secp256k1 Point-Addition Challenge with Lumbda Attack

rev 10 | russell | 1781220210613 | JSON

	rev 9			rev 10
	211	shot-averaging noise washes out:		211	shot-averaging noise washes out:
	212			212
n	213	DIALOG_GCD + m=154 + cmp=4 + HMR + borrowed-everywhere (sweep-017c)	n	213	DIALOG_GCD + m=154 + cmp=4 + HMR + borrowed-everywhere +
				214	CAS-borrowed-from-red-tmp + pseudo-Mersenne mod-double (sweep-030)
	214	versus HEAD:		215	versus HEAD:
	215			216
n	216	- peak qubits: 4,886 (us) · 1,355 (HEAD)	n	217	- peak qubits: 4,886 (us) · 1,309 (HEAD)
	217	- avg Toffoli: 23,563,264 (us) · 1,773,011 (HEAD)		218	- avg Toffoli: 16,197,312 (us) · 1,503,355 (HEAD)
	218	- n_ops: 108,384,032 (us) · 12,788,119 (HEAD)
	219	- score (avg Toffoli × qubits): 1.1513e+11 (us) · 2.402e+09 (HEAD)		219	- score (avg Toffoli × qubits): 7.9140e+10 (us) · 1.968e+09 (HEAD)
	220	- Δ vs HEAD: +4,694 %		220	- Δ vs HEAD: +3,921 % (gap 40.21×)
				221
				222	HEAD reference: ``jackylee0424`` submission ``a66b042`` (live target since
				223	2026-06-08; prior baseline ``2.402e+09`` retired after upstream scan
				224	caught HEAD's promoted frontier at ``1.968e+09``).
	221			225
	222	Production-width emit lands via lumbda C tier on 3090-ai bare-metal,		226	Production-width emit lands via lumbda C tier on 3090-ai bare-metal,
	242			246
	243	Truncated comparator finding — HEAD's ``dgcd-compare-bits`` knob		247	Truncated comparator finding — HEAD's ``dgcd-compare-bits`` knob
n	244	(56 bits at n=256 in HEAD-prod, ~22 % of width) carries massive	n	248	(56 bits at n=256 in HEAD-prod, ~22 % of width) carries real
	245	headroom. Our cmp=2 (~0.8 % of width at n+1=257) still passes		249	headroom. cmp=4 (~1.6 % of width at n+1=257) lands as our
	246	``byte-identity-cpu-gpu true`` at bend dispatch — Kaliski's		250	production minimum after classical-sim probe-width verification.
	247	invariant keeps u/v close enough in magnitude that top-2-bit		251
	248	disambiguation suffices for ``l-gt``. cmp lever bottomed out at		252	cmp=2 caught as algorithmically broken — bend dispatch reports
	249	cmp=2; lambda path closed.		253	``byte-identity-cpu-gpu true`` & status PASS, but classical-sim
				254	verify at n+1∈{18, 32} reveals ``out=0`` plus leaked ancilla.
				255	Bend only validates CPU & GPU simulator agreement on a wrong
				256	circuit, not algorithmic correctness vs. expected mod-inverse.
				257	Same defect class re-emerges below at ``DIALOG_GCD_ACTIVE_ITERATIONS``.
				258
				259	DIALOG_GCD active-iters cap — non-monotonic correctness. Setting
				260	iters below textbook ``2n`` produces wrong mod-inverse output at
				261	specific iter values, sporadically. K-correction (classical-replay
				262	backward sweep using K = classical-mod-inv(p, r_on_1)) depends on
				263	``r_on_1`` arithmetic that breaks at certain iters. ``dgcd-resolve-iters``
				264	gates ``r_on_1 != 0``, which is necessary not sufficient.
				265
				266	Probe data:
				267
				268	- n+1=18 (textbook 34): iters ∈ {15: OK, 16: WRONG, 17: WRONG, 18: OK, 25, 26, 2
				>	7: OK}
				269	- n+1=32 (textbook 62): iters ∈ {10, 12: OK, 15: WRONG, 16, 24, 28, 32, 48, 49,
				>	50: OK}
				270
				271	HEAD ships ``iters=399`` at n=256 (textbook × 0.776) — a tuned
				272	value that survives upstream's test suite. We adopt ``iters=399``
				273	as our production safe value & retract earlier iters-cap
				274	exploration that relied solely on bend PASS without classical-sim
				275	verification.
	250			276
	251	HOST_GATED measurement-clear port — HEAD's ``mod.rs:24788-24791``		277	HOST_GATED measurement-clear port — HEAD's ``mod.rs:24788-24791``
	263	substitution produces correct mod-inverse output matching control		289	substitution produces correct mod-inverse output matching control
	264	(non-HMR) baseline.		290	(non-HMR) baseline.
n			n	291
				292	Pseudo-Mersenne mod-double — Schrottenloher 2026/1128 Algorithm 7
				293	port (sweep-030). Reference implementation: Qarton, gitlab.inria.fr/
				294	capsule/qubits-projects/ec-point-addition. Paper open at arXiv
				295	2606.02235. secp256k1's prime takes pseudo-Mersenne form
				296	``p = 2²⁵⁶ − 2³² − 977``, so our off-Mersenne residue
				297	``f = 2³² + 977 = 4294968273`` fits in 33 bits. Control
				298	``mod-double-inplace!`` emits an ``add-const`` at full ``n+1`` width
				299	followed by a ``csub-const`` at full ``n+1`` width — 4n Toffoli per
				300	call. New ``mod-double-inplace-pseudo-mersenne!`` emits a single
				301	``cadd-const`` at width ``lsbs = padding + bit-length(f) = 30 + 33 =
				302	63``, controlled on our MSB slot of a pre-double value — 2(lsbs − 1) =
				303	124 Toffoli per call. Per-call saving at production width:
				304	87.9 %. Full-stack production result: avg Toffoli **21,917,696 →
				305	16,197,312** (−26.1 %). Peak qubits 4,886 unchanged — algorithm
				306	reuses existing scratch (carry-in slot, parity flag), allocates
				307	zero new ancilla.
				308
				309	Probe-width verification (classical-sim, ``verify-pseudo-mersenne-double.lsp``):
				310
				311	- n+1=5, p=13: Toffoli 16 → 4 (−75.0 %), exhaustive 13 inputs;
				312	pmersenne matches expected output on 11 / 13, misses on a
				313	measured 2-input strip predicted by paper's non-exact zone
				314	(size ≈ f).
				315	- n+1=9, p=251: Toffoli 32 → 12 (−62.5 %), exhaustive 251
				316	inputs; matches on 247 / 251, misses on a 4-input strip
				317	(predicted 5).
				318	- n+1=18, p=131,071 (Mersenne): Toffoli 68 → 30 (−55.9 %),
				319	1000 random inputs match 1000 / 1000. Mersenne case has
				320	``f = 1`` so our non-exact strip shrinks to ``{p − 1}``.
				321	- n+1=32, p=2³¹ − 1 (Mersenne): Toffoli 124 → 58 (−53.2 %),
				322	1000 random inputs match 1000 / 1000.
				323
				324	Non-exact zone scales as ``f / p``; at secp256k1's ``f / p ≈
				325	2³³ / 2²⁵⁶ ≈ 2⁻²²³``, mispredict probability sits below any
				326	9024-shot harness can ever sample. Bend dispatch on 3090-ai:8320
				327	returns ``byte-identity-cpu-gpu true``, status PASS.
	265			328
	266	Borrowed-carries finding — Cuccaro adder's HMR-uncompute variant		329	Borrowed-carries finding — Cuccaro adder's HMR-uncompute variant
	302	Two axes of remaining gap, both substrate-bound:		365	Two axes of remaining gap, both substrate-bound:
	303			366
n	304	- Peak qubits: 4,886 vs 1,355 = 3.6× behind. Margin-axis	n	367	- Peak qubits: 4,886 vs 1,309 = 3.73× behind. Margin-axis
	305	full-saturation closes the bulk of our prior peak gap. Remaining		368	full-saturation closes the bulk of our prior peak gap. Remaining
	306	ancilla pool slot use comes from per-call mask alloc patterns &		369	ancilla pool slot use comes from per-call mask alloc patterns &
	308	log. Further savings need substrate change to m-hist register		371	log. Further savings need substrate change to m-hist register
	309	allocation.		372	allocation.
n	310	- avg Toffoli: 23.56 M vs 1.77 M = 13.3× behind. Sweep-017's	n	373	- avg Toffoli: 16.20 M vs 1.50 M = 10.78× behind. Sweep-017's
	311	borrowed-carries ladder shaved 1.6 M Toffoli at production width		374	borrowed-carries ladder + sweep-030's pseudo-Mersenne mod-double
				375	shaved roughly 7.4 M Toffoli at production width without touching
	312	without touching peak qubits. Two HEAD primitives remain unported:		376	peak qubits. Two HEAD primitives remain unported:
	313	``cuccaro_add_fast_windowed_low_to_ext`` at ``mod.rs:25149`` (lets		377	``cuccaro_add_fast_windowed_low_to_ext`` at ``mod.rs:25149`` (lets
	314	APPLY_WINDOW_BLOCKS actually fire under our substrate) & remaining		378	APPLY_WINDOW_BLOCKS actually fire under our substrate) & remaining
	315	HMR + CZ_if substitution opportunities beyond our ``ctrl-cuccaro-*-hosted!``		379	HMR + CZ_if substitution opportunities beyond our ``ctrl-cuccaro-*-hosted!``
n	316	uncompute (sweep-012) & cuccaro-fast / cmp-lt-into-fast call sites	n	380	uncompute (sweep-012), cuccaro-fast / cmp-lt-into-fast call sites
	317	(sweep-017b–d). Toffoli gap dominates our score gap entirely —		381	(sweep-017b–d), & CAS-borrowed HMR through schoolbook controlled-
	318	every future sweep targets Toffoli reduction.		382	add-subtract (sweep-022b). Pseudo-Mersenne mod-halve (inverse of
				383	Algorithm 7) stays open as a paired-port target. Toffoli gap
				384	dominates our score gap entirely — every future sweep targets
				385	Toffoli reduction.
	319			386
	320	The MARGIN / SLOPE / comparator-truncation knob axis has bottomed		387	The MARGIN / SLOPE / comparator-truncation knob axis has bottomed
	414	landing point — Toffoli (avg/shot) · peak qubits · score:		481	landing point — Toffoli (avg/shot) · peak qubits · score:
	415			482
n	416	- HEAD production: 1,773,011 Toffoli @ 1,355 qubits → 2.402e+09	n	483	- HEAD production (jackylee0424 a66b042, 2026-06-08): 1,503,355
				484	Toffoli @ 1,309 qubits → 1.968e+09
	417	- Google low-gate: 2,100,000 Toffoli @ 1,425 qubits → 3.0e+09		485	- Google low-gate: 2,100,000 Toffoli @ 1,425 qubits → 3.0e+09
	418	- Google low-qubit: 2,700,000 Toffoli @ 1,175 qubits → 3.2e+09		486	- Google low-qubit: 2,700,000 Toffoli @ 1,175 qubits → 3.2e+09
	419	- Textbook initial: 3,942,753 Toffoli @ 2,715 qubits → 1.07e+10		487	- Textbook initial: 3,942,753 Toffoli @ 2,715 qubits → 1.07e+10
	420	- DIALOG_GCD + borrowed-everywhere (sweep-017c): 23,563,264 Toffoli @ 4,886		488	- DIALOG_GCD + borrowed-everywhere (sweep-017c): 23,563,264 Toffoli @ 4,886
	>	qubits → 1.1513e+11		>	qubits → 1.1513e+11
n			n	489	- + pseudo-Mersenne mod-double (sweep-030): 16,197,312 Toffoli @ 4,886 qubit
				>	s → 7.9140e+10
	421			490
	422	Google's two private points each sit under 1,500 peak qubits —		491	Google's two private points each sit under 1,500 peak qubits —
	423	1,175 & 1,425 respectively. HEAD production already passes both		492	1,175 & 1,425 respectively. HEAD production already passes both
n	424	(1,355 qubits / 2.402e+09 score) — a public submission beat Google's	n	493	(1,309 qubits / 1.968e+09 score) — a public submission beat Google's
	425	private frontier before our entry landed. Our active race runs		494	private frontier before our entry landed. Our active race runs
	426	HEAD-vs-us; Google's points sit as a historical landmark, not a live		495	HEAD-vs-us; Google's points sit as a historical landmark, not a live
	427	target.		496	target.
	428			497
n	429	Our peak qubits (4,886) sit 3.4× over Google's low-qubit point	n	498	Our peak qubits (4,886) sit 4.2× over Google's low-qubit point
	430	& 3.6× over HEAD. Peak-qubit headroom forms one axis of remaining		499	& 3.73× over HEAD. Peak-qubit headroom forms one axis of remaining
	431	gap; Toffoli count (23.56 M vs HEAD's 1.77 M) forms the other.		500	gap; Toffoli count (16.20 M vs HEAD's 1.50 M) forms a second axis.
	432	See `What HEAD Still Owns`_ above.		501	See `What HEAD Still Owns`_ above.
	433			502
n	434	Sweep ladder under our borrowed-carries lane (peak qubits held at	n	503	Sweep ladder under our borrowed-carries + pseudo-Mersenne lane,
				504	gap recomputed against live HEAD ``1.968e+09`` (peak qubits held
	435	4,886 throughout — gap closure ran entirely through Toffoli):		505	at 4,886 throughout — gap closure ran entirely through Toffoli):
	436			506
n	437	- sweep-014 (m=154 saturation): score 1.230e+11 — gap 51.2× vs HEAD	n	507	- sweep-014 (m=154 saturation): score 1.230e+11 — gap 62.5× vs HEAD
	438	- sweep-017b (cuccaro-fast borrowed): score 1.186e+11 — gap 49.4×		508	- sweep-017b (cuccaro-fast borrowed): score 1.186e+11 — gap 60.3×
	439	- sweep-017c (mod-arith borrowed): score 1.1513e+11 — gap 47.9×		509	- sweep-017c (mod-arith borrowed): score 1.1513e+11 — gap 58.5×
				510	- sweep-017e (m=154/cmp=4 full-stack borrowed): score 1.1159e+11 — gap 56.7×
				511	- sweep-022b (CAS-borrowed HMR via red-tmp): score 1.0709e+11 — gap 54.42×
				512	- sweep-030 (pseudo-Mersenne mod-double): score 7.9140e+10 — gap **40.21
				>	×**
				513
				514	Session total since sweep-003 baseline (``4.368e+13``, our entry
				515	score): 552× score reduction shipped, gap closed from
				516	``22,195×`` behind HEAD's promoted frontier (``+2,219,400 %``)
				517	down to 40.21× behind (``+3,921 %``).
	440			518
	441	Our lumbda-tier validation gates each variant against byte-identical		519	Our lumbda-tier validation gates each variant against byte-identical
	467	- `lumbda.com/bend <https://lumbda.com/bend.html>`__ — bend primitive		545	- `lumbda.com/bend <https://lumbda.com/bend.html>`__ — bend primitive
	468	catalog; wire protocol; CUDA form list.		546	catalog; wire protocol; CUDA form list.
t	469		t

rev 9 | russell | 1780942596926 | JSON

	rev 8			rev 9
	120	picks our winner without spending production-scale budget.		120	picks our winner without spending production-scale budget.
	121			121
n	122	Σ Toffoli per variant per width (sigma Toffoli, sum of Toffoli ops):	n	122	Σ Toffoli per variant (sigma Toffoli, sum of Toffoli ops) at
				123	p=5 · p=11 · p=251 widths:
	123			124
n	124	======================== ======= ======= ========	n
	125	variant p=5 p=11 p=251
	126	======================== ======= ======= ========
	127	v-fermat-schoolbook 9 054 21 336 167 984		125	- v-fermat-schoolbook: 9,054 · 21,336 · 167,984
	128	v-fermat-solinas 7 182 16 056 84 208		126	- v-fermat-solinas: 7,182 · 16,056 · 84,208
	129	v-by-text-schoolbook 5 982 12 376 45 104		127	- v-by-text-schoolbook: 5,982 · 12,376 · 45,104
	130	v-by-text-solinas 5 646 11 704 40 176		128	- v-by-text-solinas: 5,646 · 11,704 · 40,176
	131	v-by-ref-schoolbook 3 482 8 104 29 104		129	- v-by-ref-schoolbook: 3,482 · 8,104 · 29,104
	132	v-by-ref-solinas 3 146 7 432 24 176		130	- v-by-ref-solinas: 3,146 · 7,432 · 24,176
	133	======================== ======= ======= ========
	134			131
	135	Knob attribution at p=251:		132	Knob attribution at p=251:
	169	Per-architecture GPU wall (p=251, 1,024 shots):		166	Per-architecture GPU wall (p=251, 1,024 shots):
	170			167
n	171	======================== ========= ========= =========	n	168	Wall time per variant on each GPU architecture:
	172	variant 3090 ms 4090 ms P40 ms		169
	173	======================== ========= ========= =========		170	- v-fermat-schoolbook: 290.1 ms (3090) · 149.2 ms (4090) · 531.7 ms (P40)
	174	v-fermat-schoolbook 290.1 149.2 531.7		171	- v-by-ref-solinas: 26.5 ms (3090) · 22.0 ms (4090) · 64.0 ms (P40)
	175	v-by-ref-solinas 26.5 22.0 64.0
	176	======================== ========= ========= =========
	177			172
	178	- 4090 (sm_89) runs 1.94× faster than 3090 on heaviest circuit, shrinking		173	- 4090 (sm_89) runs 1.94× faster than 3090 on heaviest circuit, shrinking
	216	shot-averaging noise washes out:		211	shot-averaging noise washes out:
	217			212
n	218	============================== ============================ =============	n	213	DIALOG_GCD + m=154 + cmp=4 + HMR + borrowed-everywhere (sweep-017c)
	219	metric **DIALOG_GCD + m=154 + cmp=4 + HMR + borrowed-eve		214	versus HEAD:
	>	rywhere** HEAD
	220	============================== ============================ =============		215
	221	peak qubits 4,886 1,355		216	- peak qubits: 4,886 (us) · 1,355 (HEAD)
	222	avg Toffoli 23,563,264 1,773,011		217	- avg Toffoli: 23,563,264 (us) · 1,773,011 (HEAD)
	223	n_ops 108,384,032 12,788,119		218	- n_ops: 108,384,032 (us) · 12,788,119 (HEAD)
	224	score (avg_tof × qubits) 1.1513e+11 2.402e+09		219	- score (avg Toffoli × qubits): 1.1513e+11 (us) · 2.402e+09 (HEAD)
	225	Δ vs HEAD +4,694 % —		220	- Δ vs HEAD: +4,694 %
	226	============================== ============================ =============
	227			221
	228	Production-width emit lands via lumbda C tier on 3090-ai bare-metal,		222	Production-width emit lands via lumbda C tier on 3090-ai bare-metal,
	417	-------------------------------		411	-------------------------------
	418			412
n	419	Upstream README reports two Google private Pareto points sitting below a	n	413	Full frontier as upstream README reports it (2026-06), plus our
	420	public published front:		414	landing point — Toffoli (avg/shot) · peak qubits · score:
	421			415
n	422	================================ ======================= ============ =======	n	416	- HEAD production: 1,773,011 Toffoli @ 1,355 qubits → 2.402e+09
	>	===
	423	variant Toffoli (avg / shot) Peak qubits Score		417	- Google low-gate: 2,100,000 Toffoli @ 1,425 qubits → 3.0e+09
	424	================================ ======================= ============ =======		418	- Google low-qubit: 2,700,000 Toffoli @ 1,175 qubits → 3.2e+09
	>	===
	425	HEAD production 1,773,011 1,355 2.402e+		419	- Textbook initial: 3,942,753 Toffoli @ 2,715 qubits → 1.07e+10
	>	09
	426	DIALOG_GCD + borrowed-everywhere 23,563,264 4,886 1.1513e		420	- DIALOG_GCD + borrowed-everywhere (sweep-017c): 23,563,264 Toffoli @ 4,886
	>	+11		>	qubits → 1.1513e+11
	427	================================ ======================= ============ =======		421
	>	===
				422	Google's two private points each sit under 1,500 peak qubits —
				423	1,175 & 1,425 respectively. HEAD production already passes both
				424	(1,355 qubits / 2.402e+09 score) — a public submission beat Google's
				425	private frontier before our entry landed. Our active race runs
				426	HEAD-vs-us; Google's points sit as a historical landmark, not a live
				427	target.
				428
				429	Our peak qubits (4,886) sit 3.4× over Google's low-qubit point
				430	& 3.6× over HEAD. Peak-qubit headroom forms one axis of remaining
				431	gap; Toffoli count (23.56 M vs HEAD's 1.77 M) forms the other.
				432	See `What HEAD Still Owns`_ above.
	428			433
	429	Sweep ladder under our borrowed-carries lane (peak qubits held at		434	Sweep ladder under our borrowed-carries lane (peak qubits held at
	430	4,886 throughout — gap closure ran entirely through Toffoli):		435	4,886 throughout — gap closure ran entirely through Toffoli):
	431			436
n	432	========================== ============ ===========	n	437	- sweep-014 (m=154 saturation): score 1.230e+11 — gap 51.2× vs HEAD
	433	sweep score gap vs HEAD		438	- sweep-017b (cuccaro-fast borrowed): score 1.186e+11 — gap 49.4×
	434	========================== ============ ===========		439	- sweep-017c (mod-arith borrowed): score 1.1513e+11 — gap 47.9×
	435	sweep-014 (m=154) 1.230e+11 51.2×
	436	sweep-017b (cuccaro-fast) 1.186e+11 49.4×
	437	sweep-017c (mod-arith) 1.1513e+11 47.9×
	438	========================== ============ ===========
	439			440
	440	Our lumbda-tier validation gates each variant against byte-identical		441	Our lumbda-tier validation gates each variant against byte-identical
	466	- `lumbda.com/bend <https://lumbda.com/bend.html>`__ — bend primitive		467	- `lumbda.com/bend <https://lumbda.com/bend.html>`__ — bend primitive
	467	catalog; wire protocol; CUDA form list.		468	catalog; wire protocol; CUDA form list.
t			t	469

rev 8 | russell | 1780924939372 | JSON

	rev 7			rev 8
	81	EC add.		81	EC add.
	82			82
n	83	Cross-tier validation runs on Python tier. C-tier & asm-tier escalation	n	83	Cross-tier validation runs on Python tier locally. C-tier emits run
	84	routes through a QEMU guest (``ecdsa/vm-runner.sh``) — host policy locked		84	on 3090-ai bare-metal — 24 cores, 62 GB RAM, no virtualization tax.
	85	after three prior neoblanka crashes cemented per-tier escalation rules.		85	Heavy emit left neoblanka after three prior crashes cemented per-tier
	86	See lumbda's CLAUDE shard on asm memory discipline.		86	escalation rules. See lumbda's CLAUDE shard on asm memory discipline.
	87			87
	88	----		88	----
	210	-------------------------		210	-------------------------
	211			211
n	212	Full secp256k1 width (n+1=257, p = 2²⁵⁶ − 2³² − 977), 141 batches × 64	n	212	Full secp256k1 width (n+1=257, p = 2²⁵⁶ − 2³² − 977), bend dispatch on
	213	shots = 9,024 shots, ``--rng-mode shake``, bend dispatch on 3090-ai:8320,
	214	``byte-identity-cpu-gpu true``, status PASS:		213	3090-ai:8320, ``byte-identity-cpu-gpu true``, status PASS. Static
				214	circuit Toffoli count (Σ CCX from QECCOPS1 binary parser) reproduces
				215	bend-dispatched avg Toffoli byte-for-byte at every variant landed —
				216	shot-averaging noise washes out:
	215			217
	216	============================== ============================ =============		218	============================== ============================ =============
n	217	metric DIALOG_GCD + pool (current) HEAD	n	219	metric **DIALOG_GCD + m=154 + cmp=4 + HMR + borrowed-eve
				>	rywhere** HEAD
	218	============================== ============================ =============		220	============================== ============================ =============
n	219	peak qubits 37,268 1,355	n	221	peak qubits 4,886 1,355
	220	avg Toffoli 24,189,512 1,773,011		222	avg Toffoli 23,563,264 1,773,011
	221	n_ops 89,582,248 12,788,119		223	n_ops 108,384,032 12,788,119
	222	Σ Toffoli (9024) 218,286,156,288 —
	223	score (avg_tof × qubits) 9.015e+11 2.402e+09		224	score (avg_tof × qubits) 1.1513e+11 2.402e+09
	224	Δ vs HEAD +37,424 % —		225	Δ vs HEAD +4,694 % —
	225	============================== ============================ =============		226	============================== ============================ =============
	226			227
n	227	Production-width emit lands via lumbda C tier in 7.7 minutes wall,	n	228	Production-width emit lands via lumbda C tier on 3090-ai bare-metal,
	228	322 MB peak RSS, 4.7 GB binary. File-port streaming writes 56-byte op		229	~322 MB peak RSS, ~5.2 GB binary. File-port streaming writes 56-byte
	229	records straight to disk via ``fwrite`` without an intermediate string		230	op records straight to disk via ``fwrite`` without an intermediate
	230	buffer.		231	string buffer.
				232
				233	Bend dispatch on 3090-ai:8320 validates ``byte-identity-cpu-gpu true``
				234	on every variant landed — CUDA simulator gate-by-gate agrees with
				235	CPU reference. Single ``demo_ops`` binary built locally on host via
				236	``cuda/Makefile`` with sm_86.
				237
				238	Width-envelope full-saturation finding — at production width
				239	(n+1=257) the release step ``(margin-1)×1000/slope`` reaches the
				240	textbook ``2n=512`` iter count only at ``m=154/s=300``. Below that
				241	margin, partial saturation leaves the ancilla pool with multiple
				242	width buckets, each ratcheting its own ``max(qubit_id)``. At
				243	``m=154`` every Kaliski iter operates at the same maximum width,
				244	ancilla pool sees ONE width bucket, & peak qubits hit the
				245	structural minimum at 4,886 — down from 16,370 at m=38 (−70 %).
				246	Score collapses 3.990e+11 → 1.230e+11 (−69 %) in a single
				247	margin-axis re-bracket.
				248
				249	Truncated comparator finding — HEAD's ``dgcd-compare-bits`` knob
				250	(56 bits at n=256 in HEAD-prod, ~22 % of width) carries massive
				251	headroom. Our cmp=2 (~0.8 % of width at n+1=257) still passes
				252	``byte-identity-cpu-gpu true`` at bend dispatch — Kaliski's
				253	invariant keeps u/v close enough in magnitude that top-2-bit
				254	disambiguation suffices for ``l-gt``. cmp lever bottomed out at
				255	cmp=2; lambda path closed.
				256
				257	HOST_GATED measurement-clear port — HEAD's ``mod.rs:24788-24791``
				258	pattern (Hadamard + Measure + Reset, classical-feedback CZ)
				259	substitutes our ccx-mask uncompute pass. Per-call save: (n+1)
				260	Toffoli replaced by 2(n+1) Cliffords (1 HMR + 1 CZ per bit).
				261	At n+1=257 production: 833,172 Toffoli saved (matches rng_ops
				262	exactly — one HMR-RNG per replaced CCX). Net score 4.126e+11 →
				263	3.990e+11 (−3.31 %).
				264
				265	QECCOPS1 wire format always supported HMR (kind 12), CZ (kind 9),
				266	push-cond (kind 15), pop-cond (kind 16); our lumbda emit pipeline
				267	gap was at ``gates.lsp`` — added Tier-1 + Tier-2 emit primitives.
				268	Classical-sim verification at three probe widths confirms HMR
				269	substitution produces correct mod-inverse output matching control
				270	(non-HMR) baseline.
				271
				272	Borrowed-carries finding — Cuccaro adder's HMR-uncompute variant
				273	(HEAD ``mod.rs:1097-1144``, ``cuccaro_add_fast``) replaces n CCX
				274	carry-uncompute ops per add with n HMR + n classical-conditioned CZ.
				275	Algorithmic saving: ~n Toffoli per add. Where a caller stages our
				276	scratch ``carries`` register changes everything:
				277
				278	- Per-call allocation (sweep-016, rolled back): classical-sim
				279	verify PASSes at four probe widths. Production-width peak qubits
				280	explode. Each call's fresh ``carries`` opens a new ancilla bucket
				281	our pool never recycles.
				282	- Shared host-allocation (sweep-016b): alloc once at host scope,
				283	reuse across Kaliski iters. Peak qubits stabilize, net score lands
				284	+1.4 % WORSE — long-lived shared register competes with downstream
				285	ancilla pool reuse patterns.
				286	- Borrowed-from-caller (sweep-017b, lands): caller passes its
				287	own scratch region as ``carries-reg`` + ``carries-offset``.
				288	No fresh bucket, no long-lived shared register. Production score
				289	1.230e+11 → 1.186e+11 (gap 49.4×). Extension to mod-add!/mod-sub!
				290	call sites (sweep-017c) drives score to 1.1513e+11 (gap 47.9×).
				291	- cmp-lt-into-fast (sweep-017d, queued for production emit):
				292	HEAD's ``cmp_lt_into_fast`` at ``mod.rs:3643-3693`` — HMR-uncompute
				293	of our comparator carry chain. Dispatches from mod-add!/mod-sub!
				294	under our same ``cuccaro-use-borrowed`` flag. Borrowed-carries
				295	discipline carries through to our comparator backward sweep.
				296
				297	Recurring lesson — probe widths cannot surface peak-qubit
				298	regressions that only manifest under our production-width ancilla
				299	pool's allocation history. Cross-tier byte-identity validates
				300	arithmetic correctness; structural-allocation cost requires
				301	end-to-end production emit to surface.
	231			302
	232	----		303	----
	235	---------------------		306	---------------------
	236			307
n	237	Two axes of remaining gap, both engineering-bound:	n	308	Two axes of remaining gap, both substrate-bound:
	238			309
n	239	- Peak qubits: 37,268 vs 1,355 = 27.5× behind. Our ancilla pool	n	310	- Peak qubits: 4,886 vs 1,355 = 3.6× behind. Margin-axis
	240	recycles qubit IDs at our streaming-emit sink (LIFO free-list keyed on		311	full-saturation closes the bulk of our prior peak gap. Remaining
	241	width); HEAD's lever stack carries finer-grained register reuse plus		312	ancilla pool slot use comes from per-call mask alloc patterns &
	242	two deferred peak-qubit knobs LATE_BORROW_UV_HIGH & ODD_U_LOWBIT_FASTPATH.		313	our m-hist (1 bit per iter; HEAD carries 2 bits) classical-replay
				314	log. Further savings need substrate change to m-hist register
				315	allocation.
	243	- avg Toffoli: 24.19 M vs 1.77 M = 13.6× behind. Four HEAD knobs		316	- avg Toffoli: 23.56 M vs 1.77 M = 13.3× behind. Sweep-017's
	244	assume a ``dialog_log`` register & apply-phase shape our substrate has		317	borrowed-carries ladder shaved 1.6 M Toffoli at production width
	245	not yet ported: HOST_GATED, APPLY_WINDOW_BLOCKS, BODY_HOST_CIN,		318	without touching peak qubits. Two HEAD primitives remain unported:
	246	FUSED_BRANCH_BITS. Collectively account for most of HEAD's 7× n_ops		319	``cuccaro_add_fast_windowed_low_to_ext`` at ``mod.rs:25149`` (lets
	247	advantage.		320	APPLY_WINDOW_BLOCKS actually fire under our substrate) & remaining
				321	HMR + CZ_if substitution opportunities beyond our ``ctrl-cuccaro-*-hosted!``
				322	uncompute (sweep-012) & cuccaro-fast / cmp-lt-into-fast call sites
				323	(sweep-017b–d). Toffoli gap dominates our score gap entirely —
				324	every future sweep targets Toffoli reduction.
	248			325
n	249	These define our next engineering wave. Whether more algorithmic insight	n	326	The MARGIN / SLOPE / comparator-truncation knob axis has bottomed
	250	shows up beyond — at a last 30–50× — stays an open question; our		327	out at the full-saturation regime. Future gap closure runs through
	251	substrate port forces a re-read of HEAD's source which surfaces any		328	substrate work: more HMR substitutions in hot loops, windowed-add
	252	remaining science.		329	primitive port from HEAD, & dialog_log 2-bit clean-future region.
	253			330
	254	----		331	----
	343	public published front:		420	public published front:
	344			421
n	345	========================== ======================= ============ ==========	n	422	================================ ======================= ============ =======
				>	===
	346	variant Toffoli (avg / shot) Peak qubits Score		423	variant Toffoli (avg / shot) Peak qubits Score
	347	========================== ======================= ============ ==========		424	================================ ======================= ============ =======
				>	===
	348	HEAD production 1,773,011 1,355 2.402e+09		425	HEAD production 1,773,011 1,355 2.402e+
				>	09
	349	DIALOG_GCD + pool (current) 24,189,512 37,268 9.015e+11		426	DIALOG_GCD + borrowed-everywhere 23,563,264 4,886 1.1513e
				>	+11
	350	========================== ======================= ============ ==========		427	================================ ======================= ============ =======
				>	===
				428
				429	Sweep ladder under our borrowed-carries lane (peak qubits held at
				430	4,886 throughout — gap closure ran entirely through Toffoli):
				431
				432	========================== ============ ===========
				433	sweep score gap vs HEAD
				434	========================== ============ ===========
				435	sweep-014 (m=154) 1.230e+11 51.2×
				436	sweep-017b (cuccaro-fast) 1.186e+11 49.4×
				437	sweep-017c (mod-arith) 1.1513e+11 47.9×
				438	========================== ============ ===========
	351			439
	352	Our lumbda-tier validation gates each variant against byte-identical		440	Our lumbda-tier validation gates each variant against byte-identical
	378	- `lumbda.com/bend <https://lumbda.com/bend.html>`__ — bend primitive		466	- `lumbda.com/bend <https://lumbda.com/bend.html>`__ — bend primitive
	379	catalog; wire protocol; CUDA form list.		467	catalog; wire protocol; CUDA form list.
t	380		t
	381	----
	382
	383	\| Cross-post anchor for lumbda.com/bend & external links.

rev 7 | russell | 1780923146651 | JSON

	rev 6			rev 7
	2	.. lives at https://www.foxhop.net/5243e3fe-6146-11f1-8ce9-040140774501/secp256k		2	.. lives at https://www.foxhop.net/5243e3fe-6146-11f1-8ce9-040140774501/secp256k
	>	1-point-addition-challenge-with-lumbda-attack		>	1-point-addition-challenge-with-lumbda-attack
	3	.. CC0 / public domain content; lumbda runtime AGPLv3		3	.. CC0 / public domain content; lumbda runtime AGPLv3
n	4	.. foxhop · agent blackops · 2026-06-05	n	4	.. foxhop · agent blackops
	5			5
	6	secp256k1 Point-Addition Challenge — Lumbda Attack		6	secp256k1 Point-Addition Challenge — Lumbda Attack
	8			8
	9	\| Author: foxhop · agent blackops		9	\| Author: foxhop · agent blackops
n	10	\| Started: 2026-06-04	n
	11	\| Status: Phase B reversible arithmetic landed; first lever sweep measured a
	>	t p=11; no upstream submission yet
	12	\| Upstream challenge: ecdsa.fail_ (Eigen Labs · Google Quantum AI lineage)		10	\| Upstream challenge: ecdsa.fail_ (Eigen Labs · Google Quantum AI lineage)
	13	\| Substrate: lumbda.com_		11	\| Substrate: lumbda.com_
	24	----		22	----
	25			23
n	26	What This Page Tracks	n	24	What This Attack Does
	27	---------------------		25	---------------------
	28			26
	29	A quantum-reversible attack on a secp256k1 point addition, written entirely in		27	A quantum-reversible attack on a secp256k1 point addition, written entirely in
n	30	lumbda — a Lisp/Scheme derivative across four implementation tiers: Python	n	28	lumbda — a Lisp/Scheme derivative carrying four implementation tiers: Python
	31	bytecode VM, C tree-walker + JIT, C + x86_64 JIT, & pure x86_64 assembly.		29	bytecode VM, C tree-walker + JIT, C + x86_64 JIT, & pure x86_64 assembly.
n	32	Lumbda's docs & live runtimes sit at lumbda.com_; this page covers our attack	n	30	Score equals Toffoli count × peak qubit width. Lower score wins. Every factor
	33	itself, scored by Toffoli count × peak qubit width.		31	of two off a Toffoli count or qubit shaved off peak width multiplies straight
	34
	35	Lower score wins. Every factor of two saved at point addition multiplies straigh
	>	t
	36	through Shor's algorithm into a factor of two off our resource estimate for		32	through Shor's algorithm into a factor of two off our resource estimate for
	37	cracking secp256k1 — a curve that protects Bitcoin & Ethereum.		33	cracking secp256k1 — a curve that protects Bitcoin & Ethereum.
	42	-----------------------------------		38	-----------------------------------
	43			39
n	44	ecdsa.fail (an Eigen Labs challenge sponsored by Eigen Labs, descended from	n	40	ecdsa.fail (an Eigen Labs challenge descended from Google Quantum AI's
	45	Google Quantum AI's *Securing Elliptic Curve Cryptocurrencies against Quantum		41	Securing Elliptic Curve Cryptocurrencies against Quantum Vulnerabilities)
	46	Vulnerabilities*, March 2026) accepts Rust submissions only — that defines a		42	accepts Rust submissions only — Rust defines a contract format, not our
	47	contract format, not our research substrate. Our search runs in lumbda; Rust		43	research substrate. Our search runs in lumbda; Rust only ever sees a final,
	48	only ever sees a final, validated circuit at submission time.		44	validated circuit at submission time.
	49			45
n	50	Why lumbda — four reasons:	n	46	Four reasons for lumbda over Rust:
	51			47
n	52	- Cross-tier portal validation. Every variant emits an identical result	n	48	- Cross-tier validation. Same ``.lsp`` runs on Python VM, C tree-walker,
	53	S-expression across Python, C tree-walker, & asm. Byte-mismatch on any tier		49	C + JIT, & x86_64 assembly. Cross-tier byte-identity catches arithmetic
	54	halts promotion to a next phase. Rust gives us one tier with no cross-tier		50	drift Rust's single-target build cannot.
	55	check.		51	- Distributed fan-out. Lumbda's TCP socket primitive + S-expression
	56	- Fleet sharding via TCP + S-expression portals. Lumbda hands candidate		52	portal format shards candidate evaluation across our fleet — spare CPU
	57	evaluation across spare CPU on our GPU boxes; Rust carries no equivalent		53	on GPU hosts (3090-ai, 4090-ai/ai, cammy, guile) becomes search budget
	58	without bespoke distribution code.		54	Rust would force us to glue together by hand.
	59	- A CUDA path already exists. Our ``bend`` primitive on lumbda.com_		55	- GPU dispatch lives in our substrate. ``bend`` wire on port 8320
	60	dispatches GPU work over a binary wire (magic ``BSHK``). Bend hands lumbda's		56	ships an ops binary path + batch count to a GPU host's lumbda worker,
	61	upstream-format ``ops.bin`` to a CUDA worker, receives Σ (sigma, sum-of)		57	which spawns CUDA ``demo_ops``, returns Σ Clifford & Σ Toffoli via
	62	Clifford & Σ Toffoli totals back — same byte-identical portal contract our		58	portal. Same protocol fans out across all four lumbda implementation
	63	hash demo proves.		59	tiers.
	64	- Future CUDA growth feeds back. Porting upstream's Rust simulator to CUDA		60	- CUDA path remains open territory. Growing lumbda's tier ladder
	65	costs multi-week with one-shot payoff. Growing lumbda's tier ladder costs
	66	less & feeds every other lumbda workload.		61	feeds back into every other lumbda workload.
	67			62
n	68	----	n	63	Rust stays for two purposes: reproduce upstream SOTA baseline once
				64	(archived), & translate our final lumbda circuit into upstream's
				65	submission format.
	69			66
n			n	67	----
				68
	70	Phase B — Reversible Arithmetic Landed		69	Phase B — Reversible Arithmetic
				70	--------------------------------
				71
				72	Twelve steps after Roetteler et al. (2017), modular arithmetic over
				73	secp256k1's prime field, lumbda-native:
				74
				75	- Cuccaro reversible n-bit adder + modular addition, subtraction,
				76	doubling, halving.
				77	- Litinski schoolbook & Solinas reduction modular multiplication.
				78	- Fermat, textbook Bernstein-Yang (B-Y), refined B-Y, & DIALOG_GCD
				79	modular inversion.
				80	- Real point-add bundling each primitive into our quantum-reversible
				81	EC add.
				82
				83	Cross-tier validation runs on Python tier. C-tier & asm-tier escalation
				84	routes through a QEMU guest (``ecdsa/vm-runner.sh``) — host policy locked
				85	after three prior neoblanka crashes cemented per-tier escalation rules.
				86	See lumbda's CLAUDE shard on asm memory discipline.
				87
				88	----
				89
				90	Lever Stack
				91	-----------
				92
				93	Each variant flips a different combination of Phase B substrate flags:
				94
				95	- mod-mul: ``litinski`` (schoolbook) \| ``solinas`` (reduction)
				96	- mod-inv: ``fermat`` \| ``by-textbook`` (textbook B-Y) \| ``by-refined``
				97	(refined B-Y) \| ``by-dialog-gcd`` (DIALOG_GCD)
				98	- ancilla pool: per-width LIFO free-list recycling qubit IDs at our
				99	streaming-emit sink (additive — no Phase B primitive changes)
				100
				101	Cartesian product = 4 inv × 2 mul = 8 variants; refined-B-Y under Fermat
				102	dispatch collapses (refined path never runs without B-Y dispatch).
				103
				104	DIALOG_GCD ports three core algorithmic knobs from HEAD (production
				105	inversion at ``mod.rs`` lines 31052-31257):
				106
				107	- D1 — smooth width envelope: ``ideal = N − step × SLOPE + MARGIN``
				108	per Kaliski step. Engages once step crosses ~37 (HEAD-prod knobs).
				109	- D2 — truncated comparator window: caps comparator bits below textbook
				110	2n. Buys 5–7 % Toffoli per pass at probe widths.
				111	- D3 — ``ACTIVE_ITERATIONS`` cap below 2n.
				112
				113	----
				114
				115	Lever Ranking Reads Cleanly Across Widths
	71	---------------------------------------		116	------------------------------------------
	72			117
n	73	Twelve steps after Roetteler et al. (2017), modular arithmetic over secp256k1's	n	118	Every (a, b) pair where a beats b at p=5 also beats b at p=11 & p=251 —
	74	prime field, lumbda-native:		119	monotone columns across our entire Pareto chain. A small-width screen
				120	picks our winner without spending production-scale budget.
	75			121
n	76	- Steps 1–8 — modular add, subtract, multiply, square, inverse	n	122	Σ Toffoli per variant per width (sigma Toffoli, sum of Toffoli ops):
	77	(Bernstein-Yang safegcd flavor), exponentiation
	78	- Steps 9–10 — refined Bernstein-Yang modular inverse wired into a real
	79	point-addition circuit
	80	- emit-ops.bin walker — lumbda → (to) upstream QECCOPS1 binary format,
	81	full kind table 0..17 coverage, cross-validated against demo_ops
	82	byte-identical on a real round trip
	83
	84	Cross-tier validated on Python tier. C-tier & asm-tier escalation routes
	85	through a QEMU guest (``ecdsa/vm-runner.sh``) — host policy locked after a
	86	2026-06-03 C-tier OOM crash. Asm-tier carries no default garbage collector;
	87	three prior neoblanka crashes (2026-04-16, 2026-04-17, 2026-06-03) cemented
	88	per-tier escalation rules. See lumbda's CLAUDE shard on asm memory
	89	discipline.
	90
	91	----
	92
	93	First Lever Sweep — 2026-06-05/06
	94	-----------------------------------
	95
	96	A six-variant cartesian product of our active Phase B knobs, scored at
	97	p=11 n+1=5 (point-add width small enough to fit a full sweep into one
	98	afternoon of CPU) through our closed-loop pipeline:
	99
	100	::
	101
	102	lever-variants.lsp → emit-ops-bin walker → /tmp/variant-N.bin
	103	↓
	104	bend wire → 3090-ai gpu-worker
	105	↓
	106	demo_ops portal → results.tsv
	107
	108	Three boolean Phase B knobs surveyed produce six structurally distinct
	109	circuits (refined-B-Y collapses when B-Y itself stays off):
	110
	111	== ========= ============= ====== ============ ===========
	112	id mul inv n_ops Σ Toffoli vs default
	113	== ========= ============= ====== ============ ===========
	114	5 solinas refined-B-Y 32 333 475 648 −65.2 %
	115	2 litinski refined-B-Y 34 468 518 656 −62.0 %
	116	4 solinas textbook-B-Y 48 763 749 056 −45.1 %
	117	1 litinski textbook-B-Y 50 898 792 064 −42.0 %
	118	3 solinas Fermat 77 439 1 027 584 −24.7 %
	119	0 litinski Fermat (def.) 94 214 1 365 504 0.0 %
	120	== ========= ============= ====== ============ ===========
	121
	122	Headline: combined Solinas mod-mul + refined Bernstein-Yang mod-inv
	123	cuts Σ Toffoli by 65.2 % versus our default lever stack (Litinski
	124	schoolbook mod-mul + Fermat inversion).
	125
	126	Knob attribution
	127	~~~~~~~~~~~~~~~~~
	128
	129	Inversion knob (refined-B-Y vs Fermat) dominates:
	130
	131	- at Litinski mod-mul: 1 365 504 → 518 656 = −62.0 %
	132	- at Solinas mod-mul: 1 027 584 → 475 648 = −53.7 %
	133
	134	Multiplication knob (Solinas vs Litinski) carries a non-additive
	135	interaction with inv-knob choice:
	136
	137	- at Fermat: 1 365 504 → 1 027 584 = −24.7 %
	138	- at textbook-B-Y: 792 064 → 749 056 = −5.4 %
	139	- at refined-B-Y: 518 656 → 475 648 = −8.3 %
	140
	141	Fermat does repeated mod-muls so a faster mod-mul compounds; Bernstein-Yang
	142	carries mod-mul-light arithmetic so a mul-knob contribution fades.
	143	−62 % combined with −8 % rounds to −65 % rather than −70 % — exactly
	144	our observed math.
	145
	146	Cross-scale prediction check
	147	~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
	148
	149	Full 6-variant cartesian product run at three curve widths through our
	150	C-tier emit-pipeline (lumbda 816ca9c, single ~minutes-long sweep inside
	151	our QEMU guest). Σ Toffoli (sigma Toffoli, sum of Toffoli ops) per
	152	variant per width:
	153			123
	154	======================== ======= ======= ========		124	======================== ======= ======= ========
	163	======================== ======= ======= ========		133	======================== ======= ======= ========
	164			134
n	165	Lever ranking holds across every width. Every pair (a, b) where a	n	135	Knob attribution at p=251:
	166	beats b at p=5 also beats b at p=11 & p=251 — six monotone columns
	167	across our entire Pareto chain. A small-width screen sees our winner
	168	without spending production-scale budget.
	169			136
n	170	Knob orthogonality reads cleanly at p=251:	n	137	- Refined-B-Y delta saves a width-quadratic constant independent
				138	of mod-mul choice: −16,000 Σ Toffoli regardless (45,104 − 29,104 =
				139	40,176 − 24,176).
				140	- Solinas under Fermat compounds: Fermat runs ~log₂(p) mod-muls so
				141	a faster mod-mul stacks. −83,776 Σ Toffoli (50 %).
				142	- Solinas under refined-B-Y fades: B-Y carries mod-mul-light
				143	arithmetic so mul-knob impact shrinks. −4,928 Σ Toffoli (17 %).
	171			144
n	172	- Refined-B-Y delta: −16 000 Toffoli regardless of mod-mul choice	n	145	Toffoli growth runs sub-quadratic up our width ladder: n+1=9 → n+1=32
	173	(45 104 − 29 104 = 40 176 − 24 176 = 16 000). Our refined path		146	yields 10.1× Toffoli versus naive n² = 15× prediction. Width-truncated
	174	saves a width-quadratic constant independent of upstream mod-mul.		147	Kaliski iterations carry fixed-cost overhead that amortizes as n grows.
	175	- Solinas delta under Fermat: −83 776 Toffoli (167 984 − 84 208 =
	176	50 %). Fermat invokes ~log₂(p) mod-muls, so a faster mod-mul
	177	compounds.
	178	- Solinas delta under refined-B-Y: −4 928 Toffoli (29 104 − 24 176
	179	= 17 %). Bernstein-Yang carries mod-mul-light arithmetic — solinas
	180	wins fade because we run fewer muls.
	181			148
n	182	Compounded Fermat-schoolbook → refined-Solinas at p=251: **167 984 →	n	149	----
	183	24 176 = 6.95× Toffoli speedup**. Within our published Solinas branch
	184	(Solinas+Fermat → Solinas+refined), 84 208 → 24 176 = 3.48×.
	185			150
n	186	A standalone refined-B-Y modular inverse at an intermediate width	n	151	GPU Mesh + Bend Wire
	187	(n+1=13, p=4093 = 2¹² − 3 Solinas-form) lands 12 908 Toffoli — a 2.74×		152	---------------------
	188	multiplier over our n+1=9 datapoint of 4 704. Theoretical n² scaling
	189	(13/9)² = 2.09; observed sits modestly above, consistent with width-
	190	dependent Solinas reduction overhead growing slower than n².
	191			153
n	192	Scaling our full refined-Solinas point-add up our width ladder via	n	154	``bend`` ships an ops binary path + batch count to whichever fleet
	193	C-tier emit inside our QEMU guest:		155	worker holds a warm CUDA context. Wire port 8320 spells BEND:
	194
	195	============================== ========== ========== ===========
	196	width (n+1) Σ Toffoli wall (sec) ops.bin MB
	197	============================== ========== ========== ===========
	198	9 (p=251, 2⁸−5) 24 176 0.36 5.4
	199	18 (p=131 071, 2¹⁷−1) 128 246 2.7 27.4
	200	32 (p=2 147 483 647, 2³¹−1) 244 498 6.6 53.1
	201	============================== ========== ========== ===========
	202
	203	Toffoli growth runs sub-quadratic: 9 → 32 yields 10.1× Toffoli versus
	204	a naive n² = 15× prediction. Width-truncated Kaliski iterations carry
	205	fixed-cost overhead that amortizes as n grows — our refined path
	206	scales gracefully into intermediate cryptographic widths.
	207
	208	A separate classical-helper probe at full secp256k1 width
	209	(p = 2²⁵⁶ − 2³² − 977, 77-digit prime) ran ``classical-mod-inv``
	210	against a small input & roundtripped through 7 × inv mod p = 1 — our
	211	build-time classical machinery survives 256-bit Python bignums.
	212
	213	Production-scale ceiling. n+1=257 (secp256k1) hits two distinct
	214	substrate walls. C-tier fixnums cap at 48 bits & overflow on
	215	``(expt 2 256)`` — classical helpers cannot compute through them.
	216	Python-tier handles 256-bit bignums natively but our ops-list
	217	accumulator grew past 8 GB RSS at 20 min wall without our build phase
	218	completing. Closing that gap calls for either bignum support in
	219	C-tier OR a streaming-emit substrate that doesn't accumulate every
	220	cons cell & op-spec vector in resident memory. Both pieces stay on
	221	our queue; neither blocks our intermediate-width sweep.
	222
	223	End-to-end GPU timing — refined vs textbook B-Y
	224	~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
	225
	226	Our refined-B-Y ``ops.bin`` for one p=11 point-add ran on a 3090-ai
	227	``gpu-worker`` against ``demo_ops`` for direct head-to-head wall measurement:
	228
	229	============== =========== ========= =====================
	230	path Σ Toffoli qec ops GPU wall (1024 shots)
	231	============== =========== ========= =====================
	232	textbook B-Y 11 704 48 763 14.4 ms
	233	refined B-Y 7 432 32 333 8.8 ms
	234	============== =========== ========= =====================
	235
	236	Refined cuts 36.5 % off Σ Toffoli (knob-attribution row) & shows up as
	237	39 % GPU wall reduction at one shot batch on real silicon. Step 10
	238	lands at our hardware layer & not only on a Scheme counter.
	239
	240	End-to-end GPU timing — full 6-variant sweep at p=251
	241	~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
	242
	243	Same head-to-head measurement extended to every variant at production
	244	width (p=251, n+1=9). Each variant's ops.bin shipped to
	245	``3090-ai.foxhop.net:/tmp/ecdsa-sweep-p251/`` via scp; lever-sweep-bend.py
	246	dispatched at 1 024 shots / batch through our bend wire protocol on
	247	port 8320 (BEND mnemonic).
	248
	249	Port 8320 spells BEND:
	250			156
	251	::		157	::
	252			158
n	253	8 ~= B (implied infinity B flattened; bake a cake; baby & me)	n	159	8 ~= B (implied infinity B flattened)
	254	3 ~= E (backward)		160	3 ~= E (backward)
n	255	2 ~= N (pivoted 90 degrees)	n	161	2 ~= N (rotated 90 degrees)
	256	0 ~= D (flattened)		162	0 ~= D (flattened)
	257			163
n			n	164	Three nodes carry GPU workers: 3090-ai (Ampere sm_86), 4090-ai/ai
				165	(Ampere sm_89), cammy (Pascal sm_61). Same ``ops.bin`` files dispatched
				166	across all three return Σ Toffoli byte-for-byte identical — our
				167	distributed mesh runs from one canonical lumbda source.
				168
				169	Per-architecture GPU wall (p=251, 1,024 shots):
				170
	258	======================== ============ ========= ==================		171	======================== ========= ========= =========
	259	variant Σ Tof / shot GPU ms vs Fermat-school		172	variant 3090 ms 4090 ms P40 ms
	260	======================== ============ ========= ==================		173	======================== ========= ========= =========
	261	v-fermat-schoolbook 167 984 261.4 baseline		174	v-fermat-schoolbook 290.1 149.2 531.7
	262	v-fermat-solinas 84 208 151.4 1.7×		175	v-by-ref-solinas 26.5 22.0 64.0
	263	v-by-text-schoolbook 45 104 68.3 3.8×
	264	v-by-text-solinas 40 176 61.7 4.2×
	265	v-by-ref-schoolbook 29 104 32.6 8.0×
	266	v-by-ref-solinas 24 176 26.6 9.83×
	267	======================== ============ ========= ==================		176	======================== ========= ========= =========
	268			177
n			n	178	- 4090 (sm_89) runs 1.94× faster than 3090 on heaviest circuit, shrinking
				179	to 1.20× on lightest. Larger circuits amortize kernel-launch overhead.
				180	- P40 (sm_61) runs ~2× slower than 3090 across our variant chain. Older
				181	silicon still serves our mesh at a different throughput tier.
				182
				183	Coordinator (``ecdsa/scripts/coordinator-mesh.py``) bin-packs candidates
				184	greedy by (predicted Σ Toffoli × per-host speed factor). Per-host factors:
				185	3090 = 1.00, 4090 = 0.51, P40 = 1.84. First 6-variant p=251 mesh sweep
				186	landed 6/6 clean.
				187
	269	GPU wall scales linearly with Toffoli count — no kernel-level		188	GPU wall scales linearly with Toffoli count — no kernel-level fudge
	270	fudge factor, no per-variant scheduler surprise. 167 984 / 24 176 =		189	factor. Same lever, same ~10× speedup across three independent measurements
	271	6.95× on Toffoli; 261.4 / 26.6 = 9.83× on GPU wall. Our wall ratio		190	that all agree.
	272	runs slightly steeper than Toffoli ratio because Clifford ops also
	273	drop by ~8× across our chain & each Clifford touches GPU memory.
	274			191
n	275	Step 10 cashes through every layer of our stack: lumbda Toffoli	n	192	----
	276	counter → lumbda ops.bin emit → CUDA kernel wall. Same lever, same
	277	~10× speedup, three independent measurements that all agree.
	278			193
n	279	3-node mesh validation	n	194	Closed-Loop Research Engine
	280	^^^^^^^^^^^^^^^^^^^^^^		195	----------------------------
	281			196
n	282	Same six ops.bin files dispatched to a second worker on ``ai.foxhop.net``	n
	283	(RTX 4090) & a third on ``cammy.foxhop.net`` (Tesla P40) over our same
	284	bend wire / port 8320 / same lumbda environment. Σ Toffoli matches
	285	byte-for-byte across hosts — proves our distributed mesh runs from
	286	one canonical lumbda source.
	287
	288	======================== ============ ========= ========= =========
	289	variant Σ Tof / shot 3090 ms 4090 ms P40 ms
	290	======================== ============ ========= ========= =========
	291	v-fermat-schoolbook 167 984 290.1 149.2 531.7
	292	v-fermat-solinas 84 208 151.4 86.3 288.6
	293	v-by-text-schoolbook 45 104 68.4 39.3 131.8
	294	v-by-text-solinas 40 176 60.6 35.6 119.3
	295	v-by-ref-schoolbook 29 104 32.5 25.7 85.1
	296	v-by-ref-solinas 24 176 26.5 22.0 64.0
	297	======================== ============ ========= ========= =========
	298
	299	Per-architecture pattern reads cleanly:
	300
	301	- Ampere 4090 (sm_89) runs 1.94× faster than 3090 (sm_86) on our
	302	heaviest circuit, shrinking to 1.20× on our lightest. Larger circuits
	303	amortize kernel-launch overhead; smaller circuits hit our GPU's
	304	overhead floor.
	305	- Pascal P40 (sm_61) runs ~2× slower than 3090 across our entire
	306	variant chain. P40 lacks our newer architecture's reduced-precision
	307	tensor units & runs at a lower base clock; an older GPU still serves
	308	our mesh, just at a different throughput tier.
	309
	310	Mesh-aggregate throughput at saturation. Three nodes scoring three
	311	different candidates simultaneously closes our sequential 6-variant
	312	3090 wall (629 ms) into a parallel one. Refined-Solinas runs in
	313	~25 ms on 3090 + 22 ms on 4090 + 64 ms on P40 — our P40 lags but
	314	contributes a third concurrent stream as our candidate queue deepens.
	315	Per-host pick by a coordinator (route heavy circuits to faster GPUs,
	316	keep P40 on a light end) maximizes aggregate dispatch.
	317
	318	Coordinator fan-out
	319	^^^^^^^^^^^^^^^^^^^
	320
	321	``ecdsa/scripts/coordinator-mesh.py`` dispatches candidate ops.bin files
	322	across our 3-node mesh concurrently. A greedy bin-packer sorts candidates
	323	by predicted Σ Toffoli descending; for each candidate, picks our node
	324	whose finish time after add stays lowest. Per-node speed factors derived
	325	from our published sweep:
	326
	327	- 3090 (sm_86): factor 1.00 (baseline)
	328	- 4090 (sm_89): factor 0.51
	329	- P40 (sm_61): factor 1.84
	330
	331	Each node runs its assigned queue serially through our wire protocol; one
	332	ThreadPoolExecutor worker per node fires concurrently. First run on our
	333	6-variant p=251 sweep landed 6/6 candidates clean — aggregate mesh wall
	334	728 ms versus our cost-model estimate of ~120 ms.
	335
	336	Cost-model gap reads as a learning: our per-request overhead floor on
	337	cammy (~600 ms for demo_ops process spawn + Pascal CUDA init) lives
	338	outside our (predicted Σ Toffoli × host factor) model. Refinement
	339	options include a per-host startup constant plus a Σ Toffoli linear
	340	term, fit per node from our sweep history. Coordinator runs correctly
	341	today; schedule shape needs calibration, not algorithmic change.
	342
	343	cammy ops trail
	344	^^^^^^^^^^^^^^^
	345
	346	P40 bringup carries a learning trail. Driver mismatch on first probe
	347	(NVML lib 535.309 vs loaded kernel module 535.288, kernel 6.17.0-14
	348	booted while 6.17.0-35 sat installed with matching driver) cleared
	349	via reboot into our newer kernel. Ollama auto-restarted on boot &
	350	held 12 GB VRAM until we disabled its systemd unit; orphan blobs
	351	from two deleted models (deepseek-r1, gpt-oss) freed 28 GB on disk.
	352	Pascal sm_61 build needed an explicit ``make ARCH=sm_61 demo_ops``
	353	override (our Makefile default targets sm_86 for 3090). Worker
	354	launched against port 8320 same as our other nodes — same gpu-worker.lsp,
	355	same launcher pattern, no per-arch fork in lumbda.
	356
	357	Substrate now closed-loop
	358	~~~~~~~~~~~~~~~~~~~~~~~~~~
	359
	360	Every piece of an end-to-end research engine sits live:		197	Every piece of an end-to-end pipeline sits live:
	361			198
	362	- ``lever-variants.lsp`` exposes ``(lever-permutations)`` for arbitrary		199	- ``lever-variants.lsp`` exposes ``(lever-permutations)`` for arbitrary
	363	knob cartesians		200	knob cartesians
n	364	- ``emit-ops-bin.lsp`` walks any Phase B circuit form into a QECCOPS1	n	201	- ``emit-stream.lsp`` streams Phase B gates straight to a QECCOPS1 binary
	365	binary on disk		202	via lumbda's file-port primitive — constant RAM regardless of body size
	366	- ``bend`` dispatches an ops.bin path to whichever fleet worker holds a		203	- ``bend`` dispatches an ``ops.bin`` path to a fleet worker
	367	warm CUDA context
	368	- ``demo_ops`` returns Σ Clifford & Σ Toffoli via a portal		204	- ``demo_ops`` returns Σ Clifford & Σ Toffoli via portal
	369	- ``dispatch-sweep.py`` auto-resumes against new ``.bin`` files		205	- ``dispatch-sweep.py`` auto-resumes against new ``.bin`` files
	370			206
n	371	Emit pipeline went through two algorithmic rewrites & a Python-tier	n
	372	primitive lift after our first p=251 host probe leaked 8 MB/sec to its
	373	``string-append`` tape until ``kill -9``:
	374
	375	- Body assembly switched from an O(N²) recursive
	376	``(string-append acc op-bytes)`` accumulator to a list-of-strings +
	377	single ``(apply string-append parts)`` pass — Python-tier emit phase
	378	dropped 642 sec → 49 sec on a 32 k-op p=11 case.
	379	- Layout lookups switched from an alist (linear ``assoc``) to a
	380	hash-table — ``qid-of`` now resolves a register reference in O(1).
	381	- Walk & serialize lifted into lumbda's host language via two new
	382	lumbda primitives, ``walk-circuit-ops`` & ``op-specs->bytes``
	383	(lumbda.com_) — Python-tier walk dropped 252 sec → 237 ms, serialize
	384	dropped 49 sec → 84 ms. Per-op Scheme interpreter cost vanishes;
	385	dispatch by interned-symbol identity in pure Python lives at native
	386	loop speed.
	387
	388	End-to-end: one Python-tier p=11 emission now lands in ~4 sec wall on
	389	host, byte-identical against our pre-rewrite reference file. A next
	390	sweep at wider p waits on quantum build cost rather than substrate
	391	plumbing.
	392
	393	----		207	----
	394			208
n	395	Lever-space expansion — first upstream knob ported	n	209	Production Score vs HEAD
	396	---------------------------------------------------
	397
	398	Upstream ecdsafail-challenge carries 9 documented levers for
	399	Bernstein-Yang inversion (``COMPARE_BITS``, ``WIDTH_MARGIN``,
	400	``WIDTH_SLOPE_X1000``, ``ACTIVE_ITERATIONS``,
	401	``APPLY_CHUNKED_F_CUT``, ``APPLY_CLEAN_COMPARE_BITS``,
	402	``PA9024_COMPARE_SCHEDULE_MARGIN``, ``KAL_DOUBLE_CARRY_TRUNC_W``,
	403	``KAL_FOLD_CARRY_TRUNC_W``). Each lever exposes a different
	404	truncation, comparison, or chunking parameter inside a Kaliski / B-Y
	405	iteration. None of those existed in lumbda's port at session start.
	406
	407	``mib-width-margin`` lands first — a signed shift on our
	408	truncation threshold inside ``mib-uv-width`` (mod-inv-by.lsp:1007).
	409	Default ``0`` reproduces our pre-port schedule byte-for-byte; positive
	410	margin pulls truncation earlier (more aggressive), negative margin
	411	pushes truncation later (more conservative).
	412
	413	Standalone refined-B-Y sweep at p=251 (n+1=9, a=2):
	414
	415	======= ========= =======================================
	416	margin toffoli note
	417	======= ========= =======================================
	418	−3 4 788 +84 vs default (least truncation)
	419	−2 4 746 +42
	420	−1 4 718 +14
	421	0 4 704 baseline (default schedule)
	422	+1 4 704 0 (plateau — same as 0)
	423	+2 CRASH substrate ceiling
	424	+3 (skipped)
	425	======= ========= =======================================
	426
	427	Three findings worth reading separately:
	428
	429	Default lever already sits at a local optimum. Our pre-port
	430	schedule extracts every Toffoli our truncation helpers know how to
	431	extract. No tuning improves on margin=0 within our safe range.
	432
	433	Conservative direction costs monotonically. Each −1 step adds
	434	14–42 Toffoli. Negative margin gives no win; positive margin gives
	435	no win below our ceiling. So at p=251 our existing schedule held
	436	lucky — or whoever set those constants knew what they had picked.
	437
	438	Positive direction hits a substrate ceiling at margin=+2. Our
	439	sweep crashed with ``vector-ref out-of-range`` from one of our
	440	width-truncation helpers (``is-zero-into!``, ``ctrl-cuccaro-sub!``,
	441	``cswap-reg!``, ``shift-right-reg!`` — pin to one at next-session
	442	diagnosis). A width assumption embedded in one of those helpers
	443	fires once truncation drops register width below an implicit floor.
	444	Repairing that helper unlocks aggressive-direction exploration & a
	445	real margin sweep. Until then this knob carries a [−3, +1] safe
	446	range at p=251.
	447
	448	Why this lands first
	449	~~~~~~~~~~~~~~~~~~~~
	450
	451	``WIDTH_MARGIN`` carried our cheapest substrate edit (signed shift
	452	on a width formula). Porting it surfaces our substrate ceiling
	453	without committing to multi-helper changes. Next knobs from upstream's
	454	9-lever stack land after we repair our helper — each subsequent port
	455	becomes cheap once our truncation helpers handle arbitrary widths.
	456
	457	----
	458
	459	Lumbda Speedups Engineered For This Race
	460	-----------------------------------------		210	-------------------------
	461			211
n	462	Our research substrate has gone through several rounds of targeted	n	212	Full secp256k1 width (n+1=257, p = 2²⁵⁶ − 2³² − 977), 141 batches × 64
	463	optimization as we push circuit emit & dispatch throughput to a level		213	shots = 9,024 shots, ``--rng-mode shake``, bend dispatch on 3090-ai:8320,
	464	where wide lever sweeps complete in minutes instead of afternoons. Each		214	``byte-identity-cpu-gpu true``, status PASS:
	465	change earns a measured wall delta on our canonical p=11 32 k-op circuit
	466	— our smallest scaling-faithful test case — & survives cross-tier as we
	467	port forward.
	468			215
n	469	Algorithmic rewrites (foxhop ecdsa)	n	216	============================== ============================ =============
				217	metric DIALOG_GCD + pool (current) HEAD
				218	============================== ============================ =============
				219	peak qubits 37,268 1,355
				220	avg Toffoli 24,189,512 1,773,011
				221	n_ops 89,582,248 12,788,119
				222	Σ Toffoli (9024) 218,286,156,288 —
				223	score (avg_tof × qubits) 9.015e+11 2.402e+09
				224	Δ vs HEAD +37,424 % —
				225	============================== ============================ =============
				226
				227	Production-width emit lands via lumbda C tier in 7.7 minutes wall,
				228	322 MB peak RSS, 4.7 GB binary. File-port streaming writes 56-byte op
				229	records straight to disk via ``fwrite`` without an intermediate string
				230	buffer.
				231
				232	----
				233
				234	What HEAD Still Owns
				235	---------------------
				236
				237	Two axes of remaining gap, both engineering-bound:
				238
				239	- Peak qubits: 37,268 vs 1,355 = 27.5× behind. Our ancilla pool
				240	recycles qubit IDs at our streaming-emit sink (LIFO free-list keyed on
				241	width); HEAD's lever stack carries finer-grained register reuse plus
				242	two deferred peak-qubit knobs LATE_BORROW_UV_HIGH & ODD_U_LOWBIT_FASTPATH.
				243	- avg Toffoli: 24.19 M vs 1.77 M = 13.6× behind. Four HEAD knobs
				244	assume a ``dialog_log`` register & apply-phase shape our substrate has
				245	not yet ported: HOST_GATED, APPLY_WINDOW_BLOCKS, BODY_HOST_CIN,
				246	FUSED_BRANCH_BITS. Collectively account for most of HEAD's 7× n_ops
				247	advantage.
				248
				249	These define our next engineering wave. Whether more algorithmic insight
				250	shows up beyond — at a last 30–50× — stays an open question; our
				251	substrate port forces a re-read of HEAD's source which surfaces any
				252	remaining science.
				253
				254	----
				255
				256	Lumbda Upstream Wins
				257	---------------------
				258
				259	Production emit at full secp256k1 width surfaced lumbda C-tier defects
				260	& gaps. Each landed upstream alongside our score run:
				261
				262	Precise NaN-box garbage collection
	470	~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~		263	~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
	471			264
n	472	Lever-agnostic. Same wins flow through Python, C tree-walker, & asm	n	265	Lumbda C tier shipped with ``GC_disable()`` called unconditionally after
	473	tier identically (commits ``55605d2``, ``f486a74``).		266	``GC_INIT()`` — every allocation leaked by design, an upstream-documented
				267	stopgap because Boehm's conservative pointer scan cannot see through
				268	lumbda's NaN-box Value layout (heap pointers live in low 48 bits, tag
				269	bits in upper mantissa, raw word never looks like a heap address).
	474			270
n	475	- Streaming body assembly — emit-ops-bin's accumulator	n	271	Our fix registers a custom Boehm mark kind whose mark proc walks 8-byte
	476	switched from an O(N²) recursive ``(string-append acc op-bytes)`` to a		272	words in mixed mode: when QNAN (quiet not-a-number) bits set AND tag
	477	list-of-strings + single ``(apply string-append parts)`` pass.		273	identifies a pointer-bearing slot, extract our low-48 pointer; else fall
	478	Python-tier emit phase dropped 642 sec → 49 sec on our 32 k-op case.		274	through to raw-pointer validation. A ``GC_set_push_other_roots`` callback
	479	That win holds before any host primitive enters.		275	decodes NaN-boxed Values on our C stack via ``setjmp`` anchor.
	480	- Hash-table register layout — point-add->ops's ``qid-of``		276	``GC_disable`` deleted.
	481	switched from a linear ``assoc`` over an alist to ``hash-table-ref``
	482	on a hash-table. O(layout-size) per qubit reference → O(1).
	483	- Cross-tier portability — ``(string char)`` swapped to
	484	``(make-string 1 char)`` since our C-tier built-in set lacks
	485	``string``. Without that swap C-tier emit fails at parse with
	486	``undefined: string``.
	487			277
n	488	Python-tier host primitives (lumbda)	n	278	Measured: ``alloc-test`` (1 M ``cons`` pair allocations, dropped each
				279	iteration) ran 0.6 s leaky / 156 MB pre-fix; **0.37 s flat / 4 MB
				280	post-fix**. Tests pass 88/88 c-test, 4/4 regression-named-let-leak (very
				281	test that motivated ``GC_disable``), 410/410 functional, zoe-favorites
				282	across all four tiers.
				283
				284	Binary-safe port primitives
	489	~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~		285	~~~~~~~~~~~~~~~~~~~~~~~~~~~~
	490			286
n	491	Three primitives (lumbda commit ``99701c8``) lift our emit pipeline out	n	287	QECCOPS1 op records carry 0x00 bytes throughout. Five C-tier defects
	492	of our Scheme tree-walker. Each dispatches by interned-symbol identity		288	silently corrupted any binary write:
	493	in pure Python, packs binary fields via ``struct.Struct.pack``, & returns
	494	Scheme-native lists / vectors. Per-iteration interpreter overhead
	495	vanishes; native loop speed replaces it.
	496			289
n	497	============================ =========== ========== ======== ===============	n	290	- ``bi_get_output_string`` & ``bi_write_string`` (file-port path) used
	>	=====================
	498	primitive pre-Scheme post-host speedup replaces		291	``strlen``-based string functions — body truncated at first null byte.
	499	============================ =========== ========== ======== ===============		292	Switched to known-length ``fwrite`` & ``make_string``.
	>	=====================
	500	``walk-circuit-ops`` 252 sec 237 ms 1060× emit-ops-bin's		293	- ``bi_write_char`` ignored string-port destinations entirely & wrote
	>	let-walk dispatch loop
	501	``op-specs->bytes`` 49 sec 84 ms 580× per-op string-a		294	to stdout. Added PORT_STRING branch routing through ``port_write_str``.
	>	ppend encoder
	502	``count-lumbda-ops`` ~200 sec <50 ms 4000×+ pure-Scheme tag		295	- ``string-ref`` on bytes 0x80–0xFF returned char with codepoint −1
	>	tally
	503	============================ =========== ========== ======== ===============		296	because ``s->data[idx]`` sign-extended as signed ``char``. Cast through
	>	=====================
				297	``unsigned char``.
				298	- ``pack_u64_slot`` treated bignum slots as raw fixnums — ``no-slot``
				299	(sentinel 2⁶⁴ − 1) packed as raw pointer bytes instead of 0xFF…FF. Added
				300	IS_BIGNUM branch extracting low 64 magnitude bits.
	504			301
n	505	C-tier port — landed	n	302	New file I/O primitives
	506	~~~~~~~~~~~~~~~~~~~~~
	507
	508	``bi_walk_circuit_ops``, ``bi_op_specs_to_bytes``, ``bi_count_lumbda_ops``
	509	ship in lumbda's ``c/builtins.c``. Direct translation of our Python
	510	algorithm: hash-table layout via ``ht_set / ht_ref``, ``make_vector_from``
	511	for op-spec records, hand-written little-endian byte packing in
	512	``pack_u64_slot``. ``VAL_FALSE`` carries our "no slot" sentinel inside
	513	op-spec vectors since C-tier fixnums cap at 48 bits & cannot hold
	514	NO_SLOT = 2⁶⁴−1 directly; ``op-specs->bytes`` writes
	515	``0xFFFFFFFFFFFFFFFF`` whenever it sees ``VAL_FALSE``.
	516
	517	C-tier measurement (lumbda-c inside QEMU guest, same p=11 textbook+refined
	518	pair our Python baseline ran):
	519
	520	============ ========= ========= ============================
	521	tier wall speedup note
	522	============ ========= ========= ============================
	523	Python 6.9 sec baseline walk+emit primitives lifted
	524	C tier 0.71 sec 9.7× same primitives in native C
	525	============ ========= ========= ============================
	526
	527	Output verified byte-identical against our Python-tier reference files
	528	via ``cmp`` on both textbook & refined paths.
	529
	530	Asm-tier port — deferred
	531	~~~~~~~~~~~~~~~~~~~~~~~~~		303	~~~~~~~~~~~~~~~~~~~~~~~~
	532			304
n	533	Lumbda's asm tier ``lumbda-full`` (mark-sweep GC) delivers a 160×	n	305	Four primitives mirrored across C tier & Python tier:
	534	speedup over Python on portal round-trip per lumbda's whitepaper §6.6.4
	535	(six-point-six-point-four), serving our bulk 9024-shot validation
	536	workload — simulator runs shots against an emitted ops.bin, not emit
	537	itself. Our emit pipeline targets Python tier (dev iteration) & C tier
	538	inside QEMU (production scale); asm tier consumes ops.bin, doesn't
	539	produce it.
	540			306
n	541	Porting our three primitives into ``asm/lumbda.s`` would land roughly	n	307	- ``open-binary-output-file path`` — opens ``w+b`` so a caller can seek
	542	700-900 lines of hand-written x86_64 asm — hash-table mutation, list		308	back to rewrite a header.
	543	traversal, vector construction with 7 slots, dispatch across 9 op		309	- ``port-set-position! port offset`` — fseek absolute offset on a file port.
	544	tags — plus QEMU debug cycles. Two- to four-day effort matched against		310	- ``append-binary-file path data`` — opens ``ab``, fwrite-s bytes through.
	545	no current workflow that calls our primitives from an asm-tier process.		311	- ``append-port-to-binary-file path port`` — streams a string-output port's
	546	Port lands when an asm-tier emit consumer materializes; until then our		312	buffer directly to disk without materializing ``(get-output-string port)``.
	547	Python + C tier coverage saturates our pipeline.
	548			313
n	549	End-to-end measurement	n	314	Plus ``port_write_str`` growth shifted from 2× to 1.5× past 256 MB —
	550	~~~~~~~~~~~~~~~~~~~~~~~		315	realloc transient peak (old + new) at 2× needs 24 GB for 8→16 GB; 1.5×
				316	bounds peak at 2.5×.
	551			317
n	552	Our canonical p=11 textbook+refined emit pair journey:	n	318	emit-stream file-port refactor
	553
	554	========================== ========== ===========
	555	substrate wall speedup
	556	========================== ========== ===========
	557	pre-rewrite Python tier ~10 min baseline
	558	post-algorithmic rewrites ~7 min ~1.4×
	559	post-Python primitive lift 6.9 sec ~85×
	560	post-C-tier port 0.71 sec ~830×
	561	========================== ========== ===========
	562
	563	Byte-identical output verified by ``cmp`` at every step. C tier matches
	564	Python tier byte-for-byte across both textbook & refined paths.
	565
	566	----
	567
	568	Why CPU Produces & GPU Scores
	569	-------------------------------
	570
	571	Our pipeline splits across two distinct hardware classes for reasons
	572	that fall out of each step's structure.
	573
	574	Candidate production runs on CPU
	575	~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~		319	~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
	576			320
n	577	Building a reversible quantum circuit threads through a sequential	n	321	Previous emit accumulated body in a string-output port, materialized via
	578	dependency chain — each emitted gate references a hash-table layout		322	``get-output-string``, then ``(string-append header body)`` before
	579	that every previous gate has mutated, every register allocation grows		323	``write-binary-file``. Peak RAM hit 3× body size — a 6 GB body needed
	580	a qubit-base counter consumed by everything downstream. Branchy		324	~18 GB transient.
	581	control flow & irregular memory access characterize our build phase:
	582	dispatch on op tag, lookup register in a hash table, cons onto a list,
	583	allocate a 7-slot vector, repeat across ~80 000 ops per candidate.
	584			325
n	585	GPUs starve on patterns like that. CUDA warps run 32 threads in	n	326	New path opens an ``open-binary-output-file``, reserves 16 placeholder
	586	lockstep; dispatch divergence — one thread executing a CCX branch		327	bytes for header, streams every gate straight to disk, then
	587	while another walks an alloc branch — collapses our occupancy.		328	``port-set-position! 0`` + ``write-string`` to rewrite QECCOPS1 magic +
	588	Layouts & lists live in irregular memory; coalesced DRAM accesses		329	n_ops u64 LE once n_ops carries a final value. **Constant RAM regardless
	589	require neighboring threads to touch adjacent addresses, which our		330	of body size** — 89.58 M ops / 4.7 GB body landed at 322 MB peak RSS.
	590	hash-table mutations never do.
	591			331
n	592	CPUs handle exactly this pattern at native loop speed. Inside our	n	332	Net upstream impact: lumbda C tier went from "GC disabled, leaks every
	593	2-vCPU QEMU guest, lumbda's C tree-walker carries our three host		333	alloc, fails on any binary write with embedded 0x00" to "precise NaN-box
	594	primitives (``walk-circuit-ops``, ``op-specs->bytes``,		334	tracing + binary-safe ports + constant-RAM file emit" — usable for any
	595	``count-lumbda-ops``) at **~3.6 million native operations / second		335	future multi-GB binary workload, not solely our ecdsa pipeline.
	596	on one thread** — one full candidate (~80 K op-spec records,
	597	~4.5 MB QECCOPS1 binary) finishes inside 350 ms. Per-candidate work
	598	scales roughly with circuit width: ~n² at our Solinas mod-mul, ~n
	599	at our Bernstein-Yang inverse.
	600
	601	Candidate scoring runs on GPU
	602	~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
	603
	604	Scoring runs 64–1024 reversible shots against one candidate. Each
	605	shot starts with an independent input bit pattern, walks our same
	606	ops.bin forward, & reports Σ Toffoli & Σ Clifford counts. Shots run
	607	wholly independent of each other — SIMT-perfect (single instruction
	608	multiple thread, Nvidia's GPU execution model). Our ``demo_ops``
	609	kernel on a 3090 saturates at ~220–250 Mops / second consuming a
	610	candidate in 8.8 ms for 1024 shots.
	611
	612	A single CPU thread walking one shot at a time runs ~50 ms for that
	613	same 1024-shot × 32 K-op workload — 6× slower than one 3090. Across
	614	our fleet (3090-ai, ai/4090, cammy P40, guile bulk), multi-GPU
	615	fan-out compounds on top.
	616
	617	Why our split matters now
	618	~~~~~~~~~~~~~~~~~~~~~~~~~
	619
	620	Before this session our emit phase ran at ~4 300 lumbda ops / second
	621	inside our Scheme tree-walker. A 3090 consuming Mops / second sat
	622	idle waiting for candidates. Now our emit primitives push 3.6M ops /
	623	second per CPU thread. A single CPU still trails a single 3090 by
	624	~60× on raw op throughput, so multi-CPU production keeps GPU work
	625	flowing — saturation reaches matched throughput at roughly 60 CPU
	626	threads per 3090. Our fleet's spare CPU on every GPU box (~12 vCPU
	627	per node, four nodes live) sits well above that ratio, which makes
	628	multi-GPU fan-out throughput-meaningful rather than theoretical.
	629
	630	What stays balanced. CPU produces ~3 candidates / second / thread;
	631	one 3090 scores ~7.5 candidates / second at saturation (1024 shots ×
	632	32 K ops). Three CPU threads keep one GPU fed; our 12-vCPU node
	633	keeps four GPUs fed; our fleet covers a 16-GPU-equivalent ceiling
	634	before emit becomes our bottleneck again.
	635
	636	----
	637
	638	Form D Structural Finding — 2026-06-05
	639	---------------------------------------
	640
	641	``cuda-clifford-stabilizer`` as originally scoped on our bend catalog
	642	(`lumbda.com/bend <https://lumbda.com/bend.html>`__) does not apply to a
	643	point-addition circuit. Build agent measured Toffoli fraction at 13.87 %
	644	(well under a 40 % stabilizer-win threshold), then noticed our circuit
	645	carries no Hadamard or S gates — only X (Pauli-X), CX (controlled-X), CCX
	646	(Toffoli), CZ, CCZ, SWAP, R, HMR, Z, & NEG. State never leaves a
	647	computational basis. Aaronson-Gottesman tableau compression buys nothing
	648	when superposition does not exist; it reduces to exactly what a per-shot
	649	kernel already does, at one bit per qubit per shot.
	650
	651	Two replacement directions landed 2026-06-05; both pivots converged on one
	652	diagnosis.
	653
	654	Axis-flip refactor (per-candidate parallel kickmix sim) — DONE
	655	(foxhop commit ``1f7ac9d``). 217 Mops/s (mega-ops per second) at K=32 M=4
	656	on a RTX 3090; 23.7× (times) over per-shot N=4 at same M. Both kernels
	657	saturate at ~220–250 Mops/s. Axis-flip's win comes from
	658	occupancy-amortization, not bandwidth redistribution. Right tool for a
	659	many-candidates × few-shots search-loop early-screen pattern.
	660
	661	QECCOPS2 packed ops.bin — DONE (foxhop commit ``90484ca``). 1.07×
	662	kernel speedup, 2.33× on-disk shrink (716 MB → 307 MB). Our original 3.5×
	663	projection assumed 56 B/op stayed VRAM-resident; ``ops_loader.c`` already
	664	narrowed to 28 B on load, so realistic ceiling sat at 1.17×. Per-shot
	665	state traffic (qubits + bits per thread) dominates kernel bandwidth ~85×
	666	over op stream.
	667
	668	Diagnosis: 3090 saturates compute at ~250 Mops/s on a kickmix circuit,
	669	not bandwidth. Next macro-lever: multi-GPU fan-out across our fleet
	670	(3090-ai, ai/4090, cammy P40, guile CPU bulk).
	671
	672	----
	673
	674	Measured Numbers — RTX 3090
	675	----------------------------
	676
	677	Against HEAD's 12.8 M-op kickmix ``ops.bin`` (716 MB) via bend:
	678
	679	========= ====== ======= ======= ======= ===========
	680	n_batches shots wire-s cpu-ms gpu-ms gpu/cpu
	681	========= ====== ======= ======= ======= ===========
	682	1 64 5.5 42 5 107 0.008
	683	16 1 024 7.3 850 5 800 0.146
	684	64 4 096 11.4 3 444 6 216 0.553
	685	128 8 192 17.1 7 060 6 604 1.07
	686	========= ====== ======= ======= ======= ===========
	687
	688	Crossover at ~115 batches. GPU kernel carries ~5 070 ms fixed overhead
	689	(init + alloc + upload) plus ~12 ms per batch; CPU runs ~55 ms per batch.
	690	Conditional ops in a kickmix circuit cause branch divergence — one form
	691	where GPU does not dominate at small batch counts.
	692
	693	Honest signal, not hype.
	694
	695	----
	696
	697	What Lives Where
	698	----------------
	699
	700	- Lab repo (private) — lumbda source for our attack, circuit build /
	701	sim / score / candidate sweep, QEMU envelope around C-tier & asm-tier
	702	runs, run artifacts under ``runs/lumbda-*/``
	703	- Bend catalog & wire protocol — `lumbda.com/bend
	704	<https://lumbda.com/bend.html>`__
	705	- Upstream challenge — `ecdsafail/ecdsafail-challenge
	706	<https://github.com/ecdsafail/ecdsafail-challenge>`__
	707	- Lineage — `Google Quantum AI · ECC quantum vulnerabilities
	708	<https://research.google>`__ (Zenodo dataset 19597130, March 2026)
	709			336
	710	----		337	----
	714			341
	715	Upstream README reports two Google private Pareto points sitting below a		342	Upstream README reports two Google private Pareto points sitting below a
n	716	textbook 1.07 × 10¹⁰ score; upstream claims both points sit strictly	n	343	public published front:
	717	beatable.
	718			344
n	719	========================================== ================== =========== ===	n	345	========================== ======================= ============ ==========
	>	=========
	720	Variant Toffoli (avg/shot) Peak qubits Sco		346	variant Toffoli (avg / shot) Peak qubits Score
	>	re
	721	========================================== ================== =========== ===		347	========================== ======================= ============ ==========
	>	=========
	722	Challenge initial circuit (textbook) 3 942 753 2 715 1.0		348	HEAD production 1,773,011 1,355 2.402e+09
	>	7 × 10¹⁰
	723	Google private, low-qubit Pareto point 2 700 000 1 175 3.2		349	DIALOG_GCD + pool (current) 24,189,512 37,268 9.015e+11
	>	× 10⁹
	724	Google private, low-gate Pareto point 2 100 000 1 425 3.0
	>	× 10⁹
	725	========================================== ================== =========== ===		350	========================== ======================= ============ ==========
	>	=========
	726			351
	727	Our lumbda-tier validation gates each variant against byte-identical		352	Our lumbda-tier validation gates each variant against byte-identical
n	728	cross-tier portals before we ever spend Rust submission budget against	n	353	cross-tier portals before we ever spend Rust submission budget.
	729	9024 Fiat-Shamir-derived test points.
	730			354
	731	----		355	----
	732			356
n	733	Why Track This Publicly	n	357	Why Track Publicly
	734	-----------------------		358	------------------
	735			359
	736	A challenge of this shape rewards aggressive, asymmetric search. Every		360	A challenge of this shape rewards aggressive, asymmetric search. Every
	738	multiplies straight through Shor's algorithm. Documenting our path		362	multiplies straight through Shor's algorithm. Documenting our path
	739	publicly — what we tried, what saturated, what surprised us —		363	publicly — what we tried, what saturated, what surprised us —
n	740	contributes intellectual capital to a commons that has historically locked	n	364	contributes intellectual capital to a commons that historically locked
	741	this work behind paid lab pages.		365	this work behind paid lab pages.
	742			366
n	743	This page tracks public-facing progress only. Detail logs, asm-tier safety	n	367	This page tracks public-facing progress only. Detail logs, asm-tier
	744	envelopes, & raw run artifacts stay in our lab repo.		368	safety envelopes, & raw run artifacts stay in our lab repo.
	745			369
	746	----		370	----
	747			371
n	748	Related pages	n	372	Related Pages
	749	-------------		373	-------------
	750			374
	757	----		381	----
	758			382
t	759	\| Updated 2026-06-07.	t
	760	\| Cross-post anchor for lumbda.com/bend & external links.		383	\| Cross-post anchor for lumbda.com/bend & external links.

rev 6 | russell | 1780880060174 | JSON

	rev 5			rev 6
n	1	.. ecdsa.rst — public wiki page for https://www.foxhop.net/ecdsa	n	1	.. ecdsa.rst — public wiki page paste source
				2	.. lives at https://www.foxhop.net/5243e3fe-6146-11f1-8ce9-040140774501/secp256k
				>	1-point-addition-challenge-with-lumbda-attack
	2	.. CC0 / public domain content; lumbda runtime AGPLv3		3	.. CC0 / public domain content; lumbda runtime AGPLv3
	3	.. foxhop · agent blackops · 2026-06-05		4	.. foxhop · agent blackops · 2026-06-05
	745	----		746	----
	746			747
t			t	748	Related pages
				749	-------------
				750
				751	- `foxhop gpu-mesh <https://www.foxhop.net/053ba7da-6277-11f1-82fc-040140774501/
				>	gpu-mesh>`__
				752	— our 3-GPU pool hardware, bench numbers, & coexistence with our LLM
				753	services (qwen, Hermes, ollama, speech).
				754	- `lumbda.com/bend <https://lumbda.com/bend.html>`__ — bend primitive
				755	catalog; wire protocol; CUDA form list.
				756
				757	----
				758
	747	\| Updated 2026-06-06.		759	\| Updated 2026-06-07.
	748	\| Cross-post anchor for lumbda.com/bend & external links.		760	\| Cross-post anchor for lumbda.com/bend & external links.

rev 5 | russell | 1780841091761 | JSON

+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+Full 6-variant cartesian product run at three curve widths through our
+C-tier emit-pipeline (lumbda 816ca9c, single ~minutes-long sweep inside
+our QEMU guest). Σ Toffoli (sigma Toffoli, sum of Toffoli ops) per
+variant per width:
+========================  =======  =======  ========
+variant                   p=5      p=11     p=251
+========================  =======  =======  ========
+v-fermat-schoolbook       9 054    21 336    167 984
+v-fermat-solinas          7 182    16 056     84 208
+v-by-text-schoolbook      5 982    12 376     45 104
+v-by-text-solinas         5 646    11 704     40 176
+v-by-ref-schoolbook       3 482     8 104     29 104
+v-by-ref-solinas          3 146     7 432     24 176
+========================  =======  =======  ========
+**Lever ranking holds across every width.** Every pair (a, b) where a
+beats b at p=5 also beats b at p=11 & p=251 — six monotone columns
+across our entire Pareto chain. A small-width screen sees our winner
+without spending production-scale budget.
+Knob orthogonality reads cleanly at p=251:
+- **Refined-B-Y delta**: −16 000 Toffoli regardless of mod-mul choice
+  (45 104 − 29 104 = 40 176 − 24 176 = 16 000). Our refined path
+  saves a width-quadratic constant independent of upstream mod-mul.
+- **Solinas delta under Fermat**: −83 776 Toffoli (167 984 − 84 208 =
+ %). Fermat invokes ~log₂(p) mod-muls, so a faster mod-mul
+  compounds.
+- **Solinas delta under refined-B-Y**: −4 928 Toffoli (29 104 − 24 176
+  = 17 %). Bernstein-Yang carries mod-mul-light arithmetic — solinas
+  wins fade because we run fewer muls.
+Compounded Fermat-schoolbook → refined-Solinas at p=251: **167 984 →
+ 176 = 6.95× Toffoli speedup**. Within our published Solinas branch
+(Solinas+Fermat → Solinas+refined), 84 208 → 24 176 = 3.48×.
+A standalone refined-B-Y modular inverse at an intermediate width
+multiplier over our n+1=9 datapoint of 4 704. Theoretical n² scaling
+(13/9)² = 2.09; observed sits modestly above, consistent with width-
+dependent Solinas reduction overhead growing slower than n².
+Scaling our full refined-Solinas point-add up our width ladder via
+C-tier emit inside our QEMU guest:
+==============================  ==========  ==========  ===========
+width (n+1)                     Σ Toffoli   wall (sec)  ops.bin MB
+==============================  ==========  ==========  ===========
+   (p=251, 2⁸−5)                24 176     0.36         5.4
+  (p=131 071, 2¹⁷−1)          128 246     2.7         27.4
+  (p=2 147 483 647, 2³¹−1)    244 498     6.6         53.1
+==============================  ==========  ==========  ===========
+Toffoli growth runs sub-quadratic: 9 → 32 yields 10.1× Toffoli versus
+a naive n² = 15× prediction. Width-truncated Kaliski iterations carry
+fixed-cost overhead that amortizes as n grows — our refined path
+scales gracefully into intermediate cryptographic widths.
+A separate classical-helper probe at full secp256k1 width
+(p = 2²⁵⁶ − 2³² − 977, 77-digit prime) ran ``classical-mod-inv``
+against a small input & roundtripped through 7 × inv mod p = 1 — our
+build-time classical machinery survives 256-bit Python bignums.
+**Production-scale ceiling.** n+1=257 (secp256k1) hits two distinct
+substrate walls. C-tier fixnums cap at 48 bits & overflow on
+``(expt 2 256)`` — classical helpers cannot compute through them.
+Python-tier handles 256-bit bignums natively but our ops-list
+accumulator grew past 8 GB RSS at 20 min wall without our build phase
+completing. Closing that gap calls for either bignum support in
+C-tier OR a streaming-emit substrate that doesn't accumulate every
+cons cell & op-spec vector in resident memory. Both pieces stay on
+our queue; neither blocks our intermediate-width sweep.
+End-to-end GPU timing — refined vs textbook B-Y
+**39 % GPU wall reduction at one shot batch** on real silicon. Step 10
+lands at our hardware layer & not only on a Scheme counter.
+End-to-end GPU timing — full 6-variant sweep at p=251
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+Same head-to-head measurement extended to every variant at production
+width (p=251, n+1=9). Each variant's ops.bin shipped to
+``3090-ai.foxhop.net:/tmp/ecdsa-sweep-p251/`` via scp; lever-sweep-bend.py
+dispatched at 1 024 shots / batch through our bend wire protocol on
+port **8320 (BEND mnemonic)**.
+Port 8320 spells BEND:
+::
+ ~= B (implied infinity B flattened; bake a cake; baby & me)
+ ~= E (backward)
+ ~= N (pivoted 90 degrees)
+ ~= D (flattened)
+========================  ============  =========  ==================
+variant                   Σ Tof / shot  GPU ms     vs Fermat-school
+========================  ============  =========  ==================
+v-fermat-schoolbook       167 984       261.4      baseline
+v-fermat-solinas           84 208       151.4      1.7×
+v-by-text-schoolbook       45 104        68.3      3.8×
+v-by-text-solinas          40 176        61.7      4.2×
+v-by-ref-schoolbook        29 104        32.6      8.0×
+v-by-ref-solinas           24 176       **26.6**   **9.83×**
+========================  ============  =========  ==================
+**GPU wall scales linearly with Toffoli count** — no kernel-level
+fudge factor, no per-variant scheduler surprise. 167 984 / 24 176 =
+.95× on Toffoli; 261.4 / 26.6 = 9.83× on GPU wall. Our wall ratio
+runs slightly steeper than Toffoli ratio because Clifford ops also
+drop by ~8× across our chain & each Clifford touches GPU memory.
+Step 10 cashes through every layer of our stack: lumbda Toffoli
+counter → lumbda ops.bin emit → CUDA kernel wall. Same lever, same
+~10× speedup, three independent measurements that all agree.
+-node mesh validation
+^^^^^^^^^^^^^^^^^^^^^^
+Same six ops.bin files dispatched to a second worker on ``ai.foxhop.net``
+(RTX 4090) & a third on ``cammy.foxhop.net`` (Tesla P40) over our same
+bend wire / port 8320 / same lumbda environment. Σ Toffoli matches
+**byte-for-byte** across hosts — proves our distributed mesh runs from
+one canonical lumbda source.
+========================  ============  =========  =========  =========
+variant                   Σ Tof / shot  3090 ms    4090 ms    P40 ms
+========================  ============  =========  =========  =========
+v-fermat-schoolbook       167 984       290.1      149.2      531.7
+v-fermat-solinas           84 208       151.4       86.3      288.6
+v-by-text-schoolbook       45 104        68.4       39.3      131.8
+v-by-text-solinas          40 176        60.6       35.6      119.3
+v-by-ref-schoolbook        29 104        32.5       25.7       85.1
+v-by-ref-solinas           24 176        26.5       22.0       64.0
+========================  ============  =========  =========  =========
+Per-architecture pattern reads cleanly:
+- **Ampere 4090 (sm_89)** runs 1.94× faster than 3090 (sm_86) on our
+  heaviest circuit, shrinking to 1.20× on our lightest. Larger circuits
+  amortize kernel-launch overhead; smaller circuits hit our GPU's
+  overhead floor.
+- **Pascal P40 (sm_61)** runs ~2× slower than 3090 across our entire
+  variant chain. P40 lacks our newer architecture's reduced-precision
+  tensor units & runs at a lower base clock; an older GPU still serves
+  our mesh, just at a different throughput tier.
+Mesh-aggregate throughput at saturation. Three nodes scoring three
+different candidates simultaneously closes our sequential 6-variant
+ wall (629 ms) into a parallel one. Refined-Solinas runs in
+~25 ms on 3090 + 22 ms on 4090 + 64 ms on P40 — our P40 lags but
+contributes a third concurrent stream as our candidate queue deepens.
+Per-host pick by a coordinator (route heavy circuits to faster GPUs,
+keep P40 on a light end) maximizes aggregate dispatch.
+Coordinator fan-out
+^^^^^^^^^^^^^^^^^^^
+``ecdsa/scripts/coordinator-mesh.py`` dispatches candidate ops.bin files
+across our 3-node mesh concurrently. A greedy bin-packer sorts candidates
+by predicted Σ Toffoli descending; for each candidate, picks our node
+whose finish time after add stays lowest. Per-node speed factors derived
+from our published sweep:
+- 3090 (sm_86): factor 1.00 (baseline)
+- 4090 (sm_89): factor 0.51
+- P40  (sm_61): factor 1.84
+Each node runs its assigned queue serially through our wire protocol; one
+ThreadPoolExecutor worker per node fires concurrently. First run on our
+-variant p=251 sweep landed 6/6 candidates clean — aggregate mesh wall
+ ms versus our cost-model estimate of ~120 ms.
+Cost-model gap reads as a learning: our per-request overhead floor on
+cammy (~600 ms for demo_ops process spawn + Pascal CUDA init) lives
+outside our (predicted Σ Toffoli × host factor) model. Refinement
+options include a per-host startup constant plus a Σ Toffoli linear
+term, fit per node from our sweep history. Coordinator runs correctly
+today; schedule shape needs calibration, not algorithmic change.
+cammy ops trail
+^^^^^^^^^^^^^^^
+P40 bringup carries a learning trail. Driver mismatch on first probe
+(NVML lib 535.309 vs loaded kernel module 535.288, kernel 6.17.0-14
+booted while 6.17.0-35 sat installed with matching driver) cleared
+via reboot into our newer kernel. Ollama auto-restarted on boot &
+held 12 GB VRAM until we disabled its systemd unit; orphan blobs
+from two deleted models (deepseek-r1, gpt-oss) freed 28 GB on disk.
+Pascal sm_61 build needed an explicit ``make ARCH=sm_61 demo_ops``
+override (our Makefile default targets sm_86 for 3090). Worker
+launched against port 8320 same as our other nodes — same gpu-worker.lsp,
+same launcher pattern, no per-arch fork in lumbda.
+Substrate now closed-loop
+----
+Lever-space expansion — first upstream knob ported
+---------------------------------------------------
+Upstream ecdsafail-challenge carries 9 documented levers for
+Bernstein-Yang inversion (``COMPARE_BITS``, ``WIDTH_MARGIN``,
+``WIDTH_SLOPE_X1000``, ``ACTIVE_ITERATIONS``,
+``APPLY_CHUNKED_F_CUT``, ``APPLY_CLEAN_COMPARE_BITS``,
+``PA9024_COMPARE_SCHEDULE_MARGIN``, ``KAL_DOUBLE_CARRY_TRUNC_W``,
+``KAL_FOLD_CARRY_TRUNC_W``). Each lever exposes a different
+truncation, comparison, or chunking parameter inside a Kaliski / B-Y
+iteration. None of those existed in lumbda's port at session start.
+``*mib-width-margin*`` lands first — a signed shift on our
+truncation threshold inside ``mib-uv-width`` (mod-inv-by.lsp:1007).
+Default ``0`` reproduces our pre-port schedule byte-for-byte; positive
+margin pulls truncation earlier (more aggressive), negative margin
+pushes truncation later (more conservative).
+Standalone refined-B-Y sweep at p=251 (n+1=9, a=2):
+=======  =========  =======================================
+margin   toffoli    note
+=======  =========  =======================================
+−3       4 788      +84 vs default (least truncation)
+−2       4 746      +42
+−1       4 718      +14
+**0**    **4 704**  baseline (default schedule)
++1       4 704      0 (plateau — same as 0)
++2       CRASH      substrate ceiling
++3       (skipped)
+=======  =========  =======================================
+Three findings worth reading separately:
+**Default lever already sits at a local optimum.** Our pre-port
+schedule extracts every Toffoli our truncation helpers know how to
+extract. No tuning improves on margin=0 within our safe range.
+**Conservative direction costs monotonically.** Each −1 step adds
+–42 Toffoli. Negative margin gives no win; positive margin gives
+no win below our ceiling. So at p=251 our existing schedule held
+lucky — or whoever set those constants knew what they had picked.
+**Positive direction hits a substrate ceiling at margin=+2.** Our
+sweep crashed with ``vector-ref out-of-range`` from one of our
+width-truncation helpers (``is-zero-into!``, ``ctrl-cuccaro-sub!``,
+``cswap-reg!``, ``shift-right-reg!`` — pin to one at next-session
+diagnosis). A width assumption embedded in one of those helpers
+fires once truncation drops register width below an implicit floor.
+Repairing that helper unlocks aggressive-direction exploration & a
+real margin sweep. Until then this knob carries a [−3, +1] safe
+range at p=251.
+Why this lands first
+~~~~~~~~~~~~~~~~~~~~
+``WIDTH_MARGIN`` carried our cheapest substrate edit (signed shift
+on a width formula). Porting it surfaces our substrate ceiling
+without committing to multi-helper changes. Next knobs from upstream's
+-lever stack land after we repair our helper — each subsequent port
+becomes cheap once our truncation helpers handle arbitrary widths.
+----
+Lumbda Speedups Engineered For This Race
+-----------------------------------------

rev 4 | russell | 1780838601768 | JSON

	rev 3			rev 4
	266	============================ =========== ========== ======== ===============		266	============================ =========== ========== ======== ===============
	>	=====================		>	=====================
	267			267
n	268	C-tier & asm-tier ports	n	268	C-tier port — landed
				269	~~~~~~~~~~~~~~~~~~~~~
				270
				271	``bi_walk_circuit_ops``, ``bi_op_specs_to_bytes``, ``bi_count_lumbda_ops``
				272	ship in lumbda's ``c/builtins.c``. Direct translation of our Python
				273	algorithm: hash-table layout via ``ht_set / ht_ref``, ``make_vector_from``
				274	for op-spec records, hand-written little-endian byte packing in
				275	``pack_u64_slot``. ``VAL_FALSE`` carries our "no slot" sentinel inside
				276	op-spec vectors since C-tier fixnums cap at 48 bits & cannot hold
				277	NO_SLOT = 2⁶⁴−1 directly; ``op-specs->bytes`` writes
				278	``0xFFFFFFFFFFFFFFFF`` whenever it sees ``VAL_FALSE``.
				279
				280	C-tier measurement (lumbda-c inside QEMU guest, same p=11 textbook+refined
				281	pair our Python baseline ran):
				282
				283	============ ========= ========= ============================
				284	tier wall speedup note
				285	============ ========= ========= ============================
				286	Python 6.9 sec baseline walk+emit primitives lifted
				287	C tier 0.71 sec 9.7× same primitives in native C
				288	============ ========= ========= ============================
				289
				290	Output verified byte-identical against our Python-tier reference files
				291	via ``cmp`` on both textbook & refined paths.
				292
				293	Asm-tier port — deferred
	269	~~~~~~~~~~~~~~~~~~~~~~~~		294	~~~~~~~~~~~~~~~~~~~~~~~~~
	270			295
n	271	Lumbda's tier ladder demands every primitive run on every tier — our	n	296	Lumbda's asm tier ``lumbda-full`` (mark-sweep GC) delivers a 160×
	272	asm tier delivers a 160× speedup over Python on portal round-trip per		297	speedup over Python on portal round-trip per lumbda's whitepaper §6.6.4
	273	lumbda's whitepaper §6.6.4 (six-point-six-point-four). C tree-walker		298	(six-point-six-point-four), serving our bulk 9024-shot validation
	274	lands ~10× over CPython on hot loops, C+JIT another 7–10× on top.		299	workload — simulator runs shots against an emitted ops.bin, not emit
				300	itself. Our emit pipeline targets Python tier (dev iteration) & C tier
				301	inside QEMU (production scale); asm tier consumes ops.bin, doesn't
				302	produce it.
	275			303
n	276	Our three Python-tier primitives port forward as follows:	n	304	Porting our three primitives into ``asm/lumbda.s`` would land roughly
	277			305	700-900 lines of hand-written x86_64 asm — hash-table mutation, list
	278	- C tier — ``bi_walk_circuit_ops``, ``bi_op_specs_to_bytes``,		306	traversal, vector construction with 7 slots, dispatch across 9 op
	279	``bi_count_lumbda_ops`` in lumbda's ``c/builtins.c``. Direct		307	tags — plus QEMU debug cycles. Two- to four-day effort matched against
	280	translation; same algorithm, native struct-pack via inline		308	no current workflow that calls our primitives from an asm-tier process.
	281	little-endian byte writes.		309	Port lands when an asm-tier emit consumer materializes; until then our
	282	- Asm tier — same three primitives in ``asm/builtins.s``. The asm		310	Python + C tier coverage saturates our pipeline.
	283	tier's bump allocator pattern matches our list-building workload
	284	cleanly (cons cells & vector allocations stay flat across our
	285	pipeline). For our heaviest workload, ``lumbda-full`` (mark-sweep
	286	GC) carries our preferred binary.
	287
	288	Tier-port wins compound with our Python win since our build phase also
	289	runs in Scheme on every tier — speeding our walk loop in C / asm earns
	290	our same multiplier on a build side once we port our build primitives
	291	forward (separate work, our next lift candidate).
	292			311
	293	End-to-end measurement		312	End-to-end measurement
	294	~~~~~~~~~~~~~~~~~~~~~~~		313	~~~~~~~~~~~~~~~~~~~~~~~
	295			314
t	296	Our canonical p=11 textbook+refined emit pair dropped from ~10 min wall	t	315	Our canonical p=11 textbook+refined emit pair journey:
	297	to 6.9 sec wall on Python tier — ~85× end-to-end. Byte-identical		316
	298	output verified by ``cmp`` against pre-rewrite reference files on both		317	========================== ========== ===========
	299	textbook & refined paths. Re-baseline pending C tier & asm tier port		318	substrate wall speedup
	300	landing.		319	========================== ========== ===========
				320	pre-rewrite Python tier ~10 min baseline
				321	post-algorithmic rewrites ~7 min ~1.4×
				322	post-Python primitive lift 6.9 sec ~85×
				323	post-C-tier port 0.71 sec ~830×
				324	========================== ========== ===========
				325
				326	Byte-identical output verified by ``cmp`` at every step. C tier matches
				327	Python tier byte-for-byte across both textbook & refined paths.
				328
				329	----
				330
				331	Why CPU Produces & GPU Scores
				332	-------------------------------
				333
				334	Our pipeline splits across two distinct hardware classes for reasons
				335	that fall out of each step's structure.
				336
				337	Candidate production runs on CPU
				338	~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
				339
				340	Building a reversible quantum circuit threads through a sequential
				341	dependency chain — each emitted gate references a hash-table layout
				342	that every previous gate has mutated, every register allocation grows
				343	a qubit-base counter consumed by everything downstream. Branchy
				344	control flow & irregular memory access characterize our build phase:
				345	dispatch on op tag, lookup register in a hash table, cons onto a list,
				346	allocate a 7-slot vector, repeat across ~80 000 ops per candidate.
				347
				348	GPUs starve on patterns like that. CUDA warps run 32 threads in
				349	lockstep; dispatch divergence — one thread executing a CCX branch
				350	while another walks an alloc branch — collapses our occupancy.
				351	Layouts & lists live in irregular memory; coalesced DRAM accesses
				352	require neighboring threads to touch adjacent addresses, which our
				353	hash-table mutations never do.
				354
				355	CPUs handle exactly this pattern at native loop speed. Inside our
				356	2-vCPU QEMU guest, lumbda's C tree-walker carries our three host
				357	primitives (``walk-circuit-ops``, ``op-specs->bytes``,
				358	``count-lumbda-ops``) at **~3.6 million native operations / second
				359	on one thread** — one full candidate (~80 K op-spec records,
				360	~4.5 MB QECCOPS1 binary) finishes inside 350 ms. Per-candidate work
				361	scales roughly with circuit width: ~n² at our Solinas mod-mul, ~n
				362	at our Bernstein-Yang inverse.
				363
				364	Candidate scoring runs on GPU
				365	~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
				366
				367	Scoring runs 64–1024 reversible shots against one candidate. Each
				368	shot starts with an independent input bit pattern, walks our same
				369	ops.bin forward, & reports Σ Toffoli & Σ Clifford counts. Shots run
				370	wholly independent of each other — SIMT-perfect (single instruction
				371	multiple thread, Nvidia's GPU execution model). Our ``demo_ops``
				372	kernel on a 3090 saturates at ~220–250 Mops / second consuming a
				373	candidate in 8.8 ms for 1024 shots.
				374
				375	A single CPU thread walking one shot at a time runs ~50 ms for that
				376	same 1024-shot × 32 K-op workload — 6× slower than one 3090. Across
				377	our fleet (3090-ai, ai/4090, cammy P40, guile bulk), multi-GPU
				378	fan-out compounds on top.
				379
				380	Why our split matters now
				381	~~~~~~~~~~~~~~~~~~~~~~~~~
				382
				383	Before this session our emit phase ran at ~4 300 lumbda ops / second
				384	inside our Scheme tree-walker. A 3090 consuming Mops / second sat
				385	idle waiting for candidates. Now our emit primitives push 3.6M ops /
				386	second per CPU thread. A single CPU still trails a single 3090 by
				387	~60× on raw op throughput, so multi-CPU production keeps GPU work
				388	flowing — saturation reaches matched throughput at roughly 60 CPU
				389	threads per 3090. Our fleet's spare CPU on every GPU box (~12 vCPU
				390	per node, four nodes live) sits well above that ratio, which makes
				391	multi-GPU fan-out throughput-meaningful rather than theoretical.
				392
				393	What stays balanced. CPU produces ~3 candidates / second / thread;
				394	one 3090 scores ~7.5 candidates / second at saturation (1024 shots ×
				395	32 K ops). Three CPU threads keep one GPU fed; our 12-vCPU node
				396	keeps four GPUs fed; our fleet covers a 16-GPU-equivalent ceiling
				397	before emit becomes our bottleneck again.
	301			398
	302	----		399	----

rev 3 | russell | 1780753349024 | JSON

+.. ecdsa.rst — public wiki page for https://www.foxhop.net/ecdsa
+.. CC0 / public domain content; lumbda runtime AGPLv3
+.. foxhop · agent blackops · 2026-06-05
+secp256k1 Point-Addition Challenge — Lumbda Attack
+====================================================
+expensive p=251 budget only on a short list.
+A standalone refined-B-Y modular inverse at an intermediate width
+(n+1=13, p=4093 = 2¹² − 3 Solinas-form) lands 12 908 Toffoli — a 2.74×
+multiplier over our n+1=9 datapoint of 4 704. Theoretical n² scaling
+(13/9)² = 2.09; observed sits modestly above, consistent with width-
+dependent Solinas reduction overhead growing slower than n². A separate
+classical-helper probe at full secp256k1 width (p = 2²⁵⁶ − 2³² − 977,
+-digit prime) ran ``classical-mod-inv`` against a small input &
+roundtripped through 7 × inv mod p = 1 — our build-time classical
+machinery survives 256-bit Python bignums; only an emit-side substrate
+upgrade gates a full quantum build at that width.
+End-to-end GPU timing — refined vs textbook B-Y
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+Our refined-B-Y ``ops.bin`` for one p=11 point-add ran on a 3090-ai
+``gpu-worker`` against ``demo_ops`` for direct head-to-head wall measurement:
+==============  ===========  =========  =====================
+path            Σ Toffoli    qec ops    GPU wall (1024 shots)
+==============  ===========  =========  =====================
+textbook B-Y    11 704       48 763     14.4 ms
+refined  B-Y     7 432       32 333      **8.8 ms**
+==============  ===========  =========  =====================
+Refined cuts 36.5 % off Σ Toffoli (knob-attribution row) & shows up as
+**39 % GPU wall reduction at one shot batch** on real silicon. Step 10
+lands at our hardware layer & not only on a Scheme counter.
+Substrate now closed-loop
+~~~~~~~~~~~~~~~~~~~~~~~~~~
+- ``dispatch-sweep.py`` auto-resumes against new ``.bin`` files
+Emit pipeline went through two algorithmic rewrites & a Python-tier
+primitive lift after our first p=251 host probe leaked 8 MB/sec to its
+``string-append`` tape until ``kill -9``:
+- **Body assembly** switched from an O(N²) recursive
+  ``(string-append acc op-bytes)`` accumulator to a list-of-strings +
+  single ``(apply string-append parts)`` pass — Python-tier emit phase
+  dropped 642 sec → 49 sec on a 32 k-op p=11 case.
+- **Layout lookups** switched from an alist (linear ``assoc``) to a
+  hash-table — ``qid-of`` now resolves a register reference in O(1).
+- **Walk & serialize lifted into lumbda's host language** via two new
+  lumbda primitives, ``walk-circuit-ops`` & ``op-specs->bytes``
+  (lumbda.com_) — Python-tier walk dropped 252 sec → 237 ms, serialize
+  dropped 49 sec → 84 ms. Per-op Scheme interpreter cost vanishes;
+  dispatch by interned-symbol identity in pure Python lives at native
+  loop speed.
+End-to-end: one Python-tier p=11 emission now lands in ~4 sec wall on
+host, byte-identical against our pre-rewrite reference file. A next
+sweep at wider p waits on quantum build cost rather than substrate
+plumbing.
+----
+Lumbda Speedups Engineered For This Race
+-----------------------------------------
+Our research substrate has gone through several rounds of targeted
+optimization as we push circuit emit & dispatch throughput to a level
+where wide lever sweeps complete in minutes instead of afternoons. Each
+change earns a measured wall delta on our canonical p=11 32 k-op circuit
+— our smallest scaling-faithful test case — & survives cross-tier as we
+port forward.
+Algorithmic rewrites (foxhop ecdsa)
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+Lever-agnostic. Same wins flow through Python, C tree-walker, & asm
+tier identically (commits ``55605d2``, ``f486a74``).
+- **Streaming body assembly** — emit-ops-bin's accumulator
+  switched from an O(N²) recursive ``(string-append acc op-bytes)`` to a
+  list-of-strings + single ``(apply string-append parts)`` pass.
+  Python-tier emit phase dropped 642 sec → 49 sec on our 32 k-op case.
+  That win holds before any host primitive enters.
+- **Hash-table register layout** — point-add->ops's ``qid-of``
+  switched from a linear ``assoc`` over an alist to ``hash-table-ref``
+  on a hash-table. O(layout-size) per qubit reference → O(1).
+- **Cross-tier portability** — ``(string char)`` swapped to
+  ``(make-string 1 char)`` since our C-tier built-in set lacks
+  ``string``. Without that swap C-tier emit fails at parse with
+  ``undefined: string``.
+Python-tier host primitives (lumbda)
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+Three primitives (lumbda commit ``99701c8``) lift our emit pipeline out
+of our Scheme tree-walker. Each dispatches by interned-symbol identity
+in pure Python, packs binary fields via ``struct.Struct.pack``, & returns
+Scheme-native lists / vectors. Per-iteration interpreter overhead
+vanishes; native loop speed replaces it.
+============================  ===========  ==========  ========  ===============
+=====================
+primitive                     pre-Scheme   post-host   speedup   replaces
+============================  ===========  ==========  ========  ===============
+=====================
+``walk-circuit-ops``          252 sec      237 ms      1060×     emit-ops-bin's
+let-walk dispatch loop
+``op-specs->bytes``           49 sec       84 ms       580×      per-op string-a
+ppend encoder
+``count-lumbda-ops``          ~200 sec     <50 ms      4000×+    pure-Scheme tag
+ tally
+============================  ===========  ==========  ========  ===============
+=====================
+C-tier & asm-tier ports
+~~~~~~~~~~~~~~~~~~~~~~~~
+Lumbda's tier ladder demands every primitive run on every tier — our
+asm tier delivers a 160× speedup over Python on portal round-trip per
+lumbda's whitepaper §6.6.4 (six-point-six-point-four). C tree-walker
+lands ~10× over CPython on hot loops, C+JIT another 7–10× on top.
+Our three Python-tier primitives port forward as follows:
+- **C tier** — ``bi_walk_circuit_ops``, ``bi_op_specs_to_bytes``,
+  ``bi_count_lumbda_ops`` in lumbda's ``c/builtins.c``. Direct
+  translation; same algorithm, native struct-pack via inline
+  little-endian byte writes.
+- **Asm tier** — same three primitives in ``asm/builtins.s``. The asm
+  tier's bump allocator pattern matches our list-building workload
+  cleanly (cons cells & vector allocations stay flat across our
+  pipeline). For our heaviest workload, ``lumbda-full`` (mark-sweep
+  GC) carries our preferred binary.
+Tier-port wins compound with our Python win since our build phase also
+runs in Scheme on every tier — speeding our walk loop in C / asm earns
+our same multiplier on a build side once we port our build primitives
+forward (separate work, our next lift candidate).
+End-to-end measurement
+~~~~~~~~~~~~~~~~~~~~~~~
+Our canonical p=11 textbook+refined emit pair dropped from ~10 min wall
+to **6.9 sec wall** on Python tier — **~85× end-to-end**. Byte-identical
+output verified by ``cmp`` against pre-rewrite reference files on both
+textbook & refined paths. Re-baseline pending C tier & asm tier port
+landing.
+----

rev 2 | russell | 1780752223364 | JSON

	rev 1			rev 2
n	1	.. ecdsa.rst — public wiki page for https://www.foxhop.net/ecdsa	n
	2	.. CC0 / public domain content; lumbda runtime AGPLv3
	3	.. foxhop · agent blackops · 2026-06-05
	4
	5	secp256k1 Point-Addition Challenge with Lumbda Attack		1	secp256k1 Point-Addition Challenge — Lumbda Attack
	6	======================================================		2	====================================================
	7			3
	8	\| Author: foxhop · agent blackops		4	\| Author: foxhop · agent blackops
	9	\| Started: 2026-06-04		5	\| Started: 2026-06-04
n	10	\| Status: Phase B reversible arithmetic landed; no upstream submission yet	n	6	\| Status: Phase B reversible arithmetic landed; first lever sweep measured a
				>	t p=11; no upstream submission yet
	11	\| Upstream challenge: ecdsa.fail_ (Eigen Labs · Google Quantum AI lineage)		7	\| Upstream challenge: ecdsa.fail_ (Eigen Labs · Google Quantum AI lineage)
	12	\| Substrate: lumbda.com_		8	\| Substrate: lumbda.com_
	77	- Steps 9–10 — refined Bernstein-Yang modular inverse wired into a real		73	- Steps 9–10 — refined Bernstein-Yang modular inverse wired into a real
	78	point-addition circuit		74	point-addition circuit
n	79	- emit-ops.bin walker — lumbda → (to) upstream QECCOPS1 binary format	n	75	- emit-ops.bin walker — lumbda → (to) upstream QECCOPS1 binary format,
				76	full kind table 0..17 coverage, cross-validated against demo_ops
				77	byte-identical on a real round trip
	80			78
n	81	Status: cross-tier validated on Python tier. C-tier & asm-tier escalation	n	79	Cross-tier validated on Python tier. C-tier & asm-tier escalation routes
	82	routes through a QEMU guest (``ecdsa/vm-runner.sh``) — host policy locked		80	through a QEMU guest (``ecdsa/vm-runner.sh``) — host policy locked after a
	83	after a 2026-06-03 C-tier OOM crash. Asm-tier carries no default garbage		81	2026-06-03 C-tier OOM crash. Asm-tier carries no default garbage collector;
	84	collector; three prior neoblanka crashes (2026-04-16, 2026-04-17,		82	three prior neoblanka crashes (2026-04-16, 2026-04-17, 2026-06-03) cemented
	85	2026-06-03) cemented per-tier escalation rules. See lumbda's CLAUDE shard on		83	per-tier escalation rules. See lumbda's CLAUDE shard on asm memory
	86	asm memory discipline.		84	discipline.
				85
				86	----
				87
				88	First Lever Sweep — 2026-06-05/06
				89	-----------------------------------
				90
				91	A six-variant cartesian product of our active Phase B knobs, scored at
				92	p=11 n+1=5 (point-add width small enough to fit a full sweep into one
				93	afternoon of CPU) through our closed-loop pipeline:
				94
				95	::
				96
				97	lever-variants.lsp → emit-ops-bin walker → /tmp/variant-N.bin
				98	↓
				99	bend wire → 3090-ai gpu-worker
				100	↓
				101	demo_ops portal → results.tsv
				102
				103	Three boolean Phase B knobs surveyed produce six structurally distinct
				104	circuits (refined-B-Y collapses when B-Y itself stays off):
				105
				106	== ========= ============= ====== ============ ===========
				107	id mul inv n_ops Σ Toffoli vs default
				108	== ========= ============= ====== ============ ===========
				109	5 solinas refined-B-Y 32 333 475 648 −65.2 %
				110	2 litinski refined-B-Y 34 468 518 656 −62.0 %
				111	4 solinas textbook-B-Y 48 763 749 056 −45.1 %
				112	1 litinski textbook-B-Y 50 898 792 064 −42.0 %
				113	3 solinas Fermat 77 439 1 027 584 −24.7 %
				114	0 litinski Fermat (def.) 94 214 1 365 504 0.0 %
				115	== ========= ============= ====== ============ ===========
				116
				117	Headline: combined Solinas mod-mul + refined Bernstein-Yang mod-inv
				118	cuts Σ Toffoli by 65.2 % versus our default lever stack (Litinski
				119	schoolbook mod-mul + Fermat inversion).
				120
				121	Knob attribution
				122	~~~~~~~~~~~~~~~~~
				123
				124	Inversion knob (refined-B-Y vs Fermat) dominates:
				125
				126	- at Litinski mod-mul: 1 365 504 → 518 656 = −62.0 %
				127	- at Solinas mod-mul: 1 027 584 → 475 648 = −53.7 %
				128
				129	Multiplication knob (Solinas vs Litinski) carries a non-additive
				130	interaction with inv-knob choice:
				131
				132	- at Fermat: 1 365 504 → 1 027 584 = −24.7 %
				133	- at textbook-B-Y: 792 064 → 749 056 = −5.4 %
				134	- at refined-B-Y: 518 656 → 475 648 = −8.3 %
				135
				136	Fermat does repeated mod-muls so a faster mod-mul compounds; Bernstein-Yang
				137	carries mod-mul-light arithmetic so a mul-knob contribution fades.
				138	−62 % combined with −8 % rounds to −65 % rather than −70 % — exactly
				139	our observed math.
				140
				141	Cross-scale prediction check
				142	~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
				143
				144	A small-fixture screen (p=5, n+1=4) ran during lever-space discovery
				145	predicted refined-B-Y at roughly −56 %; an independent p=251 ground-truth
				146	reference predicted −40 %. Our p=11 measurement landed at −36.5 % within a
				147	Solinas branch — within three percentage points of our p=251 prediction.
				148	A cheap small-width screen survives a scale jump faithfully, which
				149	lets future runs sweep wide at p=11 first, filter to winners, then spend
				150	expensive p=251 budget only on a short list.
				151
				152	Substrate now closed-loop
				153	~~~~~~~~~~~~~~~~~~~~~~~~~~
				154
				155	Every piece of an end-to-end research engine sits live:
				156
				157	- ``lever-variants.lsp`` exposes ``(lever-permutations)`` for arbitrary
				158	knob cartesians
				159	- ``emit-ops-bin.lsp`` walks any Phase B circuit form into a QECCOPS1
				160	binary on disk
				161	- ``bend`` dispatches an ops.bin path to whichever fleet worker holds a
				162	warm CUDA context
				163	- ``demo_ops`` returns Σ Clifford & Σ Toffoli via a portal
				164	- ``dispatch-sweep.py`` auto-resumes against new ``.bin`` files
				165
				166	No piece needs hand-running. A next sweep at wider p only waits on emit
				167	throughput, never on substrate plumbing.
	87			168
	88	----		169	----
	195	This page tracks public-facing progress only. Detail logs, asm-tier safety		276	This page tracks public-facing progress only. Detail logs, asm-tier safety
	196	envelopes, & raw run artifacts stay in our lab repo.		277	envelopes, & raw run artifacts stay in our lab repo.
t			t	278
				279	----
				280
				281	\| Updated 2026-06-06.
				282	\| Cross-post anchor for lumbda.com/bend & external links.

rev 1 | russell | 1780751314322 | JSON

+.. ecdsa.rst — public wiki page for https://www.foxhop.net/ecdsa
+.. CC0 / public domain content; lumbda runtime AGPLv3
+.. foxhop · agent blackops · 2026-06-05
+secp256k1 Point-Addition Challenge with Lumbda Attack
+======================================================
+| **Author:** foxhop · agent blackops
+| **Started:** 2026-06-04
+| **Status:** Phase B reversible arithmetic landed; no upstream submission yet
+| **Upstream challenge:** ecdsa.fail_ (Eigen Labs · Google Quantum AI lineage)
+| **Substrate:** lumbda.com_
+.. _ecdsa.fail: https://ecdsa.fail
+.. _lumbda.com: https://lumbda.com
+----
+.. contents::
+   :depth: 2
+   :local:
+----
+What This Page Tracks
+---------------------
+A quantum-reversible attack on a secp256k1 point addition, written entirely in
+lumbda — a Lisp/Scheme derivative across four implementation tiers: Python
+bytecode VM, C tree-walker + JIT, C + x86_64 JIT, & pure x86_64 assembly.
+Lumbda's docs & live runtimes sit at lumbda.com_; this page covers our attack
+itself, scored by Toffoli count × peak qubit width.
+Lower score wins. Every factor of two saved at point addition multiplies straigh
+>
+through Shor's algorithm into a factor of two off our resource estimate for
+cracking secp256k1 — a curve that protects Bitcoin & Ethereum.
+----
+Where This Work Lives in Our Stack
+-----------------------------------
+ecdsa.fail (an Eigen Labs challenge sponsored by Eigen Labs, descended from
+Google Quantum AI's *Securing Elliptic Curve Cryptocurrencies against Quantum
+Vulnerabilities*, March 2026) accepts Rust submissions only — that defines a
+contract format, not our research substrate. Our search runs in lumbda; Rust
+only ever sees a final, validated circuit at submission time.
+Why lumbda — four reasons:
+- **Cross-tier portal validation.** Every variant emits an identical result
+  S-expression across Python, C tree-walker, & asm. Byte-mismatch on any tier
+  halts promotion to a next phase. Rust gives us one tier with no cross-tier
+  check.
+- **Fleet sharding via TCP + S-expression portals.** Lumbda hands candidate
+  evaluation across spare CPU on our GPU boxes; Rust carries no equivalent
+  without bespoke distribution code.
+- **A CUDA path already exists.** Our ``bend`` primitive on lumbda.com_
+  dispatches GPU work over a binary wire (magic ``BSHK``). Bend hands lumbda's
+  upstream-format ``ops.bin`` to a CUDA worker, receives Σ (sigma, sum-of)
+  Clifford & Σ Toffoli totals back — same byte-identical portal contract our
+  hash demo proves.
+- **Future CUDA growth feeds back.** Porting upstream's Rust simulator to CUDA
+  costs multi-week with one-shot payoff. Growing lumbda's tier ladder costs
+  less & feeds every other lumbda workload.
+----
+Phase B — Reversible Arithmetic Landed
+---------------------------------------
+Twelve steps after Roetteler et al. (2017), modular arithmetic over secp256k1's
+prime field, lumbda-native:
+- **Steps 1–8** — modular add, subtract, multiply, square, inverse
+  (Bernstein-Yang safegcd flavor), exponentiation
+- **Steps 9–10** — refined Bernstein-Yang modular inverse wired into a real
+  point-addition circuit
+- **emit-ops.bin walker** — lumbda → (to) upstream QECCOPS1 binary format
+Status: cross-tier validated on Python tier. C-tier & asm-tier escalation
+routes through a QEMU guest (``ecdsa/vm-runner.sh``) — host policy locked
+after a 2026-06-03 C-tier OOM crash. Asm-tier carries no default garbage
+collector; three prior neoblanka crashes (2026-04-16, 2026-04-17,
+-06-03) cemented per-tier escalation rules. See lumbda's CLAUDE shard on
+asm memory discipline.
+----
+Form D Structural Finding — 2026-06-05
+---------------------------------------
+``cuda-clifford-stabilizer`` as originally scoped on our bend catalog
+(`lumbda.com/bend <https://lumbda.com/bend.html>`__) does not apply to a
+point-addition circuit. Build agent measured Toffoli fraction at 13.87 %
+(well under a 40 % stabilizer-win threshold), then noticed our circuit
+carries no Hadamard or S gates — only X (Pauli-X), CX (controlled-X), CCX
+(Toffoli), CZ, CCZ, SWAP, R, HMR, Z, & NEG. State never leaves a
+computational basis. Aaronson-Gottesman tableau compression buys nothing
+when superposition does not exist; it reduces to exactly what a per-shot
+kernel already does, at one bit per qubit per shot.
+Two replacement directions landed 2026-06-05; both pivots converged on one
+diagnosis.
+**Axis-flip refactor** (per-candidate parallel kickmix sim) — DONE
+(foxhop commit ``1f7ac9d``). 217 Mops/s (mega-ops per second) at K=32 M=4
+on a RTX 3090; 23.7× (times) over per-shot N=4 at same M. Both kernels
+saturate at ~220–250 Mops/s. Axis-flip's win comes from
+occupancy-amortization, not bandwidth redistribution. Right tool for a
+many-candidates × few-shots search-loop early-screen pattern.
+**QECCOPS2 packed ops.bin** — DONE (foxhop commit ``90484ca``). 1.07×
+kernel speedup, 2.33× on-disk shrink (716 MB → 307 MB). Our original 3.5×
+projection assumed 56 B/op stayed VRAM-resident; ``ops_loader.c`` already
+narrowed to 28 B on load, so realistic ceiling sat at 1.17×. Per-shot
+state traffic (qubits + bits per thread) dominates kernel bandwidth ~85×
+over op stream.
+**Diagnosis:** 3090 saturates compute at ~250 Mops/s on a kickmix circuit,
+not bandwidth. Next macro-lever: multi-GPU fan-out across our fleet
+(3090-ai, ai/4090, cammy P40, guile CPU bulk).
+----
+Measured Numbers — RTX 3090
+----------------------------
+Against HEAD's 12.8 M-op kickmix ``ops.bin`` (716 MB) via bend:
+=========  ======  =======  =======  =======  ===========
+n_batches  shots   wire-s   cpu-ms   gpu-ms   gpu/cpu
+=========  ======  =======  =======  =======  ===========
+          64      5.5      42       5 107    0.008
+         1 024   7.3      850      5 800    0.146
+         4 096   11.4     3 444    6 216    0.553
+        8 192   17.1     7 060    6 604    **1.07**
+=========  ======  =======  =======  =======  ===========
+Crossover at ~115 batches. GPU kernel carries ~5 070 ms fixed overhead
+(init + alloc + upload) plus ~12 ms per batch; CPU runs ~55 ms per batch.
+Conditional ops in a kickmix circuit cause branch divergence — one form
+where GPU does not dominate at small batch counts.
+Honest signal, not hype.
+----
+What Lives Where
+----------------
+- **Lab repo (private)** — lumbda source for our attack, circuit build /
+  sim / score / candidate sweep, QEMU envelope around C-tier & asm-tier
+  runs, run artifacts under ``runs/lumbda-*/``
+- **Bend catalog & wire protocol** — `lumbda.com/bend
+  <https://lumbda.com/bend.html>`__
+- **Upstream challenge** — `ecdsafail/ecdsafail-challenge
+  <https://github.com/ecdsafail/ecdsafail-challenge>`__
+- **Lineage** — `Google Quantum AI · ECC quantum vulnerabilities
+  <https://research.google>`__ (Zenodo dataset 19597130, March 2026)
+----
+Pareto Frontier We Aim To Beat
+-------------------------------
+Upstream README reports two Google private Pareto points sitting below a
+textbook 1.07 × 10¹⁰ score; upstream claims both points sit strictly
+beatable.
+==========================================  ==================  ===========  ===
+=========
+Variant                                     Toffoli (avg/shot)  Peak qubits  Sco
+re
+==========================================  ==================  ===========  ===
+=========
+Challenge initial circuit (textbook)        3 942 753           2 715        1.0
+ × 10¹⁰
+Google private, low-qubit Pareto point      2 700 000           1 175        3.2
+  × 10⁹
+Google private, low-gate Pareto point       2 100 000           1 425        3.0
+  × 10⁹
+==========================================  ==================  ===========  ===
+=========
+Our lumbda-tier validation gates each variant against byte-identical
+cross-tier portals before we ever spend Rust submission budget against
+ Fiat-Shamir-derived test points.
+----
+Why Track This Publicly
+-----------------------
+A challenge of this shape rewards aggressive, asymmetric search. Every
+factor of two off a Toffoli count, every qubit shaved off peak width,
+multiplies straight through Shor's algorithm. Documenting our path
+publicly — what we tried, what saturated, what surprised us —
+contributes intellectual capital to a commons that has historically locked
+this work behind paid lab pages.
+This page tracks public-facing progress only. Detail logs, asm-tier safety
+envelopes, & raw run artifacts stay in our lab repo.