Hyperoptimize the blake3_compress_chunks circuit

[arthurpaulino]

Summary

The blake3 circuits dominated the lake exe kernel String.Internal.append
proving-cost profile. This PR cuts total FFT cost by 19.1% (3109M →
2516M) through five incremental, individually-measured changes, and
removes two now-dead helpers.

Background

Aiur compiles each function to a zk circuit. A circuit's width is
inputSize + selectors + auxiliaries + 4·(1 + lookups), where
auxiliaries and lookups are the maximum over the match arms — so
width is set by the widest arm; a wide cold arm wastes columns on every
row. Cost is width × height × log2(height). Op costs that matter here:
call +outputSize aux +1 lookup; store/load +1 lookup; u8_* ops +1
lookup each; pure field add/sub/mul-by-const cost zero columns.

Changes

1. Factor block-completion out of the hot loop

blake3_compress_chunks width 341 was set by its coldest arms
(Cons,63,1023) / (Cons,63,_) — the only ones carrying both
assign_block_value (+64 aux) and blake3_compress (+32 aux) plus flag
helpers and store, yet firing on ~1.8% of rows. Extracted that tail
into a cold blake3_compress_block circuit; the two arms merged into
one. 341 → 281.

2. Thread Layer by pointer

enum Layer { Push(&Layer, [[G;4];8]), Nil } is a 34-wide value type.
blake3_compress_chunks took and returned it by value — 34 columns of
inputSize every row plus 34 aux on every recursive call. Switched to
layer: &Layer -> &Layer; blake3 adds a store/load at the
boundary so blake3_compress_layer keeps its by-value signature.
281 → 215.

3. Accumulate block bytes in a list, not a 64-wide buffer

blake3_compress_chunks threaded block_buffer: [[G;4];16] (64 columns
of inputSize) and filled it via assign_block_value, whose
[[G;4];16] return cost +64 aux every hot row. Circuit memory is
content-addressed (no in-place mutation), so a threaded 64-element
accumulator costs 64 columns somewhere on every row — a linked list does
not. Replaced it with a reverse-ordered byte accumulator list:

• Hot loop: store(ListNode.Cons(head, byte_acc)), one store/row.
• bytes_to_block materializes a full 64-byte list into [[G;4];16] via
  64 unrolled loads — one cold row per completed block.
• pad_block zero-pads the trailing partial block.
• blake3_finish absorbs the input-exhausted arms.
• assign_block_value is now dead and removed.

215 → 75.

4. Combine carry bits with field add, not u8 xor

The byte adders (u32_add, u32_be_add, u64_add,
relaxed_u64_be_add_2_bytes) propagated carries with
u8_xor(overflow_i, carry_ia) — a circuit op (+1 aux, +1 lookup). The
two bits are mutually exclusive (a carry out of a_i + b_i forces the
partial sum <= 254, so + carry_in cannot carry), so their xor is a
plain field add costing zero columns. Replaced every carry-combining
u8_xor with +. u32_add 70 → 60.

5. Inline u8_recompose and delete it

u8_recompose([b0..b7]) = b0 + 2*b1 + ... + 128*b7 is pure arithmetic,
but each call cost +1 aux +1 lookup. Inlined all uses as explicit
weighted sums — 8 in blake3_g_function, ~36 across sha256_compress
and define_W_i — then deleted the now-unused definition.
blake3_g_function 250 → 210.

Results

Measured with lake exe kernel String.Internal.append:

metric	baseline	this PR
blake3_compress_chunks width	341	75 (−78%)
blake3_compress_chunks FFT	426M	94M
u32_add width	70	60
u32_add FFT	602M	516M
blake3_g_function width	250	210
blake3_g_function FFT	310M	261M
assign_block_value FFT	157M	eliminated
total FFT cost	3109M	2516M (−19.1%)

New cold circuits introduced: bytes_to_block, pad_block,
blake3_finish, blake3_compress_block — all small.

Validation

lake test -- --ignored aiur-hashes passes (145 assertions, exit 0),
covering blake3 and sha256 across sizes 0–3168 including block and chunk
boundaries. lake exe kernel String.Internal.append runs clean.

[arthurpaulino]

Summary

The blake3 circuits dominated the lake exe kernel String.Internal.append
proving-cost profile. This PR cuts total FFT cost by 19.1% (3109M →
2516M) through five incremental, individually-measured changes, and
removes two now-dead helpers.

Background

Aiur compiles each function to a zk circuit. A circuit's width is
inputSize + selectors + auxiliaries + 4·(1 + lookups), where
auxiliaries and lookups are the maximum over the match arms — so
width is set by the widest arm; a wide cold arm wastes columns on every
row. Cost is width × height × log2(height). Op costs that matter here:
call +outputSize aux +1 lookup; store/load +1 lookup; u8_* ops +1
lookup each; pure field add/sub/mul-by-const cost zero columns.

Changes

1. Factor block-completion out of the hot loop

blake3_compress_chunks width 341 was set by its coldest arms
(Cons,63,1023) / (Cons,63,_) — the only ones carrying both
assign_block_value (+64 aux) and blake3_compress (+32 aux) plus flag
helpers and store, yet firing on ~1.8% of rows. Extracted that tail
into a cold blake3_compress_block circuit; the two arms merged into
one. 341 → 281.

2. Thread Layer by pointer

enum Layer { Push(&Layer, [[G;4];8]), Nil } is a 34-wide value type.
blake3_compress_chunks took and returned it by value — 34 columns of
inputSize every row plus 34 aux on every recursive call. Switched to
layer: &Layer -> &Layer; blake3 adds a store/load at the
boundary so blake3_compress_layer keeps its by-value signature.
281 → 215.

3. Accumulate block bytes in a list, not a 64-wide buffer

blake3_compress_chunks threaded block_buffer: [[G;4];16] (64 columns
of inputSize) and filled it via assign_block_value, whose
[[G;4];16] return cost +64 aux every hot row. Circuit memory is
content-addressed (no in-place mutation), so a threaded 64-element
accumulator costs 64 columns somewhere on every row — a linked list does
not. Replaced it with a reverse-ordered byte accumulator list:

• Hot loop: store(ListNode.Cons(head, byte_acc)), one store/row.
• bytes_to_block materializes a full 64-byte list into [[G;4];16] via
  64 unrolled loads — one cold row per completed block.
• pad_block zero-pads the trailing partial block.
• blake3_finish absorbs the input-exhausted arms.
• assign_block_value is now dead and removed.

215 → 75.

4. Combine carry bits with field add, not u8 xor

The byte adders (u32_add, u32_be_add, u64_add,
relaxed_u64_be_add_2_bytes) propagated carries with
u8_xor(overflow_i, carry_ia) — a circuit op (+1 aux, +1 lookup). The
two bits are mutually exclusive (a carry out of a_i + b_i forces the
partial sum <= 254, so + carry_in cannot carry), so their xor is a
plain field add costing zero columns. Replaced every carry-combining
u8_xor with +. u32_add 70 → 60.

5. Inline u8_recompose and delete it

u8_recompose([b0..b7]) = b0 + 2*b1 + ... + 128*b7 is pure arithmetic,
but each call cost +1 aux +1 lookup. Inlined all uses as explicit
weighted sums — 8 in blake3_g_function, ~36 across sha256_compress
and define_W_i — then deleted the now-unused definition.
blake3_g_function 250 → 210.

Results

Measured with lake exe kernel String.Internal.append:

metric	baseline	this PR
blake3_compress_chunks width	341	75 (−78%)
blake3_compress_chunks FFT	426M	94M
u32_add width	70	60
u32_add FFT	602M	516M
blake3_g_function width	250	210
blake3_g_function FFT	310M	261M
assign_block_value FFT	157M	eliminated
total FFT cost	3109M	2516M (−19.1%)

New cold circuits introduced: bytes_to_block, pad_block,
blake3_finish, blake3_compress_block — all small.

Validation

lake test -- --ignored aiur-hashes passes (145 assertions, exit 0),
covering blake3 and sha256 across sizes 0–3168 including block and chunk
boundaries. lake exe kernel String.Internal.append runs clean.

[arthurpaulino]

Summary

The blake3 circuits dominated the lake exe kernel String.Internal.append
proving-cost profile. This PR cuts total FFT cost by 19.1% (3109M →
2516M) through five incremental, individually-measured changes, and
removes two now-dead helpers.

Background

Aiur compiles each function to a zk circuit. A circuit's width is
inputSize + selectors + auxiliaries + 4·(1 + lookups), where
auxiliaries and lookups are the maximum over the match arms — so
width is set by the widest arm; a wide cold arm wastes columns on every
row. Cost is width × height × log2(height). Op costs that matter here:
call +outputSize aux +1 lookup; store/load +1 lookup; u8_* ops +1
lookup each; pure field add/sub/mul-by-const cost zero columns.

Changes

1. Factor block-completion out of the hot loop

blake3_compress_chunks width 341 was set by its coldest arms
(Cons,63,1023) / (Cons,63,_) — the only ones carrying both
assign_block_value (+64 aux) and blake3_compress (+32 aux) plus flag
helpers and store, yet firing on ~1.8% of rows. Extracted that tail
into a cold blake3_compress_block circuit; the two arms merged into
one. 341 → 281.

2. Thread Layer by pointer

enum Layer { Push(&Layer, [[G;4];8]), Nil } is a 34-wide value type.
blake3_compress_chunks took and returned it by value — 34 columns of
inputSize every row plus 34 aux on every recursive call. Switched to
layer: &Layer -> &Layer; blake3 adds a store/load at the
boundary so blake3_compress_layer keeps its by-value signature.
281 → 215.

3. Accumulate block bytes in a list, not a 64-wide buffer

blake3_compress_chunks threaded block_buffer: [[G;4];16] (64 columns
of inputSize) and filled it via assign_block_value, whose
[[G;4];16] return cost +64 aux every hot row. Circuit memory is
content-addressed (no in-place mutation), so a threaded 64-element
accumulator costs 64 columns somewhere on every row — a linked list does
not. Replaced it with a reverse-ordered byte accumulator list:

• Hot loop: store(ListNode.Cons(head, byte_acc)), one store/row.
• bytes_to_block materializes a full 64-byte list into [[G;4];16] via
  64 unrolled loads — one cold row per completed block.
• pad_block zero-pads the trailing partial block.
• blake3_finish absorbs the input-exhausted arms.
• assign_block_value is now dead and removed.

215 → 75.

4. Combine carry bits with field add, not u8 xor

The byte adders (u32_add, u32_be_add, u64_add,
relaxed_u64_be_add_2_bytes) propagated carries with
u8_xor(overflow_i, carry_ia) — a circuit op (+1 aux, +1 lookup). The
two bits are mutually exclusive (a carry out of a_i + b_i forces the
partial sum <= 254, so + carry_in cannot carry), so their xor is a
plain field add costing zero columns. Replaced every carry-combining
u8_xor with +. u32_add 70 → 60.

5. Inline u8_recompose and delete it

u8_recompose([b0..b7]) = b0 + 2*b1 + ... + 128*b7 is pure arithmetic,
but each call cost +1 aux +1 lookup. Inlined all uses as explicit
weighted sums — 8 in blake3_g_function, ~36 across sha256_compress
and define_W_i — then deleted the now-unused definition.
blake3_g_function 250 → 210.

Results

Measured with lake exe kernel String.Internal.append:

metric	baseline	this PR
blake3_compress_chunks width	341	75 (−78%)
blake3_compress_chunks FFT	426M	94M
u32_add width	70	60
u32_add FFT	602M	516M
blake3_g_function width	250	210
blake3_g_function FFT	310M	261M
assign_block_value FFT	157M	eliminated
total FFT cost	3109M	2516M (−19.1%)

New cold circuits introduced: bytes_to_block, pad_block,
blake3_finish, blake3_compress_block — all small.

Validation

lake test -- --ignored aiur-hashes passes (145 assertions, exit 0),
covering blake3 and sha256 across sizes 0–3168 including block and chunk
boundaries. lake exe kernel String.Internal.append runs clean.

[arthurpaulino]

Summary

The blake3 circuits dominated the lake exe kernel String.Internal.append
proving-cost profile. This PR cuts total FFT cost by 19.1% (3109M →
2516M) through five incremental, individually-measured changes, and
removes two now-dead helpers.

Background

Aiur compiles each function to a zk circuit. A circuit's width is
inputSize + selectors + auxiliaries + 4·(1 + lookups), where
auxiliaries and lookups are the maximum over the match arms — so
width is set by the widest arm; a wide cold arm wastes columns on every
row. Cost is width × height × log2(height). Op costs that matter here:
call +outputSize aux +1 lookup; store/load +1 lookup; u8_* ops +1
lookup each; pure field add/sub/mul-by-const cost zero columns.

Changes

1. Factor block-completion out of the hot loop

blake3_compress_chunks width 341 was set by its coldest arms
(Cons,63,1023) / (Cons,63,_) — the only ones carrying both
assign_block_value (+64 aux) and blake3_compress (+32 aux) plus flag
helpers and store, yet firing on ~1.8% of rows. Extracted that tail
into a cold blake3_compress_block circuit; the two arms merged into
one. 341 → 281.

2. Thread Layer by pointer

enum Layer { Push(&Layer, [[G;4];8]), Nil } is a 34-wide value type.
blake3_compress_chunks took and returned it by value — 34 columns of
inputSize every row plus 34 aux on every recursive call. Switched to
layer: &Layer -> &Layer; blake3 adds a store/load at the
boundary so blake3_compress_layer keeps its by-value signature.
281 → 215.

3. Accumulate block bytes in a list, not a 64-wide buffer

blake3_compress_chunks threaded block_buffer: [[G;4];16] (64 columns
of inputSize) and filled it via assign_block_value, whose
[[G;4];16] return cost +64 aux every hot row. Circuit memory is
content-addressed (no in-place mutation), so a threaded 64-element
accumulator costs 64 columns somewhere on every row — a linked list does
not. Replaced it with a reverse-ordered byte accumulator list:

• Hot loop: store(ListNode.Cons(head, byte_acc)), one store/row.
• bytes_to_block materializes a full 64-byte list into [[G;4];16] via
  64 unrolled loads — one cold row per completed block.
• pad_block zero-pads the trailing partial block.
• blake3_finish absorbs the input-exhausted arms.
• assign_block_value is now dead and removed.

215 → 75.

4. Combine carry bits with field add, not u8 xor

The byte adders (u32_add, u32_be_add, u64_add,
relaxed_u64_be_add_2_bytes) propagated carries with
u8_xor(overflow_i, carry_ia) — a circuit op (+1 aux, +1 lookup). The
two bits are mutually exclusive (a carry out of a_i + b_i forces the
partial sum <= 254, so + carry_in cannot carry), so their xor is a
plain field add costing zero columns. Replaced every carry-combining
u8_xor with +. u32_add 70 → 60.

5. Inline u8_recompose and delete it

u8_recompose([b0..b7]) = b0 + 2*b1 + ... + 128*b7 is pure arithmetic,
but each call cost +1 aux +1 lookup. Inlined all uses as explicit
weighted sums — 8 in blake3_g_function, ~36 across sha256_compress
and define_W_i — then deleted the now-unused definition.
blake3_g_function 250 → 210.

Results

Measured with lake exe kernel String.Internal.append:

metric	baseline	this PR
blake3_compress_chunks width	341	75 (−78%)
blake3_compress_chunks FFT	426M	94M
u32_add width	70	60
u32_add FFT	602M	516M
blake3_g_function width	250	210
blake3_g_function FFT	310M	261M
assign_block_value FFT	157M	eliminated
total FFT cost	3109M	2516M (−19.1%)

New cold circuits introduced: bytes_to_block, pad_block,
blake3_finish, blake3_compress_block — all small.

Validation

lake test -- --ignored aiur-hashes passes (145 assertions, exit 0),
covering blake3 and sha256 across sizes 0–3168 including block and chunk
boundaries. lake exe kernel String.Internal.append runs clean.

[arthurpaulino]

Summary

The blake3 circuits dominated the lake exe kernel String.Internal.append
proving-cost profile. This PR cuts total FFT cost by 19.1% (3109M →
2516M) through five incremental, individually-measured changes, and
removes two now-dead helpers.

Background

Aiur compiles each function to a zk circuit. A circuit's width is
inputSize + selectors + auxiliaries + 4·(1 + lookups), where
auxiliaries and lookups are the maximum over the match arms — so
width is set by the widest arm; a wide cold arm wastes columns on every
row. Cost is width × height × log2(height). Op costs that matter here:
call +outputSize aux +1 lookup; store/load +1 lookup; u8_* ops +1
lookup each; pure field add/sub/mul-by-const cost zero columns.

Changes

1. Factor block-completion out of the hot loop

blake3_compress_chunks width 341 was set by its coldest arms
(Cons,63,1023) / (Cons,63,_) — the only ones carrying both
assign_block_value (+64 aux) and blake3_compress (+32 aux) plus flag
helpers and store, yet firing on ~1.8% of rows. Extracted that tail
into a cold blake3_compress_block circuit; the two arms merged into
one. 341 → 281.

2. Thread Layer by pointer

enum Layer { Push(&Layer, [[G;4];8]), Nil } is a 34-wide value type.
blake3_compress_chunks took and returned it by value — 34 columns of
inputSize every row plus 34 aux on every recursive call. Switched to
layer: &Layer -> &Layer; blake3 adds a store/load at the
boundary so blake3_compress_layer keeps its by-value signature.
281 → 215.

3. Accumulate block bytes in a list, not a 64-wide buffer

blake3_compress_chunks threaded block_buffer: [[G;4];16] (64 columns
of inputSize) and filled it via assign_block_value, whose
[[G;4];16] return cost +64 aux every hot row. Circuit memory is
content-addressed (no in-place mutation), so a threaded 64-element
accumulator costs 64 columns somewhere on every row — a linked list does
not. Replaced it with a reverse-ordered byte accumulator list:

• Hot loop: store(ListNode.Cons(head, byte_acc)), one store/row.
• bytes_to_block materializes a full 64-byte list into [[G;4];16] via
  64 unrolled loads — one cold row per completed block.
• pad_block zero-pads the trailing partial block.
• blake3_finish absorbs the input-exhausted arms.
• assign_block_value is now dead and removed.

215 → 75.

4. Combine carry bits with field add, not u8 xor

The byte adders (u32_add, u32_be_add, u64_add,
relaxed_u64_be_add_2_bytes) propagated carries with
u8_xor(overflow_i, carry_ia) — a circuit op (+1 aux, +1 lookup). The
two bits are mutually exclusive (a carry out of a_i + b_i forces the
partial sum <= 254, so + carry_in cannot carry), so their xor is a
plain field add costing zero columns. Replaced every carry-combining
u8_xor with +. u32_add 70 → 60.

5. Inline u8_recompose and delete it

u8_recompose([b0..b7]) = b0 + 2*b1 + ... + 128*b7 is pure arithmetic,
but each call cost +1 aux +1 lookup. Inlined all uses as explicit
weighted sums — 8 in blake3_g_function, ~36 across sha256_compress
and define_W_i — then deleted the now-unused definition.
blake3_g_function 250 → 210.

Results

Measured with lake exe kernel String.Internal.append:

metric	baseline	this PR
blake3_compress_chunks width	341	75 (−78%)
blake3_compress_chunks FFT	426M	94M
u32_add width	70	60
u32_add FFT	602M	516M
blake3_g_function width	250	210
blake3_g_function FFT	310M	261M
assign_block_value FFT	157M	eliminated
total FFT cost	3109M	2516M (−19.1%)

New cold circuits introduced: bytes_to_block, pad_block,
blake3_finish, blake3_compress_block — all small.

Validation

lake test -- --ignored aiur-hashes passes (145 assertions, exit 0),
covering blake3 and sha256 across sizes 0–3168 including block and chunk
boundaries. lake exe kernel String.Internal.append runs clean.

[arthurpaulino]

Summary

The blake3 circuits dominated the lake exe kernel String.Internal.append
proving-cost profile. This PR cuts total FFT cost by 19.1% (3109M →
2516M) through five incremental, individually-measured changes, and
removes two now-dead helpers.

Background

Aiur compiles each function to a zk circuit. A circuit's width is
inputSize + selectors + auxiliaries + 4·(1 + lookups), where
auxiliaries and lookups are the maximum over the match arms — so
width is set by the widest arm; a wide cold arm wastes columns on every
row. Cost is width × height × log2(height). Op costs that matter here:
call +outputSize aux +1 lookup; store/load +1 lookup; u8_* ops +1
lookup each; pure field add/sub/mul-by-const cost zero columns.

Changes

1. Factor block-completion out of the hot loop

blake3_compress_chunks width 341 was set by its coldest arms
(Cons,63,1023) / (Cons,63,_) — the only ones carrying both
assign_block_value (+64 aux) and blake3_compress (+32 aux) plus flag
helpers and store, yet firing on ~1.8% of rows. Extracted that tail
into a cold blake3_compress_block circuit; the two arms merged into
one. 341 → 281.

2. Thread Layer by pointer

enum Layer { Push(&Layer, [[G;4];8]), Nil } is a 34-wide value type.
blake3_compress_chunks took and returned it by value — 34 columns of
inputSize every row plus 34 aux on every recursive call. Switched to
layer: &Layer -> &Layer; blake3 adds a store/load at the
boundary so blake3_compress_layer keeps its by-value signature.
281 → 215.

3. Accumulate block bytes in a list, not a 64-wide buffer

blake3_compress_chunks threaded block_buffer: [[G;4];16] (64 columns
of inputSize) and filled it via assign_block_value, whose
[[G;4];16] return cost +64 aux every hot row. Circuit memory is
content-addressed (no in-place mutation), so a threaded 64-element
accumulator costs 64 columns somewhere on every row — a linked list does
not. Replaced it with a reverse-ordered byte accumulator list:

• Hot loop: store(ListNode.Cons(head, byte_acc)), one store/row.
• bytes_to_block materializes a full 64-byte list into [[G;4];16] via
  64 unrolled loads — one cold row per completed block.
• pad_block zero-pads the trailing partial block.
• blake3_finish absorbs the input-exhausted arms.
• assign_block_value is now dead and removed.

215 → 75.

4. Combine carry bits with field add, not u8 xor

The byte adders (u32_add, u32_be_add, u64_add,
relaxed_u64_be_add_2_bytes) propagated carries with
u8_xor(overflow_i, carry_ia) — a circuit op (+1 aux, +1 lookup). The
two bits are mutually exclusive (a carry out of a_i + b_i forces the
partial sum <= 254, so + carry_in cannot carry), so their xor is a
plain field add costing zero columns. Replaced every carry-combining
u8_xor with +. u32_add 70 → 60.

5. Inline u8_recompose and delete it

u8_recompose([b0..b7]) = b0 + 2*b1 + ... + 128*b7 is pure arithmetic,
but each call cost +1 aux +1 lookup. Inlined all uses as explicit
weighted sums — 8 in blake3_g_function, ~36 across sha256_compress
and define_W_i — then deleted the now-unused definition.
blake3_g_function 250 → 210.

Results

Measured with lake exe kernel String.Internal.append:

metric	baseline	this PR
blake3_compress_chunks width	341	75 (−78%)
blake3_compress_chunks FFT	426M	94M
u32_add width	70	60
u32_add FFT	602M	516M
blake3_g_function width	250	210
blake3_g_function FFT	310M	261M
assign_block_value FFT	157M	eliminated
total FFT cost	3109M	2516M (−19.1%)

New cold circuits introduced: bytes_to_block, pad_block,
blake3_finish, blake3_compress_block — all small.

Validation

lake test -- --ignored aiur-hashes passes (145 assertions, exit 0),
covering blake3 and sha256 across sizes 0–3168 including block and chunk
boundaries. lake exe kernel String.Internal.append runs clean.

[arthurpaulino]

Summary

The blake3 circuits dominated the lake exe kernel String.Internal.append
proving-cost profile. This PR cuts total FFT cost by 19.1% (3109M →
2516M) through five incremental, individually-measured changes, and
removes two now-dead helpers.

Background

Aiur compiles each function to a zk circuit. A circuit's width is
inputSize + selectors + auxiliaries + 4·(1 + lookups), where
auxiliaries and lookups are the maximum over the match arms — so
width is set by the widest arm; a wide cold arm wastes columns on every
row. Cost is width × height × log2(height). Op costs that matter here:
call +outputSize aux +1 lookup; store/load +1 lookup; u8_* ops +1
lookup each; pure field add/sub/mul-by-const cost zero columns.

Changes

1. Factor block-completion out of the hot loop

blake3_compress_chunks width 341 was set by its coldest arms
(Cons,63,1023) / (Cons,63,_) — the only ones carrying both
assign_block_value (+64 aux) and blake3_compress (+32 aux) plus flag
helpers and store, yet firing on ~1.8% of rows. Extracted that tail
into a cold blake3_compress_block circuit; the two arms merged into
one. 341 → 281.

2. Thread Layer by pointer

enum Layer { Push(&Layer, [[G;4];8]), Nil } is a 34-wide value type.
blake3_compress_chunks took and returned it by value — 34 columns of
inputSize every row plus 34 aux on every recursive call. Switched to
layer: &Layer -> &Layer; blake3 adds a store/load at the
boundary so blake3_compress_layer keeps its by-value signature.
281 → 215.

3. Accumulate block bytes in a list, not a 64-wide buffer

blake3_compress_chunks threaded block_buffer: [[G;4];16] (64 columns
of inputSize) and filled it via assign_block_value, whose
[[G;4];16] return cost +64 aux every hot row. Circuit memory is
content-addressed (no in-place mutation), so a threaded 64-element
accumulator costs 64 columns somewhere on every row — a linked list does
not. Replaced it with a reverse-ordered byte accumulator list:

• Hot loop: store(ListNode.Cons(head, byte_acc)), one store/row.
• bytes_to_block materializes a full 64-byte list into [[G;4];16] via
  64 unrolled loads — one cold row per completed block.
• pad_block zero-pads the trailing partial block.
• blake3_finish absorbs the input-exhausted arms.
• assign_block_value is now dead and removed.

215 → 75.

4. Combine carry bits with field add, not u8 xor

The byte adders (u32_add, u32_be_add, u64_add,
relaxed_u64_be_add_2_bytes) propagated carries with
u8_xor(overflow_i, carry_ia) — a circuit op (+1 aux, +1 lookup). The
two bits are mutually exclusive (a carry out of a_i + b_i forces the
partial sum <= 254, so + carry_in cannot carry), so their xor is a
plain field add costing zero columns. Replaced every carry-combining
u8_xor with +. u32_add 70 → 60.

5. Inline u8_recompose and delete it

u8_recompose([b0..b7]) = b0 + 2*b1 + ... + 128*b7 is pure arithmetic,
but each call cost +1 aux +1 lookup. Inlined all uses as explicit
weighted sums — 8 in blake3_g_function, ~36 across sha256_compress
and define_W_i — then deleted the now-unused definition.
blake3_g_function 250 → 210.

Results

Measured with lake exe kernel String.Internal.append:

metric	baseline	this PR
blake3_compress_chunks width	341	75 (−78%)
blake3_compress_chunks FFT	426M	94M
u32_add width	70	60
u32_add FFT	602M	516M
blake3_g_function width	250	210
blake3_g_function FFT	310M	261M
assign_block_value FFT	157M	eliminated
total FFT cost	3109M	2516M (−19.1%)

New cold circuits introduced: bytes_to_block, pad_block,
blake3_finish, blake3_compress_block — all small.

Validation

lake test -- --ignored aiur-hashes passes (145 assertions, exit 0),
covering blake3 and sha256 across sizes 0–3168 including block and chunk
boundaries. lake exe kernel String.Internal.append runs clean.

[arthurpaulino]

Summary

The blake3 circuits dominated the lake exe kernel String.Internal.append
proving-cost profile. This PR cuts total FFT cost by 19.1% (3109M →
2516M) through five incremental, individually-measured changes, and
removes two now-dead helpers.

Background

Aiur compiles each function to a zk circuit. A circuit's width is
inputSize + selectors + auxiliaries + 4·(1 + lookups), where
auxiliaries and lookups are the maximum over the match arms — so
width is set by the widest arm; a wide cold arm wastes columns on every
row. Cost is width × height × log2(height). Op costs that matter here:
call +outputSize aux +1 lookup; store/load +1 lookup; u8_* ops +1
lookup each; pure field add/sub/mul-by-const cost zero columns.

Changes

1. Factor block-completion out of the hot loop

blake3_compress_chunks width 341 was set by its coldest arms
(Cons,63,1023) / (Cons,63,_) — the only ones carrying both
assign_block_value (+64 aux) and blake3_compress (+32 aux) plus flag
helpers and store, yet firing on ~1.8% of rows. Extracted that tail
into a cold blake3_compress_block circuit; the two arms merged into
one. 341 → 281.

2. Thread Layer by pointer

enum Layer { Push(&Layer, [[G;4];8]), Nil } is a 34-wide value type.
blake3_compress_chunks took and returned it by value — 34 columns of
inputSize every row plus 34 aux on every recursive call. Switched to
layer: &Layer -> &Layer; blake3 adds a store/load at the
boundary so blake3_compress_layer keeps its by-value signature.
281 → 215.

3. Accumulate block bytes in a list, not a 64-wide buffer

blake3_compress_chunks threaded block_buffer: [[G;4];16] (64 columns
of inputSize) and filled it via assign_block_value, whose
[[G;4];16] return cost +64 aux every hot row. Circuit memory is
content-addressed (no in-place mutation), so a threaded 64-element
accumulator costs 64 columns somewhere on every row — a linked list does
not. Replaced it with a reverse-ordered byte accumulator list:

• Hot loop: store(ListNode.Cons(head, byte_acc)), one store/row.
• bytes_to_block materializes a full 64-byte list into [[G;4];16] via
  64 unrolled loads — one cold row per completed block.
• pad_block zero-pads the trailing partial block.
• blake3_finish absorbs the input-exhausted arms.
• assign_block_value is now dead and removed.

215 → 75.

4. Combine carry bits with field add, not u8 xor

The byte adders (u32_add, u32_be_add, u64_add,
relaxed_u64_be_add_2_bytes) propagated carries with
u8_xor(overflow_i, carry_ia) — a circuit op (+1 aux, +1 lookup). The
two bits are mutually exclusive (a carry out of a_i + b_i forces the
partial sum <= 254, so + carry_in cannot carry), so their xor is a
plain field add costing zero columns. Replaced every carry-combining
u8_xor with +. u32_add 70 → 60.

5. Inline u8_recompose and delete it

u8_recompose([b0..b7]) = b0 + 2*b1 + ... + 128*b7 is pure arithmetic,
but each call cost +1 aux +1 lookup. Inlined all uses as explicit
weighted sums — 8 in blake3_g_function, ~36 across sha256_compress
and define_W_i — then deleted the now-unused definition.
blake3_g_function 250 → 210.

Results

Measured with lake exe kernel String.Internal.append:

metric	baseline	this PR
blake3_compress_chunks width	341	75 (−78%)
blake3_compress_chunks FFT	426M	94M
u32_add width	70	60
u32_add FFT	602M	516M
blake3_g_function width	250	210
blake3_g_function FFT	310M	261M
assign_block_value FFT	157M	eliminated
total FFT cost	3109M	2516M (−19.1%)

New cold circuits introduced: bytes_to_block, pad_block,
blake3_finish, blake3_compress_block — all small.

Validation

lake test -- --ignored aiur-hashes passes (145 assertions, exit 0),
covering blake3 and sha256 across sizes 0–3168 including block and chunk
boundaries. lake exe kernel String.Internal.append runs clean.