\rangle=(-1)^{y_j}|y\rangle Z j ∣ y ⟩ = ( − 1 ) y j ∣ y ⟩ , the coefficient then equals
1 ν ( 1 − e − 2 π i β 2 j / 4 ) ∏ 0 ≤ ℓ < h ℓ ≠ j ( 1 + e − 2 π i β 2 ℓ / 4 ) . \frac{1}{\nu}\left(1-e^{-2\pi i\beta2^j/4}\right)\prod_{\substack{0\le\ell<h\\\ell\ne j}}\left(1+e^{-2\pi i\beta2^\ell/4}\right). ν 1 ( 1 − e − 2 π i β 2 j /4 ) 0 ≤ ℓ < h ℓ = j ∏ ( 1 + e − 2 π i β 2 ℓ /4 ) .
It is nonzero exactly for ( j , β ) = ( 0 , 2 ) , ( 1 , 1 ) , ( 1 , 3 ) (j,\beta)=(0,2),(1,1),(1,3) ( j , β ) = ( 0 , 2 ) , ( 1 , 1 ) , ( 1 , 3 ) : for j ≥ 2 j\ge2 j ≥ 2 the first factor vanishes, and the cases j = 0 , 1 j=0,1 j = 0 , 1 follow by substituting β ∈ Z 4 \beta\in\mathbb{Z}_4 β ∈ Z 4 . Since every Z j Z_j Z j has α = 0 \alpha=0 α = 0 , these cases give the Weyl label ( α , β ) = ( 0 , 2 ) (\alpha,\beta)=(0,2) ( α , β ) = ( 0 , 2 ) for Z 0 Z_0 Z 0 , and the labels ( α , β ) = ( 0 , 1 ) , ( 0 , 3 ) (\alpha,\beta)=(0,1),(0,3) ( α , β ) = ( 0 , 1 ) , ( 0 , 3 ) for Z 1 Z_1 Z 1 .
For X j X_j X j and Y j Y_j Y j with j < h − 1 j<h-1 j < h − 1 , the possible shifts are a = ± 2 j a=\pm2^j a = ± 2 j . The condition a ≡ 0 ( m o d 2 h − 2 ) a\equiv0\pmod{2^{h-2}} a ≡ 0 ( mod 2 h − 2 ) therefore forces j = h − 2 j=h-2 j = h − 2 , giving α = 1 \alpha=1 α = 1 or 3 3 3 . For either shift, y j y_j y j is fixed. Summing over the remaining bits gives, up to a nonzero phase and the factor ν − 1 \nu^{-1} ν − 1 ,
∏ 0 ≤ ℓ < h ℓ ≠ h − 2 ( 1 + e − 2 π i β 2 ℓ / 4 ) . \prod_{\substack{0\le\ell<h\\\ell\ne h-2}}\left(1+e^{-2\pi i\beta2^\ell/4}\right). 0 ≤ ℓ < h ℓ = h − 2 ∏ ( 1 + e − 2 π i β 2 ℓ /4 ) .
The X j X_j X j and Y j Y_j Y j coefficients differ only by a nonzero phase, so both have the same allowed labels. For h = 2 h=2 h = 2 , this product is 1 + ( − 1 ) β 1+(-1)^\beta 1 + ( − 1 ) β ; for h = 3 h=3 h = 3 , it is 2 ( 1 + e − π i β / 2 ) 2(1+e^{-\pi i\beta/2}) 2 ( 1 + e − π i β /2 ) ; for h ≥ 4 h\ge4 h ≥ 4 , it is 2 h − 3 ( 1 + e − π i β / 2 ) ( 1 + ( − 1 ) β ) 2^{h-3}(1+e^{-\pi i\beta/2})(1+(-1)^\beta) 2 h − 3 ( 1 + e − π i β /2 ) ( 1 + ( − 1 ) β ) . Consequently, the allowed values are
α ∈ { 1 , 3 } , β ∈ { { 0 , 2 } , h = 2 , { 0 , 1 , 3 } , h = 3 , { 0 } , h ≥ 4. \alpha\in\{1,3\},\qquad
\beta\in
\begin{cases}
\{0,2\}, & h=2,\\
\{0,1,3\}, & h=3,\\
\{0\}, & h\ge4.
\end{cases} α ∈ { 1 , 3 } , β ∈ ⎩ ⎨ ⎧ { 0 , 2 } , { 0 , 1 , 3 } , { 0 } , h = 2 , h = 3 , h ≥ 4.
At the highest digit, X h − 1 = X ν ( 2 h − 1 ) X_{h-1}=X_\nu(2^{h-1}) X h − 1 = X ν ( 2 h − 1 ) gives ( α , β ) = ( 2 , 0 ) (\alpha,\beta)=(2,0) ( α , β ) = ( 2 , 0 ) . Since Y h − 1 = i X h − 1 Z h − 1 Y_{h-1}=iX_{h-1}Z_{h-1} Y h − 1 = i X h − 1 Z h − 1 , its allowed phase labels are those of Z h − 1 Z_{h-1} Z h − 1 found above. They exist only when h = 2 h=2 h = 2 and β ∈ { 1 , 3 } \beta\in\{1,3\} β ∈ { 1 , 3 } , giving the additional labels ( 2 , 1 ) , ( 2 , 3 ) (2,1),(2,3) ( 2 , 1 ) , ( 2 , 3 ) .
Combining the three cases gives
A h = { { ( 0 , 1 ) , ( 0 , 2 ) , ( 0 , 3 ) , ( 2 , 0 ) , ( 2 , 1 ) , ( 2 , 3 ) } ∪ { 1 , 3 } × { 0 , 2 } , h = 2 , { ( 0 , 1 ) , ( 0 , 2 ) , ( 0 , 3 ) , ( 2 , 0 ) } ∪ { 1 , 3 } × { 0 , 1 , 3 } , h = 3 , { 0 } × { 1 , 2 , 3 } ∪ { 1 , 2 , 3 } × { 0 } , h ≥ 4. (37) A_h=
\begin{cases}
\{(0,1),(0,2),(0,3),(2,0),(2,1),(2,3)\}\cup\{1,3\}\times\{0,2\}, & h=2,\\
\{(0,1),(0,2),(0,3),(2,0)\}\cup\{1,3\}\times\{0,1,3\}, & h=3,\\
\{0\}\times\{1,2,3\}\cup\{1,2,3\}\times\{0\}, & h\ge4.
\end{cases} \tag*{(37)} A h = ⎩ ⎨ ⎧ {( 0 , 1 ) , ( 0 , 2 ) , ( 0 , 3 ) , ( 2 , 0 ) , ( 2 , 1 ) , ( 2 , 3 )} ∪ { 1 , 3 } × { 0 , 2 } , {( 0 , 1 ) , ( 0 , 2 ) , ( 0 , 3 ) , ( 2 , 0 )} ∪ { 1 , 3 } × { 0 , 1 , 3 } , { 0 } × { 1 , 2 , 3 } ∪ { 1 , 2 , 3 } × { 0 } , h = 2 , h = 3 , h ≥ 4. (37)
The groups with α = 0 \alpha= 0 α = 0 , α = 2 \alpha= 2 α = 2 , and α ∈ { 1 , 3 } \alpha\in\{1,3\} α ∈ { 1 , 3 } are disjoint. Counting their labels yields
c h = ∣ A h ∣ = { 3 + 3 + 4 = 10 , h = 2 , 3 + 1 + 6 = 10 , h = 3 , 3 + 1 + 2 = 6 , h ≥ 4. c_h = |\mathcal{A}_h| =
\begin{cases}
3+3+4=10, & h=2,\\
3+1+6=10, & h=3,\\
3+1+2=6, & h\geq4.
\end{cases} c h = ∣ A h ∣ = ⎩ ⎨ ⎧ 3 + 3 + 4 = 10 , 3 + 1 + 6 = 10 , 3 + 1 + 2 = 6 , h = 2 , h = 3 , h ≥ 4.
For counting, assign local weight zero to the identity, one to pairs in A h \mathcal{A}_h A h , and two to the remaining nonzero pairs. A pair outside A h \mathcal{A}_h A h cannot occur in a one-qubit Pauli expansion. Hence the assigned weight of any local term is at most the physical Pauli weight producing it. Since Weyl expansions factor over registers, every term in a Pauli error of weight below d d d has total assigned weight below d d d .
Each register has one pair of weight zero, c h c_h c h pairs of weight one, and 15 − c h 15-c_h 15 − c h pairs of weight two. Consequently, the number of pairs of exact order four with total assigned weight below d d d is at most
∑ w = 1 d − 1 [ z w ] ( 1 + c h z + ( 15 − c h ) z 2 ) M = W h ( M , d ) . \sum_{w=1}^{d-1}[z^w]\left(1+c_hz+(15-c_h)z^2\right)^M = W_h(M,d). w = 1 ∑ d − 1 [ z w ] ( 1 + c h z + ( 15 − c h ) z 2 ) M = W h ( M , d ) .
This count may also include pairs of order two, which only increases the upper bound. For every pair of exact order four, Lemma S7 with s = 2 s=2 s = 2 gives rejection probability at most 2 − 2 r 2^{-2r} 2 − 2 r .
Higher-order errors
For 3 ≤ s ≤ h 3\leq s\leq h 3 ≤ s ≤ h , the following lemma bounds the number of Weyl errors of exact order 2 s 2^s 2 s supported on fewer than d d d registers and their rejection probabilities.
Lemma S10. For $3\leq s\leq h$, give a Weyl pair cost equal to its number of nonzero registers. At most V s ( M , d ) V_s(M,d) V s ( M , d ) pairs of exact order 2 s 2^s 2 s have cost below d d d , each with rejection probability at most 2 − s r 2^{-sr} 2 − sr . Every order-2 s 2^s 2 s Weyl term in a qubit Pauli of weight below d d d has cost below $d.
Proof. A qubit Pauli of weight below d d d touches fewer than d d d registers. Its Weyl expansion is the identity on every untouched register, so each term has cost below d d d . For support size w w w , choose the registers in ( M w ) \binom{M}{w} ( w M ) ways and a nonzero local pair in ( 4 s − 1 ) w (4^s-1)^w ( 4 s − 1 ) w ways. Summing over 1 ≤ w < d 1\leq w<d 1 ≤ w < d gives V s ( M , d ) V_s(M,d) V s ( M , d ) . This count includes pairs of smaller order and therefore bounds the number of pairs of exact order 2 s 2^s 2 s with cost below d d d . For those pairs, Lemma S7 gives the rejection bound 2 − s r 2^{-sr} 2 − sr .
The total rejection bound
Combining the three error classes gives the finite rejection bound.
Lemma S11. For h ≥ 2 h\geq2 h ≥ 2 , the rejection probability is at most
Φ h ( M , K , d ) : = 2 − M B ( 2 M , d ) + 2 − r B ( M , d ) + 2 − 2 r W h ( M , d ) + ∑ s = 3 h 2 − s r V s ( M , d ) . (38) \Phi_h(M,K,d) := 2^{-M}B(2M,d)+2^{-r}B(M,d)+2^{-2r}W_h(M,d)+\sum_{s=3}^{h}2^{-sr}V_s(M,d). \tag*{(38)} Φ h ( M , K , d ) := 2 − M B ( 2 M , d ) + 2 − r B ( M , d ) + 2 − 2 r W h ( M , d ) + s = 3 ∑ h 2 − sr V s ( M , d ) . (38) For h = 1 h=1 h = 1 , the corresponding bound is
Φ 1 ( M , K , d ) : = 2 − r ∑ w = 1 d − 1 3 w ( M w ) . (39) \Phi_1(M,K,d) := 2^{-r}\sum_{w=1}^{d-1}3^w\binom{M}{w}. \tag*{(39)} Φ 1 ( M , K , d ) := 2 − r w = 1 ∑ d − 1 3 w ( w M ) . (39)
In either case, if Φ h < 1 \Phi_h < 1 Φ h < 1 , some matrix pair triggers no rejection and defines a fully addressable code with N = h M N = hM N = h M and D ≥ d D \ge d D ≥ d .
Proof. For h ≥ 2 h \ge2 h ≥ 2 , the union bound applied to Lemmas S8–S10 gives Pr ( r e j e c t ) ≤ Φ h \Pr(\mathrm{reject}) \le\Phi_h Pr ( reject ) ≤ Φ h . If Φ h < 1 \Phi_h < 1 Φ h < 1 , the probability of no rejection is positive. Choose a matrix pair for which no rejection occurs.
Let P P P be a nonidentity qubit Pauli of weight below d d d . Its identity Weyl coefficient is ν − M Tr P = 0 \nu^{-M}\operatorname{Tr} P = 0 ν − M Tr P = 0 by Eq. (18) . Lemmas S8–S10 ensure that every remaining Weyl term with nonzero coefficient satisfies the weight restriction for its order. Since no rejection occurs, Lemma S6 gives E † W ( a , b ) E = 0 E^\dagger W(a,b)E = 0 E † W ( a , b ) E = 0 for each such term. Linearity then yields E † P E = 0 E^\dagger P E = 0 E † P E = 0 , proving D ≥ d D \ge d D ≥ d . Lemma S1 gives full addressability with N = h M N = hM N = h M .
For h = 1 h = 1 h = 1 , each register is one qubit, and the Pauli weight of ( a , b ) (a,b) ( a , b ) is ∣ supp ( a ) ∪ supp ( b ) ∣ |\operatorname{supp}(a) \cup\operatorname{supp}(b)| ∣ supp ( a ) ∪ supp ( b ) ∣ . Reject a candidate if some nonzero Pauli pair of weight below d d d satisfies G ( b − a A ) T = 0 G(b-aA)^{\mathsf T} = 0 G ( b − a A ) T = 0 . There are 3 w ( M w ) 3^w\binom{M}{w} 3 w ( w M ) Pauli pairs of weight w w w , so Lemma S7 with s = 1 s = 1 s = 1 and the union bound give Pr ( r e j e c t ) ≤ Φ 1 \Pr(\mathrm{reject}) \le\Phi_1 Pr ( reject ) ≤ Φ 1 . If Φ 1 < 1 \Phi_1 < 1 Φ 1 < 1 , some matrix pair triggers no rejection. For this pair, every nonzero Pauli pair of weight below d d d satisfies G ( b − a A ) T ≠ 0 G(b-aA)^{\mathsf T} \ne0 G ( b − a A ) T = 0 . Lemma S6 therefore gives E † W ( a , b ) E = 0 E^\dagger W(a,b)E = 0 E † W ( a , b ) E = 0 , proving D ≥ d D \ge d D ≥ d . Lemma S1 gives full addressability with N = M N = M N = M .
We next show that the rejection bound decays exponentially when K K K and d d d grow proportionally to M M M . Let
H 2 ( t ) = − t log 2 t − ( 1 − t ) log 2 ( 1 − t ) , t ⋆ = 2 H 2 − 1 ( 1 / 2 ) . H_2(t) = -t\log_2 t - (1-t)\log_2(1-t), \qquad t_\star= 2H_2^{-1}(1/2). H 2 ( t ) = − t log 2 t − ( 1 − t ) log 2 ( 1 − t ) , t ⋆ = 2 H 2 − 1 ( 1/2 ) .
where the inverse is taken on [ 0 , 1 / 2 ] [0,1/2] [ 0 , 1/2 ] .
Lemma S12. Fix h ≥ 2 h \ge2 h ≥ 2 and 0 < t < t ⋆ 0 < t < t_\star 0 < t < t ⋆ . There exist constants c > 0 c > 0 c > 0 and M 0 M_0 M 0 , depending only on h , t h,t h , t , such that, for every M ≥ M 0 M \ge M_0 M ≥ M 0 and K = d = ⌈ t M ⌉ K = d = \lceil tM\rceil K = d = ⌈ tM ⌉ ,
Φ h ( M , K , d ) ≤ 2 − c M . \Phi_h(M,K,d) \le2^{-cM}. Φ h ( M , K , d ) ≤ 2 − c M .
Proof. Put K = d = ⌈ t M ⌉ K = d = \lceil tM\rceil K = d = ⌈ tM ⌉ and r = M − K r = M-K r = M − K . Then d − 1 < t M d-1 < tM d − 1 < tM and r > ( 1 − t ) M − 1 r > (1-t)M-1 r > ( 1 − t ) M − 1 . We bound each of the four contributions in Eq. (38) separately and show that each decays exponentially in M M M .
The standard binary Hamming-ball estimate [24 ] gives
B ( 2 M , d ) ≤ 2 2 M H 2 ( t / 2 ) , B ( M , d ) ≤ 2 M H 2 ( t ) . B(2M,d) \le2^{2M H_2(t/2)}, \qquad B(M,d) \le2^{M H_2(t)}. B ( 2 M , d ) ≤ 2 2 M H 2 ( t /2 ) , B ( M , d ) ≤ 2 M H 2 ( t ) .
For the first term, corresponding to order two with α ≠ 0 \alpha\ne0 α = 0 ,
2 − M B ( 2 M , d ) ≤ 2 − M [ 1 − 2 H 2 ( t / 2 ) ] . 2^{-M}B(2M,d) \le2^{-M[1-2H_2(t/2)]}. 2 − M B ( 2 M , d ) ≤ 2 − M [ 1 − 2 H 2 ( t /2 )] .
The decay rate 1 − 2 H 2 ( t / 2 ) 1-2H_2(t/2) 1 − 2 H 2 ( t /2 ) is positive because t < t ⋆ t < t_\star t < t ⋆ .
For the second term, corresponding to order two with α = 0 \alpha= 0 α = 0 , the same Hamming-ball estimate, together with r > ( 1 − t ) M − 1 r > (1-t)M-1 r > ( 1 − t ) M − 1 , gives
2 − r B ( M , d ) ≤ 2 ⋅ 2 − M [ 1 − t − H 2 ( t ) ] . 2^{-r}B(M,d) \le2 \cdot2^{-M[1-t-H_2(t)]}. 2 − r B ( M , d ) ≤ 2 ⋅ 2 − M [ 1 − t − H 2 ( t )] .
To verify positivity of this decay rate, put t ˉ = p / q = 221 / 1000 \bar{t} = p/q = 221/1000 t ˉ = p / q = 221/1000 . The exact integer comparisons
( 2 q ) 2 q > 2 4 q p p ( 2 q − p ) 2 q − p , q q < 2 q − p p p ( q − p ) q − p (2q)^{2q} > 2^{4q}p^p(2q-p)^{2q-p}, \qquad q^q < 2^{q-p}p^p(q-p)^{q-p} ( 2 q ) 2 q > 2 4 q p p ( 2 q − p ) 2 q − p , q q < 2 q − p p p ( q − p ) q − p
give 2 H 2 ( t ˉ / 2 ) > 1 2H_2(\bar{t}/2) > 1 2 H 2 ( t ˉ /2 ) > 1 and t ˉ + H 2 ( t ˉ ) < 1 \bar{t}+H_2(\bar{t}) < 1 t ˉ + H 2 ( t ˉ ) < 1 . Thus t < t ⋆ < t ˉ t < t_\star< \bar{t} t < t ⋆ < t ˉ , and monotonicity of t + H 2 ( t ) t+H_2(t) t + H 2 ( t ) on ( 0 , 1 / 2 ) (0,1/2) ( 0 , 1/2 ) gives 1 − t − H 2 ( t ) > 0 1-t-H_2(t) > 0 1 − t − H 2 ( t ) > 0 . For the third term, corresponding to order four, let P h ( z ) = 1 + c h z + ( 15 − c h ) z 2 P_h(z)=1+c_hz+(15-c_h)z^2 P h ( z ) = 1 + c h z + ( 15 − c h ) z 2 be the polynomial defining W h W_h W h in Eq. (36) . For 0 < x < 1 0<x<1 0 < x < 1 and w < d w<d w < d , we have x w ≥ x t M x^w\ge x^{tM} x w ≥ x tM . Since the coefficients of P h ( z ) M P_h(z)^M P h ( z ) M are nonnegative,
W h ( M , d ) = ∑ w = 1 d − 1 [ z w ] P h ( z ) M ≤ x − t M P h ( x ) M . W_h(M,d)=\sum_{w=1}^{d-1}[z^w]P_h(z)^M\le x^{-tM}P_h(x)^M. W h ( M , d ) = w = 1 ∑ d − 1 [ z w ] P h ( z ) M ≤ x − tM P h ( x ) M .
Choose x = 1 / 36 x=1/36 x = 1/36 . For both possible values c h = 6 , 10 c_h=6,10 c h = 6 , 10 ,
P h ( 1 / 36 ) ≤ 1 + 10 36 + 5 36 2 = 1661 1296 . P_h(1/36)\le1+\frac{10}{36}+\frac{5}{36^2}=\frac{1661}{1296}. P h ( 1/36 ) ≤ 1 + 36 10 + 3 6 2 5 = 1296 1661 .
Consequently,
2 − 2 r W h ( M , d ) ≤ 4 2 − M [ 2 − 2 t − log 2 ( 1661 / 1296 ) − t log 2 36 ] . 2^{-2r}W_h(M,d)\le4\,2^{-M[2-2t-\log_2(1661/1296)-t\log_2 36]}. 2 − 2 r W h ( M , d ) ≤ 4 2 − M [ 2 − 2 t − l o g 2 ( 1661/1296 ) − t l o g 2 36 ] .
The exact comparison
1661 q 36 p < 2 2 ( q − p ) 1296 q 1661^q36^p<2^{2(q-p)}1296^q 166 1 q 3 6 p < 2 2 ( q − p ) 129 6 q
shows that 2 t ˉ + log 2 ( 1661 / 1296 ) + t ˉ log 2 36 < 2 2\bar{t}+\log_2(1661/1296)+\bar{t}\log_2 36<2 2 t ˉ + log 2 ( 1661/1296 ) + t ˉ log 2 36 < 2 . Monotonicity in t t t then gives a positive decay rate for every t < t ⋆ t<t_\star t < t ⋆ .
For the fourth contribution, fix 3 ≤ s ≤ h 3\le s\le h 3 ≤ s ≤ h . Since w ≤ d − 1 < t M w\le d-1<tM w ≤ d − 1 < tM in this sum,
V s ( M , d ) ≤ ( 4 s − 1 ) t M B ( M , d ) ≤ 2 M [ H 2 ( t ) + t log 2 ( 4 s − 1 ) ] . V_s(M,d)\le(4^s-1)^{tM}B(M,d)\le2^{M[H_2(t)+t\log_2(4^s-1)]}. V s ( M , d ) ≤ ( 4 s − 1 ) tM B ( M , d ) ≤ 2 M [ H 2 ( t ) + t l o g 2 ( 4 s − 1 )] .
It follows that
2 − s r V s ( M , d ) ≤ 2 s 2 − M [ s − s t − H 2 ( t ) − t log 2 ( 4 s − 1 ) ] . 2^{-sr}V_s(M,d)\le2^s2^{-M[s-st-H_2(t)-t\log_2(4^s-1)]}. 2 − sr V s ( M , d ) ≤ 2 s 2 − M [ s − s t − H 2 ( t ) − t l o g 2 ( 4 s − 1 )] .
Using H 2 ( t ) ≤ 1 H_2(t)\le1 H 2 ( t ) ≤ 1 , log 2 ( 4 s − 1 ) < 2 s \log_2(4^s-1)<2s log 2 ( 4 s − 1 ) < 2 s , and t ≤ t ˉ < 2 / 9 t\le\bar{t}<2/9 t ≤ t ˉ < 2/9 , we obtain
s t + H 2 ( t ) + t log 2 ( 4 s − 1 ) < 3 s t + 1 < 2 s 3 + 1 ≤ s . st+H_2(t)+t\log_2(4^s-1)<3st+1<\frac{2s}{3}+1\le s. s t + H 2 ( t ) + t log 2 ( 4 s − 1 ) < 3 s t + 1 < 3 2 s + 1 ≤ s .
Thus every higher-order term also has a positive decay rate. This contribution is absent when h = 2 h=2 h = 2 .
Finally, let δ > 0 \delta>0 δ > 0 be the minimum of the decay rates in these bounds. It depends only on h , t h,t h , t . The prefactors sum to 1 + 2 + 4 + ∑ s = 3 h 2 s = 2 h + 1 − 1 1+2+4+\sum_{s=3}^h2^s=2^{h+1}-1 1 + 2 + 4 + ∑ s = 3 h 2 s = 2 h + 1 − 1 , so
Φ h ( M , K , d ) ≤ ( 2 h + 1 − 1 ) 2 − δ M . \Phi_h(M,K,d)\le(2^{h+1}-1)2^{-\delta M}. Φ h ( M , K , d ) ≤ ( 2 h + 1 − 1 ) 2 − δ M .
Set c = δ / 2 c=\delta/2 c = δ /2 and choose M 0 M_0 M 0 large enough that K < M K<M K < M and 2 h + 1 − 1 ≤ 2 c M 2^{h+1}-1\le2^{cM} 2 h + 1 − 1 ≤ 2 c M for every M ≥ M 0 M\ge M_0 M ≥ M 0 . Then Φ h ( M , K , d ) ≤ 2 − c M \Phi_h(M,K,d)\le2^{-cM} Φ h ( M , K , d ) ≤ 2 − c M , as claimed.
Exponential-time construction algorithm
For fixed h ≥ 2 h\ge2 h ≥ 2 and each i ≥ 3 i\ge3 i ≥ 3 , let t i t_i t i be the largest integer multiple of 2 − i 2^{-i} 2 − i satisfying 0 < t i < 1 / 2 0<t_i<1/2 0 < t i < 1/2 and 2 H 2 ( t i / 2 ) < 1 2H_2(t_i/2)<1 2 H 2 ( t i /2 ) < 1 . These values satisfy 0 < t i < t ⋆ 0<t_i<t_\star 0 < t i < t ⋆ and form a sequence converging to t ⋆ t_\star t ⋆ . To determine t i t_i t i exactly, write t i = μ i / q i t_i=\mu_i/q_i t i = μ i / q i , where q i = 2 i q_i=2^i q i = 2 i and μ i ∈ { 1 , … , q i / 2 − 1 } \mu_i\in\{1,\ldots,q_i/2-1\} μ i ∈ { 1 , … , q i /2 − 1 } , and test 2 H 2 ( t i / 2 ) < 1 2H_2(t_i/2)<1 2 H 2 ( t i /2 ) < 1 using the equivalent integer comparison
( 2 q i ) 2 q i < 2 q i μ i 2 q i ( 2 q i − μ i ) 2 q i − μ i . (2q_i)^{2q_i}<2^{q_i}\mu_i^{2q_i}(2q_i-\mu_i)^{2q_i-\mu_i}. ( 2 q i ) 2 q i < 2 q i μ i 2 q i ( 2 q i − μ i ) 2 q i − μ i .
With this t i t_i t i fixed, search M = 2 i , 2 i + 1 , … M = 2^i, 2^i + 1, \ldots M = 2 i , 2 i + 1 , … and set K = d = ⌈ t i M ⌉ K = d = \lceil t_i M\rceil K = d = ⌈ t i M ⌉ at each length; the first triple satisfying Φ h ( M , K , d ) < 1 / 2 \Phi_h(M,K,d) < 1/2 Φ h ( M , K , d ) < 1/2 is denoted by ( M i , K i , d i ) (M_i,K_i,d_i) ( M i , K i , d i ) . For each fixed i i i , Lemma S12 guarantees that the search stops at a finite length M i M_i M i . The additional condition M i ≥ 2 i M_i \ge2^i M i ≥ 2 i ensures that the selected code lengths N i = h M i N_i = hM_i N i = h M i tend to infinity as i → ∞ i \to\infty i → ∞ .
By Lemma S11, these parameters admit codes with D i ≥ d i D_i \ge d_i D i ≥ d i . Since K i = d i = ⌈ t i M i ⌉ K_i = d_i = \lceil t_iM_i\rceil K i = d i = ⌈ t i M i ⌉ and t i → t ⋆ t_i \to t_\star t i → t ⋆ ,
K i N i = d i N i = t i h + O ( M i − 1 ) ⟶ t ⋆ h . (40) \frac{K_i}{N_i} = \frac{d_i}{N_i} = \frac{t_i}{h} + O(M_i^{-1}) \longrightarrow\frac{t_\star}{h}. \tag*{(40)} N i K i = N i d i = h t i + O ( M i − 1 ) ⟶ h t ⋆ . (40)
Thus,
R ∞ = t ⋆ h , d ∞ ≥ t ⋆ h . (41) R_\infty= \frac{t_\star}{h}, \qquad d_\infty\ge\frac{t_\star}{h}. \tag*{(41)} R ∞ = h t ⋆ , d ∞ ≥ h t ⋆ . (41)
Since H 2 ( t i / 2 ) H_2(t_i/2) H 2 ( t i /2 ) increases with t i t_i t i , the search over μ i \mu_i μ i can use binary search. Its operands have O ( 2 i ) O(2^i) O ( 2 i ) bits, polynomial in M i M_i M i . Evaluation of Φ h \Phi_h Φ h uses integer polynomial arithmetic with O h ( M i ) O_h(M_i) O h ( M i ) -bit coefficients. Searching the dyadic grid and scanning lengths through M i M_i M i therefore take polynomial time and space in the output blocklength N i N_i N i .
For S S S (h = 2 h = 2 h = 2 ), the same construction gives H 2 − 1 ( 1 / 2 ) H_2^{-1}(1/2) H 2 − 1 ( 1/2 ) .
For Z Z Z (h = 1 h = 1 h = 1 ), the Hamming-ball estimate in Eq. (39) instead gives R 0 + H 2 ( d 0 ) + d 0 log 2 3 < 1 R_0 + H_2(d_0) + d_0\log_2 3 < 1 R 0 + H 2 ( d 0 ) + d 0 log 2 3 < 1 . The balanced endpoint is the root β ⋆ ∈ ( 0 , 1 / 2 ) \beta_\star\in(0,1/2) β ⋆ ∈ ( 0 , 1/2 ) of β ⋆ + H 2 ( β ⋆ ) + β ⋆ log 2 3 = 1 \beta_\star+ H_2(\beta_\star) + \beta_\star\log_2 3 = 1 β ⋆ + H 2 ( β ⋆ ) + β ⋆ log 2 3 = 1 . Here, the dyadic construction instead selects the largest t i = μ i / q i ∈ ( 0 , 1 / 2 ) t_i = \mu_i/q_i \in(0,1/2) t i = μ i / q i ∈ ( 0 , 1/2 ) satisfying
q i q i 3 μ i < 2 q i − μ i μ i μ i ( q i − μ i ) q i − μ i , q_i^{q_i}3^{\mu_i} < 2^{q_i-\mu_i}\mu_i^{\mu_i}(q_i-\mu_i)^{q_i-\mu_i}, q i q i 3 μ i < 2 q i − μ i μ i μ i ( q i − μ i ) q i − μ i ,
which is exactly the strict balanced inequality. Then, t i → β ⋆ t_i \to\beta_\star t i → β ⋆ , and the same argument gives R ∞ = β ⋆ R_\infty= \beta_\star R ∞ = β ⋆ and d ∞ ≥ β ⋆ d_\infty\ge\beta_\star d ∞ ≥ β ⋆ .
Given h h h and the selected parameters ( M i , K i , d i ) (M_i,K_i,d_i) ( M i , K i , d i ) , Algorithm S1 enumerates candidate matrix pairs and checks the rejection conditions exactly. The returned matrices B B B , A A A , F F F specify a fully addressable code with N i = h M i N_i = hM_i N i = h M i , K i K_i K i logical qubits, and D i ≥ d i D_i \ge d_i D i ≥ d i .
Lemma S11 proves termination and correctness. There are at most 2 h [ M 2 + M ( M + 1 ) / 2 ] 2^{h[M^2+M(M+1)/2]} 2 h [ M 2 + M ( M + 1 ) /2 ] candidate matrix pairs. For each candidate, enumerating all 2 2 h M 2^{2hM} 2 2 h M Weyl pairs, computing their orders and costs, and checking the rejection conditions take 2 O h ( M ) 2^{O_h(M)} 2 O h ( M ) time, since each pair requires only polynomial modular-arithmetic work. The deterministic running time is therefore 2 O h ( N 2 ) 2^{O_h(N^2)} 2 O h ( N 2 ) . Processing one Weyl pair at a time uses polynomial working space. A uniformly sampled admissible matrix pair triggers no rejection with probability at least 1 − Φ h 1-\Phi_h 1 − Φ h . At the selected lengths, Φ h < 1 / 2 \Phi_h < 1/2 Φ h < 1/2 , so fewer than two admissible matrix pairs are needed on average, giving expected time 2 O h ( N ) 2^{O_h(N)} 2 O h ( N ) . To sample B B B uniformly from the invertible matrices, sample its entries independently and repeat if its binary reduction is singular. Counting linearly independent columns over F 2 \mathbb{F}_2 F 2 shows that a uniformly sampled ring matrix is invertible with probability ∏ j = 1 M ( 1 − 2 − j ) > 1 / 4 \prod_{j=1}^{M}(1-2^{-j}) > 1/4 ∏ j = 1 M ( 1 − 2 − j ) > 1/4 , and conditioning on invertibility gives the uniform distribution. This sampling step has polynomial expected cost. Synthesis of the resulting encoder and computation of arbitrary logical phase powers are polynomial in N N N by the implementation described in Sec. S1.
Algorithm S1. Exact code construction in exponential time
Input: fixed h h h and integers M , K , d M,K,d M , K , d for which Φ h ( M , K , d ) < 1 \Phi_h(M,K,d)<1 Φ h ( M , K , d ) < 1 .
Output: matrices B , A , F \mathrm{B},\mathrm{A},\mathrm{F} B , A , F specifying a fully addressable ( ( h M , 2 K , ≥ d ) 2 ) ((hM,2^K,\ge d)_2) (( h M , 2 K , ≥ d ) 2 ) code.
Set r = M − K r=M-K r = M − K . Enumerate matrices B \mathrm{B} B and symmetric A \mathrm{A} A over R h \mathcal{R}_h R h in lexicographic order. Discard B \mathrm{B} B unless B m o d 2 \mathrm{B}\bmod2 B mod 2 is invertible, and otherwise set G = B 1 : r , : G=\mathrm{B}_{1:r,:} G = B 1 : r , : and compute B − 1 \mathrm{B}^{-1} B − 1 .
Enumerate nonzero Weyl pairs ( a , b ) (a,b) ( a , b ) one at a time and determine their exact orders 2 s 2^s 2 s . Retain only pairs of total cost below d d d . For h ≥ 2 h\ge2 h ≥ 2 , at s = 1 s=1 s = 1 use wt ( α ) + wt ( β ) \operatorname{wt}(\alpha)+\operatorname{wt}(\beta) wt ( α ) + wt ( β ) for ( a , b ) = 2 h − 1 ( α , β ) (a,b)=2^{h-1}(\alpha,\beta) ( a , b ) = 2 h − 1 ( α , β ) ; at s = 2 s=2 s = 2 use the local costs defined in the proof of Lemma S9; at s ≥ 3 s\ge3 s ≥ 3 use wt s ( a , b ) \operatorname{wt}_s(a,b) wt s ( a , b ) , the number of affected h h h -qubit registers. For h = 1 h=1 h = 1 , use binary symplectic weight.
For h ≥ 2 h\ge2 h ≥ 2 and s = 1 s=1 s = 1 , skip a Weyl pair if ( a B − 1 ) r + 1 : M ≠ 0 (a\mathrm{B}^{-1})_{r+1:M}\ne0 ( a B − 1 ) r + 1 : M = 0 . For every remaining pair, reject the candidate matrices when G ( b − a A ) T = 0 ( m o d 2 h ) G(b-a\mathrm{A})^{\mathsf T}=0\pmod{2^h} G ( b − a A ) T = 0 ( mod 2 h ) .
Return the first matrix pair for which no Weyl pair triggers rejection, using Eq. (19) and the addressing matrix in Eq. (20) .
Rate-distance upper bounds from addressability
Let A 2 ( n , d ) A_2(n,d) A 2 ( n , d ) be the largest cardinality of a binary classical code of length n n n and minimum distance at least d d d . A code of cardinality 2 k 2^k 2 k has encoding rate k / n k/n k / n . Thus, the largest rate at these parameters is n − 1 log 2 A 2 ( n , d ) n^{-1}\log_2 A_2(n,d) n − 1 log 2 A 2 ( n , d ) . The corresponding asymptotic encoding rate function at relative distance t t t is
R 2 ( t ) = lim sup n → ∞ 1 n log 2 A 2 ( n , ⌈ t n ⌉ ) , 0 ≤ t ≤ 1 2 . (42) R_2(t)=\limsup_{n\to\infty}\frac{1}{n}\log_2 A_2(n,\lceil tn\rceil),\qquad0\le t\le\frac{1}{2}. \tag*{(42)} R 2 ( t ) = n → ∞ lim sup n 1 log 2 A 2 ( n , ⌈ t n ⌉) , 0 ≤ t ≤ 2 1 . (42)
Define
H ( x ) = H 2 ( 1 − 1 − x 2 ) , \mathcal{H}(x)=H_2\left(\frac{1-\sqrt{1-x}}{2}\right), H ( x ) = H 2 ( 2 1 − 1 − x ) ,
U ( t ) = min 1 − 2 t ≤ u ≤ 1 { H ( u 2 ) − H ( u ( u − 1 + 2 t ) ) } , 0 < t < 1 2 . (43) \mathcal{U}(t)=\min_{1-2t\le u\le1}\left\{\mathcal{H}(u^2)-\mathcal{H}\left(u(u-1+2t)\right)\right\},\qquad0<t<\frac{1}{2}. \tag*{(43)} U ( t ) = 1 − 2 t ≤ u ≤ 1 min { H ( u 2 ) − H ( u ( u − 1 + 2 t ) ) } , 0 < t < 2 1 . (43)
where H 2 ( p ) = − p log 2 p − ( 1 − p ) log 2 ( 1 − p ) H_2(p)=-p\log_2p-(1-p)\log_2(1-p) H 2 ( p ) = − p log 2 p − ( 1 − p ) log 2 ( 1 − p ) is the binary entropy function. Corollary 23 of Alrabiah and Guruswami [25 ] gives the asymptotic upper bound R 2 ( t ) ≤ U ( t ) R_2(t)\le\mathcal{U}(t) R 2 ( t ) ≤ U ( t ) for 0 < t < 1 / 2 0<t<1/2 0 < t < 1/2 . Minimizing over u u u in Eq. (43) gives U ( t ) \mathcal{U}(t) U ( t ) . The substitution u = 1 − 2 t + 2 t s u=1-2t+2ts u = 1 − 2 t + 2 t s , where s ∈ [ 0 , 1 ] s\in[0,1] s ∈ [ 0 , 1 ] , expresses the minimum over a fixed compact interval with a jointly continuous objective. Thus, U \mathcal{U} U extends continuously to [ 0 , 1 / 2 ] [0,1/2] [ 0 , 1/2 ] , with U ( 0 ) = 1 \mathcal{U}(0)=1 U ( 0 ) = 1 and U ( 1 / 2 ) = 0 \mathcal{U}(1/2)=0 U ( 1/2 ) = 0 .
This bound also applies to arbitrary code families whose relative distances are specified by a lower limit. Consider binary classical codes with lengths n i → ∞ n_i\to\infty n i → ∞ , cardinalities 2 k i 2^{k_i} 2 k i , and minimum distances Δ i \Delta_i Δ i . If lim inf i Δ i / n i ≥ t \liminf_i\Delta_i/n_i\ge t lim inf i Δ i / n i ≥ t for 0 < t ≤ 1 / 2 0<t\le1/2 0 < t ≤ 1/2 , then for every 0 < ϵ < t 0<\epsilon<t 0 < ϵ < t we have Δ i / n i ≥ t − ϵ \Delta_i/n_i\ge t-\epsilon Δ i / n i ≥ t − ϵ for all sufficiently large i i i . Consequently, 2 k i ≤ A 2 ( n i , ⌈ ( t − ϵ ) n i ⌉ ) 2^{k_i}\le A_2(n_i,\lceil(t-\epsilon)n_i\rceil) 2 k i ≤ A 2 ( n i , ⌈( t − ϵ ) n i ⌉) for these indices. Taking the upper limit gives lim sup i k i / n i ≤ R 2 ( t − ϵ ) ≤ U ( t − ϵ ) \limsup_i k_i/n_i\le R_2(t-\epsilon)\le\mathcal{U}(t-\epsilon) lim sup i k i / n i ≤ R 2 ( t − ϵ ) ≤ U ( t − ϵ ) . Letting ϵ ↓ 0 \epsilon\downarrow0 ϵ ↓ 0 and using continuity yields
lim sup i k i n i ≤ U ( t ) if lim inf i Δ i n i ≥ t , 0 ≤ t ≤ 1 2 . (44) \limsup_i\frac{k_i}{n_i}\le\mathcal{U}(t)\quad\text{if}\quad\liminf_i\frac{\Delta_i}{n_i}\ge t,\qquad0\le t\le\frac{1}{2}. \tag*{(44)} i lim sup n i k i ≤ U ( t ) if i lim inf n i Δ i ≥ t , 0 ≤ t ≤ 2 1 . (44)
For t = 0 t=0 t = 0 , the same bound follows directly from 2 k i ≤ 2 n i 2^{k_i}\le2^{n_i} 2 k i ≤ 2 n i and U ( 0 ) = 1 \mathcal{U}(0)=1 U ( 0 ) = 1 .
To apply this bound to fully addressable quantum codes, we extract a classical binary code from the addressing matrix. The following theorem shows that this code has dimension K K K and minimum distance at least D D D , thereby relating the classical rate bound to the quantum code parameters.
Theorem S1. Let E E E be an encoding isometry for a ( ( N , 2 K , D ) ) 2 ((N,2^{K},D))_{2} (( N , 2 K , D ) ) 2 code with K ≥ 1 K \ge1 K ≥ 1 . Suppose that E E E is fully addressable at level h ≥ 1 h \ge1 h ≥ 1 , with addressing matrix F F F , in the sense of Definition S1. Let s F s_{F} s F denote the number of nonzero columns of F F F mod 2 2 2 . Then, deleting the zero columns of F F F mod 2 2 2 yields a generator matrix for a binary linear [ s F , K , ≥ D ] [s_{F},K,\ge D] [ s F , K , ≥ D ] code. Consequently,
2 K ≤ A 2 ( s F , D ) , K + D − 1 ≤ s F . (45) 2^{K} \le A_{2}(s_{F},D), \qquad K+D-1 \le s_{F}. \tag*{(45)} 2 K ≤ A 2 ( s F , D ) , K + D − 1 ≤ s F . (45)
Proof. Substitute c = 2 h − 1 v c=2^{h-1}v c = 2 h − 1 v , v ∈ F 2 K v \in\mathbb{F}_{2}^{K} v ∈ F 2 K , in Eq. (17) to obtain Z v ( F m o d 2 ) E = E Z v Z^{v(F\ {\rm mod}\ 2)}E=EZ^{v} Z v ( F mod 2 ) E = E Z v . For v ≠ 0 v \ne0 v = 0 , we have Z v ≠ I Z^{v} \ne I Z v = I , so v ( F m o d 2 ) ≠ 0 v(F\ {\rm mod}\ 2) \ne0 v ( F mod 2 ) = 0 . Thus, the rows of F F F mod 2 2 2 are linearly independent, so its row rank is K K K . By the definition of distance D D D , every Pauli operator P P P of weight less than D D D satisfies E † P E = λ P I E^{\dagger}PE=\lambda_{P}I E † P E = λ P I for some scalar λ P \lambda_{P} λ P . Since Z v Z^{v} Z v has eigenvalues + 1 +1 + 1 and − 1 -1 − 1 for v ≠ 0 v \ne0 v = 0 , the identity E † Z v ( F m o d 2 ) E = Z v E^{\dagger}Z^{v(F\ {\rm mod}\ 2)}E=Z^{v} E † Z v ( F mod 2 ) E = Z v implies wt ( v ( F m o d 2 ) ) ≥ D \operatorname{wt}(v(F\ {\rm mod}\ 2)) \ge D wt ( v ( F mod 2 )) ≥ D .
Removing zero columns preserves these weights and the dimension, yielding a binary linear [ s F , K , ≥ D ] [s_{F},K,\ge D] [ s F , K , ≥ D ] code. Therefore, 2 K ≤ A 2 ( s F , D ) 2^{K} \le A_{2}(s_{F},D) 2 K ≤ A 2 ( s F , D ) by the definition of A 2 A_{2} A 2 . The classical Singleton bound [24 ] gives K + D − 1 ≤ s F K+D-1 \le s_{F} K + D − 1 ≤ s F .
Consider a fully addressable code family with N i → ∞ N_{i} \to\infty N i → ∞ and R ∞ > 0 R_{\infty} > 0 R ∞ > 0 . Pad the classical codes from Theorem S1 with zero columns to length N i N_{i} N i . This preserves their dimensions and minimum distances, giving binary [ N i , K i , ≥ D i ] [N_{i},K_{i},\ge D_{i}] [ N i , K i , ≥ D i ] codes. The positive rate and the Plotkin bound [25 Corollary 19] imply d ∞ < 1 / 2 d_{\infty}<1/2 d ∞ < 1/2 . Applying Eq. (44) with t = d ∞ t=d_{\infty} t = d ∞ gives
R ∞ ≤ lim sup i K i N i ≤ U ( d ∞ ) . (46) R_{\infty} \le\limsup_{i} \frac{K_{i}}{N_{i}} \le U(d_{\infty}). \tag*{(46)} R ∞ ≤ i lim sup N i K i ≤ U ( d ∞ ) . (46)
The classical rate bound yields the following explicit upper bound on the common coefficient η \eta η .
Lemma S13. For each fixed h ≥ 1 h \ge1 h ≥ 1 , consider a family of quantum codes with physical blocklengths N i → ∞ N_{i} \to\infty N i → ∞ . Suppose that each code admits an encoding isometry that is fully addressable at level h h h in the sense of Definition S1. Then, the common asymptotic coefficient η = min { R ∞ , d ∞ } \eta=\min\{R_{\infty},d_{\infty}\} η = min { R ∞ , d ∞ } satisfies
η ≤ c u p = 0.282652727463. (47) \eta\le c_{\mathrm{up}}=0.282652727463. \tag*{(47)} η ≤ c up = 0.282652727463. (47)
Proof. The case η = 0 \eta=0 η = 0 is immediate, so assume η > 0 \eta>0 η > 0 . Set t 0 = c u p t_{0}=c_{\mathrm{up}} t 0 = c up and u 0 = 0.454058689 u_{0}=0.454058689 u 0 = 0.454058689 , so 1 − 2 t 0 < u 0 < 1 1-2t_{0}<u_{0}<1 1 − 2 t 0 < u 0 < 1 . We first certify U ( t 0 ) < t 0 U(t_{0})<t_{0} U ( t 0 ) < t 0 . Enclose each square root between adjacent multiples of 10 − 24 10^{-24} 1 0 − 24 using integer square roots. Reduce logarithm arguments to [ 1 , 2 ] [1,2] [ 1 , 2 ] and, with z = ( x − 1 ) / ( x + 1 ) z=(x-1)/(x+1) z = ( x − 1 ) / ( x + 1 ) , use
0 ≤ ln x − 2 ∑ j = 0 39 z 2 j + 1 2 j + 1 ≤ 2 z 81 81 ( 1 − z 2 ) . 0 \le\ln x-2\sum_{j=0}^{39}\frac{z^{2j+1}}{2j+1} \le\frac{2z^{81}}{81(1-z^{2})}. 0 ≤ ln x − 2 j = 0 ∑ 39 2 j + 1 z 2 j + 1 ≤ 81 ( 1 − z 2 ) 2 z 81 .
The same enclosure at x = 2 x=2 x = 2 converts natural logarithms to base two. Monotonicity of H 2 H_{2} H 2 on [ 0 , 1 / 2 ] [0,1/2] [ 0 , 1/2 ] propagates the square-root intervals. Rational interval evaluation gives
0.2826527274543 < H ( u 0 2 ) − H ( u 0 ( u 0 − 1 + 2 t 0 ) ) < 0.2826527274544 < t 0 . (48) \begin{aligned}
0.2826527274543 < \mathcal{H}(u_{0}^{2})-\mathcal{H}\bigl(u_{0}(u_{0}-1+2t_{0})\bigr) \\
&< 0.2826527274544 < t_{0}. \tag*{(48)}
\end{aligned} 0.2826527274543 < H ( u 0 2 ) − H ( u 0 ( u 0 − 1 + 2 t 0 ) ) < 0.2826527274544 < t 0 . (48)
Since u 0 u_{0} u 0 is admissible in the minimization in Eq. (43) , the witness in Eq. (48) implies U ( t 0 ) < t 0 U(t_{0})<t_{0} U ( t 0 ) < t 0 . Moreover, U U U is nondecreasing: increasing t t t enlarges the admissible interval in Eq. (43) , while the objective at each previously admissible u u u does not increase, since H \mathcal{H} H is increasing. If η ≥ t 0 \eta\ge t_0 η ≥ t 0 , both R ∞ R_{\infty} R ∞ and d ∞ d_{\infty} d ∞ would be at least t 0 t_0 t 0 , so Eq. (46) would imply
t 0 ≤ R ∞ ≤ U ( d ∞ ) ≤ U ( t 0 ) < t 0 , t_0 \le R_{\infty} \le\mathcal{U}(d_{\infty}) \le\mathcal{U}(t_0) < t_0, t 0 ≤ R ∞ ≤ U ( d ∞ ) ≤ U ( t 0 ) < t 0 ,
a contradiction. Hence η ≤ c u p \eta\le c_{\mathrm{up}} η ≤ c up .
The addressing form in Eq. (20) strengthens this bound by shortening the associated classical code.
Corollary S1. For a family as in Lemma S13, suppose N i = h M i N_i = hM_i N i = h M i and ( F i ) ℓ , ( j , b ) = 2 b z ℓ , j ( i ) ( m o d 2 h ) (F_i)_{\ell,(j,b)} = 2^b z_{\ell,j}^{(i)} \pmod{2^h} ( F i ) ℓ , ( j , b ) = 2 b z ℓ , j ( i ) ( mod 2 h ) for 0 ≤ b < h 0 \le b < h 0 ≤ b < h . Then
η ≤ c u p h . (49) \eta\le\frac{c_{\mathrm{up}}}{h}. \tag*{(49)} η ≤ h c up . (49)
Proof. Again, assume η > 0 \eta> 0 η > 0 , since otherwise the claim is immediate. All columns with b ≥ 1 b \ge1 b ≥ 1 vanish modulo two, so each register contributes at most one nonzero column and s F i ≤ M i s_{F_i} \le M_i s F i ≤ M i . Theorem S1 therefore gives a classical [ M i , K i , ≥ D i ] [M_i, K_i, \ge D_i] [ M i , K i , ≥ D i ] code after padding with zeros. Its lower-limit rate is h R ∞ hR_{\infty} h R ∞ , and its lower-limit relative distance is at least h d ∞ hd_{\infty} h d ∞ , since N i = h M i N_i = hM_i N i = h M i . The positive rate and the Plotkin bound [25 Corollary 19] ensure h d ∞ < 1 / 2 hd_{\infty} < 1/2 h d ∞ < 1/2 . By the definition of A 2 A_2 A 2 and Eq. (44) , applied with n i = M i n_i = M_i n i = M i and t = h d ∞ t = hd_{\infty} t = h d ∞ ,
2 K i ≤ A 2 ( M i , D i ) , h R ∞ ≤ U ( h d ∞ ) . (50) 2^{K_i} \le A_2(M_i,D_i), \qquad hR_{\infty} \le\mathcal{U}(hd_{\infty}). \tag*{(50)} 2 K i ≤ A 2 ( M i , D i ) , h R ∞ ≤ U ( h d ∞ ) . (50)
The proof of Lemma S13 establishes that U \mathcal{U} U is nonincreasing and U ( c u p ) < c u p \mathcal{U}(c_{\mathrm{up}}) < c_{\mathrm{up}} U ( c up ) < c up . If h η ≥ c u p h\eta\ge c_{\mathrm{up}} h η ≥ c up , Eq. (50) would therefore give
c u p ≤ h R ∞ ≤ U ( h d ∞ ) ≤ U ( c u p ) < c u p , c_{\mathrm{up}} \le hR_{\infty} \le\mathcal{U}(hd_{\infty}) \le\mathcal{U}(c_{\mathrm{up}}) < c_{\mathrm{up}}, c up ≤ h R ∞ ≤ U ( h d ∞ ) ≤ U ( c up ) < c up ,
a contradiction. Hence η ≤ c u p / h \eta\le c_{\mathrm{up}}/h η ≤ c up / h .
Quantitative comparison with prior constructions
We compare fully addressable transversal T T T gates implemented by physical T T T powers on one fixed encoding. The parameters below are the asymptotic encoding rate R ∞ R_{\infty} R ∞ and relative distance d ∞ d_{\infty} d ∞ , with blocklength measured in physical qubits.
San-José constructs binary CSS codes by converting higher-order Schur-product conditions on AG codes into weighted binary divisibility [14 Proposition 4.5 and Theorem 6.4] . For addressable T T T , we apply the hierarchy-lowering argument of Ref. [14, Remark 6.8] to his weighted level-four construction. If w p w_p w p are its physical phase weights, g a g_a g a its logical X X X rows, and ϵ a ∈ { 1 , − 1 } \epsilon_a \in\{1,-1\} ϵ a ∈ { 1 , − 1 } its logical phase signs, the addressing coefficients are F a , p = ϵ a w p g a , p ( m o d 8 ) F_{a,p} = \epsilon_a w_p g_{a,p} \pmod8 F a , p = ϵ a w p g a , p ( mod 8 ) . This weighted form preserves the original blocklength. We specialize the level-four construction to m = 18 m = 18 m = 18 and τ = 128 \tau= 128 τ = 128 . Proposition 4.5 of Ref. [14 ] , applied with j = 8 j = 8 j = 8 , bounds the binary conversion length by ∑ a = 1 8 ( 18 a ) = 106761 \sum_{a=1}^{8} \binom{18}{a} = 106761 ∑ a = 1 8 ( a 18 ) = 106761 . Choosing the logical-coordinate fraction λ = 257 / 523264 \lambda= 257/523264 λ = 257/523264 in that reference's Eqs. (28)–(29) then gives
R ∞ ≥ 257 55836750327 , d ∞ ≥ 257 55672124865 . (51) R_{\infty} \ge\frac{257}{55836750327}, \qquad d_{\infty} \ge\frac{257}{55672124865}. \tag*{(51)} R ∞ ≥ 55836750327 257 , d ∞ ≥ 55672124865 257 . (51)
This explicit substitution therefore guarantees both quantities to be at least 4.6027033897 … × 10 − 9 4.6027033897\ldots\times10^{-9} 4.6027033897 … × 1 0 − 9 . Lin, Wu, and Cheng combine AG codes with a binary embedding to obtain generalized divisibility, which directly gives fully addressable transversal T T T powers on CSS codes [9 Theorem 4.5] . Their explicit construction uses a binary [ 244 , 10 , 100 ] [244, 10, 100] [ 244 , 10 , 100 ] embedding and has K i = ⌊ n i / 992 ⌋ K_i = \lfloor n_i/992\rfloor K i = ⌊ n i /992 ⌋ and N i = 244 ( n i − K i ) N_i = 244(n_i-K_i) N i = 244 ( n i − K i ) , where n i n_i n i is the outer AG code length. Corollary D.1 of Ref. [9 ] gives
R ∞ = 1 241804 , d ∞ ≥ 1 241804 . (52) R_\infty= \frac{1}{241804}, \qquad d_\infty\ge\frac{1}{241804}. \tag*{(52)} R ∞ = 241804 1 , d ∞ ≥ 241804 1 . (52)
The common guarantee is ≃ 4.1355808837 × 10 − 6 \simeq4.1355808837 \times10^{-6} ≃ 4.1355808837 × 1 0 − 6 .
Meiburg obtains fully addressable transversal T T T gates on CSS codes by reserving AG evaluation points for logical labels and using interpolation and a binary embedding to control their phases [15 Secs. 3.3–3.5] . Before the coordinate-repetition step, the four-bit packing in Ref. [15 Sec. 3.5] gives K i = 4 t i K_i = 4t_i K i = 4 t i and N i = 385 ( n i − t i ) N_i = 385(n_i-t_i) N i = 385 ( n i − t i ) , with t i / n i → 5 / 186 t_i/n_i \to5/186 t i / n i → 5/186 , where n i n_i n i is the total number of AG evaluation points and t i t_i t i counts the reserved points. These parameters already implement arbitrary logical T T T powers using physical T T T powers, and yield
R ∞ = 4 13937 , d ∞ ≥ 1 13937 . (53) R_\infty= \frac{4}{13937}, \qquad d_\infty\ge\frac{1}{13937}. \tag*{(53)} R ∞ = 13937 4 , d ∞ ≥ 13937 1 . (53)
Thus the common guarantee is 1 / 13937 ≃ 7.1751 × 10 − 5 1/13937 \simeq7.1751 \times10^{-5} 1/13937 ≃ 7.1751 × 1 0 − 5 .
Meiburg’s modular-clock construction also applies to T T T [15 Sec. 3.6] . We specialize it to a Garcia–Stichtenoth tower over F 1024 \mathbb{F}_{1024} F 1024 , for which g i / n i → 1 / 31 g_i/n_i \to1/31 g i / n i → 1/31 [16 ] , using Meiburg’s stated divisor choices a 0 , i / n i → 1 / 3 a_{0,i}/n_i \to1/3 a 0 , i / n i → 1/3 and a 1 , i / n i → 2 / 3 a_{1,i}/n_i \to2/3 a 1 , i / n i → 2/3 . Binary basis expansion gives 10 n i 10n_i 10 n i clock coordinates and 10 ( a 1 , i − a 0 , i ) 10(a_{1,i}-a_{0,i}) 10 ( a 1 , i − a 0 , i ) logical clocks. Lifting to Z / 8 Z \mathbb{Z}/8\mathbb{Z} Z /8 Z preserves the distance lower bound min { n i − a 1 , i , a 0 , i − 2 g i + 2 } \min\{n_i-a_{1,i},a_{0,i}-2g_i+2\} min { n i − a 1 , i , a 0 , i − 2 g i + 2 } . The local encoding in Ref. [15 Eq. (18)] uses ( ⌈ log 2 8 ⌉ + 1 ) ( 8 − 1 ) = 28 (\lceil\log_2 8\rceil+ 1)(8-1) = 28 (⌈ log 2 8 ⌉ + 1 ) ( 8 − 1 ) = 28 physical qubits per clock and preserves this distance bound. Restricting each logical clock to its two basis states labelled zero and one gives N i = 280 n i N_i = 280n_i N i = 280 n i and K i = 10 ( a 1 , i − a 0 , i ) K_i = 10(a_{1,i}-a_{0,i}) K i = 10 ( a 1 , i − a 0 , i ) without decreasing the distance. Thus,
R ∞ = 1 84 , d ∞ ≥ 1 / 3 − 2 / 31 280 = 5 5208 . (54) R_\infty= \frac{1}{84}, \qquad d_\infty\ge\frac{1/3-2/31}{280} = \frac{5}{5208}. \tag*{(54)} R ∞ = 84 1 , d ∞ ≥ 280 1/3 − 2/31 = 5208 5 . (54)
The common guarantee is 5 / 5208 ≃ 9.6006 × 10 − 4 5/5208 \simeq9.6006 \times10^{-4} 5/5208 ≃ 9.6006 × 1 0 − 4 .
All four prior constructions have positive asymptotic rate and relative distance. The prior-work entries in the comparison table (§ 1 of the main text) use the smaller of the two guarantees for each stated parameter choice. The prior constructions and our constructions meet the same logical and physical T T T -gate requirement. Our polynomial-time and exponential-time constructions in § 3.2.3 and § 4.1.5 guarantee both quantities at least 52 / 2025 52/2025 52/2025 and t ⋆ / 3 t_\star/3 t ⋆ /3 , respectively.
Finite examples and their exact certificates
The codes Q 48 = ( ( 48 , 16 , 5 ) ) 2 \mathcal{Q}_{48} = ((48,16,5))_2 Q 48 = (( 48 , 16 , 5 ) ) 2 and Q 90 = ( ( 90 , 256 , 7 ) ) 2 \mathcal{Q}_{90} = ((90,256,7))_2 Q 90 = (( 90 , 256 , 7 ) ) 2 use Eq. (19) with h = 3 h=3 h = 3 and ( M , r , K ) = ( 16 , 12 , 4 ) (M,r,K) = (16,12,4) ( M , r , K ) = ( 16 , 12 , 4 ) and ( 30 , 22 , 8 ) (30,22,8) ( 30 , 22 , 8 ) , respectively. In each case B is invertible over Z / 8 Z \mathbb{Z}/8\mathbb{Z} Z /8 Z , A is symmetric, and the quadratic exponent is evaluated modulo sixteen. The matrices were obtained by bounded candidate sampling using the rejection tests of Algorithm S1. Checking every nonzero Weyl pair of cost below the respective claimed distance triggers no rejection, certifying both distance lower bounds by the proof of Lemma S11. The 90-qubit target also satisfies the sufficient ensemble condition Φ 3 < 1 \Phi_3 < 1 Φ 3 < 1 , where Φ 3 \Phi_3 Φ 3 is defined in Eq. (38) .
Addressable transversal T T T gates
The j j j th three-qubit register contains physical qubits ( 3 j − 2 , 3 j − 1 , 3 j ) (3j-2,3j-1,3j) ( 3 j − 2 , 3 j − 1 , 3 j ) in least-to-most-significant digit order. With G , L G,L G , L the first r r r and last K K K rows of B, collect the selectors of Lemma S1 in
Z a d d r = ( B − T ) r + 1 : M , : , G Z a d d r T = 0 , L Z a d d r T = I K ( m o d 8 ) . (55) Z_{\mathrm{addr}} = (\mathrm{B}^{-\mathsf{T}})_{r+1:M,:}, \qquad GZ_{\mathrm{addr}}^{\mathsf{T}} = 0,\qquad LZ_{\mathrm{addr}}^{\mathsf{T}} = I_K \pmod8. \tag*{(55)} Z addr = ( B − T ) r + 1 : M , : , G Z addr T = 0 , L Z addr T = I K ( mod 8 ) . (55)
For c ∈ R 3 K c \in\mathcal{R}_3^K c ∈ R 3 K , put a = c Z a d d r ( m o d 8 ) a=cZ_{\mathrm{addr}} \pmod{8} a = c Z addr ( mod 8 ) . The physical layer specified by Eq. (20) at h = 3 h=3 h = 3
⨂ j = 1 M ( T a j ⊗ T 2 a j ⊗ T 4 a j ) (56) \bigotimes_{j=1}^{M}\left(T^{a_j}\otimes T^{2a_j}\otimes T^{4a_j}\right) \tag*{(56)} j = 1 ⨂ M ( T a j ⊗ T 2 a j ⊗ T 4 a j ) (56)
has phase e 2 π i c x T / 8 e^{2\pi i c x^{\mathsf{T}}/8} e 2 π i c x T /8 on every term of E ∣ x ⟩ E|x\rangle E ∣ x ⟩ , so it implements ⨂ T c ℓ \bigotimes T^{c\ell} ⨂ T c ℓ exactly. Combining exponents modulo eight gives at most one single-qubit phase gate on each physical qubit.
Verification of code distances
We certify each distance by verifying detection of all Pauli errors of weight below d d d and exhibiting a weight-d d d Pauli with nonscalar logical action.
For W ( a , b ) = ⨂ j X 8 ( a j ) Z 8 ( b j ) W(a,b)=\bigotimes_j X_8(a_j)Z_8(b_j) W ( a , b ) = ⨂ j X 8 ( a j ) Z 8 ( b j ) , Eq. (22) gives
Q A † W ( a , b ) Q A = e − π i a A a T / 8 W ( a , b − a A ) , (57) Q_A^\dagger W(a,b)Q_A=e^{-\pi i a A a^{\mathsf{T}}/8}W(a,b-aA), \tag*{(57)} Q A † W ( a , b ) Q A = e − π ia A a T /8 W ( a , b − a A ) , (57)
and Lemma S6 requires G ( b − a A ) T = 0 ( m o d 8 ) G(b-aA)^{\mathsf{T}}=0\pmod{8} G ( b − a A ) T = 0 ( mod 8 ) for nonzero compression.
At exact order two, write ( a , b ) = 4 ( α , β ) (a,b)=4(\alpha,\beta) ( a , b ) = 4 ( α , β ) with α , β ∈ F 2 M \alpha,\beta\in\mathbb{F}_2^M α , β ∈ F 2 M not both zero. By Lemma S6, nonzero compression requires ( a B − 1 ) r + 1 : M = x ′ − x (aB^{-1})_{r+1:M}=x'-x ( a B − 1 ) r + 1 : M = x ′ − x for some binary logical labels x , x ′ x,x' x , x ′ . The left-hand side has entries in { 0 , 4 } \{0,4\} { 0 , 4 } , whereas the right-hand side has entries in { 0 , 1 , 7 } \{0,1,7\} { 0 , 1 , 7 } modulo eight. Their common value must therefore be zero. The order-two rejection conditions of Sec. S3.1 are consequently
G ( b − a A ) T = 0 , ( a B − 1 ) r + 1 : M = 0 ( m o d 8 ) . G(b-aA)^{\mathsf{T}}=0,\qquad(aB^{-1})_{r+1:M}=0\pmod{8}. G ( b − a A ) T = 0 , ( a B − 1 ) r + 1 : M = 0 ( mod 8 ) .
Put G 2 = G ( m o d 2 ) G_2=G\pmod{2} G 2 = G ( mod 2 ) and A 2 = A ( m o d 2 ) A_2=A\pmod{2} A 2 = A ( mod 2 ) . Using 4 z = 0 ( m o d 8 ) 4z=0\pmod{8} 4 z = 0 ( mod 8 ) if and only if z = 0 ( m o d 2 ) z=0\pmod{2} z = 0 ( mod 2 ) , the first condition becomes
G 2 ( β − α A 2 ) T = G 2 β T + G 2 A 2 α T = 0 ( m o d 2 ) , G_2(\beta-\alpha A_2)^{\mathsf{T}}=G_2\beta^{\mathsf{T}}+G_2A_2\alpha^{\mathsf{T}}=0\pmod{2}, G 2 ( β − α A 2 ) T = G 2 β T + G 2 A 2 α T = 0 ( mod 2 ) ,
where we used A 2 T = A 2 A_2^{\mathsf{T}}=A_2 A 2 T = A 2 and the equality of addition and subtraction in F 2 \mathbb{F}_2 F 2 . Reducing and transposing the second condition similarly gives J α T = 0 J\alpha^{\mathsf{T}}=0 J α T = 0 , where J = ( ( B − 1 ) : , r + 1 : M ) T ( m o d 2 ) J=((B^{-1})_{:,r+1:M})^{\mathsf{T}}\pmod{2} J = (( B − 1 ) : , r + 1 : M ) T ( mod 2 ) . Combining these two binary equations gives
\begin{pmatrix}
G_2A_2 & G_2\\
J & 0
\end{pmatrix}
\begin{pmatrix}
\alpha^{\mathsf{T}}\\
\beta^{\mathsf{T}}
\end{pmatrix}
=0\pmod{2} \tag*{(58)}\end{pmatrix}
By the proof of Lemma S8, the physical Pauli weight is wt ( α ) + wt ( β ) \operatorname{wt}(\alpha)+\operatorname{wt}(\beta) wt ( α ) + wt ( β ) . The order-two test therefore rejects a candidate exactly when Eq. (58) has a nonzero solution with wt ( α ) + wt ( β ) < d \operatorname{wt}(\alpha)+\operatorname{wt}(\beta)<d wt ( α ) + wt ( β ) < d .
For Q 48 Q_{48} Q 48 and Q 90 Q_{90} Q 90 , exact verification confirms that Eq. (58) has no nonzero solution with wt ( α ) + wt ( β ) < d \operatorname{wt}(\alpha)+\operatorname{wt}(\beta)<d wt ( α ) + wt ( β ) < d , for d = 5 d=5 d = 5 and d = 7 d=7 d = 7 , respectively.
For exact order four, write ( a , b ) = 2 ( a ′ , b ′ ) (a,b)=2(a',b') ( a , b ) = 2 ( a ′ , b ′ ) with a ′ , b ′ ∈ ( Z / 4 Z ) M a',b'\in(\mathbb{Z}/4\mathbb{Z})^M a ′ , b ′ ∈ ( Z /4 Z ) M and at least one odd coordinate. The rejection condition in Sec. S3.1 becomes
G ( b ′ − a ′ A ) T = 0 ( m o d 4 ) . G(b'-a'A)^{\mathsf{T}}=0\pmod{4}. G ( b ′ − a ′ A ) T = 0 ( mod 4 ) .
As in the proof of Lemma S9, assign each local pair weight zero at ( 0 , 0 ) (0,0) ( 0 , 0 ) , one on A 3 \mathcal{A}_3 A 3 from Eq. (37) , and two otherwise; retain only pairs whose total assigned weight is below d d d .
At exact order eight, ( a , b ) (a,b) ( a , b ) has at least one odd coordinate. Combining the same rejection condition with the weight restriction of Lemma S10 gives
G ( b − a A ) T = 0 ( m o d 8 ) , ∣ { j : ( a j , b j ) ≠ ( 0 , 0 ) } ∣ < d . G(b-aA)^{\mathsf{T}}=0\pmod{8},\qquad\left|\{j:(a_j,b_j)\ne(0,0)\}\right|<d. G ( b − a A ) T = 0 ( mod 8 ) , ∣ { j : ( a j , b j ) = ( 0 , 0 )} ∣ < d .
For both codes, exact verification excludes all solutions under these order and weight restrictions, with d = 5 d = 5 d = 5 and d = 7 d = 7 d = 7 , respectively.
Together with the order-two result, these exclusions imply E † P E = 0 E^\dagger P E = 0 E † P E = 0 for every nonidentity qubit Pauli P P P of weight below d d d , by the proof of Lemma S11. Hence D 48 ≥ 5 D_{48} \ge5 D 48 ≥ 5 and D 90 ≥ 7 D_{90} \ge7 D 90 ≥ 7 .
Matching upper bounds follow from a common criterion: a Pauli P N P_N P N with nonscalar compression E N † P N E N E_N^\dagger P_N E_N E N † P N E N implies D N ≤ wt ( P N ) D_N \le\operatorname{wt}(P_N) D N ≤ wt ( P N ) . For the two codes, take
P 48 = X 9 X 24 X 48 Z 34 Z 40 , (59) P_{48} = X_9X_{24}X_{48}Z_{34}Z_{40}, \tag*{(59)} P 48 = X 9 X 24 X 48 Z 34 Z 40 , (59)
P 90 = X 24 X 66 X 69 X 72 Z 25 Z 46 Z 76 . (60) P_{90} = X_{24}X_{66}X_{69}X_{72}Z_{25}Z_{46}Z_{76}. \tag*{(60)} P 90 = X 24 X 66 X 69 X 72 Z 25 Z 46 Z 76 . (60)
For the archived matrices, Eq. (23) gives
P N E N = E N Z 2 Z 4 , N ∈ { 48 , 90 } , (61) P_NE_N = E_NZ_2Z_4,\qquad N \in\{48,90\}, \tag*{(61)} P N E N = E N Z 2 Z 4 , N ∈ { 48 , 90 } , (61)
where Z 2 Z 4 Z_2Z_4 Z 2 Z 4 acts on the logical qubits and is nonscalar. The witness weights are five and seven, respectively, so D 48 ≤ 5 D_{48} \le5 D 48 ≤ 5 and D 90 ≤ 7 D_{90} \le7 D 90 ≤ 7 . Together with the lower bounds above, this proves D 48 = 5 D_{48} = 5 D 48 = 5 and D 90 = 7 D_{90} = 7 D 90 = 7 .
Ancilla-free encoding circuit
For Q 48 Q_{48} Q 48 , place the four logical inputs on qubits 37, 40, 43, 46 and initialize the other qubits to zero. Applying H H H to the first 36 qubits prepares the uniform ring inputs. The modular map y ↦ y B y \mapsto yB y ↦ y B , followed by the quadratic phase Q A Q_A Q A defined in the proof of Lemma S1, then implements Eq. (19) using the 48 data qubits.
The linear map acts on 16 three-qubit registers. Gauss–Jordan elimination of B B B over R 3 \mathcal{R}_3 R 3 gives a factorization implemented by 8 register swaps, 12 multiplications x ↦ u x m o d 8 x \mapsto ux \bmod8 x ↦ ux mod 8 with odd u u u , and 202 weighted additions ( x , y ) ↦ ( x , y + c x m o d 8 ) (x,y) \mapsto(x,y+cx \bmod8) ( x , y ) ↦ ( x , y + c x mod 8 ) . Each register swap consists of three two-qubit SWAP gates, giving the 24 SWAP gates reported in § 2.3 of the main text.
Expanding Q A Q_A Q A in the binary digits of the registers gives single-qubit phase gates and 466 two-qubit controlled-phase gates.