From eea8443841ed4a701bf84a9f6415aa9415d6250d Mon Sep 17 00:00:00 2001
From: Freya <fengrun.liu@gmail.com>
Date: Wed, 29 Jul 2026 20:41:48 -0400
Subject: [PATCH 01/17] docs(book): add field-to-ring reduction page and
 rewrite sumcheck stages

Adds the field-to-ring evaluation reduction chapter, rewrites the Stage-1
sumcheck-stages page (Stage 1 digit range check, Stage 2 fused relation,
Stage 3 setup product), and links the new page from SUMMARY.md.

Review fixes: hand terminal-fold anatomy to proving.md, repoint the opening-
consistency link to field-ring-reduction.md, and pin all code references to a
single snapshot.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 book/src/SUMMARY.md                          |   1 +
 book/src/how/proving/field-ring-reduction.md | 540 +++++++++++++++
 book/src/how/proving/sumcheck-stages.md      | 662 ++++++++++++++++++-
 3 files changed, 1193 insertions(+), 10 deletions(-)
 create mode 100644 book/src/how/proving/field-ring-reduction.md

diff --git a/book/src/SUMMARY.md b/book/src/SUMMARY.md
index 29f2a675e..4ebebeab7 100644
--- a/book/src/SUMMARY.md
+++ b/book/src/SUMMARY.md
@@ -21,6 +21,7 @@
   - [Setup and commitment](./how/commitment.md)
   - [Transcript and instance binding](./how/transcript.md)
   - [The proving protocol](./how/proving/proving.md)
+    - [Field-to-ring evaluation reduction](./how/proving/field-ring-reduction.md)
     - [Opening points and digit-innermost layout](./how/proving/opening-points-layout.md)
     - [Root fold and ring switching](./how/proving/root-fold-ring-switch.md)
     - [Sumcheck stages](./how/proving/sumcheck-stages.md)
diff --git a/book/src/how/proving/field-ring-reduction.md b/book/src/how/proving/field-ring-reduction.md
new file mode 100644
index 000000000..3541b70a3
--- /dev/null
+++ b/book/src/how/proving/field-ring-reduction.md
@@ -0,0 +1,540 @@
+# Field-to-ring evaluation reduction
+
+This page considers one base-field evaluation claim:
+
+$$
+f:\{0,1\}^n\rightarrow F,
+\qquad
+r\in F^n,
+\qquad
+\widetilde f(r)=v.
+$$
+
+Both the polynomial table and the opening point are defined over the base
+field $F$. Akita commits the table through the cyclotomic ring
+
+$$
+R=F[X]/(X^D+1).
+$$
+
+The goal is to turn the multilinear evaluation into a multiplication of two
+ring elements, define that multiplication as a `TraceOpen` operation, and then
+write the same evaluation claim directly as a linear relation on the committed
+fold witness.
+
+Base-field polynomials evaluated at extension-field points are left as a stub
+at the end of the page.
+
+## The evaluation problem
+
+Choose a ring dimension $D=2^d$ and a power-of-two number of positions per
+block. Re-index the polynomial table as
+
+$$
+f[\ell,p,b],
+$$
+
+where:
+
+- $\ell\in[D]$ is an inner index that will become a ring coefficient;
+- $p$ is a position inside a block; and
+- $b$ is a block index.
+
+Missing entries in a partial final block are public zeros.
+
+Split the opening point in the same order:
+
+$$
+r=(r_{\mathrm{in}},r_{\mathrm{pos}},r_{\mathrm{blk}}).
+$$
+
+Write the corresponding interpolation weights as
+
+$$
+I_\ell,
+\qquad
+Q_p,
+\qquad
+B_b.
+$$
+
+For a multilinear opening in the Lagrange basis, these are equality weights:
+
+$$
+I_\ell=\operatorname{eq}(r_{\mathrm{in}},\ell),
+\qquad
+Q_p=\operatorname{eq}(r_{\mathrm{pos}},p),
+\qquad
+B_b=\operatorname{eq}(r_{\mathrm{blk}},b).
+$$
+
+The evaluation claim is therefore
+
+$$
+\widetilde f(r)
+=
+\sum_{\ell,p,b}I_\ell Q_pB_bf[\ell,p,b].
+\tag{1}
+$$
+
+Akita evaluates the three axes in the order
+
+$$
+\text{position}\longrightarrow\text{block}\longrightarrow\text{inner}.
+$$
+
+## Reduce to a ring-valued evaluation
+
+### Pack the inner axis into ring coefficients
+
+For each position $p$ and block $b$, pack the inner slice into a ring:
+
+$$
+F_{p,b}(X)
+=
+\sum_{\ell=0}^{D-1}f[\ell,p,b]X^\ell
+\in R.
+\tag{2}
+$$
+
+This is only a change of representation. The table entry
+$f[\ell,p,b]$ becomes the coefficient of $X^\ell$.
+
+Equivalently, the values $F_{p,b}$ form a ring-valued multilinear table
+
+$$
+f_R:\{0,1\}^{n-d}\rightarrow R,
+\qquad
+f_R[p,b]:=F_{p,b}.
+$$
+
+This is the same underlying table under a lossless coefficient packing, not a
+new witness. The ring polynomial has $d=\log_2D$ fewer variables and is opened
+at
+
+$$
+r_R=(r_{\mathrm{pos}},r_{\mathrm{blk}}),
+$$
+
+whose base-field coordinates act as constant elements of $R$.
+
+### Evaluate the ring polynomial
+
+First evaluate the position coordinate independently inside every block:
+
+$$
+E_b(X)
+=
+\sum_pQ_pF_{p,b}(X).
+\tag{3}
+$$
+
+The coefficient of $X^\ell$ in $E_b$ is
+
+$$
+[E_b]_\ell
+=
+\sum_pQ_pf[\ell,p,b].
+$$
+
+Next evaluate the block coordinate:
+
+$$
+Y(X)
+=
+\sum_bB_bE_b(X).
+\tag{4}
+$$
+
+Thus Equation (4) is the ring-based evaluation claim
+
+$$
+\boxed{
+\widetilde f_R(r_R)=Y.
+}
+$$
+
+Now
+
+$$
+[Y]_\ell
+=
+\sum_{p,b}Q_pB_bf[\ell,p,b].
+\tag{5}
+$$
+
+Thus $Y$ contains the polynomial after evaluating the position and block
+parts of $r$. Only the inner coordinate remains.
+
+### Pack the inner opening weights
+
+Pack the remaining weights into a second ring:
+
+$$
+P(X)
+=
+\sum_{\ell=0}^{D-1}I_\ell X^\ell.
+\tag{6}
+$$
+
+The two rings have different sources:
+
+| Ring | Derived from | Meaning |
+|---|---|---|
+| $Y$ | $f$, $r_{\mathrm{pos}}$, and $r_{\mathrm{blk}}$ | the polynomial after the two outer folds |
+| $P$ | $r_{\mathrm{in}}$ | the weights for the remaining inner fold |
+
+Using Equation (5), the original evaluation can already be written as
+
+$$
+\widetilde f(r)
+=
+\sum_{\ell=0}^{D-1}I_\ell[Y]_\ell.
+\tag{7}
+$$
+
+## Recover the evaluation with `TraceOpen`
+
+Let $\sigma_{-1}$ be the ring automorphism
+
+$$
+\sigma_{-1}(X)=X^{-1}.
+$$
+
+For any $Z\in R$, define
+
+$$
+\boxed{
+\operatorname{TraceOpen}_P(Z)
+:=
+\left[Z(X)\sigma_{-1}(P(X))\right]_0,
+}
+\tag{8}
+$$
+
+where $[\cdot]_0$ denotes the constant coefficient in
+$F[X]/(X^D+1)$.
+
+If
+
+$$
+Z(X)=\sum_\ell[Z]_\ell X^\ell,
+$$
+
+then the matching terms in $Z\sigma_{-1}(P)$ are
+
+$$
+[Z]_\ell X^\ell\cdot I_\ell X^{-\ell}
+=
+[Z]_\ell I_\ell.
+$$
+
+They contribute to the constant coefficient, giving
+
+$$
+\operatorname{TraceOpen}_P(Z)
+=
+\sum_{\ell=0}^{D-1}[Z]_\ell I_\ell.
+\tag{9}
+$$
+
+Applying this definition to $Y$ and using Equation (7),
+
+$$
+\operatorname{TraceOpen}_P(Y)
+=
+\sum_\ell[Y]_\ell I_\ell
+=
+\widetilde f(r).
+\tag{10}
+$$
+
+Therefore:
+
+$$
+\boxed{
+\widetilde f(r)=v
+\quad\Longleftrightarrow\quad
+\operatorname{TraceOpen}_P(Y)=v.
+}
+\tag{11}
+$$
+
+`TraceOpen` is a coefficient pairing. It is not the univariate evaluation
+$Y(\alpha)$ used to reduce ring-valued relations to the field.
+
+## Eliminate the intermediate ring evaluation $Y$
+
+### Hachi: expose $Y$
+The baseline Hachi protocol exposes $Y$ and checks two statements:
+
+$$
+Y=\sum_bB_bE_b,
+\tag{12}
+$$
+
+and
+
+$$
+\operatorname{TraceOpen}_P(Y)=v.
+\tag{13}
+$$
+
+The first statement proves that $Y$ is the correct evaluation of the
+ring-valued polynomial. In this fold, each $E_b(X)$ is digit-decomposed into
+the committed partial-evaluation witness:
+
+$$
+E_b(X)
+=
+\sum_hG_h\hat e_{b,h}(X),
+\tag{14}
+$$
+
+where $\hat e_{b,h}$ are the digit rings and $G_h$ are public gadget weights.
+Substituting this decomposition into Equation (12) gives
+
+$$
+\boxed{
+Y(X)
+=
+\sum_{b,h}B_bG_h\hat e_{b,h}(X).
+}
+\tag{15}
+$$
+
+Equation (15) is a relation over the ring that enforces consistency between
+the ring element $Y$ and the witness polynomials $\hat e_{b,h}(X)$. Hachi
+sends $Y$ to the verifier, which checks Equation (13) directly. The prover
+then proves Equation (15) using the same ring-relation machinery as the other
+constraints that bind the previous witness to the next witness, as described
+in Section 2.5.2.
+
+### Akita: compose the two checks
+
+Akita's crucial observation is that $Y$ is already determined linearly by the
+committed partial-evaluation witness and that
+$\operatorname{TraceOpen}_P$ is itself a linear map. Sending $Y$ would
+therefore introduce a redundant ring element, an extra interface between the
+two checks, and additional verifier work. Akita instead composes the two
+linear maps and applies `TraceOpen` directly to Equation (15):
+
+$$
+\begin{aligned}
+v
+&=
+\operatorname{TraceOpen}_P(Y)\\
+&=
+\sum_{b,h}B_bG_h
+\operatorname{TraceOpen}_P(\hat e_{b,h}).
+\end{aligned}
+\tag{16}
+$$
+
+Write each digit ring as
+
+$$
+\hat e_{b,h}(X)
+=
+\sum_{\ell=0}^{D-1}\hat e_{b,h,\ell}X^\ell
+$$
+
+and define the public inner trace weight
+
+$$
+J_\ell
+:=
+\operatorname{TraceOpen}_P(X^\ell).
+\tag{17}
+$$
+
+By linearity,
+
+$$
+\operatorname{TraceOpen}_P(\hat e_{b,h})
+=
+\sum_\ell\hat e_{b,h,\ell}J_\ell.
+$$
+
+Equation (16) becomes the direct evaluation-consistency relation
+
+$$
+\boxed{
+v
+=
+\sum_{b,h,\ell}
+\hat e_{b,h,\ell}B_bG_hJ_\ell.
+}
+\tag{18}
+$$
+
+In the base-field setting, Equation (9) gives
+
+$$
+J_\ell
+=
+\operatorname{TraceOpen}_P(X^\ell)
+=
+I_\ell.
+\tag{19}
+$$
+
+Thus every factor in Equation (18) has a simple role:
+
+- $G_h$ recomposes the digit planes;
+- $B_b$ evaluates across blocks; and
+- $J_\ell=I_\ell$ evaluates inside the packed ring.
+
+This row acts on the committed partial-evaluation digits $\hat e$. The other
+fold relations bind those digits back to the original committed polynomial.
+
+The two possible protocol views are:
+
+```text
+Expose Y:
+
+committed ê  ──recompose──>  E_b  ──block fold──>  Y
+                                                    │
+                                                 TraceOpen
+                                                    │
+                                                    v
+
+Eliminate Y:
+
+committed ê  ───────composed public linear map──────>  v
+```
+
+## Express the direct relation as a sumcheck claim
+
+The committed fold witness is stored as one flat table $w$. Flatten the
+indices $(b,h,\ell)$ into a Boolean address $x$, and define the public
+weight function
+
+$$
+T(x)
+=
+\begin{cases}
+B_bG_hJ_\ell,
+&\text{if }x\text{ addresses the coefficient }\hat e_{b,h,\ell},\\
+0,
+&\text{if }x\text{ lies outside the }\hat e\text{ segment.}
+\end{cases}
+\tag{20}
+$$
+
+Then Equation (18) is
+
+$$
+\boxed{
+v
+=
+\sum_{x\in\{0,1\}^{\mu}}w(x)T(x).
+}
+\tag{21}
+$$
+
+This is the evaluation-correctness relation consumed by the later sumcheck
+protocol. It is already a field-valued linear relation on the committed
+witness. It therefore needs neither evaluation at $\alpha$ nor a ring-switch
+quotient.
+
+
+[Sumcheck stages](./sumcheck-stages.md#add-the-opening-claim-consistency)
+explains how this claim is row-batched and fused with the other Stage-2 terms.
+
+## Code reference
+
+The base-field path follows the reduction above:
+
+1. **Prepare the opening weights.**
+   [`prepare_opening_point`](https://github.com/LayerZero-Labs/akita/blob/b104dae6c672f406b676b04c47e00f4249669ba5/crates/akita-types/src/proof/batch.rs#L687-L750)
+   constructs $Q_p$, $B_b$, and $P$.
+2. **Evaluate the ring polynomial.**
+   [`evaluate_claims_at_prepared_point`](https://github.com/LayerZero-Labs/akita/blob/b104dae6c672f406b676b04c47e00f4249669ba5/crates/akita-prover/src/protocol/core/fold_kernels.rs#L61-L89)
+   returns the position-folded rings $E_b$ and the temporary ring $Y$.
+3. **Recover the scalar evaluation.**
+   [`scalar_opening_from_folded_ring`](https://github.com/LayerZero-Labs/akita/blob/b104dae6c672f406b676b04c47e00f4249669ba5/crates/akita-prover/src/protocol/core/fold_kernels.rs#L224-L274)
+   computes $\operatorname{TraceOpen}_P(Y)$.
+4. **Prepare the trace factors.**
+   [`prepare_evaluation_trace_group_parameters`](https://github.com/LayerZero-Labs/akita/blob/b104dae6c672f406b676b04c47e00f4249669ba5/crates/akita-types/src/trace_weight/evaluation_trace.rs#L162-L269)
+   prepares the block point underlying $B_b$, the gadget weights $G_h$, and
+   the inner trace weights $J_\ell$.
+5. **Construct the trace weights.**
+   [`build_evaluation_trace_weights`](https://github.com/LayerZero-Labs/akita/blob/b104dae6c672f406b676b04c47e00f4249669ba5/crates/akita-prover/src/protocol/sumcheck/relation_range_image/evaluation_trace.rs#L101-L168)
+   combines those factors with the claim coefficients and physical $\hat e$
+   locations to construct $T(x)$.
+6. **Fuse the Stage-2 relation.**
+   [`accumulate_fused_relation_trace`](https://github.com/LayerZero-Labs/akita/blob/b104dae6c672f406b676b04c47e00f4249669ba5/crates/akita-prover/src/protocol/sumcheck/relation_range_image/mod.rs#L281-L300)
+   adds the trace relation to the fused Stage-2 sumcheck.
+
+The main data flow is:
+
+```text
+opening point r
+      |
+      v
+PreparedOpeningPoint { Q_p, B_b, P }
+      |
+      v
+OpeningFoldOutput
+|-- folded: [E_b] -- digit decomposition --> e_hat in witness w
+`-- eval: Y ------- TraceOpen_P ----------> v_tr
+                                                  |
+                                                  v
+PreparedFold
+|-- evaluation_trace_claim: v_tr
+|-- evaluation_trace_points: prepared opening points
+|-- evaluation_trace_claim_coefficients: c_q
+`-- witness: contains E_b and e_hat
+      |
+      v
+prepare_evaluation_trace_group_parameters
+      |
+      `-- public factors B_b, G_h, J_l
+                         |
+                         v
+build_evaluation_trace_weights
+      |
+      `-- T(x) on the committed e_hat segment
+                         |
+                         v
+accumulate_fused_relation_trace
+      |
+      `-- Stage 2 proves v_tr = sum_x w(x) T(x)
+```
+
+The main values are:
+
+| Code value | Mathematical object |
+|---|---|
+| `PreparedOpeningPoint::ring_opening_point.position_weights` | $Q_p$ |
+| `PreparedOpeningPoint::ring_opening_point.live_block_weights` | $B_b$ |
+| `PreparedOpeningPoint::packed_inner_point` | $P(X)$ |
+| `OpeningFoldOutput::folded` | $E_0,E_1,\ldots$ |
+| `OpeningFoldOutput::eval` | temporary $Y(X)$ |
+| `PreparedEvaluationTraceClaim::claimed_evaluation` | $v_{\mathrm{tr}}=\operatorname{TraceOpen}_P(Y)$ |
+| `PreparedEvaluationTraceClaim::claim_coefficients` | claim-batching coefficients $c_q$ |
+| `RingRelationGroupWitness::e_folded` | position-folded rings $E_b$ |
+| `RingRelationGroupWitness::e_hat` | digit rings $\hat e_{b,h}(X)$ |
+| `PreparedFold::evaluation_trace_claim` | $v_{\mathrm{tr}}$ carried into Stage 2 |
+| `PreparedFold::evaluation_trace_points` | prepared $P$, $Q$, and $B$ for each group |
+| `PreparedFold::evaluation_trace_claim_coefficients` | $c_q$ carried into trace-weight construction |
+| `EvaluationTraceGroupParameters::block_opening_point` | block point from which $B_b$ is evaluated |
+| `EvaluationTraceGroupParameters::opening_digit_weights` | $G_h$ |
+| `EvaluationTraceGroupParameters::inner_trace` | $J_\ell$, equal to $I_\ell$ in the base-field case |
+| `EvaluationTraceWeights` | $T(x)$ |
+
+The temporary ring $Y$ is used only to compute $v_{\mathrm{tr}}$; it is not
+stored in `PreparedFold` or sent to the verifier. Stage 2 instead proves
+
+$$
+v_{\mathrm{tr}}
+=
+\sum_x w(x)T(x)
+$$
+
+directly from the committed digit witness.
+
+## Base-field polynomial at an extension-field point
+
+> **Status:** stub.
diff --git a/book/src/how/proving/sumcheck-stages.md b/book/src/how/proving/sumcheck-stages.md
index 3ba7d7be3..b398cc0e6 100644
--- a/book/src/how/proving/sumcheck-stages.md
+++ b/book/src/how/proving/sumcheck-stages.md
@@ -1,15 +1,657 @@
 # Sumcheck stages
 
-> **Status:** stub. Part of the initial Akita Book scaffold.
+Every non-terminal Akita fold runs a short sumcheck cascade over the fold
+witness:
 
-The fused sumcheck that proves one fold: stage 1 (the digit range check on the
-balanced witness), stage 2 (the fused relation sumcheck), and the optional
-stage 3 (the setup product sumcheck used by verifier offloading). How they batch
-and schedule together.
+1. **Stage 1 — digit range check.** Proves that every witness entry is a valid
+   balanced digit and outputs one evaluation of the virtual range-image table.
+2. **Stage 2 — fused relation sumcheck.** Proves the ring-switched fold
+   relation and binds both Stage 1's virtual range-image value and the opening
+   claim carried into the fold to the committed witness; the resulting witness
+   evaluation becomes the next opening claim.
+3. **Stage 3 — setup product sumcheck.** Optionally carries a recursive setup
+   contribution together with the next opening.
 
-**Sources to fold in**
+This chapter explains the Stage-1 range protocol and the Stage-2 fused
+relation protocol in detail. Stage 3 is summarized at the end. The terminal
+fold, which runs none of these sumchecks, is covered in
+[The proving protocol](./proving.md).
 
-- `crates/akita-prover/src/protocol/sumcheck/digit_range/`, `akita_stage2/`, and `two_round_prefix/`.
-- `crates/akita-verifier/src/stages/`.
-- Paper §3.5 (`fig:akita-sumcheck`), §3.5.1 `sec:akita-range-check` (optimized digit range check), §4.3 `sec:claim-reduction` (setup product sumcheck).
-- `specs/packed-sumcheck.md`, `specs/setup-product-sumcheck.md`.
+## Stage 1: digit range check
+
+### What it certifies
+
+Let
+
+$$
+w:\{0,1\}^{n}\rightarrow\mathbb{F}
+$$
+
+be the balanced-digit table of the newly committed witness. The level chooses
+one basis
+
+$$
+b\in\{4,8,16,32,64\},
+$$
+
+and every Boolean entry must lie in
+
+$$
+\mathcal{A}_b
+=
+\left\{-\frac b2,\ldots,\frac b2-1\right\}.
+$$
+
+This range bound keeps the recursive witness norm under control.
+
+### The simplest sound design
+
+The direct vanishing polynomial for the balanced alphabet is
+
+$$
+D_b(W)
+=
+\prod_{a\in\mathcal{A}_b}(W-a).
+$$
+
+A Boolean entry is valid exactly when $D_b(w(x))=0$. Checking only the
+unweighted sum of these values would not be sound, because nonzero violations
+could cancel. Instead, the protocol anchors the table at a random equality
+point $\tau$ and proves
+
+$$
+0
+=
+\sum_{x\in\{0,1\}^{n}}
+\operatorname{eq}(\tau,x)\,D_b(w(x)).
+$$
+
+The right-hand side is a random evaluation of the multilinear extension of
+the Boolean violation table. An equality-factored sumcheck proves this identity
+one variable at a time; see
+[Equality-factored sum-check](../../foundations/eq-factored-sumcheck.md).
+
+This design is simple, but $D_b$ has degree $b$. Akita represents the same
+condition with a degree-$b/2$ polynomial before deciding whether a product
+tree is needed.
+
+### Reduce the degree with the range image
+
+Pair the positive digit $k$ with the negative digit $-(k+1)$:
+
+$$
+(W-k)(W+k+1)
+=
+W(W+1)-k(k+1).
+$$
+
+Define the pointwise **range image**
+
+$$
+S(x)
+=
+\operatorname{range\_image}(w(x))
+=
+w(x)\bigl(w(x)+1\bigr)
+$$
+
+and roots
+
+$$
+c_k=k(k+1),
+\qquad
+0\le k<\frac b2.
+$$
+
+The direct polynomial factors as
+
+$$
+D_b(W)
+=
+\prod_{k=0}^{b/2-1}\left(W(W+1)-c_k\right)
+=
+R_b\bigl(W(W+1)\bigr),
+$$
+
+where
+
+$$
+R_b(T)
+=
+\prod_{k=0}^{b/2-1}(T-c_k).
+$$
+
+Thus $w(x)\in\mathcal{A}_b$ exactly when $R_b(S(x))=0$. Stage 1 starts from
+the anchored zero claim
+
+$$
+0
+=
+\sum_{x\in\{0,1\}^{n}}
+\operatorname{eq}(\tau_0,x)\,R_b(S(x)).
+$$
+
+The table $S$ is virtual: it is not committed and is not appended to the
+recursive witness. Stage 1 proves the range identity for $S$; Stage 2 later
+proves that its final evaluation comes from $w(x)(w(x)+1)$ on the committed
+witness.
+
+## The complete Stage-1 protocol
+
+### Quartic leaves and product substages
+
+For basis $4$ or $8$, $R_b$ has degree at most four and one
+equality-factored sumcheck proves the anchored identity directly.
+
+For larger bases, the protocol partitions the roots into consecutive groups of
+at most four:
+
+$$
+L_\ell(T)
+=
+\prod_{k=4\ell}^{\min(4\ell+3,\,b/2-1)}
+(T-c_k).
+$$
+
+Their product is $R_b$. Each $L_\ell$ is quartic except at basis $4$, where
+the only leaf is quadratic. Product substages prove how these leaves combine,
+using only arity-$2$ or arity-$4$ products. The topology is fixed by
+[`DigitRangePlan`](https://github.com/LayerZero-Labs/akita/blob/b104dae6c672f406b676b04c47e00f4249669ba5/crates/akita-types/src/proof/stage1.rs#L179-L400):
+
+| Basis | Product substages | Final leaf |
+|---:|---|---|
+| 4 | none | one quadratic leaf |
+| 8 | none | one quartic leaf |
+| 16 | arity 2, emitting 2 child claims | batch of 2 quartic leaves |
+| 32 | arity 4, emitting 4 child claims | batch of 4 quartic leaves |
+| 64 | arity 2, emitting 2 claims; then arity 4, emitting 8 claims | batch of 8 quartic leaves |
+
+### One product substage
+
+Suppose the current substage has parent tables $P_i$, and each parent is the
+pointwise product of $a$ child tables:
+
+$$
+P_i(x)
+=
+\prod_{j=0}^{a-1}C_{i,j}(x),
+\qquad a\in\{2,4\}.
+$$
+
+Let $\xi$ be the current equality point and $\lambda_i$ the current parent
+weights. The carried claim is
+
+$$
+v
+=
+\sum_i\lambda_i\,\widetilde{P_i}(\xi).
+\tag{1}
+$$
+
+The product substage proves
+
+$$
+v
+=
+\sum_{x\in\{0,1\}^{n}}
+\operatorname{eq}(\xi,x)
+\sum_i\lambda_i
+\prod_{j=0}^{a-1}C_{i,j}(x).
+$$
+
+At the sumcheck's sampled point $r$, the prover supplies the child evaluations
+
+$$
+u_{i,j}
+=
+\widetilde{C_{i,j}}(r)
+$$
+
+in canonical order. The verifier closes the substage against
+
+$$
+\operatorname{eq}(\xi,r)
+\sum_i\lambda_i
+\prod_{j=0}^{a-1}u_{i,j}.
+$$
+
+The protocol then:
+
+1. absorbs the child evaluations in canonical order;
+2. samples a fresh interstage challenge $\gamma$;
+3. assigns weights $1,\gamma,\gamma^2,\ldots$ in that same order;
+4. batches the child evaluations into the next carried claim; and
+5. uses $r$ as the equality point for the next substage.
+
+Let the canonical order of the $m$ child nodes be
+$C_0,C_1,\ldots,C_{m-1}$, and write their evaluations at $r$ as
+$u_h=\widetilde{C_h}(r)$. The child node in position $h$ receives weight
+$\gamma^h$, so both parties derive the next claim from the absorbed child
+claims and the transcript challenge:
+
+$$
+v_{\mathsf{next}}
+=
+\sum_{h=0}^{m-1}\gamma^h u_h
+=
+u_0+\gamma u_1+\gamma^2u_2+\cdots.
+$$
+
+For the next substage, these canonically ordered child nodes become the new
+parent nodes. Set its equality point to $r$ and its parent weights to
+$\lambda_h=\gamma^h$. The carried claim is therefore
+
+$$
+v_{\mathsf{next}}
+=
+\sum_{h=0}^{m-1}\lambda_h\,\widetilde{C_h}(r).
+\tag{2}
+$$
+
+Equation (2) has the same form as Equation (1), the carried claim proved by
+each product substage. In other words,
+the handoff substitutes $P_i\leftarrow C_h$, $\xi\leftarrow r$, and
+$\lambda_i\leftarrow\gamma^h$ in the product-substage claim above.
+
+At the root there is one parent with weight $1$ and claim $0$. Each product
+substage expands the current parents into their children; the fresh powers of
+$\gamma$ compress those child claims back into one claim for the next
+substage. The prover and verifier follow the same transcript order
+([`digit_range/mod.rs:230`](https://github.com/LayerZero-Labs/akita/blob/b104dae6c672f406b676b04c47e00f4249669ba5/crates/akita-prover/src/protocol/sumcheck/digit_range/mod.rs#L230-L299),
+[`stage1.rs:167`](https://github.com/LayerZero-Labs/akita/blob/b104dae6c672f406b676b04c47e00f4249669ba5/crates/akita-verifier/src/stages/stage1.rs#L161-L252)).
+
+### The final leaf
+
+After all product substages, let $\xi$ be the current equality point, $v$ the
+current batched claim, and $\lambda_\ell$ the current leaf weights. Define
+
+$$
+B(T)
+=
+\sum_\ell\lambda_\ell L_\ell(T).
+$$
+
+The final equality-factored sumcheck proves
+
+$$
+v
+=
+\sum_{x\in\{0,1\}^{n}}
+\operatorname{eq}(\xi,x)\,B(S(x)).
+$$
+
+For bases $8$, $16$, $32$, and $64$, $B$ is quartic. For basis $4$, it is
+quadratic. When there is no product substage, $v=0$, $\xi=\tau_0$, and
+$B=R_b$.
+
+At the final sampled point $r_{\mathsf{range}}$, the proof carries
+
+$$
+\mathsf{range\_image\_evaluation}
+=
+\widetilde S(r_{\mathsf{range}})
+=
+\sum_{x\in\{0,1\}^{n}}
+\operatorname{eq}(r_{\mathsf{range}},x)\,
+w(x)\bigl(w(x)+1\bigr).
+$$
+
+The verifier closes the leaf against
+
+$$
+\operatorname{eq}(\xi,r_{\mathsf{range}})
+B\bigl(\mathsf{range\_image\_evaluation}\bigr).
+$$
+
+The distinction between the Boolean table and its MLE matters:
+
+$$
+\widetilde S(r)
+\neq
+\widetilde w(r)\bigl(\widetilde w(r)+1\bigr)
+$$
+
+in general. The equality $S(x)=w(x)(w(x)+1)$ holds at Boolean vertices, but
+multilinear extension does not commute with the quadratic map away from those
+vertices. The proof therefore carries the independent
+`range_image_evaluation` field
+([`levels.rs:20`](https://github.com/LayerZero-Labs/akita/blob/b104dae6c672f406b676b04c47e00f4249669ba5/crates/akita-types/src/proof/levels.rs#L20-L25)).
+
+### Domain and challenge order
+
+Stage 1 views the digits as one flat Boolean table. The live witness occupies a
+prefix; every remaining address is public zero padding. Zero is a valid
+balanced digit, so padded entries also satisfy the range polynomial.
+
+Ring switching supplies $\tau_0$ in column-then-ring order, while the flat
+table binds variables in increasing physical-address-bit order. The protocol
+reorders the point so that ring-slot coordinates come first, followed by
+column coordinates
+([`stage1.rs:19`](https://github.com/LayerZero-Labs/akita/blob/b104dae6c672f406b676b04c47e00f4249669ba5/crates/akita-types/src/proof/stage1.rs#L19-L170)).
+
+### The verifier
+
+The verifier replays the same product substages, derives the same interstage
+challenges and weights, checks each child-product claim, and closes the final
+leaf at `range_image_evaluation`
+([`stage1.rs:167`](https://github.com/LayerZero-Labs/akita/blob/b104dae6c672f406b676b04c47e00f4249669ba5/crates/akita-verifier/src/stages/stage1.rs#L161-L252)).
+
+Passing Stage 1 proves that the range-tree claims are internally consistent and
+reduces the final leaf to `range_image_evaluation`. It does **not** by itself
+tie that virtual value to the committed witness.
+
+
+## Stage 2: fused relation sumcheck
+
+Stage 2 proves three statements about the same committed digit witness $w$:
+
+1. $w$ satisfies the ring-switched fold relation;
+2. Stage 1's virtual range-image value is correctly derived from $w(w+1)$; and
+3. the opening claim for this fold is consistent with $w$.
+
+The protocol fuses all three statements into one sumcheck. We first isolate
+the fold-relation term to make its matrix-row dimension explicit, then
+incorporate the range-image and opening-consistency terms.
+
+### Start with the ring relation
+
+Let $w_j(X)$ be the $j$-th ring element encoded by the digit witness, and let
+row $i$ of the extended fold relation be
+
+$$
+\sum_j M_{i,j}(X)w_j(X)=h_i(X).
+\tag{3}
+$$
+
+The extended relation includes the quotient witness, so Equation (3) is an
+equality rather than a congruence modulo a ring polynomial. The public right
+side $h_i$ is zero for some rows and contains the public data
+for the remaining rows.
+
+Ring switching samples one field element $\alpha$ and evaluates every ring
+polynomial at that point:
+
+$$
+\sum_j M_{i,j}(\alpha)w_j(\alpha)=h_i(\alpha).
+\tag{4}
+$$
+
+The scalar $\alpha$ removes the ring-coefficient dimension from the algebraic
+relation. It is not a Boolean sumcheck point.
+
+### Batch the matrix rows
+
+Suppose the relation has rows indexed by $i$. The protocol samples a Boolean
+MLE point $\tau_1$ of sufficient width for that row domain and defines
+
+$$
+\beta_i=\operatorname{eq}(\tau_1,i).
+$$
+
+It takes the random linear combination of Equation (4) over all rows. Define
+
+$$
+m_j
+=
+\sum_i\beta_iM_{i,j}(\alpha)
+\qquad\text{and}\qquad
+h_{\tau}
+=
+\sum_i\beta_i h_i(\alpha).
+$$
+
+The batched relation is the single scalar claim
+
+$$
+\sum_j m_jw_j(\alpha)=h_{\tau}.
+\tag{5}
+$$
+
+This is where the matrix-row dimension goes. It is contracted by $\tau_1$
+before Stage 2 starts its witness-address sumcheck. Consequently, the Stage-2
+sumcheck point has no matrix-row coordinate.
+
+
+Stage 2 proves the relation for this batched row. Soundness comes from the fact
+that $\tau_1$ was sampled after the witness was committed: a false collection
+of rows cannot generally arrange for its random multilinear combination to
+vanish.
+
+### Expand the ring elements into one flat witness
+
+For the moment, suppose every witness ring element has $D$ coefficients:
+
+$$
+w_j(X)=\sum_{k=0}^{D-1}w_{j,k}X^k.
+$$
+
+Evaluating at $\alpha$ gives
+
+$$
+w_j(\alpha)=\sum_{k=0}^{D-1}w_{j,k}\alpha^k.
+$$
+
+Substituting this into Equation (5) yields
+
+$$
+h_{\tau}
+=
+\sum_{j,k}w_{j,k}\,\alpha^k m_j.
+\tag{6}
+$$
+
+Now view $(j,k)$ as one flat Boolean address $x$. The low bits select the
+coefficient $k$ and the remaining bits select the witness lane $j$. Define
+
+$$
+A(k)=\alpha^k,
+\qquad
+L(j)=m_j.
+$$
+
+The relation weight factors as
+
+$$
+R(k,j)=A(k)L(j),
+$$
+
+so Equation (6) becomes
+
+$$
+h_{\tau}
+=
+\sum_{x\in\{0,1\}^n}w(x)R(x).
+\tag{7}
+$$
+
+The Boolean domain is padded with zeros when the live witness length is not a
+power of two.
+
+The production protocol also permits different ring dimensions in different
+parts of the relation. It chooses the largest power-of-two coefficient block
+common to every role and to the outgoing witness. The low address still
+selects a coefficient inside that common block. Any remaining high power of
+$\alpha$, together with the matrix entry and its $\beta_i$ row weight, is
+absorbed into the lane weight $L$. Thus the exact factorization $R=A\cdot L$
+continues to hold without adding another sumcheck dimension.
+
+### Add the range-image binding
+
+Let $r_1$ be the final point produced by Stage 1, and let $s_1$ be the
+`range_image_evaluation` carried by its proof. Stage 1 established a claim
+about a virtual table. Stage 2 must connect that table to the committed
+witness by proving
+
+$$
+s_1
+=
+\sum_x
+\operatorname{eq}(r_1,x)w(x)\bigl(w(x)+1\bigr).
+\tag{8}
+$$
+
+This is a sum over Boolean addresses. It does not claim that
+$s_1=\widetilde w(r_1)(\widetilde w(r_1)+1)$, which is generally false.
+
+After absorbing $s_1$, the transcript samples a fresh scalar $\gamma$. The
+protocol uses $\gamma$ to batch Equation (8) with the relation claim.
+
+### Add the opening claim consistency
+
+Stage 2 also verifies the incoming opening claim $v_{\mathrm{tr}}$ against the
+committed witness $w$. [Field-to-ring evaluation
+reduction](./field-ring-reduction.md) derives the public trace weight $T(x)$
+and establishes the evaluation-consistency relation
+
+$$
+v_{\mathrm{tr}}=\sum_x w(x)T(x).
+\tag{9}
+$$
+
+Here we focus only on how this relation is fused into Stage 2. Equation (9)
+has the same linear form in $w$ as a row of the ring-switched relation, so the
+protocol treats it as a **virtual row** placed immediately after the physical
+relation rows. If $i_{\mathrm{tr}}$ is that row's index in the padded row
+domain, the shared row challenge $\tau_1$ assigns it the weight
+
+$$
+\beta_{\mathrm{tr}}
+=
+\operatorname{eq}(\tau_1,i_{\mathrm{tr}}).
+$$
+
+The virtual row is not inserted into the physical matrix or its
+relation-weight factorization. Only its batching weight
+$\beta_{\mathrm{tr}}$ comes from the row domain. Stage 2 directly fuses
+
+$$
+\beta_{\mathrm{tr}}v_{\mathrm{tr}}
+=
+\sum_x\beta_{\mathrm{tr}}w(x)T(x)
+$$
+
+into the sumcheck over the flat witness address $x$. In this way, the opening
+claim reuses the same row randomness $\tau_1$ as the ring-switched relation
+without becoming a physical matrix row.
+
+### The fused Stage-2 claim
+
+Combining Equations (7), (8), and (9), the input claim is
+
+$$
+C_0
+=
+\gamma s_1+h_{\tau}+\beta_{\mathrm{tr}}v_{\mathrm{tr}}.
+$$
+
+Stage 2 proves
+
+$$
+\begin{aligned}
+C_0
+=\sum_x \bigl[{}
+&\gamma\operatorname{eq}(r_1,x)
+  w(x)\bigl(w(x)+1\bigr)\\
+&+w(x)A(k(x))L(j(x))\\
+&+\beta_{\mathrm{tr}}w(x)T(x)
+\bigr].
+\end{aligned}
+\tag{10}
+$$
+
+All three terms use the same flat witness address $x$. This is why they can be
+proved by one sumcheck.
+
+### Sumcheck rounds and the final point
+
+Let $P(X)$ denote the multilinear-polynomial expression inside the brackets in
+Equation (10). In round $t$, after challenges
+$r_{2,0},\ldots,r_{2,t-1}$ have been sampled, the prover sends
+
+$$
+g_t(Z)
+=
+\sum_{x_{t+1},\ldots,x_{n-1}\in\{0,1\}}
+P(r_{2,0},\ldots,r_{2,t-1},Z,x_{t+1},\ldots,x_{n-1}).
+$$
+
+The verifier checks
+
+$$
+g_t(0)+g_t(1)=C_t,
+$$
+
+samples the next coordinate $r_{2,t}$, and sets
+
+$$
+C_{t+1}=g_t(r_{2,t}).
+$$
+
+After all $n$ rounds, these coordinates form the flat witness point
+
+$$
+r_2=(r_{2,0},\ldots,r_{2,n-1}).
+$$
+
+Split it according to the flat address as
+
+$$
+r_2=(r_{\mathrm{coeff}},r_{\mathrm{lane}}).
+$$
+
+The verifier closes the sumcheck against
+
+$$
+\begin{aligned}
+C_n={}
+&\gamma\operatorname{eq}(r_1,r_2)
+  \widetilde w(r_2)\bigl(\widetilde w(r_2)+1\bigr)\\
+&+\widetilde w(r_2)
+  \widetilde A(r_{\mathrm{coeff}})
+  \widetilde L(r_{\mathrm{lane}})\\
+&+\beta_{\mathrm{tr}}\widetilde w(r_2)\widetilde T(r_2).
+\end{aligned}
+\tag{11}
+$$
+
+The value $\widetilde w(r_2)$ becomes the next-witness opening claim. The
+range term has degree three in each sumcheck variable: one degree from the
+equality polynomial and two from $w(w+1)$. The relation and trace terms each
+have degree two. Therefore Stage 2 sends degree-three round polynomials.
+
+The random objects have separate jobs:
+
+| Object | Shape | What it removes or binds |
+|---|---|---|
+| $\alpha$ | one field element | evaluates the ring-polynomial variable $X$ |
+| $\tau_1$ | a point over matrix rows | batches all relation rows into one virtual row |
+| $\gamma$ | one field element | batches range-image consistency with the linear claims |
+| $r_1$ | Stage-1 output point over flat witness addresses | identifies the carried range-image evaluation |
+| $r_2$ | Stage-2 output point over flat witness addresses | reduces the complete fused claim to one witness evaluation |
+
+In particular, $\alpha$, $\tau_1$, and $r_2$ are not coordinates of one larger
+point. They contract three different domains.
+
+### Implementation map
+
+The implementation builds the row weights with
+`eq_tau1.eval_at(row)`, factors the resulting flat relation table into the
+common alpha and lane factors, and evaluates that factorization at $r_2$
+([`relation_weights.rs:442`](https://github.com/LayerZero-Labs/akita/blob/b104dae6c672f406b676b04c47e00f4249669ba5/crates/akita-prover/src/protocol/ring_switch/relation_weights.rs#L442-L520),
+[`relation_weights.rs:234`](https://github.com/LayerZero-Labs/akita/blob/b104dae6c672f406b676b04c47e00f4249669ba5/crates/akita-prover/src/protocol/ring_switch/relation_weights.rs#L234-L310),
+[`ring_switch.rs:627`](https://github.com/LayerZero-Labs/akita/blob/b104dae6c672f406b676b04c47e00f4249669ba5/crates/akita-verifier/src/protocol/ring_switch.rs#L627-L657)).
+Those relation weights stop at the physical fold-consistency, $A$, $B$, and
+$D$ rows. The trace index is the next reserved padded-domain index, but no
+matrix row is created for it. The prover builds its weight function separately
+and adds it directly to the relation weight during the shared witness scan
+([`relation_range_image/mod.rs:281`](https://github.com/LayerZero-Labs/akita/blob/b104dae6c672f406b676b04c47e00f4249669ba5/crates/akita-prover/src/protocol/sumcheck/relation_range_image/mod.rs#L281-L300)).
+The fused identity is implemented by
+[`relation_range_image/mod.rs`](https://github.com/LayerZero-Labs/akita/blob/b104dae6c672f406b676b04c47e00f4249669ba5/crates/akita-prover/src/protocol/sumcheck/relation_range_image/mod.rs#L1-L77).
+
+## Stage 3: recursive setup contribution
+
+When the level uses recursive setup contribution, Stage 3 batches the public
+setup-product claim with Stage 2's next-witness opening. One sumcheck proves
+both claims and returns their evaluations at the resulting projected points.
+Under direct setup contribution, Stage 3 is absent
+([`fold.rs:1079`](https://github.com/LayerZero-Labs/akita/blob/b104dae6c672f406b676b04c47e00f4249669ba5/crates/akita-prover/src/protocol/core/fold.rs#L671-L731)).

From 975be12556273de08882bd68f5809ee756af651e Mon Sep 17 00:00:00 2001
From: Freya <fengrun.liu@gmail.com>
Date: Thu, 30 Jul 2026 17:10:33 -0400
Subject: [PATCH 02/17] akita-book: ring relation

---
 book/src/SUMMARY.md                          |   1 +
 book/src/how/proving/akita-fold.md           | 523 +++++++++++++++++++
 book/src/how/proving/field-ring-reduction.md |   2 +-
 book/src/how/proving/sumcheck-stages.md      |   4 +
 4 files changed, 529 insertions(+), 1 deletion(-)
 create mode 100644 book/src/how/proving/akita-fold.md

diff --git a/book/src/SUMMARY.md b/book/src/SUMMARY.md
index 4ebebeab7..96e7b761c 100644
--- a/book/src/SUMMARY.md
+++ b/book/src/SUMMARY.md
@@ -22,6 +22,7 @@
   - [Transcript and instance binding](./how/transcript.md)
   - [The proving protocol](./how/proving/proving.md)
     - [Field-to-ring evaluation reduction](./how/proving/field-ring-reduction.md)
+    - [Ring relation in an Akita fold](./how/proving/akita-fold.md)
     - [Opening points and digit-innermost layout](./how/proving/opening-points-layout.md)
     - [Root fold and ring switching](./how/proving/root-fold-ring-switch.md)
     - [Sumcheck stages](./how/proving/sumcheck-stages.md)
diff --git a/book/src/how/proving/akita-fold.md b/book/src/how/proving/akita-fold.md
new file mode 100644
index 000000000..1d22cf7a6
--- /dev/null
+++ b/book/src/how/proving/akita-fold.md
@@ -0,0 +1,523 @@
+# Ring relation in an Akita fold
+
+This page describes the ring-valued relations proved by one non-terminal
+Akita fold. The presentation starts with one polynomial group, one opening
+claim, and one common ring dimension:
+
+$$
+R=F[X]/(X^D+1).
+$$
+
+The current implementation also supports multiple polynomial groups,
+multiple claims, chunked witnesses, and different ring dimensions for
+different relation rows. Those extensions change the layout, but not the four
+core relations developed below.
+
+The Akita paper presents a more general matrix with additional compression
+relations. Its basic Greyhound relation motivates the four row families here;
+the current implementation is the source of truth for the rows and witness
+layout documented on this page.
+
+The goal of the fold is to replace the current polynomial blocks by a smaller
+digit witness while proving that the new witness is consistent with:
+
+1. the opening data computed from the old polynomial;
+2. the inner and outer commitments; and
+3. the random fold of the old polynomial blocks.
+
+These statements form the **physical ring relation**. The scalar evaluation
+claim from [Field-to-ring evaluation
+reduction](./field-ring-reduction.md) is a separate field-valued relation. It
+is fused with the physical rows later, but it is not a row of the ring matrix
+described on this page.
+
+## Objects entering the fold
+
+### Polynomial blocks and inner digits
+
+As in the previous page, split the ring-valued polynomial table into blocks.
+Let $b$ index a live block and $p$ a position inside the block. Write the ring
+at that location as
+
+$$
+F_{p,b}(X)\in R.
+$$
+
+Digit-decompose each ring with public inner gadget weights
+$G_a^{\mathrm{in}}$:
+
+$$
+F_{p,b}(X)
+=
+\sum_a G_a^{\mathrm{in}}s_{b,p,a}(X).
+\tag{1}
+$$
+
+For one block, collect all digit rings $s_{b,p,a}$ into a vector
+$\mathbf{s}_b$. The inner commitment matrix $\mathbf A$ maps that vector to
+
+$$
+\mathbf t_b
+=
+\mathbf A\mathbf s_b.
+\tag{2}
+$$
+
+Each coordinate of $\mathbf t_b$ is decomposed again, now with the outer
+gadget weights $G_h^{\mathrm{out}}$:
+
+$$
+t_{b,\rho}(X)
+=
+\sum_hG_h^{\mathrm{out}}\hat t_{b,\rho,h}(X),
+\tag{3}
+$$
+
+where $\rho$ selects a row of $\mathbf A$. Stack the $\hat t$ digits from all
+blocks. The public outer commitment is
+
+$$
+\mathbf u
+=
+\mathbf B\hat{\mathbf t}.
+\tag{4}
+$$
+
+The matrices $\mathbf A$ and $\mathbf B$ therefore serve different purposes:
+$\mathbf A$ creates an inner image for each block, while $\mathbf B$ commits
+the digit-decomposed inner images across all blocks.
+
+### Partial evaluations and opening digits
+
+Let $Q_p$ be the position weight derived from the opening point. For the
+base-field setting of the previous page, $Q_p\in F$ acts as a constant in
+$R$. Evaluate the position coordinate inside each block:
+
+$$
+E_b(X)
+=
+\sum_pQ_pF_{p,b}(X).
+\tag{5}
+$$
+
+Digit-decompose each $E_b$ with the opening gadget weights
+$G_h^{\mathrm{open}}$:
+
+$$
+E_b(X)
+=
+\sum_hG_h^{\mathrm{open}}\hat e_{b,h}(X).
+\tag{6}
+$$
+
+The fold witness contains the digit rings $\hat e$, not a second copy of the
+recomposed $E_b$. To bind those digits, Akita computes an opening commitment
+
+$$
+\mathbf v_D
+=
+\mathbf D\hat{\mathbf e}.
+\tag{7}
+$$
+
+The subscript in $\mathbf v_D$ distinguishes this ring vector from the scalar
+opening target $v_{\mathrm{tr}}$. Equation (7) is a commitment relation; it
+does not prove that the multilinear evaluation equals
+$v_{\mathrm{tr}}$.
+
+### The folded response
+
+After the relevant data is fixed, the transcript samples one sparse
+ring-valued fold challenge $c_b(X)$ for each live block. The prover folds the
+original block digits:
+
+$$
+z_{p,a}(X)
+=
+\sum_b c_b(X)s_{b,p,a}(X).
+\tag{8}
+$$
+
+The coefficients of $z$ are larger than the original digits, so $z$ is
+digit-decomposed once more:
+
+$$
+z_{p,a}(X)
+=
+\sum_fG_f^{\mathrm{fold}}\hat z_{p,a,f}(X).
+\tag{9}
+$$
+
+The three main digit segments produced so far are therefore
+
+$$
+\hat{\mathbf z}
+\;\Vert\;
+\hat{\mathbf e}
+\;\Vert\;
+\hat{\mathbf t}.
+\tag{10}
+$$
+
+They have different origins:
+
+| Segment | What it digit-decomposes | Why it is needed |
+|---|---|---|
+| $\hat{\mathbf z}$ | the challenge-folded block digits $\mathbf z$ | becomes the smaller folded response |
+| $\hat{\mathbf e}$ | the position-folded rings $E_b$ | carries the opening data into the fold |
+| $\hat{\mathbf t}$ | the inner images $\mathbf t_b$ | binds the folded response to the existing commitment |
+
+## The four physical relation families
+
+The verifier must check that the three segments in Equation (10) describe the
+same original polynomial and commitment. Akita expresses the checks as four
+families of linear equations over $R$.
+
+### 1. Fold-evaluation consistency
+
+Fold the recomposed partial evaluations using the same challenges as in
+Equation (8):
+
+$$
+\sum_{b,h}
+c_bG_h^{\mathrm{open}}\hat e_{b,h}.
+\tag{11}
+$$
+
+Alternatively, first fold the original digit blocks into $\hat z$, recompose
+them with Equation (9), and then apply the position weights:
+
+$$
+\sum_{p,a,f}
+Q_pG_a^{\mathrm{in}}G_f^{\mathrm{fold}}\hat z_{p,a,f}.
+\tag{12}
+$$
+
+Both expressions equal $\sum_bc_bE_b$. The first physical row therefore
+checks
+
+$$
+\boxed{
+\sum_{b,h}
+c_bG_h^{\mathrm{open}}\hat e_{b,h}
+=
+\sum_{p,a,f}
+Q_pG_a^{\mathrm{in}}G_f^{\mathrm{fold}}\hat z_{p,a,f}.
+}
+\tag{13}
+$$
+
+This is called the `consistency` row in the code. It binds the partial
+evaluation digits $\hat e$ to the folded response $\hat z$. It does **not**
+contain the scalar opening target $v_{\mathrm{tr}}$.
+
+Notice that this row uses the random fold challenges $c_b$, not the block
+opening weights $B_b$ from the previous page. The $B_b$ weights belong to the
+separate evaluation-correctness relation on $\hat e$.
+
+### 2. Inner-commitment consistency
+
+For every row $\rho$ of $\mathbf A$, fold the corresponding recomposed inner
+images:
+
+$$
+\sum_{b,h}
+c_bG_h^{\mathrm{out}}\hat t_{b,\rho,h}.
+\tag{14}
+$$
+
+By linearity of $\mathbf A$, this must equal row $\rho$ of $\mathbf A$ applied
+to the folded response:
+
+$$
+\sum_{p,a,f}
+A_{\rho,(p,a)}G_f^{\mathrm{fold}}\hat z_{p,a,f}.
+\tag{15}
+$$
+
+Thus every $\mathbf A$ row checks
+
+$$
+\boxed{
+\sum_{b,h}
+c_bG_h^{\mathrm{out}}\hat t_{b,\rho,h}
+=
+\sum_{p,a,f}
+A_{\rho,(p,a)}G_f^{\mathrm{fold}}\hat z_{p,a,f}.
+}
+\tag{16}
+$$
+
+There is no factor $G_a^{\mathrm{in}}$ on the right of Equation (16):
+$\mathbf A$ already acts on the inner digit vector $\mathbf s_b$, whose
+columns are indexed by $(p,a)$.
+
+### 3. Outer-commitment consistency
+
+The $\hat t$ segment must still open the public commitment that entered this
+fold:
+
+$$
+\boxed{
+\mathbf B\hat{\mathbf t}
+=
+\mathbf u.
+}
+\tag{17}
+$$
+
+Unlike Equations (13) and (16), this relation does not use the fold
+challenges. It checks the existing outer commitment directly.
+
+### 4. Opening-commitment consistency
+
+The $\hat e$ segment is bound by the opening commitment from Equation (7):
+
+$$
+\boxed{
+\mathbf D\hat{\mathbf e}
+=
+\mathbf v_D.
+}
+\tag{18}
+$$
+
+This relation also does not use the fold challenges. It prevents the prover
+from changing the partial-evaluation digits after $\mathbf v_D$ has been
+absorbed.
+
+## Assemble the ring relation
+
+Define the pre-switch witness
+
+$$
+\mathbf w_0
+=
+\hat{\mathbf z}
+\;\Vert\;
+\hat{\mathbf e}
+\;\Vert\;
+\hat{\mathbf t}.
+\tag{19}
+$$
+
+The four relation families can be written as one matrix equation
+
+$$
+\boxed{
+\mathbf M_0\mathbf w_0=\mathbf y
+\quad\text{over }R.
+}
+\tag{20}
+$$
+
+For one group, the physical row order and right-hand side are:
+
+| Physical rows | Meaning | Right-hand side |
+|---|---|---|
+| `consistency` | Equation (13) | $0$ |
+| $\mathbf A$ rows | Equation (16) | $\mathbf 0$ |
+| $\mathbf B$ rows | Equation (17) | $\mathbf u$ |
+| $\mathbf D$ rows | Equation (18) | $\mathbf v_D$ |
+
+Consequently,
+
+$$
+\mathbf y
+=
+\mathbf 0
+\;\Vert\;
+\mathbf 0_{\mathbf A}
+\;\Vert\;
+\mathbf u
+\;\Vert\;
+\mathbf v_D.
+\tag{21}
+$$
+
+The matrix is usually not materialized as one dense object. Its entries come
+from the fold challenges, opening weights, gadget weights, and the setup
+matrices $\mathbf A$, $\mathbf B$, and $\mathbf D$. The code generates these
+contributions directly from the canonical witness layout.
+
+## Lift the ring relation before sumcheck
+
+Equation (20) is an equality modulo $X^D+1$. Sumcheck, however, needs a field
+identity. Choose the canonical representatives of degree less than $D$ for
+all ring elements. There is then one quotient polynomial for every physical
+row:
+
+$$
+\widetilde{\mathbf M}_0(X)\widetilde{\mathbf w}_0(X)
+-
+\widetilde{\mathbf y}(X)
+=
+(X^D+1)\mathbf r(X).
+\tag{22}
+$$
+
+Digit-decompose the quotient vector:
+
+$$
+\mathbf r(X)
+=
+\mathbf G_r\hat{\mathbf r}(X),
+\tag{23}
+$$
+
+and append its digits to the committed witness:
+
+$$
+\boxed{
+\mathbf w
+=
+\hat{\mathbf z}
+\;\Vert\;
+\hat{\mathbf e}
+\;\Vert\;
+\hat{\mathbf t}
+\;\Vert\;
+\hat{\mathbf r}.
+}
+\tag{24}
+$$
+
+Move the denominator term to the left and define
+
+$$
+\mathbf M_{\mathrm{ext}}(X)
+=
+\left[
+\widetilde{\mathbf M}_0(X)
+\;\middle|\;
+-(X^D+1)\mathbf G_r
+\right].
+\tag{25}
+$$
+
+The extended relation is the exact polynomial identity
+
+$$
+\boxed{
+\mathbf M_{\mathrm{ext}}(X)\widetilde{\mathbf w}(X)
+=
+\widetilde{\mathbf y}(X).
+}
+\tag{26}
+$$
+
+This distinction is important: Equation (22) uses the quotient
+$\mathbf r$, while Equation (26) already includes the quotient digits
+$\hat{\mathbf r}$ inside $\mathbf w$. The denominator term must not be added
+to the right-hand side a second time.
+
+Ring switching now samples $\alpha$ and evaluates Equation (26):
+
+$$
+\mathbf M_{\mathrm{ext}}(\alpha)\mathbf w(\alpha)
+=
+\mathbf y(\alpha).
+\tag{27}
+$$
+
+Equation (27) is the field relation consumed by Stage 2. The
+[Sumcheck stages](./sumcheck-stages.md#stage-2-fused-relation-sumcheck) page
+explains how $\tau_1$ batches its physical rows and how the resulting relation
+is proved over the flat witness address.
+
+## The scalar opening claim is a virtual row
+
+Two different statements involve $\hat e$, and they should not be conflated:
+
+| Statement | Form | Physical ring row? | Ring-switch quotient? |
+|---|---|---:|---:|
+| opening commitment | $\mathbf D\hat{\mathbf e}=\mathbf v_D$ | yes | yes |
+| evaluation correctness | $\sum_xw(x)T(x)=v_{\mathrm{tr}}$ | no | no |
+
+The second statement is derived in [Field-to-ring evaluation
+reduction](./field-ring-reduction.md#express-the-direct-relation-as-a-sumcheck-claim).
+It is already a linear equation over the field coefficients of the committed
+witness. Akita therefore treats it as an `EvaluationTrace` virtual row after
+the physical rows. It reuses the same row-batching challenge $\tau_1$, but it
+is absent from $\mathbf M_0$, $\mathbf y$, and the quotient vector
+$\mathbf r$.
+
+[Sumcheck stages](./sumcheck-stages.md#stage-2-fused-relation-sumcheck)
+continues from Equation (27) and fuses the physical relation, the virtual
+evaluation row, and the range-image binding into one Stage-2 sumcheck.
+
+## Code reference
+
+The current prover follows the construction above:
+
+1. **Build the partial-evaluation and fold witnesses.**
+   [`RingRelationProver::new`](https://github.com/LayerZero-Labs/akita/blob/eea8443841ed4a701bf84a9f6415aa9415d6250d/crates/akita-prover/src/protocol/ring_relation.rs#L433-L760)
+   decomposes $E_b$ into $\hat e$, computes
+   $\mathbf v_D=\mathbf D\hat{\mathbf e}$, samples the fold challenges, and
+   builds $\mathbf z$.
+2. **Assemble the public relation statement.**
+   [`assemble_relation_rhs`](https://github.com/LayerZero-Labs/akita/blob/eea8443841ed4a701bf84a9f6415aa9415d6250d/crates/akita-types/src/proof/relation.rs#L286-L353)
+   lays out $\mathbf y$ as
+   `consistency | A | B | D`, while
+   [`RingRelationInstance`](https://github.com/LayerZero-Labs/akita/blob/eea8443841ed4a701bf84a9f6415aa9415d6250d/crates/akita-types/src/proof/ring_relation.rs#L82-L220)
+   carries the public challenges, points, and right-hand side.
+3. **Prepare the digit segments.**
+   [`ring_switch_build_w`](https://github.com/LayerZero-Labs/akita/blob/eea8443841ed4a701bf84a9f6415aa9415d6250d/crates/akita-prover/src/protocol/ring_switch/coeffs.rs#L253-L455)
+   extracts $\hat t$ from the commitment hint and prepares
+   $\hat z\Vert\hat e\Vert\hat t$ in the canonical witness layout.
+4. **Compute the row quotients.**
+   [`compute_multi_group_relation_quotient`](https://github.com/LayerZero-Labs/akita/blob/eea8443841ed4a701bf84a9f6415aa9415d6250d/crates/akita-prover/src/protocol/ring_relation/relation_quotient.rs#L412-L690)
+   computes one quotient for each `consistency`, $\mathbf A$, $\mathbf B$, and
+   $\mathbf D$ row. `ring_switch_build_w` decomposes them and appends
+   $\hat r$.
+5. **Evaluate the extended relation.**
+   [`build_relation_weight_events`](https://github.com/LayerZero-Labs/akita/blob/eea8443841ed4a701bf84a9f6415aa9415d6250d/crates/akita-prover/src/protocol/ring_switch/relation_weights.rs#L398-L870)
+   emits the contributions of all four row families and the quotient columns
+   after evaluation at $\alpha$ and batching by $\tau_1$.
+
+The main data flow is:
+
+```text
+old polynomial blocks and commitment hints
+                  |
+                  v
+RingRelationProver::new
+|-- position-folded rings E_b --> e_hat
+|-- inner-image hints ----------> t_hat
+|-- fold challenges ------------> z
+|-- D * e_hat ------------------> v_D
+`-- [0 | 0_A | u | v_D] -------> relation rhs y
+                  |
+                  v
+ring_switch_build_w
+|-- compute_multi_group_relation_quotient --> r
+|-- decompose z ----------------------------> z_hat
+|-- decompose r ----------------------------> r_hat
+`-- emit [z_hat | e_hat | t_hat | r_hat] ---> committed witness w
+                  |
+                  v
+build_relation_weight_events
+`-- M_ext(alpha), row-batched by tau_1 ------> Stage 2
+```
+
+The main code values are:
+
+| Code value | Mathematical object |
+|---|---|
+| `RingRelationGroupWitness::z_folded_rings` | folded response $\mathbf z$ before its final digit decomposition |
+| `RingRelationGroupWitness::e_folded` | position-folded rings $E_b$ |
+| `RingRelationGroupWitness::e_hat` | opening digits $\hat{\mathbf e}$ |
+| `RingRelationGroupWitness::hint` | commitment hint containing $\hat{\mathbf t}$ |
+| `RingRelationInstance::group_challenges()` | fold challenges $c_b$ |
+| `RingRelationInstance::rhs()` | physical right-hand side $\mathbf y$ |
+| `RingRelationInstance::v()` | opening-commitment rows $\mathbf v_D$ |
+| `RelationQuotientOutput` | row quotient vector $\mathbf r$ |
+| `RecursiveWitnessFlat` | flat committed witness $\hat z\Vert\hat e\Vert\hat t\Vert\hat r$ |
+
+With multiple groups, the implementation repeats
+`consistency | A | B` for each group and places the shared `D` rows at the
+end. With a chunked witness, it emits one
+$\hat z_i\Vert\hat e_i\Vert\hat t_i$ ownership unit per chunk followed by one
+shared $\hat r$ tail. The canonical physical layout is described in
+[Opening points and digit-innermost
+layout](./opening-points-layout.md#witness-order).
diff --git a/book/src/how/proving/field-ring-reduction.md b/book/src/how/proving/field-ring-reduction.md
index 3541b70a3..7f4dfc244 100644
--- a/book/src/how/proving/field-ring-reduction.md
+++ b/book/src/how/proving/field-ring-reduction.md
@@ -308,7 +308,7 @@ the ring element $Y$ and the witness polynomials $\hat e_{b,h}(X)$. Hachi
 sends $Y$ to the verifier, which checks Equation (13) directly. The prover
 then proves Equation (15) using the same ring-relation machinery as the other
 constraints that bind the previous witness to the next witness, as described
-in Section 2.5.2.
+in [Ring relation in an Akita fold](./akita-fold.md).
 
 ### Akita: compose the two checks
 
diff --git a/book/src/how/proving/sumcheck-stages.md b/book/src/how/proving/sumcheck-stages.md
index b398cc0e6..72a567176 100644
--- a/book/src/how/proving/sumcheck-stages.md
+++ b/book/src/how/proving/sumcheck-stages.md
@@ -355,6 +355,10 @@ incorporate the range-image and opening-consistency terms.
 
 ### Start with the ring relation
 
+The four physical row families and the quotient extension are derived in
+[Ring relation in an Akita fold](./akita-fold.md). Here we start from their
+extended relation and explain how Stage 2 proves it.
+
 Let $w_j(X)$ be the $j$-th ring element encoded by the digit witness, and let
 row $i$ of the extended fold relation be
 

From efaa55778af6c69cd512c889411acea63bbb41ce Mon Sep 17 00:00:00 2001
From: Freya <fengrun.liu@gmail.com>
Date: Thu, 30 Jul 2026 23:26:59 -0400
Subject: [PATCH 03/17] docs(book): expand ring relation layouts

---
 book/src/how/proving/akita-fold.md | 155 +++++++++++++++++++++++++----
 1 file changed, 138 insertions(+), 17 deletions(-)

diff --git a/book/src/how/proving/akita-fold.md b/book/src/how/proving/akita-fold.md
index 1d22cf7a6..6b5ba5ec8 100644
--- a/book/src/how/proving/akita-fold.md
+++ b/book/src/how/proving/akita-fold.md
@@ -340,6 +340,86 @@ from the fold challenges, opening weights, gadget weights, and the setup
 matrices $\mathbf A$, $\mathbf B$, and $\mathbf D$. The code generates these
 contributions directly from the canonical witness layout.
 
+## Relation layouts beyond the basic setting
+
+The relation above uses one polynomial group and one witness chunk. The code
+also supports multiple groups and multiple chunks. These cases change how the
+physical rows or witness columns are arranged, while preserving the basic
+relations above.
+
+### Multiple polynomial groups
+
+At a multi-group root, each group $g$ has its own opening claims, fold
+challenges, ring dimensions, commitment parameters, and
+`consistency | A | B` row block. The final/new group is placed first, followed
+by the precommitted groups. The shared $\mathbf D$ rows remain at the end:
+
+$$
+\begin{aligned}
+{}&
+[\mathrm{consistency}_{\mathrm{final}}
+ \mid \mathbf A_{\mathrm{final}}
+ \mid \mathbf B_{\mathrm{final}}]
+\\[-2pt]
+&\quad\Vert
+\big\Vert_{g\in\mathrm{precommitted}}
+[\mathrm{consistency}_g\mid\mathbf A_g\mid\mathbf B_g]
+\quad\Vert\quad
+\mathbf D.
+\end{aligned}
+$$
+
+Each group-local block has right-hand side
+$0\Vert\mathbf 0_{\mathbf A_g}\Vert\mathbf u_g$. The final shared block has
+right-hand side $\mathbf v_D$.
+
+For a single chunk per group, the corresponding pre-switch witness layout is
+
+$$
+\mathbf w_0
+=
+\big\Vert_{g\in\mathrm{relation\ order}}
+[\hat{\mathbf z}_g\mid\hat{\mathbf e}_g\mid\hat{\mathbf t}_g].
+$$
+
+The quotient digits for all physical rows are stored once, in one shared
+$\hat{\mathbf r}$ tail after these group segments.
+
+### Multiple witness chunks
+
+The chunked or distributed layout further partitions each group's live blocks
+into disjoint ranges $I_{g,k}$. Chunk $k$ computes the partial folded response
+
+$$
+\mathbf z_{g,k}
+=
+\sum_{b\in I_{g,k}}c_{g,b}\mathbf s_{g,b},
+\qquad
+\mathbf z_g=\sum_k\mathbf z_{g,k}.
+$$
+
+The canonical layout is group-major and then chunk-minor:
+
+$$
+\boxed{
+\mathbf w
+=
+\big\Vert_g\big\Vert_k
+[\hat{\mathbf z}_{g,k}
+ \mid\hat{\mathbf e}_{g,k}
+ \mid\hat{\mathbf t}_{g,k}]
+\quad\Vert\quad
+\hat{\mathbf r}.
+}
+$$
+
+Every chunk has a full-shaped local $\hat z$ segment, while its $\hat e$ and
+$\hat t$ segments contain only the live blocks owned by that chunk. Chunking
+adds witness columns, not relation rows: the chunk matrices are stacked
+horizontally and contribute to the same group-level `consistency | A | B`
+rows. The $\mathbf D$ rows and the quotient tail $\hat{\mathbf r}$ are shared
+across all groups and chunks.
+
 ## Lift the ring relation before sumcheck
 
 Equation (20) is an equality modulo $X^D+1$. Sumcheck, however, needs a field
@@ -500,24 +580,65 @@ build_relation_weight_events
 `-- M_ext(alpha), row-batched by tau_1 ------> Stage 2
 ```
 
-The main code values are:
+### Public statement: `RingRelationInstance`
+
+[`RingRelationInstance`](https://github.com/LayerZero-Labs/akita/blob/eea8443841ed4a701bf84a9f6415aa9415d6250d/crates/akita-types/src/proof/ring_relation.rs#L82-L220)
+contains the public relation statement. It contains only values that the
+verifier can reconstruct:
+
+| Field | Mathematical meaning |
+|---|---|
+| `group_challenges()` | fold challenges $c_b$ |
+| `group_opening_point()` | ordinary opening weights, including $Q_p$ and $B_b$ |
+| `group_ring_multiplier_point()` | ring multipliers used by the physical consistency row |
+| `rhs()` | $\mathbf y=[0\mid\mathbf 0_A\mid\mathbf u\mid\mathbf v_D]$ in the basic setting |
+| `v()` | $\mathbf v_D=\mathbf D\hat{\mathbf e}$ |
+| `role_dims()` | the $\mathbf A$-, $\mathbf B$-, and $\mathbf D$-row ring dimensions |
+
+### Prover witness: `RingRelationWitness`
+
+[`RingRelationWitness`](https://github.com/LayerZero-Labs/akita/blob/eea8443841ed4a701bf84a9f6415aa9415d6250d/crates/akita-prover/src/protocol/ring_relation_witness.rs#L141-L220)
+is the prover-only aggregate witness. It holds the fold-grinding nonce and one
+[`RingRelationGroupWitness`](https://github.com/LayerZero-Labs/akita/blob/eea8443841ed4a701bf84a9f6415aa9415d6250d/crates/akita-prover/src/protocol/ring_relation_witness.rs#L8-L140)
+per polynomial group. In the basic setting, the vector contains one group:
 
-| Code value | Mathematical object |
+| Field | Mathematical meaning |
 |---|---|
-| `RingRelationGroupWitness::z_folded_rings` | folded response $\mathbf z$ before its final digit decomposition |
-| `RingRelationGroupWitness::e_folded` | position-folded rings $E_b$ |
-| `RingRelationGroupWitness::e_hat` | opening digits $\hat{\mathbf e}$ |
-| `RingRelationGroupWitness::hint` | commitment hint containing $\hat{\mathbf t}$ |
-| `RingRelationInstance::group_challenges()` | fold challenges $c_b$ |
-| `RingRelationInstance::rhs()` | physical right-hand side $\mathbf y$ |
-| `RingRelationInstance::v()` | opening-commitment rows $\mathbf v_D$ |
-| `RelationQuotientOutput` | row quotient vector $\mathbf r$ |
-| `RecursiveWitnessFlat` | flat committed witness $\hat z\Vert\hat e\Vert\hat t\Vert\hat r$ |
-
-With multiple groups, the implementation repeats
-`consistency | A | B` for each group and places the shared `D` rows at the
-end. With a chunked witness, it emits one
-$\hat z_i\Vert\hat e_i\Vert\hat t_i$ ownership unit per chunk followed by one
-shared $\hat r$ tail. The canonical physical layout is described in
+| `z_folded_rings` | folded response $\mathbf z$, before decomposition into $\hat z$ |
+| `z_folded_centered_per_chunk` | chunk-local folded responses $\mathbf z_k$ |
+| `e_folded` | recomposed position-folded rings $E_b$ |
+| `e_hat` | opening digits $\hat{\mathbf e}$ |
+| `hint` | commitment hint containing $\hat{\mathbf t}$ |
+
+The quotient output $\mathbf r$ is computed after these structures are built.
+Its digits are appended when `ring_switch_build_w` emits the flat
+$\hat z\Vert\hat e\Vert\hat t\Vert\hat r$ witness.
+
+### Verifier reconstruction
+
+The verifier does not receive a serialized `RingRelationInstance`. In
+[`verify_fold`](https://github.com/LayerZero-Labs/akita/blob/eea8443841ed4a701bf84a9f6415aa9415d6250d/crates/akita-verifier/src/protocol/core/fold.rs#L646-L741),
+it reconstructs the public instance from the transcript and public proof data:
+
+```text
+public commitment rows, opening points, v_D, and transcript
+                            |
+                            v
+rederive the per-group fold challenges
+                            |
+                            v
+assemble_relation_rhs
+                            |
+                            v
+RingRelationInstance::new
+                            |
+                            v
+ring_switch_verifier --------------------------------------> Stage 2 verifier
+```
+
+Only the public instance is reconstructed on the verifier. The
+`RingRelationWitness` and its group witnesses remain prover-only.
+
+The canonical multi-group and multi-chunk physical layout is described in
 [Opening points and digit-innermost
 layout](./opening-points-layout.md#witness-order).

From 3c3100841ea3ae69a34e84835f3e1ef6cb1367d0 Mon Sep 17 00:00:00 2001
From: Freya <fengrun.liu@gmail.com>
Date: Mon, 3 Aug 2026 12:01:03 -0400
Subject: [PATCH 04/17] docs(book): update akit-fold.md

---
 book/src/how/proving/akita-fold.md | 114 ++++++++++++++++++++++++++++-
 1 file changed, 110 insertions(+), 4 deletions(-)

diff --git a/book/src/how/proving/akita-fold.md b/book/src/how/proving/akita-fold.md
index 6b5ba5ec8..436552343 100644
--- a/book/src/how/proving/akita-fold.md
+++ b/book/src/how/proving/akita-fold.md
@@ -33,6 +33,42 @@ described on this page.
 
 ## Objects entering the fold
 
+### Why the witness is digit-decomposed
+
+The witness committed for the next level must have bounded coefficients. This
+shortness condition is essential for the Module-SIS binding argument: two
+different bounded openings of the same linear commitment would give a short,
+nonzero vector in the kernel of its commitment matrix.
+
+Gadget decomposition provides the bounded representation. For a power-of-two
+base $g$ and digit depth $\delta$, define
+
+$$
+\mathbf G_{g,n}
+=
+\mathbf I_n\otimes(1,g,\ldots,g^{\delta-1}).
+$$
+
+A balanced decomposition of $\mathbf x$ is a digit vector $\hat{\mathbf x}$
+such that
+
+$$
+\mathbf x=\mathbf G_{g,n}\hat{\mathbf x},
+\qquad
+\hat x_i\in
+\{-g/2,\ldots,g/2-1\}.
+$$
+
+The decomposition specifies this small-digit representation; the protocol's
+range check proves that the committed coordinates really lie in the required
+range. Akita may use different bases and depths for the inner, outer, opening,
+fold-response, and quotient decompositions. Below, $G_a^{\mathrm{in}}$,
+$G_h^{\mathrm{out}}$, $G_h^{\mathrm{open}}$, and $G_f^{\mathrm{fold}}$ denote
+the scalar gadget weights used to decompose $F_{p,b}$, $\mathbf t_b$, $E_b$,
+and $\mathbf z$, respectively. They are entries of the corresponding gadget
+rows defined above. We omit the role-specific base and depth from this notation
+for simplicity.
+
 ### Polynomial blocks and inner digits
 
 As in the previous page, split the ring-valued polynomial table into blocks.
@@ -125,7 +161,7 @@ opening target $v_{\mathrm{tr}}$. Equation (7) is a commitment relation; it
 does not prove that the multilinear evaluation equals
 $v_{\mathrm{tr}}$.
 
-### The folded response
+### The folded response and its digitization
 
 After the relevant data is fixed, the transcript samples one sparse
 ring-valued fold challenge $c_b(X)$ for each live block. The prover folds the
@@ -138,8 +174,78 @@ z_{p,a}(X)
 \tag{8}
 $$
 
-The coefficients of $z$ are larger than the original digits, so $z$ is
-digit-decomposed once more:
+The response $\mathbf z$ no longer carries a live-block index. This is the
+fold's main reduction toward a smaller next-level witness, but combining the
+blocks increases coefficient magnitudes. Let $\sigma_\infty$ bound the
+coefficient norm of every digit block $\mathbf s_b$, and let
+$\omega=\max_b\lVert c_b\rVert_1$. Negacyclic multiplication gives
+
+$$
+\begin{aligned}
+\lVert\mathbf z\rVert_{\infty,\mathrm{coef}}
+&\le
+\sum_b
+\lVert c_b\mathbf s_b\rVert_{\infty,\mathrm{coef}}\\
+&\le
+|\mathcal B|\,\omega\,\sigma_\infty,
+\end{aligned}
+$$
+
+where $\mathcal B$ is the set of live blocks. The schedule fixes the challenge
+family, its relevant norm bounds, an admissible fold-response bound
+$\beta_{\mathrm{fold}}$, and a digit depth large enough to represent the
+accepted response. The implementation may resample the transcript nonce until
+the resulting $\mathbf z$ fits that scheduled bound. This grinding helps the
+honest prover find a compact response; the range check on its committed digits
+is what certifies the bound in the protocol.
+
+Before digitizing $\mathbf z$, the two challenge-dependent relations already
+follow directly from linearity. For the partial evaluations,
+
+$$
+\begin{aligned}
+\sum_b c_bE_b
+&=
+\sum_b c_b\sum_pQ_pF_{p,b}\\
+&=
+\sum_{p,a}Q_pG_a^{\mathrm{in}}
+\left(\sum_bc_bs_{b,p,a}\right)\\
+&=
+\sum_{p,a}Q_pG_a^{\mathrm{in}}z_{p,a}.
+\end{aligned}
+$$
+
+Using the opening digits from Equation (6), this is
+
+$$
+\sum_{b,h}c_bG_h^{\mathrm{open}}\hat e_{b,h}
+=
+\sum_{p,a}Q_pG_a^{\mathrm{in}}z_{p,a}.
+$$
+
+Similarly, $\mathbf t_b=\mathbf A\mathbf s_b$ implies
+
+$$
+\sum_bc_b\mathbf t_b
+=
+\mathbf A\left(\sum_bc_b\mathbf s_b\right)
+=
+\mathbf A\mathbf z.
+$$
+
+For row $\rho$ of $\mathbf A$, and using the outer digits from Equation (3),
+this becomes
+
+$$
+\sum_{b,h}c_bG_h^{\mathrm{out}}\hat t_{b,\rho,h}
+=
+\sum_{p,a}A_{\rho,(p,a)}z_{p,a}.
+$$
+
+These identities explain the relations in terms of the raw folded response.
+The next-level committed witness, however, must again consist of bounded
+digits so that its shortness is certified for the Module-SIS binding argument.
+Akita therefore decomposes $\mathbf z$ once more:
 
 $$
 z_{p,a}(X)
@@ -325,7 +431,7 @@ Consequently,
 $$
 \mathbf y
 =
-\mathbf 0
+0
 \;\Vert\;
 \mathbf 0_{\mathbf A}
 \;\Vert\;

From b6f7fed4a83c48625721e011573a1c6739042647 Mon Sep 17 00:00:00 2001
From: Freya <fengrun.liu@gmail.com>
Date: Mon, 3 Aug 2026 12:03:42 -0400
Subject: [PATCH 05/17] docs(book): add toc

---
 book/src/how/proving/akita-fold.md | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/book/src/how/proving/akita-fold.md b/book/src/how/proving/akita-fold.md
index 436552343..48980cae6 100644
--- a/book/src/how/proving/akita-fold.md
+++ b/book/src/how/proving/akita-fold.md
@@ -31,6 +31,26 @@ reduction](./field-ring-reduction.md) is a separate field-valued relation. It
 is fused with the physical rows later, but it is not a row of the ring matrix
 described on this page.
 
+## Contents
+
+- [Objects entering the fold](#objects-entering-the-fold)
+  - [Why the witness is digit-decomposed](#why-the-witness-is-digit-decomposed)
+  - [Polynomial blocks and inner digits](#polynomial-blocks-and-inner-digits)
+  - [Partial evaluations and opening digits](#partial-evaluations-and-opening-digits)
+  - [The folded response and its digitization](#the-folded-response-and-its-digitization)
+- [The four physical relation families](#the-four-physical-relation-families)
+  - [Fold-evaluation consistency](#1-fold-evaluation-consistency)
+  - [Inner-commitment consistency](#2-inner-commitment-consistency)
+  - [Outer-commitment consistency](#3-outer-commitment-consistency)
+  - [Opening-commitment consistency](#4-opening-commitment-consistency)
+- [Assemble the ring relation](#assemble-the-ring-relation)
+- [Relation layouts beyond the basic setting](#relation-layouts-beyond-the-basic-setting)
+  - [Multiple polynomial groups](#multiple-polynomial-groups)
+  - [Multiple witness chunks](#multiple-witness-chunks)
+- [Lift the ring relation before sumcheck](#lift-the-ring-relation-before-sumcheck)
+- [The scalar opening claim is a virtual row](#the-scalar-opening-claim-is-a-virtual-row)
+- [Code reference](#code-reference)
+
 ## Objects entering the fold
 
 ### Why the witness is digit-decomposed

From 3f9f85dc84d9317501a505e1fe1e389f99310165 Mon Sep 17 00:00:00 2001
From: Freya <fengrun.liu@gmail.com>
Date: Mon, 3 Aug 2026 17:56:26 -0400
Subject: [PATCH 06/17] akita-book: multi group relation

---
 book/src/how/proving/akita-fold.md | 92 +++++++++++++++++++++++++++---
 1 file changed, 85 insertions(+), 7 deletions(-)

diff --git a/book/src/how/proving/akita-fold.md b/book/src/how/proving/akita-fold.md
index 48980cae6..09c6116bc 100644
--- a/book/src/how/proving/akita-fold.md
+++ b/book/src/how/proving/akita-fold.md
@@ -475,10 +475,60 @@ relations above.
 
 ### Multiple polynomial groups
 
-At a multi-group root, each group $g$ has its own opening claims, fold
-challenges, ring dimensions, commitment parameters, and
-`consistency | A | B` row block. The final/new group is placed first, followed
-by the precommitted groups. The shared $\mathbf D$ rows remain at the end:
+In zkVM applications, polynomials such as execution traces, advice, and
+preprocessed data may be committed at different times. When one commitment is
+formed, the prover may not yet know which other commitments it will later be
+opened with, the opening point, or the root schedule that will combine them.
+Akita calls the polynomials held under one independently formed outer
+commitment a **commitment group**. All claims in one group share an opening
+point. In the current implementation, all groups are opened at one shared root
+point. One group is the **final/new group**, while commitments formed earlier
+enter as **precommitted groups** with already-fixed parameters.
+
+Proving each commitment group separately would repeat the entire recursive
+opening protocol. Akita instead batches the groups in one root transition and
+then resumes the ordinary single-opening recursion. The batching does not
+merge the group witnesses or commitments: each group keeps its own folded
+response $\mathbf z_g$, digit witnesses $\hat{\mathbf e}_g$ and
+$\hat{\mathbf t}_g$, and group-local `consistency | A | B` relations. Within
+the physical ring matrix, only the opening-commitment relation spans the
+groups: one $\mathbf D$ matrix acts on their concatenated opening digits. The
+field-level evaluation trace separately batches their claimed evaluations.
+
+To show only what changes from the basic setting, assume one polynomial claim
+per group and add a group index $g$ to the previous notation. Group $g$ has
+its own blocks $\mathbf s_{g,b}$, fold challenges $c_{g,b}$, and folded response
+
+$$
+\boxed{
+\mathbf z_g
+=
+\sum_b c_{g,b}\mathbf s_{g,b}.
+}
+$$
+
+There is no sum over $g$. Each group keeps a separate response
+$\mathbf z_g$, opening digits $\hat{\mathbf e}_g$, and inner-commitment digits
+$\hat{\mathbf t}_g$. The basic consistency, $\mathbf A$, and $\mathbf B$
+relations are repeated independently for every group. In particular, the
+$\mathbf B_g$ rows bind $\hat{\mathbf t}_g$ to that group's public commitment
+$\mathbf u_g$.
+
+Among the four physical relation families, only the $\mathbf D$ relation
+combines witness data from different groups. It acts once on the concatenated
+opening digits:
+
+$$
+\hat{\mathbf e}_{\mathrm{all}}
+=
+\big\Vert_{g\in\mathrm{relation\ order}}\hat{\mathbf e}_g,
+\qquad
+\mathbf D\hat{\mathbf e}_{\mathrm{all}}=\mathbf v_D.
+$$
+
+In the canonical physical row order, the final/new group is placed first,
+followed by the precommitted groups. The shared $\mathbf D$ rows remain at the
+end:
 
 $$
 \begin{aligned}
@@ -495,9 +545,22 @@ $$
 \end{aligned}
 $$
 
-Each group-local block has right-hand side
-$0\Vert\mathbf 0_{\mathbf A_g}\Vert\mathbf u_g$. The final shared block has
-right-hand side $\mathbf v_D$.
+Consequently, the full right-hand side is
+
+$$
+\mathbf y
+=
+\big\Vert_{g\in\mathrm{relation\ order}}
+[0\mid\mathbf 0_{\mathbf A_g}\mid\mathbf u_g]
+\quad\Vert\quad
+\mathbf v_D.
+$$
+
+This relation is block sparse: a group's consistency, $\mathbf A_g$, and
+$\mathbf B_g$ rows touch only that group's witness segment, whereas the
+shared $\mathbf D$ rows touch the $\hat{\mathbf e}_g$ segments from every
+group. Stage 2 batches all physical rows into one sumcheck, but this batching
+does not merge the group-local relations.
 
 For a single chunk per group, the corresponding pre-switch witness layout is
 
@@ -511,6 +574,21 @@ $$
 The quotient digits for all physical rows are stored once, in one shared
 $\hat{\mathbf r}$ tail after these group segments.
 
+The root fold consumes this multi-group structure. After ring switching, the
+group segments and the shared quotient tail form one witness
+
+$$
+\mathbf w^{\mathrm{next}}
+=
+\mathbf w_0\Vert\hat{\mathbf r},
+$$
+
+which is committed once for the next level. The output of the multi-group root
+is therefore the basic recursive object: one polynomial group, one committed
+witness, and one opening claim at one point. The original root groups remain
+only as ranges inside the flat witness; they no longer define separate folded
+responses or relation rows.
+
 ### Multiple witness chunks
 
 The chunked or distributed layout further partitions each group's live blocks

From 5cf0db95c4df5a5547322f8420a7d83298607e10 Mon Sep 17 00:00:00 2001
From: Freya <fengrun.liu@gmail.com>
Date: Mon, 3 Aug 2026 18:07:16 -0400
Subject: [PATCH 07/17] akita-book: multi group relation

---
 book/src/how/proving/akita-fold.md | 61 +++++++++++++++++++++---------
 1 file changed, 44 insertions(+), 17 deletions(-)

diff --git a/book/src/how/proving/akita-fold.md b/book/src/how/proving/akita-fold.md
index 09c6116bc..f3fce3341 100644
--- a/book/src/how/proving/akita-fold.md
+++ b/book/src/how/proving/akita-fold.md
@@ -487,13 +487,13 @@ enter as **precommitted groups** with already-fixed parameters.
 
 Proving each commitment group separately would repeat the entire recursive
 opening protocol. Akita instead batches the groups in one root transition and
-then resumes the ordinary single-opening recursion. The batching does not
-merge the group witnesses or commitments: each group keeps its own folded
-response $\mathbf z_g$, digit witnesses $\hat{\mathbf e}_g$ and
-$\hat{\mathbf t}_g$, and group-local `consistency | A | B` relations. Within
-the physical ring matrix, only the opening-commitment relation spans the
-groups: one $\mathbf D$ matrix acts on their concatenated opening digits. The
-field-level evaluation trace separately batches their claimed evaluations.
+then resumes the ordinary single-opening recursion. The batching preserves
+the separate group commitments and folded responses: each group has its own
+$\mathbf z_g$, $\hat{\mathbf t}_g$, and group-local `consistency | A | B`
+relations. On the opening side, however, every group contributes an
+$\hat{\mathbf e}_g$ segment to one concatenated vector. One $\mathbf D$ matrix
+binds that entire vector, and the field-level evaluation trace separately
+batches the claimed evaluations.
 
 To show only what changes from the basic setting, assume one polynomial claim
 per group and add a group index $g$ to the previous notation. Group $g$ has
@@ -507,25 +507,52 @@ $$
 }
 $$
 
-There is no sum over $g$. Each group keeps a separate response
-$\mathbf z_g$, opening digits $\hat{\mathbf e}_g$, and inner-commitment digits
-$\hat{\mathbf t}_g$. The basic consistency, $\mathbf A$, and $\mathbf B$
-relations are repeated independently for every group. In particular, the
-$\mathbf B_g$ rows bind $\hat{\mathbf t}_g$ to that group's public commitment
-$\mathbf u_g$.
+There is no sum over $g$: the folded responses $\mathbf z_g$ remain separate.
+The basic consistency, $\mathbf A$, and $\mathbf B$ relations are repeated
+independently for every group. In particular, the $\mathbf B_g$ rows bind
+$\hat{\mathbf t}_g$ to that group's public commitment $\mathbf u_g$. Each
+group also produces opening digits $\hat{\mathbf e}_g$, which become one
+segment of the shared opening vector below.
 
-Among the four physical relation families, only the $\mathbf D$ relation
-combines witness data from different groups. It acts once on the concatenated
-opening digits:
+The fold and outer-commitment parts remain group-local because each commitment
+fixes its own $\mathbf A_g$ and $\mathbf B_g$ matrices, decomposition
+parameters, and public target $\mathbf u_g$. Its folded response $\mathbf z_g$
+is formed with that group's challenges and must be checked against those fixed
+parameters. Combining the responses across groups would lose these
+group-specific commitment bindings.
+
+The $\mathbf D$ relation can be shared for a different reason. Unlike
+$\mathbf A_g$ and $\mathbf B_g$, $\mathbf D$ is owned by the fold level rather
+than by an individual commitment group. Every $\hat{\mathbf e}_g$ segment uses
+the same opening-role ring dimension and decomposition basis, so the segments
+can occupy disjoint column ranges of one matrix
+
+$$
+\mathbf D
+=
+[\mathbf D_0\mid\mathbf D_1\mid\cdots],
+$$
+
+and be concatenated into one input vector:
 
 $$
 \hat{\mathbf e}_{\mathrm{all}}
 =
 \big\Vert_{g\in\mathrm{relation\ order}}\hat{\mathbf e}_g,
 \qquad
-\mathbf D\hat{\mathbf e}_{\mathrm{all}}=\mathbf v_D.
+\mathbf D\hat{\mathbf e}_{\mathrm{all}}
+=
+\sum_g\mathbf D_g\hat{\mathbf e}_g
+=
+\mathbf v_D.
 $$
 
+Thus the opening digits are not committed separately by group: they are
+concatenated and bound together by the single relation
+$\mathbf D\hat{\mathbf e}_{\mathrm{all}}=\mathbf v_D$. The fixed column ranges
+record which coordinates came from each group, and the group-local consistency
+rows prove what each $\hat{\mathbf e}_g$ segment represents.
+
 In the canonical physical row order, the final/new group is placed first,
 followed by the precommitted groups. The shared $\mathbf D$ rows remain at the
 end:

From 45cd7234b3eec689a7803c3eef078e56553581e3 Mon Sep 17 00:00:00 2001
From: Freya <fengrun.liu@gmail.com>
Date: Mon, 3 Aug 2026 18:29:03 -0400
Subject: [PATCH 08/17] akita-book: advanced relation

---
 book/src/SUMMARY.md                           |   1 +
 .../how/proving/advanced-relation-layouts.md  | 215 ++++++++++++++++++
 book/src/how/proving/akita-fold.md            | 205 +----------------
 3 files changed, 226 insertions(+), 195 deletions(-)
 create mode 100644 book/src/how/proving/advanced-relation-layouts.md

diff --git a/book/src/SUMMARY.md b/book/src/SUMMARY.md
index 96e7b761c..8e34bfd9e 100644
--- a/book/src/SUMMARY.md
+++ b/book/src/SUMMARY.md
@@ -23,6 +23,7 @@
   - [The proving protocol](./how/proving/proving.md)
     - [Field-to-ring evaluation reduction](./how/proving/field-ring-reduction.md)
     - [Ring relation in an Akita fold](./how/proving/akita-fold.md)
+    - [Advanced relation layouts](./how/proving/advanced-relation-layouts.md)
     - [Opening points and digit-innermost layout](./how/proving/opening-points-layout.md)
     - [Root fold and ring switching](./how/proving/root-fold-ring-switch.md)
     - [Sumcheck stages](./how/proving/sumcheck-stages.md)
diff --git a/book/src/how/proving/advanced-relation-layouts.md b/book/src/how/proving/advanced-relation-layouts.md
new file mode 100644
index 000000000..720586322
--- /dev/null
+++ b/book/src/how/proving/advanced-relation-layouts.md
@@ -0,0 +1,215 @@
+# Advanced relation layouts
+
+The [ring relation in an Akita fold](./akita-fold.md) starts with one
+commitment group, one witness chunk, and one common ring dimension. This page
+extends that basic case along three independent layout axes:
+
+1. multiple commitment groups add group-local relation rows and witness
+   segments to the root fold;
+2. multiple witness chunks partition the work and physical witness columns
+   within each group; and
+3. different ring dimensions let each physical row retain the native ring of
+   its matrix role.
+
+None of these extensions changes the four physical relation families. They
+change which rows and columns belong to each group, chunk, or native ring. The
+physical opening-commitment relation remains distinct from the field-valued
+evaluation trace, just as in the basic setting.
+
+## Contents
+
+- [Multiple commitment groups](#multiple-commitment-groups)
+  - [Why multiple commitment groups](#why-multiple-commitment-groups)
+  - [Group-local folded responses and relations](#group-local-folded-responses-and-relations)
+  - [The shared opening-commitment relation](#the-shared-opening-commitment-relation)
+  - [Physical row and witness layout](#physical-row-and-witness-layout)
+  - [Return to the single-group recursion](#return-to-the-single-group-recursion)
+- [Multiple witness chunks](#multiple-witness-chunks)
+- [Different ring dimensions](#different-ring-dimensions)
+
+## Multiple commitment groups
+
+### Why multiple commitment groups
+
+In zkVM applications, polynomials such as execution traces, advice, and
+preprocessed data may be committed at different times. When one commitment is
+formed, the prover may not yet know which other commitments it will later be
+opened with, the opening point, or the root schedule that will combine them.
+Akita calls the polynomials held under one independently formed outer
+commitment a **commitment group**. All claims in one group share an opening
+point. In the current implementation, all groups are opened at one shared root
+point. One group is the **final/new group**, while commitments formed earlier
+enter as **precommitted groups** with already-fixed parameters.
+
+Proving each commitment group separately would repeat the entire recursive
+opening protocol. Akita instead batches the groups in one root transition and
+then resumes the ordinary single-opening recursion. The batching preserves
+the separate group commitments and folded responses: each group has its own
+$\mathbf z_g$, $\hat{\mathbf t}_g$, and group-local `consistency | A | B`
+relations. On the opening side, however, every group contributes an
+$\hat{\mathbf e}_g$ segment to one concatenated vector. One $\mathbf D$ matrix
+binds that entire vector, and the field-level evaluation trace separately
+batches the claimed evaluations.
+
+### Group-local folded responses and relations
+
+To show only what changes from the basic setting, assume one polynomial claim
+per group and add a group index $g$ to the previous notation. Group $g$ has
+its own blocks $\mathbf s_{g,b}$, fold challenges $c_{g,b}$, and folded response
+
+$$
+\boxed{
+\mathbf z_g
+=
+\sum_b c_{g,b}\mathbf s_{g,b}.
+}
+$$
+
+There is no sum over $g$: the folded responses $\mathbf z_g$ remain separate.
+The basic consistency, $\mathbf A$, and $\mathbf B$ relations are repeated
+independently for every group. In particular, the $\mathbf B_g$ rows bind
+$\hat{\mathbf t}_g$ to that group's public commitment $\mathbf u_g$. Each
+group also produces opening digits $\hat{\mathbf e}_g$, which become one
+segment of the shared opening vector below.
+
+The fold and outer-commitment parts remain group-local because each commitment
+fixes its own $\mathbf A_g$ and $\mathbf B_g$ matrices, decomposition
+parameters, and public target $\mathbf u_g$. Its folded response $\mathbf z_g$
+is formed with that group's challenges and must be checked against those fixed
+parameters. Combining the responses across groups would lose these
+group-specific commitment bindings.
+
+### The shared opening-commitment relation
+
+The $\mathbf D$ relation can be shared for a different reason. Unlike
+$\mathbf A_g$ and $\mathbf B_g$, $\mathbf D$ is owned by the fold level rather
+than by an individual commitment group. Every $\hat{\mathbf e}_g$ segment uses
+the same opening-role ring dimension and decomposition basis, so the segments
+can occupy disjoint column ranges of one matrix
+
+$$
+\mathbf D
+=
+[\mathbf D_0\mid\mathbf D_1\mid\cdots],
+$$
+
+and be concatenated into one input vector:
+
+$$
+\hat{\mathbf e}_{\mathrm{all}}
+=
+\big\Vert_{g\in\mathrm{relation\ order}}\hat{\mathbf e}_g,
+\qquad
+\mathbf D\hat{\mathbf e}_{\mathrm{all}}
+=
+\sum_g\mathbf D_g\hat{\mathbf e}_g
+=
+\mathbf v_D.
+$$
+
+Thus the opening digits are not committed separately by group: they are
+concatenated and bound together by the single relation
+$\mathbf D\hat{\mathbf e}_{\mathrm{all}}=\mathbf v_D$. The fixed column ranges
+record which coordinates came from each group, and the group-local consistency
+rows prove what each $\hat{\mathbf e}_g$ segment represents.
+
+### Physical row and witness layout
+
+In the canonical physical row order, the final/new group is placed first,
+followed by the precommitted groups. The shared $\mathbf D$ rows remain at the
+end:
+
+$$
+\begin{aligned}
+{}&
+[\mathrm{consistency}_{\mathrm{final}}
+ \mid \mathbf A_{\mathrm{final}}
+ \mid \mathbf B_{\mathrm{final}}]
+\\[-2pt]
+&\quad\Vert
+\big\Vert_{g\in\mathrm{precommitted}}
+[\mathrm{consistency}_g\mid\mathbf A_g\mid\mathbf B_g]
+\quad\Vert\quad
+\mathbf D.
+\end{aligned}
+$$
+
+Consequently, the full right-hand side is
+
+$$
+\mathbf y
+=
+\big\Vert_{g\in\mathrm{relation\ order}}
+[0\mid\mathbf 0_{\mathbf A_g}\mid\mathbf u_g]
+\quad\Vert\quad
+\mathbf v_D.
+$$
+
+This relation is block sparse: a group's consistency, $\mathbf A_g$, and
+$\mathbf B_g$ rows touch only that group's witness segment, whereas the
+shared $\mathbf D$ rows touch the $\hat{\mathbf e}_g$ segments from every
+group. Stage 2 batches all physical rows into one sumcheck, but this batching
+does not merge the group-local relations.
+
+For a single chunk per group, the corresponding pre-switch witness layout is
+
+$$
+\mathbf w_0
+=
+\big\Vert_{g\in\mathrm{relation\ order}}
+[\hat{\mathbf z}_g\mid\hat{\mathbf e}_g\mid\hat{\mathbf t}_g].
+$$
+
+The quotient digits for all physical rows are stored once, in one shared
+$\hat{\mathbf r}$ tail after these group segments.
+
+### Return to the single-group recursion
+
+The root fold consumes this multi-group structure. After ring switching, the
+group segments and the shared quotient tail form one witness
+
+$$
+\mathbf w^{\mathrm{next}}
+=
+\mathbf w_0\Vert\hat{\mathbf r},
+$$
+
+which is committed once for the next level. The output of the multi-group root
+is therefore the basic recursive object: one polynomial group, one committed
+witness, and one opening claim at one point. The original root groups remain
+only as ranges inside the flat witness; they no longer define separate folded
+responses or relation rows.
+
+## Multiple witness chunks
+
+> **Status:** stub. This section will derive how each group's live blocks are
+> partitioned among witness chunks, how chunk-local segments contribute to the
+> same group-level rows, and why all groups and chunks share one quotient tail.
+
+**Sources to fold in**
+
+- `crates/akita-types/src/witness.rs` (`WitnessLayout`, `WitnessUnitLayout`).
+- `crates/akita-types/src/proof/ring_relation.rs` (`RingRelationInstance::segment_layout`).
+- `crates/akita-prover/src/protocol/ring_switch/coeffs.rs` (group- and chunk-ordered witness emission).
+- [Opening points and digit-innermost layout](./opening-points-layout.md#chunks-and-tensor-challenges).
+- [The distributed prover](./distributed-prover.md).
+
+## Different ring dimensions
+
+> **Status:** stub. This section will distinguish each relation row's native
+> ring dimension from the common carrier dimension, then derive the mixed-row
+> quotient and ring-switch evaluation without assuming a common denominator
+> $X^D+1$.
+
+**Sources to fold in**
+
+- `crates/akita-types/src/proof/relation.rs` (`RelationRhsLayout::row_ring_dims`).
+- `crates/akita-types/src/proof/relation_address.rs` (`RelationAddressGeometry`).
+- `crates/akita-types/src/layout/params.rs` (`relation_witness_carrier_ring_dimension`).
+- `crates/akita-prover/src/protocol/ring_relation/relation_quotient.rs`.
+- `crates/akita-verifier/src/protocol/ring_switch/prepared_relation_point.rs`.
+- `crates/akita-verifier/src/protocol/ring_switch/mixed_relation.rs`.
+
+With the logical relation layout established, [Opening points and
+digit-innermost layout](./opening-points-layout.md) specifies how its segments
+are flattened into the physical source and committed witness order.
diff --git a/book/src/how/proving/akita-fold.md b/book/src/how/proving/akita-fold.md
index f3fce3341..cc0b86415 100644
--- a/book/src/how/proving/akita-fold.md
+++ b/book/src/how/proving/akita-fold.md
@@ -8,10 +8,11 @@ $$
 R=F[X]/(X^D+1).
 $$
 
-The current implementation also supports multiple polynomial groups,
-multiple claims, chunked witnesses, and different ring dimensions for
-different relation rows. Those extensions change the layout, but not the four
-core relations developed below.
+The current implementation also supports more elaborate physical layouts, but
+those extensions do not change the four core relations developed below. After
+establishing the basic case, [Advanced relation
+layouts](./advanced-relation-layouts.md) adds commitment groups, witness chunks,
+and different ring dimensions one axis at a time.
 
 The Akita paper presents a more general matrix with additional compression
 relations. Its basic Greyhound relation motivates the four row families here;
@@ -44,9 +45,6 @@ described on this page.
   - [Outer-commitment consistency](#3-outer-commitment-consistency)
   - [Opening-commitment consistency](#4-opening-commitment-consistency)
 - [Assemble the ring relation](#assemble-the-ring-relation)
-- [Relation layouts beyond the basic setting](#relation-layouts-beyond-the-basic-setting)
-  - [Multiple polynomial groups](#multiple-polynomial-groups)
-  - [Multiple witness chunks](#multiple-witness-chunks)
 - [Lift the ring relation before sumcheck](#lift-the-ring-relation-before-sumcheck)
 - [The scalar opening claim is a virtual row](#the-scalar-opening-claim-is-a-virtual-row)
 - [Code reference](#code-reference)
@@ -466,191 +464,6 @@ from the fold challenges, opening weights, gadget weights, and the setup
 matrices $\mathbf A$, $\mathbf B$, and $\mathbf D$. The code generates these
 contributions directly from the canonical witness layout.
 
-## Relation layouts beyond the basic setting
-
-The relation above uses one polynomial group and one witness chunk. The code
-also supports multiple groups and multiple chunks. These cases change how the
-physical rows or witness columns are arranged, while preserving the basic
-relations above.
-
-### Multiple polynomial groups
-
-In zkVM applications, polynomials such as execution traces, advice, and
-preprocessed data may be committed at different times. When one commitment is
-formed, the prover may not yet know which other commitments it will later be
-opened with, the opening point, or the root schedule that will combine them.
-Akita calls the polynomials held under one independently formed outer
-commitment a **commitment group**. All claims in one group share an opening
-point. In the current implementation, all groups are opened at one shared root
-point. One group is the **final/new group**, while commitments formed earlier
-enter as **precommitted groups** with already-fixed parameters.
-
-Proving each commitment group separately would repeat the entire recursive
-opening protocol. Akita instead batches the groups in one root transition and
-then resumes the ordinary single-opening recursion. The batching preserves
-the separate group commitments and folded responses: each group has its own
-$\mathbf z_g$, $\hat{\mathbf t}_g$, and group-local `consistency | A | B`
-relations. On the opening side, however, every group contributes an
-$\hat{\mathbf e}_g$ segment to one concatenated vector. One $\mathbf D$ matrix
-binds that entire vector, and the field-level evaluation trace separately
-batches the claimed evaluations.
-
-To show only what changes from the basic setting, assume one polynomial claim
-per group and add a group index $g$ to the previous notation. Group $g$ has
-its own blocks $\mathbf s_{g,b}$, fold challenges $c_{g,b}$, and folded response
-
-$$
-\boxed{
-\mathbf z_g
-=
-\sum_b c_{g,b}\mathbf s_{g,b}.
-}
-$$
-
-There is no sum over $g$: the folded responses $\mathbf z_g$ remain separate.
-The basic consistency, $\mathbf A$, and $\mathbf B$ relations are repeated
-independently for every group. In particular, the $\mathbf B_g$ rows bind
-$\hat{\mathbf t}_g$ to that group's public commitment $\mathbf u_g$. Each
-group also produces opening digits $\hat{\mathbf e}_g$, which become one
-segment of the shared opening vector below.
-
-The fold and outer-commitment parts remain group-local because each commitment
-fixes its own $\mathbf A_g$ and $\mathbf B_g$ matrices, decomposition
-parameters, and public target $\mathbf u_g$. Its folded response $\mathbf z_g$
-is formed with that group's challenges and must be checked against those fixed
-parameters. Combining the responses across groups would lose these
-group-specific commitment bindings.
-
-The $\mathbf D$ relation can be shared for a different reason. Unlike
-$\mathbf A_g$ and $\mathbf B_g$, $\mathbf D$ is owned by the fold level rather
-than by an individual commitment group. Every $\hat{\mathbf e}_g$ segment uses
-the same opening-role ring dimension and decomposition basis, so the segments
-can occupy disjoint column ranges of one matrix
-
-$$
-\mathbf D
-=
-[\mathbf D_0\mid\mathbf D_1\mid\cdots],
-$$
-
-and be concatenated into one input vector:
-
-$$
-\hat{\mathbf e}_{\mathrm{all}}
-=
-\big\Vert_{g\in\mathrm{relation\ order}}\hat{\mathbf e}_g,
-\qquad
-\mathbf D\hat{\mathbf e}_{\mathrm{all}}
-=
-\sum_g\mathbf D_g\hat{\mathbf e}_g
-=
-\mathbf v_D.
-$$
-
-Thus the opening digits are not committed separately by group: they are
-concatenated and bound together by the single relation
-$\mathbf D\hat{\mathbf e}_{\mathrm{all}}=\mathbf v_D$. The fixed column ranges
-record which coordinates came from each group, and the group-local consistency
-rows prove what each $\hat{\mathbf e}_g$ segment represents.
-
-In the canonical physical row order, the final/new group is placed first,
-followed by the precommitted groups. The shared $\mathbf D$ rows remain at the
-end:
-
-$$
-\begin{aligned}
-{}&
-[\mathrm{consistency}_{\mathrm{final}}
- \mid \mathbf A_{\mathrm{final}}
- \mid \mathbf B_{\mathrm{final}}]
-\\[-2pt]
-&\quad\Vert
-\big\Vert_{g\in\mathrm{precommitted}}
-[\mathrm{consistency}_g\mid\mathbf A_g\mid\mathbf B_g]
-\quad\Vert\quad
-\mathbf D.
-\end{aligned}
-$$
-
-Consequently, the full right-hand side is
-
-$$
-\mathbf y
-=
-\big\Vert_{g\in\mathrm{relation\ order}}
-[0\mid\mathbf 0_{\mathbf A_g}\mid\mathbf u_g]
-\quad\Vert\quad
-\mathbf v_D.
-$$
-
-This relation is block sparse: a group's consistency, $\mathbf A_g$, and
-$\mathbf B_g$ rows touch only that group's witness segment, whereas the
-shared $\mathbf D$ rows touch the $\hat{\mathbf e}_g$ segments from every
-group. Stage 2 batches all physical rows into one sumcheck, but this batching
-does not merge the group-local relations.
-
-For a single chunk per group, the corresponding pre-switch witness layout is
-
-$$
-\mathbf w_0
-=
-\big\Vert_{g\in\mathrm{relation\ order}}
-[\hat{\mathbf z}_g\mid\hat{\mathbf e}_g\mid\hat{\mathbf t}_g].
-$$
-
-The quotient digits for all physical rows are stored once, in one shared
-$\hat{\mathbf r}$ tail after these group segments.
-
-The root fold consumes this multi-group structure. After ring switching, the
-group segments and the shared quotient tail form one witness
-
-$$
-\mathbf w^{\mathrm{next}}
-=
-\mathbf w_0\Vert\hat{\mathbf r},
-$$
-
-which is committed once for the next level. The output of the multi-group root
-is therefore the basic recursive object: one polynomial group, one committed
-witness, and one opening claim at one point. The original root groups remain
-only as ranges inside the flat witness; they no longer define separate folded
-responses or relation rows.
-
-### Multiple witness chunks
-
-The chunked or distributed layout further partitions each group's live blocks
-into disjoint ranges $I_{g,k}$. Chunk $k$ computes the partial folded response
-
-$$
-\mathbf z_{g,k}
-=
-\sum_{b\in I_{g,k}}c_{g,b}\mathbf s_{g,b},
-\qquad
-\mathbf z_g=\sum_k\mathbf z_{g,k}.
-$$
-
-The canonical layout is group-major and then chunk-minor:
-
-$$
-\boxed{
-\mathbf w
-=
-\big\Vert_g\big\Vert_k
-[\hat{\mathbf z}_{g,k}
- \mid\hat{\mathbf e}_{g,k}
- \mid\hat{\mathbf t}_{g,k}]
-\quad\Vert\quad
-\hat{\mathbf r}.
-}
-$$
-
-Every chunk has a full-shaped local $\hat z$ segment, while its $\hat e$ and
-$\hat t$ segments contain only the live blocks owned by that chunk. Chunking
-adds witness columns, not relation rows: the chunk matrices are stacked
-horizontally and contribute to the same group-level `consistency | A | B`
-rows. The $\mathbf D$ rows and the quotient tail $\hat{\mathbf r}$ are shared
-across all groups and chunks.
-
 ## Lift the ring relation before sumcheck
 
 Equation (20) is an equality modulo $X^D+1$. Sumcheck, however, needs a field
@@ -870,6 +683,8 @@ ring_switch_verifier --------------------------------------> Stage 2 verifier
 Only the public instance is reconstructed on the verifier. The
 `RingRelationWitness` and its group witnesses remain prover-only.
 
-The canonical multi-group and multi-chunk physical layout is described in
-[Opening points and digit-innermost
-layout](./opening-points-layout.md#witness-order).
+The basic case on this page extends to multiple commitment groups, witness
+chunks, and mixed ring dimensions in [Advanced relation
+layouts](./advanced-relation-layouts.md). [Opening points and digit-innermost
+layout](./opening-points-layout.md#witness-order) then specifies the canonical
+physical source and digit order.

From 6e5348593db83ca3b380a68d4195419bb0d0d5a5 Mon Sep 17 00:00:00 2001
From: Freya <fengrun.liu@gmail.com>
Date: Tue, 4 Aug 2026 17:47:03 -0400
Subject: [PATCH 09/17] docs(book): keep Akita fold chapter basic

---
 book/src/SUMMARY.md                           |   3 +-
 .../how/proving/advanced-relation-layouts.md  | 215 ------------------
 book/src/how/proving/akita-fold.md            |  54 ++---
 3 files changed, 26 insertions(+), 246 deletions(-)
 delete mode 100644 book/src/how/proving/advanced-relation-layouts.md

diff --git a/book/src/SUMMARY.md b/book/src/SUMMARY.md
index 8e34bfd9e..fbf0b38f5 100644
--- a/book/src/SUMMARY.md
+++ b/book/src/SUMMARY.md
@@ -22,8 +22,7 @@
   - [Transcript and instance binding](./how/transcript.md)
   - [The proving protocol](./how/proving/proving.md)
     - [Field-to-ring evaluation reduction](./how/proving/field-ring-reduction.md)
-    - [Ring relation in an Akita fold](./how/proving/akita-fold.md)
-    - [Advanced relation layouts](./how/proving/advanced-relation-layouts.md)
+    - [Basic relations in an Akita fold](./how/proving/akita-fold.md)
     - [Opening points and digit-innermost layout](./how/proving/opening-points-layout.md)
     - [Root fold and ring switching](./how/proving/root-fold-ring-switch.md)
     - [Sumcheck stages](./how/proving/sumcheck-stages.md)
diff --git a/book/src/how/proving/advanced-relation-layouts.md b/book/src/how/proving/advanced-relation-layouts.md
deleted file mode 100644
index 720586322..000000000
--- a/book/src/how/proving/advanced-relation-layouts.md
+++ /dev/null
@@ -1,215 +0,0 @@
-# Advanced relation layouts
-
-The [ring relation in an Akita fold](./akita-fold.md) starts with one
-commitment group, one witness chunk, and one common ring dimension. This page
-extends that basic case along three independent layout axes:
-
-1. multiple commitment groups add group-local relation rows and witness
-   segments to the root fold;
-2. multiple witness chunks partition the work and physical witness columns
-   within each group; and
-3. different ring dimensions let each physical row retain the native ring of
-   its matrix role.
-
-None of these extensions changes the four physical relation families. They
-change which rows and columns belong to each group, chunk, or native ring. The
-physical opening-commitment relation remains distinct from the field-valued
-evaluation trace, just as in the basic setting.
-
-## Contents
-
-- [Multiple commitment groups](#multiple-commitment-groups)
-  - [Why multiple commitment groups](#why-multiple-commitment-groups)
-  - [Group-local folded responses and relations](#group-local-folded-responses-and-relations)
-  - [The shared opening-commitment relation](#the-shared-opening-commitment-relation)
-  - [Physical row and witness layout](#physical-row-and-witness-layout)
-  - [Return to the single-group recursion](#return-to-the-single-group-recursion)
-- [Multiple witness chunks](#multiple-witness-chunks)
-- [Different ring dimensions](#different-ring-dimensions)
-
-## Multiple commitment groups
-
-### Why multiple commitment groups
-
-In zkVM applications, polynomials such as execution traces, advice, and
-preprocessed data may be committed at different times. When one commitment is
-formed, the prover may not yet know which other commitments it will later be
-opened with, the opening point, or the root schedule that will combine them.
-Akita calls the polynomials held under one independently formed outer
-commitment a **commitment group**. All claims in one group share an opening
-point. In the current implementation, all groups are opened at one shared root
-point. One group is the **final/new group**, while commitments formed earlier
-enter as **precommitted groups** with already-fixed parameters.
-
-Proving each commitment group separately would repeat the entire recursive
-opening protocol. Akita instead batches the groups in one root transition and
-then resumes the ordinary single-opening recursion. The batching preserves
-the separate group commitments and folded responses: each group has its own
-$\mathbf z_g$, $\hat{\mathbf t}_g$, and group-local `consistency | A | B`
-relations. On the opening side, however, every group contributes an
-$\hat{\mathbf e}_g$ segment to one concatenated vector. One $\mathbf D$ matrix
-binds that entire vector, and the field-level evaluation trace separately
-batches the claimed evaluations.
-
-### Group-local folded responses and relations
-
-To show only what changes from the basic setting, assume one polynomial claim
-per group and add a group index $g$ to the previous notation. Group $g$ has
-its own blocks $\mathbf s_{g,b}$, fold challenges $c_{g,b}$, and folded response
-
-$$
-\boxed{
-\mathbf z_g
-=
-\sum_b c_{g,b}\mathbf s_{g,b}.
-}
-$$
-
-There is no sum over $g$: the folded responses $\mathbf z_g$ remain separate.
-The basic consistency, $\mathbf A$, and $\mathbf B$ relations are repeated
-independently for every group. In particular, the $\mathbf B_g$ rows bind
-$\hat{\mathbf t}_g$ to that group's public commitment $\mathbf u_g$. Each
-group also produces opening digits $\hat{\mathbf e}_g$, which become one
-segment of the shared opening vector below.
-
-The fold and outer-commitment parts remain group-local because each commitment
-fixes its own $\mathbf A_g$ and $\mathbf B_g$ matrices, decomposition
-parameters, and public target $\mathbf u_g$. Its folded response $\mathbf z_g$
-is formed with that group's challenges and must be checked against those fixed
-parameters. Combining the responses across groups would lose these
-group-specific commitment bindings.
-
-### The shared opening-commitment relation
-
-The $\mathbf D$ relation can be shared for a different reason. Unlike
-$\mathbf A_g$ and $\mathbf B_g$, $\mathbf D$ is owned by the fold level rather
-than by an individual commitment group. Every $\hat{\mathbf e}_g$ segment uses
-the same opening-role ring dimension and decomposition basis, so the segments
-can occupy disjoint column ranges of one matrix
-
-$$
-\mathbf D
-=
-[\mathbf D_0\mid\mathbf D_1\mid\cdots],
-$$
-
-and be concatenated into one input vector:
-
-$$
-\hat{\mathbf e}_{\mathrm{all}}
-=
-\big\Vert_{g\in\mathrm{relation\ order}}\hat{\mathbf e}_g,
-\qquad
-\mathbf D\hat{\mathbf e}_{\mathrm{all}}
-=
-\sum_g\mathbf D_g\hat{\mathbf e}_g
-=
-\mathbf v_D.
-$$
-
-Thus the opening digits are not committed separately by group: they are
-concatenated and bound together by the single relation
-$\mathbf D\hat{\mathbf e}_{\mathrm{all}}=\mathbf v_D$. The fixed column ranges
-record which coordinates came from each group, and the group-local consistency
-rows prove what each $\hat{\mathbf e}_g$ segment represents.
-
-### Physical row and witness layout
-
-In the canonical physical row order, the final/new group is placed first,
-followed by the precommitted groups. The shared $\mathbf D$ rows remain at the
-end:
-
-$$
-\begin{aligned}
-{}&
-[\mathrm{consistency}_{\mathrm{final}}
- \mid \mathbf A_{\mathrm{final}}
- \mid \mathbf B_{\mathrm{final}}]
-\\[-2pt]
-&\quad\Vert
-\big\Vert_{g\in\mathrm{precommitted}}
-[\mathrm{consistency}_g\mid\mathbf A_g\mid\mathbf B_g]
-\quad\Vert\quad
-\mathbf D.
-\end{aligned}
-$$
-
-Consequently, the full right-hand side is
-
-$$
-\mathbf y
-=
-\big\Vert_{g\in\mathrm{relation\ order}}
-[0\mid\mathbf 0_{\mathbf A_g}\mid\mathbf u_g]
-\quad\Vert\quad
-\mathbf v_D.
-$$
-
-This relation is block sparse: a group's consistency, $\mathbf A_g$, and
-$\mathbf B_g$ rows touch only that group's witness segment, whereas the
-shared $\mathbf D$ rows touch the $\hat{\mathbf e}_g$ segments from every
-group. Stage 2 batches all physical rows into one sumcheck, but this batching
-does not merge the group-local relations.
-
-For a single chunk per group, the corresponding pre-switch witness layout is
-
-$$
-\mathbf w_0
-=
-\big\Vert_{g\in\mathrm{relation\ order}}
-[\hat{\mathbf z}_g\mid\hat{\mathbf e}_g\mid\hat{\mathbf t}_g].
-$$
-
-The quotient digits for all physical rows are stored once, in one shared
-$\hat{\mathbf r}$ tail after these group segments.
-
-### Return to the single-group recursion
-
-The root fold consumes this multi-group structure. After ring switching, the
-group segments and the shared quotient tail form one witness
-
-$$
-\mathbf w^{\mathrm{next}}
-=
-\mathbf w_0\Vert\hat{\mathbf r},
-$$
-
-which is committed once for the next level. The output of the multi-group root
-is therefore the basic recursive object: one polynomial group, one committed
-witness, and one opening claim at one point. The original root groups remain
-only as ranges inside the flat witness; they no longer define separate folded
-responses or relation rows.
-
-## Multiple witness chunks
-
-> **Status:** stub. This section will derive how each group's live blocks are
-> partitioned among witness chunks, how chunk-local segments contribute to the
-> same group-level rows, and why all groups and chunks share one quotient tail.
-
-**Sources to fold in**
-
-- `crates/akita-types/src/witness.rs` (`WitnessLayout`, `WitnessUnitLayout`).
-- `crates/akita-types/src/proof/ring_relation.rs` (`RingRelationInstance::segment_layout`).
-- `crates/akita-prover/src/protocol/ring_switch/coeffs.rs` (group- and chunk-ordered witness emission).
-- [Opening points and digit-innermost layout](./opening-points-layout.md#chunks-and-tensor-challenges).
-- [The distributed prover](./distributed-prover.md).
-
-## Different ring dimensions
-
-> **Status:** stub. This section will distinguish each relation row's native
-> ring dimension from the common carrier dimension, then derive the mixed-row
-> quotient and ring-switch evaluation without assuming a common denominator
-> $X^D+1$.
-
-**Sources to fold in**
-
-- `crates/akita-types/src/proof/relation.rs` (`RelationRhsLayout::row_ring_dims`).
-- `crates/akita-types/src/proof/relation_address.rs` (`RelationAddressGeometry`).
-- `crates/akita-types/src/layout/params.rs` (`relation_witness_carrier_ring_dimension`).
-- `crates/akita-prover/src/protocol/ring_relation/relation_quotient.rs`.
-- `crates/akita-verifier/src/protocol/ring_switch/prepared_relation_point.rs`.
-- `crates/akita-verifier/src/protocol/ring_switch/mixed_relation.rs`.
-
-With the logical relation layout established, [Opening points and
-digit-innermost layout](./opening-points-layout.md) specifies how its segments
-are flattened into the physical source and committed witness order.
diff --git a/book/src/how/proving/akita-fold.md b/book/src/how/proving/akita-fold.md
index cc0b86415..d52caf246 100644
--- a/book/src/how/proving/akita-fold.md
+++ b/book/src/how/proving/akita-fold.md
@@ -1,4 +1,4 @@
-# Ring relation in an Akita fold
+# Basic relations in an Akita fold
 
 This page describes the ring-valued relations proved by one non-terminal
 Akita fold. The presentation starts with one polynomial group, one opening
@@ -8,11 +8,10 @@ $$
 R=F[X]/(X^D+1).
 $$
 
-The current implementation also supports more elaborate physical layouts, but
-those extensions do not change the four core relations developed below. After
-establishing the basic case, [Advanced relation
-layouts](./advanced-relation-layouts.md) adds commitment groups, witness chunks,
-and different ring dimensions one axis at a time.
+The current implementation also supports more elaborate physical layouts —
+commitment groups, witness chunks, and different ring dimensions — but those
+extensions do not change the four core relations developed below. This page
+establishes only the basic case; advanced layouts are outside its scope.
 
 The Akita paper presents a more general matrix with additional compression
 relations. Its basic Greyhound relation motivates the four row families here;
@@ -572,7 +571,9 @@ evaluation row, and the range-image binding into one Stage-2 sumcheck.
 
 ## Code reference
 
-The current prover follows the construction above:
+The current prover uses canonical entry points that also support more general
+layouts. With one group, one chunk, and one common ring dimension, they reduce
+to the construction above:
 
 1. **Build the partial-evaluation and fold witnesses.**
    [`RingRelationProver::new`](https://github.com/LayerZero-Labs/akita/blob/eea8443841ed4a701bf84a9f6415aa9415d6250d/crates/akita-prover/src/protocol/ring_relation.rs#L433-L760)
@@ -592,8 +593,9 @@ The current prover follows the construction above:
 4. **Compute the row quotients.**
    [`compute_multi_group_relation_quotient`](https://github.com/LayerZero-Labs/akita/blob/eea8443841ed4a701bf84a9f6415aa9415d6250d/crates/akita-prover/src/protocol/ring_relation/relation_quotient.rs#L412-L690)
    computes one quotient for each `consistency`, $\mathbf A$, $\mathbf B$, and
-   $\mathbf D$ row. `ring_switch_build_w` decomposes them and appends
-   $\hat r$.
+   $\mathbf D$ row. Despite its general name, this is also the canonical
+   single-group path. `ring_switch_build_w` decomposes the quotients and
+   appends $\hat r$.
 5. **Evaluate the extended relation.**
    [`build_relation_weight_events`](https://github.com/LayerZero-Labs/akita/blob/eea8443841ed4a701bf84a9f6415aa9415d6250d/crates/akita-prover/src/protocol/ring_switch/relation_weights.rs#L398-L870)
    emits the contributions of all four row families and the quotient columns
@@ -614,10 +616,10 @@ RingRelationProver::new
                   |
                   v
 ring_switch_build_w
-|-- compute_multi_group_relation_quotient --> r
-|-- decompose z ----------------------------> z_hat
-|-- decompose r ----------------------------> r_hat
-`-- emit [z_hat | e_hat | t_hat | r_hat] ---> committed witness w
+|-- compute relation quotients ----------> r
+|-- decompose z -------------------------> z_hat
+|-- decompose r -------------------------> r_hat
+`-- emit [z_hat | e_hat | t_hat | r_hat] --> committed witness w
                   |
                   v
 build_relation_weight_events
@@ -632,24 +634,22 @@ verifier can reconstruct:
 
 | Field | Mathematical meaning |
 |---|---|
-| `group_challenges()` | fold challenges $c_b$ |
-| `group_opening_point()` | ordinary opening weights, including $Q_p$ and $B_b$ |
-| `group_ring_multiplier_point()` | ring multipliers used by the physical consistency row |
+| `group_challenges()[0]` | fold challenges $c_b$ |
+| `group_opening_point(0)` | ordinary opening weights, including $Q_p$ and $B_b$ |
+| `group_ring_multiplier_point(0)` | ring multipliers used by the physical consistency row |
 | `rhs()` | $\mathbf y=[0\mid\mathbf 0_A\mid\mathbf u\mid\mathbf v_D]$ in the basic setting |
 | `v()` | $\mathbf v_D=\mathbf D\hat{\mathbf e}$ |
-| `role_dims()` | the $\mathbf A$-, $\mathbf B$-, and $\mathbf D$-row ring dimensions |
 
 ### Prover witness: `RingRelationWitness`
 
 [`RingRelationWitness`](https://github.com/LayerZero-Labs/akita/blob/eea8443841ed4a701bf84a9f6415aa9415d6250d/crates/akita-prover/src/protocol/ring_relation_witness.rs#L141-L220)
-is the prover-only aggregate witness. It holds the fold-grinding nonce and one
-[`RingRelationGroupWitness`](https://github.com/LayerZero-Labs/akita/blob/eea8443841ed4a701bf84a9f6415aa9415d6250d/crates/akita-prover/src/protocol/ring_relation_witness.rs#L8-L140)
-per polynomial group. In the basic setting, the vector contains one group:
+is the prover-only aggregate witness. In the basic setting, its `groups`
+vector contains one
+[`RingRelationGroupWitness`](https://github.com/LayerZero-Labs/akita/blob/eea8443841ed4a701bf84a9f6415aa9415d6250d/crates/akita-prover/src/protocol/ring_relation_witness.rs#L8-L140):
 
 | Field | Mathematical meaning |
 |---|---|
 | `z_folded_rings` | folded response $\mathbf z$, before decomposition into $\hat z$ |
-| `z_folded_centered_per_chunk` | chunk-local folded responses $\mathbf z_k$ |
 | `e_folded` | recomposed position-folded rings $E_b$ |
 | `e_hat` | opening digits $\hat{\mathbf e}$ |
 | `hint` | commitment hint containing $\hat{\mathbf t}$ |
@@ -668,7 +668,7 @@ it reconstructs the public instance from the transcript and public proof data:
 public commitment rows, opening points, v_D, and transcript
                             |
                             v
-rederive the per-group fold challenges
+rederive the fold challenges
                             |
                             v
 assemble_relation_rhs
@@ -681,10 +681,6 @@ ring_switch_verifier --------------------------------------> Stage 2 verifier
 ```
 
 Only the public instance is reconstructed on the verifier. The
-`RingRelationWitness` and its group witnesses remain prover-only.
-
-The basic case on this page extends to multiple commitment groups, witness
-chunks, and mixed ring dimensions in [Advanced relation
-layouts](./advanced-relation-layouts.md). [Opening points and digit-innermost
-layout](./opening-points-layout.md#witness-order) then specifies the canonical
-physical source and digit order.
+`RingRelationWitness` remains prover-only. [Opening points and digit-innermost
+layout](./opening-points-layout.md#witness-order) specifies the canonical
+physical source and digit order used by the implementation.

From 4061afe4cf94d38daab83954dd1944a440f2dde5 Mon Sep 17 00:00:00 2001
From: Freya <fengrun.liu@gmail.com>
Date: Wed, 5 Aug 2026 10:23:26 -0400
Subject: [PATCH 10/17] docs(book): introduce fold input objects

---
 book/src/how/proving/akita-fold.md | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/book/src/how/proving/akita-fold.md b/book/src/how/proving/akita-fold.md
index d52caf246..51cb8e2f9 100644
--- a/book/src/how/proving/akita-fold.md
+++ b/book/src/how/proving/akita-fold.md
@@ -50,6 +50,15 @@ described on this page.
 
 ## Objects entering the fold
 
+Before deriving the four relation families, we first identify the secret
+objects on which they act. Starting from the digit vectors of the old
+polynomial blocks, the prover derives inner-image digits
+$\hat{\mathbf t}$ and partial-evaluation digits $\hat{\mathbf e}$, then folds
+the block digits into $\mathbf z$ and digitizes it as $\hat{\mathbf z}$. These
+three digit vectors become the main segments of the next committed witness.
+This section introduces them in dependency order, beginning with the bounded
+digit representation required by the commitment binding argument.
+
 ### Why the witness is digit-decomposed
 
 The witness committed for the next level must have bounded coefficients. This

From 7f22d069e89de5358dfd981fdcae860fa77bbaff Mon Sep 17 00:00:00 2001
From: Freya <fengrun.liu@gmail.com>
Date: Wed, 5 Aug 2026 11:13:03 -0400
Subject: [PATCH 11/17] akita-book: polish basic relation

---
 book/src/how/proving/akita-fold.md | 225 ++++++++++++++++++++---------
 1 file changed, 159 insertions(+), 66 deletions(-)

diff --git a/book/src/how/proving/akita-fold.md b/book/src/how/proving/akita-fold.md
index 51cb8e2f9..aa12608ce 100644
--- a/book/src/how/proving/akita-fold.md
+++ b/book/src/how/proving/akita-fold.md
@@ -33,9 +33,10 @@ described on this page.
 
 ## Contents
 
-- [Objects entering the fold](#objects-entering-the-fold)
-  - [Why the witness is digit-decomposed](#why-the-witness-is-digit-decomposed)
-  - [Polynomial blocks and inner digits](#polynomial-blocks-and-inner-digits)
+- [Inputs and objects derived in the fold](#inputs-and-objects-derived-in-the-fold)
+  - [The committed polynomial and opening query](#the-committed-polynomial-and-opening-query)
+  - [Balanced digit representations](#balanced-digit-representations)
+  - [Polynomial blocks and commitment hint](#polynomial-blocks-and-commitment-hint)
   - [Partial evaluations and opening digits](#partial-evaluations-and-opening-digits)
   - [The folded response and its digitization](#the-folded-response-and-its-digitization)
 - [The four physical relation families](#the-four-physical-relation-families)
@@ -48,65 +49,147 @@ described on this page.
 - [The scalar opening claim is a virtual row](#the-scalar-opening-claim-is-a-virtual-row)
 - [Code reference](#code-reference)
 
-## Objects entering the fold
+## Inputs and objects derived in the fold
 
-Before deriving the four relation families, we first identify the secret
-objects on which they act. Starting from the digit vectors of the old
-polynomial blocks, the prover derives inner-image digits
-$\hat{\mathbf t}$ and partial-evaluation digits $\hat{\mathbf e}$, then folds
-the block digits into $\mathbf z$ and digitizes it as $\hat{\mathbf z}$. These
-three digit vectors become the main segments of the next committed witness.
-This section introduces them in dependency order, beginning with the bounded
-digit representation required by the commitment binding argument.
+A fold starts from a public opening claim
 
-### Why the witness is digit-decomposed
+$$
+\widetilde f(r)=v
+$$
+
+for a polynomial whose commitment $\mathbf u$ is already fixed. At a recursive
+level, $\mathbf u$ is the next-witness commitment produced by the preceding
+level; at the root, the original polynomial commitment plays the same role.
+
+The prover and verifier have different views of these inputs. The prover holds
+the polynomial blocks, their inner-digit representation, the commitment hint
+generated when $\mathbf u$ was formed, and the public commitment itself. The
+verifier knows $\mathbf u$ and the opening claim, but receives neither the
+blocks nor the hint.
+
+From these inputs, the current fold derives two new representations of the
+committed polynomial. The opening point determines partial evaluations $E_b$
+inside each block, while fresh transcript challenges fold the old block digits
+into a response $\mathbf z$. Both are digit-decomposed before entering the next
+committed witness. The four relation families later prove that these derived
+objects are consistent with the same hidden opening of $\mathbf u$.
 
-The witness committed for the next level must have bounded coefficients. This
-shortness condition is essential for the Module-SIS binding argument: two
-different bounded openings of the same linear commitment would give a short,
-nonzero vector in the kernel of its commitment matrix.
+### The committed polynomial and opening query
 
-Gadget decomposition provides the bounded representation. For a power-of-two
-base $g$ and digit depth $\delta$, define
+As in the previous page, split the ring-valued polynomial table into blocks.
+Let $b$ index a live block and $p$ a position inside that block. Pack the inner
+coefficient axis into the ring element
 
 $$
-\mathbf G_{g,n}
+F_{p,b}(X)\in R.
+$$
+
+The [field-to-ring evaluation
+reduction](./field-ring-reduction.md#the-evaluation-problem) splits $r$ into
+inner, position, and block coordinates and defines their interpolation weights
+$I_\ell$, $Q_p$, and $B_b$. We reuse those definitions here rather than
+deriving them again. The position weights $Q_p$ produce $E_b$ below, while the
+block weights $B_b$ and inner weights $I_\ell$ belong to the field-valued
+evaluation relation. The opening claim enters this page with target $v$. The
+evaluation reduction later writes its trace-form target as
+$v_{\mathrm{tr}}$; for the single base-field claim considered here, the valid
+relation has $v_{\mathrm{tr}}=v$.
+
+### Balanced digit representations
+
+Both the existing commitment opening and the next committed witness must have
+bounded coefficients. This shortness condition is what lets commitment binding
+reduce to Module-SIS: two distinct bounded openings of the same linear
+commitment would yield a short, nonzero kernel vector.
+
+Akita obtains these bounded representations by decomposing ring coefficients
+into balanced base-$g$ digits. Let $g$ be an even power of two, let $\delta$ be
+the digit depth, and let
+$\mathbf x=(x_0,\ldots,x_{n-1})\in R^n$. A balanced decomposition of
+$\mathbf x$ consists of digit rings $\hat x_{i,h}(X)\in R$, indexed by
+$0\le i<n$ and $0\le h<\delta$, such that
+
+$$
+x_i(X)
 =
-\mathbf I_n\otimes(1,g,\ldots,g^{\delta-1}).
+\sum_{h=0}^{\delta-1}g^h\hat x_{i,h}(X),
+\qquad
+[\hat x_{i,h}]_\ell
+\in
+\{-g/2,\ldots,g/2-1\}
 $$
 
-A balanced decomposition of $\mathbf x$ is a digit vector $\hat{\mathbf x}$
-such that
+for every coefficient position $0\le \ell<D$. Stack the digit rings with $h$
+innermost into $\hat{\mathbf x}\in R^{n\delta}$. Define the gadget row and its
+block-diagonal recomposition matrix by
 
 $$
-\mathbf x=\mathbf G_{g,n}\hat{\mathbf x},
+\mathbf g_{g,\delta}
+=
+(1,g,\ldots,g^{\delta-1}),
 \qquad
-\hat x_i\in
-\{-g/2,\ldots,g/2-1\}.
+\mathbf G_{g,n}
+=
+\mathbf I_n\otimes\mathbf g_{g,\delta}
+\in R^{n\times n\delta}.
 $$
 
-The decomposition specifies this small-digit representation; the protocol's
-range check proves that the committed coordinates really lie in the required
-range. Akita may use different bases and depths for the inner, outer, opening,
-fold-response, and quotient decompositions. Below, $G_a^{\mathrm{in}}$,
-$G_h^{\mathrm{out}}$, $G_h^{\mathrm{open}}$, and $G_f^{\mathrm{fold}}$ denote
-the scalar gadget weights used to decompose $F_{p,b}$, $\mathbf t_b$, $E_b$,
-and $\mathbf z$, respectively. They are entries of the corresponding gadget
-rows defined above. We omit the role-specific base and depth from this notation
-for simplicity.
+The coefficientwise identities then become the vector equation
 
-### Polynomial blocks and inner digits
+$$
+\boxed{
+\mathbf x
+=
+\mathbf G_{g,n}\hat{\mathbf x}.
+}
+$$
 
-As in the previous page, split the ring-valued polynomial table into blocks.
-Let $b$ index a live block and $p$ a position inside the block. Write the ring
-at that location as
+The entries of $\mathbf G_{g,n}$ are public scalars embedded as constant ring
+elements. Thus $\mathbf G_{g,n}$ is a deterministic **recomposition matrix**,
+not a commitment matrix such as $\mathbf A$, $\mathbf B$, or $\mathbf D$.
+Digit decomposition produces $\hat{\mathbf x}$; multiplication by
+$\mathbf G_{g,n}$ reconstructs $\mathbf x$. The protocol's range check
+certifies that the committed coefficients of $\hat{\mathbf x}$ lie in the
+balanced digit range.
+
+Akita chooses separate bases and depths for different witness roles. To keep
+the derivation readable, write $G_a^{\mathrm{in}}$,
+$G_h^{\mathrm{out}}$, $G_h^{\mathrm{open}}$, and
+$G_f^{\mathrm{fold}}$ for the corresponding scalar gadget weights. The four
+recomposition identities used on this page are
 
 $$
-F_{p,b}(X)\in R.
+\begin{aligned}
+F_{p,b}(X)
+&=
+\sum_a G_a^{\mathrm{in}}s_{b,p,a}(X),
+\\
+t_{b,\rho}(X)
+&=
+\sum_h G_h^{\mathrm{out}}\hat t_{b,\rho,h}(X),
+\\
+E_b(X)
+&=
+\sum_h G_h^{\mathrm{open}}\hat e_{b,h}(X),
+\\
+z_{p,a}(X)
+&=
+\sum_f G_f^{\mathrm{fold}}\hat z_{p,a,f}(X).
+\end{aligned}
 $$
 
-Digit-decompose each ring with public inner gadget weights
-$G_a^{\mathrm{in}}$:
+The first two identities describe commitment-side data already fixed by
+$\mathbf u$: $\mathbf s_b$ is the incoming inner-digit representation, and
+$\hat{\mathbf t}$ is reconstructed from the incoming hint. The latter two
+digit families, $\hat{\mathbf e}$ and $\hat{\mathbf z}$, are newly derived from
+the opening point and fold challenges. We now place each identity in its
+protocol context.
+
+### Polynomial blocks and commitment hint
+
+The commitment-side inputs are fixed before the polynomial is queried. For
+each block, the prover has the inner digit rings $s_{b,p,a}$ and can therefore
+recompose the polynomial rings as
 
 $$
 F_{p,b}(X)
@@ -115,8 +198,9 @@ F_{p,b}(X)
 \tag{1}
 $$
 
-For one block, collect all digit rings $s_{b,p,a}$ into a vector
-$\mathbf{s}_b$. The inner commitment matrix $\mathbf A$ maps that vector to
+For one block, collect the digit rings $s_{b,p,a}$ into a vector
+$\mathbf{s}_b$. The inner commitment matrix $\mathbf A$ maps this block vector
+to an inner image
 
 $$
 \mathbf t_b
@@ -125,18 +209,19 @@ $$
 \tag{2}
 $$
 
-Each coordinate of $\mathbf t_b$ is decomposed again, now with the outer
-gadget weights $G_h^{\mathrm{out}}$:
+Each coordinate of $\mathbf t_b$ is itself represented by balanced outer
+digits:
 
 $$
 t_{b,\rho}(X)
 =
-\sum_hG_h^{\mathrm{out}}\hat t_{b,\rho,h}(X),
+\sum_h G_h^{\mathrm{out}}\hat t_{b,\rho,h}(X),
 \tag{3}
 $$
 
-where $\rho$ selects a row of $\mathbf A$. Stack the $\hat t$ digits from all
-blocks. The public outer commitment is
+where $\rho$ selects a row of $\mathbf A$. Stack these digits over all blocks
+to obtain $\hat{\mathbf t}$. The outer commitment matrix $\mathbf B$ then gives
+the public commitment
 
 $$
 \mathbf u
@@ -145,20 +230,27 @@ $$
 \tag{4}
 $$
 
-The matrices $\mathbf A$ and $\mathbf B$ therefore serve different purposes:
-$\mathbf A$ creates an inner image for each block, while $\mathbf B$ commits
-the digit-decomposed inner images across all blocks.
+The two matrices have distinct roles: $\mathbf A$ forms one inner image per
+block, whereas $\mathbf B$ commits the digit-decomposed inner images across all
+blocks. The prover's commitment hint stores the recomposed inner images
+$\mathbf t_b$; this fold decomposes them to recover $\hat{\mathbf t}$. At a
+recursive level, the polynomial blocks, hint, and $\mathbf u$ were produced by
+the preceding level. At the root, they come from the original commitment. The
+verifier receives only $\mathbf u$ from this commitment-side data. Equations
+(1)--(4) describe the hidden opening that the later relation rows bind to that
+public value.
 
 ### Partial evaluations and opening digits
 
-Let $Q_p$ be the position weight derived from the opening point. For the
-base-field setting of the previous page, $Q_p\in F$ acts as a constant in
-$R$. Evaluate the position coordinate inside each block:
+The first new witness object derived in this fold comes from the opening point.
+Use its position weights $Q_p$ to evaluate the position coordinate inside each
+block. In the base-field setting of the previous page, $Q_p\in F$ acts as a
+constant in $R$:
 
 $$
 E_b(X)
 =
-\sum_pQ_pF_{p,b}(X).
+\sum_p Q_pF_{p,b}(X).
 \tag{5}
 $$
 
@@ -168,7 +260,7 @@ $G_h^{\mathrm{open}}$:
 $$
 E_b(X)
 =
-\sum_hG_h^{\mathrm{open}}\hat e_{b,h}(X).
+\sum_h G_h^{\mathrm{open}}\hat e_{b,h}(X).
 \tag{6}
 $$
 
@@ -182,16 +274,17 @@ $$
 \tag{7}
 $$
 
-The subscript in $\mathbf v_D$ distinguishes this ring vector from the scalar
-opening target $v_{\mathrm{tr}}$. Equation (7) is a commitment relation; it
-does not prove that the multilinear evaluation equals
-$v_{\mathrm{tr}}$.
+The subscript in $\mathbf v_D$ distinguishes this ring-vector commitment from
+the scalar opening target $v$ and its trace-form counterpart
+$v_{\mathrm{tr}}$. Equation (7) binds the newly derived opening digits; it does
+not by itself prove the scalar evaluation claim.
 
 ### The folded response and its digitization
 
-After the relevant data is fixed, the transcript samples one sparse
-ring-valued fold challenge $c_b(X)$ for each live block. The prover folds the
-original block digits:
+Once the opening digits have been committed through $\mathbf v_D$, the
+transcript samples one sparse ring-valued challenge $c_b(X)$ for each live
+block. These challenges are separate from the query weights $B_b$. The prover
+uses them to fold the original block digits:
 
 $$
 z_{p,a}(X)
@@ -276,11 +369,11 @@ Akita therefore decomposes $\mathbf z$ once more:
 $$
 z_{p,a}(X)
 =
-\sum_fG_f^{\mathrm{fold}}\hat z_{p,a,f}(X).
+\sum_f G_f^{\mathrm{fold}}\hat z_{p,a,f}(X).
 \tag{9}
 $$
 
-The three main digit segments produced so far are therefore
+The three main digit segments assembled for the next witness are therefore
 
 $$
 \hat{\mathbf z}

From 4186e2b38e827ff73295404ee521fdcfd76fe10b Mon Sep 17 00:00:00 2001
From: Freya <fengrun.liu@gmail.com>
Date: Wed, 5 Aug 2026 12:03:03 -0400
Subject: [PATCH 12/17] akita-book: basic relation families

---
 book/src/how/proving/akita-fold.md | 206 ++++++++++++++---------------
 1 file changed, 99 insertions(+), 107 deletions(-)

diff --git a/book/src/how/proving/akita-fold.md b/book/src/how/proving/akita-fold.md
index aa12608ce..839cd09a9 100644
--- a/book/src/how/proving/akita-fold.md
+++ b/book/src/how/proving/akita-fold.md
@@ -318,53 +318,44 @@ the resulting $\mathbf z$ fits that scheduled bound. This grinding helps the
 honest prover find a compact response; the range check on its committed digits
 is what certifies the bound in the protocol.
 
-Before digitizing $\mathbf z$, the two challenge-dependent relations already
-follow directly from linearity. For the partial evaluations,
+Before digitizing $\mathbf z$, linearity already gives two
+challenge-dependent identities among the recomposed ring elements. For the
+partial evaluations, Equations (1), (5), and (8) give
 
 $$
 \begin{aligned}
 \sum_b c_bE_b
 &=
-\sum_b c_b\sum_pQ_pF_{p,b}\\
+\sum_{b,p}c_bQ_pF_{p,b}\\
 &=
 \sum_{p,a}Q_pG_a^{\mathrm{in}}
-\left(\sum_bc_bs_{b,p,a}\right)\\
+\left(\sum_b c_bs_{b,p,a}\right)\\
 &=
 \sum_{p,a}Q_pG_a^{\mathrm{in}}z_{p,a}.
 \end{aligned}
+\tag{8a}
 $$
 
-Using the opening digits from Equation (6), this is
+Similarly, Equations (2) and (8) imply, for every row $\rho$ of $\mathbf A$,
 
 $$
-\sum_{b,h}c_bG_h^{\mathrm{open}}\hat e_{b,h}
-=
-\sum_{p,a}Q_pG_a^{\mathrm{in}}z_{p,a}.
-$$
-
-Similarly, $\mathbf t_b=\mathbf A\mathbf s_b$ implies
-
-$$
-\sum_bc_b\mathbf t_b
-=
-\mathbf A\left(\sum_bc_b\mathbf s_b\right)
-=
-\mathbf A\mathbf z.
-$$
-
-For row $\rho$ of $\mathbf A$, and using the outer digits from Equation (3),
-this becomes
-
-$$
-\sum_{b,h}c_bG_h^{\mathrm{out}}\hat t_{b,\rho,h}
-=
+\begin{aligned}
+\sum_b c_bt_{b,\rho}
+&=
+\sum_{p,a}A_{\rho,(p,a)}
+\left(\sum_b c_bs_{b,p,a}\right)\\
+&=
 \sum_{p,a}A_{\rho,(p,a)}z_{p,a}.
+\end{aligned}
+\tag{8b}
 $$
 
-These identities explain the relations in terms of the raw folded response.
-The next-level committed witness, however, must again consist of bounded
-digits so that its shortness is certified for the Module-SIS binding argument.
-Akita therefore decomposes $\mathbf z$ once more:
+Equations (8a) and (8b) are identities among the recomposed values; they do not
+yet use the opening digits $\hat{\mathbf e}$ or outer digits
+$\hat{\mathbf t}$. The next-level committed witness also contains bounded
+digits rather than $\mathbf z$ itself so that its shortness is certified for
+the Module-SIS binding argument. Akita therefore decomposes $\mathbf z$ once
+more:
 
 $$
 z_{p,a}(X)
@@ -394,32 +385,37 @@ They have different origins:
 
 ## The four physical relation families
 
-The verifier must check that the three segments in Equation (10) describe the
-same original polynomial and commitment. Akita expresses the checks as four
-families of linear equations over $R$.
-
-### 1. Fold-evaluation consistency
-
-Fold the recomposed partial evaluations using the same challenges as in
-Equation (8):
+Equation (10) assembles three digit segments, but placing them next to one
+another does not yet show that they describe the same polynomial opening.
+Equations (8a) and (8b) establish this consistency among the recomposed values.
+The committed witness instead contains $\hat{\mathbf e}$,
+$\hat{\mathbf t}$, and $\hat{\mathbf z}$. Substituting Equations (3), (6), and
+(9), then adding the two commitment equations from the previous section,
+gives four families of linear equations over
 
 $$
-\sum_{b,h}
-c_bG_h^{\mathrm{open}}\hat e_{b,h}.
-\tag{11}
+R=F[X]/(X^D+1).
 $$
 
-Alternatively, first fold the original digit blocks into $\hat z$, recompose
-them with Equation (9), and then apply the position weights:
+Every sum, product, and equality in this section is computed in $R$; vector
+equations are interpreted coordinatewise in $R$. The first two families
+connect the private witness segments to one another. The last two anchor those
+segments to the public commitments $\mathbf u$ and $\mathbf v_D$.
 
-$$
-\sum_{p,a,f}
-Q_pG_a^{\mathrm{in}}G_f^{\mathrm{fold}}\hat z_{p,a,f}.
-\tag{12}
-$$
+### 1. Fold-evaluation consistency
 
-Both expressions equal $\sum_bc_bE_b$. The first physical row therefore
-checks
+The purpose of this row is to bind the blockwise partial evaluations to the
+same random fold used for the polynomial blocks. Equation (8a) batches all
+partial-evaluation identities with the fresh challenges $c_b$. When every
+$E_b$ is correct, evaluating positions and folding blocks in either order
+produces $\sum_b c_bE_b$. If even one partial evaluation is inconsistent, it
+is unlikely that its error will cancel in this random combination. Moreover,
+the opening digits are committed through $\mathbf v_D$ before the challenges
+are sampled, so they cannot be adjusted after the $c_b$ values are known.
+
+To express Equation (8a) in terms of the next-fold witness, substitute the
+balanced digit representations of $E_b$ from Equation (6) and $\mathbf z$
+from Equation (9). This gives the `consistency` row
 
 $$
 \boxed{
@@ -429,38 +425,30 @@ c_bG_h^{\mathrm{open}}\hat e_{b,h}
 \sum_{p,a,f}
 Q_pG_a^{\mathrm{in}}G_f^{\mathrm{fold}}\hat z_{p,a,f}.
 }
-\tag{13}
+\tag{11}
 $$
 
-This is called the `consistency` row in the code. It binds the partial
-evaluation digits $\hat e$ to the folded response $\hat z$. It does **not**
-contain the scalar opening target $v_{\mathrm{tr}}$.
-
-Notice that this row uses the random fold challenges $c_b$, not the block
-opening weights $B_b$ from the previous page. The $B_b$ weights belong to the
-separate evaluation-correctness relation on $\hat e$.
+This row uses the random fold challenges $c_b$, not the block-opening weights
+$B_b$. The latter belong to the separate field-valued evaluation relation on
+$\hat{\mathbf e}$. In particular, this ring relation does not contain the
+scalar target $v_{\mathrm{tr}}$.
 
 ### 2. Inner-commitment consistency
 
-For every row $\rho$ of $\mathbf A$, fold the corresponding recomposed inner
-images:
+For every block $b$, the inner commitment defines the basic relation
+$\mathbf t_b=\mathbf A\mathbf s_b$. The goal is to check this entire family of
+blockwise relations. Checking them one by one would retain a separate vector
+equation for every block. Instead, Equation (8b) uses the challenges $c_b$ to
+batch them as
+$\sum_b c_b\mathbf t_b=\mathbf A(\sum_b c_b\mathbf s_b)=\mathbf A\mathbf z$.
+This leaves one vector relation across the blocks: the challenges batch the
+block index $b$, while every row $\rho$ of $\mathbf A$ is still checked. It
+connects the folded response to the commitment-side $\mathbf t_b$ values,
+which the outer-commitment rows below anchor to $\mathbf u$.
 
-$$
-\sum_{b,h}
-c_bG_h^{\mathrm{out}}\hat t_{b,\rho,h}.
-\tag{14}
-$$
-
-By linearity of $\mathbf A$, this must equal row $\rho$ of $\mathbf A$ applied
-to the folded response:
-
-$$
-\sum_{p,a,f}
-A_{\rho,(p,a)}G_f^{\mathrm{fold}}\hat z_{p,a,f}.
-\tag{15}
-$$
-
-Thus every $\mathbf A$ row checks
+The next-fold witness stores the balanced digits rather than the recomposed
+values. Substitute Equation (3) for $\mathbf t_b$ and Equation (9) for
+$\mathbf z$. For every row $\rho$ of $\mathbf A$, this gives
 
 $$
 \boxed{
@@ -470,17 +458,19 @@ c_bG_h^{\mathrm{out}}\hat t_{b,\rho,h}
 \sum_{p,a,f}
 A_{\rho,(p,a)}G_f^{\mathrm{fold}}\hat z_{p,a,f}.
 }
-\tag{16}
+\tag{12}
 $$
 
-There is no factor $G_a^{\mathrm{in}}$ on the right of Equation (16):
+There is no factor $G_a^{\mathrm{in}}$ on the right of Equation (12):
 $\mathbf A$ already acts on the inner digit vector $\mathbf s_b$, whose
 columns are indexed by $(p,a)$.
 
 ### 3. Outer-commitment consistency
 
-The $\hat t$ segment must still open the public commitment that entered this
-fold:
+The first two families compare private witness segments but do not yet tie
+them to the commitment seen by the verifier. The outer-commitment rows provide
+that public anchor by requiring $\hat{\mathbf t}$ to open the commitment that
+entered this fold:
 
 $$
 \boxed{
@@ -488,15 +478,17 @@ $$
 =
 \mathbf u.
 }
-\tag{17}
+\tag{13}
 $$
 
-Unlike Equations (13) and (16), this relation does not use the fold
-challenges. It checks the existing outer commitment directly.
+This is a direct commitment check and therefore does not use the fold
+challenges.
 
 ### 4. Opening-commitment consistency
 
-The $\hat e$ segment is bound by the opening commitment from Equation (7):
+Finally, the opening-commitment rows anchor $\hat{\mathbf e}$ to the public
+ring vector $\mathbf v_D$ that was absorbed before the fold challenges were
+sampled:
 
 $$
 \boxed{
@@ -504,12 +496,12 @@ $$
 =
 \mathbf v_D.
 }
-\tag{18}
+\tag{14}
 $$
 
-This relation also does not use the fold challenges. It prevents the prover
-from changing the partial-evaluation digits after $\mathbf v_D$ has been
-absorbed.
+This prevents the prover from changing the partial-evaluation digits after
+$\mathbf v_D$ has been fixed. Like the other three families, it is a relation
+over $R$; it is distinct from the field-valued scalar evaluation claim.
 
 ## Assemble the ring relation
 
@@ -523,7 +515,7 @@ $$
 \hat{\mathbf e}
 \;\Vert\;
 \hat{\mathbf t}.
-\tag{19}
+\tag{15}
 $$
 
 The four relation families can be written as one matrix equation
@@ -533,17 +525,17 @@ $$
 \mathbf M_0\mathbf w_0=\mathbf y
 \quad\text{over }R.
 }
-\tag{20}
+\tag{16}
 $$
 
 For one group, the physical row order and right-hand side are:
 
 | Physical rows | Meaning | Right-hand side |
 |---|---|---|
-| `consistency` | Equation (13) | $0$ |
-| $\mathbf A$ rows | Equation (16) | $\mathbf 0$ |
-| $\mathbf B$ rows | Equation (17) | $\mathbf u$ |
-| $\mathbf D$ rows | Equation (18) | $\mathbf v_D$ |
+| `consistency` | Equation (11) | $0$ |
+| $\mathbf A$ rows | Equation (12) | $\mathbf 0$ |
+| $\mathbf B$ rows | Equation (13) | $\mathbf u$ |
+| $\mathbf D$ rows | Equation (14) | $\mathbf v_D$ |
 
 Consequently,
 
@@ -557,7 +549,7 @@ $$
 \mathbf u
 \;\Vert\;
 \mathbf v_D.
-\tag{21}
+\tag{17}
 $$
 
 The matrix is usually not materialized as one dense object. Its entries come
@@ -567,7 +559,7 @@ contributions directly from the canonical witness layout.
 
 ## Lift the ring relation before sumcheck
 
-Equation (20) is an equality modulo $X^D+1$. Sumcheck, however, needs a field
+Equation (16) is an equality modulo $X^D+1$. Sumcheck, however, needs a field
 identity. Choose the canonical representatives of degree less than $D$ for
 all ring elements. There is then one quotient polynomial for every physical
 row:
@@ -578,7 +570,7 @@ $$
 \widetilde{\mathbf y}(X)
 =
 (X^D+1)\mathbf r(X).
-\tag{22}
+\tag{18}
 $$
 
 Digit-decompose the quotient vector:
@@ -587,7 +579,7 @@ $$
 \mathbf r(X)
 =
 \mathbf G_r\hat{\mathbf r}(X),
-\tag{23}
+\tag{19}
 $$
 
 and append its digits to the committed witness:
@@ -604,7 +596,7 @@ $$
 \;\Vert\;
 \hat{\mathbf r}.
 }
-\tag{24}
+\tag{20}
 $$
 
 Move the denominator term to the left and define
@@ -617,7 +609,7 @@ $$
 \;\middle|\;
 -(X^D+1)\mathbf G_r
 \right].
-\tag{25}
+\tag{21}
 $$
 
 The extended relation is the exact polynomial identity
@@ -628,24 +620,24 @@ $$
 =
 \widetilde{\mathbf y}(X).
 }
-\tag{26}
+\tag{22}
 $$
 
-This distinction is important: Equation (22) uses the quotient
-$\mathbf r$, while Equation (26) already includes the quotient digits
+This distinction is important: Equation (18) uses the quotient
+$\mathbf r$, while Equation (22) already includes the quotient digits
 $\hat{\mathbf r}$ inside $\mathbf w$. The denominator term must not be added
 to the right-hand side a second time.
 
-Ring switching now samples $\alpha$ and evaluates Equation (26):
+Ring switching now samples $\alpha$ and evaluates Equation (22):
 
 $$
 \mathbf M_{\mathrm{ext}}(\alpha)\mathbf w(\alpha)
 =
 \mathbf y(\alpha).
-\tag{27}
+\tag{23}
 $$
 
-Equation (27) is the field relation consumed by Stage 2. The
+Equation (23) is the field relation consumed by Stage 2. The
 [Sumcheck stages](./sumcheck-stages.md#stage-2-fused-relation-sumcheck) page
 explains how $\tau_1$ batches its physical rows and how the resulting relation
 is proved over the flat witness address.
@@ -668,7 +660,7 @@ is absent from $\mathbf M_0$, $\mathbf y$, and the quotient vector
 $\mathbf r$.
 
 [Sumcheck stages](./sumcheck-stages.md#stage-2-fused-relation-sumcheck)
-continues from Equation (27) and fuses the physical relation, the virtual
+continues from Equation (23) and fuses the physical relation, the virtual
 evaluation row, and the range-image binding into one Stage-2 sumcheck.
 
 ## Code reference

From 47caa5f32bb0d02a269572e23d21dae314f4c1a4 Mon Sep 17 00:00:00 2001
From: Freya <fengrun.liu@gmail.com>
Date: Wed, 5 Aug 2026 13:31:03 -0400
Subject: [PATCH 13/17] akita-book: basic relation families

---
 book/src/how/proving/akita-fold.md | 81 ++++++++++++++++++------------
 1 file changed, 49 insertions(+), 32 deletions(-)

diff --git a/book/src/how/proving/akita-fold.md b/book/src/how/proving/akita-fold.md
index 839cd09a9..2bf908474 100644
--- a/book/src/how/proving/akita-fold.md
+++ b/book/src/how/proving/akita-fold.md
@@ -404,14 +404,31 @@ segments to the public commitments $\mathbf u$ and $\mathbf v_D$.
 
 ### 1. Fold-evaluation consistency
 
-The purpose of this row is to bind the blockwise partial evaluations to the
-same random fold used for the polynomial blocks. Equation (8a) batches all
-partial-evaluation identities with the fresh challenges $c_b$. When every
-$E_b$ is correct, evaluating positions and folding blocks in either order
-produces $\sum_b c_bE_b$. If even one partial evaluation is inconsistent, it
-is unlikely that its error will cancel in this random combination. Moreover,
-the opening digits are committed through $\mathbf v_D$ before the challenges
-are sampled, so they cannot be adjusted after the $c_b$ values are known.
+For every block $b$, the partial evaluation $E_b$ must be computed from the
+same polynomial digits $\mathbf s_b$ that enter the fold. Equations (1) and
+(5) give the blockwise identity
+
+$$
+\boxed{
+E_b
+=
+\sum_p Q_pF_{p,b}
+=
+\sum_{p,a}Q_pG_a^{\mathrm{in}}s_{b,p,a}.
+}
+\tag{11}
+$$
+
+Rather than checking Equation (11) separately for every block, Equation (8a)
+uses the random challenges $c_b$ to batch them as
+$\sum_b c_bE_b=\sum_{p,a}Q_pG_a^{\mathrm{in}}z_{p,a}$. The left side folds
+the claimed partial evaluations, while the right side evaluates the same
+challenge-folded response $\mathbf z$. Thus one ring equation checks that
+evaluating positions and folding blocks give the same result. If any
+blockwise identity is inconsistent, its error is unlikely to cancel in this
+random combination. Moreover, the opening digits are committed through
+$\mathbf v_D$ before the challenges are sampled, so they cannot be adjusted
+after the $c_b$ values are known.
 
 To express Equation (8a) in terms of the next-fold witness, substitute the
 balanced digit representations of $E_b$ from Equation (6) and $\mathbf z$
@@ -425,7 +442,7 @@ c_bG_h^{\mathrm{open}}\hat e_{b,h}
 \sum_{p,a,f}
 Q_pG_a^{\mathrm{in}}G_f^{\mathrm{fold}}\hat z_{p,a,f}.
 }
-\tag{11}
+\tag{12}
 $$
 
 This row uses the random fold challenges $c_b$, not the block-opening weights
@@ -458,10 +475,10 @@ c_bG_h^{\mathrm{out}}\hat t_{b,\rho,h}
 \sum_{p,a,f}
 A_{\rho,(p,a)}G_f^{\mathrm{fold}}\hat z_{p,a,f}.
 }
-\tag{12}
+\tag{13}
 $$
 
-There is no factor $G_a^{\mathrm{in}}$ on the right of Equation (12):
+There is no factor $G_a^{\mathrm{in}}$ on the right of Equation (13):
 $\mathbf A$ already acts on the inner digit vector $\mathbf s_b$, whose
 columns are indexed by $(p,a)$.
 
@@ -478,7 +495,7 @@ $$
 =
 \mathbf u.
 }
-\tag{13}
+\tag{14}
 $$
 
 This is a direct commitment check and therefore does not use the fold
@@ -496,7 +513,7 @@ $$
 =
 \mathbf v_D.
 }
-\tag{14}
+\tag{15}
 $$
 
 This prevents the prover from changing the partial-evaluation digits after
@@ -515,7 +532,7 @@ $$
 \hat{\mathbf e}
 \;\Vert\;
 \hat{\mathbf t}.
-\tag{15}
+\tag{16}
 $$
 
 The four relation families can be written as one matrix equation
@@ -525,17 +542,17 @@ $$
 \mathbf M_0\mathbf w_0=\mathbf y
 \quad\text{over }R.
 }
-\tag{16}
+\tag{17}
 $$
 
 For one group, the physical row order and right-hand side are:
 
 | Physical rows | Meaning | Right-hand side |
 |---|---|---|
-| `consistency` | Equation (11) | $0$ |
-| $\mathbf A$ rows | Equation (12) | $\mathbf 0$ |
-| $\mathbf B$ rows | Equation (13) | $\mathbf u$ |
-| $\mathbf D$ rows | Equation (14) | $\mathbf v_D$ |
+| `consistency` | Equation (12) | $0$ |
+| $\mathbf A$ rows | Equation (13) | $\mathbf 0$ |
+| $\mathbf B$ rows | Equation (14) | $\mathbf u$ |
+| $\mathbf D$ rows | Equation (15) | $\mathbf v_D$ |
 
 Consequently,
 
@@ -549,7 +566,7 @@ $$
 \mathbf u
 \;\Vert\;
 \mathbf v_D.
-\tag{17}
+\tag{18}
 $$
 
 The matrix is usually not materialized as one dense object. Its entries come
@@ -559,7 +576,7 @@ contributions directly from the canonical witness layout.
 
 ## Lift the ring relation before sumcheck
 
-Equation (16) is an equality modulo $X^D+1$. Sumcheck, however, needs a field
+Equation (17) is an equality modulo $X^D+1$. Sumcheck, however, needs a field
 identity. Choose the canonical representatives of degree less than $D$ for
 all ring elements. There is then one quotient polynomial for every physical
 row:
@@ -570,7 +587,7 @@ $$
 \widetilde{\mathbf y}(X)
 =
 (X^D+1)\mathbf r(X).
-\tag{18}
+\tag{19}
 $$
 
 Digit-decompose the quotient vector:
@@ -579,7 +596,7 @@ $$
 \mathbf r(X)
 =
 \mathbf G_r\hat{\mathbf r}(X),
-\tag{19}
+\tag{20}
 $$
 
 and append its digits to the committed witness:
@@ -596,7 +613,7 @@ $$
 \;\Vert\;
 \hat{\mathbf r}.
 }
-\tag{20}
+\tag{21}
 $$
 
 Move the denominator term to the left and define
@@ -609,7 +626,7 @@ $$
 \;\middle|\;
 -(X^D+1)\mathbf G_r
 \right].
-\tag{21}
+\tag{22}
 $$
 
 The extended relation is the exact polynomial identity
@@ -620,24 +637,24 @@ $$
 =
 \widetilde{\mathbf y}(X).
 }
-\tag{22}
+\tag{23}
 $$
 
-This distinction is important: Equation (18) uses the quotient
-$\mathbf r$, while Equation (22) already includes the quotient digits
+This distinction is important: Equation (19) uses the quotient
+$\mathbf r$, while Equation (23) already includes the quotient digits
 $\hat{\mathbf r}$ inside $\mathbf w$. The denominator term must not be added
 to the right-hand side a second time.
 
-Ring switching now samples $\alpha$ and evaluates Equation (22):
+Ring switching now samples $\alpha$ and evaluates Equation (23):
 
 $$
 \mathbf M_{\mathrm{ext}}(\alpha)\mathbf w(\alpha)
 =
 \mathbf y(\alpha).
-\tag{23}
+\tag{24}
 $$
 
-Equation (23) is the field relation consumed by Stage 2. The
+Equation (24) is the field relation consumed by Stage 2. The
 [Sumcheck stages](./sumcheck-stages.md#stage-2-fused-relation-sumcheck) page
 explains how $\tau_1$ batches its physical rows and how the resulting relation
 is proved over the flat witness address.
@@ -660,7 +677,7 @@ is absent from $\mathbf M_0$, $\mathbf y$, and the quotient vector
 $\mathbf r$.
 
 [Sumcheck stages](./sumcheck-stages.md#stage-2-fused-relation-sumcheck)
-continues from Equation (23) and fuses the physical relation, the virtual
+continues from Equation (24) and fuses the physical relation, the virtual
 evaluation row, and the range-image binding into one Stage-2 sumcheck.
 
 ## Code reference

From 56962cd55f2bbd0d98c96727903bc16ccc3e03ac Mon Sep 17 00:00:00 2001
From: Freya <fengrun.liu@gmail.com>
Date: Wed, 5 Aug 2026 14:47:42 -0400
Subject: [PATCH 14/17] akita-book: basic relation families

---
 book/src/how/proving/akita-fold.md | 182 ++++++++++++++---------------
 1 file changed, 91 insertions(+), 91 deletions(-)

diff --git a/book/src/how/proving/akita-fold.md b/book/src/how/proving/akita-fold.md
index 2bf908474..7f42e8e3f 100644
--- a/book/src/how/proving/akita-fold.md
+++ b/book/src/how/proving/akita-fold.md
@@ -281,87 +281,122 @@ not by itself prove the scalar evaluation claim.
 
 ### The folded response and its digitization
 
-Once the opening digits have been committed through $\mathbf v_D$, the
-transcript samples one sparse ring-valued challenge $c_b(X)$ for each live
-block. These challenges are separate from the query weights $B_b$. The prover
-uses them to fold the original block digits:
+The opening commitment $\mathbf v_D$ binds the prover to
+$\hat{\mathbf e}$, but it does not by itself show that the corresponding
+partial evaluations were computed from the incoming polynomial blocks. For
+every block $b$, correctness requires
 
 $$
-z_{p,a}(X)
+\boxed{
+E_b
 =
-\sum_b c_b(X)s_{b,p,a}(X).
+\sum_p Q_pF_{p,b}
+=
+\sum_{p,a}Q_pG_a^{\mathrm{in}}s_{b,p,a}.
+}
 \tag{8}
 $$
 
-The response $\mathbf z$ no longer carries a live-block index. This is the
-fold's main reduction toward a smaller next-level witness, but combining the
-blocks increases coefficient magnitudes. Let $\sigma_\infty$ bound the
-coefficient norm of every digit block $\mathbf s_b$, and let
-$\omega=\max_b\lVert c_b\rVert_1$. Negacyclic multiplication gives
+Equation (8) connects the partial evaluation derived in this fold to the
+incoming block witness $\mathbf s_b$. The public commitment $\mathbf u$
+creates a second consistency requirement. Equation (4),
+$\mathbf u=\mathbf B\hat{\mathbf t}$, binds the outer digits
+$\hat{\mathbf t}$, which recompose the inner images $\mathbf t_b$ through
+Equation (3). However, this commitment relation does not by itself show that
+the inner images were computed from the incoming block witness. The missing
+link is the blockwise relation $\mathbf t_b=\mathbf A\mathbf s_b$ from
+Equation (2).
+
+Checking both relations separately for every live block would retain the block
+index in the next proof. Instead, after $\mathbf u$ and $\mathbf v_D$ have
+been fixed, the transcript samples one sparse ring-valued challenge $c_b(X)$
+for each live block. These challenges are separate from the query weights
+$B_b$. The prover folds the incoming block witnesses into one response:
 
 $$
-\begin{aligned}
-\lVert\mathbf z\rVert_{\infty,\mathrm{coef}}
-&\le
-\sum_b
-\lVert c_b\mathbf s_b\rVert_{\infty,\mathrm{coef}}\\
-&\le
-|\mathcal B|\,\omega\,\sigma_\infty,
-\end{aligned}
+z_{p,a}(X)
+=
+\sum_b c_b(X)s_{b,p,a}(X).
+\tag{9}
 $$
 
-where $\mathcal B$ is the set of live blocks. The schedule fixes the challenge
-family, its relevant norm bounds, an admissible fold-response bound
-$\beta_{\mathrm{fold}}$, and a digit depth large enough to represent the
-accepted response. The implementation may resample the transcript nonce until
-the resulting $\mathbf z$ fits that scheduled bound. This grinding helps the
-honest prover find a compact response; the range check on its committed digits
-is what certifies the bound in the protocol.
-
-Before digitizing $\mathbf z$, linearity already gives two
-challenge-dependent identities among the recomposed ring elements. For the
-partial evaluations, Equations (1), (5), and (8) give
+The folded response $\mathbf z$ no longer carries a live-block index. Because
+both blockwise relations are linear in $\mathbf s_b$, the same challenges
+batch them into relations on this single response. For the partial
+evaluations, Equations (8) and (9) give
 
 $$
 \begin{aligned}
 \sum_b c_bE_b
 &=
-\sum_{b,p}c_bQ_pF_{p,b}\\
+\sum_{b,p,a}c_bQ_pG_a^{\mathrm{in}}s_{b,p,a}\\
 &=
 \sum_{p,a}Q_pG_a^{\mathrm{in}}
 \left(\sum_b c_bs_{b,p,a}\right)\\
 &=
 \sum_{p,a}Q_pG_a^{\mathrm{in}}z_{p,a}.
 \end{aligned}
-\tag{8a}
+\tag{9a}
 $$
 
-Similarly, Equations (2) and (8) imply, for every row $\rho$ of $\mathbf A$,
+For the inner commitments, Equations (2) and (9) give the vector relation
 
 $$
 \begin{aligned}
-\sum_b c_bt_{b,\rho}
+\sum_b c_b\mathbf t_b
 &=
-\sum_{p,a}A_{\rho,(p,a)}
-\left(\sum_b c_bs_{b,p,a}\right)\\
+\mathbf A\left(\sum_b c_b\mathbf s_b\right)\\
 &=
-\sum_{p,a}A_{\rho,(p,a)}z_{p,a}.
+\mathbf A\mathbf z.
+\end{aligned}
+\tag{9b}
+$$
+
+Equation (9a) says that evaluating within each block and then folding gives the
+same result as first folding the block witnesses into $\mathbf z$ and then
+applying the evaluation weights. Equation (9b) similarly connects
+$\mathbf z$ to the inner images bound through $\mathbf u$. If any blockwise
+relation is incorrect, its error is unlikely to disappear in the corresponding
+random combination. Thus the challenges remove the block index while
+preserving the two links from the incoming witness: one to the partial
+evaluations created in this fold, and one to the commitment that entered it.
+
+This compression has an arithmetic cost: combining the blocks increases
+coefficient magnitudes. Let $\sigma_\infty$ bound the coefficient norm of
+every digit block $\mathbf s_b$, and let
+$\omega=\max_b\lVert c_b\rVert_1$. Negacyclic multiplication gives
+
+$$
+\begin{aligned}
+\lVert\mathbf z\rVert_{\infty,\mathrm{coef}}
+&\le
+\sum_b
+\lVert c_b\mathbf s_b\rVert_{\infty,\mathrm{coef}}\\
+&\le
+|\mathcal B|\,\omega\,\sigma_\infty,
 \end{aligned}
-\tag{8b}
 $$
 
-Equations (8a) and (8b) are identities among the recomposed values; they do not
-yet use the opening digits $\hat{\mathbf e}$ or outer digits
-$\hat{\mathbf t}$. The next-level committed witness also contains bounded
-digits rather than $\mathbf z$ itself so that its shortness is certified for
-the Module-SIS binding argument. Akita therefore decomposes $\mathbf z$ once
-more:
+where $\mathcal B$ is the set of live blocks. The schedule fixes the challenge
+family, its relevant norm bounds, an admissible fold-response bound
+$\beta_{\mathrm{fold}}$, and a digit depth large enough to represent the
+accepted response. The implementation may resample the transcript nonce until
+the resulting $\mathbf z$ fits that scheduled bound. This grinding helps the
+honest prover find a compact response; the range check on its committed digits
+is what certifies the bound in the protocol.
+
+Equations (9a) and (9b) are identities among the recomposed values; they do not
+yet use the opening digits $\hat{\mathbf e}$, the outer digits
+$\hat{\mathbf t}$, or bounded digits for $\mathbf z$. The next-level committed
+witness contains digit rings rather than $\mathbf z$ itself so that its
+shortness is certified for the Module-SIS binding argument. Akita therefore
+decomposes $\mathbf z$ once more:
 
 $$
 z_{p,a}(X)
 =
 \sum_f G_f^{\mathrm{fold}}\hat z_{p,a,f}(X).
-\tag{9}
+\tag{10}
 $$
 
 The three main digit segments assembled for the next witness are therefore
@@ -372,7 +407,7 @@ $$
 \hat{\mathbf e}
 \;\Vert\;
 \hat{\mathbf t}.
-\tag{10}
+\tag{11}
 $$
 
 They have different origins:
@@ -385,12 +420,12 @@ They have different origins:
 
 ## The four physical relation families
 
-Equation (10) assembles three digit segments, but placing them next to one
+Equation (11) assembles three digit segments, but placing them next to one
 another does not yet show that they describe the same polynomial opening.
-Equations (8a) and (8b) establish this consistency among the recomposed values.
+Equations (9a) and (9b) establish this consistency among the recomposed values.
 The committed witness instead contains $\hat{\mathbf e}$,
 $\hat{\mathbf t}$, and $\hat{\mathbf z}$. Substituting Equations (3), (6), and
-(9), then adding the two commitment equations from the previous section,
+(10), then adding the two commitment equations from the previous section,
 gives four families of linear equations over
 
 $$
@@ -404,35 +439,10 @@ segments to the public commitments $\mathbf u$ and $\mathbf v_D$.
 
 ### 1. Fold-evaluation consistency
 
-For every block $b$, the partial evaluation $E_b$ must be computed from the
-same polynomial digits $\mathbf s_b$ that enter the fold. Equations (1) and
-(5) give the blockwise identity
-
-$$
-\boxed{
-E_b
-=
-\sum_p Q_pF_{p,b}
-=
-\sum_{p,a}Q_pG_a^{\mathrm{in}}s_{b,p,a}.
-}
-\tag{11}
-$$
-
-Rather than checking Equation (11) separately for every block, Equation (8a)
-uses the random challenges $c_b$ to batch them as
-$\sum_b c_bE_b=\sum_{p,a}Q_pG_a^{\mathrm{in}}z_{p,a}$. The left side folds
-the claimed partial evaluations, while the right side evaluates the same
-challenge-folded response $\mathbf z$. Thus one ring equation checks that
-evaluating positions and folding blocks give the same result. If any
-blockwise identity is inconsistent, its error is unlikely to cancel in this
-random combination. Moreover, the opening digits are committed through
-$\mathbf v_D$ before the challenges are sampled, so they cannot be adjusted
-after the $c_b$ values are known.
-
-To express Equation (8a) in terms of the next-fold witness, substitute the
+Equation (9a) is the fold-evaluation identity among the recomposed values. To
+express it in terms of the next-fold witness, substitute the
 balanced digit representations of $E_b$ from Equation (6) and $\mathbf z$
-from Equation (9). This gives the `consistency` row
+from Equation (10). This gives the `consistency` row
 
 $$
 \boxed{
@@ -452,20 +462,10 @@ scalar target $v_{\mathrm{tr}}$.
 
 ### 2. Inner-commitment consistency
 
-For every block $b$, the inner commitment defines the basic relation
-$\mathbf t_b=\mathbf A\mathbf s_b$. The goal is to check this entire family of
-blockwise relations. Checking them one by one would retain a separate vector
-equation for every block. Instead, Equation (8b) uses the challenges $c_b$ to
-batch them as
-$\sum_b c_b\mathbf t_b=\mathbf A(\sum_b c_b\mathbf s_b)=\mathbf A\mathbf z$.
-This leaves one vector relation across the blocks: the challenges batch the
-block index $b$, while every row $\rho$ of $\mathbf A$ is still checked. It
-connects the folded response to the commitment-side $\mathbf t_b$ values,
-which the outer-commitment rows below anchor to $\mathbf u$.
-
-The next-fold witness stores the balanced digits rather than the recomposed
-values. Substitute Equation (3) for $\mathbf t_b$ and Equation (9) for
-$\mathbf z$. For every row $\rho$ of $\mathbf A$, this gives
+Equation (9b) is the inner-commitment identity among the recomposed values.
+The next-fold witness stores their balanced digits instead. Substitute
+Equation (3) for $\mathbf t_b$ and Equation (10) for $\mathbf z$. For every
+row $\rho$ of $\mathbf A$, this gives
 
 $$
 \boxed{

From 821c49e16e6c9cd9b81651dd87fe080b1bd84559 Mon Sep 17 00:00:00 2001
From: Freya <fengrun.liu@gmail.com>
Date: Wed, 5 Aug 2026 15:07:10 -0400
Subject: [PATCH 15/17] akita-book: basic relation families

---
 book/src/how/proving/akita-fold.md | 57 ++++++++++++++++--------------
 1 file changed, 31 insertions(+), 26 deletions(-)

diff --git a/book/src/how/proving/akita-fold.md b/book/src/how/proving/akita-fold.md
index 7f42e8e3f..06bc8ccf8 100644
--- a/book/src/how/proving/akita-fold.md
+++ b/book/src/how/proving/akita-fold.md
@@ -420,13 +420,13 @@ They have different origins:
 
 ## The four physical relation families
 
-Equation (11) assembles three digit segments, but placing them next to one
-another does not yet show that they describe the same polynomial opening.
-Equations (9a) and (9b) establish this consistency among the recomposed values.
-The committed witness instead contains $\hat{\mathbf e}$,
-$\hat{\mathbf t}$, and $\hat{\mathbf z}$. Substituting Equations (3), (6), and
-(10), then adding the two commitment equations from the previous section,
-gives four families of linear equations over
+Equation (11) specifies how the three digit segments are assembled, but it
+does not impose any algebraic relation among them. Substituting the balanced
+recompositions from Equations (3), (6), and (10) into the recomposed identities
+(9a) and (9b) gives two relations among the private witness segments.
+Equations (4) and (7) provide two additional relations that anchor those
+segments to the public commitments. Together, these give four families of
+linear equations over
 
 $$
 R=F[X]/(X^D+1).
@@ -440,9 +440,9 @@ segments to the public commitments $\mathbf u$ and $\mathbf v_D$.
 ### 1. Fold-evaluation consistency
 
 Equation (9a) is the fold-evaluation identity among the recomposed values. To
-express it in terms of the next-fold witness, substitute the
-balanced digit representations of $E_b$ from Equation (6) and $\mathbf z$
-from Equation (10). This gives the `consistency` row
+express it in terms of the next-fold witness, substitute the balanced digit
+representations of $E_b$ from Equation (6) and $\mathbf z$ from Equation (10).
+This gives the fold-evaluation consistency relation
 
 $$
 \boxed{
@@ -455,7 +455,7 @@ Q_pG_a^{\mathrm{in}}G_f^{\mathrm{fold}}\hat z_{p,a,f}.
 \tag{12}
 $$
 
-This row uses the random fold challenges $c_b$, not the block-opening weights
+This relation uses the random fold challenges $c_b$, not the block-opening weights
 $B_b$. The latter belong to the separate field-valued evaluation relation on
 $\hat{\mathbf e}$. In particular, this ring relation does not contain the
 scalar target $v_{\mathrm{tr}}$.
@@ -485,9 +485,9 @@ columns are indexed by $(p,a)$.
 ### 3. Outer-commitment consistency
 
 The first two families compare private witness segments but do not yet tie
-them to the commitment seen by the verifier. The outer-commitment rows provide
-that public anchor by requiring $\hat{\mathbf t}$ to open the commitment that
-entered this fold:
+them to the commitment seen by the verifier. The outer-commitment relation
+provides that public anchor by requiring $\hat{\mathbf t}$ to open the
+commitment that entered this fold:
 
 $$
 \boxed{
@@ -503,9 +503,9 @@ challenges.
 
 ### 4. Opening-commitment consistency
 
-Finally, the opening-commitment rows anchor $\hat{\mathbf e}$ to the public
-ring vector $\mathbf v_D$ that was absorbed before the fold challenges were
-sampled:
+Finally, the opening-commitment relation anchors $\hat{\mathbf e}$ to the
+public ring vector $\mathbf v_D$ that was absorbed before the fold challenges
+were sampled:
 
 $$
 \boxed{
@@ -516,8 +516,10 @@ $$
 \tag{15}
 $$
 
-This prevents the prover from changing the partial-evaluation digits after
-$\mathbf v_D$ has been fixed. Like the other three families, it is a relation
+Because $\mathbf v_D$ is fixed before the fold challenges are sampled, this
+relation, together with the boundedness of $\hat{\mathbf e}$ and Module-SIS
+binding, prevents the prover from adapting the partial-evaluation digits after
+learning those challenges. Like the other three families, it is a relation
 over $R$; it is distinct from the field-valued scalar evaluation claim.
 
 ## Assemble the ring relation
@@ -545,14 +547,17 @@ $$
 \tag{17}
 $$
 
-For one group, the physical row order and right-hand side are:
+Let $n_A$, $n_B$, and $n_D$ denote the row counts of $\mathbf A$,
+$\mathbf B$, and $\mathbf D$, respectively. In the basic one-group layout,
+the four relation families occupy $1+n_A+n_B+n_D$ physical rows. Their order
+and right-hand sides are:
 
-| Physical rows | Meaning | Right-hand side |
-|---|---|---|
-| `consistency` | Equation (12) | $0$ |
-| $\mathbf A$ rows | Equation (13) | $\mathbf 0$ |
-| $\mathbf B$ rows | Equation (14) | $\mathbf u$ |
-| $\mathbf D$ rows | Equation (15) | $\mathbf v_D$ |
+| Physical rows | Count | Meaning | Right-hand side |
+|---|---:|---|---|
+| `consistency` | $1$ | Equation (12) | $0$ |
+| $\mathbf A$ rows | $n_A$ | Equation (13) | $\mathbf 0$ |
+| $\mathbf B$ rows | $n_B$ | Equation (14) | $\mathbf u$ |
+| $\mathbf D$ rows | $n_D$ | Equation (15) | $\mathbf v_D$ |
 
 Consequently,
 

From a7f18ae002c7f40352f561729e6219dce9729e32 Mon Sep 17 00:00:00 2001
From: Freya <fengrun.liu@gmail.com>
Date: Sun, 9 Aug 2026 20:22:38 -0400
Subject: [PATCH 16/17] akita-book: add commitment compression relation

---
 book/src/how/proving/akita-fold.md | 414 ++++++++++++++++++++++++-----
 1 file changed, 353 insertions(+), 61 deletions(-)

diff --git a/book/src/how/proving/akita-fold.md b/book/src/how/proving/akita-fold.md
index 06bc8ccf8..36dd07b41 100644
--- a/book/src/how/proving/akita-fold.md
+++ b/book/src/how/proving/akita-fold.md
@@ -2,21 +2,24 @@
 
 This page describes the ring-valued relations proved by one non-terminal
 Akita fold. The presentation starts with one polynomial group, one opening
-claim, and one common ring dimension:
+claim, and one common ring dimension for the four source relations:
 
 $$
 R=F[X]/(X^D+1).
 $$
 
 The current implementation also supports more elaborate physical layouts —
-commitment groups, witness chunks, and different ring dimensions — but those
-extensions do not change the four core relations developed below. This page
-establishes only the basic case; advanced layouts are outside its scope.
-
-The Akita paper presents a more general matrix with additional compression
-relations. Its basic Greyhound relation motivates the four row families here;
-the current implementation is the source of truth for the rows and witness
-layout documented on this page.
+commitment groups, witness chunks, and different ordinary $\mathbf A$,
+$\mathbf B$, and $\mathbf D$ ring dimensions — but those extensions do not
+change the four core relations developed below. This page establishes only the
+basic case; advanced layouts are outside its scope. The compression realization
+introduced later uses its own smaller ring dimensions.
+
+The four equations below are the semantic source relations. The current
+implementation realizes the $\mathbf B$ and $\mathbf D$ commitment relations
+either by transmitting their semantic commitments as raw payloads or by
+binding those commitments to smaller terminal payloads through compression
+relations.
 
 The goal of the fold is to replace the current polynomial blocks by a smaller
 digit witness while proving that the new witness is consistent with:
@@ -39,13 +42,18 @@ described on this page.
   - [Polynomial blocks and commitment hint](#polynomial-blocks-and-commitment-hint)
   - [Partial evaluations and opening digits](#partial-evaluations-and-opening-digits)
   - [The folded response and its digitization](#the-folded-response-and-its-digitization)
-- [The four physical relation families](#the-four-physical-relation-families)
+- [The four semantic relation families](#the-four-semantic-relation-families)
   - [Fold-evaluation consistency](#1-fold-evaluation-consistency)
   - [Inner-commitment consistency](#2-inner-commitment-consistency)
   - [Outer-commitment consistency](#3-outer-commitment-consistency)
   - [Opening-commitment consistency](#4-opening-commitment-consistency)
-- [Assemble the ring relation](#assemble-the-ring-relation)
-- [Lift the ring relation before sumcheck](#lift-the-ring-relation-before-sumcheck)
+- [Commitment compression realization](#commitment-compression-realization)
+  - [Why recommit?](#why-recommit)
+  - [One recommitment step](#one-recommitment-step)
+  - [The two-map commitment chains](#the-two-map-commitment-chains)
+  - [Compressed rows and witness](#compressed-rows-and-witness)
+- [Assemble the raw ring relation](#assemble-the-raw-ring-relation)
+- [Lift the raw ring relation before sumcheck](#lift-the-raw-ring-relation-before-sumcheck)
 - [The scalar opening claim is a virtual row](#the-scalar-opening-claim-is-a-virtual-row)
 - [Code reference](#code-reference)
 
@@ -57,14 +65,16 @@ $$
 \widetilde f(r)=v
 $$
 
-for a polynomial whose commitment $\mathbf u$ is already fixed. At a recursive
-level, $\mathbf u$ is the next-witness commitment produced by the preceding
-level; at the root, the original polynomial commitment plays the same role.
+for a polynomial whose commitment payload is already fixed. We call
+$\mathbf u=\mathbf B\hat{\mathbf t}$ the semantic commitment behind that
+payload. In raw mode, $\mathbf u$ itself is transmitted; in compressed mode,
+the payload is the smaller terminal commitment $p_F$, which is bound to
+$\mathbf u$ by the compression relations below.
 
 The prover and verifier have different views of these inputs. The prover holds
 the polynomial blocks, their inner-digit representation, the commitment hint
-generated when $\mathbf u$ was formed, and the public commitment itself. The
-verifier knows $\mathbf u$ and the opening claim, but receives neither the
+generated when the commitment was formed, and the public commitment payload.
+The verifier knows that payload and the opening claim, but receives neither the
 blocks nor the hint.
 
 From these inputs, the current fold derives two new representations of the
@@ -178,12 +188,12 @@ z_{p,a}(X)
 \end{aligned}
 $$
 
-The first two identities describe commitment-side data already fixed by
-$\mathbf u$: $\mathbf s_b$ is the incoming inner-digit representation, and
-$\hat{\mathbf t}$ is reconstructed from the incoming hint. The latter two
-digit families, $\hat{\mathbf e}$ and $\hat{\mathbf z}$, are newly derived from
-the opening point and fold challenges. We now place each identity in its
-protocol context.
+The first two identities describe commitment-side data already fixed by the
+incoming commitment payload: $\mathbf s_b$ is the incoming inner-digit
+representation, and $\hat{\mathbf t}$ is reconstructed from the incoming hint.
+The latter two digit families, $\hat{\mathbf e}$ and $\hat{\mathbf z}$, are
+newly derived from the opening point and fold challenges. We now place each
+identity in its protocol context.
 
 ### Polynomial blocks and commitment hint
 
@@ -221,7 +231,7 @@ $$
 
 where $\rho$ selects a row of $\mathbf A$. Stack these digits over all blocks
 to obtain $\hat{\mathbf t}$. The outer commitment matrix $\mathbf B$ then gives
-the public commitment
+the semantic commitment
 
 $$
 \mathbf u
@@ -234,11 +244,11 @@ The two matrices have distinct roles: $\mathbf A$ forms one inner image per
 block, whereas $\mathbf B$ commits the digit-decomposed inner images across all
 blocks. The prover's commitment hint stores the recomposed inner images
 $\mathbf t_b$; this fold decomposes them to recover $\hat{\mathbf t}$. At a
-recursive level, the polynomial blocks, hint, and $\mathbf u$ were produced by
-the preceding level. At the root, they come from the original commitment. The
-verifier receives only $\mathbf u$ from this commitment-side data. Equations
-(1)--(4) describe the hidden opening that the later relation rows bind to that
-public value.
+recursive level, the polynomial blocks, hint, and public payload were produced
+by the preceding level. At the root, they come from the original commitment.
+The verifier receives only the public payload from this commitment-side data:
+$\mathbf u$ in raw mode or $p_F$ in compressed mode. (to-revise: no need to mention the two different modes, only focus the semantic commitment in this section). Equations (1)--(4)
+describe the hidden opening that the later relation rows bind to that payload.
 
 ### Partial evaluations and opening digits
 
@@ -265,7 +275,7 @@ E_b(X)
 $$
 
 The fold witness contains the digit rings $\hat e$, not a second copy of the
-recomposed $E_b$. To bind those digits, Akita computes an opening commitment
+recomposed $E_b$. Their semantic opening commitment is
 
 $$
 \mathbf v_D
@@ -274,6 +284,10 @@ $$
 \tag{7}
 $$
 
+Here $\mathbf D$ commits to the digit-decomposed partial evaluations. In raw
+mode, $\mathbf v_D$ is the opening-commitment payload sent to the verifier; in
+compressed mode, the terminal commitment $p_H$ is sent instead. (to-revise: no need to mentin the compressed mode or terminal commitment, only mention the semantic opening commitment)
+
 The subscript in $\mathbf v_D$ distinguishes this ring-vector commitment from
 the scalar opening target $v$ and its trace-form counterpart
 $v_{\mathrm{tr}}$. Equation (7) binds the newly derived opening digits; it does
@@ -281,10 +295,11 @@ not by itself prove the scalar evaluation claim.
 
 ### The folded response and its digitization
 
-The opening commitment $\mathbf v_D$ binds the prover to
-$\hat{\mathbf e}$, but it does not by itself show that the corresponding
-partial evaluations were computed from the incoming polynomial blocks. For
-every block $b$, correctness requires
+The semantic opening commitment $\mathbf v_D$, exposed directly in raw mode or
+bound through $p_H$ in compressed mode (to-revise: no need to mention two modes, only consider the semantic relations), commits the prover to
+$\hat{\mathbf e}$. It does not by itself show that the corresponding partial
+evaluations were computed from the incoming polynomial blocks. For every block
+$b$, correctness requires
 
 $$
 \boxed{
@@ -298,7 +313,7 @@ E_b
 $$
 
 Equation (8) connects the partial evaluation derived in this fold to the
-incoming block witness $\mathbf s_b$. The public commitment $\mathbf u$
+incoming block witness $\mathbf s_b$. The semantic commitment $\mathbf u$
 creates a second consistency requirement. Equation (4),
 $\mathbf u=\mathbf B\hat{\mathbf t}$, binds the outer digits
 $\hat{\mathbf t}$, which recompose the inner images $\mathbf t_b$ through
@@ -308,10 +323,11 @@ link is the blockwise relation $\mathbf t_b=\mathbf A\mathbf s_b$ from
 Equation (2).
 
 Checking both relations separately for every live block would retain the block
-index in the next proof. Instead, after $\mathbf u$ and $\mathbf v_D$ have
-been fixed, the transcript samples one sparse ring-valued challenge $c_b(X)$
-for each live block. These challenges are separate from the query weights
-$B_b$. The prover folds the incoming block witnesses into one response:
+index in the next proof. Instead, after the public payloads binding
+$\mathbf u$ and $\mathbf v_D$ have been fixed, the transcript samples one
+sparse ring-valued challenge $c_b(X)$ for each live block. These challenges
+are separate from the query weights $B_b$. The prover folds the incoming block
+witnesses into one response:
 
 $$
 z_{p,a}(X)
@@ -418,15 +434,15 @@ They have different origins:
 | $\hat{\mathbf e}$ | the position-folded rings $E_b$ | carries the opening data into the fold |
 | $\hat{\mathbf t}$ | the inner images $\mathbf t_b$ | binds the folded response to the existing commitment |
 
-## The four physical relation families
+## The four semantic relation families
 
 Equation (11) specifies how the three digit segments are assembled, but it
 does not impose any algebraic relation among them. Substituting the balanced
 recompositions from Equations (3), (6), and (10) into the recomposed identities
 (9a) and (9b) gives two relations among the private witness segments.
-Equations (4) and (7) provide two additional relations that anchor those
-segments to the public commitments. Together, these give four families of
-linear equations over
+Equations (4) and (7) provide two additional relations that define the
+semantic $\mathbf B$ and $\mathbf D$ commitments. (to-revise: should be the semantic commitments u and v computed from matrix B and D, respectively).Together, these give four
+families of linear equations over
 
 $$
 R=F[X]/(X^D+1).
@@ -434,8 +450,12 @@ $$
 
 Every sum, product, and equality in this section is computed in $R$; vector
 equations are interpreted coordinatewise in $R$. The first two families
-connect the private witness segments to one another. The last two anchor those
-segments to the public commitments $\mathbf u$ and $\mathbf v_D$.
+connect the private witness segments to one another. The last two define the
+semantic commitments $\mathbf u$ and $\mathbf v_D$. The raw realization
+exposes those commitments directly; the compressed realization binds them to
+terminal payloads instead.
+
+(to-revise: I think we can add a separte sub-section at the end of this paragraph, discussing the semantic relations and its realization: raw realization and the compressed realization. Here the comrpessed realization are for the two semantic commitment u and semantic opening commitment v)
 
 ### 1. Fold-evaluation consistency
 
@@ -484,10 +504,9 @@ columns are indexed by $(p,a)$.
 
 ### 3. Outer-commitment consistency
 
-The first two families compare private witness segments but do not yet tie
-them to the commitment seen by the verifier. The outer-commitment relation
-provides that public anchor by requiring $\hat{\mathbf t}$ to open the
-commitment that entered this fold:
+The first two families compare private witness segments but do not yet define
+the commitment produced by the outer commitment matrix. The semantic
+outer-commitment relation is
 
 $$
 \boxed{
@@ -498,14 +517,15 @@ $$
 \tag{14}
 $$
 
-This is a direct commitment check and therefore does not use the fold
-challenges.
+Here $\mathbf u\in R^{n_B}$, where $n_B$ is the output rank of $\mathbf B$.
+This relation does not use the fold challenges. Its raw realization transmits
+$\mathbf u$ directly, whereas its compressed realization recommits
+$\mathbf u$ as described below.
 
 ### 4. Opening-commitment consistency
 
-Finally, the opening-commitment relation anchors $\hat{\mathbf e}$ to the
-public ring vector $\mathbf v_D$ that was absorbed before the fold challenges
-were sampled:
+Likewise, the semantic opening-commitment relation defines the commitment to
+the opening digits under $\mathbf D$:
 
 $$
 \boxed{
@@ -516,13 +536,285 @@ $$
 \tag{15}
 $$
 
-Because $\mathbf v_D$ is fixed before the fold challenges are sampled, this
-relation, together with the boundedness of $\hat{\mathbf e}$ and Module-SIS
-binding, prevents the prover from adapting the partial-evaluation digits after
-learning those challenges. Like the other three families, it is a relation
-over $R$; it is distinct from the field-valued scalar evaluation claim.
+Here $\mathbf v_D\in R^{n_D}$, where $n_D$ is the output rank of $\mathbf D$.
+In raw mode $\mathbf v_D$ is absorbed before the fold challenges are sampled;
+in compressed mode a terminal commitment binding $\mathbf v_D$ is absorbed
+instead. Together with the boundedness of $\hat{\mathbf e}$ and Module-SIS
+binding, this prevents the prover from adapting the partial-evaluation digits
+after learning those challenges. Like the other three families, this is a
+ring-valued relation distinct from the field-valued scalar evaluation claim.
+
+## Commitment compression realization
+
+Equations (14) and (15) have the same structure: a commitment matrix maps a
+short witness to a semantic commitment consisting of a vector of ring
+elements. The raw realization places that complete commitment in the proof.
+The compressed realization instead recommits it using rank-one matrices over
+progressively smaller rings, producing a commitment chain whose terminal
+payload is exactly 128 bytes.
+
+### Why recommit?
+
+The raw wire size of the semantic outer commitment is
+
+$$
+|\mathbf u|
+=
+n_Bd_Bb_F,
+$$
+
+where $d_B$ is the $\mathbf B$ ring dimension and $b_F$ is the canonical byte
+width of one field element. For the q128 field
+
+$$
+F=\mathbb F_q,
+\qquad
+q=2^{128}-2^{32}+22537,
+$$
+
+a common committed-group profile has $n_B=1$ and $d_B=64$, and one field
+element occupies 16 bytes. Its raw payload is therefore
+
+$$
+1\cdot64\cdot16=1024\ \text{bytes}.
+$$
+
+The goal of commitment compression is to recommit this value in a smaller ring
+and repeat the process until the public payload has the desired size. This
+reduces the bytes occupied by the public commitment payload, but it also
+introduces new witness coordinates and relation rows. The planner accounts for
+both effects when it chooses between compressed and raw recursive payloads.
+
+### One recommitment step
+
+For intuition, first suppose that the semantic commitment is a single ring
+element
+
+$$
+u(X)\in R_d=F[X]/(X^d+1).
+$$
+
+Commitment compression applies the base-$2$ case of Akita's balanced
+decomposition coefficientwise:
+
+$$
+u(X)
+=
+\sum_{k=0}^{\kappa-1}2^k\xi_k(X),
+\qquad
+[\xi_k]_\ell\in\{-1,0\},
+$$
+
+where $\kappa$ is the field-modulus bit width. Thus the negative-binary
+alphabet $\{-1,0\}$ is exactly the balanced digit interval for base $2$.
+
+Now choose a smaller dimension $d'$ dividing $d$. Split each digit polynomial
+into blocks of $d'$ coefficients:
+
+$$
+\xi_k(X)
+=
+\sum_{j=0}^{d/d'-1}
+X^{jd'}\xi'_{k,j}(X),
+\qquad
+\xi'_{k,j}(X)\in R_{d'}.
+$$
+
+The small-ring elements are coefficient blocks, not a ring embedding between
+the two quotient rings. Collect them into a vector $\boldsymbol\xi$. The fixed
+recomposition map simply restores the coefficient positions and powers of
+two:
+
+$$
+\operatorname{Rec}_{d\leftarrow d'}(\boldsymbol\xi)
+=
+\sum_{k=0}^{\kappa-1}2^k
+\sum_{j=0}^{d/d'-1}X^{jd'}\xi'_{k,j}(X)
+=u(X).
+$$
+
+A rank-one matrix over the smaller ring then recommits these blocks:
+
+$$
+\mathbf F\in R_{d'}^{1\times w},
+\qquad
+u'=\mathbf F\boldsymbol\xi\in R_{d'}.
+$$
+
+Conceptually, decomposition replaces one large-ring element by several short
+small-ring elements, and the rank-one map commits all of them to one
+small-ring element.
+
+### The two-map commitment chains
+
+For the actual semantic commitment $\mathbf u\in R_{d_B}^{n_B}$, the first
+digit vector contains the blocks of every component of $\mathbf u$. Akita
+applies exactly two rank-one maps:
+
+$$
+\underbrace{\mathbf u\in R_{d_B}^{n_B}}_{\text{semantic commitment}}
+\longrightarrow
+\underbrace{\boldsymbol\xi_{F,1}\in R_{d_1}^{w_1}}_{\text{small-ring digit blocks}}
+\overset{\mathbf F_1}{\longrightarrow}
+\underbrace{u^{(1)}\in R_{d_1}}_{\text{intermediate image}}
+\longrightarrow
+\underbrace{\boldsymbol\xi_{F,2}\in R_{d_2}^{w_2}}_{\text{second-layer digit blocks}}
+\overset{\mathbf F_2}{\longrightarrow}
+\underbrace{p_F\in R_{d_2}}_{\text{terminal payload}}.
+$$
+
+The decomposition arrows are represented by recomposition maps in the
+relations below. The two $\boldsymbol\xi_F$ vectors are witness material;
+$\mathbf u$ is the semantic commitment and $u^{(1)}$ is a derived intermediate
+image. Neither is transmitted in compressed mode, and $u^{(1)}$ is not stored
+as an independent witness segment. Only $p_F$ is public.
+
+The production compression dimensions are fixed by the modulus profile:
+
+| Profile | First ring $d_1$ | First image | Terminal ring $d_2$ | Terminal payload |
+|---|---:|---:|---:|---:|
+| q128 | $16$ | 256 bytes | $8$ | 128 bytes |
+| q64 | $32$ | 256 bytes | $16$ | 128 bytes |
+| q32 | $64$ | 256 bytes | $32$ | 128 bytes |
+
+For the q128 example above, the complete chain is
+
+$$
+\underbrace{u\in R_{64}}_{1024\ \text{bytes}}
+\longrightarrow
+\underbrace{\boldsymbol\xi_{F,1}\in R_{16}^{512}}_{\text{base-2 digit blocks}}
+\overset{\mathbf F_1}{\longrightarrow}
+\underbrace{u^{(1)}\in R_{16}}_{256\ \text{bytes}}
+\longrightarrow
+\underbrace{\boldsymbol\xi_{F,2}\in R_8^{256}}_{\text{base-2 digit blocks}}
+\overset{\mathbf F_2}{\longrightarrow}
+\underbrace{p_F\in R_8}_{128\ \text{bytes}}.
+$$
+
+Standalone commitments and the root and early recursive folds use compressed
+payloads. At later recursive levels, the planner may switch to raw payloads
+when the compression witness costs more than the public bytes it saves. The
+selected sequence is always a compressed prefix followed by a raw suffix;
+compression never resumes after the cutover.
+
+### Compressed rows and witness
+
+Suppressing the component indices inside the recomposition map, the outer
+$\mathbf B/\mathbf F$ chain gives three physical relation equations:
+
+$$
+\boxed{
+\mathbf B\hat{\mathbf t}
+-
+\operatorname{Rec}_{d_B\leftarrow d_1}(\boldsymbol\xi_{F,1})
+=
+\mathbf 0
+}
+\qquad\text{in }R_{d_B}^{n_B},
+\tag{14a}
+$$
+
+$$
+\boxed{
+\mathbf F_1\boldsymbol\xi_{F,1}
+-
+\operatorname{Rec}_{d_1\leftarrow d_2}(\boldsymbol\xi_{F,2})
+=0
+}
+\qquad\text{in }R_{d_1},
+\tag{14b}
+$$
+
+$$
+\boxed{
+\mathbf F_2\boldsymbol\xi_{F,2}=p_F
+}
+\qquad\text{in }R_{d_2}.
+\tag{14c}
+$$
+
+The first equation is the compressed realization of the existing
+$\mathbf B$ rows; the latter two add the rank-one $\mathbf F_1$ and
+$\mathbf F_2$ rows. The semantic opening commitment follows the same
+construction, with an $\mathbf H$ chain:
+
+$$
+\boxed{
+\mathbf D\hat{\mathbf e}
+-
+\operatorname{Rec}_{d_D\leftarrow d_1}(\boldsymbol\xi_{H,1})
+=
+\mathbf 0
+}
+\qquad\text{in }R_{d_D}^{n_D},
+\tag{15a}
+$$
+
+$$
+\boxed{
+\mathbf H_1\boldsymbol\xi_{H,1}
+-
+\operatorname{Rec}_{d_1\leftarrow d_2}(\boldsymbol\xi_{H,2})
+=0
+}
+\qquad\text{in }R_{d_1},
+\tag{15b}
+$$
+
+$$
+\boxed{
+\mathbf H_2\boldsymbol\xi_{H,2}=p_H
+}
+\qquad\text{in }R_{d_2}.
+\tag{15c}
+$$
+
+For the basic one-group case, compressed mode therefore has
+$1+n_A+n_B+n_D+4$ physical rows:
+
+| Physical rows | Count | Right-hand side |
+|---|---:|---|
+| `consistency` | $1$ | $0$ |
+| $\mathbf A$ | $n_A$ | $\mathbf 0$ |
+| $\mathbf B$ | $n_B$ | $\mathbf 0$ |
+| $\mathbf D$ | $n_D$ | $\mathbf 0$ |
+| $\mathbf F_1$ | $1$ | $0$ |
+| $\mathbf H_1$ | $1$ | $0$ |
+| $\mathbf F_2$ | $1$ | $p_F$ |
+| $\mathbf H_2$ | $1$ | $p_H$ |
+
+Ignoring quotient digits and alignment for now, the additional compression
+witness segments appear in layer order:
+
+$$
+\hat{\mathbf z}
+\;\Vert\;
+\hat{\mathbf e}
+\;\Vert\;
+\hat{\mathbf t}
+\;\Vert\;
+\boldsymbol\xi_{F,1}
+\;\Vert\;
+\boldsymbol\xi_{H,1}
+\;\Vert\;
+\boldsymbol\xi_{F,2}
+\;\Vert\;
+\boldsymbol\xi_{H,2}.
+$$
+
+The complete witness also contains a quotient-digit row for every physical
+ring row. Because the compressed equations live in different rings, each row
+uses its native quotient modulus: $X^{d_B}+1$ for the $\mathbf B$ rows,
+$X^{d_D}+1$ for the $\mathbf D$ rows, $X^{d_1}+1$ for the first compression
+layer, and $X^{d_2}+1$ for the terminal layer. Ring switching evaluates each
+extended row with the powers and denominator belonging to that same native
+dimension. The restricted $\{-1,0\}$ check on the compression digits is
+described with the Stage 2 sumcheck rather than as another physical ring row.
+
+## Assemble the raw ring relation
 
-## Assemble the ring relation
+The original four-family matrix is the raw realization of the semantic
+relations above.
 
 Define the pre-switch witness
 
@@ -579,7 +871,7 @@ from the fold challenges, opening weights, gadget weights, and the setup
 matrices $\mathbf A$, $\mathbf B$, and $\mathbf D$. The code generates these
 contributions directly from the canonical witness layout.
 
-## Lift the ring relation before sumcheck
+## Lift the raw ring relation before sumcheck
 
 Equation (17) is an equality modulo $X^D+1$. Sumcheck, however, needs a field
 identity. Choose the canonical representatives of degree less than $D$ for

From e0a7ff00658fd86cb570a945f4b7fb19a130f73c Mon Sep 17 00:00:00 2001
From: Freya <fengrun.liu@gmail.com>
Date: Sun, 9 Aug 2026 21:40:33 -0400
Subject: [PATCH 17/17] akita-book: add commitment compression relation

---
 book/src/how/proving/akita-fold.md | 158 +++++++++++++++++++++++++----
 1 file changed, 138 insertions(+), 20 deletions(-)

diff --git a/book/src/how/proving/akita-fold.md b/book/src/how/proving/akita-fold.md
index 36dd07b41..ddf16f201 100644
--- a/book/src/how/proving/akita-fold.md
+++ b/book/src/how/proving/akita-fold.md
@@ -47,6 +47,10 @@ described on this page.
   - [Inner-commitment consistency](#2-inner-commitment-consistency)
   - [Outer-commitment consistency](#3-outer-commitment-consistency)
   - [Opening-commitment consistency](#4-opening-commitment-consistency)
+- [Semantic relations and physical realizations](#semantic-relations-and-physical-realizations)
+  - [Raw realization](#raw-realization)
+  - [Compressed realization](#compressed-realization)
+  - [Planner-selected cutover](#planner-selected-cutover)
 - [Commitment compression realization](#commitment-compression-realization)
   - [Why recommit?](#why-recommit)
   - [One recommitment step](#one-recommitment-step)
@@ -246,9 +250,9 @@ blocks. The prover's commitment hint stores the recomposed inner images
 $\mathbf t_b$; this fold decomposes them to recover $\hat{\mathbf t}$. At a
 recursive level, the polynomial blocks, hint, and public payload were produced
 by the preceding level. At the root, they come from the original commitment.
-The verifier receives only the public payload from this commitment-side data:
-$\mathbf u$ in raw mode or $p_F$ in compressed mode. (to-revise: no need to mention the two different modes, only focus the semantic commitment in this section). Equations (1)--(4)
-describe the hidden opening that the later relation rows bind to that payload.
+The semantic commitment $\mathbf u$ fixes this commitment-side data.
+Equations (1)--(4) describe its hidden opening, which the later relation rows
+bind to $\mathbf u$.
 
 ### Partial evaluations and opening digits
 
@@ -284,9 +288,7 @@ $$
 \tag{7}
 $$
 
-Here $\mathbf D$ commits to the digit-decomposed partial evaluations. In raw
-mode, $\mathbf v_D$ is the opening-commitment payload sent to the verifier; in
-compressed mode, the terminal commitment $p_H$ is sent instead. (to-revise: no need to mentin the compressed mode or terminal commitment, only mention the semantic opening commitment)
+Here $\mathbf D$ commits to the digit-decomposed partial evaluations.
 
 The subscript in $\mathbf v_D$ distinguishes this ring-vector commitment from
 the scalar opening target $v$ and its trace-form counterpart
@@ -295,8 +297,7 @@ not by itself prove the scalar evaluation claim.
 
 ### The folded response and its digitization
 
-The semantic opening commitment $\mathbf v_D$, exposed directly in raw mode or
-bound through $p_H$ in compressed mode (to-revise: no need to mention two modes, only consider the semantic relations), commits the prover to
+The semantic opening commitment $\mathbf v_D$ commits the prover to
 $\hat{\mathbf e}$. It does not by itself show that the corresponding partial
 evaluations were computed from the incoming polynomial blocks. For every block
 $b$, correctness requires
@@ -441,8 +442,9 @@ does not impose any algebraic relation among them. Substituting the balanced
 recompositions from Equations (3), (6), and (10) into the recomposed identities
 (9a) and (9b) gives two relations among the private witness segments.
 Equations (4) and (7) provide two additional relations that define the
-semantic $\mathbf B$ and $\mathbf D$ commitments. (to-revise: should be the semantic commitments u and v computed from matrix B and D, respectively).Together, these give four
-families of linear equations over
+semantic commitments $\mathbf u$ and $\mathbf v_D$ computed by $\mathbf B$
+and $\mathbf D$, respectively. Together, these give four families of linear
+equations over
 
 $$
 R=F[X]/(X^D+1).
@@ -451,11 +453,7 @@ $$
 Every sum, product, and equality in this section is computed in $R$; vector
 equations are interpreted coordinatewise in $R$. The first two families
 connect the private witness segments to one another. The last two define the
-semantic commitments $\mathbf u$ and $\mathbf v_D$. The raw realization
-exposes those commitments directly; the compressed realization binds them to
-terminal payloads instead.
-
-(to-revise: I think we can add a separte sub-section at the end of this paragraph, discussing the semantic relations and its realization: raw realization and the compressed realization. Here the comrpessed realization are for the two semantic commitment u and semantic opening commitment v)
+semantic commitments $\mathbf u$ and $\mathbf v_D$.
 
 ### 1. Fold-evaluation consistency
 
@@ -544,6 +542,128 @@ binding, this prevents the prover from adapting the partial-evaluation digits
 after learning those challenges. Like the other three families, this is a
 ring-valued relation distinct from the field-valued scalar evaluation claim.
 
+## Semantic relations and physical realizations
+
+The four relations above are semantic: they state which algebraic constraints
+a valid fold must satisfy, without prescribing which commitment values are
+sent in the proof. A **physical realization** makes that second choice. It
+determines the public payload, any additional compression witness, and the
+right-hand side that the verifier uses for each physical relation row.
+
+Only the two commitment relations depend on this choice. Their semantic
+values are
+
+$$
+\mathbf u=\mathbf B\hat{\mathbf t},
+\qquad
+\mathbf v_D=\mathbf D\hat{\mathbf e}.
+$$
+
+The fold-evaluation and inner-commitment relations have the same physical form
+in both modes.
+
+### Raw realization
+
+In raw mode, the public payload *is* the semantic commitment. The prover
+computes $\mathbf u$ and $\mathbf v_D$ and transmits their complete ring
+vectors. They appear directly as the right-hand sides of the ordinary
+$\mathbf B$ and $\mathbf D$ rows:
+
+$$
+\mathbf B\hat{\mathbf t}=\mathbf u,
+\qquad
+\mathbf D\hat{\mathbf e}=\mathbf v_D.
+$$
+
+The verifier therefore receives the values defined by the semantic relations
+and places them directly in the raw relation instance. No compression digits
+or $\mathbf F/\mathbf H$ rows are present.
+
+### Compressed realization
+
+In compressed mode, the prover still computes the same semantic commitments,
+but does not transmit $\mathbf u$ or $\mathbf v_D$. Instead, it decomposes each
+one, recommits the resulting blocks through a two-map chain, and sends only the
+terminal payloads $p_F$ and $p_H$. The compression digits become additional
+private witness coordinates:
+
+$$
+\mathbf u
+\longrightarrow
+\boldsymbol\xi_{F,1}
+\overset{\mathbf F_1}{\longrightarrow}
+u^{(1)}
+\longrightarrow
+\boldsymbol\xi_{F,2}
+\overset{\mathbf F_2}{\longrightarrow}
+p_F,
+$$
+
+$$
+\mathbf v_D
+\longrightarrow
+\boldsymbol\xi_{H,1}
+\overset{\mathbf H_1}{\longrightarrow}
+v_D^{(1)}
+\longrightarrow
+\boldsymbol\xi_{H,2}
+\overset{\mathbf H_2}{\longrightarrow}
+p_H.
+$$
+
+These arrows are not a decoding procedure. In particular, the verifier does
+not recover $\mathbf u$ from $p_F$ or $\mathbf v_D$ from $p_H$. Instead, the
+physical rows prove that the unsent semantic commitments defined by the
+$\mathbf B$ and $\mathbf D$ rows recompose from the first digit layer, and
+that the two compression maps lead to the transmitted terminal payloads. The
+$\mathbf B$ and $\mathbf D$ right-hand sides are therefore zero in compressed
+mode; $p_F$ and $p_H$ appear only on the terminal $\mathbf F_2$ and
+$\mathbf H_2$ rows.
+
+From the verifier's perspective, the schedule already determines the payload
+mode. For a raw level, it assembles the ordinary relation right-hand side from
+$\mathbf u$ and $\mathbf v_D$. For a compressed level, it assembles the larger
+row layout from $p_F$ and $p_H$ and verifies the compression chains together
+with the ordinary relations. The proof does not carry a separate mode tag.
+
+| View | Raw realization | Compressed realization |
+|---|---|---|
+| Public payload | $\mathbf u,\mathbf v_D$ | $p_F,p_H$ |
+| Additional private witness | none | $\boldsymbol\xi_{F,1},\boldsymbol\xi_{F,2},\boldsymbol\xi_{H,1},\boldsymbol\xi_{H,2}$ |
+| $\mathbf B/\mathbf D$ right-hand sides | $\mathbf u,\mathbf v_D$ | zero |
+| Additional rows | none | $\mathbf F_1,\mathbf F_2,\mathbf H_1,\mathbf H_2$ |
+| What binds the payload | the ordinary commitment equations directly | the ordinary equations followed by the compression chains |
+
+### Planner-selected cutover
+
+Compression saves public payload bytes but adds digit witnesses, relation
+rows, quotient witnesses, and restricted range-check work. The planner prices
+both sides of this tradeoff for the complete recursive schedule; it does not
+choose a mode from the payload size alone.
+
+The current protocol requires standalone commitments and the root fold to use
+compressed payloads. The first recursive fold, when present, is also
+compressed, as is any later fold that consumes a setup prefix. At subsequent
+levels the planner may either continue the compressed prefix or begin a raw
+suffix. Once it selects raw mode, every later recursive level remains raw:
+
+$$
+\underbrace{\text{compressed}\;\longrightarrow\;\cdots\;\longrightarrow\;
+\text{compressed}}_{\text{planner-selected prefix}}
+\longrightarrow
+\underbrace{\text{raw}\;\longrightarrow\;\cdots\;\longrightarrow\;
+\text{raw}}_{\text{raw suffix}}.
+$$
+
+The prefix length is schedule-dependent. Some current generated schedules cut
+over immediately after the required first recursive fold, whereas deeper
+recursive schedules keep several early recursive levels compressed. Thus
+"root and early folds are compressed" describes a planner-selected prefix,
+not a fixed global cutover level.
+
+The next section expands the two commitment relations into their compressed
+physical rows.
+
 ## Commitment compression realization
 
 Equations (14) and (15) have the same structure: a commitment matrix maps a
@@ -691,11 +811,9 @@ $$
 \underbrace{p_F\in R_8}_{128\ \text{bytes}}.
 $$
 
-Standalone commitments and the root and early recursive folds use compressed
-payloads. At later recursive levels, the planner may switch to raw payloads
-when the compression witness costs more than the public bytes it saves. The
-selected sequence is always a compressed prefix followed by a raw suffix;
-compression never resumes after the cutover.
+The schedule's payload mode determines whether these chains are present at a
+particular recursive level, according to the planner-selected cutover
+described above.
 
 ### Compressed rows and witness