Final Recap

This chapter follows one spend from a wallet's note to a block and names the chapter that explains each part, so that you can see how the site's pieces connect and return to whichever one you want to reread. It adds no protocol content. The derivations, the numbers, and the arguments about cheating all stay in the linked chapters.

1. The spend we follow

Alice holds a note from Bob, created in epoch 3 and spent with target epoch 7. Her bundle has one spend and one output to Carol, and chapter 22's run carries it as far as a published stamp. All of the values live in those chapters' tables, and most of them come from stand-in hashes rather than real Poseidon outputs.

Chapter 23 uses bundles of its own for its numbers. Its bundle Y also has one spend and one output, so you can read Y as standing in for Alice's bundle in that chapter.

Sections 2 to 6 and Section 8 follow the spend through Tachyon. Section 7 pauses at one node of the proof tree to go through the proof system underneath it, and Section 9 collects every layer in a table.

2. The note reaches Alice

Alice's wallet derives two children from its spending key, namely $\mathsf{ask}$ for authorizing spends and $\mathsf{nk}$ for deriving nullifiers. Bob needs a way to name her as the owner without learning $\mathsf{nk}$, so she gives him a payment key, which is a hash of $\mathsf{ak}$ and $\mathsf{nk}$.

Bob then forms the note $(\mathsf{pk},v,\psi ,\mathsf{rcm})$ and its commitment $\mathsf{cm}$. Alice has to learn all four fields, and Tachyon leaves that to a payment protocol outside the shielded protocol, which is what frees her wallet from trial-decrypting all traffic. Her wallet should also compare the note against her others, because a sender who reuses $\psi$ can make one of her notes unspendable.

3. The pool records the commitment

Bob's stamp publishes $\mathsf{cm}$ as a tachygram, the single kind of value that covers both commitments and nullifiers. Validators will eventually forget that tachygram, yet Alice has to prove facts about it later, so the pool keeps a short reference to it.

The stamp's tachygrams become the roots of a polynomial, a Pedersen commitment shrinks that polynomial to one point, and a Poseidon hash chain absorbs the point together with the block's epoch. A boundary digest joins each epoch to the next. The chain's state is the anchor, and chapter 22's pool history lists the anchors this note lives through. A proof can witness history freely, because one consensus check at the far end pins every earlier state.

4. What the spend has to show

Alice's nullifiers come from a master key $\mathsf{mk}$ and a sponge that gives a different value for each epoch, and the commitment pins them, so she has no choice about their values. Validators hold only two epochs of tachygrams, which divides her double-spend obligations in two:

• She proves ${\mathsf{nf}}_j$ absent from epoch $j$ for each of the closed epochs 3 to 6, since validators no longer hold all of that history.
• She publishes ${\mathsf{nf}}_7$ and ${\mathsf{nf}}_8$. The spend might land in its target epoch or the next, and publishing the pair means that a spend accepted in epoch $a$ always puts ${\mathsf{nf}}_a$ into epoch $a$, where a later test will find it.

The proof makes no claim about epoch 7 itself, because the window covers it.

5. The sync service tests old nullifiers

Testing absence means reading whole epochs, which is the work wallets were supposed to stop doing. Alice can hand it to a service because each epoch's value is unrelated to the others. She sends explicit values and no key, and she has to keep ${\mathsf{nf}}_7$ and ${\mathsf{nf}}_8$ out of every request.

An epoch's polynomial is too large to open directly, so a builder routes its tachygrams into buckets by quadratic-residue profile. Each bucket's seal computes the crossing, so that it covers the whole epoch. The service then opens the matching bucket at the value and composes the results into a segment, an ArbitraryUnspent proof that names no note.

Chapter 22's segments give the service all four epochs and use one bucket per epoch to keep the numbers short, while chapter 21's run delegates a narrower range. Both are choices of example, and a wallet may run these steps itself.

6. The wallet builds the proof tree

Alice's wallet now combines its secrets with the service's segments, working up the tree one step at a time:

1. NoteSeed pairs $\mathsf{cm}$ with $\mathsf{mk}$, and NullifierDerive commits a window of (epoch, nullifier) pairs as a product of irreducible cubic factors.
2. UnspentBind divides the service's polynomial out of that window, using a factor that carries its epoch. This is the first point at which the service's work belongs to a note.
3. QrSpendableInit consumes the test of epoch 3 and finds $\mathsf{cm}$ in that epoch's bucket, and SpendableLift moves the lineage to the entry anchor of epoch 7.
4. SpendBind derives ${\mathsf{nf}}_7$, ${\mathsf{nf}}_8$, and the value commitment, and SpendAction derives the randomized key $\mathsf{rk}$ and builds the action and tachygram sets.
5. OutputBind and OutputAction create Carol's note, with the same header type and two tachygrams.
6. ActionLift and ActionMerge bring the two actions to one anchor and combine them.
7. FeeFuse applies a fee chosen after signing, and turns Actions into a Stamp exactly once.
8. StampLift moves the stamp to a later anchor in epoch 7.

The whole tree appears in chapter 22, which flags its exact mix of steps as its own reconstruction. Two facts remain outside the proof. A signature under $\mathsf{rk}$ requires $\mathsf{ask}$, which lets a custody device hold the key while another device proves. Since no step adds up values, a binding signature shows that the bundle balances.

7. What one fuse proves

Every node in that tree is one call to fuse, which runs a step on two child proofs and emits a header and a proof. Take SpendBind as the node, and follow what its proof has to contain.

Its step first becomes gates and linear constraints, which random powers reduce to one consolidated equation. Ragu reads that equation as one coefficient of a polynomial product, where a QAP would use a quotient by a vanishing polynomial. The prover commits to its polynomials, and many evaluation claims batch into one, which an inner product argument can open. Random checks and Fiat–Shamir remove the interaction, and chapter 9 assembles these parts into one complete proof.

That proof leaves the verifier two linear costs, computing $s(x,y)$ and computing $\hat{G}$. The node has to verify its children inside its own circuit, and those costs block this. So the rest of the proof system moves that work out of the circuit, along with the checks that read whole vectors:

• Accumulation turns $\hat{G}$ into a claim that travels with the proof and merges with others, and splitting the accumulator keeps its witness out of the circuit, so a fuse runs no inner product argument.
• Revdot folding carries the product claims forward in the same way.
• The registry replaces $s(x,y)$ with claims about one polynomial holding every circuit, so a node pays only for the step it chooses.
• The Pasta cycle lets each side handle the other's points natively, endoscalars carry challenges across it, and stages let circuits share data.

Chapter 18 assembles these into many small internal circuits. Three accumulators per side pass up the tree, and each fuse replaces two of each with one, so SpendBind's proof has the same shape as the proof at the top.

A proof that leaves the tree goes through compression, which replaces its polynomials with commitments and a few values and finishes with an inner product argument on each curve. Its verifier pays the deferred linear costs once, and Section 14 of that chapter gives the size.

8. From the stamp to a block

Alice's wallet publishes her bundle as an autonome. On the wire, her signatures cover only effecting data, so the stamp in the trailer can change without invalidating them. A miner could include the bundle as it stands, and a validator would rebuild its header from published data.

An aggregator may instead merge it with other stamps. The aggregator lifts its inputs to one anchor and keeps them disjoint, and it needs none of Alice's secrets, because its steps read only commitments and published values. If a block mines one of the inputs first, StampUnmerge divides it out.

A miner then strips each covered bundle, so Alice's bundle keeps its body and fee and gains a pointer to the aggregate's wtxid. Its txid half stays stable through all of this, so her wallet can still recognize it.

The block's validators then run the checks on the aggregate, covering signatures, pointers, coverage, the tachygram count, the set commitment, and the proof. They also run the consensus rules, which look up the anchor, require its epoch to be current or preceding, check each tachygram against the window, and absorb the commitment into the chain. Finding the anchor closes the free witnesses below it.

Alice's ${\mathsf{nf}}_7$ and ${\mathsf{nf}}_8$ are now in the pool, and a second spend of this note runs into either the window or the exclusion proof.

9. The layers and their chapters

The table lists the layers in the order that the trace meets them.

10. What exists at the pinned commits

The trace reads as one working system, but its parts have very different status, and each chapter's warnings give the details.

What we read as code. Ragu at 3219e08 contains fuse, compress, and their verifiers, although we did not build or run it or run its benchmarks. The Tachyon crate contains the proof steps, written as native step bodies, the fold functions, the wire format, and a Bundle::verify for one covering bundle.

What the sources describe and we did not find in code.

• No real Tachyon circuits. The crate builds against a mock of Ragu at 0725b52, whose fuse runs a step natively, discards the polynomial openings, and does not verify child proofs.
• No validator and no mempool. The window and the anchor lookup appear only in the book and in doc comments, and block assembly and transaction-level balance appear only in the book and in tests.
• No normative specification. The shielded protocol, accumulator, syncing service, and bundle and aggregator ZIPs are empty outlines.
• No wallet check for reused trapdoors in the crate.

What remains open in the design.

• Zero knowledge and unlinkability are not yet established, although the Tachyon book assumes them.
• Decompression has not landed, so a compressed proof cannot be fused today, and an aggregator's real costs are unknown.
• The sources differ on which anchors consensus accepts and where the crossing sits.
• Service privacy measures, fee levels and aggregator payment, and per-note proving delegation are unspecified or unsettled.
• The comparison with Orchard is an estimate, and real proof size is not settled for Tachyon.

11. Where this chapter leaves us

This chapter took the following steps:

1. A note enters the pool as a tachygram, and the pool refers to it through a polynomial commitment absorbed into a hash chain.
2. A spend proves absence for closed epochs, with help from a service that does not know the note, and it publishes a nullifier pair for the window to check.
3. Each step of the wallet's tree is one fuse, and Ragu's accumulators keep the proof the same shape at every depth.
4. A stamp can pass through an aggregator and a miner without disturbing what Alice signed, and validators check the result against the anchor chain.
5. All of this is a design at fixed commits, with mock proofs on the Tachyon side and no validator, and any later commit may differ.

This is the last chapter. The glossary, the notation page, and the curves appendix remain as references.