Publish a scannable manual and a bibliography that links each paper back to the pages that use it.

Co-authored-by: Cursor <cursoragent@cursor.com>

doc/pages/applications.md

@@ -0,0 +1,564 @@
+# Application mockups {#applications}
+
+These programs are the DPF step of a larger protocol.
+Each one is a single process.
+A dealer stands in where the paper generates keys from shares.
+They compile from the repository root:
+
+    c++ -std=c++17 -march=native -I include -I thirdparty examples/applications/duoram3.cpp
+
+The same line with the other filenames builds the rest.
+Optional Python bindings configure with `-DLIBDPF_PYTHON=ON` in the test
+build directory, then `make pydpf` (and `make pydpf_pytest`).
+`pydpf` exposes point / interval / full / sequence / recipe eval on
+`uint8→uint64`, two-leaf multileaf, wildcard assign, 16-bit `eval_until`,
+and `it_dpf3`. Not in this module yet: geneval, Doerner–Shelat, VDPF
+`prove`/`sketch`, DCF, or grotto.
+What those programs had to do by hand is [the library surface underneath](@ref application_gaps).
+
+
+| Sketch | What the DPF step is |
+| --- | --- |
+| [3-party Duoram](@ref app_duoram) | Unit key, rotate, inner product |
+| [SUBLEQ](@ref app_subleq) | Instruction fetch under a secret PC |
+| [BitMore](@ref app_bitmore) | `2^L` servers, one hot slot |
+| [Keyword PIR](@ref app_keyword) | Cuckoo buckets over keywords |
+| [Prio](@ref app_prio) | Heavy-hitter prefix walk |
+| [I-DPF max / k-th](@ref app_idpf_agg) | `eval_until` order statistics |
+| [LLAMA](@ref app_llama) | Lookup and truncation |
+| [Pika](@ref app_pika) | Comparison tree |
+| [Express](@ref app_express) | Authenticated memory |
+| [PRAC](@ref app_prac) | Range and prefix counts |
+| [Splinter](@ref app_splinter) | Function secret-sharing queries |
+| [Mastic](@ref app_mastic) | Aggregation |
+| [Waldo](@ref app_waldo) | Private search |
+| [Sabre](@ref app_sabre) | Robust aggregation |
+| [(2,3) ledger](@ref app_ledger23) | Three-party update |
+| [PSI](@ref app_psi) | Private set intersection |
+| [Range count](@ref app_range_count) | Interval payload |
+| [Floram](@ref app_floram) | ORAM read |
+| [Three-server PIR](@ref app_pir3) | Information-theoretic DPF |
+| [What the walk folds in](@ref application_gaps) | Library surface those programs used to do by hand |
+
+
+## 3-party Duoram {#app_duoram}
+
+Vadapalli, Henry, and Goldberg ([USENIX Security 2023](@ref bib_duoram)) keep a memory in
+shares and read or add at a secret index.
+Preprocessing builds unit DPFs at a random index `r`.
+Online, the parties open `i* - r` and cyclic-shift the expanded vector.
+The read is the dot product of that vector with the memory.
+The update adds a payload vector, shifted the same way.
+
+The program uses one dealer unit key for the read and one payload key
+for the update.
+`eval_full_inner_product(dpf::paired, key, memory, dpf::rotate{s})` dots
+the unit key with the memory read at `(i + s) mod n`, so the caller keeps
+one unrotated vector.
+The update expands straight into the subtractive memory shares with
+`eval_full_add_into(mem, key, dpf::rotate{s})` — no separate expansion,
+shift, and add.
+A 1-bit leaf at the same index lifts to `+1` or `-1`; its sign share is
+recorded at keygen with `dpf::unit_sign`.
+A word payload of `1` opens to `+1`.
+
+This is a `(2,2)` key.
+The auxiliary party holds some of those keys.
+[dpf::make_dpf3](@ref dpf/dpf3.hpp) shares one point Shamir-style among
+three evaluators.
+
+\include{cpp} applications/duoram3.cpp
+
+## MPC SUBLEQ {#app_subleq}
+
+Jiang and Henry ([MSc thesis, University of Calgary](@ref bib_subleq)) emulate the
+subtract-and-branch-if-less-than-or-equal-to-zero (SUBLEQ) OISC for
+private function evaluation. One instruction is
+
+    D[B] -= D[A]
+    pc    = (D[B] ≤ 0) ? C : pc + 3
+
+The DPF work is prepaid. The dealer ships wildcard unit keys
+`[[* | 1]]` for the addresses that will be read (and for writing `B`).
+Each party expands those keys over the full address domain with
+`defer_eval_full` **before** the addresses are known — that is all of
+the PRG. Online, the parties open each address into `offset_x`, and
+`.get()` on the deferred view rotates the prepaid unit vector. A read
+is the Du-Atallah / local dot of that view with the memory shares. The
+write reuses the same `e_B` view: add `(-D[A]) · e_B` into the memory
+shares (a Beaver multiplication in the protocol; the listing opens the
+scale). The branch is a path evaluation only —
+`make_dpf(0, dpf::leq(1))` evaluated at `x = D'[B]` — never a full-domain
+expand of the word domain. The full protocol can instead assign a
+wildcard comparison key to `x` and evaluate at public `0` with `geq`
+(same bit).
+
+Instruction fetch is the same prepaid unit dotted against three sliding
+windows of `D` (the three addresses of the instruction). The listing
+starts after `(A, B, C)` are already shares.
+
+An equivalent prepaid form plants the unit at a random `r` and opens
+`addr - r`, then folds the shift with `dpf::rotate{s}` on
+`eval_full_inner_product` / `eval_full_add_into` (the Duoram / Pika
+surface). Same online AES; only the blinding convention differs.
+
+Still by hand: Du-Atallah blinds, the ABY2 mux of `C` against `pc+3`,
+and out-of-bounds prefix-parity checks from the thesis.
+
+\include{cpp} applications/subleq.cpp
+
+## BitMore, `2^L` servers {#app_bitmore}
+
+Hafiz and Henry ([PoPETs 2019](@ref bib_bitmore), §5.2) query `ell = 2^L` servers with `L`
+independent 1-bit DPFs, all at the same row.
+Server `j` receives key number `j_e` from DPF `e`.
+`dpf::pack_bit_columns(keys...)` runs the full-domain bit walk once per
+key and writes lane `e` = key `e` into one integer per row, so the
+server reads `symbol[row]` instead of unpacking one `int` per bit.
+Off the secret row every server computes the same digit.
+On the secret row the digits are `symbol(0) XOR j`, a permutation of
+`0 .. ell-1`.
+When the server count `ℓ` is not a power of two,
+`dpf::mod_bit_columns<ℓ>(keys...)` is that same integer modulo `ℓ`.
+The first key is still the low bit. The information-theoretic
+virtual-bucket response starts from those digits.
+
+`L = 1` is the two-server member of the same family.
+Each party XORs the records its bit selects.
+The two answers XOR to the record.
+
+\include{cpp} applications/bitmore.cpp
+
+## Keyword PIR {#app_keyword}
+
+Gilboa and Ishai ([EUROCRYPT 2014](@ref bib_dpf2014)) retrieve one record by a keyword.
+[dpf::keyword](@ref dpf/keyword.hpp) is the domain, so the DPF point is
+the keyword itself.
+Each server walks the dictionary with `eval_sequence` and XORs the
+record where its bit share is set.
+Off the keyword the two bits match, so the record cancels.
+A keyword absent from the dictionary opens to 0.
+`eval_sequence` takes the dictionary in nondecreasing order.
+
+A batch of keywords that should come back as separate records is one
+key per keyword.
+[dpf::make_multipoint](@ref dpf/multipoint.hpp) adds several secret
+points into one output. That is a histogram of hits, or a payload the
+client chose.
+That packing is de Castro–Polychroniadou (EUROCRYPT 2022): `t` points
+into `m ≈ O(t)` cuckoo buckets, each an ordinary GGM key.
+S&P 2025 (Boyle, Gilboa, Hamilis, Ishai, Tu) shrinks the dealer message
+with a silent OLE / PCG that expands a short seed into many correlated
+bucket keys.
+That is a different primitive (the same family as silent VOLE), not a
+new `multipoint_params` field, and this library does not ship a PCG
+stack.
+
+\include{cpp} applications/keyword_pir.cpp
+
+## Prio and the heavy-hitter prefix walk {#app_prio}
+
+Corrigan-Gibbs and Boneh ([NSDI 2017](@ref bib_prio)) aggregate client encodings.
+A frequency count is a one-hot vector.
+A unit DPF is that vector, compressed.
+Each client keys a point at its bin with payload `1` in
+[dpf::field64](@ref dpf/field64.hpp), the same prime as libprio `Field64`.
+Each server folds a full-domain expansion into its running histogram
+share with `eval_full_add_into(hist, key)`.
+The opened bin is the count.
+Prio's validity proof for a general encoding is a SNIP.
+This program is the DPF encoding only.
+
+The prefix walk is Poplar (Boneh, Boyle, Corrigan-Gibbs, Gilboa, and
+Ishai, [ePrint 2021/017](@ref bib_poplar)).
+[dpf::idpf](@ref dpf/placement.hpp) plants a `1` on prefix lengths 1, 2,
+and 3, counting from the high bit.
+Two clients hold `0xA0` and `0xB0`.
+They share the length-3 prefix `101` and split at the next bit.
+The servers evaluate `out<i, length>` at one representative of each node
+and add the opened values.
+
+\include{cpp} applications/prio.cpp
+
+## I-DPF max and k-th {#app_idpf_agg}
+
+Cheng, Mitrokotsa, Zhang, and Hartmann ([ePrint 2024/1190](@ref bib_idpfagg)) aggregate
+secret values with an incremental DPF.
+Communication tracks the bit length of the domain, not how many secret
+inputs were summed.
+Each secret `uint16_t` is one [dpf::idpf](@ref dpf/placement.hpp) with a
+unit payload on every prefix length.
+Servers resume only the live prefixes with
+[dpf::eval_until](@ref dpf/eval_until.hpp).
+At each depth they open the two children: max keeps the nonempty
+`1`-child; the k-th largest takes the `1`-child when its count is at
+least `k`.
+`idpf_agg_max` / `idpf_agg_kth` in [dpf/idpf_agg.hpp](@ref dpf/idpf_agg.hpp)
+share that walk with the gtest.
+
+\include{cpp} applications/idpf_agg.cpp
+
+## LLAMA {#app_llama}
+
+Gupta, Kumaraswamy, Chandran, and Gupta ([ePrint 2022/793](@ref bib_llama)) evaluate a
+nonlinear gate from a dealer key and one opened masked input
+`x_hat = x + r`.
+The sign test is a comparison: `make_dpf(knot + r, dpf::gt(1))`,
+evaluated at `x_hat`.
+A degree-0 spline is one [dpf::ic](@ref dpf/interval.hpp) key per piece.
+The piece value is the payload.
+The same comparison on `int8_t` follows numeric order: `100 > -3` opens
+to 1.
+
+\include{cpp} applications/llama.cpp
+
+## Pika {#app_pika}
+
+Wagh ([PoPETs 2022](@ref bib_pika), Fig. 1) looks up `Func(a)` in a table of a bounded
+domain.
+The dealer keys a unit DPF at a fresh index `r` and the parties open
+`x = r - a`.
+The inner product of the DPF with the table read at `(i - x) mod n` is
+the table entry at `a`; `dpf::rotate{s}` folds that offset into the walk.
+A word payload of `1` opens to `+1`.
+The paper's early-stop bit leaf opens to `+1` or `-1`; the dealer records
+that sign at keygen with `dpf::unit_sign` (the final control bit `Gen`
+sees), so the evaluators never open `r`.
+
+\include{cpp} applications/pika.cpp
+
+## Express {#app_express}
+
+Eskandarian, Corrigan-Gibbs, Zaharia, and Boneh ([USENIX Security 2021](@ref bib_express),
+§3.1) write one mailbox.
+Two servers hold subtractive shares of the mailboxes.
+The client sends one key each.
+Each server adds its expansion into its share.
+The owner opens one address.
+An [extractable](@ref dpf/verifiable.hpp) sketch accepts the honest
+write and rejects a second hot mailbox.
+
+The message is [dpf::fp61](@ref dpf/fp61.hpp) because that is the sketch
+field.
+Each server folds the expansion into its mailbox shares and the one-hot
+audit in one walk: `eval_full_add_into(box, key, dpf::sketch(s, r))`.
+The extractable full-domain leaf now matches point evaluation on every
+lane, so this one call replaces the earlier `eval_point`-per-address
+loop and the separate `sketch_fold` pass.
+
+\include{cpp} applications/express.cpp
+
+## PRAC {#app_prac}
+
+Sasy, Vadapalli, and Goldberg ([ePrint 2023/1897](@ref bib_prac)) run dynamic data
+structures on a 3-party Duoram.
+The new DPF shapes are an incremental key and a wide leaf.
+
+Binary search on a sorted array reads `lg n` locations.
+The accessible set at each depth is a public stride, and the index in
+the next stride is the previous index with one comparison bit appended.
+One [idpf](@ref dpf/placement.hpp) supplies every stride's unit vector.
+The program's array is `[1, 3, 5, 7, 9, 11, 13, 15]` and the needle is
+`10`. The public midpoint is index 3.
+`eval_prefix_inner_product(out<i, length>, key, stride)` walks to the
+prefix depth once and dots the `2^length` prefix shares with the stride,
+replacing one `eval_point` per stride slot. The prefix of length 1
+selects `11` from the stride `{1, 5}`. The prefix of length 2 selects
+`9` from `{0, 2, 4, 6}`. The bits `101` are the lower bound, index 5.
+
+Heapify reads a parent and its two children, three strides at one
+index, with one unit key.
+The update at that index is a [dpf::vec](@ref dpf/vec.hpp) of three
+lanes.
+An incremental wide key is `idpf` of those vectors. That call already
+evaluates.
+
+The dealer in this program knows the path and keys it up front.
+The protocol appends each comparison bit after the key exists.
+
+\include{cpp} applications/prac.cpp
+
+## Splinter {#app_splinter}
+
+Wang, Yun, Goldwasser, Vaikuntanathan, and Zaharia ([NSDI 2017](@ref bib_splinter)) answer
+private queries on public data with two-server FSS.
+The client's private `WHERE` value is a unit DPF at that attribute.
+Each server dots the selector with a public column pre-aggregated by
+attribute, so `eval_full_inner_product(dpf::paired, key, group_sum)` is
+`SELECT SUM(value) WHERE attribute = secret`, and the all-ones column is
+`COUNT(*)`.
+Neither server learns the queried key.
+
+Still by hand: `MAX` / `TOP-k` and multi-predicate conjunctions are not
+one selector DPF; Splinter composes several FSS instances for those.
+
+\include{cpp} applications/splinter.cpp
+
+## Mastic {#app_mastic}
+
+Mastic (private weighted heavy-hitters and attribute-based metrics) is
+Poplar's prefix walk with a weight payload.
+Each client keys an [idpf](@ref dpf/placement.hpp) whose β on every
+prefix length is its weight, not `1`.
+`eval_prefixes(out<i, length>, key)` returns the prefix shares; the
+servers sum them across clients and threshold to keep the heavy prefix.
+Two clients on `0xA0` and `0xB0` with weights 5 and 3 make prefix `101`
+heavy with total weight 8.
+`verify_idpf_path<Depth>` is the one-time VIDPF path check
+([path_sketch.hpp](@ref dpf/path_sketch.hpp)).
+
+\include{cpp} applications/mastic.cpp
+
+## Waldo {#app_waldo}
+
+Dauterman, Rathee, Popa, and Stoica ([S&P 2022](@ref bib_waldo)) build a private time-series
+database from FSS.
+The store is append-only: each event is a fresh unit DPF folded into the
+servers' value shares with `eval_full_add_into`, never an update.
+A range/threshold aggregate uses the comparison channel:
+`eval_full_inner_product(dpf::cmp, key, magnitude)` dots the
+per-timestamp `gt` shares with a public magnitude column over the whole
+domain, so the SUM over timestamps past a *secret* threshold reveals
+neither the threshold nor the matches. The two halves open with
+`reconstruct_cmp_halves`.
+
+Still by hand: Waldo's aggregation trees over several predicates, and
+range endpoints that are themselves secret-shared, compose more than one
+comparison key.
+
+\include{cpp} applications/waldo.cpp
+
+## Sabre {#app_sabre}
+
+Vadapalli, Storrier, and Henry ([S&P 2022](@ref bib_sabre)) send anonymous messages with a
+fast audit.
+The write is Express's full-domain add (`eval_full_add_into`).
+The audit is a *verifiable* DPF proof rather than Express's `fp61`
+sketch: `prove_full(key, dpf::prove(π))` folds a constant-size token per
+party, and `dpf::verify(π0, π1)` accepts an honest single-point write and
+rejects the mismatched fold a multi-point key produces.
+
+Still by hand: Sabre's blame / accountability phase that identifies a
+cheating client is protocol logic above the DPF proof.
+
+\include{cpp} applications/sabre.cpp
+
+## A (2,3) ledger {#app_ledger23}
+
+A replicated ledger held as (2-of-3) shares by three servers, on this
+group's `dpf3` VDPF+ construction.
+Each append is one `make_dpf3(slot, amount, dpf::verifiable{})`; a
+`verify_dpf3` over the three `prove_dpf3` tokens rejects an append that
+is not a single well-formed point before it is applied.
+Each server folds the point into its slot shares with
+`eval_full_add_into(shares, key)` (the (2,3) full-domain overload), and
+any two servers `shamir3::reconstruct` a balance.
+Two credits to slot 5 (100 then 7) open to 107.
+
+Still by hand: the transaction / consensus layer around the append
+(ordering, replay protection) is protocol logic above the DPF step.
+
+\include{cpp} applications/ledger23.cpp
+
+## Private set intersection {#app_psi}
+
+Kolesnikov, Kumaresan, Rosulek, and Trieu ([CCS 2016](@ref bib_kkrt)) test membership
+with an oblivious PRF.
+On this domain the PRF is a table both servers hold.
+Each receiver element is a unit DPF.
+`eval_full_inner_product(dpf::paired, key, table)` is that server's
+share of `PRF(y)`.
+The sender publishes `PRF(x)` for each element of their own set.
+`y` is in the intersection when the opened tag appears in that image.
+
+Still by hand: cuckoo hashing in the PSI application layer, and the GGM
+puncture that keeps a large domain at `O(n)` communication instead of a
+table. The multipoint cuckoo VDMPF stays the GGM packing above; S&P 2025
+DMPF seed packing needs a PCG this library does not provide.
+
+\include{cpp} applications/psi.cpp
+
+## Range count {#app_range_count}
+
+Each secret value is one comparison.
+The interval `[lo, hi)` is public.
+`eval_point(dpf::cmp, key, q)` opens to 1 when `q` is strictly above the
+value, so the two endpoints differ by 1 exactly when
+`lo <= v < hi`.
+The count is the sum of those bits over the values.
+A neighbor just below `lo`, and the open end `hi`, contribute 0.
+
+Still by hand: a secret interval over a public histogram is two
+comparison inner products (the Waldo aggregate, subtracted).
+This program is the other direction, secret values and a public range.
+
+\include{cpp} applications/range_count.cpp
+
+## Floram {#app_floram}
+
+Doerner and shelat ([CCS 2017](@ref bib_ds)) read and write an array at a secret
+address.
+Both parties see the memory.
+The address is XOR-shared, so the key is
+[dpf::make_dpf_doerner_shelat](@ref dpf/doerner_shelat.hpp) rather than a
+dealer key.
+The read dots a unit payload with the array.
+The write adds a payload key from the same address shares into
+subtractive copies of the memory, with `eval_full_add_into`.
+
+Still by hand: Floram's stash, position map, and refresh. This program
+is the FSS access.
+
+\include{cpp} applications/floram.cpp
+
+## Three-server PIR {#app_pir3}
+
+The database is public and replicated on three servers.
+
+The computational path is one (2,3) point key from
+[dpf::make_dpf3](@ref dpf/dpf3.hpp) ([ePrint 2024/1658](@ref bib_dpf3)).
+Each server dots its share with the database:
+`eval_full_inner_product(key, database)`.
+Any two of those dots `shamir3::reconstruct` to the record.
+
+\include{cpp} applications/pir3.cpp
+
+The information-theoretic path is
+[dpf::make_it_dpf3](@ref dpf/it_dpf3.hpp) ([ePrint 2023/028](@ref bib_itdpf)).
+Each server holds an additive share of the characteristic vector; the
+three dots sum to the record. Distinct from `make_dpf3`.
+
+\include{cpp} applications/it_pir3.cpp
+
+## What the walk now folds in {#application_gaps}
+
+The calls the eight programs used to build by hand are now the library
+surface. See [dpf/eval_walk.hpp](@ref dpf/eval_walk.hpp).
+
+## Shift, then add {#gap_shift}
+
+Duoram and Pika rotate a vector by an opened offset, then dot.
+`dpf::rotate{s}` on `eval_full_inner_product` reads the weight at
+`(i + s) mod 2^n` inside the walk, so the caller keeps one unrotated
+vector. `dpf::cyclic_shift(buf, s)` rotates a materialized share buffer.
+Duoram's update, Prio's histogram, and Express's mailbox add the
+expansion into a buffer the caller already holds with
+`eval_full_add_into(buf, key)` (and a `dpf::rotate` or `dpf::sketch`
+overload). Express's audit folds in the same pass.
+
+Still by hand: none for the deferred leaf.
+`dpf::leaf_later` expands without the leaf correction word and fills a
+parallel control-bit buffer. After `cyclic_shift_pair` (or
+`eval_full_add_into(..., leaf_later, rotate{s})`),
+`apply_leaf_correction(buf, control, F)` does `buf[i] += F * control[i]`.
+[Doerner–Shelat](@ref dpf/doerner_shelat.hpp) already builds a key from
+index shares the parties hold.
+
+## The bit leaf's sign {#gap_sign}
+
+Duoram's flag vector and Pika's early-stop leaf are 1-bit DPFs that lift
+to a ring unit of `+1` or `-1`. `dpf::make_dpf(alpha, dpf::bit::one,
+dpf::unit_sign{w0, w1})` records that sign at keygen — `w0 - w1` is the
+`±1` unit — from the final control bit `Gen` sees and one key hides.
+Absent the tag, keygen is unchanged.
+
+## Answers that are XORs or bit columns {#gap_xor}
+
+BitMore stacks `L` full-domain bit vectors and reads them as `L`-bit
+digits. `dpf::pack_bit_columns(keys...)` runs the bit walk once per key
+and writes one integer per row (lane `e` is key `e`).
+`dpf::mod_bit_columns<ℓ>(keys...)` reduces that integer modulo a server
+count `ℓ` from 2 through 32768, which is the digit when `ℓ` is not a
+power of two. The virtual-bucket response that consumes the digits stays
+outside the DPF layer.
+
+Keyword PIR XORs dictionary records selected by a bit share with
+`eval_sequence_xor(key, begin, end, records)`, which folds that loop into
+the sequence walk.
+
+## Prefixes {#gap_prefix}
+
+Poplar and PRAC score every node at one depth.
+`eval_prefixes(out<i, length>, key)` returns the `2^length` prefix
+shares in one walk, and
+`eval_prefix_inner_product(out<i, length>, key, values)` dots them with
+a public vector, each replacing one `eval_point` per node.
+
+`verify_idpf_path<Depth>` / `sketch_path_level` /
+`sketch_path_parent` ([path_sketch.hpp](@ref dpf/path_sketch.hpp))
+check that an incremental key is a single path: each depth is
+weight-1 (or one nonzero weight), and each parent equals the sum of its
+children. Leaf one-hot remains
+[sketch_fold](@ref dpf/verifiable.hpp).
+
+## A growing index {#gap_stride}
+
+PRAC's binary search key grows: the next comparison bit is appended to
+the index. `dpf::extend` / `dpf::add_output` realize
+[F_Grow](@ref ideal_functionalities): a dealer (or joint) view turns an
+existing `dpf_key` pair into a richer one. Specs are the same objects
+`make_dpf` accepts. Memoizer overloads skip the O(d) rewalk when both
+path memoizers are already filled through the frontier.
+`extend_ds` / `add_output_ds` realize [F_GrowDS](@ref ideal_functionalities):
+one Doerner–Shelat correction-word round on extend, or leaf-open only on
+`add_output`, from warm frontiers.
+
+**Cost (dealer F_Grow).** O(d) rewalk of the spine, or O(1) seed reads
+with warm memoizers; one `make_cw` / `advance` on extend; one exterior
+leaf plant per new packing group. Zero rounds and zero bytes on the wire.
+
+**Cost (F_GrowDS).** One interactive level on extend (blinds, CW share,
+advice, AND — same shape as one `point_party` level) plus leaf pads when
+planting. `local_cw_protocol` opens in-process (no wire). `add_output_ds`
+has no interior CW round.
+
+A wide leaf is a `vec`.
+`idpf` of several `vec` payloads is the incremental wide key heapify
+uses for every level at once. That call already evaluates.
+
+## Gates LLAMA still has to assemble {#gap_llama}
+
+One comparison and one public interval are already gates, and an
+`int8_t` comparison follows numeric order.
+A spline with several pieces is several `dpf::ic` keys in the program.
+One key whose payload is the coefficient vector of the selected piece,
+with Horner on the shares and the public `x_hat`, is the Boyle gate
+LLAMA cites.
+`dpf::gt(hi, lo)` with both payloads a [dpf::vec](@ref dpf/vec.hpp)
+carries the vector. That is a wide comparison leaf.
+`dpf::gt(hi)` alone uses a zero of the same type as `hi`, so a
+`dpf::vec` false payload is the zero vector.
+Signed extension and truncate-reduce are
+`grotto::sign_extend` / `grotto::truncate_reduce` (wrappers over
+`make_carry_keys` + `eval_carry_extend` / `eval_carry_in`). Grotto's
+piecewise Horner evaluates a public polynomial from a point key. It is a
+different construction.
+
+## Sketches on the group the protocol writes {#gap_sketch}
+
+Express audits the same key that writes the mailbox.
+`dpf::blob<N>` is the XOR leaf for a row of `N` bytes. A caller fold
+`eval_full_add_into(buf, key, fold)` invokes `fold(index, share)` once
+per written output in the same walk; `dpf::sketch` remains the `fp61`
+weight-1 fold. Pika's malicious check is the same shape over `Z/2^k`,
+using their bilinear Schwartz–Zippel lemma.
+
+`eval_full` on an extractable `fp61` key now matches `eval_point` on
+every lane, including both lanes of the packed leaf that holds the
+programmed point. Express folds its expansion and audit in one
+`eval_full_add_into(box, key, dpf::sketch(...))` walk.
+`extractable_full_test` pins the share-for-share match.
+
+## Punctured PRF {#gap_pprf}
+
+KKRT's PSI is cuckoo hashing plus a set check in the application. The
+library object is `dpf::pprf_master` / `dpf::puncture` / `dpf::pprf_eval`
+on the AES PRG, including a 128-bit domain. The programmed value at the
+punctured point is stored beside the puncture when the master holder
+computes it. The same walk over a set `H` returns a `dpf::pprf_copath`:
+every node whose parent lies on a path to `H` and which itself does not,
+with shared prefixes stored once. Empty `H` publishes the root; a
+full-domain `H` publishes nothing. The walk is O(|H| · n) and never
+materializes the domain. An audit opening of a replica-seed pool is that
+copath with `program_hidden = false`, so the live seeds stay out. The
+one-point layout stays for PSI; `{α}` with programming agrees with it.