Calibrate the orbits stack: thread-gated prepared paths, planner re-fit, prover integration

[ebfull]

Re-calibration of the orbits stack against fresh interleaved grids on Skylake-X (16C/32T) and Apple M4 Max (12P+4E), and prover-side consumption of the prepared fixed-base tables. Every behavioral change is measured on both hosts. Two posture decisions frame the series: the orbits cargo feature is now opt-in (default-off) until the planner's remaining per-arch conflict zones settle, and every prepared route is thread-gated so arming is never a pessimization anywhere we measured — the shape we want it in before it ever becomes default-on.

Split note: the x86-64 assembly field backend originally in this series now lives in #222, so it can coordinate with the in-flight x86 squaring work in #218 without holding this PR up. Nothing here depends on it — where the planner docs cite calibration data gathered on the assembly grids, they now say so generically. The branch is also rebased onto current main (#220, #221).

What changed

Planner bandwidth floor (pasta)

Parallel backend estimates are floored at 8% of their total group-operation count: wide pools divide per-worker work but not memory traffic. The floor shapes the orbit backend's window width on any parallel pool and joins the backend-versus-backend comparison only past 16 workers (at 16 the mid-size Booth/orbit boundary measures in opposite directions on the two hosts, so the comparison deliberately stays unfloored there — evaluated at the floor-picked orbit width). Summed planner cell losses: 269 → 136 pp (grid with the #222 assembly field backend), 353 → 176 pp (portable). End to end this fixed both shipped verifier regressions: x86 k=16 (−8% → +8%, measured with the assembly backend enabled) and M4 k=15 (−4..−11% → parity, via the width-5/6 boundary landing at ~28,672 terms). Pinned in multiexp_plan_selection.

Thread-gated prepared routing (halo2)

MSM::eval uses an armed prepared zero-check only on pools of at most PREPARED_MSM_MAX_THREADS (8) effective threads. The prepared evaluation stops scaling past that width while the unprepared planner keeps scaling: armed verification measured +14–16% slower at 16T (M4) and +22–27% at 32T (Skylake-X) before the gate, and is parity there now, while keeping the 8–22% wins at 4–8T. Validated within-process on both hosts. The gate is one constant, deliberately shared with the prover routes below.

Prover integration (pasta/halo2/orchard)

PreparedZeroCheck::multiexp_with_terms_vartime returns the exact MSM the zero-check already evaluates; Params::prepare_commitments arms it for commit ([g…, w, u], shared with the verifier's table; scalars [poly…, r, 0]) and commit_lagrange (a second [g_lagrange…, w, u] table) behind the same 8-thread gate; orchard::ProvingKey::prepare_proving exposes arming. Measured 1.2–1.8x per commitment at 1–8 threads on both hosts across full-width and witness-like scalar mixes, and +3.5–11% end-to-end proving at 8T for k≤14. One noisy cell: k=15 armed at 8T read −5.6% (lean budget mode at 32,770 bases; single run near the ±3% noise floor) — worth a cross-check before anyone adds a size guard. (This commit originally also parallelized the advice/h(X) commitments; #212 landed that independently while this PR was open, and the rebase keeps #212's version.)

orbits now default-off (halo2)

Removed from halo2_proofs's default features (it was never in pasta's own defaults). Downstream builds on default features get the pre-series Signed-Booth planner and plain final identity test, byte-for-byte the old behavior. Params::prepare_zero_checks / prepare_commitments and orchard's prepare_batch_validation / prepare_proving stay present as no-ops returning false, so callers never need feature-gating. CI's Linux stage job enables orbits explicitly for runtime coverage; the 32-bit and platform-smoke jobs cover the (now default) off state.

Post-review cleanup (final three commits)

A dead test shim that warned on every non-test orbits build; the planner's generic-traffic formula folded into the Booth cost model instead of silently mirroring it; prepare_commitments made idempotent with no partial-arm states; the prepared-gate constant renamed to cover all three routes it now gates, with rustdoc naming the constant instead of hardcoding "eight" in four places; the gate tests pinned under capped pools at the gate width and one past it (CI runners are 2–4 cores and never exercised the armed fall-through before); changelog entries that narrated the branch's history merged into their unreleased base entries.

Design posture

1. Ready to be default-on later: with the thread gates, arming (and eventually default-enabling) never regresses any measured configuration — wide pools transparently keep the planned multiexp, narrow pools take the wins.
2. Easy to remove or replace: everything new sits behind orbits (pasta forwards it as orbits = ["glv"], halo2 forwards pasta's); the arming APIs are stable no-ops without it.

Deliberately deferred

Per-arch conflict zones left at today's boundaries: the 16-worker mid-size backend choice and witness-shaped selection at 8–16 workers (opposite signs on the two hosts), and the x86 k=16 one-shot residual (isolated grids show orbit winning that cell; in-verifier it doesn't — steady-state vs cold-context divergence). The commit gate reads pool size, not the effective per-commit share under concurrent commits; an effective-threads hint would let wide pools use prepared commits too.

Validation

Full suites green in every feature state on both hosts before the split (pasta 200/196/190/142, halo2 91 + plonk_api with and without orbits, orchard 163/204); after the split and rebase, re-run on the x86 host: pasta 196 (multicore,orbits) and 218 (--all-features, which no longer includes the assembly), halo2 full suite plus the commitment/msm lanes with batch,orbits, rustfmt clean. Planner: an offline replica reproduces the Rust planner 100/100 on grid cells pre- and post-fit; per-cell regression checks on both grids; M4 plan diff byte-identical at ≤16T except the two intended width changes; the costs-model refactor is pinned by the measured-cell plan tests. Gates and prover effects validated within-process or with alternated rounds; the armed fall-through is now pinned by capped pools rather than host width. The halo2/orchard/glv trees are byte-identical to the previously validated branch tip apart from the rebase and two doc rewordings in glv.rs.

🤖 Generated with Claude Code

[ebfull]

Per review: the x86-64 assembly field backend is now split out to #222 (so it can coordinate with #218), and the branch is rebased onto current main. That's what the force-push is — the halo2/orchard/glv content is byte-identical to the previously reviewed tip apart from the rebase and two doc lines in glv.rs that now refer to the calibration grids' assembly field backend generically instead of naming the x86_64-asm feature.