A mixed-domain tagged Merkle proof fused the main unspent-output path and the slot-reuse guard into one relation. Proof size fell from 29.69 to 23.75 KB, while proving rose from 2.68 to 4.50 seconds and verification from 450.82 to 612.96 milliseconds. The fused construction was removed after measurement.
Can two Merkle relations share one proof?
State is the authenticated set of current unspent transaction outputs (UTXOs) and consensus counters. A UTXO path authenticates one such output in the main State tree. A reuse-guard path authenticates a second tree that, in the tested design, prevented a recently freed physical slot from being assigned again too early. Both were fixed-depth binary Merkle paths, and both were checked while proving the exact transition from one State root to the next. A tagged mixed-domain construction fused them into one larger multilinear trace.
The hypothesis was straightforward: shared algebra and one proof envelope should reduce proof bytes without materially changing proving cost.
Measured comparison
| Construction | Proof | Prove | Verify |
|---|---|---|---|
| Two domain-specific proofs | 29.69 KB | 2.68 s | 450.82 ms |
| One fused tagged proof | 23.75 KB | 4.50 s | 612.96 ms |
Fusion reduced bytes by 20.0%, but proving became 67.9% slower and verification 36.0% slower.
Why the smaller proof was slower
The fused construction created one larger multilinear extension (MLE): a polynomial representation of the combined trace over a Boolean domain. Sumcheck work grew with the enlarged domain, while the two independent proofs had executed in parallel. The byte saving came from sharing the proof envelope; the time regression came from losing domain separation and parallelism.
The fused relation was removed after measurement. Exact-State proving kept two domain-specific Merkle proofs.
Reusable conclusion
Proof size is not a reliable proxy for proof-system cost. Before fusing relations, measure the larger multilinear extension, sumcheck degree and lost scheduling parallelism. A 20% smaller serialized proof was a poor exchange for 68% more prover time on this workload.