perf(blobs): derive the blob fracs by halving the roots of unity

[AztecBot]

Refs #10323. Independent of the rest of that work — it lands on next on its own.

__compute_fracs builds w^i / (z - w^i) for all 4096 blob positions. It was a
4096-element Montgomery batch inversion (3 multiplications per element) plus a
pass to apply the numerator: ~4d multiplications and one inversion. The roots of
unity make almost all of that unnecessary.

The identity

Write z_k = z^(2^k) and w_k = w^(2^k), and let I_k[t] = 1 / (z_k - w_k^t)
over t = 0 .. d/2^k - 1. The top level is a single entry, 1 / (z^d - 1) — the
one inversion. Each level below follows by a difference of two squares, since
w_{k-1}^(t+m) = -w_{k-1}^t for m = d/2^k:

(z_{k-1} - w_{k-1}^t)(z_{k-1} + w_{k-1}^t) = z_k - w_k^t

so one parent yields two children for two multiplications:

I_{k-1}[t]     = (z_{k-1} + w_{k-1}^t) * I_k[t]
I_{k-1}[t + m] = (z_{k-1} - w_{k-1}^t) * I_k[t]

Levels halve going up, so reaching I_1 costs about d multiplications in
total. The last level folds the w^i numerator in as it descends, sharing the
z*w^t product across each pair — 3 multiplications per pair rather than the 4 a
separate numerator pass needs.

Total: ~2.5d multiplications and one inversion, against ~4d and one inversion.

The indexing falls out of the EIP-4844 layout

ROOTS is stored bit-reversed. That turns out to make the recursion trivial to
index: a parent at array index u has its children at 2u and 2u + 1, and the
root it needs is ROOTS[2u] at every level. At the final level ROOTS[2u] is
w^t and ROOTS[u] is w^2t, so both terms are plain lookups.

I got this wrong first time by assuming natural order — the halves are i and
i + d/2 there, not 2u and 2u + 1 — and it produced fracs that failed the
defining relation. test_roots_are_stored_adjacent_to_their_negations pins the
property the indexing rests on, because the failure mode is silent corruption of
half the array.

Measurements

compute_fracs alone, native ACVM, harness overhead subtracted, min of 5 on a
loaded shared host:

	time
batch inversion	0.915s
roots-of-unity halving	0.585s

1.56x, saving ~0.33s.

This is a hint used by both execution paths, so it should take roughly the same
~0.33s off constrained witness generation as well — __compute_fracs is ~0.86s
of the ~1.4s of Brillig hint work inside the ~11s constrained
rollup-checkpoint-root witness generation. I have not measured the constrained
side (it needs an 8-minute circuit compile per arm); worth confirming before
quoting that number.

It also matters for #10323: with the oracle removed (#25442) this takes a
checkpoint-root simulation from ~1.40s to ~1.05s.

Correctness

The ACIR is untouched — this only changes how the hint is produced, and
validate_fracs constrains the result exactly as before. The existing
test_validate_fracs_* tests pass, which is the real contract: the new hint
still satisfies the circuit's constraints.

New test_compute_fracs_satisfies_defining_relation_everywhere checks
fracs[i] * (z - ROOTS[i]) == ROOTS[i] for all 4096 entries rather than
spot-checking a few indices, because an error at one level of the recursion
corrupts a whole contiguous run of the output and a spot check would miss it.

Degenerate input behaves as before: if z is itself a d-th root of unity the
single inversion is zero and the array degenerates to zeros, exactly as
batch_invert mapped a zero denominator to zero. validate_fracs rejects that
either way, and reaching it requires a Poseidon2 preimage.

Ran: the blob crate's fracs and validate_fracs tests (6 passing) plus the
new invariant test. Not the full suite — CI is the complete check. The blob and
bignum crates are byte-identical between the commit those runs were made
against and current next, so the rebase did not move the code under the
measurements or the test results.

---

Created by claudebox · group: slackbot · requested by Tom (@TomAFrench) · Slack thread

[AztecBot]

⏳ Claude Review — starting review session...

[AztecBot]

✅ Adversarial verdict: PASS

✅ Claude Review — completed
live status
1m

VERDICT: PASS

070b810 has an identical repository tree to reviewed 8a155dc. Five focused tests and 192,512 arithmetic comparisons passed again; the prior 53-test full-suite result applies. No blocking findings.

Review and evidence

gist

[AztecBot]

Claude Review: Starting automated code review... workflow run

[AztecBot]

Claude Review: Starting automated code review... workflow run

[AztecBot]

Claude Review: Starting automated code review... workflow run

[iAmMichaelConnor]

Approved pending merge of #25450 into this branch

[AztecBot]

Claude Review: Starting automated code review... workflow run