@aztec/stdlib 5.0.0-nightly.20260713 → 5.0.0-nightly.20260715

package/src/gas/README.md

@@ -1,47 +1,69 @@
 # Aztec Gas and Fee Model
 
 The minimum fee per mana and its components are computed on L1 in
-`l1-contracts/src/core/libraries/rollup/FeeLib.sol`. This document describes the
-formulas, the oracle lag/lifetime mechanism, and the TypeScript types in this directory.
+`l1-contracts/src/core/libraries/rollup/FeeLib.sol` (`fee_math.ts` in this directory is a
+TypeScript port of those formulas, used to predict fees a few slots ahead). This document
+describes the formulas, the oracle lag/lifetime mechanism, how a transaction's fee is
+derived from them, the gas and data limits, and the TypeScript types in this directory.
 
 ## Mana
 
-Aztec uses **mana** as its unit of work (analogous to Ethereum gas). Transactions consume
-mana in two dimensions: **DA** (data availability) and **L2** (execution). The total fee
-is `gasUsed * feePerMana` summed across both dimensions.
+Aztec meters work as gas in two dimensions: **DA** (data availability, i.e. blob data
+published to L1) and **L2** (execution). The L2 dimension is called **mana** (analogous to
+Ethereum gas): block headers track `totalManaUsed`, and the fee model below prices one unit
+of mana. The total fee is `gasUsed * feePerGas` summed across both dimensions.
+
+### The DA dimension is priced at zero
+
+Only the L2 dimension currently carries a price. When building checkpoint global variables,
+the sequencer sets `feePerDaGas = 0` and sets `feePerL2Gas` to the L1-computed minimum fee
+per mana (`sequencer-client/src/global_variable_builder/global_builder.ts` and
+`fee_provider.ts` in the same directory). The cost of publishing data is still recovered:
+the blob gas a checkpoint pays on L1 is part of the *sequencer cost* component of the mana
+fee below. DA gas remains fully metered and limited (see
+[Gas and Data Limits](#gas-and-data-limits)) — it bounds how much data a tx or checkpoint
+may publish — it just contributes nothing to the fee today.
 
 ## Fee Components
 
-The minimum fee per mana has four components:
+The minimum fee per mana has four components. All are computed in ETH (wei) per mana and
+converted to the fee asset at the end (see [Fee Asset Price](#fee-asset-price)).
 
 ### Sequencer Cost
 
 L1 cost to propose a checkpoint (calldata gas + blob data), amortized over `manaTarget`:
 
 ```
-sequencerCost = ((L1_GAS_PER_CHECKPOINT_PROPOSED * baseFee)
+sequencerCost = ceil(((L1_GAS_PER_CHECKPOINT_PROPOSED * baseFee)
               + (BLOBS_PER_CHECKPOINT * BLOB_GAS_PER_BLOB * blobFee))
-              / manaTarget
+              / manaTarget)
 ```
 
+Note that `BLOBS_PER_CHECKPOINT` here is FeeLib's own constant (3), not the protocol blob
+capacity of the same name (6) — see the note under [Key Constants](#key-constants).
+
 ### Prover Cost
 
 L1 cost to verify an epoch proof, amortized over epoch duration and `manaTarget`, plus a
 governance-set proving cost that compensates for off-chain proof generation:
 
 ```
-proverCost = (L1_GAS_PER_EPOCH_VERIFIED * baseFee / epochDuration) / manaTarget
+proverCost = ceil(ceil((L1_GAS_PER_EPOCH_VERIFIED * baseFee) / epochDuration) / manaTarget)
            + provingCostPerMana
 ```
 
+Updates to `provingCostPerMana` are rate-limited on L1 (`FeeLib.updateProvingCostPerMana`):
+at most one update every 30 days, each moving the value by at most ×1.5 (or ÷1.5), with a
+floor of 2 wei per mana.
+
 ### Congestion Cost
 
 An exponential surcharge when the network is congested (inspired by EIP-1559; the
 implementation uses the `fakeExponential` Taylor series approximation from EIP-4844):
 
 ```
-baseCost          = sequencerCost + proverCost
-congestionCost    = baseCost * congestionMultiplier / MINIMUM_CONGESTION_MULTIPLIER - baseCost
+baseCost       = sequencerCost + proverCost
+congestionCost = floor(baseCost * congestionMultiplier / MINIMUM_CONGESTION_MULTIPLIER) - baseCost
 ```
 
 When there is no congestion the multiplier equals `MINIMUM_CONGESTION_MULTIPLIER` (1e9)
@@ -50,11 +72,15 @@ and congestion cost is zero.
 ### Congestion Multiplier
 
 ```
-excessMana          = max(0, prevExcessMana + prevManaUsed - manaTarget)
-congestionMultiplier = fakeExponential(MINIMUM_CONGESTION_MULTIPLIER, excessMana, denominator)
+excessMana           = max(0, prevExcessMana + prevManaUsed - manaTarget)
+denominator          = manaTarget * 854,700,854 / 1e8    ≈ 8.547 * manaTarget
+congestionMultiplier = fakeExponential(MINIMUM_CONGESTION_MULTIPLIER,
+                                       min(excessMana, 100 * denominator), denominator)
 ```
 
-Each additional `manaTarget` of excess mana increases the multiplier by ~12.5%.
+Each additional `manaTarget` of excess mana multiplies the fee by `e^(1/8.547) ≈ 1.124`,
+i.e. ~12.5%. The exponent is capped at 100 (multiplier ≤ ~2.7e43 × the minimum) to keep
+the Taylor series from overflowing.
 
 ### Total
 
@@ -62,6 +88,11 @@ Each additional `manaTarget` of excess mana increases the multiplier by ~12.5%.
 minFeePerMana = sequencerCost + proverCost + congestionCost
 ```
 
+Each component is converted from ETH to the fee asset individually (rounding up) before
+summing. The sum is capped at `type(uint128).max` (`FeeLib.summedMinFee`) so it always fits
+the proposal header's `feePerL2Gas` field — without the cap, extreme congestion could
+produce a fee no valid header can represent, halting the chain.
+
 ## L1 Gas Oracle: Lag and Lifetime
 
 The oracle feeds Ethereum's `baseFee` and `blobFee` into the fee model using a two-phase
@@ -70,9 +101,9 @@ The oracle feeds Ethereum's `baseFee` and `blobFee` into the fee model using a t
 - **LAG = 2 slots** — when new L1 fees are observed, they activate `LAG` slots later
   (`slotOfChange = currentSlot + LAG`). This gives mempool transactions time to land
   before fees change.
-- **LIFETIME = 5 slots** — after an oracle update, the next update is rejected until
-  `slotOfChange + (LIFETIME - LAG)` = 3 more slots have passed. This rate-limits how
-  frequently L1 fee data can change.
+- **LIFETIME = 5 slots** — after an oracle update, further updates are ignored
+  (`updateL1GasFeeOracle` returns without effect) until `slotOfChange + (LIFETIME - LAG)`
+  = 3 more slots have passed. This rate-limits how frequently L1 fee data can change.
 
 Fee resolution at a given timestamp:
 
@@ -84,6 +115,12 @@ else                    →  use post (new fees)
 **Net effect**: L1 fee changes reach L2 with a 2-slot delay and can update at most once
 every 5 slots.
 
+Because queued values only activate `LAG` slots later, the min fee for the next `LAG`
+slots is fully determined by current on-chain state. `fee_math.ts` ports the FeeLib
+formulas so the sequencer can predict min fees over that window (`FeePredictor` in
+`sequencer-client/src/global_variable_builder`), under a configurable mana-usage
+assumption (`ManaUsageEstimate`: none / target / limit).
+
 ### Worked Example
 
 Suppose the oracle is updated at slot 10 with new L1 fees. Here is the timeline:
@@ -117,34 +154,68 @@ Key observations:
 
 ## Fee Asset Price
 
-Fees are computed in ETH internally but converted to the fee asset (Fee Juice) via
-`ethPerFeeAsset` (1e12 precision). The price updates at most ±1% (±100 bps) per
-checkpoint:
+Fees are computed in ETH (wei) internally and converted to the fee asset (Fee Juice) via
+`ethPerFeeAsset` (1e12 precision), rounding up (`PriceLib.toFeeAsset` in
+`l1-contracts/src/core/libraries/compressed-data/fees/FeeConfig.sol`).
+
+Each checkpoint proposal carries a fee-asset price modifier (`OracleInput`) chosen by the
+proposer, bounded to ±1% (±100 bps) per checkpoint:
 
 ```
 newPrice = currentPrice * (10000 + modifierBps) / 10000
 ```
 
+The result is clamped to [`MIN_ETH_PER_FEE_ASSET` = 100, `MAX_ETH_PER_FEE_ASSET` = 1e14],
+i.e. 1e-10 to 100 ETH per fee asset. The floor of 100 guarantees a ±1% step always moves
+the integer price by at least 1.
+
+## Transaction Fees
+
+The checkpoint's `gasFees` (the L1-computed min fee per mana, with DA priced at zero) act
+as a base fee. Senders declare `GasSettings`: gas limits, teardown gas limits,
+`maxFeesPerGas`, and `maxPriorityFeesPerGas`. A tx is only includable if `maxFeesPerGas`
+covers the checkpoint's `gasFees` in both dimensions. The effective fee adds an
+EIP-1559-style priority fee on top of the base, capped by the max
+(`computeEffectiveGasFees` in `stdlib/src/fees/transaction_fee.ts`):
+
+```
+effectiveFeePerGas = gasFees + min(maxPriorityFeePerGas, maxFeesPerGas - gasFees)   (per dimension)
+transactionFee     = billedGas.daGas * effectiveFeePerDaGas + billedGas.l2Gas * effectiveFeePerL2Gas
+```
+
+`billedGas` is actual consumption except for the teardown phase, which is billed at the
+declared `teardownGasLimits` rather than actual usage — the fee is charged during teardown
+itself, before actual teardown consumption is known.
+
 ## Maximum Fee Change Rate
 
-| Component              | Bound                                                   |
-| ---------------------- | ------------------------------------------------------- |
-| L1 base fee / blob fee | At most once every 5 slots (oracle LIFETIME)            |
-| Fee asset price        | ±1% per checkpoint                                      |
+| Component              | Bound                                                    |
+| ---------------------- | -------------------------------------------------------- |
+| L1 base fee / blob fee | At most once every 5 slots (oracle LIFETIME)             |
+| Fee asset price        | ±1% per checkpoint                                       |
+| Proving cost per mana  | At most ×1.5 (or ÷1.5) per update, one update per 30 days |
 | Congestion multiplier  | Depends on excess mana accumulation/drain per checkpoint |
-| Sequencer/prover costs | Scale linearly with L1 fees                             |
+| Sequencer/prover costs | Scale linearly with L1 fees                              |
 
 ## Key Constants
 
-| Constant                       | Value          |
-| ------------------------------ | -------------- |
-| `L1_GAS_PER_CHECKPOINT_PROPOSED` | 300,000      |
-| `L1_GAS_PER_EPOCH_VERIFIED`     | 3,600,000    |
-| `BLOBS_PER_CHECKPOINT`          | 3            |
-| `BLOB_GAS_PER_BLOB`             | 2^17         |
-| `MINIMUM_CONGESTION_MULTIPLIER` | 1e9          |
-| `LAG`                           | 2 slots      |
-| `LIFETIME`                      | 5 slots      |
+| Constant                        | Value          |
+| ------------------------------- | -------------- |
+| `L1_GAS_PER_CHECKPOINT_PROPOSED` | 300,000       |
+| `L1_GAS_PER_EPOCH_VERIFIED`     | 3,600,000      |
+| `BLOBS_PER_CHECKPOINT` (FeeLib) | 3              |
+| `BLOB_GAS_PER_BLOB`             | 2^17           |
+| `MINIMUM_CONGESTION_MULTIPLIER` | 1e9            |
+| `LAG`                           | 2 slots        |
+| `LIFETIME`                      | 5 slots        |
+| `MIN_ETH_PER_FEE_ASSET`         | 100 (1e-10 ETH) |
+| `MAX_ETH_PER_FEE_ASSET`         | 1e14 (100 ETH) |
+
+⚠️ Name clash: `FeeLib.sol` (and its port `fee_math.ts`) defines `BLOBS_PER_CHECKPOINT = 3`,
+used only to price the sequencer's blob costs. The protocol constant of the same name in
+`@aztec/constants` is **6** — the actual blob capacity of a checkpoint, used throughout the
+limits section below. The FeeLib value is a holdover from the pre-checkpoint
+`BLOBS_PER_BLOCK`, so the fee model prices half of a full checkpoint's blobs.
 
 ## Gas and Data Limits
 
@@ -196,7 +267,7 @@ advertises them in `NodeInfo.txsLimits` (a required field); wallets read it and
 `GasSettings.fallback` as the default gas limits when sending without explicit limits, and they are enforced
 by `GasLimitsValidator` (clamped to the per-tx protocol maxima) at three points: RPC tx acceptance
 (`aztec-node/src/aztec-node/server.ts`), gossip validation (`p2p/src/services/libp2p/libp2p_service.ts`),
-and pending-pool admission (`p2p/src/client/factory.ts`). They are deliberately *not* enforced at reqresp or
+and pending-pool admission (`p2p/src/client/factory.ts`). They are deliberately *not* enforced at req/resp or
 block-proposal validation — admission is relay policy, not block validity.
 
 ### Per-block builder budgets
@@ -240,7 +311,8 @@ The outermost limits, enforced as proposal validity in `validateCheckpointLimits
 
 ## TypeScript Types
 
-- **`Gas`** — mana quantity in two dimensions (`daGas`, `l2Gas`).
+- **`Gas`** — gas quantity in two dimensions (`daGas`, `l2Gas`).
 - **`GasFees`** — per-unit price in each dimension (`feePerDaGas`, `feePerL2Gas`).
 - **`GasSettings`** — sender-chosen fee parameters: gas limits, teardown limits, max fees, priority fees.
 - **`GasUsed`** — actual consumption after execution. Note: `billedGas` uses the teardown gas *limit*, not actual usage.
+- **`fee_math.ts`** — TypeScript port of the FeeLib formulas, used for fee prediction over the oracle LAG window.

package/src/interfaces/private_kernel_prover.ts

@@ -10,8 +10,8 @@ import type {
   PrivateKernelInner3CircuitPrivateInputs,
   PrivateKernelInnerCircuitPrivateInputs,
   PrivateKernelResetCircuitPrivateInputs,
+  PrivateKernelResetTailCircuitPrivateInputs,
   PrivateKernelSimulateOutput,
-  PrivateKernelTailCircuitPrivateInputs,
   PrivateKernelTailCircuitPublicInputs,
 } from '../kernel/index.js';
 import type { ChonkProofWithPublicInputs } from '../proofs/chonk_proof.js';
@@ -166,23 +166,21 @@ export interface PrivateKernelProver {
   ): Promise<PrivateKernelSimulateOutput<PrivateKernelCircuitPublicInputs>>;
 
   /**
-   * Creates a proof output based on the last inner kernel iteration kernel data for the final ordering iteration.
+   * Creates a proof output for the terminal reset+tail step. Dispatches to the rollup-bound or
+   * public-bound family based on `inputs.isForPublic()`.
    *
-   * @param privateKernelInputsTail - The private input data structure for the final ordering iteration.
-   * @returns A Promise resolving to a ProofOutput object containing public inputs and the kernel proof.
+   * @param privateKernelInputs - Reset hints, dimensions, and tail params.
+   * @returns A Promise resolving to a ProofOutput containing the tail-shaped public inputs.
    */
-  generateTailOutput(
-    privateKernelInputsTail: PrivateKernelTailCircuitPrivateInputs,
+  generateResetTailOutput(
+    privateKernelInputs: PrivateKernelResetTailCircuitPrivateInputs,
   ): Promise<PrivateKernelSimulateOutput<PrivateKernelTailCircuitPublicInputs>>;
 
   /**
-   * Executes the final ordering iteration circuit.
-   *
-   * @param privateKernelInputsTail - The private input data structure for the final ordering iteration.
-   * @returns A Promise resolving to a ProofOutput object containing public inputs an empty kernel proof.
+   * Simulates the terminal reset+tail step without generating a proof.
    */
-  simulateTail(
-    privateKernelInputsTail: PrivateKernelTailCircuitPrivateInputs,
+  simulateResetTail(
+    privateKernelInputs: PrivateKernelResetTailCircuitPrivateInputs,
   ): Promise<PrivateKernelSimulateOutput<PrivateKernelTailCircuitPublicInputs>>;
 
   generateHidingToRollupOutput(

package/src/interfaces/proving-job.ts

@@ -1,5 +1,5 @@
 import {
-  AVM_V2_PROOF_LENGTH_IN_FIELDS_PADDED,
+  AVM_V2_PROOF_LENGTH_IN_FIELDS,
   NESTED_RECURSIVE_PROOF_LENGTH,
   NESTED_RECURSIVE_ROLLUP_HONK_PROOF_LENGTH,
   RECURSIVE_PROOF_LENGTH,
@@ -204,7 +204,7 @@ export type ProvingJobInputsMap = {
 export const ProvingJobResult = z.discriminatedUnion('type', [
   z.object({
     type: z.literal(ProvingRequestType.PUBLIC_VM),
-    result: RecursiveProof.schemaFor(AVM_V2_PROOF_LENGTH_IN_FIELDS_PADDED),
+    result: RecursiveProof.schemaFor(AVM_V2_PROOF_LENGTH_IN_FIELDS),
   }),
   z.object({
     type: z.literal(ProvingRequestType.PUBLIC_CHONK_VERIFIER),
@@ -319,7 +319,7 @@ export const ProvingJobResult = z.discriminatedUnion('type', [
 ]);
 export type ProvingJobResult = z.infer<typeof ProvingJobResult>;
 export type ProvingJobResultsMap = {
-  [ProvingRequestType.PUBLIC_VM]: RecursiveProof<typeof AVM_V2_PROOF_LENGTH_IN_FIELDS_PADDED>;
+  [ProvingRequestType.PUBLIC_VM]: RecursiveProof<typeof AVM_V2_PROOF_LENGTH_IN_FIELDS>;
   [ProvingRequestType.PUBLIC_CHONK_VERIFIER]: PublicInputsAndRecursiveProof<
     PublicChonkVerifierPublicInputs,
     typeof NESTED_RECURSIVE_ROLLUP_HONK_PROOF_LENGTH

package/src/interfaces/server_circuit_prover.ts

@@ -1,5 +1,5 @@
 import type {
-  AVM_V2_PROOF_LENGTH_IN_FIELDS_PADDED,
+  AVM_V2_PROOF_LENGTH_IN_FIELDS,
   NESTED_RECURSIVE_PROOF_LENGTH,
   NESTED_RECURSIVE_ROLLUP_HONK_PROOF_LENGTH,
   RECURSIVE_PROOF_LENGTH,
@@ -189,7 +189,7 @@ export interface ServerCircuitProver {
     inputs: AvmCircuitInputs,
     signal?: AbortSignal,
     epochNumber?: number,
-  ): Promise<RecursiveProof<typeof AVM_V2_PROOF_LENGTH_IN_FIELDS_PADDED>>;
+  ): Promise<RecursiveProof<typeof AVM_V2_PROOF_LENGTH_IN_FIELDS>>;
 }
 
 export type IVCProofVerificationResult = {

package/src/kernel/hints/find_private_kernel_reset_dimensions.ts

@@ -1,8 +1,7 @@
-import { isDefined } from '@aztec/foundation/types';
-
 import {
   PrivateKernelResetDimensions,
   type PrivateKernelResetDimensionsConfig,
+  type ResetCatalogEntry,
   privateKernelResetDimensionNames,
 } from '../private_kernel_reset_dimensions.js';
 
@@ -12,13 +11,6 @@ interface DimensionOption {
   remainder?: PrivateKernelResetDimensions;
 }
 
-function computeCost(dimensions: PrivateKernelResetDimensions, config: PrivateKernelResetDimensionsConfig) {
-  return privateKernelResetDimensionNames.reduce(
-    (accum, name) => accum + dimensions[name] * config.dimensions[name].cost,
-    0,
-  );
-}
-
 function getSize(dimensions: PrivateKernelResetDimensions) {
   return privateKernelResetDimensionNames.reduce((accum, name) => accum + dimensions[name], 0);
 }
@@ -38,124 +30,42 @@ function getRemainder(
   return remainingDimensions ? remainder : undefined;
 }
 
-function pickFromValues(targetValue: number, values: number[]) {
-  // Find the min value in `values` that's greater than or equal to `targetValue`.
-  const minGte = values.reduce(
-    (prev: number | undefined, curr) => (curr >= targetValue && (prev === undefined || curr < prev) ? curr : prev),
-    undefined,
-  );
-
-  // If no such value is found, returns the max value.
-  return minGte ?? Math.max(...values);
-}
-
-function pickCheapest(options: DimensionOption[]) {
-  return options.reduce((prev, curr) => (curr.cost < prev.cost ? curr : prev), options[0]);
-}
-
-function pickSmallestRemainder(options: DimensionOption[]) {
-  const optionsWithSize = options
-    .filter(o => o.remainder)
-    .map(option => ({ option, size: getSize(option.remainder!) }));
-  return optionsWithSize.reduce((prev, curr) => (curr.size < prev.size ? curr : prev), optionsWithSize[0])?.option;
-}
-
-function pickBestOption(options: DimensionOption[]) {
-  const optionsResetAll = options.filter(opt => !opt.remainder);
-  const optionsResetPartial = options.filter(opt => opt.remainder);
-  // The best option is the cheapest one that can reset all dimensions.
-  // If no such option exists, find one that can reset the most data.
-  return pickCheapest(optionsResetAll) || pickSmallestRemainder(optionsResetPartial);
-}
-
-function findVariant(
-  requestedDimensions: PrivateKernelResetDimensions,
-  config: PrivateKernelResetDimensionsConfig,
-  isQualified: (dimensions: PrivateKernelResetDimensions) => boolean,
-): DimensionOption | undefined {
-  const variant = PrivateKernelResetDimensions.empty();
-  privateKernelResetDimensionNames.forEach(name => {
-    variant[name] = pickFromValues(requestedDimensions[name], config.dimensions[name].variants);
-  });
-  if (!isQualified(variant)) {
-    return;
+// Returns the cheapest option that fully covers the request, or the option with the smallest
+// remainder if none do. Caller must pass a non-empty list.
+function pickBestOption(options: DimensionOption[]): DimensionOption {
+  const fullCoverage = options.filter(opt => !opt.remainder);
+  if (fullCoverage.length) {
+    return fullCoverage.reduce((prev, curr) => (curr.cost < prev.cost ? curr : prev));
   }
-
-  return {
-    dimensions: variant,
-    cost: computeCost(variant, config),
-    remainder: getRemainder(requestedDimensions, variant),
-  };
+  return options.reduce((prev, curr) => (getSize(curr.remainder!) < getSize(prev.remainder!) ? curr : prev));
 }
 
-function findStandalone(
-  requestedDimensions: PrivateKernelResetDimensions,
-  config: PrivateKernelResetDimensionsConfig,
-  isQualified: (dimensions: PrivateKernelResetDimensions) => boolean,
-): DimensionOption | undefined {
-  const needsReset = privateKernelResetDimensionNames.filter(name => requestedDimensions[name] > 0);
-  if (needsReset.length !== 1) {
-    // At the moment, we only use standalone to reset one dimension when it's about to overflow.
-    return;
-  }
-
-  const name = needsReset[0];
-  const value = pickFromValues(requestedDimensions[name], config.dimensions[name].standalone);
-  if (!value) {
-    return;
-  }
-
-  const dimensions = PrivateKernelResetDimensions.from({ [name]: value });
-  if (!isQualified(dimensions)) {
-    return;
-  }
-
+function buildOption(entry: ResetCatalogEntry, requestedDimensions: PrivateKernelResetDimensions): DimensionOption {
+  const dimensions = PrivateKernelResetDimensions.fromValues(entry.dimensions);
   return {
     dimensions,
-    cost: computeCost(dimensions, config),
+    cost: entry.cost,
     remainder: getRemainder(requestedDimensions, dimensions),
   };
 }
 
-function findSpecialCase(
-  requestedDimensions: PrivateKernelResetDimensions,
-  config: PrivateKernelResetDimensionsConfig,
-  isQualified: (dimensions: PrivateKernelResetDimensions) => boolean,
-): DimensionOption | undefined {
-  const specialCases = config.specialCases.map(PrivateKernelResetDimensions.fromValues);
-  const options = specialCases.filter(isQualified).map(dimensions => ({
-    dimensions,
-    cost: computeCost(dimensions, config),
-    remainder: getRemainder(requestedDimensions, dimensions),
-  }));
-  return pickBestOption(options);
-}
+/**
+ * Picks which catalog group the selector should search. Mid-tx resets go to `inner` (no
+ * siloing); terminal kernels go to `finalTail` or `finalTailToPublic`, depending on whether
+ * the tx has public function calls.
+ */
+export type ResetDimensionsMode = 'inner' | 'finalTail' | 'finalTailToPublic';
 
 export function findPrivateKernelResetDimensions(
   requestedDimensions: PrivateKernelResetDimensions,
   config: PrivateKernelResetDimensionsConfig,
-  isInner = false,
+  mode: ResetDimensionsMode,
   allowRemainder = false,
 ) {
-  const requestedValues = requestedDimensions.toValues();
-  const isEnough = allowRemainder
-    ? () => true
-    : (dimensions: PrivateKernelResetDimensions) => dimensions.toValues().every((v, i) => v >= requestedValues[i]);
-
-  const isQualified = !isInner
-    ? isEnough
-    : // If isInner is true, it's a reset to prevent overflow. The following must be zero because siloing can't be done at the moment.
-      (dimensions: PrivateKernelResetDimensions) =>
-        dimensions.NOTE_HASH_SILOING === 0 &&
-        dimensions.NULLIFIER_SILOING === 0 &&
-        dimensions.PRIVATE_LOG_SILOING === 0 &&
-        isEnough(dimensions);
-
-  const options = [
-    findVariant(requestedDimensions, config, isQualified),
-    findStandalone(requestedDimensions, config, isQualified),
-    findSpecialCase(requestedDimensions, config, isQualified),
-  ].filter(isDefined);
+  const catalog = config[mode];
+  const options = catalog
+    .map(entry => buildOption(entry, requestedDimensions))
+    .filter(option => allowRemainder || !option.remainder);
 
   if (!options.length) {
     throw new Error(`Cannot find an option for dimension: ${requestedDimensions.toValues()}`);

package/src/kernel/index.ts

@@ -14,7 +14,7 @@ export * from './private_kernel_inner_2_circuit_private_inputs.js';
 export * from './private_kernel_inner_3_circuit_private_inputs.js';
 export * from './private_kernel_reset_circuit_private_inputs.js';
 export * from './private_kernel_reset_dimensions.js';
-export * from './private_kernel_tail_circuit_private_inputs.js';
+export * from './private_kernel_reset_tail_circuit_private_inputs.js';
 export * from './private_kernel_tail_circuit_public_inputs.js';
 export * from './private_to_avm_accumulated_data.js';
 export * from './private_to_public_accumulated_data.js';

package/src/kernel/private_circuit_public_inputs.ts

@@ -144,6 +144,11 @@ export class PrivateCircuitPublicInputs {
      * Hash of the contract class logs emitted in this function call.
      */
     public contractClassLogsHashes: ClaimedLengthArray<CountedLogHash, typeof MAX_CONTRACT_CLASS_LOGS_PER_CALL>,
+    /**
+     * The tx request's salt. Keeps `tx_request.hash()` (the protocol nullifier) unpredictable, and lets the init
+     * kernel bind this proof to a specific tx request (it asserts this equals `tx_request.salt`).
+     */
+    public txRequestSalt: Fr,
   ) {}
 
   /**
@@ -188,6 +193,7 @@ export class PrivateCircuitPublicInputs {
       reader.readObject(ClaimedLengthArrayFromBuffer(CountedL2ToL1Message, MAX_L2_TO_L1_MSGS_PER_CALL)),
       reader.readObject(ClaimedLengthArrayFromBuffer(PrivateLogData, MAX_PRIVATE_LOGS_PER_CALL)),
       reader.readObject(ClaimedLengthArrayFromBuffer(CountedLogHash, MAX_CONTRACT_CLASS_LOGS_PER_CALL)),
+      reader.readObject(Fr),
     );
   }
 
@@ -219,6 +225,7 @@ export class PrivateCircuitPublicInputs {
       reader.readObject(ClaimedLengthArrayFromFields(CountedL2ToL1Message, MAX_L2_TO_L1_MSGS_PER_CALL)),
       reader.readObject(ClaimedLengthArrayFromFields(PrivateLogData, MAX_PRIVATE_LOGS_PER_CALL)),
       reader.readObject(ClaimedLengthArrayFromFields(CountedLogHash, MAX_CONTRACT_CLASS_LOGS_PER_CALL)),
+      reader.readField(),
     );
   }
 
@@ -251,6 +258,7 @@ export class PrivateCircuitPublicInputs {
       ClaimedLengthArray.empty(CountedL2ToL1Message, MAX_L2_TO_L1_MSGS_PER_CALL),
       ClaimedLengthArray.empty(PrivateLogData, MAX_PRIVATE_LOGS_PER_CALL),
       ClaimedLengthArray.empty(CountedLogHash, MAX_CONTRACT_CLASS_LOGS_PER_CALL),
+      Fr.ZERO,
     );
   }
 
@@ -278,7 +286,8 @@ export class PrivateCircuitPublicInputs {
       this.nullifiers.isEmpty() &&
       this.l2ToL1Msgs.isEmpty() &&
       this.privateLogs.isEmpty() &&
-      this.contractClassLogsHashes.isEmpty()
+      this.contractClassLogsHashes.isEmpty() &&
+      this.txRequestSalt.isZero()
     );
   }
 
@@ -312,6 +321,7 @@ export class PrivateCircuitPublicInputs {
       fields.l2ToL1Msgs,
       fields.privateLogs,
       fields.contractClassLogsHashes,
+      fields.txRequestSalt,
     ] as const;
   }
 
@@ -346,6 +356,7 @@ export class PrivateCircuitPublicInputs {
       this.l2ToL1Msgs,
       this.privateLogs,
       this.contractClassLogsHashes,
+      this.txRequestSalt,
     ]);
   }
 

package/src/kernel/private_context_inputs.ts

@@ -1,4 +1,4 @@
-import type { Fr } from '@aztec/foundation/curves/bn254';
+import { Fr } from '@aztec/foundation/curves/bn254';
 import { serializeToFields } from '@aztec/foundation/serialize';
 
 import { BlockHeader } from '../tx/block_header.js';
@@ -11,13 +11,20 @@ export class PrivateContextInputs {
     public anchorBlockHeader: BlockHeader,
     public txContext: TxContext,
     public startSideEffectCounter: number,
+    public txRequestSalt: Fr,
   ) {}
 
   public static empty(): PrivateContextInputs {
-    return new PrivateContextInputs(CallContext.empty(), BlockHeader.empty(), TxContext.empty(), 0);
+    return new PrivateContextInputs(CallContext.empty(), BlockHeader.empty(), TxContext.empty(), 0, Fr.ZERO);
   }
 
   public toFields(): Fr[] {
-    return serializeToFields([this.callContext, this.anchorBlockHeader, this.txContext, this.startSideEffectCounter]);
+    return serializeToFields([
+      this.callContext,
+      this.anchorBlockHeader,
+      this.txContext,
+      this.startSideEffectCounter,
+      this.txRequestSalt,
+    ]);
   }
 }

package/src/kernel/private_kernel_circuit_public_inputs.ts

@@ -115,3 +115,12 @@ export class PrivateKernelCircuitPublicInputs {
     );
   }
 }
+
+/**
+ * Returns true iff the tx requires the public-bound terminal path: it has either un-processed
+ * public-call requests in the side-effect stream or a pending public-teardown call request. Every
+ * site picking between the rollup-bound and public-bound terminal artifact must route through this.
+ */
+export function kernelStateIsForPublic(publicInputs: PrivateKernelCircuitPublicInputs): boolean {
+  return publicInputs.end.publicCallRequests.claimedLength > 0 || !publicInputs.publicTeardownCallRequest.isEmpty();
+}

package/src/kernel/private_kernel_init_2_circuit_private_inputs.ts

@@ -17,7 +17,6 @@ export class PrivateKernelInit2CircuitPrivateInputs {
     public privateCall0: PrivateCallData,
     public privateCall1: PrivateCallData,
     public isPrivateOnly: boolean,
-    public firstNullifierHint: Fr,
     public revertibleCounterHint: number,
   ) {}
 
@@ -28,7 +27,6 @@ export class PrivateKernelInit2CircuitPrivateInputs {
       this.protocolContracts,
       this.privateCall0,
       this.privateCall1,
-      this.firstNullifierHint,
       this.revertibleCounterHint,
     );
   }
@@ -42,7 +40,6 @@ export class PrivateKernelInit2CircuitPrivateInputs {
       reader.readObject(PrivateCallData),
       reader.readObject(PrivateCallData),
       reader.readBoolean(),
-      Fr.fromBuffer(reader),
       reader.readNumber(),
     );
   }

package/src/kernel/private_kernel_init_3_circuit_private_inputs.ts

@@ -18,7 +18,6 @@ export class PrivateKernelInit3CircuitPrivateInputs {
     public privateCall1: PrivateCallData,
     public privateCall2: PrivateCallData,
     public isPrivateOnly: boolean,
-    public firstNullifierHint: Fr,
     public revertibleCounterHint: number,
   ) {}
 
@@ -30,7 +29,6 @@ export class PrivateKernelInit3CircuitPrivateInputs {
       this.privateCall0,
       this.privateCall1,
       this.privateCall2,
-      this.firstNullifierHint,
       this.revertibleCounterHint,
     );
   }
@@ -45,7 +43,6 @@ export class PrivateKernelInit3CircuitPrivateInputs {
       reader.readObject(PrivateCallData),
       reader.readObject(PrivateCallData),
       reader.readBoolean(),
-      Fr.fromBuffer(reader),
       reader.readNumber(),
     );
   }