Files
amethyst/quartz
Claude f5f71220a7 fix: use proven mul_wide in mul_shift384, trace scalar_mul reduction bug
Replace mul_shift384's inline product computation with the proven mul_wide
function, eliminating the row-based carry accumulation overflow bug
(t[i+4] = carry overwrites instead of adding).

Traced the remaining scalar_mul reduction bug to its exact location:
products of two ~256-bit scalars lose exactly NC[1] = 0x4551231950B75FC4
in the second fold step. The mul_wide product and first fold are correct,
but the second fold (handling sum[4..7]) loses a carry at limb position 2.

https://claude.ai/code/session_011KVZhDcV2G7idNWEBz12GY
2026-04-11 03:34:40 +00:00
..