kernel-audited)
Proofs/FromBytesSpec.lean: FieldElement51::from_bytes is exact below bit
255 - for any 32 input bytes it succeeds with 51-bit limbs denoting
bytesVal b mod 2^255 (the sign bit is discarded, everything else is the
little-endian value). This is the y-parse of decompression: a canonical
encoding parses to exactly its y-residue.
- load8_at_spec: generic 8-byte little-endian loader (the disjoint-OR
idiom with the product-order-robust or_add_low helper; per-round clear
hygiene cured a fat-context elaboration timeout).
- window_extract / window_shift / digits_tile: the pure window algebra -
five 64-bit windows at byte offsets 0/6/12/19/24, shifted 0/3/6/1/12,
tile bits 0..254 exactly (base-2^51 digit identity).
- from_bytes_spec: the walk composing them; the five window equations
come from ring-verified low/window/high decompositions of the byte sum.
Certificate exact standard three; full button green fresh. Next:
decompress_of_canonical (step 3/5).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
