From e9aea318f5b9bbb7a2cba55b2829378d26bd4245 Mon Sep 17 00:00:00 2001
From: mjthatch <m.j.thatch@proton.me>
Date: Thu, 12 Nov 2026 15:43:19 +0000
Subject: [PATCH 1/6] site snapshot: read popovers and table bodies

Popover text is hidden until opened, so it is read regardless of visibility.
Header rows are skipped. Re-recorded against the unchanged pages.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QabhpThuWQEq1AZRZo24vm
---
 tests/site_snapshot.js   | 17 +++++++++++------
 tests/site_snapshot.json |  5 -----
 2 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/tests/site_snapshot.js b/tests/site_snapshot.js
index 0a7add7..29f0ba2 100644
--- a/tests/site_snapshot.js
+++ b/tests/site_snapshot.js
@@ -2,8 +2,8 @@
 // Checks that the site pages still show the numbers recorded in tests/site_snapshot.json.
 //
 // Each page is opened in Chromium for a fixed list of share links. The script
-// reads the result tables, info lines and inputs, and compares their numbers at the
-// precision shown.
+// reads the result tables, info lines, popovers and inputs, and compares their numbers
+// at the precision shown.
 //
 //   node tests/site_snapshot.js           compare; exit 1 if a number changed
 //   node tests/site_snapshot.js --update  record what the pages show now
@@ -39,7 +39,7 @@ const STATES = {
 const REGIONS = {
   'index.html': ['#stateless-table', '#xmss-table', '#uxmss-table', '.tuple'],
   'stateless.html': ['#initial-info', '#funnel', '#winner', '#custom-status', '#custom-result'],
-  'stateful.html': ['#schnorr-ref', '#compare-table', '#sweep-info', '#sweep-table'],
+  'stateful.html': ['#compare-table', '#sweep-info', '#sweep-table'],
 };
 const MAX_ROWS = 25;
 
@@ -49,13 +49,13 @@ function readPage({ regions, maxRows }) {
   const shown = el => el.getClientRects().length > 0 && getComputedStyle(el).visibility !== 'hidden';
   // Visible text with spaces around elements ("554<span>0.00×</span>" reads as two numbers)
   // and "^" before superscripts (2<sup>40</sup> reads as 2^40).
-  const textOf = (root, skipTables) => {
+  const textOf = (root, skipTables, hiddenToo = false) => {
     let s = '';
     (function walk(node) {
       for (const n of node.childNodes) {
         if (n.nodeType === Node.TEXT_NODE) {
           s += n.nodeValue;
-        } else if (n.nodeType === Node.ELEMENT_NODE && shown(n) && !n.matches('script, style') &&
+        } else if (n.nodeType === Node.ELEMENT_NODE && (hiddenToo || shown(n)) && !n.matches('script, style') &&
                    !(skipTables && n.tagName === 'TABLE')) {
           s += n.tagName === 'SUP' ? ' ^' : ' ';
           walk(n);
@@ -78,7 +78,7 @@ function readPage({ regions, maxRows }) {
       if (text) out[name] = text;
       const tables = el.tagName === 'TABLE' ? [el] : Array.from(el.querySelectorAll('table'));
       let r = 0;
-      for (const tr of tables.flatMap(t => Array.from(t.rows))) {
+      for (const tr of tables.flatMap(t => Array.from(t.tBodies).flatMap(b => Array.from(b.rows)))) {
         if (r === maxRows) break;
         if (!shown(tr)) continue;
         const cells = Array.from(tr.cells).filter(shown).map(c => textOf(c, false));
@@ -86,6 +86,11 @@ function readPage({ regions, maxRows }) {
       }
     });
   }
+  // Popovers stay hidden until opened.
+  for (const el of document.querySelectorAll('[popover][id]')) {
+    const text = textOf(el, false, true);
+    if (/\d/.test(text)) out[`popover #${el.id}`] = text;
+  }
   // Inputs carry the state a share link restores, so hidden ones count too.
   for (const el of document.querySelectorAll('input[id], select[id]')) {
     if (el.type === 'range') continue;  // mirrors the number box next to it
diff --git a/tests/site_snapshot.json b/tests/site_snapshot.json
index 91a31d7..0a93ff9 100644
--- a/tests/site_snapshot.json
+++ b/tests/site_snapshot.json
@@ -325,7 +325,6 @@
   "input #cust-w": "16"
  },
  "stateful.html": {
-  "#schnorr-ref": "The ρ ÷ Schnorr columns compare average-case C/B against BIP340 Schnorr verification ≈ 1.98 C/B (libsecp256k1, single verify over a 64 B wire signature; bip340-vs-sha256 : built-in 1.98 C/B — live kappa.json unreachable). SLH-DSA-128s baseline: 0.279 C/B = 0.141× Schnorr.",
   "#compare-table row 0": ["SLH-DSA-128s","7,856 B","292.4K","2.22M","—","2.2K","0.279","0.496","0.141×","2^64",""],
   "#compare-table row 1": ["UXMSS (WOTS, w=16) sig grows with index — worst case shown (255 auth nodes); capacity 256 sigs","594–4,665 B 0.59×","146.2K 0.50×","554 0.00×","4,096 B","536 0.24×","0.475→0.115 0.41×","0.884→0.167 0.34×","0.240→0.058×","256","×"],
   "#compare-table row 2": ["UXMSS (WOTS+C, w=16) sig grows with index — worst case shown (255 auth nodes); capacity 256 sigs","548–4,619 B 0.59×","133.6K 0.46×","599 0.00×","4,096 B","509 0.23×","0.465→0.110 0.39×","0.465→0.110 0.22×","0.235→0.056×","256","×"],
@@ -378,7 +377,6 @@
   "input #sw-W-cb-val": "1.0"
  },
  "stateful.html#m=cold": {
-  "#schnorr-ref": "The ρ ÷ Schnorr columns compare average-case C/B against BIP340 Schnorr verification ≈ 1.98 C/B (libsecp256k1, single verify over a 64 B wire signature; bip340-vs-sha256 : built-in 1.98 C/B — live kappa.json unreachable). SLH-DSA-128s baseline: 0.279 C/B = 0.141× Schnorr.",
   "#compare-table row 0": ["SLH-DSA-128s","7,856 B","292.4K","2.22M","—","2.2K","0.279","0.496","0.141×","2^64",""],
   "#compare-table row 1": ["UXMSS (WOTS, w=16) sig grows with index — worst case shown (255 auth nodes); capacity 256 sigs","594–4,665 B 0.59×","146.2K 0.50×","145.9K 0.07×","—","536 0.24×","0.475→0.115 0.41×","0.884→0.167 0.34×","0.240→0.058×","256","×"],
   "#compare-table row 2": ["UXMSS (WOTS+C, w=16) sig grows with index — worst case shown (255 auth nodes); capacity 256 sigs","548–4,619 B 0.59×","133.6K 0.46×","133.5K 0.06×","—","509 0.23×","0.465→0.110 0.39×","0.465→0.110 0.22×","0.235→0.056×","256","×"],
@@ -431,7 +429,6 @@
   "input #sw-W-cb-val": "1.0"
  },
  "stateful.html#b=0.5,20,20,2,20,20&w=5,1,1,2,1&sort=size.asc": {
-  "#schnorr-ref": "The ρ ÷ Schnorr columns compare average-case C/B against BIP340 Schnorr verification ≈ 1.98 C/B (libsecp256k1, single verify over a 64 B wire signature; bip340-vs-sha256 : built-in 1.98 C/B — live kappa.json unreachable). SLH-DSA-128s baseline: 0.279 C/B = 0.141× Schnorr.",
   "#compare-table row 0": ["SLH-DSA-128s","7,856 B","292.4K","2.22M","—","2.2K","0.279","0.496","0.141×","2^64",""],
   "#compare-table row 1": ["UXMSS (WOTS, w=16) sig grows with index — worst case shown (255 auth nodes); capacity 256 sigs","594–4,665 B 0.59×","146.2K 0.50×","554 0.00×","4,096 B","536 0.24×","0.475→0.115 0.41×","0.884→0.167 0.34×","0.240→0.058×","256","×"],
   "#compare-table row 2": ["UXMSS (WOTS+C, w=16) sig grows with index — worst case shown (255 auth nodes); capacity 256 sigs","548–4,619 B 0.59×","133.6K 0.46×","599 0.00×","4,096 B","509 0.23×","0.465→0.110 0.39×","0.465→0.110 0.22×","0.235→0.056×","256","×"],
@@ -484,7 +481,6 @@
   "input #sw-W-cb-val": "1.0"
  },
  "stateful.html#b=1,20,20,1.5,20,30&w=5,1,1,2,1": {
-  "#schnorr-ref": "The ρ ÷ Schnorr columns compare average-case C/B against BIP340 Schnorr verification ≈ 1.98 C/B (libsecp256k1, single verify over a 64 B wire signature; bip340-vs-sha256 : built-in 1.98 C/B — live kappa.json unreachable). SLH-DSA-128s baseline: 0.279 C/B = 0.141× Schnorr.",
   "#compare-table row 0": ["SLH-DSA-128s","7,856 B","292.4K","2.22M","—","2.2K","0.279","0.496","0.141×","2^64",""],
   "#compare-table row 1": ["UXMSS (WOTS, w=16) sig grows with index — worst case shown (255 auth nodes); capacity 256 sigs","594–4,665 B 0.59×","146.2K 0.50×","554 0.00×","4,096 B","536 0.24×","0.475→0.115 0.41×","0.884→0.167 0.34×","0.240→0.058×","256","×"],
   "#compare-table row 2": ["UXMSS (WOTS+C, w=16) sig grows with index — worst case shown (255 auth nodes); capacity 256 sigs","548–4,619 B 0.59×","133.6K 0.46×","599 0.00×","4,096 B","509 0.23×","0.465→0.110 0.39×","0.465→0.110 0.22×","0.235→0.056×","256","×"],
@@ -537,7 +533,6 @@
   "input #sw-W-cb-val": "1.0"
  },
  "stateful.html#cand=uxmss-WC-64,xmssmt-WC-64-20-1": {
-  "#schnorr-ref": "The ρ ÷ Schnorr columns compare average-case C/B against BIP340 Schnorr verification ≈ 1.98 C/B (libsecp256k1, single verify over a 64 B wire signature; bip340-vs-sha256 : built-in 1.98 C/B — live kappa.json unreachable). SLH-DSA-128s baseline: 0.279 C/B = 0.141× Schnorr.",
   "#compare-table row 0": ["SLH-DSA-128s","7,856 B","292.4K","2.22M","—","2.2K","0.279","0.496","0.141×","2^64",""],
   "#compare-table row 1": ["UXMSS (WOTS+C, w=64) sig grows with index — worst case shown (255 auth nodes); capacity 256 sigs","388–4,459 B 0.57×","362.2K 1.24×","1.2K 0.00×","4,096 B","959 0.44×","1.817→0.215 0.77×","1.817→0.215 0.43×","0.918→0.109×","256","×"],
   "#compare-table row 2": ["XMSS-2^20 (WOTS+C, w=64, d=1)","694 B 0.09×","1.48G 5.1e+3×","15.1K 0.01×","1,056 B","724 0.33×","1.043 3.74×","1.043 2.11×","0.527×","2^20","×"],

From 77076109fa0798e5c53486f500bb0abc2ae3d8ff Mon Sep 17 00:00:00 2001
From: mjthatch <m.j.thatch@proton.me>
Date: Thu, 12 Nov 2026 15:43:37 +0000
Subject: [PATCH 2/6] site: add shared number formats, popovers and glossary

js/ui.js and style.css, used by the pages from the next commits on.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QabhpThuWQEq1AZRZo24vm
---
 site/js/ui.js  | 102 +++++++++++++++++++++++++++++++++++++++++++++++++
 site/style.css |  54 ++++++++++++++++++++++++++
 2 files changed, 156 insertions(+)
 create mode 100644 site/js/ui.js
 create mode 100644 site/style.css

diff --git a/site/js/ui.js b/site/js/ui.js
new file mode 100644
index 0000000..1deb126
--- /dev/null
+++ b/site/js/ui.js
@@ -0,0 +1,102 @@
+// Number formats, popovers and the glossary.
+'use strict';
+
+// Number formats
+
+// Compressions and bytes: exact up to six digits, compact above, with the exact value on hover. Returns HTML.
+function fmtNum(n) {
+  if (!isFinite(n)) return '—';
+  n = Math.round(n);
+  const exact = n.toLocaleString('en-US');
+  if (n < 1e6) return exact;
+  for (const [unit, size] of [['M', 1e6], ['G', 1e9], ['T', 1e12], ['P', 1e15]]) {
+    const v = (n / size).toPrecision(3);
+    if (Number(v) < 1000) return `<span title="${exact}">${v}${unit}</span>`;
+  }
+  return `<span title="${exact}">${n.toExponential(2)}</span>`;
+}
+
+// Ratios to a reference value, to three significant digits.
+function fmtRatio(r) {
+  if (r >= 100) return Math.round(r).toLocaleString('en-US') + '×';
+  return r.toPrecision(3) + '×';
+}
+
+// ρ, in compressions per signature byte.
+function fmtRho(r) {
+  return r.toFixed(4);
+}
+
+function fmtPow2(e) {
+  return `2<sup>${e}</sup>`;
+}
+
+// Popovers: <button class="info" popovertarget="ID" aria-label="About …">i</button> opens
+// <div class="pop" id="ID" popover>…</div>. The browser opens and closes the popover;
+// this code only places it next to its button.
+
+function infoButton(id, label) {
+  return `<button type="button" class="info" popovertarget="${id}" aria-label="${label}">i</button>`;
+}
+
+(function () {
+  if (!('popover' in HTMLElement.prototype)) return;  // older browsers show the content inline
+  let opener = null;
+  document.addEventListener('click', e => {
+    const b = e.target.closest && e.target.closest('[popovertarget]');
+    if (b) opener = b;
+  }, true);
+
+  function place(pop) {
+    const btn = opener && opener.isConnected && opener.getAttribute('popovertarget') === pop.id
+      ? opener : document.querySelector(`[popovertarget="${pop.id}"]`);
+    if (!btn) return;
+    const r = btn.getBoundingClientRect(), gap = 6, edge = 8;
+    const left = Math.max(edge, Math.min(r.left, innerWidth - pop.offsetWidth - edge));
+    let top = r.bottom + gap;
+    if (top + pop.offsetHeight > innerHeight - edge && r.top - gap - pop.offsetHeight >= edge) {
+      top = r.top - gap - pop.offsetHeight;
+    }
+    pop.style.left = `${left}px`;
+    pop.style.top = `${Math.max(edge, top)}px`;
+  }
+
+  // toggle does not bubble, so listen in the capture phase.
+  document.addEventListener('toggle', e => {
+    if (e.newState === 'open' && e.target.classList.contains('pop')) place(e.target);
+  }, true);
+  const placeOpen = () => document.querySelectorAll('.pop:popover-open').forEach(place);
+  addEventListener('resize', placeOpen);
+  addEventListener('scroll', placeOpen, true);
+})();
+
+// Glossary
+
+document.body.insertAdjacentHTML('beforeend', `
+<div class="pop pop-wide" id="glossary" popover>
+  <h3>Glossary</h3>
+  <dl>
+    <dt>C</dt>
+    <dd>One SHA-256 compression. Costs count compressions; the PK.seed block is compressed once per key and reused.</dd>
+    <dt>B</dt>
+    <dd>Byte.</dd>
+    <dt>KeyGen, SigGen, SigVer</dt>
+    <dd>Compressions to generate a key pair, to sign a message and to verify a signature. SigVer is the average unless marked worst.</dd>
+    <dt>ρ</dt>
+    <dd>SigVer per signature byte, in C/B.</dd>
+    <dt>ρ ÷ Schnorr</dt>
+    <dd>ρ divided by the ρ of a BIP340 Schnorr verification (libsecp256k1, 64-byte signature).</dd>
+    <dt>SLH-DSA-128s</dt>
+    <dd>The FIPS 205 parameter set (h, d, k, a, w) = (63, 7, 14, 12, 16). Ratios (×) compare against it.</dd>
+    <dt>h, d, k, a, w</dt>
+    <dd>Hypertree height, number of layers, FORS trees, FORS tree height, Winternitz parameter. h′ = h/d is the height of one layer.</dd>
+    <dt>q<sub>s</sub></dt>
+    <dd>The number of signatures per key that security is computed for: 2<sup>40</sup> for the stateless schemes.</dd>
+    <dt>WOTS, WOTS+C</dt>
+    <dd>Winternitz one-time signatures. WOTS (as in SLH-DSA) has checksum chains; WOTS+C replaces them with a counter that the signer grinds until the message digits have a fixed sum, so verification always costs the same.</dd>
+    <dt>XMSS, XMSS-MT, UXMSS</dt>
+    <dd>Stateful schemes: one balanced Merkle tree (BXMSS in SHRINCS), d layers of such trees, and the unbalanced SHRINCS tree, whose signatures grow by one node per signature.</dd>
+    <dt>Cached, cold</dt>
+    <dd>A cached signer keeps tree state between signatures (a BDS state for XMSS, a leaf cache for UXMSS); a cold signer keeps none and rebuilds its trees for every signature.</dd>
+  </dl>
+</div>`);
diff --git a/site/style.css b/site/style.css
new file mode 100644
index 0000000..b34c2a4
--- /dev/null
+++ b/site/style.css
@@ -0,0 +1,54 @@
+/* Shared by the three site pages. Colours come from each page's :root. */
+
+/* Page header */
+.crumbs { margin-bottom: 4px; font-size: 12px; color: var(--text-mute); }
+.crumbs a { color: var(--accent); text-decoration: none; }
+.crumbs a:hover { text-decoration: underline; }
+.text-btn {
+  padding: 0; border: 0; background: none; font: inherit;
+  color: var(--accent); cursor: pointer;
+}
+.text-btn:hover { text-decoration: underline; }
+
+/* info button */
+.info {
+  display: inline-grid; place-items: center;
+  width: 15px; height: 15px; margin-left: 5px; padding: 0;
+  border: 1px solid currentColor; border-radius: 50%;
+  background: none; color: var(--text-mute);
+  font: italic 600 10px/1 Georgia, 'Times New Roman', serif;
+  letter-spacing: 0; text-transform: none;
+  vertical-align: 1px; cursor: pointer;
+}
+.info:hover, .info:focus-visible { color: var(--accent); }
+
+/* Popover: placed next to its button by js/ui.js. Inherited table-header styles are reset. */
+.pop {
+  position: fixed; inset: auto; margin: 0;
+  width: max-content; max-width: min(24rem, calc(100vw - 16px));
+  max-height: calc(100vh - 16px); overflow: auto;
+  padding: 10px 12px; border: 1px solid var(--border); border-radius: 6px;
+  background: var(--panel); color: var(--text);
+  box-shadow: 0 8px 24px rgba(0, 0, 0, 0.12);
+  font: 400 13px/1.5 -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
+  text-align: left; text-transform: none; letter-spacing: normal; white-space: normal;
+}
+.pop-wide { max-width: min(34rem, calc(100vw - 16px)); }
+.pop p { margin: 0; }
+.pop p + p, .pop p + ul, .pop ul + p { margin-top: 6px; }
+.pop ul { margin: 0; padding-left: 18px; }
+.pop h3 { margin: 0 0 6px; font-size: 13px; font-weight: 600; }
+.pop a { color: var(--accent); }
+.pop code { font-family: var(--mono); font-size: 12px; }
+
+/* Glossary */
+.pop dl { margin: 0; display: grid; grid-template-columns: max-content 1fr; gap: 4px 12px; }
+.pop dt { font-weight: 600; white-space: nowrap; }
+.pop dd { margin: 0; color: var(--text-soft); }
+@media (max-width: 520px) {
+  .pop dl { grid-template-columns: 1fr; gap: 0; }
+  .pop dd { margin-bottom: 6px; }
+}
+
+/* Names whose case matters */
+.keep-case { text-transform: none; }

From 5d347206d31218c41bf83ee5e6c689e41860468f Mon Sep 17 00:00:00 2001
From: mjthatch <m.j.thatch@proton.me>
Date: Thu, 12 Nov 2026 15:44:07 +0000
Subject: [PATCH 3/6] index.html: popovers, metric names, number format
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The footer moves into card popovers and the glossary. Rows use KeyGen, SigGen,
SigVer and ρ with the unit in the label.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QabhpThuWQEq1AZRZo24vm
---
 site/index.html          | 106 ++++++++++++++++++++-------------------
 tests/site_snapshot.json |  59 ++++++++++++----------
 2 files changed, 87 insertions(+), 78 deletions(-)

diff --git a/site/index.html b/site/index.html
index 6b112b0..6ac4701 100644
--- a/site/index.html
+++ b/site/index.html
@@ -4,9 +4,10 @@
 <head>
   <meta charset="UTF-8">
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
-  <title>Pinned parameters for SHRINCS</title>
+  <title>SHRINCS pinned parameters</title>
   <link rel="icon"
     href="data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 100 100'><text y='.9em' font-size='90'>🦐</text></svg>">
+  <link rel="stylesheet" href="style.css">
   <style>
     :root {
       --bg: #f7f7f5;
@@ -36,7 +37,7 @@
 
     body { padding: 24px; }
 
-    header, main, footer { max-width: 820px; margin: 0 auto; }
+    header, main { max-width: 820px; margin: 0 auto; }
     header { margin-bottom: 16px; }
 
     h1 {
@@ -149,12 +150,6 @@
       font-size: 13px;
     }
 
-    footer {
-      margin-top: 20px;
-      color: var(--text-mute);
-      font-size: 12px;
-    }
-
     @media (max-width: 720px) {
       .cards { grid-template-columns: 1fr; }
     }
@@ -164,9 +159,11 @@
 <body>
 
   <header>
-    <h1>Pinned parameters for SHRINCS</h1>
+    <h1>SHRINCS pinned parameters</h1>
     <p class="tagline">
-      Pinned parameters for the SHRINCS signature. Parameter explorer is available by <a href="stateless.html">Stateless</a> and <a href="stateful.html">Stateful</a> subpages.
+      Compare alternatives in the
+      <a href="stateless.html">Parameter Explorer</a> and the <a href="stateful.html">Stateful Comparison</a>.
+      <button type="button" class="text-btn" popovertarget="glossary">Glossary</button>
     </p>
   </header>
 
@@ -174,47 +171,53 @@ <h1>Pinned parameters for SHRINCS</h1>
     <div class="cards">
 
       <div class="card">
-        <h2>Stateless</h2>
+        <h2>Stateless <button type="button" class="info" popovertarget="about-stateless" aria-label="About the stateless parameters">i</button></h2>
+        <div class="pop" id="about-stateless" popover>
+          <p>Candidate 1 of the report. The size includes the one-byte SHRINCS indicator.</p>
+        </div>
         <p class="tuple">(h, d, k, a, w) = (45, 5, 10, 13, 16)</p>
         <table class="metrics" id="stateless-table"></table>
         <div class="card-link">
-          <a id="stateless-link" href="stateless.html#c=45,5,10,13,16">Inspect in the Parameter Explorer</a>
+          <a id="stateless-link" href="stateless.html#c=45,5,10,13,16">Open in the Parameter Explorer</a>
         </div>
       </div>
 
       <div class="card">
-        <h2>Stateful, BXMSS</h2>
-        <p class="tuple" id="xmss-tuple">XMSS (w=64, WOTS+C, h = 20)</p>
+        <h2>Stateful, XMSS <button type="button" class="info" popovertarget="about-xmss" aria-label="About the XMSS parameters">i</button></h2>
+        <div class="pop" id="about-xmss" popover>
+          <p>The cached SigGen and the state are BDS upper bounds per signature.</p>
+        </div>
+        <p class="tuple" id="xmss-tuple">WOTS+C, w = 64, h = 20</p>
         <div class="h-control">
           <label>
             <span class="name">Tree height h</span>
             <input type="number" class="val-input" id="xmss-h-val" min="2" max="20" step="1" value="20">
           </label>
-          <input type="range" id="xmss-h" min="2" max="20" step="1" value="20">
+          <input type="range" id="xmss-h" min="2" max="20" step="1" value="20" aria-label="Tree height h">
         </div>
         <table class="metrics" id="xmss-table"></table>
         <div class="card-link">
-          <a id="xmss-link" href="stateful.html#cand=xmssmt-WC-64-20-1,uxmss-WC-64">Inspect in the Parameter Explorer</a>
+          <a id="xmss-link" href="stateful.html#cand=xmssmt-WC-64-20-1,uxmss-WC-64">Open in the Stateful Comparison</a>
         </div>
       </div>
 
       <div class="card">
-        <h2>Stateful, UXMSS</h2>
-        <p class="tuple">UXMSS (w=64, WOTS+C)</p>
+        <h2>Stateful, UXMSS <button type="button" class="info" popovertarget="about-uxmss" aria-label="About the UXMSS parameters">i</button></h2>
+        <div class="pop" id="about-uxmss" popover>
+          <p>Ranges go from the first to the last signature. Each signature carries one more 16-byte node
+            than the one before, so size and SigVer grow while ρ and the cached SigGen fall.</p>
+        </div>
+        <p class="tuple">WOTS+C, w = 64</p>
         <table class="metrics" id="uxmss-table"></table>
         <div class="card-link">
-          <a href="stateful.html#cand=xmssmt-WC-64-20-1,uxmss-WC-64">Inspect in the Parameter Explorer</a>
+          <a href="stateful.html#cand=xmssmt-WC-64-20-1,uxmss-WC-64">Open in the Stateful Comparison</a>
         </div>
       </div>
 
     </div>
   </main>
 
-  <footer>
-    All costs are SHA-256 compression calls with the PK.seed block midstate-cached. Sizes include the one-byte SHRINCS indicator.
-    Ranges on UXMSS rows are first-last signature; the cached XMSS signing cost and cache size are BDS upper bounds.
-  </footer>
-
+  <script src="js/ui.js"></script>
   <script src="formulas.js"></script>
 <script>
 'use strict';
@@ -248,15 +251,15 @@ <h2>Stateful, UXMSS</h2>
   const size = shrincsStatelessSize(PINNED);
   const cb = m.sv / size, cbW = m.svWorst / size;
   document.getElementById('stateless-table').innerHTML = [
-    row('Signature Size', fmtBytes(size)),
-    row('Key Generation', fmtCompressions(m.kg) + ' C'),
-    row('Signature Generation', fmtCompressions(m.sg) + ' C'),
-    row('Signature Verification (average)', m.sv.toLocaleString() + ' C'),
-    row('Signature Verification (worst case)', m.svWorst.toLocaleString() + ' C'),
-    row('Compression-per-byte verification complexity (average)', fmtCpb(cb)),
-    row('Compression-per-byte verification complexity (worst case)', fmtCpb(cbW)),
-    row('C/B comparing to BIP-340 verification (max)', fmtCpb(cbW / SCHNORR.cb64) + '×'),
-    row('Signature Budget', '2^40'),
+    row('Max signatures', fmtPow2(40)),
+    row('Size (B)', fmtNum(size)),
+    row('KeyGen (C)', fmtNum(m.kg)),
+    row('SigGen (C)', fmtNum(m.sg)),
+    row('SigVer (C)', fmtNum(m.sv)),
+    row('SigVer, worst (C)', fmtNum(m.svWorst)),
+    row('ρ (C/B)', fmtRho(cb)),
+    row('ρ, worst (C/B)', fmtRho(cbW)),
+    row('ρ ÷ Schnorr, worst', fmtRatio(cbW / SCHNORR.cb64)),
   ].join('');
 }
 
@@ -270,16 +273,17 @@ <h2>Stateful, UXMSS</h2>
   const st = xmssMtStateBytes(h, 1, XMSS_W, 'WC');
   const sv = xmssMtVerifyC(h, 1, XMSS_W, swn, 'WC');
   const cb = sv / size;
-  document.getElementById('xmss-tuple').textContent = `XMSS (w=${XMSS_W}, WOTS+C, h = ${h})`;
+  document.getElementById('xmss-tuple').textContent = `WOTS+C, w = ${XMSS_W}, h = ${h}`;
   document.getElementById('xmss-table').innerHTML = [
-    row('Signature Budget', `2^${h} signatures`),
-    row('Signature Size', fmtBytes(size)),
-    row('Key Generation', fmtCompressions(kg) + ' C'),
-    row('Signature Generation (with cache / cold)', `${fmtCompressions(sg)} / ${fmtCompressions(sgCold)} C`),
-    row('Cache Size', fmtBytes(st)),
-    row('Signature Verification', sv.toLocaleString() + ' C'),
-    row('Compression-per-Byte Verification Complexity', fmtCpb(cb)),
-    row('C/B Comparing to BIP-340 Verification', fmtCpb(cb / SCHNORR.cb64) + '×'),
+    row('Max signatures', fmtPow2(h)),
+    row('Size (B)', fmtNum(size)),
+    row('KeyGen (C)', fmtNum(kg)),
+    row('SigGen, cached (C)', fmtNum(sg)),
+    row('SigGen, cold (C)', fmtNum(sgCold)),
+    row('State (B)', fmtNum(st)),
+    row('SigVer (C)', fmtNum(sv)),
+    row('ρ (C/B)', fmtRho(cb)),
+    row('ρ ÷ Schnorr', fmtRatio(cb / SCHNORR.cb64)),
   ].join('');
   const link = document.getElementById('xmss-link');
   link.href = `stateful.html#cand=xmssmt-WC-${XMSS_W}-${h}-1,uxmss-WC-${XMSS_W}`;
@@ -298,15 +302,15 @@ <h2>Stateful, UXMSS</h2>
   const svMax = uxmssVerifyC(hsf, hsf, XMSS_W, swn, 'WC');
   const cb1 = sv1 / sz1, cbMax = svMax / szMax;
   document.getElementById('uxmss-table').innerHTML = [
-    row('Signature Budget', `${(hsf + 1).toLocaleString()} signatures`),
-    row('Signature Size', `${sz1.toLocaleString()} – ${szMax.toLocaleString()} B`),
-    row('Key Generation', fmtCompressions(kg) + ' C'),
-    row('Signature Generation (with cache / cold)',
-        `${sg1.toLocaleString()} – ${sgLast.toLocaleString()} / ${fmtCompressions(sgCold)} C`),
-    row('Cache Size', fmtBytes((hsf + 1) * N)),
-    row('Signature Verification', `${sv1.toLocaleString()} – ${svMax.toLocaleString()} C`),
-    row('Compression-per-Byte Verification Complexity', `${fmtCpb(cb1)} - ${fmtCpb(cbMax)}`),
-    row('C/B Comparing to BIP-340 Verification', `${fmtCpb(cb1 / SCHNORR.cb64)} - ${fmtCpb(cbMax / SCHNORR.cb64)}×`),
+    row('Max signatures', fmtNum(hsf + 1)),
+    row('Size (B)', `${fmtNum(sz1)} → ${fmtNum(szMax)}`),
+    row('KeyGen (C)', fmtNum(kg)),
+    row('SigGen, cached (C)', `${fmtNum(sg1)} → ${fmtNum(sgLast)}`),
+    row('SigGen, cold (C)', fmtNum(sgCold)),
+    row('State (B)', fmtNum((hsf + 1) * N)),
+    row('SigVer (C)', `${fmtNum(sv1)} → ${fmtNum(svMax)}`),
+    row('ρ (C/B)', `${fmtRho(cb1)} → ${fmtRho(cbMax)}`),
+    row('ρ ÷ Schnorr', `${fmtRatio(cb1 / SCHNORR.cb64)} → ${fmtRatio(cbMax / SCHNORR.cb64)}`),
   ].join('');
 }
 
diff --git a/tests/site_snapshot.json b/tests/site_snapshot.json
index 0a93ff9..a1856bb 100644
--- a/tests/site_snapshot.json
+++ b/tests/site_snapshot.json
@@ -1,33 +1,38 @@
 {
  "index.html": {
-  "#stateless-table row 0": ["Signature Size","5,777 B"],
-  "#stateless-table row 1": ["Key Generation","292.4K C"],
-  "#stateless-table row 2": ["Signature Generation","1.71M C"],
-  "#stateless-table row 3": ["Signature Verification (average)","1,578 C"],
-  "#stateless-table row 4": ["Signature Verification (worst case)","2,792 C"],
-  "#stateless-table row 5": ["Compression-per-byte verification complexity (average)","0.273"],
-  "#stateless-table row 6": ["Compression-per-byte verification complexity (worst case)","0.483"],
-  "#stateless-table row 7": ["C/B comparing to BIP-340 verification (max)","0.244×"],
-  "#stateless-table row 8": ["Signature Budget","2^40"],
-  "#xmss-table row 0": ["Signature Budget","2^20 signatures"],
-  "#xmss-table row 1": ["Signature Size","694 B"],
-  "#xmss-table row 2": ["Key Generation","1.48G C"],
-  "#xmss-table row 3": ["Signature Generation (with cache / cold)","15.1K / 1.48G C"],
-  "#xmss-table row 4": ["Cache Size","1,056 B"],
-  "#xmss-table row 5": ["Signature Verification","724 C"],
-  "#xmss-table row 6": ["Compression-per-Byte Verification Complexity","1.043"],
-  "#xmss-table row 7": ["C/B Comparing to BIP-340 Verification","0.527×"],
-  "#uxmss-table row 0": ["Signature Budget","256 signatures"],
-  "#uxmss-table row 1": ["Signature Size","388 – 4,459 B"],
-  "#uxmss-table row 2": ["Key Generation","362.2K C"],
-  "#uxmss-table row 3": ["Signature Generation (with cache / cold)","1,195 – 941 / 361.8K C"],
-  "#uxmss-table row 4": ["Cache Size","4,096 B"],
-  "#uxmss-table row 5": ["Signature Verification","705 – 959 C"],
-  "#uxmss-table row 6": ["Compression-per-Byte Verification Complexity","1.817 - 0.215"],
-  "#uxmss-table row 7": ["C/B Comparing to BIP-340 Verification","0.918 - 0.109×"],
+  "#stateless-table row 0": ["Max signatures","2 ^40"],
+  "#stateless-table row 1": ["Size (B)","5,777"],
+  "#stateless-table row 2": ["KeyGen (C)","292,351"],
+  "#stateless-table row 3": ["SigGen (C)","1.71M"],
+  "#stateless-table row 4": ["SigVer (C)","1,578"],
+  "#stateless-table row 5": ["SigVer, worst (C)","2,792"],
+  "#stateless-table row 6": ["ρ (C/B)","0.2732"],
+  "#stateless-table row 7": ["ρ, worst (C/B)","0.4833"],
+  "#stateless-table row 8": ["ρ ÷ Schnorr, worst","0.244×"],
+  "#xmss-table row 0": ["Max signatures","2 ^20"],
+  "#xmss-table row 1": ["Size (B)","694"],
+  "#xmss-table row 2": ["KeyGen (C)","1.48G"],
+  "#xmss-table row 3": ["SigGen, cached (C)","15,107"],
+  "#xmss-table row 4": ["SigGen, cold (C)","1.48G"],
+  "#xmss-table row 5": ["State (B)","1,056"],
+  "#xmss-table row 6": ["SigVer (C)","724"],
+  "#xmss-table row 7": ["ρ (C/B)","1.0432"],
+  "#xmss-table row 8": ["ρ ÷ Schnorr","0.527×"],
+  "#uxmss-table row 0": ["Max signatures","256"],
+  "#uxmss-table row 1": ["Size (B)","388 → 4,459"],
+  "#uxmss-table row 2": ["KeyGen (C)","362,239"],
+  "#uxmss-table row 3": ["SigGen, cached (C)","1,195 → 941"],
+  "#uxmss-table row 4": ["SigGen, cold (C)","361,765"],
+  "#uxmss-table row 5": ["State (B)","4,096"],
+  "#uxmss-table row 6": ["SigVer (C)","705 → 959"],
+  "#uxmss-table row 7": ["ρ (C/B)","1.8170 → 0.2151"],
+  "#uxmss-table row 8": ["ρ ÷ Schnorr","0.918× → 0.109×"],
   ".tuple[0]": "(h, d, k, a, w) = (45, 5, 10, 13, 16)",
-  ".tuple[1]": "XMSS (w=64, WOTS+C, h = 20)",
-  ".tuple[2]": "UXMSS (w=64, WOTS+C)",
+  ".tuple[1]": "WOTS+C, w = 64, h = 20",
+  ".tuple[2]": "WOTS+C, w = 64",
+  "popover #about-stateless": "Candidate 1 of the report. The size includes the one-byte SHRINCS indicator.",
+  "popover #about-uxmss": "Ranges go from the first to the last signature. Each signature carries one more 16-byte node than the one before, so size and SigVer grow while ρ and the cached SigGen fall.",
+  "popover #glossary": "Glossary C One SHA-256 compression. Costs count compressions; the PK.seed block is compressed once per key and reused. B Byte. KeyGen, SigGen, SigVer Compressions to generate a key pair, to sign a message and to verify a signature. SigVer is the average unless marked worst. ρ SigVer per signature byte, in C/B. ρ ÷ Schnorr ρ divided by the ρ of a BIP340 Schnorr verification (libsecp256k1, 64-byte signature). SLH-DSA-128s The FIPS 205 parameter set (h, d, k, a, w) = (63, 7, 14, 12, 16). Ratios (×) compare against it. h, d, k, a, w Hypertree height, number of layers, FORS trees, FORS tree height, Winternitz parameter. h′ = h/d is the height of one layer. q s The number of signatures per key that security is computed for: 2 ^40 for the stateless schemes. WOTS, WOTS+C Winternitz one-time signatures. WOTS (as in SLH-DSA) has checksum chains; WOTS+C replaces them with a counter that the signer grinds until the message digits have a fixed sum, so verification always costs the same. XMSS, XMSS-MT, UXMSS Stateful schemes: one balanced Merkle tree (BXMSS in SHRINCS), d layers of such trees, and the unbalanced SHRINCS tree, whose signatures grow by one node per signature. Cached, cold A cached signer keeps tree state between signatures (a BDS state for XMSS, a leaf cache for UXMSS); a cold signer keeps none and rebuilds its trees for every signature.",
   "input #xmss-h-val": "20"
  },
  "stateless.html": {

From 0e060a8e57b67bf6baf971613d75c984bec5e2ad Mon Sep 17 00:00:00 2001
From: mjthatch <m.j.thatch@proton.me>
Date: Thu, 12 Nov 2026 15:44:36 +0000
Subject: [PATCH 4/6] stateful.html: popovers, metric names, number format

The notes move into popovers on the column headers; candidates are named XMSS or
XMSS-MT. The add form stays hidden on load, the comparison table fits its panel,
sliders have accessible names and the CSV columns match the explorer's.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QabhpThuWQEq1AZRZo24vm
---
 site/stateful.html       | 260 ++++++++++++++--------------
 tests/site_snapshot.json | 357 +++++++++++++++++++++------------------
 2 files changed, 332 insertions(+), 285 deletions(-)

diff --git a/site/stateful.html b/site/stateful.html
index ede29ca..3acba48 100644
--- a/site/stateful.html
+++ b/site/stateful.html
@@ -4,6 +4,7 @@
 <meta charset="UTF-8">
 <meta name="viewport" content="width=device-width, initial-scale=1.0">
 <title>SHRINCS Stateful Comparison</title>
+<link rel="stylesheet" href="style.css">
 <link rel="icon" href="data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 100 100'><text y='.9em' font-size='90'>🦐</text></svg>">
 <style>
   :root {
@@ -26,9 +27,6 @@
   html, body { margin: 0; padding: 0; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; background: var(--bg); color: var(--text); line-height: 1.5; }
   body { padding: 24px; }
   header { max-width: 1280px; margin: 0 auto 20px; }
-  .breadcrumb { font-size: 13px; color: var(--text-soft); margin-bottom: 8px; }
-  .breadcrumb a { color: var(--accent); text-decoration: none; }
-  .breadcrumb a:hover { text-decoration: underline; }
   h1 { margin: 0 0 6px; font-size: 22px; font-weight: 600; letter-spacing: -0.01em; }
   .tagline { color: var(--text-soft); margin: 0; font-size: 14px; }
 
@@ -36,8 +34,8 @@
 
   .panel { background: var(--panel); border: 1px solid var(--border); border-radius: 8px; padding: 16px; }
   .panel + .panel { margin-top: 16px; }
-  .panel h2 { margin: 0 0 4px; font-size: 11px; text-transform: uppercase; letter-spacing: 0.06em; color: var(--text-soft); font-weight: 600; }
-  .panel .hint { margin: 0 0 12px; color: var(--text-mute); font-size: 12px; }
+  .panel h2 { margin: 0 0 8px; font-size: 11px; text-transform: uppercase; letter-spacing: 0.06em; color: var(--text-soft); font-weight: 600; }
+  .panel .hint { margin: -4px 0 12px; color: var(--text-mute); font-size: 12px; }
 
   /* Comparison table */
   .compare-wrap { overflow-x: auto; margin: 0 -4px; padding: 0 4px; }
@@ -55,6 +53,8 @@
     vertical-align: top;
   }
   table.compare thead th {
+    white-space: normal;
+    vertical-align: bottom;
     color: var(--text-soft);
     font-weight: 600;
     font-size: 11px;
@@ -75,7 +75,6 @@
   }
   table.compare thead th.cand-col { background: var(--bg); }
   .cand-title { font-size: 12px; font-weight: 600; display: block; color: var(--text); }
-  .cand-sub { font-size: 10px; color: var(--text-soft); font-weight: 400; display: block; margin-top: 1px; }
   /* Last column: actions */
   table.compare th.act-col, table.compare td.act-col {
     text-align: center;
@@ -113,6 +112,7 @@
   .btn.btn-ghost { background: var(--bg); color: var(--text); border: 1px solid var(--border); }
   .btn.btn-ghost:hover { background: var(--accent-soft); color: var(--accent); }
 
+  .add-form[hidden] { display: none; }
   .add-form {
     display: grid;
     grid-template-columns: repeat(auto-fit, minmax(140px, 1fr));
@@ -303,10 +303,11 @@
 <body>
 
 <header>
-  <div class="breadcrumb"><a href="index.html">← SHRINCS recommended parameters</a> &nbsp;·&nbsp; <a href="stateless.html">Parameter Explorer</a></div>
-  <h1>Stateful Scheme Comparison</h1>
+  <nav class="crumbs"><a href="index.html">SHRINCS pinned parameters</a> › <a href="stateless.html">Parameter Explorer</a> · Stateful Comparison</nav>
+  <h1>SHRINCS Stateful Comparison</h1>
   <p class="tagline">
-    Comparison of stateful signature candidates. You can add and compare your own by clicking <strong>+ Add candidate</strong>.
+    Compare stateful schemes with SLH-DSA-128s, or add your own with <strong>+ Add candidate</strong>.
+    <button type="button" class="text-btn" popovertarget="glossary">Glossary</button>
   </p>
 </header>
 
@@ -316,33 +317,39 @@ <h1>Stateful Scheme Comparison</h1>
     <div class="actions">
       <button class="btn" id="show-add">+ Add candidate</button>
       <button class="btn btn-ghost" id="reset-defaults">Reset to defaults</button>
-      <button class="btn btn-ghost" id="share-btn" title="Copy a link that reproduces the current comparison list, signer mode, bounds, weights and sort">Copy shareable link</button>
-      <label class="signer-mode" title="cached: the signer keeps tree state — a BDS update per signature for XMSS/XMSS-MT (its per-signature bound is shown), a leaf cache for UXMSS. stateless-recompute: no cached tree material, trees are rebuilt per signature. SLH-DSA is stateless by design, so its SigGen is identical in both modes.">
+      <button class="btn btn-ghost" id="share-btn">Copy shareable link</button>
+      <label class="signer-mode">
         Signer:
         <select id="signer-mode">
-          <option value="cached">cached (BDS state)</option>
-          <option value="cold">stateless-recompute</option>
+          <option value="cached">cached</option>
+          <option value="cold">cold</option>
         </select>
       </label>
+      <button type="button" class="info" popovertarget="about-signer" aria-label="About the signer modes">i</button>
+      <div class="pop" id="about-signer" popover>
+        <p>A cached signer keeps tree state between signatures: a BDS state for XMSS and XMSS-MT, and a leaf cache
+          for UXMSS. A cold signer keeps none and rebuilds its trees for every signature. SLH-DSA-128s is stateless,
+          so its SigGen is the same in both modes.</p>
+      </div>
     </div>
 
     <form class="add-form" id="add-form" hidden>
       <label>Scheme
         <select id="f-scheme">
           <option value="xmssmt">XMSS / XMSS-MT</option>
-          <option value="uxmss">UXMSS (left-leaning)</option>
+          <option value="uxmss">UXMSS</option>
         </select>
       </label>
-      <label>OTS family
+      <label>OTS
         <select id="f-ots">
           <option value="TW">WOTS</option>
           <option value="WC">WOTS+C</option>
         </select>
       </label>
-      <label data-scheme="xmssmt">Tree height (h)
+      <label data-scheme="xmssmt">Tree height h
         <input type="number" id="f-h" value="20" min="2" max="60" step="1">
       </label>
-      <label data-scheme="xmssmt">Layers (d)
+      <label data-scheme="xmssmt">Layers d
         <select id="f-d"></select>
       </label>
       <label>Winternitz w
@@ -362,55 +369,54 @@ <h1>Stateful Scheme Comparison</h1>
       </div>
     </form>
 
-    <h2 style="margin-top: 20px;">Comparison table</h2>
-    <p class="hint">All cost columns are SHA-256 compression-function calls with the PK.seed block midstate-cached
-      (FIPS 205 SHA-2 layout; the original uncached convention remains available in the scripts via
-      <code>HASH_CONVENTION=uncached</code>). Cost ratios under each value compare against SLH-DSA-128s.
-      UXMSS signatures grow with the signature index: the size and C/B columns show the first→largest range
-      (C/B <em>falls</em> with the index — each extra auth node adds 16 B of signature but only one
-      compression of verify work), and all ratios, filters and verification costs use the worst case
-      (hsf auth nodes, reached by the last two of the hsf+1 signatures).
-      The <strong>Signer</strong> selector switches SigGen between the cached signer (tree state kept between
-      signatures) and a state-minimized signer that rebuilds its trees per signature. The cached cost is an
-      upper bound per signature: one BDS update per layer for XMSS/XMSS-MT (at most (h'−K)/2+1 leaf
-      computations), and for UXMSS the first signature, which recombines the most spine nodes from the cached leaves.
-      <strong>State</strong> shows the cached signer's memory — UXMSS: all hsf+1 leaf hashes;
-      XMSS/XMSS-MT: the BDS state bound; "—" for the stateless SLH-DSA baseline and in state-minimized mode.
-      Sizes use the SHRINCS stateful layout: indicator byte, 16 B randomizer, leaf index, then per layer the
-      WOTS+C counter (2 B), chains and auth path.</p>
-    <p class="hint" id="schnorr-ref"></p>
+    <h2 style="margin-top: 20px;">Comparison</h2>
+    <p class="hint">Ratios under each value compare with SLH-DSA-128s.</p>
+    <div class="pop" id="about-size" popover>
+      <p>Sizes follow the SHRINCS stateful layout: a one-byte indicator, a 16-byte randomizer and the leaf index,
+        then per layer the WOTS+C counter (2 bytes; 4 at w = 65536), the chains and the authentication path.</p>
+      <p>UXMSS signatures grow by one 16-byte node per signature, so size and ρ show first → last.
+        Ratios, bounds, sorting and SigVer use the largest signature.</p>
+    </div>
+    <div class="pop" id="about-siggen" popover>
+      <p>Cached: an upper bound per signature. For XMSS and XMSS-MT that is one BDS update per layer, at most
+        (h′ − K)/2 + 1 leaf computations; for UXMSS it is the first signature, which combines the most nodes from
+        the leaf cache. Cold: the trees are rebuilt for every signature.</p>
+    </div>
+    <div class="pop" id="about-state" popover>
+      <p>What a cached signer stores: all hsf + 1 leaf hashes for UXMSS, the BDS state bound for XMSS and XMSS-MT.
+        Empty for SLH-DSA-128s and for a cold signer.</p>
+    </div>
+    <div class="pop" id="about-schnorr" popover></div>
     <div class="compare-wrap">
       <table class="compare" id="compare-table"></table>
     </div>
   </div>
 
   <div class="panel" id="all-candidates-panel">
-    <h2>All stateful candidates</h2>
-    <p class="hint">
-      Pre-swept over h = [10, 40], d = [1, 10] (with d ⏐ h), OTS = {WOTS, WOTS+C}, w = {16, 32, 64, 128, 256, 65536},
-      plus the 12 UXMSS variants (2 OTS * 6 w). Every candidate has signature size strictly smaller than SLH-DSA-128s.
-      UXMSS tree height is capped at hsf = 255.
-      UXMSS C/B cells show the first→largest-signature range (density falls with the index);
-      bounds and sorting use the largest-signature value.
-      Tighten the bounds to narrow the pool; click a row's <strong>+</strong> to add it to the comparison above.
-    </p>
+    <h2>All stateful candidates <button type="button" class="info" popovertarget="about-sweep" aria-label="About the candidates">i</button></h2>
+    <div class="pop" id="about-sweep" popover>
+      <p>XMSS and XMSS-MT with h = 10 to 40, d = 1 to 10 dividing h, WOTS or WOTS+C and
+        w ∈ {16, 32, 64, 128, 256, 65536}, plus the 12 UXMSS variants, whose tree height is capped at hsf = 255.
+        Only candidates smaller than SLH-DSA-128s are listed.</p>
+    </div>
+    <p class="hint">Narrow the list with the bounds; <strong>+</strong> adds a row to the comparison.</p>
 
     <div class="filter-section">
-      <div class="filter-section-label">Bounds — restrict which candidates appear</div>
+      <div class="filter-section-label">Bounds (× <span class="keep-case">SLH-DSA-128s</span>)</div>
       <div class="filter-grid" id="sweep-bounds"></div>
     </div>
     <details class="filter-section filter-collapsible">
       <summary class="filter-section-label">
         <span class="chev">▸</span>
         Weights
-        <span class="filter-section-hint">(advanced — distance uses metric-normalised ratios across current survivors, as in the Parameter Explorer)</span>
+        <span class="filter-section-hint">(distance as in the Parameter Explorer)</span>
       </summary>
       <div class="filter-grid" id="sweep-weights"></div>
     </details>
 
     <div class="sweep-info" id="sweep-info"></div>
     <div class="actions">
-      <button class="btn btn-ghost" id="sweep-export" title="Download the candidates passing the current bounds (with distances) as CSV">Export table (CSV)</button>
+      <button class="btn btn-ghost" id="sweep-export" title="Download the candidates within the bounds">Export CSV</button>
     </div>
 
     <div class="compare-wrap">
@@ -420,6 +426,7 @@ <h2>All stateful candidates</h2>
 
 </main>
 
+<script src="js/ui.js"></script>
 <script src="formulas.js"></script>
 <script>
 'use strict';
@@ -435,6 +442,11 @@ <h2>All stateful candidates</h2>
 
 function otsShort(ots) { return ots === 'WC' ? 'WOTS+C' : 'WOTS'; }
 
+function xmssLabel(ots, h, d, w) {
+  return d > 1 ? `XMSS-MT (${otsShort(ots)}, w = ${w}, h = ${h}, d = ${d})`
+               : `XMSS (${otsShort(ots)}, w = ${w}, h = ${h})`;
+}
+
 function buildSLH() {
   const s = SITE_DATA ? SITE_DATA.stateful.slh : null;
   const m = slhMetrics(SLH);
@@ -461,7 +473,7 @@ <h2>All stateful candidates</h2>
   return {
     id: makeId(),
     key: `xmssmt-${ots}-${w}-${h}-${d}`,
-    label: `XMSS-2^${h} (${otsShort(ots)}, w=${w}, d=${d})`,
+    label: xmssLabel(ots, h, d, w),
     scheme: d > 1 ? 'XMSS-MT' : 'XMSS',
     canRemove: true,
     metrics: {
@@ -484,11 +496,10 @@ <h2>All stateful candidates</h2>
   return {
     id: makeId(),
     key: `uxmss-${ots}-${w}`,
-    label: `UXMSS (${otsShort(ots)}, w=${w})`,
+    label: `UXMSS (${otsShort(ots)}, w = ${w})`,
     scheme: 'UXMSS',
     canRemove: true,
     hsf,
-    sub: `sig grows with index — worst case shown (${hsf} auth nodes); capacity ${hsf + 1} sigs`,
     metrics: {
       size: uxmssSize(hsf, hsf, w, ots),
       sizeQ1: uxmssSize(1, hsf, w, ots),
@@ -520,7 +531,7 @@ <h2>All stateful candidates</h2>
   return {
     id: makeId(),
     key: `xmssmt-${ots}-${w}-${h}-${d}`,
-    label: `XMSS-2^${h} (${otsShort(ots)}, w=${w}, d=${d})`,
+    label: xmssLabel(ots, h, d, w),
     scheme: d > 1 ? 'XMSS-MT' : 'XMSS',
     canRemove: true,
     metrics: {
@@ -537,11 +548,10 @@ <h2>All stateful candidates</h2>
   return {
     id: makeId(),
     key: `uxmss-${ots}-${w}`,
-    label: `UXMSS (${otsShort(ots)}, w=${w})`,
+    label: `UXMSS (${otsShort(ots)}, w = ${w})`,
     scheme: 'UXMSS',
     canRemove: true,
     hsf,
-    sub: `sig grows with index — worst case shown (${hsf} auth nodes); capacity ${hsf + 1} sigs`,
     metrics: {
       size: rec[idx.sz_max], sizeQ1: rec[idx.sz_q1],
       keygen: rec[idx.kg], siggen: rec[idx.sg],
@@ -603,54 +613,54 @@ <h2>All stateful candidates</h2>
   ];
 }
 
-// Size cell: schemes with q-dependent signatures (UXMSS) show best–worst range;
-// ratios/filters/sorting always use the worst case (m.size).
-function fmtSize(m) {
-  if (m.sizeQ1 !== undefined && m.sizeQ1 !== m.size) {
-    return `${m.sizeQ1.toLocaleString()}–${m.size.toLocaleString()} B`;
-  }
-  return fmtBytes(m.size);
+// UXMSS signatures grow with the index: cells show first → last, while ratios,
+// bounds and sorting use the last (m.size).
+function sizeCell(m) {
+  if (m.sizeQ1 !== undefined && m.sizeQ1 !== m.size) return `${fmtNum(m.sizeQ1)} → ${fmtNum(m.size)}`;
+  return fmtNum(m.size);
 }
 
-function fmtRatio(target, std) {
-  if (target === std) return '';
-  if (!isFinite(target) || !isFinite(std)) return '';
-  const r = target / std;
-  if (r >= 100) return `${r.toExponential(1)}×`;
-  if (r >= 10)  return `${r.toFixed(1)}×`;
-  return `${r.toFixed(2)}×`;
+function ratioNote(target, std) {
+  if (target === std || !isFinite(target) || !isFinite(std)) return '';
+  return fmtRatio(target / std);
 }
 
-function fmtCpbCell(m, c, sv, scale, suffix) {
+// ρ for SigVer sv, divided by `scale` (1, or the Schnorr ρ) and printed with `fmt`.
+function rhoCell(m, c, sv, scale, fmt) {
   const cbMax = sv / m.size / scale;
   if (c && c.hsf !== undefined && m.sizeQ1 !== undefined && m.sizeQ1 !== m.size) {
     const cb1 = (sv - (c.hsf - 1) * C_Th2) / m.sizeQ1 / scale;
-    return fmtCpb(cb1) + '→' + fmtCpb(cbMax) + suffix;
+    return `${fmt(cb1)} → ${fmt(cbMax)}`;
   }
-  return fmtCpb(cbMax) + suffix;
+  return fmt(cbMax);
 }
-function fmtQs(c) {
-  if (c.qsLog2 !== null) return `2^${c.qsLog2}`;
-  return c.qsExact.toLocaleString();
+
+function qsCell(c) {
+  return c.qsLog2 !== null ? fmtPow2(c.qsLog2) : fmtNum(c.qsExact);
 }
 
+const RHO = '<span class="keep-case">ρ</span>';
+
 //  State
 const state = { candidates: [] };   // filled by init() once data.json is resolved
 
 // Render 
 // Metric column descriptors
 const METRIC_COLS = [
-  { label: 'Sig size',    value: m => fmtSize(m),                                  ratioField: 'size',    lowerIsBetter: true },
-  { label: 'KeyGen (C)',  value: m => fmtCompressions(m.keygen),                   ratioField: 'keygen',  lowerIsBetter: true },
-  { label: () => `SigGen (C, ${SIGNER_MODE === 'cold' ? 'cold' : 'BDS'})`,
-                          value: m => fmtCompressions(sigGenOf(m)),                ratioFn: m => sigGenOf(m), lowerIsBetter: true },
-  { label: 'State (B)',   value: m => (SIGNER_MODE === 'cold' || m.state === undefined) ? '—' : fmtBytes(m.state) },
-  { label: 'SigVer (C)',  value: m => fmtCompressions(m.sigver),                   ratioField: 'sigver',  lowerIsBetter: true },
-  { label: 'C/B (avg)',   value: (m, c) => fmtCpbCell(m, c, m.sigver, 1, ''),      ratioFn: m => (m.sigver      / m.size),  lowerIsBetter: true },
-  { label: 'C/B (worst)', value: (m, c) => fmtCpbCell(m, c, m.sigverWorst, 1, ''), ratioFn: m => (m.sigverWorst / m.size),  lowerIsBetter: true },
-  { label: `<span title="Verify compressions per signature byte as a multiple of BIP340 Schnorr verification (libsecp256k1) — see the ρ reference note above">ρ ÷ Schnorr</span>`,
-                          value: (m, c) => fmtCpbCell(m, c, m.sigver, SCHNORR.cb64, '×') },
-  { label: 'Max sigs',    value: (_, c) => fmtQs(c.metrics) },
+  { label: () => 'Size (B)' + infoButton('about-size', 'About the size'),
+                          value: m => sizeCell(m),                                 ratioField: 'size',    lowerIsBetter: true },
+  { label: 'KeyGen (C)',  value: m => fmtNum(m.keygen),                            ratioField: 'keygen',  lowerIsBetter: true },
+  { label: () => `SigGen, ${SIGNER_MODE} (C)` + infoButton('about-siggen', 'About SigGen'),
+                          value: m => fmtNum(sigGenOf(m)),                         ratioFn: m => sigGenOf(m), lowerIsBetter: true },
+  { label: () => 'State (B)' + infoButton('about-state', 'About the state'),
+                          value: m => (SIGNER_MODE === 'cold' || m.state === undefined) ? '—' : fmtNum(m.state) },
+  { label: 'SigVer (C)',  value: m => fmtNum(m.sigver),                            ratioField: 'sigver',  lowerIsBetter: true },
+  { label: `${RHO} (C/B)`, value: (m, c) => rhoCell(m, c, m.sigver, 1, fmtRho),    ratioFn: m => (m.sigver      / m.size),  lowerIsBetter: true },
+  { label: `${RHO}, worst (C/B)`,
+                          value: (m, c) => rhoCell(m, c, m.sigverWorst, 1, fmtRho), ratioFn: m => (m.sigverWorst / m.size),  lowerIsBetter: true },
+  { label: () => `${RHO} ÷ Schnorr` + infoButton('about-schnorr', 'About ρ ÷ Schnorr'),
+                          value: (m, c) => rhoCell(m, c, m.sigver, SCHNORR.cb64, fmtRatio) },
+  { label: 'Max signatures', value: (_, c) => qsCell(c.metrics) },
 ];
 
 function ratioClass(ratio, lowerIsBetter) {
@@ -679,7 +689,7 @@ <h2>All stateful candidates</h2>
     const isStd = (i === 0);
 
     let row = `<tr class="${isStd ? 'baseline' : ''}">`;
-    row += `<td class="cand-col"><span class="cand-title">${c.label}</span>${c.sub ? `<span class="cand-sub">${c.sub}</span>` : ''}</td>`;
+    row += `<td class="cand-col"><span class="cand-title">${c.label}</span></td>`;
 
     for (const col of METRIC_COLS) {
       let cell = col.value(m, c);
@@ -695,7 +705,7 @@ <h2>All stateful candidates</h2>
         if (target !== null && isFinite(target) && isFinite(stdVal) && stdVal > 0) {
           const ratio = target / stdVal;
           const cls = ratioClass(ratio, col.lowerIsBetter);
-          cell += `<span class="ratio ${cls}">${fmtRatio(target, stdVal)}</span>`;
+          cell += `<span class="ratio ${cls}">${ratioNote(target, stdVal)}</span>`;
         }
       }
       row += `<td>${cell}</td>`;
@@ -800,20 +810,20 @@ <h2>All stateful candidates</h2>
 
 // Bound coefficient descriptors
 const SWEEP_BOUND_FILTERS = [
-  { key: 'size',  label: 'X_size',         min: 0.10, max: 1.00,  step: 0.01, dp: 2 },
-  { key: 'kg',    label: 'X_kg',           min: 0.10, log: true },
-  { key: 'sg',    label: 'X_sg',           min: 0.10, log: true },
-  { key: 'sv',    label: 'X_sv',           min: 0.10, log: true },
-  { key: 'cb',    label: 'X_cb',           min: 0.10, log: true },
-  { key: 'minQs', label: 'Min sigs (2^h)', min: 0,    max: 40,    step: 1,    dp: 0 },
+  { key: 'size',  label: 'Size',   min: 0.10, max: 1.00,  step: 0.01, dp: 2 },
+  { key: 'kg',    label: 'KeyGen', min: 0.10, log: true },
+  { key: 'sg',    label: 'SigGen', min: 0.10, log: true },
+  { key: 'sv',    label: 'SigVer', min: 0.10, log: true },
+  { key: 'cb',    label: 'ρ',      min: 0.10, log: true },
+  { key: 'minQs', label: 'Min. sigs (log₂)', min: 0, max: 40, step: 1, dp: 0 },
 ];
 // Importance-weight descriptors (W)
 const SWEEP_WEIGHT_FILTERS = [
-  { key: 'size', label: 'w_size', min: 0.10, max: 10.00, step: 0.10, dp: 1 },
-  { key: 'kg',   label: 'w_kg',   min: 0.10, max: 10.00, step: 0.10, dp: 1 },
-  { key: 'sg',   label: 'w_sg',   min: 0.10, max: 10.00, step: 0.10, dp: 1 },
-  { key: 'sv',   label: 'w_sv',   min: 0.10, max: 10.00, step: 0.10, dp: 1 },
-  { key: 'cb',   label: 'w_cb',   min: 0.10, max: 10.00, step: 0.10, dp: 1 },
+  { key: 'size', label: 'Size',   min: 0.10, max: 10.00, step: 0.10, dp: 1 },
+  { key: 'kg',   label: 'KeyGen', min: 0.10, max: 10.00, step: 0.10, dp: 1 },
+  { key: 'sg',   label: 'SigGen', min: 0.10, max: 10.00, step: 0.10, dp: 1 },
+  { key: 'sv',   label: 'SigVer', min: 0.10, max: 10.00, step: 0.10, dp: 1 },
+  { key: 'cb',   label: 'ρ',      min: 0.10, max: 10.00, step: 0.10, dp: 1 },
 ];
 
 // Metric-normalised weighted Euclidean distance — same definition as the
@@ -931,7 +941,7 @@ <h2>All stateful candidates</h2>
                value="${numVal}"
                data-sw-input="${f.key}"${f.log ? '' : ` data-dp="${f.dp}"`}>
       </label>
-      <input type="range" ${sliderAttrs}>
+      <input type="range" aria-label="${f.label} ${group === 'X' ? 'bound' : 'weight'}" ${sliderAttrs}>
     </div>
   `;
   }).join('');
@@ -981,19 +991,19 @@ <h2>All stateful candidates</h2>
 
 // Sweep-table metric columns
 const SWEEP_COLS = [
-  { field: 'size',     label: 'Sig size',   value: m => fmtSize(m),                             sortFn: (m) => m.size,                                                  ratioFn: m => m.size,             lowerIsBetter: true },
-  { field: 'keygen',   label: 'KeyGen (C)', value: m => fmtCompressions(m.keygen),              sortFn: (m) => m.keygen,                                                ratioFn: m => m.keygen,           lowerIsBetter: true },
-  { field: 'siggen',   label: () => `SigGen (C, ${SIGNER_MODE === 'cold' ? 'cold' : 'BDS'})`,
-                                            value: m => fmtCompressions(sigGenOf(m)),           sortFn: (m) => sigGenOf(m),                                             ratioFn: m => sigGenOf(m),        lowerIsBetter: true },
-  { field: 'state',    label: 'State (B)',  value: m => (SIGNER_MODE === 'cold' || m.state === undefined) ? '—' : fmtBytes(m.state),
+  { field: 'size',     label: 'Size (B)',   value: m => sizeCell(m),                            sortFn: (m) => m.size,                                                  ratioFn: m => m.size,             lowerIsBetter: true },
+  { field: 'keygen',   label: 'KeyGen (C)', value: m => fmtNum(m.keygen),                       sortFn: (m) => m.keygen,                                                ratioFn: m => m.keygen,           lowerIsBetter: true },
+  { field: 'siggen',   label: () => `SigGen, ${SIGNER_MODE} (C)`,
+                                            value: m => fmtNum(sigGenOf(m)),                    sortFn: (m) => sigGenOf(m),                                             ratioFn: m => sigGenOf(m),        lowerIsBetter: true },
+  { field: 'state',    label: 'State (B)',  value: m => (SIGNER_MODE === 'cold' || m.state === undefined) ? '—' : fmtNum(m.state),
                                                                                                 sortFn: (m) => m.state || 0 },
-  { field: 'sigver',   label: 'SigVer (C)', value: m => fmtCompressions(m.sigver),              sortFn: (m) => m.sigver,                                                ratioFn: m => m.sigver,           lowerIsBetter: true },
-  { field: 'cb',       label: 'C/B (avg)',  value: (m, c) => fmtCpbCell(m, c, m.sigver, 1, ''), sortFn: (m) => m.sigver / m.size,                                       ratioFn: m => m.sigver / m.size,  lowerIsBetter: true },
-  { field: 'cbSchnorr', label: `<span title="Verify compressions per signature byte as a multiple of BIP340 Schnorr verification (libsecp256k1) — see the ρ reference note in the comparison panel">ρ ÷ Schnorr</span>`,
-                                            value: (m, c) => fmtCpbCell(m, c, m.sigver, SCHNORR.cb64, '×'), sortFn: (m) => m.sigver / m.size },
+  { field: 'sigver',   label: 'SigVer (C)', value: m => fmtNum(m.sigver),                       sortFn: (m) => m.sigver,                                                ratioFn: m => m.sigver,           lowerIsBetter: true },
+  { field: 'cb',       label: `${RHO} (C/B)`, value: (m, c) => rhoCell(m, c, m.sigver, 1, fmtRho), sortFn: (m) => m.sigver / m.size,                                   ratioFn: m => m.sigver / m.size,  lowerIsBetter: true },
+  { field: 'cbSchnorr', label: `${RHO} ÷ Schnorr`,
+                                            value: (m, c) => rhoCell(m, c, m.sigver, SCHNORR.cb64, fmtRatio), sortFn: (m) => m.sigver / m.size },
   { field: 'distance', label: 'Distance',   value: (m, c, std) => sweepDistance(m, std, sweepState.W).toFixed(4),
                                             sortFn: (m, c, std) => sweepDistance(m, std, sweepState.W) },
-  { field: 'qs',       label: 'Max sigs',   value: (_, c) => fmtQs(c.metrics),                  sortFn: (m) => (m.qsLog2 !== null ? Math.pow(2, m.qsLog2) : m.qsExact) },
+  { field: 'qs',       label: 'Max signatures', value: (_, c) => qsCell(c.metrics),             sortFn: (m) => (m.qsLog2 !== null ? Math.pow(2, m.qsLog2) : m.qsExact) },
 ];
 
 function renderSweepTable() {
@@ -1026,13 +1036,14 @@ <h2>All stateful candidates</h2>
   scheduleStatefulHashWrite();
 
   document.getElementById('sweep-info').innerHTML =
-    `<strong>${survivors.length}</strong> of ${SWEEP_FACTORIES.length} candidates pass the current bounds.`;
+    `<strong>${survivors.length.toLocaleString('en-US')}</strong> of ` +
+    `${SWEEP_FACTORIES.length.toLocaleString('en-US')} candidates within the bounds.`;
 
   const table = document.getElementById('sweep-table');
   table.innerHTML = '';
 
   if (survivors.length === 0) {
-    table.innerHTML = `<thead><tr><th class="cand-col" colspan="${SWEEP_COLS.length + 2}" style="text-align:center;color:var(--text-mute);font-style:italic;padding:24px;">No candidates pass. Relax a bound.</th></tr></thead>`;
+    table.innerHTML = `<thead><tr><th class="cand-col" colspan="${SWEEP_COLS.length + 2}" style="text-align:center;color:var(--text-mute);font-style:italic;padding:24px;">No candidate is within all bounds. Relax one.</th></tr></thead>`;
     return;
   }
 
@@ -1061,7 +1072,7 @@ <h2>All stateful candidates</h2>
     const c = f.cached;
     const m = c.metrics;
     let row = `<tr>`;
-    row += `<td class="cand-col"><span class="cand-title">${c.label}</span>${c.sub ? `<span class="cand-sub">${c.sub}</span>` : ''}</td>`;
+    row += `<td class="cand-col"><span class="cand-title">${c.label}</span></td>`;
     for (const col of SWEEP_COLS) {
       let cell = col.value(m, c, std);
       if (col.ratioFn) {
@@ -1070,7 +1081,7 @@ <h2>All stateful candidates</h2>
         if (isFinite(target) && isFinite(stdVal) && stdVal > 0) {
           const ratio = target / stdVal;
           const cls = ratioClass(ratio, col.lowerIsBetter);
-          cell += `<span class="ratio ${cls}">${fmtRatio(target, stdVal)}</span>`;
+          cell += `<span class="ratio ${cls}">${ratioNote(target, stdVal)}</span>`;
         }
       }
       row += `<td>${cell}</td>`;
@@ -1081,7 +1092,7 @@ <h2>All stateful candidates</h2>
     rowsHtml.push(row);
   }
   if (survivors.length > MAX_ROWS) {
-    rowsHtml.push(`<tr><td class="cand-col" colspan="${SWEEP_COLS.length + 2}" style="text-align:center;color:var(--text-mute);font-style:italic;">… and ${survivors.length - MAX_ROWS} more (tighten a bound to narrow further)</td></tr>`);
+    rowsHtml.push(`<tr><td class="cand-col" colspan="${SWEEP_COLS.length + 2}" style="text-align:center;color:var(--text-mute);font-style:italic;">… and ${(survivors.length - MAX_ROWS).toLocaleString('en-US')} more; tighten a bound to see them.</td></tr>`);
   }
   tbody.innerHTML = rowsHtml.join('');
 
@@ -1100,7 +1111,8 @@ <h2>All stateful candidates</h2>
   });
 
   table.querySelectorAll('th.sortable').forEach(th => {
-    th.addEventListener('click', () => {
+    th.addEventListener('click', e => {
+      if (e.target.closest('.info')) return;
       const col = th.dataset.sort;
       if (sweepState.sort.col === col) {
         sweepState.sort.dir = (sweepState.sort.dir === 'asc') ? 'desc' : 'asc';
@@ -1221,10 +1233,10 @@ <h2>All stateful candidates</h2>
 function exportSweepCSV() {
   const std = state.candidates[0].metrics;
   const header = ['scheme', 'label', 'max_sigs', 'size_B', 'keygen_C',
-    'siggen_bds_C', 'siggen_cold_C', 'state_B',
-    'sigver_C', 'sigver_worst_C', 'c_per_byte', 'c_per_byte_worst',
-    'cb_vs_schnorr', 'cb_worst_vs_schnorr', 'schnorr_cb64',
-    'signer_mode', 'distance'];
+    'siggen_cached_C', 'siggen_cold_C', 'state_B',
+    'sigver_C', 'sigver_worst_C', 'rho', 'rho_worst',
+    'rho_vs_schnorr', 'rho_worst_vs_schnorr', 'schnorr_rho',
+    'signer', 'distance'];
   const lines = [header.join(',')];
   for (const f of sweepState.lastSurvivors) {
     const c = f.cached, m = c.metrics;
@@ -1356,14 +1368,14 @@ <h2>All stateful candidates</h2>
   const m = state.candidates[0].metrics;
   const cb = m.sigver / m.size;
   const src = s.live
-    ? `kappa.json${s.commit ? ` @ secp256k1 ${s.commit}` : ''}${s.run ? `, ${s.run}` : ''}` +
+    ? `kappa.json${s.commit ? ` at secp256k1 ${s.commit}` : ''}${s.run ? `, ${s.run}` : ''}` +
       `${s.machine ? `, ${s.machine}` : ''}${s.preliminary ? ', preliminary' : ''}`
-    : `built-in 1.98 C/B — live kappa.json unreachable`;
-  document.getElementById('schnorr-ref').innerHTML =
-    `The <strong>ρ ÷ Schnorr</strong> columns compare average-case C/B against BIP340 Schnorr ` +
-    `verification ≈ <strong>${s.cb64.toFixed(2)} C/B</strong> (${s.impl}, single verify over a ` +
-    `64 B wire signature; <a href="https://github.com/mjthatch/bip340-vs-sha256">bip340-vs-sha256</a>: ${src}). ` +
-    `SLH-DSA-128s baseline: ${fmtCpb(cb)} C/B = <strong>${fmtCpb(cb / s.cb64)}×</strong> Schnorr.`;
+    : 'built-in value, the live kappa.json did not load';
+  document.getElementById('about-schnorr').innerHTML =
+    `<p>The average ρ divided by the ρ of a BIP340 Schnorr verification, ${s.cb64.toFixed(2)} C/B ` +
+    `(${s.impl}, one 64-byte signature; ` +
+    `<a href="https://github.com/mjthatch/bip340-vs-sha256">bip340-vs-sha256</a>, ${src}). ` +
+    `SLH-DSA-128s has ρ = ${fmtRho(cb)} C/B, ${fmtRatio(cb / s.cb64)} Schnorr.</p>`;
 }
 
 async function init() {
diff --git a/tests/site_snapshot.json b/tests/site_snapshot.json
index a1856bb..18df2a4 100644
--- a/tests/site_snapshot.json
+++ b/tests/site_snapshot.json
@@ -330,39 +330,46 @@
   "input #cust-w": "16"
  },
  "stateful.html": {
-  "#compare-table row 0": ["SLH-DSA-128s","7,856 B","292.4K","2.22M","—","2.2K","0.279","0.496","0.141×","2^64",""],
-  "#compare-table row 1": ["UXMSS (WOTS, w=16) sig grows with index — worst case shown (255 auth nodes); capacity 256 sigs","594–4,665 B 0.59×","146.2K 0.50×","554 0.00×","4,096 B","536 0.24×","0.475→0.115 0.41×","0.884→0.167 0.34×","0.240→0.058×","256","×"],
-  "#compare-table row 2": ["UXMSS (WOTS+C, w=16) sig grows with index — worst case shown (255 auth nodes); capacity 256 sigs","548–4,619 B 0.59×","133.6K 0.46×","599 0.00×","4,096 B","509 0.23×","0.465→0.110 0.39×","0.465→0.110 0.22×","0.235→0.056×","256","×"],
-  "#compare-table row 3": ["XMSS-2^10 (WOTS, w=16, d=1)","739 B 0.09×","584.7K 2.00×","3.2K 0.00×","496 B","291 0.13×","0.394 1.41×","0.723 1.46×","0.199×","2^10","×"],
-  "#compare-table row 4": ["XMSS-2^10 (WOTS+C, w=16, d=1)","693 B 0.09×","534.5K 1.83×","3.0K 0.00×","496 B","264 0.12×","0.381 1.36×","0.381 0.77×","0.192×","2^10","×"],
-  "#compare-table row 5": ["XMSS-2^20 (WOTS, w=16, d=1)","900 B 0.11×","598.74M 2.0e+3×","6.0K 0.00×","1,056 B","301 0.14×","0.334 1.20×","0.604 1.22×","0.169×","2^20","×"],
-  "#compare-table row 6": ["XMSS-2^20 (WOTS+C, w=16, d=1)","854 B 0.11×","547.36M 1.9e+3×","5.6K 0.00×","1,056 B","274 0.12×","0.321 1.15×","0.321 0.65×","0.162×","2^20","×"],
-  "#sweep-info": "469 of 1116 candidates pass the current bounds.",
-  "#sweep-table row 0": ["XMSS-2^10 (WOTS+C, w=16, d=1)","693 B 0.09×","534.5K 1.83×","3.0K 0.00×","496 B","264 0.12×","0.381 1.36×","0.192×","0.0520","2^10","+"],
-  "#sweep-table row 1": ["XMSS-2^10 (WOTS, w=16, d=1)","739 B 0.09×","584.7K 2.00×","3.2K 0.00×","496 B","291 0.13×","0.394 1.41×","0.199×","0.0571","2^10","+"],
-  "#sweep-table row 2": ["XMSS-2^10 (WOTS+C, w=16, d=2)","1,207 B 0.15×","16.7K 0.06×","2.4K 0.00×","960 B","514 0.23×","0.426 1.53×","0.215×","0.0657","2^10","+"],
-  "#sweep-table row 3": ["XMSS-2^12 (WOTS+C, w=16, d=2)","1,239 B 0.16×","33.4K 0.11×","3.5K 0.00×","1,056 B","516 0.24×","0.416 1.49×","0.210×","0.0685","2^12","+"],
-  "#sweep-table row 4": ["XMSS-2^14 (WOTS+C, w=16, d=2)","1,271 B 0.16×","66.8K 0.23×","3.5K 0.00×","1,184 B","518 0.24×","0.408 1.46×","0.206×","0.0706","2^14","+"],
-  "#sweep-table row 5": ["XMSS-2^10 (WOTS, w=16, d=2)","1,299 B 0.17×","18.3K 0.06×","2.6K 0.00×","1,008 B","568 0.26×","0.437 1.57×","0.221×","0.0728","2^10","+"],
-  "#sweep-table row 6": ["XMSS-2^16 (WOTS+C, w=16, d=2)","1,303 B 0.17×","133.6K 0.46×","4.5K 0.00×","1,280 B","520 0.24×","0.399 1.43×","0.202×","0.0743","2^16","+"],
-  "#sweep-table row 7": ["XMSS-2^12 (WOTS, w=16, d=2)","1,331 B 0.17×","36.5K 0.12×","3.7K 0.00×","1,104 B","570 0.26×","0.428 1.53×","0.216×","0.0757","2^12","+"],
-  "#sweep-table row 8": ["XMSS-2^10 (WOTS+C, w=32, d=2)","1,015 B 0.13×","26.9K 0.09×","3.9K 0.00×","864 B","836 0.38×","0.824 2.95×","0.416×","0.0775","2^10","+"],
-  "#sweep-table row 9": ["XMSS-2^14 (WOTS, w=16, d=2)","1,363 B 0.17×","73.1K 0.25×","3.7K 0.00×","1,232 B","572 0.26×","0.420 1.50×","0.212×","0.0779","2^14","+"],
-  "#sweep-table row 10": ["XMSS-2^18 (WOTS+C, w=16, d=2)","1,336 B 0.17×","267.3K 0.91×","4.5K 0.00×","1,408 B","522 0.24×","0.391 1.40×","0.197×","0.0784","2^18","+"],
-  "#sweep-table row 11": ["XMSS-2^12 (WOTS+C, w=32, d=2)","1,047 B 0.13×","53.8K 0.18×","5.6K 0.00×","960 B","838 0.38×","0.800 2.87×","0.404×","0.0797","2^12","+"],
-  "#sweep-table row 12": ["XMSS-2^14 (WOTS+C, w=32, d=2)","1,079 B 0.14×","107.5K 0.37×","5.6K 0.00×","1,088 B","840 0.38×","0.778 2.79×","0.393×","0.0802","2^14","+"],
-  "#sweep-table row 13": ["XMSS-2^16 (WOTS, w=16, d=2)","1,395 B 0.18×","146.2K 0.50×","4.9K 0.00×","1,328 B","574 0.26×","0.411 1.47×","0.208×","0.0817","2^16","+"],
-  "#sweep-table row 14": ["XMSS-2^10 (WOTS, w=32, d=2)","1,075 B 0.14×","29.0K 0.10×","4.1K 0.00×","896 B","905 0.41×","0.842 3.02×","0.425×","0.0821","2^10","+"],
-  "#sweep-table row 15": ["XMSS-2^12 (WOTS, w=32, d=2)","1,107 B 0.14×","57.9K 0.20×","5.9K 0.00×","992 B","907 0.41×","0.819 2.94×","0.414×","0.0845","2^12","+"],
-  "#sweep-table row 16": ["XMSS-2^16 (WOTS+C, w=32, d=2)","1,111 B 0.14×","215.0K 0.74×","7.3K 0.00×","1,184 B","842 0.38×","0.758 2.71×","0.383×","0.0846","2^16","+"],
-  "#sweep-table row 17": ["XMSS-2^14 (WOTS, w=32, d=2)","1,139 B 0.14×","115.8K 0.40×","5.9K 0.00×","1,120 B","909 0.41×","0.798 2.86×","0.403×","0.0852","2^14","+"],
-  "#sweep-table row 18": ["XMSS-2^18 (WOTS, w=16, d=2)","1,428 B 0.18×","292.4K","4.9K 0.00×","1,456 B","576 0.26×","0.403 1.44×","0.204×","0.0860","2^18","+"],
-  "#sweep-table row 19": ["XMSS-2^10 (WOTS+C, w=32, d=1)","597 B 0.08×","860.2K 2.94×","4.8K 0.00×","496 B","425 0.19×","0.712 2.55×","0.360×","0.0861","2^10","+"],
-  "#sweep-table row 20": ["XMSS-2^11 (WOTS+C, w=16, d=1)","709 B 0.09×","1.07M 3.66×","3.0K 0.00×","560 B","265 0.12×","0.374 1.34×","0.189×","0.0885","2^11","+"],
-  "#sweep-table row 21": ["XMSS-2^20 (WOTS+C, w=16, d=2)","1,368 B 0.17×","534.5K 1.83×","5.6K 0.00×","1,504 B","524 0.24×","0.383 1.37×","0.193×","0.0892","2^20","+"],
-  "#sweep-table row 22": ["XMSS-2^18 (WOTS+C, w=32, d=2)","1,144 B 0.15×","430.1K 1.47×","7.3K 0.00×","1,312 B","844 0.38×","0.738 2.64×","0.373×","0.0899","2^18","+"],
-  "#sweep-table row 23": ["XMSS-2^16 (WOTS, w=32, d=2)","1,171 B 0.15×","231.7K 0.79×","7.7K 0.00×","1,216 B","911 0.42×","0.778 2.79×","0.393×","0.0900","2^16","+"],
-  "#sweep-table row 24": ["XMSS-2^10 (WOTS, w=32, d=1)","627 B 0.08×","926.7K 3.17×","5.0K 0.00×","496 B","459 0.21×","0.732 2.62×","0.370×","0.0917","2^10","+"],
+  "#compare-table row 0": ["SLH-DSA-128s","7,856","292,351","2.22M","—","2,193","0.2791","0.4955","0.141×","2 ^64",""],
+  "#compare-table row 1": ["UXMSS (WOTS, w = 16)","594 → 4,665 0.594×","146,175 0.500×","554 0.000250×","4,096","536 0.244×","0.4747 → 0.1149 0.412×","0.8838 → 0.1670 0.337×","0.240× → 0.0580×","256","×"],
+  "#compare-table row 2": ["UXMSS (WOTS+C, w = 16)","548 → 4,619 0.588×","133,631 0.457×","599 0.000270×","4,096","509 0.232×","0.4653 → 0.1102 0.395×","0.4653 → 0.1102 0.222×","0.235× → 0.0557×","256","×"],
+  "#compare-table row 3": ["XMSS (WOTS, w = 16, h = 10)","739 0.0941×","584,703 2.00×","3,161 0.00142×","496","291 0.133×","0.3938 1.41×","0.7226 1.46×","0.199×","2 ^10","×"],
+  "#compare-table row 4": ["XMSS (WOTS+C, w = 16, h = 10)","693 0.0882×","534,527 1.83×","2,961 0.00133×","496","264 0.120×","0.3810 1.36×","0.3810 0.769×","0.192×","2 ^10","×"],
+  "#compare-table row 5": ["XMSS (WOTS, w = 16, h = 20)","900 0.115×","599M 2,048×","6,026 0.00272×","1,056","301 0.137×","0.3344 1.20×","0.6044 1.22×","0.169×","2 ^20","×"],
+  "#compare-table row 6": ["XMSS (WOTS+C, w = 16, h = 20)","854 0.109×","547M 1,872×","5,581 0.00252×","1,056","274 0.125×","0.3208 1.15×","0.3208 0.647×","0.162×","2 ^20","×"],
+  "#sweep-info": "469 of 1,116 candidates within the bounds.",
+  "#sweep-table row 0": ["XMSS (WOTS+C, w = 16, h = 10)","693 0.0882×","534,527 1.83×","2,961 0.00133×","496","264 0.120×","0.3810 1.36×","0.192×","0.0520","2 ^10","+"],
+  "#sweep-table row 1": ["XMSS (WOTS, w = 16, h = 10)","739 0.0941×","584,703 2.00×","3,161 0.00142×","496","291 0.133×","0.3938 1.41×","0.199×","0.0571","2 ^10","+"],
+  "#sweep-table row 2": ["XMSS-MT (WOTS+C, w = 16, h = 10, d = 2)","1,207 0.154×","16,703 0.0571×","2,433 0.00110×","960","514 0.234×","0.4258 1.53×","0.215×","0.0657","2 ^10","+"],
+  "#sweep-table row 3": ["XMSS-MT (WOTS+C, w = 16, h = 12, d = 2)","1,239 0.158×","33,407 0.114×","3,481 0.00157×","1,056","516 0.235×","0.4165 1.49×","0.210×","0.0685","2 ^12","+"],
+  "#sweep-table row 4": ["XMSS-MT (WOTS+C, w = 16, h = 14, d = 2)","1,271 0.162×","66,815 0.229×","3,481 0.00157×","1,184","518 0.236×","0.4076 1.46×","0.206×","0.0706","2 ^14","+"],
+  "#sweep-table row 5": ["XMSS-MT (WOTS, w = 16, h = 10, d = 2)","1,299 0.165×","18,271 0.0625×","2,584 0.00116×","1,008","568 0.259×","0.4373 1.57×","0.221×","0.0728","2 ^10","+"],
+  "#sweep-table row 6": ["XMSS-MT (WOTS+C, w = 16, h = 16, d = 2)","1,303 0.166×","133,631 0.457×","4,529 0.00204×","1,280","520 0.237×","0.3991 1.43×","0.202×","0.0743","2 ^16","+"],
+  "#sweep-table row 7": ["XMSS-MT (WOTS, w = 16, h = 12, d = 2)","1,331 0.169×","36,543 0.125×","3,730 0.00168×","1,104","570 0.260×","0.4282 1.53×","0.216×","0.0757","2 ^12","+"],
+  "#sweep-table row 8": ["XMSS-MT (WOTS+C, w = 32, h = 10, d = 2)","1,015 0.129×","26,879 0.0919×","3,915 0.00176×","864","836 0.381×","0.8236 2.95×","0.416×","0.0775","2 ^10","+"],
+  "#sweep-table row 9": ["XMSS-MT (WOTS, w = 16, h = 14, d = 2)","1,363 0.173×","73,087 0.250×","3,730 0.00168×","1,232","572 0.261×","0.4197 1.50×","0.212×","0.0779","2 ^14","+"],
+  "#sweep-table row 10": ["XMSS-MT (WOTS+C, w = 16, h = 18, d = 2)","1,336 0.170×","267,263 0.914×","4,529 0.00204×","1,408","522 0.238×","0.3907 1.40×","0.197×","0.0784","2 ^18","+"],
+  "#sweep-table row 11": ["XMSS-MT (WOTS+C, w = 32, h = 12, d = 2)","1,047 0.133×","53,759 0.184×","5,599 0.00252×","960","838 0.382×","0.8004 2.87×","0.404×","0.0797","2 ^12","+"],
+  "#sweep-table row 12": ["XMSS-MT (WOTS+C, w = 32, h = 14, d = 2)","1,079 0.137×","107,519 0.368×","5,599 0.00252×","1,088","840 0.383×","0.7785 2.79×","0.393×","0.0802","2 ^14","+"],
+  "#sweep-table row 13": ["XMSS-MT (WOTS, w = 16, h = 16, d = 2)","1,395 0.178×","146,175 0.500×","4,876 0.00220×","1,328","574 0.262×","0.4115 1.47×","0.208×","0.0817","2 ^16","+"],
+  "#sweep-table row 14": ["XMSS-MT (WOTS, w = 32, h = 10, d = 2)","1,075 0.137×","28,959 0.0991×","4,086 0.00184×","896","905 0.413×","0.8419 3.02×","0.425×","0.0821","2 ^10","+"],
+  "#sweep-table row 15": ["XMSS-MT (WOTS, w = 32, h = 12, d = 2)","1,107 0.141×","57,919 0.198×","5,900 0.00266×","992","907 0.414×","0.8193 2.94×","0.414×","0.0845","2 ^12","+"],
+  "#sweep-table row 16": ["XMSS-MT (WOTS+C, w = 32, h = 16, d = 2)","1,111 0.141×","215,039 0.736×","7,283 0.00328×","1,184","842 0.384×","0.7579 2.71×","0.383×","0.0846","2 ^16","+"],
+  "#sweep-table row 17": ["XMSS-MT (WOTS, w = 32, h = 14, d = 2)","1,139 0.145×","115,839 0.396×","5,900 0.00266×","1,120","909 0.415×","0.7981 2.86×","0.403×","0.0852","2 ^14","+"],
+  "#sweep-table row 18": ["XMSS-MT (WOTS, w = 16, h = 18, d = 2)","1,428 0.182×","292,351","4,876 0.00220×","1,456","576 0.263×","0.4034 1.44×","0.204×","0.0860","2 ^18","+"],
+  "#sweep-table row 19": ["XMSS (WOTS+C, w = 32, h = 10)","597 0.0760×","860,159 2.94×","4,761 0.00215×","496","425 0.194×","0.7119 2.55×","0.360×","0.0861","2 ^10","+"],
+  "#sweep-table row 20": ["XMSS (WOTS+C, w = 16, h = 11)","709 0.0902×","1.07M 3.66×","2,961 0.00133×","560","265 0.121×","0.3738 1.34×","0.189×","0.0885","2 ^11","+"],
+  "#sweep-table row 21": ["XMSS-MT (WOTS+C, w = 16, h = 20, d = 2)","1,368 0.174×","534,527 1.83×","5,577 0.00251×","1,504","524 0.239×","0.3830 1.37×","0.193×","0.0892","2 ^20","+"],
+  "#sweep-table row 22": ["XMSS-MT (WOTS+C, w = 32, h = 18, d = 2)","1,144 0.146×","430,079 1.47×","7,283 0.00328×","1,312","844 0.385×","0.7378 2.64×","0.373×","0.0899","2 ^18","+"],
+  "#sweep-table row 23": ["XMSS-MT (WOTS, w = 32, h = 16, d = 2)","1,171 0.149×","231,679 0.792×","7,714 0.00348×","1,216","911 0.415×","0.7780 2.79×","0.393×","0.0900","2 ^16","+"],
+  "#sweep-table row 24": ["XMSS (WOTS, w = 32, h = 10)","627 0.0798×","926,719 3.17×","4,997 0.00225×","496","459 0.209×","0.7321 2.62×","0.370×","0.0917","2 ^10","+"],
+  "popover #about-signer": "A cached signer keeps tree state between signatures: a BDS state for XMSS and XMSS-MT, and a leaf cache for UXMSS. A cold signer keeps none and rebuilds its trees for every signature. SLH-DSA-128s is stateless, so its SigGen is the same in both modes.",
+  "popover #about-size": "Sizes follow the SHRINCS stateful layout: a one-byte indicator, a 16-byte randomizer and the leaf index, then per layer the WOTS+C counter (2 bytes; 4 at w = 65536), the chains and the authentication path. UXMSS signatures grow by one 16-byte node per signature, so size and ρ show first → last. Ratios, bounds, sorting and SigVer use the largest signature.",
+  "popover #about-siggen": "Cached: an upper bound per signature. For XMSS and XMSS-MT that is one BDS update per layer, at most (h′ − K)/2 + 1 leaf computations; for UXMSS it is the first signature, which combines the most nodes from the leaf cache. Cold: the trees are rebuilt for every signature.",
+  "popover #about-state": "What a cached signer stores: all hsf + 1 leaf hashes for UXMSS, the BDS state bound for XMSS and XMSS-MT. Empty for SLH-DSA-128s and for a cold signer.",
+  "popover #about-schnorr": "The average ρ divided by the ρ of a BIP340 Schnorr verification, 1.98 C/B (libsecp256k1, one 64-byte signature; bip340-vs-sha256 , built-in value, the live kappa.json did not load). SLH-DSA-128s has ρ = 0.2791 C/B, 0.141× Schnorr.",
+  "popover #about-sweep": "XMSS and XMSS-MT with h = 10 to 40, d = 1 to 10 dividing h, WOTS or WOTS+C and w ∈ {16, 32, 64, 128, 256, 65536}, plus the 12 UXMSS variants, whose tree height is capped at hsf = 255. Only candidates smaller than SLH-DSA-128s are listed.",
+  "popover #glossary": "Glossary C One SHA-256 compression. Costs count compressions; the PK.seed block is compressed once per key and reused. B Byte. KeyGen, SigGen, SigVer Compressions to generate a key pair, to sign a message and to verify a signature. SigVer is the average unless marked worst. ρ SigVer per signature byte, in C/B. ρ ÷ Schnorr ρ divided by the ρ of a BIP340 Schnorr verification (libsecp256k1, 64-byte signature). SLH-DSA-128s The FIPS 205 parameter set (h, d, k, a, w) = (63, 7, 14, 12, 16). Ratios (×) compare against it. h, d, k, a, w Hypertree height, number of layers, FORS trees, FORS tree height, Winternitz parameter. h′ = h/d is the height of one layer. q s The number of signatures per key that security is computed for: 2 ^40 for the stateless schemes. WOTS, WOTS+C Winternitz one-time signatures. WOTS (as in SLH-DSA) has checksum chains; WOTS+C replaces them with a counter that the signer grinds until the message digits have a fixed sum, so verification always costs the same. XMSS, XMSS-MT, UXMSS Stateful schemes: one balanced Merkle tree (BXMSS in SHRINCS), d layers of such trees, and the unbalanced SHRINCS tree, whose signatures grow by one node per signature. Cached, cold A cached signer keeps tree state between signatures (a BDS state for XMSS, a leaf cache for UXMSS); a cold signer keeps none and rebuilds its trees for every signature.",
   "input #signer-mode": "cached",
   "input #f-scheme": "xmssmt",
   "input #f-ots": "TW",
@@ -382,39 +389,46 @@
   "input #sw-W-cb-val": "1.0"
  },
  "stateful.html#m=cold": {
-  "#compare-table row 0": ["SLH-DSA-128s","7,856 B","292.4K","2.22M","—","2.2K","0.279","0.496","0.141×","2^64",""],
-  "#compare-table row 1": ["UXMSS (WOTS, w=16) sig grows with index — worst case shown (255 auth nodes); capacity 256 sigs","594–4,665 B 0.59×","146.2K 0.50×","145.9K 0.07×","—","536 0.24×","0.475→0.115 0.41×","0.884→0.167 0.34×","0.240→0.058×","256","×"],
-  "#compare-table row 2": ["UXMSS (WOTS+C, w=16) sig grows with index — worst case shown (255 auth nodes); capacity 256 sigs","548–4,619 B 0.59×","133.6K 0.46×","133.5K 0.06×","—","509 0.23×","0.465→0.110 0.39×","0.465→0.110 0.22×","0.235→0.056×","256","×"],
-  "#compare-table row 3": ["XMSS-2^10 (WOTS, w=16, d=1)","739 B 0.09×","584.7K 2.00×","584.4K 0.26×","—","291 0.13×","0.394 1.41×","0.723 1.46×","0.199×","2^10","×"],
-  "#compare-table row 4": ["XMSS-2^10 (WOTS+C, w=16, d=1)","693 B 0.09×","534.5K 1.83×","534.3K 0.24×","—","264 0.12×","0.381 1.36×","0.381 0.77×","0.192×","2^10","×"],
-  "#compare-table row 5": ["XMSS-2^20 (WOTS, w=16, d=1)","900 B 0.11×","598.74M 2.0e+3×","598.74M 2.7e+2×","—","301 0.14×","0.334 1.20×","0.604 1.22×","0.169×","2^20","×"],
-  "#compare-table row 6": ["XMSS-2^20 (WOTS+C, w=16, d=1)","854 B 0.11×","547.36M 1.9e+3×","547.36M 2.5e+2×","—","274 0.12×","0.321 1.15×","0.321 0.65×","0.162×","2^20","×"],
-  "#sweep-info": "469 of 1116 candidates pass the current bounds.",
-  "#sweep-table row 0": ["XMSS-2^10 (WOTS+C, w=16, d=1)","693 B 0.09×","534.5K 1.83×","534.3K 0.24×","—","264 0.12×","0.381 1.36×","0.192×","0.0522","2^10","+"],
-  "#sweep-table row 1": ["XMSS-2^10 (WOTS, w=16, d=1)","739 B 0.09×","584.7K 2.00×","584.4K 0.26×","—","291 0.13×","0.394 1.41×","0.199×","0.0574","2^10","+"],
-  "#sweep-table row 2": ["XMSS-2^10 (WOTS+C, w=16, d=2)","1,207 B 0.15×","16.7K 0.06×","33.6K 0.02×","—","514 0.23×","0.426 1.53×","0.215×","0.0651","2^10","+"],
-  "#sweep-table row 3": ["XMSS-2^12 (WOTS+C, w=16, d=2)","1,239 B 0.16×","33.4K 0.11×","67.0K 0.03×","—","516 0.24×","0.416 1.49×","0.210×","0.0671","2^12","+"],
-  "#sweep-table row 4": ["XMSS-2^14 (WOTS+C, w=16, d=2)","1,271 B 0.16×","66.8K 0.23×","133.8K 0.06×","—","518 0.24×","0.408 1.46×","0.206×","0.0693","2^14","+"],
-  "#sweep-table row 5": ["XMSS-2^16 (WOTS+C, w=16, d=2)","1,303 B 0.17×","133.6K 0.46×","267.4K 0.12×","—","520 0.24×","0.399 1.43×","0.202×","0.0721","2^16","+"],
-  "#sweep-table row 6": ["XMSS-2^10 (WOTS, w=16, d=2)","1,299 B 0.17×","18.3K 0.06×","36.6K 0.02×","—","568 0.26×","0.437 1.57×","0.221×","0.0721","2^10","+"],
-  "#sweep-table row 7": ["XMSS-2^12 (WOTS, w=16, d=2)","1,331 B 0.17×","36.5K 0.12×","73.1K 0.03×","—","570 0.26×","0.428 1.53×","0.216×","0.0742","2^12","+"],
-  "#sweep-table row 8": ["XMSS-2^10 (WOTS+C, w=32, d=2)","1,015 B 0.13×","26.9K 0.09×","54.0K 0.02×","—","836 0.38×","0.824 2.95×","0.416×","0.0759","2^10","+"],
-  "#sweep-table row 9": ["XMSS-2^12 (WOTS+C, w=32, d=2)","1,047 B 0.13×","53.8K 0.18×","107.8K 0.05×","—","838 0.38×","0.800 2.87×","0.404×","0.0760","2^12","+"],
-  "#sweep-table row 10": ["XMSS-2^14 (WOTS, w=16, d=2)","1,363 B 0.17×","73.1K 0.25×","146.2K 0.07×","—","572 0.26×","0.420 1.50×","0.212×","0.0764","2^14","+"],
-  "#sweep-table row 11": ["XMSS-2^14 (WOTS+C, w=32, d=2)","1,079 B 0.14×","107.5K 0.37×","215.3K 0.10×","—","840 0.38×","0.778 2.79×","0.393×","0.0767","2^14","+"],
-  "#sweep-table row 12": ["XMSS-2^18 (WOTS+C, w=16, d=2)","1,336 B 0.17×","267.3K 0.91×","534.7K 0.24×","—","522 0.24×","0.391 1.40×","0.197×","0.0771","2^18","+"],
-  "#sweep-table row 13": ["XMSS-2^16 (WOTS+C, w=32, d=2)","1,111 B 0.14×","215.0K 0.74×","430.3K 0.19×","—","842 0.38×","0.758 2.71×","0.383×","0.0790","2^16","+"],
-  "#sweep-table row 14": ["XMSS-2^16 (WOTS, w=16, d=2)","1,395 B 0.18×","146.2K 0.50×","292.4K 0.13×","—","574 0.26×","0.411 1.47×","0.208×","0.0793","2^16","+"],
-  "#sweep-table row 15": ["XMSS-2^10 (WOTS, w=32, d=2)","1,075 B 0.14×","29.0K 0.10×","57.9K 0.03×","—","905 0.41×","0.842 3.02×","0.425×","0.0803","2^10","+"],
-  "#sweep-table row 16": ["XMSS-2^12 (WOTS, w=32, d=2)","1,107 B 0.14×","57.9K 0.20×","115.9K 0.05×","—","907 0.41×","0.819 2.94×","0.414×","0.0806","2^12","+"],
-  "#sweep-table row 17": ["XMSS-2^14 (WOTS, w=32, d=2)","1,139 B 0.14×","115.8K 0.40×","231.7K 0.10×","—","909 0.41×","0.798 2.86×","0.403×","0.0815","2^14","+"],
-  "#sweep-table row 18": ["XMSS-2^16 (WOTS, w=32, d=2)","1,171 B 0.15×","231.7K 0.79×","463.4K 0.21×","—","911 0.42×","0.778 2.79×","0.393×","0.0840","2^16","+"],
-  "#sweep-table row 19": ["XMSS-2^18 (WOTS, w=16, d=2)","1,428 B 0.18×","292.4K","584.7K 0.26×","—","576 0.26×","0.403 1.44×","0.204×","0.0846","2^18","+"],
-  "#sweep-table row 20": ["XMSS-2^10 (WOTS+C, w=32, d=1)","597 B 0.08×","860.2K 2.94×","859.9K 0.39×","—","425 0.19×","0.712 2.55×","0.360×","0.0861","2^10","+"],
-  "#sweep-table row 21": ["XMSS-2^18 (WOTS+C, w=32, d=2)","1,144 B 0.15×","430.1K 1.47×","860.4K 0.39×","—","844 0.38×","0.738 2.64×","0.373×","0.0864","2^18","+"],
-  "#sweep-table row 22": ["XMSS-2^20 (WOTS+C, w=16, d=2)","1,368 B 0.17×","534.5K 1.83×","1.07M 0.48×","—","524 0.24×","0.383 1.37×","0.193×","0.0895","2^20","+"],
-  "#sweep-table row 23": ["XMSS-2^11 (WOTS+C, w=16, d=1)","709 B 0.09×","1.07M 3.66×","1.07M 0.48×","—","265 0.12×","0.374 1.34×","0.189×","0.0912","2^11","+"],
-  "#sweep-table row 24": ["XMSS-2^10 (WOTS, w=32, d=1)","627 B 0.08×","926.7K 3.17×","926.3K 0.42×","—","459 0.21×","0.732 2.62×","0.370×","0.0918","2^10","+"],
+  "#compare-table row 0": ["SLH-DSA-128s","7,856","292,351","2.22M","—","2,193","0.2791","0.4955","0.141×","2 ^64",""],
+  "#compare-table row 1": ["UXMSS (WOTS, w = 16)","594 → 4,665 0.594×","146,175 0.500×","145,904 0.0658×","—","536 0.244×","0.4747 → 0.1149 0.412×","0.8838 → 0.1670 0.337×","0.240× → 0.0580×","256","×"],
+  "#compare-table row 2": ["UXMSS (WOTS+C, w = 16)","548 → 4,619 0.588×","133,631 0.457×","133,454 0.0602×","—","509 0.232×","0.4653 → 0.1102 0.395×","0.4653 → 0.1102 0.222×","0.235× → 0.0557×","256","×"],
+  "#compare-table row 3": ["XMSS (WOTS, w = 16, h = 10)","739 0.0941×","584,703 2.00×","584,423 0.263×","—","291 0.133×","0.3938 1.41×","0.7226 1.46×","0.199×","2 ^10","×"],
+  "#compare-table row 4": ["XMSS (WOTS+C, w = 16, h = 10)","693 0.0882×","534,527 1.83×","534,341 0.241×","—","264 0.120×","0.3810 1.36×","0.3810 0.769×","0.192×","2 ^10","×"],
+  "#compare-table row 5": ["XMSS (WOTS, w = 16, h = 20)","900 0.115×","599M 2,048×","599M 270×","—","301 0.137×","0.3344 1.20×","0.6044 1.22×","0.169×","2 ^20","×"],
+  "#compare-table row 6": ["XMSS (WOTS+C, w = 16, h = 20)","854 0.109×","547M 1,872×","547M 247×","—","274 0.125×","0.3208 1.15×","0.3208 0.647×","0.162×","2 ^20","×"],
+  "#sweep-info": "469 of 1,116 candidates within the bounds.",
+  "#sweep-table row 0": ["XMSS (WOTS+C, w = 16, h = 10)","693 0.0882×","534,527 1.83×","534,341 0.241×","—","264 0.120×","0.3810 1.36×","0.192×","0.0522","2 ^10","+"],
+  "#sweep-table row 1": ["XMSS (WOTS, w = 16, h = 10)","739 0.0941×","584,703 2.00×","584,423 0.263×","—","291 0.133×","0.3938 1.41×","0.199×","0.0574","2 ^10","+"],
+  "#sweep-table row 2": ["XMSS-MT (WOTS+C, w = 16, h = 10, d = 2)","1,207 0.154×","16,703 0.0571×","33,563 0.0151×","—","514 0.234×","0.4258 1.53×","0.215×","0.0651","2 ^10","+"],
+  "#sweep-table row 3": ["XMSS-MT (WOTS+C, w = 16, h = 12, d = 2)","1,239 0.158×","33,407 0.114×","66,970 0.0302×","—","516 0.235×","0.4165 1.49×","0.210×","0.0671","2 ^12","+"],
+  "#sweep-table row 4": ["XMSS-MT (WOTS+C, w = 16, h = 14, d = 2)","1,271 0.162×","66,815 0.229×","133,785 0.0603×","—","518 0.236×","0.4076 1.46×","0.206×","0.0693","2 ^14","+"],
+  "#sweep-table row 5": ["XMSS-MT (WOTS+C, w = 16, h = 16, d = 2)","1,303 0.166×","133,631 0.457×","267,416 0.121×","—","520 0.237×","0.3991 1.43×","0.202×","0.0721","2 ^16","+"],
+  "#sweep-table row 6": ["XMSS-MT (WOTS, w = 16, h = 10, d = 2)","1,299 0.165×","18,271 0.0625×","36,560 0.0165×","—","568 0.259×","0.4373 1.57×","0.221×","0.0721","2 ^10","+"],
+  "#sweep-table row 7": ["XMSS-MT (WOTS, w = 16, h = 12, d = 2)","1,331 0.169×","36,543 0.125×","73,103 0.0330×","—","570 0.260×","0.4282 1.53×","0.216×","0.0742","2 ^12","+"],
+  "#sweep-table row 8": ["XMSS-MT (WOTS+C, w = 32, h = 10, d = 2)","1,015 0.129×","26,879 0.0919×","54,017 0.0243×","—","836 0.381×","0.8236 2.95×","0.416×","0.0759","2 ^10","+"],
+  "#sweep-table row 9": ["XMSS-MT (WOTS+C, w = 32, h = 12, d = 2)","1,047 0.133×","53,759 0.184×","107,776 0.0486×","—","838 0.382×","0.8004 2.87×","0.404×","0.0760","2 ^12","+"],
+  "#sweep-table row 10": ["XMSS-MT (WOTS, w = 16, h = 14, d = 2)","1,363 0.173×","73,087 0.250×","146,190 0.0659×","—","572 0.261×","0.4197 1.50×","0.212×","0.0764","2 ^14","+"],
+  "#sweep-table row 11": ["XMSS-MT (WOTS+C, w = 32, h = 14, d = 2)","1,079 0.137×","107,519 0.368×","215,295 0.0970×","—","840 0.383×","0.7785 2.79×","0.393×","0.0767","2 ^14","+"],
+  "#sweep-table row 12": ["XMSS-MT (WOTS+C, w = 16, h = 18, d = 2)","1,336 0.170×","267,263 0.914×","534,679 0.241×","—","522 0.238×","0.3907 1.40×","0.197×","0.0771","2 ^18","+"],
+  "#sweep-table row 13": ["XMSS-MT (WOTS+C, w = 32, h = 16, d = 2)","1,111 0.141×","215,039 0.736×","430,334 0.194×","—","842 0.384×","0.7579 2.71×","0.383×","0.0790","2 ^16","+"],
+  "#sweep-table row 14": ["XMSS-MT (WOTS, w = 16, h = 16, d = 2)","1,395 0.178×","146,175 0.500×","292,365 0.132×","—","574 0.262×","0.4115 1.47×","0.208×","0.0793","2 ^16","+"],
+  "#sweep-table row 15": ["XMSS-MT (WOTS, w = 32, h = 10, d = 2)","1,075 0.137×","28,959 0.0991×","57,934 0.0261×","—","905 0.413×","0.8419 3.02×","0.425×","0.0803","2 ^10","+"],
+  "#sweep-table row 16": ["XMSS-MT (WOTS, w = 32, h = 12, d = 2)","1,107 0.141×","57,919 0.198×","115,853 0.0522×","—","907 0.414×","0.8193 2.94×","0.414×","0.0806","2 ^12","+"],
+  "#sweep-table row 17": ["XMSS-MT (WOTS, w = 32, h = 14, d = 2)","1,139 0.145×","115,839 0.396×","231,692 0.104×","—","909 0.415×","0.7981 2.86×","0.403×","0.0815","2 ^14","+"],
+  "#sweep-table row 18": ["XMSS-MT (WOTS, w = 32, h = 16, d = 2)","1,171 0.149×","231,679 0.792×","463,371 0.209×","—","911 0.415×","0.7780 2.79×","0.393×","0.0840","2 ^16","+"],
+  "#sweep-table row 19": ["XMSS-MT (WOTS, w = 16, h = 18, d = 2)","1,428 0.182×","292,351","584,716 0.264×","—","576 0.263×","0.4034 1.44×","0.204×","0.0846","2 ^18","+"],
+  "#sweep-table row 20": ["XMSS (WOTS+C, w = 32, h = 10)","597 0.0760×","860,159 2.94×","859,865 0.388×","—","425 0.194×","0.7119 2.55×","0.360×","0.0861","2 ^10","+"],
+  "#sweep-table row 21": ["XMSS-MT (WOTS+C, w = 32, h = 18, d = 2)","1,144 0.146×","430,079 1.47×","860,413 0.388×","—","844 0.385×","0.7378 2.64×","0.373×","0.0864","2 ^18","+"],
+  "#sweep-table row 22": ["XMSS-MT (WOTS+C, w = 16, h = 20, d = 2)","1,368 0.174×","534,527 1.83×","1.07M 0.482×","—","524 0.239×","0.3830 1.37×","0.193×","0.0895","2 ^20","+"],
+  "#sweep-table row 23": ["XMSS (WOTS+C, w = 16, h = 11)","709 0.0902×","1.07M 3.66×","1.07M 0.482×","—","265 0.121×","0.3738 1.34×","0.189×","0.0912","2 ^11","+"],
+  "#sweep-table row 24": ["XMSS (WOTS, w = 32, h = 10)","627 0.0798×","926,719 3.17×","926,271 0.418×","—","459 0.209×","0.7321 2.62×","0.370×","0.0918","2 ^10","+"],
+  "popover #about-signer": "A cached signer keeps tree state between signatures: a BDS state for XMSS and XMSS-MT, and a leaf cache for UXMSS. A cold signer keeps none and rebuilds its trees for every signature. SLH-DSA-128s is stateless, so its SigGen is the same in both modes.",
+  "popover #about-size": "Sizes follow the SHRINCS stateful layout: a one-byte indicator, a 16-byte randomizer and the leaf index, then per layer the WOTS+C counter (2 bytes; 4 at w = 65536), the chains and the authentication path. UXMSS signatures grow by one 16-byte node per signature, so size and ρ show first → last. Ratios, bounds, sorting and SigVer use the largest signature.",
+  "popover #about-siggen": "Cached: an upper bound per signature. For XMSS and XMSS-MT that is one BDS update per layer, at most (h′ − K)/2 + 1 leaf computations; for UXMSS it is the first signature, which combines the most nodes from the leaf cache. Cold: the trees are rebuilt for every signature.",
+  "popover #about-state": "What a cached signer stores: all hsf + 1 leaf hashes for UXMSS, the BDS state bound for XMSS and XMSS-MT. Empty for SLH-DSA-128s and for a cold signer.",
+  "popover #about-schnorr": "The average ρ divided by the ρ of a BIP340 Schnorr verification, 1.98 C/B (libsecp256k1, one 64-byte signature; bip340-vs-sha256 , built-in value, the live kappa.json did not load). SLH-DSA-128s has ρ = 0.2791 C/B, 0.141× Schnorr.",
+  "popover #about-sweep": "XMSS and XMSS-MT with h = 10 to 40, d = 1 to 10 dividing h, WOTS or WOTS+C and w ∈ {16, 32, 64, 128, 256, 65536}, plus the 12 UXMSS variants, whose tree height is capped at hsf = 255. Only candidates smaller than SLH-DSA-128s are listed.",
+  "popover #glossary": "Glossary C One SHA-256 compression. Costs count compressions; the PK.seed block is compressed once per key and reused. B Byte. KeyGen, SigGen, SigVer Compressions to generate a key pair, to sign a message and to verify a signature. SigVer is the average unless marked worst. ρ SigVer per signature byte, in C/B. ρ ÷ Schnorr ρ divided by the ρ of a BIP340 Schnorr verification (libsecp256k1, 64-byte signature). SLH-DSA-128s The FIPS 205 parameter set (h, d, k, a, w) = (63, 7, 14, 12, 16). Ratios (×) compare against it. h, d, k, a, w Hypertree height, number of layers, FORS trees, FORS tree height, Winternitz parameter. h′ = h/d is the height of one layer. q s The number of signatures per key that security is computed for: 2 ^40 for the stateless schemes. WOTS, WOTS+C Winternitz one-time signatures. WOTS (as in SLH-DSA) has checksum chains; WOTS+C replaces them with a counter that the signer grinds until the message digits have a fixed sum, so verification always costs the same. XMSS, XMSS-MT, UXMSS Stateful schemes: one balanced Merkle tree (BXMSS in SHRINCS), d layers of such trees, and the unbalanced SHRINCS tree, whose signatures grow by one node per signature. Cached, cold A cached signer keeps tree state between signatures (a BDS state for XMSS, a leaf cache for UXMSS); a cold signer keeps none and rebuilds its trees for every signature.",
   "input #signer-mode": "cold",
   "input #f-scheme": "xmssmt",
   "input #f-ots": "TW",
@@ -434,39 +448,46 @@
   "input #sw-W-cb-val": "1.0"
  },
  "stateful.html#b=0.5,20,20,2,20,20&w=5,1,1,2,1&sort=size.asc": {
-  "#compare-table row 0": ["SLH-DSA-128s","7,856 B","292.4K","2.22M","—","2.2K","0.279","0.496","0.141×","2^64",""],
-  "#compare-table row 1": ["UXMSS (WOTS, w=16) sig grows with index — worst case shown (255 auth nodes); capacity 256 sigs","594–4,665 B 0.59×","146.2K 0.50×","554 0.00×","4,096 B","536 0.24×","0.475→0.115 0.41×","0.884→0.167 0.34×","0.240→0.058×","256","×"],
-  "#compare-table row 2": ["UXMSS (WOTS+C, w=16) sig grows with index — worst case shown (255 auth nodes); capacity 256 sigs","548–4,619 B 0.59×","133.6K 0.46×","599 0.00×","4,096 B","509 0.23×","0.465→0.110 0.39×","0.465→0.110 0.22×","0.235→0.056×","256","×"],
-  "#compare-table row 3": ["XMSS-2^10 (WOTS, w=16, d=1)","739 B 0.09×","584.7K 2.00×","3.2K 0.00×","496 B","291 0.13×","0.394 1.41×","0.723 1.46×","0.199×","2^10","×"],
-  "#compare-table row 4": ["XMSS-2^10 (WOTS+C, w=16, d=1)","693 B 0.09×","534.5K 1.83×","3.0K 0.00×","496 B","264 0.12×","0.381 1.36×","0.381 0.77×","0.192×","2^10","×"],
-  "#compare-table row 5": ["XMSS-2^20 (WOTS, w=16, d=1)","900 B 0.11×","598.74M 2.0e+3×","6.0K 0.00×","1,056 B","301 0.14×","0.334 1.20×","0.604 1.22×","0.169×","2^20","×"],
-  "#compare-table row 6": ["XMSS-2^20 (WOTS+C, w=16, d=1)","854 B 0.11×","547.36M 1.9e+3×","5.6K 0.00×","1,056 B","274 0.12×","0.321 1.15×","0.321 0.65×","0.162×","2^20","×"],
-  "#sweep-info": "159 of 1116 candidates pass the current bounds.",
-  "#sweep-table row 0": ["XMSS-2^20 (WOTS+C, w=256, d=2)","856 B 0.11×","4.20M 14.4×","43.8K 0.02×","1,248 B","4.1K 1.88×","4.808 17.2×","2.428×","0.6628","2^20","+"],
-  "#sweep-table row 1": ["XMSS-2^20 (WOTS+C, w=128, d=2)","952 B 0.12×","2.50M 8.54×","26.0K 0.01×","1,296 B","2.5K 1.12×","2.576 9.23×","1.301×","0.3572","2^20","+"],
-  "#sweep-table row 2": ["XMSS-2^22 (WOTS+C, w=128, d=2)","984 B 0.13×","5.00M 17.1×","26.0K 0.01×","1,424 B","2.5K 1.12×","2.494 8.93×","1.260×","0.4267","2^22","+"],
-  "#sweep-table row 3": ["XMSS-2^20 (WOTS, w=128, d=2)","1,012 B 0.13×","2.76M 9.44×","28.3K 0.01×","1,328 B","2.8K 1.28×","2.779 9.95×","1.403×","0.4072","2^20","+"],
-  "#sweep-table row 4": ["XMSS-2^22 (WOTS, w=128, d=2)","1,044 B 0.13×","5.52M 18.9×","28.3K 0.01×","1,456 B","2.8K 1.28×","2.695 9.66×","1.361×","0.4823","2^22","+"],
-  "#sweep-table row 5": ["XMSS-2^20 (WOTS+C, w=64, d=2)","1,048 B 0.13×","1.45M 4.96×","15.1K 0.01×","1,344 B","1.4K 0.65×","1.359 4.87×","0.686×","0.1795","2^20","+"],
-  "#sweep-table row 6": ["XMSS-2^22 (WOTS+C, w=64, d=2)","1,080 B 0.14×","2.90M 9.91×","15.1K 0.01×","1,472 B","1.4K 0.65×","1.320 4.73×","0.667×","0.2266","2^22","+"],
-  "#sweep-table row 7": ["XMSS-2^20 (WOTS, w=64, d=2)","1,108 B 0.14×","1.58M 5.41×","16.2K 0.01×","1,376 B","1.6K 0.73×","1.437 5.15×","0.726×","0.2052","2^20","+"],
-  "#sweep-table row 8": ["XMSS-2^24 (WOTS+C, w=64, d=2)","1,112 B 0.14×","5.80M 19.8×","17.9K 0.01×","1,568 B","1.4K 0.65×","1.284 4.60×","0.649×","0.3624","2^24","+"],
-  "#sweep-table row 9": ["XMSS-2^22 (WOTS, w=64, d=2)","1,140 B 0.15×","3.16M 10.8×","16.2K 0.01×","1,504 B","1.6K 0.73×","1.398 5.01×","0.706×","0.2549","2^22","+"],
-  "#sweep-table row 10": ["XMSS-2^20 (WOTS+C, w=32, d=2)","1,176 B 0.15×","860.2K 2.94×","9.0K 0.00×","1,408 B","846 0.39×","0.719 2.58×","0.363×","0.1059","2^20","+"],
-  "#sweep-table row 11": ["XMSS-2^22 (WOTS+C, w=32, d=2)","1,208 B 0.15×","1.72M 5.88×","9.0K 0.00×","1,536 B","848 0.39×","0.702 2.51×","0.355×","0.1376","2^22","+"],
-  "#sweep-table row 12": ["XMSS-2^20 (WOTS, w=32, d=2)","1,236 B 0.16×","926.7K 3.17×","9.5K 0.00×","1,440 B","915 0.42×","0.740 2.65×","0.374×","0.1225","2^20","+"],
-  "#sweep-table row 13": ["XMSS-2^24 (WOTS+C, w=32, d=2)","1,240 B 0.16×","3.44M 11.8×","10.7K 0.00×","1,632 B","850 0.39×","0.685 2.46×","0.346×","0.2185","2^24","+"],
-  "#sweep-table row 14": ["XMSS-2^22 (WOTS, w=32, d=2)","1,268 B 0.16×","1.85M 6.34×","9.5K 0.00×","1,568 B","917 0.42×","0.723 2.59×","0.365×","0.1549","2^22","+"],
-  "#sweep-table row 15": ["XMSS-2^21 (WOTS+C, w=128, d=3)","1,274 B 0.16×","312.2K 1.07×","23.6K 0.01×","1,616 B","3.7K 1.67×","2.878 10.3×","1.454×","0.4566","2^21","+"],
-  "#sweep-table row 16": ["XMSS-2^24 (WOTS, w=32, d=2)","1,300 B 0.17×","3.71M 12.7×","11.3K 0.01×","1,664 B","919 0.42×","0.707 2.53×","0.357×","0.2398","2^24","+"],
-  "#sweep-table row 17": ["XMSS-2^24 (WOTS+C, w=128, d=3)","1,322 B 0.17×","624.4K 2.14×","30.9K 0.01×","1,760 B","3.7K 1.67×","2.776 9.94×","1.402×","0.4806","2^24","+"],
-  "#sweep-table row 18": ["XMSS-2^21 (WOTS, w=128, d=3)","1,364 B 0.17×","345.0K 1.18×","25.6K 0.01×","1,680 B","4.2K 1.92×","3.084 11.0×","1.558×","0.5264","2^21","+"],
-  "#sweep-table row 19": ["XMSS-2^20 (WOTS+C, w=16, d=2)","1,368 B 0.17×","534.5K 1.83×","5.6K 0.00×","1,504 B","524 0.24×","0.383 1.37×","0.193×","0.1236","2^20","+"],
-  "#sweep-table row 20": ["XMSS-2^27 (WOTS+C, w=128, d=3)","1,371 B 0.17×","1.25M 4.27×","30.9K 0.01×","1,952 B","3.7K 1.67×","2.679 9.60×","1.353×","0.4847","2^27","+"],
-  "#sweep-table row 21": ["XMSS-2^22 (WOTS+C, w=16, d=2)","1,400 B 0.18×","1.07M 3.66×","5.6K 0.00×","1,632 B","526 0.24×","0.376 1.35×","0.190×","0.1402","2^22","+"],
-  "#sweep-table row 22": ["XMSS-2^24 (WOTS, w=128, d=3)","1,412 B 0.18×","689.9K 2.36×","33.7K 0.02×","1,824 B","4.2K 1.92×","2.982 10.7×","1.506×","0.5520","2^24","+"],
-  "#sweep-table row 23": ["XMSS-2^21 (WOTS+C, w=64, d=3)","1,418 B 0.18×","181.1K 0.62×","13.7K 0.01×","1,712 B","2.1K 0.97×","1.499 5.37×","0.757×","0.2578","2^21","+"],
-  "#sweep-table row 24": ["XMSS-2^30 (WOTS+C, w=128, d=3)","1,419 B 0.18×","2.50M 8.54×","38.2K 0.02×","2,096 B","3.7K 1.68×","2.591 9.28×","1.308×","0.5277","2^30","+"],
+  "#compare-table row 0": ["SLH-DSA-128s","7,856","292,351","2.22M","—","2,193","0.2791","0.4955","0.141×","2 ^64",""],
+  "#compare-table row 1": ["UXMSS (WOTS, w = 16)","594 → 4,665 0.594×","146,175 0.500×","554 0.000250×","4,096","536 0.244×","0.4747 → 0.1149 0.412×","0.8838 → 0.1670 0.337×","0.240× → 0.0580×","256","×"],
+  "#compare-table row 2": ["UXMSS (WOTS+C, w = 16)","548 → 4,619 0.588×","133,631 0.457×","599 0.000270×","4,096","509 0.232×","0.4653 → 0.1102 0.395×","0.4653 → 0.1102 0.222×","0.235× → 0.0557×","256","×"],
+  "#compare-table row 3": ["XMSS (WOTS, w = 16, h = 10)","739 0.0941×","584,703 2.00×","3,161 0.00142×","496","291 0.133×","0.3938 1.41×","0.7226 1.46×","0.199×","2 ^10","×"],
+  "#compare-table row 4": ["XMSS (WOTS+C, w = 16, h = 10)","693 0.0882×","534,527 1.83×","2,961 0.00133×","496","264 0.120×","0.3810 1.36×","0.3810 0.769×","0.192×","2 ^10","×"],
+  "#compare-table row 5": ["XMSS (WOTS, w = 16, h = 20)","900 0.115×","599M 2,048×","6,026 0.00272×","1,056","301 0.137×","0.3344 1.20×","0.6044 1.22×","0.169×","2 ^20","×"],
+  "#compare-table row 6": ["XMSS (WOTS+C, w = 16, h = 20)","854 0.109×","547M 1,872×","5,581 0.00252×","1,056","274 0.125×","0.3208 1.15×","0.3208 0.647×","0.162×","2 ^20","×"],
+  "#sweep-info": "159 of 1,116 candidates within the bounds.",
+  "#sweep-table row 0": ["XMSS-MT (WOTS+C, w = 256, h = 20, d = 2)","856 0.109×","4.20M 14.4×","43,844 0.0198×","1,248","4,116 1.88×","4.8084 17.2×","2.43×","0.6628","2 ^20","+"],
+  "#sweep-table row 1": ["XMSS-MT (WOTS+C, w = 128, h = 20, d = 2)","952 0.121×","2.50M 8.54×","26,041 0.0117×","1,296","2,452 1.12×","2.5756 9.23×","1.30×","0.3572","2 ^20","+"],
+  "#sweep-table row 2": ["XMSS-MT (WOTS+C, w = 128, h = 22, d = 2)","984 0.125×","5.00M 17.1×","26,041 0.0117×","1,424","2,454 1.12×","2.4939 8.93×","1.26×","0.4267","2 ^22","+"],
+  "#sweep-table row 3": ["XMSS-MT (WOTS, w = 128, h = 20, d = 2)","1,012 0.129×","2.76M 9.44×","28,269 0.0127×","1,328","2,812 1.28×","2.7787 9.95×","1.40×","0.4072","2 ^20","+"],
+  "#sweep-table row 4": ["XMSS-MT (WOTS, w = 128, h = 22, d = 2)","1,044 0.133×","5.52M 18.9×","28,269 0.0127×","1,456","2,814 1.28×","2.6954 9.66×","1.36×","0.4823","2 ^22","+"],
+  "#sweep-table row 5": ["XMSS-MT (WOTS+C, w = 64, h = 20, d = 2)","1,048 0.133×","1.45M 4.96×","15,103 0.00681×","1,344","1,424 0.649×","1.3588 4.87×","0.686×","0.1795","2 ^20","+"],
+  "#sweep-table row 6": ["XMSS-MT (WOTS+C, w = 64, h = 22, d = 2)","1,080 0.137×","2.90M 9.91×","15,103 0.00681×","1,472","1,426 0.650×","1.3204 4.73×","0.667×","0.2266","2 ^22","+"],
+  "#sweep-table row 7": ["XMSS-MT (WOTS, w = 64, h = 20, d = 2)","1,108 0.141×","1.58M 5.41×","16,218 0.00731×","1,376","1,592 0.726×","1.4368 5.15×","0.726×","0.2052","2 ^20","+"],
+  "#sweep-table row 8": ["XMSS-MT (WOTS+C, w = 64, h = 24, d = 2)","1,112 0.142×","5.80M 19.8×","17,937 0.00809×","1,568","1,428 0.651×","1.2842 4.60×","0.649×","0.3624","2 ^24","+"],
+  "#sweep-table row 9": ["XMSS-MT (WOTS, w = 64, h = 22, d = 2)","1,140 0.145×","3.16M 10.8×","16,218 0.00731×","1,504","1,594 0.727×","1.3982 5.01×","0.706×","0.2549","2 ^22","+"],
+  "#sweep-table row 10": ["XMSS-MT (WOTS+C, w = 32, h = 20, d = 2)","1,176 0.150×","860,159 2.94×","8,967 0.00404×","1,408","846 0.386×","0.7194 2.58×","0.363×","0.1059","2 ^20","+"],
+  "#sweep-table row 11": ["XMSS-MT (WOTS+C, w = 32, h = 22, d = 2)","1,208 0.154×","1.72M 5.88×","8,967 0.00404×","1,536","848 0.387×","0.7020 2.51×","0.355×","0.1376","2 ^22","+"],
+  "#sweep-table row 12": ["XMSS-MT (WOTS, w = 32, h = 20, d = 2)","1,236 0.157×","926,719 3.17×","9,528 0.00429×","1,440","915 0.417×","0.7403 2.65×","0.374×","0.1225","2 ^20","+"],
+  "#sweep-table row 13": ["XMSS-MT (WOTS+C, w = 32, h = 24, d = 2)","1,240 0.158×","3.44M 11.8×","10,651 0.00480×","1,632","850 0.388×","0.6855 2.46×","0.346×","0.2185","2 ^24","+"],
+  "#sweep-table row 14": ["XMSS-MT (WOTS, w = 32, h = 22, d = 2)","1,268 0.161×","1.85M 6.34×","9,528 0.00429×","1,568","917 0.418×","0.7232 2.59×","0.365×","0.1549","2 ^22","+"],
+  "#sweep-table row 15": ["XMSS-MT (WOTS+C, w = 128, h = 21, d = 3)","1,274 0.162×","312,191 1.07×","23,596 0.0106×","1,616","3,667 1.67×","2.8783 10.3×","1.45×","0.4566","2 ^21","+"],
+  "#sweep-table row 16": ["XMSS-MT (WOTS, w = 32, h = 24, d = 2)","1,300 0.165×","3.71M 12.7×","11,342 0.00511×","1,664","919 0.419×","0.7069 2.53×","0.357×","0.2398","2 ^24","+"],
+  "#sweep-table row 17": ["XMSS-MT (WOTS+C, w = 128, h = 24, d = 3)","1,322 0.168×","624,383 2.14×","30,919 0.0139×","1,760","3,670 1.67×","2.7761 9.94×","1.40×","0.4806","2 ^24","+"],
+  "#sweep-table row 18": ["XMSS-MT (WOTS, w = 128, h = 21, d = 3)","1,364 0.174×","344,959 1.18×","25,568 0.0115×","1,680","4,207 1.92×","3.0843 11.0×","1.56×","0.5264","2 ^21","+"],
+  "#sweep-table row 19": ["XMSS-MT (WOTS+C, w = 16, h = 20, d = 2)","1,368 0.174×","534,527 1.83×","5,577 0.00251×","1,504","524 0.239×","0.3830 1.37×","0.193×","0.1236","2 ^20","+"],
+  "#sweep-table row 20": ["XMSS-MT (WOTS+C, w = 128, h = 27, d = 3)","1,371 0.175×","1.25M 4.27×","30,919 0.0139×","1,952","3,673 1.67×","2.6791 9.60×","1.35×","0.4847","2 ^27","+"],
+  "#sweep-table row 21": ["XMSS-MT (WOTS+C, w = 16, h = 22, d = 2)","1,400 0.178×","1.07M 3.66×","5,577 0.00251×","1,632","526 0.240×","0.3757 1.35×","0.190×","0.1402","2 ^22","+"],
+  "#sweep-table row 22": ["XMSS-MT (WOTS, w = 128, h = 24, d = 3)","1,412 0.180×","689,919 2.36×","33,659 0.0152×","1,824","4,210 1.92×","2.9816 10.7×","1.51×","0.5520","2 ^24","+"],
+  "#sweep-table row 23": ["XMSS-MT (WOTS+C, w = 64, h = 21, d = 3)","1,418 0.180×","181,119 0.620×","13,682 0.00617×","1,712","2,125 0.969×","1.4986 5.37×","0.757×","0.2578","2 ^21","+"],
+  "#sweep-table row 24": ["XMSS-MT (WOTS+C, w = 128, h = 30, d = 3)","1,419 0.181×","2.50M 8.54×","38,242 0.0172×","2,096","3,676 1.68×","2.5906 9.28×","1.31×","0.5277","2 ^30","+"],
+  "popover #about-signer": "A cached signer keeps tree state between signatures: a BDS state for XMSS and XMSS-MT, and a leaf cache for UXMSS. A cold signer keeps none and rebuilds its trees for every signature. SLH-DSA-128s is stateless, so its SigGen is the same in both modes.",
+  "popover #about-size": "Sizes follow the SHRINCS stateful layout: a one-byte indicator, a 16-byte randomizer and the leaf index, then per layer the WOTS+C counter (2 bytes; 4 at w = 65536), the chains and the authentication path. UXMSS signatures grow by one 16-byte node per signature, so size and ρ show first → last. Ratios, bounds, sorting and SigVer use the largest signature.",
+  "popover #about-siggen": "Cached: an upper bound per signature. For XMSS and XMSS-MT that is one BDS update per layer, at most (h′ − K)/2 + 1 leaf computations; for UXMSS it is the first signature, which combines the most nodes from the leaf cache. Cold: the trees are rebuilt for every signature.",
+  "popover #about-state": "What a cached signer stores: all hsf + 1 leaf hashes for UXMSS, the BDS state bound for XMSS and XMSS-MT. Empty for SLH-DSA-128s and for a cold signer.",
+  "popover #about-schnorr": "The average ρ divided by the ρ of a BIP340 Schnorr verification, 1.98 C/B (libsecp256k1, one 64-byte signature; bip340-vs-sha256 , built-in value, the live kappa.json did not load). SLH-DSA-128s has ρ = 0.2791 C/B, 0.141× Schnorr.",
+  "popover #about-sweep": "XMSS and XMSS-MT with h = 10 to 40, d = 1 to 10 dividing h, WOTS or WOTS+C and w ∈ {16, 32, 64, 128, 256, 65536}, plus the 12 UXMSS variants, whose tree height is capped at hsf = 255. Only candidates smaller than SLH-DSA-128s are listed.",
+  "popover #glossary": "Glossary C One SHA-256 compression. Costs count compressions; the PK.seed block is compressed once per key and reused. B Byte. KeyGen, SigGen, SigVer Compressions to generate a key pair, to sign a message and to verify a signature. SigVer is the average unless marked worst. ρ SigVer per signature byte, in C/B. ρ ÷ Schnorr ρ divided by the ρ of a BIP340 Schnorr verification (libsecp256k1, 64-byte signature). SLH-DSA-128s The FIPS 205 parameter set (h, d, k, a, w) = (63, 7, 14, 12, 16). Ratios (×) compare against it. h, d, k, a, w Hypertree height, number of layers, FORS trees, FORS tree height, Winternitz parameter. h′ = h/d is the height of one layer. q s The number of signatures per key that security is computed for: 2 ^40 for the stateless schemes. WOTS, WOTS+C Winternitz one-time signatures. WOTS (as in SLH-DSA) has checksum chains; WOTS+C replaces them with a counter that the signer grinds until the message digits have a fixed sum, so verification always costs the same. XMSS, XMSS-MT, UXMSS Stateful schemes: one balanced Merkle tree (BXMSS in SHRINCS), d layers of such trees, and the unbalanced SHRINCS tree, whose signatures grow by one node per signature. Cached, cold A cached signer keeps tree state between signatures (a BDS state for XMSS, a leaf cache for UXMSS); a cold signer keeps none and rebuilds its trees for every signature.",
   "input #signer-mode": "cached",
   "input #f-scheme": "xmssmt",
   "input #f-ots": "TW",
@@ -486,39 +507,46 @@
   "input #sw-W-cb-val": "1.0"
  },
  "stateful.html#b=1,20,20,1.5,20,30&w=5,1,1,2,1": {
-  "#compare-table row 0": ["SLH-DSA-128s","7,856 B","292.4K","2.22M","—","2.2K","0.279","0.496","0.141×","2^64",""],
-  "#compare-table row 1": ["UXMSS (WOTS, w=16) sig grows with index — worst case shown (255 auth nodes); capacity 256 sigs","594–4,665 B 0.59×","146.2K 0.50×","554 0.00×","4,096 B","536 0.24×","0.475→0.115 0.41×","0.884→0.167 0.34×","0.240→0.058×","256","×"],
-  "#compare-table row 2": ["UXMSS (WOTS+C, w=16) sig grows with index — worst case shown (255 auth nodes); capacity 256 sigs","548–4,619 B 0.59×","133.6K 0.46×","599 0.00×","4,096 B","509 0.23×","0.465→0.110 0.39×","0.465→0.110 0.22×","0.235→0.056×","256","×"],
-  "#compare-table row 3": ["XMSS-2^10 (WOTS, w=16, d=1)","739 B 0.09×","584.7K 2.00×","3.2K 0.00×","496 B","291 0.13×","0.394 1.41×","0.723 1.46×","0.199×","2^10","×"],
-  "#compare-table row 4": ["XMSS-2^10 (WOTS+C, w=16, d=1)","693 B 0.09×","534.5K 1.83×","3.0K 0.00×","496 B","264 0.12×","0.381 1.36×","0.381 0.77×","0.192×","2^10","×"],
-  "#compare-table row 5": ["XMSS-2^20 (WOTS, w=16, d=1)","900 B 0.11×","598.74M 2.0e+3×","6.0K 0.00×","1,056 B","301 0.14×","0.334 1.20×","0.604 1.22×","0.169×","2^20","×"],
-  "#compare-table row 6": ["XMSS-2^20 (WOTS+C, w=16, d=1)","854 B 0.11×","547.36M 1.9e+3×","5.6K 0.00×","1,056 B","274 0.12×","0.321 1.15×","0.321 0.65×","0.162×","2^20","×"],
-  "#sweep-info": "71 of 1116 candidates pass the current bounds.",
-  "#sweep-table row 0": ["XMSS-2^30 (WOTS+C, w=16, d=3)","2,043 B 0.26×","534.5K 1.83×","8.2K 0.00×","2,512 B","784 0.36×","0.384 1.37×","0.194×","0.0843","2^30","+"],
-  "#sweep-table row 1": ["XMSS-2^33 (WOTS+C, w=16, d=3)","2,092 B 0.27×","1.07M 3.66×","8.2K 0.00×","2,704 B","787 0.36×","0.376 1.35×","0.190×","0.1037","2^33","+"],
-  "#sweep-table row 2": ["XMSS-2^30 (WOTS, w=16, d=3)","2,181 B 0.28×","584.7K 2.00×","8.9K 0.00×","2,608 B","865 0.39×","0.397 1.42×","0.200×","0.1076","2^30","+"],
-  "#sweep-table row 3": ["XMSS-2^33 (WOTS, w=16, d=3)","2,230 B 0.28×","1.17M 4.00×","8.9K 0.00×","2,800 B","868 0.40×","0.389 1.39×","0.197×","0.1266","2^33","+"],
-  "#sweep-table row 4": ["XMSS-2^36 (WOTS+C, w=16, d=3)","2,140 B 0.27×","2.14M 7.31×","9.8K 0.00×","2,848 B","790 0.36×","0.369 1.32×","0.186×","0.1540","2^36","+"],
-  "#sweep-table row 5": ["XMSS-2^32 (WOTS+C, w=16, d=4)","2,589 B 0.33×","133.6K 0.46×","8.7K 0.00×","3,072 B","1.0K 0.47×","0.400 1.43×","0.202×","0.1663","2^32","+"],
-  "#sweep-table row 6": ["XMSS-2^30 (WOTS+C, w=32, d=3)","1,755 B 0.22×","860.2K 2.94×","13.2K 0.01×","2,320 B","1.3K 0.58×","0.722 2.59×","0.365×","0.1705","2^30","+"],
-  "#sweep-table row 7": ["XMSS-2^36 (WOTS+C, w=16, d=4)","2,654 B 0.34×","267.3K 0.91×","8.7K 0.00×","3,328 B","1.0K 0.47×","0.392 1.40×","0.198×","0.1759","2^36","+"],
-  "#sweep-table row 8": ["XMSS-2^36 (WOTS, w=16, d=3)","2,278 B 0.29×","2.34M 8.00×","10.6K 0.00×","2,944 B","871 0.40×","0.382 1.37×","0.193×","0.1784","2^36","+"],
-  "#sweep-table row 9": ["XMSS-2^33 (WOTS+C, w=32, d=3)","1,804 B 0.23×","1.72M 5.88×","13.2K 0.01×","2,512 B","1.3K 0.58×","0.704 2.52×","0.356×","0.1879","2^33","+"],
-  "#sweep-table row 10": ["XMSS-2^30 (WOTS, w=32, d=3)","1,845 B 0.23×","926.7K 3.17×","14.1K 0.01×","2,384 B","1.4K 0.62×","0.743 2.66×","0.375×","0.1934","2^30","+"],
-  "#sweep-table row 11": ["XMSS-2^40 (WOTS+C, w=16, d=4)","2,718 B 0.35×","534.5K 1.83×","10.8K 0.00×","3,520 B","1.0K 0.48×","0.384 1.38×","0.194×","0.1936","2^40","+"],
-  "#sweep-table row 12": ["XMSS-2^32 (WOTS, w=16, d=4)","2,773 B 0.35×","146.2K 0.50×","9.5K 0.00×","3,216 B","1.1K 0.52×","0.413 1.48×","0.208×","0.2003","2^32","+"],
-  "#sweep-table row 13": ["XMSS-2^36 (WOTS, w=16, d=4)","2,838 B 0.36×","292.4K","9.5K 0.00×","3,472 B","1.1K 0.52×","0.405 1.45×","0.204×","0.2098","2^36","+"],
-  "#sweep-table row 14": ["XMSS-2^33 (WOTS, w=32, d=3)","1,894 B 0.24×","1.85M 6.34×","14.1K 0.01×","2,576 B","1.4K 0.63×","0.725 2.60×","0.366×","0.2119","2^33","+"],
-  "#sweep-table row 15": ["XMSS-2^40 (WOTS, w=16, d=4)","2,902 B 0.37×","584.7K 2.00×","11.7K 0.01×","3,664 B","1.2K 0.53×","0.397 1.42×","0.200×","0.2281","2^40","+"],
-  "#sweep-table row 16": ["XMSS-2^32 (WOTS+C, w=32, d=4)","2,205 B 0.28×","215.0K 0.74×","14.0K 0.01×","2,784 B","1.7K 0.77×","0.762 2.73×","0.385×","0.2440","2^32","+"],
-  "#sweep-table row 17": ["XMSS-2^36 (WOTS+C, w=32, d=4)","2,270 B 0.29×","430.1K 1.47×","14.0K 0.01×","3,040 B","1.7K 0.77×","0.742 2.66×","0.375×","0.2470","2^36","+"],
-  "#sweep-table row 18": ["XMSS-2^30 (WOTS+C, w=16, d=5)","3,071 B 0.39×","33.4K 0.11×","8.2K 0.00×","3,408 B","1.3K 0.59×","0.418 1.50×","0.211×","0.2479","2^30","+"],
-  "#sweep-table row 19": ["XMSS-2^39 (WOTS+C, w=16, d=3)","2,188 B 0.28×","4.28M 14.6×","9.8K 0.00×","3,040 B","793 0.36×","0.362 1.30×","0.183×","0.2566","2^39","+"],
-  "#sweep-table row 20": ["XMSS-2^35 (WOTS+C, w=16, d=5)","3,152 B 0.40×","66.8K 0.23×","8.2K 0.00×","3,728 B","1.3K 0.59×","0.409 1.46×","0.207×","0.2593","2^35","+"],
-  "#sweep-table row 21": ["XMSS-2^36 (WOTS+C, w=32, d=3)","1,852 B 0.24×","3.44M 11.8×","15.7K 0.01×","2,656 B","1.3K 0.58×","0.687 2.46×","0.347×","0.2611","2^36","+"],
-  "#sweep-table row 22": ["XMSS-2^40 (WOTS+C, w=32, d=4)","2,334 B 0.30×","860.2K 2.94×","17.4K 0.01×","3,232 B","1.7K 0.77×","0.723 2.59×","0.365×","0.2721","2^40","+"],
-  "#sweep-table row 23": ["XMSS-2^32 (WOTS, w=32, d=4)","2,325 B 0.30×","231.7K 0.79×","15.0K 0.01×","2,880 B","1.8K 0.83×","0.782 2.80×","0.395×","0.2762","2^32","+"],
-  "#sweep-table row 24": ["XMSS-2^40 (WOTS+C, w=16, d=5)","3,232 B 0.41×","133.6K 0.46×","10.8K 0.00×","3,968 B","1.3K 0.59×","0.400 1.43×","0.202×","0.2763","2^40","+"],
+  "#compare-table row 0": ["SLH-DSA-128s","7,856","292,351","2.22M","—","2,193","0.2791","0.4955","0.141×","2 ^64",""],
+  "#compare-table row 1": ["UXMSS (WOTS, w = 16)","594 → 4,665 0.594×","146,175 0.500×","554 0.000250×","4,096","536 0.244×","0.4747 → 0.1149 0.412×","0.8838 → 0.1670 0.337×","0.240× → 0.0580×","256","×"],
+  "#compare-table row 2": ["UXMSS (WOTS+C, w = 16)","548 → 4,619 0.588×","133,631 0.457×","599 0.000270×","4,096","509 0.232×","0.4653 → 0.1102 0.395×","0.4653 → 0.1102 0.222×","0.235× → 0.0557×","256","×"],
+  "#compare-table row 3": ["XMSS (WOTS, w = 16, h = 10)","739 0.0941×","584,703 2.00×","3,161 0.00142×","496","291 0.133×","0.3938 1.41×","0.7226 1.46×","0.199×","2 ^10","×"],
+  "#compare-table row 4": ["XMSS (WOTS+C, w = 16, h = 10)","693 0.0882×","534,527 1.83×","2,961 0.00133×","496","264 0.120×","0.3810 1.36×","0.3810 0.769×","0.192×","2 ^10","×"],
+  "#compare-table row 5": ["XMSS (WOTS, w = 16, h = 20)","900 0.115×","599M 2,048×","6,026 0.00272×","1,056","301 0.137×","0.3344 1.20×","0.6044 1.22×","0.169×","2 ^20","×"],
+  "#compare-table row 6": ["XMSS (WOTS+C, w = 16, h = 20)","854 0.109×","547M 1,872×","5,581 0.00252×","1,056","274 0.125×","0.3208 1.15×","0.3208 0.647×","0.162×","2 ^20","×"],
+  "#sweep-info": "71 of 1,116 candidates within the bounds.",
+  "#sweep-table row 0": ["XMSS-MT (WOTS+C, w = 16, h = 30, d = 3)","2,043 0.260×","534,527 1.83×","8,193 0.00369×","2,512","784 0.358×","0.3837 1.37×","0.194×","0.0843","2 ^30","+"],
+  "#sweep-table row 1": ["XMSS-MT (WOTS+C, w = 16, h = 33, d = 3)","2,092 0.266×","1.07M 3.66×","8,193 0.00369×","2,704","787 0.359×","0.3762 1.35×","0.190×","0.1037","2 ^33","+"],
+  "#sweep-table row 2": ["XMSS-MT (WOTS, w = 16, h = 30, d = 3)","2,181 0.278×","584,703 2.00×","8,883 0.00400×","2,608","865 0.394×","0.3966 1.42×","0.200×","0.1076","2 ^30","+"],
+  "#sweep-table row 3": ["XMSS-MT (WOTS, w = 16, h = 33, d = 3)","2,230 0.284×","1.17M 4.00×","8,883 0.00400×","2,800","868 0.396×","0.3892 1.39×","0.197×","0.1266","2 ^33","+"],
+  "#sweep-table row 4": ["XMSS-MT (WOTS+C, w = 16, h = 36, d = 3)","2,140 0.272×","2.14M 7.31×","9,765 0.00440×","2,848","790 0.360×","0.3692 1.32×","0.186×","0.1540","2 ^36","+"],
+  "#sweep-table row 5": ["XMSS-MT (WOTS+C, w = 16, h = 32, d = 4)","2,589 0.330×","133,631 0.457×","8,713 0.00393×","3,072","1,036 0.472×","0.4002 1.43×","0.202×","0.1663","2 ^32","+"],
+  "#sweep-table row 6": ["XMSS-MT (WOTS+C, w = 32, h = 30, d = 3)","1,755 0.223×","860,159 2.94×","13,173 0.00594×","2,320","1,267 0.578×","0.7219 2.59×","0.365×","0.1705","2 ^30","+"],
+  "#sweep-table row 7": ["XMSS-MT (WOTS+C, w = 16, h = 36, d = 4)","2,654 0.338×","267,263 0.914×","8,713 0.00393×","3,328","1,040 0.474×","0.3919 1.40×","0.198×","0.1759","2 ^36","+"],
+  "#sweep-table row 8": ["XMSS-MT (WOTS, w = 16, h = 36, d = 3)","2,278 0.290×","2.34M 8.00×","10,602 0.00478×","2,944","871 0.397×","0.3824 1.37×","0.193×","0.1784","2 ^36","+"],
+  "#sweep-table row 9": ["XMSS-MT (WOTS+C, w = 32, h = 33, d = 3)","1,804 0.230×","1.72M 5.88×","13,173 0.00594×","2,512","1,270 0.579×","0.7040 2.52×","0.356×","0.1879","2 ^33","+"],
+  "#sweep-table row 10": ["XMSS-MT (WOTS, w = 32, h = 30, d = 3)","1,845 0.235×","926,719 3.17×","14,059 0.00634×","2,384","1,370 0.625×","0.7425 2.66×","0.375×","0.1934","2 ^30","+"],
+  "#sweep-table row 11": ["XMSS-MT (WOTS+C, w = 16, h = 40, d = 4)","2,718 0.346×","534,527 1.83×","10,809 0.00487×","3,520","1,044 0.476×","0.3841 1.38×","0.194×","0.1936","2 ^40","+"],
+  "#sweep-table row 12": ["XMSS-MT (WOTS, w = 16, h = 32, d = 4)","2,773 0.353×","146,175 0.500×","9,452 0.00426×","3,216","1,144 0.522×","0.4125 1.48×","0.208×","0.2003","2 ^32","+"],
+  "#sweep-table row 13": ["XMSS-MT (WOTS, w = 16, h = 36, d = 4)","2,838 0.361×","292,351","9,452 0.00426×","3,472","1,148 0.523×","0.4045 1.45×","0.204×","0.2098","2 ^36","+"],
+  "#sweep-table row 14": ["XMSS-MT (WOTS, w = 32, h = 33, d = 3)","1,894 0.241×","1.85M 6.34×","14,059 0.00634×","2,576","1,373 0.626×","0.7249 2.60×","0.366×","0.2119","2 ^33","+"],
+  "#sweep-table row 15": ["XMSS-MT (WOTS, w = 16, h = 40, d = 4)","2,902 0.369×","584,703 2.00×","11,744 0.00529×","3,664","1,152 0.525×","0.3970 1.42×","0.200×","0.2281","2 ^40","+"],
+  "#sweep-table row 16": ["XMSS-MT (WOTS+C, w = 32, h = 32, d = 4)","2,205 0.281×","215,039 0.736×","14,011 0.00632×","2,784","1,680 0.766×","0.7619 2.73×","0.385×","0.2440","2 ^32","+"],
+  "#sweep-table row 17": ["XMSS-MT (WOTS+C, w = 32, h = 36, d = 4)","2,270 0.289×","430,079 1.47×","14,011 0.00632×","3,040","1,684 0.768×","0.7419 2.66×","0.375×","0.2470","2 ^36","+"],
+  "#sweep-table row 18": ["XMSS-MT (WOTS+C, w = 16, h = 30, d = 5)","3,071 0.391×","33,407 0.114×","8,185 0.00369×","3,408","1,284 0.585×","0.4181 1.50×","0.211×","0.2479","2 ^30","+"],
+  "#sweep-table row 19": ["XMSS-MT (WOTS+C, w = 16, h = 39, d = 3)","2,188 0.279×","4.28M 14.6×","9,765 0.00440×","3,040","793 0.362×","0.3624 1.30×","0.183×","0.2566","2 ^39","+"],
+  "#sweep-table row 20": ["XMSS-MT (WOTS+C, w = 16, h = 35, d = 5)","3,152 0.401×","66,815 0.229×","8,185 0.00369×","3,728","1,289 0.588×","0.4089 1.46×","0.207×","0.2593","2 ^35","+"],
+  "#sweep-table row 21": ["XMSS-MT (WOTS+C, w = 32, h = 36, d = 3)","1,852 0.236×","3.44M 11.8×","15,699 0.00708×","2,656","1,273 0.580×","0.6874 2.46×","0.347×","0.2611","2 ^36","+"],
+  "#sweep-table row 22": ["XMSS-MT (WOTS+C, w = 32, h = 40, d = 4)","2,334 0.297×","860,159 2.94×","17,379 0.00783×","3,232","1,688 0.770×","0.7232 2.59×","0.365×","0.2721","2 ^40","+"],
+  "#sweep-table row 23": ["XMSS-MT (WOTS, w = 32, h = 32, d = 4)","2,325 0.296×","231,679 0.792×","14,962 0.00674×","2,880","1,818 0.829×","0.7819 2.80×","0.395×","0.2762","2 ^32","+"],
+  "#sweep-table row 24": ["XMSS-MT (WOTS+C, w = 16, h = 40, d = 5)","3,232 0.411×","133,631 0.457×","10,805 0.00487×","3,968","1,294 0.590×","0.4004 1.43×","0.202×","0.2763","2 ^40","+"],
+  "popover #about-signer": "A cached signer keeps tree state between signatures: a BDS state for XMSS and XMSS-MT, and a leaf cache for UXMSS. A cold signer keeps none and rebuilds its trees for every signature. SLH-DSA-128s is stateless, so its SigGen is the same in both modes.",
+  "popover #about-size": "Sizes follow the SHRINCS stateful layout: a one-byte indicator, a 16-byte randomizer and the leaf index, then per layer the WOTS+C counter (2 bytes; 4 at w = 65536), the chains and the authentication path. UXMSS signatures grow by one 16-byte node per signature, so size and ρ show first → last. Ratios, bounds, sorting and SigVer use the largest signature.",
+  "popover #about-siggen": "Cached: an upper bound per signature. For XMSS and XMSS-MT that is one BDS update per layer, at most (h′ − K)/2 + 1 leaf computations; for UXMSS it is the first signature, which combines the most nodes from the leaf cache. Cold: the trees are rebuilt for every signature.",
+  "popover #about-state": "What a cached signer stores: all hsf + 1 leaf hashes for UXMSS, the BDS state bound for XMSS and XMSS-MT. Empty for SLH-DSA-128s and for a cold signer.",
+  "popover #about-schnorr": "The average ρ divided by the ρ of a BIP340 Schnorr verification, 1.98 C/B (libsecp256k1, one 64-byte signature; bip340-vs-sha256 , built-in value, the live kappa.json did not load). SLH-DSA-128s has ρ = 0.2791 C/B, 0.141× Schnorr.",
+  "popover #about-sweep": "XMSS and XMSS-MT with h = 10 to 40, d = 1 to 10 dividing h, WOTS or WOTS+C and w ∈ {16, 32, 64, 128, 256, 65536}, plus the 12 UXMSS variants, whose tree height is capped at hsf = 255. Only candidates smaller than SLH-DSA-128s are listed.",
+  "popover #glossary": "Glossary C One SHA-256 compression. Costs count compressions; the PK.seed block is compressed once per key and reused. B Byte. KeyGen, SigGen, SigVer Compressions to generate a key pair, to sign a message and to verify a signature. SigVer is the average unless marked worst. ρ SigVer per signature byte, in C/B. ρ ÷ Schnorr ρ divided by the ρ of a BIP340 Schnorr verification (libsecp256k1, 64-byte signature). SLH-DSA-128s The FIPS 205 parameter set (h, d, k, a, w) = (63, 7, 14, 12, 16). Ratios (×) compare against it. h, d, k, a, w Hypertree height, number of layers, FORS trees, FORS tree height, Winternitz parameter. h′ = h/d is the height of one layer. q s The number of signatures per key that security is computed for: 2 ^40 for the stateless schemes. WOTS, WOTS+C Winternitz one-time signatures. WOTS (as in SLH-DSA) has checksum chains; WOTS+C replaces them with a counter that the signer grinds until the message digits have a fixed sum, so verification always costs the same. XMSS, XMSS-MT, UXMSS Stateful schemes: one balanced Merkle tree (BXMSS in SHRINCS), d layers of such trees, and the unbalanced SHRINCS tree, whose signatures grow by one node per signature. Cached, cold A cached signer keeps tree state between signatures (a BDS state for XMSS, a leaf cache for UXMSS); a cold signer keeps none and rebuilds its trees for every signature.",
   "input #signer-mode": "cached",
   "input #f-scheme": "xmssmt",
   "input #f-ots": "TW",
@@ -538,35 +566,42 @@
   "input #sw-W-cb-val": "1.0"
  },
  "stateful.html#cand=uxmss-WC-64,xmssmt-WC-64-20-1": {
-  "#compare-table row 0": ["SLH-DSA-128s","7,856 B","292.4K","2.22M","—","2.2K","0.279","0.496","0.141×","2^64",""],
-  "#compare-table row 1": ["UXMSS (WOTS+C, w=64) sig grows with index — worst case shown (255 auth nodes); capacity 256 sigs","388–4,459 B 0.57×","362.2K 1.24×","1.2K 0.00×","4,096 B","959 0.44×","1.817→0.215 0.77×","1.817→0.215 0.43×","0.918→0.109×","256","×"],
-  "#compare-table row 2": ["XMSS-2^20 (WOTS+C, w=64, d=1)","694 B 0.09×","1.48G 5.1e+3×","15.1K 0.01×","1,056 B","724 0.33×","1.043 3.74×","1.043 2.11×","0.527×","2^20","×"],
-  "#sweep-info": "469 of 1116 candidates pass the current bounds.",
-  "#sweep-table row 0": ["XMSS-2^10 (WOTS+C, w=16, d=1)","693 B 0.09×","534.5K 1.83×","3.0K 0.00×","496 B","264 0.12×","0.381 1.36×","0.192×","0.0520","2^10","+"],
-  "#sweep-table row 1": ["XMSS-2^10 (WOTS, w=16, d=1)","739 B 0.09×","584.7K 2.00×","3.2K 0.00×","496 B","291 0.13×","0.394 1.41×","0.199×","0.0571","2^10","+"],
-  "#sweep-table row 2": ["XMSS-2^10 (WOTS+C, w=16, d=2)","1,207 B 0.15×","16.7K 0.06×","2.4K 0.00×","960 B","514 0.23×","0.426 1.53×","0.215×","0.0657","2^10","+"],
-  "#sweep-table row 3": ["XMSS-2^12 (WOTS+C, w=16, d=2)","1,239 B 0.16×","33.4K 0.11×","3.5K 0.00×","1,056 B","516 0.24×","0.416 1.49×","0.210×","0.0685","2^12","+"],
-  "#sweep-table row 4": ["XMSS-2^14 (WOTS+C, w=16, d=2)","1,271 B 0.16×","66.8K 0.23×","3.5K 0.00×","1,184 B","518 0.24×","0.408 1.46×","0.206×","0.0706","2^14","+"],
-  "#sweep-table row 5": ["XMSS-2^10 (WOTS, w=16, d=2)","1,299 B 0.17×","18.3K 0.06×","2.6K 0.00×","1,008 B","568 0.26×","0.437 1.57×","0.221×","0.0728","2^10","+"],
-  "#sweep-table row 6": ["XMSS-2^16 (WOTS+C, w=16, d=2)","1,303 B 0.17×","133.6K 0.46×","4.5K 0.00×","1,280 B","520 0.24×","0.399 1.43×","0.202×","0.0743","2^16","+"],
-  "#sweep-table row 7": ["XMSS-2^12 (WOTS, w=16, d=2)","1,331 B 0.17×","36.5K 0.12×","3.7K 0.00×","1,104 B","570 0.26×","0.428 1.53×","0.216×","0.0757","2^12","+"],
-  "#sweep-table row 8": ["XMSS-2^10 (WOTS+C, w=32, d=2)","1,015 B 0.13×","26.9K 0.09×","3.9K 0.00×","864 B","836 0.38×","0.824 2.95×","0.416×","0.0775","2^10","+"],
-  "#sweep-table row 9": ["XMSS-2^14 (WOTS, w=16, d=2)","1,363 B 0.17×","73.1K 0.25×","3.7K 0.00×","1,232 B","572 0.26×","0.420 1.50×","0.212×","0.0779","2^14","+"],
-  "#sweep-table row 10": ["XMSS-2^18 (WOTS+C, w=16, d=2)","1,336 B 0.17×","267.3K 0.91×","4.5K 0.00×","1,408 B","522 0.24×","0.391 1.40×","0.197×","0.0784","2^18","+"],
-  "#sweep-table row 11": ["XMSS-2^12 (WOTS+C, w=32, d=2)","1,047 B 0.13×","53.8K 0.18×","5.6K 0.00×","960 B","838 0.38×","0.800 2.87×","0.404×","0.0797","2^12","+"],
-  "#sweep-table row 12": ["XMSS-2^14 (WOTS+C, w=32, d=2)","1,079 B 0.14×","107.5K 0.37×","5.6K 0.00×","1,088 B","840 0.38×","0.778 2.79×","0.393×","0.0802","2^14","+"],
-  "#sweep-table row 13": ["XMSS-2^16 (WOTS, w=16, d=2)","1,395 B 0.18×","146.2K 0.50×","4.9K 0.00×","1,328 B","574 0.26×","0.411 1.47×","0.208×","0.0817","2^16","+"],
-  "#sweep-table row 14": ["XMSS-2^10 (WOTS, w=32, d=2)","1,075 B 0.14×","29.0K 0.10×","4.1K 0.00×","896 B","905 0.41×","0.842 3.02×","0.425×","0.0821","2^10","+"],
-  "#sweep-table row 15": ["XMSS-2^12 (WOTS, w=32, d=2)","1,107 B 0.14×","57.9K 0.20×","5.9K 0.00×","992 B","907 0.41×","0.819 2.94×","0.414×","0.0845","2^12","+"],
-  "#sweep-table row 16": ["XMSS-2^16 (WOTS+C, w=32, d=2)","1,111 B 0.14×","215.0K 0.74×","7.3K 0.00×","1,184 B","842 0.38×","0.758 2.71×","0.383×","0.0846","2^16","+"],
-  "#sweep-table row 17": ["XMSS-2^14 (WOTS, w=32, d=2)","1,139 B 0.14×","115.8K 0.40×","5.9K 0.00×","1,120 B","909 0.41×","0.798 2.86×","0.403×","0.0852","2^14","+"],
-  "#sweep-table row 18": ["XMSS-2^18 (WOTS, w=16, d=2)","1,428 B 0.18×","292.4K","4.9K 0.00×","1,456 B","576 0.26×","0.403 1.44×","0.204×","0.0860","2^18","+"],
-  "#sweep-table row 19": ["XMSS-2^10 (WOTS+C, w=32, d=1)","597 B 0.08×","860.2K 2.94×","4.8K 0.00×","496 B","425 0.19×","0.712 2.55×","0.360×","0.0861","2^10","+"],
-  "#sweep-table row 20": ["XMSS-2^11 (WOTS+C, w=16, d=1)","709 B 0.09×","1.07M 3.66×","3.0K 0.00×","560 B","265 0.12×","0.374 1.34×","0.189×","0.0885","2^11","+"],
-  "#sweep-table row 21": ["XMSS-2^20 (WOTS+C, w=16, d=2)","1,368 B 0.17×","534.5K 1.83×","5.6K 0.00×","1,504 B","524 0.24×","0.383 1.37×","0.193×","0.0892","2^20","+"],
-  "#sweep-table row 22": ["XMSS-2^18 (WOTS+C, w=32, d=2)","1,144 B 0.15×","430.1K 1.47×","7.3K 0.00×","1,312 B","844 0.38×","0.738 2.64×","0.373×","0.0899","2^18","+"],
-  "#sweep-table row 23": ["XMSS-2^16 (WOTS, w=32, d=2)","1,171 B 0.15×","231.7K 0.79×","7.7K 0.00×","1,216 B","911 0.42×","0.778 2.79×","0.393×","0.0900","2^16","+"],
-  "#sweep-table row 24": ["XMSS-2^10 (WOTS, w=32, d=1)","627 B 0.08×","926.7K 3.17×","5.0K 0.00×","496 B","459 0.21×","0.732 2.62×","0.370×","0.0917","2^10","+"],
+  "#compare-table row 0": ["SLH-DSA-128s","7,856","292,351","2.22M","—","2,193","0.2791","0.4955","0.141×","2 ^64",""],
+  "#compare-table row 1": ["UXMSS (WOTS+C, w = 64)","388 → 4,459 0.568×","362,239 1.24×","1,195 0.000539×","4,096","959 0.437×","1.8170 → 0.2151 0.770×","1.8170 → 0.2151 0.434×","0.918× → 0.109×","256","×"],
+  "#compare-table row 2": ["XMSS (WOTS+C, w = 64, h = 20)","694 0.0883×","1.48G 5,075×","15,107 0.00681×","1,056","724 0.330×","1.0432 3.74×","1.0432 2.11×","0.527×","2 ^20","×"],
+  "#sweep-info": "469 of 1,116 candidates within the bounds.",
+  "#sweep-table row 0": ["XMSS (WOTS+C, w = 16, h = 10)","693 0.0882×","534,527 1.83×","2,961 0.00133×","496","264 0.120×","0.3810 1.36×","0.192×","0.0520","2 ^10","+"],
+  "#sweep-table row 1": ["XMSS (WOTS, w = 16, h = 10)","739 0.0941×","584,703 2.00×","3,161 0.00142×","496","291 0.133×","0.3938 1.41×","0.199×","0.0571","2 ^10","+"],
+  "#sweep-table row 2": ["XMSS-MT (WOTS+C, w = 16, h = 10, d = 2)","1,207 0.154×","16,703 0.0571×","2,433 0.00110×","960","514 0.234×","0.4258 1.53×","0.215×","0.0657","2 ^10","+"],
+  "#sweep-table row 3": ["XMSS-MT (WOTS+C, w = 16, h = 12, d = 2)","1,239 0.158×","33,407 0.114×","3,481 0.00157×","1,056","516 0.235×","0.4165 1.49×","0.210×","0.0685","2 ^12","+"],
+  "#sweep-table row 4": ["XMSS-MT (WOTS+C, w = 16, h = 14, d = 2)","1,271 0.162×","66,815 0.229×","3,481 0.00157×","1,184","518 0.236×","0.4076 1.46×","0.206×","0.0706","2 ^14","+"],
+  "#sweep-table row 5": ["XMSS-MT (WOTS, w = 16, h = 10, d = 2)","1,299 0.165×","18,271 0.0625×","2,584 0.00116×","1,008","568 0.259×","0.4373 1.57×","0.221×","0.0728","2 ^10","+"],
+  "#sweep-table row 6": ["XMSS-MT (WOTS+C, w = 16, h = 16, d = 2)","1,303 0.166×","133,631 0.457×","4,529 0.00204×","1,280","520 0.237×","0.3991 1.43×","0.202×","0.0743","2 ^16","+"],
+  "#sweep-table row 7": ["XMSS-MT (WOTS, w = 16, h = 12, d = 2)","1,331 0.169×","36,543 0.125×","3,730 0.00168×","1,104","570 0.260×","0.4282 1.53×","0.216×","0.0757","2 ^12","+"],
+  "#sweep-table row 8": ["XMSS-MT (WOTS+C, w = 32, h = 10, d = 2)","1,015 0.129×","26,879 0.0919×","3,915 0.00176×","864","836 0.381×","0.8236 2.95×","0.416×","0.0775","2 ^10","+"],
+  "#sweep-table row 9": ["XMSS-MT (WOTS, w = 16, h = 14, d = 2)","1,363 0.173×","73,087 0.250×","3,730 0.00168×","1,232","572 0.261×","0.4197 1.50×","0.212×","0.0779","2 ^14","+"],
+  "#sweep-table row 10": ["XMSS-MT (WOTS+C, w = 16, h = 18, d = 2)","1,336 0.170×","267,263 0.914×","4,529 0.00204×","1,408","522 0.238×","0.3907 1.40×","0.197×","0.0784","2 ^18","+"],
+  "#sweep-table row 11": ["XMSS-MT (WOTS+C, w = 32, h = 12, d = 2)","1,047 0.133×","53,759 0.184×","5,599 0.00252×","960","838 0.382×","0.8004 2.87×","0.404×","0.0797","2 ^12","+"],
+  "#sweep-table row 12": ["XMSS-MT (WOTS+C, w = 32, h = 14, d = 2)","1,079 0.137×","107,519 0.368×","5,599 0.00252×","1,088","840 0.383×","0.7785 2.79×","0.393×","0.0802","2 ^14","+"],
+  "#sweep-table row 13": ["XMSS-MT (WOTS, w = 16, h = 16, d = 2)","1,395 0.178×","146,175 0.500×","4,876 0.00220×","1,328","574 0.262×","0.4115 1.47×","0.208×","0.0817","2 ^16","+"],
+  "#sweep-table row 14": ["XMSS-MT (WOTS, w = 32, h = 10, d = 2)","1,075 0.137×","28,959 0.0991×","4,086 0.00184×","896","905 0.413×","0.8419 3.02×","0.425×","0.0821","2 ^10","+"],
+  "#sweep-table row 15": ["XMSS-MT (WOTS, w = 32, h = 12, d = 2)","1,107 0.141×","57,919 0.198×","5,900 0.00266×","992","907 0.414×","0.8193 2.94×","0.414×","0.0845","2 ^12","+"],
+  "#sweep-table row 16": ["XMSS-MT (WOTS+C, w = 32, h = 16, d = 2)","1,111 0.141×","215,039 0.736×","7,283 0.00328×","1,184","842 0.384×","0.7579 2.71×","0.383×","0.0846","2 ^16","+"],
+  "#sweep-table row 17": ["XMSS-MT (WOTS, w = 32, h = 14, d = 2)","1,139 0.145×","115,839 0.396×","5,900 0.00266×","1,120","909 0.415×","0.7981 2.86×","0.403×","0.0852","2 ^14","+"],
+  "#sweep-table row 18": ["XMSS-MT (WOTS, w = 16, h = 18, d = 2)","1,428 0.182×","292,351","4,876 0.00220×","1,456","576 0.263×","0.4034 1.44×","0.204×","0.0860","2 ^18","+"],
+  "#sweep-table row 19": ["XMSS (WOTS+C, w = 32, h = 10)","597 0.0760×","860,159 2.94×","4,761 0.00215×","496","425 0.194×","0.7119 2.55×","0.360×","0.0861","2 ^10","+"],
+  "#sweep-table row 20": ["XMSS (WOTS+C, w = 16, h = 11)","709 0.0902×","1.07M 3.66×","2,961 0.00133×","560","265 0.121×","0.3738 1.34×","0.189×","0.0885","2 ^11","+"],
+  "#sweep-table row 21": ["XMSS-MT (WOTS+C, w = 16, h = 20, d = 2)","1,368 0.174×","534,527 1.83×","5,577 0.00251×","1,504","524 0.239×","0.3830 1.37×","0.193×","0.0892","2 ^20","+"],
+  "#sweep-table row 22": ["XMSS-MT (WOTS+C, w = 32, h = 18, d = 2)","1,144 0.146×","430,079 1.47×","7,283 0.00328×","1,312","844 0.385×","0.7378 2.64×","0.373×","0.0899","2 ^18","+"],
+  "#sweep-table row 23": ["XMSS-MT (WOTS, w = 32, h = 16, d = 2)","1,171 0.149×","231,679 0.792×","7,714 0.00348×","1,216","911 0.415×","0.7780 2.79×","0.393×","0.0900","2 ^16","+"],
+  "#sweep-table row 24": ["XMSS (WOTS, w = 32, h = 10)","627 0.0798×","926,719 3.17×","4,997 0.00225×","496","459 0.209×","0.7321 2.62×","0.370×","0.0917","2 ^10","+"],
+  "popover #about-signer": "A cached signer keeps tree state between signatures: a BDS state for XMSS and XMSS-MT, and a leaf cache for UXMSS. A cold signer keeps none and rebuilds its trees for every signature. SLH-DSA-128s is stateless, so its SigGen is the same in both modes.",
+  "popover #about-size": "Sizes follow the SHRINCS stateful layout: a one-byte indicator, a 16-byte randomizer and the leaf index, then per layer the WOTS+C counter (2 bytes; 4 at w = 65536), the chains and the authentication path. UXMSS signatures grow by one 16-byte node per signature, so size and ρ show first → last. Ratios, bounds, sorting and SigVer use the largest signature.",
+  "popover #about-siggen": "Cached: an upper bound per signature. For XMSS and XMSS-MT that is one BDS update per layer, at most (h′ − K)/2 + 1 leaf computations; for UXMSS it is the first signature, which combines the most nodes from the leaf cache. Cold: the trees are rebuilt for every signature.",
+  "popover #about-state": "What a cached signer stores: all hsf + 1 leaf hashes for UXMSS, the BDS state bound for XMSS and XMSS-MT. Empty for SLH-DSA-128s and for a cold signer.",
+  "popover #about-schnorr": "The average ρ divided by the ρ of a BIP340 Schnorr verification, 1.98 C/B (libsecp256k1, one 64-byte signature; bip340-vs-sha256 , built-in value, the live kappa.json did not load). SLH-DSA-128s has ρ = 0.2791 C/B, 0.141× Schnorr.",
+  "popover #about-sweep": "XMSS and XMSS-MT with h = 10 to 40, d = 1 to 10 dividing h, WOTS or WOTS+C and w ∈ {16, 32, 64, 128, 256, 65536}, plus the 12 UXMSS variants, whose tree height is capped at hsf = 255. Only candidates smaller than SLH-DSA-128s are listed.",
+  "popover #glossary": "Glossary C One SHA-256 compression. Costs count compressions; the PK.seed block is compressed once per key and reused. B Byte. KeyGen, SigGen, SigVer Compressions to generate a key pair, to sign a message and to verify a signature. SigVer is the average unless marked worst. ρ SigVer per signature byte, in C/B. ρ ÷ Schnorr ρ divided by the ρ of a BIP340 Schnorr verification (libsecp256k1, 64-byte signature). SLH-DSA-128s The FIPS 205 parameter set (h, d, k, a, w) = (63, 7, 14, 12, 16). Ratios (×) compare against it. h, d, k, a, w Hypertree height, number of layers, FORS trees, FORS tree height, Winternitz parameter. h′ = h/d is the height of one layer. q s The number of signatures per key that security is computed for: 2 ^40 for the stateless schemes. WOTS, WOTS+C Winternitz one-time signatures. WOTS (as in SLH-DSA) has checksum chains; WOTS+C replaces them with a counter that the signer grinds until the message digits have a fixed sum, so verification always costs the same. XMSS, XMSS-MT, UXMSS Stateful schemes: one balanced Merkle tree (BXMSS in SHRINCS), d layers of such trees, and the unbalanced SHRINCS tree, whose signatures grow by one node per signature. Cached, cold A cached signer keeps tree state between signatures (a BDS state for XMSS, a leaf cache for UXMSS); a cold signer keeps none and rebuilds its trees for every signature.",
   "input #signer-mode": "cached",
   "input #f-scheme": "xmssmt",
   "input #f-ots": "TW",

From 4113d610748db34709208e45cb39ab0c54fc5c55 Mon Sep 17 00:00:00 2001
From: mjthatch <m.j.thatch@proton.me>
Date: Thu, 12 Nov 2026 15:45:06 +0000
Subject: [PATCH 5/6] stateless.html: popovers, metric names, number format

Each section keeps one sentence; the rest moves into popovers. One comparison
table serves the winner, the hover tooltip and your own candidate. Sliders and
inputs have accessible names, the scatter plot a text description, and the CSV
columns match the stateful page's.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QabhpThuWQEq1AZRZo24vm
---
 site/stateless.html      | 416 +++++++++++++++++----------------------
 tests/site_snapshot.json | 357 ++++++++++++++++++---------------
 2 files changed, 375 insertions(+), 398 deletions(-)

diff --git a/site/stateless.html b/site/stateless.html
index e5de31f..0d732ec 100644
--- a/site/stateless.html
+++ b/site/stateless.html
@@ -7,6 +7,7 @@
   <title>SHRINCS Parameter Explorer</title>
   <link rel="icon"
     href="data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 100 100'><text y='.9em' font-size='90'>🦐</text></svg>">
+  <link rel="stylesheet" href="style.css">
   <style>
     :root {
       --bg: #f7f7f5;
@@ -90,7 +91,7 @@
     }
 
     .panel h2 {
-      margin: 0 0 4px;
+      margin: 0 0 8px;
       font-size: 11px;
       text-transform: uppercase;
       letter-spacing: 0.06em;
@@ -99,7 +100,7 @@
     }
 
     .panel .hint {
-      margin: 0 0 12px;
+      margin: -4px 0 12px;
       color: var(--text-mute);
       font-size: 12px;
     }
@@ -230,6 +231,11 @@
       margin: 0;
     }
 
+    .mode-row {
+      display: flex;
+      align-items: center;
+    }
+
     .funnel-row {
       display: grid;
       grid-template-columns: 200px 1fr 80px;
@@ -549,13 +555,6 @@
       margin: 2px 0;
     }
 
-    .custom-notes code {
-      font-family: var(--mono);
-      background: var(--bg);
-      padding: 1px 4px;
-      border-radius: 3px;
-    }
-
     .info-strip {
       background: var(--accent-soft);
       color: var(--accent);
@@ -580,64 +579,82 @@
 <body>
 
   <header>
-    <div style="font-size:12px;margin-bottom:4px;"><a href="index.html" style="color:var(--accent);text-decoration:none;">← SHRINCS recommended parameters</a></div>
+    <nav class="crumbs"><a href="index.html">SHRINCS pinned parameters</a> › Parameter Explorer · <a href="stateful.html">Stateful Comparison</a></nav>
     <h1>SHRINCS Parameter Explorer</h1>
     <p class="tagline">
-      Interactive search over SLH-DSA-compatible parameter tuples.
-      Methodology from the <a href="report.pdf" target="_blank">SHRINCS Parameter
-        Search</a> tech report.
-      See also: <a href="stateful.html">Stateful Scheme Comparison →</a>
+      Search SLH-DSA-compatible parameter sets as in the
+      <a href="report.pdf" target="_blank">SHRINCS Parameter Search</a> report.
+      <button type="button" class="text-btn" popovertarget="glossary">Glossary</button>
     </p>
   </header>
 
   <main class="layout">
 
     <aside class="panel sidebar">
-      <h2>Scheme</h2>
-      <p class="hint" id="scheme-hint">FTS/OTS variant from the report. All ratios compare against the SLH-DSA-128s (SPX) baseline.</p>
+      <h2>Scheme <button type="button" class="info" popovertarget="about-scheme" aria-label="About the schemes">i</button></h2>
+      <div class="pop" id="about-scheme" popover>
+        <p>The stateless schemes of the report:</p>
+        <ul>
+          <li><strong>SPX</strong>: SLH-DSA, with WOTS and FORS.</li>
+          <li><strong>W+C</strong>: WOTS+C instead of WOTS.</li>
+          <li><strong>FORS+C</strong>: WOTS+C, and FORS+C, which grinds away the last FORS tree.</li>
+          <li><strong>PORS+FP</strong>: WOTS+C, and PORS+FP, a single tree with Octopus authentication.</li>
+        </ul>
+      </div>
+      <p class="hint" id="scheme-hint" hidden></p>
       <div class="seg" id="scheme-controls"></div>
 
-      <h2 class="section-title">Winternitz set</h2>
-      <p class="hint">w = {2, 4, 16, 256} is always on (lg<sub>w</sub> | 8). Extras extend the SPX pool only.</p>
-      <label class="mode-toggle" title="lg_w = 5, 6, 7 — base_2b digits straddle byte boundaries; outside strict SLH-DSA byte alignment. Exploratory.">
+      <h2 class="section-title">Winternitz parameter <button type="button" class="info" popovertarget="about-w" aria-label="About the Winternitz parameter">i</button></h2>
+      <div class="pop" id="about-w" popover>
+        <p>The pool always includes w = 2, 4, 16 and 256, whose digits fit whole bytes as SLH-DSA requires.
+          w = 32, 64 and 128 do not, so they are exploratory and extend only the SPX pool.</p>
+      </div>
+      <label class="mode-toggle">
         <input type="checkbox" id="optw-toggle"> <span>include w = 32, 64, 128 <span style="white-space: nowrap;">(non-aligned)</span></span>
       </label>
 
-      <h2 class="section-title">Filter coefficients</h2>
-      <p class="hint">Bound each metric as a coefficient of SLH-DSA-128s. Survivors must satisfy every bound.</p>
+      <h2 class="section-title">Bounds</h2>
+      <p class="hint">Keep candidates within these multiples of SLH-DSA-128s.</p>
       <div id="filter-controls"></div>
-      <label class="mode-toggle" title="Filter and rank on worst-case SigVer and ρ, compared against the baseline's worst case (SLH-DSA-128s: 3,893 C instead of 2,193 C). WOTS+C verification is deterministic, so those candidates keep the same values but gain headroom against the worst-case baseline.">
-        <input type="checkbox" id="worst-toggle"> use worst-case SigVer &amp; ρ
-      </label>
+      <div class="mode-row">
+        <label class="mode-toggle"><input type="checkbox" id="worst-toggle"> use worst-case SigVer and ρ</label>
+        <button type="button" class="info" popovertarget="about-worst" aria-label="About the worst case">i</button>
+      </div>
+      <div class="pop" id="about-worst" popover>
+        <p>Filter and rank on worst-case SigVer and ρ, against the worst case of SLH-DSA-128s
+          (<span data-std="sv_worst"></span> C instead of <span data-std="sv"></span> C). WOTS+C verification costs
+          the same for every message, so candidates with WOTS+C keep their values and gain headroom.</p>
+      </div>
 
-      <h2 class="section-title">Importance weights</h2>
-      <p class="hint">Higher weight = more important. Each metric's ratio is <strong>range-normalised across the
-          surviving pool</strong> before scoring.</p>
+      <h2 class="section-title">Weights <button type="button" class="info" popovertarget="about-weights" aria-label="About the weights">i</button></h2>
+      <div class="pop" id="about-weights" popover>
+        <p>The best candidate has the smallest distance: the weighted root mean square of its five ratios to
+          SLH-DSA-128s, each rescaled to 0–1 across the candidates within the bounds.</p>
+      </div>
+      <p class="hint">A higher weight gives a metric more say in the ranking.</p>
       <div id="weight-controls"></div>
 
       <button class="reset-btn" id="reset-btn">Reset to defaults</button>
-      <button class="reset-btn" id="share-btn" title="Copy a link that reproduces the current scheme, filters, weights and custom tuple">Copy shareable link</button>
-      <button class="reset-btn" id="export-btn" title="Download the current survivor set (with distances) as CSV">Export survivors (CSV)</button>
+      <button class="reset-btn" id="share-btn">Copy shareable link</button>
+      <button class="reset-btn" id="export-btn" title="Download the candidates within the bounds">Export CSV</button>
     </aside>
 
     <section>
       <div class="panel">
-        <div id="initial-info" class="info-strip"></div>
+        <div class="info-strip"><span id="initial-info"></span> <button type="button" class="info" popovertarget="about-pool" aria-label="About the pool and its sources">i</button></div>
+        <div class="pop pop-wide" id="about-pool" popover></div>
         <h2>Filtering funnel</h2>
-        <p class="hint">Each filter is applied in sequence. Bars show how many candidates survive each step.
-          All costs are SHA-256 compression calls with the PK.seed block midstate-cached (FIPS 205 SHA-2 layout).</p>
         <div id="funnel"></div>
       </div>
 
       <div class="panel">
-        <h2>Candidate sieve</h2>
-        <p class="hint">
-          Each dot is one (h, d, k, a, w) tuple. Positions are random — the layout carries no meaning.
-          Survivors are coloured by their weighted distance to the origin (blue = closer to ideal, red = farther).
-          Filtered-out candidates fade to grey. The winner is ringed.
-        </p>
+        <h2>Candidate sieve <button type="button" class="info" popovertarget="about-sieve" aria-label="About the candidate sieve">i</button></h2>
+        <div class="pop" id="about-sieve" popover>
+          <p>Each dot is one parameter set, placed at random. Candidates within the bounds are coloured by distance,
+            from blue (closest to ideal) to red; the others are grey and the winner is ringed. Hover a dot for its numbers.</p>
+        </div>
         <div class="scatter-wrap">
-          <canvas id="scatter" width="800" height="500"></canvas>
+          <canvas id="scatter" width="800" height="500" role="img" aria-label="Candidate sieve"></canvas>
           <div id="hover-ring"></div>
         </div>
         <div class="scatter-legend" id="scatter-legend"></div>
@@ -646,21 +663,22 @@ <h2>Candidate sieve</h2>
       <div id="tooltip"></div>
 
       <div class="panel">
-        <h2>Best candidate (minimum weighted distance)</h2>
+        <h2>Best candidate</h2>
         <div id="winner"></div>
       </div>
 
       <div class="panel">
-        <h2>Compare your own candidate</h2>
-        <p class="hint">Enter any (h, d, k, a, w) tuple to see how it stacks up against SLH-DSA-128s.
-          w covers the SLH-DSA-compatible choices {2, 4, 16, 256}, plus the optional extras 32, 64 and 128.
-          This panel always evaluates the plain SPX model (WOTS-TW + FORS), regardless of the scheme selected above.</p>
+        <h2>Compare your own candidate <button type="button" class="info" popovertarget="about-custom" aria-label="About your own candidate">i</button></h2>
+        <div class="pop" id="about-custom" popover>
+          <p>This panel always uses the SPX model (WOTS and FORS), whichever scheme is selected.</p>
+        </div>
+        <p class="hint">Enter any (h, d, k, a, w) to compare it with SLH-DSA-128s.</p>
         <div class="custom-inputs" id="custom-inputs">
-          <div class="field"><label>h</label><input type="number" id="cust-h" value="63" min="1" step="1"></div>
-          <div class="field"><label>d</label><input type="number" id="cust-d" value="7" min="1" step="1"></div>
-          <div class="field"><label>k</label><input type="number" id="cust-k" value="14" min="1" step="1"></div>
-          <div class="field"><label>a</label><input type="number" id="cust-a" value="12" min="1" step="1"></div>
-          <div class="field"><label>w</label><select id="cust-w">
+          <div class="field"><label for="cust-h">h</label><input type="number" id="cust-h" value="63" min="1" step="1"></div>
+          <div class="field"><label for="cust-d">d</label><input type="number" id="cust-d" value="7" min="1" step="1"></div>
+          <div class="field"><label for="cust-k">k</label><input type="number" id="cust-k" value="14" min="1" step="1"></div>
+          <div class="field"><label for="cust-a">a</label><input type="number" id="cust-a" value="12" min="1" step="1"></div>
+          <div class="field"><label for="cust-w">w</label><select id="cust-w">
             <optgroup label="SLH-DSA-compatible">
               <option value="2">2</option>
               <option value="4">4</option>
@@ -681,6 +699,7 @@ <h2>Compare your own candidate</h2>
 
   </main>
 
+  <script src="js/ui.js"></script>
   <script>
     'use strict';
 
@@ -1063,11 +1082,11 @@ <h2>Compare your own candidate</h2>
 
     // ---------- Filter pipeline ----------
     const FILTER_STEPS = [
-      { key: 'size', metric: 'size', label: 'Size', stdLabel: '·std' },
-      { key: 'kg', metric: 'kg', label: 'KeyGen', stdLabel: '·std' },
-      { key: 'sg', metric: 'sg', label: 'SigGen', stdLabel: '·std' },
-      { key: 'sv', metric: 'sv', label: 'SigVer', stdLabel: '·std' },
-      { key: 'cb', metric: 'cb', label: 'Comp/Byte', stdLabel: '·std' },
+      { key: 'size', metric: 'size', label: 'Size' },
+      { key: 'kg', metric: 'kg', label: 'KeyGen' },
+      { key: 'sg', metric: 'sg', label: 'SigGen' },
+      { key: 'sv', metric: 'sv', label: 'SigVer' },
+      { key: 'cb', metric: 'cb', label: 'ρ' },
     ];
 
     // Returns an array: each element holds the survivors after step i, and which step eliminated each candidate
@@ -1089,9 +1108,9 @@ <h2>Compare your own candidate</h2>
           }
         }
         cur = next;
-        const worstTag = (mk !== step.metric) ? ' (worst)' : '';
+        const worstTag = (mk !== step.metric) ? ', worst' : '';
         stepCounts.push({
-          name: `${step.label}${worstTag} ≤ ${fmtX(X[step.key])}·std`,
+          name: `${step.label}${worstTag} ≤ ${fmtX(X[step.key])}×`,
           count: cur.length
         });
       });
@@ -1228,15 +1247,6 @@ <h2>Compare your own candidate</h2>
     }
 
     // ---------- Rendering ----------
-    function fmt(n) {
-      if (n >= 1e6) return (n / 1e6).toFixed(2) + 'M';
-      if (n >= 1e3) return n.toLocaleString();
-      return n.toFixed(0);
-    }
-    function fmtRatio(r) {
-      if (r >= 1000) return r.toExponential(2) + '×';
-      return r.toFixed(3) + '×';
-    }
 
     // Log-position mapping for the cost-coefficient sliders: integer track
     // positions 0..SLIDER_STEPS <-> X in [min, max], geometrically spaced.
@@ -1260,23 +1270,23 @@ <h2>Compare your own candidate</h2>
 
     function renderControls() {
       const filterDefs = [
-        { key: 'size', label: 'X<sub>size</sub>', min: 0.30, max: 1.00, step: 0.01, dp: 2 },
-        { key: 'kg', label: 'X<sub>kg</sub>', min: 0.10, max: state.xMax.kg, log: true },
-        { key: 'sg', label: 'X<sub>sg</sub>', min: 0.10, max: state.xMax.sg, log: true },
-        { key: 'sv', label: 'X<sub>sv</sub>', min: 0.10, max: state.xMax.sv, log: true },
-        { key: 'cb', label: 'X<sub>cb</sub>', min: 0.10, max: state.xMax.cb, log: true },
+        { key: 'size', label: 'Size', min: 0.30, max: 1.00, step: 0.01, dp: 2 },
+        { key: 'kg', label: 'KeyGen', min: 0.10, max: state.xMax.kg, log: true },
+        { key: 'sg', label: 'SigGen', min: 0.10, max: state.xMax.sg, log: true },
+        { key: 'sv', label: 'SigVer', min: 0.10, max: state.xMax.sv, log: true },
+        { key: 'cb', label: 'ρ', min: 0.10, max: state.xMax.cb, log: true },
       ];
       document.getElementById('filter-controls').innerHTML = filterDefs.map(d => `
     <div class="control">
       <label>
         <span class="name">${d.label}</span>
-        <input type="number" class="val-input"
+        <input type="number" class="val-input" aria-label="${d.label} bound"
                id="X_${d.key}_val"
                min="${d.min}" max="${d.max}" step="${d.log ? 'any' : d.step}"
                value="${d.log ? fmtX(state.X[d.key]) : state.X[d.key].toFixed(d.dp)}"
                data-coef-input="${d.key}"${d.log ? '' : ` data-dp="${d.dp}"`}>
       </label>
-      <input type="range" min="${d.log ? 0 : d.min}" max="${d.log ? SLIDER_STEPS : d.max}"
+      <input type="range" aria-label="${d.label} bound" min="${d.log ? 0 : d.min}" max="${d.log ? SLIDER_STEPS : d.max}"
              step="${d.log ? 1 : d.step}"
              value="${d.log ? xToPos(state.X[d.key], d.min, d.max) : state.X[d.key]}"
              data-coef="${d.key}"${d.log ? ' data-log="1"' : ''}>
@@ -1284,23 +1294,23 @@ <h2>Compare your own candidate</h2>
   `).join('');
 
       const weightDefs = [
-        { key: 'size', label: 'w<sub>size</sub>', min: 0.10, max: 20.00, step: 0.10, dp: 1 },
-        { key: 'kg', label: 'w<sub>kg</sub>', min: 0.10, max: 20.00, step: 0.10, dp: 1 },
-        { key: 'sg', label: 'w<sub>sg</sub>', min: 0.10, max: 20.00, step: 0.10, dp: 1 },
-        { key: 'sv', label: 'w<sub>sv</sub>', min: 0.10, max: 20.00, step: 0.10, dp: 1 },
-        { key: 'cb', label: 'w<sub>cb</sub>', min: 0.10, max: 20.00, step: 0.10, dp: 1 },
+        { key: 'size', label: 'Size', min: 0.10, max: 20.00, step: 0.10, dp: 1 },
+        { key: 'kg', label: 'KeyGen', min: 0.10, max: 20.00, step: 0.10, dp: 1 },
+        { key: 'sg', label: 'SigGen', min: 0.10, max: 20.00, step: 0.10, dp: 1 },
+        { key: 'sv', label: 'SigVer', min: 0.10, max: 20.00, step: 0.10, dp: 1 },
+        { key: 'cb', label: 'ρ', min: 0.10, max: 20.00, step: 0.10, dp: 1 },
       ];
       document.getElementById('weight-controls').innerHTML = weightDefs.map(d => `
     <div class="control">
       <label>
         <span class="name">${d.label}</span>
-        <input type="number" class="val-input"
+        <input type="number" class="val-input" aria-label="${d.label} weight"
                id="W_${d.key}_val"
                min="${d.min}" max="${d.max}" step="${d.step}"
                value="${state.W[d.key].toFixed(d.dp)}"
                data-weight-input="${d.key}" data-dp="${d.dp}">
       </label>
-      <input type="range" min="${d.min}" max="${d.max}" step="${d.step}"
+      <input type="range" aria-label="${d.label} weight" min="${d.min}" max="${d.max}" step="${d.step}"
              value="${state.W[d.key]}" data-weight="${d.key}">
     </div>
   `).join('');
@@ -1372,7 +1382,7 @@ <h2>Compare your own candidate</h2>
       <div class="funnel-row ${eliminated}">
         <div class="label">${s.name}</div>
         <div><div class="bar" style="width: ${widthPct}%;"></div></div>
-        <div class="count">${s.count.toLocaleString()}</div>
+        <div class="count">${s.count.toLocaleString('en-US')}</div>
       </div>
     `;
       }).join('');
@@ -1460,13 +1470,17 @@ <h2>Compare your own candidate</h2>
         ctx.stroke();
       }
 
+      canvas.setAttribute('aria-label', `Candidate sieve: ${survivors.length.toLocaleString('en-US')} of ` +
+        `${state.initialPool.length.toLocaleString('en-US')} candidates within the bounds` +
+        (winner ? `, best (${winner.h}, ${winner.d}, ${winner.k}, ${winner.a}, ${winner.w})` : ''));
+
       // Legend
       const legendHTML = `
     <div class="item"><span class="swatch" style="background:#d4d4d0;"></span>filtered out</div>
-    <div class="item"><span class="swatch" style="background:${distanceColor(0)};"></span>survivor (closer to ideal)</div>
-    <div class="item"><span class="swatch" style="background:${distanceColor(0.5)};"></span>survivor (mid)</div>
-    <div class="item"><span class="swatch" style="background:${distanceColor(1)};"></span>survivor (farther)</div>
-    <div class="item"><span class="swatch" style="background:#1a1a1a;"></span>winner</div>
+    <div class="item"><span class="swatch" style="background:${distanceColor(0)};"></span>closest</div>
+    <div class="item"><span class="swatch" style="background:${distanceColor(0.5)};"></span>middle</div>
+    <div class="item"><span class="swatch" style="background:${distanceColor(1)};"></span>farthest</div>
+    <div class="item"><span class="swatch" style="background:#1a1a1a;"></span>best</div>
   `;
       document.getElementById('scatter-legend').innerHTML = legendHTML;
     }
@@ -1483,53 +1497,49 @@ <h2>Compare your own candidate</h2>
       return 'bad';
     }
 
+    // Rows of the comparison tables: each metric next to its SLH-DSA-128s value.
+    function comparisonRows(c) {
+      const schnorr = state.schnorr.cb64;
+      const rows = [
+        ['Size (B)', c.size, STD_M.size, fmtNum],
+        ['KeyGen (C)', c.kg, STD_M.kg, fmtNum],
+        ['SigGen (C)', c.sg, STD_M.sg, fmtNum],
+        ['SigVer (C)', c.sv, STD_M.sv, fmtNum],
+        ['SigVer, worst (C)', c.sv_worst, STD_M.sv_worst, fmtNum],
+        ['ρ (C/B)', c.cb, STD_M.cb, fmtRho],
+        ['ρ, worst (C/B)', c.cb_worst, STD_M.cb_worst, fmtRho],
+        ['ρ ÷ Schnorr', c.cb / schnorr, STD_M.cb / schnorr, fmtRatio],
+        ['ρ ÷ Schnorr, worst', c.cb_worst / schnorr, STD_M.cb_worst / schnorr, fmtRatio],
+      ];
+      return rows.map(([name, value, std, fmtValue]) => {
+        const r = value / std;
+        return `<tr><td>${name}</td><td>${fmtValue(value)}</td><td>${fmtValue(std)}</td>` +
+          `<td class="ratio ${ratioClass(r, true)}">${fmtRatio(r)}</td></tr>`;
+      }).join('');
+    }
+
+    function comparisonTable(c, column) {
+      return `<table class="metrics">
+          <thead><tr><th>Metric</th><th>${column}</th><th><span class="keep-case">SLH-DSA-128s</span></th><th>Ratio</th></tr></thead>
+          <tbody>${comparisonRows(c)}</tbody>
+        </table>`;
+    }
+
     function renderWinner(winner) {
       const el = document.getElementById('winner');
       if (!winner) {
-        el.innerHTML = '<div class="empty-state">No candidates survived all filters. Relax a bound and try again.</div>';
+        el.innerHTML = '<div class="empty-state">No candidate is within all bounds. Relax one.</div>';
         return;
       }
       const d = weightedDistance(winner, state.W);
-      const rows = [
-        ['Signature size (B)', winner.size, STD_M.size],
-        ['KeyGen cost', winner.kg, STD_M.kg],
-        ['SigGen cost', winner.sg, STD_M.sg],
-        ['SigVer cost (avg)', winner.sv, STD_M.sv],
-        ['SigVer cost (worst)', winner.sv_worst, STD_M.sv_worst],
-        ['Comp/Byte ρ (avg)', winner.cb, STD_M.cb],
-        ['Comp/Byte ρ (worst)', winner.cb_worst, STD_M.cb_worst],
-        ['ρ ÷ Schnorr (avg)', winner.cb / state.schnorr.cb64, STD_M.cb / state.schnorr.cb64],
-        ['ρ ÷ Schnorr (worst)', winner.cb_worst / state.schnorr.cb64, STD_M.cb_worst / state.schnorr.cb64],
-      ];
-      const rowsHTML = rows.map(([name, target, std]) => {
-        const ratio = target / std;
-        const cls = ratioClass(ratio, true);
-        return `
-      <tr>
-        <td>${name}</td>
-        <td>${typeof target === 'number' && target < 10 ? target.toFixed(4) : fmt(target)}</td>
-        <td>${typeof std === 'number' && std < 10 ? std.toFixed(4) : fmt(std)}</td>
-        <td class="ratio ${cls}">${fmtRatio(ratio)}</td>
-      </tr>
-    `;
-      }).join('');
-
       el.innerHTML = `
     <div class="winner-grid">
       <div>
         <p class="winner-tuple">(${winner.h}, ${winner.d}, ${winner.k}, ${winner.a}, ${winner.w})</p>
-        <p class="winner-distance">Weighted distance: <strong>${d.toFixed(4)}</strong></p>
-        <p class="winner-distance">h' = h/d = ${(winner.h / winner.d).toFixed(0)} per XMSS layer</p>
-        ${winner.swn ? `<p class="winner-distance">S<sub>wn</sub> = ${winner.swn}${winner.mmax ? ` · mmax = ${winner.mmax}` : ''}</p>` : ''}
-      </div>
-      <div>
-        <table class="metrics">
-          <thead>
-            <tr><th>Metric</th><th>Target</th><th>Std</th><th>Ratio</th></tr>
-          </thead>
-          <tbody>${rowsHTML}</tbody>
-        </table>
+        <p class="winner-distance">Distance <strong>${d.toFixed(4)}</strong> · h′ = ${winner.h / winner.d}</p>
+        ${winner.swn ? `<p class="winner-distance">S<sub>wn</sub> = ${winner.swn}${winner.mmax ? ` · m<sub>max</sub> = ${winner.mmax}` : ''}</p>` : ''}
       </div>
+      <div>${comparisonTable(winner, 'Winner')}</div>
     </div>
   `;
     }
@@ -1581,48 +1591,29 @@ <h2>Compare your own candidate</h2>
     }
 
     function statusFor(c) {
-      if (c === state.lastWinner) return { cls: 'winner', text: '★ Winner — minimum weighted distance' };
+      if (c === state.lastWinner) return { cls: 'winner', text: '★ Best candidate' };
       const elimStep = state.lastEliminatedAt ? state.lastEliminatedAt.get(c) : null;
       if (elimStep === null || elimStep === undefined) {
-        return { cls: 'survivor', text: 'Survivor — passed all filters' };
+        return { cls: 'survivor', text: 'Within all bounds' };
       }
-      return { cls: 'eliminated', text: `Eliminated at step ${elimStep + 1}: ${FILTER_STEPS[elimStep].label}` };
+      return { cls: 'eliminated', text: `Outside the ${FILTER_STEPS[elimStep].label} bound` };
     }
 
     function renderTooltip(c, clientX, clientY) {
       const tt = document.getElementById('tooltip');
       if (!c) { tt.style.display = 'none'; document.getElementById('hover-ring').style.display = 'none'; return; }
       const st = statusFor(c);
-      const rows = [
-        ['Signature size (B)', c.size, STD_M.size],
-        ['KeyGen cost', c.kg, STD_M.kg],
-        ['SigGen cost', c.sg, STD_M.sg],
-        ['SigVer cost (avg)', c.sv, STD_M.sv],
-        ['SigVer cost (worst)', c.sv_worst, STD_M.sv_worst],
-        ['Comp/Byte ρ (avg)', c.cb, STD_M.cb],
-        ['Comp/Byte ρ (worst)', c.cb_worst, STD_M.cb_worst],
-        ['ρ ÷ Schnorr (avg)', c.cb / state.schnorr.cb64, STD_M.cb / state.schnorr.cb64],
-        ['ρ ÷ Schnorr (worst)', c.cb_worst / state.schnorr.cb64, STD_M.cb_worst / state.schnorr.cb64],
-      ];
-      const tbody = rows.map(([name, target, std]) => {
-        const r = target / std;
-        const cls = ratioClass(r, true);
-        const tval = target < 10 ? target.toFixed(4) : fmt(target);
-        const sval = std < 10 ? std.toFixed(4) : fmt(std);
-        return `<tr><td>${name}</td><td>${tval}</td><td>${sval}</td><td class="ratio ${cls}">${fmtRatio(r)}</td></tr>`;
-      }).join('');
-
       const isSurvivor = st.cls === 'survivor' || st.cls === 'winner';
       const distHTML = isSurvivor
-        ? `<div class="tt-distance">Weighted distance: <strong>${weightedDistance(c, state.W).toFixed(4)}</strong></div>`
+        ? `<div class="tt-distance">Distance <strong>${weightedDistance(c, state.W).toFixed(4)}</strong></div>`
         : '';
 
       tt.innerHTML = `
     <p class="tt-tuple">(${c.h}, ${c.d}, ${c.k}, ${c.a}, ${c.w})${c.swn ? ` <span style="font-size:11px;color:var(--text-soft);">S<sub>wn</sub>=${c.swn}${c.mmax ? `, mmax=${c.mmax}` : ''}</span>` : ''}</p>
     <div class="tt-status ${st.cls}">${st.text}</div>
     <table>
-      <thead><tr><td></td><td>target</td><td>std</td><td>ratio</td></tr></thead>
-      <tbody>${tbody}</tbody>
+      <thead><tr><td></td><td>candidate</td><td>SLH-DSA-128s</td><td>ratio</td></tr></thead>
+      <tbody>${comparisonRows(c)}</tbody>
     </table>
     ${distHTML}
   `;
@@ -1663,14 +1654,12 @@ <h2>Compare your own candidate</h2>
       if (errors.length) return { valid: false, errors, warnings };
 
       if (p.h % p.d !== 0) {
-        errors.push(`d must divide h evenly — h/d = ${(p.h / p.d).toFixed(3)} is not an integer.`);
+        errors.push(`d must divide h (h/d = ${(p.h / p.d).toFixed(3)}).`);
       }
       if (!UNIVERSE_W.includes(p.w)) {
-        errors.push(`w = ${p.w} is not supported. Choose w ∈ {${UNIVERSE_W.join(', ')}} ` +
-          `({2, 4, 16, 256} are SLH-DSA-compatible; FIPS 205 itself standardises w = 16).`);
+        errors.push(`w must be one of ${UNIVERSE_W.join(', ')}.`);
       } else if (OPTIONAL_W.includes(p.w)) {
-        warnings.push(`w = ${p.w}: lg_w = ${Math.log2(p.w)} does not divide 8, so base_2b digits ` +
-          `straddle byte boundaries — exploratory, outside strict SLH-DSA compatibility.`);
+        warnings.push(`w = ${p.w} is exploratory: its digits do not fit whole bytes, as SLH-DSA requires.`);
       }
 
       if (errors.length) return { valid: false, errors, warnings };
@@ -1678,7 +1667,7 @@ <h2>Compare your own candidate</h2>
       // Real security check (FORS subset-forgery analysis, q_s = 2^40)
       const secBits = computeSecurityBits(Q_S_LOG2, p.h, p.k, p.a);
       if (secBits < 128) {
-        warnings.push(`Does not reach 128-bit security: computed security ≈ ${secBits.toFixed(1)} bits at q_s = 2⁴⁰.`);
+        warnings.push(`Below 128-bit security: ${secBits.toFixed(1)} bits at q<sub>s</sub> = 2<sup>40</sup>.`);
       }
 
       return { valid: true, errors: [], warnings, secBits };
@@ -1700,7 +1689,7 @@ <h2>Compare your own candidate</h2>
 
       if (!v.valid) {
         statusEl.className = 'custom-status invalid';
-        statusEl.innerHTML = `<strong>Invalid tuple.</strong><ul>${v.errors.map(e => `<li>${e}</li>`).join('')}</ul>`;
+        statusEl.innerHTML = `<strong>Invalid.</strong><ul>${v.errors.map(e => `<li>${e}</li>`).join('')}</ul>`;
         resultEl.innerHTML = '';
         return;
       }
@@ -1712,9 +1701,8 @@ <h2>Compare your own candidate</h2>
       // and the model stops being meaningful long before that.
       if (!isFinite(m.kg) || !isFinite(m.sg)) {
         statusEl.className = 'custom-status invalid';
-        statusEl.innerHTML = `<strong>Out of range.</strong> h' = h/d = ${(p.h / p.d).toFixed(0)} ` +
-          `is too large — the 2<sup>h'</sup> per-layer tree cost overflows this model. ` +
-          `Reduce h or increase d.`;
+        statusEl.innerHTML = `<strong>Out of range.</strong> h′ = ${p.h / p.d} is too large for this model; ` +
+          `reduce h or increase d.`;
         resultEl.innerHTML = '';
         return;
       }
@@ -1726,36 +1714,16 @@ <h2>Compare your own candidate</h2>
       } else {
         statusEl.className = 'custom-status ok';
         const sameAsStd = p.h === STD.h && p.d === STD.d && p.k === STD.k && p.a === STD.a && p.w === STD.w;
-        statusEl.innerHTML = `<strong>Valid tuple.</strong>${sameAsStd ? ' (This is the SLH-DSA-128s baseline.)' : ''}`;
+        statusEl.innerHTML = `<strong>Valid.</strong>${sameAsStd ? ' This is SLH-DSA-128s.' : ''}`;
       }
 
-      // Comparison table
-      const rows = [
-        ['Signature size (B)', m.size, STD_M.size],
-        ['KeyGen cost', m.kg, STD_M.kg],
-        ['SigGen cost', m.sg, STD_M.sg],
-        ['SigVer cost (avg)', m.sv, STD_M.sv],
-        ['SigVer cost (worst)', m.sv_worst, STD_M.sv_worst],
-        ['Comp/Byte ρ (avg)', m.cb, STD_M.cb],
-        ['Comp/Byte ρ (worst)', m.cb_worst, STD_M.cb_worst],
-        ['ρ ÷ Schnorr (avg)', m.cb / state.schnorr.cb64, STD_M.cb / state.schnorr.cb64],
-        ['ρ ÷ Schnorr (worst)', m.cb_worst / state.schnorr.cb64, STD_M.cb_worst / state.schnorr.cb64],
-      ];
-      const rowsHTML = rows.map(([name, target, std]) => {
-        const r = target / std;
-        const cls = ratioClass(r, true);
-        const tval = target < 10 ? target.toFixed(4) : fmt(target);
-        const sval = std < 10 ? std.toFixed(4) : fmt(std);
-        return `<tr><td>${name}</td><td>${tval}</td><td>${sval}</td><td class="ratio ${cls}">${fmtRatio(r)}</td></tr>`;
-      }).join('');
-
       const hp = p.h / p.d;
       const wotsL = wotsLen(STD.n, p.w);
       const secRaw = forsForgeryExponent(Q_S_LOG2, p.h, p.k, p.a);
       const rawTxt = secRaw > 300 ? '&gt; 300' : secRaw.toFixed(1);
       const secLabel = secRaw >= 128
         ? `<span style="color:var(--good);">128 bits ✓</span> <span style="color:var(--text-mute);font-size:11px;">` +
-          `(FORS-forgery exponent ≈ ${rawTxt} — capped by the 2<sup>−128</sup> preimage bound)</span>`
+          `(${rawTxt} bits against FORS forgery, capped by the 2<sup>−128</sup> preimage bound)</span>`
         : `<span style="color:var(--bad);">${secRaw.toFixed(1)} bits</span>`;
 
       resultEl.innerHTML = `
@@ -1763,19 +1731,12 @@ <h2>Compare your own candidate</h2>
       <div>
         <p class="winner-tuple">(${p.h}, ${p.d}, ${p.k}, ${p.a}, ${p.w})</p>
         <div class="custom-notes">
-          <div><code>h' = h / d = ${hp}</code> (XMSS layer height)</div>
-          <div><code>len = ${wotsL}</code> (WOTS+ chains per signature)</div>
-          <div>Security at q<sub>s</sub> = 2⁴⁰: ${secLabel}</div>
+          <div>Layer height h′ = ${hp}</div>
+          <div>WOTS chains: ${wotsL}</div>
+          <div>Security at q<sub>s</sub> = 2<sup>40</sup>: ${secLabel}</div>
         </div>
       </div>
-      <div>
-        <table class="metrics">
-          <thead>
-            <tr><th>Metric</th><th>Yours</th><th>Std</th><th>Ratio</th></tr>
-          </thead>
-          <tbody>${rowsHTML}</tbody>
-        </table>
-      </div>
+      <div>${comparisonTable(m, 'Yours')}</div>
     </div>
   `;
     }
@@ -1869,12 +1830,6 @@ <h2>Compare your own candidate</h2>
 
     // ---------- Schemes ----------
     const SCHEME_LABELS = { 'SPX': 'SPX', 'W+C': 'W+C', 'W+C_F+C': 'FORS+C', 'W+C_P+FP': 'PORS+FP' };
-    const SCHEME_TITLES = {
-      'SPX': 'Plain SLH-DSA structure: WOTS-TW + FORS',
-      'W+C': 'WOTS+C (grinding counter instead of checksum chains) + FORS',
-      'W+C_F+C': 'WOTS+C + FORS+C (grinding removes the last FORS tree)',
-      'W+C_P+FP': 'WOTS+C + PORS+FP (single tree with Octopus authentication)',
-    };
     const SCHEME_IDS = { 'SPX': 'spx', 'W+C': 'wc', 'W+C_F+C': 'fc', 'W+C_P+FP': 'pfp' };
     const SCHEME_FROM_ID = Object.fromEntries(Object.entries(SCHEME_IDS).map(([k, v]) => [v, k]));
 
@@ -1882,30 +1837,27 @@ <h2>Compare your own candidate</h2>
       const host = document.getElementById('scheme-controls');
       const schemes = state.siteData ? state.siteData.meta.schemes : ['SPX'];
       host.innerHTML = schemes.map(s =>
-        `<button class="${s === state.scheme ? 'active' : ''}" data-scheme="${s}"
-                 title="${SCHEME_TITLES[s]}">${SCHEME_LABELS[s]}</button>`).join('');
+        `<button class="${s === state.scheme ? 'active' : ''}" data-scheme="${s}">${SCHEME_LABELS[s]}</button>`).join('');
       host.querySelectorAll('button').forEach(b =>
         b.addEventListener('click', () => activateScheme(b.dataset.scheme)));
       if (!state.siteData) {
-        document.getElementById('scheme-hint').innerHTML =
-          'Variants need <code>data.json</code> (unavailable — SPX computed in-browser).';
+        const hint = document.getElementById('scheme-hint');
+        hint.textContent = 'Only SPX: data.json did not load.';
+        hint.hidden = false;
       }
     }
 
     function schnorrNote() {
       const s = state.schnorr;
-      const rAvg = (STD_M.cb / s.cb64).toFixed(3);
-      const rWorst = (STD_M.cb_worst / s.cb64).toFixed(3);
       const src = s.live
-        ? `kappa.json${s.commit ? ` @ secp256k1 ${s.commit}` : ''}${s.run ? `, ${s.run}` : ''}` +
+        ? `kappa.json${s.commit ? ` at secp256k1 ${s.commit}` : ''}${s.run ? `, ${s.run}` : ''}` +
           `${s.machine ? `, ${s.machine}` : ''}${s.preliminary ? ', preliminary' : ''}`
-        : `built-in 1.98 C/B — live kappa.json unreachable`;
-      return `<br><span style="opacity:0.65;font-size:11px;">` +
-        `ρ reference: BIP340 Schnorr verify ≈ <strong>${s.cb64.toFixed(2)} C/B</strong> ` +
-        `(${s.impl}, single verify over a 64 B wire signature; ` +
-        `<a href="https://github.com/mjthatch/bip340-vs-sha256" style="color:inherit;">bip340-vs-sha256</a>: ${src}). ` +
-        `SLH-DSA-128s baseline: ${STD_M.cb.toFixed(4)} C/B = ` +
-        `<strong>${rAvg}×</strong> Schnorr (avg), ${rWorst}× (worst).</span>`;
+        : 'built-in value, the live kappa.json did not load';
+      return `<p>Schnorr reference: a BIP340 verification takes ${s.cb64.toFixed(2)} C/B ` +
+        `(${s.impl}, one 64-byte signature; ` +
+        `<a href="https://github.com/mjthatch/bip340-vs-sha256">bip340-vs-sha256</a>, ${src}). ` +
+        `SLH-DSA-128s has ρ = ${fmtRho(STD_M.cb)} C/B, ${fmtRatio(STD_M.cb / s.cb64)} Schnorr ` +
+        `(${fmtRatio(STD_M.cb_worst / s.cb64)} worst).</p>`;
     }
 
     function renderInfoStrip() {
@@ -1915,31 +1867,21 @@ <h2>Compare your own candidate</h2>
       const wtxt = state.scheme === 'SPX'
         ? `w = {${act.join(', ')}}`
         : `(w, S<sub>wn</sub>) ∈ {(16, 240), (256, 2040)}`;
-      const bounds = `(≥ 128-bit security at q<sub>s</sub> = 2⁴⁰, size &lt; 7,856 B, ${wtxt})`;
-      let html;
-      if (d) {
-        const pm = d.pools[state.scheme];
-        const swept = state.scheme === 'SPX'
-          ? consideredPerW(d.meta.grid) * act.length
-          : pm.considered;
-        html =
-          `Scheme: <strong>${SCHEME_LABELS[state.scheme]}</strong> · ` +
-          `<strong>${swept.toLocaleString()}</strong> tuples swept · ` +
-          `<strong>${pool.length.toLocaleString()}</strong> pass the initial bounds ${bounds}. ` +
-          `<span style="opacity:0.65;font-size:11px;">` +
-          `Data: <code>data.json</code> (generated ${d.meta.generated}, commit ${d.meta.commit}); ` +
-          `security via the FORS / PORS+FP subset-forgery analysis of the report's ` +
-          `<a href="https://github.com/BlockstreamResearch/SPHINCS-Parameters/blob/main/security.sage" style="color:inherit;">security.sage</a>.` +
-          `</span>` + schnorrNote();
-      } else {
-        html =
-          `Scheme: <strong>SPX</strong> · ` +
-          `<strong>${(consideredPerW(null) * act.length).toLocaleString()}</strong> tuples · ` +
-          `<strong>${pool.length.toLocaleString()}</strong> pass the initial bounds ${bounds}. ` +
-          `<span style="opacity:0.65;font-size:11px;">Pool computed in-browser ` +
-          `(data.json unavailable — scheme variants disabled).</span>` + schnorrNote();
-      }
-      document.getElementById('initial-info').innerHTML = html;
+      const swept = d
+        ? (state.scheme === 'SPX' ? consideredPerW(d.meta.grid) * act.length : d.pools[state.scheme].considered)
+        : consideredPerW(null) * act.length;
+      document.getElementById('initial-info').innerHTML =
+        `Scheme <strong>${SCHEME_LABELS[state.scheme]}</strong> · ` +
+        `<strong>${swept.toLocaleString('en-US')}</strong> tuples swept · ` +
+        `<strong>${pool.length.toLocaleString('en-US')}</strong> pass the initial bounds`;
+      const source = d
+        ? `<p>Pool: <code>data.json</code>, generated ${d.meta.generated} from commit ${d.meta.commit}. ` +
+          `Security from the FORS and PORS+FP subset-forgery analysis in ` +
+          `<a href="https://github.com/BlockstreamResearch/SPHINCS-Parameters/blob/main/security.sage">security.sage</a>.</p>`
+        : '<p>Pool computed in the browser, because <code>data.json</code> did not load.</p>';
+      document.getElementById('about-pool').innerHTML =
+        `<p>Initial bounds: at least 128-bit security at q<sub>s</sub> = 2<sup>40</sup>, ` +
+        `size below ${fmtNum(STD_M.size)} B, ${wtxt}.</p>` + source + schnorrNote();
     }
 
     function activateScheme(scheme) {
@@ -2025,10 +1967,9 @@ <h2>Compare your own candidate</h2>
 
     // ---------- CSV export ----------
     function exportSurvivorsCSV() {
-      const header = ['scheme', 'h', 'd', 'k', 'a', 'w', 'swn', 'mmax', 'size',
-        'keygen_C', 'sign_C', 'verify_C', 'verify_worst_C',
-        'c_per_byte', 'c_per_byte_worst',
-        'cb_vs_schnorr', 'cb_worst_vs_schnorr', 'schnorr_cb64', 'distance'];
+      const header = ['scheme', 'h', 'd', 'k', 'a', 'w', 'swn', 'mmax', 'size_B',
+        'keygen_C', 'siggen_C', 'sigver_C', 'sigver_worst_C',
+        'rho', 'rho_worst', 'rho_vs_schnorr', 'rho_worst_vs_schnorr', 'schnorr_rho', 'distance'];
       const lines = [header.join(',')];
       for (const c of state.lastSurvivors) {
         lines.push([state.scheme, c.h, c.d, c.k, c.a, c.w, c.swn || 0, c.mmax || 0,
@@ -2073,6 +2014,7 @@ <h2>Compare your own candidate</h2>
       renderControls();
       document.getElementById('worst-toggle').checked = state.useWorst;
       document.getElementById('optw-toggle').checked = state.showOptW;
+      document.querySelectorAll('[data-std]').forEach(el => { el.innerHTML = fmtNum(STD_M[el.dataset.std]); });
       renderSchemeButtons();
       renderInfoStrip();
       update();
diff --git a/tests/site_snapshot.json b/tests/site_snapshot.json
index 18df2a4..d4b0d11 100644
--- a/tests/site_snapshot.json
+++ b/tests/site_snapshot.json
@@ -36,29 +36,34 @@
   "input #xmss-h-val": "20"
  },
  "stateless.html": {
-  "#initial-info": "Scheme: SPX · 34,580 tuples swept · 7,570 pass the initial bounds (≥ 128-bit security at q s = 2⁴⁰, size < 7,856 B, w = {2, 4, 16, 256}). Data: data.json (generated <date>, commit <id>); security via the FORS / PORS+FP subset-forgery analysis of the report's security.sage . ρ reference: BIP340 Schnorr verify ≈ 1.98 C/B (libsecp256k1, single verify over a 64 B wire signature; bip340-vs-sha256 : built-in 1.98 C/B — live kappa.json unreachable). SLH-DSA-128s baseline: 0.2791 C/B = 0.141× Schnorr (avg), 0.250× (worst).",
-  "#funnel": "Initial pool 7,570 Size ≤ 1.00·std 7,570 KeyGen ≤ 1.00·std 1,210 SigGen ≤ 1.00·std 762 SigVer ≤ 1.00·std 308 Comp/Byte ≤ 1.00·std 204",
-  "#winner": "(40, 5, 20, 9, 16) Weighted distance: 0.3328 h' = h/d = 8 per XMSS layer",
-  "#winner row 0": ["Signature size (B)","6,656","7,856","0.847×"],
-  "#winner row 1": ["KeyGen cost","146,175","292,351","0.500×"],
-  "#winner row 2": ["SigGen cost","761,588","2.22M","0.343×"],
-  "#winner row 3": ["SigVer cost (avg)","1,636","2,193","0.746×"],
-  "#winner row 4": ["SigVer cost (worst)","2,850","3,893","0.732×"],
-  "#winner row 5": ["Comp/Byte ρ (avg)","0.2458","0.2791","0.881×"],
-  "#winner row 6": ["Comp/Byte ρ (worst)","0.4282","0.4955","0.864×"],
-  "#winner row 7": ["ρ ÷ Schnorr (avg)","0.1241","0.1410","0.881×"],
-  "#winner row 8": ["ρ ÷ Schnorr (worst)","0.2163","0.2503","0.864×"],
-  "#custom-status": "Valid tuple. (This is the SLH-DSA-128s baseline.)",
-  "#custom-result": "(63, 7, 14, 12, 16) h' = h / d = 9 (XMSS layer height) len = 35 (WOTS+ chains per signature) Security at q s = 2⁴⁰: 128 bits ✓ (FORS-forgery exponent ≈ 191.0 — capped by the 2 ^−128 preimage bound)",
-  "#custom-result row 0": ["Signature size (B)","7,856","7,856","1.000×"],
-  "#custom-result row 1": ["KeyGen cost","292,351","292,351","1.000×"],
-  "#custom-result row 2": ["SigGen cost","2.22M","2.22M","1.000×"],
-  "#custom-result row 3": ["SigVer cost (avg)","2,193","2,193","1.000×"],
-  "#custom-result row 4": ["SigVer cost (worst)","3,893","3,893","1.000×"],
-  "#custom-result row 5": ["Comp/Byte ρ (avg)","0.2791","0.2791","1.000×"],
-  "#custom-result row 6": ["Comp/Byte ρ (worst)","0.4955","0.4955","1.000×"],
-  "#custom-result row 7": ["ρ ÷ Schnorr (avg)","0.1410","0.1410","1.000×"],
-  "#custom-result row 8": ["ρ ÷ Schnorr (worst)","0.2503","0.2503","1.000×"],
+  "#initial-info": "Scheme SPX · 34,580 tuples swept · 7,570 pass the initial bounds",
+  "#funnel": "Initial pool 7,570 Size ≤ 1.00× 7,570 KeyGen ≤ 1.00× 1,210 SigGen ≤ 1.00× 762 SigVer ≤ 1.00× 308 ρ ≤ 1.00× 204",
+  "#winner": "(40, 5, 20, 9, 16) Distance 0.3328 · h′ = 8",
+  "#winner row 0": ["Size (B)","6,656","7,856","0.847×"],
+  "#winner row 1": ["KeyGen (C)","146,175","292,351","0.500×"],
+  "#winner row 2": ["SigGen (C)","761,588","2.22M","0.343×"],
+  "#winner row 3": ["SigVer (C)","1,636","2,193","0.746×"],
+  "#winner row 4": ["SigVer, worst (C)","2,850","3,893","0.732×"],
+  "#winner row 5": ["ρ (C/B)","0.2458","0.2791","0.881×"],
+  "#winner row 6": ["ρ, worst (C/B)","0.4282","0.4955","0.864×"],
+  "#winner row 7": ["ρ ÷ Schnorr","0.124×","0.141×","0.881×"],
+  "#winner row 8": ["ρ ÷ Schnorr, worst","0.216×","0.250×","0.864×"],
+  "#custom-status": "Valid. This is SLH-DSA-128s.",
+  "#custom-result": "(63, 7, 14, 12, 16) Layer height h′ = 9 WOTS chains: 35 Security at q s = 2 ^40 : 128 bits ✓ (191.0 bits against FORS forgery, capped by the 2 ^−128 preimage bound)",
+  "#custom-result row 0": ["Size (B)","7,856","7,856","1.00×"],
+  "#custom-result row 1": ["KeyGen (C)","292,351","292,351","1.00×"],
+  "#custom-result row 2": ["SigGen (C)","2.22M","2.22M","1.00×"],
+  "#custom-result row 3": ["SigVer (C)","2,193","2,193","1.00×"],
+  "#custom-result row 4": ["SigVer, worst (C)","3,893","3,893","1.00×"],
+  "#custom-result row 5": ["ρ (C/B)","0.2791","0.2791","1.00×"],
+  "#custom-result row 6": ["ρ, worst (C/B)","0.4955","0.4955","1.00×"],
+  "#custom-result row 7": ["ρ ÷ Schnorr","0.141×","0.141×","1.00×"],
+  "#custom-result row 8": ["ρ ÷ Schnorr, worst","0.250×","0.250×","1.00×"],
+  "popover #about-w": "The pool always includes w = 2, 4, 16 and 256, whose digits fit whole bytes as SLH-DSA requires. w = 32, 64 and 128 do not, so they are exploratory and extend only the SPX pool.",
+  "popover #about-worst": "Filter and rank on worst-case SigVer and ρ, against the worst case of SLH-DSA-128s ( 3,893 C instead of 2,193 C). WOTS+C verification costs the same for every message, so candidates with WOTS+C keep their values and gain headroom.",
+  "popover #about-weights": "The best candidate has the smallest distance: the weighted root mean square of its five ratios to SLH-DSA-128s, each rescaled to 0–1 across the candidates within the bounds.",
+  "popover #about-pool": "Initial bounds: at least 128-bit security at q s = 2 ^40 , size below 7,856 B, w = {2, 4, 16, 256}. Pool: data.json , generated <date> from commit <id> Security from the FORS and PORS+FP subset-forgery analysis in security.sage . Schnorr reference: a BIP340 verification takes 1.98 C/B (libsecp256k1, one 64-byte signature; bip340-vs-sha256 , built-in value, the live kappa.json did not load). SLH-DSA-128s has ρ = 0.2791 C/B, 0.141× Schnorr (0.250× worst).",
+  "popover #glossary": "Glossary C One SHA-256 compression. Costs count compressions; the PK.seed block is compressed once per key and reused. B Byte. KeyGen, SigGen, SigVer Compressions to generate a key pair, to sign a message and to verify a signature. SigVer is the average unless marked worst. ρ SigVer per signature byte, in C/B. ρ ÷ Schnorr ρ divided by the ρ of a BIP340 Schnorr verification (libsecp256k1, 64-byte signature). SLH-DSA-128s The FIPS 205 parameter set (h, d, k, a, w) = (63, 7, 14, 12, 16). Ratios (×) compare against it. h, d, k, a, w Hypertree height, number of layers, FORS trees, FORS tree height, Winternitz parameter. h′ = h/d is the height of one layer. q s The number of signatures per key that security is computed for: 2 ^40 for the stateless schemes. WOTS, WOTS+C Winternitz one-time signatures. WOTS (as in SLH-DSA) has checksum chains; WOTS+C replaces them with a counter that the signer grinds until the message digits have a fixed sum, so verification always costs the same. XMSS, XMSS-MT, UXMSS Stateful schemes: one balanced Merkle tree (BXMSS in SHRINCS), d layers of such trees, and the unbalanced SHRINCS tree, whose signatures grow by one node per signature. Cached, cold A cached signer keeps tree state between signatures (a BDS state for XMSS, a leaf cache for UXMSS); a cold signer keeps none and rebuilds its trees for every signature.",
   "input #optw-toggle": "off",
   "input #X_size_val": "1.00",
   "input #X_kg_val": "1.00",
@@ -78,29 +83,34 @@
   "input #cust-w": "16"
  },
  "stateless.html#s=wc": {
-  "#initial-info": "Scheme: W+C · 17,290 tuples swept · 6,666 pass the initial bounds (≥ 128-bit security at q s = 2⁴⁰, size < 7,856 B, (w, S wn ) ∈ {(16, 240), (256, 2040)}). Data: data.json (generated <date>, commit <id>); security via the FORS / PORS+FP subset-forgery analysis of the report's security.sage . ρ reference: BIP340 Schnorr verify ≈ 1.98 C/B (libsecp256k1, single verify over a 64 B wire signature; bip340-vs-sha256 : built-in 1.98 C/B — live kappa.json unreachable). SLH-DSA-128s baseline: 0.2791 C/B = 0.141× Schnorr (avg), 0.250× (worst).",
-  "#funnel": "Initial pool 6,666 Size ≤ 1.00·std 6,666 KeyGen ≤ 1.00·std 1,765 SigGen ≤ 1.00·std 1,041 SigVer ≤ 1.00·std 364 Comp/Byte ≤ 1.00·std 324",
-  "#winner": "(40, 5, 19, 9, 16) Weighted distance: 0.3334 h' = h/d = 8 per XMSS layer S wn = 240",
-  "#winner row 0": ["Signature size (B)","6,276","7,856","0.799×"],
-  "#winner row 1": ["KeyGen cost","133,631","292,351","0.457×"],
-  "#winner row 2": ["SigGen cost","697,663","2.22M","0.314×"],
-  "#winner row 3": ["SigVer cost (avg)","1,490","2,193","0.679×"],
-  "#winner row 4": ["SigVer cost (worst)","1,490","3,893","0.383×"],
-  "#winner row 5": ["Comp/Byte ρ (avg)","0.2374","0.2791","0.850×"],
-  "#winner row 6": ["Comp/Byte ρ (worst)","0.2374","0.4955","0.479×"],
-  "#winner row 7": ["ρ ÷ Schnorr (avg)","0.1199","0.1410","0.850×"],
-  "#winner row 8": ["ρ ÷ Schnorr (worst)","0.1199","0.2503","0.479×"],
-  "#custom-status": "Valid tuple. (This is the SLH-DSA-128s baseline.)",
-  "#custom-result": "(63, 7, 14, 12, 16) h' = h / d = 9 (XMSS layer height) len = 35 (WOTS+ chains per signature) Security at q s = 2⁴⁰: 128 bits ✓ (FORS-forgery exponent ≈ 191.0 — capped by the 2 ^−128 preimage bound)",
-  "#custom-result row 0": ["Signature size (B)","7,856","7,856","1.000×"],
-  "#custom-result row 1": ["KeyGen cost","292,351","292,351","1.000×"],
-  "#custom-result row 2": ["SigGen cost","2.22M","2.22M","1.000×"],
-  "#custom-result row 3": ["SigVer cost (avg)","2,193","2,193","1.000×"],
-  "#custom-result row 4": ["SigVer cost (worst)","3,893","3,893","1.000×"],
-  "#custom-result row 5": ["Comp/Byte ρ (avg)","0.2791","0.2791","1.000×"],
-  "#custom-result row 6": ["Comp/Byte ρ (worst)","0.4955","0.4955","1.000×"],
-  "#custom-result row 7": ["ρ ÷ Schnorr (avg)","0.1410","0.1410","1.000×"],
-  "#custom-result row 8": ["ρ ÷ Schnorr (worst)","0.2503","0.2503","1.000×"],
+  "#initial-info": "Scheme W+C · 17,290 tuples swept · 6,666 pass the initial bounds",
+  "#funnel": "Initial pool 6,666 Size ≤ 1.00× 6,666 KeyGen ≤ 1.00× 1,765 SigGen ≤ 1.00× 1,041 SigVer ≤ 1.00× 364 ρ ≤ 1.00× 324",
+  "#winner": "(40, 5, 19, 9, 16) Distance 0.3334 · h′ = 8 S wn = 240",
+  "#winner row 0": ["Size (B)","6,276","7,856","0.799×"],
+  "#winner row 1": ["KeyGen (C)","133,631","292,351","0.457×"],
+  "#winner row 2": ["SigGen (C)","697,663","2.22M","0.314×"],
+  "#winner row 3": ["SigVer (C)","1,490","2,193","0.679×"],
+  "#winner row 4": ["SigVer, worst (C)","1,490","3,893","0.383×"],
+  "#winner row 5": ["ρ (C/B)","0.2374","0.2791","0.850×"],
+  "#winner row 6": ["ρ, worst (C/B)","0.2374","0.4955","0.479×"],
+  "#winner row 7": ["ρ ÷ Schnorr","0.120×","0.141×","0.850×"],
+  "#winner row 8": ["ρ ÷ Schnorr, worst","0.120×","0.250×","0.479×"],
+  "#custom-status": "Valid. This is SLH-DSA-128s.",
+  "#custom-result": "(63, 7, 14, 12, 16) Layer height h′ = 9 WOTS chains: 35 Security at q s = 2 ^40 : 128 bits ✓ (191.0 bits against FORS forgery, capped by the 2 ^−128 preimage bound)",
+  "#custom-result row 0": ["Size (B)","7,856","7,856","1.00×"],
+  "#custom-result row 1": ["KeyGen (C)","292,351","292,351","1.00×"],
+  "#custom-result row 2": ["SigGen (C)","2.22M","2.22M","1.00×"],
+  "#custom-result row 3": ["SigVer (C)","2,193","2,193","1.00×"],
+  "#custom-result row 4": ["SigVer, worst (C)","3,893","3,893","1.00×"],
+  "#custom-result row 5": ["ρ (C/B)","0.2791","0.2791","1.00×"],
+  "#custom-result row 6": ["ρ, worst (C/B)","0.4955","0.4955","1.00×"],
+  "#custom-result row 7": ["ρ ÷ Schnorr","0.141×","0.141×","1.00×"],
+  "#custom-result row 8": ["ρ ÷ Schnorr, worst","0.250×","0.250×","1.00×"],
+  "popover #about-w": "The pool always includes w = 2, 4, 16 and 256, whose digits fit whole bytes as SLH-DSA requires. w = 32, 64 and 128 do not, so they are exploratory and extend only the SPX pool.",
+  "popover #about-worst": "Filter and rank on worst-case SigVer and ρ, against the worst case of SLH-DSA-128s ( 3,893 C instead of 2,193 C). WOTS+C verification costs the same for every message, so candidates with WOTS+C keep their values and gain headroom.",
+  "popover #about-weights": "The best candidate has the smallest distance: the weighted root mean square of its five ratios to SLH-DSA-128s, each rescaled to 0–1 across the candidates within the bounds.",
+  "popover #about-pool": "Initial bounds: at least 128-bit security at q s = 2 ^40 , size below 7,856 B, (w, S wn ) ∈ {(16, 240), (256, 2040)}. Pool: data.json , generated <date> from commit <id> Security from the FORS and PORS+FP subset-forgery analysis in security.sage . Schnorr reference: a BIP340 verification takes 1.98 C/B (libsecp256k1, one 64-byte signature; bip340-vs-sha256 , built-in value, the live kappa.json did not load). SLH-DSA-128s has ρ = 0.2791 C/B, 0.141× Schnorr (0.250× worst).",
+  "popover #glossary": "Glossary C One SHA-256 compression. Costs count compressions; the PK.seed block is compressed once per key and reused. B Byte. KeyGen, SigGen, SigVer Compressions to generate a key pair, to sign a message and to verify a signature. SigVer is the average unless marked worst. ρ SigVer per signature byte, in C/B. ρ ÷ Schnorr ρ divided by the ρ of a BIP340 Schnorr verification (libsecp256k1, 64-byte signature). SLH-DSA-128s The FIPS 205 parameter set (h, d, k, a, w) = (63, 7, 14, 12, 16). Ratios (×) compare against it. h, d, k, a, w Hypertree height, number of layers, FORS trees, FORS tree height, Winternitz parameter. h′ = h/d is the height of one layer. q s The number of signatures per key that security is computed for: 2 ^40 for the stateless schemes. WOTS, WOTS+C Winternitz one-time signatures. WOTS (as in SLH-DSA) has checksum chains; WOTS+C replaces them with a counter that the signer grinds until the message digits have a fixed sum, so verification always costs the same. XMSS, XMSS-MT, UXMSS Stateful schemes: one balanced Merkle tree (BXMSS in SHRINCS), d layers of such trees, and the unbalanced SHRINCS tree, whose signatures grow by one node per signature. Cached, cold A cached signer keeps tree state between signatures (a BDS state for XMSS, a leaf cache for UXMSS); a cold signer keeps none and rebuilds its trees for every signature.",
   "input #optw-toggle": "off",
   "input #X_size_val": "1.00",
   "input #X_kg_val": "1.00",
@@ -120,29 +130,34 @@
   "input #cust-w": "16"
  },
  "stateless.html#s=fc": {
-  "#initial-info": "Scheme: FORS+C · 17,290 tuples swept · 7,077 pass the initial bounds (≥ 128-bit security at q s = 2⁴⁰, size < 7,856 B, (w, S wn ) ∈ {(16, 240), (256, 2040)}). Data: data.json (generated <date>, commit <id>); security via the FORS / PORS+FP subset-forgery analysis of the report's security.sage . ρ reference: BIP340 Schnorr verify ≈ 1.98 C/B (libsecp256k1, single verify over a 64 B wire signature; bip340-vs-sha256 : built-in 1.98 C/B — live kappa.json unreachable). SLH-DSA-128s baseline: 0.2791 C/B = 0.141× Schnorr (avg), 0.250× (worst).",
-  "#funnel": "Initial pool 7,077 Size ≤ 1.00·std 7,077 KeyGen ≤ 1.00·std 1,988 SigGen ≤ 1.00·std 1,116 SigVer ≤ 1.00·std 399 Comp/Byte ≤ 1.00·std 325",
-  "#winner": "(40, 5, 20, 9, 16) Weighted distance: 0.3450 h' = h/d = 8 per XMSS layer S wn = 240",
-  "#winner row 0": ["Signature size (B)","6,276","7,856","0.799×"],
-  "#winner row 1": ["KeyGen cost","133,631","292,351","0.457×"],
-  "#winner row 2": ["SigGen cost","701,240","2.22M","0.316×"],
-  "#winner row 3": ["SigVer cost (avg)","1,490","2,193","0.679×"],
-  "#winner row 4": ["SigVer cost (worst)","1,490","3,893","0.383×"],
-  "#winner row 5": ["Comp/Byte ρ (avg)","0.2374","0.2791","0.850×"],
-  "#winner row 6": ["Comp/Byte ρ (worst)","0.2374","0.4955","0.479×"],
-  "#winner row 7": ["ρ ÷ Schnorr (avg)","0.1199","0.1410","0.850×"],
-  "#winner row 8": ["ρ ÷ Schnorr (worst)","0.1199","0.2503","0.479×"],
-  "#custom-status": "Valid tuple. (This is the SLH-DSA-128s baseline.)",
-  "#custom-result": "(63, 7, 14, 12, 16) h' = h / d = 9 (XMSS layer height) len = 35 (WOTS+ chains per signature) Security at q s = 2⁴⁰: 128 bits ✓ (FORS-forgery exponent ≈ 191.0 — capped by the 2 ^−128 preimage bound)",
-  "#custom-result row 0": ["Signature size (B)","7,856","7,856","1.000×"],
-  "#custom-result row 1": ["KeyGen cost","292,351","292,351","1.000×"],
-  "#custom-result row 2": ["SigGen cost","2.22M","2.22M","1.000×"],
-  "#custom-result row 3": ["SigVer cost (avg)","2,193","2,193","1.000×"],
-  "#custom-result row 4": ["SigVer cost (worst)","3,893","3,893","1.000×"],
-  "#custom-result row 5": ["Comp/Byte ρ (avg)","0.2791","0.2791","1.000×"],
-  "#custom-result row 6": ["Comp/Byte ρ (worst)","0.4955","0.4955","1.000×"],
-  "#custom-result row 7": ["ρ ÷ Schnorr (avg)","0.1410","0.1410","1.000×"],
-  "#custom-result row 8": ["ρ ÷ Schnorr (worst)","0.2503","0.2503","1.000×"],
+  "#initial-info": "Scheme FORS+C · 17,290 tuples swept · 7,077 pass the initial bounds",
+  "#funnel": "Initial pool 7,077 Size ≤ 1.00× 7,077 KeyGen ≤ 1.00× 1,988 SigGen ≤ 1.00× 1,116 SigVer ≤ 1.00× 399 ρ ≤ 1.00× 325",
+  "#winner": "(40, 5, 20, 9, 16) Distance 0.3450 · h′ = 8 S wn = 240",
+  "#winner row 0": ["Size (B)","6,276","7,856","0.799×"],
+  "#winner row 1": ["KeyGen (C)","133,631","292,351","0.457×"],
+  "#winner row 2": ["SigGen (C)","701,240","2.22M","0.316×"],
+  "#winner row 3": ["SigVer (C)","1,490","2,193","0.679×"],
+  "#winner row 4": ["SigVer, worst (C)","1,490","3,893","0.383×"],
+  "#winner row 5": ["ρ (C/B)","0.2374","0.2791","0.850×"],
+  "#winner row 6": ["ρ, worst (C/B)","0.2374","0.4955","0.479×"],
+  "#winner row 7": ["ρ ÷ Schnorr","0.120×","0.141×","0.850×"],
+  "#winner row 8": ["ρ ÷ Schnorr, worst","0.120×","0.250×","0.479×"],
+  "#custom-status": "Valid. This is SLH-DSA-128s.",
+  "#custom-result": "(63, 7, 14, 12, 16) Layer height h′ = 9 WOTS chains: 35 Security at q s = 2 ^40 : 128 bits ✓ (191.0 bits against FORS forgery, capped by the 2 ^−128 preimage bound)",
+  "#custom-result row 0": ["Size (B)","7,856","7,856","1.00×"],
+  "#custom-result row 1": ["KeyGen (C)","292,351","292,351","1.00×"],
+  "#custom-result row 2": ["SigGen (C)","2.22M","2.22M","1.00×"],
+  "#custom-result row 3": ["SigVer (C)","2,193","2,193","1.00×"],
+  "#custom-result row 4": ["SigVer, worst (C)","3,893","3,893","1.00×"],
+  "#custom-result row 5": ["ρ (C/B)","0.2791","0.2791","1.00×"],
+  "#custom-result row 6": ["ρ, worst (C/B)","0.4955","0.4955","1.00×"],
+  "#custom-result row 7": ["ρ ÷ Schnorr","0.141×","0.141×","1.00×"],
+  "#custom-result row 8": ["ρ ÷ Schnorr, worst","0.250×","0.250×","1.00×"],
+  "popover #about-w": "The pool always includes w = 2, 4, 16 and 256, whose digits fit whole bytes as SLH-DSA requires. w = 32, 64 and 128 do not, so they are exploratory and extend only the SPX pool.",
+  "popover #about-worst": "Filter and rank on worst-case SigVer and ρ, against the worst case of SLH-DSA-128s ( 3,893 C instead of 2,193 C). WOTS+C verification costs the same for every message, so candidates with WOTS+C keep their values and gain headroom.",
+  "popover #about-weights": "The best candidate has the smallest distance: the weighted root mean square of its five ratios to SLH-DSA-128s, each rescaled to 0–1 across the candidates within the bounds.",
+  "popover #about-pool": "Initial bounds: at least 128-bit security at q s = 2 ^40 , size below 7,856 B, (w, S wn ) ∈ {(16, 240), (256, 2040)}. Pool: data.json , generated <date> from commit <id> Security from the FORS and PORS+FP subset-forgery analysis in security.sage . Schnorr reference: a BIP340 verification takes 1.98 C/B (libsecp256k1, one 64-byte signature; bip340-vs-sha256 , built-in value, the live kappa.json did not load). SLH-DSA-128s has ρ = 0.2791 C/B, 0.141× Schnorr (0.250× worst).",
+  "popover #glossary": "Glossary C One SHA-256 compression. Costs count compressions; the PK.seed block is compressed once per key and reused. B Byte. KeyGen, SigGen, SigVer Compressions to generate a key pair, to sign a message and to verify a signature. SigVer is the average unless marked worst. ρ SigVer per signature byte, in C/B. ρ ÷ Schnorr ρ divided by the ρ of a BIP340 Schnorr verification (libsecp256k1, 64-byte signature). SLH-DSA-128s The FIPS 205 parameter set (h, d, k, a, w) = (63, 7, 14, 12, 16). Ratios (×) compare against it. h, d, k, a, w Hypertree height, number of layers, FORS trees, FORS tree height, Winternitz parameter. h′ = h/d is the height of one layer. q s The number of signatures per key that security is computed for: 2 ^40 for the stateless schemes. WOTS, WOTS+C Winternitz one-time signatures. WOTS (as in SLH-DSA) has checksum chains; WOTS+C replaces them with a counter that the signer grinds until the message digits have a fixed sum, so verification always costs the same. XMSS, XMSS-MT, UXMSS Stateful schemes: one balanced Merkle tree (BXMSS in SHRINCS), d layers of such trees, and the unbalanced SHRINCS tree, whose signatures grow by one node per signature. Cached, cold A cached signer keeps tree state between signatures (a BDS state for XMSS, a leaf cache for UXMSS); a cold signer keeps none and rebuilds its trees for every signature.",
   "input #optw-toggle": "off",
   "input #X_size_val": "1.00",
   "input #X_kg_val": "1.00",
@@ -162,29 +177,34 @@
   "input #cust-w": "16"
  },
  "stateless.html#wc=1": {
-  "#initial-info": "Scheme: SPX · 34,580 tuples swept · 7,570 pass the initial bounds (≥ 128-bit security at q s = 2⁴⁰, size < 7,856 B, w = {2, 4, 16, 256}). Data: data.json (generated <date>, commit <id>); security via the FORS / PORS+FP subset-forgery analysis of the report's security.sage . ρ reference: BIP340 Schnorr verify ≈ 1.98 C/B (libsecp256k1, single verify over a 64 B wire signature; bip340-vs-sha256 : built-in 1.98 C/B — live kappa.json unreachable). SLH-DSA-128s baseline: 0.2791 C/B = 0.141× Schnorr (avg), 0.250× (worst).",
-  "#funnel": "Initial pool 7,570 Size ≤ 1.00·std 7,570 KeyGen ≤ 1.00·std 1,210 SigGen ≤ 1.00·std 762 SigVer (worst) ≤ 1.00·std 308 Comp/Byte (worst) ≤ 1.00·std 204",
-  "#winner": "(40, 5, 20, 9, 16) Weighted distance: 0.3275 h' = h/d = 8 per XMSS layer",
-  "#winner row 0": ["Signature size (B)","6,656","7,856","0.847×"],
-  "#winner row 1": ["KeyGen cost","146,175","292,351","0.500×"],
-  "#winner row 2": ["SigGen cost","761,588","2.22M","0.343×"],
-  "#winner row 3": ["SigVer cost (avg)","1,636","2,193","0.746×"],
-  "#winner row 4": ["SigVer cost (worst)","2,850","3,893","0.732×"],
-  "#winner row 5": ["Comp/Byte ρ (avg)","0.2458","0.2791","0.881×"],
-  "#winner row 6": ["Comp/Byte ρ (worst)","0.4282","0.4955","0.864×"],
-  "#winner row 7": ["ρ ÷ Schnorr (avg)","0.1241","0.1410","0.881×"],
-  "#winner row 8": ["ρ ÷ Schnorr (worst)","0.2163","0.2503","0.864×"],
-  "#custom-status": "Valid tuple. (This is the SLH-DSA-128s baseline.)",
-  "#custom-result": "(63, 7, 14, 12, 16) h' = h / d = 9 (XMSS layer height) len = 35 (WOTS+ chains per signature) Security at q s = 2⁴⁰: 128 bits ✓ (FORS-forgery exponent ≈ 191.0 — capped by the 2 ^−128 preimage bound)",
-  "#custom-result row 0": ["Signature size (B)","7,856","7,856","1.000×"],
-  "#custom-result row 1": ["KeyGen cost","292,351","292,351","1.000×"],
-  "#custom-result row 2": ["SigGen cost","2.22M","2.22M","1.000×"],
-  "#custom-result row 3": ["SigVer cost (avg)","2,193","2,193","1.000×"],
-  "#custom-result row 4": ["SigVer cost (worst)","3,893","3,893","1.000×"],
-  "#custom-result row 5": ["Comp/Byte ρ (avg)","0.2791","0.2791","1.000×"],
-  "#custom-result row 6": ["Comp/Byte ρ (worst)","0.4955","0.4955","1.000×"],
-  "#custom-result row 7": ["ρ ÷ Schnorr (avg)","0.1410","0.1410","1.000×"],
-  "#custom-result row 8": ["ρ ÷ Schnorr (worst)","0.2503","0.2503","1.000×"],
+  "#initial-info": "Scheme SPX · 34,580 tuples swept · 7,570 pass the initial bounds",
+  "#funnel": "Initial pool 7,570 Size ≤ 1.00× 7,570 KeyGen ≤ 1.00× 1,210 SigGen ≤ 1.00× 762 SigVer, worst ≤ 1.00× 308 ρ, worst ≤ 1.00× 204",
+  "#winner": "(40, 5, 20, 9, 16) Distance 0.3275 · h′ = 8",
+  "#winner row 0": ["Size (B)","6,656","7,856","0.847×"],
+  "#winner row 1": ["KeyGen (C)","146,175","292,351","0.500×"],
+  "#winner row 2": ["SigGen (C)","761,588","2.22M","0.343×"],
+  "#winner row 3": ["SigVer (C)","1,636","2,193","0.746×"],
+  "#winner row 4": ["SigVer, worst (C)","2,850","3,893","0.732×"],
+  "#winner row 5": ["ρ (C/B)","0.2458","0.2791","0.881×"],
+  "#winner row 6": ["ρ, worst (C/B)","0.4282","0.4955","0.864×"],
+  "#winner row 7": ["ρ ÷ Schnorr","0.124×","0.141×","0.881×"],
+  "#winner row 8": ["ρ ÷ Schnorr, worst","0.216×","0.250×","0.864×"],
+  "#custom-status": "Valid. This is SLH-DSA-128s.",
+  "#custom-result": "(63, 7, 14, 12, 16) Layer height h′ = 9 WOTS chains: 35 Security at q s = 2 ^40 : 128 bits ✓ (191.0 bits against FORS forgery, capped by the 2 ^−128 preimage bound)",
+  "#custom-result row 0": ["Size (B)","7,856","7,856","1.00×"],
+  "#custom-result row 1": ["KeyGen (C)","292,351","292,351","1.00×"],
+  "#custom-result row 2": ["SigGen (C)","2.22M","2.22M","1.00×"],
+  "#custom-result row 3": ["SigVer (C)","2,193","2,193","1.00×"],
+  "#custom-result row 4": ["SigVer, worst (C)","3,893","3,893","1.00×"],
+  "#custom-result row 5": ["ρ (C/B)","0.2791","0.2791","1.00×"],
+  "#custom-result row 6": ["ρ, worst (C/B)","0.4955","0.4955","1.00×"],
+  "#custom-result row 7": ["ρ ÷ Schnorr","0.141×","0.141×","1.00×"],
+  "#custom-result row 8": ["ρ ÷ Schnorr, worst","0.250×","0.250×","1.00×"],
+  "popover #about-w": "The pool always includes w = 2, 4, 16 and 256, whose digits fit whole bytes as SLH-DSA requires. w = 32, 64 and 128 do not, so they are exploratory and extend only the SPX pool.",
+  "popover #about-worst": "Filter and rank on worst-case SigVer and ρ, against the worst case of SLH-DSA-128s ( 3,893 C instead of 2,193 C). WOTS+C verification costs the same for every message, so candidates with WOTS+C keep their values and gain headroom.",
+  "popover #about-weights": "The best candidate has the smallest distance: the weighted root mean square of its five ratios to SLH-DSA-128s, each rescaled to 0–1 across the candidates within the bounds.",
+  "popover #about-pool": "Initial bounds: at least 128-bit security at q s = 2 ^40 , size below 7,856 B, w = {2, 4, 16, 256}. Pool: data.json , generated <date> from commit <id> Security from the FORS and PORS+FP subset-forgery analysis in security.sage . Schnorr reference: a BIP340 verification takes 1.98 C/B (libsecp256k1, one 64-byte signature; bip340-vs-sha256 , built-in value, the live kappa.json did not load). SLH-DSA-128s has ρ = 0.2791 C/B, 0.141× Schnorr (0.250× worst).",
+  "popover #glossary": "Glossary C One SHA-256 compression. Costs count compressions; the PK.seed block is compressed once per key and reused. B Byte. KeyGen, SigGen, SigVer Compressions to generate a key pair, to sign a message and to verify a signature. SigVer is the average unless marked worst. ρ SigVer per signature byte, in C/B. ρ ÷ Schnorr ρ divided by the ρ of a BIP340 Schnorr verification (libsecp256k1, 64-byte signature). SLH-DSA-128s The FIPS 205 parameter set (h, d, k, a, w) = (63, 7, 14, 12, 16). Ratios (×) compare against it. h, d, k, a, w Hypertree height, number of layers, FORS trees, FORS tree height, Winternitz parameter. h′ = h/d is the height of one layer. q s The number of signatures per key that security is computed for: 2 ^40 for the stateless schemes. WOTS, WOTS+C Winternitz one-time signatures. WOTS (as in SLH-DSA) has checksum chains; WOTS+C replaces them with a counter that the signer grinds until the message digits have a fixed sum, so verification always costs the same. XMSS, XMSS-MT, UXMSS Stateful schemes: one balanced Merkle tree (BXMSS in SHRINCS), d layers of such trees, and the unbalanced SHRINCS tree, whose signatures grow by one node per signature. Cached, cold A cached signer keeps tree state between signatures (a BDS state for XMSS, a leaf cache for UXMSS); a cold signer keeps none and rebuilds its trees for every signature.",
   "input #optw-toggle": "off",
   "input #X_size_val": "1.00",
   "input #X_kg_val": "1.00",
@@ -204,29 +224,34 @@
   "input #cust-w": "16"
  },
  "stateless.html#ow=1&c=45,5,10,13,128": {
-  "#initial-info": "Scheme: SPX · 60,515 tuples swept · 17,284 pass the initial bounds (≥ 128-bit security at q s = 2⁴⁰, size < 7,856 B, w = {2, 4, 16, 32, 64, 128, 256}). Data: data.json (generated <date>, commit <id>); security via the FORS / PORS+FP subset-forgery analysis of the report's security.sage . ρ reference: BIP340 Schnorr verify ≈ 1.98 C/B (libsecp256k1, single verify over a 64 B wire signature; bip340-vs-sha256 : built-in 1.98 C/B — live kappa.json unreachable). SLH-DSA-128s baseline: 0.2791 C/B = 0.141× Schnorr (avg), 0.250× (worst).",
-  "#funnel": "Initial pool 17,284 Size ≤ 1.00·std 17,284 KeyGen ≤ 1.00·std 3,459 SigGen ≤ 1.00·std 2,201 SigVer ≤ 1.00·std 308 Comp/Byte ≤ 1.00·std 204",
-  "#winner": "(40, 5, 20, 9, 16) Weighted distance: 0.3328 h' = h/d = 8 per XMSS layer",
-  "#winner row 0": ["Signature size (B)","6,656","7,856","0.847×"],
-  "#winner row 1": ["KeyGen cost","146,175","292,351","0.500×"],
-  "#winner row 2": ["SigGen cost","761,588","2.22M","0.343×"],
-  "#winner row 3": ["SigVer cost (avg)","1,636","2,193","0.746×"],
-  "#winner row 4": ["SigVer cost (worst)","2,850","3,893","0.732×"],
-  "#winner row 5": ["Comp/Byte ρ (avg)","0.2458","0.2791","0.881×"],
-  "#winner row 6": ["Comp/Byte ρ (worst)","0.4282","0.4955","0.864×"],
-  "#winner row 7": ["ρ ÷ Schnorr (avg)","0.1241","0.1410","0.881×"],
-  "#winner row 8": ["ρ ÷ Schnorr (worst)","0.2163","0.2503","0.864×"],
-  "#custom-status": "Valid, with notes: w = 128: lg_w = 7 does not divide 8, so base_2b digits straddle byte boundaries — exploratory, outside strict SLH-DSA compatibility.",
-  "#custom-result": "(45, 5, 10, 13, 128) h' = h / d = 9 (XMSS layer height) len = 21 (WOTS+ chains per signature) Security at q s = 2⁴⁰: 128 bits ✓ (FORS-forgery exponent ≈ 130.2 — capped by the 2 ^−128 preimage bound)",
-  "#custom-result row 0": ["Signature size (B)","4,656","7,856","0.593×"],
-  "#custom-result row 1": ["KeyGen cost","1.38M","292,351","4.720×"],
-  "#custom-result row 2": ["SigGen cost","7.14M","2.22M","3.221×"],
-  "#custom-result row 3": ["SigVer cost (avg)","7,162","2,193","3.266×"],
-  "#custom-result row 4": ["SigVer cost (worst)","12,922","3,893","3.319×"],
-  "#custom-result row 5": ["Comp/Byte ρ (avg)","1.5382","0.2791","5.510×"],
-  "#custom-result row 6": ["Comp/Byte ρ (worst)","2.7753","0.4955","5.601×"],
-  "#custom-result row 7": ["ρ ÷ Schnorr (avg)","0.7769","0.1410","5.510×"],
-  "#custom-result row 8": ["ρ ÷ Schnorr (worst)","1.4017","0.2503","5.601×"],
+  "#initial-info": "Scheme SPX · 60,515 tuples swept · 17,284 pass the initial bounds",
+  "#funnel": "Initial pool 17,284 Size ≤ 1.00× 17,284 KeyGen ≤ 1.00× 3,459 SigGen ≤ 1.00× 2,201 SigVer ≤ 1.00× 308 ρ ≤ 1.00× 204",
+  "#winner": "(40, 5, 20, 9, 16) Distance 0.3328 · h′ = 8",
+  "#winner row 0": ["Size (B)","6,656","7,856","0.847×"],
+  "#winner row 1": ["KeyGen (C)","146,175","292,351","0.500×"],
+  "#winner row 2": ["SigGen (C)","761,588","2.22M","0.343×"],
+  "#winner row 3": ["SigVer (C)","1,636","2,193","0.746×"],
+  "#winner row 4": ["SigVer, worst (C)","2,850","3,893","0.732×"],
+  "#winner row 5": ["ρ (C/B)","0.2458","0.2791","0.881×"],
+  "#winner row 6": ["ρ, worst (C/B)","0.4282","0.4955","0.864×"],
+  "#winner row 7": ["ρ ÷ Schnorr","0.124×","0.141×","0.881×"],
+  "#winner row 8": ["ρ ÷ Schnorr, worst","0.216×","0.250×","0.864×"],
+  "#custom-status": "Valid, with notes: w = 128 is exploratory: its digits do not fit whole bytes, as SLH-DSA requires.",
+  "#custom-result": "(45, 5, 10, 13, 128) Layer height h′ = 9 WOTS chains: 21 Security at q s = 2 ^40 : 128 bits ✓ (130.2 bits against FORS forgery, capped by the 2 ^−128 preimage bound)",
+  "#custom-result row 0": ["Size (B)","4,656","7,856","0.593×"],
+  "#custom-result row 1": ["KeyGen (C)","1.38M","292,351","4.72×"],
+  "#custom-result row 2": ["SigGen (C)","7.14M","2.22M","3.22×"],
+  "#custom-result row 3": ["SigVer (C)","7,162","2,193","3.27×"],
+  "#custom-result row 4": ["SigVer, worst (C)","12,922","3,893","3.32×"],
+  "#custom-result row 5": ["ρ (C/B)","1.5382","0.2791","5.51×"],
+  "#custom-result row 6": ["ρ, worst (C/B)","2.7753","0.4955","5.60×"],
+  "#custom-result row 7": ["ρ ÷ Schnorr","0.777×","0.141×","5.51×"],
+  "#custom-result row 8": ["ρ ÷ Schnorr, worst","1.40×","0.250×","5.60×"],
+  "popover #about-w": "The pool always includes w = 2, 4, 16 and 256, whose digits fit whole bytes as SLH-DSA requires. w = 32, 64 and 128 do not, so they are exploratory and extend only the SPX pool.",
+  "popover #about-worst": "Filter and rank on worst-case SigVer and ρ, against the worst case of SLH-DSA-128s ( 3,893 C instead of 2,193 C). WOTS+C verification costs the same for every message, so candidates with WOTS+C keep their values and gain headroom.",
+  "popover #about-weights": "The best candidate has the smallest distance: the weighted root mean square of its five ratios to SLH-DSA-128s, each rescaled to 0–1 across the candidates within the bounds.",
+  "popover #about-pool": "Initial bounds: at least 128-bit security at q s = 2 ^40 , size below 7,856 B, w = {2, 4, 16, 32, 64, 128, 256}. Pool: data.json , generated <date> from commit <id> Security from the FORS and PORS+FP subset-forgery analysis in security.sage . Schnorr reference: a BIP340 verification takes 1.98 C/B (libsecp256k1, one 64-byte signature; bip340-vs-sha256 , built-in value, the live kappa.json did not load). SLH-DSA-128s has ρ = 0.2791 C/B, 0.141× Schnorr (0.250× worst).",
+  "popover #glossary": "Glossary C One SHA-256 compression. Costs count compressions; the PK.seed block is compressed once per key and reused. B Byte. KeyGen, SigGen, SigVer Compressions to generate a key pair, to sign a message and to verify a signature. SigVer is the average unless marked worst. ρ SigVer per signature byte, in C/B. ρ ÷ Schnorr ρ divided by the ρ of a BIP340 Schnorr verification (libsecp256k1, 64-byte signature). SLH-DSA-128s The FIPS 205 parameter set (h, d, k, a, w) = (63, 7, 14, 12, 16). Ratios (×) compare against it. h, d, k, a, w Hypertree height, number of layers, FORS trees, FORS tree height, Winternitz parameter. h′ = h/d is the height of one layer. q s The number of signatures per key that security is computed for: 2 ^40 for the stateless schemes. WOTS, WOTS+C Winternitz one-time signatures. WOTS (as in SLH-DSA) has checksum chains; WOTS+C replaces them with a counter that the signer grinds until the message digits have a fixed sum, so verification always costs the same. XMSS, XMSS-MT, UXMSS Stateful schemes: one balanced Merkle tree (BXMSS in SHRINCS), d layers of such trees, and the unbalanced SHRINCS tree, whose signatures grow by one node per signature. Cached, cold A cached signer keeps tree state between signatures (a BDS state for XMSS, a leaf cache for UXMSS); a cold signer keeps none and rebuilds its trees for every signature.",
   "input #optw-toggle": "on",
   "input #X_size_val": "1.00",
   "input #X_kg_val": "1.00",
@@ -246,29 +271,34 @@
   "input #cust-w": "128"
  },
  "stateless.html#c=14,7,14,12,16": {
-  "#initial-info": "Scheme: SPX · 34,580 tuples swept · 7,570 pass the initial bounds (≥ 128-bit security at q s = 2⁴⁰, size < 7,856 B, w = {2, 4, 16, 256}). Data: data.json (generated <date>, commit <id>); security via the FORS / PORS+FP subset-forgery analysis of the report's security.sage . ρ reference: BIP340 Schnorr verify ≈ 1.98 C/B (libsecp256k1, single verify over a 64 B wire signature; bip340-vs-sha256 : built-in 1.98 C/B — live kappa.json unreachable). SLH-DSA-128s baseline: 0.2791 C/B = 0.141× Schnorr (avg), 0.250× (worst).",
-  "#funnel": "Initial pool 7,570 Size ≤ 1.00·std 7,570 KeyGen ≤ 1.00·std 1,210 SigGen ≤ 1.00·std 762 SigVer ≤ 1.00·std 308 Comp/Byte ≤ 1.00·std 204",
-  "#winner": "(40, 5, 20, 9, 16) Weighted distance: 0.3328 h' = h/d = 8 per XMSS layer",
-  "#winner row 0": ["Signature size (B)","6,656","7,856","0.847×"],
-  "#winner row 1": ["KeyGen cost","146,175","292,351","0.500×"],
-  "#winner row 2": ["SigGen cost","761,588","2.22M","0.343×"],
-  "#winner row 3": ["SigVer cost (avg)","1,636","2,193","0.746×"],
-  "#winner row 4": ["SigVer cost (worst)","2,850","3,893","0.732×"],
-  "#winner row 5": ["Comp/Byte ρ (avg)","0.2458","0.2791","0.881×"],
-  "#winner row 6": ["Comp/Byte ρ (worst)","0.4282","0.4955","0.864×"],
-  "#winner row 7": ["ρ ÷ Schnorr (avg)","0.1241","0.1410","0.881×"],
-  "#winner row 8": ["ρ ÷ Schnorr (worst)","0.2163","0.2503","0.864×"],
-  "#custom-status": "Valid, with notes: Does not reach 128-bit security: computed security ≈ 0.0 bits at q_s = 2⁴⁰.",
-  "#custom-result": "(14, 7, 14, 12, 16) h' = h / d = 2 (XMSS layer height) len = 35 (WOTS+ chains per signature) Security at q s = 2⁴⁰: 0.0 bits",
-  "#custom-result row 0": ["Signature size (B)","7,072","7,856","0.900×"],
-  "#custom-result row 1": ["KeyGen cost","2,283","292,351","0.008×"],
-  "#custom-result row 2": ["SigGen cost","188,010","2.22M","0.085×"],
-  "#custom-result row 3": ["SigVer cost (avg)","2,144","2,193","0.978×"],
-  "#custom-result row 4": ["SigVer cost (worst)","3,844","3,893","0.987×"],
-  "#custom-result row 5": ["Comp/Byte ρ (avg)","0.3032","0.2791","1.086×"],
-  "#custom-result row 6": ["Comp/Byte ρ (worst)","0.5436","0.4955","1.097×"],
-  "#custom-result row 7": ["ρ ÷ Schnorr (avg)","0.1531","0.1410","1.086×"],
-  "#custom-result row 8": ["ρ ÷ Schnorr (worst)","0.2745","0.2503","1.097×"],
+  "#initial-info": "Scheme SPX · 34,580 tuples swept · 7,570 pass the initial bounds",
+  "#funnel": "Initial pool 7,570 Size ≤ 1.00× 7,570 KeyGen ≤ 1.00× 1,210 SigGen ≤ 1.00× 762 SigVer ≤ 1.00× 308 ρ ≤ 1.00× 204",
+  "#winner": "(40, 5, 20, 9, 16) Distance 0.3328 · h′ = 8",
+  "#winner row 0": ["Size (B)","6,656","7,856","0.847×"],
+  "#winner row 1": ["KeyGen (C)","146,175","292,351","0.500×"],
+  "#winner row 2": ["SigGen (C)","761,588","2.22M","0.343×"],
+  "#winner row 3": ["SigVer (C)","1,636","2,193","0.746×"],
+  "#winner row 4": ["SigVer, worst (C)","2,850","3,893","0.732×"],
+  "#winner row 5": ["ρ (C/B)","0.2458","0.2791","0.881×"],
+  "#winner row 6": ["ρ, worst (C/B)","0.4282","0.4955","0.864×"],
+  "#winner row 7": ["ρ ÷ Schnorr","0.124×","0.141×","0.881×"],
+  "#winner row 8": ["ρ ÷ Schnorr, worst","0.216×","0.250×","0.864×"],
+  "#custom-status": "Valid, with notes: Below 128-bit security: 0.0 bits at q s = 2 ^40 .",
+  "#custom-result": "(14, 7, 14, 12, 16) Layer height h′ = 2 WOTS chains: 35 Security at q s = 2 ^40 : 0.0 bits",
+  "#custom-result row 0": ["Size (B)","7,072","7,856","0.900×"],
+  "#custom-result row 1": ["KeyGen (C)","2,283","292,351","0.00781×"],
+  "#custom-result row 2": ["SigGen (C)","188,010","2.22M","0.0847×"],
+  "#custom-result row 3": ["SigVer (C)","2,144","2,193","0.978×"],
+  "#custom-result row 4": ["SigVer, worst (C)","3,844","3,893","0.987×"],
+  "#custom-result row 5": ["ρ (C/B)","0.3032","0.2791","1.09×"],
+  "#custom-result row 6": ["ρ, worst (C/B)","0.5436","0.4955","1.10×"],
+  "#custom-result row 7": ["ρ ÷ Schnorr","0.153×","0.141×","1.09×"],
+  "#custom-result row 8": ["ρ ÷ Schnorr, worst","0.275×","0.250×","1.10×"],
+  "popover #about-w": "The pool always includes w = 2, 4, 16 and 256, whose digits fit whole bytes as SLH-DSA requires. w = 32, 64 and 128 do not, so they are exploratory and extend only the SPX pool.",
+  "popover #about-worst": "Filter and rank on worst-case SigVer and ρ, against the worst case of SLH-DSA-128s ( 3,893 C instead of 2,193 C). WOTS+C verification costs the same for every message, so candidates with WOTS+C keep their values and gain headroom.",
+  "popover #about-weights": "The best candidate has the smallest distance: the weighted root mean square of its five ratios to SLH-DSA-128s, each rescaled to 0–1 across the candidates within the bounds.",
+  "popover #about-pool": "Initial bounds: at least 128-bit security at q s = 2 ^40 , size below 7,856 B, w = {2, 4, 16, 256}. Pool: data.json , generated <date> from commit <id> Security from the FORS and PORS+FP subset-forgery analysis in security.sage . Schnorr reference: a BIP340 verification takes 1.98 C/B (libsecp256k1, one 64-byte signature; bip340-vs-sha256 , built-in value, the live kappa.json did not load). SLH-DSA-128s has ρ = 0.2791 C/B, 0.141× Schnorr (0.250× worst).",
+  "popover #glossary": "Glossary C One SHA-256 compression. Costs count compressions; the PK.seed block is compressed once per key and reused. B Byte. KeyGen, SigGen, SigVer Compressions to generate a key pair, to sign a message and to verify a signature. SigVer is the average unless marked worst. ρ SigVer per signature byte, in C/B. ρ ÷ Schnorr ρ divided by the ρ of a BIP340 Schnorr verification (libsecp256k1, 64-byte signature). SLH-DSA-128s The FIPS 205 parameter set (h, d, k, a, w) = (63, 7, 14, 12, 16). Ratios (×) compare against it. h, d, k, a, w Hypertree height, number of layers, FORS trees, FORS tree height, Winternitz parameter. h′ = h/d is the height of one layer. q s The number of signatures per key that security is computed for: 2 ^40 for the stateless schemes. WOTS, WOTS+C Winternitz one-time signatures. WOTS (as in SLH-DSA) has checksum chains; WOTS+C replaces them with a counter that the signer grinds until the message digits have a fixed sum, so verification always costs the same. XMSS, XMSS-MT, UXMSS Stateful schemes: one balanced Merkle tree (BXMSS in SHRINCS), d layers of such trees, and the unbalanced SHRINCS tree, whose signatures grow by one node per signature. Cached, cold A cached signer keeps tree state between signatures (a BDS state for XMSS, a leaf cache for UXMSS); a cold signer keeps none and rebuilds its trees for every signature.",
   "input #optw-toggle": "off",
   "input #X_size_val": "1.00",
   "input #X_kg_val": "1.00",
@@ -288,29 +318,34 @@
   "input #cust-w": "16"
  },
  "stateless.html#x=0.74,2,2,0.8,1&w=5,1,1,2,1": {
-  "#initial-info": "Scheme: SPX · 34,580 tuples swept · 7,570 pass the initial bounds (≥ 128-bit security at q s = 2⁴⁰, size < 7,856 B, w = {2, 4, 16, 256}). Data: data.json (generated <date>, commit <id>); security via the FORS / PORS+FP subset-forgery analysis of the report's security.sage . ρ reference: BIP340 Schnorr verify ≈ 1.98 C/B (libsecp256k1, single verify over a 64 B wire signature; bip340-vs-sha256 : built-in 1.98 C/B — live kappa.json unreachable). SLH-DSA-128s baseline: 0.2791 C/B = 0.141× Schnorr (avg), 0.250× (worst).",
-  "#funnel": "Initial pool 7,570 Size ≤ 0.74·std 2,860 KeyGen ≤ 2.00·std 113 SigGen ≤ 2.00·std 78 SigVer ≤ 0.80·std 2 Comp/Byte ≤ 1.00·std 2",
-  "#winner": "(45, 5, 8, 16, 16) Weighted distance: 0.4472 h' = h/d = 9 per XMSS layer",
-  "#winner row 0": ["Signature size (B)","5,712","7,856","0.727×"],
-  "#winner row 1": ["KeyGen cost","292,351","292,351","1.000×"],
-  "#winner row 2": ["SigGen cost","3.03M","2.22M","1.368×"],
-  "#winner row 3": ["SigVer cost (avg)","1,574","2,193","0.718×"],
-  "#winner row 4": ["SigVer cost (worst)","2,788","3,893","0.716×"],
-  "#winner row 5": ["Comp/Byte ρ (avg)","0.2756","0.2791","0.987×"],
-  "#winner row 6": ["Comp/Byte ρ (worst)","0.4881","0.4955","0.985×"],
-  "#winner row 7": ["ρ ÷ Schnorr (avg)","0.1392","0.1410","0.987×"],
-  "#winner row 8": ["ρ ÷ Schnorr (worst)","0.2465","0.2503","0.985×"],
-  "#custom-status": "Valid tuple. (This is the SLH-DSA-128s baseline.)",
-  "#custom-result": "(63, 7, 14, 12, 16) h' = h / d = 9 (XMSS layer height) len = 35 (WOTS+ chains per signature) Security at q s = 2⁴⁰: 128 bits ✓ (FORS-forgery exponent ≈ 191.0 — capped by the 2 ^−128 preimage bound)",
-  "#custom-result row 0": ["Signature size (B)","7,856","7,856","1.000×"],
-  "#custom-result row 1": ["KeyGen cost","292,351","292,351","1.000×"],
-  "#custom-result row 2": ["SigGen cost","2.22M","2.22M","1.000×"],
-  "#custom-result row 3": ["SigVer cost (avg)","2,193","2,193","1.000×"],
-  "#custom-result row 4": ["SigVer cost (worst)","3,893","3,893","1.000×"],
-  "#custom-result row 5": ["Comp/Byte ρ (avg)","0.2791","0.2791","1.000×"],
-  "#custom-result row 6": ["Comp/Byte ρ (worst)","0.4955","0.4955","1.000×"],
-  "#custom-result row 7": ["ρ ÷ Schnorr (avg)","0.1410","0.1410","1.000×"],
-  "#custom-result row 8": ["ρ ÷ Schnorr (worst)","0.2503","0.2503","1.000×"],
+  "#initial-info": "Scheme SPX · 34,580 tuples swept · 7,570 pass the initial bounds",
+  "#funnel": "Initial pool 7,570 Size ≤ 0.74× 2,860 KeyGen ≤ 2.00× 113 SigGen ≤ 2.00× 78 SigVer ≤ 0.80× 2 ρ ≤ 1.00× 2",
+  "#winner": "(45, 5, 8, 16, 16) Distance 0.4472 · h′ = 9",
+  "#winner row 0": ["Size (B)","5,712","7,856","0.727×"],
+  "#winner row 1": ["KeyGen (C)","292,351","292,351","1.00×"],
+  "#winner row 2": ["SigGen (C)","3.03M","2.22M","1.37×"],
+  "#winner row 3": ["SigVer (C)","1,574","2,193","0.718×"],
+  "#winner row 4": ["SigVer, worst (C)","2,788","3,893","0.716×"],
+  "#winner row 5": ["ρ (C/B)","0.2756","0.2791","0.987×"],
+  "#winner row 6": ["ρ, worst (C/B)","0.4881","0.4955","0.985×"],
+  "#winner row 7": ["ρ ÷ Schnorr","0.139×","0.141×","0.987×"],
+  "#winner row 8": ["ρ ÷ Schnorr, worst","0.247×","0.250×","0.985×"],
+  "#custom-status": "Valid. This is SLH-DSA-128s.",
+  "#custom-result": "(63, 7, 14, 12, 16) Layer height h′ = 9 WOTS chains: 35 Security at q s = 2 ^40 : 128 bits ✓ (191.0 bits against FORS forgery, capped by the 2 ^−128 preimage bound)",
+  "#custom-result row 0": ["Size (B)","7,856","7,856","1.00×"],
+  "#custom-result row 1": ["KeyGen (C)","292,351","292,351","1.00×"],
+  "#custom-result row 2": ["SigGen (C)","2.22M","2.22M","1.00×"],
+  "#custom-result row 3": ["SigVer (C)","2,193","2,193","1.00×"],
+  "#custom-result row 4": ["SigVer, worst (C)","3,893","3,893","1.00×"],
+  "#custom-result row 5": ["ρ (C/B)","0.2791","0.2791","1.00×"],
+  "#custom-result row 6": ["ρ, worst (C/B)","0.4955","0.4955","1.00×"],
+  "#custom-result row 7": ["ρ ÷ Schnorr","0.141×","0.141×","1.00×"],
+  "#custom-result row 8": ["ρ ÷ Schnorr, worst","0.250×","0.250×","1.00×"],
+  "popover #about-w": "The pool always includes w = 2, 4, 16 and 256, whose digits fit whole bytes as SLH-DSA requires. w = 32, 64 and 128 do not, so they are exploratory and extend only the SPX pool.",
+  "popover #about-worst": "Filter and rank on worst-case SigVer and ρ, against the worst case of SLH-DSA-128s ( 3,893 C instead of 2,193 C). WOTS+C verification costs the same for every message, so candidates with WOTS+C keep their values and gain headroom.",
+  "popover #about-weights": "The best candidate has the smallest distance: the weighted root mean square of its five ratios to SLH-DSA-128s, each rescaled to 0–1 across the candidates within the bounds.",
+  "popover #about-pool": "Initial bounds: at least 128-bit security at q s = 2 ^40 , size below 7,856 B, w = {2, 4, 16, 256}. Pool: data.json , generated <date> from commit <id> Security from the FORS and PORS+FP subset-forgery analysis in security.sage . Schnorr reference: a BIP340 verification takes 1.98 C/B (libsecp256k1, one 64-byte signature; bip340-vs-sha256 , built-in value, the live kappa.json did not load). SLH-DSA-128s has ρ = 0.2791 C/B, 0.141× Schnorr (0.250× worst).",
+  "popover #glossary": "Glossary C One SHA-256 compression. Costs count compressions; the PK.seed block is compressed once per key and reused. B Byte. KeyGen, SigGen, SigVer Compressions to generate a key pair, to sign a message and to verify a signature. SigVer is the average unless marked worst. ρ SigVer per signature byte, in C/B. ρ ÷ Schnorr ρ divided by the ρ of a BIP340 Schnorr verification (libsecp256k1, 64-byte signature). SLH-DSA-128s The FIPS 205 parameter set (h, d, k, a, w) = (63, 7, 14, 12, 16). Ratios (×) compare against it. h, d, k, a, w Hypertree height, number of layers, FORS trees, FORS tree height, Winternitz parameter. h′ = h/d is the height of one layer. q s The number of signatures per key that security is computed for: 2 ^40 for the stateless schemes. WOTS, WOTS+C Winternitz one-time signatures. WOTS (as in SLH-DSA) has checksum chains; WOTS+C replaces them with a counter that the signer grinds until the message digits have a fixed sum, so verification always costs the same. XMSS, XMSS-MT, UXMSS Stateful schemes: one balanced Merkle tree (BXMSS in SHRINCS), d layers of such trees, and the unbalanced SHRINCS tree, whose signatures grow by one node per signature. Cached, cold A cached signer keeps tree state between signatures (a BDS state for XMSS, a leaf cache for UXMSS); a cold signer keeps none and rebuilds its trees for every signature.",
   "input #optw-toggle": "off",
   "input #X_size_val": "0.74",
   "input #X_kg_val": "2.00",

From 3ae72107aaf234d02f3ed83a1a1e4ce91f26656f Mon Sep 17 00:00:00 2001
From: mjthatch <m.j.thatch@proton.me>
Date: Thu, 12 Nov 2026 15:45:24 +0000
Subject: [PATCH 6/6] formulas.js: remove the formatters the pages no longer
 use

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QabhpThuWQEq1AZRZo24vm
---
 site/formulas.js | 16 ----------------
 1 file changed, 16 deletions(-)

diff --git a/site/formulas.js b/site/formulas.js
index 6627669..aeb0a15 100644
--- a/site/formulas.js
+++ b/site/formulas.js
@@ -384,19 +384,3 @@ async function loadSchnorrRef() {
   }
 }
 
-
-// ---------- Shared formatters ----------
-
-function fmtBytes(n) { return n.toLocaleString() + ' B'; }
-
-function fmtCompressions(n) {
-  if (!isFinite(n)) return '—';
-  if (n >= 1e15) return n.toExponential(2);
-  if (n >= 1e12) return (n / 1e12).toFixed(2) + 'T';
-  if (n >= 1e9)  return (n / 1e9).toFixed(2) + 'G';
-  if (n >= 1e6)  return (n / 1e6).toFixed(2) + 'M';
-  if (n >= 1e3)  return (n / 1e3).toFixed(1) + 'K';
-  return Math.round(n).toLocaleString();
-}
-
-function fmtCpb(n) { return n.toFixed(3); }