The plaintext-equality primitive itself is sound: statement (γ1, γ2, φ1/φ2)
with witnesses (r0, r1) correctly proves two ciphertexts encrypt the same
plaintext under different keys. Finding F5 was a caller error in the old vote
path, not a defect here. This test pins the correct contract (accepts equal
plaintexts, rejects different plaintexts and mismatched aux) so the upcoming
cast-as-intended return-code path can rely on it.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
