Struct SsaPartBuilder 

pub struct SsaPartBuilder<S: PixSpec> {
    commitment: SsaPartCommitment<S>,
    min_shares: usize,
    shares: Vec<DefaultShare<IdentifierPrimeField<PixScalar<S>>, IdentifierPrimeField<PixScalar<S>>>>,
    reconstructed: Option<PixScalar<S>>,
    failed: bool,
}

Collects shares of a single polynomial and reconstructs its constant term.

Where verification happens

Nothing is checked per share beyond what interpolation itself requires (a non-zero, distinct x-coordinate and a decodable y). The one cryptographic check is against SsaPartCommitment, run once, on the reconstructed constant term. See that type for why this is sufficient here and what it costs — briefly: PIX has a single shareholder, so “the recovered a₀ is the committed one” is the whole property, and it is exact.

Fields

commitment: SsaPartCommitment<S>

min_shares: usize

Shares needed to interpolate, i.e. the negotiated polynomial threshold.

Comes from SsaCommitmentBuilder::poly_threshold, never from the commitment: there is only one commitment per polynomial now, so its size says nothing about the degree.

shares: Vec<DefaultShare<IdentifierPrimeField<PixScalar<S>>, IdentifierPrimeField<PixScalar<S>>>>

reconstructed: Option<PixScalar<S>>

failed: bool

Set when the part could not be reconstructed — either the interpolation itself failed, or the value it produced failed to open Self::commitment.

The failure is reported exactly once; every later share for this polynomial is absorbed silently. There is nothing to be gained from re-running the interpolation — the share set cannot be repaired without knowing which share is bad, and the cycle is already lost because SsaBuilder needs every polynomial. Both failure paths must therefore set this and release the share buffer, or the “exactly once” only holds for one of them.

Implementations

impl<S: PixSpec> SsaPartBuilder<S>

pub fn new(commitment: SsaPartCommitment<S>, min_shares: usize) -> Self

pub(crate) fn spi(&self) -> SsaPolynomialId<S::Pseudonym>

SsaPolynomialId of the polynomial this builder reconstructs.

Remains valid after the collected shares have been released.

pub(crate) fn min_shares(&self) -> usize

Shares needed to interpolate this polynomial — the negotiated threshold.

fn release_verification_state(&mut self)

Frees the collected shares, which are only needed until the part is reconstructed.

After that point they cannot be read again — the early returns in add_share short-circuit every later call before it touches them.

At production dimensions this buffer is threshold × size_of::<CompletedShare>() held for every one of the polys polynomials until the cycle is retired. Since the Entry emits shares polynomial-major, releasing here means only the polynomials still in flight hold any.

Assigns a fresh empty Vec rather than clear(), so the backing allocation is actually returned instead of being retained at capacity.

pub fn add_share( &mut self, msg: PixScalar<S>, share: PartialSsaShare<S>, ) -> Result<AddShareOutcome<S>, S::Pseudonym>