⚠️ AI-generated review. Produced by an automated agent and posted from this account — not written by hand. Findings below are leads to verify, not confirmed conclusions.

This PR turns on rkyv's pointer_width_64 across the proof-format crates, bumps RECURSION_INPUT_VERSION, and adds a CI pre-flight that blocks bench runs on branches predating the change. Both halves are internally consistent: the feature is on all six crates that declare rkyv, host and guest compile RECURSION_INPUT_VERSION from the same constant, every proof read stays on validated rkyv::access/from_bytes so old-format bytes yield an Err rather than a panic or unchecked access, the now-64-bit archived table dimensions remain gated by checked_mul plus the exact AIR-derived equality checks, and token parsing validates digits-only before every [ -lt ]. The findings below are workflow-side, plus one missing guard on the invariant the PR turns on.

.github/workflows/bench-abba.yml:102-112 (duplicated at benchmark-gpu.yml:135-146) — the pre-flight does not fail open on a failed fetch, contrary to its comment ("Skip if the fetch fails"). gh api prints HTTP error bodies to stdout, so on any 404/403/5xx SIDE holds a JSON error blob rather than the empty string: [ -n "$SIDE" ] passes, grep -q pointer_width_64 misses, and the job hard-exits with PR branch predates the rkyv pointer_width_64 fix without having read anything. Reproducible against this repo — gh api "repos/$GITHUB_REPOSITORY/contents/prover/Cargo.toml?ref=<bad-sha>" -H "Accept: application/vnd.github.raw" 2>/dev/null || true returns a {"message":"No commit found for the ref ...","status":"404"} body on stdout. A rate-limited token or a transient contents-API failure therefore turns the default cont100 bench into a hard block that blames the author for a stale branch. Fix: branch on gh's exit status (if SIDE=$(gh api ...); then ... fi) and/or require the payload to look like the file (e.g. it also contains rkyv) before treating a missing string as evidence the branch is stale. Secondary: the check is purely textual on one file's contents, so it also matches the feature name appearing only in the explanatory comment added above the dep; the whole check is deletable once every open branch postdates this merge.

.github/workflows/bench-abba.yml:38 — the Acknowledge step still runs before the cfg step (52-124), the reverse of benchmark-gpu.yml, which this PR restructured so config (71) precedes ack (163) and the notice interpolates steps.config.outputs.pairs/workload. Two effects. The notice is a hardcoded literal, so /bench-abba 4 cont10 still gets "~4-5 hr at the default 20 pairs of ethrex 100tx continuations; pass a smaller pair count or cont10 for a quicker run" — hedged by "at the default" so not false, but uninformative; pre-existing, widened by the new workload axis. New here: the fail-fast at line 110 fires after the "bench server is occupied until it finishes" comment, which — unlike the GPU workflow's marker-based update-in-place — is a plain createComment that is never retracted, and it is the default path (cont100 ⇒ TX_COUNT >= 40) for any un-rebased branch. The always() Post result step then posts a second comment headed `<sha>` vs `main` ( pairs, ethrex) — pairs/workload are written at 118-123, after the exit 1, while head_sha lands at 63 before it — whose "Last log lines" block tails /tmp/abba_out.txt from a previous run, since the bench runner is persistent self-hosted and nothing cleans /tmp. Fix: move Acknowledge after cfg and interpolate steps.cfg.outputs.pairs/workload; the cfg step costs seconds, and the fail-fast then exits before any occupancy claim is posted. Optionally write the outputs block before the fail-fast (or rm -f /tmp/abba_out.txt at job start) so the failure comment is not half-blank with a stale log.

prover/Cargo.toml:27-29 — the pointer_width_64 invariant is held only by the "Keep in sync across all proof-format crates" comment plus five copies of it. Nothing in code or CI pins it: no const assert, no test, and RECURSION_INPUT_VERSION cannot help, since host and guest compile it from the same source (prover/src/lib.rs:214, checked at :265) — a rebuilt-but-misconfigured binary still advertises v2. rkyv compile_error!s on conflicting pointer-width features, but with none enabled it silently defaults to u32. Feature unification makes dropping it from a single main-workspace crate harmless; the two cases that bite are losing it from a whole graph (hoisting rkyv into [workspace.dependencies], or a version bump that drops the feature list) and the separate non-member bench_vs/lambda/recursion guest workspace drifting from the host. Both stay green in CI, since every existing test round-trips archives that fit 32-bit offsets, and only resurface as a serialization failure at the end of a >2 GiB prove. Mirror the const _: () = { assert!(...) } pattern already at prover/src/lib.rs:216-229: const _: () = assert!(size_of::<rkyv::primitive::ArchivedUsize>() == 8, "proof format requires rkyv pointer_width_64");. That compiles into both the host and the riscv64 guest graph (the guest path-depends on lambda-vm-prover, whose rkyv dep is non-optional), so it covers the drift the CI grep cannot see; placing it in crypto/math or crypto/stark under their rkyv feature would additionally cover standalone builds of the crates that define the archived types.

Nits:

• prover/src/lib.rs:257 — no test covers the prefix rejection path (None on a short blob / wrong magic / wrong version, surfaced as Error::Execution("recursion blob: bad magic or version") at :286, continuation twin at recursion.rs:312); the three tests in prover/src/tests/recursion_smoke_test.rs (600, 649, 711) all leave the 12-byte prefix intact. Pre-existing (only the constant's value changes) and bounded to a less legible bytecheck Err, but worth closing since the breaking-change note leans on clean rejection and blobs are persisted (test_dump_recursion_input writes /tmp/recursion_input.bin, prebuilt recursion-*.elf guests are cached); recursion_archive_bytes is pure, so a test needs no proving — fabricate a 12-byte prefix plus dummy bytes and assert None for (a) version patched to 1u32 LE at bytes 4..8, (b) a flipped magic byte, (c) a blob shorter than RECURSION_INPUT_PREFIX_LEN.
• prover/src/lib.rs:256 — the doc comment claiming an access_unchecked follows is stale; there is none in tree.