Raw and compressed payload realizations

Raw mode sends the semantic commitments themselves. Compressed mode binds those same commitments to smaller public payloads through additional private digits and ring equations. Both modes preserve the four semantic relation families.

This chapter explains which witness values, public targets, and physical rows each payload mode needs. A physical row is one coordinate equation in its stated ring. We first compare the two payloads, then derive the compression chains that connect them to the semantic commitments.

Compression here concerns public commitment payloads, not the complete next-level witness. Smaller payloads require additional private digits to prove their compression chains. The complete recursive witness also includes response, opening, and inner-commitment digits, plus any quotients required by the relation mode. A shorter folded response therefore does not guarantee a smaller complete witness; the root may expand it while reducing the relations to one recursive witness opening claim.

The output is a set of ring equations. Checking ring relations over a field explains the next step: use either quotient lifting or quotient-free checking to turn those equations into field claims for Stage 2. The opening method remains a separate choice. It determines the partial-evaluation geometry in either payload mode.

Contents

• From semantic relations to physical realizations
  • Raw realization
  • Compressed realization
  • Planner-selected realization transition
• Commitment compression realization
  • Why recommit?
  • One recommitment step
  • The two-map commitment chains
  • Additional physical relations and witness
• From physical rows to field checks
• The scalar opening claim is a method-dependent virtual row
• Code reference

From semantic relations to physical realizations

The four relations derived on the previous page are semantic: they state which algebraic constraints a valid fold must satisfy, without prescribing which commitment values are sent in the proof. A physical realization turns those constraints into the native-ring matrix equations used by a particular payload mode. It determines the public payload, any additional compression witness, and the right-hand side of each equation.

When these equations are assembled as a matrix, each coordinate equation is a physical row. For example, the vector equation $\mathbf{B}\hat{\mathbf{t}}=\mathbf{u}$ contributes $n_B$ physical rows, one for each coordinate of $\mathbf{u}$. A physical row is therefore an individual native-ring equation implementing a semantic relation, not a new semantic claim.

Only the two commitment relations depend on the payload-mode choice. Their semantic values are

$$\mathbf{u}=\mathbf{B}\hat{\mathbf{t}},{\mathbf{v}}_D=\mathbf{D}\hat{\mathbf{e}}.$$

The fold-evaluation and inner-commitment relations have the same physical form in raw and compressed payload modes. Their form may still differ between the two opening methods.

Raw realization

In raw mode, the public payload is the semantic commitment. The prover computes $\mathbf{u}$ and ${\mathbf{v}}_D$ and transmits their complete ring vectors. They appear directly as the right-hand sides of the ordinary $\mathbf{B}$ and $\mathbf{D}$ rows:

$$\mathbf{B}\hat{\mathbf{t}}=\mathbf{u},\mathbf{D}\hat{\mathbf{e}}={\mathbf{v}}_D.$$

The logical witness contains only the three segments already used by the four semantic relations:

$${\mathbf{w}}_0=\hat{\mathbf{z}}\Vert \hat{\mathbf{e}}\Vert \hat{\mathbf{t}}.\text{\hspace{1em}(16)}$$

For the basic EvaluationTrace geometry, writing the four row families as one conceptual matrix gives

$$\boxed{{\mathbf{M}}_0{\mathbf{w}}_0=\mathbf{y}\text{over }R.}\text{\hspace{1em}(17)}$$

Let $n_A$, $n_B$, and $n_D$ denote the row counts of $\mathbf{A}$, $\mathbf{B}$, and $\mathbf{D}$. In that one-group layout, the raw realization has $1+n_A+n_B+n_D$ physical rows:

Consequently,

$$\mathbf{y}=0\Vert 0_{\mathbf{A}}\Vert \mathbf{u}\Vert {\mathbf{v}}_D.\text{\hspace{1em}(18)}$$

The verifier therefore receives the values defined by the semantic relations and places them directly in the raw relation instance. No compression digits or $\mathbf{F}/\mathbf{H}$ rows are present. The matrix ${\mathbf{M}}_0$ need not be materialized densely: its entries are generated from the fold challenges, opening weights, gadget weights, and the setup matrices $\mathbf{A}$, $\mathbf{B}$, and $\mathbf{D}$.

With SubringCoefficientPacking, raw mode still transmits the same semantic $\mathbf{B}$ and $\mathbf{D}$ commitments, but Equation (12b) is realized by the packed coordinate-plane relation. It therefore does not reuse the single ordinary consistency row counted in this example.

Equation (17) is still a relation in the native cyclotomic ring; it is not yet the exact field identity consumed by sumcheck. The next chapter, Checking ring relations over a field, explains the two schedule-selected ways to obtain that field claim. We first finish defining the physical rows for compressed payloads.

Compressed realization

In compressed mode, the prover still computes the same semantic commitments, but does not transmit $\mathbf{u}$ or ${\mathbf{v}}_D$. Instead, it decomposes each one, recommits the resulting blocks through a two-map chain, and sends one fixed 128-byte terminal payload for each chain. In the illustrative q128 example developed below, this replaces a 1024-byte semantic outer commitment by the 128-byte payload $p_F$. The two commitment relations follow parallel chains:

$$\mathbf{B}\hat{\mathbf{t}}=\mathbf{u}\stackrel{\text{compression }\mathbf{F}\text{ chain}}{\to }{p}_F,$$

$$\mathbf{D}\hat{\mathbf{e}}={\mathbf{v}}_D\stackrel{\text{compression }\mathbf{H}\text{ chain}}{\to }{p}_H.$$

The prover stores the two layers of $\mathbf{F}$ and $\mathbf{H}$ compression digits as additional private witness coordinates. These arrows are not a decoding procedure: the verifier does not recover $\mathbf{u}$ from $p_F$ or ${\mathbf{v}}_D$ from $p_H$. Instead, additional $\mathbf{F}/\mathbf{H}$ equations, represented by physical rows, prove that the hidden semantic commitments recompose from the first digit layer and that the two compression maps lead to the transmitted terminal payloads. The $\mathbf{B}$ and $\mathbf{D}$ right-hand sides are therefore zero in compressed mode; $p_F$ and $p_H$ appear only on the terminal ${\mathbf{F}}_2$ and ${\mathbf{H}}_2$ rows.

From the verifier's perspective, the schedule already determines the payload mode. For a raw level, it assembles the ordinary relation right-hand side from $\mathbf{u}$ and ${\mathbf{v}}_D$. For a compressed level, it assembles the larger row layout from $p_F$ and $p_H$ and verifies the compression chains together with the ordinary relations. The proof does not carry a separate mode tag.

Planner-selected realization transition

Compression saves public payload bytes but adds digit witnesses, relation rows, and restricted range-check work. With quotient lifting, its additional rows also add quotient witnesses. The planner prices both sides of this tradeoff for the complete recursive schedule; it does not choose a mode from the payload size alone.

Commitment groups created separately before recursive proving—for example, groups later supplied as precommitted root inputs—always use compressed payloads and are not part of the recursive mode choice. The protocol also requires compressed payloads for the root fold and the first recursive fold, when that fold exists. Any later fold that consumes a setup prefix must likewise remain compressed. At a later level that does not consume a setup prefix, the planner may either continue the compressed prefix or begin a raw suffix. Once it selects raw mode, every later recursive level remains raw:

$$\underset{\text{planner-selected prefix}}{\underbrace{\text{compressed}⟶\cdots ⟶\text{compressed}}}⟶\underset{\text{raw suffix}}{\underbrace{\text{raw}⟶\cdots ⟶\text{raw}}}.$$

The prefix length is schedule-dependent. Some current generated schedules cut over immediately after the required first recursive fold, whereas deeper recursive schedules keep several early recursive levels compressed. Thus "root and early folds are compressed" describes a planner-selected prefix, not a globally fixed transition point.

The next section expands the two commitment relations into their compressed physical rows.

Commitment compression realization

The outer-commitment and opening-commitment semantic relations, Equations (14) and (15), have the same structure: a commitment matrix maps a short witness to a semantic commitment consisting of a vector of ring elements. The raw realization places that complete commitment in the proof. The compressed realization instead recommits it using rank-one matrices over progressively smaller rings, producing a commitment chain whose terminal payload is exactly 128 bytes.

Why recommit?

The serialized size of an uncompressed semantic outer commitment is

$$|\mathbf{u}{|}_{\mathrm{bytes}}=n_B{d}_B{b}_F,$$

where $d_B$ is the $\mathbf{B}$ ring dimension and $b_F$ is the canonical byte width of one field element. In the q128 profile, one field element occupies 16 bytes. For a simple rank-one example, take $n_B=1$ and $d_B=64$. Its uncompressed payload then occupies

$$1\cdot 64\cdot 16=1024\text{bytes}.$$

The goal of commitment compression is to recommit this value in a smaller ring and repeat the process until the public payload has the desired size. This reduces the bytes occupied by the public commitment payload, but it also introduces new witness coordinates and relation rows. The planner accounts for both effects when it chooses between compressed and raw recursive payloads.

One recommitment step

At a high level, one step does not map a large-ring element directly into a smaller quotient ring. It first applies the balanced decomposition introduced above with base $2$, whose digit range is $\{-1,0\}$. It then groups those digits into short coefficient blocks, each representing an element of the smaller ring. A rank-one setup matrix over that same smaller ring commits the resulting vector to one new ring element. The recomposition identity is the bridge from these smaller-ring blocks back to the original large-ring element.

For intuition, first suppose that the semantic commitment is a single ring element

$$u(X)=\sum _{\ell =0}^{d-1}{u}_{\ell }{X}^{\ell }\in R_d=F[X]/(X^d+1).$$

The first operation is a coefficientwise balanced base-$2$ decomposition. For each $u_{\ell }\in F$, choose digits ${\xi }_{k,\ell }\in \{-1,0\}$ such that

$$u_{\ell }=\sum _{k=0}^{\kappa -1}{2}^k{\xi }_{k,\ell }\text{in }F,$$

where $\kappa$ is the field-modulus bit width. Put the $k$-th digit of every coefficient into one digit polynomial

$${\xi }_k(X)=\sum _{\ell =0}^{d-1}{\xi }_{k,\ell }{X}^{\ell }.$$

Then

$$u(X)=\sum _{k=0}^{\kappa -1}{2}^k{\xi }_k(X),[{\xi }_k{]}_{\ell }\in \{-1,0\},$$

so every coefficient of every decomposed polynomial is either $-1$ or $0$.

The second operation repacks these digits into a smaller ring. Choose $d^{\prime }\mid d$ and divide the length-$d$ coefficient vector of each ${\xi }_k$ into consecutive blocks of length $d^{\prime }$. The $j$-th block becomes the coefficient vector of

$${\xi }_{k,j}^{\prime }(X)=\sum _{\ell =0}^{d^{\prime }-1}{\xi }_{k,j{d}^{\prime }+\ell }{X}^{\ell }\in R_{d^{\prime }}=F[X]/(X^{d^{\prime }}+1).$$

Equivalently, if $\widetilde{{\xi }_{k,j}^{\prime }}(X)$ denotes the canonical degree-less-than-$d^{\prime }$ representative of this small-ring element, then

$${\xi }_k(X)=\sum _{j=0}^{d/d^{\prime }-1}{X}^{j{d}^{\prime }}\widetilde{{\xi }_{k,j}^{\prime }}(X)\text{in }{R}_d.$$

Collect all of the small-ring blocks into a vector

$$\mathbf{\xi }=({\xi }_{0,0}^{\prime },\dots ,{\xi }_{\kappa -1,d/d^{\prime }-1}^{\prime })\text{over }{R}_{d^{\prime }}.$$

Akita uses bit-major order: all coefficient blocks for one bit position are contiguous before the blocks for the next bit position. In this unpadded single-element example, the vector has width $w=\kappa d/d^{\prime }$ over $R_{d^{\prime }}$.

The fixed recomposition map restores both the coefficient positions and the powers of two:

$${\mathrm{Rec}}_{d\leftarrow d^{\prime }}(\mathbf{\xi })=\sum _{k=0}^{\kappa -1}{2}^k\sum _{j=0}^{d/d^{\prime }-1}{X}^{j{d}^{\prime }}\widetilde{{\xi }_{k,j}^{\prime }}(X)=u(X).$$

This is the bridge between $R_{d^{\prime }}$ and $R_d$. It is a fixed $F$-linear coefficient-recomposition map, not a ring embedding or a homomorphism between the two quotient rings.

Finally, a rank-one matrix over the smaller ring recommits the packed blocks:

$$\mathbf{F}\in R_{d^{\prime }}^{1\times w},u^{\prime }=\mathbf{F}\mathbf{\xi }\in R_{d^{\prime }}.$$

Together, the two equalities

$$u={\mathrm{Rec}}_{d\leftarrow d^{\prime }}(\mathbf{\xi }),u^{\prime }=\mathbf{F}\mathbf{\xi }$$

link the original commitment in $R_d$ to a new commitment in $R_{d^{\prime }}$ through the shared digit vector $\mathbf{\xi }$. Conceptually, one recommitment step therefore performs three operations: decompose the source coefficients, repack the digits as small-ring elements, and commit those elements to one small-ring image.

The two-map commitment chains

The smaller ring cannot be chosen solely to minimize the payload. Decreasing its dimension makes the output shorter, but it also increases the number of input columns presented to the rank-one compression matrix. The pair consisting of the ring dimension and input width must remain within Akita's Module-SIS security bounds.

The current protocol therefore uses a fixed, profile-specific ladder of exactly two certified rank-one maps. The ladder accepts a complete source of at most 8 KiB and terminates at exactly 128 bytes.

For the semantic commitment $\mathbf{u}\in R_{d_B}^{n_B}$, flatten its $n_B$ ring coordinates into $n_B{d}_B$ field coefficients. Balanced base-$2$ decomposition produces $\kappa n_B{d}_B$ digits in $\{-1,0\}$. Pack these digits in bit-major order into $w_1$ elements of $R_{d_1}$, filling any unused coefficients of the last element with zero. These smaller-ring elements form ${\mathbf{\xi }}_{F,1}\in R_{d_1}^{w_1}$. The first rank-one map commits this vector to $u^{(1)}\in R_{d_1}$; the second layer repeats the same decomposition, repacking, and recommitment at dimension $d_2$:

$$\underset{\text{semantic commitment}}{\underbrace{\mathbf{u}\in R_{d_B}^{n_B}}}\to \underset{\text{small-ring digit blocks}}{\underbrace{{\mathbf{\xi }}_{F,1}\in R_{d_1}^{w_1}}}\stackrel{{\mathbf{F}}_1}{⟶}\underset{\text{intermediate image}}{\underbrace{u^{(1)}\in R_{d_1}}}\to \underset{\text{second-layer digit blocks}}{\underbrace{{\mathbf{\xi }}_{F,2}\in R_{d_2}^{w_2}}}\stackrel{{\mathbf{F}}_2}{⟶}\underset{\text{terminal payload}}{\underbrace{p_F\in R_{d_2}}}.$$

From the prover's perspective, the chain consists of five concrete steps:

1. Compute the semantic commitment $$\mathbf{u}=\mathbf{B}\hat{\mathbf{t}}\in R_{d_B}^{n_B}.$$
2. Decompose and repack $\mathbf{u}$ into ${\mathbf{\xi }}_{F,1}$ so that $${\mathrm{Rec}}_{d_B\leftarrow d_1}({\mathbf{\xi }}_{F,1})=\mathbf{u}.$$
3. Apply the first rank-one map: $$u^{(1)}={\mathbf{F}}_1{\mathbf{\xi }}_{F,1}\in R_{d_1}.$$
4. Decompose and repack $u^{(1)}$ into ${\mathbf{\xi }}_{F,2}$ so that $${\mathrm{Rec}}_{d_1\leftarrow d_2}({\mathbf{\xi }}_{F,2})=u^{(1)}.$$
5. Apply the terminal rank-one map: $$p_F={\mathbf{F}}_2{\mathbf{\xi }}_{F,2}\in R_{d_2}.$$

Only $p_F$ is transmitted. The semantic commitment $\mathbf{u}$ is computed but omitted from the compressed payload. The intermediate image $u^{(1)}$ is also not transmitted and is not stored as an independent witness segment; the two digit vectors ${\mathbf{\xi }}_{F,1}$ and ${\mathbf{\xi }}_{F,2}$ are the additional witness material. The physical relations in the next subsection bind this private chain all the way back to $\hat{\mathbf{t}}$. The opening-side $\mathbf{H}$ chain applies the same five steps to ${\mathbf{v}}_D=\mathbf{D}\hat{\mathbf{e}}$ and terminates at $p_H$.

The production compression dimensions are fixed by the modulus profile:

For the q128 example above, the complete chain is

$$\underset{1024\text{bytes}}{\underbrace{u\in R_{64}}}\to \underset{\text{base-2 digit blocks}}{\underbrace{{\mathbf{\xi }}_{F,1}\in R_{16}^{512}}}\stackrel{{\mathbf{F}}_1}{⟶}\underset{256\text{bytes}}{\underbrace{u^{(1)}\in R_{16}}}\to \underset{\text{base-2 digit blocks}}{\underbrace{{\mathbf{\xi }}_{F,2}\in R_8^{256}}}\stackrel{{\mathbf{F}}_2}{⟶}\underset{128\text{bytes}}{\underbrace{p_F\in R_8}}.$$

The widths count the small-ring elements needed to hold all balanced base-$2$ digits: $w_1=64\cdot 128/16=512$ and $w_2=16\cdot 128/8=256$.

The schedule's payload mode determines whether these chains are present at a particular recursive level, according to the planner-selected transition described above.

Additional physical relations and witness

The equalities in a compression chain do not all live in the same ring. Each physical row is interpreted in the native ring displayed beside it, and each $\mathrm{Rec}$ is the fixed linear coefficient-recomposition map defined above. Suppressing component indices inside that map, the outer $\mathbf{B}/\mathbf{F}$ chain gives three physical relation equations. Their labels extend Equation (14) to emphasize that the entire chain realizes that one semantic commitment relation:

$$\boxed{\mathbf{B}\hat{\mathbf{t}}-{\mathrm{Rec}}_{d_B\leftarrow d_1}({\mathbf{\xi }}_{F,1})=0}\text{in }{R}_{d_B}^{n_B},\text{\hspace{1em}(14a)}$$

$$\boxed{{\mathbf{F}}_1{\mathbf{\xi }}_{F,1}-{\mathrm{Rec}}_{d_1\leftarrow d_2}({\mathbf{\xi }}_{F,2})=0}\text{in }{R}_{d_1},\text{\hspace{1em}(14b)}$$

$$\boxed{{\mathbf{F}}_2{\mathbf{\xi }}_{F,2}=p_F}\text{in }{R}_{d_2}.\text{\hspace{1em}(14c)}$$

The first equation is the compressed realization of the existing $\mathbf{B}$ rows; the latter two add the rank-one ${\mathbf{F}}_1$ and ${\mathbf{F}}_2$ rows. The semantic opening commitment follows the same construction, with an $\mathbf{H}$ chain:

$$\boxed{\mathbf{D}\hat{\mathbf{e}}-{\mathrm{Rec}}_{d_D\leftarrow d_1}({\mathbf{\xi }}_{H,1})=0}\text{in }{R}_{d_D}^{n_D},\text{\hspace{1em}(15a)}$$

$$\boxed{{\mathbf{H}}_1{\mathbf{\xi }}_{H,1}-{\mathrm{Rec}}_{d_1\leftarrow d_2}({\mathbf{\xi }}_{H,2})=0}\text{in }{R}_{d_1},\text{\hspace{1em}(15b)}$$

$$\boxed{{\mathbf{H}}_2{\mathbf{\xi }}_{H,2}=p_H}\text{in }{R}_{d_2}.\text{\hspace{1em}(15c)}$$

For the basic one-group EvaluationTrace case, compressed mode therefore has $1+n_A+n_B+n_D+4$ physical rows:

For packing, the payload-mode suffix is identical, but the method-specific coordinate-plane relations replace the ordinary consistency row just as in raw mode.

Before adding quotient digits and alignment, the logical compressed witness has the following layer order:

$$\hat{\mathbf{z}}\Vert \hat{\mathbf{e}}\Vert \hat{\mathbf{t}}\Vert {\mathbf{\xi }}_{F,1}\Vert {\mathbf{\xi }}_{H,1}\Vert {\mathbf{\xi }}_{F,2}\Vert {\mathbf{\xi }}_{H,2}.$$

The restricted $\{-1,0\}$ check on the compression digits is described with the Stage 2 sumcheck. It is separate from the physical ring equations above.

From physical rows to field checks

Both payload modes now supply physical ring equations. Raw mode uses the public $\mathbf{u}$ and ${\mathbf{v}}_D$ as targets. Compressed mode uses zero targets for the intermediate relations and the public $p_F,p_H$ for the final compression rows. Each row keeps the native ring defined above.

The next step is to check those equations over a field. The schedule selects one of two methods:

• Quotient lifting adds private quotient digits that record reduction by each row's ring modulus.
• Reduced evaluation includes that reduction in public coefficient weights and adds no quotient digits.

The next chapter derives both methods from one ring equation. Only then does it combine them with raw and compressed payloads to give the complete witness layouts. This keeps the payload choice separate from the method used to check its rows.

The scalar opening claim is a method-dependent virtual row

Two different statements involve $\hat{e}$, and they should not be conflated:

The scheduled opening method prepares the second statement. EvaluationTrace uses the trace weight derived in Field-to-ring evaluation reduction. SubringCoefficientPacking uses the direct packed scalar row. The direct scalar opening in either method reuses the same row-batching challenge ${\tau }_1$. It is absent from the physical ring-row layout and its public right-hand side. Thus it needs no ring-switch quotient in either relation mode. Coefficient packing also has a physical source-consistency relation, derived in Root fold and ring switching.

After the physical ring rows become field claims, Stage 2 fuses them with this scalar opening and the range-image binding in one sumcheck.

Code reference

The implementation follows the same semantic relations in both payload modes, then selects different public right-hand sides and witness suffixes. The functions below also support multiple groups, chunks, and role-specific ring dimensions; in the basic setting they reduce to the construction on this page.

Prover flow

1. Create and retain the commitment-side material. The standalone/root commitment paths in commitment API compute the semantic outer commitment $\mathbf{u}=\mathbf{B}\hat{\mathbf{t}}$ and compress it. The recursive commit_witness computes the same semantic value, then follows the payload mode selected for that level. A raw recursive level exposes $\mathbf{u}$ directly. A compressed commitment passes it to execute_compression_chains, exposes only $p_F$, and retains the two packed $\mathbf{F}$ digit layers in the commitment hint. It retains their quotient rows when the consuming fold uses quotient lifting.
2. Build the fold-side objects. RingRelationProver::prepare coordinates public opening payloads and fold challenges. The CPU backend decomposes the position-folded values into $\hat{\mathbf{e}}$, computes ${\mathbf{v}}_D=\mathbf{D}\hat{\mathbf{e}}$, and retains the accepted response $\mathbf{z}$ behind a fold handle. In compressed mode, materialize_compression_witness combines the retained $\mathbf{F}$ material with a newly computed $\mathbf{H}$ chain for ${\mathbf{v}}_D$, producing the terminal payload $p_H$ and storing both chains as CompressionWitnessMaterialization.
3. Assemble the mode-selected public statement. Raw mode calls assemble_relation_rhs with $\mathbf{u}$ and ${\mathbf{v}}_D$. Compressed mode instead calls assemble_compressed_relation_rhs with $p_F$ and $p_H$. The latter emits zero ordinary $\mathbf{B}/\mathbf{D}$ and first-map right-hand sides, followed by the terminal payloads on the ${\mathbf{F}}_2/{\mathbf{H}}_2$ rows.
4. Construct the committed relation witness. cpu_recursive_witness_build derives $\hat{\mathbf{t}}$ from the semantic inner rows stored in the hint, and emits $\hat{\mathbf{z}}$, $\hat{\mathbf{e}}$, and $\hat{\mathbf{t}}$. In quotient-lift mode it invokes compute_multi_group_relation_quotient to compute one quotient in every physical row's native ring. In compressed mode it also emits the two $\mathbf{F}/\mathbf{H}$ digit layers. In reduced mode it dispatches before quotient construction and uses negacyclic-only D and compression products. WitnessLayout determines which ranges and alignment are live.
5. Prepare the Stage 2 relation evaluators. Quotient lifting uses the factored build_relation_lane_weights path for the consistency, $\mathbf{A}$, $\mathbf{B}$, and $\mathbf{D}$ contributions. It accumulates one weight per relation coefficient lane; the shared low alpha factor stays implicit. Reduced evaluation builds one dense Stage-2 weight oracle instead. Both paths take their relation addresses from the semantic compiler in opaque/relation_weights/compiler.rs. Compressed mode additionally uses build_compression_relation_weights or its reduced counterpart for the recomposition, $\mathbf{F}/\mathbf{H}$, and mode-selected compression-quotient contributions, while NegativeBinarySupport restricts the separate $w(w+1)=0$ check to the compression-digit spans. The scheduled opening method contributes separate ${\tau }_1$-weighted Stage-2 terms after the payload-mode relation terms.

The mode split can be summarized as follows:

semantic inner rows
        |
        v
derive t_hat and u = B t_hat
        |
        +---------------- raw ----------------> public u
        |
        `-- compressed --> F chain ----------> public p_F
                             |
                             `--> retained F digits

position-folded values E_b
        |
        v
e_hat and v_D = D e_hat
        |
        +---------------- raw ----------------> public v_D
        |
        `-- compressed --> H chain ----------> public p_H

raw:        assemble_relation_rhs(u, v_D)
compressed: assemble_compressed_relation_rhs(p_F, p_H)
                         |
                         v
             RingRelationInstance + prover witness
                         |
                         v
                cpu_recursive_witness_build
                  |              |
           quotient lift    reduced evaluation
             add R digits      no R digits
                         |
                         v
          factored or dense relation evaluator
          + optional compression evaluator
          + optional {-1, 0} support evaluator
          + method-selected opening terms
                         |
                         v
                       Stage 2

Public statement: RingRelationInstance

RingRelationInstance is the common relation-statement carrier constructed independently by the prover and verifier. Its public fields are verifier-reconstructible. In compressed mode, private commitment intermediates remain inside the CPU backend:

Raw replay includes the public ${\mathbf{v}}_D$ in rhs(). Compressed replay uses $p_H$ instead; the privately computed ${\mathbf{v}}_D$ remains in the CPU witness-build state and is not a field of the public relation instance.

Full opening points are not owned by RingRelationInstance. They are prepared separately by the scheduled opening method. The verifier consumes evaluation trace points through evaluation_trace.rs and coefficient-packing points through its compact packing relation path. Only the projections needed by the physical consistency relation remain in this instance.

CPU-private relation witness state

The CPU consumer's private RingRelationWitness is the aggregate used while constructing an opaque CpuWitnessHandle; protocol orchestration cannot inspect or transport it. In the basic setting, its private groups vector contains one RingRelationGroupWitness:

The PortableCommitmentHandle does not store a materialized $\hat{\mathbf{t}}$ or a separate copy of $\mathbf{u}$. cpu_recursive_witness_build derives $\hat{\mathbf{t}}$ from its semantic inner rows. At the aggregate level, RingRelationWitness::compression holds the optional materialized $\mathbf{F}/\mathbf{H}$ chains used by this fold. RingRelationWitness::d_quotients records whether the shared D relation has quotient data. Quotient-lift assembly includes ordinary and compression quotient digits. Reduced evaluation places only the ordinary and optional compression digits. WitnessLayout defines their exact ranges.

Verifier reconstruction

The verifier does not receive a serialized RingRelationInstance or any RingRelationWitness. In verify_fold, it reconstructs the public instance from the schedule-selected payload and transcript data, then calls ring_switch_verifier:

schedule-selected payload mode
              |
       +------+------+
       |             |
      raw        compressed
    u, v_D         p_F, p_H
       |             |
assemble_relation_rhs
                 assemble_compressed_relation_rhs
       |             |
       +------+------+
              |
     RingRelationInstance::new
              |
      authenticated relation mode
       |                     |
 quotient lift       reduced evaluation
 quotient tail       terminal residue kernels
 common alpha        fused direct setup scan
       |                     |
       +----------+----------+
                  |
     optional compact F/H evaluator
     + optional {-1, 0} support evaluator
              |
          Stage 2 verifier

Compressed replay deliberately sets RingRelationInstance::v() to an empty carrier: the zero $\mathbf{D}$ rows and terminal $p_H$ row are already encoded in the compressed right-hand side. The separate method-selected opening preparation retains the full point data needed to bind the claimed evaluation. Opening points and digit-innermost layout describes the canonical physical source and witness order.