Proof.

Server wallet

Batches

How to verify a receipt

1. The leaf for one burned note:
   leaf = sha256( id(16 bytes) || sha256(ct bytes) || uint64be(burnedAt seconds) || kind ), with kind 0x01 if the reader opened it and 0x02 if it expired unread.
2. Walk the proof from the leaf with sorted pairs:
   parent = sha256( min(a,b) || max(a,b) ) for each sibling hash in the proof. An odd last node in a level is promoted unchanged, and a batch with one leaf has root = leaf. No left/right flags are needed.
3. The result must equal the batch root.
4. On the explorer, open the batch transaction. It is a zero-value transaction from the server wallet to itself, and its input data is the UTF-8 text ONCEINK:v1:<root> with the root as 64 lowercase hex characters.

Check a receipt here

Paste a receipt id (or the whole /r/… link). This page fetches the receipt, recomputes the root from the leaf and the proof with WebCrypto, and compares it to the batch root.