ecdsafail-circuit-optimization

name

ecdsafail-circuit-optimization

description

Use this skill whenever designing, reviewing, or modifying ECDSA Fail / quantum ECC point-addition circuits to reduce qubit count, Toffoli count, or score. This skill is especially relevant when comparing SOTA submissions, borrowing ideas from Andre/Schrottenloher-style space-optimized arithmetic, Trail of Bits trailmix-style reversible-circuit insights, or choosing structural optimization knobs before island hunting.

ECDSA Fail Circuit Optimization

Use this skill to reason about structural circuit changes before spending GPU time on island hunting. It complements the ecdsafail-island-hunting skill: this skill designs and scores candidate routes; island hunting validates whether a route has a clean nonce.

The objective is usually:

score = peak_qubits * measured_or_estimated_toffoli_count

Do not treat a lower qubit count as automatically better. A route that saves 2 qubits but creates a large Toffoli penalty or structurally dirty candidates may lose.

First Principles

Optimize in this order:

1. Preserve correctness and reversibility.
2. Estimate score against current SOTA.
3. Reduce peak live qubits by shortening live ranges and reusing scratch.
4. Reduce Toffoli count only when it does not push qubits above the target.
5. Run short triage before large island search.

Track every candidate route with:

• CFG / feature knobs
• peak qubits
• average or estimated Toffoli count
• score
• expected correctness risk
• candidate density and best cls / pha / anc after triage

Research / Engineering Harness Split

For longer ECDSA Fail optimization pushes, separate exploratory research from engineering hardening. This keeps agents from either brainstorming forever or over-polishing a weak route.

Use a research harness to create and cheap-test hypotheses:

• generate diverse structural routes from the skill catalogue and SOTA notes
• measure q/CCX/estimated Toffoli/score quickly
• run tiny theoretical diagnostics or local gates
• keep promising and failed route records with enough detail to reproduce
• converge toward a short list of paths worth engineering

Use an engineering harness to harden the best research outputs:

• turn promising knobs into clean, reviewable patches
• improve diagnostics/tooling where the research loop got stuck
• run validator/local-vs-remote checks and controlled triage
• preserve exact CFGs, commits, state files, benchmark output, and failure classes
• publish concise shared notes so future agents can continue without rereading local logs

The handoff artifact between the two harnesses should include: source commit/frontier baseline, hypothesis, changed files/env vars, measured q/Toffoli/score, cheap-gate or full-run result, failure class if any, and the exact next step.

Diagnose, Repair, Then Hunt

When a low-qubit or low-Toffoli route fails triage, do not immediately discard it or keep hunting blindly. Treat the route as a circuit-under-debugging problem and run a bounded diagnosis/repair loop before spending more GPU time. This is especially important for aggressive sub-frontier qubit routes where candidate density can be zero because the circuit structure rejects the reachable input distribution in theory.

Core rule:

The GPU should confirm a viable circuit theory, not substitute for one.

Use this loop when a route shows zero or very low candidate density, repeated high dirty fingerprints, persistent pha/anc, a suspiciously uniform failure pattern, or a hard residual floor that may be nonce-independent.

1. Freeze the exact route. Record the source commit, CFG, peak qubits, CCX/Toffoli estimate, score if relevant, peak-owner trace, state-file identity, validator binary/source hash if relevant, scan range, candidate density, and the smallest scan/validation evidence that demonstrates the failure.
2. Diagnose the failing mechanism. Prefer circuit-aware diagnostics over more nonce search: classical prefilter reason histograms, per-section validator counters, first-failing operation/section traces, failing-shot overlap tests, convergence-step distributions, carry/borrow width histograms, compare-decision disagreement counts, phase/ancilla cleanup receipts, local-vs-remote validator cross-checks, and peak-owner traces.
3. Explain the failure in circuit terms. Name the invariant that is being violated: under-converged GCD transcript, truncated body carry losing information, width envelope too tight, stale compare bit, dirty scratch reused across a live control, incorrect measurement/phase discharge, full raw transcript decode co-residing with too much state, operand alias crossing a dependency boundary, or a peak-owner assumption that was false.
4. Patch the smallest responsible mechanism. Restore one carry bit/window, widen one compare or active-width envelope, add a local giveback, delay one scratch release, restore one cleanup, change one chunk boundary, move one alias lifetime, add a per-step decode frame, or recompute/clear a narrow frame instead of holding a wide raw block. Keep the patch as close as possible to the diagnosed mechanism.
5. Measure the cost of the repair. Recompute peak qubits, CCX/estimated Toffoli, score if score matters, and peak-owner movement. A repair is useful only if it preserves the target qubit regime or spends Toffoli/qubits in a consciously acceptable way.
6. Re-run diagnostics before hunting. The first success criterion is theoretical viability: the diagnosed hard failure should disappear or become a rare tail, candidate density should become nonzero/plausible, failure fingerprints should diversify, pha/anc should not persist, and nearby safer variants should improve smoothly.
7. Only then run a short triage scan. Use a 5-10M equal-size pilot before any large hunt. Validate candidates in fast and full modes. Continue only if candidate density and the cls / pha / anc distribution look huntable.
8. Iterate with a budget. Try up to a fixed number of diagnosis/repair iterations, often X = 10, or stop sooner if several consecutive repairs do not improve the same core signal. Record failed repairs and why they failed so the next agent does not rediscover them.

Judgment rules for the loop:

• Prefer fixes that restore a broken invariant over random knob ladders.
• Do not increase qubits or Toffoli "a little" repeatedly without tracking cumulative cost.
• If relaxing a knob makes the theoretical diagnostic healthy, use that relaxation to identify the mechanism, then look for a cheaper targeted repair.
• If every repair moves the route out of the target qubit regime, mark the route structurally incompatible with that target and switch bases.
• If a route has no theoretical path to candidate production, GPU scanning is not evidence gathering; it is just burning frontier.

Hunt-readiness checklist:

• the route's qubits/Toffoli are acceptable for the current objective
• the peak-owner trace matches the intended optimization
• candidate density is not starved
• validation has low or improving residuals
• dirty fingerprints vary across candidates
• no fixed failing-shot floor is detected
• local and remote validators are reproducible

Example: GCD Prefilter Autopsy Before More Hunting

When a route has zero GCD-clean candidates, diagnose the classical GCD prefilter directly before extending any island search. Derive the same Fiat-Shamir shots as the GPU search and run every dx and c factor through check_gcd_factor, but do not early-exit. Print histograms for:

• factor pass/fail rate split by dx and c
• NonConvergence, WidthOverflow, BodyTrimMismatch, and ComparatorMismatch
• failure step distribution
• true convergence-step p50/p90/p99/max
• first bad shot distribution across each nonce

Interpretation:

• Mostly NonConvergence: raise active iterations, use K2/jump-style acceleration, or add enough padding for the 9024-shot tail.
• Mostly WidthOverflow: the active-width margin/slope or step bump schedule is too tight.
• Mostly BodyTrimMismatch: body/carry truncation is discarding information and needs a giveback, wider body window, or different chunk boundary.
• Mostly ComparatorMismatch under strict mode only: the prefilter may not be the blocker, but full validation must localize whether the truncated branch remains semantically correct.

Case study: the q=1171, active360, CCX=1,438,594 K1/base-3 sidecar route had zero candidates because sampled Fiat-Shamir factors had effectively 0% pass rate. Raising active iterations removed only the convergence part; early BodyTrimMismatch and WidthOverflow still rejected every factor. Disabling the aggressive body/width envelope made the same samples mostly pass. The conclusion was structural: the low-qubit envelope discarded required GCD body/width information too early, so large-scale island hunting could not succeed until that mechanism was repaired.

Example: K5 Apply Decode Repair

When the 1203q K5 transcript-compression route is apply-peak bound, inspect whether the compressed block is still full-decoded into a raw block during apply. If a 12-bit compressed K5 block co-resides with a 15-bit raw block plus codec/apply scratch, the route may have a direct qubit repair opportunity.

Repair pattern:

1. Keep the K5 clean transcript block compressed at rest.
2. Decode only the current step's (b0, b0_and_b1, s2) into a tiny frame.
3. Run the apply operation controlled by that frame.
4. Recompute the same frame and clear it.
5. Restore the compressed block before moving to the next step.

This attacks the measured peak owner directly. It may spend extra codec Toffolis, but it avoids holding the whole raw transcript block live across apply_double_y / apply_reverse_halve_y. Use this kind of per-step decode frame whenever the diagnosis shows that "compressed representation exists, but full materialization still binds the peak."

The Qubit<->Toffoli Exchange Rate (trailmix metric model)

This is the single most important framing for this challenge. The verified trailmix quantum_resource_metrics.md models the trade explicitly, and it changes how to read the score = qubits * Toffoli objective:

• In the volume-limited regime (a space-minimized EC inversion has few magic-state factories), iso-cost is C ~ qubits * Toffoli. The break-even tolerable Toffoli blowup is the reciprocal of the qubit shrink: halve qubits -> up to 2x Toffoli is free; shrink 10x -> 10x Toffoli is free. The benchmark score is a faithful local gradient of real cost around a fixed operating point.
• The trap is Toffoli-DEPTH, not Toffoli-count. The reciprocal rule holds only if the qubit-saving trick is depth-neutral. Recompute/uncompute and fewer-ancilla tricks inflate depth; at the reaction floor that depth blowup is NOT refundable. trailmix flags getting the EC-inversion Toffoli-depth as an open item -- all their published trades assume depth-neutrality.
• Practical verdicts they actually use: cut qubits 2x for +50% Toffoli (depth-neutral) = clear win; cut qubits 20% but 3x Toffoli = clear loss.

Consequence for our work: qubits * executed_Toffoli as an absolute scalar is a weak ("everything idles") metric, but its gradient is exactly the right "trade these qubits for those Toffolis" rate. When two routes have near-equal score, prefer the one that did NOT buy its qubits with recompute (depth), because the depth cost is invisible to the score but real on hardware.

The concrete vent primitive (trailmix gidney_const_adder.rs): a hybrid controlled adder costs Toffoli = 3n - 2 - vents. Each "vent" replaces one carry-uncompute Toffoli with an X-basis measurement + a CZ phase fixup (T-count 0). So each vent = -1 Toffoli, +1 peak qubit, held only between the forward and reverse carry chains. This is the exact, sim-verified dial. Vent OFF-peak phases (where ancilla headroom is free) for pure Toffoli savings; on the peak-binding phase, venting costs real score.

Qubit Reduction Patterns

Live-Range Shortening

The strongest qubit reductions usually come from freeing registers earlier, not from changing arithmetic formulas.

Look for:

• scratch registers whose final consumers are earlier than their lexical scope
• compare bits that can be cleaned once their branch/control use is over
• carry or borrow chains that can be truncated, measured, or recomputed
• temporary GCD/fold state that can be released during a fold instead of after the whole block
• a held carry/value that is a CHEAP FUNCTION of other still-live qubits — clear it, loan its lane to the current sub-block, then recompute it before it is next read (recompute-to-free; this is how BitWonka's q1152 cy0-release cut 1153→1152 — see "BitWonka's q1152" below). A dead-qubit liveness scan MISSES these: the qubit is not dead, its value is just cheaply restorable. When a dead-qubit scan says "no idle qubit," switch to this question before concluding the qubit floor is structural.

Relevant knobs and ideas from our experiments:

• DIALOG_GCD_APPLY_RELEASE_CLEAN_SCRATCH_DURING_FOLD=1
• DIALOG_GCD_K5_FREE_CLEAN_BLOCK_DURING_SHIFT=1
• DIALOG_GCD_APPLY_CHUNK_TOPCLEAN=0/1
• DIALOG_GCD_APPLY_FINAL_TOPCLEAN=0
• SQUARE_ROW_WINDOW_MEASURED_CARRY_CLEAR=1

The live-range HOLE pattern (1211q -> 1193q SOTA, submission ad4cf86d, 2026-06-13). This is the strongest recent qubit win and the canonical example of the pattern. The K5 apply phase holds a compressed_block transcript scratch live across the whole block, but that block is DEAD during the y-double shift sub-phase (mod_double_inplace_fast + cmod_double_inplace_lazy). DIALOG_GCD_K5_FREE_CLEAN_BLOCK_DURING_SHIFT=1 punches a hole: free_vec(compressed_block) right before the shift and reacquire_vec right after (code: src/point_add/rounds/dialog/compressed.rs:1977). That drops the GCD-apply peak below the round84 square's peak, so the binding peak owner moves to round84_inplace_solinas_square_forward. Paired with SQUARE_ROW_MAX_SEG 176->166 (the square is now the binder, so segment it harder), DIALOG_GCD_APPLY_CLEAN_COMPARE_BITS 19->20 and DIALOG_GCD_FOLD_CARRY_TRUNC_W 17->18 (loosen the now-non-binding knobs for island landability), plus a fresh DIALOG_TAIL_NONCE hunt, this dropped 18 qubits (1211->1193) for only +7,727 avg-T (1,404,664->1,412,391) = 429 T/q, far under the ~1,212 T/q break-even. Gate conditions in code: !inplace_raw && recompressed_s2.is_none() && replay_swap_host. Lesson: when you free a binding-phase scratch, the NEXT peak owner becomes the new target — re-trace TRACE_PEAK after every hole to find who binds now, then attack THAT phase.

Peak-owner whack-a-mole — the verified migration chain (1211 -> 1192). Each qubit win is a lever that drops the current binder and exposes the next one; the technique is to re-TRACE_PEAK, read the new owning phase, and design the next lever against THAT phase:

• 1211q — binder = GCD-apply compressed-block.
• DIALOG_GCD_K5_FREE_CLEAN_BLOCK_DURING_SHIFT=1 (the live-range hole above) ->
• 1193q (SOTA ad4cf86d) — binder migrated to round84_inplace_solinas_square_forward.
• attack the square's SIZE: SQUARE_ROW_MAX_SEG 166->165 (one segment notch, +fresh island 2107498317) ->
• 1192q (SOTA a7ec174f, 0fa5c6f, 1,683,610,600 = 1192 x 1,412,425; -1 q for +34 avg-T — the tighter segment costs a hair of recompute). The seg notch dropped the square's peak below the next phase, so the binder migrated AGAIN to dialog_gcd_materialized_special_underflow_fold (ops_idx ~1.82M, early in the GCD).
• THEN, square now OFF-peak, SQUARE_ROW_WINDOW_CLEAN_COMPARE_BITS 21->19 (+island 11556565) ->
• 1192q (SOTA a39ce501, cf99209, 1,683,083,736 = 1192 x 1,411,983) — a PURE peak-neutral Toffoli trim: -442 avg-T, 0 qubits. Shrinking the square's clean-compare window frees no qubits because the square no longer binds the peak; it only cuts gates.
• then ATTACK that binder with per-step scheduling + a denser codec (next bullet) ->
• 1185q (SOTA 3182d2b3, cf310ec, 1,681,025,595 = 1185 x 1,418,587; -7 q for +6,604 avg-T = 943 T/q, under break-even). A ROUTE CHANGE, not a notch — binder migrated to dialog_gcd_apply_chunk_sub_ripple (ops_idx ~1.82M). Next sub-1185 target = that GCD-apply chunked sub-ripple phase.

Two lessons fall out of the 1193->1192 leg pair: (1) the QUBIT win only ever comes from shrinking whoever CURRENTLY binds the peak (here the seg notch on the square); (2) once a phase falls OFF-peak, shrinking it further is a pure-Toffoli play — judge it on avg-T alone, expect zero qubit movement (here clean-compare 21->19 bought -442 T at 0 q). Don't expect a qubit drop from squeezing an off-peak phase, and don't skip a real Toffoli win just because it doesn't move qubits. The cheap workflow to tell which case you are in: rm -f ops.bin; TRACE_PEAK=1 build_circuit | grep peak_qubits prints peak_qubits=<N> at phase='<owner>' — that phase name IS your next QUBIT lever's target; everything else you tighten is a Toffoli-only play.

Risk: early release can silently create classical/phase errors if a supposedly dead bit is still entangled or reused as a control later.

Per-Step Scheduling And Denser Codecs (the 1192 -> 1185 route change)

Once the cheap constant-width notches are exhausted, the next qubit regime is unlocked by TWO structural ideas, both verified in SOTA 3182d2b3 (cf310ec, 1185q):

1. Per-step scheduling — replace a constant width with a fn(step) schedule. The GCD runs ~258 fixed iterations; different steps tolerate different truncation/notch widths, so a single constant must be set to the worst-case step. A per-step schedule squeezes each step exactly as tight as IT can take, recovering the slack the constant wasted. Concretely:

• Code: dialog_gcd_special_fold_carry_trunc_window(step) REPLACES the constant fold_carry_trunc_window() at the dialog_gcd_materialized_special_underflow_fold (and _borrowed_) sites (src/point_add/mod.rs underflow-fold).
• Knobs (all per-step maps): DIALOG_GCD_BINDER_NOTCH_STEPS=8,9,10 + _EXTRA=3 + _MAP=11:1,12:1,13:1 (notch the BINDING phase at chosen steps — the scheduled form of "attack the current binder"); DIALOG_GCD_BODY_CARRY_BAND_TRIMS (one entry per active iteration, e.g. 0,3,3,3,3,3,1,...,1,3,3,3 — wider trim at the ends, tight 1 in the middle); DIALOG_GCD_SPECIAL_OVERFLOW_CLEAN_STEP_BITS=113:21,131:21,142:22,....
• Parse/validate these in the classical filter (dialog_gcd_classical_filter.rs reads BINDER_NOTCH_STEPS/EXTRA/MAP ~line 707) so island hunting models the per-step widths.

2. Denser transcript codec. DIALOG_GCD_K5_HEAD11_CODEC=1 + DIALOG_GCD_APPLY_IMPLICIT_HIGH_ZERO=1 pack the K5 transcript tighter (head-11 codec) and exploit known-zero high bits in the apply. This is the "denser transcript compressor" long predicted as the only real sub-1193 lever (symbol entropy is near-uniform, so the win is structural packing, not VLC). Guarded by dialog_gcd_k5_head11_codec_selftest() + dialog_gcd_k5_head11_supports(pattern) — a codec that changes the transcript MUST ship a bijectivity/coverage self-check or it silently drops inputs. Paired with deeper carry parking (DIALOG_GCD_FOLD_PARK_LOW_CARRIES 1->7, new DIALOG_GCD_SPECIAL_FOLD_PARK_LOW_CARRIES=5 + _RELEASE_SCRATCH=1) and DIALOG_GCD_PERPOS_MAJ2=1.

Two meta-lessons from this submission:

• Off-peak phases get loosened, not just left alone. This route raised SQUARE_ROW_MAX_SEG 165->176 and SQUARE_ROW_WINDOW_CLEAN_COMPARE_BITS 19->21 — UN-doing earlier qubit notches on the square — because the square is now far off-peak, so loosening it is qubit-free and buys back Toffoli. When the binder moves, revisit what you previously over-tightened.
• The competitor bakes its optimizer's full env vector into the source via a std::env::set_var(...) block ("make the submitted circuit independent of the optimizer shell environment"). They run an external optimizer over a large knob vector and materialize the winner — a signal that the frontier is now found by automated multi-knob search over per-step schedules, not hand-picked single notches.

Chunking Large Blocks

Chunking lets the circuit trade recomputation/extra gates for lower peak qubits.

Useful knobs:

• DIALOG_GCD_APPLY_CHUNKED_F_BLOCKS=<n>
• GCD/apply block chunk sizes, especially routes like b14, b15

Observed behavior:

• Increasing chunk count can lower peak qubits by reducing simultaneously live fold state.
• Too much chunking can increase Toffoli and sometimes worsen candidate quality.
• Chunk-count changes can interact strongly with compare-bit cleaning and carry truncation.

In-Place and Operand-Aliasing Tricks

The major SOTA direction we observed was avoiding duplicate operand storage by doing more work in-place and carefully aliasing operands.

Relevant ideas:

• use in-place raw blocks when a source can safely become the destination
• avoid materializing full intermediate products when a streamed/folded form is enough
• borrow existing registers as dirty scratch when their values can be restored before observation
• decompose in-place modular multiplication into transcript creation, transcript application, and transcript uncompute: x -> dialog/transcript, apply the transcript to turn (y, 0) into (y, xy mod p), then reverse the transcript creation to restore x
• in point addition, avoid a separate long-lived slope register when possible; let the slope live in an existing coordinate register between the two dependent multiply/divide operations

Useful knob:

• DIALOG_GCD_K2_APPLY_INPLACE_RAW_BLOCK=1

Trail of Bits/trailmix-inspired framing:

• Treat the program as a reversible dataflow graph.
• Hunt for operand aliases and dead registers.
• Prefer transformations that reduce live-set peak rather than only local gate count.
• Be suspicious of aliases across measurement, phase, or conditional-control boundaries.

Risk: operand aliasing often produces low qubits but can cause uniform high cls / pha / anc failures if one dependency was misclassified as dead.

Transient vs persistent-transcript floor — two qubit levers, very different exchange rates (verified q1185 → q1175 → q1170)

Decompose the binder's live set into a persistent floor (held across the whole region) and a transient (the working registers of the current step). Get this from an alloc-phase composition histogram at the peak (instrument alloc_qubit/free to tally live qubits by the phase that allocated them). On the dialog-GCD route at the 1185q binder (dialog_gcd_apply_chunk_sub_ripple) it was:

• 1149 persistent = 637 raw_pa_pair1_quotient (u 256 + compressed transcript ~372) + 512 init (the two output coordinate registers), plus
• ~36 transient = the current apply chunk's load (~20) + carry-ripple lane (~15).

The verified q1175 route (commit 757e6e7, full-clean 0/0/0) cut −10 qubits entirely from the transient (load 20→13, ripple 15→12); the 1149 persistent floor was untouched. The transient is the easiest lever — but, as the q1170 SOTA below proves, not the cheapest per qubit. Both the transient and the persistent transcript floor are reducible; they have very different exchange rates (see the comparison at the end of this section).

Mechanism — source the current-chunk scratch from qubits that already exist, and chunk finer:

• Host the apply working space on DIRTY qubits (DIALOG_GCD_APPLY_ALL_DIRTY_QOFFSET, ..._FIRST_DIRTY_QOFFSET) — reuse non-|0⟩ qubits as the apply's scratch and clean them after, instead of grabbing fresh clean lanes (the dirty-borrow pattern, scaled up to the apply hot loop).
• Borrow already-cleaned future-boundary carries as scratch (DIALOG_GCD_BOUNDARY_REPLAY_BORROW_CLEANED, DIALOG_GCD_APPLY_BORROW_FUTURE_BOUNDARY_CARRIES).
• Finer apply chunking (DIALOG_GCD_APPLY_CHUNKED_F_BLOCKS 18→25 with an explicit DIALOG_GCD_APPLY_CHUNKED_F_CUTS schedule) — smaller chunks ⇒ a smaller per-chunk load/carry lane live at once.
• Stream/host fold controls instead of materializing them (DIALOG_GCD_FOLD_STREAM_CONTROLS, DIALOG_GCD_FOLD_HOST_STREAMED_CONTROL, ..._HOST_D_CARRY12 / _E_TOP_CARRY / _OVF2_CARRY13) and deeper carry parking (FOLD_PARK_LOW_CARRIES 7→17, SPECIAL_FOLD_PARK_LOW_CARRIES 5→15).

Coordinate across ALL co-bound families. The 1185 peak was a co-bind plateau of ~10 phases (round84 square + materialized folds + apply double_y/halve_y + apply ripple), so narrowing one family's transient leaves the others pinning 1185. The q1175 route narrowed every co-bound family together: apply (above) + square (SQUARE_ROW_MAX_SEG 158→144) + folds (park/host). Budget for several coordinated edits and re-TRACE_PEAK after each to see which walls remain.

Two cautions. (1) These are new code primitives, not just knobs — the q1175 commit is ~816 inserted lines across compressed.rs/dialog/mod.rs/venting.rs; the dirty-qoffset / boundary-borrow / stream-control knobs do not exist on the 1185 base. A structural width cut is value-exact-or-broken (validate 0/0/0 on random inputs before any island hunt; the commit name "repaired clean island" reflects exactly that fix-then-re-hunt). (2) The trade is steep: −10 qubits cost +127k avg-Toffoli (~12,700 T/qubit, ~10× the ~1,200 break-even), so q1175 is a clean qubit-record branch, not a score win (1175 × 1,545,825 = 1,816,344,375 > the 1185 SOTA's 1,681,025,595). Gate every transient cut on the exchange rate — finer chunking + hosting/borrow recompute is where the Toffoli goes. That the persistent 1149 floor is still standing means real qubit headroom remains if a cheaper-Toffoli mechanism (or a denser transcript) is found.

q1170 SOTA — the CHEAP lever (denser transcript codec + transcript release): a real score win. Submission 1278a07 / commit 674d0d8 (nasqret, promoted 2026-06-13) is the first verified sub-1175 score win: 1170 q, average Toffoli 1,434,998.727 (rounded 1,434,999), score 1,678,948,830, nonce 11,156,415. It beats the 1185 SOTA's 1,681,025,595 despite spending more Toffoli, because the qubit cut is cheap enough. Relative to q1185 it cut −15 qubits for only +16,412 avg-Toffoli (~1,094 T/qubit, UNDER the ~1,200 break-even), so the product dropped. Composition vs 1185 (637 + 512 + 36): it took −7 from the persistent transcript (637→630) and −8 from the transient (36→28). The −7 floor cut is the headline and the cheap part:

• Denser tail transcript codec (DIALOG_GCD_K5_TAIL3_TOP32_CODEC=1 + ..._TAIL3_TOP32_STREAM_APPLY=1) — a tail-specific re-encode for the final 3-step K5 tail. The reachable support has exactly 32 patterns and is packed into 5 code bits via an ANF encoder/decoder (DIALOG_GCD_K5_TAIL3_TOP32_SUPPORT, *_ENCODER_ANF, *_DECODER_ANF). The shipped self-test (DIALOG_GCD_K5_TAIL3_TOP32_SELFTEST) proves bijection/coverage and phase-clean forward/reverse behavior. This is a value-exact width cut, not a nonce-side approximation.
• Streaming tail apply (DIALOG_GCD_K5_TAIL3_TOP32_STREAM_APPLY=1) — do not materialize the old raw tail during apply. Recompute only the current slot's (b0, b0_and_b1, s2), run the apply primitive, then clear that slot. Verified ablation: turning off streaming while keeping the new codec raises the GCD/apply/fold plateau 1170→1171.
• Codec itself is the large GCD/apply cut. Verified ablation: disabling the new top32 codec (and its streaming apply) raises the GCD/apply/fold plateau 1170→1177, while the square remains at 1170. The codec therefore accounts for about seven GCD-side peak qubits, and the streamed apply accounts for the last one.
• Transcript-bit release (DIALOG_GCD_K5_PARTIAL_RAW_RELEASE=6, DIALOG_GCD_K5_RELEASE_SCALE_BITS=5, DIALOG_GCD_RUNWAY_PARTIAL_BLOCK=1) — free/host transcript bits no longer needed in full.
• Its −8 transient came cheaply too: APPLY_CHUNKED_F_BLOCKS 18→20 with explicit cuts 17,34,50,66,81,96,110,124,137,150,163,175,187,198,209,219,229,238,247, deeper park (FOLD_PARK 15 with per-step 16/17 map, SPECIAL_FOLD_PARK 13 with per-step 14/15 map), FOLD_HOST_DERIVED_CONTROLS=1, and APPLY_BORROW_FUTURE_BOUNDARY_CARRIES=1 — not the expensive dirty-qoffset hosting.
• Selective repair inside the same peak budget. The route keeps global DIALOG_GCD_COMPARE_BITS=46 but adds seven 48-bit compare repairs (181,194,199,202,207,212,216). Regular and special pseudo-Mersenne folds keep aggressive global windows (FOLD_CARRY_TRUNC_W=18, SPECIAL_FOLD_PARK_LOW_CARRIES=13) and widen only empirically failing steps to 19/20 bits via *_STEP_WINDOWS. Special overflow/underflow cleanup uses existing clean scratch for hosted phase-conditioned comparison, so repairs restore correctness without adding global scratch.
• Square must be co-balanced. The q1170 GCD side alone is not enough: the final route also sets SQUARE_ROW_MAX_SEG=143 and square-row measured cleanup schedules. Verified ablation: reverting just SQUARE_ROW_MAX_SEG to the old q1185-ish 158 makes the square bind at 1185 while the GCD side stays at 1170. The final trace is a deliberate co-binder plateau: apply add/sub ripple, apply final ripple, compressed apply double/halve, special over/underflow fold, and square forward/inverse all hit exactly 1170.

Decisive lesson — match the lever to its exchange rate:

route	what it cut	−q	+avg-T	T/qubit	score
q1175 (757e6e7)	transient only, via DIRTY-qubit hosting	10	+127k	~12,700 (~10× b/e)	worse (1,816M)
q1170 (674d0d8)	persistent transcript −7 + cheap transient −8	15	+16k	~1,094 (under b/e)	better (1,679M)

Attacking the persistent transcript with a denser/streamed codec is the CHEAP qubit lever; attacking the transient with dirty-qubit hosting is the EXPENSIVE one. Reach for the transcript codec first when you want a score win, not just a qubit record. This also corrects the old "transcript is near-incompressible / route is at its qubit floor" conclusion: a tail-specific codec plus raw/scale-bit release (not pure entropy/VLC coding — which is why a VLC-only analysis missed it) found 7 more transcript qubits at a good rate. The floor is reducible; the lever is the codec, not entropy coding.

Method behind q1170 (from the public submission note plus the committed memory/2026-06-13-q1192-*.md search note): exact GPU/WMI island filters were cross-checked against Rust/Metal/CUDA parity before large search, then the final nonce was replayed through the trusted 9024-shot evaluator at 0/0/0. Preserve this discipline for future sub-1170 work: codec self-test first, peak ablations second, local/remote validator parity third, island hunt last.

q1170 floor since 1278a07 — value-exact stacking + budgeted per-site repairs (current SOTA 65e8bcb, 1,677,861,900, nasqret, 2026-06-14). The 1170 peak held; the score dropped further via value-exact cuts at fixed peak (verified from ecdsafail submissions --all + notes; see references/frontier-1211-to-1170.md, notes archived in references/submission-notes/):

• 6dd61c5 (1,678,629,420): SQUARE_ROW_WINDOW_CLEAN_COMPARE_BITS 19→18 — the round-84 square windowed boundary-carry cleanup comparator. Value-exact (the square product is always exact; only a boundary carry is governed), −372 emitted Toffoli, peak-neutral; soft class SquareCleanupMismatch.
• dc6724b (1,678,360,320): stacks that with DIALOG_GCD_APPLY_CLEAN_COMPARE_BITS 20→19 (−506 T). The two cut disjoint op-stream regions with independent soft-mismatch classes (SquareCleanupMismatch vs ApplyCleanupMismatch), so a single DIALOG_TAIL_NONCE clean under both captures both. General method: sweep for undeployed value-exact cuts, prove region-independence, then hunt one nonce clean for all.
• 65e8bcb (current SOTA, 1,677,861,900): swaps the tail codec for the affine299 reachable-support mapping and replaces global widening with budgeted per-site repairs — an execution-weighted 0-1 knapsack selects 17 one-bit fold-width repairs (each paired with its carry-parking width); a grouped phase-cleanup optimizer selects sparse overflow/underflow/square repairs under an 80-emitted-Toffoli budget. This generalizes 1278a07's hand-picked 48-bit compare repairs into an optimizer over the per-site repair set.
• Status: value-exact comparator headroom at the 1170 floor is now reported exhausted (the 9-way peak co-bind). Further score gains need a structural sub-1170 cut (open research) or the avg-Toffoli rounding lottery — so prioritize the persistent-transcript floor (codec) and square co-bind over more comparator nonce-hunting.

The 1168 Wall Broke — trailmix_ludicrous Is the New Base (2026-06-19)

The structural sub-1170 cut the bullet above called for arrived as a circuit-family change, not a knob. On 2026-06-19 tob-joe (Trail of Bits) submitted bdb1d22 — a complete revamp porting trailmix's product-min "ludicrous" point onto B (new module src/point_add/trailmix_ludicrous/, build() now calls build_trailmix_ludicrous_ops()). It landed 1167q × 1,422,591 = 1,660,163,697, and a swarm drove it to 1163q × 1,412,402 (b310de9) in ~15h, then a second burst (Karatsuba square + NAF recoding + a qubit↔Toffoli bifurcation that then resolved into best-of-both, d11bdbb 1159q × 1,380,711), a third Toffoli-grind wave (f8e215b 1159q × 1,378,242), a fourth wave headlined by empirical dead-CCX elimination (20b9a1d 1159q × 1,364,380), a fifth step re-applying the 1156q clamp on the matured base (27d4627 1156q × 1,365,960), and a sixth adding iterated (two-pass) dead-CCX (da51a48 1153q × 1,368,487), and a seventh breaking the 1153 floor value-exactly to the current SOTA 1152q × 1,364,230 = 1,571,592,960 (d44cad3/ 71f5115, BitWonka, 6/26, §2.14): it pivots the base from empirical dead-CCX to structural-dead skipping (provable, value-exact — 6dafa07) then frees the single carry qubit that owned the 1153 peak (the FFG cy0 carry during the square suffix, free-and-recomputed since f[0]=1 ⇒ cy0 = ctrl ∧ ¬final_a0) + value-exact coord-path cuts. The SOTA is now CLEAN — no island-overfit .idx. This supersedes the dialog-GCD 1168/1170 route as the base to fork from. Full analysis: references/REPORT_1168_wall_revamp.md (§2.6–§2.14). (Separately, the low-qubit Shrunken-PZ track reached an 851→829q analysis-oracle witness — ~400–500M Toffoli, rejected [phone]% — see references/SHRUNKEN_PZ_q948_track.md §8–§9.)

The (Q,T) Pareto-frontier push: 1153q → 1133q clean basis (objective 3, value-exact)

A separate deliberate effort maps the value-exact (qubits, Toffoli) Pareto frontier below the 1153 SOTA as a sequence of clean, dead-CCX-free basis circuits (objective 3 — the useful corner where both Q and T beat the published single point-addition estimate: ≤1175q / ~2.69M Toffoli (2²¹·³⁶, Babbush space-opt via Schrottenloher 2026 Table 1, arXiv:2606.02235; NOT the full-ECDLP ≤1200q/≤90M Toffoli, which is the whole Shor run); every rung here clears both axes with ~2× Toffoli to spare). These are "rejected" on the Q×T product by construction — do not judge them by the score. Frontier: da51a48 (1153) → 3e3966b (1147) → e64cdfd (1146) → 48e6c23 (1143) → 0cbc2d7 (1142) → 370fc31 (1141) → 765ef38 (1133 × 1,460,511). The cheap qubits come from fold-vent clamping (TLM_FOLD_CALL_CODE_OVERRIDES); the medium ones from no-ancilla / dirty-borrow substitution and constant-lane loan+recompute (TLM_DIRTY_BODY_*_NOANC, TLM_LOAN_ODD_U0/EVEN_V0/GCD_Y0); the deep tail (new at 1133) from GCD active-width trimming (TLM_GCD_ACTIVE_WIDTH_TRIM=3/_AFTER=205 — per-step dynamic operand-width shrink of the post-205 convergence tail) plus fold-cout dropping, borrow-cin folds/comparators, and comparator carry narrowing (TLM_CMP_CARRY_K_DELTA=-6). 1133 is a value-exact repair of an over-aggressive 1131 (over-trimmed active width → no clean island; gave back 2q). Also introduced (flag-gated, unused by 1133): compact.rs reset-bounded qubit-id compaction — interval-colors temp lifetimes after resets/HMRs to minimize max qubit-id (the scored width), a reusable general lever. Full analysis: references/pareto-frontier-push.md. Next-qubit hunt (1133→1132 cy0/u[0] lever EXHAUSTED on this base; fold consumer has free_pool=0): memory ecdsafail-q1133-resident-cyl0-hunt.md.

BitWonka's q1152 — recompute-to-free a held carry + off-peak vents (current SOTA 71f5115/d44cad3, 2026-06-26)

The 1153 base matured then broke 1152: jieyilong da51a48 (1153 × 1,368,487, empirical dead-CCX .idx) → BitWonka b795827 (= commit 6dafa07, 1153 × 1,367,698, 6/25 — the value-exact pivot: REMOVES the empirical dead-CCX entirely and replaces it with comprehensive structural-dead skipping — ~15 knobs TLM_{FFG,CUCCARO,COMPARE,GIDNEY,CONST_CHUNK,FUSED,ADD_CONST,GCD}_SKIP_STRUCTURAL_DEAD_* / _SKIP_EXACT_REMAINDER, dropping CCX provably dead by the arithmetic (top +f carries, exact-remainder no-ops) rather than by an input screen; provably sound AND lower-Toffoli than the .idx it replaced — so the SOTA is now CLEAN, no island-overfit) → BitWonka 71f5115 (commit d44cad3, 1152 × 1,364,230 = 1,571,592,960, avg-exec Toffoli 1,364,229.770, 0/0/0 at nonce 50400005525597, 6/26) = current SOTA. The diff (git diff d44cad3~1 d44cad3) is small — mod.rs +11, arith.rs +223, ec_add.rs +142 — and the mod.rs comment credits "codex FFG cy0-release + opus square vents" (AI-assisted multi-knob search). Pull it with ecdsafail reset 71f5115.

⭐ THE QUBIT LEVER (1153→1152) — recompute-to-free a held carry, NOT free a dead one. This is the generalizable lesson and it corrects a wrong "no qubit left" conclusion that a dead-qubit liveness probe will produce. At the tight 1152/1153 peak a probe that searches for dead qubits (held but never used again) finds NONE — every live qubit holds a needed value, so live-range shortening looks impossible. The win comes from a different question: which held qubit's VALUE is a cheap function of other LIVE qubits, so it can be cleared, its lane loaned out, and recomputed later? In add_f_window_hybrid the first prefix carry cy0 = ctrl & a0_original; because the pseudo-Mersenne constant has f[0]=1, bit-0's sum flips a0, so cy0 = ctrl & !final_a0 is recoverable from the live final a0. So (env TLM_FFG_RELEASE_CY0_DURING_SUFFIX=1, ONLY for the 40 peak-binding folds TLM_FFG_RELEASE_CY0_CALLS=178..239):

1. clear cy0 → 0: x(a0); ccx(ctrl, a0, cy0); x(a0),
2. loan_zero_qubit(cy0) — the freed lane hosts the fold's suffix carries → peak −1,
3. run the suffix, then reclaim_zero_qubit(cy0) + recompute cy0 before the prefix-reverse consumes it. Cost ~+4 CCX/fold (conditional, near-free). METHOD: when a liveness/dead-qubit scan says "no idle qubit," do NOT conclude the floor is structural — re-ask "is any held value a cheap function of the live qubits?" A clear+loan+recompute (the standard compute-uncompute-on-a-value, applied to free a lane mid-block) beats the dead-qubit search. Target the exact phases that bind the peak (a TRACE_ALLOC_NEAR_PEAK=<peak> binding-alloc census names them; here it was 40 folds).

The Toffoli levers (−3,468 vs b795827), all approximation/fusion/vent on OFF-PEAK coord+square ops:

• square-reduce mod_sub measurement-vent (add_cout_vented_skip_dead, ~−838 avg-T): the square runs far below the GCD-apply peak, so its register sub's reverse-carry Toffolis are vented to X-basis-measure + CZ (each live carry = −1 Toffoli), capped to headroom by SQUARE_PEAK_HARD_CAP=1152 / TLM_SQUARE_VENT_MARGIN. Also skips the dead carries the cuccaro guard would (captures both savings at once).
• coord_rsub fusion (mod_rsub_vented_loaded, env TLM_COORD_RSUB_FUSED=1, ~−248 avg-T): rewrite ox − x as ~x + (ox+1) mod 2^256, with ox+1 precomputed on the free classical BitId tier (0 Toffoli). Replaces the two-chain mod_sub_vented + mod_neg, deleting the unconditional ~254-CCX negate.
• coord_add3x MSBS-truncation (env TLM_COORD_ADD3X_TRUNC=1, ~−116 avg-T): use MSBS-truncated mod_add (the same ~2^-PAD approximation the coord-subs already ship) instead of mod_add_exact.
• new reusable helpers in arith.rs: add_cout_vented_unctrl_bounded (headroom-capped vented add+cout) and add_cout_vented_skip_dead. cy0-release uses loan_zero_qubit/reclaim_zero_qubit.

To push below 1,364,230 (each reseeds the FS nonce → needs a fresh 0/0/0 hunt, like merge25): vent OTHER un-vented OFF-PEAK cuccaro_carry adds via add_cout_vented_unctrl_bounded (square build_sum_hi_lo/unbuild_sum_hi_lo etc. — verify value-exactness first; a naive drop-in broke 9024/9024 shots, so the addend-restore/cout convention must match), MSBS-truncate more exact adds, fuse more op-pairs, or apply the cy0 recompute-to-free trick to a SECOND held carry. Peak 1152 is a WIDE co-bind floor (register adds gidney.rs:1217, the fold, the fused fold, the comparator all bind 1152), so qubit→1151 needs ALL dropped together — score wins here are Toffoli, not the next qubit. Score margin: avg < 1,364,229.5 already wins (rounds to 1,364,229 → 1,571,591,808). Full pull/analysis in memory ecdsafail-bitwonka-1152-design.

Module map (src/point_add/trailmix_ludicrous/, fork from here). mod.rs = build_trailmix_ludicrous_ops() (register alloc order pins fuzzer IO ids), load_schedule() (copies the baked tables into a thread-local Sched with per-call cursors), and the BExt trait that adds z/ccz/neg/cswap/x_if_bit/z_if_bit/cz_if_bit to the B builder. ec_add.rs = the affine point-add formula. gcd.rs = the jump-GCD inversion engine (the heart). codec.rs = the dialog-tape codec. gidney.rs = the vented-adder zoo. arith.rs = Cuccaro add/sub + pseudo-Mersenne reduction + the truncation constants (f, PAD, LSBS, MSBS, CEILING). comparator.rs = truncated top-window swap comparator. square.rs = symmetric schoolbook square. fused.rs = fused double+cdouble and the (e+2d)·f fold. mcx.rs = Khattar–Gidney log*-ancilla MCX. schedule.rs = the baked per-call tables.

Register layout (mod.rs). Four 256-bit IO regs, alloc order fixes the ids: reg0 x2 (quantum P.x→R.x), reg1 y2 (quantum P.y→R.y), reg2 ox (classical BitId Q.x), reg3 oy (classical BitId Q.y). After ec_add, route_swaps restores the scattered R.x qubits to the reg0 ids; DIALOG_TAIL_NONCE appends 48 identity X;X pairs for island grinding (score-neutral).

Why it fits under 1168 — three structural decisions:

1. Classical Q (−512q, the decisive lever). ox/oy are classical BitIds, materialized into a transient quantum temp only at off-peak coord steps — never resident across the GCD peak. A naive design holding both as quantum registers adds 512 live qubits at the peak. The coord steps (coord_addsub/coord_add3x/coord_rsub in ec_add.rs) alloc a 256-bit temp, x_if_bit-load the classical coord (0 Toffoli), run an uncontrolled pseudo-Mersenne mod_add/mod_sub, x_if_bit-unload (clean — temp was never modified), and free. The GCD apply's own 256-bit scratch is alloc'd/freed inside mod_mul_inverse_in_place, so it's never resident across the square either.
2. Two GCD passes share one inversion primitive. The full affine law (ec_add::ec_add): x2-=ox (dx) → y2-=oy (dy) → y2 *= x2⁻¹ (GCD pass #1, Direction::Inverse → y2=λ, x2 restored to dx) → x2 += 3·ox (coord_add3x does it as coord+2·coord, one fewer mod-add) → x2 -= λ² (fused square-subtract) → y2 *= x2 (GCD pass #2, Direction::Forward → y2=λ·x2) → y2 -= oy → x2 := ox − x2 (zero-Toffoli negate ox−x2 = −(x2−ox): load, subtract, free, then mod_neg = const-add of f−1). λ is produced by the inversion itself — no separate field-inverse then multiply. Both passes call the same mod_mul_inverse_in_place (jump=2, 258 steps).
3. Live-compressed dialog tape. A SAT-synthesized all-triple base-5 codec packs each 3-symbol (subtracted, swap, s_2) window into a 7-bit code (5/8 patterns reachable, log2(5³)≈6.97), streamed inline → resident tape 603q vs 772 raw. Peak owner = the forward-multiply apply (≈512 coord + 603 tape + early-width GCD state + vent ancilla); CEILING=1167 is baked and every adder vents to exactly CEILING − active via 0-Toffoli MBU (hmr + cz_if).

The inversion engine (gcd.rs) — read this before forking. mod_mul_inverse_in_place = two passes sharing one tape: forward_gcd_jump (records) + reverse_gcd_jump (replays, restores x). Registers: u init q = 2^256 − f (q_secp256k1_le), v init the input x; classical jump-before-swap divstep on (u=q, v=x). Per step it records the 3-bit symbol (subtracted, swap, s_2) + one global t1 first-shift bit: shift-first (step 0 gates on v even, records t1; steps ≥1 shift unconditionally; s_2 = second jump shift), subtracted = v[0] post-shift, swap from the narrow comparator (controlled_swap_decision_lt_truncated), then cswap(swap,u,v) + active-width v −= subtracted·u (controlled_add_active). Kaliski odd-u bit-0 shortcut: u[0]==1 by invariant ⇒ bit-0 carry-out is provably 0 ⇒ emit cx(ctrl,y[0]) directly, run the capped adder on bits 1.. with carry-in 0 (~1000+ Toffoli saved over both passes). The forward pass swaps the live symbol bits into fresh |0> slots and compresses each window inline; the reverse pass decompresses one window at a time from the tape end, frees the 3 symbol slots before the apply (so they don't inflate the peak), does the fused forward apply, then exactly inverts the divstep — using the vented swap-flag uncompute (swap_decision_uncompute_vented, ~half the comparator Toffoli). The apply step: if sub: y+=x, if swap: cswap(x,y), then y := 2(1+s_2)·y (step 0 = two gated mod_doubles; step

0 = the fused fused_double_cdouble with one combined (e+2d)·f reduction). f = 2^32+977, bits {0,4,6,7,8,9,32}.

The qubit floor = the GCD shrink/regrow width schedule (SCHED_J2, len 258: holds at 256 for ~11 steps then ramps to 13 by step 257). Each step zero_and_frees u/v qubits above the schedule width; the reverse pass re-allocs them. The whole body (comparator, cswap, subtract) runs on current_n = SCHED_J2[i] bits, so the adders run in the freed headroom. GAP_J2[i] (len 258) is the per-step comparator window. A dx whose bitlength exceeds the schedule width makes zero_and_free panic (it's rejected) — which is why the route needs a DIALOG_TAIL_NONCE grind to land all 9024 verifier draws in the schedule-supported set.

The codec (codec.rs). DialogCodec variants Step0(2b)/Triple(7b)/Pair(5b)/Raw(3b); tiling = 1 Step0 + 85 Triples + 1 Pair tail + 1 t1 = 603 resident vs 1+3·257=772 raw. compress_2sym_fast is the SAT-synthesized straight-line x/cx/ccx pairs core (25 valid 2-symbol inputs → 25 distinct 5-bit codes, frees a wire; terminal AND-uncompute vented via clear_and = 0 Toffoli). Triple = pair → affine normalizer → fold-in s_2. ~18 executed Toffoli per Triple forward after vents.

The vented-adder zoo + baked schedule tables (gidney.rs/schedule.rs) — this is the knob surface. Every adder vents carry-uncompute via Gidney MBU (hmr(carry,bit); cz_if_bit(a,b,bit) = 0 Toffoli, +1 transient qubit held only between fwd/rev carry chains; each vent = −1 Toffoli, +1 peak qubit). Adder family, dispatched per-call by GCD_BRANCH (0=plain controlled_hybrid_add_refs_impl / 1=varchunk / 2=adaptive→chunked_then_cuccaro). Baked tables, consumed in emission order — these are the per-site levers (the design reads NO live live_qubits; everything is the table + the TRAILMIX_*_DELTA overlays): GCD_SUB_K (GCD-subtract carry-cap), GCD_BRANCH (adder dispatch), APPLY_COUT_K (apply cofactor-add cap), FOLD_SCHED (fold vent: +=clean@nv / −=chunked), CMP_K (swap-comparator held carries), FFG_G (+f-fold clean-vent count), HYB_V (hybrid-adder exact vent count, verbatim), SQ_ROW_K (square row-add headroom). The b310de9 overlay deltas (TLM_HYB_V_DELTA/TLM_COUT_K_DELTA/TLM_FFG_DELTA/TLM_FOLD_DELTA) subtract from these per-call to trade vents↔qubits at the peak; TLM_GCD_K_ADJUST{,_AFTER,_BEFORE} window-trims GCD_SUB_K in a divstep range.

The deliberate truncations (arith.rs). f=2^32+977, PAD (was 21, now 19/arith, 20/schedule). Low-LSBS=PAD+F_BITLEN-bit +f fold drops carry beyond bit LSBS−1 (~2^-PAD/fire miss); narrow-MSBS=PAD-bit overflow/swap comparators recompute the top predicate as a deferred-Z only where the HMR bit fired, tolerating a ~2^-PAD/fire mis-decide. Safe because each is an independent rare divergence and the common path is exact; DIALOG_TAIL_NONCE grinds inputs so all 9024 draws stay clean. PAD is a live lever in both directions (smaller = fewer live bits and fewer Toffoli, but higher miss rate to absorb in the nonce hunt).

The 1167→SOTA cascade splits into these reusable lever families (the rest is LF↔CRLF churn + pure nonce-grind commits — see report):

• 3 free −1q peak drops (ab1b2d6, cea9f5f, f8d23a9; 1167→1164), all the same idea: don't hold provably-constant divstep low bits live — park/loan them back to the free pool across the adder that needs the headroom (Toffoli ≈ neutral). odd-u0=1 (TLM_PARK_ODD_U0/TLM_LOAN_ODD_U0), even-v0=0 (TLM_PARK_EVEN_V0), known gcd-y0 (TLM_LOAN_GCD_Y0, with GcdBit0Mode delaying the bit-0 CNOT), and the redundant step-0 swap_flag (fold t1 in via ccx(t1,s2,sub)). One open qubit lever: mine the divstep for more provably-constant lanes to park.
• Paid −1q drops (b310de9 1164→1163; 31421df 1164→1162; fed64cf 1162→1159): the qubit↔Toffoli exchange rate run in reverse. These do NOT find new constant lanes — they buy peak qubits by spending Toffoli. Three mechanisms: (a) surrender apply-phase vents (TLM_HYB_V_DELTA, TLM_COUT_K_DELTA, TLM_FFG_DELTA, TLM_FOLD_DELTA — each removed vent reverts a 0-Toffoli MBU to a real CCX); (b) tighten PAD 21→20/19 (narrower +f-fold/comparator windows = fewer live bits and fewer Toffoli, higher 2^-PAD/fire miss) + maybe_adjust_gcd_k (TLM_GCD_K_ADJUST=-1 over a divstep window narrows the GCD carry-chunk); (c) the dynamic live-headroom clamp (fed64cf): target_qubit_headroom = TLM_TARGET_Q − active_qubits clamps EVERY transient adder's carry/chunk to min(scheduled_k, headroom) so no local peak exceeds the target — a circuit-wide "do not exceed N qubits" governor (TLM_TARGET_Q, TLM_TARGET_FFG_RESERVE, TLM_TARGET_FOLD_RESERVE, TLM_GCD_RESELECT_LAYOUT, TLM_DIRECT_VARCHUNK). Lowering the TLM_TARGET_Q ceiling is the trigger, but it only fits if you also FREE the lanes it needs — the enabling lane-freeing levers are the reusable part: (a) drop the fold-chunk carry-in entirely when chunk-0's cin is provably 0 — TLM_FOLD_CHUNK_ZERO_CIN=1 skips cin0 allocation and erases the boundary carry via a zero-cin path (fold_boundary_erase_zero_direct / erase_carry_gated_zero_cin_opt); the lazy variant TLM_FOLD_CHUNK_LAZY_CIN0 allocs it only inside the boundary-erase (defers liveness); (b) cap the FFG fold clean-vent count TLM_FFG_MAX_G (fewer transient vent qubits at the peak); (c) per-call FFG reserve overrides (TLM_TARGET_FFG_CALL_RESERVE_DELTAS/OVERRIDES). Worked examples: 6ba606a 1159→1157 (TLM_TARGET_Q−2 + lazy-cin0 + reserves); 56c3746 1156→1153 (TLM_TARGET_Q 1156→1152 + TLM_FOLD_CHUNK_ZERO_CIN=1 + TLM_FFG_MAX_G=47, via install_q1153_submission_defaults()). ⚠ The clamp+lane-freeing is qubit-only and COSTS Toffoli (tighter chunks = more carries); it only wins once the break-even below is cleared by a stacked Toffoli lever.
• ⭐ The break-even rule (the meta-lever) — and its cost is PER-BASE, not fixed. A peak qubit is worth avg_Toffoli / peak_qubits Toffoli (≈1,190 at the 1159q floor). A width-narrowing lever is net-positive only if it removes a qubit for < that many Toffoli. But the realized cost moves with the base: fed64cf's clamp-to-1159 cost ~1,514 Toffoli/qubit on the expensive schoolbook-square base (> break-even) and LOST to 3df690f (which floated to 1164q) — yet once 28fe2f2's Karatsuba removed the wide square adds the clamp was fighting, the same clamp cost only ~20 Toffoli/qubit and d11bdbb re-stacked it to WIN at 1159q × 1,380,711 (SOTA, best-of-both). The frontier bifurcated (1159q vs 1164q) then resolved — the qubit and Toffoli levers compose; they're rarely truly opposed. ⇒ After any structural arithmetic change, RE-TEST every shelved qubit lever — the break-even moved. Always divide a candidate's realized Toffoli-delta by its qubit-delta vs the current T_avg/q. The product-race trap is real but NOT permanent — "lost" means "early," not "wrong." 6ba606a (1157q) and cde752d (1156q) both cleared per-base break-even yet lost the SOTA at the time, because the 1159q Toffoli-grind was falling faster. But once the Toffoli base matured to the dead-CCX 1,364,380 floor, the very same 1156q clamp returned as SOTA (27d4627, ~527 Toffoli/qubit — 1156×1,365,960 < 1159×1,364,380). Lesson: run both tracks, compare products, and RE-TEST every shelved width drop after each Toffoli win — the break-even keeps moving in their favor. The qubit floor and Toffoli floor descend in lock-step, each unlocking the other. See references/REPORT_1168_wall_revamp.md §2.6–§2.10.
• ⭐ Biggest Toffoli wins = better arithmetic at the dominant cost-center (huge leverage from tiny diffs). 28fe2f2 Karatsuba modular square (−22.4M, the single biggest win in the saga, +175/−47 diff): split λ = hi·2^128 + lo, compute lo², hi², (lo+hi)², recombine — 3 n=128 squares (~24.4k CCX) vs 1 n=256 schoolbook (~32.6k CCX), ~25% off the O(n²) cross-products that run every divstep round. 4ea8b74 NAF recoding of f=2^32+977 (F_NAF_TERMS: 7→5 terms 2^32+2^10−2^6+2^4+1) + doubling-ramp elimination (mod_add_shifted_low/mod_sub_shifted_low, no pad qubits). e25c7d8/3df690f hoist <<32/all NAF terms to direct shifted adds (TLM_SQUARE_F_SHIFTED_LOW). Lesson: audit any O(n²) or ×258×2 primitive (the square, the reduction) for a structural improvement before touching schedule knobs — BUT only if the new ops are as cheap as the ones removed (see the next bullet).
• ❌ Recursive Karatsuba / Toom-3 on the square: TESTED, net Toffoli LOSS — do NOT re-attempt (measured 2026-06-21, §2.9). 4a90d04's kara_square_into_prod scaffolding (TLM_SQUARE_KARA2, identity x²=A+M·2^h+B·2^2h) had a width bug (unbuild_kara_sum panicked); after fixing it and enabling recursion, the square's CCX went UP 117,016→177,180 (+60,164 from one split), worse at every depth (th96 +66.8k → th32 +277k total), and it leaked the three-product live set raising peak 1159→1612. Root cause — the win does NOT transfer to this reversible cost model: the schoolbook symmetric square's cross-products are already ~1 vented CCX each (MBU), while Karatsuba trades them for un-vented wide recombination adds (hybrid_add_adaptive, ~3 CCX/bit) that cost far more than the multiplies they remove. Toom-3 is strictly worse (5 eval points + /3 interpolation, all un-vented). The square is only 8.14% of CCX with 647q off-peak slack, so the qubit room exists — but the arithmetic is already near-optimal; the live levers (dead-CCX, vents, comparator narrowing) win precisely because there's no cheap arithmetic left to restructure. (To ever make Karatsuba pay here you'd have to re-engineer the recombination adds to be MBU-vented AND recurse to deep leaves AND fix the leak — high effort, sub-2% ceiling. Not worth it.)
• ⭐ Density-neutral value-exact primitive swaps — the SAFE Toffoli lever, but the vein is EXHAUSTED and the big one is already in the SOTA (2f8835b/§2.11–§2.12). Replace an expensive exact primitive with a Boolean-identical cheaper one: TLM_FOLD_TAIL_CINC ("cinc") swaps the clean-tail fold's quadratic mcx_clean_k prefix cascade (fused.rs:86) for one Khattar–Gidney controlled-increment (cinc_khattar_gidney, log*-ancilla), measured −5,340 avgT. It is value-exact + density-neutral (preserves the GCD-clean near-zero-error island tail — a GPU 1M pilot confirmed the folds keep a healthy distribution while the dead-CCX subset was what inflated errors), so it does NOT degrade nonce-hunting. BUT: TLM_FOLD_TAIL_CINC=1 is already set in the SOTA da51a48 (mod.rs:1092,2153) — cinc is SPENT, already inside the 1,368,487. Do NOT "stack" it again (that was a 6/23 double-counting error, §2.12). An exhaustive parallel hunt found exactly ONE un-shipped survivor — merge25 (codec diamond → symmetric clean MCX, −170 avgT, marginal; stacking it needs a dead-CCX re-screen + re-hunt). The density-neutral vein is closed; it cannot move the SOTA further — the live levers are structural or dead-CCX (§2.8). Methodology lesson: before crediting a lever as a stackable Δ, grep the ship config to confirm the knob isn't already on there; never measure a lever on a different base than you'll ship from. (Source caveats: TLM_CODEC_DIAMOND_MCX is set but never read — inert; SINGLE_CCX_FANOUT_DISABLE is a stream-matching choice, not a Toffoli lever. And DIALOG_TAIL_NONCE is NOT a no-op on the current build — sha256-verified across configs; the prior "nonce is dead" was an old-tree set_var-pin bug, fixed at HEAD, mod.rs:369-371.)
• ⭐⭐ Empirical / dynamic dead-CCX elimination — biggest avg-T lever, but a SCORE lever, not a DESIGN lever (4a90d04/20b9a1d). Beyond static constprop.rs: a bit-sliced finder reproduces the Simulator's per-shot eval and records, per CCX, the OR of its fired mask. A CCX whose target never flips on the reachable EC-point distribution (its two controls are dynamically mutually-exclusive — static constprop can't prove it) is inert-but-charged (costs avg-executed Toffoli, does nothing). Drop those by post-fanout op-index via a baked .idx → build() does include_str!(...idx) → HashSet → ops.filter, after constprop + single_ccx_fanout. The false-positive defense is the heart of it: a single 9024-shot pass over-flags ~49k (most only coincidentally idle on one draw); intersect "never-fired" across 1024 independent random shot sets (~9.2M inputs) → the set shrinks monotone-nested (V1024 ⊆ V512 ⊆ …) to a robust core. Sizing the screen ≫ the 9024 verifier draw pushes the residual false-positive firing-rate below the verifier's resolution. Then hunt DIALOG_TAIL_NONCE WITH the drop applied (self-consistent fixed point) and check action-neutrality across many nonces. Caveats that matter: (1) distribution/island-exact, NOT all-inputs value-exact — "clean on its island," not correct off-island; (2) absolute-position fragile / circuit-specific — any structural change shifts the indices onto live gates (→ the 9024/141/141 all-shots break) and forces a full re-screen; the lists are literally per-variant (dead_k1_coord3x.idx vs dead_k1_nocoord3x.idx); (3) it does not improve the construction (a better circuit wouldn't emit these gates) and a clean-room build gains nothing from the .idx. Peak-neutral, open-ended (bigger screen finds more) — but treat it like a sophisticated nonce grind: it's why SOTA avg-T looks ~1.36M, but the durable wins are the structural levers. It is also ITERABLE (da51a48, the 1153q SOTA): drop the first list, then re-screen the ALREADY-DROPPED stream over fresh FS sets and drop again — the first removal reshapes the stream so a second pass (DROP_DEAD_ROBUST_SECOND, drop_dead_second_fs512.idx, 2,638 ops on top of the first 13,880) finds newly-dead gates; the marginal second pass is exactly what carried the 1153 rung over break-even. Each pass is subset-monotone and re-hunted. Operational how-to (the BitWonka find_dead_ccx screener + the distributed multi-host scan helper): see the "Dead-CCX / Dead-CXX Screening" section below. ⚠ SUPERSEDED at the 6/26 SOTA (§2.14): the empirical .idx dead-CCX was REMOVED and replaced by structural-dead skipping (next bullet) — provable, value-exact, no re-screen, and lower Toffoli. Prefer structural-dead; the empirical screen is now a fallback for gates structure can't prove.
• ⭐⭐ Structural-dead skipping — the value-exact replacement for empirical dead-CCX (6dafa07, the 6/26 SOTA base, §2.14). Skip CCX that are dead by the circuit's arithmetic structure, not by an input-distribution screen: the top +f-fold carry bits (29/30/31) that are structurally zero given the pseudo-Mersenne operand widths (TLM_FFG_SKIP_TOP_CARRY31/_30, ..._INVERSE_MOD_SUB_TOP29, predicate ffg_call_has_structurally_dead_hybrid_carry, arith.rs:217), exact-remainder no-op branches, and baked (call,bit)-keyed dead ranges (FFG_DEAD_HYBRID_CARRY_RANGES, TLM_{FFG,CUCCARO,COMPARE,GIDNEY}_SKIP_STRUCTURAL_DEAD_CALLS/_EXACT_REMAINDER). Keyed by structure (call,bit), not by sampled inputs — so input-independent: no island-overfit, no per-restructure re-screen — yet it came in lower Toffoli than the empirical drop it replaced. The named predicates (top-carry/exact-remainder) are value-exact by construction; the baked dead-range tables are structurally keyed but unaudited for derivation (both are still only validated by island 0/0/0 — the win is that the derivation is structural, not sampled). The cleaner dominant lever: derive the dead set from the arithmetic instead of simulating for it.
• ⭐⭐ Peak-break = free-and-recompute the EXACT carry that owns the peak (d44cad3, 1153→1152, §2.14). TRACE_PEAK the binder, find the single ancilla pinning it, prove it's recomputable from live wires, free it where it's idle, recompute it after. Here the 1153 peak was owned by the FFG cy0 carry held live across the square gate-suffix; because f[0]=1, cy0 = ctrl ∧ ¬final_a0 is exactly recoverable, so loan_zero_qubit(cy0) frees it for the suffix (where it's idle) and reclaim+recompute restores it (arith.rs:1330-1369, TLM_FFG_RELEASE_CY0_DURING_SUFFIX gated to the ~40 peak-binding calls). Pair it with a cap (TLM_SQUARE_PEAK_CAP=1152, lowering SQUARE_PEAK_HARD_CAP=1153) so a later phase's venting can't re-grab the freed lane — without the cap the peak rebinds. This is benhuang Lever A aimed at the precise floor-owning lane; the open next rung (1151) is the next such carry. Companion value-exact Toffoli cuts on the coord path: TLM_COORD_RSUB_FUSED (fused single-chain ox−x = ¬x+(ox+1), ~−248 avgT), TLM_COORD_ADD3X_TRUNC (MSBS-truncated add), TLM_SQUARE_VENT_SHIFTED
  • TLM_SQUARE_VENT_MARGIN=0.
• ⭐ Comparator-width (GAP_J2) narrowing — the highest-leverage static Toffoli lever per line of diff. f0c1c42 (bket7) cut −1.33M from a 22-line schedule-table edit. GAP_J2[i] (schedule.rs, len 258) is the per-step swap-decision comparator window width for the jump=2 GCD; gcd.rs sets cmp_eff = GAP_J2[i].min(current_n) and the held Gidney carries / compared MSBs in compare_geq_chunked_middle scale with it. Shaving 1 bit/step ×258 steps ×2 GCD passes is the −1.33M. Cost: mis-decides the u↔v swap with prob ~2^-k when the top differing bit falls just below the window — an island-exact truncation recovered by the tail-nonce hunt. This is the DIALOG_GCD_FOLD_CARRY_TRUNC_W-style lever native to the ludicrous GCD; sweep it one notch at a time.
• ⭐ Converged-tail cswap elision (TLM_APPLY_CSWAP_SKIP_LASTK + the FWD/INV × FIRST/LAST family). On the first/last K GCD iters the apply cswap's swap-decision is deterministically 0 for all-but-rare inputs (the GCD has converged), so it's a no-op — skip it (apply_cswap_skip_dir in gcd.rs, 5c34dd1→9d524b7). 9af02f7 extended it to the inverse pass + first iter (TLM_APPLY_INV_FIRST_CSWAP_SKIP, also ..._FWD_LAST/..._INV_LAST/..._INV_FIRST_SUB_SKIP, −283k), and there are companion ..._S2_ZERO_LAST skips routing known-zero steps through fused_double_only. Island-exact (huntable). A structural instance of "elide a data-dependent gate known-0 on the island" — enumerate every FWD/INV × FIRST/LAST corner of the converged GCD.
• Classical-constant folding (Q is classical → do constant arithmetic for free). 662e267 rewrote coord_add3x (dst += 3·ox mod q) to derive 3·ox mod q entirely in the classical BitId domain (classical_times3_mod_q, all BitStore/BitInvert, 0 Toffoli) then one mod_add_exact — removing the doubling + 2nd mod-add + 257-bit temp (~−400 Tof/call). Audit every coord step touching the classical ox/oy for constant-folding into the bit domain. (Note: this oscillated in/out vs a peak concern — it trades Toffoli for a transient; check peak before keeping.)
• Doubling-ramp elimination in the reduction (the SOTA lever, f8e215b). The f·value mod q NAF reduction inside the Karatsuba square no longer builds a 257-bit ext and walks a mod_double ramp to each NAF shift offset; a new default branch in square.rs::apply_f_times_value_tagged applies each term ±(value≪shift) mod q directly via apply_shifted_hi_term (mod_add/sub_shifted_low + per-wrapped-bit add/sub_f_window_shifted pseudo-Mersenne folds). Value-exact, −156k. Extends the shifted-low idea (4ea8b74) to the Karatsuba reduce; audit any mod_double-ramp shift for the same.
• Carry-drop-cout + MBU vent (TLM_GRAD_FINAL_NO_COUT). Drop the unneeded final carry-out of the top constant-add chunk and uncompute the chunk's carries with hmr+cz_if_bit (0-Toffoli MBU) instead of a CCX (const_chunk_add_clean_drop_cout, arith.rs, 5c34dd1).
• Schedule-level Toffoli wins: bc2334a −5.9M (exhaustive carry-chunk layout search); 497cc20+b02b354 constprop post-pass (drop CCX with const-0 control, fold const-1→CX, + affine/XOR/inverse-pair; CONSTPROP_MAX_ITERS controls fixpoint depth — d2643bc 16→256 = −377k) — model-agnostic; b1dec1e d & !e = d ^ (e & d) 2-CX identity; a47dc6e skip-j0 cswap; LUD_EXTRA_FOLD_VENTS (more Gidney vents in GCD fold rounds, 3df690f); the *_DELTA knobs (TLM_HYB_V_DELTA/TLM_COUT_K_DELTA/TLM_FOLD_DELTA) narrow scheduled vent/cap values one more step.
• Deliberate budgeted truncation: low-(PAD+33)-bit +f fold + narrow-PAD-bit comparators accept a ~2^-PAD-per-fire miss; PAD (21↔19/20) is a live two-direction lever (smaller = fewer Toffoli + fewer live bits, more miss to absorb in the nonce hunt). GAP_J2 (above) is the same idea on the swap comparator.

Corollary — neither extreme is score-competitive; stay in the 1159–1164q band. The Shrunken-PZ low-qubit track (a separate line of work from this ludicrous route — a 530-step divstep inversion, not the jump-GCD+Karatsuba arithmetic) keeps setting qubit records that are all score-rejected: 1050q → 1019q (teddyjfpender, +~280%) → 948q (nasqret a203fac, +468%, breaking the 952q wall via a "q949 robust envelope" CLZ-conditional width packing) → 851q (e7dd3de, +3659%, via dirty-catalytic / gate-hosting / register-shared-EEA — but an explicit analysis oracle, not a circuit, 464.5M Toffoli, §8 of the PZ doc). The PZ Toffoli is ~40× the ludicrous SOTA's 1.37M, so it's a qubit-lower-bound witness, not a product contender — would need a ~33× Toffoli reduction (a different inversion, not a packing tweak) to compete. High-qubit experiments (abipalli's 2045q, +46%) lose the other way. The PZ route is its own thing — full mechanism (952→948 break + the 851q oracle) in references/SHRUNKEN_PZ_q948_track.md. The product is minimized in the 1153–1164q ludicrous band — the SOTA is the 1152q point (d44cad3, 1152q × 1,364,230 = 1,571,592,960, §2.14): the matured low-Toffoli base (GAP_J2 narrowing + converged-tail cswap elision + doubling-ramp removal), now value-exact via structural-dead skipping (which replaced the empirical iterated dead-CCX, 6dafa07), + the headroom clamp, + the FFG-cy0 peak break (free-and-recompute the carry that owned the 1153 peak). The 1157q (6ba606a), 1156q (cde752d), and first 1153q (2f8835b) drops lost the product race when they landed — but each width rung returns as SOTA once the Toffoli base gets cheap enough (1156q §2.10, 1153q §2.11, 1152q §2.14); "lost" meant "early," not "wrong" (re-test shelved width drops after each Toffoli win). And the 1153→1152 break came value-exactly — the floor did not need a dead-CCX re-hunt.

Compare-Bit Narrowing

Several low-qubit routes reduce the number of clean compare bits kept live.

Useful knobs:

• SQUARE_ROW_WINDOW_CLEAN_COMPARE_BITS=<k>
• route variants like cmp21

Observed behavior:

• Reducing compare bits can save qubits directly.
• Aggressive compare-bit reduction can make candidates uniformly dirty.
• A route with SQUARE_ROW_WINDOW_CLEAN_COMPARE_BITS=21 may be viable only when paired with enough carry/fold safety.

Triage rule:

• If a compare-bit route yields repeated high triples like 9024 / 141 / 0 or hundreds of cls / pha, stop quickly.

Carry/Borrow Truncation

Carry and borrow chains are large qubit consumers. Truncating or narrowing them is one of the main qubit/Toffoli tradeoff levers.

Useful knobs:

• DIALOG_GCD_FOLD_CARRY_TRUNC_W=<w>
• KAL_FOLD_CARRY_TRUNC_W=<w>
• DIALOG_GCD_FOLD_FREED_TAIL_ED=1
• DIALOG_GCD_SPECIAL_FOLD_BORROW_CARRIES=1

Observed behavior:

• Wider truncation windows are safer but cost qubits.
• Narrower windows can reach lower qubits, but correctness degrades quickly.
• Special fold-borrow carry handling helped low-qubit 1210-style routes remain near-miss rather than structurally dead.

Use a ladder:

1. Start from a validated or near-miss route.
2. Change one carry width by a small amount.
3. Measure qubits/Toffoli.
4. Triage candidate quality.
5. Stop when near misses disappear or severity jumps.

Measured Cleanup

Andre/Schrottenloher-style space optimization and Trail of Bits-style reversible dataflow both motivate using measurement or classical transcript bits to reduce coherent state, when the measured value is no longer needed quantum-coherently.

Use this when:

• a bit is only used classically after a point
• phase correctness can be explicitly checked
• adaptive correction is cheap enough

Risk:

• Measurement can fix qubit pressure but create phase bugs.
• Always track pha separately; do not rely only on classical output checks.
• Whole-register ghosting is the extreme version: a full coordinate can be discharged and later reconstructed only if there is a written phase/correctness proof for the discharge path.

Vented/Short Product Paths

Product paths can reduce live state by streaming or shortening product intermediates.

Useful knobs:

• ROUND84_QPROD_VENT_PAD=1
• ROUND84_QPROD_VENT_PAD_MINW=<w>
• ROUND84_QPROD_SHORT=1
• SQUARE_ROW_MAX_SEG=<n>

Observed behavior:

• Smaller segment limits can reduce peak qubits.
• Vent padding can make shorter product paths safe enough to validate.
• These often trade qubits for Toffoli and need score gating.

Dead-CCX / Dead-CXX Screening

Use this step when a q-target route is nearly score-competitive and needs a robust, distribution-level dead-gate candidate list before applying any DROP_DEAD_ROBUST or similar post-build cut. Do not fit dead gates to one Fiat-Shamir draw. Screen a large random input population, then treat the resulting list as a candidate reservoir that still needs full eval and island triage.

This section is the operational how-to. For the strategic framing — read it first — see the ⭐⭐ "Empirical / dynamic dead-CCX elimination" bullet under "The 1168 Wall Broke." The key points it makes: this is a SCORE lever, NOT a DESIGN lever (it does not improve the construction; a clean-room build gains nothing from the .idx); the indices are absolute-position fragile, so any structural change (a clamp, knob, or fold toggle — not just an FS re-hash) shifts them onto live gates and forces a full re-screen. The lists are literally per-variant (dead_k1_coord3x.idx vs dead_k1_nocoord3x.idx). Treat the whole technique like a sophisticated nonce grind: worth running to squeeze a frozen artifact, but the durable wins are the structural levers. (Heading note: "Dead-CXX" only appears here because the bundled script/outputs are named *_cxx_*; the gate is a CCX.)

Preferred Screener: BitWonka dead-ccx-finder

Prefer BitWonka's public tool when the objective is dead-CCX filtering for the current ludicrous route:

https://github.com/BitWonka/ecdsafail-tools/tree/master/dead-ccx-finder

It provides find_dead_ccx.rs, a drop-in src/bin/ binary for an otherwise unmodified challenge checkout. It calls point_add::build() once, screens the exact post-fanout op stream, and ORs each charged CCX/CCZ fire mask across many Fiat-Shamir seeds. A gate emitted to .idx is one whose scored condition cond & c1 & c2 never fired over the screened population.

Key properties from the tool README:

• self-contained bit-sliced simulator; builds against the public Simulator fields and does not require trusted simulator patches
• DEAD_REAL_RNG=1 exact mode uses the real measured-gate RNG; about 9M screened inputs in roughly 13 minutes on a 16-core box
• DEAD_REAL_RNG=0 fast mode forces measurement outcomes to 0; useful for quick conservative iteration, but use exact mode for final ship screens
• knobs: DEAD_SCREEN_NONCES, DEAD_REAL_RNG, DEAD_THREADS, PREDICT_SHOTS, DEAD_IDX_OUT, plus the route's baked or exported TLM_*

Canonical single-host run:

cp dead-ccx-finder/find_dead_ccx.rs <challenge-repo>/src/bin/find_dead_ccx.rs
cd <challenge-repo>
cargo build --release --bin find_dead_ccx
NONCES=$(python3 -c "print(' '.join(str(700000000001+i*999999937) for i in range(1000)))")
DEAD_REAL_RNG=1 DEAD_SCREEN_NONCES="$NONCES" DEAD_IDX_OUT=dead.idx \
  ./target/release/find_dead_ccx

Use fast mode only as a triage pre-pass:

DEAD_REAL_RNG=0 DEAD_SCREEN_NONCES="$NONCES" DEAD_IDX_OUT=dead.fast.idx \
  ./target/release/find_dead_ccx

Add the drop loader after the single-CCX-fanout pass and before returning ops. For local tuning, point DROP_DEAD_IDX_FILE at the generated .idx. For ship, commit the .idx and switch the loader to include_str!(...) so the env-less grader build reproduces the exact final artifact. Always keep DROP_DEAD_ROBUST_DISABLE=1 as a debugging escape hatch.

Important: BitWonka's tool is not a drop-in replacement for the older bundled distributed helper's current screen_dead_ccx CLI. The finder uses environment variables (DEAD_SCREEN_NONCES, DEAD_IDX_OUT, etc.), while the bundled helper expects target/release/screen_dead_ccx --shots ... --seed ... --out .... Use BitWonka's find_dead_ccx directly for final single-host screens, or adapt the distributed helper/backend script before mixing the two.

Distributed Orchestration Helper

Bundled helper:

scripts/distributed_dead_cxx_scan.py

It currently runs target/release/screen_dead_ccx over N random inputs across M SSH hosts with K worker processes per host, launching all hosts concurrently after staging, then collects every shard's .idx list and emits merged support files:

• dead_cxx_support.tsv — every op index and the number of shards where it stayed dead
• dead_cxx_intersection.idx — indices dead in all shards
• dead_cxx_support_ge<N>.idx — threshold lists, including all-minus-one / all-minus-two when requested
• per-host shards/, logs/, manifest.tsv, plus local manifest.json and summary.json

Example:

python scripts/distributed_dead_cxx_scan.py \
  --total-shots 20000000 \
  --host l40a=root@202.181.159.211:11152 \
  --host l40b=root@103.67.42.150:10606 \
  --threads-per-host 24 \
  --challenge-dir /root/q1153_work/challenge \
  --remote-workdir /root/q1153_dead_cxx_20m \
  --out-dir outputs/q1153_dead_cxx_20m \
  --mode random \
  --support-threshold 48 \
  --support-threshold -1 \
  --support-threshold -2 \
  --ssh-option=-o \
  --ssh-option StrictHostKeyChecking=accept-new \
  --build

Host format is [name=]user@host[:port][,identity=/path/to/key]. If no --support-threshold is given, the helper writes all, all-1, and all-2 support lists by default. Use --dry-run first to write the generated remote scripts locally without running them.

Operational rules:

1. Build the screener from source on each remote host; do not upload ops.bin. If using BitWonka's tool, copy find_dead_ccx.rs into src/bin/ and build find_dead_ccx; if using the bundled script as-is, provide a compatible screen_dead_ccx binary.
2. Choose N large enough that each shard has meaningful coverage. For fragile dead-drop work, prefer tens of millions of random samples over a single 9024-shot draw. A practical final minimum is the BitWonka/field scale of about 9M inputs; use larger distributed populations when trying to relax support thresholds.
3. Use K near the CPU parallelism the host can sustain without memory pressure. If workers are killed or logs show rc=137, lower K and restart cleanly.
4. Start with strict support lists (all, all-1, all-2) and measure q / avgT / cls / pha / anc on each before relaxing thresholds.
5. If a threshold shell worsens pha or creates a repeated classical floor, split it into op-index/support shells and test recombinations instead of scanning nonces.
6. Record the source commit, CFG/env, tail nonce used for eval, exact support threshold, input population size, host list, K, screener mode (DEAD_REAL_RNG=1/0 if using BitWonka), and local/remote artifact paths before any nonce scan or submission attempt.

Interpretation:

• A high-support dead-CXX index is evidence that a charged gate is distribution-inert, not proof that deleting it is correct after the op stream re-hashes.
• Every applied list reseeds the Fiat-Shamir island. Re-run full eval_circuit on the post-drop stream and then do a short triage scan before large GPU hunting.
• Dead-CCX screening must be done with the drop disabled. Then bake/apply the .idx, re-hunt the nonce on the drop-enabled circuit, and validate that final artifact.
• Favor robust all-shard intersections for repair baselines; use lower support shells as a Toffoli reservoir only after slicing/attribution shows they do not introduce structural phase or classical dirt.

Toffoli Reduction Patterns

Fused Folds and Fast Adds

Fusing stages removes redundant controls, cleanup, or repeated work.

Useful knobs:

• DIALOG_GCD_APPLY_FUSED_FOLD=1
• ROUND84_FOLD_FAST_ADD=1

Observed behavior:

• These were helpful for lower-Toffoli 1216-style routes.
• They can interact with top-cleaning and scratch release.
• They are usually worth testing first when the qubit budget has a little slack.

Skip Final Top-Clean When Safe