[timohanke]

Release 0.2.2 → 0.2.3.

Changes

• Jacobi.mul() / Jacobi.mulBase() use the GLV endomorphism on secp256k1: the scalar is split into two ~128-bit halves and both are processed in one interleaved-NAF loop.
• New Curves.Glv type; Curves.Curve gains glv : ?Glv (breaking for code that builds its own Curve records; glv = null keeps the old path).
• CHANGELOG: removed stale entries the GLV branch had added to the already-published 0.2.1 section.
• No dependency or toolchain changes (core 2.6.2, sha2 0.3.0, moc 2.0.0, pocket-ic 15.0.0, [requirements] moc 1.4.0).

Benchmarks vs main (instructions)

Benchmark	main	GLV	Δ
ECDSA verify (preparsed)	246_258_062	158_720_308	−35.5%
ECDSA DER+verify	246_740_504	159_202_750	−35.5%
BIP32 derive, depth 3	441_000_180	315_269_845	−28.5%
BIP32 derive, depth 5	737_240_050	521_699_275	−29.2%
mul, 256-bit scalar¹	122_217_828	80_467_067	−34.2%
mul, k ≤ 2⁵⁷ (ec_arith)	29_830_886	29_921_334	+0.3%

Heap falls by the same proportion (ECDSA verify 10.4 → 6.8 MiB, BIP32 depth 5 30.7 → 21.8 MiB). Every other benchmark is unchanged (within 1%).

¹ Measured ad hoc. bench/ec_arith.bench.mo only uses scalars below 2⁵⁷, where GLV can't help (k₂ = 0) and costs ~85k instructions for the decomposition. A 256-bit column would make that benchmark representative.

Checks

• mops test --locked: 85 passed (same as main)
• mops bench --locked: no errors or warnings
• moc --check on src/: no warnings
• mops docs coverage: 100%
• mops publish --dry-run: OK, 35 files, release notes = 0.2.3 section

🤖 Generated with Claude Code