Publish a scannable manual and a bibliography that links each paper back to the pages that use it.

Co-authored-by: Cursor <cursoragent@cursor.com>

doc/pages/repr_and_twist.md

@@ -0,0 +1,116 @@
+# Representation shift and twisted jets {#repr_and_twist}
+
+One opened offset `eta = x - r` also drives linear-recurrence checkpoints and
+twisted monomials. Representation shift advances a dealer-keyed state vector
+by a public matrix power. Twisted jets key \f$c^{m}\lambda^{c}\f$ and correct
+with a public Pascal shift plus \f$\lambda^{\kappa}\f$.
+
+## Representation shift {#offset_repr}
+
+Offset Horner is the unipotent (Pascal) case of a shift-invariant module.
+Here the dealer keys an arbitrary state
+\f$S_c\in(\mathbb{Z}/2^{64})^d\f$ at the hidden center. After `eta` opens, each
+refined piece has a public carry `kappa`, and the parties apply
+
+\f[
+S_{c+\kappa}=M^{\kappa}S_c.
+\f]
+
+Negative `kappa` uses \f$M^{-1}\f$ (the determinant must be odd, hence a unit
+in \f$\mathbb{Z}/2^{64}\f$). The wrap branch is multiplication by the public
+constant \f$M^{\mp 2^n}\f$; when \f$M^{2^n}=I\f$ it is free.
+
+Built-in examples:
+
+- **Fibonacci.** Companion matrix of \f$T^2-T-1\f$ with
+  \f$S_n=(F_{n+1},F_n)\f$. The Lucas addition formula is exactly
+  \f$S_{c+\kappa}=M^{\kappa}S_c\f$. Helpers:
+  `offset_repr_fibonacci_matrix`, `offset_repr_fibonacci_state`.
+- **Geometric.** The \f$1\times 1\f$ matrix \f$[\lambda]\f$ advances
+  \f$\lambda^{c}\f$ by the public factor \f$\lambda^{\kappa}\f$.
+- **CRC / LFSR.** Over \f$\mathrm{GF}(2)\f$ the same checkpoint uses XOR
+  shares. `offset_repr_crc32_jump` is the cleartext public twin
+  (ISO / Ethernet polynomial); keyed CRC is deferred to XOR payload shares.
+
+A state of `s` lanes (`s ≤ offset_repr_max_dim`, which is 8) is one
+incremental comparison. The seed spine is `Θ(n λ)` bits with `λ` the
+seed width, and the value words grow with the `s` lanes.
+`offset_repr_eval` is one
+sequence-shaped walk on the knots. `offset_repr_matrix_pow` then
+squares the `s × s` matrix once per bit of `|kappa|` (`Θ(s³)` per
+squaring, at most 63 squarings) and applies it on every refined piece,
+`Θ(P · bitlength(kappa) · s³)` field operations. Negative exponents need
+`M^{-1}`, so the determinant has to be odd.
+
+`make_offset_repr_keys(center, state)` keys one incremental `gt` of the state vector.
+`offset_repr_eval` returns one party's share of the advanced state.
+`offset_repr_matrix_pow` is the public \f$M^{e}\f$ used after `eta` opens.
+
+**Code samples**\n
+<div class="tabbed">
+
+  - <b class="tab-title">repr_and_twist.cpp</b>  \include{cpp} grotto/repr_and_twist.cpp
+
+</div>
+
+## Twisted jets {#offset_twist}
+
+The dealer keys one comparison whose payload is the vector of twisted powers
+\f$c^{m}\lambda^{c}\f$ in \f$\mathbb{Z}/2^{64}\f$. After `eta` opens, the segment
+walk returns those shares on the hot piece. A public binomial shift of the
+coefficient vector by `kappa`, followed by a public factor \f$\lambda^{\kappa}\f$,
+yields
+
+\f[
+\sum_{m}a_m(c+\kappa)^{m}\lambda^{c+\kappa}
+  =\lambda^{\kappa}\sum_{m}q_m\,c^{m}\lambda^{c},
+\f]
+
+where \f$q=\mathrm{Pascal}(\kappa)\,a\f$. Odd \f$\lambda\f$ are units, so negative
+`kappa` is \f$(\lambda^{-1})^{|\kappa|}\f$.
+
+Dyadic decay \f$\lambda=1/2\f$ is the tag `twist_half`. A right shift does
+not distribute over additive shares, so keygen plants \f$c^{m}\f$ and
+`offset_twist_eval` returns shares of the untwisted
+\f$\sum a_m(c+\kappa)^{m}\f$. After opening, a public right shift by the
+wrapped point yields \f$\sum a_m x^{m}/2^{x}\f$. `offset_twist_clear` with
+`twist_half` evaluates that dyadic target in the clear.
+
+The closed form
+
+\f[
+\sum_{k=1}^{n}k\lambda^{k}
+  =\lambda\frac{1-(n+1)\lambda^{n}+n\lambda^{n+1}}{(1-\lambda)^{2}}
+\f]
+
+(for odd \f$\lambda\neq 1\f$) is `offset_twist_arithmetico_geometric`. It is a
+readout of the same twisted table (degree-1 coefficients against
+\f$\lambda^{k}\f$ powers).
+
+`make_offset_twist_keys(center, degree, lambda)` and the `twist_half`
+overload key the table. `lambda` must be odd. `offset_twist_eval<Party>`
+returns one party's share of the twisted polynomial at the wrapped point.
+`offset_twist_clear` is the same value in the clear.
+
+Degree `d` is at most 16: one comparison key. The seed spine is
+`Θ(n λ)` bits with `λ` the seed width, and the value words grow with
+`d`. Then one sequence-shaped walk on the knots and
+an `O(d^2)` Pascal shift. `twist_half` skips the public multiply by
+the odd base and leaves a shift for after the shares are opened.
+`offset_twist_arithmetico_geometric` is a constant amount of arithmetic
+on its two public arguments.
+
+\code{cpp}
+const std::uint8_t center = 10;
+const std::uint8_t eta = 5;
+auto twist_keys = grotto::make_offset_twist_keys<std::uint8_t>(
+    center, 2, std::uint64_t{3});
+std::vector<std::uint8_t> knots{0};
+std::vector<std::uint64_t> coeff{2, 5, 1};
+auto s0 = grotto::offset_twist_eval<0>(twist_keys, knots, coeff, eta);
+auto half_keys = grotto::make_offset_twist_keys<std::uint8_t>(
+    center, 2, grotto::twist_half);
+\endcode
+
+Offset Horner, offset polynomials, carry, prefix parity, and the cleartext
+LUTs are on [jet and ring](@ref jet_and_ring).