shares

a share is one hash. the input is the trade signature, the intent hash, the shielded identifier and a nonce, in that order, 136 bytes. the output is 32 bytes, read as one unsigned number. if that number is below the target of the chain the fill landed on, the share is valid. the solver's work is finding the nonce. the program's work is recomputing the hash with the blake3 syscall and comparing.

the share hash is also the share's name. the next accepted share, on either chain, stores this hash as its prev. the fill chain is that list of names. it has no blocks and no timestamps, only order.

every accepted share is appended to an incremental merkle tree of depth 32 held in the program's state account. the root after each append is written to the share. anyone with the list of share hashes in order can rebuild the tree and arrive at the same root.