[odraccir1]

Even-degree polynomial X-norm recovery previously used Tonelli–Shanks, requiring nonresidue searches and modular exponentiations whose exponent sizes grow with the factor degree. This change uses a weighted Frobenius trace when modular composition is enabled.

• Add frobenius_weighted_sum, using binary doubling with O(log d) compositions and products, shared composition caches, and alias-safe output.

• Add even-degree square-root recovery of X modulo an irreducible polynomial. Reuse the existing characteristic-sized seed computation and reduce final root extraction to the coefficient field.

• Try the constant representative first. If its trace vanishes, sample through the caller’s generator while reusing the seed and Frobenius image.

• Integrate the new path into X-norm reconstruction, retaining Tonelli–Shanks when modular composition is disabled.

  The implementation documents its mathematical invariants and irreducibility precondition. Tests cover agreement with direct calculations and Tonelli–Shanks, zero-trace retries, aliasing, nonmonic divisors, invalid inputs, generator exceptions, and multiple arithmetic backends.

  Clean, single-core x86 measurements using BN254 Fp12 and the small-prime backend:

   Factor degree             Complete norm recovery

              22                             69.79 s → 0.120 s — 583× faster
             708                            19.24 s
             786                             21.46 s
           1,110                             47.16 s
           1,248                            51.96 s
          14,028                             49m 6s

Measurements used an AMD EPYC 9454 and GCC 15.2. Smaller cases report three-trial medians; degree 14,028 has one clean trial. Every replay passed exact norm, degree-bound, and modular-root checks. Large-degree baseline comparisons were not run, so those rows report absolute recovery times rather than speedup ratios.