feat: add tx effects tree root to the block header

[spalladino]

Context

Proving that a note (or any effect) belonged to a given tx from a block header currently requires replaying the checkpoint's sponge blob over every tx's effect data — up to 24,576 fields of preimage. This adds a per-block commitment so "tx X was included in block N and produced exactly effects E" is provable with a handful of hashes (≤16 worst case), revealing only the field of interest.

Design

Tx effect hash (structured, not flat). Each variable-length field of the tx effect is hashed on its own over its slice of the existing blob-field encoding (create_tx_blob_data / TxEffect.toBlobFields), at its actual runtime length — no new serialization format:

sub_<field>    = poseidon2(DOM_SEP__TX_EFFECT_FIELD_HASH, <field's blob-encoding slice>)
                 // note_hashes, nullifiers, l2_to_l1_msgs, public_data_writes,
                 // private_logs, public_logs, contract_class_logs; 0 if the field is empty

tx_effect_hash = poseidon2(DOM_SEP__TX_EFFECT_HASH,
                   [tx_start_marker, transaction_fee, ...the 7 sub-hashes])   // 9 fields

leaf           = poseidon2(DOM_SEP__TX_EFFECT_LEAF, [tx_hash, tx_effect_hash])

The tx_start_marker is the existing first blob field, which packs the revert code, every array count, and the total field count — so all lengths are bound and the 0 empty-field sentinel is unambiguous. Structuring the hash this way keeps selective proofs cheap: proving one note hash needs only the note-hashes slice as preimage, with the other six sub-hashes as opaque witness values.

Tree shape. The leaves are accumulated bottom-up through the existing rollup proving tree: tx base emits the leaf, tx merge combines pairwise with poseidon2(DOM_SEP__TX_EFFECTS_TREE, [left, right]), with no zero-skipping (there are no padding txs, so every leaf is a real tx). The result is the same greedily-filled wonky tree as the proving tree itself, whose shape is pinned in-circuit by assert_rollups_filled_greedily — a pure function of the tx count, so the prover has no freedom over it (e.g. 3 txs → H(H(l0,l1),l2), 5 txs → H(H(H(l0,l1),H(l2,l3)),l4)). An empty block has root 0; a single-tx block's root is the leaf, unhashed. Leaves and internal nodes use different domain separators, so no leaf/node second-preimage confusion is possible.

Header position. tx_effects_tree_root sits immediately after sponge_blob_hash (both are effect commitments), growing BLOCK_HEADER_LENGTH from 22 to 23:

last_archive | state | sponge_blob_hash | tx_effects_tree_root | global_variables | total_fees | total_mana_used

Approach

• Leaf computed in the tx base circuits from the same per-field blob-encoding slices absorbed into the sponge blob (the slice builders were factored so both consumers share one definition); accumulated through tx merge; block root writes the value into the header. The root is deliberately not exposed in BlockRollupPublicInputs, checkpoint PIs, or L1 — it is committed via the header hash only, and TS recomputes it locally wherever headers are assembled (prover builders, archiver blob reconstruction, TXE).
• TS mirrors: TxEffect.computeTxEffectHash/Leaf, Body.computeTxEffectsTreeRoot. Cross-language test vectors pin TS↔Noir (empty header hash, tx effect leaf) and C++↔Noir (genesis header hash).
• The private-logs blob slice is built by an unconstrained hint verified with read-only accesses: constructing it in-circuit produced a bb RAM block with ~72k accesses, over the 65,535 small-range-constraint cap, aborting write_vk.

API changes

New node API for consuming the root: getTxEffectMembershipWitness(txHash) returns { blockNumber, root, leafIndex, siblingPath } — a variable-depth witness against BlockHeader.txEffectsTreeRoot. The archiver computes each block's leaves once at sync time and persists them (atomically with the block row; ARCHIVER_DB_VERSION 7 → 8), so answering a witness request only rebuilds the internal nodes from stored leaves, verifies the root against the stored header, and checks the requested tx's own leaf against the effects it serves. UnbalancedMerkleTreeCalculator gained an async-hasher factory (createAsync) for the poseidon tree.

Breaking changes

• BLOCK_HEADER_LENGTH 22 → 23, so every tx hash, VK, contract artifact, and the genesis constants change. Oracle interface version 30 → 31 (the block header oracle return type grew); PXE data schema version 13 → 14 (pre-existing PXE DBs are re-initialized on next open). Migration note included.
• Mainnet/testnet compatibility pins updated to the new VK tree root, protocol contracts hash, and genesis archive roots, following the precedent of previous protocol-breaking PRs.
• The pinned protocol/mock circuit builds were removed (stale after this change). The standard-contracts pin is untouched and its bytecode is now ABI-incompatible (the pinned contracts predate the header change), so e2e cannot pass until the standard contracts are re-pinned and redeployed — that is a deliberate, separate human decision.
• Circuit sample inputs (Prover.toml) updated; all fixtures in CI's execute list pass locally. private-kernel-init-simulated's fixture (not executed by CI) remains stale pending the e2e regeneration path.

Fixes A-1635