honk_zk_optimized_contract.hpp

Go to the documentation of this file.

// === AUDIT STATUS ===
// internal:    { status: Planned, auditors: [], commit: }
// external_1:  { status: not started, auditors: [], commit: }
// external_2:  { status: not started, auditors: [], commit: }
// =====================
 
#pragma once
 
#include "honk_optimized_common.hpp"
#include <sstream>
#include <vector>
 
// Source code for the ZK optimized Ultrahonk Solidity verifier.
// It's expected that the AcirComposer will inject a library which will load the verification key into memory.
// NOLINTNEXTLINE(cppcoreguidelines-avoid-c-arrays)
static const char HONK_ZK_CONTRACT_OPT_SOURCE[] = R"(
// SPDX-License-Identifier: Apache-2.0
// Copyright 2022 Aztec
pragma solidity ^0.8.27;
 
interface IVerifier {
    function verify(bytes calldata _proof, bytes32[] calldata _publicInputs) external view returns (bool);
}
 
 
 
uint256 constant NUMBER_OF_SUBRELATIONS = 31;
uint256 constant BATCHED_RELATION_PARTIAL_LENGTH = 9;
uint256 constant ZK_BATCHED_RELATION_PARTIAL_LENGTH = 9;
uint256 constant NUMBER_OF_ENTITIES = 42;
uint256 constant NUMBER_UNSHIFTED = 37;
uint256 constant NUMBER_TO_BE_SHIFTED = 5;
uint256 constant PAIRING_POINTS_SIZE = 8;
 
uint256 constant VK_HASH = {{ VK_HASH }};
uint256 constant CIRCUIT_SIZE = {{ CIRCUIT_SIZE }};
uint256 constant LOG_N = {{ LOG_CIRCUIT_SIZE }};
uint256 constant NUMBER_PUBLIC_INPUTS = {{ NUM_PUBLIC_INPUTS }};
uint256 constant REAL_NUMBER_PUBLIC_INPUTS = {{ REAL_NUM_PUBLIC_INPUTS }};
uint256 constant PUBLIC_INPUTS_OFFSET = 5; // NUM_DISABLED_ROWS_IN_SUMCHECK + NUM_ZERO_ROWS = 4 + 1
 
contract HonkVerifier is IVerifier {
    /*´:°•.°+.*•´.*:˚.°*.˚•´.°:°•.°•.*•´.*:˚.°*.˚•´.°:°•.°+.*•´.*:*/
    /*                    SLAB ALLOCATION                         */
    /*.•°:°.´+˚.*°.˚:*.´•*.+°.•°:´*.´•*.•°.•°:°.´:•˚°.*°.˚:*.´+°.•*/
    // {{ SECTION_START MEMORY_LAYOUT }}
    // {{ SECTION_END MEMORY_LAYOUT }}
 
    /*´:°•.°+.*•´.*:˚.°*.˚•´.°:°•.°•.*•´.*:˚.°*.˚•´.°:°•.°+.*•´.*:*/
    /*                 SUMCHECK - MEMORY ALIASES                  */
    /*.•°:°.´+˚.*°.˚:*.´•*.+°.•°:´*.´•*.•°.•°:°.´:•˚°.*°.˚:*.´+°.•*/
    uint256 internal constant EC_X_1 = W2_EVAL_LOC;
    uint256 internal constant EC_Y_1 = W3_EVAL_LOC;
    uint256 internal constant EC_X_2 = W1_SHIFT_EVAL_LOC;
    uint256 internal constant EC_Y_2 = W4_SHIFT_EVAL_LOC;
    uint256 internal constant EC_Y_3 = W3_SHIFT_EVAL_LOC;
    uint256 internal constant EC_X_3 = W2_SHIFT_EVAL_LOC;
 
    // Aliases for selectors (Elliptic curve gadget)
    uint256 internal constant EC_Q_SIGN = QL_EVAL_LOC;
    uint256 internal constant EC_Q_IS_DOUBLE = QM_EVAL_LOC;
 
    /*´:°•.°+.*•´.*:˚.°*.˚•´.°:°•.°•.*•´.*:˚.°*.˚•´.°:°•.°+.*•´.*:*/
    /*                          CONSTANTS                         */
    /*.•°:°.´+˚.*°.˚:*.´•*.+°.•°:´*.´•*.•°.•°:°.´:•˚°.*°.˚:*.´+°.•*/
    uint256 internal constant GRUMPKIN_CURVE_B_PARAMETER_NEGATED = 17; // -(-17)
 
    // Auxiliary relation constants
    // In the Non Native Field Arithmetic Relation, large field elements are broken up into 4 LIMBs of 68 `LIMB_SIZE` bits each.
    uint256 internal constant LIMB_SIZE = 0x100000000000000000; // 2<<68
 
    // In the Delta Range Check Relation, there is a range checking relation that can validate 14-bit range checks with only 1
    // extra relation in the execution trace.
    // For large range checks, we decompose them into a collection of 14-bit range checks.
    uint256 internal constant SUBLIMB_SHIFT = 0x4000; // 2<<14
 
    // Poseidon2 internal constants
    // https://github.com/HorizenLabs/poseidon2/blob/main/poseidon2_rust_params.sage - derivation code
    uint256 internal constant POS_INTERNAL_MATRIX_D_0 =
        0x10dc6e9c006ea38b04b1e03b4bd9490c0d03f98929ca1d7fb56821fd19d3b6e7;
    uint256 internal constant POS_INTERNAL_MATRIX_D_1 =
        0x0c28145b6a44df3e0149b3d0a30b3bb599df9756d4dd9b84a86b38cfb45a740b;
    uint256 internal constant POS_INTERNAL_MATRIX_D_2 =
        0x00544b8338791518b2c7645a50392798b21f75bb60e3596170067d00141cac15;
    uint256 internal constant POS_INTERNAL_MATRIX_D_3 =
        0x222c01175718386f2e2e82eb122789e352e105a3b8fa852613bc534433ee428b;
 
    // Constants inspecting proof components
    uint256 internal constant NUMBER_OF_UNSHIFTED_ENTITIES = 37;
    // Shifted columns are columes that are duplicates of existing columns but right-shifted by 1
    uint256 internal constant NUMBER_OF_SHIFTED_ENTITIES = 5;
    uint256 internal constant TOTAL_NUMBER_OF_ENTITIES = 42;
 
    // Constants for performing batch multiplication
    uint256 internal constant ACCUMULATOR = 0x00;
    uint256 internal constant ACCUMULATOR_2 = 0x40;
    uint256 internal constant G1_LOCATION = 0x60;
    uint256 internal constant G1_Y_LOCATION = 0x80;
    uint256 internal constant SCALAR_LOCATION = 0xa0;
 
    // Group order
    uint256 internal constant Q = 21888242871839275222246405745257275088696311157297823662689037894645226208583; // EC group order
 
    // Field order constants
    // -1/2 mod p
    uint256 internal constant NEG_HALF_MODULO_P = 0x183227397098d014dc2822db40c0ac2e9419f4243cdcb848a1f0fac9f8000000;
    uint256 internal constant P = 21888242871839275222246405745257275088548364400416034343698204186575808495617;
    uint256 internal constant P_SUB_1 = 21888242871839275222246405745257275088548364400416034343698204186575808495616;
    uint256 internal constant P_SUB_2 = 21888242871839275222246405745257275088548364400416034343698204186575808495615;
    uint256 internal constant P_SUB_3 = 21888242871839275222246405745257275088548364400416034343698204186575808495614;
 
    // Barycentric evaluation constants
    uint256 internal constant BARYCENTRIC_LAGRANGE_DENOMINATOR_0 =
        0x0000000000000000000000000000000000000000000000000000000000009d80;
    uint256 internal constant BARYCENTRIC_LAGRANGE_DENOMINATOR_1 =
        0x30644e72e131a029b85045b68181585d2833e84879b9709143e1f593efffec51;
    uint256 internal constant BARYCENTRIC_LAGRANGE_DENOMINATOR_2 =
        0x00000000000000000000000000000000000000000000000000000000000005a0;
    uint256 internal constant BARYCENTRIC_LAGRANGE_DENOMINATOR_3 =
        0x30644e72e131a029b85045b68181585d2833e84879b9709143e1f593effffd31;
    uint256 internal constant BARYCENTRIC_LAGRANGE_DENOMINATOR_4 =
        0x0000000000000000000000000000000000000000000000000000000000000240;
    uint256 internal constant BARYCENTRIC_LAGRANGE_DENOMINATOR_5 =
        0x30644e72e131a029b85045b68181585d2833e84879b9709143e1f593effffd31;
    uint256 internal constant BARYCENTRIC_LAGRANGE_DENOMINATOR_6 =
        0x00000000000000000000000000000000000000000000000000000000000005a0;
    uint256 internal constant BARYCENTRIC_LAGRANGE_DENOMINATOR_7 =
        0x30644e72e131a029b85045b68181585d2833e84879b9709143e1f593efffec51;
    uint256 internal constant BARYCENTRIC_LAGRANGE_DENOMINATOR_8 =
        0x0000000000000000000000000000000000000000000000000000000000009d80;
 
    // ZK-specific constants
    uint256 internal constant SUBGROUP_SIZE = 256;
    uint256 internal constant SUBGROUP_GENERATOR = 0x07b0c561a6148404f086204a9f36ffb0617942546750f230c893619174a57a76;
    uint256 internal constant SUBGROUP_GENERATOR_INVERSE = 0x204bd3277422fad364751ad938e2b5e6a54cf8c68712848a692c553d0329f5d6;
    uint256 internal constant LIBRA_COMMITMENTS = 3;
    uint256 internal constant LIBRA_EVALUATIONS = 4;
    uint256 internal constant SHIFTED_COMMITMENTS_START = 30;
 
    // Constants for computing public input delta
    uint256 internal constant PERMUTATION_ARGUMENT_VALUE_SEPARATOR = 1 << 28;
 
    /*´:°•.°+.*•´.*:˚.°*.˚•´.°:°•.°•.*•´.*:˚.°*.˚•´.°:°•.°+.*•´.*:*/
    /*                         ERRORS                             */
    /*.•°:°.´+˚.*°.˚:*.´•*.+°.•°:´*.´•*.•°.•°:°.´:•˚°.*°.˚:*.´+°.•*/
    // The errors match Errors.sol
 
    bytes4 internal constant VALUE_GE_LIMB_MAX_SELECTOR = 0xeb73e0bd;
    bytes4 internal constant VALUE_GE_GROUP_ORDER_SELECTOR = 0x607be13e;
    bytes4 internal constant VALUE_GE_FIELD_ORDER_SELECTOR = 0x20a33589;
    bytes4 internal constant SUMCHECK_FAILED_SELECTOR = 0x9fc3a218;
    bytes4 internal constant SHPLEMINI_FAILED_SELECTOR = 0xa5d82e8a;
 
    bytes4 internal constant PROOF_LENGTH_WRONG_WITH_LOG_N_SELECTOR = 0x59895a53;
    bytes4 internal constant PUBLIC_INPUTS_LENGTH_WRONG_SELECTOR = 0xfa066593;
 
    bytes4 internal constant MODEXP_FAILED_SELECTOR = 0xf442f163;
    bytes4 internal constant CONSISTENCY_CHECK_FAILED_SELECTOR = 0xa2a2ac83;
    bytes4 internal constant GEMINI_CHALLENGE_IN_SUBGROUP_SELECTOR = 0x835eb8f7;
 
    constructor() {}
 
    function verify(
        bytes calldata,
        /*proof*/
        bytes32[] calldata /*public_inputs*/
    )
        public
        view
        override
        returns (bool)
    {
        // Load the proof from calldata in one large chunk
        assembly {
            /*´:°•.°+.*•´.*:˚.°*.˚•´.°:°•.°•.*•´.*:˚.°*.˚•´.°:°•.°+.*•´.*:*/
            /*                   LOAD VERIFCATION KEY                     */
            /*.•°:°.´+˚.*°.˚:*.´•*.+°.•°:´*.´•*.•°.•°:°.´:•˚°.*°.˚:*.´+°.•*/
            // Write the verification key into memory
            //
            // Although defined at the top of the file, it is used towards the end of the algorithm when batching in the commitment scheme.
            function loadVk() {
                mstore(Q_L_X_LOC, {{ Q_L_X_LOC }})
                mstore(Q_L_Y_LOC, {{ Q_L_Y_LOC }})
                mstore(Q_R_X_LOC, {{ Q_R_X_LOC }})
                mstore(Q_R_Y_LOC, {{ Q_R_Y_LOC }})
                mstore(Q_O_X_LOC, {{ Q_O_X_LOC }})
                mstore(Q_O_Y_LOC, {{ Q_O_Y_LOC }})
                mstore(Q_4_X_LOC, {{ Q_4_X_LOC }})
                mstore(Q_4_Y_LOC, {{ Q_4_Y_LOC }})
                mstore(Q_M_X_LOC, {{ Q_M_X_LOC }})
                mstore(Q_M_Y_LOC, {{ Q_M_Y_LOC }})
                mstore(Q_C_X_LOC, {{ Q_C_X_LOC }})
                mstore(Q_C_Y_LOC, {{ Q_C_Y_LOC }})
                mstore(Q_LOOKUP_X_LOC, {{ Q_LOOKUP_X_LOC }})
                mstore(Q_LOOKUP_Y_LOC, {{ Q_LOOKUP_Y_LOC }})
                mstore(Q_ARITH_X_LOC, {{ Q_ARITH_X_LOC }})
                mstore(Q_ARITH_Y_LOC, {{ Q_ARITH_Y_LOC }})
                mstore(Q_DELTA_RANGE_X_LOC, {{ Q_DELTA_RANGE_X_LOC }})
                mstore(Q_DELTA_RANGE_Y_LOC, {{ Q_DELTA_RANGE_Y_LOC }})
                mstore(Q_ELLIPTIC_X_LOC, {{ Q_ELLIPTIC_X_LOC }})
                mstore(Q_ELLIPTIC_Y_LOC, {{ Q_ELLIPTIC_Y_LOC }})
                mstore(Q_MEMORY_X_LOC, {{ Q_MEMORY_X_LOC }})
                mstore(Q_MEMORY_Y_LOC, {{ Q_MEMORY_Y_LOC }})
                mstore(Q_NNF_X_LOC, {{ Q_NNF_X_LOC }})
                mstore(Q_NNF_Y_LOC, {{ Q_NNF_Y_LOC }})
                mstore(Q_POSEIDON_2_EXTERNAL_X_LOC, {{ Q_POSEIDON_2_EXTERNAL_X_LOC }})
                mstore(Q_POSEIDON_2_EXTERNAL_Y_LOC, {{ Q_POSEIDON_2_EXTERNAL_Y_LOC }})
                mstore(Q_POSEIDON_2_INTERNAL_X_LOC, {{ Q_POSEIDON_2_INTERNAL_X_LOC }})
                mstore(Q_POSEIDON_2_INTERNAL_Y_LOC, {{ Q_POSEIDON_2_INTERNAL_Y_LOC }})
                mstore(SIGMA_1_X_LOC, {{ SIGMA_1_X_LOC }})
                mstore(SIGMA_1_Y_LOC, {{ SIGMA_1_Y_LOC }})
                mstore(SIGMA_2_X_LOC, {{ SIGMA_2_X_LOC }})
                mstore(SIGMA_2_Y_LOC, {{ SIGMA_2_Y_LOC }})
                mstore(SIGMA_3_X_LOC, {{ SIGMA_3_X_LOC }})
                mstore(SIGMA_3_Y_LOC, {{ SIGMA_3_Y_LOC }})
                mstore(SIGMA_4_X_LOC, {{ SIGMA_4_X_LOC }})
                mstore(SIGMA_4_Y_LOC, {{ SIGMA_4_Y_LOC }})
                mstore(TABLE_1_X_LOC, {{ TABLE_1_X_LOC }})
                mstore(TABLE_1_Y_LOC, {{ TABLE_1_Y_LOC }})
                mstore(TABLE_2_X_LOC, {{ TABLE_2_X_LOC }})
                mstore(TABLE_2_Y_LOC, {{ TABLE_2_Y_LOC }})
                mstore(TABLE_3_X_LOC, {{ TABLE_3_X_LOC }})
                mstore(TABLE_3_Y_LOC, {{ TABLE_3_Y_LOC }})
                mstore(TABLE_4_X_LOC, {{ TABLE_4_X_LOC }})
                mstore(TABLE_4_Y_LOC, {{ TABLE_4_Y_LOC }})
                mstore(ID_1_X_LOC, {{ ID_1_X_LOC }})
                mstore(ID_1_Y_LOC, {{ ID_1_Y_LOC }})
                mstore(ID_2_X_LOC, {{ ID_2_X_LOC }})
                mstore(ID_2_Y_LOC, {{ ID_2_Y_LOC }})
                mstore(ID_3_X_LOC, {{ ID_3_X_LOC }})
                mstore(ID_3_Y_LOC, {{ ID_3_Y_LOC }})
                mstore(ID_4_X_LOC, {{ ID_4_X_LOC }})
                mstore(ID_4_Y_LOC, {{ ID_4_Y_LOC }})
                mstore(LAGRANGE_FIRST_X_LOC, {{ LAGRANGE_FIRST_X_LOC }})
                mstore(LAGRANGE_FIRST_Y_LOC, {{ LAGRANGE_FIRST_Y_LOC }})
                mstore(LAGRANGE_LAST_X_LOC, {{ LAGRANGE_LAST_X_LOC }})
                mstore(LAGRANGE_LAST_Y_LOC, {{ LAGRANGE_LAST_Y_LOC }})
            }
 
            // Prime field order - placing on the stack
            let p := P
 
            {
                let proof_ptr := add(calldataload(0x04), 0x24)
 
                /*´:°•.°+.*•´.*:˚.°*.˚•´.°:°•.°•.*•´.*:˚.°*.˚•´.°:°•.°+.*•´.*:*/
                /*              VALIDATE INPUT LENGTHS                      */
                /*.•°:°.´+˚.*°.˚:*.´•*.+°.•°:´*.´•*.•°.•°:°.´:•˚°.*°.˚:*.´+°.•*/
                // Validate proof byte length matches expected size for this circuit's LOG_N (ZK variant).
                // ZK proof has: 9 witness G1 (18) + 3 libra G1 (6) + LOG_N*9 univariates + 42 evals
                //   + 2 (libraSum,libraEval) + LOG_N gemini evals + 4 libra poly evals
                //   + (LOG_N-1)*2 gemini fold G1 + 2*2 (shplonkQ,kzg) + 8 pairing = (82 + 12*LOG_N) * 32
                {
                    let expected_proof_size := mul(
                        add(
                            add(
                                add(24, mul(LOG_N, BATCHED_RELATION_PARTIAL_LENGTH)),
                                add(add(NUMBER_OF_ENTITIES, 2), mul(sub(LOG_N, 1), 2))
                            ),
                            add(add(LOG_N, LIBRA_EVALUATIONS), add(4, PAIRING_POINTS_SIZE))
                        ),
                        32
                    )
                    let proof_length := calldataload(add(calldataload(0x04), 0x04))
                    if iszero(eq(proof_length, expected_proof_size)) {
                        mstore(0x00, PROOF_LENGTH_WRONG_WITH_LOG_N_SELECTOR)
                        mstore(0x04, LOG_N)
                        mstore(0x24, proof_length)
                        mstore(0x44, expected_proof_size)
                        revert(0x00, 0x64)
                    }
                }
                // Validate public inputs array length matches expected count.
                {
                    let pi_count := calldataload(add(calldataload(0x24), 0x04))
                    if iszero(eq(pi_count, REAL_NUMBER_PUBLIC_INPUTS)) {
                        mstore(0x00, PUBLIC_INPUTS_LENGTH_WRONG_SELECTOR)
                        revert(0x00, 0x04)
                    }
                }
 
                /*´:°•.°+.*•´.*:˚.°*.˚•´.°:°•.°•.*•´.*:˚.°*.˚•´.°:°•.°+.*•´.*:*/
                /*                    GENERATE CHALLENGES                     */
                /*.•°:°.´+˚.*°.˚:*.´•*.+°.•°:´*.´•*.•°.•°:°.´:•˚°.*°.˚:*.´+°.•*/
                /*
                 * Proof points (affine coordinates) in the proof are in the following format, where offset is
                 * the offset in the entire proof until the first bit of the x coordinate
                 * offset + 0x00: x
                 * offset + 0x20: y
                 */
 
                /*´:°•.°+.*•´.*:˚.°*.˚•´.°:°•.°•.*•´.*:˚.°*.˚•´.°:°•.°+.*•´.*:*/
                /*                   GENERATE ETA CHALLENGE                   */
                /*.•°:°.´+˚.*°.˚:*.´•*.+°.•°:´*.´•*.•°.•°:°.´:•˚°.*°.˚:*.´+°.•*/
                /* ZK Eta challenge participants
                 * - VK_HASH
                 * - public inputs
                 * - pairing point limbs (8)
                 * - geminiMaskingPoly (G1) <- ZK addition
                 * - w1, w2, w3 (G1)
                 */
 
                mstore(0x00, VK_HASH)
 
                let public_inputs_start := add(calldataload(0x24), 0x24)
                let public_inputs_size := mul(REAL_NUMBER_PUBLIC_INPUTS, 0x20)
 
                // Copy the public inputs into the eta buffer
                calldatacopy(0x20, public_inputs_start, public_inputs_size)
 
                // Copy Pairing points into eta buffer
                let public_inputs_end := add(0x20, public_inputs_size)
 
                calldatacopy(public_inputs_end, proof_ptr, 0x100)
 
                // 0x20 * 8 = 0x100 (8 pairing point limbs)
                // End of public inputs + pairing points
                // ZK: Copy geminiMaskingPoly(0x40) + w1,w2,w3(0xC0) = 0x100 bytes from proof after pairing
                calldatacopy(add(0x120, public_inputs_size), add(proof_ptr, 0x100), 0x100)
 
                // 0x220 = 0x20 (VK_HASH) + 0x100 (pairing) + 0x40 (geminiMaskingPoly) + 0xC0 (w1,w2,w3)
                let eta_input_length := add(0x220, public_inputs_size)
 
                // Get eta and rom_logup_gamma, and compute eta powers (eta, eta², eta³)
                let prev_challenge := mod(keccak256(0x00, eta_input_length), p)
                let eta := prev_challenge
                mstore(0x00, prev_challenge)
                prev_challenge := mod(keccak256(0x00, 0x20), p)
                mstore(0x00, prev_challenge)
 
                let eta_two := mulmod(eta, eta, p)
                let eta_three := mulmod(eta_two, eta, p)
 
                mstore(ETA_CHALLENGE, eta)
                mstore(ETA_TWO_CHALLENGE, eta_two)
                mstore(ETA_THREE_CHALLENGE, eta_three)
                mstore(ROM_LOGUP_GAMMA_CHALLENGE, prev_challenge)
 
                /*´:°•.°+.*•´.*:˚.°*.˚•´.°:°•.°•.*•´.*:˚.°*.˚•´.°:°•.°+.*•´.*:*/
                /*                  LOAD PROOF INTO MEMORY                    */
                /*.•°:°.´+˚.*°.˚:*.´•*.+°.•°:´*.´•*.•°.•°:°.´:•˚°.*°.˚:*.´+°.•*/
                // As all of our proof points are written in contiguous parts of memory, we call use a single
                // calldatacopy to place all of our proof into the correct memory regions
                // We copy the entire proof into memory as we must hash each proof section for challenge
                // evaluation
                // The last item in the proof, and the first item in the proof (pairing point 0)
                let proof_size := sub(ETA_CHALLENGE, PAIRING_POINT_0_X_0_LOC)
 
                calldatacopy(PAIRING_POINT_0_X_0_LOC, proof_ptr, proof_size)
 
                /*´:°•.°+.*•´.*:˚.°*.˚•´.°:°•.°•.*•´.*:˚.°*.˚•´.°:°•.°+.*•´.*:*/
                /*               VALIDATE PROOF INPUTS                      */
                /*.•°:°.´+˚.*°.˚:*.´•*.+°.•°:´*.´•*.•°.•°:°.´:•˚°.*°.˚:*.´+°.•*/
                // Validate all proof elements are within their expected ranges.
                // Pairing limbs: lo < 2^136, hi < 2^120. G1 coordinates < Q. Fr elements < P.
                {
                    let valid := true
                    let lo_limb_max := shl(136, 1)
                    let hi_limb_max := shl(120, 1)
                    let q_mod := Q
 
                    // 1. Pairing limbs: lo < 2^136, hi < 2^120 (4 pairs, stride 0x40)
                    let ptr := PAIRING_POINT_0_X_0_LOC
                    for {} lt(ptr, GEMINI_MASKING_POLY_X_LOC) { ptr := add(ptr, 0x40) } {
                        valid := and(valid, lt(mload(ptr), lo_limb_max))
                        valid := and(valid, lt(mload(add(ptr, 0x20)), hi_limb_max))
                    }
                    if iszero(valid) {
                        mstore(0x00, VALUE_GE_LIMB_MAX_SELECTOR)
                        revert(0x00, 0x04)
                    }
 
                    // 2. G1 coordinates: each < Q
                    //    - geminiMaskingPoly + witness commitments + libraConcat (20 slots)
                    for { ptr := GEMINI_MASKING_POLY_X_LOC } lt(ptr, LIBRA_SUM_LOC) { ptr := add(ptr, 0x20) } {
                        valid := and(valid, lt(mload(ptr), q_mod))
                    }
                    //    - Libra grand product + quotient (4 slots)
                    for { ptr := LIBRA_GRAND_PRODUCT_X_LOC } lt(ptr, GEMINI_FOLD_UNIVARIATE_0_X_LOC) {
                        ptr := add(ptr, 0x20)
                    } {
                        valid := and(valid, lt(mload(ptr), q_mod))
                    }
                    //    - Gemini fold commitments (28 slots)
                    for { ptr := GEMINI_FOLD_UNIVARIATE_0_X_LOC } lt(ptr, GEMINI_A_EVAL_0) { ptr := add(ptr, 0x20) } {
                        valid := and(valid, lt(mload(ptr), q_mod))
                    }
                    //    - Shplonk Q + KZG quotient (4 slots)
                    for { ptr := SHPLONK_Q_X_LOC } lt(ptr, ETA_CHALLENGE) { ptr := add(ptr, 0x20) } {
                        valid := and(valid, lt(mload(ptr), q_mod))
                    }
                    if iszero(valid) {
                        mstore(0x00, VALUE_GE_GROUP_ORDER_SELECTOR)
                        revert(0x00, 0x04)
                    }
 
                    // 2b. G1 points: identity (0,0) is accepted.
                    //     Polynomial commitments to identically-zero polynomials are
                    //     legitimately the identity, and the ecAdd/ecMul precompiles
                    //     treat (0,0) as the additive identity per EIP-196. Soundness
                    //     against (0,0) substitution for a non-zero commitment is upheld
                    //     by sumcheck/Shplemini downstream.
 
                    // 3. Fr elements: each < P
                    //    - libraSum + sumcheck univariates + evals + libraEvaluation (179 slots)
                    for { ptr := LIBRA_SUM_LOC } lt(ptr, LIBRA_GRAND_PRODUCT_X_LOC) {
                        ptr := add(ptr, 0x20)
                    } {
                        valid := and(valid, lt(mload(ptr), p))
                    }
                    //    - Gemini evaluations + libra poly evals (19 slots)
                    for { ptr := GEMINI_A_EVAL_0 } lt(ptr, SHPLONK_Q_X_LOC) { ptr := add(ptr, 0x20) } {
                        valid := and(valid, lt(mload(ptr), p))
                    }
                    if iszero(valid) {
                        mstore(0x00, VALUE_GE_FIELD_ORDER_SELECTOR)
                        revert(0x00, 0x04)
                    }
                }
 
                /*´:°•.°+.*•´.*:˚.°*.˚•´.°:°•.°•.*•´.*:˚.°*.˚•´.°:°•.°+.*•´.*:*/
                /*             GENERATE BETA and GAMMAA  CHALLENGE            */
                /*.•°:°.´+˚.*°.˚:*.´•*.+°.•°:´*.´•*.•°.•°:°.´:•˚°.*°.˚:*.´+°.•*/
 
                // Generate Beta and Gamma Chalenges
                // - prevChallenge
                // - LOOKUP_READ_COUNTS
                // - LOOKUP_READ_TAGS
                // - W4
                mcopy(0x20, LOOKUP_READ_COUNTS_X_LOC, 0xc0)
 
                prev_challenge := mod(keccak256(0x00, 0xe0), p)
                let beta := prev_challenge
                mstore(0x00, prev_challenge)
                prev_challenge := mod(keccak256(0x00, 0x20), p)
                mstore(0x00, prev_challenge)
                let gamma := prev_challenge
 
                mstore(BETA_CHALLENGE, beta)
                mstore(GAMMA_CHALLENGE, gamma)
 
                /*´:°•.°+.*•´.*:˚.°*.˚•´.°:°•.°•.*•´.*:˚.°*.˚•´.°:°•.°+.*•´.*:*/
                /*                      ALPHA CHALLENGES                      */
                /*.•°:°.´+˚.*°.˚:*.´•*.+°.•°:´*.´•*.•°.•°:°.´:•˚°.*°.˚:*.´+°.•*/
                // Generate Alpha challenges - non-linearise the gate contributions
                //
                // There are 31 total subrelations in this honk relation, we do not need to non linearise the first sub relation.
                // There are 30 total gate contributions, a gate contribution is analogous to
                // a custom gate, it is an expression which must evaluate to zero for each
                // row in the constraint matrix
                //
                // If we do not non-linearise sub relations, then sub relations which rely
                // on the same wire will interact with each other's sums.
 
                mcopy(0x20, LOOKUP_INVERSES_X_LOC, 0x80)
 
                // Generate single alpha challenge and compute its powers
                prev_challenge := mod(keccak256(0x00, 0xa0), p)
                mstore(0x00, prev_challenge)
                let alpha := prev_challenge
                mstore(ALPHA_CHALLENGE_0, alpha)
 
                // Compute powers of alpha: alpha^2, alpha^3, ..., alpha^30
                let alpha_off_set := ALPHA_CHALLENGE_1
                for {} lt(alpha_off_set, add(ALPHA_CHALLENGE_29, 0x20)) {} {
                    let prev_alpha := mload(sub(alpha_off_set, 0x20))
                    mstore(alpha_off_set, mulmod(prev_alpha, alpha, p))
                    alpha_off_set := add(alpha_off_set, 0x20)
                }
 
                /*´:°•.°+.*•´.*:˚.°*.˚•´.°:°•.°•.*•´.*:˚.°*.˚•´.°:°•.°+.*•´.*:*/
                /*                       GATE CHALLENGES                      */
                /*.•°:°.´+˚.*°.˚:*.´•*.+°.•°:´*.´•*.•°.•°:°.´:•˚°.*°.˚:*.´+°.•*/
 
                // Store the first gate challenge
                prev_challenge := mod(keccak256(0x00, 0x20), p)
                mstore(0x00, prev_challenge)
                let gate_challenge := prev_challenge
                mstore(GATE_CHALLENGE_0, gate_challenge)
 
                let gate_off := GATE_CHALLENGE_1
                for {} lt(gate_off, LIBRA_CHALLENGE) {} {
                    let prev := mload(sub(gate_off, 0x20))
 
                    mstore(gate_off, mulmod(prev, prev, p))
                    gate_off := add(gate_off, 0x20)
                }
 
                /*´:°•.°+.*•´.*:˚.°*.˚•´.°:°•.°•.*•´.*:˚.°*.˚•´.°:°•.°+.*•´.*:*/
                /*                     LIBRA CHALLENGE                          */
                /*.•°:°.´+˚.*°.˚:*.´•*.+°.•°:´*.´•*.•°.•°:°.´:•˚°.*°.˚:*.´+°.•*/
                // Generate Libra challenge: hash(prevChallenge, libraConcat.x, libraConcat.y, libraSum)
                // libraConcat (0x40) + libraSum (0x20) = 0x60 bytes of proof data
                mcopy(0x20, LIBRA_CONCAT_X_LOC, 0x60)
 
                prev_challenge := mod(keccak256(0x00, 0x80), p)
                mstore(0x00, prev_challenge)
                let libraChallenge := prev_challenge
                mstore(LIBRA_CHALLENGE, libraChallenge)
 
                // Sumcheck Univariate challenges (ZK variant)
                // The algebraic relations of the Honk protocol are max degree-7.
                // To prove satifiability, we multiply the relation by a random (POW) polynomial + masking.
                // As a result, in every round of sumcheck, the prover sends a degree-9 univariate polynomial.
                // 9 points are sent as it is enough to uniquely identify the polynomial.
                let read_off := SUMCHECK_UNIVARIATE_0_0_LOC
                let write_off := SUM_U_CHALLENGE_0
                for {} lt(read_off, GEMINI_MASKING_EVAL_LOC) {} {
                    // 0x20 * 9 = 0x120 bytes per round
                    mcopy(0x20, read_off, 0x120)
 
                    // Hash 0x120 + 0x20 (prev hash) = 0x140
                    prev_challenge := mod(keccak256(0x00, 0x140), p)
                    mstore(0x00, prev_challenge)
 
                    let sumcheck_u_challenge := prev_challenge
                    mstore(write_off, sumcheck_u_challenge)
 
                    // Progress read / write pointers
                    read_off := add(read_off, 0x120)
                    write_off := add(write_off, 0x20)
                }
 
                /*´:°•.°+.*•´.*:˚.°*.˚•´.°:°•.°•.*•´.*:˚.°*.˚•´.°:°•.°+.*•´.*:*/
                /*                        RHO CHALLENGES                      */
                /*.•°:°.´+˚.*°.˚:*.´•*.+°.•°:´*.´•*.•°.•°:°.´:•˚°.*°.˚:*.´+°.•*/
                // The RHO challenge is the hash of the evaluations of all of the wire values
                // As per usual, it includes the previous challenge
                // Evaluations of the following wires and their shifts (for relevant wires):
                // - QM
                // - QC
                // - Q1 (QL)
                // - Q2 (QR)
                // - Q3 (QO)
                // - Q4
                // - QLOOKUP
                // - QARITH
                // - QRANGE
                // - QELLIPTIC
                // - QMEMORY
                // - QNNF (NNF = Non Native Field)
                // - QPOSEIDON2_EXTERNAL
                // - QPOSEIDON2_INTERNAL
                // - SIGMA1
                // - SIGMA2
                // - SIGMA3
                // - SIGMA4
                // - ID1
                // - ID2
                // - ID3
                // - ID4
                // - TABLE1
                // - TABLE2
                // - TABLE3
                // - TABLE4
                // - W1 (WL)
                // - W2 (WR)
                // - W3 (WO)
                // - W4
                // - Z_PERM
                // - LOOKUP_INVERSES
                // - LOOKUP_READ_COUNTS
                // - LOOKUP_READ_TAGS
                // - W1_SHIFT
                // - W2_SHIFT
                // - W3_SHIFT
                // - W4_SHIFT
                // - Z_PERM_SHIFT
                //
                // Hash all evaluations + libraEvaluation + 2 libra commitments (G1)
                // ZK: 42 evals (GEMINI_MASKING_EVAL through Z_PERM_SHIFT) + libraEval + libraGrandProduct(G1) + libraQuotient(G1)
                // = 42*0x20 + 0x20 + 2*0x40 = 0x5e0 bytes
                mcopy(0x20, GEMINI_MASKING_EVAL_LOC, 0x5e0)
                prev_challenge := mod(keccak256(0x00, 0x600), p)
                mstore(0x00, prev_challenge)
 
                let rho := prev_challenge
 
                mstore(RHO_CHALLENGE, rho)
 
                /*´:°•.°+.*•´.*:˚.°*.˚•´.°:°•.°•.*•´.*:˚.°*.˚•´.°:°•.°+.*•´.*:*/
                /*                      GEMINI R CHALLENGE                    */
                /*.•°:°.´+˚.*°.˚:*.´•*.+°.•°:´*.´•*.•°.•°:°.´:•˚°.*°.˚:*.´+°.•*/
                // The Gemini R challenge contains a of all of commitments to all of the univariates
                // evaluated in the Gemini Protocol
                // So for multivariate polynomials in l variables, we will hash l - 1 commitments.
                // For this implementation, we have logN number of of rounds and thus logN - 1 committments
                // The format of these commitments are proof points, which are explained above
                // 0x40 * (logN - 1)
 
                mcopy(0x20, GEMINI_FOLD_UNIVARIATE_0_X_LOC, {{ GEMINI_FOLD_UNIVARIATE_LENGTH }})
 
                prev_challenge := mod(keccak256(0x00, {{ GEMINI_FOLD_UNIVARIATE_HASH_LENGTH }}), p)
                mstore(0x00, prev_challenge)
 
                let geminiR := prev_challenge
 
                mstore(GEMINI_R_CHALLENGE, geminiR)
 
                /*´:°•.°+.*•´.*:˚.°*.˚•´.°:°•.°•.*•´.*:˚.°*.˚•´.°:°•.°+.*•´.*:*/
                /*                    SHPLONK NU CHALLENGE                    */
                /*.•°:°.´+˚.*°.˚:*.´•*.+°.•°:´*.´•*.•°.•°:°.´:•˚°.*°.˚:*.´+°.•*/
                // The shplonk nu challenge hashes gemini A evaluations + libra poly evaluations
                // ZK: 0x20 * (logN + 4) = 0x20 * 19 = 0x260
 
                mcopy(0x20, GEMINI_A_EVAL_0, {{ GEMINI_EVALS_LENGTH }})
                prev_challenge := mod(keccak256(0x00, {{ GEMINI_EVALS_HASH_LENGTH }}), p)
                mstore(0x00, prev_challenge)
 
                let shplonkNu := prev_challenge
                mstore(SHPLONK_NU_CHALLENGE, shplonkNu)
 
                /*´:°•.°+.*•´.*:˚.°*.˚•´.°:°•.°•.*•´.*:˚.°*.˚•´.°:°•.°+.*•´.*:*/
                /*                    SHPLONK Z CHALLENGE                    */
                /*.•°:°.´+˚.*°.˚:*.´•*.+°.•°:´*.´•*.•°.•°:°.´:•˚°.*°.˚:*.´+°.•*/
                // Generate Shplonk Z
                // Hash of the single shplonk Q commitment
                mcopy(0x20, SHPLONK_Q_X_LOC, 0x40)
                prev_challenge := mod(keccak256(0x00, 0x60), p)
 
                let shplonkZ := prev_challenge
                mstore(SHPLONK_Z_CHALLENGE, shplonkZ)
 
                /*´:°•.°+.*•´.*:˚.°*.˚•´.°:°•.°•.*•´.*:˚.°*.˚•´.°:°•.°+.*•´.*:*/
                /*                     CHALLENGES COMPLETE                    */
                /*.•°:°.´+˚.*°.˚:*.´•*.+°.•°:´*.´•*.•°.•°:°.´:•˚°.*°.˚:*.´+°.•*/
            }
 
            /*´:°•.°+.*•´.*:˚.°*.˚•´.°:°•.°•.*•´.*:˚.°*.˚•´.°:°•.°+.*•´.*:*/
            /*                     PUBLIC INPUT DELTA                     */
            /*.•°:°.´+˚.*°.˚:*.´•*.+°.•°:´*.´•*.•°.•°:°.´:•˚°.*°.˚:*.´+°.•*/
            {
                let beta := mload(BETA_CHALLENGE)
                let gamma := mload(GAMMA_CHALLENGE)
                let pub_off := PUBLIC_INPUTS_OFFSET
 
                let numerator_value := 1
                let denominator_value := 1
 
                let p_clone := p // move p to the front of the stack
 
                // Assume offset is less than p
                // numerator_acc = gamma + (beta * (PERMUTATION_ARGUMENT_VALUE_SEPARATOR + offset))
                let numerator_acc :=
                    addmod(gamma, mulmod(beta, add(PERMUTATION_ARGUMENT_VALUE_SEPARATOR, pub_off), p_clone), p_clone)
                // demonimator_acc = gamma - (beta * (offset + 1))
                let beta_x_off := mulmod(beta, add(pub_off, 1), p_clone)
                let denominator_acc := addmod(gamma, sub(p_clone, beta_x_off), p_clone)
 
                let valid_inputs := true
                // Load the starting point of the public inputs (jump over the selector and the length of public inputs [0x24])
                let public_inputs_ptr := add(calldataload(0x24), 0x24)
 
                // endpoint_ptr = public_inputs_ptr + num_inputs * 0x20. // every public input is 0x20 bytes
                let endpoint_ptr := add(public_inputs_ptr, mul(REAL_NUMBER_PUBLIC_INPUTS, 0x20))
 
                for {} lt(public_inputs_ptr, endpoint_ptr) { public_inputs_ptr := add(public_inputs_ptr, 0x20) } {
                    // Get public inputs from calldata
                    let input := calldataload(public_inputs_ptr)
 
                    valid_inputs := and(valid_inputs, lt(input, p_clone))
 
                    numerator_value := mulmod(numerator_value, addmod(numerator_acc, input, p_clone), p_clone)
                    denominator_value := mulmod(denominator_value, addmod(denominator_acc, input, p_clone), p_clone)
 
                    numerator_acc := addmod(numerator_acc, beta, p_clone)
                    denominator_acc := addmod(denominator_acc, sub(p_clone, beta), p_clone)
                }
 
                // Revert if not all public inputs are field elements (i.e. < p)
                if iszero(valid_inputs) {
                    mstore(0x00, VALUE_GE_FIELD_ORDER_SELECTOR)
                    revert(0x00, 0x04)
                }
 
                /*´:°•.°+.*•´.*:˚.°*.˚•´.°:°•.°•.*•´.*:˚.°*.˚•´.°:°•.°+.*•´.*:*/
                /*           PUBLIC INPUT DELTA - Pairing points accum        */
                /*.•°:°.´+˚.*°.˚:*.´•*.+°.•°:´*.´•*.•°.•°:°.´:•˚°.*°.˚:*.´+°.•*/
                // Pairing points contribution to public inputs delta
                let pairing_points_ptr := PAIRING_POINT_0_X_0_LOC
                for {} lt(pairing_points_ptr, GEMINI_MASKING_POLY_X_LOC) { pairing_points_ptr := add(pairing_points_ptr, 0x20) } {
                    let input := mload(pairing_points_ptr)
 
                    numerator_value := mulmod(numerator_value, addmod(numerator_acc, input, p_clone), p_clone)
                    denominator_value := mulmod(denominator_value, addmod(denominator_acc, input, p_clone), p_clone)
 
                    numerator_acc := addmod(numerator_acc, beta, p_clone)
                    denominator_acc := addmod(denominator_acc, sub(p_clone, beta), p_clone)
                }
 
                mstore(PUBLIC_INPUTS_DELTA_NUMERATOR_CHALLENGE, numerator_value)
                mstore(PUBLIC_INPUTS_DELTA_DENOMINATOR_CHALLENGE, denominator_value)
 
                // PI delta denominator inversion is deferred to the barycentric
                // batch inversion below.
            }
            /*´:°•.°+.*•´.*:˚.°*.˚•´.°:°•.°•.*•´.*:˚.°*.˚•´.°:°•.°+.*•´.*:*/
            /*             PUBLIC INPUT DELTA - complete                  */
            /*.•°:°.´+˚.*°.˚:*.´•*.+°.•°:´*.´•*.•°.•°:°.´:•˚°.*°.˚:*.´+°.•*/
 
            /*´:°•.°+.*•´.*:˚.°*.˚•´.°:°•.°•.*•´.*:˚.°*.˚•´.°:°•.°+.*•´.*:*/
            /*                        SUMCHECK                            */
            /*.•°:°.´+˚.*°.˚:*.´•*.+°.•°:´*.´•*.•°.•°:°.´:•˚°.*°.˚:*.´+°.•*/
            //
            // Sumcheck is used to prove that every relation 0 on each row of the witness.
            //
            // Given each of the columns of our trace is a multilinear polynomial 𝑃1,…,𝑃𝑁∈𝔽[𝑋0,…,𝑋𝑑−1]. We run sumcheck over the polynomial
            //
            //                         𝐹̃ (𝑋0,…,𝑋𝑑−1)=𝑝𝑜𝑤𝛽(𝑋0,…,𝑋𝑑−1)⋅𝐹(𝑃1(𝑋0,…,𝑋𝑑−1),…,𝑃𝑁(𝑋0,…,𝑋𝑑−1))
            //
            // The Pow polynomial is a random polynomial that allows us to ceritify that the relations sum to 0 on each row of the witness,
            // rather than the entire sum just targeting 0.
            //
            // Each polynomial P in our implementation are the polys in the proof and the verification key. (W_1, W_2, W_3, W_4, Z_PERM, etc....)
            //
            // We start with a LOG_N variate multilinear polynomial, each round fixes a variable to a challenge value.
            // Each round the prover sends a round univariate poly, since the degree of our honk relations is 7 + the pow polynomial the prover
            // sends a degree-8 univariate on each round.
            // This is sent efficiently by sending 8 values, enough to represent a unique polynomial.
            // Barycentric evaluation is used to evaluate the polynomial at any point on the domain, given these 8 unique points.
            //
            // In the sumcheck protocol, the target sum for each round is the sum of the round univariate evaluated on 0 and 1.
            //                                               𝜎𝑖=?𝑆̃ 𝑖(0)+𝑆̃ 𝑖(1)
            // This is efficiently checked as S(0) and S(1) are sent by the prover as values of the round univariate.
            //
            // We compute the next challenge by evaluating the round univariate at a random challenge value.
            //                                                  𝜎𝑖+1←𝑆̃ 𝑖(𝑢𝑖)
            // This evaluation is performed via barycentric evaluation.
            //
            // Once we have reduced the multilinear polynomials into single dimensional polys, we check the entire sumcheck relation matches the target sum.
            //
            // Below this is composed of 8 relations:
            // 1. Arithmetic relation - constrains arithmetic
            // 2. Permutaiton Relation - efficiently encodes copy constraints
            // 3. Log Derivative Lookup Relation - used for lookup operations
            // 4. Delta Range Relation - used for efficient range checks
            // 5. Memory Relation - used for efficient memory operations
            // 6. NNF Relation - used for efficient Non Native Field operations
            // 7. Poseidon2 External Relation - used for efficient in-circuit hashing
            // 8. Poseidon2 Internal Relation - used for efficient in-circuit hashing
            //
            // These are batched together and evaluated at the same time using the alpha challenges.
            //
            {
                // We write the barycentric domain values into memory
                // These are written once per program execution, and reused across all
                // sumcheck rounds
                mstore(BARYCENTRIC_LAGRANGE_DENOMINATOR_0_LOC, BARYCENTRIC_LAGRANGE_DENOMINATOR_0)
                mstore(BARYCENTRIC_LAGRANGE_DENOMINATOR_1_LOC, BARYCENTRIC_LAGRANGE_DENOMINATOR_1)
                mstore(BARYCENTRIC_LAGRANGE_DENOMINATOR_2_LOC, BARYCENTRIC_LAGRANGE_DENOMINATOR_2)
                mstore(BARYCENTRIC_LAGRANGE_DENOMINATOR_3_LOC, BARYCENTRIC_LAGRANGE_DENOMINATOR_3)
                mstore(BARYCENTRIC_LAGRANGE_DENOMINATOR_4_LOC, BARYCENTRIC_LAGRANGE_DENOMINATOR_4)
                mstore(BARYCENTRIC_LAGRANGE_DENOMINATOR_5_LOC, BARYCENTRIC_LAGRANGE_DENOMINATOR_5)
                mstore(BARYCENTRIC_LAGRANGE_DENOMINATOR_6_LOC, BARYCENTRIC_LAGRANGE_DENOMINATOR_6)
                mstore(BARYCENTRIC_LAGRANGE_DENOMINATOR_7_LOC, BARYCENTRIC_LAGRANGE_DENOMINATOR_7)
                mstore(BARYCENTRIC_LAGRANGE_DENOMINATOR_8_LOC, BARYCENTRIC_LAGRANGE_DENOMINATOR_8)
 
                // Compute the target sums for each round of sumcheck
                {
                    // This requires the barycentric inverses to be computed for each round
                    // Write all of the non inverted barycentric denominators into memory
                    let accumulator := 1
                    let temp := FOLD_POS_EVALUATIONS_{{ LOG_N_MINUS_ONE }}_LOC // we use fold pos evaluations as we add 0x20 immediately to the pointer to get `BARYCENTRIC_TEMP_0_LOC`
                    let bary_centric_inverses_off := BARYCENTRIC_DENOMINATOR_INVERSES_0_0_LOC
                    {
                        let round_challenge_off := SUM_U_CHALLENGE_0
                        for { let round := 0 } lt(round, LOG_N) { round := add(round, 1) } {
                            let round_challenge := mload(round_challenge_off)
                            let bary_lagrange_denominator_off := BARYCENTRIC_LAGRANGE_DENOMINATOR_0_LOC
 
                            // Unrolled as this loop only has 9 iterations (ZK)
                            {
                                let bary_lagrange_denominator := mload(bary_lagrange_denominator_off)
                                let pre_inv :=
                                    mulmod(
                                        bary_lagrange_denominator,
                                        addmod(round_challenge, p, p), // sub(p, 0) = p
                                        p
                                    )
                                mstore(bary_centric_inverses_off, pre_inv)
                                temp := add(temp, 0x20)
                                mstore(temp, accumulator)
                                accumulator := mulmod(accumulator, pre_inv, p)
 
                                // increase offsets
                                bary_lagrange_denominator_off := add(bary_lagrange_denominator_off, 0x20)
                                bary_centric_inverses_off := add(bary_centric_inverses_off, 0x20)
 
                                // barycentric_index = 1
                                bary_lagrange_denominator := mload(bary_lagrange_denominator_off)
                                pre_inv := mulmod(bary_lagrange_denominator, addmod(round_challenge, sub(p, 1), p), p)
                                mstore(bary_centric_inverses_off, pre_inv)
                                temp := add(temp, 0x20)
                                mstore(temp, accumulator)
                                accumulator := mulmod(accumulator, pre_inv, p)
 
                                // increase offsets
                                bary_lagrange_denominator_off := add(bary_lagrange_denominator_off, 0x20)
                                bary_centric_inverses_off := add(bary_centric_inverses_off, 0x20)
 
                                // barycentric_index = 2
                                bary_lagrange_denominator := mload(bary_lagrange_denominator_off)
                                pre_inv := mulmod(bary_lagrange_denominator, addmod(round_challenge, sub(p, 2), p), p)
                                mstore(bary_centric_inverses_off, pre_inv)
                                temp := add(temp, 0x20)
                                mstore(temp, accumulator)
                                accumulator := mulmod(accumulator, pre_inv, p)
 
                                // increase offsets
                                bary_lagrange_denominator_off := add(bary_lagrange_denominator_off, 0x20)
                                bary_centric_inverses_off := add(bary_centric_inverses_off, 0x20)
 
                                // barycentric_index = 3
                                bary_lagrange_denominator := mload(bary_lagrange_denominator_off)
                                pre_inv := mulmod(bary_lagrange_denominator, addmod(round_challenge, sub(p, 3), p), p)
                                mstore(bary_centric_inverses_off, pre_inv)
                                temp := add(temp, 0x20)
                                mstore(temp, accumulator)
                                accumulator := mulmod(accumulator, pre_inv, p)
 
                                // increase offsets
                                bary_lagrange_denominator_off := add(bary_lagrange_denominator_off, 0x20)
                                bary_centric_inverses_off := add(bary_centric_inverses_off, 0x20)
 
                                // barycentric_index = 4
                                bary_lagrange_denominator := mload(bary_lagrange_denominator_off)
                                pre_inv := mulmod(bary_lagrange_denominator, addmod(round_challenge, sub(p, 4), p), p)
                                mstore(bary_centric_inverses_off, pre_inv)
                                temp := add(temp, 0x20)
                                mstore(temp, accumulator)
                                accumulator := mulmod(accumulator, pre_inv, p)
 
                                // increase offsets
                                bary_lagrange_denominator_off := add(bary_lagrange_denominator_off, 0x20)
                                bary_centric_inverses_off := add(bary_centric_inverses_off, 0x20)
 
                                // barycentric_index = 5
                                bary_lagrange_denominator := mload(bary_lagrange_denominator_off)
                                pre_inv := mulmod(bary_lagrange_denominator, addmod(round_challenge, sub(p, 5), p), p)
                                mstore(bary_centric_inverses_off, pre_inv)
                                temp := add(temp, 0x20)
                                mstore(temp, accumulator)
                                accumulator := mulmod(accumulator, pre_inv, p)
 
                                // increase offsets
                                bary_lagrange_denominator_off := add(bary_lagrange_denominator_off, 0x20)
                                bary_centric_inverses_off := add(bary_centric_inverses_off, 0x20)
 
                                // barycentric_index = 6
                                bary_lagrange_denominator := mload(bary_lagrange_denominator_off)
                                pre_inv := mulmod(bary_lagrange_denominator, addmod(round_challenge, sub(p, 6), p), p)
                                mstore(bary_centric_inverses_off, pre_inv)
                                temp := add(temp, 0x20)
                                mstore(temp, accumulator)
                                accumulator := mulmod(accumulator, pre_inv, p)
 
                                // increase offsets
                                bary_lagrange_denominator_off := add(bary_lagrange_denominator_off, 0x20)
                                bary_centric_inverses_off := add(bary_centric_inverses_off, 0x20)
 
                                // barycentric_index = 7
                                bary_lagrange_denominator := mload(bary_lagrange_denominator_off)
                                pre_inv := mulmod(bary_lagrange_denominator, addmod(round_challenge, sub(p, 7), p), p)
                                mstore(bary_centric_inverses_off, pre_inv)
                                temp := add(temp, 0x20)
                                mstore(temp, accumulator)
                                accumulator := mulmod(accumulator, pre_inv, p)
 
                                // increase offsets
                                bary_lagrange_denominator_off := add(bary_lagrange_denominator_off, 0x20)
                                bary_centric_inverses_off := add(bary_centric_inverses_off, 0x20)
 
                                // barycentric_index = 8 (ZK)
                                bary_lagrange_denominator := mload(bary_lagrange_denominator_off)
                                pre_inv := mulmod(bary_lagrange_denominator, addmod(round_challenge, sub(p, 8), p), p)
                                mstore(bary_centric_inverses_off, pre_inv)
                                temp := add(temp, 0x20)
                                mstore(temp, accumulator)
                                accumulator := mulmod(accumulator, pre_inv, p)
 
                                // increase offsets
                                bary_lagrange_denominator_off := add(bary_lagrange_denominator_off, 0x20)
                                bary_centric_inverses_off := add(bary_centric_inverses_off, 0x20)
                            }
                            round_challenge_off := add(round_challenge_off, 0x20)
                        }
                    }
 
                    // Append PI delta denominator to the batch inversion
                    {
                        let pi_denom := mload(PUBLIC_INPUTS_DELTA_DENOMINATOR_CHALLENGE)
                        mstore(PUBLIC_INPUTS_DENOM_TEMP_LOC, accumulator)
                        accumulator := mulmod(accumulator, pi_denom, p)
                    }
 
                    // --- Phase 2: Shplemini forward pass ---
                    // Compute shplemini denominators and accumulate into the running product.
                    // Pre-inversion values stored at designated addresses (0x6800+),
                    // which don't overlap with barycentric storage.
                    {
                        // Compute powers of evaluation challenge: gemini_r^{2^i}
                        let cache := mload(GEMINI_R_CHALLENGE)
                        mstore(POWERS_OF_EVALUATION_CHALLENGE_0_LOC, cache)
 
                        // Element 0: gemini_r (seed)
                        {
                            let val := mload(GEMINI_R_CHALLENGE)
                            mstore(GEMINI_R_INV_TEMP_LOC, accumulator)
                            accumulator := mulmod(accumulator, val, p)
                        }
 
                        // Append Libra Subgroup Denominator calculation to batch inversion
                        {
                            let val := addmod(
                                mload(SHPLONK_Z_CHALLENGE),
                                sub(p, mulmod(SUBGROUP_GENERATOR, mload(GEMINI_R_CHALLENGE), p)),
                                p
                            )
                            mstore(LIBRA_SUBGROUP_DENOM_LOC, val)
                            mstore(LIBRA_SUBGROUP_DENOM_TEMP_LOC, accumulator)
                            accumulator := mulmod(accumulator, val, p)
                        }
 
                        // Elements 1..LOG_N: INVERTED_CHALLENGE_POW_MINUS_U
                        // Elements LOG_N+1..2*LOG_N: POS_INVERTED_DENOM
                        // Elements 2*LOG_N+1..3*LOG_N: NEG_INVERTED_DENOM
                    }
 
                    // Invert all elements (barycentric + PI delta + shplemini) as a single batch
                    {
                        {
                            mstore(0, 0x20)
                            mstore(0x20, 0x20)
                            mstore(0x40, 0x20)
                            mstore(0x60, accumulator)
                            mstore(0x80, P_SUB_2)
                            mstore(0xa0, p)
                            if iszero(staticcall(gas(), 0x05, 0x00, 0xc0, 0x00, 0x20)) {
                                mstore(0x00, MODEXP_FAILED_SELECTOR)
                                revert(0x00, 0x04)
                            }
                            accumulator := mload(0x00)
                            if iszero(accumulator) {
                                mstore(0x00, MODEXP_FAILED_SELECTOR)
                                revert(0x00, 0x04)
                            }
                        }
 
                        // --- Shplemini backward pass ---
                        // Extract shplemini inverses in strict reverse order.
                        {
 
                            // libra subgroup denom
                            {
                                let tmp := mulmod(accumulator, mload(LIBRA_SUBGROUP_DENOM_TEMP_LOC), p)
                                accumulator := mulmod(accumulator, mload(LIBRA_SUBGROUP_DENOM_LOC), p)
                                mstore(LIBRA_SUBGROUP_DENOM_LOC, tmp)
                            }
 
                            // gemini_r inverse
                            {
                                let tmp := mulmod(accumulator, mload(GEMINI_R_INV_TEMP_LOC), p)
                                accumulator := mulmod(accumulator, mload(GEMINI_R_CHALLENGE), p)
                                mstore(GEMINI_R_INV_LOC, tmp)
                            }
                        }
 
                        // Extract PI delta denominator inverse from the batch
                        {
                            let pi_delta_inv := mulmod(accumulator, mload(PUBLIC_INPUTS_DENOM_TEMP_LOC), p)
                            accumulator := mulmod(accumulator, mload(PUBLIC_INPUTS_DELTA_DENOMINATOR_CHALLENGE), p)
 
                            // Finalize: public_inputs_delta = numerator * (1/denominator)
                            mstore(
                                PUBLIC_INPUTS_DELTA_NUMERATOR_CHALLENGE,
                                mulmod(mload(PUBLIC_INPUTS_DELTA_NUMERATOR_CHALLENGE), pi_delta_inv, p)
                            )
                        }
 
                        // Normalise as last loop will have incremented the offset
                        bary_centric_inverses_off := sub(bary_centric_inverses_off, 0x20)
                        for {} gt(bary_centric_inverses_off, BARYCENTRIC_LAGRANGE_DENOMINATOR_{{ BATCHED_RELATION_PARTIAL_LENGTH_MINUS_ONE }}_LOC) {
                            bary_centric_inverses_off := sub(bary_centric_inverses_off, 0x20)
                        } {
                            let tmp := mulmod(accumulator, mload(temp), p)
                            accumulator := mulmod(accumulator, mload(bary_centric_inverses_off), p)
                            mstore(bary_centric_inverses_off, tmp)
 
                            temp := sub(temp, 0x20)
                        }
                    }
                }
 
                let valid := true
                // ZK: initial round target = libraChallenge * libraSum
                let round_target := mulmod(mload(LIBRA_CHALLENGE), mload(LIBRA_SUM_LOC), p)
                let pow_partial_evaluation := 1
                let gate_challenge_off := GATE_CHALLENGE_0
                let round_univariates_off := SUMCHECK_UNIVARIATE_0_0_LOC
 
                let challenge_off := SUM_U_CHALLENGE_0
                let bary_inverses_off := BARYCENTRIC_DENOMINATOR_INVERSES_0_0_LOC
 
                for { let round := 0 } lt(round, LOG_N) { round := add(round, 1) } {
                    let round_challenge := mload(challenge_off)
 
                    // Total sum = u[0] + u[1]
                    let total_sum := addmod(mload(round_univariates_off), mload(add(round_univariates_off, 0x20)), p)
                    valid := and(valid, eq(total_sum, round_target))
 
                    // Compute next target sum (ZK: 9-element domain)
                    let numerator_value := round_challenge
                    numerator_value := mulmod(numerator_value, addmod(round_challenge, sub(p, 1), p), p)
                    numerator_value := mulmod(numerator_value, addmod(round_challenge, sub(p, 2), p), p)
                    numerator_value := mulmod(numerator_value, addmod(round_challenge, sub(p, 3), p), p)
                    numerator_value := mulmod(numerator_value, addmod(round_challenge, sub(p, 4), p), p)
                    numerator_value := mulmod(numerator_value, addmod(round_challenge, sub(p, 5), p), p)
                    numerator_value := mulmod(numerator_value, addmod(round_challenge, sub(p, 6), p), p)
                    numerator_value := mulmod(numerator_value, addmod(round_challenge, sub(p, 7), p), p)
                    numerator_value := mulmod(numerator_value, addmod(round_challenge, sub(p, 8), p), p)
 
                    // // Compute the next round target
                    round_target := 0
                    for { let i := 0 } lt(i, BATCHED_RELATION_PARTIAL_LENGTH) { i := add(i, 1) } {
                        let term := mload(round_univariates_off)
                        let inverse := mload(bary_inverses_off)
 
                        term := mulmod(term, inverse, p)
                        round_target := addmod(round_target, term, p)
                        round_univariates_off := add(round_univariates_off, 0x20)
                        bary_inverses_off := add(bary_inverses_off, 0x20)
                    }
 
                    round_target := mulmod(round_target, numerator_value, p)
 
                    // Partially evaluate POW
                    let gate_challenge := mload(gate_challenge_off)
                    let gate_challenge_minus_one := sub(gate_challenge, 1)
 
                    let univariate_evaluation := addmod(1, mulmod(round_challenge, gate_challenge_minus_one, p), p)
 
                    pow_partial_evaluation := mulmod(pow_partial_evaluation, univariate_evaluation, p)
 
                    gate_challenge_off := add(gate_challenge_off, 0x20)
                    challenge_off := add(challenge_off, 0x20)
                }
 
                if iszero(valid) {
                    mstore(0x00, SUMCHECK_FAILED_SELECTOR)
                    revert(0x00, 0x04)
                }
 
                // The final sumcheck round; accumulating evaluations
                // Uses pow partial evaluation as the gate scaling factor
 
                mstore(POW_PARTIAL_EVALUATION_LOC, pow_partial_evaluation)
                mstore(FINAL_ROUND_TARGET_LOC, round_target)
 
                /*´:°•.°+.*•´.*:˚.°*.˚•´.°:°•.°•.*•´.*:˚.°*.˚•´.°:°•.°+.*•´.*:*/
                /*                        LOGUP RELATION                      */
                /*.•°:°.´+˚.*°.˚:*.´•*.+°.•°:´*.´•*.•°.•°:°.´:•˚°.*°.˚:*.´+°.•*/
                {
                    let w1q1 := mulmod(mload(W1_EVAL_LOC), mload(QL_EVAL_LOC), p)
                    let w2q2 := mulmod(mload(W2_EVAL_LOC), mload(QR_EVAL_LOC), p)
                    let w3q3 := mulmod(mload(W3_EVAL_LOC), mload(QO_EVAL_LOC), p)
                    let w4q3 := mulmod(mload(W4_EVAL_LOC), mload(Q4_EVAL_LOC), p)
 
                    let q_arith := mload(QARITH_EVAL_LOC)
                    // w1w2qm := (w_1 . w_2 . q_m . (QARITH_EVAL_LOC - 3)) / 2
                    let w1w2qm :=
                        mulmod(
                            mulmod(
                                mulmod(mulmod(mload(W1_EVAL_LOC), mload(W2_EVAL_LOC), p), mload(QM_EVAL_LOC), p),
                                addmod(q_arith, P_SUB_3, p),
                                p
                            ),
                            NEG_HALF_MODULO_P,
                            p
                        )
 
                    // (w_1 . w_2 . q_m . (q_arith - 3)) / -2) + (w_1 . q_1) + (w_2 . q_2) + (w_3 . q_3) + (w_4 . q_4) + q_c
                    let identity :=
                        addmod(
                            mload(QC_EVAL_LOC),
                            addmod(w4q3, addmod(w3q3, addmod(w2q2, addmod(w1q1, w1w2qm, p), p), p), p),
                            p
                        )
 
                    // if q_arith == 3 we evaluate an additional mini addition gate (on top of the regular one), where:
                    // w_1 + w_4 - w_1_omega + q_m = 0
                    // we use this gate to save an addition gate when adding or subtracting non-native field elements
                    // α * (q_arith - 2) * (w_1 + w_4 - w_1_omega + q_m)
                    let extra_small_addition_gate_identity :=
                        mulmod(
                            addmod(q_arith, P_SUB_2, p),
                            addmod(
                                mload(QM_EVAL_LOC),
                                addmod(
                                    sub(p, mload(W1_SHIFT_EVAL_LOC)),
                                    addmod(mload(W1_EVAL_LOC), mload(W4_EVAL_LOC), p),
                                    p
                                ),
                                p
                            ),
                            p
                        )
 
                    // Split up the two relations
                    let contribution_0 :=
                        addmod(identity, mulmod(addmod(q_arith, P_SUB_1, p), mload(W4_SHIFT_EVAL_LOC), p), p)
                    contribution_0 := mulmod(mulmod(contribution_0, q_arith, p), mload(POW_PARTIAL_EVALUATION_LOC), p)
                    mstore(SUBRELATION_EVAL_6_LOC, contribution_0)
 
                    let contribution_1 := mulmod(extra_small_addition_gate_identity, addmod(q_arith, P_SUB_1, p), p)
                    contribution_1 := mulmod(contribution_1, q_arith, p)
                    contribution_1 := mulmod(contribution_1, mload(POW_PARTIAL_EVALUATION_LOC), p)
                    mstore(SUBRELATION_EVAL_7_LOC, contribution_1)
                }
 
                /*´:°•.°+.*•´.*:˚.°*.˚•´.°:°•.°•.*•´.*:˚.°*.˚•´.°:°•.°+.*•´.*:*/
                /*                   PERMUTATION RELATION                     */
                /*.•°:°.´+˚.*°.˚:*.´•*.+°.•°:´*.´•*.•°.•°:°.´:•˚°.*°.˚:*.´+°.•*/
                {
                    let beta := mload(BETA_CHALLENGE)
                    let gamma := mload(GAMMA_CHALLENGE)
 
                    let t1 :=
                        mulmod(
                            add(add(mload(W1_EVAL_LOC), gamma), mulmod(beta, mload(ID1_EVAL_LOC), p)),
                            add(add(mload(W2_EVAL_LOC), gamma), mulmod(beta, mload(ID2_EVAL_LOC), p)),
                            p
                        )
                    let t2 :=
                        mulmod(
                            add(add(mload(W3_EVAL_LOC), gamma), mulmod(beta, mload(ID3_EVAL_LOC), p)),
                            add(add(mload(W4_EVAL_LOC), gamma), mulmod(beta, mload(ID4_EVAL_LOC), p)),
                            p
                        )
                    let numerator := mulmod(t1, t2, p)
                    t1 := mulmod(
                        add(add(mload(W1_EVAL_LOC), gamma), mulmod(beta, mload(SIGMA1_EVAL_LOC), p)),
                        add(add(mload(W2_EVAL_LOC), gamma), mulmod(beta, mload(SIGMA2_EVAL_LOC), p)),
                        p
                    )
                    t2 := mulmod(
                        add(add(mload(W3_EVAL_LOC), gamma), mulmod(beta, mload(SIGMA3_EVAL_LOC), p)),
                        add(add(mload(W4_EVAL_LOC), gamma), mulmod(beta, mload(SIGMA4_EVAL_LOC), p)),
                        p
                    )
                    let denominator := mulmod(t1, t2, p)
 
                    {
                        let acc :=
                            mulmod(addmod(mload(Z_PERM_EVAL_LOC), mload(LAGRANGE_FIRST_EVAL_LOC), p), numerator, p)
 
                        acc := addmod(
                            acc,
                            sub(
                                p,
                                mulmod(
                                    addmod(
                                        mload(Z_PERM_SHIFT_EVAL_LOC),
                                        mulmod(
                                            mload(LAGRANGE_LAST_EVAL_LOC),
                                            mload(PUBLIC_INPUTS_DELTA_NUMERATOR_CHALLENGE),
                                            p
                                        ),
                                        p
                                    ),
                                    denominator,
                                    p
                                )
                            ),
                            p
                        )
 
                        acc := mulmod(acc, mload(POW_PARTIAL_EVALUATION_LOC), p)
                        mstore(SUBRELATION_EVAL_0_LOC, acc)
 
                        acc := mulmod(
                            mulmod(mload(LAGRANGE_LAST_EVAL_LOC), mload(Z_PERM_SHIFT_EVAL_LOC), p),
                            mload(POW_PARTIAL_EVALUATION_LOC),
                            p
                        )
                        mstore(SUBRELATION_EVAL_1_LOC, acc)
 
 
                        // zperm initialization (lagrange_first * z_perm = 0)
                        acc := mulmod(
                            mulmod(
                                mload(LAGRANGE_FIRST_EVAL_LOC),
                                mload(Z_PERM_EVAL_LOC),
                                p),
                            mload(POW_PARTIAL_EVALUATION_LOC),
                            p)
                        mstore(SUBRELATION_EVAL_2_LOC, acc)
                    }
                }
 
                /*´:°•.°+.*•´.*:˚.°*.˚•´.°:°•.°•.*•´.*:˚.°*.˚•´.°:°•.°+.*•´.*:*/
                /*                   LOGUP WIDGET EVALUATION                  */
                /*.•°:°.´+˚.*°.˚:*.´•*.+°.•°:´*.´•*.•°.•°:°.´:•˚°.*°.˚:*.´+°.•*/
                // Note: Using beta powers for column batching and gamma for offset ensures soundness
                // beta and gamma must be independent challenges (they come from splitting the same hash)
                {
                    let gamma := mload(GAMMA_CHALLENGE)
                    let beta := mload(BETA_CHALLENGE)
                    // Compute beta powers inline (β², β³) for lookup column batching
                    let beta_sqr := mulmod(beta, beta, p)
                    let beta_cube := mulmod(beta_sqr, beta, p)
 
                    // table_term = table_1 + γ + table_2 * β + table_3 * β² + table_4 * β³
                    let t0 :=
                        addmod(addmod(mload(TABLE1_EVAL_LOC), gamma, p), mulmod(mload(TABLE2_EVAL_LOC), beta, p), p)
                    let t1 :=
                        addmod(
                            mulmod(mload(TABLE3_EVAL_LOC), beta_sqr, p),
                            mulmod(mload(TABLE4_EVAL_LOC), beta_cube, p),
                            p
                        )
                    let table_term := addmod(t0, t1, p)
 
                    // lookup_term = derived_entry_1 + γ + derived_entry_2 * β + derived_entry_3 * β² + q_index * β³
                    t0 := addmod(
                        addmod(mload(W1_EVAL_LOC), gamma, p),
                        mulmod(mload(QR_EVAL_LOC), mload(W1_SHIFT_EVAL_LOC), p),
                        p
                    )
                    t1 := addmod(mload(W2_EVAL_LOC), mulmod(mload(QM_EVAL_LOC), mload(W2_SHIFT_EVAL_LOC), p), p)
                    let t2 := addmod(mload(W3_EVAL_LOC), mulmod(mload(QC_EVAL_LOC), mload(W3_SHIFT_EVAL_LOC), p), p)
 
                    let lookup_term := addmod(t0, mulmod(t1, beta, p), p)
                    lookup_term := addmod(lookup_term, mulmod(t2, beta_sqr, p), p)
                    lookup_term := addmod(lookup_term, mulmod(mload(QO_EVAL_LOC), beta_cube, p), p)
 
                    let lookup_inverse := mulmod(mload(LOOKUP_INVERSES_EVAL_LOC), table_term, p)
                    let table_inverse := mulmod(mload(LOOKUP_INVERSES_EVAL_LOC), lookup_term, p)
 
                    let inverse_exists_xor := addmod(mload(LOOKUP_READ_TAGS_EVAL_LOC), mload(QLOOKUP_EVAL_LOC), p)
                    inverse_exists_xor := addmod(
                        inverse_exists_xor,
                        sub(p, mulmod(mload(LOOKUP_READ_TAGS_EVAL_LOC), mload(QLOOKUP_EVAL_LOC), p)),
                        p
                    )
 
                    let accumulator_none := mulmod(mulmod(lookup_term, table_term, p), mload(LOOKUP_INVERSES_EVAL_LOC), p)
                    accumulator_none := addmod(accumulator_none, sub(p, inverse_exists_xor), p)
                    accumulator_none := mulmod(accumulator_none, mload(POW_PARTIAL_EVALUATION_LOC), p)
 
                    let accumulator_one := mulmod(mload(QLOOKUP_EVAL_LOC), lookup_inverse, p)
                    accumulator_one := addmod(
                        accumulator_one,
                        sub(p, mulmod(mload(LOOKUP_READ_COUNTS_EVAL_LOC), table_inverse, p)),
                        p
                    )
 
                    let read_tag := mload(LOOKUP_READ_TAGS_EVAL_LOC)
                    let read_tag_boolean_relation := mulmod(read_tag, addmod(read_tag, P_SUB_1, p), p)
                    read_tag_boolean_relation := mulmod(read_tag_boolean_relation, mload(POW_PARTIAL_EVALUATION_LOC), p)
 
                    mstore(SUBRELATION_EVAL_3_LOC, accumulator_none)
                    mstore(SUBRELATION_EVAL_4_LOC, accumulator_one)
                    mstore(SUBRELATION_EVAL_5_LOC, read_tag_boolean_relation)
                }
 
                /*´:°•.°+.*•´.*:˚.°*.˚•´.°:°•.°•.*•´.*:˚.°*.˚•´.°:°•.°+.*•´.*:*/
                /*                   DELTA RANGE RELATION                     */
                /*.•°:°.´+˚.*°.˚:*.´•*.+°.•°:´*.´•*.•°.•°:°.´:•˚°.*°.˚:*.´+°.•*/
                {
                    let minus_one := P_SUB_1
                    let minus_two := P_SUB_2
                    let minus_three := P_SUB_3
 
                    let delta_1 := addmod(mload(W2_EVAL_LOC), sub(p, mload(W1_EVAL_LOC)), p)
                    let delta_2 := addmod(mload(W3_EVAL_LOC), sub(p, mload(W2_EVAL_LOC)), p)
                    let delta_3 := addmod(mload(W4_EVAL_LOC), sub(p, mload(W3_EVAL_LOC)), p)
                    let delta_4 := addmod(mload(W1_SHIFT_EVAL_LOC), sub(p, mload(W4_EVAL_LOC)), p)
 
                    {
                        let acc := delta_1
                        acc := mulmod(acc, addmod(delta_1, minus_one, p), p)
                        acc := mulmod(acc, addmod(delta_1, minus_two, p), p)
                        acc := mulmod(acc, addmod(delta_1, minus_three, p), p)
                        acc := mulmod(acc, mload(QRANGE_EVAL_LOC), p)
                        acc := mulmod(acc, mload(POW_PARTIAL_EVALUATION_LOC), p)
                        mstore(SUBRELATION_EVAL_8_LOC, acc)
                    }
 
                    {
                        let acc := delta_2
                        acc := mulmod(acc, addmod(delta_2, minus_one, p), p)
                        acc := mulmod(acc, addmod(delta_2, minus_two, p), p)
                        acc := mulmod(acc, addmod(delta_2, minus_three, p), p)
                        acc := mulmod(acc, mload(QRANGE_EVAL_LOC), p)
                        acc := mulmod(acc, mload(POW_PARTIAL_EVALUATION_LOC), p)
                        mstore(SUBRELATION_EVAL_9_LOC, acc)
                    }
 
                    {
                        let acc := delta_3
                        acc := mulmod(acc, addmod(delta_3, minus_one, p), p)
                        acc := mulmod(acc, addmod(delta_3, minus_two, p), p)
                        acc := mulmod(acc, addmod(delta_3, minus_three, p), p)
                        acc := mulmod(acc, mload(QRANGE_EVAL_LOC), p)
                        acc := mulmod(acc, mload(POW_PARTIAL_EVALUATION_LOC), p)
                        mstore(SUBRELATION_EVAL_10_LOC, acc)
                    }
 
                    {
                        let acc := delta_4
                        acc := mulmod(acc, addmod(delta_4, minus_one, p), p)
                        acc := mulmod(acc, addmod(delta_4, minus_two, p), p)
                        acc := mulmod(acc, addmod(delta_4, minus_three, p), p)
                        acc := mulmod(acc, mload(QRANGE_EVAL_LOC), p)
                        acc := mulmod(acc, mload(POW_PARTIAL_EVALUATION_LOC), p)
                        mstore(SUBRELATION_EVAL_11_LOC, acc)
                    }
                }
 
                /*´:°•.°+.*•´.*:˚.°*.˚•´.°:°•.°•.*•´.*:˚.°*.˚•´.°:°•.°+.*•´.*:*/
                /*                    ELLIPTIC CURVE RELATION                 */
                /*.•°:°.´+˚.*°.˚:*.´•*.+°.•°:´*.´•*.•°.•°:°.´:•˚°.*°.˚:*.´+°.•*/
                {
                    // Contribution 10 point addition, x-coordinate check
                    // q_elliptic * (x3 + x2 + x1)(x2 - x1)(x2 - x1) - y2^2 - y1^2 + 2(y2y1)*q_sign = 0
                    let x_diff := addmod(mload(EC_X_2), sub(p, mload(EC_X_1)), p)
                    let y1_sqr := mulmod(mload(EC_Y_1), mload(EC_Y_1), p)
                    {
                        let y2_sqr := mulmod(mload(EC_Y_2), mload(EC_Y_2), p)
                        let y1y2 := mulmod(mulmod(mload(EC_Y_1), mload(EC_Y_2), p), mload(EC_Q_SIGN), p)
                        let x_add_identity := addmod(mload(EC_X_3), addmod(mload(EC_X_2), mload(EC_X_1), p), p)
                        x_add_identity := mulmod(mulmod(x_add_identity, x_diff, p), x_diff, p)
                        x_add_identity := addmod(x_add_identity, sub(p, y2_sqr), p)
                        x_add_identity := addmod(x_add_identity, sub(p, y1_sqr), p)
                        x_add_identity := addmod(x_add_identity, y1y2, p)
                        x_add_identity := addmod(x_add_identity, y1y2, p)
 
                        let eval := mulmod(x_add_identity, mload(POW_PARTIAL_EVALUATION_LOC), p)
                        eval := mulmod(eval, mload(QELLIPTIC_EVAL_LOC), p)
                        eval := mulmod(eval, addmod(1, sub(p, mload(EC_Q_IS_DOUBLE)), p), p)
                        mstore(SUBRELATION_EVAL_12_LOC, eval)
                    }
 
                    {
                        let y1_plus_y3 := addmod(mload(EC_Y_1), mload(EC_Y_3), p)
                        let y_diff := mulmod(mload(EC_Y_2), mload(EC_Q_SIGN), p)
                        y_diff := addmod(y_diff, sub(p, mload(EC_Y_1)), p)
                        let y_add_identity := mulmod(y1_plus_y3, x_diff, p)
                        y_add_identity := addmod(
                            y_add_identity,
                            mulmod(addmod(mload(EC_X_3), sub(p, mload(EC_X_1)), p), y_diff, p),
                            p
                        )
 
                        let eval := mulmod(y_add_identity, mload(POW_PARTIAL_EVALUATION_LOC), p)
                        eval := mulmod(eval, mload(QELLIPTIC_EVAL_LOC), p)
                        eval := mulmod(eval, addmod(1, sub(p, mload(EC_Q_IS_DOUBLE)), p), p)
                        mstore(SUBRELATION_EVAL_13_LOC, eval)
                    }
 
                    {
                        let x_pow_4 := mulmod(addmod(y1_sqr, GRUMPKIN_CURVE_B_PARAMETER_NEGATED, p), mload(EC_X_1), p)
                        let y1_sqr_mul_4 := addmod(y1_sqr, y1_sqr, p)
                        y1_sqr_mul_4 := addmod(y1_sqr_mul_4, y1_sqr_mul_4, p)
 
                        let x1_pow_4_mul_9 := mulmod(x_pow_4, 9, p)
 
                        let ep_x_double_identity := addmod(mload(EC_X_3), addmod(mload(EC_X_1), mload(EC_X_1), p), p)
                        ep_x_double_identity := mulmod(ep_x_double_identity, y1_sqr_mul_4, p)
                        ep_x_double_identity := addmod(ep_x_double_identity, sub(p, x1_pow_4_mul_9), p)
 
                        let acc := mulmod(ep_x_double_identity, mload(POW_PARTIAL_EVALUATION_LOC), p)
                        acc := mulmod(mulmod(acc, mload(QELLIPTIC_EVAL_LOC), p), mload(EC_Q_IS_DOUBLE), p)
                        acc := addmod(acc, mload(SUBRELATION_EVAL_12_LOC), p)
 
                        // Add to existing contribution
                        mstore(SUBRELATION_EVAL_12_LOC, acc)
                    }
 
                    {
                        let x1_sqr_mul_3 :=
                            mulmod(addmod(addmod(mload(EC_X_1), mload(EC_X_1), p), mload(EC_X_1), p), mload(EC_X_1), p)
                        let y_double_identity :=
                            mulmod(x1_sqr_mul_3, addmod(mload(EC_X_1), sub(p, mload(EC_X_3)), p), p)
                        y_double_identity := addmod(
                            y_double_identity,
                            sub(
                                p,
                                mulmod(
                                    addmod(mload(EC_Y_1), mload(EC_Y_1), p),
                                    addmod(mload(EC_Y_1), mload(EC_Y_3), p),
                                    p
                                )
                            ),
                            p
                        )
 
                        let acc := mulmod(y_double_identity, mload(POW_PARTIAL_EVALUATION_LOC), p)
                        acc := mulmod(mulmod(acc, mload(QELLIPTIC_EVAL_LOC), p), mload(EC_Q_IS_DOUBLE), p)
                        acc := addmod(acc, mload(SUBRELATION_EVAL_13_LOC), p)
 
                        // Add to existing contribution
                        mstore(SUBRELATION_EVAL_13_LOC, acc)
                    }
                }
 
                /*´:°•.°+.*•´.*:˚.°*.˚•´.°:°•.°•.*•´.*:˚.°*.˚•´.°:°•.°+.*•´.*:*/
                /*                    MEMORY RELATION                         */
                /*.•°:°.´+˚.*°.˚:*.´•*.+°.•°:´*.´•*.•°.•°:°.´:•˚°.*°.˚:*.´+°.•*/
                {
                    {
                        let memory_record_check := mulmod(mload(W3_EVAL_LOC), mload(ETA_THREE_CHALLENGE), p)
                        memory_record_check := addmod(
                            memory_record_check,
                            mulmod(mload(W2_EVAL_LOC), mload(ETA_TWO_CHALLENGE), p),
                            p
                        )
                        memory_record_check := addmod(
                            memory_record_check,
                            mulmod(mload(W1_EVAL_LOC), mload(ETA_CHALLENGE), p),
                            p
                        )
                        memory_record_check := addmod(memory_record_check, mload(QC_EVAL_LOC), p)
 
                        let partial_record_check := memory_record_check
                        memory_record_check := addmod(memory_record_check, sub(p, mload(W4_EVAL_LOC)), p)
 
                        mstore(AUX_MEMORY_CHECK_IDENTITY, memory_record_check)
 
                        // index_delta = w_1_omega - w_1
                        let index_delta := addmod(mload(W1_SHIFT_EVAL_LOC), sub(p, mload(W1_EVAL_LOC)), p)
 
                        // record_delta = w_4_omega - w_4
                        let record_delta := addmod(mload(W4_SHIFT_EVAL_LOC), sub(p, mload(W4_EVAL_LOC)), p)
 
                        // index_is_monotonically_increasing = index_delta * (index_delta - 1)
                        let index_is_monotonically_increasing := mulmod(index_delta, addmod(index_delta, P_SUB_1, p), p)
 
                        // adjacent_values_match_if_adjacent_indices_match = record_delta * (1 - index_delta)
                        let adjacent_values_match_if_adjacent_indices_match :=
                            mulmod(record_delta, addmod(1, sub(p, index_delta), p), p)
 
                        mstore(
                            SUBRELATION_EVAL_15_LOC,
                            mulmod(
                                adjacent_values_match_if_adjacent_indices_match,
                                mulmod(
                                    mload(QL_EVAL_LOC),
                                    mulmod(
                                        mload(QR_EVAL_LOC),
                                        mulmod(mload(QMEMORY_EVAL_LOC), mload(POW_PARTIAL_EVALUATION_LOC), p),
                                        p
                                    ),
                                    p
                                ),
                                p
                            )
                        )
 
                        // ROM_CONSISTENCY_CHECK_2
                        mstore(
                            SUBRELATION_EVAL_16_LOC,
                            mulmod(
                                index_is_monotonically_increasing,
                                mulmod(
                                    mload(QL_EVAL_LOC),
                                    mulmod(
                                        mload(QR_EVAL_LOC),
                                        mulmod(mload(QMEMORY_EVAL_LOC), mload(POW_PARTIAL_EVALUATION_LOC), p),
                                        p
                                    ),
                                    p
                                ),
                                p
                            )
                        )
 
                        mstore(
                            AUX_ROM_CONSISTENCY_CHECK_IDENTITY,
                            mulmod(memory_record_check, mulmod(mload(QL_EVAL_LOC), mload(QR_EVAL_LOC), p), p)
                        )
 
                        {
                            let next_gate_access_type := mulmod(mload(W3_SHIFT_EVAL_LOC), mload(ETA_THREE_CHALLENGE), p)
                            next_gate_access_type := addmod(
                                next_gate_access_type,
                                mulmod(mload(W2_SHIFT_EVAL_LOC), mload(ETA_TWO_CHALLENGE), p),
                                p
                            )
                            next_gate_access_type := addmod(
                                next_gate_access_type,
                                mulmod(mload(W1_SHIFT_EVAL_LOC), mload(ETA_CHALLENGE), p),
                                p
                            )
                            next_gate_access_type := addmod(mload(W4_SHIFT_EVAL_LOC), sub(p, next_gate_access_type), p)
 
                            // value_delta = w_3_omega - w_3
                            let value_delta := addmod(mload(W3_SHIFT_EVAL_LOC), sub(p, mload(W3_EVAL_LOC)), p)
                            //  adjacent_values_match_if_adjacent_indices_match_and_next_access_is_a_read_operation = (1 - index_delta) * value_delta * (1 - next_gate_access_type);
 
                            let adjacent_values_match_if_adjacent_indices_match_and_next_access_is_a_read_operation :=
                                mulmod(
                                    addmod(1, sub(p, index_delta), p),
                                    mulmod(value_delta, addmod(1, sub(p, next_gate_access_type), p), p),
                                    p
                                )
 
                            // We can't apply the RAM consistency check identity on the final entry in the sorted list (the wires in the
                            // next gate would make the identity fail).  We need to validate that its 'access type' bool is correct. Can't
                            // do  with an arithmetic gate because of the  `eta` factors. We need to check that the *next* gate's access
                            // type is  correct, to cover this edge case
                            // deg 2 or 4
                            let access_type := addmod(mload(W4_EVAL_LOC), sub(p, partial_record_check), p)
                            let access_check := mulmod(access_type, addmod(access_type, P_SUB_1, p), p)
                            let next_gate_access_type_is_boolean :=
                                mulmod(next_gate_access_type, addmod(next_gate_access_type, P_SUB_1, p), p)
 
                            // scaled_activation_selector = q_arith * q_aux * alpha
                            let scaled_activation_selector :=
                                mulmod(
                                    mload(QO_EVAL_LOC),
                                    mulmod(mload(QMEMORY_EVAL_LOC), mload(POW_PARTIAL_EVALUATION_LOC), p),
                                    p
                                )
 
                            mstore(
                                SUBRELATION_EVAL_17_LOC,
                                mulmod(
                                    adjacent_values_match_if_adjacent_indices_match_and_next_access_is_a_read_operation,
                                    scaled_activation_selector,
                                    p
                                )
                            )
 
                            mstore(
                                SUBRELATION_EVAL_18_LOC,
                                mulmod(index_is_monotonically_increasing, scaled_activation_selector, p)
                            )
 
                            mstore(
                                SUBRELATION_EVAL_19_LOC,
                                mulmod(next_gate_access_type_is_boolean, scaled_activation_selector, p)
                            )
 
                            mstore(AUX_RAM_CONSISTENCY_CHECK_IDENTITY, mulmod(access_check, mload(QO_EVAL_LOC), p))
                        }
 
                        {
                            // timestamp_delta = w_2_omega - w_2
                            let timestamp_delta := addmod(mload(W2_SHIFT_EVAL_LOC), sub(p, mload(W2_EVAL_LOC)), p)
 
                            // RAM_timestamp_check_identity = (1 - index_delta) * timestamp_delta - w_3
                            let RAM_TIMESTAMP_CHECK_IDENTITY :=
                                addmod(
                                    mulmod(timestamp_delta, addmod(1, sub(p, index_delta), p), p),
                                    sub(p, mload(W3_EVAL_LOC)),
                                    p
                                )
 
                            let memory_identity := mload(AUX_ROM_CONSISTENCY_CHECK_IDENTITY)
                            memory_identity := addmod(
                                memory_identity,
                                mulmod(
                                    RAM_TIMESTAMP_CHECK_IDENTITY,
                                    mulmod(mload(Q4_EVAL_LOC), mload(QL_EVAL_LOC), p),
                                    p
                                ),
                                p
                            )
 
                            memory_identity := addmod(
                                memory_identity,
                                mulmod(
                                    mload(AUX_MEMORY_CHECK_IDENTITY),
                                    mulmod(mload(QM_EVAL_LOC), mload(QL_EVAL_LOC), p),
                                    p
                                ),
                                p
                            )
                            memory_identity := addmod(memory_identity, mload(AUX_RAM_CONSISTENCY_CHECK_IDENTITY), p)
 
                            memory_identity := mulmod(
                                memory_identity,
                                mulmod(mload(QMEMORY_EVAL_LOC), mload(POW_PARTIAL_EVALUATION_LOC), p),
                                p
                            )
                            mstore(SUBRELATION_EVAL_14_LOC, memory_identity)
                        }
                    }
                }
 
                /*´:°•.°+.*•´.*:˚.°*.˚•´.°:°•.°•.*•´.*:˚.°*.˚•´.°:°•.°+.*•´.*:*/
                /*                    ROM LOGUP RELATION                      */
                /*.•°:°.´+˚.*°.˚:*.´•*.+°.•°:´*.´•*.•°.•°:°.´:•˚°.*°.˚:*.´+°.•*/
                {
                    // Single-value ROM tables. Wire layout: (w_1, w_2, w_3, w_4) = (index, value, multiplicity,
                    // inverse), q_c = array id. q_logup_table = q_2 * (1 - q_1), q_logup_read = q_4 * (1 - q_1).
                    let one_minus_q1 := addmod(1, sub(p, mload(QL_EVAL_LOC)), p)
                    let q_logup_table := mulmod(mload(QR_EVAL_LOC), one_minus_q1, p)
                    let q_logup_read := mulmod(mload(Q4_EVAL_LOC), one_minus_q1, p)
 
                    // denom = rom_logup_gamma + w_1 + eta * w_2 + eta_two * q_c
                    let denom := mload(ROM_LOGUP_GAMMA_CHALLENGE)
                    denom := addmod(denom, mload(W1_EVAL_LOC), p)
                    denom := addmod(denom, mulmod(mload(ETA_CHALLENGE), mload(W2_EVAL_LOC), p), p)
                    denom := addmod(denom, mulmod(mload(ETA_TWO_CHALLENGE), mload(QC_EVAL_LOC), p), p)
 
                    // Inverse correctness: q_logup_any * (w_4 * denom - 1) * q_memory
                    let inverse_correctness := addmod(mulmod(mload(W4_EVAL_LOC), denom, p), sub(p, 1), p)
                    inverse_correctness := mulmod(addmod(q_logup_table, q_logup_read, p), inverse_correctness, p)
                    inverse_correctness :=
                        mulmod(
                            inverse_correctness,
                            mulmod(mload(QMEMORY_EVAL_LOC), mload(POW_PARTIAL_EVALUATION_LOC), p),
                            p
                        )
                    mstore(SUBRELATION_EVAL_20_LOC, inverse_correctness)
 
                    // LogUp sum identity. Linearly dependent, so not scaled by the pow evaluation.
                    let logup_sum := addmod(q_logup_read, sub(p, mulmod(q_logup_table, mload(W3_EVAL_LOC), p)), p)
                    logup_sum := mulmod(logup_sum, mload(W4_EVAL_LOC), p)
                    logup_sum := mulmod(logup_sum, mload(QMEMORY_EVAL_LOC), p)
                    mstore(SUBRELATION_EVAL_21_LOC, logup_sum)
                }
 
                /*´:°•.°+.*•´.*:˚.°*.˚•´.°:°•.°•.*•´.*:˚.°*.˚•´.°:°•.°+.*•´.*:*/
                /*               NON NATIVE FIELD RELATION                    */
                /*.•°:°.´+˚.*°.˚:*.´•*.+°.•°:´*.´•*.•°.•°:°.´:•˚°.*°.˚:*.´+°.•*/
                {
                    let limb_subproduct :=
                        addmod(
                            mulmod(mload(W1_EVAL_LOC), mload(W2_SHIFT_EVAL_LOC), p),
                            mulmod(mload(W1_SHIFT_EVAL_LOC), mload(W2_EVAL_LOC), p),
                            p
                        )
 
                    let non_native_field_gate_2 :=
                        addmod(
                            addmod(
                                mulmod(mload(W1_EVAL_LOC), mload(W4_EVAL_LOC), p),
                                mulmod(mload(W2_EVAL_LOC), mload(W3_EVAL_LOC), p),
                                p
                            ),
                            sub(p, mload(W3_SHIFT_EVAL_LOC)),
                            p
                        )
                    non_native_field_gate_2 := mulmod(non_native_field_gate_2, LIMB_SIZE, p)
                    non_native_field_gate_2 := addmod(non_native_field_gate_2, sub(p, mload(W4_SHIFT_EVAL_LOC)), p)
                    non_native_field_gate_2 := addmod(non_native_field_gate_2, limb_subproduct, p)
                    non_native_field_gate_2 := mulmod(non_native_field_gate_2, mload(Q4_EVAL_LOC), p)
 
                    limb_subproduct := mulmod(limb_subproduct, LIMB_SIZE, p)
                    limb_subproduct := addmod(
                        limb_subproduct,
                        mulmod(mload(W1_SHIFT_EVAL_LOC), mload(W2_SHIFT_EVAL_LOC), p),
                        p
                    )
 
                    let non_native_field_gate_1 :=
                        mulmod(
                            addmod(limb_subproduct, sub(p, addmod(mload(W3_EVAL_LOC), mload(W4_EVAL_LOC), p)), p),
                            mload(QO_EVAL_LOC),
                            p
                        )
 
                    let non_native_field_gate_3 :=
                        mulmod(
                            addmod(
                                addmod(limb_subproduct, mload(W4_EVAL_LOC), p),
                                sub(p, addmod(mload(W3_SHIFT_EVAL_LOC), mload(W4_SHIFT_EVAL_LOC), p)),
                                p
                            ),
                            mload(QM_EVAL_LOC),
                            p
                        )
                    let non_native_field_identity :=
                        mulmod(
                            addmod(
                                addmod(non_native_field_gate_1, non_native_field_gate_2, p),
                                non_native_field_gate_3,
                                p
                            ),
                            mload(QR_EVAL_LOC),
                            p
                        )
 
                    mstore(AUX_NON_NATIVE_FIELD_IDENTITY, non_native_field_identity)
                }
 
                {
                    let limb_accumulator_1 := mulmod(mload(W2_SHIFT_EVAL_LOC), SUBLIMB_SHIFT, p)
                    limb_accumulator_1 := addmod(limb_accumulator_1, mload(W1_SHIFT_EVAL_LOC), p)
                    limb_accumulator_1 := mulmod(limb_accumulator_1, SUBLIMB_SHIFT, p)
                    limb_accumulator_1 := addmod(limb_accumulator_1, mload(W3_EVAL_LOC), p)
                    limb_accumulator_1 := mulmod(limb_accumulator_1, SUBLIMB_SHIFT, p)
                    limb_accumulator_1 := addmod(limb_accumulator_1, mload(W2_EVAL_LOC), p)
                    limb_accumulator_1 := mulmod(limb_accumulator_1, SUBLIMB_SHIFT, p)
                    limb_accumulator_1 := addmod(limb_accumulator_1, mload(W1_EVAL_LOC), p)
                    limb_accumulator_1 := addmod(limb_accumulator_1, sub(p, mload(W4_EVAL_LOC)), p)
                    limb_accumulator_1 := mulmod(limb_accumulator_1, mload(Q4_EVAL_LOC), p)
 
                    let limb_accumulator_2 := mulmod(mload(W3_SHIFT_EVAL_LOC), SUBLIMB_SHIFT, p)
                    limb_accumulator_2 := addmod(limb_accumulator_2, mload(W2_SHIFT_EVAL_LOC), p)
                    limb_accumulator_2 := mulmod(limb_accumulator_2, SUBLIMB_SHIFT, p)
                    limb_accumulator_2 := addmod(limb_accumulator_2, mload(W1_SHIFT_EVAL_LOC), p)
                    limb_accumulator_2 := mulmod(limb_accumulator_2, SUBLIMB_SHIFT, p)
                    limb_accumulator_2 := addmod(limb_accumulator_2, mload(W4_EVAL_LOC), p)
                    limb_accumulator_2 := mulmod(limb_accumulator_2, SUBLIMB_SHIFT, p)
                    limb_accumulator_2 := addmod(limb_accumulator_2, mload(W3_EVAL_LOC), p)
                    limb_accumulator_2 := addmod(limb_accumulator_2, sub(p, mload(W4_SHIFT_EVAL_LOC)), p)
                    limb_accumulator_2 := mulmod(limb_accumulator_2, mload(QM_EVAL_LOC), p)
 
                    let limb_accumulator_identity := addmod(limb_accumulator_1, limb_accumulator_2, p)
                    limb_accumulator_identity := mulmod(limb_accumulator_identity, mload(QO_EVAL_LOC), p)
 
                    let nnf_identity := addmod(mload(AUX_NON_NATIVE_FIELD_IDENTITY), limb_accumulator_identity, p)
                    nnf_identity := mulmod(
                        nnf_identity,
                        mulmod(mload(QNNF_EVAL_LOC), mload(POW_PARTIAL_EVALUATION_LOC), p),
                        p
                    )
 
                    mstore(SUBRELATION_EVAL_22_LOC, nnf_identity)
                }
 
                /*
                * Poseidon External Relation
                */
                {
                    let s1 := addmod(mload(W1_EVAL_LOC), mload(QL_EVAL_LOC), p)
                    let s2 := addmod(mload(W2_EVAL_LOC), mload(QR_EVAL_LOC), p)
                    let s3 := addmod(mload(W3_EVAL_LOC), mload(QO_EVAL_LOC), p)
                    let s4 := addmod(mload(W4_EVAL_LOC), mload(Q4_EVAL_LOC), p)
 
                    // u1 := s1 * s1 * s1 * s1 * s1;
                    let t0 := mulmod(s1, s1, p)
                    let u1 := mulmod(t0, mulmod(t0, s1, p), p)
 
                    // u2 := s2 * s2 * s2 * s2 * s2;
                    t0 := mulmod(s2, s2, p)
                    let u2 := mulmod(t0, mulmod(t0, s2, p), p)
 
                    // u3 := s3 * s3 * s3 * s3 * s3;
                    t0 := mulmod(s3, s3, p)
                    let u3 := mulmod(t0, mulmod(t0, s3, p), p)
 
                    // u4 := s4 * s4 * s4 * s4 * s4;
                    t0 := mulmod(s4, s4, p)
                    let u4 := mulmod(t0, mulmod(t0, s4, p), p)
 
                    // matrix mul v = M_E * u with 14 additions
                    t0 := addmod(u1, u2, p)
                    let t1 := addmod(u3, u4, p)
 
                    let t2 := addmod(u2, u2, p)
                    t2 := addmod(t2, t1, p)
 
                    let t3 := addmod(u4, u4, p)
                    t3 := addmod(t3, t0, p)
 
                    let v4 := addmod(t1, t1, p)
                    v4 := addmod(v4, v4, p)
                    v4 := addmod(v4, t3, p)
 
                    let v2 := addmod(t0, t0, p)
                    v2 := addmod(v2, v2, p)
                    v2 := addmod(v2, t2, p)
 
                    let v1 := addmod(t3, v2, p)
                    let v3 := addmod(t2, v4, p)
 
                    let q_pos_by_scaling :=
                        mulmod(mload(QPOSEIDON2_EXTERNAL_EVAL_LOC), mload(POW_PARTIAL_EVALUATION_LOC), p)
 
                    mstore(
                        SUBRELATION_EVAL_23_LOC,
                        mulmod(q_pos_by_scaling, addmod(v1, sub(p, mload(W1_SHIFT_EVAL_LOC)), p), p)
                    )
 
                    mstore(
                        SUBRELATION_EVAL_24_LOC,
                        mulmod(q_pos_by_scaling, addmod(v2, sub(p, mload(W2_SHIFT_EVAL_LOC)), p), p)
                    )
 
                    mstore(
                        SUBRELATION_EVAL_25_LOC,
                        mulmod(q_pos_by_scaling, addmod(v3, sub(p, mload(W3_SHIFT_EVAL_LOC)), p), p)
                    )
 
                    mstore(
                        SUBRELATION_EVAL_26_LOC,
                        mulmod(q_pos_by_scaling, addmod(v4, sub(p, mload(W4_SHIFT_EVAL_LOC)), p), p)
                    )
                }
 
                /*
                * Poseidon Internal Relation
                */
                {
                    let s1 := addmod(mload(W1_EVAL_LOC), mload(QL_EVAL_LOC), p)
 
                    // apply s-box round
                    let t0 := mulmod(s1, s1, p)
                    let u1 := mulmod(t0, mulmod(t0, s1, p), p)
                    let u2 := mload(W2_EVAL_LOC)
                    let u3 := mload(W3_EVAL_LOC)
                    let u4 := mload(W4_EVAL_LOC)
 
                    // matrix mul v = M_I * u 4 muls and 7 additions
                    let u_sum := addmod(u1, u2, p)
                    u_sum := addmod(u_sum, addmod(u3, u4, p), p)
 
                    let q_pos_by_scaling :=
                        mulmod(mload(QPOSEIDON2_INTERNAL_EVAL_LOC), mload(POW_PARTIAL_EVALUATION_LOC), p)
 
                    let v1 := addmod(mulmod(u1, POS_INTERNAL_MATRIX_D_0, p), u_sum, p)
 
                    mstore(
                        SUBRELATION_EVAL_27_LOC,
                        mulmod(q_pos_by_scaling, addmod(v1, sub(p, mload(W1_SHIFT_EVAL_LOC)), p), p)
                    )
                    let v2 := addmod(mulmod(u2, POS_INTERNAL_MATRIX_D_1, p), u_sum, p)
 
                    mstore(
                        SUBRELATION_EVAL_28_LOC,
                        mulmod(q_pos_by_scaling, addmod(v2, sub(p, mload(W2_SHIFT_EVAL_LOC)), p), p)
                    )
                    let v3 := addmod(mulmod(u3, POS_INTERNAL_MATRIX_D_2, p), u_sum, p)
 
                    mstore(
                        SUBRELATION_EVAL_29_LOC,
                        mulmod(q_pos_by_scaling, addmod(v3, sub(p, mload(W3_SHIFT_EVAL_LOC)), p), p)
                    )
 
                    let v4 := addmod(mulmod(u4, POS_INTERNAL_MATRIX_D_3, p), u_sum, p)
                    mstore(
                        SUBRELATION_EVAL_30_LOC,
                        mulmod(q_pos_by_scaling, addmod(v4, sub(p, mload(W4_SHIFT_EVAL_LOC)), p), p)
                    )
                }
 
                // Scale and batch subrelations by subrelation challenges
                // linear combination of subrelations
                let accumulator := mload(SUBRELATION_EVAL_0_LOC)
 
                // Below is an unrolled variant of the following loop
                // for (uint256 i = 1; i < NUMBER_OF_SUBRELATIONS; ++i) {
                //     accumulator = accumulator + evaluations[i] * subrelationChallenges[i - 1];
                // }
 
                accumulator := addmod(
                    accumulator,
                    mulmod(mload(SUBRELATION_EVAL_1_LOC), mload(ALPHA_CHALLENGE_0), p),
                    p
                )
                accumulator := addmod(
                    accumulator,
                    mulmod(mload(SUBRELATION_EVAL_2_LOC), mload(ALPHA_CHALLENGE_1), p),
                    p
                )
                accumulator := addmod(
                    accumulator,
                    mulmod(mload(SUBRELATION_EVAL_3_LOC), mload(ALPHA_CHALLENGE_2), p),
                    p
                )
                accumulator := addmod(
                    accumulator,
                    mulmod(mload(SUBRELATION_EVAL_4_LOC), mload(ALPHA_CHALLENGE_3), p),
                    p
                )
                accumulator := addmod(
                    accumulator,
                    mulmod(mload(SUBRELATION_EVAL_5_LOC), mload(ALPHA_CHALLENGE_4), p),
                    p
                )
                accumulator := addmod(
                    accumulator,
                    mulmod(mload(SUBRELATION_EVAL_6_LOC), mload(ALPHA_CHALLENGE_5), p),
                    p
                )
                accumulator := addmod(
                    accumulator,
                    mulmod(mload(SUBRELATION_EVAL_7_LOC), mload(ALPHA_CHALLENGE_6), p),
                    p
                )
                accumulator := addmod(
                    accumulator,
                    mulmod(mload(SUBRELATION_EVAL_8_LOC), mload(ALPHA_CHALLENGE_7), p),
                    p
                )
                accumulator := addmod(
                    accumulator,
                    mulmod(mload(SUBRELATION_EVAL_9_LOC), mload(ALPHA_CHALLENGE_8), p),
                    p
                )
                accumulator := addmod(
                    accumulator,
                    mulmod(mload(SUBRELATION_EVAL_10_LOC), mload(ALPHA_CHALLENGE_9), p),
                    p
                )
                accumulator := addmod(
                    accumulator,
                    mulmod(mload(SUBRELATION_EVAL_11_LOC), mload(ALPHA_CHALLENGE_10), p),
                    p
                )
                accumulator := addmod(
                    accumulator,
                    mulmod(mload(SUBRELATION_EVAL_12_LOC), mload(ALPHA_CHALLENGE_11), p),
                    p
                )
                accumulator := addmod(
                    accumulator,
                    mulmod(mload(SUBRELATION_EVAL_13_LOC), mload(ALPHA_CHALLENGE_12), p),
                    p
                )
                accumulator := addmod(
                    accumulator,
                    mulmod(mload(SUBRELATION_EVAL_14_LOC), mload(ALPHA_CHALLENGE_13), p),
                    p
                )
                accumulator := addmod(
                    accumulator,
                    mulmod(mload(SUBRELATION_EVAL_15_LOC), mload(ALPHA_CHALLENGE_14), p),
                    p
                )
                accumulator := addmod(
                    accumulator,
                    mulmod(mload(SUBRELATION_EVAL_16_LOC), mload(ALPHA_CHALLENGE_15), p),
                    p
                )
                accumulator := addmod(
                    accumulator,
                    mulmod(mload(SUBRELATION_EVAL_17_LOC), mload(ALPHA_CHALLENGE_16), p),
                    p
                )
                accumulator := addmod(
                    accumulator,
                    mulmod(mload(SUBRELATION_EVAL_18_LOC), mload(ALPHA_CHALLENGE_17), p),
                    p
                )
                accumulator := addmod(
                    accumulator,
                    mulmod(mload(SUBRELATION_EVAL_19_LOC), mload(ALPHA_CHALLENGE_18), p),
                    p
                )
                accumulator := addmod(
                    accumulator,
                    mulmod(mload(SUBRELATION_EVAL_20_LOC), mload(ALPHA_CHALLENGE_19), p),
                    p
                )
                accumulator := addmod(
                    accumulator,
                    mulmod(mload(SUBRELATION_EVAL_21_LOC), mload(ALPHA_CHALLENGE_20), p),
                    p
                )
                accumulator := addmod(
                    accumulator,
                    mulmod(mload(SUBRELATION_EVAL_22_LOC), mload(ALPHA_CHALLENGE_21), p),
                    p
                )
                accumulator := addmod(
                    accumulator,
                    mulmod(mload(SUBRELATION_EVAL_23_LOC), mload(ALPHA_CHALLENGE_22), p),
                    p
                )
                accumulator := addmod(
                    accumulator,
                    mulmod(mload(SUBRELATION_EVAL_24_LOC), mload(ALPHA_CHALLENGE_23), p),
                    p
                )
                accumulator := addmod(
                    accumulator,
                    mulmod(mload(SUBRELATION_EVAL_25_LOC), mload(ALPHA_CHALLENGE_24), p),
                    p
                )
                accumulator := addmod(
                    accumulator,
                    mulmod(mload(SUBRELATION_EVAL_26_LOC), mload(ALPHA_CHALLENGE_25), p),
                    p
                )
                accumulator := addmod(
                    accumulator,
                    mulmod(mload(SUBRELATION_EVAL_27_LOC), mload(ALPHA_CHALLENGE_26), p),
                    p
                )
                accumulator := addmod(
                    accumulator,
                    mulmod(mload(SUBRELATION_EVAL_28_LOC), mload(ALPHA_CHALLENGE_27), p),
                    p
                )
                accumulator := addmod(
                    accumulator,
                    mulmod(mload(SUBRELATION_EVAL_29_LOC), mload(ALPHA_CHALLENGE_28), p),
                    p
                )
                accumulator := addmod(
                    accumulator,
                    mulmod(mload(SUBRELATION_EVAL_30_LOC), mload(ALPHA_CHALLENGE_29), p),
                    p
                )
 
                // ZK final check: grandHonkRelationSum * (1 - evaluation) + libraEvaluation * libraChallenge == roundTargetSum
                // where evaluation = product(u[2] * u[3] * ... * u[LOG_N - 1])
                {
                    // Row-disabling polynomial: 1 - ∏_{i≥2}(1 - u_i)
                    let evaluation := 1
                    let u_off := SUM_U_CHALLENGE_2
                    for { let i := 2 } lt(i, LOG_N) { i := add(i, 1) } {
                        // evaluation = evaluation * (1 - sumCheckUChallenges[i])
                        let one_minus_u := addmod(1, sub(p, mload(u_off)), p)
                        evaluation := mulmod(evaluation, one_minus_u, p)
                        u_off := add(u_off, 0x20)
                    }
 
                    // adjustedSum = accumulator * (1 - evaluation) + libraEvaluation * libraChallenge
                    let one_minus_eval := addmod(1, sub(p, evaluation), p)
                    let adjusted_sum := addmod(
                        mulmod(accumulator, one_minus_eval, p),
                        mulmod(mload(LIBRA_EVALUATION_LOC), mload(LIBRA_CHALLENGE), p),
                        p
                    )
 
                    let sumcheck_valid := eq(adjusted_sum, mload(FINAL_ROUND_TARGET_LOC))
 
                    if iszero(sumcheck_valid) {
                        mstore(0x00, SUMCHECK_FAILED_SELECTOR)
                        revert(0x00, 0x04)
                    }
                }
            }
 
            /*´:°•.°+.*•´.*:˚.°*.˚•´.°:°•.°•.*•´.*:˚.°*.˚•´.°:°•.°+.*•´.*:*/
            /*                 SUMCHECK -- Complete                       */
            /*.•°:°.´+˚.*°.˚:*.´•*.+°.•°:´*.´•*.•°.•°:°.´:•˚°.*°.˚:*.´+°.•*/
 
            /*´:°•.°+.*•´.*:˚.°*.˚•´.°:°•.°•.*•´.*:˚.°*.˚•´.°:°•.°+.*•´.*:*/
            /*                       SHPLEMINI                            */
            /*.•°:°.´+˚.*°.˚:*.´•*.+°.•°:´*.´•*.•°.•°:°.´:•˚°.*°.˚:*.´+°.•*/
 
            // ============= SHPLEMINI INVERSES ==============
            // Inverses are already at their designated addresses from batch inversion.
            let unshifted_scalar := 0
            let shifted_scalar := 0
            {
                let gemini_r_inv := mload(GEMINI_R_INV_LOC)
 
                // Compute unshifted_scalar and shifted_scalar using the copied inverses
                let pos_inverted_denominator := mload(POS_INVERTED_DENOM_0_LOC)
                let neg_inverted_denominator := mload(NEG_INVERTED_DENOM_0_LOC)
                let shplonk_nu := mload(SHPLONK_NU_CHALLENGE)
 
                unshifted_scalar := addmod(pos_inverted_denominator, mulmod(shplonk_nu, neg_inverted_denominator, p), p)
 
                shifted_scalar := mulmod(
                    gemini_r_inv, // (1 / gemini_r_challenge)
                    // (inverse_vanishing_evals[0]) - (shplonk_nu * inverse_vanishing_evals[1])
                    addmod(
                        pos_inverted_denominator,
                        // - (shplonk_nu * inverse_vanishing_evals[1])
                        sub(p, mulmod(shplonk_nu, neg_inverted_denominator, p)),
                        p
                    ),
                    p
                )
            }
 
            // Commitment Accumulation (MSM via sequential ecAdd/ecMul):
            // For each commitment C_i with batch scalar s_i, we compute:
            //   accumulator += s_i * C_i
            // The commitments include: shplonk_Q, gemini_masking (ZK), VK points,
            // wire commitments, lookup commitments, Z_PERM, libra (ZK),
            // gemini fold univariates. The KZG quotient is handled separately.
            // The final accumulator is the LHS of the pairing equation.
 
            // Accumulators
            let batching_challenge := 1
            let batched_evaluation := 0
 
            let neg_unshifted_scalar := sub(p, unshifted_scalar)
            let neg_shifted_scalar := sub(p, shifted_scalar)
 
            let rho := mload(RHO_CHALLENGE)
 
            // Unrolled for the loop below - where NUMBER_UNSHIFTED = 37 (ZK: includes gemini_masking_poly)
            // For ZK: evaluations array is [gemini_masking_poly, qm, qc, ql, qr, ...]
            // for (uint256 i = 1; i <= NUMBER_UNSHIFTED; ++i) {
            //     scalars[i] = mem.unshiftedScalar.neg() * mem.batchingChallenge;
            //     mem.batchedEvaluation = mem.batchedEvaluation + (proof.sumcheckEvaluations[i - NUM_MASKING_POLYNOMIALS] * mem.batchingChallenge);
            //     mem.batchingChallenge = mem.batchingChallenge * tp.rho;
            // }
 
            // Calculate the scalars and batching challenge for the unshifted entities.
            // Iteration order matches UltraFlavor_Generated::EntityId. Scalar slot N+1 pairs with vk[N].
            // 0: GEMINI_MASKING_EVAL_LOC
            mstore(BATCH_SCALAR_1_LOC, mulmod(neg_unshifted_scalar, batching_challenge, p))
            batched_evaluation := addmod(batched_evaluation, mulmod(mload(GEMINI_MASKING_EVAL_LOC), batching_challenge, p), p)
            batching_challenge := mulmod(batching_challenge, rho, p)
 
            // 1: SIGMA1_EVAL_LOC
            mstore(BATCH_SCALAR_2_LOC, mulmod(neg_unshifted_scalar, batching_challenge, p))
            batched_evaluation := addmod(batched_evaluation, mulmod(mload(SIGMA1_EVAL_LOC), batching_challenge, p), p)
            batching_challenge := mulmod(batching_challenge, rho, p)
 
            // 2: SIGMA2_EVAL_LOC
            mstore(BATCH_SCALAR_3_LOC, mulmod(neg_unshifted_scalar, batching_challenge, p))
            batched_evaluation := addmod(batched_evaluation, mulmod(mload(SIGMA2_EVAL_LOC), batching_challenge, p), p)
            batching_challenge := mulmod(batching_challenge, rho, p)
 
            // 3: SIGMA3_EVAL_LOC
            mstore(BATCH_SCALAR_4_LOC, mulmod(neg_unshifted_scalar, batching_challenge, p))
            batched_evaluation := addmod(batched_evaluation, mulmod(mload(SIGMA3_EVAL_LOC), batching_challenge, p), p)
            batching_challenge := mulmod(batching_challenge, rho, p)
 
            // 4: SIGMA4_EVAL_LOC
            mstore(BATCH_SCALAR_5_LOC, mulmod(neg_unshifted_scalar, batching_challenge, p))
            batched_evaluation := addmod(batched_evaluation, mulmod(mload(SIGMA4_EVAL_LOC), batching_challenge, p), p)
            batching_challenge := mulmod(batching_challenge, rho, p)
 
            // 5: ID1_EVAL_LOC
            mstore(BATCH_SCALAR_6_LOC, mulmod(neg_unshifted_scalar, batching_challenge, p))
            batched_evaluation := addmod(batched_evaluation, mulmod(mload(ID1_EVAL_LOC), batching_challenge, p), p)
            batching_challenge := mulmod(batching_challenge, rho, p)
 
            // 6: ID2_EVAL_LOC
            mstore(BATCH_SCALAR_7_LOC, mulmod(neg_unshifted_scalar, batching_challenge, p))
            batched_evaluation := addmod(batched_evaluation, mulmod(mload(ID2_EVAL_LOC), batching_challenge, p), p)
            batching_challenge := mulmod(batching_challenge, rho, p)
 
            // 7: ID3_EVAL_LOC
            mstore(BATCH_SCALAR_8_LOC, mulmod(neg_unshifted_scalar, batching_challenge, p))
            batched_evaluation := addmod(batched_evaluation, mulmod(mload(ID3_EVAL_LOC), batching_challenge, p), p)
            batching_challenge := mulmod(batching_challenge, rho, p)
 
            // 8: ID4_EVAL_LOC
            mstore(BATCH_SCALAR_9_LOC, mulmod(neg_unshifted_scalar, batching_challenge, p))
            batched_evaluation := addmod(batched_evaluation, mulmod(mload(ID4_EVAL_LOC), batching_challenge, p), p)
            batching_challenge := mulmod(batching_challenge, rho, p)
 
            // 9: LAGRANGE_FIRST_EVAL_LOC
            mstore(BATCH_SCALAR_10_LOC, mulmod(neg_unshifted_scalar, batching_challenge, p))
            batched_evaluation := addmod(batched_evaluation, mulmod(mload(LAGRANGE_FIRST_EVAL_LOC), batching_challenge, p), p)
            batching_challenge := mulmod(batching_challenge, rho, p)
 
            // 10: LAGRANGE_LAST_EVAL_LOC
            mstore(BATCH_SCALAR_11_LOC, mulmod(neg_unshifted_scalar, batching_challenge, p))
            batched_evaluation := addmod(batched_evaluation, mulmod(mload(LAGRANGE_LAST_EVAL_LOC), batching_challenge, p), p)
            batching_challenge := mulmod(batching_challenge, rho, p)
 
            // 11: QLOOKUP_EVAL_LOC
            mstore(BATCH_SCALAR_12_LOC, mulmod(neg_unshifted_scalar, batching_challenge, p))
            batched_evaluation := addmod(batched_evaluation, mulmod(mload(QLOOKUP_EVAL_LOC), batching_challenge, p), p)
            batching_challenge := mulmod(batching_challenge, rho, p)
 
            // 12: TABLE1_EVAL_LOC
            mstore(BATCH_SCALAR_13_LOC, mulmod(neg_unshifted_scalar, batching_challenge, p))
            batched_evaluation := addmod(batched_evaluation, mulmod(mload(TABLE1_EVAL_LOC), batching_challenge, p), p)
            batching_challenge := mulmod(batching_challenge, rho, p)
 
            // 13: TABLE2_EVAL_LOC
            mstore(BATCH_SCALAR_14_LOC, mulmod(neg_unshifted_scalar, batching_challenge, p))
            batched_evaluation := addmod(batched_evaluation, mulmod(mload(TABLE2_EVAL_LOC), batching_challenge, p), p)
            batching_challenge := mulmod(batching_challenge, rho, p)
 
            // 14: TABLE3_EVAL_LOC
            mstore(BATCH_SCALAR_15_LOC, mulmod(neg_unshifted_scalar, batching_challenge, p))
            batched_evaluation := addmod(batched_evaluation, mulmod(mload(TABLE3_EVAL_LOC), batching_challenge, p), p)
            batching_challenge := mulmod(batching_challenge, rho, p)
 
            // 15: TABLE4_EVAL_LOC
            mstore(BATCH_SCALAR_16_LOC, mulmod(neg_unshifted_scalar, batching_challenge, p))
            batched_evaluation := addmod(batched_evaluation, mulmod(mload(TABLE4_EVAL_LOC), batching_challenge, p), p)
            batching_challenge := mulmod(batching_challenge, rho, p)
 
            // 16: QM_EVAL_LOC
            mstore(BATCH_SCALAR_17_LOC, mulmod(neg_unshifted_scalar, batching_challenge, p))
            batched_evaluation := addmod(batched_evaluation, mulmod(mload(QM_EVAL_LOC), batching_challenge, p), p)
            batching_challenge := mulmod(batching_challenge, rho, p)
 
            // 17: QR_EVAL_LOC
            mstore(BATCH_SCALAR_18_LOC, mulmod(neg_unshifted_scalar, batching_challenge, p))
            batched_evaluation := addmod(batched_evaluation, mulmod(mload(QR_EVAL_LOC), batching_challenge, p), p)
            batching_challenge := mulmod(batching_challenge, rho, p)
 
            // 18: QO_EVAL_LOC
            mstore(BATCH_SCALAR_19_LOC, mulmod(neg_unshifted_scalar, batching_challenge, p))
            batched_evaluation := addmod(batched_evaluation, mulmod(mload(QO_EVAL_LOC), batching_challenge, p), p)
            batching_challenge := mulmod(batching_challenge, rho, p)
 
            // 19: QC_EVAL_LOC
            mstore(BATCH_SCALAR_20_LOC, mulmod(neg_unshifted_scalar, batching_challenge, p))
            batched_evaluation := addmod(batched_evaluation, mulmod(mload(QC_EVAL_LOC), batching_challenge, p), p)
            batching_challenge := mulmod(batching_challenge, rho, p)
 
            // 20: QL_EVAL_LOC
            mstore(BATCH_SCALAR_21_LOC, mulmod(neg_unshifted_scalar, batching_challenge, p))
            batched_evaluation := addmod(batched_evaluation, mulmod(mload(QL_EVAL_LOC), batching_challenge, p), p)
            batching_challenge := mulmod(batching_challenge, rho, p)
 
            // 21: Q4_EVAL_LOC
            mstore(BATCH_SCALAR_22_LOC, mulmod(neg_unshifted_scalar, batching_challenge, p))
            batched_evaluation := addmod(batched_evaluation, mulmod(mload(Q4_EVAL_LOC), batching_challenge, p), p)
            batching_challenge := mulmod(batching_challenge, rho, p)
 
            // 22: QARITH_EVAL_LOC
            mstore(BATCH_SCALAR_23_LOC, mulmod(neg_unshifted_scalar, batching_challenge, p))
            batched_evaluation := addmod(batched_evaluation, mulmod(mload(QARITH_EVAL_LOC), batching_challenge, p), p)
            batching_challenge := mulmod(batching_challenge, rho, p)
 
            // 23: QRANGE_EVAL_LOC
            mstore(BATCH_SCALAR_24_LOC, mulmod(neg_unshifted_scalar, batching_challenge, p))
            batched_evaluation := addmod(batched_evaluation, mulmod(mload(QRANGE_EVAL_LOC), batching_challenge, p), p)
            batching_challenge := mulmod(batching_challenge, rho, p)
 
            // 24: QELLIPTIC_EVAL_LOC
            mstore(BATCH_SCALAR_25_LOC, mulmod(neg_unshifted_scalar, batching_challenge, p))
            batched_evaluation := addmod(batched_evaluation, mulmod(mload(QELLIPTIC_EVAL_LOC), batching_challenge, p), p)
            batching_challenge := mulmod(batching_challenge, rho, p)
 
            // 25: QMEMORY_EVAL_LOC
            mstore(BATCH_SCALAR_26_LOC, mulmod(neg_unshifted_scalar, batching_challenge, p))
            batched_evaluation := addmod(batched_evaluation, mulmod(mload(QMEMORY_EVAL_LOC), batching_challenge, p), p)
            batching_challenge := mulmod(batching_challenge, rho, p)
 
            // 26: QNNF_EVAL_LOC
            mstore(BATCH_SCALAR_27_LOC, mulmod(neg_unshifted_scalar, batching_challenge, p))
            batched_evaluation := addmod(batched_evaluation, mulmod(mload(QNNF_EVAL_LOC), batching_challenge, p), p)
            batching_challenge := mulmod(batching_challenge, rho, p)
 
            // 27: QPOSEIDON2_EXTERNAL_EVAL_LOC
            mstore(BATCH_SCALAR_28_LOC, mulmod(neg_unshifted_scalar, batching_challenge, p))
            batched_evaluation := addmod(batched_evaluation, mulmod(mload(QPOSEIDON2_EXTERNAL_EVAL_LOC), batching_challenge, p), p)
            batching_challenge := mulmod(batching_challenge, rho, p)
 
            // 28: QPOSEIDON2_INTERNAL_EVAL_LOC
            mstore(BATCH_SCALAR_29_LOC, mulmod(neg_unshifted_scalar, batching_challenge, p))
            batched_evaluation := addmod(batched_evaluation, mulmod(mload(QPOSEIDON2_INTERNAL_EVAL_LOC), batching_challenge, p), p)
            batching_challenge := mulmod(batching_challenge, rho, p)
 
            // 29: W1_EVAL_LOC
            mstore(BATCH_SCALAR_30_LOC, mulmod(neg_unshifted_scalar, batching_challenge, p))
            batched_evaluation := addmod(batched_evaluation, mulmod(mload(W1_EVAL_LOC), batching_challenge, p), p)
            batching_challenge := mulmod(batching_challenge, rho, p)
 
            // 30: W2_EVAL_LOC
            mstore(BATCH_SCALAR_31_LOC, mulmod(neg_unshifted_scalar, batching_challenge, p))
            batched_evaluation := addmod(batched_evaluation, mulmod(mload(W2_EVAL_LOC), batching_challenge, p), p)
            batching_challenge := mulmod(batching_challenge, rho, p)
 
            // 31: W3_EVAL_LOC
            mstore(BATCH_SCALAR_32_LOC, mulmod(neg_unshifted_scalar, batching_challenge, p))
            batched_evaluation := addmod(batched_evaluation, mulmod(mload(W3_EVAL_LOC), batching_challenge, p), p)
            batching_challenge := mulmod(batching_challenge, rho, p)
 
            // 32: W4_EVAL_LOC
            mstore(BATCH_SCALAR_33_LOC, mulmod(neg_unshifted_scalar, batching_challenge, p))
            batched_evaluation := addmod(batched_evaluation, mulmod(mload(W4_EVAL_LOC), batching_challenge, p), p)
            batching_challenge := mulmod(batching_challenge, rho, p)
 
            // 33: Z_PERM_EVAL_LOC
            mstore(BATCH_SCALAR_34_LOC, mulmod(neg_unshifted_scalar, batching_challenge, p))
            batched_evaluation := addmod(batched_evaluation, mulmod(mload(Z_PERM_EVAL_LOC), batching_challenge, p), p)
            batching_challenge := mulmod(batching_challenge, rho, p)
 
            // 34: LOOKUP_INVERSES_EVAL_LOC
            mstore(BATCH_SCALAR_35_LOC, mulmod(neg_unshifted_scalar, batching_challenge, p))
            batched_evaluation := addmod(batched_evaluation, mulmod(mload(LOOKUP_INVERSES_EVAL_LOC), batching_challenge, p), p)
            batching_challenge := mulmod(batching_challenge, rho, p)
 
            // 35: LOOKUP_READ_COUNTS_EVAL_LOC
            mstore(BATCH_SCALAR_36_LOC, mulmod(neg_unshifted_scalar, batching_challenge, p))
            batched_evaluation := addmod(batched_evaluation, mulmod(mload(LOOKUP_READ_COUNTS_EVAL_LOC), batching_challenge, p), p)
            batching_challenge := mulmod(batching_challenge, rho, p)
 
            // 36: LOOKUP_READ_TAGS_EVAL_LOC
            mstore(BATCH_SCALAR_37_LOC, mulmod(neg_unshifted_scalar, batching_challenge, p))
            batched_evaluation := addmod(batched_evaluation, mulmod(mload(LOOKUP_READ_TAGS_EVAL_LOC), batching_challenge, p), p)
            batching_challenge := mulmod(batching_challenge, rho, p)
 
            // Unrolled for NUMBER_OF_SHIFTED_ENTITIES = 5
            // for (uint256 i = NUMBER_UNSHIFTED + 1; i <= NUMBER_OF_ENTITIES; ++i) {
            //     scalars[i] = mem.shiftedScalar.neg() * mem.batchingChallenge;
            //     mem.batchedEvaluation = mem.batchedEvaluation + (proof.sumcheckEvaluations[i - 1] * mem.batchingChallenge);
            //     mem.batchingChallenge = mem.batchingChallenge * tp.rho;
            // }
 
            // Shifted entities: SHIFTED_COMMITMENTS_START = 30
            // scalars[scalarOff] += mem.shiftedScalar.neg() * mem.batchingChallenge
            // 30: W1 (shifted)
            mstore(
                BATCH_SCALAR_30_LOC,
                addmod(mload(BATCH_SCALAR_30_LOC), mulmod(neg_shifted_scalar, batching_challenge, p), p)
            )
            batched_evaluation := addmod(batched_evaluation, mulmod(mload(W1_SHIFT_EVAL_LOC), batching_challenge, p), p)
            batching_challenge := mulmod(batching_challenge, rho, p)
 
            // 31: W2 (shifted)
            mstore(
                BATCH_SCALAR_31_LOC,
                addmod(mload(BATCH_SCALAR_31_LOC), mulmod(neg_shifted_scalar, batching_challenge, p), p)
            )
            batched_evaluation := addmod(batched_evaluation, mulmod(mload(W2_SHIFT_EVAL_LOC), batching_challenge, p), p)
            batching_challenge := mulmod(batching_challenge, rho, p)
 
            // 32: W3 (shifted)
            mstore(
                BATCH_SCALAR_32_LOC,
                addmod(mload(BATCH_SCALAR_32_LOC), mulmod(neg_shifted_scalar, batching_challenge, p), p)
            )
            batched_evaluation := addmod(batched_evaluation, mulmod(mload(W3_SHIFT_EVAL_LOC), batching_challenge, p), p)
            batching_challenge := mulmod(batching_challenge, rho, p)
 
            // 33: W4 (shifted)
            mstore(
                BATCH_SCALAR_33_LOC,
                addmod(mload(BATCH_SCALAR_33_LOC), mulmod(neg_shifted_scalar, batching_challenge, p), p)
            )
            batched_evaluation := addmod(batched_evaluation, mulmod(mload(W4_SHIFT_EVAL_LOC), batching_challenge, p), p)
            batching_challenge := mulmod(batching_challenge, rho, p)
 
            // 34: Z_PERM (shifted)
            mstore(
                BATCH_SCALAR_34_LOC,
                addmod(mload(BATCH_SCALAR_34_LOC), mulmod(neg_shifted_scalar, batching_challenge, p), p)
            )
            batched_evaluation := addmod(
                batched_evaluation,
                mulmod(mload(Z_PERM_SHIFT_EVAL_LOC), batching_challenge, p),
                p
            )
            batching_challenge := mulmod(batching_challenge, rho, p)
 
            // Compute fold pos evaluations
            {
                mstore(CHALL_POW_LOC, POWERS_OF_EVALUATION_CHALLENGE_{{ LOG_N_MINUS_ONE }}_LOC)
                mstore(SUMCHECK_U_LOC, SUM_U_CHALLENGE_{{ LOG_N_MINUS_ONE }})
                mstore(GEMINI_A_LOC, GEMINI_A_EVAL_{{ LOG_N_MINUS_ONE }})
 
                // Inversion of this value was included in batch inversion above
                let inverted_chall_pow_minus_u_loc := INVERTED_CHALLENGE_POW_MINUS_U_{{ LOG_N_MINUS_ONE }}_LOC
                let fold_pos_off := FOLD_POS_EVALUATIONS_{{ LOG_N_MINUS_ONE }}_LOC
 
                let batchedEvalAcc := batched_evaluation
                for { let i := LOG_N } gt(i, 0) { i := sub(i, 1) } {
                    let chall_pow := mload(mload(CHALL_POW_LOC))
                    let sum_check_u := mload(mload(SUMCHECK_U_LOC))
 
                    // challengePower * batchedEvalAccumulator * 2
                    let batchedEvalRoundAcc := mulmod(chall_pow, mulmod(batchedEvalAcc, 2, p), p)
                    // (challengePower * (ONE - u) - u)
                    let chall_pow_times_1_minus_u := mulmod(chall_pow, addmod(1, sub(p, sum_check_u), p), p)
 
                    batchedEvalRoundAcc := addmod(
                        batchedEvalRoundAcc,
                        sub(
                            p,
                            mulmod(
                                mload(mload(GEMINI_A_LOC)),
                                addmod(chall_pow_times_1_minus_u, sub(p, sum_check_u), p),
                                p
                            )
                        ),
                        p
                    )
 
                    batchedEvalRoundAcc := mulmod(batchedEvalRoundAcc, mload(inverted_chall_pow_minus_u_loc), p)
 
                    batchedEvalAcc := batchedEvalRoundAcc
                    mstore(fold_pos_off, batchedEvalRoundAcc)
 
                    mstore(CHALL_POW_LOC, sub(mload(CHALL_POW_LOC), 0x20))
                    mstore(SUMCHECK_U_LOC, sub(mload(SUMCHECK_U_LOC), 0x20))
                    mstore(GEMINI_A_LOC, sub(mload(GEMINI_A_LOC), 0x20))
                    inverted_chall_pow_minus_u_loc := sub(inverted_chall_pow_minus_u_loc, 0x20)
                    fold_pos_off := sub(fold_pos_off, 0x20)
                }
            }
 
            let constant_term_acc := mulmod(mload(FOLD_POS_EVALUATIONS_0_LOC), mload(POS_INVERTED_DENOM_0_LOC), p)
            {
                let shplonk_nu := mload(SHPLONK_NU_CHALLENGE)
 
                constant_term_acc := addmod(
                    constant_term_acc,
                    mulmod(mload(GEMINI_A_EVAL_0), mulmod(shplonk_nu, mload(NEG_INVERTED_DENOM_0_LOC), p), p),
                    p
                )
 
                let shplonk_nu_sqr := mulmod(shplonk_nu, shplonk_nu, p)
                batching_challenge := shplonk_nu_sqr
 
                mstore(SS_POS_INV_DENOM_LOC, POS_INVERTED_DENOM_1_LOC)
                mstore(SS_NEG_INV_DENOM_LOC, NEG_INVERTED_DENOM_1_LOC)
 
                mstore(SS_GEMINI_EVALS_LOC, GEMINI_A_EVAL_1)
                let fold_pos_evals_loc := FOLD_POS_EVALUATIONS_1_LOC
 
                let scalars_loc := BATCH_SCALAR_38_LOC
 
                for { let i := 0 } lt(i, sub(LOG_N, 1)) { i := add(i, 1) } {
                    let scaling_factor_pos := mulmod(batching_challenge, mload(mload(SS_POS_INV_DENOM_LOC)), p)
                    let scaling_factor_neg :=
                        mulmod(batching_challenge, mulmod(shplonk_nu, mload(mload(SS_NEG_INV_DENOM_LOC)), p), p)
 
                    mstore(scalars_loc, addmod(sub(p, scaling_factor_neg), sub(p, scaling_factor_pos), p))
 
                    let accum_contribution := mulmod(scaling_factor_neg, mload(mload(SS_GEMINI_EVALS_LOC)), p)
                    accum_contribution := addmod(
                        accum_contribution,
                        mulmod(scaling_factor_pos, mload(fold_pos_evals_loc), p),
                        p
                    )
 
                    constant_term_acc := addmod(constant_term_acc, accum_contribution, p)
 
                    batching_challenge := mulmod(batching_challenge, shplonk_nu_sqr, p)
 
                    mstore(SS_POS_INV_DENOM_LOC, add(mload(SS_POS_INV_DENOM_LOC), 0x20))
                    mstore(SS_NEG_INV_DENOM_LOC, add(mload(SS_NEG_INV_DENOM_LOC), 0x20))
                    mstore(SS_GEMINI_EVALS_LOC, add(mload(SS_GEMINI_EVALS_LOC), 0x20))
                    fold_pos_evals_loc := add(fold_pos_evals_loc, 0x20)
                    scalars_loc := add(scalars_loc, 0x20)
                }
            }
 
            // Libra polynomial batching: five opening claims for (G, A, A, A, Q) at points {r, g*r, r, 1, r}.
            {
                let shplonk_nu := mload(SHPLONK_NU_CHALLENGE)
 
                let libra_denom_0 := mload(POS_INVERTED_DENOM_0_LOC)        // 1/(z - r)
                let libra_denom_1 := mload(LIBRA_SUBGROUP_DENOM_LOC)        // 1/(z - g*r)
 
                // 1/(z - 1): boundary denominator, computed inline via the modexp precompile.
                let shplonk_z := mload(SHPLONK_Z_CHALLENGE)
                mstore(0x00, 0x20)
                mstore(0x20, 0x20)
                mstore(0x40, 0x20)
                mstore(0x60, addmod(shplonk_z, sub(p, 1), p))
                mstore(0x80, sub(p, 2))
                mstore(0xa0, p)
                if iszero(staticcall(gas(), 0x05, 0x00, 0xc0, 0x00, 0x20)) {
                    mstore(0x00, MODEXP_FAILED_SELECTOR)
                    revert(0x00, 0x04)
                }
                let libra_denom_3 := mload(0x00)
                if iszero(libra_denom_3) {
                    mstore(0x00, MODEXP_FAILED_SELECTOR)
                    revert(0x00, 0x04)
                }
 
                // i=0: G(r)
                let scaling_factor := mulmod(libra_denom_0, batching_challenge, p)
                let libra_scalar_0 := sub(p, scaling_factor)
                constant_term_acc := addmod(constant_term_acc, mulmod(scaling_factor, mload(LIBRA_POLY_EVAL_0_LOC), p), p)
                batching_challenge := mulmod(batching_challenge, shplonk_nu, p)
 
                // i=1: A(g*r)
                scaling_factor := mulmod(libra_denom_1, batching_challenge, p)
                let libra_scalar_1 := sub(p, scaling_factor)
                constant_term_acc := addmod(constant_term_acc, mulmod(scaling_factor, mload(LIBRA_POLY_EVAL_1_LOC), p), p)
                batching_challenge := mulmod(batching_challenge, shplonk_nu, p)
 
                // i=2: A(r)
                scaling_factor := mulmod(libra_denom_0, batching_challenge, p)
                let libra_scalar_2 := sub(p, scaling_factor)
                constant_term_acc := addmod(constant_term_acc, mulmod(scaling_factor, mload(LIBRA_POLY_EVAL_2_LOC), p), p)
                batching_challenge := mulmod(batching_challenge, shplonk_nu, p)
 
                // i=3: A(1), boundary opening with hardcoded value 0.
                scaling_factor := mulmod(libra_denom_3, batching_challenge, p)
                let libra_scalar_3 := sub(p, scaling_factor)
                batching_challenge := mulmod(batching_challenge, shplonk_nu, p)
 
                // i=4: Q(r)
                scaling_factor := mulmod(libra_denom_0, batching_challenge, p)
                let libra_scalar_4 := sub(p, scaling_factor)
                constant_term_acc := addmod(constant_term_acc, mulmod(scaling_factor, mload(LIBRA_POLY_EVAL_3_LOC), p), p)
 
                // Group scalars by underlying commitment: [G], [A] (sum of three openings), [Q].
                mstore(BATCH_SCALAR_{{ LIBRA_BATCH_SCALAR_0 }}_LOC, libra_scalar_0)
                mstore(BATCH_SCALAR_{{ LIBRA_BATCH_SCALAR_1 }}_LOC, addmod(addmod(libra_scalar_1, libra_scalar_2, p), libra_scalar_3, p))
                mstore(BATCH_SCALAR_{{ LIBRA_BATCH_SCALAR_2 }}_LOC, libra_scalar_4)
            }
 
            /*´:°•.°+.*•´.*:˚.°*.˚•´.°:°•.°•.*•´.*:˚.°*.˚•´.°:°•.°+.*•´.*:*/
            /*            ZK: checkEvalsConsistency                     */
            /*.•°:°.´+˚.*°.˚:*.´•*.+°.•°:´*.´•*.•°.•°:°.´:•˚°.*°.˚:*.´+°.•*/
            // Validates Libra polynomial evaluations using small subgroup IPA
            {
                let gemini_r := mload(GEMINI_R_CHALLENGE)
 
                // Step 1: Compute vanishingPolyEval = geminiR^SUBGROUP_SIZE - 1
                // SUBGROUP_SIZE = 256 = 2^8, so 8 squarings instead of modexp precompile
                let v := mulmod(gemini_r, gemini_r, p) // r^2
                v := mulmod(v, v, p)                   // r^4
                v := mulmod(v, v, p)                   // r^8
                v := mulmod(v, v, p)                   // r^16
                v := mulmod(v, v, p)                   // r^32
                v := mulmod(v, v, p)                   // r^64
                v := mulmod(v, v, p)                   // r^128
                v := mulmod(v, v, p)                   // r^256
                let vanishing_poly_eval := addmod(v, sub(p, 1), p)
 
                // Require vanishingPolyEval != 0 (geminiR not in subgroup)
                if iszero(vanishing_poly_eval) {
                    mstore(0x00, GEMINI_CHALLENGE_IN_SUBGROUP_SELECTOR)
                    revert(0x00, 0x04)
                }
 
                // Step 2: Build challengePolyLagrange[0..255]
                // Memory layout: CHALLENGE_POLY_LAGRANGE_BASE + idx * 0x20
                // Zero-initialize all 256 entries (only 1 + 9*LOG_N = 136 will be non-zero)
 
                mstore(CHALLENGE_POLY_LAGRANGE_BASE_0, 1) // [0] = 1
 
                {
                    let u_loc := SUM_U_CHALLENGE_0
                    let challenge_base := CHALLENGE_POLY_LAGRANGE_BASE_1
                    // Upper bound of this loop is LIBRA_UNIVARIATES_LENGTH * LOG_N - this is inserted in code templating depending on LOG_N
                    for { } lt(challenge_base, CHALLENGE_POLY_LAGRANGE_BASE_{{ NUMBER_OF_LAGRANGE_BASES }}) { } {
                        let u_round := mload(u_loc)
 
                        // [currIdx] = 1
                        mstore(challenge_base, 1)
                        challenge_base := add(challenge_base, 0x20)
 
                        // Calc memory offset inner loop should break at
                        let loop_target := add(challenge_base, mul(0x20, LIBRA_UNIVARIATES_LENGTH_MINUS_ONE))
 
                        // [currIdx+1..currIdx+8] = u^1, u^2, ..., u^8
                        let prev_val := 1
                        for { } lt(challenge_base, loop_target) { } {
                            prev_val := mulmod(prev_val, u_round, p)
                            mstore(challenge_base, prev_val)
                            challenge_base := add(challenge_base, 0x20)
                        }
 
                        u_loc := add(u_loc, 0x20)
                    }
                }
 
                // Step 3: Compute the active challenge-poly denominators and L_|H|(r)'s denominator.
                {
                    let challenge_poly_denom_end := add(CONSISTENCY_DENOMINATORS_BASE_{{ NUMBER_OF_LAGRANGE_BASES }}, 0x20)
                    let root_power := 1
                    let consistency_base := CONSISTENCY_DENOMINATORS_BASE_0
                    for { } lt(consistency_base, challenge_poly_denom_end) { } {
                        let denom := addmod(mulmod(root_power, gemini_r, p), sub(p, 1), p)
                        mstore(consistency_base, denom)
                        root_power := mulmod(root_power, SUBGROUP_GENERATOR_INVERSE, p)
                        consistency_base := add(consistency_base, 0x20)
                    }
                    mstore(
                        challenge_poly_denom_end,
                        addmod(mulmod(SUBGROUP_GENERATOR, gemini_r, p), sub(p, 1), p)
                    )
                }
 
                // Step 4: Batch invert the active denominators plus L_|H|(r)'s denominator.
                {
                    let final_product_pointer := add(CONSISTENCY_PRODUCTS_BASE_{{ NUMBER_OF_LAGRANGE_BASES }}, 0x20)
                    let batch_product_end := add(final_product_pointer, 0x20)
 
                    // Forward pass: accumulate products
                    let product_pointer := CONSISTENCY_PRODUCTS_BASE_0
                    let next_product_pointer := CONSISTENCY_PRODUCTS_BASE_1
                    let denom_pointer := CONSISTENCY_DENOMINATORS_BASE_1
                    mstore(CONSISTENCY_PRODUCTS_BASE_0, mload(CONSISTENCY_DENOMINATORS_BASE_0))
                    for { } lt(next_product_pointer, batch_product_end) { } {
                        mstore(
                            next_product_pointer,
                            mulmod(
                                mload(product_pointer),
                                mload(denom_pointer),
                                p
                            )
                        )
                        product_pointer := next_product_pointer
                        next_product_pointer := add(next_product_pointer, 0x20)
                        denom_pointer := add(denom_pointer, 0x20)
                    }
 
                    // Invert the final product
                    let final_prod := mload(final_product_pointer)
                    mstore(0x00, 0x20)
                    mstore(0x20, 0x20)
                    mstore(0x40, 0x20)
                    mstore(0x60, final_prod)
                    mstore(0x80, sub(p, 2))
                    mstore(0xa0, p)
                    if iszero(staticcall(gas(), 5, 0x00, 0xc0, 0x00, 0x20)) {
                        mstore(0x00, CONSISTENCY_CHECK_FAILED_SELECTOR)
                        revert(0x00, 0x04)
                    }
                    let accumulator := mload(0x00)
                    if iszero(accumulator) {
                        mstore(0x00, MODEXP_FAILED_SELECTOR)
                        revert(0x00, 0x04)
                    }
 
                    // Backward pass: compute individual inverses
                    let products_pointer := CONSISTENCY_PRODUCTS_BASE_{{ NUMBER_OF_LAGRANGE_BASES }}
                    let denoms_pointer := add(CONSISTENCY_DENOMINATORS_BASE_{{ NUMBER_OF_LAGRANGE_BASES }}, 0x20)
                    for { } gt(denoms_pointer, CONSISTENCY_DENOMINATORS_BASE_0) { } {
                        let val := mulmod(
                            accumulator,
                            mload(products_pointer),
                            p
                        )
                        accumulator := mulmod(
                            accumulator,
                            mload(denoms_pointer),
                            p
                        )
                        mstore(denoms_pointer, val)
 
                        products_pointer := sub(products_pointer, 0x20)
                        denoms_pointer := sub(denoms_pointer, 0x20)
                    }
                    // idx=0: running_inv is the inverse of denom[0]
                    mstore(CONSISTENCY_DENOMINATORS_BASE_0, accumulator)
                }
 
                // Step 5: Compute challengePolyEval = sum(lagrange[i] * invDenom[i]) * numerator
                let challenge_poly_eval := 0
                let challenge_poly_lagrange_end := add(CHALLENGE_POLY_LAGRANGE_BASE_{{ NUMBER_OF_LAGRANGE_BASES }}, 0x20)
                let lagrange_pointer := CHALLENGE_POLY_LAGRANGE_BASE_0
                let denom_pointer := CONSISTENCY_DENOMINATORS_BASE_0
                for { } lt(lagrange_pointer, challenge_poly_lagrange_end) { } {
                    challenge_poly_eval := addmod(
                        challenge_poly_eval,
                        mulmod(
                            mload(lagrange_pointer),
                            mload(denom_pointer),
                            p
                        ),
                        p
                    )
                    lagrange_pointer := add(lagrange_pointer, 0x20)
                    denom_pointer := add(denom_pointer, 0x20)
                }
 
                // numerator = vanishingPolyEval / SUBGROUP_SIZE
                let numerator := mulmod(vanishing_poly_eval, INV_SUBGROUP_SIZE, p)
                challenge_poly_eval := mulmod(challenge_poly_eval, numerator, p)
 
                let lagrange_first := mulmod(mload(CONSISTENCY_DENOMINATORS_BASE_0), numerator, p)
                let lagrange_last := mulmod(
                    mload(CONSISTENCY_DENOMINATORS_BASE_{{ NUMBER_OF_LAGRANGE_BASES_PLUS_ONE }}),
                    numerator,
                    p
                )
 
                // Step 6: Compute diff and verify == 0
                // diff = lagrangeFirst * libraPolyEvals[2]
                let diff := mulmod(lagrange_first, mload(LIBRA_POLY_EVAL_2_LOC), p)
 
                // diff += (geminiR - SUBGROUP_GENERATOR_INVERSE) *
                //         (libraPolyEvals[1] - libraPolyEvals[2] - libraPolyEvals[0] * challengePolyEval)
                {
                    let inner := addmod(
                        mload(LIBRA_POLY_EVAL_1_LOC),
                        sub(
                            p,
                            addmod(
                                mload(LIBRA_POLY_EVAL_2_LOC),
                                mulmod(mload(LIBRA_POLY_EVAL_0_LOC), challenge_poly_eval, p),
                                p
                            )
                        ),
                        p
                    )
                    let factor := addmod(gemini_r, sub(p, SUBGROUP_GENERATOR_INVERSE), p)
                    diff := addmod(diff, mulmod(factor, inner, p), p)
                }
 
                // diff += lagrangeLast * (libraPolyEvals[2] - libraEval)
                diff := addmod(
                    diff,
                    mulmod(
                        lagrange_last,
                        addmod(mload(LIBRA_POLY_EVAL_2_LOC), sub(p, mload(LIBRA_EVALUATION_LOC)), p),
                        p
                    ),
                    p
                )
 
                // diff -= vanishingPolyEval * libraPolyEvals[3]
                diff := addmod(
                    diff,
                    sub(p, mulmod(vanishing_poly_eval, mload(LIBRA_POLY_EVAL_3_LOC), p)),
                    p
                )
 
                if diff {
                    mstore(0x00, CONSISTENCY_CHECK_FAILED_SELECTOR)
                    revert(0x00, 0x04)
                }
            }
 
            let precomp_success_flag := 1
            let q := Q // EC group order
            {
                // The initial accumulator = 1 * shplonk_q
                mcopy(ACCUMULATOR, SHPLONK_Q_X_LOC, 0x40)
            }
 
            // Accumulate geminiMaskingPoly (ZK commitment[1])
            {
                mcopy(G1_LOCATION, GEMINI_MASKING_POLY_X_LOC, 0x40)
                mstore(SCALAR_LOCATION, mload(BATCH_SCALAR_1_LOC))
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 7, G1_LOCATION, 0x60, ACCUMULATOR_2, 0x40)
                )
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 6, ACCUMULATOR, 0x80, ACCUMULATOR, 0x40)
                )
            }
 
            // Accumulate vk points
            loadVk()
            {
                // VK batchMul order matches UltraFlavor_Generated::EntityId precomputed layout.
                // Note: ZK proof has gemini_masking_poly at sumcheckEvaluations[0] paired with SCALAR_1
                // (handled separately above), so the precomputed VK entries pair with SCALAR_2..SCALAR_29.
 
                // Accumulator = accumulator + scalar[2] * vk[0] (sigma_1)
                mcopy(G1_LOCATION, SIGMA_1_X_LOC, 0x40)
                mstore(SCALAR_LOCATION, mload(BATCH_SCALAR_2_LOC))
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 7, G1_LOCATION, 0x60, ACCUMULATOR_2, 0x40)
                )
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 6, ACCUMULATOR, 0x80, ACCUMULATOR, 0x40)
                )
 
                // Accumulator = accumulator + scalar[3] * vk[1] (sigma_2)
                mcopy(G1_LOCATION, SIGMA_2_X_LOC, 0x40)
                mstore(SCALAR_LOCATION, mload(BATCH_SCALAR_3_LOC))
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 7, G1_LOCATION, 0x60, ACCUMULATOR_2, 0x40)
                )
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 6, ACCUMULATOR, 0x80, ACCUMULATOR, 0x40)
                )
 
                // Accumulator = accumulator + scalar[4] * vk[2] (sigma_3)
                mcopy(G1_LOCATION, SIGMA_3_X_LOC, 0x40)
                mstore(SCALAR_LOCATION, mload(BATCH_SCALAR_4_LOC))
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 7, G1_LOCATION, 0x60, ACCUMULATOR_2, 0x40)
                )
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 6, ACCUMULATOR, 0x80, ACCUMULATOR, 0x40)
                )
 
                // Accumulator = accumulator + scalar[5] * vk[3] (sigma_4)
                mcopy(G1_LOCATION, SIGMA_4_X_LOC, 0x40)
                mstore(SCALAR_LOCATION, mload(BATCH_SCALAR_5_LOC))
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 7, G1_LOCATION, 0x60, ACCUMULATOR_2, 0x40)
                )
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 6, ACCUMULATOR, 0x80, ACCUMULATOR, 0x40)
                )
 
                // Accumulator = accumulator + scalar[6] * vk[4] (id_1)
                mcopy(G1_LOCATION, ID_1_X_LOC, 0x40)
                mstore(SCALAR_LOCATION, mload(BATCH_SCALAR_6_LOC))
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 7, G1_LOCATION, 0x60, ACCUMULATOR_2, 0x40)
                )
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 6, ACCUMULATOR, 0x80, ACCUMULATOR, 0x40)
                )
 
                // Accumulator = accumulator + scalar[7] * vk[5] (id_2)
                mcopy(G1_LOCATION, ID_2_X_LOC, 0x40)
                mstore(SCALAR_LOCATION, mload(BATCH_SCALAR_7_LOC))
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 7, G1_LOCATION, 0x60, ACCUMULATOR_2, 0x40)
                )
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 6, ACCUMULATOR, 0x80, ACCUMULATOR, 0x40)
                )
 
                // Accumulator = accumulator + scalar[8] * vk[6] (id_3)
                mcopy(G1_LOCATION, ID_3_X_LOC, 0x40)
                mstore(SCALAR_LOCATION, mload(BATCH_SCALAR_8_LOC))
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 7, G1_LOCATION, 0x60, ACCUMULATOR_2, 0x40)
                )
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 6, ACCUMULATOR, 0x80, ACCUMULATOR, 0x40)
                )
 
                // Accumulator = accumulator + scalar[9] * vk[7] (id_4)
                mcopy(G1_LOCATION, ID_4_X_LOC, 0x40)
                mstore(SCALAR_LOCATION, mload(BATCH_SCALAR_9_LOC))
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 7, G1_LOCATION, 0x60, ACCUMULATOR_2, 0x40)
                )
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 6, ACCUMULATOR, 0x80, ACCUMULATOR, 0x40)
                )
 
                // Accumulator = accumulator + scalar[10] * vk[8] (lagrange_first)
                mcopy(G1_LOCATION, LAGRANGE_FIRST_X_LOC, 0x40)
                mstore(SCALAR_LOCATION, mload(BATCH_SCALAR_10_LOC))
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 7, G1_LOCATION, 0x60, ACCUMULATOR_2, 0x40)
                )
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 6, ACCUMULATOR, 0x80, ACCUMULATOR, 0x40)
                )
 
                // Accumulator = accumulator + scalar[11] * vk[9] (lagrange_last)
                mcopy(G1_LOCATION, LAGRANGE_LAST_X_LOC, 0x40)
                mstore(SCALAR_LOCATION, mload(BATCH_SCALAR_11_LOC))
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 7, G1_LOCATION, 0x60, ACCUMULATOR_2, 0x40)
                )
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 6, ACCUMULATOR, 0x80, ACCUMULATOR, 0x40)
                )
 
                // Accumulator = accumulator + scalar[12] * vk[10] (q_lookup)
                mcopy(G1_LOCATION, Q_LOOKUP_X_LOC, 0x40)
                mstore(SCALAR_LOCATION, mload(BATCH_SCALAR_12_LOC))
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 7, G1_LOCATION, 0x60, ACCUMULATOR_2, 0x40)
                )
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 6, ACCUMULATOR, 0x80, ACCUMULATOR, 0x40)
                )
 
                // Accumulator = accumulator + scalar[13] * vk[11] (table_1)
                mcopy(G1_LOCATION, TABLE_1_X_LOC, 0x40)
                mstore(SCALAR_LOCATION, mload(BATCH_SCALAR_13_LOC))
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 7, G1_LOCATION, 0x60, ACCUMULATOR_2, 0x40)
                )
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 6, ACCUMULATOR, 0x80, ACCUMULATOR, 0x40)
                )
 
                // Accumulator = accumulator + scalar[14] * vk[12] (table_2)
                mcopy(G1_LOCATION, TABLE_2_X_LOC, 0x40)
                mstore(SCALAR_LOCATION, mload(BATCH_SCALAR_14_LOC))
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 7, G1_LOCATION, 0x60, ACCUMULATOR_2, 0x40)
                )
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 6, ACCUMULATOR, 0x80, ACCUMULATOR, 0x40)
                )
 
                // Accumulator = accumulator + scalar[15] * vk[13] (table_3)
                mcopy(G1_LOCATION, TABLE_3_X_LOC, 0x40)
                mstore(SCALAR_LOCATION, mload(BATCH_SCALAR_15_LOC))
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 7, G1_LOCATION, 0x60, ACCUMULATOR_2, 0x40)
                )
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 6, ACCUMULATOR, 0x80, ACCUMULATOR, 0x40)
                )
 
                // Accumulator = accumulator + scalar[16] * vk[14] (table_4)
                mcopy(G1_LOCATION, TABLE_4_X_LOC, 0x40)
                mstore(SCALAR_LOCATION, mload(BATCH_SCALAR_16_LOC))
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 7, G1_LOCATION, 0x60, ACCUMULATOR_2, 0x40)
                )
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 6, ACCUMULATOR, 0x80, ACCUMULATOR, 0x40)
                )
 
                // Accumulator = accumulator + scalar[17] * vk[15] (q_m)
                mcopy(G1_LOCATION, Q_M_X_LOC, 0x40)
                mstore(SCALAR_LOCATION, mload(BATCH_SCALAR_17_LOC))
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 7, G1_LOCATION, 0x60, ACCUMULATOR_2, 0x40)
                )
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 6, ACCUMULATOR, 0x80, ACCUMULATOR, 0x40)
                )
 
                // Accumulator = accumulator + scalar[18] * vk[16] (q_r)
                mcopy(G1_LOCATION, Q_R_X_LOC, 0x40)
                mstore(SCALAR_LOCATION, mload(BATCH_SCALAR_18_LOC))
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 7, G1_LOCATION, 0x60, ACCUMULATOR_2, 0x40)
                )
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 6, ACCUMULATOR, 0x80, ACCUMULATOR, 0x40)
                )
 
                // Accumulator = accumulator + scalar[19] * vk[17] (q_o)
                mcopy(G1_LOCATION, Q_O_X_LOC, 0x40)
                mstore(SCALAR_LOCATION, mload(BATCH_SCALAR_19_LOC))
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 7, G1_LOCATION, 0x60, ACCUMULATOR_2, 0x40)
                )
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 6, ACCUMULATOR, 0x80, ACCUMULATOR, 0x40)
                )
 
                // Accumulator = accumulator + scalar[20] * vk[18] (q_c)
                mcopy(G1_LOCATION, Q_C_X_LOC, 0x40)
                mstore(SCALAR_LOCATION, mload(BATCH_SCALAR_20_LOC))
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 7, G1_LOCATION, 0x60, ACCUMULATOR_2, 0x40)
                )
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 6, ACCUMULATOR, 0x80, ACCUMULATOR, 0x40)
                )
 
                // Accumulator = accumulator + scalar[21] * vk[19] (q_l)
                mcopy(G1_LOCATION, Q_L_X_LOC, 0x40)
                mstore(SCALAR_LOCATION, mload(BATCH_SCALAR_21_LOC))
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 7, G1_LOCATION, 0x60, ACCUMULATOR_2, 0x40)
                )
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 6, ACCUMULATOR, 0x80, ACCUMULATOR, 0x40)
                )
 
                // Accumulator = accumulator + scalar[22] * vk[20] (q_4)
                mcopy(G1_LOCATION, Q_4_X_LOC, 0x40)
                mstore(SCALAR_LOCATION, mload(BATCH_SCALAR_22_LOC))
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 7, G1_LOCATION, 0x60, ACCUMULATOR_2, 0x40)
                )
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 6, ACCUMULATOR, 0x80, ACCUMULATOR, 0x40)
                )
 
                // Accumulator = accumulator + scalar[23] * vk[21] (q_arith)
                mcopy(G1_LOCATION, Q_ARITH_X_LOC, 0x40)
                mstore(SCALAR_LOCATION, mload(BATCH_SCALAR_23_LOC))
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 7, G1_LOCATION, 0x60, ACCUMULATOR_2, 0x40)
                )
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 6, ACCUMULATOR, 0x80, ACCUMULATOR, 0x40)
                )
 
                // Accumulator = accumulator + scalar[24] * vk[22] (q_delta_range)
                mcopy(G1_LOCATION, Q_DELTA_RANGE_X_LOC, 0x40)
                mstore(SCALAR_LOCATION, mload(BATCH_SCALAR_24_LOC))
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 7, G1_LOCATION, 0x60, ACCUMULATOR_2, 0x40)
                )
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 6, ACCUMULATOR, 0x80, ACCUMULATOR, 0x40)
                )
 
                // Accumulator = accumulator + scalar[25] * vk[23] (q_elliptic)
                mcopy(G1_LOCATION, Q_ELLIPTIC_X_LOC, 0x40)
                mstore(SCALAR_LOCATION, mload(BATCH_SCALAR_25_LOC))
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 7, G1_LOCATION, 0x60, ACCUMULATOR_2, 0x40)
                )
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 6, ACCUMULATOR, 0x80, ACCUMULATOR, 0x40)
                )
 
                // Accumulator = accumulator + scalar[26] * vk[24] (q_memory)
                mcopy(G1_LOCATION, Q_MEMORY_X_LOC, 0x40)
                mstore(SCALAR_LOCATION, mload(BATCH_SCALAR_26_LOC))
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 7, G1_LOCATION, 0x60, ACCUMULATOR_2, 0x40)
                )
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 6, ACCUMULATOR, 0x80, ACCUMULATOR, 0x40)
                )
 
                // Accumulator = accumulator + scalar[27] * vk[25] (q_nnf)
                mcopy(G1_LOCATION, Q_NNF_X_LOC, 0x40)
                mstore(SCALAR_LOCATION, mload(BATCH_SCALAR_27_LOC))
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 7, G1_LOCATION, 0x60, ACCUMULATOR_2, 0x40)
                )
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 6, ACCUMULATOR, 0x80, ACCUMULATOR, 0x40)
                )
 
                // Accumulator = accumulator + scalar[28] * vk[26] (q_poseidon2_external)
                mcopy(G1_LOCATION, Q_POSEIDON_2_EXTERNAL_X_LOC, 0x40)
                mstore(SCALAR_LOCATION, mload(BATCH_SCALAR_28_LOC))
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 7, G1_LOCATION, 0x60, ACCUMULATOR_2, 0x40)
                )
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 6, ACCUMULATOR, 0x80, ACCUMULATOR, 0x40)
                )
 
                // Accumulator = accumulator + scalar[29] * vk[27] (q_poseidon2_internal)
                mcopy(G1_LOCATION, Q_POSEIDON_2_INTERNAL_X_LOC, 0x40)
                mstore(SCALAR_LOCATION, mload(BATCH_SCALAR_29_LOC))
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 7, G1_LOCATION, 0x60, ACCUMULATOR_2, 0x40)
                )
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 6, ACCUMULATOR, 0x80, ACCUMULATOR, 0x40)
                )
 
                // Accumulator = accumulator + constant_term_acc * G (generator)
                mstore(G1_LOCATION, 0x01)   // G1 generator x
                mstore(G1_Y_LOCATION, 0x02) // G1 generator y
                mstore(SCALAR_LOCATION, constant_term_acc)
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 7, G1_LOCATION, 0x60, ACCUMULATOR_2, 0x40)
                )
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 6, ACCUMULATOR, 0x80, ACCUMULATOR, 0x40)
                )
 
                // Accumulate proof points
                // Accumulator = accumulator + scalar[29] * w_l
                mcopy(G1_LOCATION, W_L_X_LOC, 0x40)
                mstore(SCALAR_LOCATION, mload(BATCH_SCALAR_30_LOC))
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 7, G1_LOCATION, 0x60, ACCUMULATOR_2, 0x40)
                )
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 6, ACCUMULATOR, 0x80, ACCUMULATOR, 0x40)
                )
 
                // Accumulator = accumulator + scalar[30] * w_r
                mcopy(G1_LOCATION, W_R_X_LOC, 0x40)
                mstore(SCALAR_LOCATION, mload(BATCH_SCALAR_31_LOC))
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 7, G1_LOCATION, 0x60, ACCUMULATOR_2, 0x40)
                )
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 6, ACCUMULATOR, 0x80, ACCUMULATOR, 0x40)
                )
 
                // Accumulator = accumulator + scalar[31] * w_o
                mcopy(G1_LOCATION, W_O_X_LOC, 0x40)
                mstore(SCALAR_LOCATION, mload(BATCH_SCALAR_32_LOC))
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 7, G1_LOCATION, 0x60, ACCUMULATOR_2, 0x40)
                )
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 6, ACCUMULATOR, 0x80, ACCUMULATOR, 0x40)
                )
 
                // Accumulator = accumulator + scalar[32] * w_4
                mcopy(G1_LOCATION, W_4_X_LOC, 0x40)
                mstore(SCALAR_LOCATION, mload(BATCH_SCALAR_33_LOC))
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 7, G1_LOCATION, 0x60, ACCUMULATOR_2, 0x40)
                )
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 6, ACCUMULATOR, 0x80, ACCUMULATOR, 0x40)
                )
 
                // Accumulator = accumulator + scalar[33] * z_perm
                mcopy(G1_LOCATION, Z_PERM_X_LOC, 0x40)
                mstore(SCALAR_LOCATION, mload(BATCH_SCALAR_34_LOC))
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 7, G1_LOCATION, 0x60, ACCUMULATOR_2, 0x40)
                )
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 6, ACCUMULATOR, 0x80, ACCUMULATOR, 0x40)
                )
 
                // Accumulator = accumulator + scalar[34] * lookup_inverses
                mcopy(G1_LOCATION, LOOKUP_INVERSES_X_LOC, 0x40)
                mstore(SCALAR_LOCATION, mload(BATCH_SCALAR_35_LOC))
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 7, G1_LOCATION, 0x60, ACCUMULATOR_2, 0x40)
                )
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 6, ACCUMULATOR, 0x80, ACCUMULATOR, 0x40)
                )
 
                // Accumulator = accumulator + scalar[35] * lookup_read_counts
                mcopy(G1_LOCATION, LOOKUP_READ_COUNTS_X_LOC, 0x40)
                mstore(SCALAR_LOCATION, mload(BATCH_SCALAR_36_LOC))
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 7, G1_LOCATION, 0x60, ACCUMULATOR_2, 0x40)
                )
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 6, ACCUMULATOR, 0x80, ACCUMULATOR, 0x40)
                )
 
                // Accumulator = accumulator + scalar[36] * lookup_read_tags
                mcopy(G1_LOCATION, LOOKUP_READ_TAGS_X_LOC, 0x40)
                mstore(SCALAR_LOCATION, mload(BATCH_SCALAR_37_LOC))
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 7, G1_LOCATION, 0x60, ACCUMULATOR_2, 0x40)
                )
                precomp_success_flag := and(
                    precomp_success_flag,
                    staticcall(gas(), 6, ACCUMULATOR, 0x80, ACCUMULATOR, 0x40)
                )
 
                // Accumulate these LOG_N scalars with the gemini fold univariates
                {
                    {
                    }
                }
 
                // Accumulate libra commitments (ZK)
                {
                    // scalar[52] * libraConcat (libraCommitments[0])
                    mcopy(G1_LOCATION, LIBRA_CONCAT_X_LOC, 0x40)
                    mstore(SCALAR_LOCATION, mload(BATCH_SCALAR_{{ LIBRA_BATCH_SCALAR_0 }}_LOC))
                    precomp_success_flag := and(
                        precomp_success_flag,
                        staticcall(gas(), 7, G1_LOCATION, 0x60, ACCUMULATOR_2, 0x40)
                    )
                    precomp_success_flag := and(
                        precomp_success_flag,
                        staticcall(gas(), 6, ACCUMULATOR, 0x80, ACCUMULATOR, 0x40)
                    )
 
                    // scalar[53] * libraGrandProduct (libraCommitments[1])
                    mcopy(G1_LOCATION, LIBRA_GRAND_PRODUCT_X_LOC, 0x40)
                    mstore(SCALAR_LOCATION, mload(BATCH_SCALAR_{{ LIBRA_BATCH_SCALAR_1 }}_LOC))
                    precomp_success_flag := and(
                        precomp_success_flag,
                        staticcall(gas(), 7, G1_LOCATION, 0x60, ACCUMULATOR_2, 0x40)
                    )
                    precomp_success_flag := and(
                        precomp_success_flag,
                        staticcall(gas(), 6, ACCUMULATOR, 0x80, ACCUMULATOR, 0x40)
                    )
 
                    // scalar[54] * libraQuotient (libraCommitments[2])
                    mcopy(G1_LOCATION, LIBRA_QUOTIENT_X_LOC, 0x40)
                    mstore(SCALAR_LOCATION, mload(BATCH_SCALAR_{{ LIBRA_BATCH_SCALAR_2 }}_LOC))
                    precomp_success_flag := and(
                        precomp_success_flag,
                        staticcall(gas(), 7, G1_LOCATION, 0x60, ACCUMULATOR_2, 0x40)
                    )
                    precomp_success_flag := and(
                        precomp_success_flag,
                        staticcall(gas(), 6, ACCUMULATOR, 0x80, ACCUMULATOR, 0x40)
                    )
                }
 
                {
                    // Accumlate final quotient commitment into shplonk check
                    // Accumulator = accumulator + shplonkZ * quotient commitment
                    mcopy(G1_LOCATION, KZG_QUOTIENT_X_LOC, 0x40)
 
                    mstore(SCALAR_LOCATION, mload(SHPLONK_Z_CHALLENGE))
                    precomp_success_flag := and(
                        precomp_success_flag,
                        staticcall(gas(), 7, G1_LOCATION, 0x60, ACCUMULATOR_2, 0x40)
                    )
                    precomp_success_flag := and(
                        precomp_success_flag,
                        staticcall(gas(), 6, ACCUMULATOR, 0x80, ACCUMULATOR, 0x40)
                    )
                }
 
                // All G1 points were validated on-curve during input validation.
                // precomp_success_flag now only tracks ecAdd/ecMul precompile success.
                if iszero(precomp_success_flag) {
                    mstore(0x00, SHPLEMINI_FAILED_SELECTOR)
                    revert(0x00, 0x04)
                }
 
                /*´:°•.°+.*•´.*:˚.°*.˚•´.°:°•.°•.*•´.*:˚.°*.˚•´.°:°•.°+.*•´.*:*/
                /*                  SHPLEMINI - complete                      */
                /*.•°:°.´+˚.*°.˚:*.´•*.+°.•°:´*.´•*.•°.•°:°.´:•˚°.*°.˚:*.´+°.•*/
 
                /*´:°•.°+.*•´.*:˚.°*.˚•´.°:°•.°•.*•´.*:˚.°*.˚•´.°:°•.°+.*•´.*:*/
                /*                       PAIRING CHECK                        */
                /*.•°:°.´+˚.*°.˚:*.´•*.+°.•°:´*.´•*.•°.•°:°.´:•˚°.*°.˚:*.´+°.•*/
                {
                    // P_1
                    mstore(0xc0, mload(KZG_QUOTIENT_X_LOC))
                    mstore(0xe0, sub(q, mload(KZG_QUOTIENT_Y_LOC)))
 
                    // p_0_agg
                    // 0x80 - p_0_agg x
                    // 0xa0 - p_0_agg y
                    mcopy(0x80, ACCUMULATOR, 0x40)
 
                    /*´:°•.°+.*•´.*:˚.°*.˚•´.°:°•.°•.*•´.*:˚.°*.˚•´.°:°•.°+.*•´.*:*/
                    /*                   PAIRING AGGREGATION                      */
                    /*.•°:°.´+˚.*°.˚:*.´•*.+°.•°:´*.´•*.•°.•°:°.´:•˚°.*°.˚:*.´+°.•*/
                    // Read the pairing encoded in the first 8 field elements of the proof (2 limbs per coordinate)
                    let p0_other_x := mload(PAIRING_POINT_0_X_0_LOC)
                    p0_other_x := or(shl(136, mload(PAIRING_POINT_0_X_1_LOC)), p0_other_x)
 
                    let p0_other_y := mload(PAIRING_POINT_0_Y_0_LOC)
                    p0_other_y := or(shl(136, mload(PAIRING_POINT_0_Y_1_LOC)), p0_other_y)
 
                    let p1_other_x := mload(PAIRING_POINT_1_X_0_LOC)
                    p1_other_x := or(shl(136, mload(PAIRING_POINT_1_X_1_LOC)), p1_other_x)
 
                    let p1_other_y := mload(PAIRING_POINT_1_Y_0_LOC)
                    p1_other_y := or(shl(136, mload(PAIRING_POINT_1_Y_1_LOC)), p1_other_y)
 
                    // Check if pairing points are default (all zero = infinity = no recursive verification)
                    let pairing_points_are_default := iszero(or(or(p0_other_x, p0_other_y), or(p1_other_x, p1_other_y)))
 
                    let success := 1
                    // Only aggregate if pairing points are non-default
                    if iszero(pairing_points_are_default) {
                        // Reconstructed coordinates must be < Q to prevent malleability
                        if iszero(and(
                            and(lt(p0_other_x, q), lt(p0_other_y, q)),
                            and(lt(p1_other_x, q), lt(p1_other_y, q))
                        )) {
                            mstore(0x00, VALUE_GE_GROUP_ORDER_SELECTOR)
                            revert(0x00, 0x04)
                        }
 
                        // Validate p_0_other not point of infinity
                        success := iszero(iszero(or(p0_other_x, p0_other_y)))
                        // Validate p_1_other not point of infinity
                        success := and(success, iszero(iszero(or(p1_other_x, p1_other_y))))
 
                        // p_0
                        mstore(0x00, p0_other_x)
                        mstore(0x20, p0_other_y)
 
                        // p_1
                        mstore(0x40, p1_other_x)
                        mstore(0x60, p1_other_y)
 
                        // p_1_agg is already in the correct location
 
                        let recursion_separator := keccak256(0x00, 0x100)
 
                        // Write separator back to scratch space
                        mstore(0x00, p0_other_x)
 
                        mstore(0x40, recursion_separator)
                        // recursion_separator * p_0_other
                        success := and(success, staticcall(gas(), 0x07, 0x00, 0x60, 0x00, 0x40))
 
                        // (recursion_separator * p_0_other) + p_0_agg
                        mcopy(0x40, 0x80, 0x40)
                        // p_0 = (recursion_separator * p_0_other) + p_0_agg
                        success := and(success, staticcall(gas(), 6, 0x00, 0x80, 0x00, 0x40))
 
                        mstore(0x40, p1_other_x)
                        mstore(0x60, p1_other_y)
                        mstore(0x80, recursion_separator)
 
                        success := and(success, staticcall(gas(), 7, 0x40, 0x60, 0x40, 0x40))
 
                        // Write p_1_agg back to scratch space
                        mcopy(0x80, 0xc0, 0x40)
 
                        // 0xc0 - (recursion_separator * p_1_other) + p_1_agg
                        success := and(success, staticcall(gas(), 6, 0x40, 0x80, 0xc0, 0x40))
                    }
                    // If default pairing points, use p_0_agg and p_1_agg directly (already at 0x80, 0xc0)
                    if pairing_points_are_default {
                        // Copy p_0_agg to 0x00 for pairing input
                        mcopy(0x00, 0x80, 0x40)
                        // p_1_agg stays at 0xc0
                    }
 
                    // G2 [1]
                    mstore(0x40, 0x198e9393920d483a7260bfb731fb5d25f1aa493335a9e71297e485b7aef312c2)
                    mstore(0x60, 0x1800deef121f1e76426a00665e5c4479674322d4f75edadd46debd5cd992f6ed)
                    mstore(0x80, 0x090689d0585ff075ec9e99ad690c3395bc4b313370b38ef355acdadcd122975b)
                    mstore(0xa0, 0x12c85ea5db8c6deb4aab71808dcb408fe3d1e7690c43d37b4ce6cc0166fa7daa)
 
                    // G2 [x]
                    mstore(0x100, 0x260e01b251f6f1c7e7ff4e580791dee8ea51d87a358e038b4efe30fac09383c1)
                    mstore(0x120, 0x0118c4d5b837bcc2bc89b5b398b5974e9f5944073b32078b7e231fec938883b0)
                    mstore(0x140, 0x04fc6369f7110fe3d25156c1bb9a72859cf2a04641f99ba4ee413c80da6a5fe4)
                    mstore(0x160, 0x22febda3c0c0632a56475b4214e5615e11e6dd3f96e6cea2854a87d4dacc5e55)
 
                    let pairing_success := and(success, staticcall(gas(), 8, 0x00, 0x180, 0x00, 0x20))
                    if iszero(and(pairing_success, mload(0x00))) {
                        mstore(0x00, SHPLEMINI_FAILED_SELECTOR)
                        revert(0x00, 0x04)
                    }
 
                    /*´:°•.°+.*•´.*:˚.°*.˚•´.°:°•.°•.*•´.*:˚.°*.˚•´.°:°•.°+.*•´.*:*/
                    /*                PAIRING CHECK - Complete                    */
                    /*.•°:°.´+˚.*°.˚:*.´•*.+°.•°:´*.´•*.•°.•°:°.´:•˚°.*°.˚:*.´+°.•*/
                }
                {
                    mstore(0x00, 0x01)
                    return(0x00, 0x20) // Proof succeeded!
                }
            }
        }
    }
}
)";
 
inline std::string get_optimized_honk_zk_solidity_verifier(auto const& verification_key)
{
    std::string template_str = HONK_ZK_CONTRACT_OPT_SOURCE;
 
    apply_template_params(template_str, verification_key, /*is_zk=*/true);
 
    // Replace UNROLL_SECTION blocks
    int log_n = static_cast<int>(verification_key->log_circuit_size);
    UnrollConfig unroll_config{
        .batch_scalar_offset = 38,
    };
 
    replace_unroll_section(template_str, "POWERS_OF_EVALUATION_COMPUTATION", log_n, unroll_config);
    replace_unroll_section(template_str, "ACCUMULATE_INVERSES", log_n, unroll_config);
    replace_unroll_section(template_str, "COLLECT_INVERSES", log_n, unroll_config);
    replace_unroll_section(template_str, "ACCUMULATE_GEMINI_FOLD_UNIVARIATE", log_n, unroll_config);
 
    MemoryLayoutConfig mem_config{
        .batched_relation_partial_length = 9,
        .barycentric_domain_size = 9,
        .is_zk = true,
    };
    replace_memory_layout(template_str, log_n, mem_config);
    // Replace Memory Layout
    {
        std::string::size_type start_pos = template_str.find("// {{ SECTION_START MEMORY_LAYOUT }}");
        std::string::size_type end_pos = template_str.find("// {{ SECTION_END MEMORY_LAYOUT }}");
        if (start_pos != std::string::npos && end_pos != std::string::npos) {
            std::string::size_type start_line_end = template_str.find("\n", start_pos);
            std::string generated_code = generate_memory_offsets(log_n, mem_config);
            template_str = template_str.substr(0, start_line_end + 1) + generated_code + template_str.substr(end_pos);
        }
    }
 
    return template_str;
}