(A) Let \((d_x,d_y,d_z)\) be a box shape with \(\sum _cd_c=m_0+3\); by Lemma 1 it suffices that the box map, from the index to the prescribed digits, is injective. All \(d_c\ge 1\). The top digits \((\alpha ,\alpha +\beta _1,\alpha +\beta _1+\beta _2)\) determine \((\alpha ,\beta )\). The remaining depths \(d_c-1\) sum to \(m_0\) and are at most \(m_0\) each, so no jitter digit is prescribed, and what remains is an \(m_0\)-box of the shifted net \(P+s_\beta \), which is injective. Exactly one \(d_c=0\), say \(d_x=0\) (the cases \(d_y=0\), \(d_z=0\) are the same with the pairs \(xz\) and \(xy\)). The top digits of \(y\) and \(z\) fix \(\alpha +\beta _1\) and \(\beta _2\), and the remaining index is \((n,t)\) with \(t=\beta _1\); the block digits of \((y,z)\) are those of \(P_{yz}+\text{const}+t\, s_A^{yz}\). If \(d_y-1=e\) and \(d_z-1=m_0+1-e\) with \(1\le e\le m_0\), injectivity on \((n,t)\) is injectivity of the projection to the first \(e\) resp. \(m_0+1-e\) digits on \(P_{yz}+\mathbb {F}_bs_A^{yz}\); it holds on \(P_{yz}\) by the \((e,m_0-e)\) box, and for \(t\ne 0\) a collision would put \(s_A^{yz}\) in \(H_e=\ker \lambda ^{yz}_e\), which the separating condition excludes. If \(d_y=1\) or \(d_z=1\), the other coordinate reads all of its block and one jitter digit, \(\beta _1\) for \(z\) and \(\beta _1+\beta _2\) for \(y\), which determines \(t\), and then the block determines \(n\). For \(d_y=0\) the pair is \((x,z)\) with the line \(s_B-s_A\) and the jitter digits \(\beta _2\), \(\beta _1\); for \(d_z=0\) it is \((x,y)\) with \(s_B\) and \(\beta _2\), \(\beta _1+\beta _2\). Two \(d_c=0\). One coordinate carries all \(m_0+3\) digits: its top digit, its block (a bijection in \(n\) for fixed \(\beta =(\beta _1,\beta _2)\)) and its two jitter digits, which are a bijection of \(\mathbb {F}_b^2\) onto \((\beta _1,\beta _2)\) in every coordinate.

(B) The functional \(\lambda _e=\lambda ^{cc'}_e\) vanishes on \(Z_e\), so it is supported on the first \(e\) digits of \(c\) and the first \(m_0+1-e\) digits of \(c'\). Its coefficient on digit \(e\) of \(c\) is nonzero: otherwise \(\lambda _e\) would live on a window of \(e-1\) plus \(m_0+1-e\) digits, onto which \(P_{cc'}\) projects bijectively (the \((e-1,m_0+1-e)\) box), and vanish on \(P_{cc'}\), hence be \(0\). Likewise its coefficient on digit \(m_0+1-e\) of \(c'\) is nonzero. If \(e{\gt}D\), digit \(e\) of \(c\) is deep (index \({\gt}D\)); if \(e\le D\), digit \(m_0+1-e\ge m_0+1-D{\gt}D\) of \(c'\) is deep. So each \(\lambda _e\) has a nonzero coefficient on a deep digit, its own: digit \(e\) of \(c\) if \(e{\gt}D\), digit \(m_0+1-e\) of \(c'\) if \(e\le D\). In any vanishing linear combination, the term with the largest \(e{\gt}D\) (or, if there is none, the smallest \(e\)) is the only one that sees its own digit, so its coefficient is \(0\); by induction all coefficients are \(0\). Hence the restrictions of \(\lambda _1,\dots ,\lambda _{m_0}\) to the deep digits are linearly independent, and the deep parts of \(s_A^{yz}\) can be chosen with \(\lambda ^{yz}_e(s_A^{yz})=1\) for all \(e\), those of \(s_B^{xy}\) with \(\lambda ^{xy}_e(s_B^{xy})=1\); the conditions on \((s_B-s_A)^{xz}\) involve the still free deep digits of \((s_A)_x\) and \((s_B)_z\), and are solved in the same way.

Freezing. By induction on \(j\), \(P_{L+3j}\) is the set of points whose coordinate \(c\) has the digits \(\pi _c(u)\, |\, (p+\eta (u))_c\, |\, \mathrm{low}_c(u)\), where \(u\in \mathbb {F}_b^{3j}\) collects the new index digits, \(u\mapsto \pi (u)=(\pi _c(u))_c\in \mathbb {F}_b^{3j}\) is a bijection (\(j\) top digits per coordinate), \(p\) runs over \(P_L\), \(\eta (u)\) is a digitwise shift of the \(L\) block digits, and \(\mathrm{low}(u)\) has \(2j\) digits per coordinate. The lift at resolution \(\ell =L+3j'\) shifts only digits of index \({\gt}D_\ell \) of its own block, in which the block of \(P_L\) occupies the indices \(j'+1,\dots ,j'+L\); so it touches block digits of index \({\gt}D_\ell -j'\ge \lfloor L/2\rfloor \) only, and never the \(j'\) top digits before them. Hence \(\eta (u)\) vanishes on the top \(\lfloor L/2\rfloor \) digits of every coordinate: these are frozen, equal to those of \(p\).

Separation. Measure in units of \(b^{-(L+3j)}b^{2j}\), so that the torus has period \(b^{L+j}\) and a point has coordinates \(\pi _c(u)b^L+t_c(p)W+\varepsilon _c\) with \(\varepsilon _c\in [0,W)\). Two points with different \(p\ne p'\): reducing modulo \(b^L\), which divides the period, does not increase toroidal distances, and modulo \(b^L=AW\) the difference in coordinate \(c\) is \((t_c(p)-t_c(p'))W+(\varepsilon _c-\varepsilon '_c)\), of toroidal size more than \(W(|t_c(p)-t_c(p')|_A-1)\); so their distance is at least \(W\sqrt{v^*_L}\). Two points with the same \(p\) and different \(u\): some \(\pi _c\) differ, while \(t_c\) agree, so coordinate \(c\) differs by \((\pi _c-\pi '_c)b^L+(\varepsilon _c-\varepsilon '_c)\) with \(\pi _c\not\equiv \pi '_c\pmod{b^j}\), of toroidal size more than \(b^L-W\). A distance of \(x\) units is \(x\, b^{-L-j}\) in \([0,1)^3\), and \(N^{1/3}=b^{L/3+j}\), so \(\delta N^{1/3}\) is the distance in units times \(b^{-2L/3}\).

For a pair of points with digit difference \(\Delta \), coordinate \(c\) of the shifted pair has the digits \(X_c\) and \(X_c+\Delta _c\), where \(X_c\) is coordinate \(c\) of the first point plus \(\tau _c\). As \(\tau \) varies, \((X_x,X_y,X_z)\) runs over all triples of digit vectors, independently in the three coordinates, so the minimum over \(\tau \) of the squared distance of the pair is \(\sum _c\min _{X_c}|X'_c-X_c|^2\). This gives (b). Since \(t\mapsto \max (0,t-1)^2\) is nondecreasing, the same argument gives \(v^\circ _L=\min _{\tau '}v^*_L(P_L\oplus \tau ')\) over the digital shifts \(\tau '\) of \(P_L\). For (a), write the points of \(P_{L+3j}\) as in the proof of Lemma 64. A digital shift \(\tau \) keeps \(u\mapsto \pi (u)+\tau _\pi \) a bijection, where \(\tau _\pi \) are its digits on the top \(j\) digits, and adds the same vector \(\tau _{\mathrm{blk}}\) to the block digits of every point. So \(P_{L+3j}\oplus \tau \) has the structure used in that proof, with \(P_L\) replaced by the digitally shifted copy \(P_L\oplus \tau _{\mathrm{blk}}\): the top \(H\) block digits of every point are those of a point of \(P_L\oplus \tau _{\mathrm{blk}}\), and the proof applies verbatim. The first term is then \(W\sqrt{v^*_L(P_L\oplus \tau _{\mathrm{blk}})}\, b^{-2L/3}\ge W\sqrt{v^\circ _L}\, b^{-2L/3}\), and the second term does not involve the shift.

For the lifted resolutions: Lemma 63(A) gives the net property at every resolution, Lemma 63(B) the existence of the continuation, and Lemma 64 the bound \(\delta N^{1/3}\ge g_L\) for every \(m\ge L\) in the residue class of a certificate resolution \(L\), once the finite certificate \(v^*_L\) is known and the proviso \(g_L\le b^{L/3}-Wb^{-2L/3}\) holds. The finite part is an exact computation on explicitly given nets: the \(t=0\) property of the seeds and of the nets at the certificate resolutions, the integers \(v^*_L\) (with the proviso, which holds by a wide margin), the exact minimum distances at the finitely many resolutions between the seed and \(L\), and, for \(m\) below the seed resolutions, explicit digital \((0,m,3)\)-nets with their exact minimum distances (all above the stated constants). The constants are the minima of these exact values, truncated. Without the shift the same matrices are used: Lemmas 63 and 64 never use the shift, and only the certificates change. For (3), Lemma 65(a) gives the bound for every digital shift and every \(m\ge L\) from one integer \(v^\circ _L\), computed at the same certificate resolution \(L\) (the proviso holds again); at the finitely many resolutions below \(L\), and for the explicit nets below the seed, the exact minimum of \(\delta (P_m\oplus \tau )N^{1/3}\) over all \(\tau \) is computed by Lemma 65(b).