Summary

Adds a per-transaction prefix_hash (SHA-256 of the leading prefix bytes of txs' data) and folds it into each data ledger's tx_root, so an indexer or light client holding only the block-signature-sealed tx_root can trust every transaction's prefix_hash — and the canonical tags it commits to — without verifying any individual transaction's signature. A verifier reconstructs the folded root from each tx's (data_root, prefix_hash) and compares it to the signed tx_root.

This is a softfork: no block-header field is added and the signed block preimage is unchanged. The only changes are (a) the data-transaction format — header_size is renamed to prefix_size and a signed prefix_hash: H256 field is added — and (b) how tx_root is derived. Empty ledgers still fold to H256::zero(), so no existing block's tx_root changes meaning. The leaf formula, hash_all_sha256([data_root, prefix_hash]), matches the gateway's, so cross-implementation tx_root reconstruction holds.

Design notes

Folding changes each tx_root leaf from data_root to hash_all_sha256([data_root, prefix_hash]). Because validate_path returns the leaf's stored hash, a tx_path proof no longer yields the raw data_root — and the node previously read data_root straight out of that leaf in three places. Each now recovers the real data_root from an independent source and re-verifies it against the proof leaf via the same fold, so the two can never silently diverge:

• tx_root enforcement (prevalidate_block) — recomputes each ledger's tx_root from the included txs' folded leaves and rejects TxRootMismatch. This is what makes the block signature transitively authenticate every prefix_hash.
• PoA data-ledger branch (poa_is_valid) — recovers the recall chunk's owning transaction (in-memory block_tree for tip blocks, else the DB), binds the tx_path leaf to fold(data_root, prefix_hash), and validates the data_path against the real data_root.
• Storage retrieval (get_chunk_by_offset / get_chunk_metadata) — recovers data_root from a new per-submodule table TxLeafBindingByTxPathHash (tx_path_hash → {data_root, prefix_hash}), cross-checked against the proof leaf via the fold. (Additive table — created empty on open, no data migration.)

The fold lives in one place — DataTransactionLedger::fold_tx_root_leaf — and every consumer (block production, validation recompute, the PoA binding, and the storage check) delegates to it.

Test plan

• cargo clippy --workspace --tests and cargo fmt --all clean.
• types — fold is load-bearing (changing a tx's prefix_hash changes tx_root); compute_tx_root == merklize_tx_root root; an indexer can reconstruct tx_root from (data_root, prefix_hash); the fold is byte-identical to hash_all_sha256 (gateway-compat guard); prefix_size/prefix_hash are covered by the tx signature.
• block validation — a block whose tx_root doesn't match its txs is rejected with TxRootMismatch; valid blocks pass.
• PoA — existing data-ledger PoA suites pass, including the block_tree fallback (data_poa_at_tip_validates_via_block_tree_fallback) and migration-depth-2 (spiky_heavy_mine_ten_blocks_with_migration_depth_two); a tampered leaf is rejected.
• chunk serving / wire — end-to-end retrieval (spiky_heavy_api_end_to_end_test_32b) and the full p2p gossip-fixture suite pass.

🤖 Generated with Claude Code