Single-shot error correction of three-dimensional homological product codes

Single-shot error correction corrects data noise using only a single round of noisy measurements on the data qubits, removing the need for intensive measurement repetition. We introduce a general concept of confinement for quantum codes, which roughly stipulates qubit errors cannot grow without triggering more measurement syndromes. We prove confinement is sufficient for single-shot decoding of adversarial errors and linear confinement is sufficient for single-shot decoding of local stochastic errors. Further to this, we prove that all three-dimensional homological product codes exhibit confinement in their $X$-components and are therefore single-shot for adversarial phase-flip noise. For local stochastic phase-flip noise, we numerically explore these codes and again find evidence of single-shot protection. Our Monte Carlo simulations indicate sustainable thresholds of $3.08(4)\%$ and $2.90(2)\%$ for 3D surface and toric codes respectively, the highest observed single-shot thresholds to date. To demonstrate single-shot error correction beyond the class of topological codes, we also run simulations on a randomly constructed 3D homological product code.


I. INTRODUCTION
Quantum error correction encodes logical quantum information into a codespace [1]. Given perfect measurement of the codespace stabilisers we obtain the syndrome of any error present. A suitable decoding algorithm can determine a recovery operation that returns the system to the codespace. Either this recovery is a perfect success, or a failure resulting in a high weight logical error. However, in real quantum systems the measurements are not perfect and this simple story becomes more involved. The three main strategies for tackling noisy measurements are: repeated measurements on the code [2, 3]; performing measurement driven error-correction on a cluster state [4-9]; or using a single-shot code and decoder [10]. Focusing on the last strategy, the single-shot approach has the advantage of no additional time cost or clusterstate generation cost and provides a resilience against timecorrelated noise [11]. In single-shot error correction, some residual error persists after each round of error correction, but this residual error is kept small and does not rapidly accumulate. However, only a special class of codes support singleshot error correction, but exactly which codes and why is not yet fully understood.
Bombín coined the phrase single-shot error correction and remarked that it "is related to self-correction and confinement phenomena in the corresponding quantum Hamiltonian model." [10]. He defined confinement for subsystem codes, and showed that it is sufficient for single-shot error correction with a limited class of subsystem codes. In particular, he proved that the 3D gauge color code supports singleshot error correction, though it is unknown whether the corresponding Hamiltonian exhibits self-correction. Later singleshot error correction was numerically observed in a vari- * armandaoq@gmail.com † mvasmer@perimeterinstitute.ca ‡ joschka@roffe.eu § earltcampbell@gmail.com ety of higher dimensional topological codes, including: the 3D gauge color code [12], 4D surface codes [13] and their hyperbolic cousins [14], and 3D surface codes with phase noise [15][16][17]. Campbell established a general set of sufficient conditions, encapsulated by a code property called good soundness, that ensured adversarial noise [18] could be suppressed using a single-shot decoder. While Campbell's sufficiency conditions explained single-shot error correction in a wide range of codes, around the same time it was shown that quantum expander codes [19][20][21] supported single-shot error correction [22]. However, quantum expander codes lack the soundness property so neither Bombín's notion of confinement or Campbell's notion of soundness is sufficient to encompass all known examples of single-shot error correction. We can use different classical algorithms to decode a given quantum code, and this choice will affect the utility of the code. Different decoders have various time complexities and error tolerances, which affects the resources required by a quantum computer based on the code [23][24][25]. Thus far, single-shot decoders come in two flavours. The first are twostage decoders [12,13], where: stage 1 decoding repairs the noisy syndrome using redundancy in the parity check measurements; stage 2 decoding solves the corrected syndrome problem. The second flavour of decoders compute a correction from the noisy syndrome without attempting to repair it. Most examples of such decoders are local decoders, meaning that the whole correction is made up of corrections computed in small local regions of the code using syndrome information in the immediate neighbourhood [14-17, 21, 26, 27]. However, there are some examples of non-local decoders such as belief propagation (BP) being used for single-shot error correction without syndrome repair [14,27]. A natural question to ask is: what is the optimal decoding strategy for single-shot codes? Even in the simple case of the 3D toric code this is not well-understood.
The remainder of this article is structured as follows. In Sec. II, we give a summary of our results. In Sec. III, we formally state our results on confinement and single-shot decoding. In Sec. IV, we detail the construction of 3D product codes. In Sec. V, we present our numerical simulations and analyse their results. Finally, in Sec. VI, we discuss future research directions that flow from this work.

II. SUMMARY OF RESULTS
This article is in two parts: on the one hand, we propose the concept of confinement as an essential characteristic for a code family to display single-shot properties; on the other, we investigate the single-shot performances of the class of 3D homological product codes [19,28,29], which we call 3D product codes. We introduce confinement in Sec. III. Loosely, confinement stipulates that low-weight qubit errors will result in low-weight syndromes. We then formalise the notion of a code family having good confinement, which we prove is a sufficient condition for single-shot decoding in the adversarial noise setting. In addition to that, we prove that good linear confinement is a sufficient condition for a family of codes to exhibit a sustainable single-shot threshold for local stochastic noise (App. A). We review the construction of the 3D product codes in App. IV, and show that the 3D surface and toric codes are particular instances of this more general class of codes in Sec. B. We prove that all 3D product codes have (cubic) confinement for phase-flip errors (App. C), and therefore have single-shot error correction for adversarial phase-flip noise. We expect these codes to have single-shot error correction for local stochastic phase-flip noise as well. In fact, our definition of confinement generalises the definition proposed by Bombín [10] for the gauge color code and the notion of robustness for expander codes [20]; since both class of codes are proven to have a single-shot threshold for local stochastic noise [10,22] we conjecture that low density parity check (LDPC) codes with good (super linear) confinement have a threshold too. We investigate this case numerically.
In the single-shot setting, the code always has some residual error present and the error correction procedure introduces noise correlations in subsequent rounds of single-shot error correction. How then do we assess success or failure of a decoding algorithm? The concept of the sustainable threshold was proposed by Brown, Nickerson and Browne [12] as a metric for single-shot codes and decoders. We use p th (N ) to denote the threshold of a code-decoder family given N cycles of qubit noise, noisy syndrome extraction and single-shot decoding, with the N th cycle followed by a single round of noiseless syndrome extraction and decoding. The final round ensures that we can return the system to the codespace and assess success by the absence of a logical error. We define the sustainable threshold of the code-decoder family to be p sus = lim N →∞ p th (N ). (1) Numerically, this is estimated by plotting p th (N ) against N and fitting to the following ansatz, We numerically estimate the sustainable error thresholds of 3D toric and surface codes for two different two-stage FIG. 1. Numerical estimate of the sustainable threshold of the 3D surface code for a two-stage decoder where we repair the syndrome using MWPM, and solve the corrected syndrome problem using BP-OSD. We plot the error threshold p th (N ) for different numbers of cycles, N . Using the ansatz in Eq. (2), we estimate the sustainable threshold to be psus = 0.0308(4) with γ = 3.23. The inset shows a plot of the logical error rate, p fail , against the phase-flip and measurement error rate, p, for N = 8. The error threshold p th (8) is the point at which the curves intersect (L is the code distance).
decoders. We surpass all previous single-shot error thresholds for these code families, and we also obtain the highest code-capacity noise (no measurement error) threshold; see Table I. For our single-shot simulations, we use an independent and identically distributed (iid) noise model where each qubit experiences a phase-flip error with probability p, and each stabiliser measurement outcome is flipped with probability q = p. We investigate two decoding strategies: one where we use minimum-weight perfect matching (MWPM) for stage 1 decoding and belief propagation with ordered statistics decoding (BP+OSD) for stage 2 decoding and another where we use BP+OSD for both decoding stages. Fig. 1 shows the 3D surface code sustainable threshold fit, using the MWPM & BP+OSD decoding strategy. We find a comparable sustainable threshold for the 3D surface code using BP+OSD for both decoding stages, as shown in Table II. We achieve very similar performance for the 3D toric code, although there is a subtlety present in stage 1 decoding that is not present in the 3D surface code case; see Sec. V C. For both code families, we provide evidence that the performance of stage 1 decoding is the bottleneck of the full decoding procedure, and we achieve near-optimal performance within this constraint.
The advantage of using BP+OSD for stage 1 decoding is that, unlike MWPM, this decoder does not rely on the special structure of the loop-like syndrome present in 3D toric and surface codes. Therefore, we anticipate that one can use BP+OSD for single-shot decoding of general 3D product codes. We numerically test this prediction by decoding a family of non-topological 3D product codes using BP+OSD for both decoding stages, achieving sustainable thresholds that are comparable to those of the 3D toric and surface codes. This provides evidence that BP+OSD can be used as a generic two-stage decoder for single-shot LDPC 3D product codes.

III. FORMAL STATEMENTS
In this Section we introduce the definition of confinement for a stabiliser code and exhibit a theoretical two-stage decoder, the Shadow decoder, which we prove is single-shot on confined codes against adversarial noise. We refer the reader to App. A to see how a variant of the Shadow decoder can be used to prove that good families of codes with linear confinement have a single-shot threshold for local stochastic noise.
A stabiliser code encoding k logical qubits into n physical qubits can be described by its stabiliser group S and a syndrome map σ(·). The stabiliser group S is an Abelian subgroup of the Pauli group P n on n qubits which does not contain −1 and has dimension n − k. The syndrome map is not unique: any generating set of the group S defines a valid syndrome map for the code. If {s 1 , . . . , s m } is one of such generating sets, the associate function σ(·) maps a qubit operator p ∈ P n into the binary vector (s 1 , . . . ,s m ) T ∈ F m 2 , wheres i = 1 if s i anti-commutes with p and 0 otherwise. Importantly, σ(·) is linear, meaning that σ(p · q) = σ(p) + σ(q) over F m 2 . Because any Pauli operator p ∈ P n can be factorised as the product of an X and a Z-operator p X and p Z , we can identify it with a binary vectorp = (p X ,p Z ) T ∈ F 2n 2 , where the ith entry ofp X /p Z is 1 if and only if p X /p Z acts nontrivially on the ith qubit. Given a Pauli operator p, its weight |p| is the number of qubits on which its action is not the identity. Fixed a stabiliser code with syndrome function σ(·), the reduced weight of a Pauli operator p ∈ P n on the physical qubits is |p| red := min{|p · q| : σ(p · q) = σ(p), for some q ∈ P n }.
A stabiliser code is said to be distance d if d is the minimum weight of a Pauli operator not in S that has trivial syndrome. We will refer to a code of length n, dimension k and distance d as a [[n, k, d]] code.
For a stabiliser code, we then have Definition 1 (Confinement). Let t be an integer and f : Z → Z some increasing function with f (0) = 0. We say that a stabiliser code has (t, f )-confinement if, for all errors e with |e| red ≤ t, it holds Let us contrast this with Bombín's notion of confinement (Def. 16 of Ref. [10]) that has some similarities but only allows for linear functions of the form f (x) = κx for some constant κ. Many codes, including 3D product codes, have superlinear confinement functions, as such Bombín's definition does not encompass them. Moreover, the concept of confinement is closely related to soundness [18] but it is weaker and so able to encompass more families of codes, such as the expander codes [19-21] which are confined but not sound. Roughly speaking, a code has good confinement if small qubit errors produce small measurement syndromes; this differs from good soundness which entails that small syndromes can be produced by small errors.
Formally, we define the following notion of good confinement for a family of stabiliser codes Definition 2 (Good confinement). Consider an infinite family of stabiliser codes. We say that the family has good confinement if each code in it has (t, f )-confinement where: 1. t grows with the length n of the code: t ∈ Ω(n b ) with b > 0; 2. and f (·) is monotonically increasing and independent of n.
We say the code family has good X-confinement if the above holds only for Pauli-Z errors.
Our main analytic result is that codes with good confinement are single-shot Theorem 1. Consider a family of [[n, k, d]] quantum-LDPC codes with good confinement such that d ≥ an b with a > 0 and b > 0. This code family is single-shot for the adversarial noise model. If the code family only has good X-confinement then it is single-shot with respect to Pauli-Z noise.
We conjecture that the result of Thm. 1 can be extended to deal with local stochastic noise and used to show that LDPC codes with good confinement have a single-shot threshold. In this direction, we are able to prove that linear confinement is sufficient for codes to exhibit a single-shot threshold in the local stochastic noise setting: Theorem 2. Consider a family of [[n, k, d]] quantum-LDPC codes with qubit degree at most ω − 1 and good linear confinement such that d ≥ an b with a > 0 and b > 0. This code family has a sustainable single-shot threshold for any local stochastic noise model. If the code family only has good X-confinement then it has a sustainable single-shot threshold with respect to Pauli-Z noise.
We further prove that 3D product codes have Xconfinement: Theorem 3. All 3D product codes have (t, f ) X-confinement where t is equal to the Z-distance of the code and f (x) = x 3 /2 or better.
Thm. 1 and Thm. 3 together motivate our numerical experiments reported in Sec. V.
We now proceed to prove Thm. 1. To this end, we use the Shadow decoder that we introduce in Def. 3. The Shadow decoder differs from previous single-shot two stage decoders (e.g. the MW single-shot decoder introduced in Def. 6 of [18]) in that it does not rely on metachecks on syndromes. If syndromes are protected by a classical code, as it is the case for X-syndromes of 3D product codes introduced in Sec. IV, then a single-shot decoding strategy could work as follows: (1) correct the measured syndrome whenever it does not satisfy all the constraints defined by the metacode; (2) find a recovery operator on qubits that has syndrome equal to the one found at point (1). The Shadow decoder, instead, corrects the syndrome both anytime it fails to satisfy all the constraints of the metacode and when it is generated by high weight errors. We do not describe how to implement it or make statements concerning the complexity of decoding. Our proof makes similar assumptions as the Kovalev-Pryadko quantum-LDPC threshold theorem [37] where they assumed a minimum weight decoder without addressing implementation issues. Indeed, decoding for arbitrary LDPC codes is an NP-complete problem that we do not expect to be efficiently solvable in full generality.
The building blocks of the Shadow decoder are the t -Shadows of the code. A t -Shadow is a set in the syndrome space which contains all the images of Pauli errors e on the physical qubits that have weight at most t. In other words, if we identify Pauli errors e on n qubits with 2n-bit strings and we consider the metric space M = F 2n 2 endowed with the Hamming distance (i.e. the distance d(ē 1 ,ē 2 ) between the vectorsē 1 andē 2 corresponding to the Pauli errors e 1 and e 2 respectively is defined as d(ē 1 ,ē 2 ) = |e 1 + e 2 |) then the t -Shadow of the code is the image, via the syndrome function σ(·), of the ball of radius t centered at 0 in M. Note that, because balls on M are not vector spaces, the Shadows are not vector spaces either.
We are now ready to introduce the Shadow decoder.
Definition 3 (Shadow decoder). The Shadow decoder has variable parameter t > 0. Given an observed syndromē s = σ(e) +s e wheres e ∈ F m 2 is the syndrome error, the Shadow decoder of parameter t performs the following 2 steps: 1. Syndrome repair: find a binary vectors r of minimum weight |s r | such thats +s r belongs to the t -Shadow of the code, where t -Shadow = {σ(e) : |e| ≤ t}.
2. Qubit decode: find e r of minimum weight |e r | such that σ(e r ) =s +s r .
We call r = e r · e the residual error.
A key result in proving Thm. 1 is the following promise on the performance of the Shadow decoder: when a code has confinement, the weight of the residual error after one decoding cycle is bounded by a function of the weight of the syndrome error.
Lemma 1. Consider a stabiliser code that has (t, f )confinement. Provided that the original error pattern e has |e| red ≤ t/2, on input of the observed syndromes = σ(e)+s e , the residual error r left by the Shadow decoder of parameter t/2 satisfies: (3) Proof. Assume |e| red ≤ t/2. By construction, e r has minimum weight among all errors with syndrome σ(e)+s e +s r ∈ t/2 -Shadow of the code. In particular |e r | ≤ t/2. By the triangular inequality for the weight function, Therefore, we can apply the confinement property on the residual error r = e r · e: f |σ(e r · e)| ≥ |e r · e| red .
Note that the syndrome errors e is a possible solution of the syndrome repair step of the Shadow decoder, because by assumption |e| red ≤ t/2. Thus, |s r | ≤ |s e | and |s e +s r | ≤ |s e | + |s r | ≤ 2|s e |.
Combining these and the monotonicity of f leads to the required bound on the residual error: Thm. 1 follows directly from Lem. 1. In particular, Lem. 1 entails that a code with (t, f )-confinement is robust against N cycles of qubit noise, noisy syndrome extraction and singleshot decoding, as explained below.
At each cycle τ , we assume that a new error e τ is introduced in the system and it is added to the residual error r τ −1 . We assume that for the new physical error e τ and the syndrome measurement errors τ e the following hold: |e τ | red ≤ t/4 and f (2|s τ e |) ≤ t/4.
We perform syndrome extraction on the stateê τ = r τ −1 + e τ . The noisy syndromes τ = σ(ê τ ) +s τ e is used as input for the Shadow decoder of parameter t/2. The recovery operator e τ r found by the Shadow decoder is then applied to the state and finally a new cycle starts where r τ =ê τ + e τ r . Let r 0 = 0, so that the initial state of the system is given byê 1 = e 1 , s 1 = σ(ê 1 ) +s 1 e . Note that if then |ê τ | red = |e τ · r τ −1 | red ≤ t/2 and the hypotheses of Lem. 1 hold. Combining this with the bound on the syndrome error (9), we obtain In conclusion, provided that the conditions on the physical and the measurement error (9) are satisfied for each iteration up to τ − 1, the residual error after the τ th cycle is kept under control too. Thm. 2 is proven in App. A. There, we introduce a novel notion of weight to describe local stochastic errors: the closeness weight. We then present the Stochastic Shadow decoder, a variant of the (Adversarial) Shadow decoder of Def. 3. Importantly, on confined codes, it keeps the the closeness weight of the residual error under control over repeated correction cycles. Finally, the proof of Thm. 2 follows by combining these results with some classic percolation theory bounds.
The proof of Thm. 3 is very technical and is deferred to App. C. It is an adaption of the one of soundness for 4D codes given in [18], and it is reported in this manuscript for completeness. We remind the reader that, for our numerical studies on 3D product codes, we do not use the Shadow decoder, but rather heuristics that perform well in practice. In particular, we use a two-stage decoder that exploits a metacheck structure on syndromes and attempts to repair the syndrome if and only if it does not pass all metachecks.
Our main motivation to introduce the concept of confinement and the Shadow decoder was to find a feature of codes able to encompass all known examples of single-shot codes. Campbell [18] introduced the notion of soundness and showed that this property is a sufficient condition for codes to show single-shot properties in the adversarial setting. Nonetheless, Fawzi et al. [22] showed that expander codes have a singleshot threshold for local stochastic noise, even though they do not have the soundness property. As already said though, expander codes do have confinement. In Corollary 9 of [20] the authors prove that their confinement function is linear and call this property robustness. Confinement, in other words, fills the gap leaved by the concept of soundness. Furthermore, as Lem. 2 states, it is a requirement strictly weaker than soundness: any LDPC family of codes with good soundness has good confinement.
Definition 4 (Soundness [18]). Let t be an integer and f : Z → R be a function with f (0) = 0. Given a stabiliser code with syndrome map σ(·) we say it is (t, f )-sound if for all error sets e with |σ(e)| ≤ t it follows that f (|σ(e)|) ≥ |e| red .
Definition 5 (Good soundness [18]). Consider an infinite family of codes with syndrome maps σ n (·). We say that the family has good soundness if each code in it is (t, f )-sound where: 1. t grows with n such that t ∈ Ω(n b ) with b > 0; 2. and f (·) is monotonically increasing and independent of n.
It follows easily from Campbell's definition of soundness and our definition of confinement that the former entails the latter.
Lemma 2. Consider a LDPC code that is (t, f )-sound with f increasing. If its qubit degree is at most ω, then it has ( t ω , f )confinement.
Proof. If e is an error set with |e| red ≤ t ω , for its syndrome the following holds: By soundness of the code: In conclusion, confinement does answer to the need of finding general and inclusive properties related to single-shot error correction. The reminder of this article is devoted to the study of the 3D product codes. We recall their construction in Sec. IV and we numerically assess their single-shot performance under local stochastic noise in Sec. V.

IV. CODE CONSTRUCTION
The identification of pauli operators p ∈ P n with binary vectorsp = (p X ,p Z ) ∈ F 2n 2 is a group homomorphism (i.e. multiplication of Pauli operators corresponds to the sum of their vector representation in F 2n 2 ) and because σ(·) is linear, syndrome measurement can be simulated via a matrixvector product: where the vector (p X ,p Z ) T ∈ F 2n 2 represents a Pauli error on the physical qubits. Following the nomenclature from classical coding theory, we refer to the syndrome matrix H as parity check matrix and we say that a code is LDPC when its parity check is low density.
A stabiliser code is a CSS code if its stabiliser group can be generated by the disjoint union of a set of X-operators and a set of Z-operators. In this case, its parity check is a block matrix: where H X has size m x × n and H Z has size m z × n if the generating set of X-stabilisers/Z-stabilisers has cardinality m x /m z . Eq. (13) entails that syndrome extraction can be performed separately for the X-component and for the Zcomponent. In fact, if a Pauli operator has vector representation (p X ,p Z ) T = (p X , 0) T + (0,p Z ) T ∈ F 2n 2 , then for its syndrome holds: In other words, it is possible to truncate these vectors without loosing information and deal with X and Z operators separately. For this reason, we say that a CSS code is provided with two syndrome maps which correspond to the two blocks/matrices H X and H Z respectively. Accordingly, a CSS code will have a Z-distance and a X-distance and can be compactly be refereed to as a [[n, k, d x , d z ]] code.
To our purpose, it is handy to describe CSS codes in terms of chain complexes. A length chain complex is a collection of vector spaces C 0 , . . . , C and linear maps δ i : C i → C i+1 with the only constraint for i = 0, . . . , − 1. If H X and H Z are m x × n and m z × n binary matrices as in Eq. (13), then the chain complex: is well defined. In fact, the commutative condition on the stabilisers of the code entails that the X-generators and the Z-generators of the code have even overlap, such that they are orthogonal when seen as binary vectors. In other words, H X · H T Z = 0 is equivalent to the defining property of chain complexes (see Eq. (14)). In general, we can associate a CSS code to any chain complex {C i , δ i } of length at least 3 by equating H T Z = δ i and H X = δ i+1 for some index i. In the chain complex language, we say that the code has length dim C i+1 and the dimension of the (i+1)-th homology group H i+1 = ker δ i+1 / Im δ i . Equivalently, the dimension of the code is the dimension of the (i + 1)-th cohomology group H * i+1 = ker δ T i / Im δ T i+1 . The X and Z distances are given respectively by the minimum weight of any non-zero vector in H * i+1 and H i+1 .
Here, we study some decoding properties of 3D product codes. By this nomenclature we refer to the CSS codes obtained by the homological product of three length-1 chain complexes as described in [38]. Given three classical linear codes with parity check matrices δ A , δ B and δ C we can build a 3D quantum code as follows. If δ is a binary matrix of size m × n , it defines a linear map δ : C 0 → C 1 , where C 0 , C 1 are vector spaces over F 2 of dimension n and m respectively; in other words, each linear map defines a length-1 chain complex. The 3D product of the seed matrices δ A , δ B , δ C , is the length-3 chain complex C given by: where: The symbol ⊗ represents the tensor product. Given two vector spaces A and B over a field F, their tensor product is the vector space A ⊗ B generated by the formal sums a ⊗ b where a ∈ A and b ∈ B and the operator ⊗ is bilinear, i.e. for any a 1 , a 2 , b 1 , b 2 in A and B respectively, it holds that The horizontal stacking of spaces, instead, represents their direct sum.
It is easy to verify that condition (14) is verified for i = 1, . . . , 3 and therefore the chain complex C is well defined. As explained above, we define a CSS code on C by equating We refer to the matrix M = δ 2 as the metacheck matrix for the X-stabilisers. Condition (14) entails M H X = 0 and as a consequence we can think of the matrix M as a parity check matrix on the X syndromes: any valid X-syndrome satisfies the constraints defined by M .
Let [n , k , δ ]/[n T , k T , d T ] be the parameters of the classical linear code with parity check matrix δ /δ T . As showed in [38], C is thus associated with an [[n, k, d x , d z ]] code such that, if k = 0, n = n T a n b n c + n a n T b n c + n a n b n T c , By convention, the the distance of a code with dimension 0 is ∞. We define the single-shot distance d ss [18] of the chain complex C as the minimum weight of a vector in C 2 that satisfies all the constraints given by δ 2 (i.e. it belongs to the kernel of δ 2 ) but is not a valid X-syndrome (i.e. it does not belong to the image of δ 1 ). In other words, d ss is the minimum weight of a vector in the second homology group H 2 = ker δ 2 / Im δ 1 of the chain complex C. Following [38] it is easy to verify that It is important to note that, if the matrices δ are LDPC, then their 3D product code is quantum-LDPC. In fact, if δ has column (row) of weight bounded by c (r ), then δ i has column and row weight bounded by c i and r i respectively where: iii. c 2 ≤ max{c a , c b , c c } and r 2 ≤ r a + r b + r c .

A. On geometric locality
In addition to preserving the LDPC properties of the seed matrices, the 3D product yields local codes when qubits are placed on edges of a 3D cubic lattice. We defer the reader to App. B for a thorough discussion on the embedding of 3D product codes on a cubic lattice and we here present a loose summary.
Qubits of a 3D product code associated to the chain complex C are in bijection with basis elements of the space C 1 ; since C 1 is the direct sum of the three vector spaces C we introduce three different type of qubits: transverse, vertical and horizontal. Qubit types naturally correspond to the three different orientation of edges on a cubic lattice, namely edges parallel to each of the three crystal planes. Referring to this particular display of qubits, the stabilisers of the code defined by C have support as follows: 1. X-stabilisers have support on a 2D cross of qubits of two types out of three, contained in one of the three crystal planes; the crossing is defined by a square face of a cube (see Fig. 7); 2. Z-stabilisers have support on a 3D cross of qubits, with crossing defined by a vertex of a cube (see Fig. 8).
The cubic lattice considered can present some irregularities: in general it is a cubic lattice with some missing edges. Nonetheless, square faces and vertices are uniquely defined and they correspond to a stabiliser every time they contain at least one edge. More specifically, a square face identifies two perpendicular lines of edges/qubits on a plane which are the edges parallel to the boundary of the square face itself. The corresponding X-stabiliser has support contained on those lines of edges/qubits. Similarly, a vertex identifies three perpendicular lines of qubits and the corresponding Zstabiliser has support there contained. When combined with some locality properties of the seed matrices, this characteristic 'cross shape' of the stabilisers support entails that 3D product codes are local on a cubic lattice (Prop. 1 in App. B).
Here, by locality, we mean that for some positive integer ρ, hold: 1. any X-stabiliser generator has weight at most 2ρ with support contained in a 2D box of size ρ × ρ, 2. any Z-stabiliser generator has weight at most 3ρ with support contained in a 3D box of size ρ × ρ × ρ, Interestingly, it follows easily as a corollary of our locality proof that the 3D toric and surface codes are in fact 3D product codes. We now detail an explicit construction of the 3D toric and surface codes as 3D product codes and we remind the reader to App. B for further details.
The 3D toric code is the 3D product code obtained by choosing δ A = δ B = δ C = δ as seed matrices, where δ is the parity check matrix of the repetition code. For instance, the 3D toric code with linear lattice size L = 3 is given by In general, the 3D toric code of lattice size L, has parameters and single-shot distance d ss = L.
The 3D surface code is obtained from this construction by choosing, for linear lattice size L = 3, and single-shot distance d ss = ∞. Further details can be found in App. B.

B. Non-topological codes
The 3D product code construction can be used to obtain non-topological codes with non-local interactions. Table III shows the parameters for a class of non-topological codes based on classical LDPC codes. The specific advantage of non-topological codes is that it is possible to construct code families where the number logical qubits increases with the code length. This is in contrast to 3D toric and surface codes, where the number of logical qubits is fixed for all values of the code distance.

V. NUMERICS
To assess the single-shot performance of the 3D product codes, we simulate the decoding of phase-flip (Z) errors. As 3D product codes are CSS codes, the relevant stabilizers are the X-stabilizers. Letē Z ∈ F n 2 describe the support of a phase-flip error, i.e. (ē Z ) i = 1 if qubit i has a phase-flip error. The syndrome,s X , of this error is then where H X ∈ F m×n 2 is the parity check matrix of the Xstabilizers of the code (see Eq. (13)).
Owing to the chain-complex structure of 3D product codes (outlined in Sec. IV) the syndromess X are themselves the codewords of a classical linear code with parity check matrix M such that Ms X = 0 for alls X ∈ Im(H X ). We refer to such a code on the syndromes as metacode. The metacheck matrix can be used to detect and correct syndrome noise.
In a two-stage single-shot decoder, stage 1 decoding corrects the syndrome noise using M before stage 2 decoding corrects the data qubits. In general, decoding is an NP-complete problem that cannot be solved exactly in polynomial-time. However, good heuristic techniques exist that allow approximate solutions to be efficiently computed.
In this work, we use two such decoding methods: minimum weight perfect matching (MWPM) and belief propagation plus ordered statistics decoding (BP+OSD). Both MWPM and BP+OSD are algorithms that run over graphical models that encapsulate the structure of the code. We now briefly describe each decoder.

A. Minimum weight perfect matching (MWPM)
The minimum weight perfect matching (MWPM) decoder is useful for codes that produce pairs of syndromes at the ends of error chains. The method works by mapping the decoding problem to a graphical model in which nodes represent the code syndromes and weighted edges represent error chains of different lengths. For a given pair of syndrome excitations, the MWPM algorithm deduces the shortest error chain that could have caused it [39].
MWPM finds use for a variety of topological codes, most famously for the 2D surface and toric codes [2, [40][41][42][43]. For 3D codes, MWPM is a suitable candidate for syndrome repair step referred to as stage 1 decoding. Specifically, the syndrome of a phase-flip error can be viewed as a collection of closed loops of edges in a simple cubic lattice 1 (with boundary conditions depending on the code). Measurement errors cause loops of syndrome to be broken, and the job of stage 1 decoding is to repair these broken syndromes. To obtain the corresponding matching problem, we create a complete graph whose vertices correspond to the break-points of the broken syndrome loops, with edge weights that are equal to the path lengths between the break-points. We use the Blossom V [44] implementation of Edmonds's algorithm to solve this matching problem. The edges in the matching correspond to the syndrome recovery operators.

B. Belief propagation + ordered statistics decoding (BP+OSD)
Belief propagation (BP) is an algorithm for performing inference on sparse graphs that finds widespread use in highperformance classical coding. Classical LDPC codes, for example, achieve performance close to the Shannon-limit when decoded with BP [45]. In the context of quantum coding, BP is useful for codes that do not produce pairs of syndromes and therefore cannot be decoded with MWPM.
The BP algorithm maps the decoding problem to a bipartite factor graph where the two node species represent data qubits and syndromes respectively. Graph edges are drawn between the data and syndrome nodes according to the code's parity check matrix. The factor graph is designed to provide a factorisation of the probability distribution that describes the relationship between syndromes and errors. The BP algorithm proceeds by iteratively passing 'beliefs' between data and syndrome nodes, at each step updating the probability that a data node is errored. The algorithm terminates once the probability distribution implies a error pattern that satisfies the inputted syndrome.
For quantum codes, the standard BP algorithm alone does not achieve good decoding performance due to the presence of degenerate errors. These cause 'split-beliefs' and prevent the algorithm from terminating. Fortunately, the problem of splitbeliefs can be resolved by incorporating a post-processing technique known as ordered statistics decoding (OSD). The OSD step uses the probability distribution outputted by BP to select a low-weight recovery operator that satisfies the syndrome equation.
The BP+OSD algorithm was first applied to quantum expander codes by Panteleev and Kalachev [46]. Following this, Roffe et al. [47] demonstrated that the BP+OSD decoder applies more widely across a broad range of quantum-LDPC codes, including the 2D surface and toric codes. For this work, we use the software implementation of BP+OSD from [47], which can be downloaded from [48]. Algorithm 1 describes our methodology for the simulations of the two-stage single-shot decoder. The 3D toric code has a failure mode that is not present in the 3D surface code. In such codes, syndromess X exist that satisfy all of the metachecks, Ms X = 0, but are invalid syndromes, meaning thats X does not belong to the image of H X . In other words,s X is invalid if there is no error vectorē Z ∈ C 1 with syndromes X but it is a codeword of the metacode.

Algorithm 1 SINGLE-SHOT ERROR CORRECTION
Referring to the chain complex structure of C: we see that these non-valid syndromes are non-trivial elements of the 2nd homology group: If k m is the dimension of H 2 , the set of invalid syndromes is a vector subspace of C 2 of dimension k m whose vectors can be written asū + H XēZ whereū is a representative of the equivalence class [ū] ∈ H 2 andē Z ∈ C 1 . Thus, if F M is a matrix whose columns are k m vectors in C 2 that generate H 2 (meaning that they belong to k m different equivalence classes in H 2 ), we can write any invalid syndromes X as: wherev ∈ F km 2 is non-zero if and only ifs X is invalid andē Z is any error vector in C 1 .
By duality on C, the 2nd cohomolgy group: has order k m too. If L M is a matrix whose k m rows generates H * 2 , then the product Π = L M F M has full rank k m because both L M and F M have full rank. Moreover, since the rows of L M in particular belongs to ker H T X , it holds L M H X = 0. Combining these two observations with Eq. (17) yields: where Πv = 0 if and only ifv = 0 because Π is full rank. In conclusion, we have found that: if and only ifs X is an invalid syndrome. As a consequence, we can assess whether a syndrome is invalid or not by calculating this product. The meaning of matrices L M and F M can be understood by looking at elements in H 2 and H * 2 as logical operators of a CSS code defined on C with qubits in C 2 (see Sec. IV). In this settings, the full rank condition rank(L M F M ) = k m translates in the anticommuting relation between logical X and logical Z operators of the code.
In the 3D toric code, these invalid syndromes are loops of edges around one of the handles of the torus, and are equivalent to the logical operators of the metacode. It is therefore possible to check whether stage 1 decoding results in such a failure by checking whether the repaired syndrome anticommutes with a matrix L M whose rows generate the relevant group of the logical operators of the metacode. When a metacode failure is encountered, a failure-mode subroutine (line 13 of Algorithm 1) is called that forces the repaired syndrome into the correct form. This sub-routine involves using BP+OSD to decode a modified version of the metacheck matrix M defined as follows The additional constraints in the modified metacheck matrix ensure that the repaired syndrome is never an invalid syndrome. We call this procedure as a subroutine (rather than all the time) as the L M component causes M to have higher maximum row and column weights than M , resulting in a reduction in BP decoding performance. Indeed, the rows of L M must have weight lower bounded by the transpose distances of the seed codes 2 . Since the transpose distances of the seed codes also determine the Z-distance of the quantum code (Sec. IV), we want these quantities to be growing with the length n of the code and therefore the matrix L M is not, in general, LDPC.
We find that whilst the failure-mode subroutine does not change the error threshold of the decoder, it does considerably reduce the logical error rate. This is illustrated by Fig. 2, which shows the single-shot logical error rate with and without the failure-mode subroutine. For large syndrome error 2 More precisely, rows of L M are vectors in C 2 that correspond to elements of the second cohomology group H * 2 ; hence their weight is lower bounded rates, Fig. 2 shows the failure-mode subroutine improves decoding performance by over an order of magnitude.

D. 3D toric and surface codes
We estimate the sustainable threshold of the 3D toric and surface codes using our two decoding strategies. For codecapacity noise (i.e. perfect syndrome measurements), the syndrome-repair step is not required, so both decoding strategies are the same. For each code family, we observe a code capacity threshold of p th ≈ 21.6%, as illustrated in Fig. 3. To obtain our threshold estimates, we use the standard critical exponent method [49] (see App. D for details). In the singleshot setting, we find similar performance for both our decoding strategies, as summarized in Table II. Our results compare favourably with the performance of other decoders, which we list in Table I. We obtain the highest reported code-capacity threshold and the highest reported single-shot threshold.
We remark that the sustainable threshold that we observe for the 3D toric code is very close to the threshold of MWPM for string-like errors in the 3D toric code [50]. This implies that the performance of decoder 1 (the syndrome-repair step) is limiting the performance of the entire decoding procedure, as was suggested in [13]. Although the sustainable thresholds we observe for 3D surface codes are slightly higher than for 3D toric codes, the codes we consider are relatively small, which means that boundary effects may be having an impact on our sustainable threshold estimates.
We also investigated the suppression of the logical error rate below threshold in the 3D toric code, using MWPM & BP+OSD. We use the following ansatz for the logical error rate for values of p < p th , where α and β are parameters to be determined. The code distance of the 3D toric code for Z errors is L 2 , so if the decoder is correcting errors up to this size, we would expect β ≈ 2. Using the fitting procedure described in App. D, we estimate β = 1.91(3) for N = 0 (code capacity) and β = 1.15(3) for N = 8 (eight rounds of single-shot error correction). Therefore, for the (relatively small) codes that we consider, we find evidence that BP+OSD is correcting errors of weight up to the code distance. Viewed as an error correction problem, the distance of the syndrome-repair step of decoding (i.e the singleshot distance d ss ) is L, which is consistent of our observed value of β in the single-shot case. This provides further evidence that the bottle-neck of our single-shot decoding procedure is the syndrome-repair step.

E. Non-topological codes
So far, we have focused on the decoding of 3D topological codes. We now show that the BP+OSD decoder can be used for single-shot decoding of more general 3D product codes. Table III shows a family 3D product codes constructed by taking the 3D product of a (3, 4)-LDPC code 3 with two instances of the classical repetition code. The result is a code family where the number of logical qubits is not fixed. This code family was decoded using a two-stage single-shot decoder, BP+OSD ×2, yielding the threshold plot in Fig. 4. The simulation results suggest a sustainable threshold in the region of 2.7%.

VI. CONCLUSION
In this article, we investigated single-shot decoding of 3D product codes. We gave a formal definition of confinement in quantum codes and proved that all 3D product codes have confinement for Z errors. We also proved that confinement is sufficient for single-shot error correction against adversarial noise. This is a strengthening of the result of Campbell [18], who showed that a property called soundness is sufficient for single-shot error correction, in that soundness implies confinement but the converse is not true. Remarkably, there are important classes of codes, such as quantum expander codes, which have confinement but not soundness. Further to that, we prove that codes with linear confinement, and so expander codes, do have a single-shot threshold for local stochastic noise. The obvious open problem arising from our work is how to extend our findings for linear confinement to the super linear case. Is confinement, in general, a sufficient condition for quantum-LDPC codes to exhibit a single-shot threshold?
If not, what other requirements should a code satisfy to ensure the existence of a single-shot threshold?
We simulated single-shot error correction for a variety of 3D product codes, concentrating on 3D toric and surface codes. Using MWPM & BP+OSD, we achieved the best known code capacity error threshold and sustainable singleshot error threshold for this code family (for phase-flip noise). Our results strongly suggest that the bottleneck of two-stage decoders is the first stage where the noisy syndrome is repaired. For the 3D toric code, the optimal threshold of the syndrome repair step is 3.3% [33], whereas the optimal threshold of the entire decoding problem is 11.0% [35]. This implies that two-stage decoders can never achieve optimal performance in these codes, so perhaps other single-shot decoding methods ought to be investigated in future.
We also simulated single-shot error correction for a family of non-topological 3D product codes, using BP+OSD for both decoding steps. We achieved performance very close to that of the 3D toric and surface codes, which indicates that BP+OSD is a high-performance single-shot decoder. Furthermore, the versatility of BP+OSD means that we expect it to work as a single-shot decoder for general LDPC 3D product codes. We leave confirmation of this to future work, and we conjecture that BP+OSD will achieve good performance for other classes of quantum-LDPC codes such as topological fracton codes [51,52].  We present the Stochastic Shadow decoder, a variant of the (Adversarial) Shadow decoder described in Def. 3, and prove that it succeeds in correcting errors that have connected components that are sufficiently sparse and of bounded size, both on the syndrome and the qubits (Lem. 6). Thm. 2 will then follow from Lem. 6 on the performance of the Stochastic Shadow decoder: a family of codes with good linear confinement has a single-shot threshold under the local stochastic noise model. This Appendix is organised as follows. After fixing some graph-theory notation in Sec. A 1, we introduce a novel weight function for node sets in a graph, the closeness function, Sec. A 2. We prove that the closeness weight function preserves confinement and that the Stochastic Shadow decoder can be used on confined codes to keep the closeness of error under control (Sec. A 3). Crucially, the closeness weight function characterises the structure of local stochastic errors better that the Hamming weight does, as some classic results in percolation theory show. We conclude, in Sec. A 4, by showing that a family of codes with good linear confinement has a sustainable single-shot threshold (Thm. 2). Our proof is built on the results in [22,53], where the authors prove that expander codes (which have linear confinement) have a singleshot threshold when decoded via the small-set flip decoder.

Notation and preliminaries
Given a stabiliser code on n qubits with stabiliser group S ⊆ P n , we associate to it two graphs: (G q , ∼ q ), the qubit graph, and (G s , ∼ s ), the syndrome graph. The set of nodes are G q , the n qubits, and G s , a generating set of the stabilizer group S 4 . The adjacency relations ∼ q and ∼ s are defined as where the support supp(s) of a Pauli operator s in P n is the set of all the qubits on which its action is non-trivial. We will use lower-case symbols for Pauli operators in P n and the corresponding upper-case symbol to indicate its support e.g. E := supp(e). We use the term error to refer interchangeably to a Pauli operator or its support, in particular given two Pauli operators e 1 and e 2 we use the symbol + to indicate the support of the product operator e 1 · e 2 5 , so that E 1 + E 2 = supp(e 1 · e 2 ).
In this picture, the syndrome σ(·) maps the set of Pauli operators on n qubits P n into the power set of G s , a set of generators for the stabiliser group: We define the neighbour map Γ as With slight abuse of terminology, we call syndrome any element of P(G s ), even when such a set does not belong to the image of σ. When referring to an error as a set E, it is always to be intended as corresponding to a fixed Pauli operator e ∈ P n such that E := supp(e). We will write interchangeably σ(e)/σ(E) and Γ(e)/Γ(E) to indicate the image, via the syndrome map and the neighbour map respectively, of the Pauli error e. Given two syndromes sets in G s we use the symbol + to indicate their symmetric difference. It is easy to verify that the map σ(·) preserves the + operation (i.e. it is linear): σ(e 1 · e 2 ) = σ(E 1 + E 2 ) = σ(E 1 ) + σ(E 2 ).
Moreover, the image via σ of disjoint non-connected sets is disjoint. In fact, if E 1 , E 2 are two disjoint non-connected sets in G q and we suppose that their syndrome sets are not disjoint we find a contradiction. Letŝ be a stabiliser in σ(E 1 ) ∩ σ(E 2 ). By definition of σ, this entails that e 1 and e 2 both anti-commute withŝ which is equivalent to saying that their supports have odd overlap with supp(ŝ). In particular, there exists q i ∈ E i such that q i ∈ supp(ŝ) and, by the definition of the adjacency relation ∼ q , q 1 ∈ E 1 and q 2 ∈ E 2 would be connected viaŝ, against the assumption. Note that, in general the image via the syndrome map σ(·) of a connected set needs not to be connected. However, the neighbour function Γ(·) maps connected sets into connected sets. We will make use of these properties in Sec. A 3.

The closeness weight function
When errors are local stochastic it can be handy to use definitions of weight other than the cardinality/Hamming weight. For instance, the authors in [22] define the quantities of Def. 6 and study a related notion of percolation to understand the tolerance to errors of a given connected graph.
Definition 6 (α-subsets, MaxConn α (E) [22]). An α-subset of a set E ⊆ G q is a set K such that |K ∩ E| ≥ α|K|. The maximum size of a connected α-subset of E is denoted by MaxConn α (E).
We here introduce a conceptual cousin to MaxConn α (E), the β-closeness of an error set E, and prove that it is a well defined weight function (see Lem. 3). We do not explicitly detail the relations between α-subsets and closeness here. However, we will implicitly use them, as our percolation results and ultimately the proof of Thm. 2 heavily rely on those relations and the proofs in [22,53].
Definition 7 (β-closeness). Let G be a connected graph i.e. a graph in which there exist a path between any two of its nodes. Given a subset E of nodes and a positive integer β, we define its β-closeness as the quantity: We call any connected subset of β nodes a β-patch and any β-patch K such that |K ∩ E| = E β maximal patch for E.
Since we are interested in the β-closeness of error sets on a qubit graph G q , it is natural to introduce the notion of reduced β-closeness.
Definition 8. Given a qubit error set E ⊆ G q , its reduced β-closeness E red β is defined as Crucially, we will see in Lem. 5 that the closeness function preserves confinement. As a consequence, we can build a variant of the Shadow decoder (Def. 9) that succeeds in correcting errors of small reduced closeness.
We now prove some basic properties of the β-closeness weight function · β on a connected graph G.
Lemma 3. Let G be a connected graph and denote by |G| the number of its nodes. For any positive integer β < |G|, the following hold: (i) · β ≤ | · |; (ii) · β ≤ β; the equality holds if and only if the considered set of nodes has a connected component of size at least β; conversely, if · β < β then the connected components of the set all have size less than β; (iii) it is positive: E β ≥ 0 and equality holds if and only if E = ∅; (iv) it satisfies the triangle inequality: for any E 1 , Proof. In the following, let K ⊆ G be a maximal β-patch for E, i.e. E β = |K ∩ E|.
(ii) |K ∩ E| ≤ |K| = β. Equality holds if and only if K ∩ E = K ⊆ E which entails that E has a connected component of size at least β, since K is connected.
(iii) If E is non empty then there exists at least one node g ∈ E. Since G is connected, for any integer 1 ≤ β ≤ |G| there exists a β-patch that contains g so that E β ≥ 1.
(iv) Let J be any β-patch in G. The following hold: Since this holds for any β-patch, we obtain (v) Let K 1 , K 2 be maximal β-patches for E 1 and E 2 respectively. Then Lem. 4 below states that there exists a canonical form for maximal β-patches of an error set E. Roughly speaking, a canonical β-patch K will be made up of some entire connected components of E, plus at most one connected proper subset of a connected component of E, and some other nodes not in E (see Fig. 5). The existence of a canonical β-patch is key in proving that the closeness function preserves confinement in the sense explained by Lem. 5.
Lemma 4 (Canonical β-patch). For any error E on a qubit graph G there exists a maximal β-patch T such that, for all but one connected component E i of E, it holds: In other words, if E 1 , . . . , E m are the connected components of E, re-ordering if necessary, there exists an index ν such that: We call any such T a canonical β-patch for the set E.
Proof. Let J be any maximal β-patch for E i.e. J is connected, has size β and |J ∩ E| = E β . Staring from J we build a set T with the desired form. Write J ∩ E as disjoint union of connected sets: We call these J i 's patch-error components. Let E 1 . . . E µ be the connected components of the error E. We recall that a connected component E i of E is a connected set which is connected to no additional nodes in E \ E i . We say that E i is incomplete with respect to J if it has non trivial overlap with J but it is not entirely contained in J, i.e.
Note that it can be the case for two disjoint (but internally connected) error-patch components J i1 and J i2 to overlap with the same incomplete error component E i .
We consider a meta-graph G whose meta-nodes are connected sets in G and meta-edges are paths in G. Because the error-patch components are both internally and reciprocally connected in J, there exists a meta-spanning-tree T ⊆ G whose ν nodes J i are the error-patch components J i and whose meta-edges ε ij are formed by minimum length paths in G between the J i 's with nodes in J \ E. In the following we will indicate with T , J i and ε ij the meta-tree, its meta-nodes and its meta-edges and with T , J i and e i,j the corresponding sets of nodes in G. Note that, by this identification, T has at most β nodes. We now show how to modify the meta-tree T so that the corresponding set of nodes T in G is canonical for E. We do this in two steps: the balancing and the enlargement step.
BALANCING We show by induction on the number ν of the meta-nodes J i 's that it is possible to modify T so that the corresponding set of nodes T ⊆ G satisfies conditions (A1) on its overlap with the connected components of E. ν = 1 : the thesis is trivially verified. ν > 1 : if J is not canonical for E then E must have at least two incomplete components with respect to the patch J. Let J be a meta-leaf of T and J its corresponding subset of nodes in G. We iteratively remove from T the nodes of J , both preserving connectivity of T and the size of T ∩ E.
For any node q λ in J , we choose a node q χ such that: i. q χ belongs to some incomplete component of the error disjoint from J : q χ ∈ E χ and E χ ∩ J = ∅; ii. q χ is a new node i.e. it does not belong to J: q χ ∈ G \ J; iii. q χ is connected to at least one node in some errorpatch component other from J : q χ ∼ q q χ , q χ ∈ J χ for some χ = .
We remove q λ from J and add q χ to J, and thereby updating T accordingly. This process terminates when either (a) we are not able to find such a new node q χ or (b) there are no more nodes q λ in J .
Case (a) entails that E has at most one incomplete component with respect to T . In fact, if E had an incomplete component E χ disjoint from J such a node q χ always exists. As a consequence, if we are not able to find a new error node to enlarge one of the error-patch components J χ = J the only incomplete component of E must be the one relative to J . The updated node set T has the desired property, provided that we had removed nodes q λ from J preserving connectivity (for instance, considering a spanning tree for nodes in J and iteratively removing leaves). If case (b) is verified, we remove from T all the meta-edges that were incident to J . The updated meta-tree T derived from the updated set T has ν − 1 meta-nodes. By the induction hypothesis, it can be modified to obtain the desired form.
In other words, we pick a meta-leaf of T and we either remove part of its nodes (case (a)) or all of them (case (b)). We preserve the quantity |T ∩ E| by adding new error nodes to some different error-patch component that overlaps with an incomplete component of the error E. By choosing a leaf, we are able to preserve the connectivity of T and thus the connectivity of the corresponding node sets T . The importance of the canonical form for a patch is highlighted in the differences between the patches in (a) and (b). We observe how the crosses/syndrome nodes σ(Ei) are scattered inside the dashed curve/neighbour set Γ(Ei). For this reason, in order to group enough syndrome nodes inside a patch of bounded size, we need some care in the choice of the error nodes. When we include entire connected components of the error in a patch in Gq, we are able to build a patch in Gs which includes entire neighbour sets and, as a consequence, all the corresponding syndrome nodes. In fact, even if we assume that the dotted blue/error patches in (a) and (b) have same size, when we enlarge them by a factor of ω to build the green/syndrome patch, we obtain dramatically different results. In (a) since the dotted/error patch contains several incomplete components, the corresponding green/syndrome patch contains incomplete portions of the dashed/neighbour sets Γ(Ei). Hence, we have no guarantee on the number of crosses/syndrome nodes included in the patch. In (b) the dotted blue patch is a canonical patch for the error. We can see how the green/syndrome patch entirely contains the dashed/neighbour sets of all but one component of the error contained in the dotted blue/qubit patch. In this way we have the certainty to include in the green/syndrome patch a sufficient number of crosses/syndrome nodes to ensure confinement.
We iterate this procedure over meta-leaves of T until the overlap of the corresponding set T in G and the error set E has the desired form.
ENLARGEMENT By contradiction, we prove that it is possible to add nodes to the set T corresponding to the balanced meta-tree T so that it is connected, it has size exactly β and |T ∩ E| = E β . First note that during the balancing procedure, the number |T ∩ E| remains constant and it holds: Moreover, the initial tree is connected and the balancing procedure preserves connectivity. However, we only have an upper bound on the size of T . In fact, if T is the initial meta-tree and T is its corresponding sub-graph in G, it holds T ⊆ J and therefore |T | ≤ β. During the balancing step the size of T could decrease when we remove nodes of e ij , belonging to a meta-edge ε ij . Thus, in general, after the balancing step for the weight of T holds: |T | ≤ β.
If |T | = β, then T is a β-patch with maximum overlap with E and, by balancing, it is canonical. If |T | < β, then there must exist at least β − E β nodes in G \ (E ∪ T ) that are connected to T . In fact, a connected proper subset can always be enlarged in a connected graph. If the only way to enlarge T to a β-patch were by adding nodes in E, then we would have found a β-patch whose overlap with E has size greater than its β-closeness, which contradicts the definition of E β . In conclusion, any of such enlargements of the tree T is a canonical β-patch for E.

Confinement and Stochastic Shadow Decoder
Here, we first prove that the closeness function preserves confinement, as Lem. 5 states. Then, we present the Stochastic Shadow decoder (Def. 9) and prove, in Lem. 6, that it succeeds in correcting errors of small enough closeness. These findings, together with the percolation results of Sec. A 4, will yield the proof of the existence of a single-shot threshold for codes with linear confinement.
Lemma 5 (Closeness preserves confinement). Consider a code with qubit degree at mostω and (t, f )-confinement, where f is convex. Then, for any error E with E red t ≤ t 2 , it holds: where ω =ω + 1.
Proof. To ease the notation, let F be an error set such that σ(E) = σ(F ), F t = E red t . If F 1 , . . . , F µ are the con-nected components of F , by Lem. 4 there exists a canonical patch K for F such that: for some ν ≤ µ + 1. First, we prove that there exists an ωt-patch J in the syndrome graph G s such that it contains the syndrome of the connected components F 1 , . . . , F ν of the error which intersect the canonical patch K: Then, we prove that such a patch J has overlap with σ(F ) of Hamming weight large enough to ensure confinement with respect to the closeness function: We will then find the desired bound on E using the initial assumptions σ(F ) = σ(E) and F t = E red t . EXISTENCE OF J We build a ωt-patch J on G s as follows. We define J as the disjoint union of the (at most)ω|F i | connected nodes Γ(F i ): Let π be the set of edges of a minimum length path in K that connects all its ν disjoint error components F i . These edges correspond naturally to a set π s ⊆ G s if we associate to the edge (q 1 , q 2 ), the corresponding stabilizer in G s , remembering that: Under this identification, importantly, adjacent edges are mapped into neighbouring syndrome nodes. We add the set π s to J. As a result, J is now connected. For the size of J, it holds: Combining property (ii) of the closeness weight function and the assumption F t ≤ t 2 , yields, for any i, and ν in particular, Since π has edges in K, π s has size at most |K| i.e. : Adding up, we obtain:

|J| ≤ ωt
where ω =ω + 1. By enlarging J if necessary to include exactly ωt nodes, and remembering that by construction it is connected, we have found that J is an ωt-patch in G s , as desired. OVERLAP OF J WITH THE ERROR SYNDROME Eq. (A2) entails in particular that any connected error component F 1 , . . . , F ν that has non-trivial overlap with the patch K, has size smaller than t and therefore it has confinement: Because σ maps disjoint sets of G q in disjoint sets of G s , Thus, applying f to each term of the summation of Eq. (A4) we have: For the left hand side of Eq. (A5), using convexity of f we obtain: for the right hand side of Eq. (A5) instead, since K is canonical for F , it holds that: Combining these two bounds for (A5) yields: To obtain the thesis from Eq. (A6), we just need to substitute the Hamming weight on the left hand side with the closeness weight · ωt . By construction, for J it holds that: Moreover, since J is a ωt-patch: Using the monotonicity of f and combining Eq. (A7), (A8) and (A6) yields: CONCLUSION Because F is an error set equivalent to E i.e. σ(F ) = σ(E), such that F t = E red t , we conclude: for ω =ω + 1.
Lem. 5 in particular entails that the closeness weight is in fact a sensible quantity to look at when dealing with errors on confined codes.
We now introduce the Stochastic Shadow decoder. The difference between this variant and the one previously presented (Def. 3) is on the weight functions used. While the standard/Adversarial Shadow decoder tries to minimise the Hamming weight of the residual error, the Stochastic Shadow decoder attempts to keep under control its closeness.
Definition 9 (Stochastic Shadow decoder). The Stochastic Shadow decoder has variable parameters 0 < α ≤ 1, and 0 < β, γ ∈ Z. Given an observed syndrome S = σ(E) + S e where S e ⊆ G s is the syndrome error, the Stochastic Shadow decoder of parameters (α, β, γ) performs the following 2 steps: 1. Syndrome repair: find S r of minimum γ-closeness S r γ such that S + S r belongs to the (α, β) -Shadow of the code, where 2. Qubit decode: find E r of minimum β-closeness E r β such that σ(E r ) = S + S r .
We call R = E + E r the residual error.
We have the following promise on the Stochastic Shadow decoder, which mirrors the results of Lem. 1 for the Adversarial Shadow decoder.
Lemma 6. Consider a stabiliser code that has (t, f )confinement and qubit degree ≤ ω − 1. Provided that the original error pattern E has E red t ≤ t/2, on input of the observed syndrome S = σ(E) + S e , the residual error R left by the Stochastic Shadow decoder of parameter ( 1 2 , t, ωt) satisfies: Proof. Thanks to Lem. 5, we know that the closeness function preserves confinement. The proof is then a straightforward adaption of the proof of Lem. 1, where the Hamming weight has to be substituted with · t on error sets and · ωt on syndrome sets respectively. We here briefly report the proof for completeness. Assume E red t ≤ t/2, and let E r be the output of the qubit decode step. By construction, it has minimum t-closeness among the errors with syndrome S + S r , which belongs to the ( 1 2 , t) -Shadow of the code. In particular, E r t ≤ t 2 . We recall that the + operation between two error sets in G q denotes the support of the product of the two corresponding Pauli operators and, as such, it holds that (see Sec. A 1): By the property of the closeness weight function, this entails: The linearity of the syndrome function σ(·) yields: Since S e is a possible solution of the syndrome repair step S r ωt ≤ S e ωt and so, S e + S r ωt ≤ S e ωt + S r ωt ≤ 2 S e ωt .
Combining this and the monotonicity of f gives: Lem. 5 tells us that the Stochastic Shadow decoder succeeds whenever the t-closeness of the error is small enough. Importantly then, if we are able to bound the probability of the complement of this event, we could infer an upper bound on the failure probability of our decoder. This is the subject of the next Section.

Percolation results and proof of Theorem 2
We consider error sets E on the qubit graph G q and error sets S e on the syndrome graph G s and we assume that the probability of observing a particular error is at most exponential in its size. Formally, we use this error model Definition 10 (Local stochastic error). An error set E on a graph G is local stochastic of parameter p if, for all set of nodes G ⊆ G, holds: We then use some results in percolation theory, Lem. 7 and Lem. 8 below, to understand the probability that errors of closeness linear in the patch size (i.e. E β = αβ for some 0 < α ≤ 1) occur when the noise is local stochastic.
Lemma 7 (Corollary 28 of [22]). Let G be a graph with vertex degree upper bounded by z. Then the number N β of connected components of size β (β-patches) satisfies Lemma 8. Let G be a graph with vertex degree upper bounded by z. Let t be a positive integer and 0 < α ≤ 1. Then there exists p th > 0 such that, for local stochastic errors E of parameter p < p th , we have where h(α) = α log 2 ( 1 α ) + (1 − α) log 2 1 1−α is the binary entropy function.
Proof. The proof is a straightforward adaption of the proof of Theorem 17 in [22]. By expanding the left hand side of Eq. (A10), we find: Observe that, for a t-patch K, By Stirling's approximation 6 : Combining Eq. (A11), (A12) and Lem. 7 yields: By imposing the right hand side to decrease with t, we find And in conclusion: (1−x) is the binary entropy function.
Finally, we are able to prove that there exists a threshold under which the probability of local stochastic errors to be noncorrectable via the Stochastic Shadow decoder becomes exponentially small in the system size, provided that the graphs G s and G q have bounded degree and linear confinement.
Proof of Thm. 2. By Lem. 6, the residual error left by the Stochastic Shadow decoder on a (t, f )-confined code is kept under control provided that If the function f is linear, i.e. f (x) = κx for some κ > 0 ∈ Z, then conditions (A13) can be written as If the qubit error E is local stochastic of parameter p and the syndrome error S e is local stochastic of parameter q, thanks to Lem. 8, we obtain: where: and q th := 1 As a result, by Lem. 6, the residual error is correctable except with probability at most In other words, for local stochastic noise of intensity p ≤ p th on the qubits and q ≤ q th on the syndrome, the Stochastic Shadow decoder has a sustainable single-shot threshold.
We conclude by noting that the assumption of linear confinement is key in the proof of Thm. 2. However, we speculate that the limitations of Thm. 2 are an artefact of our proof and super linear confinement is a sufficient condition for a family of codes to exhibit a single-shot threshold. In fact, the existence of a threshold p th and q th relies on the bounds given in Lem. 8. There, it is fundamental that the relation between the chosen size of the patch and the size of the overlap with the error is linear (see Eq.(A11) and Eq.(A12)). In other words, Lem. 8 states that, if we take β-patches on the error graph and γ-patches on the syndrome graph, we are able to estimate the probability that errors have closeness less than αβ andαγ respectively. By (A13), in order to bound the closeness of the residual error left by the Stochastic Shadow decoder, we need: As a consequence, combining this with the requirements of Lem. 8, entails for some positive constant κ. In conclusion, building up on the results of Lem. 8, we either need to prove that confinement is preserved if we take on the syndrome graph patches of size linear in f −1 (αβ) or, using our Lem. 5 without modification, that the function is itself linear.
Appendix B: Qubit placement on a 3D lattice Here we detail how to embed a 3D product code on a cubic lattice, where qubits sit on edges, Z-stabilisers on vertices, X-stabilisers on faces and metachecks on cells.
Let C 0 and C 1 be two vector spaces over F with basis B 0 = {e 0 1 , . . . , e 0 n } and B 1 = {e 1 1 , . . . , e 1 m } respectively. Given a linear map from C 0 into C 1 , it can be represented as a m × n matrix δ over F such that its action on the elements of the basis B 0 is given by: Expression (B1) allows us to write the support of vectors in δ(B 0 ) = δe 0 i i in a compact form. In fact, the support of δe 0 i is the subset of B 1 : supp(δe 0 i ) = e 1 α : δ α,i = 0 α .
Since basis vectors are uniquely identified by their index, we can compactly write (B1) as a relation * on the set of indices of the basis B 0 and B 1 : where Similarly, the transpose δ T of the matrix δ induces a map from C 1 to C 0 which is defined on B 1 as  (B2 T) where η * = {κ : δ η,κ = 0} κ .
Referring to the chain complex C described in Sec. IV, we choose bases B τ = e τ ι ι of C τ for τ = 0, 1 and = A, B, C. We accordingly fix matrix representations of the maps δ A , δ B and δ C ; with slight abuse of notation, we indicate with the same symbol the m × n matrix representation of a map and the map itself. We indicate with i, j, k indices of B 0 A , B 0 B and B 0 C respectively and with α, β, γ in- Since we deal with 3-fold tensor product spaces (e.g. C 0 A ⊗ C 0 B ⊗ C 0 C ) we consider triplets (i, j, k) of valid indices; we indicate with (i * , j, k) the set of indices {(η, j, k) : η ∈ i * }, and similarly for any possible triplet combination of starred (ι * ) and non starred (ι) indices.
As illustrated in Sec. IV, when defining a CSS code on the chain complex C, the following relations hold: 1. basis elements of C 0 are in one-to-one correspondence with a generating set of Z-stabilisers; 2. basis elements of the vector space C 1 are in one-to-one correspondence with the qubits; 3. basis elements of the vector space C 2 are in one-to-one correspondence with a generating set of X-stabilisers; 4. basis elements of C 3 are in one-to-one correspondence with a generating set of metachecks.
Combining these with (B2) and (B2 T), we obtain the relations reported in Table IV. More precisely, we choose as bases for the spaces C 3 , C 2 , C 1 and C 0 the product bases obtained by combining B 0 =A,B,C and B 1 =A,B,C and we index qubits, stabilisers and metachecks on C accordingly. Equivalently, basis vectors are labelled with consecutive integers so as to preserve the ordering induced by the bases.
We use the relations of Table IV to visualise the chain complex C on a 3D cubic lattice. In order to do so, we first fix a coordinate system where O is the origin. Since basis vectors are labelled with integers (the ith basis vector corresponds to the integer i, and vice versa) we can build a 3D grid of points where any point corresponds to a basis vector of C 0 , C 1 , C 2 or C 3 . More precisely we fix a set of valid coordinates for points in the grid: 1. integer coordinates (z, y, x) = (i, j, k) for i = 1, . . . , n a , j = 1, . . . , n b , and k = 1, . . . , n c ; 2. half-integers coordinates (z, y, x) = (α + 0.5, β + 0.5, γ + 0.5) for α = 1, . . . , m a , β = 1, . . . , m b and γ = 1, . . . , m c ; 3. the origin has coordinates O = (1, 1, 1).
In this way, any point with valid coordinates uniquely identifies a basis vector (and therefore an object in the chain complex, see Table IV). For example: 1. the point (1, 4, 2) corresponds to the basis vector (e A0 1 ⊗ e B0 4 ⊗ e C0 2 ) ∈ C 0 (Z-stabilisers); 2. the point (1.5, 4, 2) corresponds to the basis vector (e A1 1 ⊗ e B0 4 ⊗ e C0 2 , 0, 0) ∈ C 1 (qubits); 3. the point (1.5, 4, 2.5) corresponds to the basis vector (0, e A1 1 ⊗ e B0 4 ⊗ e C1 2 , 0) ∈ C 2 (X-stabilisers); 4. the point (1.5, 4.5, 2.5) corresponds to the basis vector (e A1 1 ⊗ e B1 4 ⊗ e C1 2 ) ∈ C 3 (metachecks); We draw an edge for any qubit of the code defined on C. Qubits are in one-to-one correspondence with basis element of C 1 and therefore are of three different types: (v, 0, 0), (0, v, 0) and (0, 0, v). Accordingly, we draw edges of three different types as detailed in Table V (see also Fig. 6). In other words, any point with two integer entries and one half integer entry is the middle point of an edge of unit length, which corresponds to a qubit. In this way we obtain a cubic lattice with (possibly) some missing edges.
Points with two half-integer and one integer entries do not intersect any edge and sit in the center of a (possibly incomplete) square face. These points correspond to X-stabilisers which we therefore identify with faces. Given a triplet corresponding to one of such a point, the associated X-stabiliser has support contained in the set of edges which are parallel to the edges of the square, forming a cross in a plane. QUBIT EDGE transverse qubits edges parallel to the z axis (α, j, k) middle point: (α + 0.5, j, k) vertical qubits edges parallel to the y axis (i, β, k) middle point: (i, β + 0.5, k) horizontal qubits edges parallel to the x axis (i, j, γ) middle point: (i, j, γ + 0.5)  X-stabilisers, like qubits, are of three different types, being in one-to-one correspondence with basis elements of C 2 . Namely, each X-stabiliser in C 2 has support in two out of three type of qubits: transverse-vertical, transverse-horizontal or vertical-horizontal (see Table VI and Fig. 7). Points with integer coordinates are associated to Zstabilisers; these are points where endpoints of edges intersect. The Z-stabiliser corresponding to (i, j, k) has support on a 3D cross of edges/qubits centered in (z, y, x) = (i, j, k) (see Table VI and Fig. 8).
Points with half-integer coordinates sit in the center of a cube. To any such cube is associated a metacheck in C 3 . Metachecks have support on a 3D cross of faces/X-stabilisers parallel to the faces of the cube they are associated to (see Table VI).

On geometric locality
One interesting feature of the embedding of 3D product codes on a cubic lattice is that it preserves some locality properties of the seed matrices δ A , δ B and δ C . Thus, if we were able to place qubits on a 3D cubic lattice we could use the 3D homological product to build LDPC codes with nearest neighbour interactions.
Let δ be an m × n matrix with row/column indices α ∈ OPERATOR TYPE SUPPORT

X-stabilisers
transverse-vertical square transverse qubits: (α, β * , k) (α, β, k) vertical qubits: (α * , β, k) transverse-horizontal square transverse qubits: (α, j, γ * ) (α, j, γ) horizontal qubits: (α * , j, γ) vertical-horizontal square vertical qubits: (i, β, γ * ) (i, β, γ) horizontal qubits: (i, β * , γ) Z-stabilisers (i, j, k) transverse qubits: (i * , j, k) vertical qubits: (i, j * , k) horizontal qubits: (i, j, k * ) metachecks (α, β, γ) transverse-vertical faces: (α, β, γ * ) transverse-horizontal faces: (α, β * , γ) vertical-horizontal faces: (α * , β, γ) TABLE VI. Correspondence between operators of the chain complex C, their type as geometric objects on the lattice, and their support. Note that the support of X and Z stabilizers is a set of qubits/edges while the support of metachecks is a set of X-stabilisers/faces. {1, . . . , m} and i ∈ {1, . . . , n} respectively and let ν = max{m, n}. We say that δ is geometrically ρ-local on a torus if for any row and any column index: where U ρ, ν (ζ) is any set of ρ consecutive integers modulo ν which contains ζ. In particular, we require the αth rows to have support on columns with index that is close to the integer α, and similar for columns. The reason for this choice will be clear when we prove Prop. 1. Briefly, conditions (B3) says that δ is geometrically ρ-local on a torus if: (1) any of its rows has support on a bounded box of ρ-columns, and the box for row α + 1 is a right shift of the box for row α; (2) any of its columns has support on a bounded box of ρ rows, and the box for column i + 1 is a downward shift of the box for column i.
In particular, if we associate row/column indices with integer points on a circle of ν points: FIG. 8. Z-stabilisers on the lattice described in Fig. 6. (a) Zstabiliser corresponding to the vertex indexed by (i, j, k) = (2, 4, 2); its support is contained in the cross of qubits highlighted as red edges in the picture. The crossing has coordinates (z, y, x) = (2, 4, 2) (red circle). (b) Z-stabiliser corresponding to the vertex indexed by (i, j, k) = (3, 6, 2); its support is contained in the cross of qubits highlighted as red edges in the picture. The crossing has coordinates (z, y, x) = (3, 6, 2) (red circle). A closely related notion of locality on a torus is geometric locality in Euclidean space. We say that an m × n matrix is geometrically ρ-local in Euclidean space if for any row and column index: where U ρ (ζ) is any set of ρ consecutive integer in [1, . . . , ν], ν = max{m, n}, which contains ζ. In this case we can graphically picture locality by associating row/column indices with integer points on a line of ν points: A matrix is local if any set α * /i * is contained in a closed interval on the line such that (i) it has length at most ρ and (ii) it contains the point α/i. For example, the full-rank parity check matrix of the repetition code: obtained via the edge augmentation procedure presented in [47] is 7-local on a torus. We remark that geometric locality is a property of matrices. For example, the matrix with same row as H but different ordering {1, 2, 3, 4, 7, 5, 6}, is geometrically 5-local on torus.
In general, geometric locality is a relaxation of the locality property of the repetition code which only allows for interactions between pairs of nearest bits. Importantly, as Prop. 1 states, it is preserved by the 3D product construction. For this reason, geometrically local classical codes, combined with the 3D product construction, could be good candidates in the quest to quantum local codes beyond the toric and the surface codes.
The remainder of this Appendix is organised as follows. We first state Prop. 1 and prove that geometric locality is preserved by the 3D product construction. We conclude by observing how this proof provides an explicit identification of the 3D toric and surface codes as 3D product codes.
To ease the notation, in the following we will shortly refer to codes as geometrically local, dropping the specification on a torus/in Euclidean space. When considering qubits on a cubic lattice, the lattice would be on a torus or in Euclidean space depending on the definition of locality that applies to the seed matrices.
Proposition 1. Consider the 3D product code obtained from three seed matrices geometrically ρ-local. If its qubits are displayed on the edges of a cubic lattice as detailed in Sec. B, then it is geometrically ρ-local in the following sense: 1. any X-stabiliser generator has weight at most 2ρ with support contained in a 2D box of size ρ × ρ, 2. any Z-stabiliser generator has weight at most 3ρ with support contained in a 3D box of size ρ × ρ × ρ.
Proof. We prove the condition on the Z-stabilisers, the proof for the X-stabiliser being similar. Let S z be a Z-stabiliser generator. As reported in Table IV and VI, it is the image of a basis vector (e A0 i ⊗e B0 j ⊗e C0 k ) ∈ C 0 via the map δ 1 and it corresponds to the point on the lattice of integers coordinates (i, j, k). By exploiting the choice of the basis for the spaces C 0 and C 1 and some linear algebra : Again using Table IV, the set of indices which corresponds to this sum of basis vectors of C 1 can be written as: Following the nomenclature of qubits as traversal, vertical and horizontal, we see that the three components of the support of S z given above respect this division and therefore we can write: Using (B4) (or (B3)), we see that the sets indices(S z ) t , indices(S z ) v and indices(S z ) h correspond respectively to the three sets of consecutive coordinates on the lattice: Since we required ζ ∈ U ρ (ζ) (or ζ ∈ U ρ,ν (ζ)), the three sets of coordinates intersect on the point (z, y, x) = (i, j, k). Moreover, all three intervals Π t , Π v , Π h have length at most ρ. Combining these, we find that the support of S z indexed by (i, j, k) is contained in in a ρ×ρ×ρ neighborhood of the point (z, y, x) = (i, j, k) and has cardinality at most 3ρ. In other words, we have showed that the support of S z is contained on a 3D cross of qubits with arms of length at most ρ.
As previously said, the 3D toric and planar codes are particular instances of the 3D product construction. Furthermore, it is well known that they are local on a torus and in the Euclidean space respectively. To see how this is the case, we remind the reader that the 3D toric code is obtained by choosing as seed matrices the degenerate parity check matrix of the repetition code in the standard basis. For matrix size L × L, it holds that {1, . . . , L} ←→ {1, . . . , L} i −→ {i, i + 1 mod L} {α, α + 1 mod L} ←− α Therefore, stabilisers have support on pairs of consecutive edges, and it is straightforward to see that they have the usual shape: 1. Z-stabilisers have support on edges incident to a vertex; 2. X-stabilisers have support on edges on the boundary of a square face; 3. metachecks have support on the faces of a cube.
A similar argument holds for the 3D surface code, which is local in Euclidean space.
Appendix C: All 3D product codes have X-confinement In this Section we prove Thm. 3 which states that all 3D product codes have X-confinement. Our proof follows the proof of soundness for 4D codes given in [18] with some minor adaptions and it is here reported for completeness.
First, we show that an opportunely chosen length-2 chain complex has confined maps. Secondly, we explain how to use this chain complex as a building block of the length-3 chain complex C described in Sec. IV. Lastly, we prove that the confinement property is preserved and thus 3D codes defined on C as explained in Sec. IV have X-confinement.
Let δ A : C 0 A → C 1 A and δ B : C 0 B → C 1 B be two length-1 chain complexes. We consider the length-2 product complex C defined as: We first show that the mapδ 0 has confinement.
In order to prove Lem. 9 we first introduce some useful notation. When considering vectors v in a two-fold tensor product space F n1 ⊗ F n2 it can be handy to consider their reshaping, which is n 1 × n 2 matrix on F. Namely, fixed bases B 1 = {a 1 , . . . , a n1 } and B 2 = {b 1 , . . . , b n2 } of F n1 and F n2 respectively, their product ..,n1 j=1,...,n2 is a basis of F n1 ⊗ F n2 . Therefore, we can write for some v ij ∈ F. We call the matrix V whose entries are the coefficient v ij the reshaping of v. Given matrices M and N of size n 1 × m 1 and n 2 × m 2 associated to linear maps from F n1 and F n2 respectively, the map M ⊗ N from F n1 ⊗ F n2 to F m1 ⊗ F m2 acts on the reshaping of v as: In the following we will always indicate with lower-case symbol vectors and with the corresponding upper-case symbols their reshaping. We can now use this notation to prove Lem. 9.

Proof.
Let v ∈ C A 0 ⊗ C B 0 and let s =δ 0 (v). By reshaping, If we assume |v| = |v| red ≤ t = min{d A , d B } then V has no column in ker δ A and no row in ker δ T B so that col(δ A V ) = col(V ) and row(V δ T B ) = row(V ), where col(V )/row(V ) is the number of non-zero columns/rows of the matrix V . Therefore, for the weight of S, it holds that: Combining this with (a + b) 2 /4 ≥ ab for integers a, b yields: We want to use Lem. 9 to infer that the code defined on the chain complex C has X-confinement. To see how this is the case, we consider an 'asymmetrical' version of C as the product of the length-2 chain complexC and the length-1 chain complex δ C : C C 0 → C C 1 . The asymmetric product complex C is then Claim 1. Let (v, w) ∈C 1 have weight less than t and s = δ 1 (v, w) be its syndrome . If (V, W ) is the reshaping of the vector (v, w) then the following Syndrome Equation holds: where S is the reshaping of s. Note that a stabiliser for the chain complexC 0 →C 1 → C 2 →C 3 and the syndrome mapδ 1 (·) has the formδ 0 (m) for some m ∈C 0 . By construction, we can add any stabiliser to (v, w) without violating the Syndrome Equation (SE). In particular, 1. |(v, w)| < t entails that its reshaping satisfies the following properties: (a) Both V and W have at most t non-zero rows. Thus all their columns have weight at most t.
(b) Both V and W has at most t non-zero columns. Thus all their rows have weight at most t. Observe that: (a) M is a matrix whose non-zero columns are equal to a column of V . Therefore M has row support contained in the row support of V : M is a matrix whose column support is supp(W i δ T C ) for some row W i of W . Therefore M has column support contained in the column support of W : col(W ) ⊆ col(W ). (C4) Lemma 10 (Inheritance of confinement).δ 1 has (t, f )confinement where t = min{d A , d B , d C } and f (x) = x 3 /2.
Proof. Let (v, w) ∈C 1 be such that |(v, w)| = |(v, w)| red ≤ t and s =δ 1 (v, w) be its syndrome. Reshaping vectors into matrices (see Eq. (C1) and (C2)) yields the following Syndrome Equation: We will transform the vector (V, W ) by adding stabilisers to it in order to change its column and row support. We do this by iterating the following two steps.
Step 1: Let i, j be row and column indices s.t.
Build a matrix M as in Claim 1. Transform V and W accordingly: Note that in this way we are able to delete row i of W δ T C . Iterate this step until we obtain: Step 2: Let i, j be row and column indices s.t.
(a) (W δ T C ) j = 0 and (S 1 ) j = 0; this entails Build a matrix M as in Claim 1. Transform V and W accordingly: Note that in this way we are able to delete row i of W δ T C and by repeatedly doing so we can delete any column j of W (δ T C ) which does not belongs to the column support of S 1 . Iterate this step until we obtain: col(W δ T C ) ⊆ col(S 1 ).

(C6)
Let M be the matrix formed by summing over all the matrices M found during these two steps. Define V and W as We now proceed to prove an upper bound for the weight of W first and then one for the weight of V . By combining these two bounds we obtain the desired confinement relation between the weight of the syndrome and the weight of the error. BOUND ON THE WEIGHT OF W 1. By Claim 1, no row of W has weight more than t and therefore none of them belongs to ker δ T C so that row(W δ T C ) = row(W ). Combining this with Equation (C5) yields: row(W ) ⊆ row(S 1 ). (C8) 2. By Claim 1, the column support of W is contained in the column support of W which is equal to the column support of S 2 , by assumption on its weight. Summing these up: . We note that for the single-shot case there is an odd-even effect so we only include the data for odd L. We extract the gradients g(L) from the corresponding straight line fits in (a) and (b) (grey lines), and plot the logarithms of these values against log L [(c) and (d)]. The data fit well to the linear ansatz given in Eq. (D5), which allows us to estimate the parameters α and β, which control the suppression of the logical error rate as per Eq. (D2). For code capacity noise, we estimate α = 0.546(33) and β = 1.91(3), and for eight rounds of single-shot error correction, we estimate α = 0.610(37) and β = 1.15(3). The error bars in (a) and (b) show the 95% confidence intervals log p fail = logp fail ± 1.96 p fail p fail (1 − p fail )/η, where η ≥ 10 4 is the number of Monte Carlo trials. We only include data points with at least 25 failures. The error bars in (c) and (d) show the 95% confidence intervals given by the LINEARMODELFIT function of Mathematica.