Overlap advice transforms with delta planning

[ValarDragon]

Stacked on #328.

What changed

#328 finds useful advice-reference deltas before starting advice transforms.
This PR splits that planning boundary for eligible prepared k = 11,
multi-circuit proofs built with multicore and without orbits:

1. Run the exact full-row density count synchronously.
2. If the count finds a candidate, start all advice transforms while the other
   join arm performs the serial prepared-work check, materializes accepted
   deltas, evaluates the commitments, reconstructs reused commitments, and
   normalizes the results.

This ordering is intentional. The exact count is memory-bandwidth-heavy and
regressed when run alongside the transforms, while the remaining commitment
arm is long enough to give the transforms a useful head start.

If the exact count rejects every circuit, the code retains #328's per-circuit
direct-commitment/transform schedule without rescanning. If a later
prepared-work check rejects every candidate, the transform arm is already
running and the commitment arm evaluates the direct commitments. Ineligible,
empty, singleton, unprepared, orbits, non-multicore, and pools below eight
workers retain the existing schedule.

Proof format, RNG consumption, transcript order, synthesis failure order, and
the advice polynomials used for openings are unchanged.

End-to-end Ironwood results

Negative is faster. These are real post-NU6.3 two-action proofs with two real
spends. All modes were selected inside one diagnostic binary per host:

• M: main-equivalent nested direct commitments;
• S: Reuse advice commitments for sparse witness deltas #328, including its serial count, work check, and delta materialization;
• O: this PR's v2 schedule.

Host	Comparison	Mean (candidate/control)	Four-block result	95% whole-block bootstrap	Block effects
Apple M4, 10 workers	S/M	67.980/68.227 ms	-0.364639%	[-0.753445%, +0.170348%]	-0.867169%, +0.430296%, -0.411488%, -0.605468%
Apple M4, 10 workers	O/S	67.738/68.020 ms	-0.414077%	[-0.541441%, -0.314080%]	-0.278994%, -0.603884%, -0.353874%, -0.419266%
Linux AMD, 8 workers	S/M	142.376/143.019 ms	-0.449344%	[-0.560749%, -0.337814%]	-0.367660%, -0.524864%, -0.596620%, -0.307959%
Linux AMD, 8 workers	O/S	141.456/142.651 ms	-0.836799%	[-1.322477%, -0.384907%]	-1.516059%, -0.225334%, -0.739444%, -0.862095%

Every O/S block favors v2 on both hosts. With only four block effects, the
conventional Student-t intervals are also useful context: Apple
[-0.634989%, -0.192674%]; Linux [-1.678228%, +0.011831%].

These four-block rows were frozen at main 42f5dd4e. #405 subsequently
changed runtime field doubling on Apple AArch64 and can change the contention
balance, so the exact current 4d14a1d1 stack was confirmed in a fresh
same-binary run. Linux was extended without rebuilding to four blocks after
its initial S/M pair was mixed; M4 retained two blocks:

Host	Comparison	Mean (candidate/control)	Result	95% whole-block bootstrap	Block effects
Apple M4, 10 workers	S/M	67.736104/67.987879 ms	-0.370645%	[-0.500048%, -0.241074%]	-0.500048%, -0.241074%
Apple M4, 10 workers	O/S	67.430197/67.668560 ms	-0.352367%	[-0.399280%, -0.305433%]	-0.305433%, -0.399280%
Linux AMD, 8 workers	S/M	141.006833/141.492766 ms	-0.344038%	[-0.733611%, -0.025098%]	+0.098234%, -0.394182%, -0.927426%, -0.149885%
Linux AMD, 8 workers	O/S	139.787874/140.860498 ms	-0.761552%	[-1.082534%, -0.449238%]	-0.663125%, -1.221944%, -0.318462%, -0.840539%

Exact-current topology is main 4d14a1d1, #328 0dd71aba, this PR
2a06abe3, and diagnostic 32ef6b23. Bundle/runner/analyzer SHA-256 values are
3e2e97484837b4213d0e2b185173fa9dfbf3db8145db84f23bc74b9d364d1f23,
49b36a359d8e126a3fc88c45f279652a2db3be3e8304028bbf80067e9eb57365,
and 8d12840ada529b1f7771bd6a4a9f44c8f3b6bc882eec69776ebe48f1bc5dc48d.
Exact-current result archives are
1018ec9dbdcab55bbfd2e87b7b731d1125b8908cbf0496e9e318b392a4a8b5aa
on M4,
ebd168c5208494d5eb00cb3e8d0529d45480e86f448816fda0fd7f9eeb527860
for the initial Linux run, and
06200616bfabe664f1d9e761132e9521e2ac0310f3497ffd03f8fb682d378326
for its no-rebuild extension. The extension runner and authoritative combined
analyzer are
e04f59fa12b16ac5eff72715192f81dc0d07f9984c4ef8e1a590c5e36fce72f7
and 4177be3ce918b15d1254962ee81cb9c7a910bf2d04a357704c49808a43874de9.
Proof, route, binary, source, worker-width, and contamination gates all passed.
The Linux extension retained and excluded landscape-sysinfo and fwupd
attempts. M4 retained and excluded two launchd-contaminated attempts.

Alternatives rejected

• The implementation originally posted on this PR (v1) started transforms
  before the exact full-row count. On the current Reuse advice commitments for sparse witness deltas #328 stack it regressed by
  +0.304846% on M4 (four-block bootstrap
  [+0.250911%, +0.358810%]) and +0.336362% on Linux
  ([+0.143183%, +0.543067%]). All M4 blocks, order strata, and time halves
  regressed. This is consistent with count/transform memory-bandwidth
  contention.
• Parallelizing the tiny per-column work check (P) regressed M4 by
  +0.510413% ([+0.053792%, +0.969117%]) and was indistinguishable from noise
  on Linux at -0.166102% ([-0.332713%, +0.000788%]). The complete serial gate
  takes about 8.9 us, so removing it entirely could save only about 0.013% of
  this proof. v2 keeps it serial.
• Waiting for both the count and work check before starting transforms (v3)
  regressed Reuse advice commitments for sparse witness deltas #328 by +0.773703% on M4
  ([+0.766110%, +0.781296%]) and +0.951544% on Linux
  ([+0.869076%, +1.034079%]) in two-block screens.

Forced fallback gate

The principal remaining scheduling risk was the path where the exact density
count accepts but the prepared-work check rejects. A diagnostic forced that
rejection at both the first and last advice columns and compared #328's nested
direct fallback (D) with v2's transform/direct-commitment overlap (X).

Host	Forced column	Comparison	Result	95% whole-block bootstrap	Block effects
Apple M4	0	X0/D0	-0.230156%	[-0.520710%, +0.061246%]	-0.520710%, +0.061246%
Apple M4	9	X9/D9	-0.487199%	[-0.591828%, -0.382459%]	-0.382459%, -0.591828%
Linux AMD	0	X0/D0	-0.712084%	[-1.089982%, -0.332741%]	-1.089982%, -0.332741%
Linux AMD	9	X9/D9	-0.455103%	[-0.585962%, -0.324071%]	-0.585962%, -0.324071%

Both order strata favored v2 in all four contrasts. M4 X0/D0 contains one
slightly positive block and is therefore labeled favorable/noisy; the other
three two-block ranges exclude zero. The forced screen finds no fallback
regression and clears this ship gate.

Benchmark method and integrity

• Criterion flat sampling: 10 samples, 2-second warmup, 15-second measurement.
• Alternating, balanced adjacent control/candidate pairs; per-invocation
  estimate sum(times) / sum(iters); paired log ratios aggregated by block;
  1,000,000-draw seeded whole-block bootstrap.
• Frozen topology: main 42f5dd4e, Reuse advice commitments for sparse witness deltas #328 6f400097, v2 343ede91, diagnostic
  16d5e4a3. One freshly built binary per host selected all modes.
• All M, S, P, and O proofs verified and were byte-identical: 7,264
  bytes, SHA-256
  04d18c448a3fc2497daca547a90ef9a5b6d0bb8a1391e39f55529e1f95a51dc8.
  Route markers matched the requested mode and the binary hash was unchanged
  before and after timing.
• Every accepted block passed the process, load, and telemetry gates. Apple
  accepted blocks reported no thermal or performance warning. Attempts with
  geod, an unrelated PR feat(pasta): add an MSM accelerator registry and a Metal GPU backend crate #404 Rust build, Metal activity, or launchd activity
  were retained but excluded. Linux accepted blocks had no competing process,
  swap-in/out, or steal activity; its swap snapshot was unchanged.
• Diagnostic bundle SHA-256:
  ae596cdaa133cab426d93f6fc3082a7ab291888178751381d3cb75131e9bb51c.
• First-stage archives: Apple
  b342f21d1b4c541e6defad72a4f4030cb0395d477f9e965570dcd28c3c504a19;
  Linux
  d39d814edf5f8378fb53d93531303c8f6309a782bfd90155fbb29193d8b4337a.
• Extension archives: Apple
  71adea154d543bdf6d68bdfaddb185bfbeda418daf5a12bbcde9bde585751359;
  Linux
  17bdc6817eb6f4e87b7e26c4de0d848efe79387231132c609515b012824a84e1.
• Combined analyzer SHA-256:
  147a0ba5c9a169425e0953e8cab838a6d5366c13a47cc1029c32d8e348500985.
• Forced-fallback diagnostic a3eb69a6, bundle SHA-256
  39d5bbdefaec9238d109e0d2ce49cdadd2af7f4aa1f18b11de3c5ea9a8e6a305;
  Apple/Linux result archives
  0dfeb1bc07540fa564e7d32cec72717f2497c4df4fb833412e9ceea21894b9d3
  and
  797c44ab7d8db42e0b464886cd136d41f2a8c5c8bcdff8d8b50a4de37101e026;
  runner/analyzer
  c7e228ec7226534c6438431e342230d8b173f7de355576b06dbae3810ee9242e
  and
  11078b0734a26314f25cbba973b7f1b01a19c7fced9b0e93d2581ab956dc9ad0.

Between the frozen denominator and current main, #403 widens the AArch64
add/sub assembly cfg. It is target-equivalent on the two measured hosts. #405
routes runtime field doubling through that assembly on Apple and changes
explicit Sinsemilla trait-dispatch call sites; this is why the exact-current
confirmation above is required. The current restack (0dd71aba for #328 and
2a06abe3 for this PR) preserves both patches exactly by range-diff and patch
ID.

Validation, risks, and API surface

The principal risk is Rayon/cache/memory-bandwidth contention between advice
transforms and the commitment arm. v1, v3, and P show that nearby schedules
can lose substantially. The exact v2 schedule is therefore intentional, and
the forced work-reject rows above validate its remaining direct-fallback case.
Pools below eight workers and paths outside the narrow prepared configuration
do not use the overlap.

The exact current-main restack passes the full Halo2 suites: 238 default, 191
no-default, and 199 batch,orbits tests. The five focused advice-delta tests,
two Pasta multicore scalar-work tests, and 170-test Orchard library suite also
pass (with 3 Orchard tests ignored), as do formatting and git diff --check.
#328 is clean and mergeable with all 65 GitHub checks green. This stacked PR
is clean and mergeable; its two security checks are green.

This PR adds no public, pub(crate), or pub(super) API, changes no function
signature or visibility, and adds no new witness-dependent routing decision.
#328 documents the existing variable-time advice-similarity route; this PR
only changes when already-required work runs.

[v12-auditor]

Note

Complete: Audit complete. V12 did not find any issues that need review.

Open the full results here.

Analyzed one file, diff d9c5ffb...eda68c8.

[ValarDragon]

Benchmark update after remeasuring #353 on the current #328 stack.

The implementation originally posted here (v1) started advice transforms
before the exact full-row delta count. That now loses to #328 by +0.304846% on
Apple M4 (four-block bootstrap [+0.250911%, +0.358810%]) and +0.336362% on
Linux ([+0.143183%, +0.543067%]), consistent with count/transform
memory-bandwidth contention.

The replacement v2 performs the exact count synchronously, then overlaps all
advice transforms with the serial work check, delta materialization, MSMs,
reconstruction, and normalization. In a same-binary experiment:

• M = main-equivalent nested direct schedule;
• S = Reuse advice commitments for sparse witness deltas #328's serial count/work/materialization before transforms;
• O = replacement v2.

Negative is faster. These are real post-NU6.3 two-action proofs with two real
spends.

Host	Comparison	Four-block result	95% whole-block bootstrap	Four block effects
Apple M4, 10 workers	S/M	-0.364639%	[-0.753445%, +0.170348%]	-0.867169%, +0.430296%, -0.411488%, -0.605468%
Apple M4, 10 workers	O/S	-0.414077%	[-0.541441%, -0.314080%]	-0.278994%, -0.603884%, -0.353874%, -0.419266%
Linux AMD, 8 workers	S/M	-0.449344%	[-0.560749%, -0.337814%]	-0.367660%, -0.524864%, -0.596620%, -0.307959%
Linux AMD, 8 workers	O/S	-0.836799%	[-1.322477%, -0.384907%]	-1.516059%, -0.225334%, -0.739444%, -0.862095%

All eight O/S block effects favor v2. The corresponding n=4 Student-t
intervals are [-0.634989%, -0.192674%] on M4 and
[-1.678228%, +0.011831%] on Linux.

Because #405 subsequently changed runtime field doubling on Apple AArch64, we
ran a fresh same-binary confirmation on exact current main 4d14a1d1. Linux
was extended without rebuilding to four blocks after its initial S/M pair
was mixed; M4 retained two blocks:

Host	Comparison	Current means	Current result	95% whole-block bootstrap	Blocks
Apple M4, 10 workers	S/M	67.736104/67.987879 ms	-0.370645%	[-0.500048%, -0.241074%]	-0.500048%, -0.241074%
Apple M4, 10 workers	O/S	67.430197/67.668560 ms	-0.352367%	[-0.399280%, -0.305433%]	-0.305433%, -0.399280%
Linux AMD, 8 workers	S/M	141.006833/141.492766 ms	-0.344038%	[-0.733611%, -0.025098%]	+0.098234%, -0.394182%, -0.927426%, -0.149885%
Linux AMD, 8 workers	O/S	139.787874/140.860498 ms	-0.761552%	[-1.082534%, -0.449238%]	-0.663125%, -1.221944%, -0.318462%, -0.840539%

Exact-current topology is 4d14a1d1 -> #328 0dd71aba -> v2 2a06abe3
-> diagnostic 32ef6b23. Bundle/runner/analyzer SHA-256 values are
3e2e97484837b4213d0e2b185173fa9dfbf3db8145db84f23bc74b9d364d1f23,
49b36a359d8e126a3fc88c45f279652a2db3be3e8304028bbf80067e9eb57365,
and 8d12840ada529b1f7771bd6a4a9f44c8f3b6bc882eec69776ebe48f1bc5dc48d.
Exact-current result archives are
1018ec9dbdcab55bbfd2e87b7b731d1125b8908cbf0496e9e318b392a4a8b5aa
on M4,
ebd168c5208494d5eb00cb3e8d0529d45480e86f448816fda0fd7f9eeb527860
for the initial Linux run, and
06200616bfabe664f1d9e761132e9521e2ac0310f3497ffd03f8fb682d378326
for its extension. The authoritative combined analyzer is
4177be3ce918b15d1254962ee81cb9c7a910bf2d04a357704c49808a43874de9.
All integrity gates passed. The extension retained and excluded
landscape-sysinfo and fwupd attempts; M4 retained and excluded two launchd
attempts.

Two nearby designs were rejected:

• Parallelizing the approximately 8.9 us work gate (P) regressed M4 by
  +0.510413% ([+0.053792%, +0.969117%]) and was near noise on Linux at
  -0.166102% ([-0.332713%, +0.000788%]). Even eliminating the gate entirely
  could save only about 0.013% of the proof.
• Delaying transforms until after both the count and work check (v3) regressed
  Reuse advice commitments for sparse witness deltas #328 by +0.773703% on M4 ([+0.766110%, +0.781296%]) and +0.951544% on
  Linux ([+0.869076%, +1.034079%]) in two-block screens.

The same-binary source topology was main 42f5dd4e -> #328 6f400097 -> v2
343ede91 -> diagnostic 16d5e4a3. All modes produced the same verified
7,264-byte proof (SHA-256
04d18c448a3fc2497daca547a90ef9a5b6d0bb8a1391e39f55529e1f95a51dc8),
all route markers were exact, and each binary's pre/post-timing hash matched.
Accepted blocks passed process and telemetry gates; contaminated Apple attempts
were retained but excluded. Linux had no swap-in/out or steal activity, and
M4 reported no thermal or performance warning.

The four-block benchmark was frozen at 42f5dd4e. #403 is target-equivalent on
the measured hosts; #405 changes Apple runtime behavior and motivates the
exact-current confirmation above. The current restack preserves #328 and v2
exactly by range-diff and patch ID.

Artifacts:

• diagnostic bundle:
  ae596cdaa133cab426d93f6fc3082a7ab291888178751381d3cb75131e9bb51c;
• Apple first-stage / extension archives:
  b342f21d1b4c541e6defad72a4f4030cb0395d477f9e965570dcd28c3c504a19,
  71adea154d543bdf6d68bdfaddb185bfbeda418daf5a12bbcde9bde585751359;
• Linux first-stage / extension archives:
  d39d814edf5f8378fb53d93531303c8f6309a782bfd90155fbb29193d8b4337a,
  17bdc6817eb6f4e87b7e26c4de0d848efe79387231132c609515b012824a84e1;
• combined analyzer:
  147a0ba5c9a169425e0953e8cab838a6d5366c13a47cc1029c32d8e348500985.

The final fallback gate forces the density gate to pass and the prepared-work
gate to reject at the first and last advice columns.
D0/D9 use #328's nested direct fallback; X0/X9 use v2's direct
commitments while transforms run.

Host	Comparison	Result	95% whole-block bootstrap	Block effects
Apple M4	X0/D0	-0.230156%	[-0.520710%, +0.061246%]	-0.520710%, +0.061246%
Apple M4	X9/D9	-0.487199%	[-0.591828%, -0.382459%]	-0.382459%, -0.591828%
Linux AMD	X0/D0	-0.712084%	[-1.089982%, -0.332741%]	-1.089982%, -0.332741%
Linux AMD	X9/D9	-0.455103%	[-0.585962%, -0.324071%]	-0.585962%, -0.324071%

Both order strata favored v2 in every forced contrast. M4 X0/D0 is
favorable/noisy; the other three two-block ranges exclude zero. All 32 timing
legs were accepted on their first attempt with empty contamination files.
Linux swap/steal counters were unchanged; all M4 snapshots reported zero swap
and no thermal or performance warning. All forced-mode proofs were identical
to the expected verified proof, and every route/schedule marker matched.

Forced-fallback provenance: diagnostic bundle
39d5bbdefaec9238d109e0d2ce49cdadd2af7f4aa1f18b11de3c5ea9a8e6a305;
Apple/Linux archives
0dfeb1bc07540fa564e7d32cec72717f2497c4df4fb833412e9ceea21894b9d3
and
797c44ab7d8db42e0b464886cd136d41f2a8c5c8bcdff8d8b50a4de37101e026;
runner/analyzer
c7e228ec7226534c6438431e342230d8b173f7de355576b06dbae3810ee9242e
and
11078b0734a26314f25cbba973b7f1b01a19c7fced9b0e93d2581ab956dc9ad0.

The replacement adds no public, pub(crate), or pub(super) API and changes
no signature or visibility.

Current heads 0dd71aba / 2a06abe3 are clean and mergeable. All 65 #328
checks and both #353 security checks are green.