Honest prover maintains the field-value claim

Base case $t=T$: if $n\ge 1$ then $N_T=O_1$, so by [A3] the constant $G_T=O_1(G_{T-1})$ has no variables at all and the empty point ${\sigma }_T$ assigns all of its variables vacuously; by [L1] and the hypothesis that $\mathrm{\Phi }$ is true, $c_T=1=G_T({\sigma }_T)$. If $n=0$ there are no rounds, $T=0$, $\sigma$ is empty and the terminal test reads $1=b$, which holds by [L1] because $b=G_0=G_T=1$.

Induction hypothesis: for some $t$ with $1\le t\le T$, the point ${\sigma }_t$ assigns a value to every variable occurring in $G_t$ and $c_t=G_t({\sigma }_t)$; let $M=N_t$ be the round-$t$ node with active variable $x_i$.

Write $q(X)$ for the restriction of $G_{t-1}$ to the current point in the active variable $X$, so that $q$ is the honest message of round $t$ by [A2]. By [A3], $G_{t-1}$ involves only the variables in its block prefix, and the reverse protocol schedule has assigned every one except the active variable, whether or not some of them disappeared from $G_t$ through polynomial cancellation. Thus the restriction is a well-defined univariate polynomial with field values at $0,1$. By [A2] its degree is at most $D$, so the message is legal.

If $M=O_j$, then $G_{t-1}=M_j$, and [A4] gives $G_t({\sigma }_t)=(G_{t-1}{\mathrm{\mid }}_{x_j=0})({\sigma }_t)\cdot (G_{t-1}{\mathrm{\mid }}_{x_j=1})({\sigma }_t)$ when $Q_j=\mathrm{\forall }$ and $G_t({\sigma }_t)=1-(1-(G_{t-1}{\mathrm{\mid }}_{x_j=0})({\sigma }_t))(1-(G_{t-1}{\mathrm{\mid }}_{x_j=1})({\sigma }_t))$ when $Q_j=\mathrm{\exists }$, which are exactly $q(0)q(1)$ and $q(0)+q(1)-q(0)q(1)$. If $M=R_{X_i}$, then [A4] gives $G_t({\sigma }_t)=(1-a)(G_{t-1}{\mathrm{\mid }}_{x_i=0})({\sigma }_t)+a(G_{t-1}{\mathrm{\mid }}_{x_i=1})({\sigma }_t)$ with $a={\sigma }_t(i)$, that is $G_t({\sigma }_t)=(1-a)q(0)+aq(1)$. In both cases the value the verifier computes from the message equals $G_t({\sigma }_t)=c_t$ by step 1.2, so the round-$t$ test passes.

Let $r=r_t$ be the challenge of round $t$ and let ${\sigma }_{t-1}$ and $c_{t-1}$ be the point and claim after the round. By [A1] the verifier sets the active variable to $r$, leaving every other value of ${\sigma }_t$ unchanged, and $c_{t-1}=q(r)$; by the definition of $q$, this is $G_{t-1}$ evaluated at ${\sigma }_{t-1}$. The schedule in [A3] ensures that after this update every variable of $G_{t-1}$ is assigned, including when variables were absent from $G_t$ because they cancelled in a preceding operator. Therefore the induction hypothesis holds at $t-1$, which completes the induction step and ensures the next honest message is legal by step 1.3.

Descending induction from the base case of step 1.1 gives $c_t=G_t({\sigma }_t)$ for every $t=T,\dots ,1$. At the end of round $1$ the point ${\sigma }_0$ assigns every variable occurring in $G_0=b$ by the statement of claim 2, so the terminal comparison is $c_0=b({\sigma }_0)$ and it passes; all earlier tests passed by step 2.1. This proves claims 1, 2 and 3, including the case $n=0$ handled in step 1.1.