[proofplan]
We work in the formal power series ring $K[[X]]$ and define the **error co-locator polynomial** $\omega(X) := -X \sigma'(X)$, where $\sigma'$ denotes the formal derivative. A partial-fractions calculation shows that the rational function $\omega/\sigma$ has a power-series expansion whose $j$-th coefficient is precisely the syndrome value $e(\alpha^j) = \sum_{i \in E}(\alpha^j)^i$. Since $c(\alpha^j) = 0$ for $1 \leq j \leq 2t$, these syndromes coincide with $r(\alpha^j)$, which establishes existence of $(\sigma, \omega)$ satisfying (1) and (2). For uniqueness and minimality we exploit that $\sigma$ has distinct nonzero roots, which forces $\gcd(\sigma, \omega) = 1$; cross-multiplying any candidate congruence then produces a polynomial identity that forces the candidate to be a scalar multiple of $\sigma$, and condition (1) fixes the scalar to $1$.
[/proofplan]
[step:Define the error co-locator polynomial and compute its expansion]
Define the polynomial
\begin{align*}
\omega: K &\to K \\
X &\mapsto -X \sigma'(X),
\end{align*}
where $\sigma'$ is the formal derivative of $\sigma$ in $K[X]$. By the product rule for formal derivatives,
\begin{align*}
\sigma'(X) = \sum_{i \in E} \left( -\alpha^i \right) \prod_{j \in E \setminus \{i\}} (1 - \alpha^j X),
\end{align*}
so multiplying by $-X$ gives
\begin{align*}
\omega(X) = \sum_{i \in E} \alpha^i X \prod_{j \in E \setminus \{i\}} (1 - \alpha^j X).
\end{align*}
Since each summand is a polynomial of degree $|E|$ and $|E| \leq t$, we have $\deg \omega \leq t$. Also $\omega(0) = 0$, so $\omega$ has zero constant term.
[/step]
[step:Expand the rational function $\omega/\sigma$ in $K[[X]]$ by partial fractions]
The polynomial $\sigma(X)$ has constant term $\sigma(0) = \prod_{i \in E} 1 = 1$, so $\sigma$ is a unit in the formal power series ring $K[[X]]$. Therefore $\omega/\sigma \in K[[X]]$ is well-defined as a power series.
We compute $\omega/\sigma$ by partial fractions. Observe that
\begin{align*}
\frac{\omega(X)}{\sigma(X)} = \frac{\sum_{i \in E} \alpha^i X \prod_{j \in E \setminus \{i\}} (1 - \alpha^j X)}{\prod_{i \in E}(1 - \alpha^i X)} = \sum_{i \in E} \frac{\alpha^i X}{1 - \alpha^i X}.
\end{align*}
For each $i \in E$ we expand the geometric series (valid in $K[[X]]$ since $\alpha^i X$ has zero constant term):
\begin{align*}
\frac{\alpha^i X}{1 - \alpha^i X} = \sum_{j=1}^{\infty} (\alpha^i X)^j = \sum_{j=1}^{\infty} (\alpha^j)^i X^j.
\end{align*}
Summing over $i \in E$ and exchanging the finite inner sum with the outer sum,
\begin{align*}
\frac{\omega(X)}{\sigma(X)} = \sum_{j=1}^{\infty} \left( \sum_{i \in E} (\alpha^j)^i \right) X^j = \sum_{j=1}^{\infty} e(\alpha^j)\, X^j,
\end{align*}
where $e(X) = \sum_{i \in E} X^i$ is the error polynomial evaluated at powers of $\alpha$.
[guided]
We want to show that the two polynomials $\sigma$ and $\omega$ we have defined satisfy the key-equation congruence. The strategy is to first identify the rational function $\omega/\sigma$ as a concrete power series in $K[[X]]$, then read off the coefficients.
Because $\sigma(0) = 1$, $\sigma$ is invertible in $K[[X]]$, so $\omega/\sigma$ makes sense as a power series. Why partial fractions? The denominator $\sigma$ is already factored as $\prod_{i \in E}(1 - \alpha^i X)$, and the definition $\omega = -X\sigma'$ is exactly what produces the partial-fraction decomposition
\begin{align*}
\frac{\omega(X)}{\sigma(X)} = \sum_{i \in E} \frac{\alpha^i X}{1 - \alpha^i X}.
\end{align*}
This identity follows by substituting the factored form of $\sigma$ and the explicit expression for $\omega = -X\sigma'$: after dividing the sum for $\omega$ by $\sigma$, the factor $\prod_{j \in E \setminus \{i\}}(1 - \alpha^j X)$ in the $i$-th term of $\omega$ cancels with all but the $i$-th factor of $\sigma$.
Now each single fraction $\alpha^i X / (1 - \alpha^i X)$ is a standard geometric series in $K[[X]]$: since $\alpha^i X$ has zero constant term, the inverse $(1 - \alpha^i X)^{-1} = \sum_{j \geq 0} (\alpha^i X)^j$ converges formally. Multiplying by $\alpha^i X$ shifts the sum by one, so
\begin{align*}
\frac{\alpha^i X}{1 - \alpha^i X} = \sum_{j=1}^{\infty} (\alpha^i)^j X^j.
\end{align*}
Summing over $i \in E$ and swapping the finite sum over $i$ with the sum over $j$ gives
\begin{align*}
\frac{\omega(X)}{\sigma(X)} = \sum_{j=1}^{\infty} \left( \sum_{i \in E} (\alpha^i)^j \right) X^j.
\end{align*}
The inner sum is exactly $e(\alpha^j) = \sum_{i \in E} (\alpha^j)^i$ (swapping the roles of the exponents uses commutativity of the product in the exponent), so we obtain $\omega(X)/\sigma(X) = \sum_{j \geq 1} e(\alpha^j) X^j$ in $K[[X]]$.
[/guided]
[/step]
[step:Replace error-polynomial values by received-word values using the BCH constraint]
Multiplying through by $\sigma(X)$ in the power series ring gives the identity
\begin{align*}
\sigma(X) \sum_{j=1}^{\infty} e(\alpha^j)\, X^j = \omega(X) \qquad \text{in } K[[X]].
\end{align*}
Because $c \in \mathcal{C}$ is a codeword of the BCH code of designed distance $\delta \geq 2t + 1$, we have $c(\alpha^j) = 0$ for $1 \leq j \leq \delta - 1$, and in particular for $1 \leq j \leq 2t$. From $r = c + e$ and linearity of polynomial evaluation,
\begin{align*}
r(\alpha^j) = c(\alpha^j) + e(\alpha^j) = e(\alpha^j) \qquad \text{for } 1 \leq j \leq 2t.
\end{align*}
Reducing the power-series identity modulo $X^{2t+1}$ truncates it to its first $2t$ terms, so the substitution $e(\alpha^j) \mapsto r(\alpha^j)$ is valid in the reduced relation:
\begin{align*}
\sigma(X) \sum_{j=1}^{2t} r(\alpha^j)\, X^j \equiv \omega(X) \pmod{X^{2t+1}}.
\end{align*}
Together with $\sigma(0) = 1$ and $\deg \omega \leq t$, this is precisely conditions (1) and (2).
[/step]
[step:Establish coprimality of $\sigma$ and $\omega$]
[claim:$\gcd(\sigma, \omega) = 1$ in $K[X]$]
We show that $\sigma$ and $\omega = -X\sigma'$ share no common root in any extension of $K$.
[proof]
The roots of $\sigma$ in an algebraic closure $\overline{K}$ are exactly $\alpha^{-i}$ for $i \in E$, and these are pairwise distinct because $\alpha$ has multiplicative order $n$ and the indices $i$ lie in $\{0, 1, \ldots, n-1\}$. Since $\sigma$ has distinct roots, $\gcd(\sigma, \sigma') = 1$ in $K[X]$.
It remains to check that $X \nmid \sigma(X)$: indeed $\sigma(0) = 1 \neq 0$, so $0$ is not a root of $\sigma$. Hence
\begin{align*}
\gcd(\sigma(X), \omega(X)) = \gcd(\sigma(X), -X\sigma'(X)) = \gcd(\sigma, X) \cdot \gcd(\sigma, \sigma') = 1 \cdot 1 = 1,
\end{align*}
where we used that $\gcd$ is multiplicative over coprime factors. Thus $\sigma$ and $\omega$ are coprime in $K[X]$.
[/proof]
[/claim]
[/step]
[step:Deduce uniqueness of $(\sigma, \omega)$ of least degree from the coprimality]
Suppose $\tilde\sigma, \tilde\omega \in K[X]$ satisfy conditions (1) and (2) with $\deg \tilde\sigma \leq \deg \sigma \leq t$ and $\deg \tilde\omega \leq t$. From condition (2) applied to both pairs,
\begin{align*}
\sigma(X) \sum_{j=1}^{2t} r(\alpha^j) X^j &\equiv \omega(X) \pmod{X^{2t+1}}, \\
\tilde\sigma(X) \sum_{j=1}^{2t} r(\alpha^j) X^j &\equiv \tilde\omega(X) \pmod{X^{2t+1}}.
\end{align*}
Multiplying the first congruence by $\tilde\sigma$ and the second by $\sigma$, then subtracting,
\begin{align*}
\tilde\sigma(X)\, \omega(X) \equiv \sigma(X)\, \tilde\omega(X) \pmod{X^{2t+1}}.
\end{align*}
We now bound the degree of $\tilde\sigma \omega - \sigma \tilde\omega$: since $\deg \tilde\sigma \leq t$, $\deg \omega \leq t$, $\deg \sigma \leq t$, $\deg \tilde\omega \leq t$, each product has degree at most $2t$, hence so does the difference. A polynomial of degree at most $2t$ that is congruent to $0$ modulo $X^{2t+1}$ must be the zero polynomial. Therefore
\begin{align*}
\tilde\sigma(X)\, \omega(X) = \sigma(X)\, \tilde\omega(X) \qquad \text{in } K[X].
\end{align*}
By the previous step, $\gcd(\sigma, \omega) = 1$. Applying Euclid's lemma in the principal ideal domain $K[X]$ to the identity $\sigma \mid \tilde\sigma \omega$, coprimality forces $\sigma \mid \tilde\sigma$. Since $\deg \tilde\sigma \leq \deg \sigma$, we conclude $\tilde\sigma = \lambda \sigma$ for some $\lambda \in K$.
Finally, condition (1) applied to $\tilde\sigma$ gives $\tilde\sigma(0) = 1$, and we have $\sigma(0) = 1$, so $\lambda = \tilde\sigma(0)/\sigma(0) = 1$, yielding $\tilde\sigma = \sigma$ and correspondingly $\tilde\omega = \omega$.
[guided]
We now extract uniqueness. Suppose some other pair $(\tilde\sigma, \tilde\omega)$ also satisfies conditions (1) and (2) with $\deg \tilde\sigma \leq \deg \sigma$. Our goal is to prove $\tilde\sigma = \sigma$, $\tilde\omega = \omega$.
The natural first move is to eliminate the common factor $\sum_{j=1}^{2t} r(\alpha^j) X^j$ between the two congruences. Multiplying the $\sigma$-congruence by $\tilde\sigma$ and the $\tilde\sigma$-congruence by $\sigma$ gives
\begin{align*}
\tilde\sigma \sigma \sum_{j=1}^{2t} r(\alpha^j) X^j \equiv \tilde\sigma \omega &\pmod{X^{2t+1}}, \\
\tilde\sigma \sigma \sum_{j=1}^{2t} r(\alpha^j) X^j \equiv \sigma \tilde\omega &\pmod{X^{2t+1}},
\end{align*}
and subtracting eliminates the middle expression: $\tilde\sigma \omega \equiv \sigma \tilde\omega \pmod{X^{2t+1}}$.
Now comes the key degree argument: a congruence modulo $X^{2t+1}$ becomes an equality whenever both sides have degree at most $2t$. Why do we have this degree bound? All four polynomials $\sigma, \tilde\sigma, \omega, \tilde\omega$ have degree at most $t$, so each product has degree at most $2t$, and the difference $\tilde\sigma \omega - \sigma \tilde\omega$ also has degree at most $2t$. Being congruent to $0$ modulo $X^{2t+1}$ and of degree at most $2t$, it must be the zero polynomial. Hence we have the **equality** $\tilde\sigma \omega = \sigma \tilde\omega$ in $K[X]$.
This polynomial identity is where coprimality pays off. From $\sigma \tilde\omega = \tilde\sigma \omega$ we read off $\sigma \mid \tilde\sigma \omega$ in $K[X]$. Since $\gcd(\sigma, \omega) = 1$, Euclid's lemma (valid in the PID $K[X]$) gives $\sigma \mid \tilde\sigma$. Combined with $\deg \tilde\sigma \leq \deg \sigma$, we conclude $\tilde\sigma = \lambda \sigma$ for some scalar $\lambda \in K$.
The constant-term condition (1) fixes $\lambda$: we have $\sigma(0) = 1 = \tilde\sigma(0) = \lambda \sigma(0) = \lambda$, so $\lambda = 1$. Therefore $\tilde\sigma = \sigma$, and substituting back into the equality $\tilde\sigma \omega = \sigma \tilde\omega$ gives $\tilde\omega = \omega$.
What would break if $\sigma$ had a repeated root? Then $\gcd(\sigma, \omega) \neq 1$, Euclid's lemma would fail, and uniqueness could be lost — we would only determine $\tilde\sigma$ up to multiplication by a common factor. The distinctness of the error locators $\alpha^{-i}$, which comes from $\alpha$ being a primitive $n$-th root of unity and $i \in \{0, \ldots, n-1\}$, is essential.
[/guided]
[/step]
[step:Verify that $\sigma$ has the least degree among polynomials satisfying (1) and (2)]
Suppose $\tilde\sigma \in K[X]$ satisfies (1) and (2) with $\deg \tilde\sigma < \deg \sigma$. Running the same argument as in the previous step (which used only $\deg \tilde\sigma \leq \deg \sigma$) yields $\tilde\sigma = \lambda \sigma$ for some $\lambda \in K$. But then $\deg \tilde\sigma = \deg \sigma$ unless $\lambda = 0$; and $\lambda = 0$ is incompatible with $\tilde\sigma(0) = 1$. Hence no polynomial of strictly smaller degree satisfies (1) and (2), so $\sigma$ is of least degree.
Combining the construction in the first three steps with the uniqueness argument of the fourth, $\sigma(X) = \prod_{i \in E}(1 - \alpha^i X)$ is the unique polynomial of least degree in $K[X]$ satisfying conditions (1) and (2). This completes the proof.
[/step]
