# Reproduction — Aerospace actuator band guard (FPGA — Arty A7)

Source `examples/actuator_guard.eml` (sha256 `adaa434e2a58679c`). Regenerate with `make demo`.

| stage | artifact | tier |
|---|---|---|
| emit — software (14) | `c`, `cpp`, `csharp`, `gdscript`, `go`, `java`, `javascript`, `kotlin`, `luau`, `matlab`, `python`, `rust`, `swift`, `wasm` | LOCAL |
| emit — gpu shader (5) | `glsl`, `glsl-es`, `hlsl`, `metal`, `wgsl` | LOCAL |
| emit — fpga rtl (3) | `chisel`, `verilog`, `vhdl` | LOCAL |
| emit — compiler IR (1) | `llvm` | LOCAL |
| emit — proof (3) | `coq`, `isabelle`, `lean` | LOCAL |
| emit — safety-critical (4) | `aadl`, `ada/spark`, `autosar`, `ros2` | LOCAL |
| emit — blockchain (2) | `solidity`, `zkproof` | LOCAL |
| **emit total** | **32 targets from one source** | LOCAL |
| proof | `actuator_command_within_band` — ✓ clean (`proof/actuator_command_within_band.axioms.txt`) | REPLAY (re-derive: TOOLCHAIN — Lean) |
| simulate | `sim/trace.csv`, `sim/actuator_band.png` — guarded-output samples outside the certified band [-1,1] = 0 = 0 | LOCAL |
| hardware | this guard carries @target(fpga, board=arty_a7, clock_mhz=100) — the same source emits synthesizable Verilog/VHDL/Chisel (6-stage pipeline, ~300 LUTs / 6 DSPs, 16.7 Msamples/s @ 100 MHz) and has been placed-and-routed to an Arty A7-100T bitstream. Replayed from the synthesis/PnR evidence. | REPLAY |

**The same claim, three ways.** The Lean theorem `actuator_command_within_band` proves the guarded actuator command is always within the certified flight-envelope band [u_min, u_max], for any controller inputs; the simulation shows `guarded-output samples outside the certified band [-1,1] = 0 = 0` (the raw command peaks at ±4.53 (well past the band) yet the guarded output never leaves [-1.0,1.0] — the clamp the theorem proves and the RTL/silicon runs); the hardware evidence shows the same behavior measured on real hardware; Proved, simulated, measured.