Checkpoint the party/runtime stack before share-program and malicious-mode work.

Ship the TLS mesh, composer, Beaver/Yao/leaf MPC, prep/online paths, apps, and docs so the tree is pushable before elevating share_expr, security_mode, and prep resume.

Co-authored-by: Cursor <cursoragent@cursor.com>

doc/pages/ppvc.md

@@ -1,5 +1,9 @@
 # Point-programmable vector commitments {#ppvc_manual}
 
+\htmlonly
+<div class="eli5"><b>ELI5.</b> The vector is bound before the coordinate is chosen. Each coordinate is a pair of 1-bit DPF roots, and both roots are committed with a Naor string. Opening one side of each pair writes the hidden coordinate, or the sum, onto a public index.</div>
+\endhtmlonly
+
 A point-programmable vector commitment binds a vector
 `x` in `(Z/2^s Z)^n` and still lets one hidden coordinate be chosen
 after the commitment is published.
@@ -53,6 +57,10 @@ storage, so two expansions on one thread must not overlap.
 
 ## What an opening proves {#ppvc_verify}
 
+\htmlonly
+<div class="eli5"><b>ELI5.</b> verify recomputes the Naor string on each opened root and compares it to the commitment. A root that was not the committed one fails. The check does not reveal the other coordinates.</div>
+\endhtmlonly
+
 `verify` checks each opened root against its Naor string.
 `accept` also checks the programmed statement: the rotated coordinate
 when `mu` is 0, the column sum when `mu` is 1.
@@ -89,3 +97,7 @@ The generator is `dpf::prg::aes128` unless another 128-bit PRG is named.
 Naor's string commitment is Moni Naor, [Bit Commitment Using Pseudorandomness](@ref bib_naor), Journal of Cryptology 1991.
 The point keys are the Boyle–Gilboa–Ishai construction named in
 [DPF basics](@ref point_functions).
+
+\htmlonly
+<div class="tldr"><b>TL;DR.</b> Commit binds the vector before the coordinate is chosen, by committing both DPF roots. Open writes one coordinate or the sum onto a public index. verify checks those roots against the Naor strings.</div>
+\endhtmlonly