@@ -361,17 +361,24 @@ fn distinct_through_refuses_a_source_that_does_not_match_the_backend() {
     }
 }
 
-/// Under PRSS EVERY shape fails closed, never panics. A row needs its keys shared
-/// as the holder's own input, which PRSS refuses; and since #6117 step 6 routed the
-/// output stage through the same source, so does the EMPTY DISTINCT — the output
-/// stage always shares the real-row tag and the payload limbs for its `B`
-/// pure-dummy slots, so there is no longer a draw-free shape here. (Before the
-/// routing the empty case ran, because the output stage minted its own dealer and
-/// never touched the caller's source.)
+/// Under PRSS every shape fails closed for any `B > 0`, never panics. A row needs
+/// its keys shared as the holder's own input, which PRSS refuses; and since #6117
+/// step 6 routed the output stage through the same source, so does the EMPTY
+/// DISTINCT — the output stage shares the real-row tag and the payload limbs for
+/// each of its `B` pure-dummy slots, so an empty input is draw-free only at
+/// `B = 0`. (Before the routing the empty case ran at any `B`, because the output
+/// stage minted its own dealer and never touched the caller's source.)
+///
+/// First, on a DEALER source, the empty DISTINCT still returns its `B` dummy slots:
+/// the PRSS refusal below belongs to PRSS, not to a shape this operator cannot run.
 #[test]
 fn prss_fails_closed_on_every_distinct_shape() {
     use crate::prss::PrssRandomness;
     let backend = ShamirBackend::new_seeded(3, 0xD15CA).unwrap();
+    let (slots, cost) =
+        distinct_hidden_pairs_slots_through(&mut backend.dealer(), &backend, &[], 2).unwrap();
+    assert_eq!(slots, vec![OutputSlot::Dummy, OutputSlot::Dummy]);
+    assert_eq!(cost.rows, 0);
     let mut prss = PrssRandomness::with_simulated_setup(3).unwrap();
     for pairs in [
         vec![],
@@ -456,19 +463,19 @@ fn seeded_distinct_stage_draws_exactly_what_the_dealer_drew_before_the_seam() {
     );
     assert_eq!(dealer.draw_fp().value(), 888758199960741934);
 
-    // The REVEALED slot ORDER moved in #6117 step 6 (it was
-    // ["dummy", "dummy", "<http://ex/a> <http://ex/b>", "<http://ex/e> <http://ex/f>"]):
-    // the output stage now draws its sharings and its shuffle from the SAME source
-    // as the sort-and-scan stage instead of minting a second dealer, so the
-    // shuffle samples a different point of one continuous keystream. The order is
-    // the shuffle's secret permutation and carries no result meaning — the
+    // The REVEALED slot ORDER has moved twice: first in #6117 step 6 (the output
+    // stage draws its sharings and its shuffle from the SAME source as the
+    // sort-and-scan stage instead of minting a second dealer), then again when the
+    // output stage's per-element degree reduction added its re-sharings, so the
+    // shuffle samples a later point of one continuous keystream. The order is the
+    // shuffle's secret permutation and carries no result meaning — the
     // canonicalised multiset below is what the recipient sees, and it is
     // byte-identical to the pre-routing capture.
     let expected_slots = [
+        "<http://ex/a> <http://ex/b>",
         "<http://ex/e> <http://ex/f>",
         "dummy",
         "dummy",
-        "<http://ex/a> <http://ex/b>",
     ];
     let canonical = [
         "<http://ex/a> <http://ex/b>",
@@ -486,9 +493,28 @@ fn seeded_distinct_stage_draws_exactly_what_the_dealer_drew_before_the_seam() {
         (3, 2)
     );
     // `distinct_hidden_pairs_oblivious` draws both stages from ONE dealer too, so
-    // it reveals exactly the same slots in the same order.
-    let (slots, _) = distinct_hidden_pairs_oblivious(&backend, &pairs, 4).unwrap();
+    // it reveals exactly the same slots in the same order, and its output-stage
+    // `ObliviousOutputCost` is unchanged from the pre-routing capture.
+    let (slots, out_cost) = distinct_hidden_pairs_oblivious(&backend, &pairs, 4).unwrap();
     assert_eq!(slot_strings(&slots), expected_slots);
+    assert_eq!(
+        (
+            out_cost.bound,
+            out_cost.select_mults,
+            out_cost.opens,
+            out_cost.shuffle.items,
+            out_cost.shuffle.switches,
+            out_cost.shuffle.depth_rounds
+        ),
+        (4, 4, 4, 4, 35, 3)
+    );
+    // The payload-limb select is the one NEW cost: each slot's endpoint-pair
+    // payload packs six limbs (a length prefix plus five data limbs), so the limb
+    // select adds 6 multiplications per slot on top of the one tag select.
+    assert_eq!(out_cost.payload_select_mults, 24);
+    // One degree reduction per SELECTED element: the tag plus the six limbs, for
+    // each of the four slots.
+    assert_eq!(out_cost.degree_reductions, 28);
 }
 
 /// The COMPLETE draw sequence, not just its length: every seam call the stage
@@ -497,15 +523,16 @@ fn seeded_distinct_stage_draws_exactly_what_the_dealer_drew_before_the_seam() {
 /// when the witness draw count and the keep bits happen to agree.
 ///
 /// **This is the #6117-step-6 guard.** The transcript now ends in the output
-/// stage's 29 `vss_own_input` draws and its `oblivious_shuffle`: if
+/// stage's 113 `vss_own_input` draws and its `oblivious_shuffle`: if
 /// `distinct_hidden_pairs_slots_through` went back to minting its own dealer for
 /// the output stage the log would stop at 8418 entries and both the length and the
 /// suffix assertion would fail.
 ///
 /// The 8418-entry PREFIX is the pre-routing whole-log pin
 /// (`0x5455_9ace_20c7_0f97`, captured on the pre-routing code), asserted here
 /// unchanged: the routing appended an output-stage SUFFIX and moved nothing in the
-/// sort-and-scan part. The full-log fingerprint is the new pin.
+/// sort-and-scan part, and the output stage's per-element degree reduction only
+/// grew that suffix. The full-log fingerprint is the new pin.
 #[test]
 fn seeded_distinct_stage_transcript_is_pinned() {
     use crate::randomness::test_sources::{fingerprint, RecordingSource};
@@ -517,13 +544,14 @@ fn seeded_distinct_stage_transcript_is_pinned() {
     ];
     let mut rec = RecordingSource::new(backend.dealer());
     distinct_hidden_pairs_slots_through(&mut rec, &backend, &pairs, 4).unwrap();
-    assert_eq!(rec.log.len(), 8448);
-    // Prefix unchanged from the pre-routing pin; suffix is the new output stage.
+    assert_eq!(rec.log.len(), 8532);
+    // Prefix unchanged from the pre-routing pin; the whole move is in the output
+    // suffix, which grew by the per-element degree reductions.
     assert_eq!(fingerprint(&rec.log[..8418]), 0x5455_9ace_20c7_0f97);
-    assert_eq!(fingerprint(&rec.log), 0xa636_3f2c_e548_9f86);
+    assert_eq!(fingerprint(&rec.log), 0x0e8a_77a0_b90f_0200);
     let suffix: Vec<&str> = rec.log[8418..].iter().map(|(m, _)| *m).collect();
     assert_eq!(
         suffix,
-        [["vss_own_input"; 29].as_slice(), &["oblivious_shuffle"]].concat()
+        [["vss_own_input"; 113].as_slice(), &["oblivious_shuffle"]].concat()
     );
 }
@@ -117,8 +117,7 @@
 use crate::compare::secure_equal_to_bit_through;
 use crate::field::Fp;
 use crate::oblivious_join::{
-    oblivious_join_output_through, oblivious_set_output_through, Candidate, MatchBit,
-    ObliviousOutput,
+    oblivious_set_output_through, partial_result_from_slots, Candidate, MatchBit, ObliviousOutput,
 };
 use crate::partial::{MpcError, PartialResult};
 use crate::randomness::{require_source_matches, DistributedRandomness};
@@ -130,6 +129,14 @@ use std::collections::BTreeMap;
 const SUBJECT_VAR: &str = "__pp_a";
 const OBJECT_VAR: &str = "__pp_b";
 
+/// The output schema both hidden-path entry points project onto: the endpoint pair.
+fn chain_out_vars() -> Vec<Variable> {
+    vec![
+        Variable::new_unchecked(SUBJECT_VAR),
+        Variable::new_unchecked(OBJECT_VAR),
+    ]
+}
+
 /// Maximum number of edge-tuples (`|E|^k`) the operator will enumerate before
 /// refusing the path with a [`MpcError::Protocol`]. The enumeration is
 /// `|E|^k` — exponential in the PUBLIC bound `k` and polynomial-of-degree-`k` in
@@ -378,23 +385,18 @@ fn check_params(backend: &ShamirBackend, edges: &HiddenEdges, k: usize) -> Resul
 /// `bound` is the public padded bound `B`; it must cover the distinct-endpoint-pair
 /// candidate count (fail-closed in `oblivious_set_output_through` — never
 /// truncates a match). One fresh dealer covers the chain stage AND the output
-/// stage. See the module docs for the full construction and security tier.
+/// stage: this is `eval_exact_k_chain_hidden_slots_through` on that one dealer,
+/// narrowed to the disclosed rows — a single code path, so nothing here can mint a
+/// second dealer. See the module docs for the full construction and security tier.
 pub fn eval_exact_k_chain_hidden(
     backend: &ShamirBackend,
     edges: &HiddenEdges,
     k: usize,
     bound: usize,
 ) -> Result<PartialResult, MpcError> {
-    check_params(backend, edges, k)?;
-    let mut dealer = backend.dealer();
-    let candidates = build_candidates(backend, &mut dealer, edges, k)?;
-    let out_vars = vec![
-        Variable::new_unchecked(SUBJECT_VAR),
-        Variable::new_unchecked(OBJECT_VAR),
-    ];
-    let (result, _cost) =
-        oblivious_join_output_through(&mut dealer, backend, &candidates, out_vars, bound)?;
-    Ok(result)
+    let (slots, _cost) =
+        eval_exact_k_chain_hidden_slots_through(&mut backend.dealer(), backend, edges, k, bound)?;
+    Ok(partial_result_from_slots(slots, chain_out_vars()))
 }
 
 /// Like [`eval_exact_k_chain_hidden`] but returns the raw oblivious output (the `B`
@@ -440,6 +442,29 @@ pub(crate) fn eval_exact_k_chain_hidden_slots_through(
     oblivious_set_output_through(source, backend, &candidates, 2, bound)
 }
 
+/// Test-only instrumentation: the candidates
+/// `eval_exact_k_chain_hidden_slots_through` builds, together with the
+/// `(is_real, decoded_row)` of every slot the REAL output stage opens for them.
+/// Same candidate construction and same output stage as the public path — it just
+/// keeps the dummy slots' decoded payload rows, which [`ObliviousOutput`] cannot
+/// express.
+#[cfg(test)]
+#[allow(clippy::type_complexity)]
+pub(crate) fn exact_k_chain_candidates_and_opened_rows(
+    source: &mut dyn DistributedRandomness,
+    backend: &ShamirBackend,
+    edges: &HiddenEdges,
+    k: usize,
+    bound: usize,
+) -> Result<(Vec<Candidate>, Vec<(bool, Vec<Option<Term>>)>), MpcError> {
+    require_source_matches(source, backend)?;
+    check_params(backend, edges, k)?;
+    let candidates = build_candidates(backend, source, edges, k)?;
+    let slots =
+        crate::oblivious_join::opened_slot_rows_through(source, backend, &candidates, 2, bound)?;
+    Ok((candidates, slots))
+}
+
 // =====================================================================
 // sq-py8h.3 — bounded repetition `{1,k}` / `{0,k}` / `p?` + alternation
 // over the SAME hidden edge set, as a union-of-fixed-chains with an
@@ -813,24 +838,19 @@ fn build_bounded_candidates(
 /// `bound` is the public padded bound `B`; it must cover the distinct-endpoint-pair
 /// candidate count (fail-closed in `oblivious_set_output_through` — never
 /// truncates a match). One fresh dealer covers the union stage AND the output
-/// stage. Security tier is identical to [`eval_exact_k_chain_hidden`]:
+/// stage: this is `eval_bounded_path_hidden_slots_through` on that one dealer,
+/// narrowed to the disclosed rows — a single code path, so nothing here can mint a
+/// second dealer. Security tier is identical to [`eval_exact_k_chain_hidden`]:
 /// honest-majority, semi-honest, no new assumption.
 pub fn eval_bounded_path_hidden(
     backend: &ShamirBackend,
     edges: &PredicatedEdges,
     form: &HiddenBoundedPath,
     bound: usize,
 ) -> Result<PartialResult, MpcError> {
-    check_bounded_params(backend, edges, form)?;
-    let mut dealer = backend.dealer();
-    let candidates = build_bounded_candidates(backend, &mut dealer, edges, form)?;
-    let out_vars = vec![
-        Variable::new_unchecked(SUBJECT_VAR),
-        Variable::new_unchecked(OBJECT_VAR),
-    ];
-    let (result, _cost) =
-        oblivious_join_output_through(&mut dealer, backend, &candidates, out_vars, bound)?;
-    Ok(result)
+    let (slots, _cost) =
+        eval_bounded_path_hidden_slots_through(&mut backend.dealer(), backend, edges, form, bound)?;
+    Ok(partial_result_from_slots(slots, chain_out_vars()))
 }
 
 /// Like [`eval_bounded_path_hidden`] but returns the raw oblivious output (the `B`
@@ -848,7 +868,7 @@ pub fn eval_bounded_path_hidden_slots(
 /// [`eval_bounded_path_hidden_slots`] with the union stage's randomness drawn
 /// through the [`DistributedRandomness`] seam (sq-yyro, issue #6117). Same routing,
 /// source checks and fail-closed behaviour as
-/// [`eval_exact_k_chain_hidden_slots_through`], including the output stage drawn
+/// `eval_exact_k_chain_hidden_slots_through`, including the output stage drawn
 /// from the SAME `source`; the single-dealer simulation's revealed multiset and
 /// cost are unchanged.
 pub(crate) fn eval_bounded_path_hidden_slots_through(
 
@@ -567,14 +567,14 @@ fn malformed_draws_in_the_or_fold_are_refused() {
     }
 }
 
-/// Under PRSS EVERY shape fails closed, never panics. `{1,2}` needs a hop equality
-/// (a holder's own input shared), which PRSS refuses. Since #6117 step 6 routed the
-/// output stage through the same source, so does `p?` over a single predicate with
-/// no self-loop and no repeated endpoint pair, whose union stage draws nothing: the
-/// output stage always shares the real-row tag and the payload limbs for its `B`
-/// slots, so there is no longer a draw-free shape here. (Before the routing that
-/// case ran, because the output stage minted its own dealer and never touched the
-/// caller's source.)
+/// Under PRSS every shape fails closed for any `B > 0`, never panics. `{1,2}` needs
+/// a hop equality (a holder's own input shared), which PRSS refuses. Since #6117
+/// step 6 routed the output stage through the same source, so does `p?` over a
+/// single predicate with no self-loop and no repeated endpoint pair, whose union
+/// stage draws nothing: the output stage shares the real-row tag and the payload
+/// limbs for each of its `B` slots, so that shape is draw-free only at `B = 0`.
+/// (Before the routing that case ran at any `B`, because the output stage minted
+/// its own dealer and never touched the caller's source.)
 #[test]
 fn prss_fails_closed_on_every_bounded_shape() {
     use crate::prss::PrssRandomness;
@@ -693,23 +693,22 @@ fn seeded_bounded_stage_draws_exactly_what_the_dealer_drew_before_the_seam() {
         ]
     );
     assert_eq!(dealer.draw_fp().value(), 1940071552581823960);
-    // The REVEALED slot ORDER moved in #6117 step 6 (it was
-    // ["<http://ex/a> <http://ex/b>", "<http://ex/b> <http://ex/a>", "dummy",
-    //  "<http://ex/a> <http://ex/a>", "<http://ex/b> <http://ex/b>"]): the output
-    // stage now draws its sharings and its shuffle from the SAME source as the
-    // union stage instead of minting a second dealer, so the shuffle samples a
-    // different point of one continuous keystream. The order is the shuffle's
-    // secret permutation and carries no result meaning — the canonicalised multiset
-    // below is byte-identical to the pre-routing capture.
+    // The REVEALED slot ORDER has moved twice: first in #6117 step 6 (the output
+    // stage draws its sharings and its shuffle from the SAME source as the union
+    // stage instead of minting a second dealer), then again when the output stage's
+    // per-element degree reduction added its re-sharings, so the shuffle samples a
+    // later point of one continuous keystream. The order is the shuffle's secret
+    // permutation and carries no result meaning — the canonicalised multiset below
+    // is byte-identical to the pre-routing capture.
     let (slots, cost) = eval_bounded_path_hidden_slots(&backend, &edges, &form, 5).unwrap();
     assert_eq!(
         slot_strings(&slots),
         [
-            "<http://ex/b> <http://ex/a>",
+            "<http://ex/b> <http://ex/b>",
             "dummy",
+            "<http://ex/a> <http://ex/a>",
             "<http://ex/a> <http://ex/b>",
-            "<http://ex/b> <http://ex/b>",
-            "<http://ex/a> <http://ex/a>"
+            "<http://ex/b> <http://ex/a>"
         ]
     );
     let mut sorted = slot_strings(&slots);
@@ -742,15 +741,16 @@ fn seeded_bounded_stage_draws_exactly_what_the_dealer_drew_before_the_seam() {
 /// order-sensitive fingerprint over every method and returned `y`).
 ///
 /// **This is the #6117-step-6 guard.** The transcript now ends in the output
-/// stage's 36 `vss_own_input` draws and its `oblivious_shuffle`: if
+/// stage's 141 `vss_own_input` draws and its `oblivious_shuffle`: if
 /// `eval_bounded_path_hidden_slots_through` went back to minting its own dealer for
 /// the output stage the log would stop at 1932 entries and both the length and the
 /// suffix assertion would fail.
 ///
 /// The 1932-entry PREFIX is the pre-routing whole-log pin
 /// (`0x690e_cad1_cdf7_7eb0`, captured on the pre-routing code), asserted here
 /// unchanged: the routing appended an output-stage SUFFIX and moved nothing in the
-/// union part. The full-log fingerprint is the new pin.
+/// union part, and the output stage's per-element degree reduction only grew that
+/// suffix. The full-log fingerprint is the new pin.
 #[test]
 fn seeded_bounded_stage_transcript_is_pinned() {
     use crate::randomness::test_sources::{fingerprint, RecordingSource};
@@ -759,13 +759,14 @@ fn seeded_bounded_stage_transcript_is_pinned() {
     let form = HiddenBoundedPath::range("p", 0, 2);
     let mut rec = RecordingSource::new(backend.dealer());
     eval_bounded_path_hidden_slots_through(&mut rec, &backend, &edges, &form, 5).unwrap();
-    assert_eq!(rec.log.len(), 1969);
-    // Prefix unchanged from the pre-routing pin; suffix is the new output stage.
+    assert_eq!(rec.log.len(), 2074);
+    // Prefix unchanged from the pre-routing pin; the whole move is in the output
+    // suffix, which grew by the per-element degree reductions.
     assert_eq!(fingerprint(&rec.log[..1932]), 0x690e_cad1_cdf7_7eb0);
-    assert_eq!(fingerprint(&rec.log), 0x8ac7_aa74_a625_9a25);
+    assert_eq!(fingerprint(&rec.log), 0x9585_8505_1ecb_a85b);
     let suffix: Vec<&str> = rec.log[1932..].iter().map(|(m, _)| *m).collect();
     assert_eq!(
         suffix,
-        [["vss_own_input"; 36].as_slice(), &["oblivious_shuffle"]].concat()
+        [["vss_own_input"; 141].as_slice(), &["oblivious_shuffle"]].concat()
     );
 }