Glossary

anchor — A recent notes root that a spend proves membership against. The pool accepts any of the last 16 settlement roots. Also: the 240-sat pay-to-anchor output of a settlement, spent by a child transaction to bump its fee.

band — The recursion over a settlement’s contributions: band leaves (4 spends each) under band nodes (5 children each), up to four levels.

caboose — A settlement’s 330-sat output that carries the new state hash and the payout commitment, read by the next settlement.

catalog group — A set of deposit coins merged together, with a published catalog of each entry’s record and refund terms. Returned whole to every owner if not settled in time.

commitment — C = H(amount, K), a note’s leaf in the notes tree.

contribution — One payment, deposit or withdrawal: a proof made by a wallet plus its public values. Always two in, two out.

count hiding — Every contribution has the same shape, so the number of real inputs and outputs is hidden.

DA (data availability) — Everything a wallet needs is published in the settlement’s witness, bound to the proof by the fingerprint.

deposit coin — A taproot coin a depositor funds. It can be merged only into a group whose catalog lists its record and refund terms, and cancelled by its owner until then.

deposit inbox — One coin, paying to the pool’s address, that holds a converted group of deposits; the next settlement spends it.

deterministic settlement — A settlement with no funding input and no fee output, whose bytes follow from the proof, so every node builds the same transaction.

drain — Every sixth settlement, which must spend the exit inbox and process its requests.

epoch — The pool’s settlement counter.

exit inbox — A coin anyone can append an exit request to; emptied by every drain.

exit request — A proof of ownership of one note, posted to the exit inbox; paid or voided at the next drain.

fan-out — The transaction that pays a vault out to every withdrawal’s address.

final proof — The one STARK the pool’s script verifies. It proves settle-top.

fingerprint — (r, v): r a SHA-256 hash of the records, v the records evaluated as a polynomial at r. Computed by the script and proved by the circuits, it binds the published records to the proof.

GSR (Great Script Restoration) — BIP-440 (the varops budget) and BIP-441 (the restored opcodes, including OP_CAT), in tapscript leaf version 0xc2.

gsr-net — The GSR authors’ public signet, with 30-second blocks.

handshake record — A payer’s one-time public key, published once with the first payment to a payee, from which both derive every later payment’s note secrets.

leaf (script leaf) — One spending script in a taproot output’s tree. The pool has one per transaction shape.

light client — The wallet’s own checking of Bitcoin headers and settlements, without a full node or a trusted server.

lineage — The check, in every pool leaf, that the pool coin descends from the genesis transaction.

M31 — The field of integers modulo 2³¹ − 1, over which the proofs work.

memo word — A payment record’s data word: the amount, padded with a value only the payee can derive.

note — (amount, pk, rho, r); a private IOU in the pool.

nullifier — nf = H(sk, rho, position), published when a note is spent.

nullifier tree — An indexed (sorted) Merkle tree of nullifier keys. A spend proves its nullifier is absent, then inserts it.

pay key — A prover’s one-time key for one settlement, which payroll pays.

payment code — A wallet’s address (chs1…, tchs1… on test networks), from which a payer can derive notes the payee finds from their seed.

payout — A withdrawal’s amount and destination, published as a record and paid by the vault.

payroll — The step that pays a settlement’s provers in notes, six settlements later.

pin / re-pin — The fixed identity of every circuit; redoing them, and so the pool’s address, after a circuit change.

pool coin — The one taproot output that holds all private value.

Poseidon2 — The hash used inside the proofs, cheap over M31.

proving job — One piece of a settlement’s proof, done by one prover.

record — The 92 bytes a settlement publishes for each contribution (and for layer events such as payouts and handshakes).

roots — The pool’s state: both tree roots and both next-free counters, hashed to roots_h.

round — One reading of the share chain per Bitcoin block, which fixes a batch.

settle-top — The circuit that joins the band top and the DA top into the settlement’s statement.

settlement — One Bitcoin transaction that proves a batch and spends the pool coin into its successor.

share — A message on the share chain carrying at least one proving job’s result.

share chain — The chain of shares between nodes that fixes each round’s batch and credits proving work. It holds no value.

solo exit — A one-note withdrawal proved and sent by its owner alone, spending the pool coin directly.

spend proof — The STARK a wallet makes for one contribution.

stand-in verifier — A test-only script that accepts without checking, for measuring sizes and running the covenant without proving.

STARK — A hash-based proof system with no trusted setup. Cheshire’s are Circle STARKs over M31, made with a fork of stwo.

supply check — A node’s check that the notes it knows never add up to more than the pool’s value.

tapleaf 0xc2 — The tapscript leaf version under which GSR’s rules apply.

vault — The settlement output holding all payouts, paid out by one fan-out transaction.

varops — BIP-440’s per-transaction budget for script work.