prove_source_goldilocks_zk.glass

# =============================================================================
# prove_source_goldilocks_zk.glass — real Glass SOURCE -> a ZK proof over Goldilocks
#
# R1b proved a HAND-BUILT circuit over the production field. This drives the same
# cryptographic Goldilocks STARK from REAL GLASS SOURCE: prism parses the source,
# a `cgen` lowers it to Goldilocks gates, and the committed, F_{p^2}-challenged,
# query-verified, blinded STARK proves the result — the source front-end wired
# into the production-field backend.
#
# THE PATH.  source text --prism--> Expr AST --unroll--> a call-free term (calls and
# higher-order arguments inlined) --cgen--> Goldilocks gates + a bignum witness
# --R1b STARK--> a succinct, zero-knowledge proof over Goldilocks (p = 2^64-2^32+1).
# The output wire IS the function's result, so claiming a wrong value breaks the
# gate that produced it.
#
# SCOPE: `+`, `-`, `*`, `let`, function calls (inlined), and now `==` / `if`. The
# comparison lowers to a real circuit gadget over the production field: a free
# inverse-hint wire (GHint) plus an assert (GEqZero) realise is-zero — d = a - b,
# inv = d^-1 (or 0), di = d*inv, z = 1 - di, assert z*d == 0, so z = (a==b), a 0/1
# wire; `if` is the mux f + c*(t - f). The trace domain is N=16 (the gadget pushes
# the gate count past 8). `match` / ADTs over bignum remain the next step.
# Imports prism. int64-safe (base-2^16 limbs); heavy interpreted -> run natively
# (examples/selfhost/run_native.sh); dogfoods byte-identical.
# =============================================================================

import "../selfhost/prism.glass"

fn lmod(x: Int) : Int = x % 65536
fn ldiv(x: Int) : Int = x / 65536
fn rev_go(xs: List<Int>, acc: List<Int>) : List<Int> = match xs { [] => acc; [h, ...t] => rev_go(t, [h] ++ acc) }
fn rev(xs: List<Int>) : List<Int> = rev_go(xs, [])
fn drop_zeros(xs: List<Int>) : List<Int> = match xs { [] => []; [h, ...t] => if h == 0 then drop_zeros(t) else xs }
fn trim(xs: List<Int>) : List<Int> = rev(drop_zeros(rev(xs)))
fn addc(a: List<Int>, b: List<Int>, carry: Int) : List<Int> =
  match a {
    [] => match b { [] => if carry == 0 then [] else [carry]; [hb, ...tb] => let s : Int = hb + carry in [lmod(s)] ++ addc([], tb, ldiv(s)) };
    [ha, ...ta] => match b { [] => let s : Int = ha + carry in [lmod(s)] ++ addc(ta, [], ldiv(s)); [hb, ...tb] => let s : Int = ha + hb + carry in [lmod(s)] ++ addc(ta, tb, ldiv(s)) }
  }
fn bn_add(a: List<Int>, b: List<Int>) : List<Int> = trim(addc(a, b, 0))
fn smul(xs: List<Int>, k: Int, carry: Int) : List<Int> =
  match xs { [] => if carry == 0 then [] else [carry]; [h, ...t] => let p : Int = h * k + carry in [lmod(p)] ++ smul(t, k, ldiv(p)) }
fn shift(xs: List<Int>, n: Int) : List<Int> = if n <= 0 then xs else [0] ++ shift(xs, n - 1)
fn mul_go(a: List<Int>, b: List<Int>, i: Int) : List<Int> =
  match b { [] => []; [hb, ...tb] => bn_add(shift(smul(a, hb, 0), i), mul_go(a, tb, i + 1)) }
fn bn_mul(a: List<Int>, b: List<Int>) : List<Int> = trim(mul_go(a, b, 0))
fn cmp_hi(a: List<Int>, b: List<Int>) : Int = match a { [] => 0; [ha, ...ta] => match b { [] => 0; [hb, ...tb] => if ha == hb then cmp_hi(ta, tb) else (if ha < hb then 0 - 1 else 1) } }
fn bn_cmp(a: List<Int>, b: List<Int>) : Int =
  let ta : List<Int> = trim(a) in let tb : List<Int> = trim(b) in
  if len(ta) == len(tb) then cmp_hi(rev(ta), rev(tb)) else (if len(ta) < len(tb) then 0 - 1 else 1)
fn subb(a: List<Int>, b: List<Int>, borrow: Int) : List<Int> =
  match a { [] => [];
    [ha, ...ta] => match b {
      [] => let d : Int = ha - borrow in if d < 0 then [d + 65536] ++ subb(ta, [], 1) else [d] ++ subb(ta, [], 0);
      [hb, ...tb] => let d : Int = ha - hb - borrow in if d < 0 then [d + 65536] ++ subb(ta, tb, 1) else [d] ++ subb(ta, tb, 0) } }
fn bn_sub(a: List<Int>, b: List<Int>) : List<Int> = trim(subb(a, b, 0))
fn take(xs: List<Int>, n: Int) : List<Int> = if n <= 0 then [] else match xs { [] => []; [h, ...t] => [h] ++ take(t, n - 1) }
fn drop(xs: List<Int>, n: Int) : List<Int> = if n <= 0 then xs else match xs { [] => []; [h, ...t] => drop(t, n - 1) }
fn pg(d: Int) : List<Int> = [1, 0, 65535, 65535]
fn fold_hi(d: Int) : List<Int> = [65535, 65535]
fn bn_mod_p(a: List<Int>) : List<Int> =
  let t : List<Int> = trim(a) in
  if len(t) > 4 then bn_mod_p(bn_add(take(t, 4), bn_mul(drop(t, 4), fold_hi(0))))
  else if bn_cmp(t, pg(0)) >= 0 then bn_sub(t, pg(0)) else t
fn fadd(a: List<Int>, b: List<Int>) : List<Int> = gold_add(a, b)
fn fsub(a: List<Int>, b: List<Int>) : List<Int> = gold_sub(a, b)
fn fmul(a: List<Int>, b: List<Int>) : List<Int> = gold_mul(a, b)
fn bn_eq(a: List<Int>, b: List<Int>) : Bool = bn_cmp(a, b) == 0
fn bn_is_zero(e: List<Int>) : Bool = match trim(e) { [] => true; _ => false }
fn bn_is_odd(e: List<Int>) : Bool = match e { [] => false; [h, ...t] => h % 2 == 1 }
fn half_hl(xs: List<Int>, rem: Int) : List<Int> = match xs { [] => []; [h, ...t] => let cur : Int = rem * 65536 + h in [cur / 2] ++ half_hl(t, cur % 2) }
fn bn_half(e: List<Int>) : List<Int> = trim(rev(half_hl(rev(trim(e)), 0)))
fn fpow_bn(base: List<Int>, e: List<Int>) : List<Int> =
  if bn_is_zero(e) then [1]
  else let h : List<Int> = fpow_bn(fmul(base, base), bn_half(e)) in
       if bn_is_odd(e) then fmul(base, h) else h
# CUT THE ROPE (v5.60.0): the field inverse was fpow_bn — ~64 list-rebuilding fmul/bn_half per
# call, and finv runs once PER quotient-codeword element / grand-product row (tens of thousands
# of times per proof). It was 100% of the >11-min proof. The inverse is now one unboxed Fermat
# inverse in C (`goldw_inv` = 64 __int128 squarings in registers, zero allocation); we round-trip
# limbs<->u64 at the boundary and `trim` to gold-canonical form. Soundness-neutral (same field,
# same value); difftested goldw_inv == limb inverse over large values + inv0 (examples/prove/goldw_difftest.glass).
fn finv(a: List<Int>) : List<Int> = trim(goldw_to_limbs(goldw_inv(limbs_to_goldw(a))))
fn halve_k(e: List<Int>, k: Int) : List<Int> = if k <= 0 then e else halve_k(bn_half(e), k - 1)
fn root_pow2(k: Int) : List<Int> = fpow_bn([7], halve_k(bn_sub(pg(0), [1]), k))
fn glit(c: Int) : List<Int> = trim([c % 65536, (c / 65536) % 65536, c / 4294967296])
# full-width literal: correct base-2^16 limbs for any c < 2^64 (glit caps near 2^48)
fn glit4(c: Int) : List<Int> = trim([c % 65536, (c / 65536) % 65536, (c / 4294967296) % 65536, (c / 281474976710656) % 65536])
# bignum -> decimal string (long division by 10), for displaying results > 2^31
fn bn_dm10_go(hi: List<Int>, q: List<Int>, rem: Int) : (List<Int>, Int) =
  match hi { [] => (q, rem); [h, ...t] => let cur : Int = rem * 65536 + h in bn_dm10_go(t, q ++ [cur / 10], cur % 10) }
fn bn_dm10(x: List<Int>) : (List<Int>, Int) = match bn_dm10_go(rev(trim(x)), [], 0) { (qhi, r) => (trim(rev(qhi)), r) }
fn bn_dec_go(x: List<Int>, acc: String) : String = match trim(x) { [] => acc; _ => match bn_dm10(x) { (q, r) => bn_dec_go(q, int_to_string(r) ++ acc) } }
fn bn_dec(x: List<Int>) : String = match trim(x) { [] => "0"; _ => bn_dec_go(x, "") }
# Signed-aware decimal: a field element in the upper half (> p/2 = 9223372034707292160) is the
# canonical form of a NEGATIVE signed integer (a signed -k in [-2^31,2^31) is bound as p-k, far
# above p/2), so render it as "-(p-x)" = the negative it represents. Values <= p/2 print as-is.
# Used for the result/claim display so signed comparison/division/arithmetic show -3, not p-3.
# (A genuine large unsigned value in (p/2, p) would also show negative — rare; the field is the
# same element either way, and the Third Witness reports the reconciled value.)
fn bn_dec_signed(x: List<Int>) : String =
  if bn_cmp(trim(x), glit4(9223372034707292160)) > 0 then "-" ++ bn_dec(fsub(glit4(0), x)) else bn_dec(x)

# --- list-of-bignum helpers ---------------------------------------------------
fn wnth(xs: List<List<Int>>, i: Int) : List<Int> = match xs { [] => []; [x, ...r] => if i == 0 then x else wnth(r, i - 1) }
fn lset(xs: List<List<Int>>, i: Int, v: List<Int>) : List<List<Int>> = match xs { [] => []; [x, ...r] => if i == 0 then [v] ++ r else [x] ++ lset(r, i - 1, v) }
fn llen(xs: List<List<Int>>) : Int = match xs { [] => 0; [x, ...r] => 1 + llen(r) }
fn lpad(xs: List<List<Int>>, n: Int) : List<List<Int>> = if llen(xs) >= n then xs else lpad(xs ++ [glit(0)], n)

# --- circuit: gates over Goldilocks (witness = list of field elements) --------
# GHint(o)   — a FREE witness wire (no gate constrains it); the prover supplies its
#              value. Soundness comes from the gates that CONSUME it.
# GEqZero(a) — assert w[a] == 0 (the `qe · l` constraint term). The is-zero gadget
#              (for `==`) and the `if` mux are built from these two.
type Gate = | GConst(Int, List<Int>) | GAdd(Int, Int, Int) | GSub(Int, Int, Int) | GMul(Int, Int, Int) | GHint(Int) | GEqZero(Int)
type Build = | Build(Int, List<Gate>, List<List<Int>>)
fn mkc(c: List<Int>, b: Build) : (Int, Build) = match b { Build(n, gs, w) => (n, Build(n + 1, gs ++ [GConst(n, c)], w ++ [c])) }
fn mka(x: Int, y: Int, b: Build) : (Int, Build) = match b { Build(n, gs, w) => (n, Build(n + 1, gs ++ [GAdd(n, x, y)], w ++ [fadd(wnth(w, x), wnth(w, y))])) }
fn mks(x: Int, y: Int, b: Build) : (Int, Build) = match b { Build(n, gs, w) => (n, Build(n + 1, gs ++ [GSub(n, x, y)], w ++ [fsub(wnth(w, x), wnth(w, y))])) }
fn mkm(x: Int, y: Int, b: Build) : (Int, Build) = match b { Build(n, gs, w) => (n, Build(n + 1, gs ++ [GMul(n, x, y)], w ++ [fmul(wnth(w, x), wnth(w, y))])) }
fn mkh(v: List<Int>, b: Build) : (Int, Build) = match b { Build(n, gs, w) => (n, Build(n + 1, gs ++ [GHint(n)], w ++ [v])) }
fn mke(a: Int, b: Build) : Build = match b { Build(n, gs, w) => Build(n, gs ++ [GEqZero(a)], w) }
fn bwire(b: Build, i: Int) : List<Int> = match b { Build(n, gs, w) => wnth(w, i) }

# the nine trace columns (length = #gates, padded to N). A GHint row is unconstrained
# (all selectors 0); a GEqZero row fires the qe selector (its constraint is qe·l = 0).
fn sel_add(g: Gate) : List<Int> = match g { GAdd(o, a, b) => [1]; GConst(o, c) => []; GSub(o, a, b) => []; GMul(o, a, b) => []; GHint(o) => []; GEqZero(a) => [] }
fn sel_mul(g: Gate) : List<Int> = match g { GMul(o, a, b) => [1]; GConst(o, c) => []; GAdd(o, a, b) => []; GSub(o, a, b) => []; GHint(o) => []; GEqZero(a) => [] }
fn sel_sub(g: Gate) : List<Int> = match g { GSub(o, a, b) => [1]; GConst(o, c) => []; GAdd(o, a, b) => []; GMul(o, a, b) => []; GHint(o) => []; GEqZero(a) => [] }
fn sel_con(g: Gate) : List<Int> = match g { GConst(o, c) => [1]; GAdd(o, a, b) => []; GSub(o, a, b) => []; GMul(o, a, b) => []; GHint(o) => []; GEqZero(a) => [] }
fn sel_eq(g: Gate) : List<Int> = match g { GEqZero(a) => [1]; GConst(o, c) => []; GAdd(o, a, b) => []; GSub(o, a, b) => []; GMul(o, a, b) => []; GHint(o) => [] }
fn cv(g: Gate) : List<Int> = match g { GConst(o, c) => c; GAdd(o, a, b) => []; GSub(o, a, b) => []; GMul(o, a, b) => []; GHint(o) => []; GEqZero(a) => [] }
fn lv(g: Gate, w: List<List<Int>>) : List<Int> = match g { GConst(o, c) => []; GAdd(o, a, b) => wnth(w, a); GSub(o, a, b) => wnth(w, a); GMul(o, a, b) => wnth(w, a); GHint(o) => []; GEqZero(a) => wnth(w, a) }
fn rv(g: Gate, w: List<List<Int>>) : List<Int> = match g { GConst(o, c) => []; GAdd(o, a, b) => wnth(w, b); GSub(o, a, b) => wnth(w, b); GMul(o, a, b) => wnth(w, b); GHint(o) => []; GEqZero(a) => [] }
fn ov(g: Gate, w: List<List<Int>>) : List<Int> = match g { GConst(o, c) => wnth(w, o); GAdd(o, a, b) => wnth(w, o); GSub(o, a, b) => wnth(w, o); GMul(o, a, b) => wnth(w, o); GHint(o) => wnth(w, o); GEqZero(a) => [] }
fn c_qa(gs: List<Gate>) : List<List<Int>> = match gs { [] => []; [g, ...r] => [sel_add(g)] ++ c_qa(r) }
fn c_qm(gs: List<Gate>) : List<List<Int>> = match gs { [] => []; [g, ...r] => [sel_mul(g)] ++ c_qm(r) }
fn c_qs(gs: List<Gate>) : List<List<Int>> = match gs { [] => []; [g, ...r] => [sel_sub(g)] ++ c_qs(r) }
fn c_qc(gs: List<Gate>) : List<List<Int>> = match gs { [] => []; [g, ...r] => [sel_con(g)] ++ c_qc(r) }
fn c_qe(gs: List<Gate>) : List<List<Int>> = match gs { [] => []; [g, ...r] => [sel_eq(g)] ++ c_qe(r) }
fn c_c(gs: List<Gate>) : List<List<Int>> = match gs { [] => []; [g, ...r] => [cv(g)] ++ c_c(r) }
fn c_l(gs: List<Gate>, w: List<List<Int>>) : List<List<Int>> = match gs { [] => []; [g, ...r] => [lv(g, w)] ++ c_l(r, w) }
fn c_r(gs: List<Gate>, w: List<List<Int>>) : List<List<Int>> = match gs { [] => []; [g, ...r] => [rv(g, w)] ++ c_r(r, w) }
fn c_o(gs: List<Gate>, w: List<List<Int>>) : List<List<Int>> = match gs { [] => []; [g, ...r] => [ov(g, w)] ++ c_o(r, w) }

# --- interpolation (inverse NTT) over the size-8 trace domain -----------------
fn poly_eval_b(coeffs: List<List<Int>>, x: List<Int>) : List<Int> = match coeffs { [] => []; [c, ...r] => fadd(c, fmul(x, poly_eval_b(r, x))) }
fn intt_sum(ev: List<List<Int>>, k: Int, j: Int, n: Int, wi: List<Int>) : List<Int> =
  if j >= n then [] else fadd(fmul(wnth(ev, j), fpow_bn(wi, glit((j * k) % n))), intt_sum(ev, k, j + 1, n, wi))
fn interp_go(ev: List<List<Int>>, k: Int, n: Int, wi: List<Int>, ni: List<Int>) : List<List<Int>> =
  if k >= n then [] else [fmul(ni, intt_sum(ev, k, 0, n, wi))] ++ interp_go(ev, k + 1, n, wi, ni)
fn interp16(ev: List<List<Int>>) : List<List<Int>> = interp_go(ev, 0, 16, finv(root_pow2(4)), finv(glit(16)))
# R1b: generic size-n inverse NTT (n a power of two) — the variable trace domain
fn ilog2(n: Int) : Int = if n <= 1 then 0 else 1 + ilog2(n / 2)
fn scale_cols(sc: List<Int>, xs: List<List<Int>>) : List<List<Int>> = match xs { [] => []; [h, ...t] => [fmul(sc, h)] ++ scale_cols(sc, t) }
# CUT THE ROPE 2: interpolation (inverse NTT) was O(n^2)+ (interp_go/intt_sum, fpow_bn per term).
# An iNTT is the forward NTT at omega^-1 with no coset shift, scaled by 1/n -> reuse the native ntt_lde.
fn interp_n(ev: List<List<Int>>, n: Int) : List<List<Int>> =
  scale_cols(finv(glit(n)), w_to_limbs_list(ntt_lde(limbs_list_to_w(ev), n, 1, limbs_to_goldw(finv(root_pow2(ilog2(n)))))))
fn eval_on_dom(c: List<List<Int>>, dom: List<List<Int>>) : List<List<Int>> = match dom { [] => []; [x, ...r] => [poly_eval_b(c, x)] ++ eval_on_dom(c, r) }

# --- domains ------------------------------------------------------------------
fn dom_powers(cur: List<Int>, g: List<Int>, k: Int) : List<List<Int>> = if k <= 0 then [] else [cur] ++ dom_powers(fmul(cur, g), g, k - 1)

# --- the gate-constraint polynomial G(x) and its quotient Q = G / Z_H ---------
fn gate_G_at(qa: List<List<Int>>, qm: List<List<Int>>, qs: List<List<Int>>, qc: List<List<Int>>, qe: List<List<Int>>, l: List<List<Int>>, r: List<List<Int>>, o: List<List<Int>>, c: List<List<Int>>, x: List<Int>) : List<Int> =
  let va : List<Int> = poly_eval_b(qa, x) in let vm : List<Int> = poly_eval_b(qm, x) in let vs : List<Int> = poly_eval_b(qs, x) in let vc : List<Int> = poly_eval_b(qc, x) in let vq : List<Int> = poly_eval_b(qe, x) in
  let vl : List<Int> = poly_eval_b(l, x) in let vr : List<Int> = poly_eval_b(r, x) in let vo : List<Int> = poly_eval_b(o, x) in let vk : List<Int> = poly_eval_b(c, x) in
  fadd(fmul(va, fsub(vo, fadd(vl, vr))),
  fadd(fmul(vm, fsub(vo, fmul(vl, vr))),
  fadd(fmul(vs, fsub(vo, fsub(vl, vr))),
  fadd(fmul(vc, fsub(vo, vk)),
       fmul(vq, vl)))))
# gate_G evaluated pointwise on ALREADY-evaluated column values (no per-point poly_eval_b).
fn gate_G_pt(va: List<Int>, vm: List<Int>, vs: List<Int>, vc: List<Int>, vq: List<Int>, vl: List<Int>, vr: List<Int>, vo: List<Int>, vk: List<Int>) : List<Int> =
  fadd(fmul(va, fsub(vo, fadd(vl, vr))),
  fadd(fmul(vm, fsub(vo, fmul(vl, vr))),
  fadd(fmul(vs, fsub(vo, fsub(vl, vr))),
  fadd(fmul(vc, fsub(vo, vk)),
       fmul(vq, vl)))))
# CUT THE ROPE 2 (v5.61.0): the OLD quotient_cw evaluated 9 coefficient-polynomials at EVERY one of
# m=32n coset points via O(n) Horner (gate_G_at -> poly_eval_b) — O(9·n·m) = O(n²), the bottleneck the
# moment circuits grow (the comparison gadget, n≈1024, ran >18 min, ~all here). Now each column is
# low-degree-extended to the coset ONCE by the native NTT (`lde`, O(m log m)), and the quotient is a
# single pointwise lock-step walk. BYTE-IDENTICAL to the old quotient (lde == eval_on_dom, difftested
# in examples/prove/ntt_difftest.glass: NTT == naive coset-eval, interp == native).
fn limbs_list_to_w(xs: List<List<Int>>) : List<Int> = match xs { [] => []; [h, ...t] => [limbs_to_goldw(h)] ++ limbs_list_to_w(t) }
fn w_to_limbs_list(ws: List<Int>) : List<List<Int>> = match ws { [] => []; [h, ...t] => [goldw_to_limbs(h)] ++ w_to_limbs_list(t) }
# low-degree extension: evaluate the coeff-poly `c` on the size-(32n) coset {7·ω^i}, ω = root_pow2(fri_log n).
fn lde(c: List<List<Int>>, n: Int) : List<List<Int>> =
  w_to_limbs_list(ntt_lde(limbs_list_to_w(c), fri_dsize(n), 7, limbs_to_goldw(root_pow2(fri_log(n)))))
fn quo_combine(eqa: List<List<Int>>, eqm: List<List<Int>>, eqs: List<List<Int>>, eqc: List<List<Int>>, eqe: List<List<Int>>, el: List<List<Int>>, er: List<List<Int>>, eo: List<List<Int>>, ec: List<List<Int>>, coset: List<List<Int>>, n: Int) : List<List<Int>> =
  match coset { [] => []; [x, ...crest] =>
  match eqa { [] => []; [va, ...qar] => match eqm { [] => []; [vm, ...qmr] => match eqs { [] => []; [vs, ...qsr] =>
  match eqc { [] => []; [vc, ...qcr] => match eqe { [] => []; [vq, ...qer] => match el { [] => []; [vl, ...elr] =>
  match er { [] => []; [vr, ...err] => match eo { [] => []; [vo, ...eor] => match ec { [] => []; [vk, ...ecr] =>
    let g : List<Int> = gate_G_pt(va, vm, vs, vc, vq, vl, vr, vo, vk) in
    let zh : List<Int> = fsub(fpow_bn(x, glit(n)), [1]) in
    [fmul(g, finv(zh))] ++ quo_combine(qar, qmr, qsr, qcr, qer, elr, err, eor, ecr, crest, n) }}}}}}}}} }
fn quotient_cw(qa: List<List<Int>>, qm: List<List<Int>>, qs: List<List<Int>>, qc: List<List<Int>>, qe: List<List<Int>>, l: List<List<Int>>, r: List<List<Int>>, o: List<List<Int>>, c: List<List<Int>>, coset: List<List<Int>>, n: Int) : List<List<Int>> =
  quo_combine(lde(qa, n), lde(qm, n), lde(qs, n), lde(qc, n), lde(qe, n), lde(l, n), lde(r, n), lde(o, n), lde(c, n), coset, n)

# --- FRI low-degree test (base-field fold; Stage B lifts to F_{p^2}) ----------
fn fold_at_b(cw: List<List<Int>>, dom: List<List<Int>>, beta: List<Int>, finv2: List<Int>, i: Int, half: Int) : List<List<Int>> =
  if i >= half then []
  else let fx : List<Int> = wnth(cw, i) in let fmx : List<Int> = wnth(cw, i + half) in let x : List<Int> = wnth(dom, i) in
    let fe : List<Int> = fmul(fadd(fx, fmx), finv2) in let fo : List<Int> = fmul(fsub(fx, fmx), finv(fmul([2], x))) in
    [fadd(fe, fmul(beta, fo))] ++ fold_at_b(cw, dom, beta, finv2, i + 1, half)
# CUT THE ROPE 3: was O(m^2) (wnth(dom,i) per element). Lock-step walk of the first `half` points.
fn sqd(dom: List<List<Int>>, i: Int, half: Int) : List<List<Int>> =
  if i >= half then [] else match dom { [] => []; [h, ...t] => [fmul(h, h)] ++ sqd(t, i + 1, half) }
fn fold_all_b(cw: List<List<Int>>, dom: List<List<Int>>, finv2: List<Int>, round: Int) : List<List<Int>> =
  if llen(cw) <= fri_final(0) then cw
  else let half : Int = llen(cw) / 2 in fold_all_b(fold_at_b(cw, dom, glit(round * 7919 + 12345), finv2, 0, half), sqd(dom, 0, half), finv2, round + 1)
fn all_eqb(cw: List<List<Int>>, x: List<Int>) : Bool = match cw { [] => true; [y, ...r] => if bn_eq(y, x) then all_eqb(r, x) else false }
fn is_constb(cw: List<List<Int>>) : Bool = match cw { [] => true; [x, ...r] => all_eqb(r, x) }

# build all 9 column polynomials and form the quotient codeword Q on the coset.
# Trace domain N = 16 (the is-zero gadget + if-mux push the gate count past 8); the
# coset is a power-of-two blowup (FRI_DSIZE = 2^FRI_LOG points, the 2^FRI_LOG-th
# roots of unity shifted by the generator 7, disjoint from the trace domain H so
# Z_H never vanishes on it).
#
# THE RATE LEVER.  The tested degree bound is FIXED at 32 = 2^5 by the circuit
# (deg Q = deg G - deg Z_H = 45 - 16 = 29 < 32), so the FRI fold runs a FIXED 5
# rounds and stops at length FRI_DSIZE/32 (a degree-<32 codeword has folded to a
# constant by then). The rate is therefore ρ = 32 / FRI_DSIZE, and GROWING the
# coset (the single source of truth below) lowers ρ toward a cryptographic target —
# 64 -> ρ=1/2, 128 -> 1/4, 256 -> 1/8, 512 -> 1/16 — WITHOUT changing what degree
# is tested. (Folding all the way to length 2 instead would test the useless bound
# DSIZE/2 and leave ρ pinned at 1/2 — no soundness gain. The stop-at-DSIZE/32 is
# the whole point.) Each halving of ρ halves the per-query survival probability, at
# the cost of ~linearly more quotient evaluations + bigger Merkle trees (the
# interpreter-dogfood gate). See docs/parameters.md §4.
# R1b: VARIABLE trace domain. d = N = ng(gates) = next pow2 of the gate count.
# deg Q = 3(N-1) - N = 2N-3 < 2N (the tested bound); coset = 16N gives ρ = 2N/16N
# = 1/8, and the fold stops at 16N/2N = 8 (constant) — the SAME validated relation
# the Baby Bear prover uses, now N-parametric so ADT circuits (N up to hundreds) prove.
fn glen(gs: List<Gate>) : Int = match gs { [] => 0; [g, ...r] => 1 + glen(r) }
fn ng(gates: List<Gate>) : Int = next_pow2(glen(gates), 1)
fn fri_log(d: Int) : Int = let r : Int = ilog2(d) + 5 in if r > 32 then error("glass prove: trace/coset size exceeds Goldilocks 2-adicity (2^32) — no primitive 2^k-th root of unity exists for k>32, so the NTT/LDE would silently compute on a wrong domain; ABSTAIN (defense-in-depth: unreachable for any constructible proof, which would need ~2^27 gates)") else r   # coset = 32N (B3: log2(32N)); ρ=1/8 still (tested deg<4N / 32N)
fn fri_dsize(d: Int) : Int = 32 * d             # coset = 32N -> ρ = 4N/32N = 1/8 (B3 perm-quotient is deg ~3N < 4N; was 16N/2N pre-B3)
fn fri_final(d: Int) : Int = 8                  # fold to 8 over 32N (= 32N/4N): degree-<4N folded to a constant
fn fri_queries(d: Int) : Int = 82               # 82q -> ~80-bit provable FRI-query term (68 + 12 grind) / ~135 list-decode. The hash is now 4-lane (~128-bit binding) so this is no longer ~32-bit-capped. Queries are sampled WITHOUT replacement (sample_distinct dedups), so the 82 draws are negatively correlated => effective distinct queries >= the iid-82 model; the 0.83-bit/query closed-form is therefore conservative, not eroded (corrected v5.120; the old "with replacement / erosion" note was backward).
fn fri_coset(d: Int) : List<List<Int>> = dom_powers([7], root_pow2(fri_log(d)), fri_dsize(d))
# Column polynomials, factored so the (future) verifier recomputes the PUBLIC
# selectors/const by the EXACT same construction the prover uses (no drift).
fn icol(col: List<List<Int>>, n: Int) : List<List<Int>> = interp_n(lpad(col, n), n)
fn public_cols(gates: List<Gate>, n: Int) : List<List<List<Int>>> =     # [qa, qm, qs, qc, qe, c] — derived from gates alone (public)
  [icol(c_qa(gates), n), icol(c_qm(gates), n), icol(c_qs(gates), n), icol(c_qc(gates), n), icol(c_qe(gates), n), icol(c_c(gates), n)]
fn trace_cols(gates: List<Gate>, w: List<List<Int>>, n: Int) : List<List<List<Int>>> =   # [l, r, o] — the witness columns (private)
  [icol(c_l(gates, w), n), icol(c_r(gates, w), n), icol(c_o(gates, w), n)]
# --- B3: public copy-constraint (PLONK sigma) columns over the wire indices ----
# Cell ids: l-cell of row i = i, r-cell = n+i, o-cell = 2n+i. Active cells match
# lv/rv/ov EXACTLY (GAdd/Sub/Mul -> l,r,o; GConst/GHint -> o; GEqZero -> l); inactive
# cells are sigma FIXED POINTS so inert/padding cells cancel in the grand product.
# sigma links all cells sharing a wire index into one cycle. Verifier recomputes all 6
# columns (id1,id2,id3,S1,S2,S3) from the public gates, exactly like the selectors.
fn gate_cells(g: Gate, i: Int, n: Int) : List<Pair<Int, Int>> = match g {
  GAdd(o, a, b) => [Pair(i, a), Pair(n + i, b), Pair(2 * n + i, o)];
  GSub(o, a, b) => [Pair(i, a), Pair(n + i, b), Pair(2 * n + i, o)];
  GMul(o, a, b) => [Pair(i, a), Pair(n + i, b), Pair(2 * n + i, o)];
  GConst(o, c) => [Pair(2 * n + i, o)];
  GHint(o) => [Pair(2 * n + i, o)];
  GEqZero(a) => [Pair(i, a)] }
fn all_cells(gates: List<Gate>, i: Int, n: Int) : List<Pair<Int, Int>> = match gates { [] => []; [g, ...r] => gate_cells(g, i, n) ++ all_cells(r, i + 1, n) }
fn wire_of(cid: Int, cells: List<Pair<Int, Int>>) : Int = match cells { [] => 0 - 1; [Pair(c, w), ...rest] => if c == cid then w else wire_of(cid, rest) }
fn cells_for_wire(w: Int, cells: List<Pair<Int, Int>>) : List<Int> = match cells { [] => []; [Pair(c, ww), ...rest] => if ww == w then [c] ++ cells_for_wire(w, rest) else cells_for_wire(w, rest) }
fn next_in(cid: Int, lst: List<Int>, first: Int) : Int = match lst { [] => first; [c, ...rest] => if c == cid then (match rest { [] => first; [nx, ...more] => nx }) else next_in(cid, rest, first) }
fn sigma(cid: Int, cells: List<Pair<Int, Int>>) : Int =
  let w : Int = wire_of(cid, cells) in
  if w < 0 then cid else (let grp : List<Int> = cells_for_wire(w, cells) in match grp { [] => cid; [f, ...rest] => next_in(cid, grp, f) })
fn id_col(off: Int, i: Int, n: Int) : List<List<Int>> = if i >= n then [] else [glit(off + i)] ++ id_col(off, i + 1, n)
fn s_col(off: Int, cells: List<Pair<Int, Int>>, i: Int, n: Int) : List<List<Int>> = if i >= n then [] else [glit(sigma(off + i, cells))] ++ s_col(off, cells, i + 1, n)
fn perm_cols(gates: List<Gate>, n: Int) : List<List<List<Int>>> =       # [id1, id2, id3, S1, S2, S3] interpolated, public
  let cells : List<Pair<Int, Int>> = all_cells(gates, 0, n) in
  [icol(id_col(0, 0, n), n), icol(id_col(n, 0, n), n), icol(id_col(2 * n, 0, n), n),
   icol(s_col(0, cells, 0, n), n), icol(s_col(n, cells, 0, n), n), icol(s_col(2 * n, cells, 0, n), n)]
# (B3 grand-product Z helpers live below, after the G2/F_{p^2} declarations.)
fn q_cw(gates: List<Gate>, w: List<List<Int>>) : List<List<Int>> =
  let n : Int = ng(gates) in
  let pc : List<List<List<Int>>> = public_cols(gates, n) in
  let tc : List<List<List<Int>>> = trace_cols(gates, w, n) in
  quotient_cw(wnth3(pc, 0), wnth3(pc, 1), wnth3(pc, 2), wnth3(pc, 3), wnth3(pc, 4), wnth3(tc, 0), wnth3(tc, 1), wnth3(tc, 2), wnth3(pc, 5), fri_coset(n), n)
fn low_degree_quotient(gates: List<Gate>, w: List<List<Int>>) : Bool =
  is_constb(fold_all_b(q_cw(gates, w), fri_coset(ng(gates)), finv([2]), 0))

# --- ZERO-KNOWLEDGE: blind Q with a random low-degree mask (Stage B) ----------
# A degree-<8 polynomial R, evaluated on the coset, is added to Q. Since deg R is
# below the fold-to-constant bound, Q+R stays low-degree (FRI fold is linear, so it
# still folds to the same kind of constant and ACCEPTs) — but every opened value is
# randomized by R. Two seeds give two different valid proofs of the same statement:
# the verifier learns "Q is low-degree", nothing about the witness. (the Poseidon hash over
# Goldilocks supplies the mask coefficients.)
# --- the in-STARK hash: the vetted Poseidon over Goldilocks (v5.44) ------------
# Replaces the educational MiMC. The Plonky2-exact Poseidon (t=12, R_F=8, R_P=22,
# x^7 S-box, 360 hadeshash constants) — byte-identical to Plonky2's published test
# vectors (frost_goldilocks_poseidon.glass). hashg(a,b) is a 2-to-1 sponge: absorb
# [a,b] into the rate, permute, squeeze lane 0. ~300x heavier than MiMC, so the demo
# runs reduced params (small coset / few queries / grind off) to dogfood; full
# strength (rho=1/8 + grind) runs native (examples/selfhost/run_native.sh).
fn inth(xs: List<Int>, i: Int) : Int = match xs { [] => 0; [h, ...t] => if i == 0 then h else inth(t, i - 1) }
fn pdrop1(st: List<List<Int>>) : List<List<Int>> = match st { [] => []; [h, ...t] => t }

# --- Poseidon over Goldilocks — byte-exact to Plonky2 (t=12, R_F=8, R_P=22) ----
# S-box x^7 (gcd(7, p-1)=1 over Goldilocks, so it is a permutation). Computed as
# Plonky2 does: x2=x^2, x4=x^4, x3=x^3, return x3*x4 = x^7.
fn sbox(x: List<Int>) : List<Int> = let x2 : List<Int> = fmul(x, x) in let x4 : List<Int> = fmul(x2, x2) in let x3 : List<Int> = fmul(x, x2) in fmul(x3, x4)

# constant_layer: lane i += ALL_ROUND_CONSTANTS[12*rc + i]
fn clayer(arc: List<List<Int>>, st: List<List<Int>>, rc: Int, i: Int) : List<List<Int>> =
  if i >= 12 then [] else [fadd(wnth(st, i), wnth(arc, rc * 12 + i))] ++ clayer(arc, st, rc, i + 1)
# S-box on all 12 lanes (full round) / on lane 0 only (partial round)
fn sbox_all(st: List<List<Int>>, i: Int) : List<List<Int>> = if i >= 12 then [] else [sbox(wnth(st, i))] ++ sbox_all(st, i + 1)
fn sbox_lane0(st: List<List<Int>>) : List<List<Int>> = [sbox(wnth(st, 0))] ++ pdrop1(st)
# MDS: out[r] = sum_i st[(i+r) mod 12] * CIRC[i]  (+ st[0]*8 for r=0, since DIAG=[8,0..])
fn mds_row(st: List<List<Int>>, circ: List<Int>, r: Int, i: Int, acc: List<Int>) : List<Int> =
  if i >= 12 then acc else mds_row(st, circ, r, i + 1, fadd(acc, fmul(wnth(st, (i + r) % 12), glit(inth(circ, i)))))
fn mds_one(st: List<List<Int>>, circ: List<Int>, r: Int) : List<Int> =
  let base : List<Int> = mds_row(st, circ, r, 0, []) in if r == 0 then fadd(base, fmul(wnth(st, 0), [8])) else base
fn mds_layer(st: List<List<Int>>, circ: List<Int>, r: Int) : List<List<Int>> =
  if r >= 12 then [] else [mds_one(st, circ, r)] ++ mds_layer(st, circ, r + 1)

fn full_round(arc: List<List<Int>>, circ: List<Int>, st: List<List<Int>>, rc: Int) : List<List<Int>> =
  mds_layer(sbox_all(clayer(arc, st, rc, 0), 0), circ, 0)
fn partial_round(arc: List<List<Int>>, circ: List<Int>, st: List<List<Int>>, rc: Int) : List<List<Int>> =
  mds_layer(sbox_lane0(clayer(arc, st, rc, 0)), circ, 0)
fn do_full(arc: List<List<Int>>, circ: List<Int>, st: List<List<Int>>, rc: Int, stop: Int) : List<List<Int>> =
  if rc >= stop then st else do_full(arc, circ, full_round(arc, circ, st, rc), rc + 1, stop)
fn do_partial(arc: List<List<Int>>, circ: List<Int>, st: List<List<Int>>, rc: Int, stop: Int) : List<List<Int>> =
  if rc >= stop then st else do_partial(arc, circ, partial_round(arc, circ, st, rc), rc + 1, stop)
# the permutation: 4 full (rc 0..3), 22 partial (rc 4..25), 4 full (rc 26..29)
fn perm(arc: List<List<Int>>, circ: List<Int>, st: List<List<Int>>) : List<List<Int>> =
  do_full(arc, circ, do_partial(arc, circ, do_full(arc, circ, st, 0, 4), 4, 26), 26, 30)
fn p_arc(d: Int) : List<List<Int>> = [[17413, 61972, 63334, 46469], [6871, 17298, 42335, 30534], [39348, 52967, 3377, 45819], [10199, 32820, 24740, 3943], [57362, 20724, 26214, 57613], [39921, 2000, 5323, 36014], [16031, 38390, 21404, 54328], [19517, 58203, 7292, 61304], [17446, 45252, 41529, 52676], [31743, 48947, 41480, 10111], [30881, 40357, 21410, 57718], [11382, 9691, 754, 50499], [51329, 63266, 30753, 34344], [36437, 16833, 6794, 22989], [50548, 18781, 6573, 50105], [1921, 61290, 50373, 42116], [5836, 56404, 48419, 12427], [49308, 36656, 16577, 28234], [36090, 3471, 60855, 39470], [28472, 44616, 50912, 58208], [18427, 49094, 29071, 54727], [65291, 6403, 44551, 50014], [19431, 38556, 9814, 33948], [48045, 2251, 11404, 49239], [130, 8670, 25418, 59898], [24589, 38298, 27976, 62831], [4453, 1593, 5096, 63447], [23983, 12930, 4907, 33431], [11402, 58123, 1504, 44392], [21342, 64760, 55797, 44113], [44423, 6338, 55260, 20522], [12353, 4363, 21772, 22433], [58755, 27872, 54030, 26299], [25678, 22685, 44015, 3490], [3425, 56085, 10063, 61537], [38451, 59842, 60474, 10424], [37907, 32299, 22246, 37543], [25990, 65257, 16875, 28903], [60444, 44930, 24290, 413], [25426, 29254, 11991, 28527], [19617, 59361, 5839, 31988], [25657, 34468, 20859, 25055], [31605, 4567, 18843, 34268], [1843, 47553, 39752, 19349], [15959, 43012, 15965, 59582], [34457, 59098, 48157, 62912], [29887, 2543, 11455, 16561], [54833, 52010, 2366, 42551], [62472, 6221, 63634, 15555], [12731, 22463, 40385, 11847], [17222, 42531, 56839, 28489], [36219, 56887, 59326, 8508], [60035, 23885, 12596, 23300], [54945, 836, 17784, 41694], [62216, 19067, 43769, 28931], [37633, 38695, 64525, 21286], [18247, 60418, 46927, 43470], [45475, 47905, 60552, 10232], [2195, 7661, 20442, 64747], [5749, 18084, 65299, 64198], [32140, 9869, 43589, 28977], [3999, 38243, 864, 37713], [27643, 44994, 23332, 44371], [17598, 39230, 62918, 17959], [52312, 47345, 63380, 25692], [5655, 2806, 28909, 9244], [1521, 25721, 57462, 44216], [18253, 19535, 59867, 14135], [65462, 59231, 24115, 59370], [49722, 51647, 58527, 37086], [40082, 27584, 60919, 53681], [50690, 42565, 18459, 2917], [10299, 2068, 6827, 39341], [51789, 54294, 31889, 17290], [29980, 50666, 58300, 46605], [22716, 61295, 43882, 51612], [58623, 42798, 60818, 27045], [44401, 7892, 12956, 24187], [18565, 20, 44040, 24512], [20170, 14711, 33426, 13019], [62224, 22576, 27036, 2782], [24353, 4161, 22587, 31941], [54863, 57702, 40658, 34271], [48305, 60978, 57167, 26116], [61256, 55894, 62984, 60292], [24637, 50190, 34868, 55904], [61827, 32865, 65088, 36759], [31625, 38643, 18524, 43327], [54627, 36632, 59630, 26372], [8473, 7687, 59820, 52963], [28865, 58036, 3685, 20749], [14576, 27536, 16200, 63026], [52975, 65445, 36062, 2896], [15549, 58619, 28809, 62017], [22320, 37073, 23592, 24807], [62108, 63072, 32139, 42529], [4494, 50092, 52528, 29017], [54592, 45034, 20111, 33691], [2780, 33426, 15966, 3391], [48040, 57063, 33725, 36733], [7430, 59911, 8771, 30735], [5684, 62430, 22597, 60305], [62342, 9910, 4621, 53662], [60614, 32351, 58682, 366], [58487, 31027, 54606, 52063], [17567, 31229, 16760, 44216], [18226, 59383, 6411, 39970], [13857, 41914, 15387, 23913], [40647, 49846, 1943, 56559], [31507, 55938, 37475, 15715], [53479, 7112, 64919, 57971], [32469, 11554, 624, 16783], [908, 46339, 64931, 35877], [49276, 44744, 60749, 11450], [56770, 52694, 59055, 24408], [3770, 24091, 20652, 10310], [55989, 59417, 13182, 25435], [54431, 54514, 878, 40858], [5902, 44636, 9740, 47422], [46957, 31197, 60136, 45223], [22284, 36006, 11452, 53366], [19445, 4784, 61368, 13510], [49426, 64020, 2741, 16575], [16595, 31831, 28924, 46773], [13396, 11747, 47360, 23079], [45778, 46802, 45413, 45477], [48674, 59857, 57516, 34594], [33019, 32342, 58291, 30862], [57988, 5457, 9830, 5287], [46105, 40691, 26415, 39095], [3642, 27571, 44663, 48019], [63568, 25472, 15108, 10493], [33671, 37669, 26629, 12452], [40161, 25021, 49164, 13181], [65309, 51108, 41540, 54764], [31165, 25810, 25474, 30562], [55143, 57071, 13502, 49636], [60450, 21432, 13594, 665], [7040, 44325, 22244, 45780], [59915, 42140, 53757, 16030], [48856, 42064, 43307, 10610], [37854, 31716, 28119, 8225], [40646, 10308, 59599, 44543], [53827, 19495, 47900, 7245], [54360, 33570, 27274, 5537], [42505, 32729, 4747, 14474], [61691, 47853, 58838, 8960], [20740, 18401, 43654, 12131], [49769, 28366, 27880, 61891], [28873, 6201, 4389, 10008], [43373, 28892, 659, 58756], [53170, 753, 48190, 19867], [63224, 26922, 48169, 59957], [16695, 60091, 6987, 6370], [21748, 9653, 40902, 7739], [10493, 27000, 17250, 9686], [38469, 50490, 7089, 23103], [36152, 27131, 568, 56191], [57852, 4564, 1625, 46178], [32816, 17277, 19172, 18882], [1382, 4395, 34348, 55187], [36843, 29453, 4358, 43741], [54632, 38832, 28174, 50235], [64674, 36582, 9409, 58000], [35942, 13752, 49781, 24144], [39559, 42239, 16160, 4152], [23288, 29092, 61085, 14568], [43449, 23537, 6199, 56657], [55287, 11636, 1432, 30544], [51376, 56806, 39348, 34475], [49280, 16209, 20320, 45344], [3791, 28709, 44164, 61281], [24639, 4908, 55567, 7100], [46423, 38477, 55997, 3281], [7881, 60317, 44635, 4515], [53533, 42373, 49134, 63317], [42199, 9870, 12880, 41912], [37807, 37500, 1780, 20835], [41434, 51695, 44105, 56756], [17432, 13981, 28140, 25787], [8140, 11084, 38338, 63948], [59894, 24394, 32629, 2259], [26459, 13432, 39777, 61124], [57520, 60709, 37690, 61763], [50722, 21983, 56706, 58565], [6542, 61843, 30550, 59309], [63947, 34815, 12683, 37570], [22893, 64883, 9720, 29596], [65232, 61805, 51913, 22070], [370, 37774, 37018, 56719], [16219, 5382, 8161, 50752], [5205, 61868, 31539, 35545], [34067, 45662, 13931, 3145], [33545, 61801, 54226, 1924], [39553, 41344, 46718, 21263], [8009, 39856, 37417, 16644], [47532, 29732, 16948, 5013], [4446, 41377, 48478, 40112], [18849, 50063, 62997, 739], [37359, 40018, 20298, 39005], [9959, 64973, 40938, 30555], [3885, 14415, 26022, 12354], [300, 38771, 25795, 22838], [62158, 45096, 11871, 20234], [29762, 193, 7952, 56673], [20432, 57322, 24474, 55320], [43806, 43427, 5020, 61319], [57651, 49998, 4918, 15271], [568, 22199, 17757, 32058], [9860, 12312, 13025, 26125], [8003, 18637, 34367, 10618], [60343, 42833, 42806, 37088], [20435, 21772, 32974, 21663], [48484, 12088, 45714, 3955], [39999, 64378, 8051, 5823], [60439, 91, 23129, 27935], [38852, 42479, 34671, 767], [22960, 42257, 29346, 50635], [36878, 11612, 62365, 33904], [52086, 54175, 46065, 9643], [17455, 45938, 36041, 9195], [25444, 50767, 47701, 54919], [61784, 64911, 40592, 55949], [24231, 12260, 56445, 58315], [8855, 44773, 51635, 47528], [3027, 4246, 35420, 49362], [6708, 26871, 44187, 17879], [59396, 28777, 28217, 61111], [58073, 5396, 51389, 15622], [1895, 31921, 38944, 40092], [46575, 44767, 2897, 25968], [37896, 14726, 17685, 37151], [3782, 48186, 33951, 31462], [65150, 41066, 16619, 15283], [42590, 26670, 40331, 46190], [17238, 41907, 8953, 36303], [22439, 22626, 44762, 30653], [53773, 20740, 16394, 61854], [38159, 58477, 41800, 50024], [62084, 59001, 52576, 40689], [7475, 54736, 55380, 59548], [33442, 35768, 30684, 23763], [59488, 33774, 64376, 42928], [38157, 50066, 16446, 30340], [15186, 20461, 61551, 24483], [18481, 7104, 31425, 36341], [6295, 7710, 7930, 11696], [40098, 43739, 28132, 21636], [51076, 22675, 17720, 47719], [51035, 17618, 18787, 21533], [34814, 29926, 26500, 59657], [49919, 63177, 39203, 57320], [56437, 3326, 42782, 60645], [58896, 54559, 36821, 24569], [17941, 6294, 37913, 33768], [20673, 18417, 1035, 22818], [17697, 15833, 29966, 63869], [22231, 47215, 54466, 20608], [36208, 22215, 4443, 42974], [33172, 34643, 17068, 27282], [15940, 63767, 28407, 63365], [56329, 65200, 64658, 8805], [35415, 63418, 51428, 6111], [7608, 2546, 42562, 36865], [37829, 29112, 19475, 36864], [21829, 29998, 47055, 47410], [23036, 46846, 57217, 41137], [62146, 30474, 56614, 36593], [60725, 53182, 42233, 1345], [50480, 30911, 4193, 40545], [35570, 37725, 32384, 45942], [44806, 8293, 54648, 152], [26311, 23572, 37325, 12753], [44189, 41753, 61359, 16655], [50347, 58134, 62018, 48632], [32464, 22371, 54619, 40588], [37736, 59811, 11243, 56850], [9510, 36608, 8149, 19712], [43512, 3764, 14080, 51814], [8056, 9465, 14806, 12067], [62744, 51213, 31000, 27930], [2281, 13347, 18745, 57242], [14732, 59080, 5406, 60354], [25877, 41233, 11176, 972], [53123, 59456, 53303, 54081], [45004, 23284, 46546, 14460], [40583, 8848, 20831, 48034], [36423, 1523, 65143, 29256], [8794, 21085, 58730, 19809], [23869, 36256, 38460, 9774], [3778, 19746, 39689, 23016], [40030, 46987, 23378, 1373], [61337, 13588, 32435, 33458], [52859, 38583, 38090, 54016], [5429, 52490, 45953, 53084], [23164, 37278, 19894, 65261], [58783, 30011, 16211, 16752], [35695, 64734, 43328, 24302], [518, 29968, 61873, 19665], [20160, 29765, 13701, 18976], [40876, 56255, 54113, 5240], [34652, 53569, 56327, 28418], [22178, 55525, 8238, 10602], [12005, 39923, 26521, 11005], [18717, 64149, 55662, 31439], [11373, 2747, 47628, 26520], [8482, 9929, 62843, 13510], [46558, 53766, 57786, 22326], [21019, 86, 32042, 8197], [35799, 53335, 23509, 15850], [13484, 32070, 3465, 5861], [42723, 47543, 62444, 10687], [56542, 23099, 54048, 18268], [32392, 49947, 8453, 6308], [12392, 44902, 29716, 574], [26583, 4633, 28936, 5396], [65273, 55254, 57329, 58531], [22327, 34824, 53669, 424], [48879, 55906, 51022, 4532], [13126, 27047, 52237, 58759], [10862, 6058, 12912, 8183], [53355, 9331, 10692, 22862], [4821, 35227, 7601, 63219], [54218, 29458, 50660, 49194], [30904, 24779, 489, 59138], [61704, 27237, 65339, 28560], [64132, 17895, 31346, 17012], [18866, 15031, 2020, 53749], [20685, 61783, 53861, 7302], [11292, 56707, 52851, 14742], [9405, 38962, 47618, 36479], [24020, 805, 60529, 47629], [64603, 5672, 48504, 40604], [54949, 38637, 25689, 56040], [54136, 45473, 2131, 57022], [17219, 19713, 10706, 42130], [24092, 55952, 47615, 31717], [43568, 49732, 24238, 41929], [1348, 62687, 48296, 560], [18630, 49121, 49854, 16693], [15474, 17290, 49356, 5743], [16122, 35560, 46490, 14178], [18256, 35089, 35404, 59538], [24293, 42132, 2897, 10820], [65411, 32153, 64811, 32974], [54826, 58911, 31174, 48024], [20532, 33830, 36634, 28284], [56776, 7102, 45790, 5707], [25915, 19804, 12261, 62401], [29154, 60823, 59682, 16569], [6208, 48763, 23311, 21791], [6161, 50379, 10919, 9475], [17222, 19222, 13319, 43757], [51229, 63945, 38587, 36861], [2140, 22839, 37355, 28924], [21568, 24465, 24106, 32633], [54219, 21622, 55775, 17731], [51469, 79, 55102, 61810], [4664, 48328, 50430, 57297], [22780, 32741, 64354, 48269]]
fn p_circ(d: Int) : List<Int> = [17, 15, 41, 16, 2, 28, 13, 13, 39, 18, 34, 20]
fn pzero(n: Int) : List<List<Int>> = if n <= 0 then [] else [glit(0)] ++ pzero(n - 1)   # glit(0) trims to [] (field 0), but is typed List<Int> so HM infers List<List<Int>>
# --- WIDE hash: 4 Poseidon lanes (~256-bit -> ~128-bit collision binding), fixing the
# prior single-lane (~64-bit -> ~32-bit) Merkle/transcript cap (audit finding #1). hashg
# KEEPS its (List<Int>,List<Int>)->List<Int> signature: a "hash" is now 16 limbs (4 lanes
# x 4), a single field element is <=4 limbs; to_lanes splits either; lane0 extracts a
# field element where a challenge needs one. Opaque Merkle/transcript/digest uses are
# UNCHANGED. q_low/pow_ok read the first limb (= lane 0's first limb), also unchanged.
fn lcnt(x: List<Int>) : Int = match x { [] => 0; [h, ...t] => 1 + lcnt(t) }
fn pad4l(x: List<Int>) : List<Int> = if lcnt(x) >= 4 then x else pad4l(x ++ [0])
fn first4(x: List<Int>) : List<Int> = match x { [] => []; [a, ...t1] => match t1 { [] => [a]; [b, ...t2] => match t2 { [] => [a, b]; [c, ...t3] => match t3 { [] => [a, b, c]; [d, ...t4] => [a, b, c, d] } } } }
fn drop4(x: List<Int>) : List<Int> = match x { [] => []; [a, ...t1] => match t1 { [] => []; [b, ...t2] => match t2 { [] => []; [c, ...t3] => match t3 { [] => []; [d, ...t4] => t4 } } } }
fn to_lanes(x: List<Int>) : List<List<Int>> = if lcnt(x) <= 4 then [pad4l(x)] else [first4(x)] ++ to_lanes(drop4(x))
fn lanepad12(ls: List<List<Int>>) : List<List<Int>> = if llen(ls) >= 12 then ls else lanepad12(ls ++ [[0, 0, 0, 0]])
fn from4(st: List<List<Int>>) : List<Int> = pad4l(wnth(st, 0)) ++ pad4l(wnth(st, 1)) ++ pad4l(wnth(st, 2)) ++ pad4l(wnth(st, 3))
fn lane0(h: List<Int>) : List<Int> = first4(h)
# CUT THE ROPE (v5.60.0): the Poseidon MDS layer was THE proof bottleneck — 144 boxed fmul per
# round (each a wnth cons-walk + glit alloc + comb/split), x 30 rounds, x every Merkle/transcript
# hash. `poseidon_perm` is a single native intrinsic (q_poseidon_perm) running the whole
# permutation in registers over a u64[12] — zero alloc, O(1) indexing. We convert the 12 lane
# field-elements to unboxed words (limbs_to_goldw) at the boundary, permute, and expand the first
# 4 output lanes back to the SAME 16-limb digest (goldw_to_limbs + pad4l) — so hashg is BYTE-FOR-BYTE
# what `from4(perm(...))` produced, just ~100x faster. Validated: examples/prove/poseidon_difftest.glass
# (Plonky2 anchor + Glass goldw reference perm + interp==native byte-identical). The pure-Glass
# perm/full_round/mds_* below stay as the readable reference (and the difftest's spec).
fn lanes_to_w(ls: List<List<Int>>) : List<Int> = match ls { [] => []; [h, ...t] => [limbs_to_goldw(h)] ++ lanes_to_w(t) }
fn wnthw(xs: List<Int>, i: Int) : Int = match xs { [] => 0; [h, ...t] => if i == 0 then h else wnthw(t, i - 1) }
fn from4w(w: List<Int>) : List<Int> = pad4l(goldw_to_limbs(wnthw(w, 0))) ++ pad4l(goldw_to_limbs(wnthw(w, 1))) ++ pad4l(goldw_to_limbs(wnthw(w, 2))) ++ pad4l(goldw_to_limbs(wnthw(w, 3)))
# v5.70.0: the live hash is now Poseidon2 (Plonky3) — cheaper linear layers, the modern hash.
# The sponge wrappers (to_lanes/lanepad12/lanes_to_w 12->12 words/from4w 4-lane squeeze, rate 8 /
# cap 4) are permutation-agnostic and UNCHANGED; only the inner permutation changed (poseidon_perm
# -> poseidon2_perm, both byte-exact to their respective published vectors). pentecost/poseidon.py
# migrated to Poseidon2 in lock-step (the second verifier still checks the same hash). The pure-Glass
# Plonky2 perm/mds_* below remain ONLY as the readable Plonky2 reference + poseidon_difftest spec.
fn hashg(a: List<Int>, b: List<Int>) : List<Int> = from4w(poseidon2_perm(lanes_to_w(lanepad12(to_lanes(a) ++ to_lanes(b)))))
fn rand_coeffs(seed: Int, i: Int, k: Int) : List<List<Int>> = if i >= k then [] else [lane0(hashg(glit(seed), glit(i + 1)))] ++ rand_coeffs(seed, i + 1, k)
# --- ZK BLINDING (mechanism). T'(x) = T(x) + Z_H(x)*R(x): on H, Z_H=0 so T'=T (every gate
# constraint preserved); off H (the coset, where queries open) the Z_H*R mask randomizes the
# value, HIDING the witness. Full ZK = blind l,r,o,Z with deg(R) >= the ~166-eval leak surface,
# integrated into the staged FRI (the heavy part — design in docs/tier1-zk-design.md). Here we
# implement the blinding and demonstrate the HIDING property fast (no FRI).
fn zh_at(x: List<Int>, n: Int) : List<Int> = fsub(fpow_bn(x, glit(n)), [1])
fn blind_col(cw: List<List<Int>>, coset: List<List<Int>>, rco: List<List<Int>>, n: Int, i: Int, m: Int) : List<List<Int>> =
  if i >= m then [] else [fadd(wnth(cw, i), fmul(zh_at(wnth(coset, i), n), poly_eval_b(rco, wnth(coset, i))))] ++ blind_col(cw, coset, rco, n, i + 1, m)
# Hiding smoke test: blind the SAME witness column with two mask seeds; the opened value at a
# coset point must (a) differ from the raw witness value (masked) and (b) differ between the two
# masks (randomized) — so the opening reveals the mask, not the witness.
fn zk_hiding(seed1: Int, seed2: Int) : Bool =
  let n : Int = 8 in let coset : List<List<Int>> = fri_coset(n) in let m : Int = fri_dsize(n) in
  let lvals : List<List<Int>> = [glit(2), glit(3), glit(5), glit(7), glit(11), glit(13), glit(17), glit(19)] in
  let lcw : List<List<Int>> = lde(interp_n(lvals, n), n) in
  let b1 : List<List<Int>> = blind_col(lcw, coset, rand_coeffs(seed1, 0, 16), n, 0, m) in
  let b2 : List<List<Int>> = blind_col(lcw, coset, rand_coeffs(seed2, 0, 16), n, 0, m) in
  let masked : Bool = if bn_eq(wnth(b1, 5), wnth(lcw, 5)) then false else true in
  let diff_masks : Bool = if bn_eq(wnth(b1, 5), wnth(b2, 5)) then false else true in
  masked && diff_masks
fn blind_cw(cw: List<List<Int>>, coeffs: List<List<Int>>, dom: List<List<Int>>, i: Int) : List<List<Int>> =
  if i >= llen(cw) then [] else [fadd(wnth(cw, i), poly_eval_b(coeffs, wnth(dom, i)))] ++ blind_cw(cw, coeffs, dom, i + 1)
fn prove_zk(gates: List<Gate>, w: List<List<Int>>, seed: Int) : Bool =
  let bcw : List<List<Int>> = blind_cw(q_cw(gates, w), rand_coeffs(seed, 0, 16), fri_coset(ng(gates)), 0) in
  is_constb(fold_all_b(bcw, fri_coset(ng(gates)), finv([2]), 0))
fn opened5(gates: List<Gate>, w: List<List<Int>>, seed: Int) : List<Int> =
  wnth(blind_cw(q_cw(gates, w), rand_coeffs(seed, 0, 16), fri_coset(ng(gates)), 0), 5)

# --- the cryptographic STARK: F_{p^2} fold challenge + Merkle commit + queries --
# Embed the quotient codeword into F_{p^2}, blind it, Merkle-commit each FRI layer,
# derive the fold challenge β ∈ F_{p^2} ≈ 2^128 from each layer's root (Fiat-Shamir,
# so it's unpredictable), and OPEN sampled positions against the commitment: a
# prover whose Q is not low-degree is caught at (almost) every query. This is the
# production STARK shape, on the production field. (FRI over F_{p^2} + Merkle from
# frost_goldilocks_zk.glass, here applied to the gate quotient.)
type G2 = | G2(List<Int>, List<Int>)
fn gadd2(a: G2, b: G2) : G2 = match a { G2(a0, a1) => match b { G2(b0, b1) => G2(fadd(a0, b0), fadd(a1, b1)) } }
fn gsub2(a: G2, b: G2) : G2 = match a { G2(a0, a1) => match b { G2(b0, b1) => G2(fsub(a0, b0), fsub(a1, b1)) } }
fn gscale2(a: G2, s: List<Int>) : G2 = match a { G2(a0, a1) => G2(fmul(a0, s), fmul(a1, s)) }
fn gmul2(a: G2, b: G2) : G2 = match a { G2(a0, a1) => match b { G2(b0, b1) => G2(fadd(fmul(a0, b0), fmul([7], fmul(a1, b1))), fadd(fmul(a0, b1), fmul(a1, b0))) } }
fn geq2(a: G2, b: G2) : Bool = match a { G2(a0, a1) => match b { G2(b0, b1) => bn_eq(a0, b0) && bn_eq(a1, b1) } }
# --- F_{p^2} ops for the TIER-1 OOD/DEEP soundness check (u^2 = 7) --------------
fn gconj(a: G2) : G2 = match a { G2(a0, a1) => G2(a0, fsub([], a1)) }                                   # a0 - a1*u
fn gnorm(a: G2) : List<Int> = match a { G2(a0, a1) => fsub(fmul(a0, a0), fmul([7], fmul(a1, a1))) }     # a*conj(a) = a0^2 - 7*a1^2 (base field)
fn ginv2(a: G2) : G2 = gscale2(gconj(a), finv(gnorm(a)))                                                # a^-1 = conj(a)/norm
fn gpow2(a: G2, e: Int) : G2 = if e <= 0 then G2([1], []) else (if e % 2 == 0 then let h : G2 = gpow2(a, e / 2) in gmul2(h, h) else gmul2(a, gpow2(a, e - 1)))
fn poly_eval_g(coeffs: List<List<Int>>, z: G2) : G2 = match coeffs { [] => G2([], []); [c, ...r] => gadd2(emb(c), gmul2(z, poly_eval_g(r, z))) }   # eval a base-field poly at z in F_{p^2}
# (an imaginary-part-zero "anti-smuggling" guard was removed here: it was never wired into
# verify, and it is unnecessary — the trace openings are base-field BY TYPE (List<Int>) and
# the OOD evals are DEEP-bound to the committed base-field columns, so nothing can be smuggled
# in an imaginary part. An auditor should still confirm this. (Was dead code; removed for honesty.))
# --- B3: the grand-product Z column (F_{p^2}; interpolation splits real/imag since it
# is linear). Z_0=1; Z_{i+1}=Z_i * num_i/den_i with num=prod(val+beta*id+gamma_p),
# den=prod(val+beta*sigma+gamma_p) over the 3 columns. Telescopes to 1 iff every wire
# carries a single value (the copy constraint). perm_factor takes BASE-field val+id.
fn reals(zs: List<G2>) : List<List<Int>> = match zs { [] => []; [G2(a0, a1), ...r] => [a0] ++ reals(r) }
fn imags(zs: List<G2>) : List<List<Int>> = match zs { [] => []; [G2(a0, a1), ...r] => [a1] ++ imags(r) }
fn poly_eval_g2(zr: List<List<Int>>, zi: List<List<Int>>, z: G2) : G2 =
  match zr { [] => G2([], []); [cr, ...rr] => match zi { [] => G2([], []); [ci, ...ri] => gadd2(G2(cr, ci), gmul2(z, poly_eval_g2(rr, ri, z))) } }
# CUT THE ROPE 3: was O(n*m) — poly_eval_b (Horner) per coset point for both real and imag parts
# of the grand-product z-poly. Now two native NTT low-degree extensions, zipped into G2. (dom is
# always the size-32n coset, so n = |dom|/32.)
fn zip_g2(rs: List<List<Int>>, iss: List<List<Int>>) : List<G2> =
  match rs { [] => []; [rh, ...rt] => match iss { [] => []; [ih, ...it] => [G2(rh, ih)] ++ zip_g2(rt, it) } }
fn eval_g2_on_dom(zr: List<List<Int>>, zi: List<List<Int>>, dom: List<List<Int>>) : List<G2> =
  let nn : Int = lcnt(dom) / 32 in zip_g2(lde(zr, nn), lde(zi, nn))
fn perm_factor(val: List<Int>, idv: List<Int>, beta: G2, gam: G2) : G2 = gadd2(gadd2(emb(val), gmul2(beta, emb(idv))), gam)
fn perm_num(lv: List<Int>, rv: List<Int>, ov: List<Int>, i: Int, n: Int, beta: G2, gam: G2) : G2 =
  gmul2(perm_factor(lv, glit(i), beta, gam), gmul2(perm_factor(rv, glit(n + i), beta, gam), perm_factor(ov, glit(2 * n + i), beta, gam)))
fn perm_den(lv: List<Int>, rv: List<Int>, ov: List<Int>, cells: List<Pair<Int, Int>>, i: Int, n: Int, beta: G2, gam: G2) : G2 =
  gmul2(perm_factor(lv, glit(sigma(i, cells)), beta, gam), gmul2(perm_factor(rv, glit(sigma(n + i, cells)), beta, gam), perm_factor(ov, glit(sigma(2 * n + i, cells)), beta, gam)))
fn z_build(lvals: List<List<Int>>, rvals: List<List<Int>>, ovals: List<List<Int>>, cells: List<Pair<Int, Int>>, beta: G2, gam: G2, zcur: G2, i: Int, n: Int) : List<G2> =
  if i >= n then [] else
    let num : G2 = perm_num(wnth(lvals, i), wnth(rvals, i), wnth(ovals, i), i, n, beta, gam) in
    let den : G2 = perm_den(wnth(lvals, i), wnth(rvals, i), wnth(ovals, i), cells, i, n, beta, gam) in
    [zcur] ++ z_build(lvals, rvals, ovals, cells, beta, gam, gmul2(zcur, gmul2(num, ginv2(den))), i + 1, n)
fn z_final(lvals: List<List<Int>>, rvals: List<List<Int>>, ovals: List<List<Int>>, cells: List<Pair<Int, Int>>, beta: G2, gam: G2, zcur: G2, i: Int, n: Int) : G2 =
  if i >= n then zcur else
    let num : G2 = perm_num(wnth(lvals, i), wnth(rvals, i), wnth(ovals, i), i, n, beta, gam) in
    let den : G2 = perm_den(wnth(lvals, i), wnth(rvals, i), wnth(ovals, i), cells, i, n, beta, gam) in
    z_final(lvals, rvals, ovals, cells, beta, gam, gmul2(zcur, gmul2(num, ginv2(den))), i + 1, n)
fn pf(valz: G2, idz: G2, beta: G2, gam: G2) : G2 = gadd2(gadd2(valz, gmul2(beta, idz)), gam)   # F_{p^2} factor (verifier, at z)
fn beta_p_of(ts: List<Int>) : G2 = G2(lane0(hashg(ts, glit(221))), lane0(hashg(ts, glit(222))))
fn gam_p_of(ts: List<Int>) : G2 = G2(lane0(hashg(ts, glit(223))), lane0(hashg(ts, glit(224))))
fn alpha_of(ts: List<Int>) : G2 = G2(lane0(hashg(ts, glit(231))), lane0(hashg(ts, glit(232))))
fn emb(x: List<Int>) : G2 = G2(x, [])
fn embed_cw(cw: List<List<Int>>) : List<G2> = match cw { [] => []; [x, ...r] => [emb(x)] ++ embed_cw(r) }
fn lhash(leaf: G2) : List<Int> = match leaf { G2(c0, c1) => hashg(hashg(glit(7), c0), c1) }
fn nth2(xs: List<G2>, i: Int) : G2 = match xs { [] => G2([], []); [h, ...t] => if i == 0 then h else nth2(t, i - 1) }
fn next_pow2(n: Int, p: Int) : Int = if p >= n then p else next_pow2(n, p * 2)
fn leaf_hashes_g(cw: List<G2>) : List<List<Int>> = match cw { [] => []; [x, ...r] => [lhash(x)] ++ leaf_hashes_g(r) }
fn append_zeros_g(xs: List<List<Int>>, k: Int) : List<List<Int>> = if k <= 0 then xs else append_zeros_g(xs ++ [glit(0)], k - 1)
fn pad_pow2_g(xs: List<List<Int>>) : List<List<Int>> = let n : Int = llen(xs) in append_zeros_g(xs, next_pow2(n, 1) - n)
fn level_up_g(xs: List<List<Int>>) : List<List<Int>> = match xs { [] => []; [a, ...rest] => match rest { [] => [a]; [b, ...r2] => [hashg(a, b)] ++ level_up_g(r2) } }
fn root_of_g(xs: List<List<Int>>) : List<Int> = match xs { [] => []; [a, ...rest] => match rest { [] => a; _ => root_of_g(level_up_g(xs)) } }
fn merkle_root_g(cw: List<G2>) : List<Int> = root_of_g(pad_pow2_g(leaf_hashes_g(cw)))
fn path_of_g(xs: List<List<Int>>, index: Int) : List<List<Int>> = match xs { [] => []; [a, ...rest] => match rest { [] => []; _ => let sib : List<Int> = if index % 2 == 0 then wnth(xs, index + 1) else wnth(xs, index - 1) in [sib] ++ path_of_g(level_up_g(xs), index / 2) } }
fn merkle_path_g(cw: List<G2>, index: Int) : List<List<Int>> = path_of_g(pad_pow2_g(leaf_hashes_g(cw)), index)
fn fold_path_g(h: List<Int>, index: Int, path: List<List<Int>>) : List<Int> = match path { [] => h; [s, ...rest] => let up : List<Int> = if index % 2 == 0 then hashg(h, s) else hashg(s, h) in fold_path_g(up, index / 2, rest) }
fn merkle_verify_g(leaf: G2, index: Int, path: List<List<Int>>, root: List<Int>) : Bool = bn_eq(fold_path_g(lhash(leaf), index, path), root)
fn fold_pair2(fx: G2, fmx: G2, x: List<Int>, beta: G2, finv2: List<Int>) : G2 =
  let even : G2 = gscale2(gadd2(fx, fmx), finv2) in let odd : G2 = gscale2(gsub2(fx, fmx), finv(fmul([2], x))) in gadd2(even, gmul2(beta, odd))
# CUT THE ROPE 3: was O(m^2) — nth2(cw,i)/nth2(cw,i+half)/wnth(dom,i) per pair. to_vec once (O(m)), vget O(1).
fn fold_at2_go(cwv: List<G2>, domv: List<List<Int>>, beta: G2, finv2: List<Int>, i: Int, half: Int) : List<G2> =
  if i >= half then [] else [fold_pair2(vget(cwv, i), vget(cwv, i + half), vget(domv, i), beta, finv2)] ++ fold_at2_go(cwv, domv, beta, finv2, i + 1, half)
fn fold_at2(cw: List<G2>, dom: List<List<Int>>, beta: G2, finv2: List<Int>, i: Int, half: Int) : List<G2> =
  fold_at2_go(to_vec(cw), to_vec(dom), beta, finv2, 0, half)
# --- statement binding: a Poseidon digest over the gate list ------------------
# The FS transcript is SEEDED by this digest, so every FS challenge (the FRI fold
# betas and the query positions) is a deterministic function of the statement.
# gate_dig absorbs each gate's variant TAG (1..6, leading, for domain separation),
# its wire indices via glit (injective for indices < ~2^48 — true for every gate
# count), and — for GConst — the constant VALUE raw (full-width List<Int> field
# element, NOT routed through glit, so the claimed result R is captured at the full
# 2^64 width). The digest is WITNESS-INDEPENDENT: only public opcodes, wire indices,
# and constants are absorbed; GHint carries only its wire index (never the hint
# value), and the private witness `w` is never passed in. Under the current claim
# builders (build_claim / build_claim_m) the only constant in the gate list is the
# claimed result R (the last GConst), so the digest binds circuit structure + R
# without absorbing private CLI inputs (those stay in the witness, never as gates).
# glit(0) trims to [] (the field-zero element) — a valid hashg lane; the leading
# per-gate tag still separates distinct gate lists (Poseidon collision-resistance).
fn gate_dig(g: Gate, acc: List<Int>) : List<Int> = match g {
  GConst(o, c)  => hashg(hashg(hashg(acc, glit(1)), glit(o)), c);
  GAdd(o, a, b) => hashg(hashg(hashg(hashg(acc, glit(2)), glit(o)), glit(a)), glit(b));
  GSub(o, a, b) => hashg(hashg(hashg(hashg(acc, glit(3)), glit(o)), glit(a)), glit(b));
  GMul(o, a, b) => hashg(hashg(hashg(hashg(acc, glit(4)), glit(o)), glit(a)), glit(b));
  GHint(o)      => hashg(hashg(acc, glit(5)), glit(o));
  GEqZero(a)    => hashg(hashg(acc, glit(6)), glit(a)) }
fn circuit_digest(gates: List<Gate>, acc: List<Int>) : List<Int> = match gates { [] => acc; [g, ...rest] => circuit_digest(rest, gate_dig(g, acc)) }
# 2718281 = a fixed domain-separation tag (distinct from the [] seed the FRI-root
# chain would otherwise start from). NOTE: protocol params (field, coset generator
# 7, blowup 16, fold-stop 8, query count 64, 12-bit grind) are NOT in the digest —
# they are compile-time, version-pinned constants the future TIER-1 independent
# verifier must agree on out of band; they are not transcript-bound.
# The digest seed now also binds the PROTOCOL PARAMETERS (coset generator 7, blowup
# fri_dsize(1)=32, fold-stop fri_final(0)=8, query count fri_queries(0)=82, grind bits
# 12) — so a verifier instantiated with mismatched params derives different challenges
# (parameter-substitution is transcript-enforced, closing one of the two FS-PARTIAL gaps).
fn stmt_seed_of(gates: List<Gate>) : List<Int> = circuit_digest(gates, hashg(hashg(hashg(hashg(hashg(glit(2718281), glit(7)), glit(fri_dsize(1))), glit(fri_final(0))), glit(fri_queries(0))), glit(12)))
# the FRI fold challenge beta, derived from the running transcript seed (statement +
# all preceding layer roots) — NOT from the bare layer root as before.
fn beta_of_seed_g(tseed: List<Int>) : G2 = G2(lane0(hashg(tseed, glit(101))), lane0(hashg(tseed, glit(102))))
# --- memoized Merkle tree: build every level ONCE, read roots/paths from it ----
# Query verification used to recompute pad_pow2_g(leaf_hashes_g(cw)) and rebuild
# every level per query (merkle_path_g) — O(queries · tree). Instead build the full
# tree (list of levels, level 0 = padded leaf hashes, last = [root]) once per FRI
# layer, store it in the Layer, and pull sibling paths straight out. Byte-identical
# (same hashes), just not recomputed. This unblocks raising the FRI query count.
fn wnth3(xs: List<List<List<Int>>>, i: Int) : List<List<Int>> = match xs { [] => []; [x, ...r] => if i == 0 then x else wnth3(r, i - 1) }
fn l3len(xs: List<List<List<Int>>>) : Int = match xs { [] => 0; [x, ...r] => 1 + l3len(r) }
fn build_levels_g(level: List<List<Int>>, acc: List<List<List<Int>>>) : List<List<List<Int>>> =
  if llen(level) <= 1 then acc ++ [level] else build_levels_g(level_up_g(level), acc ++ [level])
fn merkle_levels_g(cw: List<G2>) : List<List<List<Int>>> = build_levels_g(pad_pow2_g(leaf_hashes_g(cw)), [])
fn root_of_levels(levels: List<List<List<Int>>>) : List<Int> = match wnth3(levels, l3len(levels) - 1) { [] => []; [r, ...t] => r }
fn path_of_levels(levels: List<List<List<Int>>>, li: Int, index: Int) : List<List<Int>> =
  if li >= l3len(levels) - 1 then []
  else let level : List<List<Int>> = wnth3(levels, li) in
       let sib : List<Int> = if index % 2 == 0 then wnth(level, index + 1) else wnth(level, index - 1) in
       [sib] ++ path_of_levels(levels, li + 1, index / 2)
fn merkle_path_levels(levels: List<List<List<Int>>>, index: Int) : List<List<Int>> = path_of_levels(levels, 0, index)
# --- Merkle batch-opening (v5.124, proof-size Stage 1): reconstruct a tree root from the opened leaves
# (at their indices) + a MINIMAL co-path node set, replacing the per-query independent sibling paths.
# Validated standalone in examples/prove/merkle_batch_difftest.glass + fuzz/merkle_batch_proto.py.
# Canonical bottom-up sweep over the memoized levels; even position = LEFT input to hashg (matching
# fold_path_g / level_up_g). The opened-index set is Fiat-Shamir-derived and recomputed by the verifier,
# so NO index tokens are transmitted (the co-path is consumed in the same canonical order both sides).
fn insI(a: Int, xs: List<Int>) : List<Int> = match xs { [] => [a]; [b, ...t] => if a <= b then [a] ++ xs else [b] ++ insI(a, t) }
fn sortI(xs: List<Int>) : List<Int> = match xs { [] => []; [a, ...t] => insI(a, sortI(t)) }
fn memI(xs: List<Int>, k: Int) : Bool = match xs { [] => false; [a, ...t] => if a == k then true else memI(t, k) }
fn unionI(xs: List<Int>, a: Int) : List<Int> = if memI(xs, a) then xs else xs ++ [a]
fn oidx_go(queries: List<Int>, half: Int, acc: List<Int>) : List<Int> =
  match queries { [] => acc; [p, ...rest] => let j : Int = p % half in oidx_go(rest, half, unionI(unionI(acc, j), j + half)) }
# the canonical sorted set of opened leaf positions {j, j+half : query p}, recomputed by the verifier
fn oidx_of(queries: List<Int>, half: Int) : List<Int> = sortI(oidx_go(queries, half, []))
# PROVER: minimal co-path over the levels. `known` = positions reconstructible at this level; a sibling
# digest is emitted iff not itself known (i.e. not opened/reconstructible). Canonical: ascending position.
fn bcp_go(todo: List<Int>, known: List<Int>, nodes: List<List<Int>>, parents: List<Int>, cp: List<List<Int>>) : (List<Int>, List<List<Int>>) =
  match todo { [] => (parents, cp);
    [pos, ...rest] => let parent : Int = pos / 2 in
      if memI(parents, parent) then bcp_go(rest, known, nodes, parents, cp)
      else let sib : Int = if pos % 2 == 0 then pos + 1 else pos - 1 in
        let cp2 : List<List<Int>> = if memI(known, sib) then cp else cp ++ [wnth(nodes, sib)] in
        bcp_go(rest, known, nodes, parents ++ [parent], cp2) }
fn bcopath(levels: List<List<List<Int>>>, li: Int, known: List<Int>, cp: List<List<Int>>) : List<List<Int>> =
  if li >= l3len(levels) - 1 then cp
  else match bcp_go(sortI(known), known, wnth3(levels, li), [], []) { (parents, cpn) => bcopath(levels, li + 1, parents, cp ++ cpn) }
# VERIFIER: reconstruct the root. `known` = List<Pair<pos, digest>>; co-path siblings consumed in the
# same canonical order. An under-run uses [] (-> wrong root -> REJECT); an over-run leaves leftover cp.
fn khasL(m: List<Pair<Int, List<Int>>>, k: Int) : Bool = match m { [] => false; [Pair(kk, vv), ...t] => if kk == k then true else khasL(t, k) }
fn kgetL(m: List<Pair<Int, List<Int>>>, k: Int) : List<Int> = match m { [] => []; [Pair(kk, vv), ...t] => if kk == k then vv else kgetL(t, k) }
fn keysL(m: List<Pair<Int, List<Int>>>) : List<Int> = match m { [] => []; [Pair(k, v), ...t] => [k] ++ keysL(t) }
fn rec_go(known: List<Pair<Int, List<Int>>>, todo: List<Int>, cp: List<List<Int>>, acc: List<Pair<Int, List<Int>>>) : (List<Pair<Int, List<Int>>>, List<List<Int>>) =
  match todo { [] => (acc, cp);
    [pos, ...rest] => let parent : Int = pos / 2 in
      if khasL(acc, parent) then rec_go(known, rest, cp, acc)
      else let sib : Int = if pos % 2 == 0 then pos + 1 else pos - 1 in
        match (if khasL(known, sib) then (kgetL(known, sib), cp) else (match cp { [] => ([], []); [s, ...cprest] => (s, cprest) })) { (sibh, cp2) =>
          let me : List<Int> = kgetL(known, pos) in
          let ph : List<Int> = if pos % 2 == 0 then hashg(me, sibh) else hashg(sibh, me) in
          rec_go(known, rest, cp2, acc ++ [Pair(parent, ph)]) } }
fn recon_root(known: List<Pair<Int, List<Int>>>, cp: List<List<Int>>, height: Int) : (List<Int>, List<List<Int>>) =
  if height <= 0 then (match known { [] => []; [Pair(k, v), ...t] => v }, cp)
  else match rec_go(known, sortI(keysL(known)), cp, []) { (parents, cprest) => recon_root(parents, cprest, height - 1) }
# reconstruct + check: root must match AND the co-path must be exactly consumed (no over-run -> no malleability)
fn recon_ok(known: List<Pair<Int, List<Int>>>, cp: List<List<Int>>, height: Int, root: List<Int>) : Bool =
  match recon_root(known, cp, height) { (rr, leftover) => bn_eq(rr, root) && (llen(leftover) == 0) }
type Layer = | Layer(List<G2>, List<List<Int>>, List<Int>, G2, List<List<List<Int>>>)
# tseed is threaded through the fold: tseed -> hashg(tseed, root_i) before each
# fold, and beta_i is derived from that updated seed. So beta_i depends on the
# statement seed AND every preceding layer root (fixing both the prior absence of
# statement-binding and the prior absence of cross-layer root chaining). The SAME
# beta value is stored in the Layer and used in fold_at2 (computed once), so the
# self-check (verify_query_g reads the stored beta) stays consistent by construction.
fn commit_g(cw: List<G2>, dom: List<List<Int>>, acc: List<Layer>, tseed: List<Int>, finv2: List<Int>) : (List<Layer>, List<G2>) =
  if len(cw) <= fri_final(0) then (acc, cw)
  else let levels : List<List<List<Int>>> = merkle_levels_g(cw) in let root : List<Int> = root_of_levels(levels) in
    let tseed2 : List<Int> = hashg(tseed, root) in
    let beta : G2 = beta_of_seed_g(tseed2) in let half : Int = len(cw) / 2 in
    commit_g(fold_at2(cw, dom, beta, finv2, 0, half), sqd(dom, 0, half), acc ++ [Layer(cw, dom, root, beta, levels)], tseed2, finv2)
# LOAD-BEARING INVARIANT: transcript_seed_g(layers, stmt_seed) MUST equal the final
# tseed threaded through commit_g — identical hashg(.,root) chaining seeded by
# stmt_seed, in layer (= commit) order. This is the exact derivation the future
# TIER-1 independent verifier will re-derive the betas and query positions from; if
# these two ever diverge, the prover would sample queries from a different seed than
# it folded under. (Defensive alternative: have commit_g return the final tseed.)
fn transcript_seed_g(layers: List<Layer>, acc: List<Int>) : List<Int> = match layers { [] => acc; [Layer(cw, dom, root, beta, levels), ...rest] => transcript_seed_g(rest, hashg(acc, root)) }
fn q_low(h: List<Int>, dsize: Int) : Int = match h { [] => 0; [x, ...t] => x % dsize }
# queries WITHOUT replacement: re-draw on a collision (fresh counter) until `count`
# DISTINCT positions, so the FRI soundness gets the full `count` independent tests (no
# wasted repeats eroding the razor-thin 68+12 margin). Deterministic: prover + verifier
# derive the identical set. Terminates since count (82) << dsize (=32N).
fn imember(x: Int, xs: List<Int>) : Bool = match xs { [] => false; [h, ...t] => if h == x then true else imember(x, t) }
fn sample_distinct(seed: List<Int>, need: Int, ctr: Int, acc: List<Int>, dsize: Int) : List<Int> =
  if need <= 0 then acc
  else if lcnt(acc) >= dsize then acc                              # all dsize positions collected (tiny circuits where count > dsize) -> stop
  else let q : Int = q_low(hashg(seed, glit(ctr)), dsize) in
       if imember(q, acc) then sample_distinct(seed, need, ctr + 1, acc, dsize)
       else sample_distinct(seed, need - 1, ctr + 1, acc ++ [q], dsize)
fn sample_queries_g(seed: List<Int>, count: Int, dsize: Int) : List<Int> = sample_distinct(seed, count, 1, [], dsize)
# --- grinding (proof-of-work on the Fiat-Shamir query seed) -------------------
# The prover must find a nonce whose hash with the transcript seed clears the low
# G_BITS bits (here 12). An adversary trying to grind a favorable set of query
# positions must therefore redo 2^12 hashing per attempt — adding 12 bits to the
# query-phase soundness (the standard STARK trick; production uses 20-30 bits).
# Two-level search keeps recursion depth bounded (~chunk + #chunks), so neither the
# interpreter's limit nor the native C stack is at risk.
# THE MEASURING REED (v5.63.0): the achieved bit-security is RE-DERIVED from the live proof
# parameters here — never asserted in prose. grind_modulus is the SINGLE source for the PoW
# target (pow_ok and grind_bits both read it, so the printed grind term can never drift from
# the grinding the prover actually does). provable_bits/listdecode_bits are pinned integer
# closed-forms at the construction's fixed rate ρ=4N/32N=1/8 (blowup = fri_dsize(1) = 32):
# ~0.83 bit/query unique-decoding, 1.5 bit/query list-decoding, + the grind bits.
fn grind_modulus(d: Int) : Int = 4096                       # 2^12 proof-of-work target
fn grind_bits(d: Int) : Int = let g : Int = ilog2(grind_modulus(0)) in if g > 16 then 16 else g   # = 12 today; CAPPED at 16: pow_ok only tests the first 16-bit limb (x in [0,2^16)), so grind_modulus > 2^16 would NOT raise the actual proof-of-work above 2^-16 — the cap keeps the PRINTED bit-security from overstating the grinding the prover does (v5.120 audit fix). Widening pow_ok to consume more limbs is the prerequisite for a genuinely higher grind.
fn blowup(d: Int) : Int = fri_dsize(1)                      # coset = 32N -> blowup 32 -> ρ = 1/8
fn provable_bits(gates: List<Gate>) : Int = (fri_queries(ng(gates)) * 83) / 100 + grind_bits(0)
fn listdecode_bits(gates: List<Gate>) : Int = (fri_queries(ng(gates)) * 3) / 2 + grind_bits(0)
fn measure_line(gates: List<Gate>) : String =
  int_to_string(provable_bits(gates)) ++ " bits provable / " ++ int_to_string(listdecode_bits(gates))
  ++ " bits list-decoding (conjectural, proximity-gap)  (" ++ int_to_string(fri_queries(ng(gates))) ++ " queries, blowup "
  ++ int_to_string(blowup(0)) ++ " => rate 1/8, " ++ int_to_string(grind_bits(0)) ++ "-bit grind, 4-lane ~128-bit hash)"
fn pow_ok(h: List<Int>) : Bool = match trim(h) { [] => true; [x, ...t] => x % grind_modulus(0) == 0 }   # 12-bit proof-of-work: the FS query seed's low 12 bits must be 0
fn grind_in(seed: List<Int>, base: Int, i: Int) : Int =
  if i >= 64 then 0 - 1 else (if pow_ok(hashg(seed, glit(base * 64 + i))) then base * 64 + i else grind_in(seed, base, i + 1))
fn grind_out(seed: List<Int>, base: Int) : Int = let r : Int = grind_in(seed, base, 0) in if r >= 0 then r else grind_out(seed, base + 1)
fn grind(seed: List<Int>) : Int = grind_out(seed, 0)
fn next_val2(rest: List<Layer>, final: List<G2>, j: Int) : G2 = match rest { [] => nth2(final, j); [Layer(cw, dom, root, beta, levels), ...more] => nth2(cw, j) }
fn verify_query_g(layers: List<Layer>, final: List<G2>, p: Int, finv2: List<Int>) : Bool =
  match layers { [] => true;
    [Layer(cw, dom, root, beta, levels), ...rest] =>
      let half : Int = len(cw) / 2 in let j : Int = p % half in
      let lx : G2 = nth2(cw, j) in let lmx : G2 = nth2(cw, j + half) in
      let ok1 : Bool = merkle_verify_g(lx, j, merkle_path_levels(levels, j), root) in
      let ok2 : Bool = merkle_verify_g(lmx, j + half, merkle_path_levels(levels, j + half), root) in
      let folded : G2 = fold_pair2(lx, lmx, wnth(dom, j), beta, finv2) in
      if ok1 then if ok2 then if geq2(folded, next_val2(rest, final, j)) then verify_query_g(rest, final, j, finv2) else false else false else false }
fn count_catches_g(layers: List<Layer>, final: List<G2>, qs: List<Int>, finv2: List<Int>) : Int =
  match qs { [] => 0; [p, ...rest] => (if verify_query_g(layers, final, p, finv2) then 0 else 1) + count_catches_g(layers, final, rest, finv2) }
fn all_eq2(cw: List<G2>, x: G2) : Bool = match cw { [] => true; [y, ...r] => if geq2(y, x) then all_eq2(r, x) else false }
fn is_const2(cw: List<G2>) : Bool = match cw { [] => true; [x, ...r] => all_eq2(r, x) }
fn blind_g(cw: List<G2>, coeffs: List<List<Int>>, dom: List<List<Int>>, i: Int) : List<G2> =
  if i >= len(cw) then [] else [gadd2(nth2(cw, i), emb(poly_eval_b(coeffs, wnth(dom, i))))] ++ blind_g(cw, coeffs, dom, i + 1)
fn prove_stark(gates: List<Gate>, w: List<List<Int>>, seed: Int) : Bool =
  let stmt_seed : List<Int> = stmt_seed_of(gates) in                     # bind the statement (circuit + R) into the transcript
  let ecw : List<G2> = blind_g(embed_cw(q_cw(gates, w)), rand_coeffs(seed, 0, 16), fri_coset(ng(gates)), 0) in
  match commit_g(ecw, fri_coset(ng(gates)), [], stmt_seed, finv([2])) { (layers, final) =>
    let base_seed : List<Int> = transcript_seed_g(layers, stmt_seed) in  # == the final tseed from commit_g (see invariant above)
    let nz : Int = grind(base_seed) in                                   # proof-of-work: 12 bits
    let ground : List<Int> = hashg(base_seed, glit(nz)) in               # the PoW-cleared query seed
    let faults : Int = count_catches_g(layers, final, sample_queries_g(ground, fri_queries(ng(gates)), fri_dsize(ng(gates))), finv([2])) in
    is_const2(final) && faults == 0 && pow_ok(ground) }
fn stark_root(gates: List<Gate>, w: List<List<Int>>, seed: Int) : List<Int> =
  merkle_root_g(blind_g(embed_cw(q_cw(gates, w)), rand_coeffs(seed, 0, 16), fri_coset(ng(gates)), 0))

# === TIER-1 (WIP, NOT YET SHIPPED): an INDEPENDENT verify(statement, proof) ====
# Splits the prover from the verifier. verify RE-DERIVES every Fiat-Shamir
# challenge — stmt_seed, the fold betas, the grind, the query positions — from the
# PUBLIC gates + the proof's Merkle roots; it never reads a stored beta and never
# sees the witness. This is the SCAFFOLDING (challenge re-derivation + opening
# checks). *** IT IS NOT YET SOUNDNESS ***: verify checks only that a low-degree
# codeword was committed and that the openings are Merkle/fold-consistent — it does
# NOT recompute G/Z_H from the gates, so a malicious prover can commit ANY low-degree
# codeword (e.g. P=0) and be ACCEPTed regardless of the statement (see prove_evil
# below — an executable demonstration of the gap). Closing it needs TIER-1 part 2:
# a trace commitment + the OOD/DEEP quotient identity + a copy/permutation argument.
type QOpen = | QOpen(G2, G2, List<List<Int>>, List<List<Int>>)            # one query, one layer: lx, lmx, path_lx, path_lmx
type Proof = | Proof(List<List<Int>>, List<G2>, Int, List<List<QOpen>>)   # roots, final, nonce, openings[query][layer]
# v5.125 Stage 2: the FRI openings (ProofB3 only) are BATCHED per LAYER. Per (query,layer) we keep only
# the opened VALUES (QVal: lx, lmx) — the fold-chain inputs — and each FRI layer's tree is opened ONCE as
# a multiproof: BFri carries qvals[query][layer] + one shared co-path per layer. The verifier reconstructs
# each layer root (vfri_recon, reusing recon_root) and runs the per-query fold chain (vq_b3) with NO
# per-query Merkle path. The FRI domains nest as powers of two, so a query's layer-L index is p % half_L.
type QVal = | QVal(G2, G2)
type BFri = | BFri(List<List<QVal>>, List<List<List<Int>>>)               # qvals[query][layer], copath[layer]
# PROVER: per-query opened values (no paths) + one co-path per FRI layer over its opened-index set.
fn extract_qvals(layers: List<Layer>, p: Int) : List<QVal> =
  match layers { [] => [];
    [Layer(cw, dom, root, beta, levels), ...rest] =>
      let half : Int = len(cw) / 2 in let j : Int = p % half in
      [QVal(nth2(cw, j), nth2(cw, j + half))] ++ extract_qvals(rest, j) }
fn extract_qvals_all(layers: List<Layer>, queries: List<Int>) : List<List<QVal>> =
  match queries { [] => []; [p, ...rest] => [extract_qvals(layers, p)] ++ extract_qvals_all(layers, rest) }
fn fri_copaths(layers: List<Layer>, queries: List<Int>) : List<List<List<Int>>> =
  match layers { [] => [];
    [Layer(cw, dom, root, beta, levels), ...rest] =>
      let half : Int = len(cw) / 2 in
      [bcopath(levels, 0, oidx_of(queries, half), [])] ++ fri_copaths(rest, queries) }
fn extract_bfri(layers: List<Layer>, queries: List<Int>) : BFri =
  BFri(extract_qvals_all(layers, queries), fri_copaths(layers, queries))
# VERIFIER: reconstruct each FRI layer root from the opened values + co-path (FRI leaf = lhash(value)).
fn nth_qval(qv: List<QVal>, i: Int) : QVal = match qv { [] => QVal(G2([], []), G2([], [])); [x, ...r] => if i == 0 then x else nth_qval(r, i - 1) }
fn frimap(qvals: List<List<QVal>>, queries: List<Int>, lyr: Int, half: Int, acc: List<Pair<Int, List<Int>>>) : List<Pair<Int, List<Int>>> =
  match qvals { [] => acc; [row, ...rr] => match queries { [] => acc; [p, ...qr] =>
    match nth_qval(row, lyr) { QVal(lx, lmx) => let j : Int = p % half in
      frimap(rr, qr, lyr, half, mapput(mapput(acc, j, lhash(lx)), j + half, lhash(lmx))) } } }
fn vfri_recon(qvals: List<List<QVal>>, queries: List<Int>, lcopaths: List<List<List<Int>>>, broots: List<List<Int>>, doms: List<List<List<Int>>>, lyr: Int, lyrs: Int) : Bool =
  if lyr >= lyrs then true
  else let domL : List<List<Int>> = wnth3(doms, lyr) in let half : Int = llen(domL) / 2 in let height : Int = ilog2(llen(domL)) in
    if recon_ok(frimap(qvals, queries, lyr, half, []), wnth3(lcopaths, lyr), height, wnth(broots, lyr))
    then vfri_recon(qvals, queries, lcopaths, broots, doms, lyr + 1, lyrs) else false
# per-query FRI fold chain (no Merkle — that is now done in bulk by vfri_recon); ties each layer's fold
# to the next layer's opened value, exactly as vq did, but reading QVal and skipping merkle_verify.
fn vq_b3(qv: List<QVal>, betas: List<G2>, doms: List<List<List<Int>>>, final: List<G2>, p: Int, finv2: List<Int>) : Bool =
  match qv { [] => true;
    [QVal(lx, lmx), ...orest] =>
      match betas { [] => false; [beta, ...brest] =>
      match doms { [] => false; [dom, ...drest] =>
        let half : Int = llen(dom) / 2 in let j : Int = p % half in
        let next_half : Int = match drest { [] => 0; [nd, ...nn] => llen(nd) / 2 } in
        let nextv : G2 = match orest { [] => nth2(final, j); [QVal(nlx, nlmx), ...more] => if j < next_half then nlx else nlmx } in
        let folded : G2 = fold_pair2(lx, lmx, wnth(dom, j), beta, finv2) in
        if geq2(folded, nextv) then vq_b3(orest, brest, drest, final, j, finv2) else false } } }
fn qvlen(xs: List<List<QVal>>) : Int = match xs { [] => 0; [x, ...r] => 1 + qvlen(r) }
fn qval1len(xs: List<QVal>) : Int = match xs { [] => 0; [x, ...r] => 1 + qval1len(r) }
fn fri_layers(d: Int) : Int = ilog2(fri_dsize(d) / fri_final(0))         # #FRI layers = log2(16N/8) = log2(2N)
fn qopen_len(xs: List<QOpen>) : Int = match xs { [] => 0; [x, ...r] => 1 + qopen_len(r) }
fn openings_len(xs: List<List<QOpen>>) : Int = match xs { [] => 0; [x, ...r] => 1 + openings_len(r) }
fn roots_of(layers: List<Layer>) : List<List<Int>> = match layers { [] => []; [Layer(cw, dom, root, beta, levels), ...rest] => [root] ++ roots_of(rest) }
fn build_gates(b: Build) : List<Gate> = match b { Build(n, gs, w) => gs }
fn build_wit(b: Build) : List<List<Int>> = match b { Build(n, gs, w) => w }
# --- prover: emit a Proof (roots + per-query openings, paths from stored levels) --
fn extract_query(layers: List<Layer>, p: Int) : List<QOpen> =
  match layers { [] => [];
    [Layer(cw, dom, root, beta, levels), ...rest] =>
      let half : Int = len(cw) / 2 in let j : Int = p % half in
      [QOpen(nth2(cw, j), nth2(cw, j + half), merkle_path_levels(levels, j), merkle_path_levels(levels, j + half))] ++ extract_query(rest, j) }
fn extract_all(layers: List<Layer>, queries: List<Int>) : List<List<QOpen>> =
  match queries { [] => []; [p, ...rest] => [extract_query(layers, p)] ++ extract_all(layers, rest) }
fn prove_to_proof(gates: List<Gate>, w: List<List<Int>>, seed: Int) : Proof =
  let stmt_seed : List<Int> = stmt_seed_of(gates) in
  let ecw : List<G2> = blind_g(embed_cw(q_cw(gates, w)), rand_coeffs(seed, 0, 16), fri_coset(ng(gates)), 0) in
  match commit_g(ecw, fri_coset(ng(gates)), [], stmt_seed, finv([2])) { (layers, final) =>
    let base_seed : List<Int> = transcript_seed_g(layers, stmt_seed) in
    let nz : Int = grind(base_seed) in
    let ground : List<Int> = hashg(base_seed, glit(nz)) in
    let queries : List<Int> = sample_queries_g(ground, fri_queries(ng(gates)), fri_dsize(ng(gates))) in
    Proof(roots_of(layers), final, nz, extract_all(layers, queries)) }
# --- verifier: re-derive ALL challenges from public gates + proof.roots --------
fn rederive_betas(roots: List<List<Int>>, tseed: List<Int>) : List<G2> =
  match roots { [] => []; [root, ...rest] => let ts2 : List<Int> = hashg(tseed, root) in [beta_of_seed_g(ts2)] ++ rederive_betas(rest, ts2) }
fn seed_from_roots(roots: List<List<Int>>, tseed: List<Int>) : List<Int> =
  match roots { [] => tseed; [root, ...rest] => seed_from_roots(rest, hashg(tseed, root)) }
fn build_doms(dom: List<List<Int>>, count: Int) : List<List<List<Int>>> =
  if count <= 0 then [] else [dom] ++ build_doms(sqd(dom, 0, llen(dom) / 2), count - 1)
# The fold target of layer i lands at index j_i in layer i+1's codeword, which is
# EITHER that layer's opened lx (if j_i < half_{i+1}) OR its lmx — and the SAME
# object is Merkle-verified at layer i+1, so the chain is airtight across the split.
fn vq(oq: List<QOpen>, roots: List<List<Int>>, betas: List<G2>, doms: List<List<List<Int>>>, final: List<G2>, p: Int, finv2: List<Int>) : Bool =
  match oq { [] => true;
    [QOpen(lx, lmx, plx, plmx), ...orest] =>
      match roots { [] => false; [root, ...rrest] =>
      match betas { [] => false; [beta, ...brest] =>
      match doms { [] => false; [dom, ...drest] =>
        let half : Int = llen(dom) / 2 in let j : Int = p % half in
        let next_half : Int = match drest { [] => 0; [nd, ...nn] => llen(nd) / 2 } in
        let nextv : G2 = match orest { [] => nth2(final, j); [QOpen(nlx, nlmx, np1, np2), ...more] => if j < next_half then nlx else nlmx } in
        let ok1 : Bool = merkle_verify_g(lx, j, plx, root) in
        let ok2 : Bool = merkle_verify_g(lmx, j + half, plmx, root) in
        let folded : G2 = fold_pair2(lx, lmx, wnth(dom, j), beta, finv2) in
        if ok1 then if ok2 then if geq2(folded, nextv) then vq(orest, rrest, brest, drest, final, j, finv2) else false else false else false } } } }
fn verify_queries(openings: List<List<QOpen>>, roots: List<List<Int>>, betas: List<G2>, doms: List<List<List<Int>>>, final: List<G2>, queries: List<Int>, lyrs: Int, finv2: List<Int>) : Bool =
  match openings { [] => match queries { [] => true; _ => false };
    [oq, ...orest] => match queries { [] => false; [p, ...qrest] =>
      if qopen_len(oq) == lyrs then (if vq(oq, roots, betas, doms, final, p, finv2) then verify_queries(orest, roots, betas, doms, final, qrest, lyrs, finv2) else false) else false } }
fn verify(gates: List<Gate>, proof: Proof) : Bool =
  match proof { Proof(roots, final, nonce, openings) =>
    let n : Int = ng(gates) in let lyrs : Int = fri_layers(n) in
    let stmt_seed : List<Int> = stmt_seed_of(gates) in
    let betas : List<G2> = rederive_betas(roots, stmt_seed) in
    let base_seed : List<Int> = seed_from_roots(roots, stmt_seed) in
    let ground : List<Int> = hashg(base_seed, glit(nonce)) in
    let doms : List<List<List<Int>>> = build_doms(fri_coset(n), lyrs) in
    let queries : List<Int> = sample_queries_g(ground, fri_queries(n), fri_dsize(n)) in
    (llen(roots) == lyrs) && (len(final) == fri_final(0)) && (openings_len(openings) == fri_queries(n))
      && pow_ok(ground) && is_const2(final) && verify_queries(openings, roots, betas, doms, final, queries, lyrs, finv([2])) }
# --- the HONEST GAP, made executable: a malicious prover commits P=0 (low-degree,
# unrelated to the gates or to ANY witness); verify ACCEPTs it for any statement.
# THIS is why the scaffolding above is not yet soundness — TIER-1 part 2 closes it.
fn zeros_cw(k: Int) : List<G2> = if k <= 0 then [] else [emb(glit(0))] ++ zeros_cw(k - 1)
fn prove_evil(gates: List<Gate>) : Proof =
  let stmt_seed : List<Int> = stmt_seed_of(gates) in
  match commit_g(zeros_cw(fri_dsize(ng(gates))), fri_coset(ng(gates)), [], stmt_seed, finv([2])) { (layers, final) =>
    let base_seed : List<Int> = transcript_seed_g(layers, stmt_seed) in
    let nz : Int = grind(base_seed) in
    let ground : List<Int> = hashg(base_seed, glit(nz)) in
    let queries : List<Int> = sample_queries_g(ground, fri_queries(ng(gates)), fri_dsize(ng(gates))) in
    Proof(roots_of(layers), final, nz, extract_all(layers, queries)) }
fn tamper_nonce(proof: Proof) : Proof = match proof { Proof(roots, final, nonce, openings) => Proof(roots, final, nonce + 1, openings) }

# === TIER-1 PART 2 (WIP): SOUND prover/verifier — ties Q to the gate constraints
# Closes the P=0 gap. Commit the trace (l,r,o) AND the quotient Q (UNBLINDED — ZK is
# SUSPENDED on this path: witness opened in clear). Draw an out-of-domain z in F_{p^2}
# AFTER the trace commitment; prover sends l(z),r(z),o(z),Q(z); verifier checks the
# constraint identity Q(z)*Z_H(z) == G(z) in F_{p^2}; the DEEP quotients (T(x)-T(z))/(x-z)
# for T in {l,r,o,Q} are batched with an FS gamma and run through the EXISTING FRI, which
# degree-bounds all four columns AND binds the sent z-evals to the committed trees.
# WHAT THIS PROVES: every row of the committed trace satisfies its per-row gate, and R =
# the asserted output row. WHAT IT DOES NOT: inter-row WIRE consistency (B3, copy/perm,
# not built) — a prover can still thread inconsistent values across rows. NOT out of
# research grade (B3 + external audit remain); NOT zero-knowledge on this path.
type TOpen = | TOpen(List<Int>, List<Int>, List<Int>, List<Int>, List<List<Int>>, List<Int>, List<Int>, List<Int>, List<Int>, List<List<Int>>)
type ProofS = | ProofS(List<Int>, G2, G2, G2, G2, List<List<Int>>, List<G2>, Int, List<List<QOpen>>, List<TOpen>)
fn ood_of(ts: List<Int>) : G2 = G2(lane0(hashg(ts, glit(201))), lane0(hashg(ts, glit(202))))
fn gamma_of(ts: List<Int>) : G2 = G2(lane0(hashg(ts, glit(211))), lane0(hashg(ts, glit(212))))
fn absorb_g2(acc: List<Int>, g: G2) : List<Int> = match g { G2(a0, a1) => hashg(hashg(acc, a0), a1) }
fn ts_with_ood(ts1: List<Int>, lz: G2, rz: G2, oz: G2, qz: G2) : List<Int> = absorb_g2(absorb_g2(absorb_g2(absorb_g2(ts1, lz), rz), oz), qz)
fn zh_g(z: G2, n: Int) : G2 = gsub2(gpow2(z, n), G2([1], []))
fn g_at_z(pc: List<List<List<Int>>>, lz: G2, rz: G2, oz: G2, z: G2) : G2 =
  let va : G2 = poly_eval_g(wnth3(pc, 0), z) in let vm : G2 = poly_eval_g(wnth3(pc, 1), z) in
  let vs : G2 = poly_eval_g(wnth3(pc, 2), z) in let vc : G2 = poly_eval_g(wnth3(pc, 3), z) in
  let vqe : G2 = poly_eval_g(wnth3(pc, 4), z) in let vk : G2 = poly_eval_g(wnth3(pc, 5), z) in
  gadd2(gmul2(va, gsub2(oz, gadd2(lz, rz))), gadd2(gmul2(vm, gsub2(oz, gmul2(lz, rz))), gadd2(gmul2(vs, gsub2(oz, gsub2(lz, rz))), gadd2(gmul2(vc, gsub2(oz, vk)), gmul2(vqe, lz)))))
fn deep_batch(li: List<Int>, ri: List<Int>, oi: List<Int>, qi: List<Int>, xi: List<Int>, lz: G2, rz: G2, oz: G2, qz: G2, z: G2, gam: G2) : G2 =
  let den : G2 = ginv2(gsub2(emb(xi), z)) in
  let qdq : G2 = gmul2(gsub2(emb(qi), qz), den) in let qdl : G2 = gmul2(gsub2(emb(li), lz), den) in
  let qdr : G2 = gmul2(gsub2(emb(ri), rz), den) in let qdo : G2 = gmul2(gsub2(emb(oi), oz), den) in
  let g2 : G2 = gmul2(gam, gam) in let g3 : G2 = gmul2(g2, gam) in
  gadd2(qdq, gadd2(gmul2(gam, qdl), gadd2(gmul2(g2, qdr), gmul2(g3, qdo))))
fn comb_leaf(li: List<Int>, ri: List<Int>, oi: List<Int>, qi: List<Int>) : List<Int> = hashg(hashg(hashg(li, ri), oi), qi)
fn trace_leaf_list(lcw: List<List<Int>>, rcw: List<List<Int>>, ocw: List<List<Int>>, qcw: List<List<Int>>, i: Int, m: Int) : List<List<Int>> =
  if i >= m then [] else [comb_leaf(wnth(lcw, i), wnth(rcw, i), wnth(ocw, i), wnth(qcw, i))] ++ trace_leaf_list(lcw, rcw, ocw, qcw, i + 1, m)
fn build_b(lcw: List<List<Int>>, rcw: List<List<Int>>, ocw: List<List<Int>>, qcw: List<List<Int>>, coset: List<List<Int>>, lz: G2, rz: G2, oz: G2, qz: G2, z: G2, gam: G2, i: Int, m: Int) : List<G2> =
  if i >= m then [] else [deep_batch(wnth(lcw, i), wnth(rcw, i), wnth(ocw, i), wnth(qcw, i), wnth(coset, i), lz, rz, oz, qz, z, gam)] ++ build_b(lcw, rcw, ocw, qcw, coset, lz, rz, oz, qz, z, gam, i + 1, m)
fn merkle_verify_h(leaf: List<Int>, index: Int, path: List<List<Int>>, root: List<Int>) : Bool = bn_eq(fold_path_g(leaf, index, path), root)
fn tlen(xs: List<TOpen>) : Int = match xs { [] => 0; [x, ...r] => 1 + tlen(r) }
fn extract_trace1(lcw: List<List<Int>>, rcw: List<List<Int>>, ocw: List<List<Int>>, qcw: List<List<Int>>, tlevels: List<List<List<Int>>>, p: Int, m: Int) : TOpen =
  let half : Int = m / 2 in let j : Int = p % half in
  TOpen(wnth(lcw, j), wnth(rcw, j), wnth(ocw, j), wnth(qcw, j), merkle_path_levels(tlevels, j),
        wnth(lcw, j + half), wnth(rcw, j + half), wnth(ocw, j + half), wnth(qcw, j + half), merkle_path_levels(tlevels, j + half))
fn extract_traces(lcw: List<List<Int>>, rcw: List<List<Int>>, ocw: List<List<Int>>, qcw: List<List<Int>>, tlevels: List<List<List<Int>>>, queries: List<Int>, m: Int) : List<TOpen> =
  match queries { [] => []; [p, ...rest] => [extract_trace1(lcw, rcw, ocw, qcw, tlevels, p, m)] ++ extract_traces(lcw, rcw, ocw, qcw, tlevels, rest, m) }
fn prove_sound(gates: List<Gate>, w: List<List<Int>>) : ProofS =
  let n : Int = ng(gates) in let m : Int = fri_dsize(n) in let coset : List<List<Int>> = fri_coset(n) in
  let stmt : List<Int> = stmt_seed_of(gates) in
  let pc : List<List<List<Int>>> = public_cols(gates, n) in let tc : List<List<List<Int>>> = trace_cols(gates, w, n) in
  let ll : List<List<Int>> = wnth3(tc, 0) in let rr : List<List<Int>> = wnth3(tc, 1) in let oo : List<List<Int>> = wnth3(tc, 2) in
  let lcw : List<List<Int>> = lde(ll, n) in let rcw : List<List<Int>> = lde(rr, n) in let ocw : List<List<Int>> = lde(oo, n) in
  let qcw : List<List<Int>> = q_cw(gates, w) in
  let tlevels : List<List<List<Int>>> = build_levels_g(pad_pow2_g(trace_leaf_list(lcw, rcw, ocw, qcw, 0, m)), []) in
  let trace_root : List<Int> = root_of_levels(tlevels) in
  let ts1 : List<Int> = hashg(stmt, trace_root) in let z : G2 = ood_of(ts1) in
  let lz : G2 = poly_eval_g(ll, z) in let rz : G2 = poly_eval_g(rr, z) in let oz : G2 = poly_eval_g(oo, z) in
  let qz : G2 = gmul2(g_at_z(pc, lz, rz, oz, z), ginv2(zh_g(z, n))) in
  let ts2 : List<Int> = ts_with_ood(ts1, lz, rz, oz, qz) in let gam : G2 = gamma_of(ts2) in
  let bcw : List<G2> = build_b(lcw, rcw, ocw, qcw, coset, lz, rz, oz, qz, z, gam, 0, m) in
  match commit_g(bcw, coset, [], ts2, finv([2])) { (blayers, bfinal) =>
    let base_seed : List<Int> = transcript_seed_g(blayers, ts2) in
    let nz : Int = grind(base_seed) in let ground : List<Int> = hashg(base_seed, glit(nz)) in
    let queries : List<Int> = sample_queries_g(ground, fri_queries(n), fri_dsize(n)) in
    ProofS(trace_root, lz, rz, oz, qz, roots_of(blayers), bfinal, nz, extract_all(blayers, queries), extract_traces(lcw, rcw, ocw, qcw, tlevels, queries, fri_dsize(n))) }
fn vsq1(boq: List<QOpen>, toq: TOpen, broots: List<List<Int>>, betas: List<G2>, doms: List<List<List<Int>>>, bfinal: List<G2>, coset: List<List<Int>>, lz: G2, rz: G2, oz: G2, qz: G2, z: G2, gam: G2, trace_root: List<Int>, m: Int, p: Int, lyrs: Int, finv2: List<Int>) : Bool =
  let half : Int = m / 2 in let j : Int = p % half in
  match toq { TOpen(lj, rj, oj, qj, pj, ljh, rjh, ojh, qjh, pjh) =>
    let mk1 : Bool = merkle_verify_h(comb_leaf(lj, rj, oj, qj), j, pj, trace_root) in
    let mk2 : Bool = merkle_verify_h(comb_leaf(ljh, rjh, ojh, qjh), j + half, pjh, trace_root) in
    let bj : G2 = deep_batch(lj, rj, oj, qj, wnth(coset, j), lz, rz, oz, qz, z, gam) in
    let bjh : G2 = deep_batch(ljh, rjh, ojh, qjh, wnth(coset, j + half), lz, rz, oz, qz, z, gam) in
    let recon : Bool = match boq { [] => false; [QOpen(blx, blmx, p1, p2), ...rest] => geq2(bj, blx) && geq2(bjh, blmx) } in
    mk1 && mk2 && recon && (qopen_len(boq) == lyrs) && vq(boq, broots, betas, doms, bfinal, p, finv2) }
fn vsqs(bopen: List<List<QOpen>>, topen: List<TOpen>, broots: List<List<Int>>, betas: List<G2>, doms: List<List<List<Int>>>, bfinal: List<G2>, coset: List<List<Int>>, lz: G2, rz: G2, oz: G2, qz: G2, z: G2, gam: G2, trace_root: List<Int>, m: Int, queries: List<Int>, lyrs: Int, finv2: List<Int>) : Bool =
  match bopen { [] => match queries { [] => match topen { [] => true; _ => false }; _ => false };
    [boq, ...brest] => match topen { [] => false; [toq, ...trest] => match queries { [] => false; [p, ...qrest] =>
      if vsq1(boq, toq, broots, betas, doms, bfinal, coset, lz, rz, oz, qz, z, gam, trace_root, m, p, lyrs, finv2)
      then vsqs(brest, trest, broots, betas, doms, bfinal, coset, lz, rz, oz, qz, z, gam, trace_root, m, qrest, lyrs, finv2) else false } } }
fn verify_sound(gates: List<Gate>, proof: ProofS) : Bool =
  match proof { ProofS(trace_root, lz, rz, oz, qz, broots, bfinal, nonce, bopen, topen) =>
    let n : Int = ng(gates) in let m : Int = fri_dsize(n) in let coset : List<List<Int>> = fri_coset(n) in let lyrs : Int = fri_layers(n) in
    let stmt : List<Int> = stmt_seed_of(gates) in let pc : List<List<List<Int>>> = public_cols(gates, n) in
    let ts1 : List<Int> = hashg(stmt, trace_root) in let z : G2 = ood_of(ts1) in
    let ts2 : List<Int> = ts_with_ood(ts1, lz, rz, oz, qz) in let gam : G2 = gamma_of(ts2) in
    let betas : List<G2> = rederive_betas(broots, ts2) in let base_seed : List<Int> = seed_from_roots(broots, ts2) in
    let ground : List<Int> = hashg(base_seed, glit(nonce)) in
    let doms : List<List<List<Int>>> = build_doms(coset, lyrs) in
    let queries : List<Int> = sample_queries_g(ground, fri_queries(n), fri_dsize(n)) in
    # OOD evals l(z),r(z),o(z),Q(z) are legitimately COMPLEX (base-field polys at a complex z); no real-only
    # guard on them. The per-query trace openings are base-field by TYPE (List<Int>), and the DEEP-FRI binds
    # the sent z-evals to the committed columns, so nothing can be smuggled. The identity is the whole check.
    let id_ok : Bool = geq2(gmul2(qz, zh_g(z, n)), g_at_z(pc, lz, rz, oz, z)) in
    let struct_ok : Bool = (llen(broots) == lyrs) && (len(bfinal) == fri_final(0)) && (openings_len(bopen) == fri_queries(n)) && (tlen(topen) == fri_queries(n)) && pow_ok(ground) && is_const2(bfinal) in
    id_ok && struct_ok && vsqs(bopen, topen, broots, betas, doms, bfinal, coset, lz, rz, oz, qz, z, gam, trace_root, m, queries, lyrs, finv([2])) }
# P=0 attack against the SOUND path: commit all-zero l,r,o,Q and zero OOD evals; the
# DEEP-FRI/Merkle all pass, but the identity Q(z)*Z_H(z)==G(z) FAILS (0 != G_pub(z),
# nonzero off H because of the GConst(R) row) -> REJECT. The headline regression.
fn zeros_b(k: Int) : List<List<Int>> = if k <= 0 then [] else [glit(0)] ++ zeros_b(k - 1)
fn prove_sound_evil(gates: List<Gate>) : ProofS =
  let n : Int = ng(gates) in let m : Int = fri_dsize(n) in let coset : List<List<Int>> = fri_coset(n) in
  let stmt : List<Int> = stmt_seed_of(gates) in let z0 : List<List<Int>> = zeros_b(m) in
  let tlevels : List<List<List<Int>>> = build_levels_g(pad_pow2_g(trace_leaf_list(z0, z0, z0, z0, 0, m)), []) in
  let trace_root : List<Int> = root_of_levels(tlevels) in
  let ts1 : List<Int> = hashg(stmt, trace_root) in let z : G2 = ood_of(ts1) in
  let lz : G2 = G2([], []) in let rz : G2 = G2([], []) in let oz : G2 = G2([], []) in let qz : G2 = G2([], []) in
  let ts2 : List<Int> = ts_with_ood(ts1, lz, rz, oz, qz) in let gam : G2 = gamma_of(ts2) in
  let bcw : List<G2> = build_b(z0, z0, z0, z0, coset, lz, rz, oz, qz, z, gam, 0, m) in
  match commit_g(bcw, coset, [], ts2, finv([2])) { (blayers, bfinal) =>
    let base_seed : List<Int> = transcript_seed_g(blayers, ts2) in
    let nz : Int = grind(base_seed) in let ground : List<Int> = hashg(base_seed, glit(nz)) in
    let queries : List<Int> = sample_queries_g(ground, fri_queries(n), fri_dsize(n)) in
    ProofS(trace_root, lz, rz, oz, qz, roots_of(blayers), bfinal, nz, extract_all(blayers, queries), extract_traces(z0, z0, z0, z0, tlevels, queries, fri_dsize(n))) }
# tamper a trace opening (flip the first query's l value): the Merkle leaf no longer
# matches trace_root AND the reconstructed B no longer matches the FRI opening -> REJECT.
# Pins the trace<->FRI index alignment (the synthesis's subtlest-bug guard).
fn tamper_topen(topen: List<TOpen>) : List<TOpen> = match topen { [] => []; [TOpen(lj, rj, oj, qj, pj, ljh, rjh, ojh, qjh, pjh), ...rest] => [TOpen(fadd(lj, [1]), rj, oj, qj, pj, ljh, rjh, ojh, qjh, pjh)] ++ rest }
fn tamper_strace(proof: ProofS) : ProofS = match proof { ProofS(tr, lz, rz, oz, qz, broots, bfinal, nonce, bopen, topen) => ProofS(tr, lz, rz, oz, qz, broots, bfinal, nonce, bopen, tamper_topen(topen)) }

# === TIER-1 PART 3 (WIP): SOUND prover/verifier WITH the copy/permutation argument
# Adds the PLONK grand-product so the committed trace is a CONSISTENT wire assignment
# (one value per wire), closing the inter-row gap. Staged 3-tree commit (commit-before-
# challenge): T1{l,r,o} -> beta,gamma_p -> T2{Z} -> alpha -> T3{Q} -> z(OOD). Q combines
# the gate, recurrence, and boundary constraints with powers of alpha. DEEP-FRI batches
# {l,r,o,Q,Z} (Z bound at z AND omega*z). Verifier checks qz == combined-quotient(z).
# v5.124 Stage 1: the trace opening is BATCHED. Per query we keep only the LEAF VALUES (TLeaf: lro+q+z
# at j and j+half) — the deep-check inputs, unchanged — and the 3 trace Merkle trees (root1-LRO,
# root3-quotient, root2-Z) are opened ONCE each as a batch multiproof: TBatch carries the per-query
# leaves + one shared co-path per tree (replacing the former 6 independent per-query paths). The verifier
# rebuilds each trace root from the opened leaves + its co-path (recon_ok); FRI `bopen` stays per-query.
type TLeaf = | TLeaf(List<Int>, List<Int>, List<Int>, G2, G2, List<Int>, List<Int>, List<Int>, G2, G2)
type TBatch = | TBatch(List<TLeaf>, List<List<Int>>, List<List<Int>>, List<List<Int>>)
type ProofB3 = | ProofB3(List<Int>, List<Int>, List<Int>, G2, G2, G2, G2, G2, G2, List<List<Int>>, List<G2>, Int, BFri, TBatch)
fn comb_lro(l: List<Int>, r: List<Int>, o: List<Int>) : List<Int> = hashg(hashg(l, r), o)
# CUT THE ROPE 3: was O(m²) — wnth(lcw,i)/wnth(rcw,i)/wnth(ocw,i) each an O(i) cons-walk per leaf,
# x m=32n leaves. Now a single lock-step walk of the three codewords (O(m), no indexing).
fn trace_leaf_lro(lcw: List<List<Int>>, rcw: List<List<Int>>, ocw: List<List<Int>>, i: Int, m: Int) : List<List<Int>> =
  match lcw { [] => []; [lh, ...lt] => match rcw { [] => []; [rh, ...rt] => match ocw { [] => []; [oh, ...ot] =>
    [comb_lro(lh, rh, oh)] ++ trace_leaf_lro(lt, rt, ot, i + 1, m) } } }
fn absorb6(ts: List<Int>, a: G2, b: G2, c: G2, d: G2, e: G2, f: G2) : List<Int> = absorb_g2(absorb_g2(absorb_g2(absorb_g2(absorb_g2(absorb_g2(ts, a), b), c), d), e), f)
# absorb the final folded codeword into the transcript BEFORE sampling queries
# (standard BCS/ethSTARK; closes the second FS-PARTIAL gap — the query positions now
# depend on bfinal, so a prover cannot adapt the final codeword after seeing the queries).
fn absorb_final(acc: List<Int>, fin: List<G2>) : List<Int> = match fin { [] => acc; [G2(a0, a1), ...r] => absorb_final(hashg(hashg(acc, a0), a1), r) }
fn recur_at_z(pm: List<List<List<Int>>>, lz: G2, rz: G2, oz: G2, zz: G2, zwz: G2, beta: G2, gamp: G2, z: G2) : G2 =
  let id1z : G2 = poly_eval_g(wnth3(pm, 0), z) in let id2z : G2 = poly_eval_g(wnth3(pm, 1), z) in let id3z : G2 = poly_eval_g(wnth3(pm, 2), z) in
  let s1z : G2 = poly_eval_g(wnth3(pm, 3), z) in let s2z : G2 = poly_eval_g(wnth3(pm, 4), z) in let s3z : G2 = poly_eval_g(wnth3(pm, 5), z) in
  let numz : G2 = gmul2(pf(lz, id1z, beta, gamp), gmul2(pf(rz, id2z, beta, gamp), pf(oz, id3z, beta, gamp))) in
  let denz : G2 = gmul2(pf(lz, s1z, beta, gamp), gmul2(pf(rz, s2z, beta, gamp), pf(oz, s3z, beta, gamp))) in
  gsub2(gmul2(zwz, denz), gmul2(zz, numz))
fn qcombined_z(pc: List<List<List<Int>>>, pm: List<List<List<Int>>>, lz: G2, rz: G2, oz: G2, zz: G2, zwz: G2, beta: G2, gamp: G2, alpha: G2, z: G2, n: Int) : G2 =
  let izh : G2 = ginv2(zh_g(z, n)) in
  let qgate : G2 = gmul2(g_at_z(pc, lz, rz, oz, z), izh) in
  let qrec : G2 = gmul2(recur_at_z(pm, lz, rz, oz, zz, zwz, beta, gamp, z), izh) in
  let qbnd : G2 = gmul2(gsub2(zz, G2([1], [])), ginv2(gsub2(z, G2([1], [])))) in
  gadd2(qgate, gadd2(gmul2(alpha, qrec), gmul2(gmul2(alpha, alpha), qbnd)))
# CUT THE ROPE 3: was O(m^2) (wnth/nth2 per row, incl. zcw at (i+rot)%m) PLUS O(n*m) — six
# poly_eval_b of the perm columns per coset point. Now: LDE the 6 perm cols ONCE (native NTT),
# to_vec every codeword (incl. zcw for both i and (i+rot)%m), and vget O(1) in the row walk.
fn build_q_b3_go(qgv: List<List<Int>>, lv: List<List<Int>>, rv: List<List<Int>>, ov: List<List<Int>>, zv: List<G2>, cv: List<List<Int>>, s0: List<List<Int>>, s1: List<List<Int>>, s2: List<List<Int>>, s3: List<List<Int>>, s4: List<List<Int>>, s5: List<List<Int>>, alpha: G2, beta: G2, gamp: G2, n: Int, rot: Int, m: Int, i: Int) : List<G2> =
  if i >= m then [] else
    let x : List<Int> = vget(cv, i) in let zhx : List<Int> = fsub(fpow_bn(x, glit(n)), [1]) in
    let lx : List<Int> = vget(lv, i) in let rx : List<Int> = vget(rv, i) in let ox : List<Int> = vget(ov, i) in
    let zx : G2 = vget(zv, i) in let zwx : G2 = vget(zv, (i + rot) % m) in
    let numx : G2 = gmul2(pf(emb(lx), emb(vget(s0, i)), beta, gamp), gmul2(pf(emb(rx), emb(vget(s1, i)), beta, gamp), pf(emb(ox), emb(vget(s2, i)), beta, gamp))) in
    let denx : G2 = gmul2(pf(emb(lx), emb(vget(s3, i)), beta, gamp), gmul2(pf(emb(rx), emb(vget(s4, i)), beta, gamp), pf(emb(ox), emb(vget(s5, i)), beta, gamp))) in
    let qrecur : G2 = gscale2(gsub2(gmul2(zwx, denx), gmul2(zx, numx)), finv(zhx)) in
    let qbound : G2 = gmul2(gsub2(zx, G2([1], [])), ginv2(gsub2(emb(x), G2([1], [])))) in
    [gadd2(emb(vget(qgv, i)), gadd2(gmul2(alpha, qrecur), gmul2(gmul2(alpha, alpha), qbound)))] ++ build_q_b3_go(qgv, lv, rv, ov, zv, cv, s0, s1, s2, s3, s4, s5, alpha, beta, gamp, n, rot, m, i + 1)
fn build_q_b3(pc: List<List<List<Int>>>, pm: List<List<List<Int>>>, qgatecw: List<List<Int>>, lcw: List<List<Int>>, rcw: List<List<Int>>, ocw: List<List<Int>>, zcw: List<G2>, coset: List<List<Int>>, alpha: G2, beta: G2, gamp: G2, n: Int, rot: Int, m: Int, i: Int) : List<G2> =
  build_q_b3_go(to_vec(qgatecw), to_vec(lcw), to_vec(rcw), to_vec(ocw), to_vec(zcw), to_vec(coset),
    to_vec(lde(wnth3(pm, 0), n)), to_vec(lde(wnth3(pm, 1), n)), to_vec(lde(wnth3(pm, 2), n)),
    to_vec(lde(wnth3(pm, 3), n)), to_vec(lde(wnth3(pm, 4), n)), to_vec(lde(wnth3(pm, 5), n)),
    alpha, beta, gamp, n, rot, m, 0)
fn deep_batch_b3(lj: List<Int>, rj: List<Int>, oj: List<Int>, qj: G2, zj: G2, xi: List<Int>, lz: G2, rz: G2, oz: G2, qz: G2, zz: G2, zwz: G2, z: G2, wz: G2, gam: G2) : G2 =
  let invz : G2 = ginv2(gsub2(emb(xi), z)) in let invwz : G2 = ginv2(gsub2(emb(xi), wz)) in
  let dq : G2 = gmul2(gsub2(qj, qz), invz) in let dl : G2 = gmul2(gsub2(emb(lj), lz), invz) in let dr : G2 = gmul2(gsub2(emb(rj), rz), invz) in
  let dlo : G2 = gmul2(gsub2(emb(oj), oz), invz) in let dz : G2 = gmul2(gsub2(zj, zz), invz) in let dzw : G2 = gmul2(gsub2(zj, zwz), invwz) in
  let g2 : G2 = gmul2(gam, gam) in let g3 : G2 = gmul2(g2, gam) in let g4 : G2 = gmul2(g3, gam) in let g5 : G2 = gmul2(g4, gam) in
  gadd2(dq, gadd2(gmul2(gam, dl), gadd2(gmul2(g2, dr), gadd2(gmul2(g3, dlo), gadd2(gmul2(g4, dz), gmul2(g5, dzw))))))
# CUT THE ROPE 3: was O(m^2) (wnth/nth2 x6 per row). to_vec the 6 codewords once (O(m)), vget O(1).
fn build_b_b3_go(lv: List<List<Int>>, rv: List<List<Int>>, ov: List<List<Int>>, qv: List<G2>, zv: List<G2>, cv: List<List<Int>>, lz: G2, rz: G2, oz: G2, qz: G2, zz: G2, zwz: G2, z: G2, wz: G2, gam: G2, i: Int, m: Int) : List<G2> =
  if i >= m then [] else [deep_batch_b3(vget(lv, i), vget(rv, i), vget(ov, i), vget(qv, i), vget(zv, i), vget(cv, i), lz, rz, oz, qz, zz, zwz, z, wz, gam)] ++ build_b_b3_go(lv, rv, ov, qv, zv, cv, lz, rz, oz, qz, zz, zwz, z, wz, gam, i + 1, m)
fn build_b_b3(lcw: List<List<Int>>, rcw: List<List<Int>>, ocw: List<List<Int>>, qcw: List<G2>, zcw: List<G2>, coset: List<List<Int>>, lz: G2, rz: G2, oz: G2, qz: G2, zz: G2, zwz: G2, z: G2, wz: G2, gam: G2, i: Int, m: Int) : List<G2> =
  build_b_b3_go(to_vec(lcw), to_vec(rcw), to_vec(ocw), to_vec(qcw), to_vec(zcw), to_vec(coset), lz, rz, oz, qz, zz, zwz, z, wz, gam, 0, m)
fn extract_tl1(lcw: List<List<Int>>, rcw: List<List<Int>>, ocw: List<List<Int>>, qcw: List<G2>, zcw: List<G2>, p: Int, m: Int) : TLeaf =
  let half : Int = m / 2 in let j : Int = p % half in
  TLeaf(wnth(lcw, j), wnth(rcw, j), wnth(ocw, j), nth2(qcw, j), nth2(zcw, j),
        wnth(lcw, j + half), wnth(rcw, j + half), wnth(ocw, j + half), nth2(qcw, j + half), nth2(zcw, j + half))
fn extract_tls(lcw: List<List<Int>>, rcw: List<List<Int>>, ocw: List<List<Int>>, qcw: List<G2>, zcw: List<G2>, queries: List<Int>, m: Int) : List<TLeaf> =
  match queries { [] => []; [p, ...rest] => [extract_tl1(lcw, rcw, ocw, qcw, zcw, p, m)] ++ extract_tls(lcw, rcw, ocw, qcw, zcw, rest, m) }
# build the batched trace opening: per-query leaf values + one shared co-path per trace tree (lev1=LRO/root1,
# lev3=quotient/root3, lev2=Z/root2), over the canonical opened-leaf set {j, j+half}.
fn extract_tbatch(lcw: List<List<Int>>, rcw: List<List<Int>>, ocw: List<List<Int>>, qcw: List<G2>, zcw: List<G2>, lev1: List<List<List<Int>>>, lev2: List<List<List<Int>>>, lev3: List<List<List<Int>>>, queries: List<Int>, m: Int) : TBatch =
  let oidx : List<Int> = oidx_of(queries, m / 2) in
  TBatch(extract_tls(lcw, rcw, ocw, qcw, zcw, queries, m), bcopath(lev1, 0, oidx, []), bcopath(lev3, 0, oidx, []), bcopath(lev2, 0, oidx, []))
fn prove_b3(gates: List<Gate>, w: List<List<Int>>) : ProofB3 =
  let n : Int = ng(gates) in let m : Int = fri_dsize(n) in let coset : List<List<Int>> = fri_coset(n) in let rot : Int = m / n in let omega : List<Int> = root_pow2(ilog2(n)) in
  let stmt : List<Int> = stmt_seed_of(gates) in let pc : List<List<List<Int>>> = public_cols(gates, n) in let pm : List<List<List<Int>>> = perm_cols(gates, n) in
  let cells : List<Pair<Int, Int>> = all_cells(gates, 0, n) in
  let lvals : List<List<Int>> = lpad(c_l(gates, w), n) in let rvals : List<List<Int>> = lpad(c_r(gates, w), n) in let ovals : List<List<Int>> = lpad(c_o(gates, w), n) in
  let ll : List<List<Int>> = icol(c_l(gates, w), n) in let rr : List<List<Int>> = icol(c_r(gates, w), n) in let oo : List<List<Int>> = icol(c_o(gates, w), n) in
  let lcw : List<List<Int>> = lde(ll, n) in let rcw : List<List<Int>> = lde(rr, n) in let ocw : List<List<Int>> = lde(oo, n) in
  let qgatecw : List<List<Int>> = q_cw(gates, w) in
  let lev1 : List<List<List<Int>>> = build_levels_g(pad_pow2_g(trace_leaf_lro(lcw, rcw, ocw, 0, m)), []) in let root1 : List<Int> = root_of_levels(lev1) in
  let ts1 : List<Int> = hashg(stmt, root1) in let beta : G2 = beta_p_of(ts1) in let gamp : G2 = gam_p_of(ts1) in
  let zvals : List<G2> = z_build(lvals, rvals, ovals, cells, beta, gamp, G2([1], []), 0, n) in
  let zr : List<List<Int>> = interp_n(reals(zvals), n) in let zi : List<List<Int>> = interp_n(imags(zvals), n) in
  let zcw : List<G2> = eval_g2_on_dom(zr, zi, coset) in
  let lev2 : List<List<List<Int>>> = merkle_levels_g(zcw) in let root2 : List<Int> = root_of_levels(lev2) in
  let ts2 : List<Int> = hashg(ts1, root2) in let alpha : G2 = alpha_of(ts2) in
  let qcw : List<G2> = build_q_b3(pc, pm, qgatecw, lcw, rcw, ocw, zcw, coset, alpha, beta, gamp, n, rot, m, 0) in
  let lev3 : List<List<List<Int>>> = merkle_levels_g(qcw) in let root3 : List<Int> = root_of_levels(lev3) in
  let ts3 : List<Int> = hashg(ts2, root3) in let z : G2 = ood_of(ts3) in let wz : G2 = gmul2(z, emb(omega)) in
  let lz : G2 = poly_eval_g(ll, z) in let rz : G2 = poly_eval_g(rr, z) in let oz : G2 = poly_eval_g(oo, z) in
  let zz : G2 = poly_eval_g2(zr, zi, z) in let zwz : G2 = poly_eval_g2(zr, zi, wz) in
  let qz : G2 = qcombined_z(pc, pm, lz, rz, oz, zz, zwz, beta, gamp, alpha, z, n) in
  let ts4 : List<Int> = absorb6(ts3, lz, rz, oz, qz, zz, zwz) in let gamd : G2 = gamma_of(ts4) in
  let bcw : List<G2> = build_b_b3(lcw, rcw, ocw, qcw, zcw, coset, lz, rz, oz, qz, zz, zwz, z, wz, gamd, 0, m) in
  match commit_g(bcw, coset, [], ts4, finv([2])) { (blayers, bfinal) =>
    let base_seed : List<Int> = absorb_final(transcript_seed_g(blayers, ts4), bfinal) in let nz : Int = grind(base_seed) in let ground : List<Int> = hashg(base_seed, glit(nz)) in
    let queries : List<Int> = sample_queries_g(ground, fri_queries(n), fri_dsize(n)) in
    ProofB3(root1, root2, root3, lz, rz, oz, qz, zz, zwz, roots_of(blayers), bfinal, nz, extract_bfri(blayers, queries), extract_tbatch(lcw, rcw, ocw, qcw, zcw, lev1, lev2, lev3, queries, m)) }
fn tllen(xs: List<TLeaf>) : Int = match xs { [] => 0; [x, ...r] => 1 + tllen(r) }
fn mapput(m: List<Pair<Int, List<Int>>>, k: Int, v: List<Int>) : List<Pair<Int, List<Int>>> = if khasL(m, k) then m else m ++ [Pair(k, v)]
# build the index->leafhash map for trace tree `which` (1=LRO/root1, 3=quotient/root3, 2=Z/root2) from the
# per-query leaf values: each query contributes its leaves at j and j+half. mapput dedups by index (a
# position opened by two queries carries the same codeword value; a mismatch is caught by the deep-tie below).
fn tmap_go(tleaves: List<TLeaf>, queries: List<Int>, half: Int, which: Int, acc: List<Pair<Int, List<Int>>>) : List<Pair<Int, List<Int>>> =
  match tleaves { [] => acc; [TLeaf(lj, rj, oj, qj, zj, ljh, rjh, ojh, qjh, zjh), ...tr] => match queries { [] => acc; [p, ...qr] =>
    let j : Int = p % half in
    let hj : List<Int> = if which == 1 then comb_lro(lj, rj, oj) else if which == 3 then lhash(qj) else lhash(zj) in
    let hjh : List<Int> = if which == 1 then comb_lro(ljh, rjh, ojh) else if which == 3 then lhash(qjh) else lhash(zjh) in
    tmap_go(tr, qr, half, which, mapput(mapput(acc, j, hj), j + half, hjh)) } }
# reconstruct + check all 3 trace roots from the batched opened leaves + their co-paths
fn vb3_trace(tleaves: List<TLeaf>, queries: List<Int>, cp1: List<List<Int>>, cp3: List<List<Int>>, cp2: List<List<Int>>, m: Int, root1: List<Int>, root2: List<Int>, root3: List<Int>) : Bool =
  let half : Int = m / 2 in let h : Int = ilog2(m) in
  recon_ok(tmap_go(tleaves, queries, half, 1, []), cp1, h, root1)
  && recon_ok(tmap_go(tleaves, queries, half, 3, []), cp3, h, root3)
  && recon_ok(tmap_go(tleaves, queries, half, 2, []), cp2, h, root2)
# per-query DEEP checks (the trace Merkle binding is now done in bulk by vb3_trace; here we only tie the
# opened trace leaves to the FRI layer-0 value and run the per-query FRI fold vq).
fn vb3_q1(qv: List<QVal>, toq: TLeaf, betas: List<G2>, doms: List<List<List<Int>>>, bfinal: List<G2>, coset: List<List<Int>>, lz: G2, rz: G2, oz: G2, qz: G2, zz: G2, zwz: G2, z: G2, wz: G2, gamd: G2, m: Int, p: Int, lyrs: Int, finv2: List<Int>) : Bool =
  let half : Int = m / 2 in let j : Int = p % half in
  match toq { TLeaf(lj, rj, oj, qj, zj, ljh, rjh, ojh, qjh, zjh) =>
    let bj : G2 = deep_batch_b3(lj, rj, oj, qj, zj, wnth(coset, j), lz, rz, oz, qz, zz, zwz, z, wz, gamd) in
    let bjh : G2 = deep_batch_b3(ljh, rjh, ojh, qjh, zjh, wnth(coset, j + half), lz, rz, oz, qz, zz, zwz, z, wz, gamd) in
    let recon : Bool = match qv { [] => false; [QVal(blx, blmx), ...rest] => geq2(bj, blx) && geq2(bjh, blmx) } in
    recon && (qval1len(qv) == lyrs) && vq_b3(qv, betas, doms, bfinal, p, finv2) }
fn vb3_qs(qvals: List<List<QVal>>, tleaves: List<TLeaf>, betas: List<G2>, doms: List<List<List<Int>>>, bfinal: List<G2>, coset: List<List<Int>>, lz: G2, rz: G2, oz: G2, qz: G2, zz: G2, zwz: G2, z: G2, wz: G2, gamd: G2, m: Int, queries: List<Int>, lyrs: Int, finv2: List<Int>) : Bool =
  match qvals { [] => match queries { [] => match tleaves { [] => true; _ => false }; _ => false };
    [qv, ...brest] => match tleaves { [] => false; [toq, ...trest] => match queries { [] => false; [p, ...qrest] =>
      if vb3_q1(qv, toq, betas, doms, bfinal, coset, lz, rz, oz, qz, zz, zwz, z, wz, gamd, m, p, lyrs, finv2)
      then vb3_qs(brest, trest, betas, doms, bfinal, coset, lz, rz, oz, qz, zz, zwz, z, wz, gamd, m, qrest, lyrs, finv2) else false } } }
fn verify_b3(gates: List<Gate>, proof: ProofB3) : Bool =
  match proof { ProofB3(root1, root2, root3, lz, rz, oz, qz, zz, zwz, broots, bfinal, nonce, bopen, topen) =>
   match topen { TBatch(tleaves, cp1, cp3, cp2) =>
   match bopen { BFri(qvals, lcopaths) =>
    let n : Int = ng(gates) in let m : Int = fri_dsize(n) in let coset : List<List<Int>> = fri_coset(n) in let lyrs : Int = fri_layers(n) in let omega : List<Int> = root_pow2(ilog2(n)) in
    let stmt : List<Int> = stmt_seed_of(gates) in let pc : List<List<List<Int>>> = public_cols(gates, n) in let pm : List<List<List<Int>>> = perm_cols(gates, n) in
    let ts1 : List<Int> = hashg(stmt, root1) in let beta : G2 = beta_p_of(ts1) in let gamp : G2 = gam_p_of(ts1) in
    let ts2 : List<Int> = hashg(ts1, root2) in let alpha : G2 = alpha_of(ts2) in
    let ts3 : List<Int> = hashg(ts2, root3) in let z : G2 = ood_of(ts3) in let wz : G2 = gmul2(z, emb(omega)) in
    let ts4 : List<Int> = absorb6(ts3, lz, rz, oz, qz, zz, zwz) in let gamd : G2 = gamma_of(ts4) in
    let betas : List<G2> = rederive_betas(broots, ts4) in let base_seed : List<Int> = absorb_final(seed_from_roots(broots, ts4), bfinal) in
    let ground : List<Int> = hashg(base_seed, glit(nonce)) in let doms : List<List<List<Int>>> = build_doms(coset, lyrs) in
    let queries : List<Int> = sample_queries_g(ground, fri_queries(n), fri_dsize(n)) in
    let id_ok : Bool = geq2(qz, qcombined_z(pc, pm, lz, rz, oz, zz, zwz, beta, gamp, alpha, z, n)) in
    let struct_ok : Bool = (llen(broots) == lyrs) && (len(bfinal) == fri_final(0)) && (qvlen(qvals) == fri_queries(n)) && (tllen(tleaves) == fri_queries(n)) && pow_ok(ground) && is_const2(bfinal) in
    id_ok && struct_ok && vb3_trace(tleaves, queries, cp1, cp3, cp2, m, root1, root2, root3)
      && vfri_recon(qvals, queries, lcopaths, broots, doms, 0, lyrs)
      && vb3_qs(qvals, tleaves, betas, doms, bfinal, coset, lz, rz, oz, qz, zz, zwz, z, wz, gamd, m, queries, lyrs, finv([2])) } } }
# prove_b3 from RAW column values (not a single witness w) — lets us build a
# wiring-INCONSISTENT-but-per-row-valid trace to demonstrate the B3 gap is closed.
fn q_cw_cols(pc: List<List<List<Int>>>, ll: List<List<Int>>, rr: List<List<Int>>, oo: List<List<Int>>, coset: List<List<Int>>, n: Int) : List<List<Int>> =
  quotient_cw(wnth3(pc, 0), wnth3(pc, 1), wnth3(pc, 2), wnth3(pc, 3), wnth3(pc, 4), ll, rr, oo, wnth3(pc, 5), coset, n)
fn low_degree_quotient_cols(gates: List<Gate>, lvals: List<List<Int>>, rvals: List<List<Int>>, ovals: List<List<Int>>) : Bool =
  let n : Int = ng(gates) in let coset : List<List<Int>> = fri_coset(n) in let pc : List<List<List<Int>>> = public_cols(gates, n) in
  is_constb(fold_all_b(q_cw_cols(pc, interp_n(lvals, n), interp_n(rvals, n), interp_n(ovals, n), coset, n), coset, finv([2]), 0))
fn prove_b3_cols(gates: List<Gate>, lvals: List<List<Int>>, rvals: List<List<Int>>, ovals: List<List<Int>>) : ProofB3 =
  let n : Int = ng(gates) in let m : Int = fri_dsize(n) in let coset : List<List<Int>> = fri_coset(n) in let rot : Int = m / n in let omega : List<Int> = root_pow2(ilog2(n)) in
  let stmt : List<Int> = stmt_seed_of(gates) in let pc : List<List<List<Int>>> = public_cols(gates, n) in let pm : List<List<List<Int>>> = perm_cols(gates, n) in
  let cells : List<Pair<Int, Int>> = all_cells(gates, 0, n) in
  let ll : List<List<Int>> = interp_n(lvals, n) in let rr : List<List<Int>> = interp_n(rvals, n) in let oo : List<List<Int>> = interp_n(ovals, n) in
  let lcw : List<List<Int>> = lde(ll, n) in let rcw : List<List<Int>> = lde(rr, n) in let ocw : List<List<Int>> = lde(oo, n) in
  let qgatecw : List<List<Int>> = q_cw_cols(pc, ll, rr, oo, coset, n) in
  let lev1 : List<List<List<Int>>> = build_levels_g(pad_pow2_g(trace_leaf_lro(lcw, rcw, ocw, 0, m)), []) in let root1 : List<Int> = root_of_levels(lev1) in
  let ts1 : List<Int> = hashg(stmt, root1) in let beta : G2 = beta_p_of(ts1) in let gamp : G2 = gam_p_of(ts1) in
  let zvals : List<G2> = z_build(lvals, rvals, ovals, cells, beta, gamp, G2([1], []), 0, n) in
  let zr : List<List<Int>> = interp_n(reals(zvals), n) in let zi : List<List<Int>> = interp_n(imags(zvals), n) in
  let zcw : List<G2> = eval_g2_on_dom(zr, zi, coset) in
  let lev2 : List<List<List<Int>>> = merkle_levels_g(zcw) in let root2 : List<Int> = root_of_levels(lev2) in
  let ts2 : List<Int> = hashg(ts1, root2) in let alpha : G2 = alpha_of(ts2) in
  let qcw : List<G2> = build_q_b3(pc, pm, qgatecw, lcw, rcw, ocw, zcw, coset, alpha, beta, gamp, n, rot, m, 0) in
  let lev3 : List<List<List<Int>>> = merkle_levels_g(qcw) in let root3 : List<Int> = root_of_levels(lev3) in
  let ts3 : List<Int> = hashg(ts2, root3) in let z : G2 = ood_of(ts3) in let wz : G2 = gmul2(z, emb(omega)) in
  let lz : G2 = poly_eval_g(ll, z) in let rz : G2 = poly_eval_g(rr, z) in let oz : G2 = poly_eval_g(oo, z) in
  let zz : G2 = poly_eval_g2(zr, zi, z) in let zwz : G2 = poly_eval_g2(zr, zi, wz) in
  let qz : G2 = qcombined_z(pc, pm, lz, rz, oz, zz, zwz, beta, gamp, alpha, z, n) in
  let ts4 : List<Int> = absorb6(ts3, lz, rz, oz, qz, zz, zwz) in let gamd : G2 = gamma_of(ts4) in
  let bcw : List<G2> = build_b_b3(lcw, rcw, ocw, qcw, zcw, coset, lz, rz, oz, qz, zz, zwz, z, wz, gamd, 0, m) in
  match commit_g(bcw, coset, [], ts4, finv([2])) { (blayers, bfinal) =>
    let base_seed : List<Int> = absorb_final(transcript_seed_g(blayers, ts4), bfinal) in let nz : Int = grind(base_seed) in let ground : List<Int> = hashg(base_seed, glit(nz)) in
    let queries : List<Int> = sample_queries_g(ground, fri_queries(n), fri_dsize(n)) in
    ProofB3(root1, root2, root3, lz, rz, oz, qz, zz, zwz, roots_of(blayers), bfinal, nz, extract_bfri(blayers, queries), extract_tbatch(lcw, rcw, ocw, qcw, zcw, lev1, lev2, lev3, queries, m)) }

# --- bridge: parse, inline calls, lower the arithmetic subset to gates -------
fn fn_body_of(fns: List<FnDecl>, name: String) : Expr = match fns { [] => error("glass prove: internal — body of resolved function '" ++ name ++ "' not found"); [FnDecl(fnm, tps, ty, body), ...rest] => if fnm == name then body else fn_body_of(rest, name) }
fn unwind_app(e: Expr, acc: List<Expr>) : (Expr, List<Expr>) = match e { EApp(f, a) => unwind_app(f, [a] ++ acc); _ => (e, acc) }
# A COMPUTED higher-order callee — the head of an application is not a bare function name but an
# expression that SELECTS a function at runtime: (if c then g else h)(x), (let f = g in f)(x), or a
# match choosing a function. The cut: PUSH THE APPLICATION INSIDE the selector — applying a
# conditionally-chosen function equals conditionally applying each candidate. (if c then g else h)(x)
# becomes if c then g(x) else h(x); each leaf is then a NAMED-fn call the bridge already lowers, and
# the branch results mux through the same `muxw` an ordinary `if` uses (so equal-width results only;
# unequal-width string branches ABSTAIN, as everywhere). Semantics-preserving because Glass is pure
# (no effect is duplicated or reordered). One shared rewrite, called from BOTH unroll (feeds heval +
# cgen) AND seval (the raw-AST guard), so the guard and the circuit can never disagree on it.
fn push_app_arms(arms: List<Pair<Pattern, Expr>>, args: List<Expr>) : List<Pair<Pattern, Expr>> =
  match arms { [] => []; [Pair(p, body), ...r] => [Pair(p, app_of(body, args))] ++ push_app_arms(r, args) }
fn push_app(hd: Expr, args: List<Expr>) : Expr = match hd {
  EIf(c, t, f) => EIf(c, app_of(t, args), app_of(f, args));
  ELet(nm, v, body) => ELet(nm, v, app_of(body, args));
  EMatch(scrut, arms) => EMatch(scrut, push_app_arms(arms, args));
  _ => error("glass prove: a computed callee must be an `if`/`let`/`match` selecting among functions — this application form cannot be lowered to a gate circuit (refused, never a silent proven-0)") }
fn fn_exists(fns: List<FnDecl>, name: String) : Bool = match fns { [] => false; [FnDecl(fnm, tps, ty, body), ...rest] => if fnm == name then true else fn_exists(rest, name) }
fn fenv_get(fenv: List<Pair<String, String>>, name: String) : String = match fenv { [] => ""; [Pair(k, v), ...r] => if k == name then v else fenv_get(r, name) }
# --- record field access `r.field` (EField), v5.104 -------------------------------------------
# A record value is a positional multi-wire value (no field names at runtime), so `r.field` needs
# a *type-env* (var -> record-type-name) to find the field's offset at LOWERING time. Rather than
# thread a new param everywhere, we REUSE the already-threaded `fenv` (param -> fn-name): a record
# var binds as `name -> "@rec:Type"`. resolve_fn IGNORES "@rec:" entries (a record var is never a
# call callee), so the two namespaces coexist. `unroll` then desugars `e.f` -> `match e { T { f }
# => f }` (reusing the v5.103 PRecord machinery) when e's record type T is known; if unknown it
# leaves EField, which heval/cgen ABSTAIN on. `seval` (the guard) treats EField permissively (its
# value is discarded) — it just guards the sub-expression. So the desugar is the SINGLE lowering.
fn is_rec_tag(s: String) : Bool = if string_length(s) >= 5 then substring(s, 0, 5) == "@rec:" else false
fn rec_tag_type(s: String) : String = substring(s, 5, string_length(s))
fn addrec(nm: String, rt: String, fenv: List<Pair<String, String>>) : List<Pair<String, String>> = if rt == "" then fenv else [Pair(nm, "@rec:" ++ rt)] ++ fenv
fn rtype_of(e: Expr, fenv: List<Pair<String, String>>) : String =
  match e {
    ENamedRec(n, l) => n;
    EVar(x) => let b : String = fenv_get(fenv, x) in if is_rec_tag(b) then rec_tag_type(b) else "";
    EIf(c, t, f) => let rt : String = rtype_of(t, fenv) in if rt == rtype_of(f, fenv) then rt else "";
    ELet(x, v, bd) => rtype_of(bd, addrec(x, rtype_of(v, fenv), fenv));
    _ => "" }
fn resolve_fn(name: String, fns: List<FnDecl>, fenv: List<Pair<String, String>>) : String =
  let bound : String = fenv_get(fenv, name) in if (bound == "") || is_rec_tag(bound) then (if fn_exists(fns, name) then name else "") else bound
fn is_fn_arg(a: Expr, fns: List<FnDecl>, fenv: List<Pair<String, String>>) : Bool = match a { EVar(n) => resolve_fn(n, fns, fenv) != ""; _ => false }
fn arg_fn_name(a: Expr, fns: List<FnDecl>, fenv: List<Pair<String, String>>) : String = match a { EVar(n) => resolve_fn(n, fns, fenv); _ => "" }
# A computed callee bound by a LET to a RUNTIME SELECTOR over functions: `let f = (if c then g else
# h) in body`, f then called in body. The v5.114 alias handles `let f = g` (a bare fn name); this
# handles the SELECTOR case — the DUAL of push_app (v5.113): DISTRIBUTE THE LET OVER THE SELECTOR.
# `let f = (if c then g else h) in body` == `if c then (let f=g in body) else (let f=h in body)`;
# each branch is then a bare-name alias the v5.114 path resolves. Sound because Glass is pure (body
# is evaluated once, in the taken branch). is_fn_sel recognises a selector whose leaves are ALL fn
# names (so an Int-valued `if` is NOT distributed); shared by unroll + seval, so guard and circuit agree.
fn arms_fn_sel(arms: List<Pair<Pattern, Expr>>, fns: List<FnDecl>, fenv: List<Pair<String, String>>) : Bool =
  match arms { [] => true; [Pair(p, b), ...r] => is_fn_sel(b, fns, fenv) && arms_fn_sel(r, fns, fenv) }
fn is_fn_sel(e: Expr, fns: List<FnDecl>, fenv: List<Pair<String, String>>) : Bool = match e {
  EVar(n) => resolve_fn(n, fns, fenv) != "";
  EIf(c, t, f) => is_fn_sel(t, fns, fenv) && is_fn_sel(f, fns, fenv);
  EMatch(s, arms) => arms_fn_sel(arms, fns, fenv);
  _ => false }
fn distrib_let_arms(nm: String, arms: List<Pair<Pattern, Expr>>, body: Expr) : List<Pair<Pattern, Expr>> =
  match arms { [] => []; [Pair(p, b), ...r] => [Pair(p, ELet(nm, b, body))] ++ distrib_let_arms(nm, r, body) }
fn distrib_let(nm: String, v: Expr, body: Expr) : Expr = match v {
  EIf(c, t, f) => EIf(c, ELet(nm, t, body), ELet(nm, f, body));
  EMatch(s, arms) => EMatch(s, distrib_let_arms(nm, arms, body));
  _ => ELet(nm, v, body) }
fn unroll_args(es: List<Expr>, fns: List<FnDecl>, fenv: List<Pair<String, String>>, fuel: Int) : List<Expr> =
  match es { [] => []; [e, ...r] => [unroll(e, fns, fenv, fuel)] ++ unroll_args(r, fns, fenv, fuel) }
fn unroll_recfields(lit: List<Pair<String, Expr>>, fns: List<FnDecl>, fenv: List<Pair<String, String>>, fuel: Int) : List<Pair<String, Expr>> =
  match lit { [] => []; [Pair(k, v), ...r] => [Pair(k, unroll(v, fns, fenv, fuel))] ++ unroll_recfields(r, fns, fenv, fuel) }
fn unroll_arms(arms: List<Pair<Pattern, Expr>>, fns: List<FnDecl>, fenv: List<Pair<String, String>>, fuel: Int) : List<Pair<Pattern, Expr>> =
  match arms { [] => []; [Pair(p, b), ...r] => [Pair(p, unroll(b, fns, fenv, fuel))] ++ unroll_arms(r, fns, fenv, fuel) }
# Capture-avoiding call inlining (v5.132). The old shape bound each argument DIRECTLY to its
# parameter as a sequential ELet nest — ELet(p1, arg1, ELet(p2, arg2, body)) — so an argument
# expression referencing an EARLIER parameter's NAME was captured by the just-bound parameter
# instead of the caller's variable: in gcd's `gcd(b, a % b)` the `a` inside `a % b` resolved to
# the new a (= caller's b), computing b % b = 0 — the circuit attested gcd(48,18) = 18 while the
# source computes 6 (STARK-valid wrong lowering, flagged by the Third Witness as DIVERGENCE; the
# same capture existed in the fn-NAMESPACE: a later arg calling a name an earlier fn-param shadows
# resolved through the extended fenv). The fix is two-phase: (1) every value argument is unrolled
# against the CALLER's fenv and bound to a reserved temp `q9p_<param>` (user code never binds q9p_*;
# nested inlines shadow their own temps harmlessly), then (2) all parameters are aliased to their
# temps: ELet(q9p_p1, arg1, ELet(q9p_p2, arg2, ELet(p1, q9p_p1, ELet(p2, q9p_p2, body)))). fn-args
# and record types (addrec) also resolve against the caller fenv (cfenv) while the BODY fenv (bfenv)
# accumulates the param bindings. An ELet binds wires, not gates, so capture-free programs lower to
# the IDENTICAL gate stream — proofs are byte-identical (checked against the committed corpus).
fn tmpn(p: String) : String = "q9p_" ++ p
fn inline_params(ps: List<String>, e: Expr) : Expr =
  match ps { [] => e; [p, ...r] => ELet(p, EVar(tmpn(p)), inline_params(r, e)) }
fn inline_fn(body: Expr, args: List<Expr>, fns: List<FnDecl>, fenv: List<Pair<String, String>>, fuel: Int) : Expr =
  inline_go(body, args, fns, fenv, fenv, fuel, [])
fn inline_go(body: Expr, args: List<Expr>, fns: List<FnDecl>, cfenv: List<Pair<String, String>>, bfenv: List<Pair<String, String>>, fuel: Int, ps: List<String>) : Expr =
  match body {
    ELam(p, inner) => match args {
      [] => inline_params(ps, unroll(inner, fns, bfenv, fuel - 1));
      [a, ...rest] => if is_fn_arg(a, fns, cfenv)
        then inline_go(inner, rest, fns, cfenv, [Pair(p, arg_fn_name(a, fns, cfenv))] ++ bfenv, fuel, ps)
        else (let ua : Expr = unroll(a, fns, cfenv, fuel) in ELet(tmpn(p), ua, inline_go(inner, rest, fns, cfenv, addrec(p, rtype_of(ua, cfenv), bfenv), fuel, ps ++ [p]))) };
    _ => inline_params(ps, unroll(body, fns, bfenv, fuel - 1)) }
# Signed comparison intrinsics. slt/sle/sgt/sge(a,b) compare a,b as SIGNED integers in
# [-2^31, 2^31). They DESUGAR to the existing unsigned ordering gadget with a +2^31 offset:
# the monotonic shift maps the signed range into [0,2^32) (a negative a = p-|a| becomes
# p-|a|+2^31 = 2^31-|a| in-field), where the existing lt_build range-proof BOTH gives the
# correct signed order AND enforces signedness (an out-of-signed-range operand lands >= 2^32
# and range_k fails -> ABSTAIN). One SHARED desugar, called from unroll (feeds heval+cgen) AND
# seval — so the guard and the circuit can never disagree on the lowering. No gate/verifier
# change: pure reuse of ELt/ELe/EGt/EGe (slt/sle/sgt/sge are reserved intrinsic names).
fn is_scmp(fname: String) : Bool =
  if fname == "slt" then true else if fname == "sle" then true else if fname == "sgt" then true else if fname == "sge" then true else false
fn scmp_desugar(fname: String, a: Expr, b: Expr) : Expr =
  let ao : Expr = EAdd(a, EInt(2147483648)) in
  let bo : Expr = EAdd(b, EInt(2147483648)) in
  if fname == "slt" then ELt(ao, bo)
  else if fname == "sgt" then EGt(ao, bo)
  else if fname == "sle" then ELe(ao, bo)
  else EGe(ao, bo)
# Signed division/modulo intrinsics. sdiv/smod(a,b) are C99 truncated division over SIGNED
# integers in [-2^31, 2^31): q rounds toward zero, r has the sign of the dividend, a = b*q + r,
# |r| < |b|. The +2^31 offset trick that makes signed COMPARISON free does NOT compose for
# division ((a+K)/(b+K) != a/b), so signed divmod is built by SIGN-MAGNITUDE — but NOT via a
# bespoke sign-bit gadget (extracting a sign bit from a field-canonical negative is unsound: an
# adversarial design failed exactly there). The sound cut: express sdiv/smod's BODY in terms of
# already-lowered, already-sound primitives and let the bridge lower it. The sign is the PROVEN
# canonical sign `slt(x, 0)` (reuses the v5.94 offset-binding, which range-pins x into
# [-2^31,2^31) and is uncheatable); magnitude and post-negation are `if`/`then`/`else` (the EIf
# mux); the core is the shipped UNSIGNED divmod_build on magnitudes (both proven in [0,2^31], so
# products stay < p). No sign-bit extraction, no new gate, no verify_b3/Pentecost change. A
# negative result is the canonical field element p-|r| (the Third Witness reports the signed value
# via --cross-check). Out-of-range operands ABSTAIN (the slt range-pin refuses them, loud); b==0
# ABSTAINs (div_ok_g). ONE shared desugar in unroll (feeds heval+cgen) AND seval — no guard/circuit
# drift. sdiv/smod are reserved intrinsic names.
fn sgn_e(e: Expr) : Expr = ELt(EAdd(e, EInt(2147483648)), EInt(2147483648))
fn neg_e(e: Expr) : Expr = ESub(EInt(0), e)
fn is_sdiv(fname: String) : Bool = if fname == "sdiv" then true else if fname == "smod" then true else false
fn sdiv_desugar(fname: String, a: Expr, b: Expr) : Expr =
  ELet("q9a", a, ELet("q9b", b,
  ELet("q9sa", sgn_e(EVar("q9a")), ELet("q9sb", sgn_e(EVar("q9b")),
  ELet("q9ma", EIf(EVar("q9sa"), neg_e(EVar("q9a")), EVar("q9a")),
  ELet("q9mb", EIf(EVar("q9sb"), neg_e(EVar("q9b")), EVar("q9b")),
  ELet("q9qm", EDiv(EVar("q9ma"), EVar("q9mb")),
  ELet("q9rm", EMod(EVar("q9ma"), EVar("q9mb")),
  if fname == "sdiv"
    then EIf(ENeq(EVar("q9sa"), EVar("q9sb")), neg_e(EVar("q9qm")), EVar("q9qm"))
    else EIf(EVar("q9sa"), neg_e(EVar("q9rm")), EVar("q9rm"))))))))))
# Signed utility intrinsics over [-2^31, 2^31): sabs(x)=|x| (1 arg), smin(a,b)/smax(a,b) (2 args).
# Same compositional cut as sdiv — express the body with the already-lowered signed comparison
# (`slt` via scmp_desugar) + `if`/`then`/`else`, and let the bridge lower it. No new gadget, no
# verifier change. sabs/smin/smax are reserved names. (sabs(-2^31)=2^31 is the mathematically
# correct magnitude — a positive value just outside the symmetric range, fine as a field result.)
fn is_sabs(fname: String) : Bool = if fname == "sabs" then true else false
fn is_sutil2(fname: String) : Bool = if fname == "smin" then true else if fname == "smax" then true else false
fn sabs_desugar(x: Expr) : Expr =
  ELet("q9z", x, EIf(scmp_desugar("slt", EVar("q9z"), EInt(0)), neg_e(EVar("q9z")), EVar("q9z")))
fn sutil2_desugar(fname: String, a: Expr, b: Expr) : Expr =
  ELet("q9u", a, ELet("q9v", b,
  if fname == "smin"
    then EIf(scmp_desugar("slt", EVar("q9u"), EVar("q9v")), EVar("q9u"), EVar("q9v"))
    else EIf(scmp_desugar("slt", EVar("q9u"), EVar("q9v")), EVar("q9v"), EVar("q9u"))))
fn unroll(e: Expr, fns: List<FnDecl>, fenv: List<Pair<String, String>>, fuel: Int) : Expr =
  match e {
    # fuel <= 0 => EInt(0) is the TERMINATOR of bounded symbolic unrolling, NOT an error:
    # the unroller can't stop a recursion at its (runtime) base case, so it unrolls to the
    # fuel bound and caps with 0. For runtime depth <= fuel the cap is never selected (the
    # `if`s short-circuit on the witness first) and the result is exact; deeper recursion is
    # silently truncated — a known circuit-model limitation (see soundness.md), not fixable
    # here without breaking every recursive program. The genuine-error fallbacks below DO
    # refuse loudly (unresolved / higher-order callee — programs the bridge cannot lower).
    EApp(f, a) => if fuel <= 0 then EInt(0) else match unwind_app(EApp(f, a), []) { (hd, args) => match hd {
      EVar(fname) => if is_scmp(fname) then (match args { [sa, sb] => unroll(scmp_desugar(fname, sa, sb), fns, fenv, fuel); _ => error("glass prove: signed comparison '" ++ fname ++ "' expects exactly 2 arguments") }) else if is_sdiv(fname) then (match args { [da, db] => unroll(sdiv_desugar(fname, da, db), fns, fenv, fuel); _ => error("glass prove: signed division '" ++ fname ++ "' expects exactly 2 arguments") }) else if is_sabs(fname) then (match args { [za] => unroll(sabs_desugar(za), fns, fenv, fuel); _ => error("glass prove: 'sabs' expects exactly 1 argument") }) else if is_sutil2(fname) then (match args { [ua, ub] => unroll(sutil2_desugar(fname, ua, ub), fns, fenv, fuel); _ => error("glass prove: signed '" ++ fname ++ "' expects exactly 2 arguments") }) else if is_strfn(fname) then app_of(EVar(fname), unroll_args(args, fns, fenv, fuel)) else if is_bitop(fname) then app_of(EVar(fname), unroll_args(args, fns, fenv, fuel)) else (let tgt : String = resolve_fn(fname, fns, fenv) in if tgt == "" then error("glass prove: unresolved call to '" ++ fname ++ "' — the prove bridge cannot lower this construct to a gate circuit (a silent proven-0 is refused)") else inline_fn(fn_body_of(fns, tgt), args, fns, fenv, fuel));
      _ => unroll(push_app(hd, args), fns, fenv, fuel) } };
    EAdd(x, y) => EAdd(unroll(x, fns, fenv, fuel), unroll(y, fns, fenv, fuel));
    ESub(x, y) => ESub(unroll(x, fns, fenv, fuel), unroll(y, fns, fenv, fuel));
    EMul(x, y) => EMul(unroll(x, fns, fenv, fuel), unroll(y, fns, fenv, fuel));
    EEq(x, y) => EEq(unroll(x, fns, fenv, fuel), unroll(y, fns, fenv, fuel));
    ENeq(x, y) => ENeq(unroll(x, fns, fenv, fuel), unroll(y, fns, fenv, fuel));
    EAnd(x, y) => EAnd(unroll(x, fns, fenv, fuel), unroll(y, fns, fenv, fuel));
    EOr(x, y) => EOr(unroll(x, fns, fenv, fuel), unroll(y, fns, fenv, fuel));
    EUNot(a) => EUNot(unroll(a, fns, fenv, fuel));
    EIf(c, t, f) => EIf(unroll(c, fns, fenv, fuel), unroll(t, fns, fenv, fuel), unroll(f, fns, fenv, fuel));
    ELet(nm, v, body) => if is_fn_arg(v, fns, fenv) then unroll(body, fns, [Pair(nm, arg_fn_name(v, fns, fenv))] ++ fenv, fuel) else if is_fn_sel(v, fns, fenv) then unroll(distrib_let(nm, v, body), fns, fenv, fuel) else (let uv : Expr = unroll(v, fns, fenv, fuel) in ELet(nm, uv, unroll(body, fns, addrec(nm, rtype_of(uv, fenv), fenv), fuel)));
    EMatch(scrut, arms) => EMatch(unroll(scrut, fns, fenv, fuel), unroll_arms(arms, fns, fenv, fuel));
    ECtor(name, args) => ECtor(name, unroll_args(args, fns, fenv, fuel));
    ETuple(elems) => ETuple(unroll_args(elems, fns, fenv, fuel));
    ENamedRec(name, lit) => ENamedRec(name, unroll_recfields(lit, fns, fenv, fuel));   # v5.103: records
    ERec(lit) => ERec(unroll_recfields(lit, fns, fenv, fuel));
    EField(e, f) => let rt : String = rtype_of(e, fenv) in (if rt == "" then EField(unroll(e, fns, fenv, fuel), f) else EMatch(unroll(e, fns, fenv, fuel), [Pair(PRecord(rt, [f]), EVar(f))]));
    ELt(x, y) => ELt(unroll(x, fns, fenv, fuel), unroll(y, fns, fenv, fuel));
    EGt(x, y) => EGt(unroll(x, fns, fenv, fuel), unroll(y, fns, fenv, fuel));
    ELe(x, y) => ELe(unroll(x, fns, fenv, fuel), unroll(y, fns, fenv, fuel));
    EGe(x, y) => EGe(unroll(x, fns, fenv, fuel), unroll(y, fns, fenv, fuel));
    EDiv(x, y) => EDiv(unroll(x, fns, fenv, fuel), unroll(y, fns, fenv, fuel));
    EMod(x, y) => EMod(unroll(x, fns, fenv, fuel), unroll(y, fns, fenv, fuel));
    EConcat(x, y) => EConcat(unroll(x, fns, fenv, fuel), unroll(y, fns, fenv, fuel));
    _ => e }

fn env_get2(env: List<Pair<String, Int>>, name: String) : Int = match env { [] => 0 - 1; [Pair(k, v), ...r] => if k == name then v else env_get2(r, name) }

# === R1b foundation: multi-wire ADT support over Goldilocks (staged) ==========
# A value is a wire LIST: scalar Int -> [w]; ADT Ctor(a,b) -> [tag, wa, wb]; tuple
# (a,b) -> [wa, wb]. These field-agnostic helpers (tags, type-directed widths) +
# bignum/wire-index list helpers are the foundation; heval (spec) + cgen (circuit)
# are the next stages. Ported from prove_source_adt_zk.glass, adapted to bignum.
fn nthI(xs: List<Int>, i: Int) : Int = match xs { [] => 0; [h, ...t] => if i == 0 then h else nthI(t, i - 1) }
fn ilenI(xs: List<Int>) : Int = match xs { [] => 0; [x, ...r] => 1 + ilenI(r) }
fn vh(v: List<List<Int>>) : List<Int> = wnth(v, 0)
fn slw(sv: List<List<Int>>, off: Int, w: Int) : List<List<Int>> = if w <= 0 then [] else [wnth(sv, off)] ++ slw(sv, off + 1, w - 1)
fn padw(v: List<List<Int>>, t: Int) : List<List<Int>> = if llen(v) >= t then v else padw(v ++ [glit(0)], t)
fn ctix(ctors: List<CtorDecl>, name: String, i: Int) : Int = match ctors { [] => 0 - 1; [CtorDecl(cn, ats), ...r] => if cn == name then i else ctix(r, name, i + 1) }
fn ctag(types: List<TypeDecl>, name: String) : Int = match types { [] => error("glass prove: undeclared constructor '" ++ name ++ "' reached the prove bridge — it is in no TypeDecl of the proven source, so the bridge cannot resolve its tag and would otherwise lower it to a tag-0 cell with dropped fields (a silent WRONG circuit, e.g. built-in list patterns all collapsing to the [] arm and a proof of 0). ABSTAIN. Built-in List literals ([a, b, c], [h, ...t]) and other built-in constructors are not yet faithfully lowerable; use a declared ADT, e.g. `type IntList = | Nil | Cons(Int, IntList)` (see examples/prove/map_prove.glass)."); [TypeDecl(tn, tps, ctors), ...r] => let idx : Int = ctix(ctors, name, 0) in if idx >= 0 then idx else ctag(r, name); [RecordDecl(rn, rps, rfs), ...r] => ctag(r, name) }
fn find_type(types: List<TypeDecl>, name: String) : List<CtorDecl> = match types { [] => []; [TypeDecl(tn, tps, ctors), ...r] => if tn == name then ctors else find_type(r, name); [RecordDecl(rn, rps, rfs), ...r] => find_type(r, name) }
fn has_ctor(ctors: List<CtorDecl>, name: String) : Bool = match ctors { [] => false; [CtorDecl(cn, ats), ...r] => if cn == name then true else has_ctor(r, name) }
fn get_args(ctors: List<CtorDecl>, name: String) : List<Type> = match ctors { [] => []; [CtorDecl(cn, ats), ...r] => if cn == name then ats else get_args(r, name) }
fn ctor_argtypes(types: List<TypeDecl>, name: String) : List<Type> = match types { [] => error("glass prove: undeclared constructor '" ++ name ++ "' reached the prove bridge — it is in no TypeDecl of the proven source, so the bridge cannot resolve its field types and would otherwise drop them (a silent WRONG circuit, e.g. built-in list patterns all collapsing to the [] arm and a proof of 0). ABSTAIN. Built-in List literals ([a, b, c], [h, ...t]) and other built-in constructors are not yet faithfully lowerable; use a declared ADT, e.g. `type IntList = | Nil | Cons(Int, IntList)` (see examples/prove/map_prove.glass)."); [TypeDecl(tn, tps, ctors), ...r] => if has_ctor(ctors, name) then get_args(ctors, name) else ctor_argtypes(r, name); [RecordDecl(rn, rps, rfs), ...r] => ctor_argtypes(r, name) }
# --- records (v5.103): a single-variant product, NO tag — fields in DECL order, twidth-padded,
# laid out exactly like a tuple but with declared field types (so any field width works). The
# type-helpers above skip RecordDecl (a RecordDecl head used to crash find_type/ctag/ctor_argtypes
# with a non-exhaustive match). find_record returns a record's declared fields by name.
fn find_record(types: List<TypeDecl>, name: String) : List<Pair<String, Type>> = match types { [] => []; [TypeDecl(tn, tps, ctors), ...r] => find_record(r, name); [RecordDecl(rn, rps, rfs), ...r] => if rn == name then rfs else find_record(r, name) }
fn rec_ftypes(fs: List<Pair<String, Type>>) : List<Type> = match fs { [] => []; [Pair(fnm, fty), ...r] => [fty] ++ rec_ftypes(r) }
fn rec_fnames(fs: List<Pair<String, Type>>) : List<String> = match fs { [] => []; [Pair(fnm, fty), ...r] => [fnm] ++ rec_fnames(r) }
# reorder a record literal's fields to the type's DECL order (so layout is canonical regardless of
# the order the constructor wrote them): for each declared field name, pick its expr from the literal.
fn assoc_e(fs: List<Pair<String, Expr>>, name: String) : Expr = match fs { [] => EInt(0); [Pair(k, v), ...r] => if k == name then v else assoc_e(r, name) }
fn reorder_rec(declnames: List<String>, lit: List<Pair<String, Expr>>) : List<Expr> = match declnames { [] => []; [nm, ...r] => [assoc_e(lit, nm)] ++ reorder_rec(r, lit) }
fn smem(xs: List<String>, x: String) : Bool = match xs { [] => false; [h, ...r] => if h == x then true else smem(r, x) }
# PRecord binds the LISTED field names; iterate the DECL fields in order (so the slice offset
# accumulates by twidth correctly), binding only the listed ones. heval (values) / cgen (wires).
fn pbind_rec(declfs: List<Pair<String, Type>>, listed: List<String>, sv: List<List<Int>>, off: Int, types: List<TypeDecl>, env: List<Pair<String, List<List<Int>>>>) : List<Pair<String, List<List<Int>>>> =
  match declfs { [] => env; [Pair(nm, ty), ...r] => let w : Int = twidth(ty, types, 12) in
    let env2 : List<Pair<String, List<List<Int>>>> = if smem(listed, nm) then [Pair(nm, slw(sv, off, w))] ++ env else env in
    pbind_rec(r, listed, sv, off + w, types, env2) }
fn cbind_rec(declfs: List<Pair<String, Type>>, listed: List<String>, sv: List<Int>, off: Int, types: List<TypeDecl>, cenv: List<Pair<String, List<Int>>>) : List<Pair<String, List<Int>>> =
  match declfs { [] => cenv; [Pair(nm, ty), ...r] => let w : Int = twidth(ty, types, 12) in
    let cenv2 : List<Pair<String, List<Int>>> = if smem(listed, nm) then [Pair(nm, slwi(sv, off, w))] ++ cenv else cenv in
    cbind_rec(r, listed, sv, off + w, types, cenv2) }
fn scalar_types_e(xs: List<Expr>) : List<Type> = match xs { [] => []; [x, ...r] => [TyInt] ++ scalar_types_e(r) }
fn twidth(ty: Type, types: List<TypeDecl>, fuel: Int) : Int = if fuel <= 0 then 1 else match ty { TyAdt(name, args) => match find_record(types, name) { [] => (match find_type(types, name) { [] => 1; cs => 1 + max_ctor_width(cs, types, fuel - 1) }); rfs => ctor_wsum(rec_ftypes(rfs), types, fuel - 1) }; TyRec(fs) => ctor_wsum(rec_ftypes(fs), types, fuel - 1); TyTuple(tys) => ctor_wsum(tys, types, fuel - 1); TyStr => error("glass prove: a String has no fixed type-determined wire width (it is codepoint-count dependent), so it cannot be laid out at a fixed offset as a FIELD of an ADT/record/tuple — a width-1 slot would mis-offset the following fields (or truncate the string to one codepoint) and silently attest a WRONG value. ABSTAIN. A String is provable as a standalone result/input, not embedded in an aggregate."); _ => 1 }
fn ctor_wsum(args: List<Type>, types: List<TypeDecl>, fuel: Int) : Int = match args { [] => 0; [a, ...r] => twidth(a, types, fuel) + ctor_wsum(r, types, fuel) }
fn max_ctor_width(ctors: List<CtorDecl>, types: List<TypeDecl>, fuel: Int) : Int = match ctors { [] => 0; [CtorDecl(cn, ats), ...r] => let w : Int = ctor_wsum(ats, types, fuel) in let rw : Int = max_ctor_width(r, types, fuel) in if w >= rw then w else rw }
# HOLE B (v5.130) — fixed-width layout overflow guard. A constructor/record/tuple lays each field at a
# FIXED slot width `twidth(t, 12)` and reads the NEXT field at `off + that width`. But a value can be
# WIDER than its slot: `twidth` decrements fuel per recursive level while construction pads at a flat
# fuel 12, so a recursive-ADT value (e.g. Cons(7,Nil) = 27 wires vs twidth(IntList)=25) over-runs its
# slot. If such an over-wide value is FOLLOWED by another field, that field is read at a shifted offset
# — onto the overflow wires — and the circuit silently attests a WRONG value (caught only by --witness3).
# It is BENIGN when the over-wide field is LAST (nothing follows; a head-reading fold like map_prove still
# works, the consumer just truncates trailing pad). So: ABSTAIN iff an over-wide field is NON-LAST.
fn has_more_e(xs: List<Expr>) : Bool = match xs { [] => false; [x, ...r] => true }
fn assert_field_fits(actual: Int, slot: Int, more: Bool) : Bool =
  if more && (actual > slot)
  then error("glass prove: a constructed field value is WIDER than its declared type's fixed wire width AND is FOLLOWED by another field — the fixed-width layout would read the following field at a shifted offset, onto this value's overflow wires, and silently attest a WRONG value (a recursive ADT or variable-width field exceeding its twidth slot). ABSTAIN. Put the variable-width/recursive field LAST in the constructor/record/tuple, or refactor the type.")
  else true

# --- R1b stage 1: heval, the reference evaluator (SPEC) for ADTs over Goldilocks --
# A value is multi-wire: scalar [v]; ADT Ctor(a,b) -> [tag, fa, fb]; tuple [a, b].
# (int -> bignum vs the Baby Bear original: values List<List<Int>>, vh first comp,
# tags via glit, is-zero via bn_is_zero.)
fn scalar_types_p(xs: List<Pattern>) : List<Type> = match xs { [] => []; [x, ...r] => [TyInt] ++ scalar_types_p(r) }
fn heg(env: List<Pair<String, List<List<Int>>>>, name: String) : List<List<Int>> = match env { [] => [glit(0)]; [Pair(k, v), ...r] => if k == name then v else heg(r, name) }
fn heval(e: Expr, env: List<Pair<String, List<List<Int>>>>, fns: List<FnDecl>, types: List<TypeDecl>) : (List<List<Int>>, List<List<Int>>) =
  match e {
    EInt(n) => ([gin(n)], []);
    EBool(tf) => ([if tf then glit(1) else glit(0)], []);
    EVar(x) => (heg(env, x), []);
    EAdd(a, b) => match heval(a, env, fns, types) { (va, ha) => match heval(b, env, fns, types) { (vb, hb) => ([fadd(vh(va), vh(vb))], ha ++ hb) } };
    ESub(a, b) => match heval(a, env, fns, types) { (va, ha) => match heval(b, env, fns, types) { (vb, hb) => ([fsub(vh(va), vh(vb))], ha ++ hb) } };
    EMul(a, b) => match heval(a, env, fns, types) { (va, ha) => match heval(b, env, fns, types) { (vb, hb) => ([fmul(vh(va), vh(vb))], ha ++ hb) } };
    EEq(a, b) => match heval(a, env, fns, types) { (va, ha) => match heval(b, env, fns, types) { (vb, hb) =>
      if (llen(va) == 1) && (llen(vb) == 1) then (let d : List<Int> = fsub(vh(va), vh(vb)) in ([if bn_is_zero(d) then glit(1) else glit(0)], ha ++ hb ++ [if bn_is_zero(d) then glit(0) else finv(d)]))
      else ([if vals_eq(va, vb) then glit(1) else glit(0)], ha ++ hb) } };
    ENeq(a, b) => match heval(a, env, fns, types) { (va, ha) => match heval(b, env, fns, types) { (vb, hb) =>
      if (llen(va) == 1) && (llen(vb) == 1) then (let d : List<Int> = fsub(vh(va), vh(vb)) in ([if bn_is_zero(d) then glit(0) else glit(1)], ha ++ hb ++ [if bn_is_zero(d) then glit(0) else finv(d)]))
      else ([if vals_eq(va, vb) then glit(0) else glit(1)], ha ++ hb) } };
    EAnd(a, b) => match heval(a, env, fns, types) { (va, ha) => match heval(b, env, fns, types) { (vb, hb) => ([fmul(vh(va), vh(vb))], ha ++ hb) } };
    EOr(a, b) => match heval(a, env, fns, types) { (va, ha) => match heval(b, env, fns, types) { (vb, hb) => ([fsub(fadd(vh(va), vh(vb)), fmul(vh(va), vh(vb)))], ha ++ hb) } };
    EUNot(a) => match heval(a, env, fns, types) { (va, ha) => ([fsub(glit(1), vh(va))], ha) };
    EIf(c, t, f) => match heval(c, env, fns, types) { (vc, hc) => match heval(t, env, fns, types) { (vt, ht) => match heval(f, env, fns, types) { (vf, hf) => (if bn_eq(vh(vc), glit(1)) then vt else vf, hc ++ ht ++ hf) } } };
    ELet(nm, v, body) => match heval(v, env, fns, types) { (vv, hv) => match heval(body, [Pair(nm, vv)] ++ env, fns, types) { (vb, hb) => (vb, hv ++ hb) } };
    ECtor(name, args) => match heval_fields(args, ctor_argtypes(types, name), env, fns, types) { (vals, hs) => ([glit(ctag(types, name))] ++ vals, hs) };
    ETuple(elems) => heval_fields(elems, scalar_types_e(elems), env, fns, types);
    ENamedRec(nm, lit) => heval_fields(reorder_rec(rec_fnames(find_record(types, nm)), lit), rec_ftypes(find_record(types, nm)), env, fns, types);
    EField(recd, f) => error("glass prove: could not resolve the record TYPE for field access (." ++ f ++ ") — direct `r.field` lowers when the record's type is inferable (a record variable or literal, or an if over records); otherwise destructure with a pattern: match r { T { " ++ f ++ " } => " ++ f ++ " }. ABSTAIN.");
    EStr(s) => (estr_v(s), []);
    EConcat(a, b) => match heval(a, env, fns, types) { (va, ha) => match heval(b, env, fns, types) { (vb, hb) => (va ++ vb, ha ++ hb) } };
    EApp(f, a) => match unwind_app(EApp(f, a), []) { (hd, args) => match hd { EVar(fname) => if is_strfn(fname) then heval_strfn(fname, args, env, fns, types) else if is_bitop(fname) then heval_bitop(fname, args, env, fns, types) else heval_call(fn_body_of(fns, fname), args, [], env, fns, types); _ => error("glass prove: unsupported call form (computed or higher-order callee) in the reference evaluator — refusing rather than silently proving 0") } };
    EMatch(scrut, arms) => match heval(scrut, env, fns, types) { (sv, hs) => match heval_match(sv, arms, env, fns, types) { (rv, ha) => (rv, hs ++ ha) } };
    ELt(a, b) => match heval(a, env, fns, types) { (va, ha) => match heval(b, env, fns, types) { (vb, hb) =>
      let xa : List<Int> = vh(va) in let xb : List<Int> = vh(vb) in
      if cmp_ok_g(xa, xb) then let d : List<Int> = fadd(fsub(xa, xb), pow2_lit(32)) in
        ([if bn_cmp(trim(xa), trim(xb)) < 0 then glit(1) else glit(0)], ha ++ hb ++ cmp_bits_w(xa, 32) ++ cmp_bits_w(xb, 32) ++ cmp_bits_w(d, 33))
      else error("glass prove: ordering comparison operand out of provable range [0,2^32) — ABSTAIN (Glass cannot faithfully lower this comparison; abstaining, not disproving — and never a wrong ACCEPT)") } };
    EGt(a, b) => match heval(a, env, fns, types) { (va, ha) => match heval(b, env, fns, types) { (vb, hb) =>
      let xa : List<Int> = vh(va) in let xb : List<Int> = vh(vb) in
      if cmp_ok_g(xa, xb) then let d : List<Int> = fadd(fsub(xb, xa), pow2_lit(32)) in
        ([if bn_cmp(trim(xb), trim(xa)) < 0 then glit(1) else glit(0)], ha ++ hb ++ cmp_bits_w(xb, 32) ++ cmp_bits_w(xa, 32) ++ cmp_bits_w(d, 33))
      else error("glass prove: ordering comparison operand out of provable range [0,2^32) — ABSTAIN (cannot lower; abstaining, not disproving)") } };
    ELe(a, b) => match heval(a, env, fns, types) { (va, ha) => match heval(b, env, fns, types) { (vb, hb) =>
      let xa : List<Int> = vh(va) in let xb : List<Int> = vh(vb) in
      if cmp_ok_g(xa, xb) then let d : List<Int> = fadd(fsub(xb, xa), pow2_lit(32)) in
        ([if bn_cmp(trim(xb), trim(xa)) < 0 then glit(0) else glit(1)], ha ++ hb ++ cmp_bits_w(xb, 32) ++ cmp_bits_w(xa, 32) ++ cmp_bits_w(d, 33))
      else error("glass prove: ordering comparison operand out of provable range [0,2^32) — ABSTAIN (cannot lower; abstaining, not disproving)") } };
    EGe(a, b) => match heval(a, env, fns, types) { (va, ha) => match heval(b, env, fns, types) { (vb, hb) =>
      let xa : List<Int> = vh(va) in let xb : List<Int> = vh(vb) in
      if cmp_ok_g(xa, xb) then let d : List<Int> = fadd(fsub(xa, xb), pow2_lit(32)) in
        ([if bn_cmp(trim(xa), trim(xb)) < 0 then glit(0) else glit(1)], ha ++ hb ++ cmp_bits_w(xa, 32) ++ cmp_bits_w(xb, 32) ++ cmp_bits_w(d, 33))
      else error("glass prove: ordering comparison operand out of provable range [0,2^32) — ABSTAIN (cannot lower; abstaining, not disproving)") } };
    EDiv(a, b) => match heval(a, env, fns, types) { (va, ha) => match heval(b, env, fns, types) { (vb, hb) =>
      let xa : List<Int> = vh(va) in let xb : List<Int> = vh(vb) in
      if cmp_ok_g(xa, xb) then ([if bn_is_zero(xb) then glit(0) else gdiv_lit(xa, xb)], ha ++ hb)
      else error("glass prove: integer division operand out of provable range [0,2^32) — ABSTAIN (Glass cannot faithfully lower this division; abstaining, not disproving — and never a wrong ACCEPT)") } };
    EMod(a, b) => match heval(a, env, fns, types) { (va, ha) => match heval(b, env, fns, types) { (vb, hb) =>
      let xa : List<Int> = vh(va) in let xb : List<Int> = vh(vb) in
      if cmp_ok_g(xa, xb) then ([if bn_is_zero(xb) then glit(bn_small_to_int(xa)) else gmod_lit(xa, xb)], ha ++ hb)
      else error("glass prove: integer modulo operand out of provable range [0,2^32) — ABSTAIN (cannot lower; abstaining, not disproving)") } };
    _ => error("glass prove: unsupported expression in the prove bridge (heval) — only + - * == != && || ! < > <= >= / % (range-bounded) and if/let/match/ADT/calls lower to the field circuit; strings and records have no faithful field lowering and are refused, not silently proven as 0") }
fn heval_fields(args: List<Expr>, tys: List<Type>, env: List<Pair<String, List<List<Int>>>>, fns: List<FnDecl>, types: List<TypeDecl>) : (List<List<Int>>, List<List<Int>>) =
  match args { [] => ([], []); [a, ...arest] => match tys { [] => ([], []); [t, ...trest] =>
    match heval(a, env, fns, types) { (va, ha) => let _ : Bool = assert_field_fits(llen(va), twidth(t, types, 12), has_more_e(arest)) in match heval_fields(arest, trest, env, fns, types) { (vr, hr) =>
      (padw(va, twidth(t, types, 12)) ++ vr, ha ++ hr) } } } }
# string intrinsics in the reference evaluator: string_length -> the (static) wire count; substring
# -> a static wire slice (bounds via cval_h). Both structural — they read the multi-wire value.
fn heval_strfn(fname: String, args: List<Expr>, env: List<Pair<String, List<List<Int>>>>, fns: List<FnDecl>, types: List<TypeDecl>) : (List<List<Int>>, List<List<Int>>) =
  if fname == "string_length"
  then (match args { [s] => match heval(s, env, fns, types) { (sv, hs) => ([glit(llen(sv))], hs) }; _ => error("glass prove: string_length expects exactly 1 argument") })
  else (match args { [s, lo, hi] => match heval(s, env, fns, types) { (sv, hs) => match substr_bounds(cval_h(lo, env), cval_h(hi, env), llen(sv)) { (a, bb) => (slw(sv, a, bb - a), hs) } }; _ => error("glass prove: substring expects exactly 3 arguments") })
fn heval_call(body: Expr, args: List<Expr>, ccenv: List<Pair<String, List<List<Int>>>>, fcenv: List<Pair<String, List<List<Int>>>>, fns: List<FnDecl>, types: List<TypeDecl>) : (List<List<Int>>, List<List<Int>>) =
  match body {
    ELam(p, inner) => match args { [] => heval(body, ccenv, fns, types); [a, ...rest] => match heval(a, fcenv, fns, types) { (va, ha) => match heval_call(inner, rest, [Pair(p, va)] ++ ccenv, fcenv, fns, types) { (vr, hr) => (vr, ha ++ hr) } } };
    _ => heval(body, ccenv, fns, types) }
fn pmatch(p: Pattern, sv: List<List<Int>>, types: List<TypeDecl>) : Bool =
  match p { PWild => true; PVar(x) => true; PInt(n) => bn_eq(vh(sv), glit(n)); PBool(bb) => bn_eq(vh(sv), if bb then glit(1) else glit(0)); PCtor(nm, ps) => if bn_eq(vh(sv), glit(ctag(types, nm))) then pmatch_fields(ps, ctor_argtypes(types, nm), sv, 1, types) else false; PTuple(ps) => pmatch_fields(ps, scalar_types_p(ps), sv, 0, types); PStr(s) => vals_eq(sv, estr_v(s)); PRecord(nm, fs) => true }
fn pmatch_fields(ps: List<Pattern>, tys: List<Type>, sv: List<List<Int>>, off: Int, types: List<TypeDecl>) : Bool =
  match ps { [] => true; [p, ...prest] => match tys { [] => true; [t, ...trest] =>
    let wt : Int = twidth(t, types, 12) in if pmatch(p, slw(sv, off, wt), types) then pmatch_fields(prest, trest, sv, off + wt, types) else false } }
fn pbind(p: Pattern, sv: List<List<Int>>, types: List<TypeDecl>, env: List<Pair<String, List<List<Int>>>>) : List<Pair<String, List<List<Int>>>> =
  match p { PVar(x) => [Pair(x, sv)] ++ env; PCtor(nm, ps) => pbind_fields(ps, ctor_argtypes(types, nm), sv, 1, types, env); PWild => env; PInt(n) => env; PBool(bb) => env; PTuple(ps) => pbind_fields(ps, scalar_types_p(ps), sv, 0, types, env); PStr(s) => env; PRecord(nm, fs) => pbind_rec(find_record(types, nm), fs, sv, 0, types, env) }
fn pbind_fields(ps: List<Pattern>, tys: List<Type>, sv: List<List<Int>>, off: Int, types: List<TypeDecl>, env: List<Pair<String, List<List<Int>>>>) : List<Pair<String, List<List<Int>>>> =
  match ps { [] => env; [p, ...prest] => match tys { [] => env; [t, ...trest] =>
    let wt : Int = twidth(t, types, 12) in pbind_fields(prest, trest, sv, off + wt, types, pbind(p, slw(sv, off, wt), types, env)) } }
fn psel_hint(p: Pattern, sv: List<List<Int>>, types: List<TypeDecl>) : List<List<Int>> =
  match p { PInt(n) => let d : List<Int> = fsub(vh(sv), glit(n)) in [if bn_is_zero(d) then glit(0) else finv(d)]; PBool(bb) => let d : List<Int> = fsub(vh(sv), if bb then glit(1) else glit(0)) in [if bn_is_zero(d) then glit(0) else finv(d)]; PCtor(nm, ps) => let d : List<Int> = fsub(vh(sv), glit(ctag(types, nm))) in [if bn_is_zero(d) then glit(0) else finv(d)] ++ psel_hint_fields(ps, ctor_argtypes(types, nm), sv, 1, types); PWild => []; PVar(x) => []; PTuple(ps) => psel_hint_fields(ps, scalar_types_p(ps), sv, 0, types); PStr(s) => []; PRecord(nm, fs) => [] }
fn psel_hint_fields(ps: List<Pattern>, tys: List<Type>, sv: List<List<Int>>, off: Int, types: List<TypeDecl>) : List<List<Int>> =
  match ps { [] => []; [p, ...prest] => match tys { [] => []; [t, ...trest] =>
    let wt : Int = twidth(t, types, 12) in psel_hint(p, slw(sv, off, wt), types) ++ psel_hint_fields(prest, trest, sv, off + wt, types) } }
fn heval_match(sv: List<List<Int>>, arms: List<Pair<Pattern, Expr>>, env: List<Pair<String, List<List<Int>>>>, fns: List<FnDecl>, types: List<TypeDecl>) : (List<List<Int>>, List<List<Int>>) =
  match arms { [] => ([glit(0)], []);
    [Pair(p, body), ...rest] =>
      let sh : List<List<Int>> = psel_hint(p, sv, types) in
      match heval(body, pbind(p, sv, types, env), fns, types) { (bv, bh) =>
      match heval_match(sv, rest, env, fns, types) { (rv, rh) =>
        (if pmatch(p, sv, types) then bv else rv, sh ++ bh ++ rh) } } }

# --- bounded-unroll depth: ONE source of truth so seval and unroll can never drift ---
fn unroll_fuel(d: Int) : Int = 8

# --- seval: a SHORT-CIRCUITING, fuel-limited reference interpreter over the SAME multi-wire
# value domain as heval/cgen (scalar [v]; ADT [tag, ...fields]; tuple). It evaluates the SOURCE
# with calls intact and is a PURE GUARD: it never builds a gate, never calls prove_b3/verify_b3.
# Unlike heval (which evaluates BOTH if-arms and EVERY match-arm to accumulate hints), seval
# descends ONLY the taken arm + the first matching pattern, and decrements `fuel` once per
# SATURATED call IN LOCKSTEP with inline_fn: spine args at the current fuel (no decrement), the
# saturated body at fuel-1 (seval_call's `[] =>` / `_ =>`), and the cap check `fuel <= 0` AT the
# EApp node (mirroring unroll). So it reaches a call-at-fuel-0 ONLY when the genuinely-taken
# runtime recursion is deeper than the unroll bound -> exactly the case the fuel-bounded circuit
# would SILENTLY TRUNCATE. There it calls `error` (loud refuse) instead of yielding a truncated
# value. Within fuel it returns the same value the circuit proves (accept-set is a SUBSET of the
# circuit-faithful set). HONEST SCOPE: this guards the CLI's honest R-computation path; a
# malicious prover building a truncated circuit directly (or calling gprove_sound with a forged
# R) is OUT of the soundness threat model (faithful-lowering, audit-readiness.md) — the
# do-not-protect-real-value banner stays.
# seval carries `fenv` (param -> fn-name) exactly like unroll's inline_fn, so the guard resolves
# FUNCTION-VALUED parameters the same way the prover (unroll+cgen) does — higher-order programs like
# `map(inc, xs)` are guarded (and provable) instead of spuriously refused. fn-args bind into fenv (no
# fuel decrement, matching inline_fn); value-args bind into env. seval's accept-set stays a subset of
# the circuit-faithful set because the resolution now MATCHES unroll's.
fn seval(e: Expr, env: List<Pair<String, List<List<Int>>>>, fns: List<FnDecl>, types: List<TypeDecl>, fenv: List<Pair<String, String>>, fuel: Int) : List<List<Int>> =
  match e {
    EInt(n) => [gin(n)];
    EBool(tf) => [if tf then glit(1) else glit(0)];
    EVar(x) => heg(env, x);
    EAdd(a, b) => [fadd(vh(seval(a, env, fns, types, fenv, fuel)), vh(seval(b, env, fns, types, fenv, fuel)))];
    ESub(a, b) => [fsub(vh(seval(a, env, fns, types, fenv, fuel)), vh(seval(b, env, fns, types, fenv, fuel)))];
    EMul(a, b) => [fmul(vh(seval(a, env, fns, types, fenv, fuel)), vh(seval(b, env, fns, types, fenv, fuel)))];
    EEq(a, b) => let va : List<List<Int>> = seval(a, env, fns, types, fenv, fuel) in let vb : List<List<Int>> = seval(b, env, fns, types, fenv, fuel) in
      if (llen(va) == 1) && (llen(vb) == 1) then (let d : List<Int> = fsub(vh(va), vh(vb)) in [if bn_is_zero(d) then glit(1) else glit(0)]) else [if vals_eq(va, vb) then glit(1) else glit(0)];
    ENeq(a, b) => let va : List<List<Int>> = seval(a, env, fns, types, fenv, fuel) in let vb : List<List<Int>> = seval(b, env, fns, types, fenv, fuel) in
      if (llen(va) == 1) && (llen(vb) == 1) then (let d : List<Int> = fsub(vh(va), vh(vb)) in [if bn_is_zero(d) then glit(0) else glit(1)]) else [if vals_eq(va, vb) then glit(0) else glit(1)];
    EAnd(a, b) => [fmul(vh(seval(a, env, fns, types, fenv, fuel)), vh(seval(b, env, fns, types, fenv, fuel)))];
    EOr(a, b) => let va : List<Int> = vh(seval(a, env, fns, types, fenv, fuel)) in let vb : List<Int> = vh(seval(b, env, fns, types, fenv, fuel)) in [fsub(fadd(va, vb), fmul(va, vb))];
    EUNot(a) => [fsub(glit(1), vh(seval(a, env, fns, types, fenv, fuel)))];
    EIf(c, t, f) => if bn_eq(vh(seval(c, env, fns, types, fenv, fuel)), glit(1)) then seval(t, env, fns, types, fenv, fuel) else seval(f, env, fns, types, fenv, fuel);
    ELet(nm, v, body) => if is_fn_arg(v, fns, fenv) then seval(body, env, fns, types, [Pair(nm, arg_fn_name(v, fns, fenv))] ++ fenv, fuel) else if is_fn_sel(v, fns, fenv) then seval(distrib_let(nm, v, body), env, fns, types, fenv, fuel) else seval(body, [Pair(nm, seval(v, env, fns, types, fenv, fuel))] ++ env, fns, types, fenv, fuel);
    ECtor(name, args) => [glit(ctag(types, name))] ++ seval_fields(args, ctor_argtypes(types, name), env, fns, types, fenv, fuel);
    ETuple(elems) => seval_fields(elems, scalar_types_e(elems), env, fns, types, fenv, fuel);
    ENamedRec(nm, lit) => seval_fields(reorder_rec(rec_fnames(find_record(types, nm)), lit), rec_ftypes(find_record(types, nm)), env, fns, types, fenv, fuel);
    # v5.104: EField is permissive in the guard (its value is discarded) — just guard the subexpr's
    # recursion/callees. The real lowering is unroll's `e.f -> match e { T { f } => f }` desugar
    # (heval/cgen on the unrolled term); an UNRESOLVABLE e.f stays EField -> heval/cgen ABSTAIN.
    EField(recd, f) => let _g : List<List<Int>> = seval(recd, env, fns, types, fenv, fuel) in [glit(0)];
    EStr(s) => estr_v(s);
    EConcat(a, b) => seval(a, env, fns, types, fenv, fuel) ++ seval(b, env, fns, types, fenv, fuel);
    EApp(f, a) => match unwind_app(EApp(f, a), []) { (hd, args) => match hd {
      EVar(fname) => if is_scmp(fname) then (match args { [sa, sb] => seval(scmp_desugar(fname, sa, sb), env, fns, types, fenv, fuel); _ => error("glass prove: signed comparison '" ++ fname ++ "' expects exactly 2 arguments") }) else if is_sdiv(fname) then (match args { [da, db] => seval(sdiv_desugar(fname, da, db), env, fns, types, fenv, fuel); _ => error("glass prove: signed division '" ++ fname ++ "' expects exactly 2 arguments") }) else if is_sabs(fname) then (match args { [za] => seval(sabs_desugar(za), env, fns, types, fenv, fuel); _ => error("glass prove: 'sabs' expects exactly 1 argument") }) else if is_sutil2(fname) then (match args { [ua, ub] => seval(sutil2_desugar(fname, ua, ub), env, fns, types, fenv, fuel); _ => error("glass prove: signed '" ++ fname ++ "' expects exactly 2 arguments") }) else if is_strfn(fname) then seval_strfn(fname, args, env, fns, types, fenv, fuel) else if is_bitop(fname) then seval_bitop(fname, args, env, fns, types, fenv, fuel) else if fuel <= 0 then error("glass prove: recursion depth exceeds the unroll bound (" ++ int_to_string(unroll_fuel(0)) ++ "); refusing to prove a depth-truncated result — it would otherwise be a silently wrong value with a valid-looking proof (the program needs statically-bounded, shallower recursion)") else (let tgt : String = resolve_fn(fname, fns, fenv) in if tgt == "" then error("glass prove: unresolved call to '" ++ fname ++ "' in the reference evaluator") else seval_call(fn_body_of(fns, tgt), args, [], env, [], fenv, fns, types, fuel));
      _ => seval(push_app(hd, args), env, fns, types, fenv, fuel) } };
    EMatch(scrut, arms) => seval_match(seval(scrut, env, fns, types, fenv, fuel), arms, env, fns, types, fenv, fuel);
    ELt(a, b) => let xa : List<Int> = vh(seval(a, env, fns, types, fenv, fuel)) in let xb : List<Int> = vh(seval(b, env, fns, types, fenv, fuel)) in
      if cmp_ok_g(xa, xb) then (if bn_cmp(trim(xa), trim(xb)) < 0 then [glit(1)] else [glit(0)]) else error("glass prove: ordering comparison operand out of provable range [0,2^32) — ABSTAIN (cannot lower; abstaining, not disproving)");
    EGt(a, b) => let xa : List<Int> = vh(seval(a, env, fns, types, fenv, fuel)) in let xb : List<Int> = vh(seval(b, env, fns, types, fenv, fuel)) in
      if cmp_ok_g(xa, xb) then (if bn_cmp(trim(xb), trim(xa)) < 0 then [glit(1)] else [glit(0)]) else error("glass prove: ordering comparison operand out of provable range [0,2^32) — ABSTAIN (cannot lower; abstaining, not disproving)");
    ELe(a, b) => let xa : List<Int> = vh(seval(a, env, fns, types, fenv, fuel)) in let xb : List<Int> = vh(seval(b, env, fns, types, fenv, fuel)) in
      if cmp_ok_g(xa, xb) then (if bn_cmp(trim(xb), trim(xa)) < 0 then [glit(0)] else [glit(1)]) else error("glass prove: ordering comparison operand out of provable range [0,2^32) — ABSTAIN (cannot lower; abstaining, not disproving)");
    EGe(a, b) => let xa : List<Int> = vh(seval(a, env, fns, types, fenv, fuel)) in let xb : List<Int> = vh(seval(b, env, fns, types, fenv, fuel)) in
      if cmp_ok_g(xa, xb) then (if bn_cmp(trim(xa), trim(xb)) < 0 then [glit(0)] else [glit(1)]) else error("glass prove: ordering comparison operand out of provable range [0,2^32) — ABSTAIN (cannot lower; abstaining, not disproving)");
    EDiv(a, b) => let xa : List<Int> = vh(seval(a, env, fns, types, fenv, fuel)) in let xb : List<Int> = vh(seval(b, env, fns, types, fenv, fuel)) in
      if div_ok_g(xa, xb) then [gdiv_lit(xa, xb)] else error("glass prove: integer division operand out of provable range [0,2^32) or divisor zero — ABSTAIN (cannot lower; abstaining, not disproving)");
    EMod(a, b) => let xa : List<Int> = vh(seval(a, env, fns, types, fenv, fuel)) in let xb : List<Int> = vh(seval(b, env, fns, types, fenv, fuel)) in
      if div_ok_g(xa, xb) then [gmod_lit(xa, xb)] else error("glass prove: integer modulo operand out of provable range [0,2^32) or divisor zero — ABSTAIN (cannot lower; abstaining, not disproving)");
    _ => error("glass prove: unsupported expression in the prove bridge (seval guard) — only + - * == != && || ! < > <= >= / % (range-bounded) and if/let/match/ADT/calls lower to the field circuit; strings and records are refused, not silently proven as 0") }
fn seval_fields(args: List<Expr>, tys: List<Type>, env: List<Pair<String, List<List<Int>>>>, fns: List<FnDecl>, types: List<TypeDecl>, fenv: List<Pair<String, String>>, fuel: Int) : List<List<Int>> =
  match args { [] => []; [a, ...arest] => match tys { [] => []; [t, ...trest] =>
    let sva : List<List<Int>> = seval(a, env, fns, types, fenv, fuel) in let _ : Bool = assert_field_fits(llen(sva), twidth(t, types, 12), has_more_e(arest)) in padw(sva, twidth(t, types, 12)) ++ seval_fields(arest, trest, env, fns, types, fenv, fuel) } }
# string intrinsics in the guard evaluator (mirrors heval_strfn so the guard's value matches).
fn seval_strfn(fname: String, args: List<Expr>, env: List<Pair<String, List<List<Int>>>>, fns: List<FnDecl>, types: List<TypeDecl>, fenv: List<Pair<String, String>>, fuel: Int) : List<List<Int>> =
  if fname == "string_length"
  then (match args { [s] => [glit(llen(seval(s, env, fns, types, fenv, fuel)))]; _ => error("glass prove: string_length expects exactly 1 argument") })
  else (match args { [s, lo, hi] => let sv : List<List<Int>> = seval(s, env, fns, types, fenv, fuel) in match substr_bounds(cval_h(lo, env), cval_h(hi, env), llen(sv)) { (a, bb) => slw(sv, a, bb - a) }; _ => error("glass prove: substring expects exactly 3 arguments") })
# seval_call mirrors inline_fn: a fn-valued arg (resolvable in the CALLER's f_fenv) binds the param
# into the CALLEE's c_fenv (no fuel decrement); a value arg is seval'd in the caller's env and binds
# into ccenv. ccenv/c_fenv start empty (fresh callee scope); fcenv/f_fenv are the caller's.
fn seval_call(body: Expr, args: List<Expr>, ccenv: List<Pair<String, List<List<Int>>>>, fcenv: List<Pair<String, List<List<Int>>>>, c_fenv: List<Pair<String, String>>, f_fenv: List<Pair<String, String>>, fns: List<FnDecl>, types: List<TypeDecl>, fuel: Int) : List<List<Int>> =
  match body {
    ELam(p, inner) => match args {
      [] => seval(body, ccenv, fns, types, c_fenv, fuel - 1);
      [a, ...rest] => if is_fn_arg(a, fns, f_fenv)
        then seval_call(inner, rest, ccenv, fcenv, [Pair(p, arg_fn_name(a, fns, f_fenv))] ++ c_fenv, f_fenv, fns, types, fuel)
        else (let va : List<List<Int>> = seval(a, fcenv, fns, types, f_fenv, fuel) in seval_call(inner, rest, [Pair(p, va)] ++ ccenv, fcenv, c_fenv, f_fenv, fns, types, fuel)) };
    _ => seval(body, ccenv, fns, types, c_fenv, fuel - 1) }
fn seval_match(sv: List<List<Int>>, arms: List<Pair<Pattern, Expr>>, env: List<Pair<String, List<List<Int>>>>, fns: List<FnDecl>, types: List<TypeDecl>, fenv: List<Pair<String, String>>, fuel: Int) : List<List<Int>> =
  match arms { [] => [glit(0)]; [Pair(p, body), ...rest] => if pmatch(p, sv, types) then seval(body, pbind(p, sv, types, env), fns, types, fenv, fuel) else seval_match(sv, rest, env, fns, types, fenv, fuel) }

fn gref_h(src: String) : List<List<Int>> = match parse_prog(src) { Program(types, fns, main) => match heval(unroll(main, fns, [], unroll_fuel(0)), [], fns, types) { (v, h) => v } }

# --- R1b stage 2: cgen, the multi-wire circuit generator for ADTs --------------
# Value = wire-index LIST (List<Int>): scalar [w]; ADT [tag, ...fields]; tuple [...].
# Inline is-zero hints via mkh (no hint region), bignum constants via glit. Adapted
# from prove_source_adt_zk's cgen; mk_eq_g is the Goldilocks is-zero gadget.
fn slwi(sv: List<Int>, off: Int, w: Int) : List<Int> = if w <= 0 then [] else [nthI(sv, off)] ++ slwi(sv, off + 1, w - 1)
fn vhi(v: List<Int>) : Int = nthI(v, 0)
# substring bounds matching glass.py's b_substring EXACTLY (the reference semantics every lowering must
# reproduce): a negative OR inverted (start > end) index is an error (the reference raises); otherwise
# both bounds CLAMP to the value's width n and the slice is [a, b). WITHOUT this the slice over-reads
# and OOB cells take nthI/wnth's default = wire 0 = the FIRST input codepoint, so `substring("ab",0,5)`
# attests "abaaa" while the source computes "ab" — a SILENT wrong string the SOUND verify_b3 ACCEPTs
# (caught only by --witness3). The clamp makes the circuit value EQUAL the reference for EVERY input
# (in-bounds slices are byte-identical; OOB clamps identically; negative/inverted ABSTAINs).
fn substr_bounds(l: Int, h: Int, n: Int) : (Int, Int) =
  if (l < 0) || (h < 0) then error("glass prove: substring negative index — ABSTAIN (the reference interpreter raises here; never reads past the string into wire 0)")
  else if l > h then error("glass prove: substring start > end — ABSTAIN (the reference interpreter raises here)")
  else (if l > n then n else l, if h > n then n else h)
fn cenv_get(cenv: List<Pair<String, List<Int>>>, name: String) : List<Int> = match cenv { [] => [0 - 1]; [Pair(k, v), ...r] => if k == name then v else cenv_get(r, name) }
fn padv_g(v: List<Int>, target: Int, b: Build) : (List<Int>, Build) = if ilenI(v) >= target then (v, b) else match mkc(glit(0), b) { (z, b1) => padv_g(v ++ [z], target, b1) }
fn mk_eq_g(wx: Int, wy: Int, b: Build) : (Int, Build) =
  match mks(wx, wy, b) { (wd, b1) => let dv : List<Int> = bwire(b1, wd) in let iv : List<Int> = if bn_is_zero(dv) then glit(0) else finv(dv) in
  match mkh(iv, b1) { (winv, b2) => match mkm(wd, winv, b2) { (wdi, b3) => match mkc(glit(1), b3) { (wone, b4) =>
  match mks(wone, wdi, b4) { (wz, b5) => match mkm(wz, wd, b5) { (wzd, b6) => (wz, mke(wzd, b6)) } } } } } }
fn muxw_go(wc: Int, vt: List<Int>, vf: List<Int>, b: Build) : (List<Int>, Build) =
  match vt { [] => ([], b); [t, ...tr] => match vf { [] => ([], b); [f, ...fr] =>
    match mks(t, f, b) { (wd, b1) => match mkm(wc, wd, b1) { (wcd, b2) => match mka(f, wcd, b2) { (wo, b3) =>
    match muxw_go(wc, tr, fr, b3) { (rest, b4) => ([wo] ++ rest, b4) } } } } } }
# An `if` mux over MULTI-WIRE branches (strings, ADTs, tuples): muxw_go recurses in lockstep and
# STOPS at the shorter branch, so UNEQUAL widths would silently TRUNCATE the longer to a corrupted
# value. `mux_if` handles that by branch TYPE. By well-typedness both arms share a type, so the ONLY
# way widths differ is STRINGS (width = codepoint count, not type-fixed; ADTs are twidth-padded, tuples
# fixed-arity). When both branches are flat STRING expressions (is_str_expr) we NUL-pad the shorter to
# the longer with codepoint-0 wires (a value real codepoints — 32..126 — never take) and mux at equal
# width; decode_str (v5.121) stops at the first NUL, so the shorter branch decodes back to its true
# text. `if c then "APPROVED" else "DENIED"` now lowers soundly. An unequal-width mux that is NOT both
# flat strings (e.g. a record/ADT carrying a variable-length string field — a deep corner) still
# ABSTAINs loudly rather than corrupt. Scalar ifs and equal-width string/ADT/tuple ifs are byte-identical.
fn mux_if(wc: Int, t: Expr, f: Expr, vt: List<Int>, vf: List<Int>, b: Build) : (List<Int>, Build) =
  if ilenI(vt) == ilenI(vf) then muxw_go(wc, vt, vf, b)
  else if is_str_expr(t) && is_str_expr(f)
    then (let mx : Int = if ilenI(vt) >= ilenI(vf) then ilenI(vt) else ilenI(vf) in
          match padv_g(vt, mx, b) { (pvt, b1) => match padv_g(vf, mx, b1) { (pvf, b2) => muxw_go(wc, pvt, pvf, b2) } })
    else error("glass prove: an `if` returns multi-wire values of DIFFERENT widths that are not both flat strings (e.g. ADT/record variants with different shapes, or a structure carrying a variable-length string field) — muxing them would corrupt the value, so this ABSTAINs.")

# --- strings as multi-wire codepoint values (v5.101) -------------------------
# "strings can't be field-proven" was the long-standing refusal. The cut: a string IS a value,
# and the value model is ALREADY multi-wire (scalar [v]; ADT [tag,..]; tuple [a,b]). So a string
# is just a tuple of codepoints — one wire per character. "ab" -> [glit(97), glit(98)]. `++`
# concatenates wire lists (structural, NO gate); `==` is the per-codepoint is-zero gadget
# AND-folded to one 0/1 wire (unequal lengths -> a constant 0, decided at build time);
# `string_length` is the (static) wire count; `substring` a static wire slice. No new gate type,
# no verify_b3 / Pentecost change — the SAME Goldilocks gate model proves it. Bridge-only (not
# bootstrap-critical). The native dialect has no `ord`, so a literal's codepoints come from
# string_index_of into the printable-ASCII table (a char outside 32..126 ABSTAINs, never a wrong
# proof). The scalar (width-1) `==` path is preserved byte-for-byte, so every prior arithmetic /
# comparison proof, the corpus fixtures, and the Name are unchanged.
fn is_strfn(n: String) : Bool = (n == "string_length") || (n == "substring")
# is_str_expr: a CONSERVATIVE, syntactic "is this expression a FLAT string value?" used to gate the
# unequal-width NUL-padding mux (v5.121). True only for forms whose result is certainly a flat list of
# codepoint wires — a literal, a `++` of strings, a `substring(..)` slice, or an if/match/let whose
# leaves are all strings. NOT true for a bare variable or a call (type unknown without an env) — those
# stay equal-width-or-ABSTAIN (sound: a false negative only forgoes the pad, never corrupts). NOT true
# for ADT/tuple/record constructors, so a structure carrying a string field is never NUL-padded.
fn is_str_expr(e: Expr) : Bool =
  match e {
    EStr(s) => true;
    EConcat(x, y) => is_str_expr(x) && is_str_expr(y);
    EIf(c, t, f) => is_str_expr(t) && is_str_expr(f);
    ELet(nm, v, body) => is_str_expr(body);
    EMatch(scrut, arms) => all_arms_str(arms);
    EApp(g, a) => match unwind_app(EApp(g, a), []) { (hd, args) => match hd { EVar(nm) => nm == "substring"; _ => false } };
    _ => false }
fn all_arms_str(arms: List<Pair<Pattern, Expr>>) : Bool =
  match arms { [] => true; [Pair(p, body), ...r] => is_str_expr(body) && all_arms_str(r) }
fn ascii_tbl(u: Int) : String = " !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~"
fn char_code(c: String) : Int = match string_index_of(ascii_tbl(0), c) { Some(idx) => 32 + idx; None => error("glass prove: a proven string has a non-printable / non-ASCII character (only codepoints 32..126 lower to the field) — ABSTAIN, not a wrong proof") }
fn str_cps(s: String, i: Int, n: Int) : List<Int> = if i >= n then [] else [char_code(substring(s, i, i + 1))] ++ str_cps(s, i + 1, n)
fn str_codes(s: String) : List<Int> = str_cps(s, 0, string_length(s))
fn app_of(hd: Expr, args: List<Expr>) : Expr = match args { [] => hd; [a, ...r] => app_of(EApp(hd, a), r) }
# heval/seval values are List<List<Int>> (a wire = a bignum); cgen values are List<Int> (wire indices).
fn str_wires_v(cps: List<Int>) : List<List<Int>> = match cps { [] => []; [c, ...r] => [glit(c)] ++ str_wires_v(r) }
fn estr_v(s: String) : List<List<Int>> = str_wires_v(str_codes(s))
fn estr_c(cps: List<Int>, b: Build) : (List<Int>, Build) = match cps { [] => ([], b); [c, ...r] => match mkc(glit(c), b) { (w, b1) => match estr_c(r, b1) { (ws, b2) => ([w] ++ ws, b2) } } }
# multi-wire structural equality -> ONE 0/1 wire. Width-1 stays the EXACT scalar mk_eq_g path
# (byte-identical); only multi-wire (string/ADT/tuple) operands AND-fold; unequal lengths -> 0.
fn eqfold_g(vx: List<Int>, vy: List<Int>, acc: Int, b: Build) : (Int, Build) =
  match vx { [] => (acc, b); [x, ...xr] => match vy { [] => (acc, b); [y, ...yr] =>
    match mk_eq_g(x, y, b) { (e, b1) => match mkm(acc, e, b1) { (acc2, b2) => eqfold_g(xr, yr, acc2, b2) } } } }
fn mk_eq_wide(vx: List<Int>, vy: List<Int>, b: Build) : (Int, Build) =
  if ilenI(vx) == ilenI(vy)
  then (if ilenI(vx) == 1 then mk_eq_g(vhi(vx), vhi(vy), b)
        else match mkc(glit(1), b) { (one, b1) => eqfold_g(vx, vy, one, b1) })
  else mkc(glit(0), b)
# reference (heval/seval) structural equality on bignum-wire values, matching mk_eq_wide.
fn alleq_v(vx: List<List<Int>>, vy: List<List<Int>>) : Bool =
  match vx { [] => true; [x, ...xr] => match vy { [] => true; [y, ...yr] => if bn_is_zero(fsub(x, y)) then alleq_v(xr, yr) else false } }
fn vals_eq(vx: List<List<Int>>, vy: List<List<Int>>) : Bool = if llen(vx) == llen(vy) then alleq_v(vx, vy) else false
# substring bounds must be STATIC (literals, +,-,*, string_length of a var/literal) — the circuit
# slice offset is build-time. cval_h evaluates a bound from heval/seval values; cval_c from cgen wires.
fn cg_width_c(s: Expr, cenv: List<Pair<String, List<Int>>>) : Int = match s { EVar(x) => ilenI(cenv_get(cenv, x)); EStr(t) => string_length(t); _ => error("glass prove: string_length expects a string variable or literal in a substring bound") }
fn cval_c(e: Expr, cenv: List<Pair<String, List<Int>>>) : Int =
  match e { EInt(n) => n;
    EAdd(a, b) => cval_c(a, cenv) + cval_c(b, cenv); ESub(a, b) => cval_c(a, cenv) - cval_c(b, cenv); EMul(a, b) => cval_c(a, cenv) * cval_c(b, cenv);
    EApp(f, a) => match unwind_app(EApp(f, a), []) { (hd, args) => match hd { EVar(nm) => if nm == "string_length" then (match args { [s] => cg_width_c(s, cenv); _ => error("glass prove: string_length expects 1 argument") }) else error("glass prove: a substring bound may only use literals, + - *, and string_length"); _ => error("glass prove: a substring bound may only use literals, + - *, and string_length") } };
    _ => error("glass prove: a substring bound must be a STATIC expression (literals, + - *, string_length) — a witness-dependent slice cannot lower to a fixed circuit") }
fn cg_width_h(s: Expr, env: List<Pair<String, List<List<Int>>>>) : Int = match s { EVar(x) => llen(heg(env, x)); EStr(t) => string_length(t); _ => error("glass prove: string_length expects a string variable or literal in a substring bound") }
fn cval_h(e: Expr, env: List<Pair<String, List<List<Int>>>>) : Int =
  match e { EInt(n) => n;
    EAdd(a, b) => cval_h(a, env) + cval_h(b, env); ESub(a, b) => cval_h(a, env) - cval_h(b, env); EMul(a, b) => cval_h(a, env) * cval_h(b, env);
    EApp(f, a) => match unwind_app(EApp(f, a), []) { (hd, args) => match hd { EVar(nm) => if nm == "string_length" then (match args { [s] => cg_width_h(s, env); _ => error("glass prove: string_length expects 1 argument") }) else error("glass prove: a substring bound may only use literals, + - *, and string_length"); _ => error("glass prove: a substring bound may only use literals, + - *, and string_length") } };
    _ => error("glass prove: a substring bound must be a STATIC expression (literals, + - *, string_length) — a witness-dependent slice cannot lower to a fixed circuit") }

# --- ordering comparisons (< > <= >=) — sound, range-bounded gadget --------
# A field comparison a<b is meaningful only if BOTH operands are PROVABLY in
# [0, 2^k) with 2^(k+1) < p, so d = a - b + 2^k never wraps mod p (Goldilocks
# p = 2^64-2^32+1; k=32 => 2^33 << p). cmp_bits_loop allocates k INLINE hint
# bits (mkh reads the operand's runtime value via bwire), constrains each
# boolean (wb*wb - wb == 0 via mke), and binds Σ bitᵢ·2ⁱ to the operand (range_k)
# or returns the captured sign bit (decompose_capture). An operand outside
# [0,2^k) makes the weighted-sum binding UNSATISFIABLE => honest REJECT, never a
# wrong ACCEPT. This NARROWS the v5.52 loud refusal, never replaces it with a
# silent wrong proof. (verify_b3 enforces every gate, so the bound is real.)
fn ipow2(i: Int) : Int = if i <= 0 then 1 else 2 * ipow2(i - 1)
fn pow2_lit(i: Int) : List<Int> = glit(ipow2(i))
fn bn_bit(v: List<Int>, i: Int) : Int = (nthI(v, i / 16) / ipow2(i % 16)) % 2
fn in_range_k(v: List<Int>, k: Int) : Bool = bn_cmp(trim(v), glit(ipow2(k))) < 0
fn cmp_ok_g(xa: List<Int>, xb: List<Int>) : Bool = if in_range_k(xa, 32) then in_range_k(xb, 32) else false
# div/mod gadget support: read a small bignum (in [0,2^32)) as a machine Int (base-2^16 limbs),
# the lowerability guard (both operands in [0,2^32) AND divisor != 0), and the integer-result
# literals. Glass `/` `%` here truncate toward zero; with both operands >= 0 that is floor division.
fn bn_small_to_int(v: List<Int>) : Int = nthI(v, 0) + nthI(v, 1) * 65536
fn div_ok_g(xa: List<Int>, xb: List<Int>) : Bool = if cmp_ok_g(xa, xb) then (if bn_is_zero(xb) then false else true) else false
fn gdiv_lit(xa: List<Int>, xb: List<Int>) : List<Int> = glit(bn_small_to_int(xa) / bn_small_to_int(xb))
fn gmod_lit(xa: List<Int>, xb: List<Int>) : List<Int> = glit(bn_small_to_int(xa) - bn_small_to_int(xb) * (bn_small_to_int(xa) / bn_small_to_int(xb)))
fn fnot01(v: List<Int>) : List<Int> = fsub(glit(1), v)
fn cmp_bits_w_go(v: List<Int>, i: Int, k: Int) : List<List<Int>> = if i >= k then [] else [if bn_bit(v, i) == 1 then glit(1) else glit(0)] ++ cmp_bits_w_go(v, i + 1, k)
fn cmp_bits_w(v: List<Int>, k: Int) : List<List<Int>> = cmp_bits_w_go(v, 0, k)
fn cmp_bits_loop(w: Int, i: Int, k: Int, capIdx: Int, acc: Int, cap: Int, b: Build) : (Int, Int, Build) =
  if i >= k then (acc, cap, b)
  else let bv : List<Int> = if bn_bit(bwire(b, w), i) == 1 then glit(1) else glit(0) in
    match mkh(bv, b) { (wb, b1) =>
    match mkm(wb, wb, b1) { (wsq, b2) =>
    match mks(wsq, wb, b2) { (wbm, b3) => let b4 : Build = mke(wbm, b3) in
    match mkc(pow2_lit(i), b4) { (wpow, b5) =>
    match mkm(wpow, wb, b5) { (wterm, b6) =>
    match mka(acc, wterm, b6) { (wacc, b7) =>
      let cap2 : Int = if i == capIdx then wb else cap in
      cmp_bits_loop(w, i + 1, k, capIdx, wacc, cap2, b7) } } } } } }
fn range_k(w: Int, k: Int, b: Build) : Build =
  match mkc(glit(0), b) { (wzero, b0) =>
  match cmp_bits_loop(w, 0, k, 0 - 1, wzero, 0 - 1, b0) { (wsum, ucap, b1) =>
  match mks(wsum, w, b1) { (wdiff, b2) => mke(wdiff, b2) } } }
fn decompose_capture(w: Int, kk: Int, capIdx: Int, b: Build) : (Int, Build) =
  match mkc(glit(0), b) { (wzero, b0) =>
  match cmp_bits_loop(w, 0, kk, capIdx, wzero, 0 - 1, b0) { (wsum, wcap, b1) =>
  match mks(wsum, w, b1) { (wdiff, b2) => let b3 : Build = mke(wdiff, b2) in (wcap, b3) } } }
# --- bitwise logic (bit_and / bit_or / bit_xor) over [0, 2^32) -----------------------------------
# The one integer-operation family the bridge lacked (it has +,-,*, /,%, comparison, signed). The
# language already exposes bit_and/bit_or/bit_xor as builtins; here they lower to a circuit that
# reuses the SAME bit-decomposition the range gadget uses (each bit pinned boolean wb^2-wb==0 and the
# weighted sum bound to the operand), combines the two operands' bits per position, and recomposes.
# Sound: the bits are the operand's TRUE bits (an out-of-range operand makes the bind unsatisfiable —
# guarded to ABSTAIN at heval/seval, never a wrong proof). Per bit (over 0/1 values): AND = a*b,
# OR = a+b-a*b, XOR = (a-b)^2 (= a+b-2ab). Result is a fresh wire = Σ 2^i (a_i op b_i), in [0,2^32),
# matching the int64 builtin for non-negative operands (so the Third Witness agrees).
fn is_bitop(n: String) : Bool = (n == "bit_and") || (n == "bit_or") || (n == "bit_xor")
# value side (shared by heval/seval, pure bit arithmetic — no native bitwise builtin needed, and it
# computes EXACTLY what the circuit computes, so the witness matches).
fn bv_bit(op: String, ai: Int, bi: Int) : Int =
  if op == "bit_and" then ai * bi else if op == "bit_or" then ai + bi - ai * bi else ai + bi - 2 * ai * bi
fn bitop_val_go(op: String, xa: List<Int>, xb: List<Int>, i: Int, k: Int) : List<Int> =
  if i >= k then glit(0)
  else fadd(if bv_bit(op, bn_bit(xa, i), bn_bit(xb, i)) == 1 then pow2_lit(i) else glit(0), bitop_val_go(op, xa, xb, i + 1, k))
fn bitop_val(op: String, xa: List<Int>, xb: List<Int>) : List<Int> = bitop_val_go(op, xa, xb, 0, 32)
# circuit side: decompose a wire into k boolean-pinned bit wires + bind Σ 2^i bit_i == the wire.
fn dbits_go(w: Int, i: Int, k: Int, b: Build) : (List<Int>, Build) =
  if i >= k then ([], b)
  else let bv : List<Int> = if bn_bit(bwire(b, w), i) == 1 then glit(1) else glit(0) in
    match mkh(bv, b) { (wb, b1) => match mkm(wb, wb, b1) { (wsq, b2) => match mks(wsq, wb, b2) { (wbm, b3) =>
    let b4 : Build = mke(wbm, b3) in match dbits_go(w, i + 1, k, b4) { (rest, b5) => ([wb] ++ rest, b5) } } } }
fn bsum_go(bits: List<Int>, i: Int, b: Build) : (Int, Build) =
  match bits { [] => mkc(glit(0), b); [wb, ...r] =>
    match mkc(pow2_lit(i), b) { (wp, b1) => match mkm(wp, wb, b1) { (wt, b2) =>
    match bsum_go(r, i + 1, b2) { (wrest, b3) => mka(wt, wrest, b3) } } } }
fn decompose_bits(w: Int, k: Int, b: Build) : (List<Int>, Build) =
  match dbits_go(w, 0, k, b) { (bits, b1) => match bsum_go(bits, 0, b1) { (wsum, b2) =>
    match mks(wsum, w, b2) { (wd, b3) => let b4 : Build = mke(wd, b3) in (bits, b4) } } }
fn bit1(op: String, a0: Int, b0: Int, b: Build) : (Int, Build) =
  if op == "bit_and" then mkm(a0, b0, b)
  else if op == "bit_or" then (match mka(a0, b0, b) { (s, b1) => match mkm(a0, b0, b1) { (p, b2) => mks(s, p, b2) } })
  else (match mks(a0, b0, b) { (d, b1) => mkm(d, d, b1) })
fn bitcombine_go(op: String, ba: List<Int>, bb: List<Int>, b: Build) : (List<Int>, Build) =
  match ba { [] => ([], b); [a0, ...ar] => match bb { [] => ([], b); [b0, ...br] =>
    match bit1(op, a0, b0, b) { (wc, b1) => match bitcombine_go(op, ar, br, b1) { (rest, b2) => ([wc] ++ rest, b2) } } } }
fn cgen_bitop(op: String, args: List<Expr>, cenv: List<Pair<String, List<Int>>>, fns: List<FnDecl>, types: List<TypeDecl>, b: Build) : (List<Int>, Build) =
  match args { [ea, eb] =>
    match cgen(ea, cenv, fns, types, b) { (va, b1) => match cgen(eb, cenv, fns, types, b1) { (vb, b2) =>
    match decompose_bits(vhi(va), 32, b2) { (bits_a, b3) => match decompose_bits(vhi(vb), 32, b3) { (bits_b, b4) =>
    match bitcombine_go(op, bits_a, bits_b, b4) { (cbits, b5) => match bsum_go(cbits, 0, b5) { (wr, b6) => ([wr], b6) } } } } } };
    _ => error("glass prove: bitwise '" ++ op ++ "' expects exactly 2 arguments") }
fn heval_bitop(op: String, args: List<Expr>, env: List<Pair<String, List<List<Int>>>>, fns: List<FnDecl>, types: List<TypeDecl>) : (List<List<Int>>, List<List<Int>>) =
  match args { [ea, eb] =>
    match heval(ea, env, fns, types) { (va, ha) => match heval(eb, env, fns, types) { (vb, hb) =>
    let xa : List<Int> = vh(va) in let xb : List<Int> = vh(vb) in
    if cmp_ok_g(xa, xb) then ([bitop_val(op, xa, xb)], ha ++ hb)
    else error("glass prove: bitwise '" ++ op ++ "' operands must be in [0,2^32) — out of range, ABSTAIN (never a wrong proof)") } };
    _ => error("glass prove: bitwise '" ++ op ++ "' expects exactly 2 arguments") }
fn seval_bitop(op: String, args: List<Expr>, env: List<Pair<String, List<List<Int>>>>, fns: List<FnDecl>, types: List<TypeDecl>, fenv: List<Pair<String, String>>, fuel: Int) : List<List<Int>> =
  match args { [ea, eb] =>
    let xa : List<Int> = vh(seval(ea, env, fns, types, fenv, fuel)) in
    let xb : List<Int> = vh(seval(eb, env, fns, types, fenv, fuel)) in
    if cmp_ok_g(xa, xb) then [bitop_val(op, xa, xb)]
    else error("glass prove: bitwise '" ++ op ++ "' operands must be in [0,2^32) — out of range, ABSTAIN (never a wrong proof)");
    _ => error("glass prove: bitwise '" ++ op ++ "' expects exactly 2 arguments") }
# lt_build: a 0/1 wire = (value(wx) < value(wy)), after PROVING both ∈ [0,2^k).
fn lt_build(wx: Int, wy: Int, b: Build) : (Int, Build) =
  let b1 : Build = range_k(wx, 32, b) in
  let b2 : Build = range_k(wy, 32, b1) in
  match mks(wx, wy, b2) { (wxy, b3) =>
  match mkc(pow2_lit(32), b3) { (wk, b4) =>
  match mka(wxy, wk, b4) { (wd, b5) =>
  match decompose_capture(wd, 33, 32, b5) { (wbitk, b6) =>
  match mkc(glit(1), b6) { (wone, b7) =>
  match mks(wone, wbitk, b7) { (wlt, b8) => (wlt, b8) } } } } } }
# divmod_build: integer division/modulo as a circuit via the defining identity a = b*q + r, 0 <= r < b.
# q,r are advice (mkh), pinned by: range_k(q), range_k(r) (both in [0,2^32)); the multiply-add identity
# a == b*q + r; and r < b — but the r < b assert is PREDICATED on an in-circuit `b != 0` bit (nz). When
# b != 0 (nz=1) r < b is enforced, so the divisor is forced >= 1 and (q,r) is the unique integer
# division (products stay < the Goldilocks prime since q,b,r < 2^32, so field == integer identity).
# When b == 0 (nz=0) the r < b assert goes VACUOUS (nz*(1-(r<b)) == 0 holds for nz=0) and the identity
# reduces to a == r — a SATISFIABLE sub-circuit. This is the predication paradigm shift: a divide-by-
# zero in a DEAD branch (cgen builds both `if` arms) no longer poisons the circuit — the mux discards
# its garbage q, and the live result proves. A LIVE divide-by-zero is still refused by the seval guard
# (it short-circuits to the taken path and abstains on b==0). nz is computed from b in-circuit (mk_eq_g
# is-zero, sound BOTH directions: wz*wd==0 forces wz=0 when b!=0, and wz is a computed wire forced to 1
# when b==0), so it cannot be faked in either direction. The b==0 witness is UNIQUE (v5.131 defense-in-
# depth, the forgery-resistance audit's one finding): isz*q == 0 pins q=0 when b==0, so the identity
# then forces r=a — without this pin q was a free [0,2^32) advice in the b==0 sub-circuit, and any
# future call path reaching verify_b3 with a LIVE b==0 could have claimed an arbitrary quotient for
# a/0. In-circuit semantics is now total and deterministic: a/0 = 0, a%0 = a (matching the honest hint
# below, so every existing witness still satisfies it). No verify_b3/Pentecost change — pure
# GMul+GEqZero predication in the existing gate model.
fn divmod_build(wa: Int, wb: Int, b: Build) : (Int, Int, Build) =
  let ai : Int = bn_small_to_int(bwire(b, wa)) in
  let bi : Int = bn_small_to_int(bwire(b, wb)) in
  let qi : Int = if bi <= 0 then 0 else ai / bi in
  let ri : Int = ai - bi * qi in
  match mkh(glit(qi), b) { (wq, b1) =>
  match mkh(glit(ri), b1) { (wr, b2) =>
  let b3 : Build = range_k(wq, 32, b2) in
  let b4 : Build = range_k(wr, 32, b3) in
  match mkm(wb, wq, b4) { (wbq, b5) =>
  match mka(wbq, wr, b5) { (wsum, b6) =>
  match mks(wa, wsum, b6) { (wdiff, b7) =>
  let b8 : Build = mke(wdiff, b7) in
  match mkc(glit(0), b8) { (wzero, b9) =>
  match mk_eq_g(wb, wzero, b9) { (wisz, b10) =>
  match mkc(glit(1), b10) { (wone, b11) =>
  match mks(wone, wisz, b11) { (wnz, b12) =>
  match lt_build(wr, wb, b12) { (wlt, b13) =>
  match mks(wone, wlt, b13) { (wd2, b14) =>
  match mkm(wnz, wd2, b14) { (wg, b15) =>
  let b16 : Build = mke(wg, b15) in
  match mkm(wisz, wq, b16) { (wqz, b17) =>
  let b18 : Build = mke(wqz, b17) in
  (wq, wr, b18) } } } } } } } } } } } } }

fn cgen(e: Expr, cenv: List<Pair<String, List<Int>>>, fns: List<FnDecl>, types: List<TypeDecl>, b: Build) : (List<Int>, Build) =
  match e {
    EInt(n) => match mkc(gin(n), b) { (w, b1) => ([w], b1) };
    EBool(tf) => match mkc(if tf then glit(1) else glit(0), b) { (w, b1) => ([w], b1) };
    EVar(x) => (cenv_get(cenv, x), b);
    EAdd(x, y) => match cgen(x, cenv, fns, types, b) { (vx, b1) => match cgen(y, cenv, fns, types, b1) { (vy, b2) => match mka(vhi(vx), vhi(vy), b2) { (wo, b3) => ([wo], b3) } } };
    ESub(x, y) => match cgen(x, cenv, fns, types, b) { (vx, b1) => match cgen(y, cenv, fns, types, b1) { (vy, b2) => match mks(vhi(vx), vhi(vy), b2) { (wo, b3) => ([wo], b3) } } };
    EMul(x, y) => match cgen(x, cenv, fns, types, b) { (vx, b1) => match cgen(y, cenv, fns, types, b1) { (vy, b2) => match mkm(vhi(vx), vhi(vy), b2) { (wo, b3) => ([wo], b3) } } };
    EEq(x, y) => match cgen(x, cenv, fns, types, b) { (vx, b1) => match cgen(y, cenv, fns, types, b1) { (vy, b2) => match mk_eq_wide(vx, vy, b2) { (wo, b3) => ([wo], b3) } } };
    ENeq(x, y) => match cgen(x, cenv, fns, types, b) { (vx, b1) => match cgen(y, cenv, fns, types, b1) { (vy, b2) => match mk_eq_wide(vx, vy, b2) { (weq, b3) => match mkc(glit(1), b3) { (wone, b4) => match mks(wone, weq, b4) { (wo, b5) => ([wo], b5) } } } } };
    EAnd(x, y) => match cgen(x, cenv, fns, types, b) { (vx, b1) => match cgen(y, cenv, fns, types, b1) { (vy, b2) => match mkm(vhi(vx), vhi(vy), b2) { (wo, b3) => ([wo], b3) } } };
    EOr(x, y) => match cgen(x, cenv, fns, types, b) { (vx, b1) => match cgen(y, cenv, fns, types, b1) { (vy, b2) => match mka(vhi(vx), vhi(vy), b2) { (ws, b3) => match mkm(vhi(vx), vhi(vy), b3) { (wp, b4) => match mks(ws, wp, b4) { (wo, b5) => ([wo], b5) } } } } };
    EUNot(x) => match cgen(x, cenv, fns, types, b) { (vx, b1) => match mkc(glit(1), b1) { (wone, b2) => match mks(wone, vhi(vx), b2) { (wo, b3) => ([wo], b3) } } };
    EIf(c, t, f) => match cgen(c, cenv, fns, types, b) { (vc, b1) => match cgen(t, cenv, fns, types, b1) { (vt, b2) => match cgen(f, cenv, fns, types, b2) { (vf, b3) => mux_if(vhi(vc), t, f, vt, vf, b3) } } };
    ELet(nm, v, body) => match cgen(v, cenv, fns, types, b) { (vv, b1) => cgen(body, [Pair(nm, vv)] ++ cenv, fns, types, b1) };
    ECtor(name, args) => match mkc(glit(ctag(types, name)), b) { (wtag, b1) => match cgen_fields(args, ctor_argtypes(types, name), cenv, fns, types, b1) { (fws, b2) => ([wtag] ++ fws, b2) } };
    ETuple(elems) => cgen_fields(elems, scalar_types_e(elems), cenv, fns, types, b);
    ENamedRec(nm, lit) => cgen_fields(reorder_rec(rec_fnames(find_record(types, nm)), lit), rec_ftypes(find_record(types, nm)), cenv, fns, types, b);
    EField(recd, f) => error("glass prove: could not resolve the record TYPE for field access (." ++ f ++ ") — direct `r.field` lowers when the record's type is inferable; otherwise destructure with a pattern: match r { T { " ++ f ++ " } => " ++ f ++ " }. ABSTAIN.");
    EStr(s) => estr_c(str_codes(s), b);
    EConcat(x, y) => match cgen(x, cenv, fns, types, b) { (vx, b1) => match cgen(y, cenv, fns, types, b1) { (vy, b2) => (vx ++ vy, b2) } };
    EApp(f, a) => match unwind_app(EApp(f, a), []) { (hd, args) => match hd { EVar(fname) => if is_strfn(fname) then cgen_strfn(fname, args, cenv, fns, types, b) else if is_bitop(fname) then cgen_bitop(fname, args, cenv, fns, types, b) else cgen_call(fn_body_of(fns, fname), args, [], cenv, fns, types, b); _ => error("glass prove: unsupported call form (computed or higher-order callee) in cgen — refusing rather than silently building a 0 circuit") } };
    EMatch(scrut, arms) => match cgen(scrut, cenv, fns, types, b) { (sv, b1) => match mkc(glit(0), b1) { (zm, b2) => cgen_match(arms, sv, cenv, fns, types, zm, [], b2) } };
    ELt(x, y) => match cgen(x, cenv, fns, types, b) { (vx, b1) => match cgen(y, cenv, fns, types, b1) { (vy, b2) => match lt_build(vhi(vx), vhi(vy), b2) { (wlt, b3) => ([wlt], b3) } } };
    EGt(x, y) => match cgen(x, cenv, fns, types, b) { (vx, b1) => match cgen(y, cenv, fns, types, b1) { (vy, b2) => match lt_build(vhi(vy), vhi(vx), b2) { (wlt, b3) => ([wlt], b3) } } };
    ELe(x, y) => match cgen(x, cenv, fns, types, b) { (vx, b1) => match cgen(y, cenv, fns, types, b1) { (vy, b2) => match lt_build(vhi(vy), vhi(vx), b2) { (wlt, b3) => match mkc(glit(1), b3) { (wone, b4) => match mks(wone, wlt, b4) { (wo, b5) => ([wo], b5) } } } } };
    EGe(x, y) => match cgen(x, cenv, fns, types, b) { (vx, b1) => match cgen(y, cenv, fns, types, b1) { (vy, b2) => match lt_build(vhi(vx), vhi(vy), b2) { (wlt, b3) => match mkc(glit(1), b3) { (wone, b4) => match mks(wone, wlt, b4) { (wo, b5) => ([wo], b5) } } } } };
    EDiv(x, y) => match cgen(x, cenv, fns, types, b) { (vx, b1) => match cgen(y, cenv, fns, types, b1) { (vy, b2) => match divmod_build(vhi(vx), vhi(vy), b2) { (wq, wr, b3) => ([wq], b3) } } };
    EMod(x, y) => match cgen(x, cenv, fns, types, b) { (vx, b1) => match cgen(y, cenv, fns, types, b1) { (vy, b2) => match divmod_build(vhi(vx), vhi(vy), b2) { (wq, wr, b3) => ([wr], b3) } } };
    _ => error("glass prove: unsupported expression in the prove bridge (cgen) — only + - * == != && || ! < > <= >= / % (range-bounded) and if/let/match/ADT/calls lower to the field circuit; strings and records are refused, not silently built as a 0 circuit") }
fn cgen_fields(args: List<Expr>, tys: List<Type>, cenv: List<Pair<String, List<Int>>>, fns: List<FnDecl>, types: List<TypeDecl>, b: Build) : (List<Int>, Build) =
  match args { [] => ([], b); [a, ...arest] => match tys { [] => ([], b); [t, ...trest] =>
    match cgen(a, cenv, fns, types, b) { (va, b1) => let _ : Bool = assert_field_fits(ilenI(va), twidth(t, types, 12), has_more_e(arest)) in match padv_g(va, twidth(t, types, 12), b1) { (pva, b2) =>
    match cgen_fields(arest, trest, cenv, fns, types, b2) { (vr, b3) => (pva ++ vr, b3) } } } } }
fn cgen_call(body: Expr, args: List<Expr>, ccenv: List<Pair<String, List<Int>>>, fcenv: List<Pair<String, List<Int>>>, fns: List<FnDecl>, types: List<TypeDecl>, b: Build) : (List<Int>, Build) =
  match body { ELam(p, inner) => match args { [] => cgen(body, ccenv, fns, types, b); [a, ...rest] => match cgen(a, fcenv, fns, types, b) { (va, b1) => cgen_call(inner, rest, [Pair(p, va)] ++ ccenv, fcenv, fns, types, b1) } }; _ => cgen(body, ccenv, fns, types, b) }
# string intrinsics in the circuit generator: string_length -> a GConst of the (static) wire count;
# substring -> a static slice of the operand's wire indices (no gate, the wires already exist).
fn cgen_strfn(fname: String, args: List<Expr>, cenv: List<Pair<String, List<Int>>>, fns: List<FnDecl>, types: List<TypeDecl>, b: Build) : (List<Int>, Build) =
  if fname == "string_length"
  then (match args { [s] => match cgen(s, cenv, fns, types, b) { (sv, b1) => match mkc(glit(ilenI(sv)), b1) { (w, b2) => ([w], b2) } }; _ => error("glass prove: string_length expects exactly 1 argument") })
  else (match args { [s, lo, hi] => match cgen(s, cenv, fns, types, b) { (sv, b1) => match substr_bounds(cval_c(lo, cenv), cval_c(hi, cenv), ilenI(sv)) { (a, bb) => (slwi(sv, a, bb - a), b1) } }; _ => error("glass prove: substring expects exactly 3 arguments") })
fn psel(p: Pattern, sv: List<Int>, types: List<TypeDecl>, b: Build) : (Int, Build) =
  match p { PWild => mkc(glit(1), b); PVar(x) => mkc(glit(1), b);
    PInt(n) => match mkc(glit(n), b) { (wn, b1) => mk_eq_g(vhi(sv), wn, b1) };
    PBool(bb) => match mkc(if bb then glit(1) else glit(0), b) { (wn, b1) => mk_eq_g(vhi(sv), wn, b1) };
    PCtor(nm, ps) => match mkc(glit(ctag(types, nm)), b) { (wn, b1) => match mk_eq_g(vhi(sv), wn, b1) { (s0, b2) => psel_fields(ps, ctor_argtypes(types, nm), sv, 1, types, s0, b2) } };
    PTuple(ps) => match mkc(glit(1), b) { (one, b1) => psel_fields(ps, scalar_types_p(ps), sv, 0, types, one, b1) };
    PStr(s) => match estr_c(str_codes(s), b) { (litws, b1) => mk_eq_wide(sv, litws, b1) };   # v5.102: string-literal arm selects by multi-wire codepoint equality
    PRecord(nm, fs) => mkc(glit(1), b) }
fn psel_fields(ps: List<Pattern>, tys: List<Type>, sv: List<Int>, off: Int, types: List<TypeDecl>, acc: Int, b: Build) : (Int, Build) =
  match ps { [] => (acc, b); [p, ...prest] => match tys { [] => (acc, b); [t, ...trest] =>
    let wt : Int = twidth(t, types, 12) in match psel(p, slwi(sv, off, wt), types, b) { (s, b1) => match mkm(acc, s, b1) { (acc2, b2) => psel_fields(prest, trest, sv, off + wt, types, acc2, b2) } } } }
fn cbind(p: Pattern, sv: List<Int>, types: List<TypeDecl>, cenv: List<Pair<String, List<Int>>>) : List<Pair<String, List<Int>>> =
  match p { PVar(x) => [Pair(x, sv)] ++ cenv; PCtor(nm, ps) => cbind_fields(ps, ctor_argtypes(types, nm), sv, 1, types, cenv); PWild => cenv; PInt(n) => cenv; PBool(bb) => cenv; PTuple(ps) => cbind_fields(ps, scalar_types_p(ps), sv, 0, types, cenv); PStr(s) => cenv; PRecord(nm, fs) => cbind_rec(find_record(types, nm), fs, sv, 0, types, cenv) }
fn cbind_fields(ps: List<Pattern>, tys: List<Type>, sv: List<Int>, off: Int, types: List<TypeDecl>, cenv: List<Pair<String, List<Int>>>) : List<Pair<String, List<Int>>> =
  match ps { [] => cenv; [p, ...prest] => match tys { [] => cenv; [t, ...trest] =>
    let wt : Int = twidth(t, types, 12) in cbind_fields(prest, trest, sv, off + wt, types, cbind(p, slwi(sv, off, wt), types, cenv)) } }
# accw accumulates each match arm's body wires, weighted by its 0/1 effective selector `eff`, into the
# running `result` (the muxed value). v5.121: when an arm body is SHORTER than the accumulated result
# (unequal-width string arms), KEEP the result tail — `[] => (result, b)` — instead of the old
# `([], b)` that TRUNCATED it to the shorter arm and silently proved a CORRUPTED string (e.g.
# `match s { 0 => "approved"; _ => "no" }` at s=0 attested "ap"). With the tail kept, an unmatched
# arm's positions stay 0 (NUL) and decode_str stops there, so the matched arm decodes to its true text.
# Equal-width arms (every ADT/tuple/scalar match, and equal-length string arms) are byte-identical: the
# longer/shorter cases never trigger, so this is a pure fix to the unequal-width path.
fn accw(result: List<Int>, eff: Int, body: List<Int>, b: Build) : (List<Int>, Build) =
  match body { [] => (result, b); [bi, ...br] => match mkm(eff, bi, b) { (contrib, b1) =>
    match result { [] => match accw([], eff, br, b1) { (rest, b2) => ([contrib] ++ rest, b2) };
      [ri, ...rr] => match mka(ri, contrib, b1) { (nri, b2) => match accw(rr, eff, br, b2) { (rest, b3) => ([nri] ++ rest, b3) } } } } }
fn cgen_match(arms: List<Pair<Pattern, Expr>>, sv: List<Int>, cenv: List<Pair<String, List<Int>>>, fns: List<FnDecl>, types: List<TypeDecl>, matched: Int, result: List<Int>, b: Build) : (List<Int>, Build) =
  match arms { [] => (result, b);
    [Pair(p, body), ...rest] =>
      match psel(p, sv, types, b) { (sel, b1) => match mkc(glit(1), b1) { (one, b2) => match mks(one, matched, b2) { (notm, b3) =>
      match mkm(sel, notm, b3) { (eff, b4) => match cgen(body, cbind(p, sv, types, cenv), fns, types, b4) { (vb, b5) =>
      match accw(result, eff, vb, b5) { (nres, b6) => match mka(matched, eff, b6) { (nm, b7) => cgen_match(rest, sv, cenv, fns, types, nm, nres, b7) } } } } } } } }
# cgen-as-reference: build the circuit, read the output wires' witness values (must equal heval)
fn wmap(ws: List<Int>, w: List<List<Int>>) : List<List<Int>> = match ws { [] => []; [i, ...r] => [wnth(w, i)] ++ wmap(r, w) }
fn cref(src: String) : List<List<Int>> = match parse_prog(src) { Program(types, fns, main) =>
  match cgen(unroll(main, fns, [], unroll_fuel(0)), [], fns, types, Build(0, [], [])) { (outws, b) => match b { Build(n, gs, w) => wmap(outws, w) } } }

# lower a call-free arithmetic Expr to gates; returns (output wire index, Build)
fn cg(e: Expr, env: List<Pair<String, Int>>, b: Build) : (Int, Build) =
  match e {
    EInt(n) => mkc(gin(n), b);
    EVar(x) => (env_get2(env, x), b);
    EAdd(x, y) => match cg(x, env, b) { (wx, b1) => match cg(y, env, b1) { (wy, b2) => mka(wx, wy, b2) } };
    ESub(x, y) => match cg(x, env, b) { (wx, b1) => match cg(y, env, b1) { (wy, b2) => mks(wx, wy, b2) } };
    EMul(x, y) => match cg(x, env, b) { (wx, b1) => match cg(y, env, b1) { (wy, b2) => mkm(wx, wy, b2) } };
    # a == b  ->  is-zero gadget on d = a - b. inv is a free hint (d^-1, or 0 when d=0);
    # then di = d*inv, z = 1 - di, and the assert z*d == 0 forces z = (d==0). z is 0/1.
    EEq(x, y) => match cg(x, env, b) { (wx, b1) => match cg(y, env, b1) { (wy, b2) =>
      match mks(wx, wy, b2) { (wd, b3) =>
        let dv : List<Int> = bwire(b3, wd) in
        let iv : List<Int> = if bn_is_zero(dv) then glit(0) else finv(dv) in
        match mkh(iv, b3) { (winv, b4) =>
          match mkm(wd, winv, b4) { (wdi, b5) =>
            match mkc(glit(1), b5) { (wone, b6) =>
              match mks(wone, wdi, b6) { (wz, b7) =>
                match mkm(wz, wd, b7) { (wzd, b8) => (wz, mke(wzd, b8)) } } } } } } } };
    # a != b  ->  1 - (a == b), reusing the is-zero gadget (z is 0/1).
    ENeq(x, y) => match cg(x, env, b) { (wx, b1) => match cg(y, env, b1) { (wy, b2) =>
      match mks(wx, wy, b2) { (wd, b3) =>
        let dv : List<Int> = bwire(b3, wd) in
        let iv : List<Int> = if bn_is_zero(dv) then glit(0) else finv(dv) in
        match mkh(iv, b3) { (winv, b4) =>
          match mkm(wd, winv, b4) { (wdi, b5) =>
            match mkc(glit(1), b5) { (wone, b6) =>
              match mks(wone, wdi, b6) { (wz, b7) =>
                match mkm(wz, wd, b7) { (wzd, b8) =>
                  let b9 : Build = mke(wzd, b8) in
                  match mkc(glit(1), b9) { (wone2, b10) => mks(wone2, wz, b10) } } } } } } } } };
    # boolean ops on 0/1 wires: a && b = a*b ; a || b = a+b - a*b ; !a = 1 - a
    EAnd(x, y) => match cg(x, env, b) { (wx, b1) => match cg(y, env, b1) { (wy, b2) => mkm(wx, wy, b2) } };
    EOr(x, y) => match cg(x, env, b) { (wx, b1) => match cg(y, env, b1) { (wy, b2) => match mka(wx, wy, b2) { (ws, b3) => match mkm(wx, wy, b3) { (wp, b4) => mks(ws, wp, b4) } } } };
    EUNot(x) => match cg(x, env, b) { (wx, b1) => match mkc(glit(1), b1) { (wone, b2) => mks(wone, wx, b2) } };
    # if c then t else f  ->  f + c*(t - f), with c a 0/1 wire (from a comparison)
    EIf(c, t, f) => match cg(c, env, b) { (wc, b1) => match cg(t, env, b1) { (wt, b2) => match cg(f, env, b2) { (wf, b3) =>
      match mks(wt, wf, b3) { (wtf, b4) => match mkm(wc, wtf, b4) { (wctf, b5) => mka(wf, wctf, b5) } } } } };
    ELet(nm, v, body) => match cg(v, env, b) { (wv, b1) => cg(body, [Pair(nm, wv)] ++ env, b1) };
    _ => error("glass prove: unsupported expression in the prove bridge (cg) — only + - * == != && || ! and if/let lower to the scalar field circuit; comparisons (< > <= >=), / %, strings and records are refused, not silently built as a 0 circuit") }
# parse, inline calls, lower; wire 0 = the private input `inp`
fn parse_prog(src: String) : Program = match parse_program(src) { Ok(p) => p; Err(m) => error("glass prove: parse error — " ++ m ++ " (refusing to prove the empty/0 program)") }
fn build_src(src: String, inpv: List<Int>) : (Int, Build) =
  match parse_prog(src) { Program(types, fns, main) =>
    cg(unroll(main, fns, [], unroll_fuel(0)), [Pair("inp", 0)], Build(1, [], [inpv])) }
fn src_result(src: String, inpv: List<Int>) : List<Int> =
  match build_src(src, inpv) { (out, b) => match b { Build(n, gs, w) => wnth(w, out) } }

# --- multi-input: each named private input on its own low wire (0..k-1) -------
# This is what `glass prove --goldilocks <file> a=.. b=..` lowers to: the inputs
# are PRIVATE (kept in the witness), the output wire is the function's result, and
# (for proving) we assert output == the claimed result so a wrong claim is rejected.
fn in_cenv_g(inputs: List<Pair<String, Int>>, i: Int) : List<Pair<String, Int>> =
  match inputs { [] => []; [Pair(nm, v), ...r] => [Pair(nm, i)] ++ in_cenv_g(r, i + 1) }
# gin: bind a machine Int (a CLI input OR an in-program literal) as a CANONICAL Goldilocks field
# element. A negative v is the field element p + v (= p - |v|), built in-field as 0 - |v|
# (gold_sub from zero), NOT the raw two's-complement limbs glit4(-5)=[-5] would give — those are
# non-canonical and break field arithmetic (a=-5; a+1000 used to REJECT instead of proving 995;
# a negative LITERAL like `-40` used to lower to a WRONG comparison — caught by the Third Witness
# as a source<->circuit DIVERGENCE). Non-negative v is unchanged (glit4 == glit on the small
# literals in use), so every existing non-negative prove is byte-identical. This is what lets the
# signed comparison gadget (slt/sle/sgt/sge) take a negative operand: p-|v| + 2^31 lands back in
# [0,2^32) for the existing range gadget. Used by EInt lowering in heval/seval/cgen/cg AND input
# binding in in_vals_g/in_cenv_seval, so all four evaluators agree on the field value of any Int.
fn gin(v: Int) : List<Int> = if v < 0 then fsub(glit4(0), glit4(0 - v)) else glit4(v)
fn in_vals_g(inputs: List<Pair<String, Int>>) : List<List<Int>> =
  match inputs { [] => []; [Pair(nm, v), ...r] => [gin(v)] ++ in_vals_g(r) }
fn iplen(xs: List<Pair<String, Int>>) : Int = match xs { [] => 0; [x, ...r] => 1 + iplen(r) }
fn build_multi(src: String, inputs: List<Pair<String, Int>>) : (Int, Build) =
  match parse_prog(src) { Program(types, fns, main) =>
    cg(unroll(main, fns, [], unroll_fuel(0)), in_cenv_g(inputs, 0), Build(iplen(inputs), [], in_vals_g(inputs))) }
fn gref(src: String, inputs: List<Pair<String, Int>>) : List<Int> =
  match build_multi(src, inputs) { (out, b) => match b { Build(n, gs, w) => wnth(w, out) } }
# bind the claimed result: assert (output - claimedR) == 0 via the is-zero assert gate
fn build_claim(src: String, inputs: List<Pair<String, Int>>, claimedR: List<Int>) : Build =
  match build_multi(src, inputs) { (out, b) =>
    match mkc(claimedR, b) { (wR, b1) => match mks(out, wR, b1) { (wd, b2) => mke(wd, b2) } } }
fn gprove(src: String, inputs: List<Pair<String, Int>>, claimedR: List<Int>, seed: Int) : Bool =
  match build_claim(src, inputs, claimedR) { Build(n, gs, w) => prove_stark(gs, w, seed) }
# --- R1b stage 3: multi-wire prove path (cgen) — proves programs that USE ADTs / STRINGS ---
# v5.101: an input is a MULTI-WIRE value. An Int is the 1-wire case [v]; a STRING is its codepoints
# [c0, c1, ..] (one private wire per character). Each input occupies CONSECUTIVE low wires; ints stay
# 1 wire each, so the wire layout for any all-int program is IDENTICAL to pre-v5.101 (every prior proof
# byte-identical). Codepoints (>= 0) lower via the SAME gin as ints (gin(c) == glit(c)), so one rule
# binds both. ints_to_minput lifts a legacy int-input list into this representation (for the demo).
fn span_w(base: Int, k: Int) : List<Int> = if k <= 0 then [] else [base] ++ span_w(base + 1, k - 1)
fn in_cenv_m(inputs: List<Pair<String, List<Int>>>, base: Int) : List<Pair<String, List<Int>>> =
  match inputs { [] => []; [Pair(nm, vs), ...r] => let k : Int = ilenI(vs) in [Pair(nm, span_w(base, k))] ++ in_cenv_m(r, base + k) }
fn map_gin(vs: List<Int>) : List<List<Int>> = match vs { [] => []; [v, ...r] => [gin(v)] ++ map_gin(r) }
fn min_vals(inputs: List<Pair<String, List<Int>>>) : List<List<Int>> =
  match inputs { [] => []; [Pair(nm, vs), ...r] => map_gin(vs) ++ min_vals(r) }
fn min_iplen(inputs: List<Pair<String, List<Int>>>) : Int = match inputs { [] => 0; [Pair(nm, vs), ...r] => ilenI(vs) + min_iplen(r) }
fn ints_to_minput(xs: List<Pair<String, Int>>) : List<Pair<String, List<Int>>> =
  match xs { [] => []; [Pair(nm, v), ...r] => [Pair(nm, [v])] ++ ints_to_minput(r) }
fn build_multi_m(src: String, inputs: List<Pair<String, List<Int>>>) : (List<Int>, Build) =
  match parse_prog(src) { Program(types, fns, main) =>
    cgen(unroll(main, fns, [], unroll_fuel(0)), in_cenv_m(inputs, 0), fns, types, Build(min_iplen(inputs), [], min_vals(inputs))) }
fn gref_m(src: String, inputs: List<Pair<String, List<Int>>>) : List<List<Int>> =
  match build_multi_m(src, inputs) { (outws, b) => match b { Build(n, gs, w) => wmap(outws, w) } }
# seval's initial env from CLI inputs, matching min_vals's VALUE (gin: glit4 full-width for
# v>=0, canonical p-|v| for v<0) so seval/heval agree with the circuit on large AND negative
# inputs (else a spurious refusal/REJECT near 2^48, or a desync on signed operands). A string
# input binds to its multi-wire codepoint value, so string ops in the guard see the same value.
fn in_cenv_seval(inputs: List<Pair<String, List<Int>>>) : List<Pair<String, List<List<Int>>>> =
  match inputs { [] => []; [Pair(nm, vs), ...r] => [Pair(nm, map_gin(vs))] ++ in_cenv_seval(r) }
# gref_m_checked: the GUARDED result-computation for the CLI prove path. It forces `seval` as a
# fail-closed guard (seval `error`s + exits on over-deep recursion BEFORE any proof is built —
# the let is forced in both interp and native), then returns gref_m's OWN R (the circuit's
# value), so the PROVEN R is byte-identical to the circuit (zero guard/circuit value drift).
# seval's accept-set is a SUBSET of the circuit-faithful set (fuel lockstep + short-circuit), so
# whenever seval does not error, gref_m's R is the exact result. (Bypassing this guard by calling
# gprove_sound directly still proves a truncated circuit — out of the soundness threat model.)
# It then forces a SECOND guard — `heval` on the UNROLLED program — the ALL-BRANCHES domain guard,
# closing the dead-branch case. cgen builds BOTH if-arms / all match-arms into one muxed circuit, so a
# program is faithfully lowerable only if EVERY branch's `/ % < > <= >=` operands are in-domain — not
# just the taken one. heval evaluates all arms and `error`s (ABSTAIN) on any out-of-domain op, so an
# out-of-domain op in a DEAD branch (e.g. `if cond then a else a%0`, cond true) ABSTAINs honestly
# instead of making cgen's circuit UNSATISFIABLE and REJECTing a TRUE statement.
# Why this is safe (no ACCEPTing program regresses): seval runs FIRST and already refuses higher-order
# callees and over-deep recursion, so only first-order, depth-ok programs reach heval; on those, heval
# `error`s EXACTLY when an operand is out-of-range / a divisor is zero — EXACTLY when cgen's gadget is
# unsatisfiable. heval is O(unrolled-AST-size), the same order as cgen, so it adds no complexity class.
# (It does NOT rescue gcd-class programs — a compound recursive arg makes the UNROLL itself exponential,
# so both cgen and heval are slow there regardless; that is a separate frontier, see the roadmap.)
fn gref_m_checked(src: String, inputs: List<Pair<String, List<Int>>>) : List<List<Int>> =
  match parse_prog(src) { Program(types, fns, main) =>
    let _guard : List<List<Int>> = seval(main, in_cenv_seval(inputs), fns, types, [], unroll_fuel(0)) in
    match heval(unroll(main, fns, [], unroll_fuel(0)), in_cenv_seval(inputs), fns, types) { (_hv, _hh) =>
    gref_m(src, inputs) } }
# claim-bind the scalar result (first output component) to claimedR
fn build_claim_m(src: String, inputs: List<Pair<String, List<Int>>>, claimedR: List<Int>) : Build =
  match build_multi_m(src, inputs) { (outws, b) =>
    if ilenI(outws) == 1
    then match mkc(claimedR, b) { (wR, b1) => match mks(vhi(outws), wR, b1) { (wd, b2) => mke(wd, b2) } }
    else error("glass prove: a SCALAR claim reached the binder but the result lowered to a non-scalar wire layout (empty or multi-wire) — ABSTAIN rather than vacuously bind wire 0 (an EMPTY layout makes mks(vhi([])=0, 0)=0, which would ACCEPT an ARBITRARY claim)") }
# --- MULTI-WIRE result claim (v5.110): bind EVERY output wire, not just the first ----------------
# A scalar (Int/Bool) result is one wire; a STRING result is several (one codepoint wire per char).
# build_claim_m above pins only outws[0] — fine for a scalar, but for a string it would publish just
# the first codepoint and SILENTLY DROP the rest (a misleading public claim). bind_outs pins EACH
# output wire to its claimed codepoint with the SAME is-zero gadget (mkc const + mks + mke) the scalar
# path and bind_input use — so the whole string lands in GConst gates as the public statement and
# verify_b3 checks it. No new gate, no verify_b3 / Pentecost change: a multi-wire claim is just more
# is-zero asserts. (Lengths match by construction: claimedRs is the circuit's own output `_rv`.)
fn bind_outs(outws: List<Int>, claimedRs: List<List<Int>>, b: Build) : Build =
  match outws { [] => b; [ow, ...owr] => match claimedRs { [] => b; [cr, ...crr] =>
    match mkc(cr, b) { (wR, b1) => match mks(ow, wR, b1) { (wd, b2) => bind_outs(owr, crr, mke(wd, b2)) } } } }
fn build_claim_mw(src: String, inputs: List<Pair<String, List<Int>>>, claimedRs: List<List<Int>>) : Build =
  match build_multi_m(src, inputs) { (outws, b) =>
    if ilenI(outws) == len(claimedRs) then bind_outs(outws, claimedRs, b)
    else error("glass prove --claim: the claimed string is a different length than the result — cannot bind it; ABSTAIN (a wrong-LENGTH claim is refused, never bound as a matching prefix)") }
# decode a multi-wire string RESULT (codepoint wires) back to text for display. Each wire's small
# field value is its codepoint; the printable-ASCII char is table[code-32] (the inverse of char_code,
# which is 32 + index-into-ascii_tbl). A codepoint outside 32..126 ABSTAINs (never a wrong proof) —
# the same printable bound the lowering enforces, applied on the way out.
fn decode_char(code: Int) : String =
  if code < 32 then error("glass prove: a string result has a non-printable codepoint (< 32) — only 32..126 lower to the field; ABSTAIN")
  else if code > 126 then error("glass prove: a string result has a non-printable codepoint (> 126) — only 32..126 lower to the field; ABSTAIN")
  else substring(ascii_tbl(0), code - 32, code - 31)
# decode_str: render a string result's codepoint wires to text. v5.121: STOP at the first NUL
# (codepoint 0) — the sentinel the unequal-width string mux (mux_if / accw) pads the shorter branch
# with. Real codepoints are 32..126, so 0 is unambiguous and a normal (un-padded) string decodes
# byte-identically (it contains no 0, so the stop never triggers). This is what lets an unequal-width
# `if`/`match` over strings reveal the SELECTED branch's true text rather than its NUL-padded form.
fn decode_str(rv: List<List<Int>>) : String =
  match rv { [] => ""; [w, ...r] => let c : Int = bn_small_to_int(w) in if c == 0 then "" else decode_char(c) ++ decode_str(r) }
fn gprove_m(src: String, inputs: List<Pair<String, List<Int>>>, claimedR: List<Int>, seed: Int) : Bool =
  match build_claim_m(src, inputs, claimedR) { Build(n, gs, w) => prove_stark(gs, w, seed) }
# the multi-wire (string result) FAST self-check: bind every output wire, then the witness self-check.
fn gprove_m_mw(src: String, inputs: List<Pair<String, List<Int>>>, claimedRs: List<List<Int>>, seed: Int) : Bool =
  match build_claim_mw(src, inputs, claimedRs) { Build(n, gs, w) => prove_stark(gs, w, seed) }
# --- SOUND path: prove via prove_b3, then verify with the INDEPENDENT witness-free
# verify_b3 (per-row gate soundness + PLONK grand-product wire consistency). Unlike
# gprove_m/prove_stark (a self-check over the witness, no malicious-prover bound), this
# round-trips through the real verifier — accept ==> the committed trace is a consistent
# satisfying assignment with output == claimedR. NOT zero-knowledge here (the witness is
# opened in the clear); use gprove_zk for hiding. Research-grade + UNAUDITED (see soundness.md).
fn gprove_sound(src: String, inputs: List<Pair<String, List<Int>>>, claimedR: List<Int>) : Bool =
  match build_claim_m(src, inputs, claimedR) { Build(n, gs, w) => verify_b3(gs, prove_b3(gs, w)) }
# the multi-wire (string result) SOUND path: bind every output wire, then the SAME verify_b3.
fn gprove_sound_mw(src: String, inputs: List<Pair<String, List<Int>>>, claimedRs: List<List<Int>>) : Bool =
  match build_claim_mw(src, inputs, claimedRs) { Build(n, gs, w) => verify_b3(gs, prove_b3(gs, w)) }
# --- SOUND + ZERO-KNOWLEDGE: randomized-trace ZK (build_claim_zk pads to targetN with
# random dummy rows that hide the openings) then the same sound verify_b3. Heavy (targetN
# is large so the random rows exceed the ~170 query openings) — opt-in via `--zk`.
fn gprove_zk(src: String, inputs: List<Pair<String, List<Int>>>, claimedR: List<Int>, seed: Int, targetN: Int) : Bool =
  match build_claim_zk(src, inputs, claimedR, seed, targetN) { Build(n, gs, w) => verify_b3(gs, prove_b3(gs, w)) }
# the multi-wire (string result) ZK path: pad the multi-wire claim with random dummy rows, same verify_b3.
fn build_claim_zk_mw(src: String, inputs: List<Pair<String, List<Int>>>, claimedRs: List<List<Int>>, seed: Int, targetN: Int) : Build =
  match build_claim_mw(src, inputs, claimedRs) { Build(n, gs, w) =>
    let k : Int = zk_pad_k(targetN, glen(gs)) in
    Build(n + 3 * k, gs ++ zk_dummy_gates(n, k), w ++ zk_dummy_wit(seed, k, 1)) }
fn gprove_zk_mw(src: String, inputs: List<Pair<String, List<Int>>>, claimedRs: List<List<Int>>, seed: Int, targetN: Int) : Bool =
  match build_claim_zk_mw(src, inputs, claimedRs, seed, targetN) { Build(n, gs, w) => verify_b3(gs, prove_b3(gs, w)) }
# --- PUBLIC INPUTS: pin a chosen input wire to a PUBLIC value, via the same is-zero
# gadget (mkc+mks+mke = assert wire - value == 0). The value lands in a GConst gate, so
# it is part of the public statement (absorbed into stmt_seed) and the verifier checks it.
# This upgrades "R is SOME valid output" to "R = f(THESE public inputs)": a wrong public
# input value makes the bind constraint unsatisfiable -> REJECT.
fn bind_input(wire: Int, value: List<Int>, b: Build) : Build =
  match mkc(value, b) { (wv, b1) => match mks(wire, wv, b1) { (wd, b2) => mke(wd, b2) } }
fn bind_inputs(pubs: List<Pair<Int, List<Int>>>, b: Build) : Build =
  match pubs { [] => b; [Pair(wire, value), ...rest] => bind_inputs(rest, bind_input(wire, value, b)) }
fn build_claim_pub(src: String, inputs: List<Pair<String, List<Int>>>, pubs: List<Pair<Int, List<Int>>>, claimedR: List<Int>) : Build =
  match build_multi_m(src, inputs) { (outws, b) =>
    if ilenI(outws) == 1
    then match mkc(claimedR, b) { (wR, b1) => match mks(vhi(outws), wR, b1) { (wd, b2) => bind_inputs(pubs, mke(wd, b2)) } }
    else error("glass prove: a SCALAR claim reached the public binder but the result lowered to a non-scalar wire layout (empty or multi-wire) — ABSTAIN rather than vacuously bind wire 0") }
# --- ZK via RANDOMIZED TRACE (full integration, the cleaner route): append k dummy
# GAdd(o,a,b) gates on FRESH wires with random satisfying witness (o = a + b). Each is
# sound-NEUTRAL (the gate holds, so the quotient is unaffected; a,b,o are fresh -> sigma
# fixed-points that cancel in the grand product), and fills l,r,o with RANDOM values. With
# k > the ~170-eval leak surface, the query/OOD openings reveal only the random rows, not
# the witness -> HIDING. No degree blowup, no param change; the verifier is UNCHANGED (just
# a larger n). targetN sizes the trace (256 -> ~240 random rows >> 170 openings).
fn zk_dummy_gates(base: Int, k: Int) : List<Gate> = if k <= 0 then [] else [GAdd(base + 2, base, base + 1)] ++ zk_dummy_gates(base + 3, k - 1)
fn zk_dummy_wit(seed: Int, k: Int, i: Int) : List<List<Int>> =
  if k <= 0 then [] else let a : List<Int> = lane0(hashg(glit(seed), glit(2 * i))) in let b : List<Int> = lane0(hashg(glit(seed), glit(2 * i + 1))) in [a, b, fadd(a, b)] ++ zk_dummy_wit(seed, k - 1, i + 1)
# zk_pad_k: how many random dummy rows the ZK trace gets. The hiding argument needs the dummy-row
# count to EXCEED the ~170-value opening surface (2*fri_queries + the OOD/trace openings), so the
# query/OOD openings reveal only random rows, not the witness. The old `targetN - glen(gs)` went
# <= 0 (ZERO hiding) for any circuit with >= targetN gates — silently producing a NON-hiding proof
# still labelled "zero-knowledge" (the v5.118 audit's HIGH finding). Floor it at 256 (> the opening
# surface, with margin) so hiding holds for ANY circuit size; bigger circuits get a bigger (but
# genuinely hiding) ZK proof. The randomness is still an idealized PRG (mask-RNG), an honest-scope
# caveat that stands until retired.
fn zk_pad_k(targetN: Int, ngates: Int) : Int = let kb : Int = targetN - ngates in if kb < 256 then 256 else kb
fn build_claim_zk(src: String, inputs: List<Pair<String, List<Int>>>, claimedR: List<Int>, seed: Int, targetN: Int) : Build =
  match build_claim_m(src, inputs, claimedR) { Build(n, gs, w) =>
    let k : Int = zk_pad_k(targetN, glen(gs)) in
    Build(n + 3 * k, gs ++ zk_dummy_gates(n, k), w ++ zk_dummy_wit(seed, k, 1)) }

# --- PENTECOST SERIALIZER (north-star "let the verifier be two", v5.64.0) --------
# Emit a ProofB3 (+ its gates) as the exact whitespace-separated token stream the INDEPENDENT
# Python re-verifier pentecost/pentecost_verify.py parse() consumes — so a second, non-Glass
# tongue can check the same proof. Grammar (byte-for-byte with parse()): a field element fe =
# `count limb0 limb1 ..` (base-2^16, trimmed); a hash digest = EXACTLY 4 fe (the 4 Poseidon
# lanes via to_lanes — NOT one 16-limb fe); g2 = 2 fe; path = `count` then count hashes; etc.
# NOTE: naive ++ string-building is O(N^2) in token count — fine for the round-trip alignment
# gate on a small circuit; a string-builder / incremental emit is the follow-up for big proofs.
fn emit_int(x: Int) : String = int_to_string(x) ++ " "
fn emit_limbs(xs: List<Int>) : String = match xs { [] => ""; [h, ...t] => emit_int(h) ++ emit_limbs(t) }
fn emit_fe(x: List<Int>) : String = let t : List<Int> = trim(x) in emit_int(len(t)) ++ emit_limbs(t)
fn emit_lanes(ls: List<List<Int>>) : String = match ls { [] => ""; [h, ...t] => emit_fe(h) ++ emit_lanes(t) }
# v5.122.0 proof-size cut (denser hash encoding): a digest = 4 lanes, and a Goldilocks lane is
# ALWAYS < p < 2^64 = at most 4 base-2^16 limbs. So emit a FIXED 16 limbs (4 lanes x pad4l-to-4) and
# DROP the per-lane `count` prefix — the count was a pure length-prefix (emit_fe trims trailing-zero
# high limbs); a zero-padded fixed-16 layout is lossless (rd_hash reconstructs each lane via
# sum(limb_i << 16i) mod p). Measured: hash material is ~94% of a proof and every hash-lane is 4 limbs,
# so the count tokens are pure overhead (always "4") => ~19% fewer tokens on the comparison proof.
# DIGEST-LOCAL: emit_fe / emit_lanes stay count-bearing and BYTE-IDENTICAL for non-hash field elements
# (g2 coords, TLeaf scalar openings, gate constants). Mirrored EXACTLY by rd_hash in pentecost_verify.py.
fn emit_lanes16(ls: List<List<Int>>) : String = match ls { [] => ""; [h, ...t] => emit_limbs(pad4l(first4(h))) ++ emit_lanes16(t) }
fn emit_hash(h: List<Int>) : String = emit_lanes16(to_lanes(h))               # 16-limb hash -> 16 raw base-2^16 limbs (no per-lane count)
fn emit_g2(g: G2) : String = match g { G2(a0, a1) => emit_fe(a0) ++ emit_fe(a1) }
fn emit_hlist(p: List<List<Int>>) : String = match p { [] => ""; [h, ...t] => emit_hash(h) ++ emit_hlist(t) }
fn emit_path(p: List<List<Int>>) : String = emit_int(len(p)) ++ emit_hlist(p)
fn emit_qopen(q: QOpen) : String = match q { QOpen(lx, lmx, p1, p2) => emit_g2(lx) ++ emit_g2(lmx) ++ emit_path(p1) ++ emit_path(p2) }
fn emit_qlist_go(qs: List<QOpen>) : String = match qs { [] => ""; [q, ...t] => emit_qopen(q) ++ emit_qlist_go(t) }
fn emit_qlist(qs: List<QOpen>) : String = emit_int(len(qs)) ++ emit_qlist_go(qs)
fn emit_bopen_go(b: List<List<QOpen>>) : String = match b { [] => ""; [ql, ...t] => emit_qlist(ql) ++ emit_bopen_go(t) }
fn emit_bopen(b: List<List<QOpen>>) : String = emit_int(len(b)) ++ emit_bopen_go(b)
# v5.125: batched FRI opening — per-query opened values (no paths) + one co-path per layer
fn emit_qval(q: QVal) : String = match q { QVal(lx, lmx) => emit_g2(lx) ++ emit_g2(lmx) }
fn emit_qvrow_go(qs: List<QVal>) : String = match qs { [] => ""; [q, ...t] => emit_qval(q) ++ emit_qvrow_go(t) }
fn emit_qvrow(qs: List<QVal>) : String = emit_int(len(qs)) ++ emit_qvrow_go(qs)
fn emit_qvals_go(b: List<List<QVal>>) : String = match b { [] => ""; [row, ...t] => emit_qvrow(row) ++ emit_qvals_go(t) }
fn emit_lcopaths_go(cps: List<List<List<Int>>>) : String = match cps { [] => ""; [cp, ...t] => emit_path(cp) ++ emit_lcopaths_go(t) }
fn emit_bfri(b: BFri) : String = match b { BFri(qvals, lcopaths) =>
  emit_int(qvlen(qvals)) ++ emit_qvals_go(qvals) ++ emit_int(l3len(lcopaths)) ++ emit_lcopaths_go(lcopaths) }
fn emit_g2list_go(gs: List<G2>) : String = match gs { [] => ""; [g, ...t] => emit_g2(g) ++ emit_g2list_go(t) }
fn emit_g2list(gs: List<G2>) : String = emit_int(len(gs)) ++ emit_g2list_go(gs)
fn emit_tleaf(tl: TLeaf) : String = match tl { TLeaf(lj, rj, oj, qj, zj, ljh, rjh, ojh, qjh, zjh) =>
  emit_fe(lj) ++ emit_fe(rj) ++ emit_fe(oj) ++ emit_g2(qj) ++ emit_g2(zj)
  ++ emit_fe(ljh) ++ emit_fe(rjh) ++ emit_fe(ojh) ++ emit_g2(qjh) ++ emit_g2(zjh) }
fn emit_tleaves_go(ts: List<TLeaf>) : String = match ts { [] => ""; [tl, ...t] => emit_tleaf(tl) ++ emit_tleaves_go(t) }
# the batched trace opening: the per-query leaf values, then one shared co-path per trace tree
# (root1-LRO, root3-quotient, root2-Z). A co-path is a count-prefixed hash list (emit_path).
fn emit_topen(tb: TBatch) : String = match tb { TBatch(tleaves, cp1, cp3, cp2) =>
  emit_int(len(tleaves)) ++ emit_tleaves_go(tleaves) ++ emit_path(cp1) ++ emit_path(cp3) ++ emit_path(cp2) }
fn emit_gate(g: Gate) : String = match g {
  GConst(o, c) => emit_int(1) ++ emit_int(o) ++ emit_fe(c);
  GAdd(o, a, b) => emit_int(2) ++ emit_int(o) ++ emit_int(a) ++ emit_int(b);
  GSub(o, a, b) => emit_int(3) ++ emit_int(o) ++ emit_int(a) ++ emit_int(b);
  GMul(o, a, b) => emit_int(4) ++ emit_int(o) ++ emit_int(a) ++ emit_int(b);
  GHint(o) => emit_int(5) ++ emit_int(o);
  GEqZero(a) => emit_int(6) ++ emit_int(a) }
fn emit_gates_go(gs: List<Gate>) : String = match gs { [] => ""; [g, ...t] => emit_gate(g) ++ emit_gates_go(t) }
fn emit_proofb3(gates: List<Gate>, p: ProofB3) : String =
  match p { ProofB3(root1, root2, root3, lz, rz, oz, qz, zz, zwz, broots, bfinal, nonce, bopen, topen) =>
  "GATES " ++ emit_int(len(gates)) ++ emit_gates_go(gates)
  ++ "PROOF " ++ emit_hash(root1) ++ emit_hash(root2) ++ emit_hash(root3)
  ++ emit_g2(lz) ++ emit_g2(rz) ++ emit_g2(oz) ++ emit_g2(qz) ++ emit_g2(zz) ++ emit_g2(zwz)
  ++ emit_roots(broots) ++ emit_g2list(bfinal) ++ emit_int(nonce)
  ++ emit_bfri(bopen) ++ emit_topen(topen) }
fn emit_roots(p: List<List<Int>>) : String = emit_int(len(p)) ++ emit_hlist(p)
# serialize a freshly-built+proven claim (gprove_sound throws ProofB3 away; here we KEEP it)
fn gprove_emit(src: String, inputs: List<Pair<String, List<Int>>>, claimedR: List<Int>) : String =
  match build_claim_m(src, inputs, claimedR) { Build(n, gs, w) => emit_proofb3(gs, prove_b3(gs, w)) }
# the multi-wire (string result) emit: bind every output wire, serialize the SAME ProofB3. The extra
# is-zero asserts are ordinary GConst/GSub/GEqZero gates emit_gate already serializes, so a string-
# VALUED proof rides the same byte-for-byte token stream Pentecost parses — extending the second
# verifier to the multi-wire output shape, no serializer change.
fn gprove_emit_mw(src: String, inputs: List<Pair<String, List<Int>>>, claimedRs: List<List<Int>>) : String =
  match build_claim_mw(src, inputs, claimedRs) { Build(n, gs, w) => emit_proofb3(gs, prove_b3(gs, w)) }

# --- demo --------------------------------------------------------------------
fn show_a(b: Bool) : String = if b then "ACCEPT" else "REJECT"
fn show_b(b: Bool) : String = if b then "yes" else "no"
# SOUNDNESS GATE assertions: turn the printed ACCEPT/REJECT expectations into hard checks.
# A mismatch (an attack that should REJECT but ACCEPTs, or an honest proof that REJECTs)
# aborts the whole run via the loud `error` builtin -> nonzero exit, so soundness can never
# silently regress under a refactor (the grind-no-op / hash-cap lesson, institutionalized).
# Pure (no IO): return the label on success, abort via `error` on a mismatch. Printing is
# done at the top-level call sites (where IO is allowed), keeping these effect-free.
fn expect_accept(label: String, got: Bool) : String = if got then label else error("SOUNDNESS GATE FAILED: " ++ label ++ " expected ACCEPT but got REJECT")
fn expect_reject(label: String, got: Bool) : String = if got then error("SOUNDNESS GATE FAILED: " ++ label ++ " expected REJECT but got ACCEPT") else label
fn show(xs: List<Int>) : String = match trim(xs) { [] => "0"; [h, ...t] => match t { [] => int_to_string(h); _ => int_to_string(h) ++ " (low limb of " ++ int_to_string(len(trim(xs))) ++ ")" } }
let msrc : String = "fn f(a: Int, b: Int, c: Int) : Int = a * b + c\nf(a, b, c)"
let mins : List<Pair<String, Int>> = [Pair("a", 100000), Pair("b", 100000), Pair("c", 99)]
let mins_m : List<Pair<String, List<Int>>> = ints_to_minput(mins)   # v5.101: lift to the multi-wire input model
let mres : List<Int> = gref(msrc, mins)                       # the true result, over Goldilocks
let zk_hide : Bool = zk_hiding(777, 888)                       # ZK blinding hides the witness at openings (fast, no FRI)
let _ : String = print("ZK BLINDING (mechanism): a blinded opening differs from the raw witness AND between masks (hiding): " ++ show_b(zk_hide))
let _ : String = print("  (the full ZK proof — blinded l,r,o,Z through the staged FRI — is the heavy remaining piece; design in docs/tier1-zk-design.md)")
let okm : Bool = gprove(msrc, mins, mres, 11111)              # honest claim -> ACCEPT
let badm : Bool = gprove(msrc, mins, glit(12345), 11111)     # wrong claim -> REJECT
let _ : String = print("--- prove_source_goldilocks_zk.glass: real Glass SOURCE -> a ZK proof over Goldilocks, POSEIDON-hashed ---")
let _ : String = print("source (prism-parsed) -> cgen (multi-input, ==, if) -> committed, F_{p^2}-challenged, query-verified, blinded STARK,")
let _ : String = print("now hashed with the VETTED POSEIDON over Goldilocks (Plonky2-exact, vector-verified) — the educational MiMC is retired.")
let _ : String = print("")
let _ : String = print("  fn f(a, b, c) = a * b + c;  f(a, b, c)   -- a, b, c PRIVATE, over Goldilocks (p = 2^64-2^32+1)")
let _ : String = print("  a=100000, b=100000, c=99  ->  result = " ++ bn_dec(mres) ++ "  (= 10^10 + 99; Baby Bear's 2^31 can't hold this)")
let _ : String = print("  honest claim         -> Poseidon-Merkle-committed, Fiat-Shamir queries verify: " ++ show_a(okm))
let _ : String = print("  wrong claim (R=12345) -> rejected (the output==claim assert breaks): " ++ show_a(badm))
let _ : String = print("")
let _ : String = print("This demo runs the FULL-STRENGTH proof (rho=1/8, coset 16N, 64 queries, real 12-bit grind, ~65-bit provable) + ZK (two seeds),")
let _ : String = print("Poseidon-hashed (~300x MiMC) under the v5.44 GC runtime (~10 MB, no OOM). Run it NATIVELY (run_native.sh / `glass prove`), ~2-3 min;")
let _ : String = print("the reference interpreter is multi-hour for a Poseidon STARK, so the native path is canonical (dogfoods byte-identical there).")
let _ : String = print("Fiat-Shamir now SEEDS the transcript with a digest of the statement (circuit + claimed R), so every challenge depends on it — prover-side")
let _ : String = print("only for now; an independent verifier that re-derives the challenges is the next step. (digest-sensitivity: prove_source_goldilocks_bind_test.glass)")

# --- TIER-1 (WIP) independent-verify scaffolding: round-trip + tamper + the gap ---
let t1b : Build = build_claim_m(msrc, mins_m, mres)
let t1gs : List<Gate> = build_gates(t1b)
let t1w : List<List<Int>> = build_wit(t1b)
let t1pp : Proof = prove_to_proof(t1gs, t1w, 11111)
let t1honest : Bool = verify(t1gs, t1pp)                                      # round-trip: expect ACCEPT
let t1bgs : List<Gate> = build_gates(build_claim_m(msrc, mins_m, glit(12345)))  # a DIFFERENT statement (wrong R)
let t1cross : Bool = verify(t1bgs, t1pp)                                      # proof for t1gs, verified vs t1bgs: expect REJECT
let t1nonce : Bool = verify(t1gs, tamper_nonce(t1pp))                         # tampered nonce: expect REJECT
let t1evil : Bool = verify(t1gs, prove_evil(t1gs))                            # P=0, no witness: ACCEPT = the known gap
let _ : String = print("")
let _ : String = print("TIER-1 (WIP) independent verify() — re-derives all challenges from public gates + proof roots:")
let _ : String = print("  honest round-trip          -> " ++ show_a(t1honest) ++ "   (expect ACCEPT)")
let _ : String = print("  cross-statement (wrong R)  -> " ++ show_a(t1cross) ++ "   (expect REJECT)")
let _ : String = print("  tampered nonce             -> " ++ show_a(t1nonce) ++ "   (expect REJECT)")
let _ : String = print("  P=0 evil proof             -> " ++ show_a(t1evil) ++ "   (ACCEPT = the scaffolding gap, pre-part-2)")
let _ : String = print("")
# --- TIER-1 PART 2 (WIP) SOUND verify: OOD-z identity + DEEP-batched FRI on the trace ---
let s_honest : Bool = verify_sound(t1gs, prove_sound(t1gs, t1w))             # expect ACCEPT
let s_cross : Bool = verify_sound(t1bgs, prove_sound(t1gs, t1w))             # proof for t1gs vs t1bgs: expect REJECT
let s_evil : Bool = verify_sound(t1gs, prove_sound_evil(t1gs))              # P=0 attack on the SOUND path: expect REJECT (the headline)
let s_tamper : Bool = verify_sound(t1gs, tamper_strace(prove_sound(t1gs, t1w)))   # tampered trace opening: expect REJECT
let _ : String = print("TIER-1 PART 2 (WIP) SOUND verify() — ties the committed quotient to the gate constraints (per-row):")
let _ : String = print("  honest proof               -> " ++ show_a(s_honest) ++ "   (expect ACCEPT)")
let _ : String = print("  cross-statement (wrong R)  -> " ++ show_a(s_cross) ++ "   (expect REJECT)")
let _ : String = print("  P=0 attack                 -> " ++ show_a(s_evil) ++ "   (expect REJECT <- the OOD identity now CATCHES it; per-row gate-binding)")
let _ : String = print("  tampered trace opening     -> " ++ show_a(s_tamper) ++ "   (expect REJECT; pins the trace<->FRI index alignment)")
let _ : String = print("  CEILING: per-row gate satisfaction ONLY. Inter-row WIRE consistency (a prover threading inconsistent values for the")
let _ : String = print("           same wire across rows, disconnecting R from the real computation) is NOT enforced -> needs B3 (copy/permutation).")
let _ : String = print("           Witness opened in clear (ZK suspended on this path). NOT out of research grade; unaudited; do not protect real value.")
let _ : String = print("")
# --- TIER-1 PART 3 (WIP) B3: copy/permutation argument (the wiring gap) ---
let b3_honest : Bool = verify_b3(t1gs, prove_b3(t1gs, t1w))                  # expect ACCEPT
let b3_cross : Bool = verify_b3(t1bgs, prove_b3(t1gs, t1w))                  # proof for t1gs vs t1bgs: expect REJECT
let _ : String = print("TIER-1 PART 3 (WIP) B3 verify() — adds the grand-product wire-consistency (copy) constraint:")
let _ : String = print("  honest proof               -> " ++ show_a(b3_honest) ++ "   (expect ACCEPT)")
let _ : String = print("  cross-statement (wrong R)  -> " ++ show_a(b3_cross) ++ "   (expect REJECT)")
# THE HEADLINE: a wiring-inconsistent trace. circuit wire2 = w0*w1, then wire3 = wire2*wire2.
# EVIL trace: row0 emits wire2=6 (=2*3), but row1 READS wire2=5 (inconsistent) -> per-row gates
# all hold (6=2*3, 25=5*5) so a per-row check ACCEPTs, but the wire is threaded inconsistently.
let ev_gates : List<Gate> = [GMul(2, 0, 1), GMul(3, 2, 2), GHint(4)]   # 3 gates -> ng=4 -> dsize=128 > 82 queries (no cap; wiring is caught by the PERMUTATION, not the query count)
let ev_l : List<List<Int>> = [glit(2), glit(5), glit(0), glit(0)]      # n=4 (padded); row0 wire2-output side, row1 wire2-INPUT side = 5 (inconsistent)
let ev_r : List<List<Int>> = [glit(3), glit(5), glit(0), glit(0)]
let ev_o : List<List<Int>> = [glit(6), glit(25), glit(7), glit(0)]     # row0 wire2=6, row1 wire3=25, row2 GHint wire4=7 (unconstrained), row3 padding
let ev_perrow : Bool = low_degree_quotient_cols(ev_gates, ev_l, ev_r, ev_o)            # per-row gates DO hold (would pass a per-row check)
let b3_wiring : Bool = verify_b3(ev_gates, prove_b3_cols(ev_gates, ev_l, ev_r, ev_o))  # B3: expect REJECT (wire2 inconsistent across rows)
let _ : String = print("  --- wiring attack (wire2 = 6 as output, 5 as input; per-row gates all hold) ---")
let _ : String = print("  per-row gate check         -> " ++ show_b(ev_perrow) ++ "   (yes: a per-row-only verifier would ACCEPT this)")
let _ : String = print("  B3 grand-product           -> " ++ show_a(b3_wiring) ++ "   (expect REJECT <- the copy constraint CATCHES the inconsistent wire)")
let _ : String = print("  => A+B1+B2+B3: the last NAMED structural soundness hole is closed (a consistent satisfying assignment => genuine R).")
let _ : String = print("     CONCRETE SOUNDNESS: ~80-bit PROVABLE (FRI-query term, 82q x log2(16/9)=68 + 12 grind; conjecture-free unique-decoding) /")
let _ : String = print("     ~135 list-decode (CONJECTURAL). The prior ~32-bit hash-width CAP IS FIXED: hashg now outputs 4 Poseidon lanes (~256-bit ->")
let _ : String = print("     ~128-bit collision binding), so the Merkle + FS commitment binding (~128-bit) no longer gates the ~80-bit FRI term. (The")
let _ : String = print("     32-bit cap was caught by the audit-readiness adversarial pass and fixed here — the integrity discipline working end to end.)")
let _ : String = print("     Queries are now sampled WITHOUT replacement (82 DISTINCT positions), so the full 82-query margin holds (no duplicate erosion).")
let _ : String = print("     All bounds REASONED pen-and-paper, NOT")
let _ : String = print("     machine-verified or audited. ZK SUSPENDED (witness in clear). NOT out of research grade; the EXTERNAL AUDIT is the hard")
let _ : String = print("     boundary (Poseidon unaudited -> if its RO model is false the whole bound is vacuous). Research-grade, audit-pending. Do not protect real value.")
let _ : String = print("")
# --- PUBLIC-INPUT PINNING (closes the 'R is SOME valid output' gap for public inputs) ---
# Pin input wire 0 ('a') to a PUBLIC value, proven on the sound B3 path.
let pin_ok_b : Build = build_claim_pub(msrc, mins, [Pair(0, glit(100000))], mres)
let pin_ok : Bool = match pin_ok_b { Build(pn, pgs, pw) => verify_b3(pgs, prove_b3(pgs, pw)) }      # a pinned to its TRUE value 100000
let pin_bad_b : Build = build_claim_pub(msrc, mins, [Pair(0, glit(99999))], mres)
let pin_bad : Bool = match pin_bad_b { Build(pn, pgs, pw) => verify_b3(pgs, prove_b3(pgs, pw)) }     # a pinned to a WRONG public value 99999
let _ : String = print("TIER-1 PUBLIC-INPUT PINNING (bind input wire 0 = 'a' to a public value in the statement, sound B3 path):")
let _ : String = print("  a pinned to its true value 100000 -> " ++ show_a(pin_ok) ++ "   (expect ACCEPT)")
let _ : String = print("  a pinned to a WRONG value 99999    -> " ++ show_a(pin_bad) ++ "   (expect REJECT <- the proof is now bound to f(THESE public inputs), not just 'some inputs')")
let _ : String = print("")
# --- ZK FULL INTEGRATION: a RANDOMIZED-TRACE proof (n=256, ~240 random dummy rows >> the
# ~170-eval leak surface) proves + verifies on the sound B3 path. The random rows hide the
# witness at the openings (statistical HVZK) while being sound-neutral. ~30-60 min native.
let zk_full_b : Build = build_claim_zk(msrc, mins, mres, 31337, 256)
let zk_full : Bool = match zk_full_b { Build(zn, zgs, zw) => verify_b3(zgs, prove_b3(zgs, zw)) }
let _ : String = print("ZK FULL INTEGRATION (randomized n=256 trace, ~240 random rows hide the ~170 openings) -> " ++ show_a(zk_full) ++ "   (expect ACCEPT: sound + hiding)")
let _ : String = print("")
# === SOUNDNESS GATE === assert every honest case ACCEPTs and every attack REJECTs.
# Any mismatch calls `error` -> the run aborts with a nonzero exit. This makes the demo a
# real regression GATE (not just human-readable prints): a refactor that silently weakens
# verify_b3 can no longer pass. (t1evil/ev_perrow are the DOCUMENTED scaffolding gap +
# per-row-would-accept marker, not soundness guarantees, so they are not gated.)
let _ : String = print("=== SOUNDNESS GATE (each case asserted; a mismatch aborts via `error`) ===")
let _ : String = print("  [OK] " ++ expect_accept("honest (scaffolding verify)", t1honest))
let _ : String = print("  [OK] " ++ expect_reject("cross-statement (scaffolding verify)", t1cross))
let _ : String = print("  [OK] " ++ expect_reject("tampered nonce", t1nonce))
let _ : String = print("  [OK] " ++ expect_accept("honest (sound verify)", s_honest))
let _ : String = print("  [OK] " ++ expect_reject("cross-statement (sound verify)", s_cross))
let _ : String = print("  [OK] " ++ expect_reject("P=0 attack (sound verify)", s_evil))
let _ : String = print("  [OK] " ++ expect_reject("tampered trace opening", s_tamper))
let _ : String = print("  [OK] " ++ expect_accept("honest (B3 verify)", b3_honest))
let _ : String = print("  [OK] " ++ expect_reject("cross-statement (B3 verify)", b3_cross))
let _ : String = print("  [OK] " ++ expect_reject("wiring attack (B3 grand-product)", b3_wiring))
let _ : String = print("  [OK] " ++ expect_accept("public input pinned to true value", pin_ok))
let _ : String = print("  [OK] " ++ expect_reject("public input pinned to WRONG value", pin_bad))
let _ : String = print("  [OK] " ++ expect_accept("ZK full integration (n=256)", zk_full))
let _ : String = print("=== SOUNDNESS GATE PASSED: all 13 cases as expected ===")
let _ : String = print("")

"prove_source_goldilocks_zk v1.0 (Glass 5.48.0) — A+B1+B2+B3 sound + public-input pinning + ZK via randomized trace (n=256 ACCEPTs, sound+hiding); 4-lane hash + 82 distinct queries => tight ~80-bit; reasoned-not-machine-checked, UNAUDITED — research-grade, do NOT protect real value"