feat(bb/msm): mobile-first MSM — SwiftShader correctness harness + GLV design

[AztecBot]

Mobile-first BN254 WebGPU MSM — GLV decomposition

Autonomous work toward a memory- and time-optimal BN254 MSM for laptop/mobile GPUs (Apple TBDR, Adreno, Mali) under the ≤100 MB algorithm-buffer budget and 16/32 KB workgroup-memory limits. Full design + budget: barretenberg/ts/src/msm_webgpu/MOBILE_MSM_DESIGN.md.

Algorithmic contribution: GLV endomorphism (cuzk/glv.ts + scalarBits knob)

MSM_DESIGN_ANALYSIS.md §3.6 flags GLV as the top unexploited win ("wins everywhere", used by neither baseline). BN254 has φ(x,y)=(βx,y)=[λ]P; every scalar splits as k ≡ k₁ + λ·k₂ (mod r) with |kᵢ| < 2¹²⁷. So an n-pair, 254-bit MSM becomes a 2n-pair, 128-bit MSM Σ k₁ᵢPᵢ + Σ k₂ᵢφPᵢ. Constants derived offline (Tonelli-Shanks cube roots, Gauss lattice reduction), verified against the group law, re-asserted at module load.

Total accumulation work is invariant (2n·T′ ≈ n·T nonzero digits), but halving the scalar bit length halves the window count T, which:

	baseline	GLV	effect
BPR + transpose-scan (T·2ᶜ, the n-independent term — 37 % of GPU wall @2¹⁶)	T	T/2	time −, halved
Horner (T)	T	T/2	time −
accumulation (n·T)	n·T	n·T	flat (no regression)
algorithm buffers @2¹⁷	12.52 MB	8.02 MB	−36 %
algorithm buffers @2²⁰	43.33 MB	29.56 MB	−32 %

(Buffer totals computed from the real allocation formulas in ba_stream_plan.ts, holding thread count at the work-justified baseline.) Mobile-agnostic: φ is one Fq-multiply + a free coordinate copy, zero extra workgroup memory.

Correctness — validated under SwiftShader (GPU-less host)

New WASM-free, network-free WebGPU correctness oracle vs noble (dev/msm-webgpu/xcheck.*), run under SwiftShader:

baseline    logN=8 PASS (c=4)   logN=10 PASS (c=8)
GLV (128b)  logN=8 PASS (c=5)   logN=10 PASS (c=8)   max |kᵢ|=126 bits

Commits

1. SwiftShader correctness harness (xcheck.{html,ts} + driver)
2. cuzk/glv.ts GLV decomposition + MsmV2.scalarBits knob
3. MOBILE_MSM_DESIGN.md design + memory/time budget
4. ?glv=1 knob in the bench harness for on-device runs

Status / blockers (honest)

• No local GPU — correctness validated only under SwiftShader at logn 8/10 (per task constraints).
• BrowserStack: blocked. Both seats (2, shared across ~10 agents) were occupied throughout this session; never interfered with running jobs. The on-device path is turnkey: cloudflared installed, ?glv=1 wired into the bench autorun (the WASM/noble cross-check then also confirms GLV correctness on the real device). Reproduce on a free seat:
  node dev/msm-webgpu/scripts/run-browserstack.mjs --target macos --n 17 --autorun msm-bench and the same with &glv=1 appended to the page URL.
• Peak GPU memory is not measurable via WebGPU (no API; performance.memory is JS heap). The credible memory evidence is therefore the analytical buffer budget above, derived from the real allocation formulas.
• Designed, not yet wired (full memory-optimality): work-invariant thread allocation under GLV, and on-the-fly φ point-fetch to avoid doubling the input SRS — see design doc §4/§6.