Send ring-switch s_hat_v on the stream, drop RingSwitchProof

The ring-switch message was the last plain scalar riding a struct:
`RingSwitchProof` wrapped 64 E values that `observe_ext_slice` bound and
the verifier read back out of `BatchOpeningProof`. `add_scalars` and
`next_scalars` do both jobs in one call, so the struct is deleted and
`BatchOpeningProof` is now just the WHIR Merkle data.

`omit_replayed_ab` goes with it. It existed because the prover put AB's
s_hat_v in the struct and then removed it after checking it matched
lincheck's z_partial. On the stream a prebound claim simply sends
nothing, so there is nothing to take back.

The verifier's shape validation collapses too: reading exactly 64 words
is the width check, and a short stream is the new `VerifyError::
Truncated` instead of a length test on attacker-supplied data.

The guest reads the 64 words with the same `fs_next` walk it uses for
z_partial, so read and bind stay one act and the separate obs loop and
the `rs_shatv` hint buffer both disappear.

The sponge sequence is unchanged: the same 64 values are bound at the
same point, so every challenge is identical. Only the stream grew by 64
words and the struct shrank by the same, and `flock_stream_end` still
marks where flock's reduction ends.

testall, clippyall, docall and ruff clean. recursion_2to1{,_mixed},
recursion_generic_many and recursion_soundness_binds pass with the
edited guest; the python verifier's pinning test passes. Guest cycles
727,750 and proof size 223.8 KiB, both unchanged.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: TomWambsgans

crates/flock/tests/blake3_batch.rs

@@ -95,9 +95,7 @@ fn verifier_ring(ab: &ZClaim, c: &ZClaim, ab_s_hat_v: &[F192], qflock_vars: usiz
     RingSwitchVerify {
         offset: 0,
         qflock_vars,
-        reconstructed: vec![pcs::ring_switch::RingSwitchProof {
-            s_hat_v: ab_s_hat_v.to_vec(),
-        }],
+        reconstructed: vec![ab_s_hat_v.to_vec()],
         claims: vec![ring_claim(ab, None, qflock_vars), ring_claim(c, None, qflock_vars)],
     }
 }
@@ -160,9 +158,7 @@ fn blake3_batch_prove_verify() {
         let reduced = setup.prove_reduction_precomputed(&z_packed, &a_packed, &b_packed, &z_lincheck, &mut ps);
         drop((z_packed, a_packed, b_packed, z_lincheck));
         let ring = prover_ring(&reduced, mu);
-        let mut opening = open_batch_mixed_whir_stacked(&mut ps, &q_flock, &prover_data, &prover_config, &[], &ring);
-        assert_eq!(opening.ring_switches[0].s_hat_v, reduced.ab.s_hat_v.as_deref().unwrap());
-        opening.ring_switches.remove(0);
+        let opening = open_batch_mixed_whir_stacked(&mut ps, &q_flock, &prover_data, &prover_config, &[], &ring);
         let open_s = t.elapsed().as_secs_f64();
         let prove_s = t_prove.elapsed().as_secs_f64();
 

crates/lean_vm/src/blake3_flock.rs

@@ -400,29 +400,11 @@ pub fn ring_switch_verify(
     crate::pcs::RingSwitchVerify {
         offset,
         qflock_vars,
-        reconstructed: vec![::pcs::ring_switch::RingSwitchProof {
-            s_hat_v: ab_s_hat_v.to_vec(),
-        }],
+        reconstructed: vec![ab_s_hat_v.to_vec()],
         claims: vec![ring_claim(&ab, None, qflock_vars), ring_claim(&c, None, qflock_vars)],
     }
 }
 
-/// Drop the AB ring-switch message from the opening after checking that it is
-/// the same `z_partial` already sent by lincheck. Verifiers reconstruct and
-/// use it as an already-bound ring-switch message.
-pub fn omit_replayed_ab(opening: &mut crate::pcs::BatchOpeningProof, ab_s_hat_v: &[F192]) {
-    assert_eq!(
-        opening.ring_switches.len(),
-        2,
-        "Flock opening must carry AB and C ring-switch messages"
-    );
-    assert_eq!(
-        opening.ring_switches[0].s_hat_v, ab_s_hat_v,
-        "lincheck and AB ring-switch values drifted"
-    );
-    opening.ring_switches.remove(0);
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -585,20 +567,7 @@ mod tests {
         let committed = crate::pcs::commit(&mut ps, &stacked.q, crate::pcs::LOG_INV_RATE);
         let (_z, reduced) = prove_reduction(&blocks, &mut ps);
         let ring = ring_switch_open(blocks.len(), offset, &reduced);
-        let mut open = crate::pcs::open(&mut ps, &committed, &stacked.q, &points, &ring);
-        omit_replayed_ab(
-            &mut open,
-            reduced
-                .ab
-                .s_hat_v
-                .as_deref()
-                .expect("Flock AB ring-switch values are captured"),
-        );
-        assert_eq!(
-            open.ring_switches.len(),
-            1,
-            "only C's ring-switch message travels in the opening"
-        );
+        let open = crate::pcs::open(&mut ps, &committed, &stacked.q, &points, &ring);
         ps.hint_opening(open);
         let bundle = ps.into_proof();
 

crates/lean_vm/src/cpu/mod.rs

@@ -617,15 +617,7 @@ pub fn prove(program: &Program, public_input: [F192; 2], log_inv_rate: usize) ->
     drop(flock_reduction);
     let offset = w.layout.placements[QFLOCK].offset;
     let ring = crate::blake3_flock::ring_switch_open(n_blocks, offset, &reduced);
-    let mut mixed_open = crate::stage!("PCS open", || { pcs::open(&mut ps, &committed, &w.q, &slots, &ring) });
-    crate::blake3_flock::omit_replayed_ab(
-        &mut mixed_open,
-        reduced
-            .ab
-            .s_hat_v
-            .as_deref()
-            .expect("Flock AB ring-switch values are captured"),
-    );
+    let mixed_open = crate::stage!("PCS open", || { pcs::open(&mut ps, &committed, &w.q, &slots, &ring) });
     // flock's scalar sub-proof already rode the shared stream (add_scalar at its
     // protocol points); only the Merkle-bearing stacked opening needs the hint
     // channel.

crates/lean_vm/src/leaf.rs

@@ -462,25 +462,15 @@ fn decompose_prove(
 
     // Pass 2: replay in the original order; duplicates reuse the recorded claim.
     let mut fresh_iter = jobs.iter().zip(vals.iter());
-    decompose_formula(
-        blocks,
-        lay,
-        zeta,
-        w,
-        gamma,
-        owners,
-        forms,
-        claims,
-        |col, zeta_lo| {
-            let (&(jc, jk), &v) = fresh_iter
-                .next()
-                .expect("job enumeration matches decompose_formula's col_val order");
-            debug_assert_eq!((jc, jk), (col, zeta_lo.len()), "job/coord order drift");
-            debug_assert_eq!(v, mle_eval(cols[col], zeta_lo), "job/coord order drift");
-            ps.add_scalar(v);
-            Ok(v)
-        },
-    )
+    decompose_formula(blocks, lay, zeta, w, gamma, owners, forms, claims, |col, zeta_lo| {
+        let (&(jc, jk), &v) = fresh_iter
+            .next()
+            .expect("job enumeration matches decompose_formula's col_val order");
+        debug_assert_eq!((jc, jk), (col, zeta_lo.len()), "job/coord order drift");
+        debug_assert_eq!(v, mle_eval(cols[col], zeta_lo), "job/coord order drift");
+        ps.add_scalar(v);
+        Ok(v)
+    })
     .expect("prover decomposition is infallible")
 }
 
@@ -687,7 +677,13 @@ pub fn prove_balance(
     // Framework blocks keep their per-column claims (deduped: push/pull share ζ);
     // every table block becomes a form for the zerocheck instead.
     let mut claims: Vec<ColumnClaim> = Vec::new();
-    let sides = sides([push, pull, count], [&push_lay, &pull_lay, &count_lay], &w, &count_w, gamma);
+    let sides = sides(
+        [push, pull, count],
+        [&push_lay, &pull_lay, &count_lay],
+        &w,
+        &count_w,
+        gamma,
+    );
     // Each table's columns at ζ[..τ], computed once and shared by the three sides
     // (a form's linear part factors through them). Nothing here travels, neither the
     // evaluations nor any total: the verifier derives each side's table share as `Ṽ₀(ζ)` less the
@@ -840,7 +836,13 @@ pub fn verify_balance(
     // here, the batch's target being what pins it, so no table column is opened at ζ.
     let mut claims: Vec<ColumnClaim> = Vec::new();
     let mut forms = std::array::from_fn(|_| tables.iter().map(|&(_, n)| BusForm::new(n)).collect::<Vec<_>>());
-    let sides = sides([push, pull, count], [&push_lay, &pull_lay, &count_lay], &w, &count_w, gamma);
+    let sides = sides(
+        [push, pull, count],
+        [&push_lay, &pull_lay, &count_lay],
+        &w,
+        &count_w,
+        gamma,
+    );
     let mut totals = [F192::ZERO; 3];
     for (s, &(blocks, lay, a, g)) in sides.iter().enumerate() {
         let framework = decompose_verify(