Checkpoint the party/runtime stack before share-program and malicious-mode work.

Ship the TLS mesh, composer, Beaver/Yao/leaf MPC, prep/online paths, apps, and docs so the tree is pushable before elevating share_expr, security_mode, and prep resume.

Co-authored-by: Cursor <cursoragent@cursor.com>

include/grotto/nmod.hpp

@@ -47,6 +47,10 @@ struct nmod_result
 /// @return `x_raw / 2^x_bits` modulo `M`, with `1/M ≈ recip_raw / 2^recip_bits`
 /// @throws std::invalid_argument if the reciprocal is zero or a width is illegal.
 /// @throws std::overflow_error if the quotient does not fit in `int64_t`.
+/// \complexity One 64×128 multiply into four 64-bit limbs, then a constant number of limb tests to split the quotient and the residue. `Θ(1)` in that 256-bit width. Extra space is the four-limb array.
+/// @see grotto::ring_switch_eval
+/// @see grotto::nmod_pow2
+/// @note Truncated Barrett. The residue is `{x/M}` on `residue_bits` fractional bits, not an exact `zn64` representative. Exact conversion is `ring_switch`.
 HEDLEY_WARN_UNUSED_RESULT
 inline nmod_result nmod(std::int64_t x_raw, unsigned x_bits,
     unsigned __int128 recip_raw, unsigned recip_bits, unsigned residue_bits)
@@ -190,6 +194,8 @@ inline nmod_result nmod(std::int64_t x_raw, unsigned x_bits,
 /// @param residue_bits the fractional bits kept in the residue
 /// @return Modulus `2^{-exp}` by an exact shift
 /// @throws std::overflow_error if `exp` does not fit the reciprocal width.
+/// \complexity One call to `nmod` with a reciprocal that is a shift (`2^{exp}` or `2^{-exp}`). `Θ(1)`.
+/// @see grotto::nmod
 HEDLEY_WARN_UNUSED_RESULT
 inline nmod_result nmod_pow2(std::int64_t x_raw, unsigned x_bits, int exp,
     unsigned residue_bits)