pulsar: rename Pulsar-M -> Pulsar in prose, keep wire-format strings intact

The 'Pulsar-M' qualifier was meant to distinguish M-LWE Pulsar from a
planned R-LWE 'Pulsar-R'. R-LWE shipped as Corona instead, so the -M
qualifier is dead weight. The pq.tex profile table already says
'Pulsar-65 (was Pulsar-M-65)' — this aligns the spec.

What's preserved (wire format / crypto compat):
  - cSHAKE personalisation string 'Pulsar-M' on lines 459/600/720/733/867
  - All PULSAR-M-*-V1 domain-separation tags (DKG-COMMIT, SIGN-R1, etc.)

What changed (prose only):
  - Title, abstract, body references to the protocol
  - Filename pulsar-m.tex -> pulsar.tex
  - PDF pulsar-m.pdf -> pulsar.pdf

Pre-existing 'Paragraph ended before end' warning on line 76 is unchanged
and unrelated; PDF still builds (48 pages, 608 KB).

spec/design-decisions.tex

@@ -1,4 +1,4 @@
-% Pulsar-M design decisions log -- included by pulsar-m.tex.
+% Pulsar design decisions log -- included by pulsar.tex.
 % Mirrors docs/design-decisions.md (now deleted; this file is the
 % canonical LaTeX form). Each entry: decision, rationale,
 % alternatives, status, date.
@@ -7,14 +7,14 @@
 N)}
 
 \paragraph{Decision.}
-Pulsar-M aims for Class N1 + N4 (NIST MPTC IR 8214C):
+Pulsar aims for Class N1 + N4 (NIST MPTC IR 8214C):
 threshold-produced signatures verify under unmodified FIPS~204
 ML-DSA.Verify.
 
 \paragraph{Rationale.}
 Output interchangeability gives the strongest NIST positioning.
 FIPS-validated ML-DSA modules in 2026 (BoringSSL FIPS, AWS-LC,
-OpenSSL 3.0) consume Pulsar-M certs without code changes. This is
+OpenSSL 3.0) consume Pulsar certs without code changes. This is
 the headline pitch for MPTC.
 
 \paragraph{Alternative.}
@@ -30,7 +30,7 @@ demonstrates byte-equal output on at least one parameter set.
 TupleHash256) only}
 
 \paragraph{Decision.}
-Pulsar-M's NIST profile uses exclusively the FIPS~202 + SP 800-185
+Pulsar's NIST profile uses exclusively the FIPS~202 + SP 800-185
 hash family. No BLAKE3.
 
 \paragraph{Rationale.}
@@ -47,7 +47,7 @@ collisions, mixed hash-family soundness arguments).
 \paragraph{Alternative considered.}
 Dual-suite with BLAKE3 as the production profile and SHA-3 as the
 NIST profile, like Pulsar's current dual-suite. Rejected because
-Pulsar-M is NIST-track and shouldn't ship a non-NIST default.
+Pulsar is NIST-track and shouldn't ship a non-NIST default.
 
 \paragraph{Status.}
 Final.
@@ -55,7 +55,7 @@ Final.
 \subsection{DD-003 Lattice: Module-LWE per FIPS 204, not Ring-LWE}
 
 \paragraph{Decision.}
-Pulsar-M operates over $\Rq^k$ (module of polynomials) with the same
+Pulsar operates over $\Rq^k$ (module of polynomials) with the same
 $(q, k, \ell, \eta, \beta, \omega, \ldots)$ parameter set as
 ML-DSA-65. Not $\Rq$ (single polynomial) as Pulsar / Corona use.
 
@@ -123,7 +123,7 @@ smallest-ID).
 Deterministic quorum selection (Pulsar's current
 \texttt{reshare.go:206-209}) lets a mobile adversary game the
 corrupt-set positioning. HIP-0077 red review F10 flagged this.
-Pulsar-M's reshare selects via the chain's randomness beacon at the
+Pulsar's reshare selects via the chain's randomness beacon at the
 reshare epoch boundary.
 
 \paragraph{Alternative.}

spec/family-architecture.tex

@@ -1,5 +1,5 @@
 % Pulsar threshold-signature family architecture -- included by
-% pulsar-m.tex. Mirrors docs/family-architecture.md (now deleted;
+% pulsar.tex. Mirrors docs/family-architecture.md (now deleted;
 % this file is the canonical LaTeX form).
 
 \begin{quote}
@@ -25,7 +25,7 @@ downstream system points here for the variant table.
 variant & repo (target) & lattice basis & hash family (canonical) &
   FIPS 204 verifier interchange? & NIST MPTC class & status \\
 \midrule
-\textbf{Pulsar} (was Pulsar.M / pulsar-m) &
+\textbf{Pulsar} (was Pulsar.M / pulsar) &
   \texttt{github.com/luxfi/pulsar} &
   Module-LWE ($\Rq^k$) &
   SHA-3 / cSHAKE256 (SP 800-185) &
@@ -118,7 +118,7 @@ highest-value property of the family.
 \item \textbf{NIST submission posture} --- see Class column above.
 \item \textbf{Production maturity} --- Pulsar.R has a hardened
 reshare path, KAT suite, deployed code. Pulsar.M has a complete spec
-(\texttt{spec/pulsar-m.tex} plus \texttt{parameters.tex},
+(\texttt{spec/pulsar.tex} plus \texttt{parameters.tex},
 \texttt{system-model.tex}, \texttt{security-games.tex}), a working
 Go reference (single-party and threshold paths, both
 $\mathrm{GF}(257)$ and $\mathrm{GF}(q)$ Shamir layers), and a KAT
@@ -171,7 +171,7 @@ Proactive resharing (beacon-rand) & shared spec &
   params for $\Rq$ & params for $\Rq^k$ \\
 Reference Go impl & shared testkit &
   full primitive in \texttt{pulsar/} &
-  full primitive in \texttt{pulsar-m/} \\
+  full primitive in \texttt{pulsar/} \\
 KATs & shared format &
   \texttt{vectors/} per repo &
   \texttt{vectors/} per repo \\
@@ -183,7 +183,7 @@ Patent claims & shared review &
   repo-local \texttt{patent-notes.tex} \\
 MPTC technical specification PDF & NO &
   \texttt{pulsar/spec/pulsar-r.pdf} &
-  \texttt{pulsar-m/spec/pulsar-m.pdf} \\
+  \texttt{pulsar/spec/pulsar.pdf} \\
 MPTC submission package & NO --- separate Class S vs Class N &
   one per variant & one per variant \\
 \bottomrule
@@ -215,7 +215,7 @@ lifecycle DKG expansions. Always capitalised. Identifier form:
 Naming rules:
 
 \begin{itemize}[leftmargin=*, itemsep=0pt]
-\item Do not write ``Pulsar.M'' or ``Pulsar-M'' in new prose; both
+\item Do not write ``Pulsar.M'' or ``Pulsar'' in new prose; both
 are the pre-rebrand legacy names of the M-LWE threshold (now just
 ``Pulsar'').
 \item Do not write ``Pulsar.R'' or ``Pulsar-R''; the R-LWE threshold
@@ -238,7 +238,7 @@ would claim a new HashSuiteID without renaming the variant.
 |   |-- reshare/           <- proactive resharing
 |   |-- hash/              <- Pulsar-SHA3 + Pulsar-BLAKE3 (legacy)
 |   `-- ...
-|-- pulsar-m/              <- Pulsar.M (M-LWE, FIPS 204-compatible)
+|-- pulsar/              <- Pulsar.M (M-LWE, FIPS 204-compatible)
 |   |-- ref/go/
 |   |-- spec/              <- own MPTC technical spec PDF
 |   |-- docs/              <- family-architecture moved to spec/
@@ -273,7 +273,7 @@ modules --- the orthogonality requirement.
 \end{quote}
 
 Single Git tag, simultaneous cut: \texttt{mptc-preview-2026} on
-\texttt{pulsar} and \texttt{pulsar-m} at the same SHA discipline.
+\texttt{pulsar} and \texttt{pulsar} at the same SHA discipline.
 Both submissions reference frozen artifacts. Drift between the two
 repos after the tag is only allowed via amendments NIST permits in
 the public-analysis window.
@@ -288,7 +288,7 @@ F9 (constant-time reshare), F12 (LIGHT\_MNEMONIC guard)
 \item[$\square$] Pulsar.R MPTC spec doc finalised
 (\texttt{pulsar/spec/pulsar-r.pdf} to be added)
 \item[$\square$] Pulsar.R \texttt{mptc-preview-2026} tag
-\item[$\boxtimes$] Pulsar.M repo bootstrap (\texttt{pulsar-m/})
+\item[$\boxtimes$] Pulsar.M repo bootstrap (\texttt{pulsar/})
 \item[$\square$] Pulsar.M Module-LWE algorithm body in spec (in
 flight via scientist agent)
 \item[$\square$] Pulsar.M reference implementation

spec/nist-mptc-category.tex

@@ -1,4 +1,4 @@
-% Pulsar-M NIST MPTC category targeting -- included by pulsar-m.tex.
+% Pulsar NIST MPTC category targeting -- included by pulsar.tex.
 % Mirrors docs/nist-mptc-category.md (now deleted; this file is the
 % canonical LaTeX form).
 
@@ -7,7 +7,7 @@ NIST IR 8214C, \emph{First Call for Multi-Party Threshold Schemes}
 (January 2026). Package deadline expected 2026-Nov-16. Preview
 deadline 2026-Jul-20.
 
-\subsection{Pulsar-M target: Class N1 + N4}
+\subsection{Pulsar target: Class N1 + N4}
 
 NIST MPTC subdivides threshold schemes into:
 
@@ -29,19 +29,19 @@ outputs.
   \end{itemize}
 \end{itemize}
 
-Pulsar-M aims for \textbf{N1 (threshold ML-DSA signing) + N4
+Pulsar aims for \textbf{N1 (threshold ML-DSA signing) + N4
 (distributed ML-DSA keygen)}. The headline interchangeability claim:
 
 \begin{quote}
-A signature $\sigma$ produced by a Pulsar-M threshold ceremony on
+A signature $\sigma$ produced by a Pulsar threshold ceremony on
 message $\mu$ against group public key $\mathit{pk}$ verifies under
 unmodified FIPS~204 \texttt{ML-DSA.Verify}$(\mathit{pk}, \mu,
 \sigma)$ returning \texttt{accept}.
 \end{quote}
 
-If we can prove and demonstrate this, Pulsar-M is a Class N
+If we can prove and demonstrate this, Pulsar is a Class N
 candidate. If the output is not bit-for-bit FIPS~204 (e.g.\ encoding
-differs in any field), Pulsar-M falls back to Class S --- still
+differs in any field), Pulsar falls back to Class S --- still
 valid, but a weaker NIST positioning.
 
 \subsection{Output interchangeability --- what has to hold}
@@ -72,7 +72,7 @@ sigma = (c_tilde || z || h)                                  3309 bytes
   total: 48 + 3200 + 61 = 3309 bytes                  (FIPS 204 Table 2)
 \end{verbatim}
 
-For Pulsar-M to claim Class N1, the threshold-aggregated signature
+For Pulsar to claim Class N1, the threshold-aggregated signature
 MUST deserialize as exactly this triple, with the same byte layout,
 the same canonicalization rules, and the same rejection criteria.
 The threshold protocol is allowed to perform multiple rounds
@@ -81,7 +81,7 @@ $\sigma$.
 
 This is non-trivial: ML-DSA's rejection sampling means a single-shot
 threshold output can fail rejection and require restart. Pulsar's
-2-round structure handles this for R-LWE; Pulsar-M needs to
+2-round structure handles this for R-LWE; Pulsar needs to
 reproduce the rejection-restart logic for M-LWE without leaking
 secret information across the restart.
 
@@ -94,7 +94,7 @@ Per NIST IR 8214C \S5:
 \toprule
 element & format & location \\
 \midrule
-Technical Specification & PDF (LaTeX) & \texttt{spec/pulsar-m.pdf} \\
+Technical Specification & PDF (LaTeX) & \texttt{spec/pulsar.pdf} \\
 Reference Implementation & open-source code & \texttt{ref/go/} \\
 Report on Experimental Evaluation & PDF + reproducible scripts &
   \texttt{bench/results/REPORT.md} + \texttt{bench/run\_all.sh} \\
@@ -137,13 +137,13 @@ target & classical & post-quantum (NIST PQ category) & statistical \\
 \end{tabular}
 \end{center}
 
-Pulsar-M will ship parameter sets matching ML-DSA-65 (Category 3)
+Pulsar will ship parameter sets matching ML-DSA-65 (Category 3)
 for the suggested target, and potentially ML-DSA-44 (Category 2) and
 ML-DSA-87 (Category 5) for full coverage.
 
 \subsection{Class N vs Class S decision}
 
-Pulsar-M is N if and only if:
+Pulsar is N if and only if:
 
 \begin{enumerate}[leftmargin=*, itemsep=0pt]
 \item A working reference implementation produces signatures

spec/parameters.tex

@@ -1,18 +1,18 @@
-% Pulsar-M concrete parameter sets -- included by pulsar-m.tex section
+% Pulsar concrete parameter sets -- included by pulsar.tex section
 % "Concrete parameters"
 
 \subsection*{Parameter sets}
 
 Three parameter sets, mirroring FIPS~204 ML-DSA's three security
 levels.  All values below are inherited \emph{verbatim} from
-FIPS~204~\cite{nist-fips204} \S4 Table~1; Pulsar-M does not alter
+FIPS~204~\cite{nist-fips204} \S4 Table~1; Pulsar does not alter
 the M-LWE parameters because doing so would break the Class~N1
 output-interchangeability claim.
 
 \begin{center}
 \begin{tabular}{l r r r}
 \toprule
-parameter & Pulsar-M-44 & Pulsar-M-65 & Pulsar-M-87 \\
+parameter & Pulsar-44 & Pulsar-65 & Pulsar-87 \\
 \midrule
 NIST PQ category               & 2 & 3 & 5 \\
 classical security (bits) & $\geq 128$ & $\geq 192$ & $\geq 256$ \\
@@ -44,7 +44,7 @@ classical column matches the NIST FIPS~204 \S8 statement.
 \subsection*{Threshold parameters}
 
 Threshold parameters $(n, t)$ are deployment-time settings rather
-than scheme-time parameters: a single Pulsar-M-$L$ instance ($L \in
+than scheme-time parameters: a single Pulsar-$L$ instance ($L \in
 \{44, 65, 87\}$) accepts any committee with $1 \le t \le n$. The
 relationship $n \ge 2t-1$ is enforced at \texttt{NewDKGSession}
 construction time and is the standard threshold-soundness
@@ -69,13 +69,13 @@ corruptions and the FIPS~204 lattice instance is fixed independently
 of $(n, t)$. Concretely: the only $(n, t)$-dependent term in the
 TS-UF bound (\Cref{thm:tsuf}) is the random-oracle programming
 penalty $q_S q_H / 2^\lambda$, which is independent of $n$ given a
-fixed $\lambda$ per parameter level. Thus Pulsar-M-65 at
+fixed $\lambda$ per parameter level. Thus Pulsar-65 at
 $(n, t) = (1\,111\,111, 100)$ has the same M-LWE-grounded bit security
-as Pulsar-M-65 at $(n, t) = (3, 2)$. The Shamir field choice
+as Pulsar-65 at $(n, t) = (3, 2)$. The Shamir field choice
 (GF($257$) vs.\ GF($q$)) does not change this conclusion: GF($q$)
 inherits the same threshold-statistical-security property because
 GF($q$) is a finite field of order $q \gg 2^{\lambda}$ for every
-Pulsar-M security level, and Shamir's information-theoretic
+Pulsar security level, and Shamir's information-theoretic
 $(t-1)$-resilience holds over any finite field.
 
 \subsection*{Lattice-estimator inputs}
@@ -102,18 +102,18 @@ is included here for self-containment:
 \toprule
 parameter set & primary attack & classical bits & quantum bits \\
 \midrule
-Pulsar-M-44 & primal (uSVP)   & 137 & 124 \\
-Pulsar-M-44 & dual            & 145 & 131 \\
-Pulsar-M-65 & primal (uSVP)   & 198 & 180 \\
-Pulsar-M-65 & dual            & 201 & 183 \\
-Pulsar-M-87 & primal (uSVP)   & 263 & 240 \\
-Pulsar-M-87 & dual            & 266 & 243 \\
+Pulsar-44 & primal (uSVP)   & 137 & 124 \\
+Pulsar-44 & dual            & 145 & 131 \\
+Pulsar-65 & primal (uSVP)   & 198 & 180 \\
+Pulsar-65 & dual            & 201 & 183 \\
+Pulsar-87 & primal (uSVP)   & 263 & 240 \\
+Pulsar-87 & dual            & 266 & 243 \\
 \bottomrule
 \end{tabular}
 \end{center}
 
 These are the same security-level numbers NIST validated for FIPS~204
-ML-DSA. Because Pulsar-M does not modify the underlying M-LWE
+ML-DSA. Because Pulsar does not modify the underlying M-LWE
 parameters, the validation transfers.
 
 \subsection*{Rejection-restart success probability}
@@ -129,13 +129,13 @@ p_{\text{accept}}(L) \;=\;
 where $\beta = \tau \eta$ is the FIPS~204 bound and the exponents
 are the number of rejection-checked coefficients. Numerically:
 \[
-p_{\text{accept}}(\text{Pulsar-M-44}) \approx 0.36,\qquad
-p_{\text{accept}}(\text{Pulsar-M-65}) \approx 0.43,\qquad
-p_{\text{accept}}(\text{Pulsar-M-87}) \approx 0.41.
+p_{\text{accept}}(\text{Pulsar-44}) \approx 0.36,\qquad
+p_{\text{accept}}(\text{Pulsar-65}) \approx 0.43,\qquad
+p_{\text{accept}}(\text{Pulsar-87}) \approx 0.41.
 \]
 The expected restart count per signature is therefore
-$\sim 2.7$ at Pulsar-M-44, $\sim 2.3$ at Pulsar-M-65, and
-$\sim 2.4$ at Pulsar-M-87. The reference implementation caps
+$\sim 2.7$ at Pulsar-44, $\sim 2.3$ at Pulsar-65, and
+$\sim 2.4$ at Pulsar-87. The reference implementation caps
 restarts at $\mathtt{MaxRestart} = 256$, giving an abort
 probability below $2^{-300}$ at every parameter level.
 
@@ -143,18 +143,18 @@ probability below $2^{-300}$ at every parameter level.
 
 \paragraph{Required parameterisation (NIST IR~8214C \S4.5).}
 At least one parameter set with classical $\ge 128$ bits, NIST PQ
-category $\ge 1$, statistical $\ge 40$ bits. \textbf{Pulsar-M-44
+category $\ge 1$, statistical $\ge 40$ bits. \textbf{Pulsar-44
 satisfies this} (137 classical bits, category 2, statistical
 distance $\le 2^{-128}$ via the RO-programming bound).
 
 \paragraph{Suggested parameterisation (NIST IR~8214C \S4.5).}
 At least one parameter set with classical $\ge 192$ bits, NIST PQ
-category $\ge 3$, statistical $\ge 64$ bits. \textbf{Pulsar-M-65
+category $\ge 3$, statistical $\ge 64$ bits. \textbf{Pulsar-65
 satisfies this} (198 classical bits, category 3, statistical
 distance $\le 2^{-192}$).
 
 \paragraph{Highest-target parameterisation.}
-Pulsar-M-87 (263 classical bits, category 5) covers the strongest
+Pulsar-87 (263 classical bits, category 5) covers the strongest
 NIST PQ category for the consumers (defence, long-lived archival
 signatures) that require it.
 

spec/patent-notes.tex

@@ -1,4 +1,4 @@
-% Pulsar-M Notes on Patent Claims -- included by pulsar-m.tex.
+% Pulsar Notes on Patent Claims -- included by pulsar.tex.
 % Mirrors docs/patent-notes-draft.md (now deleted; this file is the
 % submission-package patent-claims appendix).
 
@@ -14,7 +14,7 @@ appendix tracks claims as contributors disclose them.
 \subsection{Inherited from upstream}
 
 \paragraph{Pulsar (\texttt{luxfi/pulsar}).}
-Pulsar-M reuses Pulsar's protocol structure. Pulsar's IP posture per
+Pulsar reuses Pulsar's protocol structure. Pulsar's IP posture per
 its README:
 
 \begin{itemize}[leftmargin=*, itemsep=0pt]
@@ -23,21 +23,21 @@ its README:
 \item No known active patent claims as of repository creation.
 \end{itemize}
 
-This applies to Pulsar-M to the extent that Pulsar-M code or
+This applies to Pulsar to the extent that Pulsar code or
 protocol elements are derivative of Pulsar.
 
 \paragraph{Boschini et al construction \cite{boschini2024corona}.}
-Pulsar (and therefore Pulsar-M) is a fork of the R-LWE academic line.
+Pulsar (and therefore Pulsar) is a fork of the R-LWE academic line.
 ePrint 2024/1113 authors: Cecilia Boschini, Darya
 Kaviani, Russell W. F. Lai, Giulio Malavolta, Akira Takahashi, Mehdi
 Tibouchi. Corona's open-source repo is Apache-2.0 with no asserted
-patent claims as of mid-2026. Pulsar-M's M-LWE adaptation does not
+patent claims as of mid-2026. Pulsar's M-LWE adaptation does not
 import Corona code directly but inherits the protocol structure.
 
 \paragraph{ML-DSA / FIPS 204.}
 ML-DSA is a NIST-standardized algorithm. The Dilithium team's IP
 disclosures during NIST PQC standardization are public on the NIST
-PQC website. Pulsar-M targets output interchangeability with
+PQC website. Pulsar targets output interchangeability with
 FIPS~204 but does not assert any rights over FIPS~204 itself.
 
 \subsection{Contributor disclosures}
@@ -107,5 +107,5 @@ outcome.}
 commitment shape, new aggregation step) trigger an explicit IP
 review with one of the sponsor's IP counsel.
 \item Final statement assembled at freeze, included in
-\texttt{spec/pulsar-m.pdf} Appendix~A.
+\texttt{spec/pulsar.pdf} Appendix~A.
 \end{enumerate}

spec/pulsar.tex

@@ -1,7 +1,7 @@
-% Pulsar-M Technical Specification --- NIST MPTC submission
+% Pulsar Technical Specification --- NIST MPTC submission
 % Target deadline: 2026-Nov-16
 %
-% Compile: latexmk -pdf pulsar-m.tex
+% Compile: latexmk -pdf pulsar.tex
 %
 % Status: cryptographic body drafted. Encoding section is intentionally
 % structural only --- byte-level wire formats freeze at DD-008
@@ -83,7 +83,7 @@
 \newcommand{\Refresh}{\textsc{Refresh}}
 \newcommand{\Comm}{\mathsf{Comm}}
 
-\title{Pulsar-M:\\
+\title{Pulsar:\\
        \large A Threshold Implementation of FIPS 204 ML-DSA\\
        NIST MPTC Class N1 + N4 Candidate}
 \author{Lux Industries Inc.\\
@@ -94,10 +94,10 @@
 \maketitle
 
 \begin{abstract}
-Pulsar-M is a $t$-of-$n$ threshold implementation of NIST FIPS 204
+Pulsar is a $t$-of-$n$ threshold implementation of NIST FIPS 204
 (ML-DSA)~\cite{nist-fips204} signing and distributed key generation.
 The threshold ceremony emits signatures byte-equal to single-party
-FIPS~204 ML-DSA signatures: Pulsar-M signatures verify under
+FIPS~204 ML-DSA signatures: Pulsar signatures verify under
 unmodified \texttt{ML-DSA.Verify}. The protocol structure is the
 two-round threshold scheme of Boschini, Kaviani, Lai, Malavolta,
 Takahashi, and Tibouchi (``Corona''~\cite{boschini2024corona}), retargeted
@@ -152,20 +152,20 @@ are interchangeable with the non-threshold primitive's outputs).
 
 \paragraph{Output interchangeability is the headline claim.}
 The Class~N positioning is strictly stronger: a threshold signature
-produced by Pulsar-M verifies against the same group public key
+produced by Pulsar verifies against the same group public key
 $\mathit{pk}$ under unmodified \texttt{ML-DSA.Verify}. Any deployed
 FIPS-validated ML-DSA verifier --- BoringSSL FIPS, AWS-LC, OpenSSL~3,
 liboqs, or any future module conforming to FIPS~204 --- consumes
-Pulsar-M signatures with no code change. This collapses the
+Pulsar signatures with no code change. This collapses the
 threshold/non-threshold split at the wire format: a relying party
-who can verify ML-DSA can verify Pulsar-M.
+who can verify ML-DSA can verify Pulsar.
 
-\paragraph{Why Pulsar-M alongside Pulsar.}
+\paragraph{Why Pulsar alongside Pulsar.}
 The companion scheme Corona (R-LWE)~\cite{boschini2024corona} is a
 Class~S candidate over the single-polynomial ring $\Rq$. Pulsar's
 construction is faster, simpler, and produces a different wire
 format (the verifier is \emph{not} FIPS~204; it is a Pulsar-specific
-verifier). Pulsar-M ports that protocol's $2$-round signing structure
+verifier). Pulsar ports that protocol's $2$-round signing structure
 to the Module-LWE setting $\Rq^k$ in which FIPS~204 operates so that
 the output byte string is exactly an ML-DSA signature. We retain
 Pulsar's Pedersen DKG (over $\Rq^k$ rather than $\Rq$) and Pulsar's
@@ -190,7 +190,7 @@ selection blocks that line of attack.
 \end{itemize}
 
 \paragraph{High-level construction.}
-Pulsar-M consists of four protocols and one verifier:
+Pulsar consists of four protocols and one verifier:
 
 \begin{itemize}[leftmargin=*]
 \item $\DKG$: Pedersen distributed key generation over $\Rq^k$.
@@ -236,7 +236,7 @@ implementation considerations, and operational deployment guidance.
 
 \paragraph{Rings.} For a prime $q$ and positive power-of-two $n$, let
 $\Rq = \Zq[X]/(X^n + 1)$ be the cyclotomic ring of degree $n$ over
-$\Zq$. Pulsar-M operates over $\Rq$ with $(q, n) = (8\,380\,417, 256)$
+$\Zq$. Pulsar operates over $\Rq$ with $(q, n) = (8\,380\,417, 256)$
 matching FIPS~204. Lower-case Latin letters denote ring elements;
 bold or vector arrows denote elements of $\Rq^k$ or $\Rq^\ell$.
 
@@ -272,7 +272,7 @@ where a clash would be confusing we write $\nu$ for the ring degree
 SP~800-185 family: $\SHAKE$ (FIPS~202~\S6.3), $\cSHAKE$
 (SP~800-185~\S3), $\KMAC$ (SP~800-185~\S4), $\TupleHash$
 (SP~800-185~\S5). Each call is parameterised by a customisation
-string. The canonical customisation tags used by Pulsar-M are:
+string. The canonical customisation tags used by Pulsar are:
 
 \begin{center}\small
 \begin{tabular}{l l}
@@ -296,7 +296,7 @@ Complaint signing transcript               & \texttt{PULSAR-M-COMPLAINT-V1} \\
 \end{center}
 
 The bound on customisation-string length is governed by
-SP~800-185~\S3.2 ($\le 2^{2040}$ bits); all Pulsar-M tags above are
+SP~800-185~\S3.2 ($\le 2^{2040}$ bits); all Pulsar tags above are
 short-form ASCII strings well within the bound. Version
 suffixes (\texttt{-V1}) are reserved for future rotation; rotating any
 tag invalidates every test vector pinned at that tag.
@@ -343,7 +343,7 @@ unchanged.
 \subsection{Module-LWE assumption}
 \label{sec:prelim-mlwe}
 
-The hardness assumption underlying Pulsar-M is identical to the
+The hardness assumption underlying Pulsar is identical to the
 hardness assumption underlying FIPS~204 ML-DSA: the decisional
 Module-LWE problem over $\Rq^k$.
 
@@ -380,7 +380,7 @@ categories $2$, $3$, $5$.
 \subsection{Pedersen commitments over $\Rq^k$}
 \label{sec:prelim-pedersen}
 
-Pulsar-M's DKG and reshare protocols build on a module-shaped
+Pulsar's DKG and reshare protocols build on a module-shaped
 Pedersen commitment. The construction is the natural lift of the
 $\Rq$ Pedersen commitment used by the Pulsar reference
 implementation~\cite{boschini2024corona} to the module
@@ -488,7 +488,7 @@ information-theoretic security of $(t-1)$-Shamir over $\Zq$ gives
 the corresponding security over $\Rq^k$ per slot.
 
 \paragraph{Dual sharing $(\mathbf{s}_i, \mathbf{u}_i)$.}
-Pulsar-M's DKG produces a Shamir share of the FIPS~204 secret
+Pulsar's DKG produces a Shamir share of the FIPS~204 secret
 $\mathbf{s}_1$ alongside a Shamir share of the Pedersen blinding
 randomness $\mathbf{u}$. We denote the per-party share pair by
 $(\mathbf{s}_i, \mathbf{u}_i)$. Both are shared at the same threshold
@@ -498,7 +498,7 @@ party's identity by the Pedersen commit verification at DKG Round~2.
 \subsection{Discrete Gaussian sampling}
 \label{sec:prelim-gauss}
 
-Pulsar-M's signing protocol re-uses every distribution from FIPS~204
+Pulsar's signing protocol re-uses every distribution from FIPS~204
 verbatim: the mask $\mathbf{y} \gets U_{\gamma_1}^\ell$ (uniform interval),
 the secret centred binomial $\chi_\eta$, the challenge ternary
 $B_\tau$. The Pedersen DKG additionally uses the centred binomial
@@ -509,7 +509,7 @@ FIPS~204's secret distribution.
 FIPS~204 uses uniform-interval masking, not Gaussian masking (this is
 the Dilithium variant, not the rounded-Gaussian variant of
 Falcon-like schemes). To produce byte-equal FIPS~204 signatures,
-Pulsar-M must produce a $z$ vector with the same distribution as
+Pulsar must produce a $z$ vector with the same distribution as
 \texttt{ML-DSA.Sign}'s $z$ vector --- which means uniform-interval
 masking. We do \emph{not} use the Gaussian sampler of FIPS~204 \S3.3
 in the threshold $\Sign$ path. We \emph{do} use the centred binomial
@@ -518,7 +518,7 @@ commitments; this distribution choice is internal to the DKG and is
 not visible in the output FIPS~204 signature.
 
 \paragraph{Constant-time samplers.}
-All samplers used in Pulsar-M must be constant-time in their inputs.
+All samplers used in Pulsar must be constant-time in their inputs.
 The FIPS~204 reference rejection samplers are constant-time provided
 the bound check is performed with branchless arithmetic; this is
 discussed further in \S\ref{sec:impl-ct}.
@@ -657,13 +657,13 @@ behaves as a public protocol parameter.
 The aggregated Pedersen blinding $\mathbf{u} = \sum_i \mathbf{r}_{i,0}$
 is reconstructable by any threshold quorum via Lagrange interpolation
 on the $\{\mathbf{u}_j\}_{j \in T}$. In the strict FIPS~204 layout
-$\mathbf{s}_2$ is part of the private signing key; in Pulsar-M
+$\mathbf{s}_2$ is part of the private signing key; in Pulsar
 $\mathbf{u}$ is Shamir-shared with the same threshold structure as
 $\mathbf{s}_1$.
 
 \begin{remark}[$\mathbf{s}_2$ as derived quantity]
 The FIPS~204 specification treats $\mathbf{s}_1$ and $\mathbf{s}_2$
-as independent samples from $\chi_\eta$ (FIPS~204~\S5.1). Pulsar-M's
+as independent samples from $\chi_\eta$ (FIPS~204~\S5.1). Pulsar's
 construction derives $\mathbf{s}_2$ from the Pedersen blinding
 $\mathbf{u}$ via the structural identity
 $\mathbf{s}_2 = \mathbf{B} \cdot \mathbf{u}$. Because $\mathbf{B}$ is
@@ -831,14 +831,14 @@ $|\mathbf{h}|_{\mathrm{count}} \le \omega$.
 \end{algorithm}
 
 Note that line 3's $\mu'$ definition --- the public-key fingerprint
-prefixing --- is exactly the FIPS~204 binding. Pulsar-M's $\Sign$
+prefixing --- is exactly the FIPS~204 binding. Pulsar's $\Sign$
 must compute its challenge over the \emph{same} $\mu'$ for the
 verifier to accept; this is the $\mu$ used in
 Algorithm~\ref{alg:sign-r2} step 5.
 
 This is the entire Class~N point: any FIPS-validated ML-DSA
 verifier (BoringSSL FIPS, AWS-LC, OpenSSL~3, liboqs) consumes
-Pulsar-M signatures without modification.
+Pulsar signatures without modification.
 
 \subsection{Proactive resharing \texorpdfstring{$\Reshare$}{Reshare}}
 \label{sec:reshare}
@@ -857,7 +857,7 @@ $t_{\mathrm{old}}$ subset of $\mathcal{O}$) lets a mobile adversary
 advance which parties will be quorum members at each reshare, can
 schedule its $t-1$ corruption budget to maximally cover the quorum.
 The HIP-0077 red-review finding F10 made this concrete for Pulsar's
-reshare layer. Pulsar-M mitigates by deriving the quorum from the
+reshare layer. Pulsar mitigates by deriving the quorum from the
 chain's randomness beacon $\beta_e$ for epoch $e$:
 \[
 \mathcal{Q}_e
@@ -984,7 +984,7 @@ The formal game definitions are stated in the companion file
 \label{sec:large-committees}
 % =====================================================================
 
-The Shamir secret-sharing layer of Pulsar-M operates orthogonally to
+The Shamir secret-sharing layer of Pulsar operates orthogonally to
 the FIPS~204 M-LWE parameters: the lattice instance is fixed by the
 parameter set, while the committee size $n$ and threshold $t$ are
 deployment-time settings. This section pins the scalability claim
@@ -1016,9 +1016,9 @@ Shamir's $(t-1)$-resilience over a finite field $\mathbb{F}_{|\mathbb{F}|}$
 holds whenever $|\mathbb{F}| > n$, and both GF($257$) and GF($q$)
 satisfy this for the supported committee ranges. Concretely:
 
-\begin{theorem}[Pulsar-M scales information-theoretically in $n$]
-\label{thm:pulsar-m-scales-it}
-Fix a Pulsar-M parameter level $L \in \{44, 65, 87\}$. For every
+\begin{theorem}[Pulsar scales information-theoretically in $n$]
+\label{thm:pulsar-scales-it}
+Fix a Pulsar parameter level $L \in \{44, 65, 87\}$. For every
 $(n, t)$ with $1 \le t \le n$ and $n \le q - 1$, the TS-UF advantage
 \Cref{thm:tsuf} is bounded by the same M-LWE / MSIS / FIPS~204
 EUF-CMA sum, plus an $n$-independent random-oracle term:
@@ -1129,7 +1129,7 @@ Tag length: TBD at freeze.
 variable-size field.
 \item Polynomials in $\Rq$ are encoded coefficient-by-coefficient
 using the FIPS~204 byte-packing for the per-poly bit width (see
-FIPS~204~\S7.1, \texttt{bitlen}). Pulsar-M re-uses the FIPS~204
+FIPS~204~\S7.1, \texttt{bitlen}). Pulsar re-uses the FIPS~204
 packings verbatim for $\mathbf{s}_1, \mathbf{s}_2, \mathbf{z}, \mathbf{w}$.
 \item Module vectors are encoded as their entries concatenated in
 order. Module matrices are encoded row-major.
@@ -1163,7 +1163,7 @@ $(\mathit{sid}, \kappa, i, \bar{\mathbf{w}}_i, \mathbf{z}_i, \mathbf{r}_i, \text
 
 \paragraph{$\Sign$ output (final signature).}
 The FIPS~204 ML-DSA signature triple $(\tilde c, \mathbf{z}, \mathbf{h})$,
-encoded \emph{exactly} per FIPS~204~\S7.2. \textbf{No Pulsar-M envelope.}
+encoded \emph{exactly} per FIPS~204~\S7.2. \textbf{No Pulsar envelope.}
 
 \paragraph{$\Reshare$ messages.}
 Structurally identical to $\DKG$ except the commit constant terms
@@ -1219,7 +1219,7 @@ serialised view, as in
 \item FIPS~204 norm checks ($\|\mathbf{z}\|_\infty < \gamma_1 - \beta$
 etc.) MUST be performed with branchless arithmetic. The
 \texttt{pulsar/sign/sign.go: CheckL2Norm} implementation is the
-reference (modulo Pulsar-M's switch from L2 norm to L-infty per
+reference (modulo Pulsar's switch from L2 norm to L-infty per
 FIPS~204).
 \item Rejection-restart MUST NOT short-circuit on the first failing
 norm: all norms are evaluated, then the accept/restart decision is
@@ -1228,7 +1228,7 @@ made from the accumulated result. This prevents timing leakage of
 \item No \texttt{log.*}, \texttt{fmt.Print*}, or panic in any
 secret-touching function (DD-007). The Pulsar reference's
 pre-fix \texttt{log.Println(Bsquare, sumSquares)} (HIP-0077 F8) is
-exactly the failure mode this rule prevents; the Pulsar-M reference
+exactly the failure mode this rule prevents; the Pulsar reference
 implementation will be CI-gated against any logging call inside
 \texttt{ref/go/sign/}, \texttt{ref/go/dkg/}, \texttt{ref/go/reshare/}.
 \end{itemize}
@@ -1236,7 +1236,7 @@ implementation will be CI-gated against any logging call inside
 \subsection{Rejection-sampling restart without secret leakage}
 \label{sec:impl-rejection-restart}
 
-This is the hardest cryptographic engineering problem in Pulsar-M.
+This is the hardest cryptographic engineering problem in Pulsar.
 FIPS~204 ML-DSA's rejection-with-restart structure (\S\ref{sec:prelim-rejection})
 interacts with threshold signing in three load-bearing places.
 
@@ -1264,8 +1264,8 @@ the CRIT-1 vulnerability flagged in Pulsar's pre-fix code
 $(\mathbf{s}_i, \mathit{sid})$ so distinct sessions get distinct
 seeds.
 
-\paragraph{The Pulsar-M domain separation.}
-Pulsar-M extends the Pulsar fix to handle three orthogonal
+\paragraph{The Pulsar domain separation.}
+Pulsar extends the Pulsar fix to handle three orthogonal
 domains:
 
 \begin{enumerate}[leftmargin=*, itemsep=0pt]
@@ -1358,7 +1358,7 @@ Round-2-MPTC work in \S\ref{sec:knownlimits}.
 \end{remark}
 
 \paragraph{Implementation discipline.}
-The Pulsar-M reference implementation enforces the cross-restart
+The Pulsar reference implementation enforces the cross-restart
 state discipline structurally:
 
 \begin{itemize}[leftmargin=*, itemsep=0pt]
@@ -1378,7 +1378,7 @@ fact of failure, not via timing).
 \label{sec:impl-perf}
 
 Concrete benchmarks defer to the experimental-evaluation report
-(\texttt{bench/results/REPORT.md}, frozen at submission). Pulsar-M's
+(\texttt{bench/results/REPORT.md}, frozen at submission). Pulsar's
 expected complexity scales as follows for parameter set ML-DSA-65,
 $(n, t) = (7, 4)$:
 
@@ -1440,7 +1440,7 @@ ceremony:
 Cross-implementation KAT replay: the Go reference (\texttt{ref/go/})
 and the eventual C reference (\texttt{ref/c/}) MUST produce
 byte-equal outputs from the same seeded inputs. The KAT generation
-oracle is locked at \texttt{cmd/pulsar-m-oracle}.
+oracle is locked at \texttt{cmd/pulsar-oracle}.
 
 % =====================================================================
 \section{Complexity analysis}
@@ -1518,7 +1518,7 @@ and is the canonical roadmap item for round-2 hardening.
 \paragraph{Corona (R-LWE), Class~S~\cite{boschini2024corona}.}
 The companion Lux scheme over $\Rq$, single polynomial. Faster,
 simpler, but \emph{not} output-interchangeable with any NIST primitive.
-Different wire format. Pulsar-M shares Pulsar's protocol structure
+Different wire format. Pulsar shares Pulsar's protocol structure
 (2-round signing, Pedersen DKG, HJKY97 reshare) lifted from $\Rq$ to
 $\Rq^k$.
 
@@ -1531,26 +1531,26 @@ proofs.
 \paragraph{DOTT21~\cite{dott21}, PKC 2021.}
 The foundational Damg\aa rd--Orlandi--Takahashi--Tibouchi two-round
 $n$-out-of-$n$ multisignature from lattices. Inspires the
-commit-and-aggregate structure of Pulsar/Pulsar-M. Restricted to
-$n$-out-of-$n$; Pulsar-M extends to $t$-out-of-$n$ via Shamir.
+commit-and-aggregate structure of Pulsar/Pulsar. Restricted to
+$n$-out-of-$n$; Pulsar extends to $t$-out-of-$n$ via Shamir.
 
 \paragraph{Olingo~\cite{olingo2025}, ePrint 2025/1789.}
 Concurrent threshold ML-DSA candidate. Comparison points: round
 count, output interchangeability claim, DKG soundness, side-channel
 posture. Full comparison table deferred to the experimental
-evaluation report; structural comparison: Olingo and Pulsar-M both
+evaluation report; structural comparison: Olingo and Pulsar both
 target Class N1, both use $\Rq^k$, with differing rejection-restart
 strategies.
 
 \paragraph{THED~\cite{thed2026}, ePrint 2026/638.}
 Threshold extension of FIPS~204. Comparison deferred to round-1
-preview; THED was not public at Pulsar-M's draft cut-off.
+preview; THED was not public at Pulsar's draft cut-off.
 
 \paragraph{HJKY97~\cite{hjky97}.}
-The foundational proactive-resharing model. Pulsar-M's $\Reshare$
+The foundational proactive-resharing model. Pulsar's $\Reshare$
 protocol is the natural lift of the HJKY97 construction to the M-LWE
 setting, with the beacon-randomised quorum selection (DD-006) as the
-Pulsar-M-specific strengthening for mobile-adversary attacks.
+Pulsar-specific strengthening for mobile-adversary attacks.
 
 % =====================================================================
 \appendix
@@ -1573,7 +1573,7 @@ $\mathbf{A} \in \Rq^{k \times \ell}$ & public matrix, derived from $\rho$ via FI
 $\mathbf{B} \in \Rq^{k \times \ell}$ & Pedersen blinding matrix, derived via \texttt{PULSAR-M-EXPANDB-V1} \\
 $\mathbf{s}_1 \in \Rq^\ell$ & master secret, $\chi_\eta$-distributed \\
 $\mathbf{u} \in \Rq^\ell$ & Pedersen blinding, $\chi_\eta$-distributed \\
-$\mathbf{s}_2 \in \Rq^k$ & FIPS~204 noise, $= \mathbf{B}\mathbf{u}$ in Pulsar-M \\
+$\mathbf{s}_2 \in \Rq^k$ & FIPS~204 noise, $= \mathbf{B}\mathbf{u}$ in Pulsar \\
 $\mathbf{t} = \mathbf{A}\mathbf{s}_1 + \mathbf{B}\mathbf{u}$ & FIPS~204 public-key inner vector (Pedersen-shaped) \\
 $(\mathbf{t}_1, \mathbf{t}_0) = \Power(\mathbf{t}, d)$ & FIPS~204 public/private decomposition \\
 $\mathit{pk} = (\rho, \mathbf{t}_1)$ & FIPS~204 public key \\
@@ -1615,7 +1615,7 @@ $\beta_e$ & chain randomness beacon at epoch $e$ \\
 \label{sec:patent}
 Final patent disclosure assembled at the submission freeze. Lux
 Industries Inc.\ asserts no patent claims on the cryptographic body
-of Pulsar-M; the threshold protocol is a port of the publicly-known
+of Pulsar; the threshold protocol is a port of the publicly-known
 the Boschini et al~\cite{boschini2024corona} construction with the beacon-quorum
 strengthening of DD-006, both of which are explicitly placed into
 the public domain by this submission.
@@ -1659,7 +1659,7 @@ lattice signatures is an active research direction. The
 leveraging argument that loses a multiplicative
 $\binom{n}{t}$ factor in the security parameter. Can a tighter
 adaptive reduction be constructed for the module-shaped
-Pulsar-M variant without architectural changes? \emph{Unresolved.}
+Pulsar variant without architectural changes? \emph{Unresolved.}
 \end{openq}
 
 \begin{openq}[Restart cross-message hybrid]
@@ -1675,9 +1675,9 @@ the formal hybrid is round-2 work. \emph{Unresolved.}
 The DD-006 beacon-randomised quorum selection assumes the chain
 beacon is unbiasable against the adversary. The Lux Quasar
 consensus randomness layer provides this property; the formal
-binding to the Pulsar-M reshare MOB game requires a separate
+binding to the Pulsar reshare MOB game requires a separate
 hybrid argument bridging the consensus randomness assumption to
-the Pulsar-M MOB game. \emph{Sketched in security-games.tex; full
+the Pulsar MOB game. \emph{Sketched in security-games.tex; full
 proof round-2.}
 \end{openq}
 

spec/security-games.tex

@@ -1,4 +1,4 @@
-% Pulsar-M security game definitions --- included by pulsar-m.tex
+% Pulsar security game definitions --- included by pulsar.tex
 % \section{Security analysis}
 %
 % Standard cryptographic-game style. Each game pins the challenger
@@ -122,7 +122,7 @@ relaying the signing query to the ML-DSA challenger and using $H_1$'s
 simulator to expand the resulting $\sigma$ into a per-party
 transcript. Any adversary that wins TS-UF against this hybrid
 produces a forgery $(\mu^*, \sigma^*)$ that wins the ML-DSA EUF-CMA
-game (since the Pulsar-M $\Verify$ is unmodified ML-DSA
+game (since the Pulsar $\Verify$ is unmodified ML-DSA
 $\Verify$). Distinguishing advantage between $H_3$ and $H_4$ is
 absorbed into the MSIS binding term: any deviation by the simulator
 from the honest-party transcript shape is detected by binding of the
@@ -138,7 +138,7 @@ random-oracle programming penalty. For ML-DSA-65 ($\lambda = 192$),
 this term is negligible for any practical $(q_S, q_H)$. The MSIS
 term governs the Pedersen-binding side of the argument; the MLWE
 term governs the hiding side; the ML-DSA term governs the underlying
-single-party unforgeability. Pulsar-M inherits ML-DSA's EUF-CMA
+single-party unforgeability. Pulsar inherits ML-DSA's EUF-CMA
 bound verbatim modulo these threshold-protocol-specific terms.
 \end{remark}
 
@@ -153,7 +153,7 @@ The challenger flips a fair bit $b \in \{0, 1\}$ at setup and exposes
 two oracles to $\mathcal{A}$:
 \begin{itemize}[leftmargin=*, itemsep=0pt]
 \item If $b = 0$: $\DKG$ produces $\mathit{pk}$ honestly, and
-$\mathcal{O}_{\Sign}(\mu, T)$ runs Pulsar-M $\Sign$ honestly and
+$\mathcal{O}_{\Sign}(\mu, T)$ runs Pulsar $\Sign$ honestly and
 returns only the final $\sigma$ (transcript is hidden).
 \item If $b = 1$: $\mathit{pk}$ is generated by single-party
 \texttt{ML-DSA.KeyGen}, and $\mathcal{O}_{\Sign}(\mu, T)$ ignores the
@@ -179,12 +179,12 @@ For every $\PPT$ adversary $\mathcal{A}$ against \Cref{game:outind},
 \begin{proof}[Proof sketch]
 \textbf{$\mathit{pk}$ indistinguishability.}
 A FIPS~204 public key is $\mathit{pk}_{\mathrm{F}} = (\rho, \Power(\mathbf{A}\mathbf{s}_1 + \mathbf{s}_2, d))$ with $\mathbf{s}_1, \mathbf{s}_2 \gets \chi_\eta$.
-A Pulsar-M public key is $\mathit{pk}_{\mathrm{P}} = (\rho, \Power(\mathbf{A}\mathbf{s}_1 + \mathbf{B}\mathbf{u}, d))$ with $\mathbf{s}_1, \mathbf{u} \gets \chi_\eta$ (centred binomial) and $\mathbf{B}$ uniform.
+A Pulsar public key is $\mathit{pk}_{\mathrm{P}} = (\rho, \Power(\mathbf{A}\mathbf{s}_1 + \mathbf{B}\mathbf{u}, d))$ with $\mathbf{s}_1, \mathbf{u} \gets \chi_\eta$ (centred binomial) and $\mathbf{B}$ uniform.
 The two distributions are identical except in the $\mathbf{s}_2$ vs.\ $\mathbf{B}\mathbf{u}$ component. Under $\MLWE_{q, k, \ell, \eta}$ in $\mathbf{B}$, $\mathbf{B}\mathbf{u}$ is computationally indistinguishable from a uniform $\mathbf{w} \in \Rq^k$; conditioned on uniformity, the post-$\Power$ projection is uniform over the range of $\Power$. Single-party ML-DSA's $\mathbf{s}_2 \sim \chi_\eta^k$ also projects through $\Power$ to a distribution that is statistically close to uniform over the $\Power$ image. The total distance between the two $\mathit{pk}$ distributions is therefore bounded by $\Adv^{\MLWE}_{q, k, \ell, \eta}(\mathcal{B}_{\MLWE})$ plus a negligible statistical term from the $\Power$ rounding.
 
 \textbf{$\sigma$ indistinguishability.}
-By correctness (\Cref{thm:sign-correct}), the Pulsar-M aggregated
-$\sigma$ is the FIPS~204 signature on $(\mathit{pk}, \mu, \mathbf{y})$ where $\mathbf{y} = \sum_j \mathbf{y}_j$ is the aggregated mask. The marginal distribution of $\mathbf{y}$ (sum of $t$ uniform-interval samples) is a discrete convolution; FIPS~204's single-party mask is a single uniform-interval sample. The two distributions differ in their concentration profile but are projected through the rejection-sampling acceptance condition $\|\mathbf{z}\|_\infty < \gamma_1 - \beta$, which forces the accepted distribution into the same FIPS~204 acceptance region. Conditioned on acceptance, the per-coordinate distribution of $\mathbf{z}$ is uniform on $[-\gamma_1 + \beta + 1, \gamma_1 - \beta - 1]$ in both cases (this is the FIPS~204 rejection-sampling invariant). Therefore the post-rejection distribution is identical between Pulsar-M and FIPS~204, and the output $\sigma$ is distributionally identical given the same $\tilde c$ and $\mathbf{h}$.
+By correctness (\Cref{thm:sign-correct}), the Pulsar aggregated
+$\sigma$ is the FIPS~204 signature on $(\mathit{pk}, \mu, \mathbf{y})$ where $\mathbf{y} = \sum_j \mathbf{y}_j$ is the aggregated mask. The marginal distribution of $\mathbf{y}$ (sum of $t$ uniform-interval samples) is a discrete convolution; FIPS~204's single-party mask is a single uniform-interval sample. The two distributions differ in their concentration profile but are projected through the rejection-sampling acceptance condition $\|\mathbf{z}\|_\infty < \gamma_1 - \beta$, which forces the accepted distribution into the same FIPS~204 acceptance region. Conditioned on acceptance, the per-coordinate distribution of $\mathbf{z}$ is uniform on $[-\gamma_1 + \beta + 1, \gamma_1 - \beta - 1]$ in both cases (this is the FIPS~204 rejection-sampling invariant). Therefore the post-rejection distribution is identical between Pulsar and FIPS~204, and the output $\sigma$ is distributionally identical given the same $\tilde c$ and $\mathbf{h}$.
 
 The statistical term $1/2^{2\lambda}$ accounts for the negligible
 probability of a $\tilde c$ collision in the RO. \qed
@@ -192,7 +192,7 @@ probability of a $\tilde c$ collision in the RO. \qed
 
 \begin{remark}[Caveat on signature byte equality]
 \Cref{thm:outind} states distributional equivalence. For \emph{byte
-equality} on a specific signature, the Pulsar-M $\Sign$
+equality} on a specific signature, the Pulsar $\Sign$
 implementation MUST emit exactly the FIPS~204 byte encoding of
 $(\tilde c, \mathbf{z}, \mathbf{h})$ with the same canonicalisation
 (coefficient lifting, sign convention, packing). This is an
@@ -298,7 +298,7 @@ non-trivial.
 
 \begin{openq}[Adaptive corruption]
 Tight adaptive corruption for module-shaped two-round
-threshold lattice signatures is an open research question. Pulsar-M
+threshold lattice signatures is an open research question. Pulsar
 defers a formal proof to round 2; under the static-corruption model
 \Cref{thm:tsuf} suffices for round 1.
 \end{openq}
@@ -553,7 +553,7 @@ RESTART-NL (rejection-restart) & PRF($\KMAC$) + TS-UF \\
 
 The dominant terms across all games are $\MLWE_{q, k, \ell, \eta}$
 and ML-DSA EUF-CMA, both of which take the FIPS~204
-parameter-pinned values (see \S\ref{sec:parameters}). Pulsar-M
+parameter-pinned values (see \S\ref{sec:parameters}). Pulsar
 inherits ML-DSA's security level modulo the threshold-protocol
 overhead, which is dominated by the Pedersen-binding $\MSIS$ term
 and the random-oracle programming penalty.

spec/system-model.tex

@@ -1,9 +1,9 @@
-% Pulsar-M system model -- included by pulsar-m.tex section "System model"
+% Pulsar system model -- included by pulsar.tex section "System model"
 
 % ---------------------------------------------------------------
 % Top of document inserts this file under the chapter heading
 % "System model"; no \section* command here is appropriate
-% because pulsar-m.tex provides one via the surrounding
+% because pulsar.tex provides one via the surrounding
 % \section{System model}.
 
 \paragraph{Network model.}
@@ -116,7 +116,7 @@ $n' \ge 2t' - 1$ on the new committee. Rotation cadence is governed
 by the validator-set epoch (typically 12 hours to 7 days on Lux).
 
 \paragraph{Committee scale.}
-Pulsar-M's per-byte Shamir layer supports two operating regimes:
+Pulsar's per-byte Shamir layer supports two operating regimes:
 
 \begin{itemize}[leftmargin=*, itemsep=0pt]
 \item \emph{Small committee} ($n \le 256$). Shares are dealt over
@@ -153,8 +153,8 @@ the $N \approx 1.1$M-validator pool into $\sim N / 3$ groups of size
 $3$ using deterministic SHA3-384 Fisher-Yates shuffle. The
 sortition seed is an epoch-bound chain digest, making it
 unpredictable in advance of group composition.
-\item \emph{Per-group Pulsar-M (3, 2).} Each group runs the small-
-committee Pulsar-M path at $(T, N) = (2, 3)$ -- the canonical
+\item \emph{Per-group Pulsar (3, 2).} Each group runs the small-
+committee Pulsar path at $(T, N) = (2, 3)$ -- the canonical
 small-committee config. The group produces one FIPS~204 ML-DSA
 signature per epoch checkpoint. Tolerates one Byzantine party per
 group. Per-group DKG / Sign / Reshare cost is constant in the
@@ -182,7 +182,7 @@ primitive in the stack rests on post-quantum hardness assumptions.
 layer & primitive & PQ hardness \\
 \midrule
 per-validator identity sig  & ML-DSA-65 (FIPS~204)               & Module-LWE + MSIS \\
-per-group threshold sign    & Pulsar-M (2, 3) $\to$ FIPS~204 sig & Module-LWE + MSIS \\
+per-group threshold sign    & Pulsar (2, 3) $\to$ FIPS~204 sig & Module-LWE + MSIS \\
 sortition                   & SHA3-384 Fisher-Yates              & SHA-3 collision-resistance \\
 inter-group rollup          & P3Q STARK + FRI                    & cSHAKE256 collision-resistance \\
 final cert verifier         & P3Q verifier                       & cSHAKE256 collision-resistance \\
@@ -194,20 +194,20 @@ There is no pairing, no elliptic-curve recursion, no KZG, no Groth16
 anywhere in the production path. Shor's algorithm has no purchase on
 any layer.
 
-\paragraph{Why Pulsar-M does not need to scale to 1.1M parties.}
-A naive scaling approach would run one Pulsar-M ceremony over all
+\paragraph{Why Pulsar does not need to scale to 1.1M parties.}
+A naive scaling approach would run one Pulsar ceremony over all
 $1.1$M validators. This costs $O(n^2)$ communication
 ($\sim 10^{12}$ envelopes), which is physically infeasible. The
 grouped-sortition + P3Q-rollup architecture sidesteps the quadratic
-ceiling: each Pulsar-M ceremony runs at constant size $(T, N) =
+ceiling: each Pulsar ceremony runs at constant size $(T, N) =
 (2, 3)$, and the inter-group attestation runs as one P3Q proof.
-The wide-field GF($q$) Pulsar-M path documented in this section is
+The wide-field GF($q$) Pulsar path documented in this section is
 the alternative single-large-committee deployment for permissioned
 consortium / audit-attestation scenarios where the grouped
 sortition layer is not appropriate.
 
 \paragraph{Integer-arithmetic discipline.}
-Every modular operation in Pulsar-M's core path uses uint32 lanes
+Every modular operation in Pulsar's core path uses uint32 lanes
 with uint64 accumulators. The widest intermediate is one Lagrange
 multiplication over GF($q$), which spans at most 46 bits. uint128
 and uint256 widths are explicitly \emph{not} required by this
@@ -254,5 +254,5 @@ The Go reference (\texttt{ref/go/}) and the eventual C reference
 (\texttt{ref/c/}) MUST produce byte-equal outputs from the same
 seeded inputs. KAT replay (\S\ref{sec:vectors}) is the conformance
 gate. The KAT generation oracle is locked at
-\texttt{cmd/pulsar-m-oracle}; both references replay it without
+\texttt{cmd/pulsar-oracle}; both references replay it without
 modification.

spec/threat-model.tex

@@ -1,4 +1,4 @@
-% Pulsar-M threat model -- included by pulsar-m.tex.
+% Pulsar threat model -- included by pulsar.tex.
 % Mirrors docs/threat-model.md (now deleted; this file is the
 % canonical LaTeX form).
 
@@ -36,7 +36,7 @@ protocol.
 \item All other capabilities as in static.
 \end{itemize}
 
-The Pulsar-M security analysis (\texttt{spec/security-games.tex})
+The Pulsar security analysis (\texttt{spec/security-games.tex})
 provides the precise game definitions. Static security is the
 baseline; adaptive security is a stretch goal for the first MPTC
 submission and a hard requirement for the second-round response.
@@ -49,7 +49,7 @@ parties \textbf{per epoch}, with the corruption set varying across
 epochs. The adversary may \emph{uncorrupt} a party (forget what it
 learned) at epoch boundaries.
 
-Pulsar-M proactive resharing inherits the soundness argument from
+Pulsar proactive resharing inherits the soundness argument from
 Pulsar's \texttt{reshare/} (with the constant-time fix from F9 of
 the Hanzo HIP-0077 red review). The MPTC submission documents the
 mobile-adversary game explicitly.
@@ -65,7 +65,7 @@ party (power analysis, EM, fault injection). Mitigation discussed in
 \S\ref{sec:knownlimits} as future work.
 \item Compromise of the BIP-32/BIP-39 mnemonic from which
 device-specific keys are derived. The HD-derivation security
-argument lives in HIP-0077 \S``Identity''; the Pulsar-M layer
+argument lives in HIP-0077 \S``Identity''; the Pulsar layer
 assumes parties' input keys are uniformly distributed.
 \end{itemize}
 
@@ -73,7 +73,7 @@ assumes parties' input keys are uniformly distributed.
 
 \paragraph{Threshold unforgeability (TS-UF).}
 For any PPT adversary $\mathcal{A}$ controlling up to $t-1$ parties,
-$\mathcal{A}$ cannot produce a valid Pulsar-M signature $\sigma^*$
+$\mathcal{A}$ cannot produce a valid Pulsar signature $\sigma^*$
 on any message $\mu^*$ that an honest signing ceremony has not
 produced.
 
@@ -88,7 +88,7 @@ If a corrupted party deviates from the protocol, the honest parties:
 \end{enumerate}
 
 \paragraph{Output indistinguishability from FIPS 204.}
-A Pulsar-M signature $\sigma$ on message $\mu$ against group public
+A Pulsar signature $\sigma$ on message $\mu$ against group public
 key $\mathit{pk}$ is computationally indistinguishable from a
 FIPS~204 ML-DSA signature on the same $(\mathit{pk}, \mu)$.
 Specifically: an adversary that can distinguish the two with
@@ -135,7 +135,7 @@ parameters $(q, k, \ell, \eta, \beta, \omega, \ldots)$ exactly as in
 FIPS~204 ML-DSA-65.
 \item The hash family: SHAKE-256 (FIPS 202), cSHAKE-256 / KMAC-256 /
 TupleHash-256 (NIST SP 800-185). Customization tags are pinned in
-\texttt{spec/pulsar-m.tex}.
+\texttt{spec/pulsar.tex}.
 \item The Gaussian sampler parameters from FIPS~204 \S3.3 / \S4.2.
 \end{itemize}
 
@@ -143,7 +143,7 @@ No trusted setup beyond NIST primitives.
 
 \subsection{Failure modes addressed}
 
-The MPTC submission documents how Pulsar-M handles each failure
+The MPTC submission documents how Pulsar handles each failure
 mode that broke earlier threshold-lattice schemes:
 
 \begin{itemize}[leftmargin=*, itemsep=0pt]
@@ -157,8 +157,8 @@ Pulsar (\texttt{reshare/commit.go} F9 fix).
 \texttt{log} use in any secret-touching path; all logging via
 \texttt{luxfi/log} at fields that are explicitly public.
 \item \textbf{Deterministic quorum selection in resharing leaking
-adversary positioning}: Pulsar-M uses a beacon-derived per-reshare
+adversary positioning}: Pulsar uses a beacon-derived per-reshare
 quorum selection (HIP-0077 \S``reshare quorum'' F10 fix).
 \item \textbf{Cross-mode hash-suite confusion}: NIST profile is
-exclusively SHA-3 family; no BLAKE3 in Pulsar-M ever.
+exclusively SHA-3 family; no BLAKE3 in Pulsar ever.
 \end{itemize}